xmrig | e1df29acb76a31565c4c5afb59e98b99c34cb1dc1fa778984aef0362b3a73e8e

Analysis

max time kernel
120s
max time network
24s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fd8479008ebb7ed0fee27aee9bbea00N.exe
Size

1.3MB
MD5

2fd8479008ebb7ed0fee27aee9bbea00
SHA1

b992500a381bfe21e58437864709742ab19e323b
SHA256

e1df29acb76a31565c4c5afb59e98b99c34cb1dc1fa778984aef0362b3a73e8e
SHA512

9e1af50a2398f6ad2d89f6608b0c66fd8956dbd4c65c670364025af139cbaa971489fdae778f405a7263448557f3a5a100120f1f8c1e2284a563b60c763f7d2a
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727XL1+Ki+4ini/T9UDhCcbm:ROdWCCi7/rahHxH4T9Ma

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral1/memory/2232-36-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/2748-35-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/2604-34-0x000000013FA70000-0x000000013FDC1000-memory.dmp	xmrig
behavioral1/memory/2232-40-0x000000013F180000-0x000000013F4D1000-memory.dmp	xmrig
behavioral1/memory/2232-50-0x0000000001E50000-0x00000000021A1000-memory.dmp	xmrig
behavioral1/memory/2848-47-0x000000013F870000-0x000000013FBC1000-memory.dmp	xmrig
behavioral1/memory/2684-54-0x000000013F0C0000-0x000000013F411000-memory.dmp	xmrig
behavioral1/memory/2944-60-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/2432-61-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/2748-71-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/3016-90-0x000000013F210000-0x000000013F561000-memory.dmp	xmrig
behavioral1/memory/2264-257-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	xmrig
behavioral1/memory/2368-454-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/1720-379-0x000000013F730000-0x000000013FA81000-memory.dmp	xmrig
behavioral1/memory/2232-332-0x000000013F730000-0x000000013FA81000-memory.dmp	xmrig
behavioral1/memory/2104-291-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/1492-175-0x000000013FFC0000-0x0000000140311000-memory.dmp	xmrig
behavioral1/memory/2232-95-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/1152-106-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/2600-81-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2232-87-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2232-86-0x0000000001E50000-0x00000000021A1000-memory.dmp	xmrig
behavioral1/memory/2684-1667-0x000000013F0C0000-0x000000013F411000-memory.dmp	xmrig
behavioral1/memory/2848-1673-0x000000013F870000-0x000000013FBC1000-memory.dmp	xmrig
behavioral1/memory/2944-1694-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/2604-1690-0x000000013FA70000-0x000000013FDC1000-memory.dmp	xmrig
behavioral1/memory/2748-1750-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/2600-1790-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2432-1824-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/1492-1870-0x000000013FFC0000-0x0000000140311000-memory.dmp	xmrig
behavioral1/memory/2104-1884-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2368-2167-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2264-2184-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	xmrig
behavioral1/memory/1152-2189-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/1720-2370-0x000000013F730000-0x000000013FA81000-memory.dmp	xmrig
behavioral1/memory/3016-2525-0x000000013F210000-0x000000013F561000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2848	VrtAGCN.exe
2684	ouiHlIb.exe
2944	cewzIgE.exe
2604	aqIUZJG.exe
2748	lrAiKZZ.exe
2600	uEvwWoQ.exe
3016	IGUohff.exe
2432	oTWeNfS.exe
1152	qOCCwTy.exe
1492	vBWfObi.exe
2264	ysBEGov.exe
2104	eGEVbsx.exe
1720	zilwynA.exe
2368	xWZhqYr.exe
2204	Gkkcqix.exe
1964	JURXIpA.exe
2320	zQSUqjr.exe
2304	luxjrcl.exe
1384	yliBNel.exe
1704	sMNYkgU.exe
2136	PydWQaU.exe
2524	NoZXAQG.exe
2424	SRGWBvt.exe
2988	wdpmYpA.exe
2332	yBRUipW.exe
1608	KrWBAoV.exe
1612	fXrTXEJ.exe
1632	mLnkOOv.exe
712	dgVRclN.exe
2436	YGmuNfI.exe
984	ZUiSzKQ.exe
1328	qbLgFNK.exe
1876	brCLjCw.exe
2384	coKKnXL.exe
292	DWiJCrJ.exe
1284	bQfqnDB.exe
2316	ofJglck.exe
964	YQagtRP.exe
1528	gQcEcDy.exe
2284	bBLIFjr.exe
584	NqDryZL.exe
276	oqjkoFz.exe
2480	tWxBopR.exe
2496	ADzuyvi.exe
320	xtFWHEz.exe
2472	nUekeMP.exe
2416	CwSkwWC.exe
884	aegxgEC.exe
1732	mduXIth.exe
1624	bKfokVm.exe
1488	jkfpEUE.exe
1576	jtbCVwK.exe
1680	bNbvOlr.exe
2772	XmavVLk.exe
2720	cACRKPz.exe
2860	hFQNCnd.exe
2792	YHfuJyb.exe
2876	UtzHYhZ.exe
2744	Xswaaxv.exe
2640	fDXZRAo.exe
2120	FlIwclx.exe
2116	cwDMAoD.exe
1844	tmOqvEo.exe
2080	sQIdIEK.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe
2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x000000013F180000-0x000000013F4D1000-memory.dmp	upx
behavioral1/files/0x000d000000012262-3.dat	upx
behavioral1/memory/2848-8-0x000000013F870000-0x000000013FBC1000-memory.dmp	upx
behavioral1/files/0x0025000000016fea-9.dat	upx
behavioral1/memory/2684-15-0x000000013F0C0000-0x000000013F411000-memory.dmp	upx
behavioral1/files/0x0008000000017116-11.dat	upx
behavioral1/memory/2944-22-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/files/0x0010000000016ff2-26.dat	upx
behavioral1/files/0x0006000000017236-29.dat	upx
behavioral1/memory/2748-35-0x000000013F520000-0x000000013F871000-memory.dmp	upx
behavioral1/memory/2604-34-0x000000013FA70000-0x000000013FDC1000-memory.dmp	upx
behavioral1/files/0x0006000000017415-41.dat	upx
behavioral1/memory/2232-40-0x000000013F180000-0x000000013F4D1000-memory.dmp	upx
behavioral1/memory/2600-43-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/3016-52-0x000000013F210000-0x000000013F561000-memory.dmp	upx
behavioral1/files/0x00080000000174d5-51.dat	upx
behavioral1/memory/2848-47-0x000000013F870000-0x000000013FBC1000-memory.dmp	upx
behavioral1/memory/2684-54-0x000000013F0C0000-0x000000013F411000-memory.dmp	upx
behavioral1/files/0x00020000000178b0-58.dat	upx
behavioral1/memory/2944-60-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/2432-61-0x000000013F540000-0x000000013F891000-memory.dmp	upx
behavioral1/files/0x0005000000018cf2-70.dat	upx
behavioral1/memory/2748-71-0x000000013F520000-0x000000013F871000-memory.dmp	upx
behavioral1/memory/1492-74-0x000000013FFC0000-0x0000000140311000-memory.dmp	upx
behavioral1/memory/1152-66-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/memory/3016-90-0x000000013F210000-0x000000013F561000-memory.dmp	upx
behavioral1/memory/2104-91-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/files/0x0005000000018ddd-102.dat	upx
behavioral1/memory/2368-107-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/files/0x0005000000018e9f-138.dat	upx
behavioral1/files/0x0005000000018ed5-158.dat	upx
behavioral1/files/0x0005000000018f80-189.dat	upx
behavioral1/memory/2264-257-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/memory/2368-454-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/1720-379-0x000000013F730000-0x000000013FA81000-memory.dmp	upx
behavioral1/memory/2104-291-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/files/0x0005000000018f88-199.dat	upx
behavioral1/files/0x0005000000018f84-194.dat	upx
behavioral1/files/0x0005000000018f6e-184.dat	upx
behavioral1/memory/1492-175-0x000000013FFC0000-0x0000000140311000-memory.dmp	upx
behavioral1/files/0x0005000000018f40-179.dat	upx
behavioral1/files/0x0005000000018f2c-173.dat	upx
behavioral1/files/0x0005000000018f08-168.dat	upx
behavioral1/files/0x0005000000018ef7-163.dat	upx
behavioral1/files/0x0005000000018eba-153.dat	upx
behavioral1/files/0x0005000000018eb2-148.dat	upx
behavioral1/files/0x0005000000018ea1-143.dat	upx
behavioral1/files/0x0005000000018e96-133.dat	upx
behavioral1/files/0x0005000000018e46-123.dat	upx
behavioral1/files/0x0005000000018e65-128.dat	upx
behavioral1/files/0x0005000000018dea-113.dat	upx
behavioral1/files/0x0005000000018e25-118.dat	upx
behavioral1/memory/1720-99-0x000000013F730000-0x000000013FA81000-memory.dmp	upx
behavioral1/files/0x0005000000018dcf-98.dat	upx
behavioral1/memory/1152-106-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/memory/2264-82-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/memory/2600-81-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/files/0x0005000000018d02-80.dat	upx
behavioral1/files/0x0005000000018d1e-89.dat	upx
behavioral1/files/0x0005000000018ce8-65.dat	upx
behavioral1/memory/2684-1667-0x000000013F0C0000-0x000000013F411000-memory.dmp	upx
behavioral1/memory/2848-1673-0x000000013F870000-0x000000013FBC1000-memory.dmp	upx
behavioral1/memory/2944-1694-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/2604-1690-0x000000013FA70000-0x000000013FDC1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zilwynA.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\YPLFWuy.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\RUiUDhB.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\NMwZMZK.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\wgPWaYl.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\ZEwJcVH.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\IjjLQge.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\kcWDSDy.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\ZEEqRel.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\UTVGvJI.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\SFwVtLh.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\tEfYBUl.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\mEcxHvj.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\nbUABZy.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\HyhUryL.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\mpWvYWO.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\dapHXrQ.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\AWReTAo.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\WOVDdXe.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\iEdlThg.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\HOxGFlG.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\xArjeJq.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\oKeokHU.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\pSxJXkQ.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\VTCSeFv.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\JuiKjrW.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\jLgvLsj.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\CgPyBRX.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\XSahNyX.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\rUegKlF.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\kOFVtnS.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\HtBCprv.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\XOZRIeN.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\tmOqvEo.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\BxKjNDD.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\tQYObnr.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\ztsPEXR.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\rQgWedJ.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\nvLJSeE.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\gScrMeS.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\KNTasMI.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\FVifydK.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\TqInPgy.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\UWUWNUy.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\rPJxcuk.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\xYuGbjX.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\ukoLDec.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\ePKywRs.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\fsqlkUX.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\RkkRIJS.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\hzooCHX.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\rNZifch.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\dkKoBKk.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\gmWVJYN.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\estvzAa.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\kFZGugs.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\oTWeNfS.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\PydWQaU.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\HmOkpHp.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\WWajeZx.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\eLplnmW.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\HHALEug.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\JURXIpA.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe
File created	C:\Windows\System\eupnfRd.exe	2fd8479008ebb7ed0fee27aee9bbea00N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2848	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	31
PID 2232 wrote to memory of 2848	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	31
PID 2232 wrote to memory of 2848	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	31
PID 2232 wrote to memory of 2684	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	32
PID 2232 wrote to memory of 2684	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	32
PID 2232 wrote to memory of 2684	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	32
PID 2232 wrote to memory of 2944	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	33
PID 2232 wrote to memory of 2944	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	33
PID 2232 wrote to memory of 2944	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	33
PID 2232 wrote to memory of 2604	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	34
PID 2232 wrote to memory of 2604	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	34
PID 2232 wrote to memory of 2604	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	34
PID 2232 wrote to memory of 2748	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	35
PID 2232 wrote to memory of 2748	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	35
PID 2232 wrote to memory of 2748	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	35
PID 2232 wrote to memory of 2600	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	36
PID 2232 wrote to memory of 2600	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	36
PID 2232 wrote to memory of 2600	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	36
PID 2232 wrote to memory of 3016	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	37
PID 2232 wrote to memory of 3016	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	37
PID 2232 wrote to memory of 3016	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	37
PID 2232 wrote to memory of 2432	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	38
PID 2232 wrote to memory of 2432	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	38
PID 2232 wrote to memory of 2432	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	38
PID 2232 wrote to memory of 1152	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	39
PID 2232 wrote to memory of 1152	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	39
PID 2232 wrote to memory of 1152	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	39
PID 2232 wrote to memory of 1492	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	40
PID 2232 wrote to memory of 1492	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	40
PID 2232 wrote to memory of 1492	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	40
PID 2232 wrote to memory of 2264	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	41
PID 2232 wrote to memory of 2264	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	41
PID 2232 wrote to memory of 2264	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	41
PID 2232 wrote to memory of 2104	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	42
PID 2232 wrote to memory of 2104	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	42
PID 2232 wrote to memory of 2104	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	42
PID 2232 wrote to memory of 1720	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	43
PID 2232 wrote to memory of 1720	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	43
PID 2232 wrote to memory of 1720	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	43
PID 2232 wrote to memory of 2368	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	44
PID 2232 wrote to memory of 2368	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	44
PID 2232 wrote to memory of 2368	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	44
PID 2232 wrote to memory of 2204	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	45
PID 2232 wrote to memory of 2204	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	45
PID 2232 wrote to memory of 2204	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	45
PID 2232 wrote to memory of 1964	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	46
PID 2232 wrote to memory of 1964	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	46
PID 2232 wrote to memory of 1964	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	46
PID 2232 wrote to memory of 2320	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	47
PID 2232 wrote to memory of 2320	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	47
PID 2232 wrote to memory of 2320	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	47
PID 2232 wrote to memory of 2304	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	48
PID 2232 wrote to memory of 2304	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	48
PID 2232 wrote to memory of 2304	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	48
PID 2232 wrote to memory of 1384	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	49
PID 2232 wrote to memory of 1384	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	49
PID 2232 wrote to memory of 1384	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	49
PID 2232 wrote to memory of 1704	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	50
PID 2232 wrote to memory of 1704	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	50
PID 2232 wrote to memory of 1704	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	50
PID 2232 wrote to memory of 2136	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	51
PID 2232 wrote to memory of 2136	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	51
PID 2232 wrote to memory of 2136	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	51
PID 2232 wrote to memory of 2524	2232	2fd8479008ebb7ed0fee27aee9bbea00N.exe	52

C:\Users\Admin\AppData\Local\Temp\2fd8479008ebb7ed0fee27aee9bbea00N.exe
"C:\Users\Admin\AppData\Local\Temp\2fd8479008ebb7ed0fee27aee9bbea00N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System\VrtAGCN.exe
  C:\Windows\System\VrtAGCN.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ouiHlIb.exe
  C:\Windows\System\ouiHlIb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\cewzIgE.exe
  C:\Windows\System\cewzIgE.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\aqIUZJG.exe
  C:\Windows\System\aqIUZJG.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lrAiKZZ.exe
  C:\Windows\System\lrAiKZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\uEvwWoQ.exe
  C:\Windows\System\uEvwWoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\IGUohff.exe
  C:\Windows\System\IGUohff.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\oTWeNfS.exe
  C:\Windows\System\oTWeNfS.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qOCCwTy.exe
  C:\Windows\System\qOCCwTy.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\vBWfObi.exe
  C:\Windows\System\vBWfObi.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ysBEGov.exe
  C:\Windows\System\ysBEGov.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\eGEVbsx.exe
  C:\Windows\System\eGEVbsx.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\zilwynA.exe
  C:\Windows\System\zilwynA.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\xWZhqYr.exe
  C:\Windows\System\xWZhqYr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\Gkkcqix.exe
  C:\Windows\System\Gkkcqix.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\JURXIpA.exe
  C:\Windows\System\JURXIpA.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\zQSUqjr.exe
  C:\Windows\System\zQSUqjr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\luxjrcl.exe
  C:\Windows\System\luxjrcl.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\yliBNel.exe
  C:\Windows\System\yliBNel.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\sMNYkgU.exe
  C:\Windows\System\sMNYkgU.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\PydWQaU.exe
  C:\Windows\System\PydWQaU.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\NoZXAQG.exe
  C:\Windows\System\NoZXAQG.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\SRGWBvt.exe
  C:\Windows\System\SRGWBvt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\wdpmYpA.exe
  C:\Windows\System\wdpmYpA.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\yBRUipW.exe
  C:\Windows\System\yBRUipW.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\KrWBAoV.exe
  C:\Windows\System\KrWBAoV.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\fXrTXEJ.exe
  C:\Windows\System\fXrTXEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\mLnkOOv.exe
  C:\Windows\System\mLnkOOv.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\dgVRclN.exe
  C:\Windows\System\dgVRclN.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\YGmuNfI.exe
  C:\Windows\System\YGmuNfI.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ZUiSzKQ.exe
  C:\Windows\System\ZUiSzKQ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\qbLgFNK.exe
  C:\Windows\System\qbLgFNK.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\brCLjCw.exe
  C:\Windows\System\brCLjCw.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\coKKnXL.exe
  C:\Windows\System\coKKnXL.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\DWiJCrJ.exe
  C:\Windows\System\DWiJCrJ.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\bQfqnDB.exe
  C:\Windows\System\bQfqnDB.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\ofJglck.exe
  C:\Windows\System\ofJglck.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\YQagtRP.exe
  C:\Windows\System\YQagtRP.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\gQcEcDy.exe
  C:\Windows\System\gQcEcDy.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\bBLIFjr.exe
  C:\Windows\System\bBLIFjr.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\NqDryZL.exe
  C:\Windows\System\NqDryZL.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\oqjkoFz.exe
  C:\Windows\System\oqjkoFz.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\tWxBopR.exe
  C:\Windows\System\tWxBopR.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\ADzuyvi.exe
  C:\Windows\System\ADzuyvi.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\xtFWHEz.exe
  C:\Windows\System\xtFWHEz.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\nUekeMP.exe
  C:\Windows\System\nUekeMP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\CwSkwWC.exe
  C:\Windows\System\CwSkwWC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\aegxgEC.exe
  C:\Windows\System\aegxgEC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\mduXIth.exe
  C:\Windows\System\mduXIth.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\bKfokVm.exe
  C:\Windows\System\bKfokVm.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\jkfpEUE.exe
  C:\Windows\System\jkfpEUE.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\jtbCVwK.exe
  C:\Windows\System\jtbCVwK.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\bNbvOlr.exe
  C:\Windows\System\bNbvOlr.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\XmavVLk.exe
  C:\Windows\System\XmavVLk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cACRKPz.exe
  C:\Windows\System\cACRKPz.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\hFQNCnd.exe
  C:\Windows\System\hFQNCnd.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\YHfuJyb.exe
  C:\Windows\System\YHfuJyb.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\UtzHYhZ.exe
  C:\Windows\System\UtzHYhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\Xswaaxv.exe
  C:\Windows\System\Xswaaxv.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\fDXZRAo.exe
  C:\Windows\System\fDXZRAo.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\FlIwclx.exe
  C:\Windows\System\FlIwclx.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\cwDMAoD.exe
  C:\Windows\System\cwDMAoD.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\tmOqvEo.exe
  C:\Windows\System\tmOqvEo.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\sQIdIEK.exe
  C:\Windows\System\sQIdIEK.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\MjCCMDR.exe
  C:\Windows\System\MjCCMDR.exe
  2⤵
  PID:1092
- C:\Windows\System\MvLakgX.exe
  C:\Windows\System\MvLakgX.exe
  2⤵
  PID:2676
- C:\Windows\System\uWSrhTB.exe
  C:\Windows\System\uWSrhTB.exe
  2⤵
  PID:2244
- C:\Windows\System\gWMrlOR.exe
  C:\Windows\System\gWMrlOR.exe
  2⤵
  PID:2580
- C:\Windows\System\nidhjrt.exe
  C:\Windows\System\nidhjrt.exe
  2⤵
  PID:524
- C:\Windows\System\AcfQtzA.exe
  C:\Windows\System\AcfQtzA.exe
  2⤵
  PID:2364
- C:\Windows\System\GiWciGp.exe
  C:\Windows\System\GiWciGp.exe
  2⤵
  PID:2512
- C:\Windows\System\gyflump.exe
  C:\Windows\System\gyflump.exe
  2⤵
  PID:3000
- C:\Windows\System\YPLFWuy.exe
  C:\Windows\System\YPLFWuy.exe
  2⤵
  PID:2052
- C:\Windows\System\gUuFjVM.exe
  C:\Windows\System\gUuFjVM.exe
  2⤵
  PID:640
- C:\Windows\System\ssycNnO.exe
  C:\Windows\System\ssycNnO.exe
  2⤵
  PID:1252
- C:\Windows\System\nkfNMba.exe
  C:\Windows\System\nkfNMba.exe
  2⤵
  PID:1820
- C:\Windows\System\klLYIEl.exe
  C:\Windows\System\klLYIEl.exe
  2⤵
  PID:1860
- C:\Windows\System\ZzDVxTO.exe
  C:\Windows\System\ZzDVxTO.exe
  2⤵
  PID:1244
- C:\Windows\System\ujkDilv.exe
  C:\Windows\System\ujkDilv.exe
  2⤵
  PID:832
- C:\Windows\System\UFCIYBu.exe
  C:\Windows\System\UFCIYBu.exe
  2⤵
  PID:656
- C:\Windows\System\hZrzmai.exe
  C:\Windows\System\hZrzmai.exe
  2⤵
  PID:1752
- C:\Windows\System\wBcnreq.exe
  C:\Windows\System\wBcnreq.exe
  2⤵
  PID:2292
- C:\Windows\System\MusosOl.exe
  C:\Windows\System\MusosOl.exe
  2⤵
  PID:1840
- C:\Windows\System\fsqlkUX.exe
  C:\Windows\System\fsqlkUX.exe
  2⤵
  PID:2460
- C:\Windows\System\uDXaBak.exe
  C:\Windows\System\uDXaBak.exe
  2⤵
  PID:560
- C:\Windows\System\imMkMkx.exe
  C:\Windows\System\imMkMkx.exe
  2⤵
  PID:2296
- C:\Windows\System\lbhYFlm.exe
  C:\Windows\System\lbhYFlm.exe
  2⤵
  PID:1688
- C:\Windows\System\bXYZBLv.exe
  C:\Windows\System\bXYZBLv.exe
  2⤵
  PID:2340
- C:\Windows\System\cFvRLXU.exe
  C:\Windows\System\cFvRLXU.exe
  2⤵
  PID:1568
- C:\Windows\System\iEdlThg.exe
  C:\Windows\System\iEdlThg.exe
  2⤵
  PID:2948
- C:\Windows\System\oWjCDza.exe
  C:\Windows\System\oWjCDza.exe
  2⤵
  PID:2068
- C:\Windows\System\wJPnuxA.exe
  C:\Windows\System\wJPnuxA.exe
  2⤵
  PID:2840
- C:\Windows\System\ckeeexD.exe
  C:\Windows\System\ckeeexD.exe
  2⤵
  PID:2172
- C:\Windows\System\plFwfxG.exe
  C:\Windows\System\plFwfxG.exe
  2⤵
  PID:2596
- C:\Windows\System\MtlqFjF.exe
  C:\Windows\System\MtlqFjF.exe
  2⤵
  PID:1208
- C:\Windows\System\uhhZNTY.exe
  C:\Windows\System\uhhZNTY.exe
  2⤵
  PID:2872
- C:\Windows\System\LPhhCFb.exe
  C:\Windows\System\LPhhCFb.exe
  2⤵
  PID:2036
- C:\Windows\System\yPeFpGP.exe
  C:\Windows\System\yPeFpGP.exe
  2⤵
  PID:1708
- C:\Windows\System\LoftKRO.exe
  C:\Windows\System\LoftKRO.exe
  2⤵
  PID:588
- C:\Windows\System\ugovlJO.exe
  C:\Windows\System\ugovlJO.exe
  2⤵
  PID:1960
- C:\Windows\System\iGCyUra.exe
  C:\Windows\System\iGCyUra.exe
  2⤵
  PID:2936
- C:\Windows\System\jZqUeBm.exe
  C:\Windows\System\jZqUeBm.exe
  2⤵
  PID:2700
- C:\Windows\System\ZHuNhyo.exe
  C:\Windows\System\ZHuNhyo.exe
  2⤵
  PID:3036
- C:\Windows\System\RSzvtJp.exe
  C:\Windows\System\RSzvtJp.exe
  2⤵
  PID:780
- C:\Windows\System\myvcFwX.exe
  C:\Windows\System\myvcFwX.exe
  2⤵
  PID:1288
- C:\Windows\System\loAAPsG.exe
  C:\Windows\System\loAAPsG.exe
  2⤵
  PID:1968
- C:\Windows\System\PJGkYdm.exe
  C:\Windows\System\PJGkYdm.exe
  2⤵
  PID:2484
- C:\Windows\System\MxBEKbr.exe
  C:\Windows\System\MxBEKbr.exe
  2⤵
  PID:2064
- C:\Windows\System\wZuysgo.exe
  C:\Windows\System\wZuysgo.exe
  2⤵
  PID:1472
- C:\Windows\System\anTqVbe.exe
  C:\Windows\System\anTqVbe.exe
  2⤵
  PID:1648
- C:\Windows\System\KkbzizE.exe
  C:\Windows\System\KkbzizE.exe
  2⤵
  PID:2056
- C:\Windows\System\BWDcNRK.exe
  C:\Windows\System\BWDcNRK.exe
  2⤵
  PID:2960
- C:\Windows\System\NztJWyG.exe
  C:\Windows\System\NztJWyG.exe
  2⤵
  PID:2796
- C:\Windows\System\njJMfuz.exe
  C:\Windows\System\njJMfuz.exe
  2⤵
  PID:1712
- C:\Windows\System\nLNpqrH.exe
  C:\Windows\System\nLNpqrH.exe
  2⤵
  PID:2776
- C:\Windows\System\oxiiPqE.exe
  C:\Windows\System\oxiiPqE.exe
  2⤵
  PID:2888
- C:\Windows\System\zeuusOZ.exe
  C:\Windows\System\zeuusOZ.exe
  2⤵
  PID:2228
- C:\Windows\System\lobzvxK.exe
  C:\Windows\System\lobzvxK.exe
  2⤵
  PID:1304
- C:\Windows\System\eAQMatU.exe
  C:\Windows\System\eAQMatU.exe
  2⤵
  PID:2300
- C:\Windows\System\aNJxLPo.exe
  C:\Windows\System\aNJxLPo.exe
  2⤵
  PID:1816
- C:\Windows\System\BKhUeIm.exe
  C:\Windows\System\BKhUeIm.exe
  2⤵
  PID:2288
- C:\Windows\System\cnXqwPm.exe
  C:\Windows\System\cnXqwPm.exe
  2⤵
  PID:2864
- C:\Windows\System\IrwrrAF.exe
  C:\Windows\System\IrwrrAF.exe
  2⤵
  PID:1928
- C:\Windows\System\EHGdJDV.exe
  C:\Windows\System\EHGdJDV.exe
  2⤵
  PID:2268
- C:\Windows\System\TLrtRHe.exe
  C:\Windows\System\TLrtRHe.exe
  2⤵
  PID:2884
- C:\Windows\System\kmZTxmp.exe
  C:\Windows\System\kmZTxmp.exe
  2⤵
  PID:2784
- C:\Windows\System\KLvZjbw.exe
  C:\Windows\System\KLvZjbw.exe
  2⤵
  PID:3056
- C:\Windows\System\slnENra.exe
  C:\Windows\System\slnENra.exe
  2⤵
  PID:2528
- C:\Windows\System\wAPLWoz.exe
  C:\Windows\System\wAPLWoz.exe
  2⤵
  PID:2360
- C:\Windows\System\pXhpapq.exe
  C:\Windows\System\pXhpapq.exe
  2⤵
  PID:532
- C:\Windows\System\gntwYVK.exe
  C:\Windows\System\gntwYVK.exe
  2⤵
  PID:1340
- C:\Windows\System\QXXAuqo.exe
  C:\Windows\System\QXXAuqo.exe
  2⤵
  PID:1808
- C:\Windows\System\BCzKDEZ.exe
  C:\Windows\System\BCzKDEZ.exe
  2⤵
  PID:1980
- C:\Windows\System\cqJXzUm.exe
  C:\Windows\System\cqJXzUm.exe
  2⤵
  PID:272
- C:\Windows\System\ezLCjKM.exe
  C:\Windows\System\ezLCjKM.exe
  2⤵
  PID:2516
- C:\Windows\System\BxKjNDD.exe
  C:\Windows\System\BxKjNDD.exe
  2⤵
  PID:1824
- C:\Windows\System\DeHHxYy.exe
  C:\Windows\System\DeHHxYy.exe
  2⤵
  PID:2620
- C:\Windows\System\dGnQudd.exe
  C:\Windows\System\dGnQudd.exe
  2⤵
  PID:1760
- C:\Windows\System\CrPipgk.exe
  C:\Windows\System\CrPipgk.exe
  2⤵
  PID:2532
- C:\Windows\System\uNtJpSR.exe
  C:\Windows\System\uNtJpSR.exe
  2⤵
  PID:1668
- C:\Windows\System\OSOUsie.exe
  C:\Windows\System\OSOUsie.exe
  2⤵
  PID:2868
- C:\Windows\System\XlcgHZF.exe
  C:\Windows\System\XlcgHZF.exe
  2⤵
  PID:1048
- C:\Windows\System\AXrACof.exe
  C:\Windows\System\AXrACof.exe
  2⤵
  PID:2672
- C:\Windows\System\rlxFbjs.exe
  C:\Windows\System\rlxFbjs.exe
  2⤵
  PID:1556
- C:\Windows\System\lEjNuhW.exe
  C:\Windows\System\lEjNuhW.exe
  2⤵
  PID:264
- C:\Windows\System\uzYnBuV.exe
  C:\Windows\System\uzYnBuV.exe
  2⤵
  PID:2952
- C:\Windows\System\KiYMKcI.exe
  C:\Windows\System\KiYMKcI.exe
  2⤵
  PID:3052
- C:\Windows\System\dprFtUn.exe
  C:\Windows\System\dprFtUn.exe
  2⤵
  PID:2636
- C:\Windows\System\pXySXIH.exe
  C:\Windows\System\pXySXIH.exe
  2⤵
  PID:1956
- C:\Windows\System\NBqEBQR.exe
  C:\Windows\System\NBqEBQR.exe
  2⤵
  PID:3004
- C:\Windows\System\ezzQlnd.exe
  C:\Windows\System\ezzQlnd.exe
  2⤵
  PID:2024
- C:\Windows\System\mEQpMaK.exe
  C:\Windows\System\mEQpMaK.exe
  2⤵
  PID:1616
- C:\Windows\System\gSEBhkw.exe
  C:\Windows\System\gSEBhkw.exe
  2⤵
  PID:2456
- C:\Windows\System\TFJWfEv.exe
  C:\Windows\System\TFJWfEv.exe
  2⤵
  PID:2392
- C:\Windows\System\SFwVtLh.exe
  C:\Windows\System\SFwVtLh.exe
  2⤵
  PID:2912
- C:\Windows\System\vfVQWPR.exe
  C:\Windows\System\vfVQWPR.exe
  2⤵
  PID:304
- C:\Windows\System\UwrjOyo.exe
  C:\Windows\System\UwrjOyo.exe
  2⤵
  PID:2092
- C:\Windows\System\ceCdMTh.exe
  C:\Windows\System\ceCdMTh.exe
  2⤵
  PID:932
- C:\Windows\System\WvoQbgY.exe
  C:\Windows\System\WvoQbgY.exe
  2⤵
  PID:3008
- C:\Windows\System\aOFnrPS.exe
  C:\Windows\System\aOFnrPS.exe
  2⤵
  PID:1596
- C:\Windows\System\oRjhSUz.exe
  C:\Windows\System\oRjhSUz.exe
  2⤵
  PID:2124
- C:\Windows\System\cxSNZWB.exe
  C:\Windows\System\cxSNZWB.exe
  2⤵
  PID:3044
- C:\Windows\System\HOxGFlG.exe
  C:\Windows\System\HOxGFlG.exe
  2⤵
  PID:1104
- C:\Windows\System\ffpQonU.exe
  C:\Windows\System\ffpQonU.exe
  2⤵
  PID:2388
- C:\Windows\System\heNVcwD.exe
  C:\Windows\System\heNVcwD.exe
  2⤵
  PID:3088
- C:\Windows\System\QUCWKBn.exe
  C:\Windows\System\QUCWKBn.exe
  2⤵
  PID:3108
- C:\Windows\System\ZzSZSRI.exe
  C:\Windows\System\ZzSZSRI.exe
  2⤵
  PID:3124
- C:\Windows\System\UrEirUC.exe
  C:\Windows\System\UrEirUC.exe
  2⤵
  PID:3184
- C:\Windows\System\dsrHrKw.exe
  C:\Windows\System\dsrHrKw.exe
  2⤵
  PID:3200
- C:\Windows\System\GyVxrcN.exe
  C:\Windows\System\GyVxrcN.exe
  2⤵
  PID:3216
- C:\Windows\System\ORhrJnh.exe
  C:\Windows\System\ORhrJnh.exe
  2⤵
  PID:3232
- C:\Windows\System\GcXtXOG.exe
  C:\Windows\System\GcXtXOG.exe
  2⤵
  PID:3248
- C:\Windows\System\YssazCv.exe
  C:\Windows\System\YssazCv.exe
  2⤵
  PID:3264
- C:\Windows\System\IkkXHKa.exe
  C:\Windows\System\IkkXHKa.exe
  2⤵
  PID:3280
- C:\Windows\System\xtQEQfy.exe
  C:\Windows\System\xtQEQfy.exe
  2⤵
  PID:3304
- C:\Windows\System\cCecFUV.exe
  C:\Windows\System\cCecFUV.exe
  2⤵
  PID:3320
- C:\Windows\System\qTOmQvs.exe
  C:\Windows\System\qTOmQvs.exe
  2⤵
  PID:3368
- C:\Windows\System\kXLBUJW.exe
  C:\Windows\System\kXLBUJW.exe
  2⤵
  PID:3420
- C:\Windows\System\DRLtrUy.exe
  C:\Windows\System\DRLtrUy.exe
  2⤵
  PID:3436
- C:\Windows\System\qrIlWYi.exe
  C:\Windows\System\qrIlWYi.exe
  2⤵
  PID:3456
- C:\Windows\System\aqxkYJa.exe
  C:\Windows\System\aqxkYJa.exe
  2⤵
  PID:3472
- C:\Windows\System\yEKOavo.exe
  C:\Windows\System\yEKOavo.exe
  2⤵
  PID:3488
- C:\Windows\System\uiSFijH.exe
  C:\Windows\System\uiSFijH.exe
  2⤵
  PID:3508
- C:\Windows\System\KjtVxtP.exe
  C:\Windows\System\KjtVxtP.exe
  2⤵
  PID:3540
- C:\Windows\System\JedZwFa.exe
  C:\Windows\System\JedZwFa.exe
  2⤵
  PID:3556
- C:\Windows\System\FMYJWGz.exe
  C:\Windows\System\FMYJWGz.exe
  2⤵
  PID:3576
- C:\Windows\System\lBqNulP.exe
  C:\Windows\System\lBqNulP.exe
  2⤵
  PID:3592
- C:\Windows\System\ORAoFQv.exe
  C:\Windows\System\ORAoFQv.exe
  2⤵
  PID:3608
- C:\Windows\System\sgvbBfj.exe
  C:\Windows\System\sgvbBfj.exe
  2⤵
  PID:3624
- C:\Windows\System\mhSBfrV.exe
  C:\Windows\System\mhSBfrV.exe
  2⤵
  PID:3640
- C:\Windows\System\MuAPPGh.exe
  C:\Windows\System\MuAPPGh.exe
  2⤵
  PID:3660
- C:\Windows\System\UuMswrE.exe
  C:\Windows\System\UuMswrE.exe
  2⤵
  PID:3680
- C:\Windows\System\Hzynchh.exe
  C:\Windows\System\Hzynchh.exe
  2⤵
  PID:3716
- C:\Windows\System\tnUhFUQ.exe
  C:\Windows\System\tnUhFUQ.exe
  2⤵
  PID:3732
- C:\Windows\System\qvKBdQd.exe
  C:\Windows\System\qvKBdQd.exe
  2⤵
  PID:3748
- C:\Windows\System\eupnfRd.exe
  C:\Windows\System\eupnfRd.exe
  2⤵
  PID:3764
- C:\Windows\System\wVXjwNI.exe
  C:\Windows\System\wVXjwNI.exe
  2⤵
  PID:3784
- C:\Windows\System\aSONiSd.exe
  C:\Windows\System\aSONiSd.exe
  2⤵
  PID:3804
- C:\Windows\System\JeQXtAM.exe
  C:\Windows\System\JeQXtAM.exe
  2⤵
  PID:3820
- C:\Windows\System\CItnqRY.exe
  C:\Windows\System\CItnqRY.exe
  2⤵
  PID:3840
- C:\Windows\System\lXHscXs.exe
  C:\Windows\System\lXHscXs.exe
  2⤵
  PID:3856
- C:\Windows\System\qcFLsiS.exe
  C:\Windows\System\qcFLsiS.exe
  2⤵
  PID:3872
- C:\Windows\System\RWyEUjF.exe
  C:\Windows\System\RWyEUjF.exe
  2⤵
  PID:3888
- C:\Windows\System\PnuzWtM.exe
  C:\Windows\System\PnuzWtM.exe
  2⤵
  PID:3904
- C:\Windows\System\rIvFKTJ.exe
  C:\Windows\System\rIvFKTJ.exe
  2⤵
  PID:3960
- C:\Windows\System\wZDChYO.exe
  C:\Windows\System\wZDChYO.exe
  2⤵
  PID:3980
- C:\Windows\System\IplwCCU.exe
  C:\Windows\System\IplwCCU.exe
  2⤵
  PID:3996
- C:\Windows\System\jlBALrs.exe
  C:\Windows\System\jlBALrs.exe
  2⤵
  PID:4012
- C:\Windows\System\HgnBGoy.exe
  C:\Windows\System\HgnBGoy.exe
  2⤵
  PID:4028
- C:\Windows\System\JpKEBXg.exe
  C:\Windows\System\JpKEBXg.exe
  2⤵
  PID:4044
- C:\Windows\System\oOxcebi.exe
  C:\Windows\System\oOxcebi.exe
  2⤵
  PID:4060
- C:\Windows\System\FvSDmHJ.exe
  C:\Windows\System\FvSDmHJ.exe
  2⤵
  PID:4080
- C:\Windows\System\tzDUNPC.exe
  C:\Windows\System\tzDUNPC.exe
  2⤵
  PID:2896
- C:\Windows\System\DJfGCwO.exe
  C:\Windows\System\DJfGCwO.exe
  2⤵
  PID:2376
- C:\Windows\System\ZcNDSBk.exe
  C:\Windows\System\ZcNDSBk.exe
  2⤵
  PID:1880
- C:\Windows\System\EgiWeWr.exe
  C:\Windows\System\EgiWeWr.exe
  2⤵
  PID:3040
- C:\Windows\System\PVULjmp.exe
  C:\Windows\System\PVULjmp.exe
  2⤵
  PID:3084
- C:\Windows\System\vmivmdV.exe
  C:\Windows\System\vmivmdV.exe
  2⤵
  PID:956
- C:\Windows\System\PPSVdlk.exe
  C:\Windows\System\PPSVdlk.exe
  2⤵
  PID:1352
- C:\Windows\System\VQrEKIc.exe
  C:\Windows\System\VQrEKIc.exe
  2⤵
  PID:1072
- C:\Windows\System\sriVRoA.exe
  C:\Windows\System\sriVRoA.exe
  2⤵
  PID:3100
- C:\Windows\System\tEfYBUl.exe
  C:\Windows\System\tEfYBUl.exe
  2⤵
  PID:3148
- C:\Windows\System\RSiRJUT.exe
  C:\Windows\System\RSiRJUT.exe
  2⤵
  PID:3164
- C:\Windows\System\SXiNDQq.exe
  C:\Windows\System\SXiNDQq.exe
  2⤵
  PID:2704
- C:\Windows\System\MpgcuGp.exe
  C:\Windows\System\MpgcuGp.exe
  2⤵
  PID:3256
- C:\Windows\System\TPwNIwX.exe
  C:\Windows\System\TPwNIwX.exe
  2⤵
  PID:3296
- C:\Windows\System\jgAzFzl.exe
  C:\Windows\System\jgAzFzl.exe
  2⤵
  PID:3332
- C:\Windows\System\DfcLPUY.exe
  C:\Windows\System\DfcLPUY.exe
  2⤵
  PID:3272
- C:\Windows\System\roVorbn.exe
  C:\Windows\System\roVorbn.exe
  2⤵
  PID:2180
- C:\Windows\System\vUtjTgk.exe
  C:\Windows\System\vUtjTgk.exe
  2⤵
  PID:3500
- C:\Windows\System\rIyAjQh.exe
  C:\Windows\System\rIyAjQh.exe
  2⤵
  PID:1700
- C:\Windows\System\PQlKTtj.exe
  C:\Windows\System\PQlKTtj.exe
  2⤵
  PID:3584
- C:\Windows\System\eDiRGtO.exe
  C:\Windows\System\eDiRGtO.exe
  2⤵
  PID:3516
- C:\Windows\System\wEMzFiz.exe
  C:\Windows\System\wEMzFiz.exe
  2⤵
  PID:3572
- C:\Windows\System\cAEbhGY.exe
  C:\Windows\System\cAEbhGY.exe
  2⤵
  PID:3656
- C:\Windows\System\yhnUwEy.exe
  C:\Windows\System\yhnUwEy.exe
  2⤵
  PID:3704
- C:\Windows\System\UkrIQNy.exe
  C:\Windows\System\UkrIQNy.exe
  2⤵
  PID:3692
- C:\Windows\System\bvzuVQM.exe
  C:\Windows\System\bvzuVQM.exe
  2⤵
  PID:3880
- C:\Windows\System\zYjrWMW.exe
  C:\Windows\System\zYjrWMW.exe
  2⤵
  PID:3932
- C:\Windows\System\XWiVCww.exe
  C:\Windows\System\XWiVCww.exe
  2⤵
  PID:3936
- C:\Windows\System\dgvmizA.exe
  C:\Windows\System\dgvmizA.exe
  2⤵
  PID:3952
- C:\Windows\System\wrjmrxk.exe
  C:\Windows\System\wrjmrxk.exe
  2⤵
  PID:3992
- C:\Windows\System\vemhSWA.exe
  C:\Windows\System\vemhSWA.exe
  2⤵
  PID:3668
- C:\Windows\System\PilLpRa.exe
  C:\Windows\System\PilLpRa.exe
  2⤵
  PID:3796
- C:\Windows\System\umeEulu.exe
  C:\Windows\System\umeEulu.exe
  2⤵
  PID:3864
- C:\Windows\System\lGRgpUY.exe
  C:\Windows\System\lGRgpUY.exe
  2⤵
  PID:4052
- C:\Windows\System\QqTdHYr.exe
  C:\Windows\System\QqTdHYr.exe
  2⤵
  PID:2644
- C:\Windows\System\QetOqJk.exe
  C:\Windows\System\QetOqJk.exe
  2⤵
  PID:3212
- C:\Windows\System\GbpcCys.exe
  C:\Windows\System\GbpcCys.exe
  2⤵
  PID:852
- C:\Windows\System\NcOpmUi.exe
  C:\Windows\System\NcOpmUi.exe
  2⤵
  PID:3196
- C:\Windows\System\XbQPQob.exe
  C:\Windows\System\XbQPQob.exe
  2⤵
  PID:3388
- C:\Windows\System\LQyVdSy.exe
  C:\Windows\System\LQyVdSy.exe
  2⤵
  PID:2804
- C:\Windows\System\CFdRTBX.exe
  C:\Windows\System\CFdRTBX.exe
  2⤵
  PID:3404
- C:\Windows\System\WCquQEx.exe
  C:\Windows\System\WCquQEx.exe
  2⤵
  PID:2088
- C:\Windows\System\dqvzfwL.exe
  C:\Windows\System\dqvzfwL.exe
  2⤵
  PID:3616
- C:\Windows\System\ofxtVVK.exe
  C:\Windows\System\ofxtVVK.exe
  2⤵
  PID:3648
- C:\Windows\System\TAhZahx.exe
  C:\Windows\System\TAhZahx.exe
  2⤵
  PID:3564
- C:\Windows\System\yzZqrhR.exe
  C:\Windows\System\yzZqrhR.exe
  2⤵
  PID:3800
- C:\Windows\System\lajCggA.exe
  C:\Windows\System\lajCggA.exe
  2⤵
  PID:2156
- C:\Windows\System\SHGOjEn.exe
  C:\Windows\System\SHGOjEn.exe
  2⤵
  PID:2624
- C:\Windows\System\KczcQVq.exe
  C:\Windows\System\KczcQVq.exe
  2⤵
  PID:3744
- C:\Windows\System\qnaFFzZ.exe
  C:\Windows\System\qnaFFzZ.exe
  2⤵
  PID:2008
- C:\Windows\System\mWDTurW.exe
  C:\Windows\System\mWDTurW.exe
  2⤵
  PID:3136
- C:\Windows\System\PGFLBJc.exe
  C:\Windows\System\PGFLBJc.exe
  2⤵
  PID:3496
- C:\Windows\System\CpJLaBG.exe
  C:\Windows\System\CpJLaBG.exe
  2⤵
  PID:3772
- C:\Windows\System\vtoTQwF.exe
  C:\Windows\System\vtoTQwF.exe
  2⤵
  PID:3928
- C:\Windows\System\PByapzp.exe
  C:\Windows\System\PByapzp.exe
  2⤵
  PID:3836
- C:\Windows\System\nnSgnrE.exe
  C:\Windows\System\nnSgnrE.exe
  2⤵
  PID:4092
- C:\Windows\System\dgZCKJk.exe
  C:\Windows\System\dgZCKJk.exe
  2⤵
  PID:3604
- C:\Windows\System\qyXSMWQ.exe
  C:\Windows\System\qyXSMWQ.exe
  2⤵
  PID:3228
- C:\Windows\System\OpWXqsP.exe
  C:\Windows\System\OpWXqsP.exe
  2⤵
  PID:3360
- C:\Windows\System\KJKvSYU.exe
  C:\Windows\System\KJKvSYU.exe
  2⤵
  PID:3852
- C:\Windows\System\XuFkmSJ.exe
  C:\Windows\System\XuFkmSJ.exe
  2⤵
  PID:3396
- C:\Windows\System\PTMafSC.exe
  C:\Windows\System\PTMafSC.exe
  2⤵
  PID:2880
- C:\Windows\System\KmzBbcM.exe
  C:\Windows\System\KmzBbcM.exe
  2⤵
  PID:3724
- C:\Windows\System\CTRIfWL.exe
  C:\Windows\System\CTRIfWL.exe
  2⤵
  PID:3156
- C:\Windows\System\MTUlIMo.exe
  C:\Windows\System\MTUlIMo.exe
  2⤵
  PID:1520
- C:\Windows\System\nggrSrF.exe
  C:\Windows\System\nggrSrF.exe
  2⤵
  PID:3416
- C:\Windows\System\CmpAOyl.exe
  C:\Windows\System\CmpAOyl.exe
  2⤵
  PID:3760
- C:\Windows\System\kUhDaoM.exe
  C:\Windows\System\kUhDaoM.exe
  2⤵
  PID:3288
- C:\Windows\System\UVLoVaf.exe
  C:\Windows\System\UVLoVaf.exe
  2⤵
  PID:2200
- C:\Windows\System\jGZpgfC.exe
  C:\Windows\System\jGZpgfC.exe
  2⤵
  PID:3168
- C:\Windows\System\FRdazRr.exe
  C:\Windows\System\FRdazRr.exe
  2⤵
  PID:3532
- C:\Windows\System\JeoLKhb.exe
  C:\Windows\System\JeoLKhb.exe
  2⤵
  PID:4024
- C:\Windows\System\UCWgCVz.exe
  C:\Windows\System\UCWgCVz.exe
  2⤵
  PID:2312
- C:\Windows\System\QgDKfxy.exe
  C:\Windows\System\QgDKfxy.exe
  2⤵
  PID:3636
- C:\Windows\System\DLjwDwP.exe
  C:\Windows\System\DLjwDwP.exe
  2⤵
  PID:3384
- C:\Windows\System\SrsgSea.exe
  C:\Windows\System\SrsgSea.exe
  2⤵
  PID:4072
- C:\Windows\System\hvxVmoT.exe
  C:\Windows\System\hvxVmoT.exe
  2⤵
  PID:3568
- C:\Windows\System\moXmNEI.exe
  C:\Windows\System\moXmNEI.exe
  2⤵
  PID:4008
- C:\Windows\System\XuYOnnX.exe
  C:\Windows\System\XuYOnnX.exe
  2⤵
  PID:3356
- C:\Windows\System\UsPcNhM.exe
  C:\Windows\System\UsPcNhM.exe
  2⤵
  PID:3988
- C:\Windows\System\GnJYEPL.exe
  C:\Windows\System\GnJYEPL.exe
  2⤵
  PID:3900
- C:\Windows\System\UKPGErf.exe
  C:\Windows\System\UKPGErf.exe
  2⤵
  PID:2928
- C:\Windows\System\ObWFtCD.exe
  C:\Windows\System\ObWFtCD.exe
  2⤵
  PID:3240
- C:\Windows\System\qgpqBEb.exe
  C:\Windows\System\qgpqBEb.exe
  2⤵
  PID:4088
- C:\Windows\System\VgkGZGN.exe
  C:\Windows\System\VgkGZGN.exe
  2⤵
  PID:2440
- C:\Windows\System\NBPtOdI.exe
  C:\Windows\System\NBPtOdI.exe
  2⤵
  PID:4112
- C:\Windows\System\TjRMrLW.exe
  C:\Windows\System\TjRMrLW.exe
  2⤵
  PID:4152
- C:\Windows\System\JMzWJWH.exe
  C:\Windows\System\JMzWJWH.exe
  2⤵
  PID:4188
- C:\Windows\System\IaIJEih.exe
  C:\Windows\System\IaIJEih.exe
  2⤵
  PID:4208
- C:\Windows\System\JLCLsFK.exe
  C:\Windows\System\JLCLsFK.exe
  2⤵
  PID:4232
- C:\Windows\System\mZyREYX.exe
  C:\Windows\System\mZyREYX.exe
  2⤵
  PID:4256
- C:\Windows\System\zdrimyB.exe
  C:\Windows\System\zdrimyB.exe
  2⤵
  PID:4272
- C:\Windows\System\mToMcPF.exe
  C:\Windows\System\mToMcPF.exe
  2⤵
  PID:4292
- C:\Windows\System\VCtoIzW.exe
  C:\Windows\System\VCtoIzW.exe
  2⤵
  PID:4308
- C:\Windows\System\goOWXGh.exe
  C:\Windows\System\goOWXGh.exe
  2⤵
  PID:4324
- C:\Windows\System\KjinHaH.exe
  C:\Windows\System\KjinHaH.exe
  2⤵
  PID:4340
- C:\Windows\System\ZdhMeSG.exe
  C:\Windows\System\ZdhMeSG.exe
  2⤵
  PID:4392
- C:\Windows\System\JRHofRd.exe
  C:\Windows\System\JRHofRd.exe
  2⤵
  PID:4412
- C:\Windows\System\UkvIXiF.exe
  C:\Windows\System\UkvIXiF.exe
  2⤵
  PID:4436
- C:\Windows\System\dkKoBKk.exe
  C:\Windows\System\dkKoBKk.exe
  2⤵
  PID:4452
- C:\Windows\System\SPAPAHG.exe
  C:\Windows\System\SPAPAHG.exe
  2⤵
  PID:4480
- C:\Windows\System\NkdJcvZ.exe
  C:\Windows\System\NkdJcvZ.exe
  2⤵
  PID:4496
- C:\Windows\System\FIYafIL.exe
  C:\Windows\System\FIYafIL.exe
  2⤵
  PID:4512
- C:\Windows\System\qBmRRnz.exe
  C:\Windows\System\qBmRRnz.exe
  2⤵
  PID:4532
- C:\Windows\System\sqLIWwe.exe
  C:\Windows\System\sqLIWwe.exe
  2⤵
  PID:4548
- C:\Windows\System\ElZdexP.exe
  C:\Windows\System\ElZdexP.exe
  2⤵
  PID:4564
- C:\Windows\System\MwuNTSG.exe
  C:\Windows\System\MwuNTSG.exe
  2⤵
  PID:4580
- C:\Windows\System\YLEzxQP.exe
  C:\Windows\System\YLEzxQP.exe
  2⤵
  PID:4600
- C:\Windows\System\yOTmctu.exe
  C:\Windows\System\yOTmctu.exe
  2⤵
  PID:4640
- C:\Windows\System\GvqXOMi.exe
  C:\Windows\System\GvqXOMi.exe
  2⤵
  PID:4660
- C:\Windows\System\jaSpSjW.exe
  C:\Windows\System\jaSpSjW.exe
  2⤵
  PID:4676
- C:\Windows\System\YqWqgTH.exe
  C:\Windows\System\YqWqgTH.exe
  2⤵
  PID:4692
- C:\Windows\System\pGozKKf.exe
  C:\Windows\System\pGozKKf.exe
  2⤵
  PID:4712
- C:\Windows\System\VtOowIK.exe
  C:\Windows\System\VtOowIK.exe
  2⤵
  PID:4732
- C:\Windows\System\pcyhjds.exe
  C:\Windows\System\pcyhjds.exe
  2⤵
  PID:4748
- C:\Windows\System\UIPEDqf.exe
  C:\Windows\System\UIPEDqf.exe
  2⤵
  PID:4764
- C:\Windows\System\gkHNFyq.exe
  C:\Windows\System\gkHNFyq.exe
  2⤵
  PID:4780
- C:\Windows\System\BfRQhpX.exe
  C:\Windows\System\BfRQhpX.exe
  2⤵
  PID:4796
- C:\Windows\System\wsGjAVy.exe
  C:\Windows\System\wsGjAVy.exe
  2⤵
  PID:4844
- C:\Windows\System\XhkcckN.exe
  C:\Windows\System\XhkcckN.exe
  2⤵
  PID:4860
- C:\Windows\System\HutZeLn.exe
  C:\Windows\System\HutZeLn.exe
  2⤵
  PID:4880
- C:\Windows\System\qSjFSGO.exe
  C:\Windows\System\qSjFSGO.exe
  2⤵
  PID:4896
- C:\Windows\System\tQYObnr.exe
  C:\Windows\System\tQYObnr.exe
  2⤵
  PID:4916
- C:\Windows\System\NSHtycA.exe
  C:\Windows\System\NSHtycA.exe
  2⤵
  PID:4936
- C:\Windows\System\mEcxHvj.exe
  C:\Windows\System\mEcxHvj.exe
  2⤵
  PID:4960
- C:\Windows\System\JxyGXXE.exe
  C:\Windows\System\JxyGXXE.exe
  2⤵
  PID:4980
- C:\Windows\System\Sxjgjlq.exe
  C:\Windows\System\Sxjgjlq.exe
  2⤵
  PID:5000
- C:\Windows\System\oSncRXA.exe
  C:\Windows\System\oSncRXA.exe
  2⤵
  PID:5064
- C:\Windows\System\NUHWXxE.exe
  C:\Windows\System\NUHWXxE.exe
  2⤵
  PID:5080
- C:\Windows\System\mzIgfPm.exe
  C:\Windows\System\mzIgfPm.exe
  2⤵
  PID:5100
- C:\Windows\System\nQNxIEM.exe
  C:\Windows\System\nQNxIEM.exe
  2⤵
  PID:5116
- C:\Windows\System\qDGUXzG.exe
  C:\Windows\System\qDGUXzG.exe
  2⤵
  PID:3956
- C:\Windows\System\EqIcrzP.exe
  C:\Windows\System\EqIcrzP.exe
  2⤵
  PID:4136
- C:\Windows\System\ymWXgOk.exe
  C:\Windows\System\ymWXgOk.exe
  2⤵
  PID:4132
- C:\Windows\System\XyIImKQ.exe
  C:\Windows\System\XyIImKQ.exe
  2⤵
  PID:4040
- C:\Windows\System\gtHrwnC.exe
  C:\Windows\System\gtHrwnC.exe
  2⤵
  PID:2756
- C:\Windows\System\xFCHVFI.exe
  C:\Windows\System\xFCHVFI.exe
  2⤵
  PID:2148
- C:\Windows\System\bSXOBYJ.exe
  C:\Windows\System\bSXOBYJ.exe
  2⤵
  PID:4160
- C:\Windows\System\nTQQmvU.exe
  C:\Windows\System\nTQQmvU.exe
  2⤵
  PID:4196
- C:\Windows\System\dWohvie.exe
  C:\Windows\System\dWohvie.exe
  2⤵
  PID:4224
- C:\Windows\System\YyDArxf.exe
  C:\Windows\System\YyDArxf.exe
  2⤵
  PID:4284
- C:\Windows\System\EXlUUIo.exe
  C:\Windows\System\EXlUUIo.exe
  2⤵
  PID:4336
- C:\Windows\System\zsRIoei.exe
  C:\Windows\System\zsRIoei.exe
  2⤵
  PID:4320
- C:\Windows\System\ZxvMOdh.exe
  C:\Windows\System\ZxvMOdh.exe
  2⤵
  PID:4356
- C:\Windows\System\EtYtdie.exe
  C:\Windows\System\EtYtdie.exe
  2⤵
  PID:4376
- C:\Windows\System\swskiMe.exe
  C:\Windows\System\swskiMe.exe
  2⤵
  PID:4408
- C:\Windows\System\NUtDmAR.exe
  C:\Windows\System\NUtDmAR.exe
  2⤵
  PID:4428
- C:\Windows\System\muRxMga.exe
  C:\Windows\System\muRxMga.exe
  2⤵
  PID:4472
- C:\Windows\System\zSsEFXY.exe
  C:\Windows\System\zSsEFXY.exe
  2⤵
  PID:4448
- C:\Windows\System\xJOeTaz.exe
  C:\Windows\System\xJOeTaz.exe
  2⤵
  PID:4628
- C:\Windows\System\tAqDGIx.exe
  C:\Windows\System\tAqDGIx.exe
  2⤵
  PID:4560
- C:\Windows\System\YhRYtoO.exe
  C:\Windows\System\YhRYtoO.exe
  2⤵
  PID:4524
- C:\Windows\System\BRTgzrS.exe
  C:\Windows\System\BRTgzrS.exe
  2⤵
  PID:4596
- C:\Windows\System\LXwWDnR.exe
  C:\Windows\System\LXwWDnR.exe
  2⤵
  PID:4668
- C:\Windows\System\aEGkoyR.exe
  C:\Windows\System\aEGkoyR.exe
  2⤵
  PID:4708
- C:\Windows\System\ZfzYbvG.exe
  C:\Windows\System\ZfzYbvG.exe
  2⤵
  PID:4724
- C:\Windows\System\aNXngTH.exe
  C:\Windows\System\aNXngTH.exe
  2⤵
  PID:4760
- C:\Windows\System\MpIwibF.exe
  C:\Windows\System\MpIwibF.exe
  2⤵
  PID:4792
- C:\Windows\System\biRyKLh.exe
  C:\Windows\System\biRyKLh.exe
  2⤵
  PID:4820
- C:\Windows\System\hAYhsmc.exe
  C:\Windows\System\hAYhsmc.exe
  2⤵
  PID:4832
- C:\Windows\System\QusPClH.exe
  C:\Windows\System\QusPClH.exe
  2⤵
  PID:4380
- C:\Windows\System\LryJkyX.exe
  C:\Windows\System\LryJkyX.exe
  2⤵
  PID:4872
- C:\Windows\System\KqwGqkg.exe
  C:\Windows\System\KqwGqkg.exe
  2⤵
  PID:4968
- C:\Windows\System\EjObKTK.exe
  C:\Windows\System\EjObKTK.exe
  2⤵
  PID:4892
- C:\Windows\System\qYJCMnz.exe
  C:\Windows\System\qYJCMnz.exe
  2⤵
  PID:5012
- C:\Windows\System\eCxWBWS.exe
  C:\Windows\System\eCxWBWS.exe
  2⤵
  PID:4952
- C:\Windows\System\DoufdsY.exe
  C:\Windows\System\DoufdsY.exe
  2⤵
  PID:5024
- C:\Windows\System\OqfoABk.exe
  C:\Windows\System\OqfoABk.exe
  2⤵
  PID:5040
- C:\Windows\System\cBQzcFO.exe
  C:\Windows\System\cBQzcFO.exe
  2⤵
  PID:5056
- C:\Windows\System\lsvfEHO.exe
  C:\Windows\System\lsvfEHO.exe
  2⤵
  PID:5108
- C:\Windows\System\RXcxeJQ.exe
  C:\Windows\System\RXcxeJQ.exe
  2⤵
  PID:3520
- C:\Windows\System\HichWEo.exe
  C:\Windows\System\HichWEo.exe
  2⤵
  PID:4120
- C:\Windows\System\naJBsoF.exe
  C:\Windows\System\naJBsoF.exe
  2⤵
  PID:1932
- C:\Windows\System\CBSkBqz.exe
  C:\Windows\System\CBSkBqz.exe
  2⤵
  PID:4124
- C:\Windows\System\NKWSptf.exe
  C:\Windows\System\NKWSptf.exe
  2⤵
  PID:4220
- C:\Windows\System\gcnRWNz.exe
  C:\Windows\System\gcnRWNz.exe
  2⤵
  PID:4252
- C:\Windows\System\pSxJXkQ.exe
  C:\Windows\System\pSxJXkQ.exe
  2⤵
  PID:4288
- C:\Windows\System\yfIelGo.exe
  C:\Windows\System\yfIelGo.exe
  2⤵
  PID:4364
- C:\Windows\System\iCmtCFl.exe
  C:\Windows\System\iCmtCFl.exe
  2⤵
  PID:4460
- C:\Windows\System\wurBAXz.exe
  C:\Windows\System\wurBAXz.exe
  2⤵
  PID:4608
- C:\Windows\System\OXidtHV.exe
  C:\Windows\System\OXidtHV.exe
  2⤵
  PID:3812
- C:\Windows\System\JOSNZoH.exe
  C:\Windows\System\JOSNZoH.exe
  2⤵
  PID:4520
- C:\Windows\System\gDceRzV.exe
  C:\Windows\System\gDceRzV.exe
  2⤵
  PID:4424
- C:\Windows\System\ZpfjNmW.exe
  C:\Windows\System\ZpfjNmW.exe
  2⤵
  PID:4720
- C:\Windows\System\memrVIn.exe
  C:\Windows\System\memrVIn.exe
  2⤵
  PID:4588
- C:\Windows\System\hFGBuPG.exe
  C:\Windows\System\hFGBuPG.exe
  2⤵
  PID:4944
- C:\Windows\System\dPXqKQp.exe
  C:\Windows\System\dPXqKQp.exe
  2⤵
  PID:5072
- C:\Windows\System\GbEJylk.exe
  C:\Windows\System\GbEJylk.exe
  2⤵
  PID:3536
- C:\Windows\System\hltISmw.exe
  C:\Windows\System\hltISmw.exe
  2⤵
  PID:3756
- C:\Windows\System\zoacBbA.exe
  C:\Windows\System\zoacBbA.exe
  2⤵
  PID:4388
- C:\Windows\System\IFAeBLj.exe
  C:\Windows\System\IFAeBLj.exe
  2⤵
  PID:4616
- C:\Windows\System\IdrnUzI.exe
  C:\Windows\System\IdrnUzI.exe
  2⤵
  PID:4268
- C:\Windows\System\kuhNYIh.exe
  C:\Windows\System\kuhNYIh.exe
  2⤵
  PID:4868
- C:\Windows\System\vhbvDAd.exe
  C:\Windows\System\vhbvDAd.exe
  2⤵
  PID:4204
- C:\Windows\System\uQqrcuf.exe
  C:\Windows\System\uQqrcuf.exe
  2⤵
  PID:4912
- C:\Windows\System\PHPStni.exe
  C:\Windows\System\PHPStni.exe
  2⤵
  PID:5052
- C:\Windows\System\EGFXQwW.exe
  C:\Windows\System\EGFXQwW.exe
  2⤵
  PID:4128
- C:\Windows\System\sbHdKoM.exe
  C:\Windows\System\sbHdKoM.exe
  2⤵
  PID:4184
- C:\Windows\System\jjMjCza.exe
  C:\Windows\System\jjMjCza.exe
  2⤵
  PID:4144
- C:\Windows\System\sbKjBWb.exe
  C:\Windows\System\sbKjBWb.exe
  2⤵
  PID:4264
- C:\Windows\System\xhgaGFM.exe
  C:\Windows\System\xhgaGFM.exe
  2⤵
  PID:4368
- C:\Windows\System\tWmPADo.exe
  C:\Windows\System\tWmPADo.exe
  2⤵
  PID:4700
- C:\Windows\System\nbUABZy.exe
  C:\Windows\System\nbUABZy.exe
  2⤵
  PID:4444
- C:\Windows\System\vKPwXbv.exe
  C:\Windows\System\vKPwXbv.exe
  2⤵
  PID:928
- C:\Windows\System\LqsKAki.exe
  C:\Windows\System\LqsKAki.exe
  2⤵
  PID:4836
- C:\Windows\System\ovwsGit.exe
  C:\Windows\System\ovwsGit.exe
  2⤵
  PID:5092
- C:\Windows\System\tElLbiZ.exe
  C:\Windows\System\tElLbiZ.exe
  2⤵
  PID:4164
- C:\Windows\System\fXzyHpL.exe
  C:\Windows\System\fXzyHpL.exe
  2⤵
  PID:5032
- C:\Windows\System\ZSYVeoH.exe
  C:\Windows\System\ZSYVeoH.exe
  2⤵
  PID:4172
- C:\Windows\System\wSRHwBq.exe
  C:\Windows\System\wSRHwBq.exe
  2⤵
  PID:976
- C:\Windows\System\NLyBkmb.exe
  C:\Windows\System\NLyBkmb.exe
  2⤵
  PID:4888
- C:\Windows\System\mqdvLtP.exe
  C:\Windows\System\mqdvLtP.exe
  2⤵
  PID:5008
- C:\Windows\System\kaSnSRT.exe
  C:\Windows\System\kaSnSRT.exe
  2⤵
  PID:4508
- C:\Windows\System\IrdkBar.exe
  C:\Windows\System\IrdkBar.exe
  2⤵
  PID:4168
- C:\Windows\System\AegzQpk.exe
  C:\Windows\System\AegzQpk.exe
  2⤵
  PID:4876
- C:\Windows\System\IjjLQge.exe
  C:\Windows\System\IjjLQge.exe
  2⤵
  PID:4280
- C:\Windows\System\DRcOuEC.exe
  C:\Windows\System\DRcOuEC.exe
  2⤵
  PID:5136
- C:\Windows\System\PLZlBWA.exe
  C:\Windows\System\PLZlBWA.exe
  2⤵
  PID:5152
- C:\Windows\System\iDuyYTt.exe
  C:\Windows\System\iDuyYTt.exe
  2⤵
  PID:5172
- C:\Windows\System\PdBYJqR.exe
  C:\Windows\System\PdBYJqR.exe
  2⤵
  PID:5196
- C:\Windows\System\nMaOZku.exe
  C:\Windows\System\nMaOZku.exe
  2⤵
  PID:5240
- C:\Windows\System\BNPfPSk.exe
  C:\Windows\System\BNPfPSk.exe
  2⤵
  PID:5256
- C:\Windows\System\imgvefE.exe
  C:\Windows\System\imgvefE.exe
  2⤵
  PID:5272
- C:\Windows\System\NDEOBDq.exe
  C:\Windows\System\NDEOBDq.exe
  2⤵
  PID:5288
- C:\Windows\System\poQgdJG.exe
  C:\Windows\System\poQgdJG.exe
  2⤵
  PID:5304
- C:\Windows\System\nYklJDW.exe
  C:\Windows\System\nYklJDW.exe
  2⤵
  PID:5328
- C:\Windows\System\zfwRFhr.exe
  C:\Windows\System\zfwRFhr.exe
  2⤵
  PID:5348
- C:\Windows\System\gerLUzH.exe
  C:\Windows\System\gerLUzH.exe
  2⤵
  PID:5364
- C:\Windows\System\DUCYzhg.exe
  C:\Windows\System\DUCYzhg.exe
  2⤵
  PID:5380
- C:\Windows\System\YajWslf.exe
  C:\Windows\System\YajWslf.exe
  2⤵
  PID:5396
- C:\Windows\System\mEBIBQj.exe
  C:\Windows\System\mEBIBQj.exe
  2⤵
  PID:5440
- C:\Windows\System\wCYgcPh.exe
  C:\Windows\System\wCYgcPh.exe
  2⤵
  PID:5456
- C:\Windows\System\XnSodlK.exe
  C:\Windows\System\XnSodlK.exe
  2⤵
  PID:5472
- C:\Windows\System\kBsbMMD.exe
  C:\Windows\System\kBsbMMD.exe
  2⤵
  PID:5492
- C:\Windows\System\SHJTGcb.exe
  C:\Windows\System\SHJTGcb.exe
  2⤵
  PID:5512
- C:\Windows\System\CPEXNPf.exe
  C:\Windows\System\CPEXNPf.exe
  2⤵
  PID:5528
- C:\Windows\System\sUUjwhM.exe
  C:\Windows\System\sUUjwhM.exe
  2⤵
  PID:5544
- C:\Windows\System\ozfLXwb.exe
  C:\Windows\System\ozfLXwb.exe
  2⤵
  PID:5560
- C:\Windows\System\bbYMbrg.exe
  C:\Windows\System\bbYMbrg.exe
  2⤵
  PID:5576
- C:\Windows\System\HGONcRi.exe
  C:\Windows\System\HGONcRi.exe
  2⤵
  PID:5596
- C:\Windows\System\kripugX.exe
  C:\Windows\System\kripugX.exe
  2⤵
  PID:5612
- C:\Windows\System\VhlmbQI.exe
  C:\Windows\System\VhlmbQI.exe
  2⤵
  PID:5628
- C:\Windows\System\jbSvAun.exe
  C:\Windows\System\jbSvAun.exe
  2⤵
  PID:5680
- C:\Windows\System\XIrRAIJ.exe
  C:\Windows\System\XIrRAIJ.exe
  2⤵
  PID:5696
- C:\Windows\System\YYxLzSi.exe
  C:\Windows\System\YYxLzSi.exe
  2⤵
  PID:5712
- C:\Windows\System\oAhaIBJ.exe
  C:\Windows\System\oAhaIBJ.exe
  2⤵
  PID:5728
- C:\Windows\System\BMKyjop.exe
  C:\Windows\System\BMKyjop.exe
  2⤵
  PID:5760
- C:\Windows\System\ElxibQq.exe
  C:\Windows\System\ElxibQq.exe
  2⤵
  PID:5780
- C:\Windows\System\DhCrIpo.exe
  C:\Windows\System\DhCrIpo.exe
  2⤵
  PID:5796
- C:\Windows\System\iaVXvcY.exe
  C:\Windows\System\iaVXvcY.exe
  2⤵
  PID:5824
- C:\Windows\System\NprDjmS.exe
  C:\Windows\System\NprDjmS.exe
  2⤵
  PID:5840
- C:\Windows\System\QKsMzyy.exe
  C:\Windows\System\QKsMzyy.exe
  2⤵
  PID:5856
- C:\Windows\System\wanvSaj.exe
  C:\Windows\System\wanvSaj.exe
  2⤵
  PID:5872
- C:\Windows\System\qqnXeBz.exe
  C:\Windows\System\qqnXeBz.exe
  2⤵
  PID:5892
- C:\Windows\System\EqxLyJd.exe
  C:\Windows\System\EqxLyJd.exe
  2⤵
  PID:5908
- C:\Windows\System\wLEOaVg.exe
  C:\Windows\System\wLEOaVg.exe
  2⤵
  PID:5924
- C:\Windows\System\rtbtaCq.exe
  C:\Windows\System\rtbtaCq.exe
  2⤵
  PID:5976
- C:\Windows\System\boZYkgh.exe
  C:\Windows\System\boZYkgh.exe
  2⤵
  PID:5996
- C:\Windows\System\KTcniRS.exe
  C:\Windows\System\KTcniRS.exe
  2⤵
  PID:6016
- C:\Windows\System\OwsWbrj.exe
  C:\Windows\System\OwsWbrj.exe
  2⤵
  PID:6032
- C:\Windows\System\BNDzInV.exe
  C:\Windows\System\BNDzInV.exe
  2⤵
  PID:6048
- C:\Windows\System\WMCAzho.exe
  C:\Windows\System\WMCAzho.exe
  2⤵
  PID:6064
- C:\Windows\System\FmuSnDN.exe
  C:\Windows\System\FmuSnDN.exe
  2⤵
  PID:6096
- C:\Windows\System\EEVXdsI.exe
  C:\Windows\System\EEVXdsI.exe
  2⤵
  PID:6116
- C:\Windows\System\OxRkkVA.exe
  C:\Windows\System\OxRkkVA.exe
  2⤵
  PID:6132
- C:\Windows\System\RsNyeKw.exe
  C:\Windows\System\RsNyeKw.exe
  2⤵
  PID:4808
- C:\Windows\System\IiehFkf.exe
  C:\Windows\System\IiehFkf.exe
  2⤵
  PID:4996
- C:\Windows\System\DYQNwgB.exe
  C:\Windows\System\DYQNwgB.exe
  2⤵
  PID:5180
- C:\Windows\System\KneZfMN.exe
  C:\Windows\System\KneZfMN.exe
  2⤵
  PID:5164
- C:\Windows\System\xcLTDrw.exe
  C:\Windows\System\xcLTDrw.exe
  2⤵
  PID:4776
- C:\Windows\System\wzpBXmJ.exe
  C:\Windows\System\wzpBXmJ.exe
  2⤵
  PID:5188
- C:\Windows\System\uYjPSKs.exe
  C:\Windows\System\uYjPSKs.exe
  2⤵
  PID:5212
- C:\Windows\System\ldDdPCZ.exe
  C:\Windows\System\ldDdPCZ.exe
  2⤵
  PID:5312
- C:\Windows\System\PSizaqj.exe
  C:\Windows\System\PSizaqj.exe
  2⤵
  PID:5320
- C:\Windows\System\ESczBZc.exe
  C:\Windows\System\ESczBZc.exe
  2⤵
  PID:5392
- C:\Windows\System\vUxLOVG.exe
  C:\Windows\System\vUxLOVG.exe
  2⤵
  PID:5336
- C:\Windows\System\SvhclGJ.exe
  C:\Windows\System\SvhclGJ.exe
  2⤵
  PID:5484
- C:\Windows\System\XAJDJcS.exe
  C:\Windows\System\XAJDJcS.exe
  2⤵
  PID:5524
- C:\Windows\System\kNhlJad.exe
  C:\Windows\System\kNhlJad.exe
  2⤵
  PID:5676
- C:\Windows\System\wcPeKqS.exe
  C:\Windows\System\wcPeKqS.exe
  2⤵
  PID:5536
- C:\Windows\System\zucotwk.exe
  C:\Windows\System\zucotwk.exe
  2⤵
  PID:5508
- C:\Windows\System\NIJvMFU.exe
  C:\Windows\System\NIJvMFU.exe
  2⤵
  PID:5664
- C:\Windows\System\hdGZOeM.exe
  C:\Windows\System\hdGZOeM.exe
  2⤵
  PID:5572
- C:\Windows\System\XBXSEdN.exe
  C:\Windows\System\XBXSEdN.exe
  2⤵
  PID:5748
- C:\Windows\System\QGjGhDR.exe
  C:\Windows\System\QGjGhDR.exe
  2⤵
  PID:5808
- C:\Windows\System\ayfyibz.exe
  C:\Windows\System\ayfyibz.exe
  2⤵
  PID:5820
- C:\Windows\System\vYuQhSt.exe
  C:\Windows\System\vYuQhSt.exe
  2⤵
  PID:5884
- C:\Windows\System\xBWMEJG.exe
  C:\Windows\System\xBWMEJG.exe
  2⤵
  PID:5868
- C:\Windows\System\IszQZdK.exe
  C:\Windows\System\IszQZdK.exe
  2⤵
  PID:5940
- C:\Windows\System\mqlwtzT.exe
  C:\Windows\System\mqlwtzT.exe
  2⤵
  PID:5988
- C:\Windows\System\lYpUquQ.exe
  C:\Windows\System\lYpUquQ.exe
  2⤵
  PID:6060
- C:\Windows\System\munpGaZ.exe
  C:\Windows\System\munpGaZ.exe
  2⤵
  PID:6108
- C:\Windows\System\YLIiLJc.exe
  C:\Windows\System\YLIiLJc.exe
  2⤵
  PID:1604
- C:\Windows\System\WbrfOrE.exe
  C:\Windows\System\WbrfOrE.exe
  2⤵
  PID:5956
- C:\Windows\System\bKDcOwi.exe
  C:\Windows\System\bKDcOwi.exe
  2⤵
  PID:5964
- C:\Windows\System\rCttibl.exe
  C:\Windows\System\rCttibl.exe
  2⤵
  PID:5220
- C:\Windows\System\kjWjPQz.exe
  C:\Windows\System\kjWjPQz.exe
  2⤵
  PID:6088
- C:\Windows\System\dMgZFdR.exe
  C:\Windows\System\dMgZFdR.exe
  2⤵
  PID:5236
- C:\Windows\System\iCviPEd.exe
  C:\Windows\System\iCviPEd.exe
  2⤵
  PID:5268
- C:\Windows\System\nqvMPuD.exe
  C:\Windows\System\nqvMPuD.exe
  2⤵
  PID:5388
- C:\Windows\System\FGtWSgh.exe
  C:\Windows\System\FGtWSgh.exe
  2⤵
  PID:5372
- C:\Windows\System\rNtsbvG.exe
  C:\Windows\System\rNtsbvG.exe
  2⤵
  PID:4684
- C:\Windows\System\gnWtIdj.exe
  C:\Windows\System\gnWtIdj.exe
  2⤵
  PID:5432
- C:\Windows\System\yPXtcjF.exe
  C:\Windows\System\yPXtcjF.exe
  2⤵
  PID:5520
- C:\Windows\System\cbXcBIs.exe
  C:\Windows\System\cbXcBIs.exe
  2⤵
  PID:5584
- C:\Windows\System\artcZVK.exe
  C:\Windows\System\artcZVK.exe
  2⤵
  PID:5656
- C:\Windows\System\ZsOSvYv.exe
  C:\Windows\System\ZsOSvYv.exe
  2⤵
  PID:5648
- C:\Windows\System\zJiiDBo.exe
  C:\Windows\System\zJiiDBo.exe
  2⤵
  PID:5720
- C:\Windows\System\iTsZfoq.exe
  C:\Windows\System\iTsZfoq.exe
  2⤵
  PID:5812
- C:\Windows\System\XddPRLC.exe
  C:\Windows\System\XddPRLC.exe
  2⤵
  PID:5880
- C:\Windows\System\pGWCAxu.exe
  C:\Windows\System\pGWCAxu.exe
  2⤵
  PID:5900
- C:\Windows\System\KYPSERJ.exe
  C:\Windows\System\KYPSERJ.exe
  2⤵
  PID:6080
- C:\Windows\System\eNiuzFX.exe
  C:\Windows\System\eNiuzFX.exe
  2⤵
  PID:5160
- C:\Windows\System\gIzNLRz.exe
  C:\Windows\System\gIzNLRz.exe
  2⤵
  PID:4956
- C:\Windows\System\ofwQWmi.exe
  C:\Windows\System\ofwQWmi.exe
  2⤵
  PID:6028
- C:\Windows\System\FGLljPI.exe
  C:\Windows\System\FGLljPI.exe
  2⤵
  PID:5792
- C:\Windows\System\HmOkpHp.exe
  C:\Windows\System\HmOkpHp.exe
  2⤵
  PID:6140
- C:\Windows\System\lYxbkUN.exe
  C:\Windows\System\lYxbkUN.exe
  2⤵
  PID:5208
- C:\Windows\System\jBoeDnc.exe
  C:\Windows\System\jBoeDnc.exe
  2⤵
  PID:6056
- C:\Windows\System\oBmraUO.exe
  C:\Windows\System\oBmraUO.exe
  2⤵
  PID:5424
- C:\Windows\System\rWsJHPZ.exe
  C:\Windows\System\rWsJHPZ.exe
  2⤵
  PID:5464
- C:\Windows\System\thisJAa.exe
  C:\Windows\System\thisJAa.exe
  2⤵
  PID:5604
- C:\Windows\System\NCnCamn.exe
  C:\Windows\System\NCnCamn.exe
  2⤵
  PID:5620
- C:\Windows\System\QHrehOS.exe
  C:\Windows\System\QHrehOS.exe
  2⤵
  PID:5852
- C:\Windows\System\SwmAJUG.exe
  C:\Windows\System\SwmAJUG.exe
  2⤵
  PID:6084
- C:\Windows\System\kcWDSDy.exe
  C:\Windows\System\kcWDSDy.exe
  2⤵
  PID:5744
- C:\Windows\System\lHvbfDW.exe
  C:\Windows\System\lHvbfDW.exe
  2⤵
  PID:5540
- C:\Windows\System\oWVcCjI.exe
  C:\Windows\System\oWVcCjI.exe
  2⤵
  PID:5588
- C:\Windows\System\usuJuwK.exe
  C:\Windows\System\usuJuwK.exe
  2⤵
  PID:5284
- C:\Windows\System\sAiEJxh.exe
  C:\Windows\System\sAiEJxh.exe
  2⤵
  PID:6076
- C:\Windows\System\tZwrolv.exe
  C:\Windows\System\tZwrolv.exe
  2⤵
  PID:5224
- C:\Windows\System\ZAtFMZo.exe
  C:\Windows\System\ZAtFMZo.exe
  2⤵
  PID:5344
- C:\Windows\System\RfNsgWy.exe
  C:\Windows\System\RfNsgWy.exe
  2⤵
  PID:5772
- C:\Windows\System\uokAOFv.exe
  C:\Windows\System\uokAOFv.exe
  2⤵
  PID:5504
- C:\Windows\System\CrBRutC.exe
  C:\Windows\System\CrBRutC.exe
  2⤵
  PID:4744
- C:\Windows\System\CdouYBk.exe
  C:\Windows\System\CdouYBk.exe
  2⤵
  PID:5264
- C:\Windows\System\ClGjMjs.exe
  C:\Windows\System\ClGjMjs.exe
  2⤵
  PID:6192
- C:\Windows\System\DYKHsPd.exe
  C:\Windows\System\DYKHsPd.exe
  2⤵
  PID:6208
- C:\Windows\System\oRsiIao.exe
  C:\Windows\System\oRsiIao.exe
  2⤵
  PID:6244
- C:\Windows\System\XzzOiux.exe
  C:\Windows\System\XzzOiux.exe
  2⤵
  PID:6260
- C:\Windows\System\IiOEesf.exe
  C:\Windows\System\IiOEesf.exe
  2⤵
  PID:6276
- C:\Windows\System\GBSiUbA.exe
  C:\Windows\System\GBSiUbA.exe
  2⤵
  PID:6292
- C:\Windows\System\fedlzfa.exe
  C:\Windows\System\fedlzfa.exe
  2⤵
  PID:6308
- C:\Windows\System\RaYnapM.exe
  C:\Windows\System\RaYnapM.exe
  2⤵
  PID:6328
- C:\Windows\System\lxzIgsf.exe
  C:\Windows\System\lxzIgsf.exe
  2⤵
  PID:6360
- C:\Windows\System\srBQWgJ.exe
  C:\Windows\System\srBQWgJ.exe
  2⤵
  PID:6376
- C:\Windows\System\FfoRLrx.exe
  C:\Windows\System\FfoRLrx.exe
  2⤵
  PID:6396
- C:\Windows\System\EqLeiDG.exe
  C:\Windows\System\EqLeiDG.exe
  2⤵
  PID:6420
- C:\Windows\System\hUgfyXz.exe
  C:\Windows\System\hUgfyXz.exe
  2⤵
  PID:6436
- C:\Windows\System\jBLtjVQ.exe
  C:\Windows\System\jBLtjVQ.exe
  2⤵
  PID:6464
- C:\Windows\System\Lojysee.exe
  C:\Windows\System\Lojysee.exe
  2⤵
  PID:6480
- C:\Windows\System\tjQXQqS.exe
  C:\Windows\System\tjQXQqS.exe
  2⤵
  PID:6496
- C:\Windows\System\CGJTkJL.exe
  C:\Windows\System\CGJTkJL.exe
  2⤵
  PID:6512
- C:\Windows\System\LiGlmmU.exe
  C:\Windows\System\LiGlmmU.exe
  2⤵
  PID:6528
- C:\Windows\System\ysTMuaR.exe
  C:\Windows\System\ysTMuaR.exe
  2⤵
  PID:6552
- C:\Windows\System\XEGaluI.exe
  C:\Windows\System\XEGaluI.exe
  2⤵
  PID:6568
- C:\Windows\System\wRUtmLr.exe
  C:\Windows\System\wRUtmLr.exe
  2⤵
  PID:6584
- C:\Windows\System\oPvRudF.exe
  C:\Windows\System\oPvRudF.exe
  2⤵
  PID:6600
- C:\Windows\System\CWwODzb.exe
  C:\Windows\System\CWwODzb.exe
  2⤵
  PID:6620
- C:\Windows\System\xxQWrRR.exe
  C:\Windows\System\xxQWrRR.exe
  2⤵
  PID:6636
- C:\Windows\System\iUWtund.exe
  C:\Windows\System\iUWtund.exe
  2⤵
  PID:6656
- C:\Windows\System\phrPGdF.exe
  C:\Windows\System\phrPGdF.exe
  2⤵
  PID:6672
- C:\Windows\System\jZGSniX.exe
  C:\Windows\System\jZGSniX.exe
  2⤵
  PID:6692
- C:\Windows\System\GjqjqZJ.exe
  C:\Windows\System\GjqjqZJ.exe
  2⤵
  PID:6708
- C:\Windows\System\WATOOhq.exe
  C:\Windows\System\WATOOhq.exe
  2⤵
  PID:6728
- C:\Windows\System\GXskZwM.exe
  C:\Windows\System\GXskZwM.exe
  2⤵
  PID:6784
- C:\Windows\System\nAKUVCT.exe
  C:\Windows\System\nAKUVCT.exe
  2⤵
  PID:6800
- C:\Windows\System\VkRmaji.exe
  C:\Windows\System\VkRmaji.exe
  2⤵
  PID:6816
- C:\Windows\System\jwTVJHJ.exe
  C:\Windows\System\jwTVJHJ.exe
  2⤵
  PID:6840
- C:\Windows\System\BwIxDRJ.exe
  C:\Windows\System\BwIxDRJ.exe
  2⤵
  PID:6856
- C:\Windows\System\SAZlRon.exe
  C:\Windows\System\SAZlRon.exe
  2⤵
  PID:6872
- C:\Windows\System\SDsnjJl.exe
  C:\Windows\System\SDsnjJl.exe
  2⤵
  PID:6888
- C:\Windows\System\MDZhZuJ.exe
  C:\Windows\System\MDZhZuJ.exe
  2⤵
  PID:6904
- C:\Windows\System\Givcpni.exe
  C:\Windows\System\Givcpni.exe
  2⤵
  PID:6920
- C:\Windows\System\zuSvGBw.exe
  C:\Windows\System\zuSvGBw.exe
  2⤵
  PID:6940
- C:\Windows\System\EoCXHfz.exe
  C:\Windows\System\EoCXHfz.exe
  2⤵
  PID:6960
- C:\Windows\System\sShHWZO.exe
  C:\Windows\System\sShHWZO.exe
  2⤵
  PID:6976
- C:\Windows\System\NMwZMZK.exe
  C:\Windows\System\NMwZMZK.exe
  2⤵
  PID:6992
- C:\Windows\System\AZHfQbp.exe
  C:\Windows\System\AZHfQbp.exe
  2⤵
  PID:7016
- C:\Windows\System\YlxJALM.exe
  C:\Windows\System\YlxJALM.exe
  2⤵
  PID:7040
- C:\Windows\System\aiKpFvz.exe
  C:\Windows\System\aiKpFvz.exe
  2⤵
  PID:7060
- C:\Windows\System\gSBXQWC.exe
  C:\Windows\System\gSBXQWC.exe
  2⤵
  PID:7076
- C:\Windows\System\bZqQUwU.exe
  C:\Windows\System\bZqQUwU.exe
  2⤵
  PID:7092
- C:\Windows\System\ojxwkFj.exe
  C:\Windows\System\ojxwkFj.exe
  2⤵
  PID:7108
- C:\Windows\System\BAXvcNp.exe
  C:\Windows\System\BAXvcNp.exe
  2⤵
  PID:7124
- C:\Windows\System\oAOSOLl.exe
  C:\Windows\System\oAOSOLl.exe
  2⤵
  PID:7140
- C:\Windows\System\lojThQb.exe
  C:\Windows\System\lojThQb.exe
  2⤵
  PID:6112
- C:\Windows\System\jkuIoth.exe
  C:\Windows\System\jkuIoth.exe
  2⤵
  PID:5788
- C:\Windows\System\XSahNyX.exe
  C:\Windows\System\XSahNyX.exe
  2⤵
  PID:5968
- C:\Windows\System\ycSnXiM.exe
  C:\Windows\System\ycSnXiM.exe
  2⤵
  PID:5412
- C:\Windows\System\XpwSoGP.exe
  C:\Windows\System\XpwSoGP.exe
  2⤵
  PID:5132
- C:\Windows\System\hbLCtDL.exe
  C:\Windows\System\hbLCtDL.exe
  2⤵
  PID:5624
- C:\Windows\System\MwdYFPN.exe
  C:\Windows\System\MwdYFPN.exe
  2⤵
  PID:6156
- C:\Windows\System\sVzBQnv.exe
  C:\Windows\System\sVzBQnv.exe
  2⤵
  PID:6184
- C:\Windows\System\asYNhcq.exe
  C:\Windows\System\asYNhcq.exe
  2⤵
  PID:6216
- C:\Windows\System\eGZMhxs.exe
  C:\Windows\System\eGZMhxs.exe
  2⤵
  PID:6232
- C:\Windows\System\pPOQcKa.exe
  C:\Windows\System\pPOQcKa.exe
  2⤵
  PID:6324
- C:\Windows\System\XbytXkx.exe
  C:\Windows\System\XbytXkx.exe
  2⤵
  PID:6444
- C:\Windows\System\ypbTZsk.exe
  C:\Windows\System\ypbTZsk.exe
  2⤵
  PID:6460
- C:\Windows\System\FuXJzFL.exe
  C:\Windows\System\FuXJzFL.exe
  2⤵
  PID:6524
- C:\Windows\System\SHQMKco.exe
  C:\Windows\System\SHQMKco.exe
  2⤵
  PID:6304
- C:\Windows\System\pDwBOrJ.exe
  C:\Windows\System\pDwBOrJ.exe
  2⤵
  PID:6628
- C:\Windows\System\YzZOBFc.exe
  C:\Windows\System\YzZOBFc.exe
  2⤵
  PID:6700
- C:\Windows\System\FspURxy.exe
  C:\Windows\System\FspURxy.exe
  2⤵
  PID:6336
- C:\Windows\System\iCjWNDD.exe
  C:\Windows\System\iCjWNDD.exe
  2⤵
  PID:6608
- C:\Windows\System\Wysaggi.exe
  C:\Windows\System\Wysaggi.exe
  2⤵
  PID:6680
- C:\Windows\System\UZJYJPd.exe
  C:\Windows\System\UZJYJPd.exe
  2⤵
  PID:6756
- C:\Windows\System\tKqosGm.exe
  C:\Windows\System\tKqosGm.exe
  2⤵
  PID:6716
- C:\Windows\System\elSjbYv.exe
  C:\Windows\System\elSjbYv.exe
  2⤵
  PID:6540
- C:\Windows\System\KQHXROD.exe
  C:\Windows\System\KQHXROD.exe
  2⤵
  PID:6808
- C:\Windows\System\htbNNFi.exe
  C:\Windows\System\htbNNFi.exe
  2⤵
  PID:6644
- C:\Windows\System\EpvOBZJ.exe
  C:\Windows\System\EpvOBZJ.exe
  2⤵
  PID:6864
- C:\Windows\System\SmnIexF.exe
  C:\Windows\System\SmnIexF.exe
  2⤵
  PID:6720
- C:\Windows\System\ANWCHpJ.exe
  C:\Windows\System\ANWCHpJ.exe
  2⤵
  PID:6900
- C:\Windows\System\chvEQdB.exe
  C:\Windows\System\chvEQdB.exe
  2⤵
  PID:6868
- C:\Windows\System\hFMuXUl.exe
  C:\Windows\System\hFMuXUl.exe
  2⤵
  PID:6896
- C:\Windows\System\dFysQki.exe
  C:\Windows\System\dFysQki.exe
  2⤵
  PID:7008
- C:\Windows\System\awNxTGP.exe
  C:\Windows\System\awNxTGP.exe
  2⤵
  PID:4216
- C:\Windows\System\UxORnXl.exe
  C:\Windows\System\UxORnXl.exe
  2⤵
  PID:6764
- C:\Windows\System\ZjUJTUM.exe
  C:\Windows\System\ZjUJTUM.exe
  2⤵
  PID:7072
- C:\Windows\System\eLplnmW.exe
  C:\Windows\System\eLplnmW.exe
  2⤵
  PID:7052
- C:\Windows\System\HHALEug.exe
  C:\Windows\System\HHALEug.exe
  2⤵
  PID:7116
- C:\Windows\System\UfErfbB.exe
  C:\Windows\System\UfErfbB.exe
  2⤵
  PID:5480
- C:\Windows\System\IvtEBMf.exe
  C:\Windows\System\IvtEBMf.exe
  2⤵
  PID:7120
- C:\Windows\System\fjpFsOY.exe
  C:\Windows\System\fjpFsOY.exe
  2⤵
  PID:6228
- C:\Windows\System\KbBTGtq.exe
  C:\Windows\System\KbBTGtq.exe
  2⤵
  PID:5832
- C:\Windows\System\MzWfNCo.exe
  C:\Windows\System\MzWfNCo.exe
  2⤵
  PID:6072
- C:\Windows\System\otThhKX.exe
  C:\Windows\System\otThhKX.exe
  2⤵
  PID:6204
- C:\Windows\System\gemvZAy.exe
  C:\Windows\System\gemvZAy.exe
  2⤵
  PID:6236
- C:\Windows\System\ZEEqRel.exe
  C:\Windows\System\ZEEqRel.exe
  2⤵
  PID:6776
- C:\Windows\System\EGKGTbk.exe
  C:\Windows\System\EGKGTbk.exe
  2⤵
  PID:6300
- C:\Windows\System\pkkvzYT.exe
  C:\Windows\System\pkkvzYT.exe
  2⤵
  PID:6544
- C:\Windows\System\InDJkqI.exe
  C:\Windows\System\InDJkqI.exe
  2⤵
  PID:6880
- C:\Windows\System\XGewxNB.exe
  C:\Windows\System\XGewxNB.exe
  2⤵
  PID:6388
- C:\Windows\System\IAQpFuu.exe
  C:\Windows\System\IAQpFuu.exe
  2⤵
  PID:7028
- C:\Windows\System\nbZCCYC.exe
  C:\Windows\System\nbZCCYC.exe
  2⤵
  PID:6972
- C:\Windows\System\uqzMKfP.exe
  C:\Windows\System\uqzMKfP.exe
  2⤵
  PID:6504
- C:\Windows\System\BmOTmNF.exe
  C:\Windows\System\BmOTmNF.exe
  2⤵
  PID:6936
- C:\Windows\System\vMJUkNj.exe
  C:\Windows\System\vMJUkNj.exe
  2⤵
  PID:6408
- C:\Windows\System\POisEft.exe
  C:\Windows\System\POisEft.exe
  2⤵
  PID:6592
- C:\Windows\System\vJnbOhj.exe
  C:\Windows\System\vJnbOhj.exe
  2⤵
  PID:6272
- C:\Windows\System\wCYrlJH.exe
  C:\Windows\System\wCYrlJH.exe
  2⤵
  PID:6456
- C:\Windows\System\QiuVXeY.exe
  C:\Windows\System\QiuVXeY.exe
  2⤵
  PID:6752
- C:\Windows\System\ZQqwpzl.exe
  C:\Windows\System\ZQqwpzl.exe
  2⤵
  PID:6836
- C:\Windows\System\KNTasMI.exe
  C:\Windows\System\KNTasMI.exe
  2⤵
  PID:6344
- C:\Windows\System\TjxnzMC.exe
  C:\Windows\System\TjxnzMC.exe
  2⤵
  PID:6688
- C:\Windows\System\mDUNKZt.exe
  C:\Windows\System\mDUNKZt.exe
  2⤵
  PID:6432
- C:\Windows\System\ZZFJfAQ.exe
  C:\Windows\System\ZZFJfAQ.exe
  2⤵
  PID:7004
- C:\Windows\System\FVifydK.exe
  C:\Windows\System\FVifydK.exe
  2⤵
  PID:7104
- C:\Windows\System\ChBLPyE.exe
  C:\Windows\System\ChBLPyE.exe
  2⤵
  PID:7084
- C:\Windows\System\BSBAlsz.exe
  C:\Windows\System\BSBAlsz.exe
  2⤵
  PID:6180
- C:\Windows\System\YSwIjYe.exe
  C:\Windows\System\YSwIjYe.exe
  2⤵
  PID:6772
- C:\Windows\System\UEHnrGv.exe
  C:\Windows\System\UEHnrGv.exe
  2⤵
  PID:6916
- C:\Windows\System\JvgEOUl.exe
  C:\Windows\System\JvgEOUl.exe
  2⤵
  PID:6832
- C:\Windows\System\QZcBBZW.exe
  C:\Windows\System\QZcBBZW.exe
  2⤵
  PID:6428
- C:\Windows\System\aHOEPZx.exe
  C:\Windows\System\aHOEPZx.exe
  2⤵
  PID:6152
- C:\Windows\System\QhAtjpo.exe
  C:\Windows\System\QhAtjpo.exe
  2⤵
  PID:6824
- C:\Windows\System\nIrcGxa.exe
  C:\Windows\System\nIrcGxa.exe
  2⤵
  PID:7164
- C:\Windows\System\jKNIAog.exe
  C:\Windows\System\jKNIAog.exe
  2⤵
  PID:7088
- C:\Windows\System\QtABmpx.exe
  C:\Windows\System\QtABmpx.exe
  2⤵
  PID:7176
- C:\Windows\System\MaMNFnO.exe
  C:\Windows\System\MaMNFnO.exe
  2⤵
  PID:7192
- C:\Windows\System\cGAzOpW.exe
  C:\Windows\System\cGAzOpW.exe
  2⤵
  PID:7208
- C:\Windows\System\EwglZTA.exe
  C:\Windows\System\EwglZTA.exe
  2⤵
  PID:7224
- C:\Windows\System\gmWVJYN.exe
  C:\Windows\System\gmWVJYN.exe
  2⤵
  PID:7240
- C:\Windows\System\sXofPdd.exe
  C:\Windows\System\sXofPdd.exe
  2⤵
  PID:7256
- C:\Windows\System\ecuKQzZ.exe
  C:\Windows\System\ecuKQzZ.exe
  2⤵
  PID:7272
- C:\Windows\System\AZKyMNu.exe
  C:\Windows\System\AZKyMNu.exe
  2⤵
  PID:7288
- C:\Windows\System\BzukVRA.exe
  C:\Windows\System\BzukVRA.exe
  2⤵
  PID:7304
- C:\Windows\System\stCkDVT.exe
  C:\Windows\System\stCkDVT.exe
  2⤵
  PID:7320
- C:\Windows\System\VrcfTfr.exe
  C:\Windows\System\VrcfTfr.exe
  2⤵
  PID:7336
- C:\Windows\System\rNbubbd.exe
  C:\Windows\System\rNbubbd.exe
  2⤵
  PID:7352
- C:\Windows\System\qrJNUBT.exe
  C:\Windows\System\qrJNUBT.exe
  2⤵
  PID:7368
- C:\Windows\System\EHHMCEc.exe
  C:\Windows\System\EHHMCEc.exe
  2⤵
  PID:7392
- C:\Windows\System\aiBZYnT.exe
  C:\Windows\System\aiBZYnT.exe
  2⤵
  PID:7408
- C:\Windows\System\tOIGedW.exe
  C:\Windows\System\tOIGedW.exe
  2⤵
  PID:7424
- C:\Windows\System\mWSYQrQ.exe
  C:\Windows\System\mWSYQrQ.exe
  2⤵
  PID:7440
- C:\Windows\System\sfbqcNV.exe
  C:\Windows\System\sfbqcNV.exe
  2⤵
  PID:7456
- C:\Windows\System\NYNjBDN.exe
  C:\Windows\System\NYNjBDN.exe
  2⤵
  PID:7480
- C:\Windows\System\cDyczHw.exe
  C:\Windows\System\cDyczHw.exe
  2⤵
  PID:7496
- C:\Windows\System\GqlqQjL.exe
  C:\Windows\System\GqlqQjL.exe
  2⤵
  PID:7516
- C:\Windows\System\OSvwzyF.exe
  C:\Windows\System\OSvwzyF.exe
  2⤵
  PID:7536
- C:\Windows\System\PTsThUX.exe
  C:\Windows\System\PTsThUX.exe
  2⤵
  PID:7552
- C:\Windows\System\OoeaLuV.exe
  C:\Windows\System\OoeaLuV.exe
  2⤵
  PID:7568
- C:\Windows\System\VwijGnp.exe
  C:\Windows\System\VwijGnp.exe
  2⤵
  PID:7584
- C:\Windows\System\DpaNqWP.exe
  C:\Windows\System\DpaNqWP.exe
  2⤵
  PID:7600
- C:\Windows\System\NWnaEQu.exe
  C:\Windows\System\NWnaEQu.exe
  2⤵
  PID:7620
- C:\Windows\System\IpzjUNw.exe
  C:\Windows\System\IpzjUNw.exe
  2⤵
  PID:7636
- C:\Windows\System\WWajeZx.exe
  C:\Windows\System\WWajeZx.exe
  2⤵
  PID:7652
- C:\Windows\System\GjQEyUd.exe
  C:\Windows\System\GjQEyUd.exe
  2⤵
  PID:7668
- C:\Windows\System\KCvZLpL.exe
  C:\Windows\System\KCvZLpL.exe
  2⤵
  PID:7684
- C:\Windows\System\mFUcprE.exe
  C:\Windows\System\mFUcprE.exe
  2⤵
  PID:7700
- C:\Windows\System\LRMtcgX.exe
  C:\Windows\System\LRMtcgX.exe
  2⤵
  PID:7716
- C:\Windows\System\tzaABoJ.exe
  C:\Windows\System\tzaABoJ.exe
  2⤵
  PID:7732
- C:\Windows\System\YpKQLOq.exe
  C:\Windows\System\YpKQLOq.exe
  2⤵
  PID:7748
- C:\Windows\System\bmhrsop.exe
  C:\Windows\System\bmhrsop.exe
  2⤵
  PID:7768
- C:\Windows\System\MsYNRLX.exe
  C:\Windows\System\MsYNRLX.exe
  2⤵
  PID:7784
- C:\Windows\System\LbRkkVE.exe
  C:\Windows\System\LbRkkVE.exe
  2⤵
  PID:7800
- C:\Windows\System\OiYejRG.exe
  C:\Windows\System\OiYejRG.exe
  2⤵
  PID:7816
- C:\Windows\System\eIsdfJA.exe
  C:\Windows\System\eIsdfJA.exe
  2⤵
  PID:7832
- C:\Windows\System\iYqrqkd.exe
  C:\Windows\System\iYqrqkd.exe
  2⤵
  PID:7848
- C:\Windows\System\EJSNEFM.exe
  C:\Windows\System\EJSNEFM.exe
  2⤵
  PID:7864
- C:\Windows\System\VTCSeFv.exe
  C:\Windows\System\VTCSeFv.exe
  2⤵
  PID:7884
- C:\Windows\System\RLjrKFv.exe
  C:\Windows\System\RLjrKFv.exe
  2⤵
  PID:7900
- C:\Windows\System\CZMmrox.exe
  C:\Windows\System\CZMmrox.exe
  2⤵
  PID:7916
- C:\Windows\System\FiLChgY.exe
  C:\Windows\System\FiLChgY.exe
  2⤵
  PID:7932
- C:\Windows\System\NlnwaMN.exe
  C:\Windows\System\NlnwaMN.exe
  2⤵
  PID:7948
- C:\Windows\System\NzzMlDl.exe
  C:\Windows\System\NzzMlDl.exe
  2⤵
  PID:7964
- C:\Windows\System\sOPNSeL.exe
  C:\Windows\System\sOPNSeL.exe
  2⤵
  PID:7984
- C:\Windows\System\ZYCAVSQ.exe
  C:\Windows\System\ZYCAVSQ.exe
  2⤵
  PID:8004
- C:\Windows\System\igXAMZN.exe
  C:\Windows\System\igXAMZN.exe
  2⤵
  PID:8020
- C:\Windows\System\mGRwMJf.exe
  C:\Windows\System\mGRwMJf.exe
  2⤵
  PID:8088
- C:\Windows\System\hSDfyAT.exe
  C:\Windows\System\hSDfyAT.exe
  2⤵
  PID:8108
- C:\Windows\System\QCofQyg.exe
  C:\Windows\System\QCofQyg.exe
  2⤵
  PID:8124
- C:\Windows\System\XPvnYRM.exe
  C:\Windows\System\XPvnYRM.exe
  2⤵
  PID:8140
- C:\Windows\System\RkkRIJS.exe
  C:\Windows\System\RkkRIJS.exe
  2⤵
  PID:8156
- C:\Windows\System\AadYleI.exe
  C:\Windows\System\AadYleI.exe
  2⤵
  PID:8172
- C:\Windows\System\JuiKjrW.exe
  C:\Windows\System\JuiKjrW.exe
  2⤵
  PID:8188
- C:\Windows\System\TOUdfKV.exe
  C:\Windows\System\TOUdfKV.exe
  2⤵
  PID:7188
- C:\Windows\System\vnDVKwh.exe
  C:\Windows\System\vnDVKwh.exe
  2⤵
  PID:6240
- C:\Windows\System\SnxLKdC.exe
  C:\Windows\System\SnxLKdC.exe
  2⤵
  PID:7216
- C:\Windows\System\CRFSNgm.exe
  C:\Windows\System\CRFSNgm.exe
  2⤵
  PID:7312
- C:\Windows\System\nJyCqqS.exe
  C:\Windows\System\nJyCqqS.exe
  2⤵
  PID:7348
- C:\Windows\System\cIzzJiG.exe
  C:\Windows\System\cIzzJiG.exe
  2⤵
  PID:6668
- C:\Windows\System\FaiBfsP.exe
  C:\Windows\System\FaiBfsP.exe
  2⤵
  PID:6372
- C:\Windows\System\YBOiVus.exe
  C:\Windows\System\YBOiVus.exe
  2⤵
  PID:5972
- C:\Windows\System\NBMRTgW.exe
  C:\Windows\System\NBMRTgW.exe
  2⤵
  PID:6384
- C:\Windows\System\ABRRRxM.exe
  C:\Windows\System\ABRRRxM.exe
  2⤵
  PID:7048
- C:\Windows\System\MCXhEbP.exe
  C:\Windows\System\MCXhEbP.exe
  2⤵
  PID:7264
- C:\Windows\System\kUQhVGc.exe
  C:\Windows\System\kUQhVGc.exe
  2⤵
  PID:7300
- C:\Windows\System\VqjFubz.exe
  C:\Windows\System\VqjFubz.exe
  2⤵
  PID:7364
- C:\Windows\System\MmZDFnk.exe
  C:\Windows\System\MmZDFnk.exe
  2⤵
  PID:7436
- C:\Windows\System\zDBzVYv.exe
  C:\Windows\System\zDBzVYv.exe
  2⤵
  PID:7504
- C:\Windows\System\SDlWuMm.exe
  C:\Windows\System\SDlWuMm.exe
  2⤵
  PID:7380
- C:\Windows\System\wbwgDXG.exe
  C:\Windows\System\wbwgDXG.exe
  2⤵
  PID:7420
- C:\Windows\System\AnlbRHu.exe
  C:\Windows\System\AnlbRHu.exe
  2⤵
  PID:7492
- C:\Windows\System\TrRTqhH.exe
  C:\Windows\System\TrRTqhH.exe
  2⤵
  PID:7560
- C:\Windows\System\hzooCHX.exe
  C:\Windows\System\hzooCHX.exe
  2⤵
  PID:7612
- C:\Windows\System\FOlRfFj.exe
  C:\Windows\System\FOlRfFj.exe
  2⤵
  PID:7648
- C:\Windows\System\GOBgsyl.exe
  C:\Windows\System\GOBgsyl.exe
  2⤵
  PID:7664
- C:\Windows\System\WAosnkg.exe
  C:\Windows\System\WAosnkg.exe
  2⤵
  PID:7692
- C:\Windows\System\ZMwtAHo.exe
  C:\Windows\System\ZMwtAHo.exe
  2⤵
  PID:7724
- C:\Windows\System\aHtYAKw.exe
  C:\Windows\System\aHtYAKw.exe
  2⤵
  PID:7780
- C:\Windows\System\Jkoyzep.exe
  C:\Windows\System\Jkoyzep.exe
  2⤵
  PID:7844
- C:\Windows\System\erTGXgI.exe
  C:\Windows\System\erTGXgI.exe
  2⤵
  PID:7860
- C:\Windows\System\yNTTfci.exe
  C:\Windows\System\yNTTfci.exe
  2⤵
  PID:7828
- C:\Windows\System\ygKUuXU.exe
  C:\Windows\System\ygKUuXU.exe
  2⤵
  PID:7944
- C:\Windows\System\ognAUun.exe
  C:\Windows\System\ognAUun.exe
  2⤵
  PID:8012
- C:\Windows\System\sHDPBBX.exe
  C:\Windows\System\sHDPBBX.exe
  2⤵
  PID:7924
- C:\Windows\System\UTVGvJI.exe
  C:\Windows\System\UTVGvJI.exe
  2⤵
  PID:8104
- C:\Windows\System\cBbZnHE.exe
  C:\Windows\System\cBbZnHE.exe
  2⤵
  PID:8040
- C:\Windows\System\NqytZsA.exe
  C:\Windows\System\NqytZsA.exe
  2⤵
  PID:6724
- C:\Windows\System\RsAWQcC.exe
  C:\Windows\System\RsAWQcC.exe
  2⤵
  PID:8028
- C:\Windows\System\DtBelay.exe
  C:\Windows\System\DtBelay.exe
  2⤵
  PID:8036
- C:\Windows\System\TEXaBgm.exe
  C:\Windows\System\TEXaBgm.exe
  2⤵
  PID:8056
- C:\Windows\System\bbyGAOi.exe
  C:\Windows\System\bbyGAOi.exe
  2⤵
  PID:8076
- C:\Windows\System\NrssLhc.exe
  C:\Windows\System\NrssLhc.exe
  2⤵
  PID:8116
- C:\Windows\System\vIgFAqn.exe
  C:\Windows\System\vIgFAqn.exe
  2⤵
  PID:8184
- C:\Windows\System\TqInPgy.exe
  C:\Windows\System\TqInPgy.exe
  2⤵
  PID:6148
- C:\Windows\System\wgPWaYl.exe
  C:\Windows\System\wgPWaYl.exe
  2⤵
  PID:7220
- C:\Windows\System\oIyoakC.exe
  C:\Windows\System\oIyoakC.exe
  2⤵
  PID:6744
- C:\Windows\System\spmVQzl.exe
  C:\Windows\System\spmVQzl.exe
  2⤵
  PID:7236
- C:\Windows\System\YncndAI.exe
  C:\Windows\System\YncndAI.exe
  2⤵
  PID:7472
- C:\Windows\System\gTSmEaV.exe
  C:\Windows\System\gTSmEaV.exe
  2⤵
  PID:7476
- C:\Windows\System\PLtLCXA.exe
  C:\Windows\System\PLtLCXA.exe
  2⤵
  PID:7296
- C:\Windows\System\PYSGZNI.exe
  C:\Windows\System\PYSGZNI.exe
  2⤵
  PID:7416
- C:\Windows\System\UiXdQWo.exe
  C:\Windows\System\UiXdQWo.exe
  2⤵
  PID:7576
- C:\Windows\System\NPppIEN.exe
  C:\Windows\System\NPppIEN.exe
  2⤵
  PID:7756
- C:\Windows\System\ViDEQbl.exe
  C:\Windows\System\ViDEQbl.exe
  2⤵
  PID:7764
- C:\Windows\System\EVEfNzH.exe
  C:\Windows\System\EVEfNzH.exe
  2⤵
  PID:7744
- C:\Windows\System\NyZQPUR.exe
  C:\Windows\System\NyZQPUR.exe
  2⤵
  PID:7912
- C:\Windows\System\JQdMglq.exe
  C:\Windows\System\JQdMglq.exe
  2⤵
  PID:7896
- C:\Windows\System\RlqFDJq.exe
  C:\Windows\System\RlqFDJq.exe
  2⤵
  PID:8072
- C:\Windows\System\RzpPweX.exe
  C:\Windows\System\RzpPweX.exe
  2⤵
  PID:8052
- C:\Windows\System\xFOWTHQ.exe
  C:\Windows\System\xFOWTHQ.exe
  2⤵
  PID:7608
- C:\Windows\System\hYxqCdC.exe
  C:\Windows\System\hYxqCdC.exe
  2⤵
  PID:7564
- C:\Windows\System\aCVCeaK.exe
  C:\Windows\System\aCVCeaK.exe
  2⤵
  PID:6956
- C:\Windows\System\NWuFVyP.exe
  C:\Windows\System\NWuFVyP.exe
  2⤵
  PID:7892
- C:\Windows\System\hfEmKbi.exe
  C:\Windows\System\hfEmKbi.exe
  2⤵
  PID:8168
- C:\Windows\System\pJTQYJo.exe
  C:\Windows\System\pJTQYJo.exe
  2⤵
  PID:7960
- C:\Windows\System\ujOqcAv.exe
  C:\Windows\System\ujOqcAv.exe
  2⤵
  PID:7248
- C:\Windows\System\rIlRtmA.exe
  C:\Windows\System\rIlRtmA.exe
  2⤵
  PID:8180
- C:\Windows\System\qJsCaTU.exe
  C:\Windows\System\qJsCaTU.exe
  2⤵
  PID:7156
- C:\Windows\System\nyxpDma.exe
  C:\Windows\System\nyxpDma.exe
  2⤵
  PID:1524
- C:\Windows\System\Xvejkij.exe
  C:\Windows\System\Xvejkij.exe
  2⤵
  PID:7468
- C:\Windows\System\SOOJsRo.exe
  C:\Windows\System\SOOJsRo.exe
  2⤵
  PID:5672
- C:\Windows\System\uboSdrI.exe
  C:\Windows\System\uboSdrI.exe
  2⤵
  PID:7344
- C:\Windows\System\mpWvYWO.exe
  C:\Windows\System\mpWvYWO.exe
  2⤵
  PID:8132
- C:\Windows\System\XAADcHW.exe
  C:\Windows\System\XAADcHW.exe
  2⤵
  PID:6288
- C:\Windows\System\DDGoOrG.exe
  C:\Windows\System\DDGoOrG.exe
  2⤵
  PID:7660
- C:\Windows\System\rUegKlF.exe
  C:\Windows\System\rUegKlF.exe
  2⤵
  PID:7928
- C:\Windows\System\HEYLxDO.exe
  C:\Windows\System\HEYLxDO.exe
  2⤵
  PID:7232
- C:\Windows\System\PmxSqNj.exe
  C:\Windows\System\PmxSqNj.exe
  2⤵
  PID:804
- C:\Windows\System\KzzdPOn.exe
  C:\Windows\System\KzzdPOn.exe
  2⤵
  PID:7528
- C:\Windows\System\FHLrZqe.exe
  C:\Windows\System\FHLrZqe.exe
  2⤵
  PID:7252
- C:\Windows\System\kcxQwrk.exe
  C:\Windows\System\kcxQwrk.exe
  2⤵
  PID:7172
- C:\Windows\System\jBYYxbU.exe
  C:\Windows\System\jBYYxbU.exe
  2⤵
  PID:7708
- C:\Windows\System\hSiCIAU.exe
  C:\Windows\System\hSiCIAU.exe
  2⤵
  PID:8148
- C:\Windows\System\AeyOOhd.exe
  C:\Windows\System\AeyOOhd.exe
  2⤵
  PID:6012
- C:\Windows\System\kDKuDiU.exe
  C:\Windows\System\kDKuDiU.exe
  2⤵
  PID:7452
- C:\Windows\System\gzqSWHW.exe
  C:\Windows\System\gzqSWHW.exe
  2⤵
  PID:7796
- C:\Windows\System\TADvthW.exe
  C:\Windows\System\TADvthW.exe
  2⤵
  PID:7980
- C:\Windows\System\ZghImiF.exe
  C:\Windows\System\ZghImiF.exe
  2⤵
  PID:2452
- C:\Windows\System\iHnapGQ.exe
  C:\Windows\System\iHnapGQ.exe
  2⤵
  PID:7184
- C:\Windows\System\AEdfulu.exe
  C:\Windows\System\AEdfulu.exe
  2⤵
  PID:8152
- C:\Windows\System\XESIqyf.exe
  C:\Windows\System\XESIqyf.exe
  2⤵
  PID:8200
- C:\Windows\System\PpqbWXq.exe
  C:\Windows\System\PpqbWXq.exe
  2⤵
  PID:8216
- C:\Windows\System\hOGDHID.exe
  C:\Windows\System\hOGDHID.exe
  2⤵
  PID:8236
- C:\Windows\System\nzOrdnk.exe
  C:\Windows\System\nzOrdnk.exe
  2⤵
  PID:8252
- C:\Windows\System\wRhsfGc.exe
  C:\Windows\System\wRhsfGc.exe
  2⤵
  PID:8268
- C:\Windows\System\jPfgnVy.exe
  C:\Windows\System\jPfgnVy.exe
  2⤵
  PID:8284
- C:\Windows\System\KHtXgUk.exe
  C:\Windows\System\KHtXgUk.exe
  2⤵
  PID:8324
- C:\Windows\System\JXSqoqr.exe
  C:\Windows\System\JXSqoqr.exe
  2⤵
  PID:8496
- C:\Windows\System\tstvSJf.exe
  C:\Windows\System\tstvSJf.exe
  2⤵
  PID:8512
- C:\Windows\System\azjFTFY.exe
  C:\Windows\System\azjFTFY.exe
  2⤵
  PID:8532
- C:\Windows\System\tQXauym.exe
  C:\Windows\System\tQXauym.exe
  2⤵
  PID:8644
- C:\Windows\System\UWUWNUy.exe
  C:\Windows\System\UWUWNUy.exe
  2⤵
  PID:8680
- C:\Windows\System\rNZifch.exe
  C:\Windows\System\rNZifch.exe
  2⤵
  PID:8696
- C:\Windows\System\nfHuabu.exe
  C:\Windows\System\nfHuabu.exe
  2⤵
  PID:8712
- C:\Windows\System\skWMsDp.exe
  C:\Windows\System\skWMsDp.exe
  2⤵
  PID:8728
- C:\Windows\System\FCbiWeq.exe
  C:\Windows\System\FCbiWeq.exe
  2⤵
  PID:8744
- C:\Windows\System\lECoMBN.exe
  C:\Windows\System\lECoMBN.exe
  2⤵
  PID:8760
- C:\Windows\System\jOUyxzQ.exe
  C:\Windows\System\jOUyxzQ.exe
  2⤵
  PID:8848
- C:\Windows\System\UIEokQV.exe
  C:\Windows\System\UIEokQV.exe
  2⤵
  PID:8928
- C:\Windows\System\LwETVqo.exe
  C:\Windows\System\LwETVqo.exe
  2⤵
  PID:8980
- C:\Windows\System\nhflThz.exe
  C:\Windows\System\nhflThz.exe
  2⤵
  PID:8996
- C:\Windows\System\IKMuwrA.exe
  C:\Windows\System\IKMuwrA.exe
  2⤵
  PID:9012
- C:\Windows\System\quEMCIR.exe
  C:\Windows\System\quEMCIR.exe
  2⤵
  PID:9028
- C:\Windows\System\rQgWedJ.exe
  C:\Windows\System\rQgWedJ.exe
  2⤵
  PID:9044
- C:\Windows\System\Vmonkiw.exe
  C:\Windows\System\Vmonkiw.exe
  2⤵
  PID:9060
- C:\Windows\System\AuFJUIZ.exe
  C:\Windows\System\AuFJUIZ.exe
  2⤵
  PID:9080
- C:\Windows\System\YCNxefz.exe
  C:\Windows\System\YCNxefz.exe
  2⤵
  PID:9096
- C:\Windows\System\QMDkfEj.exe
  C:\Windows\System\QMDkfEj.exe
  2⤵
  PID:9116
- C:\Windows\System\GBHnIaX.exe
  C:\Windows\System\GBHnIaX.exe
  2⤵
  PID:9140
- C:\Windows\System\GweecGl.exe
  C:\Windows\System\GweecGl.exe
  2⤵
  PID:9160
- C:\Windows\System\JEUxKxi.exe
  C:\Windows\System\JEUxKxi.exe
  2⤵
  PID:9180
- C:\Windows\System\gdVjcUy.exe
  C:\Windows\System\gdVjcUy.exe
  2⤵
  PID:9200
- C:\Windows\System\gdqKWcR.exe
  C:\Windows\System\gdqKWcR.exe
  2⤵
  PID:8208
- C:\Windows\System\BNmFcSp.exe
  C:\Windows\System\BNmFcSp.exe
  2⤵
  PID:8248
- C:\Windows\System\WvgSYJb.exe
  C:\Windows\System\WvgSYJb.exe
  2⤵
  PID:8196
- C:\Windows\System\rPJxcuk.exe
  C:\Windows\System\rPJxcuk.exe
  2⤵
  PID:1344
- C:\Windows\System\ojSdHGo.exe
  C:\Windows\System\ojSdHGo.exe
  2⤵
  PID:2660
- C:\Windows\System\tARPfJd.exe
  C:\Windows\System\tARPfJd.exe
  2⤵
  PID:7512
- C:\Windows\System\lqkKfNJ.exe
  C:\Windows\System\lqkKfNJ.exe
  2⤵
  PID:2920
- C:\Windows\System\NKZyTtT.exe
  C:\Windows\System\NKZyTtT.exe
  2⤵
  PID:8384
- C:\Windows\System\wZqBxDR.exe
  C:\Windows\System\wZqBxDR.exe
  2⤵
  PID:8416
- C:\Windows\System\pDFFUVe.exe
  C:\Windows\System\pDFFUVe.exe
  2⤵
  PID:8436
- C:\Windows\System\avKTkYU.exe
  C:\Windows\System\avKTkYU.exe
  2⤵
  PID:8456
- C:\Windows\System\YHdnURa.exe
  C:\Windows\System\YHdnURa.exe
  2⤵
  PID:8484
- C:\Windows\System\xYuGbjX.exe
  C:\Windows\System\xYuGbjX.exe
  2⤵
  PID:8524
- C:\Windows\System\HrhBssW.exe
  C:\Windows\System\HrhBssW.exe
  2⤵
  PID:2336
- C:\Windows\System\LqGACnu.exe
  C:\Windows\System\LqGACnu.exe
  2⤵
  PID:8544
- C:\Windows\System\YwEZZOX.exe
  C:\Windows\System\YwEZZOX.exe
  2⤵
  PID:8668
- C:\Windows\System\POTzOlX.exe
  C:\Windows\System\POTzOlX.exe
  2⤵
  PID:8736
- C:\Windows\System\EasUAHH.exe
  C:\Windows\System\EasUAHH.exe
  2⤵
  PID:8772
- C:\Windows\System\PgvYJtp.exe
  C:\Windows\System\PgvYJtp.exe
  2⤵
  PID:8788
- C:\Windows\System\XRYDWAn.exe
  C:\Windows\System\XRYDWAn.exe
  2⤵
  PID:8804
- C:\Windows\System\XjBFVxQ.exe
  C:\Windows\System\XjBFVxQ.exe
  2⤵
  PID:8820
- C:\Windows\System\gMvcfha.exe
  C:\Windows\System\gMvcfha.exe
  2⤵
  PID:8552
- C:\Windows\System\EceiCko.exe
  C:\Windows\System\EceiCko.exe
  2⤵
  PID:8576
- C:\Windows\System\WYrdlJF.exe
  C:\Windows\System\WYrdlJF.exe
  2⤵
  PID:8592
- C:\Windows\System\DXsSEqp.exe
  C:\Windows\System\DXsSEqp.exe
  2⤵
  PID:8612
- C:\Windows\System\MqYwDsj.exe
  C:\Windows\System\MqYwDsj.exe
  2⤵
  PID:8632
- C:\Windows\System\hYuIlBX.exe
  C:\Windows\System\hYuIlBX.exe
  2⤵
  PID:8560
- C:\Windows\System\RSwxoGM.exe
  C:\Windows\System\RSwxoGM.exe
  2⤵
  PID:8832
- C:\Windows\System\IjScBoD.exe
  C:\Windows\System\IjScBoD.exe
  2⤵
  PID:8844
- C:\Windows\System\DfYuWOA.exe
  C:\Windows\System\DfYuWOA.exe
  2⤵
  PID:8960
- C:\Windows\System\jbXhwaJ.exe
  C:\Windows\System\jbXhwaJ.exe
  2⤵
  PID:9004
- C:\Windows\System\llpJamd.exe
  C:\Windows\System\llpJamd.exe
  2⤵
  PID:9040
- C:\Windows\System\lwdbeSR.exe
  C:\Windows\System\lwdbeSR.exe
  2⤵
  PID:8868
- C:\Windows\System\hfBtuxv.exe
  C:\Windows\System\hfBtuxv.exe
  2⤵
  PID:8992
- C:\Windows\System\fKuTDBC.exe
  C:\Windows\System\fKuTDBC.exe
  2⤵
  PID:8892
- C:\Windows\System\gMmpkns.exe
  C:\Windows\System\gMmpkns.exe
  2⤵
  PID:8916
- C:\Windows\System\kbLIXwv.exe
  C:\Windows\System\kbLIXwv.exe
  2⤵
  PID:8872
- C:\Windows\System\fjHOVXR.exe
  C:\Windows\System\fjHOVXR.exe
  2⤵
  PID:9056
- C:\Windows\System\VKxaSwR.exe
  C:\Windows\System\VKxaSwR.exe
  2⤵
  PID:9136
- C:\Windows\System\UxlIPsc.exe
  C:\Windows\System\UxlIPsc.exe
  2⤵
  PID:9152
- C:\Windows\System\HxKxvOG.exe
  C:\Windows\System\HxKxvOG.exe
  2⤵
  PID:9188
- C:\Windows\System\ZSlidIA.exe
  C:\Windows\System\ZSlidIA.exe
  2⤵
  PID:1256
- C:\Windows\System\njQVkAc.exe
  C:\Windows\System\njQVkAc.exe
  2⤵
  PID:9212
- C:\Windows\System\zrNSMGN.exe
  C:\Windows\System\zrNSMGN.exe
  2⤵
  PID:7644
- C:\Windows\System\sGlFedJ.exe
  C:\Windows\System\sGlFedJ.exe
  2⤵
  PID:2072
- C:\Windows\System\tPmYDZj.exe
  C:\Windows\System\tPmYDZj.exe
  2⤵
  PID:8232
- C:\Windows\System\qFnnKBu.exe
  C:\Windows\System\qFnnKBu.exe
  2⤵
  PID:8396
- C:\Windows\System\CTNHWrZ.exe
  C:\Windows\System\CTNHWrZ.exe
  2⤵
  PID:8448
- C:\Windows\System\ecaCvqt.exe
  C:\Windows\System\ecaCvqt.exe
  2⤵
  PID:8652
- C:\Windows\System\mOxiykG.exe
  C:\Windows\System\mOxiykG.exe
  2⤵
  PID:8348
- C:\Windows\System\FVpUKve.exe
  C:\Windows\System\FVpUKve.exe
  2⤵
  PID:8292
- C:\Windows\System\XmsLFGR.exe
  C:\Windows\System\XmsLFGR.exe
  2⤵
  PID:8444
- C:\Windows\System\lWaEjGO.exe
  C:\Windows\System\lWaEjGO.exe
  2⤵
  PID:8352
- C:\Windows\System\SufkyyE.exe
  C:\Windows\System\SufkyyE.exe
  2⤵
  PID:8424
- C:\Windows\System\dVQKXwx.exe
  C:\Windows\System\dVQKXwx.exe
  2⤵
  PID:8504
- C:\Windows\System\AOhQqHT.exe
  C:\Windows\System\AOhQqHT.exe
  2⤵
  PID:8768
- C:\Windows\System\kHWJQBe.exe
  C:\Windows\System\kHWJQBe.exe
  2⤵
  PID:8584
- C:\Windows\System\IJsqOZA.exe
  C:\Windows\System\IJsqOZA.exe
  2⤵
  PID:8572
- C:\Windows\System\YqUpsOn.exe
  C:\Windows\System\YqUpsOn.exe
  2⤵
  PID:8588
- C:\Windows\System\rNDzJeZ.exe
  C:\Windows\System\rNDzJeZ.exe
  2⤵
  PID:8692
- C:\Windows\System\qzJGUUQ.exe
  C:\Windows\System\qzJGUUQ.exe
  2⤵
  PID:8884
- C:\Windows\System\xArjeJq.exe
  C:\Windows\System\xArjeJq.exe
  2⤵
  PID:8908
- C:\Windows\System\awQOaGR.exe
  C:\Windows\System\awQOaGR.exe
  2⤵
  PID:8940
- C:\Windows\System\Cfbkmzf.exe
  C:\Windows\System\Cfbkmzf.exe
  2⤵
  PID:9176
- C:\Windows\System\wfYexUO.exe
  C:\Windows\System\wfYexUO.exe
  2⤵
  PID:9108
- C:\Windows\System\ocbErAG.exe
  C:\Windows\System\ocbErAG.exe
  2⤵
  PID:8856
- C:\Windows\System\trSSuQI.exe
  C:\Windows\System\trSSuQI.exe
  2⤵
  PID:8224
- C:\Windows\System\TeqpcXl.exe
  C:\Windows\System\TeqpcXl.exe
  2⤵
  PID:9148
- C:\Windows\System\MyVgNpJ.exe
  C:\Windows\System\MyVgNpJ.exe
  2⤵
  PID:8048
- C:\Windows\System\YjduVbY.exe
  C:\Windows\System\YjduVbY.exe
  2⤵
  PID:8332
- C:\Windows\System\xeCewEV.exe
  C:\Windows\System\xeCewEV.exe
  2⤵
  PID:8340
- C:\Windows\System\nvLJSeE.exe
  C:\Windows\System\nvLJSeE.exe
  2⤵
  PID:8428
- C:\Windows\System\exbRwVK.exe
  C:\Windows\System\exbRwVK.exe
  2⤵
  PID:8540
- C:\Windows\System\HJIwoFj.exe
  C:\Windows\System\HJIwoFj.exe
  2⤵
  PID:8388
- C:\Windows\System\TNyQtlj.exe
  C:\Windows\System\TNyQtlj.exe
  2⤵
  PID:8664
- C:\Windows\System\hGsICeN.exe
  C:\Windows\System\hGsICeN.exe
  2⤵
  PID:9072
- C:\Windows\System\JEVvCov.exe
  C:\Windows\System\JEVvCov.exe
  2⤵
  PID:8828
- C:\Windows\System\estvzAa.exe
  C:\Windows\System\estvzAa.exe
  2⤵
  PID:8624
- C:\Windows\System\JvcBlyY.exe
  C:\Windows\System\JvcBlyY.exe
  2⤵
  PID:7284
- C:\Windows\System\jaIAXcU.exe
  C:\Windows\System\jaIAXcU.exe
  2⤵
  PID:9092
- C:\Windows\System\rrZaApX.exe
  C:\Windows\System\rrZaApX.exe
  2⤵
  PID:8676
- C:\Windows\System\KDnYAeZ.exe
  C:\Windows\System\KDnYAeZ.exe
  2⤵
  PID:8468
- C:\Windows\System\COJsNCh.exe
  C:\Windows\System\COJsNCh.exe
  2⤵
  PID:8860
- C:\Windows\System\XsItcIm.exe
  C:\Windows\System\XsItcIm.exe
  2⤵
  PID:8316
- C:\Windows\System\tSGGXoe.exe
  C:\Windows\System\tSGGXoe.exe
  2⤵
  PID:9052
- C:\Windows\System\dwNPSnP.exe
  C:\Windows\System\dwNPSnP.exe
  2⤵
  PID:8372
- C:\Windows\System\gRtFNLb.exe
  C:\Windows\System\gRtFNLb.exe
  2⤵
  PID:9328
- C:\Windows\System\uFALtDI.exe
  C:\Windows\System\uFALtDI.exe
  2⤵
  PID:9360
- C:\Windows\System\ChzWGiZ.exe
  C:\Windows\System\ChzWGiZ.exe
  2⤵
  PID:9376
- C:\Windows\System\UkIzeNM.exe
  C:\Windows\System\UkIzeNM.exe
  2⤵
  PID:9392
- C:\Windows\System\BrFonbH.exe
  C:\Windows\System\BrFonbH.exe
  2⤵
  PID:9408
- C:\Windows\System\WpERlrK.exe
  C:\Windows\System\WpERlrK.exe
  2⤵
  PID:9424
- C:\Windows\System\LYUchSo.exe
  C:\Windows\System\LYUchSo.exe
  2⤵
  PID:9456
- C:\Windows\System\AAKudKE.exe
  C:\Windows\System\AAKudKE.exe
  2⤵
  PID:9472
- C:\Windows\System\HWUkhlW.exe
  C:\Windows\System\HWUkhlW.exe
  2⤵
  PID:9488
- C:\Windows\System\bwtRViV.exe
  C:\Windows\System\bwtRViV.exe
  2⤵
  PID:9504
- C:\Windows\System\LEecNcN.exe
  C:\Windows\System\LEecNcN.exe
  2⤵
  PID:9520
- C:\Windows\System\aFxZgZX.exe
  C:\Windows\System\aFxZgZX.exe
  2⤵
  PID:9536
- C:\Windows\System\DreSPWm.exe
  C:\Windows\System\DreSPWm.exe
  2⤵
  PID:9596
- C:\Windows\System\lfkfdFO.exe
  C:\Windows\System\lfkfdFO.exe
  2⤵
  PID:9692
- C:\Windows\System\KDsajZf.exe
  C:\Windows\System\KDsajZf.exe
  2⤵
  PID:9824
- C:\Windows\System\wwCjDwW.exe
  C:\Windows\System\wwCjDwW.exe
  2⤵
  PID:9840
- C:\Windows\System\TEBmOZF.exe
  C:\Windows\System\TEBmOZF.exe
  2⤵
  PID:9856
- C:\Windows\System\BEPBORB.exe
  C:\Windows\System\BEPBORB.exe
  2⤵
  PID:9872
- C:\Windows\System\dVNcTNM.exe
  C:\Windows\System\dVNcTNM.exe
  2⤵
  PID:9888
- C:\Windows\System\obYXOcn.exe
  C:\Windows\System\obYXOcn.exe
  2⤵
  PID:9916
- C:\Windows\System\vccflVY.exe
  C:\Windows\System\vccflVY.exe
  2⤵
  PID:9932
- C:\Windows\System\SUqohhj.exe
  C:\Windows\System\SUqohhj.exe
  2⤵
  PID:9952
- C:\Windows\System\QBrjxSG.exe
  C:\Windows\System\QBrjxSG.exe
  2⤵
  PID:9968
- C:\Windows\System\ZePlRLW.exe
  C:\Windows\System\ZePlRLW.exe
  2⤵
  PID:9984
- C:\Windows\System\XFlDTQm.exe
  C:\Windows\System\XFlDTQm.exe
  2⤵
  PID:10004
- C:\Windows\System\CNKyhXp.exe
  C:\Windows\System\CNKyhXp.exe
  2⤵
  PID:10020
- C:\Windows\System\YUuSYpp.exe
  C:\Windows\System\YUuSYpp.exe
  2⤵
  PID:10036
- C:\Windows\System\aijDRiz.exe
  C:\Windows\System\aijDRiz.exe
  2⤵
  PID:10052
- C:\Windows\System\tHsfwWp.exe
  C:\Windows\System\tHsfwWp.exe
  2⤵
  PID:10068
- C:\Windows\System\ztsPEXR.exe
  C:\Windows\System\ztsPEXR.exe
  2⤵
  PID:10084
- C:\Windows\System\IxNdALf.exe
  C:\Windows\System\IxNdALf.exe
  2⤵
  PID:10104
- C:\Windows\System\GghhRMK.exe
  C:\Windows\System\GghhRMK.exe
  2⤵
  PID:10120
- C:\Windows\System\DnRZReP.exe
  C:\Windows\System\DnRZReP.exe
  2⤵
  PID:10144
- C:\Windows\System\sGmcGhC.exe
  C:\Windows\System\sGmcGhC.exe
  2⤵
  PID:10180
- C:\Windows\System\yhWAnyY.exe
  C:\Windows\System\yhWAnyY.exe
  2⤵
  PID:10196
- C:\Windows\System\wYgwCHv.exe
  C:\Windows\System\wYgwCHv.exe
  2⤵
  PID:10212
- C:\Windows\System\vvzmqoc.exe
  C:\Windows\System\vvzmqoc.exe
  2⤵
  PID:10228
- C:\Windows\System\emmAwCa.exe
  C:\Windows\System\emmAwCa.exe
  2⤵
  PID:8904
- C:\Windows\System\kuivwWX.exe
  C:\Windows\System\kuivwWX.exe
  2⤵
  PID:8720
- C:\Windows\System\nuWDDfh.exe
  C:\Windows\System\nuWDDfh.exe
  2⤵
  PID:8320
- C:\Windows\System\vDpMEFH.exe
  C:\Windows\System\vDpMEFH.exe
  2⤵
  PID:9132
- C:\Windows\System\xjsAfpC.exe
  C:\Windows\System\xjsAfpC.exe
  2⤵
  PID:9336
- C:\Windows\System\EkTHWtO.exe
  C:\Windows\System\EkTHWtO.exe
  2⤵
  PID:9104
- C:\Windows\System\oslYYDS.exe
  C:\Windows\System\oslYYDS.exe
  2⤵
  PID:8812
- C:\Windows\System\iZbXYPH.exe
  C:\Windows\System\iZbXYPH.exe
  2⤵
  PID:8464
- C:\Windows\System\oOsyjaR.exe
  C:\Windows\System\oOsyjaR.exe
  2⤵
  PID:9228
- C:\Windows\System\IGceEEk.exe
  C:\Windows\System\IGceEEk.exe
  2⤵
  PID:9316
- C:\Windows\System\knfUrsF.exe
  C:\Windows\System\knfUrsF.exe
  2⤵
  PID:9432
- C:\Windows\System\SGtaLkU.exe
  C:\Windows\System\SGtaLkU.exe
  2⤵
  PID:9264
- C:\Windows\System\nRpPWDX.exe
  C:\Windows\System\nRpPWDX.exe
  2⤵
  PID:9292
- C:\Windows\System\kdGaotB.exe
  C:\Windows\System\kdGaotB.exe
  2⤵
  PID:9312
- C:\Windows\System\ibjDFqE.exe
  C:\Windows\System\ibjDFqE.exe
  2⤵
  PID:9500
- C:\Windows\System\idGfbyf.exe
  C:\Windows\System\idGfbyf.exe
  2⤵
  PID:9528
- C:\Windows\System\LhMNOcO.exe
  C:\Windows\System\LhMNOcO.exe
  2⤵
  PID:9484
- C:\Windows\System\AiHNcQx.exe
  C:\Windows\System\AiHNcQx.exe
  2⤵
  PID:9604
- C:\Windows\System\jLgvLsj.exe
  C:\Windows\System\jLgvLsj.exe
  2⤵
  PID:9620
- C:\Windows\System\WLCzTbS.exe
  C:\Windows\System\WLCzTbS.exe
  2⤵
  PID:9440
- C:\Windows\System\klHvIyT.exe
  C:\Windows\System\klHvIyT.exe
  2⤵
  PID:9572
- C:\Windows\System\bpIWwue.exe
  C:\Windows\System\bpIWwue.exe
  2⤵
  PID:9584
- C:\Windows\System\vVwxRMm.exe
  C:\Windows\System\vVwxRMm.exe
  2⤵
  PID:9664
- C:\Windows\System\uJqvlDS.exe
  C:\Windows\System\uJqvlDS.exe
  2⤵
  PID:9688
- C:\Windows\System\nedUwmf.exe
  C:\Windows\System\nedUwmf.exe
  2⤵
  PID:9648
- C:\Windows\System\yFfTZbt.exe
  C:\Windows\System\yFfTZbt.exe
  2⤵
  PID:9672
- C:\Windows\System\YxPpRxp.exe
  C:\Windows\System\YxPpRxp.exe
  2⤵
  PID:9864
- C:\Windows\System\tBgknkJ.exe
  C:\Windows\System\tBgknkJ.exe
  2⤵
  PID:9748
- C:\Windows\System\FsQhxZL.exe
  C:\Windows\System\FsQhxZL.exe
  2⤵
  PID:9900
- C:\Windows\System\VarbGns.exe
  C:\Windows\System\VarbGns.exe
  2⤵
  PID:9740
- C:\Windows\System\kXFjsMV.exe
  C:\Windows\System\kXFjsMV.exe
  2⤵
  PID:9768
- C:\Windows\System\uTPjmlt.exe
  C:\Windows\System\uTPjmlt.exe
  2⤵
  PID:9964
- C:\Windows\System\jAUuXSW.exe
  C:\Windows\System\jAUuXSW.exe
  2⤵
  PID:9796
- C:\Windows\System\IiFGFLL.exe
  C:\Windows\System\IiFGFLL.exe
  2⤵
  PID:9812
- C:\Windows\System\PGPxZqZ.exe
  C:\Windows\System\PGPxZqZ.exe
  2⤵
  PID:10028
- C:\Windows\System\wCZhItV.exe
  C:\Windows\System\wCZhItV.exe
  2⤵
  PID:10032
- C:\Windows\System\wlTIxOm.exe
  C:\Windows\System\wlTIxOm.exe
  2⤵
  PID:9912
- C:\Windows\System\BHnBBsp.exe
  C:\Windows\System\BHnBBsp.exe
  2⤵
  PID:9948
- C:\Windows\System\kOFVtnS.exe
  C:\Windows\System\kOFVtnS.exe
  2⤵
  PID:1376
- C:\Windows\System\dapHXrQ.exe
  C:\Windows\System\dapHXrQ.exe
  2⤵
  PID:10016
- C:\Windows\System\mLGmxNQ.exe
  C:\Windows\System\mLGmxNQ.exe
  2⤵
  PID:10080
- C:\Windows\System\ukoLDec.exe
  C:\Windows\System\ukoLDec.exe
  2⤵
  PID:10224
- C:\Windows\System\IMsnZlH.exe
  C:\Windows\System\IMsnZlH.exe
  2⤵
  PID:1776
- C:\Windows\System\imjmUUL.exe
  C:\Windows\System\imjmUUL.exe
  2⤵
  PID:10152
- C:\Windows\System\wJEEtlQ.exe
  C:\Windows\System\wJEEtlQ.exe
  2⤵
  PID:10156
- C:\Windows\System\LxUzcyt.exe
  C:\Windows\System\LxUzcyt.exe
  2⤵
  PID:8912
- C:\Windows\System\zNRplGV.exe
  C:\Windows\System\zNRplGV.exe
  2⤵
  PID:8356
- C:\Windows\System\pDPUfKo.exe
  C:\Windows\System\pDPUfKo.exe
  2⤵
  PID:9220
- C:\Windows\System\mktlAbg.exe
  C:\Windows\System\mktlAbg.exe
  2⤵
  PID:9384
- C:\Windows\System\lGhrcrI.exe
  C:\Windows\System\lGhrcrI.exe
  2⤵
  PID:9532
- C:\Windows\System\nNkdOtl.exe
  C:\Windows\System\nNkdOtl.exe
  2⤵
  PID:9036
- C:\Windows\System\dpQvmCZ.exe
  C:\Windows\System\dpQvmCZ.exe
  2⤵
  PID:9208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Gkkcqix.exe

Filesize
1.3MB

MD5
79ad96e497bde426e26d0f2b7329235c

SHA1
d8439490cbb18458f995ac8f48bdfc870557894e

SHA256
a5481795c1f05b708d3a390fc76c9939db87ac4f0ddecba30dd62c28e8f7bc15

SHA512
addf050d69319a3fc2f8b79c84a1bb34bf17ab3e886b31dd57d74d3afa1829dac05b32b5b0b86b002f2f078e5a0977c0a2b6dba1638af081bd4d75724263d0b9

Download Submit
C:\Windows\system\IGUohff.exe

Filesize
1.3MB

MD5
8c29af082f1f2ee6d141edcdd64bf014

SHA1
4367b5e7d4cdd286a33c9a9dbe97cf946489bd3f

SHA256
a401b2da0eb012c53f026f49048a998447dff582f1de76bc30851223271eea94

SHA512
811866899efa97ced5df96ae53736dcb1772a8fd5ce3ee44bc36518e627197b9e2eb44c117958154be72eff0e3da232151225ae4d93e9c15c91f2a8774feec6c

Download Submit
C:\Windows\system\JURXIpA.exe

Filesize
1.3MB

MD5
2225cb07c8df1cec2c61b320243729b8

SHA1
460abaad4f746529cf9c23c2e50bef525cbae2a2

SHA256
abb5e048293375297969ae95f71fca9929ac372ad4ac10070df9ef5572c09f8d

SHA512
bd41061fa11e6fd117367dc1119c5e1db12745d2d4e67a84bd9b8a2e59ba3d4a0ade2859b684b88b15a0b067a23eaaf2d19d793d3945ccc87309ffcc9a0f57ed

Download Submit
C:\Windows\system\KrWBAoV.exe

Filesize
1.3MB

MD5
d8210eea3770e06b63f939756cdf6b52

SHA1
8b1e6d3d6bdd6bbd37846a918b80e63e169b1c98

SHA256
d26cdefe03b577d5348cbd41b8967db98a96d841030136fb28386e67694e76aa

SHA512
83cc12c3817a2ce8c3088b1698da681ee78ea6e907aaf4307a3c327fa3e28b26e834f3c9c4c1e83c2f083f49fed7dec18ad3c3e5ed7f29f17dc5bef1f650ac80

Download Submit
C:\Windows\system\NoZXAQG.exe

Filesize
1.3MB

MD5
9eb3f7ea628cae6107e461abd9fc2d07

SHA1
c7d1d41601d0a3654a859df460c7cfeb3881980f

SHA256
3ae6993bce62cfc622c05bc9a0e4789d0682b252aa78901be38e5f90ab0b426f

SHA512
f76601834b471e5a1cdab2b67473687bfbfb97492b9f8a830a7996d9b07c3fe97ce0501583c2133091c63829d97387501c038d470c4e508d6574a09eeae4c8a2

Download Submit
C:\Windows\system\PydWQaU.exe

Filesize
1.3MB

MD5
2e57c0f5a493e2a9fd9d05180edb03a3

SHA1
2545a38cacf97584201715d1292c3bfaa2a31383

SHA256
48ff3971bcc273b86c3868e98e9afda82bbc8c8f08015e11a37adf988699a25b

SHA512
16b594d57bcaaa7d99918d482e2f79d712073a5849aa0f938c2201ca8f27b559a646ae42e6aaa247eae3454a3a71e8dd9c71ef42bfd2a98219ea069c7d5d3cb1

Download Submit
C:\Windows\system\SRGWBvt.exe

Filesize
1.3MB

MD5
4d035c588c3fdcca2d9185a1f6b6c629

SHA1
d75f806e2184048e2621656aed32babeab714119

SHA256
7309bbf81164f8f85ee4cd3248bd95a153ea2a382aaa005a85b511f128c41121

SHA512
8c49ab39fa1e51dc440ec6f446d95e0f5a99563453e968cdc08a358a23ee1700abefbd346a2754c66787cc90580894d14792f626172531f2fee2b472b9441718

Download Submit
C:\Windows\system\YGmuNfI.exe

Filesize
1.3MB

MD5
f1a09e089d8fac19cb7a24fc59404068

SHA1
412465faa92fd1a6a4a456cb30526929ccf1bb7d

SHA256
ca974f939f6a125db7cc7b853ddcaf80f9c9b62cac30d460695aa66a8a70a671

SHA512
a38e3c868ae8ac6ec44d689b752a3364b555bd846433994fa29b2a4f435d32e1505d4234b14fc53fbbd7f37eb8dcf334577c6064ac2364fc34db7b4252a833ec

Download Submit
C:\Windows\system\ZUiSzKQ.exe

Filesize
1.3MB

MD5
f0ec5b2e20f499377461136801b80f5b

SHA1
08315357103217844d0fb54ac1fc70c3e941aae0

SHA256
b2c46e211b56b0e937f3761a87648b1205836b92393851ac8ffa7b52624d0f83

SHA512
68716c58adb91a5c8228074013920eeaf1d1b3097bc39eb417b60c4db217924eabcb5191f022c7fe24a6a33c3baa5436c1132934461164109242c2b02e1e6c0f

Download Submit
C:\Windows\system\aqIUZJG.exe

Filesize
1.3MB

MD5
7bf446ee5f1417b138a4e1c6be3bcffd

SHA1
8553264568c67ebfb62bdc4238d6136d6670de94

SHA256
c973d0881b4f5bdd50631c23d92d9149379478063cb7b83732f5310b07af6888

SHA512
3f21b1895ab22c442ad64ff868e516ffb588a6a00fb32c33790575e94a7754fecffb91b1f56f7c3e24220a85a5b7f854c72526eca8c4ad15c73bb6613579cb41

Download Submit
C:\Windows\system\cewzIgE.exe

Filesize
1.3MB

MD5
18a5ca296884df9b9d5f57b9a0a042ff

SHA1
bfc43e244c482b004c9c85e3845720feea4dc2e3

SHA256
5d8fb3021b481121c248e8d1cbb8b9b033bb1831420fdf99d92cbca332b99000

SHA512
1a64355cb92f0e04fb7013a2c576b993eab8333719b69b133d6094c358854b95e36b2c684b858feadacc5db56f341e4b230c69f91520fdcecf2cfd50a47a6394

Download Submit
C:\Windows\system\dgVRclN.exe

Filesize
1.3MB

MD5
4ce8339b4431126342609c89ad37f259

SHA1
fb7ebc0fabc5e7db699bddfbfa6e0f207a30dd69

SHA256
9d48b8932f27fe8e0432110597a2174e8d785a474a51887c19a617bd3bf135fc

SHA512
0c51b2275010fc6741176feb76f32e5bd2f399a26368e783fb039efd450945887c94cef30a04d8bd47f6d5bc13ab59021b06e802b711032e2c67a14d0751769b

Download Submit
C:\Windows\system\eGEVbsx.exe

Filesize
1.3MB

MD5
4acdb3aca2e85a18c32f03f29f8fbc01

SHA1
93136acbd6435bb9625bad1a049fc53653e6c864

SHA256
9c0564810f5f557c7aae4e74d003d40cddb8426f761e1d5bb834d9c8fc035cdd

SHA512
141afde4c27a68148bd431f622d5d83cbd952a634b218feb6cde78e1c45a915d2c9ffa9f2bd4c623d444b94e309def7302868f893019693b4e41dd2049e5c719

Download Submit
C:\Windows\system\fXrTXEJ.exe

Filesize
1.3MB

MD5
bed8a2a9233a9d6886f4b052e9784c1d

SHA1
167263bf0e21d9af74b1ccc8cff33efc62ff3c09

SHA256
443bd4e0d7009cf05dc3d83c431481fd705ce39d0f84e3e13ff338b31804f1b5

SHA512
5245e6073e77fb64f27945d95161c0595b792087681f89dd5e2fba1b3d0c7631fc98e6febb120e65d88a683d2f5c9957145fa13deb755e8faece467992f30f97

Download Submit
C:\Windows\system\luxjrcl.exe

Filesize
1.3MB

MD5
30dfbebaf478c681a1022310805fb5a6

SHA1
1d8571bbf46f5769c03f5805d180f1a7ecb177d3

SHA256
c94dfa63c169fa09b9621484cb3160ecc85b0b5262d798b06bfdcfdd0ae490f3

SHA512
237c5c8064bf0a21950ff46531ede69e36ea20aa42ae1abfab9b524b5e623e97e7a47a9a76a51e164da011407b6a4c4433b44b780c58fa5d788b113646bf9660

Download Submit
C:\Windows\system\mLnkOOv.exe

Filesize
1.3MB

MD5
125a3d7eae51595a8c3445e8326ab37a

SHA1
ebcab74d341c651a5eb943b5fd964d2222715e36

SHA256
49c02f1d4a4dd872ce9c4566260f1404a9a8c11d61a7956899f071261fa4688e

SHA512
7fb1a6ecccc3f9a7a89b63bc4c61c8fcd5beec0072bbefef913911622e31143fb8a6ea0be58913c33c15d66857b6456201eeb32087bf971d4f871a4d0db2f226

Download Submit
C:\Windows\system\oTWeNfS.exe

Filesize
1.3MB

MD5
1df0974efc778d13a19a00bf1b436b33

SHA1
087ddc4f3083e3b9027245facb28f2844ef5ac2c

SHA256
936cb1ca61efe1fa44c468119bc3b93ff5a745329446c1aa7ec5d59c3e0e2701

SHA512
d61ef14f297f701475fbe85c8e767f27dcf09e15d56c309472b1afa4ff9d14c07ceba7038717af986395eb7aa35c5d00f30040f1d67f5cbbd15c67d745435e4d

Download Submit
C:\Windows\system\qOCCwTy.exe

Filesize
1.3MB

MD5
8ce2f597d2d9e14f7e8101e70e0a7cd7

SHA1
9480c83b296c9abbd91f4cf01e2a70574727d125

SHA256
6733bc288d84a3bb87ecfde1d157f33ea5fdaa42f068e34267fb19b4b44def0c

SHA512
c6257cf7a233b57176eb57fa54dc79bf80d35c90b88e8182fc6a354dd1c278e5d45fe23a913f57626656e08f497a1f901aa0354c554597adf3466eec08366540

Download Submit
C:\Windows\system\qbLgFNK.exe

Filesize
1.3MB

MD5
a1a83e79ef0f84a45925a750c9a9b772

SHA1
1f46268265b1c3e532e4e465d5b454e1816ee320

SHA256
95b2829e431505bf966431f1a0a64e3991bae3a6295433ee1dd29a38af3cb7e1

SHA512
de08394ec0065a60351a36d9c14d670f8c5062b54ae8b6ada4124b89190d886e82d182df4376ad8627fdf6e0693b0d98bac4c0a704b217f18e329c95fba9f4a5

Download Submit
C:\Windows\system\sMNYkgU.exe

Filesize
1.3MB

MD5
47ceb542812377cc4e23024823937579

SHA1
5420cd1fe6584d61a248be5a43e48b2496c391d5

SHA256
46359771a5ba3794d4509144ec7b0dc3673ceef7f95f95588ad16ad571f32321

SHA512
a8ea915211ede4ba61c1f6b907ba0e8f060d21e8a48d7a079933167e3b36a4ef9be8d50b1bf20d9a7bf9abb73b0e69cdd6a89b7fb7c24166417d95514f23ec91

Download Submit
C:\Windows\system\uEvwWoQ.exe

Filesize
1.3MB

MD5
2fadca36d5b9f3207aabe6fa0a8f2756

SHA1
db6012a4d00106c8b7a763da55e461a99fdfedb2

SHA256
09815a1750aa5622b710d8df9b6f1b7f909a16b5be9c6ad32ffe0e62ffb0d2da

SHA512
393aa2164b876ecb97c6e19fa50cc184fc18ec6ccceffa98391858649a4410122d96ecb3a8ee22d0dac0f0136ad5e824e6ad09c51460588ffeba005b794b143e

Download Submit
C:\Windows\system\wdpmYpA.exe

Filesize
1.3MB

MD5
f93647e020f52120edca6c5d210e3090

SHA1
daac78cf3629775d4d3a3d84b80018d766bb2f08

SHA256
1b06a3fdfe83e029a3c7b31f6810a7f3c4cb408439deee330f8123d194338e76

SHA512
b4a0184fc9d5a77120fd851590bf9dfe14bffabd7ee6ef1dde62d0822d1a3ae0df8c2326852669905d679fe99daf27a8801422a9a65b61b7090cb18f52deb125

Download Submit
C:\Windows\system\yBRUipW.exe

Filesize
1.3MB

MD5
bb84fc89e39f98e5a53272b8d72bb827

SHA1
350029858acda8d7ee69f076d0576f381bcbe9ec

SHA256
58929c1964adc0c4797e076707cb495c265fbecddfd3012e87e1e3abfe937b0e

SHA512
d9fe2b1929e787346d13c7b42232b42df963e4dae8aad6ab7fd5bf5ca4f0133f53abdbf7b2ab71399abfae7c47213e8e4c678b6899ac62e303b2c4eaf3601262

Download Submit
C:\Windows\system\yliBNel.exe

Filesize
1.3MB

MD5
b0651917cb305768f9068deeddc87f21

SHA1
25eb9da1650bc6314377d0fbc6c24c2b6f1ab6f4

SHA256
9f0f70f81d60d7a26c6e1fe3c6f7ce8cd0d8753f997f93e83270e654eb66f5c1

SHA512
9078201737ea04bc97e388edabad1de97f0dafdde68522ea3420127533faf5f9d2776852b7d1b936ad0ff17b43589cb2d0b668395f6801d96bf6243c0026e661

Download Submit
C:\Windows\system\ysBEGov.exe

Filesize
1.3MB

MD5
9b91574e3dc5fe9fec39fbef920b3d3e

SHA1
3a54474597f1c237a1551c1417b5223a60cba588

SHA256
d9d20b49c85168f2cba1e97320144b814ee3b52bd56e0b4fd04935472fecf35e

SHA512
fd25fc133fca596a0972014517179136345faa0a3eceec88b17795db0c5678a63097e8b30a8d334b98de5aa94868505e288302a18c3f1e3974a5bda7b8ad7fb0

Download Submit
C:\Windows\system\zQSUqjr.exe

Filesize
1.3MB

MD5
7caad5f02e756c1e08380248ba454fc9

SHA1
5764716bd69963c67e1fbfd57d2823973ada31ca

SHA256
b176e7b9a5b9f61cb5c6b8f4c186ccaabba0d2c1254f83d5cba5b7fd0c11b3cd

SHA512
d975b33d774440d7d81b6057448d8bb65f9b0a6bdc4546f292957117e4d3a1f808d6253d6b3650420b2dfa93791630661062284d9f2fabe143fc670c2e8f7125

Download Submit
C:\Windows\system\zilwynA.exe

Filesize
1.3MB

MD5
86d85b3d58727b681bec52aadd0e3b48

SHA1
14a75ac24ac2d09bd1e16045470d412f64a69451

SHA256
b6bb090b9c8dc4638fbfa32aeb1f7495b236fd8133df894e3599aa7a36336d8b

SHA512
0b9303c24947fc55b5cb510ee48ba1834b22b1efcb7216b6165642d7f326f29d2fcea9b1487ac6da5f53cf4d33505e4718b5fd32e6abbb6e05ee3109249e948c

Download Submit
\Windows\system\VrtAGCN.exe

Filesize
1.3MB

MD5
34a76e8dc2cb4e1a9643599b382ebce8

SHA1
dffa51327f34e65a2c8e304ed3628ed04b8d84a4

SHA256
2b76e4cf7c8a9d5a4b68786f64848bec071a850d37eb47d1d4b3885555ddafdb

SHA512
1f6a480a9b60b3d7e5b4246507dcf742d6519464c705cf1c12647dc9e444e6b5e7447401e0ec0c9c8e291a1ba0754c0ba2409b7ad0a70749268b52552555d46a

Download Submit
\Windows\system\lrAiKZZ.exe

Filesize
1.3MB

MD5
5015e673796da67caf22123bb66e713f

SHA1
83fe431d127393f018385f26a970ae29f226bb31

SHA256
05af95246a1ece1b4abe8937a0c0d4b1b207489f27c7b4a0698f7b61d59dd89e

SHA512
80422e501af21f71798b9b99846be473aa55289f7bf7a647628551f680b14ecc53e759d6c881fc1cc1f5bd9eea200894042e0d86c7b74ea5f0b90d3121397ce3

Download Submit
\Windows\system\ouiHlIb.exe

Filesize
1.3MB

MD5
a4ca71b0259120c1002750818e62463e

SHA1
34892cae726d68433a513cb07085e76800c8d360

SHA256
76450aea16e7d4f270b6e22066aafd04fefa9c5d766f4c96899711f79af51d36

SHA512
8d1336a59350f30fb50706767878faa420c97d4e53e348df1878213e3170008aa1a02fffaff76a87d5540d89af462d78647857b299852615d075a48c4b2ee32a

Download Submit
\Windows\system\vBWfObi.exe

Filesize
1.3MB

MD5
79d03687c736b5c7a8765e5c88d111f3

SHA1
3345070cc5003b22fbf34f0aa6b20bbb032cfa47

SHA256
00649ce48579dde6fa20b6dd67eef97963072c3f1c25c08755940ac0044a8f95

SHA512
7f5287c6448e9826724d8aa072b82db6394a0cc0e1402c9c50a5d2de4f4f964b3fd3d53fa56fc1717d64abc3642f9eb0c7e8f83a915aee91d06e71f33bc1ad83

Download Submit
\Windows\system\xWZhqYr.exe

Filesize
1.3MB

MD5
34421c1533496e5d1ccfdbdca3187140

SHA1
254faa6f6404c4e23f76e8cf537e55731f19e06c

SHA256
1e617ae8f849741bf9efa1e5caeec3c1bc4f5c6931cdd9f18891799198eb3fff

SHA512
af2b7dff6b97169aec624b8a8d03df621065ed17188979e97b19784dcc278fe2866df2313d27bf5ac70be6571ea9bde10a520a518cd3b6f6a052c4a3547f18e7

Download Submit
memory/1152-2189-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/1152-106-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/1152-66-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/1492-1870-0x000000013FFC0000-0x0000000140311000-memory.dmp

Filesize
3.3MB

Download
memory/1492-175-0x000000013FFC0000-0x0000000140311000-memory.dmp

Filesize
3.3MB

Download
memory/1492-74-0x000000013FFC0000-0x0000000140311000-memory.dmp

Filesize
3.3MB

Download
memory/1720-379-0x000000013F730000-0x000000013FA81000-memory.dmp

Filesize
3.3MB

Download
memory/1720-2370-0x000000013F730000-0x000000013FA81000-memory.dmp

Filesize
3.3MB

Download
memory/1720-99-0x000000013F730000-0x000000013FA81000-memory.dmp

Filesize
3.3MB

Download
memory/2104-91-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2104-1884-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2104-291-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2232-50-0x0000000001E50000-0x00000000021A1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-20-0x0000000001E50000-0x00000000021A1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-332-0x000000013F730000-0x000000013FA81000-memory.dmp

Filesize
3.3MB

Download
memory/2232-63-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/2232-498-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-12-0x0000000001E50000-0x00000000021A1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-86-0x0000000001E50000-0x00000000021A1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2232-87-0x000000013F910000-0x000000013FC61000-memory.dmp

Filesize
3.3MB

Download
memory/2232-78-0x0000000001E50000-0x00000000021A1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-6-0x000000013F870000-0x000000013FBC1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-56-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2232-103-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2232-426-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2232-0-0x000000013F180000-0x000000013F4D1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-33-0x000000013FA70000-0x000000013FDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-95-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2232-42-0x000000013F870000-0x000000013FBC1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-40-0x000000013F180000-0x000000013F4D1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-96-0x000000013F730000-0x000000013FA81000-memory.dmp

Filesize
3.3MB

Download
memory/2232-111-0x000000013FFC0000-0x0000000140311000-memory.dmp

Filesize
3.3MB

Download
memory/2232-36-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2184-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2264-257-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2264-82-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2368-454-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2368-2167-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2368-107-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2432-61-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2432-1824-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2600-81-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2600-1790-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2600-43-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2604-34-0x000000013FA70000-0x000000013FDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2604-1690-0x000000013FA70000-0x000000013FDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-54-0x000000013F0C0000-0x000000013F411000-memory.dmp

Filesize
3.3MB

Download
memory/2684-1667-0x000000013F0C0000-0x000000013F411000-memory.dmp

Filesize
3.3MB

Download
memory/2684-15-0x000000013F0C0000-0x000000013F411000-memory.dmp

Filesize
3.3MB

Download
memory/2748-35-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2748-71-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2748-1750-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2848-47-0x000000013F870000-0x000000013FBC1000-memory.dmp

Filesize
3.3MB

Download
memory/2848-1673-0x000000013F870000-0x000000013FBC1000-memory.dmp

Filesize
3.3MB

Download
memory/2848-8-0x000000013F870000-0x000000013FBC1000-memory.dmp

Filesize
3.3MB

Download
memory/2944-1694-0x000000013F420000-0x000000013F771000-memory.dmp

Filesize
3.3MB

Download
memory/2944-22-0x000000013F420000-0x000000013F771000-memory.dmp

Filesize
3.3MB

Download
memory/2944-60-0x000000013F420000-0x000000013F771000-memory.dmp

Filesize
3.3MB

Download
memory/3016-52-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/3016-90-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download
memory/3016-2525-0x000000013F210000-0x000000013F561000-memory.dmp

Filesize
3.3MB

Download