xmrig | 0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
Size

1.2MB
MD5

bf573f44b1043ca21ada4b2f8c165b72
SHA1

ce6287f3e405cfe2ad1f24ed38b31b96a48cd938
SHA256

0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b
SHA512

db9a13de4da30f35376802b0c91020e57c4bc941c1ba29630c5dfb5b4172c320877bffe7ef21273c3bf135861a532763d71ef44a2262535dbd42e2e792170c20
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwXs4+:GezaTF8FcNkNdfE0pZ9ozttwIRx2VT

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	xmrig
behavioral1/files/0x000700000001868b-9.dat	xmrig
behavioral1/files/0x00070000000186f2-13.dat	xmrig
behavioral1/files/0x0007000000018731-14.dat	xmrig
behavioral1/files/0x0006000000018781-21.dat	xmrig
behavioral1/files/0x000600000001878c-28.dat	xmrig
behavioral1/files/0x0007000000018bf3-33.dat	xmrig
behavioral1/files/0x000700000001925e-34.dat	xmrig
behavioral1/files/0x000600000001945c-40.dat	xmrig
behavioral1/files/0x0005000000019467-44.dat	xmrig
behavioral1/files/0x0005000000019496-48.dat	xmrig
behavioral1/files/0x00050000000194ad-52.dat	xmrig
behavioral1/files/0x00050000000194d0-56.dat	xmrig
behavioral1/files/0x00050000000194fc-64.dat	xmrig
behavioral1/files/0x0005000000019506-69.dat	xmrig
behavioral1/files/0x000500000001952f-76.dat	xmrig
behavioral1/files/0x000500000001957e-80.dat	xmrig
behavioral1/files/0x00050000000195e6-88.dat	xmrig
behavioral1/files/0x0005000000019621-101.dat	xmrig
behavioral1/files/0x0005000000019623-108.dat	xmrig
behavioral1/files/0x0005000000019627-116.dat	xmrig
behavioral1/files/0x000500000001967f-132.dat	xmrig
behavioral1/files/0x000500000001963b-128.dat	xmrig
behavioral1/files/0x000500000001962b-124.dat	xmrig
behavioral1/files/0x0005000000019629-121.dat	xmrig
behavioral1/files/0x0005000000019625-113.dat	xmrig
behavioral1/files/0x0005000000019622-105.dat	xmrig
behavioral1/files/0x000500000001961f-96.dat	xmrig
behavioral1/files/0x000500000001961d-93.dat	xmrig
behavioral1/files/0x00050000000195a7-84.dat	xmrig
behavioral1/files/0x0035000000018669-72.dat	xmrig
behavioral1/files/0x00050000000194ef-60.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2716	ppRPoKt.exe
2752	HETdNno.exe
2680	yOOVlSQ.exe
2648	WtqtBKt.exe
2640	mgrjZst.exe
2700	LHhcnJK.exe
2744	JMbnyWp.exe
1720	RgOsgSp.exe
2532	pYJoZNL.exe
2584	KJHkSKZ.exe
2976	lydxRoq.exe
2144	tPYmiIz.exe
1820	sREYXlp.exe
340	KArAxKx.exe
2560	tHcruei.exe
2400	rpqLqUo.exe
2084	KCErumj.exe
1924	hMipmHJ.exe
2420	JJEjQHI.exe
2852	wmvxTMI.exe
1684	mqmVzNk.exe
784	slRreHw.exe
2756	TeHPssY.exe
2008	hAPILlv.exe
3000	inKobQv.exe
1636	bkEgjbm.exe
2452	CAarxMZ.exe
1696	ZvWJvkX.exe
2368	STywIBS.exe
696	GwMcnyI.exe
1872	olTVeiH.exe
2208	SInwieV.exe
2248	FOapnrz.exe
2288	RggxVmV.exe
2912	pjXCrua.exe
2356	DNbWfZq.exe
408	yAUzoTa.exe
1060	wTFfuoD.exe
2172	kwfpCoJ.exe
2304	HKOiPZg.exe
2032	WWAZRJS.exe
1336	NtFXDUv.exe
268	NJMidMn.exe
1524	ETmTWJl.exe
316	HGjvZVL.exe
968	uJqimEd.exe
1532	HpYQFax.exe
1620	AOAWcXo.exe
1712	wnkkslQ.exe
1788	rujYIwX.exe
756	IoWccvz.exe
1252	jXVXehy.exe
1356	AbJspBQ.exe
1348	uCZKlrF.exe
1744	GuJLDsG.exe
776	XcYKrGm.exe
1940	NjdUqRP.exe
1656	eDbJHrM.exe
1216	beqCzlj.exe
2800	mmtVYil.exe
1880	MBZaEzg.exe
2112	OhdjeCy.exe
1952	zXOyowK.exe
2392	FWXjYDn.exe

Loads dropped DLL 64 IoCs

pid	Process
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xQuYMiM.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\OVriyQw.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\ayYqcNz.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\snSgcpp.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\dJwWnSC.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\wmwlxrH.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\JXmRGFQ.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\qMhhPmX.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\zUUSydU.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\lcZfHGp.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\NjdUqRP.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\LsLEJGP.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\zedYrUl.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\kgidIFm.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\ShLFQGh.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\AwdxTGk.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\fSVimXj.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\MbhVRZR.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\wnkkslQ.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\jEGbIoT.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\JKngwtD.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\oFEuJAt.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\KufSzPO.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\jBgINSE.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\qzFhvcL.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\qeIZiwe.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\KREadFm.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\XHzpHqQ.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\pNKoOQf.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\KCggpkx.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\CVCQuQX.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\MmmpjlB.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\qgcATHM.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\faZUlQq.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\ZVuRvLO.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\OATcJlA.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\BuUCEyt.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\VhLmUSW.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\SGpFOvI.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\tPYmiIz.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\QmGcCAv.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\megGLTo.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\nxTlRyr.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\XkzHiuV.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\HXGRyPW.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\qGAJwkb.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\kwfpCoJ.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\EmCiIkf.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\PXqNxfu.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\GOCsDgz.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\hwPABty.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\ruQaFnn.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\XlaNxRO.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\tGEMQdy.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\DNgLQfg.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\SFBOnnN.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\BpwLIRf.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\hUdYCAm.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\dZkqqWA.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\SFlBtzu.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\HpiuefX.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\KWiJeip.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\XprxwUY.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
File created	C:\Windows\System\hhAdgYQ.exe	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2716	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	31
PID 1964 wrote to memory of 2716	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	31
PID 1964 wrote to memory of 2716	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	31
PID 1964 wrote to memory of 2752	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	32
PID 1964 wrote to memory of 2752	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	32
PID 1964 wrote to memory of 2752	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	32
PID 1964 wrote to memory of 2680	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	33
PID 1964 wrote to memory of 2680	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	33
PID 1964 wrote to memory of 2680	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	33
PID 1964 wrote to memory of 2648	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	34
PID 1964 wrote to memory of 2648	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	34
PID 1964 wrote to memory of 2648	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	34
PID 1964 wrote to memory of 2640	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	35
PID 1964 wrote to memory of 2640	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	35
PID 1964 wrote to memory of 2640	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	35
PID 1964 wrote to memory of 2700	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	36
PID 1964 wrote to memory of 2700	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	36
PID 1964 wrote to memory of 2700	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	36
PID 1964 wrote to memory of 2744	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	37
PID 1964 wrote to memory of 2744	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	37
PID 1964 wrote to memory of 2744	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	37
PID 1964 wrote to memory of 1720	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	38
PID 1964 wrote to memory of 1720	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	38
PID 1964 wrote to memory of 1720	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	38
PID 1964 wrote to memory of 2532	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	39
PID 1964 wrote to memory of 2532	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	39
PID 1964 wrote to memory of 2532	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	39
PID 1964 wrote to memory of 2584	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	40
PID 1964 wrote to memory of 2584	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	40
PID 1964 wrote to memory of 2584	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	40
PID 1964 wrote to memory of 2976	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	41
PID 1964 wrote to memory of 2976	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	41
PID 1964 wrote to memory of 2976	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	41
PID 1964 wrote to memory of 2144	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	42
PID 1964 wrote to memory of 2144	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	42
PID 1964 wrote to memory of 2144	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	42
PID 1964 wrote to memory of 1820	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	43
PID 1964 wrote to memory of 1820	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	43
PID 1964 wrote to memory of 1820	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	43
PID 1964 wrote to memory of 340	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	44
PID 1964 wrote to memory of 340	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	44
PID 1964 wrote to memory of 340	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	44
PID 1964 wrote to memory of 2560	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	45
PID 1964 wrote to memory of 2560	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	45
PID 1964 wrote to memory of 2560	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	45
PID 1964 wrote to memory of 2400	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	46
PID 1964 wrote to memory of 2400	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	46
PID 1964 wrote to memory of 2400	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	46
PID 1964 wrote to memory of 2084	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	47
PID 1964 wrote to memory of 2084	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	47
PID 1964 wrote to memory of 2084	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	47
PID 1964 wrote to memory of 1924	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	48
PID 1964 wrote to memory of 1924	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	48
PID 1964 wrote to memory of 1924	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	48
PID 1964 wrote to memory of 2420	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	49
PID 1964 wrote to memory of 2420	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	49
PID 1964 wrote to memory of 2420	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	49
PID 1964 wrote to memory of 2852	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	50
PID 1964 wrote to memory of 2852	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	50
PID 1964 wrote to memory of 2852	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	50
PID 1964 wrote to memory of 1684	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	51
PID 1964 wrote to memory of 1684	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	51
PID 1964 wrote to memory of 1684	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	51
PID 1964 wrote to memory of 784	1964	0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe	52

C:\Users\Admin\AppData\Local\Temp\0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe
"C:\Users\Admin\AppData\Local\Temp\0d78ccb1b3a8bb5386b0e37f702001fac87db05772fbe03cc315403fe945c04b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System\ppRPoKt.exe
  C:\Windows\System\ppRPoKt.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\HETdNno.exe
  C:\Windows\System\HETdNno.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\yOOVlSQ.exe
  C:\Windows\System\yOOVlSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\WtqtBKt.exe
  C:\Windows\System\WtqtBKt.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\mgrjZst.exe
  C:\Windows\System\mgrjZst.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\LHhcnJK.exe
  C:\Windows\System\LHhcnJK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\JMbnyWp.exe
  C:\Windows\System\JMbnyWp.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\RgOsgSp.exe
  C:\Windows\System\RgOsgSp.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\pYJoZNL.exe
  C:\Windows\System\pYJoZNL.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\KJHkSKZ.exe
  C:\Windows\System\KJHkSKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\lydxRoq.exe
  C:\Windows\System\lydxRoq.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\tPYmiIz.exe
  C:\Windows\System\tPYmiIz.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\sREYXlp.exe
  C:\Windows\System\sREYXlp.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\KArAxKx.exe
  C:\Windows\System\KArAxKx.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\tHcruei.exe
  C:\Windows\System\tHcruei.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\rpqLqUo.exe
  C:\Windows\System\rpqLqUo.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\KCErumj.exe
  C:\Windows\System\KCErumj.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\hMipmHJ.exe
  C:\Windows\System\hMipmHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\JJEjQHI.exe
  C:\Windows\System\JJEjQHI.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\wmvxTMI.exe
  C:\Windows\System\wmvxTMI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\mqmVzNk.exe
  C:\Windows\System\mqmVzNk.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\slRreHw.exe
  C:\Windows\System\slRreHw.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\TeHPssY.exe
  C:\Windows\System\TeHPssY.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\hAPILlv.exe
  C:\Windows\System\hAPILlv.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\inKobQv.exe
  C:\Windows\System\inKobQv.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\bkEgjbm.exe
  C:\Windows\System\bkEgjbm.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\CAarxMZ.exe
  C:\Windows\System\CAarxMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ZvWJvkX.exe
  C:\Windows\System\ZvWJvkX.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\STywIBS.exe
  C:\Windows\System\STywIBS.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\GwMcnyI.exe
  C:\Windows\System\GwMcnyI.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\olTVeiH.exe
  C:\Windows\System\olTVeiH.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\SInwieV.exe
  C:\Windows\System\SInwieV.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\FOapnrz.exe
  C:\Windows\System\FOapnrz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\RggxVmV.exe
  C:\Windows\System\RggxVmV.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\pjXCrua.exe
  C:\Windows\System\pjXCrua.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\DNbWfZq.exe
  C:\Windows\System\DNbWfZq.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\yAUzoTa.exe
  C:\Windows\System\yAUzoTa.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\wTFfuoD.exe
  C:\Windows\System\wTFfuoD.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\kwfpCoJ.exe
  C:\Windows\System\kwfpCoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\HKOiPZg.exe
  C:\Windows\System\HKOiPZg.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\WWAZRJS.exe
  C:\Windows\System\WWAZRJS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\NtFXDUv.exe
  C:\Windows\System\NtFXDUv.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\NJMidMn.exe
  C:\Windows\System\NJMidMn.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\ETmTWJl.exe
  C:\Windows\System\ETmTWJl.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\HGjvZVL.exe
  C:\Windows\System\HGjvZVL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\uJqimEd.exe
  C:\Windows\System\uJqimEd.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\HpYQFax.exe
  C:\Windows\System\HpYQFax.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\AOAWcXo.exe
  C:\Windows\System\AOAWcXo.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\wnkkslQ.exe
  C:\Windows\System\wnkkslQ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\rujYIwX.exe
  C:\Windows\System\rujYIwX.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\IoWccvz.exe
  C:\Windows\System\IoWccvz.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\jXVXehy.exe
  C:\Windows\System\jXVXehy.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\AbJspBQ.exe
  C:\Windows\System\AbJspBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\uCZKlrF.exe
  C:\Windows\System\uCZKlrF.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\GuJLDsG.exe
  C:\Windows\System\GuJLDsG.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\XcYKrGm.exe
  C:\Windows\System\XcYKrGm.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\NjdUqRP.exe
  C:\Windows\System\NjdUqRP.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\eDbJHrM.exe
  C:\Windows\System\eDbJHrM.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\beqCzlj.exe
  C:\Windows\System\beqCzlj.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\mmtVYil.exe
  C:\Windows\System\mmtVYil.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\MBZaEzg.exe
  C:\Windows\System\MBZaEzg.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\OhdjeCy.exe
  C:\Windows\System\OhdjeCy.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\zXOyowK.exe
  C:\Windows\System\zXOyowK.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\FWXjYDn.exe
  C:\Windows\System\FWXjYDn.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\RZMDuYS.exe
  C:\Windows\System\RZMDuYS.exe
  2⤵
  PID:2612
- C:\Windows\System\cEuAyGg.exe
  C:\Windows\System\cEuAyGg.exe
  2⤵
  PID:2428
- C:\Windows\System\snSgcpp.exe
  C:\Windows\System\snSgcpp.exe
  2⤵
  PID:1700
- C:\Windows\System\TXlElYQ.exe
  C:\Windows\System\TXlElYQ.exe
  2⤵
  PID:1960
- C:\Windows\System\aOuquWh.exe
  C:\Windows\System\aOuquWh.exe
  2⤵
  PID:1928
- C:\Windows\System\BQuzZqd.exe
  C:\Windows\System\BQuzZqd.exe
  2⤵
  PID:1772
- C:\Windows\System\ZsSpypA.exe
  C:\Windows\System\ZsSpypA.exe
  2⤵
  PID:1644
- C:\Windows\System\EmCiIkf.exe
  C:\Windows\System\EmCiIkf.exe
  2⤵
  PID:1780
- C:\Windows\System\oPMllbA.exe
  C:\Windows\System\oPMllbA.exe
  2⤵
  PID:1588
- C:\Windows\System\FdmCzCy.exe
  C:\Windows\System\FdmCzCy.exe
  2⤵
  PID:2296
- C:\Windows\System\dvzLRAZ.exe
  C:\Windows\System\dvzLRAZ.exe
  2⤵
  PID:2748
- C:\Windows\System\CbchlVw.exe
  C:\Windows\System\CbchlVw.exe
  2⤵
  PID:2712
- C:\Windows\System\SeQWLHK.exe
  C:\Windows\System\SeQWLHK.exe
  2⤵
  PID:2676
- C:\Windows\System\CMGurGQ.exe
  C:\Windows\System\CMGurGQ.exe
  2⤵
  PID:2652
- C:\Windows\System\GriUiwH.exe
  C:\Windows\System\GriUiwH.exe
  2⤵
  PID:2796
- C:\Windows\System\rUynJcq.exe
  C:\Windows\System\rUynJcq.exe
  2⤵
  PID:2848
- C:\Windows\System\vcQZBpi.exe
  C:\Windows\System\vcQZBpi.exe
  2⤵
  PID:2548
- C:\Windows\System\fszRdVx.exe
  C:\Windows\System\fszRdVx.exe
  2⤵
  PID:2524
- C:\Windows\System\VURsSrW.exe
  C:\Windows\System\VURsSrW.exe
  2⤵
  PID:2984
- C:\Windows\System\HwhtXQA.exe
  C:\Windows\System\HwhtXQA.exe
  2⤵
  PID:1756
- C:\Windows\System\HEroIpO.exe
  C:\Windows\System\HEroIpO.exe
  2⤵
  PID:1352
- C:\Windows\System\yJPYpUJ.exe
  C:\Windows\System\yJPYpUJ.exe
  2⤵
  PID:2408
- C:\Windows\System\NYtZTpa.exe
  C:\Windows\System\NYtZTpa.exe
  2⤵
  PID:2380
- C:\Windows\System\hKyfkik.exe
  C:\Windows\System\hKyfkik.exe
  2⤵
  PID:1992
- C:\Windows\System\TkjUAEP.exe
  C:\Windows\System\TkjUAEP.exe
  2⤵
  PID:2856
- C:\Windows\System\YdPomnT.exe
  C:\Windows\System\YdPomnT.exe
  2⤵
  PID:1496
- C:\Windows\System\BpwLIRf.exe
  C:\Windows\System\BpwLIRf.exe
  2⤵
  PID:2760
- C:\Windows\System\bXlDhjm.exe
  C:\Windows\System\bXlDhjm.exe
  2⤵
  PID:2960
- C:\Windows\System\dJwWnSC.exe
  C:\Windows\System\dJwWnSC.exe
  2⤵
  PID:532
- C:\Windows\System\AbuaAYq.exe
  C:\Windows\System\AbuaAYq.exe
  2⤵
  PID:1824
- C:\Windows\System\CLKQONO.exe
  C:\Windows\System\CLKQONO.exe
  2⤵
  PID:1784
- C:\Windows\System\KCggpkx.exe
  C:\Windows\System\KCggpkx.exe
  2⤵
  PID:2892
- C:\Windows\System\pcXLJgC.exe
  C:\Windows\System\pcXLJgC.exe
  2⤵
  PID:3064
- C:\Windows\System\zDinERC.exe
  C:\Windows\System\zDinERC.exe
  2⤵
  PID:2740
- C:\Windows\System\qmHEjKG.exe
  C:\Windows\System\qmHEjKG.exe
  2⤵
  PID:2608
- C:\Windows\System\OKowQGT.exe
  C:\Windows\System\OKowQGT.exe
  2⤵
  PID:2480
- C:\Windows\System\NzUkgjQ.exe
  C:\Windows\System\NzUkgjQ.exe
  2⤵
  PID:916
- C:\Windows\System\izzIlox.exe
  C:\Windows\System\izzIlox.exe
  2⤵
  PID:1764
- C:\Windows\System\KgiEhxw.exe
  C:\Windows\System\KgiEhxw.exe
  2⤵
  PID:2416
- C:\Windows\System\HvSLIKR.exe
  C:\Windows\System\HvSLIKR.exe
  2⤵
  PID:2044
- C:\Windows\System\bNOTikz.exe
  C:\Windows\System\bNOTikz.exe
  2⤵
  PID:2456
- C:\Windows\System\aFtHwHZ.exe
  C:\Windows\System\aFtHwHZ.exe
  2⤵
  PID:1704
- C:\Windows\System\kaTSZiL.exe
  C:\Windows\System\kaTSZiL.exe
  2⤵
  PID:2228
- C:\Windows\System\jEGbIoT.exe
  C:\Windows\System\jEGbIoT.exe
  2⤵
  PID:2768
- C:\Windows\System\KyChXvD.exe
  C:\Windows\System\KyChXvD.exe
  2⤵
  PID:2224
- C:\Windows\System\rFNVSdk.exe
  C:\Windows\System\rFNVSdk.exe
  2⤵
  PID:2520
- C:\Windows\System\bQPstbc.exe
  C:\Windows\System\bQPstbc.exe
  2⤵
  PID:2636
- C:\Windows\System\fOFgilD.exe
  C:\Windows\System\fOFgilD.exe
  2⤵
  PID:2816
- C:\Windows\System\UbTBUOC.exe
  C:\Windows\System\UbTBUOC.exe
  2⤵
  PID:2540
- C:\Windows\System\SBDzJWW.exe
  C:\Windows\System\SBDzJWW.exe
  2⤵
  PID:592
- C:\Windows\System\JSuVsol.exe
  C:\Windows\System\JSuVsol.exe
  2⤵
  PID:2500
- C:\Windows\System\NvFxyFp.exe
  C:\Windows\System\NvFxyFp.exe
  2⤵
  PID:2956
- C:\Windows\System\bCzFVnv.exe
  C:\Windows\System\bCzFVnv.exe
  2⤵
  PID:1308
- C:\Windows\System\QIVtAfh.exe
  C:\Windows\System\QIVtAfh.exe
  2⤵
  PID:1036
- C:\Windows\System\VtDpszx.exe
  C:\Windows\System\VtDpszx.exe
  2⤵
  PID:320
- C:\Windows\System\ANFgmPL.exe
  C:\Windows\System\ANFgmPL.exe
  2⤵
  PID:2624
- C:\Windows\System\npGxCRQ.exe
  C:\Windows\System\npGxCRQ.exe
  2⤵
  PID:2092
- C:\Windows\System\JGuHWhr.exe
  C:\Windows\System\JGuHWhr.exe
  2⤵
  PID:2320
- C:\Windows\System\MZkIWrf.exe
  C:\Windows\System\MZkIWrf.exe
  2⤵
  PID:1540
- C:\Windows\System\qSjIvOe.exe
  C:\Windows\System\qSjIvOe.exe
  2⤵
  PID:1376
- C:\Windows\System\ASyUYoz.exe
  C:\Windows\System\ASyUYoz.exe
  2⤵
  PID:2072
- C:\Windows\System\FIvZBIZ.exe
  C:\Windows\System\FIvZBIZ.exe
  2⤵
  PID:2188
- C:\Windows\System\hQzoJBc.exe
  C:\Windows\System\hQzoJBc.exe
  2⤵
  PID:2240
- C:\Windows\System\jFtMTbg.exe
  C:\Windows\System\jFtMTbg.exe
  2⤵
  PID:2160
- C:\Windows\System\UdfIpwY.exe
  C:\Windows\System\UdfIpwY.exe
  2⤵
  PID:1288
- C:\Windows\System\aWPCKRp.exe
  C:\Windows\System\aWPCKRp.exe
  2⤵
  PID:2880
- C:\Windows\System\hadtOAi.exe
  C:\Windows\System\hadtOAi.exe
  2⤵
  PID:1724
- C:\Windows\System\OZLtqEg.exe
  C:\Windows\System\OZLtqEg.exe
  2⤵
  PID:2336
- C:\Windows\System\XTnthRw.exe
  C:\Windows\System\XTnthRw.exe
  2⤵
  PID:880
- C:\Windows\System\qOdCcpK.exe
  C:\Windows\System\qOdCcpK.exe
  2⤵
  PID:1104
- C:\Windows\System\UANMrIs.exe
  C:\Windows\System\UANMrIs.exe
  2⤵
  PID:684
- C:\Windows\System\UCszmNo.exe
  C:\Windows\System\UCszmNo.exe
  2⤵
  PID:1108
- C:\Windows\System\GJKjhzG.exe
  C:\Windows\System\GJKjhzG.exe
  2⤵
  PID:1100
- C:\Windows\System\AaakSOr.exe
  C:\Windows\System\AaakSOr.exe
  2⤵
  PID:644
- C:\Windows\System\ahLMswv.exe
  C:\Windows\System\ahLMswv.exe
  2⤵
  PID:2204
- C:\Windows\System\mEUCNhy.exe
  C:\Windows\System\mEUCNhy.exe
  2⤵
  PID:1200
- C:\Windows\System\VStvDBP.exe
  C:\Windows\System\VStvDBP.exe
  2⤵
  PID:964
- C:\Windows\System\pvlaLwY.exe
  C:\Windows\System\pvlaLwY.exe
  2⤵
  PID:944
- C:\Windows\System\mwSvmcd.exe
  C:\Windows\System\mwSvmcd.exe
  2⤵
  PID:1544
- C:\Windows\System\EtrpyUf.exe
  C:\Windows\System\EtrpyUf.exe
  2⤵
  PID:2968
- C:\Windows\System\fulhRVu.exe
  C:\Windows\System\fulhRVu.exe
  2⤵
  PID:2388
- C:\Windows\System\qeeTzHU.exe
  C:\Windows\System\qeeTzHU.exe
  2⤵
  PID:1808
- C:\Windows\System\exvUEQj.exe
  C:\Windows\System\exvUEQj.exe
  2⤵
  PID:1956
- C:\Windows\System\lWoZXDt.exe
  C:\Windows\System\lWoZXDt.exe
  2⤵
  PID:2056
- C:\Windows\System\sstykJj.exe
  C:\Windows\System\sstykJj.exe
  2⤵
  PID:1028
- C:\Windows\System\bxNmhYl.exe
  C:\Windows\System\bxNmhYl.exe
  2⤵
  PID:2720
- C:\Windows\System\OnbHqlu.exe
  C:\Windows\System\OnbHqlu.exe
  2⤵
  PID:2732
- C:\Windows\System\ibqZoqQ.exe
  C:\Windows\System\ibqZoqQ.exe
  2⤵
  PID:2692
- C:\Windows\System\yasyPhc.exe
  C:\Windows\System\yasyPhc.exe
  2⤵
  PID:2000
- C:\Windows\System\VofIRgo.exe
  C:\Windows\System\VofIRgo.exe
  2⤵
  PID:1516
- C:\Windows\System\QRHGRRV.exe
  C:\Windows\System\QRHGRRV.exe
  2⤵
  PID:2508
- C:\Windows\System\hWoDXRQ.exe
  C:\Windows\System\hWoDXRQ.exe
  2⤵
  PID:1052
- C:\Windows\System\SgnAMnZ.exe
  C:\Windows\System\SgnAMnZ.exe
  2⤵
  PID:2340
- C:\Windows\System\ApUxFTp.exe
  C:\Windows\System\ApUxFTp.exe
  2⤵
  PID:1632
- C:\Windows\System\bilJUBL.exe
  C:\Windows\System\bilJUBL.exe
  2⤵
  PID:1240
- C:\Windows\System\zzTubuY.exe
  C:\Windows\System\zzTubuY.exe
  2⤵
  PID:1616
- C:\Windows\System\fOnvkXr.exe
  C:\Windows\System\fOnvkXr.exe
  2⤵
  PID:1792
- C:\Windows\System\hUdYCAm.exe
  C:\Windows\System\hUdYCAm.exe
  2⤵
  PID:2364
- C:\Windows\System\VwIyGpX.exe
  C:\Windows\System\VwIyGpX.exe
  2⤵
  PID:2152
- C:\Windows\System\tSszhiP.exe
  C:\Windows\System\tSszhiP.exe
  2⤵
  PID:2568
- C:\Windows\System\lBGEObt.exe
  C:\Windows\System\lBGEObt.exe
  2⤵
  PID:1296
- C:\Windows\System\SnNOoWZ.exe
  C:\Windows\System\SnNOoWZ.exe
  2⤵
  PID:2592
- C:\Windows\System\ukFEUgd.exe
  C:\Windows\System\ukFEUgd.exe
  2⤵
  PID:2080
- C:\Windows\System\PCbwXEL.exe
  C:\Windows\System\PCbwXEL.exe
  2⤵
  PID:660
- C:\Windows\System\ikMtJhC.exe
  C:\Windows\System\ikMtJhC.exe
  2⤵
  PID:2656
- C:\Windows\System\PQyCrlI.exe
  C:\Windows\System\PQyCrlI.exe
  2⤵
  PID:1800
- C:\Windows\System\PazdrMP.exe
  C:\Windows\System\PazdrMP.exe
  2⤵
  PID:3092
- C:\Windows\System\UwFIORu.exe
  C:\Windows\System\UwFIORu.exe
  2⤵
  PID:3108
- C:\Windows\System\VYylMhw.exe
  C:\Windows\System\VYylMhw.exe
  2⤵
  PID:3124
- C:\Windows\System\XMfNUoh.exe
  C:\Windows\System\XMfNUoh.exe
  2⤵
  PID:3148
- C:\Windows\System\unFVhKt.exe
  C:\Windows\System\unFVhKt.exe
  2⤵
  PID:3164
- C:\Windows\System\GpwwbzC.exe
  C:\Windows\System\GpwwbzC.exe
  2⤵
  PID:3184
- C:\Windows\System\HvpEgeq.exe
  C:\Windows\System\HvpEgeq.exe
  2⤵
  PID:3204
- C:\Windows\System\JapZwQO.exe
  C:\Windows\System\JapZwQO.exe
  2⤵
  PID:3220
- C:\Windows\System\qeIZiwe.exe
  C:\Windows\System\qeIZiwe.exe
  2⤵
  PID:3240
- C:\Windows\System\qMhAGHA.exe
  C:\Windows\System\qMhAGHA.exe
  2⤵
  PID:3264
- C:\Windows\System\mjOxFKD.exe
  C:\Windows\System\mjOxFKD.exe
  2⤵
  PID:3280
- C:\Windows\System\lOlShqM.exe
  C:\Windows\System\lOlShqM.exe
  2⤵
  PID:3300
- C:\Windows\System\fQVExfS.exe
  C:\Windows\System\fQVExfS.exe
  2⤵
  PID:3316
- C:\Windows\System\FoBGjbD.exe
  C:\Windows\System\FoBGjbD.exe
  2⤵
  PID:3332
- C:\Windows\System\UXrHWYi.exe
  C:\Windows\System\UXrHWYi.exe
  2⤵
  PID:3352
- C:\Windows\System\lGHYTPm.exe
  C:\Windows\System\lGHYTPm.exe
  2⤵
  PID:3368
- C:\Windows\System\NukwWFn.exe
  C:\Windows\System\NukwWFn.exe
  2⤵
  PID:3388
- C:\Windows\System\gdixook.exe
  C:\Windows\System\gdixook.exe
  2⤵
  PID:3416
- C:\Windows\System\BgAKHyv.exe
  C:\Windows\System\BgAKHyv.exe
  2⤵
  PID:3436
- C:\Windows\System\zHoxQgl.exe
  C:\Windows\System\zHoxQgl.exe
  2⤵
  PID:3452
- C:\Windows\System\pgbPflj.exe
  C:\Windows\System\pgbPflj.exe
  2⤵
  PID:3468
- C:\Windows\System\HrxIcjl.exe
  C:\Windows\System\HrxIcjl.exe
  2⤵
  PID:3488
- C:\Windows\System\xxRHUOI.exe
  C:\Windows\System\xxRHUOI.exe
  2⤵
  PID:3520
- C:\Windows\System\pRdntsB.exe
  C:\Windows\System\pRdntsB.exe
  2⤵
  PID:3536
- C:\Windows\System\QaByqom.exe
  C:\Windows\System\QaByqom.exe
  2⤵
  PID:3552
- C:\Windows\System\kctmwrj.exe
  C:\Windows\System\kctmwrj.exe
  2⤵
  PID:3592
- C:\Windows\System\BSBGjXc.exe
  C:\Windows\System\BSBGjXc.exe
  2⤵
  PID:3608
- C:\Windows\System\tQdXYqV.exe
  C:\Windows\System\tQdXYqV.exe
  2⤵
  PID:3624
- C:\Windows\System\aAMMMQC.exe
  C:\Windows\System\aAMMMQC.exe
  2⤵
  PID:3644
- C:\Windows\System\ojErfip.exe
  C:\Windows\System\ojErfip.exe
  2⤵
  PID:3660
- C:\Windows\System\boMeKZl.exe
  C:\Windows\System\boMeKZl.exe
  2⤵
  PID:3680
- C:\Windows\System\wmwlxrH.exe
  C:\Windows\System\wmwlxrH.exe
  2⤵
  PID:3696
- C:\Windows\System\DVMsZVd.exe
  C:\Windows\System\DVMsZVd.exe
  2⤵
  PID:3712
- C:\Windows\System\MdLbmrC.exe
  C:\Windows\System\MdLbmrC.exe
  2⤵
  PID:3732
- C:\Windows\System\xvAXBnG.exe
  C:\Windows\System\xvAXBnG.exe
  2⤵
  PID:3788
- C:\Windows\System\WXHubcF.exe
  C:\Windows\System\WXHubcF.exe
  2⤵
  PID:3804
- C:\Windows\System\RgbefCh.exe
  C:\Windows\System\RgbefCh.exe
  2⤵
  PID:3820
- C:\Windows\System\ZJOfVok.exe
  C:\Windows\System\ZJOfVok.exe
  2⤵
  PID:3844
- C:\Windows\System\FsxZysZ.exe
  C:\Windows\System\FsxZysZ.exe
  2⤵
  PID:3864
- C:\Windows\System\SPDdgpH.exe
  C:\Windows\System\SPDdgpH.exe
  2⤵
  PID:3884
- C:\Windows\System\sVUsYUk.exe
  C:\Windows\System\sVUsYUk.exe
  2⤵
  PID:3908
- C:\Windows\System\VdiHQUb.exe
  C:\Windows\System\VdiHQUb.exe
  2⤵
  PID:3924
- C:\Windows\System\KTxwnat.exe
  C:\Windows\System\KTxwnat.exe
  2⤵
  PID:3940
- C:\Windows\System\rBLZGVq.exe
  C:\Windows\System\rBLZGVq.exe
  2⤵
  PID:3964
- C:\Windows\System\dmBTFnn.exe
  C:\Windows\System\dmBTFnn.exe
  2⤵
  PID:3980
- C:\Windows\System\oFoiWDc.exe
  C:\Windows\System\oFoiWDc.exe
  2⤵
  PID:4000
- C:\Windows\System\lAZQChk.exe
  C:\Windows\System\lAZQChk.exe
  2⤵
  PID:4020
- C:\Windows\System\nWwjSwg.exe
  C:\Windows\System\nWwjSwg.exe
  2⤵
  PID:4040
- C:\Windows\System\LnwEllj.exe
  C:\Windows\System\LnwEllj.exe
  2⤵
  PID:4060
- C:\Windows\System\QmGcCAv.exe
  C:\Windows\System\QmGcCAv.exe
  2⤵
  PID:4080
- C:\Windows\System\auVlAgQ.exe
  C:\Windows\System\auVlAgQ.exe
  2⤵
  PID:3076
- C:\Windows\System\jwRBHIG.exe
  C:\Windows\System\jwRBHIG.exe
  2⤵
  PID:2184
- C:\Windows\System\GYvaqsh.exe
  C:\Windows\System\GYvaqsh.exe
  2⤵
  PID:2632
- C:\Windows\System\JKngwtD.exe
  C:\Windows\System\JKngwtD.exe
  2⤵
  PID:2168
- C:\Windows\System\gRbcUci.exe
  C:\Windows\System\gRbcUci.exe
  2⤵
  PID:2572
- C:\Windows\System\wzatine.exe
  C:\Windows\System\wzatine.exe
  2⤵
  PID:3100
- C:\Windows\System\IcLmQlv.exe
  C:\Windows\System\IcLmQlv.exe
  2⤵
  PID:3144
- C:\Windows\System\megGLTo.exe
  C:\Windows\System\megGLTo.exe
  2⤵
  PID:3176
- C:\Windows\System\dtBrcwD.exe
  C:\Windows\System\dtBrcwD.exe
  2⤵
  PID:3172
- C:\Windows\System\gfWhsOT.exe
  C:\Windows\System\gfWhsOT.exe
  2⤵
  PID:3228
- C:\Windows\System\pczBgCo.exe
  C:\Windows\System\pczBgCo.exe
  2⤵
  PID:3308
- C:\Windows\System\kzxEJVA.exe
  C:\Windows\System\kzxEJVA.exe
  2⤵
  PID:3348
- C:\Windows\System\IPlJAhj.exe
  C:\Windows\System\IPlJAhj.exe
  2⤵
  PID:3428
- C:\Windows\System\BBJBxTa.exe
  C:\Windows\System\BBJBxTa.exe
  2⤵
  PID:3496
- C:\Windows\System\TnNfTyH.exe
  C:\Windows\System\TnNfTyH.exe
  2⤵
  PID:3408
- C:\Windows\System\TxQrhIy.exe
  C:\Windows\System\TxQrhIy.exe
  2⤵
  PID:3544
- C:\Windows\System\pdnVbHP.exe
  C:\Windows\System\pdnVbHP.exe
  2⤵
  PID:3476
- C:\Windows\System\OsRaCFg.exe
  C:\Windows\System\OsRaCFg.exe
  2⤵
  PID:3364
- C:\Windows\System\IRfSesU.exe
  C:\Windows\System\IRfSesU.exe
  2⤵
  PID:3560
- C:\Windows\System\pFYfKdZ.exe
  C:\Windows\System\pFYfKdZ.exe
  2⤵
  PID:3572
- C:\Windows\System\gzXfJMv.exe
  C:\Windows\System\gzXfJMv.exe
  2⤵
  PID:3632
- C:\Windows\System\dZkqqWA.exe
  C:\Windows\System\dZkqqWA.exe
  2⤵
  PID:3672
- C:\Windows\System\EBPkwZq.exe
  C:\Windows\System\EBPkwZq.exe
  2⤵
  PID:3656
- C:\Windows\System\KRJoPTO.exe
  C:\Windows\System\KRJoPTO.exe
  2⤵
  PID:3692
- C:\Windows\System\vTWDjQm.exe
  C:\Windows\System\vTWDjQm.exe
  2⤵
  PID:3768
- C:\Windows\System\AIMLiSk.exe
  C:\Windows\System\AIMLiSk.exe
  2⤵
  PID:3784
- C:\Windows\System\wTnUXKA.exe
  C:\Windows\System\wTnUXKA.exe
  2⤵
  PID:3828
- C:\Windows\System\jaiWOAf.exe
  C:\Windows\System\jaiWOAf.exe
  2⤵
  PID:3860
- C:\Windows\System\kdzuMhS.exe
  C:\Windows\System\kdzuMhS.exe
  2⤵
  PID:3892
- C:\Windows\System\BcpAQik.exe
  C:\Windows\System\BcpAQik.exe
  2⤵
  PID:3920
- C:\Windows\System\HZCkGIO.exe
  C:\Windows\System\HZCkGIO.exe
  2⤵
  PID:4008
- C:\Windows\System\BRsSZNE.exe
  C:\Windows\System\BRsSZNE.exe
  2⤵
  PID:4048
- C:\Windows\System\iNwOkPN.exe
  C:\Windows\System\iNwOkPN.exe
  2⤵
  PID:3960
- C:\Windows\System\rqldBzz.exe
  C:\Windows\System\rqldBzz.exe
  2⤵
  PID:4088
- C:\Windows\System\PhgLBrk.exe
  C:\Windows\System\PhgLBrk.exe
  2⤵
  PID:3080
- C:\Windows\System\areLPrp.exe
  C:\Windows\System\areLPrp.exe
  2⤵
  PID:3028
- C:\Windows\System\uZOyoyN.exe
  C:\Windows\System\uZOyoyN.exe
  2⤵
  PID:1056
- C:\Windows\System\ITNDHYd.exe
  C:\Windows\System\ITNDHYd.exe
  2⤵
  PID:3120
- C:\Windows\System\XxOSFIN.exe
  C:\Windows\System\XxOSFIN.exe
  2⤵
  PID:3160
- C:\Windows\System\QuXsaTv.exe
  C:\Windows\System\QuXsaTv.exe
  2⤵
  PID:3216
- C:\Windows\System\EihrYua.exe
  C:\Windows\System\EihrYua.exe
  2⤵
  PID:3276
- C:\Windows\System\jqEBkFx.exe
  C:\Windows\System\jqEBkFx.exe
  2⤵
  PID:3296
- C:\Windows\System\awXGGGy.exe
  C:\Windows\System\awXGGGy.exe
  2⤵
  PID:3500
- C:\Windows\System\psOXKMu.exe
  C:\Windows\System\psOXKMu.exe
  2⤵
  PID:3288
- C:\Windows\System\OHJbHxn.exe
  C:\Windows\System\OHJbHxn.exe
  2⤵
  PID:3328
- C:\Windows\System\kkoduvL.exe
  C:\Windows\System\kkoduvL.exe
  2⤵
  PID:3480
- C:\Windows\System\hwPABty.exe
  C:\Windows\System\hwPABty.exe
  2⤵
  PID:3604
- C:\Windows\System\VuiWDLn.exe
  C:\Windows\System\VuiWDLn.exe
  2⤵
  PID:3708
- C:\Windows\System\aeovGJy.exe
  C:\Windows\System\aeovGJy.exe
  2⤵
  PID:3728
- C:\Windows\System\KDxoHGg.exe
  C:\Windows\System\KDxoHGg.exe
  2⤵
  PID:3776
- C:\Windows\System\qpbyYeC.exe
  C:\Windows\System\qpbyYeC.exe
  2⤵
  PID:3836
- C:\Windows\System\XevogxE.exe
  C:\Windows\System\XevogxE.exe
  2⤵
  PID:3876
- C:\Windows\System\WyErzpc.exe
  C:\Windows\System\WyErzpc.exe
  2⤵
  PID:3976
- C:\Windows\System\fxpWngW.exe
  C:\Windows\System\fxpWngW.exe
  2⤵
  PID:3956
- C:\Windows\System\SeSqaxJ.exe
  C:\Windows\System\SeSqaxJ.exe
  2⤵
  PID:4028
- C:\Windows\System\IbnNdHI.exe
  C:\Windows\System\IbnNdHI.exe
  2⤵
  PID:2412
- C:\Windows\System\tDmsIit.exe
  C:\Windows\System\tDmsIit.exe
  2⤵
  PID:712
- C:\Windows\System\WhkRTlN.exe
  C:\Windows\System\WhkRTlN.exe
  2⤵
  PID:3200
- C:\Windows\System\nxWjiOy.exe
  C:\Windows\System\nxWjiOy.exe
  2⤵
  PID:3252
- C:\Windows\System\mykCDLs.exe
  C:\Windows\System\mykCDLs.exe
  2⤵
  PID:3340
- C:\Windows\System\liVYNvZ.exe
  C:\Windows\System\liVYNvZ.exe
  2⤵
  PID:3516
- C:\Windows\System\ytPpVFE.exe
  C:\Windows\System\ytPpVFE.exe
  2⤵
  PID:3324
- C:\Windows\System\THyJMNw.exe
  C:\Windows\System\THyJMNw.exe
  2⤵
  PID:3568
- C:\Windows\System\fikudWs.exe
  C:\Windows\System\fikudWs.exe
  2⤵
  PID:3616
- C:\Windows\System\YOTpOmW.exe
  C:\Windows\System\YOTpOmW.exe
  2⤵
  PID:3764
- C:\Windows\System\RrCaOAw.exe
  C:\Windows\System\RrCaOAw.exe
  2⤵
  PID:3872
- C:\Windows\System\IjpZoNV.exe
  C:\Windows\System\IjpZoNV.exe
  2⤵
  PID:3972
- C:\Windows\System\HXudzbB.exe
  C:\Windows\System\HXudzbB.exe
  2⤵
  PID:4056
- C:\Windows\System\nrriYEC.exe
  C:\Windows\System\nrriYEC.exe
  2⤵
  PID:1680
- C:\Windows\System\ospEQON.exe
  C:\Windows\System\ospEQON.exe
  2⤵
  PID:1760
- C:\Windows\System\bmLFoEC.exe
  C:\Windows\System\bmLFoEC.exe
  2⤵
  PID:3248
- C:\Windows\System\ZrnLyTP.exe
  C:\Windows\System\ZrnLyTP.exe
  2⤵
  PID:3580
- C:\Windows\System\ebSdckz.exe
  C:\Windows\System\ebSdckz.exe
  2⤵
  PID:3652
- C:\Windows\System\VjnWwMy.exe
  C:\Windows\System\VjnWwMy.exe
  2⤵
  PID:4032
- C:\Windows\System\qkGHUJw.exe
  C:\Windows\System\qkGHUJw.exe
  2⤵
  PID:3192
- C:\Windows\System\lidTWTE.exe
  C:\Windows\System\lidTWTE.exe
  2⤵
  PID:4076
- C:\Windows\System\JWHOIuJ.exe
  C:\Windows\System\JWHOIuJ.exe
  2⤵
  PID:3640
- C:\Windows\System\IQmPVKM.exe
  C:\Windows\System\IQmPVKM.exe
  2⤵
  PID:3380
- C:\Windows\System\bvlYPRS.exe
  C:\Windows\System\bvlYPRS.exe
  2⤵
  PID:3812
- C:\Windows\System\xWDmENs.exe
  C:\Windows\System\xWDmENs.exe
  2⤵
  PID:2012
- C:\Windows\System\KfnQFGP.exe
  C:\Windows\System\KfnQFGP.exe
  2⤵
  PID:4108
- C:\Windows\System\ncvolYI.exe
  C:\Windows\System\ncvolYI.exe
  2⤵
  PID:4124
- C:\Windows\System\tIJVQXA.exe
  C:\Windows\System\tIJVQXA.exe
  2⤵
  PID:4144
- C:\Windows\System\OshKHwX.exe
  C:\Windows\System\OshKHwX.exe
  2⤵
  PID:4160
- C:\Windows\System\cEsrzgh.exe
  C:\Windows\System\cEsrzgh.exe
  2⤵
  PID:4180
- C:\Windows\System\mPdrCpD.exe
  C:\Windows\System\mPdrCpD.exe
  2⤵
  PID:4204
- C:\Windows\System\zhAaUhf.exe
  C:\Windows\System\zhAaUhf.exe
  2⤵
  PID:4224
- C:\Windows\System\UVoeBJd.exe
  C:\Windows\System\UVoeBJd.exe
  2⤵
  PID:4248
- C:\Windows\System\IkAdrHU.exe
  C:\Windows\System\IkAdrHU.exe
  2⤵
  PID:4272
- C:\Windows\System\ayzGvNV.exe
  C:\Windows\System\ayzGvNV.exe
  2⤵
  PID:4288
- C:\Windows\System\bOMRZDn.exe
  C:\Windows\System\bOMRZDn.exe
  2⤵
  PID:4304
- C:\Windows\System\KREadFm.exe
  C:\Windows\System\KREadFm.exe
  2⤵
  PID:4324
- C:\Windows\System\ifPOaIc.exe
  C:\Windows\System\ifPOaIc.exe
  2⤵
  PID:4340
- C:\Windows\System\GlJsPkl.exe
  C:\Windows\System\GlJsPkl.exe
  2⤵
  PID:4356
- C:\Windows\System\xGlzUmN.exe
  C:\Windows\System\xGlzUmN.exe
  2⤵
  PID:4376
- C:\Windows\System\BRBVmXS.exe
  C:\Windows\System\BRBVmXS.exe
  2⤵
  PID:4396
- C:\Windows\System\sISabIr.exe
  C:\Windows\System\sISabIr.exe
  2⤵
  PID:4412
- C:\Windows\System\KMqKWky.exe
  C:\Windows\System\KMqKWky.exe
  2⤵
  PID:4428
- C:\Windows\System\QObIcXD.exe
  C:\Windows\System\QObIcXD.exe
  2⤵
  PID:4448
- C:\Windows\System\HBRtyQx.exe
  C:\Windows\System\HBRtyQx.exe
  2⤵
  PID:4464
- C:\Windows\System\YGIvJtJ.exe
  C:\Windows\System\YGIvJtJ.exe
  2⤵
  PID:4484
- C:\Windows\System\UrSSPTA.exe
  C:\Windows\System\UrSSPTA.exe
  2⤵
  PID:4500
- C:\Windows\System\bWJtLTh.exe
  C:\Windows\System\bWJtLTh.exe
  2⤵
  PID:4516
- C:\Windows\System\XFEYpaw.exe
  C:\Windows\System\XFEYpaw.exe
  2⤵
  PID:4536
- C:\Windows\System\zZzzjMV.exe
  C:\Windows\System\zZzzjMV.exe
  2⤵
  PID:4556
- C:\Windows\System\LsLEJGP.exe
  C:\Windows\System\LsLEJGP.exe
  2⤵
  PID:4572
- C:\Windows\System\lsVYRSr.exe
  C:\Windows\System\lsVYRSr.exe
  2⤵
  PID:4592
- C:\Windows\System\DaMpcye.exe
  C:\Windows\System\DaMpcye.exe
  2⤵
  PID:4612
- C:\Windows\System\ADyUtMO.exe
  C:\Windows\System\ADyUtMO.exe
  2⤵
  PID:4628
- C:\Windows\System\JIRdRUH.exe
  C:\Windows\System\JIRdRUH.exe
  2⤵
  PID:4648
- C:\Windows\System\gQEewhH.exe
  C:\Windows\System\gQEewhH.exe
  2⤵
  PID:4664
- C:\Windows\System\QDcuhpq.exe
  C:\Windows\System\QDcuhpq.exe
  2⤵
  PID:4740
- C:\Windows\System\nUCttkh.exe
  C:\Windows\System\nUCttkh.exe
  2⤵
  PID:4756
- C:\Windows\System\xfbzwKN.exe
  C:\Windows\System\xfbzwKN.exe
  2⤵
  PID:4776
- C:\Windows\System\iGfEidq.exe
  C:\Windows\System\iGfEidq.exe
  2⤵
  PID:4796
- C:\Windows\System\aeiNlNg.exe
  C:\Windows\System\aeiNlNg.exe
  2⤵
  PID:4816
- C:\Windows\System\JBXuJQq.exe
  C:\Windows\System\JBXuJQq.exe
  2⤵
  PID:4832
- C:\Windows\System\gSFakaE.exe
  C:\Windows\System\gSFakaE.exe
  2⤵
  PID:4848
- C:\Windows\System\xitQwuV.exe
  C:\Windows\System\xitQwuV.exe
  2⤵
  PID:4868
- C:\Windows\System\KKNtfEW.exe
  C:\Windows\System\KKNtfEW.exe
  2⤵
  PID:4884
- C:\Windows\System\wBxEAXe.exe
  C:\Windows\System\wBxEAXe.exe
  2⤵
  PID:4904
- C:\Windows\System\DdlSxSR.exe
  C:\Windows\System\DdlSxSR.exe
  2⤵
  PID:4920
- C:\Windows\System\bgTpCED.exe
  C:\Windows\System\bgTpCED.exe
  2⤵
  PID:4944
- C:\Windows\System\VEmSnsf.exe
  C:\Windows\System\VEmSnsf.exe
  2⤵
  PID:4960
- C:\Windows\System\tQBNlnT.exe
  C:\Windows\System\tQBNlnT.exe
  2⤵
  PID:4976
- C:\Windows\System\xrISAlj.exe
  C:\Windows\System\xrISAlj.exe
  2⤵
  PID:5020
- C:\Windows\System\EVuexKp.exe
  C:\Windows\System\EVuexKp.exe
  2⤵
  PID:5036
- C:\Windows\System\gOhZZSy.exe
  C:\Windows\System\gOhZZSy.exe
  2⤵
  PID:5056
- C:\Windows\System\qgcATHM.exe
  C:\Windows\System\qgcATHM.exe
  2⤵
  PID:5072
- C:\Windows\System\ByGQNGp.exe
  C:\Windows\System\ByGQNGp.exe
  2⤵
  PID:5092
- C:\Windows\System\MqLlDAL.exe
  C:\Windows\System\MqLlDAL.exe
  2⤵
  PID:5108
- C:\Windows\System\OqWpceb.exe
  C:\Windows\System\OqWpceb.exe
  2⤵
  PID:3688
- C:\Windows\System\lRqZhFM.exe
  C:\Windows\System\lRqZhFM.exe
  2⤵
  PID:3236
- C:\Windows\System\oHxrOKt.exe
  C:\Windows\System\oHxrOKt.exe
  2⤵
  PID:4132
- C:\Windows\System\zedYrUl.exe
  C:\Windows\System\zedYrUl.exe
  2⤵
  PID:3952
- C:\Windows\System\AgChFgr.exe
  C:\Windows\System\AgChFgr.exe
  2⤵
  PID:4152
- C:\Windows\System\XPgHadg.exe
  C:\Windows\System\XPgHadg.exe
  2⤵
  PID:4200
- C:\Windows\System\BrYnZYq.exe
  C:\Windows\System\BrYnZYq.exe
  2⤵
  PID:4220
- C:\Windows\System\qIDuJmG.exe
  C:\Windows\System\qIDuJmG.exe
  2⤵
  PID:4264
- C:\Windows\System\bzXVxFI.exe
  C:\Windows\System\bzXVxFI.exe
  2⤵
  PID:4444
- C:\Windows\System\gZDkMmp.exe
  C:\Windows\System\gZDkMmp.exe
  2⤵
  PID:4508
- C:\Windows\System\gJMYcRF.exe
  C:\Windows\System\gJMYcRF.exe
  2⤵
  PID:4588
- C:\Windows\System\wQjMRDh.exe
  C:\Windows\System\wQjMRDh.exe
  2⤵
  PID:4660
- C:\Windows\System\CDBGUEI.exe
  C:\Windows\System\CDBGUEI.exe
  2⤵
  PID:4316
- C:\Windows\System\bcHiGgK.exe
  C:\Windows\System\bcHiGgK.exe
  2⤵
  PID:4688
- C:\Windows\System\PARQAJZ.exe
  C:\Windows\System\PARQAJZ.exe
  2⤵
  PID:4696
- C:\Windows\System\obDtSoS.exe
  C:\Windows\System\obDtSoS.exe
  2⤵
  PID:4392
- C:\Windows\System\LQdgcCJ.exe
  C:\Windows\System\LQdgcCJ.exe
  2⤵
  PID:4460
- C:\Windows\System\XENkNmG.exe
  C:\Windows\System\XENkNmG.exe
  2⤵
  PID:4524
- C:\Windows\System\niMWtzB.exe
  C:\Windows\System\niMWtzB.exe
  2⤵
  PID:4720
- C:\Windows\System\SwKoyGr.exe
  C:\Windows\System\SwKoyGr.exe
  2⤵
  PID:4728
- C:\Windows\System\tGEMQdy.exe
  C:\Windows\System\tGEMQdy.exe
  2⤵
  PID:4672
- C:\Windows\System\aYIHLCq.exe
  C:\Windows\System\aYIHLCq.exe
  2⤵
  PID:4732
- C:\Windows\System\iEZFKKo.exe
  C:\Windows\System\iEZFKKo.exe
  2⤵
  PID:4784
- C:\Windows\System\hFEIleZ.exe
  C:\Windows\System\hFEIleZ.exe
  2⤵
  PID:4824
- C:\Windows\System\JDcxKRB.exe
  C:\Windows\System\JDcxKRB.exe
  2⤵
  PID:4896
- C:\Windows\System\XKrnwxH.exe
  C:\Windows\System\XKrnwxH.exe
  2⤵
  PID:4968
- C:\Windows\System\kjTfgvm.exe
  C:\Windows\System\kjTfgvm.exe
  2⤵
  PID:4804
- C:\Windows\System\MFytQdc.exe
  C:\Windows\System\MFytQdc.exe
  2⤵
  PID:4840
- C:\Windows\System\ERDUhQF.exe
  C:\Windows\System\ERDUhQF.exe
  2⤵
  PID:5028
- C:\Windows\System\CNJwuCR.exe
  C:\Windows\System\CNJwuCR.exe
  2⤵
  PID:5068
- C:\Windows\System\rgWRDLT.exe
  C:\Windows\System\rgWRDLT.exe
  2⤵
  PID:4140
- C:\Windows\System\MTjfzJM.exe
  C:\Windows\System\MTjfzJM.exe
  2⤵
  PID:4196
- C:\Windows\System\sumnXMd.exe
  C:\Windows\System\sumnXMd.exe
  2⤵
  PID:5016
- C:\Windows\System\aalZuNZ.exe
  C:\Windows\System\aalZuNZ.exe
  2⤵
  PID:5012
- C:\Windows\System\wlZQhPX.exe
  C:\Windows\System\wlZQhPX.exe
  2⤵
  PID:3816
- C:\Windows\System\jCqPfPn.exe
  C:\Windows\System\jCqPfPn.exe
  2⤵
  PID:4116
- C:\Windows\System\sAJUZPP.exe
  C:\Windows\System\sAJUZPP.exe
  2⤵
  PID:5052
- C:\Windows\System\TyeiVPL.exe
  C:\Windows\System\TyeiVPL.exe
  2⤵
  PID:4332
- C:\Windows\System\yXSMumn.exe
  C:\Windows\System\yXSMumn.exe
  2⤵
  PID:4404
- C:\Windows\System\aoikIJm.exe
  C:\Windows\System\aoikIJm.exe
  2⤵
  PID:4624
- C:\Windows\System\mahzIAu.exe
  C:\Windows\System\mahzIAu.exe
  2⤵
  PID:4420
- C:\Windows\System\gODrMEz.exe
  C:\Windows\System\gODrMEz.exe
  2⤵
  PID:4548
- C:\Windows\System\DudnYxu.exe
  C:\Windows\System\DudnYxu.exe
  2⤵
  PID:4456
- C:\Windows\System\LvSIZiQ.exe
  C:\Windows\System\LvSIZiQ.exe
  2⤵
  PID:4768
- C:\Windows\System\eQGDHhX.exe
  C:\Windows\System\eQGDHhX.exe
  2⤵
  PID:4932
- C:\Windows\System\APyKLaA.exe
  C:\Windows\System\APyKLaA.exe
  2⤵
  PID:4916
- C:\Windows\System\enwzylM.exe
  C:\Windows\System\enwzylM.exe
  2⤵
  PID:4532
- C:\Windows\System\obOKFuy.exe
  C:\Windows\System\obOKFuy.exe
  2⤵
  PID:4892
- C:\Windows\System\xQuYMiM.exe
  C:\Windows\System\xQuYMiM.exe
  2⤵
  PID:4988
- C:\Windows\System\zDmeDhZ.exe
  C:\Windows\System\zDmeDhZ.exe
  2⤵
  PID:4192
- C:\Windows\System\hMuNZZa.exe
  C:\Windows\System\hMuNZZa.exe
  2⤵
  PID:4748
- C:\Windows\System\RLOtbjh.exe
  C:\Windows\System\RLOtbjh.exe
  2⤵
  PID:4544
- C:\Windows\System\KZJqmEV.exe
  C:\Windows\System\KZJqmEV.exe
  2⤵
  PID:4704
- C:\Windows\System\AWuqfoy.exe
  C:\Windows\System\AWuqfoy.exe
  2⤵
  PID:4680
- C:\Windows\System\bGpYIWT.exe
  C:\Windows\System\bGpYIWT.exe
  2⤵
  PID:4212
- C:\Windows\System\KMYIUQt.exe
  C:\Windows\System\KMYIUQt.exe
  2⤵
  PID:4724
- C:\Windows\System\RRRIRZC.exe
  C:\Windows\System\RRRIRZC.exe
  2⤵
  PID:4368
- C:\Windows\System\vHVaCdb.exe
  C:\Windows\System\vHVaCdb.exe
  2⤵
  PID:4492
- C:\Windows\System\ZWTWtOe.exe
  C:\Windows\System\ZWTWtOe.exe
  2⤵
  PID:4928
- C:\Windows\System\aOENZDa.exe
  C:\Windows\System\aOENZDa.exe
  2⤵
  PID:4312
- C:\Windows\System\AmqGVfC.exe
  C:\Windows\System\AmqGVfC.exe
  2⤵
  PID:5008
- C:\Windows\System\dEKurZG.exe
  C:\Windows\System\dEKurZG.exe
  2⤵
  PID:4172
- C:\Windows\System\ohWzpOT.exe
  C:\Windows\System\ohWzpOT.exe
  2⤵
  PID:4912
- C:\Windows\System\MhsyfNO.exe
  C:\Windows\System\MhsyfNO.exe
  2⤵
  PID:4684
- C:\Windows\System\loDEVoI.exe
  C:\Windows\System\loDEVoI.exe
  2⤵
  PID:4260
- C:\Windows\System\akslvRk.exe
  C:\Windows\System\akslvRk.exe
  2⤵
  PID:4476
- C:\Windows\System\VIPteND.exe
  C:\Windows\System\VIPteND.exe
  2⤵
  PID:4716
- C:\Windows\System\kBdtkkI.exe
  C:\Windows\System\kBdtkkI.exe
  2⤵
  PID:4584
- C:\Windows\System\plZxZwx.exe
  C:\Windows\System\plZxZwx.exe
  2⤵
  PID:5116
- C:\Windows\System\WJkbUSz.exe
  C:\Windows\System\WJkbUSz.exe
  2⤵
  PID:4372
- C:\Windows\System\TkYmDaJ.exe
  C:\Windows\System\TkYmDaJ.exe
  2⤵
  PID:4496
- C:\Windows\System\dwROniW.exe
  C:\Windows\System\dwROniW.exe
  2⤵
  PID:4712
- C:\Windows\System\yuPOvfU.exe
  C:\Windows\System\yuPOvfU.exe
  2⤵
  PID:4284
- C:\Windows\System\VNAXRLH.exe
  C:\Windows\System\VNAXRLH.exe
  2⤵
  PID:4828
- C:\Windows\System\AoEkJwS.exe
  C:\Windows\System\AoEkJwS.exe
  2⤵
  PID:4236
- C:\Windows\System\dkKjhOX.exe
  C:\Windows\System\dkKjhOX.exe
  2⤵
  PID:5136
- C:\Windows\System\msPwZle.exe
  C:\Windows\System\msPwZle.exe
  2⤵
  PID:5156
- C:\Windows\System\FGuXFLs.exe
  C:\Windows\System\FGuXFLs.exe
  2⤵
  PID:5172
- C:\Windows\System\BoKggxl.exe
  C:\Windows\System\BoKggxl.exe
  2⤵
  PID:5188
- C:\Windows\System\OqQDZge.exe
  C:\Windows\System\OqQDZge.exe
  2⤵
  PID:5208
- C:\Windows\System\AblFXNa.exe
  C:\Windows\System\AblFXNa.exe
  2⤵
  PID:5224
- C:\Windows\System\YlyzcyM.exe
  C:\Windows\System\YlyzcyM.exe
  2⤵
  PID:5260
- C:\Windows\System\dkAhTqP.exe
  C:\Windows\System\dkAhTqP.exe
  2⤵
  PID:5280
- C:\Windows\System\CpWcPDK.exe
  C:\Windows\System\CpWcPDK.exe
  2⤵
  PID:5296
- C:\Windows\System\lrKfPwU.exe
  C:\Windows\System\lrKfPwU.exe
  2⤵
  PID:5316
- C:\Windows\System\AFSTotM.exe
  C:\Windows\System\AFSTotM.exe
  2⤵
  PID:5340
- C:\Windows\System\RHIeIxt.exe
  C:\Windows\System\RHIeIxt.exe
  2⤵
  PID:5356
- C:\Windows\System\FkJDwbc.exe
  C:\Windows\System\FkJDwbc.exe
  2⤵
  PID:5372
- C:\Windows\System\tfmTxWA.exe
  C:\Windows\System\tfmTxWA.exe
  2⤵
  PID:5388
- C:\Windows\System\yYCGjkw.exe
  C:\Windows\System\yYCGjkw.exe
  2⤵
  PID:5404
- C:\Windows\System\ykSEouH.exe
  C:\Windows\System\ykSEouH.exe
  2⤵
  PID:5420
- C:\Windows\System\wTQikHu.exe
  C:\Windows\System\wTQikHu.exe
  2⤵
  PID:5460
- C:\Windows\System\ptQJfHC.exe
  C:\Windows\System\ptQJfHC.exe
  2⤵
  PID:5484
- C:\Windows\System\qoqWDrX.exe
  C:\Windows\System\qoqWDrX.exe
  2⤵
  PID:5500
- C:\Windows\System\PXqNxfu.exe
  C:\Windows\System\PXqNxfu.exe
  2⤵
  PID:5516
- C:\Windows\System\Lguuzdq.exe
  C:\Windows\System\Lguuzdq.exe
  2⤵
  PID:5536
- C:\Windows\System\mQwkapo.exe
  C:\Windows\System\mQwkapo.exe
  2⤵
  PID:5552
- C:\Windows\System\SPNogUc.exe
  C:\Windows\System\SPNogUc.exe
  2⤵
  PID:5572
- C:\Windows\System\VyadvCK.exe
  C:\Windows\System\VyadvCK.exe
  2⤵
  PID:5588
- C:\Windows\System\MHtMKLu.exe
  C:\Windows\System\MHtMKLu.exe
  2⤵
  PID:5612
- C:\Windows\System\QrqmNaw.exe
  C:\Windows\System\QrqmNaw.exe
  2⤵
  PID:5632
- C:\Windows\System\LGXcOiN.exe
  C:\Windows\System\LGXcOiN.exe
  2⤵
  PID:5652
- C:\Windows\System\QdUdwHg.exe
  C:\Windows\System\QdUdwHg.exe
  2⤵
  PID:5668
- C:\Windows\System\CFvJIWu.exe
  C:\Windows\System\CFvJIWu.exe
  2⤵
  PID:5688
- C:\Windows\System\tkDcUKy.exe
  C:\Windows\System\tkDcUKy.exe
  2⤵
  PID:5712
- C:\Windows\System\TNHWbvN.exe
  C:\Windows\System\TNHWbvN.exe
  2⤵
  PID:5728
- C:\Windows\System\uXxFpKV.exe
  C:\Windows\System\uXxFpKV.exe
  2⤵
  PID:5744
- C:\Windows\System\TgaFlXY.exe
  C:\Windows\System\TgaFlXY.exe
  2⤵
  PID:5764
- C:\Windows\System\DBIxmgN.exe
  C:\Windows\System\DBIxmgN.exe
  2⤵
  PID:5780
- C:\Windows\System\eRrbQtb.exe
  C:\Windows\System\eRrbQtb.exe
  2⤵
  PID:5800
- C:\Windows\System\iXVcMxo.exe
  C:\Windows\System\iXVcMxo.exe
  2⤵
  PID:5824
- C:\Windows\System\tJRyocN.exe
  C:\Windows\System\tJRyocN.exe
  2⤵
  PID:5848
- C:\Windows\System\FoHSXTj.exe
  C:\Windows\System\FoHSXTj.exe
  2⤵
  PID:5868
- C:\Windows\System\MuBTaku.exe
  C:\Windows\System\MuBTaku.exe
  2⤵
  PID:5884
- C:\Windows\System\PJSrETD.exe
  C:\Windows\System\PJSrETD.exe
  2⤵
  PID:5900
- C:\Windows\System\RLhFuAY.exe
  C:\Windows\System\RLhFuAY.exe
  2⤵
  PID:5920
- C:\Windows\System\ZMiwedX.exe
  C:\Windows\System\ZMiwedX.exe
  2⤵
  PID:5936
- C:\Windows\System\xBQMwpK.exe
  C:\Windows\System\xBQMwpK.exe
  2⤵
  PID:5956
- C:\Windows\System\VqJUvka.exe
  C:\Windows\System\VqJUvka.exe
  2⤵
  PID:5976
- C:\Windows\System\YfIVyLp.exe
  C:\Windows\System\YfIVyLp.exe
  2⤵
  PID:5996
- C:\Windows\System\NcFKaaI.exe
  C:\Windows\System\NcFKaaI.exe
  2⤵
  PID:6020
- C:\Windows\System\YhUifpB.exe
  C:\Windows\System\YhUifpB.exe
  2⤵
  PID:6036
- C:\Windows\System\uITpIrt.exe
  C:\Windows\System\uITpIrt.exe
  2⤵
  PID:6052
- C:\Windows\System\YUjIojK.exe
  C:\Windows\System\YUjIojK.exe
  2⤵
  PID:6072
- C:\Windows\System\qHHrfTk.exe
  C:\Windows\System\qHHrfTk.exe
  2⤵
  PID:6092
- C:\Windows\System\EaigBiU.exe
  C:\Windows\System\EaigBiU.exe
  2⤵
  PID:6112
- C:\Windows\System\hoWLZwS.exe
  C:\Windows\System\hoWLZwS.exe
  2⤵
  PID:6128
- C:\Windows\System\lINokkP.exe
  C:\Windows\System\lINokkP.exe
  2⤵
  PID:4936
- C:\Windows\System\RDGSATC.exe
  C:\Windows\System\RDGSATC.exe
  2⤵
  PID:3936
- C:\Windows\System\VzDPljp.exe
  C:\Windows\System\VzDPljp.exe
  2⤵
  PID:5200
- C:\Windows\System\qHCqAdK.exe
  C:\Windows\System\qHCqAdK.exe
  2⤵
  PID:4656
- C:\Windows\System\xtmKMcS.exe
  C:\Windows\System\xtmKMcS.exe
  2⤵
  PID:5104
- C:\Windows\System\AawZxOF.exe
  C:\Windows\System\AawZxOF.exe
  2⤵
  PID:5184
- C:\Windows\System\cJuPHPb.exe
  C:\Windows\System\cJuPHPb.exe
  2⤵
  PID:5248
- C:\Windows\System\YAsdxPN.exe
  C:\Windows\System\YAsdxPN.exe
  2⤵
  PID:5292
- C:\Windows\System\mNiEFMn.exe
  C:\Windows\System\mNiEFMn.exe
  2⤵
  PID:5368
- C:\Windows\System\xAoXTlL.exe
  C:\Windows\System\xAoXTlL.exe
  2⤵
  PID:5312
- C:\Windows\System\OMAEiLa.exe
  C:\Windows\System\OMAEiLa.exe
  2⤵
  PID:5440
- C:\Windows\System\huVLBPP.exe
  C:\Windows\System\huVLBPP.exe
  2⤵
  PID:5456
- C:\Windows\System\ouWaVRR.exe
  C:\Windows\System\ouWaVRR.exe
  2⤵
  PID:5384
- C:\Windows\System\satDOhZ.exe
  C:\Windows\System\satDOhZ.exe
  2⤵
  PID:5480
- C:\Windows\System\oXyvzyL.exe
  C:\Windows\System\oXyvzyL.exe
  2⤵
  PID:5524
- C:\Windows\System\SYKmlat.exe
  C:\Windows\System\SYKmlat.exe
  2⤵
  PID:5568
- C:\Windows\System\aGJthyP.exe
  C:\Windows\System\aGJthyP.exe
  2⤵
  PID:5644
- C:\Windows\System\WosVgcf.exe
  C:\Windows\System\WosVgcf.exe
  2⤵
  PID:5720
- C:\Windows\System\oCiXzsH.exe
  C:\Windows\System\oCiXzsH.exe
  2⤵
  PID:5844
- C:\Windows\System\EEefPhI.exe
  C:\Windows\System\EEefPhI.exe
  2⤵
  PID:5952
- C:\Windows\System\WQIIrgS.exe
  C:\Windows\System\WQIIrgS.exe
  2⤵
  PID:6028
- C:\Windows\System\HcckmEk.exe
  C:\Windows\System\HcckmEk.exe
  2⤵
  PID:6068
- C:\Windows\System\PxZqNAS.exe
  C:\Windows\System\PxZqNAS.exe
  2⤵
  PID:6140
- C:\Windows\System\PlaUgqv.exe
  C:\Windows\System\PlaUgqv.exe
  2⤵
  PID:5580
- C:\Windows\System\solwpDR.exe
  C:\Windows\System\solwpDR.exe
  2⤵
  PID:4792
- C:\Windows\System\ldaEzfi.exe
  C:\Windows\System\ldaEzfi.exe
  2⤵
  PID:5332
- C:\Windows\System\QuxFLRe.exe
  C:\Windows\System\QuxFLRe.exe
  2⤵
  PID:5396
- C:\Windows\System\pfLVDtc.exe
  C:\Windows\System\pfLVDtc.exe
  2⤵
  PID:5492
- C:\Windows\System\wqsSpiA.exe
  C:\Windows\System\wqsSpiA.exe
  2⤵
  PID:5816
- C:\Windows\System\lWcnjkM.exe
  C:\Windows\System\lWcnjkM.exe
  2⤵
  PID:5660
- C:\Windows\System\ZCFnCJg.exe
  C:\Windows\System\ZCFnCJg.exe
  2⤵
  PID:5788
- C:\Windows\System\equCIzm.exe
  C:\Windows\System\equCIzm.exe
  2⤵
  PID:5708
- C:\Windows\System\QicPMPF.exe
  C:\Windows\System\QicPMPF.exe
  2⤵
  PID:5796
- C:\Windows\System\MpUfIqX.exe
  C:\Windows\System\MpUfIqX.exe
  2⤵
  PID:5740
- C:\Windows\System\MsRAWVc.exe
  C:\Windows\System\MsRAWVc.exe
  2⤵
  PID:5776
- C:\Windows\System\roQyDyA.exe
  C:\Windows\System\roQyDyA.exe
  2⤵
  PID:5812
- C:\Windows\System\SfNkQfY.exe
  C:\Windows\System\SfNkQfY.exe
  2⤵
  PID:5664
- C:\Windows\System\TWyBWvX.exe
  C:\Windows\System\TWyBWvX.exe
  2⤵
  PID:4352
- C:\Windows\System\onJVpxy.exe
  C:\Windows\System\onJVpxy.exe
  2⤵
  PID:5928
- C:\Windows\System\cIyfHHn.exe
  C:\Windows\System\cIyfHHn.exe
  2⤵
  PID:6124
- C:\Windows\System\FlUnpBx.exe
  C:\Windows\System\FlUnpBx.exe
  2⤵
  PID:5304
- C:\Windows\System\chnLZUV.exe
  C:\Windows\System\chnLZUV.exe
  2⤵
  PID:5476
- C:\Windows\System\xhfrDQB.exe
  C:\Windows\System\xhfrDQB.exe
  2⤵
  PID:5680
- C:\Windows\System\tZPVQvb.exe
  C:\Windows\System\tZPVQvb.exe
  2⤵
  PID:6104
- C:\Windows\System\zjHtEkU.exe
  C:\Windows\System\zjHtEkU.exe
  2⤵
  PID:5620
- C:\Windows\System\HGqUeIN.exe
  C:\Windows\System\HGqUeIN.exe
  2⤵
  PID:5328
- C:\Windows\System\ttmLzkF.exe
  C:\Windows\System\ttmLzkF.exe
  2⤵
  PID:5912
- C:\Windows\System\oIlWjgi.exe
  C:\Windows\System\oIlWjgi.exe
  2⤵
  PID:5244
- C:\Windows\System\BCrXYVl.exe
  C:\Windows\System\BCrXYVl.exe
  2⤵
  PID:5772
- C:\Windows\System\BOfgYQS.exe
  C:\Windows\System\BOfgYQS.exe
  2⤵
  PID:5856
- C:\Windows\System\fNfKims.exe
  C:\Windows\System\fNfKims.exe
  2⤵
  PID:5348
- C:\Windows\System\akSYRik.exe
  C:\Windows\System\akSYRik.exe
  2⤵
  PID:5236
- C:\Windows\System\aJyYbFj.exe
  C:\Windows\System\aJyYbFj.exe
  2⤵
  PID:5256
- C:\Windows\System\LDSDlxR.exe
  C:\Windows\System\LDSDlxR.exe
  2⤵
  PID:5268
- C:\Windows\System\qGIFEGB.exe
  C:\Windows\System\qGIFEGB.exe
  2⤵
  PID:5436
- C:\Windows\System\aPVMbAD.exe
  C:\Windows\System\aPVMbAD.exe
  2⤵
  PID:5972
- C:\Windows\System\QrgOlzL.exe
  C:\Windows\System\QrgOlzL.exe
  2⤵
  PID:6084
- C:\Windows\System\CFgWJPO.exe
  C:\Windows\System\CFgWJPO.exe
  2⤵
  PID:5932
- C:\Windows\System\DkbCxUY.exe
  C:\Windows\System\DkbCxUY.exe
  2⤵
  PID:5908
- C:\Windows\System\fwUIKYc.exe
  C:\Windows\System\fwUIKYc.exe
  2⤵
  PID:5880
- C:\Windows\System\GNEmVcx.exe
  C:\Windows\System\GNEmVcx.exe
  2⤵
  PID:5836
- C:\Windows\System\XXvecZn.exe
  C:\Windows\System\XXvecZn.exe
  2⤵
  PID:5152
- C:\Windows\System\APzMOsR.exe
  C:\Windows\System\APzMOsR.exe
  2⤵
  PID:5608
- C:\Windows\System\BQhJuQz.exe
  C:\Windows\System\BQhJuQz.exe
  2⤵
  PID:5508
- C:\Windows\System\OEpbVxJ.exe
  C:\Windows\System\OEpbVxJ.exe
  2⤵
  PID:5640
- C:\Windows\System\SBLntGa.exe
  C:\Windows\System\SBLntGa.exe
  2⤵
  PID:5564
- C:\Windows\System\DJdNsbE.exe
  C:\Windows\System\DJdNsbE.exe
  2⤵
  PID:5992
- C:\Windows\System\YRTSihw.exe
  C:\Windows\System\YRTSihw.exe
  2⤵
  PID:5196
- C:\Windows\System\fAxGjYE.exe
  C:\Windows\System\fAxGjYE.exe
  2⤵
  PID:5964
- C:\Windows\System\WXGSPGm.exe
  C:\Windows\System\WXGSPGm.exe
  2⤵
  PID:5472
- C:\Windows\System\kAhdiEC.exe
  C:\Windows\System\kAhdiEC.exe
  2⤵
  PID:6004
- C:\Windows\System\EJMqMOq.exe
  C:\Windows\System\EJMqMOq.exe
  2⤵
  PID:5948
- C:\Windows\System\imCSsIC.exe
  C:\Windows\System\imCSsIC.exe
  2⤵
  PID:5240
- C:\Windows\System\FwaqOHW.exe
  C:\Windows\System\FwaqOHW.exe
  2⤵
  PID:6136
- C:\Windows\System\toIhxpy.exe
  C:\Windows\System\toIhxpy.exe
  2⤵
  PID:6016
- C:\Windows\System\GVQxwiP.exe
  C:\Windows\System\GVQxwiP.exe
  2⤵
  PID:6156
- C:\Windows\System\CKJLeUf.exe
  C:\Windows\System\CKJLeUf.exe
  2⤵
  PID:6172
- C:\Windows\System\MjuXgCh.exe
  C:\Windows\System\MjuXgCh.exe
  2⤵
  PID:6196
- C:\Windows\System\fGEmUgJ.exe
  C:\Windows\System\fGEmUgJ.exe
  2⤵
  PID:6216
- C:\Windows\System\yxboaSo.exe
  C:\Windows\System\yxboaSo.exe
  2⤵
  PID:6236
- C:\Windows\System\Jtdkdui.exe
  C:\Windows\System\Jtdkdui.exe
  2⤵
  PID:6256
- C:\Windows\System\RnUoFWw.exe
  C:\Windows\System\RnUoFWw.exe
  2⤵
  PID:6276
- C:\Windows\System\PXeUnpM.exe
  C:\Windows\System\PXeUnpM.exe
  2⤵
  PID:6296
- C:\Windows\System\viGEert.exe
  C:\Windows\System\viGEert.exe
  2⤵
  PID:6316
- C:\Windows\System\UtvmCBp.exe
  C:\Windows\System\UtvmCBp.exe
  2⤵
  PID:6332
- C:\Windows\System\sZCCnre.exe
  C:\Windows\System\sZCCnre.exe
  2⤵
  PID:6352
- C:\Windows\System\KXppUzj.exe
  C:\Windows\System\KXppUzj.exe
  2⤵
  PID:6372
- C:\Windows\System\vEfjohz.exe
  C:\Windows\System\vEfjohz.exe
  2⤵
  PID:6396
- C:\Windows\System\WMwCqsT.exe
  C:\Windows\System\WMwCqsT.exe
  2⤵
  PID:6420
- C:\Windows\System\OVPcAxY.exe
  C:\Windows\System\OVPcAxY.exe
  2⤵
  PID:6444
- C:\Windows\System\tJYmPNa.exe
  C:\Windows\System\tJYmPNa.exe
  2⤵
  PID:6460
- C:\Windows\System\MUqRZUQ.exe
  C:\Windows\System\MUqRZUQ.exe
  2⤵
  PID:6476
- C:\Windows\System\RAyCWlS.exe
  C:\Windows\System\RAyCWlS.exe
  2⤵
  PID:6496
- C:\Windows\System\DKgyfzI.exe
  C:\Windows\System\DKgyfzI.exe
  2⤵
  PID:6520
- C:\Windows\System\GxBfoTR.exe
  C:\Windows\System\GxBfoTR.exe
  2⤵
  PID:6536
- C:\Windows\System\DJdMkQg.exe
  C:\Windows\System\DJdMkQg.exe
  2⤵
  PID:6552
- C:\Windows\System\bnDoBjG.exe
  C:\Windows\System\bnDoBjG.exe
  2⤵
  PID:6568
- C:\Windows\System\TfmepHa.exe
  C:\Windows\System\TfmepHa.exe
  2⤵
  PID:6584
- C:\Windows\System\JgJNGcV.exe
  C:\Windows\System\JgJNGcV.exe
  2⤵
  PID:6600
- C:\Windows\System\ZVQuxqu.exe
  C:\Windows\System\ZVQuxqu.exe
  2⤵
  PID:6616
- C:\Windows\System\sMSgMLu.exe
  C:\Windows\System\sMSgMLu.exe
  2⤵
  PID:6632
- C:\Windows\System\dlaBnqj.exe
  C:\Windows\System\dlaBnqj.exe
  2⤵
  PID:6652
- C:\Windows\System\yXVxTIf.exe
  C:\Windows\System\yXVxTIf.exe
  2⤵
  PID:6676
- C:\Windows\System\DbHuykP.exe
  C:\Windows\System\DbHuykP.exe
  2⤵
  PID:6692
- C:\Windows\System\yGZuyVw.exe
  C:\Windows\System\yGZuyVw.exe
  2⤵
  PID:6712
- C:\Windows\System\xsFXCGY.exe
  C:\Windows\System\xsFXCGY.exe
  2⤵
  PID:6732
- C:\Windows\System\ZVuRvLO.exe
  C:\Windows\System\ZVuRvLO.exe
  2⤵
  PID:6748
- C:\Windows\System\UazNeAd.exe
  C:\Windows\System\UazNeAd.exe
  2⤵
  PID:6808
- C:\Windows\System\IQaoVdD.exe
  C:\Windows\System\IQaoVdD.exe
  2⤵
  PID:6824
- C:\Windows\System\FAHFmzi.exe
  C:\Windows\System\FAHFmzi.exe
  2⤵
  PID:6840
- C:\Windows\System\ZnneJLy.exe
  C:\Windows\System\ZnneJLy.exe
  2⤵
  PID:6860
- C:\Windows\System\RcFRjwh.exe
  C:\Windows\System\RcFRjwh.exe
  2⤵
  PID:6880
- C:\Windows\System\nvtJtMe.exe
  C:\Windows\System\nvtJtMe.exe
  2⤵
  PID:6896
- C:\Windows\System\aacQHEp.exe
  C:\Windows\System\aacQHEp.exe
  2⤵
  PID:6916
- C:\Windows\System\xYgJGBg.exe
  C:\Windows\System\xYgJGBg.exe
  2⤵
  PID:6932
- C:\Windows\System\uxhFFFF.exe
  C:\Windows\System\uxhFFFF.exe
  2⤵
  PID:6948
- C:\Windows\System\DqsKbOO.exe
  C:\Windows\System\DqsKbOO.exe
  2⤵
  PID:6980
- C:\Windows\System\XaGoeSC.exe
  C:\Windows\System\XaGoeSC.exe
  2⤵
  PID:6996
- C:\Windows\System\MlxNaDs.exe
  C:\Windows\System\MlxNaDs.exe
  2⤵
  PID:7012
- C:\Windows\System\xAkSfne.exe
  C:\Windows\System\xAkSfne.exe
  2⤵
  PID:7028
- C:\Windows\System\zqPQgqS.exe
  C:\Windows\System\zqPQgqS.exe
  2⤵
  PID:7044
- C:\Windows\System\bkLObgs.exe
  C:\Windows\System\bkLObgs.exe
  2⤵
  PID:7060
- C:\Windows\System\NilTMQt.exe
  C:\Windows\System\NilTMQt.exe
  2⤵
  PID:7076
- C:\Windows\System\xyotzJR.exe
  C:\Windows\System\xyotzJR.exe
  2⤵
  PID:7096
- C:\Windows\System\BXPqdFx.exe
  C:\Windows\System\BXPqdFx.exe
  2⤵
  PID:7112
- C:\Windows\System\XHzpHqQ.exe
  C:\Windows\System\XHzpHqQ.exe
  2⤵
  PID:7128
- C:\Windows\System\pNWwVql.exe
  C:\Windows\System\pNWwVql.exe
  2⤵
  PID:7156
- C:\Windows\System\ADEfYai.exe
  C:\Windows\System\ADEfYai.exe
  2⤵
  PID:6164
- C:\Windows\System\JzBbWhB.exe
  C:\Windows\System\JzBbWhB.exe
  2⤵
  PID:6288
- C:\Windows\System\TwVMNhf.exe
  C:\Windows\System\TwVMNhf.exe
  2⤵
  PID:6264
- C:\Windows\System\jESljhs.exe
  C:\Windows\System\jESljhs.exe
  2⤵
  PID:5544
- C:\Windows\System\bMKVFRW.exe
  C:\Windows\System\bMKVFRW.exe
  2⤵
  PID:6152
- C:\Windows\System\ikVddZC.exe
  C:\Windows\System\ikVddZC.exe
  2⤵
  PID:6188
- C:\Windows\System\joThEJx.exe
  C:\Windows\System\joThEJx.exe
  2⤵
  PID:6232
- C:\Windows\System\MYuPThl.exe
  C:\Windows\System\MYuPThl.exe
  2⤵
  PID:6304
- C:\Windows\System\edbYMyx.exe
  C:\Windows\System\edbYMyx.exe
  2⤵
  PID:6452
- C:\Windows\System\tCjirqD.exe
  C:\Windows\System\tCjirqD.exe
  2⤵
  PID:6492
- C:\Windows\System\OxHNoVN.exe
  C:\Windows\System\OxHNoVN.exe
  2⤵
  PID:6392
- C:\Windows\System\aLfsPhh.exe
  C:\Windows\System\aLfsPhh.exe
  2⤵
  PID:6596
- C:\Windows\System\QfpuOND.exe
  C:\Windows\System\QfpuOND.exe
  2⤵
  PID:6664
- C:\Windows\System\OcFQDnY.exe
  C:\Windows\System\OcFQDnY.exe
  2⤵
  PID:6428
- C:\Windows\System\MhPbbio.exe
  C:\Windows\System\MhPbbio.exe
  2⤵
  PID:6436
- C:\Windows\System\vXzljPG.exe
  C:\Windows\System\vXzljPG.exe
  2⤵
  PID:6576
- C:\Windows\System\oliMAQQ.exe
  C:\Windows\System\oliMAQQ.exe
  2⤵
  PID:6768
- C:\Windows\System\rhFxCAi.exe
  C:\Windows\System\rhFxCAi.exe
  2⤵
  PID:6776
- C:\Windows\System\NRqSbyU.exe
  C:\Windows\System\NRqSbyU.exe
  2⤵
  PID:6640
- C:\Windows\System\MUKOwzf.exe
  C:\Windows\System\MUKOwzf.exe
  2⤵
  PID:6608
- C:\Windows\System\jezcAmN.exe
  C:\Windows\System\jezcAmN.exe
  2⤵
  PID:6756
- C:\Windows\System\pgkUDTz.exe
  C:\Windows\System\pgkUDTz.exe
  2⤵
  PID:6888
- C:\Windows\System\jjcJkIh.exe
  C:\Windows\System\jjcJkIh.exe
  2⤵
  PID:6968
- C:\Windows\System\yXkiams.exe
  C:\Windows\System\yXkiams.exe
  2⤵
  PID:6976
- C:\Windows\System\aPAwFKt.exe
  C:\Windows\System\aPAwFKt.exe
  2⤵
  PID:7068
- C:\Windows\System\WTLlHkn.exe
  C:\Windows\System\WTLlHkn.exe
  2⤵
  PID:7136
- C:\Windows\System\EnCgDaS.exe
  C:\Windows\System\EnCgDaS.exe
  2⤵
  PID:6208
- C:\Windows\System\QwKgAuQ.exe
  C:\Windows\System\QwKgAuQ.exe
  2⤵
  PID:5704
- C:\Windows\System\kTesRXo.exe
  C:\Windows\System\kTesRXo.exe
  2⤵
  PID:6940
- C:\Windows\System\ffGQBEP.exe
  C:\Windows\System\ffGQBEP.exe
  2⤵
  PID:6988
- C:\Windows\System\AbMLggi.exe
  C:\Windows\System\AbMLggi.exe
  2⤵
  PID:6992
- C:\Windows\System\zzLPBtZ.exe
  C:\Windows\System\zzLPBtZ.exe
  2⤵
  PID:6284
- C:\Windows\System\DNgLQfg.exe
  C:\Windows\System\DNgLQfg.exe
  2⤵
  PID:7088
- C:\Windows\System\iZwbvmB.exe
  C:\Windows\System\iZwbvmB.exe
  2⤵
  PID:6292
- C:\Windows\System\CERURQk.exe
  C:\Windows\System\CERURQk.exe
  2⤵
  PID:6416
- C:\Windows\System\ZtpXBhQ.exe
  C:\Windows\System\ZtpXBhQ.exe
  2⤵
  PID:6472
- C:\Windows\System\UrqUOqf.exe
  C:\Windows\System\UrqUOqf.exe
  2⤵
  PID:6700
- C:\Windows\System\fsymWgP.exe
  C:\Windows\System\fsymWgP.exe
  2⤵
  PID:6380
- C:\Windows\System\BNJGJPU.exe
  C:\Windows\System\BNJGJPU.exe
  2⤵
  PID:6184
- C:\Windows\System\wATgnnM.exe
  C:\Windows\System\wATgnnM.exe
  2⤵
  PID:6660
- C:\Windows\System\lhUnyEF.exe
  C:\Windows\System\lhUnyEF.exe
  2⤵
  PID:6544
- C:\Windows\System\ObNCAZS.exe
  C:\Windows\System\ObNCAZS.exe
  2⤵
  PID:6788
- C:\Windows\System\VcwhhEK.exe
  C:\Windows\System\VcwhhEK.exe
  2⤵
  PID:6720
- C:\Windows\System\IIlMJEm.exe
  C:\Windows\System\IIlMJEm.exe
  2⤵
  PID:6684
- C:\Windows\System\dghcHJD.exe
  C:\Windows\System\dghcHJD.exe
  2⤵
  PID:6856
- C:\Windows\System\SrDCVKq.exe
  C:\Windows\System\SrDCVKq.exe
  2⤵
  PID:6956
- C:\Windows\System\dFTePcN.exe
  C:\Windows\System\dFTePcN.exe
  2⤵
  PID:7104
- C:\Windows\System\tTVsJCk.exe
  C:\Windows\System\tTVsJCk.exe
  2⤵
  PID:5276
- C:\Windows\System\hltGjDa.exe
  C:\Windows\System\hltGjDa.exe
  2⤵
  PID:6252
- C:\Windows\System\cNvseZy.exe
  C:\Windows\System\cNvseZy.exe
  2⤵
  PID:7008
- C:\Windows\System\kAmkdSP.exe
  C:\Windows\System\kAmkdSP.exe
  2⤵
  PID:6340
- C:\Windows\System\lPKxzji.exe
  C:\Windows\System\lPKxzji.exe
  2⤵
  PID:6908
- C:\Windows\System\uUhswEe.exe
  C:\Windows\System\uUhswEe.exe
  2⤵
  PID:6532
- C:\Windows\System\dEIcVjI.exe
  C:\Windows\System\dEIcVjI.exe
  2⤵
  PID:6564
- C:\Windows\System\NmdVjKQ.exe
  C:\Windows\System\NmdVjKQ.exe
  2⤵
  PID:6364
- C:\Windows\System\KyMgTom.exe
  C:\Windows\System\KyMgTom.exe
  2⤵
  PID:7152
- C:\Windows\System\MZzZIjL.exe
  C:\Windows\System\MZzZIjL.exe
  2⤵
  PID:6644
- C:\Windows\System\ZGKMYCW.exe
  C:\Windows\System\ZGKMYCW.exe
  2⤵
  PID:4860
- C:\Windows\System\ZeFBUuy.exe
  C:\Windows\System\ZeFBUuy.exe
  2⤵
  PID:7124
- C:\Windows\System\BNPVfjY.exe
  C:\Windows\System\BNPVfjY.exe
  2⤵
  PID:6708
- C:\Windows\System\vydeSyz.exe
  C:\Windows\System\vydeSyz.exe
  2⤵
  PID:6612
- C:\Windows\System\BwDqjmo.exe
  C:\Windows\System\BwDqjmo.exe
  2⤵
  PID:6548
- C:\Windows\System\FwfOisr.exe
  C:\Windows\System\FwfOisr.exe
  2⤵
  PID:6516
- C:\Windows\System\iirnskh.exe
  C:\Windows\System\iirnskh.exe
  2⤵
  PID:6964
- C:\Windows\System\pnXHOiW.exe
  C:\Windows\System\pnXHOiW.exe
  2⤵
  PID:6244
- C:\Windows\System\ibtxtHL.exe
  C:\Windows\System\ibtxtHL.exe
  2⤵
  PID:6688
- C:\Windows\System\NGFvYkH.exe
  C:\Windows\System\NGFvYkH.exe
  2⤵
  PID:7148
- C:\Windows\System\aMMWYNG.exe
  C:\Windows\System\aMMWYNG.exe
  2⤵
  PID:6784
- C:\Windows\System\qCbXsFD.exe
  C:\Windows\System\qCbXsFD.exe
  2⤵
  PID:6848
- C:\Windows\System\pfHjpRj.exe
  C:\Windows\System\pfHjpRj.exe
  2⤵
  PID:6120
- C:\Windows\System\OSVVfdh.exe
  C:\Windows\System\OSVVfdh.exe
  2⤵
  PID:6876
- C:\Windows\System\ErQQvbH.exe
  C:\Windows\System\ErQQvbH.exe
  2⤵
  PID:6272
- C:\Windows\System\vaCrkZe.exe
  C:\Windows\System\vaCrkZe.exe
  2⤵
  PID:5820
- C:\Windows\System\SnrjTSV.exe
  C:\Windows\System\SnrjTSV.exe
  2⤵
  PID:6180
- C:\Windows\System\bddqMDL.exe
  C:\Windows\System\bddqMDL.exe
  2⤵
  PID:7188
- C:\Windows\System\yfCfLDp.exe
  C:\Windows\System\yfCfLDp.exe
  2⤵
  PID:7204
- C:\Windows\System\iOfneoi.exe
  C:\Windows\System\iOfneoi.exe
  2⤵
  PID:7220
- C:\Windows\System\OByEqup.exe
  C:\Windows\System\OByEqup.exe
  2⤵
  PID:7236
- C:\Windows\System\mucGWcc.exe
  C:\Windows\System\mucGWcc.exe
  2⤵
  PID:7256
- C:\Windows\System\ruQaFnn.exe
  C:\Windows\System\ruQaFnn.exe
  2⤵
  PID:7272
- C:\Windows\System\heiRPPy.exe
  C:\Windows\System\heiRPPy.exe
  2⤵
  PID:7292
- C:\Windows\System\roVuDYI.exe
  C:\Windows\System\roVuDYI.exe
  2⤵
  PID:7308
- C:\Windows\System\pIBDVRM.exe
  C:\Windows\System\pIBDVRM.exe
  2⤵
  PID:7328
- C:\Windows\System\INZdVME.exe
  C:\Windows\System\INZdVME.exe
  2⤵
  PID:7344
- C:\Windows\System\rguzAZW.exe
  C:\Windows\System\rguzAZW.exe
  2⤵
  PID:7360
- C:\Windows\System\MlvlKAR.exe
  C:\Windows\System\MlvlKAR.exe
  2⤵
  PID:7380
- C:\Windows\System\FklZNSK.exe
  C:\Windows\System\FklZNSK.exe
  2⤵
  PID:7396
- C:\Windows\System\TNIXOhY.exe
  C:\Windows\System\TNIXOhY.exe
  2⤵
  PID:7416
- C:\Windows\System\PiRRiFQ.exe
  C:\Windows\System\PiRRiFQ.exe
  2⤵
  PID:7480
- C:\Windows\System\dnaBKBU.exe
  C:\Windows\System\dnaBKBU.exe
  2⤵
  PID:7500
- C:\Windows\System\fgiuJLL.exe
  C:\Windows\System\fgiuJLL.exe
  2⤵
  PID:7516
- C:\Windows\System\OLQfCaH.exe
  C:\Windows\System\OLQfCaH.exe
  2⤵
  PID:7532
- C:\Windows\System\xgELQTz.exe
  C:\Windows\System\xgELQTz.exe
  2⤵
  PID:7552
- C:\Windows\System\ZFrCfsI.exe
  C:\Windows\System\ZFrCfsI.exe
  2⤵
  PID:7568
- C:\Windows\System\rPHINIy.exe
  C:\Windows\System\rPHINIy.exe
  2⤵
  PID:7588
- C:\Windows\System\AXeJhrZ.exe
  C:\Windows\System\AXeJhrZ.exe
  2⤵
  PID:7616
- C:\Windows\System\CxaXcQp.exe
  C:\Windows\System\CxaXcQp.exe
  2⤵
  PID:7632
- C:\Windows\System\TmyHurq.exe
  C:\Windows\System\TmyHurq.exe
  2⤵
  PID:7652
- C:\Windows\System\LTmFfJW.exe
  C:\Windows\System\LTmFfJW.exe
  2⤵
  PID:7668
- C:\Windows\System\gXQKuYF.exe
  C:\Windows\System\gXQKuYF.exe
  2⤵
  PID:7688
- C:\Windows\System\kUBaWKk.exe
  C:\Windows\System\kUBaWKk.exe
  2⤵
  PID:7712
- C:\Windows\System\PKHEoQQ.exe
  C:\Windows\System\PKHEoQQ.exe
  2⤵
  PID:7732
- C:\Windows\System\bggoEuc.exe
  C:\Windows\System\bggoEuc.exe
  2⤵
  PID:7748
- C:\Windows\System\vAmjinA.exe
  C:\Windows\System\vAmjinA.exe
  2⤵
  PID:7768
- C:\Windows\System\VgJZmKl.exe
  C:\Windows\System\VgJZmKl.exe
  2⤵
  PID:7788
- C:\Windows\System\lQYQqOo.exe
  C:\Windows\System\lQYQqOo.exe
  2⤵
  PID:7808
- C:\Windows\System\DPVKfbo.exe
  C:\Windows\System\DPVKfbo.exe
  2⤵
  PID:7828
- C:\Windows\System\KgodizG.exe
  C:\Windows\System\KgodizG.exe
  2⤵
  PID:7856
- C:\Windows\System\dxQOSOg.exe
  C:\Windows\System\dxQOSOg.exe
  2⤵
  PID:7872
- C:\Windows\System\BVeYvjJ.exe
  C:\Windows\System\BVeYvjJ.exe
  2⤵
  PID:7888
- C:\Windows\System\ZjUVovC.exe
  C:\Windows\System\ZjUVovC.exe
  2⤵
  PID:7920
- C:\Windows\System\WFtJsxF.exe
  C:\Windows\System\WFtJsxF.exe
  2⤵
  PID:7936
- C:\Windows\System\vFwnUAs.exe
  C:\Windows\System\vFwnUAs.exe
  2⤵
  PID:7952
- C:\Windows\System\wvdozkX.exe
  C:\Windows\System\wvdozkX.exe
  2⤵
  PID:7972
- C:\Windows\System\qpebKjJ.exe
  C:\Windows\System\qpebKjJ.exe
  2⤵
  PID:7988
- C:\Windows\System\cevbRix.exe
  C:\Windows\System\cevbRix.exe
  2⤵
  PID:8008
- C:\Windows\System\zyCzSzi.exe
  C:\Windows\System\zyCzSzi.exe
  2⤵
  PID:8024
- C:\Windows\System\wYZgGNK.exe
  C:\Windows\System\wYZgGNK.exe
  2⤵
  PID:8040
- C:\Windows\System\TNAUJYk.exe
  C:\Windows\System\TNAUJYk.exe
  2⤵
  PID:8056
- C:\Windows\System\NBRWvWA.exe
  C:\Windows\System\NBRWvWA.exe
  2⤵
  PID:8080
- C:\Windows\System\RyZdapR.exe
  C:\Windows\System\RyZdapR.exe
  2⤵
  PID:8096
- C:\Windows\System\teJIxFN.exe
  C:\Windows\System\teJIxFN.exe
  2⤵
  PID:8112
- C:\Windows\System\MxMPjrz.exe
  C:\Windows\System\MxMPjrz.exe
  2⤵
  PID:8128
- C:\Windows\System\tMxlzII.exe
  C:\Windows\System\tMxlzII.exe
  2⤵
  PID:8148
- C:\Windows\System\axnWYIE.exe
  C:\Windows\System\axnWYIE.exe
  2⤵
  PID:6792
- C:\Windows\System\iDVSwcP.exe
  C:\Windows\System\iDVSwcP.exe
  2⤵
  PID:7196
- C:\Windows\System\CVCQuQX.exe
  C:\Windows\System\CVCQuQX.exe
  2⤵
  PID:7228
- C:\Windows\System\kBJNIap.exe
  C:\Windows\System\kBJNIap.exe
  2⤵
  PID:7336
- C:\Windows\System\tHVIZZU.exe
  C:\Windows\System\tHVIZZU.exe
  2⤵
  PID:7404
- C:\Windows\System\vDcjDqC.exe
  C:\Windows\System\vDcjDqC.exe
  2⤵
  PID:7280
- C:\Windows\System\TmzGhnn.exe
  C:\Windows\System\TmzGhnn.exe
  2⤵
  PID:7356
- C:\Windows\System\cTgIIbO.exe
  C:\Windows\System\cTgIIbO.exe
  2⤵
  PID:7320
- C:\Windows\System\CKhhZNk.exe
  C:\Windows\System\CKhhZNk.exe
  2⤵
  PID:7212
- C:\Windows\System\lwfJXic.exe
  C:\Windows\System\lwfJXic.exe
  2⤵
  PID:6528
- C:\Windows\System\wbVFarP.exe
  C:\Windows\System\wbVFarP.exe
  2⤵
  PID:7436
- C:\Windows\System\WnRcxQW.exe
  C:\Windows\System\WnRcxQW.exe
  2⤵
  PID:7464
- C:\Windows\System\zrUjpWB.exe
  C:\Windows\System\zrUjpWB.exe
  2⤵
  PID:7476
- C:\Windows\System\aYSlAgN.exe
  C:\Windows\System\aYSlAgN.exe
  2⤵
  PID:7528
- C:\Windows\System\pDQLnaZ.exe
  C:\Windows\System\pDQLnaZ.exe
  2⤵
  PID:7544
- C:\Windows\System\BrcIfwi.exe
  C:\Windows\System\BrcIfwi.exe
  2⤵
  PID:7580
- C:\Windows\System\uYXOMMF.exe
  C:\Windows\System\uYXOMMF.exe
  2⤵
  PID:7644
- C:\Windows\System\PHRvUti.exe
  C:\Windows\System\PHRvUti.exe
  2⤵
  PID:7720
- C:\Windows\System\acYRqcd.exe
  C:\Windows\System\acYRqcd.exe
  2⤵
  PID:7660
- C:\Windows\System\YwHnFWM.exe
  C:\Windows\System\YwHnFWM.exe
  2⤵
  PID:7800
- C:\Windows\System\BjdfKFZ.exe
  C:\Windows\System\BjdfKFZ.exe
  2⤵
  PID:7836
- C:\Windows\System\mYUleaI.exe
  C:\Windows\System\mYUleaI.exe
  2⤵
  PID:7852
- C:\Windows\System\FqWEBUI.exe
  C:\Windows\System\FqWEBUI.exe
  2⤵
  PID:7884
- C:\Windows\System\uajNnvi.exe
  C:\Windows\System\uajNnvi.exe
  2⤵
  PID:7708
- C:\Windows\System\klKZulB.exe
  C:\Windows\System\klKZulB.exe
  2⤵
  PID:7776
- C:\Windows\System\nxTlRyr.exe
  C:\Windows\System\nxTlRyr.exe
  2⤵
  PID:7820
- C:\Windows\System\CWaKnzg.exe
  C:\Windows\System\CWaKnzg.exe
  2⤵
  PID:7824
- C:\Windows\System\NmpLZhg.exe
  C:\Windows\System\NmpLZhg.exe
  2⤵
  PID:7932
- C:\Windows\System\PthAgLx.exe
  C:\Windows\System\PthAgLx.exe
  2⤵
  PID:7968
- C:\Windows\System\iXdSxdT.exe
  C:\Windows\System\iXdSxdT.exe
  2⤵
  PID:7984
- C:\Windows\System\iWsgaJE.exe
  C:\Windows\System\iWsgaJE.exe
  2⤵
  PID:8136
- C:\Windows\System\CatzUcc.exe
  C:\Windows\System\CatzUcc.exe
  2⤵
  PID:8120
- C:\Windows\System\CEvIFeG.exe
  C:\Windows\System\CEvIFeG.exe
  2⤵
  PID:8176
- C:\Windows\System\QpNOPzI.exe
  C:\Windows\System\QpNOPzI.exe
  2⤵
  PID:8168
- C:\Windows\System\KcaLDJq.exe
  C:\Windows\System\KcaLDJq.exe
  2⤵
  PID:7084
- C:\Windows\System\ygTerWB.exe
  C:\Windows\System\ygTerWB.exe
  2⤵
  PID:7304
- C:\Windows\System\PBsFKMM.exe
  C:\Windows\System\PBsFKMM.exe
  2⤵
  PID:7216
- C:\Windows\System\OATcJlA.exe
  C:\Windows\System\OATcJlA.exe
  2⤵
  PID:7172
- C:\Windows\System\jYwCYqc.exe
  C:\Windows\System\jYwCYqc.exe
  2⤵
  PID:7496
- C:\Windows\System\pcaHrmU.exe
  C:\Windows\System\pcaHrmU.exe
  2⤵
  PID:7524
- C:\Windows\System\wbWfoqp.exe
  C:\Windows\System\wbWfoqp.exe
  2⤵
  PID:7608
- C:\Windows\System\faJtMRN.exe
  C:\Windows\System\faJtMRN.exe
  2⤵
  PID:7676
- C:\Windows\System\dMbEHUo.exe
  C:\Windows\System\dMbEHUo.exe
  2⤵
  PID:7352
- C:\Windows\System\HaTMgyw.exe
  C:\Windows\System\HaTMgyw.exe
  2⤵
  PID:7472
- C:\Windows\System\QvpPUKy.exe
  C:\Windows\System\QvpPUKy.exe
  2⤵
  PID:7784
- C:\Windows\System\mpMCFNd.exe
  C:\Windows\System\mpMCFNd.exe
  2⤵
  PID:7944
- C:\Windows\System\BIXOXxC.exe
  C:\Windows\System\BIXOXxC.exe
  2⤵
  PID:7584
- C:\Windows\System\aESOVhh.exe
  C:\Windows\System\aESOVhh.exe
  2⤵
  PID:7724
- C:\Windows\System\TsJPYYJ.exe
  C:\Windows\System\TsJPYYJ.exe
  2⤵
  PID:7880
- C:\Windows\System\woKIgMn.exe
  C:\Windows\System\woKIgMn.exe
  2⤵
  PID:8020
- C:\Windows\System\utsFLkc.exe
  C:\Windows\System\utsFLkc.exe
  2⤵
  PID:8064
- C:\Windows\System\DCOZWUh.exe
  C:\Windows\System\DCOZWUh.exe
  2⤵
  PID:8032
- C:\Windows\System\IefCxrJ.exe
  C:\Windows\System\IefCxrJ.exe
  2⤵
  PID:8188
- C:\Windows\System\uwWWWGF.exe
  C:\Windows\System\uwWWWGF.exe
  2⤵
  PID:7232
- C:\Windows\System\FDQJBUK.exe
  C:\Windows\System\FDQJBUK.exe
  2⤵
  PID:7372
- C:\Windows\System\aFfCrwm.exe
  C:\Windows\System\aFfCrwm.exe
  2⤵
  PID:7248
- C:\Windows\System\QlRdeqR.exe
  C:\Windows\System\QlRdeqR.exe
  2⤵
  PID:7868
- C:\Windows\System\TvEIeDk.exe
  C:\Windows\System\TvEIeDk.exe
  2⤵
  PID:7904
- C:\Windows\System\fFzvEwl.exe
  C:\Windows\System\fFzvEwl.exe
  2⤵
  PID:7600
- C:\Windows\System\tWsIlji.exe
  C:\Windows\System\tWsIlji.exe
  2⤵
  PID:7700
- C:\Windows\System\UfkOYio.exe
  C:\Windows\System\UfkOYio.exe
  2⤵
  PID:7316
- C:\Windows\System\caLeayt.exe
  C:\Windows\System\caLeayt.exe
  2⤵
  PID:7980
- C:\Windows\System\PnlMtFf.exe
  C:\Windows\System\PnlMtFf.exe
  2⤵
  PID:7896
- C:\Windows\System\aPeuYLy.exe
  C:\Windows\System\aPeuYLy.exe
  2⤵
  PID:8092
- C:\Windows\System\eJPxtxB.exe
  C:\Windows\System\eJPxtxB.exe
  2⤵
  PID:8108
- C:\Windows\System\HswEYZx.exe
  C:\Windows\System\HswEYZx.exe
  2⤵
  PID:8156
- C:\Windows\System\uyRTmPN.exe
  C:\Windows\System\uyRTmPN.exe
  2⤵
  PID:7512
- C:\Windows\System\LOxKMdJ.exe
  C:\Windows\System\LOxKMdJ.exe
  2⤵
  PID:8180
- C:\Windows\System\gLLaJug.exe
  C:\Windows\System\gLLaJug.exe
  2⤵
  PID:7576
- C:\Windows\System\xiHrrsn.exe
  C:\Windows\System\xiHrrsn.exe
  2⤵
  PID:8004
- C:\Windows\System\TgKklHa.exe
  C:\Windows\System\TgKklHa.exe
  2⤵
  PID:8208
- C:\Windows\System\xedLOkn.exe
  C:\Windows\System\xedLOkn.exe
  2⤵
  PID:8224
- C:\Windows\System\SQcuJJM.exe
  C:\Windows\System\SQcuJJM.exe
  2⤵
  PID:8244
- C:\Windows\System\xDoFhiw.exe
  C:\Windows\System\xDoFhiw.exe
  2⤵
  PID:8268
- C:\Windows\System\hterhsP.exe
  C:\Windows\System\hterhsP.exe
  2⤵
  PID:8288
- C:\Windows\System\naSjOOn.exe
  C:\Windows\System\naSjOOn.exe
  2⤵
  PID:8320
- C:\Windows\System\NpuFyZB.exe
  C:\Windows\System\NpuFyZB.exe
  2⤵
  PID:8340
- C:\Windows\System\AJxUCAS.exe
  C:\Windows\System\AJxUCAS.exe
  2⤵
  PID:8356
- C:\Windows\System\nHFnZpL.exe
  C:\Windows\System\nHFnZpL.exe
  2⤵
  PID:8384
- C:\Windows\System\LDHOcSa.exe
  C:\Windows\System\LDHOcSa.exe
  2⤵
  PID:8404
- C:\Windows\System\qoxpSDk.exe
  C:\Windows\System\qoxpSDk.exe
  2⤵
  PID:8424
- C:\Windows\System\kgidIFm.exe
  C:\Windows\System\kgidIFm.exe
  2⤵
  PID:8440
- C:\Windows\System\NqXpCyA.exe
  C:\Windows\System\NqXpCyA.exe
  2⤵
  PID:8460
- C:\Windows\System\eTHrkxI.exe
  C:\Windows\System\eTHrkxI.exe
  2⤵
  PID:8504
- C:\Windows\System\fcMXaWu.exe
  C:\Windows\System\fcMXaWu.exe
  2⤵
  PID:8524
- C:\Windows\System\YsDJUDR.exe
  C:\Windows\System\YsDJUDR.exe
  2⤵
  PID:8544
- C:\Windows\System\DplHwTz.exe
  C:\Windows\System\DplHwTz.exe
  2⤵
  PID:8560
- C:\Windows\System\nveaxgN.exe
  C:\Windows\System\nveaxgN.exe
  2⤵
  PID:8580
- C:\Windows\System\WLQaAot.exe
  C:\Windows\System\WLQaAot.exe
  2⤵
  PID:8600
- C:\Windows\System\OKIoejc.exe
  C:\Windows\System\OKIoejc.exe
  2⤵
  PID:8628
- C:\Windows\System\VXKcqjB.exe
  C:\Windows\System\VXKcqjB.exe
  2⤵
  PID:8648
- C:\Windows\System\PUwinRb.exe
  C:\Windows\System\PUwinRb.exe
  2⤵
  PID:8664
- C:\Windows\System\mIlfnXD.exe
  C:\Windows\System\mIlfnXD.exe
  2⤵
  PID:8684
- C:\Windows\System\WnPMYLY.exe
  C:\Windows\System\WnPMYLY.exe
  2⤵
  PID:8704
- C:\Windows\System\hDfNpjQ.exe
  C:\Windows\System\hDfNpjQ.exe
  2⤵
  PID:8724
- C:\Windows\System\dtrYLwz.exe
  C:\Windows\System\dtrYLwz.exe
  2⤵
  PID:8740
- C:\Windows\System\wVQAlKp.exe
  C:\Windows\System\wVQAlKp.exe
  2⤵
  PID:8756
- C:\Windows\System\jnRGOKI.exe
  C:\Windows\System\jnRGOKI.exe
  2⤵
  PID:8772
- C:\Windows\System\HBteaxx.exe
  C:\Windows\System\HBteaxx.exe
  2⤵
  PID:8792
- C:\Windows\System\dkGfTYM.exe
  C:\Windows\System\dkGfTYM.exe
  2⤵
  PID:8812
- C:\Windows\System\PROLgmc.exe
  C:\Windows\System\PROLgmc.exe
  2⤵
  PID:8832
- C:\Windows\System\gywHpeQ.exe
  C:\Windows\System\gywHpeQ.exe
  2⤵
  PID:8852
- C:\Windows\System\BLEFjoB.exe
  C:\Windows\System\BLEFjoB.exe
  2⤵
  PID:8868
- C:\Windows\System\UlBkRBo.exe
  C:\Windows\System\UlBkRBo.exe
  2⤵
  PID:8904
- C:\Windows\System\pQovmzF.exe
  C:\Windows\System\pQovmzF.exe
  2⤵
  PID:8924
- C:\Windows\System\ogJlyGl.exe
  C:\Windows\System\ogJlyGl.exe
  2⤵
  PID:8948
- C:\Windows\System\ZLqYjQb.exe
  C:\Windows\System\ZLqYjQb.exe
  2⤵
  PID:8964
- C:\Windows\System\nuelMWP.exe
  C:\Windows\System\nuelMWP.exe
  2⤵
  PID:8980
- C:\Windows\System\lblPRYF.exe
  C:\Windows\System\lblPRYF.exe
  2⤵
  PID:9004
- C:\Windows\System\laPGhWH.exe
  C:\Windows\System\laPGhWH.exe
  2⤵
  PID:9020
- C:\Windows\System\AwriGQf.exe
  C:\Windows\System\AwriGQf.exe
  2⤵
  PID:9040
- C:\Windows\System\gwoNkoF.exe
  C:\Windows\System\gwoNkoF.exe
  2⤵
  PID:9056
- C:\Windows\System\VBXcdaC.exe
  C:\Windows\System\VBXcdaC.exe
  2⤵
  PID:9072
- C:\Windows\System\DmbcoWZ.exe
  C:\Windows\System\DmbcoWZ.exe
  2⤵
  PID:9092
- C:\Windows\System\jnjetbk.exe
  C:\Windows\System\jnjetbk.exe
  2⤵
  PID:9132
- C:\Windows\System\NcdYTsp.exe
  C:\Windows\System\NcdYTsp.exe
  2⤵
  PID:9148
- C:\Windows\System\XLKmXIm.exe
  C:\Windows\System\XLKmXIm.exe
  2⤵
  PID:9168
- C:\Windows\System\zGqkFBV.exe
  C:\Windows\System\zGqkFBV.exe
  2⤵
  PID:9184
- C:\Windows\System\dMEqHyn.exe
  C:\Windows\System\dMEqHyn.exe
  2⤵
  PID:9208
- C:\Windows\System\OVriyQw.exe
  C:\Windows\System\OVriyQw.exe
  2⤵
  PID:7624
- C:\Windows\System\KTWuAmk.exe
  C:\Windows\System\KTWuAmk.exe
  2⤵
  PID:8164
- C:\Windows\System\zfcLcgR.exe
  C:\Windows\System\zfcLcgR.exe
  2⤵
  PID:7164
- C:\Windows\System\NRVEXeA.exe
  C:\Windows\System\NRVEXeA.exe
  2⤵
  PID:8256
- C:\Windows\System\JCUQGVI.exe
  C:\Windows\System\JCUQGVI.exe
  2⤵
  PID:8304
- C:\Windows\System\OMZgLRq.exe
  C:\Windows\System\OMZgLRq.exe
  2⤵
  PID:8352
- C:\Windows\System\VCBNkpu.exe
  C:\Windows\System\VCBNkpu.exe
  2⤵
  PID:7964
- C:\Windows\System\nTXhiOz.exe
  C:\Windows\System\nTXhiOz.exe
  2⤵
  PID:7764
- C:\Windows\System\DCbrdcV.exe
  C:\Windows\System\DCbrdcV.exe
  2⤵
  PID:7268
- C:\Windows\System\yYlfEPO.exe
  C:\Windows\System\yYlfEPO.exe
  2⤵
  PID:8284
- C:\Windows\System\BPBdGvP.exe
  C:\Windows\System\BPBdGvP.exe
  2⤵
  PID:7180
- C:\Windows\System\AfrffgA.exe
  C:\Windows\System\AfrffgA.exe
  2⤵
  PID:8432
- C:\Windows\System\mhuyebo.exe
  C:\Windows\System\mhuyebo.exe
  2⤵
  PID:8412
- C:\Windows\System\BjNJJgl.exe
  C:\Windows\System\BjNJJgl.exe
  2⤵
  PID:8492
- C:\Windows\System\bqGELEi.exe
  C:\Windows\System\bqGELEi.exe
  2⤵
  PID:8540
- C:\Windows\System\ShLFQGh.exe
  C:\Windows\System\ShLFQGh.exe
  2⤵
  PID:8416
- C:\Windows\System\QSFTMee.exe
  C:\Windows\System\QSFTMee.exe
  2⤵
  PID:8512
- C:\Windows\System\AwdxTGk.exe
  C:\Windows\System\AwdxTGk.exe
  2⤵
  PID:8616
- C:\Windows\System\vkzpwLw.exe
  C:\Windows\System\vkzpwLw.exe
  2⤵
  PID:8588
- C:\Windows\System\kHCnSjk.exe
  C:\Windows\System\kHCnSjk.exe
  2⤵
  PID:8636
- C:\Windows\System\CHeKart.exe
  C:\Windows\System\CHeKart.exe
  2⤵
  PID:8696
- C:\Windows\System\xGcXxDm.exe
  C:\Windows\System\xGcXxDm.exe
  2⤵
  PID:8736
- C:\Windows\System\xXQYUHd.exe
  C:\Windows\System\xXQYUHd.exe
  2⤵
  PID:8808
- C:\Windows\System\rxEGxHI.exe
  C:\Windows\System\rxEGxHI.exe
  2⤵
  PID:8880
- C:\Windows\System\LwoBdfe.exe
  C:\Windows\System\LwoBdfe.exe
  2⤵
  PID:8896
- C:\Windows\System\WqgryLO.exe
  C:\Windows\System\WqgryLO.exe
  2⤵
  PID:8780
- C:\Windows\System\CutSrUq.exe
  C:\Windows\System\CutSrUq.exe
  2⤵
  PID:8828
- C:\Windows\System\rYzbcaV.exe
  C:\Windows\System\rYzbcaV.exe
  2⤵
  PID:8932
- C:\Windows\System\slRmihQ.exe
  C:\Windows\System\slRmihQ.exe
  2⤵
  PID:8972
- C:\Windows\System\kxmHegp.exe
  C:\Windows\System\kxmHegp.exe
  2⤵
  PID:8956
- C:\Windows\System\cAtSINE.exe
  C:\Windows\System\cAtSINE.exe
  2⤵
  PID:9088
- C:\Windows\System\ELJqJLS.exe
  C:\Windows\System\ELJqJLS.exe
  2⤵
  PID:9104
- C:\Windows\System\bpABJHD.exe
  C:\Windows\System\bpABJHD.exe
  2⤵
  PID:9112
- C:\Windows\System\AIQLgEI.exe
  C:\Windows\System\AIQLgEI.exe
  2⤵
  PID:9124
- C:\Windows\System\fCkjRpZ.exe
  C:\Windows\System\fCkjRpZ.exe
  2⤵
  PID:9144
- C:\Windows\System\nJSXCIq.exe
  C:\Windows\System\nJSXCIq.exe
  2⤵
  PID:9164
- C:\Windows\System\FFxknoL.exe
  C:\Windows\System\FFxknoL.exe
  2⤵
  PID:7376
- C:\Windows\System\QjRIKcX.exe
  C:\Windows\System\QjRIKcX.exe
  2⤵
  PID:8264
- C:\Windows\System\dkIkgXX.exe
  C:\Windows\System\dkIkgXX.exe
  2⤵
  PID:7424
- C:\Windows\System\RSxsjgk.exe
  C:\Windows\System\RSxsjgk.exe
  2⤵
  PID:8252
- C:\Windows\System\TIzvGan.exe
  C:\Windows\System\TIzvGan.exe
  2⤵
  PID:8348
- C:\Windows\System\DhPATuz.exe
  C:\Windows\System\DhPATuz.exe
  2⤵
  PID:8196
- C:\Windows\System\XbTVUyE.exe
  C:\Windows\System\XbTVUyE.exe
  2⤵
  PID:8376
- C:\Windows\System\KWPbBfB.exe
  C:\Windows\System\KWPbBfB.exe
  2⤵
  PID:8468
- C:\Windows\System\RaqTXzn.exe
  C:\Windows\System\RaqTXzn.exe
  2⤵
  PID:8500
- C:\Windows\System\lxfDyKi.exe
  C:\Windows\System\lxfDyKi.exe
  2⤵
  PID:8452
- C:\Windows\System\tcUeapd.exe
  C:\Windows\System\tcUeapd.exe
  2⤵
  PID:8576
- C:\Windows\System\jgGQdGa.exe
  C:\Windows\System\jgGQdGa.exe
  2⤵
  PID:8660
- C:\Windows\System\zDqbPnp.exe
  C:\Windows\System\zDqbPnp.exe
  2⤵
  PID:8672
- C:\Windows\System\qHwXRPF.exe
  C:\Windows\System\qHwXRPF.exe
  2⤵
  PID:8768
- C:\Windows\System\ZMHwbXN.exe
  C:\Windows\System\ZMHwbXN.exe
  2⤵
  PID:8752
- C:\Windows\System\HzLWANT.exe
  C:\Windows\System\HzLWANT.exe
  2⤵
  PID:8820
- C:\Windows\System\IUyprqT.exe
  C:\Windows\System\IUyprqT.exe
  2⤵
  PID:8720
- C:\Windows\System\RqwIMxZ.exe
  C:\Windows\System\RqwIMxZ.exe
  2⤵
  PID:9048
- C:\Windows\System\QjNaFKT.exe
  C:\Windows\System\QjNaFKT.exe
  2⤵
  PID:8912
- C:\Windows\System\LhFRvjU.exe
  C:\Windows\System\LhFRvjU.exe
  2⤵
  PID:9028
- C:\Windows\System\mROYXOW.exe
  C:\Windows\System\mROYXOW.exe
  2⤵
  PID:9128
- C:\Windows\System\YIjHkPG.exe
  C:\Windows\System\YIjHkPG.exe
  2⤵
  PID:9160
- C:\Windows\System\vyejuEb.exe
  C:\Windows\System\vyejuEb.exe
  2⤵
  PID:7916
- C:\Windows\System\qJKEVcS.exe
  C:\Windows\System\qJKEVcS.exe
  2⤵
  PID:7468
- C:\Windows\System\UNivafx.exe
  C:\Windows\System\UNivafx.exe
  2⤵
  PID:7444
- C:\Windows\System\RoATCAe.exe
  C:\Windows\System\RoATCAe.exe
  2⤵
  PID:7184
- C:\Windows\System\uIvIBXr.exe
  C:\Windows\System\uIvIBXr.exe
  2⤵
  PID:8036
- C:\Windows\System\lbBjQTU.exe
  C:\Windows\System\lbBjQTU.exe
  2⤵
  PID:8480
- C:\Windows\System\doDDlWM.exe
  C:\Windows\System\doDDlWM.exe
  2⤵
  PID:8556
- C:\Windows\System\ZmhaeZv.exe
  C:\Windows\System\ZmhaeZv.exe
  2⤵
  PID:8764
- C:\Windows\System\MGrMxqW.exe
  C:\Windows\System\MGrMxqW.exe
  2⤵
  PID:8612
- C:\Windows\System\GpvqSvU.exe
  C:\Windows\System\GpvqSvU.exe
  2⤵
  PID:8712
- C:\Windows\System\mURwSXt.exe
  C:\Windows\System\mURwSXt.exe
  2⤵
  PID:8716
- C:\Windows\System\rxbfHih.exe
  C:\Windows\System\rxbfHih.exe
  2⤵
  PID:9012
- C:\Windows\System\tvGVqSF.exe
  C:\Windows\System\tvGVqSF.exe
  2⤵
  PID:9196
- C:\Windows\System\wMrsVIf.exe
  C:\Windows\System\wMrsVIf.exe
  2⤵
  PID:7912
- C:\Windows\System\KufSzPO.exe
  C:\Windows\System\KufSzPO.exe
  2⤵
  PID:8488
- C:\Windows\System\TswAqtu.exe
  C:\Windows\System\TswAqtu.exe
  2⤵
  PID:8220
- C:\Windows\System\LsYenEY.exe
  C:\Windows\System\LsYenEY.exe
  2⤵
  PID:8484
- C:\Windows\System\xkBBQml.exe
  C:\Windows\System\xkBBQml.exe
  2⤵
  PID:8572
- C:\Windows\System\KCNRqOb.exe
  C:\Windows\System\KCNRqOb.exe
  2⤵
  PID:8876
- C:\Windows\System\JXmRGFQ.exe
  C:\Windows\System\JXmRGFQ.exe
  2⤵
  PID:9064
- C:\Windows\System\bLcFsmK.exe
  C:\Windows\System\bLcFsmK.exe
  2⤵
  PID:8916
- C:\Windows\System\fXFddur.exe
  C:\Windows\System\fXFddur.exe
  2⤵
  PID:8988
- C:\Windows\System\dllgGPW.exe
  C:\Windows\System\dllgGPW.exe
  2⤵
  PID:6852
- C:\Windows\System\hGEkomc.exe
  C:\Windows\System\hGEkomc.exe
  2⤵
  PID:8516
- C:\Windows\System\oQgLPAs.exe
  C:\Windows\System\oQgLPAs.exe
  2⤵
  PID:8748
- C:\Windows\System\uJmfbQr.exe
  C:\Windows\System\uJmfbQr.exe
  2⤵
  PID:8884
- C:\Windows\System\lvDPYxt.exe
  C:\Windows\System\lvDPYxt.exe
  2⤵
  PID:8940
- C:\Windows\System\FjZfHWq.exe
  C:\Windows\System\FjZfHWq.exe
  2⤵
  PID:8364
- C:\Windows\System\BAGZKsK.exe
  C:\Windows\System\BAGZKsK.exe
  2⤵
  PID:8568
- C:\Windows\System\maAgUiV.exe
  C:\Windows\System\maAgUiV.exe
  2⤵
  PID:8592
- C:\Windows\System\CwelrpZ.exe
  C:\Windows\System\CwelrpZ.exe
  2⤵
  PID:9228
- C:\Windows\System\zyZgAnA.exe
  C:\Windows\System\zyZgAnA.exe
  2⤵
  PID:9248
- C:\Windows\System\EPViZod.exe
  C:\Windows\System\EPViZod.exe
  2⤵
  PID:9264
- C:\Windows\System\UmCRNZk.exe
  C:\Windows\System\UmCRNZk.exe
  2⤵
  PID:9288
- C:\Windows\System\zYcsuow.exe
  C:\Windows\System\zYcsuow.exe
  2⤵
  PID:9308
- C:\Windows\System\TSQQvIB.exe
  C:\Windows\System\TSQQvIB.exe
  2⤵
  PID:9324
- C:\Windows\System\XkHwMaF.exe
  C:\Windows\System\XkHwMaF.exe
  2⤵
  PID:9340
- C:\Windows\System\rXHsxPs.exe
  C:\Windows\System\rXHsxPs.exe
  2⤵
  PID:9356
- C:\Windows\System\FmawAwK.exe
  C:\Windows\System\FmawAwK.exe
  2⤵
  PID:9372
- C:\Windows\System\fSVimXj.exe
  C:\Windows\System\fSVimXj.exe
  2⤵
  PID:9424
- C:\Windows\System\gAtcfbO.exe
  C:\Windows\System\gAtcfbO.exe
  2⤵
  PID:9440
- C:\Windows\System\DnKAGDW.exe
  C:\Windows\System\DnKAGDW.exe
  2⤵
  PID:9456
- C:\Windows\System\ALMBeYp.exe
  C:\Windows\System\ALMBeYp.exe
  2⤵
  PID:9488
- C:\Windows\System\gWoWOUx.exe
  C:\Windows\System\gWoWOUx.exe
  2⤵
  PID:9516
- C:\Windows\System\OYyQBNn.exe
  C:\Windows\System\OYyQBNn.exe
  2⤵
  PID:9532
- C:\Windows\System\mPfXAKk.exe
  C:\Windows\System\mPfXAKk.exe
  2⤵
  PID:9548
- C:\Windows\System\zQEqaKd.exe
  C:\Windows\System\zQEqaKd.exe
  2⤵
  PID:9564
- C:\Windows\System\KDLDZJR.exe
  C:\Windows\System\KDLDZJR.exe
  2⤵
  PID:9588
- C:\Windows\System\EaHTQCn.exe
  C:\Windows\System\EaHTQCn.exe
  2⤵
  PID:9616
- C:\Windows\System\wUxplTj.exe
  C:\Windows\System\wUxplTj.exe
  2⤵
  PID:9632
- C:\Windows\System\BvwSFhK.exe
  C:\Windows\System\BvwSFhK.exe
  2⤵
  PID:9648
- C:\Windows\System\uhQIhnK.exe
  C:\Windows\System\uhQIhnK.exe
  2⤵
  PID:9664
- C:\Windows\System\FSUCzPA.exe
  C:\Windows\System\FSUCzPA.exe
  2⤵
  PID:9692
- C:\Windows\System\yExVive.exe
  C:\Windows\System\yExVive.exe
  2⤵
  PID:9708
- C:\Windows\System\AoInyCl.exe
  C:\Windows\System\AoInyCl.exe
  2⤵
  PID:9736
- C:\Windows\System\kkyBbkl.exe
  C:\Windows\System\kkyBbkl.exe
  2⤵
  PID:9752
- C:\Windows\System\jyzuXcZ.exe
  C:\Windows\System\jyzuXcZ.exe
  2⤵
  PID:9776
- C:\Windows\System\MbhVRZR.exe
  C:\Windows\System\MbhVRZR.exe
  2⤵
  PID:9792
- C:\Windows\System\logUgaJ.exe
  C:\Windows\System\logUgaJ.exe
  2⤵
  PID:9812
- C:\Windows\System\oNXDLvT.exe
  C:\Windows\System\oNXDLvT.exe
  2⤵
  PID:9828
- C:\Windows\System\NxYsqsc.exe
  C:\Windows\System\NxYsqsc.exe
  2⤵
  PID:9852
- C:\Windows\System\rwoKjyh.exe
  C:\Windows\System\rwoKjyh.exe
  2⤵
  PID:9872
- C:\Windows\System\qRnJgly.exe
  C:\Windows\System\qRnJgly.exe
  2⤵
  PID:9888
- C:\Windows\System\PBxqiNO.exe
  C:\Windows\System\PBxqiNO.exe
  2⤵
  PID:9904
- C:\Windows\System\QPjkDhE.exe
  C:\Windows\System\QPjkDhE.exe
  2⤵
  PID:9932
- C:\Windows\System\gvxjBcZ.exe
  C:\Windows\System\gvxjBcZ.exe
  2⤵
  PID:9960
- C:\Windows\System\rLMZDzR.exe
  C:\Windows\System\rLMZDzR.exe
  2⤵
  PID:9976
- C:\Windows\System\eOKZRdz.exe
  C:\Windows\System\eOKZRdz.exe
  2⤵
  PID:10000
- C:\Windows\System\lfzIFeq.exe
  C:\Windows\System\lfzIFeq.exe
  2⤵
  PID:10016
- C:\Windows\System\aIveTho.exe
  C:\Windows\System\aIveTho.exe
  2⤵
  PID:10032
- C:\Windows\System\bgfxJrS.exe
  C:\Windows\System\bgfxJrS.exe
  2⤵
  PID:10052
- C:\Windows\System\IIBRaRm.exe
  C:\Windows\System\IIBRaRm.exe
  2⤵
  PID:10068
- C:\Windows\System\tfuxEwC.exe
  C:\Windows\System\tfuxEwC.exe
  2⤵
  PID:10084
- C:\Windows\System\ONsBLlP.exe
  C:\Windows\System\ONsBLlP.exe
  2⤵
  PID:10128
- C:\Windows\System\YzcLIJt.exe
  C:\Windows\System\YzcLIJt.exe
  2⤵
  PID:10144
- C:\Windows\System\eTMsLZh.exe
  C:\Windows\System\eTMsLZh.exe
  2⤵
  PID:10164
- C:\Windows\System\UjvmpNq.exe
  C:\Windows\System\UjvmpNq.exe
  2⤵
  PID:10184
- C:\Windows\System\hQlbXub.exe
  C:\Windows\System\hQlbXub.exe
  2⤵
  PID:10200
- C:\Windows\System\oFEuJAt.exe
  C:\Windows\System\oFEuJAt.exe
  2⤵
  PID:10220
- C:\Windows\System\JDKMHbt.exe
  C:\Windows\System\JDKMHbt.exe
  2⤵
  PID:9220
- C:\Windows\System\qgIFLyB.exe
  C:\Windows\System\qgIFLyB.exe
  2⤵
  PID:9256
- C:\Windows\System\AFvnDTw.exe
  C:\Windows\System\AFvnDTw.exe
  2⤵
  PID:9336
- C:\Windows\System\KVeUGZJ.exe
  C:\Windows\System\KVeUGZJ.exe
  2⤵
  PID:9276
- C:\Windows\System\DjmCkcB.exe
  C:\Windows\System\DjmCkcB.exe
  2⤵
  PID:9348
- C:\Windows\System\SDmUhWs.exe
  C:\Windows\System\SDmUhWs.exe
  2⤵
  PID:9272
- C:\Windows\System\IfxMdGy.exe
  C:\Windows\System\IfxMdGy.exe
  2⤵
  PID:9436
- C:\Windows\System\ylUXaRp.exe
  C:\Windows\System\ylUXaRp.exe
  2⤵
  PID:9480
- C:\Windows\System\cKNakTg.exe
  C:\Windows\System\cKNakTg.exe
  2⤵
  PID:9448
- C:\Windows\System\jJGJAZX.exe
  C:\Windows\System\jJGJAZX.exe
  2⤵
  PID:9404
- C:\Windows\System\eHNcwbM.exe
  C:\Windows\System\eHNcwbM.exe
  2⤵
  PID:9484
- C:\Windows\System\ZcBgFvO.exe
  C:\Windows\System\ZcBgFvO.exe
  2⤵
  PID:9508
- C:\Windows\System\PteszgL.exe
  C:\Windows\System\PteszgL.exe
  2⤵
  PID:9596
- C:\Windows\System\jBgINSE.exe
  C:\Windows\System\jBgINSE.exe
  2⤵
  PID:9576
- C:\Windows\System\rAraypR.exe
  C:\Windows\System\rAraypR.exe
  2⤵
  PID:9640
- C:\Windows\System\XkzHiuV.exe
  C:\Windows\System\XkzHiuV.exe
  2⤵
  PID:9684
- C:\Windows\System\RxDYNLW.exe
  C:\Windows\System\RxDYNLW.exe
  2⤵
  PID:9628
- C:\Windows\System\EKSWRAA.exe
  C:\Windows\System\EKSWRAA.exe
  2⤵
  PID:9704
- C:\Windows\System\ThAdUNI.exe
  C:\Windows\System\ThAdUNI.exe
  2⤵
  PID:1560
- C:\Windows\System\XaBJVcj.exe
  C:\Windows\System\XaBJVcj.exe
  2⤵
  PID:9772
- C:\Windows\System\yXunBDn.exe
  C:\Windows\System\yXunBDn.exe
  2⤵
  PID:9804
- C:\Windows\System\Ugdowkf.exe
  C:\Windows\System\Ugdowkf.exe
  2⤵
  PID:9836
- C:\Windows\System\iVahvae.exe
  C:\Windows\System\iVahvae.exe
  2⤵
  PID:9864
- C:\Windows\System\CojZlnO.exe
  C:\Windows\System\CojZlnO.exe
  2⤵
  PID:9916
- C:\Windows\System\DXMpMLZ.exe
  C:\Windows\System\DXMpMLZ.exe
  2⤵
  PID:9944
- C:\Windows\System\xcEhgxe.exe
  C:\Windows\System\xcEhgxe.exe
  2⤵
  PID:9996
- C:\Windows\System\jltpWtL.exe
  C:\Windows\System\jltpWtL.exe
  2⤵
  PID:10040
- C:\Windows\System\MQYxjsw.exe
  C:\Windows\System\MQYxjsw.exe
  2⤵
  PID:10076
- C:\Windows\System\SqbtqSt.exe
  C:\Windows\System\SqbtqSt.exe
  2⤵
  PID:10100
- C:\Windows\System\GNzmTdk.exe
  C:\Windows\System\GNzmTdk.exe
  2⤵
  PID:10124
- C:\Windows\System\MOcOHsT.exe
  C:\Windows\System\MOcOHsT.exe
  2⤵
  PID:10156
- C:\Windows\System\mzsvXkJ.exe
  C:\Windows\System\mzsvXkJ.exe
  2⤵
  PID:10208
- C:\Windows\System\iOhhcNL.exe
  C:\Windows\System\iOhhcNL.exe
  2⤵
  PID:10212
- C:\Windows\System\OyIEnaq.exe
  C:\Windows\System\OyIEnaq.exe
  2⤵
  PID:9304
- C:\Windows\System\pNrYpNv.exe
  C:\Windows\System\pNrYpNv.exe
  2⤵
  PID:8784
- C:\Windows\System\atLkdso.exe
  C:\Windows\System\atLkdso.exe
  2⤵
  PID:9236
- C:\Windows\System\KVFZhgX.exe
  C:\Windows\System\KVFZhgX.exe
  2⤵
  PID:9380
- C:\Windows\System\XEkAsSl.exe
  C:\Windows\System\XEkAsSl.exe
  2⤵
  PID:9476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CAarxMZ.exe

Filesize
1.2MB

MD5
6958caddd1a634e5ebe7a3c247ef85d6

SHA1
47bf258510e39ab59d9b72ebb3737b3b9a088c95

SHA256
24c271775705c79c05e71516322e680bc88892c30790899a87118a19fa5c519b

SHA512
272cfb64ef31b83bf45ae093ce6743d0734ce64161ad1a2451aadb090aa0d61131f9e765e1fd68fdd39aec842e2300a19f45b0a8e35ebc8280014dbe51677ce5

Download Submit
C:\Windows\system\GwMcnyI.exe

Filesize
1.2MB

MD5
0a5399a1da6178eb2ff3d3a878605954

SHA1
495cc1a9ecb788b9a73871919b36f9444d130a27

SHA256
fcc5d2186f55445975f1fcd1b5e9b60cae0cf6c2194cd0bafceb129cc5a78c4b

SHA512
5f56329905a8523b7f8c2e96a0c42fd0e95b55b9f87b6fcbe818d68380a35cf57025d6e28d2383eb2efba905324ae277dba0bd4aa1cae0c9679b5837fd38dcf8

Download Submit
C:\Windows\system\HETdNno.exe

Filesize
1.2MB

MD5
9fc272dd008751dde495533dd5ab3bad

SHA1
85e634f8b5feefb68303181a00cdb62d8bb48470

SHA256
ec42cabc82cb1d120ed020e0311ec1edc046d56cd7317bf394fb6b5fdb93acdc

SHA512
8f359be07e0a7749844ca09e88870e18c275a3ebb811cc878503afdefa202ef610876ca034fe429abd964b1ec1c8cbf94b9c4a28addc24a971581a53a68cdf23

Download Submit
C:\Windows\system\JJEjQHI.exe

Filesize
1.2MB

MD5
55dc437f185e8cf30004f335106762ed

SHA1
612665c9336ae7760dc74a8b62f4760543428ce6

SHA256
2ebaee652b963d9aa15e9958fc322da971204ac14c5d2abbbe24b670f04a7fe0

SHA512
e02b84986b6b623ca1c4db341a1fd67347add56899c9e1013fe8e5bd0c65deee23791e1bc4ec4067f797b9a13789ba4c73dcd4639fc3cf73a097a8e587cafaea

Download Submit
C:\Windows\system\JMbnyWp.exe

Filesize
1.2MB

MD5
b25fa4e79dc2e58c81307a4f4b32064b

SHA1
493034584e5f99efed842b04b72ba879336e407b

SHA256
4c5e76fc3ea5b910f4ae1126bec7355e4c136b2b76a6ff6070b2206e1916e3ab

SHA512
578b3090bbd9f1176c74086f3488d3e0a97f66a9627ce9c113437072a2d6855a6b2d1c9a7aa04fd2aa9876606bdbbab147fab0dd375cdcecda5c29f8eafd465a

Download Submit
C:\Windows\system\KArAxKx.exe

Filesize
1.2MB

MD5
bf42d6739eb04f30226774cc7bfa3b55

SHA1
503778b1b12850ab97c2113a3c0f446e2a8410c1

SHA256
773cbcf9f07566ca4cd5afb595d7f9151eb7016a020d5e0bd0e98f912720f25c

SHA512
ba28c59e1fee7548dd2f7a8d14d73e9ee8c50da7cca02e8adab858bec39c38ce7f7851c441bc8909e9058f03c20b523292f23b8bd6735f3094450b5a792ad001

Download Submit
C:\Windows\system\KCErumj.exe

Filesize
1.2MB

MD5
6ae6f644094d7d1a6075c9d08e7bb649

SHA1
b93b37138b811844b88a9980a273808c21a81662

SHA256
4c0f57e3609da474669464d0dc46f6e75f26ad99110c75db2ebfec02942644bd

SHA512
aba2a09bd4f50d1409cec62077a6ec2b1da014ff3b22a992cb9c5a0780308259d32aa82ec9ceaeff077bb2cff56bb58ad70c9e9f5443adcfcf081617c7d9bb95

Download Submit
C:\Windows\system\KJHkSKZ.exe

Filesize
1.2MB

MD5
eeec16d129b6f983a6ef6b55405f9164

SHA1
26bf3fe00fc954b341937028a935d61205d92f73

SHA256
9dca28edc259a6bc2846453b75c225911b2dc71676183ed3b51a617158d82222

SHA512
6c9a6074590d096f1de7505c70189f877d44a12a7013bdf106a8c18501b3f003bdbb30e68b1ccd67ef4d320f281d36b7f02142f043df476d4d188567ebed06a7

Download Submit
C:\Windows\system\LHhcnJK.exe

Filesize
1.2MB

MD5
771aac1a58c8066738c8f93dfdda23ea

SHA1
63097ee4b77e6e97e3618bcc6c08cf2b1bf93c08

SHA256
f3dcd3f376985323f914c2439c6b90a53e589aca304626a90e7add7d8070856d

SHA512
be07b84123d46ffb363413b12eff803522d4877ae08504b4e28726a795ff81ecdfdb17f0df201d0d4d6e73bd1a2b6a9a033f60baa59b135ecc69cba068c82943

Download Submit
C:\Windows\system\SInwieV.exe

Filesize
1.2MB

MD5
4f0b62346b5d166db5483f785caa6fe4

SHA1
3c6ec78b15788dfbc236fcdef8be904efeca7cf4

SHA256
3b94e829b409aa33f801e0b7195f8748f67384986f09519a117ea8765c545822

SHA512
f1f755609d66bb7284236cfb09a2a454bfdf582ef2532fa327514240eabc73a89f809a7d15cad883d23f36c44ec79246a7ed4c55291c863efd1c8ca0104d5158

Download Submit
C:\Windows\system\STywIBS.exe

Filesize
1.2MB

MD5
e0b40aec1aed0031eb83ae2dcd5bcba2

SHA1
b3dfb73cd09e802b7436289684b2ad5ccea334a6

SHA256
880de31b20ff769a62a7014d6a789fd0b8f66dd0543e523c09f2afe01c51f143

SHA512
32018bc5583fd53d91b965828c9a31b619108e303e97e7893bd3afa77476b023db03304a66ddcdc4bb23dea108b4b6819425037590c0ed23404b56608a5f9344

Download Submit
C:\Windows\system\TeHPssY.exe

Filesize
1.2MB

MD5
2e4486b2d1761a53ae8cc9f7d7171fdc

SHA1
0fab7cf69487e3b2ffc5f4c8f2a947facdebc85e

SHA256
2c31dfac1b3810e4d9a64d005cf7b118e0824ec7adbfc40660a3c29ea50f5a93

SHA512
cd323dba7e9e4902f56735bc197aac2ce9a9a28c7340f239871bece4c85a994259629080652bc32a191da12b5e039551e96f45cd2271db6533195671ba69e715

Download Submit
C:\Windows\system\ZvWJvkX.exe

Filesize
1.2MB

MD5
41fe5f08b744552fe0e620750e256d7f

SHA1
d39e3c0def376f1224b394fba1ace2ad3d3e3bae

SHA256
4813018e6a65c2bde9845b88e9317b078d4a3f3c27d3d2d010223e5a7bbcfc83

SHA512
95c7eae3bceb2b9d2b063914568fffaca2ef1e457487ce41ee9feacafb97c1a0249bb3d883868963596750e67e4ccb8d17fd73b0a68c1782cdcb7d671e60815d

Download Submit
C:\Windows\system\bkEgjbm.exe

Filesize
1.2MB

MD5
b11efeeb85440a5312d79de508ea077d

SHA1
470fe615e1b34852a456259b9f0c0360ea29ec36

SHA256
2c90030d528309515fe6e43f41c1a7dda9a318adf5cc9a4c883c7b16e14688b1

SHA512
fc5cf46f298279f2a03dcfc1f8585b598b02027d9e37ba96864b5a83b60a188c7d9b556f3f180f0e9735a425cdddd5bda9f14fb6f10973795cc669be38b1a8ac

Download Submit
C:\Windows\system\hAPILlv.exe

Filesize
1.2MB

MD5
cecfa7edd6a9cc27aa75386c633290ac

SHA1
f484e4bbda3ae0b92e56d942ed9078782f707ed2

SHA256
0dce7cbc48a3114c14c0881636b3dc207f746233d93cc5772558b2fc118b57e6

SHA512
bf918dc143d19ef66fce3b011226146b673842e67a30cc28f18ebf48ec4c10db8e49892d784f6ff2e3ccb06c7cefbeb476159d2253ac74482ea13527f51bc1e9

Download Submit
C:\Windows\system\hMipmHJ.exe

Filesize
1.2MB

MD5
fdba363f01885d1ae105cfe0506b3b9c

SHA1
478efafba482f09e8180d139e91f215a182c5197

SHA256
32b953988d52766fc8cb09f5f4d488d1c468b4de1af75aec428ff47c323e1b0e

SHA512
69129ec73691b3fc9abe84afcaede035dc6b70f0405ac37ac6e9ed95e7f4fc3106e761cd2bf5df14eea7458004a2de4f01d501845eb43a1e85e90f7262594332

Download Submit
C:\Windows\system\inKobQv.exe

Filesize
1.2MB

MD5
5b51755ac800dcf2eb6b01773f049c79

SHA1
48e7be48257f6dac5b3042243b941957f81f5157

SHA256
9205a2ec9137ed10623b10f19db760c366a4a26dd8013bc81c0db89ddfc08a22

SHA512
e7211da576985cfe74c28a7319d27aec675f4f2b7aea366af03c00bc131c85b7a57fcf3149c9312cf04044ff1b8ae4c6302c95e5db3cca32f500183650bc9efb

Download Submit
C:\Windows\system\lydxRoq.exe

Filesize
1.2MB

MD5
28144d7084aca096c369a1a25770848b

SHA1
bf50b5919cc9af14497269ad780143c0e53700de

SHA256
8ad0c2a3b188d211de17e2b5e5595785218c2c58bf84e49f60d9c927baa0d1c3

SHA512
f9d0591fb2d51056658e9e9a221d8ca078a1f464aba72eb06c14534c79b59f91bec5aa1c2bf5781bc5fe9477d0bbcc7279e6c0502ab5f7857e4afac1e7947327

Download Submit
C:\Windows\system\mqmVzNk.exe

Filesize
1.2MB

MD5
dae9e7542247c44f52e05b57625fe147

SHA1
81c4bcb1fff73283a5162ea4ad72abc1446dd7a5

SHA256
7566ab0c62660788c9d61fffb33481405a55bad871c5db7bdf991dfd136beac9

SHA512
4bdfa276988027ee5d3ba3beb17c432fc1231ba412fdc23f91296ea3c728fa5573bb433899a861442c026b92138dba155c207555e021183c2a0a6b2f87b9c8c1

Download Submit
C:\Windows\system\olTVeiH.exe

Filesize
1.2MB

MD5
124dd85886bbff85932005f6713e371b

SHA1
ad6753eaff74bab69e685a6bcf1057a1d8d69ee8

SHA256
a20c3c56fc70f33601f7a1386354605dda973c242c9b8b8a27592ffcf773b76a

SHA512
77cbb4d8a6f77dbd89468554586aea006cf029e70ee53bb710a57cf2f1ece98f62d27c3d5cb58ccf70717b5e3a9c6b784217e2af52cdb7c938af715bcdeebccf

Download Submit
C:\Windows\system\pYJoZNL.exe

Filesize
1.2MB

MD5
42e48f83762e6e2f3cbea929dc74d773

SHA1
7caa1d081ffbdde5260ab9c01167a372f2adbff4

SHA256
1e73a5ef2fc0dc4bd24f5117b3b98aa272ddd808aee6473646181a645d9c782f

SHA512
7e11d5898e3f5aec9a90be8ececb4e12287b806c871ecd4262dbdbaf71bc279663f359a2e3e7d46817d73e72cdd0a4e6ee1ef43904cbd4869370c8b19c51cd84

Download Submit
C:\Windows\system\rpqLqUo.exe

Filesize
1.2MB

MD5
bea247072bb369cf5b2ca0fab64f0a89

SHA1
6ffd45fd07b3b35db01822b15c5277abae35996e

SHA256
350a5a1eb418d88d1e12f05a5ecb539fea3453dcc911a5c3544993e889ee9d43

SHA512
6b2e439115641df788ceee8a0d6d967df75a2274f7ca1cecebe800a3d46abdc8778227a40aa5e04c04e0b83c5f50b811ca5351d81eb455a00de058078ae6200b

Download Submit
C:\Windows\system\sREYXlp.exe

Filesize
1.2MB

MD5
376de11459dd405195ed1581fdf713fc

SHA1
da1073df81671f5d2397609ffce2cb0fc21e0c95

SHA256
268539dbd8fc3a34a41fdd8f188e3443bb1c5525d38d77a29acde6b85d5943de

SHA512
003c8f8d6e642444a28dabb53c120d36eb590630c81671c77fb41caf5342ff211a72a43ec0b6993cd8939ce2a0b7afe77655ebef2a4a790adb75325dd4fcac99

Download Submit
C:\Windows\system\slRreHw.exe

Filesize
1.2MB

MD5
84b855a5b0097b8b00c89bc5e7aea46a

SHA1
567fd0eb7b204c2b7e78471a1fa6652f75c76485

SHA256
9fb135ab4307a3b88704c70bf6f7d25bfbcfa9c9f085a35dd2ffe5453c5580a1

SHA512
7283a6513c8d085d3015c5be08752acabb56593c25f24fe7f1bd52c62129af94270a87bc4f40f58d7bf72c402af5e47ca32604b483f626124e7eb95c67eaaf0c

Download Submit
C:\Windows\system\tHcruei.exe

Filesize
1.2MB

MD5
7a1fe87eec882f9964eb217fe7ce2cd7

SHA1
9a65bc1a8908a546b038f109ea0f87a48de90273

SHA256
643b852edbe499e23801a733c4288109c6ed3f3ba6dd3b5fd0799991e2e14914

SHA512
d91b76ea8d869dd4ed0ac8ab06e21a95f8e3035c6feb8d0048228bfeb11d0685386673b4be7efec6c963afb90defb8d60d59028de7ad0322d618a8b9ae0a31d6

Download Submit
C:\Windows\system\tPYmiIz.exe

Filesize
1.2MB

MD5
b84870d23ef29f3c7de750c4ad7570b5

SHA1
a497bb3fd5e46648ffcc887fdf17ae6eb057b36e

SHA256
96363feb5aa4c44ff1605876f9c286131d0393d9a6f8d6bd0f50bcdf16334849

SHA512
2ff9dd1635abf49943e15b1185d92ecbfebeeead25809d4a8ad0a1f9d72b3cf1f163e41429a6a58d5c699850dc08cabc1155189dbc3c6b6971bce58aac669ee8

Download Submit
C:\Windows\system\wmvxTMI.exe

Filesize
1.2MB

MD5
d00cb647813b6e6246584345d4a54e49

SHA1
b7626cbc1d37b49d730d3aa7bee767ec3b1cbcd9

SHA256
4b1c2741b91a8f3da4ae6fdbf2eea5a8199850989ee8f12601e4318f59810350

SHA512
6b555d0f4e3964aade0ca3c600719019227768f233529379fc2f740c2507bbcefbd09bcd90ac72efbd80fb40ec45fbd254b7d1f81d631d81a842d928b994efd4

Download Submit
C:\Windows\system\yOOVlSQ.exe

Filesize
1.2MB

MD5
8c4ddd3449445d8be01e2e9132eba362

SHA1
966ae0002ce9ff6cafb568c6720b084e2425a2b4

SHA256
cc8f6d0a976fba09870911ed6d384c84a2aa5f60ab5062eb27e5fe9a9cb35b48

SHA512
0bc63550c6b2e744a491654587ae93103577613263c27caf1a477cc5e64c1344bea416ce55f6e422a3d3ad2bad1e35d7dd4478f34c8be51f2b1c051890a155ad

Download Submit
\Windows\system\RgOsgSp.exe

Filesize
1.2MB

MD5
0ef912db963f10dde5e389ad1380ba6c

SHA1
75ff42f0fc5048dbab591f22149310d08da02fad

SHA256
6456050568cd848c56b017aa6604f4591ffb4a69c8b0ecce5a3cc3aa8db0b148

SHA512
fe830fb185c0827bc5e0eb88edcafbc68f236564ebeae6d1b90e557106cbd40bc698a73f25c82a696ebd2fed67cd7df30a892e88c0d15dfd3ea7e21458bf97a0

Download Submit
\Windows\system\WtqtBKt.exe

Filesize
1.2MB

MD5
79c47102648431374820be945af1ccc0

SHA1
287163c657921b50db96ffb425f506d89a57c9e8

SHA256
3ea85418eafe846cd7735a61aa9bfea1bb7b67ac5af796683c9398e4984fd75e

SHA512
dc519fd4f911c74427a16c965e0eb3384dbac9ba78b9b6df1c5202f3ad8ec88953b37ff63725cd9b1ce23426bd1b60b4a7f67088ca0324c925642aae678a5be4

Download Submit
\Windows\system\mgrjZst.exe

Filesize
1.2MB

MD5
06547906e142b31e227b9e9eb0a83cbe

SHA1
9d983725ace320a616732d8591de6cdc29849f29

SHA256
ca565c4d56805335b195cc33f73fdef96b49be42a6ae89ec1ada0aedb0fbc82e

SHA512
730cd5e336a026c976de15ef013a71a8faadb9338531c6faf8641b1aab4575b8cad2c8823e0d268b8ae33b616a7dcdcdf7c031fd946f2381c5f7d955b88cdefc

Download Submit
\Windows\system\ppRPoKt.exe

Filesize
1.2MB

MD5
476ae827849fff6382c795aa16ae792b

SHA1
b9f4ca2833ab37a2735e7e7fec5d2e87a3397fb3

SHA256
c78344e1474e384e920d37b0c48a3f0afad05dbc181493abab93e2d1526eb5fb

SHA512
b5ba864b849dc5e6d6eed8561b2a1b03f25922f894f6d9e6572fd413d9c50be138e2e2c564bf3397413cfa35200af7595611bfb10df1a3a831a6e32114ade104

Download Submit
memory/1964-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download