xmrig | c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1

Analysis

max time kernel
143s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
Size

2.1MB
MD5

a5c8b64bcb2a6ebe4a0e5591cb285073
SHA1

1f80d7833daf89e8d5d28f1e36cecec72555d8a9
SHA256

c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1
SHA512

64bd131eb792e72b86e68f10869b02e56820a95b6d43ff1e50bd0a49e7eee015d14385676f73c8f4c6eb5992b394c970b4dfc8c8538c848772401109d8c16d8d
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNU6ff91f2Ub:oemTLkNdfE0pZrQE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/3004-0-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/files/0x000d0000000141f5-6.dat	xmrig
behavioral1/files/0x0008000000018b89-12.dat	xmrig
behavioral1/memory/2520-14-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/memory/2464-15-0x000000013FE10000-0x0000000140164000-memory.dmp	xmrig
behavioral1/files/0x0007000000018bac-9.dat	xmrig
behavioral1/memory/2696-22-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/files/0x0006000000018bd4-23.dat	xmrig
behavioral1/memory/2232-28-0x000000013F4D0000-0x000000013F824000-memory.dmp	xmrig
behavioral1/files/0x0006000000018d48-30.dat	xmrig
behavioral1/memory/2748-35-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/files/0x000d000000018b58-37.dat	xmrig
behavioral1/memory/3004-43-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/2836-44-0x000000013F850000-0x000000013FBA4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018eb2-45.dat	xmrig
behavioral1/files/0x0007000000018eb8-51.dat	xmrig
behavioral1/memory/2696-56-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2720-58-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig
behavioral1/memory/2728-50-0x000000013FD40000-0x0000000140094000-memory.dmp	xmrig
behavioral1/files/0x0007000000018f8e-66.dat	xmrig
behavioral1/files/0x0007000000018ed5-59.dat	xmrig
behavioral1/files/0x0004000000019438-77.dat	xmrig
behavioral1/memory/2768-72-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2924-65-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/files/0x0004000000019461-83.dat	xmrig
behavioral1/files/0x0004000000019485-93.dat	xmrig
behavioral1/files/0x00040000000194ec-98.dat	xmrig
behavioral1/files/0x000500000001962f-113.dat	xmrig
behavioral1/files/0x0005000000019575-108.dat	xmrig
behavioral1/files/0x0005000000019571-103.dat	xmrig
behavioral1/files/0x000500000001966c-118.dat	xmrig
behavioral1/files/0x000500000001a1ee-142.dat	xmrig
behavioral1/files/0x000500000001a1fe-152.dat	xmrig
behavioral1/files/0x000500000001a25c-173.dat	xmrig
behavioral1/memory/2608-484-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/memory/3048-486-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/2772-494-0x000000013FE50000-0x00000001401A4000-memory.dmp	xmrig
behavioral1/memory/2720-561-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig
behavioral1/memory/2924-681-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2636-1306-0x000000013F650000-0x000000013F9A4000-memory.dmp	xmrig
behavioral1/memory/2608-1307-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/memory/2768-935-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/3004-786-0x0000000002090000-0x00000000023E4000-memory.dmp	xmrig
behavioral1/files/0x000500000001a272-183.dat	xmrig
behavioral1/files/0x000500000001a270-179.dat	xmrig
behavioral1/files/0x000500000001a25a-168.dat	xmrig
behavioral1/files/0x000500000001a237-163.dat	xmrig
behavioral1/files/0x000500000001a201-158.dat	xmrig
behavioral1/files/0x000500000001a1f1-149.dat	xmrig
behavioral1/files/0x000500000001a1e8-138.dat	xmrig
behavioral1/files/0x0005000000019f50-128.dat	xmrig
behavioral1/files/0x000500000001a056-133.dat	xmrig
behavioral1/files/0x00050000000196af-123.dat	xmrig
behavioral1/files/0x0004000000019380-89.dat	xmrig
behavioral1/memory/2636-87-0x000000013F650000-0x000000013F9A4000-memory.dmp	xmrig
behavioral1/memory/2232-64-0x000000013F4D0000-0x000000013F824000-memory.dmp	xmrig
behavioral1/memory/2748-70-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2464-2728-0x000000013FE10000-0x0000000140164000-memory.dmp	xmrig
behavioral1/memory/2232-2730-0x000000013F4D0000-0x000000013F824000-memory.dmp	xmrig
behavioral1/memory/2696-2734-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2748-2735-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2728-2768-0x000000013FD40000-0x0000000140094000-memory.dmp	xmrig
behavioral1/memory/2836-2764-0x000000013F850000-0x000000013FBA4000-memory.dmp	xmrig
behavioral1/memory/2720-2775-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2520	CYsptJe.exe
2464	AIFiVnk.exe
2696	qZatgOS.exe
2232	BqaMJCz.exe
2748	SOOYFoM.exe
2836	nyPbJnw.exe
2728	DnHRnaO.exe
2720	zEIZqVb.exe
2924	zertBAM.exe
2768	ITYtcJV.exe
2636	JVwSbUt.exe
2608	JBTogCL.exe
2772	yKKrgrP.exe
3048	VuOjHyR.exe
2372	LkFSVhJ.exe
936	HuMwfwa.exe
1716	OpwzRlL.exe
332	mzVdekE.exe
1264	fdwLERb.exe
1688	MrOAwSM.exe
1016	bgNmSzc.exe
1200	OsYCpoa.exe
1856	HtmAGGI.exe
2044	zzBUHoi.exe
1128	XPXeKXt.exe
1808	DOIntXn.exe
2644	aueDiVo.exe
2868	tIEVrpj.exe
1048	BnbVgRI.exe
2292	AtdtLpx.exe
2080	NeJpxkU.exe
2120	MiiBhGO.exe
2364	CRGTdWM.exe
2252	erklDeA.exe
828	PmKhzMf.exe
2368	dtEdLCw.exe
1044	ouwniMQ.exe
1732	BAfaEhz.exe
792	AhHSxdR.exe
1784	ByicIjX.exe
1348	ZLpqVgC.exe
1552	BzLgXqH.exe
1704	tBIKvOX.exe
1832	FPMYQgP.exe
2336	WvIQwWI.exe
920	cpySAJt.exe
472	nAnEhBq.exe
2688	ptUJhPS.exe
2940	XLnyTfO.exe
1604	CsnPTMc.exe
1172	XMaMQZd.exe
2992	isPPeoC.exe
2576	YvLWvCL.exe
1504	yGBexPO.exe
2544	hXfozcf.exe
2532	beDmICa.exe
1600	YNFsLWi.exe
3064	Owdimab.exe
2176	rEvouuW.exe
2260	MQIUFuI.exe
2804	AZVNzZV.exe
2024	pwCLLUS.exe
2796	OvBYHWp.exe
2240	vTpeOdJ.exe

Loads dropped DLL 64 IoCs

pid	Process
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/files/0x000d0000000141f5-6.dat	upx
behavioral1/files/0x0008000000018b89-12.dat	upx
behavioral1/memory/2520-14-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/memory/2464-15-0x000000013FE10000-0x0000000140164000-memory.dmp	upx
behavioral1/files/0x0007000000018bac-9.dat	upx
behavioral1/memory/2696-22-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/files/0x0006000000018bd4-23.dat	upx
behavioral1/memory/2232-28-0x000000013F4D0000-0x000000013F824000-memory.dmp	upx
behavioral1/files/0x0006000000018d48-30.dat	upx
behavioral1/memory/2748-35-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/files/0x000d000000018b58-37.dat	upx
behavioral1/memory/3004-43-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/memory/2836-44-0x000000013F850000-0x000000013FBA4000-memory.dmp	upx
behavioral1/files/0x0006000000018eb2-45.dat	upx
behavioral1/files/0x0007000000018eb8-51.dat	upx
behavioral1/memory/2696-56-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2720-58-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2728-50-0x000000013FD40000-0x0000000140094000-memory.dmp	upx
behavioral1/files/0x0007000000018f8e-66.dat	upx
behavioral1/files/0x0007000000018ed5-59.dat	upx
behavioral1/files/0x0004000000019438-77.dat	upx
behavioral1/memory/2768-72-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/2924-65-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/files/0x0004000000019461-83.dat	upx
behavioral1/files/0x0004000000019485-93.dat	upx
behavioral1/files/0x00040000000194ec-98.dat	upx
behavioral1/files/0x000500000001962f-113.dat	upx
behavioral1/files/0x0005000000019575-108.dat	upx
behavioral1/files/0x0005000000019571-103.dat	upx
behavioral1/files/0x000500000001966c-118.dat	upx
behavioral1/files/0x000500000001a1ee-142.dat	upx
behavioral1/files/0x000500000001a1fe-152.dat	upx
behavioral1/files/0x000500000001a25c-173.dat	upx
behavioral1/memory/2608-484-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/memory/3048-486-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/2772-494-0x000000013FE50000-0x00000001401A4000-memory.dmp	upx
behavioral1/memory/2720-561-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2924-681-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2636-1306-0x000000013F650000-0x000000013F9A4000-memory.dmp	upx
behavioral1/memory/2608-1307-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/memory/2768-935-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/files/0x000500000001a272-183.dat	upx
behavioral1/files/0x000500000001a270-179.dat	upx
behavioral1/files/0x000500000001a25a-168.dat	upx
behavioral1/files/0x000500000001a237-163.dat	upx
behavioral1/files/0x000500000001a201-158.dat	upx
behavioral1/files/0x000500000001a1f1-149.dat	upx
behavioral1/files/0x000500000001a1e8-138.dat	upx
behavioral1/files/0x0005000000019f50-128.dat	upx
behavioral1/files/0x000500000001a056-133.dat	upx
behavioral1/files/0x00050000000196af-123.dat	upx
behavioral1/files/0x0004000000019380-89.dat	upx
behavioral1/memory/2636-87-0x000000013F650000-0x000000013F9A4000-memory.dmp	upx
behavioral1/memory/2232-64-0x000000013F4D0000-0x000000013F824000-memory.dmp	upx
behavioral1/memory/2748-70-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2464-2728-0x000000013FE10000-0x0000000140164000-memory.dmp	upx
behavioral1/memory/2232-2730-0x000000013F4D0000-0x000000013F824000-memory.dmp	upx
behavioral1/memory/2696-2734-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2748-2735-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2728-2768-0x000000013FD40000-0x0000000140094000-memory.dmp	upx
behavioral1/memory/2836-2764-0x000000013F850000-0x000000013FBA4000-memory.dmp	upx
behavioral1/memory/2720-2775-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2768-2780-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\majfqgv.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\HnGQebO.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\XnwZDlO.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\Spuryzt.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\QyVqbGD.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\uXfxJNv.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\kZPgyut.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\BfaEZLW.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\giJkomp.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\BRdyOaX.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\qyGAdKU.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\fLyvaVk.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\FUXVFfm.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\oBvDXcu.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\JkzfVeW.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\iUQoVKJ.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\wnWsdQw.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\MLwAaoB.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\sWwYbbr.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\MtiVMXp.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\QsuZhnG.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\QmSIErH.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\iDCRwop.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\nJQOstO.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\uFJjjre.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\jQvFtVp.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\pKhJkCL.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\igBCAes.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\qsTgPlM.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\vZBdXvq.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\nlykJrm.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\obAPWoM.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\SFpbTsn.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\rMrYKeD.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\yNDdpKC.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\LgPXmlO.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\tBvRcJd.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\ulDuGyR.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\YjAhtac.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\TUefGnG.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\OOYMCnA.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\ThQVLWy.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\DXpeENE.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\hsVGKnr.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\iFjxFHa.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\oruBVWD.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\jdEoWjJ.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\PsctsaY.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\HVxkXZB.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\HqPmLEk.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\TlQCfva.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\gupKhci.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\mmCDbJR.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\dYARllX.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\WSkfejE.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\nVKnbfa.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\xQeHiHu.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\ffCQweG.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\yUYOrdS.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\nAnEhBq.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\TwIeljs.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\MAxhgPo.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\wsncReu.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
File created	C:\Windows\System\maBqoul.exe	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2520	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	30
PID 3004 wrote to memory of 2520	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	30
PID 3004 wrote to memory of 2520	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	30
PID 3004 wrote to memory of 2464	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	31
PID 3004 wrote to memory of 2464	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	31
PID 3004 wrote to memory of 2464	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	31
PID 3004 wrote to memory of 2696	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	32
PID 3004 wrote to memory of 2696	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	32
PID 3004 wrote to memory of 2696	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	32
PID 3004 wrote to memory of 2232	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	33
PID 3004 wrote to memory of 2232	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	33
PID 3004 wrote to memory of 2232	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	33
PID 3004 wrote to memory of 2748	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	34
PID 3004 wrote to memory of 2748	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	34
PID 3004 wrote to memory of 2748	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	34
PID 3004 wrote to memory of 2836	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	35
PID 3004 wrote to memory of 2836	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	35
PID 3004 wrote to memory of 2836	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	35
PID 3004 wrote to memory of 2728	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	36
PID 3004 wrote to memory of 2728	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	36
PID 3004 wrote to memory of 2728	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	36
PID 3004 wrote to memory of 2720	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	37
PID 3004 wrote to memory of 2720	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	37
PID 3004 wrote to memory of 2720	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	37
PID 3004 wrote to memory of 2924	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	38
PID 3004 wrote to memory of 2924	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	38
PID 3004 wrote to memory of 2924	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	38
PID 3004 wrote to memory of 2768	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	39
PID 3004 wrote to memory of 2768	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	39
PID 3004 wrote to memory of 2768	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	39
PID 3004 wrote to memory of 2608	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	40
PID 3004 wrote to memory of 2608	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	40
PID 3004 wrote to memory of 2608	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	40
PID 3004 wrote to memory of 2636	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	41
PID 3004 wrote to memory of 2636	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	41
PID 3004 wrote to memory of 2636	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	41
PID 3004 wrote to memory of 2772	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	42
PID 3004 wrote to memory of 2772	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	42
PID 3004 wrote to memory of 2772	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	42
PID 3004 wrote to memory of 3048	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	43
PID 3004 wrote to memory of 3048	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	43
PID 3004 wrote to memory of 3048	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	43
PID 3004 wrote to memory of 2372	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	44
PID 3004 wrote to memory of 2372	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	44
PID 3004 wrote to memory of 2372	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	44
PID 3004 wrote to memory of 936	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	45
PID 3004 wrote to memory of 936	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	45
PID 3004 wrote to memory of 936	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	45
PID 3004 wrote to memory of 1716	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	46
PID 3004 wrote to memory of 1716	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	46
PID 3004 wrote to memory of 1716	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	46
PID 3004 wrote to memory of 332	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	47
PID 3004 wrote to memory of 332	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	47
PID 3004 wrote to memory of 332	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	47
PID 3004 wrote to memory of 1264	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	48
PID 3004 wrote to memory of 1264	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	48
PID 3004 wrote to memory of 1264	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	48
PID 3004 wrote to memory of 1688	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	49
PID 3004 wrote to memory of 1688	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	49
PID 3004 wrote to memory of 1688	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	49
PID 3004 wrote to memory of 1016	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	50
PID 3004 wrote to memory of 1016	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	50
PID 3004 wrote to memory of 1016	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	50
PID 3004 wrote to memory of 1200	3004	c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe	51

C:\Users\Admin\AppData\Local\Temp\c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe
"C:\Users\Admin\AppData\Local\Temp\c4d953ad530ca2b9bd76b9fc716d4212ba3a047f47ae62cc7858b7d169a144a1.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System\CYsptJe.exe
  C:\Windows\System\CYsptJe.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AIFiVnk.exe
  C:\Windows\System\AIFiVnk.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\qZatgOS.exe
  C:\Windows\System\qZatgOS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\BqaMJCz.exe
  C:\Windows\System\BqaMJCz.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\SOOYFoM.exe
  C:\Windows\System\SOOYFoM.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\nyPbJnw.exe
  C:\Windows\System\nyPbJnw.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\DnHRnaO.exe
  C:\Windows\System\DnHRnaO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zEIZqVb.exe
  C:\Windows\System\zEIZqVb.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\zertBAM.exe
  C:\Windows\System\zertBAM.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ITYtcJV.exe
  C:\Windows\System\ITYtcJV.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JBTogCL.exe
  C:\Windows\System\JBTogCL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\JVwSbUt.exe
  C:\Windows\System\JVwSbUt.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\yKKrgrP.exe
  C:\Windows\System\yKKrgrP.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\VuOjHyR.exe
  C:\Windows\System\VuOjHyR.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\LkFSVhJ.exe
  C:\Windows\System\LkFSVhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HuMwfwa.exe
  C:\Windows\System\HuMwfwa.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\OpwzRlL.exe
  C:\Windows\System\OpwzRlL.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mzVdekE.exe
  C:\Windows\System\mzVdekE.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\fdwLERb.exe
  C:\Windows\System\fdwLERb.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\MrOAwSM.exe
  C:\Windows\System\MrOAwSM.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\bgNmSzc.exe
  C:\Windows\System\bgNmSzc.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\OsYCpoa.exe
  C:\Windows\System\OsYCpoa.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\HtmAGGI.exe
  C:\Windows\System\HtmAGGI.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\zzBUHoi.exe
  C:\Windows\System\zzBUHoi.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\XPXeKXt.exe
  C:\Windows\System\XPXeKXt.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\DOIntXn.exe
  C:\Windows\System\DOIntXn.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\aueDiVo.exe
  C:\Windows\System\aueDiVo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\tIEVrpj.exe
  C:\Windows\System\tIEVrpj.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\BnbVgRI.exe
  C:\Windows\System\BnbVgRI.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\AtdtLpx.exe
  C:\Windows\System\AtdtLpx.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\NeJpxkU.exe
  C:\Windows\System\NeJpxkU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\MiiBhGO.exe
  C:\Windows\System\MiiBhGO.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\CRGTdWM.exe
  C:\Windows\System\CRGTdWM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\erklDeA.exe
  C:\Windows\System\erklDeA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\PmKhzMf.exe
  C:\Windows\System\PmKhzMf.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\dtEdLCw.exe
  C:\Windows\System\dtEdLCw.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ouwniMQ.exe
  C:\Windows\System\ouwniMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\BAfaEhz.exe
  C:\Windows\System\BAfaEhz.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\AhHSxdR.exe
  C:\Windows\System\AhHSxdR.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ByicIjX.exe
  C:\Windows\System\ByicIjX.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ZLpqVgC.exe
  C:\Windows\System\ZLpqVgC.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\BzLgXqH.exe
  C:\Windows\System\BzLgXqH.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\tBIKvOX.exe
  C:\Windows\System\tBIKvOX.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\FPMYQgP.exe
  C:\Windows\System\FPMYQgP.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\WvIQwWI.exe
  C:\Windows\System\WvIQwWI.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\cpySAJt.exe
  C:\Windows\System\cpySAJt.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\nAnEhBq.exe
  C:\Windows\System\nAnEhBq.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\ptUJhPS.exe
  C:\Windows\System\ptUJhPS.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\XLnyTfO.exe
  C:\Windows\System\XLnyTfO.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\CsnPTMc.exe
  C:\Windows\System\CsnPTMc.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\XMaMQZd.exe
  C:\Windows\System\XMaMQZd.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\isPPeoC.exe
  C:\Windows\System\isPPeoC.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\YvLWvCL.exe
  C:\Windows\System\YvLWvCL.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yGBexPO.exe
  C:\Windows\System\yGBexPO.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\hXfozcf.exe
  C:\Windows\System\hXfozcf.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\beDmICa.exe
  C:\Windows\System\beDmICa.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\YNFsLWi.exe
  C:\Windows\System\YNFsLWi.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\Owdimab.exe
  C:\Windows\System\Owdimab.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\rEvouuW.exe
  C:\Windows\System\rEvouuW.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\MQIUFuI.exe
  C:\Windows\System\MQIUFuI.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\AZVNzZV.exe
  C:\Windows\System\AZVNzZV.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\pwCLLUS.exe
  C:\Windows\System\pwCLLUS.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\OvBYHWp.exe
  C:\Windows\System\OvBYHWp.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\vTpeOdJ.exe
  C:\Windows\System\vTpeOdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tdHvbmI.exe
  C:\Windows\System\tdHvbmI.exe
  2⤵
  PID:2568
- C:\Windows\System\NPAXpZg.exe
  C:\Windows\System\NPAXpZg.exe
  2⤵
  PID:2668
- C:\Windows\System\RGYQKFw.exe
  C:\Windows\System\RGYQKFw.exe
  2⤵
  PID:2888
- C:\Windows\System\YLyAbJj.exe
  C:\Windows\System\YLyAbJj.exe
  2⤵
  PID:2656
- C:\Windows\System\YlcbTLY.exe
  C:\Windows\System\YlcbTLY.exe
  2⤵
  PID:2844
- C:\Windows\System\yxOjEiJ.exe
  C:\Windows\System\yxOjEiJ.exe
  2⤵
  PID:2540
- C:\Windows\System\SxpwPuI.exe
  C:\Windows\System\SxpwPuI.exe
  2⤵
  PID:2492
- C:\Windows\System\iRsnQiK.exe
  C:\Windows\System\iRsnQiK.exe
  2⤵
  PID:2116
- C:\Windows\System\izPuoKr.exe
  C:\Windows\System\izPuoKr.exe
  2⤵
  PID:1536
- C:\Windows\System\hjwveJm.exe
  C:\Windows\System\hjwveJm.exe
  2⤵
  PID:592
- C:\Windows\System\ZgKhgAC.exe
  C:\Windows\System\ZgKhgAC.exe
  2⤵
  PID:1740
- C:\Windows\System\nMuGZih.exe
  C:\Windows\System\nMuGZih.exe
  2⤵
  PID:316
- C:\Windows\System\ofYgQEu.exe
  C:\Windows\System\ofYgQEu.exe
  2⤵
  PID:2780
- C:\Windows\System\sEuZdJX.exe
  C:\Windows\System\sEuZdJX.exe
  2⤵
  PID:2944
- C:\Windows\System\gdvlIvO.exe
  C:\Windows\System\gdvlIvO.exe
  2⤵
  PID:2208
- C:\Windows\System\oAPKdgg.exe
  C:\Windows\System\oAPKdgg.exe
  2⤵
  PID:1680
- C:\Windows\System\NJTJlOk.exe
  C:\Windows\System\NJTJlOk.exe
  2⤵
  PID:2700
- C:\Windows\System\mSuqzrK.exe
  C:\Windows\System\mSuqzrK.exe
  2⤵
  PID:1152
- C:\Windows\System\yQXcpXt.exe
  C:\Windows\System\yQXcpXt.exe
  2⤵
  PID:1988
- C:\Windows\System\sahaLjc.exe
  C:\Windows\System\sahaLjc.exe
  2⤵
  PID:956
- C:\Windows\System\PWJUJKc.exe
  C:\Windows\System\PWJUJKc.exe
  2⤵
  PID:1992
- C:\Windows\System\aOryRwi.exe
  C:\Windows\System\aOryRwi.exe
  2⤵
  PID:2300
- C:\Windows\System\CQNTKXt.exe
  C:\Windows\System\CQNTKXt.exe
  2⤵
  PID:1664
- C:\Windows\System\MMTCNIf.exe
  C:\Windows\System\MMTCNIf.exe
  2⤵
  PID:2536
- C:\Windows\System\TZtmoiE.exe
  C:\Windows\System\TZtmoiE.exe
  2⤵
  PID:612
- C:\Windows\System\BYwqlYS.exe
  C:\Windows\System\BYwqlYS.exe
  2⤵
  PID:1292
- C:\Windows\System\iSxdcJF.exe
  C:\Windows\System\iSxdcJF.exe
  2⤵
  PID:1288
- C:\Windows\System\kofBBgv.exe
  C:\Windows\System\kofBBgv.exe
  2⤵
  PID:2416
- C:\Windows\System\WdYRwPA.exe
  C:\Windows\System\WdYRwPA.exe
  2⤵
  PID:1692
- C:\Windows\System\Apqjghj.exe
  C:\Windows\System\Apqjghj.exe
  2⤵
  PID:1816
- C:\Windows\System\SGEoqPP.exe
  C:\Windows\System\SGEoqPP.exe
  2⤵
  PID:1572
- C:\Windows\System\TLqFOub.exe
  C:\Windows\System\TLqFOub.exe
  2⤵
  PID:2564
- C:\Windows\System\QLnhOOO.exe
  C:\Windows\System\QLnhOOO.exe
  2⤵
  PID:2948
- C:\Windows\System\mJWYOkt.exe
  C:\Windows\System\mJWYOkt.exe
  2⤵
  PID:2004
- C:\Windows\System\VVkSNHe.exe
  C:\Windows\System\VVkSNHe.exe
  2⤵
  PID:2444
- C:\Windows\System\mkXdUrf.exe
  C:\Windows\System\mkXdUrf.exe
  2⤵
  PID:2808
- C:\Windows\System\MnoVfcL.exe
  C:\Windows\System\MnoVfcL.exe
  2⤵
  PID:2112
- C:\Windows\System\DoMbBXQ.exe
  C:\Windows\System\DoMbBXQ.exe
  2⤵
  PID:2196
- C:\Windows\System\HHyLdBk.exe
  C:\Windows\System\HHyLdBk.exe
  2⤵
  PID:2620
- C:\Windows\System\LKCvuaT.exe
  C:\Windows\System\LKCvuaT.exe
  2⤵
  PID:2304
- C:\Windows\System\QsuZhnG.exe
  C:\Windows\System\QsuZhnG.exe
  2⤵
  PID:2456
- C:\Windows\System\wgUBnUX.exe
  C:\Windows\System\wgUBnUX.exe
  2⤵
  PID:2488
- C:\Windows\System\VJQiZNo.exe
  C:\Windows\System\VJQiZNo.exe
  2⤵
  PID:2856
- C:\Windows\System\biWSgKY.exe
  C:\Windows\System\biWSgKY.exe
  2⤵
  PID:2816
- C:\Windows\System\raGCcaA.exe
  C:\Windows\System\raGCcaA.exe
  2⤵
  PID:572
- C:\Windows\System\jvyCElc.exe
  C:\Windows\System\jvyCElc.exe
  2⤵
  PID:2784
- C:\Windows\System\qzwnjLK.exe
  C:\Windows\System\qzwnjLK.exe
  2⤵
  PID:2140
- C:\Windows\System\PfMLluW.exe
  C:\Windows\System\PfMLluW.exe
  2⤵
  PID:2512
- C:\Windows\System\IdEQHPq.exe
  C:\Windows\System\IdEQHPq.exe
  2⤵
  PID:2412
- C:\Windows\System\BiFqgjq.exe
  C:\Windows\System\BiFqgjq.exe
  2⤵
  PID:1532
- C:\Windows\System\OeFydzb.exe
  C:\Windows\System\OeFydzb.exe
  2⤵
  PID:1012
- C:\Windows\System\gIYpjYC.exe
  C:\Windows\System\gIYpjYC.exe
  2⤵
  PID:2188
- C:\Windows\System\liJrAXm.exe
  C:\Windows\System\liJrAXm.exe
  2⤵
  PID:2716
- C:\Windows\System\PPbadmm.exe
  C:\Windows\System\PPbadmm.exe
  2⤵
  PID:2664
- C:\Windows\System\ghIafuG.exe
  C:\Windows\System\ghIafuG.exe
  2⤵
  PID:2060
- C:\Windows\System\POFJTTY.exe
  C:\Windows\System\POFJTTY.exe
  2⤵
  PID:876
- C:\Windows\System\MjjLTGP.exe
  C:\Windows\System\MjjLTGP.exe
  2⤵
  PID:3028
- C:\Windows\System\cmXXsZc.exe
  C:\Windows\System\cmXXsZc.exe
  2⤵
  PID:3068
- C:\Windows\System\PVzimYx.exe
  C:\Windows\System\PVzimYx.exe
  2⤵
  PID:2092
- C:\Windows\System\PkzWAGJ.exe
  C:\Windows\System\PkzWAGJ.exe
  2⤵
  PID:2152
- C:\Windows\System\jxWqQWx.exe
  C:\Windows\System\jxWqQWx.exe
  2⤵
  PID:2680
- C:\Windows\System\IEAYWxt.exe
  C:\Windows\System\IEAYWxt.exe
  2⤵
  PID:528
- C:\Windows\System\RNKWHLr.exe
  C:\Windows\System\RNKWHLr.exe
  2⤵
  PID:2788
- C:\Windows\System\DdHWebF.exe
  C:\Windows\System\DdHWebF.exe
  2⤵
  PID:1248
- C:\Windows\System\lhLqfJd.exe
  C:\Windows\System\lhLqfJd.exe
  2⤵
  PID:1036
- C:\Windows\System\kXGvsDm.exe
  C:\Windows\System\kXGvsDm.exe
  2⤵
  PID:2200
- C:\Windows\System\LIKapIA.exe
  C:\Windows\System\LIKapIA.exe
  2⤵
  PID:2340
- C:\Windows\System\LEkhrVB.exe
  C:\Windows\System\LEkhrVB.exe
  2⤵
  PID:1736
- C:\Windows\System\IumRaxR.exe
  C:\Windows\System\IumRaxR.exe
  2⤵
  PID:1040
- C:\Windows\System\yvOcITu.exe
  C:\Windows\System\yvOcITu.exe
  2⤵
  PID:3040
- C:\Windows\System\VzlfsLQ.exe
  C:\Windows\System\VzlfsLQ.exe
  2⤵
  PID:2640
- C:\Windows\System\LgPXmlO.exe
  C:\Windows\System\LgPXmlO.exe
  2⤵
  PID:2320
- C:\Windows\System\JENXBJB.exe
  C:\Windows\System\JENXBJB.exe
  2⤵
  PID:852
- C:\Windows\System\hpDPBoE.exe
  C:\Windows\System\hpDPBoE.exe
  2⤵
  PID:1256
- C:\Windows\System\rRkREel.exe
  C:\Windows\System\rRkREel.exe
  2⤵
  PID:1700
- C:\Windows\System\RnpDihE.exe
  C:\Windows\System\RnpDihE.exe
  2⤵
  PID:3024
- C:\Windows\System\gVRjDUi.exe
  C:\Windows\System\gVRjDUi.exe
  2⤵
  PID:2812
- C:\Windows\System\eujnNew.exe
  C:\Windows\System\eujnNew.exe
  2⤵
  PID:2076
- C:\Windows\System\lNTthIa.exe
  C:\Windows\System\lNTthIa.exe
  2⤵
  PID:2724
- C:\Windows\System\gXBTSRe.exe
  C:\Windows\System\gXBTSRe.exe
  2⤵
  PID:824
- C:\Windows\System\BijXMxg.exe
  C:\Windows\System\BijXMxg.exe
  2⤵
  PID:760
- C:\Windows\System\bvzqMaV.exe
  C:\Windows\System\bvzqMaV.exe
  2⤵
  PID:2652
- C:\Windows\System\QFGojxU.exe
  C:\Windows\System\QFGojxU.exe
  2⤵
  PID:2180
- C:\Windows\System\tIBsgaL.exe
  C:\Windows\System\tIBsgaL.exe
  2⤵
  PID:2496
- C:\Windows\System\dDYJoYm.exe
  C:\Windows\System\dDYJoYm.exe
  2⤵
  PID:2860
- C:\Windows\System\etYeoJe.exe
  C:\Windows\System\etYeoJe.exe
  2⤵
  PID:1768
- C:\Windows\System\mmCDbJR.exe
  C:\Windows\System\mmCDbJR.exe
  2⤵
  PID:924
- C:\Windows\System\snNGIRF.exe
  C:\Windows\System\snNGIRF.exe
  2⤵
  PID:2256
- C:\Windows\System\MHgoJPO.exe
  C:\Windows\System\MHgoJPO.exe
  2⤵
  PID:1752
- C:\Windows\System\AiyzRZq.exe
  C:\Windows\System\AiyzRZq.exe
  2⤵
  PID:2612
- C:\Windows\System\vlXOucH.exe
  C:\Windows\System\vlXOucH.exe
  2⤵
  PID:2376
- C:\Windows\System\fgzOyAm.exe
  C:\Windows\System\fgzOyAm.exe
  2⤵
  PID:1416
- C:\Windows\System\UjoMBQN.exe
  C:\Windows\System\UjoMBQN.exe
  2⤵
  PID:2516
- C:\Windows\System\rYItccb.exe
  C:\Windows\System\rYItccb.exe
  2⤵
  PID:2124
- C:\Windows\System\nvAHBXG.exe
  C:\Windows\System\nvAHBXG.exe
  2⤵
  PID:2584
- C:\Windows\System\EudgADa.exe
  C:\Windows\System\EudgADa.exe
  2⤵
  PID:1368
- C:\Windows\System\FVqFhbK.exe
  C:\Windows\System\FVqFhbK.exe
  2⤵
  PID:1116
- C:\Windows\System\cZQBmyT.exe
  C:\Windows\System\cZQBmyT.exe
  2⤵
  PID:2604
- C:\Windows\System\imVpwSK.exe
  C:\Windows\System\imVpwSK.exe
  2⤵
  PID:944
- C:\Windows\System\jjTfsnR.exe
  C:\Windows\System\jjTfsnR.exe
  2⤵
  PID:1616
- C:\Windows\System\xYnDoNz.exe
  C:\Windows\System\xYnDoNz.exe
  2⤵
  PID:308
- C:\Windows\System\RdHgYDZ.exe
  C:\Windows\System\RdHgYDZ.exe
  2⤵
  PID:588
- C:\Windows\System\KwWVgwe.exe
  C:\Windows\System\KwWVgwe.exe
  2⤵
  PID:2792
- C:\Windows\System\PsctsaY.exe
  C:\Windows\System\PsctsaY.exe
  2⤵
  PID:2436
- C:\Windows\System\LtYgbHu.exe
  C:\Windows\System\LtYgbHu.exe
  2⤵
  PID:3044
- C:\Windows\System\hCpZfhr.exe
  C:\Windows\System\hCpZfhr.exe
  2⤵
  PID:1260
- C:\Windows\System\InAODlC.exe
  C:\Windows\System\InAODlC.exe
  2⤵
  PID:2388
- C:\Windows\System\tdWNVal.exe
  C:\Windows\System\tdWNVal.exe
  2⤵
  PID:892
- C:\Windows\System\mMDqbix.exe
  C:\Windows\System\mMDqbix.exe
  2⤵
  PID:952
- C:\Windows\System\RtUXZHS.exe
  C:\Windows\System\RtUXZHS.exe
  2⤵
  PID:1620
- C:\Windows\System\xJeTumR.exe
  C:\Windows\System\xJeTumR.exe
  2⤵
  PID:980
- C:\Windows\System\PkQeBQL.exe
  C:\Windows\System\PkQeBQL.exe
  2⤵
  PID:804
- C:\Windows\System\avPGQpJ.exe
  C:\Windows\System\avPGQpJ.exe
  2⤵
  PID:2400
- C:\Windows\System\JyJzlGm.exe
  C:\Windows\System\JyJzlGm.exe
  2⤵
  PID:2704
- C:\Windows\System\LBzbPsb.exe
  C:\Windows\System\LBzbPsb.exe
  2⤵
  PID:2548
- C:\Windows\System\XRfHjZJ.exe
  C:\Windows\System\XRfHjZJ.exe
  2⤵
  PID:1092
- C:\Windows\System\wwinhbu.exe
  C:\Windows\System\wwinhbu.exe
  2⤵
  PID:2572
- C:\Windows\System\RHWKnex.exe
  C:\Windows\System\RHWKnex.exe
  2⤵
  PID:3100
- C:\Windows\System\JQRYJBf.exe
  C:\Windows\System\JQRYJBf.exe
  2⤵
  PID:3124
- C:\Windows\System\ysnKGzm.exe
  C:\Windows\System\ysnKGzm.exe
  2⤵
  PID:3140
- C:\Windows\System\FsfaQHm.exe
  C:\Windows\System\FsfaQHm.exe
  2⤵
  PID:3160
- C:\Windows\System\BGHceAb.exe
  C:\Windows\System\BGHceAb.exe
  2⤵
  PID:3184
- C:\Windows\System\CoSGfNW.exe
  C:\Windows\System\CoSGfNW.exe
  2⤵
  PID:3208
- C:\Windows\System\XgMqyLp.exe
  C:\Windows\System\XgMqyLp.exe
  2⤵
  PID:3224
- C:\Windows\System\xHNOIrT.exe
  C:\Windows\System\xHNOIrT.exe
  2⤵
  PID:3240
- C:\Windows\System\cKHIqcj.exe
  C:\Windows\System\cKHIqcj.exe
  2⤵
  PID:3256
- C:\Windows\System\QXkaRnl.exe
  C:\Windows\System\QXkaRnl.exe
  2⤵
  PID:3276
- C:\Windows\System\tdMZWVy.exe
  C:\Windows\System\tdMZWVy.exe
  2⤵
  PID:3316
- C:\Windows\System\gdQNVBR.exe
  C:\Windows\System\gdQNVBR.exe
  2⤵
  PID:3332
- C:\Windows\System\tBvRcJd.exe
  C:\Windows\System\tBvRcJd.exe
  2⤵
  PID:3352
- C:\Windows\System\qYSzjjJ.exe
  C:\Windows\System\qYSzjjJ.exe
  2⤵
  PID:3376
- C:\Windows\System\SQyPmjK.exe
  C:\Windows\System\SQyPmjK.exe
  2⤵
  PID:3400
- C:\Windows\System\nJuCNDX.exe
  C:\Windows\System\nJuCNDX.exe
  2⤵
  PID:3416
- C:\Windows\System\ulDuGyR.exe
  C:\Windows\System\ulDuGyR.exe
  2⤵
  PID:3432
- C:\Windows\System\QISEcaI.exe
  C:\Windows\System\QISEcaI.exe
  2⤵
  PID:3448
- C:\Windows\System\KxFToRo.exe
  C:\Windows\System\KxFToRo.exe
  2⤵
  PID:3464
- C:\Windows\System\dJMxQSW.exe
  C:\Windows\System\dJMxQSW.exe
  2⤵
  PID:3500
- C:\Windows\System\UslOzaL.exe
  C:\Windows\System\UslOzaL.exe
  2⤵
  PID:3516
- C:\Windows\System\vPdkRDW.exe
  C:\Windows\System\vPdkRDW.exe
  2⤵
  PID:3532
- C:\Windows\System\zZxRNVq.exe
  C:\Windows\System\zZxRNVq.exe
  2⤵
  PID:3548
- C:\Windows\System\mpuwjos.exe
  C:\Windows\System\mpuwjos.exe
  2⤵
  PID:3572
- C:\Windows\System\xMlWvUr.exe
  C:\Windows\System\xMlWvUr.exe
  2⤵
  PID:3596
- C:\Windows\System\VRvmYCU.exe
  C:\Windows\System\VRvmYCU.exe
  2⤵
  PID:3612
- C:\Windows\System\VUBOAxJ.exe
  C:\Windows\System\VUBOAxJ.exe
  2⤵
  PID:3628
- C:\Windows\System\oZghEGn.exe
  C:\Windows\System\oZghEGn.exe
  2⤵
  PID:3644
- C:\Windows\System\zCbsFwB.exe
  C:\Windows\System\zCbsFwB.exe
  2⤵
  PID:3680
- C:\Windows\System\sTvKFqc.exe
  C:\Windows\System\sTvKFqc.exe
  2⤵
  PID:3696
- C:\Windows\System\PySXXaO.exe
  C:\Windows\System\PySXXaO.exe
  2⤵
  PID:3720
- C:\Windows\System\xRzoCmM.exe
  C:\Windows\System\xRzoCmM.exe
  2⤵
  PID:3740
- C:\Windows\System\avdrBoI.exe
  C:\Windows\System\avdrBoI.exe
  2⤵
  PID:3756
- C:\Windows\System\fdQMSGI.exe
  C:\Windows\System\fdQMSGI.exe
  2⤵
  PID:3776
- C:\Windows\System\JcyZERU.exe
  C:\Windows\System\JcyZERU.exe
  2⤵
  PID:3792
- C:\Windows\System\wksWcmr.exe
  C:\Windows\System\wksWcmr.exe
  2⤵
  PID:3808
- C:\Windows\System\SjUjiKs.exe
  C:\Windows\System\SjUjiKs.exe
  2⤵
  PID:3824
- C:\Windows\System\bkQZxfG.exe
  C:\Windows\System\bkQZxfG.exe
  2⤵
  PID:3844
- C:\Windows\System\mDBEguE.exe
  C:\Windows\System\mDBEguE.exe
  2⤵
  PID:3860
- C:\Windows\System\BYvFKUo.exe
  C:\Windows\System\BYvFKUo.exe
  2⤵
  PID:3900
- C:\Windows\System\XvotikD.exe
  C:\Windows\System\XvotikD.exe
  2⤵
  PID:3928
- C:\Windows\System\wWkzneb.exe
  C:\Windows\System\wWkzneb.exe
  2⤵
  PID:3948
- C:\Windows\System\XykOSqi.exe
  C:\Windows\System\XykOSqi.exe
  2⤵
  PID:3964
- C:\Windows\System\HDRgSyS.exe
  C:\Windows\System\HDRgSyS.exe
  2⤵
  PID:3992
- C:\Windows\System\IKQFmDH.exe
  C:\Windows\System\IKQFmDH.exe
  2⤵
  PID:4008
- C:\Windows\System\URVHbMc.exe
  C:\Windows\System\URVHbMc.exe
  2⤵
  PID:4024
- C:\Windows\System\wJBFlDK.exe
  C:\Windows\System\wJBFlDK.exe
  2⤵
  PID:4044
- C:\Windows\System\NQijlob.exe
  C:\Windows\System\NQijlob.exe
  2⤵
  PID:4068
- C:\Windows\System\eADOxAY.exe
  C:\Windows\System\eADOxAY.exe
  2⤵
  PID:4088
- C:\Windows\System\pdDvxTj.exe
  C:\Windows\System\pdDvxTj.exe
  2⤵
  PID:2932
- C:\Windows\System\djWxWRq.exe
  C:\Windows\System\djWxWRq.exe
  2⤵
  PID:436
- C:\Windows\System\WNAsvNh.exe
  C:\Windows\System\WNAsvNh.exe
  2⤵
  PID:3076
- C:\Windows\System\YmMDPJR.exe
  C:\Windows\System\YmMDPJR.exe
  2⤵
  PID:3148
- C:\Windows\System\BaDIWYN.exe
  C:\Windows\System\BaDIWYN.exe
  2⤵
  PID:3168
- C:\Windows\System\oDWxWLR.exe
  C:\Windows\System\oDWxWLR.exe
  2⤵
  PID:3180
- C:\Windows\System\InSZTRH.exe
  C:\Windows\System\InSZTRH.exe
  2⤵
  PID:3236
- C:\Windows\System\UjawsKM.exe
  C:\Windows\System\UjawsKM.exe
  2⤵
  PID:3220
- C:\Windows\System\batMoTj.exe
  C:\Windows\System\batMoTj.exe
  2⤵
  PID:3292
- C:\Windows\System\mNWRBWp.exe
  C:\Windows\System\mNWRBWp.exe
  2⤵
  PID:3308
- C:\Windows\System\IRrlkoY.exe
  C:\Windows\System\IRrlkoY.exe
  2⤵
  PID:3340
- C:\Windows\System\sjUSyES.exe
  C:\Windows\System\sjUSyES.exe
  2⤵
  PID:3372
- C:\Windows\System\SfkGFGP.exe
  C:\Windows\System\SfkGFGP.exe
  2⤵
  PID:3412
- C:\Windows\System\PdemecS.exe
  C:\Windows\System\PdemecS.exe
  2⤵
  PID:3476
- C:\Windows\System\diOlZmQ.exe
  C:\Windows\System\diOlZmQ.exe
  2⤵
  PID:3424
- C:\Windows\System\rHqIGkL.exe
  C:\Windows\System\rHqIGkL.exe
  2⤵
  PID:3564
- C:\Windows\System\ZCYXuXc.exe
  C:\Windows\System\ZCYXuXc.exe
  2⤵
  PID:3636
- C:\Windows\System\asPOBrh.exe
  C:\Windows\System\asPOBrh.exe
  2⤵
  PID:3540
- C:\Windows\System\ZGMOczp.exe
  C:\Windows\System\ZGMOczp.exe
  2⤵
  PID:3512
- C:\Windows\System\UnafAjj.exe
  C:\Windows\System\UnafAjj.exe
  2⤵
  PID:3688
- C:\Windows\System\adlJjeD.exe
  C:\Windows\System\adlJjeD.exe
  2⤵
  PID:3676
- C:\Windows\System\aPKaFBp.exe
  C:\Windows\System\aPKaFBp.exe
  2⤵
  PID:3716
- C:\Windows\System\heQVNrj.exe
  C:\Windows\System\heQVNrj.exe
  2⤵
  PID:3732
- C:\Windows\System\LNHKlto.exe
  C:\Windows\System\LNHKlto.exe
  2⤵
  PID:3820
- C:\Windows\System\fRoWOIK.exe
  C:\Windows\System\fRoWOIK.exe
  2⤵
  PID:3832
- C:\Windows\System\diMGWTd.exe
  C:\Windows\System\diMGWTd.exe
  2⤵
  PID:3872
- C:\Windows\System\UMKJtKt.exe
  C:\Windows\System\UMKJtKt.exe
  2⤵
  PID:3908
- C:\Windows\System\otTDMyJ.exe
  C:\Windows\System\otTDMyJ.exe
  2⤵
  PID:3960
- C:\Windows\System\IKmaiRP.exe
  C:\Windows\System\IKmaiRP.exe
  2⤵
  PID:3972
- C:\Windows\System\JYWJXzv.exe
  C:\Windows\System\JYWJXzv.exe
  2⤵
  PID:4000
- C:\Windows\System\chShkxL.exe
  C:\Windows\System\chShkxL.exe
  2⤵
  PID:4052
- C:\Windows\System\GDGMCSE.exe
  C:\Windows\System\GDGMCSE.exe
  2⤵
  PID:4036
- C:\Windows\System\cNzgGvb.exe
  C:\Windows\System\cNzgGvb.exe
  2⤵
  PID:3096
- C:\Windows\System\jXDYizP.exe
  C:\Windows\System\jXDYizP.exe
  2⤵
  PID:1684
- C:\Windows\System\cxgTpFz.exe
  C:\Windows\System\cxgTpFz.exe
  2⤵
  PID:3116
- C:\Windows\System\coqwVVc.exe
  C:\Windows\System\coqwVVc.exe
  2⤵
  PID:3136
- C:\Windows\System\JXWdFIk.exe
  C:\Windows\System\JXWdFIk.exe
  2⤵
  PID:1568
- C:\Windows\System\GvKXyfI.exe
  C:\Windows\System\GvKXyfI.exe
  2⤵
  PID:3296
- C:\Windows\System\TjxBPHG.exe
  C:\Windows\System\TjxBPHG.exe
  2⤵
  PID:3408
- C:\Windows\System\XBUugNC.exe
  C:\Windows\System\XBUugNC.exe
  2⤵
  PID:3272
- C:\Windows\System\ClJPFhi.exe
  C:\Windows\System\ClJPFhi.exe
  2⤵
  PID:3472
- C:\Windows\System\prBguIG.exe
  C:\Windows\System\prBguIG.exe
  2⤵
  PID:2800
- C:\Windows\System\UVbdfIV.exe
  C:\Windows\System\UVbdfIV.exe
  2⤵
  PID:3560
- C:\Windows\System\tutNGyu.exe
  C:\Windows\System\tutNGyu.exe
  2⤵
  PID:3608
- C:\Windows\System\zzErvbZ.exe
  C:\Windows\System\zzErvbZ.exe
  2⤵
  PID:3624
- C:\Windows\System\cocSUEb.exe
  C:\Windows\System\cocSUEb.exe
  2⤵
  PID:3764
- C:\Windows\System\UokWpsQ.exe
  C:\Windows\System\UokWpsQ.exe
  2⤵
  PID:3656
- C:\Windows\System\iccUkRS.exe
  C:\Windows\System\iccUkRS.exe
  2⤵
  PID:3868
- C:\Windows\System\jWoFscb.exe
  C:\Windows\System\jWoFscb.exe
  2⤵
  PID:3752
- C:\Windows\System\RLGCfVI.exe
  C:\Windows\System\RLGCfVI.exe
  2⤵
  PID:4004
- C:\Windows\System\oJJYxCj.exe
  C:\Windows\System\oJJYxCj.exe
  2⤵
  PID:3132
- C:\Windows\System\iBVtuuS.exe
  C:\Windows\System\iBVtuuS.exe
  2⤵
  PID:3080
- C:\Windows\System\kKQjnmG.exe
  C:\Windows\System\kKQjnmG.exe
  2⤵
  PID:4060
- C:\Windows\System\KSDaRBd.exe
  C:\Windows\System\KSDaRBd.exe
  2⤵
  PID:4080
- C:\Windows\System\cyVZGlE.exe
  C:\Windows\System\cyVZGlE.exe
  2⤵
  PID:2000
- C:\Windows\System\qxMwuZW.exe
  C:\Windows\System\qxMwuZW.exe
  2⤵
  PID:3284
- C:\Windows\System\ROnfaCM.exe
  C:\Windows\System\ROnfaCM.exe
  2⤵
  PID:3480
- C:\Windows\System\kMCzsub.exe
  C:\Windows\System\kMCzsub.exe
  2⤵
  PID:3508
- C:\Windows\System\QIGBuaZ.exe
  C:\Windows\System\QIGBuaZ.exe
  2⤵
  PID:3396
- C:\Windows\System\ekQnnET.exe
  C:\Windows\System\ekQnnET.exe
  2⤵
  PID:3896
- C:\Windows\System\FJgUtOS.exe
  C:\Windows\System\FJgUtOS.exe
  2⤵
  PID:3888
- C:\Windows\System\FjzPhqq.exe
  C:\Windows\System\FjzPhqq.exe
  2⤵
  PID:3788
- C:\Windows\System\PhjhWom.exe
  C:\Windows\System\PhjhWom.exe
  2⤵
  PID:3940
- C:\Windows\System\sAwVxfe.exe
  C:\Windows\System\sAwVxfe.exe
  2⤵
  PID:3392
- C:\Windows\System\UWOjEdr.exe
  C:\Windows\System\UWOjEdr.exe
  2⤵
  PID:3084
- C:\Windows\System\RUDwAkl.exe
  C:\Windows\System\RUDwAkl.exe
  2⤵
  PID:3652
- C:\Windows\System\ONoNexH.exe
  C:\Windows\System\ONoNexH.exe
  2⤵
  PID:3252
- C:\Windows\System\iLnkoVI.exe
  C:\Windows\System\iLnkoVI.exe
  2⤵
  PID:3876
- C:\Windows\System\drBcYna.exe
  C:\Windows\System\drBcYna.exe
  2⤵
  PID:3444
- C:\Windows\System\ORMaoef.exe
  C:\Windows\System\ORMaoef.exe
  2⤵
  PID:3800
- C:\Windows\System\LvRHiZG.exe
  C:\Windows\System\LvRHiZG.exe
  2⤵
  PID:3712
- C:\Windows\System\bsyamjI.exe
  C:\Windows\System\bsyamjI.exe
  2⤵
  PID:3492
- C:\Windows\System\qUCuIFR.exe
  C:\Windows\System\qUCuIFR.exe
  2⤵
  PID:3232
- C:\Windows\System\vZzKRPQ.exe
  C:\Windows\System\vZzKRPQ.exe
  2⤵
  PID:3704
- C:\Windows\System\leAsytR.exe
  C:\Windows\System\leAsytR.exe
  2⤵
  PID:1588
- C:\Windows\System\xKrkrSA.exe
  C:\Windows\System\xKrkrSA.exe
  2⤵
  PID:4064
- C:\Windows\System\bBYlCzp.exe
  C:\Windows\System\bBYlCzp.exe
  2⤵
  PID:3984
- C:\Windows\System\SJLOWlT.exe
  C:\Windows\System\SJLOWlT.exe
  2⤵
  PID:3852
- C:\Windows\System\dnBTWui.exe
  C:\Windows\System\dnBTWui.exe
  2⤵
  PID:4104
- C:\Windows\System\ZOTVlLk.exe
  C:\Windows\System\ZOTVlLk.exe
  2⤵
  PID:4132
- C:\Windows\System\BHYyglU.exe
  C:\Windows\System\BHYyglU.exe
  2⤵
  PID:4152
- C:\Windows\System\VZPNIne.exe
  C:\Windows\System\VZPNIne.exe
  2⤵
  PID:4172
- C:\Windows\System\GriHeAq.exe
  C:\Windows\System\GriHeAq.exe
  2⤵
  PID:4188
- C:\Windows\System\oaNRjhh.exe
  C:\Windows\System\oaNRjhh.exe
  2⤵
  PID:4216
- C:\Windows\System\BDfGcjS.exe
  C:\Windows\System\BDfGcjS.exe
  2⤵
  PID:4236
- C:\Windows\System\qSlqLaf.exe
  C:\Windows\System\qSlqLaf.exe
  2⤵
  PID:4256
- C:\Windows\System\vXOumwP.exe
  C:\Windows\System\vXOumwP.exe
  2⤵
  PID:4272
- C:\Windows\System\vzcQSsY.exe
  C:\Windows\System\vzcQSsY.exe
  2⤵
  PID:4292
- C:\Windows\System\yWoeIvb.exe
  C:\Windows\System\yWoeIvb.exe
  2⤵
  PID:4312
- C:\Windows\System\vMUyuQs.exe
  C:\Windows\System\vMUyuQs.exe
  2⤵
  PID:4328
- C:\Windows\System\oHxyImr.exe
  C:\Windows\System\oHxyImr.exe
  2⤵
  PID:4348
- C:\Windows\System\mDmKRre.exe
  C:\Windows\System\mDmKRre.exe
  2⤵
  PID:4364
- C:\Windows\System\UdxIhTm.exe
  C:\Windows\System\UdxIhTm.exe
  2⤵
  PID:4380
- C:\Windows\System\REDcNkP.exe
  C:\Windows\System\REDcNkP.exe
  2⤵
  PID:4400
- C:\Windows\System\bzBDPew.exe
  C:\Windows\System\bzBDPew.exe
  2⤵
  PID:4428
- C:\Windows\System\eopTFQa.exe
  C:\Windows\System\eopTFQa.exe
  2⤵
  PID:4448
- C:\Windows\System\DVmqmVs.exe
  C:\Windows\System\DVmqmVs.exe
  2⤵
  PID:4476
- C:\Windows\System\uunphCb.exe
  C:\Windows\System\uunphCb.exe
  2⤵
  PID:4492
- C:\Windows\System\kBhCltq.exe
  C:\Windows\System\kBhCltq.exe
  2⤵
  PID:4508
- C:\Windows\System\GnjIETN.exe
  C:\Windows\System\GnjIETN.exe
  2⤵
  PID:4524
- C:\Windows\System\NpVJyIX.exe
  C:\Windows\System\NpVJyIX.exe
  2⤵
  PID:4544
- C:\Windows\System\oJcSWLE.exe
  C:\Windows\System\oJcSWLE.exe
  2⤵
  PID:4560
- C:\Windows\System\FyAnaee.exe
  C:\Windows\System\FyAnaee.exe
  2⤵
  PID:4576
- C:\Windows\System\aCcCquE.exe
  C:\Windows\System\aCcCquE.exe
  2⤵
  PID:4616
- C:\Windows\System\QQERwan.exe
  C:\Windows\System\QQERwan.exe
  2⤵
  PID:4640
- C:\Windows\System\LTIIMks.exe
  C:\Windows\System\LTIIMks.exe
  2⤵
  PID:4664
- C:\Windows\System\owqEAjC.exe
  C:\Windows\System\owqEAjC.exe
  2⤵
  PID:4688
- C:\Windows\System\FkjIjsE.exe
  C:\Windows\System\FkjIjsE.exe
  2⤵
  PID:4704
- C:\Windows\System\bNbrEoI.exe
  C:\Windows\System\bNbrEoI.exe
  2⤵
  PID:4724
- C:\Windows\System\hqDmvAs.exe
  C:\Windows\System\hqDmvAs.exe
  2⤵
  PID:4744
- C:\Windows\System\QutfhZx.exe
  C:\Windows\System\QutfhZx.exe
  2⤵
  PID:4760
- C:\Windows\System\ixwTRvG.exe
  C:\Windows\System\ixwTRvG.exe
  2⤵
  PID:4776
- C:\Windows\System\zgUiPvZ.exe
  C:\Windows\System\zgUiPvZ.exe
  2⤵
  PID:4796
- C:\Windows\System\jDlOiVJ.exe
  C:\Windows\System\jDlOiVJ.exe
  2⤵
  PID:4820
- C:\Windows\System\VioPDcn.exe
  C:\Windows\System\VioPDcn.exe
  2⤵
  PID:4844
- C:\Windows\System\Ihlifay.exe
  C:\Windows\System\Ihlifay.exe
  2⤵
  PID:4864
- C:\Windows\System\IhQkStP.exe
  C:\Windows\System\IhQkStP.exe
  2⤵
  PID:4888
- C:\Windows\System\ahfxQyp.exe
  C:\Windows\System\ahfxQyp.exe
  2⤵
  PID:4908
- C:\Windows\System\lGuAjAA.exe
  C:\Windows\System\lGuAjAA.exe
  2⤵
  PID:4924
- C:\Windows\System\aPSRMIT.exe
  C:\Windows\System\aPSRMIT.exe
  2⤵
  PID:4944
- C:\Windows\System\KxaoELr.exe
  C:\Windows\System\KxaoELr.exe
  2⤵
  PID:4972
- C:\Windows\System\nvKemFN.exe
  C:\Windows\System\nvKemFN.exe
  2⤵
  PID:4988
- C:\Windows\System\SZMOftn.exe
  C:\Windows\System\SZMOftn.exe
  2⤵
  PID:5004
- C:\Windows\System\WgDwLdJ.exe
  C:\Windows\System\WgDwLdJ.exe
  2⤵
  PID:5020
- C:\Windows\System\wnnbIsy.exe
  C:\Windows\System\wnnbIsy.exe
  2⤵
  PID:5036
- C:\Windows\System\XIGnHux.exe
  C:\Windows\System\XIGnHux.exe
  2⤵
  PID:5072
- C:\Windows\System\DIfmXXZ.exe
  C:\Windows\System\DIfmXXZ.exe
  2⤵
  PID:5088
- C:\Windows\System\jDysvcY.exe
  C:\Windows\System\jDysvcY.exe
  2⤵
  PID:5104
- C:\Windows\System\MmZahAi.exe
  C:\Windows\System\MmZahAi.exe
  2⤵
  PID:4100
- C:\Windows\System\XaLOzKy.exe
  C:\Windows\System\XaLOzKy.exe
  2⤵
  PID:2616
- C:\Windows\System\qQySCWk.exe
  C:\Windows\System\qQySCWk.exe
  2⤵
  PID:2740
- C:\Windows\System\FzFYMxw.exe
  C:\Windows\System\FzFYMxw.exe
  2⤵
  PID:4124
- C:\Windows\System\mRiIfFb.exe
  C:\Windows\System\mRiIfFb.exe
  2⤵
  PID:4224
- C:\Windows\System\dLfvcaV.exe
  C:\Windows\System\dLfvcaV.exe
  2⤵
  PID:4168
- C:\Windows\System\gBMbWPC.exe
  C:\Windows\System\gBMbWPC.exe
  2⤵
  PID:4264
- C:\Windows\System\SVrFZSQ.exe
  C:\Windows\System\SVrFZSQ.exe
  2⤵
  PID:4212
- C:\Windows\System\yVzYXVh.exe
  C:\Windows\System\yVzYXVh.exe
  2⤵
  PID:4372
- C:\Windows\System\WGUOxlt.exe
  C:\Windows\System\WGUOxlt.exe
  2⤵
  PID:4460
- C:\Windows\System\XLOpmbu.exe
  C:\Windows\System\XLOpmbu.exe
  2⤵
  PID:4392
- C:\Windows\System\cXgNFAj.exe
  C:\Windows\System\cXgNFAj.exe
  2⤵
  PID:4504
- C:\Windows\System\miPBMXk.exe
  C:\Windows\System\miPBMXk.exe
  2⤵
  PID:4444
- C:\Windows\System\hsEvMQr.exe
  C:\Windows\System\hsEvMQr.exe
  2⤵
  PID:4396
- C:\Windows\System\SpbyABd.exe
  C:\Windows\System\SpbyABd.exe
  2⤵
  PID:4436
- C:\Windows\System\rlqYtkQ.exe
  C:\Windows\System\rlqYtkQ.exe
  2⤵
  PID:4488
- C:\Windows\System\pwUaJCU.exe
  C:\Windows\System\pwUaJCU.exe
  2⤵
  PID:4592
- C:\Windows\System\igBCAes.exe
  C:\Windows\System\igBCAes.exe
  2⤵
  PID:4612
- C:\Windows\System\GDxVmeX.exe
  C:\Windows\System\GDxVmeX.exe
  2⤵
  PID:4652
- C:\Windows\System\LWzxFTb.exe
  C:\Windows\System\LWzxFTb.exe
  2⤵
  PID:4676
- C:\Windows\System\iLQqJTG.exe
  C:\Windows\System\iLQqJTG.exe
  2⤵
  PID:4712
- C:\Windows\System\lERTfUJ.exe
  C:\Windows\System\lERTfUJ.exe
  2⤵
  PID:4732
- C:\Windows\System\XCKeHrg.exe
  C:\Windows\System\XCKeHrg.exe
  2⤵
  PID:4788
- C:\Windows\System\rtSTGkc.exe
  C:\Windows\System\rtSTGkc.exe
  2⤵
  PID:4772
- C:\Windows\System\trmopzS.exe
  C:\Windows\System\trmopzS.exe
  2⤵
  PID:4816
- C:\Windows\System\INikOJZ.exe
  C:\Windows\System\INikOJZ.exe
  2⤵
  PID:4872
- C:\Windows\System\EyKPkXI.exe
  C:\Windows\System\EyKPkXI.exe
  2⤵
  PID:4916
- C:\Windows\System\ZOphpng.exe
  C:\Windows\System\ZOphpng.exe
  2⤵
  PID:4960
- C:\Windows\System\GmTAAIO.exe
  C:\Windows\System\GmTAAIO.exe
  2⤵
  PID:4904
- C:\Windows\System\gXJnyXm.exe
  C:\Windows\System\gXJnyXm.exe
  2⤵
  PID:4996
- C:\Windows\System\sLnnqPp.exe
  C:\Windows\System\sLnnqPp.exe
  2⤵
  PID:5012
- C:\Windows\System\OFaTOoP.exe
  C:\Windows\System\OFaTOoP.exe
  2⤵
  PID:5048
- C:\Windows\System\yxjgYdp.exe
  C:\Windows\System\yxjgYdp.exe
  2⤵
  PID:5064
- C:\Windows\System\oEyoDog.exe
  C:\Windows\System\oEyoDog.exe
  2⤵
  PID:3108
- C:\Windows\System\nATWCTV.exe
  C:\Windows\System\nATWCTV.exe
  2⤵
  PID:4184
- C:\Windows\System\fLyvaVk.exe
  C:\Windows\System\fLyvaVk.exe
  2⤵
  PID:4244
- C:\Windows\System\TUEUHZr.exe
  C:\Windows\System\TUEUHZr.exe
  2⤵
  PID:4204
- C:\Windows\System\LrcZPgf.exe
  C:\Windows\System\LrcZPgf.exe
  2⤵
  PID:4532
- C:\Windows\System\BLtdKZe.exe
  C:\Windows\System\BLtdKZe.exe
  2⤵
  PID:4572
- C:\Windows\System\VnazLqe.exe
  C:\Windows\System\VnazLqe.exe
  2⤵
  PID:4280
- C:\Windows\System\FLQbtdH.exe
  C:\Windows\System\FLQbtdH.exe
  2⤵
  PID:4556
- C:\Windows\System\zpiLWiv.exe
  C:\Windows\System\zpiLWiv.exe
  2⤵
  PID:4636
- C:\Windows\System\EarZPda.exe
  C:\Windows\System\EarZPda.exe
  2⤵
  PID:4684
- C:\Windows\System\DXpeENE.exe
  C:\Windows\System\DXpeENE.exe
  2⤵
  PID:4784
- C:\Windows\System\hcGlGIP.exe
  C:\Windows\System\hcGlGIP.exe
  2⤵
  PID:4896
- C:\Windows\System\nTbnNdf.exe
  C:\Windows\System\nTbnNdf.exe
  2⤵
  PID:5056
- C:\Windows\System\LNhqAWD.exe
  C:\Windows\System\LNhqAWD.exe
  2⤵
  PID:5068
- C:\Windows\System\SGtFAzC.exe
  C:\Windows\System\SGtFAzC.exe
  2⤵
  PID:4660
- C:\Windows\System\URRshVN.exe
  C:\Windows\System\URRshVN.exe
  2⤵
  PID:4828
- C:\Windows\System\zZjJmYH.exe
  C:\Windows\System\zZjJmYH.exe
  2⤵
  PID:4940
- C:\Windows\System\qufvkvp.exe
  C:\Windows\System\qufvkvp.exe
  2⤵
  PID:5084
- C:\Windows\System\UmRenST.exe
  C:\Windows\System\UmRenST.exe
  2⤵
  PID:4120
- C:\Windows\System\CuiTtLa.exe
  C:\Windows\System\CuiTtLa.exe
  2⤵
  PID:4968
- C:\Windows\System\lvbdIxU.exe
  C:\Windows\System\lvbdIxU.exe
  2⤵
  PID:4420
- C:\Windows\System\YfXpcMa.exe
  C:\Windows\System\YfXpcMa.exe
  2⤵
  PID:4288
- C:\Windows\System\yZZSkhc.exe
  C:\Windows\System\yZZSkhc.exe
  2⤵
  PID:4536
- C:\Windows\System\fkOqELy.exe
  C:\Windows\System\fkOqELy.exe
  2⤵
  PID:4632
- C:\Windows\System\VdewUgw.exe
  C:\Windows\System\VdewUgw.exe
  2⤵
  PID:2012
- C:\Windows\System\ciHDrUI.exe
  C:\Windows\System\ciHDrUI.exe
  2⤵
  PID:4284
- C:\Windows\System\hutsTFr.exe
  C:\Windows\System\hutsTFr.exe
  2⤵
  PID:4500
- C:\Windows\System\hvYVAFX.exe
  C:\Windows\System\hvYVAFX.exe
  2⤵
  PID:5100
- C:\Windows\System\MtvGzoM.exe
  C:\Windows\System\MtvGzoM.exe
  2⤵
  PID:5028
- C:\Windows\System\lYbOQCJ.exe
  C:\Windows\System\lYbOQCJ.exe
  2⤵
  PID:4700
- C:\Windows\System\pWJsuSA.exe
  C:\Windows\System\pWJsuSA.exe
  2⤵
  PID:4856
- C:\Windows\System\buuvodN.exe
  C:\Windows\System\buuvodN.exe
  2⤵
  PID:4440
- C:\Windows\System\ESOaNQb.exe
  C:\Windows\System\ESOaNQb.exe
  2⤵
  PID:4696
- C:\Windows\System\BolIpJg.exe
  C:\Windows\System\BolIpJg.exe
  2⤵
  PID:4884
- C:\Windows\System\bDuONtF.exe
  C:\Windows\System\bDuONtF.exe
  2⤵
  PID:4416
- C:\Windows\System\lFOaiPK.exe
  C:\Windows\System\lFOaiPK.exe
  2⤵
  PID:4472
- C:\Windows\System\bwPsfsu.exe
  C:\Windows\System\bwPsfsu.exe
  2⤵
  PID:4552
- C:\Windows\System\clBaqSH.exe
  C:\Windows\System\clBaqSH.exe
  2⤵
  PID:4812
- C:\Windows\System\BlJkPay.exe
  C:\Windows\System\BlJkPay.exe
  2⤵
  PID:4880
- C:\Windows\System\pZeDLPh.exe
  C:\Windows\System\pZeDLPh.exe
  2⤵
  PID:4600
- C:\Windows\System\XUUwRJO.exe
  C:\Windows\System\XUUwRJO.exe
  2⤵
  PID:4456
- C:\Windows\System\ZnhBcIK.exe
  C:\Windows\System\ZnhBcIK.exe
  2⤵
  PID:4832
- C:\Windows\System\BhhEyZH.exe
  C:\Windows\System\BhhEyZH.exe
  2⤵
  PID:4516
- C:\Windows\System\QoJJjnM.exe
  C:\Windows\System\QoJJjnM.exe
  2⤵
  PID:4148
- C:\Windows\System\NrroZQb.exe
  C:\Windows\System\NrroZQb.exe
  2⤵
  PID:3936
- C:\Windows\System\GdJxlzy.exe
  C:\Windows\System\GdJxlzy.exe
  2⤵
  PID:4232
- C:\Windows\System\ZIlLbrI.exe
  C:\Windows\System\ZIlLbrI.exe
  2⤵
  PID:4720
- C:\Windows\System\KVqeMcC.exe
  C:\Windows\System\KVqeMcC.exe
  2⤵
  PID:5128
- C:\Windows\System\xtnOPhb.exe
  C:\Windows\System\xtnOPhb.exe
  2⤵
  PID:5144
- C:\Windows\System\nHZzMuX.exe
  C:\Windows\System\nHZzMuX.exe
  2⤵
  PID:5164
- C:\Windows\System\YdQsoMu.exe
  C:\Windows\System\YdQsoMu.exe
  2⤵
  PID:5184
- C:\Windows\System\pJIMCfD.exe
  C:\Windows\System\pJIMCfD.exe
  2⤵
  PID:5216
- C:\Windows\System\VuuNVTi.exe
  C:\Windows\System\VuuNVTi.exe
  2⤵
  PID:5240
- C:\Windows\System\NOiEAzz.exe
  C:\Windows\System\NOiEAzz.exe
  2⤵
  PID:5256
- C:\Windows\System\PqaiHRu.exe
  C:\Windows\System\PqaiHRu.exe
  2⤵
  PID:5272
- C:\Windows\System\kvhCIdE.exe
  C:\Windows\System\kvhCIdE.exe
  2⤵
  PID:5304
- C:\Windows\System\mbrlmSy.exe
  C:\Windows\System\mbrlmSy.exe
  2⤵
  PID:5320
- C:\Windows\System\MgrJbFx.exe
  C:\Windows\System\MgrJbFx.exe
  2⤵
  PID:5336
- C:\Windows\System\HySSyzD.exe
  C:\Windows\System\HySSyzD.exe
  2⤵
  PID:5352
- C:\Windows\System\eYMbnhL.exe
  C:\Windows\System\eYMbnhL.exe
  2⤵
  PID:5384
- C:\Windows\System\AugItco.exe
  C:\Windows\System\AugItco.exe
  2⤵
  PID:5400
- C:\Windows\System\TwIeljs.exe
  C:\Windows\System\TwIeljs.exe
  2⤵
  PID:5416
- C:\Windows\System\meMrgBv.exe
  C:\Windows\System\meMrgBv.exe
  2⤵
  PID:5432
- C:\Windows\System\CJgPdCV.exe
  C:\Windows\System\CJgPdCV.exe
  2⤵
  PID:5460
- C:\Windows\System\LblJmOG.exe
  C:\Windows\System\LblJmOG.exe
  2⤵
  PID:5480
- C:\Windows\System\HPnmmHv.exe
  C:\Windows\System\HPnmmHv.exe
  2⤵
  PID:5496
- C:\Windows\System\lIpFNGj.exe
  C:\Windows\System\lIpFNGj.exe
  2⤵
  PID:5512
- C:\Windows\System\ghSVwws.exe
  C:\Windows\System\ghSVwws.exe
  2⤵
  PID:5532
- C:\Windows\System\uYkFnXu.exe
  C:\Windows\System\uYkFnXu.exe
  2⤵
  PID:5560
- C:\Windows\System\wOutibw.exe
  C:\Windows\System\wOutibw.exe
  2⤵
  PID:5576
- C:\Windows\System\AnlBKfq.exe
  C:\Windows\System\AnlBKfq.exe
  2⤵
  PID:5596
- C:\Windows\System\CBdScum.exe
  C:\Windows\System\CBdScum.exe
  2⤵
  PID:5612
- C:\Windows\System\dYARllX.exe
  C:\Windows\System\dYARllX.exe
  2⤵
  PID:5628
- C:\Windows\System\gBVeUAO.exe
  C:\Windows\System\gBVeUAO.exe
  2⤵
  PID:5648
- C:\Windows\System\PolDiyd.exe
  C:\Windows\System\PolDiyd.exe
  2⤵
  PID:5668
- C:\Windows\System\GtUaFoo.exe
  C:\Windows\System\GtUaFoo.exe
  2⤵
  PID:5684
- C:\Windows\System\cHlAcIS.exe
  C:\Windows\System\cHlAcIS.exe
  2⤵
  PID:5700
- C:\Windows\System\TxwXjGS.exe
  C:\Windows\System\TxwXjGS.exe
  2⤵
  PID:5720
- C:\Windows\System\GnzFRQt.exe
  C:\Windows\System\GnzFRQt.exe
  2⤵
  PID:5736
- C:\Windows\System\gZcbhQd.exe
  C:\Windows\System\gZcbhQd.exe
  2⤵
  PID:5756
- C:\Windows\System\JkVadui.exe
  C:\Windows\System\JkVadui.exe
  2⤵
  PID:5780
- C:\Windows\System\XukIkUf.exe
  C:\Windows\System\XukIkUf.exe
  2⤵
  PID:5800
- C:\Windows\System\KprssRh.exe
  C:\Windows\System\KprssRh.exe
  2⤵
  PID:5820
- C:\Windows\System\GEAloMZ.exe
  C:\Windows\System\GEAloMZ.exe
  2⤵
  PID:5852
- C:\Windows\System\VNRhsea.exe
  C:\Windows\System\VNRhsea.exe
  2⤵
  PID:5868
- C:\Windows\System\VWKNNnV.exe
  C:\Windows\System\VWKNNnV.exe
  2⤵
  PID:5900
- C:\Windows\System\quRoCsR.exe
  C:\Windows\System\quRoCsR.exe
  2⤵
  PID:5916
- C:\Windows\System\kuLIunU.exe
  C:\Windows\System\kuLIunU.exe
  2⤵
  PID:5932
- C:\Windows\System\UrZwvSc.exe
  C:\Windows\System\UrZwvSc.exe
  2⤵
  PID:5948
- C:\Windows\System\WSfegeA.exe
  C:\Windows\System\WSfegeA.exe
  2⤵
  PID:5968
- C:\Windows\System\eqmGwFD.exe
  C:\Windows\System\eqmGwFD.exe
  2⤵
  PID:5992
- C:\Windows\System\oodVPyk.exe
  C:\Windows\System\oodVPyk.exe
  2⤵
  PID:6008
- C:\Windows\System\edBnVPF.exe
  C:\Windows\System\edBnVPF.exe
  2⤵
  PID:6024
- C:\Windows\System\humgVkf.exe
  C:\Windows\System\humgVkf.exe
  2⤵
  PID:6044
- C:\Windows\System\bYNoseE.exe
  C:\Windows\System\bYNoseE.exe
  2⤵
  PID:6088
- C:\Windows\System\ficcunb.exe
  C:\Windows\System\ficcunb.exe
  2⤵
  PID:6108
- C:\Windows\System\uccdwOK.exe
  C:\Windows\System\uccdwOK.exe
  2⤵
  PID:6124
- C:\Windows\System\tatjCJw.exe
  C:\Windows\System\tatjCJw.exe
  2⤵
  PID:4860
- C:\Windows\System\majfqgv.exe
  C:\Windows\System\majfqgv.exe
  2⤵
  PID:5160
- C:\Windows\System\zPWipBu.exe
  C:\Windows\System\zPWipBu.exe
  2⤵
  PID:5208
- C:\Windows\System\CpwzHsv.exe
  C:\Windows\System\CpwzHsv.exe
  2⤵
  PID:5140
- C:\Windows\System\SuRfzoN.exe
  C:\Windows\System\SuRfzoN.exe
  2⤵
  PID:5232
- C:\Windows\System\EJIoHoE.exe
  C:\Windows\System\EJIoHoE.exe
  2⤵
  PID:5280
- C:\Windows\System\cOqqReI.exe
  C:\Windows\System\cOqqReI.exe
  2⤵
  PID:5296
- C:\Windows\System\GkqBaWB.exe
  C:\Windows\System\GkqBaWB.exe
  2⤵
  PID:5332
- C:\Windows\System\ErOPcyZ.exe
  C:\Windows\System\ErOPcyZ.exe
  2⤵
  PID:5372
- C:\Windows\System\UFxiICQ.exe
  C:\Windows\System\UFxiICQ.exe
  2⤵
  PID:5348
- C:\Windows\System\HULfJPJ.exe
  C:\Windows\System\HULfJPJ.exe
  2⤵
  PID:5396
- C:\Windows\System\tlfprql.exe
  C:\Windows\System\tlfprql.exe
  2⤵
  PID:5444
- C:\Windows\System\XONKyaY.exe
  C:\Windows\System\XONKyaY.exe
  2⤵
  PID:4344
- C:\Windows\System\gmmjrHm.exe
  C:\Windows\System\gmmjrHm.exe
  2⤵
  PID:5524
- C:\Windows\System\juuUZUL.exe
  C:\Windows\System\juuUZUL.exe
  2⤵
  PID:5556
- C:\Windows\System\ObYpTkW.exe
  C:\Windows\System\ObYpTkW.exe
  2⤵
  PID:5572
- C:\Windows\System\InuOEwX.exe
  C:\Windows\System\InuOEwX.exe
  2⤵
  PID:5640
- C:\Windows\System\ghYFHtb.exe
  C:\Windows\System\ghYFHtb.exe
  2⤵
  PID:5708
- C:\Windows\System\OsbNnSZ.exe
  C:\Windows\System\OsbNnSZ.exe
  2⤵
  PID:5752
- C:\Windows\System\xcoIhkS.exe
  C:\Windows\System\xcoIhkS.exe
  2⤵
  PID:5588
- C:\Windows\System\twOdBme.exe
  C:\Windows\System\twOdBme.exe
  2⤵
  PID:5732
- C:\Windows\System\XrOuOdM.exe
  C:\Windows\System\XrOuOdM.exe
  2⤵
  PID:5772
- C:\Windows\System\UEFcZha.exe
  C:\Windows\System\UEFcZha.exe
  2⤵
  PID:5664
- C:\Windows\System\XKEZOyp.exe
  C:\Windows\System\XKEZOyp.exe
  2⤵
  PID:5816
- C:\Windows\System\EuCUEKV.exe
  C:\Windows\System\EuCUEKV.exe
  2⤵
  PID:5880
- C:\Windows\System\KBzBeLc.exe
  C:\Windows\System\KBzBeLc.exe
  2⤵
  PID:5924
- C:\Windows\System\swIRuSq.exe
  C:\Windows\System\swIRuSq.exe
  2⤵
  PID:5860
- C:\Windows\System\jgcseax.exe
  C:\Windows\System\jgcseax.exe
  2⤵
  PID:6004
- C:\Windows\System\gmwoJkA.exe
  C:\Windows\System\gmwoJkA.exe
  2⤵
  PID:5940
- C:\Windows\System\vWGkhrz.exe
  C:\Windows\System\vWGkhrz.exe
  2⤵
  PID:6096
- C:\Windows\System\GoWijeF.exe
  C:\Windows\System\GoWijeF.exe
  2⤵
  PID:6084
- C:\Windows\System\BvfWkvB.exe
  C:\Windows\System\BvfWkvB.exe
  2⤵
  PID:6104
- C:\Windows\System\HGrTggY.exe
  C:\Windows\System\HGrTggY.exe
  2⤵
  PID:6132
- C:\Windows\System\eofBoLQ.exe
  C:\Windows\System\eofBoLQ.exe
  2⤵
  PID:5152
- C:\Windows\System\zQSRRgO.exe
  C:\Windows\System\zQSRRgO.exe
  2⤵
  PID:5136
- C:\Windows\System\JMuCQkQ.exe
  C:\Windows\System\JMuCQkQ.exe
  2⤵
  PID:5252
- C:\Windows\System\NWWsnBr.exe
  C:\Windows\System\NWWsnBr.exe
  2⤵
  PID:5364
- C:\Windows\System\TLETDeR.exe
  C:\Windows\System\TLETDeR.exe
  2⤵
  PID:5380
- C:\Windows\System\sLzSaUF.exe
  C:\Windows\System\sLzSaUF.exe
  2⤵
  PID:5452
- C:\Windows\System\pFodznk.exe
  C:\Windows\System\pFodznk.exe
  2⤵
  PID:5476
- C:\Windows\System\wqsUAxA.exe
  C:\Windows\System\wqsUAxA.exe
  2⤵
  PID:5316
- C:\Windows\System\FrMmQbC.exe
  C:\Windows\System\FrMmQbC.exe
  2⤵
  PID:5636
- C:\Windows\System\lYFVDEx.exe
  C:\Windows\System\lYFVDEx.exe
  2⤵
  PID:5748
- C:\Windows\System\CsfWudo.exe
  C:\Windows\System\CsfWudo.exe
  2⤵
  PID:5776
- C:\Windows\System\GLWIbqX.exe
  C:\Windows\System\GLWIbqX.exe
  2⤵
  PID:5848
- C:\Windows\System\DjKBJDv.exe
  C:\Windows\System\DjKBJDv.exe
  2⤵
  PID:5676
- C:\Windows\System\JSDPPYM.exe
  C:\Windows\System\JSDPPYM.exe
  2⤵
  PID:5584
- C:\Windows\System\ttZKJpz.exe
  C:\Windows\System\ttZKJpz.exe
  2⤵
  PID:5692
- C:\Windows\System\ICuhRXf.exe
  C:\Windows\System\ICuhRXf.exe
  2⤵
  PID:5912
- C:\Windows\System\uCldRIU.exe
  C:\Windows\System\uCldRIU.exe
  2⤵
  PID:5896
- C:\Windows\System\IogWPCm.exe
  C:\Windows\System\IogWPCm.exe
  2⤵
  PID:6000
- C:\Windows\System\BzYaZcg.exe
  C:\Windows\System\BzYaZcg.exe
  2⤵
  PID:6056
- C:\Windows\System\InVPKeK.exe
  C:\Windows\System\InVPKeK.exe
  2⤵
  PID:6120
- C:\Windows\System\OnuWnkU.exe
  C:\Windows\System\OnuWnkU.exe
  2⤵
  PID:5200
- C:\Windows\System\SQObmyx.exe
  C:\Windows\System\SQObmyx.exe
  2⤵
  PID:5228
- C:\Windows\System\SMIDRMC.exe
  C:\Windows\System\SMIDRMC.exe
  2⤵
  PID:5368
- C:\Windows\System\JqwtAdz.exe
  C:\Windows\System\JqwtAdz.exe
  2⤵
  PID:5504
- C:\Windows\System\hPebksw.exe
  C:\Windows\System\hPebksw.exe
  2⤵
  PID:5492
- C:\Windows\System\dfBceeD.exe
  C:\Windows\System\dfBceeD.exe
  2⤵
  PID:5624
- C:\Windows\System\YOHMlkC.exe
  C:\Windows\System\YOHMlkC.exe
  2⤵
  PID:5224
- C:\Windows\System\rhAlzOp.exe
  C:\Windows\System\rhAlzOp.exe
  2⤵
  PID:5812
- C:\Windows\System\eWzWEgD.exe
  C:\Windows\System\eWzWEgD.exe
  2⤵
  PID:5908
- C:\Windows\System\zVTdlHH.exe
  C:\Windows\System\zVTdlHH.exe
  2⤵
  PID:6020
- C:\Windows\System\fANDnfa.exe
  C:\Windows\System\fANDnfa.exe
  2⤵
  PID:5328
- C:\Windows\System\BhOaUzu.exe
  C:\Windows\System\BhOaUzu.exe
  2⤵
  PID:5988
- C:\Windows\System\USiDDyX.exe
  C:\Windows\System\USiDDyX.exe
  2⤵
  PID:5156
- C:\Windows\System\nystgWS.exe
  C:\Windows\System\nystgWS.exe
  2⤵
  PID:5508
- C:\Windows\System\lpiueey.exe
  C:\Windows\System\lpiueey.exe
  2⤵
  PID:5568
- C:\Windows\System\eNRHnlR.exe
  C:\Windows\System\eNRHnlR.exe
  2⤵
  PID:5660
- C:\Windows\System\PBhJVIt.exe
  C:\Windows\System\PBhJVIt.exe
  2⤵
  PID:6076
- C:\Windows\System\UaqSaPq.exe
  C:\Windows\System\UaqSaPq.exe
  2⤵
  PID:5520
- C:\Windows\System\nustWVw.exe
  C:\Windows\System\nustWVw.exe
  2⤵
  PID:6116
- C:\Windows\System\KXHBGFb.exe
  C:\Windows\System\KXHBGFb.exe
  2⤵
  PID:5412
- C:\Windows\System\xuAvhau.exe
  C:\Windows\System\xuAvhau.exe
  2⤵
  PID:5728
- C:\Windows\System\JproTrc.exe
  C:\Windows\System\JproTrc.exe
  2⤵
  PID:5236
- C:\Windows\System\UTALode.exe
  C:\Windows\System\UTALode.exe
  2⤵
  PID:5888
- C:\Windows\System\TZJtAAz.exe
  C:\Windows\System\TZJtAAz.exe
  2⤵
  PID:5408
- C:\Windows\System\WkfnStw.exe
  C:\Windows\System\WkfnStw.exe
  2⤵
  PID:5196
- C:\Windows\System\TCepMdo.exe
  C:\Windows\System\TCepMdo.exe
  2⤵
  PID:5984
- C:\Windows\System\RjwqbaU.exe
  C:\Windows\System\RjwqbaU.exe
  2⤵
  PID:5212
- C:\Windows\System\VqExKft.exe
  C:\Windows\System\VqExKft.exe
  2⤵
  PID:6160
- C:\Windows\System\JSjiyZc.exe
  C:\Windows\System\JSjiyZc.exe
  2⤵
  PID:6176
- C:\Windows\System\xxBNUGk.exe
  C:\Windows\System\xxBNUGk.exe
  2⤵
  PID:6196
- C:\Windows\System\JRUnfHV.exe
  C:\Windows\System\JRUnfHV.exe
  2⤵
  PID:6220
- C:\Windows\System\jrkdWUf.exe
  C:\Windows\System\jrkdWUf.exe
  2⤵
  PID:6236
- C:\Windows\System\UMULQNF.exe
  C:\Windows\System\UMULQNF.exe
  2⤵
  PID:6252
- C:\Windows\System\LvKjcuv.exe
  C:\Windows\System\LvKjcuv.exe
  2⤵
  PID:6272
- C:\Windows\System\tokXvCR.exe
  C:\Windows\System\tokXvCR.exe
  2⤵
  PID:6296
- C:\Windows\System\UgOjnLQ.exe
  C:\Windows\System\UgOjnLQ.exe
  2⤵
  PID:6312
- C:\Windows\System\ccXcfCl.exe
  C:\Windows\System\ccXcfCl.exe
  2⤵
  PID:6328
- C:\Windows\System\wekKuOx.exe
  C:\Windows\System\wekKuOx.exe
  2⤵
  PID:6344
- C:\Windows\System\HWSqyNR.exe
  C:\Windows\System\HWSqyNR.exe
  2⤵
  PID:6368
- C:\Windows\System\PvcEQrF.exe
  C:\Windows\System\PvcEQrF.exe
  2⤵
  PID:6396
- C:\Windows\System\LeGNIMV.exe
  C:\Windows\System\LeGNIMV.exe
  2⤵
  PID:6412
- C:\Windows\System\lneakSb.exe
  C:\Windows\System\lneakSb.exe
  2⤵
  PID:6428
- C:\Windows\System\xVYknEd.exe
  C:\Windows\System\xVYknEd.exe
  2⤵
  PID:6448
- C:\Windows\System\zoNAQzw.exe
  C:\Windows\System\zoNAQzw.exe
  2⤵
  PID:6468
- C:\Windows\System\ldMYLHS.exe
  C:\Windows\System\ldMYLHS.exe
  2⤵
  PID:6492
- C:\Windows\System\noibOTe.exe
  C:\Windows\System\noibOTe.exe
  2⤵
  PID:6520
- C:\Windows\System\EsJrICl.exe
  C:\Windows\System\EsJrICl.exe
  2⤵
  PID:6544
- C:\Windows\System\YIhBPen.exe
  C:\Windows\System\YIhBPen.exe
  2⤵
  PID:6572
- C:\Windows\System\XfJCymE.exe
  C:\Windows\System\XfJCymE.exe
  2⤵
  PID:6588
- C:\Windows\System\ddLihrm.exe
  C:\Windows\System\ddLihrm.exe
  2⤵
  PID:6604
- C:\Windows\System\rkzMKJi.exe
  C:\Windows\System\rkzMKJi.exe
  2⤵
  PID:6624
- C:\Windows\System\oskSlLm.exe
  C:\Windows\System\oskSlLm.exe
  2⤵
  PID:6652
- C:\Windows\System\pvTAxTB.exe
  C:\Windows\System\pvTAxTB.exe
  2⤵
  PID:6668
- C:\Windows\System\FQVPlHg.exe
  C:\Windows\System\FQVPlHg.exe
  2⤵
  PID:6684
- C:\Windows\System\ggjVGDh.exe
  C:\Windows\System\ggjVGDh.exe
  2⤵
  PID:6708
- C:\Windows\System\XDDfGuI.exe
  C:\Windows\System\XDDfGuI.exe
  2⤵
  PID:6756
- C:\Windows\System\rXelmsd.exe
  C:\Windows\System\rXelmsd.exe
  2⤵
  PID:6772
- C:\Windows\System\eaQjzmm.exe
  C:\Windows\System\eaQjzmm.exe
  2⤵
  PID:6792
- C:\Windows\System\jsJxJTV.exe
  C:\Windows\System\jsJxJTV.exe
  2⤵
  PID:6808
- C:\Windows\System\FFtOInX.exe
  C:\Windows\System\FFtOInX.exe
  2⤵
  PID:6832
- C:\Windows\System\EghoeeY.exe
  C:\Windows\System\EghoeeY.exe
  2⤵
  PID:6848
- C:\Windows\System\NGEBSmE.exe
  C:\Windows\System\NGEBSmE.exe
  2⤵
  PID:6872
- C:\Windows\System\pUMbsbd.exe
  C:\Windows\System\pUMbsbd.exe
  2⤵
  PID:6888
- C:\Windows\System\KRnMgkT.exe
  C:\Windows\System\KRnMgkT.exe
  2⤵
  PID:6904
- C:\Windows\System\XfgNhhe.exe
  C:\Windows\System\XfgNhhe.exe
  2⤵
  PID:6920
- C:\Windows\System\PKaioOK.exe
  C:\Windows\System\PKaioOK.exe
  2⤵
  PID:6940
- C:\Windows\System\eKtlQaM.exe
  C:\Windows\System\eKtlQaM.exe
  2⤵
  PID:6956
- C:\Windows\System\HhecmuG.exe
  C:\Windows\System\HhecmuG.exe
  2⤵
  PID:6976
- C:\Windows\System\FCBbtgm.exe
  C:\Windows\System\FCBbtgm.exe
  2⤵
  PID:7004
- C:\Windows\System\JkUuWew.exe
  C:\Windows\System\JkUuWew.exe
  2⤵
  PID:7020
- C:\Windows\System\qaPSzeC.exe
  C:\Windows\System\qaPSzeC.exe
  2⤵
  PID:7036
- C:\Windows\System\kzZtNkN.exe
  C:\Windows\System\kzZtNkN.exe
  2⤵
  PID:7072
- C:\Windows\System\scxPGrV.exe
  C:\Windows\System\scxPGrV.exe
  2⤵
  PID:7092
- C:\Windows\System\mYLcnwP.exe
  C:\Windows\System\mYLcnwP.exe
  2⤵
  PID:7108
- C:\Windows\System\mxebasv.exe
  C:\Windows\System\mxebasv.exe
  2⤵
  PID:7124
- C:\Windows\System\NHYeZvM.exe
  C:\Windows\System\NHYeZvM.exe
  2⤵
  PID:7140
- C:\Windows\System\wYYNoxj.exe
  C:\Windows\System\wYYNoxj.exe
  2⤵
  PID:7156
- C:\Windows\System\VzKTnDp.exe
  C:\Windows\System\VzKTnDp.exe
  2⤵
  PID:6148
- C:\Windows\System\NBxhrBo.exe
  C:\Windows\System\NBxhrBo.exe
  2⤵
  PID:6232
- C:\Windows\System\gaXejPB.exe
  C:\Windows\System\gaXejPB.exe
  2⤵
  PID:5472
- C:\Windows\System\OhSKdxt.exe
  C:\Windows\System\OhSKdxt.exe
  2⤵
  PID:6248
- C:\Windows\System\YJkjRxj.exe
  C:\Windows\System\YJkjRxj.exe
  2⤵
  PID:6288
- C:\Windows\System\uGlfrpZ.exe
  C:\Windows\System\uGlfrpZ.exe
  2⤵
  PID:6212
- C:\Windows\System\oGqkHew.exe
  C:\Windows\System\oGqkHew.exe
  2⤵
  PID:6356
- C:\Windows\System\RSaOnyW.exe
  C:\Windows\System\RSaOnyW.exe
  2⤵
  PID:6388
- C:\Windows\System\VUDPuCj.exe
  C:\Windows\System\VUDPuCj.exe
  2⤵
  PID:6456
- C:\Windows\System\MBverGf.exe
  C:\Windows\System\MBverGf.exe
  2⤵
  PID:6508
- C:\Windows\System\tKEsmxb.exe
  C:\Windows\System\tKEsmxb.exe
  2⤵
  PID:6476
- C:\Windows\System\BmKsqNB.exe
  C:\Windows\System\BmKsqNB.exe
  2⤵
  PID:6480
- C:\Windows\System\kljAhoo.exe
  C:\Windows\System\kljAhoo.exe
  2⤵
  PID:6532
- C:\Windows\System\TAQqDnS.exe
  C:\Windows\System\TAQqDnS.exe
  2⤵
  PID:6600
- C:\Windows\System\KxcBXlS.exe
  C:\Windows\System\KxcBXlS.exe
  2⤵
  PID:6664
- C:\Windows\System\sRNkhGj.exe
  C:\Windows\System\sRNkhGj.exe
  2⤵
  PID:6620
- C:\Windows\System\PvGwhME.exe
  C:\Windows\System\PvGwhME.exe
  2⤵
  PID:6696
- C:\Windows\System\tiETjUz.exe
  C:\Windows\System\tiETjUz.exe
  2⤵
  PID:6724
- C:\Windows\System\EkFHYyx.exe
  C:\Windows\System\EkFHYyx.exe
  2⤵
  PID:6764
- C:\Windows\System\kQKkHEw.exe
  C:\Windows\System\kQKkHEw.exe
  2⤵
  PID:6824
- C:\Windows\System\DjIPhtS.exe
  C:\Windows\System\DjIPhtS.exe
  2⤵
  PID:6860
- C:\Windows\System\KrTcQRe.exe
  C:\Windows\System\KrTcQRe.exe
  2⤵
  PID:6840
- C:\Windows\System\ltyzsfG.exe
  C:\Windows\System\ltyzsfG.exe
  2⤵
  PID:6932
- C:\Windows\System\YytEsZc.exe
  C:\Windows\System\YytEsZc.exe
  2⤵
  PID:7000
- C:\Windows\System\yFSFpyy.exe
  C:\Windows\System\yFSFpyy.exe
  2⤵
  PID:6988
- C:\Windows\System\nYkMXHQ.exe
  C:\Windows\System\nYkMXHQ.exe
  2⤵
  PID:6912
- C:\Windows\System\xxSLgzw.exe
  C:\Windows\System\xxSLgzw.exe
  2⤵
  PID:7064
- C:\Windows\System\MNsIeqX.exe
  C:\Windows\System\MNsIeqX.exe
  2⤵
  PID:7100
- C:\Windows\System\hyqjTxA.exe
  C:\Windows\System\hyqjTxA.exe
  2⤵
  PID:7136
- C:\Windows\System\HZoSixX.exe
  C:\Windows\System\HZoSixX.exe
  2⤵
  PID:7152
- C:\Windows\System\kGYjKXP.exe
  C:\Windows\System\kGYjKXP.exe
  2⤵
  PID:6244
- C:\Windows\System\OjwlqPZ.exe
  C:\Windows\System\OjwlqPZ.exe
  2⤵
  PID:6284
- C:\Windows\System\ORigrFe.exe
  C:\Windows\System\ORigrFe.exe
  2⤵
  PID:7120
- C:\Windows\System\jMpFSGZ.exe
  C:\Windows\System\jMpFSGZ.exe
  2⤵
  PID:6512
- C:\Windows\System\Bbntrzo.exe
  C:\Windows\System\Bbntrzo.exe
  2⤵
  PID:6436
- C:\Windows\System\uuTxPUK.exe
  C:\Windows\System\uuTxPUK.exe
  2⤵
  PID:6536
- C:\Windows\System\zKHrntr.exe
  C:\Windows\System\zKHrntr.exe
  2⤵
  PID:6204
- C:\Windows\System\UceKFiN.exe
  C:\Windows\System\UceKFiN.exe
  2⤵
  PID:6556
- C:\Windows\System\NxpNETz.exe
  C:\Windows\System\NxpNETz.exe
  2⤵
  PID:6596
- C:\Windows\System\QlpVXDR.exe
  C:\Windows\System\QlpVXDR.exe
  2⤵
  PID:6616
- C:\Windows\System\kBtEMqg.exe
  C:\Windows\System\kBtEMqg.exe
  2⤵
  PID:6752
- C:\Windows\System\yfooHbZ.exe
  C:\Windows\System\yfooHbZ.exe
  2⤵
  PID:6896
- C:\Windows\System\SZLYKRb.exe
  C:\Windows\System\SZLYKRb.exe
  2⤵
  PID:6984
- C:\Windows\System\YWAnibJ.exe
  C:\Windows\System\YWAnibJ.exe
  2⤵
  PID:6720
- C:\Windows\System\LtOIRyA.exe
  C:\Windows\System\LtOIRyA.exe
  2⤵
  PID:6964
- C:\Windows\System\McwydIz.exe
  C:\Windows\System\McwydIz.exe
  2⤵
  PID:6784
- C:\Windows\System\iMJJStO.exe
  C:\Windows\System\iMJJStO.exe
  2⤵
  PID:7052
- C:\Windows\System\lYdyzQG.exe
  C:\Windows\System\lYdyzQG.exe
  2⤵
  PID:6636
- C:\Windows\System\TtrmxPW.exe
  C:\Windows\System\TtrmxPW.exe
  2⤵
  PID:6304
- C:\Windows\System\JNpFpsY.exe
  C:\Windows\System\JNpFpsY.exe
  2⤵
  PID:7084
- C:\Windows\System\pVQodmV.exe
  C:\Windows\System\pVQodmV.exe
  2⤵
  PID:6420
- C:\Windows\System\fLHxqZU.exe
  C:\Windows\System\fLHxqZU.exe
  2⤵
  PID:6408
- C:\Windows\System\BHWiIgV.exe
  C:\Windows\System\BHWiIgV.exe
  2⤵
  PID:6464
- C:\Windows\System\cyNNnHo.exe
  C:\Windows\System\cyNNnHo.exe
  2⤵
  PID:6500
- C:\Windows\System\JseQiAn.exe
  C:\Windows\System\JseQiAn.exe
  2⤵
  PID:6952
- C:\Windows\System\QygtCaa.exe
  C:\Windows\System\QygtCaa.exe
  2⤵
  PID:6844
- C:\Windows\System\uGeqxqR.exe
  C:\Windows\System\uGeqxqR.exe
  2⤵
  PID:6828
- C:\Windows\System\ItkYMzV.exe
  C:\Windows\System\ItkYMzV.exe
  2⤵
  PID:6716
- C:\Windows\System\mdpnGlC.exe
  C:\Windows\System\mdpnGlC.exe
  2⤵
  PID:7028
- C:\Windows\System\jNlemQe.exe
  C:\Windows\System\jNlemQe.exe
  2⤵
  PID:6972
- C:\Windows\System\auwPbbG.exe
  C:\Windows\System\auwPbbG.exe
  2⤵
  PID:6336
- C:\Windows\System\zDNKpgp.exe
  C:\Windows\System\zDNKpgp.exe
  2⤵
  PID:6644
- C:\Windows\System\yVIWgUo.exe
  C:\Windows\System\yVIWgUo.exe
  2⤵
  PID:7088
- C:\Windows\System\mPySBXZ.exe
  C:\Windows\System\mPySBXZ.exe
  2⤵
  PID:6404
- C:\Windows\System\ZGynmDU.exe
  C:\Windows\System\ZGynmDU.exe
  2⤵
  PID:6868
- C:\Windows\System\MNypGdm.exe
  C:\Windows\System\MNypGdm.exe
  2⤵
  PID:6216
- C:\Windows\System\AgFHgUz.exe
  C:\Windows\System\AgFHgUz.exe
  2⤵
  PID:7044
- C:\Windows\System\WvFMnHN.exe
  C:\Windows\System\WvFMnHN.exe
  2⤵
  PID:7184
- C:\Windows\System\rwLMpFr.exe
  C:\Windows\System\rwLMpFr.exe
  2⤵
  PID:7200
- C:\Windows\System\cHCgbYv.exe
  C:\Windows\System\cHCgbYv.exe
  2⤵
  PID:7220
- C:\Windows\System\TRxTqRh.exe
  C:\Windows\System\TRxTqRh.exe
  2⤵
  PID:7268
- C:\Windows\System\WSjMNGK.exe
  C:\Windows\System\WSjMNGK.exe
  2⤵
  PID:7284
- C:\Windows\System\LYqJEEU.exe
  C:\Windows\System\LYqJEEU.exe
  2⤵
  PID:7300
- C:\Windows\System\kWemAJf.exe
  C:\Windows\System\kWemAJf.exe
  2⤵
  PID:7320
- C:\Windows\System\pklBTes.exe
  C:\Windows\System\pklBTes.exe
  2⤵
  PID:7336
- C:\Windows\System\ULCulap.exe
  C:\Windows\System\ULCulap.exe
  2⤵
  PID:7352
- C:\Windows\System\VhOnUkq.exe
  C:\Windows\System\VhOnUkq.exe
  2⤵
  PID:7372
- C:\Windows\System\CvuxzRZ.exe
  C:\Windows\System\CvuxzRZ.exe
  2⤵
  PID:7392
- C:\Windows\System\PAAGWDn.exe
  C:\Windows\System\PAAGWDn.exe
  2⤵
  PID:7412
- C:\Windows\System\yqumsqj.exe
  C:\Windows\System\yqumsqj.exe
  2⤵
  PID:7432
- C:\Windows\System\KPDZSTe.exe
  C:\Windows\System\KPDZSTe.exe
  2⤵
  PID:7448
- C:\Windows\System\CnyXCGw.exe
  C:\Windows\System\CnyXCGw.exe
  2⤵
  PID:7464
- C:\Windows\System\WzuYBUQ.exe
  C:\Windows\System\WzuYBUQ.exe
  2⤵
  PID:7484
- C:\Windows\System\VEmiJIM.exe
  C:\Windows\System\VEmiJIM.exe
  2⤵
  PID:7500
- C:\Windows\System\zqAHsON.exe
  C:\Windows\System\zqAHsON.exe
  2⤵
  PID:7548
- C:\Windows\System\BfVsJop.exe
  C:\Windows\System\BfVsJop.exe
  2⤵
  PID:7564
- C:\Windows\System\RWAPXYn.exe
  C:\Windows\System\RWAPXYn.exe
  2⤵
  PID:7584
- C:\Windows\System\edrUlko.exe
  C:\Windows\System\edrUlko.exe
  2⤵
  PID:7604
- C:\Windows\System\PGYiBec.exe
  C:\Windows\System\PGYiBec.exe
  2⤵
  PID:7620
- C:\Windows\System\jFQTWij.exe
  C:\Windows\System\jFQTWij.exe
  2⤵
  PID:7636
- C:\Windows\System\xsUtgyz.exe
  C:\Windows\System\xsUtgyz.exe
  2⤵
  PID:7660
- C:\Windows\System\BMGSZND.exe
  C:\Windows\System\BMGSZND.exe
  2⤵
  PID:7680
- C:\Windows\System\twMgzFJ.exe
  C:\Windows\System\twMgzFJ.exe
  2⤵
  PID:7708
- C:\Windows\System\LDnSlpl.exe
  C:\Windows\System\LDnSlpl.exe
  2⤵
  PID:7724
- C:\Windows\System\ITMNCxF.exe
  C:\Windows\System\ITMNCxF.exe
  2⤵
  PID:7740
- C:\Windows\System\NbPpZjN.exe
  C:\Windows\System\NbPpZjN.exe
  2⤵
  PID:7756
- C:\Windows\System\fNQkVMU.exe
  C:\Windows\System\fNQkVMU.exe
  2⤵
  PID:7776
- C:\Windows\System\rcyXmLI.exe
  C:\Windows\System\rcyXmLI.exe
  2⤵
  PID:7792
- C:\Windows\System\ExYkMou.exe
  C:\Windows\System\ExYkMou.exe
  2⤵
  PID:7820
- C:\Windows\System\GxGxSTj.exe
  C:\Windows\System\GxGxSTj.exe
  2⤵
  PID:7844
- C:\Windows\System\pPBdTwr.exe
  C:\Windows\System\pPBdTwr.exe
  2⤵
  PID:7868
- C:\Windows\System\WmwSPLS.exe
  C:\Windows\System\WmwSPLS.exe
  2⤵
  PID:7888
- C:\Windows\System\airZmIX.exe
  C:\Windows\System\airZmIX.exe
  2⤵
  PID:7904
- C:\Windows\System\tdFIZeS.exe
  C:\Windows\System\tdFIZeS.exe
  2⤵
  PID:7920
- C:\Windows\System\hZbPnAp.exe
  C:\Windows\System\hZbPnAp.exe
  2⤵
  PID:7952
- C:\Windows\System\QDBcbcw.exe
  C:\Windows\System\QDBcbcw.exe
  2⤵
  PID:7968
- C:\Windows\System\bELEmQC.exe
  C:\Windows\System\bELEmQC.exe
  2⤵
  PID:7984
- C:\Windows\System\VBGpoTg.exe
  C:\Windows\System\VBGpoTg.exe
  2⤵
  PID:8000
- C:\Windows\System\UwFxirw.exe
  C:\Windows\System\UwFxirw.exe
  2⤵
  PID:8016
- C:\Windows\System\ieiKJBD.exe
  C:\Windows\System\ieiKJBD.exe
  2⤵
  PID:8036
- C:\Windows\System\zqaIyEM.exe
  C:\Windows\System\zqaIyEM.exe
  2⤵
  PID:8060
- C:\Windows\System\IWETMqw.exe
  C:\Windows\System\IWETMqw.exe
  2⤵
  PID:8076
- C:\Windows\System\USZPFbe.exe
  C:\Windows\System\USZPFbe.exe
  2⤵
  PID:8092
- C:\Windows\System\OhXoFjL.exe
  C:\Windows\System\OhXoFjL.exe
  2⤵
  PID:8108
- C:\Windows\System\zKYaPgl.exe
  C:\Windows\System\zKYaPgl.exe
  2⤵
  PID:8124
- C:\Windows\System\YjAhtac.exe
  C:\Windows\System\YjAhtac.exe
  2⤵
  PID:8168
- C:\Windows\System\TEMzyPM.exe
  C:\Windows\System\TEMzyPM.exe
  2⤵
  PID:8188
- C:\Windows\System\MfZAFQt.exe
  C:\Windows\System\MfZAFQt.exe
  2⤵
  PID:7032
- C:\Windows\System\EbCtUUg.exe
  C:\Windows\System\EbCtUUg.exe
  2⤵
  PID:7192
- C:\Windows\System\KYteXRW.exe
  C:\Windows\System\KYteXRW.exe
  2⤵
  PID:6140
- C:\Windows\System\SevdplX.exe
  C:\Windows\System\SevdplX.exe
  2⤵
  PID:7180
- C:\Windows\System\GsCXSEr.exe
  C:\Windows\System\GsCXSEr.exe
  2⤵
  PID:6640
- C:\Windows\System\LegQcmI.exe
  C:\Windows\System\LegQcmI.exe
  2⤵
  PID:7228
- C:\Windows\System\mqaZdGa.exe
  C:\Windows\System\mqaZdGa.exe
  2⤵
  PID:7292
- C:\Windows\System\rsqCpsU.exe
  C:\Windows\System\rsqCpsU.exe
  2⤵
  PID:7312
- C:\Windows\System\OcYbwMY.exe
  C:\Windows\System\OcYbwMY.exe
  2⤵
  PID:7360
- C:\Windows\System\WSkfejE.exe
  C:\Windows\System\WSkfejE.exe
  2⤵
  PID:7404
- C:\Windows\System\usTZSAf.exe
  C:\Windows\System\usTZSAf.exe
  2⤵
  PID:7424
- C:\Windows\System\HCOqGLM.exe
  C:\Windows\System\HCOqGLM.exe
  2⤵
  PID:7384
- C:\Windows\System\nQjSDXK.exe
  C:\Windows\System\nQjSDXK.exe
  2⤵
  PID:7492
- C:\Windows\System\aUuvwcu.exe
  C:\Windows\System\aUuvwcu.exe
  2⤵
  PID:7440
- C:\Windows\System\qiwWMYP.exe
  C:\Windows\System\qiwWMYP.exe
  2⤵
  PID:7516
- C:\Windows\System\PvMmgXG.exe
  C:\Windows\System\PvMmgXG.exe
  2⤵
  PID:7536
- C:\Windows\System\bCVsMra.exe
  C:\Windows\System\bCVsMra.exe
  2⤵
  PID:7596
- C:\Windows\System\lbWfyxw.exe
  C:\Windows\System\lbWfyxw.exe
  2⤵
  PID:7648
- C:\Windows\System\yhzETdU.exe
  C:\Windows\System\yhzETdU.exe
  2⤵
  PID:7656
- C:\Windows\System\LHAmTap.exe
  C:\Windows\System\LHAmTap.exe
  2⤵
  PID:7692
- C:\Windows\System\YYmyTRm.exe
  C:\Windows\System\YYmyTRm.exe
  2⤵
  PID:7720
- C:\Windows\System\zoOclPq.exe
  C:\Windows\System\zoOclPq.exe
  2⤵
  PID:7768
- C:\Windows\System\TcXEelI.exe
  C:\Windows\System\TcXEelI.exe
  2⤵
  PID:7812
- C:\Windows\System\jIlvyvQ.exe
  C:\Windows\System\jIlvyvQ.exe
  2⤵
  PID:7864
- C:\Windows\System\gsTeHKi.exe
  C:\Windows\System\gsTeHKi.exe
  2⤵
  PID:7828
- C:\Windows\System\NKijyDa.exe
  C:\Windows\System\NKijyDa.exe
  2⤵
  PID:7896
- C:\Windows\System\GErigVI.exe
  C:\Windows\System\GErigVI.exe
  2⤵
  PID:7912
- C:\Windows\System\EdCQclA.exe
  C:\Windows\System\EdCQclA.exe
  2⤵
  PID:7980
- C:\Windows\System\qfxwnpF.exe
  C:\Windows\System\qfxwnpF.exe
  2⤵
  PID:8024
- C:\Windows\System\rztMTmg.exe
  C:\Windows\System\rztMTmg.exe
  2⤵
  PID:7996
- C:\Windows\System\tDPtxOu.exe
  C:\Windows\System\tDPtxOu.exe
  2⤵
  PID:7960
- C:\Windows\System\PNUwWgP.exe
  C:\Windows\System\PNUwWgP.exe
  2⤵
  PID:8068
- C:\Windows\System\CxKSBfo.exe
  C:\Windows\System\CxKSBfo.exe
  2⤵
  PID:8104
- C:\Windows\System\qGkZsrb.exe
  C:\Windows\System\qGkZsrb.exe
  2⤵
  PID:8160
- C:\Windows\System\rGNSiKN.exe
  C:\Windows\System\rGNSiKN.exe
  2⤵
  PID:6660
- C:\Windows\System\qlIexBf.exe
  C:\Windows\System\qlIexBf.exe
  2⤵
  PID:7244
- C:\Windows\System\zWUSUuY.exe
  C:\Windows\System\zWUSUuY.exe
  2⤵
  PID:7256
- C:\Windows\System\aytRQcg.exe
  C:\Windows\System\aytRQcg.exe
  2⤵
  PID:6264
- C:\Windows\System\CPRSunX.exe
  C:\Windows\System\CPRSunX.exe
  2⤵
  PID:7060
- C:\Windows\System\yCbuWCp.exe
  C:\Windows\System\yCbuWCp.exe
  2⤵
  PID:7460
- C:\Windows\System\RKtpUdx.exe
  C:\Windows\System\RKtpUdx.exe
  2⤵
  PID:7420
- C:\Windows\System\UtlVoZK.exe
  C:\Windows\System\UtlVoZK.exe
  2⤵
  PID:7368
- C:\Windows\System\exJIFjH.exe
  C:\Windows\System\exJIFjH.exe
  2⤵
  PID:7524
- C:\Windows\System\GiZSyRf.exe
  C:\Windows\System\GiZSyRf.exe
  2⤵
  PID:7480
- C:\Windows\System\WfYyECq.exe
  C:\Windows\System\WfYyECq.exe
  2⤵
  PID:7688
- C:\Windows\System\pvltdgK.exe
  C:\Windows\System\pvltdgK.exe
  2⤵
  PID:7764
- C:\Windows\System\BvXagVG.exe
  C:\Windows\System\BvXagVG.exe
  2⤵
  PID:7804
- C:\Windows\System\bIkvBYZ.exe
  C:\Windows\System\bIkvBYZ.exe
  2⤵
  PID:6172
- C:\Windows\System\LKpZWQU.exe
  C:\Windows\System\LKpZWQU.exe
  2⤵
  PID:7784
- C:\Windows\System\euDVmnS.exe
  C:\Windows\System\euDVmnS.exe
  2⤵
  PID:7840
- C:\Windows\System\raxqbBA.exe
  C:\Windows\System\raxqbBA.exe
  2⤵
  PID:7936
- C:\Windows\System\kGUtJOg.exe
  C:\Windows\System\kGUtJOg.exe
  2⤵
  PID:8088
- C:\Windows\System\StQQuvL.exe
  C:\Windows\System\StQQuvL.exe
  2⤵
  PID:7964
- C:\Windows\System\iglvmXn.exe
  C:\Windows\System\iglvmXn.exe
  2⤵
  PID:8100
- C:\Windows\System\OYevYMD.exe
  C:\Windows\System\OYevYMD.exe
  2⤵
  PID:8136
- C:\Windows\System\pHVLYeL.exe
  C:\Windows\System\pHVLYeL.exe
  2⤵
  PID:6632
- C:\Windows\System\PhTYJmM.exe
  C:\Windows\System\PhTYJmM.exe
  2⤵
  PID:7216
- C:\Windows\System\BowDzdR.exe
  C:\Windows\System\BowDzdR.exe
  2⤵
  PID:7364
- C:\Windows\System\MNmGqHE.exe
  C:\Windows\System\MNmGqHE.exe
  2⤵
  PID:6188
- C:\Windows\System\eAWWwLM.exe
  C:\Windows\System\eAWWwLM.exe
  2⤵
  PID:7560
- C:\Windows\System\CVvrzcR.exe
  C:\Windows\System\CVvrzcR.exe
  2⤵
  PID:7544
- C:\Windows\System\DdzLldG.exe
  C:\Windows\System\DdzLldG.exe
  2⤵
  PID:7632
- C:\Windows\System\FeVuqsQ.exe
  C:\Windows\System\FeVuqsQ.exe
  2⤵
  PID:7752
- C:\Windows\System\VQnkjgV.exe
  C:\Windows\System\VQnkjgV.exe
  2⤵
  PID:7876
- C:\Windows\System\yOHxIZG.exe
  C:\Windows\System\yOHxIZG.exe
  2⤵
  PID:7932
- C:\Windows\System\rdAaRVM.exe
  C:\Windows\System\rdAaRVM.exe
  2⤵
  PID:8056
- C:\Windows\System\pPOxQnA.exe
  C:\Windows\System\pPOxQnA.exe
  2⤵
  PID:8116
- C:\Windows\System\fHvDlsH.exe
  C:\Windows\System\fHvDlsH.exe
  2⤵
  PID:7232
- C:\Windows\System\UrWHDsY.exe
  C:\Windows\System\UrWHDsY.exe
  2⤵
  PID:8152
- C:\Windows\System\KgeIOOT.exe
  C:\Windows\System\KgeIOOT.exe
  2⤵
  PID:7476
- C:\Windows\System\NrgJFCW.exe
  C:\Windows\System\NrgJFCW.exe
  2⤵
  PID:7672
- C:\Windows\System\DOiaJzS.exe
  C:\Windows\System\DOiaJzS.exe
  2⤵
  PID:7576
- C:\Windows\System\zhaTboA.exe
  C:\Windows\System\zhaTboA.exe
  2⤵
  PID:7428
- C:\Windows\System\LPaNBbr.exe
  C:\Windows\System\LPaNBbr.exe
  2⤵
  PID:7808
- C:\Windows\System\lGOrYGb.exe
  C:\Windows\System\lGOrYGb.exe
  2⤵
  PID:8048
- C:\Windows\System\zUdYBrh.exe
  C:\Windows\System\zUdYBrh.exe
  2⤵
  PID:7308
- C:\Windows\System\HnGQebO.exe
  C:\Windows\System\HnGQebO.exe
  2⤵
  PID:7380
- C:\Windows\System\aWumJgm.exe
  C:\Windows\System\aWumJgm.exe
  2⤵
  PID:8044
- C:\Windows\System\lottmuh.exe
  C:\Windows\System\lottmuh.exe
  2⤵
  PID:7928
- C:\Windows\System\jxVIlDU.exe
  C:\Windows\System\jxVIlDU.exe
  2⤵
  PID:7328
- C:\Windows\System\FmHWBNS.exe
  C:\Windows\System\FmHWBNS.exe
  2⤵
  PID:8204
- C:\Windows\System\UGQDFPH.exe
  C:\Windows\System\UGQDFPH.exe
  2⤵
  PID:8220
- C:\Windows\System\QpnrRsj.exe
  C:\Windows\System\QpnrRsj.exe
  2⤵
  PID:8236
- C:\Windows\System\BSZpuQY.exe
  C:\Windows\System\BSZpuQY.exe
  2⤵
  PID:8280
- C:\Windows\System\doMDMXb.exe
  C:\Windows\System\doMDMXb.exe
  2⤵
  PID:8296
- C:\Windows\System\ARTWTvB.exe
  C:\Windows\System\ARTWTvB.exe
  2⤵
  PID:8312
- C:\Windows\System\eounhZa.exe
  C:\Windows\System\eounhZa.exe
  2⤵
  PID:8336
- C:\Windows\System\AquvpuF.exe
  C:\Windows\System\AquvpuF.exe
  2⤵
  PID:8352
- C:\Windows\System\HGMJbyH.exe
  C:\Windows\System\HGMJbyH.exe
  2⤵
  PID:8368
- C:\Windows\System\iApNNJR.exe
  C:\Windows\System\iApNNJR.exe
  2⤵
  PID:8384
- C:\Windows\System\EcSpLsi.exe
  C:\Windows\System\EcSpLsi.exe
  2⤵
  PID:8400
- C:\Windows\System\HwFbGOU.exe
  C:\Windows\System\HwFbGOU.exe
  2⤵
  PID:8416
- C:\Windows\System\vLFZpnA.exe
  C:\Windows\System\vLFZpnA.exe
  2⤵
  PID:8432
- C:\Windows\System\SFYaFTN.exe
  C:\Windows\System\SFYaFTN.exe
  2⤵
  PID:8452
- C:\Windows\System\CXhAvNP.exe
  C:\Windows\System\CXhAvNP.exe
  2⤵
  PID:8496
- C:\Windows\System\zPGOZAp.exe
  C:\Windows\System\zPGOZAp.exe
  2⤵
  PID:8516
- C:\Windows\System\mdmfXhY.exe
  C:\Windows\System\mdmfXhY.exe
  2⤵
  PID:8532
- C:\Windows\System\Picqjvv.exe
  C:\Windows\System\Picqjvv.exe
  2⤵
  PID:8548
- C:\Windows\System\dgNTHQD.exe
  C:\Windows\System\dgNTHQD.exe
  2⤵
  PID:8564
- C:\Windows\System\uJkJlIX.exe
  C:\Windows\System\uJkJlIX.exe
  2⤵
  PID:8580
- C:\Windows\System\cfSSURZ.exe
  C:\Windows\System\cfSSURZ.exe
  2⤵
  PID:8608
- C:\Windows\System\esxEUjJ.exe
  C:\Windows\System\esxEUjJ.exe
  2⤵
  PID:8644
- C:\Windows\System\zByqCFm.exe
  C:\Windows\System\zByqCFm.exe
  2⤵
  PID:8660
- C:\Windows\System\qsTgPlM.exe
  C:\Windows\System\qsTgPlM.exe
  2⤵
  PID:8684
- C:\Windows\System\pmCOAZe.exe
  C:\Windows\System\pmCOAZe.exe
  2⤵
  PID:8700
- C:\Windows\System\ttTZkej.exe
  C:\Windows\System\ttTZkej.exe
  2⤵
  PID:8716
- C:\Windows\System\CsypYOV.exe
  C:\Windows\System\CsypYOV.exe
  2⤵
  PID:8732
- C:\Windows\System\MReTcjL.exe
  C:\Windows\System\MReTcjL.exe
  2⤵
  PID:8748
- C:\Windows\System\KSTCMLr.exe
  C:\Windows\System\KSTCMLr.exe
  2⤵
  PID:8780
- C:\Windows\System\BoQhaUK.exe
  C:\Windows\System\BoQhaUK.exe
  2⤵
  PID:8796
- C:\Windows\System\ZJcHPPS.exe
  C:\Windows\System\ZJcHPPS.exe
  2⤵
  PID:8812
- C:\Windows\System\hoImtiL.exe
  C:\Windows\System\hoImtiL.exe
  2⤵
  PID:8828
- C:\Windows\System\efNHpkK.exe
  C:\Windows\System\efNHpkK.exe
  2⤵
  PID:8856
- C:\Windows\System\bqHCEkM.exe
  C:\Windows\System\bqHCEkM.exe
  2⤵
  PID:8872
- C:\Windows\System\cBcGKcI.exe
  C:\Windows\System\cBcGKcI.exe
  2⤵
  PID:8888
- C:\Windows\System\SQhtgcb.exe
  C:\Windows\System\SQhtgcb.exe
  2⤵
  PID:8928
- C:\Windows\System\UEJleAo.exe
  C:\Windows\System\UEJleAo.exe
  2⤵
  PID:8944
- C:\Windows\System\gafBeht.exe
  C:\Windows\System\gafBeht.exe
  2⤵
  PID:8960
- C:\Windows\System\PqHiiAF.exe
  C:\Windows\System\PqHiiAF.exe
  2⤵
  PID:8984
- C:\Windows\System\zpPKVnm.exe
  C:\Windows\System\zpPKVnm.exe
  2⤵
  PID:9008
- C:\Windows\System\OOrRFfS.exe
  C:\Windows\System\OOrRFfS.exe
  2⤵
  PID:9024
- C:\Windows\System\uekTbcm.exe
  C:\Windows\System\uekTbcm.exe
  2⤵
  PID:9040
- C:\Windows\System\Havszow.exe
  C:\Windows\System\Havszow.exe
  2⤵
  PID:9056
- C:\Windows\System\vknbcum.exe
  C:\Windows\System\vknbcum.exe
  2⤵
  PID:9084
- C:\Windows\System\PpzvCCi.exe
  C:\Windows\System\PpzvCCi.exe
  2⤵
  PID:9108
- C:\Windows\System\lqNePGr.exe
  C:\Windows\System\lqNePGr.exe
  2⤵
  PID:9124
- C:\Windows\System\yBUzdtD.exe
  C:\Windows\System\yBUzdtD.exe
  2⤵
  PID:9152
- C:\Windows\System\nYEqGDa.exe
  C:\Windows\System\nYEqGDa.exe
  2⤵
  PID:9168
- C:\Windows\System\mipBwly.exe
  C:\Windows\System\mipBwly.exe
  2⤵
  PID:9184
- C:\Windows\System\CrHcvAj.exe
  C:\Windows\System\CrHcvAj.exe
  2⤵
  PID:9208
- C:\Windows\System\qdqHisC.exe
  C:\Windows\System\qdqHisC.exe
  2⤵
  PID:8164
- C:\Windows\System\DKrbpTP.exe
  C:\Windows\System\DKrbpTP.exe
  2⤵
  PID:7556
- C:\Windows\System\GlKPGFk.exe
  C:\Windows\System\GlKPGFk.exe
  2⤵
  PID:8256
- C:\Windows\System\vYwqwqb.exe
  C:\Windows\System\vYwqwqb.exe
  2⤵
  PID:8272
- C:\Windows\System\kfDtYAQ.exe
  C:\Windows\System\kfDtYAQ.exe
  2⤵
  PID:7208
- C:\Windows\System\rzSfDja.exe
  C:\Windows\System\rzSfDja.exe
  2⤵
  PID:8200
- C:\Windows\System\TRLGeXW.exe
  C:\Windows\System\TRLGeXW.exe
  2⤵
  PID:8320
- C:\Windows\System\HogseVN.exe
  C:\Windows\System\HogseVN.exe
  2⤵
  PID:8344
- C:\Windows\System\BrtMZWE.exe
  C:\Windows\System\BrtMZWE.exe
  2⤵
  PID:8408
- C:\Windows\System\pMjIhSA.exe
  C:\Windows\System\pMjIhSA.exe
  2⤵
  PID:8448
- C:\Windows\System\WKyeHpJ.exe
  C:\Windows\System\WKyeHpJ.exe
  2⤵
  PID:8488
- C:\Windows\System\hNVfOwv.exe
  C:\Windows\System\hNVfOwv.exe
  2⤵
  PID:8472
- C:\Windows\System\RuflXxZ.exe
  C:\Windows\System\RuflXxZ.exe
  2⤵
  PID:8544
- C:\Windows\System\TDDLMIO.exe
  C:\Windows\System\TDDLMIO.exe
  2⤵
  PID:8512
- C:\Windows\System\pUlvfoQ.exe
  C:\Windows\System\pUlvfoQ.exe
  2⤵
  PID:8592
- C:\Windows\System\bzzouXl.exe
  C:\Windows\System\bzzouXl.exe
  2⤵
  PID:8624
- C:\Windows\System\watpIWb.exe
  C:\Windows\System\watpIWb.exe
  2⤵
  PID:8656
- C:\Windows\System\mEpbpeI.exe
  C:\Windows\System\mEpbpeI.exe
  2⤵
  PID:8692
- C:\Windows\System\BsfwDKt.exe
  C:\Windows\System\BsfwDKt.exe
  2⤵
  PID:8744
- C:\Windows\System\SEivFXm.exe
  C:\Windows\System\SEivFXm.exe
  2⤵
  PID:8760
- C:\Windows\System\hsVGKnr.exe
  C:\Windows\System\hsVGKnr.exe
  2⤵
  PID:8880
- C:\Windows\System\JtEQPwB.exe
  C:\Windows\System\JtEQPwB.exe
  2⤵
  PID:8900
- C:\Windows\System\tqkEkfu.exe
  C:\Windows\System\tqkEkfu.exe
  2⤵
  PID:8916
- C:\Windows\System\wWlLidT.exe
  C:\Windows\System\wWlLidT.exe
  2⤵
  PID:8924
- C:\Windows\System\MCZenjO.exe
  C:\Windows\System\MCZenjO.exe
  2⤵
  PID:9000
- C:\Windows\System\lVDArPZ.exe
  C:\Windows\System\lVDArPZ.exe
  2⤵
  PID:9032
- C:\Windows\System\fbucyKT.exe
  C:\Windows\System\fbucyKT.exe
  2⤵
  PID:9080
- C:\Windows\System\fUKnHHs.exe
  C:\Windows\System\fUKnHHs.exe
  2⤵
  PID:9100
- C:\Windows\System\nlBADWH.exe
  C:\Windows\System\nlBADWH.exe
  2⤵
  PID:9148
- C:\Windows\System\HVxkXZB.exe
  C:\Windows\System\HVxkXZB.exe
  2⤵
  PID:9180
- C:\Windows\System\nmVagvW.exe
  C:\Windows\System\nmVagvW.exe
  2⤵
  PID:7520
- C:\Windows\System\sSlFFRB.exe
  C:\Windows\System\sSlFFRB.exe
  2⤵
  PID:8264
- C:\Windows\System\ZssSUxy.exe
  C:\Windows\System\ZssSUxy.exe
  2⤵
  PID:8196
- C:\Windows\System\FnrPpmo.exe
  C:\Windows\System\FnrPpmo.exe
  2⤵
  PID:8288
- C:\Windows\System\EHFyehR.exe
  C:\Windows\System\EHFyehR.exe
  2⤵
  PID:8292
- C:\Windows\System\MhEZcVs.exe
  C:\Windows\System\MhEZcVs.exe
  2⤵
  PID:8392
- C:\Windows\System\EnPKAuI.exe
  C:\Windows\System\EnPKAuI.exe
  2⤵
  PID:8360
- C:\Windows\System\eVMLTuK.exe
  C:\Windows\System\eVMLTuK.exe
  2⤵
  PID:8504
- C:\Windows\System\PdfiroA.exe
  C:\Windows\System\PdfiroA.exe
  2⤵
  PID:8620
- C:\Windows\System\OSCBvJD.exe
  C:\Windows\System\OSCBvJD.exe
  2⤵
  PID:8680
- C:\Windows\System\HxXNEEJ.exe
  C:\Windows\System\HxXNEEJ.exe
  2⤵
  PID:8640
- C:\Windows\System\TNlDmkQ.exe
  C:\Windows\System\TNlDmkQ.exe
  2⤵
  PID:8884
- C:\Windows\System\VMPSjRI.exe
  C:\Windows\System\VMPSjRI.exe
  2⤵
  PID:8820
- C:\Windows\System\epnAzcs.exe
  C:\Windows\System\epnAzcs.exe
  2⤵
  PID:8844
- C:\Windows\System\BfTZJgs.exe
  C:\Windows\System\BfTZJgs.exe
  2⤵
  PID:8908
- C:\Windows\System\PkthLqc.exe
  C:\Windows\System\PkthLqc.exe
  2⤵
  PID:8560
- C:\Windows\System\mhgrdoy.exe
  C:\Windows\System\mhgrdoy.exe
  2⤵
  PID:9016
- C:\Windows\System\EyBjIDR.exe
  C:\Windows\System\EyBjIDR.exe
  2⤵
  PID:9104
- C:\Windows\System\ztGRcvY.exe
  C:\Windows\System\ztGRcvY.exe
  2⤵
  PID:8540
- C:\Windows\System\FltFXCD.exe
  C:\Windows\System\FltFXCD.exe
  2⤵
  PID:9136
- C:\Windows\System\PCWHwKd.exe
  C:\Windows\System\PCWHwKd.exe
  2⤵
  PID:8956
- C:\Windows\System\fOEZyXE.exe
  C:\Windows\System\fOEZyXE.exe
  2⤵
  PID:7716
- C:\Windows\System\sIlyKIh.exe
  C:\Windows\System\sIlyKIh.exe
  2⤵
  PID:6268
- C:\Windows\System\MMxVwdg.exe
  C:\Windows\System\MMxVwdg.exe
  2⤵
  PID:8484
- C:\Windows\System\XZCVizC.exe
  C:\Windows\System\XZCVizC.exe
  2⤵
  PID:8756
- C:\Windows\System\MfAkNwF.exe
  C:\Windows\System\MfAkNwF.exe
  2⤵
  PID:8708
- C:\Windows\System\IoEBJhG.exe
  C:\Windows\System\IoEBJhG.exe
  2⤵
  PID:9096
- C:\Windows\System\WCucItl.exe
  C:\Windows\System\WCucItl.exe
  2⤵
  PID:8576
- C:\Windows\System\ssdokif.exe
  C:\Windows\System\ssdokif.exe
  2⤵
  PID:8740
- C:\Windows\System\FUXVFfm.exe
  C:\Windows\System\FUXVFfm.exe
  2⤵
  PID:8972
- C:\Windows\System\mIMBKap.exe
  C:\Windows\System\mIMBKap.exe
  2⤵
  PID:8440
- C:\Windows\System\GsxVqXu.exe
  C:\Windows\System\GsxVqXu.exe
  2⤵
  PID:8376
- C:\Windows\System\FlCIzFC.exe
  C:\Windows\System\FlCIzFC.exe
  2⤵
  PID:8556
- C:\Windows\System\NsPDURJ.exe
  C:\Windows\System\NsPDURJ.exe
  2⤵
  PID:8848
- C:\Windows\System\yclAHuG.exe
  C:\Windows\System\yclAHuG.exe
  2⤵
  PID:8652
- C:\Windows\System\lbxOthd.exe
  C:\Windows\System\lbxOthd.exe
  2⤵
  PID:8712
- C:\Windows\System\lzYUDcU.exe
  C:\Windows\System\lzYUDcU.exe
  2⤵
  PID:8424
- C:\Windows\System\GJEiHaM.exe
  C:\Windows\System\GJEiHaM.exe
  2⤵
  PID:9176
- C:\Windows\System\vnnyNXu.exe
  C:\Windows\System\vnnyNXu.exe
  2⤵
  PID:8824
- C:\Windows\System\sggAzkW.exe
  C:\Windows\System\sggAzkW.exe
  2⤵
  PID:8632
- C:\Windows\System\AaDTOGY.exe
  C:\Windows\System\AaDTOGY.exe
  2⤵
  PID:8808
- C:\Windows\System\QsIOiln.exe
  C:\Windows\System\QsIOiln.exe
  2⤵
  PID:9064
- C:\Windows\System\gobbLzK.exe
  C:\Windows\System\gobbLzK.exe
  2⤵
  PID:9196
- C:\Windows\System\yJkLBhU.exe
  C:\Windows\System\yJkLBhU.exe
  2⤵
  PID:9248
- C:\Windows\System\iovwbAj.exe
  C:\Windows\System\iovwbAj.exe
  2⤵
  PID:9264
- C:\Windows\System\peLHfEl.exe
  C:\Windows\System\peLHfEl.exe
  2⤵
  PID:9284
- C:\Windows\System\NgmduLN.exe
  C:\Windows\System\NgmduLN.exe
  2⤵
  PID:9300
- C:\Windows\System\IFjfuyL.exe
  C:\Windows\System\IFjfuyL.exe
  2⤵
  PID:9316
- C:\Windows\System\zryKAxW.exe
  C:\Windows\System\zryKAxW.exe
  2⤵
  PID:9332
- C:\Windows\System\iZkSpQh.exe
  C:\Windows\System\iZkSpQh.exe
  2⤵
  PID:9348
- C:\Windows\System\GGPhGdE.exe
  C:\Windows\System\GGPhGdE.exe
  2⤵
  PID:9372
- C:\Windows\System\kzUfAHZ.exe
  C:\Windows\System\kzUfAHZ.exe
  2⤵
  PID:9392
- C:\Windows\System\mIiGtLN.exe
  C:\Windows\System\mIiGtLN.exe
  2⤵
  PID:9408
- C:\Windows\System\flYGMjU.exe
  C:\Windows\System\flYGMjU.exe
  2⤵
  PID:9428
- C:\Windows\System\EkFSyHA.exe
  C:\Windows\System\EkFSyHA.exe
  2⤵
  PID:9444
- C:\Windows\System\rSXVTDt.exe
  C:\Windows\System\rSXVTDt.exe
  2⤵
  PID:9472
- C:\Windows\System\VICpQXC.exe
  C:\Windows\System\VICpQXC.exe
  2⤵
  PID:9488
- C:\Windows\System\CjWeReI.exe
  C:\Windows\System\CjWeReI.exe
  2⤵
  PID:9508
- C:\Windows\System\OhfSyRW.exe
  C:\Windows\System\OhfSyRW.exe
  2⤵
  PID:9536
- C:\Windows\System\xDsjNgf.exe
  C:\Windows\System\xDsjNgf.exe
  2⤵
  PID:9556
- C:\Windows\System\syMLFSV.exe
  C:\Windows\System\syMLFSV.exe
  2⤵
  PID:9572
- C:\Windows\System\amrjxcX.exe
  C:\Windows\System\amrjxcX.exe
  2⤵
  PID:9592
- C:\Windows\System\cQpUqpX.exe
  C:\Windows\System\cQpUqpX.exe
  2⤵
  PID:9608
- C:\Windows\System\TuxbjYE.exe
  C:\Windows\System\TuxbjYE.exe
  2⤵
  PID:9624
- C:\Windows\System\rVochBV.exe
  C:\Windows\System\rVochBV.exe
  2⤵
  PID:9640
- C:\Windows\System\ZhYUUxv.exe
  C:\Windows\System\ZhYUUxv.exe
  2⤵
  PID:9656
- C:\Windows\System\oajUSGy.exe
  C:\Windows\System\oajUSGy.exe
  2⤵
  PID:9712
- C:\Windows\System\eOdXFYy.exe
  C:\Windows\System\eOdXFYy.exe
  2⤵
  PID:9728
- C:\Windows\System\RHdPCCY.exe
  C:\Windows\System\RHdPCCY.exe
  2⤵
  PID:9744
- C:\Windows\System\UjOJAWk.exe
  C:\Windows\System\UjOJAWk.exe
  2⤵
  PID:9760
- C:\Windows\System\pFWffwp.exe
  C:\Windows\System\pFWffwp.exe
  2⤵
  PID:9776
- C:\Windows\System\zGejQJb.exe
  C:\Windows\System\zGejQJb.exe
  2⤵
  PID:9800
- C:\Windows\System\AxPZfXr.exe
  C:\Windows\System\AxPZfXr.exe
  2⤵
  PID:9816
- C:\Windows\System\CKvTUed.exe
  C:\Windows\System\CKvTUed.exe
  2⤵
  PID:9836
- C:\Windows\System\nAfcryZ.exe
  C:\Windows\System\nAfcryZ.exe
  2⤵
  PID:9860
- C:\Windows\System\lLElgRq.exe
  C:\Windows\System\lLElgRq.exe
  2⤵
  PID:9876
- C:\Windows\System\ZGBTnFT.exe
  C:\Windows\System\ZGBTnFT.exe
  2⤵
  PID:9892
- C:\Windows\System\KxVZMHj.exe
  C:\Windows\System\KxVZMHj.exe
  2⤵
  PID:9908
- C:\Windows\System\VUeYdmJ.exe
  C:\Windows\System\VUeYdmJ.exe
  2⤵
  PID:9932
- C:\Windows\System\BvfJIgZ.exe
  C:\Windows\System\BvfJIgZ.exe
  2⤵
  PID:9952
- C:\Windows\System\yqOBAvD.exe
  C:\Windows\System\yqOBAvD.exe
  2⤵
  PID:9972
- C:\Windows\System\pVEFiHW.exe
  C:\Windows\System\pVEFiHW.exe
  2⤵
  PID:9988
- C:\Windows\System\wvIDzhe.exe
  C:\Windows\System\wvIDzhe.exe
  2⤵
  PID:10004
- C:\Windows\System\TKkGrLJ.exe
  C:\Windows\System\TKkGrLJ.exe
  2⤵
  PID:10020
- C:\Windows\System\ZkINByk.exe
  C:\Windows\System\ZkINByk.exe
  2⤵
  PID:10036
- C:\Windows\System\BEzQOcQ.exe
  C:\Windows\System\BEzQOcQ.exe
  2⤵
  PID:10076
- C:\Windows\System\NFsCoXN.exe
  C:\Windows\System\NFsCoXN.exe
  2⤵
  PID:10112
- C:\Windows\System\mVNFcFh.exe
  C:\Windows\System\mVNFcFh.exe
  2⤵
  PID:10132
- C:\Windows\System\qtZzTWq.exe
  C:\Windows\System\qtZzTWq.exe
  2⤵
  PID:10148
- C:\Windows\System\mEiOimA.exe
  C:\Windows\System\mEiOimA.exe
  2⤵
  PID:10164
- C:\Windows\System\UQLoPdx.exe
  C:\Windows\System\UQLoPdx.exe
  2⤵
  PID:10184
- C:\Windows\System\jNNCAkC.exe
  C:\Windows\System\jNNCAkC.exe
  2⤵
  PID:10216
- C:\Windows\System\RXAhofa.exe
  C:\Windows\System\RXAhofa.exe
  2⤵
  PID:10232
- C:\Windows\System\fMndPHf.exe
  C:\Windows\System\fMndPHf.exe
  2⤵
  PID:8144
- C:\Windows\System\kmdAWia.exe
  C:\Windows\System\kmdAWia.exe
  2⤵
  PID:9116
- C:\Windows\System\AfvANpB.exe
  C:\Windows\System\AfvANpB.exe
  2⤵
  PID:9224
- C:\Windows\System\BtGCKYn.exe
  C:\Windows\System\BtGCKYn.exe
  2⤵
  PID:9244
- C:\Windows\System\gesOnUq.exe
  C:\Windows\System\gesOnUq.exe
  2⤵
  PID:8672
- C:\Windows\System\sIvTtWj.exe
  C:\Windows\System\sIvTtWj.exe
  2⤵
  PID:9192
- C:\Windows\System\lJzbhjY.exe
  C:\Windows\System\lJzbhjY.exe
  2⤵
  PID:9256
- C:\Windows\System\AJqxCou.exe
  C:\Windows\System\AJqxCou.exe
  2⤵
  PID:9296
- C:\Windows\System\noQKBND.exe
  C:\Windows\System\noQKBND.exe
  2⤵
  PID:9328
- C:\Windows\System\zeobAAf.exe
  C:\Windows\System\zeobAAf.exe
  2⤵
  PID:9388
- C:\Windows\System\glHDFkk.exe
  C:\Windows\System\glHDFkk.exe
  2⤵
  PID:9464
- C:\Windows\System\sJGHdpA.exe
  C:\Windows\System\sJGHdpA.exe
  2⤵
  PID:9504
- C:\Windows\System\lkJisTT.exe
  C:\Windows\System\lkJisTT.exe
  2⤵
  PID:9368
- C:\Windows\System\cUtVVHa.exe
  C:\Windows\System\cUtVVHa.exe
  2⤵
  PID:9480
- C:\Windows\System\AHVxFQE.exe
  C:\Windows\System\AHVxFQE.exe
  2⤵
  PID:9564
- C:\Windows\System\euZwkpk.exe
  C:\Windows\System\euZwkpk.exe
  2⤵
  PID:9664
- C:\Windows\System\oMgpEHp.exe
  C:\Windows\System\oMgpEHp.exe
  2⤵
  PID:9604
- C:\Windows\System\dVvGquo.exe
  C:\Windows\System\dVvGquo.exe
  2⤵
  PID:9672
- C:\Windows\System\ImYblOm.exe
  C:\Windows\System\ImYblOm.exe
  2⤵
  PID:9688
- C:\Windows\System\nlhgJXO.exe
  C:\Windows\System\nlhgJXO.exe
  2⤵
  PID:9708
- C:\Windows\System\hGRdKfF.exe
  C:\Windows\System\hGRdKfF.exe
  2⤵
  PID:9724
- C:\Windows\System\yHAMlaK.exe
  C:\Windows\System\yHAMlaK.exe
  2⤵
  PID:9792
- C:\Windows\System\hrnWPwj.exe
  C:\Windows\System\hrnWPwj.exe
  2⤵
  PID:9736
- C:\Windows\System\eETREqE.exe
  C:\Windows\System\eETREqE.exe
  2⤵
  PID:9812
- C:\Windows\System\ibaMSSS.exe
  C:\Windows\System\ibaMSSS.exe
  2⤵
  PID:9868
- C:\Windows\System\ADzLPwf.exe
  C:\Windows\System\ADzLPwf.exe
  2⤵
  PID:9904
- C:\Windows\System\RcTghcL.exe
  C:\Windows\System\RcTghcL.exe
  2⤵
  PID:9964
- C:\Windows\System\jbEwpCr.exe
  C:\Windows\System\jbEwpCr.exe
  2⤵
  PID:9848
- C:\Windows\System\MbgaiJU.exe
  C:\Windows\System\MbgaiJU.exe
  2⤵
  PID:9944
- C:\Windows\System\KusMmLA.exe
  C:\Windows\System\KusMmLA.exe
  2⤵
  PID:10048
- C:\Windows\System\XnwZDlO.exe
  C:\Windows\System\XnwZDlO.exe
  2⤵
  PID:9996
- C:\Windows\System\xcgGiEi.exe
  C:\Windows\System\xcgGiEi.exe
  2⤵
  PID:10044
- C:\Windows\System\jMDhzsc.exe
  C:\Windows\System\jMDhzsc.exe
  2⤵
  PID:10064
- C:\Windows\System\ZerRmBq.exe
  C:\Windows\System\ZerRmBq.exe
  2⤵
  PID:10128
- C:\Windows\System\knyzJdv.exe
  C:\Windows\System\knyzJdv.exe
  2⤵
  PID:10176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIFiVnk.exe

Filesize
2.1MB

MD5
537a96dca652c343df52ab90e45f8f8e

SHA1
0ec472692c91a32601995f8a79fa33cf8e4d715c

SHA256
3e49b8ab61166c78419215e0864b5b76db01b24d901948563b2f1a33dbe388e7

SHA512
d984f7c7ca908106ac0a787e8ac2ad3ef2eef26d89624e2b41e52f0c09ae42b367b98eaab260dac4be3a6a8fc02f38da9d868bcebd59c74658b5d43572bddc19

Download Submit
C:\Windows\system\AtdtLpx.exe

Filesize
2.1MB

MD5
6518229acae0124c41b240f7cbd7529d

SHA1
ec6975b5e04d8e0cf3c3ad34ff3ceca328ac311b

SHA256
6fc1f115c9e6a6b8a669e24f6e6deb6883bb1602808380157eca1c2ee2669dde

SHA512
15a9090f2b5c784008d7df4607ef165c139eaf8b02adf14bd8842f1aafd451c5efcdeb7999b167bb71cddb4d0ffe64c70fc7aad1dcc1f77d7212ed3c932af816

Download Submit
C:\Windows\system\BnbVgRI.exe

Filesize
2.1MB

MD5
0205f4f949adb443af2bfddcc4b99c0f

SHA1
370d6ef8a2d33fc699aa864223e4ce6bb91570dc

SHA256
481b74616b52b7bf7cac1a3e4825d32bb2ce495b58089652c0e0b67bf9fcf171

SHA512
e448538809b5afa375f5dfd457b54a874f17f5352ffbf2ed684c4b170a8c343f54167f2ef74d2cc18b8e6a348d914f4af4fc0266cd933bff74f554d9fe65beb4

Download Submit
C:\Windows\system\CYsptJe.exe

Filesize
2.1MB

MD5
cfcc891cbf1687c67d7defb8cc2bf78a

SHA1
6ca0dba5e2ae6cec3c3b64187598eca83bc6e3da

SHA256
d058cb8d0343e85298b6c1c11c86ab6bfe40b7774b2fff4a754494e2adb37190

SHA512
afa3f05aaf1d16c687bb1888d64416ef22a1235e34a06e8f80ece804a69a6e0bbb480e3fbe64f19119d2c84761eacdda5adc2bcf2e82036c7371a6ded7239ab7

Download Submit
C:\Windows\system\DOIntXn.exe

Filesize
2.1MB

MD5
052b36a315547d6f3fdf97f273146c28

SHA1
78955785c335afed2905f087db918adfe96ae834

SHA256
2b0c7fd61ab49154ed16ed15352d219233e9faf1471ec37e954dd103fc2e662a

SHA512
c9ad7463ff0668b3707bff83ddc82571d1e74dcfdecc740d18cb1bff4117f217af591108327aabe1355595624d0e9fbe735b7d1b80f7475d5ebeea47856d50da

Download Submit
C:\Windows\system\HtmAGGI.exe

Filesize
2.1MB

MD5
1bff5feb9df69e85d64ef2f3b4adddec

SHA1
200493f07f4d42c95a7767eb94b552ea88294593

SHA256
b8e9719d4da77b72b5939f4d23df94a3a33835f8173e0ab4be735ac69f61ad71

SHA512
143740bc3eded944934bffd51b926a446513cf823b41431db69826d47e41f72e8cf1b76fb87e74e1d9fb1a2ed888c1cf58e9e6ef11837538458c1239d6be4ed3

Download Submit
C:\Windows\system\HuMwfwa.exe

Filesize
2.1MB

MD5
fea8cf8bde8aba07b4663e3bd95bd663

SHA1
149fcd072f801291ad22e9e72e401620a363cbe8

SHA256
3c66e0755054a8656a76f33080d6a0720480df2cc389101e660442c235849692

SHA512
c74f2acf02df964c5ba1dcb721e7de7a38070c64c7a9a10ff6e71c7cb76938c20fec9e5710b5f13934edf15c81f96e63f5584b2eb83fbdd4e23e4e44627e706d

Download Submit
C:\Windows\system\JBTogCL.exe

Filesize
2.1MB

MD5
2091f859f4b148885c3d2e3d17c62cb5

SHA1
45083933fecdcf2e687dd2ad42636a010b1c8dbb

SHA256
051f7910b2c33bbc325e7ff8837210a6a40a89e0df741e4dc4d8c12bac8a1e10

SHA512
9cb9ee1c1b463e2332b87b2d83b1ba302e198482784fa614541d9538b28e62999e82d2f033c67690dc2b0f863413060d1f99b38618ccff277ad24f9c406fd12f

Download Submit
C:\Windows\system\LkFSVhJ.exe

Filesize
2.1MB

MD5
e118b2e12b358393caeeef3fe7e600f7

SHA1
cad630b183b1ab391fa9a3b85f0af0f831034ca2

SHA256
69f9ae0d20a9c0559254a8b4ef3583564968a0554e85255ea35df51a8aeb7b48

SHA512
824bff46b8803c65853e1f2764c1e7e496430bb1878171d8f8e35e64a61c391c992d9693a0a162b8215b57584ffcbe384327c1a9fdf11dc0133c5b8737850773

Download Submit
C:\Windows\system\MiiBhGO.exe

Filesize
2.1MB

MD5
ed6aaf3e345f4032b55b7502bc0ef74b

SHA1
f23768c9e8adccbaccaf498e52d0646c0d6ab491

SHA256
e274f012f62f98b1904e969a2ecb5ec01bf24bb713f9dc6d76efdfec3402dd80

SHA512
fe8fef675008c4ef4dcc9566513949c8a34e769d574ad1acc5ef72a3a410541e05586a5cf3b3f68691cbd46252e62d9577a4c7795e71d1c5907a7d77485f4967

Download Submit
C:\Windows\system\MrOAwSM.exe

Filesize
2.1MB

MD5
697f05b2d30ce46bdb40334a59ac8de8

SHA1
1282908059c8b879be0976111067dad11eb1c6f5

SHA256
fcc6399a165b4a698b5d32ecac19526a312fb86fa319ec4a40dffb954fc9c6a0

SHA512
050b5b7b551ba0c36d1fb36837b05c30bff0ee8b74d603ffad303b0be106309aecfa81f7c635ac0becd1a71bf47083a9cb47c762964200b0edd138695b1d2a6d

Download Submit
C:\Windows\system\NeJpxkU.exe

Filesize
2.1MB

MD5
d9fc85b2476f8e3414d140791e565091

SHA1
c0272172a061274101f1a260801b0682a4f329f6

SHA256
bead6beac2902197bbcb041a7c308ef0bc44da53fe0a1ee1d48dc42261498afc

SHA512
f4109811c1cd7cecf485ac83cabd324310c1f8ce81edca51a868f352f07a30e3874b1a33d961b65118dc482fed451699190aa445c946677bc7611e4c13f5ab02

Download Submit
C:\Windows\system\OpwzRlL.exe

Filesize
2.1MB

MD5
cc77c05111e9c304de67b2b328cfa7c6

SHA1
827d3d363de17199f6a572e6314a181b1746de6a

SHA256
9c92a72a10cd671b1f23f22aa79c83f2d29497ec477b88a82bbbe0d7a71ff938

SHA512
236f8933c29bdf2edb7b011e9091eed4505fbf1e42b076b76ca4f2b8a02dca6c0a27c2c84d9fac509b7988aebc0e51cdc547d0cf2e408e32c537e7ceaafe1853

Download Submit
C:\Windows\system\OsYCpoa.exe

Filesize
2.1MB

MD5
2a1f5502452209a60fb0d2efeb90c84d

SHA1
2d63e892f2c7773dff78e71ee3f15f287976b9b2

SHA256
480a21c46cc616ef4c74ff0cff30d35db7fa12ced034f8f5376aa5e5aaaef56a

SHA512
1df3e5bf4d940e4eebbe1ca2ef302f9f6c9f87612a46a8873ba2621632d64be1af9b02140f5e0f5a5d13efed699d42b37d5a6b9bdb4bfc2e910e5c9167a0a817

Download Submit
C:\Windows\system\VuOjHyR.exe

Filesize
2.1MB

MD5
4cd9f4bfd2805ed8337250c3876c30f7

SHA1
7c9e0d54242e1df42e4758c345a6bf68a3798912

SHA256
0f6243f995639dc48594bcbbdbcfc3347fe662211f95b653db6c50d3acaa3b76

SHA512
329cb89a5bf402eed701345dd577d245428b045fc233edb865110f033266fa20965e25b0f963ced09c2a144364a853d8fbef5233820ff8e73b4098df332b359e

Download Submit
C:\Windows\system\XPXeKXt.exe

Filesize
2.1MB

MD5
d65c5e5317a42c7c8a47e3fb74ba3e1e

SHA1
f11526b8387028ee9a4c9710bb8a692da3cd5f77

SHA256
d90e9c5edbaa26b42b95ec6d3b53e615a52b02bd882b9236de47ef80f743aaac

SHA512
395fb94127d57919172d3f285d8d724ac0fa459cc6b3605f187e79250e5ea733b7a1c3171a6bfcb1116de88a41e645486831793654f1f40805d6ad459e1f17f5

Download Submit
C:\Windows\system\aueDiVo.exe

Filesize
2.1MB

MD5
51f32dd7d626b36ed499bcb74415e182

SHA1
ef5000b241e7f3e2f6846a885e372b9396652e3a

SHA256
3efcd2fd106d34150386803fc4e694ebadaa7dc97d462bef674b540ffdb5a06a

SHA512
525914f58e7fb0ab35bef3d6efafea9ba7099d4ee71584e1477f19daa6363499471222a7713794fe95be60b8bab80fbd718d6034a21975ec8367a2d8b4968c97

Download Submit
C:\Windows\system\bgNmSzc.exe

Filesize
2.1MB

MD5
984231ab833581b44741bdb6ba3cc5ee

SHA1
a74c0008cfd802438e31b95768f680152a6813f4

SHA256
86b3d7c4709370f41280e1a70b8724b23dd580ab46728d493a34ca7588a3ea4c

SHA512
684f19e3314d9b5c6f57c73620d5884564a1be97efe320c10aa20b806b32519bf6d4be3fa4c8b3364418da3e7ba40eaec0563f0f69222511785dd8b295d410d3

Download Submit
C:\Windows\system\fdwLERb.exe

Filesize
2.1MB

MD5
0ffbb26f3b5f0f10bccec0a55103c17c

SHA1
9dd8cbeb8a4f30862fc75a2a85d8fdc9542c0ffd

SHA256
6e0a4258da98c2c926a175d4e38be27aae323bfdb11835e1d7f3ebe1816e560b

SHA512
cbf7a75ee813310cb7686d433f1f1116340964fd7cb033199a1df22ce7ac0d6703058c09e3171a6af255c371a139e7b437603f751fd3b7065acda4f8ae32ee7c

Download Submit
C:\Windows\system\mzVdekE.exe

Filesize
2.1MB

MD5
f146a2d43b167f8b520082c6bed42828

SHA1
1978929a7dff5312444ae2dcb08c586dcc6fa7f1

SHA256
19fcaa9d3ecc3331fbb8e8ad2b2bad16aedff0d25327dee111cc3152d098bb32

SHA512
6c8b01197c54a6d755f9b2f9684637bf9f9fba9a27635da327491becd63e18b1d606d1ab407a2e6ba974c7370b3b55c888788aeb8f1ff65fad2bddafba39cfb7

Download Submit
C:\Windows\system\qZatgOS.exe

Filesize
2.1MB

MD5
161a0055fc55e9792bb4d11a46933986

SHA1
4dc94b0fa56faa983dc39cbb4ad5a88afb5c0c31

SHA256
c68ae1211733a4c3f7e20f8e8eed1881bfa9ab6ba63be07325986398ffdf7245

SHA512
618cf4afad60588d45b4750a43920621b5580cdb4d641b4362163be29ea5aaf3c0e1cf2b4f8c44507cb3e5674db97b77fbb671762c5a0540efde8e11d73015f4

Download Submit
C:\Windows\system\tIEVrpj.exe

Filesize
2.1MB

MD5
004fe1f94ade901ddb2510883ee38799

SHA1
d91671764a6d4a0c5a19c216fe17116b42581610

SHA256
123c9699ba4ff2ff61eb4c8e9f4b8e478a2a7e04b9a98d7c8eea1a56b1d55bd5

SHA512
472bf973a242c89ffd0974fe897ecccd1330f8e015f7d461383b7b2f22bedb9ed9ea3baa866aca4530f08b239ad79a065d6393d8bb31e4a07a49f2b9633f721f

Download Submit
C:\Windows\system\zzBUHoi.exe

Filesize
2.1MB

MD5
f22bf4886310ad0b1118ce9922537989

SHA1
87cd11f58eaa5534afb8c0270ca1fdb444c03454

SHA256
5e3c1ca54fbb1f29b5d9447dcc259af77991ceec9566ff7807b9d52aacde7a6e

SHA512
45f083eceef185050a95b1b0c127cd17b64338b990c84378371b4eb4e9beb7ecde16c22e353b0afe32af6d8d2608b641361100a460fe0de9f44c975f8b88857d

Download Submit
\Windows\system\BqaMJCz.exe

Filesize
2.1MB

MD5
420cdac796478efff540dfec0b6161e0

SHA1
54c6516945d8aa2a99c2500525e6751ecb26d5b3

SHA256
7a2598d2a36e29f46d897a2f9441150d083d965de00b798f8bc60d929fdfe2b9

SHA512
b270ae22267c0301e43f65fd71094c9c88511e060f86e25afb962a4d934fc2eba8190b0060e36054372f9c3b2c80c157fcc8e10279535679f4eae4cbeb308f9c

Download Submit
\Windows\system\DnHRnaO.exe

Filesize
2.1MB

MD5
7ad479aac7053e8c70de3aeaece2efe5

SHA1
37dd10e347fb7e4bcb83b277d72f19244549f880

SHA256
9ab47d11c170063a04a287c609d30444d30f929c3914f32e0c9d77ada0f8c49b

SHA512
1f77203d96daaa2341c83e07d80a78e8604af29e99b9882a45cbfa1f79b80af14bc86391234aa261bfa1424954b1155778910e9b41c60678ae37f83784a6f572

Download Submit
\Windows\system\ITYtcJV.exe

Filesize
2.1MB

MD5
4f32b23124a9d683e239130acc904b50

SHA1
752939bd236127b3f29c14b4b9a90dd478e58ae9

SHA256
ea30cd9ce2304b797d8f5e075bc1b1cd12a4340eae3690621fefee4245d2c8a2

SHA512
4bb742e9967bee29f2bb097e3daeac62f91bf3ff4d05997c0900a57a8624adcc0c05e28c40a54cf83a72714945548c913c981458434fa143718df294e6067284

Download Submit
\Windows\system\JVwSbUt.exe

Filesize
2.1MB

MD5
2a2b4ac119ca150a543449be1086f401

SHA1
416d5e91085a6899ed5b501d0abddd7bc3dc629b

SHA256
334ff3e63535c838f44ef41b6288918f5b32359a03c867a71a8153b32e310ba5

SHA512
294b8b0d28e9b694eab850d603fcb051274f5d903d1cdb2640e4af7da59597a205f1b1b454b2ef4dcb964479cf1ce5f88d947d4b177c3f798d52726bd9323cb0

Download Submit
\Windows\system\SOOYFoM.exe

Filesize
2.1MB

MD5
e359f9e5beab103813a4a511e612ff95

SHA1
1fbad33f01f139b6f9f408881c0730466cbb9b2e

SHA256
ecc14cb02369dce02a76d8d817b705c51eeb910d0b6d15bccb904767ea85a9b8

SHA512
f7e1e23182ace56ff877e3cef554be28b371ba2e61d4ab2adb74430ed94f680d6b91511e071c602b2b18e803e22403c6c901b7c6ac631e19c0b753a8763f459b

Download Submit
\Windows\system\nyPbJnw.exe

Filesize
2.1MB

MD5
40b60a7eb08d6c02c4f7b54aeee22d42

SHA1
e0899e89ca43d80bdbe75fe1c50a4dd0102f87ea

SHA256
db30a540ff567b33ce2f89fdfc2658b961a503e6de5f2f89229bbe01d5d8262d

SHA512
1e3de8114dc097a575f35042fa3416ef1e94bf4916925744aaf2a6b725e023cccab1bd4811890994c53a4f352eb6a504dae7f1d50452bfccd71544d8a2889e5a

Download Submit
\Windows\system\yKKrgrP.exe

Filesize
2.1MB

MD5
9b8a3dc2698c49345cdc5b7f6b64d83a

SHA1
9749abe782678f1739a85d4ff5b35b70c08ba427

SHA256
8ab33aa57fa2bf95bf316494c70b9108e5c6dd27b00a8bacbd8cdb2490dc9fe3

SHA512
c749e7b800b7c895125a3c514d809b0ddd7d56c0b2343f08e6ee44698466532fecb9f23beef4c043e678d4b08ed540e33e1e34300909b0784f5e4426dfc62fdb

Download Submit
\Windows\system\zEIZqVb.exe

Filesize
2.1MB

MD5
9fd522d8cff09b771d8bf91547b91edb

SHA1
24b700860c636adcb673385850eb97ae5c4678b5

SHA256
69db6be0ea40ff135967d56d12de0fe995aa5887c70c26dfa563694361507497

SHA512
5096dc252ef88ef9f9f7423a5542c47f8d7acbf10aa208eb8344e55ca334be21abe5819327a6a0fb771982aef0e88aa80c4ef228dfce62fc7c1b3d7a3b69fa50

Download Submit
\Windows\system\zertBAM.exe

Filesize
2.1MB

MD5
21e04fee9e9a52d9c2ab6c650caab85d

SHA1
7876b07d74c99ebf40adedacf02df369f2091db7

SHA256
f097c162a1280c83cf6f4c3c79dfd161f720ef8c1dc26f44353716e383910b6e

SHA512
a32431c45cc2f5811a85339beded3fe18c14cdb0672a38fb8b85145104c551a64dfc60a29401995a5512cedc86e5e8474bc5f2562f9d057672236635dc3caae8

Download Submit
memory/2232-64-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/2232-2730-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/2232-28-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/2464-2728-0x000000013FE10000-0x0000000140164000-memory.dmp

Filesize
3.3MB

Download
memory/2464-15-0x000000013FE10000-0x0000000140164000-memory.dmp

Filesize
3.3MB

Download
memory/2520-14-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-3294-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2608-484-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2608-1307-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2636-1306-0x000000013F650000-0x000000013F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-87-0x000000013F650000-0x000000013F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-2788-0x000000013F650000-0x000000013F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/2696-56-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2696-22-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2696-2734-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2720-2775-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2720-58-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2720-561-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2768-0x000000013FD40000-0x0000000140094000-memory.dmp

Filesize
3.3MB

Download
memory/2728-50-0x000000013FD40000-0x0000000140094000-memory.dmp

Filesize
3.3MB

Download
memory/2748-35-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2748-70-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2748-2735-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2768-72-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2768-935-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2768-2780-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2772-3274-0x000000013FE50000-0x00000001401A4000-memory.dmp

Filesize
3.3MB

Download
memory/2772-494-0x000000013FE50000-0x00000001401A4000-memory.dmp

Filesize
3.3MB

Download
memory/2836-44-0x000000013F850000-0x000000013FBA4000-memory.dmp

Filesize
3.3MB

Download
memory/2836-2764-0x000000013F850000-0x000000013FBA4000-memory.dmp

Filesize
3.3MB

Download
memory/2924-65-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2924-681-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2784-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1327-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-81-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/3004-38-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-33-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-88-0x000000013FE50000-0x00000001401A4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-0-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-27-0x000000013F4D0000-0x000000013F824000-memory.dmp

Filesize
3.3MB

Download
memory/3004-62-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-55-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-67-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-20-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/3004-43-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-786-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1336-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/3004-939-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/3004-485-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-487-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-11-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1194-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3004-670-0x0000000002090000-0x00000000023E4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-2797-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/3048-486-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download