xmrig | 2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
Size

1.8MB
MD5

6c226c1527195a3695652b42c0d213d0
SHA1

20e26a9a189bae06e6af22b44589d43d84c56802
SHA256

2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768
SHA512

f1aea74a155836e4ded8387d59ae64cd14932be13a3f60cc89115d094a530e57d645c8155336ba0a8070ef57c90abd7dfaccad299e3c0787f0053806ea41651f
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLvitT:GemTLkNdfE0pZyP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012280-4.dat	xmrig
behavioral1/files/0x00080000000186e7-6.dat	xmrig
behavioral1/files/0x00070000000186f1-10.dat	xmrig
behavioral1/files/0x00060000000186f4-15.dat	xmrig
behavioral1/files/0x0006000000018704-22.dat	xmrig
behavioral1/files/0x0006000000018739-25.dat	xmrig
behavioral1/files/0x00050000000193df-37.dat	xmrig
behavioral1/files/0x0005000000019502-69.dat	xmrig
behavioral1/files/0x0005000000019623-105.dat	xmrig
behavioral1/files/0x0005000000019629-122.dat	xmrig
behavioral1/files/0x000500000001962d-130.dat	xmrig
behavioral1/files/0x000500000001962b-125.dat	xmrig
behavioral1/files/0x0005000000019627-117.dat	xmrig
behavioral1/files/0x0005000000019625-114.dat	xmrig
behavioral1/files/0x0005000000019624-110.dat	xmrig
behavioral1/files/0x0005000000019621-102.dat	xmrig
behavioral1/files/0x00050000000195f0-97.dat	xmrig
behavioral1/files/0x00050000000195ab-93.dat	xmrig
behavioral1/files/0x000500000001958e-89.dat	xmrig
behavioral1/files/0x000500000001957e-85.dat	xmrig
behavioral1/files/0x0005000000019512-81.dat	xmrig
behavioral1/files/0x000500000001950e-77.dat	xmrig
behavioral1/files/0x0005000000019509-73.dat	xmrig
behavioral1/files/0x00050000000194f1-65.dat	xmrig
behavioral1/files/0x00050000000194ee-61.dat	xmrig
behavioral1/files/0x00050000000194c9-57.dat	xmrig
behavioral1/files/0x00050000000194b9-53.dat	xmrig
behavioral1/files/0x00050000000194a9-49.dat	xmrig
behavioral1/files/0x0005000000019458-45.dat	xmrig
behavioral1/files/0x0005000000019451-41.dat	xmrig
behavioral1/files/0x00070000000193c4-33.dat	xmrig
behavioral1/files/0x0006000000018744-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
580	caEYYhf.exe
1272	nhwwaQM.exe
2596	PIQyNvr.exe
1028	mQcdkvw.exe
2524	NqZhQHr.exe
2152	VMpeJBF.exe
2804	bLLVkkL.exe
2888	jrtjSxt.exe
2916	hejmBkX.exe
788	wmbnObQ.exe
2548	SJgqWCi.exe
2952	leqPHvW.exe
2988	jhETXrS.exe
2380	QaWuYQq.exe
2924	AvCKfSi.exe
2696	GjoyWEw.exe
2736	oNtzdJl.exe
1932	AmDBgAc.exe
2340	hvpXnQH.exe
1804	ycPBeye.exe
920	MYgHUaT.exe
3064	TiIvEBh.exe
3040	WOpnlxl.exe
2144	AUuUeUh.exe
548	ziyDrPt.exe
1448	utlYgvH.exe
3012	dtjwjpA.exe
2276	zlZPubm.exe
2284	tEzgraE.exe
1072	xoNafkL.exe
2460	fIfhrRV.exe
1020	RdfzCmm.exe
640	qMatsKU.exe
1552	KrKPUco.exe
1000	qSWlhAI.exe
1940	ocSOkBj.exe
960	XHaQhvd.exe
1616	ToXAWZV.exe
1032	kFTmtKQ.exe
1480	XNxiurR.exe
2956	YvWCnHP.exe
1508	uprhUgj.exe
968	mYutOYn.exe
2876	DOvdXyg.exe
956	ZIEPVaO.exe
1556	MLBJwql.exe
1676	svhtgXp.exe
1360	QbsOmlt.exe
2040	XTStkXQ.exe
2576	OAKtGwq.exe
768	HabXPOz.exe
2780	HeigFJk.exe
1308	pfAUEda.exe
1624	oatDgZM.exe
2124	AnBBFRq.exe
2064	yyoXmIn.exe
1956	OoIJaPm.exe
2560	hZHbYaC.exe
2212	vZeXRMJ.exe
1868	htwkjvy.exe
2032	yLOwFSS.exe
2608	CEQmpqh.exe
772	YXupaOb.exe
2412	lXJpiBR.exe

Loads dropped DLL 64 IoCs

pid	Process
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CtivAgx.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\qEtXkRW.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\diOrBEn.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\SJVjYEx.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\HMRbxoo.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ktwzHYR.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\EuqzNSL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\PmTKTYk.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\nJPacWO.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\LLspNKD.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\TeaGGyK.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\BKzDlZp.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\DIjeTwp.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\GvBCqMV.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\EsXJrGh.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\lanIMXS.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\nxSIFzc.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\BFotfSW.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\yrBGvKL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\bCmUAKN.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\JKaqMlO.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\xoNafkL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\YiPrwSo.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\WbcOudO.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\wFaAqvC.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\FPyMlAB.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ZiIUYAQ.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\BByZGWU.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\QLnIRYV.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\upyyXla.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\qaPFshs.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\JBHYSAT.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\acwTNZe.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\GPlfplf.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\cCfdFNr.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\TCLJzCb.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\aCKNscf.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\qhfrdOG.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\AvCKfSi.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\hHIXZCg.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\KLKJGuK.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\fRBMtaD.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\CHJKkGS.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\eRnkQRE.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\apknUAY.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\sknUOed.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\TJPndhs.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\vlFUpWT.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\PogDcRi.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\CDhhpOm.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\gwAGiLx.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\mUhwhOd.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\TkDhvUZ.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\nsAFGbr.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\jCiAiQs.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\prVBpqI.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\yVcBTjS.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\bbrAQEd.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\pzZzJhk.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\hepSmjT.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\bZEtkop.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\EmZGSTg.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\deJmXZy.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\syyPFOY.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 580	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	32
PID 1268 wrote to memory of 580	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	32
PID 1268 wrote to memory of 580	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	32
PID 1268 wrote to memory of 1272	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	33
PID 1268 wrote to memory of 1272	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	33
PID 1268 wrote to memory of 1272	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	33
PID 1268 wrote to memory of 2596	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	34
PID 1268 wrote to memory of 2596	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	34
PID 1268 wrote to memory of 2596	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	34
PID 1268 wrote to memory of 1028	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	35
PID 1268 wrote to memory of 1028	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	35
PID 1268 wrote to memory of 1028	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	35
PID 1268 wrote to memory of 2524	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	36
PID 1268 wrote to memory of 2524	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	36
PID 1268 wrote to memory of 2524	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	36
PID 1268 wrote to memory of 2152	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	37
PID 1268 wrote to memory of 2152	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	37
PID 1268 wrote to memory of 2152	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	37
PID 1268 wrote to memory of 2804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	38
PID 1268 wrote to memory of 2804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	38
PID 1268 wrote to memory of 2804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	38
PID 1268 wrote to memory of 2888	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	39
PID 1268 wrote to memory of 2888	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	39
PID 1268 wrote to memory of 2888	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	39
PID 1268 wrote to memory of 2916	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	40
PID 1268 wrote to memory of 2916	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	40
PID 1268 wrote to memory of 2916	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	40
PID 1268 wrote to memory of 788	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	41
PID 1268 wrote to memory of 788	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	41
PID 1268 wrote to memory of 788	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	41
PID 1268 wrote to memory of 2548	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	42
PID 1268 wrote to memory of 2548	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	42
PID 1268 wrote to memory of 2548	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	42
PID 1268 wrote to memory of 2952	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	43
PID 1268 wrote to memory of 2952	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	43
PID 1268 wrote to memory of 2952	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	43
PID 1268 wrote to memory of 2988	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	44
PID 1268 wrote to memory of 2988	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	44
PID 1268 wrote to memory of 2988	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	44
PID 1268 wrote to memory of 2380	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	45
PID 1268 wrote to memory of 2380	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	45
PID 1268 wrote to memory of 2380	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	45
PID 1268 wrote to memory of 2924	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	46
PID 1268 wrote to memory of 2924	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	46
PID 1268 wrote to memory of 2924	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	46
PID 1268 wrote to memory of 2696	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	47
PID 1268 wrote to memory of 2696	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	47
PID 1268 wrote to memory of 2696	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	47
PID 1268 wrote to memory of 2736	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	48
PID 1268 wrote to memory of 2736	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	48
PID 1268 wrote to memory of 2736	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	48
PID 1268 wrote to memory of 1932	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	49
PID 1268 wrote to memory of 1932	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	49
PID 1268 wrote to memory of 1932	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	49
PID 1268 wrote to memory of 2340	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	50
PID 1268 wrote to memory of 2340	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	50
PID 1268 wrote to memory of 2340	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	50
PID 1268 wrote to memory of 1804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	51
PID 1268 wrote to memory of 1804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	51
PID 1268 wrote to memory of 1804	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	51
PID 1268 wrote to memory of 920	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	52
PID 1268 wrote to memory of 920	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	52
PID 1268 wrote to memory of 920	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	52
PID 1268 wrote to memory of 3064	1268	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	53

C:\Users\Admin\AppData\Local\Temp\2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
"C:\Users\Admin\AppData\Local\Temp\2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\System\caEYYhf.exe
  C:\Windows\System\caEYYhf.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\nhwwaQM.exe
  C:\Windows\System\nhwwaQM.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\PIQyNvr.exe
  C:\Windows\System\PIQyNvr.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\mQcdkvw.exe
  C:\Windows\System\mQcdkvw.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\NqZhQHr.exe
  C:\Windows\System\NqZhQHr.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\VMpeJBF.exe
  C:\Windows\System\VMpeJBF.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\bLLVkkL.exe
  C:\Windows\System\bLLVkkL.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jrtjSxt.exe
  C:\Windows\System\jrtjSxt.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\hejmBkX.exe
  C:\Windows\System\hejmBkX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wmbnObQ.exe
  C:\Windows\System\wmbnObQ.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\SJgqWCi.exe
  C:\Windows\System\SJgqWCi.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\leqPHvW.exe
  C:\Windows\System\leqPHvW.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jhETXrS.exe
  C:\Windows\System\jhETXrS.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\QaWuYQq.exe
  C:\Windows\System\QaWuYQq.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\AvCKfSi.exe
  C:\Windows\System\AvCKfSi.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\GjoyWEw.exe
  C:\Windows\System\GjoyWEw.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\oNtzdJl.exe
  C:\Windows\System\oNtzdJl.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\AmDBgAc.exe
  C:\Windows\System\AmDBgAc.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\hvpXnQH.exe
  C:\Windows\System\hvpXnQH.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ycPBeye.exe
  C:\Windows\System\ycPBeye.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\MYgHUaT.exe
  C:\Windows\System\MYgHUaT.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\TiIvEBh.exe
  C:\Windows\System\TiIvEBh.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\WOpnlxl.exe
  C:\Windows\System\WOpnlxl.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\AUuUeUh.exe
  C:\Windows\System\AUuUeUh.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ziyDrPt.exe
  C:\Windows\System\ziyDrPt.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\utlYgvH.exe
  C:\Windows\System\utlYgvH.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dtjwjpA.exe
  C:\Windows\System\dtjwjpA.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\zlZPubm.exe
  C:\Windows\System\zlZPubm.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\tEzgraE.exe
  C:\Windows\System\tEzgraE.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\xoNafkL.exe
  C:\Windows\System\xoNafkL.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\fIfhrRV.exe
  C:\Windows\System\fIfhrRV.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RdfzCmm.exe
  C:\Windows\System\RdfzCmm.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\qMatsKU.exe
  C:\Windows\System\qMatsKU.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\KrKPUco.exe
  C:\Windows\System\KrKPUco.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\qSWlhAI.exe
  C:\Windows\System\qSWlhAI.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ocSOkBj.exe
  C:\Windows\System\ocSOkBj.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\XHaQhvd.exe
  C:\Windows\System\XHaQhvd.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ToXAWZV.exe
  C:\Windows\System\ToXAWZV.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\kFTmtKQ.exe
  C:\Windows\System\kFTmtKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\XNxiurR.exe
  C:\Windows\System\XNxiurR.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\YvWCnHP.exe
  C:\Windows\System\YvWCnHP.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\uprhUgj.exe
  C:\Windows\System\uprhUgj.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\mYutOYn.exe
  C:\Windows\System\mYutOYn.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\DOvdXyg.exe
  C:\Windows\System\DOvdXyg.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ZIEPVaO.exe
  C:\Windows\System\ZIEPVaO.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\MLBJwql.exe
  C:\Windows\System\MLBJwql.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\svhtgXp.exe
  C:\Windows\System\svhtgXp.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\QbsOmlt.exe
  C:\Windows\System\QbsOmlt.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\XTStkXQ.exe
  C:\Windows\System\XTStkXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\OAKtGwq.exe
  C:\Windows\System\OAKtGwq.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\HabXPOz.exe
  C:\Windows\System\HabXPOz.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\HeigFJk.exe
  C:\Windows\System\HeigFJk.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\pfAUEda.exe
  C:\Windows\System\pfAUEda.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\oatDgZM.exe
  C:\Windows\System\oatDgZM.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\AnBBFRq.exe
  C:\Windows\System\AnBBFRq.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\yyoXmIn.exe
  C:\Windows\System\yyoXmIn.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\OoIJaPm.exe
  C:\Windows\System\OoIJaPm.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\hZHbYaC.exe
  C:\Windows\System\hZHbYaC.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\vZeXRMJ.exe
  C:\Windows\System\vZeXRMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\htwkjvy.exe
  C:\Windows\System\htwkjvy.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\yLOwFSS.exe
  C:\Windows\System\yLOwFSS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\CEQmpqh.exe
  C:\Windows\System\CEQmpqh.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\YXupaOb.exe
  C:\Windows\System\YXupaOb.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\lXJpiBR.exe
  C:\Windows\System\lXJpiBR.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\gMIOaBb.exe
  C:\Windows\System\gMIOaBb.exe
  2⤵
  PID:1580
- C:\Windows\System\MqVoXpl.exe
  C:\Windows\System\MqVoXpl.exe
  2⤵
  PID:1724
- C:\Windows\System\YpWpFaD.exe
  C:\Windows\System\YpWpFaD.exe
  2⤵
  PID:2348
- C:\Windows\System\KyxIhwo.exe
  C:\Windows\System\KyxIhwo.exe
  2⤵
  PID:2512
- C:\Windows\System\DRpYMmH.exe
  C:\Windows\System\DRpYMmH.exe
  2⤵
  PID:2396
- C:\Windows\System\eNcaiec.exe
  C:\Windows\System\eNcaiec.exe
  2⤵
  PID:2664
- C:\Windows\System\nPerSsn.exe
  C:\Windows\System\nPerSsn.exe
  2⤵
  PID:2440
- C:\Windows\System\raoAYqN.exe
  C:\Windows\System\raoAYqN.exe
  2⤵
  PID:2844
- C:\Windows\System\ZvPnlVa.exe
  C:\Windows\System\ZvPnlVa.exe
  2⤵
  PID:2848
- C:\Windows\System\DzDZwMU.exe
  C:\Windows\System\DzDZwMU.exe
  2⤵
  PID:2324
- C:\Windows\System\nrZoAbo.exe
  C:\Windows\System\nrZoAbo.exe
  2⤵
  PID:2716
- C:\Windows\System\YiPrwSo.exe
  C:\Windows\System\YiPrwSo.exe
  2⤵
  PID:2708
- C:\Windows\System\KBCwoPH.exe
  C:\Windows\System\KBCwoPH.exe
  2⤵
  PID:2352
- C:\Windows\System\xrYRyvP.exe
  C:\Windows\System\xrYRyvP.exe
  2⤵
  PID:1344
- C:\Windows\System\tWvmNIs.exe
  C:\Windows\System\tWvmNIs.exe
  2⤵
  PID:1388
- C:\Windows\System\hWLhtps.exe
  C:\Windows\System\hWLhtps.exe
  2⤵
  PID:2004
- C:\Windows\System\UJVfPAg.exe
  C:\Windows\System\UJVfPAg.exe
  2⤵
  PID:2992
- C:\Windows\System\wSOHuVn.exe
  C:\Windows\System\wSOHuVn.exe
  2⤵
  PID:2484
- C:\Windows\System\GktKKFm.exe
  C:\Windows\System\GktKKFm.exe
  2⤵
  PID:1244
- C:\Windows\System\MLvjXED.exe
  C:\Windows\System\MLvjXED.exe
  2⤵
  PID:2148
- C:\Windows\System\VhXDVfD.exe
  C:\Windows\System\VhXDVfD.exe
  2⤵
  PID:680
- C:\Windows\System\RmvNYEb.exe
  C:\Windows\System\RmvNYEb.exe
  2⤵
  PID:1692
- C:\Windows\System\SeNYzli.exe
  C:\Windows\System\SeNYzli.exe
  2⤵
  PID:1384
- C:\Windows\System\Plcwvtn.exe
  C:\Windows\System\Plcwvtn.exe
  2⤵
  PID:1036
- C:\Windows\System\tDYDnnI.exe
  C:\Windows\System\tDYDnnI.exe
  2⤵
  PID:1820
- C:\Windows\System\xGZtJhm.exe
  C:\Windows\System\xGZtJhm.exe
  2⤵
  PID:2732
- C:\Windows\System\zIdxoWp.exe
  C:\Windows\System\zIdxoWp.exe
  2⤵
  PID:2676
- C:\Windows\System\EsXJrGh.exe
  C:\Windows\System\EsXJrGh.exe
  2⤵
  PID:1368
- C:\Windows\System\zyssdtj.exe
  C:\Windows\System\zyssdtj.exe
  2⤵
  PID:836
- C:\Windows\System\uQZsZQU.exe
  C:\Windows\System\uQZsZQU.exe
  2⤵
  PID:840
- C:\Windows\System\FZJCIGb.exe
  C:\Windows\System\FZJCIGb.exe
  2⤵
  PID:2528
- C:\Windows\System\uylQNJv.exe
  C:\Windows\System\uylQNJv.exe
  2⤵
  PID:2620
- C:\Windows\System\BByZGWU.exe
  C:\Windows\System\BByZGWU.exe
  2⤵
  PID:1008
- C:\Windows\System\QwLhWxD.exe
  C:\Windows\System\QwLhWxD.exe
  2⤵
  PID:1656
- C:\Windows\System\fupqiDi.exe
  C:\Windows\System\fupqiDi.exe
  2⤵
  PID:1504
- C:\Windows\System\XNbCoSX.exe
  C:\Windows\System\XNbCoSX.exe
  2⤵
  PID:2492
- C:\Windows\System\YwYfQFt.exe
  C:\Windows\System\YwYfQFt.exe
  2⤵
  PID:588
- C:\Windows\System\cEpZspw.exe
  C:\Windows\System\cEpZspw.exe
  2⤵
  PID:1600
- C:\Windows\System\sWArlHM.exe
  C:\Windows\System\sWArlHM.exe
  2⤵
  PID:2520
- C:\Windows\System\oXIKaxv.exe
  C:\Windows\System\oXIKaxv.exe
  2⤵
  PID:2248
- C:\Windows\System\WaMHJZF.exe
  C:\Windows\System\WaMHJZF.exe
  2⤵
  PID:2828
- C:\Windows\System\jEGfyQT.exe
  C:\Windows\System\jEGfyQT.exe
  2⤵
  PID:2860
- C:\Windows\System\ZAKYXPY.exe
  C:\Windows\System\ZAKYXPY.exe
  2⤵
  PID:2816
- C:\Windows\System\QSFkeOK.exe
  C:\Windows\System\QSFkeOK.exe
  2⤵
  PID:1856
- C:\Windows\System\QMzTLSV.exe
  C:\Windows\System\QMzTLSV.exe
  2⤵
  PID:3084
- C:\Windows\System\apknUAY.exe
  C:\Windows\System\apknUAY.exe
  2⤵
  PID:3100
- C:\Windows\System\EEGiRVk.exe
  C:\Windows\System\EEGiRVk.exe
  2⤵
  PID:3116
- C:\Windows\System\yjCJkVd.exe
  C:\Windows\System\yjCJkVd.exe
  2⤵
  PID:3132
- C:\Windows\System\rePvJGr.exe
  C:\Windows\System\rePvJGr.exe
  2⤵
  PID:3148
- C:\Windows\System\THzlRdH.exe
  C:\Windows\System\THzlRdH.exe
  2⤵
  PID:3164
- C:\Windows\System\NPXdkIA.exe
  C:\Windows\System\NPXdkIA.exe
  2⤵
  PID:3180
- C:\Windows\System\UPxgqfW.exe
  C:\Windows\System\UPxgqfW.exe
  2⤵
  PID:3196
- C:\Windows\System\QWlUvVa.exe
  C:\Windows\System\QWlUvVa.exe
  2⤵
  PID:3212
- C:\Windows\System\cBkzVYm.exe
  C:\Windows\System\cBkzVYm.exe
  2⤵
  PID:3228
- C:\Windows\System\esjxRTp.exe
  C:\Windows\System\esjxRTp.exe
  2⤵
  PID:3244
- C:\Windows\System\GvOOLVT.exe
  C:\Windows\System\GvOOLVT.exe
  2⤵
  PID:3260
- C:\Windows\System\BmfdEBg.exe
  C:\Windows\System\BmfdEBg.exe
  2⤵
  PID:3276
- C:\Windows\System\mUhwhOd.exe
  C:\Windows\System\mUhwhOd.exe
  2⤵
  PID:3292
- C:\Windows\System\aRDRwUy.exe
  C:\Windows\System\aRDRwUy.exe
  2⤵
  PID:3308
- C:\Windows\System\vRINKwn.exe
  C:\Windows\System\vRINKwn.exe
  2⤵
  PID:3324
- C:\Windows\System\nJPacWO.exe
  C:\Windows\System\nJPacWO.exe
  2⤵
  PID:3340
- C:\Windows\System\dhRTBLR.exe
  C:\Windows\System\dhRTBLR.exe
  2⤵
  PID:3356
- C:\Windows\System\hPLcHrx.exe
  C:\Windows\System\hPLcHrx.exe
  2⤵
  PID:3372
- C:\Windows\System\hpROcfl.exe
  C:\Windows\System\hpROcfl.exe
  2⤵
  PID:3388
- C:\Windows\System\yvgDMhD.exe
  C:\Windows\System\yvgDMhD.exe
  2⤵
  PID:3404
- C:\Windows\System\SjjwtkN.exe
  C:\Windows\System\SjjwtkN.exe
  2⤵
  PID:3420
- C:\Windows\System\MNiMTPe.exe
  C:\Windows\System\MNiMTPe.exe
  2⤵
  PID:3436
- C:\Windows\System\HeVZZJd.exe
  C:\Windows\System\HeVZZJd.exe
  2⤵
  PID:3452
- C:\Windows\System\OTezWCS.exe
  C:\Windows\System\OTezWCS.exe
  2⤵
  PID:3468
- C:\Windows\System\hYWBgiD.exe
  C:\Windows\System\hYWBgiD.exe
  2⤵
  PID:3484
- C:\Windows\System\YqsodMB.exe
  C:\Windows\System\YqsodMB.exe
  2⤵
  PID:3500
- C:\Windows\System\stQWJYg.exe
  C:\Windows\System\stQWJYg.exe
  2⤵
  PID:3516
- C:\Windows\System\zaqsIJW.exe
  C:\Windows\System\zaqsIJW.exe
  2⤵
  PID:3532
- C:\Windows\System\egUzJjv.exe
  C:\Windows\System\egUzJjv.exe
  2⤵
  PID:3548
- C:\Windows\System\NNQrcRF.exe
  C:\Windows\System\NNQrcRF.exe
  2⤵
  PID:3564
- C:\Windows\System\eXnJREw.exe
  C:\Windows\System\eXnJREw.exe
  2⤵
  PID:3580
- C:\Windows\System\cYZebQz.exe
  C:\Windows\System\cYZebQz.exe
  2⤵
  PID:3596
- C:\Windows\System\bRprczh.exe
  C:\Windows\System\bRprczh.exe
  2⤵
  PID:3612
- C:\Windows\System\NWDYWtP.exe
  C:\Windows\System\NWDYWtP.exe
  2⤵
  PID:3628
- C:\Windows\System\VckwKUr.exe
  C:\Windows\System\VckwKUr.exe
  2⤵
  PID:3644
- C:\Windows\System\faJJQPP.exe
  C:\Windows\System\faJJQPP.exe
  2⤵
  PID:3660
- C:\Windows\System\lRDmGma.exe
  C:\Windows\System\lRDmGma.exe
  2⤵
  PID:3676
- C:\Windows\System\gqiWsDF.exe
  C:\Windows\System\gqiWsDF.exe
  2⤵
  PID:3692
- C:\Windows\System\lraXkaV.exe
  C:\Windows\System\lraXkaV.exe
  2⤵
  PID:3708
- C:\Windows\System\lVisjCT.exe
  C:\Windows\System\lVisjCT.exe
  2⤵
  PID:3724
- C:\Windows\System\lvSqBPu.exe
  C:\Windows\System\lvSqBPu.exe
  2⤵
  PID:3740
- C:\Windows\System\FgFntUY.exe
  C:\Windows\System\FgFntUY.exe
  2⤵
  PID:3756
- C:\Windows\System\HzXIBzY.exe
  C:\Windows\System\HzXIBzY.exe
  2⤵
  PID:3772
- C:\Windows\System\VRdWCPk.exe
  C:\Windows\System\VRdWCPk.exe
  2⤵
  PID:3788
- C:\Windows\System\QjXeAMb.exe
  C:\Windows\System\QjXeAMb.exe
  2⤵
  PID:3804
- C:\Windows\System\ARIDCNN.exe
  C:\Windows\System\ARIDCNN.exe
  2⤵
  PID:3820
- C:\Windows\System\HpFCUZB.exe
  C:\Windows\System\HpFCUZB.exe
  2⤵
  PID:3836
- C:\Windows\System\sknUOed.exe
  C:\Windows\System\sknUOed.exe
  2⤵
  PID:3852
- C:\Windows\System\CGkZrvi.exe
  C:\Windows\System\CGkZrvi.exe
  2⤵
  PID:3868
- C:\Windows\System\xjSGYnV.exe
  C:\Windows\System\xjSGYnV.exe
  2⤵
  PID:3884
- C:\Windows\System\cCTYqmn.exe
  C:\Windows\System\cCTYqmn.exe
  2⤵
  PID:3900
- C:\Windows\System\vzRDcqt.exe
  C:\Windows\System\vzRDcqt.exe
  2⤵
  PID:3916
- C:\Windows\System\qgZwBsh.exe
  C:\Windows\System\qgZwBsh.exe
  2⤵
  PID:3932
- C:\Windows\System\QWtoZtC.exe
  C:\Windows\System\QWtoZtC.exe
  2⤵
  PID:3948
- C:\Windows\System\MMTZEfJ.exe
  C:\Windows\System\MMTZEfJ.exe
  2⤵
  PID:3964
- C:\Windows\System\dswjxdb.exe
  C:\Windows\System\dswjxdb.exe
  2⤵
  PID:3980
- C:\Windows\System\KaXOOpM.exe
  C:\Windows\System\KaXOOpM.exe
  2⤵
  PID:3996
- C:\Windows\System\TJPndhs.exe
  C:\Windows\System\TJPndhs.exe
  2⤵
  PID:4012
- C:\Windows\System\duIyAYo.exe
  C:\Windows\System\duIyAYo.exe
  2⤵
  PID:4028
- C:\Windows\System\hepSmjT.exe
  C:\Windows\System\hepSmjT.exe
  2⤵
  PID:4044
- C:\Windows\System\cvyxCVh.exe
  C:\Windows\System\cvyxCVh.exe
  2⤵
  PID:4060
- C:\Windows\System\NQfvaZV.exe
  C:\Windows\System\NQfvaZV.exe
  2⤵
  PID:4076
- C:\Windows\System\iojShvQ.exe
  C:\Windows\System\iojShvQ.exe
  2⤵
  PID:4092
- C:\Windows\System\CDKfPZe.exe
  C:\Windows\System\CDKfPZe.exe
  2⤵
  PID:3048
- C:\Windows\System\VfLgUlE.exe
  C:\Windows\System\VfLgUlE.exe
  2⤵
  PID:2272
- C:\Windows\System\DXRdPOP.exe
  C:\Windows\System\DXRdPOP.exe
  2⤵
  PID:1148
- C:\Windows\System\LnNZUis.exe
  C:\Windows\System\LnNZUis.exe
  2⤵
  PID:1712
- C:\Windows\System\BOuOKkk.exe
  C:\Windows\System\BOuOKkk.exe
  2⤵
  PID:1924
- C:\Windows\System\fzQqOUT.exe
  C:\Windows\System\fzQqOUT.exe
  2⤵
  PID:2496
- C:\Windows\System\jUJHaSd.exe
  C:\Windows\System\jUJHaSd.exe
  2⤵
  PID:1640
- C:\Windows\System\bKQOjFM.exe
  C:\Windows\System\bKQOjFM.exe
  2⤵
  PID:484
- C:\Windows\System\OoGxVPp.exe
  C:\Windows\System\OoGxVPp.exe
  2⤵
  PID:1668
- C:\Windows\System\jpCRuTh.exe
  C:\Windows\System\jpCRuTh.exe
  2⤵
  PID:1520
- C:\Windows\System\CSMYdEO.exe
  C:\Windows\System\CSMYdEO.exe
  2⤵
  PID:1512
- C:\Windows\System\qhWkbMt.exe
  C:\Windows\System\qhWkbMt.exe
  2⤵
  PID:2612
- C:\Windows\System\GJSPprq.exe
  C:\Windows\System\GJSPprq.exe
  2⤵
  PID:2964
- C:\Windows\System\fORdnES.exe
  C:\Windows\System\fORdnES.exe
  2⤵
  PID:2764
- C:\Windows\System\eBYTWaZ.exe
  C:\Windows\System\eBYTWaZ.exe
  2⤵
  PID:3092
- C:\Windows\System\jfzNRoO.exe
  C:\Windows\System\jfzNRoO.exe
  2⤵
  PID:3124
- C:\Windows\System\xjWEijS.exe
  C:\Windows\System\xjWEijS.exe
  2⤵
  PID:3156
- C:\Windows\System\aLOaWAN.exe
  C:\Windows\System\aLOaWAN.exe
  2⤵
  PID:3188
- C:\Windows\System\cwYdYcQ.exe
  C:\Windows\System\cwYdYcQ.exe
  2⤵
  PID:3220
- C:\Windows\System\wHTfdfV.exe
  C:\Windows\System\wHTfdfV.exe
  2⤵
  PID:3252
- C:\Windows\System\DgKTyFB.exe
  C:\Windows\System\DgKTyFB.exe
  2⤵
  PID:3284
- C:\Windows\System\HfqdZwZ.exe
  C:\Windows\System\HfqdZwZ.exe
  2⤵
  PID:3316
- C:\Windows\System\xFTsnFQ.exe
  C:\Windows\System\xFTsnFQ.exe
  2⤵
  PID:3364
- C:\Windows\System\LLspNKD.exe
  C:\Windows\System\LLspNKD.exe
  2⤵
  PID:3384
- C:\Windows\System\daQDGIc.exe
  C:\Windows\System\daQDGIc.exe
  2⤵
  PID:3432
- C:\Windows\System\vVfvOxA.exe
  C:\Windows\System\vVfvOxA.exe
  2⤵
  PID:3464
- C:\Windows\System\cxpfnLo.exe
  C:\Windows\System\cxpfnLo.exe
  2⤵
  PID:3524
- C:\Windows\System\WLlVUNK.exe
  C:\Windows\System\WLlVUNK.exe
  2⤵
  PID:3556
- C:\Windows\System\YrtTwdv.exe
  C:\Windows\System\YrtTwdv.exe
  2⤵
  PID:3576
- C:\Windows\System\tgyCsPp.exe
  C:\Windows\System\tgyCsPp.exe
  2⤵
  PID:3624
- C:\Windows\System\CnnHKNB.exe
  C:\Windows\System\CnnHKNB.exe
  2⤵
  PID:3656
- C:\Windows\System\BeZmiCN.exe
  C:\Windows\System\BeZmiCN.exe
  2⤵
  PID:3700
- C:\Windows\System\LTFNgrG.exe
  C:\Windows\System\LTFNgrG.exe
  2⤵
  PID:3732
- C:\Windows\System\IRyrKKU.exe
  C:\Windows\System\IRyrKKU.exe
  2⤵
  PID:3780
- C:\Windows\System\mPudgjc.exe
  C:\Windows\System\mPudgjc.exe
  2⤵
  PID:3816
- C:\Windows\System\BGOABYC.exe
  C:\Windows\System\BGOABYC.exe
  2⤵
  PID:3844
- C:\Windows\System\FydqlKs.exe
  C:\Windows\System\FydqlKs.exe
  2⤵
  PID:3876
- C:\Windows\System\eophsKH.exe
  C:\Windows\System\eophsKH.exe
  2⤵
  PID:3896
- C:\Windows\System\aakOzCj.exe
  C:\Windows\System\aakOzCj.exe
  2⤵
  PID:3944
- C:\Windows\System\zlAnCzw.exe
  C:\Windows\System\zlAnCzw.exe
  2⤵
  PID:3976
- C:\Windows\System\CRqRgWV.exe
  C:\Windows\System\CRqRgWV.exe
  2⤵
  PID:4036
- C:\Windows\System\LGwCmCd.exe
  C:\Windows\System\LGwCmCd.exe
  2⤵
  PID:2200
- C:\Windows\System\ufkREvv.exe
  C:\Windows\System\ufkREvv.exe
  2⤵
  PID:1112
- C:\Windows\System\wIDlSPY.exe
  C:\Windows\System\wIDlSPY.exe
  2⤵
  PID:3096
- C:\Windows\System\HqSQWrC.exe
  C:\Windows\System\HqSQWrC.exe
  2⤵
  PID:3336
- C:\Windows\System\zTVwGJE.exe
  C:\Windows\System\zTVwGJE.exe
  2⤵
  PID:1984
- C:\Windows\System\aXAyPJk.exe
  C:\Windows\System\aXAyPJk.exe
  2⤵
  PID:2820
- C:\Windows\System\ozuuJfy.exe
  C:\Windows\System\ozuuJfy.exe
  2⤵
  PID:1392
- C:\Windows\System\SKWYppe.exe
  C:\Windows\System\SKWYppe.exe
  2⤵
  PID:2760
- C:\Windows\System\pxiQtuW.exe
  C:\Windows\System\pxiQtuW.exe
  2⤵
  PID:1992
- C:\Windows\System\rzGBRnR.exe
  C:\Windows\System\rzGBRnR.exe
  2⤵
  PID:3068
- C:\Windows\System\SucmetD.exe
  C:\Windows\System\SucmetD.exe
  2⤵
  PID:1860
- C:\Windows\System\HuPbLtX.exe
  C:\Windows\System\HuPbLtX.exe
  2⤵
  PID:3320
- C:\Windows\System\zoMHLde.exe
  C:\Windows\System\zoMHLde.exe
  2⤵
  PID:1700
- C:\Windows\System\RqjGaQy.exe
  C:\Windows\System\RqjGaQy.exe
  2⤵
  PID:2020
- C:\Windows\System\bwduMDf.exe
  C:\Windows\System\bwduMDf.exe
  2⤵
  PID:1936
- C:\Windows\System\KUprEaR.exe
  C:\Windows\System\KUprEaR.exe
  2⤵
  PID:2892
- C:\Windows\System\bZEtkop.exe
  C:\Windows\System\bZEtkop.exe
  2⤵
  PID:2160
- C:\Windows\System\TeaGGyK.exe
  C:\Windows\System\TeaGGyK.exe
  2⤵
  PID:2836
- C:\Windows\System\SImHoOf.exe
  C:\Windows\System\SImHoOf.exe
  2⤵
  PID:2788
- C:\Windows\System\vvtVcFn.exe
  C:\Windows\System\vvtVcFn.exe
  2⤵
  PID:3380
- C:\Windows\System\thScAkL.exe
  C:\Windows\System\thScAkL.exe
  2⤵
  PID:3428
- C:\Windows\System\lXZHzrt.exe
  C:\Windows\System\lXZHzrt.exe
  2⤵
  PID:3480
- C:\Windows\System\XwXuQXH.exe
  C:\Windows\System\XwXuQXH.exe
  2⤵
  PID:3540
- C:\Windows\System\JBHYSAT.exe
  C:\Windows\System\JBHYSAT.exe
  2⤵
  PID:3636
- C:\Windows\System\HstowNC.exe
  C:\Windows\System\HstowNC.exe
  2⤵
  PID:3640
- C:\Windows\System\vzMbdLo.exe
  C:\Windows\System\vzMbdLo.exe
  2⤵
  PID:3784
- C:\Windows\System\NLCmydN.exe
  C:\Windows\System\NLCmydN.exe
  2⤵
  PID:3688
- C:\Windows\System\VMhtwHx.exe
  C:\Windows\System\VMhtwHx.exe
  2⤵
  PID:3928
- C:\Windows\System\ICTzREW.exe
  C:\Windows\System\ICTzREW.exe
  2⤵
  PID:3940
- C:\Windows\System\tlrRnHg.exe
  C:\Windows\System\tlrRnHg.exe
  2⤵
  PID:3908
- C:\Windows\System\tHlvAmY.exe
  C:\Windows\System\tHlvAmY.exe
  2⤵
  PID:3972
- C:\Windows\System\BONHQGM.exe
  C:\Windows\System\BONHQGM.exe
  2⤵
  PID:4052
- C:\Windows\System\dHoKjdy.exe
  C:\Windows\System\dHoKjdy.exe
  2⤵
  PID:4084
- C:\Windows\System\UaVRKRU.exe
  C:\Windows\System\UaVRKRU.exe
  2⤵
  PID:2292
- C:\Windows\System\zdKLxNX.exe
  C:\Windows\System\zdKLxNX.exe
  2⤵
  PID:1068
- C:\Windows\System\GuQkDYy.exe
  C:\Windows\System\GuQkDYy.exe
  2⤵
  PID:620
- C:\Windows\System\MVeIMUe.exe
  C:\Windows\System\MVeIMUe.exe
  2⤵
  PID:1792
- C:\Windows\System\NcLKShU.exe
  C:\Windows\System\NcLKShU.exe
  2⤵
  PID:2968
- C:\Windows\System\BudcxYh.exe
  C:\Windows\System\BudcxYh.exe
  2⤵
  PID:2012
- C:\Windows\System\vFqnaDA.exe
  C:\Windows\System\vFqnaDA.exe
  2⤵
  PID:1316
- C:\Windows\System\JfdJSpb.exe
  C:\Windows\System\JfdJSpb.exe
  2⤵
  PID:3112
- C:\Windows\System\NbbZREA.exe
  C:\Windows\System\NbbZREA.exe
  2⤵
  PID:3256
- C:\Windows\System\ghqojRk.exe
  C:\Windows\System\ghqojRk.exe
  2⤵
  PID:2712
- C:\Windows\System\yqLhFwj.exe
  C:\Windows\System\yqLhFwj.exe
  2⤵
  PID:536
- C:\Windows\System\tPijIJP.exe
  C:\Windows\System\tPijIJP.exe
  2⤵
  PID:2960
- C:\Windows\System\ChRBqFl.exe
  C:\Windows\System\ChRBqFl.exe
  2⤵
  PID:1920
- C:\Windows\System\aSnnCKS.exe
  C:\Windows\System\aSnnCKS.exe
  2⤵
  PID:1164
- C:\Windows\System\QLnIRYV.exe
  C:\Windows\System\QLnIRYV.exe
  2⤵
  PID:2904
- C:\Windows\System\nzAskZx.exe
  C:\Windows\System\nzAskZx.exe
  2⤵
  PID:3348
- C:\Windows\System\lbpRSWM.exe
  C:\Windows\System\lbpRSWM.exe
  2⤵
  PID:3416
- C:\Windows\System\jRzhWnr.exe
  C:\Windows\System\jRzhWnr.exe
  2⤵
  PID:3000
- C:\Windows\System\PlSQXQR.exe
  C:\Windows\System\PlSQXQR.exe
  2⤵
  PID:3592
- C:\Windows\System\goiNFRn.exe
  C:\Windows\System\goiNFRn.exe
  2⤵
  PID:3672
- C:\Windows\System\AEkLDHQ.exe
  C:\Windows\System\AEkLDHQ.exe
  2⤵
  PID:3992
- C:\Windows\System\XKcBPcb.exe
  C:\Windows\System\XKcBPcb.exe
  2⤵
  PID:3764
- C:\Windows\System\tWaMzMk.exe
  C:\Windows\System\tWaMzMk.exe
  2⤵
  PID:4072
- C:\Windows\System\faNupgE.exe
  C:\Windows\System\faNupgE.exe
  2⤵
  PID:912
- C:\Windows\System\WPsdycV.exe
  C:\Windows\System\WPsdycV.exe
  2⤵
  PID:2540
- C:\Windows\System\lLxBKGD.exe
  C:\Windows\System\lLxBKGD.exe
  2⤵
  PID:3204
- C:\Windows\System\AGLuyUa.exe
  C:\Windows\System\AGLuyUa.exe
  2⤵
  PID:2692
- C:\Windows\System\vLVFYrX.exe
  C:\Windows\System\vLVFYrX.exe
  2⤵
  PID:2680
- C:\Windows\System\AvXXpzA.exe
  C:\Windows\System\AvXXpzA.exe
  2⤵
  PID:2944
- C:\Windows\System\YcBNLEM.exe
  C:\Windows\System\YcBNLEM.exe
  2⤵
  PID:3448
- C:\Windows\System\fxATzdf.exe
  C:\Windows\System\fxATzdf.exe
  2⤵
  PID:3528
- C:\Windows\System\ofdgXcm.exe
  C:\Windows\System\ofdgXcm.exe
  2⤵
  PID:3752
- C:\Windows\System\ywuSbKU.exe
  C:\Windows\System\ywuSbKU.exe
  2⤵
  PID:4040
- C:\Windows\System\AdgvMgj.exe
  C:\Windows\System\AdgvMgj.exe
  2⤵
  PID:1752
- C:\Windows\System\nHJARjc.exe
  C:\Windows\System\nHJARjc.exe
  2⤵
  PID:1160
- C:\Windows\System\OPZjpEQ.exe
  C:\Windows\System\OPZjpEQ.exe
  2⤵
  PID:2700
- C:\Windows\System\oklJOQa.exe
  C:\Windows\System\oklJOQa.exe
  2⤵
  PID:320
- C:\Windows\System\LHWknQU.exe
  C:\Windows\System\LHWknQU.exe
  2⤵
  PID:2652
- C:\Windows\System\AkeKNhq.exe
  C:\Windows\System\AkeKNhq.exe
  2⤵
  PID:2384
- C:\Windows\System\VFrusoi.exe
  C:\Windows\System\VFrusoi.exe
  2⤵
  PID:4112
- C:\Windows\System\bhpqary.exe
  C:\Windows\System\bhpqary.exe
  2⤵
  PID:4128
- C:\Windows\System\EtBzMRx.exe
  C:\Windows\System\EtBzMRx.exe
  2⤵
  PID:4144
- C:\Windows\System\YfMXppe.exe
  C:\Windows\System\YfMXppe.exe
  2⤵
  PID:4160
- C:\Windows\System\BkFPOYm.exe
  C:\Windows\System\BkFPOYm.exe
  2⤵
  PID:4176
- C:\Windows\System\SFdFucd.exe
  C:\Windows\System\SFdFucd.exe
  2⤵
  PID:4192
- C:\Windows\System\UqPJpfb.exe
  C:\Windows\System\UqPJpfb.exe
  2⤵
  PID:4208
- C:\Windows\System\jHPhNIR.exe
  C:\Windows\System\jHPhNIR.exe
  2⤵
  PID:4224
- C:\Windows\System\mnjPiHL.exe
  C:\Windows\System\mnjPiHL.exe
  2⤵
  PID:4240
- C:\Windows\System\eUsfuik.exe
  C:\Windows\System\eUsfuik.exe
  2⤵
  PID:4256
- C:\Windows\System\HBMdSBu.exe
  C:\Windows\System\HBMdSBu.exe
  2⤵
  PID:4272
- C:\Windows\System\LOEWWKT.exe
  C:\Windows\System\LOEWWKT.exe
  2⤵
  PID:4288
- C:\Windows\System\qPIoMtc.exe
  C:\Windows\System\qPIoMtc.exe
  2⤵
  PID:4304
- C:\Windows\System\sCMveMw.exe
  C:\Windows\System\sCMveMw.exe
  2⤵
  PID:4320
- C:\Windows\System\CVfJTKk.exe
  C:\Windows\System\CVfJTKk.exe
  2⤵
  PID:4336
- C:\Windows\System\UYYNaWj.exe
  C:\Windows\System\UYYNaWj.exe
  2⤵
  PID:4352
- C:\Windows\System\LKqWNON.exe
  C:\Windows\System\LKqWNON.exe
  2⤵
  PID:4372
- C:\Windows\System\eCSMvUq.exe
  C:\Windows\System\eCSMvUq.exe
  2⤵
  PID:4392
- C:\Windows\System\DSjDnKr.exe
  C:\Windows\System\DSjDnKr.exe
  2⤵
  PID:4408
- C:\Windows\System\cUPWhls.exe
  C:\Windows\System\cUPWhls.exe
  2⤵
  PID:4428
- C:\Windows\System\xYjZSyE.exe
  C:\Windows\System\xYjZSyE.exe
  2⤵
  PID:4444
- C:\Windows\System\nZjkKpn.exe
  C:\Windows\System\nZjkKpn.exe
  2⤵
  PID:4460
- C:\Windows\System\JpuWmzV.exe
  C:\Windows\System\JpuWmzV.exe
  2⤵
  PID:4496
- C:\Windows\System\sraNerN.exe
  C:\Windows\System\sraNerN.exe
  2⤵
  PID:4580
- C:\Windows\System\gntNEHr.exe
  C:\Windows\System\gntNEHr.exe
  2⤵
  PID:4596
- C:\Windows\System\QkQdqGP.exe
  C:\Windows\System\QkQdqGP.exe
  2⤵
  PID:4612
- C:\Windows\System\ruwrwbQ.exe
  C:\Windows\System\ruwrwbQ.exe
  2⤵
  PID:4628
- C:\Windows\System\fRBMtaD.exe
  C:\Windows\System\fRBMtaD.exe
  2⤵
  PID:4644
- C:\Windows\System\dSRvHly.exe
  C:\Windows\System\dSRvHly.exe
  2⤵
  PID:4660
- C:\Windows\System\BTOmriO.exe
  C:\Windows\System\BTOmriO.exe
  2⤵
  PID:4676
- C:\Windows\System\yarlEUW.exe
  C:\Windows\System\yarlEUW.exe
  2⤵
  PID:4696
- C:\Windows\System\IyjzkMS.exe
  C:\Windows\System\IyjzkMS.exe
  2⤵
  PID:4728
- C:\Windows\System\bwQeGlu.exe
  C:\Windows\System\bwQeGlu.exe
  2⤵
  PID:4752
- C:\Windows\System\lcGbVrd.exe
  C:\Windows\System\lcGbVrd.exe
  2⤵
  PID:4768
- C:\Windows\System\UupTYsG.exe
  C:\Windows\System\UupTYsG.exe
  2⤵
  PID:4812
- C:\Windows\System\jSQRDjj.exe
  C:\Windows\System\jSQRDjj.exe
  2⤵
  PID:4836
- C:\Windows\System\LqfxZUN.exe
  C:\Windows\System\LqfxZUN.exe
  2⤵
  PID:4852
- C:\Windows\System\XMsyqyh.exe
  C:\Windows\System\XMsyqyh.exe
  2⤵
  PID:4872
- C:\Windows\System\qrIcaiu.exe
  C:\Windows\System\qrIcaiu.exe
  2⤵
  PID:4912
- C:\Windows\System\vdLVFat.exe
  C:\Windows\System\vdLVFat.exe
  2⤵
  PID:4928
- C:\Windows\System\cHjnews.exe
  C:\Windows\System\cHjnews.exe
  2⤵
  PID:4944
- C:\Windows\System\hWVukwq.exe
  C:\Windows\System\hWVukwq.exe
  2⤵
  PID:4960
- C:\Windows\System\IOChdDQ.exe
  C:\Windows\System\IOChdDQ.exe
  2⤵
  PID:4976
- C:\Windows\System\oNntznF.exe
  C:\Windows\System\oNntznF.exe
  2⤵
  PID:4992
- C:\Windows\System\zgaFlFf.exe
  C:\Windows\System\zgaFlFf.exe
  2⤵
  PID:5008
- C:\Windows\System\GxmvteH.exe
  C:\Windows\System\GxmvteH.exe
  2⤵
  PID:5024
- C:\Windows\System\TUBvwWa.exe
  C:\Windows\System\TUBvwWa.exe
  2⤵
  PID:5040
- C:\Windows\System\swxMVCi.exe
  C:\Windows\System\swxMVCi.exe
  2⤵
  PID:5056
- C:\Windows\System\zlQQvqB.exe
  C:\Windows\System\zlQQvqB.exe
  2⤵
  PID:5072
- C:\Windows\System\koefkgE.exe
  C:\Windows\System\koefkgE.exe
  2⤵
  PID:5092
- C:\Windows\System\NspDRuI.exe
  C:\Windows\System\NspDRuI.exe
  2⤵
  PID:5112
- C:\Windows\System\lJcosyC.exe
  C:\Windows\System\lJcosyC.exe
  2⤵
  PID:2016
- C:\Windows\System\UVtZPhv.exe
  C:\Windows\System\UVtZPhv.exe
  2⤵
  PID:4008
- C:\Windows\System\ezTpROI.exe
  C:\Windows\System\ezTpROI.exe
  2⤵
  PID:4156
- C:\Windows\System\PdRFxZC.exe
  C:\Windows\System\PdRFxZC.exe
  2⤵
  PID:4220
- C:\Windows\System\gUnCsFg.exe
  C:\Windows\System\gUnCsFg.exe
  2⤵
  PID:4284
- C:\Windows\System\iNSloKs.exe
  C:\Windows\System\iNSloKs.exe
  2⤵
  PID:3800
- C:\Windows\System\PyrJhAV.exe
  C:\Windows\System\PyrJhAV.exe
  2⤵
  PID:4140
- C:\Windows\System\QhXNxAZ.exe
  C:\Windows\System\QhXNxAZ.exe
  2⤵
  PID:2976
- C:\Windows\System\hHIXZCg.exe
  C:\Windows\System\hHIXZCg.exe
  2⤵
  PID:4168
- C:\Windows\System\pPOOrEU.exe
  C:\Windows\System\pPOOrEU.exe
  2⤵
  PID:3240
- C:\Windows\System\exflDLv.exe
  C:\Windows\System\exflDLv.exe
  2⤵
  PID:3924
- C:\Windows\System\oYIFEmw.exe
  C:\Windows\System\oYIFEmw.exe
  2⤵
  PID:4232
- C:\Windows\System\BRALMDp.exe
  C:\Windows\System\BRALMDp.exe
  2⤵
  PID:4364
- C:\Windows\System\nwgymaT.exe
  C:\Windows\System\nwgymaT.exe
  2⤵
  PID:4416
- C:\Windows\System\aAzaHKr.exe
  C:\Windows\System\aAzaHKr.exe
  2⤵
  PID:4404
- C:\Windows\System\asXOYvC.exe
  C:\Windows\System\asXOYvC.exe
  2⤵
  PID:4472
- C:\Windows\System\IysZwbv.exe
  C:\Windows\System\IysZwbv.exe
  2⤵
  PID:4492
- C:\Windows\System\zfTwskx.exe
  C:\Windows\System\zfTwskx.exe
  2⤵
  PID:4512
- C:\Windows\System\bkpFvST.exe
  C:\Windows\System\bkpFvST.exe
  2⤵
  PID:4528
- C:\Windows\System\vxgotGc.exe
  C:\Windows\System\vxgotGc.exe
  2⤵
  PID:4540
- C:\Windows\System\QTtqssB.exe
  C:\Windows\System\QTtqssB.exe
  2⤵
  PID:4560
- C:\Windows\System\XNffpmn.exe
  C:\Windows\System\XNffpmn.exe
  2⤵
  PID:4576
- C:\Windows\System\TEYbbnI.exe
  C:\Windows\System\TEYbbnI.exe
  2⤵
  PID:4608
- C:\Windows\System\ZvIAyBs.exe
  C:\Windows\System\ZvIAyBs.exe
  2⤵
  PID:4640
- C:\Windows\System\BTvtsjd.exe
  C:\Windows\System\BTvtsjd.exe
  2⤵
  PID:4672
- C:\Windows\System\bEzIPcg.exe
  C:\Windows\System\bEzIPcg.exe
  2⤵
  PID:4688
- C:\Windows\System\sBRcwma.exe
  C:\Windows\System\sBRcwma.exe
  2⤵
  PID:4720
- C:\Windows\System\GMFKTOa.exe
  C:\Windows\System\GMFKTOa.exe
  2⤵
  PID:4740
- C:\Windows\System\jZXLIZe.exe
  C:\Windows\System\jZXLIZe.exe
  2⤵
  PID:4784
- C:\Windows\System\FaqPxmM.exe
  C:\Windows\System\FaqPxmM.exe
  2⤵
  PID:4800
- C:\Windows\System\zlLgZRC.exe
  C:\Windows\System\zlLgZRC.exe
  2⤵
  PID:4824
- C:\Windows\System\BNmptVf.exe
  C:\Windows\System\BNmptVf.exe
  2⤵
  PID:4860
- C:\Windows\System\QNAdvGA.exe
  C:\Windows\System\QNAdvGA.exe
  2⤵
  PID:4884
- C:\Windows\System\eCIUidt.exe
  C:\Windows\System\eCIUidt.exe
  2⤵
  PID:4900
- C:\Windows\System\NRgEnMc.exe
  C:\Windows\System\NRgEnMc.exe
  2⤵
  PID:4924
- C:\Windows\System\HxScIHD.exe
  C:\Windows\System\HxScIHD.exe
  2⤵
  PID:4940
- C:\Windows\System\LkHsWGW.exe
  C:\Windows\System\LkHsWGW.exe
  2⤵
  PID:5016
- C:\Windows\System\JoYXhRK.exe
  C:\Windows\System\JoYXhRK.exe
  2⤵
  PID:5004
- C:\Windows\System\mHXffyL.exe
  C:\Windows\System\mHXffyL.exe
  2⤵
  PID:5036
- C:\Windows\System\nSfgaXP.exe
  C:\Windows\System\nSfgaXP.exe
  2⤵
  PID:5088
- C:\Windows\System\GtFGHWd.exe
  C:\Windows\System\GtFGHWd.exe
  2⤵
  PID:5104
- C:\Windows\System\CMsancV.exe
  C:\Windows\System\CMsancV.exe
  2⤵
  PID:4120
- C:\Windows\System\xerOLYS.exe
  C:\Windows\System\xerOLYS.exe
  2⤵
  PID:3508
- C:\Windows\System\wZDVXHo.exe
  C:\Windows\System\wZDVXHo.exe
  2⤵
  PID:4136
- C:\Windows\System\GXJXHSr.exe
  C:\Windows\System\GXJXHSr.exe
  2⤵
  PID:4380
- C:\Windows\System\GUmmnxu.exe
  C:\Windows\System\GUmmnxu.exe
  2⤵
  PID:4424
- C:\Windows\System\miERiDA.exe
  C:\Windows\System\miERiDA.exe
  2⤵
  PID:4520
- C:\Windows\System\FrOGfNj.exe
  C:\Windows\System\FrOGfNj.exe
  2⤵
  PID:4592
- C:\Windows\System\OYoVqZY.exe
  C:\Windows\System\OYoVqZY.exe
  2⤵
  PID:4668
- C:\Windows\System\ZCNMMFe.exe
  C:\Windows\System\ZCNMMFe.exe
  2⤵
  PID:4716
- C:\Windows\System\UvgwUtJ.exe
  C:\Windows\System\UvgwUtJ.exe
  2⤵
  PID:4572
- C:\Windows\System\UlNgnVQ.exe
  C:\Windows\System\UlNgnVQ.exe
  2⤵
  PID:4764
- C:\Windows\System\WyJrzdh.exe
  C:\Windows\System\WyJrzdh.exe
  2⤵
  PID:4892
- C:\Windows\System\YpCtpiM.exe
  C:\Windows\System\YpCtpiM.exe
  2⤵
  PID:5068
- C:\Windows\System\zHnFzKg.exe
  C:\Windows\System\zHnFzKg.exe
  2⤵
  PID:4216
- C:\Windows\System\WHmmGkY.exe
  C:\Windows\System\WHmmGkY.exe
  2⤵
  PID:2704
- C:\Windows\System\HvbfbWF.exe
  C:\Windows\System\HvbfbWF.exe
  2⤵
  PID:4328
- C:\Windows\System\XXAuear.exe
  C:\Windows\System\XXAuear.exe
  2⤵
  PID:4348
- C:\Windows\System\sxthazk.exe
  C:\Windows\System\sxthazk.exe
  2⤵
  PID:4172
- C:\Windows\System\Nwxsyvr.exe
  C:\Windows\System\Nwxsyvr.exe
  2⤵
  PID:4480
- C:\Windows\System\jZsggWy.exe
  C:\Windows\System\jZsggWy.exe
  2⤵
  PID:4552
- C:\Windows\System\mhuQusj.exe
  C:\Windows\System\mhuQusj.exe
  2⤵
  PID:4776
- C:\Windows\System\cSygeRI.exe
  C:\Windows\System\cSygeRI.exe
  2⤵
  PID:4708
- C:\Windows\System\xBSBOfE.exe
  C:\Windows\System\xBSBOfE.exe
  2⤵
  PID:4804
- C:\Windows\System\dpxhKTS.exe
  C:\Windows\System\dpxhKTS.exe
  2⤵
  PID:4788
- C:\Windows\System\RfDKPWt.exe
  C:\Windows\System\RfDKPWt.exe
  2⤵
  PID:4848
- C:\Windows\System\Ujdrbjv.exe
  C:\Windows\System\Ujdrbjv.exe
  2⤵
  PID:4968
- C:\Windows\System\kEUxTZp.exe
  C:\Windows\System\kEUxTZp.exe
  2⤵
  PID:4956
- C:\Windows\System\aPipzWd.exe
  C:\Windows\System\aPipzWd.exe
  2⤵
  PID:5080
- C:\Windows\System\utxcKnA.exe
  C:\Windows\System\utxcKnA.exe
  2⤵
  PID:4296
- C:\Windows\System\eqXjQyA.exe
  C:\Windows\System\eqXjQyA.exe
  2⤵
  PID:4344
- C:\Windows\System\FhOssAK.exe
  C:\Windows\System\FhOssAK.exe
  2⤵
  PID:4420
- C:\Windows\System\iTBsBQI.exe
  C:\Windows\System\iTBsBQI.exe
  2⤵
  PID:4712
- C:\Windows\System\pyguPFy.exe
  C:\Windows\System\pyguPFy.exe
  2⤵
  PID:4508
- C:\Windows\System\sFuhaJv.exe
  C:\Windows\System\sFuhaJv.exe
  2⤵
  PID:4844
- C:\Windows\System\sgeAmPY.exe
  C:\Windows\System\sgeAmPY.exe
  2⤵
  PID:5100
- C:\Windows\System\jpCGVyH.exe
  C:\Windows\System\jpCGVyH.exe
  2⤵
  PID:4300
- C:\Windows\System\UUTpNgS.exe
  C:\Windows\System\UUTpNgS.exe
  2⤵
  PID:4936
- C:\Windows\System\GmwsoNP.exe
  C:\Windows\System\GmwsoNP.exe
  2⤵
  PID:4984
- C:\Windows\System\UrKFiPD.exe
  C:\Windows\System\UrKFiPD.exe
  2⤵
  PID:4108
- C:\Windows\System\iuDhWSU.exe
  C:\Windows\System\iuDhWSU.exe
  2⤵
  PID:5020
- C:\Windows\System\OqVBsJA.exe
  C:\Windows\System\OqVBsJA.exe
  2⤵
  PID:4484
- C:\Windows\System\YTiBbeI.exe
  C:\Windows\System\YTiBbeI.exe
  2⤵
  PID:5136
- C:\Windows\System\lXVImWG.exe
  C:\Windows\System\lXVImWG.exe
  2⤵
  PID:5152
- C:\Windows\System\VtylyeQ.exe
  C:\Windows\System\VtylyeQ.exe
  2⤵
  PID:5168
- C:\Windows\System\quNyTov.exe
  C:\Windows\System\quNyTov.exe
  2⤵
  PID:5184
- C:\Windows\System\ueUGQeh.exe
  C:\Windows\System\ueUGQeh.exe
  2⤵
  PID:5200
- C:\Windows\System\mQdfdva.exe
  C:\Windows\System\mQdfdva.exe
  2⤵
  PID:5216
- C:\Windows\System\JVwbaEY.exe
  C:\Windows\System\JVwbaEY.exe
  2⤵
  PID:5232
- C:\Windows\System\plIpXUH.exe
  C:\Windows\System\plIpXUH.exe
  2⤵
  PID:5248
- C:\Windows\System\QjXqXaf.exe
  C:\Windows\System\QjXqXaf.exe
  2⤵
  PID:5264
- C:\Windows\System\pprWelN.exe
  C:\Windows\System\pprWelN.exe
  2⤵
  PID:5280
- C:\Windows\System\mDXOJWk.exe
  C:\Windows\System\mDXOJWk.exe
  2⤵
  PID:5296
- C:\Windows\System\xPGrCpd.exe
  C:\Windows\System\xPGrCpd.exe
  2⤵
  PID:5316
- C:\Windows\System\GvHubJK.exe
  C:\Windows\System\GvHubJK.exe
  2⤵
  PID:5336
- C:\Windows\System\AAJHRBO.exe
  C:\Windows\System\AAJHRBO.exe
  2⤵
  PID:5356
- C:\Windows\System\HEMctYQ.exe
  C:\Windows\System\HEMctYQ.exe
  2⤵
  PID:5380
- C:\Windows\System\goyLjDZ.exe
  C:\Windows\System\goyLjDZ.exe
  2⤵
  PID:5396
- C:\Windows\System\LYiBqZR.exe
  C:\Windows\System\LYiBqZR.exe
  2⤵
  PID:5412
- C:\Windows\System\TmZYtPO.exe
  C:\Windows\System\TmZYtPO.exe
  2⤵
  PID:5428
- C:\Windows\System\zlpPAqt.exe
  C:\Windows\System\zlpPAqt.exe
  2⤵
  PID:5444
- C:\Windows\System\ZvjQfuG.exe
  C:\Windows\System\ZvjQfuG.exe
  2⤵
  PID:5460
- C:\Windows\System\zocJEWE.exe
  C:\Windows\System\zocJEWE.exe
  2⤵
  PID:5476
- C:\Windows\System\USTJycS.exe
  C:\Windows\System\USTJycS.exe
  2⤵
  PID:5492
- C:\Windows\System\snondnR.exe
  C:\Windows\System\snondnR.exe
  2⤵
  PID:5508
- C:\Windows\System\MRcCGoD.exe
  C:\Windows\System\MRcCGoD.exe
  2⤵
  PID:5524
- C:\Windows\System\xwFPOou.exe
  C:\Windows\System\xwFPOou.exe
  2⤵
  PID:5540
- C:\Windows\System\gBXkbKn.exe
  C:\Windows\System\gBXkbKn.exe
  2⤵
  PID:5556
- C:\Windows\System\sjEUKWS.exe
  C:\Windows\System\sjEUKWS.exe
  2⤵
  PID:5572
- C:\Windows\System\IMbkogT.exe
  C:\Windows\System\IMbkogT.exe
  2⤵
  PID:5592
- C:\Windows\System\eulwMyv.exe
  C:\Windows\System\eulwMyv.exe
  2⤵
  PID:5608
- C:\Windows\System\xsMBgTX.exe
  C:\Windows\System\xsMBgTX.exe
  2⤵
  PID:5624
- C:\Windows\System\XnvLRkC.exe
  C:\Windows\System\XnvLRkC.exe
  2⤵
  PID:5640
- C:\Windows\System\sUwLhoK.exe
  C:\Windows\System\sUwLhoK.exe
  2⤵
  PID:5656
- C:\Windows\System\WdVrZCv.exe
  C:\Windows\System\WdVrZCv.exe
  2⤵
  PID:5672
- C:\Windows\System\FZgWAUu.exe
  C:\Windows\System\FZgWAUu.exe
  2⤵
  PID:5688
- C:\Windows\System\FKXuwxP.exe
  C:\Windows\System\FKXuwxP.exe
  2⤵
  PID:5704
- C:\Windows\System\TkDhvUZ.exe
  C:\Windows\System\TkDhvUZ.exe
  2⤵
  PID:5720
- C:\Windows\System\rNJvSsz.exe
  C:\Windows\System\rNJvSsz.exe
  2⤵
  PID:5736
- C:\Windows\System\jEsDyLm.exe
  C:\Windows\System\jEsDyLm.exe
  2⤵
  PID:5752
- C:\Windows\System\ciyhHUe.exe
  C:\Windows\System\ciyhHUe.exe
  2⤵
  PID:5768
- C:\Windows\System\CyPvGld.exe
  C:\Windows\System\CyPvGld.exe
  2⤵
  PID:5784
- C:\Windows\System\GZxnYyF.exe
  C:\Windows\System\GZxnYyF.exe
  2⤵
  PID:5800
- C:\Windows\System\RqkfDHE.exe
  C:\Windows\System\RqkfDHE.exe
  2⤵
  PID:5816
- C:\Windows\System\CDQlGkO.exe
  C:\Windows\System\CDQlGkO.exe
  2⤵
  PID:5832
- C:\Windows\System\XsaLdpq.exe
  C:\Windows\System\XsaLdpq.exe
  2⤵
  PID:5848
- C:\Windows\System\qPWvggt.exe
  C:\Windows\System\qPWvggt.exe
  2⤵
  PID:5872
- C:\Windows\System\lCUnueC.exe
  C:\Windows\System\lCUnueC.exe
  2⤵
  PID:5892
- C:\Windows\System\OugFoIv.exe
  C:\Windows\System\OugFoIv.exe
  2⤵
  PID:5908
- C:\Windows\System\KVlAmkP.exe
  C:\Windows\System\KVlAmkP.exe
  2⤵
  PID:5952
- C:\Windows\System\LaDGDNy.exe
  C:\Windows\System\LaDGDNy.exe
  2⤵
  PID:6004
- C:\Windows\System\rMjbINA.exe
  C:\Windows\System\rMjbINA.exe
  2⤵
  PID:6024
- C:\Windows\System\HerQklM.exe
  C:\Windows\System\HerQklM.exe
  2⤵
  PID:6056
- C:\Windows\System\NDLWbQU.exe
  C:\Windows\System\NDLWbQU.exe
  2⤵
  PID:6076
- C:\Windows\System\wUiwXkw.exe
  C:\Windows\System\wUiwXkw.exe
  2⤵
  PID:6100
- C:\Windows\System\FhHrdXT.exe
  C:\Windows\System\FhHrdXT.exe
  2⤵
  PID:4908
- C:\Windows\System\NWmxJae.exe
  C:\Windows\System\NWmxJae.exe
  2⤵
  PID:5208
- C:\Windows\System\oBnrVdr.exe
  C:\Windows\System\oBnrVdr.exe
  2⤵
  PID:5240
- C:\Windows\System\OBraPIL.exe
  C:\Windows\System\OBraPIL.exe
  2⤵
  PID:5368
- C:\Windows\System\FcsqbrK.exe
  C:\Windows\System\FcsqbrK.exe
  2⤵
  PID:5500
- C:\Windows\System\ZBKpQLd.exe
  C:\Windows\System\ZBKpQLd.exe
  2⤵
  PID:5488
- C:\Windows\System\upyyXla.exe
  C:\Windows\System\upyyXla.exe
  2⤵
  PID:5604
- C:\Windows\System\hkBdZMv.exe
  C:\Windows\System\hkBdZMv.exe
  2⤵
  PID:5620
- C:\Windows\System\vdvVaQf.exe
  C:\Windows\System\vdvVaQf.exe
  2⤵
  PID:5584
- C:\Windows\System\SVWkhrL.exe
  C:\Windows\System\SVWkhrL.exe
  2⤵
  PID:5680
- C:\Windows\System\MVtzqxJ.exe
  C:\Windows\System\MVtzqxJ.exe
  2⤵
  PID:5716
- C:\Windows\System\iZbqgcE.exe
  C:\Windows\System\iZbqgcE.exe
  2⤵
  PID:5764
- C:\Windows\System\AVkMLIl.exe
  C:\Windows\System\AVkMLIl.exe
  2⤵
  PID:5828
- C:\Windows\System\iUTzqOK.exe
  C:\Windows\System\iUTzqOK.exe
  2⤵
  PID:5860
- C:\Windows\System\LICspyd.exe
  C:\Windows\System\LICspyd.exe
  2⤵
  PID:5920
- C:\Windows\System\zJUjhur.exe
  C:\Windows\System\zJUjhur.exe
  2⤵
  PID:5936
- C:\Windows\System\IwnCRfC.exe
  C:\Windows\System\IwnCRfC.exe
  2⤵
  PID:5960
- C:\Windows\System\HtJYAAE.exe
  C:\Windows\System\HtJYAAE.exe
  2⤵
  PID:5976
- C:\Windows\System\iOJvSmt.exe
  C:\Windows\System\iOJvSmt.exe
  2⤵
  PID:5996
- C:\Windows\System\RhpsNPv.exe
  C:\Windows\System\RhpsNPv.exe
  2⤵
  PID:6036
- C:\Windows\System\mrYFWjZ.exe
  C:\Windows\System\mrYFWjZ.exe
  2⤵
  PID:6052
- C:\Windows\System\FEMdwwx.exe
  C:\Windows\System\FEMdwwx.exe
  2⤵
  PID:6096
- C:\Windows\System\XGEtmYT.exe
  C:\Windows\System\XGEtmYT.exe
  2⤵
  PID:6068
- C:\Windows\System\LWmbpIT.exe
  C:\Windows\System\LWmbpIT.exe
  2⤵
  PID:6112
- C:\Windows\System\SOWuAip.exe
  C:\Windows\System\SOWuAip.exe
  2⤵
  PID:6128
- C:\Windows\System\fozInQO.exe
  C:\Windows\System\fozInQO.exe
  2⤵
  PID:5128
- C:\Windows\System\texnThM.exe
  C:\Windows\System\texnThM.exe
  2⤵
  PID:5196
- C:\Windows\System\avZmvQh.exe
  C:\Windows\System\avZmvQh.exe
  2⤵
  PID:5256
- C:\Windows\System\VmjknTL.exe
  C:\Windows\System\VmjknTL.exe
  2⤵
  PID:4556
- C:\Windows\System\WlZoVMA.exe
  C:\Windows\System\WlZoVMA.exe
  2⤵
  PID:5424
- C:\Windows\System\XjVfMnG.exe
  C:\Windows\System\XjVfMnG.exe
  2⤵
  PID:5484
- C:\Windows\System\ejtUtJn.exe
  C:\Windows\System\ejtUtJn.exe
  2⤵
  PID:5600
- C:\Windows\System\hNpjIzQ.exe
  C:\Windows\System\hNpjIzQ.exe
  2⤵
  PID:5712
- C:\Windows\System\IWTqnfh.exe
  C:\Windows\System\IWTqnfh.exe
  2⤵
  PID:5760
- C:\Windows\System\hdansvg.exe
  C:\Windows\System\hdansvg.exe
  2⤵
  PID:5808
- C:\Windows\System\tKUEKCJ.exe
  C:\Windows\System\tKUEKCJ.exe
  2⤵
  PID:5900
- C:\Windows\System\bmNNzoM.exe
  C:\Windows\System\bmNNzoM.exe
  2⤵
  PID:5884
- C:\Windows\System\WXdFWUx.exe
  C:\Windows\System\WXdFWUx.exe
  2⤵
  PID:5928
- C:\Windows\System\jTrJYnR.exe
  C:\Windows\System\jTrJYnR.exe
  2⤵
  PID:5948
- C:\Windows\System\HMRbxoo.exe
  C:\Windows\System\HMRbxoo.exe
  2⤵
  PID:6032
- C:\Windows\System\hgfpnve.exe
  C:\Windows\System\hgfpnve.exe
  2⤵
  PID:6048
- C:\Windows\System\qEtXkRW.exe
  C:\Windows\System\qEtXkRW.exe
  2⤵
  PID:6136
- C:\Windows\System\SPJQMgh.exe
  C:\Windows\System\SPJQMgh.exe
  2⤵
  PID:6132
- C:\Windows\System\zTAeQYl.exe
  C:\Windows\System\zTAeQYl.exe
  2⤵
  PID:5160
- C:\Windows\System\UPXbtTO.exe
  C:\Windows\System\UPXbtTO.exe
  2⤵
  PID:5032
- C:\Windows\System\tTbJHox.exe
  C:\Windows\System\tTbJHox.exe
  2⤵
  PID:5328
- C:\Windows\System\PJEYOCn.exe
  C:\Windows\System\PJEYOCn.exe
  2⤵
  PID:5312
- C:\Windows\System\xFdrlZc.exe
  C:\Windows\System\xFdrlZc.exe
  2⤵
  PID:5352
- C:\Windows\System\ZwetDLc.exe
  C:\Windows\System\ZwetDLc.exe
  2⤵
  PID:5456
- C:\Windows\System\ffUJrGh.exe
  C:\Windows\System\ffUJrGh.exe
  2⤵
  PID:5564
- C:\Windows\System\uJeRrKT.exe
  C:\Windows\System\uJeRrKT.exe
  2⤵
  PID:5728
- C:\Windows\System\AJnRNmR.exe
  C:\Windows\System\AJnRNmR.exe
  2⤵
  PID:5856
- C:\Windows\System\vlPFtIm.exe
  C:\Windows\System\vlPFtIm.exe
  2⤵
  PID:5652
- C:\Windows\System\psaSKfV.exe
  C:\Windows\System\psaSKfV.exe
  2⤵
  PID:5796
- C:\Windows\System\fAWhjWz.exe
  C:\Windows\System\fAWhjWz.exe
  2⤵
  PID:6072
- C:\Windows\System\eJhFiEX.exe
  C:\Windows\System\eJhFiEX.exe
  2⤵
  PID:6120
- C:\Windows\System\eiYjIOU.exe
  C:\Windows\System\eiYjIOU.exe
  2⤵
  PID:5212
- C:\Windows\System\CpjfWta.exe
  C:\Windows\System\CpjfWta.exe
  2⤵
  PID:5288
- C:\Windows\System\EmZGSTg.exe
  C:\Windows\System\EmZGSTg.exe
  2⤵
  PID:3080
- C:\Windows\System\FFDtigb.exe
  C:\Windows\System\FFDtigb.exe
  2⤵
  PID:5344
- C:\Windows\System\YyRDKRl.exe
  C:\Windows\System\YyRDKRl.exe
  2⤵
  PID:5392
- C:\Windows\System\QIBlvey.exe
  C:\Windows\System\QIBlvey.exe
  2⤵
  PID:5520
- C:\Windows\System\aWZHlZl.exe
  C:\Windows\System\aWZHlZl.exe
  2⤵
  PID:5580
- C:\Windows\System\gflnqZh.exe
  C:\Windows\System\gflnqZh.exe
  2⤵
  PID:5840
- C:\Windows\System\GopwYqz.exe
  C:\Windows\System\GopwYqz.exe
  2⤵
  PID:5944
- C:\Windows\System\VSuTNYR.exe
  C:\Windows\System\VSuTNYR.exe
  2⤵
  PID:6108
- C:\Windows\System\gnXEJKg.exe
  C:\Windows\System\gnXEJKg.exe
  2⤵
  PID:4736
- C:\Windows\System\UBUcuMC.exe
  C:\Windows\System\UBUcuMC.exe
  2⤵
  PID:5148
- C:\Windows\System\hLwKdgt.exe
  C:\Windows\System\hLwKdgt.exe
  2⤵
  PID:5388
- C:\Windows\System\ExjVKSJ.exe
  C:\Windows\System\ExjVKSJ.exe
  2⤵
  PID:5348
- C:\Windows\System\ztsfiCK.exe
  C:\Windows\System\ztsfiCK.exe
  2⤵
  PID:5888
- C:\Windows\System\ZswNfng.exe
  C:\Windows\System\ZswNfng.exe
  2⤵
  PID:6040
- C:\Windows\System\hrZJwzt.exe
  C:\Windows\System\hrZJwzt.exe
  2⤵
  PID:5292
- C:\Windows\System\NIjWoBb.exe
  C:\Windows\System\NIjWoBb.exe
  2⤵
  PID:5244
- C:\Windows\System\KLKJGuK.exe
  C:\Windows\System\KLKJGuK.exe
  2⤵
  PID:5404
- C:\Windows\System\fLicwvj.exe
  C:\Windows\System\fLicwvj.exe
  2⤵
  PID:5548
- C:\Windows\System\yWuWcfZ.exe
  C:\Windows\System\yWuWcfZ.exe
  2⤵
  PID:6152
- C:\Windows\System\MSRXPjX.exe
  C:\Windows\System\MSRXPjX.exe
  2⤵
  PID:6168
- C:\Windows\System\WoKMQUA.exe
  C:\Windows\System\WoKMQUA.exe
  2⤵
  PID:6184
- C:\Windows\System\KKSHWBO.exe
  C:\Windows\System\KKSHWBO.exe
  2⤵
  PID:6204
- C:\Windows\System\OcifEYJ.exe
  C:\Windows\System\OcifEYJ.exe
  2⤵
  PID:6224
- C:\Windows\System\zvEUWYN.exe
  C:\Windows\System\zvEUWYN.exe
  2⤵
  PID:6252
- C:\Windows\System\kHHlupr.exe
  C:\Windows\System\kHHlupr.exe
  2⤵
  PID:6268
- C:\Windows\System\NCJrtqL.exe
  C:\Windows\System\NCJrtqL.exe
  2⤵
  PID:6284
- C:\Windows\System\WbcOudO.exe
  C:\Windows\System\WbcOudO.exe
  2⤵
  PID:6300
- C:\Windows\System\gVKhoAp.exe
  C:\Windows\System\gVKhoAp.exe
  2⤵
  PID:6316
- C:\Windows\System\TbWejfy.exe
  C:\Windows\System\TbWejfy.exe
  2⤵
  PID:6332
- C:\Windows\System\CzpuoAW.exe
  C:\Windows\System\CzpuoAW.exe
  2⤵
  PID:6348
- C:\Windows\System\RwQtdyq.exe
  C:\Windows\System\RwQtdyq.exe
  2⤵
  PID:6364
- C:\Windows\System\yCFQldJ.exe
  C:\Windows\System\yCFQldJ.exe
  2⤵
  PID:6384
- C:\Windows\System\KrBoESH.exe
  C:\Windows\System\KrBoESH.exe
  2⤵
  PID:6404
- C:\Windows\System\NutfbdU.exe
  C:\Windows\System\NutfbdU.exe
  2⤵
  PID:6420
- C:\Windows\System\VqsRdSU.exe
  C:\Windows\System\VqsRdSU.exe
  2⤵
  PID:6436
- C:\Windows\System\GJxcnzi.exe
  C:\Windows\System\GJxcnzi.exe
  2⤵
  PID:6456
- C:\Windows\System\KZTVOjw.exe
  C:\Windows\System\KZTVOjw.exe
  2⤵
  PID:6472
- C:\Windows\System\unxjWYC.exe
  C:\Windows\System\unxjWYC.exe
  2⤵
  PID:6516
- C:\Windows\System\GErZFMq.exe
  C:\Windows\System\GErZFMq.exe
  2⤵
  PID:6536
- C:\Windows\System\BnwYdLC.exe
  C:\Windows\System\BnwYdLC.exe
  2⤵
  PID:6652
- C:\Windows\System\fyBUzaQ.exe
  C:\Windows\System\fyBUzaQ.exe
  2⤵
  PID:6672
- C:\Windows\System\eTsqUiw.exe
  C:\Windows\System\eTsqUiw.exe
  2⤵
  PID:6688
- C:\Windows\System\sibpGyN.exe
  C:\Windows\System\sibpGyN.exe
  2⤵
  PID:6704
- C:\Windows\System\xrunIIM.exe
  C:\Windows\System\xrunIIM.exe
  2⤵
  PID:6724
- C:\Windows\System\hnzgRKV.exe
  C:\Windows\System\hnzgRKV.exe
  2⤵
  PID:6748
- C:\Windows\System\XDQIePy.exe
  C:\Windows\System\XDQIePy.exe
  2⤵
  PID:6764
- C:\Windows\System\OYwSEhA.exe
  C:\Windows\System\OYwSEhA.exe
  2⤵
  PID:6780
- C:\Windows\System\DyaOfLm.exe
  C:\Windows\System\DyaOfLm.exe
  2⤵
  PID:6796
- C:\Windows\System\xRmklGf.exe
  C:\Windows\System\xRmklGf.exe
  2⤵
  PID:6820
- C:\Windows\System\FpnylMq.exe
  C:\Windows\System\FpnylMq.exe
  2⤵
  PID:6836
- C:\Windows\System\wKBOmRP.exe
  C:\Windows\System\wKBOmRP.exe
  2⤵
  PID:6852
- C:\Windows\System\YyEVcDK.exe
  C:\Windows\System\YyEVcDK.exe
  2⤵
  PID:6868
- C:\Windows\System\tskJUIq.exe
  C:\Windows\System\tskJUIq.exe
  2⤵
  PID:6892
- C:\Windows\System\CHJKkGS.exe
  C:\Windows\System\CHJKkGS.exe
  2⤵
  PID:6908
- C:\Windows\System\vYmvXuZ.exe
  C:\Windows\System\vYmvXuZ.exe
  2⤵
  PID:6924
- C:\Windows\System\IhpEUAl.exe
  C:\Windows\System\IhpEUAl.exe
  2⤵
  PID:6940
- C:\Windows\System\iPbsDEQ.exe
  C:\Windows\System\iPbsDEQ.exe
  2⤵
  PID:6956
- C:\Windows\System\LFVwQQw.exe
  C:\Windows\System\LFVwQQw.exe
  2⤵
  PID:6976
- C:\Windows\System\vVFCvQy.exe
  C:\Windows\System\vVFCvQy.exe
  2⤵
  PID:7016
- C:\Windows\System\BcRpQcr.exe
  C:\Windows\System\BcRpQcr.exe
  2⤵
  PID:7068
- C:\Windows\System\kJGturd.exe
  C:\Windows\System\kJGturd.exe
  2⤵
  PID:7084
- C:\Windows\System\YgfuJve.exe
  C:\Windows\System\YgfuJve.exe
  2⤵
  PID:7108
- C:\Windows\System\HVAafou.exe
  C:\Windows\System\HVAafou.exe
  2⤵
  PID:7128
- C:\Windows\System\QKtkQhV.exe
  C:\Windows\System\QKtkQhV.exe
  2⤵
  PID:7152
- C:\Windows\System\BvuJtUU.exe
  C:\Windows\System\BvuJtUU.exe
  2⤵
  PID:5308
- C:\Windows\System\oHMZueM.exe
  C:\Windows\System\oHMZueM.exe
  2⤵
  PID:5192
- C:\Windows\System\fKRWlQX.exe
  C:\Windows\System\fKRWlQX.exe
  2⤵
  PID:6200
- C:\Windows\System\GuAeogY.exe
  C:\Windows\System\GuAeogY.exe
  2⤵
  PID:6176
- C:\Windows\System\RXiaLBA.exe
  C:\Windows\System\RXiaLBA.exe
  2⤵
  PID:6212
- C:\Windows\System\SMfpNqT.exe
  C:\Windows\System\SMfpNqT.exe
  2⤵
  PID:6308
- C:\Windows\System\fnwQBUN.exe
  C:\Windows\System\fnwQBUN.exe
  2⤵
  PID:6380
- C:\Windows\System\YoxhCOZ.exe
  C:\Windows\System\YoxhCOZ.exe
  2⤵
  PID:6296
- C:\Windows\System\QdcpwMA.exe
  C:\Windows\System\QdcpwMA.exe
  2⤵
  PID:6400
- C:\Windows\System\jgPrwPj.exe
  C:\Windows\System\jgPrwPj.exe
  2⤵
  PID:6500
- C:\Windows\System\HjHKTvR.exe
  C:\Windows\System\HjHKTvR.exe
  2⤵
  PID:6572
- C:\Windows\System\aZhhVyV.exe
  C:\Windows\System\aZhhVyV.exe
  2⤵
  PID:6612
- C:\Windows\System\aeRhlDI.exe
  C:\Windows\System\aeRhlDI.exe
  2⤵
  PID:6640
- C:\Windows\System\UizHgJq.exe
  C:\Windows\System\UizHgJq.exe
  2⤵
  PID:6668
- C:\Windows\System\wBUXQwT.exe
  C:\Windows\System\wBUXQwT.exe
  2⤵
  PID:6712
- C:\Windows\System\NdoDPWA.exe
  C:\Windows\System\NdoDPWA.exe
  2⤵
  PID:6756
- C:\Windows\System\RAoANMy.exe
  C:\Windows\System\RAoANMy.exe
  2⤵
  PID:6740
- C:\Windows\System\BEbiOzK.exe
  C:\Windows\System\BEbiOzK.exe
  2⤵
  PID:6804
- C:\Windows\System\acwTNZe.exe
  C:\Windows\System\acwTNZe.exe
  2⤵
  PID:6828
- C:\Windows\System\pUkjbZE.exe
  C:\Windows\System\pUkjbZE.exe
  2⤵
  PID:6860
- C:\Windows\System\wxeXnFz.exe
  C:\Windows\System\wxeXnFz.exe
  2⤵
  PID:6904
- C:\Windows\System\swbhrEf.exe
  C:\Windows\System\swbhrEf.exe
  2⤵
  PID:6948
- C:\Windows\System\sYyblTs.exe
  C:\Windows\System\sYyblTs.exe
  2⤵
  PID:6992
- C:\Windows\System\SeTGwzs.exe
  C:\Windows\System\SeTGwzs.exe
  2⤵
  PID:7008
- C:\Windows\System\WKTsJmr.exe
  C:\Windows\System\WKTsJmr.exe
  2⤵
  PID:7036
- C:\Windows\System\xMWmzbh.exe
  C:\Windows\System\xMWmzbh.exe
  2⤵
  PID:7052
- C:\Windows\System\bUgaCPI.exe
  C:\Windows\System\bUgaCPI.exe
  2⤵
  PID:7076
- C:\Windows\System\LVqVzqt.exe
  C:\Windows\System\LVqVzqt.exe
  2⤵
  PID:7136
- C:\Windows\System\tdeaQCO.exe
  C:\Windows\System\tdeaQCO.exe
  2⤵
  PID:6164
- C:\Windows\System\wFaAqvC.exe
  C:\Windows\System\wFaAqvC.exe
  2⤵
  PID:7164
- C:\Windows\System\HmfycPj.exe
  C:\Windows\System\HmfycPj.exe
  2⤵
  PID:6192
- C:\Windows\System\TWvOjNq.exe
  C:\Windows\System\TWvOjNq.exe
  2⤵
  PID:6260
- C:\Windows\System\UPjRcws.exe
  C:\Windows\System\UPjRcws.exe
  2⤵
  PID:6244
- C:\Windows\System\bNHCoju.exe
  C:\Windows\System\bNHCoju.exe
  2⤵
  PID:6292
- C:\Windows\System\vZdachT.exe
  C:\Windows\System\vZdachT.exe
  2⤵
  PID:6356
- C:\Windows\System\ttnWbAv.exe
  C:\Windows\System\ttnWbAv.exe
  2⤵
  PID:6428
- C:\Windows\System\ItLSwHI.exe
  C:\Windows\System\ItLSwHI.exe
  2⤵
  PID:6480
- C:\Windows\System\NQoIQTP.exe
  C:\Windows\System\NQoIQTP.exe
  2⤵
  PID:6484
- C:\Windows\System\eHuMPCC.exe
  C:\Windows\System\eHuMPCC.exe
  2⤵
  PID:6532
- C:\Windows\System\NihRzaV.exe
  C:\Windows\System\NihRzaV.exe
  2⤵
  PID:6564
- C:\Windows\System\FGwDwwX.exe
  C:\Windows\System\FGwDwwX.exe
  2⤵
  PID:6584
- C:\Windows\System\aklhtvB.exe
  C:\Windows\System\aklhtvB.exe
  2⤵
  PID:6884
- C:\Windows\System\DqMgKwD.exe
  C:\Windows\System\DqMgKwD.exe
  2⤵
  PID:6932
- C:\Windows\System\PSFWVNB.exe
  C:\Windows\System\PSFWVNB.exe
  2⤵
  PID:7024
- C:\Windows\System\BpBmWQZ.exe
  C:\Windows\System\BpBmWQZ.exe
  2⤵
  PID:7096
- C:\Windows\System\BLujgMB.exe
  C:\Windows\System\BLujgMB.exe
  2⤵
  PID:7160
- C:\Windows\System\LbhHsAG.exe
  C:\Windows\System\LbhHsAG.exe
  2⤵
  PID:5824
- C:\Windows\System\jCiAiQs.exe
  C:\Windows\System\jCiAiQs.exe
  2⤵
  PID:6276
- C:\Windows\System\fexqkBl.exe
  C:\Windows\System\fexqkBl.exe
  2⤵
  PID:6432
- C:\Windows\System\riwnklq.exe
  C:\Windows\System\riwnklq.exe
  2⤵
  PID:6488
- C:\Windows\System\LrKknTM.exe
  C:\Windows\System\LrKknTM.exe
  2⤵
  PID:6548
- C:\Windows\System\kCGSndx.exe
  C:\Windows\System\kCGSndx.exe
  2⤵
  PID:6524
- C:\Windows\System\qIjKTZP.exe
  C:\Windows\System\qIjKTZP.exe
  2⤵
  PID:6596
- C:\Windows\System\YSUcQCx.exe
  C:\Windows\System\YSUcQCx.exe
  2⤵
  PID:6648
- C:\Windows\System\tYTTZNh.exe
  C:\Windows\System\tYTTZNh.exe
  2⤵
  PID:6720
- C:\Windows\System\IZKhIVm.exe
  C:\Windows\System\IZKhIVm.exe
  2⤵
  PID:6624
- C:\Windows\System\RJNXFkU.exe
  C:\Windows\System\RJNXFkU.exe
  2⤵
  PID:6636
- C:\Windows\System\dUpItvy.exe
  C:\Windows\System\dUpItvy.exe
  2⤵
  PID:6900
- C:\Windows\System\SvRFxDv.exe
  C:\Windows\System\SvRFxDv.exe
  2⤵
  PID:6996
- C:\Windows\System\MYRnYvo.exe
  C:\Windows\System\MYRnYvo.exe
  2⤵
  PID:7044
- C:\Windows\System\TgsUtPj.exe
  C:\Windows\System\TgsUtPj.exe
  2⤵
  PID:6964
- C:\Windows\System\BFotfSW.exe
  C:\Windows\System\BFotfSW.exe
  2⤵
  PID:7100
- C:\Windows\System\TdOfxYi.exe
  C:\Windows\System\TdOfxYi.exe
  2⤵
  PID:7080
- C:\Windows\System\wBGfyZq.exe
  C:\Windows\System\wBGfyZq.exe
  2⤵
  PID:6444
- C:\Windows\System\nsAFGbr.exe
  C:\Windows\System\nsAFGbr.exe
  2⤵
  PID:6360
- C:\Windows\System\DqSCNUM.exe
  C:\Windows\System\DqSCNUM.exe
  2⤵
  PID:6604
- C:\Windows\System\lvtYbTv.exe
  C:\Windows\System\lvtYbTv.exe
  2⤵
  PID:6632
- C:\Windows\System\InxwgUJ.exe
  C:\Windows\System\InxwgUJ.exe
  2⤵
  PID:6732
- C:\Windows\System\yOqYsVk.exe
  C:\Windows\System\yOqYsVk.exe
  2⤵
  PID:6848
- C:\Windows\System\SvPlBai.exe
  C:\Windows\System\SvPlBai.exe
  2⤵
  PID:7104
- C:\Windows\System\QRsSBfv.exe
  C:\Windows\System\QRsSBfv.exe
  2⤵
  PID:6344
- C:\Windows\System\pcbZSTi.exe
  C:\Windows\System\pcbZSTi.exe
  2⤵
  PID:6876
- C:\Windows\System\oneUwJC.exe
  C:\Windows\System\oneUwJC.exe
  2⤵
  PID:6972
- C:\Windows\System\NHXOfus.exe
  C:\Windows\System\NHXOfus.exe
  2⤵
  PID:6492
- C:\Windows\System\ToCLBDC.exe
  C:\Windows\System\ToCLBDC.exe
  2⤵
  PID:6844
- C:\Windows\System\cgIODME.exe
  C:\Windows\System\cgIODME.exe
  2⤵
  PID:6528
- C:\Windows\System\vYpLcjb.exe
  C:\Windows\System\vYpLcjb.exe
  2⤵
  PID:6772
- C:\Windows\System\lmhkqqS.exe
  C:\Windows\System\lmhkqqS.exe
  2⤵
  PID:6664
- C:\Windows\System\fiUofKI.exe
  C:\Windows\System\fiUofKI.exe
  2⤵
  PID:7116
- C:\Windows\System\UgoOHbi.exe
  C:\Windows\System\UgoOHbi.exe
  2⤵
  PID:6448
- C:\Windows\System\cakcZwF.exe
  C:\Windows\System\cakcZwF.exe
  2⤵
  PID:6880
- C:\Windows\System\fpwpqCf.exe
  C:\Windows\System\fpwpqCf.exe
  2⤵
  PID:7184
- C:\Windows\System\gDBWPjJ.exe
  C:\Windows\System\gDBWPjJ.exe
  2⤵
  PID:7200
- C:\Windows\System\vlFUpWT.exe
  C:\Windows\System\vlFUpWT.exe
  2⤵
  PID:7216
- C:\Windows\System\DERJGCY.exe
  C:\Windows\System\DERJGCY.exe
  2⤵
  PID:7232
- C:\Windows\System\vcwilOM.exe
  C:\Windows\System\vcwilOM.exe
  2⤵
  PID:7248
- C:\Windows\System\GDflcYe.exe
  C:\Windows\System\GDflcYe.exe
  2⤵
  PID:7264
- C:\Windows\System\yrBGvKL.exe
  C:\Windows\System\yrBGvKL.exe
  2⤵
  PID:7280
- C:\Windows\System\QWbMuhr.exe
  C:\Windows\System\QWbMuhr.exe
  2⤵
  PID:7300
- C:\Windows\System\eAwmvxD.exe
  C:\Windows\System\eAwmvxD.exe
  2⤵
  PID:7316
- C:\Windows\System\TLmEuQD.exe
  C:\Windows\System\TLmEuQD.exe
  2⤵
  PID:7332
- C:\Windows\System\XtOLYNz.exe
  C:\Windows\System\XtOLYNz.exe
  2⤵
  PID:7348
- C:\Windows\System\qRKomIc.exe
  C:\Windows\System\qRKomIc.exe
  2⤵
  PID:7364
- C:\Windows\System\LRnxlFi.exe
  C:\Windows\System\LRnxlFi.exe
  2⤵
  PID:7380
- C:\Windows\System\uHAehtn.exe
  C:\Windows\System\uHAehtn.exe
  2⤵
  PID:7396
- C:\Windows\System\CbnzRBz.exe
  C:\Windows\System\CbnzRBz.exe
  2⤵
  PID:7416
- C:\Windows\System\KUlnCDl.exe
  C:\Windows\System\KUlnCDl.exe
  2⤵
  PID:7432
- C:\Windows\System\GnxpgDs.exe
  C:\Windows\System\GnxpgDs.exe
  2⤵
  PID:7448
- C:\Windows\System\oFMNOIj.exe
  C:\Windows\System\oFMNOIj.exe
  2⤵
  PID:7464
- C:\Windows\System\VIaImrY.exe
  C:\Windows\System\VIaImrY.exe
  2⤵
  PID:7484
- C:\Windows\System\UCeZpnw.exe
  C:\Windows\System\UCeZpnw.exe
  2⤵
  PID:7524
- C:\Windows\System\SQroVNc.exe
  C:\Windows\System\SQroVNc.exe
  2⤵
  PID:7540
- C:\Windows\System\UJbMXqi.exe
  C:\Windows\System\UJbMXqi.exe
  2⤵
  PID:7556
- C:\Windows\System\AmwImZF.exe
  C:\Windows\System\AmwImZF.exe
  2⤵
  PID:7576
- C:\Windows\System\LlBZUXl.exe
  C:\Windows\System\LlBZUXl.exe
  2⤵
  PID:7592
- C:\Windows\System\XdgMvBN.exe
  C:\Windows\System\XdgMvBN.exe
  2⤵
  PID:7608
- C:\Windows\System\wZERSRv.exe
  C:\Windows\System\wZERSRv.exe
  2⤵
  PID:7624
- C:\Windows\System\GlIBXch.exe
  C:\Windows\System\GlIBXch.exe
  2⤵
  PID:7640
- C:\Windows\System\TYvzrGz.exe
  C:\Windows\System\TYvzrGz.exe
  2⤵
  PID:7656
- C:\Windows\System\pqnuueh.exe
  C:\Windows\System\pqnuueh.exe
  2⤵
  PID:7676
- C:\Windows\System\cCfdFNr.exe
  C:\Windows\System\cCfdFNr.exe
  2⤵
  PID:7692
- C:\Windows\System\kYJcdIG.exe
  C:\Windows\System\kYJcdIG.exe
  2⤵
  PID:7708
- C:\Windows\System\uTRsiax.exe
  C:\Windows\System\uTRsiax.exe
  2⤵
  PID:7724
- C:\Windows\System\FPyMlAB.exe
  C:\Windows\System\FPyMlAB.exe
  2⤵
  PID:7740
- C:\Windows\System\YRzxIUz.exe
  C:\Windows\System\YRzxIUz.exe
  2⤵
  PID:7756
- C:\Windows\System\AlBnkMU.exe
  C:\Windows\System\AlBnkMU.exe
  2⤵
  PID:7772
- C:\Windows\System\gGeBiNM.exe
  C:\Windows\System\gGeBiNM.exe
  2⤵
  PID:7788
- C:\Windows\System\tvKAnfJ.exe
  C:\Windows\System\tvKAnfJ.exe
  2⤵
  PID:7804
- C:\Windows\System\PPgmBnt.exe
  C:\Windows\System\PPgmBnt.exe
  2⤵
  PID:7824
- C:\Windows\System\prVBpqI.exe
  C:\Windows\System\prVBpqI.exe
  2⤵
  PID:7840
- C:\Windows\System\NmJzBdX.exe
  C:\Windows\System\NmJzBdX.exe
  2⤵
  PID:7856
- C:\Windows\System\kyxFAMn.exe
  C:\Windows\System\kyxFAMn.exe
  2⤵
  PID:7872
- C:\Windows\System\GvVXDet.exe
  C:\Windows\System\GvVXDet.exe
  2⤵
  PID:7888
- C:\Windows\System\coWHqTk.exe
  C:\Windows\System\coWHqTk.exe
  2⤵
  PID:7904
- C:\Windows\System\VVNllfj.exe
  C:\Windows\System\VVNllfj.exe
  2⤵
  PID:7920
- C:\Windows\System\XEMfawf.exe
  C:\Windows\System\XEMfawf.exe
  2⤵
  PID:7936
- C:\Windows\System\QMNQVtZ.exe
  C:\Windows\System\QMNQVtZ.exe
  2⤵
  PID:7952
- C:\Windows\System\alKRcwA.exe
  C:\Windows\System\alKRcwA.exe
  2⤵
  PID:7968
- C:\Windows\System\dUPJdsG.exe
  C:\Windows\System\dUPJdsG.exe
  2⤵
  PID:7984
- C:\Windows\System\GPlfplf.exe
  C:\Windows\System\GPlfplf.exe
  2⤵
  PID:8000
- C:\Windows\System\QKoglJH.exe
  C:\Windows\System\QKoglJH.exe
  2⤵
  PID:8016
- C:\Windows\System\lEuqmyI.exe
  C:\Windows\System\lEuqmyI.exe
  2⤵
  PID:8032
- C:\Windows\System\JSJUuFs.exe
  C:\Windows\System\JSJUuFs.exe
  2⤵
  PID:8048
- C:\Windows\System\EDPssui.exe
  C:\Windows\System\EDPssui.exe
  2⤵
  PID:8064
- C:\Windows\System\VHNsCgs.exe
  C:\Windows\System\VHNsCgs.exe
  2⤵
  PID:8080
- C:\Windows\System\ktwzHYR.exe
  C:\Windows\System\ktwzHYR.exe
  2⤵
  PID:8096
- C:\Windows\System\gMKzHCM.exe
  C:\Windows\System\gMKzHCM.exe
  2⤵
  PID:8136
- C:\Windows\System\cqYpRoo.exe
  C:\Windows\System\cqYpRoo.exe
  2⤵
  PID:8156
- C:\Windows\System\tEYMfOs.exe
  C:\Windows\System\tEYMfOs.exe
  2⤵
  PID:8184
- C:\Windows\System\rLFoKjW.exe
  C:\Windows\System\rLFoKjW.exe
  2⤵
  PID:7244
- C:\Windows\System\iwQHoDo.exe
  C:\Windows\System\iwQHoDo.exe
  2⤵
  PID:7340
- C:\Windows\System\oLyIogD.exe
  C:\Windows\System\oLyIogD.exe
  2⤵
  PID:7412
- C:\Windows\System\qnRrbKN.exe
  C:\Windows\System\qnRrbKN.exe
  2⤵
  PID:7428
- C:\Windows\System\MRzEOft.exe
  C:\Windows\System\MRzEOft.exe
  2⤵
  PID:7192
- C:\Windows\System\uXEsoSH.exe
  C:\Windows\System\uXEsoSH.exe
  2⤵
  PID:7292
- C:\Windows\System\pWycICw.exe
  C:\Windows\System\pWycICw.exe
  2⤵
  PID:7356
- C:\Windows\System\wkhssko.exe
  C:\Windows\System\wkhssko.exe
  2⤵
  PID:7456
- C:\Windows\System\NmLqCgu.exe
  C:\Windows\System\NmLqCgu.exe
  2⤵
  PID:7492
- C:\Windows\System\pMClROi.exe
  C:\Windows\System\pMClROi.exe
  2⤵
  PID:7496
- C:\Windows\System\xmbCqkP.exe
  C:\Windows\System\xmbCqkP.exe
  2⤵
  PID:7564
- C:\Windows\System\seOLRCy.exe
  C:\Windows\System\seOLRCy.exe
  2⤵
  PID:7600
- C:\Windows\System\BhuutVE.exe
  C:\Windows\System\BhuutVE.exe
  2⤵
  PID:7664
- C:\Windows\System\qdBYRRF.exe
  C:\Windows\System\qdBYRRF.exe
  2⤵
  PID:7700
- C:\Windows\System\XlfbFdc.exe
  C:\Windows\System\XlfbFdc.exe
  2⤵
  PID:7616
- C:\Windows\System\IYXRCJE.exe
  C:\Windows\System\IYXRCJE.exe
  2⤵
  PID:7652
- C:\Windows\System\SFgkQWF.exe
  C:\Windows\System\SFgkQWF.exe
  2⤵
  PID:7720
- C:\Windows\System\xDJRzZO.exe
  C:\Windows\System\xDJRzZO.exe
  2⤵
  PID:7784
- C:\Windows\System\tDbsDro.exe
  C:\Windows\System\tDbsDro.exe
  2⤵
  PID:7900
- C:\Windows\System\hTNMEBa.exe
  C:\Windows\System\hTNMEBa.exe
  2⤵
  PID:7964
- C:\Windows\System\AiTKXsB.exe
  C:\Windows\System\AiTKXsB.exe
  2⤵
  PID:7912
- C:\Windows\System\kUFxecJ.exe
  C:\Windows\System\kUFxecJ.exe
  2⤵
  PID:8028
- C:\Windows\System\VENwVAQ.exe
  C:\Windows\System\VENwVAQ.exe
  2⤵
  PID:7852
- C:\Windows\System\DCzPAKj.exe
  C:\Windows\System\DCzPAKj.exe
  2⤵
  PID:7944
- C:\Windows\System\FXGmrHD.exe
  C:\Windows\System\FXGmrHD.exe
  2⤵
  PID:8088
- C:\Windows\System\LFpjXih.exe
  C:\Windows\System\LFpjXih.exe
  2⤵
  PID:8104
- C:\Windows\System\VBUaLnX.exe
  C:\Windows\System\VBUaLnX.exe
  2⤵
  PID:8144
- C:\Windows\System\pHxsGEk.exe
  C:\Windows\System\pHxsGEk.exe
  2⤵
  PID:8164
- C:\Windows\System\kIHahry.exe
  C:\Windows\System\kIHahry.exe
  2⤵
  PID:7208
- C:\Windows\System\BMDIhvb.exe
  C:\Windows\System\BMDIhvb.exe
  2⤵
  PID:7404
- C:\Windows\System\YtrYIKZ.exe
  C:\Windows\System\YtrYIKZ.exe
  2⤵
  PID:6580
- C:\Windows\System\nRoBbGc.exe
  C:\Windows\System\nRoBbGc.exe
  2⤵
  PID:7328
- C:\Windows\System\sUpNIAp.exe
  C:\Windows\System\sUpNIAp.exe
  2⤵
  PID:7736
- C:\Windows\System\XBPXdkW.exe
  C:\Windows\System\XBPXdkW.exe
  2⤵
  PID:7508
- C:\Windows\System\vSEPXnW.exe
  C:\Windows\System\vSEPXnW.exe
  2⤵
  PID:8180
- C:\Windows\System\txjsZwS.exe
  C:\Windows\System\txjsZwS.exe
  2⤵
  PID:7444
- C:\Windows\System\YXYzZdW.exe
  C:\Windows\System\YXYzZdW.exe
  2⤵
  PID:2624
- C:\Windows\System\VYyeqZt.exe
  C:\Windows\System\VYyeqZt.exe
  2⤵
  PID:7868
- C:\Windows\System\fLlucRT.exe
  C:\Windows\System\fLlucRT.exe
  2⤵
  PID:7276
- C:\Windows\System\zFCoqVM.exe
  C:\Windows\System\zFCoqVM.exe
  2⤵
  PID:7780
- C:\Windows\System\rgpQjVP.exe
  C:\Windows\System\rgpQjVP.exe
  2⤵
  PID:7980
- C:\Windows\System\htLepxb.exe
  C:\Windows\System\htLepxb.exe
  2⤵
  PID:6376
- C:\Windows\System\LZnjrOK.exe
  C:\Windows\System\LZnjrOK.exe
  2⤵
  PID:8060
- C:\Windows\System\FSnjXuT.exe
  C:\Windows\System\FSnjXuT.exe
  2⤵
  PID:7180
- C:\Windows\System\lOIIpuX.exe
  C:\Windows\System\lOIIpuX.exe
  2⤵
  PID:8044
- C:\Windows\System\Krtrnsd.exe
  C:\Windows\System\Krtrnsd.exe
  2⤵
  PID:7324
- C:\Windows\System\usLalDA.exe
  C:\Windows\System\usLalDA.exe
  2⤵
  PID:8172
- C:\Windows\System\pRcrVxU.exe
  C:\Windows\System\pRcrVxU.exe
  2⤵
  PID:8132
- C:\Windows\System\zUIPKkb.exe
  C:\Windows\System\zUIPKkb.exe
  2⤵
  PID:8168
- C:\Windows\System\BXmhICY.exe
  C:\Windows\System\BXmhICY.exe
  2⤵
  PID:7572
- C:\Windows\System\csDUpOu.exe
  C:\Windows\System\csDUpOu.exe
  2⤵
  PID:7228
- C:\Windows\System\pmQeMQE.exe
  C:\Windows\System\pmQeMQE.exe
  2⤵
  PID:7588
- C:\Windows\System\GPmSHQH.exe
  C:\Windows\System\GPmSHQH.exe
  2⤵
  PID:7716
- C:\Windows\System\fHnBaKT.exe
  C:\Windows\System\fHnBaKT.exe
  2⤵
  PID:7752
- C:\Windows\System\dpRpwTV.exe
  C:\Windows\System\dpRpwTV.exe
  2⤵
  PID:7948
- C:\Windows\System\uGnjsbs.exe
  C:\Windows\System\uGnjsbs.exe
  2⤵
  PID:8128
- C:\Windows\System\fhNJppf.exe
  C:\Windows\System\fhNJppf.exe
  2⤵
  PID:8076
- C:\Windows\System\iUnwpMO.exe
  C:\Windows\System\iUnwpMO.exe
  2⤵
  PID:7880
- C:\Windows\System\UBiegiU.exe
  C:\Windows\System\UBiegiU.exe
  2⤵
  PID:7372
- C:\Windows\System\SlPCOTx.exe
  C:\Windows\System\SlPCOTx.exe
  2⤵
  PID:7504
- C:\Windows\System\OTJlowo.exe
  C:\Windows\System\OTJlowo.exe
  2⤵
  PID:7224
- C:\Windows\System\cBiqLCd.exe
  C:\Windows\System\cBiqLCd.exe
  2⤵
  PID:7996
- C:\Windows\System\XoCBFbE.exe
  C:\Windows\System\XoCBFbE.exe
  2⤵
  PID:7884
- C:\Windows\System\xRwPBJn.exe
  C:\Windows\System\xRwPBJn.exe
  2⤵
  PID:7548
- C:\Windows\System\ytKygNP.exe
  C:\Windows\System\ytKygNP.exe
  2⤵
  PID:8212
- C:\Windows\System\riuCLyh.exe
  C:\Windows\System\riuCLyh.exe
  2⤵
  PID:8232
- C:\Windows\System\WWSSBAk.exe
  C:\Windows\System\WWSSBAk.exe
  2⤵
  PID:8248
- C:\Windows\System\VDHNKPk.exe
  C:\Windows\System\VDHNKPk.exe
  2⤵
  PID:8264
- C:\Windows\System\bnBwZER.exe
  C:\Windows\System\bnBwZER.exe
  2⤵
  PID:8280
- C:\Windows\System\xEqtQaY.exe
  C:\Windows\System\xEqtQaY.exe
  2⤵
  PID:8296
- C:\Windows\System\LyGEdDE.exe
  C:\Windows\System\LyGEdDE.exe
  2⤵
  PID:8312
- C:\Windows\System\ObrheRV.exe
  C:\Windows\System\ObrheRV.exe
  2⤵
  PID:8328
- C:\Windows\System\DGiMkjv.exe
  C:\Windows\System\DGiMkjv.exe
  2⤵
  PID:8344
- C:\Windows\System\cbrAAem.exe
  C:\Windows\System\cbrAAem.exe
  2⤵
  PID:8360
- C:\Windows\System\VZiMgyG.exe
  C:\Windows\System\VZiMgyG.exe
  2⤵
  PID:8376
- C:\Windows\System\iJFaUCO.exe
  C:\Windows\System\iJFaUCO.exe
  2⤵
  PID:8392
- C:\Windows\System\WVigEzh.exe
  C:\Windows\System\WVigEzh.exe
  2⤵
  PID:8408
- C:\Windows\System\sUABiXL.exe
  C:\Windows\System\sUABiXL.exe
  2⤵
  PID:8424
- C:\Windows\System\fdIxZXE.exe
  C:\Windows\System\fdIxZXE.exe
  2⤵
  PID:8444
- C:\Windows\System\EactSyF.exe
  C:\Windows\System\EactSyF.exe
  2⤵
  PID:8460
- C:\Windows\System\uICzNle.exe
  C:\Windows\System\uICzNle.exe
  2⤵
  PID:8476
- C:\Windows\System\lanIMXS.exe
  C:\Windows\System\lanIMXS.exe
  2⤵
  PID:8492
- C:\Windows\System\JKGCOto.exe
  C:\Windows\System\JKGCOto.exe
  2⤵
  PID:8508
- C:\Windows\System\IsnWFns.exe
  C:\Windows\System\IsnWFns.exe
  2⤵
  PID:8524
- C:\Windows\System\rLWoWzp.exe
  C:\Windows\System\rLWoWzp.exe
  2⤵
  PID:8540
- C:\Windows\System\mLexcno.exe
  C:\Windows\System\mLexcno.exe
  2⤵
  PID:8556
- C:\Windows\System\claNlvg.exe
  C:\Windows\System\claNlvg.exe
  2⤵
  PID:8572
- C:\Windows\System\fiUXnQZ.exe
  C:\Windows\System\fiUXnQZ.exe
  2⤵
  PID:8588
- C:\Windows\System\RlTdRNN.exe
  C:\Windows\System\RlTdRNN.exe
  2⤵
  PID:8604
- C:\Windows\System\HGDHWRc.exe
  C:\Windows\System\HGDHWRc.exe
  2⤵
  PID:8620
- C:\Windows\System\DgBzMwz.exe
  C:\Windows\System\DgBzMwz.exe
  2⤵
  PID:8636
- C:\Windows\System\yVcBTjS.exe
  C:\Windows\System\yVcBTjS.exe
  2⤵
  PID:8652
- C:\Windows\System\uzNnnJw.exe
  C:\Windows\System\uzNnnJw.exe
  2⤵
  PID:8668
- C:\Windows\System\LLfkBqQ.exe
  C:\Windows\System\LLfkBqQ.exe
  2⤵
  PID:8684
- C:\Windows\System\EBoBbIg.exe
  C:\Windows\System\EBoBbIg.exe
  2⤵
  PID:8700
- C:\Windows\System\ADiDjum.exe
  C:\Windows\System\ADiDjum.exe
  2⤵
  PID:8716
- C:\Windows\System\HyziLWn.exe
  C:\Windows\System\HyziLWn.exe
  2⤵
  PID:8732
- C:\Windows\System\WzTVOdy.exe
  C:\Windows\System\WzTVOdy.exe
  2⤵
  PID:8748
- C:\Windows\System\vDYaxEt.exe
  C:\Windows\System\vDYaxEt.exe
  2⤵
  PID:8764
- C:\Windows\System\OnUXnsJ.exe
  C:\Windows\System\OnUXnsJ.exe
  2⤵
  PID:8780
- C:\Windows\System\CEJBgoH.exe
  C:\Windows\System\CEJBgoH.exe
  2⤵
  PID:8800
- C:\Windows\System\oBIybZU.exe
  C:\Windows\System\oBIybZU.exe
  2⤵
  PID:8820
- C:\Windows\System\JflAdQF.exe
  C:\Windows\System\JflAdQF.exe
  2⤵
  PID:8848
- C:\Windows\System\tvNOfqx.exe
  C:\Windows\System\tvNOfqx.exe
  2⤵
  PID:8864
- C:\Windows\System\kyTPQrg.exe
  C:\Windows\System\kyTPQrg.exe
  2⤵
  PID:8880
- C:\Windows\System\IefWAZz.exe
  C:\Windows\System\IefWAZz.exe
  2⤵
  PID:8900
- C:\Windows\System\EFAdaGg.exe
  C:\Windows\System\EFAdaGg.exe
  2⤵
  PID:8916
- C:\Windows\System\vwggAqB.exe
  C:\Windows\System\vwggAqB.exe
  2⤵
  PID:8932
- C:\Windows\System\zzydKCv.exe
  C:\Windows\System\zzydKCv.exe
  2⤵
  PID:8948
- C:\Windows\System\aorkHFv.exe
  C:\Windows\System\aorkHFv.exe
  2⤵
  PID:8976
- C:\Windows\System\diOrBEn.exe
  C:\Windows\System\diOrBEn.exe
  2⤵
  PID:8996
- C:\Windows\System\qoiKUEg.exe
  C:\Windows\System\qoiKUEg.exe
  2⤵
  PID:9020
- C:\Windows\System\bbrAQEd.exe
  C:\Windows\System\bbrAQEd.exe
  2⤵
  PID:9044
- C:\Windows\System\njhUvGr.exe
  C:\Windows\System\njhUvGr.exe
  2⤵
  PID:9064
- C:\Windows\System\PeqXwgh.exe
  C:\Windows\System\PeqXwgh.exe
  2⤵
  PID:9084
- C:\Windows\System\icKcwNB.exe
  C:\Windows\System\icKcwNB.exe
  2⤵
  PID:9100
- C:\Windows\System\VqsFBmv.exe
  C:\Windows\System\VqsFBmv.exe
  2⤵
  PID:9116
- C:\Windows\System\pzZzJhk.exe
  C:\Windows\System\pzZzJhk.exe
  2⤵
  PID:9132
- C:\Windows\System\YKGbZHa.exe
  C:\Windows\System\YKGbZHa.exe
  2⤵
  PID:9148
- C:\Windows\System\qcYlSlr.exe
  C:\Windows\System\qcYlSlr.exe
  2⤵
  PID:9164
- C:\Windows\System\pZEszuV.exe
  C:\Windows\System\pZEszuV.exe
  2⤵
  PID:9184
- C:\Windows\System\FjsVjzp.exe
  C:\Windows\System\FjsVjzp.exe
  2⤵
  PID:9200
- C:\Windows\System\iFYCAhm.exe
  C:\Windows\System\iFYCAhm.exe
  2⤵
  PID:7480
- C:\Windows\System\AfDVQnQ.exe
  C:\Windows\System\AfDVQnQ.exe
  2⤵
  PID:8208
- C:\Windows\System\ZwURkEZ.exe
  C:\Windows\System\ZwURkEZ.exe
  2⤵
  PID:8276
- C:\Windows\System\EucPWvG.exe
  C:\Windows\System\EucPWvG.exe
  2⤵
  PID:8340
- C:\Windows\System\pyFenUm.exe
  C:\Windows\System\pyFenUm.exe
  2⤵
  PID:7388
- C:\Windows\System\sbAxMvX.exe
  C:\Windows\System\sbAxMvX.exe
  2⤵
  PID:8260
- C:\Windows\System\NLBhEvH.exe
  C:\Windows\System\NLBhEvH.exe
  2⤵
  PID:7916
- C:\Windows\System\rlbXGVb.exe
  C:\Windows\System\rlbXGVb.exe
  2⤵
  PID:7636
- C:\Windows\System\RSJbrJv.exe
  C:\Windows\System\RSJbrJv.exe
  2⤵
  PID:2628
- C:\Windows\System\EvaJvqC.exe
  C:\Windows\System\EvaJvqC.exe
  2⤵
  PID:8224
- C:\Windows\System\kbaXhrP.exe
  C:\Windows\System\kbaXhrP.exe
  2⤵
  PID:8416
- C:\Windows\System\ckwbrnc.exe
  C:\Windows\System\ckwbrnc.exe
  2⤵
  PID:8324
- C:\Windows\System\NuadLya.exe
  C:\Windows\System\NuadLya.exe
  2⤵
  PID:8504
- C:\Windows\System\zIGEjdf.exe
  C:\Windows\System\zIGEjdf.exe
  2⤵
  PID:8536
- C:\Windows\System\lThaEds.exe
  C:\Windows\System\lThaEds.exe
  2⤵
  PID:8520
- C:\Windows\System\ujfRbOa.exe
  C:\Windows\System\ujfRbOa.exe
  2⤵
  PID:8580
- C:\Windows\System\eaUpqzf.exe
  C:\Windows\System\eaUpqzf.exe
  2⤵
  PID:8628
- C:\Windows\System\Rjqlujx.exe
  C:\Windows\System\Rjqlujx.exe
  2⤵
  PID:8660
- C:\Windows\System\dDmkvJQ.exe
  C:\Windows\System\dDmkvJQ.exe
  2⤵
  PID:8680
- C:\Windows\System\rLYaqqU.exe
  C:\Windows\System\rLYaqqU.exe
  2⤵
  PID:8708
- C:\Windows\System\YtVLYer.exe
  C:\Windows\System\YtVLYer.exe
  2⤵
  PID:8756
- C:\Windows\System\CeEDGOg.exe
  C:\Windows\System\CeEDGOg.exe
  2⤵
  PID:8792
- C:\Windows\System\yXGSMxC.exe
  C:\Windows\System\yXGSMxC.exe
  2⤵
  PID:8828
- C:\Windows\System\AXwCCLT.exe
  C:\Windows\System\AXwCCLT.exe
  2⤵
  PID:8816
- C:\Windows\System\rHQadPs.exe
  C:\Windows\System\rHQadPs.exe
  2⤵
  PID:8872
- C:\Windows\System\DkrFoix.exe
  C:\Windows\System\DkrFoix.exe
  2⤵
  PID:8908
- C:\Windows\System\UFANASO.exe
  C:\Windows\System\UFANASO.exe
  2⤵
  PID:8940
- C:\Windows\System\ICAAlQG.exe
  C:\Windows\System\ICAAlQG.exe
  2⤵
  PID:8984
- C:\Windows\System\bKbRTfm.exe
  C:\Windows\System\bKbRTfm.exe
  2⤵
  PID:9036
- C:\Windows\System\CexCmNQ.exe
  C:\Windows\System\CexCmNQ.exe
  2⤵
  PID:9140
- C:\Windows\System\RQtNORj.exe
  C:\Windows\System\RQtNORj.exe
  2⤵
  PID:9176
- C:\Windows\System\NknOQgX.exe
  C:\Windows\System\NknOQgX.exe
  2⤵
  PID:8956
- C:\Windows\System\OUoCmWc.exe
  C:\Windows\System\OUoCmWc.exe
  2⤵
  PID:9016
- C:\Windows\System\vyMDmEj.exe
  C:\Windows\System\vyMDmEj.exe
  2⤵
  PID:9212
- C:\Windows\System\LsOCOHb.exe
  C:\Windows\System\LsOCOHb.exe
  2⤵
  PID:8244
- C:\Windows\System\SpHVfSD.exe
  C:\Windows\System\SpHVfSD.exe
  2⤵
  PID:9156
- C:\Windows\System\BZCecne.exe
  C:\Windows\System\BZCecne.exe
  2⤵
  PID:9160
- C:\Windows\System\seYAPLV.exe
  C:\Windows\System\seYAPLV.exe
  2⤵
  PID:8400
- C:\Windows\System\OEyzYlZ.exe
  C:\Windows\System\OEyzYlZ.exe
  2⤵
  PID:8440
- C:\Windows\System\GQypwqv.exe
  C:\Windows\System\GQypwqv.exe
  2⤵
  PID:8288
- C:\Windows\System\unigLIs.exe
  C:\Windows\System\unigLIs.exe
  2⤵
  PID:7196
- C:\Windows\System\TpeDSSb.exe
  C:\Windows\System\TpeDSSb.exe
  2⤵
  PID:8488
- C:\Windows\System\WjeZYEZ.exe
  C:\Windows\System\WjeZYEZ.exe
  2⤵
  PID:8320
- C:\Windows\System\DZvdbPi.exe
  C:\Windows\System\DZvdbPi.exe
  2⤵
  PID:8648
- C:\Windows\System\PjGvBAJ.exe
  C:\Windows\System\PjGvBAJ.exe
  2⤵
  PID:8812
- C:\Windows\System\EuqzNSL.exe
  C:\Windows\System\EuqzNSL.exe
  2⤵
  PID:8696
- C:\Windows\System\kAdOgfs.exe
  C:\Windows\System\kAdOgfs.exe
  2⤵
  PID:8788
- C:\Windows\System\VpLJgRE.exe
  C:\Windows\System\VpLJgRE.exe
  2⤵
  PID:8896
- C:\Windows\System\LPrdShL.exe
  C:\Windows\System\LPrdShL.exe
  2⤵
  PID:8992
- C:\Windows\System\KSxGmBN.exe
  C:\Windows\System\KSxGmBN.exe
  2⤵
  PID:8968
- C:\Windows\System\DSThTul.exe
  C:\Windows\System\DSThTul.exe
  2⤵
  PID:9072
- C:\Windows\System\OUViCzP.exe
  C:\Windows\System\OUViCzP.exe
  2⤵
  PID:9056
- C:\Windows\System\MwamSta.exe
  C:\Windows\System\MwamSta.exe
  2⤵
  PID:9008
- C:\Windows\System\sZkwiyx.exe
  C:\Windows\System\sZkwiyx.exe
  2⤵
  PID:8372
- C:\Windows\System\DdsNtBX.exe
  C:\Windows\System\DdsNtBX.exe
  2⤵
  PID:8120
- C:\Windows\System\flIFLgm.exe
  C:\Windows\System\flIFLgm.exe
  2⤵
  PID:7392
- C:\Windows\System\oGfondO.exe
  C:\Windows\System\oGfondO.exe
  2⤵
  PID:8336
- C:\Windows\System\gCgLOXm.exe
  C:\Windows\System\gCgLOXm.exe
  2⤵
  PID:8220
- C:\Windows\System\NvBjkpJ.exe
  C:\Windows\System\NvBjkpJ.exe
  2⤵
  PID:8596
- C:\Windows\System\TCLJzCb.exe
  C:\Windows\System\TCLJzCb.exe
  2⤵
  PID:8612
- C:\Windows\System\TbVXgMe.exe
  C:\Windows\System\TbVXgMe.exe
  2⤵
  PID:8924
- C:\Windows\System\EIQNpWO.exe
  C:\Windows\System\EIQNpWO.exe
  2⤵
  PID:9028
- C:\Windows\System\gBhUrIm.exe
  C:\Windows\System\gBhUrIm.exe
  2⤵
  PID:9032
- C:\Windows\System\zgwupZF.exe
  C:\Windows\System\zgwupZF.exe
  2⤵
  PID:9128
- C:\Windows\System\TWdZXca.exe
  C:\Windows\System\TWdZXca.exe
  2⤵
  PID:9012
- C:\Windows\System\hgbFAYi.exe
  C:\Windows\System\hgbFAYi.exe
  2⤵
  PID:8472
- C:\Windows\System\XCfHZMO.exe
  C:\Windows\System\XCfHZMO.exe
  2⤵
  PID:8600
- C:\Windows\System\NifDLaZ.exe
  C:\Windows\System\NifDLaZ.exe
  2⤵
  PID:8876
- C:\Windows\System\oLWELij.exe
  C:\Windows\System\oLWELij.exe
  2⤵
  PID:8856
- C:\Windows\System\kTDBitZ.exe
  C:\Windows\System\kTDBitZ.exe
  2⤵
  PID:9092
- C:\Windows\System\IZQUKsy.exe
  C:\Windows\System\IZQUKsy.exe
  2⤵
  PID:8796
- C:\Windows\System\gaszGcz.exe
  C:\Windows\System\gaszGcz.exe
  2⤵
  PID:9228
- C:\Windows\System\qIoKxlv.exe
  C:\Windows\System\qIoKxlv.exe
  2⤵
  PID:9244
- C:\Windows\System\brfBWLM.exe
  C:\Windows\System\brfBWLM.exe
  2⤵
  PID:9260
- C:\Windows\System\HQWsJLF.exe
  C:\Windows\System\HQWsJLF.exe
  2⤵
  PID:9276
- C:\Windows\System\IkgNIFM.exe
  C:\Windows\System\IkgNIFM.exe
  2⤵
  PID:9292
- C:\Windows\System\PmUOsbN.exe
  C:\Windows\System\PmUOsbN.exe
  2⤵
  PID:9308
- C:\Windows\System\VOnaRqu.exe
  C:\Windows\System\VOnaRqu.exe
  2⤵
  PID:9324
- C:\Windows\System\PmTKTYk.exe
  C:\Windows\System\PmTKTYk.exe
  2⤵
  PID:9340
- C:\Windows\System\CgahXGn.exe
  C:\Windows\System\CgahXGn.exe
  2⤵
  PID:9376
- C:\Windows\System\uYxtoUl.exe
  C:\Windows\System\uYxtoUl.exe
  2⤵
  PID:9676
- C:\Windows\System\ztUxFqE.exe
  C:\Windows\System\ztUxFqE.exe
  2⤵
  PID:10000
- C:\Windows\System\SnYzGqA.exe
  C:\Windows\System\SnYzGqA.exe
  2⤵
  PID:10032
- C:\Windows\System\VxhErwE.exe
  C:\Windows\System\VxhErwE.exe
  2⤵
  PID:10064
- C:\Windows\System\VkABcDl.exe
  C:\Windows\System\VkABcDl.exe
  2⤵
  PID:9300
- C:\Windows\System\uIyYvic.exe
  C:\Windows\System\uIyYvic.exe
  2⤵
  PID:9256
- C:\Windows\System\SinpePd.exe
  C:\Windows\System\SinpePd.exe
  2⤵
  PID:9316
- C:\Windows\System\lRdjXwo.exe
  C:\Windows\System\lRdjXwo.exe
  2⤵
  PID:9356
- C:\Windows\System\fZRlNkt.exe
  C:\Windows\System\fZRlNkt.exe
  2⤵
  PID:9388
- C:\Windows\System\HvkcKAd.exe
  C:\Windows\System\HvkcKAd.exe
  2⤵
  PID:9404
- C:\Windows\System\QZhEHwA.exe
  C:\Windows\System\QZhEHwA.exe
  2⤵
  PID:9428
- C:\Windows\System\WxnhnGj.exe
  C:\Windows\System\WxnhnGj.exe
  2⤵
  PID:9452
- C:\Windows\System\rjXrrCg.exe
  C:\Windows\System\rjXrrCg.exe
  2⤵
  PID:9476
- C:\Windows\System\LVNrgjx.exe
  C:\Windows\System\LVNrgjx.exe
  2⤵
  PID:9496
- C:\Windows\System\JpoGSmM.exe
  C:\Windows\System\JpoGSmM.exe
  2⤵
  PID:9512
- C:\Windows\System\KwnIyaM.exe
  C:\Windows\System\KwnIyaM.exe
  2⤵
  PID:9528
- C:\Windows\System\QarBAym.exe
  C:\Windows\System\QarBAym.exe
  2⤵
  PID:9576
- C:\Windows\System\prFZHDb.exe
  C:\Windows\System\prFZHDb.exe
  2⤵
  PID:9580
- C:\Windows\System\lDLkpxb.exe
  C:\Windows\System\lDLkpxb.exe
  2⤵
  PID:9600
- C:\Windows\System\ALAmPzu.exe
  C:\Windows\System\ALAmPzu.exe
  2⤵
  PID:9616
- C:\Windows\System\nYFMvgL.exe
  C:\Windows\System\nYFMvgL.exe
  2⤵
  PID:9632
- C:\Windows\System\VvUQUOB.exe
  C:\Windows\System\VvUQUOB.exe
  2⤵
  PID:9648
- C:\Windows\System\dVXVPHG.exe
  C:\Windows\System\dVXVPHG.exe
  2⤵
  PID:9672
- C:\Windows\System\JRQgpaJ.exe
  C:\Windows\System\JRQgpaJ.exe
  2⤵
  PID:9704
- C:\Windows\System\OYwNSAF.exe
  C:\Windows\System\OYwNSAF.exe
  2⤵
  PID:9724
- C:\Windows\System\oKRwEBc.exe
  C:\Windows\System\oKRwEBc.exe
  2⤵
  PID:9748
- C:\Windows\System\MXCsojk.exe
  C:\Windows\System\MXCsojk.exe
  2⤵
  PID:9768
- C:\Windows\System\idzSxGL.exe
  C:\Windows\System\idzSxGL.exe
  2⤵
  PID:9788
- C:\Windows\System\VPUPLtB.exe
  C:\Windows\System\VPUPLtB.exe
  2⤵
  PID:9800
- C:\Windows\System\OnXWbSv.exe
  C:\Windows\System\OnXWbSv.exe
  2⤵
  PID:9824
- C:\Windows\System\sWBxJNk.exe
  C:\Windows\System\sWBxJNk.exe
  2⤵
  PID:9832
- C:\Windows\System\QRyKfwW.exe
  C:\Windows\System\QRyKfwW.exe
  2⤵
  PID:9856
- C:\Windows\System\geqMGkk.exe
  C:\Windows\System\geqMGkk.exe
  2⤵
  PID:9880
- C:\Windows\System\MUXEDFx.exe
  C:\Windows\System\MUXEDFx.exe
  2⤵
  PID:9900
- C:\Windows\System\lWfTINr.exe
  C:\Windows\System\lWfTINr.exe
  2⤵
  PID:9920
- C:\Windows\System\rslwmnz.exe
  C:\Windows\System\rslwmnz.exe
  2⤵
  PID:9944
- C:\Windows\System\XNTZitw.exe
  C:\Windows\System\XNTZitw.exe
  2⤵
  PID:9992
- C:\Windows\System\FrMcRPM.exe
  C:\Windows\System\FrMcRPM.exe
  2⤵
  PID:9972
- C:\Windows\System\LsJnbXA.exe
  C:\Windows\System\LsJnbXA.exe
  2⤵
  PID:9996
- C:\Windows\System\dAOBzDm.exe
  C:\Windows\System\dAOBzDm.exe
  2⤵
  PID:1784
- C:\Windows\System\nXgRCuw.exe
  C:\Windows\System\nXgRCuw.exe
  2⤵
  PID:10072
- C:\Windows\System\BXPLLHS.exe
  C:\Windows\System\BXPLLHS.exe
  2⤵
  PID:10088
- C:\Windows\System\sOegHDf.exe
  C:\Windows\System\sOegHDf.exe
  2⤵
  PID:10108
- C:\Windows\System\tkroeBu.exe
  C:\Windows\System\tkroeBu.exe
  2⤵
  PID:10132
- C:\Windows\System\iLQqxPV.exe
  C:\Windows\System\iLQqxPV.exe
  2⤵
  PID:10152
- C:\Windows\System\wtsQgnH.exe
  C:\Windows\System\wtsQgnH.exe
  2⤵
  PID:10180
- C:\Windows\System\CUbdRcD.exe
  C:\Windows\System\CUbdRcD.exe
  2⤵
  PID:10196
- C:\Windows\System\eLwlofr.exe
  C:\Windows\System\eLwlofr.exe
  2⤵
  PID:10208
- C:\Windows\System\hAqePvT.exe
  C:\Windows\System\hAqePvT.exe
  2⤵
  PID:10232
- C:\Windows\System\zMpSicQ.exe
  C:\Windows\System\zMpSicQ.exe
  2⤵
  PID:8256
- C:\Windows\System\iRZgOXh.exe
  C:\Windows\System\iRZgOXh.exe
  2⤵
  PID:8200
- C:\Windows\System\pqHxmej.exe
  C:\Windows\System\pqHxmej.exe
  2⤵
  PID:8772
- C:\Windows\System\kIriVOA.exe
  C:\Windows\System\kIriVOA.exe
  2⤵
  PID:9268
- C:\Windows\System\nxSIFzc.exe
  C:\Windows\System\nxSIFzc.exe
  2⤵
  PID:9384
- C:\Windows\System\bCJEWaF.exe
  C:\Windows\System\bCJEWaF.exe
  2⤵
  PID:9416
- C:\Windows\System\wpgCSSI.exe
  C:\Windows\System\wpgCSSI.exe
  2⤵
  PID:9468
- C:\Windows\System\KkVIMhV.exe
  C:\Windows\System\KkVIMhV.exe
  2⤵
  PID:9440
- C:\Windows\System\GKEiDFY.exe
  C:\Windows\System\GKEiDFY.exe
  2⤵
  PID:9492
- C:\Windows\System\AjOlhtt.exe
  C:\Windows\System\AjOlhtt.exe
  2⤵
  PID:9544
- C:\Windows\System\LvJsfSm.exe
  C:\Windows\System\LvJsfSm.exe
  2⤵
  PID:9572
- C:\Windows\System\BFTEmGK.exe
  C:\Windows\System\BFTEmGK.exe
  2⤵
  PID:9624
- C:\Windows\System\CGTHfNa.exe
  C:\Windows\System\CGTHfNa.exe
  2⤵
  PID:9664
- C:\Windows\System\uaJmsML.exe
  C:\Windows\System\uaJmsML.exe
  2⤵
  PID:9708
- C:\Windows\System\QrNgKNG.exe
  C:\Windows\System\QrNgKNG.exe
  2⤵
  PID:9692
- C:\Windows\System\Fotjigw.exe
  C:\Windows\System\Fotjigw.exe
  2⤵
  PID:9728
- C:\Windows\System\WrLyvHh.exe
  C:\Windows\System\WrLyvHh.exe
  2⤵
  PID:9776
- C:\Windows\System\JIOhxDp.exe
  C:\Windows\System\JIOhxDp.exe
  2⤵
  PID:9828
- C:\Windows\System\gPQvPGQ.exe
  C:\Windows\System\gPQvPGQ.exe
  2⤵
  PID:9868
- C:\Windows\System\nnMgDlK.exe
  C:\Windows\System\nnMgDlK.exe
  2⤵
  PID:9892
- C:\Windows\System\UnkoASB.exe
  C:\Windows\System\UnkoASB.exe
  2⤵
  PID:9912
- C:\Windows\System\iEZOCif.exe
  C:\Windows\System\iEZOCif.exe
  2⤵
  PID:9488
- C:\Windows\System\ZxEahYj.exe
  C:\Windows\System\ZxEahYj.exe
  2⤵
  PID:9968
- C:\Windows\System\FRlDIsz.exe
  C:\Windows\System\FRlDIsz.exe
  2⤵
  PID:10028
- C:\Windows\System\iOigNOV.exe
  C:\Windows\System\iOigNOV.exe
  2⤵
  PID:10096
- C:\Windows\System\yCVuGOj.exe
  C:\Windows\System\yCVuGOj.exe
  2⤵
  PID:10100
- C:\Windows\System\QYPakZA.exe
  C:\Windows\System\QYPakZA.exe
  2⤵
  PID:10144
- C:\Windows\System\iLrBtKJ.exe
  C:\Windows\System\iLrBtKJ.exe
  2⤵
  PID:10188
- C:\Windows\System\WNYwLLW.exe
  C:\Windows\System\WNYwLLW.exe
  2⤵
  PID:10216
- C:\Windows\System\yHJTLNU.exe
  C:\Windows\System\yHJTLNU.exe
  2⤵
  PID:9240
- C:\Windows\System\YFCAxsi.exe
  C:\Windows\System\YFCAxsi.exe
  2⤵
  PID:9236
- C:\Windows\System\npJVKnC.exe
  C:\Windows\System\npJVKnC.exe
  2⤵
  PID:9304
- C:\Windows\System\PnnUiTa.exe
  C:\Windows\System\PnnUiTa.exe
  2⤵
  PID:1576
- C:\Windows\System\ukmgtyI.exe
  C:\Windows\System\ukmgtyI.exe
  2⤵
  PID:9420
- C:\Windows\System\rRTUFak.exe
  C:\Windows\System\rRTUFak.exe
  2⤵
  PID:9464
- C:\Windows\System\szRawPn.exe
  C:\Windows\System\szRawPn.exe
  2⤵
  PID:9548
- C:\Windows\System\VmcGFmC.exe
  C:\Windows\System\VmcGFmC.exe
  2⤵
  PID:9612
- C:\Windows\System\siYXURm.exe
  C:\Windows\System\siYXURm.exe
  2⤵
  PID:9696
- C:\Windows\System\JBKaXms.exe
  C:\Windows\System\JBKaXms.exe
  2⤵
  PID:9784
- C:\Windows\System\hyxQMgH.exe
  C:\Windows\System\hyxQMgH.exe
  2⤵
  PID:9660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUuUeUh.exe

Filesize
1.8MB

MD5
fec2233ad253bba2e5a0319db8bf99af

SHA1
074d460865b62bcf36b4a284b84514463b075eae

SHA256
24dc6dbda17df2a5efd4e25139f15f421d8821d7409f404df19688afa53d38c2

SHA512
bdb76628373515fff80f05238fa992f98ad03ab2ab9ff52caf8cbcda4165d29a3771444ab318894e41b585ad05ce13c47a1e40bfcbbf37f4565f49b19f1a988d

Download Submit
C:\Windows\system\AmDBgAc.exe

Filesize
1.8MB

MD5
adb26d25d0e9d1bb376ccc2ce742b1fa

SHA1
4a97d8e6614b6a88c40cbe4d547b250f5b65db2c

SHA256
62f7481d19f872e9075c4cdd9bca1dd806cec5d99736aed1827cbd4d947e2b20

SHA512
4caed3f4c2578b7664b61c3ab682941df12356cf31c94c793cc58c8249f18b9dc123a8e8f68a72e1d2f596b4c05c1b2a5d7fc92b8ca024309f488f1e78434d35

Download Submit
C:\Windows\system\AvCKfSi.exe

Filesize
1.8MB

MD5
1b0eb92d4627ba19c117115fc1facb0f

SHA1
16dd3cb846d301e913c0ac8dba14e49799ebd8c2

SHA256
0ce37fbe959fa4e961ffe1f129e8d21b7a0f616af90f96adf6ac0652141d30b0

SHA512
089a03d5e722f6f5cab79c932dfc49e2f5959e435ab144864c502415e70a503579a29d4a7144eb43d30d0c3509fa9c1c38922d211c0d0cb8fad17d9513cb4103

Download Submit
C:\Windows\system\GjoyWEw.exe

Filesize
1.8MB

MD5
5e9f7563fdc3959eb0be50544a1f5f2d

SHA1
35e8bbb05bf95bd866507fce70d4113640222b6a

SHA256
d102d2b2dbd6f603c2b88e7ac3d06deb79776c09a625e28e60752fe3a2f4a17a

SHA512
df3eb031edbe1731788ed199777f2d8baab22ed4b154788d0afff24bc720936e1ac6f90255b561acc1bec6088969a476e2d2c9e87e0a2f5a7cb0cfc70586858f

Download Submit
C:\Windows\system\MYgHUaT.exe

Filesize
1.8MB

MD5
0786107f41010ea64240f9e3ad9143d3

SHA1
3a90d4f8832380dabe7c0eb07f2b88b2f7f25527

SHA256
624deba022a2d67e8780d3094cd0864a8fb68af385db82371f067c795d8c83b4

SHA512
af08b49e1e035ab976b7c27b10db68de3ce775fe59a2b3f340a4dc1246f9d8d0643bc95a1dcfa3673850c2be3dc9ddb21bbc7debaf85aefc8fb3ab788605dc35

Download Submit
C:\Windows\system\NqZhQHr.exe

Filesize
1.8MB

MD5
ff2f48f8a5d00ade3dedbffac7e443c6

SHA1
9b450db4c21de177062a00ecefe39fdeaddbf8e2

SHA256
96da0e4f61369f5cd09bdddff25d9692413de1a716cd0b0921e99cdfdcb07449

SHA512
fe9bbb0495408a7ad91748ef0d6f8bf50c1b40a53ea25fe70404675d6c30fb0b556aff28a77ade19a7b5bd2842565a46c129cb92d436a4c50f1ba78f7c736862

Download Submit
C:\Windows\system\PIQyNvr.exe

Filesize
1.8MB

MD5
36312ac22bd914d89adeb4cba54f1c65

SHA1
c3ca8c6a194cc158b311c39f27c23ba7b416dcad

SHA256
50aa55795c1037cc535fd98208990d2bd5d2da4c64933bba6c0c2845a2987b66

SHA512
ef3b871fe21b16738cd50b6699b55290c9814008d5c739026d4eeca4a77418cc544f869ce47638c0212ebe725e50d25f80f85f7e5b65112844acd9fce7f468ae

Download Submit
C:\Windows\system\QaWuYQq.exe

Filesize
1.8MB

MD5
4a298eef2b47a4db6b14bd509124d9b8

SHA1
2fa24461bc80229311ab33749e0713a63006eca5

SHA256
11556b15e2a3bfca9a5e6efe4dc66675c2fa263521d8cf0224831548d8ff3454

SHA512
82e733d44839a06dcdd71792c8f993b2610082dbb123e716d6f5467d3b4cab6a63c6f148f99f4ac450f0ea964ca36eeb7010cae066c9e6f154ad4c36e9c959ca

Download Submit
C:\Windows\system\RdfzCmm.exe

Filesize
1.8MB

MD5
586d90a1934af1d15fb4b813fa4922d7

SHA1
83970fe82a426e5da037c82af843ab689a822f83

SHA256
c3ebfbc8c89fd77980dcab1d87b23fd2ccf4753ed8830a0b00571e70e7897cf6

SHA512
10e868c0839268da52633d3c9e646a52ca00fb2465f987e18c9922cd8797ec29f53a8d9d2f7bad3215d9bf8335a1e62ecc410255947128dc14996b9fcb3e6b96

Download Submit
C:\Windows\system\SJgqWCi.exe

Filesize
1.8MB

MD5
d1b0229a2f6ae1a8f92574903b4e98eb

SHA1
092e8ad91323ced4cd0e91240377253215f2ba23

SHA256
e1c238c54f72fba0c8f4e8af41a2b3d191a1eed83ea080926122681ed05d417c

SHA512
c520a4cbfae34db7ca4c0eeea12f608b477d608ee3408c3d370841c1aa4dc82a8d35ac7c5c67ffccfa1747e5148355a4258c9221bf7ef357ae1de8420087c21b

Download Submit
C:\Windows\system\TiIvEBh.exe

Filesize
1.8MB

MD5
188bf06051b783c296bfd58ce77d43f3

SHA1
8a8302336a235598f06c49b8de1d6e8550474201

SHA256
25d52cadc13e52e80d4370d97ce8ce702ae259e8b7bbbe1ab7fc17bbd2058e01

SHA512
247ecaf3122b7ac18744b82d0fd9a8c30a404f1bb9c216ee63a42a222ef6d90bb93bf648d6deed48a781d48d74cb51a20a966b3acbf2d7b734adf188825266a4

Download Submit
C:\Windows\system\VMpeJBF.exe

Filesize
1.8MB

MD5
de009820a28ea37a54693c7e38c3cc55

SHA1
579ebbfeabedb41af83260fd5aa4cb2d56ab3272

SHA256
a8df365314529da7b84eed1f0bdf043fac9876b8e4ad09e55799c5e6247b089f

SHA512
2866446d0bab299f7bcc158309dff08d1c551996684bb135b4625b4b8f8c77f61bfa449728601d7b66f3577e0cd297d6c4b7f671aa04db7296d929f08ce6934a

Download Submit
C:\Windows\system\WOpnlxl.exe

Filesize
1.8MB

MD5
6cbfbec69117bc75ab70343911aae60f

SHA1
10e0da132b0fc17902e78057f502586038daa6ff

SHA256
3fdf72f8d864e00b198d0e052fab32d32513e1d925aea465af972ad4d6740284

SHA512
accde25b4cd9927415e19a53137f0d575afa2515e64d995b7bdb5b5d246c2c57df4a74a8030c1c908e0dc4a8f80a249d56c8605bd0448a3052bf3fb88d6c5154

Download Submit
C:\Windows\system\bLLVkkL.exe

Filesize
1.8MB

MD5
866fa0e24c3afd9896c02d578706d206

SHA1
a86c29da53506f3bc7fa460c47693b0fb1ce85ce

SHA256
acb5e37a6a3ffcc5b0489011dc98bda55427f0d1cc338e9aec486665e6e91508

SHA512
9d80d37c83f6f2fd0ddb3b44e122ea58b594c606c675799981988543c983c02707d46645d0663b22312d06f87ad59506fc5ac44d0384b8339259900795c639f6

Download Submit
C:\Windows\system\caEYYhf.exe

Filesize
1.8MB

MD5
31375bcc105d70bc5ce60c5322bf75f9

SHA1
b9c542c792314aad05df552a5641d6224d914f62

SHA256
34798f33b1c833ca5faec29bd258a51f35eddb45bc5790f36c7a370f60cbd303

SHA512
5114de8e9599995ac488e941b076b4df5c132c19a0f34f080bd5c2ec76204215d4b3a5078f524e6dfac3d5657a04ac841e5bbd95197c91202216519a6a675937

Download Submit
C:\Windows\system\dtjwjpA.exe

Filesize
1.8MB

MD5
dd97b61160af1faf0f6ef302eea991a9

SHA1
9d19dfe80465802637c3f0e41bc7037fc2ce6812

SHA256
ecccb9d0dcdda267e4e314a35718e726d38868f2747d6b169915959b221391be

SHA512
57ef7e677283c7f20fc3a0dccccadb76aa3821d773e4cb2fafb689e0ab99fb2828787d5d6b8c27cff058b594e7bf12b4c77f4660b03e788b39aebe8e71b8cfd7

Download Submit
C:\Windows\system\fIfhrRV.exe

Filesize
1.8MB

MD5
374c1eeaf63079cd3145d9b23ebcd19f

SHA1
49aae577972d19b75a7e486e8bbb40de40e86b35

SHA256
cfbc69760a297500f8effb52b7cdef90af06b412aa1d9a582a87a87891edf84c

SHA512
10b69d9088a8a18e5ae082b0e539d26df01ba2dce14966ffe7b6b06d4101c362e930e4d9345a69539e885344f744e6585ade90070417fee24b7f5abf8f29fcfc

Download Submit
C:\Windows\system\hejmBkX.exe

Filesize
1.8MB

MD5
42df9c4b4f706df12f1d5f246113e07d

SHA1
ba055d1eb48fba46b0a9857ca3dca856e23c1c6a

SHA256
36b2c3b93657b1c948ef02033603af92c85336ff33757bd10a4a3978fbd39675

SHA512
90e48b3682f20c5648b412ce3704bdd8464041a3d3797cb0599a7b796813b5cbb888423e05dc5d170257eb1d287c32968b4d7dbe4ff12ab2ad78ed0312fa982a

Download Submit
C:\Windows\system\hvpXnQH.exe

Filesize
1.8MB

MD5
3a5c75a439e457fbed46cf3278e9e8c2

SHA1
2de7fc3226ebc653e42f863ed8b46799dba31a59

SHA256
6080559a0c5cd7160cd244ca1f017361aeb95d0c4746721c379e5b79f9bb312e

SHA512
f55f83c6a492520d39b2152c0d90ce8b01b2f69e221eb3d821cd1cfcccf69864249241b24ef3c7db8f175a102fab779c68d42265c98d53b88c2f76e908fdd742

Download Submit
C:\Windows\system\jhETXrS.exe

Filesize
1.8MB

MD5
617c82f309fc8ac876c77c38b7648656

SHA1
6acc7a22fc1b9364d268c48e64c63222be5f23d1

SHA256
252d3f61f995c19a61e6d89e9db346d75ca130693091ffdf751af2f3dd74ba03

SHA512
ef3272de0061ebb0d874d458b4eac04a225c7f30efb035e816a76ee9b1d78f0b854d04e107bc117e4a16336f8ac98df7b7e07313e3ca3a42e37bf3c1c1dcba5d

Download Submit
C:\Windows\system\jrtjSxt.exe

Filesize
1.8MB

MD5
cda8f0080b2f8c2e81c1e19b0470cd1c

SHA1
78d6be6604a661ec9358667009a3786af6ea77a6

SHA256
55a18b73d238f29becd1cca873d66e37f055134fc42f105c8f79bea00e829441

SHA512
b7fc09f463ec83234dfd46a25cf15e0d23a43d560f4eb4e0c47147bd0acff1b6179195af15d223678a613f45aca407e036bdd74ec8e1e95802a5a354fad09754

Download Submit
C:\Windows\system\leqPHvW.exe

Filesize
1.8MB

MD5
8a5dbcc75ba716a080dddda4b0b67925

SHA1
6a1feec285c4d05b784dd7f1fd64a9c3276fe43c

SHA256
5b41d212975765a9a04b23e2b261f162fc32bdf8d5d1f53a872060104e0d66d3

SHA512
b779f5984deb0d1f63302297dbcf8820ea36c24398b8fa26da22c252f945d698451e0cc33bcd1e7e8eab850fa2a91bb1f19ba44916492ffb67821f7609df69fd

Download Submit
C:\Windows\system\oNtzdJl.exe

Filesize
1.8MB

MD5
341d567d22a3a293882fbecd612b3572

SHA1
e313c62be4f168631e38212983dd8fd8da5a52c8

SHA256
7cc19dc3ae53f71dae2dbf59bed08b48d6c52d0e71f99794b5b869e771f06ad6

SHA512
2461291dc5b855e2a86d836c1956fbb84f46a2797861edf05293e1f69d8c53ddaa0c9090779f56f50cc250ffdbc68ff919785fc76c594096c98760ade0cda1c6

Download Submit
C:\Windows\system\tEzgraE.exe

Filesize
1.8MB

MD5
63d3e2848e8c695d4e73489e4d305fa9

SHA1
4ad7a7b15c32cbaf019d82237a598503d3db672c

SHA256
74358aaf0eaff06b8f118834c06cf23744cc41ee4e626916879c085d22c943f1

SHA512
1e2c29c73cdbc1fc08ca6fd97a0d9b45032ff6d3dd1eaa6eb60a143a4c2691f209cc29fb60bc382186081c45d76cca40354b9df1e27ed121454eeac8fcea32b3

Download Submit
C:\Windows\system\utlYgvH.exe

Filesize
1.8MB

MD5
4f6b078891129bd2c67d8aa7167f3dbd

SHA1
df2347d5f87bdecd1615f0148eef028c3e685bfd

SHA256
dc21c74e0715e12cd331011c61e5b88ad2ec26c190288d41575d58161f45f71d

SHA512
99c2ef1fe0a6baf7b56c63439192ffe9059b5ba697409a5bcbede28507a78875f700eee95468745c3e4b2b777bb55f38b06b11107dde7a0804a6782f50bbb24f

Download Submit
C:\Windows\system\wmbnObQ.exe

Filesize
1.8MB

MD5
bf5dc5852d36f1cab51c67d5ab63bd88

SHA1
ff2fca99c2792a1d933651c1ca957fa475841a18

SHA256
38b517f5de6a37de08b0dceda3f701c5c9935b34b6e5e5230e00cd43ed40f764

SHA512
2c33f1120b3c33d0d4af3cd76adae7f71e03302e1408e53a97b8e0deb7ba239aa6ccb3ca40011e2f0b0ab025fcc28a4a041ef0a278f1c4cfba093fa22236b378

Download Submit
C:\Windows\system\xoNafkL.exe

Filesize
1.8MB

MD5
4c656fca3cc96ca2f632794104cd481a

SHA1
558d187af003e8f6025f91495686d5a59cdedb21

SHA256
d2a273c9a14b8e0435764eb7b8f849065aa2abcf61382b9b88e61e4a6b52416f

SHA512
5cd58fbcd95fb7d1c5be7a1271b536c0a5b876c0eb3e0443bbc28e175846a643d029ad10fc84941679957cda08a698468641eadf504a50d04bee32d6feee4aa5

Download Submit
C:\Windows\system\ycPBeye.exe

Filesize
1.8MB

MD5
73244b8ca16bb85018c7564b1459f88a

SHA1
045f4ce6f86edffdb0a6c697f18bf38077048451

SHA256
b8f44a298f70564c5fa815350997fa40c8224fc20724124555ccd248f5f53843

SHA512
d16c993ec75568ab012aaf40ded4a9c7811f5b1457f76f049309e971ae420bd911d2d52b6dc7fc5e64f2fa372a23b31b27ad8383ceefd50b8d641c2d77789257

Download Submit
C:\Windows\system\ziyDrPt.exe

Filesize
1.8MB

MD5
8975b5d352675b37b2a94c9db7c59e30

SHA1
ee7e4b2eef0e44b87ddd915f45b7230960fb78b4

SHA256
285ad27274c3e16a970e721faec654c484f2bddc132de41dff09dced670f2019

SHA512
a47f9acad2af066d0feeef595449909c354585321d39254f6d84900f2136c5bf68788678bb4ffde92b592f3b0344140d640a830c019be21b61506bfa54036776

Download Submit
C:\Windows\system\zlZPubm.exe

Filesize
1.8MB

MD5
e36f24a1f35f026f498daff2cf920584

SHA1
a22bba1f26ecac6549211fa478f7936a446f665e

SHA256
58e2fab92a5e1f74fafc75db8210346d6cb3e834b191b4af18d4bee1c30f9ab7

SHA512
e54a5025afccdc4730d47795d5de1ce2b75e51fce5c3a91cf01101cced603e210b6a71e34c00801cf5ec3c3478ede464d3345caf55b7dd454fb3d743d5f6047f

Download Submit
\Windows\system\mQcdkvw.exe

Filesize
1.8MB

MD5
4deaf1ae609c7523a01ef4a312e6e479

SHA1
03de0a1fb9150d5845f59b91771a9c4d492bb84d

SHA256
167322a588b7b4fc6d3f20888a1bc5e428f8af765981cd3c88689008eeb788a8

SHA512
9ad9df926b7fccca0764b93531eafa6f7ecbfcd4e7c8c27ef55adddc049b3c24af55376f59b8ff458a807fd47d438822ba67dfaa49323adc068307738427a0bc

Download Submit
\Windows\system\nhwwaQM.exe

Filesize
1.8MB

MD5
401785810166b8aa581f5f9c152bb0e2

SHA1
2665fe553879314e531a6e69e0ee2f62aa42b220

SHA256
b13b31657966ee0a654648fd8178f757f2ea740e8a46f22ec9e58a6c281bc417

SHA512
3c1844ac4e14a190765b38e326aefe13fb14daee813f063b5d7709fb79cc84e7a0c74288e6ffcc15168dc501d9560bb230dda3c3f2c9a2e701330ac956ff6674

Download Submit
memory/1268-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download