xmrig | 664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
Size

1.4MB
MD5

779c3a09f233cec5e7ea097e7032c38b
SHA1

5ff879ebc7c57ac19dc39d4906f47b20a00d00b1
SHA256

664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137
SHA512

63a0c33ae6e0a065dbe78cb168bab8fdec0f6f429ac27534c808ac843271762335fb2da9d2588a758466d82655d14077573a6daa7877fb5bda37407e0aadbb01
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcs:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5m

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012281-5.dat	xmrig
behavioral1/files/0x00070000000186f8-9.dat	xmrig
behavioral1/files/0x0006000000018731-13.dat	xmrig
behavioral1/files/0x0006000000018742-18.dat	xmrig
behavioral1/files/0x0006000000018781-22.dat	xmrig
behavioral1/files/0x000600000001878c-25.dat	xmrig
behavioral1/files/0x0009000000018bf3-30.dat	xmrig
behavioral1/files/0x0007000000019438-34.dat	xmrig
behavioral1/files/0x000500000001945c-41.dat	xmrig
behavioral1/files/0x0005000000019496-49.dat	xmrig
behavioral1/files/0x00050000000194d0-57.dat	xmrig
behavioral1/files/0x00050000000194fc-65.dat	xmrig
behavioral1/files/0x00050000000195e6-85.dat	xmrig
behavioral1/files/0x0005000000019621-98.dat	xmrig
behavioral1/files/0x0005000000019629-118.dat	xmrig
behavioral1/files/0x000500000001967f-129.dat	xmrig
behavioral1/files/0x000500000001963b-125.dat	xmrig
behavioral1/files/0x000500000001962b-121.dat	xmrig
behavioral1/files/0x0005000000019627-113.dat	xmrig
behavioral1/files/0x0005000000019625-110.dat	xmrig
behavioral1/files/0x0005000000019623-105.dat	xmrig
behavioral1/files/0x0005000000019622-102.dat	xmrig
behavioral1/files/0x000500000001961f-93.dat	xmrig
behavioral1/files/0x000500000001961d-90.dat	xmrig
behavioral1/files/0x00050000000195a7-81.dat	xmrig
behavioral1/files/0x000500000001957e-77.dat	xmrig
behavioral1/files/0x000500000001952f-73.dat	xmrig
behavioral1/files/0x0005000000019506-69.dat	xmrig
behavioral1/files/0x00050000000194ef-61.dat	xmrig
behavioral1/files/0x00050000000194ad-53.dat	xmrig
behavioral1/files/0x0005000000019467-45.dat	xmrig
behavioral1/files/0x0006000000019456-37.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2536	cVVcVPn.exe
1972	mbsOeHE.exe
1960	uYoVzst.exe
3064	pDVHagS.exe
2332	CfFehco.exe
2356	buNpqGx.exe
2412	pfCtpJp.exe
1636	unNwKmt.exe
2736	AQuBkWX.exe
2864	UdVLbBS.exe
2848	afIXadz.exe
2596	roSyLGk.exe
2896	TzreIhI.exe
2888	CkMuFUy.exe
2940	bOPwDJc.exe
2760	AmpQRtW.exe
2700	tgWNjBQ.exe
2600	gKiJnpW.exe
2660	IKPWbVU.exe
2324	MYwERbr.exe
2308	OHkacUq.exe
784	qdHKQSE.exe
1804	XcNynBC.exe
1372	yNMMeim.exe
2928	velOLtv.exe
464	othWFek.exe
1548	WdgUlrh.exe
284	yyfqgJp.exe
1408	zPMeuyc.exe
2140	SazzcTb.exe
2964	ZcMVkVg.exe
2088	ZQPgghx.exe
1980	odzHMmM.exe
2132	xoEmtBb.exe
2092	lStknDe.exe
2232	IbQNjQm.exe
1204	qgWdPzn.exe
2300	xyxWQXG.exe
1712	QsHLhdq.exe
652	cARoTwJ.exe
944	ybqDjje.exe
1924	BoeNIFm.exe
2336	beHNKOY.exe
1216	JiuzOHC.exe
1608	TISOmQs.exe
2252	TrcIVWL.exe
300	eMgSJeJ.exe
2084	ppgsqRf.exe
808	jdwluWG.exe
2476	wNXhxiH.exe
2296	FDCSzNk.exe
1376	rGwEoSN.exe
884	smPVzeE.exe
1664	ymofTpv.exe
580	cayBaML.exe
2204	gshgGfn.exe
2480	rherfSX.exe
2212	dUMeyAK.exe
2288	pBExEZg.exe
2264	zEImIyA.exe
1816	nGkPbYc.exe
872	JCiHQUH.exe
2292	WrWFPcS.exe
1064	QRhIaMp.exe

Loads dropped DLL 64 IoCs

pid	Process
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SeogqOK.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\sCDZVaB.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ppgsqRf.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\SxVUSzX.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\BFotWiI.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\BwOKxbm.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\hFgOdtg.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ShSPACk.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\PpZrzsm.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\KoNWVFA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\TzSkEmA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\GGFInHv.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\EQjLWKW.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ERghary.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\LSSAlmA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\BZXCmRy.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\CYVuHka.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\tRwYxrL.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\aIClauh.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ULMUPhp.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\jKaJAKq.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\zTgGQqz.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\aBnCxYm.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\AQeXGKU.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\MtMXsFd.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\WSlVzea.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\TFFlMph.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\RwnVXLw.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ZkwpNdD.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\mXuuCGo.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\iEsnMbx.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ztnpxGA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\YSOYOOA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\HbgwjcM.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\yBEenJq.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\BbhktVh.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\zfpZTSp.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\yslYpHe.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\RskLFQR.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\oWCGdTV.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\AGQErYD.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\SvBbqzR.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\qmVzLiI.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\YNGbSZJ.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\NwtDwgM.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\haSbiAP.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\Bnllpki.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\MFbomIq.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\ucBooqe.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\NHpcoYk.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\qZgzGhX.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\wiTNhOZ.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\lWGmXYy.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\FZcGDNX.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\SFrzVQT.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\XkaYqGA.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\GyyTtlO.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\DtYVfBV.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\fSfPROV.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\YeGUTrP.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\nytXUHo.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\WFhAIfn.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\nnDuFfJ.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
File created	C:\Windows\System\RnQjDVj.exe	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2536	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	31
PID 2672 wrote to memory of 2536	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	31
PID 2672 wrote to memory of 2536	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	31
PID 2672 wrote to memory of 1972	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	32
PID 2672 wrote to memory of 1972	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	32
PID 2672 wrote to memory of 1972	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	32
PID 2672 wrote to memory of 1960	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	33
PID 2672 wrote to memory of 1960	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	33
PID 2672 wrote to memory of 1960	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	33
PID 2672 wrote to memory of 3064	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	34
PID 2672 wrote to memory of 3064	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	34
PID 2672 wrote to memory of 3064	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	34
PID 2672 wrote to memory of 2332	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	35
PID 2672 wrote to memory of 2332	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	35
PID 2672 wrote to memory of 2332	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	35
PID 2672 wrote to memory of 2356	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	36
PID 2672 wrote to memory of 2356	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	36
PID 2672 wrote to memory of 2356	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	36
PID 2672 wrote to memory of 2412	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	37
PID 2672 wrote to memory of 2412	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	37
PID 2672 wrote to memory of 2412	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	37
PID 2672 wrote to memory of 1636	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	38
PID 2672 wrote to memory of 1636	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	38
PID 2672 wrote to memory of 1636	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	38
PID 2672 wrote to memory of 2736	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	39
PID 2672 wrote to memory of 2736	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	39
PID 2672 wrote to memory of 2736	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	39
PID 2672 wrote to memory of 2864	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	40
PID 2672 wrote to memory of 2864	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	40
PID 2672 wrote to memory of 2864	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	40
PID 2672 wrote to memory of 2848	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	41
PID 2672 wrote to memory of 2848	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	41
PID 2672 wrote to memory of 2848	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	41
PID 2672 wrote to memory of 2596	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	42
PID 2672 wrote to memory of 2596	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	42
PID 2672 wrote to memory of 2596	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	42
PID 2672 wrote to memory of 2896	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	43
PID 2672 wrote to memory of 2896	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	43
PID 2672 wrote to memory of 2896	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	43
PID 2672 wrote to memory of 2888	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	44
PID 2672 wrote to memory of 2888	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	44
PID 2672 wrote to memory of 2888	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	44
PID 2672 wrote to memory of 2940	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	45
PID 2672 wrote to memory of 2940	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	45
PID 2672 wrote to memory of 2940	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	45
PID 2672 wrote to memory of 2760	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	46
PID 2672 wrote to memory of 2760	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	46
PID 2672 wrote to memory of 2760	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	46
PID 2672 wrote to memory of 2700	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	47
PID 2672 wrote to memory of 2700	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	47
PID 2672 wrote to memory of 2700	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	47
PID 2672 wrote to memory of 2600	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	48
PID 2672 wrote to memory of 2600	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	48
PID 2672 wrote to memory of 2600	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	48
PID 2672 wrote to memory of 2660	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	49
PID 2672 wrote to memory of 2660	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	49
PID 2672 wrote to memory of 2660	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	49
PID 2672 wrote to memory of 2324	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	50
PID 2672 wrote to memory of 2324	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	50
PID 2672 wrote to memory of 2324	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	50
PID 2672 wrote to memory of 2308	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	51
PID 2672 wrote to memory of 2308	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	51
PID 2672 wrote to memory of 2308	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	51
PID 2672 wrote to memory of 784	2672	664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe	52

C:\Users\Admin\AppData\Local\Temp\664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe
"C:\Users\Admin\AppData\Local\Temp\664b5a208175ac3512a41c70a705b47a69745f21f91b0624fdd8c68e67927137.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System\cVVcVPn.exe
  C:\Windows\System\cVVcVPn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\mbsOeHE.exe
  C:\Windows\System\mbsOeHE.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\uYoVzst.exe
  C:\Windows\System\uYoVzst.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\pDVHagS.exe
  C:\Windows\System\pDVHagS.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\CfFehco.exe
  C:\Windows\System\CfFehco.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\buNpqGx.exe
  C:\Windows\System\buNpqGx.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\pfCtpJp.exe
  C:\Windows\System\pfCtpJp.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\unNwKmt.exe
  C:\Windows\System\unNwKmt.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\AQuBkWX.exe
  C:\Windows\System\AQuBkWX.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\UdVLbBS.exe
  C:\Windows\System\UdVLbBS.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\afIXadz.exe
  C:\Windows\System\afIXadz.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\roSyLGk.exe
  C:\Windows\System\roSyLGk.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\TzreIhI.exe
  C:\Windows\System\TzreIhI.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\CkMuFUy.exe
  C:\Windows\System\CkMuFUy.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bOPwDJc.exe
  C:\Windows\System\bOPwDJc.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\AmpQRtW.exe
  C:\Windows\System\AmpQRtW.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\tgWNjBQ.exe
  C:\Windows\System\tgWNjBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\gKiJnpW.exe
  C:\Windows\System\gKiJnpW.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\IKPWbVU.exe
  C:\Windows\System\IKPWbVU.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\MYwERbr.exe
  C:\Windows\System\MYwERbr.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\OHkacUq.exe
  C:\Windows\System\OHkacUq.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\qdHKQSE.exe
  C:\Windows\System\qdHKQSE.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\XcNynBC.exe
  C:\Windows\System\XcNynBC.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\yNMMeim.exe
  C:\Windows\System\yNMMeim.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\velOLtv.exe
  C:\Windows\System\velOLtv.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\othWFek.exe
  C:\Windows\System\othWFek.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\WdgUlrh.exe
  C:\Windows\System\WdgUlrh.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\yyfqgJp.exe
  C:\Windows\System\yyfqgJp.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\zPMeuyc.exe
  C:\Windows\System\zPMeuyc.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\SazzcTb.exe
  C:\Windows\System\SazzcTb.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ZcMVkVg.exe
  C:\Windows\System\ZcMVkVg.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ZQPgghx.exe
  C:\Windows\System\ZQPgghx.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\odzHMmM.exe
  C:\Windows\System\odzHMmM.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\xoEmtBb.exe
  C:\Windows\System\xoEmtBb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\lStknDe.exe
  C:\Windows\System\lStknDe.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\IbQNjQm.exe
  C:\Windows\System\IbQNjQm.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\qgWdPzn.exe
  C:\Windows\System\qgWdPzn.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\xyxWQXG.exe
  C:\Windows\System\xyxWQXG.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\QsHLhdq.exe
  C:\Windows\System\QsHLhdq.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\cARoTwJ.exe
  C:\Windows\System\cARoTwJ.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\ybqDjje.exe
  C:\Windows\System\ybqDjje.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\BoeNIFm.exe
  C:\Windows\System\BoeNIFm.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\beHNKOY.exe
  C:\Windows\System\beHNKOY.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\JiuzOHC.exe
  C:\Windows\System\JiuzOHC.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\TISOmQs.exe
  C:\Windows\System\TISOmQs.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\TrcIVWL.exe
  C:\Windows\System\TrcIVWL.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\eMgSJeJ.exe
  C:\Windows\System\eMgSJeJ.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\ppgsqRf.exe
  C:\Windows\System\ppgsqRf.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\jdwluWG.exe
  C:\Windows\System\jdwluWG.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\wNXhxiH.exe
  C:\Windows\System\wNXhxiH.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\FDCSzNk.exe
  C:\Windows\System\FDCSzNk.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\rGwEoSN.exe
  C:\Windows\System\rGwEoSN.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\smPVzeE.exe
  C:\Windows\System\smPVzeE.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ymofTpv.exe
  C:\Windows\System\ymofTpv.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\cayBaML.exe
  C:\Windows\System\cayBaML.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\gshgGfn.exe
  C:\Windows\System\gshgGfn.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\rherfSX.exe
  C:\Windows\System\rherfSX.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\dUMeyAK.exe
  C:\Windows\System\dUMeyAK.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\pBExEZg.exe
  C:\Windows\System\pBExEZg.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zEImIyA.exe
  C:\Windows\System\zEImIyA.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\nGkPbYc.exe
  C:\Windows\System\nGkPbYc.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\JCiHQUH.exe
  C:\Windows\System\JCiHQUH.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\WrWFPcS.exe
  C:\Windows\System\WrWFPcS.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QRhIaMp.exe
  C:\Windows\System\QRhIaMp.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RYYlESg.exe
  C:\Windows\System\RYYlESg.exe
  2⤵
  PID:2392
- C:\Windows\System\PuKYrGX.exe
  C:\Windows\System\PuKYrGX.exe
  2⤵
  PID:1688
- C:\Windows\System\SxVUSzX.exe
  C:\Windows\System\SxVUSzX.exe
  2⤵
  PID:1976
- C:\Windows\System\taJBGVZ.exe
  C:\Windows\System\taJBGVZ.exe
  2⤵
  PID:2280
- C:\Windows\System\kOtRjWp.exe
  C:\Windows\System\kOtRjWp.exe
  2⤵
  PID:2124
- C:\Windows\System\WNEdFqf.exe
  C:\Windows\System\WNEdFqf.exe
  2⤵
  PID:1588
- C:\Windows\System\FXLLSqJ.exe
  C:\Windows\System\FXLLSqJ.exe
  2⤵
  PID:1716
- C:\Windows\System\qsHntoH.exe
  C:\Windows\System\qsHntoH.exe
  2⤵
  PID:1944
- C:\Windows\System\NftsyWN.exe
  C:\Windows\System\NftsyWN.exe
  2⤵
  PID:1996
- C:\Windows\System\QpkSZPC.exe
  C:\Windows\System\QpkSZPC.exe
  2⤵
  PID:2068
- C:\Windows\System\GGQXnJj.exe
  C:\Windows\System\GGQXnJj.exe
  2⤵
  PID:2804
- C:\Windows\System\cbEaXUZ.exe
  C:\Windows\System\cbEaXUZ.exe
  2⤵
  PID:1068
- C:\Windows\System\AGQErYD.exe
  C:\Windows\System\AGQErYD.exe
  2⤵
  PID:2172
- C:\Windows\System\LSvLpPw.exe
  C:\Windows\System\LSvLpPw.exe
  2⤵
  PID:2328
- C:\Windows\System\JjaqECn.exe
  C:\Windows\System\JjaqECn.exe
  2⤵
  PID:2000
- C:\Windows\System\dmXCoTV.exe
  C:\Windows\System\dmXCoTV.exe
  2⤵
  PID:2544
- C:\Windows\System\QXUyVDd.exe
  C:\Windows\System\QXUyVDd.exe
  2⤵
  PID:1364
- C:\Windows\System\ZfpZkFC.exe
  C:\Windows\System\ZfpZkFC.exe
  2⤵
  PID:3044
- C:\Windows\System\GcjCkLV.exe
  C:\Windows\System\GcjCkLV.exe
  2⤵
  PID:2452
- C:\Windows\System\dGtheFc.exe
  C:\Windows\System\dGtheFc.exe
  2⤵
  PID:2116
- C:\Windows\System\VMzbpWb.exe
  C:\Windows\System\VMzbpWb.exe
  2⤵
  PID:1060
- C:\Windows\System\jkXGqoD.exe
  C:\Windows\System\jkXGqoD.exe
  2⤵
  PID:1800
- C:\Windows\System\jwKJsiI.exe
  C:\Windows\System\jwKJsiI.exe
  2⤵
  PID:1648
- C:\Windows\System\slOWIBd.exe
  C:\Windows\System\slOWIBd.exe
  2⤵
  PID:3068
- C:\Windows\System\XNFyJMW.exe
  C:\Windows\System\XNFyJMW.exe
  2⤵
  PID:2056
- C:\Windows\System\ggKgsyO.exe
  C:\Windows\System\ggKgsyO.exe
  2⤵
  PID:2980
- C:\Windows\System\fHlIbtg.exe
  C:\Windows\System\fHlIbtg.exe
  2⤵
  PID:2316
- C:\Windows\System\bmaanSc.exe
  C:\Windows\System\bmaanSc.exe
  2⤵
  PID:2136
- C:\Windows\System\DVOnhhP.exe
  C:\Windows\System\DVOnhhP.exe
  2⤵
  PID:1652
- C:\Windows\System\UNoFVey.exe
  C:\Windows\System\UNoFVey.exe
  2⤵
  PID:2856
- C:\Windows\System\aZrTgYc.exe
  C:\Windows\System\aZrTgYc.exe
  2⤵
  PID:2704
- C:\Windows\System\gSxQaPE.exe
  C:\Windows\System\gSxQaPE.exe
  2⤵
  PID:2784
- C:\Windows\System\cGbiHIj.exe
  C:\Windows\System\cGbiHIj.exe
  2⤵
  PID:2584
- C:\Windows\System\PdRXgsv.exe
  C:\Windows\System\PdRXgsv.exe
  2⤵
  PID:2144
- C:\Windows\System\iWFHkKc.exe
  C:\Windows\System\iWFHkKc.exe
  2⤵
  PID:772
- C:\Windows\System\kEtNDEL.exe
  C:\Windows\System\kEtNDEL.exe
  2⤵
  PID:2832
- C:\Windows\System\WdCilfy.exe
  C:\Windows\System\WdCilfy.exe
  2⤵
  PID:2684
- C:\Windows\System\LPrsjOU.exe
  C:\Windows\System\LPrsjOU.exe
  2⤵
  PID:2076
- C:\Windows\System\eTkVowb.exe
  C:\Windows\System\eTkVowb.exe
  2⤵
  PID:1576
- C:\Windows\System\YIxDIzj.exe
  C:\Windows\System\YIxDIzj.exe
  2⤵
  PID:2072
- C:\Windows\System\MyNWPkg.exe
  C:\Windows\System\MyNWPkg.exe
  2⤵
  PID:1780
- C:\Windows\System\jAeJFJw.exe
  C:\Windows\System\jAeJFJw.exe
  2⤵
  PID:1356
- C:\Windows\System\ztgvakW.exe
  C:\Windows\System\ztgvakW.exe
  2⤵
  PID:2260
- C:\Windows\System\kpzHcBA.exe
  C:\Windows\System\kpzHcBA.exe
  2⤵
  PID:2836
- C:\Windows\System\rSlszrK.exe
  C:\Windows\System\rSlszrK.exe
  2⤵
  PID:1264
- C:\Windows\System\WFPBofu.exe
  C:\Windows\System\WFPBofu.exe
  2⤵
  PID:1040
- C:\Windows\System\cDZjbaD.exe
  C:\Windows\System\cDZjbaD.exe
  2⤵
  PID:1192
- C:\Windows\System\MKKDdez.exe
  C:\Windows\System\MKKDdez.exe
  2⤵
  PID:2208
- C:\Windows\System\lCtphnK.exe
  C:\Windows\System\lCtphnK.exe
  2⤵
  PID:2100
- C:\Windows\System\dNUBzjH.exe
  C:\Windows\System\dNUBzjH.exe
  2⤵
  PID:1592
- C:\Windows\System\kApqpzl.exe
  C:\Windows\System\kApqpzl.exe
  2⤵
  PID:756
- C:\Windows\System\reDHVDN.exe
  C:\Windows\System\reDHVDN.exe
  2⤵
  PID:1072
- C:\Windows\System\KQXvzqG.exe
  C:\Windows\System\KQXvzqG.exe
  2⤵
  PID:2616
- C:\Windows\System\LLiKZad.exe
  C:\Windows\System\LLiKZad.exe
  2⤵
  PID:2432
- C:\Windows\System\xOTxOPO.exe
  C:\Windows\System\xOTxOPO.exe
  2⤵
  PID:2876
- C:\Windows\System\LjiWiTi.exe
  C:\Windows\System\LjiWiTi.exe
  2⤵
  PID:1344
- C:\Windows\System\IQikHLD.exe
  C:\Windows\System\IQikHLD.exe
  2⤵
  PID:1832
- C:\Windows\System\oQqaUSW.exe
  C:\Windows\System\oQqaUSW.exe
  2⤵
  PID:536
- C:\Windows\System\woiDOOc.exe
  C:\Windows\System\woiDOOc.exe
  2⤵
  PID:3088
- C:\Windows\System\CYXLGoI.exe
  C:\Windows\System\CYXLGoI.exe
  2⤵
  PID:3108
- C:\Windows\System\HbgwjcM.exe
  C:\Windows\System\HbgwjcM.exe
  2⤵
  PID:3128
- C:\Windows\System\vqLpKYA.exe
  C:\Windows\System\vqLpKYA.exe
  2⤵
  PID:3144
- C:\Windows\System\TGQlIal.exe
  C:\Windows\System\TGQlIal.exe
  2⤵
  PID:3168
- C:\Windows\System\lrfZPtO.exe
  C:\Windows\System\lrfZPtO.exe
  2⤵
  PID:3184
- C:\Windows\System\IHKLgLy.exe
  C:\Windows\System\IHKLgLy.exe
  2⤵
  PID:3200
- C:\Windows\System\aWGwDmC.exe
  C:\Windows\System\aWGwDmC.exe
  2⤵
  PID:3248
- C:\Windows\System\MtMXsFd.exe
  C:\Windows\System\MtMXsFd.exe
  2⤵
  PID:3264
- C:\Windows\System\cOHwOQV.exe
  C:\Windows\System\cOHwOQV.exe
  2⤵
  PID:3284
- C:\Windows\System\aYejUEZ.exe
  C:\Windows\System\aYejUEZ.exe
  2⤵
  PID:3304
- C:\Windows\System\DokaMvD.exe
  C:\Windows\System\DokaMvD.exe
  2⤵
  PID:3328
- C:\Windows\System\IujGsfI.exe
  C:\Windows\System\IujGsfI.exe
  2⤵
  PID:3344
- C:\Windows\System\WouOTXh.exe
  C:\Windows\System\WouOTXh.exe
  2⤵
  PID:3360
- C:\Windows\System\wNUwYdk.exe
  C:\Windows\System\wNUwYdk.exe
  2⤵
  PID:3376
- C:\Windows\System\FPofBdH.exe
  C:\Windows\System\FPofBdH.exe
  2⤵
  PID:3392
- C:\Windows\System\wmKHnKU.exe
  C:\Windows\System\wmKHnKU.exe
  2⤵
  PID:3408
- C:\Windows\System\txFGjDY.exe
  C:\Windows\System\txFGjDY.exe
  2⤵
  PID:3432
- C:\Windows\System\VMeSpDp.exe
  C:\Windows\System\VMeSpDp.exe
  2⤵
  PID:3456
- C:\Windows\System\QIToNlk.exe
  C:\Windows\System\QIToNlk.exe
  2⤵
  PID:3472
- C:\Windows\System\KwtRKqI.exe
  C:\Windows\System\KwtRKqI.exe
  2⤵
  PID:3496
- C:\Windows\System\fomrRdz.exe
  C:\Windows\System\fomrRdz.exe
  2⤵
  PID:3512
- C:\Windows\System\aamtAqY.exe
  C:\Windows\System\aamtAqY.exe
  2⤵
  PID:3532
- C:\Windows\System\WSlVzea.exe
  C:\Windows\System\WSlVzea.exe
  2⤵
  PID:3556
- C:\Windows\System\FUZazZu.exe
  C:\Windows\System\FUZazZu.exe
  2⤵
  PID:3580
- C:\Windows\System\APuCTwv.exe
  C:\Windows\System\APuCTwv.exe
  2⤵
  PID:3600
- C:\Windows\System\ivbrtQL.exe
  C:\Windows\System\ivbrtQL.exe
  2⤵
  PID:3620
- C:\Windows\System\TMSTogk.exe
  C:\Windows\System\TMSTogk.exe
  2⤵
  PID:3636
- C:\Windows\System\usApOeA.exe
  C:\Windows\System\usApOeA.exe
  2⤵
  PID:3656
- C:\Windows\System\cTxwKhv.exe
  C:\Windows\System\cTxwKhv.exe
  2⤵
  PID:3672
- C:\Windows\System\KlpQvib.exe
  C:\Windows\System\KlpQvib.exe
  2⤵
  PID:3708
- C:\Windows\System\RpoxtRh.exe
  C:\Windows\System\RpoxtRh.exe
  2⤵
  PID:3728
- C:\Windows\System\cPIMUUe.exe
  C:\Windows\System\cPIMUUe.exe
  2⤵
  PID:3744
- C:\Windows\System\nyvUAlg.exe
  C:\Windows\System\nyvUAlg.exe
  2⤵
  PID:3760
- C:\Windows\System\TNgIKBq.exe
  C:\Windows\System\TNgIKBq.exe
  2⤵
  PID:3784
- C:\Windows\System\MEUkZnU.exe
  C:\Windows\System\MEUkZnU.exe
  2⤵
  PID:3800
- C:\Windows\System\uOHyxCd.exe
  C:\Windows\System\uOHyxCd.exe
  2⤵
  PID:3816
- C:\Windows\System\ExPvuVG.exe
  C:\Windows\System\ExPvuVG.exe
  2⤵
  PID:3844
- C:\Windows\System\GDDTPkQ.exe
  C:\Windows\System\GDDTPkQ.exe
  2⤵
  PID:3860
- C:\Windows\System\ylLnxTp.exe
  C:\Windows\System\ylLnxTp.exe
  2⤵
  PID:3884
- C:\Windows\System\UJHlPZi.exe
  C:\Windows\System\UJHlPZi.exe
  2⤵
  PID:3900
- C:\Windows\System\CutDzST.exe
  C:\Windows\System\CutDzST.exe
  2⤵
  PID:3924
- C:\Windows\System\PIUtVUQ.exe
  C:\Windows\System\PIUtVUQ.exe
  2⤵
  PID:3940
- C:\Windows\System\IEcjjPa.exe
  C:\Windows\System\IEcjjPa.exe
  2⤵
  PID:3956
- C:\Windows\System\jboNcRC.exe
  C:\Windows\System\jboNcRC.exe
  2⤵
  PID:3972
- C:\Windows\System\IrXVqhR.exe
  C:\Windows\System\IrXVqhR.exe
  2⤵
  PID:3988
- C:\Windows\System\YwLXUUN.exe
  C:\Windows\System\YwLXUUN.exe
  2⤵
  PID:4008
- C:\Windows\System\qvbkRZe.exe
  C:\Windows\System\qvbkRZe.exe
  2⤵
  PID:4028
- C:\Windows\System\yvGUtrx.exe
  C:\Windows\System\yvGUtrx.exe
  2⤵
  PID:4060
- C:\Windows\System\aYEASWH.exe
  C:\Windows\System\aYEASWH.exe
  2⤵
  PID:4084
- C:\Windows\System\tHHlqeo.exe
  C:\Windows\System\tHHlqeo.exe
  2⤵
  PID:1324
- C:\Windows\System\QDejSaH.exe
  C:\Windows\System\QDejSaH.exe
  2⤵
  PID:836
- C:\Windows\System\YSKstgX.exe
  C:\Windows\System\YSKstgX.exe
  2⤵
  PID:2776
- C:\Windows\System\ApKuqWg.exe
  C:\Windows\System\ApKuqWg.exe
  2⤵
  PID:564
- C:\Windows\System\nrcOEiL.exe
  C:\Windows\System\nrcOEiL.exe
  2⤵
  PID:2096
- C:\Windows\System\bLnMYTn.exe
  C:\Windows\System\bLnMYTn.exe
  2⤵
  PID:544
- C:\Windows\System\rMutSNl.exe
  C:\Windows\System\rMutSNl.exe
  2⤵
  PID:1988
- C:\Windows\System\ZpOvWBC.exe
  C:\Windows\System\ZpOvWBC.exe
  2⤵
  PID:928
- C:\Windows\System\BFotWiI.exe
  C:\Windows\System\BFotWiI.exe
  2⤵
  PID:2828
- C:\Windows\System\jFnVUiM.exe
  C:\Windows\System\jFnVUiM.exe
  2⤵
  PID:2272
- C:\Windows\System\ZLACBXu.exe
  C:\Windows\System\ZLACBXu.exe
  2⤵
  PID:1696
- C:\Windows\System\ioczcrV.exe
  C:\Windows\System\ioczcrV.exe
  2⤵
  PID:3180
- C:\Windows\System\NIaWcSJ.exe
  C:\Windows\System\NIaWcSJ.exe
  2⤵
  PID:2720
- C:\Windows\System\HKUJsoG.exe
  C:\Windows\System\HKUJsoG.exe
  2⤵
  PID:2628
- C:\Windows\System\EJuvmzx.exe
  C:\Windows\System\EJuvmzx.exe
  2⤵
  PID:3220
- C:\Windows\System\nEcZcBh.exe
  C:\Windows\System\nEcZcBh.exe
  2⤵
  PID:3240
- C:\Windows\System\bqSsaMW.exe
  C:\Windows\System\bqSsaMW.exe
  2⤵
  PID:3280
- C:\Windows\System\hpDhhTK.exe
  C:\Windows\System\hpDhhTK.exe
  2⤵
  PID:2592
- C:\Windows\System\CBVPlLx.exe
  C:\Windows\System\CBVPlLx.exe
  2⤵
  PID:3324
- C:\Windows\System\gkWWzNa.exe
  C:\Windows\System\gkWWzNa.exe
  2⤵
  PID:3384
- C:\Windows\System\CWgmELq.exe
  C:\Windows\System\CWgmELq.exe
  2⤵
  PID:3164
- C:\Windows\System\lRfwKZl.exe
  C:\Windows\System\lRfwKZl.exe
  2⤵
  PID:3152
- C:\Windows\System\GHRZNwi.exe
  C:\Windows\System\GHRZNwi.exe
  2⤵
  PID:3080
- C:\Windows\System\thKdPRQ.exe
  C:\Windows\System\thKdPRQ.exe
  2⤵
  PID:2872
- C:\Windows\System\xMQQkmd.exe
  C:\Windows\System\xMQQkmd.exe
  2⤵
  PID:3420
- C:\Windows\System\fgTcgvd.exe
  C:\Windows\System\fgTcgvd.exe
  2⤵
  PID:3424
- C:\Windows\System\qNXOKxb.exe
  C:\Windows\System\qNXOKxb.exe
  2⤵
  PID:3548
- C:\Windows\System\qNmIHaW.exe
  C:\Windows\System\qNmIHaW.exe
  2⤵
  PID:3596
- C:\Windows\System\GYLOKxp.exe
  C:\Windows\System\GYLOKxp.exe
  2⤵
  PID:3452
- C:\Windows\System\OmGIlOP.exe
  C:\Windows\System\OmGIlOP.exe
  2⤵
  PID:3520
- C:\Windows\System\CshGCPE.exe
  C:\Windows\System\CshGCPE.exe
  2⤵
  PID:3480
- C:\Windows\System\EcZkHhl.exe
  C:\Windows\System\EcZkHhl.exe
  2⤵
  PID:3400
- C:\Windows\System\zzGemaG.exe
  C:\Windows\System\zzGemaG.exe
  2⤵
  PID:2892
- C:\Windows\System\LuOXnpa.exe
  C:\Windows\System\LuOXnpa.exe
  2⤵
  PID:2796
- C:\Windows\System\CJIBIvj.exe
  C:\Windows\System\CJIBIvj.exe
  2⤵
  PID:2948
- C:\Windows\System\BQvImkx.exe
  C:\Windows\System\BQvImkx.exe
  2⤵
  PID:3648
- C:\Windows\System\XZcJURQ.exe
  C:\Windows\System\XZcJURQ.exe
  2⤵
  PID:3612
- C:\Windows\System\QEfDWCa.exe
  C:\Windows\System\QEfDWCa.exe
  2⤵
  PID:3752
- C:\Windows\System\ETsJNzS.exe
  C:\Windows\System\ETsJNzS.exe
  2⤵
  PID:3684
- C:\Windows\System\udyxpaX.exe
  C:\Windows\System\udyxpaX.exe
  2⤵
  PID:2984
- C:\Windows\System\HdZVDGf.exe
  C:\Windows\System\HdZVDGf.exe
  2⤵
  PID:3704
- C:\Windows\System\SPRhfPa.exe
  C:\Windows\System\SPRhfPa.exe
  2⤵
  PID:3740
- C:\Windows\System\PFlXkTV.exe
  C:\Windows\System\PFlXkTV.exe
  2⤵
  PID:3828
- C:\Windows\System\PjSEmwW.exe
  C:\Windows\System\PjSEmwW.exe
  2⤵
  PID:3876
- C:\Windows\System\ohsKaut.exe
  C:\Windows\System\ohsKaut.exe
  2⤵
  PID:2020
- C:\Windows\System\CAgGZxm.exe
  C:\Windows\System\CAgGZxm.exe
  2⤵
  PID:4016
- C:\Windows\System\ShdKXPA.exe
  C:\Windows\System\ShdKXPA.exe
  2⤵
  PID:264
- C:\Windows\System\xCNLoia.exe
  C:\Windows\System\xCNLoia.exe
  2⤵
  PID:2792
- C:\Windows\System\ULFHClU.exe
  C:\Windows\System\ULFHClU.exe
  2⤵
  PID:4000
- C:\Windows\System\vLAUjnf.exe
  C:\Windows\System\vLAUjnf.exe
  2⤵
  PID:4056
- C:\Windows\System\kcBrHix.exe
  C:\Windows\System\kcBrHix.exe
  2⤵
  PID:4048
- C:\Windows\System\RXEBVcU.exe
  C:\Windows\System\RXEBVcU.exe
  2⤵
  PID:1940
- C:\Windows\System\nIbxEbb.exe
  C:\Windows\System\nIbxEbb.exe
  2⤵
  PID:1552
- C:\Windows\System\BTzOlvs.exe
  C:\Windows\System\BTzOlvs.exe
  2⤵
  PID:2364
- C:\Windows\System\LGXLVkz.exe
  C:\Windows\System\LGXLVkz.exe
  2⤵
  PID:4072
- C:\Windows\System\aIFqgKk.exe
  C:\Windows\System\aIFqgKk.exe
  2⤵
  PID:2488
- C:\Windows\System\gBPQkgm.exe
  C:\Windows\System\gBPQkgm.exe
  2⤵
  PID:1448
- C:\Windows\System\LmVQDSj.exe
  C:\Windows\System\LmVQDSj.exe
  2⤵
  PID:3100
- C:\Windows\System\qGgZgZT.exe
  C:\Windows\System\qGgZgZT.exe
  2⤵
  PID:1848
- C:\Windows\System\VjzyQka.exe
  C:\Windows\System\VjzyQka.exe
  2⤵
  PID:1248
- C:\Windows\System\vfKtAtC.exe
  C:\Windows\System\vfKtAtC.exe
  2⤵
  PID:3140
- C:\Windows\System\dcaXkxg.exe
  C:\Windows\System\dcaXkxg.exe
  2⤵
  PID:3216
- C:\Windows\System\XerEbij.exe
  C:\Windows\System\XerEbij.exe
  2⤵
  PID:3312
- C:\Windows\System\CjZKdFl.exe
  C:\Windows\System\CjZKdFl.exe
  2⤵
  PID:2032
- C:\Windows\System\TFFlMph.exe
  C:\Windows\System\TFFlMph.exe
  2⤵
  PID:3228
- C:\Windows\System\oCdDCTS.exe
  C:\Windows\System\oCdDCTS.exe
  2⤵
  PID:3156
- C:\Windows\System\HijvcpJ.exe
  C:\Windows\System\HijvcpJ.exe
  2⤵
  PID:3260
- C:\Windows\System\JuAcpuQ.exe
  C:\Windows\System\JuAcpuQ.exe
  2⤵
  PID:3292
- C:\Windows\System\GMsEQLC.exe
  C:\Windows\System\GMsEQLC.exe
  2⤵
  PID:2840
- C:\Windows\System\qUwGMcy.exe
  C:\Windows\System\qUwGMcy.exe
  2⤵
  PID:2884
- C:\Windows\System\CZkgVLl.exe
  C:\Windows\System\CZkgVLl.exe
  2⤵
  PID:3588
- C:\Windows\System\DZskxiW.exe
  C:\Windows\System\DZskxiW.exe
  2⤵
  PID:3300
- C:\Windows\System\UgmZPnO.exe
  C:\Windows\System\UgmZPnO.exe
  2⤵
  PID:3404
- C:\Windows\System\dGIyzHl.exe
  C:\Windows\System\dGIyzHl.exe
  2⤵
  PID:3616
- C:\Windows\System\ontgGaU.exe
  C:\Windows\System\ontgGaU.exe
  2⤵
  PID:3720
- C:\Windows\System\Prwniyf.exe
  C:\Windows\System\Prwniyf.exe
  2⤵
  PID:3776
- C:\Windows\System\QcBtVrs.exe
  C:\Windows\System\QcBtVrs.exe
  2⤵
  PID:3872
- C:\Windows\System\DutbLii.exe
  C:\Windows\System\DutbLii.exe
  2⤵
  PID:3832
- C:\Windows\System\cwULAcR.exe
  C:\Windows\System\cwULAcR.exe
  2⤵
  PID:3464
- C:\Windows\System\nsOFHvk.exe
  C:\Windows\System\nsOFHvk.exe
  2⤵
  PID:3564
- C:\Windows\System\cHRXbsZ.exe
  C:\Windows\System\cHRXbsZ.exe
  2⤵
  PID:568
- C:\Windows\System\BwOKxbm.exe
  C:\Windows\System\BwOKxbm.exe
  2⤵
  PID:3812
- C:\Windows\System\QJhOHKL.exe
  C:\Windows\System\QJhOHKL.exe
  2⤵
  PID:3916
- C:\Windows\System\vbQGRuS.exe
  C:\Windows\System\vbQGRuS.exe
  2⤵
  PID:3856
- C:\Windows\System\ONNzBRc.exe
  C:\Windows\System\ONNzBRc.exe
  2⤵
  PID:1684
- C:\Windows\System\sCymrxT.exe
  C:\Windows\System\sCymrxT.exe
  2⤵
  PID:2444
- C:\Windows\System\JPcGQoX.exe
  C:\Windows\System\JPcGQoX.exe
  2⤵
  PID:2496
- C:\Windows\System\NZkuQNr.exe
  C:\Windows\System\NZkuQNr.exe
  2⤵
  PID:2348
- C:\Windows\System\sKMkupt.exe
  C:\Windows\System\sKMkupt.exe
  2⤵
  PID:3508
- C:\Windows\System\ivOnMJo.exe
  C:\Windows\System\ivOnMJo.exe
  2⤵
  PID:3440
- C:\Windows\System\qBrjMRt.exe
  C:\Windows\System\qBrjMRt.exe
  2⤵
  PID:3836
- C:\Windows\System\IFkYmBw.exe
  C:\Windows\System\IFkYmBw.exe
  2⤵
  PID:4108
- C:\Windows\System\jnRkaMM.exe
  C:\Windows\System\jnRkaMM.exe
  2⤵
  PID:4124
- C:\Windows\System\EIWMTAG.exe
  C:\Windows\System\EIWMTAG.exe
  2⤵
  PID:4140
- C:\Windows\System\hBGjjwk.exe
  C:\Windows\System\hBGjjwk.exe
  2⤵
  PID:4156
- C:\Windows\System\FjGXMRL.exe
  C:\Windows\System\FjGXMRL.exe
  2⤵
  PID:4176
- C:\Windows\System\hFgOdtg.exe
  C:\Windows\System\hFgOdtg.exe
  2⤵
  PID:4196
- C:\Windows\System\pBkDcLt.exe
  C:\Windows\System\pBkDcLt.exe
  2⤵
  PID:4212
- C:\Windows\System\wPjSTuU.exe
  C:\Windows\System\wPjSTuU.exe
  2⤵
  PID:4232
- C:\Windows\System\USynBqD.exe
  C:\Windows\System\USynBqD.exe
  2⤵
  PID:4248
- C:\Windows\System\msNxYJi.exe
  C:\Windows\System\msNxYJi.exe
  2⤵
  PID:4264
- C:\Windows\System\jzuRfvh.exe
  C:\Windows\System\jzuRfvh.exe
  2⤵
  PID:4284
- C:\Windows\System\YTtqCNq.exe
  C:\Windows\System\YTtqCNq.exe
  2⤵
  PID:4300
- C:\Windows\System\rLagYeG.exe
  C:\Windows\System\rLagYeG.exe
  2⤵
  PID:4316
- C:\Windows\System\cVQDncq.exe
  C:\Windows\System\cVQDncq.exe
  2⤵
  PID:4340
- C:\Windows\System\znQonzu.exe
  C:\Windows\System\znQonzu.exe
  2⤵
  PID:4372
- C:\Windows\System\XFWJvvc.exe
  C:\Windows\System\XFWJvvc.exe
  2⤵
  PID:4392
- C:\Windows\System\sdhkUUs.exe
  C:\Windows\System\sdhkUUs.exe
  2⤵
  PID:4432
- C:\Windows\System\UhfWZYB.exe
  C:\Windows\System\UhfWZYB.exe
  2⤵
  PID:4448
- C:\Windows\System\EhBhkZc.exe
  C:\Windows\System\EhBhkZc.exe
  2⤵
  PID:4464
- C:\Windows\System\NxzEFSq.exe
  C:\Windows\System\NxzEFSq.exe
  2⤵
  PID:4480
- C:\Windows\System\XWiPmCK.exe
  C:\Windows\System\XWiPmCK.exe
  2⤵
  PID:4500
- C:\Windows\System\NzLeBBz.exe
  C:\Windows\System\NzLeBBz.exe
  2⤵
  PID:4516
- C:\Windows\System\oHDFtEg.exe
  C:\Windows\System\oHDFtEg.exe
  2⤵
  PID:4532
- C:\Windows\System\FhoUBTF.exe
  C:\Windows\System\FhoUBTF.exe
  2⤵
  PID:4548
- C:\Windows\System\KnefrOy.exe
  C:\Windows\System\KnefrOy.exe
  2⤵
  PID:4564
- C:\Windows\System\rRmwRck.exe
  C:\Windows\System\rRmwRck.exe
  2⤵
  PID:4580
- C:\Windows\System\tHZBgby.exe
  C:\Windows\System\tHZBgby.exe
  2⤵
  PID:4596
- C:\Windows\System\GhUolTc.exe
  C:\Windows\System\GhUolTc.exe
  2⤵
  PID:4612
- C:\Windows\System\luVCuxm.exe
  C:\Windows\System\luVCuxm.exe
  2⤵
  PID:4628
- C:\Windows\System\dwoxlgP.exe
  C:\Windows\System\dwoxlgP.exe
  2⤵
  PID:4644
- C:\Windows\System\JrmxUjZ.exe
  C:\Windows\System\JrmxUjZ.exe
  2⤵
  PID:4660
- C:\Windows\System\PSITROl.exe
  C:\Windows\System\PSITROl.exe
  2⤵
  PID:4676
- C:\Windows\System\LOwzEDP.exe
  C:\Windows\System\LOwzEDP.exe
  2⤵
  PID:4692
- C:\Windows\System\dWbYCdi.exe
  C:\Windows\System\dWbYCdi.exe
  2⤵
  PID:4708
- C:\Windows\System\OPbcdpZ.exe
  C:\Windows\System\OPbcdpZ.exe
  2⤵
  PID:4724
- C:\Windows\System\okgLkxw.exe
  C:\Windows\System\okgLkxw.exe
  2⤵
  PID:4740
- C:\Windows\System\lCJBVBo.exe
  C:\Windows\System\lCJBVBo.exe
  2⤵
  PID:4756
- C:\Windows\System\NmeZMEC.exe
  C:\Windows\System\NmeZMEC.exe
  2⤵
  PID:4772
- C:\Windows\System\EQjLWKW.exe
  C:\Windows\System\EQjLWKW.exe
  2⤵
  PID:4788
- C:\Windows\System\dNTOHjM.exe
  C:\Windows\System\dNTOHjM.exe
  2⤵
  PID:4804
- C:\Windows\System\bhYpgzL.exe
  C:\Windows\System\bhYpgzL.exe
  2⤵
  PID:4820
- C:\Windows\System\NJbAUmv.exe
  C:\Windows\System\NJbAUmv.exe
  2⤵
  PID:4836
- C:\Windows\System\xquLqFJ.exe
  C:\Windows\System\xquLqFJ.exe
  2⤵
  PID:4852
- C:\Windows\System\LtjZfJR.exe
  C:\Windows\System\LtjZfJR.exe
  2⤵
  PID:4868
- C:\Windows\System\SVGGrdH.exe
  C:\Windows\System\SVGGrdH.exe
  2⤵
  PID:4884
- C:\Windows\System\YojUzvb.exe
  C:\Windows\System\YojUzvb.exe
  2⤵
  PID:4900
- C:\Windows\System\lwRsPfA.exe
  C:\Windows\System\lwRsPfA.exe
  2⤵
  PID:4916
- C:\Windows\System\BEyjXjg.exe
  C:\Windows\System\BEyjXjg.exe
  2⤵
  PID:4932
- C:\Windows\System\XdtSJeJ.exe
  C:\Windows\System\XdtSJeJ.exe
  2⤵
  PID:4948
- C:\Windows\System\dQMlTiF.exe
  C:\Windows\System\dQMlTiF.exe
  2⤵
  PID:4964
- C:\Windows\System\fBjEpIJ.exe
  C:\Windows\System\fBjEpIJ.exe
  2⤵
  PID:4980
- C:\Windows\System\RtHfplY.exe
  C:\Windows\System\RtHfplY.exe
  2⤵
  PID:4996
- C:\Windows\System\RwnVXLw.exe
  C:\Windows\System\RwnVXLw.exe
  2⤵
  PID:5012
- C:\Windows\System\eXmhDkf.exe
  C:\Windows\System\eXmhDkf.exe
  2⤵
  PID:5028
- C:\Windows\System\cLWvhWQ.exe
  C:\Windows\System\cLWvhWQ.exe
  2⤵
  PID:5044
- C:\Windows\System\YINepDv.exe
  C:\Windows\System\YINepDv.exe
  2⤵
  PID:5060
- C:\Windows\System\SgrsSOx.exe
  C:\Windows\System\SgrsSOx.exe
  2⤵
  PID:5076
- C:\Windows\System\qIuRHcn.exe
  C:\Windows\System\qIuRHcn.exe
  2⤵
  PID:5092
- C:\Windows\System\QhfEnNt.exe
  C:\Windows\System\QhfEnNt.exe
  2⤵
  PID:5108
- C:\Windows\System\NBQDSvM.exe
  C:\Windows\System\NBQDSvM.exe
  2⤵
  PID:3488
- C:\Windows\System\rNWpGup.exe
  C:\Windows\System\rNWpGup.exe
  2⤵
  PID:3700
- C:\Windows\System\QzKbSfs.exe
  C:\Windows\System\QzKbSfs.exe
  2⤵
  PID:3920
- C:\Windows\System\fDlzJiF.exe
  C:\Windows\System\fDlzJiF.exe
  2⤵
  PID:3104
- C:\Windows\System\lFThEIU.exe
  C:\Windows\System\lFThEIU.exe
  2⤵
  PID:3320
- C:\Windows\System\WvgYLnY.exe
  C:\Windows\System\WvgYLnY.exe
  2⤵
  PID:4120
- C:\Windows\System\OOGwONM.exe
  C:\Windows\System\OOGwONM.exe
  2⤵
  PID:4188
- C:\Windows\System\fQADLrJ.exe
  C:\Windows\System\fQADLrJ.exe
  2⤵
  PID:4036
- C:\Windows\System\cjJcnlL.exe
  C:\Windows\System\cjJcnlL.exe
  2⤵
  PID:3996
- C:\Windows\System\JbqnGPT.exe
  C:\Windows\System\JbqnGPT.exe
  2⤵
  PID:2780
- C:\Windows\System\UoPZfoQ.exe
  C:\Windows\System\UoPZfoQ.exe
  2⤵
  PID:3936
- C:\Windows\System\FvKwXfu.exe
  C:\Windows\System\FvKwXfu.exe
  2⤵
  PID:2456
- C:\Windows\System\JYJgHAu.exe
  C:\Windows\System\JYJgHAu.exe
  2⤵
  PID:2656
- C:\Windows\System\UveaSlA.exe
  C:\Windows\System\UveaSlA.exe
  2⤵
  PID:3000
- C:\Windows\System\IzWrgLm.exe
  C:\Windows\System\IzWrgLm.exe
  2⤵
  PID:3116
- C:\Windows\System\ChPVOgY.exe
  C:\Windows\System\ChPVOgY.exe
  2⤵
  PID:3356
- C:\Windows\System\xqbntba.exe
  C:\Windows\System\xqbntba.exe
  2⤵
  PID:3468
- C:\Windows\System\mBqVnQJ.exe
  C:\Windows\System\mBqVnQJ.exe
  2⤵
  PID:2416
- C:\Windows\System\zSaYDbR.exe
  C:\Windows\System\zSaYDbR.exe
  2⤵
  PID:3772
- C:\Windows\System\XiuxXeD.exe
  C:\Windows\System\XiuxXeD.exe
  2⤵
  PID:3652
- C:\Windows\System\WmCVPlV.exe
  C:\Windows\System\WmCVPlV.exe
  2⤵
  PID:1676
- C:\Windows\System\dqxzJQN.exe
  C:\Windows\System\dqxzJQN.exe
  2⤵
  PID:2708
- C:\Windows\System\fFmfllD.exe
  C:\Windows\System\fFmfllD.exe
  2⤵
  PID:3692
- C:\Windows\System\nNEARFV.exe
  C:\Windows\System\nNEARFV.exe
  2⤵
  PID:4136
- C:\Windows\System\tfnkBpX.exe
  C:\Windows\System\tfnkBpX.exe
  2⤵
  PID:4192
- C:\Windows\System\OaHwwvn.exe
  C:\Windows\System\OaHwwvn.exe
  2⤵
  PID:4244
- C:\Windows\System\jGaTSOg.exe
  C:\Windows\System\jGaTSOg.exe
  2⤵
  PID:4308
- C:\Windows\System\kimcvcq.exe
  C:\Windows\System\kimcvcq.exe
  2⤵
  PID:4360
- C:\Windows\System\JjODEjA.exe
  C:\Windows\System\JjODEjA.exe
  2⤵
  PID:4400
- C:\Windows\System\oBWvbdb.exe
  C:\Windows\System\oBWvbdb.exe
  2⤵
  PID:4332
- C:\Windows\System\Sulcney.exe
  C:\Windows\System\Sulcney.exe
  2⤵
  PID:4404
- C:\Windows\System\WNgiRXo.exe
  C:\Windows\System\WNgiRXo.exe
  2⤵
  PID:4456
- C:\Windows\System\WmrnQLw.exe
  C:\Windows\System\WmrnQLw.exe
  2⤵
  PID:4440
- C:\Windows\System\nARnUpy.exe
  C:\Windows\System\nARnUpy.exe
  2⤵
  PID:4508
- C:\Windows\System\QaOmldk.exe
  C:\Windows\System\QaOmldk.exe
  2⤵
  PID:4544
- C:\Windows\System\aNSYFCN.exe
  C:\Windows\System\aNSYFCN.exe
  2⤵
  PID:4572
- C:\Windows\System\vyzWvmZ.exe
  C:\Windows\System\vyzWvmZ.exe
  2⤵
  PID:4620
- C:\Windows\System\FfSejar.exe
  C:\Windows\System\FfSejar.exe
  2⤵
  PID:4604
- C:\Windows\System\WFhAIfn.exe
  C:\Windows\System\WFhAIfn.exe
  2⤵
  PID:4672
- C:\Windows\System\CsJdZti.exe
  C:\Windows\System\CsJdZti.exe
  2⤵
  PID:4736
- C:\Windows\System\dgkyPYF.exe
  C:\Windows\System\dgkyPYF.exe
  2⤵
  PID:4684
- C:\Windows\System\eFMypkB.exe
  C:\Windows\System\eFMypkB.exe
  2⤵
  PID:4688
- C:\Windows\System\Ehszfcz.exe
  C:\Windows\System\Ehszfcz.exe
  2⤵
  PID:4784
- C:\Windows\System\Zrxlnjv.exe
  C:\Windows\System\Zrxlnjv.exe
  2⤵
  PID:4832
- C:\Windows\System\RBXfjoJ.exe
  C:\Windows\System\RBXfjoJ.exe
  2⤵
  PID:4812
- C:\Windows\System\Bnllpki.exe
  C:\Windows\System\Bnllpki.exe
  2⤵
  PID:4880
- C:\Windows\System\WaJMBHu.exe
  C:\Windows\System\WaJMBHu.exe
  2⤵
  PID:4896
- C:\Windows\System\ILBfvOw.exe
  C:\Windows\System\ILBfvOw.exe
  2⤵
  PID:4976
- C:\Windows\System\kCViwMx.exe
  C:\Windows\System\kCViwMx.exe
  2⤵
  PID:4956
- C:\Windows\System\VFrBryJ.exe
  C:\Windows\System\VFrBryJ.exe
  2⤵
  PID:5020
- C:\Windows\System\wjpTqgo.exe
  C:\Windows\System\wjpTqgo.exe
  2⤵
  PID:5040
- C:\Windows\System\gSljosk.exe
  C:\Windows\System\gSljosk.exe
  2⤵
  PID:5104
- C:\Windows\System\NVyrJaN.exe
  C:\Windows\System\NVyrJaN.exe
  2⤵
  PID:5084
- C:\Windows\System\xYohoii.exe
  C:\Windows\System\xYohoii.exe
  2⤵
  PID:3912
- C:\Windows\System\lUarRof.exe
  C:\Windows\System\lUarRof.exe
  2⤵
  PID:4184
- C:\Windows\System\AajdWWw.exe
  C:\Windows\System\AajdWWw.exe
  2⤵
  PID:1948
- C:\Windows\System\zoYJZKv.exe
  C:\Windows\System\zoYJZKv.exe
  2⤵
  PID:3136
- C:\Windows\System\uwTrwKK.exe
  C:\Windows\System\uwTrwKK.exe
  2⤵
  PID:2052
- C:\Windows\System\QsgSGFs.exe
  C:\Windows\System\QsgSGFs.exe
  2⤵
  PID:288
- C:\Windows\System\ljcOuPX.exe
  C:\Windows\System\ljcOuPX.exe
  2⤵
  PID:4116
- C:\Windows\System\DkBfUGs.exe
  C:\Windows\System\DkBfUGs.exe
  2⤵
  PID:4292
- C:\Windows\System\aXnaOXw.exe
  C:\Windows\System\aXnaOXw.exe
  2⤵
  PID:3084
- C:\Windows\System\jnyjtWo.exe
  C:\Windows\System\jnyjtWo.exe
  2⤵
  PID:3716
- C:\Windows\System\tCpRWtr.exe
  C:\Windows\System\tCpRWtr.exe
  2⤵
  PID:4168
- C:\Windows\System\hRaiieE.exe
  C:\Windows\System\hRaiieE.exe
  2⤵
  PID:4368
- C:\Windows\System\Ztjoxmg.exe
  C:\Windows\System\Ztjoxmg.exe
  2⤵
  PID:4496
- C:\Windows\System\hJxyKyP.exe
  C:\Windows\System\hJxyKyP.exe
  2⤵
  PID:4104
- C:\Windows\System\DbbMPYg.exe
  C:\Windows\System\DbbMPYg.exe
  2⤵
  PID:4208
- C:\Windows\System\qdCFMYZ.exe
  C:\Windows\System\qdCFMYZ.exe
  2⤵
  PID:4388
- C:\Windows\System\sHGEMTE.exe
  C:\Windows\System\sHGEMTE.exe
  2⤵
  PID:4476
- C:\Windows\System\MFbomIq.exe
  C:\Windows\System\MFbomIq.exe
  2⤵
  PID:4576
- C:\Windows\System\uyDZqBw.exe
  C:\Windows\System\uyDZqBw.exe
  2⤵
  PID:4656
- C:\Windows\System\gQxoZCO.exe
  C:\Windows\System\gQxoZCO.exe
  2⤵
  PID:4876
- C:\Windows\System\QqZAFnF.exe
  C:\Windows\System\QqZAFnF.exe
  2⤵
  PID:4640
- C:\Windows\System\neQbrzl.exe
  C:\Windows\System\neQbrzl.exe
  2⤵
  PID:4752
- C:\Windows\System\cacqmep.exe
  C:\Windows\System\cacqmep.exe
  2⤵
  PID:4592
- C:\Windows\System\BSrwjbx.exe
  C:\Windows\System\BSrwjbx.exe
  2⤵
  PID:4988
- C:\Windows\System\YpUYnQJ.exe
  C:\Windows\System\YpUYnQJ.exe
  2⤵
  PID:5036
- C:\Windows\System\wSGeCvr.exe
  C:\Windows\System\wSGeCvr.exe
  2⤵
  PID:5132
- C:\Windows\System\qkNhwhG.exe
  C:\Windows\System\qkNhwhG.exe
  2⤵
  PID:5148
- C:\Windows\System\ubfcrGN.exe
  C:\Windows\System\ubfcrGN.exe
  2⤵
  PID:5164
- C:\Windows\System\sXJPbQL.exe
  C:\Windows\System\sXJPbQL.exe
  2⤵
  PID:5180
- C:\Windows\System\diUNNFw.exe
  C:\Windows\System\diUNNFw.exe
  2⤵
  PID:5196
- C:\Windows\System\yacmsnW.exe
  C:\Windows\System\yacmsnW.exe
  2⤵
  PID:5212
- C:\Windows\System\fDCGPVb.exe
  C:\Windows\System\fDCGPVb.exe
  2⤵
  PID:5228
- C:\Windows\System\fcnMRsa.exe
  C:\Windows\System\fcnMRsa.exe
  2⤵
  PID:5244
- C:\Windows\System\ERghary.exe
  C:\Windows\System\ERghary.exe
  2⤵
  PID:5260
- C:\Windows\System\mzoacWO.exe
  C:\Windows\System\mzoacWO.exe
  2⤵
  PID:5276
- C:\Windows\System\NHpcoYk.exe
  C:\Windows\System\NHpcoYk.exe
  2⤵
  PID:5292
- C:\Windows\System\lmDWery.exe
  C:\Windows\System\lmDWery.exe
  2⤵
  PID:5308
- C:\Windows\System\eiHcieu.exe
  C:\Windows\System\eiHcieu.exe
  2⤵
  PID:5324
- C:\Windows\System\fSJTOOC.exe
  C:\Windows\System\fSJTOOC.exe
  2⤵
  PID:5340
- C:\Windows\System\nEPKjWM.exe
  C:\Windows\System\nEPKjWM.exe
  2⤵
  PID:5356
- C:\Windows\System\itrmmIg.exe
  C:\Windows\System\itrmmIg.exe
  2⤵
  PID:5372
- C:\Windows\System\nnDuFfJ.exe
  C:\Windows\System\nnDuFfJ.exe
  2⤵
  PID:5388
- C:\Windows\System\PNFzNTB.exe
  C:\Windows\System\PNFzNTB.exe
  2⤵
  PID:5404
- C:\Windows\System\iuHOmKI.exe
  C:\Windows\System\iuHOmKI.exe
  2⤵
  PID:5420
- C:\Windows\System\ICwJjoU.exe
  C:\Windows\System\ICwJjoU.exe
  2⤵
  PID:5436
- C:\Windows\System\nJPaQVo.exe
  C:\Windows\System\nJPaQVo.exe
  2⤵
  PID:5452
- C:\Windows\System\pbWQfzy.exe
  C:\Windows\System\pbWQfzy.exe
  2⤵
  PID:5468
- C:\Windows\System\iWCiZbv.exe
  C:\Windows\System\iWCiZbv.exe
  2⤵
  PID:5484
- C:\Windows\System\smqdhhH.exe
  C:\Windows\System\smqdhhH.exe
  2⤵
  PID:5500
- C:\Windows\System\xMyFznN.exe
  C:\Windows\System\xMyFznN.exe
  2⤵
  PID:5520
- C:\Windows\System\wTZcrRP.exe
  C:\Windows\System\wTZcrRP.exe
  2⤵
  PID:5548
- C:\Windows\System\fRZAVXS.exe
  C:\Windows\System\fRZAVXS.exe
  2⤵
  PID:5564
- C:\Windows\System\qZgzGhX.exe
  C:\Windows\System\qZgzGhX.exe
  2⤵
  PID:5580
- C:\Windows\System\EyXVFXf.exe
  C:\Windows\System\EyXVFXf.exe
  2⤵
  PID:5596
- C:\Windows\System\xRbUgnf.exe
  C:\Windows\System\xRbUgnf.exe
  2⤵
  PID:5612
- C:\Windows\System\AAbFYab.exe
  C:\Windows\System\AAbFYab.exe
  2⤵
  PID:5632
- C:\Windows\System\DCbhIVt.exe
  C:\Windows\System\DCbhIVt.exe
  2⤵
  PID:5652
- C:\Windows\System\yzUGLfq.exe
  C:\Windows\System\yzUGLfq.exe
  2⤵
  PID:5764
- C:\Windows\System\BdDzuDG.exe
  C:\Windows\System\BdDzuDG.exe
  2⤵
  PID:5780
- C:\Windows\System\luHBHOs.exe
  C:\Windows\System\luHBHOs.exe
  2⤵
  PID:5796
- C:\Windows\System\yBEenJq.exe
  C:\Windows\System\yBEenJq.exe
  2⤵
  PID:5812
- C:\Windows\System\uEIdDct.exe
  C:\Windows\System\uEIdDct.exe
  2⤵
  PID:5828
- C:\Windows\System\GYpDFYi.exe
  C:\Windows\System\GYpDFYi.exe
  2⤵
  PID:5844
- C:\Windows\System\sqWYDrA.exe
  C:\Windows\System\sqWYDrA.exe
  2⤵
  PID:5860
- C:\Windows\System\vyZKVKv.exe
  C:\Windows\System\vyZKVKv.exe
  2⤵
  PID:5880
- C:\Windows\System\EQgdsjH.exe
  C:\Windows\System\EQgdsjH.exe
  2⤵
  PID:5896
- C:\Windows\System\uMAcpMu.exe
  C:\Windows\System\uMAcpMu.exe
  2⤵
  PID:5912
- C:\Windows\System\RNuifrG.exe
  C:\Windows\System\RNuifrG.exe
  2⤵
  PID:5928
- C:\Windows\System\qlbOAGK.exe
  C:\Windows\System\qlbOAGK.exe
  2⤵
  PID:5944
- C:\Windows\System\DkUKvBN.exe
  C:\Windows\System\DkUKvBN.exe
  2⤵
  PID:5960
- C:\Windows\System\BDXSgKk.exe
  C:\Windows\System\BDXSgKk.exe
  2⤵
  PID:5976
- C:\Windows\System\dkkJAfn.exe
  C:\Windows\System\dkkJAfn.exe
  2⤵
  PID:5992
- C:\Windows\System\vQJTIwT.exe
  C:\Windows\System\vQJTIwT.exe
  2⤵
  PID:6012
- C:\Windows\System\YnvfkGq.exe
  C:\Windows\System\YnvfkGq.exe
  2⤵
  PID:6028
- C:\Windows\System\GxpxPlg.exe
  C:\Windows\System\GxpxPlg.exe
  2⤵
  PID:6044
- C:\Windows\System\BAdUluQ.exe
  C:\Windows\System\BAdUluQ.exe
  2⤵
  PID:6060
- C:\Windows\System\EpkNQPk.exe
  C:\Windows\System\EpkNQPk.exe
  2⤵
  PID:6076
- C:\Windows\System\yyOTsEV.exe
  C:\Windows\System\yyOTsEV.exe
  2⤵
  PID:6092
- C:\Windows\System\NPcyZQU.exe
  C:\Windows\System\NPcyZQU.exe
  2⤵
  PID:6108
- C:\Windows\System\bVMyQXL.exe
  C:\Windows\System\bVMyQXL.exe
  2⤵
  PID:6124
- C:\Windows\System\vNxSWWc.exe
  C:\Windows\System\vNxSWWc.exe
  2⤵
  PID:6140
- C:\Windows\System\QEUaPpF.exe
  C:\Windows\System\QEUaPpF.exe
  2⤵
  PID:4472
- C:\Windows\System\tbwKUXW.exe
  C:\Windows\System\tbwKUXW.exe
  2⤵
  PID:4260
- C:\Windows\System\cjrjazd.exe
  C:\Windows\System\cjrjazd.exe
  2⤵
  PID:2652
- C:\Windows\System\BtIGgdc.exe
  C:\Windows\System\BtIGgdc.exe
  2⤵
  PID:3020
- C:\Windows\System\reyAKzp.exe
  C:\Windows\System\reyAKzp.exe
  2⤵
  PID:4488
- C:\Windows\System\uNyhmqR.exe
  C:\Windows\System\uNyhmqR.exe
  2⤵
  PID:4652
- C:\Windows\System\XgEgAZv.exe
  C:\Windows\System\XgEgAZv.exe
  2⤵
  PID:4668
- C:\Windows\System\xuHsFDm.exe
  C:\Windows\System\xuHsFDm.exe
  2⤵
  PID:5172
- C:\Windows\System\nKyzUiq.exe
  C:\Windows\System\nKyzUiq.exe
  2⤵
  PID:4892
- C:\Windows\System\LSSAlmA.exe
  C:\Windows\System\LSSAlmA.exe
  2⤵
  PID:5272
- C:\Windows\System\kaxDQQI.exe
  C:\Windows\System\kaxDQQI.exe
  2⤵
  PID:5332
- C:\Windows\System\IxcGvOO.exe
  C:\Windows\System\IxcGvOO.exe
  2⤵
  PID:5396
- C:\Windows\System\JodwBMy.exe
  C:\Windows\System\JodwBMy.exe
  2⤵
  PID:5460
- C:\Windows\System\jWWNCev.exe
  C:\Windows\System\jWWNCev.exe
  2⤵
  PID:3724
- C:\Windows\System\nMJfPIe.exe
  C:\Windows\System\nMJfPIe.exe
  2⤵
  PID:3368
- C:\Windows\System\FNGVYtf.exe
  C:\Windows\System\FNGVYtf.exe
  2⤵
  PID:4748
- C:\Windows\System\QVekXAf.exe
  C:\Windows\System\QVekXAf.exe
  2⤵
  PID:5160
- C:\Windows\System\KGuLnKS.exe
  C:\Windows\System\KGuLnKS.exe
  2⤵
  PID:5224
- C:\Windows\System\BmELWTN.exe
  C:\Windows\System\BmELWTN.exe
  2⤵
  PID:5316
- C:\Windows\System\OvDqekG.exe
  C:\Windows\System\OvDqekG.exe
  2⤵
  PID:5416
- C:\Windows\System\xBeUxyf.exe
  C:\Windows\System\xBeUxyf.exe
  2⤵
  PID:5480
- C:\Windows\System\QhLoayc.exe
  C:\Windows\System\QhLoayc.exe
  2⤵
  PID:4152
- C:\Windows\System\YeYzPqO.exe
  C:\Windows\System\YeYzPqO.exe
  2⤵
  PID:4588
- C:\Windows\System\tHuFwrV.exe
  C:\Windows\System\tHuFwrV.exe
  2⤵
  PID:4528
- C:\Windows\System\axFQBzX.exe
  C:\Windows\System\axFQBzX.exe
  2⤵
  PID:5320
- C:\Windows\System\cbUGnHm.exe
  C:\Windows\System\cbUGnHm.exe
  2⤵
  PID:5512
- C:\Windows\System\jbuYKyU.exe
  C:\Windows\System\jbuYKyU.exe
  2⤵
  PID:5592
- C:\Windows\System\XwDsPoU.exe
  C:\Windows\System\XwDsPoU.exe
  2⤵
  PID:5544
- C:\Windows\System\bzIlhKB.exe
  C:\Windows\System\bzIlhKB.exe
  2⤵
  PID:5560
- C:\Windows\System\nFqpKLp.exe
  C:\Windows\System\nFqpKLp.exe
  2⤵
  PID:5628
- C:\Windows\System\ImoTInC.exe
  C:\Windows\System\ImoTInC.exe
  2⤵
  PID:5664
- C:\Windows\System\nDoDFwr.exe
  C:\Windows\System\nDoDFwr.exe
  2⤵
  PID:5696
- C:\Windows\System\LETLzBq.exe
  C:\Windows\System\LETLzBq.exe
  2⤵
  PID:5680
- C:\Windows\System\eIvjkSr.exe
  C:\Windows\System\eIvjkSr.exe
  2⤵
  PID:5704
- C:\Windows\System\aljcpmf.exe
  C:\Windows\System\aljcpmf.exe
  2⤵
  PID:5728
- C:\Windows\System\dczGbJb.exe
  C:\Windows\System\dczGbJb.exe
  2⤵
  PID:5744
- C:\Windows\System\BlpVVXD.exe
  C:\Windows\System\BlpVVXD.exe
  2⤵
  PID:5760
- C:\Windows\System\oAMbGAU.exe
  C:\Windows\System\oAMbGAU.exe
  2⤵
  PID:5824
- C:\Windows\System\KImIJHz.exe
  C:\Windows\System\KImIJHz.exe
  2⤵
  PID:5892
- C:\Windows\System\XUkfSyo.exe
  C:\Windows\System\XUkfSyo.exe
  2⤵
  PID:5956
- C:\Windows\System\oJaNVAT.exe
  C:\Windows\System\oJaNVAT.exe
  2⤵
  PID:6024
- C:\Windows\System\lSuRsQY.exe
  C:\Windows\System\lSuRsQY.exe
  2⤵
  PID:5836
- C:\Windows\System\jssUxBm.exe
  C:\Windows\System\jssUxBm.exe
  2⤵
  PID:5808
- C:\Windows\System\iWlfwWf.exe
  C:\Windows\System\iWlfwWf.exe
  2⤵
  PID:5876
- C:\Windows\System\fvqmztV.exe
  C:\Windows\System\fvqmztV.exe
  2⤵
  PID:5940
- C:\Windows\System\bKsUfCB.exe
  C:\Windows\System\bKsUfCB.exe
  2⤵
  PID:6004
- C:\Windows\System\ZPJjzPd.exe
  C:\Windows\System\ZPJjzPd.exe
  2⤵
  PID:6068
- C:\Windows\System\BOzvRTE.exe
  C:\Windows\System\BOzvRTE.exe
  2⤵
  PID:6132
- C:\Windows\System\psCRgJJ.exe
  C:\Windows\System\psCRgJJ.exe
  2⤵
  PID:5088
- C:\Windows\System\YFDLebA.exe
  C:\Windows\System\YFDLebA.exe
  2⤵
  PID:5208
- C:\Windows\System\MluzdoI.exe
  C:\Windows\System\MluzdoI.exe
  2⤵
  PID:4864
- C:\Windows\System\olLqqxT.exe
  C:\Windows\System\olLqqxT.exe
  2⤵
  PID:5144
- C:\Windows\System\zFWyTii.exe
  C:\Windows\System\zFWyTii.exe
  2⤵
  PID:4540
- C:\Windows\System\kiRTqzW.exe
  C:\Windows\System\kiRTqzW.exe
  2⤵
  PID:1784
- C:\Windows\System\tnDRJes.exe
  C:\Windows\System\tnDRJes.exe
  2⤵
  PID:5492
- C:\Windows\System\BbhktVh.exe
  C:\Windows\System\BbhktVh.exe
  2⤵
  PID:4280
- C:\Windows\System\zGusjcr.exe
  C:\Windows\System\zGusjcr.exe
  2⤵
  PID:5432
- C:\Windows\System\AbepTtl.exe
  C:\Windows\System\AbepTtl.exe
  2⤵
  PID:5220
- C:\Windows\System\zomObZs.exe
  C:\Windows\System\zomObZs.exe
  2⤵
  PID:5448
- C:\Windows\System\fycvwvP.exe
  C:\Windows\System\fycvwvP.exe
  2⤵
  PID:5056
- C:\Windows\System\colosnf.exe
  C:\Windows\System\colosnf.exe
  2⤵
  PID:5288
- C:\Windows\System\aDiqYPS.exe
  C:\Windows\System\aDiqYPS.exe
  2⤵
  PID:4608
- C:\Windows\System\xJivmgj.exe
  C:\Windows\System\xJivmgj.exe
  2⤵
  PID:5528
- C:\Windows\System\PVhnwNI.exe
  C:\Windows\System\PVhnwNI.exe
  2⤵
  PID:5640
- C:\Windows\System\fHlZpQC.exe
  C:\Windows\System\fHlZpQC.exe
  2⤵
  PID:5644
- C:\Windows\System\ShSPACk.exe
  C:\Windows\System\ShSPACk.exe
  2⤵
  PID:5720
- C:\Windows\System\tQqGedb.exe
  C:\Windows\System\tQqGedb.exe
  2⤵
  PID:5692
- C:\Windows\System\FJrJEZM.exe
  C:\Windows\System\FJrJEZM.exe
  2⤵
  PID:5988
- C:\Windows\System\oBCEQSJ.exe
  C:\Windows\System\oBCEQSJ.exe
  2⤵
  PID:5804
- C:\Windows\System\SrLyWFX.exe
  C:\Windows\System\SrLyWFX.exe
  2⤵
  PID:6040
- C:\Windows\System\UppOCpS.exe
  C:\Windows\System\UppOCpS.exe
  2⤵
  PID:5740
- C:\Windows\System\DdxYveG.exe
  C:\Windows\System\DdxYveG.exe
  2⤵
  PID:6052
- C:\Windows\System\ZJiImnu.exe
  C:\Windows\System\ZJiImnu.exe
  2⤵
  PID:6100
- C:\Windows\System\YKcmEYG.exe
  C:\Windows\System\YKcmEYG.exe
  2⤵
  PID:6084
- C:\Windows\System\XLsZLvm.exe
  C:\Windows\System\XLsZLvm.exe
  2⤵
  PID:6000
- C:\Windows\System\TjzuUqj.exe
  C:\Windows\System\TjzuUqj.exe
  2⤵
  PID:6104
- C:\Windows\System\toraZjI.exe
  C:\Windows\System\toraZjI.exe
  2⤵
  PID:5268
- C:\Windows\System\baztcbN.exe
  C:\Windows\System\baztcbN.exe
  2⤵
  PID:4352
- C:\Windows\System\xVwSRgI.exe
  C:\Windows\System\xVwSRgI.exe
  2⤵
  PID:5608
- C:\Windows\System\QEPqdJk.exe
  C:\Windows\System\QEPqdJk.exe
  2⤵
  PID:5204
- C:\Windows\System\DZXMZGl.exe
  C:\Windows\System\DZXMZGl.exe
  2⤵
  PID:5888
- C:\Windows\System\jQGTobG.exe
  C:\Windows\System\jQGTobG.exe
  2⤵
  PID:5380
- C:\Windows\System\biVxTzB.exe
  C:\Windows\System\biVxTzB.exe
  2⤵
  PID:5716
- C:\Windows\System\xHHCKoQ.exe
  C:\Windows\System\xHHCKoQ.exe
  2⤵
  PID:5672
- C:\Windows\System\pFXneXL.exe
  C:\Windows\System\pFXneXL.exe
  2⤵
  PID:5820
- C:\Windows\System\YtlJvMj.exe
  C:\Windows\System\YtlJvMj.exe
  2⤵
  PID:5756
- C:\Windows\System\HUdVsId.exe
  C:\Windows\System\HUdVsId.exe
  2⤵
  PID:2004
- C:\Windows\System\hPenomh.exe
  C:\Windows\System\hPenomh.exe
  2⤵
  PID:4428
- C:\Windows\System\BLjYcQa.exe
  C:\Windows\System\BLjYcQa.exe
  2⤵
  PID:5660
- C:\Windows\System\bcIhwLr.exe
  C:\Windows\System\bcIhwLr.exe
  2⤵
  PID:5192
- C:\Windows\System\RvNChNY.exe
  C:\Windows\System\RvNChNY.exe
  2⤵
  PID:5536
- C:\Windows\System\EmNJTTd.exe
  C:\Windows\System\EmNJTTd.exe
  2⤵
  PID:6152
- C:\Windows\System\fSIDxfB.exe
  C:\Windows\System\fSIDxfB.exe
  2⤵
  PID:6168
- C:\Windows\System\QXtzxQe.exe
  C:\Windows\System\QXtzxQe.exe
  2⤵
  PID:6184
- C:\Windows\System\wyaSgdr.exe
  C:\Windows\System\wyaSgdr.exe
  2⤵
  PID:6200
- C:\Windows\System\brMbDkH.exe
  C:\Windows\System\brMbDkH.exe
  2⤵
  PID:6216
- C:\Windows\System\HDvTTJE.exe
  C:\Windows\System\HDvTTJE.exe
  2⤵
  PID:6232
- C:\Windows\System\lIqZIyz.exe
  C:\Windows\System\lIqZIyz.exe
  2⤵
  PID:6248
- C:\Windows\System\mLDowCz.exe
  C:\Windows\System\mLDowCz.exe
  2⤵
  PID:6264
- C:\Windows\System\WQtaBis.exe
  C:\Windows\System\WQtaBis.exe
  2⤵
  PID:6280
- C:\Windows\System\mKkBgye.exe
  C:\Windows\System\mKkBgye.exe
  2⤵
  PID:6296
- C:\Windows\System\WDxoVsK.exe
  C:\Windows\System\WDxoVsK.exe
  2⤵
  PID:6312
- C:\Windows\System\GQpoHmp.exe
  C:\Windows\System\GQpoHmp.exe
  2⤵
  PID:6328
- C:\Windows\System\OImZbnC.exe
  C:\Windows\System\OImZbnC.exe
  2⤵
  PID:6344
- C:\Windows\System\pjzEMoT.exe
  C:\Windows\System\pjzEMoT.exe
  2⤵
  PID:6360
- C:\Windows\System\DRLXRhW.exe
  C:\Windows\System\DRLXRhW.exe
  2⤵
  PID:6376
- C:\Windows\System\iMimiXZ.exe
  C:\Windows\System\iMimiXZ.exe
  2⤵
  PID:6392
- C:\Windows\System\smNqFWn.exe
  C:\Windows\System\smNqFWn.exe
  2⤵
  PID:6408
- C:\Windows\System\yocuSyR.exe
  C:\Windows\System\yocuSyR.exe
  2⤵
  PID:6424
- C:\Windows\System\SEDCpPa.exe
  C:\Windows\System\SEDCpPa.exe
  2⤵
  PID:6440
- C:\Windows\System\FMQWSAP.exe
  C:\Windows\System\FMQWSAP.exe
  2⤵
  PID:6456
- C:\Windows\System\MgvmPjo.exe
  C:\Windows\System\MgvmPjo.exe
  2⤵
  PID:6472
- C:\Windows\System\pVHawRM.exe
  C:\Windows\System\pVHawRM.exe
  2⤵
  PID:6488
- C:\Windows\System\DwAxThy.exe
  C:\Windows\System\DwAxThy.exe
  2⤵
  PID:6508
- C:\Windows\System\ojkOEqK.exe
  C:\Windows\System\ojkOEqK.exe
  2⤵
  PID:6524
- C:\Windows\System\xSHTcqC.exe
  C:\Windows\System\xSHTcqC.exe
  2⤵
  PID:6540
- C:\Windows\System\HxlpKar.exe
  C:\Windows\System\HxlpKar.exe
  2⤵
  PID:6556
- C:\Windows\System\VSjKFau.exe
  C:\Windows\System\VSjKFau.exe
  2⤵
  PID:6572
- C:\Windows\System\IfOZaMa.exe
  C:\Windows\System\IfOZaMa.exe
  2⤵
  PID:6588
- C:\Windows\System\roOnEOP.exe
  C:\Windows\System\roOnEOP.exe
  2⤵
  PID:6604
- C:\Windows\System\cOGSEtw.exe
  C:\Windows\System\cOGSEtw.exe
  2⤵
  PID:6620
- C:\Windows\System\zCFLFuR.exe
  C:\Windows\System\zCFLFuR.exe
  2⤵
  PID:6636
- C:\Windows\System\RnQjDVj.exe
  C:\Windows\System\RnQjDVj.exe
  2⤵
  PID:6652
- C:\Windows\System\MSUaUhq.exe
  C:\Windows\System\MSUaUhq.exe
  2⤵
  PID:6668
- C:\Windows\System\rZhEXWt.exe
  C:\Windows\System\rZhEXWt.exe
  2⤵
  PID:6684
- C:\Windows\System\uXTzkjW.exe
  C:\Windows\System\uXTzkjW.exe
  2⤵
  PID:6700
- C:\Windows\System\DhkyvLp.exe
  C:\Windows\System\DhkyvLp.exe
  2⤵
  PID:6716
- C:\Windows\System\jogUYIX.exe
  C:\Windows\System\jogUYIX.exe
  2⤵
  PID:6732
- C:\Windows\System\ZzxNkhN.exe
  C:\Windows\System\ZzxNkhN.exe
  2⤵
  PID:6748
- C:\Windows\System\vJaunky.exe
  C:\Windows\System\vJaunky.exe
  2⤵
  PID:6764
- C:\Windows\System\zvzzICd.exe
  C:\Windows\System\zvzzICd.exe
  2⤵
  PID:6780
- C:\Windows\System\IVNxcLP.exe
  C:\Windows\System\IVNxcLP.exe
  2⤵
  PID:6796
- C:\Windows\System\WpgUIOM.exe
  C:\Windows\System\WpgUIOM.exe
  2⤵
  PID:6812
- C:\Windows\System\dSDfHJe.exe
  C:\Windows\System\dSDfHJe.exe
  2⤵
  PID:6828
- C:\Windows\System\kbFIYTW.exe
  C:\Windows\System\kbFIYTW.exe
  2⤵
  PID:6844
- C:\Windows\System\taPkHJG.exe
  C:\Windows\System\taPkHJG.exe
  2⤵
  PID:6860
- C:\Windows\System\dldumFd.exe
  C:\Windows\System\dldumFd.exe
  2⤵
  PID:6876
- C:\Windows\System\iQLfDRb.exe
  C:\Windows\System\iQLfDRb.exe
  2⤵
  PID:6892
- C:\Windows\System\KWBjpGh.exe
  C:\Windows\System\KWBjpGh.exe
  2⤵
  PID:6908
- C:\Windows\System\NyZXmRF.exe
  C:\Windows\System\NyZXmRF.exe
  2⤵
  PID:6924
- C:\Windows\System\yzSUCKK.exe
  C:\Windows\System\yzSUCKK.exe
  2⤵
  PID:6940
- C:\Windows\System\JSEWfyd.exe
  C:\Windows\System\JSEWfyd.exe
  2⤵
  PID:6956
- C:\Windows\System\iqfXfXf.exe
  C:\Windows\System\iqfXfXf.exe
  2⤵
  PID:6976
- C:\Windows\System\rRytIhs.exe
  C:\Windows\System\rRytIhs.exe
  2⤵
  PID:7000
- C:\Windows\System\EagdATh.exe
  C:\Windows\System\EagdATh.exe
  2⤵
  PID:7020
- C:\Windows\System\swUrrDh.exe
  C:\Windows\System\swUrrDh.exe
  2⤵
  PID:7036
- C:\Windows\System\RtXyiuV.exe
  C:\Windows\System\RtXyiuV.exe
  2⤵
  PID:7052
- C:\Windows\System\EcisuiY.exe
  C:\Windows\System\EcisuiY.exe
  2⤵
  PID:7068
- C:\Windows\System\uAFFSkM.exe
  C:\Windows\System\uAFFSkM.exe
  2⤵
  PID:7084
- C:\Windows\System\eNTkAUU.exe
  C:\Windows\System\eNTkAUU.exe
  2⤵
  PID:7100
- C:\Windows\System\GyCMZhG.exe
  C:\Windows\System\GyCMZhG.exe
  2⤵
  PID:7116
- C:\Windows\System\lCxErhx.exe
  C:\Windows\System\lCxErhx.exe
  2⤵
  PID:7136
- C:\Windows\System\ZEsMVzu.exe
  C:\Windows\System\ZEsMVzu.exe
  2⤵
  PID:7152
- C:\Windows\System\quenAcr.exe
  C:\Windows\System\quenAcr.exe
  2⤵
  PID:4384
- C:\Windows\System\zVbCzJb.exe
  C:\Windows\System\zVbCzJb.exe
  2⤵
  PID:5972
- C:\Windows\System\VFnSUYE.exe
  C:\Windows\System\VFnSUYE.exe
  2⤵
  PID:6176
- C:\Windows\System\UQVBHIs.exe
  C:\Windows\System\UQVBHIs.exe
  2⤵
  PID:6288
- C:\Windows\System\jpPOlQA.exe
  C:\Windows\System\jpPOlQA.exe
  2⤵
  PID:5368
- C:\Windows\System\fekhwpJ.exe
  C:\Windows\System\fekhwpJ.exe
  2⤵
  PID:6272
- C:\Windows\System\wENcxDG.exe
  C:\Windows\System\wENcxDG.exe
  2⤵
  PID:6356
- C:\Windows\System\myTzjoP.exe
  C:\Windows\System\myTzjoP.exe
  2⤵
  PID:6448
- C:\Windows\System\IlbCGPC.exe
  C:\Windows\System\IlbCGPC.exe
  2⤵
  PID:6484
- C:\Windows\System\uwlreFy.exe
  C:\Windows\System\uwlreFy.exe
  2⤵
  PID:6520
- C:\Windows\System\SAvrMFr.exe
  C:\Windows\System\SAvrMFr.exe
  2⤵
  PID:6372
- C:\Windows\System\oNYYaKO.exe
  C:\Windows\System\oNYYaKO.exe
  2⤵
  PID:6432
- C:\Windows\System\uORCMpT.exe
  C:\Windows\System\uORCMpT.exe
  2⤵
  PID:6504
- C:\Windows\System\xszGlXt.exe
  C:\Windows\System\xszGlXt.exe
  2⤵
  PID:6584
- C:\Windows\System\HmJJTIr.exe
  C:\Windows\System\HmJJTIr.exe
  2⤵
  PID:6644
- C:\Windows\System\tkkpviE.exe
  C:\Windows\System\tkkpviE.exe
  2⤵
  PID:6600
- C:\Windows\System\VmZnFrT.exe
  C:\Windows\System\VmZnFrT.exe
  2⤵
  PID:6680
- C:\Windows\System\lXSPxuG.exe
  C:\Windows\System\lXSPxuG.exe
  2⤵
  PID:6744
- C:\Windows\System\NnRCLLg.exe
  C:\Windows\System\NnRCLLg.exe
  2⤵
  PID:6804
- C:\Windows\System\JQtRPrc.exe
  C:\Windows\System\JQtRPrc.exe
  2⤵
  PID:6872
- C:\Windows\System\giWCkBx.exe
  C:\Windows\System\giWCkBx.exe
  2⤵
  PID:6904
- C:\Windows\System\btKvnsX.exe
  C:\Windows\System\btKvnsX.exe
  2⤵
  PID:6968
- C:\Windows\System\kvQVYAo.exe
  C:\Windows\System\kvQVYAo.exe
  2⤵
  PID:6724
- C:\Windows\System\YVsIVmV.exe
  C:\Windows\System\YVsIVmV.exe
  2⤵
  PID:7016
- C:\Windows\System\WtCpaYT.exe
  C:\Windows\System\WtCpaYT.exe
  2⤵
  PID:6988
- C:\Windows\System\gGXNWsY.exe
  C:\Windows\System\gGXNWsY.exe
  2⤵
  PID:6760
- C:\Windows\System\FvalDRe.exe
  C:\Windows\System\FvalDRe.exe
  2⤵
  PID:7028
- C:\Windows\System\YTueDnL.exe
  C:\Windows\System\YTueDnL.exe
  2⤵
  PID:6852
- C:\Windows\System\dSUxYjI.exe
  C:\Windows\System\dSUxYjI.exe
  2⤵
  PID:7080
- C:\Windows\System\RfEXTDp.exe
  C:\Windows\System\RfEXTDp.exe
  2⤵
  PID:6948
- C:\Windows\System\tMNRmnZ.exe
  C:\Windows\System\tMNRmnZ.exe
  2⤵
  PID:7064
- C:\Windows\System\gSVukjs.exe
  C:\Windows\System\gSVukjs.exe
  2⤵
  PID:7124
- C:\Windows\System\aIClauh.exe
  C:\Windows\System\aIClauh.exe
  2⤵
  PID:7148
- C:\Windows\System\XwNLKNW.exe
  C:\Windows\System\XwNLKNW.exe
  2⤵
  PID:5604
- C:\Windows\System\jnoeChA.exe
  C:\Windows\System\jnoeChA.exe
  2⤵
  PID:6192
- C:\Windows\System\yMTHFBa.exe
  C:\Windows\System\yMTHFBa.exe
  2⤵
  PID:6228
- C:\Windows\System\FfLAcST.exe
  C:\Windows\System\FfLAcST.exe
  2⤵
  PID:5936
- C:\Windows\System\zFOGqkQ.exe
  C:\Windows\System\zFOGqkQ.exe
  2⤵
  PID:6244
- C:\Windows\System\cYkTCQq.exe
  C:\Windows\System\cYkTCQq.exe
  2⤵
  PID:6420
- C:\Windows\System\pCleXEV.exe
  C:\Windows\System\pCleXEV.exe
  2⤵
  PID:5736
- C:\Windows\System\QoAtVrv.exe
  C:\Windows\System\QoAtVrv.exe
  2⤵
  PID:6368
- C:\Windows\System\ORCEBEz.exe
  C:\Windows\System\ORCEBEz.exe
  2⤵
  PID:6552
- C:\Windows\System\dJLLJMr.exe
  C:\Windows\System\dJLLJMr.exe
  2⤵
  PID:6564
- C:\Windows\System\sjLOrCL.exe
  C:\Windows\System\sjLOrCL.exe
  2⤵
  PID:6840
- C:\Windows\System\ONAmUgj.exe
  C:\Windows\System\ONAmUgj.exe
  2⤵
  PID:6616
- C:\Windows\System\qpuYLvQ.exe
  C:\Windows\System\qpuYLvQ.exe
  2⤵
  PID:6936
- C:\Windows\System\UxMauIy.exe
  C:\Windows\System\UxMauIy.exe
  2⤵
  PID:6664
- C:\Windows\System\gJICtCo.exe
  C:\Windows\System\gJICtCo.exe
  2⤵
  PID:6756
- C:\Windows\System\UwMPfaw.exe
  C:\Windows\System\UwMPfaw.exe
  2⤵
  PID:6884
- C:\Windows\System\tbYkqJK.exe
  C:\Windows\System\tbYkqJK.exe
  2⤵
  PID:7144
- C:\Windows\System\VgWCIFp.exe
  C:\Windows\System\VgWCIFp.exe
  2⤵
  PID:6212
- C:\Windows\System\frElXVj.exe
  C:\Windows\System\frElXVj.exe
  2⤵
  PID:6304
- C:\Windows\System\GzsoWPW.exe
  C:\Windows\System\GzsoWPW.exe
  2⤵
  PID:6416
- C:\Windows\System\ywSExDz.exe
  C:\Windows\System\ywSExDz.exe
  2⤵
  PID:6580
- C:\Windows\System\bsWnDys.exe
  C:\Windows\System\bsWnDys.exe
  2⤵
  PID:7160
- C:\Windows\System\wylcrKT.exe
  C:\Windows\System\wylcrKT.exe
  2⤵
  PID:5588
- C:\Windows\System\GTnNiAE.exe
  C:\Windows\System\GTnNiAE.exe
  2⤵
  PID:6740
- C:\Windows\System\fOjXDaI.exe
  C:\Windows\System\fOjXDaI.exe
  2⤵
  PID:6964
- C:\Windows\System\cZNDXel.exe
  C:\Windows\System\cZNDXel.exe
  2⤵
  PID:6468
- C:\Windows\System\jZFbVNk.exe
  C:\Windows\System\jZFbVNk.exe
  2⤵
  PID:7012
- C:\Windows\System\zlsUZPC.exe
  C:\Windows\System\zlsUZPC.exe
  2⤵
  PID:6916
- C:\Windows\System\mICUHPE.exe
  C:\Windows\System\mICUHPE.exe
  2⤵
  PID:7076
- C:\Windows\System\GSckUVs.exe
  C:\Windows\System\GSckUVs.exe
  2⤵
  PID:6256
- C:\Windows\System\xKxWeIQ.exe
  C:\Windows\System\xKxWeIQ.exe
  2⤵
  PID:6340
- C:\Windows\System\tTBgmAT.exe
  C:\Windows\System\tTBgmAT.exe
  2⤵
  PID:6712
- C:\Windows\System\Csexzlh.exe
  C:\Windows\System\Csexzlh.exe
  2⤵
  PID:6824
- C:\Windows\System\YLlRNXQ.exe
  C:\Windows\System\YLlRNXQ.exe
  2⤵
  PID:6996
- C:\Windows\System\ZkwpNdD.exe
  C:\Windows\System\ZkwpNdD.exe
  2⤵
  PID:6496
- C:\Windows\System\QwiSWeo.exe
  C:\Windows\System\QwiSWeo.exe
  2⤵
  PID:7172
- C:\Windows\System\ceRaZbl.exe
  C:\Windows\System\ceRaZbl.exe
  2⤵
  PID:7188
- C:\Windows\System\VoEjJTY.exe
  C:\Windows\System\VoEjJTY.exe
  2⤵
  PID:7204
- C:\Windows\System\cOfxZEE.exe
  C:\Windows\System\cOfxZEE.exe
  2⤵
  PID:7220
- C:\Windows\System\INNyTsV.exe
  C:\Windows\System\INNyTsV.exe
  2⤵
  PID:7236
- C:\Windows\System\zCFhCVe.exe
  C:\Windows\System\zCFhCVe.exe
  2⤵
  PID:7252
- C:\Windows\System\dXNhTXk.exe
  C:\Windows\System\dXNhTXk.exe
  2⤵
  PID:7268
- C:\Windows\System\mXuuCGo.exe
  C:\Windows\System\mXuuCGo.exe
  2⤵
  PID:7284
- C:\Windows\System\pxqugBg.exe
  C:\Windows\System\pxqugBg.exe
  2⤵
  PID:7300
- C:\Windows\System\ucBooqe.exe
  C:\Windows\System\ucBooqe.exe
  2⤵
  PID:7316
- C:\Windows\System\wiTNhOZ.exe
  C:\Windows\System\wiTNhOZ.exe
  2⤵
  PID:7332
- C:\Windows\System\jmtjICu.exe
  C:\Windows\System\jmtjICu.exe
  2⤵
  PID:7348
- C:\Windows\System\MpFjKMg.exe
  C:\Windows\System\MpFjKMg.exe
  2⤵
  PID:7364
- C:\Windows\System\ijnArxc.exe
  C:\Windows\System\ijnArxc.exe
  2⤵
  PID:7380
- C:\Windows\System\lfEriTz.exe
  C:\Windows\System\lfEriTz.exe
  2⤵
  PID:7396
- C:\Windows\System\tZjnLcf.exe
  C:\Windows\System\tZjnLcf.exe
  2⤵
  PID:7412
- C:\Windows\System\kdojctB.exe
  C:\Windows\System\kdojctB.exe
  2⤵
  PID:7428
- C:\Windows\System\EKxVXVE.exe
  C:\Windows\System\EKxVXVE.exe
  2⤵
  PID:7444
- C:\Windows\System\VOIvUsX.exe
  C:\Windows\System\VOIvUsX.exe
  2⤵
  PID:7460
- C:\Windows\System\JygLqiH.exe
  C:\Windows\System\JygLqiH.exe
  2⤵
  PID:7476
- C:\Windows\System\usmpLHo.exe
  C:\Windows\System\usmpLHo.exe
  2⤵
  PID:7492
- C:\Windows\System\lMwHTNh.exe
  C:\Windows\System\lMwHTNh.exe
  2⤵
  PID:7508
- C:\Windows\System\zfpZTSp.exe
  C:\Windows\System\zfpZTSp.exe
  2⤵
  PID:7524
- C:\Windows\System\qndvnYa.exe
  C:\Windows\System\qndvnYa.exe
  2⤵
  PID:7540
- C:\Windows\System\rHhxMrH.exe
  C:\Windows\System\rHhxMrH.exe
  2⤵
  PID:7556
- C:\Windows\System\NEidOJr.exe
  C:\Windows\System\NEidOJr.exe
  2⤵
  PID:7572
- C:\Windows\System\hdSfzNq.exe
  C:\Windows\System\hdSfzNq.exe
  2⤵
  PID:7588
- C:\Windows\System\fGACerZ.exe
  C:\Windows\System\fGACerZ.exe
  2⤵
  PID:7604
- C:\Windows\System\uEIdGDd.exe
  C:\Windows\System\uEIdGDd.exe
  2⤵
  PID:7620
- C:\Windows\System\WzqCfZo.exe
  C:\Windows\System\WzqCfZo.exe
  2⤵
  PID:7636
- C:\Windows\System\WrwvDrv.exe
  C:\Windows\System\WrwvDrv.exe
  2⤵
  PID:7652
- C:\Windows\System\StKlakz.exe
  C:\Windows\System\StKlakz.exe
  2⤵
  PID:7668
- C:\Windows\System\KMfvRTh.exe
  C:\Windows\System\KMfvRTh.exe
  2⤵
  PID:7684
- C:\Windows\System\KOvHtft.exe
  C:\Windows\System\KOvHtft.exe
  2⤵
  PID:7700
- C:\Windows\System\uLhSosE.exe
  C:\Windows\System\uLhSosE.exe
  2⤵
  PID:7716
- C:\Windows\System\smkcOeD.exe
  C:\Windows\System\smkcOeD.exe
  2⤵
  PID:7732
- C:\Windows\System\fBTPtGQ.exe
  C:\Windows\System\fBTPtGQ.exe
  2⤵
  PID:7748
- C:\Windows\System\FImDROk.exe
  C:\Windows\System\FImDROk.exe
  2⤵
  PID:7764
- C:\Windows\System\dsFlzLk.exe
  C:\Windows\System\dsFlzLk.exe
  2⤵
  PID:7780
- C:\Windows\System\KYccMiy.exe
  C:\Windows\System\KYccMiy.exe
  2⤵
  PID:7796
- C:\Windows\System\yVfyTpC.exe
  C:\Windows\System\yVfyTpC.exe
  2⤵
  PID:7812
- C:\Windows\System\PApFqps.exe
  C:\Windows\System\PApFqps.exe
  2⤵
  PID:7828
- C:\Windows\System\PGCPDsR.exe
  C:\Windows\System\PGCPDsR.exe
  2⤵
  PID:7844
- C:\Windows\System\BZXCmRy.exe
  C:\Windows\System\BZXCmRy.exe
  2⤵
  PID:7864
- C:\Windows\System\nmbbeYF.exe
  C:\Windows\System\nmbbeYF.exe
  2⤵
  PID:7880
- C:\Windows\System\OKkrlME.exe
  C:\Windows\System\OKkrlME.exe
  2⤵
  PID:7896
- C:\Windows\System\MjoRbMS.exe
  C:\Windows\System\MjoRbMS.exe
  2⤵
  PID:7916
- C:\Windows\System\tqfMCYM.exe
  C:\Windows\System\tqfMCYM.exe
  2⤵
  PID:7932
- C:\Windows\System\SvBbqzR.exe
  C:\Windows\System\SvBbqzR.exe
  2⤵
  PID:7948
- C:\Windows\System\AlQGJum.exe
  C:\Windows\System\AlQGJum.exe
  2⤵
  PID:7964
- C:\Windows\System\EZApUbT.exe
  C:\Windows\System\EZApUbT.exe
  2⤵
  PID:7980
- C:\Windows\System\PrtPzPq.exe
  C:\Windows\System\PrtPzPq.exe
  2⤵
  PID:7996
- C:\Windows\System\IXrfyRT.exe
  C:\Windows\System\IXrfyRT.exe
  2⤵
  PID:8012
- C:\Windows\System\idhSbSL.exe
  C:\Windows\System\idhSbSL.exe
  2⤵
  PID:8028
- C:\Windows\System\YmULVko.exe
  C:\Windows\System\YmULVko.exe
  2⤵
  PID:8044
- C:\Windows\System\tIWHyyH.exe
  C:\Windows\System\tIWHyyH.exe
  2⤵
  PID:8060
- C:\Windows\System\vOVNgzW.exe
  C:\Windows\System\vOVNgzW.exe
  2⤵
  PID:8076
- C:\Windows\System\SKmeSEh.exe
  C:\Windows\System\SKmeSEh.exe
  2⤵
  PID:8092
- C:\Windows\System\ExKzYQD.exe
  C:\Windows\System\ExKzYQD.exe
  2⤵
  PID:8108
- C:\Windows\System\TwpZLwE.exe
  C:\Windows\System\TwpZLwE.exe
  2⤵
  PID:8124
- C:\Windows\System\mSbwDRq.exe
  C:\Windows\System\mSbwDRq.exe
  2⤵
  PID:8140
- C:\Windows\System\lWaQWdz.exe
  C:\Windows\System\lWaQWdz.exe
  2⤵
  PID:8156
- C:\Windows\System\ZyqBEgS.exe
  C:\Windows\System\ZyqBEgS.exe
  2⤵
  PID:7196
- C:\Windows\System\DKYVECa.exe
  C:\Windows\System\DKYVECa.exe
  2⤵
  PID:7404
- C:\Windows\System\ZOAUnCW.exe
  C:\Windows\System\ZOAUnCW.exe
  2⤵
  PID:7468
- C:\Windows\System\wTmDmLD.exe
  C:\Windows\System\wTmDmLD.exe
  2⤵
  PID:7232
- C:\Windows\System\jpwRvPS.exe
  C:\Windows\System\jpwRvPS.exe
  2⤵
  PID:7296
- C:\Windows\System\YeGUTrP.exe
  C:\Windows\System\YeGUTrP.exe
  2⤵
  PID:7532
- C:\Windows\System\EnJiqhE.exe
  C:\Windows\System\EnJiqhE.exe
  2⤵
  PID:7600
- C:\Windows\System\QGOqZJN.exe
  C:\Windows\System\QGOqZJN.exe
  2⤵
  PID:7392
- C:\Windows\System\CgXYrjf.exe
  C:\Windows\System\CgXYrjf.exe
  2⤵
  PID:7424
- C:\Windows\System\peuvZCz.exe
  C:\Windows\System\peuvZCz.exe
  2⤵
  PID:7612
- C:\Windows\System\igtGIbQ.exe
  C:\Windows\System\igtGIbQ.exe
  2⤵
  PID:7548
- C:\Windows\System\yMXscMs.exe
  C:\Windows\System\yMXscMs.exe
  2⤵
  PID:7660
- C:\Windows\System\yslYpHe.exe
  C:\Windows\System\yslYpHe.exe
  2⤵
  PID:7708
- C:\Windows\System\ccWvYUL.exe
  C:\Windows\System\ccWvYUL.exe
  2⤵
  PID:7728
- C:\Windows\System\PjiePeU.exe
  C:\Windows\System\PjiePeU.exe
  2⤵
  PID:7792
- C:\Windows\System\Cxbrrkh.exe
  C:\Windows\System\Cxbrrkh.exe
  2⤵
  PID:7860
- C:\Windows\System\rEMNVgP.exe
  C:\Windows\System\rEMNVgP.exe
  2⤵
  PID:7928
- C:\Windows\System\dxLgJpi.exe
  C:\Windows\System\dxLgJpi.exe
  2⤵
  PID:7956
- C:\Windows\System\PvycAAH.exe
  C:\Windows\System\PvycAAH.exe
  2⤵
  PID:8020
- C:\Windows\System\QEmQlJf.exe
  C:\Windows\System\QEmQlJf.exe
  2⤵
  PID:7740
- C:\Windows\System\GOUIqpa.exe
  C:\Windows\System\GOUIqpa.exe
  2⤵
  PID:7840
- C:\Windows\System\FLAndxI.exe
  C:\Windows\System\FLAndxI.exe
  2⤵
  PID:7904
- C:\Windows\System\vqPhvGh.exe
  C:\Windows\System\vqPhvGh.exe
  2⤵
  PID:7944
- C:\Windows\System\PwOErna.exe
  C:\Windows\System\PwOErna.exe
  2⤵
  PID:8036
- C:\Windows\System\shrFDZE.exe
  C:\Windows\System\shrFDZE.exe
  2⤵
  PID:8184
- C:\Windows\System\AxpbWZq.exe
  C:\Windows\System\AxpbWZq.exe
  2⤵
  PID:7184
- C:\Windows\System\ATCHxgg.exe
  C:\Windows\System\ATCHxgg.exe
  2⤵
  PID:6404
- C:\Windows\System\kIAVUta.exe
  C:\Windows\System\kIAVUta.exe
  2⤵
  PID:7312
- C:\Windows\System\cZoIaav.exe
  C:\Windows\System\cZoIaav.exe
  2⤵
  PID:6324
- C:\Windows\System\VeKYPiP.exe
  C:\Windows\System\VeKYPiP.exe
  2⤵
  PID:7376
- C:\Windows\System\HJABEPE.exe
  C:\Windows\System\HJABEPE.exe
  2⤵
  PID:7264
- C:\Windows\System\qcaczhK.exe
  C:\Windows\System\qcaczhK.exe
  2⤵
  PID:7260
- C:\Windows\System\fEzdmLI.exe
  C:\Windows\System\fEzdmLI.exe
  2⤵
  PID:7440
- C:\Windows\System\eEwaBEc.exe
  C:\Windows\System\eEwaBEc.exe
  2⤵
  PID:7456
- C:\Windows\System\tEfrHKu.exe
  C:\Windows\System\tEfrHKu.exe
  2⤵
  PID:7484
- C:\Windows\System\jKUylQv.exe
  C:\Windows\System\jKUylQv.exe
  2⤵
  PID:7552
- C:\Windows\System\MkxQTge.exe
  C:\Windows\System\MkxQTge.exe
  2⤵
  PID:7696
- C:\Windows\System\qijEfqb.exe
  C:\Windows\System\qijEfqb.exe
  2⤵
  PID:7760
- C:\Windows\System\KQUYYlt.exe
  C:\Windows\System\KQUYYlt.exe
  2⤵
  PID:7924
- C:\Windows\System\EJgSTQs.exe
  C:\Windows\System\EJgSTQs.exe
  2⤵
  PID:7872
- C:\Windows\System\HhWpdHz.exe
  C:\Windows\System\HhWpdHz.exe
  2⤵
  PID:8084
- C:\Windows\System\amvNEGo.exe
  C:\Windows\System\amvNEGo.exe
  2⤵
  PID:7836
- C:\Windows\System\NsLLNIq.exe
  C:\Windows\System\NsLLNIq.exe
  2⤵
  PID:7940
- C:\Windows\System\mCVIWyK.exe
  C:\Windows\System\mCVIWyK.exe
  2⤵
  PID:8068
- C:\Windows\System\bVSwTDv.exe
  C:\Windows\System\bVSwTDv.exe
  2⤵
  PID:8100
- C:\Windows\System\tJpYXid.exe
  C:\Windows\System\tJpYXid.exe
  2⤵
  PID:8168
- C:\Windows\System\DDntsql.exe
  C:\Windows\System\DDntsql.exe
  2⤵
  PID:7112
- C:\Windows\System\PIeyPPJ.exe
  C:\Windows\System\PIeyPPJ.exe
  2⤵
  PID:7248
- C:\Windows\System\GihmbkZ.exe
  C:\Windows\System\GihmbkZ.exe
  2⤵
  PID:7200
- C:\Windows\System\MCnrQsw.exe
  C:\Windows\System\MCnrQsw.exe
  2⤵
  PID:7596
- C:\Windows\System\soUnHke.exe
  C:\Windows\System\soUnHke.exe
  2⤵
  PID:7644
- C:\Windows\System\VfRmxHe.exe
  C:\Windows\System\VfRmxHe.exe
  2⤵
  PID:7992
- C:\Windows\System\ywYhjsO.exe
  C:\Windows\System\ywYhjsO.exe
  2⤵
  PID:7420
- C:\Windows\System\YgJcvOX.exe
  C:\Windows\System\YgJcvOX.exe
  2⤵
  PID:7680
- C:\Windows\System\vRuzKGa.exe
  C:\Windows\System\vRuzKGa.exe
  2⤵
  PID:8088
- C:\Windows\System\SeogqOK.exe
  C:\Windows\System\SeogqOK.exe
  2⤵
  PID:8008
- C:\Windows\System\KzOkHFN.exe
  C:\Windows\System\KzOkHFN.exe
  2⤵
  PID:8132
- C:\Windows\System\rZNLOvO.exe
  C:\Windows\System\rZNLOvO.exe
  2⤵
  PID:7244
- C:\Windows\System\qmVzLiI.exe
  C:\Windows\System\qmVzLiI.exe
  2⤵
  PID:7328
- C:\Windows\System\IBVQBrX.exe
  C:\Windows\System\IBVQBrX.exe
  2⤵
  PID:7776
- C:\Windows\System\qKNFXUW.exe
  C:\Windows\System\qKNFXUW.exe
  2⤵
  PID:8204
- C:\Windows\System\UeaBGWa.exe
  C:\Windows\System\UeaBGWa.exe
  2⤵
  PID:8220
- C:\Windows\System\ibpvnSi.exe
  C:\Windows\System\ibpvnSi.exe
  2⤵
  PID:8240
- C:\Windows\System\NmpavBh.exe
  C:\Windows\System\NmpavBh.exe
  2⤵
  PID:8256
- C:\Windows\System\KlHSSUJ.exe
  C:\Windows\System\KlHSSUJ.exe
  2⤵
  PID:8272
- C:\Windows\System\SqqDPsI.exe
  C:\Windows\System\SqqDPsI.exe
  2⤵
  PID:8292
- C:\Windows\System\YdmiZAR.exe
  C:\Windows\System\YdmiZAR.exe
  2⤵
  PID:8336
- C:\Windows\System\rcnSUmq.exe
  C:\Windows\System\rcnSUmq.exe
  2⤵
  PID:8356
- C:\Windows\System\xhGSUzU.exe
  C:\Windows\System\xhGSUzU.exe
  2⤵
  PID:8372
- C:\Windows\System\redAhrX.exe
  C:\Windows\System\redAhrX.exe
  2⤵
  PID:8388
- C:\Windows\System\SjLYhyO.exe
  C:\Windows\System\SjLYhyO.exe
  2⤵
  PID:8404
- C:\Windows\System\mBNbKFT.exe
  C:\Windows\System\mBNbKFT.exe
  2⤵
  PID:8424
- C:\Windows\System\iIMsAcb.exe
  C:\Windows\System\iIMsAcb.exe
  2⤵
  PID:8444
- C:\Windows\System\QUzcWih.exe
  C:\Windows\System\QUzcWih.exe
  2⤵
  PID:8460
- C:\Windows\System\iEpfebd.exe
  C:\Windows\System\iEpfebd.exe
  2⤵
  PID:8476
- C:\Windows\System\ppolljY.exe
  C:\Windows\System\ppolljY.exe
  2⤵
  PID:8492
- C:\Windows\System\oVCCUta.exe
  C:\Windows\System\oVCCUta.exe
  2⤵
  PID:8508
- C:\Windows\System\LWCzSoA.exe
  C:\Windows\System\LWCzSoA.exe
  2⤵
  PID:8524
- C:\Windows\System\TaxgOck.exe
  C:\Windows\System\TaxgOck.exe
  2⤵
  PID:8540
- C:\Windows\System\sGzRTkG.exe
  C:\Windows\System\sGzRTkG.exe
  2⤵
  PID:8556
- C:\Windows\System\UtiAZcp.exe
  C:\Windows\System\UtiAZcp.exe
  2⤵
  PID:8572
- C:\Windows\System\yrAtajs.exe
  C:\Windows\System\yrAtajs.exe
  2⤵
  PID:8588
- C:\Windows\System\RGcvJEj.exe
  C:\Windows\System\RGcvJEj.exe
  2⤵
  PID:8604
- C:\Windows\System\iWUcrjo.exe
  C:\Windows\System\iWUcrjo.exe
  2⤵
  PID:8620
- C:\Windows\System\XsnQvCx.exe
  C:\Windows\System\XsnQvCx.exe
  2⤵
  PID:8636
- C:\Windows\System\ULMUPhp.exe
  C:\Windows\System\ULMUPhp.exe
  2⤵
  PID:8652
- C:\Windows\System\YNGbSZJ.exe
  C:\Windows\System\YNGbSZJ.exe
  2⤵
  PID:8672
- C:\Windows\System\VGzwFZu.exe
  C:\Windows\System\VGzwFZu.exe
  2⤵
  PID:8688
- C:\Windows\System\jmlDnOu.exe
  C:\Windows\System\jmlDnOu.exe
  2⤵
  PID:8704
- C:\Windows\System\aZHqXCd.exe
  C:\Windows\System\aZHqXCd.exe
  2⤵
  PID:8720
- C:\Windows\System\YXuuuQa.exe
  C:\Windows\System\YXuuuQa.exe
  2⤵
  PID:8740
- C:\Windows\System\BMFyorf.exe
  C:\Windows\System\BMFyorf.exe
  2⤵
  PID:8756
- C:\Windows\System\lTgsUgQ.exe
  C:\Windows\System\lTgsUgQ.exe
  2⤵
  PID:8772
- C:\Windows\System\JSAWqjr.exe
  C:\Windows\System\JSAWqjr.exe
  2⤵
  PID:8788
- C:\Windows\System\UZmsxUj.exe
  C:\Windows\System\UZmsxUj.exe
  2⤵
  PID:8804
- C:\Windows\System\bDPhmGE.exe
  C:\Windows\System\bDPhmGE.exe
  2⤵
  PID:8820
- C:\Windows\System\GtxBtGm.exe
  C:\Windows\System\GtxBtGm.exe
  2⤵
  PID:8836
- C:\Windows\System\zdmiOHU.exe
  C:\Windows\System\zdmiOHU.exe
  2⤵
  PID:8860
- C:\Windows\System\YZfUFrM.exe
  C:\Windows\System\YZfUFrM.exe
  2⤵
  PID:8880
- C:\Windows\System\nDYFRIv.exe
  C:\Windows\System\nDYFRIv.exe
  2⤵
  PID:8896
- C:\Windows\System\LmhlKQw.exe
  C:\Windows\System\LmhlKQw.exe
  2⤵
  PID:8912
- C:\Windows\System\CuOwvTE.exe
  C:\Windows\System\CuOwvTE.exe
  2⤵
  PID:8928
- C:\Windows\System\VtGUxMB.exe
  C:\Windows\System\VtGUxMB.exe
  2⤵
  PID:8944
- C:\Windows\System\hZQUIuN.exe
  C:\Windows\System\hZQUIuN.exe
  2⤵
  PID:8960
- C:\Windows\System\gtbmsWA.exe
  C:\Windows\System\gtbmsWA.exe
  2⤵
  PID:8976
- C:\Windows\System\qrvlvyy.exe
  C:\Windows\System\qrvlvyy.exe
  2⤵
  PID:8992
- C:\Windows\System\ybytFlY.exe
  C:\Windows\System\ybytFlY.exe
  2⤵
  PID:9008
- C:\Windows\System\MxMXfEt.exe
  C:\Windows\System\MxMXfEt.exe
  2⤵
  PID:9024
- C:\Windows\System\UXLPSjS.exe
  C:\Windows\System\UXLPSjS.exe
  2⤵
  PID:9040
- C:\Windows\System\QlrfZyt.exe
  C:\Windows\System\QlrfZyt.exe
  2⤵
  PID:9056
- C:\Windows\System\LBdbxoF.exe
  C:\Windows\System\LBdbxoF.exe
  2⤵
  PID:9072
- C:\Windows\System\EACQzOp.exe
  C:\Windows\System\EACQzOp.exe
  2⤵
  PID:9092
- C:\Windows\System\KdlQffW.exe
  C:\Windows\System\KdlQffW.exe
  2⤵
  PID:9108
- C:\Windows\System\zlxFEjY.exe
  C:\Windows\System\zlxFEjY.exe
  2⤵
  PID:9128
- C:\Windows\System\JtUUUAp.exe
  C:\Windows\System\JtUUUAp.exe
  2⤵
  PID:9152
- C:\Windows\System\JJXLlGX.exe
  C:\Windows\System\JJXLlGX.exe
  2⤵
  PID:7856
- C:\Windows\System\YmJZtBk.exe
  C:\Windows\System\YmJZtBk.exe
  2⤵
  PID:7804
- C:\Windows\System\wZdykUO.exe
  C:\Windows\System\wZdykUO.exe
  2⤵
  PID:8320
- C:\Windows\System\nytXUHo.exe
  C:\Windows\System\nytXUHo.exe
  2⤵
  PID:8344
- C:\Windows\System\jhtmMms.exe
  C:\Windows\System\jhtmMms.exe
  2⤵
  PID:8368
- C:\Windows\System\nMAuqXn.exe
  C:\Windows\System\nMAuqXn.exe
  2⤵
  PID:8416
- C:\Windows\System\uMSeIgV.exe
  C:\Windows\System\uMSeIgV.exe
  2⤵
  PID:8396
- C:\Windows\System\PuNLCGH.exe
  C:\Windows\System\PuNLCGH.exe
  2⤵
  PID:8516
- C:\Windows\System\tPwwlMS.exe
  C:\Windows\System\tPwwlMS.exe
  2⤵
  PID:8580
- C:\Windows\System\JpOHEXU.exe
  C:\Windows\System\JpOHEXU.exe
  2⤵
  PID:8648
- C:\Windows\System\DNxCBeh.exe
  C:\Windows\System\DNxCBeh.exe
  2⤵
  PID:8440
- C:\Windows\System\cmKCNLw.exe
  C:\Windows\System\cmKCNLw.exe
  2⤵
  PID:8712
- C:\Windows\System\elZqfCH.exe
  C:\Windows\System\elZqfCH.exe
  2⤵
  PID:8780
- C:\Windows\System\kAHwOtT.exe
  C:\Windows\System\kAHwOtT.exe
  2⤵
  PID:8812
- C:\Windows\System\OphZQRq.exe
  C:\Windows\System\OphZQRq.exe
  2⤵
  PID:8564
- C:\Windows\System\BUvGrsu.exe
  C:\Windows\System\BUvGrsu.exe
  2⤵
  PID:8596
- C:\Windows\System\MMDGXOz.exe
  C:\Windows\System\MMDGXOz.exe
  2⤵
  PID:8768
- C:\Windows\System\dviPUrK.exe
  C:\Windows\System\dviPUrK.exe
  2⤵
  PID:8888
- C:\Windows\System\sCDZVaB.exe
  C:\Windows\System\sCDZVaB.exe
  2⤵
  PID:8924
- C:\Windows\System\jpKCdfs.exe
  C:\Windows\System\jpKCdfs.exe
  2⤵
  PID:8828
- C:\Windows\System\MSxqTBN.exe
  C:\Windows\System\MSxqTBN.exe
  2⤵
  PID:8696
- C:\Windows\System\AkwKZYU.exe
  C:\Windows\System\AkwKZYU.exe
  2⤵
  PID:8800
- C:\Windows\System\VwuLDiD.exe
  C:\Windows\System\VwuLDiD.exe
  2⤵
  PID:8728
- C:\Windows\System\JfgyPik.exe
  C:\Windows\System\JfgyPik.exe
  2⤵
  PID:9088
- C:\Windows\System\KxdKKRC.exe
  C:\Windows\System\KxdKKRC.exe
  2⤵
  PID:9116
- C:\Windows\System\XTUXiDq.exe
  C:\Windows\System\XTUXiDq.exe
  2⤵
  PID:9124
- C:\Windows\System\pBNFcTY.exe
  C:\Windows\System\pBNFcTY.exe
  2⤵
  PID:8968
- C:\Windows\System\oEWxYmQ.exe
  C:\Windows\System\oEWxYmQ.exe
  2⤵
  PID:9032
- C:\Windows\System\JppXwfW.exe
  C:\Windows\System\JppXwfW.exe
  2⤵
  PID:9100
- C:\Windows\System\PWVAaGl.exe
  C:\Windows\System\PWVAaGl.exe
  2⤵
  PID:9148
- C:\Windows\System\byDxWMq.exe
  C:\Windows\System\byDxWMq.exe
  2⤵
  PID:9180
- C:\Windows\System\hwJHnns.exe
  C:\Windows\System\hwJHnns.exe
  2⤵
  PID:9204
- C:\Windows\System\LchpWPS.exe
  C:\Windows\System\LchpWPS.exe
  2⤵
  PID:9200
- C:\Windows\System\OJrASjU.exe
  C:\Windows\System\OJrASjU.exe
  2⤵
  PID:8152
- C:\Windows\System\xknuDfV.exe
  C:\Windows\System\xknuDfV.exe
  2⤵
  PID:8216
- C:\Windows\System\uvrYYYd.exe
  C:\Windows\System\uvrYYYd.exe
  2⤵
  PID:7344
- C:\Windows\System\sTsvGvH.exe
  C:\Windows\System\sTsvGvH.exe
  2⤵
  PID:7820
- C:\Windows\System\RvCZtmN.exe
  C:\Windows\System\RvCZtmN.exe
  2⤵
  PID:8268
- C:\Windows\System\qneFCUn.exe
  C:\Windows\System\qneFCUn.exe
  2⤵
  PID:8284
- C:\Windows\System\qACeIKX.exe
  C:\Windows\System\qACeIKX.exe
  2⤵
  PID:8164
- C:\Windows\System\lxGUYPt.exe
  C:\Windows\System\lxGUYPt.exe
  2⤵
  PID:8308
- C:\Windows\System\SfuzFSU.exe
  C:\Windows\System\SfuzFSU.exe
  2⤵
  PID:8452
- C:\Windows\System\wGiGBSJ.exe
  C:\Windows\System\wGiGBSJ.exe
  2⤵
  PID:8552
- C:\Windows\System\iItSwBS.exe
  C:\Windows\System\iItSwBS.exe
  2⤵
  PID:8400
- C:\Windows\System\YEqZTel.exe
  C:\Windows\System\YEqZTel.exe
  2⤵
  PID:8844
- C:\Windows\System\MioCpam.exe
  C:\Windows\System\MioCpam.exe
  2⤵
  PID:8680
- C:\Windows\System\xlLtHvT.exe
  C:\Windows\System\xlLtHvT.exe
  2⤵
  PID:8488
- C:\Windows\System\gOSrIbr.exe
  C:\Windows\System\gOSrIbr.exe
  2⤵
  PID:8472
- C:\Windows\System\xkMOSNR.exe
  C:\Windows\System\xkMOSNR.exe
  2⤵
  PID:8868
- C:\Windows\System\HnYNPgJ.exe
  C:\Windows\System\HnYNPgJ.exe
  2⤵
  PID:8600
- C:\Windows\System\hOQelrH.exe
  C:\Windows\System\hOQelrH.exe
  2⤵
  PID:6388
- C:\Windows\System\FsKHpXB.exe
  C:\Windows\System\FsKHpXB.exe
  2⤵
  PID:9052
- C:\Windows\System\RftZjsl.exe
  C:\Windows\System\RftZjsl.exe
  2⤵
  PID:9084
- C:\Windows\System\oVUsDDn.exe
  C:\Windows\System\oVUsDDn.exe
  2⤵
  PID:9192
- C:\Windows\System\uSZshSn.exe
  C:\Windows\System\uSZshSn.exe
  2⤵
  PID:9120
- C:\Windows\System\uHJghts.exe
  C:\Windows\System\uHJghts.exe
  2⤵
  PID:9000
- C:\Windows\System\FbbrYBl.exe
  C:\Windows\System\FbbrYBl.exe
  2⤵
  PID:8212
- C:\Windows\System\lOuOnbE.exe
  C:\Windows\System\lOuOnbE.exe
  2⤵
  PID:8248
- C:\Windows\System\iJtrfXQ.exe
  C:\Windows\System\iJtrfXQ.exe
  2⤵
  PID:8264
- C:\Windows\System\MeZAMCo.exe
  C:\Windows\System\MeZAMCo.exe
  2⤵
  PID:8252
- C:\Windows\System\PJDZyGt.exe
  C:\Windows\System\PJDZyGt.exe
  2⤵
  PID:8500
- C:\Windows\System\hYxHcox.exe
  C:\Windows\System\hYxHcox.exe
  2⤵
  PID:8332
- C:\Windows\System\Dahmvzc.exe
  C:\Windows\System\Dahmvzc.exe
  2⤵
  PID:9020
- C:\Windows\System\QVjPyCx.exe
  C:\Windows\System\QVjPyCx.exe
  2⤵
  PID:8364
- C:\Windows\System\nmPgCbG.exe
  C:\Windows\System\nmPgCbG.exe
  2⤵
  PID:8616
- C:\Windows\System\GdkkOOX.exe
  C:\Windows\System\GdkkOOX.exe
  2⤵
  PID:9188
- C:\Windows\System\fyQVWDS.exe
  C:\Windows\System\fyQVWDS.exe
  2⤵
  PID:8972
- C:\Windows\System\XEvmBMJ.exe
  C:\Windows\System\XEvmBMJ.exe
  2⤵
  PID:9004
- C:\Windows\System\YSMbUKK.exe
  C:\Windows\System\YSMbUKK.exe
  2⤵
  PID:9168
- C:\Windows\System\WClBukr.exe
  C:\Windows\System\WClBukr.exe
  2⤵
  PID:8312
- C:\Windows\System\uWwzhBr.exe
  C:\Windows\System\uWwzhBr.exe
  2⤵
  PID:8532
- C:\Windows\System\aDljjhk.exe
  C:\Windows\System\aDljjhk.exe
  2⤵
  PID:8348
- C:\Windows\System\kezkdnv.exe
  C:\Windows\System\kezkdnv.exe
  2⤵
  PID:8412
- C:\Windows\System\lqMDULm.exe
  C:\Windows\System\lqMDULm.exe
  2⤵
  PID:8232
- C:\Windows\System\hvlJonl.exe
  C:\Windows\System\hvlJonl.exe
  2⤵
  PID:9144
- C:\Windows\System\KnAzKsj.exe
  C:\Windows\System\KnAzKsj.exe
  2⤵
  PID:8664
- C:\Windows\System\glmWGaU.exe
  C:\Windows\System\glmWGaU.exe
  2⤵
  PID:8856
- C:\Windows\System\SnjTyBF.exe
  C:\Windows\System\SnjTyBF.exe
  2⤵
  PID:9164
- C:\Windows\System\GhamjPc.exe
  C:\Windows\System\GhamjPc.exe
  2⤵
  PID:8548
- C:\Windows\System\JSQzOjA.exe
  C:\Windows\System\JSQzOjA.exe
  2⤵
  PID:7912
- C:\Windows\System\EtbzGZJ.exe
  C:\Windows\System\EtbzGZJ.exe
  2⤵
  PID:9232
- C:\Windows\System\YLXrLrz.exe
  C:\Windows\System\YLXrLrz.exe
  2⤵
  PID:9248
- C:\Windows\System\EaBTAjR.exe
  C:\Windows\System\EaBTAjR.exe
  2⤵
  PID:9264
- C:\Windows\System\aBnCxYm.exe
  C:\Windows\System\aBnCxYm.exe
  2⤵
  PID:9280
- C:\Windows\System\clLhhxz.exe
  C:\Windows\System\clLhhxz.exe
  2⤵
  PID:9296
- C:\Windows\System\tgFUPKA.exe
  C:\Windows\System\tgFUPKA.exe
  2⤵
  PID:9312
- C:\Windows\System\CeniBvg.exe
  C:\Windows\System\CeniBvg.exe
  2⤵
  PID:9328
- C:\Windows\System\KvmOeuc.exe
  C:\Windows\System\KvmOeuc.exe
  2⤵
  PID:9344
- C:\Windows\System\ymJJbwK.exe
  C:\Windows\System\ymJJbwK.exe
  2⤵
  PID:9360
- C:\Windows\System\XcoovoC.exe
  C:\Windows\System\XcoovoC.exe
  2⤵
  PID:9376
- C:\Windows\System\iPBfjDR.exe
  C:\Windows\System\iPBfjDR.exe
  2⤵
  PID:9392
- C:\Windows\System\pPkaZoL.exe
  C:\Windows\System\pPkaZoL.exe
  2⤵
  PID:9408
- C:\Windows\System\cKtQpny.exe
  C:\Windows\System\cKtQpny.exe
  2⤵
  PID:9424
- C:\Windows\System\NPXKbCC.exe
  C:\Windows\System\NPXKbCC.exe
  2⤵
  PID:9440
- C:\Windows\System\OMkfYen.exe
  C:\Windows\System\OMkfYen.exe
  2⤵
  PID:9456
- C:\Windows\System\krFwBgn.exe
  C:\Windows\System\krFwBgn.exe
  2⤵
  PID:9472
- C:\Windows\System\ydOUhJy.exe
  C:\Windows\System\ydOUhJy.exe
  2⤵
  PID:9488
- C:\Windows\System\hrVuMwW.exe
  C:\Windows\System\hrVuMwW.exe
  2⤵
  PID:9504
- C:\Windows\System\lWGmXYy.exe
  C:\Windows\System\lWGmXYy.exe
  2⤵
  PID:9520
- C:\Windows\System\tDpRIot.exe
  C:\Windows\System\tDpRIot.exe
  2⤵
  PID:9536
- C:\Windows\System\LZMitye.exe
  C:\Windows\System\LZMitye.exe
  2⤵
  PID:9552
- C:\Windows\System\Wgslnca.exe
  C:\Windows\System\Wgslnca.exe
  2⤵
  PID:9568
- C:\Windows\System\OkHuVdR.exe
  C:\Windows\System\OkHuVdR.exe
  2⤵
  PID:9584
- C:\Windows\System\PspTCNk.exe
  C:\Windows\System\PspTCNk.exe
  2⤵
  PID:9600
- C:\Windows\System\IOegJlp.exe
  C:\Windows\System\IOegJlp.exe
  2⤵
  PID:9620
- C:\Windows\System\YdtFIQH.exe
  C:\Windows\System\YdtFIQH.exe
  2⤵
  PID:9640
- C:\Windows\System\FLfjpfx.exe
  C:\Windows\System\FLfjpfx.exe
  2⤵
  PID:9660
- C:\Windows\System\YwevuCU.exe
  C:\Windows\System\YwevuCU.exe
  2⤵
  PID:9680
- C:\Windows\System\ljOpziK.exe
  C:\Windows\System\ljOpziK.exe
  2⤵
  PID:9704
- C:\Windows\System\pTuDhdw.exe
  C:\Windows\System\pTuDhdw.exe
  2⤵
  PID:9724
- C:\Windows\System\LuRIGaj.exe
  C:\Windows\System\LuRIGaj.exe
  2⤵
  PID:9744
- C:\Windows\System\kKoSHkB.exe
  C:\Windows\System\kKoSHkB.exe
  2⤵
  PID:9760
- C:\Windows\System\fJAfQlA.exe
  C:\Windows\System\fJAfQlA.exe
  2⤵
  PID:9776
- C:\Windows\System\bPMMnEm.exe
  C:\Windows\System\bPMMnEm.exe
  2⤵
  PID:9808
- C:\Windows\System\OCmpPhP.exe
  C:\Windows\System\OCmpPhP.exe
  2⤵
  PID:9832
- C:\Windows\System\OVUZsfI.exe
  C:\Windows\System\OVUZsfI.exe
  2⤵
  PID:9868
- C:\Windows\System\rjflpqk.exe
  C:\Windows\System\rjflpqk.exe
  2⤵
  PID:9884
- C:\Windows\System\SKUHLyP.exe
  C:\Windows\System\SKUHLyP.exe
  2⤵
  PID:9900
- C:\Windows\System\XXAqFTU.exe
  C:\Windows\System\XXAqFTU.exe
  2⤵
  PID:9928
- C:\Windows\System\lLbYuux.exe
  C:\Windows\System\lLbYuux.exe
  2⤵
  PID:9944
- C:\Windows\System\EWpRGLA.exe
  C:\Windows\System\EWpRGLA.exe
  2⤵
  PID:9960
- C:\Windows\System\XcSQXPJ.exe
  C:\Windows\System\XcSQXPJ.exe
  2⤵
  PID:9976
- C:\Windows\System\KCysCfY.exe
  C:\Windows\System\KCysCfY.exe
  2⤵
  PID:9996
- C:\Windows\System\exyEGYo.exe
  C:\Windows\System\exyEGYo.exe
  2⤵
  PID:10016
- C:\Windows\System\JFNKkBF.exe
  C:\Windows\System\JFNKkBF.exe
  2⤵
  PID:10032
- C:\Windows\System\KLhPVkt.exe
  C:\Windows\System\KLhPVkt.exe
  2⤵
  PID:10052
- C:\Windows\System\bdGLNmX.exe
  C:\Windows\System\bdGLNmX.exe
  2⤵
  PID:10068
- C:\Windows\System\biZPkOK.exe
  C:\Windows\System\biZPkOK.exe
  2⤵
  PID:10084
- C:\Windows\System\kcYDEeD.exe
  C:\Windows\System\kcYDEeD.exe
  2⤵
  PID:10100
- C:\Windows\System\lbtOWTM.exe
  C:\Windows\System\lbtOWTM.exe
  2⤵
  PID:10116
- C:\Windows\System\cLjFoNY.exe
  C:\Windows\System\cLjFoNY.exe
  2⤵
  PID:10132
- C:\Windows\System\wFqQIyv.exe
  C:\Windows\System\wFqQIyv.exe
  2⤵
  PID:10148
- C:\Windows\System\VioLnuH.exe
  C:\Windows\System\VioLnuH.exe
  2⤵
  PID:10164
- C:\Windows\System\kTGCGad.exe
  C:\Windows\System\kTGCGad.exe
  2⤵
  PID:10180
- C:\Windows\System\SREQZTZ.exe
  C:\Windows\System\SREQZTZ.exe
  2⤵
  PID:10196
- C:\Windows\System\MwAYbiX.exe
  C:\Windows\System\MwAYbiX.exe
  2⤵
  PID:10212
- C:\Windows\System\CYVuHka.exe
  C:\Windows\System\CYVuHka.exe
  2⤵
  PID:10228
- C:\Windows\System\hpgjuTk.exe
  C:\Windows\System\hpgjuTk.exe
  2⤵
  PID:9260
- C:\Windows\System\qZIEowY.exe
  C:\Windows\System\qZIEowY.exe
  2⤵
  PID:9244
- C:\Windows\System\hCvIdBx.exe
  C:\Windows\System\hCvIdBx.exe
  2⤵
  PID:9272
- C:\Windows\System\OPRVPHx.exe
  C:\Windows\System\OPRVPHx.exe
  2⤵
  PID:9324
- C:\Windows\System\uTrzCie.exe
  C:\Windows\System\uTrzCie.exe
  2⤵
  PID:9356
- C:\Windows\System\WgdKahV.exe
  C:\Windows\System\WgdKahV.exe
  2⤵
  PID:9420
- C:\Windows\System\cJkpCnw.exe
  C:\Windows\System\cJkpCnw.exe
  2⤵
  PID:9484
- C:\Windows\System\CKahOKO.exe
  C:\Windows\System\CKahOKO.exe
  2⤵
  PID:9516
- C:\Windows\System\ptWmEDY.exe
  C:\Windows\System\ptWmEDY.exe
  2⤵
  PID:9400
- C:\Windows\System\bOTDJOm.exe
  C:\Windows\System\bOTDJOm.exe
  2⤵
  PID:9436
- C:\Windows\System\NveunGP.exe
  C:\Windows\System\NveunGP.exe
  2⤵
  PID:9528
- C:\Windows\System\HSaqnyt.exe
  C:\Windows\System\HSaqnyt.exe
  2⤵
  PID:9652
- C:\Windows\System\ZVpkpHA.exe
  C:\Windows\System\ZVpkpHA.exe
  2⤵
  PID:9736
- C:\Windows\System\DeJIrft.exe
  C:\Windows\System\DeJIrft.exe
  2⤵
  PID:9844
- C:\Windows\System\qCgflpO.exe
  C:\Windows\System\qCgflpO.exe
  2⤵
  PID:9852
- C:\Windows\System\JzdNJOT.exe
  C:\Windows\System\JzdNJOT.exe
  2⤵
  PID:9916
- C:\Windows\System\XalHyKq.exe
  C:\Windows\System\XalHyKq.exe
  2⤵
  PID:9936
- C:\Windows\System\ZmILemM.exe
  C:\Windows\System\ZmILemM.exe
  2⤵
  PID:10064
- C:\Windows\System\ndotYmu.exe
  C:\Windows\System\ndotYmu.exe
  2⤵
  PID:9968
- C:\Windows\System\TNjgImu.exe
  C:\Windows\System\TNjgImu.exe
  2⤵
  PID:10076
- C:\Windows\System\GwcoYIh.exe
  C:\Windows\System\GwcoYIh.exe
  2⤵
  PID:10220
- C:\Windows\System\kgathYE.exe
  C:\Windows\System\kgathYE.exe
  2⤵
  PID:10204
- C:\Windows\System\BCmekLX.exe
  C:\Windows\System\BCmekLX.exe
  2⤵
  PID:9256
- C:\Windows\System\AQeXGKU.exe
  C:\Windows\System\AQeXGKU.exe
  2⤵
  PID:9416
- C:\Windows\System\IIcoleP.exe
  C:\Windows\System\IIcoleP.exe
  2⤵
  PID:9368
- C:\Windows\System\LDtSDml.exe
  C:\Windows\System\LDtSDml.exe
  2⤵
  PID:9352
- C:\Windows\System\UQZYCLo.exe
  C:\Windows\System\UQZYCLo.exe
  2⤵
  PID:9532
- C:\Windows\System\PpZrzsm.exe
  C:\Windows\System\PpZrzsm.exe
  2⤵
  PID:9372
- C:\Windows\System\VWQelLY.exe
  C:\Windows\System\VWQelLY.exe
  2⤵
  PID:9468
- C:\Windows\System\yrmuCbT.exe
  C:\Windows\System\yrmuCbT.exe
  2⤵
  PID:9596
- C:\Windows\System\TlBVKgg.exe
  C:\Windows\System\TlBVKgg.exe
  2⤵
  PID:9692
- C:\Windows\System\ZmCkixq.exe
  C:\Windows\System\ZmCkixq.exe
  2⤵
  PID:9696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQuBkWX.exe

Filesize
1.4MB

MD5
6fb60b5d203b6098641cc3b9e593a58e

SHA1
99e88988c74b2df024583f5ab00699dbe0ab806e

SHA256
c57c2ab57273e768c3d652f353b01a36308a4fff7994c6af6be1601cd4b31d43

SHA512
b4d232eeb564896e5a2d0bbfee14c8bfdba4ffb4fd99c08b32f9b172c504bef1a4b95a2398adbbd1cfcab22099fa4c773b8a9afd9ffed903abdf5c077b2cc608

Download Submit
C:\Windows\system\AmpQRtW.exe

Filesize
1.4MB

MD5
3cf01c4f5f63fa5d169d5a4d11cb7075

SHA1
74674e22ffbdf35f41201e19a72a186b7242a694

SHA256
636958f73255bf779948484cdb53064415a5c173886ab03d510b2fcbab973a02

SHA512
aee5cf2d61dee29b1e0a3e87117b7460ee1ab197225c1fa3a243b9e2c6c6b6af89256975e7c586b542a428ab6475ff164fd9057a8843f497157eec1c38bb281d

Download Submit
C:\Windows\system\CfFehco.exe

Filesize
1.4MB

MD5
7df4329d5724e7add672886e826435f9

SHA1
baf707d7cf35accab0db655c7291531c000c2740

SHA256
d93f5739a796208747e7b1050d257a9e50ac6b5ecc112c1c27e36939f409c8cd

SHA512
220285f45e116b382e52a43948a0ed7b90751465c90197d92d1d7cd09da8a6d4061170a6d1344f49cf576ea5f53030fd124eeea188180e984e3127f984ace425

Download Submit
C:\Windows\system\CkMuFUy.exe

Filesize
1.4MB

MD5
cb347892757e920bec11411cac2ed12b

SHA1
82d7e7fced3f94c8cbd90870d66308e9997f71d0

SHA256
935b8e1e5c574729cc75a8eb6911eee26213d3edcce837be818be5b5c7bd7905

SHA512
a1ea258c3648554f558b8c43c6e7efbc2cff180fc37d83615818af44386cd3cbc87dbe487cf4a3c341a66e1a2b245a36ae56fa158c9d779a11e3cb0006339f25

Download Submit
C:\Windows\system\IKPWbVU.exe

Filesize
1.4MB

MD5
0598bb9da5439ed05adfca1d3770ea5e

SHA1
5b09c24aeed55a10cd3e61d47a073077b69047bf

SHA256
e56d64a010ce16d736130d57661408bbc6e7e50db9a65ad070f5a7a4ad36f36e

SHA512
9a1a8d47c1f2e418f1145e56931f165682bf9f6863b211e7210115a58253c845e66b5bc6d7fa20559c22742452337b1bc982d07bc253e61eacffa910ab7673ab

Download Submit
C:\Windows\system\MYwERbr.exe

Filesize
1.4MB

MD5
18043cb0bb5e1d023d57d286c426b030

SHA1
4be26251adcb5f33215bffc4370244358541d65c

SHA256
d968907b9c706b0e21a4e8e254504199366330ebf623c4269ccea94c22fee86f

SHA512
0b9abe5cc8c9687c0cd847332ac6b765e1fc0884527229da2db8148cd418fcfdc04a91034dd889b25df33fd5acdec87c194ae151591d8f25bc7417f27e90be06

Download Submit
C:\Windows\system\OHkacUq.exe

Filesize
1.4MB

MD5
70c426260a55b66a168b38971db5ab3e

SHA1
72a258bc99c6cc0968a136dc03128d3f966556ac

SHA256
3a8b029b7d37b666f93cf616d38ebadc3c269fbf9fc25872a9966696c34cfb6a

SHA512
49109418e9a98d6f38cde11f4b249e07a3b876e48aaae9e928848b6429bb35b34cbfd6423162c4fa5dec098ac70a2dc1320fa402f0f8f3bb8201a16070597092

Download Submit
C:\Windows\system\SazzcTb.exe

Filesize
1.4MB

MD5
1ddf29138d0b042f3478fdd576245374

SHA1
05713b712555168ff0d41811d01a667d381093ff

SHA256
32b2ecff969c4befc8b98956d9cd8398d8eb830d687708a57330e40e168611b4

SHA512
679f2fc7ee9026d3cf4340709eb3c1292be0bef8fa97d570c8d821d3024944574abb99e15f021572b2db7b87c5027d09513d5bec4acb7ebca3531ddd7be0ce59

Download Submit
C:\Windows\system\TzreIhI.exe

Filesize
1.4MB

MD5
a49401bf784f016e4712fc551ec1cd5d

SHA1
115a6f51b7120f77a2fcc33ce4717c7ee589423e

SHA256
7e31fb9108a7e2bea007ccf23ee18f5787ff87fc4dfcbd1a7f733bec9b7dd145

SHA512
11835ac42433d4fbd19503ecd94282dae8e0e1183bef44f8a951b89fe98286817a11e07f597847fcc8bd4b6321568892eb9966a6b0872398c3f672e5491d4dc5

Download Submit
C:\Windows\system\UdVLbBS.exe

Filesize
1.4MB

MD5
323f9bdc285664cd0e198b8d233caac1

SHA1
32624afe3b1a55aa04cdb334c265c7371380628e

SHA256
94c33845dd1c19db731fe54ee78d5b532e08a72e741469aa1216a4cb4e0cbd34

SHA512
32d6320d58ce9ed4ef15f42bbcd3350e666001b00650bd64812a425ac57be0d4a89e804ed28e63f54e906192d8e6dd3d6512d5674e57b5d2aa7dce4ffb385d95

Download Submit
C:\Windows\system\WdgUlrh.exe

Filesize
1.4MB

MD5
11a33911562648288205e1c0ceb0e6cb

SHA1
c33f992143403b873b65667e492ca79014dbf96a

SHA256
7bf6b63f62fca6d01a5cb6580ddd875a71b0216ef13815ffcaec3a2ef24a6f14

SHA512
acbe28b6f1b79044df8cf2de20b3b46668bfb083fef0c52a8d26491198bc9c924265a773a7aeab059b8ee481dcec202b5df499e6283e90f62267e7b9b1594b32

Download Submit
C:\Windows\system\XcNynBC.exe

Filesize
1.4MB

MD5
1c1e621de5bf393258350eebe1318adc

SHA1
0677a14964b005352bdde9cb30d72b7e4051528d

SHA256
939f4e084ab772242c9a023ac40092f3741958121c3b568a0cc7901cfd0062e5

SHA512
6cb4192b56183e06f79591b88a4c8a306753d335e1c7472afc7be636416bc7f00997fe54392b84b1cdb606c59a0d0876c837257e86fd70f33b7c249a1357f105

Download Submit
C:\Windows\system\ZQPgghx.exe

Filesize
1.4MB

MD5
fbf9eb115045d16b669bb55906772b1e

SHA1
aac03afa01517967dd17eb3f379809c29fed4a28

SHA256
1104e5ccc69df10162b6591b7398be0c3069734578076eced948c57af949ecd4

SHA512
84b4d945220594e47792c1b9e8507af7ed4e5af5a40e9a432c95764c76a1738d7cdd0acfeab10b70bee84eee67898c112242dc4b1a308eec91bb0c75e3d3102e

Download Submit
C:\Windows\system\ZcMVkVg.exe

Filesize
1.4MB

MD5
d21183a79a60811cccb7d5f6c7cdd5ab

SHA1
abab6bdbdb10ccf188ed18b7335de57c575b0060

SHA256
0db69a3b7bea84a5c4b3427f473dedab4e7676645282dfdb5e0cd10c78173348

SHA512
c7867d285780658791a82a67236ba290ea4d6ec24ceeb0f9c36c018389b6ca6ed0c5123adda242fef31eeb0c8d35b4d8f75be8a6327ed0c258a3c702f208151a

Download Submit
C:\Windows\system\afIXadz.exe

Filesize
1.4MB

MD5
c21789dd28688ac9b4ee0d91903832aa

SHA1
14445fc32986c9480760f50b778715ab8047877d

SHA256
62e665721b026134ce55a18ce78c1b412c74c03042a69238cc42063b31b20d64

SHA512
c7a4a5b04ece4f3e74064df7a49f0ea7af2f4e35cfbb7a4f18dd74075916c8046095a41bc2a76dd73fddeecfb9ed2973781e63a0924fc95ba283832b477bf6f5

Download Submit
C:\Windows\system\bOPwDJc.exe

Filesize
1.4MB

MD5
13295224778dc4aed2602da0f26359e1

SHA1
eeeb578fb4b2438c58550219438a954c3449beee

SHA256
c7a62c32aa42d8aea85ab12b8e61c9cf8ae83daca45ac545d0736263f4368e76

SHA512
f0286a318d83603c3a2c6dd75128e1591dbd13ccaeb31e4c02b1c5e83c3dca07532d28a0b7ef72726f34109f57596b082e07004cb6471a470cefdca37c4ba6c4

Download Submit
C:\Windows\system\buNpqGx.exe

Filesize
1.4MB

MD5
6ca945c5ca7dda282cfa2fe8e8cc8c63

SHA1
27b30e621d23b2cd522d248746cc3a292a04af8f

SHA256
48b092b8f9a7141ef4c495b6fe039dfd341715597c6ab36d0f054b78f4282fbc

SHA512
b9c85e2b0260002f1ac58c4b4bb9eee10b7281f74f7681be890477d535d7a81dddc655107fad246766a74dbfce8186f0d43f1d0da327f71ee43c5b3d033ca942

Download Submit
C:\Windows\system\cVVcVPn.exe

Filesize
1.4MB

MD5
5e1368133a4b7bd90a38d10309548fb3

SHA1
71205ba4c4de51980b5450f898804c75b7e7fca3

SHA256
93d140635a838d1664f2c56845451b7f432f5c11890cfd98493285db85984c98

SHA512
9b5b933a4d2518e7c6ad96950aad776d4b31be9751f0128e54a673550824ab91e3b3e1ace5da0e1ad61a8d74aff12eeb67ab192b8b9d3ce1c6889caccf48313a

Download Submit
C:\Windows\system\gKiJnpW.exe

Filesize
1.4MB

MD5
a60b36179db5a3ffe4eb56937f961c17

SHA1
254dd561859c9584dac4d570a46767f710f83b3c

SHA256
9ff976edf73bed68d968508a1e486f440f185f9ac809166190b6a659de883cf0

SHA512
aade420994e2a25f466d3ce21e727ada691edd85c00add230154ba15fa5eb01c1229d589044df1add70dbe51ef7168dcbdd532d1d0282bfeec7b68aee573466d

Download Submit
C:\Windows\system\mbsOeHE.exe

Filesize
1.4MB

MD5
81ff1a24ec50544d68206527bde026a1

SHA1
bb4ec2ddf60dc12c607a25cb3471fa7658229737

SHA256
dadcca0ddeab7d62d24b27f9f8d69812850ac24db3cb1994330f5d063a3dbdb6

SHA512
e6a5a9ded4958c0294145b3fb4a6f8bd936832ada5bab4e8dd7a7e68ea2b4875f9ffa3d00f8f90176cb2afc96da11ffa3c42974f17a17a2405fde55d699b8157

Download Submit
C:\Windows\system\othWFek.exe

Filesize
1.4MB

MD5
f8b40024d332b2c3857425b4564ff1be

SHA1
cba2e11926cddfc48bcb93d826c9c03172460034

SHA256
6e1c4da95987cb482993f807596b0106b0ef852161dc2165e7bc9ceb513c527c

SHA512
f2ed47a1e32678e5390903f0d712c8a2916381214dfc8c1fdd53a1f4833b0fa709ff9cbaf96be84b4c1e88c3ee72f737fac7a02beb8157cbccd4d8ef19089a40

Download Submit
C:\Windows\system\pDVHagS.exe

Filesize
1.4MB

MD5
cd97ceb49edeb833674f150e3324ae84

SHA1
1227a9c808f0b51a0c0a4143627c1445a2a4005e

SHA256
b9d3faa6e652e5dc9e511f31d56c341064aaba03a53b212aafcfb6bc6c32d2b7

SHA512
1c64f2fcac833a4d86def15c91b8013edfd17e3486cc92d0fd367ee086fddcfe8ba8ef946b5d4168000c3f724ee511c5888a4fe9fc401581f0c89cb9c572b3d2

Download Submit
C:\Windows\system\pfCtpJp.exe

Filesize
1.4MB

MD5
b44eda632949be4cec13db3554c0ecc9

SHA1
05c3bee5d4eed4c4fa751a50fc42987a8e955de1

SHA256
cf4d23e50d67474cc9b1d3efdfe75d71e6b54d601af2b6e7e734c4ecb18988b8

SHA512
889f987eaad73c026dd0cef6cd24bcf4a9ff996c75c5f50c53239415e773ad072765cc8102d911035a41ad8c50bd0e537918d89bb90747046195a35de5af20a9

Download Submit
C:\Windows\system\qdHKQSE.exe

Filesize
1.4MB

MD5
0a55b6c3b73657f461219fddbb5881ab

SHA1
1578f69818c91bb3d53e0387fbab126b3564eee1

SHA256
01d67db5abc80b488e2bd846a964b7a60cea83f54191b035a932914d3910cff7

SHA512
8fd86e268dcb9fb7010bf0648166be6ac7c8c7b242c5cbc8963c8a91eb4babae763c20c042ee833548dc3cd2416ae5d728227ad2cb0c7f1b029696c4107e5f6d

Download Submit
C:\Windows\system\roSyLGk.exe

Filesize
1.4MB

MD5
610641691d463a559d3f937d7fe8b139

SHA1
a08ec68d9c6364ee5b00f57343140a8980114798

SHA256
0e966a7e7ab2faf97c22339d8e69645a98b745a60fa7dd80acbe441d8de21036

SHA512
e6b2664ad4867956d269dc0c48f9a45f165cdce1351ffa1addae57a48b30896e0b9ae7547c2c08bf75f8966af455b59ae62b2ca9a353236f326f71e8aa9ab819

Download Submit
C:\Windows\system\tgWNjBQ.exe

Filesize
1.4MB

MD5
229612f1b2ccb631f3b4a31dc530fb2a

SHA1
a6b9d361cb7a8170aed79685a4c82de9434ab6eb

SHA256
58e6bd94db514d69e1c4795625cb2c1beff441102f317d131cf1bd704f143b0a

SHA512
2db4e9c3a3222f90529b93a474883b8781f2b33f0f769e701bf2eed1f81837bbe36efdd7937b61c1fdbe8da41c321b7462cd2b196c06a56b1a7698768373dc7c

Download Submit
C:\Windows\system\uYoVzst.exe

Filesize
1.4MB

MD5
6fa9d16c2877ad4b9101602d366997f1

SHA1
4c6d07c91fba4ff3c656b9fbc094c57c1851a6a6

SHA256
b016f2f5f92826659b36863185bd7f2c868a6d09fbe8df4988c31277a789ffe3

SHA512
c2b8cf282e39909a853d05c1ef48c78056248ee50f8a74327cb5623dc77fdcc64a9953baf696134bcbd3f8e33620da10697b153419cfa4c4135d32f60dba3fe3

Download Submit
C:\Windows\system\unNwKmt.exe

Filesize
1.4MB

MD5
fa682f4cdf5a35e8c1c6fc3f3e9eda7b

SHA1
83d8d4e5959b06fe68059dfa7c142d9cdf325d19

SHA256
626f476ca99d3c261ca993a41c9c223f1b78a7733ba4f26586663ae5a072d46e

SHA512
e6538e1bf30f5ef6a8adeb36b52b4649ce175353bf9cf46135922b5854e076d92ed09dbab1b8f0b31ef2b27c7117b9d6384e7adfecc182bd665d3328441a149b

Download Submit
C:\Windows\system\velOLtv.exe

Filesize
1.4MB

MD5
09d3a157c90f49b59b4f6e9e83be9cab

SHA1
97281473ea7873bc11130c797143a56a759eea25

SHA256
eaabad2c1c5fd96332ab9b1aa422cda20ed19175f709daa36bada1862ad93c1d

SHA512
c41d4306b4444f4b885e867289ee8f4bd13414a4e014a3153018d89b504402e4f0496a6e21ec92c8c54417c3531516debfd1bea175ac40acd6471b2c1db78ace

Download Submit
C:\Windows\system\yNMMeim.exe

Filesize
1.4MB

MD5
d29274fa6d143606d87880eb3dee7cae

SHA1
03ee0662eb1211c6a69c22db890f6afd9d52bed6

SHA256
08e41e98255d12c0f095d83664a073bcdcf3dbaa72c83aec10cb38c06fdf5d80

SHA512
e53215bdd517cabc2c8a6863061a9224419b3cf5d5a7c98fcad7aa98196eebbe7ae75c3ad4de6db939f69cb062ece07956aa523b3ba24a490c0fbd0cae6faeba

Download Submit
C:\Windows\system\yyfqgJp.exe

Filesize
1.4MB

MD5
736ac90f2aec25b9cb47197978889f41

SHA1
b1c88fb55bb802a1ffc82b3ce9910e6d95842c64

SHA256
c28fbbb137d24704651ce79fecae6fed20cab2281a420f8f1b9a857f3e3c3727

SHA512
bce1d55cd27f037dfbdcd61ad88ed5e1647dacd939fb1395cd0effdcfdcc91af660a84d2c05007a3892f9a316c297947c1957fdb2bbccd6c8393fe15cc581c9e

Download Submit
C:\Windows\system\zPMeuyc.exe

Filesize
1.4MB

MD5
d2cb7a5cdcca2ba3fc0b2d0b4df60a47

SHA1
9292eef16f1b2e1018a63e10e4b9d11205839669

SHA256
7c5e6d85a57f639627fdd99748226d8709aaeeced8d4a4040daf001037455db8

SHA512
07ef36183f357f1bb95ee4db168eeb61ee5b0d36dc464d79f8cf030f35f8b895ba268f9ca76910f07d6b278d43b80a8bbecf1bc61c2abf65404d640c0aa5111f

Download Submit
memory/2672-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download