xmrig | 9abf894de3a0d30eefff2bff7b80204ddfcf843bed8d977120ca2c8b9f273311

Analysis

max time kernel
96s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e3af59826526ce7a88e9f38f001290N.exe
Size

1.4MB
MD5

d2e3af59826526ce7a88e9f38f001290
SHA1

dec2afae9fbd7bbb3392fdabab8a09b36cc9317a
SHA256

9abf894de3a0d30eefff2bff7b80204ddfcf843bed8d977120ca2c8b9f273311
SHA512

83aa398352034abe66e66dccb9219a6f03830acaaac3216ab1987b58baab8c7fb8081a8856edea0e4ec343ff89b3185aaa5ac7bde790dd95583fae634d2dc7c1
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZyhTHF3Vgazf6J6iHH5orMHn4Z7:ROdWCCi7/rahW/zaZY5ayk/HY7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2652-21-0x000000013F1D0000-0x000000013F521000-memory.dmp	xmrig
behavioral1/memory/2776-19-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2732-18-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2192-29-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2440-31-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2716-36-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2732-52-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2992-317-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig
behavioral1/memory/2240-469-0x000000013F440000-0x000000013F791000-memory.dmp	xmrig
behavioral1/memory/2544-75-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2440-51-0x000000013F9F0000-0x000000013FD41000-memory.dmp	xmrig
behavioral1/memory/2616-50-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	xmrig
behavioral1/memory/2384-670-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/1836-1148-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2776-4001-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2732-4045-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2652-4046-0x000000013F1D0000-0x000000013F521000-memory.dmp	xmrig
behavioral1/memory/2192-4067-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2716-4125-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/264-4248-0x000000013FD90000-0x00000001400E1000-memory.dmp	xmrig
behavioral1/memory/1232-4250-0x000000013FA90000-0x000000013FDE1000-memory.dmp	xmrig
behavioral1/memory/3048-4249-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	xmrig
behavioral1/memory/1836-4251-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2616-4265-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	xmrig
behavioral1/memory/2384-4259-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2240-4267-0x000000013F440000-0x000000013F791000-memory.dmp	xmrig
behavioral1/memory/2544-4266-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2992-4253-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2732	kZxAtuW.exe
2776	ORIGNkz.exe
2652	NceoFoI.exe
2192	ujepnRC.exe
2716	Xbinemj.exe
2544	dMsAHAe.exe
2616	KSDuwKx.exe
3048	IqxvnDU.exe
264	lyvkvHg.exe
1232	apewDvU.exe
2992	UdImUnj.exe
2240	dcSjwNu.exe
2384	DIyxHMs.exe
1836	axZtRFm.exe
2104	xDmXaNE.exe
2784	myXJXKI.exe
2884	sbOKdtd.exe
2080	CCywBeu.exe
1620	wvcdvRt.exe
2632	yAvUDrv.exe
556	NzgCTfa.exe
3008	BDtdxwg.exe
1792	RnGSVmb.exe
2364	iJWXQDy.exe
2004	HEgorOv.exe
2224	ncfHlhK.exe
2248	lZZByuf.exe
844	oHYucUq.exe
668	teyDafT.exe
1464	QomBsKZ.exe
1828	YAvBlaQ.exe
448	PiVgaPV.exe
1908	YDYfUtj.exe
1928	wxvnLwb.exe
2952	pKXnGlc.exe
1368	RxbqgFN.exe
2180	bUcPQrj.exe
1768	OiYpEdr.exe
1352	qYEVoJd.exe
2380	ASMIEjX.exe
1688	yijYxOS.exe
888	kKiKGhn.exe
1980	PaajcpK.exe
2328	GcMCWtC.exe
1956	FHYykwm.exe
1740	JVHrXKa.exe
1240	tOqtwcX.exe
2516	QUpIzAK.exe
2268	RXzJvXf.exe
2068	TTADJkG.exe
872	hqtLKcO.exe
2392	igycDha.exe
1708	ZuYOHUO.exe
1548	HIEqpCI.exe
2744	pZBNKit.exe
2688	ilNwgHR.exe
2748	LTugdpE.exe
2836	QUjxpTa.exe
2580	mJPenLa.exe
1500	RktXlKO.exe
2824	xOTGQNZ.exe
1628	fuCCuNa.exe
3044	VntPfUT.exe
2712	GSJKxZZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe
2440	d2e3af59826526ce7a88e9f38f001290N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-0-0x000000013F9F0000-0x000000013FD41000-memory.dmp	upx
behavioral1/files/0x0007000000012116-6.dat	upx
behavioral1/files/0x0008000000016ca2-11.dat	upx
behavioral1/files/0x0007000000016cd3-12.dat	upx
behavioral1/memory/2652-21-0x000000013F1D0000-0x000000013F521000-memory.dmp	upx
behavioral1/files/0x0008000000016cfe-23.dat	upx
behavioral1/memory/2776-19-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/memory/2732-18-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2192-29-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/files/0x0007000000016d0b-30.dat	upx
behavioral1/memory/2716-36-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2732-52-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/files/0x0007000000016d1b-53.dat	upx
behavioral1/memory/3048-58-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/files/0x0008000000016d36-67.dat	upx
behavioral1/files/0x000600000001748f-80.dat	upx
behavioral1/files/0x000600000001752f-92.dat	upx
behavioral1/files/0x00060000000190d6-121.dat	upx
behavioral1/files/0x0005000000019218-148.dat	upx
behavioral1/files/0x000500000001924c-164.dat	upx
behavioral1/files/0x0005000000019277-183.dat	upx
behavioral1/memory/2992-317-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx
behavioral1/memory/2240-469-0x000000013F440000-0x000000013F791000-memory.dmp	upx
behavioral1/files/0x0005000000019389-193.dat	upx
behavioral1/files/0x0005000000019382-188.dat	upx
behavioral1/files/0x0005000000019271-174.dat	upx
behavioral1/files/0x0005000000019273-177.dat	upx
behavioral1/files/0x0005000000019229-162.dat	upx
behavioral1/files/0x000500000001926b-168.dat	upx
behavioral1/files/0x0005000000019234-156.dat	upx
behavioral1/files/0x00050000000191f7-129.dat	upx
behavioral1/files/0x00050000000191f3-125.dat	upx
behavioral1/files/0x00060000000190cd-117.dat	upx
behavioral1/files/0x000500000001879b-113.dat	upx
behavioral1/files/0x0009000000018678-106.dat	upx
behavioral1/files/0x0005000000018690-109.dat	upx
behavioral1/files/0x001500000001866d-99.dat	upx
behavioral1/memory/1836-96-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/2384-89-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x00060000000174ac-86.dat	upx
behavioral1/memory/2240-83-0x000000013F440000-0x000000013F791000-memory.dmp	upx
behavioral1/memory/2992-77-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx
behavioral1/memory/2544-75-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/memory/1232-70-0x000000013FA90000-0x000000013FDE1000-memory.dmp	upx
behavioral1/files/0x000600000001747b-73.dat	upx
behavioral1/memory/264-64-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/files/0x0007000000016d24-62.dat	upx
behavioral1/memory/2440-51-0x000000013F9F0000-0x000000013FD41000-memory.dmp	upx
behavioral1/memory/2616-50-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	upx
behavioral1/memory/2544-41-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/files/0x0007000000016d13-47.dat	upx
behavioral1/files/0x0035000000016c3d-39.dat	upx
behavioral1/memory/2384-670-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/1836-1148-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/2776-4001-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/memory/2732-4045-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2652-4046-0x000000013F1D0000-0x000000013F521000-memory.dmp	upx
behavioral1/memory/2192-4067-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2716-4125-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/264-4248-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/memory/1232-4250-0x000000013FA90000-0x000000013FDE1000-memory.dmp	upx
behavioral1/memory/3048-4249-0x000000013F4A0000-0x000000013F7F1000-memory.dmp	upx
behavioral1/memory/1836-4251-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/2616-4265-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uDBsloi.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\IdrXLqe.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\dNbsZFg.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\JJEGILY.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\pLBBjeN.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\Hqfwugj.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\xABMUDd.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\JlZYhtv.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\eQFRIdk.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\EBrJVUK.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\TCsanTy.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\kcVkiKX.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\iCuUAmT.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\gJVZrzL.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\GixWXUJ.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\nedypzL.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\GOVakWP.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\odtpBGk.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\aAuFzFn.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\wCTBnLp.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\OlseSsb.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\YipGXGj.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\ijDyCdI.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\djWzQdq.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\LYLjdxr.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\TYFiQIT.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\nwIEqzx.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\OXgSYAk.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\MMuxEDv.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\CICccFx.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\pGxVPWN.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\okBwKwU.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\QJoxhSx.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\wAlqvJk.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\aqYbsXY.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\hiXdtxi.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\LWUDkgK.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\OYyEpaf.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\NceoFoI.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\ekkqSBg.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\awMdhSp.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\wSxFDMD.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\MHXpiga.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\nmixrbn.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\vVTLpKg.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\UTthgMR.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\YezWQmF.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\GnjCrpy.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\EhiEvWi.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\sutmAJa.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\ZLKxplO.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\PsXWAql.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\kqfRNzp.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\slPJmOI.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\iaOdRGM.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\JtQBcZt.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\BkEtlRI.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\IyJpLKV.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\TseKHwR.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\BEKLJJd.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\nMCKfdx.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\FyUbDGz.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\fmXgSts.exe	d2e3af59826526ce7a88e9f38f001290N.exe
File created	C:\Windows\System\jfVzRor.exe	d2e3af59826526ce7a88e9f38f001290N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2732	2440	d2e3af59826526ce7a88e9f38f001290N.exe	31
PID 2440 wrote to memory of 2732	2440	d2e3af59826526ce7a88e9f38f001290N.exe	31
PID 2440 wrote to memory of 2732	2440	d2e3af59826526ce7a88e9f38f001290N.exe	31
PID 2440 wrote to memory of 2776	2440	d2e3af59826526ce7a88e9f38f001290N.exe	32
PID 2440 wrote to memory of 2776	2440	d2e3af59826526ce7a88e9f38f001290N.exe	32
PID 2440 wrote to memory of 2776	2440	d2e3af59826526ce7a88e9f38f001290N.exe	32
PID 2440 wrote to memory of 2652	2440	d2e3af59826526ce7a88e9f38f001290N.exe	33
PID 2440 wrote to memory of 2652	2440	d2e3af59826526ce7a88e9f38f001290N.exe	33
PID 2440 wrote to memory of 2652	2440	d2e3af59826526ce7a88e9f38f001290N.exe	33
PID 2440 wrote to memory of 2192	2440	d2e3af59826526ce7a88e9f38f001290N.exe	34
PID 2440 wrote to memory of 2192	2440	d2e3af59826526ce7a88e9f38f001290N.exe	34
PID 2440 wrote to memory of 2192	2440	d2e3af59826526ce7a88e9f38f001290N.exe	34
PID 2440 wrote to memory of 2716	2440	d2e3af59826526ce7a88e9f38f001290N.exe	35
PID 2440 wrote to memory of 2716	2440	d2e3af59826526ce7a88e9f38f001290N.exe	35
PID 2440 wrote to memory of 2716	2440	d2e3af59826526ce7a88e9f38f001290N.exe	35
PID 2440 wrote to memory of 2544	2440	d2e3af59826526ce7a88e9f38f001290N.exe	36
PID 2440 wrote to memory of 2544	2440	d2e3af59826526ce7a88e9f38f001290N.exe	36
PID 2440 wrote to memory of 2544	2440	d2e3af59826526ce7a88e9f38f001290N.exe	36
PID 2440 wrote to memory of 2616	2440	d2e3af59826526ce7a88e9f38f001290N.exe	37
PID 2440 wrote to memory of 2616	2440	d2e3af59826526ce7a88e9f38f001290N.exe	37
PID 2440 wrote to memory of 2616	2440	d2e3af59826526ce7a88e9f38f001290N.exe	37
PID 2440 wrote to memory of 3048	2440	d2e3af59826526ce7a88e9f38f001290N.exe	38
PID 2440 wrote to memory of 3048	2440	d2e3af59826526ce7a88e9f38f001290N.exe	38
PID 2440 wrote to memory of 3048	2440	d2e3af59826526ce7a88e9f38f001290N.exe	38
PID 2440 wrote to memory of 264	2440	d2e3af59826526ce7a88e9f38f001290N.exe	39
PID 2440 wrote to memory of 264	2440	d2e3af59826526ce7a88e9f38f001290N.exe	39
PID 2440 wrote to memory of 264	2440	d2e3af59826526ce7a88e9f38f001290N.exe	39
PID 2440 wrote to memory of 1232	2440	d2e3af59826526ce7a88e9f38f001290N.exe	40
PID 2440 wrote to memory of 1232	2440	d2e3af59826526ce7a88e9f38f001290N.exe	40
PID 2440 wrote to memory of 1232	2440	d2e3af59826526ce7a88e9f38f001290N.exe	40
PID 2440 wrote to memory of 2992	2440	d2e3af59826526ce7a88e9f38f001290N.exe	41
PID 2440 wrote to memory of 2992	2440	d2e3af59826526ce7a88e9f38f001290N.exe	41
PID 2440 wrote to memory of 2992	2440	d2e3af59826526ce7a88e9f38f001290N.exe	41
PID 2440 wrote to memory of 2240	2440	d2e3af59826526ce7a88e9f38f001290N.exe	42
PID 2440 wrote to memory of 2240	2440	d2e3af59826526ce7a88e9f38f001290N.exe	42
PID 2440 wrote to memory of 2240	2440	d2e3af59826526ce7a88e9f38f001290N.exe	42
PID 2440 wrote to memory of 2384	2440	d2e3af59826526ce7a88e9f38f001290N.exe	43
PID 2440 wrote to memory of 2384	2440	d2e3af59826526ce7a88e9f38f001290N.exe	43
PID 2440 wrote to memory of 2384	2440	d2e3af59826526ce7a88e9f38f001290N.exe	43
PID 2440 wrote to memory of 1836	2440	d2e3af59826526ce7a88e9f38f001290N.exe	44
PID 2440 wrote to memory of 1836	2440	d2e3af59826526ce7a88e9f38f001290N.exe	44
PID 2440 wrote to memory of 1836	2440	d2e3af59826526ce7a88e9f38f001290N.exe	44
PID 2440 wrote to memory of 2104	2440	d2e3af59826526ce7a88e9f38f001290N.exe	45
PID 2440 wrote to memory of 2104	2440	d2e3af59826526ce7a88e9f38f001290N.exe	45
PID 2440 wrote to memory of 2104	2440	d2e3af59826526ce7a88e9f38f001290N.exe	45
PID 2440 wrote to memory of 2784	2440	d2e3af59826526ce7a88e9f38f001290N.exe	46
PID 2440 wrote to memory of 2784	2440	d2e3af59826526ce7a88e9f38f001290N.exe	46
PID 2440 wrote to memory of 2784	2440	d2e3af59826526ce7a88e9f38f001290N.exe	46
PID 2440 wrote to memory of 2884	2440	d2e3af59826526ce7a88e9f38f001290N.exe	47
PID 2440 wrote to memory of 2884	2440	d2e3af59826526ce7a88e9f38f001290N.exe	47
PID 2440 wrote to memory of 2884	2440	d2e3af59826526ce7a88e9f38f001290N.exe	47
PID 2440 wrote to memory of 2080	2440	d2e3af59826526ce7a88e9f38f001290N.exe	48
PID 2440 wrote to memory of 2080	2440	d2e3af59826526ce7a88e9f38f001290N.exe	48
PID 2440 wrote to memory of 2080	2440	d2e3af59826526ce7a88e9f38f001290N.exe	48
PID 2440 wrote to memory of 1620	2440	d2e3af59826526ce7a88e9f38f001290N.exe	49
PID 2440 wrote to memory of 1620	2440	d2e3af59826526ce7a88e9f38f001290N.exe	49
PID 2440 wrote to memory of 1620	2440	d2e3af59826526ce7a88e9f38f001290N.exe	49
PID 2440 wrote to memory of 2632	2440	d2e3af59826526ce7a88e9f38f001290N.exe	50
PID 2440 wrote to memory of 2632	2440	d2e3af59826526ce7a88e9f38f001290N.exe	50
PID 2440 wrote to memory of 2632	2440	d2e3af59826526ce7a88e9f38f001290N.exe	50
PID 2440 wrote to memory of 556	2440	d2e3af59826526ce7a88e9f38f001290N.exe	51
PID 2440 wrote to memory of 556	2440	d2e3af59826526ce7a88e9f38f001290N.exe	51
PID 2440 wrote to memory of 556	2440	d2e3af59826526ce7a88e9f38f001290N.exe	51
PID 2440 wrote to memory of 3008	2440	d2e3af59826526ce7a88e9f38f001290N.exe	52

C:\Users\Admin\AppData\Local\Temp\d2e3af59826526ce7a88e9f38f001290N.exe
"C:\Users\Admin\AppData\Local\Temp\d2e3af59826526ce7a88e9f38f001290N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\System\kZxAtuW.exe
  C:\Windows\System\kZxAtuW.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ORIGNkz.exe
  C:\Windows\System\ORIGNkz.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NceoFoI.exe
  C:\Windows\System\NceoFoI.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ujepnRC.exe
  C:\Windows\System\ujepnRC.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\Xbinemj.exe
  C:\Windows\System\Xbinemj.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\dMsAHAe.exe
  C:\Windows\System\dMsAHAe.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\KSDuwKx.exe
  C:\Windows\System\KSDuwKx.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\IqxvnDU.exe
  C:\Windows\System\IqxvnDU.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\lyvkvHg.exe
  C:\Windows\System\lyvkvHg.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\apewDvU.exe
  C:\Windows\System\apewDvU.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\UdImUnj.exe
  C:\Windows\System\UdImUnj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\dcSjwNu.exe
  C:\Windows\System\dcSjwNu.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\DIyxHMs.exe
  C:\Windows\System\DIyxHMs.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\axZtRFm.exe
  C:\Windows\System\axZtRFm.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\xDmXaNE.exe
  C:\Windows\System\xDmXaNE.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\myXJXKI.exe
  C:\Windows\System\myXJXKI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\sbOKdtd.exe
  C:\Windows\System\sbOKdtd.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\CCywBeu.exe
  C:\Windows\System\CCywBeu.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\wvcdvRt.exe
  C:\Windows\System\wvcdvRt.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\yAvUDrv.exe
  C:\Windows\System\yAvUDrv.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\NzgCTfa.exe
  C:\Windows\System\NzgCTfa.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\BDtdxwg.exe
  C:\Windows\System\BDtdxwg.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\RnGSVmb.exe
  C:\Windows\System\RnGSVmb.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\HEgorOv.exe
  C:\Windows\System\HEgorOv.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\iJWXQDy.exe
  C:\Windows\System\iJWXQDy.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ncfHlhK.exe
  C:\Windows\System\ncfHlhK.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\lZZByuf.exe
  C:\Windows\System\lZZByuf.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\oHYucUq.exe
  C:\Windows\System\oHYucUq.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\teyDafT.exe
  C:\Windows\System\teyDafT.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\QomBsKZ.exe
  C:\Windows\System\QomBsKZ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\YAvBlaQ.exe
  C:\Windows\System\YAvBlaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\PiVgaPV.exe
  C:\Windows\System\PiVgaPV.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\YDYfUtj.exe
  C:\Windows\System\YDYfUtj.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\wxvnLwb.exe
  C:\Windows\System\wxvnLwb.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\pKXnGlc.exe
  C:\Windows\System\pKXnGlc.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\RxbqgFN.exe
  C:\Windows\System\RxbqgFN.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\bUcPQrj.exe
  C:\Windows\System\bUcPQrj.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\OiYpEdr.exe
  C:\Windows\System\OiYpEdr.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\qYEVoJd.exe
  C:\Windows\System\qYEVoJd.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ASMIEjX.exe
  C:\Windows\System\ASMIEjX.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\yijYxOS.exe
  C:\Windows\System\yijYxOS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\kKiKGhn.exe
  C:\Windows\System\kKiKGhn.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\PaajcpK.exe
  C:\Windows\System\PaajcpK.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\GcMCWtC.exe
  C:\Windows\System\GcMCWtC.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FHYykwm.exe
  C:\Windows\System\FHYykwm.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\JVHrXKa.exe
  C:\Windows\System\JVHrXKa.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\tOqtwcX.exe
  C:\Windows\System\tOqtwcX.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\RXzJvXf.exe
  C:\Windows\System\RXzJvXf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QUpIzAK.exe
  C:\Windows\System\QUpIzAK.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\TTADJkG.exe
  C:\Windows\System\TTADJkG.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\hqtLKcO.exe
  C:\Windows\System\hqtLKcO.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\ZuYOHUO.exe
  C:\Windows\System\ZuYOHUO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\igycDha.exe
  C:\Windows\System\igycDha.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\HIEqpCI.exe
  C:\Windows\System\HIEqpCI.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\pZBNKit.exe
  C:\Windows\System\pZBNKit.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ilNwgHR.exe
  C:\Windows\System\ilNwgHR.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LTugdpE.exe
  C:\Windows\System\LTugdpE.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\QUjxpTa.exe
  C:\Windows\System\QUjxpTa.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\mJPenLa.exe
  C:\Windows\System\mJPenLa.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\RktXlKO.exe
  C:\Windows\System\RktXlKO.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\xOTGQNZ.exe
  C:\Windows\System\xOTGQNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\VntPfUT.exe
  C:\Windows\System\VntPfUT.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\fuCCuNa.exe
  C:\Windows\System\fuCCuNa.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\GSJKxZZ.exe
  C:\Windows\System\GSJKxZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\uIGRRts.exe
  C:\Windows\System\uIGRRts.exe
  2⤵
  PID:1276
- C:\Windows\System\xfxQxVs.exe
  C:\Windows\System\xfxQxVs.exe
  2⤵
  PID:2916
- C:\Windows\System\YCgjuuN.exe
  C:\Windows\System\YCgjuuN.exe
  2⤵
  PID:2808
- C:\Windows\System\deLvCnv.exe
  C:\Windows\System\deLvCnv.exe
  2⤵
  PID:2904
- C:\Windows\System\xeHkHDF.exe
  C:\Windows\System\xeHkHDF.exe
  2⤵
  PID:2372
- C:\Windows\System\wuPnnQI.exe
  C:\Windows\System\wuPnnQI.exe
  2⤵
  PID:2076
- C:\Windows\System\gAXjOZg.exe
  C:\Windows\System\gAXjOZg.exe
  2⤵
  PID:2956
- C:\Windows\System\NuvFdRY.exe
  C:\Windows\System\NuvFdRY.exe
  2⤵
  PID:1760
- C:\Windows\System\tbuxWol.exe
  C:\Windows\System\tbuxWol.exe
  2⤵
  PID:2964
- C:\Windows\System\OmfhRgf.exe
  C:\Windows\System\OmfhRgf.exe
  2⤵
  PID:2664
- C:\Windows\System\ONaARFh.exe
  C:\Windows\System\ONaARFh.exe
  2⤵
  PID:2132
- C:\Windows\System\kJPsJpc.exe
  C:\Windows\System\kJPsJpc.exe
  2⤵
  PID:1484
- C:\Windows\System\WJKYLMV.exe
  C:\Windows\System\WJKYLMV.exe
  2⤵
  PID:1852
- C:\Windows\System\mAZHYGT.exe
  C:\Windows\System\mAZHYGT.exe
  2⤵
  PID:2444
- C:\Windows\System\slPJmOI.exe
  C:\Windows\System\slPJmOI.exe
  2⤵
  PID:940
- C:\Windows\System\fGTAjiy.exe
  C:\Windows\System\fGTAjiy.exe
  2⤵
  PID:744
- C:\Windows\System\MuLXUiA.exe
  C:\Windows\System\MuLXUiA.exe
  2⤵
  PID:1532
- C:\Windows\System\MbkZpzP.exe
  C:\Windows\System\MbkZpzP.exe
  2⤵
  PID:1704
- C:\Windows\System\ZFwJOty.exe
  C:\Windows\System\ZFwJOty.exe
  2⤵
  PID:1304
- C:\Windows\System\lRtJjRu.exe
  C:\Windows\System\lRtJjRu.exe
  2⤵
  PID:604
- C:\Windows\System\pMolfPv.exe
  C:\Windows\System\pMolfPv.exe
  2⤵
  PID:3000
- C:\Windows\System\fhvVAOC.exe
  C:\Windows\System\fhvVAOC.exe
  2⤵
  PID:2356
- C:\Windows\System\bGzIWZz.exe
  C:\Windows\System\bGzIWZz.exe
  2⤵
  PID:704
- C:\Windows\System\MniFUtP.exe
  C:\Windows\System\MniFUtP.exe
  2⤵
  PID:2456
- C:\Windows\System\RjDxTME.exe
  C:\Windows\System\RjDxTME.exe
  2⤵
  PID:1576
- C:\Windows\System\DlxwEgQ.exe
  C:\Windows\System\DlxwEgQ.exe
  2⤵
  PID:2924
- C:\Windows\System\vAZTcJv.exe
  C:\Windows\System\vAZTcJv.exe
  2⤵
  PID:2736
- C:\Windows\System\eRuVhzV.exe
  C:\Windows\System\eRuVhzV.exe
  2⤵
  PID:2696
- C:\Windows\System\uVSZyop.exe
  C:\Windows\System\uVSZyop.exe
  2⤵
  PID:2816
- C:\Windows\System\LofgHLr.exe
  C:\Windows\System\LofgHLr.exe
  2⤵
  PID:2548
- C:\Windows\System\RGwPEVI.exe
  C:\Windows\System\RGwPEVI.exe
  2⤵
  PID:2092
- C:\Windows\System\qkcNFiT.exe
  C:\Windows\System\qkcNFiT.exe
  2⤵
  PID:332
- C:\Windows\System\JcHffvF.exe
  C:\Windows\System\JcHffvF.exe
  2⤵
  PID:2856
- C:\Windows\System\rLnEQtI.exe
  C:\Windows\System\rLnEQtI.exe
  2⤵
  PID:1916
- C:\Windows\System\dzIREXq.exe
  C:\Windows\System\dzIREXq.exe
  2⤵
  PID:2656
- C:\Windows\System\bKxLrix.exe
  C:\Windows\System\bKxLrix.exe
  2⤵
  PID:2728
- C:\Windows\System\roFCYJK.exe
  C:\Windows\System\roFCYJK.exe
  2⤵
  PID:1428
- C:\Windows\System\YiNzYsg.exe
  C:\Windows\System\YiNzYsg.exe
  2⤵
  PID:2108
- C:\Windows\System\mmIugOp.exe
  C:\Windows\System\mmIugOp.exe
  2⤵
  PID:2208
- C:\Windows\System\CJIGLBX.exe
  C:\Windows\System\CJIGLBX.exe
  2⤵
  PID:2200
- C:\Windows\System\zzmlTdo.exe
  C:\Windows\System\zzmlTdo.exe
  2⤵
  PID:3036
- C:\Windows\System\GtAIIIN.exe
  C:\Windows\System\GtAIIIN.exe
  2⤵
  PID:2404
- C:\Windows\System\eolOgYe.exe
  C:\Windows\System\eolOgYe.exe
  2⤵
  PID:1676
- C:\Windows\System\Kkkstiw.exe
  C:\Windows\System\Kkkstiw.exe
  2⤵
  PID:1716
- C:\Windows\System\MXsBNPr.exe
  C:\Windows\System\MXsBNPr.exe
  2⤵
  PID:2112
- C:\Windows\System\eAfWFVj.exe
  C:\Windows\System\eAfWFVj.exe
  2⤵
  PID:1720
- C:\Windows\System\uqRmIYG.exe
  C:\Windows\System\uqRmIYG.exe
  2⤵
  PID:288
- C:\Windows\System\ZYMeqFL.exe
  C:\Windows\System\ZYMeqFL.exe
  2⤵
  PID:2984
- C:\Windows\System\wBPsJAg.exe
  C:\Windows\System\wBPsJAg.exe
  2⤵
  PID:1952
- C:\Windows\System\JnRLFdL.exe
  C:\Windows\System\JnRLFdL.exe
  2⤵
  PID:2684
- C:\Windows\System\evYLKZX.exe
  C:\Windows\System\evYLKZX.exe
  2⤵
  PID:2772
- C:\Windows\System\gZshIho.exe
  C:\Windows\System\gZshIho.exe
  2⤵
  PID:2648
- C:\Windows\System\wCTBnLp.exe
  C:\Windows\System\wCTBnLp.exe
  2⤵
  PID:2936
- C:\Windows\System\EEAMAnS.exe
  C:\Windows\System\EEAMAnS.exe
  2⤵
  PID:2428
- C:\Windows\System\YEWHWja.exe
  C:\Windows\System\YEWHWja.exe
  2⤵
  PID:2028
- C:\Windows\System\LWKxved.exe
  C:\Windows\System\LWKxved.exe
  2⤵
  PID:2368
- C:\Windows\System\wJOnXvX.exe
  C:\Windows\System\wJOnXvX.exe
  2⤵
  PID:2140
- C:\Windows\System\iyqXQAp.exe
  C:\Windows\System\iyqXQAp.exe
  2⤵
  PID:1948
- C:\Windows\System\emPWcNI.exe
  C:\Windows\System\emPWcNI.exe
  2⤵
  PID:2564
- C:\Windows\System\VhLDpfF.exe
  C:\Windows\System\VhLDpfF.exe
  2⤵
  PID:2640
- C:\Windows\System\LYLjdxr.exe
  C:\Windows\System\LYLjdxr.exe
  2⤵
  PID:1476
- C:\Windows\System\WnzbRfZ.exe
  C:\Windows\System\WnzbRfZ.exe
  2⤵
  PID:476
- C:\Windows\System\UaZjVjN.exe
  C:\Windows\System\UaZjVjN.exe
  2⤵
  PID:1800
- C:\Windows\System\XmldaLV.exe
  C:\Windows\System\XmldaLV.exe
  2⤵
  PID:2128
- C:\Windows\System\rPLncik.exe
  C:\Windows\System\rPLncik.exe
  2⤵
  PID:1356
- C:\Windows\System\sopFTtj.exe
  C:\Windows\System\sopFTtj.exe
  2⤵
  PID:2568
- C:\Windows\System\EBrJVUK.exe
  C:\Windows\System\EBrJVUK.exe
  2⤵
  PID:2780
- C:\Windows\System\DBjKaqC.exe
  C:\Windows\System\DBjKaqC.exe
  2⤵
  PID:1960
- C:\Windows\System\PHqRDre.exe
  C:\Windows\System\PHqRDre.exe
  2⤵
  PID:2976
- C:\Windows\System\yJtzcyQ.exe
  C:\Windows\System\yJtzcyQ.exe
  2⤵
  PID:2116
- C:\Windows\System\BWfsEfU.exe
  C:\Windows\System\BWfsEfU.exe
  2⤵
  PID:2912
- C:\Windows\System\LwSvJnL.exe
  C:\Windows\System\LwSvJnL.exe
  2⤵
  PID:2008
- C:\Windows\System\bUajPkU.exe
  C:\Windows\System\bUajPkU.exe
  2⤵
  PID:2024
- C:\Windows\System\umNGGIf.exe
  C:\Windows\System\umNGGIf.exe
  2⤵
  PID:1112
- C:\Windows\System\Ivyttay.exe
  C:\Windows\System\Ivyttay.exe
  2⤵
  PID:1292
- C:\Windows\System\FlvnDrr.exe
  C:\Windows\System\FlvnDrr.exe
  2⤵
  PID:2236
- C:\Windows\System\RfgfqDO.exe
  C:\Windows\System\RfgfqDO.exe
  2⤵
  PID:2676
- C:\Windows\System\NrpOouI.exe
  C:\Windows\System\NrpOouI.exe
  2⤵
  PID:1848
- C:\Windows\System\kjvcPJp.exe
  C:\Windows\System\kjvcPJp.exe
  2⤵
  PID:2344
- C:\Windows\System\hhljxBU.exe
  C:\Windows\System\hhljxBU.exe
  2⤵
  PID:2256
- C:\Windows\System\PJwGfVh.exe
  C:\Windows\System\PJwGfVh.exe
  2⤵
  PID:2304
- C:\Windows\System\HqYBvlQ.exe
  C:\Windows\System\HqYBvlQ.exe
  2⤵
  PID:2244
- C:\Windows\System\jtukDSR.exe
  C:\Windows\System\jtukDSR.exe
  2⤵
  PID:2504
- C:\Windows\System\jaLmEhH.exe
  C:\Windows\System\jaLmEhH.exe
  2⤵
  PID:1900
- C:\Windows\System\mTikCos.exe
  C:\Windows\System\mTikCos.exe
  2⤵
  PID:1084
- C:\Windows\System\MMuxEDv.exe
  C:\Windows\System\MMuxEDv.exe
  2⤵
  PID:408
- C:\Windows\System\jOgbZbh.exe
  C:\Windows\System\jOgbZbh.exe
  2⤵
  PID:1040
- C:\Windows\System\RjFONUv.exe
  C:\Windows\System\RjFONUv.exe
  2⤵
  PID:1596
- C:\Windows\System\HpTcErx.exe
  C:\Windows\System\HpTcErx.exe
  2⤵
  PID:2996
- C:\Windows\System\zolQhvt.exe
  C:\Windows\System\zolQhvt.exe
  2⤵
  PID:2292
- C:\Windows\System\xeyvQZO.exe
  C:\Windows\System\xeyvQZO.exe
  2⤵
  PID:2020
- C:\Windows\System\LWDxzJO.exe
  C:\Windows\System\LWDxzJO.exe
  2⤵
  PID:2396
- C:\Windows\System\lLJShMv.exe
  C:\Windows\System\lLJShMv.exe
  2⤵
  PID:1268
- C:\Windows\System\WMEdvHy.exe
  C:\Windows\System\WMEdvHy.exe
  2⤵
  PID:2300
- C:\Windows\System\ckQPMXS.exe
  C:\Windows\System\ckQPMXS.exe
  2⤵
  PID:2900
- C:\Windows\System\uAxpGax.exe
  C:\Windows\System\uAxpGax.exe
  2⤵
  PID:2788
- C:\Windows\System\xRyjsHv.exe
  C:\Windows\System\xRyjsHv.exe
  2⤵
  PID:2680
- C:\Windows\System\DXKJgdz.exe
  C:\Windows\System\DXKJgdz.exe
  2⤵
  PID:2528
- C:\Windows\System\OeCfhZK.exe
  C:\Windows\System\OeCfhZK.exe
  2⤵
  PID:776
- C:\Windows\System\EHPdUsq.exe
  C:\Windows\System\EHPdUsq.exe
  2⤵
  PID:1236
- C:\Windows\System\UTthgMR.exe
  C:\Windows\System\UTthgMR.exe
  2⤵
  PID:624
- C:\Windows\System\NPhqhpP.exe
  C:\Windows\System\NPhqhpP.exe
  2⤵
  PID:3040
- C:\Windows\System\IsEAlhC.exe
  C:\Windows\System\IsEAlhC.exe
  2⤵
  PID:1976
- C:\Windows\System\wCWbAnt.exe
  C:\Windows\System\wCWbAnt.exe
  2⤵
  PID:1556
- C:\Windows\System\rENwpSU.exe
  C:\Windows\System\rENwpSU.exe
  2⤵
  PID:1136
- C:\Windows\System\YezWQmF.exe
  C:\Windows\System\YezWQmF.exe
  2⤵
  PID:2152
- C:\Windows\System\bvhtrUS.exe
  C:\Windows\System\bvhtrUS.exe
  2⤵
  PID:3084
- C:\Windows\System\gYsLddo.exe
  C:\Windows\System\gYsLddo.exe
  2⤵
  PID:3100
- C:\Windows\System\EFwvmfo.exe
  C:\Windows\System\EFwvmfo.exe
  2⤵
  PID:3116
- C:\Windows\System\mbzOfKq.exe
  C:\Windows\System\mbzOfKq.exe
  2⤵
  PID:3132
- C:\Windows\System\SKbkRme.exe
  C:\Windows\System\SKbkRme.exe
  2⤵
  PID:3148
- C:\Windows\System\RQOesnq.exe
  C:\Windows\System\RQOesnq.exe
  2⤵
  PID:3164
- C:\Windows\System\GDWRBmH.exe
  C:\Windows\System\GDWRBmH.exe
  2⤵
  PID:3180
- C:\Windows\System\oFEuZTH.exe
  C:\Windows\System\oFEuZTH.exe
  2⤵
  PID:3196
- C:\Windows\System\IGhldSq.exe
  C:\Windows\System\IGhldSq.exe
  2⤵
  PID:3212
- C:\Windows\System\SwsJNQg.exe
  C:\Windows\System\SwsJNQg.exe
  2⤵
  PID:3228
- C:\Windows\System\PiaeNKk.exe
  C:\Windows\System\PiaeNKk.exe
  2⤵
  PID:3244
- C:\Windows\System\vcIIAWt.exe
  C:\Windows\System\vcIIAWt.exe
  2⤵
  PID:3264
- C:\Windows\System\KfiOPtY.exe
  C:\Windows\System\KfiOPtY.exe
  2⤵
  PID:3284
- C:\Windows\System\wKoJBqR.exe
  C:\Windows\System\wKoJBqR.exe
  2⤵
  PID:3300
- C:\Windows\System\EHqPqIZ.exe
  C:\Windows\System\EHqPqIZ.exe
  2⤵
  PID:3316
- C:\Windows\System\lzCdFIg.exe
  C:\Windows\System\lzCdFIg.exe
  2⤵
  PID:3332
- C:\Windows\System\nFFAkGq.exe
  C:\Windows\System\nFFAkGq.exe
  2⤵
  PID:3348
- C:\Windows\System\jXgvlib.exe
  C:\Windows\System\jXgvlib.exe
  2⤵
  PID:3364
- C:\Windows\System\mNMQFRh.exe
  C:\Windows\System\mNMQFRh.exe
  2⤵
  PID:3380
- C:\Windows\System\GzXQvPN.exe
  C:\Windows\System\GzXQvPN.exe
  2⤵
  PID:3400
- C:\Windows\System\KSnlJEu.exe
  C:\Windows\System\KSnlJEu.exe
  2⤵
  PID:3420
- C:\Windows\System\RXfuvtk.exe
  C:\Windows\System\RXfuvtk.exe
  2⤵
  PID:3436
- C:\Windows\System\mSvPBBK.exe
  C:\Windows\System\mSvPBBK.exe
  2⤵
  PID:3456
- C:\Windows\System\QzeWAqD.exe
  C:\Windows\System\QzeWAqD.exe
  2⤵
  PID:3472
- C:\Windows\System\ZPovEpb.exe
  C:\Windows\System\ZPovEpb.exe
  2⤵
  PID:3488
- C:\Windows\System\DQKKnMK.exe
  C:\Windows\System\DQKKnMK.exe
  2⤵
  PID:3504
- C:\Windows\System\WbKdWsy.exe
  C:\Windows\System\WbKdWsy.exe
  2⤵
  PID:3524
- C:\Windows\System\yfbklSt.exe
  C:\Windows\System\yfbklSt.exe
  2⤵
  PID:3548
- C:\Windows\System\gsKfHMS.exe
  C:\Windows\System\gsKfHMS.exe
  2⤵
  PID:3600
- C:\Windows\System\xQLwgBO.exe
  C:\Windows\System\xQLwgBO.exe
  2⤵
  PID:3636
- C:\Windows\System\RhtSjuJ.exe
  C:\Windows\System\RhtSjuJ.exe
  2⤵
  PID:3652
- C:\Windows\System\GwlpahF.exe
  C:\Windows\System\GwlpahF.exe
  2⤵
  PID:3668
- C:\Windows\System\jfzxzkg.exe
  C:\Windows\System\jfzxzkg.exe
  2⤵
  PID:3684
- C:\Windows\System\ISDClLQ.exe
  C:\Windows\System\ISDClLQ.exe
  2⤵
  PID:3700
- C:\Windows\System\ZUgpEmS.exe
  C:\Windows\System\ZUgpEmS.exe
  2⤵
  PID:3716
- C:\Windows\System\WPNShgs.exe
  C:\Windows\System\WPNShgs.exe
  2⤵
  PID:3732
- C:\Windows\System\sKLtYuo.exe
  C:\Windows\System\sKLtYuo.exe
  2⤵
  PID:3848
- C:\Windows\System\POcMSBl.exe
  C:\Windows\System\POcMSBl.exe
  2⤵
  PID:3864
- C:\Windows\System\VlclDHH.exe
  C:\Windows\System\VlclDHH.exe
  2⤵
  PID:3880
- C:\Windows\System\GIaIrfB.exe
  C:\Windows\System\GIaIrfB.exe
  2⤵
  PID:3896
- C:\Windows\System\NTJCnTB.exe
  C:\Windows\System\NTJCnTB.exe
  2⤵
  PID:3912
- C:\Windows\System\onVFqnq.exe
  C:\Windows\System\onVFqnq.exe
  2⤵
  PID:3932
- C:\Windows\System\TseKHwR.exe
  C:\Windows\System\TseKHwR.exe
  2⤵
  PID:3948
- C:\Windows\System\raAjsBR.exe
  C:\Windows\System\raAjsBR.exe
  2⤵
  PID:3968
- C:\Windows\System\eBoHwSY.exe
  C:\Windows\System\eBoHwSY.exe
  2⤵
  PID:3984
- C:\Windows\System\WeTtzTD.exe
  C:\Windows\System\WeTtzTD.exe
  2⤵
  PID:4004
- C:\Windows\System\ETrZtND.exe
  C:\Windows\System\ETrZtND.exe
  2⤵
  PID:4020
- C:\Windows\System\viSnpJx.exe
  C:\Windows\System\viSnpJx.exe
  2⤵
  PID:4036
- C:\Windows\System\UStPnFy.exe
  C:\Windows\System\UStPnFy.exe
  2⤵
  PID:4060
- C:\Windows\System\ekkqSBg.exe
  C:\Windows\System\ekkqSBg.exe
  2⤵
  PID:4076
- C:\Windows\System\kmpOOsQ.exe
  C:\Windows\System\kmpOOsQ.exe
  2⤵
  PID:4092
- C:\Windows\System\TYFiQIT.exe
  C:\Windows\System\TYFiQIT.exe
  2⤵
  PID:1756
- C:\Windows\System\SiITovp.exe
  C:\Windows\System\SiITovp.exe
  2⤵
  PID:3092
- C:\Windows\System\SqIQaaO.exe
  C:\Windows\System\SqIQaaO.exe
  2⤵
  PID:3160
- C:\Windows\System\MTwlcJU.exe
  C:\Windows\System\MTwlcJU.exe
  2⤵
  PID:3224
- C:\Windows\System\MFioSif.exe
  C:\Windows\System\MFioSif.exe
  2⤵
  PID:3292
- C:\Windows\System\PuCkVfP.exe
  C:\Windows\System\PuCkVfP.exe
  2⤵
  PID:3356
- C:\Windows\System\vUhTYFi.exe
  C:\Windows\System\vUhTYFi.exe
  2⤵
  PID:3428
- C:\Windows\System\NHGShbX.exe
  C:\Windows\System\NHGShbX.exe
  2⤵
  PID:3468
- C:\Windows\System\NzNWjYX.exe
  C:\Windows\System\NzNWjYX.exe
  2⤵
  PID:3208
- C:\Windows\System\RDnXeuB.exe
  C:\Windows\System\RDnXeuB.exe
  2⤵
  PID:3276
- C:\Windows\System\PNSYFlc.exe
  C:\Windows\System\PNSYFlc.exe
  2⤵
  PID:3340
- C:\Windows\System\FVgQldS.exe
  C:\Windows\System\FVgQldS.exe
  2⤵
  PID:3416
- C:\Windows\System\XNwDLxa.exe
  C:\Windows\System\XNwDLxa.exe
  2⤵
  PID:3480
- C:\Windows\System\owMSJkp.exe
  C:\Windows\System\owMSJkp.exe
  2⤵
  PID:3520
- C:\Windows\System\xdwAuSW.exe
  C:\Windows\System\xdwAuSW.exe
  2⤵
  PID:1468
- C:\Windows\System\kVvklGo.exe
  C:\Windows\System\kVvklGo.exe
  2⤵
  PID:3588
- C:\Windows\System\NiDLiBW.exe
  C:\Windows\System\NiDLiBW.exe
  2⤵
  PID:3692
- C:\Windows\System\JOBreGc.exe
  C:\Windows\System\JOBreGc.exe
  2⤵
  PID:3724
- C:\Windows\System\puaZERy.exe
  C:\Windows\System\puaZERy.exe
  2⤵
  PID:3680
- C:\Windows\System\TwMjpfA.exe
  C:\Windows\System\TwMjpfA.exe
  2⤵
  PID:3748
- C:\Windows\System\UacVDBg.exe
  C:\Windows\System\UacVDBg.exe
  2⤵
  PID:3788
- C:\Windows\System\aEjTqrm.exe
  C:\Windows\System\aEjTqrm.exe
  2⤵
  PID:3804
- C:\Windows\System\GnjCrpy.exe
  C:\Windows\System\GnjCrpy.exe
  2⤵
  PID:3828
- C:\Windows\System\iwyhtUW.exe
  C:\Windows\System\iwyhtUW.exe
  2⤵
  PID:3856
- C:\Windows\System\uJQYlUS.exe
  C:\Windows\System\uJQYlUS.exe
  2⤵
  PID:3920
- C:\Windows\System\qPmHgeZ.exe
  C:\Windows\System\qPmHgeZ.exe
  2⤵
  PID:3960
- C:\Windows\System\iQoExtp.exe
  C:\Windows\System\iQoExtp.exe
  2⤵
  PID:4000
- C:\Windows\System\GxaUJeP.exe
  C:\Windows\System\GxaUJeP.exe
  2⤵
  PID:4072
- C:\Windows\System\wtRSkum.exe
  C:\Windows\System\wtRSkum.exe
  2⤵
  PID:3260
- C:\Windows\System\QiVlqon.exe
  C:\Windows\System\QiVlqon.exe
  2⤵
  PID:3840
- C:\Windows\System\MdwciWi.exe
  C:\Windows\System\MdwciWi.exe
  2⤵
  PID:3876
- C:\Windows\System\xXDwgWi.exe
  C:\Windows\System\xXDwgWi.exe
  2⤵
  PID:3944
- C:\Windows\System\QXkeOKb.exe
  C:\Windows\System\QXkeOKb.exe
  2⤵
  PID:4016
- C:\Windows\System\QGxduPc.exe
  C:\Windows\System\QGxduPc.exe
  2⤵
  PID:4084
- C:\Windows\System\MuzzmTD.exe
  C:\Windows\System\MuzzmTD.exe
  2⤵
  PID:2960
- C:\Windows\System\XGjfSip.exe
  C:\Windows\System\XGjfSip.exe
  2⤵
  PID:3192
- C:\Windows\System\xAJJrnq.exe
  C:\Windows\System\xAJJrnq.exe
  2⤵
  PID:3540
- C:\Windows\System\fvDHMQT.exe
  C:\Windows\System\fvDHMQT.exe
  2⤵
  PID:3372
- C:\Windows\System\BkagIok.exe
  C:\Windows\System\BkagIok.exe
  2⤵
  PID:2800
- C:\Windows\System\CUQUrcn.exe
  C:\Windows\System\CUQUrcn.exe
  2⤵
  PID:3112
- C:\Windows\System\lWVbnEd.exe
  C:\Windows\System\lWVbnEd.exe
  2⤵
  PID:3204
- C:\Windows\System\CDNyOOK.exe
  C:\Windows\System\CDNyOOK.exe
  2⤵
  PID:3512
- C:\Windows\System\gmSsGrc.exe
  C:\Windows\System\gmSsGrc.exe
  2⤵
  PID:2084
- C:\Windows\System\IiMyJez.exe
  C:\Windows\System\IiMyJez.exe
  2⤵
  PID:3676
- C:\Windows\System\fonLMGI.exe
  C:\Windows\System\fonLMGI.exe
  2⤵
  PID:3768
- C:\Windows\System\uCqMsqF.exe
  C:\Windows\System\uCqMsqF.exe
  2⤵
  PID:3712
- C:\Windows\System\fObrQJu.exe
  C:\Windows\System\fObrQJu.exe
  2⤵
  PID:4068
- C:\Windows\System\FXdlweK.exe
  C:\Windows\System\FXdlweK.exe
  2⤵
  PID:3888
- C:\Windows\System\OCUYScp.exe
  C:\Windows\System\OCUYScp.exe
  2⤵
  PID:344
- C:\Windows\System\SkTKZul.exe
  C:\Windows\System\SkTKZul.exe
  2⤵
  PID:3256
- C:\Windows\System\GENdian.exe
  C:\Windows\System\GENdian.exe
  2⤵
  PID:4012
- C:\Windows\System\VEoSvuW.exe
  C:\Windows\System\VEoSvuW.exe
  2⤵
  PID:3536
- C:\Windows\System\qnZCPgF.exe
  C:\Windows\System\qnZCPgF.exe
  2⤵
  PID:3144
- C:\Windows\System\bcishsw.exe
  C:\Windows\System\bcishsw.exe
  2⤵
  PID:3392
- C:\Windows\System\LFmNlXn.exe
  C:\Windows\System\LFmNlXn.exe
  2⤵
  PID:4056
- C:\Windows\System\tHzDXFZ.exe
  C:\Windows\System\tHzDXFZ.exe
  2⤵
  PID:3744
- C:\Windows\System\oVRyNSs.exe
  C:\Windows\System\oVRyNSs.exe
  2⤵
  PID:3928
- C:\Windows\System\gYUrDYR.exe
  C:\Windows\System\gYUrDYR.exe
  2⤵
  PID:3796
- C:\Windows\System\EryANfK.exe
  C:\Windows\System\EryANfK.exe
  2⤵
  PID:2880
- C:\Windows\System\gZHaKkn.exe
  C:\Windows\System\gZHaKkn.exe
  2⤵
  PID:4044
- C:\Windows\System\dBVhwZm.exe
  C:\Windows\System\dBVhwZm.exe
  2⤵
  PID:2888
- C:\Windows\System\LwRKQhw.exe
  C:\Windows\System\LwRKQhw.exe
  2⤵
  PID:3220
- C:\Windows\System\wVIINDM.exe
  C:\Windows\System\wVIINDM.exe
  2⤵
  PID:3412
- C:\Windows\System\romKCRx.exe
  C:\Windows\System\romKCRx.exe
  2⤵
  PID:3776
- C:\Windows\System\XRxVlMl.exe
  C:\Windows\System\XRxVlMl.exe
  2⤵
  PID:4112
- C:\Windows\System\XREFpYG.exe
  C:\Windows\System\XREFpYG.exe
  2⤵
  PID:4128
- C:\Windows\System\LbYzwbX.exe
  C:\Windows\System\LbYzwbX.exe
  2⤵
  PID:4144
- C:\Windows\System\xIOUiFa.exe
  C:\Windows\System\xIOUiFa.exe
  2⤵
  PID:4168
- C:\Windows\System\pNTTPbe.exe
  C:\Windows\System\pNTTPbe.exe
  2⤵
  PID:4184
- C:\Windows\System\NRHojJz.exe
  C:\Windows\System\NRHojJz.exe
  2⤵
  PID:4200
- C:\Windows\System\lyCTSEG.exe
  C:\Windows\System\lyCTSEG.exe
  2⤵
  PID:4216
- C:\Windows\System\Lykfmdp.exe
  C:\Windows\System\Lykfmdp.exe
  2⤵
  PID:4232
- C:\Windows\System\zoUfVJt.exe
  C:\Windows\System\zoUfVJt.exe
  2⤵
  PID:4252
- C:\Windows\System\EhiEvWi.exe
  C:\Windows\System\EhiEvWi.exe
  2⤵
  PID:4376
- C:\Windows\System\yPTngYi.exe
  C:\Windows\System\yPTngYi.exe
  2⤵
  PID:4392
- C:\Windows\System\uvvxIWJ.exe
  C:\Windows\System\uvvxIWJ.exe
  2⤵
  PID:4408
- C:\Windows\System\feCTEIG.exe
  C:\Windows\System\feCTEIG.exe
  2⤵
  PID:4424
- C:\Windows\System\RoIjhbP.exe
  C:\Windows\System\RoIjhbP.exe
  2⤵
  PID:4440
- C:\Windows\System\BebpDld.exe
  C:\Windows\System\BebpDld.exe
  2⤵
  PID:4456
- C:\Windows\System\BDbUCmM.exe
  C:\Windows\System\BDbUCmM.exe
  2⤵
  PID:4472
- C:\Windows\System\iaOdRGM.exe
  C:\Windows\System\iaOdRGM.exe
  2⤵
  PID:4488
- C:\Windows\System\mzGvFxT.exe
  C:\Windows\System\mzGvFxT.exe
  2⤵
  PID:4504
- C:\Windows\System\aqYbsXY.exe
  C:\Windows\System\aqYbsXY.exe
  2⤵
  PID:4520
- C:\Windows\System\vuuGxBq.exe
  C:\Windows\System\vuuGxBq.exe
  2⤵
  PID:4536
- C:\Windows\System\oYGOLmn.exe
  C:\Windows\System\oYGOLmn.exe
  2⤵
  PID:4552
- C:\Windows\System\VbHgCUl.exe
  C:\Windows\System\VbHgCUl.exe
  2⤵
  PID:4568
- C:\Windows\System\UXyMCVt.exe
  C:\Windows\System\UXyMCVt.exe
  2⤵
  PID:4584
- C:\Windows\System\iQcvIvc.exe
  C:\Windows\System\iQcvIvc.exe
  2⤵
  PID:4600
- C:\Windows\System\ySbNOgc.exe
  C:\Windows\System\ySbNOgc.exe
  2⤵
  PID:4616
- C:\Windows\System\luKwSBS.exe
  C:\Windows\System\luKwSBS.exe
  2⤵
  PID:4632
- C:\Windows\System\ZMqiHss.exe
  C:\Windows\System\ZMqiHss.exe
  2⤵
  PID:4648
- C:\Windows\System\aXWudjQ.exe
  C:\Windows\System\aXWudjQ.exe
  2⤵
  PID:4664
- C:\Windows\System\fOhpSHk.exe
  C:\Windows\System\fOhpSHk.exe
  2⤵
  PID:4680
- C:\Windows\System\mNiuLqb.exe
  C:\Windows\System\mNiuLqb.exe
  2⤵
  PID:4696
- C:\Windows\System\fyFvMND.exe
  C:\Windows\System\fyFvMND.exe
  2⤵
  PID:4712
- C:\Windows\System\toPLlWG.exe
  C:\Windows\System\toPLlWG.exe
  2⤵
  PID:4732
- C:\Windows\System\xkcCqyO.exe
  C:\Windows\System\xkcCqyO.exe
  2⤵
  PID:4752
- C:\Windows\System\suqlnsQ.exe
  C:\Windows\System\suqlnsQ.exe
  2⤵
  PID:4772
- C:\Windows\System\nXADkZa.exe
  C:\Windows\System\nXADkZa.exe
  2⤵
  PID:4788
- C:\Windows\System\kdjNohi.exe
  C:\Windows\System\kdjNohi.exe
  2⤵
  PID:4808
- C:\Windows\System\DLJLWXJ.exe
  C:\Windows\System\DLJLWXJ.exe
  2⤵
  PID:4828
- C:\Windows\System\BVLfQCz.exe
  C:\Windows\System\BVLfQCz.exe
  2⤵
  PID:4844
- C:\Windows\System\XfVqGqU.exe
  C:\Windows\System\XfVqGqU.exe
  2⤵
  PID:4860
- C:\Windows\System\iwnOHdS.exe
  C:\Windows\System\iwnOHdS.exe
  2⤵
  PID:4932
- C:\Windows\System\DFGbJYt.exe
  C:\Windows\System\DFGbJYt.exe
  2⤵
  PID:5016
- C:\Windows\System\bRIvGmr.exe
  C:\Windows\System\bRIvGmr.exe
  2⤵
  PID:5032
- C:\Windows\System\oXWzmme.exe
  C:\Windows\System\oXWzmme.exe
  2⤵
  PID:5052
- C:\Windows\System\znScvYz.exe
  C:\Windows\System\znScvYz.exe
  2⤵
  PID:5068
- C:\Windows\System\ZuuhwoS.exe
  C:\Windows\System\ZuuhwoS.exe
  2⤵
  PID:5084
- C:\Windows\System\WunPHQJ.exe
  C:\Windows\System\WunPHQJ.exe
  2⤵
  PID:5100
- C:\Windows\System\LLeRYef.exe
  C:\Windows\System\LLeRYef.exe
  2⤵
  PID:3816
- C:\Windows\System\SNIBXth.exe
  C:\Windows\System\SNIBXth.exe
  2⤵
  PID:1176
- C:\Windows\System\BlfGYTc.exe
  C:\Windows\System\BlfGYTc.exe
  2⤵
  PID:2332
- C:\Windows\System\TKipMzL.exe
  C:\Windows\System\TKipMzL.exe
  2⤵
  PID:3308
- C:\Windows\System\SlkEBGj.exe
  C:\Windows\System\SlkEBGj.exe
  2⤵
  PID:1736
- C:\Windows\System\QscMEsc.exe
  C:\Windows\System\QscMEsc.exe
  2⤵
  PID:3240
- C:\Windows\System\HRivUGQ.exe
  C:\Windows\System\HRivUGQ.exe
  2⤵
  PID:4160
- C:\Windows\System\rWFEvKv.exe
  C:\Windows\System\rWFEvKv.exe
  2⤵
  PID:4224
- C:\Windows\System\lOHRgWl.exe
  C:\Windows\System\lOHRgWl.exe
  2⤵
  PID:4268
- C:\Windows\System\HkObauM.exe
  C:\Windows\System\HkObauM.exe
  2⤵
  PID:3872
- C:\Windows\System\AUaCbNC.exe
  C:\Windows\System\AUaCbNC.exe
  2⤵
  PID:3408
- C:\Windows\System\cEnqXIw.exe
  C:\Windows\System\cEnqXIw.exe
  2⤵
  PID:3992
- C:\Windows\System\TiuqdOd.exe
  C:\Windows\System\TiuqdOd.exe
  2⤵
  PID:4052
- C:\Windows\System\acClZOY.exe
  C:\Windows\System\acClZOY.exe
  2⤵
  PID:4208
- C:\Windows\System\PfSuOEF.exe
  C:\Windows\System\PfSuOEF.exe
  2⤵
  PID:4136
- C:\Windows\System\HUQARJr.exe
  C:\Windows\System\HUQARJr.exe
  2⤵
  PID:4284
- C:\Windows\System\ErFzVLG.exe
  C:\Windows\System\ErFzVLG.exe
  2⤵
  PID:4304
- C:\Windows\System\QECkRKR.exe
  C:\Windows\System\QECkRKR.exe
  2⤵
  PID:4400
- C:\Windows\System\xBVNrCJ.exe
  C:\Windows\System\xBVNrCJ.exe
  2⤵
  PID:4464
- C:\Windows\System\mbHIvch.exe
  C:\Windows\System\mbHIvch.exe
  2⤵
  PID:4500
- C:\Windows\System\xRCcNDU.exe
  C:\Windows\System\xRCcNDU.exe
  2⤵
  PID:4564
- C:\Windows\System\QuDNUDy.exe
  C:\Windows\System\QuDNUDy.exe
  2⤵
  PID:4624
- C:\Windows\System\fzShTUY.exe
  C:\Windows\System\fzShTUY.exe
  2⤵
  PID:4660
- C:\Windows\System\DfeEXXj.exe
  C:\Windows\System\DfeEXXj.exe
  2⤵
  PID:4480
- C:\Windows\System\SPrFktx.exe
  C:\Windows\System\SPrFktx.exe
  2⤵
  PID:4548
- C:\Windows\System\WrNTNwL.exe
  C:\Windows\System\WrNTNwL.exe
  2⤵
  PID:4516
- C:\Windows\System\YtbOgot.exe
  C:\Windows\System\YtbOgot.exe
  2⤵
  PID:4640
- C:\Windows\System\CgkZGHI.exe
  C:\Windows\System\CgkZGHI.exe
  2⤵
  PID:4728
- C:\Windows\System\CmmKyaw.exe
  C:\Windows\System\CmmKyaw.exe
  2⤵
  PID:4800
- C:\Windows\System\WUdfFVF.exe
  C:\Windows\System\WUdfFVF.exe
  2⤵
  PID:4888
- C:\Windows\System\HdbKMMi.exe
  C:\Windows\System\HdbKMMi.exe
  2⤵
  PID:4928
- C:\Windows\System\oaJrwbe.exe
  C:\Windows\System\oaJrwbe.exe
  2⤵
  PID:4868
- C:\Windows\System\HWiYNrG.exe
  C:\Windows\System\HWiYNrG.exe
  2⤵
  PID:4880
- C:\Windows\System\CfloPlX.exe
  C:\Windows\System\CfloPlX.exe
  2⤵
  PID:4912
- C:\Windows\System\WZFMJeg.exe
  C:\Windows\System\WZFMJeg.exe
  2⤵
  PID:4956
- C:\Windows\System\iTrojdo.exe
  C:\Windows\System\iTrojdo.exe
  2⤵
  PID:4972
- C:\Windows\System\IAIsxej.exe
  C:\Windows\System\IAIsxej.exe
  2⤵
  PID:4984
- C:\Windows\System\hvDnHef.exe
  C:\Windows\System\hvDnHef.exe
  2⤵
  PID:5000
- C:\Windows\System\VtWfOEj.exe
  C:\Windows\System\VtWfOEj.exe
  2⤵
  PID:5024
- C:\Windows\System\ttkAgRL.exe
  C:\Windows\System\ttkAgRL.exe
  2⤵
  PID:5060
- C:\Windows\System\GSlwBKO.exe
  C:\Windows\System\GSlwBKO.exe
  2⤵
  PID:3156
- C:\Windows\System\PqQdueu.exe
  C:\Windows\System\PqQdueu.exe
  2⤵
  PID:5076
- C:\Windows\System\OOeUoBo.exe
  C:\Windows\System\OOeUoBo.exe
  2⤵
  PID:4260
- C:\Windows\System\mmVDIGa.exe
  C:\Windows\System\mmVDIGa.exe
  2⤵
  PID:576
- C:\Windows\System\sOxUVce.exe
  C:\Windows\System\sOxUVce.exe
  2⤵
  PID:3648
- C:\Windows\System\SuRyOKW.exe
  C:\Windows\System\SuRyOKW.exe
  2⤵
  PID:4196
- C:\Windows\System\UUmoPci.exe
  C:\Windows\System\UUmoPci.exe
  2⤵
  PID:4032
- C:\Windows\System\gSFiCYQ.exe
  C:\Windows\System\gSFiCYQ.exe
  2⤵
  PID:3940
- C:\Windows\System\hIEDSKB.exe
  C:\Windows\System\hIEDSKB.exe
  2⤵
  PID:3452
- C:\Windows\System\KvRhdLf.exe
  C:\Windows\System\KvRhdLf.exe
  2⤵
  PID:4108
- C:\Windows\System\tgMaGFb.exe
  C:\Windows\System\tgMaGFb.exe
  2⤵
  PID:4180
- C:\Windows\System\SHrTBjB.exe
  C:\Windows\System\SHrTBjB.exe
  2⤵
  PID:4296
- C:\Windows\System\PLHmscQ.exe
  C:\Windows\System\PLHmscQ.exe
  2⤵
  PID:4316
- C:\Windows\System\CpWwiCt.exe
  C:\Windows\System\CpWwiCt.exe
  2⤵
  PID:4356
- C:\Windows\System\hsHFucr.exe
  C:\Windows\System\hsHFucr.exe
  2⤵
  PID:4592
- C:\Windows\System\chVCKYK.exe
  C:\Windows\System\chVCKYK.exe
  2⤵
  PID:4768
- C:\Windows\System\TzbahiB.exe
  C:\Windows\System\TzbahiB.exe
  2⤵
  PID:4940
- C:\Windows\System\DaIwdCu.exe
  C:\Windows\System\DaIwdCu.exe
  2⤵
  PID:4908
- C:\Windows\System\norokuc.exe
  C:\Windows\System\norokuc.exe
  2⤵
  PID:4992
- C:\Windows\System\KEexvhK.exe
  C:\Windows\System\KEexvhK.exe
  2⤵
  PID:4980
- C:\Windows\System\QhgdRxM.exe
  C:\Windows\System\QhgdRxM.exe
  2⤵
  PID:5040
- C:\Windows\System\gZMuShs.exe
  C:\Windows\System\gZMuShs.exe
  2⤵
  PID:3980
- C:\Windows\System\ManScNT.exe
  C:\Windows\System\ManScNT.exe
  2⤵
  PID:4312
- C:\Windows\System\vhmkeyN.exe
  C:\Windows\System\vhmkeyN.exe
  2⤵
  PID:3608
- C:\Windows\System\jEpQUQM.exe
  C:\Windows\System\jEpQUQM.exe
  2⤵
  PID:4300
- C:\Windows\System\MkBwJJt.exe
  C:\Windows\System\MkBwJJt.exe
  2⤵
  PID:3632
- C:\Windows\System\ipOKyDY.exe
  C:\Windows\System\ipOKyDY.exe
  2⤵
  PID:4264
- C:\Windows\System\iFFRvff.exe
  C:\Windows\System\iFFRvff.exe
  2⤵
  PID:4332
- C:\Windows\System\WpAbyOg.exe
  C:\Windows\System\WpAbyOg.exe
  2⤵
  PID:4416
- C:\Windows\System\moHPhQf.exe
  C:\Windows\System\moHPhQf.exe
  2⤵
  PID:4452
- C:\Windows\System\ktcjdBM.exe
  C:\Windows\System\ktcjdBM.exe
  2⤵
  PID:1968
- C:\Windows\System\HXBIaLl.exe
  C:\Windows\System\HXBIaLl.exe
  2⤵
  PID:4824
- C:\Windows\System\WIkLHOR.exe
  C:\Windows\System\WIkLHOR.exe
  2⤵
  PID:4692
- C:\Windows\System\yjSGnPk.exe
  C:\Windows\System\yjSGnPk.exe
  2⤵
  PID:4944
- C:\Windows\System\nOPDNyM.exe
  C:\Windows\System\nOPDNyM.exe
  2⤵
  PID:4968
- C:\Windows\System\fkapEyY.exe
  C:\Windows\System\fkapEyY.exe
  2⤵
  PID:4152
- C:\Windows\System\PfYTzKc.exe
  C:\Windows\System\PfYTzKc.exe
  2⤵
  PID:5048
- C:\Windows\System\qGJJwKf.exe
  C:\Windows\System\qGJJwKf.exe
  2⤵
  PID:5080
- C:\Windows\System\RqUrmvx.exe
  C:\Windows\System\RqUrmvx.exe
  2⤵
  PID:4192
- C:\Windows\System\cOfKDNZ.exe
  C:\Windows\System\cOfKDNZ.exe
  2⤵
  PID:4324
- C:\Windows\System\oxYXGth.exe
  C:\Windows\System\oxYXGth.exe
  2⤵
  PID:4368
- C:\Windows\System\ANrWuqS.exe
  C:\Windows\System\ANrWuqS.exe
  2⤵
  PID:4580
- C:\Windows\System\yCYemNf.exe
  C:\Windows\System\yCYemNf.exe
  2⤵
  PID:4708
- C:\Windows\System\gaasBWp.exe
  C:\Windows\System\gaasBWp.exe
  2⤵
  PID:4448
- C:\Windows\System\PailFjw.exe
  C:\Windows\System\PailFjw.exe
  2⤵
  PID:4852
- C:\Windows\System\mEQifzr.exe
  C:\Windows\System\mEQifzr.exe
  2⤵
  PID:4856
- C:\Windows\System\FPbiRdW.exe
  C:\Windows\System\FPbiRdW.exe
  2⤵
  PID:4140
- C:\Windows\System\SivCvNq.exe
  C:\Windows\System\SivCvNq.exe
  2⤵
  PID:4384
- C:\Windows\System\hpLfbQd.exe
  C:\Windows\System\hpLfbQd.exe
  2⤵
  PID:2160
- C:\Windows\System\NyzmPbs.exe
  C:\Windows\System\NyzmPbs.exe
  2⤵
  PID:4336
- C:\Windows\System\weaFjaC.exe
  C:\Windows\System\weaFjaC.exe
  2⤵
  PID:4608
- C:\Windows\System\uDCItjX.exe
  C:\Windows\System\uDCItjX.exe
  2⤵
  PID:4884
- C:\Windows\System\PYroKFB.exe
  C:\Windows\System\PYroKFB.exe
  2⤵
  PID:4952
- C:\Windows\System\kiHSKnI.exe
  C:\Windows\System\kiHSKnI.exe
  2⤵
  PID:4720
- C:\Windows\System\QaMgXnZ.exe
  C:\Windows\System\QaMgXnZ.exe
  2⤵
  PID:4292
- C:\Windows\System\XhcKlok.exe
  C:\Windows\System\XhcKlok.exe
  2⤵
  PID:4372
- C:\Windows\System\onlrgvV.exe
  C:\Windows\System\onlrgvV.exe
  2⤵
  PID:4916
- C:\Windows\System\Qesquhm.exe
  C:\Windows\System\Qesquhm.exe
  2⤵
  PID:3784
- C:\Windows\System\FpjIqTh.exe
  C:\Windows\System\FpjIqTh.exe
  2⤵
  PID:2804
- C:\Windows\System\JAYzbwz.exe
  C:\Windows\System\JAYzbwz.exe
  2⤵
  PID:5124
- C:\Windows\System\zwtFiYJ.exe
  C:\Windows\System\zwtFiYJ.exe
  2⤵
  PID:5140
- C:\Windows\System\eNkgAVs.exe
  C:\Windows\System\eNkgAVs.exe
  2⤵
  PID:5160
- C:\Windows\System\LATzQLa.exe
  C:\Windows\System\LATzQLa.exe
  2⤵
  PID:5184
- C:\Windows\System\BpffJnB.exe
  C:\Windows\System\BpffJnB.exe
  2⤵
  PID:5200
- C:\Windows\System\SqPgdKJ.exe
  C:\Windows\System\SqPgdKJ.exe
  2⤵
  PID:5220
- C:\Windows\System\hvFyLRv.exe
  C:\Windows\System\hvFyLRv.exe
  2⤵
  PID:5236
- C:\Windows\System\gXFAmFi.exe
  C:\Windows\System\gXFAmFi.exe
  2⤵
  PID:5256
- C:\Windows\System\rKELjBX.exe
  C:\Windows\System\rKELjBX.exe
  2⤵
  PID:5272
- C:\Windows\System\wWuYUIl.exe
  C:\Windows\System\wWuYUIl.exe
  2⤵
  PID:5288
- C:\Windows\System\AMLGvXi.exe
  C:\Windows\System\AMLGvXi.exe
  2⤵
  PID:5312
- C:\Windows\System\MhRCWBH.exe
  C:\Windows\System\MhRCWBH.exe
  2⤵
  PID:5328
- C:\Windows\System\fFKEoeP.exe
  C:\Windows\System\fFKEoeP.exe
  2⤵
  PID:5348
- C:\Windows\System\RaEwVOB.exe
  C:\Windows\System\RaEwVOB.exe
  2⤵
  PID:5404
- C:\Windows\System\jUNvAsK.exe
  C:\Windows\System\jUNvAsK.exe
  2⤵
  PID:5420
- C:\Windows\System\TdHIPmy.exe
  C:\Windows\System\TdHIPmy.exe
  2⤵
  PID:5436
- C:\Windows\System\kkgNfwg.exe
  C:\Windows\System\kkgNfwg.exe
  2⤵
  PID:5452
- C:\Windows\System\wFPojOG.exe
  C:\Windows\System\wFPojOG.exe
  2⤵
  PID:5468
- C:\Windows\System\QJtrBiR.exe
  C:\Windows\System\QJtrBiR.exe
  2⤵
  PID:5488
- C:\Windows\System\svbeiql.exe
  C:\Windows\System\svbeiql.exe
  2⤵
  PID:5504
- C:\Windows\System\nwIEqzx.exe
  C:\Windows\System\nwIEqzx.exe
  2⤵
  PID:5520
- C:\Windows\System\BjKfkUU.exe
  C:\Windows\System\BjKfkUU.exe
  2⤵
  PID:5536
- C:\Windows\System\NGnwePl.exe
  C:\Windows\System\NGnwePl.exe
  2⤵
  PID:5596
- C:\Windows\System\SjcqsPg.exe
  C:\Windows\System\SjcqsPg.exe
  2⤵
  PID:5612
- C:\Windows\System\ALoEEtT.exe
  C:\Windows\System\ALoEEtT.exe
  2⤵
  PID:5628
- C:\Windows\System\VmrmvzR.exe
  C:\Windows\System\VmrmvzR.exe
  2⤵
  PID:5644
- C:\Windows\System\nzGuxXj.exe
  C:\Windows\System\nzGuxXj.exe
  2⤵
  PID:5660
- C:\Windows\System\rQeSSak.exe
  C:\Windows\System\rQeSSak.exe
  2⤵
  PID:5676
- C:\Windows\System\YuthqAh.exe
  C:\Windows\System\YuthqAh.exe
  2⤵
  PID:5692
- C:\Windows\System\dNbsZFg.exe
  C:\Windows\System\dNbsZFg.exe
  2⤵
  PID:5712
- C:\Windows\System\qxPWxZf.exe
  C:\Windows\System\qxPWxZf.exe
  2⤵
  PID:5728
- C:\Windows\System\ipgPxOi.exe
  C:\Windows\System\ipgPxOi.exe
  2⤵
  PID:5744
- C:\Windows\System\MrsGCIB.exe
  C:\Windows\System\MrsGCIB.exe
  2⤵
  PID:5760
- C:\Windows\System\LmiBVbj.exe
  C:\Windows\System\LmiBVbj.exe
  2⤵
  PID:5780
- C:\Windows\System\OMOPsOL.exe
  C:\Windows\System\OMOPsOL.exe
  2⤵
  PID:5796
- C:\Windows\System\yyoTgbO.exe
  C:\Windows\System\yyoTgbO.exe
  2⤵
  PID:5856
- C:\Windows\System\vWnbhEv.exe
  C:\Windows\System\vWnbhEv.exe
  2⤵
  PID:5872
- C:\Windows\System\xaUWDVG.exe
  C:\Windows\System\xaUWDVG.exe
  2⤵
  PID:5888
- C:\Windows\System\SFVgCoL.exe
  C:\Windows\System\SFVgCoL.exe
  2⤵
  PID:5904
- C:\Windows\System\JtQBcZt.exe
  C:\Windows\System\JtQBcZt.exe
  2⤵
  PID:5920
- C:\Windows\System\NcFdCaS.exe
  C:\Windows\System\NcFdCaS.exe
  2⤵
  PID:5936
- C:\Windows\System\jWQTsGa.exe
  C:\Windows\System\jWQTsGa.exe
  2⤵
  PID:5960
- C:\Windows\System\OpMSjwD.exe
  C:\Windows\System\OpMSjwD.exe
  2⤵
  PID:5980
- C:\Windows\System\pIcOUnk.exe
  C:\Windows\System\pIcOUnk.exe
  2⤵
  PID:5996
- C:\Windows\System\qHBmNVT.exe
  C:\Windows\System\qHBmNVT.exe
  2⤵
  PID:6012
- C:\Windows\System\VTsNrRe.exe
  C:\Windows\System\VTsNrRe.exe
  2⤵
  PID:6028
- C:\Windows\System\eZlbSXx.exe
  C:\Windows\System\eZlbSXx.exe
  2⤵
  PID:6048
- C:\Windows\System\hTXYxbT.exe
  C:\Windows\System\hTXYxbT.exe
  2⤵
  PID:6064
- C:\Windows\System\lcwGIPv.exe
  C:\Windows\System\lcwGIPv.exe
  2⤵
  PID:6116
- C:\Windows\System\igbwngg.exe
  C:\Windows\System\igbwngg.exe
  2⤵
  PID:6132
- C:\Windows\System\LmlIOue.exe
  C:\Windows\System\LmlIOue.exe
  2⤵
  PID:5152
- C:\Windows\System\Qtuviuk.exe
  C:\Windows\System\Qtuviuk.exe
  2⤵
  PID:4344
- C:\Windows\System\Wzlztwx.exe
  C:\Windows\System\Wzlztwx.exe
  2⤵
  PID:5132
- C:\Windows\System\TvPOWlH.exe
  C:\Windows\System\TvPOWlH.exe
  2⤵
  PID:5208
- C:\Windows\System\ZTOsHnZ.exe
  C:\Windows\System\ZTOsHnZ.exe
  2⤵
  PID:5216
- C:\Windows\System\aToxTxd.exe
  C:\Windows\System\aToxTxd.exe
  2⤵
  PID:5280
- C:\Windows\System\yeIHEVZ.exe
  C:\Windows\System\yeIHEVZ.exe
  2⤵
  PID:5228
- C:\Windows\System\cgRgZge.exe
  C:\Windows\System\cgRgZge.exe
  2⤵
  PID:5308
- C:\Windows\System\dUsifeI.exe
  C:\Windows\System\dUsifeI.exe
  2⤵
  PID:5320
- C:\Windows\System\JJEGILY.exe
  C:\Windows\System\JJEGILY.exe
  2⤵
  PID:5364
- C:\Windows\System\uDBsloi.exe
  C:\Windows\System\uDBsloi.exe
  2⤵
  PID:5388
- C:\Windows\System\zZPofEp.exe
  C:\Windows\System\zZPofEp.exe
  2⤵
  PID:5460
- C:\Windows\System\fapAHZl.exe
  C:\Windows\System\fapAHZl.exe
  2⤵
  PID:5532
- C:\Windows\System\qZZKnTc.exe
  C:\Windows\System\qZZKnTc.exe
  2⤵
  PID:5444
- C:\Windows\System\WccyqQD.exe
  C:\Windows\System\WccyqQD.exe
  2⤵
  PID:5484
- C:\Windows\System\OubUdHD.exe
  C:\Windows\System\OubUdHD.exe
  2⤵
  PID:5552
- C:\Windows\System\WfVLrWw.exe
  C:\Windows\System\WfVLrWw.exe
  2⤵
  PID:5564
- C:\Windows\System\RhGGhNB.exe
  C:\Windows\System\RhGGhNB.exe
  2⤵
  PID:5580
- C:\Windows\System\uPsexAX.exe
  C:\Windows\System\uPsexAX.exe
  2⤵
  PID:5636
- C:\Windows\System\oeZCmQx.exe
  C:\Windows\System\oeZCmQx.exe
  2⤵
  PID:5652
- C:\Windows\System\WVgNyNM.exe
  C:\Windows\System\WVgNyNM.exe
  2⤵
  PID:5724
- C:\Windows\System\pcjUFIB.exe
  C:\Windows\System\pcjUFIB.exe
  2⤵
  PID:5792
- C:\Windows\System\RKOkPOe.exe
  C:\Windows\System\RKOkPOe.exe
  2⤵
  PID:5668
- C:\Windows\System\EARUvAD.exe
  C:\Windows\System\EARUvAD.exe
  2⤵
  PID:5832
- C:\Windows\System\sXqEdub.exe
  C:\Windows\System\sXqEdub.exe
  2⤵
  PID:5844
- C:\Windows\System\KkCDkzA.exe
  C:\Windows\System\KkCDkzA.exe
  2⤵
  PID:5848
- C:\Windows\System\rvsqxtT.exe
  C:\Windows\System\rvsqxtT.exe
  2⤵
  PID:5828
- C:\Windows\System\YQjOMTP.exe
  C:\Windows\System\YQjOMTP.exe
  2⤵
  PID:5852
- C:\Windows\System\ZXTPZdO.exe
  C:\Windows\System\ZXTPZdO.exe
  2⤵
  PID:5880
- C:\Windows\System\AuCWgVO.exe
  C:\Windows\System\AuCWgVO.exe
  2⤵
  PID:5928
- C:\Windows\System\ggYtuPZ.exe
  C:\Windows\System\ggYtuPZ.exe
  2⤵
  PID:5944
- C:\Windows\System\xBBaRlI.exe
  C:\Windows\System\xBBaRlI.exe
  2⤵
  PID:5988
- C:\Windows\System\cZQMtjD.exe
  C:\Windows\System\cZQMtjD.exe
  2⤵
  PID:6004
- C:\Windows\System\bdUpULT.exe
  C:\Windows\System\bdUpULT.exe
  2⤵
  PID:6128
- C:\Windows\System\PkRFWpE.exe
  C:\Windows\System\PkRFWpE.exe
  2⤵
  PID:4560
- C:\Windows\System\OWLRLQt.exe
  C:\Windows\System\OWLRLQt.exe
  2⤵
  PID:5176
- C:\Windows\System\nsLUSZk.exe
  C:\Windows\System\nsLUSZk.exe
  2⤵
  PID:4976
- C:\Windows\System\HOUxIxS.exe
  C:\Windows\System\HOUxIxS.exe
  2⤵
  PID:5376
- C:\Windows\System\EmFgmoF.exe
  C:\Windows\System\EmFgmoF.exe
  2⤵
  PID:5380
- C:\Windows\System\vZkeLyq.exe
  C:\Windows\System\vZkeLyq.exe
  2⤵
  PID:5300
- C:\Windows\System\mIDvNcw.exe
  C:\Windows\System\mIDvNcw.exe
  2⤵
  PID:5400
- C:\Windows\System\WtqkjQl.exe
  C:\Windows\System\WtqkjQl.exe
  2⤵
  PID:5416
- C:\Windows\System\ulHgWzt.exe
  C:\Windows\System\ulHgWzt.exe
  2⤵
  PID:5500
- C:\Windows\System\GixWXUJ.exe
  C:\Windows\System\GixWXUJ.exe
  2⤵
  PID:5560
- C:\Windows\System\lZLvMZa.exe
  C:\Windows\System\lZLvMZa.exe
  2⤵
  PID:5704
- C:\Windows\System\BhutNWS.exe
  C:\Windows\System\BhutNWS.exe
  2⤵
  PID:5672
- C:\Windows\System\UemQXcw.exe
  C:\Windows\System\UemQXcw.exe
  2⤵
  PID:5864
- C:\Windows\System\oJlyUDv.exe
  C:\Windows\System\oJlyUDv.exe
  2⤵
  PID:5740
- C:\Windows\System\ZUIAiKK.exe
  C:\Windows\System\ZUIAiKK.exe
  2⤵
  PID:5840
- C:\Windows\System\MeuZGBB.exe
  C:\Windows\System\MeuZGBB.exe
  2⤵
  PID:5608
- C:\Windows\System\krrYyOF.exe
  C:\Windows\System\krrYyOF.exe
  2⤵
  PID:6072
- C:\Windows\System\ncXjwyJ.exe
  C:\Windows\System\ncXjwyJ.exe
  2⤵
  PID:6008
- C:\Windows\System\awMdhSp.exe
  C:\Windows\System\awMdhSp.exe
  2⤵
  PID:6152
- C:\Windows\System\hFIlbaH.exe
  C:\Windows\System\hFIlbaH.exe
  2⤵
  PID:6168
- C:\Windows\System\VMUbQVG.exe
  C:\Windows\System\VMUbQVG.exe
  2⤵
  PID:6192
- C:\Windows\System\QUqmAqD.exe
  C:\Windows\System\QUqmAqD.exe
  2⤵
  PID:6208
- C:\Windows\System\ccOsvkt.exe
  C:\Windows\System\ccOsvkt.exe
  2⤵
  PID:6244
- C:\Windows\System\ckmBKGT.exe
  C:\Windows\System\ckmBKGT.exe
  2⤵
  PID:6268
- C:\Windows\System\YNwBJNI.exe
  C:\Windows\System\YNwBJNI.exe
  2⤵
  PID:6284
- C:\Windows\System\yFrDYzM.exe
  C:\Windows\System\yFrDYzM.exe
  2⤵
  PID:6300
- C:\Windows\System\kUFnwYp.exe
  C:\Windows\System\kUFnwYp.exe
  2⤵
  PID:6320
- C:\Windows\System\gTanVAA.exe
  C:\Windows\System\gTanVAA.exe
  2⤵
  PID:6340
- C:\Windows\System\UrmkTJz.exe
  C:\Windows\System\UrmkTJz.exe
  2⤵
  PID:6356
- C:\Windows\System\GxKDwUD.exe
  C:\Windows\System\GxKDwUD.exe
  2⤵
  PID:6372
- C:\Windows\System\LwJkuSv.exe
  C:\Windows\System\LwJkuSv.exe
  2⤵
  PID:6388
- C:\Windows\System\oSKKpQW.exe
  C:\Windows\System\oSKKpQW.exe
  2⤵
  PID:6408
- C:\Windows\System\CblIJDv.exe
  C:\Windows\System\CblIJDv.exe
  2⤵
  PID:6424
- C:\Windows\System\XBbDCxC.exe
  C:\Windows\System\XBbDCxC.exe
  2⤵
  PID:6440
- C:\Windows\System\WObJSaB.exe
  C:\Windows\System\WObJSaB.exe
  2⤵
  PID:6456
- C:\Windows\System\qIurvzl.exe
  C:\Windows\System\qIurvzl.exe
  2⤵
  PID:6472
- C:\Windows\System\nBJAJks.exe
  C:\Windows\System\nBJAJks.exe
  2⤵
  PID:6488
- C:\Windows\System\KSlgazL.exe
  C:\Windows\System\KSlgazL.exe
  2⤵
  PID:6504
- C:\Windows\System\ptRIakJ.exe
  C:\Windows\System\ptRIakJ.exe
  2⤵
  PID:6520
- C:\Windows\System\rjhqciT.exe
  C:\Windows\System\rjhqciT.exe
  2⤵
  PID:6536
- C:\Windows\System\SvchAEn.exe
  C:\Windows\System\SvchAEn.exe
  2⤵
  PID:6552
- C:\Windows\System\JelGXgb.exe
  C:\Windows\System\JelGXgb.exe
  2⤵
  PID:6568
- C:\Windows\System\SZstPpf.exe
  C:\Windows\System\SZstPpf.exe
  2⤵
  PID:6584
- C:\Windows\System\aJLARYU.exe
  C:\Windows\System\aJLARYU.exe
  2⤵
  PID:6600
- C:\Windows\System\ihMTvPN.exe
  C:\Windows\System\ihMTvPN.exe
  2⤵
  PID:6620
- C:\Windows\System\BTwLaBc.exe
  C:\Windows\System\BTwLaBc.exe
  2⤵
  PID:6636
- C:\Windows\System\wllXuhV.exe
  C:\Windows\System\wllXuhV.exe
  2⤵
  PID:6700
- C:\Windows\System\EcWEkzL.exe
  C:\Windows\System\EcWEkzL.exe
  2⤵
  PID:6716
- C:\Windows\System\PjuvbiV.exe
  C:\Windows\System\PjuvbiV.exe
  2⤵
  PID:6732
- C:\Windows\System\lqftnES.exe
  C:\Windows\System\lqftnES.exe
  2⤵
  PID:6748
- C:\Windows\System\tSRUEcw.exe
  C:\Windows\System\tSRUEcw.exe
  2⤵
  PID:6764
- C:\Windows\System\QyZSNEa.exe
  C:\Windows\System\QyZSNEa.exe
  2⤵
  PID:6780
- C:\Windows\System\TCFygqy.exe
  C:\Windows\System\TCFygqy.exe
  2⤵
  PID:6796
- C:\Windows\System\pllSkkE.exe
  C:\Windows\System\pllSkkE.exe
  2⤵
  PID:6812
- C:\Windows\System\TCsanTy.exe
  C:\Windows\System\TCsanTy.exe
  2⤵
  PID:6828
- C:\Windows\System\UtEcBpg.exe
  C:\Windows\System\UtEcBpg.exe
  2⤵
  PID:6844
- C:\Windows\System\niMHkve.exe
  C:\Windows\System\niMHkve.exe
  2⤵
  PID:6864
- C:\Windows\System\yrqdkCu.exe
  C:\Windows\System\yrqdkCu.exe
  2⤵
  PID:6880
- C:\Windows\System\HYiDpeV.exe
  C:\Windows\System\HYiDpeV.exe
  2⤵
  PID:6896
- C:\Windows\System\MrQeKnk.exe
  C:\Windows\System\MrQeKnk.exe
  2⤵
  PID:6916
- C:\Windows\System\OlseSsb.exe
  C:\Windows\System\OlseSsb.exe
  2⤵
  PID:6932
- C:\Windows\System\LutitHp.exe
  C:\Windows\System\LutitHp.exe
  2⤵
  PID:6948
- C:\Windows\System\HNGSxPe.exe
  C:\Windows\System\HNGSxPe.exe
  2⤵
  PID:6964
- C:\Windows\System\bUDQZIE.exe
  C:\Windows\System\bUDQZIE.exe
  2⤵
  PID:6980
- C:\Windows\System\QTARQoD.exe
  C:\Windows\System\QTARQoD.exe
  2⤵
  PID:6996
- C:\Windows\System\GyNgICr.exe
  C:\Windows\System\GyNgICr.exe
  2⤵
  PID:7012
- C:\Windows\System\hUNmxWq.exe
  C:\Windows\System\hUNmxWq.exe
  2⤵
  PID:7028
- C:\Windows\System\jlMZlWx.exe
  C:\Windows\System\jlMZlWx.exe
  2⤵
  PID:7044
- C:\Windows\System\vhaCIJB.exe
  C:\Windows\System\vhaCIJB.exe
  2⤵
  PID:7060
- C:\Windows\System\linyWpG.exe
  C:\Windows\System\linyWpG.exe
  2⤵
  PID:7076
- C:\Windows\System\WKEhiWH.exe
  C:\Windows\System\WKEhiWH.exe
  2⤵
  PID:7092
- C:\Windows\System\DvULymm.exe
  C:\Windows\System\DvULymm.exe
  2⤵
  PID:7108
- C:\Windows\System\siuXgBg.exe
  C:\Windows\System\siuXgBg.exe
  2⤵
  PID:7124
- C:\Windows\System\BTDwldX.exe
  C:\Windows\System\BTDwldX.exe
  2⤵
  PID:7140
- C:\Windows\System\xfIERlw.exe
  C:\Windows\System\xfIERlw.exe
  2⤵
  PID:7156
- C:\Windows\System\ChsIZNP.exe
  C:\Windows\System\ChsIZNP.exe
  2⤵
  PID:6100
- C:\Windows\System\slQrfGs.exe
  C:\Windows\System\slQrfGs.exe
  2⤵
  PID:6024
- C:\Windows\System\uzOSsAu.exe
  C:\Windows\System\uzOSsAu.exe
  2⤵
  PID:6080
- C:\Windows\System\egGDOQJ.exe
  C:\Windows\System\egGDOQJ.exe
  2⤵
  PID:6104
- C:\Windows\System\AgRrGjX.exe
  C:\Windows\System\AgRrGjX.exe
  2⤵
  PID:5480
- C:\Windows\System\SyENRka.exe
  C:\Windows\System\SyENRka.exe
  2⤵
  PID:5264
- C:\Windows\System\TuHYyRN.exe
  C:\Windows\System\TuHYyRN.exe
  2⤵
  PID:5432
- C:\Windows\System\LCqeero.exe
  C:\Windows\System\LCqeero.exe
  2⤵
  PID:5952
- C:\Windows\System\AorBPpr.exe
  C:\Windows\System\AorBPpr.exe
  2⤵
  PID:5868
- C:\Windows\System\EgphiBb.exe
  C:\Windows\System\EgphiBb.exe
  2⤵
  PID:5344
- C:\Windows\System\pLBBjeN.exe
  C:\Windows\System\pLBBjeN.exe
  2⤵
  PID:5968
- C:\Windows\System\EvwHMqt.exe
  C:\Windows\System\EvwHMqt.exe
  2⤵
  PID:6256
- C:\Windows\System\lqFruKF.exe
  C:\Windows\System\lqFruKF.exe
  2⤵
  PID:5156
- C:\Windows\System\WGgsbyt.exe
  C:\Windows\System\WGgsbyt.exe
  2⤵
  PID:6292
- C:\Windows\System\RodXPII.exe
  C:\Windows\System\RodXPII.exe
  2⤵
  PID:6336
- C:\Windows\System\vwLquao.exe
  C:\Windows\System\vwLquao.exe
  2⤵
  PID:5396
- C:\Windows\System\AcZnRKK.exe
  C:\Windows\System\AcZnRKK.exe
  2⤵
  PID:5544
- C:\Windows\System\yWwITBA.exe
  C:\Windows\System\yWwITBA.exe
  2⤵
  PID:5824
- C:\Windows\System\GobxMpm.exe
  C:\Windows\System\GobxMpm.exe
  2⤵
  PID:6176
- C:\Windows\System\RaBYvxB.exe
  C:\Windows\System\RaBYvxB.exe
  2⤵
  PID:6220
- C:\Windows\System\YgrxLdb.exe
  C:\Windows\System\YgrxLdb.exe
  2⤵
  PID:6232
- C:\Windows\System\LQLYllG.exe
  C:\Windows\System\LQLYllG.exe
  2⤵
  PID:6280
- C:\Windows\System\HzWsvGT.exe
  C:\Windows\System\HzWsvGT.exe
  2⤵
  PID:6348
- C:\Windows\System\XvKVAlm.exe
  C:\Windows\System\XvKVAlm.exe
  2⤵
  PID:6380
- C:\Windows\System\mBAaZzM.exe
  C:\Windows\System\mBAaZzM.exe
  2⤵
  PID:6464
- C:\Windows\System\goGWluI.exe
  C:\Windows\System\goGWluI.exe
  2⤵
  PID:6420
- C:\Windows\System\AKOvKOz.exe
  C:\Windows\System\AKOvKOz.exe
  2⤵
  PID:6532
- C:\Windows\System\zjGGZEc.exe
  C:\Windows\System\zjGGZEc.exe
  2⤵
  PID:6448
- C:\Windows\System\Cafqvil.exe
  C:\Windows\System\Cafqvil.exe
  2⤵
  PID:6580
- C:\Windows\System\vxUWFBs.exe
  C:\Windows\System\vxUWFBs.exe
  2⤵
  PID:6516
- C:\Windows\System\urSFUuu.exe
  C:\Windows\System\urSFUuu.exe
  2⤵
  PID:1544
- C:\Windows\System\yuQtWFx.exe
  C:\Windows\System\yuQtWFx.exe
  2⤵
  PID:6644
- C:\Windows\System\YBsogAy.exe
  C:\Windows\System\YBsogAy.exe
  2⤵
  PID:6660
- C:\Windows\System\tWEFkwZ.exe
  C:\Windows\System\tWEFkwZ.exe
  2⤵
  PID:6676
- C:\Windows\System\iRuNmIZ.exe
  C:\Windows\System\iRuNmIZ.exe
  2⤵
  PID:6684
- C:\Windows\System\dPBoaHb.exe
  C:\Windows\System\dPBoaHb.exe
  2⤵
  PID:6756
- C:\Windows\System\vVZipqV.exe
  C:\Windows\System\vVZipqV.exe
  2⤵
  PID:6820
- C:\Windows\System\xBekksW.exe
  C:\Windows\System\xBekksW.exe
  2⤵
  PID:6860
- C:\Windows\System\JOAIZGm.exe
  C:\Windows\System\JOAIZGm.exe
  2⤵
  PID:6712
- C:\Windows\System\QNzKAzU.exe
  C:\Windows\System\QNzKAzU.exe
  2⤵
  PID:6772
- C:\Windows\System\bPyFqqh.exe
  C:\Windows\System\bPyFqqh.exe
  2⤵
  PID:6836
- C:\Windows\System\remFdDc.exe
  C:\Windows\System\remFdDc.exe
  2⤵
  PID:6904
- C:\Windows\System\LbbUgsF.exe
  C:\Windows\System\LbbUgsF.exe
  2⤵
  PID:6912
- C:\Windows\System\tpRaCSX.exe
  C:\Windows\System\tpRaCSX.exe
  2⤵
  PID:6960
- C:\Windows\System\TgEjked.exe
  C:\Windows\System\TgEjked.exe
  2⤵
  PID:6992
- C:\Windows\System\UcFQuSZ.exe
  C:\Windows\System\UcFQuSZ.exe
  2⤵
  PID:7008
- C:\Windows\System\uJsdVwz.exe
  C:\Windows\System\uJsdVwz.exe
  2⤵
  PID:7116
- C:\Windows\System\mTuRPrs.exe
  C:\Windows\System\mTuRPrs.exe
  2⤵
  PID:6020
- C:\Windows\System\GknztSn.exe
  C:\Windows\System\GknztSn.exe
  2⤵
  PID:7036
- C:\Windows\System\Hqfwugj.exe
  C:\Windows\System\Hqfwugj.exe
  2⤵
  PID:7164
- C:\Windows\System\qTqFweC.exe
  C:\Windows\System\qTqFweC.exe
  2⤵
  PID:7136
- C:\Windows\System\MhcOKVj.exe
  C:\Windows\System\MhcOKVj.exe
  2⤵
  PID:5196
- C:\Windows\System\cafCAyd.exe
  C:\Windows\System\cafCAyd.exe
  2⤵
  PID:5812
- C:\Windows\System\xABMUDd.exe
  C:\Windows\System\xABMUDd.exe
  2⤵
  PID:6204
- C:\Windows\System\RvCUtnn.exe
  C:\Windows\System\RvCUtnn.exe
  2⤵
  PID:6364
- C:\Windows\System\xqRwVsk.exe
  C:\Windows\System\xqRwVsk.exe
  2⤵
  PID:6368
- C:\Windows\System\GcnKvxS.exe
  C:\Windows\System\GcnKvxS.exe
  2⤵
  PID:6276
- C:\Windows\System\ZlLcIQe.exe
  C:\Windows\System\ZlLcIQe.exe
  2⤵
  PID:6416
- C:\Windows\System\QRrhTUy.exe
  C:\Windows\System\QRrhTUy.exe
  2⤵
  PID:5180
- C:\Windows\System\qkkQzPb.exe
  C:\Windows\System\qkkQzPb.exe
  2⤵
  PID:5428
- C:\Windows\System\MoXcEXa.exe
  C:\Windows\System\MoXcEXa.exe
  2⤵
  PID:4900
- C:\Windows\System\rVvdgIO.exe
  C:\Windows\System\rVvdgIO.exe
  2⤵
  PID:6148
- C:\Windows\System\ztokgEk.exe
  C:\Windows\System\ztokgEk.exe
  2⤵
  PID:6312
- C:\Windows\System\dPjzpmu.exe
  C:\Windows\System\dPjzpmu.exe
  2⤵
  PID:6528
- C:\Windows\System\WZdciqW.exe
  C:\Windows\System\WZdciqW.exe
  2⤵
  PID:6548
- C:\Windows\System\JIVvJiH.exe
  C:\Windows\System\JIVvJiH.exe
  2⤵
  PID:6512
- C:\Windows\System\VWJOYVl.exe
  C:\Windows\System\VWJOYVl.exe
  2⤵
  PID:6668
- C:\Windows\System\voIuOFX.exe
  C:\Windows\System\voIuOFX.exe
  2⤵
  PID:6852
- C:\Windows\System\LpSsJip.exe
  C:\Windows\System\LpSsJip.exe
  2⤵
  PID:6872
- C:\Windows\System\kvDqHeP.exe
  C:\Windows\System\kvDqHeP.exe
  2⤵
  PID:6892
- C:\Windows\System\LgWCQSE.exe
  C:\Windows\System\LgWCQSE.exe
  2⤵
  PID:6972
- C:\Windows\System\hGdlexW.exe
  C:\Windows\System\hGdlexW.exe
  2⤵
  PID:6956
- C:\Windows\System\RrzbkGI.exe
  C:\Windows\System\RrzbkGI.exe
  2⤵
  PID:7148
- C:\Windows\System\RELpiYy.exe
  C:\Windows\System\RELpiYy.exe
  2⤵
  PID:7132
- C:\Windows\System\rdFiQuO.exe
  C:\Windows\System\rdFiQuO.exe
  2⤵
  PID:6164
- C:\Windows\System\TeBcdDz.exe
  C:\Windows\System\TeBcdDz.exe
  2⤵
  PID:6468
- C:\Windows\System\uLGMoqP.exe
  C:\Windows\System\uLGMoqP.exe
  2⤵
  PID:5496
- C:\Windows\System\phjKBeC.exe
  C:\Windows\System\phjKBeC.exe
  2⤵
  PID:6484
- C:\Windows\System\LefwyeG.exe
  C:\Windows\System\LefwyeG.exe
  2⤵
  PID:6088
- C:\Windows\System\qWDJZnG.exe
  C:\Windows\System\qWDJZnG.exe
  2⤵
  PID:7100
- C:\Windows\System\QKLFKCL.exe
  C:\Windows\System\QKLFKCL.exe
  2⤵
  PID:6260
- C:\Windows\System\SFZIoky.exe
  C:\Windows\System\SFZIoky.exe
  2⤵
  PID:5972
- C:\Windows\System\iBZOWul.exe
  C:\Windows\System\iBZOWul.exe
  2⤵
  PID:6608
- C:\Windows\System\iMpWAWV.exe
  C:\Windows\System\iMpWAWV.exe
  2⤵
  PID:6692
- C:\Windows\System\xhXeETj.exe
  C:\Windows\System\xhXeETj.exe
  2⤵
  PID:6688
- C:\Windows\System\NwevjAL.exe
  C:\Windows\System\NwevjAL.exe
  2⤵
  PID:7072
- C:\Windows\System\EtFfMiG.exe
  C:\Windows\System\EtFfMiG.exe
  2⤵
  PID:5916
- C:\Windows\System\oaeQcJN.exe
  C:\Windows\System\oaeQcJN.exe
  2⤵
  PID:5572
- C:\Windows\System\AqhmPlT.exe
  C:\Windows\System\AqhmPlT.exe
  2⤵
  PID:7088
- C:\Windows\System\PfqtPrn.exe
  C:\Windows\System\PfqtPrn.exe
  2⤵
  PID:5304
- C:\Windows\System\HAFmBNX.exe
  C:\Windows\System\HAFmBNX.exe
  2⤵
  PID:6564
- C:\Windows\System\cFeKwZV.exe
  C:\Windows\System\cFeKwZV.exe
  2⤵
  PID:6236
- C:\Windows\System\VUQlMCP.exe
  C:\Windows\System\VUQlMCP.exe
  2⤵
  PID:6944
- C:\Windows\System\YOhxFCM.exe
  C:\Windows\System\YOhxFCM.exe
  2⤵
  PID:5248
- C:\Windows\System\VxIVNGn.exe
  C:\Windows\System\VxIVNGn.exe
  2⤵
  PID:6404
- C:\Windows\System\ahGMjqe.exe
  C:\Windows\System\ahGMjqe.exe
  2⤵
  PID:6728
- C:\Windows\System\ZVVUvqC.exe
  C:\Windows\System\ZVVUvqC.exe
  2⤵
  PID:7188
- C:\Windows\System\iPXcCja.exe
  C:\Windows\System\iPXcCja.exe
  2⤵
  PID:7204
- C:\Windows\System\nGFxBTK.exe
  C:\Windows\System\nGFxBTK.exe
  2⤵
  PID:7224
- C:\Windows\System\sioaOOE.exe
  C:\Windows\System\sioaOOE.exe
  2⤵
  PID:7240
- C:\Windows\System\rokqGoX.exe
  C:\Windows\System\rokqGoX.exe
  2⤵
  PID:7256
- C:\Windows\System\kNULnCX.exe
  C:\Windows\System\kNULnCX.exe
  2⤵
  PID:7272
- C:\Windows\System\MipaTGX.exe
  C:\Windows\System\MipaTGX.exe
  2⤵
  PID:7288
- C:\Windows\System\UybfPDY.exe
  C:\Windows\System\UybfPDY.exe
  2⤵
  PID:7304
- C:\Windows\System\DNQRzKd.exe
  C:\Windows\System\DNQRzKd.exe
  2⤵
  PID:7320
- C:\Windows\System\SfAJWXc.exe
  C:\Windows\System\SfAJWXc.exe
  2⤵
  PID:7336
- C:\Windows\System\tszNmoi.exe
  C:\Windows\System\tszNmoi.exe
  2⤵
  PID:7352
- C:\Windows\System\GEynCcZ.exe
  C:\Windows\System\GEynCcZ.exe
  2⤵
  PID:7368
- C:\Windows\System\GBqqiAs.exe
  C:\Windows\System\GBqqiAs.exe
  2⤵
  PID:7388
- C:\Windows\System\eUIDvMz.exe
  C:\Windows\System\eUIDvMz.exe
  2⤵
  PID:7404
- C:\Windows\System\NHSfObN.exe
  C:\Windows\System\NHSfObN.exe
  2⤵
  PID:7420
- C:\Windows\System\eVsvEFq.exe
  C:\Windows\System\eVsvEFq.exe
  2⤵
  PID:7436
- C:\Windows\System\zJwJUXc.exe
  C:\Windows\System\zJwJUXc.exe
  2⤵
  PID:7452
- C:\Windows\System\vPuvrmt.exe
  C:\Windows\System\vPuvrmt.exe
  2⤵
  PID:7468
- C:\Windows\System\JlZYhtv.exe
  C:\Windows\System\JlZYhtv.exe
  2⤵
  PID:7484
- C:\Windows\System\sutmAJa.exe
  C:\Windows\System\sutmAJa.exe
  2⤵
  PID:7500
- C:\Windows\System\FOlQKUx.exe
  C:\Windows\System\FOlQKUx.exe
  2⤵
  PID:7516
- C:\Windows\System\TWzrzGm.exe
  C:\Windows\System\TWzrzGm.exe
  2⤵
  PID:7532
- C:\Windows\System\SfzdKCg.exe
  C:\Windows\System\SfzdKCg.exe
  2⤵
  PID:7548
- C:\Windows\System\ZLKxplO.exe
  C:\Windows\System\ZLKxplO.exe
  2⤵
  PID:7564
- C:\Windows\System\TcaRZiQ.exe
  C:\Windows\System\TcaRZiQ.exe
  2⤵
  PID:7580
- C:\Windows\System\NUrUbhF.exe
  C:\Windows\System\NUrUbhF.exe
  2⤵
  PID:7596
- C:\Windows\System\byxPPkm.exe
  C:\Windows\System\byxPPkm.exe
  2⤵
  PID:7612
- C:\Windows\System\MaAQdSk.exe
  C:\Windows\System\MaAQdSk.exe
  2⤵
  PID:7628
- C:\Windows\System\pbwUQhR.exe
  C:\Windows\System\pbwUQhR.exe
  2⤵
  PID:7644
- C:\Windows\System\jHeakWd.exe
  C:\Windows\System\jHeakWd.exe
  2⤵
  PID:7660
- C:\Windows\System\QCtADBK.exe
  C:\Windows\System\QCtADBK.exe
  2⤵
  PID:7676
- C:\Windows\System\acwKUeD.exe
  C:\Windows\System\acwKUeD.exe
  2⤵
  PID:7692
- C:\Windows\System\INZlDVS.exe
  C:\Windows\System\INZlDVS.exe
  2⤵
  PID:7708
- C:\Windows\System\SvOxLIX.exe
  C:\Windows\System\SvOxLIX.exe
  2⤵
  PID:7724
- C:\Windows\System\kcVkiKX.exe
  C:\Windows\System\kcVkiKX.exe
  2⤵
  PID:7740
- C:\Windows\System\lwJzffW.exe
  C:\Windows\System\lwJzffW.exe
  2⤵
  PID:7756
- C:\Windows\System\wDwEDdu.exe
  C:\Windows\System\wDwEDdu.exe
  2⤵
  PID:7772
- C:\Windows\System\QDPFwYc.exe
  C:\Windows\System\QDPFwYc.exe
  2⤵
  PID:7788
- C:\Windows\System\UCtiXxs.exe
  C:\Windows\System\UCtiXxs.exe
  2⤵
  PID:7804
- C:\Windows\System\PkBQIiz.exe
  C:\Windows\System\PkBQIiz.exe
  2⤵
  PID:7820
- C:\Windows\System\JTNlZuv.exe
  C:\Windows\System\JTNlZuv.exe
  2⤵
  PID:7836
- C:\Windows\System\lVQeuAu.exe
  C:\Windows\System\lVQeuAu.exe
  2⤵
  PID:7856
- C:\Windows\System\iAEDwCT.exe
  C:\Windows\System\iAEDwCT.exe
  2⤵
  PID:7872
- C:\Windows\System\ppqRPNS.exe
  C:\Windows\System\ppqRPNS.exe
  2⤵
  PID:7888
- C:\Windows\System\kJZYZuF.exe
  C:\Windows\System\kJZYZuF.exe
  2⤵
  PID:7904
- C:\Windows\System\hCLnRTa.exe
  C:\Windows\System\hCLnRTa.exe
  2⤵
  PID:7920
- C:\Windows\System\PRtmZHd.exe
  C:\Windows\System\PRtmZHd.exe
  2⤵
  PID:7936
- C:\Windows\System\OXgSYAk.exe
  C:\Windows\System\OXgSYAk.exe
  2⤵
  PID:7952
- C:\Windows\System\CbUUMtw.exe
  C:\Windows\System\CbUUMtw.exe
  2⤵
  PID:7968
- C:\Windows\System\mlmCNlP.exe
  C:\Windows\System\mlmCNlP.exe
  2⤵
  PID:7984
- C:\Windows\System\kBJvvnb.exe
  C:\Windows\System\kBJvvnb.exe
  2⤵
  PID:8000
- C:\Windows\System\dqkROBC.exe
  C:\Windows\System\dqkROBC.exe
  2⤵
  PID:8016
- C:\Windows\System\fMLzLMk.exe
  C:\Windows\System\fMLzLMk.exe
  2⤵
  PID:8032
- C:\Windows\System\razBnnJ.exe
  C:\Windows\System\razBnnJ.exe
  2⤵
  PID:8048
- C:\Windows\System\RjAvKjG.exe
  C:\Windows\System\RjAvKjG.exe
  2⤵
  PID:8064
- C:\Windows\System\XIozjhp.exe
  C:\Windows\System\XIozjhp.exe
  2⤵
  PID:8080
- C:\Windows\System\BEKLJJd.exe
  C:\Windows\System\BEKLJJd.exe
  2⤵
  PID:8096
- C:\Windows\System\FTOptlK.exe
  C:\Windows\System\FTOptlK.exe
  2⤵
  PID:8112
- C:\Windows\System\zQWDikP.exe
  C:\Windows\System\zQWDikP.exe
  2⤵
  PID:8132
- C:\Windows\System\HMSLERk.exe
  C:\Windows\System\HMSLERk.exe
  2⤵
  PID:8148
- C:\Windows\System\lgFicqZ.exe
  C:\Windows\System\lgFicqZ.exe
  2⤵
  PID:8164
- C:\Windows\System\GoIkECI.exe
  C:\Windows\System\GoIkECI.exe
  2⤵
  PID:8180
- C:\Windows\System\DiMGClK.exe
  C:\Windows\System\DiMGClK.exe
  2⤵
  PID:6928
- C:\Windows\System\YipGXGj.exe
  C:\Windows\System\YipGXGj.exe
  2⤵
  PID:7200
- C:\Windows\System\NFOizyL.exe
  C:\Windows\System\NFOizyL.exe
  2⤵
  PID:7296
- C:\Windows\System\CICccFx.exe
  C:\Windows\System\CICccFx.exe
  2⤵
  PID:7360
- C:\Windows\System\INmVbaq.exe
  C:\Windows\System\INmVbaq.exe
  2⤵
  PID:6264
- C:\Windows\System\CQrFfsi.exe
  C:\Windows\System\CQrFfsi.exe
  2⤵
  PID:7464
- C:\Windows\System\kpihpDg.exe
  C:\Windows\System\kpihpDg.exe
  2⤵
  PID:7528
- C:\Windows\System\fEjaSAz.exe
  C:\Windows\System\fEjaSAz.exe
  2⤵
  PID:7592
- C:\Windows\System\pfxweEm.exe
  C:\Windows\System\pfxweEm.exe
  2⤵
  PID:6744
- C:\Windows\System\NBYAIrH.exe
  C:\Windows\System\NBYAIrH.exe
  2⤵
  PID:7684
- C:\Windows\System\ySQvEpy.exe
  C:\Windows\System\ySQvEpy.exe
  2⤵
  PID:7412
- C:\Windows\System\HbpDIYd.exe
  C:\Windows\System\HbpDIYd.exe
  2⤵
  PID:6708
- C:\Windows\System\cTYysYr.exe
  C:\Windows\System\cTYysYr.exe
  2⤵
  PID:7480
- C:\Windows\System\ZLrBuvJ.exe
  C:\Windows\System\ZLrBuvJ.exe
  2⤵
  PID:7216
- C:\Windows\System\uRdDKio.exe
  C:\Windows\System\uRdDKio.exe
  2⤵
  PID:7252
- C:\Windows\System\QiJlOHh.exe
  C:\Windows\System\QiJlOHh.exe
  2⤵
  PID:7812
- C:\Windows\System\vWopUJa.exe
  C:\Windows\System\vWopUJa.exe
  2⤵
  PID:7280
- C:\Windows\System\SQMwgGY.exe
  C:\Windows\System\SQMwgGY.exe
  2⤵
  PID:7344
- C:\Windows\System\WTqQgHP.exe
  C:\Windows\System\WTqQgHP.exe
  2⤵
  PID:7384
- C:\Windows\System\uplsxFk.exe
  C:\Windows\System\uplsxFk.exe
  2⤵
  PID:7448
- C:\Windows\System\QdaOWAP.exe
  C:\Windows\System\QdaOWAP.exe
  2⤵
  PID:7544
- C:\Windows\System\nOibCTu.exe
  C:\Windows\System\nOibCTu.exe
  2⤵
  PID:7636
- C:\Windows\System\fMZgOBK.exe
  C:\Windows\System\fMZgOBK.exe
  2⤵
  PID:7668
- C:\Windows\System\dreAdBH.exe
  C:\Windows\System\dreAdBH.exe
  2⤵
  PID:6596
- C:\Windows\System\lLfYJPb.exe
  C:\Windows\System\lLfYJPb.exe
  2⤵
  PID:7884
- C:\Windows\System\KZhlPXf.exe
  C:\Windows\System\KZhlPXf.exe
  2⤵
  PID:7948
- C:\Windows\System\XjBMkVY.exe
  C:\Windows\System\XjBMkVY.exe
  2⤵
  PID:8012
- C:\Windows\System\gcPMwBK.exe
  C:\Windows\System\gcPMwBK.exe
  2⤵
  PID:8024
- C:\Windows\System\XBkTSPV.exe
  C:\Windows\System\XBkTSPV.exe
  2⤵
  PID:7960
- C:\Windows\System\dFIlHfc.exe
  C:\Windows\System\dFIlHfc.exe
  2⤵
  PID:8056
- C:\Windows\System\PkbETXJ.exe
  C:\Windows\System\PkbETXJ.exe
  2⤵
  PID:8088
- C:\Windows\System\DOKKdpD.exe
  C:\Windows\System\DOKKdpD.exe
  2⤵
  PID:8108
- C:\Windows\System\nMCKfdx.exe
  C:\Windows\System\nMCKfdx.exe
  2⤵
  PID:8176
- C:\Windows\System\fFaIVqE.exe
  C:\Windows\System\fFaIVqE.exe
  2⤵
  PID:8092
- C:\Windows\System\hdWIFCk.exe
  C:\Windows\System\hdWIFCk.exe
  2⤵
  PID:7432
- C:\Windows\System\hjfECII.exe
  C:\Windows\System\hjfECII.exe
  2⤵
  PID:7656
- C:\Windows\System\UIXOXzy.exe
  C:\Windows\System\UIXOXzy.exe
  2⤵
  PID:6808
- C:\Windows\System\jxGQYsz.exe
  C:\Windows\System\jxGQYsz.exe
  2⤵
  PID:7496
- C:\Windows\System\FvIXHYj.exe
  C:\Windows\System\FvIXHYj.exe
  2⤵
  PID:7716
- C:\Windows\System\TEtzEiU.exe
  C:\Windows\System\TEtzEiU.exe
  2⤵
  PID:7720
- C:\Windows\System\FEbTqGR.exe
  C:\Windows\System\FEbTqGR.exe
  2⤵
  PID:7212
- C:\Windows\System\qInWNMs.exe
  C:\Windows\System\qInWNMs.exe
  2⤵
  PID:7764
- C:\Windows\System\gCspLQj.exe
  C:\Windows\System\gCspLQj.exe
  2⤵
  PID:7700
- C:\Windows\System\AlxomjM.exe
  C:\Windows\System\AlxomjM.exe
  2⤵
  PID:7896
- C:\Windows\System\VKbamCv.exe
  C:\Windows\System\VKbamCv.exe
  2⤵
  PID:8076
- C:\Windows\System\NEDkOaG.exe
  C:\Windows\System\NEDkOaG.exe
  2⤵
  PID:7512
- C:\Windows\System\mBhHZCm.exe
  C:\Windows\System\mBhHZCm.exe
  2⤵
  PID:7588
- C:\Windows\System\WJIHbIa.exe
  C:\Windows\System\WJIHbIa.exe
  2⤵
  PID:7864
- C:\Windows\System\uvjFRuC.exe
  C:\Windows\System\uvjFRuC.exe
  2⤵
  PID:7980
- C:\Windows\System\rFSatmK.exe
  C:\Windows\System\rFSatmK.exe
  2⤵
  PID:7704
- C:\Windows\System\bYdHeSg.exe
  C:\Windows\System\bYdHeSg.exe
  2⤵
  PID:8040
- C:\Windows\System\roLFzrp.exe
  C:\Windows\System\roLFzrp.exe
  2⤵
  PID:7800
- C:\Windows\System\qCSmust.exe
  C:\Windows\System\qCSmust.exe
  2⤵
  PID:7508
- C:\Windows\System\DtLpsmB.exe
  C:\Windows\System\DtLpsmB.exe
  2⤵
  PID:8172
- C:\Windows\System\xxajxaE.exe
  C:\Windows\System\xxajxaE.exe
  2⤵
  PID:6396
- C:\Windows\System\OKJmCOi.exe
  C:\Windows\System\OKJmCOi.exe
  2⤵
  PID:8028
- C:\Windows\System\YuyUFHI.exe
  C:\Windows\System\YuyUFHI.exe
  2⤵
  PID:7944
- C:\Windows\System\OnkthMo.exe
  C:\Windows\System\OnkthMo.exe
  2⤵
  PID:7400
- C:\Windows\System\MmSREvo.exe
  C:\Windows\System\MmSREvo.exe
  2⤵
  PID:7184
- C:\Windows\System\pmKGsJk.exe
  C:\Windows\System\pmKGsJk.exe
  2⤵
  PID:7576
- C:\Windows\System\QawATMq.exe
  C:\Windows\System\QawATMq.exe
  2⤵
  PID:7928
- C:\Windows\System\hCeRxUA.exe
  C:\Windows\System\hCeRxUA.exe
  2⤵
  PID:8200
- C:\Windows\System\VyRvimW.exe
  C:\Windows\System\VyRvimW.exe
  2⤵
  PID:8216
- C:\Windows\System\RpdSpPw.exe
  C:\Windows\System\RpdSpPw.exe
  2⤵
  PID:8232
- C:\Windows\System\oMRZdFq.exe
  C:\Windows\System\oMRZdFq.exe
  2⤵
  PID:8248
- C:\Windows\System\ZdmXqzI.exe
  C:\Windows\System\ZdmXqzI.exe
  2⤵
  PID:8264
- C:\Windows\System\TOGFrwG.exe
  C:\Windows\System\TOGFrwG.exe
  2⤵
  PID:8280
- C:\Windows\System\QKwFDcd.exe
  C:\Windows\System\QKwFDcd.exe
  2⤵
  PID:8300
- C:\Windows\System\WtVNXdW.exe
  C:\Windows\System\WtVNXdW.exe
  2⤵
  PID:8316
- C:\Windows\System\PXWdtLZ.exe
  C:\Windows\System\PXWdtLZ.exe
  2⤵
  PID:8332
- C:\Windows\System\RNpwiqJ.exe
  C:\Windows\System\RNpwiqJ.exe
  2⤵
  PID:8348
- C:\Windows\System\TIgoeyL.exe
  C:\Windows\System\TIgoeyL.exe
  2⤵
  PID:8364
- C:\Windows\System\UXZbSkm.exe
  C:\Windows\System\UXZbSkm.exe
  2⤵
  PID:8380
- C:\Windows\System\mirzNPK.exe
  C:\Windows\System\mirzNPK.exe
  2⤵
  PID:8396
- C:\Windows\System\QMJxvaW.exe
  C:\Windows\System\QMJxvaW.exe
  2⤵
  PID:8412
- C:\Windows\System\LMddfIM.exe
  C:\Windows\System\LMddfIM.exe
  2⤵
  PID:8428
- C:\Windows\System\UXbxnFX.exe
  C:\Windows\System\UXbxnFX.exe
  2⤵
  PID:8444
- C:\Windows\System\bfEUjBq.exe
  C:\Windows\System\bfEUjBq.exe
  2⤵
  PID:8460
- C:\Windows\System\TKOUSgL.exe
  C:\Windows\System\TKOUSgL.exe
  2⤵
  PID:8476
- C:\Windows\System\PGTjcCX.exe
  C:\Windows\System\PGTjcCX.exe
  2⤵
  PID:8492
- C:\Windows\System\XFFZWFP.exe
  C:\Windows\System\XFFZWFP.exe
  2⤵
  PID:8508
- C:\Windows\System\HuesuUy.exe
  C:\Windows\System\HuesuUy.exe
  2⤵
  PID:8524
- C:\Windows\System\YAbtBtv.exe
  C:\Windows\System\YAbtBtv.exe
  2⤵
  PID:8540
- C:\Windows\System\XWfhTLh.exe
  C:\Windows\System\XWfhTLh.exe
  2⤵
  PID:8556
- C:\Windows\System\JDUzAkz.exe
  C:\Windows\System\JDUzAkz.exe
  2⤵
  PID:8572
- C:\Windows\System\AXXOYTY.exe
  C:\Windows\System\AXXOYTY.exe
  2⤵
  PID:8588
- C:\Windows\System\VkOLmfd.exe
  C:\Windows\System\VkOLmfd.exe
  2⤵
  PID:8604
- C:\Windows\System\ViPdOsg.exe
  C:\Windows\System\ViPdOsg.exe
  2⤵
  PID:8620
- C:\Windows\System\AIDrTFU.exe
  C:\Windows\System\AIDrTFU.exe
  2⤵
  PID:8636
- C:\Windows\System\LuJpAdk.exe
  C:\Windows\System\LuJpAdk.exe
  2⤵
  PID:8652
- C:\Windows\System\OjrpzWe.exe
  C:\Windows\System\OjrpzWe.exe
  2⤵
  PID:8668
- C:\Windows\System\mDDWJqk.exe
  C:\Windows\System\mDDWJqk.exe
  2⤵
  PID:8684
- C:\Windows\System\kzmQcjg.exe
  C:\Windows\System\kzmQcjg.exe
  2⤵
  PID:8700
- C:\Windows\System\EzrYayE.exe
  C:\Windows\System\EzrYayE.exe
  2⤵
  PID:8716
- C:\Windows\System\qzruFyU.exe
  C:\Windows\System\qzruFyU.exe
  2⤵
  PID:8732
- C:\Windows\System\kEHOKgY.exe
  C:\Windows\System\kEHOKgY.exe
  2⤵
  PID:8748
- C:\Windows\System\NKqVwWC.exe
  C:\Windows\System\NKqVwWC.exe
  2⤵
  PID:8764
- C:\Windows\System\VvKcdDk.exe
  C:\Windows\System\VvKcdDk.exe
  2⤵
  PID:8780
- C:\Windows\System\BOqPEhw.exe
  C:\Windows\System\BOqPEhw.exe
  2⤵
  PID:8796
- C:\Windows\System\zSHXdXA.exe
  C:\Windows\System\zSHXdXA.exe
  2⤵
  PID:8812
- C:\Windows\System\oyvielT.exe
  C:\Windows\System\oyvielT.exe
  2⤵
  PID:8828
- C:\Windows\System\qWrLumh.exe
  C:\Windows\System\qWrLumh.exe
  2⤵
  PID:8844
- C:\Windows\System\WquVuDs.exe
  C:\Windows\System\WquVuDs.exe
  2⤵
  PID:8860
- C:\Windows\System\QIJFiIg.exe
  C:\Windows\System\QIJFiIg.exe
  2⤵
  PID:8876
- C:\Windows\System\wntMqSc.exe
  C:\Windows\System\wntMqSc.exe
  2⤵
  PID:8892
- C:\Windows\System\ZunvACl.exe
  C:\Windows\System\ZunvACl.exe
  2⤵
  PID:8908
- C:\Windows\System\lWeSary.exe
  C:\Windows\System\lWeSary.exe
  2⤵
  PID:8924
- C:\Windows\System\lWqfbMo.exe
  C:\Windows\System\lWqfbMo.exe
  2⤵
  PID:8940
- C:\Windows\System\VOdxTDD.exe
  C:\Windows\System\VOdxTDD.exe
  2⤵
  PID:8956
- C:\Windows\System\wLXPhJF.exe
  C:\Windows\System\wLXPhJF.exe
  2⤵
  PID:8972
- C:\Windows\System\JkyGoyD.exe
  C:\Windows\System\JkyGoyD.exe
  2⤵
  PID:8988
- C:\Windows\System\DmjiQxV.exe
  C:\Windows\System\DmjiQxV.exe
  2⤵
  PID:9004
- C:\Windows\System\facNOLh.exe
  C:\Windows\System\facNOLh.exe
  2⤵
  PID:9020
- C:\Windows\System\MybuQcU.exe
  C:\Windows\System\MybuQcU.exe
  2⤵
  PID:9036
- C:\Windows\System\GSOEJUJ.exe
  C:\Windows\System\GSOEJUJ.exe
  2⤵
  PID:9052
- C:\Windows\System\cDnVRMB.exe
  C:\Windows\System\cDnVRMB.exe
  2⤵
  PID:9068
- C:\Windows\System\BNVokyv.exe
  C:\Windows\System\BNVokyv.exe
  2⤵
  PID:9084
- C:\Windows\System\IYBeDGO.exe
  C:\Windows\System\IYBeDGO.exe
  2⤵
  PID:9100
- C:\Windows\System\MUKWpgP.exe
  C:\Windows\System\MUKWpgP.exe
  2⤵
  PID:9116
- C:\Windows\System\FgZSwmP.exe
  C:\Windows\System\FgZSwmP.exe
  2⤵
  PID:9132
- C:\Windows\System\FILScBc.exe
  C:\Windows\System\FILScBc.exe
  2⤵
  PID:9148
- C:\Windows\System\ZFJJBoG.exe
  C:\Windows\System\ZFJJBoG.exe
  2⤵
  PID:9164
- C:\Windows\System\mETMkbM.exe
  C:\Windows\System\mETMkbM.exe
  2⤵
  PID:9180
- C:\Windows\System\wSxFDMD.exe
  C:\Windows\System\wSxFDMD.exe
  2⤵
  PID:9196
- C:\Windows\System\dzgTdPh.exe
  C:\Windows\System\dzgTdPh.exe
  2⤵
  PID:9212
- C:\Windows\System\SQRcbkR.exe
  C:\Windows\System\SQRcbkR.exe
  2⤵
  PID:7608
- C:\Windows\System\iCuUAmT.exe
  C:\Windows\System\iCuUAmT.exe
  2⤵
  PID:7880
- C:\Windows\System\IzkrJYX.exe
  C:\Windows\System\IzkrJYX.exe
  2⤵
  PID:7828
- C:\Windows\System\fGJkMkQ.exe
  C:\Windows\System\fGJkMkQ.exe
  2⤵
  PID:7992
- C:\Windows\System\cOFMLog.exe
  C:\Windows\System\cOFMLog.exe
  2⤵
  PID:8208
- C:\Windows\System\MWSOwlD.exe
  C:\Windows\System\MWSOwlD.exe
  2⤵
  PID:8260
- C:\Windows\System\BLSrvZr.exe
  C:\Windows\System\BLSrvZr.exe
  2⤵
  PID:8324
- C:\Windows\System\RkJDmpV.exe
  C:\Windows\System\RkJDmpV.exe
  2⤵
  PID:8360
- C:\Windows\System\eOQDDly.exe
  C:\Windows\System\eOQDDly.exe
  2⤵
  PID:8424
- C:\Windows\System\XnZqWpV.exe
  C:\Windows\System\XnZqWpV.exe
  2⤵
  PID:8272
- C:\Windows\System\MHXpiga.exe
  C:\Windows\System\MHXpiga.exe
  2⤵
  PID:8376
- C:\Windows\System\DkJDmjA.exe
  C:\Windows\System\DkJDmjA.exe
  2⤵
  PID:8408
- C:\Windows\System\YFYyTLd.exe
  C:\Windows\System\YFYyTLd.exe
  2⤵
  PID:8472
- C:\Windows\System\FCVVlJP.exe
  C:\Windows\System\FCVVlJP.exe
  2⤵
  PID:8504
- C:\Windows\System\SwyZTaQ.exe
  C:\Windows\System\SwyZTaQ.exe
  2⤵
  PID:8584
- C:\Windows\System\ESfDtZq.exe
  C:\Windows\System\ESfDtZq.exe
  2⤵
  PID:8648
- C:\Windows\System\DCUFxlV.exe
  C:\Windows\System\DCUFxlV.exe
  2⤵
  PID:8676
- C:\Windows\System\oqhcbfW.exe
  C:\Windows\System\oqhcbfW.exe
  2⤵
  PID:8568
- C:\Windows\System\uITrwFE.exe
  C:\Windows\System\uITrwFE.exe
  2⤵
  PID:8804
- C:\Windows\System\aUeaNXL.exe
  C:\Windows\System\aUeaNXL.exe
  2⤵
  PID:8696
- C:\Windows\System\VmJUjhf.exe
  C:\Windows\System\VmJUjhf.exe
  2⤵
  PID:8628
- C:\Windows\System\tikmyIJ.exe
  C:\Windows\System\tikmyIJ.exe
  2⤵
  PID:8792
- C:\Windows\System\egVMeDz.exe
  C:\Windows\System\egVMeDz.exe
  2⤵
  PID:8728
- C:\Windows\System\qUUjWHK.exe
  C:\Windows\System\qUUjWHK.exe
  2⤵
  PID:8868
- C:\Windows\System\AUTWwFA.exe
  C:\Windows\System\AUTWwFA.exe
  2⤵
  PID:8932
- C:\Windows\System\YytWfpl.exe
  C:\Windows\System\YytWfpl.exe
  2⤵
  PID:8964
- C:\Windows\System\UsaZNXV.exe
  C:\Windows\System\UsaZNXV.exe
  2⤵
  PID:8852
- C:\Windows\System\BUTsfvC.exe
  C:\Windows\System\BUTsfvC.exe
  2⤵
  PID:8952
- C:\Windows\System\llrDMPM.exe
  C:\Windows\System\llrDMPM.exe
  2⤵
  PID:9028
- C:\Windows\System\TXBfPKG.exe
  C:\Windows\System\TXBfPKG.exe
  2⤵
  PID:9092
- C:\Windows\System\yXudWiw.exe
  C:\Windows\System\yXudWiw.exe
  2⤵
  PID:9012
- C:\Windows\System\FyUbDGz.exe
  C:\Windows\System\FyUbDGz.exe
  2⤵
  PID:9080
- C:\Windows\System\OaGQSIP.exe
  C:\Windows\System\OaGQSIP.exe
  2⤵
  PID:9156
- C:\Windows\System\CkVMuwm.exe
  C:\Windows\System\CkVMuwm.exe
  2⤵
  PID:9144
- C:\Windows\System\OnXEJvW.exe
  C:\Windows\System\OnXEJvW.exe
  2⤵
  PID:9172
- C:\Windows\System\KoqZliF.exe
  C:\Windows\System\KoqZliF.exe
  2⤵
  PID:7328
- C:\Windows\System\kTDkwcQ.exe
  C:\Windows\System\kTDkwcQ.exe
  2⤵
  PID:8224
- C:\Windows\System\vXFwDHS.exe
  C:\Windows\System\vXFwDHS.exe
  2⤵
  PID:8240
- C:\Windows\System\bGXAxPQ.exe
  C:\Windows\System\bGXAxPQ.exe
  2⤵
  PID:8296
- C:\Windows\System\FiASsiB.exe
  C:\Windows\System\FiASsiB.exe
  2⤵
  PID:8372
- C:\Windows\System\tmjbczB.exe
  C:\Windows\System\tmjbczB.exe
  2⤵
  PID:8276
- C:\Windows\System\ZzlqTms.exe
  C:\Windows\System\ZzlqTms.exe
  2⤵
  PID:8404
- C:\Windows\System\QmGBuuv.exe
  C:\Windows\System\QmGBuuv.exe
  2⤵
  PID:8580
- C:\Windows\System\NaOvrId.exe
  C:\Windows\System\NaOvrId.exe
  2⤵
  PID:8520
- C:\Windows\System\BPhjygd.exe
  C:\Windows\System\BPhjygd.exe
  2⤵
  PID:8664
- C:\Windows\System\NGAQlRJ.exe
  C:\Windows\System\NGAQlRJ.exe
  2⤵
  PID:8948
- C:\Windows\System\JXGnhPp.exe
  C:\Windows\System\JXGnhPp.exe
  2⤵
  PID:8888
- C:\Windows\System\lkUTzoG.exe
  C:\Windows\System\lkUTzoG.exe
  2⤵
  PID:8740
- C:\Windows\System\qfjIlll.exe
  C:\Windows\System\qfjIlll.exe
  2⤵
  PID:8692
- C:\Windows\System\ZdqnhKr.exe
  C:\Windows\System\ZdqnhKr.exe
  2⤵
  PID:8824
- C:\Windows\System\BRMAoCQ.exe
  C:\Windows\System\BRMAoCQ.exe
  2⤵
  PID:9060
- C:\Windows\System\cRcrUux.exe
  C:\Windows\System\cRcrUux.exe
  2⤵
  PID:9192
- C:\Windows\System\alQZitl.exe
  C:\Windows\System\alQZitl.exe
  2⤵
  PID:9160
- C:\Windows\System\scnCshM.exe
  C:\Windows\System\scnCshM.exe
  2⤵
  PID:9204
- C:\Windows\System\XnvSZPK.exe
  C:\Windows\System\XnvSZPK.exe
  2⤵
  PID:7380
- C:\Windows\System\crCiZbM.exe
  C:\Windows\System\crCiZbM.exe
  2⤵
  PID:8436
- C:\Windows\System\XLLAbrh.exe
  C:\Windows\System\XLLAbrh.exe
  2⤵
  PID:8552
- C:\Windows\System\TJgMgae.exe
  C:\Windows\System\TJgMgae.exe
  2⤵
  PID:8600
- C:\Windows\System\CATdQJX.exe
  C:\Windows\System\CATdQJX.exe
  2⤵
  PID:9000
- C:\Windows\System\SHNNgpF.exe
  C:\Windows\System\SHNNgpF.exe
  2⤵
  PID:8712
- C:\Windows\System\NxExcUx.exe
  C:\Windows\System\NxExcUx.exe
  2⤵
  PID:9016
- C:\Windows\System\qZGcgab.exe
  C:\Windows\System\qZGcgab.exe
  2⤵
  PID:8256
- C:\Windows\System\VSwcXMg.exe
  C:\Windows\System\VSwcXMg.exe
  2⤵
  PID:8344
- C:\Windows\System\GqyiOLj.exe
  C:\Windows\System\GqyiOLj.exe
  2⤵
  PID:8420
- C:\Windows\System\RDUklmF.exe
  C:\Windows\System\RDUklmF.exe
  2⤵
  PID:8772
- C:\Windows\System\ocpLbDX.exe
  C:\Windows\System\ocpLbDX.exe
  2⤵
  PID:8840
- C:\Windows\System\gAAnrdu.exe
  C:\Windows\System\gAAnrdu.exe
  2⤵
  PID:9208
- C:\Windows\System\VkcVnoE.exe
  C:\Windows\System\VkcVnoE.exe
  2⤵
  PID:9128
- C:\Windows\System\TORLTwo.exe
  C:\Windows\System\TORLTwo.exe
  2⤵
  PID:8644
- C:\Windows\System\YbRfGbJ.exe
  C:\Windows\System\YbRfGbJ.exe
  2⤵
  PID:7796
- C:\Windows\System\hBUafpn.exe
  C:\Windows\System\hBUafpn.exe
  2⤵
  PID:9232
- C:\Windows\System\JyXAjkJ.exe
  C:\Windows\System\JyXAjkJ.exe
  2⤵
  PID:9248
- C:\Windows\System\sgSVKlF.exe
  C:\Windows\System\sgSVKlF.exe
  2⤵
  PID:9264
- C:\Windows\System\mivjxoF.exe
  C:\Windows\System\mivjxoF.exe
  2⤵
  PID:9280
- C:\Windows\System\FQzNcjK.exe
  C:\Windows\System\FQzNcjK.exe
  2⤵
  PID:9296
- C:\Windows\System\EMgRXMv.exe
  C:\Windows\System\EMgRXMv.exe
  2⤵
  PID:9312
- C:\Windows\System\mnODhfX.exe
  C:\Windows\System\mnODhfX.exe
  2⤵
  PID:9328
- C:\Windows\System\UIsRJaN.exe
  C:\Windows\System\UIsRJaN.exe
  2⤵
  PID:9344
- C:\Windows\System\jFOOPez.exe
  C:\Windows\System\jFOOPez.exe
  2⤵
  PID:9360
- C:\Windows\System\UYBZyqe.exe
  C:\Windows\System\UYBZyqe.exe
  2⤵
  PID:9376
- C:\Windows\System\mqzWvvu.exe
  C:\Windows\System\mqzWvvu.exe
  2⤵
  PID:9392
- C:\Windows\System\KYNboVk.exe
  C:\Windows\System\KYNboVk.exe
  2⤵
  PID:9408
- C:\Windows\System\yQNjUoV.exe
  C:\Windows\System\yQNjUoV.exe
  2⤵
  PID:9424
- C:\Windows\System\QnzkZzY.exe
  C:\Windows\System\QnzkZzY.exe
  2⤵
  PID:9440
- C:\Windows\System\zQSGvDo.exe
  C:\Windows\System\zQSGvDo.exe
  2⤵
  PID:9456
- C:\Windows\System\IjYJwOB.exe
  C:\Windows\System\IjYJwOB.exe
  2⤵
  PID:9472
- C:\Windows\System\lNTzFdU.exe
  C:\Windows\System\lNTzFdU.exe
  2⤵
  PID:9488
- C:\Windows\System\nbhyaCx.exe
  C:\Windows\System\nbhyaCx.exe
  2⤵
  PID:9504
- C:\Windows\System\PsXWAql.exe
  C:\Windows\System\PsXWAql.exe
  2⤵
  PID:9520
- C:\Windows\System\IGSwcXY.exe
  C:\Windows\System\IGSwcXY.exe
  2⤵
  PID:9536
- C:\Windows\System\VfTsarJ.exe
  C:\Windows\System\VfTsarJ.exe
  2⤵
  PID:9552
- C:\Windows\System\MlmqLiC.exe
  C:\Windows\System\MlmqLiC.exe
  2⤵
  PID:9568
- C:\Windows\System\fmXgSts.exe
  C:\Windows\System\fmXgSts.exe
  2⤵
  PID:9584
- C:\Windows\System\THiywTL.exe
  C:\Windows\System\THiywTL.exe
  2⤵
  PID:9600
- C:\Windows\System\JrpNFjW.exe
  C:\Windows\System\JrpNFjW.exe
  2⤵
  PID:9616
- C:\Windows\System\vQdpOOl.exe
  C:\Windows\System\vQdpOOl.exe
  2⤵
  PID:9632
- C:\Windows\System\vkRQKvz.exe
  C:\Windows\System\vkRQKvz.exe
  2⤵
  PID:9648
- C:\Windows\System\CHdBdKx.exe
  C:\Windows\System\CHdBdKx.exe
  2⤵
  PID:9664
- C:\Windows\System\IlsKXrG.exe
  C:\Windows\System\IlsKXrG.exe
  2⤵
  PID:9680
- C:\Windows\System\dWBPvjF.exe
  C:\Windows\System\dWBPvjF.exe
  2⤵
  PID:9696
- C:\Windows\System\gCykhBI.exe
  C:\Windows\System\gCykhBI.exe
  2⤵
  PID:9712
- C:\Windows\System\QjJeLCF.exe
  C:\Windows\System\QjJeLCF.exe
  2⤵
  PID:9728
- C:\Windows\System\upGaiGL.exe
  C:\Windows\System\upGaiGL.exe
  2⤵
  PID:9744
- C:\Windows\System\PgXdxHh.exe
  C:\Windows\System\PgXdxHh.exe
  2⤵
  PID:9760
- C:\Windows\System\abPEESP.exe
  C:\Windows\System\abPEESP.exe
  2⤵
  PID:9776
- C:\Windows\System\EpinDxc.exe
  C:\Windows\System\EpinDxc.exe
  2⤵
  PID:9792
- C:\Windows\System\alxRmFu.exe
  C:\Windows\System\alxRmFu.exe
  2⤵
  PID:9808
- C:\Windows\System\RIPQkHf.exe
  C:\Windows\System\RIPQkHf.exe
  2⤵
  PID:9824
- C:\Windows\System\SFsOLCB.exe
  C:\Windows\System\SFsOLCB.exe
  2⤵
  PID:9840
- C:\Windows\System\PexgBBj.exe
  C:\Windows\System\PexgBBj.exe
  2⤵
  PID:9856
- C:\Windows\System\nwVNoAg.exe
  C:\Windows\System\nwVNoAg.exe
  2⤵
  PID:9872
- C:\Windows\System\yRtspIt.exe
  C:\Windows\System\yRtspIt.exe
  2⤵
  PID:9888
- C:\Windows\System\arayekG.exe
  C:\Windows\System\arayekG.exe
  2⤵
  PID:9904
- C:\Windows\System\hHDkwvv.exe
  C:\Windows\System\hHDkwvv.exe
  2⤵
  PID:9920
- C:\Windows\System\nmixrbn.exe
  C:\Windows\System\nmixrbn.exe
  2⤵
  PID:9936
- C:\Windows\System\CwBtSHb.exe
  C:\Windows\System\CwBtSHb.exe
  2⤵
  PID:9952
- C:\Windows\System\QeYTzDl.exe
  C:\Windows\System\QeYTzDl.exe
  2⤵
  PID:9968
- C:\Windows\System\wxLhVYc.exe
  C:\Windows\System\wxLhVYc.exe
  2⤵
  PID:9984
- C:\Windows\System\wLCQYNd.exe
  C:\Windows\System\wLCQYNd.exe
  2⤵
  PID:10000
- C:\Windows\System\IncDIth.exe
  C:\Windows\System\IncDIth.exe
  2⤵
  PID:10016
- C:\Windows\System\JBdcPqZ.exe
  C:\Windows\System\JBdcPqZ.exe
  2⤵
  PID:10032
- C:\Windows\System\XNLhyNN.exe
  C:\Windows\System\XNLhyNN.exe
  2⤵
  PID:10048
- C:\Windows\System\eviQHtP.exe
  C:\Windows\System\eviQHtP.exe
  2⤵
  PID:10064
- C:\Windows\System\BCuGAYv.exe
  C:\Windows\System\BCuGAYv.exe
  2⤵
  PID:10080
- C:\Windows\System\efAodFn.exe
  C:\Windows\System\efAodFn.exe
  2⤵
  PID:10096
- C:\Windows\System\dMKCNKq.exe
  C:\Windows\System\dMKCNKq.exe
  2⤵
  PID:10112
- C:\Windows\System\Zejhsju.exe
  C:\Windows\System\Zejhsju.exe
  2⤵
  PID:10128
- C:\Windows\System\MKtkWHJ.exe
  C:\Windows\System\MKtkWHJ.exe
  2⤵
  PID:10144
- C:\Windows\System\TeCRHXm.exe
  C:\Windows\System\TeCRHXm.exe
  2⤵
  PID:10160
- C:\Windows\System\uBxpSTX.exe
  C:\Windows\System\uBxpSTX.exe
  2⤵
  PID:10176
- C:\Windows\System\ZvuqUDl.exe
  C:\Windows\System\ZvuqUDl.exe
  2⤵
  PID:10192
- C:\Windows\System\CikjUft.exe
  C:\Windows\System\CikjUft.exe
  2⤵
  PID:10208
- C:\Windows\System\ijDyCdI.exe
  C:\Windows\System\ijDyCdI.exe
  2⤵
  PID:10224
- C:\Windows\System\GkAVssp.exe
  C:\Windows\System\GkAVssp.exe
  2⤵
  PID:9224
- C:\Windows\System\TDpbQro.exe
  C:\Windows\System\TDpbQro.exe
  2⤵
  PID:9064
- C:\Windows\System\JJnBbkr.exe
  C:\Windows\System\JJnBbkr.exe
  2⤵
  PID:9244
- C:\Windows\System\IXMZJLt.exe
  C:\Windows\System\IXMZJLt.exe
  2⤵
  PID:9272
- C:\Windows\System\dczXeHN.exe
  C:\Windows\System\dczXeHN.exe
  2⤵
  PID:9356
- C:\Windows\System\vvQkMdI.exe
  C:\Windows\System\vvQkMdI.exe
  2⤵
  PID:9340
- C:\Windows\System\vVTLpKg.exe
  C:\Windows\System\vVTLpKg.exe
  2⤵
  PID:9416
- C:\Windows\System\VaCcxfV.exe
  C:\Windows\System\VaCcxfV.exe
  2⤵
  PID:9436
- C:\Windows\System\eSvrxdO.exe
  C:\Windows\System\eSvrxdO.exe
  2⤵
  PID:9464
- C:\Windows\System\jWxIkJq.exe
  C:\Windows\System\jWxIkJq.exe
  2⤵
  PID:9496
- C:\Windows\System\qTllKPZ.exe
  C:\Windows\System\qTllKPZ.exe
  2⤵
  PID:9528
- C:\Windows\System\rmLRCXA.exe
  C:\Windows\System\rmLRCXA.exe
  2⤵
  PID:9576
- C:\Windows\System\tErlvMy.exe
  C:\Windows\System\tErlvMy.exe
  2⤵
  PID:9560
- C:\Windows\System\fXIuxQi.exe
  C:\Windows\System\fXIuxQi.exe
  2⤵
  PID:9640
- C:\Windows\System\kePDWma.exe
  C:\Windows\System\kePDWma.exe
  2⤵
  PID:9672
- C:\Windows\System\yEIPVpd.exe
  C:\Windows\System\yEIPVpd.exe
  2⤵
  PID:9688
- C:\Windows\System\ilIkqju.exe
  C:\Windows\System\ilIkqju.exe
  2⤵
  PID:9720
- C:\Windows\System\abIwlqp.exe
  C:\Windows\System\abIwlqp.exe
  2⤵
  PID:9768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BDtdxwg.exe

Filesize
1.4MB

MD5
c24cfa0408f0ed84ef55e0b71ae6d557

SHA1
987c29730612abc5694ccf26bce76ecc0f726785

SHA256
5a4f73b43307245947ad85ec51eae0839643ed38e54e238e759762fbd893f316

SHA512
599ef4d9afeb2d2408a88495eeef072052bb93b0ccdc2a625c77d9a1ac3cdd86fd87179e556fde1e5e6cd538d7132062b52f1a36361e6a4b2ab7cefe68be68dc

Download Submit
C:\Windows\system\CCywBeu.exe

Filesize
1.4MB

MD5
cfb699179ccfbb48b55d9bea7191a471

SHA1
5c2cfe8eafddb310345f8dc79f4d16d228b0acd2

SHA256
1618807c33c246284248c3ae0d40a0c952ad220122e78dc247be332b091361f4

SHA512
e7707b4b2465ce64492cc6a2cf8ceb6c1dd34f0992cab969950f7bfccbbef56c1e78624b4b4e61d4f8fa06b0cdd872d25b028dd9393c7ee9a5329d5582822ff3

Download Submit
C:\Windows\system\DIyxHMs.exe

Filesize
1.4MB

MD5
8dc7bdbdbf76c9159af6c9deec04ff3f

SHA1
2055bd2f3de0bc9053fe862e39d14892414b2f38

SHA256
b27aa0c3dce9dad555f0652de95250853d2a5ef7771c7ac84d3e1e2df51a57f9

SHA512
b82088f127743cd84be8b62c87257e90ea892a3b4642cd7a036de70fd1fbf38a671ca9db1941c06093ce176bcefaff349822cd482cbe136c9c05714b8598bbe0

Download Submit
C:\Windows\system\HEgorOv.exe

Filesize
1.4MB

MD5
cf547d393313f62b46cb7f35717fbb09

SHA1
48ff6fa86d11c2aa25789fcd159cd604f181f721

SHA256
218a8c4ad9e84bc746452b4f1a2b662172e998f96349be45de39cbd243325d1b

SHA512
12e3eb66621065288bb103bc2385030ced806feb99fd9ddd18baf70f63395901d6e1ee472d50a2be4690d5a7ccb0899bb3204ab77c24b196c1df8b2a8d8cc40d

Download Submit
C:\Windows\system\KSDuwKx.exe

Filesize
1.4MB

MD5
b6a1d51f501578ad377c27893306dca4

SHA1
2c9c4427b15190284bfc418af459a609c9e0fc42

SHA256
cf4624dec4cdeb17b568a06ac123c288b40a7c7be2d252e9ee7d09fe83ca847c

SHA512
6f34b75c3951c8eaf214f97f1092522cc37cdfdabc98c1a2e84f64c48ffb9657894395aefa209b24dff50dda4e0c461c238b0a20341b830094c3de05ee8c0673

Download Submit
C:\Windows\system\NzgCTfa.exe

Filesize
1.4MB

MD5
0dd1f91fd9251ab0bada9a4dbba965d1

SHA1
b6cdbc8436ec1161eef766055333585510bfd44f

SHA256
f77dfd3dd3f6e888b38bcaf491f15eb7e2d4d3552396c26ee359ff70850f5be9

SHA512
113007a13c6407b0717efa9bad0855b3d2dc22be6030b1099083f4e9694a4b567dc72976bc67785bbaecbcc84c229a06955ef4bf126c13d59cc466adc02781bb

Download Submit
C:\Windows\system\ORIGNkz.exe

Filesize
1.4MB

MD5
ba84941fc081c156df4d69de3ce4b848

SHA1
d66d92bb4638e8fd5dc84e22e9d0b203cc62f146

SHA256
ce45d03c7d24ff4c99c3bcd6ad7de1c6a63f523513a1f908816d423e5547c305

SHA512
8d23b74c6f5abf6ae190fabf8f80c56e72a812237e953ba28b49fbe1d2cec2277df5424aeb64ccd717263e97feaef637f4696c443703789dab854c79aaba3c49

Download Submit
C:\Windows\system\PiVgaPV.exe

Filesize
1.4MB

MD5
7366388c3e5602850412b0fe2b94c456

SHA1
c99d2766927c65fd69332e4a36ea2d9a86962aa2

SHA256
4a339564f688426db07c769b97140e4f7a523f1ecd49cce1acb10cd3351b2d90

SHA512
1c41f3e224a7f79ef7777f70e2936ace9a156c1c2ca4201ca2b3ca90d27a25df2907938e90e724c3ff179d9390bd883cd9864df412bad7e206debd9028592c55

Download Submit
C:\Windows\system\QomBsKZ.exe

Filesize
1.4MB

MD5
84e30456e2b17966931ea1cf9af78e0b

SHA1
fa732b6df7abf73a6456a8ebaba832bcc4ae9e66

SHA256
4873dbe42b17215befbb53bb514b4534398c6a9436bf6c37fece3b312e696538

SHA512
03c66fe1658befee0030cf9978a07e50fb40b09a9546e5fddd83cf3906441ba8eb0162834f26a0642e4000920904a601ee7c3ebc92426fc7aa57b120d8664510

Download Submit
C:\Windows\system\RnGSVmb.exe

Filesize
1.4MB

MD5
c896476e3992f6fdff58c3232f2064ee

SHA1
7a8aedb5c4cdf1cac2948d4b75dd8fd56d6b5205

SHA256
fa3743c56f18018c49ca8b41b7f406ef4e3e423f779ef6ffa864c0eb193883d0

SHA512
c13de01b032796cb4f09786dec30f5ec49b4d041df8d67a8c7ce477d75d592e48ee31d61e25a165febeb09eac29e09f5947564b03b38e84ae1b2fd5c03cc71e1

Download Submit
C:\Windows\system\UdImUnj.exe

Filesize
1.4MB

MD5
4affea67c344b41a2b7f65210a38367b

SHA1
848fb401a7cf1b5ec17205fa9dfa878f44ddaf6f

SHA256
518044d6aca857db4c3b29829a7be2397bf649cc760554ce4c2da2c94dc33104

SHA512
db25c30a011170eb5627b472f66c3c514521a281c635fda11318df2a8c5ed8ce81b014e3f7132801cbfe3826e2740957539122d31e0bd6cff4de8b512ffc7540

Download Submit
C:\Windows\system\YAvBlaQ.exe

Filesize
1.4MB

MD5
819422928044f6ede13ce4d44afd96c8

SHA1
bcb1b7cafd1b7b0814b0468b539c28aae3798ada

SHA256
a0da898ed4ca57b2e964395974fa0851dd5965ec342ab8fa751ac7828cdb11fb

SHA512
e9bb06fe662d0d96caf1df6d587a2cf20370b0fca0c1939d4b49efaba2f4023c3d6bc40b1b17221256aa9e8bdf64251cbe47cfc9f1bac2244c206006bb7dc150

Download Submit
C:\Windows\system\apewDvU.exe

Filesize
1.4MB

MD5
5ac4db55178310459396596b562526f8

SHA1
d4f9357750b8a8ea66ff6a517e1a4b8212b48aae

SHA256
ecec1dc3223d0d8b81aa55356232207122ed6de97dda1e18fcfde95d92080649

SHA512
7216aa8a85c6d70a8f2d13aa358ad2fe49a397860f07b03fa778bd01325703bfeecdee4e83f6c2d1a4ff641688b2fadbfdfc6769396f6152058d749f2b4206f9

Download Submit
C:\Windows\system\axZtRFm.exe

Filesize
1.4MB

MD5
1a983917007c56dfc0909976a74ff6dd

SHA1
dde09d859a905570c1e8c95a65687c5e3361973a

SHA256
b47ae89d204c8ffba3fdcc8216885285aaf9ba9a23656a2aee1e878366941f21

SHA512
bd83e3e77bba8ee8aa622cb7951bdf966ecfdd187ee951a1a09485f03f98478cb7782168d820475b1334bd2434c978b9f718dba1a8a3c27b6f4419e264b7aaa8

Download Submit
C:\Windows\system\dMsAHAe.exe

Filesize
1.4MB

MD5
40caae8d813715de02f27a5bd13c15db

SHA1
5bd8ffe3c85465660657a19b3c7f89246c417a03

SHA256
486a2e035ea67e3fd4770dc355087bd383fbb63dfbd1e184ebe638e5fedad670

SHA512
1bf84aee8ae561bb16852c6309a5b4dd3aff856b9b82ccf5a4b2a4db1d3a31c7b07ff854e23a4ff046f129da9bfc1c077e12ab7d5739f75bfa9f05f76e7efe24

Download Submit
C:\Windows\system\dcSjwNu.exe

Filesize
1.4MB

MD5
179c58dd9c24a500bb9ffd7159b7d59b

SHA1
4600b9da859dd68bbfddb942fdd8705c4cc07da2

SHA256
1022e7d22cda7320ab3803db7f9bab266cdaf241638a7241d657857447fe18b3

SHA512
bbee6eb46ea39de516dbdad9e5cd8b1a5045289295a38659b88d128769a08983b22cbf9ad3c11ef1cf286d053e30ad40aa015476f4c13068de4e129c4ca5d9e4

Download Submit
C:\Windows\system\iJWXQDy.exe

Filesize
1.4MB

MD5
0cf636eb57c756b924b23bfa1e06d945

SHA1
6ae33daac9f53a7d2d55cd9b39baa0c749fa9fb9

SHA256
a110d8e9167aeab8ebb0e4a431169cd5d66e93e368b0f66cfeabaec4052ddc81

SHA512
241087c108e0b697d2db869289eecc3b9ee48c66048a59d867e0774d5ca3965d281d578ff7f324750803e35f7e8ab20f0313032f004d1a3faca633c7564ac37e

Download Submit
C:\Windows\system\kZxAtuW.exe

Filesize
1.4MB

MD5
5700ee5d68f2eb000f7910df9dc130be

SHA1
51325a7125ad6068ebaee406187c963455eed696

SHA256
3305a048606fe9047333432732c9e9f74be246a8d0876f5f89a135e92f199610

SHA512
195cbcb757b32571aec6d06c60ab538a8b42da5ab5287ae270e885c5a0625a3b12eaa735f8d0f67d5239776c94224a9cef9bfd115b83b7a35fbf0681f0d79873

Download Submit
C:\Windows\system\lZZByuf.exe

Filesize
1.4MB

MD5
c2d1af0e4ca987d65ae64fc01d60dbcb

SHA1
f6849618bb7d5d5845a4fa811c881275a34b8842

SHA256
6d0cfe6bdeee08eadea9104bad7af4e681e98ad2e47e463330832d3062ab98e1

SHA512
311a40f80430242fed16f2826def414362ef3536dd4bf87c2e32365817a3f0543df1bd505f1f982a3bdc286ab3e455c30ba3d14ca173c34c95690dcada33679c

Download Submit
C:\Windows\system\lyvkvHg.exe

Filesize
1.4MB

MD5
72fa9484066c7660017fa77f4c034d47

SHA1
fa5f0b7310184f2547017e233062e8d532599444

SHA256
18248c30d48a63327ebad9a4d62d5276a89c33ba8e9b3f4b85b49ff27076277a

SHA512
37dd1b6564035e5a7722367f388839f7c2b2e8d1d332cbd8d9fcf2980b1a325f6226c709af6513a9e506c2f8ee7634e91f9b79d2cbf0f84d187c653893b54a79

Download Submit
C:\Windows\system\myXJXKI.exe

Filesize
1.4MB

MD5
d59c302654c3d71c32a451db6480c307

SHA1
2a0688de3a33f33b3884a8f7c59380a2e3f99f85

SHA256
3274e5b92a16cbe52d50503db948783bdbe433a470eb7445e98dcfc2f5a37ab0

SHA512
af943564bed73370546670194a953f40e4c8216cf93eae5b164b05d0357c8230afcc89bcf70a4848266f4f31d517627c0c0e8c5f2346744259f421cee26b1c90

Download Submit
C:\Windows\system\ncfHlhK.exe

Filesize
1.4MB

MD5
7ee9ace66589f994f968c4a6cebb0e47

SHA1
834df78586104e96b117a269e43cb4ffa045524c

SHA256
bc965f385d8faae490fb28db051acacb5387a2d02c57da41f511ce6c8423b3b8

SHA512
8a38d26b9a9393d65b4732da9cc396dacdef8d95c8b2481524f4180490080de4fe93e14cb975913dc7366684615e82db2aa449db4776ed5116799aa319fb3b2d

Download Submit
C:\Windows\system\oHYucUq.exe

Filesize
1.4MB

MD5
07a697b0790673d88702affde9163792

SHA1
09d74fc7def4660fd5b3bd76076faf6fa9985b88

SHA256
60dcf159f3a854d4864877964efe1a03df953f5294515d9953475ce0cc193941

SHA512
7cf6d422ebc970b761968e6f05cbf6a530754671e6dddcd2304e92064e9983db601524501b9c8a4ae01514bd340deeaac7ff39b7342e5914c19f0babb321090b

Download Submit
C:\Windows\system\sbOKdtd.exe

Filesize
1.4MB

MD5
f0a0c44eb5c8aa9bdb9d07b832543230

SHA1
86603865219e480fa623a1ea5b7cd4bbdeb113a0

SHA256
e6e3b8594e56fea4dd6d7dea74deaa5f6be19a5b2f0a6ab035d582216fcda440

SHA512
bb5f4fddd3e8ee09d4901daf8a8379ea5e984216893e7fb5a57877daec2cb23638ff7abf1dafe6ae7a3a760b4db54e587ccf12ed6e556c33d9f7abe49eb9595d

Download Submit
C:\Windows\system\teyDafT.exe

Filesize
1.4MB

MD5
ff92ddc981b94e19e9881104a3411f3b

SHA1
89591d5fb90174d6476dcc2b9a895fbe6ff25b9d

SHA256
3ddb11e72cc29c973a759555907f934191dac4375b96c1099c6066fdb0f4b65b

SHA512
3c992b60eea84f885571da0f2c1a4878ce63f5535afc25942ff11d5ee6e29eb01eecafe28a11d357f02008178c47205c2c34fd74996bad310f70e9d72a2d3668

Download Submit
C:\Windows\system\wvcdvRt.exe

Filesize
1.4MB

MD5
76000ea295f202cb2792e36b4cad0e60

SHA1
19a05d26fefa439a728856a5716064e968ca2d72

SHA256
625b7ae9184480f2240b21482fb1e6d13e3beaee74c5a1c06315b0137434953c

SHA512
8d8de8d0bc463d6e6e931b3be1a1e8d6c3f3d6306556965f550032ba66a70183bbfba5b961ef52c65297e47ef516d7024f5171f78769d9d4ab5e0ca2fb3ddcb9

Download Submit
C:\Windows\system\xDmXaNE.exe

Filesize
1.4MB

MD5
3fd30a7f69df0dc4fe6af97ff58656b5

SHA1
d5636a8187bd96be930c89ad024869b22c04dd93

SHA256
28a8211475016dc45849bf96fbd2f02f4b5f35d153700c82ee3dbfed22b84619

SHA512
de9565aea5c536b3e6d0c26a9f624c86bb85433d624b233aeeb727881b70bf1383c1cfc5a2293bb13bdd31e3dadd042e266ad7f9e161cfb4ef55f727f6a064cb

Download Submit
C:\Windows\system\yAvUDrv.exe

Filesize
1.4MB

MD5
b689d8354513788972e754c08562ee4b

SHA1
1100b07829adb9020d1de1ebb321217eeb6ad464

SHA256
5da56338a3d3002fee7be88009903bf7afc59a9b649a436600d5157e9456c8ca

SHA512
38ae0e8534132ea1ad6af010a54feb69fc9783992e34390280df477ba0e3e263e518d5d9a7b0a64cbf14946a16a609cec0580f43f7b02cefb30ca24c5f488b64

Download Submit
\Windows\system\IqxvnDU.exe

Filesize
1.4MB

MD5
856f106f9fea4def2fabb7eed9f7e90d

SHA1
d3de22bff47f60151805ced5692d706c3a06f9ac

SHA256
cb99ada5d193af73121963bc4683282d23dc919cd571df5a2e092993233e4cb7

SHA512
d57b31006f6c7c0c850fb6726be4dda03e7d8d999a37b1a9727c500f0c3821f95250a27c97a522561e12a0cb145ebdb914f526ee7f7c3ad7a71d16b15576c3bb

Download Submit
\Windows\system\NceoFoI.exe

Filesize
1.4MB

MD5
a44d5d56125905c8e00ceca34da293a8

SHA1
384a51ffa2a819ba4f8b96f053d2feec86b06b39

SHA256
483df021da910e8104233930c450c7ab804defc6695a7d9ac5f07d4d2098a160

SHA512
fb87ae2ea2d395667518415f0a0bf417e568f488f9f3ad67791ab20f8b9570dc33b1a29f772e4998ca009146cd57a457cbbe8227ee79fda3c27ef8c1b8697e4e

Download Submit
\Windows\system\Xbinemj.exe

Filesize
1.4MB

MD5
16731db0dfd7d92e9677668cd05fb0c7

SHA1
145bb91992acf19eeaff7936bf679be7b60fb3a2

SHA256
aa2370933f911b73c946ee7a342e1e43d3f22fb875c6e024701355fdf1b087a0

SHA512
6806dae9f2e729b1228e0471ac1945b223751558faf9076656ddc972c514bdce1f528eebd9018cc6552052ed0377072c151892eca9a97946f60ca5669dd03d8e

Download Submit
\Windows\system\ujepnRC.exe

Filesize
1.4MB

MD5
f67b43685c91352e75685af799baba5f

SHA1
590efd9d916e260745481a03e4f12cd26f63cb2d

SHA256
bbc7736f79812411d2a010412595d279528693a21cd84f237b81d6d976f1ce53

SHA512
11bfb2459870836d4d5b714d2f1e4bfaa7f37a48dda2ed59a003b19b7a8aa0baa2bf57d723d3c4c88048aa3351912e46ffba8fc25dba65e3efc8881aa9b97188

Download Submit
memory/264-64-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/264-4248-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/1232-70-0x000000013FA90000-0x000000013FDE1000-memory.dmp

Filesize
3.3MB

Download
memory/1232-4250-0x000000013FA90000-0x000000013FDE1000-memory.dmp

Filesize
3.3MB

Download
memory/1836-1148-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/1836-96-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/1836-4251-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2192-4067-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2192-29-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2240-83-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2240-4267-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2240-469-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2384-4259-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2384-89-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2384-670-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2440-105-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-49-0x000000013F0A0000-0x000000013F3F1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-94-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-101-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-88-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-0-0x000000013F9F0000-0x000000013FD41000-memory.dmp

Filesize
3.3MB

Download
memory/2440-316-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-82-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2440-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2440-76-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-22-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-468-0x000000013F440000-0x000000013F791000-memory.dmp

Filesize
3.3MB

Download
memory/2440-69-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-24-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2440-20-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/2440-63-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-1409-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-56-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/2440-51-0x000000013F9F0000-0x000000013FD41000-memory.dmp

Filesize
3.3MB

Download
memory/2440-1147-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-31-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2440-95-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2440-40-0x0000000001E10000-0x0000000002161000-memory.dmp

Filesize
3.3MB

Download
memory/2544-41-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2544-4266-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2544-75-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2616-50-0x000000013F0A0000-0x000000013F3F1000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4265-0x000000013F0A0000-0x000000013F3F1000-memory.dmp

Filesize
3.3MB

Download
memory/2652-21-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4046-0x000000013F1D0000-0x000000013F521000-memory.dmp

Filesize
3.3MB

Download
memory/2716-36-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2716-4125-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2732-18-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-52-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-4045-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-19-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4001-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2992-317-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2992-77-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2992-4253-0x000000013F150000-0x000000013F4A1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-4249-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-58-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

Filesize
3.3MB

Download