xmrig | b7355f6be775c8e8f90fddd303ec4d542035fedf3d9416137b8d7be0cff755cb

Analysis

max time kernel
117s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e9c61004bbf7cc81b56ae7a4a70da10N.exe
Size

1.8MB
MD5

6e9c61004bbf7cc81b56ae7a4a70da10
SHA1

9a899ef962270964b1a4803b7f0700eda5abadc3
SHA256

b7355f6be775c8e8f90fddd303ec4d542035fedf3d9416137b8d7be0cff755cb
SHA512

6375788a7d0bfd5e6f53b176300c524274cf612c3b77221bcfc8dad12a49390eef4c14e4177d405699f211b0592d814f62ce8a22c6434a912d3b559b44c97540
SSDEEP

49152:ROdWCCi7/rahFD2P6QV8Nq8AgmUtBrdHa61Zd:RWWBiban

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/memory/2396-27-0x000000013FA00000-0x000000013FD51000-memory.dmp	xmrig
behavioral1/memory/2096-29-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2120-26-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/572-359-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2136-96-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2136-93-0x000000013F6C0000-0x000000013FA11000-memory.dmp	xmrig
behavioral1/memory/2404-92-0x000000013F1B0000-0x000000013F501000-memory.dmp	xmrig
behavioral1/memory/2136-59-0x000000013FA70000-0x000000013FDC1000-memory.dmp	xmrig
behavioral1/memory/3056-53-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2752-51-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/2828-1578-0x000000013FC30000-0x000000013FF81000-memory.dmp	xmrig
behavioral1/memory/2772-1580-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2636-1845-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	xmrig
behavioral1/memory/1940-2117-0x000000013F7A0000-0x000000013FAF1000-memory.dmp	xmrig
behavioral1/memory/2628-2503-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/1740-2636-0x000000013FF20000-0x0000000140271000-memory.dmp	xmrig
behavioral1/memory/2188-2803-0x000000013F6C0000-0x000000013FA11000-memory.dmp	xmrig
behavioral1/memory/2136-3072-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2096-3850-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2396-3863-0x000000013FA00000-0x000000013FD51000-memory.dmp	xmrig
behavioral1/memory/2752-3859-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/3056-3872-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2404-3867-0x000000013F1B0000-0x000000013F501000-memory.dmp	xmrig
behavioral1/memory/2120-3949-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2772-3924-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2188-4073-0x000000013F6C0000-0x000000013FA11000-memory.dmp	xmrig
behavioral1/memory/2628-4074-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/2636-4075-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	xmrig
behavioral1/memory/1940-4076-0x000000013F7A0000-0x000000013FAF1000-memory.dmp	xmrig
behavioral1/memory/572-4080-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2828-4082-0x000000013FC30000-0x000000013FF81000-memory.dmp	xmrig
behavioral1/memory/1740-4081-0x000000013FF20000-0x0000000140271000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2120	agBluqF.exe
2396	UNCuVtn.exe
2404	uLjjLHz.exe
2096	enhWriL.exe
572	lbdCDAy.exe
2752	FJVXFMY.exe
3056	ImahNVd.exe
2828	AKOMOjX.exe
2772	oUoqDhX.exe
2636	rOpwTHJ.exe
1940	MNfSKqQ.exe
2628	YMYZmKD.exe
1740	CzCIzrf.exe
2188	CFOmEGM.exe
2364	leHWFJx.exe
308	oAmOryv.exe
1664	XUndqcA.exe
2892	TiLfoAQ.exe
2508	pUTNYXx.exe
292	rMoayKj.exe
1796	rHDVcpA.exe
316	AvsPDEL.exe
1760	ITxTFfx.exe
2600	GwxTmjn.exe
1944	HEVZLHZ.exe
1772	TVJRPVp.exe
2996	qsdgwFb.exe
2944	nGrErDX.exe
2304	mFlnkQY.exe
2140	hdsnJaK.exe
2036	rBLiwFf.exe
2652	lXzrRry.exe
2308	gFVKjSm.exe
2500	rirGuAK.exe
1036	LIVhnwV.exe
1800	rMmWxeL.exe
2592	HrLMWHD.exe
936	BAQhrrI.exe
1308	DOsockZ.exe
1788	jgGJNLl.exe
752	cRVZmVj.exe
3048	kfabGld.exe
1404	IPCKwrj.exe
1864	kUhJvuR.exe
1492	xdzcMRM.exe
2300	wGYZZnh.exe
2680	hQdjsWg.exe
1952	NqFJaGt.exe
1348	tfDQqQW.exe
556	nMndxfM.exe
952	WCdvdzw.exe
1964	cFruBPP.exe
1868	qURZfWb.exe
2280	HiJENGQ.exe
1612	GFnfoND.exe
2432	suVmIxI.exe
2052	XcLrXVB.exe
2076	GxlAlpn.exe
2820	jnzuoYz.exe
3044	SJYaLIC.exe
1696	yxIBpGC.exe
2420	IXToQVk.exe
2684	OAxGvuJ.exe
2780	KoQbnHN.exe

Loads dropped DLL 64 IoCs

pid	Process
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-0-0x000000013FA70000-0x000000013FDC1000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-3.dat	upx
behavioral1/files/0x00070000000187a7-10.dat	upx
behavioral1/memory/2396-27-0x000000013FA00000-0x000000013FD51000-memory.dmp	upx
behavioral1/memory/2096-29-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2120-26-0x000000013F860000-0x000000013FBB1000-memory.dmp	upx
behavioral1/memory/2404-24-0x000000013F1B0000-0x000000013F501000-memory.dmp	upx
behavioral1/files/0x00080000000187ac-19.dat	upx
behavioral1/files/0x000800000001871a-18.dat	upx
behavioral1/memory/2136-7-0x0000000001EF0000-0x0000000002241000-memory.dmp	upx
behavioral1/files/0x0007000000018bb0-34.dat	upx
behavioral1/files/0x0007000000018bf9-46.dat	upx
behavioral1/files/0x0007000000018be5-55.dat	upx
behavioral1/memory/2136-68-0x0000000001EF0000-0x0000000002241000-memory.dmp	upx
behavioral1/memory/2636-70-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	upx
behavioral1/memory/2628-81-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/files/0x00050000000195de-102.dat	upx
behavioral1/files/0x000500000001963f-118.dat	upx
behavioral1/files/0x000500000001964b-134.dat	upx
behavioral1/files/0x0005000000019650-151.dat	upx
behavioral1/files/0x0005000000019657-166.dat	upx
behavioral1/files/0x0005000000019655-163.dat	upx
behavioral1/memory/572-359-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/files/0x0005000000019653-158.dat	upx
behavioral1/files/0x0005000000019651-155.dat	upx
behavioral1/files/0x000500000001964f-146.dat	upx
behavioral1/files/0x000500000001964e-143.dat	upx
behavioral1/files/0x000500000001964d-139.dat	upx
behavioral1/files/0x0005000000019649-131.dat	upx
behavioral1/files/0x0005000000019645-126.dat	upx
behavioral1/files/0x0005000000019643-122.dat	upx
behavioral1/files/0x000500000001963d-115.dat	upx
behavioral1/files/0x000500000001963b-110.dat	upx
behavioral1/files/0x0005000000019610-106.dat	upx
behavioral1/files/0x00050000000195b3-98.dat	upx
behavioral1/memory/2188-94-0x000000013F6C0000-0x000000013FA11000-memory.dmp	upx
behavioral1/memory/2404-92-0x000000013F1B0000-0x000000013F501000-memory.dmp	upx
behavioral1/memory/1740-87-0x000000013FF20000-0x0000000140271000-memory.dmp	upx
behavioral1/files/0x0005000000019533-90.dat	upx
behavioral1/files/0x000500000001952c-84.dat	upx
behavioral1/memory/1940-75-0x000000013F7A0000-0x000000013FAF1000-memory.dmp	upx
behavioral1/files/0x0005000000019529-74.dat	upx
behavioral1/files/0x0008000000018708-78.dat	upx
behavioral1/memory/2772-61-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2828-60-0x000000013FC30000-0x000000013FF81000-memory.dmp	upx
behavioral1/memory/2136-59-0x000000013FA70000-0x000000013FDC1000-memory.dmp	upx
behavioral1/files/0x000500000001951e-66.dat	upx
behavioral1/files/0x0008000000018c11-58.dat	upx
behavioral1/memory/3056-53-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2752-51-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/572-47-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/files/0x00070000000187c0-33.dat	upx
behavioral1/memory/2828-1578-0x000000013FC30000-0x000000013FF81000-memory.dmp	upx
behavioral1/memory/2772-1580-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2636-1845-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	upx
behavioral1/memory/1940-2117-0x000000013F7A0000-0x000000013FAF1000-memory.dmp	upx
behavioral1/memory/2628-2503-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/memory/1740-2636-0x000000013FF20000-0x0000000140271000-memory.dmp	upx
behavioral1/memory/2188-2803-0x000000013F6C0000-0x000000013FA11000-memory.dmp	upx
behavioral1/memory/2096-3850-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2396-3863-0x000000013FA00000-0x000000013FD51000-memory.dmp	upx
behavioral1/memory/2752-3859-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/3056-3872-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2404-3867-0x000000013F1B0000-0x000000013F501000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GesauOL.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\KqlBtkH.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\cpXrvVZ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\WUUJKej.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\eZpWdve.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\mwCtOBa.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\bRiAEmO.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\HshBcwZ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\nUjTTLp.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\LZPKrZV.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\UWaxybl.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\nmFrGCO.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\MNbajwD.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\tQBZIcB.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\rNAOdwV.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\PVKHZXZ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\jymsAFh.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\ITJrxFo.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\tNfxnVz.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\yhPhBbn.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\YLdfXnz.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\nXSfrSf.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\HDLayzX.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\OLugVie.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\EtMmVzM.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\wKlWGrL.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\bRxzczf.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\OIBjIqg.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\oRcPimf.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\RchubBM.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\xnveddS.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\nhEIvuP.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\ibefDyc.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\MTMvgpg.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\kuKtzcR.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\ytgmApL.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\WCdvdzw.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\OAxGvuJ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\HbcrDaJ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\FtSvjjx.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\qsdgwFb.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\qnEdOXV.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\jvzPySX.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\DnOoKAX.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\mgkOVYh.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\AnzxCaY.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\LoEdElD.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\eMxbnZa.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\kGCVrNw.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\lbdCDAy.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\XDDyCbC.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\lNrzqUI.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\uZlefVY.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\qacgIFR.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\NlCPTjr.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\xuKhsUB.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\JhTAFnC.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\zlpOkoA.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\YTNyaHe.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\EZisDkb.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\VGobSOW.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\yCSPodC.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\wrxwsfb.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe
File created	C:\Windows\System\TiLfoAQ.exe	6e9c61004bbf7cc81b56ae7a4a70da10N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2120	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	31
PID 2136 wrote to memory of 2120	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	31
PID 2136 wrote to memory of 2120	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	31
PID 2136 wrote to memory of 2396	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	32
PID 2136 wrote to memory of 2396	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	32
PID 2136 wrote to memory of 2396	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	32
PID 2136 wrote to memory of 2096	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	33
PID 2136 wrote to memory of 2096	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	33
PID 2136 wrote to memory of 2096	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	33
PID 2136 wrote to memory of 2404	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	34
PID 2136 wrote to memory of 2404	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	34
PID 2136 wrote to memory of 2404	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	34
PID 2136 wrote to memory of 572	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	35
PID 2136 wrote to memory of 572	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	35
PID 2136 wrote to memory of 572	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	35
PID 2136 wrote to memory of 2752	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	36
PID 2136 wrote to memory of 2752	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	36
PID 2136 wrote to memory of 2752	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	36
PID 2136 wrote to memory of 2828	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	37
PID 2136 wrote to memory of 2828	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	37
PID 2136 wrote to memory of 2828	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	37
PID 2136 wrote to memory of 3056	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	38
PID 2136 wrote to memory of 3056	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	38
PID 2136 wrote to memory of 3056	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	38
PID 2136 wrote to memory of 2772	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	39
PID 2136 wrote to memory of 2772	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	39
PID 2136 wrote to memory of 2772	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	39
PID 2136 wrote to memory of 2636	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	40
PID 2136 wrote to memory of 2636	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	40
PID 2136 wrote to memory of 2636	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	40
PID 2136 wrote to memory of 1940	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	41
PID 2136 wrote to memory of 1940	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	41
PID 2136 wrote to memory of 1940	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	41
PID 2136 wrote to memory of 2628	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	42
PID 2136 wrote to memory of 2628	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	42
PID 2136 wrote to memory of 2628	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	42
PID 2136 wrote to memory of 1740	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	43
PID 2136 wrote to memory of 1740	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	43
PID 2136 wrote to memory of 1740	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	43
PID 2136 wrote to memory of 2188	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	44
PID 2136 wrote to memory of 2188	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	44
PID 2136 wrote to memory of 2188	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	44
PID 2136 wrote to memory of 2364	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	45
PID 2136 wrote to memory of 2364	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	45
PID 2136 wrote to memory of 2364	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	45
PID 2136 wrote to memory of 308	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	46
PID 2136 wrote to memory of 308	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	46
PID 2136 wrote to memory of 308	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	46
PID 2136 wrote to memory of 1664	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	47
PID 2136 wrote to memory of 1664	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	47
PID 2136 wrote to memory of 1664	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	47
PID 2136 wrote to memory of 2892	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	48
PID 2136 wrote to memory of 2892	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	48
PID 2136 wrote to memory of 2892	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	48
PID 2136 wrote to memory of 2508	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	49
PID 2136 wrote to memory of 2508	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	49
PID 2136 wrote to memory of 2508	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	49
PID 2136 wrote to memory of 292	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	50
PID 2136 wrote to memory of 292	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	50
PID 2136 wrote to memory of 292	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	50
PID 2136 wrote to memory of 1796	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	51
PID 2136 wrote to memory of 1796	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	51
PID 2136 wrote to memory of 1796	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	51
PID 2136 wrote to memory of 316	2136	6e9c61004bbf7cc81b56ae7a4a70da10N.exe	52

C:\Users\Admin\AppData\Local\Temp\6e9c61004bbf7cc81b56ae7a4a70da10N.exe
"C:\Users\Admin\AppData\Local\Temp\6e9c61004bbf7cc81b56ae7a4a70da10N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System\agBluqF.exe
  C:\Windows\System\agBluqF.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\UNCuVtn.exe
  C:\Windows\System\UNCuVtn.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\enhWriL.exe
  C:\Windows\System\enhWriL.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\uLjjLHz.exe
  C:\Windows\System\uLjjLHz.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\lbdCDAy.exe
  C:\Windows\System\lbdCDAy.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\FJVXFMY.exe
  C:\Windows\System\FJVXFMY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\AKOMOjX.exe
  C:\Windows\System\AKOMOjX.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ImahNVd.exe
  C:\Windows\System\ImahNVd.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\oUoqDhX.exe
  C:\Windows\System\oUoqDhX.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\rOpwTHJ.exe
  C:\Windows\System\rOpwTHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\MNfSKqQ.exe
  C:\Windows\System\MNfSKqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\YMYZmKD.exe
  C:\Windows\System\YMYZmKD.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\CzCIzrf.exe
  C:\Windows\System\CzCIzrf.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\CFOmEGM.exe
  C:\Windows\System\CFOmEGM.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\leHWFJx.exe
  C:\Windows\System\leHWFJx.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\oAmOryv.exe
  C:\Windows\System\oAmOryv.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\XUndqcA.exe
  C:\Windows\System\XUndqcA.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\TiLfoAQ.exe
  C:\Windows\System\TiLfoAQ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\pUTNYXx.exe
  C:\Windows\System\pUTNYXx.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\rMoayKj.exe
  C:\Windows\System\rMoayKj.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\rHDVcpA.exe
  C:\Windows\System\rHDVcpA.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\AvsPDEL.exe
  C:\Windows\System\AvsPDEL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\ITxTFfx.exe
  C:\Windows\System\ITxTFfx.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\GwxTmjn.exe
  C:\Windows\System\GwxTmjn.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HEVZLHZ.exe
  C:\Windows\System\HEVZLHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\TVJRPVp.exe
  C:\Windows\System\TVJRPVp.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\qsdgwFb.exe
  C:\Windows\System\qsdgwFb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\nGrErDX.exe
  C:\Windows\System\nGrErDX.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\mFlnkQY.exe
  C:\Windows\System\mFlnkQY.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\hdsnJaK.exe
  C:\Windows\System\hdsnJaK.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\rBLiwFf.exe
  C:\Windows\System\rBLiwFf.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\lXzrRry.exe
  C:\Windows\System\lXzrRry.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\gFVKjSm.exe
  C:\Windows\System\gFVKjSm.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\rirGuAK.exe
  C:\Windows\System\rirGuAK.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HrLMWHD.exe
  C:\Windows\System\HrLMWHD.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\LIVhnwV.exe
  C:\Windows\System\LIVhnwV.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\BAQhrrI.exe
  C:\Windows\System\BAQhrrI.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\rMmWxeL.exe
  C:\Windows\System\rMmWxeL.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\kUhJvuR.exe
  C:\Windows\System\kUhJvuR.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\DOsockZ.exe
  C:\Windows\System\DOsockZ.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\hQdjsWg.exe
  C:\Windows\System\hQdjsWg.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\jgGJNLl.exe
  C:\Windows\System\jgGJNLl.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\tfDQqQW.exe
  C:\Windows\System\tfDQqQW.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\cRVZmVj.exe
  C:\Windows\System\cRVZmVj.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\nMndxfM.exe
  C:\Windows\System\nMndxfM.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\kfabGld.exe
  C:\Windows\System\kfabGld.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\WCdvdzw.exe
  C:\Windows\System\WCdvdzw.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\IPCKwrj.exe
  C:\Windows\System\IPCKwrj.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\cFruBPP.exe
  C:\Windows\System\cFruBPP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\xdzcMRM.exe
  C:\Windows\System\xdzcMRM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\qURZfWb.exe
  C:\Windows\System\qURZfWb.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\wGYZZnh.exe
  C:\Windows\System\wGYZZnh.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\HiJENGQ.exe
  C:\Windows\System\HiJENGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\NqFJaGt.exe
  C:\Windows\System\NqFJaGt.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\GFnfoND.exe
  C:\Windows\System\GFnfoND.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\suVmIxI.exe
  C:\Windows\System\suVmIxI.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\XcLrXVB.exe
  C:\Windows\System\XcLrXVB.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\GxlAlpn.exe
  C:\Windows\System\GxlAlpn.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\jnzuoYz.exe
  C:\Windows\System\jnzuoYz.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\SJYaLIC.exe
  C:\Windows\System\SJYaLIC.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\yxIBpGC.exe
  C:\Windows\System\yxIBpGC.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\IXToQVk.exe
  C:\Windows\System\IXToQVk.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\OAxGvuJ.exe
  C:\Windows\System\OAxGvuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KoQbnHN.exe
  C:\Windows\System\KoQbnHN.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\BSTTWNg.exe
  C:\Windows\System\BSTTWNg.exe
  2⤵
  PID:552
- C:\Windows\System\pNOoWEp.exe
  C:\Windows\System\pNOoWEp.exe
  2⤵
  PID:1516
- C:\Windows\System\ayrBdxi.exe
  C:\Windows\System\ayrBdxi.exe
  2⤵
  PID:1588
- C:\Windows\System\CNtTKwm.exe
  C:\Windows\System\CNtTKwm.exe
  2⤵
  PID:1928
- C:\Windows\System\zqThuDA.exe
  C:\Windows\System\zqThuDA.exe
  2⤵
  PID:2968
- C:\Windows\System\DsewrYZ.exe
  C:\Windows\System\DsewrYZ.exe
  2⤵
  PID:2072
- C:\Windows\System\NlCPTjr.exe
  C:\Windows\System\NlCPTjr.exe
  2⤵
  PID:1092
- C:\Windows\System\fHPmFbP.exe
  C:\Windows\System\fHPmFbP.exe
  2⤵
  PID:2176
- C:\Windows\System\CzEnJgD.exe
  C:\Windows\System\CzEnJgD.exe
  2⤵
  PID:1620
- C:\Windows\System\jymsAFh.exe
  C:\Windows\System\jymsAFh.exe
  2⤵
  PID:1752
- C:\Windows\System\onnbMHD.exe
  C:\Windows\System\onnbMHD.exe
  2⤵
  PID:1432
- C:\Windows\System\cCmWoGg.exe
  C:\Windows\System\cCmWoGg.exe
  2⤵
  PID:1672
- C:\Windows\System\XstYqsD.exe
  C:\Windows\System\XstYqsD.exe
  2⤵
  PID:2760
- C:\Windows\System\irEIQgt.exe
  C:\Windows\System\irEIQgt.exe
  2⤵
  PID:920
- C:\Windows\System\zAzVifD.exe
  C:\Windows\System\zAzVifD.exe
  2⤵
  PID:2816
- C:\Windows\System\AaGIxfP.exe
  C:\Windows\System\AaGIxfP.exe
  2⤵
  PID:1920
- C:\Windows\System\KRjjOTD.exe
  C:\Windows\System\KRjjOTD.exe
  2⤵
  PID:2948
- C:\Windows\System\UuTzeFV.exe
  C:\Windows\System\UuTzeFV.exe
  2⤵
  PID:1872
- C:\Windows\System\bRiAEmO.exe
  C:\Windows\System\bRiAEmO.exe
  2⤵
  PID:1988
- C:\Windows\System\dafgaZA.exe
  C:\Windows\System\dafgaZA.exe
  2⤵
  PID:1604
- C:\Windows\System\oRHNuGI.exe
  C:\Windows\System\oRHNuGI.exe
  2⤵
  PID:2736
- C:\Windows\System\uETYKkQ.exe
  C:\Windows\System\uETYKkQ.exe
  2⤵
  PID:2532
- C:\Windows\System\LlpjjMp.exe
  C:\Windows\System\LlpjjMp.exe
  2⤵
  PID:2496
- C:\Windows\System\YYtaujs.exe
  C:\Windows\System\YYtaujs.exe
  2⤵
  PID:1876
- C:\Windows\System\JzluGON.exe
  C:\Windows\System\JzluGON.exe
  2⤵
  PID:1736
- C:\Windows\System\sfKgtau.exe
  C:\Windows\System\sfKgtau.exe
  2⤵
  PID:1700
- C:\Windows\System\IzsVYev.exe
  C:\Windows\System\IzsVYev.exe
  2⤵
  PID:2572
- C:\Windows\System\YPVDvNo.exe
  C:\Windows\System\YPVDvNo.exe
  2⤵
  PID:2912
- C:\Windows\System\XfbCPnF.exe
  C:\Windows\System\XfbCPnF.exe
  2⤵
  PID:2920
- C:\Windows\System\ZiySSun.exe
  C:\Windows\System\ZiySSun.exe
  2⤵
  PID:3008
- C:\Windows\System\cAyNdac.exe
  C:\Windows\System\cAyNdac.exe
  2⤵
  PID:2428
- C:\Windows\System\YISKLHh.exe
  C:\Windows\System\YISKLHh.exe
  2⤵
  PID:1104
- C:\Windows\System\QBGfgzB.exe
  C:\Windows\System\QBGfgzB.exe
  2⤵
  PID:1692
- C:\Windows\System\SgEDuWd.exe
  C:\Windows\System\SgEDuWd.exe
  2⤵
  PID:300
- C:\Windows\System\RchubBM.exe
  C:\Windows\System\RchubBM.exe
  2⤵
  PID:1148
- C:\Windows\System\YYXXLvl.exe
  C:\Windows\System\YYXXLvl.exe
  2⤵
  PID:964
- C:\Windows\System\WvQlXIF.exe
  C:\Windows\System\WvQlXIF.exe
  2⤵
  PID:2056
- C:\Windows\System\LQiZJxF.exe
  C:\Windows\System\LQiZJxF.exe
  2⤵
  PID:1344
- C:\Windows\System\YLPYEGX.exe
  C:\Windows\System\YLPYEGX.exe
  2⤵
  PID:1232
- C:\Windows\System\fFqMaVg.exe
  C:\Windows\System\fFqMaVg.exe
  2⤵
  PID:2284
- C:\Windows\System\ubGLKNm.exe
  C:\Windows\System\ubGLKNm.exe
  2⤵
  PID:540
- C:\Windows\System\rMRqLqQ.exe
  C:\Windows\System\rMRqLqQ.exe
  2⤵
  PID:2712
- C:\Windows\System\eKBPlyp.exe
  C:\Windows\System\eKBPlyp.exe
  2⤵
  PID:2676
- C:\Windows\System\rPgaQOq.exe
  C:\Windows\System\rPgaQOq.exe
  2⤵
  PID:1168
- C:\Windows\System\uwOkizy.exe
  C:\Windows\System\uwOkizy.exe
  2⤵
  PID:1600
- C:\Windows\System\fJBhycY.exe
  C:\Windows\System\fJBhycY.exe
  2⤵
  PID:3036
- C:\Windows\System\xatIUzb.exe
  C:\Windows\System\xatIUzb.exe
  2⤵
  PID:1368
- C:\Windows\System\FBZoTfG.exe
  C:\Windows\System\FBZoTfG.exe
  2⤵
  PID:2376
- C:\Windows\System\IzfmrMa.exe
  C:\Windows\System\IzfmrMa.exe
  2⤵
  PID:1852
- C:\Windows\System\gIfPdeT.exe
  C:\Windows\System\gIfPdeT.exe
  2⤵
  PID:2064
- C:\Windows\System\OXwbXdN.exe
  C:\Windows\System\OXwbXdN.exe
  2⤵
  PID:2648
- C:\Windows\System\SBKMPNK.exe
  C:\Windows\System\SBKMPNK.exe
  2⤵
  PID:2388
- C:\Windows\System\QZsBwsU.exe
  C:\Windows\System\QZsBwsU.exe
  2⤵
  PID:2928
- C:\Windows\System\QAUsKcH.exe
  C:\Windows\System\QAUsKcH.exe
  2⤵
  PID:1948
- C:\Windows\System\DrNLxvh.exe
  C:\Windows\System\DrNLxvh.exe
  2⤵
  PID:448
- C:\Windows\System\EZisDkb.exe
  C:\Windows\System\EZisDkb.exe
  2⤵
  PID:1204
- C:\Windows\System\ExoAKNL.exe
  C:\Windows\System\ExoAKNL.exe
  2⤵
  PID:872
- C:\Windows\System\PvVBHcD.exe
  C:\Windows\System\PvVBHcD.exe
  2⤵
  PID:832
- C:\Windows\System\kThfdvC.exe
  C:\Windows\System\kThfdvC.exe
  2⤵
  PID:352
- C:\Windows\System\uqnQOCB.exe
  C:\Windows\System\uqnQOCB.exe
  2⤵
  PID:1652
- C:\Windows\System\dhaSnRY.exe
  C:\Windows\System\dhaSnRY.exe
  2⤵
  PID:2796
- C:\Windows\System\sYKTJCk.exe
  C:\Windows\System\sYKTJCk.exe
  2⤵
  PID:868
- C:\Windows\System\VGobSOW.exe
  C:\Windows\System\VGobSOW.exe
  2⤵
  PID:2976
- C:\Windows\System\dupypsy.exe
  C:\Windows\System\dupypsy.exe
  2⤵
  PID:1628
- C:\Windows\System\mgkOVYh.exe
  C:\Windows\System\mgkOVYh.exe
  2⤵
  PID:3028
- C:\Windows\System\uTQPRaN.exe
  C:\Windows\System\uTQPRaN.exe
  2⤵
  PID:2476
- C:\Windows\System\buNmJeM.exe
  C:\Windows\System\buNmJeM.exe
  2⤵
  PID:2244
- C:\Windows\System\YPrTjGJ.exe
  C:\Windows\System\YPrTjGJ.exe
  2⤵
  PID:2872
- C:\Windows\System\EeWlLlg.exe
  C:\Windows\System\EeWlLlg.exe
  2⤵
  PID:2708
- C:\Windows\System\keJRpFw.exe
  C:\Windows\System\keJRpFw.exe
  2⤵
  PID:2148
- C:\Windows\System\ZANrLQE.exe
  C:\Windows\System\ZANrLQE.exe
  2⤵
  PID:2940
- C:\Windows\System\tQhJqnD.exe
  C:\Windows\System\tQhJqnD.exe
  2⤵
  PID:2252
- C:\Windows\System\RSbvubE.exe
  C:\Windows\System\RSbvubE.exe
  2⤵
  PID:2824
- C:\Windows\System\mnfeWaM.exe
  C:\Windows\System\mnfeWaM.exe
  2⤵
  PID:2908
- C:\Windows\System\tTzLdHR.exe
  C:\Windows\System\tTzLdHR.exe
  2⤵
  PID:2356
- C:\Windows\System\CEvXqYK.exe
  C:\Windows\System\CEvXqYK.exe
  2⤵
  PID:2848
- C:\Windows\System\wKlWGrL.exe
  C:\Windows\System\wKlWGrL.exe
  2⤵
  PID:2456
- C:\Windows\System\cFlCocq.exe
  C:\Windows\System\cFlCocq.exe
  2⤵
  PID:2276
- C:\Windows\System\LeiQfly.exe
  C:\Windows\System\LeiQfly.exe
  2⤵
  PID:2344
- C:\Windows\System\NgYTBRd.exe
  C:\Windows\System\NgYTBRd.exe
  2⤵
  PID:2640
- C:\Windows\System\OtLelnu.exe
  C:\Windows\System\OtLelnu.exe
  2⤵
  PID:2484
- C:\Windows\System\RUoBquN.exe
  C:\Windows\System\RUoBquN.exe
  2⤵
  PID:2720
- C:\Windows\System\FjuROol.exe
  C:\Windows\System\FjuROol.exe
  2⤵
  PID:2964
- C:\Windows\System\YPBuyKE.exe
  C:\Windows\System\YPBuyKE.exe
  2⤵
  PID:2876
- C:\Windows\System\YJobuST.exe
  C:\Windows\System\YJobuST.exe
  2⤵
  PID:2032
- C:\Windows\System\GoZpMSd.exe
  C:\Windows\System\GoZpMSd.exe
  2⤵
  PID:476
- C:\Windows\System\ejfEbWx.exe
  C:\Windows\System\ejfEbWx.exe
  2⤵
  PID:2936
- C:\Windows\System\mGdnbjc.exe
  C:\Windows\System\mGdnbjc.exe
  2⤵
  PID:2068
- C:\Windows\System\kQXgVXW.exe
  C:\Windows\System\kQXgVXW.exe
  2⤵
  PID:2272
- C:\Windows\System\cloKcrh.exe
  C:\Windows\System\cloKcrh.exe
  2⤵
  PID:2716
- C:\Windows\System\JUdQGeu.exe
  C:\Windows\System\JUdQGeu.exe
  2⤵
  PID:2644
- C:\Windows\System\vXBRCvt.exe
  C:\Windows\System\vXBRCvt.exe
  2⤵
  PID:2008
- C:\Windows\System\whRKMmk.exe
  C:\Windows\System\whRKMmk.exe
  2⤵
  PID:680
- C:\Windows\System\UWaxybl.exe
  C:\Windows\System\UWaxybl.exe
  2⤵
  PID:636
- C:\Windows\System\MLPxVJy.exe
  C:\Windows\System\MLPxVJy.exe
  2⤵
  PID:2732
- C:\Windows\System\nmFrGCO.exe
  C:\Windows\System\nmFrGCO.exe
  2⤵
  PID:1556
- C:\Windows\System\ORSnZhW.exe
  C:\Windows\System\ORSnZhW.exe
  2⤵
  PID:2204
- C:\Windows\System\wYCFknL.exe
  C:\Windows\System\wYCFknL.exe
  2⤵
  PID:2040
- C:\Windows\System\DnYexiz.exe
  C:\Windows\System\DnYexiz.exe
  2⤵
  PID:1584
- C:\Windows\System\DPURfsp.exe
  C:\Windows\System\DPURfsp.exe
  2⤵
  PID:780
- C:\Windows\System\ojJKFoh.exe
  C:\Windows\System\ojJKFoh.exe
  2⤵
  PID:2044
- C:\Windows\System\kERJZMs.exe
  C:\Windows\System\kERJZMs.exe
  2⤵
  PID:2844
- C:\Windows\System\zxrMjzi.exe
  C:\Windows\System\zxrMjzi.exe
  2⤵
  PID:2688
- C:\Windows\System\XEYdqdq.exe
  C:\Windows\System\XEYdqdq.exe
  2⤵
  PID:492
- C:\Windows\System\kKSzTtZ.exe
  C:\Windows\System\kKSzTtZ.exe
  2⤵
  PID:1680
- C:\Windows\System\ayNhiEK.exe
  C:\Windows\System\ayNhiEK.exe
  2⤵
  PID:1932
- C:\Windows\System\iOXPOsq.exe
  C:\Windows\System\iOXPOsq.exe
  2⤵
  PID:3080
- C:\Windows\System\sIfXKUK.exe
  C:\Windows\System\sIfXKUK.exe
  2⤵
  PID:3096
- C:\Windows\System\RZBNpGq.exe
  C:\Windows\System\RZBNpGq.exe
  2⤵
  PID:3112
- C:\Windows\System\MLvnCNo.exe
  C:\Windows\System\MLvnCNo.exe
  2⤵
  PID:3128
- C:\Windows\System\mcvCywO.exe
  C:\Windows\System\mcvCywO.exe
  2⤵
  PID:3148
- C:\Windows\System\xYlwnhQ.exe
  C:\Windows\System\xYlwnhQ.exe
  2⤵
  PID:3164
- C:\Windows\System\VhODzbO.exe
  C:\Windows\System\VhODzbO.exe
  2⤵
  PID:3180
- C:\Windows\System\TREEEWc.exe
  C:\Windows\System\TREEEWc.exe
  2⤵
  PID:3196
- C:\Windows\System\WsgHHba.exe
  C:\Windows\System\WsgHHba.exe
  2⤵
  PID:3216
- C:\Windows\System\HIcYtIP.exe
  C:\Windows\System\HIcYtIP.exe
  2⤵
  PID:3240
- C:\Windows\System\IZzMxii.exe
  C:\Windows\System\IZzMxii.exe
  2⤵
  PID:3256
- C:\Windows\System\NWSfSgU.exe
  C:\Windows\System\NWSfSgU.exe
  2⤵
  PID:3272
- C:\Windows\System\ZgNUyxE.exe
  C:\Windows\System\ZgNUyxE.exe
  2⤵
  PID:3288
- C:\Windows\System\jRHAHro.exe
  C:\Windows\System\jRHAHro.exe
  2⤵
  PID:3308
- C:\Windows\System\GmfdJGK.exe
  C:\Windows\System\GmfdJGK.exe
  2⤵
  PID:3324
- C:\Windows\System\DOFUwvx.exe
  C:\Windows\System\DOFUwvx.exe
  2⤵
  PID:3344
- C:\Windows\System\ZMokLAQ.exe
  C:\Windows\System\ZMokLAQ.exe
  2⤵
  PID:3360
- C:\Windows\System\bSpiZVt.exe
  C:\Windows\System\bSpiZVt.exe
  2⤵
  PID:3376
- C:\Windows\System\XnVebLQ.exe
  C:\Windows\System\XnVebLQ.exe
  2⤵
  PID:3392
- C:\Windows\System\lcbyajI.exe
  C:\Windows\System\lcbyajI.exe
  2⤵
  PID:3416
- C:\Windows\System\VOtVgwM.exe
  C:\Windows\System\VOtVgwM.exe
  2⤵
  PID:3432
- C:\Windows\System\kEHslcj.exe
  C:\Windows\System\kEHslcj.exe
  2⤵
  PID:3448
- C:\Windows\System\gOzoPFh.exe
  C:\Windows\System\gOzoPFh.exe
  2⤵
  PID:3464
- C:\Windows\System\mZqlqeL.exe
  C:\Windows\System\mZqlqeL.exe
  2⤵
  PID:3480
- C:\Windows\System\qnEdOXV.exe
  C:\Windows\System\qnEdOXV.exe
  2⤵
  PID:3620
- C:\Windows\System\YreLlhS.exe
  C:\Windows\System\YreLlhS.exe
  2⤵
  PID:3640
- C:\Windows\System\lrdMZzr.exe
  C:\Windows\System\lrdMZzr.exe
  2⤵
  PID:3656
- C:\Windows\System\qjHPjLD.exe
  C:\Windows\System\qjHPjLD.exe
  2⤵
  PID:3672
- C:\Windows\System\KaTeuVB.exe
  C:\Windows\System\KaTeuVB.exe
  2⤵
  PID:3688
- C:\Windows\System\nCDekHi.exe
  C:\Windows\System\nCDekHi.exe
  2⤵
  PID:3704
- C:\Windows\System\WzYrYfp.exe
  C:\Windows\System\WzYrYfp.exe
  2⤵
  PID:3720
- C:\Windows\System\diODmuN.exe
  C:\Windows\System\diODmuN.exe
  2⤵
  PID:3768
- C:\Windows\System\tXYAqSZ.exe
  C:\Windows\System\tXYAqSZ.exe
  2⤵
  PID:3784
- C:\Windows\System\uofZYik.exe
  C:\Windows\System\uofZYik.exe
  2⤵
  PID:3800
- C:\Windows\System\AOtuEKh.exe
  C:\Windows\System\AOtuEKh.exe
  2⤵
  PID:3816
- C:\Windows\System\kGQQLVV.exe
  C:\Windows\System\kGQQLVV.exe
  2⤵
  PID:3832
- C:\Windows\System\UuUQXFC.exe
  C:\Windows\System\UuUQXFC.exe
  2⤵
  PID:3848
- C:\Windows\System\NkyECNa.exe
  C:\Windows\System\NkyECNa.exe
  2⤵
  PID:3864
- C:\Windows\System\EchBTQO.exe
  C:\Windows\System\EchBTQO.exe
  2⤵
  PID:3884
- C:\Windows\System\lLlVfuv.exe
  C:\Windows\System\lLlVfuv.exe
  2⤵
  PID:3900
- C:\Windows\System\nWOZmCk.exe
  C:\Windows\System\nWOZmCk.exe
  2⤵
  PID:3916
- C:\Windows\System\BUuARLe.exe
  C:\Windows\System\BUuARLe.exe
  2⤵
  PID:3932
- C:\Windows\System\AtZoEps.exe
  C:\Windows\System\AtZoEps.exe
  2⤵
  PID:3948
- C:\Windows\System\gSmmJIn.exe
  C:\Windows\System\gSmmJIn.exe
  2⤵
  PID:3964
- C:\Windows\System\kDxIMZS.exe
  C:\Windows\System\kDxIMZS.exe
  2⤵
  PID:3980
- C:\Windows\System\oEzfali.exe
  C:\Windows\System\oEzfali.exe
  2⤵
  PID:3996
- C:\Windows\System\WJcNfwb.exe
  C:\Windows\System\WJcNfwb.exe
  2⤵
  PID:4016
- C:\Windows\System\EpLDKfT.exe
  C:\Windows\System\EpLDKfT.exe
  2⤵
  PID:4032
- C:\Windows\System\auWdlZj.exe
  C:\Windows\System\auWdlZj.exe
  2⤵
  PID:4048
- C:\Windows\System\DnMvIvg.exe
  C:\Windows\System\DnMvIvg.exe
  2⤵
  PID:4064
- C:\Windows\System\wpBFqnx.exe
  C:\Windows\System\wpBFqnx.exe
  2⤵
  PID:4080
- C:\Windows\System\IitofaH.exe
  C:\Windows\System\IitofaH.exe
  2⤵
  PID:2620
- C:\Windows\System\QpMACNV.exe
  C:\Windows\System\QpMACNV.exe
  2⤵
  PID:3000
- C:\Windows\System\uVJiyUd.exe
  C:\Windows\System\uVJiyUd.exe
  2⤵
  PID:2020
- C:\Windows\System\JfhUhEn.exe
  C:\Windows\System\JfhUhEn.exe
  2⤵
  PID:3140
- C:\Windows\System\OdEysIz.exe
  C:\Windows\System\OdEysIz.exe
  2⤵
  PID:3236
- C:\Windows\System\RejQumt.exe
  C:\Windows\System\RejQumt.exe
  2⤵
  PID:3208
- C:\Windows\System\sNTrKJZ.exe
  C:\Windows\System\sNTrKJZ.exe
  2⤵
  PID:3296
- C:\Windows\System\NxbSACf.exe
  C:\Windows\System\NxbSACf.exe
  2⤵
  PID:3332
- C:\Windows\System\bTXkctz.exe
  C:\Windows\System\bTXkctz.exe
  2⤵
  PID:3316
- C:\Windows\System\CKOXnON.exe
  C:\Windows\System\CKOXnON.exe
  2⤵
  PID:3372
- C:\Windows\System\jdiRcQK.exe
  C:\Windows\System\jdiRcQK.exe
  2⤵
  PID:3412
- C:\Windows\System\wrNLAWU.exe
  C:\Windows\System\wrNLAWU.exe
  2⤵
  PID:3356
- C:\Windows\System\hhSbaub.exe
  C:\Windows\System\hhSbaub.exe
  2⤵
  PID:3488
- C:\Windows\System\CnHmJVW.exe
  C:\Windows\System\CnHmJVW.exe
  2⤵
  PID:3580
- C:\Windows\System\WknMkPz.exe
  C:\Windows\System\WknMkPz.exe
  2⤵
  PID:3604
- C:\Windows\System\nDaBesq.exe
  C:\Windows\System\nDaBesq.exe
  2⤵
  PID:3628
- C:\Windows\System\eLHhBmM.exe
  C:\Windows\System\eLHhBmM.exe
  2⤵
  PID:3668
- C:\Windows\System\UScncbp.exe
  C:\Windows\System\UScncbp.exe
  2⤵
  PID:3728
- C:\Windows\System\YMtTVTc.exe
  C:\Windows\System\YMtTVTc.exe
  2⤵
  PID:3744
- C:\Windows\System\LpTLcey.exe
  C:\Windows\System\LpTLcey.exe
  2⤵
  PID:3612
- C:\Windows\System\ROevQFg.exe
  C:\Windows\System\ROevQFg.exe
  2⤵
  PID:3652
- C:\Windows\System\NKwCWYm.exe
  C:\Windows\System\NKwCWYm.exe
  2⤵
  PID:3716
- C:\Windows\System\wuboabd.exe
  C:\Windows\System\wuboabd.exe
  2⤵
  PID:3780
- C:\Windows\System\QuCOsKT.exe
  C:\Windows\System\QuCOsKT.exe
  2⤵
  PID:3828
- C:\Windows\System\vqGypRz.exe
  C:\Windows\System\vqGypRz.exe
  2⤵
  PID:3896
- C:\Windows\System\pYrNeFA.exe
  C:\Windows\System\pYrNeFA.exe
  2⤵
  PID:3992
- C:\Windows\System\bvxvZJc.exe
  C:\Windows\System\bvxvZJc.exe
  2⤵
  PID:4060
- C:\Windows\System\fyybPxe.exe
  C:\Windows\System\fyybPxe.exe
  2⤵
  PID:3872
- C:\Windows\System\PSRZCsn.exe
  C:\Windows\System\PSRZCsn.exe
  2⤵
  PID:4076
- C:\Windows\System\CnLmTpR.exe
  C:\Windows\System\CnLmTpR.exe
  2⤵
  PID:3912
- C:\Windows\System\CFeMPty.exe
  C:\Windows\System\CFeMPty.exe
  2⤵
  PID:3976
- C:\Windows\System\pBdoYoT.exe
  C:\Windows\System\pBdoYoT.exe
  2⤵
  PID:4040
- C:\Windows\System\AnzxCaY.exe
  C:\Windows\System\AnzxCaY.exe
  2⤵
  PID:3088
- C:\Windows\System\GesauOL.exe
  C:\Windows\System\GesauOL.exe
  2⤵
  PID:1420
- C:\Windows\System\GYBQOEm.exe
  C:\Windows\System\GYBQOEm.exe
  2⤵
  PID:3124
- C:\Windows\System\EOBDyuT.exe
  C:\Windows\System\EOBDyuT.exe
  2⤵
  PID:3192
- C:\Windows\System\SpIkpnp.exe
  C:\Windows\System\SpIkpnp.exe
  2⤵
  PID:3232
- C:\Windows\System\CJQaNfY.exe
  C:\Windows\System\CJQaNfY.exe
  2⤵
  PID:3280
- C:\Windows\System\NfNDCpT.exe
  C:\Windows\System\NfNDCpT.exe
  2⤵
  PID:3404
- C:\Windows\System\ShdNxfA.exe
  C:\Windows\System\ShdNxfA.exe
  2⤵
  PID:3572
- C:\Windows\System\GngEBTO.exe
  C:\Windows\System\GngEBTO.exe
  2⤵
  PID:3532
- C:\Windows\System\MGDyBcO.exe
  C:\Windows\System\MGDyBcO.exe
  2⤵
  PID:3204
- C:\Windows\System\wuyVFpj.exe
  C:\Windows\System\wuyVFpj.exe
  2⤵
  PID:3444
- C:\Windows\System\ZIoQlpi.exe
  C:\Windows\System\ZIoQlpi.exe
  2⤵
  PID:3456
- C:\Windows\System\IJNiflV.exe
  C:\Windows\System\IJNiflV.exe
  2⤵
  PID:3684
- C:\Windows\System\UhuMStQ.exe
  C:\Windows\System\UhuMStQ.exe
  2⤵
  PID:3960
- C:\Windows\System\joFidub.exe
  C:\Windows\System\joFidub.exe
  2⤵
  PID:3908
- C:\Windows\System\cnptIsx.exe
  C:\Windows\System\cnptIsx.exe
  2⤵
  PID:4012
- C:\Windows\System\FWFeGkI.exe
  C:\Windows\System\FWFeGkI.exe
  2⤵
  PID:3188
- C:\Windows\System\whQvPmW.exe
  C:\Windows\System\whQvPmW.exe
  2⤵
  PID:3764
- C:\Windows\System\AxMApAi.exe
  C:\Windows\System\AxMApAi.exe
  2⤵
  PID:2724
- C:\Windows\System\TZlrtCv.exe
  C:\Windows\System\TZlrtCv.exe
  2⤵
  PID:4056
- C:\Windows\System\RDvYKIY.exe
  C:\Windows\System\RDvYKIY.exe
  2⤵
  PID:3268
- C:\Windows\System\gPTHbmU.exe
  C:\Windows\System\gPTHbmU.exe
  2⤵
  PID:2744
- C:\Windows\System\MDRaUxE.exe
  C:\Windows\System\MDRaUxE.exe
  2⤵
  PID:3228
- C:\Windows\System\orvisbd.exe
  C:\Windows\System\orvisbd.exe
  2⤵
  PID:3108
- C:\Windows\System\rklYDsO.exe
  C:\Windows\System\rklYDsO.exe
  2⤵
  PID:3524
- C:\Windows\System\nTVNoZE.exe
  C:\Windows\System\nTVNoZE.exe
  2⤵
  PID:3368
- C:\Windows\System\lwtYfOg.exe
  C:\Windows\System\lwtYfOg.exe
  2⤵
  PID:3592
- C:\Windows\System\VQMjBnN.exe
  C:\Windows\System\VQMjBnN.exe
  2⤵
  PID:3584
- C:\Windows\System\jyOhEOs.exe
  C:\Windows\System\jyOhEOs.exe
  2⤵
  PID:3752
- C:\Windows\System\qMMtiMr.exe
  C:\Windows\System\qMMtiMr.exe
  2⤵
  PID:3544
- C:\Windows\System\gJSRWIf.exe
  C:\Windows\System\gJSRWIf.exe
  2⤵
  PID:3608
- C:\Windows\System\guFeqAp.exe
  C:\Windows\System\guFeqAp.exe
  2⤵
  PID:3664
- C:\Windows\System\RtinnBS.exe
  C:\Windows\System\RtinnBS.exe
  2⤵
  PID:3792
- C:\Windows\System\fDbcdSI.exe
  C:\Windows\System\fDbcdSI.exe
  2⤵
  PID:3892
- C:\Windows\System\ZtSjcNo.exe
  C:\Windows\System\ZtSjcNo.exe
  2⤵
  PID:2840
- C:\Windows\System\ypyxNEl.exe
  C:\Windows\System\ypyxNEl.exe
  2⤵
  PID:3388
- C:\Windows\System\cInhRjJ.exe
  C:\Windows\System\cInhRjJ.exe
  2⤵
  PID:3560
- C:\Windows\System\CXHNDBF.exe
  C:\Windows\System\CXHNDBF.exe
  2⤵
  PID:3284
- C:\Windows\System\KqlBtkH.exe
  C:\Windows\System\KqlBtkH.exe
  2⤵
  PID:3460
- C:\Windows\System\FwlwNQE.exe
  C:\Windows\System\FwlwNQE.exe
  2⤵
  PID:3576
- C:\Windows\System\HsHHoTf.exe
  C:\Windows\System\HsHHoTf.exe
  2⤵
  PID:3564
- C:\Windows\System\MCUjyBZ.exe
  C:\Windows\System\MCUjyBZ.exe
  2⤵
  PID:3740
- C:\Windows\System\ygJEbed.exe
  C:\Windows\System\ygJEbed.exe
  2⤵
  PID:3648
- C:\Windows\System\JjSgpwY.exe
  C:\Windows\System\JjSgpwY.exe
  2⤵
  PID:4100
- C:\Windows\System\nRDLMni.exe
  C:\Windows\System\nRDLMni.exe
  2⤵
  PID:4116
- C:\Windows\System\lxyPJJt.exe
  C:\Windows\System\lxyPJJt.exe
  2⤵
  PID:4132
- C:\Windows\System\qwnOZLg.exe
  C:\Windows\System\qwnOZLg.exe
  2⤵
  PID:4148
- C:\Windows\System\RSTucWc.exe
  C:\Windows\System\RSTucWc.exe
  2⤵
  PID:4164
- C:\Windows\System\yCSPodC.exe
  C:\Windows\System\yCSPodC.exe
  2⤵
  PID:4180
- C:\Windows\System\UbURauy.exe
  C:\Windows\System\UbURauy.exe
  2⤵
  PID:4196
- C:\Windows\System\ICKwxwL.exe
  C:\Windows\System\ICKwxwL.exe
  2⤵
  PID:4212
- C:\Windows\System\MFvksWH.exe
  C:\Windows\System\MFvksWH.exe
  2⤵
  PID:4228
- C:\Windows\System\eFoMlUu.exe
  C:\Windows\System\eFoMlUu.exe
  2⤵
  PID:4244
- C:\Windows\System\MxyvOgE.exe
  C:\Windows\System\MxyvOgE.exe
  2⤵
  PID:4260
- C:\Windows\System\YvCdngn.exe
  C:\Windows\System\YvCdngn.exe
  2⤵
  PID:4276
- C:\Windows\System\TsHZQGy.exe
  C:\Windows\System\TsHZQGy.exe
  2⤵
  PID:4292
- C:\Windows\System\HOEeljy.exe
  C:\Windows\System\HOEeljy.exe
  2⤵
  PID:4308
- C:\Windows\System\DHAyeaU.exe
  C:\Windows\System\DHAyeaU.exe
  2⤵
  PID:4328
- C:\Windows\System\mVDoMSq.exe
  C:\Windows\System\mVDoMSq.exe
  2⤵
  PID:4344
- C:\Windows\System\YWTMAwO.exe
  C:\Windows\System\YWTMAwO.exe
  2⤵
  PID:4360
- C:\Windows\System\KkbBmhW.exe
  C:\Windows\System\KkbBmhW.exe
  2⤵
  PID:4376
- C:\Windows\System\eSradpQ.exe
  C:\Windows\System\eSradpQ.exe
  2⤵
  PID:4392
- C:\Windows\System\OvdjlPr.exe
  C:\Windows\System\OvdjlPr.exe
  2⤵
  PID:4408
- C:\Windows\System\TIJkWYI.exe
  C:\Windows\System\TIJkWYI.exe
  2⤵
  PID:4424
- C:\Windows\System\kaegGye.exe
  C:\Windows\System\kaegGye.exe
  2⤵
  PID:4440
- C:\Windows\System\qcHAkyT.exe
  C:\Windows\System\qcHAkyT.exe
  2⤵
  PID:4456
- C:\Windows\System\BZkjtfD.exe
  C:\Windows\System\BZkjtfD.exe
  2⤵
  PID:4472
- C:\Windows\System\mBtmQZp.exe
  C:\Windows\System\mBtmQZp.exe
  2⤵
  PID:4488
- C:\Windows\System\aigepKl.exe
  C:\Windows\System\aigepKl.exe
  2⤵
  PID:4504
- C:\Windows\System\VQoBBqt.exe
  C:\Windows\System\VQoBBqt.exe
  2⤵
  PID:4520
- C:\Windows\System\wySHXSk.exe
  C:\Windows\System\wySHXSk.exe
  2⤵
  PID:4536
- C:\Windows\System\mlCszWN.exe
  C:\Windows\System\mlCszWN.exe
  2⤵
  PID:4552
- C:\Windows\System\XDDyCbC.exe
  C:\Windows\System\XDDyCbC.exe
  2⤵
  PID:4568
- C:\Windows\System\JySSMkl.exe
  C:\Windows\System\JySSMkl.exe
  2⤵
  PID:4584
- C:\Windows\System\FPpGuPr.exe
  C:\Windows\System\FPpGuPr.exe
  2⤵
  PID:4600
- C:\Windows\System\JMfkhQx.exe
  C:\Windows\System\JMfkhQx.exe
  2⤵
  PID:4616
- C:\Windows\System\eGoTiPT.exe
  C:\Windows\System\eGoTiPT.exe
  2⤵
  PID:4632
- C:\Windows\System\cEwyLym.exe
  C:\Windows\System\cEwyLym.exe
  2⤵
  PID:4648
- C:\Windows\System\OLhoSOa.exe
  C:\Windows\System\OLhoSOa.exe
  2⤵
  PID:4664
- C:\Windows\System\AcfBVJd.exe
  C:\Windows\System\AcfBVJd.exe
  2⤵
  PID:4680
- C:\Windows\System\EBOcFrL.exe
  C:\Windows\System\EBOcFrL.exe
  2⤵
  PID:4700
- C:\Windows\System\QEbDioC.exe
  C:\Windows\System\QEbDioC.exe
  2⤵
  PID:4716
- C:\Windows\System\bDgydXM.exe
  C:\Windows\System\bDgydXM.exe
  2⤵
  PID:4736
- C:\Windows\System\IHUqLNI.exe
  C:\Windows\System\IHUqLNI.exe
  2⤵
  PID:4752
- C:\Windows\System\cYJMGKk.exe
  C:\Windows\System\cYJMGKk.exe
  2⤵
  PID:4768
- C:\Windows\System\pBVfCGU.exe
  C:\Windows\System\pBVfCGU.exe
  2⤵
  PID:4784
- C:\Windows\System\IyPoXJj.exe
  C:\Windows\System\IyPoXJj.exe
  2⤵
  PID:4800
- C:\Windows\System\XpSOZUf.exe
  C:\Windows\System\XpSOZUf.exe
  2⤵
  PID:4820
- C:\Windows\System\kqHJbQl.exe
  C:\Windows\System\kqHJbQl.exe
  2⤵
  PID:4840
- C:\Windows\System\jZjecjf.exe
  C:\Windows\System\jZjecjf.exe
  2⤵
  PID:4856
- C:\Windows\System\eVvAdPH.exe
  C:\Windows\System\eVvAdPH.exe
  2⤵
  PID:4872
- C:\Windows\System\FTaYyng.exe
  C:\Windows\System\FTaYyng.exe
  2⤵
  PID:4892
- C:\Windows\System\rQNtZsv.exe
  C:\Windows\System\rQNtZsv.exe
  2⤵
  PID:4908
- C:\Windows\System\mEeKgFt.exe
  C:\Windows\System\mEeKgFt.exe
  2⤵
  PID:4924
- C:\Windows\System\vXGYkeW.exe
  C:\Windows\System\vXGYkeW.exe
  2⤵
  PID:4940
- C:\Windows\System\LQRRAsA.exe
  C:\Windows\System\LQRRAsA.exe
  2⤵
  PID:4956
- C:\Windows\System\ZOGuHyW.exe
  C:\Windows\System\ZOGuHyW.exe
  2⤵
  PID:4972
- C:\Windows\System\LnsXVNo.exe
  C:\Windows\System\LnsXVNo.exe
  2⤵
  PID:4992
- C:\Windows\System\vvYKMZQ.exe
  C:\Windows\System\vvYKMZQ.exe
  2⤵
  PID:5012
- C:\Windows\System\VaSGROX.exe
  C:\Windows\System\VaSGROX.exe
  2⤵
  PID:5028
- C:\Windows\System\GDHFUWT.exe
  C:\Windows\System\GDHFUWT.exe
  2⤵
  PID:5044
- C:\Windows\System\vFkXrsw.exe
  C:\Windows\System\vFkXrsw.exe
  2⤵
  PID:5064
- C:\Windows\System\VWRQkkY.exe
  C:\Windows\System\VWRQkkY.exe
  2⤵
  PID:5080
- C:\Windows\System\ZMAkLhj.exe
  C:\Windows\System\ZMAkLhj.exe
  2⤵
  PID:5100
- C:\Windows\System\RthjLuc.exe
  C:\Windows\System\RthjLuc.exe
  2⤵
  PID:5116
- C:\Windows\System\LCAbkKJ.exe
  C:\Windows\System\LCAbkKJ.exe
  2⤵
  PID:3700
- C:\Windows\System\RDBIoMa.exe
  C:\Windows\System\RDBIoMa.exe
  2⤵
  PID:3528
- C:\Windows\System\orONVUd.exe
  C:\Windows\System\orONVUd.exe
  2⤵
  PID:4208
- C:\Windows\System\JqBhwHo.exe
  C:\Windows\System\JqBhwHo.exe
  2⤵
  PID:4188
- C:\Windows\System\QsXGHMe.exe
  C:\Windows\System\QsXGHMe.exe
  2⤵
  PID:3336
- C:\Windows\System\YWxrRwB.exe
  C:\Windows\System\YWxrRwB.exe
  2⤵
  PID:3552
- C:\Windows\System\ialasjY.exe
  C:\Windows\System\ialasjY.exe
  2⤵
  PID:4272
- C:\Windows\System\MtodSdf.exe
  C:\Windows\System\MtodSdf.exe
  2⤵
  PID:4368
- C:\Windows\System\JjiWnbv.exe
  C:\Windows\System\JjiWnbv.exe
  2⤵
  PID:4432
- C:\Windows\System\bJgOOUE.exe
  C:\Windows\System\bJgOOUE.exe
  2⤵
  PID:4256
- C:\Windows\System\yHBVLER.exe
  C:\Windows\System\yHBVLER.exe
  2⤵
  PID:4320
- C:\Windows\System\QoLHdNv.exe
  C:\Windows\System\QoLHdNv.exe
  2⤵
  PID:4724
- C:\Windows\System\vhEKwXs.exe
  C:\Windows\System\vhEKwXs.exe
  2⤵
  PID:4900
- C:\Windows\System\hffxrDX.exe
  C:\Windows\System\hffxrDX.exe
  2⤵
  PID:4968
- C:\Windows\System\GfYGqxQ.exe
  C:\Windows\System\GfYGqxQ.exe
  2⤵
  PID:4984
- C:\Windows\System\ZAydffB.exe
  C:\Windows\System\ZAydffB.exe
  2⤵
  PID:5004
- C:\Windows\System\LlkXNYB.exe
  C:\Windows\System\LlkXNYB.exe
  2⤵
  PID:5040
- C:\Windows\System\xBKGNCr.exe
  C:\Windows\System\xBKGNCr.exe
  2⤵
  PID:5092
- C:\Windows\System\kkqumlj.exe
  C:\Windows\System\kkqumlj.exe
  2⤵
  PID:4336
- C:\Windows\System\BuBGbkh.exe
  C:\Windows\System\BuBGbkh.exe
  2⤵
  PID:4124
- C:\Windows\System\qjAMMEq.exe
  C:\Windows\System\qjAMMEq.exe
  2⤵
  PID:4624
- C:\Windows\System\wQaZHxR.exe
  C:\Windows\System\wQaZHxR.exe
  2⤵
  PID:4816
- C:\Windows\System\cZWqXAx.exe
  C:\Windows\System\cZWqXAx.exe
  2⤵
  PID:4864
- C:\Windows\System\uXDrJzk.exe
  C:\Windows\System\uXDrJzk.exe
  2⤵
  PID:4964
- C:\Windows\System\qSkOtLf.exe
  C:\Windows\System\qSkOtLf.exe
  2⤵
  PID:4920
- C:\Windows\System\bDoLCYb.exe
  C:\Windows\System\bDoLCYb.exe
  2⤵
  PID:5008
- C:\Windows\System\CTpxFRb.exe
  C:\Windows\System\CTpxFRb.exe
  2⤵
  PID:5024
- C:\Windows\System\lQUifMn.exe
  C:\Windows\System\lQUifMn.exe
  2⤵
  PID:5076
- C:\Windows\System\MlBLbwa.exe
  C:\Windows\System\MlBLbwa.exe
  2⤵
  PID:2104
- C:\Windows\System\ZQCYnhP.exe
  C:\Windows\System\ZQCYnhP.exe
  2⤵
  PID:4436
- C:\Windows\System\yFbRWxb.exe
  C:\Windows\System\yFbRWxb.exe
  2⤵
  PID:4352
- C:\Windows\System\KhZHGtP.exe
  C:\Windows\System\KhZHGtP.exe
  2⤵
  PID:4468
- C:\Windows\System\ilfCGqX.exe
  C:\Windows\System\ilfCGqX.exe
  2⤵
  PID:4496
- C:\Windows\System\dgVtSwS.exe
  C:\Windows\System\dgVtSwS.exe
  2⤵
  PID:4564
- C:\Windows\System\XPcRSwA.exe
  C:\Windows\System\XPcRSwA.exe
  2⤵
  PID:4512
- C:\Windows\System\kfMRfBA.exe
  C:\Windows\System\kfMRfBA.exe
  2⤵
  PID:4748
- C:\Windows\System\nQPWdTT.exe
  C:\Windows\System\nQPWdTT.exe
  2⤵
  PID:4852
- C:\Windows\System\DVhpnsa.exe
  C:\Windows\System\DVhpnsa.exe
  2⤵
  PID:4808
- C:\Windows\System\PjRwnSa.exe
  C:\Windows\System\PjRwnSa.exe
  2⤵
  PID:5036
- C:\Windows\System\YLdfXnz.exe
  C:\Windows\System\YLdfXnz.exe
  2⤵
  PID:5072
- C:\Windows\System\qhtLhrv.exe
  C:\Windows\System\qhtLhrv.exe
  2⤵
  PID:4952
- C:\Windows\System\yGXSDkd.exe
  C:\Windows\System\yGXSDkd.exe
  2⤵
  PID:4224
- C:\Windows\System\zraRghK.exe
  C:\Windows\System\zraRghK.exe
  2⤵
  PID:4204
- C:\Windows\System\ASESQbK.exe
  C:\Windows\System\ASESQbK.exe
  2⤵
  PID:4384
- C:\Windows\System\GDfJDJO.exe
  C:\Windows\System\GDfJDJO.exe
  2⤵
  PID:4448
- C:\Windows\System\WTrvRqu.exe
  C:\Windows\System\WTrvRqu.exe
  2⤵
  PID:4532
- C:\Windows\System\SRRBIIl.exe
  C:\Windows\System\SRRBIIl.exe
  2⤵
  PID:4480
- C:\Windows\System\SOYzYKh.exe
  C:\Windows\System\SOYzYKh.exe
  2⤵
  PID:4780
- C:\Windows\System\VjEDDVG.exe
  C:\Windows\System\VjEDDVG.exe
  2⤵
  PID:4796
- C:\Windows\System\eLaKFvO.exe
  C:\Windows\System\eLaKFvO.exe
  2⤵
  PID:4836
- C:\Windows\System\MNbajwD.exe
  C:\Windows\System\MNbajwD.exe
  2⤵
  PID:4112
- C:\Windows\System\dXSIzll.exe
  C:\Windows\System\dXSIzll.exe
  2⤵
  PID:4172
- C:\Windows\System\SONtUZm.exe
  C:\Windows\System\SONtUZm.exe
  2⤵
  PID:4416
- C:\Windows\System\UMZTmdb.exe
  C:\Windows\System\UMZTmdb.exe
  2⤵
  PID:4452
- C:\Windows\System\znuunHW.exe
  C:\Windows\System\znuunHW.exe
  2⤵
  PID:5136
- C:\Windows\System\qDNmqIu.exe
  C:\Windows\System\qDNmqIu.exe
  2⤵
  PID:5160
- C:\Windows\System\pqBvUIE.exe
  C:\Windows\System\pqBvUIE.exe
  2⤵
  PID:5176
- C:\Windows\System\MBuUtkE.exe
  C:\Windows\System\MBuUtkE.exe
  2⤵
  PID:5192
- C:\Windows\System\BudnwwC.exe
  C:\Windows\System\BudnwwC.exe
  2⤵
  PID:5212
- C:\Windows\System\zHPItEK.exe
  C:\Windows\System\zHPItEK.exe
  2⤵
  PID:5232
- C:\Windows\System\bctcguO.exe
  C:\Windows\System\bctcguO.exe
  2⤵
  PID:5248
- C:\Windows\System\beYGOZn.exe
  C:\Windows\System\beYGOZn.exe
  2⤵
  PID:5264
- C:\Windows\System\dprWLCV.exe
  C:\Windows\System\dprWLCV.exe
  2⤵
  PID:5284
- C:\Windows\System\NtPrVuF.exe
  C:\Windows\System\NtPrVuF.exe
  2⤵
  PID:5300
- C:\Windows\System\LsfXbwX.exe
  C:\Windows\System\LsfXbwX.exe
  2⤵
  PID:5316
- C:\Windows\System\LjBamsC.exe
  C:\Windows\System\LjBamsC.exe
  2⤵
  PID:5332
- C:\Windows\System\VppySYe.exe
  C:\Windows\System\VppySYe.exe
  2⤵
  PID:5352
- C:\Windows\System\fpDROaE.exe
  C:\Windows\System\fpDROaE.exe
  2⤵
  PID:5368
- C:\Windows\System\bVIraDZ.exe
  C:\Windows\System\bVIraDZ.exe
  2⤵
  PID:5384
- C:\Windows\System\LMtJubY.exe
  C:\Windows\System\LMtJubY.exe
  2⤵
  PID:5404
- C:\Windows\System\jvzPySX.exe
  C:\Windows\System\jvzPySX.exe
  2⤵
  PID:5428
- C:\Windows\System\LzAMRea.exe
  C:\Windows\System\LzAMRea.exe
  2⤵
  PID:5444
- C:\Windows\System\EKzIkQI.exe
  C:\Windows\System\EKzIkQI.exe
  2⤵
  PID:5460
- C:\Windows\System\FkOzpfI.exe
  C:\Windows\System\FkOzpfI.exe
  2⤵
  PID:5480
- C:\Windows\System\pVbKHbH.exe
  C:\Windows\System\pVbKHbH.exe
  2⤵
  PID:5584
- C:\Windows\System\EdmtOGa.exe
  C:\Windows\System\EdmtOGa.exe
  2⤵
  PID:5600
- C:\Windows\System\VDajLGE.exe
  C:\Windows\System\VDajLGE.exe
  2⤵
  PID:5616
- C:\Windows\System\oubaDmy.exe
  C:\Windows\System\oubaDmy.exe
  2⤵
  PID:5632
- C:\Windows\System\xjRWibh.exe
  C:\Windows\System\xjRWibh.exe
  2⤵
  PID:5652
- C:\Windows\System\ImiRKHW.exe
  C:\Windows\System\ImiRKHW.exe
  2⤵
  PID:5668
- C:\Windows\System\IfvQNve.exe
  C:\Windows\System\IfvQNve.exe
  2⤵
  PID:5684
- C:\Windows\System\LpFvIdT.exe
  C:\Windows\System\LpFvIdT.exe
  2⤵
  PID:5700
- C:\Windows\System\tVocrSQ.exe
  C:\Windows\System\tVocrSQ.exe
  2⤵
  PID:5720
- C:\Windows\System\keEOCDC.exe
  C:\Windows\System\keEOCDC.exe
  2⤵
  PID:5736
- C:\Windows\System\qpVZZqm.exe
  C:\Windows\System\qpVZZqm.exe
  2⤵
  PID:5756
- C:\Windows\System\oJrQQdv.exe
  C:\Windows\System\oJrQQdv.exe
  2⤵
  PID:5784
- C:\Windows\System\ljPuFyP.exe
  C:\Windows\System\ljPuFyP.exe
  2⤵
  PID:5800
- C:\Windows\System\yozzciy.exe
  C:\Windows\System\yozzciy.exe
  2⤵
  PID:5828
- C:\Windows\System\dHfEqNH.exe
  C:\Windows\System\dHfEqNH.exe
  2⤵
  PID:5844
- C:\Windows\System\MaUpYty.exe
  C:\Windows\System\MaUpYty.exe
  2⤵
  PID:5860
- C:\Windows\System\LVeIuCT.exe
  C:\Windows\System\LVeIuCT.exe
  2⤵
  PID:5880
- C:\Windows\System\ovUAWtk.exe
  C:\Windows\System\ovUAWtk.exe
  2⤵
  PID:5900
- C:\Windows\System\WznGLRZ.exe
  C:\Windows\System\WznGLRZ.exe
  2⤵
  PID:5920
- C:\Windows\System\flYwDwJ.exe
  C:\Windows\System\flYwDwJ.exe
  2⤵
  PID:5936
- C:\Windows\System\OLNgPrd.exe
  C:\Windows\System\OLNgPrd.exe
  2⤵
  PID:5956
- C:\Windows\System\vjSpTzR.exe
  C:\Windows\System\vjSpTzR.exe
  2⤵
  PID:5972
- C:\Windows\System\ibjKtQv.exe
  C:\Windows\System\ibjKtQv.exe
  2⤵
  PID:5988
- C:\Windows\System\yLKzHor.exe
  C:\Windows\System\yLKzHor.exe
  2⤵
  PID:6008
- C:\Windows\System\eNkWxVT.exe
  C:\Windows\System\eNkWxVT.exe
  2⤵
  PID:6024
- C:\Windows\System\Wilndhk.exe
  C:\Windows\System\Wilndhk.exe
  2⤵
  PID:6040
- C:\Windows\System\pNSIRPq.exe
  C:\Windows\System\pNSIRPq.exe
  2⤵
  PID:6060
- C:\Windows\System\hamLXXz.exe
  C:\Windows\System\hamLXXz.exe
  2⤵
  PID:6076
- C:\Windows\System\KXzwwdP.exe
  C:\Windows\System\KXzwwdP.exe
  2⤵
  PID:6092
- C:\Windows\System\qwrBZtI.exe
  C:\Windows\System\qwrBZtI.exe
  2⤵
  PID:6112
- C:\Windows\System\iSFnAPp.exe
  C:\Windows\System\iSFnAPp.exe
  2⤵
  PID:6136
- C:\Windows\System\MjcrTZo.exe
  C:\Windows\System\MjcrTZo.exe
  2⤵
  PID:4792
- C:\Windows\System\oOfACKY.exe
  C:\Windows\System\oOfACKY.exe
  2⤵
  PID:4812
- C:\Windows\System\ulQjQUv.exe
  C:\Windows\System\ulQjQUv.exe
  2⤵
  PID:4072
- C:\Windows\System\SrCppvW.exe
  C:\Windows\System\SrCppvW.exe
  2⤵
  PID:5220
- C:\Windows\System\uQKdHfe.exe
  C:\Windows\System\uQKdHfe.exe
  2⤵
  PID:5296
- C:\Windows\System\weFqokp.exe
  C:\Windows\System\weFqokp.exe
  2⤵
  PID:5364
- C:\Windows\System\eBvlctK.exe
  C:\Windows\System\eBvlctK.exe
  2⤵
  PID:5468
- C:\Windows\System\tQsAmtZ.exe
  C:\Windows\System\tQsAmtZ.exe
  2⤵
  PID:4516
- C:\Windows\System\qjGKfuL.exe
  C:\Windows\System\qjGKfuL.exe
  2⤵
  PID:5532
- C:\Windows\System\zGnowrj.exe
  C:\Windows\System\zGnowrj.exe
  2⤵
  PID:5200
- C:\Windows\System\oTrATSV.exe
  C:\Windows\System\oTrATSV.exe
  2⤵
  PID:5244
- C:\Windows\System\OsVryhi.exe
  C:\Windows\System\OsVryhi.exe
  2⤵
  PID:5280
- C:\Windows\System\PEjBHdD.exe
  C:\Windows\System\PEjBHdD.exe
  2⤵
  PID:5624
- C:\Windows\System\lPIhgpG.exe
  C:\Windows\System\lPIhgpG.exe
  2⤵
  PID:5692
- C:\Windows\System\kbGZJCj.exe
  C:\Windows\System\kbGZJCj.exe
  2⤵
  PID:5556
- C:\Windows\System\IFbXnFR.exe
  C:\Windows\System\IFbXnFR.exe
  2⤵
  PID:5412
- C:\Windows\System\qlMDgnG.exe
  C:\Windows\System\qlMDgnG.exe
  2⤵
  PID:5568
- C:\Windows\System\TlSMjUN.exe
  C:\Windows\System\TlSMjUN.exe
  2⤵
  PID:5572
- C:\Windows\System\LZPKrZV.exe
  C:\Windows\System\LZPKrZV.exe
  2⤵
  PID:5512
- C:\Windows\System\fYTSGKC.exe
  C:\Windows\System\fYTSGKC.exe
  2⤵
  PID:5612
- C:\Windows\System\mxStnTK.exe
  C:\Windows\System\mxStnTK.exe
  2⤵
  PID:5708
- C:\Windows\System\xnveddS.exe
  C:\Windows\System\xnveddS.exe
  2⤵
  PID:5752
- C:\Windows\System\bFyaHQr.exe
  C:\Windows\System\bFyaHQr.exe
  2⤵
  PID:5436
- C:\Windows\System\aqkrguw.exe
  C:\Windows\System\aqkrguw.exe
  2⤵
  PID:4372
- C:\Windows\System\VRGTCIN.exe
  C:\Windows\System\VRGTCIN.exe
  2⤵
  PID:5748
- C:\Windows\System\HDyLtJQ.exe
  C:\Windows\System\HDyLtJQ.exe
  2⤵
  PID:5916
- C:\Windows\System\sgajZMI.exe
  C:\Windows\System\sgajZMI.exe
  2⤵
  PID:5948
- C:\Windows\System\hSeCbYw.exe
  C:\Windows\System\hSeCbYw.exe
  2⤵
  PID:6016
- C:\Windows\System\oRcPimf.exe
  C:\Windows\System\oRcPimf.exe
  2⤵
  PID:6056
- C:\Windows\System\oWKfhBV.exe
  C:\Windows\System\oWKfhBV.exe
  2⤵
  PID:5148
- C:\Windows\System\ggPWmUZ.exe
  C:\Windows\System\ggPWmUZ.exe
  2⤵
  PID:5156
- C:\Windows\System\xhWiFbC.exe
  C:\Windows\System\xhWiFbC.exe
  2⤵
  PID:4832
- C:\Windows\System\fNdeJZP.exe
  C:\Windows\System\fNdeJZP.exe
  2⤵
  PID:5540
- C:\Windows\System\KCWQhXt.exe
  C:\Windows\System\KCWQhXt.exe
  2⤵
  PID:5000
- C:\Windows\System\pbmwgtE.exe
  C:\Windows\System\pbmwgtE.exe
  2⤵
  PID:5328
- C:\Windows\System\HhBGUrd.exe
  C:\Windows\System\HhBGUrd.exe
  2⤵
  PID:5456
- C:\Windows\System\MRduPWb.exe
  C:\Windows\System\MRduPWb.exe
  2⤵
  PID:5664
- C:\Windows\System\kJQQDMk.exe
  C:\Windows\System\kJQQDMk.exe
  2⤵
  PID:5564
- C:\Windows\System\dfAhIdb.exe
  C:\Windows\System\dfAhIdb.exe
  2⤵
  PID:5376
- C:\Windows\System\iXEdjnU.exe
  C:\Windows\System\iXEdjnU.exe
  2⤵
  PID:5496
- C:\Windows\System\xfNSAQl.exe
  C:\Windows\System\xfNSAQl.exe
  2⤵
  PID:5576
- C:\Windows\System\julmfRa.exe
  C:\Windows\System\julmfRa.exe
  2⤵
  PID:5644
- C:\Windows\System\ePfDyNi.exe
  C:\Windows\System\ePfDyNi.exe
  2⤵
  PID:5812
- C:\Windows\System\NoHMfjB.exe
  C:\Windows\System\NoHMfjB.exe
  2⤵
  PID:5996
- C:\Windows\System\pktLFqL.exe
  C:\Windows\System\pktLFqL.exe
  2⤵
  PID:6004
- C:\Windows\System\mlBwAgN.exe
  C:\Windows\System\mlBwAgN.exe
  2⤵
  PID:6104
- C:\Windows\System\PLiiTpx.exe
  C:\Windows\System\PLiiTpx.exe
  2⤵
  PID:4592
- C:\Windows\System\xbtmmEh.exe
  C:\Windows\System\xbtmmEh.exe
  2⤵
  PID:5840
- C:\Windows\System\NWpWotz.exe
  C:\Windows\System\NWpWotz.exe
  2⤵
  PID:5228
- C:\Windows\System\RiXLLob.exe
  C:\Windows\System\RiXLLob.exe
  2⤵
  PID:5868
- C:\Windows\System\uPlcXCs.exe
  C:\Windows\System\uPlcXCs.exe
  2⤵
  PID:6048
- C:\Windows\System\ANZYJpi.exe
  C:\Windows\System\ANZYJpi.exe
  2⤵
  PID:5912
- C:\Windows\System\TVlNHFV.exe
  C:\Windows\System\TVlNHFV.exe
  2⤵
  PID:5524
- C:\Windows\System\pZrJREV.exe
  C:\Windows\System\pZrJREV.exe
  2⤵
  PID:6128
- C:\Windows\System\hHJfiHv.exe
  C:\Windows\System\hHJfiHv.exe
  2⤵
  PID:5276
- C:\Windows\System\rVinunL.exe
  C:\Windows\System\rVinunL.exe
  2⤵
  PID:5552
- C:\Windows\System\BPvGOrP.exe
  C:\Windows\System\BPvGOrP.exe
  2⤵
  PID:5348
- C:\Windows\System\HTzzZLc.exe
  C:\Windows\System\HTzzZLc.exe
  2⤵
  PID:5608
- C:\Windows\System\XuXyxRj.exe
  C:\Windows\System\XuXyxRj.exe
  2⤵
  PID:5816
- C:\Windows\System\rvTYTSb.exe
  C:\Windows\System\rvTYTSb.exe
  2⤵
  PID:5896
- C:\Windows\System\ATPdPns.exe
  C:\Windows\System\ATPdPns.exe
  2⤵
  PID:5964
- C:\Windows\System\ccGfCzm.exe
  C:\Windows\System\ccGfCzm.exe
  2⤵
  PID:5128
- C:\Windows\System\yxjILAp.exe
  C:\Windows\System\yxjILAp.exe
  2⤵
  PID:5744
- C:\Windows\System\wOwvqUc.exe
  C:\Windows\System\wOwvqUc.exe
  2⤵
  PID:6120
- C:\Windows\System\WYBsgpq.exe
  C:\Windows\System\WYBsgpq.exe
  2⤵
  PID:5680
- C:\Windows\System\idyEOpv.exe
  C:\Windows\System\idyEOpv.exe
  2⤵
  PID:4288
- C:\Windows\System\VGEmmTz.exe
  C:\Windows\System\VGEmmTz.exe
  2⤵
  PID:5476
- C:\Windows\System\SchjtEZ.exe
  C:\Windows\System\SchjtEZ.exe
  2⤵
  PID:4848
- C:\Windows\System\vETwQCv.exe
  C:\Windows\System\vETwQCv.exe
  2⤵
  PID:5172
- C:\Windows\System\HwqlWXz.exe
  C:\Windows\System\HwqlWXz.exe
  2⤵
  PID:5648
- C:\Windows\System\UYZustP.exe
  C:\Windows\System\UYZustP.exe
  2⤵
  PID:6100
- C:\Windows\System\rkGyhRq.exe
  C:\Windows\System\rkGyhRq.exe
  2⤵
  PID:5796
- C:\Windows\System\iPvsKEu.exe
  C:\Windows\System\iPvsKEu.exe
  2⤵
  PID:5308
- C:\Windows\System\BeFqsOj.exe
  C:\Windows\System\BeFqsOj.exe
  2⤵
  PID:5508
- C:\Windows\System\aQcXoBk.exe
  C:\Windows\System\aQcXoBk.exe
  2⤵
  PID:5776
- C:\Windows\System\dfZHZsc.exe
  C:\Windows\System\dfZHZsc.exe
  2⤵
  PID:5836
- C:\Windows\System\bTjMgSN.exe
  C:\Windows\System\bTjMgSN.exe
  2⤵
  PID:5984
- C:\Windows\System\YZKzuql.exe
  C:\Windows\System\YZKzuql.exe
  2⤵
  PID:5240
- C:\Windows\System\MPmRHWZ.exe
  C:\Windows\System\MPmRHWZ.exe
  2⤵
  PID:5824
- C:\Windows\System\ZPdzBmL.exe
  C:\Windows\System\ZPdzBmL.exe
  2⤵
  PID:6160
- C:\Windows\System\XBkNxxD.exe
  C:\Windows\System\XBkNxxD.exe
  2⤵
  PID:6176
- C:\Windows\System\mrFlWwa.exe
  C:\Windows\System\mrFlWwa.exe
  2⤵
  PID:6196
- C:\Windows\System\kMxFjVa.exe
  C:\Windows\System\kMxFjVa.exe
  2⤵
  PID:6212
- C:\Windows\System\HaOXGyR.exe
  C:\Windows\System\HaOXGyR.exe
  2⤵
  PID:6228
- C:\Windows\System\iyOsNKi.exe
  C:\Windows\System\iyOsNKi.exe
  2⤵
  PID:6244
- C:\Windows\System\sCYpsvN.exe
  C:\Windows\System\sCYpsvN.exe
  2⤵
  PID:6264
- C:\Windows\System\OndSZKR.exe
  C:\Windows\System\OndSZKR.exe
  2⤵
  PID:6284
- C:\Windows\System\WTogOuP.exe
  C:\Windows\System\WTogOuP.exe
  2⤵
  PID:6300
- C:\Windows\System\zPgpLWu.exe
  C:\Windows\System\zPgpLWu.exe
  2⤵
  PID:6320
- C:\Windows\System\PkKcUgO.exe
  C:\Windows\System\PkKcUgO.exe
  2⤵
  PID:6380
- C:\Windows\System\RFSHyNR.exe
  C:\Windows\System\RFSHyNR.exe
  2⤵
  PID:6396
- C:\Windows\System\TdkPakZ.exe
  C:\Windows\System\TdkPakZ.exe
  2⤵
  PID:6412
- C:\Windows\System\edONlLO.exe
  C:\Windows\System\edONlLO.exe
  2⤵
  PID:6428
- C:\Windows\System\gqVBqHh.exe
  C:\Windows\System\gqVBqHh.exe
  2⤵
  PID:6448
- C:\Windows\System\HshBcwZ.exe
  C:\Windows\System\HshBcwZ.exe
  2⤵
  PID:6464
- C:\Windows\System\DyBoljZ.exe
  C:\Windows\System\DyBoljZ.exe
  2⤵
  PID:6480
- C:\Windows\System\hXcznvU.exe
  C:\Windows\System\hXcznvU.exe
  2⤵
  PID:6500
- C:\Windows\System\RaJNscx.exe
  C:\Windows\System\RaJNscx.exe
  2⤵
  PID:6516
- C:\Windows\System\BqWagkB.exe
  C:\Windows\System\BqWagkB.exe
  2⤵
  PID:6532
- C:\Windows\System\FNdDrUC.exe
  C:\Windows\System\FNdDrUC.exe
  2⤵
  PID:6548
- C:\Windows\System\GaqbeYj.exe
  C:\Windows\System\GaqbeYj.exe
  2⤵
  PID:6576
- C:\Windows\System\afPcFES.exe
  C:\Windows\System\afPcFES.exe
  2⤵
  PID:6604
- C:\Windows\System\vDZpljE.exe
  C:\Windows\System\vDZpljE.exe
  2⤵
  PID:6620
- C:\Windows\System\LfwOmsr.exe
  C:\Windows\System\LfwOmsr.exe
  2⤵
  PID:6644
- C:\Windows\System\iKSDuNG.exe
  C:\Windows\System\iKSDuNG.exe
  2⤵
  PID:6664
- C:\Windows\System\cetUvNV.exe
  C:\Windows\System\cetUvNV.exe
  2⤵
  PID:6684
- C:\Windows\System\swjvouQ.exe
  C:\Windows\System\swjvouQ.exe
  2⤵
  PID:6700
- C:\Windows\System\YvmpLfn.exe
  C:\Windows\System\YvmpLfn.exe
  2⤵
  PID:6720
- C:\Windows\System\kPbiKce.exe
  C:\Windows\System\kPbiKce.exe
  2⤵
  PID:6764
- C:\Windows\System\CtMduNt.exe
  C:\Windows\System\CtMduNt.exe
  2⤵
  PID:6784
- C:\Windows\System\aOXmZGZ.exe
  C:\Windows\System\aOXmZGZ.exe
  2⤵
  PID:6800
- C:\Windows\System\DnOoKAX.exe
  C:\Windows\System\DnOoKAX.exe
  2⤵
  PID:6820
- C:\Windows\System\yjvhdRD.exe
  C:\Windows\System\yjvhdRD.exe
  2⤵
  PID:6844
- C:\Windows\System\lKqXbcj.exe
  C:\Windows\System\lKqXbcj.exe
  2⤵
  PID:6860
- C:\Windows\System\kMHHKSr.exe
  C:\Windows\System\kMHHKSr.exe
  2⤵
  PID:6876
- C:\Windows\System\lVYEMJm.exe
  C:\Windows\System\lVYEMJm.exe
  2⤵
  PID:6896
- C:\Windows\System\wYdRyXh.exe
  C:\Windows\System\wYdRyXh.exe
  2⤵
  PID:6912
- C:\Windows\System\cZyRaML.exe
  C:\Windows\System\cZyRaML.exe
  2⤵
  PID:6928
- C:\Windows\System\hjHZycl.exe
  C:\Windows\System\hjHZycl.exe
  2⤵
  PID:6948
- C:\Windows\System\yVLfMkg.exe
  C:\Windows\System\yVLfMkg.exe
  2⤵
  PID:6964
- C:\Windows\System\JVVYuJy.exe
  C:\Windows\System\JVVYuJy.exe
  2⤵
  PID:6980
- C:\Windows\System\aDUwsGw.exe
  C:\Windows\System\aDUwsGw.exe
  2⤵
  PID:6996
- C:\Windows\System\MoBDvwY.exe
  C:\Windows\System\MoBDvwY.exe
  2⤵
  PID:7016
- C:\Windows\System\ZGTrfMz.exe
  C:\Windows\System\ZGTrfMz.exe
  2⤵
  PID:7032
- C:\Windows\System\eqmXmQK.exe
  C:\Windows\System\eqmXmQK.exe
  2⤵
  PID:7048
- C:\Windows\System\LOqAFdo.exe
  C:\Windows\System\LOqAFdo.exe
  2⤵
  PID:7064
- C:\Windows\System\HEqKgsf.exe
  C:\Windows\System\HEqKgsf.exe
  2⤵
  PID:7080
- C:\Windows\System\bRxzczf.exe
  C:\Windows\System\bRxzczf.exe
  2⤵
  PID:7100
- C:\Windows\System\EvneHsf.exe
  C:\Windows\System\EvneHsf.exe
  2⤵
  PID:7132
- C:\Windows\System\RuLruof.exe
  C:\Windows\System\RuLruof.exe
  2⤵
  PID:7156
- C:\Windows\System\XXhyxKt.exe
  C:\Windows\System\XXhyxKt.exe
  2⤵
  PID:6072
- C:\Windows\System\VaJbKQD.exe
  C:\Windows\System\VaJbKQD.exe
  2⤵
  PID:6168
- C:\Windows\System\OTkjdeg.exe
  C:\Windows\System\OTkjdeg.exe
  2⤵
  PID:6308
- C:\Windows\System\YTHShoJ.exe
  C:\Windows\System\YTHShoJ.exe
  2⤵
  PID:6280
- C:\Windows\System\vyVgLDN.exe
  C:\Windows\System\vyVgLDN.exe
  2⤵
  PID:6152
- C:\Windows\System\erzzznn.exe
  C:\Windows\System\erzzznn.exe
  2⤵
  PID:6148
- C:\Windows\System\NEMIbxY.exe
  C:\Windows\System\NEMIbxY.exe
  2⤵
  PID:6220
- C:\Windows\System\QppoIbg.exe
  C:\Windows\System\QppoIbg.exe
  2⤵
  PID:6260
- C:\Windows\System\YDSozsO.exe
  C:\Windows\System\YDSozsO.exe
  2⤵
  PID:6336
- C:\Windows\System\DMaZiiJ.exe
  C:\Windows\System\DMaZiiJ.exe
  2⤵
  PID:6352
- C:\Windows\System\VZaLMdL.exe
  C:\Windows\System\VZaLMdL.exe
  2⤵
  PID:6372
- C:\Windows\System\iDRymjS.exe
  C:\Windows\System\iDRymjS.exe
  2⤵
  PID:6392
- C:\Windows\System\SVlphbn.exe
  C:\Windows\System\SVlphbn.exe
  2⤵
  PID:6488
- C:\Windows\System\njZbPlh.exe
  C:\Windows\System\njZbPlh.exe
  2⤵
  PID:6528
- C:\Windows\System\vfYRnhu.exe
  C:\Windows\System\vfYRnhu.exe
  2⤵
  PID:6444
- C:\Windows\System\Hlcrcmn.exe
  C:\Windows\System\Hlcrcmn.exe
  2⤵
  PID:6540
- C:\Windows\System\HTzCQsm.exe
  C:\Windows\System\HTzCQsm.exe
  2⤵
  PID:6564
- C:\Windows\System\qwNGkJW.exe
  C:\Windows\System\qwNGkJW.exe
  2⤵
  PID:6592
- C:\Windows\System\YTNyaHe.exe
  C:\Windows\System\YTNyaHe.exe
  2⤵
  PID:6600
- C:\Windows\System\bTNBRdH.exe
  C:\Windows\System\bTNBRdH.exe
  2⤵
  PID:6656
- C:\Windows\System\ikquKNc.exe
  C:\Windows\System\ikquKNc.exe
  2⤵
  PID:6660
- C:\Windows\System\nPvEbcC.exe
  C:\Windows\System\nPvEbcC.exe
  2⤵
  PID:6728
- C:\Windows\System\gPKObMy.exe
  C:\Windows\System\gPKObMy.exe
  2⤵
  PID:6708
- C:\Windows\System\cYYVjgC.exe
  C:\Windows\System\cYYVjgC.exe
  2⤵
  PID:6744
- C:\Windows\System\CLOBQme.exe
  C:\Windows\System\CLOBQme.exe
  2⤵
  PID:6748
- C:\Windows\System\lNrzqUI.exe
  C:\Windows\System\lNrzqUI.exe
  2⤵
  PID:6828
- C:\Windows\System\rorvtcz.exe
  C:\Windows\System\rorvtcz.exe
  2⤵
  PID:6780
- C:\Windows\System\MKVVQVQ.exe
  C:\Windows\System\MKVVQVQ.exe
  2⤵
  PID:6908
- C:\Windows\System\rbxohEF.exe
  C:\Windows\System\rbxohEF.exe
  2⤵
  PID:6940
- C:\Windows\System\HjxeJwh.exe
  C:\Windows\System\HjxeJwh.exe
  2⤵
  PID:6924
- C:\Windows\System\jWUvjzY.exe
  C:\Windows\System\jWUvjzY.exe
  2⤵
  PID:6856
- C:\Windows\System\GheaeaV.exe
  C:\Windows\System\GheaeaV.exe
  2⤵
  PID:6812
- C:\Windows\System\BGEmKOt.exe
  C:\Windows\System\BGEmKOt.exe
  2⤵
  PID:7124
- C:\Windows\System\SpBTXwR.exe
  C:\Windows\System\SpBTXwR.exe
  2⤵
  PID:7024
- C:\Windows\System\CjZoVWF.exe
  C:\Windows\System\CjZoVWF.exe
  2⤵
  PID:7060
- C:\Windows\System\rXuKirz.exe
  C:\Windows\System\rXuKirz.exe
  2⤵
  PID:5660
- C:\Windows\System\PvZRHzS.exe
  C:\Windows\System\PvZRHzS.exe
  2⤵
  PID:5892
- C:\Windows\System\dJuMUvK.exe
  C:\Windows\System\dJuMUvK.exe
  2⤵
  PID:5888
- C:\Windows\System\rOQHaia.exe
  C:\Windows\System\rOQHaia.exe
  2⤵
  PID:6192
- C:\Windows\System\CgnCzOw.exe
  C:\Windows\System\CgnCzOw.exe
  2⤵
  PID:6456
- C:\Windows\System\tHDJkGd.exe
  C:\Windows\System\tHDJkGd.exe
  2⤵
  PID:6440
- C:\Windows\System\PpFvhLj.exe
  C:\Windows\System\PpFvhLj.exe
  2⤵
  PID:5772
- C:\Windows\System\NZTVSHH.exe
  C:\Windows\System\NZTVSHH.exe
  2⤵
  PID:7152
- C:\Windows\System\GOnfwxE.exe
  C:\Windows\System\GOnfwxE.exe
  2⤵
  PID:6388
- C:\Windows\System\rgrevDa.exe
  C:\Windows\System\rgrevDa.exe
  2⤵
  PID:5396
- C:\Windows\System\iJaGOZl.exe
  C:\Windows\System\iJaGOZl.exe
  2⤵
  PID:6508
- C:\Windows\System\KudVwzu.exe
  C:\Windows\System\KudVwzu.exe
  2⤵
  PID:6636
- C:\Windows\System\vwfKzQk.exe
  C:\Windows\System\vwfKzQk.exe
  2⤵
  PID:6760
- C:\Windows\System\GSVnKho.exe
  C:\Windows\System\GSVnKho.exe
  2⤵
  PID:6836
- C:\Windows\System\XComQPV.exe
  C:\Windows\System\XComQPV.exe
  2⤵
  PID:6884
- C:\Windows\System\zbjWpiS.exe
  C:\Windows\System\zbjWpiS.exe
  2⤵
  PID:6872
- C:\Windows\System\PSuCrPt.exe
  C:\Windows\System\PSuCrPt.exe
  2⤵
  PID:7008
- C:\Windows\System\qSXDtCd.exe
  C:\Windows\System\qSXDtCd.exe
  2⤵
  PID:6696
- C:\Windows\System\GYHXsGF.exe
  C:\Windows\System\GYHXsGF.exe
  2⤵
  PID:6588
- C:\Windows\System\UvMkELX.exe
  C:\Windows\System\UvMkELX.exe
  2⤵
  PID:7044
- C:\Windows\System\qHwFzOa.exe
  C:\Windows\System\qHwFzOa.exe
  2⤵
  PID:7164
- C:\Windows\System\IGbeSKz.exe
  C:\Windows\System\IGbeSKz.exe
  2⤵
  PID:6436
- C:\Windows\System\WipjMJa.exe
  C:\Windows\System\WipjMJa.exe
  2⤵
  PID:6276
- C:\Windows\System\FVApFjd.exe
  C:\Windows\System\FVApFjd.exe
  2⤵
  PID:6376
- C:\Windows\System\ImLLLOI.exe
  C:\Windows\System\ImLLLOI.exe
  2⤵
  PID:6524
- C:\Windows\System\CDjhdJS.exe
  C:\Windows\System\CDjhdJS.exe
  2⤵
  PID:6596
- C:\Windows\System\UTVzGKb.exe
  C:\Windows\System\UTVzGKb.exe
  2⤵
  PID:7004
- C:\Windows\System\BOZyTqq.exe
  C:\Windows\System\BOZyTqq.exe
  2⤵
  PID:7144
- C:\Windows\System\uLYDylL.exe
  C:\Windows\System\uLYDylL.exe
  2⤵
  PID:6408
- C:\Windows\System\sCStxLB.exe
  C:\Windows\System\sCStxLB.exe
  2⤵
  PID:7072
- C:\Windows\System\EeWKFXE.exe
  C:\Windows\System\EeWKFXE.exe
  2⤵
  PID:6796
- C:\Windows\System\qCXyOki.exe
  C:\Windows\System\qCXyOki.exe
  2⤵
  PID:6652
- C:\Windows\System\SrIhPJV.exe
  C:\Windows\System\SrIhPJV.exe
  2⤵
  PID:7092
- C:\Windows\System\AidDWJs.exe
  C:\Windows\System\AidDWJs.exe
  2⤵
  PID:6360
- C:\Windows\System\fZHNluE.exe
  C:\Windows\System\fZHNluE.exe
  2⤵
  PID:6988
- C:\Windows\System\oHuzRJZ.exe
  C:\Windows\System\oHuzRJZ.exe
  2⤵
  PID:7096
- C:\Windows\System\pvdfQwa.exe
  C:\Windows\System\pvdfQwa.exe
  2⤵
  PID:6840
- C:\Windows\System\NeFnsBq.exe
  C:\Windows\System\NeFnsBq.exe
  2⤵
  PID:6740
- C:\Windows\System\uOfVgPI.exe
  C:\Windows\System\uOfVgPI.exe
  2⤵
  PID:7172
- C:\Windows\System\ganvghm.exe
  C:\Windows\System\ganvghm.exe
  2⤵
  PID:7192
- C:\Windows\System\LHxsUuO.exe
  C:\Windows\System\LHxsUuO.exe
  2⤵
  PID:7208
- C:\Windows\System\pWmFfum.exe
  C:\Windows\System\pWmFfum.exe
  2⤵
  PID:7224
- C:\Windows\System\snQEYhQ.exe
  C:\Windows\System\snQEYhQ.exe
  2⤵
  PID:7240
- C:\Windows\System\PKgPHBA.exe
  C:\Windows\System\PKgPHBA.exe
  2⤵
  PID:7256
- C:\Windows\System\GBpUqZA.exe
  C:\Windows\System\GBpUqZA.exe
  2⤵
  PID:7356
- C:\Windows\System\PsKKzjI.exe
  C:\Windows\System\PsKKzjI.exe
  2⤵
  PID:7376
- C:\Windows\System\RgFzYDG.exe
  C:\Windows\System\RgFzYDG.exe
  2⤵
  PID:7392
- C:\Windows\System\czKdbsH.exe
  C:\Windows\System\czKdbsH.exe
  2⤵
  PID:7408
- C:\Windows\System\horoURc.exe
  C:\Windows\System\horoURc.exe
  2⤵
  PID:7432
- C:\Windows\System\VFeLvan.exe
  C:\Windows\System\VFeLvan.exe
  2⤵
  PID:7448
- C:\Windows\System\eGEFQKa.exe
  C:\Windows\System\eGEFQKa.exe
  2⤵
  PID:7476
- C:\Windows\System\BQFtvls.exe
  C:\Windows\System\BQFtvls.exe
  2⤵
  PID:7496
- C:\Windows\System\HjFuKNl.exe
  C:\Windows\System\HjFuKNl.exe
  2⤵
  PID:7512
- C:\Windows\System\eRHGEZN.exe
  C:\Windows\System\eRHGEZN.exe
  2⤵
  PID:7528
- C:\Windows\System\mCzMQLW.exe
  C:\Windows\System\mCzMQLW.exe
  2⤵
  PID:7544
- C:\Windows\System\siOtgLQ.exe
  C:\Windows\System\siOtgLQ.exe
  2⤵
  PID:7560
- C:\Windows\System\DEuDApa.exe
  C:\Windows\System\DEuDApa.exe
  2⤵
  PID:7580
- C:\Windows\System\VZMXxtG.exe
  C:\Windows\System\VZMXxtG.exe
  2⤵
  PID:7596
- C:\Windows\System\JKplEeV.exe
  C:\Windows\System\JKplEeV.exe
  2⤵
  PID:7616
- C:\Windows\System\wrxwsfb.exe
  C:\Windows\System\wrxwsfb.exe
  2⤵
  PID:7636
- C:\Windows\System\gXhwcdN.exe
  C:\Windows\System\gXhwcdN.exe
  2⤵
  PID:7652
- C:\Windows\System\ULlkuMb.exe
  C:\Windows\System\ULlkuMb.exe
  2⤵
  PID:7668
- C:\Windows\System\nvmIZzj.exe
  C:\Windows\System\nvmIZzj.exe
  2⤵
  PID:7692
- C:\Windows\System\bPYdwar.exe
  C:\Windows\System\bPYdwar.exe
  2⤵
  PID:7716
- C:\Windows\System\gMyesKa.exe
  C:\Windows\System\gMyesKa.exe
  2⤵
  PID:7736
- C:\Windows\System\hRgJnox.exe
  C:\Windows\System\hRgJnox.exe
  2⤵
  PID:7792
- C:\Windows\System\sXTVhSe.exe
  C:\Windows\System\sXTVhSe.exe
  2⤵
  PID:7808
- C:\Windows\System\gPuIzaI.exe
  C:\Windows\System\gPuIzaI.exe
  2⤵
  PID:7824
- C:\Windows\System\JCMRPAY.exe
  C:\Windows\System\JCMRPAY.exe
  2⤵
  PID:7840
- C:\Windows\System\iQUBmRx.exe
  C:\Windows\System\iQUBmRx.exe
  2⤵
  PID:7856
- C:\Windows\System\lPJdQRO.exe
  C:\Windows\System\lPJdQRO.exe
  2⤵
  PID:7884
- C:\Windows\System\vuuYmzA.exe
  C:\Windows\System\vuuYmzA.exe
  2⤵
  PID:7900
- C:\Windows\System\JdzMZkl.exe
  C:\Windows\System\JdzMZkl.exe
  2⤵
  PID:7920
- C:\Windows\System\tZeGRer.exe
  C:\Windows\System\tZeGRer.exe
  2⤵
  PID:7940
- C:\Windows\System\jaIMtYd.exe
  C:\Windows\System\jaIMtYd.exe
  2⤵
  PID:7956
- C:\Windows\System\GdQANcL.exe
  C:\Windows\System\GdQANcL.exe
  2⤵
  PID:7972
- C:\Windows\System\zzMirOC.exe
  C:\Windows\System\zzMirOC.exe
  2⤵
  PID:7988
- C:\Windows\System\HismsWr.exe
  C:\Windows\System\HismsWr.exe
  2⤵
  PID:8004
- C:\Windows\System\XgomGhu.exe
  C:\Windows\System\XgomGhu.exe
  2⤵
  PID:8020
- C:\Windows\System\wQoPbWX.exe
  C:\Windows\System\wQoPbWX.exe
  2⤵
  PID:8040
- C:\Windows\System\hIaqLJM.exe
  C:\Windows\System\hIaqLJM.exe
  2⤵
  PID:8056
- C:\Windows\System\ONGJQpF.exe
  C:\Windows\System\ONGJQpF.exe
  2⤵
  PID:8072
- C:\Windows\System\EPqApYH.exe
  C:\Windows\System\EPqApYH.exe
  2⤵
  PID:8088
- C:\Windows\System\SKzSozD.exe
  C:\Windows\System\SKzSozD.exe
  2⤵
  PID:8104
- C:\Windows\System\EBuXdAQ.exe
  C:\Windows\System\EBuXdAQ.exe
  2⤵
  PID:8124
- C:\Windows\System\cBXkPXR.exe
  C:\Windows\System\cBXkPXR.exe
  2⤵
  PID:8140
- C:\Windows\System\XITevFo.exe
  C:\Windows\System\XITevFo.exe
  2⤵
  PID:8156
- C:\Windows\System\dyIDoSE.exe
  C:\Windows\System\dyIDoSE.exe
  2⤵
  PID:8172
- C:\Windows\System\SKIQOWX.exe
  C:\Windows\System\SKIQOWX.exe
  2⤵
  PID:6364
- C:\Windows\System\nBUwmnd.exe
  C:\Windows\System\nBUwmnd.exe
  2⤵
  PID:7120
- C:\Windows\System\GxgArjP.exe
  C:\Windows\System\GxgArjP.exe
  2⤵
  PID:7236
- C:\Windows\System\ezcFlPI.exe
  C:\Windows\System\ezcFlPI.exe
  2⤵
  PID:7268
- C:\Windows\System\ZPvmSzY.exe
  C:\Windows\System\ZPvmSzY.exe
  2⤵
  PID:7288
- C:\Windows\System\meBSIER.exe
  C:\Windows\System\meBSIER.exe
  2⤵
  PID:7304
- C:\Windows\System\bqjyKWb.exe
  C:\Windows\System\bqjyKWb.exe
  2⤵
  PID:7320
- C:\Windows\System\EvsBDaV.exe
  C:\Windows\System\EvsBDaV.exe
  2⤵
  PID:7340
- C:\Windows\System\nIbKhdz.exe
  C:\Windows\System\nIbKhdz.exe
  2⤵
  PID:7364
- C:\Windows\System\rCillkn.exe
  C:\Windows\System\rCillkn.exe
  2⤵
  PID:7404
- C:\Windows\System\ZvhemeK.exe
  C:\Windows\System\ZvhemeK.exe
  2⤵
  PID:7488
- C:\Windows\System\zfAblwt.exe
  C:\Windows\System\zfAblwt.exe
  2⤵
  PID:7552
- C:\Windows\System\bpTNDng.exe
  C:\Windows\System\bpTNDng.exe
  2⤵
  PID:7468
- C:\Windows\System\WfZoqWl.exe
  C:\Windows\System\WfZoqWl.exe
  2⤵
  PID:7416
- C:\Windows\System\cQibYLH.exe
  C:\Windows\System\cQibYLH.exe
  2⤵
  PID:7456
- C:\Windows\System\xbDaftl.exe
  C:\Windows\System\xbDaftl.exe
  2⤵
  PID:7536
- C:\Windows\System\VYNbfFN.exe
  C:\Windows\System\VYNbfFN.exe
  2⤵
  PID:7576
- C:\Windows\System\SDWlgZl.exe
  C:\Windows\System\SDWlgZl.exe
  2⤵
  PID:7384
- C:\Windows\System\FmNUpuj.exe
  C:\Windows\System\FmNUpuj.exe
  2⤵
  PID:7660
- C:\Windows\System\jiJLFII.exe
  C:\Windows\System\jiJLFII.exe
  2⤵
  PID:7648
- C:\Windows\System\GhQKDJu.exe
  C:\Windows\System\GhQKDJu.exe
  2⤵
  PID:7712
- C:\Windows\System\WPlrIgB.exe
  C:\Windows\System\WPlrIgB.exe
  2⤵
  PID:7676
- C:\Windows\System\EQByRpl.exe
  C:\Windows\System\EQByRpl.exe
  2⤵
  PID:7732
- C:\Windows\System\aSuErDl.exe
  C:\Windows\System\aSuErDl.exe
  2⤵
  PID:7756
- C:\Windows\System\bTutsdD.exe
  C:\Windows\System\bTutsdD.exe
  2⤵
  PID:7780
- C:\Windows\System\ZNADMMo.exe
  C:\Windows\System\ZNADMMo.exe
  2⤵
  PID:7820
- C:\Windows\System\bUkVUNC.exe
  C:\Windows\System\bUkVUNC.exe
  2⤵
  PID:7872
- C:\Windows\System\ZmpmupK.exe
  C:\Windows\System\ZmpmupK.exe
  2⤵
  PID:7864
- C:\Windows\System\kFdQQny.exe
  C:\Windows\System\kFdQQny.exe
  2⤵
  PID:7916
- C:\Windows\System\yNZhmYO.exe
  C:\Windows\System\yNZhmYO.exe
  2⤵
  PID:8016
- C:\Windows\System\fMzMolP.exe
  C:\Windows\System\fMzMolP.exe
  2⤵
  PID:8052
- C:\Windows\System\YfIsSTh.exe
  C:\Windows\System\YfIsSTh.exe
  2⤵
  PID:7248
- C:\Windows\System\DHkbCcq.exe
  C:\Windows\System\DHkbCcq.exe
  2⤵
  PID:8164
- C:\Windows\System\wSOWGIj.exe
  C:\Windows\System\wSOWGIj.exe
  2⤵
  PID:7252
- C:\Windows\System\cpXrvVZ.exe
  C:\Windows\System\cpXrvVZ.exe
  2⤵
  PID:7216
- C:\Windows\System\oYrIjmY.exe
  C:\Windows\System\oYrIjmY.exe
  2⤵
  PID:7908
- C:\Windows\System\jxIaZGb.exe
  C:\Windows\System\jxIaZGb.exe
  2⤵
  PID:6692
- C:\Windows\System\MdQQPID.exe
  C:\Windows\System\MdQQPID.exe
  2⤵
  PID:8080
- C:\Windows\System\wGYwcZn.exe
  C:\Windows\System\wGYwcZn.exe
  2⤵
  PID:7140
- C:\Windows\System\iykeKrm.exe
  C:\Windows\System\iykeKrm.exe
  2⤵
  PID:7200
- C:\Windows\System\pOXYADw.exe
  C:\Windows\System\pOXYADw.exe
  2⤵
  PID:6252
- C:\Windows\System\cCxqUyo.exe
  C:\Windows\System\cCxqUyo.exe
  2⤵
  PID:7336
- C:\Windows\System\NgSTLrq.exe
  C:\Windows\System\NgSTLrq.exe
  2⤵
  PID:7524
- C:\Windows\System\NagYaNh.exe
  C:\Windows\System\NagYaNh.exe
  2⤵
  PID:7504
- C:\Windows\System\KjPXyYN.exe
  C:\Windows\System\KjPXyYN.exe
  2⤵
  PID:7664
- C:\Windows\System\HxOfNgz.exe
  C:\Windows\System\HxOfNgz.exe
  2⤵
  PID:7444
- C:\Windows\System\GCtUpvz.exe
  C:\Windows\System\GCtUpvz.exe
  2⤵
  PID:7312
- C:\Windows\System\TuHwtYJ.exe
  C:\Windows\System\TuHwtYJ.exe
  2⤵
  PID:7952
- C:\Windows\System\gkkPjWJ.exe
  C:\Windows\System\gkkPjWJ.exe
  2⤵
  PID:7836
- C:\Windows\System\VJraWeF.exe
  C:\Windows\System\VJraWeF.exe
  2⤵
  PID:7980
- C:\Windows\System\WDYjoXE.exe
  C:\Windows\System\WDYjoXE.exe
  2⤵
  PID:7964
- C:\Windows\System\KCMpLhj.exe
  C:\Windows\System\KCMpLhj.exe
  2⤵
  PID:8048
- C:\Windows\System\MEDtqwY.exe
  C:\Windows\System\MEDtqwY.exe
  2⤵
  PID:8184
- C:\Windows\System\ACwijEC.exe
  C:\Windows\System\ACwijEC.exe
  2⤵
  PID:8136
- C:\Windows\System\YkFgOiv.exe
  C:\Windows\System\YkFgOiv.exe
  2⤵
  PID:8116
- C:\Windows\System\uZPsRfB.exe
  C:\Windows\System\uZPsRfB.exe
  2⤵
  PID:7028
- C:\Windows\System\PvbYoeH.exe
  C:\Windows\System\PvbYoeH.exe
  2⤵
  PID:7592
- C:\Windows\System\mCUoWWZ.exe
  C:\Windows\System\mCUoWWZ.exe
  2⤵
  PID:7684
- C:\Windows\System\XVrtdcu.exe
  C:\Windows\System\XVrtdcu.exe
  2⤵
  PID:7484
- C:\Windows\System\tDHGZnB.exe
  C:\Windows\System\tDHGZnB.exe
  2⤵
  PID:7572
- C:\Windows\System\cTTIrOL.exe
  C:\Windows\System\cTTIrOL.exe
  2⤵
  PID:7708
- C:\Windows\System\gqTAZTO.exe
  C:\Windows\System\gqTAZTO.exe
  2⤵
  PID:7868
- C:\Windows\System\gyBurlM.exe
  C:\Windows\System\gyBurlM.exe
  2⤵
  PID:7772
- C:\Windows\System\svLCyPw.exe
  C:\Windows\System\svLCyPw.exe
  2⤵
  PID:7848
- C:\Windows\System\jgeEqBQ.exe
  C:\Windows\System\jgeEqBQ.exe
  2⤵
  PID:7804
- C:\Windows\System\ZmSXqiV.exe
  C:\Windows\System\ZmSXqiV.exe
  2⤵
  PID:7752
- C:\Windows\System\ShpQARY.exe
  C:\Windows\System\ShpQARY.exe
  2⤵
  PID:7628
- C:\Windows\System\btoBNPE.exe
  C:\Windows\System\btoBNPE.exe
  2⤵
  PID:6892
- C:\Windows\System\GKMqtqG.exe
  C:\Windows\System\GKMqtqG.exe
  2⤵
  PID:8032
- C:\Windows\System\Wybqbon.exe
  C:\Windows\System\Wybqbon.exe
  2⤵
  PID:8036
- C:\Windows\System\FkdhgzI.exe
  C:\Windows\System\FkdhgzI.exe
  2⤵
  PID:7324
- C:\Windows\System\AbAkvBc.exe
  C:\Windows\System\AbAkvBc.exe
  2⤵
  PID:6816
- C:\Windows\System\YPCJaUw.exe
  C:\Windows\System\YPCJaUw.exe
  2⤵
  PID:8152
- C:\Windows\System\vtPrHlm.exe
  C:\Windows\System\vtPrHlm.exe
  2⤵
  PID:7332
- C:\Windows\System\xXmwbUd.exe
  C:\Windows\System\xXmwbUd.exe
  2⤵
  PID:7896
- C:\Windows\System\pEraTXv.exe
  C:\Windows\System\pEraTXv.exe
  2⤵
  PID:8208
- C:\Windows\System\LWkbiDv.exe
  C:\Windows\System\LWkbiDv.exe
  2⤵
  PID:8224
- C:\Windows\System\WltDWmT.exe
  C:\Windows\System\WltDWmT.exe
  2⤵
  PID:8240
- C:\Windows\System\xUYPiOj.exe
  C:\Windows\System\xUYPiOj.exe
  2⤵
  PID:8260
- C:\Windows\System\sXyRXXd.exe
  C:\Windows\System\sXyRXXd.exe
  2⤵
  PID:8276
- C:\Windows\System\lxehMTO.exe
  C:\Windows\System\lxehMTO.exe
  2⤵
  PID:8296
- C:\Windows\System\pfIRZSx.exe
  C:\Windows\System\pfIRZSx.exe
  2⤵
  PID:8312
- C:\Windows\System\VtBxCkH.exe
  C:\Windows\System\VtBxCkH.exe
  2⤵
  PID:8332
- C:\Windows\System\DMjhIKM.exe
  C:\Windows\System\DMjhIKM.exe
  2⤵
  PID:8348
- C:\Windows\System\YcngATJ.exe
  C:\Windows\System\YcngATJ.exe
  2⤵
  PID:8364
- C:\Windows\System\FaRLuRN.exe
  C:\Windows\System\FaRLuRN.exe
  2⤵
  PID:8448
- C:\Windows\System\mSyPXhb.exe
  C:\Windows\System\mSyPXhb.exe
  2⤵
  PID:8464
- C:\Windows\System\pIBcDOT.exe
  C:\Windows\System\pIBcDOT.exe
  2⤵
  PID:8488
- C:\Windows\System\guBPKQB.exe
  C:\Windows\System\guBPKQB.exe
  2⤵
  PID:8504
- C:\Windows\System\eEhrYDd.exe
  C:\Windows\System\eEhrYDd.exe
  2⤵
  PID:8520
- C:\Windows\System\ZNHycmj.exe
  C:\Windows\System\ZNHycmj.exe
  2⤵
  PID:8536
- C:\Windows\System\pdxpChN.exe
  C:\Windows\System\pdxpChN.exe
  2⤵
  PID:8552
- C:\Windows\System\vDvlOKL.exe
  C:\Windows\System\vDvlOKL.exe
  2⤵
  PID:8568
- C:\Windows\System\ZOrVJxO.exe
  C:\Windows\System\ZOrVJxO.exe
  2⤵
  PID:8588
- C:\Windows\System\DvcBJiX.exe
  C:\Windows\System\DvcBJiX.exe
  2⤵
  PID:8616
- C:\Windows\System\FrIOkIT.exe
  C:\Windows\System\FrIOkIT.exe
  2⤵
  PID:8632
- C:\Windows\System\NjGyKjF.exe
  C:\Windows\System\NjGyKjF.exe
  2⤵
  PID:8652
- C:\Windows\System\RveNmUe.exe
  C:\Windows\System\RveNmUe.exe
  2⤵
  PID:8668
- C:\Windows\System\prXSqaT.exe
  C:\Windows\System\prXSqaT.exe
  2⤵
  PID:8684
- C:\Windows\System\FjoZjvo.exe
  C:\Windows\System\FjoZjvo.exe
  2⤵
  PID:8732
- C:\Windows\System\lZsouLh.exe
  C:\Windows\System\lZsouLh.exe
  2⤵
  PID:8748
- C:\Windows\System\iBnPxnf.exe
  C:\Windows\System\iBnPxnf.exe
  2⤵
  PID:8764
- C:\Windows\System\cySelWi.exe
  C:\Windows\System\cySelWi.exe
  2⤵
  PID:8780
- C:\Windows\System\CYAzAVS.exe
  C:\Windows\System\CYAzAVS.exe
  2⤵
  PID:8796
- C:\Windows\System\SZwBtko.exe
  C:\Windows\System\SZwBtko.exe
  2⤵
  PID:8812
- C:\Windows\System\xDYmwFs.exe
  C:\Windows\System\xDYmwFs.exe
  2⤵
  PID:8856
- C:\Windows\System\MMFloVz.exe
  C:\Windows\System\MMFloVz.exe
  2⤵
  PID:8876
- C:\Windows\System\hZopHvs.exe
  C:\Windows\System\hZopHvs.exe
  2⤵
  PID:8896
- C:\Windows\System\tcleEgW.exe
  C:\Windows\System\tcleEgW.exe
  2⤵
  PID:8912
- C:\Windows\System\ITJrxFo.exe
  C:\Windows\System\ITJrxFo.exe
  2⤵
  PID:8928
- C:\Windows\System\knqFscX.exe
  C:\Windows\System\knqFscX.exe
  2⤵
  PID:8948
- C:\Windows\System\UNjzsaY.exe
  C:\Windows\System\UNjzsaY.exe
  2⤵
  PID:8964
- C:\Windows\System\zQtYPjb.exe
  C:\Windows\System\zQtYPjb.exe
  2⤵
  PID:8980
- C:\Windows\System\CALynXz.exe
  C:\Windows\System\CALynXz.exe
  2⤵
  PID:9012
- C:\Windows\System\iXDhDAp.exe
  C:\Windows\System\iXDhDAp.exe
  2⤵
  PID:9028
- C:\Windows\System\ZcQRXYG.exe
  C:\Windows\System\ZcQRXYG.exe
  2⤵
  PID:9044
- C:\Windows\System\jsMtxsv.exe
  C:\Windows\System\jsMtxsv.exe
  2⤵
  PID:9064
- C:\Windows\System\VIExQsL.exe
  C:\Windows\System\VIExQsL.exe
  2⤵
  PID:9088
- C:\Windows\System\ggqgQuZ.exe
  C:\Windows\System\ggqgQuZ.exe
  2⤵
  PID:9104
- C:\Windows\System\uZlefVY.exe
  C:\Windows\System\uZlefVY.exe
  2⤵
  PID:9128
- C:\Windows\System\okQsjfM.exe
  C:\Windows\System\okQsjfM.exe
  2⤵
  PID:9152
- C:\Windows\System\tCoekby.exe
  C:\Windows\System\tCoekby.exe
  2⤵
  PID:9168
- C:\Windows\System\JOPCtVZ.exe
  C:\Windows\System\JOPCtVZ.exe
  2⤵
  PID:9184
- C:\Windows\System\btvEwyO.exe
  C:\Windows\System\btvEwyO.exe
  2⤵
  PID:9208
- C:\Windows\System\hAPmdOC.exe
  C:\Windows\System\hAPmdOC.exe
  2⤵
  PID:7300
- C:\Windows\System\TffyZLm.exe
  C:\Windows\System\TffyZLm.exe
  2⤵
  PID:7728
- C:\Windows\System\caMZZbP.exe
  C:\Windows\System\caMZZbP.exe
  2⤵
  PID:7800
- C:\Windows\System\TPJsssk.exe
  C:\Windows\System\TPJsssk.exe
  2⤵
  PID:8064
- C:\Windows\System\TiwNcLF.exe
  C:\Windows\System\TiwNcLF.exe
  2⤵
  PID:8308
- C:\Windows\System\RyUrJeW.exe
  C:\Windows\System\RyUrJeW.exe
  2⤵
  PID:8380
- C:\Windows\System\UwxNFcm.exe
  C:\Windows\System\UwxNFcm.exe
  2⤵
  PID:8360
- C:\Windows\System\XIMMyHw.exe
  C:\Windows\System\XIMMyHw.exe
  2⤵
  PID:8292
- C:\Windows\System\kMoyQOY.exe
  C:\Windows\System\kMoyQOY.exe
  2⤵
  PID:8252
- C:\Windows\System\fsrvljH.exe
  C:\Windows\System\fsrvljH.exe
  2⤵
  PID:7352
- C:\Windows\System\bSTWsIt.exe
  C:\Windows\System\bSTWsIt.exe
  2⤵
  PID:7984
- C:\Windows\System\lHvvuWL.exe
  C:\Windows\System\lHvvuWL.exe
  2⤵
  PID:8388
- C:\Windows\System\EfqLoGI.exe
  C:\Windows\System\EfqLoGI.exe
  2⤵
  PID:8400
- C:\Windows\System\xLSeRvL.exe
  C:\Windows\System\xLSeRvL.exe
  2⤵
  PID:8440
- C:\Windows\System\XrSCsmd.exe
  C:\Windows\System\XrSCsmd.exe
  2⤵
  PID:8460
- C:\Windows\System\vWmPOAQ.exe
  C:\Windows\System\vWmPOAQ.exe
  2⤵
  PID:8484
- C:\Windows\System\cZHGRoO.exe
  C:\Windows\System\cZHGRoO.exe
  2⤵
  PID:8544
- C:\Windows\System\bMaYHBz.exe
  C:\Windows\System\bMaYHBz.exe
  2⤵
  PID:8576
- C:\Windows\System\aJgpikr.exe
  C:\Windows\System\aJgpikr.exe
  2⤵
  PID:8612
- C:\Windows\System\IBrRlaG.exe
  C:\Windows\System\IBrRlaG.exe
  2⤵
  PID:8624
- C:\Windows\System\CgoFHAK.exe
  C:\Windows\System\CgoFHAK.exe
  2⤵
  PID:8640
- C:\Windows\System\VhFJSbO.exe
  C:\Windows\System\VhFJSbO.exe
  2⤵
  PID:8704
- C:\Windows\System\yyUdjLA.exe
  C:\Windows\System\yyUdjLA.exe
  2⤵
  PID:8680
- C:\Windows\System\OGJhFnt.exe
  C:\Windows\System\OGJhFnt.exe
  2⤵
  PID:8720
- C:\Windows\System\bFXONlU.exe
  C:\Windows\System\bFXONlU.exe
  2⤵
  PID:8756
- C:\Windows\System\fmtVaQn.exe
  C:\Windows\System\fmtVaQn.exe
  2⤵
  PID:8892
- C:\Windows\System\wlcjgkr.exe
  C:\Windows\System\wlcjgkr.exe
  2⤵
  PID:8920
- C:\Windows\System\iiPbivy.exe
  C:\Windows\System\iiPbivy.exe
  2⤵
  PID:8988
- C:\Windows\System\mXNomCp.exe
  C:\Windows\System\mXNomCp.exe
  2⤵
  PID:9008
- C:\Windows\System\VypMMLm.exe
  C:\Windows\System\VypMMLm.exe
  2⤵
  PID:8972
- C:\Windows\System\pKYzMDZ.exe
  C:\Windows\System\pKYzMDZ.exe
  2⤵
  PID:9020
- C:\Windows\System\BlxuQrg.exe
  C:\Windows\System\BlxuQrg.exe
  2⤵
  PID:8868
- C:\Windows\System\HbcrDaJ.exe
  C:\Windows\System\HbcrDaJ.exe
  2⤵
  PID:9080
- C:\Windows\System\BpWIeyt.exe
  C:\Windows\System\BpWIeyt.exe
  2⤵
  PID:9124
- C:\Windows\System\rISVzul.exe
  C:\Windows\System\rISVzul.exe
  2⤵
  PID:9100
- C:\Windows\System\HDfVina.exe
  C:\Windows\System\HDfVina.exe
  2⤵
  PID:9164
- C:\Windows\System\MxYmaEn.exe
  C:\Windows\System\MxYmaEn.exe
  2⤵
  PID:9204
- C:\Windows\System\sCgEFRY.exe
  C:\Windows\System\sCgEFRY.exe
  2⤵
  PID:7928
- C:\Windows\System\XQHlETl.exe
  C:\Windows\System\XQHlETl.exe
  2⤵
  PID:8216
- C:\Windows\System\BGbdusH.exe
  C:\Windows\System\BGbdusH.exe
  2⤵
  PID:8284
- C:\Windows\System\oxIlXGj.exe
  C:\Windows\System\oxIlXGj.exe
  2⤵
  PID:7188
- C:\Windows\System\oZjPCyl.exe
  C:\Windows\System\oZjPCyl.exe
  2⤵
  PID:7936
- C:\Windows\System\wwtaIiY.exe
  C:\Windows\System\wwtaIiY.exe
  2⤵
  PID:8420
- C:\Windows\System\cxGQREW.exe
  C:\Windows\System\cxGQREW.exe
  2⤵
  PID:8436
- C:\Windows\System\GJWjAUz.exe
  C:\Windows\System\GJWjAUz.exe
  2⤵
  PID:8604
- C:\Windows\System\QbXDQdV.exe
  C:\Windows\System\QbXDQdV.exe
  2⤵
  PID:8516
- C:\Windows\System\ZPVnkXh.exe
  C:\Windows\System\ZPVnkXh.exe
  2⤵
  PID:8716
- C:\Windows\System\YJvBpoO.exe
  C:\Windows\System\YJvBpoO.exe
  2⤵
  PID:8512
- C:\Windows\System\RHVxfaQ.exe
  C:\Windows\System\RHVxfaQ.exe
  2⤵
  PID:8676
- C:\Windows\System\YfUagKj.exe
  C:\Windows\System\YfUagKj.exe
  2⤵
  PID:8728
- C:\Windows\System\JQoAkMq.exe
  C:\Windows\System\JQoAkMq.exe
  2⤵
  PID:8804
- C:\Windows\System\nXSfrSf.exe
  C:\Windows\System\nXSfrSf.exe
  2⤵
  PID:8824
- C:\Windows\System\lqDXkEp.exe
  C:\Windows\System\lqDXkEp.exe
  2⤵
  PID:8844
- C:\Windows\System\xnlfbRi.exe
  C:\Windows\System\xnlfbRi.exe
  2⤵
  PID:9144
- C:\Windows\System\ketYBOq.exe
  C:\Windows\System\ketYBOq.exe
  2⤵
  PID:8936
- C:\Windows\System\MTUaFbX.exe
  C:\Windows\System\MTUaFbX.exe
  2⤵
  PID:9036
- C:\Windows\System\LoEdElD.exe
  C:\Windows\System\LoEdElD.exe
  2⤵
  PID:9052
- C:\Windows\System\pzRqPzS.exe
  C:\Windows\System\pzRqPzS.exe
  2⤵
  PID:9040
- C:\Windows\System\HVknTNn.exe
  C:\Windows\System\HVknTNn.exe
  2⤵
  PID:9200
- C:\Windows\System\HgGLNdn.exe
  C:\Windows\System\HgGLNdn.exe
  2⤵
  PID:8268
- C:\Windows\System\NByqzWo.exe
  C:\Windows\System\NByqzWo.exe
  2⤵
  PID:7608
- C:\Windows\System\xWLReiA.exe
  C:\Windows\System\xWLReiA.exe
  2⤵
  PID:8344
- C:\Windows\System\UaiLUgh.exe
  C:\Windows\System\UaiLUgh.exe
  2⤵
  PID:8028
- C:\Windows\System\kvcolsG.exe
  C:\Windows\System\kvcolsG.exe
  2⤵
  PID:8428
- C:\Windows\System\UcRkurW.exe
  C:\Windows\System\UcRkurW.exe
  2⤵
  PID:8644
- C:\Windows\System\uaYpvVI.exe
  C:\Windows\System\uaYpvVI.exe
  2⤵
  PID:8944
- C:\Windows\System\IDoqoRE.exe
  C:\Windows\System\IDoqoRE.exe
  2⤵
  PID:6572
- C:\Windows\System\piJHyrh.exe
  C:\Windows\System\piJHyrh.exe
  2⤵
  PID:8712
- C:\Windows\System\PWvRwUD.exe
  C:\Windows\System\PWvRwUD.exe
  2⤵
  PID:9160
- C:\Windows\System\uVgaNUf.exe
  C:\Windows\System\uVgaNUf.exe
  2⤵
  PID:8864
- C:\Windows\System\jvsupsQ.exe
  C:\Windows\System\jvsupsQ.exe
  2⤵
  PID:7316
- C:\Windows\System\LcNRthB.exe
  C:\Windows\System\LcNRthB.exe
  2⤵
  PID:8808
- C:\Windows\System\sBziOPf.exe
  C:\Windows\System\sBziOPf.exe
  2⤵
  PID:7632
- C:\Windows\System\fwTisda.exe
  C:\Windows\System\fwTisda.exe
  2⤵
  PID:9176
- C:\Windows\System\BmPleAw.exe
  C:\Windows\System\BmPleAw.exe
  2⤵
  PID:9004
- C:\Windows\System\gOMjFMw.exe
  C:\Windows\System\gOMjFMw.exe
  2⤵
  PID:8836
- C:\Windows\System\sbeWkwe.exe
  C:\Windows\System\sbeWkwe.exe
  2⤵
  PID:8496
- C:\Windows\System\YhvwLyY.exe
  C:\Windows\System\YhvwLyY.exe
  2⤵
  PID:9096
- C:\Windows\System\qacgIFR.exe
  C:\Windows\System\qacgIFR.exe
  2⤵
  PID:8328
- C:\Windows\System\tNfxnVz.exe
  C:\Windows\System\tNfxnVz.exe
  2⤵
  PID:8792
- C:\Windows\System\QkFZTqW.exe
  C:\Windows\System\QkFZTqW.exe
  2⤵
  PID:8412
- C:\Windows\System\ikvYCIi.exe
  C:\Windows\System\ikvYCIi.exe
  2⤵
  PID:8840
- C:\Windows\System\jHoWfOB.exe
  C:\Windows\System\jHoWfOB.exe
  2⤵
  PID:8696
- C:\Windows\System\qDzhgCj.exe
  C:\Windows\System\qDzhgCj.exe
  2⤵
  PID:8776
- C:\Windows\System\yluLXEY.exe
  C:\Windows\System\yluLXEY.exe
  2⤵
  PID:8480
- C:\Windows\System\bzZmiqf.exe
  C:\Windows\System\bzZmiqf.exe
  2⤵
  PID:9060
- C:\Windows\System\BCtSXfS.exe
  C:\Windows\System\BCtSXfS.exe
  2⤵
  PID:9228
- C:\Windows\System\ENtXbku.exe
  C:\Windows\System\ENtXbku.exe
  2⤵
  PID:9244
- C:\Windows\System\FuzEFpM.exe
  C:\Windows\System\FuzEFpM.exe
  2⤵
  PID:9260
- C:\Windows\System\tnjNvjA.exe
  C:\Windows\System\tnjNvjA.exe
  2⤵
  PID:9276
- C:\Windows\System\aRSUqfh.exe
  C:\Windows\System\aRSUqfh.exe
  2⤵
  PID:9292
- C:\Windows\System\IKrOKRS.exe
  C:\Windows\System\IKrOKRS.exe
  2⤵
  PID:9308
- C:\Windows\System\SZxIjbY.exe
  C:\Windows\System\SZxIjbY.exe
  2⤵
  PID:9324
- C:\Windows\System\SXTdTEA.exe
  C:\Windows\System\SXTdTEA.exe
  2⤵
  PID:9344
- C:\Windows\System\nhEIvuP.exe
  C:\Windows\System\nhEIvuP.exe
  2⤵
  PID:9364
- C:\Windows\System\UDXaTNB.exe
  C:\Windows\System\UDXaTNB.exe
  2⤵
  PID:9384
- C:\Windows\System\AjIVsYD.exe
  C:\Windows\System\AjIVsYD.exe
  2⤵
  PID:9400
- C:\Windows\System\bsaRAWz.exe
  C:\Windows\System\bsaRAWz.exe
  2⤵
  PID:9416
- C:\Windows\System\jpwLoFx.exe
  C:\Windows\System\jpwLoFx.exe
  2⤵
  PID:9436
- C:\Windows\System\kBMTfGB.exe
  C:\Windows\System\kBMTfGB.exe
  2⤵
  PID:9456
- C:\Windows\System\yDQdNZb.exe
  C:\Windows\System\yDQdNZb.exe
  2⤵
  PID:9472
- C:\Windows\System\whyEUvA.exe
  C:\Windows\System\whyEUvA.exe
  2⤵
  PID:9488
- C:\Windows\System\nVADmur.exe
  C:\Windows\System\nVADmur.exe
  2⤵
  PID:9504
- C:\Windows\System\IrGjdhw.exe
  C:\Windows\System\IrGjdhw.exe
  2⤵
  PID:9520
- C:\Windows\System\kceQvWu.exe
  C:\Windows\System\kceQvWu.exe
  2⤵
  PID:9676
- C:\Windows\System\GfrpwLJ.exe
  C:\Windows\System\GfrpwLJ.exe
  2⤵
  PID:9692
- C:\Windows\System\fysUxGU.exe
  C:\Windows\System\fysUxGU.exe
  2⤵
  PID:9712
- C:\Windows\System\clOeetG.exe
  C:\Windows\System\clOeetG.exe
  2⤵
  PID:9728
- C:\Windows\System\WGJggjl.exe
  C:\Windows\System\WGJggjl.exe
  2⤵
  PID:9748
- C:\Windows\System\wKUTzjG.exe
  C:\Windows\System\wKUTzjG.exe
  2⤵
  PID:9768
- C:\Windows\System\HOVtkkb.exe
  C:\Windows\System\HOVtkkb.exe
  2⤵
  PID:9788
- C:\Windows\System\ofEnBcf.exe
  C:\Windows\System\ofEnBcf.exe
  2⤵
  PID:9808
- C:\Windows\System\zBpTZgS.exe
  C:\Windows\System\zBpTZgS.exe
  2⤵
  PID:9824
- C:\Windows\System\frvGDOi.exe
  C:\Windows\System\frvGDOi.exe
  2⤵
  PID:9840
- C:\Windows\System\VbKeaLD.exe
  C:\Windows\System\VbKeaLD.exe
  2⤵
  PID:9856
- C:\Windows\System\IdHGhfO.exe
  C:\Windows\System\IdHGhfO.exe
  2⤵
  PID:9872
- C:\Windows\System\PhBgHPg.exe
  C:\Windows\System\PhBgHPg.exe
  2⤵
  PID:9892
- C:\Windows\System\mYqbHFq.exe
  C:\Windows\System\mYqbHFq.exe
  2⤵
  PID:9908
- C:\Windows\System\ccCzXlQ.exe
  C:\Windows\System\ccCzXlQ.exe
  2⤵
  PID:9928
- C:\Windows\System\GPWVUlO.exe
  C:\Windows\System\GPWVUlO.exe
  2⤵
  PID:9948
- C:\Windows\System\hWbZqvf.exe
  C:\Windows\System\hWbZqvf.exe
  2⤵
  PID:9964
- C:\Windows\System\JvqNDVk.exe
  C:\Windows\System\JvqNDVk.exe
  2⤵
  PID:9992
- C:\Windows\System\LMDPADm.exe
  C:\Windows\System\LMDPADm.exe
  2⤵
  PID:10048
- C:\Windows\System\PClxWxL.exe
  C:\Windows\System\PClxWxL.exe
  2⤵
  PID:10064
- C:\Windows\System\KkRmhtS.exe
  C:\Windows\System\KkRmhtS.exe
  2⤵
  PID:10080
- C:\Windows\System\eMxbnZa.exe
  C:\Windows\System\eMxbnZa.exe
  2⤵
  PID:10136
- C:\Windows\System\cBbIMzi.exe
  C:\Windows\System\cBbIMzi.exe
  2⤵
  PID:10152
- C:\Windows\System\xnCHHlw.exe
  C:\Windows\System\xnCHHlw.exe
  2⤵
  PID:10168
- C:\Windows\System\IkSKDhH.exe
  C:\Windows\System\IkSKDhH.exe
  2⤵
  PID:10188
- C:\Windows\System\lGOMyjB.exe
  C:\Windows\System\lGOMyjB.exe
  2⤵
  PID:10204
- C:\Windows\System\ghxheOs.exe
  C:\Windows\System\ghxheOs.exe
  2⤵
  PID:10224
- C:\Windows\System\ooIWbzP.exe
  C:\Windows\System\ooIWbzP.exe
  2⤵
  PID:9240
- C:\Windows\System\fHvuNsZ.exe
  C:\Windows\System\fHvuNsZ.exe
  2⤵
  PID:9304
- C:\Windows\System\FXiuMaA.exe
  C:\Windows\System\FXiuMaA.exe
  2⤵
  PID:8232
- C:\Windows\System\UxZyddD.exe
  C:\Windows\System\UxZyddD.exe
  2⤵
  PID:8772
- C:\Windows\System\KirwmHS.exe
  C:\Windows\System\KirwmHS.exe
  2⤵
  PID:9340
- C:\Windows\System\NBZWIyS.exe
  C:\Windows\System\NBZWIyS.exe
  2⤵
  PID:9376
- C:\Windows\System\nMnsFeE.exe
  C:\Windows\System\nMnsFeE.exe
  2⤵
  PID:9320
- C:\Windows\System\OnGSNPJ.exe
  C:\Windows\System\OnGSNPJ.exe
  2⤵
  PID:9448
- C:\Windows\System\xAoOMXV.exe
  C:\Windows\System\xAoOMXV.exe
  2⤵
  PID:9360
- C:\Windows\System\HhLkNUv.exe
  C:\Windows\System\HhLkNUv.exe
  2⤵
  PID:9464
- C:\Windows\System\lFQrMSB.exe
  C:\Windows\System\lFQrMSB.exe
  2⤵
  PID:9532
- C:\Windows\System\nohmoex.exe
  C:\Windows\System\nohmoex.exe
  2⤵
  PID:9484
- C:\Windows\System\ypDmdhV.exe
  C:\Windows\System\ypDmdhV.exe
  2⤵
  PID:9544
- C:\Windows\System\ZWFIhpD.exe
  C:\Windows\System\ZWFIhpD.exe
  2⤵
  PID:9568
- C:\Windows\System\GBBZPNP.exe
  C:\Windows\System\GBBZPNP.exe
  2⤵
  PID:9580
- C:\Windows\System\bnIBpiF.exe
  C:\Windows\System\bnIBpiF.exe
  2⤵
  PID:9608
- C:\Windows\System\VsWAafV.exe
  C:\Windows\System\VsWAafV.exe
  2⤵
  PID:9684
- C:\Windows\System\GudgNPd.exe
  C:\Windows\System\GudgNPd.exe
  2⤵
  PID:9756
- C:\Windows\System\WIPGemh.exe
  C:\Windows\System\WIPGemh.exe
  2⤵
  PID:9800
- C:\Windows\System\xmFnqhQ.exe
  C:\Windows\System\xmFnqhQ.exe
  2⤵
  PID:9864
- C:\Windows\System\PuUAjfV.exe
  C:\Windows\System\PuUAjfV.exe
  2⤵
  PID:9936
- C:\Windows\System\XHRaxhV.exe
  C:\Windows\System\XHRaxhV.exe
  2⤵
  PID:9976
- C:\Windows\System\vWcnjtn.exe
  C:\Windows\System\vWcnjtn.exe
  2⤵
  PID:9668
- C:\Windows\System\vqBgZZq.exe
  C:\Windows\System\vqBgZZq.exe
  2⤵
  PID:9736
- C:\Windows\System\gCFOUoO.exe
  C:\Windows\System\gCFOUoO.exe
  2⤵
  PID:9880
- C:\Windows\System\voCpVnK.exe
  C:\Windows\System\voCpVnK.exe
  2⤵
  PID:9924
- C:\Windows\System\hbkxCaz.exe
  C:\Windows\System\hbkxCaz.exe
  2⤵
  PID:9744
- C:\Windows\System\yIequOC.exe
  C:\Windows\System\yIequOC.exe
  2⤵
  PID:9988
- C:\Windows\System\fBNfoZg.exe
  C:\Windows\System\fBNfoZg.exe
  2⤵
  PID:10016
- C:\Windows\System\bauPVqu.exe
  C:\Windows\System\bauPVqu.exe
  2⤵
  PID:10032
- C:\Windows\System\eoGkAFf.exe
  C:\Windows\System\eoGkAFf.exe
  2⤵
  PID:10036
- C:\Windows\System\ykbAGwd.exe
  C:\Windows\System\ykbAGwd.exe
  2⤵
  PID:10092
- C:\Windows\System\urleIrd.exe
  C:\Windows\System\urleIrd.exe
  2⤵
  PID:10124
- C:\Windows\System\oPUiVZW.exe
  C:\Windows\System\oPUiVZW.exe
  2⤵
  PID:10144
- C:\Windows\System\ibefDyc.exe
  C:\Windows\System\ibefDyc.exe
  2⤵
  PID:10176
- C:\Windows\System\pkNagaq.exe
  C:\Windows\System\pkNagaq.exe
  2⤵
  PID:10196
- C:\Windows\System\QJKfTMf.exe
  C:\Windows\System\QJKfTMf.exe
  2⤵
  PID:8724
- C:\Windows\System\SiPSvLi.exe
  C:\Windows\System\SiPSvLi.exe
  2⤵
  PID:10220
- C:\Windows\System\gCUWXcg.exe
  C:\Windows\System\gCUWXcg.exe
  2⤵
  PID:9300
- C:\Windows\System\mRZEvET.exe
  C:\Windows\System\mRZEvET.exe
  2⤵
  PID:8560
- C:\Windows\System\SpKHbGA.exe
  C:\Windows\System\SpKHbGA.exe
  2⤵
  PID:9528
- C:\Windows\System\BAojudp.exe
  C:\Windows\System\BAojudp.exe
  2⤵
  PID:9468
- C:\Windows\System\OITUmdo.exe
  C:\Windows\System\OITUmdo.exe
  2⤵
  PID:9572
- C:\Windows\System\eDPzkVC.exe
  C:\Windows\System\eDPzkVC.exe
  2⤵
  PID:9624
- C:\Windows\System\HiZjiLu.exe
  C:\Windows\System\HiZjiLu.exe
  2⤵
  PID:9620
- C:\Windows\System\vnbyGsx.exe
  C:\Windows\System\vnbyGsx.exe
  2⤵
  PID:9600
- C:\Windows\System\ulElhRW.exe
  C:\Windows\System\ulElhRW.exe
  2⤵
  PID:10000
- C:\Windows\System\JLNCZFT.exe
  C:\Windows\System\JLNCZFT.exe
  2⤵
  PID:9720
- C:\Windows\System\idreTQu.exe
  C:\Windows\System\idreTQu.exe
  2⤵
  PID:10108
- C:\Windows\System\hAwbgij.exe
  C:\Windows\System\hAwbgij.exe
  2⤵
  PID:9944
- C:\Windows\System\MluYjpO.exe
  C:\Windows\System\MluYjpO.exe
  2⤵
  PID:9512
- C:\Windows\System\ZRZWhNG.exe
  C:\Windows\System\ZRZWhNG.exe
  2⤵
  PID:9656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKOMOjX.exe

Filesize
1.8MB

MD5
1da00b7886340239f8d128c73b9440fe

SHA1
aabac9d7234872c3a83cfd2b1d2d394f76c243ea

SHA256
39c5e81c707098650762b31c3fa0dfec4d76d1412c4979220e8d8b6bb487d48b

SHA512
6a2aa67ea29f26c9d21dce591a2c32341600847a3347707dfd595f33a10b31ab3d30bd4bca8793c00d2b3b46727c2f6accfae5887ce119ae5f56d605a0b25987

Download Submit
C:\Windows\system\AvsPDEL.exe

Filesize
1.8MB

MD5
532e200815b5ec4d80b7531e719899da

SHA1
c736dd5f77709569a2361d68985d05bfbf5e7f9b

SHA256
6bd995d2b5796426583df56e0fae7083d65ca9db5c523b7a669881ecdb7eed3c

SHA512
6cb928046842251eadb2ff3eca0b894be325ecb81d6d180c5b24e4488cb2574ddb356ebe7ec1b44f4e9389a76f6afcbe251eb9a5665d4819486a0eb7ce2cd151

Download Submit
C:\Windows\system\CFOmEGM.exe

Filesize
1.8MB

MD5
6c845fb00db8955b49498db60652aece

SHA1
50cc79451b9bf9896ee2fb60db9cef5f651a84a8

SHA256
d9685b3c4e588947d4ccc258d25dc2ccbb75095d9d8a5c63b965c00ef7d7b58e

SHA512
661603bb52c600ee19741b5a072f2cf1eaa90a8906f3f2c2cb6c136a5a478026660f213e47c68db675cd8930825c9390efe0fc57014c218443582c8bbed3bb98

Download Submit
C:\Windows\system\CzCIzrf.exe

Filesize
1.8MB

MD5
b7e6c1a2d44bde74ab7314e77d449413

SHA1
4b2278bfbc018bf0019af796f515bb15517bc2d8

SHA256
21526c231be7aad1c094eac86b8b5966b3a61d6caa07a97b8ef74d769b6eb1ee

SHA512
0ea81c4a83e9dfd459066abd7b236d5d66c4060e79ff8b1e1d1f7eab644b0a24737db39583442f52f3265b4ac983b043db9064fa2bc81cb8fe46462c3342a66b

Download Submit
C:\Windows\system\GwxTmjn.exe

Filesize
1.8MB

MD5
64d6828cb3995c8b2a149e277d3f587d

SHA1
78de5d677c73ad4e8d50e3dd57aef82293c66621

SHA256
b112b2eaebabcf3d83a137ca510186564681c288360afd0200fd2eee64540af0

SHA512
660f991727c05ca41799862c570663cd05826481cde2f36522f935f2ab653700b72cfa999ca81128f30378f51937ab03b1810eb281ac70f72cbe3e62bee4f2ff

Download Submit
C:\Windows\system\HEVZLHZ.exe

Filesize
1.8MB

MD5
14c0b2d403e12368639468680519d491

SHA1
5618c42a310d36436b5b5b60f9b5543495eab1f7

SHA256
f14ca3f6232f1236186f58a1ccd7a0b020f2d0298417a68cfe465dfb97481a60

SHA512
fc0c2c692fa2374d693c61520723207631d1b9d2775e15a2313da8b5934359b3251f168a857bc76d5fcf3ee149a0a32b5623dabafb6a76a042c630c318ca551d

Download Submit
C:\Windows\system\ITxTFfx.exe

Filesize
1.8MB

MD5
4eaef9bf6e0607b60ae6b443a180e89a

SHA1
f9eea3c551791b0d0971cc57f7437c5695dcf6b4

SHA256
f3f4fcb9e63d0cf658959dfa219c62bdcf58a300b5eb709482bc6e48af69d728

SHA512
22a5aa10977e9da1447fcb3b686825f73d703fe150aedcad82314404474ee190a01e1d20426881d9cc37b591399000f1c9a5ea8c947fa5e4e04bbd4bb042a8c9

Download Submit
C:\Windows\system\ImahNVd.exe

Filesize
1.8MB

MD5
eeec080fd3a981a89cb27be4b87bf825

SHA1
007142fc40c860238f529edbaae3f842fd2e7369

SHA256
bf5337da8cfe6dff6a92ca035641d210ad04dd22a91a290704c5d148bae7defa

SHA512
ae7048596fccbf44bd1de40a434412033b255174d20c25bc103e60676fcf92c65ad6f475d0875e8fb1113b9583b0d817e0fab88db24b6939458480182741cd5f

Download Submit
C:\Windows\system\MNfSKqQ.exe

Filesize
1.8MB

MD5
3a126e61b23cbbf730af16335969e49d

SHA1
0425d9745ab99bdf6e29b4a8a692bf9c615ec968

SHA256
c013770916cda7e02b80cc881d82e1e277b762d7845638a29e51ac085dd4ab5f

SHA512
29990cc73eeaa986634f745c859dcf20f7221b7eefb46264ef72fef35ed1651e943e9de72bdac1c9626376673cc592e5d29579446a3de16ed734542c5bfe5802

Download Submit
C:\Windows\system\TVJRPVp.exe

Filesize
1.8MB

MD5
8ae1e2c9be625e3f50541238c53e7e7f

SHA1
ed5a69668c52b06aabf377121aa637a8c9bd9529

SHA256
a67673ce36200c324b0f90c48ef03b3830150a90bc713f26912fb30f619aa1b7

SHA512
629ba292f6dc05219e72189c41e72cff0142cdfec9227be322bb358a8f240ba099c3ed84d0f0104c6853e6724cc63c4b9f095419565685f1e55292a032d95907

Download Submit
C:\Windows\system\TiLfoAQ.exe

Filesize
1.8MB

MD5
4f5da2299b1d45d0d78078863a4a483e

SHA1
492d87af0e8d8bca40988e71160953fa4a3cdf7a

SHA256
ca68fe4c4605d3ff96cf19edc137e978ed8b12225b6eb8c1304c00d613c7bded

SHA512
0a22583ffa2319e7e801dce3169a2282480c2aa3fdfcc3363ca388c70c0a008e996d0415c802a520ebe9663615547f8c1d8857cbf153e9d6880961fd1d0d7938

Download Submit
C:\Windows\system\UNCuVtn.exe

Filesize
1.8MB

MD5
0d4c50b0f53126d5c30df07ce3f8eca7

SHA1
3afccf794d449f8ada6e9093f5c1568132efe23f

SHA256
187eac8a4dde5fe3c7d22698da31fd7af8a6e008e3e9468b682834973a668bc1

SHA512
9a403dbdfccabf6edc003db901b543e8f81f272cb8b51d886f7951d447b78c861e051f7d9a7373582be313e06a91bf9245270c2da9e9d43c26c54da6bbc251a8

Download Submit
C:\Windows\system\XUndqcA.exe

Filesize
1.8MB

MD5
457050f169bfd83fefd358e992f94787

SHA1
69ea9687d8337b4f5d929d38a45b29b207880d46

SHA256
a35fc5a89090f53a4a0f310cffee3a369f65ab9d2a80e42af4bb86c7b3b9d9a2

SHA512
bb6882f82cf92b5f394c0cf1f271e52eccfbe153dd0ac50f909324b00752efb6a852b0fb10d3762dfd2f3af9ca4d4a476f225b16e11349450e8b78ec2519e269

Download Submit
C:\Windows\system\YMYZmKD.exe

Filesize
1.8MB

MD5
452d84cd1c585d15429b4f78c6f8f97f

SHA1
80a56b6fc9addef06d96008f596898f5697446c0

SHA256
83c61874dabb020c5f0828eecbd410d6154e5b24d4156d0bc988de0319b1f366

SHA512
33d4e57475fbbbce62a82191239f702d59845b8fff5d1bc719802bcb4e05a0eb1d2aaa6ab942aee7dae23be155b8662ffdf5a0cc9e9470720c65cfc81f1666c3

Download Submit
C:\Windows\system\hdsnJaK.exe

Filesize
1.8MB

MD5
8057fac492e9ad97a16e945b13bcf147

SHA1
137188cab3cc794d361928f560021e449c36c430

SHA256
acad07fd911c369e21a2b622316e51197c31cce9cec21ae3b5d46b7d2dc5eafe

SHA512
f4d5bcf6e9d8c78ca954ce8423e091c47312bf4fe47985cfd7aae0a13b426bb3bccd531266061551e6bcff48f8bb105da7d526afe1a51089e88813028299724f

Download Submit
C:\Windows\system\lXzrRry.exe

Filesize
1.8MB

MD5
94a1d7e9f554f3db018e8e573b82503e

SHA1
12e2485f92ff5f0bec7707b6a8c09b7bbc867132

SHA256
f5be03864dac648a4a6acb16e6aea6a256ded20529089df46b25df9749d7bff3

SHA512
c2d4e1a706694686a2daa61311f48032fa6ced8a329cd77161a3512fe908dab60390b799dbbcbc12ec2f2c05db575fdad87e55320c21386522502e59cb5acce5

Download Submit
C:\Windows\system\lbdCDAy.exe

Filesize
1.8MB

MD5
5d6f6a5f13e16f9c138ac8948d4c54c3

SHA1
fd0fe57e1b125cf14de533784032817ec3be2514

SHA256
7d346ef2911dbbfad6c5206b85746d54b889bae26f272b54faa52ed0325013b8

SHA512
0d92334879df6d8b218cf966ac0e9417875dd453d306b6b0ea407d049097f2ad97d7965c4e96d5b3e11d32bc98646b1f76d111df9421083e45fc3383a80e14c9

Download Submit
C:\Windows\system\leHWFJx.exe

Filesize
1.8MB

MD5
9b8b8fc4e6b4bc4c4da67f2cf8950a27

SHA1
c30af28f0279a48b7056d58ba430b545c3109d3e

SHA256
1d1d61c6f174a71a55aa649413638d50e5c7c73f658d397b51fd1641d2250580

SHA512
e0099049e2addf50534df85b80503846debce68e4216cb8ac2489e4005f4a5e03fb0d1017810f20c747f26f64b0da75dac72ce3c3b772587115c0ed6655c1515

Download Submit
C:\Windows\system\mFlnkQY.exe

Filesize
1.8MB

MD5
755f77fad4bb46f169b0a9e6c9a5d0a0

SHA1
a912ad47b41525a8a0a37e810dd4f1b1d0d607f9

SHA256
5c5e60988f1aeb76b37a79e9e7e782789cca3a5dd31687aff09ba238f0a75a7d

SHA512
646a0a83f646f7e825b197d5f654030fbf791cc0ea7637757fbd4c6db6ce106f3f74ca9b6dd7e32f07bc78284e4ac73fe406ea41fadf068a3e10d30901897e3d

Download Submit
C:\Windows\system\nGrErDX.exe

Filesize
1.8MB

MD5
8565e8133574f11a6bcb8e060ee93e0d

SHA1
d6c8d564357f42c86d86ee42587977cd596c333f

SHA256
3b0200c67a8093731bc9f89ad1ac969520bc3b4bf3f8077d428c19ce7dbb16b6

SHA512
dc44bd7abab0a697ef2cff78daf9e3fb171abe5face575eb16f7b34da9a65789cf94374b208e453f0e58b7a26e1eba41af55258ef6ca737053a3f8562ec9573a

Download Submit
C:\Windows\system\oAmOryv.exe

Filesize
1.8MB

MD5
1514bb499a79eebeb691fbbb6c034456

SHA1
93bf5516adc23bf9be19e56e5f3199cf114b9c37

SHA256
2a1e4b696f4c644afb298565ce7221b6ec29e241de6e369d5e12486cdfe7cfc5

SHA512
76ff9d6004b5e380d8303a04a0048f92740bd49c038459f4a8eed8f81c5d93c8aea3291a98662bacd6307dbc9348633ea4803811207588a2727ab0683256620c

Download Submit
C:\Windows\system\oUoqDhX.exe

Filesize
1.8MB

MD5
78b0aeb2f44d578d003409ad92274ae6

SHA1
6ff52b746a7c3c6d083b6dae6b126fbf137cf6db

SHA256
7c65fe688e332cf84bd0a56bfa7e4e0d2649b30e7943d6fa8b80c7f8e44ff0d6

SHA512
28081a3f9f5ffd9d8e0afd859f4cd9b5e5cff48fe2e095e9434d69e3333df1be51ed4abb57d5afa677adcb77f34f74a1bde68d2a7bad395a4d147e890a93f72e

Download Submit
C:\Windows\system\pUTNYXx.exe

Filesize
1.8MB

MD5
ead31d8950d82da3f5d4bd46f1108f01

SHA1
2b0e96bb783d324ac280ec0a93b9c9d0153a7b8a

SHA256
d1310a262b4d3e2e3ba259042967927ec6004eaf7a6b72286473ab752bb8b79e

SHA512
30f55759e803623e8cff3d79191336f141fb32724f2db3c906c5e34c88afa740f9a628ba6aef5e21590e4f97531dec8401f49379642eaf6914f1bb7237392ef4

Download Submit
C:\Windows\system\qsdgwFb.exe

Filesize
1.8MB

MD5
090af8f44028d7c68f690a7357748210

SHA1
3f3d0701312d53d0d07fce8bf3435de9b026259d

SHA256
9213b81e77b43ef8a60ba7e60d94d5391a35e546788a994e8f3559e5ec4732ae

SHA512
41509ba22bce7e50782285a5278fdb7f1506d104c8d83d52c1f06cfee68063da74622f9a599ec5e754ad7424aeee08aee5bea4e839b252ce5c1d69801ed3ff37

Download Submit
C:\Windows\system\rBLiwFf.exe

Filesize
1.8MB

MD5
85438ec71ea2106f4d26de6df549c0d3

SHA1
26acee586919e992ecff73cfd21c13401cd64617

SHA256
dfdfc0b549c66ee7e74a3fa0d9a49f687588018a414f8211b90999cf856ff0b6

SHA512
38581492e51d5608494e0b21932dd3b41db2cef42fcc4138c9fbae8945a09066d46d56f26ed17a0f85d5f6a772360b4ecb5d95e23368e9c949e4421d0c8525c5

Download Submit
C:\Windows\system\rHDVcpA.exe

Filesize
1.8MB

MD5
8be6c7f83ec20cfc2b560e31373cea00

SHA1
6b2a2700058f92569fe27befa4727a44afa40056

SHA256
8efabb97e9725bd4ae9d4c528a33ca7e6054ad819c6026201a65519dc1895fb2

SHA512
df0d641896530c496f11c126906b64f731a52444fdc9822d5825d04d4be7a11c1b9a755636e3fd3dc00ca89c65cb039c6e92815998decdfedad8df317b567410

Download Submit
C:\Windows\system\rMoayKj.exe

Filesize
1.8MB

MD5
5a84d9268b4fc921c7ae08767267e7af

SHA1
8459248fa1dbf6eb220cde17369bade12cc5a78a

SHA256
79e38c662988cb7ecd83a165ea4820a8d4333f3cc694dd04ec7ff044b6a86da1

SHA512
31f86c8645239aea05486670372623cacc52b616302de5d046ddc30f8dd4835b30dda8e5ab5a68c0320e4140c5950790d908b33ec843515cd55ea869a49d9867

Download Submit
C:\Windows\system\rOpwTHJ.exe

Filesize
1.8MB

MD5
8266fbad5b7a3d420885761e353f9ec0

SHA1
209a10f685fc14fc592adfaa7f640ffca2b6c9a6

SHA256
6623385de7b8dbe95f0ab7345d4a59130ccbe8e39f9354217c6933cf9d92c7f0

SHA512
a50901c5472936b32765850981fcc26bdd74798ceacefe11c8ba61f3a1a011388b428f363c1af1642a8401de14b19bd8bfd78ee9de8c843fa4e0805c4e843a72

Download Submit
C:\Windows\system\uLjjLHz.exe

Filesize
1.8MB

MD5
04f4140b3d4405b9999856ffe8de8758

SHA1
a871d8293b336b017ff1d59f01a50594aa8fe46b

SHA256
ac2124097466195b6af5b163160b0a75fb33edd7e9ac6e748b6d66e8e17a0b12

SHA512
7504a1069c4b29ae026da68f483cd42e99fd93fe321190e8bd2f30b82c1443da573cf0085a22d72db780d3171a9b7d57c6856c83158de41554dcb5c6c5181d51

Download Submit
\Windows\system\FJVXFMY.exe

Filesize
1.8MB

MD5
e167a982f01d54581088977dc14f15c8

SHA1
97411eeb0ad99ea15d2cce305d37724f10edd292

SHA256
41ef6920ea7f7c2cbb6158e5a21a67247b1ae36aa93cb779de94978c1c18bf1f

SHA512
e3b95d008ec4088066862cb84d4b201fe268c96c546c7770697cbf85fd5525bc1a55349f14aec618dfb283fdbe2aba270cca7c5a5f1fb94667ae22afb84ccaa4

Download Submit
\Windows\system\agBluqF.exe

Filesize
1.8MB

MD5
e75363da1aa40b6be5bbce48552312a5

SHA1
fd1a347033279d73e5bddc18a0e9cbd6fedc3771

SHA256
5a6277122ea35a6aca03c13eb581364f0f64744ae3477a6cfeff2e49e24d71ad

SHA512
1766b99760f369130e1c6617c447dbe0bf536e9292c0d7bdbedd980c11ad983c4d88eb1eecb069fc4c9e7a744438c702d5168ef5bfe95ae6f7f4895aa0d19a97

Download Submit
\Windows\system\enhWriL.exe

Filesize
1.8MB

MD5
794fb9769957f23f68fd668097a817f1

SHA1
8a91422a836d8d934baf1a257117136f650d6d05

SHA256
d73dbd5d223434a26db3ba9fadbe2178e609d929cd76a1929add4383c76dc2ba

SHA512
d41c19507027ba36788f83d1cd2d06dbca5c2af03518e087265a4dc8f2ebacb024ffabed2216e607d25948bb7c155d59039ad1da2d6fd9e9d9734d3fb484f144

Download Submit
memory/572-47-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/572-4080-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/572-359-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/1740-4081-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/1740-2636-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/1740-87-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/1940-2117-0x000000013F7A0000-0x000000013FAF1000-memory.dmp

Filesize
3.3MB

Download
memory/1940-4076-0x000000013F7A0000-0x000000013FAF1000-memory.dmp

Filesize
3.3MB

Download
memory/1940-75-0x000000013F7A0000-0x000000013FAF1000-memory.dmp

Filesize
3.3MB

Download
memory/2096-29-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2096-3850-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2120-26-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2120-3949-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2136-59-0x000000013FA70000-0x000000013FDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2136-37-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2136-80-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2136-86-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/2136-7-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2136-69-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-68-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-3072-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2136-54-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-93-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2801-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2136-22-0x000000013F1B0000-0x000000013F501000-memory.dmp

Filesize
3.3MB

Download
memory/2136-52-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2633-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/2136-48-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-96-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2501-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2111-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-675-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-0-0x000000013FA70000-0x000000013FDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2136-1579-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-1843-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2136-13-0x0000000001EF0000-0x0000000002241000-memory.dmp

Filesize
3.3MB

Download
memory/2188-4073-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2188-94-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2188-2803-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2396-27-0x000000013FA00000-0x000000013FD51000-memory.dmp

Filesize
3.3MB

Download
memory/2396-3863-0x000000013FA00000-0x000000013FD51000-memory.dmp

Filesize
3.3MB

Download
memory/2404-3867-0x000000013F1B0000-0x000000013F501000-memory.dmp

Filesize
3.3MB

Download
memory/2404-24-0x000000013F1B0000-0x000000013F501000-memory.dmp

Filesize
3.3MB

Download
memory/2404-92-0x000000013F1B0000-0x000000013F501000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2503-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4074-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-81-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2636-1845-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4075-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2636-70-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2752-3859-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2752-51-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2772-1580-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2772-3924-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2772-61-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2828-1578-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2828-60-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2828-4082-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/3056-3872-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/3056-53-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download