xmrig | 1775e1913eb099e04a99533f52df5b9f7ca5a7958c1c7088b2bf213c199c213e

Analysis

max time kernel
114s
max time network
20s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7767547c78e3fb47faa307ab1a604f60N.exe
Size

1.2MB
MD5

7767547c78e3fb47faa307ab1a604f60
SHA1

63c8d31998c9373a5d091b4d427787d05c420c8c
SHA256

1775e1913eb099e04a99533f52df5b9f7ca5a7958c1c7088b2bf213c199c213e
SHA512

ee0ecc43f2109fe45005ec0c31f573890b2f5767c44c462310ba9c63e40ae294b2d7f4bd368750cc6db4a4a739c6fd34c63494beeb346de1517ec58ebdf81215
SSDEEP

24576:RVIl/WDGCi7/qkat6zqxG2Z9mIhQvq8wd7sNE6phFr56Ozq6gY71s+KVf6Q9R:ROdWCCi7/raWMmSdp2P5v3PSfh9R

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/2676-21-0x000000013F020000-0x000000013F371000-memory.dmp	xmrig
behavioral1/memory/2608-74-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2984-77-0x000000013F5F0000-0x000000013F941000-memory.dmp	xmrig
behavioral1/memory/2728-81-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2544-82-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/2644-78-0x000000013FF90000-0x00000001402E1000-memory.dmp	xmrig
behavioral1/memory/2720-76-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2156-75-0x000000013F900000-0x000000013FC51000-memory.dmp	xmrig
behavioral1/memory/2772-102-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/2680-87-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2676-606-0x000000013F020000-0x000000013F371000-memory.dmp	xmrig
behavioral1/memory/2712-1087-0x000000013FF50000-0x00000001402A1000-memory.dmp	xmrig
behavioral1/memory/1036-1086-0x000000013FDD0000-0x0000000140121000-memory.dmp	xmrig
behavioral1/memory/2812-1706-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2856-2525-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/1276-2698-0x000000013FBB0000-0x000000013FF01000-memory.dmp	xmrig
behavioral1/memory/2644-2961-0x000000013FA30000-0x000000013FD81000-memory.dmp	xmrig
behavioral1/memory/2772-3722-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/2680-3743-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/1036-3764-0x000000013FDD0000-0x0000000140121000-memory.dmp	xmrig
behavioral1/memory/2608-3770-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2156-3769-0x000000013F900000-0x000000013FC51000-memory.dmp	xmrig
behavioral1/memory/2728-3767-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2812-3773-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2984-3785-0x000000013F5F0000-0x000000013F941000-memory.dmp	xmrig
behavioral1/memory/2720-3787-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2676-3796-0x000000013F020000-0x000000013F371000-memory.dmp	xmrig
behavioral1/memory/2544-3781-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/2712-3779-0x000000013FF50000-0x00000001402A1000-memory.dmp	xmrig
behavioral1/memory/1276-3812-0x000000013FBB0000-0x000000013FF01000-memory.dmp	xmrig
behavioral1/memory/2856-3808-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2680	UgXVGzN.exe
2772	qsBjbvk.exe
2676	bUhnxeh.exe
1036	LPyBerc.exe
2712	pQCyPrD.exe
2728	tjeBEke.exe
2812	Alvgtlx.exe
2608	LxUermC.exe
2156	DEmZDIm.exe
2720	zyahFGJ.exe
2544	jUhgzdQ.exe
2984	zOqyTBZ.exe
2856	pctDiwH.exe
1276	qDWMuJO.exe
2032	AEZsGsy.exe
1332	bmUboAh.exe
1520	HWOvuqZ.exe
1800	WsDqsBT.exe
1868	wXAkEVO.exe
2836	cBXjsTB.exe
1828	UuicjVp.exe
340	XNIkKyO.exe
888	vmRmMyK.exe
1988	ajhkGpz.exe
2912	vjvThmR.exe
3060	RUDdEkh.exe
2168	ImuPvFY.exe
2072	XohCihN.exe
2040	uXCslpa.exe
2928	QIGzCNb.exe
1016	NeSRazq.exe
1576	SYbeXIJ.exe
2968	eJSOFXR.exe
704	bGMfTqp.exe
1796	PHJaHbx.exe
836	ltixUot.exe
1720	sBPSXZB.exe
956	SafPVHP.exe
796	AzsTFnj.exe
1436	UQNHhlD.exe
1968	PLmAKps.exe
1060	YDEUfBZ.exe
1616	eCZNNCk.exe
1368	bkifBxK.exe
2128	XgJsmlV.exe
2208	mnDlxDF.exe
864	mluXsvT.exe
1156	UeOzNBY.exe
2148	bvorKtS.exe
2448	VagrCTk.exe
1760	yvakUeS.exe
884	JcMMEZc.exe
2412	YxkjxqV.exe
2416	mlqCSEb.exe
2300	kMRlkPM.exe
1604	wJYkAfp.exe
2700	NBowmkL.exe
2708	VkGyaYd.exe
2692	qYbJbjX.exe
2684	oXNtGpW.exe
2652	UWBwYAW.exe
2824	KCcHnQk.exe
2688	cTWYOlY.exe
2672	rrbbnbR.exe

Loads dropped DLL 64 IoCs

pid	Process
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe
2644	7767547c78e3fb47faa307ab1a604f60N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2644-0-0x000000013FF90000-0x00000001402E1000-memory.dmp	upx
behavioral1/files/0x000b0000000120dc-3.dat	upx
behavioral1/memory/2680-7-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/files/0x0009000000015d18-9.dat	upx
behavioral1/memory/2772-15-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/files/0x0008000000015d29-11.dat	upx
behavioral1/memory/2676-21-0x000000013F020000-0x000000013F371000-memory.dmp	upx
behavioral1/files/0x0007000000015d52-22.dat	upx
behavioral1/files/0x000600000001907c-52.dat	upx
behavioral1/files/0x0006000000018741-61.dat	upx
behavioral1/memory/2608-74-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2984-77-0x000000013F5F0000-0x000000013F941000-memory.dmp	upx
behavioral1/memory/2728-81-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2544-82-0x000000013FED0000-0x0000000140221000-memory.dmp	upx
behavioral1/memory/2644-78-0x000000013FF90000-0x00000001402E1000-memory.dmp	upx
behavioral1/memory/2720-76-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/2156-75-0x000000013F900000-0x000000013FC51000-memory.dmp	upx
behavioral1/memory/2812-72-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/files/0x0006000000018636-67.dat	upx
behavioral1/files/0x0007000000015f6d-63.dat	upx
behavioral1/files/0x0006000000019080-62.dat	upx
behavioral1/memory/1276-95-0x000000013FBB0000-0x000000013FF01000-memory.dmp	upx
behavioral1/files/0x000500000001919c-83.dat	upx
behavioral1/memory/2856-89-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2772-102-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/files/0x00050000000191ad-100.dat	upx
behavioral1/memory/2680-87-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/files/0x002a000000015cca-93.dat	upx
behavioral1/files/0x0009000000015fe0-60.dat	upx
behavioral1/files/0x0007000000015ef7-59.dat	upx
behavioral1/files/0x0007000000015d66-33.dat	upx
behavioral1/memory/2712-39-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx
behavioral1/memory/1036-30-0x000000013FDD0000-0x0000000140121000-memory.dmp	upx
behavioral1/files/0x00050000000191cf-104.dat	upx
behavioral1/files/0x00050000000191df-108.dat	upx
behavioral1/files/0x00050000000191f8-112.dat	upx
behavioral1/files/0x0005000000019219-120.dat	upx
behavioral1/files/0x0005000000019232-132.dat	upx
behavioral1/files/0x0005000000019214-116.dat	upx
behavioral1/files/0x0005000000019345-145.dat	upx
behavioral1/files/0x000500000001921d-125.dat	upx
behavioral1/files/0x0005000000019329-138.dat	upx
behavioral1/files/0x0005000000019369-149.dat	upx
behavioral1/files/0x0005000000019382-165.dat	upx
behavioral1/files/0x000500000001937b-159.dat	upx
behavioral1/files/0x00050000000193e6-186.dat	upx
behavioral1/files/0x00050000000193d1-181.dat	upx
behavioral1/files/0x000500000001938e-172.dat	upx
behavioral1/files/0x00050000000193a8-176.dat	upx
behavioral1/memory/2644-166-0x0000000001E70000-0x00000000021C1000-memory.dmp	upx
behavioral1/files/0x0005000000019371-154.dat	upx
behavioral1/memory/2676-606-0x000000013F020000-0x000000013F371000-memory.dmp	upx
behavioral1/memory/2712-1087-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx
behavioral1/memory/1036-1086-0x000000013FDD0000-0x0000000140121000-memory.dmp	upx
behavioral1/memory/2812-1706-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2856-2525-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/1276-2698-0x000000013FBB0000-0x000000013FF01000-memory.dmp	upx
behavioral1/memory/2772-3722-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/memory/2680-3743-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/1036-3764-0x000000013FDD0000-0x0000000140121000-memory.dmp	upx
behavioral1/memory/2608-3770-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2156-3769-0x000000013F900000-0x000000013FC51000-memory.dmp	upx
behavioral1/memory/2728-3767-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2812-3773-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DHrEwgV.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\biwcqRY.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\UpRIKQg.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\jPmjhHQ.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\OSYkmvv.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\wafomiP.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\wRpIYiL.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\EGMLXwH.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\VedJvQN.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\NHTDOvE.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\zKPzjXe.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\NNTTEOB.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\nueBYBc.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\huwrPFc.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\AEopsTO.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\KYCidfv.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\mGjgWaL.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\guhxxVS.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\jUhgzdQ.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\sHOqRPg.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\YDdDEIp.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\nWzdJzK.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\pioNcuD.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\fzkxRwY.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\PhSWQgo.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\scxrVRo.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\kUbJrbB.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\pQeNPLF.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\zplXuYI.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\AYOomRC.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\hEuaJOk.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\uPSocwH.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\VetRofM.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\QFSgToR.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\vMNvyng.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\bkifBxK.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\wiXodqy.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\YtGoOdJ.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\qWilfMh.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\LOKCtJC.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\fsbxTAd.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\EdQzVHZ.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\WmTCWlO.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\gmxKvAS.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\yVNfyMP.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\YsyEmXV.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\jmSYuPE.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\lXokJDp.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\EBOeqtm.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\VjjhAZk.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\sBPSXZB.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\SafPVHP.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\JyphoYo.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\PqdXsaR.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\wREpkip.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\tqVIuFA.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\HVBOLiN.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\MIdNryn.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\YrLQeeg.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\lrlcWKW.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\JrpqSPX.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\IAAJTls.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\BuECvFJ.exe	7767547c78e3fb47faa307ab1a604f60N.exe
File created	C:\Windows\System\canpFAr.exe	7767547c78e3fb47faa307ab1a604f60N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2680	2644	7767547c78e3fb47faa307ab1a604f60N.exe	31
PID 2644 wrote to memory of 2680	2644	7767547c78e3fb47faa307ab1a604f60N.exe	31
PID 2644 wrote to memory of 2680	2644	7767547c78e3fb47faa307ab1a604f60N.exe	31
PID 2644 wrote to memory of 2772	2644	7767547c78e3fb47faa307ab1a604f60N.exe	32
PID 2644 wrote to memory of 2772	2644	7767547c78e3fb47faa307ab1a604f60N.exe	32
PID 2644 wrote to memory of 2772	2644	7767547c78e3fb47faa307ab1a604f60N.exe	32
PID 2644 wrote to memory of 2676	2644	7767547c78e3fb47faa307ab1a604f60N.exe	33
PID 2644 wrote to memory of 2676	2644	7767547c78e3fb47faa307ab1a604f60N.exe	33
PID 2644 wrote to memory of 2676	2644	7767547c78e3fb47faa307ab1a604f60N.exe	33
PID 2644 wrote to memory of 1036	2644	7767547c78e3fb47faa307ab1a604f60N.exe	34
PID 2644 wrote to memory of 1036	2644	7767547c78e3fb47faa307ab1a604f60N.exe	34
PID 2644 wrote to memory of 1036	2644	7767547c78e3fb47faa307ab1a604f60N.exe	34
PID 2644 wrote to memory of 2712	2644	7767547c78e3fb47faa307ab1a604f60N.exe	35
PID 2644 wrote to memory of 2712	2644	7767547c78e3fb47faa307ab1a604f60N.exe	35
PID 2644 wrote to memory of 2712	2644	7767547c78e3fb47faa307ab1a604f60N.exe	35
PID 2644 wrote to memory of 2728	2644	7767547c78e3fb47faa307ab1a604f60N.exe	36
PID 2644 wrote to memory of 2728	2644	7767547c78e3fb47faa307ab1a604f60N.exe	36
PID 2644 wrote to memory of 2728	2644	7767547c78e3fb47faa307ab1a604f60N.exe	36
PID 2644 wrote to memory of 2720	2644	7767547c78e3fb47faa307ab1a604f60N.exe	37
PID 2644 wrote to memory of 2720	2644	7767547c78e3fb47faa307ab1a604f60N.exe	37
PID 2644 wrote to memory of 2720	2644	7767547c78e3fb47faa307ab1a604f60N.exe	37
PID 2644 wrote to memory of 2812	2644	7767547c78e3fb47faa307ab1a604f60N.exe	38
PID 2644 wrote to memory of 2812	2644	7767547c78e3fb47faa307ab1a604f60N.exe	38
PID 2644 wrote to memory of 2812	2644	7767547c78e3fb47faa307ab1a604f60N.exe	38
PID 2644 wrote to memory of 2544	2644	7767547c78e3fb47faa307ab1a604f60N.exe	39
PID 2644 wrote to memory of 2544	2644	7767547c78e3fb47faa307ab1a604f60N.exe	39
PID 2644 wrote to memory of 2544	2644	7767547c78e3fb47faa307ab1a604f60N.exe	39
PID 2644 wrote to memory of 2608	2644	7767547c78e3fb47faa307ab1a604f60N.exe	40
PID 2644 wrote to memory of 2608	2644	7767547c78e3fb47faa307ab1a604f60N.exe	40
PID 2644 wrote to memory of 2608	2644	7767547c78e3fb47faa307ab1a604f60N.exe	40
PID 2644 wrote to memory of 2984	2644	7767547c78e3fb47faa307ab1a604f60N.exe	41
PID 2644 wrote to memory of 2984	2644	7767547c78e3fb47faa307ab1a604f60N.exe	41
PID 2644 wrote to memory of 2984	2644	7767547c78e3fb47faa307ab1a604f60N.exe	41
PID 2644 wrote to memory of 2156	2644	7767547c78e3fb47faa307ab1a604f60N.exe	42
PID 2644 wrote to memory of 2156	2644	7767547c78e3fb47faa307ab1a604f60N.exe	42
PID 2644 wrote to memory of 2156	2644	7767547c78e3fb47faa307ab1a604f60N.exe	42
PID 2644 wrote to memory of 2856	2644	7767547c78e3fb47faa307ab1a604f60N.exe	43
PID 2644 wrote to memory of 2856	2644	7767547c78e3fb47faa307ab1a604f60N.exe	43
PID 2644 wrote to memory of 2856	2644	7767547c78e3fb47faa307ab1a604f60N.exe	43
PID 2644 wrote to memory of 1276	2644	7767547c78e3fb47faa307ab1a604f60N.exe	44
PID 2644 wrote to memory of 1276	2644	7767547c78e3fb47faa307ab1a604f60N.exe	44
PID 2644 wrote to memory of 1276	2644	7767547c78e3fb47faa307ab1a604f60N.exe	44
PID 2644 wrote to memory of 2032	2644	7767547c78e3fb47faa307ab1a604f60N.exe	45
PID 2644 wrote to memory of 2032	2644	7767547c78e3fb47faa307ab1a604f60N.exe	45
PID 2644 wrote to memory of 2032	2644	7767547c78e3fb47faa307ab1a604f60N.exe	45
PID 2644 wrote to memory of 1332	2644	7767547c78e3fb47faa307ab1a604f60N.exe	46
PID 2644 wrote to memory of 1332	2644	7767547c78e3fb47faa307ab1a604f60N.exe	46
PID 2644 wrote to memory of 1332	2644	7767547c78e3fb47faa307ab1a604f60N.exe	46
PID 2644 wrote to memory of 1520	2644	7767547c78e3fb47faa307ab1a604f60N.exe	47
PID 2644 wrote to memory of 1520	2644	7767547c78e3fb47faa307ab1a604f60N.exe	47
PID 2644 wrote to memory of 1520	2644	7767547c78e3fb47faa307ab1a604f60N.exe	47
PID 2644 wrote to memory of 1800	2644	7767547c78e3fb47faa307ab1a604f60N.exe	48
PID 2644 wrote to memory of 1800	2644	7767547c78e3fb47faa307ab1a604f60N.exe	48
PID 2644 wrote to memory of 1800	2644	7767547c78e3fb47faa307ab1a604f60N.exe	48
PID 2644 wrote to memory of 1868	2644	7767547c78e3fb47faa307ab1a604f60N.exe	49
PID 2644 wrote to memory of 1868	2644	7767547c78e3fb47faa307ab1a604f60N.exe	49
PID 2644 wrote to memory of 1868	2644	7767547c78e3fb47faa307ab1a604f60N.exe	49
PID 2644 wrote to memory of 2836	2644	7767547c78e3fb47faa307ab1a604f60N.exe	50
PID 2644 wrote to memory of 2836	2644	7767547c78e3fb47faa307ab1a604f60N.exe	50
PID 2644 wrote to memory of 2836	2644	7767547c78e3fb47faa307ab1a604f60N.exe	50
PID 2644 wrote to memory of 340	2644	7767547c78e3fb47faa307ab1a604f60N.exe	51
PID 2644 wrote to memory of 340	2644	7767547c78e3fb47faa307ab1a604f60N.exe	51
PID 2644 wrote to memory of 340	2644	7767547c78e3fb47faa307ab1a604f60N.exe	51
PID 2644 wrote to memory of 1828	2644	7767547c78e3fb47faa307ab1a604f60N.exe	52

C:\Users\Admin\AppData\Local\Temp\7767547c78e3fb47faa307ab1a604f60N.exe
"C:\Users\Admin\AppData\Local\Temp\7767547c78e3fb47faa307ab1a604f60N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System\UgXVGzN.exe
  C:\Windows\System\UgXVGzN.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\qsBjbvk.exe
  C:\Windows\System\qsBjbvk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\bUhnxeh.exe
  C:\Windows\System\bUhnxeh.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\LPyBerc.exe
  C:\Windows\System\LPyBerc.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\pQCyPrD.exe
  C:\Windows\System\pQCyPrD.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\tjeBEke.exe
  C:\Windows\System\tjeBEke.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zyahFGJ.exe
  C:\Windows\System\zyahFGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\Alvgtlx.exe
  C:\Windows\System\Alvgtlx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\jUhgzdQ.exe
  C:\Windows\System\jUhgzdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\LxUermC.exe
  C:\Windows\System\LxUermC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\zOqyTBZ.exe
  C:\Windows\System\zOqyTBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\DEmZDIm.exe
  C:\Windows\System\DEmZDIm.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\pctDiwH.exe
  C:\Windows\System\pctDiwH.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\qDWMuJO.exe
  C:\Windows\System\qDWMuJO.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\AEZsGsy.exe
  C:\Windows\System\AEZsGsy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\bmUboAh.exe
  C:\Windows\System\bmUboAh.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\HWOvuqZ.exe
  C:\Windows\System\HWOvuqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\WsDqsBT.exe
  C:\Windows\System\WsDqsBT.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\wXAkEVO.exe
  C:\Windows\System\wXAkEVO.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\cBXjsTB.exe
  C:\Windows\System\cBXjsTB.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\XNIkKyO.exe
  C:\Windows\System\XNIkKyO.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\UuicjVp.exe
  C:\Windows\System\UuicjVp.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\vmRmMyK.exe
  C:\Windows\System\vmRmMyK.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ajhkGpz.exe
  C:\Windows\System\ajhkGpz.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\vjvThmR.exe
  C:\Windows\System\vjvThmR.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\RUDdEkh.exe
  C:\Windows\System\RUDdEkh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\ImuPvFY.exe
  C:\Windows\System\ImuPvFY.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XohCihN.exe
  C:\Windows\System\XohCihN.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\uXCslpa.exe
  C:\Windows\System\uXCslpa.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\QIGzCNb.exe
  C:\Windows\System\QIGzCNb.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\NeSRazq.exe
  C:\Windows\System\NeSRazq.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\SYbeXIJ.exe
  C:\Windows\System\SYbeXIJ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\eJSOFXR.exe
  C:\Windows\System\eJSOFXR.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\bGMfTqp.exe
  C:\Windows\System\bGMfTqp.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\PHJaHbx.exe
  C:\Windows\System\PHJaHbx.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ltixUot.exe
  C:\Windows\System\ltixUot.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\sBPSXZB.exe
  C:\Windows\System\sBPSXZB.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\SafPVHP.exe
  C:\Windows\System\SafPVHP.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\AzsTFnj.exe
  C:\Windows\System\AzsTFnj.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UQNHhlD.exe
  C:\Windows\System\UQNHhlD.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\PLmAKps.exe
  C:\Windows\System\PLmAKps.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\YDEUfBZ.exe
  C:\Windows\System\YDEUfBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\eCZNNCk.exe
  C:\Windows\System\eCZNNCk.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\bkifBxK.exe
  C:\Windows\System\bkifBxK.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\XgJsmlV.exe
  C:\Windows\System\XgJsmlV.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\mnDlxDF.exe
  C:\Windows\System\mnDlxDF.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\mluXsvT.exe
  C:\Windows\System\mluXsvT.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\UeOzNBY.exe
  C:\Windows\System\UeOzNBY.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\bvorKtS.exe
  C:\Windows\System\bvorKtS.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\VagrCTk.exe
  C:\Windows\System\VagrCTk.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\yvakUeS.exe
  C:\Windows\System\yvakUeS.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\JcMMEZc.exe
  C:\Windows\System\JcMMEZc.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\YxkjxqV.exe
  C:\Windows\System\YxkjxqV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\mlqCSEb.exe
  C:\Windows\System\mlqCSEb.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\kMRlkPM.exe
  C:\Windows\System\kMRlkPM.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\wJYkAfp.exe
  C:\Windows\System\wJYkAfp.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\NBowmkL.exe
  C:\Windows\System\NBowmkL.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\VkGyaYd.exe
  C:\Windows\System\VkGyaYd.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\qYbJbjX.exe
  C:\Windows\System\qYbJbjX.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\oXNtGpW.exe
  C:\Windows\System\oXNtGpW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KCcHnQk.exe
  C:\Windows\System\KCcHnQk.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\UWBwYAW.exe
  C:\Windows\System\UWBwYAW.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\cTWYOlY.exe
  C:\Windows\System\cTWYOlY.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\rrbbnbR.exe
  C:\Windows\System\rrbbnbR.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\AlAzoHf.exe
  C:\Windows\System\AlAzoHf.exe
  2⤵
  PID:2568
- C:\Windows\System\oBnmfQm.exe
  C:\Windows\System\oBnmfQm.exe
  2⤵
  PID:772
- C:\Windows\System\aCtLRWk.exe
  C:\Windows\System\aCtLRWk.exe
  2⤵
  PID:1324
- C:\Windows\System\WcxNGSR.exe
  C:\Windows\System\WcxNGSR.exe
  2⤵
  PID:2668
- C:\Windows\System\RdvGtla.exe
  C:\Windows\System\RdvGtla.exe
  2⤵
  PID:2960
- C:\Windows\System\qfMWqCf.exe
  C:\Windows\System\qfMWqCf.exe
  2⤵
  PID:3024
- C:\Windows\System\hFschcf.exe
  C:\Windows\System\hFschcf.exe
  2⤵
  PID:2872
- C:\Windows\System\mccjTBo.exe
  C:\Windows\System\mccjTBo.exe
  2⤵
  PID:792
- C:\Windows\System\MtHYymc.exe
  C:\Windows\System\MtHYymc.exe
  2⤵
  PID:2624
- C:\Windows\System\CnlFYXR.exe
  C:\Windows\System\CnlFYXR.exe
  2⤵
  PID:1316
- C:\Windows\System\lcmybQG.exe
  C:\Windows\System\lcmybQG.exe
  2⤵
  PID:1496
- C:\Windows\System\BFTsyWw.exe
  C:\Windows\System\BFTsyWw.exe
  2⤵
  PID:584
- C:\Windows\System\iwUVDYT.exe
  C:\Windows\System\iwUVDYT.exe
  2⤵
  PID:1952
- C:\Windows\System\TOcTMHR.exe
  C:\Windows\System\TOcTMHR.exe
  2⤵
  PID:764
- C:\Windows\System\xGJktAR.exe
  C:\Windows\System\xGJktAR.exe
  2⤵
  PID:2028
- C:\Windows\System\GignoRg.exe
  C:\Windows\System\GignoRg.exe
  2⤵
  PID:2620
- C:\Windows\System\ndSNEXf.exe
  C:\Windows\System\ndSNEXf.exe
  2⤵
  PID:1660
- C:\Windows\System\SPSVlma.exe
  C:\Windows\System\SPSVlma.exe
  2⤵
  PID:1672
- C:\Windows\System\GZeePbj.exe
  C:\Windows\System\GZeePbj.exe
  2⤵
  PID:2816
- C:\Windows\System\qbtmDNM.exe
  C:\Windows\System\qbtmDNM.exe
  2⤵
  PID:2932
- C:\Windows\System\XfQedmh.exe
  C:\Windows\System\XfQedmh.exe
  2⤵
  PID:2140
- C:\Windows\System\qckOCdD.exe
  C:\Windows\System\qckOCdD.exe
  2⤵
  PID:1864
- C:\Windows\System\CZYwqap.exe
  C:\Windows\System\CZYwqap.exe
  2⤵
  PID:2036
- C:\Windows\System\qXuvqon.exe
  C:\Windows\System\qXuvqon.exe
  2⤵
  PID:1544
- C:\Windows\System\xoShxNb.exe
  C:\Windows\System\xoShxNb.exe
  2⤵
  PID:408
- C:\Windows\System\HzawoSW.exe
  C:\Windows\System\HzawoSW.exe
  2⤵
  PID:1752
- C:\Windows\System\AHPvhhi.exe
  C:\Windows\System\AHPvhhi.exe
  2⤵
  PID:1540
- C:\Windows\System\KdMWXOo.exe
  C:\Windows\System\KdMWXOo.exe
  2⤵
  PID:1700
- C:\Windows\System\QEqqzUU.exe
  C:\Windows\System\QEqqzUU.exe
  2⤵
  PID:1876
- C:\Windows\System\jUNYSWv.exe
  C:\Windows\System\jUNYSWv.exe
  2⤵
  PID:1972
- C:\Windows\System\eXpaOgV.exe
  C:\Windows\System\eXpaOgV.exe
  2⤵
  PID:2516
- C:\Windows\System\eJSZLok.exe
  C:\Windows\System\eJSZLok.exe
  2⤵
  PID:1976
- C:\Windows\System\BpIEKrJ.exe
  C:\Windows\System\BpIEKrJ.exe
  2⤵
  PID:2244
- C:\Windows\System\xgxoTMn.exe
  C:\Windows\System\xgxoTMn.exe
  2⤵
  PID:2476
- C:\Windows\System\yWzwoYa.exe
  C:\Windows\System\yWzwoYa.exe
  2⤵
  PID:2744
- C:\Windows\System\TJrKAEw.exe
  C:\Windows\System\TJrKAEw.exe
  2⤵
  PID:2844
- C:\Windows\System\BgIZcWu.exe
  C:\Windows\System\BgIZcWu.exe
  2⤵
  PID:2924
- C:\Windows\System\OZnduqD.exe
  C:\Windows\System\OZnduqD.exe
  2⤵
  PID:1756
- C:\Windows\System\rItRzXu.exe
  C:\Windows\System\rItRzXu.exe
  2⤵
  PID:3032
- C:\Windows\System\jPlooyN.exe
  C:\Windows\System\jPlooyN.exe
  2⤵
  PID:2344
- C:\Windows\System\JyribQV.exe
  C:\Windows\System\JyribQV.exe
  2⤵
  PID:2408
- C:\Windows\System\VLOpbNS.exe
  C:\Windows\System\VLOpbNS.exe
  2⤵
  PID:2008
- C:\Windows\System\WSVEjVC.exe
  C:\Windows\System\WSVEjVC.exe
  2⤵
  PID:2132
- C:\Windows\System\NHTDOvE.exe
  C:\Windows\System\NHTDOvE.exe
  2⤵
  PID:2316
- C:\Windows\System\JQqUcGt.exe
  C:\Windows\System\JQqUcGt.exe
  2⤵
  PID:1920
- C:\Windows\System\MVYeRfh.exe
  C:\Windows\System\MVYeRfh.exe
  2⤵
  PID:2916
- C:\Windows\System\ebUrzHc.exe
  C:\Windows\System\ebUrzHc.exe
  2⤵
  PID:2184
- C:\Windows\System\JpubUpl.exe
  C:\Windows\System\JpubUpl.exe
  2⤵
  PID:2704
- C:\Windows\System\WWBSszS.exe
  C:\Windows\System\WWBSszS.exe
  2⤵
  PID:2868
- C:\Windows\System\kpJnLxa.exe
  C:\Windows\System\kpJnLxa.exe
  2⤵
  PID:2724
- C:\Windows\System\EtzgBpq.exe
  C:\Windows\System\EtzgBpq.exe
  2⤵
  PID:3052
- C:\Windows\System\WJuLPwy.exe
  C:\Windows\System\WJuLPwy.exe
  2⤵
  PID:700
- C:\Windows\System\SZYJTaZ.exe
  C:\Windows\System\SZYJTaZ.exe
  2⤵
  PID:2004
- C:\Windows\System\HjhggYo.exe
  C:\Windows\System\HjhggYo.exe
  2⤵
  PID:816
- C:\Windows\System\wwqkoSr.exe
  C:\Windows\System\wwqkoSr.exe
  2⤵
  PID:2424
- C:\Windows\System\gRQkFok.exe
  C:\Windows\System\gRQkFok.exe
  2⤵
  PID:2992
- C:\Windows\System\YwpkgCF.exe
  C:\Windows\System\YwpkgCF.exe
  2⤵
  PID:2884
- C:\Windows\System\oqtkYpj.exe
  C:\Windows\System\oqtkYpj.exe
  2⤵
  PID:2080
- C:\Windows\System\InQNMjz.exe
  C:\Windows\System\InQNMjz.exe
  2⤵
  PID:2272
- C:\Windows\System\wxGUJYB.exe
  C:\Windows\System\wxGUJYB.exe
  2⤵
  PID:3044
- C:\Windows\System\okmhhAZ.exe
  C:\Windows\System\okmhhAZ.exe
  2⤵
  PID:1580
- C:\Windows\System\DTCLifn.exe
  C:\Windows\System\DTCLifn.exe
  2⤵
  PID:1088
- C:\Windows\System\okDlizV.exe
  C:\Windows\System\okDlizV.exe
  2⤵
  PID:2508
- C:\Windows\System\EbrROil.exe
  C:\Windows\System\EbrROil.exe
  2⤵
  PID:1552
- C:\Windows\System\JskUpIJ.exe
  C:\Windows\System\JskUpIJ.exe
  2⤵
  PID:2520
- C:\Windows\System\qrXUowb.exe
  C:\Windows\System\qrXUowb.exe
  2⤵
  PID:2232
- C:\Windows\System\tOpuvVZ.exe
  C:\Windows\System\tOpuvVZ.exe
  2⤵
  PID:3020
- C:\Windows\System\TvIyKOm.exe
  C:\Windows\System\TvIyKOm.exe
  2⤵
  PID:2284
- C:\Windows\System\ZnfpuVU.exe
  C:\Windows\System\ZnfpuVU.exe
  2⤵
  PID:2896
- C:\Windows\System\BmQsPKu.exe
  C:\Windows\System\BmQsPKu.exe
  2⤵
  PID:1040
- C:\Windows\System\IfUYcuu.exe
  C:\Windows\System\IfUYcuu.exe
  2⤵
  PID:1712
- C:\Windows\System\hgilkcR.exe
  C:\Windows\System\hgilkcR.exe
  2⤵
  PID:1812
- C:\Windows\System\KanMMnC.exe
  C:\Windows\System\KanMMnC.exe
  2⤵
  PID:2112
- C:\Windows\System\FhXCjnL.exe
  C:\Windows\System\FhXCjnL.exe
  2⤵
  PID:2440
- C:\Windows\System\bQzEXjd.exe
  C:\Windows\System\bQzEXjd.exe
  2⤵
  PID:1312
- C:\Windows\System\hRAmhae.exe
  C:\Windows\System\hRAmhae.exe
  2⤵
  PID:1548
- C:\Windows\System\zREtpeb.exe
  C:\Windows\System\zREtpeb.exe
  2⤵
  PID:2748
- C:\Windows\System\eGImemR.exe
  C:\Windows\System\eGImemR.exe
  2⤵
  PID:3000
- C:\Windows\System\sHssDhY.exe
  C:\Windows\System\sHssDhY.exe
  2⤵
  PID:2104
- C:\Windows\System\uIMSZRy.exe
  C:\Windows\System\uIMSZRy.exe
  2⤵
  PID:2204
- C:\Windows\System\lrlcWKW.exe
  C:\Windows\System\lrlcWKW.exe
  2⤵
  PID:1296
- C:\Windows\System\sedCgmk.exe
  C:\Windows\System\sedCgmk.exe
  2⤵
  PID:1808
- C:\Windows\System\sndWsQT.exe
  C:\Windows\System\sndWsQT.exe
  2⤵
  PID:1656
- C:\Windows\System\CDVWeFo.exe
  C:\Windows\System\CDVWeFo.exe
  2⤵
  PID:2400
- C:\Windows\System\KVAfNBG.exe
  C:\Windows\System\KVAfNBG.exe
  2⤵
  PID:2820
- C:\Windows\System\JmwJUKZ.exe
  C:\Windows\System\JmwJUKZ.exe
  2⤵
  PID:2764
- C:\Windows\System\DedCnPV.exe
  C:\Windows\System\DedCnPV.exe
  2⤵
  PID:920
- C:\Windows\System\escYAbF.exe
  C:\Windows\System\escYAbF.exe
  2⤵
  PID:2528
- C:\Windows\System\xxGzCRp.exe
  C:\Windows\System\xxGzCRp.exe
  2⤵
  PID:2940
- C:\Windows\System\IopuNXO.exe
  C:\Windows\System\IopuNXO.exe
  2⤵
  PID:1160
- C:\Windows\System\IQVqQUU.exe
  C:\Windows\System\IQVqQUU.exe
  2⤵
  PID:2236
- C:\Windows\System\bhNWvAD.exe
  C:\Windows\System\bhNWvAD.exe
  2⤵
  PID:876
- C:\Windows\System\iWedeis.exe
  C:\Windows\System\iWedeis.exe
  2⤵
  PID:1840
- C:\Windows\System\jnyRhTY.exe
  C:\Windows\System\jnyRhTY.exe
  2⤵
  PID:332
- C:\Windows\System\xbMnmKl.exe
  C:\Windows\System\xbMnmKl.exe
  2⤵
  PID:2976
- C:\Windows\System\NHJjUHa.exe
  C:\Windows\System\NHJjUHa.exe
  2⤵
  PID:1872
- C:\Windows\System\xBhBTJN.exe
  C:\Windows\System\xBhBTJN.exe
  2⤵
  PID:1688
- C:\Windows\System\eGjaVmz.exe
  C:\Windows\System\eGjaVmz.exe
  2⤵
  PID:1536
- C:\Windows\System\NqOAyBb.exe
  C:\Windows\System\NqOAyBb.exe
  2⤵
  PID:2612
- C:\Windows\System\vofqwcU.exe
  C:\Windows\System\vofqwcU.exe
  2⤵
  PID:896
- C:\Windows\System\HVBOLiN.exe
  C:\Windows\System\HVBOLiN.exe
  2⤵
  PID:1820
- C:\Windows\System\wEViTqT.exe
  C:\Windows\System\wEViTqT.exe
  2⤵
  PID:2332
- C:\Windows\System\TDkbQwF.exe
  C:\Windows\System\TDkbQwF.exe
  2⤵
  PID:1504
- C:\Windows\System\RPVfdWO.exe
  C:\Windows\System\RPVfdWO.exe
  2⤵
  PID:2980
- C:\Windows\System\oVKsboe.exe
  C:\Windows\System\oVKsboe.exe
  2⤵
  PID:1640
- C:\Windows\System\CAZBwxJ.exe
  C:\Windows\System\CAZBwxJ.exe
  2⤵
  PID:1264
- C:\Windows\System\aQilvCf.exe
  C:\Windows\System\aQilvCf.exe
  2⤵
  PID:952
- C:\Windows\System\yEfEmty.exe
  C:\Windows\System\yEfEmty.exe
  2⤵
  PID:1732
- C:\Windows\System\GJZdiak.exe
  C:\Windows\System\GJZdiak.exe
  2⤵
  PID:1680
- C:\Windows\System\cpUzEBJ.exe
  C:\Windows\System\cpUzEBJ.exe
  2⤵
  PID:2456
- C:\Windows\System\PMwjBsS.exe
  C:\Windows\System\PMwjBsS.exe
  2⤵
  PID:2428
- C:\Windows\System\DVqtMdU.exe
  C:\Windows\System\DVqtMdU.exe
  2⤵
  PID:1740
- C:\Windows\System\boOxGvX.exe
  C:\Windows\System\boOxGvX.exe
  2⤵
  PID:2664
- C:\Windows\System\mNrBPfn.exe
  C:\Windows\System\mNrBPfn.exe
  2⤵
  PID:1492
- C:\Windows\System\usgdvEB.exe
  C:\Windows\System\usgdvEB.exe
  2⤵
  PID:1728
- C:\Windows\System\EBojecM.exe
  C:\Windows\System\EBojecM.exe
  2⤵
  PID:1932
- C:\Windows\System\biwcqRY.exe
  C:\Windows\System\biwcqRY.exe
  2⤵
  PID:3088
- C:\Windows\System\NBDHKCA.exe
  C:\Windows\System\NBDHKCA.exe
  2⤵
  PID:3104
- C:\Windows\System\aLLArlk.exe
  C:\Windows\System\aLLArlk.exe
  2⤵
  PID:3120
- C:\Windows\System\bvALXgZ.exe
  C:\Windows\System\bvALXgZ.exe
  2⤵
  PID:3136
- C:\Windows\System\lSBEikA.exe
  C:\Windows\System\lSBEikA.exe
  2⤵
  PID:3152
- C:\Windows\System\epgpcGM.exe
  C:\Windows\System\epgpcGM.exe
  2⤵
  PID:3168
- C:\Windows\System\lXDyGNV.exe
  C:\Windows\System\lXDyGNV.exe
  2⤵
  PID:3184
- C:\Windows\System\OPHWjlp.exe
  C:\Windows\System\OPHWjlp.exe
  2⤵
  PID:3240
- C:\Windows\System\WiomykA.exe
  C:\Windows\System\WiomykA.exe
  2⤵
  PID:3256
- C:\Windows\System\QfHqPnc.exe
  C:\Windows\System\QfHqPnc.exe
  2⤵
  PID:3272
- C:\Windows\System\NfvWVZI.exe
  C:\Windows\System\NfvWVZI.exe
  2⤵
  PID:3292
- C:\Windows\System\FzmueBQ.exe
  C:\Windows\System\FzmueBQ.exe
  2⤵
  PID:3308
- C:\Windows\System\sHOqRPg.exe
  C:\Windows\System\sHOqRPg.exe
  2⤵
  PID:3324
- C:\Windows\System\zKPzjXe.exe
  C:\Windows\System\zKPzjXe.exe
  2⤵
  PID:3340
- C:\Windows\System\QeufSQk.exe
  C:\Windows\System\QeufSQk.exe
  2⤵
  PID:3356
- C:\Windows\System\emJDhLx.exe
  C:\Windows\System\emJDhLx.exe
  2⤵
  PID:3376
- C:\Windows\System\AKJFfUw.exe
  C:\Windows\System\AKJFfUw.exe
  2⤵
  PID:3392
- C:\Windows\System\qMMNoXw.exe
  C:\Windows\System\qMMNoXw.exe
  2⤵
  PID:3408
- C:\Windows\System\BYHsXaS.exe
  C:\Windows\System\BYHsXaS.exe
  2⤵
  PID:3424
- C:\Windows\System\TVRRyVB.exe
  C:\Windows\System\TVRRyVB.exe
  2⤵
  PID:3444
- C:\Windows\System\qmCxGWP.exe
  C:\Windows\System\qmCxGWP.exe
  2⤵
  PID:3460
- C:\Windows\System\IZKdbqs.exe
  C:\Windows\System\IZKdbqs.exe
  2⤵
  PID:3476
- C:\Windows\System\QAcYSEP.exe
  C:\Windows\System\QAcYSEP.exe
  2⤵
  PID:3492
- C:\Windows\System\edHITTg.exe
  C:\Windows\System\edHITTg.exe
  2⤵
  PID:3508
- C:\Windows\System\YDdDEIp.exe
  C:\Windows\System\YDdDEIp.exe
  2⤵
  PID:3524
- C:\Windows\System\uIzAvGa.exe
  C:\Windows\System\uIzAvGa.exe
  2⤵
  PID:3540
- C:\Windows\System\sghsJXp.exe
  C:\Windows\System\sghsJXp.exe
  2⤵
  PID:3560
- C:\Windows\System\QPVHAki.exe
  C:\Windows\System\QPVHAki.exe
  2⤵
  PID:3576
- C:\Windows\System\NNTTEOB.exe
  C:\Windows\System\NNTTEOB.exe
  2⤵
  PID:3592
- C:\Windows\System\XeBRMBU.exe
  C:\Windows\System\XeBRMBU.exe
  2⤵
  PID:3608
- C:\Windows\System\lTQdvwR.exe
  C:\Windows\System\lTQdvwR.exe
  2⤵
  PID:3624
- C:\Windows\System\rPjuIJQ.exe
  C:\Windows\System\rPjuIJQ.exe
  2⤵
  PID:3640
- C:\Windows\System\ZMkmgIG.exe
  C:\Windows\System\ZMkmgIG.exe
  2⤵
  PID:3660
- C:\Windows\System\yvHrisI.exe
  C:\Windows\System\yvHrisI.exe
  2⤵
  PID:3676
- C:\Windows\System\RbgoAZu.exe
  C:\Windows\System\RbgoAZu.exe
  2⤵
  PID:3692
- C:\Windows\System\JGHUnEN.exe
  C:\Windows\System\JGHUnEN.exe
  2⤵
  PID:3708
- C:\Windows\System\zoyllLk.exe
  C:\Windows\System\zoyllLk.exe
  2⤵
  PID:3724
- C:\Windows\System\gydmfmU.exe
  C:\Windows\System\gydmfmU.exe
  2⤵
  PID:3740
- C:\Windows\System\zzUOhWH.exe
  C:\Windows\System\zzUOhWH.exe
  2⤵
  PID:3756
- C:\Windows\System\GcsjXDi.exe
  C:\Windows\System\GcsjXDi.exe
  2⤵
  PID:3776
- C:\Windows\System\QRXrzTG.exe
  C:\Windows\System\QRXrzTG.exe
  2⤵
  PID:3792
- C:\Windows\System\NRNOoWy.exe
  C:\Windows\System\NRNOoWy.exe
  2⤵
  PID:3816
- C:\Windows\System\hiJsBFR.exe
  C:\Windows\System\hiJsBFR.exe
  2⤵
  PID:3848
- C:\Windows\System\gmxKvAS.exe
  C:\Windows\System\gmxKvAS.exe
  2⤵
  PID:3976
- C:\Windows\System\PPpnzcK.exe
  C:\Windows\System\PPpnzcK.exe
  2⤵
  PID:3992
- C:\Windows\System\cSZTprx.exe
  C:\Windows\System\cSZTprx.exe
  2⤵
  PID:4008
- C:\Windows\System\HPimzRu.exe
  C:\Windows\System\HPimzRu.exe
  2⤵
  PID:4024
- C:\Windows\System\VapDXyU.exe
  C:\Windows\System\VapDXyU.exe
  2⤵
  PID:4040
- C:\Windows\System\kajJvRK.exe
  C:\Windows\System\kajJvRK.exe
  2⤵
  PID:4056
- C:\Windows\System\rZVcwoZ.exe
  C:\Windows\System\rZVcwoZ.exe
  2⤵
  PID:4072
- C:\Windows\System\FKfMpXp.exe
  C:\Windows\System\FKfMpXp.exe
  2⤵
  PID:4088
- C:\Windows\System\bRyAEuF.exe
  C:\Windows\System\bRyAEuF.exe
  2⤵
  PID:3084
- C:\Windows\System\NyUqCKA.exe
  C:\Windows\System\NyUqCKA.exe
  2⤵
  PID:3148
- C:\Windows\System\ayEYjzH.exe
  C:\Windows\System\ayEYjzH.exe
  2⤵
  PID:3096
- C:\Windows\System\VTscUfL.exe
  C:\Windows\System\VTscUfL.exe
  2⤵
  PID:3160
- C:\Windows\System\gaJQehR.exe
  C:\Windows\System\gaJQehR.exe
  2⤵
  PID:3204
- C:\Windows\System\PUQMPRB.exe
  C:\Windows\System\PUQMPRB.exe
  2⤵
  PID:3220
- C:\Windows\System\FlSnrAO.exe
  C:\Windows\System\FlSnrAO.exe
  2⤵
  PID:3200
- C:\Windows\System\iErPXfN.exe
  C:\Windows\System\iErPXfN.exe
  2⤵
  PID:3284
- C:\Windows\System\nWzdJzK.exe
  C:\Windows\System\nWzdJzK.exe
  2⤵
  PID:3372
- C:\Windows\System\dtVcvzQ.exe
  C:\Windows\System\dtVcvzQ.exe
  2⤵
  PID:3436
- C:\Windows\System\pStOwjO.exe
  C:\Windows\System\pStOwjO.exe
  2⤵
  PID:3500
- C:\Windows\System\PkZZuVf.exe
  C:\Windows\System\PkZZuVf.exe
  2⤵
  PID:3572
- C:\Windows\System\QYUiYRi.exe
  C:\Windows\System\QYUiYRi.exe
  2⤵
  PID:3636
- C:\Windows\System\soRSPyd.exe
  C:\Windows\System\soRSPyd.exe
  2⤵
  PID:3704
- C:\Windows\System\xNPGrgO.exe
  C:\Windows\System\xNPGrgO.exe
  2⤵
  PID:3800
- C:\Windows\System\pCJIexN.exe
  C:\Windows\System\pCJIexN.exe
  2⤵
  PID:3300
- C:\Windows\System\SqZzMTJ.exe
  C:\Windows\System\SqZzMTJ.exe
  2⤵
  PID:3768
- C:\Windows\System\TfYRccT.exe
  C:\Windows\System\TfYRccT.exe
  2⤵
  PID:3352
- C:\Windows\System\RWooGNv.exe
  C:\Windows\System\RWooGNv.exe
  2⤵
  PID:3420
- C:\Windows\System\GwqWJHG.exe
  C:\Windows\System\GwqWJHG.exe
  2⤵
  PID:3516
- C:\Windows\System\GcGklzJ.exe
  C:\Windows\System\GcGklzJ.exe
  2⤵
  PID:3552
- C:\Windows\System\kCjBEfO.exe
  C:\Windows\System\kCjBEfO.exe
  2⤵
  PID:3620
- C:\Windows\System\DLFxQAL.exe
  C:\Windows\System\DLFxQAL.exe
  2⤵
  PID:3684
- C:\Windows\System\FuyjkZS.exe
  C:\Windows\System\FuyjkZS.exe
  2⤵
  PID:3748
- C:\Windows\System\qpHUoSe.exe
  C:\Windows\System\qpHUoSe.exe
  2⤵
  PID:3808
- C:\Windows\System\RZjAVWI.exe
  C:\Windows\System\RZjAVWI.exe
  2⤵
  PID:3832
- C:\Windows\System\AnvhzqQ.exe
  C:\Windows\System\AnvhzqQ.exe
  2⤵
  PID:3872
- C:\Windows\System\OIwqPpj.exe
  C:\Windows\System\OIwqPpj.exe
  2⤵
  PID:3904
- C:\Windows\System\LQoDlhr.exe
  C:\Windows\System\LQoDlhr.exe
  2⤵
  PID:3916
- C:\Windows\System\rqbzrrf.exe
  C:\Windows\System\rqbzrrf.exe
  2⤵
  PID:4104
- C:\Windows\System\olOTQVU.exe
  C:\Windows\System\olOTQVU.exe
  2⤵
  PID:4124
- C:\Windows\System\AJccGTu.exe
  C:\Windows\System\AJccGTu.exe
  2⤵
  PID:4140
- C:\Windows\System\VzIHJmf.exe
  C:\Windows\System\VzIHJmf.exe
  2⤵
  PID:4156
- C:\Windows\System\kVTBYim.exe
  C:\Windows\System\kVTBYim.exe
  2⤵
  PID:4172
- C:\Windows\System\mROeZAn.exe
  C:\Windows\System\mROeZAn.exe
  2⤵
  PID:4308
- C:\Windows\System\NhOOypI.exe
  C:\Windows\System\NhOOypI.exe
  2⤵
  PID:4360
- C:\Windows\System\xjRvNNX.exe
  C:\Windows\System\xjRvNNX.exe
  2⤵
  PID:4376
- C:\Windows\System\NiSwiMN.exe
  C:\Windows\System\NiSwiMN.exe
  2⤵
  PID:4392
- C:\Windows\System\YRMfEDr.exe
  C:\Windows\System\YRMfEDr.exe
  2⤵
  PID:4408
- C:\Windows\System\ZTRoPWy.exe
  C:\Windows\System\ZTRoPWy.exe
  2⤵
  PID:4424
- C:\Windows\System\XTiKIKO.exe
  C:\Windows\System\XTiKIKO.exe
  2⤵
  PID:4440
- C:\Windows\System\OqQOdbU.exe
  C:\Windows\System\OqQOdbU.exe
  2⤵
  PID:4456
- C:\Windows\System\FcCKirC.exe
  C:\Windows\System\FcCKirC.exe
  2⤵
  PID:4472
- C:\Windows\System\zYoKMfW.exe
  C:\Windows\System\zYoKMfW.exe
  2⤵
  PID:4492
- C:\Windows\System\CahZGTB.exe
  C:\Windows\System\CahZGTB.exe
  2⤵
  PID:4508
- C:\Windows\System\UAlzfll.exe
  C:\Windows\System\UAlzfll.exe
  2⤵
  PID:4560
- C:\Windows\System\ZbIKPrg.exe
  C:\Windows\System\ZbIKPrg.exe
  2⤵
  PID:4580
- C:\Windows\System\hjWSsMz.exe
  C:\Windows\System\hjWSsMz.exe
  2⤵
  PID:4596
- C:\Windows\System\nueBYBc.exe
  C:\Windows\System\nueBYBc.exe
  2⤵
  PID:4612
- C:\Windows\System\avQnFRg.exe
  C:\Windows\System\avQnFRg.exe
  2⤵
  PID:4628
- C:\Windows\System\EtGDbdB.exe
  C:\Windows\System\EtGDbdB.exe
  2⤵
  PID:4644
- C:\Windows\System\iqnhDwS.exe
  C:\Windows\System\iqnhDwS.exe
  2⤵
  PID:4660
- C:\Windows\System\ujDnrYb.exe
  C:\Windows\System\ujDnrYb.exe
  2⤵
  PID:4676
- C:\Windows\System\yVNfyMP.exe
  C:\Windows\System\yVNfyMP.exe
  2⤵
  PID:4692
- C:\Windows\System\AqLnPJd.exe
  C:\Windows\System\AqLnPJd.exe
  2⤵
  PID:4712
- C:\Windows\System\LYNpXub.exe
  C:\Windows\System\LYNpXub.exe
  2⤵
  PID:4728
- C:\Windows\System\GbyAAlx.exe
  C:\Windows\System\GbyAAlx.exe
  2⤵
  PID:4748
- C:\Windows\System\nInaTlU.exe
  C:\Windows\System\nInaTlU.exe
  2⤵
  PID:4764
- C:\Windows\System\MTAmmjz.exe
  C:\Windows\System\MTAmmjz.exe
  2⤵
  PID:4780
- C:\Windows\System\dpeuwMb.exe
  C:\Windows\System\dpeuwMb.exe
  2⤵
  PID:4796
- C:\Windows\System\AYOomRC.exe
  C:\Windows\System\AYOomRC.exe
  2⤵
  PID:4812
- C:\Windows\System\AhpbdrK.exe
  C:\Windows\System\AhpbdrK.exe
  2⤵
  PID:4832
- C:\Windows\System\MmNagya.exe
  C:\Windows\System\MmNagya.exe
  2⤵
  PID:4848
- C:\Windows\System\hAjCpKZ.exe
  C:\Windows\System\hAjCpKZ.exe
  2⤵
  PID:4864
- C:\Windows\System\lkjjccP.exe
  C:\Windows\System\lkjjccP.exe
  2⤵
  PID:4880
- C:\Windows\System\sbVtiEP.exe
  C:\Windows\System\sbVtiEP.exe
  2⤵
  PID:4896
- C:\Windows\System\CugwMNn.exe
  C:\Windows\System\CugwMNn.exe
  2⤵
  PID:4916
- C:\Windows\System\UTnyTUB.exe
  C:\Windows\System\UTnyTUB.exe
  2⤵
  PID:4932
- C:\Windows\System\UyqxeRY.exe
  C:\Windows\System\UyqxeRY.exe
  2⤵
  PID:4948
- C:\Windows\System\HksOZzV.exe
  C:\Windows\System\HksOZzV.exe
  2⤵
  PID:4964
- C:\Windows\System\MkbsRwc.exe
  C:\Windows\System\MkbsRwc.exe
  2⤵
  PID:4984
- C:\Windows\System\WXYctjw.exe
  C:\Windows\System\WXYctjw.exe
  2⤵
  PID:5000
- C:\Windows\System\UJVrUxi.exe
  C:\Windows\System\UJVrUxi.exe
  2⤵
  PID:5020
- C:\Windows\System\JyzXMpy.exe
  C:\Windows\System\JyzXMpy.exe
  2⤵
  PID:5036
- C:\Windows\System\iMosWzA.exe
  C:\Windows\System\iMosWzA.exe
  2⤵
  PID:5052
- C:\Windows\System\AaUfPuf.exe
  C:\Windows\System\AaUfPuf.exe
  2⤵
  PID:5068
- C:\Windows\System\anCuWHu.exe
  C:\Windows\System\anCuWHu.exe
  2⤵
  PID:5084
- C:\Windows\System\xveeVnl.exe
  C:\Windows\System\xveeVnl.exe
  2⤵
  PID:5104
- C:\Windows\System\OVioRkw.exe
  C:\Windows\System\OVioRkw.exe
  2⤵
  PID:3920
- C:\Windows\System\mgDwUXe.exe
  C:\Windows\System\mgDwUXe.exe
  2⤵
  PID:3944
- C:\Windows\System\xCTaBZz.exe
  C:\Windows\System\xCTaBZz.exe
  2⤵
  PID:3964
- C:\Windows\System\zYltlVH.exe
  C:\Windows\System\zYltlVH.exe
  2⤵
  PID:4004
- C:\Windows\System\Drlgpzh.exe
  C:\Windows\System\Drlgpzh.exe
  2⤵
  PID:1392
- C:\Windows\System\LeJYioa.exe
  C:\Windows\System\LeJYioa.exe
  2⤵
  PID:1880
- C:\Windows\System\zwbbmuZ.exe
  C:\Windows\System\zwbbmuZ.exe
  2⤵
  PID:4052
- C:\Windows\System\dzXOrti.exe
  C:\Windows\System\dzXOrti.exe
  2⤵
  PID:3264
- C:\Windows\System\vSPoYSB.exe
  C:\Windows\System\vSPoYSB.exe
  2⤵
  PID:3456
- C:\Windows\System\JcXMbqi.exe
  C:\Windows\System\JcXMbqi.exe
  2⤵
  PID:3212
- C:\Windows\System\WEwZUum.exe
  C:\Windows\System\WEwZUum.exe
  2⤵
  PID:3404
- C:\Windows\System\YieTpTQ.exe
  C:\Windows\System\YieTpTQ.exe
  2⤵
  PID:3568
- C:\Windows\System\xAMZhzF.exe
  C:\Windows\System\xAMZhzF.exe
  2⤵
  PID:3304
- C:\Windows\System\AGDYOeo.exe
  C:\Windows\System\AGDYOeo.exe
  2⤵
  PID:3584
- C:\Windows\System\VFuYjsT.exe
  C:\Windows\System\VFuYjsT.exe
  2⤵
  PID:3824
- C:\Windows\System\ZPVQYJs.exe
  C:\Windows\System\ZPVQYJs.exe
  2⤵
  PID:3988
- C:\Windows\System\TVCNIco.exe
  C:\Windows\System\TVCNIco.exe
  2⤵
  PID:4200
- C:\Windows\System\UYYokVb.exe
  C:\Windows\System\UYYokVb.exe
  2⤵
  PID:4228
- C:\Windows\System\SSsfOjV.exe
  C:\Windows\System\SSsfOjV.exe
  2⤵
  PID:4244
- C:\Windows\System\sbLRRDZ.exe
  C:\Windows\System\sbLRRDZ.exe
  2⤵
  PID:4264
- C:\Windows\System\QzOtYxp.exe
  C:\Windows\System\QzOtYxp.exe
  2⤵
  PID:4300
- C:\Windows\System\GoBfHUI.exe
  C:\Windows\System\GoBfHUI.exe
  2⤵
  PID:4336
- C:\Windows\System\BBlyasv.exe
  C:\Windows\System\BBlyasv.exe
  2⤵
  PID:4372
- C:\Windows\System\FOsCZsU.exe
  C:\Windows\System\FOsCZsU.exe
  2⤵
  PID:4384
- C:\Windows\System\oCheYid.exe
  C:\Windows\System\oCheYid.exe
  2⤵
  PID:4464
- C:\Windows\System\pioNcuD.exe
  C:\Windows\System\pioNcuD.exe
  2⤵
  PID:4504
- C:\Windows\System\VYwDGjj.exe
  C:\Windows\System\VYwDGjj.exe
  2⤵
  PID:4420
- C:\Windows\System\ZJHVytd.exe
  C:\Windows\System\ZJHVytd.exe
  2⤵
  PID:4488
- C:\Windows\System\qLvKlgI.exe
  C:\Windows\System\qLvKlgI.exe
  2⤵
  PID:4544
- C:\Windows\System\YCksayi.exe
  C:\Windows\System\YCksayi.exe
  2⤵
  PID:4520
- C:\Windows\System\nAQdURz.exe
  C:\Windows\System\nAQdURz.exe
  2⤵
  PID:4636
- C:\Windows\System\WOXCJta.exe
  C:\Windows\System\WOXCJta.exe
  2⤵
  PID:4856
- C:\Windows\System\JyphoYo.exe
  C:\Windows\System\JyphoYo.exe
  2⤵
  PID:4956
- C:\Windows\System\DHrEwgV.exe
  C:\Windows\System\DHrEwgV.exe
  2⤵
  PID:4760
- C:\Windows\System\aSmprNO.exe
  C:\Windows\System\aSmprNO.exe
  2⤵
  PID:4720
- C:\Windows\System\TxwyYgk.exe
  C:\Windows\System\TxwyYgk.exe
  2⤵
  PID:3940
- C:\Windows\System\YZvPxfc.exe
  C:\Windows\System\YZvPxfc.exe
  2⤵
  PID:3236
- C:\Windows\System\VXjiPMb.exe
  C:\Windows\System\VXjiPMb.exe
  2⤵
  PID:3536
- C:\Windows\System\AooASFw.exe
  C:\Windows\System\AooASFw.exe
  2⤵
  PID:4788
- C:\Windows\System\vLbNezT.exe
  C:\Windows\System\vLbNezT.exe
  2⤵
  PID:3936
- C:\Windows\System\tKsMtuk.exe
  C:\Windows\System\tKsMtuk.exe
  2⤵
  PID:4708
- C:\Windows\System\jmPjuTE.exe
  C:\Windows\System\jmPjuTE.exe
  2⤵
  PID:3128
- C:\Windows\System\wUDzTJq.exe
  C:\Windows\System\wUDzTJq.exe
  2⤵
  PID:4944
- C:\Windows\System\AhQELmr.exe
  C:\Windows\System\AhQELmr.exe
  2⤵
  PID:4872
- C:\Windows\System\xZAnFWb.exe
  C:\Windows\System\xZAnFWb.exe
  2⤵
  PID:4804
- C:\Windows\System\bMKcoqE.exe
  C:\Windows\System\bMKcoqE.exe
  2⤵
  PID:5016
- C:\Windows\System\VtSBkNj.exe
  C:\Windows\System\VtSBkNj.exe
  2⤵
  PID:4068
- C:\Windows\System\lxomVIh.exe
  C:\Windows\System\lxomVIh.exe
  2⤵
  PID:5116
- C:\Windows\System\iqOLciF.exe
  C:\Windows\System\iqOLciF.exe
  2⤵
  PID:5044
- C:\Windows\System\GdLltSS.exe
  C:\Windows\System\GdLltSS.exe
  2⤵
  PID:4136
- C:\Windows\System\qDxsOug.exe
  C:\Windows\System\qDxsOug.exe
  2⤵
  PID:3616
- C:\Windows\System\ICUvNQq.exe
  C:\Windows\System\ICUvNQq.exe
  2⤵
  PID:4168
- C:\Windows\System\SuQeWOv.exe
  C:\Windows\System\SuQeWOv.exe
  2⤵
  PID:3772
- C:\Windows\System\mEWxHPu.exe
  C:\Windows\System\mEWxHPu.exe
  2⤵
  PID:3736
- C:\Windows\System\BFxKhnY.exe
  C:\Windows\System\BFxKhnY.exe
  2⤵
  PID:3548
- C:\Windows\System\PwcBRwL.exe
  C:\Windows\System\PwcBRwL.exe
  2⤵
  PID:3840
- C:\Windows\System\wGOuTVS.exe
  C:\Windows\System\wGOuTVS.exe
  2⤵
  PID:4120
- C:\Windows\System\URQgucM.exe
  C:\Windows\System\URQgucM.exe
  2⤵
  PID:4188
- C:\Windows\System\fJontqF.exe
  C:\Windows\System\fJontqF.exe
  2⤵
  PID:4224
- C:\Windows\System\vRjypLd.exe
  C:\Windows\System\vRjypLd.exe
  2⤵
  PID:4260
- C:\Windows\System\YsUQCyZ.exe
  C:\Windows\System\YsUQCyZ.exe
  2⤵
  PID:4284
- C:\Windows\System\ZUKPCia.exe
  C:\Windows\System\ZUKPCia.exe
  2⤵
  PID:4352
- C:\Windows\System\lMDyfaa.exe
  C:\Windows\System\lMDyfaa.exe
  2⤵
  PID:4296
- C:\Windows\System\FDcExLf.exe
  C:\Windows\System\FDcExLf.exe
  2⤵
  PID:4452
- C:\Windows\System\hfMnptG.exe
  C:\Windows\System\hfMnptG.exe
  2⤵
  PID:4568
- C:\Windows\System\xRDgqKt.exe
  C:\Windows\System\xRDgqKt.exe
  2⤵
  PID:4536
- C:\Windows\System\DDhKpvl.exe
  C:\Windows\System\DDhKpvl.exe
  2⤵
  PID:4652
- C:\Windows\System\tLdGarb.exe
  C:\Windows\System\tLdGarb.exe
  2⤵
  PID:4328
- C:\Windows\System\Mmjbhpi.exe
  C:\Windows\System\Mmjbhpi.exe
  2⤵
  PID:5060
- C:\Windows\System\QeFEdoF.exe
  C:\Windows\System\QeFEdoF.exe
  2⤵
  PID:4996
- C:\Windows\System\yTYWneG.exe
  C:\Windows\System\yTYWneG.exe
  2⤵
  PID:3932
- C:\Windows\System\aVIFAeF.exe
  C:\Windows\System\aVIFAeF.exe
  2⤵
  PID:3484
- C:\Windows\System\hzTPMxF.exe
  C:\Windows\System\hzTPMxF.exe
  2⤵
  PID:4828
- C:\Windows\System\AdKGlZe.exe
  C:\Windows\System\AdKGlZe.exe
  2⤵
  PID:4672
- C:\Windows\System\aMlDNOB.exe
  C:\Windows\System\aMlDNOB.exe
  2⤵
  PID:4744
- C:\Windows\System\QeshxlF.exe
  C:\Windows\System\QeshxlF.exe
  2⤵
  PID:4908
- C:\Windows\System\JLuTtsI.exe
  C:\Windows\System\JLuTtsI.exe
  2⤵
  PID:3956
- C:\Windows\System\yeefmNz.exe
  C:\Windows\System\yeefmNz.exe
  2⤵
  PID:3468
- C:\Windows\System\VGbhmJD.exe
  C:\Windows\System\VGbhmJD.exe
  2⤵
  PID:4080
- C:\Windows\System\jWtaKxp.exe
  C:\Windows\System\jWtaKxp.exe
  2⤵
  PID:3948
- C:\Windows\System\ZdlKMMd.exe
  C:\Windows\System\ZdlKMMd.exe
  2⤵
  PID:3700
- C:\Windows\System\anTIics.exe
  C:\Windows\System\anTIics.exe
  2⤵
  PID:4036
- C:\Windows\System\HfoBRig.exe
  C:\Windows\System\HfoBRig.exe
  2⤵
  PID:3864
- C:\Windows\System\hEuaJOk.exe
  C:\Windows\System\hEuaJOk.exe
  2⤵
  PID:4116
- C:\Windows\System\VGKjhyZ.exe
  C:\Windows\System\VGKjhyZ.exe
  2⤵
  PID:4192
- C:\Windows\System\eIQJTLG.exe
  C:\Windows\System\eIQJTLG.exe
  2⤵
  PID:4256
- C:\Windows\System\kSwhHFA.exe
  C:\Windows\System\kSwhHFA.exe
  2⤵
  PID:4320
- C:\Windows\System\hXLDBfe.exe
  C:\Windows\System\hXLDBfe.exe
  2⤵
  PID:4556
- C:\Windows\System\hNXywxM.exe
  C:\Windows\System\hNXywxM.exe
  2⤵
  PID:4524
- C:\Windows\System\VDtNdny.exe
  C:\Windows\System\VDtNdny.exe
  2⤵
  PID:4572
- C:\Windows\System\zObqKoU.exe
  C:\Windows\System\zObqKoU.exe
  2⤵
  PID:4892
- C:\Windows\System\mEoJOcG.exe
  C:\Windows\System\mEoJOcG.exe
  2⤵
  PID:2348
- C:\Windows\System\PPhzCVc.exe
  C:\Windows\System\PPhzCVc.exe
  2⤵
  PID:3080
- C:\Windows\System\UBmFZXU.exe
  C:\Windows\System\UBmFZXU.exe
  2⤵
  PID:4824
- C:\Windows\System\tpfJJpx.exe
  C:\Windows\System\tpfJJpx.exe
  2⤵
  PID:3132
- C:\Windows\System\QJaXUVu.exe
  C:\Windows\System\QJaXUVu.exe
  2⤵
  PID:4840
- C:\Windows\System\KYkklZB.exe
  C:\Windows\System\KYkklZB.exe
  2⤵
  PID:4904
- C:\Windows\System\CtnOMdY.exe
  C:\Windows\System\CtnOMdY.exe
  2⤵
  PID:4808
- C:\Windows\System\skXCHIj.exe
  C:\Windows\System\skXCHIj.exe
  2⤵
  PID:4048
- C:\Windows\System\yuoMqVd.exe
  C:\Windows\System\yuoMqVd.exe
  2⤵
  PID:3604
- C:\Windows\System\QCFZdpe.exe
  C:\Windows\System\QCFZdpe.exe
  2⤵
  PID:3364
- C:\Windows\System\DBUlpYD.exe
  C:\Windows\System\DBUlpYD.exe
  2⤵
  PID:3912
- C:\Windows\System\IFDBVkt.exe
  C:\Windows\System\IFDBVkt.exe
  2⤵
  PID:4240
- C:\Windows\System\nBKZUCB.exe
  C:\Windows\System\nBKZUCB.exe
  2⤵
  PID:4432
- C:\Windows\System\IxwxDwE.exe
  C:\Windows\System\IxwxDwE.exe
  2⤵
  PID:4292
- C:\Windows\System\MagcIKP.exe
  C:\Windows\System\MagcIKP.exe
  2⤵
  PID:4552
- C:\Windows\System\yDRZHwW.exe
  C:\Windows\System\yDRZHwW.exe
  2⤵
  PID:5132
- C:\Windows\System\jNTWfwK.exe
  C:\Windows\System\jNTWfwK.exe
  2⤵
  PID:5148
- C:\Windows\System\hcEexRl.exe
  C:\Windows\System\hcEexRl.exe
  2⤵
  PID:5164
- C:\Windows\System\hIAxZTG.exe
  C:\Windows\System\hIAxZTG.exe
  2⤵
  PID:5184
- C:\Windows\System\UwwaPem.exe
  C:\Windows\System\UwwaPem.exe
  2⤵
  PID:5200
- C:\Windows\System\kaEsOMv.exe
  C:\Windows\System\kaEsOMv.exe
  2⤵
  PID:5220
- C:\Windows\System\DhzhYLU.exe
  C:\Windows\System\DhzhYLU.exe
  2⤵
  PID:5236
- C:\Windows\System\BFBTFEo.exe
  C:\Windows\System\BFBTFEo.exe
  2⤵
  PID:5252
- C:\Windows\System\vosnGXT.exe
  C:\Windows\System\vosnGXT.exe
  2⤵
  PID:5268
- C:\Windows\System\SVGyjNq.exe
  C:\Windows\System\SVGyjNq.exe
  2⤵
  PID:5288
- C:\Windows\System\SjVvWyo.exe
  C:\Windows\System\SjVvWyo.exe
  2⤵
  PID:5400
- C:\Windows\System\kOByhdZ.exe
  C:\Windows\System\kOByhdZ.exe
  2⤵
  PID:5420
- C:\Windows\System\YTEugmd.exe
  C:\Windows\System\YTEugmd.exe
  2⤵
  PID:5440
- C:\Windows\System\GetDiNg.exe
  C:\Windows\System\GetDiNg.exe
  2⤵
  PID:5464
- C:\Windows\System\KzYjNvt.exe
  C:\Windows\System\KzYjNvt.exe
  2⤵
  PID:5488
- C:\Windows\System\QCXtrOt.exe
  C:\Windows\System\QCXtrOt.exe
  2⤵
  PID:5508
- C:\Windows\System\Huztcej.exe
  C:\Windows\System\Huztcej.exe
  2⤵
  PID:5524
- C:\Windows\System\yEaOZjA.exe
  C:\Windows\System\yEaOZjA.exe
  2⤵
  PID:5544
- C:\Windows\System\tEsjoIo.exe
  C:\Windows\System\tEsjoIo.exe
  2⤵
  PID:5564
- C:\Windows\System\FMetPlM.exe
  C:\Windows\System\FMetPlM.exe
  2⤵
  PID:5584
- C:\Windows\System\OlTXcGu.exe
  C:\Windows\System\OlTXcGu.exe
  2⤵
  PID:5604
- C:\Windows\System\ksvNXaE.exe
  C:\Windows\System\ksvNXaE.exe
  2⤵
  PID:5620
- C:\Windows\System\FhImuvq.exe
  C:\Windows\System\FhImuvq.exe
  2⤵
  PID:5636
- C:\Windows\System\RISpnaA.exe
  C:\Windows\System\RISpnaA.exe
  2⤵
  PID:5656
- C:\Windows\System\QlUFunI.exe
  C:\Windows\System\QlUFunI.exe
  2⤵
  PID:5672
- C:\Windows\System\AKcSOKE.exe
  C:\Windows\System\AKcSOKE.exe
  2⤵
  PID:5688
- C:\Windows\System\iulNzCB.exe
  C:\Windows\System\iulNzCB.exe
  2⤵
  PID:5704
- C:\Windows\System\wummaby.exe
  C:\Windows\System\wummaby.exe
  2⤵
  PID:5724
- C:\Windows\System\SxGlATQ.exe
  C:\Windows\System\SxGlATQ.exe
  2⤵
  PID:5740
- C:\Windows\System\GIVqvmv.exe
  C:\Windows\System\GIVqvmv.exe
  2⤵
  PID:5756
- C:\Windows\System\dgSeEmd.exe
  C:\Windows\System\dgSeEmd.exe
  2⤵
  PID:5772
- C:\Windows\System\IxZbWMn.exe
  C:\Windows\System\IxZbWMn.exe
  2⤵
  PID:5788
- C:\Windows\System\BNLgsdm.exe
  C:\Windows\System\BNLgsdm.exe
  2⤵
  PID:5832
- C:\Windows\System\KdZDsEi.exe
  C:\Windows\System\KdZDsEi.exe
  2⤵
  PID:5848
- C:\Windows\System\RqJLyIe.exe
  C:\Windows\System\RqJLyIe.exe
  2⤵
  PID:5880
- C:\Windows\System\LHhFwAt.exe
  C:\Windows\System\LHhFwAt.exe
  2⤵
  PID:5928
- C:\Windows\System\qhLvEPo.exe
  C:\Windows\System\qhLvEPo.exe
  2⤵
  PID:5944
- C:\Windows\System\dlFfuZH.exe
  C:\Windows\System\dlFfuZH.exe
  2⤵
  PID:5960
- C:\Windows\System\crvxAKi.exe
  C:\Windows\System\crvxAKi.exe
  2⤵
  PID:5976
- C:\Windows\System\SURdPQe.exe
  C:\Windows\System\SURdPQe.exe
  2⤵
  PID:5992
- C:\Windows\System\IUVedsT.exe
  C:\Windows\System\IUVedsT.exe
  2⤵
  PID:6008
- C:\Windows\System\zpPfCVR.exe
  C:\Windows\System\zpPfCVR.exe
  2⤵
  PID:6024
- C:\Windows\System\vGUyYdM.exe
  C:\Windows\System\vGUyYdM.exe
  2⤵
  PID:6040
- C:\Windows\System\OwkmXhX.exe
  C:\Windows\System\OwkmXhX.exe
  2⤵
  PID:6056
- C:\Windows\System\PqdXsaR.exe
  C:\Windows\System\PqdXsaR.exe
  2⤵
  PID:6072
- C:\Windows\System\cteODRK.exe
  C:\Windows\System\cteODRK.exe
  2⤵
  PID:6088
- C:\Windows\System\MIdNryn.exe
  C:\Windows\System\MIdNryn.exe
  2⤵
  PID:2340
- C:\Windows\System\oYJmiyx.exe
  C:\Windows\System\oYJmiyx.exe
  2⤵
  PID:4992
- C:\Windows\System\UmykXjv.exe
  C:\Windows\System\UmykXjv.exe
  2⤵
  PID:4772
- C:\Windows\System\gShkKoz.exe
  C:\Windows\System\gShkKoz.exe
  2⤵
  PID:4184
- C:\Windows\System\kQEfRUi.exe
  C:\Windows\System\kQEfRUi.exe
  2⤵
  PID:4280
- C:\Windows\System\YtnMfIR.exe
  C:\Windows\System\YtnMfIR.exe
  2⤵
  PID:5172
- C:\Windows\System\FBYSSOQ.exe
  C:\Windows\System\FBYSSOQ.exe
  2⤵
  PID:5216
- C:\Windows\System\iNBCosM.exe
  C:\Windows\System\iNBCosM.exe
  2⤵
  PID:5284
- C:\Windows\System\mCJrNIz.exe
  C:\Windows\System\mCJrNIz.exe
  2⤵
  PID:5412
- C:\Windows\System\bvVsDwj.exe
  C:\Windows\System\bvVsDwj.exe
  2⤵
  PID:5532
- C:\Windows\System\BroulSS.exe
  C:\Windows\System\BroulSS.exe
  2⤵
  PID:5616
- C:\Windows\System\mCarFzq.exe
  C:\Windows\System\mCarFzq.exe
  2⤵
  PID:5456
- C:\Windows\System\DJjZqVb.exe
  C:\Windows\System\DJjZqVb.exe
  2⤵
  PID:5576
- C:\Windows\System\VMVKYml.exe
  C:\Windows\System\VMVKYml.exe
  2⤵
  PID:5312
- C:\Windows\System\VVJaMzA.exe
  C:\Windows\System\VVJaMzA.exe
  2⤵
  PID:5328
- C:\Windows\System\QNNkUkC.exe
  C:\Windows\System\QNNkUkC.exe
  2⤵
  PID:5336
- C:\Windows\System\YkOqUPA.exe
  C:\Windows\System\YkOqUPA.exe
  2⤵
  PID:5352
- C:\Windows\System\niYGNqq.exe
  C:\Windows\System\niYGNqq.exe
  2⤵
  PID:5124
- C:\Windows\System\XqMNpvp.exe
  C:\Windows\System\XqMNpvp.exe
  2⤵
  PID:5372
- C:\Windows\System\EkRlywW.exe
  C:\Windows\System\EkRlywW.exe
  2⤵
  PID:5260
- C:\Windows\System\NwdHzqP.exe
  C:\Windows\System\NwdHzqP.exe
  2⤵
  PID:5392
- C:\Windows\System\OGqDcEI.exe
  C:\Windows\System\OGqDcEI.exe
  2⤵
  PID:5552
- C:\Windows\System\UXErYQR.exe
  C:\Windows\System\UXErYQR.exe
  2⤵
  PID:5628
- C:\Windows\System\UQAcCwP.exe
  C:\Windows\System\UQAcCwP.exe
  2⤵
  PID:5808
- C:\Windows\System\YjWMPRs.exe
  C:\Windows\System\YjWMPRs.exe
  2⤵
  PID:5428
- C:\Windows\System\JYmtkHm.exe
  C:\Windows\System\JYmtkHm.exe
  2⤵
  PID:5824
- C:\Windows\System\jCchzCx.exe
  C:\Windows\System\jCchzCx.exe
  2⤵
  PID:5820
- C:\Windows\System\xzrxhHX.exe
  C:\Windows\System\xzrxhHX.exe
  2⤵
  PID:5872
- C:\Windows\System\caiyXRx.exe
  C:\Windows\System\caiyXRx.exe
  2⤵
  PID:5876
- C:\Windows\System\WqKSBDT.exe
  C:\Windows\System\WqKSBDT.exe
  2⤵
  PID:5900
- C:\Windows\System\NFMHeeW.exe
  C:\Windows\System\NFMHeeW.exe
  2⤵
  PID:5920
- C:\Windows\System\mRSnBEQ.exe
  C:\Windows\System\mRSnBEQ.exe
  2⤵
  PID:5952
- C:\Windows\System\CfJYfTZ.exe
  C:\Windows\System\CfJYfTZ.exe
  2⤵
  PID:5988
- C:\Windows\System\JKkVrFa.exe
  C:\Windows\System\JKkVrFa.exe
  2⤵
  PID:6020
- C:\Windows\System\WLiqQBf.exe
  C:\Windows\System\WLiqQBf.exe
  2⤵
  PID:6052
- C:\Windows\System\rRwZpEM.exe
  C:\Windows\System\rRwZpEM.exe
  2⤵
  PID:6104
- C:\Windows\System\ipJEsZq.exe
  C:\Windows\System\ipJEsZq.exe
  2⤵
  PID:4324
- C:\Windows\System\JNGZFHw.exe
  C:\Windows\System\JNGZFHw.exe
  2⤵
  PID:4976
- C:\Windows\System\tUBfJcf.exe
  C:\Windows\System\tUBfJcf.exe
  2⤵
  PID:4972
- C:\Windows\System\AOXfPVg.exe
  C:\Windows\System\AOXfPVg.exe
  2⤵
  PID:4272
- C:\Windows\System\oWTNmTx.exe
  C:\Windows\System\oWTNmTx.exe
  2⤵
  PID:5304
- C:\Windows\System\LfzRgXb.exe
  C:\Windows\System\LfzRgXb.exe
  2⤵
  PID:5144
- C:\Windows\System\qJTSIrv.exe
  C:\Windows\System\qJTSIrv.exe
  2⤵
  PID:4368
- C:\Windows\System\hUJTGCG.exe
  C:\Windows\System\hUJTGCG.exe
  2⤵
  PID:5496
- C:\Windows\System\HnEcXGT.exe
  C:\Windows\System\HnEcXGT.exe
  2⤵
  PID:5652
- C:\Windows\System\LgsCQxC.exe
  C:\Windows\System\LgsCQxC.exe
  2⤵
  PID:5712
- C:\Windows\System\sXwQFNv.exe
  C:\Windows\System\sXwQFNv.exe
  2⤵
  PID:5540
- C:\Windows\System\jADufyf.exe
  C:\Windows\System\jADufyf.exe
  2⤵
  PID:5752
- C:\Windows\System\yYPVPXC.exe
  C:\Windows\System\yYPVPXC.exe
  2⤵
  PID:4020
- C:\Windows\System\GwidEkE.exe
  C:\Windows\System\GwidEkE.exe
  2⤵
  PID:4980
- C:\Windows\System\QvqXZnW.exe
  C:\Windows\System\QvqXZnW.exe
  2⤵
  PID:5516
- C:\Windows\System\FUEyXEo.exe
  C:\Windows\System\FUEyXEo.exe
  2⤵
  PID:5560
- C:\Windows\System\hrcZJTP.exe
  C:\Windows\System\hrcZJTP.exe
  2⤵
  PID:5476
- C:\Windows\System\oxWYAai.exe
  C:\Windows\System\oxWYAai.exe
  2⤵
  PID:5840
- C:\Windows\System\hLVIZZh.exe
  C:\Windows\System\hLVIZZh.exe
  2⤵
  PID:5896
- C:\Windows\System\malWkQN.exe
  C:\Windows\System\malWkQN.exe
  2⤵
  PID:5856
- C:\Windows\System\UVYjbMU.exe
  C:\Windows\System\UVYjbMU.exe
  2⤵
  PID:5916
- C:\Windows\System\DNxJQdJ.exe
  C:\Windows\System\DNxJQdJ.exe
  2⤵
  PID:6068
- C:\Windows\System\UTnUzWo.exe
  C:\Windows\System\UTnUzWo.exe
  2⤵
  PID:5984
- C:\Windows\System\oAjDqON.exe
  C:\Windows\System\oAjDqON.exe
  2⤵
  PID:3804
- C:\Windows\System\PnaoEcW.exe
  C:\Windows\System\PnaoEcW.exe
  2⤵
  PID:3656
- C:\Windows\System\tidEeOy.exe
  C:\Windows\System\tidEeOy.exe
  2⤵
  PID:4400
- C:\Windows\System\ZBBncBi.exe
  C:\Windows\System\ZBBncBi.exe
  2⤵
  PID:5748
- C:\Windows\System\ThKyrSd.exe
  C:\Windows\System\ThKyrSd.exe
  2⤵
  PID:5504
- C:\Windows\System\FCFMHsj.exe
  C:\Windows\System\FCFMHsj.exe
  2⤵
  PID:5364
- C:\Windows\System\McIXyKk.exe
  C:\Windows\System\McIXyKk.exe
  2⤵
  PID:5696
- C:\Windows\System\laKPqmY.exe
  C:\Windows\System\laKPqmY.exe
  2⤵
  PID:5668
- C:\Windows\System\IMMwyKN.exe
  C:\Windows\System\IMMwyKN.exe
  2⤵
  PID:5804
- C:\Windows\System\xCTptbD.exe
  C:\Windows\System\xCTptbD.exe
  2⤵
  PID:5480
- C:\Windows\System\gXGmOPk.exe
  C:\Windows\System\gXGmOPk.exe
  2⤵
  PID:5908
- C:\Windows\System\ycMieIE.exe
  C:\Windows\System\ycMieIE.exe
  2⤵
  PID:5828
- C:\Windows\System\fZknuht.exe
  C:\Windows\System\fZknuht.exe
  2⤵
  PID:6100
- C:\Windows\System\XihCdAl.exe
  C:\Windows\System\XihCdAl.exe
  2⤵
  PID:3232
- C:\Windows\System\qrdnWLL.exe
  C:\Windows\System\qrdnWLL.exe
  2⤵
  PID:4860
- C:\Windows\System\GneUovg.exe
  C:\Windows\System\GneUovg.exe
  2⤵
  PID:5308
- C:\Windows\System\bWqSLxk.exe
  C:\Windows\System\bWqSLxk.exe
  2⤵
  PID:5380
- C:\Windows\System\xAioMIq.exe
  C:\Windows\System\xAioMIq.exe
  2⤵
  PID:5448
- C:\Windows\System\OdPNhom.exe
  C:\Windows\System\OdPNhom.exe
  2⤵
  PID:4180
- C:\Windows\System\MXyvyMS.exe
  C:\Windows\System\MXyvyMS.exe
  2⤵
  PID:5348
- C:\Windows\System\nuVwlJu.exe
  C:\Windows\System\nuVwlJu.exe
  2⤵
  PID:5296
- C:\Windows\System\yiSIxzl.exe
  C:\Windows\System\yiSIxzl.exe
  2⤵
  PID:5156
- C:\Windows\System\YsyEmXV.exe
  C:\Windows\System\YsyEmXV.exe
  2⤵
  PID:5732
- C:\Windows\System\gLfnEYW.exe
  C:\Windows\System\gLfnEYW.exe
  2⤵
  PID:6036
- C:\Windows\System\eKCbQBG.exe
  C:\Windows\System\eKCbQBG.exe
  2⤵
  PID:5720
- C:\Windows\System\gGeSrTb.exe
  C:\Windows\System\gGeSrTb.exe
  2⤵
  PID:6164
- C:\Windows\System\Kloooro.exe
  C:\Windows\System\Kloooro.exe
  2⤵
  PID:6180
- C:\Windows\System\GRMtSXo.exe
  C:\Windows\System\GRMtSXo.exe
  2⤵
  PID:6196
- C:\Windows\System\PPhGOGp.exe
  C:\Windows\System\PPhGOGp.exe
  2⤵
  PID:6224
- C:\Windows\System\sgoqSIs.exe
  C:\Windows\System\sgoqSIs.exe
  2⤵
  PID:6240
- C:\Windows\System\njJIfXJ.exe
  C:\Windows\System\njJIfXJ.exe
  2⤵
  PID:6256
- C:\Windows\System\zCkcipV.exe
  C:\Windows\System\zCkcipV.exe
  2⤵
  PID:6272
- C:\Windows\System\nYeTLas.exe
  C:\Windows\System\nYeTLas.exe
  2⤵
  PID:6296
- C:\Windows\System\nSRqqDf.exe
  C:\Windows\System\nSRqqDf.exe
  2⤵
  PID:6316
- C:\Windows\System\jmSYuPE.exe
  C:\Windows\System\jmSYuPE.exe
  2⤵
  PID:6332
- C:\Windows\System\nWIhYHM.exe
  C:\Windows\System\nWIhYHM.exe
  2⤵
  PID:6348
- C:\Windows\System\URpRKbi.exe
  C:\Windows\System\URpRKbi.exe
  2⤵
  PID:6364
- C:\Windows\System\HnEeMzt.exe
  C:\Windows\System\HnEeMzt.exe
  2⤵
  PID:6380
- C:\Windows\System\ouQaDtM.exe
  C:\Windows\System\ouQaDtM.exe
  2⤵
  PID:6396
- C:\Windows\System\pjDgery.exe
  C:\Windows\System\pjDgery.exe
  2⤵
  PID:6412
- C:\Windows\System\SmsRMKo.exe
  C:\Windows\System\SmsRMKo.exe
  2⤵
  PID:6428
- C:\Windows\System\SkvWxeT.exe
  C:\Windows\System\SkvWxeT.exe
  2⤵
  PID:6448
- C:\Windows\System\pvHvJkD.exe
  C:\Windows\System\pvHvJkD.exe
  2⤵
  PID:6464
- C:\Windows\System\dvnjZyh.exe
  C:\Windows\System\dvnjZyh.exe
  2⤵
  PID:6480
- C:\Windows\System\ryPTgKj.exe
  C:\Windows\System\ryPTgKj.exe
  2⤵
  PID:6496
- C:\Windows\System\LaUhSvS.exe
  C:\Windows\System\LaUhSvS.exe
  2⤵
  PID:6512
- C:\Windows\System\KWjmJhb.exe
  C:\Windows\System\KWjmJhb.exe
  2⤵
  PID:6528
- C:\Windows\System\TxYxYqk.exe
  C:\Windows\System\TxYxYqk.exe
  2⤵
  PID:6544
- C:\Windows\System\UpRIKQg.exe
  C:\Windows\System\UpRIKQg.exe
  2⤵
  PID:6560
- C:\Windows\System\nJTFJRg.exe
  C:\Windows\System\nJTFJRg.exe
  2⤵
  PID:6576
- C:\Windows\System\WbWEPbU.exe
  C:\Windows\System\WbWEPbU.exe
  2⤵
  PID:6592
- C:\Windows\System\kXITJNu.exe
  C:\Windows\System\kXITJNu.exe
  2⤵
  PID:6612
- C:\Windows\System\SaRXpEG.exe
  C:\Windows\System\SaRXpEG.exe
  2⤵
  PID:6628
- C:\Windows\System\RojZKaT.exe
  C:\Windows\System\RojZKaT.exe
  2⤵
  PID:6644
- C:\Windows\System\BOhDReC.exe
  C:\Windows\System\BOhDReC.exe
  2⤵
  PID:6660
- C:\Windows\System\PSiITDR.exe
  C:\Windows\System\PSiITDR.exe
  2⤵
  PID:6676
- C:\Windows\System\GRedhmb.exe
  C:\Windows\System\GRedhmb.exe
  2⤵
  PID:6692
- C:\Windows\System\URQupJC.exe
  C:\Windows\System\URQupJC.exe
  2⤵
  PID:6708
- C:\Windows\System\cMmSJbm.exe
  C:\Windows\System\cMmSJbm.exe
  2⤵
  PID:6724
- C:\Windows\System\WtldyRP.exe
  C:\Windows\System\WtldyRP.exe
  2⤵
  PID:6740
- C:\Windows\System\zQurUWh.exe
  C:\Windows\System\zQurUWh.exe
  2⤵
  PID:6756
- C:\Windows\System\vmjlNsj.exe
  C:\Windows\System\vmjlNsj.exe
  2⤵
  PID:6772
- C:\Windows\System\apHqBPI.exe
  C:\Windows\System\apHqBPI.exe
  2⤵
  PID:6788
- C:\Windows\System\kLRRfCc.exe
  C:\Windows\System\kLRRfCc.exe
  2⤵
  PID:6804
- C:\Windows\System\iPlsNjD.exe
  C:\Windows\System\iPlsNjD.exe
  2⤵
  PID:6820
- C:\Windows\System\QCcUiKG.exe
  C:\Windows\System\QCcUiKG.exe
  2⤵
  PID:6836
- C:\Windows\System\cFGVyew.exe
  C:\Windows\System\cFGVyew.exe
  2⤵
  PID:6852
- C:\Windows\System\wjsukdN.exe
  C:\Windows\System\wjsukdN.exe
  2⤵
  PID:6868
- C:\Windows\System\yWSasLj.exe
  C:\Windows\System\yWSasLj.exe
  2⤵
  PID:6884
- C:\Windows\System\LHPUZDP.exe
  C:\Windows\System\LHPUZDP.exe
  2⤵
  PID:6900
- C:\Windows\System\KXtLSGc.exe
  C:\Windows\System\KXtLSGc.exe
  2⤵
  PID:6916
- C:\Windows\System\OEzdPQN.exe
  C:\Windows\System\OEzdPQN.exe
  2⤵
  PID:6940
- C:\Windows\System\Jwdklsg.exe
  C:\Windows\System\Jwdklsg.exe
  2⤵
  PID:6956
- C:\Windows\System\JZvRvhn.exe
  C:\Windows\System\JZvRvhn.exe
  2⤵
  PID:6972
- C:\Windows\System\DxNZeuv.exe
  C:\Windows\System\DxNZeuv.exe
  2⤵
  PID:6988
- C:\Windows\System\NCiyirM.exe
  C:\Windows\System\NCiyirM.exe
  2⤵
  PID:7008
- C:\Windows\System\cAZHKSx.exe
  C:\Windows\System\cAZHKSx.exe
  2⤵
  PID:7024
- C:\Windows\System\KOUdoAk.exe
  C:\Windows\System\KOUdoAk.exe
  2⤵
  PID:7044
- C:\Windows\System\KPRpJMI.exe
  C:\Windows\System\KPRpJMI.exe
  2⤵
  PID:7136
- C:\Windows\System\HMARNIs.exe
  C:\Windows\System\HMARNIs.exe
  2⤵
  PID:7152
- C:\Windows\System\DAtRsJn.exe
  C:\Windows\System\DAtRsJn.exe
  2⤵
  PID:5140
- C:\Windows\System\IxmgJXM.exe
  C:\Windows\System\IxmgJXM.exe
  2⤵
  PID:5592
- C:\Windows\System\HexKDhu.exe
  C:\Windows\System\HexKDhu.exe
  2⤵
  PID:6156
- C:\Windows\System\ZmuwQKC.exe
  C:\Windows\System\ZmuwQKC.exe
  2⤵
  PID:880
- C:\Windows\System\zImXshE.exe
  C:\Windows\System\zImXshE.exe
  2⤵
  PID:5228
- C:\Windows\System\qSmhqob.exe
  C:\Windows\System\qSmhqob.exe
  2⤵
  PID:6004
- C:\Windows\System\WeTKzZi.exe
  C:\Windows\System\WeTKzZi.exe
  2⤵
  PID:5384
- C:\Windows\System\hdrzFFy.exe
  C:\Windows\System\hdrzFFy.exe
  2⤵
  PID:6108
- C:\Windows\System\GPhOujT.exe
  C:\Windows\System\GPhOujT.exe
  2⤵
  PID:6216
- C:\Windows\System\TwgEAup.exe
  C:\Windows\System\TwgEAup.exe
  2⤵
  PID:6236
- C:\Windows\System\SEYraOz.exe
  C:\Windows\System\SEYraOz.exe
  2⤵
  PID:6268
- C:\Windows\System\pTSmzrB.exe
  C:\Windows\System\pTSmzrB.exe
  2⤵
  PID:6372
- C:\Windows\System\uIuGoEb.exe
  C:\Windows\System\uIuGoEb.exe
  2⤵
  PID:6424
- C:\Windows\System\xBwYUQJ.exe
  C:\Windows\System\xBwYUQJ.exe
  2⤵
  PID:6436
- C:\Windows\System\XQrblMF.exe
  C:\Windows\System\XQrblMF.exe
  2⤵
  PID:6508
- C:\Windows\System\PiUOikw.exe
  C:\Windows\System\PiUOikw.exe
  2⤵
  PID:6440
- C:\Windows\System\lNcCcOi.exe
  C:\Windows\System\lNcCcOi.exe
  2⤵
  PID:6520
- C:\Windows\System\JDAJXMt.exe
  C:\Windows\System\JDAJXMt.exe
  2⤵
  PID:6568
- C:\Windows\System\QkUcFDr.exe
  C:\Windows\System\QkUcFDr.exe
  2⤵
  PID:6620
- C:\Windows\System\nRKGGVX.exe
  C:\Windows\System\nRKGGVX.exe
  2⤵
  PID:6688
- C:\Windows\System\HqftoFz.exe
  C:\Windows\System\HqftoFz.exe
  2⤵
  PID:6700
- C:\Windows\System\KhyPYhO.exe
  C:\Windows\System\KhyPYhO.exe
  2⤵
  PID:6716
- C:\Windows\System\FZinbWu.exe
  C:\Windows\System\FZinbWu.exe
  2⤵
  PID:6636
- C:\Windows\System\fzkxRwY.exe
  C:\Windows\System\fzkxRwY.exe
  2⤵
  PID:6768
- C:\Windows\System\uWbFEpR.exe
  C:\Windows\System\uWbFEpR.exe
  2⤵
  PID:6800
- C:\Windows\System\GMtjrxS.exe
  C:\Windows\System\GMtjrxS.exe
  2⤵
  PID:6832
- C:\Windows\System\EKELGFo.exe
  C:\Windows\System\EKELGFo.exe
  2⤵
  PID:6876
- C:\Windows\System\jBaARiQ.exe
  C:\Windows\System\jBaARiQ.exe
  2⤵
  PID:6892
- C:\Windows\System\RGPymao.exe
  C:\Windows\System\RGPymao.exe
  2⤵
  PID:6948
- C:\Windows\System\ddQIlkT.exe
  C:\Windows\System\ddQIlkT.exe
  2⤵
  PID:7052
- C:\Windows\System\XTSaSEE.exe
  C:\Windows\System\XTSaSEE.exe
  2⤵
  PID:7040
- C:\Windows\System\kLIuWQs.exe
  C:\Windows\System\kLIuWQs.exe
  2⤵
  PID:7080
- C:\Windows\System\cNnZBKb.exe
  C:\Windows\System\cNnZBKb.exe
  2⤵
  PID:7100
- C:\Windows\System\nwTRoTD.exe
  C:\Windows\System\nwTRoTD.exe
  2⤵
  PID:7132
- C:\Windows\System\lXokJDp.exe
  C:\Windows\System\lXokJDp.exe
  2⤵
  PID:7144
- C:\Windows\System\RXziYJC.exe
  C:\Windows\System\RXziYJC.exe
  2⤵
  PID:6208
- C:\Windows\System\KEATBeE.exe
  C:\Windows\System\KEATBeE.exe
  2⤵
  PID:6292
- C:\Windows\System\ZCyRhCJ.exe
  C:\Windows\System\ZCyRhCJ.exe
  2⤵
  PID:6304
- C:\Windows\System\KcjdlEd.exe
  C:\Windows\System\KcjdlEd.exe
  2⤵
  PID:6340
- C:\Windows\System\lvCovMC.exe
  C:\Windows\System\lvCovMC.exe
  2⤵
  PID:6748
- C:\Windows\System\BWbszYO.exe
  C:\Windows\System\BWbszYO.exe
  2⤵
  PID:6732
- C:\Windows\System\jEQwfig.exe
  C:\Windows\System\jEQwfig.exe
  2⤵
  PID:6912
- C:\Windows\System\EhQaALQ.exe
  C:\Windows\System\EhQaALQ.exe
  2⤵
  PID:7016
- C:\Windows\System\oGNvvii.exe
  C:\Windows\System\oGNvvii.exe
  2⤵
  PID:6932
- C:\Windows\System\bHAalwL.exe
  C:\Windows\System\bHAalwL.exe
  2⤵
  PID:7092
- C:\Windows\System\euwvbga.exe
  C:\Windows\System\euwvbga.exe
  2⤵
  PID:7128
- C:\Windows\System\iYwexXk.exe
  C:\Windows\System\iYwexXk.exe
  2⤵
  PID:6188
- C:\Windows\System\sTgMICm.exe
  C:\Windows\System\sTgMICm.exe
  2⤵
  PID:5796
- C:\Windows\System\dBOOdid.exe
  C:\Windows\System\dBOOdid.exe
  2⤵
  PID:5600
- C:\Windows\System\ARLuuLd.exe
  C:\Windows\System\ARLuuLd.exe
  2⤵
  PID:6232
- C:\Windows\System\jugYwxl.exe
  C:\Windows\System\jugYwxl.exe
  2⤵
  PID:6328
- C:\Windows\System\BNulHlw.exe
  C:\Windows\System\BNulHlw.exe
  2⤵
  PID:6476
- C:\Windows\System\MHUbsCf.exe
  C:\Windows\System\MHUbsCf.exe
  2⤵
  PID:6408
- C:\Windows\System\rTZUcTA.exe
  C:\Windows\System\rTZUcTA.exe
  2⤵
  PID:6684
- C:\Windows\System\lqxoGEt.exe
  C:\Windows\System\lqxoGEt.exe
  2⤵
  PID:6752
- C:\Windows\System\urkNdUM.exe
  C:\Windows\System\urkNdUM.exe
  2⤵
  PID:6672
- C:\Windows\System\grOnYMU.exe
  C:\Windows\System\grOnYMU.exe
  2⤵
  PID:6796
- C:\Windows\System\JBUXuOW.exe
  C:\Windows\System\JBUXuOW.exe
  2⤵
  PID:6896
- C:\Windows\System\mtJuAgz.exe
  C:\Windows\System\mtJuAgz.exe
  2⤵
  PID:6996
- C:\Windows\System\GErnCLc.exe
  C:\Windows\System\GErnCLc.exe
  2⤵
  PID:6964
- C:\Windows\System\knaVIyb.exe
  C:\Windows\System\knaVIyb.exe
  2⤵
  PID:7108
- C:\Windows\System\qgZBYbz.exe
  C:\Windows\System\qgZBYbz.exe
  2⤵
  PID:6344
- C:\Windows\System\IyzUHGR.exe
  C:\Windows\System\IyzUHGR.exe
  2⤵
  PID:5736
- C:\Windows\System\EqznIHz.exe
  C:\Windows\System\EqznIHz.exe
  2⤵
  PID:5764
- C:\Windows\System\wiXodqy.exe
  C:\Windows\System\wiXodqy.exe
  2⤵
  PID:1568
- C:\Windows\System\ueeHjUN.exe
  C:\Windows\System\ueeHjUN.exe
  2⤵
  PID:6460
- C:\Windows\System\ctoiEhE.exe
  C:\Windows\System\ctoiEhE.exe
  2⤵
  PID:6552
- C:\Windows\System\LzMmZiC.exe
  C:\Windows\System\LzMmZiC.exe
  2⤵
  PID:6572
- C:\Windows\System\qfTHAIt.exe
  C:\Windows\System\qfTHAIt.exe
  2⤵
  PID:6980
- C:\Windows\System\HijDCnZ.exe
  C:\Windows\System\HijDCnZ.exe
  2⤵
  PID:7032
- C:\Windows\System\uPSocwH.exe
  C:\Windows\System\uPSocwH.exe
  2⤵
  PID:7116
- C:\Windows\System\poTNkIk.exe
  C:\Windows\System\poTNkIk.exe
  2⤵
  PID:5160
- C:\Windows\System\znfdImI.exe
  C:\Windows\System\znfdImI.exe
  2⤵
  PID:6176
- C:\Windows\System\CojrzhG.exe
  C:\Windows\System\CojrzhG.exe
  2⤵
  PID:6360
- C:\Windows\System\SZzsybw.exe
  C:\Windows\System\SZzsybw.exe
  2⤵
  PID:6656
- C:\Windows\System\mzWkMtG.exe
  C:\Windows\System\mzWkMtG.exe
  2⤵
  PID:6600
- C:\Windows\System\IhwEgdL.exe
  C:\Windows\System\IhwEgdL.exe
  2⤵
  PID:7164
- C:\Windows\System\bsnzmln.exe
  C:\Windows\System\bsnzmln.exe
  2⤵
  PID:6192
- C:\Windows\System\wREpkip.exe
  C:\Windows\System\wREpkip.exe
  2⤵
  PID:5396
- C:\Windows\System\KvFWkRa.exe
  C:\Windows\System\KvFWkRa.exe
  2⤵
  PID:6936
- C:\Windows\System\uckKKUE.exe
  C:\Windows\System\uckKKUE.exe
  2⤵
  PID:7176
- C:\Windows\System\HtPKKBp.exe
  C:\Windows\System\HtPKKBp.exe
  2⤵
  PID:7196
- C:\Windows\System\FreWOyB.exe
  C:\Windows\System\FreWOyB.exe
  2⤵
  PID:7212
- C:\Windows\System\FAjzMFq.exe
  C:\Windows\System\FAjzMFq.exe
  2⤵
  PID:7228
- C:\Windows\System\dFTPkeP.exe
  C:\Windows\System\dFTPkeP.exe
  2⤵
  PID:7244
- C:\Windows\System\njTtZPT.exe
  C:\Windows\System\njTtZPT.exe
  2⤵
  PID:7264
- C:\Windows\System\PqsQCNx.exe
  C:\Windows\System\PqsQCNx.exe
  2⤵
  PID:7280
- C:\Windows\System\yIlUWdw.exe
  C:\Windows\System\yIlUWdw.exe
  2⤵
  PID:7296
- C:\Windows\System\wdhkmZT.exe
  C:\Windows\System\wdhkmZT.exe
  2⤵
  PID:7312
- C:\Windows\System\ZtYSMkL.exe
  C:\Windows\System\ZtYSMkL.exe
  2⤵
  PID:7328
- C:\Windows\System\yKyqpkU.exe
  C:\Windows\System\yKyqpkU.exe
  2⤵
  PID:7348
- C:\Windows\System\KKYYZrb.exe
  C:\Windows\System\KKYYZrb.exe
  2⤵
  PID:7364
- C:\Windows\System\IMEPfCj.exe
  C:\Windows\System\IMEPfCj.exe
  2⤵
  PID:7380
- C:\Windows\System\EnTEcLx.exe
  C:\Windows\System\EnTEcLx.exe
  2⤵
  PID:7396
- C:\Windows\System\OPbDuIx.exe
  C:\Windows\System\OPbDuIx.exe
  2⤵
  PID:7412
- C:\Windows\System\EBOeqtm.exe
  C:\Windows\System\EBOeqtm.exe
  2⤵
  PID:7428
- C:\Windows\System\SgxCsqv.exe
  C:\Windows\System\SgxCsqv.exe
  2⤵
  PID:7448
- C:\Windows\System\vosipgZ.exe
  C:\Windows\System\vosipgZ.exe
  2⤵
  PID:7468
- C:\Windows\System\kgEfwbJ.exe
  C:\Windows\System\kgEfwbJ.exe
  2⤵
  PID:7484
- C:\Windows\System\gBQunfO.exe
  C:\Windows\System\gBQunfO.exe
  2⤵
  PID:7500
- C:\Windows\System\ZAvomrA.exe
  C:\Windows\System\ZAvomrA.exe
  2⤵
  PID:7520
- C:\Windows\System\ffzUnvz.exe
  C:\Windows\System\ffzUnvz.exe
  2⤵
  PID:7592
- C:\Windows\System\ZsMHacQ.exe
  C:\Windows\System\ZsMHacQ.exe
  2⤵
  PID:7612
- C:\Windows\System\XUCdorG.exe
  C:\Windows\System\XUCdorG.exe
  2⤵
  PID:7632
- C:\Windows\System\hyWmBPm.exe
  C:\Windows\System\hyWmBPm.exe
  2⤵
  PID:7648
- C:\Windows\System\pwtpXPg.exe
  C:\Windows\System\pwtpXPg.exe
  2⤵
  PID:7664
- C:\Windows\System\QeikcWY.exe
  C:\Windows\System\QeikcWY.exe
  2⤵
  PID:7680
- C:\Windows\System\AaTBMAx.exe
  C:\Windows\System\AaTBMAx.exe
  2⤵
  PID:7696
- C:\Windows\System\MLzrLYJ.exe
  C:\Windows\System\MLzrLYJ.exe
  2⤵
  PID:7768
- C:\Windows\System\IpdqhqS.exe
  C:\Windows\System\IpdqhqS.exe
  2⤵
  PID:7784
- C:\Windows\System\oiEvxoB.exe
  C:\Windows\System\oiEvxoB.exe
  2⤵
  PID:7800
- C:\Windows\System\fxogXhj.exe
  C:\Windows\System\fxogXhj.exe
  2⤵
  PID:7816
- C:\Windows\System\jWqDnSw.exe
  C:\Windows\System\jWqDnSw.exe
  2⤵
  PID:7832
- C:\Windows\System\neDSDba.exe
  C:\Windows\System\neDSDba.exe
  2⤵
  PID:7848
- C:\Windows\System\OTqJTQU.exe
  C:\Windows\System\OTqJTQU.exe
  2⤵
  PID:7864
- C:\Windows\System\jNmYjXb.exe
  C:\Windows\System\jNmYjXb.exe
  2⤵
  PID:7884
- C:\Windows\System\aCZKUxq.exe
  C:\Windows\System\aCZKUxq.exe
  2⤵
  PID:7900
- C:\Windows\System\gmVzSQO.exe
  C:\Windows\System\gmVzSQO.exe
  2⤵
  PID:7952
- C:\Windows\System\mjHWhra.exe
  C:\Windows\System\mjHWhra.exe
  2⤵
  PID:7968
- C:\Windows\System\KLmyxwZ.exe
  C:\Windows\System\KLmyxwZ.exe
  2⤵
  PID:7988
- C:\Windows\System\huwrPFc.exe
  C:\Windows\System\huwrPFc.exe
  2⤵
  PID:8008
- C:\Windows\System\gfJzfKX.exe
  C:\Windows\System\gfJzfKX.exe
  2⤵
  PID:8052
- C:\Windows\System\dZJiIdD.exe
  C:\Windows\System\dZJiIdD.exe
  2⤵
  PID:8068
- C:\Windows\System\oIfcWdi.exe
  C:\Windows\System\oIfcWdi.exe
  2⤵
  PID:8084
- C:\Windows\System\gLfQruM.exe
  C:\Windows\System\gLfQruM.exe
  2⤵
  PID:8100
- C:\Windows\System\sypkmGP.exe
  C:\Windows\System\sypkmGP.exe
  2⤵
  PID:8120
- C:\Windows\System\kMnfBNy.exe
  C:\Windows\System\kMnfBNy.exe
  2⤵
  PID:8144
- C:\Windows\System\cFzzIeA.exe
  C:\Windows\System\cFzzIeA.exe
  2⤵
  PID:8164
- C:\Windows\System\GuQvqli.exe
  C:\Windows\System\GuQvqli.exe
  2⤵
  PID:8184
- C:\Windows\System\HNDjmJQ.exe
  C:\Windows\System\HNDjmJQ.exe
  2⤵
  PID:7272
- C:\Windows\System\oYkjxop.exe
  C:\Windows\System\oYkjxop.exe
  2⤵
  PID:7336
- C:\Windows\System\CLwbqST.exe
  C:\Windows\System\CLwbqST.exe
  2⤵
  PID:7404
- C:\Windows\System\tPJyeed.exe
  C:\Windows\System\tPJyeed.exe
  2⤵
  PID:7172
- C:\Windows\System\qtQBmyY.exe
  C:\Windows\System\qtQBmyY.exe
  2⤵
  PID:7204
- C:\Windows\System\vTAKYow.exe
  C:\Windows\System\vTAKYow.exe
  2⤵
  PID:7508
- C:\Windows\System\lsUekjK.exe
  C:\Windows\System\lsUekjK.exe
  2⤵
  PID:7288
- C:\Windows\System\mGjgWaL.exe
  C:\Windows\System\mGjgWaL.exe
  2⤵
  PID:7220
- C:\Windows\System\MVWxHXm.exe
  C:\Windows\System\MVWxHXm.exe
  2⤵
  PID:6488
- C:\Windows\System\qzgLnkg.exe
  C:\Windows\System\qzgLnkg.exe
  2⤵
  PID:7320
- C:\Windows\System\pqOBoEf.exe
  C:\Windows\System\pqOBoEf.exe
  2⤵
  PID:7464
- C:\Windows\System\SAHcaxl.exe
  C:\Windows\System\SAHcaxl.exe
  2⤵
  PID:7540
- C:\Windows\System\oftBcgB.exe
  C:\Windows\System\oftBcgB.exe
  2⤵
  PID:7544
- C:\Windows\System\vhTENVO.exe
  C:\Windows\System\vhTENVO.exe
  2⤵
  PID:7564
- C:\Windows\System\xObwodC.exe
  C:\Windows\System\xObwodC.exe
  2⤵
  PID:7576
- C:\Windows\System\kekFSuT.exe
  C:\Windows\System\kekFSuT.exe
  2⤵
  PID:7644
- C:\Windows\System\tEzSqMQ.exe
  C:\Windows\System\tEzSqMQ.exe
  2⤵
  PID:7660
- C:\Windows\System\VLxWoUm.exe
  C:\Windows\System\VLxWoUm.exe
  2⤵
  PID:7712
- C:\Windows\System\IGKlNdW.exe
  C:\Windows\System\IGKlNdW.exe
  2⤵
  PID:7732
- C:\Windows\System\vEHbhqp.exe
  C:\Windows\System\vEHbhqp.exe
  2⤵
  PID:7748
- C:\Windows\System\tkmDgXh.exe
  C:\Windows\System\tkmDgXh.exe
  2⤵
  PID:7764
- C:\Windows\System\DvvdRMN.exe
  C:\Windows\System\DvvdRMN.exe
  2⤵
  PID:7824
- C:\Windows\System\riHVhIz.exe
  C:\Windows\System\riHVhIz.exe
  2⤵
  PID:7840
- C:\Windows\System\fHBZFfJ.exe
  C:\Windows\System\fHBZFfJ.exe
  2⤵
  PID:7872
- C:\Windows\System\YrLQeeg.exe
  C:\Windows\System\YrLQeeg.exe
  2⤵
  PID:7780
- C:\Windows\System\JrpqSPX.exe
  C:\Windows\System\JrpqSPX.exe
  2⤵
  PID:7916
- C:\Windows\System\LuVxUNK.exe
  C:\Windows\System\LuVxUNK.exe
  2⤵
  PID:7932
- C:\Windows\System\KTOWFVt.exe
  C:\Windows\System\KTOWFVt.exe
  2⤵
  PID:8156
- C:\Windows\System\ddAHrTz.exe
  C:\Windows\System\ddAHrTz.exe
  2⤵
  PID:7096
- C:\Windows\System\ifzcNaT.exe
  C:\Windows\System\ifzcNaT.exe
  2⤵
  PID:7372
- C:\Windows\System\QVorrpH.exe
  C:\Windows\System\QVorrpH.exe
  2⤵
  PID:7516
- C:\Windows\System\dWEYznP.exe
  C:\Windows\System\dWEYznP.exe
  2⤵
  PID:7608
- C:\Windows\System\eWNWrUB.exe
  C:\Windows\System\eWNWrUB.exe
  2⤵
  PID:8132
- C:\Windows\System\KqAEESj.exe
  C:\Windows\System\KqAEESj.exe
  2⤵
  PID:8180
- C:\Windows\System\hTMpSSj.exe
  C:\Windows\System\hTMpSSj.exe
  2⤵
  PID:7344
- C:\Windows\System\jdYcNHz.exe
  C:\Windows\System\jdYcNHz.exe
  2⤵
  PID:7120
- C:\Windows\System\bojsNlH.exe
  C:\Windows\System\bojsNlH.exe
  2⤵
  PID:7424
- C:\Windows\System\BMcxmVU.exe
  C:\Windows\System\BMcxmVU.exe
  2⤵
  PID:7356
- C:\Windows\System\JPgMHlo.exe
  C:\Windows\System\JPgMHlo.exe
  2⤵
  PID:7588
- C:\Windows\System\LxQySEK.exe
  C:\Windows\System\LxQySEK.exe
  2⤵
  PID:7560
- C:\Windows\System\LVifwuT.exe
  C:\Windows\System\LVifwuT.exe
  2⤵
  PID:7708
- C:\Windows\System\XRhYaNA.exe
  C:\Windows\System\XRhYaNA.exe
  2⤵
  PID:7796
- C:\Windows\System\ZdDKEnJ.exe
  C:\Windows\System\ZdDKEnJ.exe
  2⤵
  PID:7720
- C:\Windows\System\vUybgIR.exe
  C:\Windows\System\vUybgIR.exe
  2⤵
  PID:7760
- C:\Windows\System\HXodvhv.exe
  C:\Windows\System\HXodvhv.exe
  2⤵
  PID:7860
- C:\Windows\System\kYXcdhy.exe
  C:\Windows\System\kYXcdhy.exe
  2⤵
  PID:7912
- C:\Windows\System\SMYTkrC.exe
  C:\Windows\System\SMYTkrC.exe
  2⤵
  PID:7928
- C:\Windows\System\peNoqfn.exe
  C:\Windows\System\peNoqfn.exe
  2⤵
  PID:7976
- C:\Windows\System\jnnYWem.exe
  C:\Windows\System\jnnYWem.exe
  2⤵
  PID:7996
- C:\Windows\System\MqqwQNu.exe
  C:\Windows\System\MqqwQNu.exe
  2⤵
  PID:8004
- C:\Windows\System\nlAkBDT.exe
  C:\Windows\System\nlAkBDT.exe
  2⤵
  PID:8064
- C:\Windows\System\PeQTqCX.exe
  C:\Windows\System\PeQTqCX.exe
  2⤵
  PID:7944
- C:\Windows\System\rMDrsPt.exe
  C:\Windows\System\rMDrsPt.exe
  2⤵
  PID:8140
- C:\Windows\System\JXgfoIk.exe
  C:\Windows\System\JXgfoIk.exe
  2⤵
  PID:7308
- C:\Windows\System\NIduSop.exe
  C:\Windows\System\NIduSop.exe
  2⤵
  PID:7340
- C:\Windows\System\vIqMhfA.exe
  C:\Windows\System\vIqMhfA.exe
  2⤵
  PID:8076
- C:\Windows\System\PZrhKeT.exe
  C:\Windows\System\PZrhKeT.exe
  2⤵
  PID:7620
- C:\Windows\System\znOgKBB.exe
  C:\Windows\System\znOgKBB.exe
  2⤵
  PID:7876
- C:\Windows\System\YsZpdXE.exe
  C:\Windows\System\YsZpdXE.exe
  2⤵
  PID:8080
- C:\Windows\System\oUdyYoD.exe
  C:\Windows\System\oUdyYoD.exe
  2⤵
  PID:7420
- C:\Windows\System\bPUABuc.exe
  C:\Windows\System\bPUABuc.exe
  2⤵
  PID:7460
- C:\Windows\System\pFKOLBZ.exe
  C:\Windows\System\pFKOLBZ.exe
  2⤵
  PID:8096
- C:\Windows\System\HZjyubp.exe
  C:\Windows\System\HZjyubp.exe
  2⤵
  PID:7496
- C:\Windows\System\LWzfuce.exe
  C:\Windows\System\LWzfuce.exe
  2⤵
  PID:7744
- C:\Windows\System\cRNqXtm.exe
  C:\Windows\System\cRNqXtm.exe
  2⤵
  PID:7688
- C:\Windows\System\EdQzVHZ.exe
  C:\Windows\System\EdQzVHZ.exe
  2⤵
  PID:7392
- C:\Windows\System\sucJHfY.exe
  C:\Windows\System\sucJHfY.exe
  2⤵
  PID:7964
- C:\Windows\System\noDjGUr.exe
  C:\Windows\System\noDjGUr.exe
  2⤵
  PID:8032
- C:\Windows\System\aXDDSXU.exe
  C:\Windows\System\aXDDSXU.exe
  2⤵
  PID:8028
- C:\Windows\System\OvtcHqS.exe
  C:\Windows\System\OvtcHqS.exe
  2⤵
  PID:8108
- C:\Windows\System\YtGoOdJ.exe
  C:\Windows\System\YtGoOdJ.exe
  2⤵
  PID:7184
- C:\Windows\System\ntOnnjy.exe
  C:\Windows\System\ntOnnjy.exe
  2⤵
  PID:6780
- C:\Windows\System\KjuBaAA.exe
  C:\Windows\System\KjuBaAA.exe
  2⤵
  PID:7724
- C:\Windows\System\BWtoisv.exe
  C:\Windows\System\BWtoisv.exe
  2⤵
  PID:7692
- C:\Windows\System\RBwrczJ.exe
  C:\Windows\System\RBwrczJ.exe
  2⤵
  PID:7948
- C:\Windows\System\UrenFEX.exe
  C:\Windows\System\UrenFEX.exe
  2⤵
  PID:7512
- C:\Windows\System\eJpsFjw.exe
  C:\Windows\System\eJpsFjw.exe
  2⤵
  PID:7548
- C:\Windows\System\wMhrvVk.exe
  C:\Windows\System\wMhrvVk.exe
  2⤵
  PID:8024
- C:\Windows\System\wduwZlt.exe
  C:\Windows\System\wduwZlt.exe
  2⤵
  PID:7292
- C:\Windows\System\vQVIaWL.exe
  C:\Windows\System\vQVIaWL.exe
  2⤵
  PID:7456
- C:\Windows\System\SsELzzu.exe
  C:\Windows\System\SsELzzu.exe
  2⤵
  PID:8204
- C:\Windows\System\toAIEVl.exe
  C:\Windows\System\toAIEVl.exe
  2⤵
  PID:8220
- C:\Windows\System\tckShjz.exe
  C:\Windows\System\tckShjz.exe
  2⤵
  PID:8240
- C:\Windows\System\MZcKQxF.exe
  C:\Windows\System\MZcKQxF.exe
  2⤵
  PID:8256
- C:\Windows\System\NsItEAo.exe
  C:\Windows\System\NsItEAo.exe
  2⤵
  PID:8276
- C:\Windows\System\dTiOEhF.exe
  C:\Windows\System\dTiOEhF.exe
  2⤵
  PID:8292
- C:\Windows\System\NSCgtzE.exe
  C:\Windows\System\NSCgtzE.exe
  2⤵
  PID:8308
- C:\Windows\System\IAAJTls.exe
  C:\Windows\System\IAAJTls.exe
  2⤵
  PID:8324
- C:\Windows\System\HSLrNOj.exe
  C:\Windows\System\HSLrNOj.exe
  2⤵
  PID:8340
- C:\Windows\System\PqsNItE.exe
  C:\Windows\System\PqsNItE.exe
  2⤵
  PID:8356
- C:\Windows\System\SWdSfsv.exe
  C:\Windows\System\SWdSfsv.exe
  2⤵
  PID:8432
- C:\Windows\System\jzdzwzC.exe
  C:\Windows\System\jzdzwzC.exe
  2⤵
  PID:8448
- C:\Windows\System\HBgbxTG.exe
  C:\Windows\System\HBgbxTG.exe
  2⤵
  PID:8464
- C:\Windows\System\guhxxVS.exe
  C:\Windows\System\guhxxVS.exe
  2⤵
  PID:8480
- C:\Windows\System\fGKLCZi.exe
  C:\Windows\System\fGKLCZi.exe
  2⤵
  PID:8500
- C:\Windows\System\aLvxFpc.exe
  C:\Windows\System\aLvxFpc.exe
  2⤵
  PID:8516
- C:\Windows\System\FwvkPsJ.exe
  C:\Windows\System\FwvkPsJ.exe
  2⤵
  PID:8544
- C:\Windows\System\ABUmTbE.exe
  C:\Windows\System\ABUmTbE.exe
  2⤵
  PID:8564
- C:\Windows\System\PgHxhix.exe
  C:\Windows\System\PgHxhix.exe
  2⤵
  PID:8580
- C:\Windows\System\tqkKpmg.exe
  C:\Windows\System\tqkKpmg.exe
  2⤵
  PID:8596
- C:\Windows\System\oXNEqcr.exe
  C:\Windows\System\oXNEqcr.exe
  2⤵
  PID:8612
- C:\Windows\System\jPmjhHQ.exe
  C:\Windows\System\jPmjhHQ.exe
  2⤵
  PID:8628
- C:\Windows\System\CjWiYDp.exe
  C:\Windows\System\CjWiYDp.exe
  2⤵
  PID:8648
- C:\Windows\System\iDwFHqI.exe
  C:\Windows\System\iDwFHqI.exe
  2⤵
  PID:8664
- C:\Windows\System\pQVYvtR.exe
  C:\Windows\System\pQVYvtR.exe
  2⤵
  PID:8704
- C:\Windows\System\GoQqKqq.exe
  C:\Windows\System\GoQqKqq.exe
  2⤵
  PID:8736
- C:\Windows\System\RbKQAQJ.exe
  C:\Windows\System\RbKQAQJ.exe
  2⤵
  PID:8752
- C:\Windows\System\DWZYuaf.exe
  C:\Windows\System\DWZYuaf.exe
  2⤵
  PID:8768
- C:\Windows\System\wcVXQxo.exe
  C:\Windows\System\wcVXQxo.exe
  2⤵
  PID:8784
- C:\Windows\System\qsYpIoY.exe
  C:\Windows\System\qsYpIoY.exe
  2⤵
  PID:8804
- C:\Windows\System\gRRtukF.exe
  C:\Windows\System\gRRtukF.exe
  2⤵
  PID:8820
- C:\Windows\System\mVaSkpH.exe
  C:\Windows\System\mVaSkpH.exe
  2⤵
  PID:8836
- C:\Windows\System\qWVFqMJ.exe
  C:\Windows\System\qWVFqMJ.exe
  2⤵
  PID:8856
- C:\Windows\System\dRJVTKX.exe
  C:\Windows\System\dRJVTKX.exe
  2⤵
  PID:8876
- C:\Windows\System\xzhQEHU.exe
  C:\Windows\System\xzhQEHU.exe
  2⤵
  PID:8892
- C:\Windows\System\IQPXaPv.exe
  C:\Windows\System\IQPXaPv.exe
  2⤵
  PID:8908
- C:\Windows\System\kCMnROo.exe
  C:\Windows\System\kCMnROo.exe
  2⤵
  PID:8924
- C:\Windows\System\pjIkClP.exe
  C:\Windows\System\pjIkClP.exe
  2⤵
  PID:8940
- C:\Windows\System\RqAZtas.exe
  C:\Windows\System\RqAZtas.exe
  2⤵
  PID:8960
- C:\Windows\System\jUWYbCu.exe
  C:\Windows\System\jUWYbCu.exe
  2⤵
  PID:8976
- C:\Windows\System\NVNJPEV.exe
  C:\Windows\System\NVNJPEV.exe
  2⤵
  PID:9008
- C:\Windows\System\FmPTllZ.exe
  C:\Windows\System\FmPTllZ.exe
  2⤵
  PID:9024
- C:\Windows\System\SLqWDHS.exe
  C:\Windows\System\SLqWDHS.exe
  2⤵
  PID:9044
- C:\Windows\System\XnAymtW.exe
  C:\Windows\System\XnAymtW.exe
  2⤵
  PID:9060
- C:\Windows\System\MXpkHLV.exe
  C:\Windows\System\MXpkHLV.exe
  2⤵
  PID:9080
- C:\Windows\System\QBcxMOY.exe
  C:\Windows\System\QBcxMOY.exe
  2⤵
  PID:9096
- C:\Windows\System\XHYiycL.exe
  C:\Windows\System\XHYiycL.exe
  2⤵
  PID:9112
- C:\Windows\System\EZAuKQb.exe
  C:\Windows\System\EZAuKQb.exe
  2⤵
  PID:9136
- C:\Windows\System\xmbbSEi.exe
  C:\Windows\System\xmbbSEi.exe
  2⤵
  PID:9192
- C:\Windows\System\YHdFCIn.exe
  C:\Windows\System\YHdFCIn.exe
  2⤵
  PID:9208
- C:\Windows\System\rBeujuO.exe
  C:\Windows\System\rBeujuO.exe
  2⤵
  PID:8212
- C:\Windows\System\lbjuDcD.exe
  C:\Windows\System\lbjuDcD.exe
  2⤵
  PID:6984
- C:\Windows\System\EoVdhBg.exe
  C:\Windows\System\EoVdhBg.exe
  2⤵
  PID:8196
- C:\Windows\System\fBVHTwh.exe
  C:\Windows\System\fBVHTwh.exe
  2⤵
  PID:8264
- C:\Windows\System\XcQlRGA.exe
  C:\Windows\System\XcQlRGA.exe
  2⤵
  PID:8236
- C:\Windows\System\BuECvFJ.exe
  C:\Windows\System\BuECvFJ.exe
  2⤵
  PID:8376
- C:\Windows\System\EWfHxMZ.exe
  C:\Windows\System\EWfHxMZ.exe
  2⤵
  PID:8352
- C:\Windows\System\gjzLijg.exe
  C:\Windows\System\gjzLijg.exe
  2⤵
  PID:8396
- C:\Windows\System\rCgxjcQ.exe
  C:\Windows\System\rCgxjcQ.exe
  2⤵
  PID:8408
- C:\Windows\System\FMOLCay.exe
  C:\Windows\System\FMOLCay.exe
  2⤵
  PID:8428
- C:\Windows\System\ppATGoP.exe
  C:\Windows\System\ppATGoP.exe
  2⤵
  PID:8552
- C:\Windows\System\CqJCEXW.exe
  C:\Windows\System\CqJCEXW.exe
  2⤵
  PID:8592
- C:\Windows\System\qGhKoQy.exe
  C:\Windows\System\qGhKoQy.exe
  2⤵
  PID:8660
- C:\Windows\System\xhOUSWD.exe
  C:\Windows\System\xhOUSWD.exe
  2⤵
  PID:8640
- C:\Windows\System\aFJCKdW.exe
  C:\Windows\System\aFJCKdW.exe
  2⤵
  PID:8676
- C:\Windows\System\cigMFRD.exe
  C:\Windows\System\cigMFRD.exe
  2⤵
  PID:8696
- C:\Windows\System\TYNcpiY.exe
  C:\Windows\System\TYNcpiY.exe
  2⤵
  PID:8712
- C:\Windows\System\dLFutUV.exe
  C:\Windows\System\dLFutUV.exe
  2⤵
  PID:7240
- C:\Windows\System\jvEjLCD.exe
  C:\Windows\System\jvEjLCD.exe
  2⤵
  PID:8792
- C:\Windows\System\QGHoarm.exe
  C:\Windows\System\QGHoarm.exe
  2⤵
  PID:8744
- C:\Windows\System\hbKtLJo.exe
  C:\Windows\System\hbKtLJo.exe
  2⤵
  PID:8868
- C:\Windows\System\TAZhAtg.exe
  C:\Windows\System\TAZhAtg.exe
  2⤵
  PID:8812
- C:\Windows\System\aWkMWCl.exe
  C:\Windows\System\aWkMWCl.exe
  2⤵
  PID:8888
- C:\Windows\System\BpcmcpA.exe
  C:\Windows\System\BpcmcpA.exe
  2⤵
  PID:8884
- C:\Windows\System\XEHDZMg.exe
  C:\Windows\System\XEHDZMg.exe
  2⤵
  PID:8984
- C:\Windows\System\YksuxMO.exe
  C:\Windows\System\YksuxMO.exe
  2⤵
  PID:9016
- C:\Windows\System\HNLnPpO.exe
  C:\Windows\System\HNLnPpO.exe
  2⤵
  PID:9088
- C:\Windows\System\sXOaMEF.exe
  C:\Windows\System\sXOaMEF.exe
  2⤵
  PID:9132
- C:\Windows\System\Csapens.exe
  C:\Windows\System\Csapens.exe
  2⤵
  PID:9076
- C:\Windows\System\dUEzXkx.exe
  C:\Windows\System\dUEzXkx.exe
  2⤵
  PID:9148
- C:\Windows\System\UExURKe.exe
  C:\Windows\System\UExURKe.exe
  2⤵
  PID:9152
- C:\Windows\System\ZyqjyIT.exe
  C:\Windows\System\ZyqjyIT.exe
  2⤵
  PID:9164
- C:\Windows\System\PoAZTnL.exe
  C:\Windows\System\PoAZTnL.exe
  2⤵
  PID:9200
- C:\Windows\System\PhSWQgo.exe
  C:\Windows\System\PhSWQgo.exe
  2⤵
  PID:8272
- C:\Windows\System\LuKAHZL.exe
  C:\Windows\System\LuKAHZL.exe
  2⤵
  PID:8000
- C:\Windows\System\jNuWIGl.exe
  C:\Windows\System\jNuWIGl.exe
  2⤵
  PID:8364
- C:\Windows\System\jsQiibJ.exe
  C:\Windows\System\jsQiibJ.exe
  2⤵
  PID:8444
- C:\Windows\System\HAnkoBh.exe
  C:\Windows\System\HAnkoBh.exe
  2⤵
  PID:8476
- C:\Windows\System\OfwXsbp.exe
  C:\Windows\System\OfwXsbp.exe
  2⤵
  PID:1008
- C:\Windows\System\VNEnzHS.exe
  C:\Windows\System\VNEnzHS.exe
  2⤵
  PID:8576
- C:\Windows\System\hQcSvlW.exe
  C:\Windows\System\hQcSvlW.exe
  2⤵
  PID:8644
- C:\Windows\System\OCaMhAQ.exe
  C:\Windows\System\OCaMhAQ.exe
  2⤵
  PID:8728
- C:\Windows\System\WcVutLK.exe
  C:\Windows\System\WcVutLK.exe
  2⤵
  PID:8904
- C:\Windows\System\JAsDzAS.exe
  C:\Windows\System\JAsDzAS.exe
  2⤵
  PID:8776
- C:\Windows\System\eKiIloN.exe
  C:\Windows\System\eKiIloN.exe
  2⤵
  PID:8996
- C:\Windows\System\wjxPypI.exe
  C:\Windows\System\wjxPypI.exe
  2⤵
  PID:9040
- C:\Windows\System\oiKjYVP.exe
  C:\Windows\System\oiKjYVP.exe
  2⤵
  PID:8832
- C:\Windows\System\vympLKa.exe
  C:\Windows\System\vympLKa.exe
  2⤵
  PID:9160
- C:\Windows\System\spRsusZ.exe
  C:\Windows\System\spRsusZ.exe
  2⤵
  PID:8232
- C:\Windows\System\pKiNkTi.exe
  C:\Windows\System\pKiNkTi.exe
  2⤵
  PID:8332
- C:\Windows\System\OSYkmvv.exe
  C:\Windows\System\OSYkmvv.exe
  2⤵
  PID:9068
- C:\Windows\System\LaWaAvu.exe
  C:\Windows\System\LaWaAvu.exe
  2⤵
  PID:6584
- C:\Windows\System\LFYtujB.exe
  C:\Windows\System\LFYtujB.exe
  2⤵
  PID:8300
- C:\Windows\System\NMpkIms.exe
  C:\Windows\System\NMpkIms.exe
  2⤵
  PID:8288
- C:\Windows\System\QykElhq.exe
  C:\Windows\System\QykElhq.exe
  2⤵
  PID:8404
- C:\Windows\System\mOydVrU.exe
  C:\Windows\System\mOydVrU.exe
  2⤵
  PID:8680
- C:\Windows\System\xRRfhwi.exe
  C:\Windows\System\xRRfhwi.exe
  2⤵
  PID:8588
- C:\Windows\System\WboFqeK.exe
  C:\Windows\System\WboFqeK.exe
  2⤵
  PID:9128
- C:\Windows\System\LChwByj.exe
  C:\Windows\System\LChwByj.exe
  2⤵
  PID:8748
- C:\Windows\System\woQlIAf.exe
  C:\Windows\System\woQlIAf.exe
  2⤵
  PID:7536
- C:\Windows\System\qWilfMh.exe
  C:\Windows\System\qWilfMh.exe
  2⤵
  PID:8780
- C:\Windows\System\ofdKSGJ.exe
  C:\Windows\System\ofdKSGJ.exe
  2⤵
  PID:8988
- C:\Windows\System\xxOeTyF.exe
  C:\Windows\System\xxOeTyF.exe
  2⤵
  PID:8416
- C:\Windows\System\zOuZMBo.exe
  C:\Windows\System\zOuZMBo.exe
  2⤵
  PID:8348
- C:\Windows\System\vfCULhs.exe
  C:\Windows\System\vfCULhs.exe
  2⤵
  PID:8764
- C:\Windows\System\PuqDeMf.exe
  C:\Windows\System\PuqDeMf.exe
  2⤵
  PID:8424
- C:\Windows\System\wpZjEYE.exe
  C:\Windows\System\wpZjEYE.exe
  2⤵
  PID:9220
- C:\Windows\System\ivPpCUg.exe
  C:\Windows\System\ivPpCUg.exe
  2⤵
  PID:9240
- C:\Windows\System\SPHwqiR.exe
  C:\Windows\System\SPHwqiR.exe
  2⤵
  PID:9260
- C:\Windows\System\dzFaMJx.exe
  C:\Windows\System\dzFaMJx.exe
  2⤵
  PID:9276
- C:\Windows\System\pyMjjQx.exe
  C:\Windows\System\pyMjjQx.exe
  2⤵
  PID:9292
- C:\Windows\System\WYZBktI.exe
  C:\Windows\System\WYZBktI.exe
  2⤵
  PID:9308
- C:\Windows\System\HnDPmOn.exe
  C:\Windows\System\HnDPmOn.exe
  2⤵
  PID:9328
- C:\Windows\System\KSvuooh.exe
  C:\Windows\System\KSvuooh.exe
  2⤵
  PID:9344
- C:\Windows\System\mlCefav.exe
  C:\Windows\System\mlCefav.exe
  2⤵
  PID:9360
- C:\Windows\System\irgyodo.exe
  C:\Windows\System\irgyodo.exe
  2⤵
  PID:9376
- C:\Windows\System\EYpmlZW.exe
  C:\Windows\System\EYpmlZW.exe
  2⤵
  PID:9392
- C:\Windows\System\ARojysM.exe
  C:\Windows\System\ARojysM.exe
  2⤵
  PID:9408
- C:\Windows\System\LoXUryU.exe
  C:\Windows\System\LoXUryU.exe
  2⤵
  PID:9484
- C:\Windows\System\oNZLIsT.exe
  C:\Windows\System\oNZLIsT.exe
  2⤵
  PID:9552
- C:\Windows\System\Dnkmhet.exe
  C:\Windows\System\Dnkmhet.exe
  2⤵
  PID:9568
- C:\Windows\System\BhLFLVv.exe
  C:\Windows\System\BhLFLVv.exe
  2⤵
  PID:9588
- C:\Windows\System\SpXdeFn.exe
  C:\Windows\System\SpXdeFn.exe
  2⤵
  PID:9604
- C:\Windows\System\sViNQyY.exe
  C:\Windows\System\sViNQyY.exe
  2⤵
  PID:9624
- C:\Windows\System\ydWgbqr.exe
  C:\Windows\System\ydWgbqr.exe
  2⤵
  PID:9640
- C:\Windows\System\TcdhCRQ.exe
  C:\Windows\System\TcdhCRQ.exe
  2⤵
  PID:9660
- C:\Windows\System\IwdoZht.exe
  C:\Windows\System\IwdoZht.exe
  2⤵
  PID:9676
- C:\Windows\System\iekJVtf.exe
  C:\Windows\System\iekJVtf.exe
  2⤵
  PID:9692
- C:\Windows\System\BmIkTJR.exe
  C:\Windows\System\BmIkTJR.exe
  2⤵
  PID:9712
- C:\Windows\System\VSwfYEs.exe
  C:\Windows\System\VSwfYEs.exe
  2⤵
  PID:9728
- C:\Windows\System\lEAfUpe.exe
  C:\Windows\System\lEAfUpe.exe
  2⤵
  PID:9748
- C:\Windows\System\JcisepZ.exe
  C:\Windows\System\JcisepZ.exe
  2⤵
  PID:9764
- C:\Windows\System\hLFwgth.exe
  C:\Windows\System\hLFwgth.exe
  2⤵
  PID:9804
- C:\Windows\System\hzvgQgH.exe
  C:\Windows\System\hzvgQgH.exe
  2⤵
  PID:9820
- C:\Windows\System\ettaAEf.exe
  C:\Windows\System\ettaAEf.exe
  2⤵
  PID:9836
- C:\Windows\System\GLDOYBJ.exe
  C:\Windows\System\GLDOYBJ.exe
  2⤵
  PID:9852
- C:\Windows\System\IzApJJq.exe
  C:\Windows\System\IzApJJq.exe
  2⤵
  PID:9868
- C:\Windows\System\pyUZvlj.exe
  C:\Windows\System\pyUZvlj.exe
  2⤵
  PID:9884
- C:\Windows\System\EYupgSM.exe
  C:\Windows\System\EYupgSM.exe
  2⤵
  PID:9904
- C:\Windows\System\AKmQDur.exe
  C:\Windows\System\AKmQDur.exe
  2⤵
  PID:9920
- C:\Windows\System\HuooyHz.exe
  C:\Windows\System\HuooyHz.exe
  2⤵
  PID:9936
- C:\Windows\System\mgBTAVo.exe
  C:\Windows\System\mgBTAVo.exe
  2⤵
  PID:9956
- C:\Windows\System\LAPEqHY.exe
  C:\Windows\System\LAPEqHY.exe
  2⤵
  PID:9972
- C:\Windows\System\XPJBaPd.exe
  C:\Windows\System\XPJBaPd.exe
  2⤵
  PID:9988
- C:\Windows\System\IIBsGEs.exe
  C:\Windows\System\IIBsGEs.exe
  2⤵
  PID:10004
- C:\Windows\System\EqOmqJY.exe
  C:\Windows\System\EqOmqJY.exe
  2⤵
  PID:10076
- C:\Windows\System\CMYRFBQ.exe
  C:\Windows\System\CMYRFBQ.exe
  2⤵
  PID:10092
- C:\Windows\System\BTmMVNF.exe
  C:\Windows\System\BTmMVNF.exe
  2⤵
  PID:10112
- C:\Windows\System\cZIhzHV.exe
  C:\Windows\System\cZIhzHV.exe
  2⤵
  PID:10128
- C:\Windows\System\MJnhThx.exe
  C:\Windows\System\MJnhThx.exe
  2⤵
  PID:10144
- C:\Windows\System\inUAECT.exe
  C:\Windows\System\inUAECT.exe
  2⤵
  PID:10164
- C:\Windows\System\vwvaRBz.exe
  C:\Windows\System\vwvaRBz.exe
  2⤵
  PID:10180
- C:\Windows\System\haofMbU.exe
  C:\Windows\System\haofMbU.exe
  2⤵
  PID:10196
- C:\Windows\System\pJSsDuz.exe
  C:\Windows\System\pJSsDuz.exe
  2⤵
  PID:10216
- C:\Windows\System\ayKMLpH.exe
  C:\Windows\System\ayKMLpH.exe
  2⤵
  PID:10232
- C:\Windows\System\DcDPmLK.exe
  C:\Windows\System\DcDPmLK.exe
  2⤵
  PID:9176
- C:\Windows\System\ilcDMox.exe
  C:\Windows\System\ilcDMox.exe
  2⤵
  PID:9168
- C:\Windows\System\YPCJRje.exe
  C:\Windows\System\YPCJRje.exe
  2⤵
  PID:8316
- C:\Windows\System\RoEkweZ.exe
  C:\Windows\System\RoEkweZ.exe
  2⤵
  PID:8936
- C:\Windows\System\zoodotu.exe
  C:\Windows\System\zoodotu.exe
  2⤵
  PID:8420
- C:\Windows\System\KOHUbNO.exe
  C:\Windows\System\KOHUbNO.exe
  2⤵
  PID:9052
- C:\Windows\System\FIopIqW.exe
  C:\Windows\System\FIopIqW.exe
  2⤵
  PID:9268
- C:\Windows\System\btXUSVW.exe
  C:\Windows\System\btXUSVW.exe
  2⤵
  PID:9336
- C:\Windows\System\afHsdsL.exe
  C:\Windows\System\afHsdsL.exe
  2⤵
  PID:9404
- C:\Windows\System\UBcGRAl.exe
  C:\Windows\System\UBcGRAl.exe
  2⤵
  PID:9440
- C:\Windows\System\NsMWphU.exe
  C:\Windows\System\NsMWphU.exe
  2⤵
  PID:9324
- C:\Windows\System\yQVXBgn.exe
  C:\Windows\System\yQVXBgn.exe
  2⤵
  PID:9388
- C:\Windows\System\SWFXJgb.exe
  C:\Windows\System\SWFXJgb.exe
  2⤵
  PID:9432
- C:\Windows\System\yXdOPmw.exe
  C:\Windows\System\yXdOPmw.exe
  2⤵
  PID:9456
- C:\Windows\System\YLfjvzl.exe
  C:\Windows\System\YLfjvzl.exe
  2⤵
  PID:9492
- C:\Windows\System\dgxdzcC.exe
  C:\Windows\System\dgxdzcC.exe
  2⤵
  PID:9256
- C:\Windows\System\trjQEJF.exe
  C:\Windows\System\trjQEJF.exe
  2⤵
  PID:9564
- C:\Windows\System\YsyxNJF.exe
  C:\Windows\System\YsyxNJF.exe
  2⤵
  PID:9632
- C:\Windows\System\XnYlMli.exe
  C:\Windows\System\XnYlMli.exe
  2⤵
  PID:9584
- C:\Windows\System\ZvJJOun.exe
  C:\Windows\System\ZvJJOun.exe
  2⤵
  PID:9708
- C:\Windows\System\oPAEgLL.exe
  C:\Windows\System\oPAEgLL.exe
  2⤵
  PID:9796
- C:\Windows\System\wPdOxqQ.exe
  C:\Windows\System\wPdOxqQ.exe
  2⤵
  PID:9756
- C:\Windows\System\GVcjUEq.exe
  C:\Windows\System\GVcjUEq.exe
  2⤵
  PID:9828
- C:\Windows\System\VNmlThg.exe
  C:\Windows\System\VNmlThg.exe
  2⤵
  PID:9812
- C:\Windows\System\rDGBRhs.exe
  C:\Windows\System\rDGBRhs.exe
  2⤵
  PID:9892
- C:\Windows\System\CndlHat.exe
  C:\Windows\System\CndlHat.exe
  2⤵
  PID:9932
- C:\Windows\System\cAGnFbi.exe
  C:\Windows\System\cAGnFbi.exe
  2⤵
  PID:10084
- C:\Windows\System\LcmDSOy.exe
  C:\Windows\System\LcmDSOy.exe
  2⤵
  PID:10040
- C:\Windows\System\eRqfBTO.exe
  C:\Windows\System\eRqfBTO.exe
  2⤵
  PID:9912
- C:\Windows\System\laCUhbQ.exe
  C:\Windows\System\laCUhbQ.exe
  2⤵
  PID:9952
- C:\Windows\System\xdROHyk.exe
  C:\Windows\System\xdROHyk.exe
  2⤵
  PID:10124
- C:\Windows\System\DuFkcSQ.exe
  C:\Windows\System\DuFkcSQ.exe
  2⤵
  PID:10152
- C:\Windows\System\nuBzdKK.exe
  C:\Windows\System\nuBzdKK.exe
  2⤵
  PID:10020
- C:\Windows\System\enyeweA.exe
  C:\Windows\System\enyeweA.exe
  2⤵
  PID:10172
- C:\Windows\System\lXgmqzx.exe
  C:\Windows\System\lXgmqzx.exe
  2⤵
  PID:10192
- C:\Windows\System\pmvaGEQ.exe
  C:\Windows\System\pmvaGEQ.exe
  2⤵
  PID:8760
- C:\Windows\System\fAuGpVU.exe
  C:\Windows\System\fAuGpVU.exe
  2⤵
  PID:9304
- C:\Windows\System\canpFAr.exe
  C:\Windows\System\canpFAr.exe
  2⤵
  PID:10208
- C:\Windows\System\xuQeEjh.exe
  C:\Windows\System\xuQeEjh.exe
  2⤵
  PID:9228
- C:\Windows\System\kasbZhr.exe
  C:\Windows\System\kasbZhr.exe
  2⤵
  PID:9596
- C:\Windows\System\AEopsTO.exe
  C:\Windows\System\AEopsTO.exe
  2⤵
  PID:9648
- C:\Windows\System\boOmvhh.exe
  C:\Windows\System\boOmvhh.exe
  2⤵
  PID:9368
- C:\Windows\System\LOKCtJC.exe
  C:\Windows\System\LOKCtJC.exe
  2⤵
  PID:9760
- C:\Windows\System\YbIuRZu.exe
  C:\Windows\System\YbIuRZu.exe
  2⤵
  PID:9900
- C:\Windows\System\GyOLnwK.exe
  C:\Windows\System\GyOLnwK.exe
  2⤵
  PID:9948
- C:\Windows\System\bqutOkZ.exe
  C:\Windows\System\bqutOkZ.exe
  2⤵
  PID:10052
- C:\Windows\System\SXPtRtw.exe
  C:\Windows\System\SXPtRtw.exe
  2⤵
  PID:10228
- C:\Windows\System\uJRpYBu.exe
  C:\Windows\System\uJRpYBu.exe
  2⤵
  PID:9864
- C:\Windows\System\vGHTFQx.exe
  C:\Windows\System\vGHTFQx.exe
  2⤵
  PID:9792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AEZsGsy.exe

Filesize
1.2MB

MD5
79424098f1b498907ab3ed5c0ebcfb97

SHA1
01e2ac8219b6bf6364f8753b8167f704720aa527

SHA256
4dbe689bb47d112cf82f3e31875f4bb8c02a73330a363932b6552b48f4159cdc

SHA512
89703568b34b83a85c8c0f0200eba60e7a6401e5d465fe4a59a20cbba14fb082f9985544aca1c566802c29098f36aaa4b7bd755ee3e48ad6322c781a95833e81

Download Submit
C:\Windows\system\Alvgtlx.exe

Filesize
1.2MB

MD5
822852f09ca5293c26a4d80ca398b32b

SHA1
8d3e59351cb0989ee96d7d0fd12a876daeb3e807

SHA256
532c4dfd8582c042949d3b508f8b92a67d306c56f20d3cd581a6e8bd748784e0

SHA512
14c3795265e61c5ad87dcd4a04ff4e46737af3c2190eef0a79afc13b7e364530bba51bcbe24981e9b90e64ab846c38de73f488a61ecaf6e70571709118204dc3

Download Submit
C:\Windows\system\DEmZDIm.exe

Filesize
1.2MB

MD5
82b95a601049c0224e64d0129f6aa35e

SHA1
3762ffcf1f3e13160301ac6797c9f1962d174a44

SHA256
2e6befcd9bb95be62b925ca6334f5698671d2e3577f6932f1f56073012a2ba3f

SHA512
5dabc1b985a69b06f255866332f5b306f9a42583cba78cdd8c7374424cc139fff3a45d99ea29da438065207cfaa76b37cdf775f94e6e39dce2ae540203ea5f05

Download Submit
C:\Windows\system\ImuPvFY.exe

Filesize
1.2MB

MD5
1cd01d53ba75dc7ae4447e7b49157890

SHA1
fa481fbc4ccbb2677b7360e2c1b1e709f8031562

SHA256
4f135e96ed8a678dcdd9ea48541502527a5612ddca614f0665254cf5be9bdc97

SHA512
dd55f4ba54be047509a1f31679a9e8d9d9406c483efadb64167c54677ab38e3d7f5656419a2c33813e983874c1b6b7620a4f5e273fa8ea0279d0c0508c42ec3a

Download Submit
C:\Windows\system\LxUermC.exe

Filesize
1.2MB

MD5
8dd34c396c0392cf4b4bfbdad22d3099

SHA1
15dc81d291b9e6cab0fa38b258b7cfcda1cc6c91

SHA256
35e79445f92615845e8676f3d2233430bc1d9fd0ff04f5e62f6b5bd521386cfc

SHA512
953c4ff1758bc03821de1b0d01861c14765d110315c3ef95de117ff15a63b2f2eb24de65d9955beec2783f49af879953de04f142e9e3be40a653cc7ed3d8ca0c

Download Submit
C:\Windows\system\NeSRazq.exe

Filesize
1.2MB

MD5
39ff647adb612335ba885f0bff6774da

SHA1
59d1efa9aceedbcdc399dc133810cc437870ca75

SHA256
94fd6c074178ae08e5900d3f1da58fe924779eb441af68065d0fdf03a0be64e4

SHA512
30698de8406f416aa8cc5199f52f8a269a5e4f06847d095032a4a76a34da6c118711a1a002b0f9b6087b033f58a9f760a9c70df4d54e70c34bd5813a3f38d9bb

Download Submit
C:\Windows\system\QIGzCNb.exe

Filesize
1.2MB

MD5
65565e3531e0bd89d633e066570f33ba

SHA1
d9f9e42e008f1bd7539811ef2971acd20deb6b30

SHA256
b2bf287225d6b88e70fd53bac29a506ff8c68603e7147b678ae69e1d3ab73c7b

SHA512
885457e57f3c4910537d35948ee955144750d30da7ffab98928f121259291b5cf09b131fa911d2140fb0e77cc08b01ab7b966c105637543b453ec61d94f60e43

Download Submit
C:\Windows\system\RUDdEkh.exe

Filesize
1.2MB

MD5
e51671d839bee0b0d97182211e070b39

SHA1
7cfb5a5c1e53d72444b245ca3241130d4e30a153

SHA256
95fe2eac14780d8f9b7eb0effae0b96e9447b69897f04578e5e7803372dd508f

SHA512
e444d44243ec8ec7c1cbebf153c6cf67cbb01001c130c3e86b02e6ec5a675ffcd246c54fc9ad03501755030402c380fdeb2980e8c27bf6bf78d60a71a458fbf2

Download Submit
C:\Windows\system\SYbeXIJ.exe

Filesize
1.2MB

MD5
6e3f0283c5d4315c32c1c14c49f6193b

SHA1
0f31b77ed4114bb06a4f41e854cf1c7eb404f181

SHA256
f37f4a5b753eba70570712699c6779fc21d25506c8fb44e3dcaf716793fd02cf

SHA512
1c125f34299e0273374d5731241719752f751e56d51fb07aced1f08f231e1cddfa878a41e06fc709f69e2909f5008165d678528e9946f4871321e70cb3d230b2

Download Submit
C:\Windows\system\UuicjVp.exe

Filesize
1.2MB

MD5
8c3e8a2bfce8772ae77a23efb5485dbd

SHA1
a461586c3dbcc2a5f2c14da1494707bf9307e270

SHA256
b52ab426ae5efc818a934b4f4b8a27da1f8a347b5ced8fefee7e68caa01f2ed8

SHA512
93dff7968612b9a0be8acd813ccb07458f0af00a00dcd0323a6255d7d495fac25d3208a2b2008d1c899537a721bb0b0e4d438d6ac2647d26d8e1c0bee012c355

Download Submit
C:\Windows\system\XohCihN.exe

Filesize
1.2MB

MD5
6168b4e5a5a8751f9539f760f04d7437

SHA1
fe906ce28955a360eb7b280bfedd9e12700fd451

SHA256
9fe356dd5fc3e0e6a5c86b4ef1a11addef8a6dd65a6a6509da1d944790b143a2

SHA512
502d83435c677853e2e8d8b68cc8ac18699db51a233c3d52c25205680e9db55587b9282801426f0d1fb074bc1646497293a36dbed8becda8c8eb43e8be660f12

Download Submit
C:\Windows\system\ajhkGpz.exe

Filesize
1.2MB

MD5
befbfdd82d2de8f831f56f95aafa1836

SHA1
8a392240a4741e48885c3a25f47414e8643b8735

SHA256
51a5da30bbe9c05c64791e2c27f9c0d4d0f44a34b79dfac334d17f95dc3dd783

SHA512
9fd6a9d0077c6f2755c467c328b13a724192551c5822eb6d1832f47fb651c5835dd6a4a5fa1ea315f6d1dd572cdaa0a8dcd30358c14eb58e8c0ba6e3db427a9f

Download Submit
C:\Windows\system\bUhnxeh.exe

Filesize
1.2MB

MD5
a74e8a8c8cdfa360406d7ac6f70c6022

SHA1
e995a91948248a1a36ba8550a39ae1a6dbbc7b09

SHA256
82ae180865f9fc70c3c7e6d406a20327632fa937b684873034a33d5473bf1a43

SHA512
615f5c8d0d3d09d336890c1877a051565841cca6decd4c1b6377fbcd9e5f168c438995f284603069a4081e6f664428469b059854cae7bd664df3736859cfe927

Download Submit
C:\Windows\system\jUhgzdQ.exe

Filesize
1.2MB

MD5
8b36ff1ec119166f560c1b3684c560cd

SHA1
9a4338b821104f9fe685b3dbe680d7dd221528df

SHA256
fc7283183bb8803a4eb5304697166770ef0e1a3dba9688d4abaa4884fc30f75c

SHA512
ec86c424901e42eead3b03d965485e5c576c4596928f5a0fe2d88170b614d8f288c9c7f5636bef953524e0e8670fa8b986f2b0e85f645cacf334131befcd4a16

Download Submit
C:\Windows\system\pQCyPrD.exe

Filesize
1.2MB

MD5
246da7217369f64ac8d3ad4f78bfbe2d

SHA1
c51fe24d0bc9d33245b263dcc2986d3d48384c35

SHA256
53e50a26e185131c5fca5a595445c9a73a271ed40349a9f4ed8004a2e2aa0fe6

SHA512
a289f20b1c14be58b153932fb68ed6c3bf867d12120a6d2f7f884ff3496b774e3e60d210cb090e57625789865a19f994bc9e250d3eb5c80c4845319c62bf3c96

Download Submit
C:\Windows\system\qDWMuJO.exe

Filesize
1.2MB

MD5
8a53c381330c487e409058acf44dd3d7

SHA1
a1a50ab68e813f07b20c6a4d9801150f1d43af8e

SHA256
d9f6056a1f4a19879354f00a01febb46be5ecf31e86f35b8a85da233d7600728

SHA512
53859181166a9cb17d606a21fa9e58fa126df599d0c2fa524e1b985db127e5392db979946fb2331d4373fae09df4b1bf6af27fd3600717ec118355f91df5d555

Download Submit
C:\Windows\system\tjeBEke.exe

Filesize
1.2MB

MD5
5bdf248fdcedc694e4b74b9dd9fb1e08

SHA1
9b8460644407fac5239cb67b50ca09dbde03b233

SHA256
8a95dfb781227f1421e0b24d819d2f59a22f195a947d9b62b6acbcb58da40d1a

SHA512
154ef5b69d7208f69061b53ee432753a4dd5334d8738d7d4eea792fdb86a91f9ba4e1a4588bbda775373b72fe9eb40d93e778d8d7d0b196e83aea858354554b6

Download Submit
C:\Windows\system\uXCslpa.exe

Filesize
1.2MB

MD5
c45d3e6b3435940294bdc8971eb79951

SHA1
dff7b14fa6dd2a226d4824e1b08d4ca95df1bdeb

SHA256
b011ef8731da59e0a47c27a8537473a0b333f90b38f9cd6016794ee2c96b2078

SHA512
c1a3f822e5878795c3039d6c85c8e889f1001238f0d02aebb9e4881aa1a2942644ceffa79dbce85be05605a009ce220b614d57346b4ce0059a22857747681194

Download Submit
C:\Windows\system\vjvThmR.exe

Filesize
1.2MB

MD5
651ad8640d54f7f3e6b526c5f036eecc

SHA1
4768d2f23e13633a460a9425c72ee74fe382faad

SHA256
1388451377b555507668813d45d1a4be59a1fc26a17962e924d92a3d52462331

SHA512
f72e18c0b33ccf4f9191a215cc97a40dc161d3cbb55825615a8f0d62fbfdadea316b05cc7eb61ef8b0c501a4dc8be8b7a467a3c283c857eeefcc85e814d09b8c

Download Submit
C:\Windows\system\vmRmMyK.exe

Filesize
1.2MB

MD5
51e1cdaf862752e586a397b26520334f

SHA1
58b7e97c879e0efc029cc929a6bc74d67eadc749

SHA256
f8fecc1f649ca73027943e18e80c581c2978f2cc6eec60b390cf9670122bf8cd

SHA512
ae244790cbd39ffbd5b6528e9479be9b23df578559358715522ac17cfd9ab36bdea6e6941d88d85e97272f3839f4fcabc24e641bbcbac47e2521a3b657566011

Download Submit
C:\Windows\system\zyahFGJ.exe

Filesize
1.2MB

MD5
0493a3d5123961311a429efcf5915f4c

SHA1
1ccafe3cc0f0d4366ed0e4556a71a71a7fd3d7e3

SHA256
e3d2cef02a635ab7ed1189237f6e07a9562d6bc65aaf72563a682e7b9bbf1522

SHA512
77a734113ff8cfa7e7fd432b73472278c458b578325bea5f8dad3cdff63fb5bd07489f5569ecc457179e693064ef684553068a77a11096185299f5bfe10e0950

Download Submit
\Windows\system\HWOvuqZ.exe

Filesize
1.2MB

MD5
4d0dfe651061c6c50c98d182808a8f0e

SHA1
de2ea0322500fc6c33db125dba74fc6be73dc0e4

SHA256
ca0d71d6955c00a1222755711988bd71567edd7ab387d30aa9fce648e0355a35

SHA512
a36c4a757630e9509eba7a4df06b56a97e6e51cb27f43a6dbaeca2a710ae8f13c4ecc8256fc2dbd6692478b830c95bfbb0adb8352c288a6a424a43abc93a1c48

Download Submit
\Windows\system\LPyBerc.exe

Filesize
1.2MB

MD5
ff572ece5fe361a4ea72028a82bc3bc9

SHA1
c24b056d33c319899be52ea5705b7950e2600e38

SHA256
a6145fa6f3f8a999dd100eba95e6d54ee3b4ca3a394efce83fd1f13f124f6faf

SHA512
6c262217fb270589ad97df8fa66b5fcb1647c15f572654b4a21fa988121632f61701d3646c4c2c66e2db8bcfe1c8cdc4a1afe03bb639d3726d41ede6c29f9225

Download Submit
\Windows\system\UgXVGzN.exe

Filesize
1.2MB

MD5
b1f7e598e2b9acc79c2521b1b527c0e9

SHA1
d78c7e5e0f31b9d055293ff575e3502d0e52e5c1

SHA256
ae386e4eda29fecc58f2e2661dddd6f858cf0da6a372706cfcfbd608e9133a5e

SHA512
921cfb7940e125708b2c118bf55374874034ef634a6e9452c8343cc01b43e3ede3b55890a2990d4bac026a77fff4d5f6e6105656ceba453ba3f4a4716b46fbe5

Download Submit
\Windows\system\WsDqsBT.exe

Filesize
1.2MB

MD5
cda640fe64313829ca89a9861b1f4007

SHA1
207f01e50097c71c7f64ee0a330cf7dea1c8405d

SHA256
970c61062e7e2af61c4381df44e1535586d558a0c1fa39d802e58bf8ae187faa

SHA512
8ac95731c8d7c5821b7ce33599ddcc93feed2e0351faba000349d80d8d4bb61f1ada8fcc4eb4aed953593418f1a1e367e1d99fa68d141e11b9bf975938204a40

Download Submit
\Windows\system\XNIkKyO.exe

Filesize
1.2MB

MD5
1cca4a487438ea1ba359ed8f922f1a61

SHA1
765be436dbf843926a89b21cf00cae8aa3d4ad38

SHA256
e819747a9453b5d64eaf1e6e3e1bb7b86a08b660b9ed8409cb620d71098b1ac6

SHA512
c7a9565430a3d7cec8dbdd56f0bda91c5cefe83112a629c23eac1ec2332e1fe0f98a4cabdbf7ecb4f14636d6d4dada3967882c79907caa30654afc0b1d8b9f2c

Download Submit
\Windows\system\bmUboAh.exe

Filesize
1.2MB

MD5
a4c8ee100313d824fb74e732d0da01aa

SHA1
fb1ec44df38e26cf2b52d02ada25ff791fc169cf

SHA256
b8be4aa605fc80734c16406daf33db9d66b0780b03bfbe603cc2671456e31615

SHA512
2987e8062dec9da86fe2c376db286c32d23b0b541c536c162dcc0dba6c2a8179db05bb691e8a596b3e946ff2acae3e5f3a97112aeb6099cc2751e1ab8c27a159

Download Submit
\Windows\system\cBXjsTB.exe

Filesize
1.2MB

MD5
e0437317efa9a1147fd6eb179154a058

SHA1
b2362e613fda51ae8b9ed57e0f384f646e9bfce6

SHA256
8b0f2adb574f26c49da5f62d1072a5d9f4c9ba04b3a5e1243bf07fd1438a2777

SHA512
a1fd11d1e38e62b7527f1c599b8afc2bd1a803e1e64a708b48a631484a119b3ff265ad2acd4bbc6cf25a9575938c97f387bc1a51d68992f40f1b4bbdd5c54193

Download Submit
\Windows\system\pctDiwH.exe

Filesize
1.2MB

MD5
006862dfcc8b4b24986708add77099a0

SHA1
1ffade5d5dd2b912a912097a3728ac845858f66d

SHA256
7063ce49db35a710d785f98a7043f131fb418acb8bfea2343cad4a524bc5288d

SHA512
cc91ac5b7156c6e350389bec5c4a121e786f16f7aa7eaf92650c0ce0b19cfaef3e6a9e1836ec1c3c9ca42d71f450908a541894eccbae4107633afcfabfdee0f5

Download Submit
\Windows\system\qsBjbvk.exe

Filesize
1.2MB

MD5
cd63f9bec7ca78c446eb6a703b68e621

SHA1
c1e731ff545a2f26dfade51d62108243bbcd76b9

SHA256
5e1c5ba15773a066327c6cac52a0e7409bf37b4a340f8c09203f0dc19f279511

SHA512
b4ffd2c6f35c13530ed2d1b7a3637c705d6eb1913da8c3fe825bcfab97f54875ee52307f77ab944efbc1674b1409fab4668272ad0a6aa637ba6f291672f6cdb3

Download Submit
\Windows\system\wXAkEVO.exe

Filesize
1.2MB

MD5
785db54f8794e8f7a8353a668d926a8e

SHA1
622145bf3b6a640b44142acd7136c4b13e410439

SHA256
ad37b34021648855931782b5de987604ee5b6522fe7ebe2e3722feea3940b869

SHA512
601dd7d89a166ca5d1c482376cf0499339cb554d53798954a32108b65d75194a4705927515bd21eed3e4e53cfcf2a7a23bbcc751190358763609345e65cea151

Download Submit
\Windows\system\zOqyTBZ.exe

Filesize
1.2MB

MD5
2c5a4fa33827a44152f51e3a415b16fa

SHA1
80d055ca8318a075d808032855c4a0b638251bb2

SHA256
4f90cde603ca1049b53d07689e38d1a590d89b722ac75d33a8aa0e179402bebb

SHA512
5cfaf13880bef8ae11ddfb931e00c5264bbdc986759ef7742dfce57607de45f37b2b6389de3949a5c93576cd3a98212344ad47fe28bd877dbc49b72959d9a817

Download Submit
memory/1036-1086-0x000000013FDD0000-0x0000000140121000-memory.dmp

Filesize
3.3MB

Download
memory/1036-30-0x000000013FDD0000-0x0000000140121000-memory.dmp

Filesize
3.3MB

Download
memory/1036-3764-0x000000013FDD0000-0x0000000140121000-memory.dmp

Filesize
3.3MB

Download
memory/1276-3812-0x000000013FBB0000-0x000000013FF01000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2698-0x000000013FBB0000-0x000000013FF01000-memory.dmp

Filesize
3.3MB

Download
memory/1276-95-0x000000013FBB0000-0x000000013FF01000-memory.dmp

Filesize
3.3MB

Download
memory/2156-75-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2156-3769-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2544-82-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2544-3781-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2608-74-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2608-3770-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2524-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-1702-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2644-88-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2961-0x000000013FA30000-0x000000013FD81000-memory.dmp

Filesize
3.3MB

Download
memory/2644-80-0x000000013F5F0000-0x000000013F941000-memory.dmp

Filesize
3.3MB

Download
memory/2644-79-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-34-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-94-0x000000013FBB0000-0x000000013FF01000-memory.dmp

Filesize
3.3MB

Download
memory/2644-46-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2644-51-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2355-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-12-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2354-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-58-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2644-2014-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-166-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2644-0-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-1411-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-78-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2676-606-0x000000013F020000-0x000000013F371000-memory.dmp

Filesize
3.3MB

Download
memory/2676-3796-0x000000013F020000-0x000000013F371000-memory.dmp

Filesize
3.3MB

Download
memory/2676-21-0x000000013F020000-0x000000013F371000-memory.dmp

Filesize
3.3MB

Download
memory/2680-3743-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2680-7-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2680-87-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2712-3779-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2712-1087-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2712-39-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-3787-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2720-76-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2728-81-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2728-3767-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2772-3722-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2772-102-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2772-15-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2812-3773-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2812-72-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2812-1706-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2856-2525-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2856-89-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2856-3808-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2984-3785-0x000000013F5F0000-0x000000013F941000-memory.dmp

Filesize
3.3MB

Download
memory/2984-77-0x000000013F5F0000-0x000000013F941000-memory.dmp

Filesize
3.3MB

Download