xmrig | f2df0e87600f63087777a7e8554af92627293c89b1657030df0eda6dd54aef71

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

047b454a9b88b44ca141dd3bc3aa5e70N.exe
Size

1.1MB
MD5

047b454a9b88b44ca141dd3bc3aa5e70
SHA1

b186cd84040d96284c23586643bdc25b2983fc9d
SHA256

f2df0e87600f63087777a7e8554af92627293c89b1657030df0eda6dd54aef71
SHA512

6bc9c2c2c4e7f23e55726c7c73c3909f068b7c24672e2fafd16c18e088fb988aba174abacfcfc3b4b6e05e94d732ab650b1ba821c716920c0c2fc71249cc3fd5
SSDEEP

24576:RVIl/WDGCi7/qkat62wTlvck3AWsu4JtQumtp9h349BDP+oe:ROdWCCi7/ra+xeHNRmdhW69

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2908-21-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/2740-33-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig
behavioral1/memory/2744-40-0x000000013FFA0000-0x00000001402F1000-memory.dmp	xmrig
behavioral1/memory/2884-50-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	xmrig
behavioral1/memory/2908-54-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/1656-73-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/1608-69-0x000000013FA20000-0x000000013FD71000-memory.dmp	xmrig
behavioral1/memory/2756-62-0x000000013F380000-0x000000013F6D1000-memory.dmp	xmrig
behavioral1/memory/2588-79-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/2684-497-0x000000013F090000-0x000000013F3E1000-memory.dmp	xmrig
behavioral1/memory/1608-379-0x000000013FA20000-0x000000013FD71000-memory.dmp	xmrig
behavioral1/memory/2244-109-0x000000013F5E0000-0x000000013F931000-memory.dmp	xmrig
behavioral1/memory/2028-98-0x000000013F930000-0x000000013FC81000-memory.dmp	xmrig
behavioral1/memory/2660-97-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2928-3262-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig
behavioral1/memory/2072-3261-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/2884-3618-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	xmrig
behavioral1/memory/2908-3635-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/2756-3662-0x000000013F380000-0x000000013F6D1000-memory.dmp	xmrig
behavioral1/memory/2588-3683-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/2660-3688-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/1608-3907-0x000000013FA20000-0x000000013FD71000-memory.dmp	xmrig
behavioral1/memory/1656-3910-0x000000013FFB0000-0x0000000140301000-memory.dmp	xmrig
behavioral1/memory/2244-3909-0x000000013F5E0000-0x000000013F931000-memory.dmp	xmrig
behavioral1/memory/2684-3914-0x000000013F090000-0x000000013F3E1000-memory.dmp	xmrig
behavioral1/memory/2028-3975-0x000000013F930000-0x000000013FC81000-memory.dmp	xmrig
behavioral1/memory/2072-3968-0x000000013F520000-0x000000013F871000-memory.dmp	xmrig
behavioral1/memory/2928-3967-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2744	ummZFsB.exe
2884	HuwPDsR.exe
2908	gwacxGE.exe
2756	JYmvALH.exe
2588	ybwTqFL.exe
2660	UJaywch.exe
2244	dAmyVzU.exe
1608	APESjFM.exe
2684	WXrfGGu.exe
1656	VVcAgKS.exe
2028	rblHLdI.exe
2072	kVrMWSM.exe
2928	eEcvyrM.exe
2996	UdLVitb.exe
2572	xVZcvaT.exe
2824	wSMCJwe.exe
2264	Thtzpgy.exe
876	PmEVJKD.exe
1948	DCSztzv.exe
1596	dfsWSlx.exe
2336	AFnaYWD.exe
1996	UhiCUWW.exe
2256	mCXkzrB.exe
3068	swUUGDS.exe
2300	PiueOOe.exe
2412	sEJcyTx.exe
812	KCyNbSG.exe
2548	TmHpkGz.exe
884	aAhERCP.exe
1132	ErmqmWf.exe
3020	yPfMbyJ.exe
1820	zpzeojR.exe
952	uQrfdjJ.exe
956	SmRZTXj.exe
1764	JNnknAi.exe
1512	OewXbxx.exe
1760	TIjvatr.exe
2008	VhdwDLF.exe
1908	SQVbliO.exe
692	VYYNiNQ.exe
564	HxUvkEh.exe
2504	xKbMofX.exe
2288	WAwWsny.exe
2140	KjaZDZH.exe
1708	VPIMcPi.exe
1796	QwlAhiC.exe
2396	fawWcsN.exe
1736	DodQcCF.exe
1916	FOxgGtb.exe
2220	OnJTRIb.exe
584	mpkEMqv.exe
2392	UmOXgsQ.exe
1572	lEBTzQL.exe
1980	etIwzOu.exe
3028	BgyTNWs.exe
2440	iWAjojQ.exe
2860	EhiNizs.exe
2640	OkAqeoF.exe
2760	LCHcXQs.exe
2676	hgYecWZ.exe
2704	HvksiPf.exe
624	LAnCWNK.exe
2644	DaeITDY.exe
2652	vmtPyKc.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe
2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/files/0x000a000000012283-3.dat	upx
behavioral1/memory/2744-7-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/files/0x0008000000016d29-8.dat	upx
behavioral1/memory/2884-14-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	upx
behavioral1/files/0x0007000000016d31-19.dat	upx
behavioral1/memory/2908-21-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/files/0x0008000000016d3a-22.dat	upx
behavioral1/memory/2756-27-0x000000013F380000-0x000000013F6D1000-memory.dmp	upx
behavioral1/memory/2588-35-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/memory/2740-33-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/files/0x0007000000016d4a-32.dat	upx
behavioral1/memory/2660-41-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/2744-40-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/files/0x0007000000016d5e-39.dat	upx
behavioral1/files/0x0007000000016d65-52.dat	upx
behavioral1/memory/2244-51-0x000000013F5E0000-0x000000013F931000-memory.dmp	upx
behavioral1/memory/2884-50-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	upx
behavioral1/files/0x0032000000016cdf-49.dat	upx
behavioral1/memory/2908-54-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/files/0x0008000000016dcb-67.dat	upx
behavioral1/memory/1656-73-0x000000013FFB0000-0x0000000140301000-memory.dmp	upx
behavioral1/memory/2684-72-0x000000013F090000-0x000000013F3E1000-memory.dmp	upx
behavioral1/memory/1608-69-0x000000013FA20000-0x000000013FD71000-memory.dmp	upx
behavioral1/files/0x0008000000016d69-68.dat	upx
behavioral1/memory/2756-62-0x000000013F380000-0x000000013F6D1000-memory.dmp	upx
behavioral1/memory/2588-79-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/files/0x000500000001870f-80.dat	upx
behavioral1/files/0x00050000000191f1-102.dat	upx
behavioral1/files/0x0005000000018712-84.dat	upx
behavioral1/files/0x00050000000191dc-90.dat	upx
behavioral1/files/0x0005000000019244-116.dat	upx
behavioral1/files/0x0005000000019444-191.dat	upx
behavioral1/memory/2684-497-0x000000013F090000-0x000000013F3E1000-memory.dmp	upx
behavioral1/memory/1608-379-0x000000013FA20000-0x000000013FD71000-memory.dmp	upx
behavioral1/files/0x0005000000019439-186.dat	upx
behavioral1/files/0x000500000001942e-181.dat	upx
behavioral1/files/0x000500000001941f-176.dat	upx
behavioral1/files/0x00050000000193ee-171.dat	upx
behavioral1/files/0x00050000000193d5-166.dat	upx
behavioral1/files/0x000500000001936c-161.dat	upx
behavioral1/files/0x0005000000019361-156.dat	upx
behavioral1/files/0x0005000000019315-146.dat	upx
behavioral1/files/0x000500000001934d-151.dat	upx
behavioral1/files/0x000500000001926b-141.dat	upx
behavioral1/files/0x0005000000019266-136.dat	upx
behavioral1/files/0x000500000001925d-131.dat	upx
behavioral1/files/0x0005000000019259-126.dat	upx
behavioral1/files/0x000500000001924a-121.dat	upx
behavioral1/memory/2244-109-0x000000013F5E0000-0x000000013F931000-memory.dmp	upx
behavioral1/memory/2928-105-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/memory/2072-104-0x000000013F520000-0x000000013F871000-memory.dmp	upx
behavioral1/files/0x0006000000018bc8-101.dat	upx
behavioral1/memory/2028-98-0x000000013F930000-0x000000013FC81000-memory.dmp	upx
behavioral1/memory/2660-97-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/files/0x0005000000018701-83.dat	upx
behavioral1/memory/2928-3262-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/memory/2072-3261-0x000000013F520000-0x000000013F871000-memory.dmp	upx
behavioral1/memory/2884-3618-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	upx
behavioral1/memory/2908-3635-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/memory/2756-3662-0x000000013F380000-0x000000013F6D1000-memory.dmp	upx
behavioral1/memory/2588-3683-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/memory/2660-3688-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/1608-3907-0x000000013FA20000-0x000000013FD71000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XdIRYoo.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\QGIdIUU.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\KjWggkM.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\TKhUIad.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\MaXKQUM.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\iaRRIvN.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\HKxIAnV.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\ucHRsAU.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\UdpDcuT.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\DPXCHAY.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\qylfHBr.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\fDpeayv.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\fwgLujA.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\HHurfnq.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\IwYqEGl.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\RjTESrX.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\PhtaZNs.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\MYEIMWn.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\drfIOAV.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\JiAHHXa.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\ChFoNql.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\RHrAksi.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\sWMdsuG.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\qSDXrNM.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\VvjzDoS.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\WyxLTrQ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\BAeidQr.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\DMtTJdA.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\rDXANJr.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\wSMCJwe.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\KCyNbSG.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\QwlAhiC.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\QFyuKzv.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\owrUZLS.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\QrfTnkC.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\qqGQUAB.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\uDSDfmW.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\zLWtSjC.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\jBywjWV.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\CoZFTMQ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\zxpABTK.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\HxUvkEh.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\MFwBbPZ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\VYYNiNQ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\yoTpWop.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\mEYegeJ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\NZxhbSN.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\RPszSLu.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\FDYGXpF.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\CxMhMof.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\rblHLdI.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\ophSrfN.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\FCuYOLa.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\WdTSlRH.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\uQrfdjJ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\lpsYujR.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\FjNrzLn.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\WZjXlSC.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\nbgTCdX.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\tVVMVbJ.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\rDOikIa.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\iOwFrZm.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\tCHtMaF.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe
File created	C:\Windows\System\tMHKVlI.exe	047b454a9b88b44ca141dd3bc3aa5e70N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2744	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	31
PID 2740 wrote to memory of 2744	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	31
PID 2740 wrote to memory of 2744	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	31
PID 2740 wrote to memory of 2884	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	32
PID 2740 wrote to memory of 2884	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	32
PID 2740 wrote to memory of 2884	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	32
PID 2740 wrote to memory of 2908	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	33
PID 2740 wrote to memory of 2908	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	33
PID 2740 wrote to memory of 2908	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	33
PID 2740 wrote to memory of 2756	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	34
PID 2740 wrote to memory of 2756	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	34
PID 2740 wrote to memory of 2756	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	34
PID 2740 wrote to memory of 2588	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	35
PID 2740 wrote to memory of 2588	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	35
PID 2740 wrote to memory of 2588	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	35
PID 2740 wrote to memory of 2660	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	36
PID 2740 wrote to memory of 2660	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	36
PID 2740 wrote to memory of 2660	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	36
PID 2740 wrote to memory of 2244	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	37
PID 2740 wrote to memory of 2244	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	37
PID 2740 wrote to memory of 2244	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	37
PID 2740 wrote to memory of 1608	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	38
PID 2740 wrote to memory of 1608	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	38
PID 2740 wrote to memory of 1608	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	38
PID 2740 wrote to memory of 1656	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	39
PID 2740 wrote to memory of 1656	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	39
PID 2740 wrote to memory of 1656	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	39
PID 2740 wrote to memory of 2684	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	40
PID 2740 wrote to memory of 2684	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	40
PID 2740 wrote to memory of 2684	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	40
PID 2740 wrote to memory of 2028	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	41
PID 2740 wrote to memory of 2028	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	41
PID 2740 wrote to memory of 2028	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	41
PID 2740 wrote to memory of 2072	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	42
PID 2740 wrote to memory of 2072	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	42
PID 2740 wrote to memory of 2072	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	42
PID 2740 wrote to memory of 2572	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	43
PID 2740 wrote to memory of 2572	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	43
PID 2740 wrote to memory of 2572	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	43
PID 2740 wrote to memory of 2928	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	44
PID 2740 wrote to memory of 2928	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	44
PID 2740 wrote to memory of 2928	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	44
PID 2740 wrote to memory of 2824	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	45
PID 2740 wrote to memory of 2824	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	45
PID 2740 wrote to memory of 2824	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	45
PID 2740 wrote to memory of 2996	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	46
PID 2740 wrote to memory of 2996	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	46
PID 2740 wrote to memory of 2996	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	46
PID 2740 wrote to memory of 2264	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	47
PID 2740 wrote to memory of 2264	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	47
PID 2740 wrote to memory of 2264	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	47
PID 2740 wrote to memory of 876	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	48
PID 2740 wrote to memory of 876	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	48
PID 2740 wrote to memory of 876	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	48
PID 2740 wrote to memory of 1948	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	49
PID 2740 wrote to memory of 1948	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	49
PID 2740 wrote to memory of 1948	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	49
PID 2740 wrote to memory of 1596	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	50
PID 2740 wrote to memory of 1596	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	50
PID 2740 wrote to memory of 1596	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	50
PID 2740 wrote to memory of 2336	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	51
PID 2740 wrote to memory of 2336	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	51
PID 2740 wrote to memory of 2336	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	51
PID 2740 wrote to memory of 1996	2740	047b454a9b88b44ca141dd3bc3aa5e70N.exe	52

C:\Users\Admin\AppData\Local\Temp\047b454a9b88b44ca141dd3bc3aa5e70N.exe
"C:\Users\Admin\AppData\Local\Temp\047b454a9b88b44ca141dd3bc3aa5e70N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System\ummZFsB.exe
  C:\Windows\System\ummZFsB.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\HuwPDsR.exe
  C:\Windows\System\HuwPDsR.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\gwacxGE.exe
  C:\Windows\System\gwacxGE.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\JYmvALH.exe
  C:\Windows\System\JYmvALH.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\ybwTqFL.exe
  C:\Windows\System\ybwTqFL.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\UJaywch.exe
  C:\Windows\System\UJaywch.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\dAmyVzU.exe
  C:\Windows\System\dAmyVzU.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\APESjFM.exe
  C:\Windows\System\APESjFM.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\VVcAgKS.exe
  C:\Windows\System\VVcAgKS.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\WXrfGGu.exe
  C:\Windows\System\WXrfGGu.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\rblHLdI.exe
  C:\Windows\System\rblHLdI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\kVrMWSM.exe
  C:\Windows\System\kVrMWSM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\xVZcvaT.exe
  C:\Windows\System\xVZcvaT.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\eEcvyrM.exe
  C:\Windows\System\eEcvyrM.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\wSMCJwe.exe
  C:\Windows\System\wSMCJwe.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\UdLVitb.exe
  C:\Windows\System\UdLVitb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\Thtzpgy.exe
  C:\Windows\System\Thtzpgy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\PmEVJKD.exe
  C:\Windows\System\PmEVJKD.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\DCSztzv.exe
  C:\Windows\System\DCSztzv.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\dfsWSlx.exe
  C:\Windows\System\dfsWSlx.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\AFnaYWD.exe
  C:\Windows\System\AFnaYWD.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\UhiCUWW.exe
  C:\Windows\System\UhiCUWW.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\mCXkzrB.exe
  C:\Windows\System\mCXkzrB.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\swUUGDS.exe
  C:\Windows\System\swUUGDS.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\PiueOOe.exe
  C:\Windows\System\PiueOOe.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\sEJcyTx.exe
  C:\Windows\System\sEJcyTx.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\KCyNbSG.exe
  C:\Windows\System\KCyNbSG.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\TmHpkGz.exe
  C:\Windows\System\TmHpkGz.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\aAhERCP.exe
  C:\Windows\System\aAhERCP.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ErmqmWf.exe
  C:\Windows\System\ErmqmWf.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\yPfMbyJ.exe
  C:\Windows\System\yPfMbyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\zpzeojR.exe
  C:\Windows\System\zpzeojR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\uQrfdjJ.exe
  C:\Windows\System\uQrfdjJ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\SmRZTXj.exe
  C:\Windows\System\SmRZTXj.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\JNnknAi.exe
  C:\Windows\System\JNnknAi.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\OewXbxx.exe
  C:\Windows\System\OewXbxx.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\TIjvatr.exe
  C:\Windows\System\TIjvatr.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\VhdwDLF.exe
  C:\Windows\System\VhdwDLF.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\SQVbliO.exe
  C:\Windows\System\SQVbliO.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\VYYNiNQ.exe
  C:\Windows\System\VYYNiNQ.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\HxUvkEh.exe
  C:\Windows\System\HxUvkEh.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\xKbMofX.exe
  C:\Windows\System\xKbMofX.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\WAwWsny.exe
  C:\Windows\System\WAwWsny.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\KjaZDZH.exe
  C:\Windows\System\KjaZDZH.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\VPIMcPi.exe
  C:\Windows\System\VPIMcPi.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\QwlAhiC.exe
  C:\Windows\System\QwlAhiC.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fawWcsN.exe
  C:\Windows\System\fawWcsN.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\DodQcCF.exe
  C:\Windows\System\DodQcCF.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\FOxgGtb.exe
  C:\Windows\System\FOxgGtb.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\OnJTRIb.exe
  C:\Windows\System\OnJTRIb.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mpkEMqv.exe
  C:\Windows\System\mpkEMqv.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\UmOXgsQ.exe
  C:\Windows\System\UmOXgsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\lEBTzQL.exe
  C:\Windows\System\lEBTzQL.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\etIwzOu.exe
  C:\Windows\System\etIwzOu.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\BgyTNWs.exe
  C:\Windows\System\BgyTNWs.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\iWAjojQ.exe
  C:\Windows\System\iWAjojQ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\EhiNizs.exe
  C:\Windows\System\EhiNizs.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\OkAqeoF.exe
  C:\Windows\System\OkAqeoF.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\LCHcXQs.exe
  C:\Windows\System\LCHcXQs.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hgYecWZ.exe
  C:\Windows\System\hgYecWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\HvksiPf.exe
  C:\Windows\System\HvksiPf.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\LAnCWNK.exe
  C:\Windows\System\LAnCWNK.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\DaeITDY.exe
  C:\Windows\System\DaeITDY.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\vmtPyKc.exe
  C:\Windows\System\vmtPyKc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\jpzgHyH.exe
  C:\Windows\System\jpzgHyH.exe
  2⤵
  PID:2304
- C:\Windows\System\XZfEUrq.exe
  C:\Windows\System\XZfEUrq.exe
  2⤵
  PID:2936
- C:\Windows\System\GutljmY.exe
  C:\Windows\System\GutljmY.exe
  2⤵
  PID:1776
- C:\Windows\System\TUZXmKI.exe
  C:\Windows\System\TUZXmKI.exe
  2⤵
  PID:2076
- C:\Windows\System\JnyTFty.exe
  C:\Windows\System\JnyTFty.exe
  2⤵
  PID:3016
- C:\Windows\System\SkfjIVq.exe
  C:\Windows\System\SkfjIVq.exe
  2⤵
  PID:2020
- C:\Windows\System\VrzbYcQ.exe
  C:\Windows\System\VrzbYcQ.exe
  2⤵
  PID:2148
- C:\Windows\System\MKfTUMy.exe
  C:\Windows\System\MKfTUMy.exe
  2⤵
  PID:2808
- C:\Windows\System\xBPPAjj.exe
  C:\Windows\System\xBPPAjj.exe
  2⤵
  PID:2016
- C:\Windows\System\PpZzwlr.exe
  C:\Windows\System\PpZzwlr.exe
  2⤵
  PID:2328
- C:\Windows\System\yJjFNgn.exe
  C:\Windows\System\yJjFNgn.exe
  2⤵
  PID:1152
- C:\Windows\System\PnnWOBn.exe
  C:\Windows\System\PnnWOBn.exe
  2⤵
  PID:1236
- C:\Windows\System\EJkxmJE.exe
  C:\Windows\System\EJkxmJE.exe
  2⤵
  PID:2444
- C:\Windows\System\uDSDfmW.exe
  C:\Windows\System\uDSDfmW.exe
  2⤵
  PID:2340
- C:\Windows\System\IHhEQOv.exe
  C:\Windows\System\IHhEQOv.exe
  2⤵
  PID:1592
- C:\Windows\System\iriJRtz.exe
  C:\Windows\System\iriJRtz.exe
  2⤵
  PID:2012
- C:\Windows\System\JAaLTDO.exe
  C:\Windows\System\JAaLTDO.exe
  2⤵
  PID:836
- C:\Windows\System\uWFwstM.exe
  C:\Windows\System\uWFwstM.exe
  2⤵
  PID:2144
- C:\Windows\System\nOpMLTU.exe
  C:\Windows\System\nOpMLTU.exe
  2⤵
  PID:1356
- C:\Windows\System\quIOSiu.exe
  C:\Windows\System\quIOSiu.exe
  2⤵
  PID:1588
- C:\Windows\System\OdifEnY.exe
  C:\Windows\System\OdifEnY.exe
  2⤵
  PID:1508
- C:\Windows\System\DdvowUS.exe
  C:\Windows\System\DdvowUS.exe
  2⤵
  PID:2464
- C:\Windows\System\tmQPviU.exe
  C:\Windows\System\tmQPviU.exe
  2⤵
  PID:648
- C:\Windows\System\TERLtHx.exe
  C:\Windows\System\TERLtHx.exe
  2⤵
  PID:1308
- C:\Windows\System\haFnDVy.exe
  C:\Windows\System\haFnDVy.exe
  2⤵
  PID:1292
- C:\Windows\System\qHqgrVX.exe
  C:\Windows\System\qHqgrVX.exe
  2⤵
  PID:828
- C:\Windows\System\hyHCMDu.exe
  C:\Windows\System\hyHCMDu.exe
  2⤵
  PID:1964
- C:\Windows\System\VmAZgrR.exe
  C:\Windows\System\VmAZgrR.exe
  2⤵
  PID:2432
- C:\Windows\System\JNuPaGQ.exe
  C:\Windows\System\JNuPaGQ.exe
  2⤵
  PID:2940
- C:\Windows\System\qfVUoKJ.exe
  C:\Windows\System\qfVUoKJ.exe
  2⤵
  PID:2796
- C:\Windows\System\YdzMBxU.exe
  C:\Windows\System\YdzMBxU.exe
  2⤵
  PID:1580
- C:\Windows\System\IGojNvp.exe
  C:\Windows\System\IGojNvp.exe
  2⤵
  PID:2872
- C:\Windows\System\kNOPZJl.exe
  C:\Windows\System\kNOPZJl.exe
  2⤵
  PID:2880
- C:\Windows\System\fsSYOar.exe
  C:\Windows\System\fsSYOar.exe
  2⤵
  PID:2604
- C:\Windows\System\tukncFh.exe
  C:\Windows\System\tukncFh.exe
  2⤵
  PID:2612
- C:\Windows\System\MhkUreD.exe
  C:\Windows\System\MhkUreD.exe
  2⤵
  PID:572
- C:\Windows\System\pONfKtK.exe
  C:\Windows\System\pONfKtK.exe
  2⤵
  PID:2308
- C:\Windows\System\wLsCFrk.exe
  C:\Windows\System\wLsCFrk.exe
  2⤵
  PID:2600
- C:\Windows\System\AzBiUFe.exe
  C:\Windows\System\AzBiUFe.exe
  2⤵
  PID:2064
- C:\Windows\System\GqlUJlZ.exe
  C:\Windows\System\GqlUJlZ.exe
  2⤵
  PID:2068
- C:\Windows\System\VEZogDu.exe
  C:\Windows\System\VEZogDu.exe
  2⤵
  PID:2080
- C:\Windows\System\ClRZflV.exe
  C:\Windows\System\ClRZflV.exe
  2⤵
  PID:2820
- C:\Windows\System\QcSQLAu.exe
  C:\Windows\System\QcSQLAu.exe
  2⤵
  PID:2692
- C:\Windows\System\kmRtChu.exe
  C:\Windows\System\kmRtChu.exe
  2⤵
  PID:1316
- C:\Windows\System\OrNSBSa.exe
  C:\Windows\System\OrNSBSa.exe
  2⤵
  PID:3012
- C:\Windows\System\GHyztOp.exe
  C:\Windows\System\GHyztOp.exe
  2⤵
  PID:2484
- C:\Windows\System\wyGlQeg.exe
  C:\Windows\System\wyGlQeg.exe
  2⤵
  PID:2092
- C:\Windows\System\tOQsYBS.exe
  C:\Windows\System\tOQsYBS.exe
  2⤵
  PID:2216
- C:\Windows\System\gfblSbY.exe
  C:\Windows\System\gfblSbY.exe
  2⤵
  PID:2100
- C:\Windows\System\zGwrrkv.exe
  C:\Windows\System\zGwrrkv.exe
  2⤵
  PID:2496
- C:\Windows\System\nRlXpuM.exe
  C:\Windows\System\nRlXpuM.exe
  2⤵
  PID:1188
- C:\Windows\System\CLDTlFj.exe
  C:\Windows\System\CLDTlFj.exe
  2⤵
  PID:1680
- C:\Windows\System\mGoFIba.exe
  C:\Windows\System\mGoFIba.exe
  2⤵
  PID:1660
- C:\Windows\System\yGirxPo.exe
  C:\Windows\System\yGirxPo.exe
  2⤵
  PID:2980
- C:\Windows\System\iMCIomX.exe
  C:\Windows\System\iMCIomX.exe
  2⤵
  PID:688
- C:\Windows\System\XlzAOQV.exe
  C:\Windows\System\XlzAOQV.exe
  2⤵
  PID:2512
- C:\Windows\System\ByRJGTb.exe
  C:\Windows\System\ByRJGTb.exe
  2⤵
  PID:1928
- C:\Windows\System\XdIRYoo.exe
  C:\Windows\System\XdIRYoo.exe
  2⤵
  PID:2832
- C:\Windows\System\PPsddkR.exe
  C:\Windows\System\PPsddkR.exe
  2⤵
  PID:2812
- C:\Windows\System\VIjJcAX.exe
  C:\Windows\System\VIjJcAX.exe
  2⤵
  PID:2316
- C:\Windows\System\MAcgNbT.exe
  C:\Windows\System\MAcgNbT.exe
  2⤵
  PID:2896
- C:\Windows\System\cQcKbLc.exe
  C:\Windows\System\cQcKbLc.exe
  2⤵
  PID:1500
- C:\Windows\System\huCMvmZ.exe
  C:\Windows\System\huCMvmZ.exe
  2⤵
  PID:2944
- C:\Windows\System\IseDHIU.exe
  C:\Windows\System\IseDHIU.exe
  2⤵
  PID:1604
- C:\Windows\System\poqlxvg.exe
  C:\Windows\System\poqlxvg.exe
  2⤵
  PID:2296
- C:\Windows\System\yKGRitd.exe
  C:\Windows\System\yKGRitd.exe
  2⤵
  PID:2576
- C:\Windows\System\uWAdCDx.exe
  C:\Windows\System\uWAdCDx.exe
  2⤵
  PID:2984
- C:\Windows\System\uNyJwDk.exe
  C:\Windows\System\uNyJwDk.exe
  2⤵
  PID:2768
- C:\Windows\System\HboDyXe.exe
  C:\Windows\System\HboDyXe.exe
  2⤵
  PID:2960
- C:\Windows\System\RwXBAJv.exe
  C:\Windows\System\RwXBAJv.exe
  2⤵
  PID:1432
- C:\Windows\System\KKJJKYg.exe
  C:\Windows\System\KKJJKYg.exe
  2⤵
  PID:336
- C:\Windows\System\aMmDGYq.exe
  C:\Windows\System\aMmDGYq.exe
  2⤵
  PID:1484
- C:\Windows\System\eMznILH.exe
  C:\Windows\System\eMznILH.exe
  2⤵
  PID:2292
- C:\Windows\System\cqeAcmu.exe
  C:\Windows\System\cqeAcmu.exe
  2⤵
  PID:680
- C:\Windows\System\UCRbtMQ.exe
  C:\Windows\System\UCRbtMQ.exe
  2⤵
  PID:1956
- C:\Windows\System\gCJhkHe.exe
  C:\Windows\System\gCJhkHe.exe
  2⤵
  PID:2260
- C:\Windows\System\jgMxhkH.exe
  C:\Windows\System\jgMxhkH.exe
  2⤵
  PID:860
- C:\Windows\System\qvOEjnl.exe
  C:\Windows\System\qvOEjnl.exe
  2⤵
  PID:2716
- C:\Windows\System\uSjYuUw.exe
  C:\Windows\System\uSjYuUw.exe
  2⤵
  PID:2272
- C:\Windows\System\ETdthZx.exe
  C:\Windows\System\ETdthZx.exe
  2⤵
  PID:2852
- C:\Windows\System\lblSZUq.exe
  C:\Windows\System\lblSZUq.exe
  2⤵
  PID:2616
- C:\Windows\System\AUayBNc.exe
  C:\Windows\System\AUayBNc.exe
  2⤵
  PID:1644
- C:\Windows\System\xBUQCbU.exe
  C:\Windows\System\xBUQCbU.exe
  2⤵
  PID:2620
- C:\Windows\System\chzHBFz.exe
  C:\Windows\System\chzHBFz.exe
  2⤵
  PID:2128
- C:\Windows\System\fohAOYY.exe
  C:\Windows\System\fohAOYY.exe
  2⤵
  PID:3004
- C:\Windows\System\zZuNDcR.exe
  C:\Windows\System\zZuNDcR.exe
  2⤵
  PID:3040
- C:\Windows\System\MCELWPs.exe
  C:\Windows\System\MCELWPs.exe
  2⤵
  PID:764
- C:\Windows\System\iOCmFMm.exe
  C:\Windows\System\iOCmFMm.exe
  2⤵
  PID:2320
- C:\Windows\System\wrGeHrl.exe
  C:\Windows\System\wrGeHrl.exe
  2⤵
  PID:2912
- C:\Windows\System\vGHPBzI.exe
  C:\Windows\System\vGHPBzI.exe
  2⤵
  PID:1896
- C:\Windows\System\EVrSflN.exe
  C:\Windows\System\EVrSflN.exe
  2⤵
  PID:3064
- C:\Windows\System\YyuSQaj.exe
  C:\Windows\System\YyuSQaj.exe
  2⤵
  PID:948
- C:\Windows\System\EEUdoGb.exe
  C:\Windows\System\EEUdoGb.exe
  2⤵
  PID:2332
- C:\Windows\System\tUFYctv.exe
  C:\Windows\System\tUFYctv.exe
  2⤵
  PID:2500
- C:\Windows\System\vDtgvLn.exe
  C:\Windows\System\vDtgvLn.exe
  2⤵
  PID:880
- C:\Windows\System\NdUoeAq.exe
  C:\Windows\System\NdUoeAq.exe
  2⤵
  PID:2784
- C:\Windows\System\nOewEZh.exe
  C:\Windows\System\nOewEZh.exe
  2⤵
  PID:2344
- C:\Windows\System\vwXOvxV.exe
  C:\Windows\System\vwXOvxV.exe
  2⤵
  PID:2176
- C:\Windows\System\XSRFuqp.exe
  C:\Windows\System\XSRFuqp.exe
  2⤵
  PID:2972
- C:\Windows\System\YoSruyu.exe
  C:\Windows\System\YoSruyu.exe
  2⤵
  PID:1528
- C:\Windows\System\zzPrGMg.exe
  C:\Windows\System\zzPrGMg.exe
  2⤵
  PID:2968
- C:\Windows\System\DpAJiyP.exe
  C:\Windows\System\DpAJiyP.exe
  2⤵
  PID:2904
- C:\Windows\System\AHHnOWP.exe
  C:\Windows\System\AHHnOWP.exe
  2⤵
  PID:112
- C:\Windows\System\XXKepxZ.exe
  C:\Windows\System\XXKepxZ.exe
  2⤵
  PID:1904
- C:\Windows\System\ohZHvgW.exe
  C:\Windows\System\ohZHvgW.exe
  2⤵
  PID:1296
- C:\Windows\System\yjuBDnp.exe
  C:\Windows\System\yjuBDnp.exe
  2⤵
  PID:2476
- C:\Windows\System\yqfKnKs.exe
  C:\Windows\System\yqfKnKs.exe
  2⤵
  PID:748
- C:\Windows\System\LBbLgkt.exe
  C:\Windows\System\LBbLgkt.exe
  2⤵
  PID:1616
- C:\Windows\System\WlzYDSb.exe
  C:\Windows\System\WlzYDSb.exe
  2⤵
  PID:1784
- C:\Windows\System\NDlXJNM.exe
  C:\Windows\System\NDlXJNM.exe
  2⤵
  PID:2460
- C:\Windows\System\SqpZwvv.exe
  C:\Windows\System\SqpZwvv.exe
  2⤵
  PID:3076
- C:\Windows\System\vQwABUU.exe
  C:\Windows\System\vQwABUU.exe
  2⤵
  PID:3092
- C:\Windows\System\koXsdwa.exe
  C:\Windows\System\koXsdwa.exe
  2⤵
  PID:3108
- C:\Windows\System\rfPEKse.exe
  C:\Windows\System\rfPEKse.exe
  2⤵
  PID:3124
- C:\Windows\System\HLHtbeW.exe
  C:\Windows\System\HLHtbeW.exe
  2⤵
  PID:3140
- C:\Windows\System\dsrKuoy.exe
  C:\Windows\System\dsrKuoy.exe
  2⤵
  PID:3156
- C:\Windows\System\rbUJCHj.exe
  C:\Windows\System\rbUJCHj.exe
  2⤵
  PID:3220
- C:\Windows\System\zNbsGqV.exe
  C:\Windows\System\zNbsGqV.exe
  2⤵
  PID:3260
- C:\Windows\System\YwlIbVr.exe
  C:\Windows\System\YwlIbVr.exe
  2⤵
  PID:3276
- C:\Windows\System\feKQtBt.exe
  C:\Windows\System\feKQtBt.exe
  2⤵
  PID:3292
- C:\Windows\System\fDpeayv.exe
  C:\Windows\System\fDpeayv.exe
  2⤵
  PID:3312
- C:\Windows\System\MdlITpS.exe
  C:\Windows\System\MdlITpS.exe
  2⤵
  PID:3328
- C:\Windows\System\RvRyYQV.exe
  C:\Windows\System\RvRyYQV.exe
  2⤵
  PID:3344
- C:\Windows\System\vwJlvdZ.exe
  C:\Windows\System\vwJlvdZ.exe
  2⤵
  PID:3360
- C:\Windows\System\QXvoOAp.exe
  C:\Windows\System\QXvoOAp.exe
  2⤵
  PID:3376
- C:\Windows\System\VCgpLXS.exe
  C:\Windows\System\VCgpLXS.exe
  2⤵
  PID:3392
- C:\Windows\System\xPJCSDa.exe
  C:\Windows\System\xPJCSDa.exe
  2⤵
  PID:3424
- C:\Windows\System\kJyYyPG.exe
  C:\Windows\System\kJyYyPG.exe
  2⤵
  PID:3448
- C:\Windows\System\JwYYyXG.exe
  C:\Windows\System\JwYYyXG.exe
  2⤵
  PID:3464
- C:\Windows\System\DSehxZu.exe
  C:\Windows\System\DSehxZu.exe
  2⤵
  PID:3480
- C:\Windows\System\KpEpyhk.exe
  C:\Windows\System\KpEpyhk.exe
  2⤵
  PID:3496
- C:\Windows\System\qONdoqx.exe
  C:\Windows\System\qONdoqx.exe
  2⤵
  PID:3512
- C:\Windows\System\dlOrjpo.exe
  C:\Windows\System\dlOrjpo.exe
  2⤵
  PID:3528
- C:\Windows\System\qVsOmLQ.exe
  C:\Windows\System\qVsOmLQ.exe
  2⤵
  PID:3548
- C:\Windows\System\JOyJHrp.exe
  C:\Windows\System\JOyJHrp.exe
  2⤵
  PID:3564
- C:\Windows\System\McdLtEd.exe
  C:\Windows\System\McdLtEd.exe
  2⤵
  PID:3580
- C:\Windows\System\oFaVyCv.exe
  C:\Windows\System\oFaVyCv.exe
  2⤵
  PID:3600
- C:\Windows\System\rFAfQqX.exe
  C:\Windows\System\rFAfQqX.exe
  2⤵
  PID:3620
- C:\Windows\System\NZqACcj.exe
  C:\Windows\System\NZqACcj.exe
  2⤵
  PID:3640
- C:\Windows\System\iWSByPZ.exe
  C:\Windows\System\iWSByPZ.exe
  2⤵
  PID:3656
- C:\Windows\System\YGDdaoc.exe
  C:\Windows\System\YGDdaoc.exe
  2⤵
  PID:3672
- C:\Windows\System\YcUfSQI.exe
  C:\Windows\System\YcUfSQI.exe
  2⤵
  PID:3696
- C:\Windows\System\QgbRazu.exe
  C:\Windows\System\QgbRazu.exe
  2⤵
  PID:3720
- C:\Windows\System\lpsYujR.exe
  C:\Windows\System\lpsYujR.exe
  2⤵
  PID:3744
- C:\Windows\System\SvBVOlB.exe
  C:\Windows\System\SvBVOlB.exe
  2⤵
  PID:3760
- C:\Windows\System\akPMmOJ.exe
  C:\Windows\System\akPMmOJ.exe
  2⤵
  PID:3776
- C:\Windows\System\HbQoDMK.exe
  C:\Windows\System\HbQoDMK.exe
  2⤵
  PID:3792
- C:\Windows\System\TMoikHI.exe
  C:\Windows\System\TMoikHI.exe
  2⤵
  PID:3808
- C:\Windows\System\nykJZHi.exe
  C:\Windows\System\nykJZHi.exe
  2⤵
  PID:3824
- C:\Windows\System\xSwulDw.exe
  C:\Windows\System\xSwulDw.exe
  2⤵
  PID:3840
- C:\Windows\System\UzVNQoP.exe
  C:\Windows\System\UzVNQoP.exe
  2⤵
  PID:3856
- C:\Windows\System\HDMQqSY.exe
  C:\Windows\System\HDMQqSY.exe
  2⤵
  PID:3872
- C:\Windows\System\ophSrfN.exe
  C:\Windows\System\ophSrfN.exe
  2⤵
  PID:3892
- C:\Windows\System\fPkxdei.exe
  C:\Windows\System\fPkxdei.exe
  2⤵
  PID:3908
- C:\Windows\System\GOoLncx.exe
  C:\Windows\System\GOoLncx.exe
  2⤵
  PID:3928
- C:\Windows\System\MnnRiIJ.exe
  C:\Windows\System\MnnRiIJ.exe
  2⤵
  PID:3944
- C:\Windows\System\BfWaPXx.exe
  C:\Windows\System\BfWaPXx.exe
  2⤵
  PID:3960
- C:\Windows\System\RyAtwDR.exe
  C:\Windows\System\RyAtwDR.exe
  2⤵
  PID:3976
- C:\Windows\System\vGljHHL.exe
  C:\Windows\System\vGljHHL.exe
  2⤵
  PID:3992
- C:\Windows\System\lMModlx.exe
  C:\Windows\System\lMModlx.exe
  2⤵
  PID:4008
- C:\Windows\System\rwMEfwJ.exe
  C:\Windows\System\rwMEfwJ.exe
  2⤵
  PID:4028
- C:\Windows\System\LUxANNK.exe
  C:\Windows\System\LUxANNK.exe
  2⤵
  PID:4044
- C:\Windows\System\kwnDIEf.exe
  C:\Windows\System\kwnDIEf.exe
  2⤵
  PID:4060
- C:\Windows\System\kkjntBd.exe
  C:\Windows\System\kkjntBd.exe
  2⤵
  PID:4076
- C:\Windows\System\IKpTgFL.exe
  C:\Windows\System\IKpTgFL.exe
  2⤵
  PID:4092
- C:\Windows\System\wQHbGPL.exe
  C:\Windows\System\wQHbGPL.exe
  2⤵
  PID:2632
- C:\Windows\System\ZrPuaeT.exe
  C:\Windows\System\ZrPuaeT.exe
  2⤵
  PID:3100
- C:\Windows\System\KGzovGq.exe
  C:\Windows\System\KGzovGq.exe
  2⤵
  PID:3164
- C:\Windows\System\xijgZQr.exe
  C:\Windows\System\xijgZQr.exe
  2⤵
  PID:2848
- C:\Windows\System\hkcUDSL.exe
  C:\Windows\System\hkcUDSL.exe
  2⤵
  PID:3024
- C:\Windows\System\OTdLAVw.exe
  C:\Windows\System\OTdLAVw.exe
  2⤵
  PID:3116
- C:\Windows\System\kxCXCdM.exe
  C:\Windows\System\kxCXCdM.exe
  2⤵
  PID:2828
- C:\Windows\System\FqRuLyT.exe
  C:\Windows\System\FqRuLyT.exe
  2⤵
  PID:3244
- C:\Windows\System\tMiQkrz.exe
  C:\Windows\System\tMiQkrz.exe
  2⤵
  PID:3304
- C:\Windows\System\pjaHqCX.exe
  C:\Windows\System\pjaHqCX.exe
  2⤵
  PID:3368
- C:\Windows\System\vYnrHrh.exe
  C:\Windows\System\vYnrHrh.exe
  2⤵
  PID:3408
- C:\Windows\System\eOFprTE.exe
  C:\Windows\System\eOFprTE.exe
  2⤵
  PID:3456
- C:\Windows\System\CbaTGdv.exe
  C:\Windows\System\CbaTGdv.exe
  2⤵
  PID:3252
- C:\Windows\System\fwgLujA.exe
  C:\Windows\System\fwgLujA.exe
  2⤵
  PID:3320
- C:\Windows\System\wCVJStd.exe
  C:\Windows\System\wCVJStd.exe
  2⤵
  PID:3388
- C:\Windows\System\PafClvK.exe
  C:\Windows\System\PafClvK.exe
  2⤵
  PID:3560
- C:\Windows\System\NElTyoq.exe
  C:\Windows\System\NElTyoq.exe
  2⤵
  PID:3432
- C:\Windows\System\LKNNIXO.exe
  C:\Windows\System\LKNNIXO.exe
  2⤵
  PID:3628
- C:\Windows\System\uSusVTL.exe
  C:\Windows\System\uSusVTL.exe
  2⤵
  PID:3356
- C:\Windows\System\JBbtNAm.exe
  C:\Windows\System\JBbtNAm.exe
  2⤵
  PID:3536
- C:\Windows\System\IjSKjSZ.exe
  C:\Windows\System\IjSKjSZ.exe
  2⤵
  PID:3576
- C:\Windows\System\KqVqJBK.exe
  C:\Windows\System\KqVqJBK.exe
  2⤵
  PID:3648
- C:\Windows\System\mSZDFEP.exe
  C:\Windows\System\mSZDFEP.exe
  2⤵
  PID:3664
- C:\Windows\System\TUzwUha.exe
  C:\Windows\System\TUzwUha.exe
  2⤵
  PID:3712
- C:\Windows\System\QEehTWk.exe
  C:\Windows\System\QEehTWk.exe
  2⤵
  PID:3732
- C:\Windows\System\VsOlMTM.exe
  C:\Windows\System\VsOlMTM.exe
  2⤵
  PID:3784
- C:\Windows\System\LRzwxrP.exe
  C:\Windows\System\LRzwxrP.exe
  2⤵
  PID:3848
- C:\Windows\System\ecDUuVA.exe
  C:\Windows\System\ecDUuVA.exe
  2⤵
  PID:3888
- C:\Windows\System\EFZIuFJ.exe
  C:\Windows\System\EFZIuFJ.exe
  2⤵
  PID:3952
- C:\Windows\System\JDbBgLa.exe
  C:\Windows\System\JDbBgLa.exe
  2⤵
  PID:3972
- C:\Windows\System\XobGUwq.exe
  C:\Windows\System\XobGUwq.exe
  2⤵
  PID:4024
- C:\Windows\System\JGUaCIV.exe
  C:\Windows\System\JGUaCIV.exe
  2⤵
  PID:4088
- C:\Windows\System\HOgYArO.exe
  C:\Windows\System\HOgYArO.exe
  2⤵
  PID:3184
- C:\Windows\System\kWhCPoy.exe
  C:\Windows\System\kWhCPoy.exe
  2⤵
  PID:3240
- C:\Windows\System\lmAvNpp.exe
  C:\Windows\System\lmAvNpp.exe
  2⤵
  PID:3416
- C:\Windows\System\XuDRcrg.exe
  C:\Windows\System\XuDRcrg.exe
  2⤵
  PID:3520
- C:\Windows\System\WHCLBET.exe
  C:\Windows\System\WHCLBET.exe
  2⤵
  PID:3444
- C:\Windows\System\NoIVrdA.exe
  C:\Windows\System\NoIVrdA.exe
  2⤵
  PID:3488
- C:\Windows\System\NiUXzqA.exe
  C:\Windows\System\NiUXzqA.exe
  2⤵
  PID:3476
- C:\Windows\System\ROnEMMr.exe
  C:\Windows\System\ROnEMMr.exe
  2⤵
  PID:3752
- C:\Windows\System\DxIDNGE.exe
  C:\Windows\System\DxIDNGE.exe
  2⤵
  PID:3880
- C:\Windows\System\cAWsvyb.exe
  C:\Windows\System\cAWsvyb.exe
  2⤵
  PID:3300
- C:\Windows\System\lHAHRBS.exe
  C:\Windows\System\lHAHRBS.exe
  2⤵
  PID:2488
- C:\Windows\System\YvMLBkJ.exe
  C:\Windows\System\YvMLBkJ.exe
  2⤵
  PID:3152
- C:\Windows\System\PoFKZbt.exe
  C:\Windows\System\PoFKZbt.exe
  2⤵
  PID:3384
- C:\Windows\System\jzYoZFy.exe
  C:\Windows\System\jzYoZFy.exe
  2⤵
  PID:3572
- C:\Windows\System\IMDrZIp.exe
  C:\Windows\System\IMDrZIp.exe
  2⤵
  PID:3820
- C:\Windows\System\eucBUFS.exe
  C:\Windows\System\eucBUFS.exe
  2⤵
  PID:3900
- C:\Windows\System\cjDmfAo.exe
  C:\Windows\System\cjDmfAo.exe
  2⤵
  PID:3736
- C:\Windows\System\ChVRNfD.exe
  C:\Windows\System\ChVRNfD.exe
  2⤵
  PID:3740
- C:\Windows\System\gSFhNUh.exe
  C:\Windows\System\gSFhNUh.exe
  2⤵
  PID:3868
- C:\Windows\System\ijPwNyU.exe
  C:\Windows\System\ijPwNyU.exe
  2⤵
  PID:4056
- C:\Windows\System\uiJgiav.exe
  C:\Windows\System\uiJgiav.exe
  2⤵
  PID:3088
- C:\Windows\System\SChacHM.exe
  C:\Windows\System\SChacHM.exe
  2⤵
  PID:4004
- C:\Windows\System\VsOCAEf.exe
  C:\Windows\System\VsOCAEf.exe
  2⤵
  PID:3180
- C:\Windows\System\KUXwHBM.exe
  C:\Windows\System\KUXwHBM.exe
  2⤵
  PID:3404
- C:\Windows\System\usJYnoE.exe
  C:\Windows\System\usJYnoE.exe
  2⤵
  PID:3148
- C:\Windows\System\EVvXTKS.exe
  C:\Windows\System\EVvXTKS.exe
  2⤵
  PID:1684
- C:\Windows\System\vxJUREn.exe
  C:\Windows\System\vxJUREn.exe
  2⤵
  PID:3684
- C:\Windows\System\ljVhFWQ.exe
  C:\Windows\System\ljVhFWQ.exe
  2⤵
  PID:4072
- C:\Windows\System\ZWOycdk.exe
  C:\Windows\System\ZWOycdk.exe
  2⤵
  PID:3988
- C:\Windows\System\ZxhkYHA.exe
  C:\Windows\System\ZxhkYHA.exe
  2⤵
  PID:3816
- C:\Windows\System\mUBNKXo.exe
  C:\Windows\System\mUBNKXo.exe
  2⤵
  PID:4036
- C:\Windows\System\IwYqEGl.exe
  C:\Windows\System\IwYqEGl.exe
  2⤵
  PID:2672
- C:\Windows\System\ufABBny.exe
  C:\Windows\System\ufABBny.exe
  2⤵
  PID:3284
- C:\Windows\System\bYdeyxc.exe
  C:\Windows\System\bYdeyxc.exe
  2⤵
  PID:3708
- C:\Windows\System\RMsCqfS.exe
  C:\Windows\System\RMsCqfS.exe
  2⤵
  PID:3692
- C:\Windows\System\ObnmqzU.exe
  C:\Windows\System\ObnmqzU.exe
  2⤵
  PID:4068
- C:\Windows\System\fDeLVin.exe
  C:\Windows\System\fDeLVin.exe
  2⤵
  PID:3544
- C:\Windows\System\WXjPvVS.exe
  C:\Windows\System\WXjPvVS.exe
  2⤵
  PID:3936
- C:\Windows\System\eaDAKBM.exe
  C:\Windows\System\eaDAKBM.exe
  2⤵
  PID:4104
- C:\Windows\System\faGDfHp.exe
  C:\Windows\System\faGDfHp.exe
  2⤵
  PID:4120
- C:\Windows\System\epuoRzK.exe
  C:\Windows\System\epuoRzK.exe
  2⤵
  PID:4136
- C:\Windows\System\pduvYPe.exe
  C:\Windows\System\pduvYPe.exe
  2⤵
  PID:4152
- C:\Windows\System\PqjmSXs.exe
  C:\Windows\System\PqjmSXs.exe
  2⤵
  PID:4168
- C:\Windows\System\QtRHVpu.exe
  C:\Windows\System\QtRHVpu.exe
  2⤵
  PID:4184
- C:\Windows\System\MeWTrXt.exe
  C:\Windows\System\MeWTrXt.exe
  2⤵
  PID:4200
- C:\Windows\System\pImEuhT.exe
  C:\Windows\System\pImEuhT.exe
  2⤵
  PID:4216
- C:\Windows\System\RgdvJJQ.exe
  C:\Windows\System\RgdvJJQ.exe
  2⤵
  PID:4232
- C:\Windows\System\SLDiSdL.exe
  C:\Windows\System\SLDiSdL.exe
  2⤵
  PID:4248
- C:\Windows\System\lctPNdk.exe
  C:\Windows\System\lctPNdk.exe
  2⤵
  PID:4264
- C:\Windows\System\TUcLVXq.exe
  C:\Windows\System\TUcLVXq.exe
  2⤵
  PID:4280
- C:\Windows\System\cddfuFH.exe
  C:\Windows\System\cddfuFH.exe
  2⤵
  PID:4296
- C:\Windows\System\RkoaTsW.exe
  C:\Windows\System\RkoaTsW.exe
  2⤵
  PID:4316
- C:\Windows\System\jwEBYcD.exe
  C:\Windows\System\jwEBYcD.exe
  2⤵
  PID:4332
- C:\Windows\System\GXiduzK.exe
  C:\Windows\System\GXiduzK.exe
  2⤵
  PID:4348
- C:\Windows\System\aLnOeat.exe
  C:\Windows\System\aLnOeat.exe
  2⤵
  PID:4364
- C:\Windows\System\RpTXuLw.exe
  C:\Windows\System\RpTXuLw.exe
  2⤵
  PID:4380
- C:\Windows\System\remuNMD.exe
  C:\Windows\System\remuNMD.exe
  2⤵
  PID:4400
- C:\Windows\System\PKOmFVB.exe
  C:\Windows\System\PKOmFVB.exe
  2⤵
  PID:4416
- C:\Windows\System\prvodrN.exe
  C:\Windows\System\prvodrN.exe
  2⤵
  PID:4432
- C:\Windows\System\QhtySSm.exe
  C:\Windows\System\QhtySSm.exe
  2⤵
  PID:4452
- C:\Windows\System\QmUMPuy.exe
  C:\Windows\System\QmUMPuy.exe
  2⤵
  PID:4468
- C:\Windows\System\TPPgyCe.exe
  C:\Windows\System\TPPgyCe.exe
  2⤵
  PID:4484
- C:\Windows\System\lnyhztH.exe
  C:\Windows\System\lnyhztH.exe
  2⤵
  PID:4500
- C:\Windows\System\FNfxmfP.exe
  C:\Windows\System\FNfxmfP.exe
  2⤵
  PID:4516
- C:\Windows\System\uwKbcPD.exe
  C:\Windows\System\uwKbcPD.exe
  2⤵
  PID:4532
- C:\Windows\System\ErutzML.exe
  C:\Windows\System\ErutzML.exe
  2⤵
  PID:4548
- C:\Windows\System\JQIbqzI.exe
  C:\Windows\System\JQIbqzI.exe
  2⤵
  PID:4564
- C:\Windows\System\nMSiJfV.exe
  C:\Windows\System\nMSiJfV.exe
  2⤵
  PID:4580
- C:\Windows\System\nThaIKo.exe
  C:\Windows\System\nThaIKo.exe
  2⤵
  PID:4596
- C:\Windows\System\QFyuKzv.exe
  C:\Windows\System\QFyuKzv.exe
  2⤵
  PID:4612
- C:\Windows\System\FjNrzLn.exe
  C:\Windows\System\FjNrzLn.exe
  2⤵
  PID:4628
- C:\Windows\System\tVPXbmk.exe
  C:\Windows\System\tVPXbmk.exe
  2⤵
  PID:4644
- C:\Windows\System\XeXxOYH.exe
  C:\Windows\System\XeXxOYH.exe
  2⤵
  PID:4660
- C:\Windows\System\FbrQmDt.exe
  C:\Windows\System\FbrQmDt.exe
  2⤵
  PID:4680
- C:\Windows\System\sPgaFvj.exe
  C:\Windows\System\sPgaFvj.exe
  2⤵
  PID:4696
- C:\Windows\System\rYOegRF.exe
  C:\Windows\System\rYOegRF.exe
  2⤵
  PID:4712
- C:\Windows\System\iSqbxxv.exe
  C:\Windows\System\iSqbxxv.exe
  2⤵
  PID:4728
- C:\Windows\System\rSPjvPZ.exe
  C:\Windows\System\rSPjvPZ.exe
  2⤵
  PID:4744
- C:\Windows\System\JZAtOIi.exe
  C:\Windows\System\JZAtOIi.exe
  2⤵
  PID:4760
- C:\Windows\System\lljZiBc.exe
  C:\Windows\System\lljZiBc.exe
  2⤵
  PID:4776
- C:\Windows\System\ApEnzUX.exe
  C:\Windows\System\ApEnzUX.exe
  2⤵
  PID:4792
- C:\Windows\System\BraDVwb.exe
  C:\Windows\System\BraDVwb.exe
  2⤵
  PID:4808
- C:\Windows\System\MYCfEHs.exe
  C:\Windows\System\MYCfEHs.exe
  2⤵
  PID:4824
- C:\Windows\System\IWesngc.exe
  C:\Windows\System\IWesngc.exe
  2⤵
  PID:4840
- C:\Windows\System\RECZvKO.exe
  C:\Windows\System\RECZvKO.exe
  2⤵
  PID:4856
- C:\Windows\System\ihOivfx.exe
  C:\Windows\System\ihOivfx.exe
  2⤵
  PID:4872
- C:\Windows\System\sTTQxLh.exe
  C:\Windows\System\sTTQxLh.exe
  2⤵
  PID:4888
- C:\Windows\System\NXpZRry.exe
  C:\Windows\System\NXpZRry.exe
  2⤵
  PID:4904
- C:\Windows\System\UTUUpXG.exe
  C:\Windows\System\UTUUpXG.exe
  2⤵
  PID:4920
- C:\Windows\System\qFjJKwu.exe
  C:\Windows\System\qFjJKwu.exe
  2⤵
  PID:4940
- C:\Windows\System\tUVHquW.exe
  C:\Windows\System\tUVHquW.exe
  2⤵
  PID:4956
- C:\Windows\System\riLDZul.exe
  C:\Windows\System\riLDZul.exe
  2⤵
  PID:4972
- C:\Windows\System\fjbTMCQ.exe
  C:\Windows\System\fjbTMCQ.exe
  2⤵
  PID:4992
- C:\Windows\System\IFGlNmT.exe
  C:\Windows\System\IFGlNmT.exe
  2⤵
  PID:5008
- C:\Windows\System\BhCNnDb.exe
  C:\Windows\System\BhCNnDb.exe
  2⤵
  PID:5024
- C:\Windows\System\wdikYzo.exe
  C:\Windows\System\wdikYzo.exe
  2⤵
  PID:5040
- C:\Windows\System\hQXmjCy.exe
  C:\Windows\System\hQXmjCy.exe
  2⤵
  PID:5056
- C:\Windows\System\ChFoNql.exe
  C:\Windows\System\ChFoNql.exe
  2⤵
  PID:5080
- C:\Windows\System\aBeLORP.exe
  C:\Windows\System\aBeLORP.exe
  2⤵
  PID:5096
- C:\Windows\System\RVlmroQ.exe
  C:\Windows\System\RVlmroQ.exe
  2⤵
  PID:5112
- C:\Windows\System\Mdxuwzq.exe
  C:\Windows\System\Mdxuwzq.exe
  2⤵
  PID:3836
- C:\Windows\System\FNdQuxH.exe
  C:\Windows\System\FNdQuxH.exe
  2⤵
  PID:4116
- C:\Windows\System\obXeKYr.exe
  C:\Windows\System\obXeKYr.exe
  2⤵
  PID:4180
- C:\Windows\System\tcEEhgW.exe
  C:\Windows\System\tcEEhgW.exe
  2⤵
  PID:4244
- C:\Windows\System\ZrPMKZG.exe
  C:\Windows\System\ZrPMKZG.exe
  2⤵
  PID:4196
- C:\Windows\System\Tnkkooq.exe
  C:\Windows\System\Tnkkooq.exe
  2⤵
  PID:4160
- C:\Windows\System\agmkGkp.exe
  C:\Windows\System\agmkGkp.exe
  2⤵
  PID:3864
- C:\Windows\System\sRnPtGU.exe
  C:\Windows\System\sRnPtGU.exe
  2⤵
  PID:4260
- C:\Windows\System\WLlCiFi.exe
  C:\Windows\System\WLlCiFi.exe
  2⤵
  PID:4304
- C:\Windows\System\KKgJYgY.exe
  C:\Windows\System\KKgJYgY.exe
  2⤵
  PID:4344
- C:\Windows\System\wXHeQoH.exe
  C:\Windows\System\wXHeQoH.exe
  2⤵
  PID:4412
- C:\Windows\System\AsahjeC.exe
  C:\Windows\System\AsahjeC.exe
  2⤵
  PID:4360
- C:\Windows\System\toYdbYq.exe
  C:\Windows\System\toYdbYq.exe
  2⤵
  PID:4424
- C:\Windows\System\YyhbNyq.exe
  C:\Windows\System\YyhbNyq.exe
  2⤵
  PID:4396
- C:\Windows\System\CGYvsdt.exe
  C:\Windows\System\CGYvsdt.exe
  2⤵
  PID:4388
- C:\Windows\System\PDLhBTe.exe
  C:\Windows\System\PDLhBTe.exe
  2⤵
  PID:4492
- C:\Windows\System\xHZSvvj.exe
  C:\Windows\System\xHZSvvj.exe
  2⤵
  PID:4528
- C:\Windows\System\OnkIllQ.exe
  C:\Windows\System\OnkIllQ.exe
  2⤵
  PID:4524
- C:\Windows\System\zCLzjWo.exe
  C:\Windows\System\zCLzjWo.exe
  2⤵
  PID:4640
- C:\Windows\System\CbueSWt.exe
  C:\Windows\System\CbueSWt.exe
  2⤵
  PID:4676
- C:\Windows\System\wRYGjAF.exe
  C:\Windows\System\wRYGjAF.exe
  2⤵
  PID:4708
- C:\Windows\System\xQvhGCL.exe
  C:\Windows\System\xQvhGCL.exe
  2⤵
  PID:4768
- C:\Windows\System\jMMDvQW.exe
  C:\Windows\System\jMMDvQW.exe
  2⤵
  PID:4804
- C:\Windows\System\zztRktU.exe
  C:\Windows\System\zztRktU.exe
  2⤵
  PID:4752
- C:\Windows\System\sqgjmjy.exe
  C:\Windows\System\sqgjmjy.exe
  2⤵
  PID:4832
- C:\Windows\System\seXvquY.exe
  C:\Windows\System\seXvquY.exe
  2⤵
  PID:4896
- C:\Windows\System\pOIthsU.exe
  C:\Windows\System\pOIthsU.exe
  2⤵
  PID:4936
- C:\Windows\System\wTiobrI.exe
  C:\Windows\System\wTiobrI.exe
  2⤵
  PID:4820
- C:\Windows\System\BSOlold.exe
  C:\Windows\System\BSOlold.exe
  2⤵
  PID:5004
- C:\Windows\System\SdauyDH.exe
  C:\Windows\System\SdauyDH.exe
  2⤵
  PID:5020
- C:\Windows\System\gMXCQFo.exe
  C:\Windows\System\gMXCQFo.exe
  2⤵
  PID:2700
- C:\Windows\System\JSHlhqu.exe
  C:\Windows\System\JSHlhqu.exe
  2⤵
  PID:4100
- C:\Windows\System\sObMLEA.exe
  C:\Windows\System\sObMLEA.exe
  2⤵
  PID:4440
- C:\Windows\System\fcAqGZR.exe
  C:\Windows\System\fcAqGZR.exe
  2⤵
  PID:4460
- C:\Windows\System\flvZWDH.exe
  C:\Windows\System\flvZWDH.exe
  2⤵
  PID:4608
- C:\Windows\System\gmLeAbj.exe
  C:\Windows\System\gmLeAbj.exe
  2⤵
  PID:4376
- C:\Windows\System\oRfVTwX.exe
  C:\Windows\System\oRfVTwX.exe
  2⤵
  PID:4508
- C:\Windows\System\HUBWIiW.exe
  C:\Windows\System\HUBWIiW.exe
  2⤵
  PID:4624
- C:\Windows\System\HtroGeJ.exe
  C:\Windows\System\HtroGeJ.exe
  2⤵
  PID:4740
- C:\Windows\System\TilDLFm.exe
  C:\Windows\System\TilDLFm.exe
  2⤵
  PID:3228
- C:\Windows\System\RjTESrX.exe
  C:\Windows\System\RjTESrX.exe
  2⤵
  PID:4688
- C:\Windows\System\mjbSDWh.exe
  C:\Windows\System\mjbSDWh.exe
  2⤵
  PID:4928
- C:\Windows\System\APbVSWr.exe
  C:\Windows\System\APbVSWr.exe
  2⤵
  PID:5036
- C:\Windows\System\bzjUQtk.exe
  C:\Windows\System\bzjUQtk.exe
  2⤵
  PID:5016
- C:\Windows\System\BEApDrb.exe
  C:\Windows\System\BEApDrb.exe
  2⤵
  PID:4952
- C:\Windows\System\pKeCxcv.exe
  C:\Windows\System\pKeCxcv.exe
  2⤵
  PID:4980
- C:\Windows\System\nxYwxOO.exe
  C:\Windows\System\nxYwxOO.exe
  2⤵
  PID:4228
- C:\Windows\System\QGIdIUU.exe
  C:\Windows\System\QGIdIUU.exe
  2⤵
  PID:4984
- C:\Windows\System\bNvvKjP.exe
  C:\Windows\System\bNvvKjP.exe
  2⤵
  PID:4164
- C:\Windows\System\ySXVOMw.exe
  C:\Windows\System\ySXVOMw.exe
  2⤵
  PID:1568
- C:\Windows\System\npXUhhw.exe
  C:\Windows\System\npXUhhw.exe
  2⤵
  PID:4356
- C:\Windows\System\EtPmnWS.exe
  C:\Windows\System\EtPmnWS.exe
  2⤵
  PID:4592
- C:\Windows\System\rupKboA.exe
  C:\Windows\System\rupKboA.exe
  2⤵
  PID:4588
- C:\Windows\System\heJhIYR.exe
  C:\Windows\System\heJhIYR.exe
  2⤵
  PID:4868
- C:\Windows\System\qbaDUxU.exe
  C:\Windows\System\qbaDUxU.exe
  2⤵
  PID:4912
- C:\Windows\System\TyMvlsB.exe
  C:\Windows\System\TyMvlsB.exe
  2⤵
  PID:4948
- C:\Windows\System\faFLhcT.exe
  C:\Windows\System\faFLhcT.exe
  2⤵
  PID:4540
- C:\Windows\System\TTcuEiU.exe
  C:\Windows\System\TTcuEiU.exe
  2⤵
  PID:4208
- C:\Windows\System\tLEmSKD.exe
  C:\Windows\System\tLEmSKD.exe
  2⤵
  PID:4884
- C:\Windows\System\OAFXBZy.exe
  C:\Windows\System\OAFXBZy.exe
  2⤵
  PID:1912
- C:\Windows\System\ZEAgkXi.exe
  C:\Windows\System\ZEAgkXi.exe
  2⤵
  PID:4672
- C:\Windows\System\eDgbYOK.exe
  C:\Windows\System\eDgbYOK.exe
  2⤵
  PID:4576
- C:\Windows\System\vwvQPgL.exe
  C:\Windows\System\vwvQPgL.exe
  2⤵
  PID:5092
- C:\Windows\System\RQxMiYp.exe
  C:\Windows\System\RQxMiYp.exe
  2⤵
  PID:4736
- C:\Windows\System\sBzdsPu.exe
  C:\Windows\System\sBzdsPu.exe
  2⤵
  PID:4968
- C:\Windows\System\SWPAzhN.exe
  C:\Windows\System\SWPAzhN.exe
  2⤵
  PID:5136
- C:\Windows\System\gxJGhlr.exe
  C:\Windows\System\gxJGhlr.exe
  2⤵
  PID:5152
- C:\Windows\System\BFeBQOU.exe
  C:\Windows\System\BFeBQOU.exe
  2⤵
  PID:5172
- C:\Windows\System\gaXvSLh.exe
  C:\Windows\System\gaXvSLh.exe
  2⤵
  PID:5192
- C:\Windows\System\RqQXIWW.exe
  C:\Windows\System\RqQXIWW.exe
  2⤵
  PID:5208
- C:\Windows\System\gsamzNF.exe
  C:\Windows\System\gsamzNF.exe
  2⤵
  PID:5224
- C:\Windows\System\FZDRZCy.exe
  C:\Windows\System\FZDRZCy.exe
  2⤵
  PID:5240
- C:\Windows\System\yHRIdAB.exe
  C:\Windows\System\yHRIdAB.exe
  2⤵
  PID:5256
- C:\Windows\System\rnuqSDc.exe
  C:\Windows\System\rnuqSDc.exe
  2⤵
  PID:5272
- C:\Windows\System\THXbptC.exe
  C:\Windows\System\THXbptC.exe
  2⤵
  PID:5288
- C:\Windows\System\RPGheRb.exe
  C:\Windows\System\RPGheRb.exe
  2⤵
  PID:5304
- C:\Windows\System\WVREsmf.exe
  C:\Windows\System\WVREsmf.exe
  2⤵
  PID:5320
- C:\Windows\System\vtIxQXu.exe
  C:\Windows\System\vtIxQXu.exe
  2⤵
  PID:5340
- C:\Windows\System\eSkJXEp.exe
  C:\Windows\System\eSkJXEp.exe
  2⤵
  PID:5356
- C:\Windows\System\VPvRBse.exe
  C:\Windows\System\VPvRBse.exe
  2⤵
  PID:5372
- C:\Windows\System\KBSgiKF.exe
  C:\Windows\System\KBSgiKF.exe
  2⤵
  PID:5388
- C:\Windows\System\ptxfRwg.exe
  C:\Windows\System\ptxfRwg.exe
  2⤵
  PID:5404
- C:\Windows\System\hNuKqVi.exe
  C:\Windows\System\hNuKqVi.exe
  2⤵
  PID:5424
- C:\Windows\System\PRngvRY.exe
  C:\Windows\System\PRngvRY.exe
  2⤵
  PID:5444
- C:\Windows\System\OBMHUjw.exe
  C:\Windows\System\OBMHUjw.exe
  2⤵
  PID:5460
- C:\Windows\System\NzadmBp.exe
  C:\Windows\System\NzadmBp.exe
  2⤵
  PID:5476
- C:\Windows\System\gAxCFGc.exe
  C:\Windows\System\gAxCFGc.exe
  2⤵
  PID:5496
- C:\Windows\System\vhquFXG.exe
  C:\Windows\System\vhquFXG.exe
  2⤵
  PID:5512
- C:\Windows\System\ehfpihP.exe
  C:\Windows\System\ehfpihP.exe
  2⤵
  PID:5528
- C:\Windows\System\FcbOnSA.exe
  C:\Windows\System\FcbOnSA.exe
  2⤵
  PID:5544
- C:\Windows\System\FyIEyfO.exe
  C:\Windows\System\FyIEyfO.exe
  2⤵
  PID:5560
- C:\Windows\System\WvcmorT.exe
  C:\Windows\System\WvcmorT.exe
  2⤵
  PID:5576
- C:\Windows\System\ChoXTtz.exe
  C:\Windows\System\ChoXTtz.exe
  2⤵
  PID:5592
- C:\Windows\System\VYvAPko.exe
  C:\Windows\System\VYvAPko.exe
  2⤵
  PID:5608
- C:\Windows\System\GOjYAAP.exe
  C:\Windows\System\GOjYAAP.exe
  2⤵
  PID:5624
- C:\Windows\System\jhHNMTX.exe
  C:\Windows\System\jhHNMTX.exe
  2⤵
  PID:5640
- C:\Windows\System\wsNPAkN.exe
  C:\Windows\System\wsNPAkN.exe
  2⤵
  PID:5656
- C:\Windows\System\ECbZQoY.exe
  C:\Windows\System\ECbZQoY.exe
  2⤵
  PID:5672
- C:\Windows\System\FnAMNuW.exe
  C:\Windows\System\FnAMNuW.exe
  2⤵
  PID:5688
- C:\Windows\System\CLDAJuA.exe
  C:\Windows\System\CLDAJuA.exe
  2⤵
  PID:5704
- C:\Windows\System\aYyeSOW.exe
  C:\Windows\System\aYyeSOW.exe
  2⤵
  PID:5720
- C:\Windows\System\yZGCpMs.exe
  C:\Windows\System\yZGCpMs.exe
  2⤵
  PID:5736
- C:\Windows\System\ImzCLaR.exe
  C:\Windows\System\ImzCLaR.exe
  2⤵
  PID:5752
- C:\Windows\System\JJSNIYK.exe
  C:\Windows\System\JJSNIYK.exe
  2⤵
  PID:5772
- C:\Windows\System\TKhUIad.exe
  C:\Windows\System\TKhUIad.exe
  2⤵
  PID:5824
- C:\Windows\System\MYjkYZQ.exe
  C:\Windows\System\MYjkYZQ.exe
  2⤵
  PID:5844
- C:\Windows\System\gVonNHo.exe
  C:\Windows\System\gVonNHo.exe
  2⤵
  PID:5868
- C:\Windows\System\XfnXrCT.exe
  C:\Windows\System\XfnXrCT.exe
  2⤵
  PID:5884
- C:\Windows\System\XjKmeIv.exe
  C:\Windows\System\XjKmeIv.exe
  2⤵
  PID:5900
- C:\Windows\System\OVkeffT.exe
  C:\Windows\System\OVkeffT.exe
  2⤵
  PID:5920
- C:\Windows\System\lkFMbCJ.exe
  C:\Windows\System\lkFMbCJ.exe
  2⤵
  PID:5968
- C:\Windows\System\VWMMYvs.exe
  C:\Windows\System\VWMMYvs.exe
  2⤵
  PID:5168
- C:\Windows\System\fAtQuoq.exe
  C:\Windows\System\fAtQuoq.exe
  2⤵
  PID:6136
- C:\Windows\System\IhwAaxh.exe
  C:\Windows\System\IhwAaxh.exe
  2⤵
  PID:5204
- C:\Windows\System\sBElUtz.exe
  C:\Windows\System\sBElUtz.exe
  2⤵
  PID:4720
- C:\Windows\System\KeFizew.exe
  C:\Windows\System\KeFizew.exe
  2⤵
  PID:4324
- C:\Windows\System\IeoeXFj.exe
  C:\Windows\System\IeoeXFj.exe
  2⤵
  PID:4864
- C:\Windows\System\VzOmqvR.exe
  C:\Windows\System\VzOmqvR.exe
  2⤵
  PID:5220
- C:\Windows\System\PfTlrVc.exe
  C:\Windows\System\PfTlrVc.exe
  2⤵
  PID:996
- C:\Windows\System\vjvVUKl.exe
  C:\Windows\System\vjvVUKl.exe
  2⤵
  PID:5184
- C:\Windows\System\rUjQsCI.exe
  C:\Windows\System\rUjQsCI.exe
  2⤵
  PID:5312
- C:\Windows\System\NYqvPiL.exe
  C:\Windows\System\NYqvPiL.exe
  2⤵
  PID:5332
- C:\Windows\System\WZJxtfK.exe
  C:\Windows\System\WZJxtfK.exe
  2⤵
  PID:5400
- C:\Windows\System\cWAJooi.exe
  C:\Windows\System\cWAJooi.exe
  2⤵
  PID:5336
- C:\Windows\System\vGPDlbd.exe
  C:\Windows\System\vGPDlbd.exe
  2⤵
  PID:5508
- C:\Windows\System\HmIohoj.exe
  C:\Windows\System\HmIohoj.exe
  2⤵
  PID:5412
- C:\Windows\System\LqRgprB.exe
  C:\Windows\System\LqRgprB.exe
  2⤵
  PID:5492
- C:\Windows\System\KHYvhzu.exe
  C:\Windows\System\KHYvhzu.exe
  2⤵
  PID:5452
- C:\Windows\System\ooOPypR.exe
  C:\Windows\System\ooOPypR.exe
  2⤵
  PID:5520
- C:\Windows\System\bBWDFHK.exe
  C:\Windows\System\bBWDFHK.exe
  2⤵
  PID:5748
- C:\Windows\System\dThEHpu.exe
  C:\Windows\System\dThEHpu.exe
  2⤵
  PID:5760
- C:\Windows\System\lsQlUBA.exe
  C:\Windows\System\lsQlUBA.exe
  2⤵
  PID:5728
- C:\Windows\System\Bltvqfx.exe
  C:\Windows\System\Bltvqfx.exe
  2⤵
  PID:5680
- C:\Windows\System\RuynXwy.exe
  C:\Windows\System\RuynXwy.exe
  2⤵
  PID:5768
- C:\Windows\System\FCuYOLa.exe
  C:\Windows\System\FCuYOLa.exe
  2⤵
  PID:6012
- C:\Windows\System\jtmskUx.exe
  C:\Windows\System\jtmskUx.exe
  2⤵
  PID:5960
- C:\Windows\System\iulPaXv.exe
  C:\Windows\System\iulPaXv.exe
  2⤵
  PID:6048
- C:\Windows\System\LSIaWyN.exe
  C:\Windows\System\LSIaWyN.exe
  2⤵
  PID:6116
- C:\Windows\System\TgCNNRi.exe
  C:\Windows\System\TgCNNRi.exe
  2⤵
  PID:6124
- C:\Windows\System\BISkiEj.exe
  C:\Windows\System\BISkiEj.exe
  2⤵
  PID:5236
- C:\Windows\System\VGTZkbx.exe
  C:\Windows\System\VGTZkbx.exe
  2⤵
  PID:4788
- C:\Windows\System\qVphiQC.exe
  C:\Windows\System\qVphiQC.exe
  2⤵
  PID:5132
- C:\Windows\System\SxIcXhI.exe
  C:\Windows\System\SxIcXhI.exe
  2⤵
  PID:4704
- C:\Windows\System\oPmaMwm.exe
  C:\Windows\System\oPmaMwm.exe
  2⤵
  PID:5732
- C:\Windows\System\iOwFrZm.exe
  C:\Windows\System\iOwFrZm.exe
  2⤵
  PID:5164
- C:\Windows\System\nGiimri.exe
  C:\Windows\System\nGiimri.exe
  2⤵
  PID:5540
- C:\Windows\System\gFiGtyp.exe
  C:\Windows\System\gFiGtyp.exe
  2⤵
  PID:5488
- C:\Windows\System\OdneilB.exe
  C:\Windows\System\OdneilB.exe
  2⤵
  PID:5180
- C:\Windows\System\VNaZwFy.exe
  C:\Windows\System\VNaZwFy.exe
  2⤵
  PID:5620
- C:\Windows\System\CXILkoP.exe
  C:\Windows\System\CXILkoP.exe
  2⤵
  PID:5552
- C:\Windows\System\ryaVNIB.exe
  C:\Windows\System\ryaVNIB.exe
  2⤵
  PID:5440
- C:\Windows\System\MIeNGIt.exe
  C:\Windows\System\MIeNGIt.exe
  2⤵
  PID:6024
- C:\Windows\System\bWXzLYv.exe
  C:\Windows\System\bWXzLYv.exe
  2⤵
  PID:6032
- C:\Windows\System\owrUZLS.exe
  C:\Windows\System\owrUZLS.exe
  2⤵
  PID:5956
- C:\Windows\System\rjZnufD.exe
  C:\Windows\System\rjZnufD.exe
  2⤵
  PID:5792
- C:\Windows\System\vvvEsFI.exe
  C:\Windows\System\vvvEsFI.exe
  2⤵
  PID:5816
- C:\Windows\System\UZJUZgh.exe
  C:\Windows\System\UZJUZgh.exe
  2⤵
  PID:6152
- C:\Windows\System\RHrAksi.exe
  C:\Windows\System\RHrAksi.exe
  2⤵
  PID:6168
- C:\Windows\System\cMHfBEU.exe
  C:\Windows\System\cMHfBEU.exe
  2⤵
  PID:6188
- C:\Windows\System\XxYDGTs.exe
  C:\Windows\System\XxYDGTs.exe
  2⤵
  PID:6204
- C:\Windows\System\nEsxGMp.exe
  C:\Windows\System\nEsxGMp.exe
  2⤵
  PID:6228
- C:\Windows\System\dTRlSMK.exe
  C:\Windows\System\dTRlSMK.exe
  2⤵
  PID:6244
- C:\Windows\System\JyDQuXm.exe
  C:\Windows\System\JyDQuXm.exe
  2⤵
  PID:6260
- C:\Windows\System\LFLmTJw.exe
  C:\Windows\System\LFLmTJw.exe
  2⤵
  PID:6276
- C:\Windows\System\mTrZNAG.exe
  C:\Windows\System\mTrZNAG.exe
  2⤵
  PID:6296
- C:\Windows\System\STJHWBO.exe
  C:\Windows\System\STJHWBO.exe
  2⤵
  PID:6312
- C:\Windows\System\ZWDHCaf.exe
  C:\Windows\System\ZWDHCaf.exe
  2⤵
  PID:6332
- C:\Windows\System\bISRYhi.exe
  C:\Windows\System\bISRYhi.exe
  2⤵
  PID:6348
- C:\Windows\System\FsfITWS.exe
  C:\Windows\System\FsfITWS.exe
  2⤵
  PID:6444
- C:\Windows\System\WmvWfZA.exe
  C:\Windows\System\WmvWfZA.exe
  2⤵
  PID:6484
- C:\Windows\System\lncGjim.exe
  C:\Windows\System\lncGjim.exe
  2⤵
  PID:6500
- C:\Windows\System\neXGHzj.exe
  C:\Windows\System\neXGHzj.exe
  2⤵
  PID:6516
- C:\Windows\System\WrevvsD.exe
  C:\Windows\System\WrevvsD.exe
  2⤵
  PID:6532
- C:\Windows\System\UFYJZdn.exe
  C:\Windows\System\UFYJZdn.exe
  2⤵
  PID:6548
- C:\Windows\System\mCDoOTu.exe
  C:\Windows\System\mCDoOTu.exe
  2⤵
  PID:6568
- C:\Windows\System\XDGUTwY.exe
  C:\Windows\System\XDGUTwY.exe
  2⤵
  PID:6584
- C:\Windows\System\zmOlniQ.exe
  C:\Windows\System\zmOlniQ.exe
  2⤵
  PID:6600
- C:\Windows\System\psyesvs.exe
  C:\Windows\System\psyesvs.exe
  2⤵
  PID:6616
- C:\Windows\System\KBjYCgN.exe
  C:\Windows\System\KBjYCgN.exe
  2⤵
  PID:6640
- C:\Windows\System\HeDComw.exe
  C:\Windows\System\HeDComw.exe
  2⤵
  PID:6668
- C:\Windows\System\xbWwrgy.exe
  C:\Windows\System\xbWwrgy.exe
  2⤵
  PID:6684
- C:\Windows\System\nxsEGUl.exe
  C:\Windows\System\nxsEGUl.exe
  2⤵
  PID:6708
- C:\Windows\System\aDEwbOq.exe
  C:\Windows\System\aDEwbOq.exe
  2⤵
  PID:6724
- C:\Windows\System\ZYIBPuK.exe
  C:\Windows\System\ZYIBPuK.exe
  2⤵
  PID:6740
- C:\Windows\System\GwFYvNW.exe
  C:\Windows\System\GwFYvNW.exe
  2⤵
  PID:6756
- C:\Windows\System\SDsLLDI.exe
  C:\Windows\System\SDsLLDI.exe
  2⤵
  PID:6776
- C:\Windows\System\ssUqzLu.exe
  C:\Windows\System\ssUqzLu.exe
  2⤵
  PID:6792
- C:\Windows\System\MaXKQUM.exe
  C:\Windows\System\MaXKQUM.exe
  2⤵
  PID:6812
- C:\Windows\System\pohFFdN.exe
  C:\Windows\System\pohFFdN.exe
  2⤵
  PID:6828
- C:\Windows\System\tBDXiyM.exe
  C:\Windows\System\tBDXiyM.exe
  2⤵
  PID:6848
- C:\Windows\System\mfHEQDp.exe
  C:\Windows\System\mfHEQDp.exe
  2⤵
  PID:6864
- C:\Windows\System\ArAITkY.exe
  C:\Windows\System\ArAITkY.exe
  2⤵
  PID:6880
- C:\Windows\System\CyoEUHW.exe
  C:\Windows\System\CyoEUHW.exe
  2⤵
  PID:6896
- C:\Windows\System\Qroqrds.exe
  C:\Windows\System\Qroqrds.exe
  2⤵
  PID:6912
- C:\Windows\System\fTrYPAq.exe
  C:\Windows\System\fTrYPAq.exe
  2⤵
  PID:6932
- C:\Windows\System\gWaRlwn.exe
  C:\Windows\System\gWaRlwn.exe
  2⤵
  PID:6948
- C:\Windows\System\bBRFsRd.exe
  C:\Windows\System\bBRFsRd.exe
  2⤵
  PID:6964
- C:\Windows\System\eSGehMK.exe
  C:\Windows\System\eSGehMK.exe
  2⤵
  PID:6980
- C:\Windows\System\lXyxtKJ.exe
  C:\Windows\System\lXyxtKJ.exe
  2⤵
  PID:7000
- C:\Windows\System\KrOlygT.exe
  C:\Windows\System\KrOlygT.exe
  2⤵
  PID:7016
- C:\Windows\System\gPEtcfi.exe
  C:\Windows\System\gPEtcfi.exe
  2⤵
  PID:7032
- C:\Windows\System\FsGWLTp.exe
  C:\Windows\System\FsGWLTp.exe
  2⤵
  PID:7052
- C:\Windows\System\hxKJZQZ.exe
  C:\Windows\System\hxKJZQZ.exe
  2⤵
  PID:7068
- C:\Windows\System\lgSSXLQ.exe
  C:\Windows\System\lgSSXLQ.exe
  2⤵
  PID:7084
- C:\Windows\System\VVMMEmf.exe
  C:\Windows\System\VVMMEmf.exe
  2⤵
  PID:7100
- C:\Windows\System\bKwCLqa.exe
  C:\Windows\System\bKwCLqa.exe
  2⤵
  PID:7116
- C:\Windows\System\VqESBis.exe
  C:\Windows\System\VqESBis.exe
  2⤵
  PID:7132
- C:\Windows\System\IJHSLTr.exe
  C:\Windows\System\IJHSLTr.exe
  2⤵
  PID:7148
- C:\Windows\System\CFttkeo.exe
  C:\Windows\System\CFttkeo.exe
  2⤵
  PID:7164
- C:\Windows\System\oqMAUHe.exe
  C:\Windows\System\oqMAUHe.exe
  2⤵
  PID:5684
- C:\Windows\System\NpMUrPs.exe
  C:\Windows\System\NpMUrPs.exe
  2⤵
  PID:5484
- C:\Windows\System\pInEtVs.exe
  C:\Windows\System\pInEtVs.exe
  2⤵
  PID:5636
- C:\Windows\System\hejVHBN.exe
  C:\Windows\System\hejVHBN.exe
  2⤵
  PID:5352
- C:\Windows\System\MHnGGsR.exe
  C:\Windows\System\MHnGGsR.exe
  2⤵
  PID:5820
- C:\Windows\System\abfHSvg.exe
  C:\Windows\System\abfHSvg.exe
  2⤵
  PID:6236
- C:\Windows\System\GDolOTX.exe
  C:\Windows\System\GDolOTX.exe
  2⤵
  PID:5912
- C:\Windows\System\MKDVprd.exe
  C:\Windows\System\MKDVprd.exe
  2⤵
  PID:6268
- C:\Windows\System\HTTaUgO.exe
  C:\Windows\System\HTTaUgO.exe
  2⤵
  PID:6344
- C:\Windows\System\qEZFmSR.exe
  C:\Windows\System\qEZFmSR.exe
  2⤵
  PID:5600
- C:\Windows\System\PceRECv.exe
  C:\Windows\System\PceRECv.exe
  2⤵
  PID:5588
- C:\Windows\System\PqXOPmr.exe
  C:\Windows\System\PqXOPmr.exe
  2⤵
  PID:6212
- C:\Windows\System\SOQhkqL.exe
  C:\Windows\System\SOQhkqL.exe
  2⤵
  PID:6224
- C:\Windows\System\gwORWwb.exe
  C:\Windows\System\gwORWwb.exe
  2⤵
  PID:6292
- C:\Windows\System\XdAHfZB.exe
  C:\Windows\System\XdAHfZB.exe
  2⤵
  PID:5996
- C:\Windows\System\BHGuNIz.exe
  C:\Windows\System\BHGuNIz.exe
  2⤵
  PID:5992
- C:\Windows\System\oyXgdMR.exe
  C:\Windows\System\oyXgdMR.exe
  2⤵
  PID:5940
- C:\Windows\System\lZkDrDC.exe
  C:\Windows\System\lZkDrDC.exe
  2⤵
  PID:6148
- C:\Windows\System\YrnEjMZ.exe
  C:\Windows\System\YrnEjMZ.exe
  2⤵
  PID:5652
- C:\Windows\System\SLeGLje.exe
  C:\Windows\System\SLeGLje.exe
  2⤵
  PID:6008
- C:\Windows\System\chDyWJc.exe
  C:\Windows\System\chDyWJc.exe
  2⤵
  PID:6428
- C:\Windows\System\cVLUXrg.exe
  C:\Windows\System\cVLUXrg.exe
  2⤵
  PID:6452
- C:\Windows\System\LvPrMRH.exe
  C:\Windows\System\LvPrMRH.exe
  2⤵
  PID:6468
- C:\Windows\System\ZElgMeQ.exe
  C:\Windows\System\ZElgMeQ.exe
  2⤵
  PID:6508
- C:\Windows\System\uckYWeD.exe
  C:\Windows\System\uckYWeD.exe
  2⤵
  PID:6580
- C:\Windows\System\jvhPQEU.exe
  C:\Windows\System\jvhPQEU.exe
  2⤵
  PID:6592
- C:\Windows\System\evbANJK.exe
  C:\Windows\System\evbANJK.exe
  2⤵
  PID:6556
- C:\Windows\System\mTIDYWj.exe
  C:\Windows\System\mTIDYWj.exe
  2⤵
  PID:6608
- C:\Windows\System\zSvwyVA.exe
  C:\Windows\System\zSvwyVA.exe
  2⤵
  PID:6648
- C:\Windows\System\SqFwewG.exe
  C:\Windows\System\SqFwewG.exe
  2⤵
  PID:6696
- C:\Windows\System\OgeaNct.exe
  C:\Windows\System\OgeaNct.exe
  2⤵
  PID:6736
- C:\Windows\System\ezslytj.exe
  C:\Windows\System\ezslytj.exe
  2⤵
  PID:6804
- C:\Windows\System\WxLcnVp.exe
  C:\Windows\System\WxLcnVp.exe
  2⤵
  PID:6956
- C:\Windows\System\tdNBfKA.exe
  C:\Windows\System\tdNBfKA.exe
  2⤵
  PID:7012
- C:\Windows\System\HEuRSfG.exe
  C:\Windows\System\HEuRSfG.exe
  2⤵
  PID:6844
- C:\Windows\System\wklexZl.exe
  C:\Windows\System\wklexZl.exe
  2⤵
  PID:6940
- C:\Windows\System\OglJNcB.exe
  C:\Windows\System\OglJNcB.exe
  2⤵
  PID:7044
- C:\Windows\System\kNlCpXG.exe
  C:\Windows\System\kNlCpXG.exe
  2⤵
  PID:7112
- C:\Windows\System\wKPWsku.exe
  C:\Windows\System\wKPWsku.exe
  2⤵
  PID:6920
- C:\Windows\System\cwHHktX.exe
  C:\Windows\System\cwHHktX.exe
  2⤵
  PID:5876
- C:\Windows\System\WdTSlRH.exe
  C:\Windows\System\WdTSlRH.exe
  2⤵
  PID:7064
- C:\Windows\System\QftYEWp.exe
  C:\Windows\System\QftYEWp.exe
  2⤵
  PID:7128
- C:\Windows\System\sJqYYMo.exe
  C:\Windows\System\sJqYYMo.exe
  2⤵
  PID:5836
- C:\Windows\System\VSUoTaS.exe
  C:\Windows\System\VSUoTaS.exe
  2⤵
  PID:5664
- C:\Windows\System\dFIzZxS.exe
  C:\Windows\System\dFIzZxS.exe
  2⤵
  PID:5812
- C:\Windows\System\UKxgYnn.exe
  C:\Windows\System\UKxgYnn.exe
  2⤵
  PID:6340
- C:\Windows\System\soXXUPN.exe
  C:\Windows\System\soXXUPN.exe
  2⤵
  PID:6220
- C:\Windows\System\YGzuMCF.exe
  C:\Windows\System\YGzuMCF.exe
  2⤵
  PID:6112
- C:\Windows\System\vQThLbZ.exe
  C:\Windows\System\vQThLbZ.exe
  2⤵
  PID:5148
- C:\Windows\System\KejZYdi.exe
  C:\Windows\System\KejZYdi.exe
  2⤵
  PID:6184
- C:\Windows\System\aXFIvcP.exe
  C:\Windows\System\aXFIvcP.exe
  2⤵
  PID:6716
- C:\Windows\System\eSjQpmN.exe
  C:\Windows\System\eSjQpmN.exe
  2⤵
  PID:6820
- C:\Windows\System\IKYBDrO.exe
  C:\Windows\System\IKYBDrO.exe
  2⤵
  PID:5064
- C:\Windows\System\QTiOOJn.exe
  C:\Windows\System\QTiOOJn.exe
  2⤵
  PID:5856
- C:\Windows\System\OpBsDMG.exe
  C:\Windows\System\OpBsDMG.exe
  2⤵
  PID:5980
- C:\Windows\System\WnAGLgQ.exe
  C:\Windows\System\WnAGLgQ.exe
  2⤵
  PID:6288
- C:\Windows\System\rZAhQLX.exe
  C:\Windows\System\rZAhQLX.exe
  2⤵
  PID:5916
- C:\Windows\System\byJfgVB.exe
  C:\Windows\System\byJfgVB.exe
  2⤵
  PID:4240
- C:\Windows\System\DnGYVUs.exe
  C:\Windows\System\DnGYVUs.exe
  2⤵
  PID:5052
- C:\Windows\System\KffouMK.exe
  C:\Windows\System\KffouMK.exe
  2⤵
  PID:6368
- C:\Windows\System\pTBAsoT.exe
  C:\Windows\System\pTBAsoT.exe
  2⤵
  PID:5800
- C:\Windows\System\PenPgrr.exe
  C:\Windows\System\PenPgrr.exe
  2⤵
  PID:5908
- C:\Windows\System\iObLpkH.exe
  C:\Windows\System\iObLpkH.exe
  2⤵
  PID:6392
- C:\Windows\System\QLDNzDV.exe
  C:\Windows\System\QLDNzDV.exe
  2⤵
  PID:6412
- C:\Windows\System\sEZOvol.exe
  C:\Windows\System\sEZOvol.exe
  2⤵
  PID:6424
- C:\Windows\System\aKNAjqX.exe
  C:\Windows\System\aKNAjqX.exe
  2⤵
  PID:7028
- C:\Windows\System\uNXRJqh.exe
  C:\Windows\System\uNXRJqh.exe
  2⤵
  PID:5864
- C:\Windows\System\WQhXtsA.exe
  C:\Windows\System\WQhXtsA.exe
  2⤵
  PID:6720
- C:\Windows\System\fgZkjUn.exe
  C:\Windows\System\fgZkjUn.exe
  2⤵
  PID:6748
- C:\Windows\System\sWMdsuG.exe
  C:\Windows\System\sWMdsuG.exe
  2⤵
  PID:5896
- C:\Windows\System\WjprFpi.exe
  C:\Windows\System\WjprFpi.exe
  2⤵
  PID:6372
- C:\Windows\System\YJPHQHh.exe
  C:\Windows\System\YJPHQHh.exe
  2⤵
  PID:7080
- C:\Windows\System\gIDPgCs.exe
  C:\Windows\System\gIDPgCs.exe
  2⤵
  PID:6388
- C:\Windows\System\SasEMYv.exe
  C:\Windows\System\SasEMYv.exe
  2⤵
  PID:6528
- C:\Windows\System\PhtaZNs.exe
  C:\Windows\System\PhtaZNs.exe
  2⤵
  PID:5948
- C:\Windows\System\HHkWruZ.exe
  C:\Windows\System\HHkWruZ.exe
  2⤵
  PID:6028
- C:\Windows\System\gaAUgHw.exe
  C:\Windows\System\gaAUgHw.exe
  2⤵
  PID:5128
- C:\Windows\System\geWCVlM.exe
  C:\Windows\System\geWCVlM.exe
  2⤵
  PID:6200
- C:\Windows\System\NyWkkWX.exe
  C:\Windows\System\NyWkkWX.exe
  2⤵
  PID:5648
- C:\Windows\System\XlBPZNH.exe
  C:\Windows\System\XlBPZNH.exe
  2⤵
  PID:6664
- C:\Windows\System\PgCralb.exe
  C:\Windows\System\PgCralb.exe
  2⤵
  PID:6596
- C:\Windows\System\rdPXapW.exe
  C:\Windows\System\rdPXapW.exe
  2⤵
  PID:7124
- C:\Windows\System\bXERcFp.exe
  C:\Windows\System\bXERcFp.exe
  2⤵
  PID:6636
- C:\Windows\System\UEjIIKW.exe
  C:\Windows\System\UEjIIKW.exe
  2⤵
  PID:6732
- C:\Windows\System\mBeDYnO.exe
  C:\Windows\System\mBeDYnO.exe
  2⤵
  PID:6876
- C:\Windows\System\nyAFcxT.exe
  C:\Windows\System\nyAFcxT.exe
  2⤵
  PID:7144
- C:\Windows\System\cLLaOEo.exe
  C:\Windows\System\cLLaOEo.exe
  2⤵
  PID:6996
- C:\Windows\System\gTXPZHh.exe
  C:\Windows\System\gTXPZHh.exe
  2⤵
  PID:6676
- C:\Windows\System\ZggKSPM.exe
  C:\Windows\System\ZggKSPM.exe
  2⤵
  PID:5604
- C:\Windows\System\CbdlcMx.exe
  C:\Windows\System\CbdlcMx.exe
  2⤵
  PID:6472
- C:\Windows\System\sTLKDsX.exe
  C:\Windows\System\sTLKDsX.exe
  2⤵
  PID:6180
- C:\Windows\System\gwgUFvr.exe
  C:\Windows\System\gwgUFvr.exe
  2⤵
  PID:6960
- C:\Windows\System\vgDuuPk.exe
  C:\Windows\System\vgDuuPk.exe
  2⤵
  PID:6328
- C:\Windows\System\mOzAXOk.exe
  C:\Windows\System\mOzAXOk.exe
  2⤵
  PID:6752
- C:\Windows\System\mmwCyHV.exe
  C:\Windows\System\mmwCyHV.exe
  2⤵
  PID:6132
- C:\Windows\System\squtlEB.exe
  C:\Windows\System\squtlEB.exe
  2⤵
  PID:6704
- C:\Windows\System\ZwltSgt.exe
  C:\Windows\System\ZwltSgt.exe
  2⤵
  PID:6632
- C:\Windows\System\xnBAwaD.exe
  C:\Windows\System\xnBAwaD.exe
  2⤵
  PID:6540
- C:\Windows\System\mIwEJwm.exe
  C:\Windows\System\mIwEJwm.exe
  2⤵
  PID:5072
- C:\Windows\System\gmLrrps.exe
  C:\Windows\System\gmLrrps.exe
  2⤵
  PID:6788
- C:\Windows\System\tXkXYTC.exe
  C:\Windows\System\tXkXYTC.exe
  2⤵
  PID:6944
- C:\Windows\System\qSDXrNM.exe
  C:\Windows\System\qSDXrNM.exe
  2⤵
  PID:6992
- C:\Windows\System\MYEIMWn.exe
  C:\Windows\System\MYEIMWn.exe
  2⤵
  PID:6904
- C:\Windows\System\uZVDmFu.exe
  C:\Windows\System\uZVDmFu.exe
  2⤵
  PID:6908
- C:\Windows\System\iaRRIvN.exe
  C:\Windows\System\iaRRIvN.exe
  2⤵
  PID:6524
- C:\Windows\System\gvNQkLd.exe
  C:\Windows\System\gvNQkLd.exe
  2⤵
  PID:7172
- C:\Windows\System\XvlBmpS.exe
  C:\Windows\System\XvlBmpS.exe
  2⤵
  PID:7188
- C:\Windows\System\WqaglSi.exe
  C:\Windows\System\WqaglSi.exe
  2⤵
  PID:7204
- C:\Windows\System\GmatgMj.exe
  C:\Windows\System\GmatgMj.exe
  2⤵
  PID:7220
- C:\Windows\System\RQfvigT.exe
  C:\Windows\System\RQfvigT.exe
  2⤵
  PID:7236
- C:\Windows\System\IhcDIyr.exe
  C:\Windows\System\IhcDIyr.exe
  2⤵
  PID:7260
- C:\Windows\System\RNaTkSm.exe
  C:\Windows\System\RNaTkSm.exe
  2⤵
  PID:7284
- C:\Windows\System\xvFARmg.exe
  C:\Windows\System\xvFARmg.exe
  2⤵
  PID:7304
- C:\Windows\System\DDtYvNC.exe
  C:\Windows\System\DDtYvNC.exe
  2⤵
  PID:7324
- C:\Windows\System\nGfzqdi.exe
  C:\Windows\System\nGfzqdi.exe
  2⤵
  PID:7340
- C:\Windows\System\GLXVmCZ.exe
  C:\Windows\System\GLXVmCZ.exe
  2⤵
  PID:7356
- C:\Windows\System\ncUnnMu.exe
  C:\Windows\System\ncUnnMu.exe
  2⤵
  PID:7372
- C:\Windows\System\qZnWwND.exe
  C:\Windows\System\qZnWwND.exe
  2⤵
  PID:7388
- C:\Windows\System\LrCAzWM.exe
  C:\Windows\System\LrCAzWM.exe
  2⤵
  PID:7404
- C:\Windows\System\rhhbLZj.exe
  C:\Windows\System\rhhbLZj.exe
  2⤵
  PID:7420
- C:\Windows\System\ooHJnxz.exe
  C:\Windows\System\ooHJnxz.exe
  2⤵
  PID:7436
- C:\Windows\System\PciaWVh.exe
  C:\Windows\System\PciaWVh.exe
  2⤵
  PID:7452
- C:\Windows\System\dQiSoBy.exe
  C:\Windows\System\dQiSoBy.exe
  2⤵
  PID:7468
- C:\Windows\System\IDBWEoc.exe
  C:\Windows\System\IDBWEoc.exe
  2⤵
  PID:7488
- C:\Windows\System\kMUlTQf.exe
  C:\Windows\System\kMUlTQf.exe
  2⤵
  PID:7504
- C:\Windows\System\ExIdLOs.exe
  C:\Windows\System\ExIdLOs.exe
  2⤵
  PID:7524
- C:\Windows\System\lpgBJYP.exe
  C:\Windows\System\lpgBJYP.exe
  2⤵
  PID:7540
- C:\Windows\System\ycpBDcv.exe
  C:\Windows\System\ycpBDcv.exe
  2⤵
  PID:7556
- C:\Windows\System\TpXzkpZ.exe
  C:\Windows\System\TpXzkpZ.exe
  2⤵
  PID:7572
- C:\Windows\System\VfUZHHG.exe
  C:\Windows\System\VfUZHHG.exe
  2⤵
  PID:7592
- C:\Windows\System\vFMmfcc.exe
  C:\Windows\System\vFMmfcc.exe
  2⤵
  PID:7608
- C:\Windows\System\lqmavRr.exe
  C:\Windows\System\lqmavRr.exe
  2⤵
  PID:7624
- C:\Windows\System\MmBWLqV.exe
  C:\Windows\System\MmBWLqV.exe
  2⤵
  PID:7648
- C:\Windows\System\lsFmfSN.exe
  C:\Windows\System\lsFmfSN.exe
  2⤵
  PID:7664
- C:\Windows\System\yYDSbeB.exe
  C:\Windows\System\yYDSbeB.exe
  2⤵
  PID:7680
- C:\Windows\System\aeHIxDz.exe
  C:\Windows\System\aeHIxDz.exe
  2⤵
  PID:7704
- C:\Windows\System\NgIcZxJ.exe
  C:\Windows\System\NgIcZxJ.exe
  2⤵
  PID:7720
- C:\Windows\System\zMcwelA.exe
  C:\Windows\System\zMcwelA.exe
  2⤵
  PID:7736
- C:\Windows\System\ZIZDIwf.exe
  C:\Windows\System\ZIZDIwf.exe
  2⤵
  PID:7752
- C:\Windows\System\wwbHKOU.exe
  C:\Windows\System\wwbHKOU.exe
  2⤵
  PID:7768
- C:\Windows\System\zLWtSjC.exe
  C:\Windows\System\zLWtSjC.exe
  2⤵
  PID:7784
- C:\Windows\System\XrWPliL.exe
  C:\Windows\System\XrWPliL.exe
  2⤵
  PID:7800
- C:\Windows\System\sMNbMqI.exe
  C:\Windows\System\sMNbMqI.exe
  2⤵
  PID:7820
- C:\Windows\System\fZQMWHl.exe
  C:\Windows\System\fZQMWHl.exe
  2⤵
  PID:7836
- C:\Windows\System\RhJJUDb.exe
  C:\Windows\System\RhJJUDb.exe
  2⤵
  PID:7852
- C:\Windows\System\eOJsxLe.exe
  C:\Windows\System\eOJsxLe.exe
  2⤵
  PID:7872
- C:\Windows\System\mVEumhX.exe
  C:\Windows\System\mVEumhX.exe
  2⤵
  PID:7888
- C:\Windows\System\axWQIXi.exe
  C:\Windows\System\axWQIXi.exe
  2⤵
  PID:7908
- C:\Windows\System\yoTpWop.exe
  C:\Windows\System\yoTpWop.exe
  2⤵
  PID:7924
- C:\Windows\System\FKUSCzI.exe
  C:\Windows\System\FKUSCzI.exe
  2⤵
  PID:7940
- C:\Windows\System\pQVrcJE.exe
  C:\Windows\System\pQVrcJE.exe
  2⤵
  PID:7956
- C:\Windows\System\HBBqAxX.exe
  C:\Windows\System\HBBqAxX.exe
  2⤵
  PID:7976
- C:\Windows\System\QGEvYRH.exe
  C:\Windows\System\QGEvYRH.exe
  2⤵
  PID:7992
- C:\Windows\System\CnrpgIz.exe
  C:\Windows\System\CnrpgIz.exe
  2⤵
  PID:8012
- C:\Windows\System\eOPEPvy.exe
  C:\Windows\System\eOPEPvy.exe
  2⤵
  PID:8028
- C:\Windows\System\WimPEbQ.exe
  C:\Windows\System\WimPEbQ.exe
  2⤵
  PID:8044
- C:\Windows\System\ZyBBdxd.exe
  C:\Windows\System\ZyBBdxd.exe
  2⤵
  PID:8060
- C:\Windows\System\EbJrFBX.exe
  C:\Windows\System\EbJrFBX.exe
  2⤵
  PID:8076
- C:\Windows\System\TRpTnse.exe
  C:\Windows\System\TRpTnse.exe
  2⤵
  PID:8092
- C:\Windows\System\BgAZykc.exe
  C:\Windows\System\BgAZykc.exe
  2⤵
  PID:8108
- C:\Windows\System\QrfTnkC.exe
  C:\Windows\System\QrfTnkC.exe
  2⤵
  PID:8124
- C:\Windows\System\SorcbJq.exe
  C:\Windows\System\SorcbJq.exe
  2⤵
  PID:8140
- C:\Windows\System\lsDjZac.exe
  C:\Windows\System\lsDjZac.exe
  2⤵
  PID:8156
- C:\Windows\System\JZHlccb.exe
  C:\Windows\System\JZHlccb.exe
  2⤵
  PID:8172
- C:\Windows\System\OPlKSRm.exe
  C:\Windows\System\OPlKSRm.exe
  2⤵
  PID:8188
- C:\Windows\System\vJkRjjY.exe
  C:\Windows\System\vJkRjjY.exe
  2⤵
  PID:6408
- C:\Windows\System\NvMdwew.exe
  C:\Windows\System\NvMdwew.exe
  2⤵
  PID:7248
- C:\Windows\System\qyHZFiY.exe
  C:\Windows\System\qyHZFiY.exe
  2⤵
  PID:7200
- C:\Windows\System\kpwUAiI.exe
  C:\Windows\System\kpwUAiI.exe
  2⤵
  PID:7232
- C:\Windows\System\SkSVDfl.exe
  C:\Windows\System\SkSVDfl.exe
  2⤵
  PID:6380
- C:\Windows\System\RMENhmv.exe
  C:\Windows\System\RMENhmv.exe
  2⤵
  PID:6544
- C:\Windows\System\syOmWRW.exe
  C:\Windows\System\syOmWRW.exe
  2⤵
  PID:7300
- C:\Windows\System\nnnlqhh.exe
  C:\Windows\System\nnnlqhh.exe
  2⤵
  PID:7364
- C:\Windows\System\RYNyQed.exe
  C:\Windows\System\RYNyQed.exe
  2⤵
  PID:7348
- C:\Windows\System\enrVLPo.exe
  C:\Windows\System\enrVLPo.exe
  2⤵
  PID:7384
- C:\Windows\System\ludHiGd.exe
  C:\Windows\System\ludHiGd.exe
  2⤵
  PID:7412
- C:\Windows\System\HFgqDaV.exe
  C:\Windows\System\HFgqDaV.exe
  2⤵
  PID:7476
- C:\Windows\System\AMJcpDK.exe
  C:\Windows\System\AMJcpDK.exe
  2⤵
  PID:7496
- C:\Windows\System\jsaKXej.exe
  C:\Windows\System\jsaKXej.exe
  2⤵
  PID:7536
- C:\Windows\System\ToVguNp.exe
  C:\Windows\System\ToVguNp.exe
  2⤵
  PID:7568
- C:\Windows\System\bmTCygG.exe
  C:\Windows\System\bmTCygG.exe
  2⤵
  PID:7552
- C:\Windows\System\oCzHrKV.exe
  C:\Windows\System\oCzHrKV.exe
  2⤵
  PID:7620
- C:\Windows\System\CTJBKeX.exe
  C:\Windows\System\CTJBKeX.exe
  2⤵
  PID:7636
- C:\Windows\System\HKxIAnV.exe
  C:\Windows\System\HKxIAnV.exe
  2⤵
  PID:7676
- C:\Windows\System\AqhnEbh.exe
  C:\Windows\System\AqhnEbh.exe
  2⤵
  PID:7712
- C:\Windows\System\YzBHvcZ.exe
  C:\Windows\System\YzBHvcZ.exe
  2⤵
  PID:7848
- C:\Windows\System\WZjXlSC.exe
  C:\Windows\System\WZjXlSC.exe
  2⤵
  PID:7764
- C:\Windows\System\rjoaRvm.exe
  C:\Windows\System\rjoaRvm.exe
  2⤵
  PID:7832
- C:\Windows\System\gbGzWKw.exe
  C:\Windows\System\gbGzWKw.exe
  2⤵
  PID:7916
- C:\Windows\System\QycdIUb.exe
  C:\Windows\System\QycdIUb.exe
  2⤵
  PID:7904
- C:\Windows\System\FkTxpzI.exe
  C:\Windows\System\FkTxpzI.exe
  2⤵
  PID:7988
- C:\Windows\System\nPzBUbw.exe
  C:\Windows\System\nPzBUbw.exe
  2⤵
  PID:8004
- C:\Windows\System\xhtYhXQ.exe
  C:\Windows\System\xhtYhXQ.exe
  2⤵
  PID:8036
- C:\Windows\System\pSxonjZ.exe
  C:\Windows\System\pSxonjZ.exe
  2⤵
  PID:8040
- C:\Windows\System\nggzWuG.exe
  C:\Windows\System\nggzWuG.exe
  2⤵
  PID:8116
- C:\Windows\System\AFhjHde.exe
  C:\Windows\System\AFhjHde.exe
  2⤵
  PID:8152
- C:\Windows\System\FcHXLDw.exe
  C:\Windows\System\FcHXLDw.exe
  2⤵
  PID:7244
- C:\Windows\System\uJnfDnK.exe
  C:\Windows\System\uJnfDnK.exe
  2⤵
  PID:8168
- C:\Windows\System\gZjoERA.exe
  C:\Windows\System\gZjoERA.exe
  2⤵
  PID:7512
- C:\Windows\System\oyDEKkg.exe
  C:\Windows\System\oyDEKkg.exe
  2⤵
  PID:7600
- C:\Windows\System\NDlpLAT.exe
  C:\Windows\System\NDlpLAT.exe
  2⤵
  PID:7580
- C:\Windows\System\dbqHDgi.exe
  C:\Windows\System\dbqHDgi.exe
  2⤵
  PID:7748
- C:\Windows\System\XSEXDDV.exe
  C:\Windows\System\XSEXDDV.exe
  2⤵
  PID:7660
- C:\Windows\System\rWvWFLi.exe
  C:\Windows\System\rWvWFLi.exe
  2⤵
  PID:7728
- C:\Windows\System\TdGTbpg.exe
  C:\Windows\System\TdGTbpg.exe
  2⤵
  PID:7844
- C:\Windows\System\BrXMDcZ.exe
  C:\Windows\System\BrXMDcZ.exe
  2⤵
  PID:7760
- C:\Windows\System\geLgCwC.exe
  C:\Windows\System\geLgCwC.exe
  2⤵
  PID:7936
- C:\Windows\System\rILspFS.exe
  C:\Windows\System\rILspFS.exe
  2⤵
  PID:7972
- C:\Windows\System\iQwHKBV.exe
  C:\Windows\System\iQwHKBV.exe
  2⤵
  PID:7896
- C:\Windows\System\eQMnXGy.exe
  C:\Windows\System\eQMnXGy.exe
  2⤵
  PID:8100
- C:\Windows\System\THdrFTb.exe
  C:\Windows\System\THdrFTb.exe
  2⤵
  PID:8184
- C:\Windows\System\SoUpfja.exe
  C:\Windows\System\SoUpfja.exe
  2⤵
  PID:8164
- C:\Windows\System\iBnNvjv.exe
  C:\Windows\System\iBnNvjv.exe
  2⤵
  PID:7280
- C:\Windows\System\qIgKyCi.exe
  C:\Windows\System\qIgKyCi.exe
  2⤵
  PID:6576
- C:\Windows\System\IWdKVVx.exe
  C:\Windows\System\IWdKVVx.exe
  2⤵
  PID:7336
- C:\Windows\System\tCzBQjk.exe
  C:\Windows\System\tCzBQjk.exe
  2⤵
  PID:7320
- C:\Windows\System\GMhHXbg.exe
  C:\Windows\System\GMhHXbg.exe
  2⤵
  PID:7428
- C:\Windows\System\gMnXmNF.exe
  C:\Windows\System\gMnXmNF.exe
  2⤵
  PID:7516
- C:\Windows\System\SgURUbH.exe
  C:\Windows\System\SgURUbH.exe
  2⤵
  PID:7644
- C:\Windows\System\mlyjCdw.exe
  C:\Windows\System\mlyjCdw.exe
  2⤵
  PID:8008
- C:\Windows\System\IEiKXRF.exe
  C:\Windows\System\IEiKXRF.exe
  2⤵
  PID:7180
- C:\Windows\System\WgHZVYF.exe
  C:\Windows\System\WgHZVYF.exe
  2⤵
  PID:7312
- C:\Windows\System\txrWqAG.exe
  C:\Windows\System\txrWqAG.exe
  2⤵
  PID:7880
- C:\Windows\System\SQqwrVe.exe
  C:\Windows\System\SQqwrVe.exe
  2⤵
  PID:8196
- C:\Windows\System\GQxrtYi.exe
  C:\Windows\System\GQxrtYi.exe
  2⤵
  PID:8212
- C:\Windows\System\sLnBOmq.exe
  C:\Windows\System\sLnBOmq.exe
  2⤵
  PID:8228
- C:\Windows\System\OiROGlB.exe
  C:\Windows\System\OiROGlB.exe
  2⤵
  PID:8244
- C:\Windows\System\LUZRkJe.exe
  C:\Windows\System\LUZRkJe.exe
  2⤵
  PID:8260
- C:\Windows\System\QYkgmxi.exe
  C:\Windows\System\QYkgmxi.exe
  2⤵
  PID:8276
- C:\Windows\System\XrGpMqf.exe
  C:\Windows\System\XrGpMqf.exe
  2⤵
  PID:8292
- C:\Windows\System\TfhfusJ.exe
  C:\Windows\System\TfhfusJ.exe
  2⤵
  PID:8308
- C:\Windows\System\dZJkpfX.exe
  C:\Windows\System\dZJkpfX.exe
  2⤵
  PID:8324
- C:\Windows\System\RzujVmm.exe
  C:\Windows\System\RzujVmm.exe
  2⤵
  PID:8344
- C:\Windows\System\QBhEVJl.exe
  C:\Windows\System\QBhEVJl.exe
  2⤵
  PID:8360
- C:\Windows\System\OTkRSAR.exe
  C:\Windows\System\OTkRSAR.exe
  2⤵
  PID:8376
- C:\Windows\System\zeMSHqn.exe
  C:\Windows\System\zeMSHqn.exe
  2⤵
  PID:8392
- C:\Windows\System\ixmiHYb.exe
  C:\Windows\System\ixmiHYb.exe
  2⤵
  PID:8416
- C:\Windows\System\VPnpUUq.exe
  C:\Windows\System\VPnpUUq.exe
  2⤵
  PID:8432
- C:\Windows\System\sdgwNCa.exe
  C:\Windows\System\sdgwNCa.exe
  2⤵
  PID:8448
- C:\Windows\System\keknxCu.exe
  C:\Windows\System\keknxCu.exe
  2⤵
  PID:8464
- C:\Windows\System\jJfEWjA.exe
  C:\Windows\System\jJfEWjA.exe
  2⤵
  PID:8480
- C:\Windows\System\DlQGzkH.exe
  C:\Windows\System\DlQGzkH.exe
  2⤵
  PID:8496
- C:\Windows\System\SpBIYgC.exe
  C:\Windows\System\SpBIYgC.exe
  2⤵
  PID:8512
- C:\Windows\System\uPmgwWF.exe
  C:\Windows\System\uPmgwWF.exe
  2⤵
  PID:8528
- C:\Windows\System\wsUuFTH.exe
  C:\Windows\System\wsUuFTH.exe
  2⤵
  PID:8544
- C:\Windows\System\YSkOnHZ.exe
  C:\Windows\System\YSkOnHZ.exe
  2⤵
  PID:8560
- C:\Windows\System\JuaRdNK.exe
  C:\Windows\System\JuaRdNK.exe
  2⤵
  PID:8576
- C:\Windows\System\DalkmeV.exe
  C:\Windows\System\DalkmeV.exe
  2⤵
  PID:8592
- C:\Windows\System\crYOBSp.exe
  C:\Windows\System\crYOBSp.exe
  2⤵
  PID:8608
- C:\Windows\System\qDqFLZh.exe
  C:\Windows\System\qDqFLZh.exe
  2⤵
  PID:8628
- C:\Windows\System\qXrsGYQ.exe
  C:\Windows\System\qXrsGYQ.exe
  2⤵
  PID:8644
- C:\Windows\System\ToBrRNd.exe
  C:\Windows\System\ToBrRNd.exe
  2⤵
  PID:8660
- C:\Windows\System\dqFaoHx.exe
  C:\Windows\System\dqFaoHx.exe
  2⤵
  PID:8684
- C:\Windows\System\PNcOywY.exe
  C:\Windows\System\PNcOywY.exe
  2⤵
  PID:8700
- C:\Windows\System\OfFbtcR.exe
  C:\Windows\System\OfFbtcR.exe
  2⤵
  PID:8716
- C:\Windows\System\DVlAjWb.exe
  C:\Windows\System\DVlAjWb.exe
  2⤵
  PID:8732
- C:\Windows\System\nPbpcac.exe
  C:\Windows\System\nPbpcac.exe
  2⤵
  PID:8748
- C:\Windows\System\RYQktyg.exe
  C:\Windows\System\RYQktyg.exe
  2⤵
  PID:8856
- C:\Windows\System\WNtLaFB.exe
  C:\Windows\System\WNtLaFB.exe
  2⤵
  PID:8876
- C:\Windows\System\dNOCjAq.exe
  C:\Windows\System\dNOCjAq.exe
  2⤵
  PID:8892
- C:\Windows\System\ELHxNyW.exe
  C:\Windows\System\ELHxNyW.exe
  2⤵
  PID:8908
- C:\Windows\System\RIsshwm.exe
  C:\Windows\System\RIsshwm.exe
  2⤵
  PID:8924
- C:\Windows\System\fzyekrr.exe
  C:\Windows\System\fzyekrr.exe
  2⤵
  PID:8940
- C:\Windows\System\ZwkhJOG.exe
  C:\Windows\System\ZwkhJOG.exe
  2⤵
  PID:8976
- C:\Windows\System\EQBaXUI.exe
  C:\Windows\System\EQBaXUI.exe
  2⤵
  PID:9028
- C:\Windows\System\YXrqjuY.exe
  C:\Windows\System\YXrqjuY.exe
  2⤵
  PID:9048
- C:\Windows\System\fOcvksk.exe
  C:\Windows\System\fOcvksk.exe
  2⤵
  PID:9080
- C:\Windows\System\OxyPLEl.exe
  C:\Windows\System\OxyPLEl.exe
  2⤵
  PID:9104
- C:\Windows\System\dnkDkCh.exe
  C:\Windows\System\dnkDkCh.exe
  2⤵
  PID:9120
- C:\Windows\System\qhPYJrM.exe
  C:\Windows\System\qhPYJrM.exe
  2⤵
  PID:9136
- C:\Windows\System\GtUScJs.exe
  C:\Windows\System\GtUScJs.exe
  2⤵
  PID:9152
- C:\Windows\System\RxeMoZE.exe
  C:\Windows\System\RxeMoZE.exe
  2⤵
  PID:9168
- C:\Windows\System\yqjMyUm.exe
  C:\Windows\System\yqjMyUm.exe
  2⤵
  PID:9184
- C:\Windows\System\naiQkVX.exe
  C:\Windows\System\naiQkVX.exe
  2⤵
  PID:9200
- C:\Windows\System\YzOHVFJ.exe
  C:\Windows\System\YzOHVFJ.exe
  2⤵
  PID:6628
- C:\Windows\System\jCXQRZm.exe
  C:\Windows\System\jCXQRZm.exe
  2⤵
  PID:8252
- C:\Windows\System\IJVicZm.exe
  C:\Windows\System\IJVicZm.exe
  2⤵
  PID:8316
- C:\Windows\System\uBdRTJE.exe
  C:\Windows\System\uBdRTJE.exe
  2⤵
  PID:8356
- C:\Windows\System\hkriZjm.exe
  C:\Windows\System\hkriZjm.exe
  2⤵
  PID:8236
- C:\Windows\System\SlKDQuH.exe
  C:\Windows\System\SlKDQuH.exe
  2⤵
  PID:7460
- C:\Windows\System\nEOnOyv.exe
  C:\Windows\System\nEOnOyv.exe
  2⤵
  PID:7948
- C:\Windows\System\GClyASz.exe
  C:\Windows\System\GClyASz.exe
  2⤵
  PID:8696
- C:\Windows\System\uYMWuTC.exe
  C:\Windows\System\uYMWuTC.exe
  2⤵
  PID:8728
- C:\Windows\System\HgtpMih.exe
  C:\Windows\System\HgtpMih.exe
  2⤵
  PID:8744
- C:\Windows\System\HLRogji.exe
  C:\Windows\System\HLRogji.exe
  2⤵
  PID:8780
- C:\Windows\System\jnSwNIu.exe
  C:\Windows\System\jnSwNIu.exe
  2⤵
  PID:8796
- C:\Windows\System\ZMkjFvT.exe
  C:\Windows\System\ZMkjFvT.exe
  2⤵
  PID:8812
- C:\Windows\System\FrsLKGy.exe
  C:\Windows\System\FrsLKGy.exe
  2⤵
  PID:8828
- C:\Windows\System\jDbodhI.exe
  C:\Windows\System\jDbodhI.exe
  2⤵
  PID:8844
- C:\Windows\System\EaJcECF.exe
  C:\Windows\System\EaJcECF.exe
  2⤵
  PID:8884
- C:\Windows\System\viAIQow.exe
  C:\Windows\System\viAIQow.exe
  2⤵
  PID:8904
- C:\Windows\System\SsNXHmy.exe
  C:\Windows\System\SsNXHmy.exe
  2⤵
  PID:8920
- C:\Windows\System\zZZiSjv.exe
  C:\Windows\System\zZZiSjv.exe
  2⤵
  PID:8960
- C:\Windows\System\iEvyaOv.exe
  C:\Windows\System\iEvyaOv.exe
  2⤵
  PID:8996
- C:\Windows\System\XvtiAFa.exe
  C:\Windows\System\XvtiAFa.exe
  2⤵
  PID:9056
- C:\Windows\System\EDEiito.exe
  C:\Windows\System\EDEiito.exe
  2⤵
  PID:9040
- C:\Windows\System\KkJpfGO.exe
  C:\Windows\System\KkJpfGO.exe
  2⤵
  PID:9072
- C:\Windows\System\wPjtbCZ.exe
  C:\Windows\System\wPjtbCZ.exe
  2⤵
  PID:9096
- C:\Windows\System\HoHNDLy.exe
  C:\Windows\System\HoHNDLy.exe
  2⤵
  PID:9160
- C:\Windows\System\nbgTCdX.exe
  C:\Windows\System\nbgTCdX.exe
  2⤵
  PID:8220
- C:\Windows\System\irssHOY.exe
  C:\Windows\System\irssHOY.exe
  2⤵
  PID:7464
- C:\Windows\System\rhyPBfk.exe
  C:\Windows\System\rhyPBfk.exe
  2⤵
  PID:9148
- C:\Windows\System\ABHxzQI.exe
  C:\Windows\System\ABHxzQI.exe
  2⤵
  PID:8284
- C:\Windows\System\WdfTJEu.exe
  C:\Windows\System\WdfTJEu.exe
  2⤵
  PID:7672
- C:\Windows\System\TBWdjoa.exe
  C:\Windows\System\TBWdjoa.exe
  2⤵
  PID:8952
- C:\Windows\System\fEViXgv.exe
  C:\Windows\System\fEViXgv.exe
  2⤵
  PID:8332
- C:\Windows\System\FoXCnaH.exe
  C:\Windows\System\FoXCnaH.exe
  2⤵
  PID:8268
- C:\Windows\System\ZKEiuVC.exe
  C:\Windows\System\ZKEiuVC.exe
  2⤵
  PID:8372
- C:\Windows\System\fQqZPYv.exe
  C:\Windows\System\fQqZPYv.exe
  2⤵
  PID:7696
- C:\Windows\System\gMQSwJP.exe
  C:\Windows\System\gMQSwJP.exe
  2⤵
  PID:7268
- C:\Windows\System\SntaCDJ.exe
  C:\Windows\System\SntaCDJ.exe
  2⤵
  PID:8600
- C:\Windows\System\ZhKMyBD.exe
  C:\Windows\System\ZhKMyBD.exe
  2⤵
  PID:8640
- C:\Windows\System\aWbIvhf.exe
  C:\Windows\System\aWbIvhf.exe
  2⤵
  PID:8740
- C:\Windows\System\VzhVSVF.exe
  C:\Windows\System\VzhVSVF.exe
  2⤵
  PID:8824
- C:\Windows\System\pQsxJjs.exe
  C:\Windows\System\pQsxJjs.exe
  2⤵
  PID:8916
- C:\Windows\System\pxJeMts.exe
  C:\Windows\System\pxJeMts.exe
  2⤵
  PID:8992
- C:\Windows\System\rBbARnG.exe
  C:\Windows\System\rBbARnG.exe
  2⤵
  PID:8764
- C:\Windows\System\dkJuhEH.exe
  C:\Windows\System\dkJuhEH.exe
  2⤵
  PID:8900
- C:\Windows\System\UglzHwK.exe
  C:\Windows\System\UglzHwK.exe
  2⤵
  PID:9088
- C:\Windows\System\yhLjWFM.exe
  C:\Windows\System\yhLjWFM.exe
  2⤵
  PID:8388
- C:\Windows\System\XgpFwdD.exe
  C:\Windows\System\XgpFwdD.exe
  2⤵
  PID:7296
- C:\Windows\System\fEZGKzA.exe
  C:\Windows\System\fEZGKzA.exe
  2⤵
  PID:8084
- C:\Windows\System\kdCDHFj.exe
  C:\Windows\System\kdCDHFj.exe
  2⤵
  PID:8460
- C:\Windows\System\rxNSJWF.exe
  C:\Windows\System\rxNSJWF.exe
  2⤵
  PID:8412
- C:\Windows\System\XKusPYh.exe
  C:\Windows\System\XKusPYh.exe
  2⤵
  PID:8444
- C:\Windows\System\cOiQXOz.exe
  C:\Windows\System\cOiQXOz.exe
  2⤵
  PID:8552
- C:\Windows\System\farvHPy.exe
  C:\Windows\System\farvHPy.exe
  2⤵
  PID:8584
- C:\Windows\System\xtUdAAG.exe
  C:\Windows\System\xtUdAAG.exe
  2⤵
  PID:8668
- C:\Windows\System\DUylIpX.exe
  C:\Windows\System\DUylIpX.exe
  2⤵
  PID:8636
- C:\Windows\System\MzKEWiz.exe
  C:\Windows\System\MzKEWiz.exe
  2⤵
  PID:8820
- C:\Windows\System\LxTruBO.exe
  C:\Windows\System\LxTruBO.exe
  2⤵
  PID:8840
- C:\Windows\System\blntAuP.exe
  C:\Windows\System\blntAuP.exe
  2⤵
  PID:8708
- C:\Windows\System\nqtFTZH.exe
  C:\Windows\System\nqtFTZH.exe
  2⤵
  PID:9076
- C:\Windows\System\mScgYmu.exe
  C:\Windows\System\mScgYmu.exe
  2⤵
  PID:9012
- C:\Windows\System\cEOqdxW.exe
  C:\Windows\System\cEOqdxW.exe
  2⤵
  PID:9128
- C:\Windows\System\TNeoJMo.exe
  C:\Windows\System\TNeoJMo.exe
  2⤵
  PID:9196
- C:\Windows\System\qOeZfDg.exe
  C:\Windows\System\qOeZfDg.exe
  2⤵
  PID:8288
- C:\Windows\System\NYJnkqH.exe
  C:\Windows\System\NYJnkqH.exe
  2⤵
  PID:8088
- C:\Windows\System\QNyrKwR.exe
  C:\Windows\System\QNyrKwR.exe
  2⤵
  PID:8208
- C:\Windows\System\ddhFrGj.exe
  C:\Windows\System\ddhFrGj.exe
  2⤵
  PID:8524
- C:\Windows\System\jvUxjZU.exe
  C:\Windows\System\jvUxjZU.exe
  2⤵
  PID:8572
- C:\Windows\System\yQOwMFv.exe
  C:\Windows\System\yQOwMFv.exe
  2⤵
  PID:8792
- C:\Windows\System\KPfkIMQ.exe
  C:\Windows\System\KPfkIMQ.exe
  2⤵
  PID:9008
- C:\Windows\System\KmwRuWY.exe
  C:\Windows\System\KmwRuWY.exe
  2⤵
  PID:9144
- C:\Windows\System\nKHzXCZ.exe
  C:\Windows\System\nKHzXCZ.exe
  2⤵
  PID:8520
- C:\Windows\System\SNlDRpq.exe
  C:\Windows\System\SNlDRpq.exe
  2⤵
  PID:9228
- C:\Windows\System\gGRiNcn.exe
  C:\Windows\System\gGRiNcn.exe
  2⤵
  PID:9244
- C:\Windows\System\praNsqZ.exe
  C:\Windows\System\praNsqZ.exe
  2⤵
  PID:9264
- C:\Windows\System\AvpoRIL.exe
  C:\Windows\System\AvpoRIL.exe
  2⤵
  PID:9280
- C:\Windows\System\rkoSTsQ.exe
  C:\Windows\System\rkoSTsQ.exe
  2⤵
  PID:9296
- C:\Windows\System\WdnhzwM.exe
  C:\Windows\System\WdnhzwM.exe
  2⤵
  PID:9316
- C:\Windows\System\ApjWiEg.exe
  C:\Windows\System\ApjWiEg.exe
  2⤵
  PID:9332
- C:\Windows\System\PZJAZvo.exe
  C:\Windows\System\PZJAZvo.exe
  2⤵
  PID:9348
- C:\Windows\System\YqBNhxx.exe
  C:\Windows\System\YqBNhxx.exe
  2⤵
  PID:9364
- C:\Windows\System\zBPxoYk.exe
  C:\Windows\System\zBPxoYk.exe
  2⤵
  PID:9380
- C:\Windows\System\zQTidQF.exe
  C:\Windows\System\zQTidQF.exe
  2⤵
  PID:9396
- C:\Windows\System\EKYThgg.exe
  C:\Windows\System\EKYThgg.exe
  2⤵
  PID:9412
- C:\Windows\System\UXNexuW.exe
  C:\Windows\System\UXNexuW.exe
  2⤵
  PID:9428
- C:\Windows\System\bALbVFT.exe
  C:\Windows\System\bALbVFT.exe
  2⤵
  PID:9448
- C:\Windows\System\KjWggkM.exe
  C:\Windows\System\KjWggkM.exe
  2⤵
  PID:9468
- C:\Windows\System\yrQfabk.exe
  C:\Windows\System\yrQfabk.exe
  2⤵
  PID:9484
- C:\Windows\System\VqnjfGR.exe
  C:\Windows\System\VqnjfGR.exe
  2⤵
  PID:9500
- C:\Windows\System\qQvwxul.exe
  C:\Windows\System\qQvwxul.exe
  2⤵
  PID:9528
- C:\Windows\System\UNeekHM.exe
  C:\Windows\System\UNeekHM.exe
  2⤵
  PID:9552
- C:\Windows\System\TujZyDm.exe
  C:\Windows\System\TujZyDm.exe
  2⤵
  PID:9636
- C:\Windows\System\ZRcNHnN.exe
  C:\Windows\System\ZRcNHnN.exe
  2⤵
  PID:9652
- C:\Windows\System\hYkAvFy.exe
  C:\Windows\System\hYkAvFy.exe
  2⤵
  PID:9668
- C:\Windows\System\YKmTyeQ.exe
  C:\Windows\System\YKmTyeQ.exe
  2⤵
  PID:9684
- C:\Windows\System\KeVOkhZ.exe
  C:\Windows\System\KeVOkhZ.exe
  2⤵
  PID:9700
- C:\Windows\System\AjzXDeM.exe
  C:\Windows\System\AjzXDeM.exe
  2⤵
  PID:9716
- C:\Windows\System\iCesblT.exe
  C:\Windows\System\iCesblT.exe
  2⤵
  PID:9732
- C:\Windows\System\iVVxLAW.exe
  C:\Windows\System\iVVxLAW.exe
  2⤵
  PID:9748
- C:\Windows\System\ucHRsAU.exe
  C:\Windows\System\ucHRsAU.exe
  2⤵
  PID:9764
- C:\Windows\System\TNJdHLT.exe
  C:\Windows\System\TNJdHLT.exe
  2⤵
  PID:9784
- C:\Windows\System\cEmcjHd.exe
  C:\Windows\System\cEmcjHd.exe
  2⤵
  PID:9800
- C:\Windows\System\vSeYexn.exe
  C:\Windows\System\vSeYexn.exe
  2⤵
  PID:9816
- C:\Windows\System\csiyXhM.exe
  C:\Windows\System\csiyXhM.exe
  2⤵
  PID:9832
- C:\Windows\System\BAKXQXZ.exe
  C:\Windows\System\BAKXQXZ.exe
  2⤵
  PID:9848
- C:\Windows\System\TEoVYam.exe
  C:\Windows\System\TEoVYam.exe
  2⤵
  PID:9864
- C:\Windows\System\PLjOiMy.exe
  C:\Windows\System\PLjOiMy.exe
  2⤵
  PID:9880
- C:\Windows\System\vafqpWP.exe
  C:\Windows\System\vafqpWP.exe
  2⤵
  PID:9896
- C:\Windows\System\PhdyeZs.exe
  C:\Windows\System\PhdyeZs.exe
  2⤵
  PID:9912
- C:\Windows\System\nNCYsjL.exe
  C:\Windows\System\nNCYsjL.exe
  2⤵
  PID:9928
- C:\Windows\System\wwaJGtv.exe
  C:\Windows\System\wwaJGtv.exe
  2⤵
  PID:9944
- C:\Windows\System\jrTZtVs.exe
  C:\Windows\System\jrTZtVs.exe
  2⤵
  PID:9960
- C:\Windows\System\zAUqbvT.exe
  C:\Windows\System\zAUqbvT.exe
  2⤵
  PID:9976
- C:\Windows\System\OPTWVBn.exe
  C:\Windows\System\OPTWVBn.exe
  2⤵
  PID:9992
- C:\Windows\System\yGyEjxp.exe
  C:\Windows\System\yGyEjxp.exe
  2⤵
  PID:10008
- C:\Windows\System\ISGGzFY.exe
  C:\Windows\System\ISGGzFY.exe
  2⤵
  PID:10024
- C:\Windows\System\tnMInNz.exe
  C:\Windows\System\tnMInNz.exe
  2⤵
  PID:10040
- C:\Windows\System\AJNBaeJ.exe
  C:\Windows\System\AJNBaeJ.exe
  2⤵
  PID:10056
- C:\Windows\System\tVVMVbJ.exe
  C:\Windows\System\tVVMVbJ.exe
  2⤵
  PID:10072
- C:\Windows\System\UGXFtKA.exe
  C:\Windows\System\UGXFtKA.exe
  2⤵
  PID:10088
- C:\Windows\System\OAuzIVF.exe
  C:\Windows\System\OAuzIVF.exe
  2⤵
  PID:10104
- C:\Windows\System\WnrKxSe.exe
  C:\Windows\System\WnrKxSe.exe
  2⤵
  PID:10120
- C:\Windows\System\hVHlMce.exe
  C:\Windows\System\hVHlMce.exe
  2⤵
  PID:10136
- C:\Windows\System\zZzYCcl.exe
  C:\Windows\System\zZzYCcl.exe
  2⤵
  PID:10160
- C:\Windows\System\xqAENSq.exe
  C:\Windows\System\xqAENSq.exe
  2⤵
  PID:10176
- C:\Windows\System\zkazZvM.exe
  C:\Windows\System\zkazZvM.exe
  2⤵
  PID:10192
- C:\Windows\System\EQRbqkH.exe
  C:\Windows\System\EQRbqkH.exe
  2⤵
  PID:10208
- C:\Windows\System\oVhWtTF.exe
  C:\Windows\System\oVhWtTF.exe
  2⤵
  PID:10228
- C:\Windows\System\trbzANY.exe
  C:\Windows\System\trbzANY.exe
  2⤵
  PID:9252
- C:\Windows\System\PqzSEPA.exe
  C:\Windows\System\PqzSEPA.exe
  2⤵
  PID:9220
- C:\Windows\System\UdpDcuT.exe
  C:\Windows\System\UdpDcuT.exe
  2⤵
  PID:9292
- C:\Windows\System\XJCudFv.exe
  C:\Windows\System\XJCudFv.exe
  2⤵
  PID:9360
- C:\Windows\System\srzHbiA.exe
  C:\Windows\System\srzHbiA.exe
  2⤵
  PID:8536
- C:\Windows\System\kqmzmoN.exe
  C:\Windows\System\kqmzmoN.exe
  2⤵
  PID:9240
- C:\Windows\System\NyjqmSb.exe
  C:\Windows\System\NyjqmSb.exe
  2⤵
  PID:9308
- C:\Windows\System\ufArdGg.exe
  C:\Windows\System\ufArdGg.exe
  2⤵
  PID:9404
- C:\Windows\System\vcjxZzE.exe
  C:\Windows\System\vcjxZzE.exe
  2⤵
  PID:9512
- C:\Windows\System\yfyGmCK.exe
  C:\Windows\System\yfyGmCK.exe
  2⤵
  PID:8604
- C:\Windows\System\wXQyoYK.exe
  C:\Windows\System\wXQyoYK.exe
  2⤵
  PID:8568
- C:\Windows\System\OwcOMUI.exe
  C:\Windows\System\OwcOMUI.exe
  2⤵
  PID:9740
- C:\Windows\System\KJfvSlY.exe
  C:\Windows\System\KJfvSlY.exe
  2⤵
  PID:9776
- C:\Windows\System\DaQVvQd.exe
  C:\Windows\System\DaQVvQd.exe
  2⤵
  PID:9840
- C:\Windows\System\NGNUrSY.exe
  C:\Windows\System\NGNUrSY.exe
  2⤵
  PID:9876
- C:\Windows\System\SyXkWxu.exe
  C:\Windows\System\SyXkWxu.exe
  2⤵
  PID:9936
- C:\Windows\System\aCbsBSE.exe
  C:\Windows\System\aCbsBSE.exe
  2⤵
  PID:9952
- C:\Windows\System\afyvNYb.exe
  C:\Windows\System\afyvNYb.exe
  2⤵
  PID:9372
- C:\Windows\System\glXmHht.exe
  C:\Windows\System\glXmHht.exe
  2⤵
  PID:8624
- C:\Windows\System\hBWdwwR.exe
  C:\Windows\System\hBWdwwR.exe
  2⤵
  PID:9536
- C:\Windows\System\lhPKNDP.exe
  C:\Windows\System\lhPKNDP.exe
  2⤵
  PID:9572
- C:\Windows\System\JlvKZXQ.exe
  C:\Windows\System\JlvKZXQ.exe
  2⤵
  PID:9580
- C:\Windows\System\PCBNAza.exe
  C:\Windows\System\PCBNAza.exe
  2⤵
  PID:9628
- C:\Windows\System\VRzsyZo.exe
  C:\Windows\System\VRzsyZo.exe
  2⤵
  PID:9772
- C:\Windows\System\PVxPHUK.exe
  C:\Windows\System\PVxPHUK.exe
  2⤵
  PID:9872
- C:\Windows\System\kDHHxeu.exe
  C:\Windows\System\kDHHxeu.exe
  2⤵
  PID:9968
- C:\Windows\System\OIynqsl.exe
  C:\Windows\System\OIynqsl.exe
  2⤵
  PID:10064
- C:\Windows\System\mSNLovE.exe
  C:\Windows\System\mSNLovE.exe
  2⤵
  PID:9956
- C:\Windows\System\isDKeHw.exe
  C:\Windows\System\isDKeHw.exe
  2⤵
  PID:10156
- C:\Windows\System\XRMsPFw.exe
  C:\Windows\System\XRMsPFw.exe
  2⤵
  PID:10188
- C:\Windows\System\seeulQT.exe
  C:\Windows\System\seeulQT.exe
  2⤵
  PID:10216
- C:\Windows\System\cvBijkz.exe
  C:\Windows\System\cvBijkz.exe
  2⤵
  PID:9116
- C:\Windows\System\ySMuSbk.exe
  C:\Windows\System\ySMuSbk.exe
  2⤵
  PID:9424
- C:\Windows\System\DCuhglM.exe
  C:\Windows\System\DCuhglM.exe
  2⤵
  PID:7816
- C:\Windows\System\sisektD.exe
  C:\Windows\System\sisektD.exe
  2⤵
  PID:9036
- C:\Windows\System\TwqecjB.exe
  C:\Windows\System\TwqecjB.exe
  2⤵
  PID:8352
- C:\Windows\System\ptOgOeV.exe
  C:\Windows\System\ptOgOeV.exe
  2⤵
  PID:9444
- C:\Windows\System\XqhBrfs.exe
  C:\Windows\System\XqhBrfs.exe
  2⤵
  PID:9304
- C:\Windows\System\zVnrodp.exe
  C:\Windows\System\zVnrodp.exe
  2⤵
  PID:9476
- C:\Windows\System\UcVHLeW.exe
  C:\Windows\System\UcVHLeW.exe
  2⤵
  PID:9600
- C:\Windows\System\fNpyicq.exe
  C:\Windows\System\fNpyicq.exe
  2⤵
  PID:9548
- C:\Windows\System\QXRVlCv.exe
  C:\Windows\System\QXRVlCv.exe
  2⤵
  PID:9376
- C:\Windows\System\jBywjWV.exe
  C:\Windows\System\jBywjWV.exe
  2⤵
  PID:9592
- C:\Windows\System\jWdbAXE.exe
  C:\Windows\System\jWdbAXE.exe
  2⤵
  PID:9940
- C:\Windows\System\kkChnGf.exe
  C:\Windows\System\kkChnGf.exe
  2⤵
  PID:9812
- C:\Windows\System\buCqhAg.exe
  C:\Windows\System\buCqhAg.exe
  2⤵
  PID:9796
- C:\Windows\System\pesDoec.exe
  C:\Windows\System\pesDoec.exe
  2⤵
  PID:9760
- C:\Windows\System\eJNYrKr.exe
  C:\Windows\System\eJNYrKr.exe
  2⤵
  PID:10148
- C:\Windows\System\zNSDSav.exe
  C:\Windows\System\zNSDSav.exe
  2⤵
  PID:10016
- C:\Windows\System\mEYegeJ.exe
  C:\Windows\System\mEYegeJ.exe
  2⤵
  PID:10116
- C:\Windows\System\uPxsgUN.exe
  C:\Windows\System\uPxsgUN.exe
  2⤵
  PID:9988
- C:\Windows\System\WzYRDgK.exe
  C:\Windows\System\WzYRDgK.exe
  2⤵
  PID:10204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AFnaYWD.exe

Filesize
1.1MB

MD5
2e15ee002ab4a20ea751f4b20b6a8d7d

SHA1
39498d59ec6198f8836c19a7b32c3b4e7a8d1721

SHA256
00974452b3001421ab61b92d51376295468f5c2ad451d29250f267f115525a5e

SHA512
0757aa3683618a8941cb29e27059b4ba173f3c8d437d8925a2a0499acc3a57cbb051526c02cecae7cd3f4040a978727420c8146a92c6ae02568c8fc145ad2b9e

Download Submit
C:\Windows\system\DCSztzv.exe

Filesize
1.1MB

MD5
45589bae83bed06467cff478404e35e7

SHA1
8eadd3ec3927fa6ac3082581f920866576dd11c5

SHA256
9d981be8f0665eb306b849a597d063fb1136e2e91364b23a4c26c60a2865ca67

SHA512
aead3e5415c4261588af5b45767599aa105334f66ca169a65d36524e0f1faf59867a5c850f3fb7e508f936b20fec8e4f8f2e119555b2cf9a4a7525627bb07c6b

Download Submit
C:\Windows\system\ErmqmWf.exe

Filesize
1.1MB

MD5
f49eccc6a83034092a2e4b4aa6e57b1a

SHA1
bf873fa92fb82e375f6551cf111e3bd159e6af1d

SHA256
f94399c91030dacd94de35e77f94d6ed53e057b2c70aa80acfdcce2ab9913e85

SHA512
41614746b5ef92c5bde596bae4a453ef697b352b9c0f5e371b2aef00ecc66ad85b740dcaa67ce778c9336d6c7ae33de986879410a82af210067bdb609403b201

Download Submit
C:\Windows\system\KCyNbSG.exe

Filesize
1.1MB

MD5
c58e8c6fa0c22a4bce1ff9158489dfad

SHA1
5ab7c60278829ef3b9f4a972cdaed0b3cc745479

SHA256
3f3003599da8ff11e913c42a978990dc7aed6f368259833a5725fcfad1c8f193

SHA512
fbb7eac739c75894bb8159141a20a7b2c37b31de778c074405cff6f3828f64ba34786c64011ba1e85f3286f831f58c9665dedd66b894399e952ff81624c6dc3a

Download Submit
C:\Windows\system\PiueOOe.exe

Filesize
1.1MB

MD5
c1a287cf105065a661e6dbcdfe841ebd

SHA1
deaaf19b3d95543efe2ee0771261774cf22d1aee

SHA256
85561979c858b85747f9a07a507cbceae87c425df712c30532524e7affa4bd4c

SHA512
b3b55a1dfed33fe239a494dad700a1ac6bcbaa330a142065e224b60e3954bd37f26eed253ea3933dd725a6b99f38824921bff8a5d447ba64bb75ab626698aab9

Download Submit
C:\Windows\system\PmEVJKD.exe

Filesize
1.1MB

MD5
3c93784d903bd0b6e90f1926f9fa1242

SHA1
4523eaeb1d4ddc3e2fcfa791a30b83209aa1d913

SHA256
257d03bb30ec26d43d938b9c89985afb3dff0812091869a773d0fc92af8b280c

SHA512
c63fa3f30656a37b95b9b8355e8647dd4b6ccae9e94f0d1c58a7c747282e7b88204fd86c1e408a3aba906a7596b68725305026bc30979edbba082e1fa6457d02

Download Submit
C:\Windows\system\Thtzpgy.exe

Filesize
1.1MB

MD5
264143ea7736a54895b10cf3a6a4c37b

SHA1
0ae7d2dcb8a6ff26c938ec3a1cd6a5aa74ec8f0d

SHA256
dc708ac81b8afa3124807bfa69a1e21b0263e1dd0c6882604a2c6a6a105b8af6

SHA512
5e12d117825ac02babcdb5721d1626ea64b42cf8b9e0f02185fe1bb0d56a582b3342b818deb20dae892bf664cf13ae42dea40afc91d3c970a9a8895b6289b9e6

Download Submit
C:\Windows\system\TmHpkGz.exe

Filesize
1.1MB

MD5
a878b680623ee94b27d5edfc1a549b40

SHA1
65616fc9a033c7b87101e605eb444d22dd41a34c

SHA256
7526ee847ddba86e4ed2a3d7dc849705518d3a60cd2549d959dc5ef4daed83fa

SHA512
a41b664c68caf98c62fb81f5780f63fa8f3b0c94b645007896b3221ed533911a53df71a0cfdc6d2eb3370248d9496f6f67043fd54c24d41c2a06a2a329943ede

Download Submit
C:\Windows\system\UJaywch.exe

Filesize
1.1MB

MD5
f5f5379f706c6856e9b8d70f7d094c88

SHA1
f1fa95dff0ea799c21ef5d6de48c9b4f2e70cf06

SHA256
da61ff8ce55739eb8269349e79bbf10bb065adb0d2e162009d08c4291ab40771

SHA512
4c4642ea4b8f969da8edca22cad4b1b0ded840010c9d691787f5b579cdba452fe1e605a1fa7c15734652c4bbdd8fc9d3a4cb3595fe4eaa9ce4ee961afdfffe2d

Download Submit
C:\Windows\system\UdLVitb.exe

Filesize
1.1MB

MD5
fd1d975919ae9186712faf35f55017f3

SHA1
f2a017bfca93a964c4b7b10182b7ef2afb2c91cc

SHA256
570bece2217c31da7bd653ba21121ab70441f92fbb92a5f0770f168d9fc09315

SHA512
ea17b15ccb008c5cbde6266440fb76a5fde8dbcefae3fcdb9ce0ceada6df38a786e73ad22ecb7ed495b31443799dcac44a8a6bcd6bc7476e217fb6cc69d12681

Download Submit
C:\Windows\system\UhiCUWW.exe

Filesize
1.1MB

MD5
94966a5a8351ccbb57f062cd4383f3cf

SHA1
f4d5df394fed2b146b150822e961e986dc987f03

SHA256
92459d090724bd0c6f3cc0c095f88bad3d7c640dcc6c8eb6040988b491b526f8

SHA512
e9e0bd06284d5312f8838431c45ba096a8862505351a8706b764d34d58bec18c492dc8b9d6f793af32261fbdc76ffb4448e802fd5a2815a0b30e1cf8f2f32995

Download Submit
C:\Windows\system\VVcAgKS.exe

Filesize
1.1MB

MD5
3b522317f4f6d428af365a666f21de0f

SHA1
fde78e158b75087f50d64adc39d16b39facd0e48

SHA256
0f9030fbd42add0b535d3f2184969719444f97d5cff665fed092ae497301862a

SHA512
84194216bcfbcd4f237ef7430bb899382b6fa6790055566062b7b0775b5c278f770acbeccafefafa131c62a52560c29196385e3a94d6478d91889b3ff18f981c

Download Submit
C:\Windows\system\WXrfGGu.exe

Filesize
1.1MB

MD5
3562e7f87892460dad3bd7262de75f6e

SHA1
eeb6773e75d03e760a0260ccd72671bcbc4d1a70

SHA256
12861c71d72e4fc4331a540b07135c8ef7f22b4e8d699ed9e4d6d3f92a8cee90

SHA512
4c58c762e93442eb3c70e4327e10559522251107ba32d918a227a0567e75b1202bfd5fc64ab86f5c3a422c3fa369fc2846cd9d9e0c5b91d8697860fda8c1da6f

Download Submit
C:\Windows\system\aAhERCP.exe

Filesize
1.1MB

MD5
b154831588834f50241a5c9af9686610

SHA1
278e0a16777a6c8c2c618671d1718a379bed9dbd

SHA256
fa3060e690a184fce3913f57008c985aadb8506f37af87e7a8c6336987a633e0

SHA512
e53ae7619a24a81f76902fe1c7e00f3f7d1caa8ec3d0820af67281b5ab0ce6e019a24ed6d728570acff3cc02251deccd0079c10bdc348f4b48b94d1c8e84c9fe

Download Submit
C:\Windows\system\dAmyVzU.exe

Filesize
1.1MB

MD5
63f134df936068e42788737d543467a1

SHA1
50fd3d6c93c81656d6948cf313428899950939aa

SHA256
4b638975ee19412d6ea98fc8500f90cf2e88850d4a7a3f2eaa8301faeaf03319

SHA512
4fb55a0da82ed12ffa9bfc77d1dd35b7fc427574b59add978f10e0ec708c2248ef24e283c4a3330e3b4961cbf81ef35aaef9bb5da513b69b5490763239b4846f

Download Submit
C:\Windows\system\dfsWSlx.exe

Filesize
1.1MB

MD5
3b36a25fb04274c4ee8450965747f264

SHA1
14ecdc27a7b4c860f63a952b74f27fc62f06de3f

SHA256
b6d40aea6cbdcb70e35cbf1994cefef6f5d21d032aeb76cdcac7f0deb1f6b3e9

SHA512
31066ea85cded88615f8a0afb552b1159c26529304b2c0948bb192de2956e1e9f63037d24b5a1998af1bf0a1e701f03c8beae1e5cd0df3b2b994fd9ff56ede90

Download Submit
C:\Windows\system\eEcvyrM.exe

Filesize
1.1MB

MD5
faf61acb49e186588c020ea4cd6fead1

SHA1
132aeffe1fcf6f541da0a9a2397a018e5470e9f1

SHA256
24a15088c351cc6e709297d3fff916dac85559534038c1d01a7ceda8889ac2e8

SHA512
3796ff9e3fb6d3f7d9070d96a5e1ec7a9d33cad7a075a5274ab93c7e512a34739db5fa8b505a1771f351003951d5002a2ea7bf010e19d76ec1bc19074dcd0a8a

Download Submit
C:\Windows\system\gwacxGE.exe

Filesize
1.1MB

MD5
5b7cb277f48b881d9ef92447576fdfe0

SHA1
c7ee7547fe3b17407ced68b2c5eb514f3cd4f3fd

SHA256
e020ec05577f5fcf3099c124021da44e9300c36d8abbd4c22ff5ac2d7c9523f1

SHA512
a9b667171491d82e7cf2381ac45ab961179f433c775bcde8a2031a2ea1aa79fd72b1887f48dca19aa5d9556416f5abfaa470c9a453df1a8f3cf7870ca28a9dea

Download Submit
C:\Windows\system\mCXkzrB.exe

Filesize
1.1MB

MD5
85d563b72da825b4c81ca6161d931733

SHA1
5947c8e2dacb3654142c0ceb507cf243e7b354b7

SHA256
67f71840c2f8e2997c495adfb9e7f2a1aed14fe6d166a324821f6a88d2126c81

SHA512
1f3b1401cbe69071876f582ca39d14239685c61001afcc31454f2e0312110653c8fc8dd9d9e8bf6529af79614273e60df6f38b32142218b31e0305b50759efc8

Download Submit
C:\Windows\system\rblHLdI.exe

Filesize
1.1MB

MD5
064be5152ab236bd8633a30a4d0e4da8

SHA1
f76e157892fcade1bfcc4cfaaced3f7e4093f3f7

SHA256
eb7b5327ea63e61506c44851744fb1a85fe6663696f2f16caf3d909ae79d4c83

SHA512
a1696df9574f77f4287582864b528a6d522732d36b1579002026931b43f67c2ce87604b82f052f66bf9d5f27d954d26cf1ee288be73d913d12c95761a0b35206

Download Submit
C:\Windows\system\sEJcyTx.exe

Filesize
1.1MB

MD5
86a564357552fe2c8e7fe4fd1e47330e

SHA1
e864be295d20564a0596d45b2e875163c4b03ef8

SHA256
0bc38f12502a59deb32a0350253683c8acbce246d5bc34d7ee82a945375cb1c4

SHA512
52c384daa8cd5b0baba46a361159b3c01c475f479b77d8bda93772e61d0c48243021c082b26f103a1a3a7185f280d6fd27a65c281c246835d3724b1eb534457c

Download Submit
C:\Windows\system\swUUGDS.exe

Filesize
1.1MB

MD5
5b781d1db574897e80ee8a427096a755

SHA1
2a2a1eec8449ab9c7d2057670453a8cd1181ec6d

SHA256
f4f7f61d2afe053907d323c0d027799c9f1e529e0b6c984ac19339b8effaf8ba

SHA512
3d1d6e88e816add42f9b5116e1531fcb5694719f96dc72ca7f1e01366fd0e42716f0aa3a7238f482b499b58383bc3bd193ea94b1321e6e8fb603a37660955db5

Download Submit
C:\Windows\system\yPfMbyJ.exe

Filesize
1.1MB

MD5
1d465559a2044c02486966c30bcf1426

SHA1
5abc77aabf1a9ed9608f83f5540ec614535eaf59

SHA256
27c2bcb4b1b9e36f53373cc6049953fc9c49e4732efe0181c071672bdb2a685c

SHA512
77d6252918e31789b18a5107e9d741b8d50fe8c6c55f342930a620193848420fdf27f08b555986591671a47f1f4c373b9743e94fc8155d757a8b083cd6020588

Download Submit
C:\Windows\system\ybwTqFL.exe

Filesize
1.1MB

MD5
8fa5e3389f87898702d57946d151b5c3

SHA1
ef9aae1995e14147770996061c39cf4da7dacec9

SHA256
5af6b3fdb76f5600063a220af6c5df0ff103baebbc8742a7b0e180c74f1e010b

SHA512
86c3dd908f88e6f6893db2e7adf490c7105964d47c9bc7182c1bb3d4a8d60159f937d9ba167bfd650847853848a83204a1f1a6d61f41bb158f7b1f413420dd5a

Download Submit
C:\Windows\system\zpzeojR.exe

Filesize
1.1MB

MD5
a266295e874fd7d29d4e978938e46f15

SHA1
b66ee47f419ab66391e2acf422e56204def016c8

SHA256
56832dcf69f47084bb4b9f899fbd8f894064716200bfa4216d2c5b5fa8c44b77

SHA512
f1873bc8ff689c6fa7d0aebf282466a370d18368204ed77a182d320656d3a4552a25071bf03f562c59bf683d33237f97aab8a3553ef824f7c37a160cab97e691

Download Submit
\Windows\system\APESjFM.exe

Filesize
1.1MB

MD5
ab8db5dd733292a5eed00d2e45196ae8

SHA1
1aaf20854b8a59034b265645deecf5b780fffa64

SHA256
33742258cb324dcbf32e102aa78355571c3791266f173191395b33612882d768

SHA512
c15b063ae7473676b50d9c856b5097a465e6c754ac5b1a1971de0ac390a00a4cc6d833d5fff81ab7ca7e8e951d00e1c15786850977811c3fafd143070973fa30

Download Submit
\Windows\system\HuwPDsR.exe

Filesize
1.1MB

MD5
fc36b96ec90f7ab8c89afb4d2b2d358c

SHA1
a14664919b073ab0f235fa1e8c12fa0701bac8fe

SHA256
ee0d8eb6ceb155ea043041276e2eecb4f58cbf130a3897f8707540c928034bbe

SHA512
5f65f20201426d83613d909b46f351979b01edf2c1f4da43026089a203eeec573387761212e1d38f2aae54f7ea1d2bcc473d7fa3736047ef6be886a0531d90ee

Download Submit
\Windows\system\JYmvALH.exe

Filesize
1.1MB

MD5
32ede3b0a172e3d981eaca3180472b22

SHA1
31c6367e3b05ad86eaa9a44603188efe631257ae

SHA256
53e6badf4d8eb473ee5a0682b18f53e3595d8a39a1476469a6bb1ad140c34b02

SHA512
8622ecba1dd1d682278d28094297b88400070a38fdae97f5f08982cf9b376a3cf7f8dc44470e16f17d70bd19e3504f105f97c4ebb71fe4a85152fb8c689c3a73

Download Submit
\Windows\system\kVrMWSM.exe

Filesize
1.1MB

MD5
3c9f9999cddaf9e49c5aaca85f8c9acd

SHA1
718ff1a0752615a3ec75f56041bf8fe3bc3139c3

SHA256
f2641dafe941cad8b6a87ff971e5212667c4d583e38519b7556db6ba2d35e14f

SHA512
03e27e4b2bbb6fb379e3b4c305f84feaddae48e1db0b07458fce42ecd917386f8bdedd314aaf5ab1a9ce6d0eba2689a1bfd926a73d02ac8f9b7b8d53451d59f9

Download Submit
\Windows\system\ummZFsB.exe

Filesize
1.1MB

MD5
0b341cd7cba8ac2556411fa9e356cc14

SHA1
4cea37c17fc068f4660bc115806467aee452ed29

SHA256
1530d38db5296b180b2a88b905a2fff1021e5f8420bdf5218048a161aec6e4c5

SHA512
fcaa6dda3fe3a75498dfc5d5842129825f89d054adc6d8efc8a05c8a6cee022a8157899c3d62219d908915e41197664fc9f110cd46d0bc3c4cf978b8c2f61ee2

Download Submit
\Windows\system\wSMCJwe.exe

Filesize
1.1MB

MD5
a47dab2cc2af6c2c0221e6772d1e3a80

SHA1
8d834e59a041789211da2aac5c006ae41d9ffc3b

SHA256
c2b107b052bb3dd2ac2270178f9c93a4535abf375f42ab2aed9b889ab968a343

SHA512
052096f293544bfd23b4fe58b29032bceb00cbc1d5e81ee8f6ae538f4fb8db1436136b7fd3e76d509833363a147fd5eb75d82c5215b0571979e2dc0d614e8c38

Download Submit
\Windows\system\xVZcvaT.exe

Filesize
1.1MB

MD5
aced6f064d96e81df2accd8b4f53bf9f

SHA1
e8c67cca35bfee2279b74af7ac0f56fdc21a02ac

SHA256
7755a5458ff45117d090ac7d3cbb00c4182fe2de6f84a60dfba03f9a865d7ecb

SHA512
80fb0bdd35b5d9f143166adf5d4a9d357f6827d84310b2ab7023cea24e409936c6a30ca91fa4fc00ebdc6af7482ed632024b90666a4031e780ad37b3ae00ef4a

Download Submit
memory/1608-69-0x000000013FA20000-0x000000013FD71000-memory.dmp

Filesize
3.3MB

Download
memory/1608-3907-0x000000013FA20000-0x000000013FD71000-memory.dmp

Filesize
3.3MB

Download
memory/1608-379-0x000000013FA20000-0x000000013FD71000-memory.dmp

Filesize
3.3MB

Download
memory/1656-3910-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/1656-73-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2028-3975-0x000000013F930000-0x000000013FC81000-memory.dmp

Filesize
3.3MB

Download
memory/2028-98-0x000000013F930000-0x000000013FC81000-memory.dmp

Filesize
3.3MB

Download
memory/2072-3261-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2072-104-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2072-3968-0x000000013F520000-0x000000013F871000-memory.dmp

Filesize
3.3MB

Download
memory/2244-51-0x000000013F5E0000-0x000000013F931000-memory.dmp

Filesize
3.3MB

Download
memory/2244-3909-0x000000013F5E0000-0x000000013F931000-memory.dmp

Filesize
3.3MB

Download
memory/2244-109-0x000000013F5E0000-0x000000013F931000-memory.dmp

Filesize
3.3MB

Download
memory/2588-79-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2588-35-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2588-3683-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2660-41-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2660-3688-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2660-97-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-72-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-3914-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-497-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-45-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-1611-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-93-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2740-0-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2740-29-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2740-46-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-11-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-33-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2740-103-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2740-99-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-23-0x000000013F380000-0x000000013F6D1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-75-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-74-0x000000013FFB0000-0x0000000140301000-memory.dmp

Filesize
3.3MB

Download
memory/2740-603-0x000000013F090000-0x000000013F3E1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-1610-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-53-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-3172-0x0000000001E70000-0x00000000021C1000-memory.dmp

Filesize
3.3MB

Download
memory/2744-7-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Filesize
3.3MB

Download
memory/2744-40-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Filesize
3.3MB

Download
memory/2756-27-0x000000013F380000-0x000000013F6D1000-memory.dmp

Filesize
3.3MB

Download
memory/2756-62-0x000000013F380000-0x000000013F6D1000-memory.dmp

Filesize
3.3MB

Download
memory/2756-3662-0x000000013F380000-0x000000013F6D1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-50-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-14-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-3618-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2908-3635-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2908-21-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2908-54-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2928-3262-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/2928-105-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/2928-3967-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download