xmrig | 728c75bfc27a9fddd198b95865602d49f40041fbbb404d056c5a0d4fe8a5396d

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc81474a6dc4d9cc639b84eb6812660N.exe
Size

1.6MB
MD5

acc81474a6dc4d9cc639b84eb6812660
SHA1

2c91a82613b8db921b523151a448ebf07578d3f0
SHA256

728c75bfc27a9fddd198b95865602d49f40041fbbb404d056c5a0d4fe8a5396d
SHA512

042d178d7a4ac5e89c48336866bc42666c42266ab9bca699e43583fe39ea3c509463d75b1af4b07466b957f3486e65cb5c0be42d5770b4fe427576a8845dbc56
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1k4QMQbDA4irGtQWdDMrgDZ:ROdWCCi7/rahwNUMJH4KrwDsu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-42-0x000000013F4E0000-0x000000013F831000-memory.dmp	xmrig
behavioral1/memory/2012-41-0x000000013F750000-0x000000013FAA1000-memory.dmp	xmrig
behavioral1/memory/2708-38-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig
behavioral1/memory/2396-37-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/3040-34-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/2316-31-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/1984-61-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	xmrig
behavioral1/memory/2684-143-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2140-149-0x000000013F3C0000-0x000000013F711000-memory.dmp	xmrig
behavioral1/memory/2720-536-0x000000013F190000-0x000000013F4E1000-memory.dmp	xmrig
behavioral1/memory/1644-141-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig
behavioral1/memory/1672-128-0x000000013FD90000-0x00000001400E1000-memory.dmp	xmrig
behavioral1/memory/2864-946-0x000000013F830000-0x000000013FB81000-memory.dmp	xmrig
behavioral1/memory/2732-1171-0x000000013F270000-0x000000013F5C1000-memory.dmp	xmrig
behavioral1/memory/3064-3614-0x000000013F4E0000-0x000000013F831000-memory.dmp	xmrig
behavioral1/memory/2012-3618-0x000000013F750000-0x000000013FAA1000-memory.dmp	xmrig
behavioral1/memory/2708-3616-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig
behavioral1/memory/2396-3612-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/2316-3609-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/3040-3608-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/2720-3833-0x000000013F190000-0x000000013F4E1000-memory.dmp	xmrig
behavioral1/memory/2864-3842-0x000000013F830000-0x000000013FB81000-memory.dmp	xmrig
behavioral1/memory/1672-3846-0x000000013FD90000-0x00000001400E1000-memory.dmp	xmrig
behavioral1/memory/2732-3847-0x000000013F270000-0x000000013F5C1000-memory.dmp	xmrig
behavioral1/memory/2140-3859-0x000000013F3C0000-0x000000013F711000-memory.dmp	xmrig
behavioral1/memory/1644-3852-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig
behavioral1/memory/2684-3854-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2316	UYUpOxv.exe
3040	FGOJrbd.exe
2012	cqvdmHc.exe
2396	OiXfYfU.exe
2708	fsBknSh.exe
3064	nVRqpsU.exe
2720	shtdPPR.exe
2864	uktzvoY.exe
2732	jrbDpeu.exe
1672	zHoHIAv.exe
2140	zDChVlA.exe
1644	vucaeRk.exe
2684	fKOmwRh.exe
2276	RfRCsXK.exe
532	sVGPWHy.exe
1512	ZJIkFWV.exe
2912	UCWoHQW.exe
1428	OoxCUQX.exe
1540	CokhBmk.exe
2968	qLYAMFV.exe
348	KzujpAc.exe
2676	oDxXeno.exe
2956	fgujKxB.exe
1688	ABJqPoT.exe
2928	Lbdaubf.exe
2552	GQuGTyh.exe
1700	rzbESUa.exe
1936	TZQGDlG.exe
1588	CpswekY.exe
2572	NbHNEyP.exe
2148	TDWnZAG.exe
1868	cjRevJt.exe
2940	cFzoqme.exe
1640	jmWnDOB.exe
1560	CsIEPpt.exe
2040	PpomztO.exe
1076	LSGMjUl.exe
1216	tfplrPH.exe
908	WmYlHnv.exe
772	FxaMNtv.exe
2232	LXZmgBM.exe
1548	iBLQelh.exe
2188	HUgwgOQ.exe
1716	TUOieRn.exe
1620	rVcvaFX.exe
2408	HuxGFNt.exe
2228	PffXOLX.exe
1080	SUtVlsC.exe
308	jKDqrcx.exe
876	LZdakFL.exe
1816	XfvmSVm.exe
2508	rmsJSxh.exe
1396	cGkPwcA.exe
2380	gnWsjTF.exe
2384	yHezxCR.exe
1568	JStNSGs.exe
2816	GhILNhL.exe
1468	BZqynEj.exe
2872	bsWxQiI.exe
2832	wqHlYYF.exe
2868	lYrUdEu.exe
2700	JfgufsP.exe
2892	yMxNXzQ.exe
2804	XTWyFgb.exe

Loads dropped DLL 64 IoCs

pid	Process
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe
1984	acc81474a6dc4d9cc639b84eb6812660N.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	upx
behavioral1/files/0x0008000000016cf6-14.dat	upx
behavioral1/files/0x0008000000016d0c-26.dat	upx
behavioral1/memory/3064-42-0x000000013F4E0000-0x000000013F831000-memory.dmp	upx
behavioral1/memory/2012-41-0x000000013F750000-0x000000013FAA1000-memory.dmp	upx
behavioral1/memory/2708-38-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx
behavioral1/memory/2396-37-0x000000013FA40000-0x000000013FD91000-memory.dmp	upx
behavioral1/memory/3040-34-0x000000013F540000-0x000000013F891000-memory.dmp	upx
behavioral1/files/0x0007000000016d27-32.dat	upx
behavioral1/memory/2316-31-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/files/0x0007000000016d30-28.dat	upx
behavioral1/files/0x0007000000016d1f-27.dat	upx
behavioral1/files/0x000c000000012254-17.dat	upx
behavioral1/files/0x0009000000016d38-43.dat	upx
behavioral1/files/0x0009000000016c53-49.dat	upx
behavioral1/memory/2720-48-0x000000013F190000-0x000000013F4E1000-memory.dmp	upx
behavioral1/memory/2732-60-0x000000013F270000-0x000000013F5C1000-memory.dmp	upx
behavioral1/files/0x0008000000016d40-59.dat	upx
behavioral1/memory/2864-54-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/1984-61-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	upx
behavioral1/files/0x00060000000174bf-84.dat	upx
behavioral1/files/0x00060000000190c9-99.dat	upx
behavioral1/memory/2684-143-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/2140-149-0x000000013F3C0000-0x000000013F711000-memory.dmp	upx
behavioral1/files/0x000500000001925d-157.dat	upx
behavioral1/memory/2720-536-0x000000013F190000-0x000000013F4E1000-memory.dmp	upx
behavioral1/files/0x00050000000193b7-189.dat	upx
behavioral1/files/0x0005000000019399-184.dat	upx
behavioral1/files/0x000500000001938b-178.dat	upx
behavioral1/files/0x0005000000019280-174.dat	upx
behavioral1/files/0x0005000000019278-168.dat	upx
behavioral1/files/0x0005000000019263-163.dat	upx
behavioral1/files/0x0005000000019240-153.dat	upx
behavioral1/files/0x0005000000019220-113.dat	upx
behavioral1/files/0x00050000000191fd-146.dat	upx
behavioral1/memory/1644-141-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/files/0x000500000001878d-134.dat	upx
behavioral1/files/0x000500000001867d-129.dat	upx
behavioral1/memory/1672-128-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/files/0x0005000000019238-127.dat	upx
behavioral1/files/0x0005000000019217-126.dat	upx
behavioral1/files/0x00050000000191f3-125.dat	upx
behavioral1/files/0x00060000000190c6-124.dat	upx
behavioral1/files/0x00050000000186c8-123.dat	upx
behavioral1/files/0x0014000000018657-121.dat	upx
behavioral1/files/0x000d000000018662-85.dat	upx
behavioral1/files/0x000600000001749c-83.dat	upx
behavioral1/files/0x0006000000017481-71.dat	upx
behavioral1/memory/2864-946-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/2732-1171-0x000000013F270000-0x000000013F5C1000-memory.dmp	upx
behavioral1/memory/3064-3614-0x000000013F4E0000-0x000000013F831000-memory.dmp	upx
behavioral1/memory/2012-3618-0x000000013F750000-0x000000013FAA1000-memory.dmp	upx
behavioral1/memory/2708-3616-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx
behavioral1/memory/2396-3612-0x000000013FA40000-0x000000013FD91000-memory.dmp	upx
behavioral1/memory/2316-3609-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/memory/3040-3608-0x000000013F540000-0x000000013F891000-memory.dmp	upx
behavioral1/memory/2720-3833-0x000000013F190000-0x000000013F4E1000-memory.dmp	upx
behavioral1/memory/2864-3842-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/1672-3846-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/memory/2732-3847-0x000000013F270000-0x000000013F5C1000-memory.dmp	upx
behavioral1/memory/2140-3859-0x000000013F3C0000-0x000000013F711000-memory.dmp	upx
behavioral1/memory/1644-3852-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/memory/2684-3854-0x000000013FD40000-0x0000000140091000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MfoXJZx.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\xNwthMf.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\okmUoUa.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\vBFTqxB.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\OcWNzzh.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\GGnptaV.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\XYRaanP.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\MXIwtAa.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\Lxrtwhf.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\rHqfmRO.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\wLWLdHP.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\GzPnmqJ.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\LZdakFL.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\ngqmbsM.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\siiwYJQ.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\DapAAlS.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\mUmpMjV.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\uSSyFHw.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\NuGnanX.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\aaPHCni.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\wvKlXIY.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\sNlHNpE.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\AOdYSWX.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\roulYjs.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\zsIOlQz.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\jRkKeZY.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\hqRhecj.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\nppHcoX.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\vBQYRVj.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\iGkUocc.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\roTpikv.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\HHkisAU.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\XlIUlCn.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\BKiRStl.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\xbOYxlN.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\nGWnboy.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\OqUrMCH.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\CTtccHf.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\csToAde.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\zSDtLgt.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\iTWgWzi.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\zYMrtoU.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\TrdArLd.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\wGlUXUB.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\qviLsna.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\oRtzypW.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\lxxmOAf.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\nysHSgO.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\vytMcpP.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\RUlrnBg.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\wqHlYYF.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\SJeaglV.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\IuuZvQv.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\RHsddmi.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\iOJansa.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\HzSgfZM.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\vcrfvCc.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\zyvuvCp.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\nrCcuTt.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\hxSYqXC.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\CrKWSJq.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\abXAjqm.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\uktzvoY.exe	acc81474a6dc4d9cc639b84eb6812660N.exe
File created	C:\Windows\System\AHSSILn.exe	acc81474a6dc4d9cc639b84eb6812660N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3040	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	31
PID 1984 wrote to memory of 3040	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	31
PID 1984 wrote to memory of 3040	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	31
PID 1984 wrote to memory of 2316	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	32
PID 1984 wrote to memory of 2316	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	32
PID 1984 wrote to memory of 2316	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	32
PID 1984 wrote to memory of 2012	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	33
PID 1984 wrote to memory of 2012	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	33
PID 1984 wrote to memory of 2012	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	33
PID 1984 wrote to memory of 2396	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	34
PID 1984 wrote to memory of 2396	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	34
PID 1984 wrote to memory of 2396	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	34
PID 1984 wrote to memory of 3064	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	35
PID 1984 wrote to memory of 3064	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	35
PID 1984 wrote to memory of 3064	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	35
PID 1984 wrote to memory of 2708	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	36
PID 1984 wrote to memory of 2708	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	36
PID 1984 wrote to memory of 2708	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	36
PID 1984 wrote to memory of 2720	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	37
PID 1984 wrote to memory of 2720	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	37
PID 1984 wrote to memory of 2720	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	37
PID 1984 wrote to memory of 2864	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	38
PID 1984 wrote to memory of 2864	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	38
PID 1984 wrote to memory of 2864	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	38
PID 1984 wrote to memory of 2732	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	39
PID 1984 wrote to memory of 2732	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	39
PID 1984 wrote to memory of 2732	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	39
PID 1984 wrote to memory of 1672	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	40
PID 1984 wrote to memory of 1672	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	40
PID 1984 wrote to memory of 1672	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	40
PID 1984 wrote to memory of 2140	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	41
PID 1984 wrote to memory of 2140	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	41
PID 1984 wrote to memory of 2140	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	41
PID 1984 wrote to memory of 1644	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	42
PID 1984 wrote to memory of 1644	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	42
PID 1984 wrote to memory of 1644	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	42
PID 1984 wrote to memory of 2276	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	43
PID 1984 wrote to memory of 2276	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	43
PID 1984 wrote to memory of 2276	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	43
PID 1984 wrote to memory of 2684	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	44
PID 1984 wrote to memory of 2684	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	44
PID 1984 wrote to memory of 2684	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	44
PID 1984 wrote to memory of 2968	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	45
PID 1984 wrote to memory of 2968	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	45
PID 1984 wrote to memory of 2968	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	45
PID 1984 wrote to memory of 532	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	46
PID 1984 wrote to memory of 532	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	46
PID 1984 wrote to memory of 532	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	46
PID 1984 wrote to memory of 348	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	47
PID 1984 wrote to memory of 348	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	47
PID 1984 wrote to memory of 348	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	47
PID 1984 wrote to memory of 1512	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	48
PID 1984 wrote to memory of 1512	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	48
PID 1984 wrote to memory of 1512	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	48
PID 1984 wrote to memory of 2676	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	49
PID 1984 wrote to memory of 2676	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	49
PID 1984 wrote to memory of 2676	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	49
PID 1984 wrote to memory of 2912	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	50
PID 1984 wrote to memory of 2912	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	50
PID 1984 wrote to memory of 2912	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	50
PID 1984 wrote to memory of 2956	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	51
PID 1984 wrote to memory of 2956	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	51
PID 1984 wrote to memory of 2956	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	51
PID 1984 wrote to memory of 1428	1984	acc81474a6dc4d9cc639b84eb6812660N.exe	52

C:\Users\Admin\AppData\Local\Temp\acc81474a6dc4d9cc639b84eb6812660N.exe
"C:\Users\Admin\AppData\Local\Temp\acc81474a6dc4d9cc639b84eb6812660N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System\FGOJrbd.exe
  C:\Windows\System\FGOJrbd.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\UYUpOxv.exe
  C:\Windows\System\UYUpOxv.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\cqvdmHc.exe
  C:\Windows\System\cqvdmHc.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OiXfYfU.exe
  C:\Windows\System\OiXfYfU.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\nVRqpsU.exe
  C:\Windows\System\nVRqpsU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\fsBknSh.exe
  C:\Windows\System\fsBknSh.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\shtdPPR.exe
  C:\Windows\System\shtdPPR.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\uktzvoY.exe
  C:\Windows\System\uktzvoY.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\jrbDpeu.exe
  C:\Windows\System\jrbDpeu.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\zHoHIAv.exe
  C:\Windows\System\zHoHIAv.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zDChVlA.exe
  C:\Windows\System\zDChVlA.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\vucaeRk.exe
  C:\Windows\System\vucaeRk.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\RfRCsXK.exe
  C:\Windows\System\RfRCsXK.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\fKOmwRh.exe
  C:\Windows\System\fKOmwRh.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\qLYAMFV.exe
  C:\Windows\System\qLYAMFV.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\sVGPWHy.exe
  C:\Windows\System\sVGPWHy.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\KzujpAc.exe
  C:\Windows\System\KzujpAc.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\ZJIkFWV.exe
  C:\Windows\System\ZJIkFWV.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\oDxXeno.exe
  C:\Windows\System\oDxXeno.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\UCWoHQW.exe
  C:\Windows\System\UCWoHQW.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fgujKxB.exe
  C:\Windows\System\fgujKxB.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\OoxCUQX.exe
  C:\Windows\System\OoxCUQX.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ABJqPoT.exe
  C:\Windows\System\ABJqPoT.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\CokhBmk.exe
  C:\Windows\System\CokhBmk.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\Lbdaubf.exe
  C:\Windows\System\Lbdaubf.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\GQuGTyh.exe
  C:\Windows\System\GQuGTyh.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\rzbESUa.exe
  C:\Windows\System\rzbESUa.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\TZQGDlG.exe
  C:\Windows\System\TZQGDlG.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\CpswekY.exe
  C:\Windows\System\CpswekY.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\NbHNEyP.exe
  C:\Windows\System\NbHNEyP.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TDWnZAG.exe
  C:\Windows\System\TDWnZAG.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\cjRevJt.exe
  C:\Windows\System\cjRevJt.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\cFzoqme.exe
  C:\Windows\System\cFzoqme.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\jmWnDOB.exe
  C:\Windows\System\jmWnDOB.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\CsIEPpt.exe
  C:\Windows\System\CsIEPpt.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\PpomztO.exe
  C:\Windows\System\PpomztO.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\LSGMjUl.exe
  C:\Windows\System\LSGMjUl.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\tfplrPH.exe
  C:\Windows\System\tfplrPH.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\WmYlHnv.exe
  C:\Windows\System\WmYlHnv.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\FxaMNtv.exe
  C:\Windows\System\FxaMNtv.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\LXZmgBM.exe
  C:\Windows\System\LXZmgBM.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\iBLQelh.exe
  C:\Windows\System\iBLQelh.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\HUgwgOQ.exe
  C:\Windows\System\HUgwgOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\TUOieRn.exe
  C:\Windows\System\TUOieRn.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\rVcvaFX.exe
  C:\Windows\System\rVcvaFX.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\HuxGFNt.exe
  C:\Windows\System\HuxGFNt.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\PffXOLX.exe
  C:\Windows\System\PffXOLX.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\SUtVlsC.exe
  C:\Windows\System\SUtVlsC.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\jKDqrcx.exe
  C:\Windows\System\jKDqrcx.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\LZdakFL.exe
  C:\Windows\System\LZdakFL.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\XfvmSVm.exe
  C:\Windows\System\XfvmSVm.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\rmsJSxh.exe
  C:\Windows\System\rmsJSxh.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\cGkPwcA.exe
  C:\Windows\System\cGkPwcA.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\gnWsjTF.exe
  C:\Windows\System\gnWsjTF.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\yHezxCR.exe
  C:\Windows\System\yHezxCR.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\JStNSGs.exe
  C:\Windows\System\JStNSGs.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\GhILNhL.exe
  C:\Windows\System\GhILNhL.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\BZqynEj.exe
  C:\Windows\System\BZqynEj.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\bsWxQiI.exe
  C:\Windows\System\bsWxQiI.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\wqHlYYF.exe
  C:\Windows\System\wqHlYYF.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\lYrUdEu.exe
  C:\Windows\System\lYrUdEu.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\JfgufsP.exe
  C:\Windows\System\JfgufsP.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yMxNXzQ.exe
  C:\Windows\System\yMxNXzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\XTWyFgb.exe
  C:\Windows\System\XTWyFgb.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\IZQMUgh.exe
  C:\Windows\System\IZQMUgh.exe
  2⤵
  PID:2788
- C:\Windows\System\vYMxYhV.exe
  C:\Windows\System\vYMxYhV.exe
  2⤵
  PID:2784
- C:\Windows\System\gRHyYpE.exe
  C:\Windows\System\gRHyYpE.exe
  2⤵
  PID:1376
- C:\Windows\System\fhPHuOV.exe
  C:\Windows\System\fhPHuOV.exe
  2⤵
  PID:2692
- C:\Windows\System\CirkpRn.exe
  C:\Windows\System\CirkpRn.exe
  2⤵
  PID:3048
- C:\Windows\System\iTWgWzi.exe
  C:\Windows\System\iTWgWzi.exe
  2⤵
  PID:992
- C:\Windows\System\DgzqqWK.exe
  C:\Windows\System\DgzqqWK.exe
  2⤵
  PID:2336
- C:\Windows\System\ezCiPOm.exe
  C:\Windows\System\ezCiPOm.exe
  2⤵
  PID:2444
- C:\Windows\System\hpQvLjV.exe
  C:\Windows\System\hpQvLjV.exe
  2⤵
  PID:2092
- C:\Windows\System\iggXmxx.exe
  C:\Windows\System\iggXmxx.exe
  2⤵
  PID:1256
- C:\Windows\System\KuTSAwW.exe
  C:\Windows\System\KuTSAwW.exe
  2⤵
  PID:1348
- C:\Windows\System\ZbxOWvK.exe
  C:\Windows\System\ZbxOWvK.exe
  2⤵
  PID:1520
- C:\Windows\System\mzEvQMS.exe
  C:\Windows\System\mzEvQMS.exe
  2⤵
  PID:1632
- C:\Windows\System\cDqZwGw.exe
  C:\Windows\System\cDqZwGw.exe
  2⤵
  PID:316
- C:\Windows\System\CWMwnmZ.exe
  C:\Windows\System\CWMwnmZ.exe
  2⤵
  PID:3000
- C:\Windows\System\VdbwOwp.exe
  C:\Windows\System\VdbwOwp.exe
  2⤵
  PID:1776
- C:\Windows\System\GUOZPGO.exe
  C:\Windows\System\GUOZPGO.exe
  2⤵
  PID:1096
- C:\Windows\System\YSaVhRO.exe
  C:\Windows\System\YSaVhRO.exe
  2⤵
  PID:1040
- C:\Windows\System\ndxjcrg.exe
  C:\Windows\System\ndxjcrg.exe
  2⤵
  PID:1780
- C:\Windows\System\QdtMgKf.exe
  C:\Windows\System\QdtMgKf.exe
  2⤵
  PID:900
- C:\Windows\System\SNFNzFq.exe
  C:\Windows\System\SNFNzFq.exe
  2⤵
  PID:1772
- C:\Windows\System\NBZEdvO.exe
  C:\Windows\System\NBZEdvO.exe
  2⤵
  PID:2424
- C:\Windows\System\tvqDghs.exe
  C:\Windows\System\tvqDghs.exe
  2⤵
  PID:2488
- C:\Windows\System\YDQpAkq.exe
  C:\Windows\System\YDQpAkq.exe
  2⤵
  PID:1996
- C:\Windows\System\HEWtCdK.exe
  C:\Windows\System\HEWtCdK.exe
  2⤵
  PID:1068
- C:\Windows\System\QmxkQzD.exe
  C:\Windows\System\QmxkQzD.exe
  2⤵
  PID:2128
- C:\Windows\System\EgwzcXE.exe
  C:\Windows\System\EgwzcXE.exe
  2⤵
  PID:2484
- C:\Windows\System\aSQKapv.exe
  C:\Windows\System\aSQKapv.exe
  2⤵
  PID:1604
- C:\Windows\System\RKNmzof.exe
  C:\Windows\System\RKNmzof.exe
  2⤵
  PID:3056
- C:\Windows\System\AnKgWRm.exe
  C:\Windows\System\AnKgWRm.exe
  2⤵
  PID:1944
- C:\Windows\System\kBgVNpM.exe
  C:\Windows\System\kBgVNpM.exe
  2⤵
  PID:2328
- C:\Windows\System\VSXOrUe.exe
  C:\Windows\System\VSXOrUe.exe
  2⤵
  PID:2240
- C:\Windows\System\HmiNjKd.exe
  C:\Windows\System\HmiNjKd.exe
  2⤵
  PID:2876
- C:\Windows\System\WCgOyCH.exe
  C:\Windows\System\WCgOyCH.exe
  2⤵
  PID:2756
- C:\Windows\System\SCDxmUJ.exe
  C:\Windows\System\SCDxmUJ.exe
  2⤵
  PID:3004
- C:\Windows\System\UCSNZrZ.exe
  C:\Windows\System\UCSNZrZ.exe
  2⤵
  PID:2820
- C:\Windows\System\pZRLSYm.exe
  C:\Windows\System\pZRLSYm.exe
  2⤵
  PID:2768
- C:\Windows\System\PYdfiDe.exe
  C:\Windows\System\PYdfiDe.exe
  2⤵
  PID:2664
- C:\Windows\System\uVynwHS.exe
  C:\Windows\System\uVynwHS.exe
  2⤵
  PID:2688
- C:\Windows\System\dLiCHXS.exe
  C:\Windows\System\dLiCHXS.exe
  2⤵
  PID:2908
- C:\Windows\System\DdKGMbB.exe
  C:\Windows\System\DdKGMbB.exe
  2⤵
  PID:1536
- C:\Windows\System\oTgGLId.exe
  C:\Windows\System\oTgGLId.exe
  2⤵
  PID:580
- C:\Windows\System\pUabnXw.exe
  C:\Windows\System\pUabnXw.exe
  2⤵
  PID:2340
- C:\Windows\System\eGPDxsZ.exe
  C:\Windows\System\eGPDxsZ.exe
  2⤵
  PID:796
- C:\Windows\System\BYhXjKi.exe
  C:\Windows\System\BYhXjKi.exe
  2⤵
  PID:960
- C:\Windows\System\yWYqDvR.exe
  C:\Windows\System\yWYqDvR.exe
  2⤵
  PID:704
- C:\Windows\System\fJxhRDS.exe
  C:\Windows\System\fJxhRDS.exe
  2⤵
  PID:2144
- C:\Windows\System\uOXjIDC.exe
  C:\Windows\System\uOXjIDC.exe
  2⤵
  PID:1092
- C:\Windows\System\KJoaKhC.exe
  C:\Windows\System\KJoaKhC.exe
  2⤵
  PID:2452
- C:\Windows\System\LhuSqko.exe
  C:\Windows\System\LhuSqko.exe
  2⤵
  PID:2400
- C:\Windows\System\qxmqhMD.exe
  C:\Windows\System\qxmqhMD.exe
  2⤵
  PID:1072
- C:\Windows\System\HzSgfZM.exe
  C:\Windows\System\HzSgfZM.exe
  2⤵
  PID:2072
- C:\Windows\System\aIBDzRv.exe
  C:\Windows\System\aIBDzRv.exe
  2⤵
  PID:2288
- C:\Windows\System\runoYAf.exe
  C:\Windows\System\runoYAf.exe
  2⤵
  PID:2960
- C:\Windows\System\sFUUxcy.exe
  C:\Windows\System\sFUUxcy.exe
  2⤵
  PID:1764
- C:\Windows\System\vEUAebm.exe
  C:\Windows\System\vEUAebm.exe
  2⤵
  PID:1872
- C:\Windows\System\LyMnskW.exe
  C:\Windows\System\LyMnskW.exe
  2⤵
  PID:2500
- C:\Windows\System\dkmpTgf.exe
  C:\Windows\System\dkmpTgf.exe
  2⤵
  PID:2244
- C:\Windows\System\mlkVeLf.exe
  C:\Windows\System\mlkVeLf.exe
  2⤵
  PID:2192
- C:\Windows\System\lDLdJaj.exe
  C:\Windows\System\lDLdJaj.exe
  2⤵
  PID:2860
- C:\Windows\System\EwPyoYw.exe
  C:\Windows\System\EwPyoYw.exe
  2⤵
  PID:956
- C:\Windows\System\xTrSzYW.exe
  C:\Windows\System\xTrSzYW.exe
  2⤵
  PID:2896
- C:\Windows\System\yPVSzLl.exe
  C:\Windows\System\yPVSzLl.exe
  2⤵
  PID:2320
- C:\Windows\System\qctMQtu.exe
  C:\Windows\System\qctMQtu.exe
  2⤵
  PID:1736
- C:\Windows\System\espwyru.exe
  C:\Windows\System\espwyru.exe
  2⤵
  PID:1172
- C:\Windows\System\unuXpNj.exe
  C:\Windows\System\unuXpNj.exe
  2⤵
  PID:2736
- C:\Windows\System\lTcnVYP.exe
  C:\Windows\System\lTcnVYP.exe
  2⤵
  PID:1956
- C:\Windows\System\okmUoUa.exe
  C:\Windows\System\okmUoUa.exe
  2⤵
  PID:2028
- C:\Windows\System\zinZjna.exe
  C:\Windows\System\zinZjna.exe
  2⤵
  PID:1564
- C:\Windows\System\bWfgins.exe
  C:\Windows\System\bWfgins.exe
  2⤵
  PID:568
- C:\Windows\System\xXlQaji.exe
  C:\Windows\System\xXlQaji.exe
  2⤵
  PID:1200
- C:\Windows\System\jQdUyJZ.exe
  C:\Windows\System\jQdUyJZ.exe
  2⤵
  PID:2020
- C:\Windows\System\ODSUuSy.exe
  C:\Windows\System\ODSUuSy.exe
  2⤵
  PID:2296
- C:\Windows\System\mDSGqOH.exe
  C:\Windows\System\mDSGqOH.exe
  2⤵
  PID:2808
- C:\Windows\System\ysGyyXX.exe
  C:\Windows\System\ysGyyXX.exe
  2⤵
  PID:1320
- C:\Windows\System\ypiUToN.exe
  C:\Windows\System\ypiUToN.exe
  2⤵
  PID:1012
- C:\Windows\System\wpcDHlh.exe
  C:\Windows\System\wpcDHlh.exe
  2⤵
  PID:1608
- C:\Windows\System\kfxlwRd.exe
  C:\Windows\System\kfxlwRd.exe
  2⤵
  PID:764
- C:\Windows\System\lucJmha.exe
  C:\Windows\System\lucJmha.exe
  2⤵
  PID:2840
- C:\Windows\System\DHtzAOX.exe
  C:\Windows\System\DHtzAOX.exe
  2⤵
  PID:2924
- C:\Windows\System\oRtzypW.exe
  C:\Windows\System\oRtzypW.exe
  2⤵
  PID:1800
- C:\Windows\System\cZeAQsi.exe
  C:\Windows\System\cZeAQsi.exe
  2⤵
  PID:2992
- C:\Windows\System\sVXzMyl.exe
  C:\Windows\System\sVXzMyl.exe
  2⤵
  PID:2884
- C:\Windows\System\TFpqBWp.exe
  C:\Windows\System\TFpqBWp.exe
  2⤵
  PID:1636
- C:\Windows\System\zozumoL.exe
  C:\Windows\System\zozumoL.exe
  2⤵
  PID:1364
- C:\Windows\System\PGozSHS.exe
  C:\Windows\System\PGozSHS.exe
  2⤵
  PID:1248
- C:\Windows\System\INzceHT.exe
  C:\Windows\System\INzceHT.exe
  2⤵
  PID:2880
- C:\Windows\System\iMBssFb.exe
  C:\Windows\System\iMBssFb.exe
  2⤵
  PID:2224
- C:\Windows\System\KgSlYmX.exe
  C:\Windows\System\KgSlYmX.exe
  2⤵
  PID:416
- C:\Windows\System\yyehXdM.exe
  C:\Windows\System\yyehXdM.exe
  2⤵
  PID:948
- C:\Windows\System\KTqRZGV.exe
  C:\Windows\System\KTqRZGV.exe
  2⤵
  PID:1112
- C:\Windows\System\BCUHlDZ.exe
  C:\Windows\System\BCUHlDZ.exe
  2⤵
  PID:1532
- C:\Windows\System\AEkHcMB.exe
  C:\Windows\System\AEkHcMB.exe
  2⤵
  PID:2088
- C:\Windows\System\FzYIMdP.exe
  C:\Windows\System\FzYIMdP.exe
  2⤵
  PID:2596
- C:\Windows\System\EaKIhlM.exe
  C:\Windows\System\EaKIhlM.exe
  2⤵
  PID:3052
- C:\Windows\System\jkLuSPq.exe
  C:\Windows\System\jkLuSPq.exe
  2⤵
  PID:2212
- C:\Windows\System\kvWQlgR.exe
  C:\Windows\System\kvWQlgR.exe
  2⤵
  PID:2780
- C:\Windows\System\FQNAZWY.exe
  C:\Windows\System\FQNAZWY.exe
  2⤵
  PID:2972
- C:\Windows\System\IXTNwig.exe
  C:\Windows\System\IXTNwig.exe
  2⤵
  PID:912
- C:\Windows\System\jzfRboF.exe
  C:\Windows\System\jzfRboF.exe
  2⤵
  PID:996
- C:\Windows\System\HVlmkjL.exe
  C:\Windows\System\HVlmkjL.exe
  2⤵
  PID:3076
- C:\Windows\System\cFbSimv.exe
  C:\Windows\System\cFbSimv.exe
  2⤵
  PID:3092
- C:\Windows\System\qgcKKhW.exe
  C:\Windows\System\qgcKKhW.exe
  2⤵
  PID:3112
- C:\Windows\System\vDwUkSI.exe
  C:\Windows\System\vDwUkSI.exe
  2⤵
  PID:3128
- C:\Windows\System\NTvMuze.exe
  C:\Windows\System\NTvMuze.exe
  2⤵
  PID:3144
- C:\Windows\System\ObuKjIY.exe
  C:\Windows\System\ObuKjIY.exe
  2⤵
  PID:3160
- C:\Windows\System\vaaoscP.exe
  C:\Windows\System\vaaoscP.exe
  2⤵
  PID:3212
- C:\Windows\System\IYQpQat.exe
  C:\Windows\System\IYQpQat.exe
  2⤵
  PID:3228
- C:\Windows\System\QxUrHfa.exe
  C:\Windows\System\QxUrHfa.exe
  2⤵
  PID:3244
- C:\Windows\System\ffETybz.exe
  C:\Windows\System\ffETybz.exe
  2⤵
  PID:3264
- C:\Windows\System\pKSFddq.exe
  C:\Windows\System\pKSFddq.exe
  2⤵
  PID:3296
- C:\Windows\System\uJGIxHq.exe
  C:\Windows\System\uJGIxHq.exe
  2⤵
  PID:3324
- C:\Windows\System\ghRzdXJ.exe
  C:\Windows\System\ghRzdXJ.exe
  2⤵
  PID:3344
- C:\Windows\System\TzVlmHk.exe
  C:\Windows\System\TzVlmHk.exe
  2⤵
  PID:3360
- C:\Windows\System\roTpikv.exe
  C:\Windows\System\roTpikv.exe
  2⤵
  PID:3388
- C:\Windows\System\BpnkhYV.exe
  C:\Windows\System\BpnkhYV.exe
  2⤵
  PID:3404
- C:\Windows\System\tsTKuay.exe
  C:\Windows\System\tsTKuay.exe
  2⤵
  PID:3428
- C:\Windows\System\hlTJdEe.exe
  C:\Windows\System\hlTJdEe.exe
  2⤵
  PID:3448
- C:\Windows\System\xeoWhne.exe
  C:\Windows\System\xeoWhne.exe
  2⤵
  PID:3464
- C:\Windows\System\NkUfsNH.exe
  C:\Windows\System\NkUfsNH.exe
  2⤵
  PID:3480
- C:\Windows\System\TzAwLCY.exe
  C:\Windows\System\TzAwLCY.exe
  2⤵
  PID:3496
- C:\Windows\System\aaPHCni.exe
  C:\Windows\System\aaPHCni.exe
  2⤵
  PID:3512
- C:\Windows\System\yhfpBYK.exe
  C:\Windows\System\yhfpBYK.exe
  2⤵
  PID:3532
- C:\Windows\System\dAvKapS.exe
  C:\Windows\System\dAvKapS.exe
  2⤵
  PID:3548
- C:\Windows\System\bKgqqMu.exe
  C:\Windows\System\bKgqqMu.exe
  2⤵
  PID:3564
- C:\Windows\System\ImhOkJD.exe
  C:\Windows\System\ImhOkJD.exe
  2⤵
  PID:3580
- C:\Windows\System\ZfUQgGA.exe
  C:\Windows\System\ZfUQgGA.exe
  2⤵
  PID:3596
- C:\Windows\System\bbumbeP.exe
  C:\Windows\System\bbumbeP.exe
  2⤵
  PID:3616
- C:\Windows\System\KPTFIkh.exe
  C:\Windows\System\KPTFIkh.exe
  2⤵
  PID:3632
- C:\Windows\System\NkxFdVI.exe
  C:\Windows\System\NkxFdVI.exe
  2⤵
  PID:3648
- C:\Windows\System\fPXHQmK.exe
  C:\Windows\System\fPXHQmK.exe
  2⤵
  PID:3664
- C:\Windows\System\GUJKfbN.exe
  C:\Windows\System\GUJKfbN.exe
  2⤵
  PID:3684
- C:\Windows\System\HHkisAU.exe
  C:\Windows\System\HHkisAU.exe
  2⤵
  PID:3700
- C:\Windows\System\MJgOjpr.exe
  C:\Windows\System\MJgOjpr.exe
  2⤵
  PID:3716
- C:\Windows\System\dFvMSSD.exe
  C:\Windows\System\dFvMSSD.exe
  2⤵
  PID:3732
- C:\Windows\System\AHSSILn.exe
  C:\Windows\System\AHSSILn.exe
  2⤵
  PID:3752
- C:\Windows\System\VFumeYd.exe
  C:\Windows\System\VFumeYd.exe
  2⤵
  PID:3768
- C:\Windows\System\TPNMuYk.exe
  C:\Windows\System\TPNMuYk.exe
  2⤵
  PID:3784
- C:\Windows\System\yXeJmOj.exe
  C:\Windows\System\yXeJmOj.exe
  2⤵
  PID:3868
- C:\Windows\System\JGmWkvG.exe
  C:\Windows\System\JGmWkvG.exe
  2⤵
  PID:3888
- C:\Windows\System\bZZmEPA.exe
  C:\Windows\System\bZZmEPA.exe
  2⤵
  PID:3904
- C:\Windows\System\CUVrVmM.exe
  C:\Windows\System\CUVrVmM.exe
  2⤵
  PID:3920
- C:\Windows\System\jiEASWZ.exe
  C:\Windows\System\jiEASWZ.exe
  2⤵
  PID:3936
- C:\Windows\System\xwhCRjJ.exe
  C:\Windows\System\xwhCRjJ.exe
  2⤵
  PID:3952
- C:\Windows\System\tfEXGHv.exe
  C:\Windows\System\tfEXGHv.exe
  2⤵
  PID:3968
- C:\Windows\System\FXcPOne.exe
  C:\Windows\System\FXcPOne.exe
  2⤵
  PID:3984
- C:\Windows\System\AAydzlx.exe
  C:\Windows\System\AAydzlx.exe
  2⤵
  PID:4004
- C:\Windows\System\QEMwPMw.exe
  C:\Windows\System\QEMwPMw.exe
  2⤵
  PID:4020
- C:\Windows\System\gVdSEDX.exe
  C:\Windows\System\gVdSEDX.exe
  2⤵
  PID:4036
- C:\Windows\System\ALqnnWI.exe
  C:\Windows\System\ALqnnWI.exe
  2⤵
  PID:4052
- C:\Windows\System\CSYbpIv.exe
  C:\Windows\System\CSYbpIv.exe
  2⤵
  PID:4072
- C:\Windows\System\AoFqgrI.exe
  C:\Windows\System\AoFqgrI.exe
  2⤵
  PID:4088
- C:\Windows\System\vBFTqxB.exe
  C:\Windows\System\vBFTqxB.exe
  2⤵
  PID:692
- C:\Windows\System\ZEBklCd.exe
  C:\Windows\System\ZEBklCd.exe
  2⤵
  PID:840
- C:\Windows\System\YkyqMtF.exe
  C:\Windows\System\YkyqMtF.exe
  2⤵
  PID:2200
- C:\Windows\System\VHLhNop.exe
  C:\Windows\System\VHLhNop.exe
  2⤵
  PID:3108
- C:\Windows\System\MpMLmQD.exe
  C:\Windows\System\MpMLmQD.exe
  2⤵
  PID:3172
- C:\Windows\System\NKmIXIp.exe
  C:\Windows\System\NKmIXIp.exe
  2⤵
  PID:3192
- C:\Windows\System\WQQlOnx.exe
  C:\Windows\System\WQQlOnx.exe
  2⤵
  PID:3176
- C:\Windows\System\pgNEDWO.exe
  C:\Windows\System\pgNEDWO.exe
  2⤵
  PID:380
- C:\Windows\System\AkggAUS.exe
  C:\Windows\System\AkggAUS.exe
  2⤵
  PID:3152
- C:\Windows\System\hwrKyqV.exe
  C:\Windows\System\hwrKyqV.exe
  2⤵
  PID:3252
- C:\Windows\System\KuxwBJj.exe
  C:\Windows\System\KuxwBJj.exe
  2⤵
  PID:1152
- C:\Windows\System\ppkFuqT.exe
  C:\Windows\System\ppkFuqT.exe
  2⤵
  PID:3340
- C:\Windows\System\TQLwYCH.exe
  C:\Windows\System\TQLwYCH.exe
  2⤵
  PID:3380
- C:\Windows\System\neWjDbh.exe
  C:\Windows\System\neWjDbh.exe
  2⤵
  PID:3424
- C:\Windows\System\IDiOdKk.exe
  C:\Windows\System\IDiOdKk.exe
  2⤵
  PID:3520
- C:\Windows\System\oVgtvsO.exe
  C:\Windows\System\oVgtvsO.exe
  2⤵
  PID:3444
- C:\Windows\System\ylYvEtm.exe
  C:\Windows\System\ylYvEtm.exe
  2⤵
  PID:3576
- C:\Windows\System\qNqOGnz.exe
  C:\Windows\System\qNqOGnz.exe
  2⤵
  PID:3644
- C:\Windows\System\FLnBsdx.exe
  C:\Windows\System\FLnBsdx.exe
  2⤵
  PID:3708
- C:\Windows\System\EpwUMSe.exe
  C:\Windows\System\EpwUMSe.exe
  2⤵
  PID:3748
- C:\Windows\System\rEEWFIA.exe
  C:\Windows\System\rEEWFIA.exe
  2⤵
  PID:3560
- C:\Windows\System\mYbxBxT.exe
  C:\Windows\System\mYbxBxT.exe
  2⤵
  PID:3656
- C:\Windows\System\SMMKpto.exe
  C:\Windows\System\SMMKpto.exe
  2⤵
  PID:3724
- C:\Windows\System\ePTFSKq.exe
  C:\Windows\System\ePTFSKq.exe
  2⤵
  PID:3836
- C:\Windows\System\kYuRFgx.exe
  C:\Windows\System\kYuRFgx.exe
  2⤵
  PID:3824
- C:\Windows\System\NjVfArg.exe
  C:\Windows\System\NjVfArg.exe
  2⤵
  PID:3800
- C:\Windows\System\YxJfTbi.exe
  C:\Windows\System\YxJfTbi.exe
  2⤵
  PID:3852
- C:\Windows\System\auoBjhn.exe
  C:\Windows\System\auoBjhn.exe
  2⤵
  PID:3476
- C:\Windows\System\kqOrfwf.exe
  C:\Windows\System\kqOrfwf.exe
  2⤵
  PID:3776
- C:\Windows\System\NIIMDJP.exe
  C:\Windows\System\NIIMDJP.exe
  2⤵
  PID:3880
- C:\Windows\System\QxpWWhP.exe
  C:\Windows\System\QxpWWhP.exe
  2⤵
  PID:3912
- C:\Windows\System\IPSYEOk.exe
  C:\Windows\System\IPSYEOk.exe
  2⤵
  PID:3976
- C:\Windows\System\loXSXKf.exe
  C:\Windows\System\loXSXKf.exe
  2⤵
  PID:4048
- C:\Windows\System\zBnkrSh.exe
  C:\Windows\System\zBnkrSh.exe
  2⤵
  PID:3136
- C:\Windows\System\PPbEEKE.exe
  C:\Windows\System\PPbEEKE.exe
  2⤵
  PID:3204
- C:\Windows\System\HdWVcfj.exe
  C:\Windows\System\HdWVcfj.exe
  2⤵
  PID:3260
- C:\Windows\System\fizZqZk.exe
  C:\Windows\System\fizZqZk.exe
  2⤵
  PID:2356
- C:\Windows\System\VGvTNxK.exe
  C:\Windows\System\VGvTNxK.exe
  2⤵
  PID:2168
- C:\Windows\System\vTEPRLM.exe
  C:\Windows\System\vTEPRLM.exe
  2⤵
  PID:3104
- C:\Windows\System\fwEqPvd.exe
  C:\Windows\System\fwEqPvd.exe
  2⤵
  PID:3280
- C:\Windows\System\taHIwIB.exe
  C:\Windows\System\taHIwIB.exe
  2⤵
  PID:1692
- C:\Windows\System\hjSqMtl.exe
  C:\Windows\System\hjSqMtl.exe
  2⤵
  PID:3312
- C:\Windows\System\BtEVOtt.exe
  C:\Windows\System\BtEVOtt.exe
  2⤵
  PID:3356
- C:\Windows\System\bPUWyVW.exe
  C:\Windows\System\bPUWyVW.exe
  2⤵
  PID:3436
- C:\Windows\System\VXfOYSi.exe
  C:\Windows\System\VXfOYSi.exe
  2⤵
  PID:3676
- C:\Windows\System\iIIdwtV.exe
  C:\Windows\System\iIIdwtV.exe
  2⤵
  PID:3696
- C:\Windows\System\IJckPIh.exe
  C:\Windows\System\IJckPIh.exe
  2⤵
  PID:3844
- C:\Windows\System\zQUeYeR.exe
  C:\Windows\System\zQUeYeR.exe
  2⤵
  PID:3604
- C:\Windows\System\DPjBLLV.exe
  C:\Windows\System\DPjBLLV.exe
  2⤵
  PID:4016
- C:\Windows\System\ViOVEJx.exe
  C:\Windows\System\ViOVEJx.exe
  2⤵
  PID:3168
- C:\Windows\System\XNUENmU.exe
  C:\Windows\System\XNUENmU.exe
  2⤵
  PID:3276
- C:\Windows\System\ngqmbsM.exe
  C:\Windows\System\ngqmbsM.exe
  2⤵
  PID:596
- C:\Windows\System\LLRpgor.exe
  C:\Windows\System\LLRpgor.exe
  2⤵
  PID:4104
- C:\Windows\System\jRkKeZY.exe
  C:\Windows\System\jRkKeZY.exe
  2⤵
  PID:4128
- C:\Windows\System\fdTnGFy.exe
  C:\Windows\System\fdTnGFy.exe
  2⤵
  PID:4144
- C:\Windows\System\MSPUIky.exe
  C:\Windows\System\MSPUIky.exe
  2⤵
  PID:4160
- C:\Windows\System\dsPvaHC.exe
  C:\Windows\System\dsPvaHC.exe
  2⤵
  PID:4180
- C:\Windows\System\KSvxyqO.exe
  C:\Windows\System\KSvxyqO.exe
  2⤵
  PID:4196
- C:\Windows\System\WQzThNA.exe
  C:\Windows\System\WQzThNA.exe
  2⤵
  PID:4216
- C:\Windows\System\EYyopQK.exe
  C:\Windows\System\EYyopQK.exe
  2⤵
  PID:4232
- C:\Windows\System\OwOlMDX.exe
  C:\Windows\System\OwOlMDX.exe
  2⤵
  PID:4248
- C:\Windows\System\wcgAyuQ.exe
  C:\Windows\System\wcgAyuQ.exe
  2⤵
  PID:4264
- C:\Windows\System\zxITwDR.exe
  C:\Windows\System\zxITwDR.exe
  2⤵
  PID:4284
- C:\Windows\System\QZRfikJ.exe
  C:\Windows\System\QZRfikJ.exe
  2⤵
  PID:4300
- C:\Windows\System\rudhUlB.exe
  C:\Windows\System\rudhUlB.exe
  2⤵
  PID:4316
- C:\Windows\System\ZRxTuQa.exe
  C:\Windows\System\ZRxTuQa.exe
  2⤵
  PID:4336
- C:\Windows\System\bLvaBZm.exe
  C:\Windows\System\bLvaBZm.exe
  2⤵
  PID:4352
- C:\Windows\System\dEeoNmP.exe
  C:\Windows\System\dEeoNmP.exe
  2⤵
  PID:4372
- C:\Windows\System\NgGScxx.exe
  C:\Windows\System\NgGScxx.exe
  2⤵
  PID:4388
- C:\Windows\System\YSIOLEU.exe
  C:\Windows\System\YSIOLEU.exe
  2⤵
  PID:4412
- C:\Windows\System\nGMTcGE.exe
  C:\Windows\System\nGMTcGE.exe
  2⤵
  PID:4428
- C:\Windows\System\RKoSXSp.exe
  C:\Windows\System\RKoSXSp.exe
  2⤵
  PID:4452
- C:\Windows\System\WtDdfjB.exe
  C:\Windows\System\WtDdfjB.exe
  2⤵
  PID:4488
- C:\Windows\System\amriqSi.exe
  C:\Windows\System\amriqSi.exe
  2⤵
  PID:4556
- C:\Windows\System\oHcysTd.exe
  C:\Windows\System\oHcysTd.exe
  2⤵
  PID:4612
- C:\Windows\System\qTBzSDD.exe
  C:\Windows\System\qTBzSDD.exe
  2⤵
  PID:4628
- C:\Windows\System\LhnObeq.exe
  C:\Windows\System\LhnObeq.exe
  2⤵
  PID:4652
- C:\Windows\System\hDIcNLJ.exe
  C:\Windows\System\hDIcNLJ.exe
  2⤵
  PID:4668
- C:\Windows\System\sibjMET.exe
  C:\Windows\System\sibjMET.exe
  2⤵
  PID:4684
- C:\Windows\System\PhhJsHD.exe
  C:\Windows\System\PhhJsHD.exe
  2⤵
  PID:4700
- C:\Windows\System\abUGPWH.exe
  C:\Windows\System\abUGPWH.exe
  2⤵
  PID:4720
- C:\Windows\System\dNwtrby.exe
  C:\Windows\System\dNwtrby.exe
  2⤵
  PID:4736
- C:\Windows\System\tNyFKrz.exe
  C:\Windows\System\tNyFKrz.exe
  2⤵
  PID:4752
- C:\Windows\System\ADYFsgm.exe
  C:\Windows\System\ADYFsgm.exe
  2⤵
  PID:4768
- C:\Windows\System\OGLrjGn.exe
  C:\Windows\System\OGLrjGn.exe
  2⤵
  PID:4784
- C:\Windows\System\sgGghpA.exe
  C:\Windows\System\sgGghpA.exe
  2⤵
  PID:4800
- C:\Windows\System\WKxwxzz.exe
  C:\Windows\System\WKxwxzz.exe
  2⤵
  PID:4820
- C:\Windows\System\YKyBwdN.exe
  C:\Windows\System\YKyBwdN.exe
  2⤵
  PID:4836
- C:\Windows\System\zrOxlTS.exe
  C:\Windows\System\zrOxlTS.exe
  2⤵
  PID:4852
- C:\Windows\System\uKccCKb.exe
  C:\Windows\System\uKccCKb.exe
  2⤵
  PID:4872
- C:\Windows\System\lJckiPS.exe
  C:\Windows\System\lJckiPS.exe
  2⤵
  PID:4892
- C:\Windows\System\lsofWMQ.exe
  C:\Windows\System\lsofWMQ.exe
  2⤵
  PID:4908
- C:\Windows\System\IHPwSlJ.exe
  C:\Windows\System\IHPwSlJ.exe
  2⤵
  PID:4924
- C:\Windows\System\kDwjqpV.exe
  C:\Windows\System\kDwjqpV.exe
  2⤵
  PID:4940
- C:\Windows\System\WbFqHJi.exe
  C:\Windows\System\WbFqHJi.exe
  2⤵
  PID:4960
- C:\Windows\System\wvKlXIY.exe
  C:\Windows\System\wvKlXIY.exe
  2⤵
  PID:4976
- C:\Windows\System\jZeFgIj.exe
  C:\Windows\System\jZeFgIj.exe
  2⤵
  PID:4992
- C:\Windows\System\dnktLGk.exe
  C:\Windows\System\dnktLGk.exe
  2⤵
  PID:5012
- C:\Windows\System\VTaxhPK.exe
  C:\Windows\System\VTaxhPK.exe
  2⤵
  PID:5056
- C:\Windows\System\gmEBTal.exe
  C:\Windows\System\gmEBTal.exe
  2⤵
  PID:5084
- C:\Windows\System\MUsAQVF.exe
  C:\Windows\System\MUsAQVF.exe
  2⤵
  PID:5108
- C:\Windows\System\lWtKHir.exe
  C:\Windows\System\lWtKHir.exe
  2⤵
  PID:3884
- C:\Windows\System\rSOXDuC.exe
  C:\Windows\System\rSOXDuC.exe
  2⤵
  PID:3996
- C:\Windows\System\dzsRTRm.exe
  C:\Windows\System\dzsRTRm.exe
  2⤵
  PID:3416
- C:\Windows\System\LeknDdP.exe
  C:\Windows\System\LeknDdP.exe
  2⤵
  PID:3612
- C:\Windows\System\ysMOFuJ.exe
  C:\Windows\System\ysMOFuJ.exe
  2⤵
  PID:4032
- C:\Windows\System\PNeHLEr.exe
  C:\Windows\System\PNeHLEr.exe
  2⤵
  PID:3760
- C:\Windows\System\PbamGgh.exe
  C:\Windows\System\PbamGgh.exe
  2⤵
  PID:3804
- C:\Windows\System\zlrQKLs.exe
  C:\Windows\System\zlrQKLs.exe
  2⤵
  PID:3224
- C:\Windows\System\cPQZafk.exe
  C:\Windows\System\cPQZafk.exe
  2⤵
  PID:3556
- C:\Windows\System\KMZitjx.exe
  C:\Windows\System\KMZitjx.exe
  2⤵
  PID:4204
- C:\Windows\System\BrcFnMC.exe
  C:\Windows\System\BrcFnMC.exe
  2⤵
  PID:4272
- C:\Windows\System\sFnuQJI.exe
  C:\Windows\System\sFnuQJI.exe
  2⤵
  PID:4308
- C:\Windows\System\jvkhcjy.exe
  C:\Windows\System\jvkhcjy.exe
  2⤵
  PID:4380
- C:\Windows\System\pMkWrNA.exe
  C:\Windows\System\pMkWrNA.exe
  2⤵
  PID:3592
- C:\Windows\System\zGdPtXQ.exe
  C:\Windows\System\zGdPtXQ.exe
  2⤵
  PID:1504
- C:\Windows\System\bAmGGdh.exe
  C:\Windows\System\bAmGGdh.exe
  2⤵
  PID:4120
- C:\Windows\System\mOChYOa.exe
  C:\Windows\System\mOChYOa.exe
  2⤵
  PID:4468
- C:\Windows\System\iRhfLTg.exe
  C:\Windows\System\iRhfLTg.exe
  2⤵
  PID:4484
- C:\Windows\System\AnnViWH.exe
  C:\Windows\System\AnnViWH.exe
  2⤵
  PID:4000
- C:\Windows\System\XdRRDdi.exe
  C:\Windows\System\XdRRDdi.exe
  2⤵
  PID:4512
- C:\Windows\System\UsAStOB.exe
  C:\Windows\System\UsAStOB.exe
  2⤵
  PID:4296
- C:\Windows\System\wTtLBRL.exe
  C:\Windows\System\wTtLBRL.exe
  2⤵
  PID:4364
- C:\Windows\System\DTlRUmV.exe
  C:\Windows\System\DTlRUmV.exe
  2⤵
  PID:4408
- C:\Windows\System\kqMgnTu.exe
  C:\Windows\System\kqMgnTu.exe
  2⤵
  PID:4496
- C:\Windows\System\SJeaglV.exe
  C:\Windows\System\SJeaglV.exe
  2⤵
  PID:4520
- C:\Windows\System\jLkwIoZ.exe
  C:\Windows\System\jLkwIoZ.exe
  2⤵
  PID:4532
- C:\Windows\System\MdovuOF.exe
  C:\Windows\System\MdovuOF.exe
  2⤵
  PID:4576
- C:\Windows\System\VwMVbku.exe
  C:\Windows\System\VwMVbku.exe
  2⤵
  PID:4588
- C:\Windows\System\tjPhVhX.exe
  C:\Windows\System\tjPhVhX.exe
  2⤵
  PID:4624
- C:\Windows\System\jIOdiQm.exe
  C:\Windows\System\jIOdiQm.exe
  2⤵
  PID:4692
- C:\Windows\System\nxooCfS.exe
  C:\Windows\System\nxooCfS.exe
  2⤵
  PID:4732
- C:\Windows\System\aNRIcBm.exe
  C:\Windows\System\aNRIcBm.exe
  2⤵
  PID:4764
- C:\Windows\System\FCKmPvh.exe
  C:\Windows\System\FCKmPvh.exe
  2⤵
  PID:4716
- C:\Windows\System\GYVdCwR.exe
  C:\Windows\System\GYVdCwR.exe
  2⤵
  PID:4864
- C:\Windows\System\QLBDuFs.exe
  C:\Windows\System\QLBDuFs.exe
  2⤵
  PID:4848
- C:\Windows\System\TbJrTDm.exe
  C:\Windows\System\TbJrTDm.exe
  2⤵
  PID:5028
- C:\Windows\System\fmwOEbG.exe
  C:\Windows\System\fmwOEbG.exe
  2⤵
  PID:4936
- C:\Windows\System\bydgWuf.exe
  C:\Windows\System\bydgWuf.exe
  2⤵
  PID:5044
- C:\Windows\System\FEJiWZs.exe
  C:\Windows\System\FEJiWZs.exe
  2⤵
  PID:4904
- C:\Windows\System\TckOdyK.exe
  C:\Windows\System\TckOdyK.exe
  2⤵
  PID:5052
- C:\Windows\System\uEFfzML.exe
  C:\Windows\System\uEFfzML.exe
  2⤵
  PID:5008
- C:\Windows\System\vBgNMlk.exe
  C:\Windows\System\vBgNMlk.exe
  2⤵
  PID:5092
- C:\Windows\System\WTMgYaN.exe
  C:\Windows\System\WTMgYaN.exe
  2⤵
  PID:3352
- C:\Windows\System\gpQoqES.exe
  C:\Windows\System\gpQoqES.exe
  2⤵
  PID:3540
- C:\Windows\System\CLbWrGl.exe
  C:\Windows\System\CLbWrGl.exe
  2⤵
  PID:3492
- C:\Windows\System\RKONLEF.exe
  C:\Windows\System\RKONLEF.exe
  2⤵
  PID:3864
- C:\Windows\System\hZnypFm.exe
  C:\Windows\System\hZnypFm.exe
  2⤵
  PID:4068
- C:\Windows\System\nxrIyHd.exe
  C:\Windows\System\nxrIyHd.exe
  2⤵
  PID:1680
- C:\Windows\System\JpIRVTy.exe
  C:\Windows\System\JpIRVTy.exe
  2⤵
  PID:3304
- C:\Windows\System\QUBHXIo.exe
  C:\Windows\System\QUBHXIo.exe
  2⤵
  PID:3412
- C:\Windows\System\ZUqjWlU.exe
  C:\Windows\System\ZUqjWlU.exe
  2⤵
  PID:4276
- C:\Windows\System\BzWNzAq.exe
  C:\Windows\System\BzWNzAq.exe
  2⤵
  PID:4244
- C:\Windows\System\VPXpuVe.exe
  C:\Windows\System\VPXpuVe.exe
  2⤵
  PID:3628
- C:\Windows\System\YDeZHbl.exe
  C:\Windows\System\YDeZHbl.exe
  2⤵
  PID:4480
- C:\Windows\System\zGUWdeF.exe
  C:\Windows\System\zGUWdeF.exe
  2⤵
  PID:2592
- C:\Windows\System\FGWINXO.exe
  C:\Windows\System\FGWINXO.exe
  2⤵
  PID:4260
- C:\Windows\System\lqTYdPJ.exe
  C:\Windows\System\lqTYdPJ.exe
  2⤵
  PID:4440
- C:\Windows\System\LxVrmni.exe
  C:\Windows\System\LxVrmni.exe
  2⤵
  PID:4464
- C:\Windows\System\MazpJec.exe
  C:\Windows\System\MazpJec.exe
  2⤵
  PID:4552
- C:\Windows\System\yCRxeky.exe
  C:\Windows\System\yCRxeky.exe
  2⤵
  PID:4584
- C:\Windows\System\EuCpqqW.exe
  C:\Windows\System\EuCpqqW.exe
  2⤵
  PID:4516
- C:\Windows\System\LRdaYJk.exe
  C:\Windows\System\LRdaYJk.exe
  2⤵
  PID:2516
- C:\Windows\System\XHCRagq.exe
  C:\Windows\System\XHCRagq.exe
  2⤵
  PID:4728
- C:\Windows\System\uQOOmiq.exe
  C:\Windows\System\uQOOmiq.exe
  2⤵
  PID:4792
- C:\Windows\System\UqmJeaZ.exe
  C:\Windows\System\UqmJeaZ.exe
  2⤵
  PID:4808
- C:\Windows\System\Kmldpft.exe
  C:\Windows\System\Kmldpft.exe
  2⤵
  PID:4780
- C:\Windows\System\DRuMNyb.exe
  C:\Windows\System\DRuMNyb.exe
  2⤵
  PID:4696
- C:\Windows\System\jJvQQVD.exe
  C:\Windows\System\jJvQQVD.exe
  2⤵
  PID:4796
- C:\Windows\System\kjVuQGN.exe
  C:\Windows\System\kjVuQGN.exe
  2⤵
  PID:2656
- C:\Windows\System\nrCcuTt.exe
  C:\Windows\System\nrCcuTt.exe
  2⤵
  PID:5048
- C:\Windows\System\uLEUemN.exe
  C:\Windows\System\uLEUemN.exe
  2⤵
  PID:5076
- C:\Windows\System\axyCPlp.exe
  C:\Windows\System\axyCPlp.exe
  2⤵
  PID:4028
- C:\Windows\System\YuIycsY.exe
  C:\Windows\System\YuIycsY.exe
  2⤵
  PID:3860
- C:\Windows\System\DfGIjVv.exe
  C:\Windows\System\DfGIjVv.exe
  2⤵
  PID:3876
- C:\Windows\System\ZsyAVbf.exe
  C:\Windows\System\ZsyAVbf.exe
  2⤵
  PID:4100
- C:\Windows\System\sXWMVwn.exe
  C:\Windows\System\sXWMVwn.exe
  2⤵
  PID:3944
- C:\Windows\System\uyQQYFe.exe
  C:\Windows\System\uyQQYFe.exe
  2⤵
  PID:868
- C:\Windows\System\LCFunpX.exe
  C:\Windows\System\LCFunpX.exe
  2⤵
  PID:3692
- C:\Windows\System\Gskdxod.exe
  C:\Windows\System\Gskdxod.exe
  2⤵
  PID:4152
- C:\Windows\System\vqtOTnn.exe
  C:\Windows\System\vqtOTnn.exe
  2⤵
  PID:4228
- C:\Windows\System\lLciPtd.exe
  C:\Windows\System\lLciPtd.exe
  2⤵
  PID:324
- C:\Windows\System\XtQldiH.exe
  C:\Windows\System\XtQldiH.exe
  2⤵
  PID:4968
- C:\Windows\System\sWMybDA.exe
  C:\Windows\System\sWMybDA.exe
  2⤵
  PID:3816
- C:\Windows\System\QHTgYxs.exe
  C:\Windows\System\QHTgYxs.exe
  2⤵
  PID:4344
- C:\Windows\System\PzmGipg.exe
  C:\Windows\System\PzmGipg.exe
  2⤵
  PID:4116
- C:\Windows\System\KEijkdy.exe
  C:\Windows\System\KEijkdy.exe
  2⤵
  PID:4396
- C:\Windows\System\ofyfECR.exe
  C:\Windows\System\ofyfECR.exe
  2⤵
  PID:4256
- C:\Windows\System\jyfGonp.exe
  C:\Windows\System\jyfGonp.exe
  2⤵
  PID:4400
- C:\Windows\System\aqbhoyg.exe
  C:\Windows\System\aqbhoyg.exe
  2⤵
  PID:4608
- C:\Windows\System\thraAPu.exe
  C:\Windows\System\thraAPu.exe
  2⤵
  PID:4604
- C:\Windows\System\YbsLREB.exe
  C:\Windows\System\YbsLREB.exe
  2⤵
  PID:4956
- C:\Windows\System\qVuSHGZ.exe
  C:\Windows\System\qVuSHGZ.exe
  2⤵
  PID:4828
- C:\Windows\System\GIWfnbj.exe
  C:\Windows\System\GIWfnbj.exe
  2⤵
  PID:4916
- C:\Windows\System\oDfABgZ.exe
  C:\Windows\System\oDfABgZ.exe
  2⤵
  PID:3256
- C:\Windows\System\YualTKD.exe
  C:\Windows\System\YualTKD.exe
  2⤵
  PID:4708
- C:\Windows\System\IAKBGSG.exe
  C:\Windows\System\IAKBGSG.exe
  2⤵
  PID:3376
- C:\Windows\System\BOzucMM.exe
  C:\Windows\System\BOzucMM.exe
  2⤵
  PID:3220
- C:\Windows\System\FOhFtJL.exe
  C:\Windows\System\FOhFtJL.exe
  2⤵
  PID:4748
- C:\Windows\System\NNPrfxu.exe
  C:\Windows\System\NNPrfxu.exe
  2⤵
  PID:4596
- C:\Windows\System\zwTiQuh.exe
  C:\Windows\System\zwTiQuh.exe
  2⤵
  PID:4140
- C:\Windows\System\NkPptva.exe
  C:\Windows\System\NkPptva.exe
  2⤵
  PID:3400
- C:\Windows\System\fQYhPZl.exe
  C:\Windows\System\fQYhPZl.exe
  2⤵
  PID:3544
- C:\Windows\System\buhjbCP.exe
  C:\Windows\System\buhjbCP.exe
  2⤵
  PID:3744
- C:\Windows\System\UBLNBuB.exe
  C:\Windows\System\UBLNBuB.exe
  2⤵
  PID:4920
- C:\Windows\System\ttbeizy.exe
  C:\Windows\System\ttbeizy.exe
  2⤵
  PID:3336
- C:\Windows\System\xtcQZHv.exe
  C:\Windows\System\xtcQZHv.exe
  2⤵
  PID:4816
- C:\Windows\System\Kjgefxx.exe
  C:\Windows\System\Kjgefxx.exe
  2⤵
  PID:4952
- C:\Windows\System\UkbSuxz.exe
  C:\Windows\System\UkbSuxz.exe
  2⤵
  PID:5140
- C:\Windows\System\zXIzGuv.exe
  C:\Windows\System\zXIzGuv.exe
  2⤵
  PID:5156
- C:\Windows\System\pNoDTee.exe
  C:\Windows\System\pNoDTee.exe
  2⤵
  PID:5172
- C:\Windows\System\OcWNzzh.exe
  C:\Windows\System\OcWNzzh.exe
  2⤵
  PID:5188
- C:\Windows\System\cbAkcJe.exe
  C:\Windows\System\cbAkcJe.exe
  2⤵
  PID:5204
- C:\Windows\System\JTqmuUb.exe
  C:\Windows\System\JTqmuUb.exe
  2⤵
  PID:5224
- C:\Windows\System\VKNftbu.exe
  C:\Windows\System\VKNftbu.exe
  2⤵
  PID:5248
- C:\Windows\System\okYpZZC.exe
  C:\Windows\System\okYpZZC.exe
  2⤵
  PID:5276
- C:\Windows\System\hWiTMXv.exe
  C:\Windows\System\hWiTMXv.exe
  2⤵
  PID:5336
- C:\Windows\System\rBxQglR.exe
  C:\Windows\System\rBxQglR.exe
  2⤵
  PID:5352
- C:\Windows\System\baxYnTn.exe
  C:\Windows\System\baxYnTn.exe
  2⤵
  PID:5368
- C:\Windows\System\TwoTdlx.exe
  C:\Windows\System\TwoTdlx.exe
  2⤵
  PID:5384
- C:\Windows\System\miXIGpX.exe
  C:\Windows\System\miXIGpX.exe
  2⤵
  PID:5400
- C:\Windows\System\BiuyJmz.exe
  C:\Windows\System\BiuyJmz.exe
  2⤵
  PID:5416
- C:\Windows\System\jbEukPc.exe
  C:\Windows\System\jbEukPc.exe
  2⤵
  PID:5432
- C:\Windows\System\Jrmgawg.exe
  C:\Windows\System\Jrmgawg.exe
  2⤵
  PID:5452
- C:\Windows\System\NYHjYqC.exe
  C:\Windows\System\NYHjYqC.exe
  2⤵
  PID:5468
- C:\Windows\System\vcrfvCc.exe
  C:\Windows\System\vcrfvCc.exe
  2⤵
  PID:5484
- C:\Windows\System\GqXKTiB.exe
  C:\Windows\System\GqXKTiB.exe
  2⤵
  PID:5504
- C:\Windows\System\NIcbyEo.exe
  C:\Windows\System\NIcbyEo.exe
  2⤵
  PID:5520
- C:\Windows\System\MaiPKqj.exe
  C:\Windows\System\MaiPKqj.exe
  2⤵
  PID:5536
- C:\Windows\System\FynyBkk.exe
  C:\Windows\System\FynyBkk.exe
  2⤵
  PID:5552
- C:\Windows\System\ffvjACK.exe
  C:\Windows\System\ffvjACK.exe
  2⤵
  PID:5568
- C:\Windows\System\KkZZVsX.exe
  C:\Windows\System\KkZZVsX.exe
  2⤵
  PID:5640
- C:\Windows\System\apzuoCo.exe
  C:\Windows\System\apzuoCo.exe
  2⤵
  PID:5656
- C:\Windows\System\OoiMvPw.exe
  C:\Windows\System\OoiMvPw.exe
  2⤵
  PID:5672
- C:\Windows\System\jszFweT.exe
  C:\Windows\System\jszFweT.exe
  2⤵
  PID:5688
- C:\Windows\System\TfCDMCT.exe
  C:\Windows\System\TfCDMCT.exe
  2⤵
  PID:5704
- C:\Windows\System\xPGHDHh.exe
  C:\Windows\System\xPGHDHh.exe
  2⤵
  PID:5724
- C:\Windows\System\jivwjye.exe
  C:\Windows\System\jivwjye.exe
  2⤵
  PID:5740
- C:\Windows\System\uaGwOsn.exe
  C:\Windows\System\uaGwOsn.exe
  2⤵
  PID:5756
- C:\Windows\System\lwlqBGQ.exe
  C:\Windows\System\lwlqBGQ.exe
  2⤵
  PID:5788
- C:\Windows\System\OqeiASg.exe
  C:\Windows\System\OqeiASg.exe
  2⤵
  PID:5804
- C:\Windows\System\VUiDSvC.exe
  C:\Windows\System\VUiDSvC.exe
  2⤵
  PID:5820
- C:\Windows\System\iWAmSln.exe
  C:\Windows\System\iWAmSln.exe
  2⤵
  PID:5836
- C:\Windows\System\UTbMNch.exe
  C:\Windows\System\UTbMNch.exe
  2⤵
  PID:5856
- C:\Windows\System\kjRCjlQ.exe
  C:\Windows\System\kjRCjlQ.exe
  2⤵
  PID:5872
- C:\Windows\System\dweIunm.exe
  C:\Windows\System\dweIunm.exe
  2⤵
  PID:5888
- C:\Windows\System\YaWsHYp.exe
  C:\Windows\System\YaWsHYp.exe
  2⤵
  PID:5908
- C:\Windows\System\hTWNalg.exe
  C:\Windows\System\hTWNalg.exe
  2⤵
  PID:5928
- C:\Windows\System\MBIdXno.exe
  C:\Windows\System\MBIdXno.exe
  2⤵
  PID:5956
- C:\Windows\System\yBOFqdu.exe
  C:\Windows\System\yBOFqdu.exe
  2⤵
  PID:5972
- C:\Windows\System\FLkiaRd.exe
  C:\Windows\System\FLkiaRd.exe
  2⤵
  PID:5992
- C:\Windows\System\MzcWQlX.exe
  C:\Windows\System\MzcWQlX.exe
  2⤵
  PID:6008
- C:\Windows\System\DbASJag.exe
  C:\Windows\System\DbASJag.exe
  2⤵
  PID:6024
- C:\Windows\System\uQkyoNF.exe
  C:\Windows\System\uQkyoNF.exe
  2⤵
  PID:6040
- C:\Windows\System\hEudiAF.exe
  C:\Windows\System\hEudiAF.exe
  2⤵
  PID:6056
- C:\Windows\System\hbZJbaE.exe
  C:\Windows\System\hbZJbaE.exe
  2⤵
  PID:6080
- C:\Windows\System\WecIYNC.exe
  C:\Windows\System\WecIYNC.exe
  2⤵
  PID:6096
- C:\Windows\System\sDzjTJG.exe
  C:\Windows\System\sDzjTJG.exe
  2⤵
  PID:5152
- C:\Windows\System\NxJmuUI.exe
  C:\Windows\System\NxJmuUI.exe
  2⤵
  PID:5212
- C:\Windows\System\vzscazK.exe
  C:\Windows\System\vzscazK.exe
  2⤵
  PID:5200
- C:\Windows\System\mdBWkbH.exe
  C:\Windows\System\mdBWkbH.exe
  2⤵
  PID:5196
- C:\Windows\System\PPjPWTt.exe
  C:\Windows\System\PPjPWTt.exe
  2⤵
  PID:5256
- C:\Windows\System\NUhaQTr.exe
  C:\Windows\System\NUhaQTr.exe
  2⤵
  PID:5284
- C:\Windows\System\yFXmfhJ.exe
  C:\Windows\System\yFXmfhJ.exe
  2⤵
  PID:4504
- C:\Windows\System\VCUPlfd.exe
  C:\Windows\System\VCUPlfd.exe
  2⤵
  PID:5348
- C:\Windows\System\vUXjNoV.exe
  C:\Windows\System\vUXjNoV.exe
  2⤵
  PID:5412
- C:\Windows\System\HzYQqsu.exe
  C:\Windows\System\HzYQqsu.exe
  2⤵
  PID:5476
- C:\Windows\System\LIoEwdA.exe
  C:\Windows\System\LIoEwdA.exe
  2⤵
  PID:5564
- C:\Windows\System\uwQoUur.exe
  C:\Windows\System\uwQoUur.exe
  2⤵
  PID:5396
- C:\Windows\System\HfAfdVT.exe
  C:\Windows\System\HfAfdVT.exe
  2⤵
  PID:5496
- C:\Windows\System\hUgpGkn.exe
  C:\Windows\System\hUgpGkn.exe
  2⤵
  PID:5428
- C:\Windows\System\iKGLpAi.exe
  C:\Windows\System\iKGLpAi.exe
  2⤵
  PID:5548
- C:\Windows\System\cKOVmkJ.exe
  C:\Windows\System\cKOVmkJ.exe
  2⤵
  PID:5596
- C:\Windows\System\ldyDTGc.exe
  C:\Windows\System\ldyDTGc.exe
  2⤵
  PID:5616
- C:\Windows\System\ymgUhkI.exe
  C:\Windows\System\ymgUhkI.exe
  2⤵
  PID:5628
- C:\Windows\System\VWEkaXp.exe
  C:\Windows\System\VWEkaXp.exe
  2⤵
  PID:5732
- C:\Windows\System\RfXURfo.exe
  C:\Windows\System\RfXURfo.exe
  2⤵
  PID:5776
- C:\Windows\System\nEMdUuk.exe
  C:\Windows\System\nEMdUuk.exe
  2⤵
  PID:5848
- C:\Windows\System\YkJEfTj.exe
  C:\Windows\System\YkJEfTj.exe
  2⤵
  PID:5884
- C:\Windows\System\LWvaYsN.exe
  C:\Windows\System\LWvaYsN.exe
  2⤵
  PID:5716
- C:\Windows\System\gOxCjtx.exe
  C:\Windows\System\gOxCjtx.exe
  2⤵
  PID:5828
- C:\Windows\System\ryDzKBL.exe
  C:\Windows\System\ryDzKBL.exe
  2⤵
  PID:5720
- C:\Windows\System\eQqHqPq.exe
  C:\Windows\System\eQqHqPq.exe
  2⤵
  PID:5936
- C:\Windows\System\yePMCiy.exe
  C:\Windows\System\yePMCiy.exe
  2⤵
  PID:6004
- C:\Windows\System\kppehHo.exe
  C:\Windows\System\kppehHo.exe
  2⤵
  PID:6064
- C:\Windows\System\MNtRGJu.exe
  C:\Windows\System\MNtRGJu.exe
  2⤵
  PID:6108
- C:\Windows\System\lqrispA.exe
  C:\Windows\System\lqrispA.exe
  2⤵
  PID:6120
- C:\Windows\System\SaOKNWz.exe
  C:\Windows\System\SaOKNWz.exe
  2⤵
  PID:6016
- C:\Windows\System\eJteWyf.exe
  C:\Windows\System\eJteWyf.exe
  2⤵
  PID:6088
- C:\Windows\System\nUFVrCi.exe
  C:\Windows\System\nUFVrCi.exe
  2⤵
  PID:5952
- C:\Windows\System\tICmvoC.exe
  C:\Windows\System\tICmvoC.exe
  2⤵
  PID:4712
- C:\Windows\System\WVaGSqb.exe
  C:\Windows\System\WVaGSqb.exe
  2⤵
  PID:5164
- C:\Windows\System\Tesjkrr.exe
  C:\Windows\System\Tesjkrr.exe
  2⤵
  PID:5292
- C:\Windows\System\ArsYNYS.exe
  C:\Windows\System\ArsYNYS.exe
  2⤵
  PID:5268
- C:\Windows\System\rPkTcfR.exe
  C:\Windows\System\rPkTcfR.exe
  2⤵
  PID:5312
- C:\Windows\System\VVqWsyz.exe
  C:\Windows\System\VVqWsyz.exe
  2⤵
  PID:5316
- C:\Windows\System\UxWtGab.exe
  C:\Windows\System\UxWtGab.exe
  2⤵
  PID:5380
- C:\Windows\System\sMiabzI.exe
  C:\Windows\System\sMiabzI.exe
  2⤵
  PID:5528
- C:\Windows\System\EyagoZo.exe
  C:\Windows\System\EyagoZo.exe
  2⤵
  PID:5544
- C:\Windows\System\HbTrRge.exe
  C:\Windows\System\HbTrRge.exe
  2⤵
  PID:5768
- C:\Windows\System\ugfLZFS.exe
  C:\Windows\System\ugfLZFS.exe
  2⤵
  PID:5784
- C:\Windows\System\gZKnDfS.exe
  C:\Windows\System\gZKnDfS.exe
  2⤵
  PID:5680
- C:\Windows\System\nCmZqOM.exe
  C:\Windows\System\nCmZqOM.exe
  2⤵
  PID:5712
- C:\Windows\System\RlmXvtw.exe
  C:\Windows\System\RlmXvtw.exe
  2⤵
  PID:5964
- C:\Windows\System\ioUiSeb.exe
  C:\Windows\System\ioUiSeb.exe
  2⤵
  PID:6104
- C:\Windows\System\hjptKtl.exe
  C:\Windows\System\hjptKtl.exe
  2⤵
  PID:5408
- C:\Windows\System\SQJdfsh.exe
  C:\Windows\System\SQJdfsh.exe
  2⤵
  PID:6136
- C:\Windows\System\oVKRdZa.exe
  C:\Windows\System\oVKRdZa.exe
  2⤵
  PID:5168
- C:\Windows\System\GGnptaV.exe
  C:\Windows\System\GGnptaV.exe
  2⤵
  PID:5664
- C:\Windows\System\huEouep.exe
  C:\Windows\System\huEouep.exe
  2⤵
  PID:5948
- C:\Windows\System\yuvEuQo.exe
  C:\Windows\System\yuvEuQo.exe
  2⤵
  PID:5900
- C:\Windows\System\veTQMHU.exe
  C:\Windows\System\veTQMHU.exe
  2⤵
  PID:5296
- C:\Windows\System\COReFce.exe
  C:\Windows\System\COReFce.exe
  2⤵
  PID:5392
- C:\Windows\System\ShcrsBo.exe
  C:\Windows\System\ShcrsBo.exe
  2⤵
  PID:5700
- C:\Windows\System\JAjAqRv.exe
  C:\Windows\System\JAjAqRv.exe
  2⤵
  PID:5832
- C:\Windows\System\KzVatNX.exe
  C:\Windows\System\KzVatNX.exe
  2⤵
  PID:5328
- C:\Windows\System\vzbGHXy.exe
  C:\Windows\System\vzbGHXy.exe
  2⤵
  PID:5652
- C:\Windows\System\MWhXRWz.exe
  C:\Windows\System\MWhXRWz.exe
  2⤵
  PID:5796
- C:\Windows\System\RmJRrzS.exe
  C:\Windows\System\RmJRrzS.exe
  2⤵
  PID:5136
- C:\Windows\System\nppHcoX.exe
  C:\Windows\System\nppHcoX.exe
  2⤵
  PID:6160
- C:\Windows\System\AguDJSQ.exe
  C:\Windows\System\AguDJSQ.exe
  2⤵
  PID:6224
- C:\Windows\System\SgKCejq.exe
  C:\Windows\System\SgKCejq.exe
  2⤵
  PID:6240
- C:\Windows\System\qoxKmMr.exe
  C:\Windows\System\qoxKmMr.exe
  2⤵
  PID:6256
- C:\Windows\System\ZxFPoSG.exe
  C:\Windows\System\ZxFPoSG.exe
  2⤵
  PID:6280
- C:\Windows\System\lhtVkzL.exe
  C:\Windows\System\lhtVkzL.exe
  2⤵
  PID:6300
- C:\Windows\System\YrIWgsv.exe
  C:\Windows\System\YrIWgsv.exe
  2⤵
  PID:6316
- C:\Windows\System\RjhIQfk.exe
  C:\Windows\System\RjhIQfk.exe
  2⤵
  PID:6336
- C:\Windows\System\bEVxmMu.exe
  C:\Windows\System\bEVxmMu.exe
  2⤵
  PID:6352
- C:\Windows\System\WktgbCf.exe
  C:\Windows\System\WktgbCf.exe
  2⤵
  PID:6368
- C:\Windows\System\uLFozhM.exe
  C:\Windows\System\uLFozhM.exe
  2⤵
  PID:6388
- C:\Windows\System\ABuLkTD.exe
  C:\Windows\System\ABuLkTD.exe
  2⤵
  PID:6404
- C:\Windows\System\qDbGHiG.exe
  C:\Windows\System\qDbGHiG.exe
  2⤵
  PID:6420
- C:\Windows\System\AOmqtKh.exe
  C:\Windows\System\AOmqtKh.exe
  2⤵
  PID:6440
- C:\Windows\System\oxYZFwa.exe
  C:\Windows\System\oxYZFwa.exe
  2⤵
  PID:6456
- C:\Windows\System\QMQegLR.exe
  C:\Windows\System\QMQegLR.exe
  2⤵
  PID:6472
- C:\Windows\System\PSuoZjO.exe
  C:\Windows\System\PSuoZjO.exe
  2⤵
  PID:6492
- C:\Windows\System\mZZhEUQ.exe
  C:\Windows\System\mZZhEUQ.exe
  2⤵
  PID:6508
- C:\Windows\System\jauXXKJ.exe
  C:\Windows\System\jauXXKJ.exe
  2⤵
  PID:6524
- C:\Windows\System\AxdhKWo.exe
  C:\Windows\System\AxdhKWo.exe
  2⤵
  PID:6544
- C:\Windows\System\LIXFJub.exe
  C:\Windows\System\LIXFJub.exe
  2⤵
  PID:6564
- C:\Windows\System\LFYCpQt.exe
  C:\Windows\System\LFYCpQt.exe
  2⤵
  PID:6580
- C:\Windows\System\vpFNGvQ.exe
  C:\Windows\System\vpFNGvQ.exe
  2⤵
  PID:6648
- C:\Windows\System\OTMjqqE.exe
  C:\Windows\System\OTMjqqE.exe
  2⤵
  PID:6664
- C:\Windows\System\jWJaZsm.exe
  C:\Windows\System\jWJaZsm.exe
  2⤵
  PID:6680
- C:\Windows\System\emUVesR.exe
  C:\Windows\System\emUVesR.exe
  2⤵
  PID:6700
- C:\Windows\System\HFYtSBJ.exe
  C:\Windows\System\HFYtSBJ.exe
  2⤵
  PID:6716
- C:\Windows\System\mYsAwDk.exe
  C:\Windows\System\mYsAwDk.exe
  2⤵
  PID:6732
- C:\Windows\System\gQmnvKc.exe
  C:\Windows\System\gQmnvKc.exe
  2⤵
  PID:6748
- C:\Windows\System\rqAXftk.exe
  C:\Windows\System\rqAXftk.exe
  2⤵
  PID:6764
- C:\Windows\System\thsNvVz.exe
  C:\Windows\System\thsNvVz.exe
  2⤵
  PID:6784
- C:\Windows\System\lcdWcyN.exe
  C:\Windows\System\lcdWcyN.exe
  2⤵
  PID:6800
- C:\Windows\System\QzEHPQq.exe
  C:\Windows\System\QzEHPQq.exe
  2⤵
  PID:6820
- C:\Windows\System\RLfFeBK.exe
  C:\Windows\System\RLfFeBK.exe
  2⤵
  PID:6836
- C:\Windows\System\sekiuKz.exe
  C:\Windows\System\sekiuKz.exe
  2⤵
  PID:6852
- C:\Windows\System\VZvYvyL.exe
  C:\Windows\System\VZvYvyL.exe
  2⤵
  PID:6872
- C:\Windows\System\ZHnOzak.exe
  C:\Windows\System\ZHnOzak.exe
  2⤵
  PID:6888
- C:\Windows\System\mJzyRsn.exe
  C:\Windows\System\mJzyRsn.exe
  2⤵
  PID:6904
- C:\Windows\System\TrwDFiR.exe
  C:\Windows\System\TrwDFiR.exe
  2⤵
  PID:6924
- C:\Windows\System\ubKXknV.exe
  C:\Windows\System\ubKXknV.exe
  2⤵
  PID:6940
- C:\Windows\System\lxxmOAf.exe
  C:\Windows\System\lxxmOAf.exe
  2⤵
  PID:6960
- C:\Windows\System\AFZJUAU.exe
  C:\Windows\System\AFZJUAU.exe
  2⤵
  PID:6976
- C:\Windows\System\odCuLkv.exe
  C:\Windows\System\odCuLkv.exe
  2⤵
  PID:6992
- C:\Windows\System\pbrTnAR.exe
  C:\Windows\System\pbrTnAR.exe
  2⤵
  PID:7012
- C:\Windows\System\BnEoUgP.exe
  C:\Windows\System\BnEoUgP.exe
  2⤵
  PID:7028
- C:\Windows\System\meSHqva.exe
  C:\Windows\System\meSHqva.exe
  2⤵
  PID:7052
- C:\Windows\System\UtoQHlX.exe
  C:\Windows\System\UtoQHlX.exe
  2⤵
  PID:7084
- C:\Windows\System\cSJXiqO.exe
  C:\Windows\System\cSJXiqO.exe
  2⤵
  PID:7108
- C:\Windows\System\jhdPRZU.exe
  C:\Windows\System\jhdPRZU.exe
  2⤵
  PID:7124
- C:\Windows\System\SLTjWAo.exe
  C:\Windows\System\SLTjWAo.exe
  2⤵
  PID:7140
- C:\Windows\System\GRqWdvU.exe
  C:\Windows\System\GRqWdvU.exe
  2⤵
  PID:7156
- C:\Windows\System\ukjjkEI.exe
  C:\Windows\System\ukjjkEI.exe
  2⤵
  PID:5184
- C:\Windows\System\PUMajBc.exe
  C:\Windows\System\PUMajBc.exe
  2⤵
  PID:6156
- C:\Windows\System\xjarmEO.exe
  C:\Windows\System\xjarmEO.exe
  2⤵
  PID:6192
- C:\Windows\System\ffhQHIp.exe
  C:\Windows\System\ffhQHIp.exe
  2⤵
  PID:5588
- C:\Windows\System\sycpJGQ.exe
  C:\Windows\System\sycpJGQ.exe
  2⤵
  PID:5220
- C:\Windows\System\NDZVUNr.exe
  C:\Windows\System\NDZVUNr.exe
  2⤵
  PID:6036
- C:\Windows\System\nEmQFeB.exe
  C:\Windows\System\nEmQFeB.exe
  2⤵
  PID:6168
- C:\Windows\System\mzDNaxa.exe
  C:\Windows\System\mzDNaxa.exe
  2⤵
  PID:6204
- C:\Windows\System\qfcesVI.exe
  C:\Windows\System\qfcesVI.exe
  2⤵
  PID:6172
- C:\Windows\System\PYGbPAd.exe
  C:\Windows\System\PYGbPAd.exe
  2⤵
  PID:6272
- C:\Windows\System\kZcNRjE.exe
  C:\Windows\System\kZcNRjE.exe
  2⤵
  PID:6344
- C:\Windows\System\cXdWaJH.exe
  C:\Windows\System\cXdWaJH.exe
  2⤵
  PID:6384
- C:\Windows\System\HxACuVA.exe
  C:\Windows\System\HxACuVA.exe
  2⤵
  PID:6480
- C:\Windows\System\iBWQjym.exe
  C:\Windows\System\iBWQjym.exe
  2⤵
  PID:6448
- C:\Windows\System\dmkYGOA.exe
  C:\Windows\System\dmkYGOA.exe
  2⤵
  PID:6484
- C:\Windows\System\xvapMlh.exe
  C:\Windows\System\xvapMlh.exe
  2⤵
  PID:6556
- C:\Windows\System\JSLWBYZ.exe
  C:\Windows\System\JSLWBYZ.exe
  2⤵
  PID:6608
- C:\Windows\System\mqyQUXM.exe
  C:\Windows\System\mqyQUXM.exe
  2⤵
  PID:6616
- C:\Windows\System\dmzAqcG.exe
  C:\Windows\System\dmzAqcG.exe
  2⤵
  PID:6504
- C:\Windows\System\QDMdWXf.exe
  C:\Windows\System\QDMdWXf.exe
  2⤵
  PID:6644
- C:\Windows\System\XlIUlCn.exe
  C:\Windows\System\XlIUlCn.exe
  2⤵
  PID:6712
- C:\Windows\System\mhESDUw.exe
  C:\Windows\System\mhESDUw.exe
  2⤵
  PID:6776
- C:\Windows\System\yiSnxTa.exe
  C:\Windows\System\yiSnxTa.exe
  2⤵
  PID:6912
- C:\Windows\System\CrZAsSP.exe
  C:\Windows\System\CrZAsSP.exe
  2⤵
  PID:6688
- C:\Windows\System\aUpFATo.exe
  C:\Windows\System\aUpFATo.exe
  2⤵
  PID:6360
- C:\Windows\System\EFauleK.exe
  C:\Windows\System\EFauleK.exe
  2⤵
  PID:6536
- C:\Windows\System\zdWOlCf.exe
  C:\Windows\System\zdWOlCf.exe
  2⤵
  PID:6692
- C:\Windows\System\HGcENOW.exe
  C:\Windows\System\HGcENOW.exe
  2⤵
  PID:6756
- C:\Windows\System\iMnFzgE.exe
  C:\Windows\System\iMnFzgE.exe
  2⤵
  PID:6828
- C:\Windows\System\xpbLASl.exe
  C:\Windows\System\xpbLASl.exe
  2⤵
  PID:6896
- C:\Windows\System\OffHBoK.exe
  C:\Windows\System\OffHBoK.exe
  2⤵
  PID:6968
- C:\Windows\System\CgwxtCa.exe
  C:\Windows\System\CgwxtCa.exe
  2⤵
  PID:7036
- C:\Windows\System\XaYctEA.exe
  C:\Windows\System\XaYctEA.exe
  2⤵
  PID:7080
- C:\Windows\System\zrdDkHG.exe
  C:\Windows\System\zrdDkHG.exe
  2⤵
  PID:7100
- C:\Windows\System\qJCXfGV.exe
  C:\Windows\System\qJCXfGV.exe
  2⤵
  PID:7164
- C:\Windows\System\nDWNNeF.exe
  C:\Windows\System\nDWNNeF.exe
  2⤵
  PID:5460
- C:\Windows\System\ztTKmPI.exe
  C:\Windows\System\ztTKmPI.exe
  2⤵
  PID:5696
- C:\Windows\System\jcHpNsI.exe
  C:\Windows\System\jcHpNsI.exe
  2⤵
  PID:5532
- C:\Windows\System\eePOlOz.exe
  C:\Windows\System\eePOlOz.exe
  2⤵
  PID:5648
- C:\Windows\System\ceCOslL.exe
  C:\Windows\System\ceCOslL.exe
  2⤵
  PID:6200
- C:\Windows\System\rbEhEnt.exe
  C:\Windows\System\rbEhEnt.exe
  2⤵
  PID:5984
- C:\Windows\System\RiFPtIh.exe
  C:\Windows\System\RiFPtIh.exe
  2⤵
  PID:5632
- C:\Windows\System\SJaQQTD.exe
  C:\Windows\System\SJaQQTD.exe
  2⤵
  PID:6232
- C:\Windows\System\VVeqkTC.exe
  C:\Windows\System\VVeqkTC.exe
  2⤵
  PID:6252
- C:\Windows\System\YLssNkU.exe
  C:\Windows\System\YLssNkU.exe
  2⤵
  PID:6600
- C:\Windows\System\XuoQbqA.exe
  C:\Windows\System\XuoQbqA.exe
  2⤵
  PID:6708
- C:\Windows\System\UdMeqNP.exe
  C:\Windows\System\UdMeqNP.exe
  2⤵
  PID:6812
- C:\Windows\System\NeNqvir.exe
  C:\Windows\System\NeNqvir.exe
  2⤵
  PID:5332
- C:\Windows\System\RvZlRQn.exe
  C:\Windows\System\RvZlRQn.exe
  2⤵
  PID:6984
- C:\Windows\System\PgkMNMH.exe
  C:\Windows\System\PgkMNMH.exe
  2⤵
  PID:7068
- C:\Windows\System\CtTodZq.exe
  C:\Windows\System\CtTodZq.exe
  2⤵
  PID:6396
- C:\Windows\System\QsoXqzB.exe
  C:\Windows\System\QsoXqzB.exe
  2⤵
  PID:7048
- C:\Windows\System\jImFtgX.exe
  C:\Windows\System\jImFtgX.exe
  2⤵
  PID:6656
- C:\Windows\System\RfptHqS.exe
  C:\Windows\System\RfptHqS.exe
  2⤵
  PID:6760
- C:\Windows\System\rJXezUS.exe
  C:\Windows\System\rJXezUS.exe
  2⤵
  PID:7148
- C:\Windows\System\shJShhp.exe
  C:\Windows\System\shJShhp.exe
  2⤵
  PID:3840
- C:\Windows\System\zplgJTB.exe
  C:\Windows\System\zplgJTB.exe
  2⤵
  PID:5764
- C:\Windows\System\usoynGC.exe
  C:\Windows\System\usoynGC.exe
  2⤵
  PID:6264
- C:\Windows\System\rvfJZex.exe
  C:\Windows\System\rvfJZex.exe
  2⤵
  PID:6596
- C:\Windows\System\GhOlQmC.exe
  C:\Windows\System\GhOlQmC.exe
  2⤵
  PID:6128
- C:\Windows\System\yFlPjYT.exe
  C:\Windows\System\yFlPjYT.exe
  2⤵
  PID:5624
- C:\Windows\System\FLJaJYD.exe
  C:\Windows\System\FLJaJYD.exe
  2⤵
  PID:6308
- C:\Windows\System\gCZleoe.exe
  C:\Windows\System\gCZleoe.exe
  2⤵
  PID:6376
- C:\Windows\System\fgYRzlX.exe
  C:\Windows\System\fgYRzlX.exe
  2⤵
  PID:6416
- C:\Windows\System\DGqAOJm.exe
  C:\Windows\System\DGqAOJm.exe
  2⤵
  PID:6468
- C:\Windows\System\dmNRpnM.exe
  C:\Windows\System\dmNRpnM.exe
  2⤵
  PID:6576
- C:\Windows\System\YCAMtKG.exe
  C:\Windows\System\YCAMtKG.exe
  2⤵
  PID:6772
- C:\Windows\System\XRRRwUL.exe
  C:\Windows\System\XRRRwUL.exe
  2⤵
  PID:6916
- C:\Windows\System\cLNzpKT.exe
  C:\Windows\System\cLNzpKT.exe
  2⤵
  PID:7020
- C:\Windows\System\jScmvbP.exe
  C:\Windows\System\jScmvbP.exe
  2⤵
  PID:6432
- C:\Windows\System\SKeEZrJ.exe
  C:\Windows\System\SKeEZrJ.exe
  2⤵
  PID:6832
- C:\Windows\System\oTgBdVA.exe
  C:\Windows\System\oTgBdVA.exe
  2⤵
  PID:6532
- C:\Windows\System\LcrGuCG.exe
  C:\Windows\System\LcrGuCG.exe
  2⤵
  PID:7072
- C:\Windows\System\vUWmxBM.exe
  C:\Windows\System\vUWmxBM.exe
  2⤵
  PID:7120
- C:\Windows\System\lJublTS.exe
  C:\Windows\System\lJublTS.exe
  2⤵
  PID:5516
- C:\Windows\System\fxNqIyU.exe
  C:\Windows\System\fxNqIyU.exe
  2⤵
  PID:6268
- C:\Windows\System\DIadNwH.exe
  C:\Windows\System\DIadNwH.exe
  2⤵
  PID:5772
- C:\Windows\System\xXMsQJB.exe
  C:\Windows\System\xXMsQJB.exe
  2⤵
  PID:6552
- C:\Windows\System\xfNlxvi.exe
  C:\Windows\System\xfNlxvi.exe
  2⤵
  PID:6628
- C:\Windows\System\oYsjRoH.exe
  C:\Windows\System\oYsjRoH.exe
  2⤵
  PID:6464
- C:\Windows\System\IuuZvQv.exe
  C:\Windows\System\IuuZvQv.exe
  2⤵
  PID:5816
- C:\Windows\System\xsjaYiA.exe
  C:\Windows\System\xsjaYiA.exe
  2⤵
  PID:6400
- C:\Windows\System\hOLOXBO.exe
  C:\Windows\System\hOLOXBO.exe
  2⤵
  PID:7096
- C:\Windows\System\SEfyyhA.exe
  C:\Windows\System\SEfyyhA.exe
  2⤵
  PID:5244
- C:\Windows\System\zAWQWaw.exe
  C:\Windows\System\zAWQWaw.exe
  2⤵
  PID:6844
- C:\Windows\System\NotjKtd.exe
  C:\Windows\System\NotjKtd.exe
  2⤵
  PID:6196
- C:\Windows\System\kgmPVOz.exe
  C:\Windows\System\kgmPVOz.exe
  2⤵
  PID:6972
- C:\Windows\System\SGOAPLh.exe
  C:\Windows\System\SGOAPLh.exe
  2⤵
  PID:6516
- C:\Windows\System\ACmPHOg.exe
  C:\Windows\System\ACmPHOg.exe
  2⤵
  PID:7172
- C:\Windows\System\cPwXNDr.exe
  C:\Windows\System\cPwXNDr.exe
  2⤵
  PID:7188
- C:\Windows\System\nToSEqJ.exe
  C:\Windows\System\nToSEqJ.exe
  2⤵
  PID:7208
- C:\Windows\System\tYAcHSo.exe
  C:\Windows\System\tYAcHSo.exe
  2⤵
  PID:7224
- C:\Windows\System\anqJSbq.exe
  C:\Windows\System\anqJSbq.exe
  2⤵
  PID:7244
- C:\Windows\System\riOCBet.exe
  C:\Windows\System\riOCBet.exe
  2⤵
  PID:7260
- C:\Windows\System\hCtGEVF.exe
  C:\Windows\System\hCtGEVF.exe
  2⤵
  PID:7280
- C:\Windows\System\qhHfubf.exe
  C:\Windows\System\qhHfubf.exe
  2⤵
  PID:7296
- C:\Windows\System\GhxzbWc.exe
  C:\Windows\System\GhxzbWc.exe
  2⤵
  PID:7312
- C:\Windows\System\KFCSsyr.exe
  C:\Windows\System\KFCSsyr.exe
  2⤵
  PID:7328
- C:\Windows\System\yPOQkxF.exe
  C:\Windows\System\yPOQkxF.exe
  2⤵
  PID:7356
- C:\Windows\System\phnjczk.exe
  C:\Windows\System\phnjczk.exe
  2⤵
  PID:7416
- C:\Windows\System\qIabLGJ.exe
  C:\Windows\System\qIabLGJ.exe
  2⤵
  PID:7432
- C:\Windows\System\kRYQLtl.exe
  C:\Windows\System\kRYQLtl.exe
  2⤵
  PID:7448
- C:\Windows\System\ZKpgKmD.exe
  C:\Windows\System\ZKpgKmD.exe
  2⤵
  PID:7464
- C:\Windows\System\JCGKJdc.exe
  C:\Windows\System\JCGKJdc.exe
  2⤵
  PID:7480
- C:\Windows\System\oDtZWMO.exe
  C:\Windows\System\oDtZWMO.exe
  2⤵
  PID:7496
- C:\Windows\System\MtDUXAK.exe
  C:\Windows\System\MtDUXAK.exe
  2⤵
  PID:7516
- C:\Windows\System\tWVIPer.exe
  C:\Windows\System\tWVIPer.exe
  2⤵
  PID:7536
- C:\Windows\System\oJYZvji.exe
  C:\Windows\System\oJYZvji.exe
  2⤵
  PID:7560
- C:\Windows\System\aSNjCZh.exe
  C:\Windows\System\aSNjCZh.exe
  2⤵
  PID:7584
- C:\Windows\System\SUmHOlr.exe
  C:\Windows\System\SUmHOlr.exe
  2⤵
  PID:7600
- C:\Windows\System\AuRIyEt.exe
  C:\Windows\System\AuRIyEt.exe
  2⤵
  PID:7620
- C:\Windows\System\KAIquWQ.exe
  C:\Windows\System\KAIquWQ.exe
  2⤵
  PID:7640
- C:\Windows\System\XYRaanP.exe
  C:\Windows\System\XYRaanP.exe
  2⤵
  PID:7660
- C:\Windows\System\IqcqcND.exe
  C:\Windows\System\IqcqcND.exe
  2⤵
  PID:7720
- C:\Windows\System\isGZcmx.exe
  C:\Windows\System\isGZcmx.exe
  2⤵
  PID:7740
- C:\Windows\System\ngrpgZj.exe
  C:\Windows\System\ngrpgZj.exe
  2⤵
  PID:7764
- C:\Windows\System\nFXwLgO.exe
  C:\Windows\System\nFXwLgO.exe
  2⤵
  PID:7784
- C:\Windows\System\njDDmgh.exe
  C:\Windows\System\njDDmgh.exe
  2⤵
  PID:7800
- C:\Windows\System\IZttefO.exe
  C:\Windows\System\IZttefO.exe
  2⤵
  PID:7820
- C:\Windows\System\MnFBCST.exe
  C:\Windows\System\MnFBCST.exe
  2⤵
  PID:7840
- C:\Windows\System\BmVtCPF.exe
  C:\Windows\System\BmVtCPF.exe
  2⤵
  PID:7860
- C:\Windows\System\ScEJbjG.exe
  C:\Windows\System\ScEJbjG.exe
  2⤵
  PID:7884
- C:\Windows\System\lqlejUN.exe
  C:\Windows\System\lqlejUN.exe
  2⤵
  PID:7912
- C:\Windows\System\vBQYRVj.exe
  C:\Windows\System\vBQYRVj.exe
  2⤵
  PID:7980
- C:\Windows\System\wNTDEQx.exe
  C:\Windows\System\wNTDEQx.exe
  2⤵
  PID:7996
- C:\Windows\System\jjeogLq.exe
  C:\Windows\System\jjeogLq.exe
  2⤵
  PID:8012
- C:\Windows\System\UhHFTqK.exe
  C:\Windows\System\UhHFTqK.exe
  2⤵
  PID:8028
- C:\Windows\System\ZitwrHJ.exe
  C:\Windows\System\ZitwrHJ.exe
  2⤵
  PID:8048
- C:\Windows\System\QDkhEdo.exe
  C:\Windows\System\QDkhEdo.exe
  2⤵
  PID:8064
- C:\Windows\System\ZtnQPDC.exe
  C:\Windows\System\ZtnQPDC.exe
  2⤵
  PID:8080
- C:\Windows\System\MXaQrZO.exe
  C:\Windows\System\MXaQrZO.exe
  2⤵
  PID:8100
- C:\Windows\System\XSaQyir.exe
  C:\Windows\System\XSaQyir.exe
  2⤵
  PID:8116
- C:\Windows\System\egZaOUz.exe
  C:\Windows\System\egZaOUz.exe
  2⤵
  PID:8132
- C:\Windows\System\nIhWddt.exe
  C:\Windows\System\nIhWddt.exe
  2⤵
  PID:8184
- C:\Windows\System\xZSAReX.exe
  C:\Windows\System\xZSAReX.exe
  2⤵
  PID:7076
- C:\Windows\System\ttfBYxJ.exe
  C:\Windows\System\ttfBYxJ.exe
  2⤵
  PID:6808
- C:\Windows\System\gnPGyGX.exe
  C:\Windows\System\gnPGyGX.exe
  2⤵
  PID:7064
- C:\Windows\System\ORipsQQ.exe
  C:\Windows\System\ORipsQQ.exe
  2⤵
  PID:7320
- C:\Windows\System\LEeZTbf.exe
  C:\Windows\System\LEeZTbf.exe
  2⤵
  PID:6500
- C:\Windows\System\FzFbfyX.exe
  C:\Windows\System\FzFbfyX.exe
  2⤵
  PID:7236
- C:\Windows\System\CPbkoat.exe
  C:\Windows\System\CPbkoat.exe
  2⤵
  PID:7276
- C:\Windows\System\EQkjtHb.exe
  C:\Windows\System\EQkjtHb.exe
  2⤵
  PID:7204
- C:\Windows\System\nJFnLHB.exe
  C:\Windows\System\nJFnLHB.exe
  2⤵
  PID:7336
- C:\Windows\System\kXMjsyx.exe
  C:\Windows\System\kXMjsyx.exe
  2⤵
  PID:7428
- C:\Windows\System\PYbzrIx.exe
  C:\Windows\System\PYbzrIx.exe
  2⤵
  PID:7460
- C:\Windows\System\XqjBhsV.exe
  C:\Windows\System\XqjBhsV.exe
  2⤵
  PID:7488
- C:\Windows\System\mgUnLnl.exe
  C:\Windows\System\mgUnLnl.exe
  2⤵
  PID:7476
- C:\Windows\System\vFrcaoL.exe
  C:\Windows\System\vFrcaoL.exe
  2⤵
  PID:7456
- C:\Windows\System\zuNCApO.exe
  C:\Windows\System\zuNCApO.exe
  2⤵
  PID:7512
- C:\Windows\System\YpYytxG.exe
  C:\Windows\System\YpYytxG.exe
  2⤵
  PID:7608
- C:\Windows\System\QKqQsnO.exe
  C:\Windows\System\QKqQsnO.exe
  2⤵
  PID:7532
- C:\Windows\System\zrNWpsX.exe
  C:\Windows\System\zrNWpsX.exe
  2⤵
  PID:7684
- C:\Windows\System\TCpPBuA.exe
  C:\Windows\System\TCpPBuA.exe
  2⤵
  PID:7700
- C:\Windows\System\feKUxKb.exe
  C:\Windows\System\feKUxKb.exe
  2⤵
  PID:7728
- C:\Windows\System\fLXhhXW.exe
  C:\Windows\System\fLXhhXW.exe
  2⤵
  PID:7776
- C:\Windows\System\SGAxUoP.exe
  C:\Windows\System\SGAxUoP.exe
  2⤵
  PID:7816
- C:\Windows\System\FXpGOoo.exe
  C:\Windows\System\FXpGOoo.exe
  2⤵
  PID:7920
- C:\Windows\System\WFSUBtb.exe
  C:\Windows\System\WFSUBtb.exe
  2⤵
  PID:7752
- C:\Windows\System\DlbizkV.exe
  C:\Windows\System\DlbizkV.exe
  2⤵
  PID:7796
- C:\Windows\System\OkwrCfP.exe
  C:\Windows\System\OkwrCfP.exe
  2⤵
  PID:7876
- C:\Windows\System\NvThkFY.exe
  C:\Windows\System\NvThkFY.exe
  2⤵
  PID:7856
- C:\Windows\System\LoXOxTd.exe
  C:\Windows\System\LoXOxTd.exe
  2⤵
  PID:7940
- C:\Windows\System\uvMEjLx.exe
  C:\Windows\System\uvMEjLx.exe
  2⤵
  PID:7956
- C:\Windows\System\hafDsOk.exe
  C:\Windows\System\hafDsOk.exe
  2⤵
  PID:7976
- C:\Windows\System\YzoNQck.exe
  C:\Windows\System\YzoNQck.exe
  2⤵
  PID:8008
- C:\Windows\System\SPiJlxV.exe
  C:\Windows\System\SPiJlxV.exe
  2⤵
  PID:8108
- C:\Windows\System\qmHwjfU.exe
  C:\Windows\System\qmHwjfU.exe
  2⤵
  PID:8092
- C:\Windows\System\jbflhJd.exe
  C:\Windows\System\jbflhJd.exe
  2⤵
  PID:8024
- C:\Windows\System\iVEkQQT.exe
  C:\Windows\System\iVEkQQT.exe
  2⤵
  PID:8148
- C:\Windows\System\VPdOzOq.exe
  C:\Windows\System\VPdOzOq.exe
  2⤵
  PID:8164
- C:\Windows\System\eulDhcC.exe
  C:\Windows\System\eulDhcC.exe
  2⤵
  PID:7368
- C:\Windows\System\NZFwaKg.exe
  C:\Windows\System\NZFwaKg.exe
  2⤵
  PID:7376
- C:\Windows\System\HBDIEkn.exe
  C:\Windows\System\HBDIEkn.exe
  2⤵
  PID:7308
- C:\Windows\System\mnICUno.exe
  C:\Windows\System\mnICUno.exe
  2⤵
  PID:7388
- C:\Windows\System\sUVjwhh.exe
  C:\Windows\System\sUVjwhh.exe
  2⤵
  PID:7412
- C:\Windows\System\ZVAclXc.exe
  C:\Windows\System\ZVAclXc.exe
  2⤵
  PID:7444
- C:\Windows\System\BvXCtNm.exe
  C:\Windows\System\BvXCtNm.exe
  2⤵
  PID:7628
- C:\Windows\System\zcINjHF.exe
  C:\Windows\System\zcINjHF.exe
  2⤵
  PID:7580
- C:\Windows\System\MdOORnI.exe
  C:\Windows\System\MdOORnI.exe
  2⤵
  PID:7596
- C:\Windows\System\dFubOSD.exe
  C:\Windows\System\dFubOSD.exe
  2⤵
  PID:7404
- C:\Windows\System\mpbsxKv.exe
  C:\Windows\System\mpbsxKv.exe
  2⤵
  PID:7904
- C:\Windows\System\NtuYYPz.exe
  C:\Windows\System\NtuYYPz.exe
  2⤵
  PID:7872
- C:\Windows\System\UpzoKHv.exe
  C:\Windows\System\UpzoKHv.exe
  2⤵
  PID:7968
- C:\Windows\System\qSPPxcV.exe
  C:\Windows\System\qSPPxcV.exe
  2⤵
  PID:7732
- C:\Windows\System\ptDBQmN.exe
  C:\Windows\System\ptDBQmN.exe
  2⤵
  PID:7712
- C:\Windows\System\QFkJbBc.exe
  C:\Windows\System\QFkJbBc.exe
  2⤵
  PID:6624
- C:\Windows\System\IylrYLU.exe
  C:\Windows\System\IylrYLU.exe
  2⤵
  PID:7256
- C:\Windows\System\XZJgQmt.exe
  C:\Windows\System\XZJgQmt.exe
  2⤵
  PID:7772
- C:\Windows\System\kNqIWzg.exe
  C:\Windows\System\kNqIWzg.exe
  2⤵
  PID:8144
- C:\Windows\System\mFeyJzp.exe
  C:\Windows\System\mFeyJzp.exe
  2⤵
  PID:8128
- C:\Windows\System\fYgpwGX.exe
  C:\Windows\System\fYgpwGX.exe
  2⤵
  PID:7952
- C:\Windows\System\ciynKSH.exe
  C:\Windows\System\ciynKSH.exe
  2⤵
  PID:7232
- C:\Windows\System\GNPkopt.exe
  C:\Windows\System\GNPkopt.exe
  2⤵
  PID:7372
- C:\Windows\System\IovtKpB.exe
  C:\Windows\System\IovtKpB.exe
  2⤵
  PID:4444
- C:\Windows\System\IHDrAjm.exe
  C:\Windows\System\IHDrAjm.exe
  2⤵
  PID:7632
- C:\Windows\System\ssebMSE.exe
  C:\Windows\System\ssebMSE.exe
  2⤵
  PID:7708
- C:\Windows\System\HElGghg.exe
  C:\Windows\System\HElGghg.exe
  2⤵
  PID:7808
- C:\Windows\System\THgtKsk.exe
  C:\Windows\System\THgtKsk.exe
  2⤵
  PID:7836
- C:\Windows\System\djKGaXj.exe
  C:\Windows\System\djKGaXj.exe
  2⤵
  PID:7736
- C:\Windows\System\UefAdlZ.exe
  C:\Windows\System\UefAdlZ.exe
  2⤵
  PID:8180
- C:\Windows\System\HBJEIXn.exe
  C:\Windows\System\HBJEIXn.exe
  2⤵
  PID:8124
- C:\Windows\System\iNKaXxL.exe
  C:\Windows\System\iNKaXxL.exe
  2⤵
  PID:7200
- C:\Windows\System\qkDdNII.exe
  C:\Windows\System\qkDdNII.exe
  2⤵
  PID:7908
- C:\Windows\System\aBcNiss.exe
  C:\Windows\System\aBcNiss.exe
  2⤵
  PID:7928
- C:\Windows\System\gOwNwWw.exe
  C:\Windows\System\gOwNwWw.exe
  2⤵
  PID:7396
- C:\Windows\System\ZqehYqE.exe
  C:\Windows\System\ZqehYqE.exe
  2⤵
  PID:7472
- C:\Windows\System\gHRjDVO.exe
  C:\Windows\System\gHRjDVO.exe
  2⤵
  PID:7492
- C:\Windows\System\lRdTZNX.exe
  C:\Windows\System\lRdTZNX.exe
  2⤵
  PID:7944
- C:\Windows\System\jEBxhtC.exe
  C:\Windows\System\jEBxhtC.exe
  2⤵
  PID:7504
- C:\Windows\System\QwzZyDs.exe
  C:\Windows\System\QwzZyDs.exe
  2⤵
  PID:8156
- C:\Windows\System\QrPTFsn.exe
  C:\Windows\System\QrPTFsn.exe
  2⤵
  PID:7964
- C:\Windows\System\TGVPyGQ.exe
  C:\Windows\System\TGVPyGQ.exe
  2⤵
  PID:6848
- C:\Windows\System\ZpjYCaW.exe
  C:\Windows\System\ZpjYCaW.exe
  2⤵
  PID:8200
- C:\Windows\System\AcIhOFi.exe
  C:\Windows\System\AcIhOFi.exe
  2⤵
  PID:8264
- C:\Windows\System\IhFyZKG.exe
  C:\Windows\System\IhFyZKG.exe
  2⤵
  PID:8284
- C:\Windows\System\YeGcqRp.exe
  C:\Windows\System\YeGcqRp.exe
  2⤵
  PID:8300
- C:\Windows\System\yohaldU.exe
  C:\Windows\System\yohaldU.exe
  2⤵
  PID:8320
- C:\Windows\System\VwnbFIn.exe
  C:\Windows\System\VwnbFIn.exe
  2⤵
  PID:8340
- C:\Windows\System\EJgrRje.exe
  C:\Windows\System\EJgrRje.exe
  2⤵
  PID:8356
- C:\Windows\System\lIzLrMR.exe
  C:\Windows\System\lIzLrMR.exe
  2⤵
  PID:8372
- C:\Windows\System\eYLcCYh.exe
  C:\Windows\System\eYLcCYh.exe
  2⤵
  PID:8388
- C:\Windows\System\tWpVgJC.exe
  C:\Windows\System\tWpVgJC.exe
  2⤵
  PID:8404
- C:\Windows\System\wQsizFU.exe
  C:\Windows\System\wQsizFU.exe
  2⤵
  PID:8424
- C:\Windows\System\rNDPUwL.exe
  C:\Windows\System\rNDPUwL.exe
  2⤵
  PID:8440
- C:\Windows\System\eyTGDvf.exe
  C:\Windows\System\eyTGDvf.exe
  2⤵
  PID:8464
- C:\Windows\System\YbYAbiS.exe
  C:\Windows\System\YbYAbiS.exe
  2⤵
  PID:8480
- C:\Windows\System\CKXGNdc.exe
  C:\Windows\System\CKXGNdc.exe
  2⤵
  PID:8496
- C:\Windows\System\sUavFnO.exe
  C:\Windows\System\sUavFnO.exe
  2⤵
  PID:8516
- C:\Windows\System\dByslXU.exe
  C:\Windows\System\dByslXU.exe
  2⤵
  PID:8532
- C:\Windows\System\kIVKUZx.exe
  C:\Windows\System\kIVKUZx.exe
  2⤵
  PID:8552
- C:\Windows\System\KPEssTm.exe
  C:\Windows\System\KPEssTm.exe
  2⤵
  PID:8568
- C:\Windows\System\uWCgjpJ.exe
  C:\Windows\System\uWCgjpJ.exe
  2⤵
  PID:8584
- C:\Windows\System\lyhaMJD.exe
  C:\Windows\System\lyhaMJD.exe
  2⤵
  PID:8600
- C:\Windows\System\xuuBCOj.exe
  C:\Windows\System\xuuBCOj.exe
  2⤵
  PID:8616
- C:\Windows\System\rLblqDw.exe
  C:\Windows\System\rLblqDw.exe
  2⤵
  PID:8636
- C:\Windows\System\oVWlNjb.exe
  C:\Windows\System\oVWlNjb.exe
  2⤵
  PID:8652
- C:\Windows\System\OcsFelb.exe
  C:\Windows\System\OcsFelb.exe
  2⤵
  PID:8672
- C:\Windows\System\HtNYomm.exe
  C:\Windows\System\HtNYomm.exe
  2⤵
  PID:8688
- C:\Windows\System\iHNPpsT.exe
  C:\Windows\System\iHNPpsT.exe
  2⤵
  PID:8708
- C:\Windows\System\sHuCmgQ.exe
  C:\Windows\System\sHuCmgQ.exe
  2⤵
  PID:8724
- C:\Windows\System\bAuEHbx.exe
  C:\Windows\System\bAuEHbx.exe
  2⤵
  PID:8744
- C:\Windows\System\duEqqQN.exe
  C:\Windows\System\duEqqQN.exe
  2⤵
  PID:8852
- C:\Windows\System\WAjJtlW.exe
  C:\Windows\System\WAjJtlW.exe
  2⤵
  PID:8868
- C:\Windows\System\aqFWJcN.exe
  C:\Windows\System\aqFWJcN.exe
  2⤵
  PID:8884
- C:\Windows\System\HiXWwiu.exe
  C:\Windows\System\HiXWwiu.exe
  2⤵
  PID:8900
- C:\Windows\System\nRPJUll.exe
  C:\Windows\System\nRPJUll.exe
  2⤵
  PID:8916
- C:\Windows\System\fNchXZu.exe
  C:\Windows\System\fNchXZu.exe
  2⤵
  PID:8932
- C:\Windows\System\vkjMnZG.exe
  C:\Windows\System\vkjMnZG.exe
  2⤵
  PID:8948
- C:\Windows\System\YWusCKU.exe
  C:\Windows\System\YWusCKU.exe
  2⤵
  PID:8964
- C:\Windows\System\BxrnwCc.exe
  C:\Windows\System\BxrnwCc.exe
  2⤵
  PID:8984
- C:\Windows\System\XRvrvtO.exe
  C:\Windows\System\XRvrvtO.exe
  2⤵
  PID:9000
- C:\Windows\System\StKESWJ.exe
  C:\Windows\System\StKESWJ.exe
  2⤵
  PID:9016
- C:\Windows\System\jqwPhHl.exe
  C:\Windows\System\jqwPhHl.exe
  2⤵
  PID:9032
- C:\Windows\System\qVDGxzX.exe
  C:\Windows\System\qVDGxzX.exe
  2⤵
  PID:9052
- C:\Windows\System\FnVaehS.exe
  C:\Windows\System\FnVaehS.exe
  2⤵
  PID:9072
- C:\Windows\System\bICsYFJ.exe
  C:\Windows\System\bICsYFJ.exe
  2⤵
  PID:9088
- C:\Windows\System\paLfnOy.exe
  C:\Windows\System\paLfnOy.exe
  2⤵
  PID:9108
- C:\Windows\System\ejsLqRG.exe
  C:\Windows\System\ejsLqRG.exe
  2⤵
  PID:9124
- C:\Windows\System\dIlqjxV.exe
  C:\Windows\System\dIlqjxV.exe
  2⤵
  PID:9140
- C:\Windows\System\RmJMzEz.exe
  C:\Windows\System\RmJMzEz.exe
  2⤵
  PID:9156
- C:\Windows\System\XNVoSTD.exe
  C:\Windows\System\XNVoSTD.exe
  2⤵
  PID:8208
- C:\Windows\System\jVBbtaq.exe
  C:\Windows\System\jVBbtaq.exe
  2⤵
  PID:7184
- C:\Windows\System\hRRlIWJ.exe
  C:\Windows\System\hRRlIWJ.exe
  2⤵
  PID:7424
- C:\Windows\System\PAdOxlB.exe
  C:\Windows\System\PAdOxlB.exe
  2⤵
  PID:7288
- C:\Windows\System\iVxGOsf.exe
  C:\Windows\System\iVxGOsf.exe
  2⤵
  PID:8232
- C:\Windows\System\OONUUYT.exe
  C:\Windows\System\OONUUYT.exe
  2⤵
  PID:8252
- C:\Windows\System\hKetRFg.exe
  C:\Windows\System\hKetRFg.exe
  2⤵
  PID:8260
- C:\Windows\System\RnbkaDy.exe
  C:\Windows\System\RnbkaDy.exe
  2⤵
  PID:7556
- C:\Windows\System\kFdrNkE.exe
  C:\Windows\System\kFdrNkE.exe
  2⤵
  PID:8336
- C:\Windows\System\SnpaFgl.exe
  C:\Windows\System\SnpaFgl.exe
  2⤵
  PID:8432
- C:\Windows\System\fyVMzVg.exe
  C:\Windows\System\fyVMzVg.exe
  2⤵
  PID:8608
- C:\Windows\System\accSirF.exe
  C:\Windows\System\accSirF.exe
  2⤵
  PID:8308
- C:\Windows\System\Amxtbdf.exe
  C:\Windows\System\Amxtbdf.exe
  2⤵
  PID:8380
- C:\Windows\System\naqmsto.exe
  C:\Windows\System\naqmsto.exe
  2⤵
  PID:8448
- C:\Windows\System\uJTSSJd.exe
  C:\Windows\System\uJTSSJd.exe
  2⤵
  PID:8644
- C:\Windows\System\tjgDEFu.exe
  C:\Windows\System\tjgDEFu.exe
  2⤵
  PID:8544
- C:\Windows\System\ZsoIyZr.exe
  C:\Windows\System\ZsoIyZr.exe
  2⤵
  PID:8632
- C:\Windows\System\BtOzCaW.exe
  C:\Windows\System\BtOzCaW.exe
  2⤵
  PID:8668
- C:\Windows\System\iTsBKQk.exe
  C:\Windows\System\iTsBKQk.exe
  2⤵
  PID:8704
- C:\Windows\System\SXIERDK.exe
  C:\Windows\System\SXIERDK.exe
  2⤵
  PID:8768
- C:\Windows\System\TEnxklz.exe
  C:\Windows\System\TEnxklz.exe
  2⤵
  PID:8784
- C:\Windows\System\drIQnsa.exe
  C:\Windows\System\drIQnsa.exe
  2⤵
  PID:8800
- C:\Windows\System\xZmVgYT.exe
  C:\Windows\System\xZmVgYT.exe
  2⤵
  PID:8824
- C:\Windows\System\KDFnyGX.exe
  C:\Windows\System\KDFnyGX.exe
  2⤵
  PID:8844
- C:\Windows\System\eIwLvJL.exe
  C:\Windows\System\eIwLvJL.exe
  2⤵
  PID:8860
- C:\Windows\System\dRcxRtI.exe
  C:\Windows\System\dRcxRtI.exe
  2⤵
  PID:8944
- C:\Windows\System\nndxnlH.exe
  C:\Windows\System\nndxnlH.exe
  2⤵
  PID:9044
- C:\Windows\System\gEnSBEm.exe
  C:\Windows\System\gEnSBEm.exe
  2⤵
  PID:9152
- C:\Windows\System\HIImtWe.exe
  C:\Windows\System\HIImtWe.exe
  2⤵
  PID:9064
- C:\Windows\System\miMypbj.exe
  C:\Windows\System\miMypbj.exe
  2⤵
  PID:9176
- C:\Windows\System\oywoqIr.exe
  C:\Windows\System\oywoqIr.exe
  2⤵
  PID:8956
- C:\Windows\System\uKeUrSu.exe
  C:\Windows\System\uKeUrSu.exe
  2⤵
  PID:9028
- C:\Windows\System\gkDkwtG.exe
  C:\Windows\System\gkDkwtG.exe
  2⤵
  PID:9200
- C:\Windows\System\zyvuvCp.exe
  C:\Windows\System\zyvuvCp.exe
  2⤵
  PID:8152
- C:\Windows\System\FrRlKxf.exe
  C:\Windows\System\FrRlKxf.exe
  2⤵
  PID:9172
- C:\Windows\System\NgTVYqp.exe
  C:\Windows\System\NgTVYqp.exe
  2⤵
  PID:8228
- C:\Windows\System\kxMkKmL.exe
  C:\Windows\System\kxMkKmL.exe
  2⤵
  PID:7392
- C:\Windows\System\ElXuXUy.exe
  C:\Windows\System\ElXuXUy.exe
  2⤵
  PID:8416
- C:\Windows\System\drnKRub.exe
  C:\Windows\System\drnKRub.exe
  2⤵
  PID:8368
- C:\Windows\System\LVurSBV.exe
  C:\Windows\System\LVurSBV.exe
  2⤵
  PID:8436
- C:\Windows\System\MwNbxks.exe
  C:\Windows\System\MwNbxks.exe
  2⤵
  PID:8684
- C:\Windows\System\QlPYDVz.exe
  C:\Windows\System\QlPYDVz.exe
  2⤵
  PID:8296
- C:\Windows\System\HFllUtu.exe
  C:\Windows\System\HFllUtu.exe
  2⤵
  PID:8460
- C:\Windows\System\LEOypYX.exe
  C:\Windows\System\LEOypYX.exe
  2⤵
  PID:8740
- C:\Windows\System\GIziICI.exe
  C:\Windows\System\GIziICI.exe
  2⤵
  PID:8764
- C:\Windows\System\WMbkmnm.exe
  C:\Windows\System\WMbkmnm.exe
  2⤵
  PID:8576
- C:\Windows\System\wJLUrGE.exe
  C:\Windows\System\wJLUrGE.exe
  2⤵
  PID:8940
- C:\Windows\System\GHvvhBk.exe
  C:\Windows\System\GHvvhBk.exe
  2⤵
  PID:8700
- C:\Windows\System\zDOIDcu.exe
  C:\Windows\System\zDOIDcu.exe
  2⤵
  PID:8596
- C:\Windows\System\SfCAjQH.exe
  C:\Windows\System\SfCAjQH.exe
  2⤵
  PID:8812
- C:\Windows\System\oKxDESf.exe
  C:\Windows\System\oKxDESf.exe
  2⤵
  PID:8864
- C:\Windows\System\OtEIUjr.exe
  C:\Windows\System\OtEIUjr.exe
  2⤵
  PID:8980
- C:\Windows\System\ZmviuWD.exe
  C:\Windows\System\ZmviuWD.exe
  2⤵
  PID:8892
- C:\Windows\System\BKiRStl.exe
  C:\Windows\System\BKiRStl.exe
  2⤵
  PID:9148
- C:\Windows\System\HOCetEU.exe
  C:\Windows\System\HOCetEU.exe
  2⤵
  PID:9188
- C:\Windows\System\PdSueTz.exe
  C:\Windows\System\PdSueTz.exe
  2⤵
  PID:8996
- C:\Windows\System\YGRnMSM.exe
  C:\Windows\System\YGRnMSM.exe
  2⤵
  PID:9136
- C:\Windows\System\zjdODHl.exe
  C:\Windows\System\zjdODHl.exe
  2⤵
  PID:9208
- C:\Windows\System\dymNNuj.exe
  C:\Windows\System\dymNNuj.exe
  2⤵
  PID:8224
- C:\Windows\System\DQvUcXK.exe
  C:\Windows\System\DQvUcXK.exe
  2⤵
  PID:7892
- C:\Windows\System\ggaFUGb.exe
  C:\Windows\System\ggaFUGb.exe
  2⤵
  PID:8220
- C:\Windows\System\WGsWCTh.exe
  C:\Windows\System\WGsWCTh.exe
  2⤵
  PID:8512
- C:\Windows\System\zYMrtoU.exe
  C:\Windows\System\zYMrtoU.exe
  2⤵
  PID:8472
- C:\Windows\System\sgYaTdH.exe
  C:\Windows\System\sgYaTdH.exe
  2⤵
  PID:8332
- C:\Windows\System\SGsrIYw.exe
  C:\Windows\System\SGsrIYw.exe
  2⤵
  PID:8488
- C:\Windows\System\FJXRKln.exe
  C:\Windows\System\FJXRKln.exe
  2⤵
  PID:8560
- C:\Windows\System\zoUZfzE.exe
  C:\Windows\System\zoUZfzE.exe
  2⤵
  PID:8776
- C:\Windows\System\mJwbruh.exe
  C:\Windows\System\mJwbruh.exe
  2⤵
  PID:9008
- C:\Windows\System\xeqjtAH.exe
  C:\Windows\System\xeqjtAH.exe
  2⤵
  PID:8624
- C:\Windows\System\sTADspo.exe
  C:\Windows\System\sTADspo.exe
  2⤵
  PID:9116
- C:\Windows\System\VjDzzmE.exe
  C:\Windows\System\VjDzzmE.exe
  2⤵
  PID:9168
- C:\Windows\System\nWhRjNC.exe
  C:\Windows\System\nWhRjNC.exe
  2⤵
  PID:9196
- C:\Windows\System\kYqyvMy.exe
  C:\Windows\System\kYqyvMy.exe
  2⤵
  PID:8248
- C:\Windows\System\rCurlLC.exe
  C:\Windows\System\rCurlLC.exe
  2⤵
  PID:8316
- C:\Windows\System\VsBKsXA.exe
  C:\Windows\System\VsBKsXA.exe
  2⤵
  PID:8612
- C:\Windows\System\oaoFAWG.exe
  C:\Windows\System\oaoFAWG.exe
  2⤵
  PID:8780
- C:\Windows\System\RCfNHuE.exe
  C:\Windows\System\RCfNHuE.exe
  2⤵
  PID:8456
- C:\Windows\System\RgpMGJS.exe
  C:\Windows\System\RgpMGJS.exe
  2⤵
  PID:8276
- C:\Windows\System\ceJYuPv.exe
  C:\Windows\System\ceJYuPv.exe
  2⤵
  PID:8992
- C:\Windows\System\SkiQtPm.exe
  C:\Windows\System\SkiQtPm.exe
  2⤵
  PID:7384
- C:\Windows\System\YvtFtiP.exe
  C:\Windows\System\YvtFtiP.exe
  2⤵
  PID:8216
- C:\Windows\System\CQmkIOF.exe
  C:\Windows\System\CQmkIOF.exe
  2⤵
  PID:7220
- C:\Windows\System\mSjhvIE.exe
  C:\Windows\System\mSjhvIE.exe
  2⤵
  PID:8792
- C:\Windows\System\JOwwbke.exe
  C:\Windows\System\JOwwbke.exe
  2⤵
  PID:9232
- C:\Windows\System\fHTeBZZ.exe
  C:\Windows\System\fHTeBZZ.exe
  2⤵
  PID:9256
- C:\Windows\System\kGxRpNC.exe
  C:\Windows\System\kGxRpNC.exe
  2⤵
  PID:9308
- C:\Windows\System\kTmtRVD.exe
  C:\Windows\System\kTmtRVD.exe
  2⤵
  PID:9492
- C:\Windows\System\zxcbevA.exe
  C:\Windows\System\zxcbevA.exe
  2⤵
  PID:9512
- C:\Windows\System\FQSjdFq.exe
  C:\Windows\System\FQSjdFq.exe
  2⤵
  PID:9528
- C:\Windows\System\GrOIFlG.exe
  C:\Windows\System\GrOIFlG.exe
  2⤵
  PID:9548
- C:\Windows\System\tftEIrd.exe
  C:\Windows\System\tftEIrd.exe
  2⤵
  PID:9564
- C:\Windows\System\uVhMtZh.exe
  C:\Windows\System\uVhMtZh.exe
  2⤵
  PID:9580
- C:\Windows\System\AMvCaoE.exe
  C:\Windows\System\AMvCaoE.exe
  2⤵
  PID:9600
- C:\Windows\System\MdEunOb.exe
  C:\Windows\System\MdEunOb.exe
  2⤵
  PID:9616
- C:\Windows\System\yNqNpeC.exe
  C:\Windows\System\yNqNpeC.exe
  2⤵
  PID:9636
- C:\Windows\System\rEJHRsj.exe
  C:\Windows\System\rEJHRsj.exe
  2⤵
  PID:9672
- C:\Windows\System\WYUJXQy.exe
  C:\Windows\System\WYUJXQy.exe
  2⤵
  PID:9692
- C:\Windows\System\TrdArLd.exe
  C:\Windows\System\TrdArLd.exe
  2⤵
  PID:9708
- C:\Windows\System\mQewJip.exe
  C:\Windows\System\mQewJip.exe
  2⤵
  PID:9724
- C:\Windows\System\ZMNqACt.exe
  C:\Windows\System\ZMNqACt.exe
  2⤵
  PID:9740
- C:\Windows\System\MKYUvDn.exe
  C:\Windows\System\MKYUvDn.exe
  2⤵
  PID:9756
- C:\Windows\System\GMgXcgK.exe
  C:\Windows\System\GMgXcgK.exe
  2⤵
  PID:9772
- C:\Windows\System\fUpmfho.exe
  C:\Windows\System\fUpmfho.exe
  2⤵
  PID:9788
- C:\Windows\System\IaPmKGr.exe
  C:\Windows\System\IaPmKGr.exe
  2⤵
  PID:9804
- C:\Windows\System\EDtnNhL.exe
  C:\Windows\System\EDtnNhL.exe
  2⤵
  PID:9820
- C:\Windows\System\GzfExoQ.exe
  C:\Windows\System\GzfExoQ.exe
  2⤵
  PID:9836
- C:\Windows\System\aDZfvYD.exe
  C:\Windows\System\aDZfvYD.exe
  2⤵
  PID:9852
- C:\Windows\System\EjDyzde.exe
  C:\Windows\System\EjDyzde.exe
  2⤵
  PID:9868
- C:\Windows\System\yJRIvdC.exe
  C:\Windows\System\yJRIvdC.exe
  2⤵
  PID:9884
- C:\Windows\System\VSqzLrZ.exe
  C:\Windows\System\VSqzLrZ.exe
  2⤵
  PID:9900
- C:\Windows\System\DEQaEsS.exe
  C:\Windows\System\DEQaEsS.exe
  2⤵
  PID:9916
- C:\Windows\System\klJZtEI.exe
  C:\Windows\System\klJZtEI.exe
  2⤵
  PID:9932
- C:\Windows\System\pIhDwgA.exe
  C:\Windows\System\pIhDwgA.exe
  2⤵
  PID:9948
- C:\Windows\System\KcSnBGR.exe
  C:\Windows\System\KcSnBGR.exe
  2⤵
  PID:9964
- C:\Windows\System\wXuJatN.exe
  C:\Windows\System\wXuJatN.exe
  2⤵
  PID:9980
- C:\Windows\System\NrOYvIY.exe
  C:\Windows\System\NrOYvIY.exe
  2⤵
  PID:10000
- C:\Windows\System\CvlrVam.exe
  C:\Windows\System\CvlrVam.exe
  2⤵
  PID:10016
- C:\Windows\System\PrZFcuM.exe
  C:\Windows\System\PrZFcuM.exe
  2⤵
  PID:10032
- C:\Windows\System\XeDAlbW.exe
  C:\Windows\System\XeDAlbW.exe
  2⤵
  PID:10048
- C:\Windows\System\eKauyeS.exe
  C:\Windows\System\eKauyeS.exe
  2⤵
  PID:10064
- C:\Windows\System\siSsUCJ.exe
  C:\Windows\System\siSsUCJ.exe
  2⤵
  PID:10080
- C:\Windows\System\kciBVbr.exe
  C:\Windows\System\kciBVbr.exe
  2⤵
  PID:10100
- C:\Windows\System\YCKVsQB.exe
  C:\Windows\System\YCKVsQB.exe
  2⤵
  PID:10116
- C:\Windows\System\nfRULaT.exe
  C:\Windows\System\nfRULaT.exe
  2⤵
  PID:10132
- C:\Windows\System\gBeiEbH.exe
  C:\Windows\System\gBeiEbH.exe
  2⤵
  PID:10152
- C:\Windows\System\ZRgWkAN.exe
  C:\Windows\System\ZRgWkAN.exe
  2⤵
  PID:10168
- C:\Windows\System\hxSYqXC.exe
  C:\Windows\System\hxSYqXC.exe
  2⤵
  PID:10188
- C:\Windows\System\CjPJHPO.exe
  C:\Windows\System\CjPJHPO.exe
  2⤵
  PID:9012
- C:\Windows\System\vEvyPOa.exe
  C:\Windows\System\vEvyPOa.exe
  2⤵
  PID:9320
- C:\Windows\System\yrTVSXl.exe
  C:\Windows\System\yrTVSXl.exe
  2⤵
  PID:9272
- C:\Windows\System\vTiymqx.exe
  C:\Windows\System\vTiymqx.exe
  2⤵
  PID:9288
- C:\Windows\System\eUabIHN.exe
  C:\Windows\System\eUabIHN.exe
  2⤵
  PID:9304
- C:\Windows\System\pepfgVv.exe
  C:\Windows\System\pepfgVv.exe
  2⤵
  PID:9348
- C:\Windows\System\ZAWfOZA.exe
  C:\Windows\System\ZAWfOZA.exe
  2⤵
  PID:9364
- C:\Windows\System\eyRdIvo.exe
  C:\Windows\System\eyRdIvo.exe
  2⤵
  PID:9380
- C:\Windows\System\HQLespY.exe
  C:\Windows\System\HQLespY.exe
  2⤵
  PID:9384
- C:\Windows\System\tsKuFaC.exe
  C:\Windows\System\tsKuFaC.exe
  2⤵
  PID:9424
- C:\Windows\System\FXlKEur.exe
  C:\Windows\System\FXlKEur.exe
  2⤵
  PID:9448
- C:\Windows\System\uWUBxou.exe
  C:\Windows\System\uWUBxou.exe
  2⤵
  PID:9464
- C:\Windows\System\Deiyqtb.exe
  C:\Windows\System\Deiyqtb.exe
  2⤵
  PID:9504
- C:\Windows\System\XEKTBnk.exe
  C:\Windows\System\XEKTBnk.exe
  2⤵
  PID:9544
- C:\Windows\System\BOwcxLy.exe
  C:\Windows\System\BOwcxLy.exe
  2⤵
  PID:9612
- C:\Windows\System\ggxpkJc.exe
  C:\Windows\System\ggxpkJc.exe
  2⤵
  PID:9488
- C:\Windows\System\pZgyoDP.exe
  C:\Windows\System\pZgyoDP.exe
  2⤵
  PID:9656
- C:\Windows\System\OvmfKxv.exe
  C:\Windows\System\OvmfKxv.exe
  2⤵
  PID:9520
- C:\Windows\System\kmvolXl.exe
  C:\Windows\System\kmvolXl.exe
  2⤵
  PID:9648
- C:\Windows\System\qkdzCNR.exe
  C:\Windows\System\qkdzCNR.exe
  2⤵
  PID:9560
- C:\Windows\System\ZfWXUeT.exe
  C:\Windows\System\ZfWXUeT.exe
  2⤵
  PID:9704
- C:\Windows\System\xbEjuJQ.exe
  C:\Windows\System\xbEjuJQ.exe
  2⤵
  PID:9768
- C:\Windows\System\uFOnHJD.exe
  C:\Windows\System\uFOnHJD.exe
  2⤵
  PID:9832
- C:\Windows\System\qfsVdqq.exe
  C:\Windows\System\qfsVdqq.exe
  2⤵
  PID:9752
- C:\Windows\System\aMyleVq.exe
  C:\Windows\System\aMyleVq.exe
  2⤵
  PID:9688
- C:\Windows\System\WNzYDWQ.exe
  C:\Windows\System\WNzYDWQ.exe
  2⤵
  PID:9880
- C:\Windows\System\jWBHTZH.exe
  C:\Windows\System\jWBHTZH.exe
  2⤵
  PID:9784
- C:\Windows\System\dWFshSU.exe
  C:\Windows\System\dWFshSU.exe
  2⤵
  PID:9928
- C:\Windows\System\REoFjas.exe
  C:\Windows\System\REoFjas.exe
  2⤵
  PID:9972
- C:\Windows\System\OyUEBfO.exe
  C:\Windows\System\OyUEBfO.exe
  2⤵
  PID:9988
- C:\Windows\System\cdMvnQI.exe
  C:\Windows\System\cdMvnQI.exe
  2⤵
  PID:10028
- C:\Windows\System\smmWLlk.exe
  C:\Windows\System\smmWLlk.exe
  2⤵
  PID:10124
- C:\Windows\System\ynDCzLa.exe
  C:\Windows\System\ynDCzLa.exe
  2⤵
  PID:10184
- C:\Windows\System\CPxzmmX.exe
  C:\Windows\System\CPxzmmX.exe
  2⤵
  PID:10144
- C:\Windows\System\TGSyvLo.exe
  C:\Windows\System\TGSyvLo.exe
  2⤵
  PID:10076
- C:\Windows\System\SUWYsUM.exe
  C:\Windows\System\SUWYsUM.exe
  2⤵
  PID:10208
- C:\Windows\System\eelWOzg.exe
  C:\Windows\System\eelWOzg.exe
  2⤵
  PID:10232
- C:\Windows\System\FlBIfUS.exe
  C:\Windows\System\FlBIfUS.exe
  2⤵
  PID:9192
- C:\Windows\System\CjkqCvg.exe
  C:\Windows\System\CjkqCvg.exe
  2⤵
  PID:8476
- C:\Windows\System\qQYFEoa.exe
  C:\Windows\System\qQYFEoa.exe
  2⤵
  PID:9328
- C:\Windows\System\YeuKUJk.exe
  C:\Windows\System\YeuKUJk.exe
  2⤵
  PID:9300
- C:\Windows\System\TnJsCgw.exe
  C:\Windows\System\TnJsCgw.exe
  2⤵
  PID:9408
- C:\Windows\System\FTdUxfo.exe
  C:\Windows\System\FTdUxfo.exe
  2⤵
  PID:9468
- C:\Windows\System\UmQTfRq.exe
  C:\Windows\System\UmQTfRq.exe
  2⤵
  PID:9456
- C:\Windows\System\lbGZAKM.exe
  C:\Windows\System\lbGZAKM.exe
  2⤵
  PID:9316
- C:\Windows\System\CEhQpQE.exe
  C:\Windows\System\CEhQpQE.exe
  2⤵
  PID:9284
- C:\Windows\System\igYPhOZ.exe
  C:\Windows\System\igYPhOZ.exe
  2⤵
  PID:9372
- C:\Windows\System\PVeTDWH.exe
  C:\Windows\System\PVeTDWH.exe
  2⤵
  PID:9608
- C:\Windows\System\paKAutH.exe
  C:\Windows\System\paKAutH.exe
  2⤵
  PID:9844
- C:\Windows\System\WGAwMKw.exe
  C:\Windows\System\WGAwMKw.exe
  2⤵
  PID:9720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CokhBmk.exe

Filesize
1.6MB

MD5
9586fe7b3a3d5c2decec6c9fb6c3d503

SHA1
1228cdef84ba83b855f842dfd62d0b9e485e210a

SHA256
7cc2aa4bf910a3f95e23d2b15b72b23b45574302d006696298290d4bba907e72

SHA512
ac1bf2d4269a4f81aef67ebd4c42a0734445f8d820aaed2bfa01fc2e402393669906788a612f491fa94e8b916ab805ebb2f79fe8fb0bdd464784ee07b76734fd

Download Submit
C:\Windows\system\CpswekY.exe

Filesize
1.6MB

MD5
7a1c330f7c3746936e25661e5e23505b

SHA1
3121bf3f5caa1019456d76235c3aa268c181d667

SHA256
ac0a00f8e0d1cba4d42df20207b8a5a16962929f7347bacb9f147aa6d4983759

SHA512
56845cd8cbe5a0e272e108d99cbe5d7c48ff6c6f721bb7babaa69bcb37fbf07f71a1eb57021759a40a554f12272dd2e3c7bcba8d12cb087bf06879ba793f44ff

Download Submit
C:\Windows\system\FGOJrbd.exe

Filesize
1.6MB

MD5
a213062dd95d1f5a41a809ce6e1a2f59

SHA1
8a2e517b9433a5c812d69619c752e2e8fe192a28

SHA256
5eea3705579bb1c6cd32de1b0f45bc83aa315fa53e931455e9dfc99fe900c54b

SHA512
f7ac6ed504ef7f7cb5f71a5d2ac3049de67691f227384f34b0bf1316a3b83ce5555970e2467f97fcc2c9166f62133a68ffcd1e05b14b3e64c32858be10855a08

Download Submit
C:\Windows\system\GQuGTyh.exe

Filesize
1.6MB

MD5
e9679ebd615a0c58f01045af734ac26b

SHA1
f734e1cd4879c09baba5288d8e2318a3cc208ffe

SHA256
98396940d242683a6d44423f790a93db193fa62537c8cdbb1a1c0715022f9f20

SHA512
22142d6244385cfd290985eeae763bc4e2839b4b59b62d9e2d3aa80b4a264f8c283c20ffc596f13c42a0f22f1ac50f268a8abd40f3e9fbc472ef2f3a47279fcc

Download Submit
C:\Windows\system\KzujpAc.exe

Filesize
1.6MB

MD5
afee5b0e63077c989b2ec1cee4c23bf1

SHA1
cb230fdc4e13bed7d2f028ee4f7bc0d189754ab6

SHA256
3315f91dd27f2ad2cdb336e0261971722a6e3692cc21379fdb75c1adcf98caa4

SHA512
1dafa7ec78e396ce3bf66a0a2193c7d7a561f3f9d712c024ac37f51e0c0c9a97a4794afe1cd1f2cc4ceb4aadf2b2e2178518e0f4d2b9c1abac63446bdab9ecbd

Download Submit
C:\Windows\system\Lbdaubf.exe

Filesize
1.6MB

MD5
40473235a4b7ed161ac48ecd136fea4a

SHA1
ba77a140a23dad0e1d1d0d997ac23f00adbf3048

SHA256
7242fff6ccc1a210f18473d55099d8f826a804f211d34d504b95f8780f248138

SHA512
b9100bd28715a81e52d1293ecb1a06fd7c0557c577775501e9c437b9bdeab10cd407422a46bf028aa17f02c357f74d1c2202c7af51f9f3ee3945e6aa5baf6366

Download Submit
C:\Windows\system\NbHNEyP.exe

Filesize
1.6MB

MD5
3f9f08f6b9cce65d308bb56127a3b5ef

SHA1
f70977b08c90922eb5d51f98d2e408aa6fccff55

SHA256
244c5f723c90d8b5aa0b5de4ac39050278ff13799eb6e731c73de8e56ff8a413

SHA512
388b283fbc38b5f84348557b3ea79744e9c12b948993e02720e3d6402639c0014067ea1b41102fd9d6904bc8d6b0032bbeaa03bbd7c564cf5c5c4348bc5016fa

Download Submit
C:\Windows\system\OiXfYfU.exe

Filesize
1.6MB

MD5
a8b79d42ea22b012a24d6725bfefd09f

SHA1
7c9fb228af7e57e88c77efc2bf32fdf7a1774622

SHA256
e430ab12080ebcfaf8df4ebb34cb0f238a2d11d1f0cb5facb038f350f630b81f

SHA512
3ce739afa728e0f10125b74cc23197b11a4dbf37fba675d6610515e03c69c0039354b676446c8db0a4d45680df5c6df4c4b643c294d9e0fc0e0eb46279196549

Download Submit
C:\Windows\system\OoxCUQX.exe

Filesize
1.6MB

MD5
da4be2cf5cf253469924016469135368

SHA1
933cb4ecfccd1b6b4a0d909c231750ef990ab2df

SHA256
c3ec9212693dd2ee9b2152e80800ecf2f5af77e7261368f6d19bacb2f2035f31

SHA512
45b697a8599f7579a909ec30364073a236d2f1dac043166459377310a307979f0150512321746ef597bef621ea6f9a00cbb65e77f76edf5a9f10f567e898b1a0

Download Submit
C:\Windows\system\RfRCsXK.exe

Filesize
1.6MB

MD5
28e19e43851bec0eda39d3403d3ed370

SHA1
73652d730b3880ca47f397ae223030c619103869

SHA256
f798119c7a93d6222ddcaaa3c58417940cd570ab2fe8c3b080233e3405e5cd64

SHA512
2687a27e5a5ae3c9f17f29c0ffff2791abc8c92b10647a243856ec64bc1dc12586d173d4f5d5ed554b4cd1ce60365b5f7b8b137d3914d648ccccf9186de7d45b

Download Submit
C:\Windows\system\TDWnZAG.exe

Filesize
1.6MB

MD5
32481f13ff8d11cf90eeca642c26c26a

SHA1
3167adb32401432982bec70135d9c0e0292d2bad

SHA256
d137c3f3ab79feb97482be8aca4f60b44278b42cd738694e73dc6aa057bf9403

SHA512
9289d5fbc4832bfeb2c965ca1e2a42a8909fdfb9159f651d8e526e1797eb224e3af0acf5609d1b3268c935f4e56deb6f5c0f217435f9ebeb73cf2911a12caa9c

Download Submit
C:\Windows\system\TZQGDlG.exe

Filesize
1.6MB

MD5
d3379309e1f7537356f7ff0215d10f96

SHA1
58c3c23f96205f080f9bff755f39df82f3e2bfaf

SHA256
8d2e0fc400cb63b62820f10bcd402d6ac69c4a42e3e2b979d116651c493dc072

SHA512
f9bcefd4b13cbad2f204be9dea90c8b10c6340cb056817144b1c2ad90743245d83e1ee227d8ff71ef6f64d8e872aaf76ce92e77d3f9bd5f865c8123ba85e0310

Download Submit
C:\Windows\system\UCWoHQW.exe

Filesize
1.6MB

MD5
536362beb7ab8b0560575b862ab9a89b

SHA1
b2044b4d479a5674be64908b69e60bc10c173d20

SHA256
901816ecf471bac88de6163792812d23053514b3330afde93274fe78e7a59395

SHA512
27ebc703914e8d18795f87e42014bfd6a6fcf016001e9d261f451adfc31cdde0d9da1fa4cf3042c2a1174575d6574ca483044247ef49655cb79b983f9708febb

Download Submit
C:\Windows\system\UYUpOxv.exe

Filesize
1.6MB

MD5
cc97b3f7786864fad35b26495333b869

SHA1
f659fbcbb746da17fc1ce11930387367f0be49dc

SHA256
eff3be0d11eef50068b80f4e6267d1af06970d83f48c32e1df488cfee770caac

SHA512
8c4345dde71cc743229bec406633d29cfbd0672a3944c3aac029f19b531c93295ff827fe12aeb573e75a28fbe6f0c4c13036ffb5dc8b0bfc90decdadfaee68a1

Download Submit
C:\Windows\system\ZJIkFWV.exe

Filesize
1.6MB

MD5
fcb96fc6862100d211ba3a205c072d0e

SHA1
994c98ee8877bd32a4dc27b2b2fc9b5cd3a4d417

SHA256
162f3b219dbe5221b5ef553cf8619503fdf51545d918154547d400ba6f0cb68f

SHA512
91195b3b8a06467e30abdb00176fd7b889fd955ef5fc4765e670896c1c8171954e40a1bf13ad241ae8055c6a6bc850a854a6fbb1308aab8a16e9e4caf1247d5e

Download Submit
C:\Windows\system\cjRevJt.exe

Filesize
1.7MB

MD5
2fff501cbef35001673bdc532cf6be28

SHA1
3e2d4a970ae8c5d5e33045bce4807f11f986c255

SHA256
381f24ceb4c132e58d4ce04b2ea9e0bb5e243005fd031da0977a39fb8f6f75c6

SHA512
928ca5b04792ac536884134b30095f74a07522cc1aac764c4bd1793391f9255dc8fceaae6140f2e9a9ce0ca74fc08e6ae335fc55756a88375761431962966ef6

Download Submit
C:\Windows\system\cqvdmHc.exe

Filesize
1.6MB

MD5
84922065fd6e8d5aba227eb9e70973ab

SHA1
972efb84f3a805dc1f3bc5f37a5034d138226065

SHA256
b569999503b63335815bba84aa8f1bd124fd87795b70b6dfab38d78e60dbb6b5

SHA512
16610daac9d4aaa5155261f6c53dfd5e9ed1296edd310b1e6feb740cb2013de2376b0d992130efe9f48479215bfe2ebb226b9291e6b4b6fee8c1ee36c0f71cb0

Download Submit
C:\Windows\system\fKOmwRh.exe

Filesize
1.6MB

MD5
bb14ca8e204a9b2908f89663711b02a7

SHA1
5b5b2ba582938616aa5fcc301ee7aa9f008a87ee

SHA256
e925021774902af97dc67da7de0e04a2ae3d053228e342610e024f604a26f182

SHA512
764e142809ed79e9d45cf73522d6c28d286f61b0c49379b6f2a4e0ad2bc7d57464386ee2e2a9ca09743e2811d0562bbc21a214c758cc4d96728257bee13e275e

Download Submit
C:\Windows\system\fgujKxB.exe

Filesize
1.6MB

MD5
5bc9c4f206c9e0145e7d3cfc481b1a86

SHA1
21cdcd5bf4bf931fb79666874f1e25fdad559b84

SHA256
e090ef9b8f043d6d44501e68f2b18d7c05e09e0723f29e062ddd53edfec170ee

SHA512
9515dda4e24a45dc1086bd340ab6738cb1b4d511d25e22c5ca243721d80cd0cd036a712de03fdd90f7f9b6143ec7bc9a3f17250bd23f98708e6d160f804f0c24

Download Submit
C:\Windows\system\fsBknSh.exe

Filesize
1.6MB

MD5
2892f904a39cbe8739f299f62267fe96

SHA1
6149ba58302e1a7adc7c3460d6c158ee6bf057d5

SHA256
0883489ea94ea4648c2a9f51794cbed6a25c5096075e61164c398f8dba5afdb5

SHA512
12579901a1c83e18318a772af9cf2fd41aaed0eb3bc3a8d0987dd6bf747605e5a87cce2ab77b10bc5e2cb32d88162f4f3920cc4c71e52507e947ebb73563e077

Download Submit
C:\Windows\system\jrbDpeu.exe

Filesize
1.6MB

MD5
1d655733bc93f5c6adc7c9bf4c5828c7

SHA1
0753db3432ca2a67fad088d2e274075a2dbb30da

SHA256
4fb313277ecc54626337d9a70844990b5f3ff91b51840386125723f6cbf0e598

SHA512
7789597e4a5df029d49e3ef0db3675bfb362626148fe87bdab2fd8236ba512a9b497e3d000ed5d041e89b205ec75aaca889acef487a4bfc0952bf189f788a951

Download Submit
C:\Windows\system\nVRqpsU.exe

Filesize
1.6MB

MD5
1cb8e5bb2606f11d3391210a3fa52606

SHA1
474e07dafd831f22b346ad424fdbc7bbe9355c9e

SHA256
8112bba90db49c0769f60ec1bdf94260bab32d9630fa8b8ad49d686e0c65b03a

SHA512
f3a654286a12cdd25e1466db83a8de23e971ae21365b15d5e1b362054c8f75f2eff636c0dd0a59d9b930529fe776ff8a5ffb7e0802f703242cd061c96d2ad47b

Download Submit
C:\Windows\system\qLYAMFV.exe

Filesize
1.6MB

MD5
564dc26ad6e77ee680b7a80423547c36

SHA1
48d2f7055be312a1334aee60aa037197bdc9ce69

SHA256
3bc82c75854ab23f833415c7919a317008c94ac6083f7ebd92f4c75d21a09e11

SHA512
739f222198d8772db1835dfe6e560a7f91580e8a7ff19b58c57fda2589bc40471d6de066130c21cc24ebe0b7c61ba333e03a73f6f180a5d264b2ce5121c96c0d

Download Submit
C:\Windows\system\rzbESUa.exe

Filesize
1.6MB

MD5
b43775603fa0a4d21361f3c5a7ab4ac7

SHA1
c4e5be20fcc3d73145e8e461110548ccf2fb05a8

SHA256
d3c2099b8ba37099517ee90d4818de3ca59cec7c4db480dab7681d57be4e7883

SHA512
1f65fd40f8a71f59a81c9822ee18a3311324728ceb90f7aa4fd78349da1eda843d22b8a2aeb3bbc19bf20afe8ed16771783e2dc66e0724a2a9fabd1ef1ce50f1

Download Submit
C:\Windows\system\sVGPWHy.exe

Filesize
1.6MB

MD5
e75a8a2df05d844735e01ef915fae6a4

SHA1
516fc9251bf2fb5985b25e04be7ac0b292da8164

SHA256
131440ac71bcd2377b728d96ab9230965c87e886a77141778ae3cf0db3f004d6

SHA512
e469069755f8ee9829a1a39ab6fdbcd656705032c0752fc40e9703b6bf20ea3697eadce395c1f5b3631556d97b5b65c684d49787f8baabba51ed1dfa5deb5271

Download Submit
C:\Windows\system\vucaeRk.exe

Filesize
1.6MB

MD5
84fc6644b4781fb602dd9ec8d60862e3

SHA1
4bb0dabf3d53f34e86f77556e6228712c8b73e77

SHA256
43e9f915fe5c0c2e899f69c630be7af8e55151986817ae545be4313708033ed9

SHA512
fed1ca61efd2e2339f2148cdb6050855596b44c0691b0109ee4f0a8ecb7898654e43fb886553322ead37c013783479df2caaa4b5715acf6acc5cbc87ec5e34d4

Download Submit
C:\Windows\system\zDChVlA.exe

Filesize
1.6MB

MD5
e74f2e848f53cfa703cca26bf22f2137

SHA1
e28b84c180c6dcc9d0c941d7d02f3ad4393390f9

SHA256
52b19a70479151d0c16b886250a44c9bdd78c1875b88882263a32de58197b1f5

SHA512
d8373c3dc493006a6a7c48253c56ee312900174dc6407f8c417912d59945dc99304bdeaff4cc84d0d9b70326395c3cf9cfeec8bcd873cf2367a8f3b00f75a05f

Download Submit
C:\Windows\system\zHoHIAv.exe

Filesize
1.6MB

MD5
af8e92f278c35d9bf07dd3bb1585a98e

SHA1
bba87ab556587bd3d582d295163aa9d39ef0beb6

SHA256
2a4368a977b451f7a63a41b43ce0efb439c4092a37b429a618e5ba07ad11c290

SHA512
c5621f195a65f95d01e60cfb3a089a3d9fa60b9466c06155ee6765cc3dc99e592b5b1dce1dfbce285ddfeef22dc7967ecdf2fec1cc4b2d9a112d0672bd40bb79

Download Submit
\Windows\system\ABJqPoT.exe

Filesize
1.6MB

MD5
39e6ff79bf560ebb79f8aad06528667a

SHA1
d750c46aa75bef79f90aeba055a4d90485116ffe

SHA256
8d3e38fca3b5ec5155fdbc9da0880c16cd12cf961403e6adc564f3144875ac35

SHA512
1a12e86bf349b5e7f96989fb02ae494b6f5a42dd5a29c52c34798ead4c419b97155874db7b7a2b395233d5abfeb3a1335685eaa178f4a9389734fcaaca387e2c

Download Submit
\Windows\system\oDxXeno.exe

Filesize
1.6MB

MD5
e0df66b36c3cb4e5dad8579210514bc9

SHA1
e7c27ed37eeec23753f8e5fa0508108eafba90d5

SHA256
29c490aaa2d478ec5c60957d3548815c8850e86b0552bbed6863f80e447aabb1

SHA512
f5cecd2ec8de1abb4f43196a51ede244313e3f460afc9274314e4c6182debebf62655f1b2d8a524432e2ecd839f286fedd1443dfeda60f0614d64a3864b7c735

Download Submit
\Windows\system\shtdPPR.exe

Filesize
1.6MB

MD5
bd7c6c22123016698544bd00d18b13a4

SHA1
9189b873dda238166fe8a293cead50613e29f1a7

SHA256
7f37e9a0bf80fd46a5f075a54808d1bca9a046aacb0d53ce91dcf33e41ab3ee7

SHA512
a6dbedd0668900346fc3a1f6a7d061ed0bd841f3fd0d64da4c09ea188fc7464b7fc80489fbe4b1d2926780070428194c38539429ca6b202547e3248a1e9b7910

Download Submit
\Windows\system\uktzvoY.exe

Filesize
1.6MB

MD5
8d46feb064395da13c99ad88f21ddc5d

SHA1
a2ffdaabd9787ab0442fd8524af6e7ab06fda2cb

SHA256
8561d13faedac155e72114073d36f1c1cf29ca18fd3c977919a452e2f6eaf096

SHA512
d4b1376ba8819710b8479c1cd181f326c86148d08b85fba95cfebf5d59a230b3cc248c174e1ff97c2a73a8e21e14486fdbaea518e914a272b1434fcd89f4470c

Download Submit
memory/1644-3852-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/1644-141-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/1672-3846-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/1672-128-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1391-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-118-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-52-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-57-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-44-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-12-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-61-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1390-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-145-0x000000013FA00000-0x000000013FD51000-memory.dmp

Filesize
3.3MB

Download
memory/1984-144-0x000000013FA50000-0x000000013FDA1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1065-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-140-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/1984-138-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/1984-752-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-147-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-82-0x000000013FA40000-0x000000013FD91000-memory.dmp

Filesize
3.3MB

Download
memory/1984-0-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-40-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1984-120-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-39-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/1984-36-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2012-41-0x000000013F750000-0x000000013FAA1000-memory.dmp

Filesize
3.3MB

Download
memory/2012-3618-0x000000013F750000-0x000000013FAA1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-3859-0x000000013F3C0000-0x000000013F711000-memory.dmp

Filesize
3.3MB

Download
memory/2140-149-0x000000013F3C0000-0x000000013F711000-memory.dmp

Filesize
3.3MB

Download
memory/2316-31-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2316-3609-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2396-37-0x000000013FA40000-0x000000013FD91000-memory.dmp

Filesize
3.3MB

Download
memory/2396-3612-0x000000013FA40000-0x000000013FD91000-memory.dmp

Filesize
3.3MB

Download
memory/2684-3854-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2684-143-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2708-38-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2708-3616-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-536-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-48-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/2720-3833-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-3847-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-1171-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-60-0x000000013F270000-0x000000013F5C1000-memory.dmp

Filesize
3.3MB

Download
memory/2864-946-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/2864-3842-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/2864-54-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/3040-34-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/3040-3608-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/3064-3614-0x000000013F4E0000-0x000000013F831000-memory.dmp

Filesize
3.3MB

Download
memory/3064-42-0x000000013F4E0000-0x000000013F831000-memory.dmp

Filesize
3.3MB

Download