xmrig | cb67e0fb2600a3c61a6d68bba6ecd2fd68043f9dc070950821e64ea90afddc81

Analysis

max time kernel
79s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
Size

1.9MB
MD5

fcbf40e3d4e890ac419f4a3c31a0cb80
SHA1

7f06f436db5bc014af160f4da94158d83439d8ec
SHA256

cb67e0fb2600a3c61a6d68bba6ecd2fd68043f9dc070950821e64ea90afddc81
SHA512

3006afa619ee2ecc8bd860dfb9621e5212d41048853ad5f6a4f2409190ddb3c630f8a83f44b30ffb40bf10ef212a648f0750c1d8fb9ad96e74ebbf1ff03644c3
SSDEEP

49152:ROdWCCi7/raU56uL3pgrCEdMKPFoTzDRcs:RWWBib356utgpPFoR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/memory/2852-19-0x000000013F2E0000-0x000000013F631000-memory.dmp	xmrig
behavioral1/memory/2708-21-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2852-82-0x000000013F2E0000-0x000000013F631000-memory.dmp	xmrig
behavioral1/memory/2804-108-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/1868-107-0x000000013F560000-0x000000013F8B1000-memory.dmp	xmrig
behavioral1/memory/2412-97-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2776-80-0x000000013F340000-0x000000013F691000-memory.dmp	xmrig
behavioral1/memory/2712-79-0x000000013FB20000-0x000000013FE71000-memory.dmp	xmrig
behavioral1/memory/2776-74-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2632-58-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2004-50-0x000000013FD50000-0x00000001400A1000-memory.dmp	xmrig
behavioral1/memory/2628-48-0x000000013FDD0000-0x0000000140121000-memory.dmp	xmrig
behavioral1/memory/2712-17-0x000000013FB20000-0x000000013FE71000-memory.dmp	xmrig
behavioral1/memory/572-1363-0x000000013F720000-0x000000013FA71000-memory.dmp	xmrig
behavioral1/memory/1492-2093-0x000000013F740000-0x000000013FA91000-memory.dmp	xmrig
behavioral1/memory/1508-3447-0x000000013F1D0000-0x000000013F521000-memory.dmp	xmrig
behavioral1/memory/2776-4242-0x000000013F340000-0x000000013F691000-memory.dmp	xmrig
behavioral1/memory/2128-4266-0x000000013F340000-0x000000013F691000-memory.dmp	xmrig
behavioral1/memory/2712-4274-0x000000013FB20000-0x000000013FE71000-memory.dmp	xmrig
behavioral1/memory/2708-4273-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2852-4272-0x000000013F2E0000-0x000000013F631000-memory.dmp	xmrig
behavioral1/memory/2804-4280-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/2412-4279-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2004-4277-0x000000013FD50000-0x00000001400A1000-memory.dmp	xmrig
behavioral1/memory/2628-4283-0x000000013FDD0000-0x0000000140121000-memory.dmp	xmrig
behavioral1/memory/2632-4284-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/572-4288-0x000000013F720000-0x000000013FA71000-memory.dmp	xmrig
behavioral1/memory/2128-4287-0x000000013F340000-0x000000013F691000-memory.dmp	xmrig
behavioral1/memory/1508-4294-0x000000013F1D0000-0x000000013F521000-memory.dmp	xmrig
behavioral1/memory/1492-4293-0x000000013F740000-0x000000013FA91000-memory.dmp	xmrig
behavioral1/memory/2168-4292-0x000000013F580000-0x000000013F8D1000-memory.dmp	xmrig
behavioral1/memory/1868-4296-0x000000013F560000-0x000000013F8B1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2712	qdWztMP.exe
2852	rEjkczR.exe
2708	sRCUuTl.exe
2412	rjZJyYR.exe
2804	mTVgUoq.exe
2628	xPVjFIb.exe
2004	kqtneJX.exe
2632	XEqFmtH.exe
572	TpCdkhd.exe
1492	ZFMmqoK.exe
1508	THxyNSN.exe
2128	ExnZTUm.exe
2168	wEUUSVD.exe
1868	gaPswMP.exe
2248	shTuQWy.exe
2880	zGfOCBU.exe
3048	JgXARBM.exe
2424	svypVId.exe
1308	FmoGsKl.exe
2488	AWCYXDg.exe
2352	xykdjRH.exe
2184	TXquKoc.exe
1324	tHmuImD.exe
1428	WOkdeVT.exe
1564	DMoCLOG.exe
1996	SNHraVg.exe
2180	BhzzAWa.exe
864	tesfEaY.exe
560	EHjdSsu.exe
1656	ralRjhY.exe
820	ZDBdPZg.exe
444	UOlxYST.exe
2348	DGmShfs.exe
2392	RgbvBCT.exe
720	fbLzMCW.exe
1292	IXzzmrM.exe
964	qeTgqZr.exe
1376	SQwCRVf.exe
952	ejLffXW.exe
3068	NGlpNTT.exe
2236	InhvrJp.exe
1048	AhRvZnr.exe
340	JqvghGI.exe
1688	DmJAozd.exe
2280	vMIfIZY.exe
1488	xIcdWxk.exe
1856	QimZlVL.exe
1496	LxyxInu.exe
2388	xHyhFWf.exe
2528	VicMWGE.exe
1604	UjzytMk.exe
1580	UNkBLlu.exe
2140	fZHPcmJ.exe
2744	NxCCAJk.exe
2620	uqHehzl.exe
3020	PegItKY.exe
2656	dcUfIxO.exe
2848	esRPKjU.exe
1484	UKDcWKB.exe
2820	ECFWBec.exe
1300	QlSFOUm.exe
2896	XtlYEge.exe
2192	yNzqZAK.exe
1864	eaJhsss.exe

Loads dropped DLL 64 IoCs

pid	Process
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-0-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/files/0x000a000000012029-3.dat	upx
behavioral1/files/0x000f000000015dac-8.dat	upx
behavioral1/memory/2852-19-0x000000013F2E0000-0x000000013F631000-memory.dmp	upx
behavioral1/memory/2708-21-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0008000000015dca-26.dat	upx
behavioral1/files/0x0008000000015e46-29.dat	upx
behavioral1/files/0x0008000000016148-62.dat	upx
behavioral1/memory/572-63-0x000000013F720000-0x000000013FA71000-memory.dmp	upx
behavioral1/files/0x0006000000018d87-66.dat	upx
behavioral1/memory/1492-69-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/memory/2852-82-0x000000013F2E0000-0x000000013F631000-memory.dmp	upx
behavioral1/files/0x0005000000019246-119.dat	upx
behavioral1/files/0x000500000001925b-135.dat	upx
behavioral1/files/0x00050000000193a2-171.dat	upx
behavioral1/files/0x00050000000193c3-175.dat	upx
behavioral1/files/0x0005000000019394-167.dat	upx
behavioral1/files/0x0005000000019368-156.dat	upx
behavioral1/files/0x0005000000019346-149.dat	upx
behavioral1/files/0x0005000000019385-162.dat	upx
behavioral1/files/0x0005000000019358-155.dat	upx
behavioral1/files/0x00050000000192fe-143.dat	upx
behavioral1/files/0x0005000000019309-147.dat	upx
behavioral1/files/0x0005000000019272-139.dat	upx
behavioral1/files/0x0005000000019256-131.dat	upx
behavioral1/files/0x0005000000019253-127.dat	upx
behavioral1/files/0x0005000000019249-123.dat	upx
behavioral1/files/0x0031000000015d98-115.dat	upx
behavioral1/files/0x000500000001923a-112.dat	upx
behavioral1/memory/2804-108-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/1868-107-0x000000013F560000-0x000000013F8B1000-memory.dmp	upx
behavioral1/memory/2128-83-0x000000013F340000-0x000000013F691000-memory.dmp	upx
behavioral1/files/0x00050000000191fe-88.dat	upx
behavioral1/memory/2412-97-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/files/0x0005000000019221-96.dat	upx
behavioral1/memory/2168-95-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/files/0x000600000001904f-86.dat	upx
behavioral1/files/0x0006000000018f94-81.dat	upx
behavioral1/memory/2712-79-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/1508-78-0x000000013F1D0000-0x000000013F521000-memory.dmp	upx
behavioral1/memory/2776-74-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/files/0x0006000000018d89-72.dat	upx
behavioral1/memory/2632-58-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/files/0x0007000000015fa3-54.dat	upx
behavioral1/memory/2004-50-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/memory/2628-48-0x000000013FDD0000-0x0000000140121000-memory.dmp	upx
behavioral1/files/0x0007000000015f3d-38.dat	upx
behavioral1/files/0x0007000000015f55-44.dat	upx
behavioral1/memory/2804-35-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/2412-28-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/files/0x0008000000015db6-10.dat	upx
behavioral1/memory/2712-17-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/572-1363-0x000000013F720000-0x000000013FA71000-memory.dmp	upx
behavioral1/memory/1492-2093-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/memory/1508-3447-0x000000013F1D0000-0x000000013F521000-memory.dmp	upx
behavioral1/memory/2128-4266-0x000000013F340000-0x000000013F691000-memory.dmp	upx
behavioral1/memory/2712-4274-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/2708-4273-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2852-4272-0x000000013F2E0000-0x000000013F631000-memory.dmp	upx
behavioral1/memory/2804-4280-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/2412-4279-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/2004-4277-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/memory/2628-4283-0x000000013FDD0000-0x0000000140121000-memory.dmp	upx
behavioral1/memory/2632-4284-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wpTwCDb.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\gpxJBQE.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\hnjyrem.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\lgUAlJc.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\RrfapED.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\WhpfoPo.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\sElIwLu.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\Fpfgolj.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\ZKIBVsF.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\iJZVrKx.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LVTWGvU.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\mBamCqC.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LgZWfnm.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LADpUHk.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\RTOxaIo.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\DJZUxVE.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\ZNrTCZt.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\mzLsorM.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\KDpaCiV.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\oywHrNg.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\fOggmzi.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\FaptoGd.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\JHPPEcM.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\cURWDdo.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\ymWtLcu.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\SAqOtQY.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\aUjomQc.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\PTByisu.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\xHEnkMz.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\JPBwgAn.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\KhMaBZE.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\DUEcUAK.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LvyIYxo.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\CVDZUhU.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\XAZVdoP.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LxyxInu.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\TNTDpJG.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\AmzSKJb.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\RiwArNx.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\djEwHHs.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\SQwCRVf.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\IhZatGc.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LuoOpHO.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\InhvrJp.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\KEaeDXQ.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\nczSyWx.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\owJjZzw.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\YnedKoc.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\pCKbUcm.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\xHyhFWf.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\DOKarvI.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\RWZPTWR.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\BLCHzDt.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\VlSDDkd.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\gVINgWb.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\MfwutRP.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\UMzvkQA.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\nLcMhmE.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\lztCfti.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\yWseETs.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\zDXEPjv.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\PUhqpAn.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\YiQbjwO.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
File created	C:\Windows\System\LlPMEZZ.exe	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2712	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	31
PID 2776 wrote to memory of 2712	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	31
PID 2776 wrote to memory of 2712	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	31
PID 2776 wrote to memory of 2852	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	32
PID 2776 wrote to memory of 2852	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	32
PID 2776 wrote to memory of 2852	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	32
PID 2776 wrote to memory of 2708	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	33
PID 2776 wrote to memory of 2708	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	33
PID 2776 wrote to memory of 2708	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	33
PID 2776 wrote to memory of 2412	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	34
PID 2776 wrote to memory of 2412	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	34
PID 2776 wrote to memory of 2412	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	34
PID 2776 wrote to memory of 2804	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	35
PID 2776 wrote to memory of 2804	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	35
PID 2776 wrote to memory of 2804	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	35
PID 2776 wrote to memory of 2628	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	36
PID 2776 wrote to memory of 2628	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	36
PID 2776 wrote to memory of 2628	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	36
PID 2776 wrote to memory of 2004	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	37
PID 2776 wrote to memory of 2004	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	37
PID 2776 wrote to memory of 2004	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	37
PID 2776 wrote to memory of 2632	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	38
PID 2776 wrote to memory of 2632	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	38
PID 2776 wrote to memory of 2632	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	38
PID 2776 wrote to memory of 572	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	39
PID 2776 wrote to memory of 572	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	39
PID 2776 wrote to memory of 572	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	39
PID 2776 wrote to memory of 1492	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	40
PID 2776 wrote to memory of 1492	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	40
PID 2776 wrote to memory of 1492	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	40
PID 2776 wrote to memory of 1508	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	41
PID 2776 wrote to memory of 1508	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	41
PID 2776 wrote to memory of 1508	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	41
PID 2776 wrote to memory of 2128	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	42
PID 2776 wrote to memory of 2128	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	42
PID 2776 wrote to memory of 2128	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	42
PID 2776 wrote to memory of 2168	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	43
PID 2776 wrote to memory of 2168	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	43
PID 2776 wrote to memory of 2168	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	43
PID 2776 wrote to memory of 2248	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	44
PID 2776 wrote to memory of 2248	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	44
PID 2776 wrote to memory of 2248	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	44
PID 2776 wrote to memory of 1868	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	45
PID 2776 wrote to memory of 1868	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	45
PID 2776 wrote to memory of 1868	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	45
PID 2776 wrote to memory of 2880	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	46
PID 2776 wrote to memory of 2880	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	46
PID 2776 wrote to memory of 2880	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	46
PID 2776 wrote to memory of 3048	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	47
PID 2776 wrote to memory of 3048	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	47
PID 2776 wrote to memory of 3048	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	47
PID 2776 wrote to memory of 2424	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	48
PID 2776 wrote to memory of 2424	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	48
PID 2776 wrote to memory of 2424	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	48
PID 2776 wrote to memory of 1308	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	49
PID 2776 wrote to memory of 1308	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	49
PID 2776 wrote to memory of 1308	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	49
PID 2776 wrote to memory of 2488	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	50
PID 2776 wrote to memory of 2488	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	50
PID 2776 wrote to memory of 2488	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	50
PID 2776 wrote to memory of 2352	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	51
PID 2776 wrote to memory of 2352	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	51
PID 2776 wrote to memory of 2352	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	51
PID 2776 wrote to memory of 2184	2776	fcbf40e3d4e890ac419f4a3c31a0cb80N.exe	52

C:\Users\Admin\AppData\Local\Temp\fcbf40e3d4e890ac419f4a3c31a0cb80N.exe
"C:\Users\Admin\AppData\Local\Temp\fcbf40e3d4e890ac419f4a3c31a0cb80N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\System\qdWztMP.exe
  C:\Windows\System\qdWztMP.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\rEjkczR.exe
  C:\Windows\System\rEjkczR.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\sRCUuTl.exe
  C:\Windows\System\sRCUuTl.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\rjZJyYR.exe
  C:\Windows\System\rjZJyYR.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\mTVgUoq.exe
  C:\Windows\System\mTVgUoq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xPVjFIb.exe
  C:\Windows\System\xPVjFIb.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\kqtneJX.exe
  C:\Windows\System\kqtneJX.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\XEqFmtH.exe
  C:\Windows\System\XEqFmtH.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\TpCdkhd.exe
  C:\Windows\System\TpCdkhd.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\ZFMmqoK.exe
  C:\Windows\System\ZFMmqoK.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\THxyNSN.exe
  C:\Windows\System\THxyNSN.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ExnZTUm.exe
  C:\Windows\System\ExnZTUm.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\wEUUSVD.exe
  C:\Windows\System\wEUUSVD.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\shTuQWy.exe
  C:\Windows\System\shTuQWy.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\gaPswMP.exe
  C:\Windows\System\gaPswMP.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\zGfOCBU.exe
  C:\Windows\System\zGfOCBU.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\JgXARBM.exe
  C:\Windows\System\JgXARBM.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\svypVId.exe
  C:\Windows\System\svypVId.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\FmoGsKl.exe
  C:\Windows\System\FmoGsKl.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\AWCYXDg.exe
  C:\Windows\System\AWCYXDg.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\xykdjRH.exe
  C:\Windows\System\xykdjRH.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\TXquKoc.exe
  C:\Windows\System\TXquKoc.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\tHmuImD.exe
  C:\Windows\System\tHmuImD.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\WOkdeVT.exe
  C:\Windows\System\WOkdeVT.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\DMoCLOG.exe
  C:\Windows\System\DMoCLOG.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\BhzzAWa.exe
  C:\Windows\System\BhzzAWa.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\SNHraVg.exe
  C:\Windows\System\SNHraVg.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\EHjdSsu.exe
  C:\Windows\System\EHjdSsu.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\tesfEaY.exe
  C:\Windows\System\tesfEaY.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ralRjhY.exe
  C:\Windows\System\ralRjhY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ZDBdPZg.exe
  C:\Windows\System\ZDBdPZg.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\UOlxYST.exe
  C:\Windows\System\UOlxYST.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\DGmShfs.exe
  C:\Windows\System\DGmShfs.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\RgbvBCT.exe
  C:\Windows\System\RgbvBCT.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\fbLzMCW.exe
  C:\Windows\System\fbLzMCW.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\IXzzmrM.exe
  C:\Windows\System\IXzzmrM.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\qeTgqZr.exe
  C:\Windows\System\qeTgqZr.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\SQwCRVf.exe
  C:\Windows\System\SQwCRVf.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ejLffXW.exe
  C:\Windows\System\ejLffXW.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\NGlpNTT.exe
  C:\Windows\System\NGlpNTT.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\InhvrJp.exe
  C:\Windows\System\InhvrJp.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\JqvghGI.exe
  C:\Windows\System\JqvghGI.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\AhRvZnr.exe
  C:\Windows\System\AhRvZnr.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\DmJAozd.exe
  C:\Windows\System\DmJAozd.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\vMIfIZY.exe
  C:\Windows\System\vMIfIZY.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\xIcdWxk.exe
  C:\Windows\System\xIcdWxk.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\QimZlVL.exe
  C:\Windows\System\QimZlVL.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\LxyxInu.exe
  C:\Windows\System\LxyxInu.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\xHyhFWf.exe
  C:\Windows\System\xHyhFWf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\VicMWGE.exe
  C:\Windows\System\VicMWGE.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\UjzytMk.exe
  C:\Windows\System\UjzytMk.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\UNkBLlu.exe
  C:\Windows\System\UNkBLlu.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\fZHPcmJ.exe
  C:\Windows\System\fZHPcmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\uqHehzl.exe
  C:\Windows\System\uqHehzl.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\NxCCAJk.exe
  C:\Windows\System\NxCCAJk.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\PegItKY.exe
  C:\Windows\System\PegItKY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\dcUfIxO.exe
  C:\Windows\System\dcUfIxO.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\esRPKjU.exe
  C:\Windows\System\esRPKjU.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\UKDcWKB.exe
  C:\Windows\System\UKDcWKB.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ECFWBec.exe
  C:\Windows\System\ECFWBec.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\QlSFOUm.exe
  C:\Windows\System\QlSFOUm.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\eaJhsss.exe
  C:\Windows\System\eaJhsss.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\XtlYEge.exe
  C:\Windows\System\XtlYEge.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ispxmsC.exe
  C:\Windows\System\ispxmsC.exe
  2⤵
  PID:2476
- C:\Windows\System\yNzqZAK.exe
  C:\Windows\System\yNzqZAK.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\WKDmDAA.exe
  C:\Windows\System\WKDmDAA.exe
  2⤵
  PID:2548
- C:\Windows\System\WSTntzl.exe
  C:\Windows\System\WSTntzl.exe
  2⤵
  PID:2076
- C:\Windows\System\FlDxZPH.exe
  C:\Windows\System\FlDxZPH.exe
  2⤵
  PID:2108
- C:\Windows\System\HqcoInm.exe
  C:\Windows\System\HqcoInm.exe
  2⤵
  PID:1348
- C:\Windows\System\xaUohbm.exe
  C:\Windows\System\xaUohbm.exe
  2⤵
  PID:2384
- C:\Windows\System\IhZatGc.exe
  C:\Windows\System\IhZatGc.exe
  2⤵
  PID:1504
- C:\Windows\System\IjeLsGH.exe
  C:\Windows\System\IjeLsGH.exe
  2⤵
  PID:1152
- C:\Windows\System\DyLDyna.exe
  C:\Windows\System\DyLDyna.exe
  2⤵
  PID:1560
- C:\Windows\System\BiqdbkS.exe
  C:\Windows\System\BiqdbkS.exe
  2⤵
  PID:1344
- C:\Windows\System\XAMUHyK.exe
  C:\Windows\System\XAMUHyK.exe
  2⤵
  PID:1040
- C:\Windows\System\myPuQbi.exe
  C:\Windows\System\myPuQbi.exe
  2⤵
  PID:1044
- C:\Windows\System\OVkiszv.exe
  C:\Windows\System\OVkiszv.exe
  2⤵
  PID:1712
- C:\Windows\System\UlAtYCm.exe
  C:\Windows\System\UlAtYCm.exe
  2⤵
  PID:2040
- C:\Windows\System\HYwhQtF.exe
  C:\Windows\System\HYwhQtF.exe
  2⤵
  PID:1592
- C:\Windows\System\vqiRloj.exe
  C:\Windows\System\vqiRloj.exe
  2⤵
  PID:800
- C:\Windows\System\bWnsmYo.exe
  C:\Windows\System\bWnsmYo.exe
  2⤵
  PID:3040
- C:\Windows\System\LwDRbww.exe
  C:\Windows\System\LwDRbww.exe
  2⤵
  PID:564
- C:\Windows\System\RTUARzS.exe
  C:\Windows\System\RTUARzS.exe
  2⤵
  PID:2116
- C:\Windows\System\vTUHpXR.exe
  C:\Windows\System\vTUHpXR.exe
  2⤵
  PID:2012
- C:\Windows\System\qOTKhKB.exe
  C:\Windows\System\qOTKhKB.exe
  2⤵
  PID:2020
- C:\Windows\System\ULbliCU.exe
  C:\Windows\System\ULbliCU.exe
  2⤵
  PID:2092
- C:\Windows\System\ztprZuO.exe
  C:\Windows\System\ztprZuO.exe
  2⤵
  PID:480
- C:\Windows\System\nXYEuRr.exe
  C:\Windows\System\nXYEuRr.exe
  2⤵
  PID:2256
- C:\Windows\System\TEfCHwV.exe
  C:\Windows\System\TEfCHwV.exe
  2⤵
  PID:1156
- C:\Windows\System\zMyxSCH.exe
  C:\Windows\System\zMyxSCH.exe
  2⤵
  PID:2932
- C:\Windows\System\LlPMEZZ.exe
  C:\Windows\System\LlPMEZZ.exe
  2⤵
  PID:1112
- C:\Windows\System\OTycxKP.exe
  C:\Windows\System\OTycxKP.exe
  2⤵
  PID:2968
- C:\Windows\System\YGhDoir.exe
  C:\Windows\System\YGhDoir.exe
  2⤵
  PID:1568
- C:\Windows\System\RxJLxQW.exe
  C:\Windows\System\RxJLxQW.exe
  2⤵
  PID:1696
- C:\Windows\System\uLMXPsu.exe
  C:\Windows\System\uLMXPsu.exe
  2⤵
  PID:2500
- C:\Windows\System\oHwUVKx.exe
  C:\Windows\System\oHwUVKx.exe
  2⤵
  PID:1228
- C:\Windows\System\RECBZDH.exe
  C:\Windows\System\RECBZDH.exe
  2⤵
  PID:2696
- C:\Windows\System\ylnOncr.exe
  C:\Windows\System\ylnOncr.exe
  2⤵
  PID:2904
- C:\Windows\System\UXHvQOH.exe
  C:\Windows\System\UXHvQOH.exe
  2⤵
  PID:3024
- C:\Windows\System\krQkgdG.exe
  C:\Windows\System\krQkgdG.exe
  2⤵
  PID:996
- C:\Windows\System\kysEwFG.exe
  C:\Windows\System\kysEwFG.exe
  2⤵
  PID:2444
- C:\Windows\System\sNJzMzR.exe
  C:\Windows\System\sNJzMzR.exe
  2⤵
  PID:1008
- C:\Windows\System\SqnIXZx.exe
  C:\Windows\System\SqnIXZx.exe
  2⤵
  PID:1500
- C:\Windows\System\BLJwXMI.exe
  C:\Windows\System\BLJwXMI.exe
  2⤵
  PID:2860
- C:\Windows\System\AIKQvQP.exe
  C:\Windows\System\AIKQvQP.exe
  2⤵
  PID:2700
- C:\Windows\System\aDqXNwj.exe
  C:\Windows\System\aDqXNwj.exe
  2⤵
  PID:1652
- C:\Windows\System\sjdMSRO.exe
  C:\Windows\System\sjdMSRO.exe
  2⤵
  PID:2900
- C:\Windows\System\WXmjqbm.exe
  C:\Windows\System\WXmjqbm.exe
  2⤵
  PID:316
- C:\Windows\System\wUfyODc.exe
  C:\Windows\System\wUfyODc.exe
  2⤵
  PID:1352
- C:\Windows\System\wzxjHyJ.exe
  C:\Windows\System\wzxjHyJ.exe
  2⤵
  PID:1828
- C:\Windows\System\NetOnZA.exe
  C:\Windows\System\NetOnZA.exe
  2⤵
  PID:1056
- C:\Windows\System\NWrPcHM.exe
  C:\Windows\System\NWrPcHM.exe
  2⤵
  PID:1260
- C:\Windows\System\MnEBRYW.exe
  C:\Windows\System\MnEBRYW.exe
  2⤵
  PID:2996
- C:\Windows\System\TNocsKT.exe
  C:\Windows\System\TNocsKT.exe
  2⤵
  PID:396
- C:\Windows\System\rnuOZxF.exe
  C:\Windows\System\rnuOZxF.exe
  2⤵
  PID:1032
- C:\Windows\System\BVcscYO.exe
  C:\Windows\System\BVcscYO.exe
  2⤵
  PID:2144
- C:\Windows\System\VmYzYNh.exe
  C:\Windows\System\VmYzYNh.exe
  2⤵
  PID:1724
- C:\Windows\System\KkXJEvA.exe
  C:\Windows\System\KkXJEvA.exe
  2⤵
  PID:2588
- C:\Windows\System\oTOlSaR.exe
  C:\Windows\System\oTOlSaR.exe
  2⤵
  PID:2924
- C:\Windows\System\nKQxiec.exe
  C:\Windows\System\nKQxiec.exe
  2⤵
  PID:1644
- C:\Windows\System\YIIFRTi.exe
  C:\Windows\System\YIIFRTi.exe
  2⤵
  PID:2612
- C:\Windows\System\RFngGdY.exe
  C:\Windows\System\RFngGdY.exe
  2⤵
  PID:3064
- C:\Windows\System\CSloijR.exe
  C:\Windows\System\CSloijR.exe
  2⤵
  PID:2748
- C:\Windows\System\OaZDdBz.exe
  C:\Windows\System\OaZDdBz.exe
  2⤵
  PID:2468
- C:\Windows\System\BTmHPId.exe
  C:\Windows\System\BTmHPId.exe
  2⤵
  PID:688
- C:\Windows\System\cwKJzAf.exe
  C:\Windows\System\cwKJzAf.exe
  2⤵
  PID:2188
- C:\Windows\System\GfTeWaz.exe
  C:\Windows\System\GfTeWaz.exe
  2⤵
  PID:2956
- C:\Windows\System\suawhOa.exe
  C:\Windows\System\suawhOa.exe
  2⤵
  PID:1092
- C:\Windows\System\JwaJwmk.exe
  C:\Windows\System\JwaJwmk.exe
  2⤵
  PID:2340
- C:\Windows\System\yWiqKpN.exe
  C:\Windows\System\yWiqKpN.exe
  2⤵
  PID:2568
- C:\Windows\System\WNnpxre.exe
  C:\Windows\System\WNnpxre.exe
  2⤵
  PID:1700
- C:\Windows\System\EOKWzcd.exe
  C:\Windows\System\EOKWzcd.exe
  2⤵
  PID:1132
- C:\Windows\System\zHPzEhj.exe
  C:\Windows\System\zHPzEhj.exe
  2⤵
  PID:1756
- C:\Windows\System\kdHmWcE.exe
  C:\Windows\System\kdHmWcE.exe
  2⤵
  PID:2644
- C:\Windows\System\knSCzxU.exe
  C:\Windows\System\knSCzxU.exe
  2⤵
  PID:2064
- C:\Windows\System\DrBMdGd.exe
  C:\Windows\System\DrBMdGd.exe
  2⤵
  PID:576
- C:\Windows\System\vXkNLzu.exe
  C:\Windows\System\vXkNLzu.exe
  2⤵
  PID:2056
- C:\Windows\System\AwjvOvM.exe
  C:\Windows\System\AwjvOvM.exe
  2⤵
  PID:836
- C:\Windows\System\IuyBdBQ.exe
  C:\Windows\System\IuyBdBQ.exe
  2⤵
  PID:1796
- C:\Windows\System\Rvdwznh.exe
  C:\Windows\System\Rvdwznh.exe
  2⤵
  PID:2124
- C:\Windows\System\ygnPqcM.exe
  C:\Windows\System\ygnPqcM.exe
  2⤵
  PID:588
- C:\Windows\System\vApdfQR.exe
  C:\Windows\System\vApdfQR.exe
  2⤵
  PID:2580
- C:\Windows\System\iCaOVcB.exe
  C:\Windows\System\iCaOVcB.exe
  2⤵
  PID:3076
- C:\Windows\System\SghjfiU.exe
  C:\Windows\System\SghjfiU.exe
  2⤵
  PID:3092
- C:\Windows\System\ZXcYiob.exe
  C:\Windows\System\ZXcYiob.exe
  2⤵
  PID:3108
- C:\Windows\System\ISfCpcr.exe
  C:\Windows\System\ISfCpcr.exe
  2⤵
  PID:3128
- C:\Windows\System\HmHSKsJ.exe
  C:\Windows\System\HmHSKsJ.exe
  2⤵
  PID:3144
- C:\Windows\System\iBYrJcB.exe
  C:\Windows\System\iBYrJcB.exe
  2⤵
  PID:3168
- C:\Windows\System\QQaJTLo.exe
  C:\Windows\System\QQaJTLo.exe
  2⤵
  PID:3184
- C:\Windows\System\WwJAMle.exe
  C:\Windows\System\WwJAMle.exe
  2⤵
  PID:3200
- C:\Windows\System\zPVJTMw.exe
  C:\Windows\System\zPVJTMw.exe
  2⤵
  PID:3216
- C:\Windows\System\HmEXzdU.exe
  C:\Windows\System\HmEXzdU.exe
  2⤵
  PID:3236
- C:\Windows\System\yYUXxHP.exe
  C:\Windows\System\yYUXxHP.exe
  2⤵
  PID:3348
- C:\Windows\System\XexmQZx.exe
  C:\Windows\System\XexmQZx.exe
  2⤵
  PID:3364
- C:\Windows\System\SyvnDoM.exe
  C:\Windows\System\SyvnDoM.exe
  2⤵
  PID:3380
- C:\Windows\System\ALfPFes.exe
  C:\Windows\System\ALfPFes.exe
  2⤵
  PID:3396
- C:\Windows\System\AMZZNOH.exe
  C:\Windows\System\AMZZNOH.exe
  2⤵
  PID:3412
- C:\Windows\System\bPSGFVr.exe
  C:\Windows\System\bPSGFVr.exe
  2⤵
  PID:3428
- C:\Windows\System\aEYFtRc.exe
  C:\Windows\System\aEYFtRc.exe
  2⤵
  PID:3448
- C:\Windows\System\quqHtLw.exe
  C:\Windows\System\quqHtLw.exe
  2⤵
  PID:3464
- C:\Windows\System\rpvhnUA.exe
  C:\Windows\System\rpvhnUA.exe
  2⤵
  PID:3480
- C:\Windows\System\ukBbWVQ.exe
  C:\Windows\System\ukBbWVQ.exe
  2⤵
  PID:3496
- C:\Windows\System\rhjObtI.exe
  C:\Windows\System\rhjObtI.exe
  2⤵
  PID:3524
- C:\Windows\System\xqpFFtD.exe
  C:\Windows\System\xqpFFtD.exe
  2⤵
  PID:3568
- C:\Windows\System\sYsuaaN.exe
  C:\Windows\System\sYsuaaN.exe
  2⤵
  PID:3584
- C:\Windows\System\uOzGMKa.exe
  C:\Windows\System\uOzGMKa.exe
  2⤵
  PID:3616
- C:\Windows\System\mkxCxoS.exe
  C:\Windows\System\mkxCxoS.exe
  2⤵
  PID:3632
- C:\Windows\System\DOrmAon.exe
  C:\Windows\System\DOrmAon.exe
  2⤵
  PID:3648
- C:\Windows\System\FtQQkVp.exe
  C:\Windows\System\FtQQkVp.exe
  2⤵
  PID:3668
- C:\Windows\System\SOdMBhE.exe
  C:\Windows\System\SOdMBhE.exe
  2⤵
  PID:3684
- C:\Windows\System\rCNdqyb.exe
  C:\Windows\System\rCNdqyb.exe
  2⤵
  PID:3700
- C:\Windows\System\lbEfDAj.exe
  C:\Windows\System\lbEfDAj.exe
  2⤵
  PID:3716
- C:\Windows\System\PKWNwoC.exe
  C:\Windows\System\PKWNwoC.exe
  2⤵
  PID:3732
- C:\Windows\System\kKQJjAy.exe
  C:\Windows\System\kKQJjAy.exe
  2⤵
  PID:3748
- C:\Windows\System\SWmDsmA.exe
  C:\Windows\System\SWmDsmA.exe
  2⤵
  PID:3764
- C:\Windows\System\skbcxjs.exe
  C:\Windows\System\skbcxjs.exe
  2⤵
  PID:3780
- C:\Windows\System\USXysIN.exe
  C:\Windows\System\USXysIN.exe
  2⤵
  PID:3796
- C:\Windows\System\fTHHGOs.exe
  C:\Windows\System\fTHHGOs.exe
  2⤵
  PID:3812
- C:\Windows\System\NBNgWCI.exe
  C:\Windows\System\NBNgWCI.exe
  2⤵
  PID:3828
- C:\Windows\System\ekWYrYe.exe
  C:\Windows\System\ekWYrYe.exe
  2⤵
  PID:3844
- C:\Windows\System\dBkOEDP.exe
  C:\Windows\System\dBkOEDP.exe
  2⤵
  PID:3860
- C:\Windows\System\diPJKFS.exe
  C:\Windows\System\diPJKFS.exe
  2⤵
  PID:3880
- C:\Windows\System\LAvFaNI.exe
  C:\Windows\System\LAvFaNI.exe
  2⤵
  PID:3896
- C:\Windows\System\yfUNKZC.exe
  C:\Windows\System\yfUNKZC.exe
  2⤵
  PID:3912
- C:\Windows\System\wcJkUoe.exe
  C:\Windows\System\wcJkUoe.exe
  2⤵
  PID:3928
- C:\Windows\System\uLLnmuE.exe
  C:\Windows\System\uLLnmuE.exe
  2⤵
  PID:3944
- C:\Windows\System\KdKfrda.exe
  C:\Windows\System\KdKfrda.exe
  2⤵
  PID:3964
- C:\Windows\System\YubRCtF.exe
  C:\Windows\System\YubRCtF.exe
  2⤵
  PID:3984
- C:\Windows\System\IsxObkS.exe
  C:\Windows\System\IsxObkS.exe
  2⤵
  PID:4000
- C:\Windows\System\zanJNyh.exe
  C:\Windows\System\zanJNyh.exe
  2⤵
  PID:4016
- C:\Windows\System\YVqUrKM.exe
  C:\Windows\System\YVqUrKM.exe
  2⤵
  PID:4032
- C:\Windows\System\XySBzoI.exe
  C:\Windows\System\XySBzoI.exe
  2⤵
  PID:4052
- C:\Windows\System\xbJJdCR.exe
  C:\Windows\System\xbJJdCR.exe
  2⤵
  PID:4068
- C:\Windows\System\xkolpyW.exe
  C:\Windows\System\xkolpyW.exe
  2⤵
  PID:4084
- C:\Windows\System\QRnNgmM.exe
  C:\Windows\System\QRnNgmM.exe
  2⤵
  PID:348
- C:\Windows\System\LnifjeB.exe
  C:\Windows\System\LnifjeB.exe
  2⤵
  PID:1780
- C:\Windows\System\ABMdMfR.exe
  C:\Windows\System\ABMdMfR.exe
  2⤵
  PID:2544
- C:\Windows\System\svMBqKt.exe
  C:\Windows\System\svMBqKt.exe
  2⤵
  PID:1616
- C:\Windows\System\ApgympT.exe
  C:\Windows\System\ApgympT.exe
  2⤵
  PID:1392
- C:\Windows\System\klHPDyo.exe
  C:\Windows\System\klHPDyo.exe
  2⤵
  PID:3136
- C:\Windows\System\oAiNaZV.exe
  C:\Windows\System\oAiNaZV.exe
  2⤵
  PID:3004
- C:\Windows\System\QbYTQyD.exe
  C:\Windows\System\QbYTQyD.exe
  2⤵
  PID:264
- C:\Windows\System\kanQQUr.exe
  C:\Windows\System\kanQQUr.exe
  2⤵
  PID:2624
- C:\Windows\System\gjXWQBL.exe
  C:\Windows\System\gjXWQBL.exe
  2⤵
  PID:3120
- C:\Windows\System\glxXTFm.exe
  C:\Windows\System\glxXTFm.exe
  2⤵
  PID:840
- C:\Windows\System\HHQqoHH.exe
  C:\Windows\System\HHQqoHH.exe
  2⤵
  PID:708
- C:\Windows\System\gMxrsAV.exe
  C:\Windows\System\gMxrsAV.exe
  2⤵
  PID:3192
- C:\Windows\System\XnvXyku.exe
  C:\Windows\System\XnvXyku.exe
  2⤵
  PID:3232
- C:\Windows\System\ncOhbKh.exe
  C:\Windows\System\ncOhbKh.exe
  2⤵
  PID:3180
- C:\Windows\System\PyGfDfg.exe
  C:\Windows\System\PyGfDfg.exe
  2⤵
  PID:1264
- C:\Windows\System\kLJqmkg.exe
  C:\Windows\System\kLJqmkg.exe
  2⤵
  PID:3264
- C:\Windows\System\ZWQPnHs.exe
  C:\Windows\System\ZWQPnHs.exe
  2⤵
  PID:1136
- C:\Windows\System\lkjwNbF.exe
  C:\Windows\System\lkjwNbF.exe
  2⤵
  PID:3320
- C:\Windows\System\MYNjAhQ.exe
  C:\Windows\System\MYNjAhQ.exe
  2⤵
  PID:3336
- C:\Windows\System\OEDHccd.exe
  C:\Windows\System\OEDHccd.exe
  2⤵
  PID:3288
- C:\Windows\System\sOvUcsj.exe
  C:\Windows\System\sOvUcsj.exe
  2⤵
  PID:3304
- C:\Windows\System\GAaMawY.exe
  C:\Windows\System\GAaMawY.exe
  2⤵
  PID:3360
- C:\Windows\System\lBUVqXs.exe
  C:\Windows\System\lBUVqXs.exe
  2⤵
  PID:3424
- C:\Windows\System\ziOZhff.exe
  C:\Windows\System\ziOZhff.exe
  2⤵
  PID:3492
- C:\Windows\System\uClwcvs.exe
  C:\Windows\System\uClwcvs.exe
  2⤵
  PID:3376
- C:\Windows\System\GLYaKuI.exe
  C:\Windows\System\GLYaKuI.exe
  2⤵
  PID:3536
- C:\Windows\System\mVRRDfG.exe
  C:\Windows\System\mVRRDfG.exe
  2⤵
  PID:3552
- C:\Windows\System\jLNwlsA.exe
  C:\Windows\System\jLNwlsA.exe
  2⤵
  PID:3404
- C:\Windows\System\yDMsqil.exe
  C:\Windows\System\yDMsqil.exe
  2⤵
  PID:3440
- C:\Windows\System\JyNVTCp.exe
  C:\Windows\System\JyNVTCp.exe
  2⤵
  PID:3504
- C:\Windows\System\TNTDpJG.exe
  C:\Windows\System\TNTDpJG.exe
  2⤵
  PID:3520
- C:\Windows\System\kguoTJn.exe
  C:\Windows\System\kguoTJn.exe
  2⤵
  PID:2884
- C:\Windows\System\yFoScyH.exe
  C:\Windows\System\yFoScyH.exe
  2⤵
  PID:3592
- C:\Windows\System\DLTvsud.exe
  C:\Windows\System\DLTvsud.exe
  2⤵
  PID:3604
- C:\Windows\System\LyLcDXb.exe
  C:\Windows\System\LyLcDXb.exe
  2⤵
  PID:3608
- C:\Windows\System\yKUhmyD.exe
  C:\Windows\System\yKUhmyD.exe
  2⤵
  PID:2284
- C:\Windows\System\PTByisu.exe
  C:\Windows\System\PTByisu.exe
  2⤵
  PID:2272
- C:\Windows\System\hBTyMUi.exe
  C:\Windows\System\hBTyMUi.exe
  2⤵
  PID:3788
- C:\Windows\System\PbTQFhN.exe
  C:\Windows\System\PbTQFhN.exe
  2⤵
  PID:3852
- C:\Windows\System\rmvPLLo.exe
  C:\Windows\System\rmvPLLo.exe
  2⤵
  PID:3892
- C:\Windows\System\UfjQBqu.exe
  C:\Windows\System\UfjQBqu.exe
  2⤵
  PID:3956
- C:\Windows\System\kJICFos.exe
  C:\Windows\System\kJICFos.exe
  2⤵
  PID:3772
- C:\Windows\System\nRndtAt.exe
  C:\Windows\System\nRndtAt.exe
  2⤵
  PID:3612
- C:\Windows\System\iybhGtH.exe
  C:\Windows\System\iybhGtH.exe
  2⤵
  PID:3676
- C:\Windows\System\akrchDs.exe
  C:\Windows\System\akrchDs.exe
  2⤵
  PID:3712
- C:\Windows\System\scTTYNW.exe
  C:\Windows\System\scTTYNW.exe
  2⤵
  PID:3808
- C:\Windows\System\ZGSdINN.exe
  C:\Windows\System\ZGSdINN.exe
  2⤵
  PID:3904
- C:\Windows\System\VFfyLWU.exe
  C:\Windows\System\VFfyLWU.exe
  2⤵
  PID:4008
- C:\Windows\System\OjxpAtt.exe
  C:\Windows\System\OjxpAtt.exe
  2⤵
  PID:4012
- C:\Windows\System\HpHjsVO.exe
  C:\Windows\System\HpHjsVO.exe
  2⤵
  PID:2760
- C:\Windows\System\NYRBJJH.exe
  C:\Windows\System\NYRBJJH.exe
  2⤵
  PID:4060
- C:\Windows\System\mhNSfRD.exe
  C:\Windows\System\mhNSfRD.exe
  2⤵
  PID:3992
- C:\Windows\System\PKGXDYF.exe
  C:\Windows\System\PKGXDYF.exe
  2⤵
  PID:916
- C:\Windows\System\UXngims.exe
  C:\Windows\System\UXngims.exe
  2⤵
  PID:2648
- C:\Windows\System\hnjyrem.exe
  C:\Windows\System\hnjyrem.exe
  2⤵
  PID:3160
- C:\Windows\System\Qlmwfpr.exe
  C:\Windows\System\Qlmwfpr.exe
  2⤵
  PID:3244
- C:\Windows\System\SNVjSTD.exe
  C:\Windows\System\SNVjSTD.exe
  2⤵
  PID:3280
- C:\Windows\System\WisFUsL.exe
  C:\Windows\System\WisFUsL.exe
  2⤵
  PID:3100
- C:\Windows\System\VAWnIpG.exe
  C:\Windows\System\VAWnIpG.exe
  2⤵
  PID:2220
- C:\Windows\System\XvlTqLk.exe
  C:\Windows\System\XvlTqLk.exe
  2⤵
  PID:3212
- C:\Windows\System\MoVqWWT.exe
  C:\Windows\System\MoVqWWT.exe
  2⤵
  PID:3328
- C:\Windows\System\JKqBMMJ.exe
  C:\Windows\System\JKqBMMJ.exe
  2⤵
  PID:3284
- C:\Windows\System\GDOLASR.exe
  C:\Windows\System\GDOLASR.exe
  2⤵
  PID:3488
- C:\Windows\System\IblwoBk.exe
  C:\Windows\System\IblwoBk.exe
  2⤵
  PID:3472
- C:\Windows\System\eYDFYuV.exe
  C:\Windows\System\eYDFYuV.exe
  2⤵
  PID:3512
- C:\Windows\System\sxpBApo.exe
  C:\Windows\System\sxpBApo.exe
  2⤵
  PID:3544
- C:\Windows\System\wZyIASV.exe
  C:\Windows\System\wZyIASV.exe
  2⤵
  PID:3516
- C:\Windows\System\ITHrczu.exe
  C:\Windows\System\ITHrczu.exe
  2⤵
  PID:3692
- C:\Windows\System\MYshRyF.exe
  C:\Windows\System\MYshRyF.exe
  2⤵
  PID:1384
- C:\Windows\System\NYWUHhg.exe
  C:\Windows\System\NYWUHhg.exe
  2⤵
  PID:2368
- C:\Windows\System\bBjeGIX.exe
  C:\Windows\System\bBjeGIX.exe
  2⤵
  PID:3644
- C:\Windows\System\ZXfmGPT.exe
  C:\Windows\System\ZXfmGPT.exe
  2⤵
  PID:3980
- C:\Windows\System\oPLZYYg.exe
  C:\Windows\System\oPLZYYg.exe
  2⤵
  PID:1920
- C:\Windows\System\sXPhVWl.exe
  C:\Windows\System\sXPhVWl.exe
  2⤵
  PID:3176
- C:\Windows\System\yBMEXQA.exe
  C:\Windows\System\yBMEXQA.exe
  2⤵
  PID:3728
- C:\Windows\System\TiRaSmb.exe
  C:\Windows\System\TiRaSmb.exe
  2⤵
  PID:2740
- C:\Windows\System\qQoSsRR.exe
  C:\Windows\System\qQoSsRR.exe
  2⤵
  PID:4024
- C:\Windows\System\dEMPHKW.exe
  C:\Windows\System\dEMPHKW.exe
  2⤵
  PID:3228
- C:\Windows\System\ZQsmZTG.exe
  C:\Windows\System\ZQsmZTG.exe
  2⤵
  PID:3936
- C:\Windows\System\nGuMLYt.exe
  C:\Windows\System\nGuMLYt.exe
  2⤵
  PID:3876
- C:\Windows\System\vCBgrLH.exe
  C:\Windows\System\vCBgrLH.exe
  2⤵
  PID:3560
- C:\Windows\System\wBogbOm.exe
  C:\Windows\System\wBogbOm.exe
  2⤵
  PID:3088
- C:\Windows\System\KERIvzB.exe
  C:\Windows\System\KERIvzB.exe
  2⤵
  PID:2692
- C:\Windows\System\FwVCDNi.exe
  C:\Windows\System\FwVCDNi.exe
  2⤵
  PID:3804
- C:\Windows\System\gktvNCK.exe
  C:\Windows\System\gktvNCK.exe
  2⤵
  PID:3924
- C:\Windows\System\SztmtrM.exe
  C:\Windows\System\SztmtrM.exe
  2⤵
  PID:3708
- C:\Windows\System\Nehvwud.exe
  C:\Windows\System\Nehvwud.exe
  2⤵
  PID:3888
- C:\Windows\System\azMucKX.exe
  C:\Windows\System\azMucKX.exe
  2⤵
  PID:4108
- C:\Windows\System\khQcBKz.exe
  C:\Windows\System\khQcBKz.exe
  2⤵
  PID:4124
- C:\Windows\System\HkWezqO.exe
  C:\Windows\System\HkWezqO.exe
  2⤵
  PID:4140
- C:\Windows\System\JGkMIkh.exe
  C:\Windows\System\JGkMIkh.exe
  2⤵
  PID:4156
- C:\Windows\System\EXXDLcX.exe
  C:\Windows\System\EXXDLcX.exe
  2⤵
  PID:4172
- C:\Windows\System\JRRXXCO.exe
  C:\Windows\System\JRRXXCO.exe
  2⤵
  PID:4188
- C:\Windows\System\DiICdCp.exe
  C:\Windows\System\DiICdCp.exe
  2⤵
  PID:4204
- C:\Windows\System\jPImEta.exe
  C:\Windows\System\jPImEta.exe
  2⤵
  PID:4220
- C:\Windows\System\ElkEDMj.exe
  C:\Windows\System\ElkEDMj.exe
  2⤵
  PID:4236
- C:\Windows\System\zwsUhBe.exe
  C:\Windows\System\zwsUhBe.exe
  2⤵
  PID:4252
- C:\Windows\System\vjSSyZP.exe
  C:\Windows\System\vjSSyZP.exe
  2⤵
  PID:4268
- C:\Windows\System\ZFPUgCC.exe
  C:\Windows\System\ZFPUgCC.exe
  2⤵
  PID:4284
- C:\Windows\System\ykngYsf.exe
  C:\Windows\System\ykngYsf.exe
  2⤵
  PID:4300
- C:\Windows\System\StFikYX.exe
  C:\Windows\System\StFikYX.exe
  2⤵
  PID:4316
- C:\Windows\System\qJnkzUO.exe
  C:\Windows\System\qJnkzUO.exe
  2⤵
  PID:4332
- C:\Windows\System\jZcOeic.exe
  C:\Windows\System\jZcOeic.exe
  2⤵
  PID:4348
- C:\Windows\System\uRBgDcD.exe
  C:\Windows\System\uRBgDcD.exe
  2⤵
  PID:4364
- C:\Windows\System\rjLplup.exe
  C:\Windows\System\rjLplup.exe
  2⤵
  PID:4380
- C:\Windows\System\TnlRctj.exe
  C:\Windows\System\TnlRctj.exe
  2⤵
  PID:4396
- C:\Windows\System\nLcMhmE.exe
  C:\Windows\System\nLcMhmE.exe
  2⤵
  PID:4412
- C:\Windows\System\ItqUPGN.exe
  C:\Windows\System\ItqUPGN.exe
  2⤵
  PID:4428
- C:\Windows\System\KyFiqim.exe
  C:\Windows\System\KyFiqim.exe
  2⤵
  PID:4444
- C:\Windows\System\ILJJbvL.exe
  C:\Windows\System\ILJJbvL.exe
  2⤵
  PID:4460
- C:\Windows\System\eeIiSQE.exe
  C:\Windows\System\eeIiSQE.exe
  2⤵
  PID:4476
- C:\Windows\System\miPlQyN.exe
  C:\Windows\System\miPlQyN.exe
  2⤵
  PID:4492
- C:\Windows\System\fdRKMkD.exe
  C:\Windows\System\fdRKMkD.exe
  2⤵
  PID:4508
- C:\Windows\System\DQtbZPa.exe
  C:\Windows\System\DQtbZPa.exe
  2⤵
  PID:4524
- C:\Windows\System\VSYpSKM.exe
  C:\Windows\System\VSYpSKM.exe
  2⤵
  PID:4540
- C:\Windows\System\WmgMsMZ.exe
  C:\Windows\System\WmgMsMZ.exe
  2⤵
  PID:4556
- C:\Windows\System\SjYYgDx.exe
  C:\Windows\System\SjYYgDx.exe
  2⤵
  PID:4572
- C:\Windows\System\DuCMSVi.exe
  C:\Windows\System\DuCMSVi.exe
  2⤵
  PID:4588
- C:\Windows\System\XRWzfGx.exe
  C:\Windows\System\XRWzfGx.exe
  2⤵
  PID:4604
- C:\Windows\System\JjicUKu.exe
  C:\Windows\System\JjicUKu.exe
  2⤵
  PID:4620
- C:\Windows\System\UnELsPb.exe
  C:\Windows\System\UnELsPb.exe
  2⤵
  PID:4636
- C:\Windows\System\CpeayDy.exe
  C:\Windows\System\CpeayDy.exe
  2⤵
  PID:4652
- C:\Windows\System\MBaNymj.exe
  C:\Windows\System\MBaNymj.exe
  2⤵
  PID:4668
- C:\Windows\System\qsGjPHv.exe
  C:\Windows\System\qsGjPHv.exe
  2⤵
  PID:4684
- C:\Windows\System\kXbdobf.exe
  C:\Windows\System\kXbdobf.exe
  2⤵
  PID:4700
- C:\Windows\System\BEQWlzg.exe
  C:\Windows\System\BEQWlzg.exe
  2⤵
  PID:4716
- C:\Windows\System\kASnHmF.exe
  C:\Windows\System\kASnHmF.exe
  2⤵
  PID:4732
- C:\Windows\System\KjrVcUY.exe
  C:\Windows\System\KjrVcUY.exe
  2⤵
  PID:4748
- C:\Windows\System\RUdkQoj.exe
  C:\Windows\System\RUdkQoj.exe
  2⤵
  PID:4764
- C:\Windows\System\pSVYRPc.exe
  C:\Windows\System\pSVYRPc.exe
  2⤵
  PID:4780
- C:\Windows\System\IWyoobg.exe
  C:\Windows\System\IWyoobg.exe
  2⤵
  PID:4796
- C:\Windows\System\oxUFzTw.exe
  C:\Windows\System\oxUFzTw.exe
  2⤵
  PID:4812
- C:\Windows\System\RJJtTGe.exe
  C:\Windows\System\RJJtTGe.exe
  2⤵
  PID:4828
- C:\Windows\System\CEPFCZl.exe
  C:\Windows\System\CEPFCZl.exe
  2⤵
  PID:4844
- C:\Windows\System\ocekhuM.exe
  C:\Windows\System\ocekhuM.exe
  2⤵
  PID:4860
- C:\Windows\System\ZeePduM.exe
  C:\Windows\System\ZeePduM.exe
  2⤵
  PID:4876
- C:\Windows\System\bnvAJZV.exe
  C:\Windows\System\bnvAJZV.exe
  2⤵
  PID:4892
- C:\Windows\System\qvzSYWF.exe
  C:\Windows\System\qvzSYWF.exe
  2⤵
  PID:4908
- C:\Windows\System\CHBmYON.exe
  C:\Windows\System\CHBmYON.exe
  2⤵
  PID:4924
- C:\Windows\System\jHaBxKR.exe
  C:\Windows\System\jHaBxKR.exe
  2⤵
  PID:4940
- C:\Windows\System\PHAPTqy.exe
  C:\Windows\System\PHAPTqy.exe
  2⤵
  PID:4956
- C:\Windows\System\fUphooK.exe
  C:\Windows\System\fUphooK.exe
  2⤵
  PID:4972
- C:\Windows\System\UAVgbVx.exe
  C:\Windows\System\UAVgbVx.exe
  2⤵
  PID:4988
- C:\Windows\System\DSLJkfO.exe
  C:\Windows\System\DSLJkfO.exe
  2⤵
  PID:5004
- C:\Windows\System\DXcKGJU.exe
  C:\Windows\System\DXcKGJU.exe
  2⤵
  PID:5020
- C:\Windows\System\CcMYxuo.exe
  C:\Windows\System\CcMYxuo.exe
  2⤵
  PID:5036
- C:\Windows\System\MjjZDzp.exe
  C:\Windows\System\MjjZDzp.exe
  2⤵
  PID:5052
- C:\Windows\System\UNlOcIR.exe
  C:\Windows\System\UNlOcIR.exe
  2⤵
  PID:5068
- C:\Windows\System\OXKlSlP.exe
  C:\Windows\System\OXKlSlP.exe
  2⤵
  PID:5084
- C:\Windows\System\lOsllXH.exe
  C:\Windows\System\lOsllXH.exe
  2⤵
  PID:5100
- C:\Windows\System\HIFPLIO.exe
  C:\Windows\System\HIFPLIO.exe
  2⤵
  PID:5116
- C:\Windows\System\wVtBfBR.exe
  C:\Windows\System\wVtBfBR.exe
  2⤵
  PID:4104
- C:\Windows\System\escCoiF.exe
  C:\Windows\System\escCoiF.exe
  2⤵
  PID:4168
- C:\Windows\System\amPFUhy.exe
  C:\Windows\System\amPFUhy.exe
  2⤵
  PID:4232
- C:\Windows\System\frktutX.exe
  C:\Windows\System\frktutX.exe
  2⤵
  PID:4296
- C:\Windows\System\GSbfrCO.exe
  C:\Windows\System\GSbfrCO.exe
  2⤵
  PID:1932
- C:\Windows\System\tJIGjVM.exe
  C:\Windows\System\tJIGjVM.exe
  2⤵
  PID:4392
- C:\Windows\System\FKwDZgQ.exe
  C:\Windows\System\FKwDZgQ.exe
  2⤵
  PID:2396
- C:\Windows\System\RjQwAVS.exe
  C:\Windows\System\RjQwAVS.exe
  2⤵
  PID:3392
- C:\Windows\System\hPWnruU.exe
  C:\Windows\System\hPWnruU.exe
  2⤵
  PID:4244
- C:\Windows\System\oCJHAls.exe
  C:\Windows\System\oCJHAls.exe
  2⤵
  PID:3696
- C:\Windows\System\eafAJhW.exe
  C:\Windows\System\eafAJhW.exe
  2⤵
  PID:4080
- C:\Windows\System\csBQTuF.exe
  C:\Windows\System\csBQTuF.exe
  2⤵
  PID:4076
- C:\Windows\System\DlgMthP.exe
  C:\Windows\System\DlgMthP.exe
  2⤵
  PID:3532
- C:\Windows\System\GFNHqDl.exe
  C:\Windows\System\GFNHqDl.exe
  2⤵
  PID:3164
- C:\Windows\System\TdMPXyt.exe
  C:\Windows\System\TdMPXyt.exe
  2⤵
  PID:4120
- C:\Windows\System\txMfKeY.exe
  C:\Windows\System\txMfKeY.exe
  2⤵
  PID:4184
- C:\Windows\System\jQOkggT.exe
  C:\Windows\System\jQOkggT.exe
  2⤵
  PID:4280
- C:\Windows\System\TzsCsUX.exe
  C:\Windows\System\TzsCsUX.exe
  2⤵
  PID:4344
- C:\Windows\System\sZRruVQ.exe
  C:\Windows\System\sZRruVQ.exe
  2⤵
  PID:4436
- C:\Windows\System\HVJdnRu.exe
  C:\Windows\System\HVJdnRu.exe
  2⤵
  PID:4472
- C:\Windows\System\ZgGXysT.exe
  C:\Windows\System\ZgGXysT.exe
  2⤵
  PID:4548
- C:\Windows\System\ERzjPxR.exe
  C:\Windows\System\ERzjPxR.exe
  2⤵
  PID:4616
- C:\Windows\System\QdHLkrr.exe
  C:\Windows\System\QdHLkrr.exe
  2⤵
  PID:4648
- C:\Windows\System\AhkZUvr.exe
  C:\Windows\System\AhkZUvr.exe
  2⤵
  PID:4708
- C:\Windows\System\iJjUtNv.exe
  C:\Windows\System\iJjUtNv.exe
  2⤵
  PID:4772
- C:\Windows\System\hbKMVlE.exe
  C:\Windows\System\hbKMVlE.exe
  2⤵
  PID:4596
- C:\Windows\System\NXnyVcr.exe
  C:\Windows\System\NXnyVcr.exe
  2⤵
  PID:4504
- C:\Windows\System\lLEjegn.exe
  C:\Windows\System\lLEjegn.exe
  2⤵
  PID:4568
- C:\Windows\System\luoyOUC.exe
  C:\Windows\System\luoyOUC.exe
  2⤵
  PID:4664
- C:\Windows\System\fBMXNNy.exe
  C:\Windows\System\fBMXNNy.exe
  2⤵
  PID:4728
- C:\Windows\System\PxDdnKb.exe
  C:\Windows\System\PxDdnKb.exe
  2⤵
  PID:4760
- C:\Windows\System\eIQfwWh.exe
  C:\Windows\System\eIQfwWh.exe
  2⤵
  PID:4852
- C:\Windows\System\bKpvZWu.exe
  C:\Windows\System\bKpvZWu.exe
  2⤵
  PID:4888
- C:\Windows\System\HOZGUwL.exe
  C:\Windows\System\HOZGUwL.exe
  2⤵
  PID:4984
- C:\Windows\System\TWLqPqe.exe
  C:\Windows\System\TWLqPqe.exe
  2⤵
  PID:5048
- C:\Windows\System\nCPXhdj.exe
  C:\Windows\System\nCPXhdj.exe
  2⤵
  PID:5112
- C:\Windows\System\OdgYOzB.exe
  C:\Windows\System\OdgYOzB.exe
  2⤵
  PID:4292
- C:\Windows\System\dPAWDwM.exe
  C:\Windows\System\dPAWDwM.exe
  2⤵
  PID:4308
- C:\Windows\System\myykkLv.exe
  C:\Windows\System\myykkLv.exe
  2⤵
  PID:3372
- C:\Windows\System\VfahGaN.exe
  C:\Windows\System\VfahGaN.exe
  2⤵
  PID:4452
- C:\Windows\System\fUEJUOZ.exe
  C:\Windows\System\fUEJUOZ.exe
  2⤵
  PID:4836
- C:\Windows\System\MghnbXV.exe
  C:\Windows\System\MghnbXV.exe
  2⤵
  PID:4900
- C:\Windows\System\ZKIBVsF.exe
  C:\Windows\System\ZKIBVsF.exe
  2⤵
  PID:4964
- C:\Windows\System\ATqEOWm.exe
  C:\Windows\System\ATqEOWm.exe
  2⤵
  PID:4580
- C:\Windows\System\lydHFwg.exe
  C:\Windows\System\lydHFwg.exe
  2⤵
  PID:5060
- C:\Windows\System\lgUAlJc.exe
  C:\Windows\System\lgUAlJc.exe
  2⤵
  PID:3224
- C:\Windows\System\PgwiUUy.exe
  C:\Windows\System\PgwiUUy.exe
  2⤵
  PID:4228
- C:\Windows\System\DIwQDgi.exe
  C:\Windows\System\DIwQDgi.exe
  2⤵
  PID:3624
- C:\Windows\System\fLYOIgb.exe
  C:\Windows\System\fLYOIgb.exe
  2⤵
  PID:3952
- C:\Windows\System\WyJUtIY.exe
  C:\Windows\System\WyJUtIY.exe
  2⤵
  PID:4216
- C:\Windows\System\iJvBCaC.exe
  C:\Windows\System\iJvBCaC.exe
  2⤵
  PID:4516
- C:\Windows\System\Kxzxnag.exe
  C:\Windows\System\Kxzxnag.exe
  2⤵
  PID:4584
- C:\Windows\System\ekYUfTK.exe
  C:\Windows\System\ekYUfTK.exe
  2⤵
  PID:4500
- C:\Windows\System\uvfgWTn.exe
  C:\Windows\System\uvfgWTn.exe
  2⤵
  PID:4980
- C:\Windows\System\ZgCUUHx.exe
  C:\Windows\System\ZgCUUHx.exe
  2⤵
  PID:4952
- C:\Windows\System\JVZAOsd.exe
  C:\Windows\System\JVZAOsd.exe
  2⤵
  PID:4536
- C:\Windows\System\CnOJlDR.exe
  C:\Windows\System\CnOJlDR.exe
  2⤵
  PID:3824
- C:\Windows\System\WzQAChZ.exe
  C:\Windows\System\WzQAChZ.exe
  2⤵
  PID:5044
- C:\Windows\System\ppeGoFk.exe
  C:\Windows\System\ppeGoFk.exe
  2⤵
  PID:5132
- C:\Windows\System\qKhuuZs.exe
  C:\Windows\System\qKhuuZs.exe
  2⤵
  PID:5148
- C:\Windows\System\YVFjkVr.exe
  C:\Windows\System\YVFjkVr.exe
  2⤵
  PID:5164
- C:\Windows\System\KEaeDXQ.exe
  C:\Windows\System\KEaeDXQ.exe
  2⤵
  PID:5180
- C:\Windows\System\pgWMkpC.exe
  C:\Windows\System\pgWMkpC.exe
  2⤵
  PID:5196
- C:\Windows\System\ooxKRmh.exe
  C:\Windows\System\ooxKRmh.exe
  2⤵
  PID:5212
- C:\Windows\System\bJZDFyj.exe
  C:\Windows\System\bJZDFyj.exe
  2⤵
  PID:5228
- C:\Windows\System\RCxIdVe.exe
  C:\Windows\System\RCxIdVe.exe
  2⤵
  PID:5244
- C:\Windows\System\LuoOpHO.exe
  C:\Windows\System\LuoOpHO.exe
  2⤵
  PID:5260
- C:\Windows\System\SEKGTFh.exe
  C:\Windows\System\SEKGTFh.exe
  2⤵
  PID:5276
- C:\Windows\System\vUvsVST.exe
  C:\Windows\System\vUvsVST.exe
  2⤵
  PID:5292
- C:\Windows\System\kCDqYPg.exe
  C:\Windows\System\kCDqYPg.exe
  2⤵
  PID:5308
- C:\Windows\System\bWaNTUK.exe
  C:\Windows\System\bWaNTUK.exe
  2⤵
  PID:5324
- C:\Windows\System\tsHAjEj.exe
  C:\Windows\System\tsHAjEj.exe
  2⤵
  PID:5340
- C:\Windows\System\UTWATwG.exe
  C:\Windows\System\UTWATwG.exe
  2⤵
  PID:5356
- C:\Windows\System\dALHZPu.exe
  C:\Windows\System\dALHZPu.exe
  2⤵
  PID:5372
- C:\Windows\System\bmolzYK.exe
  C:\Windows\System\bmolzYK.exe
  2⤵
  PID:5388
- C:\Windows\System\ejQFRgz.exe
  C:\Windows\System\ejQFRgz.exe
  2⤵
  PID:5404
- C:\Windows\System\XiGJUrd.exe
  C:\Windows\System\XiGJUrd.exe
  2⤵
  PID:5420
- C:\Windows\System\FukMkec.exe
  C:\Windows\System\FukMkec.exe
  2⤵
  PID:5436
- C:\Windows\System\gYvyxBr.exe
  C:\Windows\System\gYvyxBr.exe
  2⤵
  PID:5452
- C:\Windows\System\VecHbxw.exe
  C:\Windows\System\VecHbxw.exe
  2⤵
  PID:5472
- C:\Windows\System\qGSrBYg.exe
  C:\Windows\System\qGSrBYg.exe
  2⤵
  PID:5488
- C:\Windows\System\COPtMIw.exe
  C:\Windows\System\COPtMIw.exe
  2⤵
  PID:5504
- C:\Windows\System\EegIcgG.exe
  C:\Windows\System\EegIcgG.exe
  2⤵
  PID:5520
- C:\Windows\System\HHEqvWT.exe
  C:\Windows\System\HHEqvWT.exe
  2⤵
  PID:5536
- C:\Windows\System\KuCbeQv.exe
  C:\Windows\System\KuCbeQv.exe
  2⤵
  PID:5552
- C:\Windows\System\IGjewUp.exe
  C:\Windows\System\IGjewUp.exe
  2⤵
  PID:5568
- C:\Windows\System\dSPDOFC.exe
  C:\Windows\System\dSPDOFC.exe
  2⤵
  PID:5584
- C:\Windows\System\FIcWXtg.exe
  C:\Windows\System\FIcWXtg.exe
  2⤵
  PID:5600
- C:\Windows\System\cJfdisf.exe
  C:\Windows\System\cJfdisf.exe
  2⤵
  PID:5616
- C:\Windows\System\ilJDlcc.exe
  C:\Windows\System\ilJDlcc.exe
  2⤵
  PID:5632
- C:\Windows\System\ZNrTCZt.exe
  C:\Windows\System\ZNrTCZt.exe
  2⤵
  PID:5648
- C:\Windows\System\WslUwpK.exe
  C:\Windows\System\WslUwpK.exe
  2⤵
  PID:5664
- C:\Windows\System\ZFxZSxy.exe
  C:\Windows\System\ZFxZSxy.exe
  2⤵
  PID:5680
- C:\Windows\System\ydUFDiN.exe
  C:\Windows\System\ydUFDiN.exe
  2⤵
  PID:5696
- C:\Windows\System\Hbxuztz.exe
  C:\Windows\System\Hbxuztz.exe
  2⤵
  PID:5712
- C:\Windows\System\ctVdgaG.exe
  C:\Windows\System\ctVdgaG.exe
  2⤵
  PID:5728
- C:\Windows\System\MrKgRyI.exe
  C:\Windows\System\MrKgRyI.exe
  2⤵
  PID:5744
- C:\Windows\System\lkLPuTi.exe
  C:\Windows\System\lkLPuTi.exe
  2⤵
  PID:5760
- C:\Windows\System\bJLkghb.exe
  C:\Windows\System\bJLkghb.exe
  2⤵
  PID:5776
- C:\Windows\System\yatfLZJ.exe
  C:\Windows\System\yatfLZJ.exe
  2⤵
  PID:5792
- C:\Windows\System\thzdgCq.exe
  C:\Windows\System\thzdgCq.exe
  2⤵
  PID:5808
- C:\Windows\System\JOtqyUO.exe
  C:\Windows\System\JOtqyUO.exe
  2⤵
  PID:5824
- C:\Windows\System\qfeyiOp.exe
  C:\Windows\System\qfeyiOp.exe
  2⤵
  PID:5840
- C:\Windows\System\MzlLCxg.exe
  C:\Windows\System\MzlLCxg.exe
  2⤵
  PID:5856
- C:\Windows\System\BbkkUoE.exe
  C:\Windows\System\BbkkUoE.exe
  2⤵
  PID:5872
- C:\Windows\System\HEFrHke.exe
  C:\Windows\System\HEFrHke.exe
  2⤵
  PID:5888
- C:\Windows\System\viSduQI.exe
  C:\Windows\System\viSduQI.exe
  2⤵
  PID:5904
- C:\Windows\System\gQEGCfX.exe
  C:\Windows\System\gQEGCfX.exe
  2⤵
  PID:5924
- C:\Windows\System\SeoONjw.exe
  C:\Windows\System\SeoONjw.exe
  2⤵
  PID:5940
- C:\Windows\System\nQLmULg.exe
  C:\Windows\System\nQLmULg.exe
  2⤵
  PID:5956
- C:\Windows\System\kvbMfke.exe
  C:\Windows\System\kvbMfke.exe
  2⤵
  PID:5972
- C:\Windows\System\QukHyFi.exe
  C:\Windows\System\QukHyFi.exe
  2⤵
  PID:5988
- C:\Windows\System\TlGcDhG.exe
  C:\Windows\System\TlGcDhG.exe
  2⤵
  PID:6004
- C:\Windows\System\yNEgXwv.exe
  C:\Windows\System\yNEgXwv.exe
  2⤵
  PID:6020
- C:\Windows\System\kEyvsBY.exe
  C:\Windows\System\kEyvsBY.exe
  2⤵
  PID:6036
- C:\Windows\System\auTEMQL.exe
  C:\Windows\System\auTEMQL.exe
  2⤵
  PID:6052
- C:\Windows\System\FQkMzmS.exe
  C:\Windows\System\FQkMzmS.exe
  2⤵
  PID:6068
- C:\Windows\System\fUJGpbh.exe
  C:\Windows\System\fUJGpbh.exe
  2⤵
  PID:6084
- C:\Windows\System\nHkjaLk.exe
  C:\Windows\System\nHkjaLk.exe
  2⤵
  PID:6100
- C:\Windows\System\ZjhnEir.exe
  C:\Windows\System\ZjhnEir.exe
  2⤵
  PID:6116
- C:\Windows\System\jPhQWyJ.exe
  C:\Windows\System\jPhQWyJ.exe
  2⤵
  PID:6132
- C:\Windows\System\ZqxLBuF.exe
  C:\Windows\System\ZqxLBuF.exe
  2⤵
  PID:4936
- C:\Windows\System\qXIimnd.exe
  C:\Windows\System\qXIimnd.exe
  2⤵
  PID:4328
- C:\Windows\System\wNNtPsC.exe
  C:\Windows\System\wNNtPsC.exe
  2⤵
  PID:4520
- C:\Windows\System\kYDItHF.exe
  C:\Windows\System\kYDItHF.exe
  2⤵
  PID:3460
- C:\Windows\System\FzmpgcX.exe
  C:\Windows\System\FzmpgcX.exe
  2⤵
  PID:5128
- C:\Windows\System\KiIAZdP.exe
  C:\Windows\System\KiIAZdP.exe
  2⤵
  PID:4920
- C:\Windows\System\yCzDgzw.exe
  C:\Windows\System\yCzDgzw.exe
  2⤵
  PID:5192
- C:\Windows\System\xHEnkMz.exe
  C:\Windows\System\xHEnkMz.exe
  2⤵
  PID:5256
- C:\Windows\System\wHbbQMy.exe
  C:\Windows\System\wHbbQMy.exe
  2⤵
  PID:5320
- C:\Windows\System\ekIVrmk.exe
  C:\Windows\System\ekIVrmk.exe
  2⤵
  PID:5384
- C:\Windows\System\yMQHCyt.exe
  C:\Windows\System\yMQHCyt.exe
  2⤵
  PID:4388
- C:\Windows\System\ovtdSfg.exe
  C:\Windows\System\ovtdSfg.exe
  2⤵
  PID:4180
- C:\Windows\System\xKxadWB.exe
  C:\Windows\System\xKxadWB.exe
  2⤵
  PID:5480
- C:\Windows\System\iVAwERX.exe
  C:\Windows\System\iVAwERX.exe
  2⤵
  PID:5544
- C:\Windows\System\nLKuHbS.exe
  C:\Windows\System\nLKuHbS.exe
  2⤵
  PID:5608
- C:\Windows\System\iJZVrKx.exe
  C:\Windows\System\iJZVrKx.exe
  2⤵
  PID:5672
- C:\Windows\System\bZiLkDG.exe
  C:\Windows\System\bZiLkDG.exe
  2⤵
  PID:5708
- C:\Windows\System\mDUIWmP.exe
  C:\Windows\System\mDUIWmP.exe
  2⤵
  PID:5772
- C:\Windows\System\UmkWULo.exe
  C:\Windows\System\UmkWULo.exe
  2⤵
  PID:4996
- C:\Windows\System\cWluJXS.exe
  C:\Windows\System\cWluJXS.exe
  2⤵
  PID:1628
- C:\Windows\System\mRPDDMM.exe
  C:\Windows\System\mRPDDMM.exe
  2⤵
  PID:2100
- C:\Windows\System\tXSWmCp.exe
  C:\Windows\System\tXSWmCp.exe
  2⤵
  PID:4564
- C:\Windows\System\rdKJUce.exe
  C:\Windows\System\rdKJUce.exe
  2⤵
  PID:5140
- C:\Windows\System\nFtcWYW.exe
  C:\Windows\System\nFtcWYW.exe
  2⤵
  PID:5268
- C:\Windows\System\msSHzFQ.exe
  C:\Windows\System\msSHzFQ.exe
  2⤵
  PID:5332
- C:\Windows\System\FMjfuTV.exe
  C:\Windows\System\FMjfuTV.exe
  2⤵
  PID:5236
- C:\Windows\System\jwksaIf.exe
  C:\Windows\System\jwksaIf.exe
  2⤵
  PID:5400
- C:\Windows\System\vdMQtmb.exe
  C:\Windows\System\vdMQtmb.exe
  2⤵
  PID:5864
- C:\Windows\System\HpTgVeq.exe
  C:\Windows\System\HpTgVeq.exe
  2⤵
  PID:5932
- C:\Windows\System\tYQGbJE.exe
  C:\Windows\System\tYQGbJE.exe
  2⤵
  PID:5496
- C:\Windows\System\fmfvxjm.exe
  C:\Windows\System\fmfvxjm.exe
  2⤵
  PID:5560
- C:\Windows\System\UbNVDDT.exe
  C:\Windows\System\UbNVDDT.exe
  2⤵
  PID:5624
- C:\Windows\System\XCAyXsv.exe
  C:\Windows\System\XCAyXsv.exe
  2⤵
  PID:5688
- C:\Windows\System\UsqbaBQ.exe
  C:\Windows\System\UsqbaBQ.exe
  2⤵
  PID:5752
- C:\Windows\System\qkcHIPY.exe
  C:\Windows\System\qkcHIPY.exe
  2⤵
  PID:5816
- C:\Windows\System\MdbkFUZ.exe
  C:\Windows\System\MdbkFUZ.exe
  2⤵
  PID:5996
- C:\Windows\System\XDfSMwI.exe
  C:\Windows\System\XDfSMwI.exe
  2⤵
  PID:6032
- C:\Windows\System\ghDJtem.exe
  C:\Windows\System\ghDJtem.exe
  2⤵
  PID:5848
- C:\Windows\System\LbBKRpM.exe
  C:\Windows\System\LbBKRpM.exe
  2⤵
  PID:5980
- C:\Windows\System\yJbImJa.exe
  C:\Windows\System\yJbImJa.exe
  2⤵
  PID:5920
- C:\Windows\System\chJkvsU.exe
  C:\Windows\System\chJkvsU.exe
  2⤵
  PID:6124
- C:\Windows\System\VGSFefp.exe
  C:\Windows\System\VGSFefp.exe
  2⤵
  PID:6012
- C:\Windows\System\xmIPfrT.exe
  C:\Windows\System\xmIPfrT.exe
  2⤵
  PID:5032
- C:\Windows\System\VVYyDKu.exe
  C:\Windows\System\VVYyDKu.exe
  2⤵
  PID:4744
- C:\Windows\System\jeEhKAx.exe
  C:\Windows\System\jeEhKAx.exe
  2⤵
  PID:4792
- C:\Windows\System\CcQZFpK.exe
  C:\Windows\System\CcQZFpK.exe
  2⤵
  PID:5224
- C:\Windows\System\ixCndXX.exe
  C:\Windows\System\ixCndXX.exe
  2⤵
  PID:4456
- C:\Windows\System\OMPyhCg.exe
  C:\Windows\System\OMPyhCg.exe
  2⤵
  PID:5352
- C:\Windows\System\rfPDJjW.exe
  C:\Windows\System\rfPDJjW.exe
  2⤵
  PID:5512
- C:\Windows\System\TRoHTVr.exe
  C:\Windows\System\TRoHTVr.exe
  2⤵
  PID:5444
- C:\Windows\System\NkOvBFg.exe
  C:\Windows\System\NkOvBFg.exe
  2⤵
  PID:5092
- C:\Windows\System\yHbNTrf.exe
  C:\Windows\System\yHbNTrf.exe
  2⤵
  PID:5804
- C:\Windows\System\qWwqeap.exe
  C:\Windows\System\qWwqeap.exe
  2⤵
  PID:4868
- C:\Windows\System\NaXmlaJ.exe
  C:\Windows\System\NaXmlaJ.exe
  2⤵
  PID:5172
- C:\Windows\System\XqAYZiK.exe
  C:\Windows\System\XqAYZiK.exe
  2⤵
  PID:2196
- C:\Windows\System\FFLEmXT.exe
  C:\Windows\System\FFLEmXT.exe
  2⤵
  PID:4164
- C:\Windows\System\igwmGSh.exe
  C:\Windows\System\igwmGSh.exe
  2⤵
  PID:5396
- C:\Windows\System\pxAwzYM.exe
  C:\Windows\System\pxAwzYM.exe
  2⤵
  PID:5460
- C:\Windows\System\mzLsorM.exe
  C:\Windows\System\mzLsorM.exe
  2⤵
  PID:5720
- C:\Windows\System\ZkEFZGF.exe
  C:\Windows\System\ZkEFZGF.exe
  2⤵
  PID:6064
- C:\Windows\System\GUWwEXR.exe
  C:\Windows\System\GUWwEXR.exe
  2⤵
  PID:6044
- C:\Windows\System\CfwACmN.exe
  C:\Windows\System\CfwACmN.exe
  2⤵
  PID:5656
- C:\Windows\System\TwIRTEh.exe
  C:\Windows\System\TwIRTEh.exe
  2⤵
  PID:5660
- C:\Windows\System\jnLFQES.exe
  C:\Windows\System\jnLFQES.exe
  2⤵
  PID:5880
- C:\Windows\System\gxDXuRf.exe
  C:\Windows\System\gxDXuRf.exe
  2⤵
  PID:6096
- C:\Windows\System\uHBmJub.exe
  C:\Windows\System\uHBmJub.exe
  2⤵
  PID:4884
- C:\Windows\System\TXagWRb.exe
  C:\Windows\System\TXagWRb.exe
  2⤵
  PID:5640
- C:\Windows\System\HjKdlrG.exe
  C:\Windows\System\HjKdlrG.exe
  2⤵
  PID:4632
- C:\Windows\System\JPQLqFf.exe
  C:\Windows\System\JPQLqFf.exe
  2⤵
  PID:5900
- C:\Windows\System\OwrkESg.exe
  C:\Windows\System\OwrkESg.exe
  2⤵
  PID:4152
- C:\Windows\System\nhhUbEN.exe
  C:\Windows\System\nhhUbEN.exe
  2⤵
  PID:5580
- C:\Windows\System\MavWgNg.exe
  C:\Windows\System\MavWgNg.exe
  2⤵
  PID:5304
- C:\Windows\System\iJiqaCq.exe
  C:\Windows\System\iJiqaCq.exe
  2⤵
  PID:5820
- C:\Windows\System\XnGEcwz.exe
  C:\Windows\System\XnGEcwz.exe
  2⤵
  PID:5912
- C:\Windows\System\RUMVfNQ.exe
  C:\Windows\System\RUMVfNQ.exe
  2⤵
  PID:6028
- C:\Windows\System\qBgXUqA.exe
  C:\Windows\System\qBgXUqA.exe
  2⤵
  PID:5096
- C:\Windows\System\fqigfvr.exe
  C:\Windows\System\fqigfvr.exe
  2⤵
  PID:5208
- C:\Windows\System\kEoHiAw.exe
  C:\Windows\System\kEoHiAw.exe
  2⤵
  PID:6156
- C:\Windows\System\XUTAeOG.exe
  C:\Windows\System\XUTAeOG.exe
  2⤵
  PID:6172
- C:\Windows\System\ucMzczJ.exe
  C:\Windows\System\ucMzczJ.exe
  2⤵
  PID:6188
- C:\Windows\System\sGibeAK.exe
  C:\Windows\System\sGibeAK.exe
  2⤵
  PID:6204
- C:\Windows\System\bLmqBch.exe
  C:\Windows\System\bLmqBch.exe
  2⤵
  PID:6224
- C:\Windows\System\jABgZRU.exe
  C:\Windows\System\jABgZRU.exe
  2⤵
  PID:6240
- C:\Windows\System\JPBwgAn.exe
  C:\Windows\System\JPBwgAn.exe
  2⤵
  PID:6256
- C:\Windows\System\ZSoBVXl.exe
  C:\Windows\System\ZSoBVXl.exe
  2⤵
  PID:6272
- C:\Windows\System\HmbbolF.exe
  C:\Windows\System\HmbbolF.exe
  2⤵
  PID:6288
- C:\Windows\System\gWMexXG.exe
  C:\Windows\System\gWMexXG.exe
  2⤵
  PID:6304
- C:\Windows\System\mCrAXfh.exe
  C:\Windows\System\mCrAXfh.exe
  2⤵
  PID:6320
- C:\Windows\System\JHPPEcM.exe
  C:\Windows\System\JHPPEcM.exe
  2⤵
  PID:6336
- C:\Windows\System\tcolJGd.exe
  C:\Windows\System\tcolJGd.exe
  2⤵
  PID:6352
- C:\Windows\System\LtZGykO.exe
  C:\Windows\System\LtZGykO.exe
  2⤵
  PID:6368
- C:\Windows\System\xOYBetd.exe
  C:\Windows\System\xOYBetd.exe
  2⤵
  PID:6384
- C:\Windows\System\rVGBWEM.exe
  C:\Windows\System\rVGBWEM.exe
  2⤵
  PID:6400
- C:\Windows\System\KUKDPWV.exe
  C:\Windows\System\KUKDPWV.exe
  2⤵
  PID:6416
- C:\Windows\System\oxSiskJ.exe
  C:\Windows\System\oxSiskJ.exe
  2⤵
  PID:6432
- C:\Windows\System\bneDgNF.exe
  C:\Windows\System\bneDgNF.exe
  2⤵
  PID:6448
- C:\Windows\System\lztCfti.exe
  C:\Windows\System\lztCfti.exe
  2⤵
  PID:6464
- C:\Windows\System\cURWDdo.exe
  C:\Windows\System\cURWDdo.exe
  2⤵
  PID:6480
- C:\Windows\System\nczSyWx.exe
  C:\Windows\System\nczSyWx.exe
  2⤵
  PID:6496
- C:\Windows\System\YUjMldf.exe
  C:\Windows\System\YUjMldf.exe
  2⤵
  PID:6512
- C:\Windows\System\juRReVJ.exe
  C:\Windows\System\juRReVJ.exe
  2⤵
  PID:6528
- C:\Windows\System\YjPzRsJ.exe
  C:\Windows\System\YjPzRsJ.exe
  2⤵
  PID:6544
- C:\Windows\System\BzYFiIw.exe
  C:\Windows\System\BzYFiIw.exe
  2⤵
  PID:6560
- C:\Windows\System\nhfiEUR.exe
  C:\Windows\System\nhfiEUR.exe
  2⤵
  PID:6576
- C:\Windows\System\XqlqJaZ.exe
  C:\Windows\System\XqlqJaZ.exe
  2⤵
  PID:6592
- C:\Windows\System\pYYhvkU.exe
  C:\Windows\System\pYYhvkU.exe
  2⤵
  PID:6608
- C:\Windows\System\YuAPVbM.exe
  C:\Windows\System\YuAPVbM.exe
  2⤵
  PID:6624
- C:\Windows\System\kllNNka.exe
  C:\Windows\System\kllNNka.exe
  2⤵
  PID:6640
- C:\Windows\System\TnDvNAO.exe
  C:\Windows\System\TnDvNAO.exe
  2⤵
  PID:6656
- C:\Windows\System\HReJTDl.exe
  C:\Windows\System\HReJTDl.exe
  2⤵
  PID:6672
- C:\Windows\System\FJXxtCX.exe
  C:\Windows\System\FJXxtCX.exe
  2⤵
  PID:6688
- C:\Windows\System\NKlWxHJ.exe
  C:\Windows\System\NKlWxHJ.exe
  2⤵
  PID:6704
- C:\Windows\System\iWuoeDZ.exe
  C:\Windows\System\iWuoeDZ.exe
  2⤵
  PID:6720
- C:\Windows\System\lhMNodc.exe
  C:\Windows\System\lhMNodc.exe
  2⤵
  PID:6736
- C:\Windows\System\RMeaRZs.exe
  C:\Windows\System\RMeaRZs.exe
  2⤵
  PID:6752
- C:\Windows\System\vOANXNR.exe
  C:\Windows\System\vOANXNR.exe
  2⤵
  PID:6768
- C:\Windows\System\QqpNszi.exe
  C:\Windows\System\QqpNszi.exe
  2⤵
  PID:6784
- C:\Windows\System\uQlNsWr.exe
  C:\Windows\System\uQlNsWr.exe
  2⤵
  PID:6800
- C:\Windows\System\tYoJwvc.exe
  C:\Windows\System\tYoJwvc.exe
  2⤵
  PID:6816
- C:\Windows\System\inDXFUZ.exe
  C:\Windows\System\inDXFUZ.exe
  2⤵
  PID:6832
- C:\Windows\System\pGKPUiV.exe
  C:\Windows\System\pGKPUiV.exe
  2⤵
  PID:6848
- C:\Windows\System\owJjZzw.exe
  C:\Windows\System\owJjZzw.exe
  2⤵
  PID:6864
- C:\Windows\System\mkNZdMl.exe
  C:\Windows\System\mkNZdMl.exe
  2⤵
  PID:6880
- C:\Windows\System\gUmPlUf.exe
  C:\Windows\System\gUmPlUf.exe
  2⤵
  PID:6896
- C:\Windows\System\ApzYwfe.exe
  C:\Windows\System\ApzYwfe.exe
  2⤵
  PID:6912
- C:\Windows\System\UxMwMaS.exe
  C:\Windows\System\UxMwMaS.exe
  2⤵
  PID:6928
- C:\Windows\System\vWBVVhh.exe
  C:\Windows\System\vWBVVhh.exe
  2⤵
  PID:6944
- C:\Windows\System\oaQYpOo.exe
  C:\Windows\System\oaQYpOo.exe
  2⤵
  PID:6960
- C:\Windows\System\IYynBtV.exe
  C:\Windows\System\IYynBtV.exe
  2⤵
  PID:6976
- C:\Windows\System\YIKrInS.exe
  C:\Windows\System\YIKrInS.exe
  2⤵
  PID:6992
- C:\Windows\System\tNYPrHY.exe
  C:\Windows\System\tNYPrHY.exe
  2⤵
  PID:7008
- C:\Windows\System\PymkKJe.exe
  C:\Windows\System\PymkKJe.exe
  2⤵
  PID:7024
- C:\Windows\System\kJuorag.exe
  C:\Windows\System\kJuorag.exe
  2⤵
  PID:7040
- C:\Windows\System\KhMaBZE.exe
  C:\Windows\System\KhMaBZE.exe
  2⤵
  PID:7056
- C:\Windows\System\mCKnOEb.exe
  C:\Windows\System\mCKnOEb.exe
  2⤵
  PID:7076
- C:\Windows\System\irUwDCa.exe
  C:\Windows\System\irUwDCa.exe
  2⤵
  PID:7092
- C:\Windows\System\NinOtlJ.exe
  C:\Windows\System\NinOtlJ.exe
  2⤵
  PID:7108
- C:\Windows\System\aUshWtG.exe
  C:\Windows\System\aUshWtG.exe
  2⤵
  PID:7124
- C:\Windows\System\oglgOdH.exe
  C:\Windows\System\oglgOdH.exe
  2⤵
  PID:7140
- C:\Windows\System\XmsGNzH.exe
  C:\Windows\System\XmsGNzH.exe
  2⤵
  PID:7156
- C:\Windows\System\AhrBAda.exe
  C:\Windows\System\AhrBAda.exe
  2⤵
  PID:6128
- C:\Windows\System\jzNfjIH.exe
  C:\Windows\System\jzNfjIH.exe
  2⤵
  PID:6180
- C:\Windows\System\mOIEqMO.exe
  C:\Windows\System\mOIEqMO.exe
  2⤵
  PID:3564
- C:\Windows\System\YNuBcIa.exe
  C:\Windows\System\YNuBcIa.exe
  2⤵
  PID:4116
- C:\Windows\System\envdtLN.exe
  C:\Windows\System\envdtLN.exe
  2⤵
  PID:5448
- C:\Windows\System\mPUHXOo.exe
  C:\Windows\System\mPUHXOo.exe
  2⤵
  PID:5160
- C:\Windows\System\xaYDRDb.exe
  C:\Windows\System\xaYDRDb.exe
  2⤵
  PID:6196
- C:\Windows\System\SGfmpnO.exe
  C:\Windows\System\SGfmpnO.exe
  2⤵
  PID:6264
- C:\Windows\System\KJAJsQY.exe
  C:\Windows\System\KJAJsQY.exe
  2⤵
  PID:6332
- C:\Windows\System\kotkRxF.exe
  C:\Windows\System\kotkRxF.exe
  2⤵
  PID:6248
- C:\Windows\System\SYAJiOW.exe
  C:\Windows\System\SYAJiOW.exe
  2⤵
  PID:6316
- C:\Windows\System\YYheApR.exe
  C:\Windows\System\YYheApR.exe
  2⤵
  PID:6380
- C:\Windows\System\VtpPzYe.exe
  C:\Windows\System\VtpPzYe.exe
  2⤵
  PID:6408
- C:\Windows\System\OJtegZW.exe
  C:\Windows\System\OJtegZW.exe
  2⤵
  PID:6428
- C:\Windows\System\QBLlRKN.exe
  C:\Windows\System\QBLlRKN.exe
  2⤵
  PID:6472
- C:\Windows\System\bYETSaX.exe
  C:\Windows\System\bYETSaX.exe
  2⤵
  PID:6540
- C:\Windows\System\aTEgMVX.exe
  C:\Windows\System\aTEgMVX.exe
  2⤵
  PID:6572
- C:\Windows\System\CxhooVh.exe
  C:\Windows\System\CxhooVh.exe
  2⤵
  PID:6636
- C:\Windows\System\zSPnTNB.exe
  C:\Windows\System\zSPnTNB.exe
  2⤵
  PID:6700
- C:\Windows\System\bkHcKfX.exe
  C:\Windows\System\bkHcKfX.exe
  2⤵
  PID:6460
- C:\Windows\System\akCKRFL.exe
  C:\Windows\System\akCKRFL.exe
  2⤵
  PID:6732
- C:\Windows\System\PzvncRK.exe
  C:\Windows\System\PzvncRK.exe
  2⤵
  PID:6556
- C:\Windows\System\fkkeeDB.exe
  C:\Windows\System\fkkeeDB.exe
  2⤵
  PID:6648
- C:\Windows\System\IecBIPR.exe
  C:\Windows\System\IecBIPR.exe
  2⤵
  PID:6680
- C:\Windows\System\YPGLHZq.exe
  C:\Windows\System\YPGLHZq.exe
  2⤵
  PID:6716
- C:\Windows\System\cUILEfS.exe
  C:\Windows\System\cUILEfS.exe
  2⤵
  PID:6808
- C:\Windows\System\ZRbfrKg.exe
  C:\Windows\System\ZRbfrKg.exe
  2⤵
  PID:6860
- C:\Windows\System\aLqHBjy.exe
  C:\Windows\System\aLqHBjy.exe
  2⤵
  PID:6872
- C:\Windows\System\afGcGuJ.exe
  C:\Windows\System\afGcGuJ.exe
  2⤵
  PID:6924
- C:\Windows\System\oLSzNOt.exe
  C:\Windows\System\oLSzNOt.exe
  2⤵
  PID:6904
- C:\Windows\System\cpWERsc.exe
  C:\Windows\System\cpWERsc.exe
  2⤵
  PID:6968
- C:\Windows\System\IkYMlHY.exe
  C:\Windows\System\IkYMlHY.exe
  2⤵
  PID:7032
- C:\Windows\System\FjFHkDz.exe
  C:\Windows\System\FjFHkDz.exe
  2⤵
  PID:7020
- C:\Windows\System\UedtjSQ.exe
  C:\Windows\System\UedtjSQ.exe
  2⤵
  PID:7084
- C:\Windows\System\qeoqpoc.exe
  C:\Windows\System\qeoqpoc.exe
  2⤵
  PID:7072
- C:\Windows\System\uOSoSwL.exe
  C:\Windows\System\uOSoSwL.exe
  2⤵
  PID:7148
- C:\Windows\System\yZemkgA.exe
  C:\Windows\System\yZemkgA.exe
  2⤵
  PID:7164
- C:\Windows\System\xmksEMy.exe
  C:\Windows\System\xmksEMy.exe
  2⤵
  PID:5528
- C:\Windows\System\KwPpsjm.exe
  C:\Windows\System\KwPpsjm.exe
  2⤵
  PID:5596
- C:\Windows\System\UKiCBJq.exe
  C:\Windows\System\UKiCBJq.exe
  2⤵
  PID:5768
- C:\Windows\System\JTNnfdh.exe
  C:\Windows\System\JTNnfdh.exe
  2⤵
  PID:6296
- C:\Windows\System\wSbYuzQ.exe
  C:\Windows\System\wSbYuzQ.exe
  2⤵
  PID:6376
- C:\Windows\System\UnynDjn.exe
  C:\Windows\System\UnynDjn.exe
  2⤵
  PID:6536
- C:\Windows\System\ESFRMEj.exe
  C:\Windows\System\ESFRMEj.exe
  2⤵
  PID:6476
- C:\Windows\System\RTQOJHl.exe
  C:\Windows\System\RTQOJHl.exe
  2⤵
  PID:6444
- C:\Windows\System\RERVoZG.exe
  C:\Windows\System\RERVoZG.exe
  2⤵
  PID:6696
- C:\Windows\System\vkoaNTp.exe
  C:\Windows\System\vkoaNTp.exe
  2⤵
  PID:6524
- C:\Windows\System\kvJRAUh.exe
  C:\Windows\System\kvJRAUh.exe
  2⤵
  PID:6764
- C:\Windows\System\gPKnXuE.exe
  C:\Windows\System\gPKnXuE.exe
  2⤵
  PID:6616
- C:\Windows\System\PvSClzS.exe
  C:\Windows\System\PvSClzS.exe
  2⤵
  PID:6780
- C:\Windows\System\xhyscOh.exe
  C:\Windows\System\xhyscOh.exe
  2⤵
  PID:6856
- C:\Windows\System\nCgLPsf.exe
  C:\Windows\System\nCgLPsf.exe
  2⤵
  PID:7004
- C:\Windows\System\IPqUGju.exe
  C:\Windows\System\IPqUGju.exe
  2⤵
  PID:7104
- C:\Windows\System\jntMjJu.exe
  C:\Windows\System\jntMjJu.exe
  2⤵
  PID:6988
- C:\Windows\System\QynzmTD.exe
  C:\Windows\System\QynzmTD.exe
  2⤵
  PID:7068
- C:\Windows\System\jFvvmQF.exe
  C:\Windows\System\jFvvmQF.exe
  2⤵
  PID:5916
- C:\Windows\System\kVevJeX.exe
  C:\Windows\System\kVevJeX.exe
  2⤵
  PID:7132
- C:\Windows\System\TWhHRqv.exe
  C:\Windows\System\TWhHRqv.exe
  2⤵
  PID:6168
- C:\Windows\System\jgqAFAu.exe
  C:\Windows\System\jgqAFAu.exe
  2⤵
  PID:6424
- C:\Windows\System\KmlkCDp.exe
  C:\Windows\System\KmlkCDp.exe
  2⤵
  PID:6488
- C:\Windows\System\saQTfNO.exe
  C:\Windows\System\saQTfNO.exe
  2⤵
  PID:6440
- C:\Windows\System\falUEun.exe
  C:\Windows\System\falUEun.exe
  2⤵
  PID:7120
- C:\Windows\System\zrHMbLN.exe
  C:\Windows\System\zrHMbLN.exe
  2⤵
  PID:4264
- C:\Windows\System\BLBVohh.exe
  C:\Windows\System\BLBVohh.exe
  2⤵
  PID:6152
- C:\Windows\System\AxGEFyO.exe
  C:\Windows\System\AxGEFyO.exe
  2⤵
  PID:6232
- C:\Windows\System\ahXkuqq.exe
  C:\Windows\System\ahXkuqq.exe
  2⤵
  PID:6236
- C:\Windows\System\GKLCiak.exe
  C:\Windows\System\GKLCiak.exe
  2⤵
  PID:6312
- C:\Windows\System\gzrFFdt.exe
  C:\Windows\System\gzrFFdt.exe
  2⤵
  PID:6588
- C:\Windows\System\PDOTTXn.exe
  C:\Windows\System\PDOTTXn.exe
  2⤵
  PID:6492
- C:\Windows\System\DOKarvI.exe
  C:\Windows\System\DOKarvI.exe
  2⤵
  PID:6652
- C:\Windows\System\AvnKPIJ.exe
  C:\Windows\System\AvnKPIJ.exe
  2⤵
  PID:6684
- C:\Windows\System\HmhlsUN.exe
  C:\Windows\System\HmhlsUN.exe
  2⤵
  PID:6920
- C:\Windows\System\JxYknKT.exe
  C:\Windows\System\JxYknKT.exe
  2⤵
  PID:7180
- C:\Windows\System\yWseETs.exe
  C:\Windows\System\yWseETs.exe
  2⤵
  PID:7196
- C:\Windows\System\zYIbnwz.exe
  C:\Windows\System\zYIbnwz.exe
  2⤵
  PID:7212
- C:\Windows\System\fsBrqwP.exe
  C:\Windows\System\fsBrqwP.exe
  2⤵
  PID:7228
- C:\Windows\System\lKEsUqs.exe
  C:\Windows\System\lKEsUqs.exe
  2⤵
  PID:7244
- C:\Windows\System\qQpRGTM.exe
  C:\Windows\System\qQpRGTM.exe
  2⤵
  PID:7260
- C:\Windows\System\AJOFFRG.exe
  C:\Windows\System\AJOFFRG.exe
  2⤵
  PID:7276
- C:\Windows\System\lpFNjdI.exe
  C:\Windows\System\lpFNjdI.exe
  2⤵
  PID:7296
- C:\Windows\System\qKlyRmX.exe
  C:\Windows\System\qKlyRmX.exe
  2⤵
  PID:7312
- C:\Windows\System\LNCirNc.exe
  C:\Windows\System\LNCirNc.exe
  2⤵
  PID:7328
- C:\Windows\System\MMbzKem.exe
  C:\Windows\System\MMbzKem.exe
  2⤵
  PID:7344
- C:\Windows\System\ZPesMJL.exe
  C:\Windows\System\ZPesMJL.exe
  2⤵
  PID:7360
- C:\Windows\System\EMlzRqg.exe
  C:\Windows\System\EMlzRqg.exe
  2⤵
  PID:7376
- C:\Windows\System\oikPBQJ.exe
  C:\Windows\System\oikPBQJ.exe
  2⤵
  PID:7392
- C:\Windows\System\kPBOwKA.exe
  C:\Windows\System\kPBOwKA.exe
  2⤵
  PID:7408
- C:\Windows\System\kltCNnd.exe
  C:\Windows\System\kltCNnd.exe
  2⤵
  PID:7424
- C:\Windows\System\IVGoNKx.exe
  C:\Windows\System\IVGoNKx.exe
  2⤵
  PID:7444
- C:\Windows\System\ZNCbcJT.exe
  C:\Windows\System\ZNCbcJT.exe
  2⤵
  PID:7460
- C:\Windows\System\DUEcUAK.exe
  C:\Windows\System\DUEcUAK.exe
  2⤵
  PID:7476
- C:\Windows\System\zPpnOBc.exe
  C:\Windows\System\zPpnOBc.exe
  2⤵
  PID:7492
- C:\Windows\System\VYtHtvU.exe
  C:\Windows\System\VYtHtvU.exe
  2⤵
  PID:7508
- C:\Windows\System\gNicvvS.exe
  C:\Windows\System\gNicvvS.exe
  2⤵
  PID:7524
- C:\Windows\System\TQcOfGE.exe
  C:\Windows\System\TQcOfGE.exe
  2⤵
  PID:7540
- C:\Windows\System\cLPraIi.exe
  C:\Windows\System\cLPraIi.exe
  2⤵
  PID:7556
- C:\Windows\System\BnGNwSi.exe
  C:\Windows\System\BnGNwSi.exe
  2⤵
  PID:7572
- C:\Windows\System\QGGWtbH.exe
  C:\Windows\System\QGGWtbH.exe
  2⤵
  PID:7588
- C:\Windows\System\SdbSdaL.exe
  C:\Windows\System\SdbSdaL.exe
  2⤵
  PID:7604
- C:\Windows\System\JrrCGIW.exe
  C:\Windows\System\JrrCGIW.exe
  2⤵
  PID:7624
- C:\Windows\System\WvDARkB.exe
  C:\Windows\System\WvDARkB.exe
  2⤵
  PID:7640
- C:\Windows\System\gWavGbR.exe
  C:\Windows\System\gWavGbR.exe
  2⤵
  PID:7656
- C:\Windows\System\LPBIReU.exe
  C:\Windows\System\LPBIReU.exe
  2⤵
  PID:7672
- C:\Windows\System\JVFQCqD.exe
  C:\Windows\System\JVFQCqD.exe
  2⤵
  PID:7688
- C:\Windows\System\fCwTuya.exe
  C:\Windows\System\fCwTuya.exe
  2⤵
  PID:7704
- C:\Windows\System\pQWFqVw.exe
  C:\Windows\System\pQWFqVw.exe
  2⤵
  PID:7720
- C:\Windows\System\CwzFyfj.exe
  C:\Windows\System\CwzFyfj.exe
  2⤵
  PID:7736
- C:\Windows\System\JzvFkYH.exe
  C:\Windows\System\JzvFkYH.exe
  2⤵
  PID:7752
- C:\Windows\System\dNfBniI.exe
  C:\Windows\System\dNfBniI.exe
  2⤵
  PID:7768
- C:\Windows\System\HZgSfTN.exe
  C:\Windows\System\HZgSfTN.exe
  2⤵
  PID:7784
- C:\Windows\System\zsEkzLo.exe
  C:\Windows\System\zsEkzLo.exe
  2⤵
  PID:7800
- C:\Windows\System\MaVLkhN.exe
  C:\Windows\System\MaVLkhN.exe
  2⤵
  PID:7816
- C:\Windows\System\hoFsHVz.exe
  C:\Windows\System\hoFsHVz.exe
  2⤵
  PID:7836
- C:\Windows\System\aFhcjax.exe
  C:\Windows\System\aFhcjax.exe
  2⤵
  PID:7852
- C:\Windows\System\peehjan.exe
  C:\Windows\System\peehjan.exe
  2⤵
  PID:7868
- C:\Windows\System\tkDcIZM.exe
  C:\Windows\System\tkDcIZM.exe
  2⤵
  PID:7884
- C:\Windows\System\gFfJFfz.exe
  C:\Windows\System\gFfJFfz.exe
  2⤵
  PID:7900
- C:\Windows\System\tIfjKKn.exe
  C:\Windows\System\tIfjKKn.exe
  2⤵
  PID:7916
- C:\Windows\System\nvnUPxO.exe
  C:\Windows\System\nvnUPxO.exe
  2⤵
  PID:7932
- C:\Windows\System\bzmaEhP.exe
  C:\Windows\System\bzmaEhP.exe
  2⤵
  PID:7948
- C:\Windows\System\PKCJfLe.exe
  C:\Windows\System\PKCJfLe.exe
  2⤵
  PID:7968
- C:\Windows\System\fzcmCwJ.exe
  C:\Windows\System\fzcmCwJ.exe
  2⤵
  PID:7984
- C:\Windows\System\ycdYkou.exe
  C:\Windows\System\ycdYkou.exe
  2⤵
  PID:8000
- C:\Windows\System\kCFXerJ.exe
  C:\Windows\System\kCFXerJ.exe
  2⤵
  PID:8016
- C:\Windows\System\zDXEPjv.exe
  C:\Windows\System\zDXEPjv.exe
  2⤵
  PID:8032
- C:\Windows\System\PaVSqvm.exe
  C:\Windows\System\PaVSqvm.exe
  2⤵
  PID:8048
- C:\Windows\System\DyCgKil.exe
  C:\Windows\System\DyCgKil.exe
  2⤵
  PID:8064
- C:\Windows\System\nIXRdYv.exe
  C:\Windows\System\nIXRdYv.exe
  2⤵
  PID:8080
- C:\Windows\System\NLIGLbP.exe
  C:\Windows\System\NLIGLbP.exe
  2⤵
  PID:8096
- C:\Windows\System\kjKBjhH.exe
  C:\Windows\System\kjKBjhH.exe
  2⤵
  PID:8112
- C:\Windows\System\BEajibQ.exe
  C:\Windows\System\BEajibQ.exe
  2⤵
  PID:8140
- C:\Windows\System\KETHmlt.exe
  C:\Windows\System\KETHmlt.exe
  2⤵
  PID:8160
- C:\Windows\System\BjGRSec.exe
  C:\Windows\System\BjGRSec.exe
  2⤵
  PID:8180
- C:\Windows\System\LmSsaYK.exe
  C:\Windows\System\LmSsaYK.exe
  2⤵
  PID:7116
- C:\Windows\System\jEkqGub.exe
  C:\Windows\System\jEkqGub.exe
  2⤵
  PID:7224
- C:\Windows\System\klZlSqr.exe
  C:\Windows\System\klZlSqr.exe
  2⤵
  PID:7388
- C:\Windows\System\WiiFRiI.exe
  C:\Windows\System\WiiFRiI.exe
  2⤵
  PID:7404
- C:\Windows\System\LEoMhiZ.exe
  C:\Windows\System\LEoMhiZ.exe
  2⤵
  PID:7596
- C:\Windows\System\leHYQdy.exe
  C:\Windows\System\leHYQdy.exe
  2⤵
  PID:7780
- C:\Windows\System\pHMtECY.exe
  C:\Windows\System\pHMtECY.exe
  2⤵
  PID:7996
- C:\Windows\System\EMYrhBs.exe
  C:\Windows\System\EMYrhBs.exe
  2⤵
  PID:8056
- C:\Windows\System\hFLREyT.exe
  C:\Windows\System\hFLREyT.exe
  2⤵
  PID:7500
- C:\Windows\System\jRUUyRs.exe
  C:\Windows\System\jRUUyRs.exe
  2⤵
  PID:7648
- C:\Windows\System\BLCHzDt.exe
  C:\Windows\System\BLCHzDt.exe
  2⤵
  PID:6828
- C:\Windows\System\MlvkxHX.exe
  C:\Windows\System\MlvkxHX.exe
  2⤵
  PID:7532
- C:\Windows\System\rkjyBbI.exe
  C:\Windows\System\rkjyBbI.exe
  2⤵
  PID:7256
- C:\Windows\System\yEdaRis.exe
  C:\Windows\System\yEdaRis.exe
  2⤵
  PID:7176
- C:\Windows\System\uUBVXwA.exe
  C:\Windows\System\uUBVXwA.exe
  2⤵
  PID:7744
- C:\Windows\System\PIMRuzg.exe
  C:\Windows\System\PIMRuzg.exe
  2⤵
  PID:7776
- C:\Windows\System\BicrAyK.exe
  C:\Windows\System\BicrAyK.exe
  2⤵
  PID:7824
- C:\Windows\System\IegEcRx.exe
  C:\Windows\System\IegEcRx.exe
  2⤵
  PID:7876
- C:\Windows\System\eVmfrpx.exe
  C:\Windows\System\eVmfrpx.exe
  2⤵
  PID:7896
- C:\Windows\System\ihKwPUO.exe
  C:\Windows\System\ihKwPUO.exe
  2⤵
  PID:7912
- C:\Windows\System\ohBMKJs.exe
  C:\Windows\System\ohBMKJs.exe
  2⤵
  PID:7760
- C:\Windows\System\eciZYTP.exe
  C:\Windows\System\eciZYTP.exe
  2⤵
  PID:7980
- C:\Windows\System\wMwGxKT.exe
  C:\Windows\System\wMwGxKT.exe
  2⤵
  PID:7956
- C:\Windows\System\HQuYZTF.exe
  C:\Windows\System\HQuYZTF.exe
  2⤵
  PID:7940
- C:\Windows\System\vXQkArK.exe
  C:\Windows\System\vXQkArK.exe
  2⤵
  PID:8012
- C:\Windows\System\kOsLWSb.exe
  C:\Windows\System\kOsLWSb.exe
  2⤵
  PID:7484
- C:\Windows\System\jaGWjRu.exe
  C:\Windows\System\jaGWjRu.exe
  2⤵
  PID:8076
- C:\Windows\System\xZMQBxg.exe
  C:\Windows\System\xZMQBxg.exe
  2⤵
  PID:8132
- C:\Windows\System\cdRpxzG.exe
  C:\Windows\System\cdRpxzG.exe
  2⤵
  PID:8148
- C:\Windows\System\ymWtLcu.exe
  C:\Windows\System\ymWtLcu.exe
  2⤵
  PID:6212
- C:\Windows\System\uNtPAxq.exe
  C:\Windows\System\uNtPAxq.exe
  2⤵
  PID:7220
- C:\Windows\System\UvIQjyR.exe
  C:\Windows\System\UvIQjyR.exe
  2⤵
  PID:7504
- C:\Windows\System\ASQMMHZ.exe
  C:\Windows\System\ASQMMHZ.exe
  2⤵
  PID:7456
- C:\Windows\System\Xgdiwdq.exe
  C:\Windows\System\Xgdiwdq.exe
  2⤵
  PID:7548
- C:\Windows\System\LKqOhHP.exe
  C:\Windows\System\LKqOhHP.exe
  2⤵
  PID:7384
- C:\Windows\System\bxbdkKY.exe
  C:\Windows\System\bxbdkKY.exe
  2⤵
  PID:7552
- C:\Windows\System\dWwlRDI.exe
  C:\Windows\System\dWwlRDI.exe
  2⤵
  PID:7536
- C:\Windows\System\fJNQnkd.exe
  C:\Windows\System\fJNQnkd.exe
  2⤵
  PID:7680
- C:\Windows\System\OyMFveL.exe
  C:\Windows\System\OyMFveL.exe
  2⤵
  PID:7636
- C:\Windows\System\glPxmsd.exe
  C:\Windows\System\glPxmsd.exe
  2⤵
  PID:7924
- C:\Windows\System\AIxfOIm.exe
  C:\Windows\System\AIxfOIm.exe
  2⤵
  PID:7700
- C:\Windows\System\IcuLesB.exe
  C:\Windows\System\IcuLesB.exe
  2⤵
  PID:7960
- C:\Windows\System\BiDUGjb.exe
  C:\Windows\System\BiDUGjb.exe
  2⤵
  PID:7964
- C:\Windows\System\BzZmIfL.exe
  C:\Windows\System\BzZmIfL.exe
  2⤵
  PID:8108
- C:\Windows\System\XltSmrm.exe
  C:\Windows\System\XltSmrm.exe
  2⤵
  PID:7616
- C:\Windows\System\hjVnWat.exe
  C:\Windows\System\hjVnWat.exe
  2⤵
  PID:7336
- C:\Windows\System\gOiHbVu.exe
  C:\Windows\System\gOiHbVu.exe
  2⤵
  PID:8188
- C:\Windows\System\BSJBuTZ.exe
  C:\Windows\System\BSJBuTZ.exe
  2⤵
  PID:7420
- C:\Windows\System\GwZVTYw.exe
  C:\Windows\System\GwZVTYw.exe
  2⤵
  PID:2728
- C:\Windows\System\IwhKUzc.exe
  C:\Windows\System\IwhKUzc.exe
  2⤵
  PID:7748
- C:\Windows\System\MpxGdOi.exe
  C:\Windows\System\MpxGdOi.exe
  2⤵
  PID:8176
- C:\Windows\System\AjwZKYy.exe
  C:\Windows\System\AjwZKYy.exe
  2⤵
  PID:7928
- C:\Windows\System\HuTHEoQ.exe
  C:\Windows\System\HuTHEoQ.exe
  2⤵
  PID:7828
- C:\Windows\System\EwYJVin.exe
  C:\Windows\System\EwYJVin.exe
  2⤵
  PID:8172
- C:\Windows\System\irLaZnz.exe
  C:\Windows\System\irLaZnz.exe
  2⤵
  PID:7796
- C:\Windows\System\oEAnEAR.exe
  C:\Windows\System\oEAnEAR.exe
  2⤵
  PID:7992
- C:\Windows\System\PoOMsoF.exe
  C:\Windows\System\PoOMsoF.exe
  2⤵
  PID:8028
- C:\Windows\System\dMKWguP.exe
  C:\Windows\System\dMKWguP.exe
  2⤵
  PID:8212
- C:\Windows\System\oKCPRvZ.exe
  C:\Windows\System\oKCPRvZ.exe
  2⤵
  PID:8228
- C:\Windows\System\LMKnSXc.exe
  C:\Windows\System\LMKnSXc.exe
  2⤵
  PID:8244
- C:\Windows\System\unoPWcc.exe
  C:\Windows\System\unoPWcc.exe
  2⤵
  PID:8260
- C:\Windows\System\aJCwOhR.exe
  C:\Windows\System\aJCwOhR.exe
  2⤵
  PID:8276
- C:\Windows\System\LvyIYxo.exe
  C:\Windows\System\LvyIYxo.exe
  2⤵
  PID:8292
- C:\Windows\System\sUlQttB.exe
  C:\Windows\System\sUlQttB.exe
  2⤵
  PID:8308
- C:\Windows\System\qdpDspY.exe
  C:\Windows\System\qdpDspY.exe
  2⤵
  PID:8324
- C:\Windows\System\JrGFJOo.exe
  C:\Windows\System\JrGFJOo.exe
  2⤵
  PID:8340
- C:\Windows\System\apoiMrm.exe
  C:\Windows\System\apoiMrm.exe
  2⤵
  PID:8356
- C:\Windows\System\dBhUsMi.exe
  C:\Windows\System\dBhUsMi.exe
  2⤵
  PID:8372
- C:\Windows\System\WdJDCPV.exe
  C:\Windows\System\WdJDCPV.exe
  2⤵
  PID:8388
- C:\Windows\System\VJTJBzB.exe
  C:\Windows\System\VJTJBzB.exe
  2⤵
  PID:8508
- C:\Windows\System\qQRzFPo.exe
  C:\Windows\System\qQRzFPo.exe
  2⤵
  PID:8528
- C:\Windows\System\UmWHwek.exe
  C:\Windows\System\UmWHwek.exe
  2⤵
  PID:8548
- C:\Windows\System\JkAGFhK.exe
  C:\Windows\System\JkAGFhK.exe
  2⤵
  PID:8564
- C:\Windows\System\xSjwkXP.exe
  C:\Windows\System\xSjwkXP.exe
  2⤵
  PID:8580
- C:\Windows\System\KmReFfU.exe
  C:\Windows\System\KmReFfU.exe
  2⤵
  PID:8596
- C:\Windows\System\NUZnwHR.exe
  C:\Windows\System\NUZnwHR.exe
  2⤵
  PID:8612
- C:\Windows\System\MmVQgPs.exe
  C:\Windows\System\MmVQgPs.exe
  2⤵
  PID:8628
- C:\Windows\System\ZyLTfHm.exe
  C:\Windows\System\ZyLTfHm.exe
  2⤵
  PID:8644
- C:\Windows\System\gAqwEMK.exe
  C:\Windows\System\gAqwEMK.exe
  2⤵
  PID:8660
- C:\Windows\System\sPbeEpd.exe
  C:\Windows\System\sPbeEpd.exe
  2⤵
  PID:8676
- C:\Windows\System\ypMdDoT.exe
  C:\Windows\System\ypMdDoT.exe
  2⤵
  PID:8820
- C:\Windows\System\VYQqpcA.exe
  C:\Windows\System\VYQqpcA.exe
  2⤵
  PID:8836
- C:\Windows\System\WvoVBFi.exe
  C:\Windows\System\WvoVBFi.exe
  2⤵
  PID:8852
- C:\Windows\System\ThiJfAJ.exe
  C:\Windows\System\ThiJfAJ.exe
  2⤵
  PID:8868
- C:\Windows\System\iwtijjU.exe
  C:\Windows\System\iwtijjU.exe
  2⤵
  PID:8884
- C:\Windows\System\HKjuScz.exe
  C:\Windows\System\HKjuScz.exe
  2⤵
  PID:8900
- C:\Windows\System\fXQbUHk.exe
  C:\Windows\System\fXQbUHk.exe
  2⤵
  PID:8916
- C:\Windows\System\PINCHEp.exe
  C:\Windows\System\PINCHEp.exe
  2⤵
  PID:8932
- C:\Windows\System\HlpPKpY.exe
  C:\Windows\System\HlpPKpY.exe
  2⤵
  PID:8948
- C:\Windows\System\QESkBLr.exe
  C:\Windows\System\QESkBLr.exe
  2⤵
  PID:8964
- C:\Windows\System\gOliTvL.exe
  C:\Windows\System\gOliTvL.exe
  2⤵
  PID:8980
- C:\Windows\System\bQWyzxw.exe
  C:\Windows\System\bQWyzxw.exe
  2⤵
  PID:8996
- C:\Windows\System\jjjyZoT.exe
  C:\Windows\System\jjjyZoT.exe
  2⤵
  PID:9012
- C:\Windows\System\luVAkUL.exe
  C:\Windows\System\luVAkUL.exe
  2⤵
  PID:9028
- C:\Windows\System\WGVWtXG.exe
  C:\Windows\System\WGVWtXG.exe
  2⤵
  PID:9044
- C:\Windows\System\rtJoEFm.exe
  C:\Windows\System\rtJoEFm.exe
  2⤵
  PID:9060
- C:\Windows\System\lQMdNFl.exe
  C:\Windows\System\lQMdNFl.exe
  2⤵
  PID:9076
- C:\Windows\System\cSWgFSB.exe
  C:\Windows\System\cSWgFSB.exe
  2⤵
  PID:9092
- C:\Windows\System\yUsQoHJ.exe
  C:\Windows\System\yUsQoHJ.exe
  2⤵
  PID:9108
- C:\Windows\System\VeBTsIC.exe
  C:\Windows\System\VeBTsIC.exe
  2⤵
  PID:9124
- C:\Windows\System\nifktiy.exe
  C:\Windows\System\nifktiy.exe
  2⤵
  PID:9140
- C:\Windows\System\wdNCPzr.exe
  C:\Windows\System\wdNCPzr.exe
  2⤵
  PID:9156
- C:\Windows\System\OWupiMI.exe
  C:\Windows\System\OWupiMI.exe
  2⤵
  PID:9172
- C:\Windows\System\QCQnxxS.exe
  C:\Windows\System\QCQnxxS.exe
  2⤵
  PID:9188
- C:\Windows\System\RrfapED.exe
  C:\Windows\System\RrfapED.exe
  2⤵
  PID:9204
- C:\Windows\System\oywHrNg.exe
  C:\Windows\System\oywHrNg.exe
  2⤵
  PID:7712
- C:\Windows\System\zVwiWuI.exe
  C:\Windows\System\zVwiWuI.exe
  2⤵
  PID:8208
- C:\Windows\System\owOiSSc.exe
  C:\Windows\System\owOiSSc.exe
  2⤵
  PID:7580
- C:\Windows\System\HmcIeWW.exe
  C:\Windows\System\HmcIeWW.exe
  2⤵
  PID:8240
- C:\Windows\System\LADpUHk.exe
  C:\Windows\System\LADpUHk.exe
  2⤵
  PID:8256
- C:\Windows\System\kgRuykN.exe
  C:\Windows\System\kgRuykN.exe
  2⤵
  PID:8348
- C:\Windows\System\ISGZlbd.exe
  C:\Windows\System\ISGZlbd.exe
  2⤵
  PID:8380
- C:\Windows\System\NQvfAtl.exe
  C:\Windows\System\NQvfAtl.exe
  2⤵
  PID:8332
- C:\Windows\System\keqjCvF.exe
  C:\Windows\System\keqjCvF.exe
  2⤵
  PID:8400
- C:\Windows\System\HKfJTOw.exe
  C:\Windows\System\HKfJTOw.exe
  2⤵
  PID:8416
- C:\Windows\System\FHFMLFn.exe
  C:\Windows\System\FHFMLFn.exe
  2⤵
  PID:8432
- C:\Windows\System\LixsrvW.exe
  C:\Windows\System\LixsrvW.exe
  2⤵
  PID:8452
- C:\Windows\System\zniVJip.exe
  C:\Windows\System\zniVJip.exe
  2⤵
  PID:8484
- C:\Windows\System\qukkxNW.exe
  C:\Windows\System\qukkxNW.exe
  2⤵
  PID:8504
- C:\Windows\System\gMTDmkF.exe
  C:\Windows\System\gMTDmkF.exe
  2⤵
  PID:8540
- C:\Windows\System\jeAuvqN.exe
  C:\Windows\System\jeAuvqN.exe
  2⤵
  PID:8640
- C:\Windows\System\XITjpNr.exe
  C:\Windows\System\XITjpNr.exe
  2⤵
  PID:8516
- C:\Windows\System\GPDqfPt.exe
  C:\Windows\System\GPDqfPt.exe
  2⤵
  PID:8656
- C:\Windows\System\XdYFXZM.exe
  C:\Windows\System\XdYFXZM.exe
  2⤵
  PID:8592
- C:\Windows\System\lslhWdN.exe
  C:\Windows\System\lslhWdN.exe
  2⤵
  PID:8588
- C:\Windows\System\IhUwTFL.exe
  C:\Windows\System\IhUwTFL.exe
  2⤵
  PID:8704
- C:\Windows\System\VWEskLH.exe
  C:\Windows\System\VWEskLH.exe
  2⤵
  PID:8720
- C:\Windows\System\MvEvcdA.exe
  C:\Windows\System\MvEvcdA.exe
  2⤵
  PID:8736
- C:\Windows\System\BdYksXn.exe
  C:\Windows\System\BdYksXn.exe
  2⤵
  PID:8752
- C:\Windows\System\bNXOrjI.exe
  C:\Windows\System\bNXOrjI.exe
  2⤵
  PID:8772
- C:\Windows\System\TWRgjTZ.exe
  C:\Windows\System\TWRgjTZ.exe
  2⤵
  PID:8788
- C:\Windows\System\HefbtSb.exe
  C:\Windows\System\HefbtSb.exe
  2⤵
  PID:8804
- C:\Windows\System\FNSBDgy.exe
  C:\Windows\System\FNSBDgy.exe
  2⤵
  PID:8876
- C:\Windows\System\mSpeKNq.exe
  C:\Windows\System\mSpeKNq.exe
  2⤵
  PID:8828
- C:\Windows\System\yIPepiv.exe
  C:\Windows\System\yIPepiv.exe
  2⤵
  PID:8896
- C:\Windows\System\DuHfYnq.exe
  C:\Windows\System\DuHfYnq.exe
  2⤵
  PID:8960
- C:\Windows\System\WPPjstB.exe
  C:\Windows\System\WPPjstB.exe
  2⤵
  PID:8912
- C:\Windows\System\fmockKe.exe
  C:\Windows\System\fmockKe.exe
  2⤵
  PID:8992
- C:\Windows\System\dqIceHv.exe
  C:\Windows\System\dqIceHv.exe
  2⤵
  PID:9008
- C:\Windows\System\qftfGsZ.exe
  C:\Windows\System\qftfGsZ.exe
  2⤵
  PID:9040
- C:\Windows\System\kVrYXON.exe
  C:\Windows\System\kVrYXON.exe
  2⤵
  PID:9024
- C:\Windows\System\SSEqVHO.exe
  C:\Windows\System\SSEqVHO.exe
  2⤵
  PID:9056
- C:\Windows\System\ynorCuM.exe
  C:\Windows\System\ynorCuM.exe
  2⤵
  PID:9180
- C:\Windows\System\PUhqpAn.exe
  C:\Windows\System\PUhqpAn.exe
  2⤵
  PID:7468
- C:\Windows\System\PbNLzgg.exe
  C:\Windows\System\PbNLzgg.exe
  2⤵
  PID:9168
- C:\Windows\System\FJpJQFO.exe
  C:\Windows\System\FJpJQFO.exe
  2⤵
  PID:8044
- C:\Windows\System\UyKlPAA.exe
  C:\Windows\System\UyKlPAA.exe
  2⤵
  PID:8268
- C:\Windows\System\rVcDeaT.exe
  C:\Windows\System\rVcDeaT.exe
  2⤵
  PID:8364
- C:\Windows\System\iUEKRXZ.exe
  C:\Windows\System\iUEKRXZ.exe
  2⤵
  PID:8436
- C:\Windows\System\bjearKg.exe
  C:\Windows\System\bjearKg.exe
  2⤵
  PID:8408
- C:\Windows\System\CnCfxFB.exe
  C:\Windows\System\CnCfxFB.exe
  2⤵
  PID:8288
- C:\Windows\System\mKDSlza.exe
  C:\Windows\System\mKDSlza.exe
  2⤵
  PID:8464
- C:\Windows\System\nbTPnAQ.exe
  C:\Windows\System\nbTPnAQ.exe
  2⤵
  PID:8572
- C:\Windows\System\AaBOhka.exe
  C:\Windows\System\AaBOhka.exe
  2⤵
  PID:8672
- C:\Windows\System\iYfdvRx.exe
  C:\Windows\System\iYfdvRx.exe
  2⤵
  PID:8700
- C:\Windows\System\sfmxTrU.exe
  C:\Windows\System\sfmxTrU.exe
  2⤵
  PID:8764
- C:\Windows\System\VTnOBYd.exe
  C:\Windows\System\VTnOBYd.exe
  2⤵
  PID:8496
- C:\Windows\System\LBrhFLG.exe
  C:\Windows\System\LBrhFLG.exe
  2⤵
  PID:8576
- C:\Windows\System\CzleIck.exe
  C:\Windows\System\CzleIck.exe
  2⤵
  PID:8744
- C:\Windows\System\QBdqKLw.exe
  C:\Windows\System\QBdqKLw.exe
  2⤵
  PID:8800
- C:\Windows\System\KWFPopN.exe
  C:\Windows\System\KWFPopN.exe
  2⤵
  PID:8908
- C:\Windows\System\dAlLnwn.exe
  C:\Windows\System\dAlLnwn.exe
  2⤵
  PID:9036
- C:\Windows\System\WEcMTrM.exe
  C:\Windows\System\WEcMTrM.exe
  2⤵
  PID:9196
- C:\Windows\System\zDrlDjA.exe
  C:\Windows\System\zDrlDjA.exe
  2⤵
  PID:8224
- C:\Windows\System\rfCVkIV.exe
  C:\Windows\System\rfCVkIV.exe
  2⤵
  PID:8608
- C:\Windows\System\XjoSbCW.exe
  C:\Windows\System\XjoSbCW.exe
  2⤵
  PID:8716
- C:\Windows\System\CadOWgs.exe
  C:\Windows\System\CadOWgs.exe
  2⤵
  PID:9132
- C:\Windows\System\xYpHkOU.exe
  C:\Windows\System\xYpHkOU.exe
  2⤵
  PID:8892
- C:\Windows\System\CmmqpRQ.exe
  C:\Windows\System\CmmqpRQ.exe
  2⤵
  PID:8560
- C:\Windows\System\wsvnGLZ.exe
  C:\Windows\System\wsvnGLZ.exe
  2⤵
  PID:8812
- C:\Windows\System\fOggmzi.exe
  C:\Windows\System\fOggmzi.exe
  2⤵
  PID:8972
- C:\Windows\System\PBwKHuA.exe
  C:\Windows\System\PBwKHuA.exe
  2⤵
  PID:9152
- C:\Windows\System\ywRqtqT.exe
  C:\Windows\System\ywRqtqT.exe
  2⤵
  PID:8480
- C:\Windows\System\nnbqSTc.exe
  C:\Windows\System\nnbqSTc.exe
  2⤵
  PID:8492
- C:\Windows\System\YFiJsAy.exe
  C:\Windows\System\YFiJsAy.exe
  2⤵
  PID:8300
- C:\Windows\System\EoCAkrJ.exe
  C:\Windows\System\EoCAkrJ.exe
  2⤵
  PID:8712
- C:\Windows\System\cgTekfF.exe
  C:\Windows\System\cgTekfF.exe
  2⤵
  PID:7716
- C:\Windows\System\FLfQqhE.exe
  C:\Windows\System\FLfQqhE.exe
  2⤵
  PID:9212
- C:\Windows\System\ocdDZcr.exe
  C:\Windows\System\ocdDZcr.exe
  2⤵
  PID:8944
- C:\Windows\System\qavAzwW.exe
  C:\Windows\System\qavAzwW.exe
  2⤵
  PID:9020
- C:\Windows\System\gvFIvVG.exe
  C:\Windows\System\gvFIvVG.exe
  2⤵
  PID:8652
- C:\Windows\System\fsLsdxB.exe
  C:\Windows\System\fsLsdxB.exe
  2⤵
  PID:8956
- C:\Windows\System\VlSDDkd.exe
  C:\Windows\System\VlSDDkd.exe
  2⤵
  PID:8368
- C:\Windows\System\udEVErT.exe
  C:\Windows\System\udEVErT.exe
  2⤵
  PID:8668
- C:\Windows\System\PAGkVbX.exe
  C:\Windows\System\PAGkVbX.exe
  2⤵
  PID:8768
- C:\Windows\System\yIoJsxx.exe
  C:\Windows\System\yIoJsxx.exe
  2⤵
  PID:8448
- C:\Windows\System\ZBPgtrC.exe
  C:\Windows\System\ZBPgtrC.exe
  2⤵
  PID:8428
- C:\Windows\System\ymSIjiH.exe
  C:\Windows\System\ymSIjiH.exe
  2⤵
  PID:9228
- C:\Windows\System\eudmnZk.exe
  C:\Windows\System\eudmnZk.exe
  2⤵
  PID:9244
- C:\Windows\System\xSdXZEO.exe
  C:\Windows\System\xSdXZEO.exe
  2⤵
  PID:9260
- C:\Windows\System\DtjtTiR.exe
  C:\Windows\System\DtjtTiR.exe
  2⤵
  PID:9280
- C:\Windows\System\mIxVoVB.exe
  C:\Windows\System\mIxVoVB.exe
  2⤵
  PID:9296
- C:\Windows\System\ghIWLiy.exe
  C:\Windows\System\ghIWLiy.exe
  2⤵
  PID:9312
- C:\Windows\System\YfeYryc.exe
  C:\Windows\System\YfeYryc.exe
  2⤵
  PID:9328
- C:\Windows\System\XxJeHzJ.exe
  C:\Windows\System\XxJeHzJ.exe
  2⤵
  PID:9344
- C:\Windows\System\lyiAVLK.exe
  C:\Windows\System\lyiAVLK.exe
  2⤵
  PID:9360
- C:\Windows\System\SAqOtQY.exe
  C:\Windows\System\SAqOtQY.exe
  2⤵
  PID:9376
- C:\Windows\System\ugumsFA.exe
  C:\Windows\System\ugumsFA.exe
  2⤵
  PID:9392
- C:\Windows\System\eUuBKuB.exe
  C:\Windows\System\eUuBKuB.exe
  2⤵
  PID:9408
- C:\Windows\System\TczIrXQ.exe
  C:\Windows\System\TczIrXQ.exe
  2⤵
  PID:9428
- C:\Windows\System\PSbVODz.exe
  C:\Windows\System\PSbVODz.exe
  2⤵
  PID:9444
- C:\Windows\System\xlmNJnv.exe
  C:\Windows\System\xlmNJnv.exe
  2⤵
  PID:9460
- C:\Windows\System\ucxdcTk.exe
  C:\Windows\System\ucxdcTk.exe
  2⤵
  PID:9476
- C:\Windows\System\otGruPF.exe
  C:\Windows\System\otGruPF.exe
  2⤵
  PID:9492
- C:\Windows\System\dekefVa.exe
  C:\Windows\System\dekefVa.exe
  2⤵
  PID:9508
- C:\Windows\System\BbwMnHW.exe
  C:\Windows\System\BbwMnHW.exe
  2⤵
  PID:9524
- C:\Windows\System\QNfaHWa.exe
  C:\Windows\System\QNfaHWa.exe
  2⤵
  PID:9540
- C:\Windows\System\ZSPgrxC.exe
  C:\Windows\System\ZSPgrxC.exe
  2⤵
  PID:9556
- C:\Windows\System\AcLyGlf.exe
  C:\Windows\System\AcLyGlf.exe
  2⤵
  PID:9572
- C:\Windows\System\CiEVZDD.exe
  C:\Windows\System\CiEVZDD.exe
  2⤵
  PID:9588
- C:\Windows\System\Izztxvc.exe
  C:\Windows\System\Izztxvc.exe
  2⤵
  PID:9604
- C:\Windows\System\VouFbuo.exe
  C:\Windows\System\VouFbuo.exe
  2⤵
  PID:9624
- C:\Windows\System\pWyuKYc.exe
  C:\Windows\System\pWyuKYc.exe
  2⤵
  PID:9640
- C:\Windows\System\IltIZqe.exe
  C:\Windows\System\IltIZqe.exe
  2⤵
  PID:9656
- C:\Windows\System\KOpBpdx.exe
  C:\Windows\System\KOpBpdx.exe
  2⤵
  PID:9672
- C:\Windows\System\XqUKbzo.exe
  C:\Windows\System\XqUKbzo.exe
  2⤵
  PID:9688
- C:\Windows\System\TMCXVaw.exe
  C:\Windows\System\TMCXVaw.exe
  2⤵
  PID:9704
- C:\Windows\System\MntEvYM.exe
  C:\Windows\System\MntEvYM.exe
  2⤵
  PID:9720
- C:\Windows\System\DfdmvGQ.exe
  C:\Windows\System\DfdmvGQ.exe
  2⤵
  PID:9736
- C:\Windows\System\tKTQeij.exe
  C:\Windows\System\tKTQeij.exe
  2⤵
  PID:9752
- C:\Windows\System\aUjomQc.exe
  C:\Windows\System\aUjomQc.exe
  2⤵
  PID:9772
- C:\Windows\System\SdkZWKx.exe
  C:\Windows\System\SdkZWKx.exe
  2⤵
  PID:9796
- C:\Windows\System\aULTBtS.exe
  C:\Windows\System\aULTBtS.exe
  2⤵
  PID:9812
- C:\Windows\System\vrULroc.exe
  C:\Windows\System\vrULroc.exe
  2⤵
  PID:9832
- C:\Windows\System\DMEhFzr.exe
  C:\Windows\System\DMEhFzr.exe
  2⤵
  PID:9872
- C:\Windows\System\jqkzUEA.exe
  C:\Windows\System\jqkzUEA.exe
  2⤵
  PID:9896
- C:\Windows\System\NVcqmDh.exe
  C:\Windows\System\NVcqmDh.exe
  2⤵
  PID:9956
- C:\Windows\System\lHvsHVR.exe
  C:\Windows\System\lHvsHVR.exe
  2⤵
  PID:10020
- C:\Windows\System\hTsFoLK.exe
  C:\Windows\System\hTsFoLK.exe
  2⤵
  PID:10044
- C:\Windows\System\gifJDhT.exe
  C:\Windows\System\gifJDhT.exe
  2⤵
  PID:10060
- C:\Windows\System\PexgpNg.exe
  C:\Windows\System\PexgpNg.exe
  2⤵
  PID:10076
- C:\Windows\System\EwVWgHz.exe
  C:\Windows\System\EwVWgHz.exe
  2⤵
  PID:10092
- C:\Windows\System\PoKSrIf.exe
  C:\Windows\System\PoKSrIf.exe
  2⤵
  PID:10116
- C:\Windows\System\VNMoTjG.exe
  C:\Windows\System\VNMoTjG.exe
  2⤵
  PID:10136
- C:\Windows\System\iZrPCFC.exe
  C:\Windows\System\iZrPCFC.exe
  2⤵
  PID:9256
- C:\Windows\System\LVTWGvU.exe
  C:\Windows\System\LVTWGvU.exe
  2⤵
  PID:9320
- C:\Windows\System\WTVKMtC.exe
  C:\Windows\System\WTVKMtC.exe
  2⤵
  PID:9324
- C:\Windows\System\BfHVkPY.exe
  C:\Windows\System\BfHVkPY.exe
  2⤵
  PID:9400
- C:\Windows\System\gVINgWb.exe
  C:\Windows\System\gVINgWb.exe
  2⤵
  PID:9616
- C:\Windows\System\aLAWcDb.exe
  C:\Windows\System\aLAWcDb.exe
  2⤵
  PID:9668
- C:\Windows\System\ncvlGHs.exe
  C:\Windows\System\ncvlGHs.exe
  2⤵
  PID:9648
- C:\Windows\System\xzOyRUb.exe
  C:\Windows\System\xzOyRUb.exe
  2⤵
  PID:9732
- C:\Windows\System\fXxPnrX.exe
  C:\Windows\System\fXxPnrX.exe
  2⤵
  PID:9748
- C:\Windows\System\buCVxNZ.exe
  C:\Windows\System\buCVxNZ.exe
  2⤵
  PID:9780
- C:\Windows\System\AJRnTnH.exe
  C:\Windows\System\AJRnTnH.exe
  2⤵
  PID:9868
- C:\Windows\System\yHMmxfq.exe
  C:\Windows\System\yHMmxfq.exe
  2⤵
  PID:9844
- C:\Windows\System\FANnrIG.exe
  C:\Windows\System\FANnrIG.exe
  2⤵
  PID:9904
- C:\Windows\System\qjtCzvB.exe
  C:\Windows\System\qjtCzvB.exe
  2⤵
  PID:9936
- C:\Windows\System\nJeWltY.exe
  C:\Windows\System\nJeWltY.exe
  2⤵
  PID:9788
- C:\Windows\System\AfXvGwH.exe
  C:\Windows\System\AfXvGwH.exe
  2⤵
  PID:9252
- C:\Windows\System\Xducjej.exe
  C:\Windows\System\Xducjej.exe
  2⤵
  PID:9972
- C:\Windows\System\leOgUkK.exe
  C:\Windows\System\leOgUkK.exe
  2⤵
  PID:9992
- C:\Windows\System\djoCvJP.exe
  C:\Windows\System\djoCvJP.exe
  2⤵
  PID:10008
- C:\Windows\System\LZmEqLT.exe
  C:\Windows\System\LZmEqLT.exe
  2⤵
  PID:10028
- C:\Windows\System\GrrGPiD.exe
  C:\Windows\System\GrrGPiD.exe
  2⤵
  PID:10112
- C:\Windows\System\WvGNApr.exe
  C:\Windows\System\WvGNApr.exe
  2⤵
  PID:10148
- C:\Windows\System\HkJAnaE.exe
  C:\Windows\System\HkJAnaE.exe
  2⤵
  PID:9472
- C:\Windows\System\ulvCdfm.exe
  C:\Windows\System\ulvCdfm.exe
  2⤵
  PID:9548
- C:\Windows\System\FlMCSjC.exe
  C:\Windows\System\FlMCSjC.exe
  2⤵
  PID:9764
- C:\Windows\System\zqjdeBs.exe
  C:\Windows\System\zqjdeBs.exe
  2⤵
  PID:10244
- C:\Windows\System\xYOtKwf.exe
  C:\Windows\System\xYOtKwf.exe
  2⤵
  PID:10264
- C:\Windows\System\NxaUCCH.exe
  C:\Windows\System\NxaUCCH.exe
  2⤵
  PID:10336
- C:\Windows\System\PMnhasG.exe
  C:\Windows\System\PMnhasG.exe
  2⤵
  PID:10364
- C:\Windows\System\RTOxaIo.exe
  C:\Windows\System\RTOxaIo.exe
  2⤵
  PID:10384
- C:\Windows\System\YIEERew.exe
  C:\Windows\System\YIEERew.exe
  2⤵
  PID:10400
- C:\Windows\System\soVWxOQ.exe
  C:\Windows\System\soVWxOQ.exe
  2⤵
  PID:10420
- C:\Windows\System\yYioXGK.exe
  C:\Windows\System\yYioXGK.exe
  2⤵
  PID:10436
- C:\Windows\System\JQQAUzs.exe
  C:\Windows\System\JQQAUzs.exe
  2⤵
  PID:10456
- C:\Windows\System\VsssmEt.exe
  C:\Windows\System\VsssmEt.exe
  2⤵
  PID:10476
- C:\Windows\System\WuDJijT.exe
  C:\Windows\System\WuDJijT.exe
  2⤵
  PID:10496
- C:\Windows\System\jksKSXq.exe
  C:\Windows\System\jksKSXq.exe
  2⤵
  PID:10516
- C:\Windows\System\oGTloTv.exe
  C:\Windows\System\oGTloTv.exe
  2⤵
  PID:10536
- C:\Windows\System\hebejYK.exe
  C:\Windows\System\hebejYK.exe
  2⤵
  PID:10556
- C:\Windows\System\jGnpVjj.exe
  C:\Windows\System\jGnpVjj.exe
  2⤵
  PID:10572
- C:\Windows\System\qpfysps.exe
  C:\Windows\System\qpfysps.exe
  2⤵
  PID:10588
- C:\Windows\System\qjSsCEs.exe
  C:\Windows\System\qjSsCEs.exe
  2⤵
  PID:10608
- C:\Windows\System\eJvDscP.exe
  C:\Windows\System\eJvDscP.exe
  2⤵
  PID:10624
- C:\Windows\System\IsnxPnp.exe
  C:\Windows\System\IsnxPnp.exe
  2⤵
  PID:10644
- C:\Windows\System\aUMHKKw.exe
  C:\Windows\System\aUMHKKw.exe
  2⤵
  PID:10660
- C:\Windows\System\WAMkOaL.exe
  C:\Windows\System\WAMkOaL.exe
  2⤵
  PID:10676
- C:\Windows\System\POqkCxL.exe
  C:\Windows\System\POqkCxL.exe
  2⤵
  PID:10692
- C:\Windows\System\VECasJu.exe
  C:\Windows\System\VECasJu.exe
  2⤵
  PID:10840
- C:\Windows\System\CQhCHPI.exe
  C:\Windows\System\CQhCHPI.exe
  2⤵
  PID:10856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AWCYXDg.exe

Filesize
1.9MB

MD5
092d5f1432d261171ba699036980179e

SHA1
920b765571755a3aebfa0486d24dbc45f277bac6

SHA256
06c2954f11fd7fc34b7911f73d259edbcc8a5ccf3d4749c563ae3b4e4d7c6d42

SHA512
3da3d3276a13defd1fbcfd0beeb1e3d589134bab3eb0574a9727c8c94d764b7c3c7ac3dc430ae31c907e02d566a2dfbc2076ca372a178101b5ea30b47212c093

Download Submit
C:\Windows\system\DMoCLOG.exe

Filesize
1.9MB

MD5
d37a04e028e86ec0aec143c19971542d

SHA1
649e98e4a42f7fc40eb295ffedd5e2bf88a06a73

SHA256
58f22b2a0476ad817dcda23db50c5882a2704be109a342dc1bdf92295cea5a41

SHA512
00365bc8ae076081f7dfd0d868b3d519a51a246479d83a659c8f80f6f7ceed43333be2ec8cd37e262f2e5b78619629c3421465e31b82002863f62559adaa13e6

Download Submit
C:\Windows\system\ExnZTUm.exe

Filesize
1.9MB

MD5
2c2ad6d945931db44f70e1c761298cde

SHA1
9411f4a9cfac966e397576506d50adc82a73f90f

SHA256
1ed25b14284fe594081dfb973595893f7c707a549182e198f48e161aefa934c9

SHA512
41fabfe7a20ea0fe2c349e65fbd3717bbf69c2d0858f4d1adbf66173c2af4f6ac82e38fe4893265e01e84090690ed7cd1e2729570a74cc43b3a57f1f524812e6

Download Submit
C:\Windows\system\FmoGsKl.exe

Filesize
1.9MB

MD5
485ae857716f253c12bc8064755d012e

SHA1
0c726623617f4be463d72cc074411e2a6f977544

SHA256
68301b04218b471e22bbd194782858723a9945a767c1e5713b5939f1b15a2c19

SHA512
d93ecc1b76df2b2e93f520da7b834c2ea89a4e15a4f3799be28c52923fe201d3c6e4d317389c480e571d048058f6eb550a2a7d85a2363f1af1c340487ecbdf5d

Download Submit
C:\Windows\system\JgXARBM.exe

Filesize
1.9MB

MD5
4b66e612425eec3c01c09b0bd79097fe

SHA1
ae4d3c547c2a526bece858a5b1adc199bad2a20f

SHA256
dcf400763fa3fa15329f8426369dc4a3c87c27af50c7b1c6ca9e9b7142b9ace2

SHA512
690867a8f9b0ac224f254b09e87d05694d2ffdb349ee94e223f3d2a8e4e101bd6140e42e69a79fc1b52c214824169f885d6087051ad895a04ddf5042796f329a

Download Submit
C:\Windows\system\SNHraVg.exe

Filesize
1.9MB

MD5
7232e4729ba3d910392bf5bb5a1c4abb

SHA1
e1e5ce829f3606b736234797b67e1c7b3874fb14

SHA256
bcc7b8e2ba265dd47293e436b5596c948d4873e74e928d21d294f666a1d45ddc

SHA512
8c19712461cd2526304906495d2dfcf81f94a8f79e5ea74cfb223f70e9c85bd0f4b4735f13bd9851b42c59f356852e31fef39f7213e8c08c3428eebe752da013

Download Submit
C:\Windows\system\THxyNSN.exe

Filesize
1.9MB

MD5
1b97d52347ac8cb929871c67aabf7c02

SHA1
7c7368b485585f1f7d45929a0a249c2d86735044

SHA256
adbef5cbe9c1092c7fda51e1b016b3b3ff340d6dac3f225e09fd9ea8694ca0c4

SHA512
b2184b8e237b77106524f17699cd3d491292c70a3d9eab5fd222da38fc7e52c230e9023f91fef9997dc3f59fe8d298ee9e0cb2d89296689da2d080f1505a3a2f

Download Submit
C:\Windows\system\TXquKoc.exe

Filesize
1.9MB

MD5
761db4591840fe88bd6bc5ca31b40947

SHA1
256ed7e61f5dd2e858920c56dff3ab1ec01d95c4

SHA256
1f83272de33cda35d2b505c71f9dc3a6fdf4f44d78adefb02dc82b86b8d2298d

SHA512
f23b2c5fd1fd2f0c54580f03ed01db5b7e6ec440c057d66dafdf5393045562c9d9c60c93dde887ac4f5228f526222e1398df59933c83911c0a103645e2fe1009

Download Submit
C:\Windows\system\TpCdkhd.exe

Filesize
1.9MB

MD5
21aa8dbe55d4d9d52bf0060d2ea229ab

SHA1
a99df0a8b40dc5435a29dc0cc3f8ee622229521e

SHA256
67bf224514d75f21f506318dbb38634116712298d07f608b29dda5b3265afebb

SHA512
5fa4c373755db3ab96b3f3de75035a81ec97add50629c2202e0da53c442d5539777574fd33a42a25439aa905ce30f242738a7771a0b23441bbf38b39558d9d8a

Download Submit
C:\Windows\system\UOlxYST.exe

Filesize
2.0MB

MD5
895a33884fbb9b1e58f58a820ded96fc

SHA1
56e61b70d8ec24ea4718331728911af6ac93f1b3

SHA256
5cb910ae46c0d6676e84d43bcff395ad9dfaa8bb9e5d7ac14139f28ff5601506

SHA512
89b1f26fab2086613dd2daa864431cbadd953c1054ffb72e7c835f5ff7e6bab34889a88d0b90515974d29c36c4521e526ed04a6896765eda48f8c6dbdc53dfc8

Download Submit
C:\Windows\system\WOkdeVT.exe

Filesize
1.9MB

MD5
d869ed0675a12dea2e80c332e27be7ae

SHA1
1861769da1f99980246d04ef92e5213ae2561dd5

SHA256
529e8123857f6d08099ef4190e124fe5e1cd4c446d6eb2099d05ae6837e7c15a

SHA512
ec14bb7908439b915ba1161cb76ebd5f5625397334b24bfec660cd622dc590f6c13afb53fbb3bd2d86a76c222012e8a1ab9c0eb27eed36cf6c6bc4853495e04c

Download Submit
C:\Windows\system\XEqFmtH.exe

Filesize
1.9MB

MD5
836e84d701c9d04f6a646e767c82fc7b

SHA1
ee6ddce835bc22dc94ddf339283b5a1093b7ab65

SHA256
345c35c93993c23ede88e0ed30d90f95ff7a8a858692ee8c3da142293501f68d

SHA512
7d19ad9438f7824de71c1da9078a9fd2c8bfca16265ddef877416067d4c6181b052a7cebcbd7a414bd82725828331a9d1b7ce167cf099426ce3dc72f2e73fdce

Download Submit
C:\Windows\system\ZDBdPZg.exe

Filesize
2.0MB

MD5
517701322401ac030f5ee06d8cbb36e9

SHA1
9e9e1dae4e5e8981f839ba95e310c8e881824d46

SHA256
c91e554996898304cf6b5356db22b16e45568fba48f69844ed5aa21738dc8f31

SHA512
dbb139aa03a12cbf585b77955e952f56c04be59bdb07d5f28509c52666e775f9b986264d0ff2ee8113337945f22a7d74e3ee9bc3c23b36c723d5ff0edad17c48

Download Submit
C:\Windows\system\ZFMmqoK.exe

Filesize
1.9MB

MD5
8f195ecbf7c9e3e964bec4be674934f4

SHA1
ee44f85ef12be8e3fdfd9dcaf77e4c8ed204e7ec

SHA256
ebeeee755566e1e4e8a678c17173291ffef4f1204ffc78eeccdb7c6e6badb3b9

SHA512
00ecd05e92c9dcc0d994660f1017b6f755f10b0674bbcc221e1ff8aa8c016c289a2cee1dd9dab982fa81c6a1f952ea9c3d3727625336862581a8cd037d093d7c

Download Submit
C:\Windows\system\gaPswMP.exe

Filesize
1.9MB

MD5
bd4766b4df1a4d20a69924d2bf341192

SHA1
bc06d13446926998224759515b2a6b0da3c5a05c

SHA256
b61ac62a8129b71cff5df793762d07e6b5430ed0eb596e0f32c4df6ef345bce6

SHA512
62f671754d8245a4f7ab92bc818d65f214a8e6257077ba27242f181b7ac77e86407e6da956c13245690413c03a03849cf5d12580757dce6a29ba40c46684aaf6

Download Submit
C:\Windows\system\kqtneJX.exe

Filesize
1.9MB

MD5
f771080a461adbd27839c50a004af24b

SHA1
c11081524e8272b8ab224c62a61b190666efb6c6

SHA256
5ef2d4d808cbeb883d8a9767be63a3dba4a00c4ee6faea5d5e9718a98d3c3973

SHA512
fe7115751bc8f132020eb6c3dec50e25dac5ec2ca193dfe29ccde1de79800deba46733016b04a80dc868f1c8b23d53ac88699c847fd53e7f5ebc5c7fea42a8e4

Download Submit
C:\Windows\system\ralRjhY.exe

Filesize
1.9MB

MD5
c991c2f560d8dfe041da3678e8453fc1

SHA1
56595d8eb0c0ca417a5cc14f1abe695b6ccc2b2e

SHA256
7174a4e0a004121629be115d626d19c584ef24282918f1485711574adbf35ce4

SHA512
eca805ff41989ca4a4d4109092dedfd93fb6582faffd3492cfc07a16d0ecf71831345320ff0225b12f166054490ad4123c636de7f03f97941eccf69b80eea68b

Download Submit
C:\Windows\system\rjZJyYR.exe

Filesize
1.9MB

MD5
92109d77af2b23d62c30915a0c70a7d5

SHA1
566668b2b5e804cbe8506dda4303f72664f19629

SHA256
48217627aebcb25f8de9d55d4ff571f3ca895f6e87b5a699f75d1096a6249cce

SHA512
4e0204b88b953b7766894672f774c59d06079a5efb7dc80dd6158ba26bfb2c94472ecd177e1c5832466a6091a174f4cdd6b2ca31517b5c2bfaefd02389f5b374

Download Submit
C:\Windows\system\sRCUuTl.exe

Filesize
1.9MB

MD5
56c7052b8a80081098a487ae3ea7a31f

SHA1
85183292b49e5630d8f85f182623ecf15574085d

SHA256
cf1489d52a0caed5cf2aad6eae764bdb9d7804a2f311bb70a8474dd65f627479

SHA512
0499febcc1c03dabf29b4bdd1b9b48065bb0b7209fc143049cc0cc3eb4d232c1fa7513a716e2d966d5b9d0357626366c737df067ae96b1b6b4ca0ada2098d4ad

Download Submit
C:\Windows\system\svypVId.exe

Filesize
1.9MB

MD5
c5f7d4ede69403aa379d0a378da2701b

SHA1
4b000d072d371238ba21bc6a509e9386193c2e99

SHA256
e819c3e05f3bcd84267681ba7ca2737f72da75094679829cf991c63bf88378c5

SHA512
8f1877cdcd4debd65cbe56208ad09d89a36b84a9adfc7b7700a098ec6460eab040ad021cf2295609295fe4cfd61265efb31b9dac1bd426521a15d24706cae044

Download Submit
C:\Windows\system\tHmuImD.exe

Filesize
1.9MB

MD5
598c509bb5e9756f9e0b82c21aaeb162

SHA1
2d669f5cf06a583ea92a12397fe7925214cfd26f

SHA256
7069b681409ef026d330625b5b79836029f212606fb02350f4823f821949f383

SHA512
c248c2af59e142718d12a9fbd774c5d2139083b512373e728b5184044686f2711d8786273e9224d357286ee897f7227c6ace6c85cbc56f10038bc805ee3035f1

Download Submit
C:\Windows\system\tesfEaY.exe

Filesize
1.9MB

MD5
e99727261857c557e41bb9b459fd34ac

SHA1
4c6700fcfbf4df33b0433eaa1790a125af0f4d31

SHA256
6125fa9537fa7d42b2c8de4a4c3febb4fae8f1af9699cea54f2e74e0199ded43

SHA512
6f89714a4cdcad68f77a8c4dc47df3f15911c33d70951fd98c3fab4f632ceebb695e57659afddd21f15f91be15f046050afc736ff37ae949afe765e4de892ee2

Download Submit
C:\Windows\system\wEUUSVD.exe

Filesize
1.9MB

MD5
0ee5bb2ebbb7910527a2af7df3fd2370

SHA1
125894778ddefa1b9f58ddc38ddd0e96a434fbf8

SHA256
94a8410eec56c48852edc6ad09885be9a6c765dfbe8b88cc7c877fe9e3d0b859

SHA512
b33d8c2340a4e9a3c079b58a91601220ec12f9a1e11c5a1b7a85660ea727c49388b0b6887e12aef1d974d63691f744610a0cc3195d7e44e37794c47e0e65d660

Download Submit
C:\Windows\system\xPVjFIb.exe

Filesize
1.9MB

MD5
1aeff1fb90ec2bfdd1f1c759f2fe7acb

SHA1
9728f6eea51a40a2cf4cfbcecbddcf949513de9a

SHA256
828da207689852fa0bc74a1b0ea706b885fe609738e3d0454ffcd7bed96cff44

SHA512
1e05f7b3170bf883076cdcfda682512505074a2358c2d6f4542e1f3a875a52070d34328a4afe755704e9e8091e4ccbc9be3cc137fb17a4d1c53c5f1960996db0

Download Submit
C:\Windows\system\xykdjRH.exe

Filesize
1.9MB

MD5
3156bb203a5375c8136355a3188fe677

SHA1
fe10c353d79c2bfb198d55c66999c2e17edf3a23

SHA256
d207022f488282e6e1c8da6cf783ccf744ae9f6ce968bd0029b09a14a5055013

SHA512
7c42b6ea4120c1643a2ddd86c082ff07cc735c6ec58a54fe03777f216252c51bd793f0adb6f4357c32204bea32c1198a2f48c4b4f5ae14e566bf3ab274475802

Download Submit
C:\Windows\system\zGfOCBU.exe

Filesize
1.9MB

MD5
47970b973f31854b7eeff250d7f45319

SHA1
f4515117ceaed80be40d8c9c380e9cea44796e12

SHA256
45bcb6e4cd3919c5f03dcfae6b8de0d2152946006c1c922ecde16564c7aab6c1

SHA512
d28f0c7b33122ac9febb0d64579695474d695551b038910d1c08ca64b66d67e5f255704b7e4737605de06482b9086085d4b5c27f85b4936a2cb7cdd51f88e0c6

Download Submit
\Windows\system\BhzzAWa.exe

Filesize
1.9MB

MD5
2740455e18b8523c0ceb1dfc330ab312

SHA1
ab5aab9b950b777dafe667f861d8686c580e70e2

SHA256
a39cc20b3059b660dd3cb092dca51b93b3a4e1a48a26b2235ea1497e2d98c1d1

SHA512
ba1a6d7074004779438f9dd6f74eae1d474cb834c74517678f6ab9cab6f6f557ba3ac96e7d3eaae8a6423bdaf7ee1532f4c8cd621c0656eb265767b205a9c400

Download Submit
\Windows\system\EHjdSsu.exe

Filesize
1.9MB

MD5
ef8a80e4bf656d4d39f16920c88d2083

SHA1
b7e337607a80d34d2fb9316cf08d0e458cf8f5d3

SHA256
9e94e887c1be04cb2c7b32f603fc09f35c342776fc9ba29a68eebe68f988745a

SHA512
57873145304b1853cb4f6e65951bd1f1864facaee359dc7b8e25b5e45763c4dbdd54d08aec3f84d3cf477389bcb8dab111e978f7dcbae9c7309ac4b4313fd6a9

Download Submit
\Windows\system\mTVgUoq.exe

Filesize
1.9MB

MD5
9d2df9f98ed2339403a86aa7ac1600e3

SHA1
0000d4fb98e639141179222fd2ee932a00edd850

SHA256
5d94b816cb0cf8146c9621790b4b85b494514a7d9adb0638a19a4c530fb7c293

SHA512
8c275a1602e301a59f1427b00bc142ce0a41b7bbcc651cf680c4165faeba2b8c8b8a1cda621cf4119c19ad0a212a7a1c618ce484129b1efeeb5ce8af9a0e7d54

Download Submit
\Windows\system\qdWztMP.exe

Filesize
1.9MB

MD5
0b764f7466c04f79e73531380f124fac

SHA1
d15a01ebdbc56d698b66ac4616ee4e7795615a06

SHA256
2e769344b9398dbba9c6eaec6e58f7e85b251bdc77be398a8419d6e21d4b0bbc

SHA512
961c80678d20fbb3dbb29b03c3d81881f1e69b6880e1640fad34275792a800e10f25683e4e84541549cc9c53fdaa5d24f9fd0883126aba8a507e5b121e18c5a6

Download Submit
\Windows\system\rEjkczR.exe

Filesize
1.9MB

MD5
a46aee6542ba315954748881c559718e

SHA1
792971bc52f0c3a5f7642899e5260e1b6c1b1fa1

SHA256
4802078ac572a641b59dc907f10514cd8f0d493897ba8a4600f021566b895404

SHA512
9c55897df1679a67c202bdb899cba2839f410da63aa8db4d81c3b8776d5717402b1af6db537895242b29999c9c745bb3001aebe0f1b4bd7b106171cb139aedb0

Download Submit
\Windows\system\shTuQWy.exe

Filesize
1.9MB

MD5
680a3382e352e1b80b9908bb3c5d4c2b

SHA1
26a0c5a371ed42fb1b84cee8f4c454354cccc84f

SHA256
2057b0984eb02a477454d89f353b845f80e13022995b030d2a31baa656e55883

SHA512
522590ae8153586ee91e765a72d88df51e93bd0cb404499389565925c953a92c1394b50a2cfc5932128587d7b90323d5b6fb538094f9764a09682855833209a9

Download Submit
memory/572-63-0x000000013F720000-0x000000013FA71000-memory.dmp

Filesize
3.3MB

Download
memory/572-1363-0x000000013F720000-0x000000013FA71000-memory.dmp

Filesize
3.3MB

Download
memory/572-4288-0x000000013F720000-0x000000013FA71000-memory.dmp

Filesize
3.3MB

Download
memory/1492-69-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2093-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/1492-4293-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/1508-3447-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/1508-78-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/1508-4294-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/1868-107-0x000000013F560000-0x000000013F8B1000-memory.dmp

Filesize
3.3MB

Download
memory/1868-4296-0x000000013F560000-0x000000013F8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2004-4277-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2004-50-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2128-83-0x000000013F340000-0x000000013F691000-memory.dmp

Filesize
3.3MB

Download
memory/2128-4266-0x000000013F340000-0x000000013F691000-memory.dmp

Filesize
3.3MB

Download
memory/2128-4287-0x000000013F340000-0x000000013F691000-memory.dmp

Filesize
3.3MB

Download
memory/2168-95-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2168-4292-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2412-4279-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2412-28-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2412-97-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4283-0x000000013FDD0000-0x0000000140121000-memory.dmp

Filesize
3.3MB

Download
memory/2628-48-0x000000013FDD0000-0x0000000140121000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4284-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2632-58-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2708-21-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2708-4273-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2712-17-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4274-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2712-79-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4267-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-68-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/2776-98-0x00000000020A0000-0x00000000023F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-47-0x00000000020A0000-0x00000000023F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-0-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-80-0x000000013F340000-0x000000013F691000-memory.dmp

Filesize
3.3MB

Download
memory/2776-61-0x000000013F720000-0x000000013FA71000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4242-0x000000013F340000-0x000000013F691000-memory.dmp

Filesize
3.3MB

Download
memory/2776-34-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-20-0x00000000020A0000-0x00000000023F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-27-0x00000000020A0000-0x00000000023F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-49-0x00000000020A0000-0x00000000023F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-22-0x000000013F2E0000-0x000000013F631000-memory.dmp

Filesize
3.3MB

Download
memory/2776-94-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-74-0x000000013FD70000-0x00000001400C1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-57-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2776-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2776-106-0x000000013F560000-0x000000013F8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2804-35-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2804-4280-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2804-108-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2852-4272-0x000000013F2E0000-0x000000013F631000-memory.dmp

Filesize
3.3MB

Download
memory/2852-19-0x000000013F2E0000-0x000000013F631000-memory.dmp

Filesize
3.3MB

Download
memory/2852-82-0x000000013F2E0000-0x000000013F631000-memory.dmp

Filesize
3.3MB

Download