xmrig | f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
Size

1.4MB
MD5

9581d00479a4ad2331f7bd9cc10eb576
SHA1

1762215e261ac82c54cf81c43267ff638c7521db
SHA256

f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86
SHA512

d2cc4206d85f00494b76c7673eb2fd68bd71c0de7906644763d56db4c5c814b83f5f8bdb0e65d116ccf7a0a524119439f3ef9a444db0686b647515d76e736791
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcd:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5L

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012263-2.dat	xmrig
behavioral1/files/0x0008000000016d42-8.dat	xmrig
behavioral1/files/0x0008000000016d27-9.dat	xmrig
behavioral1/files/0x0007000000016d66-24.dat	xmrig
behavioral1/files/0x0007000000016d4a-19.dat	xmrig
behavioral1/files/0x0007000000016dbc-28.dat	xmrig
behavioral1/files/0x0009000000016dc0-34.dat	xmrig
behavioral1/files/0x000500000001955c-43.dat	xmrig
behavioral1/files/0x00050000000195fe-78.dat	xmrig
behavioral1/files/0x000500000001969b-113.dat	xmrig
behavioral1/files/0x0005000000019d40-153.dat	xmrig
behavioral1/files/0x0005000000019da9-158.dat	xmrig
behavioral1/files/0x0005000000019d18-148.dat	xmrig
behavioral1/files/0x0005000000019c50-143.dat	xmrig
behavioral1/files/0x0005000000019c34-134.dat	xmrig
behavioral1/files/0x0005000000019c36-137.dat	xmrig
behavioral1/files/0x0005000000019c32-128.dat	xmrig
behavioral1/files/0x0005000000019999-123.dat	xmrig
behavioral1/files/0x00050000000196ed-117.dat	xmrig
behavioral1/files/0x0005000000019659-108.dat	xmrig
behavioral1/files/0x0005000000019615-103.dat	xmrig
behavioral1/files/0x0005000000019603-93.dat	xmrig
behavioral1/files/0x0005000000019605-98.dat	xmrig
behavioral1/files/0x0005000000019601-89.dat	xmrig
behavioral1/files/0x00050000000195ff-83.dat	xmrig
behavioral1/files/0x00050000000195fd-74.dat	xmrig
behavioral1/files/0x00050000000195f9-64.dat	xmrig
behavioral1/files/0x00050000000195fb-67.dat	xmrig
behavioral1/files/0x00050000000195f7-58.dat	xmrig
behavioral1/files/0x00050000000195c0-53.dat	xmrig
behavioral1/files/0x0005000000019581-48.dat	xmrig
behavioral1/files/0x0008000000016dc8-38.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2308	IFSRIVn.exe
2288	ItsnFFG.exe
1980	Nelczgc.exe
1976	rSVYXAB.exe
2724	MQzoIfk.exe
2504	yiIIXKY.exe
3044	tVwPtXU.exe
3040	sHVfeox.exe
2668	KaPPmqs.exe
2844	fRncmZr.exe
2772	xTUXJSX.exe
2004	WlYwQqi.exe
2652	xebyPRn.exe
1272	ujiAYEg.exe
2440	RJbHDbP.exe
2676	nnRBpLS.exe
1808	uwhbFNH.exe
1092	jRrVnhg.exe
1612	TkEGyrU.exe
2064	iQEjwDn.exe
1776	TKKAxgA.exe
236	RTunQSA.exe
1508	BkQTZYH.exe
2928	MvlHHwi.exe
1280	aMrKTLX.exe
1608	DHpaVGH.exe
1696	wouePxr.exe
2852	ROeIuEf.exe
2828	tNNaQEX.exe
2728	WNWgABE.exe
2216	FsJXbam.exe
2148	XxYXsLw.exe
2164	LmqAaKc.exe
3064	GLcVOev.exe
1148	EnSUGaj.exe
2340	jxEoHzp.exe
1996	ktucXiY.exe
1348	FZtYDDf.exe
1628	ytLDWhn.exe
1124	qwflgFa.exe
2040	KZJrSyq.exe
1252	QfAMXEX.exe
768	KQHyHLp.exe
2596	BbdtyAX.exe
752	lWZtLOE.exe
2364	FTsxuav.exe
1548	oLdOyHZ.exe
2508	fERgujr.exe
2052	kRzGKGX.exe
2088	tglShnn.exe
556	nQoBPDF.exe
2100	VVuvFAm.exe
1052	LBGElaI.exe
3048	muhPUQI.exe
992	yvavTll.exe
1268	iJRYyGl.exe
1824	ShVqiVe.exe
876	WaiAxLS.exe
2448	zzKxMvx.exe
1592	IxsCFYN.exe
1584	ZylMNuR.exe
2588	bIPkTKN.exe
2372	vKymZbi.exe
1028	XNCmuxG.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vjgijGH.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\HYDaPuv.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\DFgRKQv.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\wSvlXnT.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\XNCmuxG.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\jIoxniI.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\Wbfkmvl.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\IpedJAX.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\bJwwyzw.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\VJvCecj.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\MrJXiAq.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\zVhtEvu.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\ooOQOCQ.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\ZauhqTi.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\dqcXGlD.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\LReXxBS.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\GBwWlIN.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\WMcanoU.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\ytjlmul.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\gHRUZJV.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\DulTdVh.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\yjyelMp.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\FiIeuHD.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\PlmmCcG.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\VNkeABA.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\CawPiXa.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\EUcrTLD.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\GJJDWrq.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\uIsBJLw.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\LWbSXBL.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\sNtrSsL.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\UbrbuFP.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\HOtaTdo.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\YobwNDL.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\WzsgCkk.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\mKBGNgr.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\SSxtIPf.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\UPSpIyV.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\zNFUxCn.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\HDzTDMp.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\WaiAxLS.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\lPLatcZ.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\FelbBIv.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\LtPTicH.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\scpXOJc.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\sYxIUmH.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\dzUqzwl.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\rMPAchK.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\nwUMBrz.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\AXstVSr.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\lkHjoCi.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\ClCGPgP.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\aHQwUSU.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\WGcuIow.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\NeyKEiM.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\cEaGSkq.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\hVyDMZA.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\pcsnoRy.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\pjjNMAf.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\jWWjqAu.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\zetqsgF.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\APCqgIc.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\SBmhzva.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
File created	C:\Windows\System\TJGlOLj.exe	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2308	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	32
PID 1728 wrote to memory of 2308	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	32
PID 1728 wrote to memory of 2308	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	32
PID 1728 wrote to memory of 2288	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	33
PID 1728 wrote to memory of 2288	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	33
PID 1728 wrote to memory of 2288	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	33
PID 1728 wrote to memory of 1980	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	34
PID 1728 wrote to memory of 1980	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	34
PID 1728 wrote to memory of 1980	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	34
PID 1728 wrote to memory of 1976	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	35
PID 1728 wrote to memory of 1976	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	35
PID 1728 wrote to memory of 1976	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	35
PID 1728 wrote to memory of 2724	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	36
PID 1728 wrote to memory of 2724	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	36
PID 1728 wrote to memory of 2724	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	36
PID 1728 wrote to memory of 2504	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	37
PID 1728 wrote to memory of 2504	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	37
PID 1728 wrote to memory of 2504	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	37
PID 1728 wrote to memory of 3044	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	38
PID 1728 wrote to memory of 3044	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	38
PID 1728 wrote to memory of 3044	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	38
PID 1728 wrote to memory of 3040	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	39
PID 1728 wrote to memory of 3040	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	39
PID 1728 wrote to memory of 3040	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	39
PID 1728 wrote to memory of 2668	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	40
PID 1728 wrote to memory of 2668	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	40
PID 1728 wrote to memory of 2668	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	40
PID 1728 wrote to memory of 2844	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	41
PID 1728 wrote to memory of 2844	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	41
PID 1728 wrote to memory of 2844	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	41
PID 1728 wrote to memory of 2772	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	42
PID 1728 wrote to memory of 2772	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	42
PID 1728 wrote to memory of 2772	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	42
PID 1728 wrote to memory of 2004	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	43
PID 1728 wrote to memory of 2004	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	43
PID 1728 wrote to memory of 2004	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	43
PID 1728 wrote to memory of 2652	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	44
PID 1728 wrote to memory of 2652	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	44
PID 1728 wrote to memory of 2652	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	44
PID 1728 wrote to memory of 1272	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	45
PID 1728 wrote to memory of 1272	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	45
PID 1728 wrote to memory of 1272	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	45
PID 1728 wrote to memory of 2440	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	46
PID 1728 wrote to memory of 2440	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	46
PID 1728 wrote to memory of 2440	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	46
PID 1728 wrote to memory of 2676	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	47
PID 1728 wrote to memory of 2676	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	47
PID 1728 wrote to memory of 2676	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	47
PID 1728 wrote to memory of 1808	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	48
PID 1728 wrote to memory of 1808	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	48
PID 1728 wrote to memory of 1808	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	48
PID 1728 wrote to memory of 1092	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	49
PID 1728 wrote to memory of 1092	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	49
PID 1728 wrote to memory of 1092	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	49
PID 1728 wrote to memory of 1612	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	50
PID 1728 wrote to memory of 1612	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	50
PID 1728 wrote to memory of 1612	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	50
PID 1728 wrote to memory of 2064	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	51
PID 1728 wrote to memory of 2064	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	51
PID 1728 wrote to memory of 2064	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	51
PID 1728 wrote to memory of 1776	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	52
PID 1728 wrote to memory of 1776	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	52
PID 1728 wrote to memory of 1776	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	52
PID 1728 wrote to memory of 236	1728	f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe	53

C:\Users\Admin\AppData\Local\Temp\f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe
"C:\Users\Admin\AppData\Local\Temp\f890e24428776c46b9eb615fce4bbe5393c4accc8c1c6062366650f9386d4b86.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System\IFSRIVn.exe
  C:\Windows\System\IFSRIVn.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ItsnFFG.exe
  C:\Windows\System\ItsnFFG.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\Nelczgc.exe
  C:\Windows\System\Nelczgc.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\rSVYXAB.exe
  C:\Windows\System\rSVYXAB.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\MQzoIfk.exe
  C:\Windows\System\MQzoIfk.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\yiIIXKY.exe
  C:\Windows\System\yiIIXKY.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\tVwPtXU.exe
  C:\Windows\System\tVwPtXU.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\sHVfeox.exe
  C:\Windows\System\sHVfeox.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KaPPmqs.exe
  C:\Windows\System\KaPPmqs.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fRncmZr.exe
  C:\Windows\System\fRncmZr.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\xTUXJSX.exe
  C:\Windows\System\xTUXJSX.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\WlYwQqi.exe
  C:\Windows\System\WlYwQqi.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\xebyPRn.exe
  C:\Windows\System\xebyPRn.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ujiAYEg.exe
  C:\Windows\System\ujiAYEg.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\RJbHDbP.exe
  C:\Windows\System\RJbHDbP.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\nnRBpLS.exe
  C:\Windows\System\nnRBpLS.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\uwhbFNH.exe
  C:\Windows\System\uwhbFNH.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\jRrVnhg.exe
  C:\Windows\System\jRrVnhg.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\TkEGyrU.exe
  C:\Windows\System\TkEGyrU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\iQEjwDn.exe
  C:\Windows\System\iQEjwDn.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\TKKAxgA.exe
  C:\Windows\System\TKKAxgA.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\RTunQSA.exe
  C:\Windows\System\RTunQSA.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\BkQTZYH.exe
  C:\Windows\System\BkQTZYH.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\MvlHHwi.exe
  C:\Windows\System\MvlHHwi.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\aMrKTLX.exe
  C:\Windows\System\aMrKTLX.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\DHpaVGH.exe
  C:\Windows\System\DHpaVGH.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wouePxr.exe
  C:\Windows\System\wouePxr.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ROeIuEf.exe
  C:\Windows\System\ROeIuEf.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\tNNaQEX.exe
  C:\Windows\System\tNNaQEX.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\WNWgABE.exe
  C:\Windows\System\WNWgABE.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\FsJXbam.exe
  C:\Windows\System\FsJXbam.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\XxYXsLw.exe
  C:\Windows\System\XxYXsLw.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\LmqAaKc.exe
  C:\Windows\System\LmqAaKc.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\GLcVOev.exe
  C:\Windows\System\GLcVOev.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EnSUGaj.exe
  C:\Windows\System\EnSUGaj.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\jxEoHzp.exe
  C:\Windows\System\jxEoHzp.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ktucXiY.exe
  C:\Windows\System\ktucXiY.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FZtYDDf.exe
  C:\Windows\System\FZtYDDf.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ytLDWhn.exe
  C:\Windows\System\ytLDWhn.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\qwflgFa.exe
  C:\Windows\System\qwflgFa.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\KZJrSyq.exe
  C:\Windows\System\KZJrSyq.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\QfAMXEX.exe
  C:\Windows\System\QfAMXEX.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\KQHyHLp.exe
  C:\Windows\System\KQHyHLp.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\BbdtyAX.exe
  C:\Windows\System\BbdtyAX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\lWZtLOE.exe
  C:\Windows\System\lWZtLOE.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\FTsxuav.exe
  C:\Windows\System\FTsxuav.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\oLdOyHZ.exe
  C:\Windows\System\oLdOyHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\fERgujr.exe
  C:\Windows\System\fERgujr.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kRzGKGX.exe
  C:\Windows\System\kRzGKGX.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\tglShnn.exe
  C:\Windows\System\tglShnn.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\nQoBPDF.exe
  C:\Windows\System\nQoBPDF.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\VVuvFAm.exe
  C:\Windows\System\VVuvFAm.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\LBGElaI.exe
  C:\Windows\System\LBGElaI.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\muhPUQI.exe
  C:\Windows\System\muhPUQI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\yvavTll.exe
  C:\Windows\System\yvavTll.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\iJRYyGl.exe
  C:\Windows\System\iJRYyGl.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\ShVqiVe.exe
  C:\Windows\System\ShVqiVe.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\WaiAxLS.exe
  C:\Windows\System\WaiAxLS.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\zzKxMvx.exe
  C:\Windows\System\zzKxMvx.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\IxsCFYN.exe
  C:\Windows\System\IxsCFYN.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ZylMNuR.exe
  C:\Windows\System\ZylMNuR.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\bIPkTKN.exe
  C:\Windows\System\bIPkTKN.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\vKymZbi.exe
  C:\Windows\System\vKymZbi.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\XNCmuxG.exe
  C:\Windows\System\XNCmuxG.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\gndQYZL.exe
  C:\Windows\System\gndQYZL.exe
  2⤵
  PID:2780
- C:\Windows\System\dPhJmeQ.exe
  C:\Windows\System\dPhJmeQ.exe
  2⤵
  PID:2276
- C:\Windows\System\ofpakrF.exe
  C:\Windows\System\ofpakrF.exe
  2⤵
  PID:2932
- C:\Windows\System\dRGUkUO.exe
  C:\Windows\System\dRGUkUO.exe
  2⤵
  PID:2720
- C:\Windows\System\gzUYMfi.exe
  C:\Windows\System\gzUYMfi.exe
  2⤵
  PID:2644
- C:\Windows\System\DesdUGG.exe
  C:\Windows\System\DesdUGG.exe
  2⤵
  PID:2256
- C:\Windows\System\xeTVghS.exe
  C:\Windows\System\xeTVghS.exe
  2⤵
  PID:2704
- C:\Windows\System\SVocPqY.exe
  C:\Windows\System\SVocPqY.exe
  2⤵
  PID:1804
- C:\Windows\System\sYxIUmH.exe
  C:\Windows\System\sYxIUmH.exe
  2⤵
  PID:2620
- C:\Windows\System\SAWezvj.exe
  C:\Windows\System\SAWezvj.exe
  2⤵
  PID:1288
- C:\Windows\System\aiybeEa.exe
  C:\Windows\System\aiybeEa.exe
  2⤵
  PID:2604
- C:\Windows\System\xeoDnUI.exe
  C:\Windows\System\xeoDnUI.exe
  2⤵
  PID:2860
- C:\Windows\System\aBdajOx.exe
  C:\Windows\System\aBdajOx.exe
  2⤵
  PID:2056
- C:\Windows\System\zihRacQ.exe
  C:\Windows\System\zihRacQ.exe
  2⤵
  PID:688
- C:\Windows\System\PcLlbEW.exe
  C:\Windows\System\PcLlbEW.exe
  2⤵
  PID:316
- C:\Windows\System\JIUNjuV.exe
  C:\Windows\System\JIUNjuV.exe
  2⤵
  PID:2948
- C:\Windows\System\RtqJCwt.exe
  C:\Windows\System\RtqJCwt.exe
  2⤵
  PID:3000
- C:\Windows\System\iLiqMaL.exe
  C:\Windows\System\iLiqMaL.exe
  2⤵
  PID:2168
- C:\Windows\System\qDXNxVb.exe
  C:\Windows\System\qDXNxVb.exe
  2⤵
  PID:1528
- C:\Windows\System\ZJSbEIE.exe
  C:\Windows\System\ZJSbEIE.exe
  2⤵
  PID:448
- C:\Windows\System\gHMapjw.exe
  C:\Windows\System\gHMapjw.exe
  2⤵
  PID:2980
- C:\Windows\System\MVlCqCr.exe
  C:\Windows\System\MVlCqCr.exe
  2⤵
  PID:1604
- C:\Windows\System\FJbcqqc.exe
  C:\Windows\System\FJbcqqc.exe
  2⤵
  PID:1840
- C:\Windows\System\kYxbkiS.exe
  C:\Windows\System\kYxbkiS.exe
  2⤵
  PID:344
- C:\Windows\System\zetqsgF.exe
  C:\Windows\System\zetqsgF.exe
  2⤵
  PID:2144
- C:\Windows\System\FmMrXtY.exe
  C:\Windows\System\FmMrXtY.exe
  2⤵
  PID:2020
- C:\Windows\System\bcvOAwT.exe
  C:\Windows\System\bcvOAwT.exe
  2⤵
  PID:2376
- C:\Windows\System\bTSinOx.exe
  C:\Windows\System\bTSinOx.exe
  2⤵
  PID:2992
- C:\Windows\System\YItxDpl.exe
  C:\Windows\System\YItxDpl.exe
  2⤵
  PID:2140
- C:\Windows\System\OQxZVtG.exe
  C:\Windows\System\OQxZVtG.exe
  2⤵
  PID:2496
- C:\Windows\System\HeATQmr.exe
  C:\Windows\System\HeATQmr.exe
  2⤵
  PID:872
- C:\Windows\System\LRAFeBe.exe
  C:\Windows\System\LRAFeBe.exe
  2⤵
  PID:1944
- C:\Windows\System\vrtiCDu.exe
  C:\Windows\System\vrtiCDu.exe
  2⤵
  PID:960
- C:\Windows\System\YaODCKg.exe
  C:\Windows\System\YaODCKg.exe
  2⤵
  PID:2544
- C:\Windows\System\UyUqhMr.exe
  C:\Windows\System\UyUqhMr.exe
  2⤵
  PID:1568
- C:\Windows\System\twBKpTf.exe
  C:\Windows\System\twBKpTf.exe
  2⤵
  PID:1972
- C:\Windows\System\TGKFEyW.exe
  C:\Windows\System\TGKFEyW.exe
  2⤵
  PID:1968
- C:\Windows\System\upOntEG.exe
  C:\Windows\System\upOntEG.exe
  2⤵
  PID:580
- C:\Windows\System\ADdmAqR.exe
  C:\Windows\System\ADdmAqR.exe
  2⤵
  PID:2796
- C:\Windows\System\CGjCrdg.exe
  C:\Windows\System\CGjCrdg.exe
  2⤵
  PID:2688
- C:\Windows\System\BxdAvRN.exe
  C:\Windows\System\BxdAvRN.exe
  2⤵
  PID:2708
- C:\Windows\System\OMjvAjf.exe
  C:\Windows\System\OMjvAjf.exe
  2⤵
  PID:1664
- C:\Windows\System\GOdYDQg.exe
  C:\Windows\System\GOdYDQg.exe
  2⤵
  PID:1336
- C:\Windows\System\mirUMJK.exe
  C:\Windows\System\mirUMJK.exe
  2⤵
  PID:1596
- C:\Windows\System\giphdBM.exe
  C:\Windows\System\giphdBM.exe
  2⤵
  PID:2700
- C:\Windows\System\UUBwfNa.exe
  C:\Windows\System\UUBwfNa.exe
  2⤵
  PID:272
- C:\Windows\System\HVaqyIi.exe
  C:\Windows\System\HVaqyIi.exe
  2⤵
  PID:2116
- C:\Windows\System\xMQOAVT.exe
  C:\Windows\System\xMQOAVT.exe
  2⤵
  PID:3024
- C:\Windows\System\XdaqNzH.exe
  C:\Windows\System\XdaqNzH.exe
  2⤵
  PID:808
- C:\Windows\System\NeyKEiM.exe
  C:\Windows\System\NeyKEiM.exe
  2⤵
  PID:2464
- C:\Windows\System\LvRQsrL.exe
  C:\Windows\System\LvRQsrL.exe
  2⤵
  PID:1088
- C:\Windows\System\EhlOaqI.exe
  C:\Windows\System\EhlOaqI.exe
  2⤵
  PID:2292
- C:\Windows\System\CJHfFkl.exe
  C:\Windows\System\CJHfFkl.exe
  2⤵
  PID:1760
- C:\Windows\System\CMJAaxZ.exe
  C:\Windows\System\CMJAaxZ.exe
  2⤵
  PID:2528
- C:\Windows\System\ztIIfXy.exe
  C:\Windows\System\ztIIfXy.exe
  2⤵
  PID:2456
- C:\Windows\System\fSfnxOj.exe
  C:\Windows\System\fSfnxOj.exe
  2⤵
  PID:2480
- C:\Windows\System\eIiXptk.exe
  C:\Windows\System\eIiXptk.exe
  2⤵
  PID:1880
- C:\Windows\System\bQhjfaU.exe
  C:\Windows\System\bQhjfaU.exe
  2⤵
  PID:1956
- C:\Windows\System\JdCeRqh.exe
  C:\Windows\System\JdCeRqh.exe
  2⤵
  PID:2296
- C:\Windows\System\tgzAWQC.exe
  C:\Windows\System\tgzAWQC.exe
  2⤵
  PID:3084
- C:\Windows\System\NynqKpu.exe
  C:\Windows\System\NynqKpu.exe
  2⤵
  PID:3104
- C:\Windows\System\uhMSKBP.exe
  C:\Windows\System\uhMSKBP.exe
  2⤵
  PID:3124
- C:\Windows\System\ZDSQHzk.exe
  C:\Windows\System\ZDSQHzk.exe
  2⤵
  PID:3144
- C:\Windows\System\mbRtvTx.exe
  C:\Windows\System\mbRtvTx.exe
  2⤵
  PID:3164
- C:\Windows\System\gZsIJLv.exe
  C:\Windows\System\gZsIJLv.exe
  2⤵
  PID:3184
- C:\Windows\System\YXdygoL.exe
  C:\Windows\System\YXdygoL.exe
  2⤵
  PID:3200
- C:\Windows\System\pCQghXH.exe
  C:\Windows\System\pCQghXH.exe
  2⤵
  PID:3224
- C:\Windows\System\HRPQvFq.exe
  C:\Windows\System\HRPQvFq.exe
  2⤵
  PID:3244
- C:\Windows\System\eTQzSWA.exe
  C:\Windows\System\eTQzSWA.exe
  2⤵
  PID:3264
- C:\Windows\System\TVKvWEv.exe
  C:\Windows\System\TVKvWEv.exe
  2⤵
  PID:3284
- C:\Windows\System\YibnBwM.exe
  C:\Windows\System\YibnBwM.exe
  2⤵
  PID:3304
- C:\Windows\System\XMGLwtZ.exe
  C:\Windows\System\XMGLwtZ.exe
  2⤵
  PID:3324
- C:\Windows\System\FWQRYkN.exe
  C:\Windows\System\FWQRYkN.exe
  2⤵
  PID:3344
- C:\Windows\System\MoBvoGg.exe
  C:\Windows\System\MoBvoGg.exe
  2⤵
  PID:3364
- C:\Windows\System\ZHLuOSt.exe
  C:\Windows\System\ZHLuOSt.exe
  2⤵
  PID:3384
- C:\Windows\System\APAeAXO.exe
  C:\Windows\System\APAeAXO.exe
  2⤵
  PID:3404
- C:\Windows\System\ZeuVWqQ.exe
  C:\Windows\System\ZeuVWqQ.exe
  2⤵
  PID:3424
- C:\Windows\System\UMtUKyb.exe
  C:\Windows\System\UMtUKyb.exe
  2⤵
  PID:3440
- C:\Windows\System\CbFfUGY.exe
  C:\Windows\System\CbFfUGY.exe
  2⤵
  PID:3464
- C:\Windows\System\uPigZVJ.exe
  C:\Windows\System\uPigZVJ.exe
  2⤵
  PID:3484
- C:\Windows\System\BRNuptX.exe
  C:\Windows\System\BRNuptX.exe
  2⤵
  PID:3504
- C:\Windows\System\buEVVIe.exe
  C:\Windows\System\buEVVIe.exe
  2⤵
  PID:3520
- C:\Windows\System\mYCHQiA.exe
  C:\Windows\System\mYCHQiA.exe
  2⤵
  PID:3544
- C:\Windows\System\kBJnGrP.exe
  C:\Windows\System\kBJnGrP.exe
  2⤵
  PID:3560
- C:\Windows\System\KKkqlde.exe
  C:\Windows\System\KKkqlde.exe
  2⤵
  PID:3584
- C:\Windows\System\cEaGSkq.exe
  C:\Windows\System\cEaGSkq.exe
  2⤵
  PID:3600
- C:\Windows\System\QxASeuh.exe
  C:\Windows\System\QxASeuh.exe
  2⤵
  PID:3624
- C:\Windows\System\PfZZFkv.exe
  C:\Windows\System\PfZZFkv.exe
  2⤵
  PID:3640
- C:\Windows\System\VEwbijy.exe
  C:\Windows\System\VEwbijy.exe
  2⤵
  PID:3664
- C:\Windows\System\FnFUhgv.exe
  C:\Windows\System\FnFUhgv.exe
  2⤵
  PID:3680
- C:\Windows\System\VuHEFLo.exe
  C:\Windows\System\VuHEFLo.exe
  2⤵
  PID:3700
- C:\Windows\System\WAjtiOW.exe
  C:\Windows\System\WAjtiOW.exe
  2⤵
  PID:3720
- C:\Windows\System\UwYDWKQ.exe
  C:\Windows\System\UwYDWKQ.exe
  2⤵
  PID:3740
- C:\Windows\System\LbFPvTw.exe
  C:\Windows\System\LbFPvTw.exe
  2⤵
  PID:3760
- C:\Windows\System\NvRPTfb.exe
  C:\Windows\System\NvRPTfb.exe
  2⤵
  PID:3780
- C:\Windows\System\ELrmniZ.exe
  C:\Windows\System\ELrmniZ.exe
  2⤵
  PID:3804
- C:\Windows\System\YtlghxE.exe
  C:\Windows\System\YtlghxE.exe
  2⤵
  PID:3824
- C:\Windows\System\NKMzRZe.exe
  C:\Windows\System\NKMzRZe.exe
  2⤵
  PID:3844
- C:\Windows\System\WagjEpf.exe
  C:\Windows\System\WagjEpf.exe
  2⤵
  PID:3864
- C:\Windows\System\jrYwVtR.exe
  C:\Windows\System\jrYwVtR.exe
  2⤵
  PID:3880
- C:\Windows\System\VRWFZtp.exe
  C:\Windows\System\VRWFZtp.exe
  2⤵
  PID:3904
- C:\Windows\System\TQYPsfl.exe
  C:\Windows\System\TQYPsfl.exe
  2⤵
  PID:3920
- C:\Windows\System\BZrlcEm.exe
  C:\Windows\System\BZrlcEm.exe
  2⤵
  PID:3940
- C:\Windows\System\DqXEKlb.exe
  C:\Windows\System\DqXEKlb.exe
  2⤵
  PID:3964
- C:\Windows\System\lxzZiqL.exe
  C:\Windows\System\lxzZiqL.exe
  2⤵
  PID:3980
- C:\Windows\System\HPFNBsB.exe
  C:\Windows\System\HPFNBsB.exe
  2⤵
  PID:4000
- C:\Windows\System\sGxcPWA.exe
  C:\Windows\System\sGxcPWA.exe
  2⤵
  PID:4024
- C:\Windows\System\ftGscDb.exe
  C:\Windows\System\ftGscDb.exe
  2⤵
  PID:4040
- C:\Windows\System\kUHLCbC.exe
  C:\Windows\System\kUHLCbC.exe
  2⤵
  PID:4064
- C:\Windows\System\bwvqqSF.exe
  C:\Windows\System\bwvqqSF.exe
  2⤵
  PID:4080
- C:\Windows\System\SkYDpzt.exe
  C:\Windows\System\SkYDpzt.exe
  2⤵
  PID:1484
- C:\Windows\System\ZWVqOUE.exe
  C:\Windows\System\ZWVqOUE.exe
  2⤵
  PID:2684
- C:\Windows\System\aehiFAC.exe
  C:\Windows\System\aehiFAC.exe
  2⤵
  PID:2776
- C:\Windows\System\zulFgqe.exe
  C:\Windows\System\zulFgqe.exe
  2⤵
  PID:1104
- C:\Windows\System\VFmZtGa.exe
  C:\Windows\System\VFmZtGa.exe
  2⤵
  PID:2356
- C:\Windows\System\TVgoBVx.exe
  C:\Windows\System\TVgoBVx.exe
  2⤵
  PID:2956
- C:\Windows\System\UqLgJyj.exe
  C:\Windows\System\UqLgJyj.exe
  2⤵
  PID:2392
- C:\Windows\System\ujajHLW.exe
  C:\Windows\System\ujajHLW.exe
  2⤵
  PID:2740
- C:\Windows\System\pDvOKxq.exe
  C:\Windows\System\pDvOKxq.exe
  2⤵
  PID:836
- C:\Windows\System\DSkxZOP.exe
  C:\Windows\System\DSkxZOP.exe
  2⤵
  PID:1064
- C:\Windows\System\hgcnTyo.exe
  C:\Windows\System\hgcnTyo.exe
  2⤵
  PID:1744
- C:\Windows\System\rPyRplX.exe
  C:\Windows\System\rPyRplX.exe
  2⤵
  PID:1816
- C:\Windows\System\KuSuGkT.exe
  C:\Windows\System\KuSuGkT.exe
  2⤵
  PID:1704
- C:\Windows\System\WHKHoHv.exe
  C:\Windows\System\WHKHoHv.exe
  2⤵
  PID:2312
- C:\Windows\System\GDbHobA.exe
  C:\Windows\System\GDbHobA.exe
  2⤵
  PID:3080
- C:\Windows\System\pZDIoWI.exe
  C:\Windows\System\pZDIoWI.exe
  2⤵
  PID:3140
- C:\Windows\System\uIPHXae.exe
  C:\Windows\System\uIPHXae.exe
  2⤵
  PID:3180
- C:\Windows\System\eYoDRQh.exe
  C:\Windows\System\eYoDRQh.exe
  2⤵
  PID:3192
- C:\Windows\System\JOdcBKZ.exe
  C:\Windows\System\JOdcBKZ.exe
  2⤵
  PID:3232
- C:\Windows\System\qgwdNpQ.exe
  C:\Windows\System\qgwdNpQ.exe
  2⤵
  PID:3236
- C:\Windows\System\ILqLiib.exe
  C:\Windows\System\ILqLiib.exe
  2⤵
  PID:3276
- C:\Windows\System\JgSNsUJ.exe
  C:\Windows\System\JgSNsUJ.exe
  2⤵
  PID:3280
- C:\Windows\System\jpvYLZs.exe
  C:\Windows\System\jpvYLZs.exe
  2⤵
  PID:3376
- C:\Windows\System\sscFPYv.exe
  C:\Windows\System\sscFPYv.exe
  2⤵
  PID:3412
- C:\Windows\System\UCQiESB.exe
  C:\Windows\System\UCQiESB.exe
  2⤵
  PID:3400
- C:\Windows\System\KFHtqOP.exe
  C:\Windows\System\KFHtqOP.exe
  2⤵
  PID:3492
- C:\Windows\System\DPYYawm.exe
  C:\Windows\System\DPYYawm.exe
  2⤵
  PID:3496
- C:\Windows\System\gSjKRba.exe
  C:\Windows\System\gSjKRba.exe
  2⤵
  PID:3480
- C:\Windows\System\HCAzWfy.exe
  C:\Windows\System\HCAzWfy.exe
  2⤵
  PID:3572
- C:\Windows\System\TEefvYo.exe
  C:\Windows\System\TEefvYo.exe
  2⤵
  PID:2220
- C:\Windows\System\jlWDRTc.exe
  C:\Windows\System\jlWDRTc.exe
  2⤵
  PID:3616
- C:\Windows\System\hbxrUtE.exe
  C:\Windows\System\hbxrUtE.exe
  2⤵
  PID:3636
- C:\Windows\System\xtHOUhd.exe
  C:\Windows\System\xtHOUhd.exe
  2⤵
  PID:3692
- C:\Windows\System\pUnKsPK.exe
  C:\Windows\System\pUnKsPK.exe
  2⤵
  PID:3732
- C:\Windows\System\kKVJbcr.exe
  C:\Windows\System\kKVJbcr.exe
  2⤵
  PID:3748
- C:\Windows\System\unBXXtT.exe
  C:\Windows\System\unBXXtT.exe
  2⤵
  PID:3812
- C:\Windows\System\hSQXDTV.exe
  C:\Windows\System\hSQXDTV.exe
  2⤵
  PID:3856
- C:\Windows\System\vhZYLnC.exe
  C:\Windows\System\vhZYLnC.exe
  2⤵
  PID:3836
- C:\Windows\System\vSQlVbZ.exe
  C:\Windows\System\vSQlVbZ.exe
  2⤵
  PID:3872
- C:\Windows\System\oOnqoLM.exe
  C:\Windows\System\oOnqoLM.exe
  2⤵
  PID:3912
- C:\Windows\System\scFgLMY.exe
  C:\Windows\System\scFgLMY.exe
  2⤵
  PID:2972
- C:\Windows\System\zPYOrSh.exe
  C:\Windows\System\zPYOrSh.exe
  2⤵
  PID:3956
- C:\Windows\System\zRxMLzi.exe
  C:\Windows\System\zRxMLzi.exe
  2⤵
  PID:4016
- C:\Windows\System\QBaTDfm.exe
  C:\Windows\System\QBaTDfm.exe
  2⤵
  PID:3996
- C:\Windows\System\RJaBfpu.exe
  C:\Windows\System\RJaBfpu.exe
  2⤵
  PID:4036
- C:\Windows\System\xFFQfPJ.exe
  C:\Windows\System\xFFQfPJ.exe
  2⤵
  PID:4092
- C:\Windows\System\TyejGOc.exe
  C:\Windows\System\TyejGOc.exe
  2⤵
  PID:2988
- C:\Windows\System\BhqxQLQ.exe
  C:\Windows\System\BhqxQLQ.exe
  2⤵
  PID:1340
- C:\Windows\System\OAjYISC.exe
  C:\Windows\System\OAjYISC.exe
  2⤵
  PID:1236
- C:\Windows\System\bCZlxDq.exe
  C:\Windows\System\bCZlxDq.exe
  2⤵
  PID:1828
- C:\Windows\System\YebGKJk.exe
  C:\Windows\System\YebGKJk.exe
  2⤵
  PID:3020
- C:\Windows\System\rQlVpgt.exe
  C:\Windows\System\rQlVpgt.exe
  2⤵
  PID:2580
- C:\Windows\System\TnImbeZ.exe
  C:\Windows\System\TnImbeZ.exe
  2⤵
  PID:1040
- C:\Windows\System\JeDHPVl.exe
  C:\Windows\System\JeDHPVl.exe
  2⤵
  PID:1004
- C:\Windows\System\syNrSYp.exe
  C:\Windows\System\syNrSYp.exe
  2⤵
  PID:804
- C:\Windows\System\ofPEGMy.exe
  C:\Windows\System\ofPEGMy.exe
  2⤵
  PID:1440
- C:\Windows\System\TnbQjYH.exe
  C:\Windows\System\TnbQjYH.exe
  2⤵
  PID:3112
- C:\Windows\System\DICuuFo.exe
  C:\Windows\System\DICuuFo.exe
  2⤵
  PID:3152
- C:\Windows\System\cwVYXdE.exe
  C:\Windows\System\cwVYXdE.exe
  2⤵
  PID:3196
- C:\Windows\System\iwLiKSE.exe
  C:\Windows\System\iwLiKSE.exe
  2⤵
  PID:3292
- C:\Windows\System\UcprQjS.exe
  C:\Windows\System\UcprQjS.exe
  2⤵
  PID:3260
- C:\Windows\System\gDfJZWE.exe
  C:\Windows\System\gDfJZWE.exe
  2⤵
  PID:2756
- C:\Windows\System\KYxEgZl.exe
  C:\Windows\System\KYxEgZl.exe
  2⤵
  PID:3316
- C:\Windows\System\eArSHgi.exe
  C:\Windows\System\eArSHgi.exe
  2⤵
  PID:3356
- C:\Windows\System\ERvUFUk.exe
  C:\Windows\System\ERvUFUk.exe
  2⤵
  PID:3472
- C:\Windows\System\HlSBNKF.exe
  C:\Windows\System\HlSBNKF.exe
  2⤵
  PID:3452
- C:\Windows\System\WqCzfof.exe
  C:\Windows\System\WqCzfof.exe
  2⤵
  PID:3536
- C:\Windows\System\rEgKnMB.exe
  C:\Windows\System\rEgKnMB.exe
  2⤵
  PID:3592
- C:\Windows\System\wUlBWla.exe
  C:\Windows\System\wUlBWla.exe
  2⤵
  PID:3648
- C:\Windows\System\vkNcLaG.exe
  C:\Windows\System\vkNcLaG.exe
  2⤵
  PID:1800
- C:\Windows\System\UVXIdgv.exe
  C:\Windows\System\UVXIdgv.exe
  2⤵
  PID:3676
- C:\Windows\System\eEAZrbJ.exe
  C:\Windows\System\eEAZrbJ.exe
  2⤵
  PID:2520
- C:\Windows\System\CFbdrGx.exe
  C:\Windows\System\CFbdrGx.exe
  2⤵
  PID:3776
- C:\Windows\System\ovNJIFD.exe
  C:\Windows\System\ovNJIFD.exe
  2⤵
  PID:3788
- C:\Windows\System\BHDxDxY.exe
  C:\Windows\System\BHDxDxY.exe
  2⤵
  PID:3888
- C:\Windows\System\EgKdvfL.exe
  C:\Windows\System\EgKdvfL.exe
  2⤵
  PID:3900
- C:\Windows\System\RQYkEGp.exe
  C:\Windows\System\RQYkEGp.exe
  2⤵
  PID:2760
- C:\Windows\System\PVrvAXO.exe
  C:\Windows\System\PVrvAXO.exe
  2⤵
  PID:1048
- C:\Windows\System\WKvrBxK.exe
  C:\Windows\System\WKvrBxK.exe
  2⤵
  PID:2280
- C:\Windows\System\JdmqopU.exe
  C:\Windows\System\JdmqopU.exe
  2⤵
  PID:1740
- C:\Windows\System\oZxqVum.exe
  C:\Windows\System\oZxqVum.exe
  2⤵
  PID:4060
- C:\Windows\System\IyVkuhq.exe
  C:\Windows\System\IyVkuhq.exe
  2⤵
  PID:1444
- C:\Windows\System\JbjJnfT.exe
  C:\Windows\System\JbjJnfT.exe
  2⤵
  PID:2368
- C:\Windows\System\NLvzLNd.exe
  C:\Windows\System\NLvzLNd.exe
  2⤵
  PID:2836
- C:\Windows\System\KCDmnlz.exe
  C:\Windows\System\KCDmnlz.exe
  2⤵
  PID:2188
- C:\Windows\System\LeaDDAT.exe
  C:\Windows\System\LeaDDAT.exe
  2⤵
  PID:2692
- C:\Windows\System\hIungEt.exe
  C:\Windows\System\hIungEt.exe
  2⤵
  PID:2984
- C:\Windows\System\pzLAlGS.exe
  C:\Windows\System\pzLAlGS.exe
  2⤵
  PID:2492
- C:\Windows\System\bFneBsc.exe
  C:\Windows\System\bFneBsc.exe
  2⤵
  PID:320
- C:\Windows\System\bbPODoi.exe
  C:\Windows\System\bbPODoi.exe
  2⤵
  PID:2176
- C:\Windows\System\VMSuyhb.exe
  C:\Windows\System\VMSuyhb.exe
  2⤵
  PID:2252
- C:\Windows\System\KZEATpe.exe
  C:\Windows\System\KZEATpe.exe
  2⤵
  PID:2696
- C:\Windows\System\SijXzsA.exe
  C:\Windows\System\SijXzsA.exe
  2⤵
  PID:2680
- C:\Windows\System\mktDMOU.exe
  C:\Windows\System\mktDMOU.exe
  2⤵
  PID:3532
- C:\Windows\System\KJlrBud.exe
  C:\Windows\System\KJlrBud.exe
  2⤵
  PID:3632
- C:\Windows\System\yUPbYeh.exe
  C:\Windows\System\yUPbYeh.exe
  2⤵
  PID:1624
- C:\Windows\System\QurKJTS.exe
  C:\Windows\System\QurKJTS.exe
  2⤵
  PID:3928
- C:\Windows\System\iGXeiMh.exe
  C:\Windows\System\iGXeiMh.exe
  2⤵
  PID:4048
- C:\Windows\System\whKIyIX.exe
  C:\Windows\System\whKIyIX.exe
  2⤵
  PID:4088
- C:\Windows\System\PVqAUJN.exe
  C:\Windows\System\PVqAUJN.exe
  2⤵
  PID:2092
- C:\Windows\System\OGlWCgQ.exe
  C:\Windows\System\OGlWCgQ.exe
  2⤵
  PID:2472
- C:\Windows\System\CYCiNBU.exe
  C:\Windows\System\CYCiNBU.exe
  2⤵
  PID:3352
- C:\Windows\System\SErSVgN.exe
  C:\Windows\System\SErSVgN.exe
  2⤵
  PID:3552
- C:\Windows\System\AfKDIgV.exe
  C:\Windows\System\AfKDIgV.exe
  2⤵
  PID:3012
- C:\Windows\System\EUcrTLD.exe
  C:\Windows\System\EUcrTLD.exe
  2⤵
  PID:3596
- C:\Windows\System\idORYYZ.exe
  C:\Windows\System\idORYYZ.exe
  2⤵
  PID:4108
- C:\Windows\System\kmiKSxx.exe
  C:\Windows\System\kmiKSxx.exe
  2⤵
  PID:4124
- C:\Windows\System\cBeVxNb.exe
  C:\Windows\System\cBeVxNb.exe
  2⤵
  PID:4140
- C:\Windows\System\zOBponV.exe
  C:\Windows\System\zOBponV.exe
  2⤵
  PID:4180
- C:\Windows\System\MpskfGV.exe
  C:\Windows\System\MpskfGV.exe
  2⤵
  PID:4196
- C:\Windows\System\oGbeBhC.exe
  C:\Windows\System\oGbeBhC.exe
  2⤵
  PID:4212
- C:\Windows\System\WngYngQ.exe
  C:\Windows\System\WngYngQ.exe
  2⤵
  PID:4248
- C:\Windows\System\oAKCTXo.exe
  C:\Windows\System\oAKCTXo.exe
  2⤵
  PID:4268
- C:\Windows\System\BTOjqIw.exe
  C:\Windows\System\BTOjqIw.exe
  2⤵
  PID:4284
- C:\Windows\System\RjNhBvD.exe
  C:\Windows\System\RjNhBvD.exe
  2⤵
  PID:4304
- C:\Windows\System\wglXYqV.exe
  C:\Windows\System\wglXYqV.exe
  2⤵
  PID:4364
- C:\Windows\System\pSvruXs.exe
  C:\Windows\System\pSvruXs.exe
  2⤵
  PID:4380
- C:\Windows\System\LQEHbWd.exe
  C:\Windows\System\LQEHbWd.exe
  2⤵
  PID:4396
- C:\Windows\System\xMeUEqm.exe
  C:\Windows\System\xMeUEqm.exe
  2⤵
  PID:4412
- C:\Windows\System\JdLZxWT.exe
  C:\Windows\System\JdLZxWT.exe
  2⤵
  PID:4428
- C:\Windows\System\JQUETqa.exe
  C:\Windows\System\JQUETqa.exe
  2⤵
  PID:4448
- C:\Windows\System\lPLatcZ.exe
  C:\Windows\System\lPLatcZ.exe
  2⤵
  PID:4464
- C:\Windows\System\wvdDDFw.exe
  C:\Windows\System\wvdDDFw.exe
  2⤵
  PID:4484
- C:\Windows\System\nSIhUHc.exe
  C:\Windows\System\nSIhUHc.exe
  2⤵
  PID:4500
- C:\Windows\System\DzEQQQM.exe
  C:\Windows\System\DzEQQQM.exe
  2⤵
  PID:4520
- C:\Windows\System\JBsOuwY.exe
  C:\Windows\System\JBsOuwY.exe
  2⤵
  PID:4540
- C:\Windows\System\adKwBnc.exe
  C:\Windows\System\adKwBnc.exe
  2⤵
  PID:4560
- C:\Windows\System\ZQvOeny.exe
  C:\Windows\System\ZQvOeny.exe
  2⤵
  PID:4576
- C:\Windows\System\nHHOAGq.exe
  C:\Windows\System\nHHOAGq.exe
  2⤵
  PID:4592
- C:\Windows\System\jHmnoDE.exe
  C:\Windows\System\jHmnoDE.exe
  2⤵
  PID:4616
- C:\Windows\System\BNzUgpR.exe
  C:\Windows\System\BNzUgpR.exe
  2⤵
  PID:4640
- C:\Windows\System\Jzqibru.exe
  C:\Windows\System\Jzqibru.exe
  2⤵
  PID:4656
- C:\Windows\System\ukIvvfT.exe
  C:\Windows\System\ukIvvfT.exe
  2⤵
  PID:4676
- C:\Windows\System\SYbkSlZ.exe
  C:\Windows\System\SYbkSlZ.exe
  2⤵
  PID:4736
- C:\Windows\System\qWpTupf.exe
  C:\Windows\System\qWpTupf.exe
  2⤵
  PID:4752
- C:\Windows\System\iycxYdY.exe
  C:\Windows\System\iycxYdY.exe
  2⤵
  PID:4772
- C:\Windows\System\IWowVAL.exe
  C:\Windows\System\IWowVAL.exe
  2⤵
  PID:4796
- C:\Windows\System\cuwTfdp.exe
  C:\Windows\System\cuwTfdp.exe
  2⤵
  PID:4812
- C:\Windows\System\NyDXJGa.exe
  C:\Windows\System\NyDXJGa.exe
  2⤵
  PID:4836
- C:\Windows\System\EbWYKVF.exe
  C:\Windows\System\EbWYKVF.exe
  2⤵
  PID:4852
- C:\Windows\System\CfSlRMl.exe
  C:\Windows\System\CfSlRMl.exe
  2⤵
  PID:4880
- C:\Windows\System\AHRbDwJ.exe
  C:\Windows\System\AHRbDwJ.exe
  2⤵
  PID:4900
- C:\Windows\System\QPaVLzq.exe
  C:\Windows\System\QPaVLzq.exe
  2⤵
  PID:4916
- C:\Windows\System\klLixJP.exe
  C:\Windows\System\klLixJP.exe
  2⤵
  PID:4936
- C:\Windows\System\GJJDWrq.exe
  C:\Windows\System\GJJDWrq.exe
  2⤵
  PID:4952
- C:\Windows\System\hVyDMZA.exe
  C:\Windows\System\hVyDMZA.exe
  2⤵
  PID:4968
- C:\Windows\System\ikKLXFM.exe
  C:\Windows\System\ikKLXFM.exe
  2⤵
  PID:5012
- C:\Windows\System\jUkMheE.exe
  C:\Windows\System\jUkMheE.exe
  2⤵
  PID:5028
- C:\Windows\System\hacTkTs.exe
  C:\Windows\System\hacTkTs.exe
  2⤵
  PID:5060
- C:\Windows\System\mQHRYyM.exe
  C:\Windows\System\mQHRYyM.exe
  2⤵
  PID:5076
- C:\Windows\System\dlTOtai.exe
  C:\Windows\System\dlTOtai.exe
  2⤵
  PID:5092
- C:\Windows\System\etkLmNN.exe
  C:\Windows\System\etkLmNN.exe
  2⤵
  PID:5108
- C:\Windows\System\nMqigRf.exe
  C:\Windows\System\nMqigRf.exe
  2⤵
  PID:2996
- C:\Windows\System\SDrNcRO.exe
  C:\Windows\System\SDrNcRO.exe
  2⤵
  PID:3096
- C:\Windows\System\DFcSxIi.exe
  C:\Windows\System\DFcSxIi.exe
  2⤵
  PID:900
- C:\Windows\System\OKtNAuW.exe
  C:\Windows\System\OKtNAuW.exe
  2⤵
  PID:3176
- C:\Windows\System\HUmWzdG.exe
  C:\Windows\System\HUmWzdG.exe
  2⤵
  PID:3860
- C:\Windows\System\lgNJjiX.exe
  C:\Windows\System\lgNJjiX.exe
  2⤵
  PID:3240
- C:\Windows\System\TLUuNWn.exe
  C:\Windows\System\TLUuNWn.exe
  2⤵
  PID:336
- C:\Windows\System\kqmjSYp.exe
  C:\Windows\System\kqmjSYp.exe
  2⤵
  PID:4152
- C:\Windows\System\zLgSNGd.exe
  C:\Windows\System\zLgSNGd.exe
  2⤵
  PID:4176
- C:\Windows\System\FaLZVek.exe
  C:\Windows\System\FaLZVek.exe
  2⤵
  PID:4260
- C:\Windows\System\PBpYsih.exe
  C:\Windows\System\PBpYsih.exe
  2⤵
  PID:4376
- C:\Windows\System\qVFrSVQ.exe
  C:\Windows\System\qVFrSVQ.exe
  2⤵
  PID:4516
- C:\Windows\System\BnqAJAv.exe
  C:\Windows\System\BnqAJAv.exe
  2⤵
  PID:1588
- C:\Windows\System\OTYAGxp.exe
  C:\Windows\System\OTYAGxp.exe
  2⤵
  PID:4556
- C:\Windows\System\jPhGWNy.exe
  C:\Windows\System\jPhGWNy.exe
  2⤵
  PID:3672
- C:\Windows\System\kAqtOid.exe
  C:\Windows\System\kAqtOid.exe
  2⤵
  PID:1532
- C:\Windows\System\DrfbFEV.exe
  C:\Windows\System\DrfbFEV.exe
  2⤵
  PID:4624
- C:\Windows\System\GQnbiFd.exe
  C:\Windows\System\GQnbiFd.exe
  2⤵
  PID:4632
- C:\Windows\System\qbBNHEH.exe
  C:\Windows\System\qbBNHEH.exe
  2⤵
  PID:4672
- C:\Windows\System\zORdsTR.exe
  C:\Windows\System\zORdsTR.exe
  2⤵
  PID:4072
- C:\Windows\System\vEuTOhp.exe
  C:\Windows\System\vEuTOhp.exe
  2⤵
  PID:3796
- C:\Windows\System\EgQJRmL.exe
  C:\Windows\System\EgQJRmL.exe
  2⤵
  PID:3708
- C:\Windows\System\jsbEVpw.exe
  C:\Windows\System\jsbEVpw.exe
  2⤵
  PID:4744
- C:\Windows\System\rgDfEjC.exe
  C:\Windows\System\rgDfEjC.exe
  2⤵
  PID:4824
- C:\Windows\System\LgKoFyt.exe
  C:\Windows\System\LgKoFyt.exe
  2⤵
  PID:4244
- C:\Windows\System\VVWEwIS.exe
  C:\Windows\System\VVWEwIS.exe
  2⤵
  PID:4320
- C:\Windows\System\BjpBmKp.exe
  C:\Windows\System\BjpBmKp.exe
  2⤵
  PID:4460
- C:\Windows\System\iyszoEC.exe
  C:\Windows\System\iyszoEC.exe
  2⤵
  PID:4728
- C:\Windows\System\iblYKfo.exe
  C:\Windows\System\iblYKfo.exe
  2⤵
  PID:4808
- C:\Windows\System\mmNMNhY.exe
  C:\Windows\System\mmNMNhY.exe
  2⤵
  PID:4192
- C:\Windows\System\JMHARod.exe
  C:\Windows\System\JMHARod.exe
  2⤵
  PID:4228
- C:\Windows\System\ufkbbaz.exe
  C:\Windows\System\ufkbbaz.exe
  2⤵
  PID:4336
- C:\Windows\System\TBqtRxg.exe
  C:\Windows\System\TBqtRxg.exe
  2⤵
  PID:4356
- C:\Windows\System\uIsBJLw.exe
  C:\Windows\System\uIsBJLw.exe
  2⤵
  PID:4892
- C:\Windows\System\seOSIjb.exe
  C:\Windows\System\seOSIjb.exe
  2⤵
  PID:4996
- C:\Windows\System\iufXloB.exe
  C:\Windows\System\iufXloB.exe
  2⤵
  PID:4492
- C:\Windows\System\wYDYVIr.exe
  C:\Windows\System\wYDYVIr.exe
  2⤵
  PID:4928
- C:\Windows\System\PnvMISP.exe
  C:\Windows\System\PnvMISP.exe
  2⤵
  PID:4932
- C:\Windows\System\BIyyfoZ.exe
  C:\Windows\System\BIyyfoZ.exe
  2⤵
  PID:4648
- C:\Windows\System\NjNHkhq.exe
  C:\Windows\System\NjNHkhq.exe
  2⤵
  PID:5036
- C:\Windows\System\bMFhFyL.exe
  C:\Windows\System\bMFhFyL.exe
  2⤵
  PID:5052
- C:\Windows\System\dhFrCUk.exe
  C:\Windows\System\dhFrCUk.exe
  2⤵
  PID:5084
- C:\Windows\System\NAyyiMZ.exe
  C:\Windows\System\NAyyiMZ.exe
  2⤵
  PID:3156
- C:\Windows\System\lUjITJz.exe
  C:\Windows\System\lUjITJz.exe
  2⤵
  PID:2792
- C:\Windows\System\ifWQJVx.exe
  C:\Windows\System\ifWQJVx.exe
  2⤵
  PID:5104
- C:\Windows\System\SHCUsJY.exe
  C:\Windows\System\SHCUsJY.exe
  2⤵
  PID:5068
- C:\Windows\System\yoTQeGJ.exe
  C:\Windows\System\yoTQeGJ.exe
  2⤵
  PID:3092
- C:\Windows\System\iLcVDcd.exe
  C:\Windows\System\iLcVDcd.exe
  2⤵
  PID:4100
- C:\Windows\System\mDCMGAo.exe
  C:\Windows\System\mDCMGAo.exe
  2⤵
  PID:4148
- C:\Windows\System\OqTBPMk.exe
  C:\Windows\System\OqTBPMk.exe
  2⤵
  PID:4588
- C:\Windows\System\pIMSVYU.exe
  C:\Windows\System\pIMSVYU.exe
  2⤵
  PID:3216
- C:\Windows\System\RbEigvj.exe
  C:\Windows\System\RbEigvj.exe
  2⤵
  PID:4008
- C:\Windows\System\NkrwHNl.exe
  C:\Windows\System\NkrwHNl.exe
  2⤵
  PID:4860
- C:\Windows\System\edrUgEW.exe
  C:\Windows\System\edrUgEW.exe
  2⤵
  PID:1960
- C:\Windows\System\MtIiNMM.exe
  C:\Windows\System\MtIiNMM.exe
  2⤵
  PID:4552
- C:\Windows\System\vYxtpyJ.exe
  C:\Windows\System\vYxtpyJ.exe
  2⤵
  PID:2672
- C:\Windows\System\ZFdHECJ.exe
  C:\Windows\System\ZFdHECJ.exe
  2⤵
  PID:4780
- C:\Windows\System\IqCtqRT.exe
  C:\Windows\System\IqCtqRT.exe
  2⤵
  PID:4312
- C:\Windows\System\vwyFBaA.exe
  C:\Windows\System\vwyFBaA.exe
  2⤵
  PID:4340
- C:\Windows\System\bSFrPKw.exe
  C:\Windows\System\bSFrPKw.exe
  2⤵
  PID:4424
- C:\Windows\System\XLfCGJr.exe
  C:\Windows\System\XLfCGJr.exe
  2⤵
  PID:4912
- C:\Windows\System\wGCAXyI.exe
  C:\Windows\System\wGCAXyI.exe
  2⤵
  PID:4764
- C:\Windows\System\MAXHfkp.exe
  C:\Windows\System\MAXHfkp.exe
  2⤵
  PID:4224
- C:\Windows\System\XvmAJFm.exe
  C:\Windows\System\XvmAJFm.exe
  2⤵
  PID:4988
- C:\Windows\System\zbqTKPx.exe
  C:\Windows\System\zbqTKPx.exe
  2⤵
  PID:4236
- C:\Windows\System\INtLOev.exe
  C:\Windows\System\INtLOev.exe
  2⤵
  PID:4896
- C:\Windows\System\VxAadJF.exe
  C:\Windows\System\VxAadJF.exe
  2⤵
  PID:5024
- C:\Windows\System\IhQgWOE.exe
  C:\Windows\System\IhQgWOE.exe
  2⤵
  PID:5072
- C:\Windows\System\DwHLsFC.exe
  C:\Windows\System\DwHLsFC.exe
  2⤵
  PID:4372
- C:\Windows\System\tbyTccm.exe
  C:\Windows\System\tbyTccm.exe
  2⤵
  PID:5008
- C:\Windows\System\bTqMgVm.exe
  C:\Windows\System\bTqMgVm.exe
  2⤵
  PID:2172
- C:\Windows\System\ZTzYDUY.exe
  C:\Windows\System\ZTzYDUY.exe
  2⤵
  PID:4536
- C:\Windows\System\KAuTvOY.exe
  C:\Windows\System\KAuTvOY.exe
  2⤵
  PID:4868
- C:\Windows\System\mkizcDl.exe
  C:\Windows\System\mkizcDl.exe
  2⤵
  PID:4220
- C:\Windows\System\LYYgnaj.exe
  C:\Windows\System\LYYgnaj.exe
  2⤵
  PID:5044
- C:\Windows\System\fDsBIZI.exe
  C:\Windows\System\fDsBIZI.exe
  2⤵
  PID:4136
- C:\Windows\System\eKhcVYk.exe
  C:\Windows\System\eKhcVYk.exe
  2⤵
  PID:4508
- C:\Windows\System\hWMPdSt.exe
  C:\Windows\System\hWMPdSt.exe
  2⤵
  PID:4720
- C:\Windows\System\SEDFiew.exe
  C:\Windows\System\SEDFiew.exe
  2⤵
  PID:4392
- C:\Windows\System\kxDsjaw.exe
  C:\Windows\System\kxDsjaw.exe
  2⤵
  PID:5132
- C:\Windows\System\rxwzpLp.exe
  C:\Windows\System\rxwzpLp.exe
  2⤵
  PID:5208
- C:\Windows\System\FSAETBj.exe
  C:\Windows\System\FSAETBj.exe
  2⤵
  PID:5224
- C:\Windows\System\tPhUWlt.exe
  C:\Windows\System\tPhUWlt.exe
  2⤵
  PID:5248
- C:\Windows\System\MxjIvpY.exe
  C:\Windows\System\MxjIvpY.exe
  2⤵
  PID:5268
- C:\Windows\System\xYKQYKK.exe
  C:\Windows\System\xYKQYKK.exe
  2⤵
  PID:5284
- C:\Windows\System\rcmaoMQ.exe
  C:\Windows\System\rcmaoMQ.exe
  2⤵
  PID:5300
- C:\Windows\System\QXnAJok.exe
  C:\Windows\System\QXnAJok.exe
  2⤵
  PID:5316
- C:\Windows\System\ZlQMvfI.exe
  C:\Windows\System\ZlQMvfI.exe
  2⤵
  PID:5332
- C:\Windows\System\lkHjoCi.exe
  C:\Windows\System\lkHjoCi.exe
  2⤵
  PID:5352
- C:\Windows\System\zROHqwK.exe
  C:\Windows\System\zROHqwK.exe
  2⤵
  PID:5368
- C:\Windows\System\yTpaZbv.exe
  C:\Windows\System\yTpaZbv.exe
  2⤵
  PID:5396
- C:\Windows\System\TZnhEKR.exe
  C:\Windows\System\TZnhEKR.exe
  2⤵
  PID:5412
- C:\Windows\System\IWqPNul.exe
  C:\Windows\System\IWqPNul.exe
  2⤵
  PID:5428
- C:\Windows\System\NwApVOC.exe
  C:\Windows\System\NwApVOC.exe
  2⤵
  PID:5444
- C:\Windows\System\fFjaTSM.exe
  C:\Windows\System\fFjaTSM.exe
  2⤵
  PID:5460
- C:\Windows\System\fZyxnfK.exe
  C:\Windows\System\fZyxnfK.exe
  2⤵
  PID:5500
- C:\Windows\System\taRCCWe.exe
  C:\Windows\System\taRCCWe.exe
  2⤵
  PID:5516
- C:\Windows\System\UrcGYuE.exe
  C:\Windows\System\UrcGYuE.exe
  2⤵
  PID:5544
- C:\Windows\System\ckMPUep.exe
  C:\Windows\System\ckMPUep.exe
  2⤵
  PID:5572
- C:\Windows\System\wfSIrMv.exe
  C:\Windows\System\wfSIrMv.exe
  2⤵
  PID:5588
- C:\Windows\System\uGYWWIU.exe
  C:\Windows\System\uGYWWIU.exe
  2⤵
  PID:5604
- C:\Windows\System\sIKuwrt.exe
  C:\Windows\System\sIKuwrt.exe
  2⤵
  PID:5620
- C:\Windows\System\isqjxJj.exe
  C:\Windows\System\isqjxJj.exe
  2⤵
  PID:5636
- C:\Windows\System\MiwEDoc.exe
  C:\Windows\System\MiwEDoc.exe
  2⤵
  PID:5652
- C:\Windows\System\iFPoELc.exe
  C:\Windows\System\iFPoELc.exe
  2⤵
  PID:5668
- C:\Windows\System\NCwuxBW.exe
  C:\Windows\System\NCwuxBW.exe
  2⤵
  PID:5684
- C:\Windows\System\xbGpXUU.exe
  C:\Windows\System\xbGpXUU.exe
  2⤵
  PID:5708
- C:\Windows\System\fOrVLqm.exe
  C:\Windows\System\fOrVLqm.exe
  2⤵
  PID:5724
- C:\Windows\System\FSHUKzp.exe
  C:\Windows\System\FSHUKzp.exe
  2⤵
  PID:5740
- C:\Windows\System\NdGNkPd.exe
  C:\Windows\System\NdGNkPd.exe
  2⤵
  PID:5756
- C:\Windows\System\sIkgzGc.exe
  C:\Windows\System\sIkgzGc.exe
  2⤵
  PID:5772
- C:\Windows\System\mzaBZVi.exe
  C:\Windows\System\mzaBZVi.exe
  2⤵
  PID:5796
- C:\Windows\System\gHRUZJV.exe
  C:\Windows\System\gHRUZJV.exe
  2⤵
  PID:5824
- C:\Windows\System\VIhVDiE.exe
  C:\Windows\System\VIhVDiE.exe
  2⤵
  PID:5848
- C:\Windows\System\teHdnMF.exe
  C:\Windows\System\teHdnMF.exe
  2⤵
  PID:5876
- C:\Windows\System\lVCmLQz.exe
  C:\Windows\System\lVCmLQz.exe
  2⤵
  PID:5892
- C:\Windows\System\KDXnlab.exe
  C:\Windows\System\KDXnlab.exe
  2⤵
  PID:5908
- C:\Windows\System\LWbSXBL.exe
  C:\Windows\System\LWbSXBL.exe
  2⤵
  PID:5928
- C:\Windows\System\KhZBCNW.exe
  C:\Windows\System\KhZBCNW.exe
  2⤵
  PID:5948
- C:\Windows\System\vjgijGH.exe
  C:\Windows\System\vjgijGH.exe
  2⤵
  PID:5964
- C:\Windows\System\XhLZBvT.exe
  C:\Windows\System\XhLZBvT.exe
  2⤵
  PID:5996
- C:\Windows\System\tJhiENQ.exe
  C:\Windows\System\tJhiENQ.exe
  2⤵
  PID:6012
- C:\Windows\System\YobwNDL.exe
  C:\Windows\System\YobwNDL.exe
  2⤵
  PID:6028
- C:\Windows\System\MGNxpZp.exe
  C:\Windows\System\MGNxpZp.exe
  2⤵
  PID:6048
- C:\Windows\System\HCitMPr.exe
  C:\Windows\System\HCitMPr.exe
  2⤵
  PID:6064
- C:\Windows\System\jbVHYfk.exe
  C:\Windows\System\jbVHYfk.exe
  2⤵
  PID:6088
- C:\Windows\System\NQXixtW.exe
  C:\Windows\System\NQXixtW.exe
  2⤵
  PID:6104
- C:\Windows\System\dllwywP.exe
  C:\Windows\System\dllwywP.exe
  2⤵
  PID:6120
- C:\Windows\System\bJkNpXj.exe
  C:\Windows\System\bJkNpXj.exe
  2⤵
  PID:6140
- C:\Windows\System\jsjEoOi.exe
  C:\Windows\System\jsjEoOi.exe
  2⤵
  PID:3688
- C:\Windows\System\LVIqwfn.exe
  C:\Windows\System\LVIqwfn.exe
  2⤵
  PID:4684
- C:\Windows\System\hhPmsiv.exe
  C:\Windows\System\hhPmsiv.exe
  2⤵
  PID:4964
- C:\Windows\System\lJIblpH.exe
  C:\Windows\System\lJIblpH.exe
  2⤵
  PID:5156
- C:\Windows\System\QCwWUnT.exe
  C:\Windows\System\QCwWUnT.exe
  2⤵
  PID:4612
- C:\Windows\System\hQOEQon.exe
  C:\Windows\System\hQOEQon.exe
  2⤵
  PID:5184
- C:\Windows\System\ncgSFmS.exe
  C:\Windows\System\ncgSFmS.exe
  2⤵
  PID:5204
- C:\Windows\System\mdBgjdu.exe
  C:\Windows\System\mdBgjdu.exe
  2⤵
  PID:2912
- C:\Windows\System\CfnrbfX.exe
  C:\Windows\System\CfnrbfX.exe
  2⤵
  PID:4388
- C:\Windows\System\jDVtFvg.exe
  C:\Windows\System\jDVtFvg.exe
  2⤵
  PID:4352
- C:\Windows\System\qWhCakh.exe
  C:\Windows\System\qWhCakh.exe
  2⤵
  PID:4888
- C:\Windows\System\yXcjpPi.exe
  C:\Windows\System\yXcjpPi.exe
  2⤵
  PID:4132
- C:\Windows\System\tMxPGgE.exe
  C:\Windows\System\tMxPGgE.exe
  2⤵
  PID:4324
- C:\Windows\System\TPXWTfM.exe
  C:\Windows\System\TPXWTfM.exe
  2⤵
  PID:1144
- C:\Windows\System\FelbBIv.exe
  C:\Windows\System\FelbBIv.exe
  2⤵
  PID:5260
- C:\Windows\System\UkOYXbJ.exe
  C:\Windows\System\UkOYXbJ.exe
  2⤵
  PID:5280
- C:\Windows\System\yQjfFyR.exe
  C:\Windows\System\yQjfFyR.exe
  2⤵
  PID:5376
- C:\Windows\System\nfGDAsx.exe
  C:\Windows\System\nfGDAsx.exe
  2⤵
  PID:5324
- C:\Windows\System\SWNFdWY.exe
  C:\Windows\System\SWNFdWY.exe
  2⤵
  PID:5292
- C:\Windows\System\BmqAeys.exe
  C:\Windows\System\BmqAeys.exe
  2⤵
  PID:5452
- C:\Windows\System\WzsgCkk.exe
  C:\Windows\System\WzsgCkk.exe
  2⤵
  PID:5552
- C:\Windows\System\nHNHFOt.exe
  C:\Windows\System\nHNHFOt.exe
  2⤵
  PID:5560
- C:\Windows\System\yipYAaB.exe
  C:\Windows\System\yipYAaB.exe
  2⤵
  PID:5480
- C:\Windows\System\zwVbOHB.exe
  C:\Windows\System\zwVbOHB.exe
  2⤵
  PID:5492
- C:\Windows\System\OXkxkYH.exe
  C:\Windows\System\OXkxkYH.exe
  2⤵
  PID:5536
- C:\Windows\System\ruHreCc.exe
  C:\Windows\System\ruHreCc.exe
  2⤵
  PID:5596
- C:\Windows\System\GtMCszk.exe
  C:\Windows\System\GtMCszk.exe
  2⤵
  PID:5616
- C:\Windows\System\tWzQdyT.exe
  C:\Windows\System\tWzQdyT.exe
  2⤵
  PID:5696
- C:\Windows\System\LJwCkwf.exe
  C:\Windows\System\LJwCkwf.exe
  2⤵
  PID:5804
- C:\Windows\System\iAXvVjd.exe
  C:\Windows\System\iAXvVjd.exe
  2⤵
  PID:5856
- C:\Windows\System\UGGolCk.exe
  C:\Windows\System\UGGolCk.exe
  2⤵
  PID:5648
- C:\Windows\System\bWFQgxn.exe
  C:\Windows\System\bWFQgxn.exe
  2⤵
  PID:5680
- C:\Windows\System\QjkaYgB.exe
  C:\Windows\System\QjkaYgB.exe
  2⤵
  PID:5972
- C:\Windows\System\BOAUGba.exe
  C:\Windows\System\BOAUGba.exe
  2⤵
  PID:5780
- C:\Windows\System\jKBjxYX.exe
  C:\Windows\System\jKBjxYX.exe
  2⤵
  PID:5992
- C:\Windows\System\jSAETIh.exe
  C:\Windows\System\jSAETIh.exe
  2⤵
  PID:4820
- C:\Windows\System\VJPVDFS.exe
  C:\Windows\System\VJPVDFS.exe
  2⤵
  PID:3696
- C:\Windows\System\RCgCTBe.exe
  C:\Windows\System\RCgCTBe.exe
  2⤵
  PID:3896
- C:\Windows\System\UpXiJcu.exe
  C:\Windows\System\UpXiJcu.exe
  2⤵
  PID:5832
- C:\Windows\System\VdHYBST.exe
  C:\Windows\System\VdHYBST.exe
  2⤵
  PID:3116
- C:\Windows\System\UwNLMFo.exe
  C:\Windows\System\UwNLMFo.exe
  2⤵
  PID:5888
- C:\Windows\System\tGfcKSv.exe
  C:\Windows\System\tGfcKSv.exe
  2⤵
  PID:6004
- C:\Windows\System\IyWxHce.exe
  C:\Windows\System\IyWxHce.exe
  2⤵
  PID:5916
- C:\Windows\System\hUXigQB.exe
  C:\Windows\System\hUXigQB.exe
  2⤵
  PID:6040
- C:\Windows\System\NzDLOyK.exe
  C:\Windows\System\NzDLOyK.exe
  2⤵
  PID:6116
- C:\Windows\System\oNsHEvM.exe
  C:\Windows\System\oNsHEvM.exe
  2⤵
  PID:4700
- C:\Windows\System\vwZfhbq.exe
  C:\Windows\System\vwZfhbq.exe
  2⤵
  PID:5192
- C:\Windows\System\SjSxegI.exe
  C:\Windows\System\SjSxegI.exe
  2⤵
  PID:3832
- C:\Windows\System\fTCXaEK.exe
  C:\Windows\System\fTCXaEK.exe
  2⤵
  PID:4608
- C:\Windows\System\pwOFYtF.exe
  C:\Windows\System\pwOFYtF.exe
  2⤵
  PID:4960
- C:\Windows\System\LBTRuxT.exe
  C:\Windows\System\LBTRuxT.exe
  2⤵
  PID:5232
- C:\Windows\System\mYPbnnS.exe
  C:\Windows\System\mYPbnnS.exe
  2⤵
  PID:5276
- C:\Windows\System\pnNMEHv.exe
  C:\Windows\System\pnNMEHv.exe
  2⤵
  PID:5468
- C:\Windows\System\DulTdVh.exe
  C:\Windows\System\DulTdVh.exe
  2⤵
  PID:5484
- C:\Windows\System\jlgnrbb.exe
  C:\Windows\System\jlgnrbb.exe
  2⤵
  PID:5612
- C:\Windows\System\JgKCPqU.exe
  C:\Windows\System\JgKCPqU.exe
  2⤵
  PID:5936
- C:\Windows\System\QyntKQF.exe
  C:\Windows\System\QyntKQF.exe
  2⤵
  PID:6056
- C:\Windows\System\FzevYbh.exe
  C:\Windows\System\FzevYbh.exe
  2⤵
  PID:6132
- C:\Windows\System\EXcpjob.exe
  C:\Windows\System\EXcpjob.exe
  2⤵
  PID:5348
- C:\Windows\System\kPsWdEf.exe
  C:\Windows\System\kPsWdEf.exe
  2⤵
  PID:5508
- C:\Windows\System\KouHoSL.exe
  C:\Windows\System\KouHoSL.exe
  2⤵
  PID:5528
- C:\Windows\System\MiypCeD.exe
  C:\Windows\System\MiypCeD.exe
  2⤵
  PID:5644
- C:\Windows\System\mKBGNgr.exe
  C:\Windows\System\mKBGNgr.exe
  2⤵
  PID:5764
- C:\Windows\System\vHjXjYf.exe
  C:\Windows\System\vHjXjYf.exe
  2⤵
  PID:5944
- C:\Windows\System\URDztiN.exe
  C:\Windows\System\URDztiN.exe
  2⤵
  PID:4120
- C:\Windows\System\lJSDlDw.exe
  C:\Windows\System\lJSDlDw.exe
  2⤵
  PID:3800
- C:\Windows\System\DTkjKSb.exe
  C:\Windows\System\DTkjKSb.exe
  2⤵
  PID:6036
- C:\Windows\System\tIUZmse.exe
  C:\Windows\System\tIUZmse.exe
  2⤵
  PID:4924
- C:\Windows\System\YpEdRUc.exe
  C:\Windows\System\YpEdRUc.exe
  2⤵
  PID:6084
- C:\Windows\System\djmvomN.exe
  C:\Windows\System\djmvomN.exe
  2⤵
  PID:5664
- C:\Windows\System\ooOQOCQ.exe
  C:\Windows\System\ooOQOCQ.exe
  2⤵
  PID:5820
- C:\Windows\System\VtBWSAr.exe
  C:\Windows\System\VtBWSAr.exe
  2⤵
  PID:5904
- C:\Windows\System\HQIuSfl.exe
  C:\Windows\System\HQIuSfl.exe
  2⤵
  PID:5844
- C:\Windows\System\DlmCJOk.exe
  C:\Windows\System\DlmCJOk.exe
  2⤵
  PID:6128
- C:\Windows\System\MjSZAsI.exe
  C:\Windows\System\MjSZAsI.exe
  2⤵
  PID:4052
- C:\Windows\System\fFJJIGB.exe
  C:\Windows\System\fFJJIGB.exe
  2⤵
  PID:5152
- C:\Windows\System\dqmvNNv.exe
  C:\Windows\System\dqmvNNv.exe
  2⤵
  PID:2396
- C:\Windows\System\nXzioTA.exe
  C:\Windows\System\nXzioTA.exe
  2⤵
  PID:5424
- C:\Windows\System\hSASing.exe
  C:\Windows\System\hSASing.exe
  2⤵
  PID:5988
- C:\Windows\System\gNBxvxp.exe
  C:\Windows\System\gNBxvxp.exe
  2⤵
  PID:5496
- C:\Windows\System\FpeFrWZ.exe
  C:\Windows\System\FpeFrWZ.exe
  2⤵
  PID:4792
- C:\Windows\System\JqgEDsB.exe
  C:\Windows\System\JqgEDsB.exe
  2⤵
  PID:5836
- C:\Windows\System\gUlegyl.exe
  C:\Windows\System\gUlegyl.exe
  2⤵
  PID:5168
- C:\Windows\System\glVygXA.exe
  C:\Windows\System\glVygXA.exe
  2⤵
  PID:5124
- C:\Windows\System\OhouOxw.exe
  C:\Windows\System\OhouOxw.exe
  2⤵
  PID:5720
- C:\Windows\System\hSfEFAL.exe
  C:\Windows\System\hSfEFAL.exe
  2⤵
  PID:5792
- C:\Windows\System\AmgKfxt.exe
  C:\Windows\System\AmgKfxt.exe
  2⤵
  PID:5868
- C:\Windows\System\ajVrxuw.exe
  C:\Windows\System\ajVrxuw.exe
  2⤵
  PID:5420
- C:\Windows\System\ZauhqTi.exe
  C:\Windows\System\ZauhqTi.exe
  2⤵
  PID:5240
- C:\Windows\System\caCcuyk.exe
  C:\Windows\System\caCcuyk.exe
  2⤵
  PID:5476
- C:\Windows\System\HIVyUEZ.exe
  C:\Windows\System\HIVyUEZ.exe
  2⤵
  PID:6060
- C:\Windows\System\wLSNtZz.exe
  C:\Windows\System\wLSNtZz.exe
  2⤵
  PID:5384
- C:\Windows\System\SSxtIPf.exe
  C:\Windows\System\SSxtIPf.exe
  2⤵
  PID:6152
- C:\Windows\System\sNtrSsL.exe
  C:\Windows\System\sNtrSsL.exe
  2⤵
  PID:6180
- C:\Windows\System\WXOgGba.exe
  C:\Windows\System\WXOgGba.exe
  2⤵
  PID:6204
- C:\Windows\System\lhWnptH.exe
  C:\Windows\System\lhWnptH.exe
  2⤵
  PID:6224
- C:\Windows\System\TkuokqP.exe
  C:\Windows\System\TkuokqP.exe
  2⤵
  PID:6244
- C:\Windows\System\BrgpaeH.exe
  C:\Windows\System\BrgpaeH.exe
  2⤵
  PID:6260
- C:\Windows\System\VXyFHQv.exe
  C:\Windows\System\VXyFHQv.exe
  2⤵
  PID:6276
- C:\Windows\System\OYULsfE.exe
  C:\Windows\System\OYULsfE.exe
  2⤵
  PID:6292
- C:\Windows\System\vyRxXBC.exe
  C:\Windows\System\vyRxXBC.exe
  2⤵
  PID:6308
- C:\Windows\System\FqFIBtu.exe
  C:\Windows\System\FqFIBtu.exe
  2⤵
  PID:6324
- C:\Windows\System\AXstVSr.exe
  C:\Windows\System\AXstVSr.exe
  2⤵
  PID:6340
- C:\Windows\System\NxvcsrG.exe
  C:\Windows\System\NxvcsrG.exe
  2⤵
  PID:6356
- C:\Windows\System\pAVbYND.exe
  C:\Windows\System\pAVbYND.exe
  2⤵
  PID:6372
- C:\Windows\System\VsWcPuQ.exe
  C:\Windows\System\VsWcPuQ.exe
  2⤵
  PID:6388
- C:\Windows\System\PIJgbMj.exe
  C:\Windows\System\PIJgbMj.exe
  2⤵
  PID:6404
- C:\Windows\System\nzerSNr.exe
  C:\Windows\System\nzerSNr.exe
  2⤵
  PID:6420
- C:\Windows\System\VBSiOkm.exe
  C:\Windows\System\VBSiOkm.exe
  2⤵
  PID:6436
- C:\Windows\System\fFLEIWV.exe
  C:\Windows\System\fFLEIWV.exe
  2⤵
  PID:6452
- C:\Windows\System\bzlNikF.exe
  C:\Windows\System\bzlNikF.exe
  2⤵
  PID:6468
- C:\Windows\System\UbrbuFP.exe
  C:\Windows\System\UbrbuFP.exe
  2⤵
  PID:6484
- C:\Windows\System\AUywKqk.exe
  C:\Windows\System\AUywKqk.exe
  2⤵
  PID:6508
- C:\Windows\System\SxviScN.exe
  C:\Windows\System\SxviScN.exe
  2⤵
  PID:6524
- C:\Windows\System\PajXVmh.exe
  C:\Windows\System\PajXVmh.exe
  2⤵
  PID:6540
- C:\Windows\System\bKJjNra.exe
  C:\Windows\System\bKJjNra.exe
  2⤵
  PID:6560
- C:\Windows\System\anrrrTK.exe
  C:\Windows\System\anrrrTK.exe
  2⤵
  PID:6576
- C:\Windows\System\ZFQoTte.exe
  C:\Windows\System\ZFQoTte.exe
  2⤵
  PID:6604
- C:\Windows\System\ejxRmFf.exe
  C:\Windows\System\ejxRmFf.exe
  2⤵
  PID:6640
- C:\Windows\System\UPSpIyV.exe
  C:\Windows\System\UPSpIyV.exe
  2⤵
  PID:6656
- C:\Windows\System\JEETITU.exe
  C:\Windows\System\JEETITU.exe
  2⤵
  PID:6676
- C:\Windows\System\emZnkwT.exe
  C:\Windows\System\emZnkwT.exe
  2⤵
  PID:6696
- C:\Windows\System\XCuwRre.exe
  C:\Windows\System\XCuwRre.exe
  2⤵
  PID:6712
- C:\Windows\System\AiBRXNl.exe
  C:\Windows\System\AiBRXNl.exe
  2⤵
  PID:6728
- C:\Windows\System\JJLPRfo.exe
  C:\Windows\System\JJLPRfo.exe
  2⤵
  PID:6744
- C:\Windows\System\ZqsWwjl.exe
  C:\Windows\System\ZqsWwjl.exe
  2⤵
  PID:6760
- C:\Windows\System\wHiknFt.exe
  C:\Windows\System\wHiknFt.exe
  2⤵
  PID:6776
- C:\Windows\System\MBPirPe.exe
  C:\Windows\System\MBPirPe.exe
  2⤵
  PID:6792
- C:\Windows\System\QoHJrOy.exe
  C:\Windows\System\QoHJrOy.exe
  2⤵
  PID:6808
- C:\Windows\System\MgBRsNU.exe
  C:\Windows\System\MgBRsNU.exe
  2⤵
  PID:6824
- C:\Windows\System\AvtSAuE.exe
  C:\Windows\System\AvtSAuE.exe
  2⤵
  PID:6872
- C:\Windows\System\fRHybPZ.exe
  C:\Windows\System\fRHybPZ.exe
  2⤵
  PID:6888
- C:\Windows\System\XfIhhDc.exe
  C:\Windows\System\XfIhhDc.exe
  2⤵
  PID:6908
- C:\Windows\System\zoRstAH.exe
  C:\Windows\System\zoRstAH.exe
  2⤵
  PID:6924
- C:\Windows\System\WMKrtbY.exe
  C:\Windows\System\WMKrtbY.exe
  2⤵
  PID:6944
- C:\Windows\System\ppCJSCf.exe
  C:\Windows\System\ppCJSCf.exe
  2⤵
  PID:6968
- C:\Windows\System\TKUbRnS.exe
  C:\Windows\System\TKUbRnS.exe
  2⤵
  PID:6992
- C:\Windows\System\LHJgTmb.exe
  C:\Windows\System\LHJgTmb.exe
  2⤵
  PID:7056
- C:\Windows\System\olCqHeP.exe
  C:\Windows\System\olCqHeP.exe
  2⤵
  PID:7132
- C:\Windows\System\GBqpkpW.exe
  C:\Windows\System\GBqpkpW.exe
  2⤵
  PID:7148
- C:\Windows\System\dEhsaDI.exe
  C:\Windows\System\dEhsaDI.exe
  2⤵
  PID:5200
- C:\Windows\System\gRVshau.exe
  C:\Windows\System\gRVshau.exe
  2⤵
  PID:5256
- C:\Windows\System\KVZeBAl.exe
  C:\Windows\System\KVZeBAl.exe
  2⤵
  PID:6176
- C:\Windows\System\sHljOMH.exe
  C:\Windows\System\sHljOMH.exe
  2⤵
  PID:5840
- C:\Windows\System\CuDqVlK.exe
  C:\Windows\System\CuDqVlK.exe
  2⤵
  PID:5752
- C:\Windows\System\QVXZVSg.exe
  C:\Windows\System\QVXZVSg.exe
  2⤵
  PID:6188
- C:\Windows\System\bEhsHnU.exe
  C:\Windows\System\bEhsHnU.exe
  2⤵
  PID:6216
- C:\Windows\System\EWvXubY.exe
  C:\Windows\System\EWvXubY.exe
  2⤵
  PID:6316
- C:\Windows\System\aYFtFkb.exe
  C:\Windows\System\aYFtFkb.exe
  2⤵
  PID:6352
- C:\Windows\System\AlskZGq.exe
  C:\Windows\System\AlskZGq.exe
  2⤵
  PID:6444
- C:\Windows\System\yOkcMvd.exe
  C:\Windows\System\yOkcMvd.exe
  2⤵
  PID:6548
- C:\Windows\System\kZpwPzu.exe
  C:\Windows\System\kZpwPzu.exe
  2⤵
  PID:6600
- C:\Windows\System\xPPxEVN.exe
  C:\Windows\System\xPPxEVN.exe
  2⤵
  PID:6496
- C:\Windows\System\qUCjjES.exe
  C:\Windows\System\qUCjjES.exe
  2⤵
  PID:6612
- C:\Windows\System\yskcZBC.exe
  C:\Windows\System\yskcZBC.exe
  2⤵
  PID:6464
- C:\Windows\System\hvRnVwj.exe
  C:\Windows\System\hvRnVwj.exe
  2⤵
  PID:6396
- C:\Windows\System\pSbMvxu.exe
  C:\Windows\System\pSbMvxu.exe
  2⤵
  PID:5144
- C:\Windows\System\gwKtQwi.exe
  C:\Windows\System\gwKtQwi.exe
  2⤵
  PID:6240
- C:\Windows\System\swYBYCS.exe
  C:\Windows\System\swYBYCS.exe
  2⤵
  PID:4420
- C:\Windows\System\LJMuYPe.exe
  C:\Windows\System\LJMuYPe.exe
  2⤵
  PID:6632
- C:\Windows\System\oMLVcHq.exe
  C:\Windows\System\oMLVcHq.exe
  2⤵
  PID:6668
- C:\Windows\System\GYZboaO.exe
  C:\Windows\System\GYZboaO.exe
  2⤵
  PID:6724
- C:\Windows\System\sJetVbJ.exe
  C:\Windows\System\sJetVbJ.exe
  2⤵
  PID:6756
- C:\Windows\System\rTLeZCw.exe
  C:\Windows\System\rTLeZCw.exe
  2⤵
  PID:6772
- C:\Windows\System\lmAdSyy.exe
  C:\Windows\System\lmAdSyy.exe
  2⤵
  PID:6800
- C:\Windows\System\ZXWpvNc.exe
  C:\Windows\System\ZXWpvNc.exe
  2⤵
  PID:6864
- C:\Windows\System\glWwjWj.exe
  C:\Windows\System\glWwjWj.exe
  2⤵
  PID:6860
- C:\Windows\System\QgFpOZX.exe
  C:\Windows\System\QgFpOZX.exe
  2⤵
  PID:6896
- C:\Windows\System\DZJmTNM.exe
  C:\Windows\System\DZJmTNM.exe
  2⤵
  PID:6964
- C:\Windows\System\JiVEizB.exe
  C:\Windows\System\JiVEizB.exe
  2⤵
  PID:6980
- C:\Windows\System\TPiRbVF.exe
  C:\Windows\System\TPiRbVF.exe
  2⤵
  PID:7004
- C:\Windows\System\UEhmYqm.exe
  C:\Windows\System\UEhmYqm.exe
  2⤵
  PID:7028
- C:\Windows\System\tipNYiF.exe
  C:\Windows\System\tipNYiF.exe
  2⤵
  PID:7044
- C:\Windows\System\zNFUxCn.exe
  C:\Windows\System\zNFUxCn.exe
  2⤵
  PID:7068
- C:\Windows\System\ETKXepL.exe
  C:\Windows\System\ETKXepL.exe
  2⤵
  PID:7080
- C:\Windows\System\vSmhDTh.exe
  C:\Windows\System\vSmhDTh.exe
  2⤵
  PID:7100
- C:\Windows\System\ufxsWHz.exe
  C:\Windows\System\ufxsWHz.exe
  2⤵
  PID:6072
- C:\Windows\System\iyUjjhb.exe
  C:\Windows\System\iyUjjhb.exe
  2⤵
  PID:7144
- C:\Windows\System\ucyjAiE.exe
  C:\Windows\System\ucyjAiE.exe
  2⤵
  PID:6164
- C:\Windows\System\LlGNjbr.exe
  C:\Windows\System\LlGNjbr.exe
  2⤵
  PID:6168
- C:\Windows\System\oTqKwdp.exe
  C:\Windows\System\oTqKwdp.exe
  2⤵
  PID:5388
- C:\Windows\System\aSScpFH.exe
  C:\Windows\System\aSScpFH.exe
  2⤵
  PID:5924
- C:\Windows\System\uFUzuSi.exe
  C:\Windows\System\uFUzuSi.exe
  2⤵
  PID:6284
- C:\Windows\System\rJbsnXI.exe
  C:\Windows\System\rJbsnXI.exe
  2⤵
  PID:6588
- C:\Windows\System\QwpbGWY.exe
  C:\Windows\System\QwpbGWY.exe
  2⤵
  PID:6596
- C:\Windows\System\bdiYjWz.exe
  C:\Windows\System\bdiYjWz.exe
  2⤵
  PID:6536
- C:\Windows\System\zbYmvxO.exe
  C:\Windows\System\zbYmvxO.exe
  2⤵
  PID:6364
- C:\Windows\System\zGNbtJU.exe
  C:\Windows\System\zGNbtJU.exe
  2⤵
  PID:6268
- C:\Windows\System\cluxVVh.exe
  C:\Windows\System\cluxVVh.exe
  2⤵
  PID:6684
- C:\Windows\System\YHtdenR.exe
  C:\Windows\System\YHtdenR.exe
  2⤵
  PID:6736
- C:\Windows\System\tzEfqQr.exe
  C:\Windows\System\tzEfqQr.exe
  2⤵
  PID:6832
- C:\Windows\System\MecmpYx.exe
  C:\Windows\System\MecmpYx.exe
  2⤵
  PID:6652
- C:\Windows\System\CcGtJFg.exe
  C:\Windows\System\CcGtJFg.exe
  2⤵
  PID:6932
- C:\Windows\System\qLRAlcX.exe
  C:\Windows\System\qLRAlcX.exe
  2⤵
  PID:6852
- C:\Windows\System\XcpUWFG.exe
  C:\Windows\System\XcpUWFG.exe
  2⤵
  PID:6976
- C:\Windows\System\XLqaRCp.exe
  C:\Windows\System\XLqaRCp.exe
  2⤵
  PID:7020
- C:\Windows\System\vNyRHDD.exe
  C:\Windows\System\vNyRHDD.exe
  2⤵
  PID:7092
- C:\Windows\System\nyzAtVX.exe
  C:\Windows\System\nyzAtVX.exe
  2⤵
  PID:7140
- C:\Windows\System\MMuXmFY.exe
  C:\Windows\System\MMuXmFY.exe
  2⤵
  PID:5748
- C:\Windows\System\QIkAMdG.exe
  C:\Windows\System\QIkAMdG.exe
  2⤵
  PID:7108
- C:\Windows\System\lPDLITz.exe
  C:\Windows\System\lPDLITz.exe
  2⤵
  PID:7036
- C:\Windows\System\EstLbIt.exe
  C:\Windows\System\EstLbIt.exe
  2⤵
  PID:7156
- C:\Windows\System\pOJLNkE.exe
  C:\Windows\System\pOJLNkE.exe
  2⤵
  PID:6256
- C:\Windows\System\wbuIcDz.exe
  C:\Windows\System\wbuIcDz.exe
  2⤵
  PID:6232
- C:\Windows\System\BFpxtOJ.exe
  C:\Windows\System\BFpxtOJ.exe
  2⤵
  PID:6504
- C:\Windows\System\UNnaCtl.exe
  C:\Windows\System\UNnaCtl.exe
  2⤵
  PID:6336
- C:\Windows\System\GpGbCnh.exe
  C:\Windows\System\GpGbCnh.exe
  2⤵
  PID:6672
- C:\Windows\System\xwiaqRM.exe
  C:\Windows\System\xwiaqRM.exe
  2⤵
  PID:6492
- C:\Windows\System\mOohrYw.exe
  C:\Windows\System\mOohrYw.exe
  2⤵
  PID:6708
- C:\Windows\System\qcvGMRu.exe
  C:\Windows\System\qcvGMRu.exe
  2⤵
  PID:6844
- C:\Windows\System\UKPOjPf.exe
  C:\Windows\System\UKPOjPf.exe
  2⤵
  PID:7012
- C:\Windows\System\zUgSAqy.exe
  C:\Windows\System\zUgSAqy.exe
  2⤵
  PID:6820
- C:\Windows\System\KCftRlA.exe
  C:\Windows\System\KCftRlA.exe
  2⤵
  PID:7116
- C:\Windows\System\KXcDuUq.exe
  C:\Windows\System\KXcDuUq.exe
  2⤵
  PID:6096
- C:\Windows\System\YVlfEqT.exe
  C:\Windows\System\YVlfEqT.exe
  2⤵
  PID:6476
- C:\Windows\System\HYDaPuv.exe
  C:\Windows\System\HYDaPuv.exe
  2⤵
  PID:3016
- C:\Windows\System\LhfufsF.exe
  C:\Windows\System\LhfufsF.exe
  2⤵
  PID:4760
- C:\Windows\System\LfTSLTx.exe
  C:\Windows\System\LfTSLTx.exe
  2⤵
  PID:5736
- C:\Windows\System\gpPFZFZ.exe
  C:\Windows\System\gpPFZFZ.exe
  2⤵
  PID:6788
- C:\Windows\System\gAqNlqp.exe
  C:\Windows\System\gAqNlqp.exe
  2⤵
  PID:6848
- C:\Windows\System\gqHnsQp.exe
  C:\Windows\System\gqHnsQp.exe
  2⤵
  PID:4300
- C:\Windows\System\HUfeLQe.exe
  C:\Windows\System\HUfeLQe.exe
  2⤵
  PID:7172
- C:\Windows\System\dAHOVNt.exe
  C:\Windows\System\dAHOVNt.exe
  2⤵
  PID:7204
- C:\Windows\System\KMQSxes.exe
  C:\Windows\System\KMQSxes.exe
  2⤵
  PID:7220
- C:\Windows\System\XdApMwG.exe
  C:\Windows\System\XdApMwG.exe
  2⤵
  PID:7236
- C:\Windows\System\CRsSEAF.exe
  C:\Windows\System\CRsSEAF.exe
  2⤵
  PID:7252
- C:\Windows\System\OmKwnqg.exe
  C:\Windows\System\OmKwnqg.exe
  2⤵
  PID:7268
- C:\Windows\System\GEYrqoN.exe
  C:\Windows\System\GEYrqoN.exe
  2⤵
  PID:7284
- C:\Windows\System\HOtaTdo.exe
  C:\Windows\System\HOtaTdo.exe
  2⤵
  PID:7300
- C:\Windows\System\KqyFCoe.exe
  C:\Windows\System\KqyFCoe.exe
  2⤵
  PID:7316
- C:\Windows\System\AqyUPkS.exe
  C:\Windows\System\AqyUPkS.exe
  2⤵
  PID:7344
- C:\Windows\System\IoQfZRE.exe
  C:\Windows\System\IoQfZRE.exe
  2⤵
  PID:7380
- C:\Windows\System\oskPCge.exe
  C:\Windows\System\oskPCge.exe
  2⤵
  PID:7396
- C:\Windows\System\OTNFrKB.exe
  C:\Windows\System\OTNFrKB.exe
  2⤵
  PID:7412
- C:\Windows\System\iQTgYNo.exe
  C:\Windows\System\iQTgYNo.exe
  2⤵
  PID:7432
- C:\Windows\System\DiWpiuB.exe
  C:\Windows\System\DiWpiuB.exe
  2⤵
  PID:7456
- C:\Windows\System\VHWQdPc.exe
  C:\Windows\System\VHWQdPc.exe
  2⤵
  PID:7484
- C:\Windows\System\ykvCPJz.exe
  C:\Windows\System\ykvCPJz.exe
  2⤵
  PID:7512
- C:\Windows\System\luoCYRB.exe
  C:\Windows\System\luoCYRB.exe
  2⤵
  PID:7536
- C:\Windows\System\dlyQTvR.exe
  C:\Windows\System\dlyQTvR.exe
  2⤵
  PID:7552
- C:\Windows\System\WjMnesY.exe
  C:\Windows\System\WjMnesY.exe
  2⤵
  PID:7568
- C:\Windows\System\bbjxpfw.exe
  C:\Windows\System\bbjxpfw.exe
  2⤵
  PID:7584
- C:\Windows\System\KJQujaw.exe
  C:\Windows\System\KJQujaw.exe
  2⤵
  PID:7604
- C:\Windows\System\dnniqKt.exe
  C:\Windows\System\dnniqKt.exe
  2⤵
  PID:7636
- C:\Windows\System\SfDOjcm.exe
  C:\Windows\System\SfDOjcm.exe
  2⤵
  PID:7652
- C:\Windows\System\ZAsqfsm.exe
  C:\Windows\System\ZAsqfsm.exe
  2⤵
  PID:7668
- C:\Windows\System\mmbOlrA.exe
  C:\Windows\System\mmbOlrA.exe
  2⤵
  PID:7688
- C:\Windows\System\hUJAoTn.exe
  C:\Windows\System\hUJAoTn.exe
  2⤵
  PID:7732
- C:\Windows\System\ytwGxwp.exe
  C:\Windows\System\ytwGxwp.exe
  2⤵
  PID:7748
- C:\Windows\System\lTPRILP.exe
  C:\Windows\System\lTPRILP.exe
  2⤵
  PID:7764
- C:\Windows\System\BNwOmfI.exe
  C:\Windows\System\BNwOmfI.exe
  2⤵
  PID:7780
- C:\Windows\System\LEIAnVM.exe
  C:\Windows\System\LEIAnVM.exe
  2⤵
  PID:7808
- C:\Windows\System\jRabjFl.exe
  C:\Windows\System\jRabjFl.exe
  2⤵
  PID:7824
- C:\Windows\System\JuVXdPt.exe
  C:\Windows\System\JuVXdPt.exe
  2⤵
  PID:7848
- C:\Windows\System\XLEqglA.exe
  C:\Windows\System\XLEqglA.exe
  2⤵
  PID:7864
- C:\Windows\System\RXmmhuf.exe
  C:\Windows\System\RXmmhuf.exe
  2⤵
  PID:7884
- C:\Windows\System\OaExAgO.exe
  C:\Windows\System\OaExAgO.exe
  2⤵
  PID:7900
- C:\Windows\System\hxODoMV.exe
  C:\Windows\System\hxODoMV.exe
  2⤵
  PID:7916
- C:\Windows\System\sDMMgMd.exe
  C:\Windows\System\sDMMgMd.exe
  2⤵
  PID:7932
- C:\Windows\System\NOHgKwP.exe
  C:\Windows\System\NOHgKwP.exe
  2⤵
  PID:7948
- C:\Windows\System\HbxXmZx.exe
  C:\Windows\System\HbxXmZx.exe
  2⤵
  PID:7968
- C:\Windows\System\NZVPRew.exe
  C:\Windows\System\NZVPRew.exe
  2⤵
  PID:7984
- C:\Windows\System\qvMXZCS.exe
  C:\Windows\System\qvMXZCS.exe
  2⤵
  PID:8000
- C:\Windows\System\QjEsxiR.exe
  C:\Windows\System\QjEsxiR.exe
  2⤵
  PID:8020
- C:\Windows\System\JcOOAmF.exe
  C:\Windows\System\JcOOAmF.exe
  2⤵
  PID:8036
- C:\Windows\System\QpCntgj.exe
  C:\Windows\System\QpCntgj.exe
  2⤵
  PID:8052
- C:\Windows\System\JLDqvmt.exe
  C:\Windows\System\JLDqvmt.exe
  2⤵
  PID:8068
- C:\Windows\System\cGVVxZF.exe
  C:\Windows\System\cGVVxZF.exe
  2⤵
  PID:8092
- C:\Windows\System\RlKjfAp.exe
  C:\Windows\System\RlKjfAp.exe
  2⤵
  PID:8108
- C:\Windows\System\CewNfAx.exe
  C:\Windows\System\CewNfAx.exe
  2⤵
  PID:8124
- C:\Windows\System\DYNNxbn.exe
  C:\Windows\System\DYNNxbn.exe
  2⤵
  PID:8144
- C:\Windows\System\xVBtdcV.exe
  C:\Windows\System\xVBtdcV.exe
  2⤵
  PID:8160
- C:\Windows\System\TzoeZXD.exe
  C:\Windows\System\TzoeZXD.exe
  2⤵
  PID:8176
- C:\Windows\System\lPBdmKT.exe
  C:\Windows\System\lPBdmKT.exe
  2⤵
  PID:5128
- C:\Windows\System\TZtaKmQ.exe
  C:\Windows\System\TZtaKmQ.exe
  2⤵
  PID:6592
- C:\Windows\System\QgEwnxV.exe
  C:\Windows\System\QgEwnxV.exe
  2⤵
  PID:7244
- C:\Windows\System\qLmJfHh.exe
  C:\Windows\System\qLmJfHh.exe
  2⤵
  PID:7308
- C:\Windows\System\yyzomlX.exe
  C:\Windows\System\yyzomlX.exe
  2⤵
  PID:7232
- C:\Windows\System\SIraNOp.exe
  C:\Windows\System\SIraNOp.exe
  2⤵
  PID:7292
- C:\Windows\System\mxiMROH.exe
  C:\Windows\System\mxiMROH.exe
  2⤵
  PID:7196
- C:\Windows\System\syezxKX.exe
  C:\Windows\System\syezxKX.exe
  2⤵
  PID:7296
- C:\Windows\System\QpOBxdW.exe
  C:\Windows\System\QpOBxdW.exe
  2⤵
  PID:7328
- C:\Windows\System\ToFpqdx.exe
  C:\Windows\System\ToFpqdx.exe
  2⤵
  PID:7076
- C:\Windows\System\OGrFpQD.exe
  C:\Windows\System\OGrFpQD.exe
  2⤵
  PID:6556
- C:\Windows\System\AeTTDVy.exe
  C:\Windows\System\AeTTDVy.exe
  2⤵
  PID:7336
- C:\Windows\System\bJrJZAH.exe
  C:\Windows\System\bJrJZAH.exe
  2⤵
  PID:7364
- C:\Windows\System\TALfLnY.exe
  C:\Windows\System\TALfLnY.exe
  2⤵
  PID:7376
- C:\Windows\System\BiZiojt.exe
  C:\Windows\System\BiZiojt.exe
  2⤵
  PID:7444
- C:\Windows\System\gvIAIZc.exe
  C:\Windows\System\gvIAIZc.exe
  2⤵
  PID:7424
- C:\Windows\System\DFgRKQv.exe
  C:\Windows\System\DFgRKQv.exe
  2⤵
  PID:7496
- C:\Windows\System\uXgehhU.exe
  C:\Windows\System\uXgehhU.exe
  2⤵
  PID:7548
- C:\Windows\System\EaBTEKL.exe
  C:\Windows\System\EaBTEKL.exe
  2⤵
  PID:7620
- C:\Windows\System\ltWzuqa.exe
  C:\Windows\System\ltWzuqa.exe
  2⤵
  PID:7388
- C:\Windows\System\ljIHMfS.exe
  C:\Windows\System\ljIHMfS.exe
  2⤵
  PID:7468
- C:\Windows\System\obSQFLx.exe
  C:\Windows\System\obSQFLx.exe
  2⤵
  PID:7476
- C:\Windows\System\Umwdfbg.exe
  C:\Windows\System\Umwdfbg.exe
  2⤵
  PID:7592
- C:\Windows\System\vEevGDs.exe
  C:\Windows\System\vEevGDs.exe
  2⤵
  PID:7676
- C:\Windows\System\GkbjGPs.exe
  C:\Windows\System\GkbjGPs.exe
  2⤵
  PID:7528
- C:\Windows\System\PjqfwRk.exe
  C:\Windows\System\PjqfwRk.exe
  2⤵
  PID:7560
- C:\Windows\System\IarBEqK.exe
  C:\Windows\System\IarBEqK.exe
  2⤵
  PID:7712
- C:\Windows\System\tULJHlh.exe
  C:\Windows\System\tULJHlh.exe
  2⤵
  PID:7728
- C:\Windows\System\nYvXsEX.exe
  C:\Windows\System\nYvXsEX.exe
  2⤵
  PID:7760
- C:\Windows\System\qdDigCx.exe
  C:\Windows\System\qdDigCx.exe
  2⤵
  PID:7740
- C:\Windows\System\AHbEwgt.exe
  C:\Windows\System\AHbEwgt.exe
  2⤵
  PID:7800
- C:\Windows\System\hpZMbtu.exe
  C:\Windows\System\hpZMbtu.exe
  2⤵
  PID:7816
- C:\Windows\System\grrcant.exe
  C:\Windows\System\grrcant.exe
  2⤵
  PID:7872
- C:\Windows\System\wfiDXFV.exe
  C:\Windows\System\wfiDXFV.exe
  2⤵
  PID:7912
- C:\Windows\System\gCjZshF.exe
  C:\Windows\System\gCjZshF.exe
  2⤵
  PID:7980
- C:\Windows\System\oGwvBNe.exe
  C:\Windows\System\oGwvBNe.exe
  2⤵
  PID:7892
- C:\Windows\System\pYsiqTG.exe
  C:\Windows\System\pYsiqTG.exe
  2⤵
  PID:7956
- C:\Windows\System\zrQqhDd.exe
  C:\Windows\System\zrQqhDd.exe
  2⤵
  PID:8028
- C:\Windows\System\kxNgPYc.exe
  C:\Windows\System\kxNgPYc.exe
  2⤵
  PID:7860
- C:\Windows\System\ZETQXaD.exe
  C:\Windows\System\ZETQXaD.exe
  2⤵
  PID:8080
- C:\Windows\System\yZKXqJu.exe
  C:\Windows\System\yZKXqJu.exe
  2⤵
  PID:8088
- C:\Windows\System\ClLpkhO.exe
  C:\Windows\System\ClLpkhO.exe
  2⤵
  PID:8156
- C:\Windows\System\NbfUKdG.exe
  C:\Windows\System\NbfUKdG.exe
  2⤵
  PID:7216
- C:\Windows\System\KxLFvaw.exe
  C:\Windows\System\KxLFvaw.exe
  2⤵
  PID:6856
- C:\Windows\System\wCEAjbz.exe
  C:\Windows\System\wCEAjbz.exe
  2⤵
  PID:6664
- C:\Windows\System\dzUqzwl.exe
  C:\Windows\System\dzUqzwl.exe
  2⤵
  PID:7180
- C:\Windows\System\BDhbraX.exe
  C:\Windows\System\BDhbraX.exe
  2⤵
  PID:7260
- C:\Windows\System\QxOaSOy.exe
  C:\Windows\System\QxOaSOy.exe
  2⤵
  PID:8136
- C:\Windows\System\YTkamjW.exe
  C:\Windows\System\YTkamjW.exe
  2⤵
  PID:7356
- C:\Windows\System\jXGbKOe.exe
  C:\Windows\System\jXGbKOe.exe
  2⤵
  PID:7408
- C:\Windows\System\KwQlHeG.exe
  C:\Windows\System\KwQlHeG.exe
  2⤵
  PID:7500
- C:\Windows\System\XMcMRUC.exe
  C:\Windows\System\XMcMRUC.exe
  2⤵
  PID:7664
- C:\Windows\System\BLJkOHe.exe
  C:\Windows\System\BLJkOHe.exe
  2⤵
  PID:7464
- C:\Windows\System\BqTwmLU.exe
  C:\Windows\System\BqTwmLU.exe
  2⤵
  PID:7700
- C:\Windows\System\ImVdwEu.exe
  C:\Windows\System\ImVdwEu.exe
  2⤵
  PID:7372
- C:\Windows\System\PwXvMwo.exe
  C:\Windows\System\PwXvMwo.exe
  2⤵
  PID:7776
- C:\Windows\System\dqcXGlD.exe
  C:\Windows\System\dqcXGlD.exe
  2⤵
  PID:7788
- C:\Windows\System\DrhviIg.exe
  C:\Windows\System\DrhviIg.exe
  2⤵
  PID:7724
- C:\Windows\System\izPtpLV.exe
  C:\Windows\System\izPtpLV.exe
  2⤵
  PID:7472
- C:\Windows\System\qKdiivs.exe
  C:\Windows\System\qKdiivs.exe
  2⤵
  PID:7836
- C:\Windows\System\qlQUpLO.exe
  C:\Windows\System\qlQUpLO.exe
  2⤵
  PID:7944
- C:\Windows\System\IyRfetZ.exe
  C:\Windows\System\IyRfetZ.exe
  2⤵
  PID:8060
- C:\Windows\System\itsZWQM.exe
  C:\Windows\System\itsZWQM.exe
  2⤵
  PID:6692
- C:\Windows\System\nybDTJY.exe
  C:\Windows\System\nybDTJY.exe
  2⤵
  PID:7276
- C:\Windows\System\EVfTylv.exe
  C:\Windows\System\EVfTylv.exe
  2⤵
  PID:7832
- C:\Windows\System\dKmtBKF.exe
  C:\Windows\System\dKmtBKF.exe
  2⤵
  PID:7992
- C:\Windows\System\TCbFhEF.exe
  C:\Windows\System\TCbFhEF.exe
  2⤵
  PID:8168
- C:\Windows\System\qEquQjZ.exe
  C:\Windows\System\qEquQjZ.exe
  2⤵
  PID:5872
- C:\Windows\System\YLdkDZm.exe
  C:\Windows\System\YLdkDZm.exe
  2⤵
  PID:8044
- C:\Windows\System\ITKKdZl.exe
  C:\Windows\System\ITKKdZl.exe
  2⤵
  PID:2552
- C:\Windows\System\hniiSAK.exe
  C:\Windows\System\hniiSAK.exe
  2⤵
  PID:7684
- C:\Windows\System\urYuwfW.exe
  C:\Windows\System\urYuwfW.exe
  2⤵
  PID:7544
- C:\Windows\System\ODZxZLu.exe
  C:\Windows\System\ODZxZLu.exe
  2⤵
  PID:7628
- C:\Windows\System\JhKfWcy.exe
  C:\Windows\System\JhKfWcy.exe
  2⤵
  PID:7704
- C:\Windows\System\xiLkhZf.exe
  C:\Windows\System\xiLkhZf.exe
  2⤵
  PID:7924
- C:\Windows\System\jBVQkvX.exe
  C:\Windows\System\jBVQkvX.exe
  2⤵
  PID:8140
- C:\Windows\System\hYlHvQe.exe
  C:\Windows\System\hYlHvQe.exe
  2⤵
  PID:8120
- C:\Windows\System\xTwZQui.exe
  C:\Windows\System\xTwZQui.exe
  2⤵
  PID:6416
- C:\Windows\System\nlfztat.exe
  C:\Windows\System\nlfztat.exe
  2⤵
  PID:6428
- C:\Windows\System\DkjJFlW.exe
  C:\Windows\System\DkjJFlW.exe
  2⤵
  PID:8064
- C:\Windows\System\otklzJs.exe
  C:\Windows\System\otklzJs.exe
  2⤵
  PID:7520
- C:\Windows\System\sqGOILp.exe
  C:\Windows\System\sqGOILp.exe
  2⤵
  PID:8012
- C:\Windows\System\TSZlVIi.exe
  C:\Windows\System\TSZlVIi.exe
  2⤵
  PID:7612
- C:\Windows\System\XEwSvUj.exe
  C:\Windows\System\XEwSvUj.exe
  2⤵
  PID:6936
- C:\Windows\System\KxqzDyK.exe
  C:\Windows\System\KxqzDyK.exe
  2⤵
  PID:7880
- C:\Windows\System\YwQNBnG.exe
  C:\Windows\System\YwQNBnG.exe
  2⤵
  PID:8152
- C:\Windows\System\QFRwPeb.exe
  C:\Windows\System\QFRwPeb.exe
  2⤵
  PID:8208
- C:\Windows\System\QOSiJew.exe
  C:\Windows\System\QOSiJew.exe
  2⤵
  PID:8224
- C:\Windows\System\bMuZgVu.exe
  C:\Windows\System\bMuZgVu.exe
  2⤵
  PID:8240
- C:\Windows\System\mHFAtse.exe
  C:\Windows\System\mHFAtse.exe
  2⤵
  PID:8256
- C:\Windows\System\HYmBDJZ.exe
  C:\Windows\System\HYmBDJZ.exe
  2⤵
  PID:8272
- C:\Windows\System\uMmmgpJ.exe
  C:\Windows\System\uMmmgpJ.exe
  2⤵
  PID:8288
- C:\Windows\System\KdDbJqt.exe
  C:\Windows\System\KdDbJqt.exe
  2⤵
  PID:8304
- C:\Windows\System\HDzTDMp.exe
  C:\Windows\System\HDzTDMp.exe
  2⤵
  PID:8320
- C:\Windows\System\btxgETJ.exe
  C:\Windows\System\btxgETJ.exe
  2⤵
  PID:8336
- C:\Windows\System\BVKnntp.exe
  C:\Windows\System\BVKnntp.exe
  2⤵
  PID:8352
- C:\Windows\System\NLYzZhB.exe
  C:\Windows\System\NLYzZhB.exe
  2⤵
  PID:8372
- C:\Windows\System\FjyLewc.exe
  C:\Windows\System\FjyLewc.exe
  2⤵
  PID:8432
- C:\Windows\System\GyWjTwh.exe
  C:\Windows\System\GyWjTwh.exe
  2⤵
  PID:8476
- C:\Windows\System\KljwxkG.exe
  C:\Windows\System\KljwxkG.exe
  2⤵
  PID:8644
- C:\Windows\System\sCEmdBb.exe
  C:\Windows\System\sCEmdBb.exe
  2⤵
  PID:8740
- C:\Windows\System\TsmqUIF.exe
  C:\Windows\System\TsmqUIF.exe
  2⤵
  PID:8772
- C:\Windows\System\vzhapaV.exe
  C:\Windows\System\vzhapaV.exe
  2⤵
  PID:8800
- C:\Windows\System\HsBQuTm.exe
  C:\Windows\System\HsBQuTm.exe
  2⤵
  PID:8820
- C:\Windows\System\MmmlHov.exe
  C:\Windows\System\MmmlHov.exe
  2⤵
  PID:8908
- C:\Windows\System\EzqLvay.exe
  C:\Windows\System\EzqLvay.exe
  2⤵
  PID:8924
- C:\Windows\System\qMoicYU.exe
  C:\Windows\System\qMoicYU.exe
  2⤵
  PID:8940
- C:\Windows\System\SEJUxWm.exe
  C:\Windows\System\SEJUxWm.exe
  2⤵
  PID:8972
- C:\Windows\System\OorbRiS.exe
  C:\Windows\System\OorbRiS.exe
  2⤵
  PID:9032
- C:\Windows\System\HemWJMs.exe
  C:\Windows\System\HemWJMs.exe
  2⤵
  PID:9052
- C:\Windows\System\ifJsvUL.exe
  C:\Windows\System\ifJsvUL.exe
  2⤵
  PID:9068
- C:\Windows\System\cSqDQRQ.exe
  C:\Windows\System\cSqDQRQ.exe
  2⤵
  PID:9092
- C:\Windows\System\zxgHNnb.exe
  C:\Windows\System\zxgHNnb.exe
  2⤵
  PID:9108
- C:\Windows\System\IRHddkr.exe
  C:\Windows\System\IRHddkr.exe
  2⤵
  PID:9124
- C:\Windows\System\srrJJkJ.exe
  C:\Windows\System\srrJJkJ.exe
  2⤵
  PID:9144
- C:\Windows\System\cZFPRhv.exe
  C:\Windows\System\cZFPRhv.exe
  2⤵
  PID:9172
- C:\Windows\System\IGBoTQu.exe
  C:\Windows\System\IGBoTQu.exe
  2⤵
  PID:9188
- C:\Windows\System\LELBBHV.exe
  C:\Windows\System\LELBBHV.exe
  2⤵
  PID:9204
- C:\Windows\System\osiuIYr.exe
  C:\Windows\System\osiuIYr.exe
  2⤵
  PID:8204
- C:\Windows\System\DBUDjDZ.exe
  C:\Windows\System\DBUDjDZ.exe
  2⤵
  PID:7616
- C:\Windows\System\ZnfXsAj.exe
  C:\Windows\System\ZnfXsAj.exe
  2⤵
  PID:8252
- C:\Windows\System\wspMxBY.exe
  C:\Windows\System\wspMxBY.exe
  2⤵
  PID:8296
- C:\Windows\System\mJQkhwC.exe
  C:\Windows\System\mJQkhwC.exe
  2⤵
  PID:8364
- C:\Windows\System\aecpkbC.exe
  C:\Windows\System\aecpkbC.exe
  2⤵
  PID:8348
- C:\Windows\System\MZbJSxs.exe
  C:\Windows\System\MZbJSxs.exe
  2⤵
  PID:8396
- C:\Windows\System\pAeZqIq.exe
  C:\Windows\System\pAeZqIq.exe
  2⤵
  PID:8404
- C:\Windows\System\fhxyQGz.exe
  C:\Windows\System\fhxyQGz.exe
  2⤵
  PID:8440
- C:\Windows\System\gCpGWLJ.exe
  C:\Windows\System\gCpGWLJ.exe
  2⤵
  PID:8448
- C:\Windows\System\DCbLoSm.exe
  C:\Windows\System\DCbLoSm.exe
  2⤵
  PID:8508
- C:\Windows\System\JFauhxI.exe
  C:\Windows\System\JFauhxI.exe
  2⤵
  PID:8524
- C:\Windows\System\oZOQcru.exe
  C:\Windows\System\oZOQcru.exe
  2⤵
  PID:8540
- C:\Windows\System\SNPwvUp.exe
  C:\Windows\System\SNPwvUp.exe
  2⤵
  PID:8576
- C:\Windows\System\IdmLHON.exe
  C:\Windows\System\IdmLHON.exe
  2⤵
  PID:8596
- C:\Windows\System\jmmaDtl.exe
  C:\Windows\System\jmmaDtl.exe
  2⤵
  PID:8588
- C:\Windows\System\AoPiInJ.exe
  C:\Windows\System\AoPiInJ.exe
  2⤵
  PID:8620
- C:\Windows\System\ffdbGNF.exe
  C:\Windows\System\ffdbGNF.exe
  2⤵
  PID:8640
- C:\Windows\System\YkGSHcu.exe
  C:\Windows\System\YkGSHcu.exe
  2⤵
  PID:8664
- C:\Windows\System\wQPcjHp.exe
  C:\Windows\System\wQPcjHp.exe
  2⤵
  PID:8680
- C:\Windows\System\jMmxKbE.exe
  C:\Windows\System\jMmxKbE.exe
  2⤵
  PID:8696
- C:\Windows\System\jgDGrPf.exe
  C:\Windows\System\jgDGrPf.exe
  2⤵
  PID:8716
- C:\Windows\System\alLQyjt.exe
  C:\Windows\System\alLQyjt.exe
  2⤵
  PID:8732
- C:\Windows\System\jHGkfLf.exe
  C:\Windows\System\jHGkfLf.exe
  2⤵
  PID:8780
- C:\Windows\System\eepdtrd.exe
  C:\Windows\System\eepdtrd.exe
  2⤵
  PID:8764
- C:\Windows\System\UdAIxJq.exe
  C:\Windows\System\UdAIxJq.exe
  2⤵
  PID:8828
- C:\Windows\System\FEeaJgo.exe
  C:\Windows\System\FEeaJgo.exe
  2⤵
  PID:8852
- C:\Windows\System\ZnHRStv.exe
  C:\Windows\System\ZnHRStv.exe
  2⤵
  PID:8876
- C:\Windows\System\dERqHCb.exe
  C:\Windows\System\dERqHCb.exe
  2⤵
  PID:8892
- C:\Windows\System\VrgkaEj.exe
  C:\Windows\System\VrgkaEj.exe
  2⤵
  PID:8932
- C:\Windows\System\GtDiSwA.exe
  C:\Windows\System\GtDiSwA.exe
  2⤵
  PID:8980
- C:\Windows\System\RoSjTym.exe
  C:\Windows\System\RoSjTym.exe
  2⤵
  PID:8996
- C:\Windows\System\YLcsNTJ.exe
  C:\Windows\System\YLcsNTJ.exe
  2⤵
  PID:9016
- C:\Windows\System\bijzBgW.exe
  C:\Windows\System\bijzBgW.exe
  2⤵
  PID:9076
- C:\Windows\System\YZWUnMT.exe
  C:\Windows\System\YZWUnMT.exe
  2⤵
  PID:9136
- C:\Windows\System\XlTvybA.exe
  C:\Windows\System\XlTvybA.exe
  2⤵
  PID:9080
- C:\Windows\System\QrRjRso.exe
  C:\Windows\System\QrRjRso.exe
  2⤵
  PID:8196
- C:\Windows\System\yUiDHex.exe
  C:\Windows\System\yUiDHex.exe
  2⤵
  PID:9156
- C:\Windows\System\LlRNrUz.exe
  C:\Windows\System\LlRNrUz.exe
  2⤵
  PID:8332
- C:\Windows\System\cxpYrNX.exe
  C:\Windows\System\cxpYrNX.exe
  2⤵
  PID:8232
- C:\Windows\System\iPABuwX.exe
  C:\Windows\System\iPABuwX.exe
  2⤵
  PID:8248
- C:\Windows\System\oOtecdZ.exe
  C:\Windows\System\oOtecdZ.exe
  2⤵
  PID:8420
- C:\Windows\System\ySjPuAo.exe
  C:\Windows\System\ySjPuAo.exe
  2⤵
  PID:8456
- C:\Windows\System\IQamKTz.exe
  C:\Windows\System\IQamKTz.exe
  2⤵
  PID:8468
- C:\Windows\System\mcUARSf.exe
  C:\Windows\System\mcUARSf.exe
  2⤵
  PID:8552
- C:\Windows\System\JkbGKsd.exe
  C:\Windows\System\JkbGKsd.exe
  2⤵
  PID:8532
- C:\Windows\System\uBHAzrV.exe
  C:\Windows\System\uBHAzrV.exe
  2⤵
  PID:8564
- C:\Windows\System\bkRnhXY.exe
  C:\Windows\System\bkRnhXY.exe
  2⤵
  PID:8584
- C:\Windows\System\fEDzEyZ.exe
  C:\Windows\System\fEDzEyZ.exe
  2⤵
  PID:8624
- C:\Windows\System\yHdLFMT.exe
  C:\Windows\System\yHdLFMT.exe
  2⤵
  PID:8672
- C:\Windows\System\CvTsaBA.exe
  C:\Windows\System\CvTsaBA.exe
  2⤵
  PID:8724
- C:\Windows\System\NSEPuvf.exe
  C:\Windows\System\NSEPuvf.exe
  2⤵
  PID:8756
- C:\Windows\System\sLZqjXs.exe
  C:\Windows\System\sLZqjXs.exe
  2⤵
  PID:8704
- C:\Windows\System\dOcEGmw.exe
  C:\Windows\System\dOcEGmw.exe
  2⤵
  PID:8884
- C:\Windows\System\RkMNwte.exe
  C:\Windows\System\RkMNwte.exe
  2⤵
  PID:8916
- C:\Windows\System\tJFAxxS.exe
  C:\Windows\System\tJFAxxS.exe
  2⤵
  PID:8992
- C:\Windows\System\LTvWGze.exe
  C:\Windows\System\LTvWGze.exe
  2⤵
  PID:8860
- C:\Windows\System\GZOSjGq.exe
  C:\Windows\System\GZOSjGq.exe
  2⤵
  PID:8952
- C:\Windows\System\yykkvcb.exe
  C:\Windows\System\yykkvcb.exe
  2⤵
  PID:8988
- C:\Windows\System\rNcRwZO.exe
  C:\Windows\System\rNcRwZO.exe
  2⤵
  PID:9028
- C:\Windows\System\RbyDDVe.exe
  C:\Windows\System\RbyDDVe.exe
  2⤵
  PID:8496
- C:\Windows\System\AtgqXwu.exe
  C:\Windows\System\AtgqXwu.exe
  2⤵
  PID:9180
- C:\Windows\System\ByDHsYK.exe
  C:\Windows\System\ByDHsYK.exe
  2⤵
  PID:7524
- C:\Windows\System\ZOUrvcV.exe
  C:\Windows\System\ZOUrvcV.exe
  2⤵
  PID:9120
- C:\Windows\System\YWlUXeO.exe
  C:\Windows\System\YWlUXeO.exe
  2⤵
  PID:8360
- C:\Windows\System\tbLufxO.exe
  C:\Windows\System\tbLufxO.exe
  2⤵
  PID:8512
- C:\Windows\System\GTohxJi.exe
  C:\Windows\System\GTohxJi.exe
  2⤵
  PID:8608
- C:\Windows\System\aadeUip.exe
  C:\Windows\System\aadeUip.exe
  2⤵
  PID:8688
- C:\Windows\System\UthBiZj.exe
  C:\Windows\System\UthBiZj.exe
  2⤵
  PID:8752
- C:\Windows\System\PCdhspn.exe
  C:\Windows\System\PCdhspn.exe
  2⤵
  PID:8808
- C:\Windows\System\cDqggHv.exe
  C:\Windows\System\cDqggHv.exe
  2⤵
  PID:8816
- C:\Windows\System\vOchTpv.exe
  C:\Windows\System\vOchTpv.exe
  2⤵
  PID:8792
- C:\Windows\System\YkPjpyB.exe
  C:\Windows\System\YkPjpyB.exe
  2⤵
  PID:544
- C:\Windows\System\gNmnZdv.exe
  C:\Windows\System\gNmnZdv.exe
  2⤵
  PID:9212
- C:\Windows\System\WnIHMQV.exe
  C:\Windows\System\WnIHMQV.exe
  2⤵
  PID:8280
- C:\Windows\System\eNRONfc.exe
  C:\Windows\System\eNRONfc.exe
  2⤵
  PID:9152
- C:\Windows\System\vuHaXBk.exe
  C:\Windows\System\vuHaXBk.exe
  2⤵
  PID:8344
- C:\Windows\System\ClCGPgP.exe
  C:\Windows\System\ClCGPgP.exe
  2⤵
  PID:8492
- C:\Windows\System\CNXokSm.exe
  C:\Windows\System\CNXokSm.exe
  2⤵
  PID:8712
- C:\Windows\System\tEUEPWQ.exe
  C:\Windows\System\tEUEPWQ.exe
  2⤵
  PID:8960
- C:\Windows\System\XxNyREO.exe
  C:\Windows\System\XxNyREO.exe
  2⤵
  PID:8956
- C:\Windows\System\CQGrttu.exe
  C:\Windows\System\CQGrttu.exe
  2⤵
  PID:9008
- C:\Windows\System\mdnwbSo.exe
  C:\Windows\System\mdnwbSo.exe
  2⤵
  PID:8464
- C:\Windows\System\SsuIYCc.exe
  C:\Windows\System\SsuIYCc.exe
  2⤵
  PID:8316
- C:\Windows\System\WwAxSzC.exe
  C:\Windows\System\WwAxSzC.exe
  2⤵
  PID:8460
- C:\Windows\System\ebrEYAO.exe
  C:\Windows\System\ebrEYAO.exe
  2⤵
  PID:8472
- C:\Windows\System\pcsnoRy.exe
  C:\Windows\System\pcsnoRy.exe
  2⤵
  PID:8692
- C:\Windows\System\KNpMUqf.exe
  C:\Windows\System\KNpMUqf.exe
  2⤵
  PID:9000
- C:\Windows\System\JcubeEw.exe
  C:\Windows\System\JcubeEw.exe
  2⤵
  PID:8900
- C:\Windows\System\blKDqNv.exe
  C:\Windows\System\blKDqNv.exe
  2⤵
  PID:8556
- C:\Windows\System\SfJjCsj.exe
  C:\Windows\System\SfJjCsj.exe
  2⤵
  PID:9048
- C:\Windows\System\TWrnxiS.exe
  C:\Windows\System\TWrnxiS.exe
  2⤵
  PID:8388
- C:\Windows\System\wUvtBLM.exe
  C:\Windows\System\wUvtBLM.exe
  2⤵
  PID:9040
- C:\Windows\System\YNtkrtK.exe
  C:\Windows\System\YNtkrtK.exe
  2⤵
  PID:8636
- C:\Windows\System\QWckIar.exe
  C:\Windows\System\QWckIar.exe
  2⤵
  PID:8488
- C:\Windows\System\pUyFQey.exe
  C:\Windows\System\pUyFQey.exe
  2⤵
  PID:8904
- C:\Windows\System\pJzUNFq.exe
  C:\Windows\System\pJzUNFq.exe
  2⤵
  PID:9224
- C:\Windows\System\FYuvhys.exe
  C:\Windows\System\FYuvhys.exe
  2⤵
  PID:9240
- C:\Windows\System\tobkZWb.exe
  C:\Windows\System\tobkZWb.exe
  2⤵
  PID:9268
- C:\Windows\System\jIoxniI.exe
  C:\Windows\System\jIoxniI.exe
  2⤵
  PID:9308
- C:\Windows\System\fIPnsPM.exe
  C:\Windows\System\fIPnsPM.exe
  2⤵
  PID:9328
- C:\Windows\System\XfbKDdU.exe
  C:\Windows\System\XfbKDdU.exe
  2⤵
  PID:9344
- C:\Windows\System\KZjaspj.exe
  C:\Windows\System\KZjaspj.exe
  2⤵
  PID:9368
- C:\Windows\System\BnHRuLZ.exe
  C:\Windows\System\BnHRuLZ.exe
  2⤵
  PID:9384
- C:\Windows\System\ZRRHqzU.exe
  C:\Windows\System\ZRRHqzU.exe
  2⤵
  PID:9404
- C:\Windows\System\FhsnEUS.exe
  C:\Windows\System\FhsnEUS.exe
  2⤵
  PID:9428
- C:\Windows\System\LReXxBS.exe
  C:\Windows\System\LReXxBS.exe
  2⤵
  PID:9448
- C:\Windows\System\lTRfZts.exe
  C:\Windows\System\lTRfZts.exe
  2⤵
  PID:9468
- C:\Windows\System\pQlnwAC.exe
  C:\Windows\System\pQlnwAC.exe
  2⤵
  PID:9484
- C:\Windows\System\jmcEKib.exe
  C:\Windows\System\jmcEKib.exe
  2⤵
  PID:9500
- C:\Windows\System\palsyFk.exe
  C:\Windows\System\palsyFk.exe
  2⤵
  PID:9516
- C:\Windows\System\QAdckvb.exe
  C:\Windows\System\QAdckvb.exe
  2⤵
  PID:9532
- C:\Windows\System\mAROGgU.exe
  C:\Windows\System\mAROGgU.exe
  2⤵
  PID:9548
- C:\Windows\System\EqpIQxw.exe
  C:\Windows\System\EqpIQxw.exe
  2⤵
  PID:9580
- C:\Windows\System\soCkEQB.exe
  C:\Windows\System\soCkEQB.exe
  2⤵
  PID:9612
- C:\Windows\System\UndqZsl.exe
  C:\Windows\System\UndqZsl.exe
  2⤵
  PID:9628
- C:\Windows\System\tvlCBmQ.exe
  C:\Windows\System\tvlCBmQ.exe
  2⤵
  PID:9648
- C:\Windows\System\pRJYotw.exe
  C:\Windows\System\pRJYotw.exe
  2⤵
  PID:9664
- C:\Windows\System\btxWrHn.exe
  C:\Windows\System\btxWrHn.exe
  2⤵
  PID:9696
- C:\Windows\System\YfQtzVE.exe
  C:\Windows\System\YfQtzVE.exe
  2⤵
  PID:9712
- C:\Windows\System\MSptmEt.exe
  C:\Windows\System\MSptmEt.exe
  2⤵
  PID:9728
- C:\Windows\System\HtgDKkF.exe
  C:\Windows\System\HtgDKkF.exe
  2⤵
  PID:9748
- C:\Windows\System\pzKtbwV.exe
  C:\Windows\System\pzKtbwV.exe
  2⤵
  PID:9768
- C:\Windows\System\UiDAyHK.exe
  C:\Windows\System\UiDAyHK.exe
  2⤵
  PID:9788
- C:\Windows\System\HdkYVGQ.exe
  C:\Windows\System\HdkYVGQ.exe
  2⤵
  PID:9808
- C:\Windows\System\EdTqrAN.exe
  C:\Windows\System\EdTqrAN.exe
  2⤵
  PID:9836
- C:\Windows\System\bdlMEfA.exe
  C:\Windows\System\bdlMEfA.exe
  2⤵
  PID:9856
- C:\Windows\System\konKSDB.exe
  C:\Windows\System\konKSDB.exe
  2⤵
  PID:9876
- C:\Windows\System\hbRjVlt.exe
  C:\Windows\System\hbRjVlt.exe
  2⤵
  PID:9892
- C:\Windows\System\GAevbOJ.exe
  C:\Windows\System\GAevbOJ.exe
  2⤵
  PID:9908
- C:\Windows\System\rypecbI.exe
  C:\Windows\System\rypecbI.exe
  2⤵
  PID:9924
- C:\Windows\System\SrXkDyb.exe
  C:\Windows\System\SrXkDyb.exe
  2⤵
  PID:9940
- C:\Windows\System\srYlGyO.exe
  C:\Windows\System\srYlGyO.exe
  2⤵
  PID:9956
- C:\Windows\System\EpGBWtj.exe
  C:\Windows\System\EpGBWtj.exe
  2⤵
  PID:9972
- C:\Windows\System\qvfzdAg.exe
  C:\Windows\System\qvfzdAg.exe
  2⤵
  PID:10020
- C:\Windows\System\gAvZXca.exe
  C:\Windows\System\gAvZXca.exe
  2⤵
  PID:10040
- C:\Windows\System\dMehczK.exe
  C:\Windows\System\dMehczK.exe
  2⤵
  PID:10056
- C:\Windows\System\aszkPif.exe
  C:\Windows\System\aszkPif.exe
  2⤵
  PID:10072
- C:\Windows\System\BAScubG.exe
  C:\Windows\System\BAScubG.exe
  2⤵
  PID:10092
- C:\Windows\System\iyocMBJ.exe
  C:\Windows\System\iyocMBJ.exe
  2⤵
  PID:10108
- C:\Windows\System\spMyqrA.exe
  C:\Windows\System\spMyqrA.exe
  2⤵
  PID:10124
- C:\Windows\System\PlRRyso.exe
  C:\Windows\System\PlRRyso.exe
  2⤵
  PID:10164
- C:\Windows\System\ynislJE.exe
  C:\Windows\System\ynislJE.exe
  2⤵
  PID:10184
- C:\Windows\System\QhiVxBa.exe
  C:\Windows\System\QhiVxBa.exe
  2⤵
  PID:10200
- C:\Windows\System\flkOnLb.exe
  C:\Windows\System\flkOnLb.exe
  2⤵
  PID:10216
- C:\Windows\System\HKFagms.exe
  C:\Windows\System\HKFagms.exe
  2⤵
  PID:8616
- C:\Windows\System\QdSqRdS.exe
  C:\Windows\System\QdSqRdS.exe
  2⤵
  PID:8428
- C:\Windows\System\GBwWlIN.exe
  C:\Windows\System\GBwWlIN.exe
  2⤵
  PID:9264
- C:\Windows\System\IlWYjwG.exe
  C:\Windows\System\IlWYjwG.exe
  2⤵
  PID:9292
- C:\Windows\System\qxEKcPc.exe
  C:\Windows\System\qxEKcPc.exe
  2⤵
  PID:9336
- C:\Windows\System\JIxNjjj.exe
  C:\Windows\System\JIxNjjj.exe
  2⤵
  PID:9364
- C:\Windows\System\ggGsTmO.exe
  C:\Windows\System\ggGsTmO.exe
  2⤵
  PID:9376
- C:\Windows\System\QRnqyMV.exe
  C:\Windows\System\QRnqyMV.exe
  2⤵
  PID:9444
- C:\Windows\System\peiIzEd.exe
  C:\Windows\System\peiIzEd.exe
  2⤵
  PID:9476
- C:\Windows\System\HaytRyx.exe
  C:\Windows\System\HaytRyx.exe
  2⤵
  PID:9540
- C:\Windows\System\fmWTwnW.exe
  C:\Windows\System\fmWTwnW.exe
  2⤵
  PID:9592
- C:\Windows\System\GNYzzvj.exe
  C:\Windows\System\GNYzzvj.exe
  2⤵
  PID:9556
- C:\Windows\System\SLOcTgI.exe
  C:\Windows\System\SLOcTgI.exe
  2⤵
  PID:9300
- C:\Windows\System\whDBDTL.exe
  C:\Windows\System\whDBDTL.exe
  2⤵
  PID:9624
- C:\Windows\System\Wbfkmvl.exe
  C:\Windows\System\Wbfkmvl.exe
  2⤵
  PID:9656
- C:\Windows\System\VSIdXRX.exe
  C:\Windows\System\VSIdXRX.exe
  2⤵
  PID:9692
- C:\Windows\System\MrIZhrb.exe
  C:\Windows\System\MrIZhrb.exe
  2⤵
  PID:9736
- C:\Windows\System\WMFIhdf.exe
  C:\Windows\System\WMFIhdf.exe
  2⤵
  PID:9796
- C:\Windows\System\oBFmcws.exe
  C:\Windows\System\oBFmcws.exe
  2⤵
  PID:9780
- C:\Windows\System\EmsbWJe.exe
  C:\Windows\System\EmsbWJe.exe
  2⤵
  PID:9828
- C:\Windows\System\kCWgWlq.exe
  C:\Windows\System\kCWgWlq.exe
  2⤵
  PID:9868
- C:\Windows\System\TcYuaiU.exe
  C:\Windows\System\TcYuaiU.exe
  2⤵
  PID:9920
- C:\Windows\System\DcvruOm.exe
  C:\Windows\System\DcvruOm.exe
  2⤵
  PID:9904
- C:\Windows\System\QCqdIjJ.exe
  C:\Windows\System\QCqdIjJ.exe
  2⤵
  PID:10008
- C:\Windows\System\kCaWhzU.exe
  C:\Windows\System\kCaWhzU.exe
  2⤵
  PID:10028
- C:\Windows\System\owGMzTH.exe
  C:\Windows\System\owGMzTH.exe
  2⤵
  PID:10064
- C:\Windows\System\sPWvtjd.exe
  C:\Windows\System\sPWvtjd.exe
  2⤵
  PID:10120
- C:\Windows\System\BFVlvly.exe
  C:\Windows\System\BFVlvly.exe
  2⤵
  PID:10132
- C:\Windows\System\ioiosew.exe
  C:\Windows\System\ioiosew.exe
  2⤵
  PID:9848
- C:\Windows\System\iUGDRWV.exe
  C:\Windows\System\iUGDRWV.exe
  2⤵
  PID:10196
- C:\Windows\System\xLKKldU.exe
  C:\Windows\System\xLKKldU.exe
  2⤵
  PID:10224
- C:\Windows\System\NcxcpgK.exe
  C:\Windows\System\NcxcpgK.exe
  2⤵
  PID:9256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BkQTZYH.exe

Filesize
1.4MB

MD5
3e363b90cbd44d39dd3d21cceb365fc0

SHA1
7635f0a355c5aedcba1f86fd85191b72bd8aae83

SHA256
e2e93f16cafda9d24d724a237104ffe1579785e48c5026a9f8ced2a9772bacde

SHA512
adbebb9bc2c689fed698032de7e396f3df66c73d97f94a90d6ee636b5fd0254e1d607a2a382c1ac730c865f7fbd6877db05e58cc348451f0b7134477bbc53736

Download Submit
C:\Windows\system\DHpaVGH.exe

Filesize
1.4MB

MD5
f7d2fc40389f894c7fee976b05aab845

SHA1
1275c60812173b66bfeeb1f3ed0f696b3b9c4672

SHA256
2c0cc6d164f2a8676727bc0a47788d2a663aed24a6a5ffa99b121394980edab5

SHA512
69a24233b6c224f2d281342a78946d11300b2a8dcd6643fbff4bce4cd9b1ef48d4c3d12c9441127e7c1910c3bd6a02f01b6ec6552cc71ca927b3d8727bc11910

Download Submit
C:\Windows\system\FsJXbam.exe

Filesize
1.4MB

MD5
4e080e19faecb3d537b37bcfb1fdf8dd

SHA1
89c4a91e6f5457adfa15156cc7da55d8ebe87a29

SHA256
7284bb89d54161207a87e8e1c226db1e82fccbee51c33f374156637903dbf431

SHA512
e278f7b5923ddff366d9661f93d2fa0f7f5bd572777316c0336203a130f38cced1c12b7736803f44b675f2f9e67fded0f4ea5e73651cb0225c1d6f5b93589ef4

Download Submit
C:\Windows\system\ItsnFFG.exe

Filesize
1.4MB

MD5
5a0f6d25e99c469c24a99fa4507c2fbf

SHA1
d03c07019f3e3f5ac7c8b3429d7ce350b160361f

SHA256
065d51eb280fd41400e4f2e61c1b84f7b4f051968561deec43b16c082591ee25

SHA512
58ef55639073e13cec8978446f044572dde842b27e4212acd9225c39f85208a602a260b2388a4103dc1118f780b100c71e3718353b159e802ed387f2ef53d6ee

Download Submit
C:\Windows\system\KaPPmqs.exe

Filesize
1.4MB

MD5
97f477ab04305ffaedbac6a51b9243d2

SHA1
096d83c8790938ca5e7857ff7d8b859ac8285221

SHA256
886f51c964ee5e0c9c1f9454ce5e935255aa8d58231e3f987384f28be130d11e

SHA512
ec342d7b9c08b735421869023d7e9e8777b4eeb533e92c5e06cb02e2a079ab8f245e97fa2aa68ae45e30bfce0cd9d8655f03202d0b8e7d7f7bb3957a0fe2daca

Download Submit
C:\Windows\system\MQzoIfk.exe

Filesize
1.4MB

MD5
026e5db1293859625d41278385859707

SHA1
c35c970460c1a62592ae4d55d4566b1d2f84bd35

SHA256
de0b5f9de4efd1f56c5064746f7251e305b9e7e925cb2f3fa9fea8beaf8d4731

SHA512
71816a942046becf54bf55b17f1ed3af2f8fece40e1a294c6d9dd4f1a5578a353fc4aef9a4c1e79b37afe606a440f81df60c46968c1e77526ccdd2d0d9d0037a

Download Submit
C:\Windows\system\MvlHHwi.exe

Filesize
1.4MB

MD5
f97b684f6626fcb9194bcd2269ff6e8b

SHA1
9a03e357395d6e219e1ea9c77b3e9ecf55869bcf

SHA256
6cd42b80c98daadae9c606af7b170c3f899a3a949a548a8374ad4245ae80d856

SHA512
ae2dfd4a57adcd5efb9310439c708ca4ae1a246a09379b6fa949a1162af9afbfbdb6ff85fbf7cd90cf36aaae19fe0d74ba7a7a323407d7c283a500e0ead73259

Download Submit
C:\Windows\system\Nelczgc.exe

Filesize
1.4MB

MD5
0e6c80a29d7fd6390fcc9eee505c76fb

SHA1
a6accfb827273cfcf38da074a4c43d0eb2b6b3cb

SHA256
de7a604ee6ef3ad4f5cafa5e53a8d13a673cbe7511a5ecd874f1f6391bebc356

SHA512
9c39e81bb500c8f40b949995860a1535e184e92956729505809a2c5478d64d40c0200bbe1936e94124477259c73cdc715b947bfd01d34b9f0884675d2b18540d

Download Submit
C:\Windows\system\RJbHDbP.exe

Filesize
1.4MB

MD5
6a6c3ea659632fb6b11b052909be4e03

SHA1
25404b585067d0d1524f6b90ae981bf781d17c5e

SHA256
89bef0f0a13ed227204ed75551315b83684c051b2f0f1e0e91aac57664ca285b

SHA512
a6f58ce93a8331627f55ef3a550f3e16e11d1971493c52a69400bbe65caddc1562e6d6ae156756d4674af1144f095026a48d3fdc9405ccb2e48aaa6169837ae5

Download Submit
C:\Windows\system\ROeIuEf.exe

Filesize
1.4MB

MD5
9e82375fafec0d16e325ee609bc730e6

SHA1
27e005ff82b4b42557011b7be84448cc75c382f1

SHA256
3a8eb3502c8a8f5a4a1b19d83899836c1ff2b8f9c1451ad220e740e79bcc9593

SHA512
ab78f10a053d7505214015002d1675a9ec64cc9657629f22aa3c9f2bbbaeceec565b3a8d5356eeef91381714d9cdf70eb9dd01536a470e0b8cdff1582b043f2c

Download Submit
C:\Windows\system\RTunQSA.exe

Filesize
1.4MB

MD5
53e06ff409092eef2878a59700769657

SHA1
4157c34e2561444cb02fd06b81698ae4e1157859

SHA256
1bc55b317f4fc458370a5412bf73afc1d50207e84613f8e8311fdc03fb395a82

SHA512
929cf2ac8865006dde54d8b8b6393a5ef10db46761562e99a191d2f07b68644fb9daafa634d37ebbd79e470934421c701d75d38ec06a29a67b87e024178e311a

Download Submit
C:\Windows\system\TKKAxgA.exe

Filesize
1.4MB

MD5
e3fd9fdde134c874fd44e3bbdc8ae559

SHA1
f76929d2a6fbe3b5483d5454f52f193af994d516

SHA256
b4a5351b599ed0ff1507c336281f3daa64b2581adc289cfbc6370b3ff4762935

SHA512
d1e70499febea156b1fee961c117f78d2f2e50e76245e078d9b2c8e9fccd9cab3c9d21ca847fe9a9c4a771332140360a478b274996c49e5af40daa0e6002043a

Download Submit
C:\Windows\system\TkEGyrU.exe

Filesize
1.4MB

MD5
84f48d828542374e64fb77edf3a96fe8

SHA1
edb8412e765d0fdb6c91b03f71e362fdf6f70ce5

SHA256
9e04add89ba89383011bc80ca13c3880411634d1b7cd244f651112240b8e82ac

SHA512
bf622983834f457592c2c579fa8d34f70e9495ebab69e7fa731b90f249187211e5a54a5371b6f8277e84fa5b50d8f60cbf9a91f5e95ec98d6219f71d2a74319f

Download Submit
C:\Windows\system\WNWgABE.exe

Filesize
1.4MB

MD5
b9a4f49174c3cb47c60e7e376fb3106a

SHA1
c3cbe9cf15147dc7785ff11d3a4380fea59624cd

SHA256
1dbdc9e2f715d0ab88eba0930716f2305ce5959461bf440e98360dc813350f3e

SHA512
832a19794ebd6038b3125140bf14a132374c89d55e1ac8f8beebb49d47940063a50c1dcf95b962d57c5c5ec477d52c29322613b68af2f9f78c302b7bce5eb5da

Download Submit
C:\Windows\system\WlYwQqi.exe

Filesize
1.4MB

MD5
a23ec21fa82cb75bad72c0cbabaaa7e8

SHA1
e5e92d4d61994be1be89443f7037bd8638ed073b

SHA256
b2daaaffbc76c0f8580922e500d48fa567cc99b3bde75961540eb014a9ad71bb

SHA512
ec300b9842680139e11f549f02531c2b456211c4154a7b5b3230d96944f99b1950855141b0a587b5edb144ec9eeed427dcc0016e6e5e14470bcc7598e1c1a77f

Download Submit
C:\Windows\system\XxYXsLw.exe

Filesize
1.4MB

MD5
a368aeac29b6e3496891689780dabd83

SHA1
848200048354096d6e6511e5bd5556e0c5b5edf3

SHA256
34b21dfd018f6d9322420b805559c11c714cac724d20f9a619bdbcb4dc4f9214

SHA512
68a31fc47464f1a9e5205908b94f0153573bda959e26550276759f81768b8db223553c19fece6f186352ad6797c76514ca29a9845160a0bc21f7d9891b3bbef6

Download Submit
C:\Windows\system\aMrKTLX.exe

Filesize
1.4MB

MD5
201415d1cb469f349859c3b9b004d5bc

SHA1
0e86726ea053837298898b5eeebb215f30f01f0e

SHA256
f20e307ab7d9b0c4b3b203a727b0353973d93259ebe718ec6eac07e88a120a72

SHA512
36810c9c1171ec620525c0413a339e420c713adbcb4c933ba615d1e37051738f5b57324898e13125c555bf13c0e23afd99eab804ba3d1ec6c6bedc4285fd0610

Download Submit
C:\Windows\system\fRncmZr.exe

Filesize
1.4MB

MD5
616a26c84eab24f72554c7929b106a83

SHA1
2455568ba57faefd162354bb870710b20e4f62a4

SHA256
c60111a43432236a7a6a16535d711312c982a9548f3586e550bcc7cafa205c2d

SHA512
df814063af8bcdd138c4779ed57b5eaf299de3282522cf6a32cdd4524a143308f7be196cc2dc9df9ee92d9285466fdd14f1f2a872c36c45b175bc76e502fc299

Download Submit
C:\Windows\system\iQEjwDn.exe

Filesize
1.4MB

MD5
51c680ed3a1c7132c0f26e743e86b560

SHA1
9c685f0b5399da91445e6df0238ae96f0816edda

SHA256
77a13719b5c7a7c336bc6ea3878a31ad532be28743391a33213ce8456eeb09a9

SHA512
aa611d16cc75a5789b989d2e4c84987544064f6e5aaa1b11bc5ca32c4a8192e8e071339c9b7d25afb56407699c18b2840e914487289f1ddf2897d9abd395995f

Download Submit
C:\Windows\system\jRrVnhg.exe

Filesize
1.4MB

MD5
25a84f569174dba6a105f0a7476ce157

SHA1
58b0b432f0c839c6c79416fd3ae3333c2fc4b1e0

SHA256
421a21261aac65905417f9bece1ef983f441bbf8c6fc4dd17bb06933365ae1c5

SHA512
c94a6606da22a241e2a9ca2d33892bf216489abc819ff32b30c2f1a0900e8112cee685b608102f70db973c170cc05e978669d84e58a85beba3b90f856a337741

Download Submit
C:\Windows\system\nnRBpLS.exe

Filesize
1.4MB

MD5
3501280b006a7aebd0edf0f51e904575

SHA1
661d642b3125dbced45e572149a75c49a7db671e

SHA256
8fa6feda3c458134f696a6d9ae7c895bbdc777de914e2d447914be2fb6336d47

SHA512
0848d13976f4eca79eb0950417eca0e686b7f8a16de5b07e6eb91b7d1d69f2d1a0867ff89fbd2f0bd006ff406753949cb5cedd07c9e661043740d1f6935ce449

Download Submit
C:\Windows\system\rSVYXAB.exe

Filesize
1.4MB

MD5
5127fbd20748e4018acdd08512ce0f4a

SHA1
de33f78f9c9593edbb3016ca0f718850c6f8a8b6

SHA256
a332ac7464ba7eaadba7326f1aff1ad3ee6b8d24c39b9234622447231f70d9ae

SHA512
76a6983eca3d2c04bd55f93cb255c17d002ef0a879913efc86bed2b5dc0f72f4608e2349b2732ea038e678e7cbcf475af87e53aa9d748dd8fe7645bd8d3380b9

Download Submit
C:\Windows\system\sHVfeox.exe

Filesize
1.4MB

MD5
71b053add58466479186ef0e23267ce9

SHA1
a0a2e406a9ea40b53586a3415727030ba37ab8c1

SHA256
7494b0ac4cf9390990f1bb4838662582d404d864856c91fa50d9933efe6166ae

SHA512
826d57464b16e42a3e84911105056719b908891655b1c41e08128f834a3ed2615bdafcda7282f8e3dadfe7153acaff773e80b9ac32a3f2a7739e63b995253d54

Download Submit
C:\Windows\system\tNNaQEX.exe

Filesize
1.4MB

MD5
dff24c0435a53880d5e595ec6c428c39

SHA1
21ea9a8373c3718e3e2ce53cf5a54792fe5ff59c

SHA256
3ad202c26a9ffbf9bc540856abee03b3439592bedd2d000af3da326abba4a666

SHA512
2e49514d02e6083fe8178a5e29eaecff427b5414c75eb5b47dd002d6c929121e917e9dc41526be3f3f7ac7d38d907ceac9d10aa41db18952f585c986ab87f7ac

Download Submit
C:\Windows\system\tVwPtXU.exe

Filesize
1.4MB

MD5
bd894cddebdeab5c492945d4aa51adc4

SHA1
6063a612259b4356c85363dae1999ce6d3f8be61

SHA256
9c34a1c3d74daa8f7b99d670cdb00c5b9d6d906a9befa970c5b70e133171e4ec

SHA512
db320271e1a9275bca039c81615266ed942bdee4fb8c497a995b5763217d0e5967ca22f1f27f1304794bb01944aea7902718fd197167e4c7026975bb2e425695

Download Submit
C:\Windows\system\ujiAYEg.exe

Filesize
1.4MB

MD5
dc719387115b910272750288808d61b7

SHA1
67bb9427d50804c0be9286d8e9ee7d787b3a12aa

SHA256
0bd67f1966e0b0fec2469ba776935d88dc5792906a7f2dfd298e02c200e8ce01

SHA512
91dd6531d6846d494d13a6d1b0e592669a40a9eb1b63b18e807e60f8207a7f25d6bd3b4198aaca44a819127d3d1e0590e4855e539565ca4f34b8479aa20fad84

Download Submit
C:\Windows\system\uwhbFNH.exe

Filesize
1.4MB

MD5
b6d9f78230f748c79b85438f2dda7819

SHA1
3605988266470741417930cbf0a41d9baa2f7eca

SHA256
15e179493d770e9af18d7eff5326fcc32db792f21d439b76c06b1e3762950f3d

SHA512
f49e8c4901b79945310493d71472cbe3d6c0f87599520b860ceae825621a3970b609b43845db60cf0d0f826cfbc516e27c26ad323353fa98e2e6eb97d59f9415

Download Submit
C:\Windows\system\wouePxr.exe

Filesize
1.4MB

MD5
1416f57e53d7bedc80351d6119a5719d

SHA1
bf731576045ad83697379ecd882cb970ec204027

SHA256
aab8f31dc7e18760b5607b337142709066cf905d2db96cbf8e0c59bc79254764

SHA512
7eb645075da7d3f57edbb0e473374c0f103551896eb775521be6e9e97b084a7364379fda93aae83867b1d292b720d250eee70c664f98d72f90eebc61daa82d57

Download Submit
C:\Windows\system\xTUXJSX.exe

Filesize
1.4MB

MD5
2a6c53d300255832a94963095acf246b

SHA1
9789abc11f76653a69301c6f4aa8ad68dea50272

SHA256
ddf92e54837d9d92b514b9d158f7fa015f840415c3292d1919182592ae59ea8f

SHA512
22fd01b7fb24a04c42f7b3c0c80cbc8b247ed020a75e1d00b2ec6ec6dbcc8dcbf7f12584edbcfce246aef0be53a73ebaa2bd744f548e039742ea75ae8556efd8

Download Submit
C:\Windows\system\xebyPRn.exe

Filesize
1.4MB

MD5
3961216835714c23135eb5ade2274646

SHA1
008ba12cb34ec7039f24a388a34cd0d264c18041

SHA256
320aed7907000ce55b7175b36c72287b46d6cff6ec9f71eda7f3ac97db6d6340

SHA512
49196391ff613094962ade540d1b887016603f9ad062a9f0840a07a3e76f94a3d7d1bf56e8b13c4d2283498ace4916949dcc83f27cab6828b91b6ee1afc5419a

Download Submit
C:\Windows\system\yiIIXKY.exe

Filesize
1.4MB

MD5
b5971aec54aea92caacc7d4bbb527a26

SHA1
1b34bbdaad4898ec6bee5f1fa3891d265d05c98f

SHA256
ea9988afc055df297291acfd2228b3195d89bb69aed5a554e4637c0dc0b80811

SHA512
5fff5dc423fcb32294abb7b17b2919f64f2a61d49f393fb6a7d5776816a7f7e0f07a9f18e75717217a540bf189c52cbc3a8258b3c5112d4efd0f22ff052995ba

Download Submit
\Windows\system\IFSRIVn.exe

Filesize
1.4MB

MD5
3dd7a1a276d6b4c2d558e9f7646fafce

SHA1
2b41db74a3036a2bdcc79a97ae8a3ccb5de1cb46

SHA256
ef939f21c71649c48b95b0890a9ca5acdd4d2ed3edbca21fba1bfa7a51108ff9

SHA512
667d41653e9fe6e686110b42a78b4c7ac635d74120a4a4d54b252bfc2cf1b532ba69c944420ed5fb7e708eba344cb899924c8554e3fe1311049da6770a406956

Download Submit
memory/1728-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download