xmrig | 9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af

Analysis

max time kernel
149s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
Size

1.1MB
MD5

a82d903091b887d38a05058c502096f5
SHA1

857b937671e2665a5d7d9e05c53c1c835563d101
SHA256

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af
SHA512

bee88124a594548b2b55adce49f9a183e2c3aa97516aa90487f9534e9d0cb4087af2369742e41b2e906dc59cff8aad5533607f1f6771bc84db5a5e242811b3aa
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJc+7KEdv:GezaTF8FcNkNdfE0pZ9ozttwIRxP7N1

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral1/files/0x00070000000120fc-2.dat	xmrig
behavioral1/files/0x0008000000019394-6.dat	xmrig
behavioral1/files/0x00070000000193b8-13.dat	xmrig
behavioral1/files/0x0007000000019470-17.dat	xmrig
behavioral1/files/0x0006000000019489-25.dat	xmrig
behavioral1/files/0x000600000001948c-29.dat	xmrig
behavioral1/files/0x0006000000019490-32.dat	xmrig
behavioral1/files/0x00080000000194eb-40.dat	xmrig
behavioral1/files/0x00070000000195bb-44.dat	xmrig
behavioral1/files/0x000500000001a309-49.dat	xmrig
behavioral1/files/0x000500000001a3f6-59.dat	xmrig
behavioral1/files/0x000500000001a400-74.dat	xmrig
behavioral1/files/0x000500000001a404-79.dat	xmrig
behavioral1/files/0x000500000001a459-104.dat	xmrig
behavioral1/files/0x000500000001a463-109.dat	xmrig
behavioral1/files/0x000500000001a46b-119.dat	xmrig
behavioral1/files/0x000500000001a471-135.dat	xmrig
behavioral1/files/0x000500000001a473-139.dat	xmrig
behavioral1/files/0x000500000001a479-155.dat	xmrig
behavioral1/files/0x000500000001a47b-159.dat	xmrig
behavioral1/files/0x000500000001a477-149.dat	xmrig
behavioral1/files/0x000500000001a475-145.dat	xmrig
behavioral1/files/0x000500000001a46f-129.dat	xmrig
behavioral1/files/0x000500000001a46d-125.dat	xmrig
behavioral1/files/0x000500000001a469-115.dat	xmrig
behavioral1/files/0x000500000001a457-99.dat	xmrig
behavioral1/files/0x000500000001a44f-94.dat	xmrig
behavioral1/files/0x000500000001a44d-90.dat	xmrig
behavioral1/files/0x000500000001a438-84.dat	xmrig
behavioral1/files/0x000500000001a3fd-69.dat	xmrig
behavioral1/files/0x000500000001a3f8-64.dat	xmrig
behavioral1/files/0x000500000001a3ab-54.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

KWHVXjm.exeZlrSRZT.exerbjFGmE.execAlGbPp.exerzAdJpw.exeKbSKunj.exeuActEZs.exekcpcChu.exeaEokwon.exelKfXuqT.exekhsxMhC.exeiflJkAi.exeiOLJPhp.exeBBqAKJt.exeItfdAZQ.exeBdNiFIq.exepkbnARU.exeZRRuKkl.execEVUfpR.exefYGvDOO.exenHJdWIp.exeZtxjlrY.exexnlzSmT.exePqjEshj.exePCOnJeT.exeJeWMONq.exefXPSJYG.exeyedtGko.exeawnBLCG.exeKIFUpjF.exehWeopJF.exeGAHhHZZ.exeQrYfIqF.exeMRZRjmn.exeYWMPDfx.exeNYYulIp.exeiVojJKZ.exeipMQexe.exeIpiCcBg.execYfnxTf.exeptGscQy.exeKrodROF.exeMrMnNDG.exemVcYugJ.exeKGRHUrk.exeRyPIBzQ.exeIzMtlDR.exePSiqEhv.exedfexiDP.exeEBegTuT.exeanvtgfi.exePnxIOHz.exeLLBOeNG.exeXIuNZcq.exeCCIcxON.exehPfaWzd.exeQlYvpAf.exeiRHohVn.exehvaKpNJ.exeBVIKhWj.exeCXolKsV.exeCgngjZS.execiZwWit.exeKbtMKiq.exe

pid	Process
2472	KWHVXjm.exe
2876	ZlrSRZT.exe
2984	rbjFGmE.exe
2852	cAlGbPp.exe
3008	rzAdJpw.exe
2864	KbSKunj.exe
2920	uActEZs.exe
2776	kcpcChu.exe
2860	aEokwon.exe
2744	lKfXuqT.exe
2820	khsxMhC.exe
2612	iflJkAi.exe
2380	iOLJPhp.exe
1708	BBqAKJt.exe
1140	ItfdAZQ.exe
1144	BdNiFIq.exe
2156	pkbnARU.exe
3056	ZRRuKkl.exe
2340	cEVUfpR.exe
2368	fYGvDOO.exe
3032	nHJdWIp.exe
2736	ZtxjlrY.exe
2516	xnlzSmT.exe
1640	PqjEshj.exe
692	PCOnJeT.exe
1548	JeWMONq.exe
2116	fXPSJYG.exe
2456	yedtGko.exe
2500	awnBLCG.exe
396	KIFUpjF.exe
2272	hWeopJF.exe
2212	GAHhHZZ.exe
1844	QrYfIqF.exe
560	MRZRjmn.exe
1388	YWMPDfx.exe
1992	NYYulIp.exe
1556	iVojJKZ.exe
1052	ipMQexe.exe
900	IpiCcBg.exe
792	cYfnxTf.exe
1284	ptGscQy.exe
1500	KrodROF.exe
1812	MrMnNDG.exe
1372	mVcYugJ.exe
860	KGRHUrk.exe
1128	RyPIBzQ.exe
1652	IzMtlDR.exe
1544	PSiqEhv.exe
2600	dfexiDP.exe
2384	EBegTuT.exe
2036	anvtgfi.exe
1696	PnxIOHz.exe
1152	LLBOeNG.exe
1240	XIuNZcq.exe
1804	CCIcxON.exe
1120	hPfaWzd.exe
1716	QlYvpAf.exe
1524	iRHohVn.exe
1608	hvaKpNJ.exe
2216	BVIKhWj.exe
2556	CXolKsV.exe
2872	CgngjZS.exe
2096	ciZwWit.exe
2784	KbtMKiq.exe

Loads dropped DLL 64 IoCs

Processes:

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

pid	Process
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

Drops file in Windows directory 64 IoCs

Processes:

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

description	ioc	Process
File created	C:\Windows\System\pRMsnpB.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\hvaKpNJ.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\DLMuzlX.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\IIqbxlY.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ljLauCV.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\XNixGYc.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\KLVYBmW.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\CyEaHzT.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\GyqdFlL.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ABwkhFm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\KzDZRiI.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\xefGfdi.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\uMkhqgr.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\XiKsdIb.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\KqFqaXK.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\sDNlIkF.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\frOOXjI.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\wbBbkij.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\MPacxFS.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\VhHtZQp.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\oUIbKLx.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ciGAfix.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\EJnsQMA.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\wHWeloU.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\jEPNrKw.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\uVFuuae.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\FwOhQPc.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\FepcdTH.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\hYQmmFh.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ohRnQxr.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\kWeUsYA.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\cOnooPE.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\wLeWdVC.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\dKPnvwo.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\XdZOlFe.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\PsLXgRS.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\GdndxRj.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\NiDgeee.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ITGwdue.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\AajGkQV.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\LbtVsuc.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\zWKtAWs.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\idWtHLw.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\odWWfxM.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\MxNpJKI.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\crzxOCp.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\WjRZGBV.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\lySohPN.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\dCyRWHa.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\XPKhLKm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ptjqNUB.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\QIUlLBB.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\MRZRjmn.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\rGelrtL.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\dKgcRNp.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\chHOLRc.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\pwHJUJq.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\YHnWbxz.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\izJSetT.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\jCYAPSL.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ufPpwkg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\JJnrDJR.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\RKifbys.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\WQHDEab.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

pid	Process
12948

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

description	pid	Process	procid_target
PID 2592 wrote to memory of 2472	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	31
PID 2592 wrote to memory of 2472	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	31
PID 2592 wrote to memory of 2472	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	31
PID 2592 wrote to memory of 2876	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	32
PID 2592 wrote to memory of 2876	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	32
PID 2592 wrote to memory of 2876	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	32
PID 2592 wrote to memory of 2984	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	33
PID 2592 wrote to memory of 2984	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	33
PID 2592 wrote to memory of 2984	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	33
PID 2592 wrote to memory of 2852	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	34
PID 2592 wrote to memory of 2852	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	34
PID 2592 wrote to memory of 2852	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	34
PID 2592 wrote to memory of 3008	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	35
PID 2592 wrote to memory of 3008	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	35
PID 2592 wrote to memory of 3008	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	35
PID 2592 wrote to memory of 2864	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	36
PID 2592 wrote to memory of 2864	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	36
PID 2592 wrote to memory of 2864	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	36
PID 2592 wrote to memory of 2920	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	37
PID 2592 wrote to memory of 2920	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	37
PID 2592 wrote to memory of 2920	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	37
PID 2592 wrote to memory of 2776	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	38
PID 2592 wrote to memory of 2776	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	38
PID 2592 wrote to memory of 2776	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	38
PID 2592 wrote to memory of 2860	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	39
PID 2592 wrote to memory of 2860	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	39
PID 2592 wrote to memory of 2860	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	39
PID 2592 wrote to memory of 2744	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	40
PID 2592 wrote to memory of 2744	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	40
PID 2592 wrote to memory of 2744	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	40
PID 2592 wrote to memory of 2820	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	41
PID 2592 wrote to memory of 2820	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	41
PID 2592 wrote to memory of 2820	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	41
PID 2592 wrote to memory of 2612	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	42
PID 2592 wrote to memory of 2612	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	42
PID 2592 wrote to memory of 2612	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	42
PID 2592 wrote to memory of 2380	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	43
PID 2592 wrote to memory of 2380	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	43
PID 2592 wrote to memory of 2380	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	43
PID 2592 wrote to memory of 1708	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	44
PID 2592 wrote to memory of 1708	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	44
PID 2592 wrote to memory of 1708	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	44
PID 2592 wrote to memory of 1140	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	45
PID 2592 wrote to memory of 1140	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	45
PID 2592 wrote to memory of 1140	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	45
PID 2592 wrote to memory of 1144	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	46
PID 2592 wrote to memory of 1144	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	46
PID 2592 wrote to memory of 1144	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	46
PID 2592 wrote to memory of 2156	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	47
PID 2592 wrote to memory of 2156	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	47
PID 2592 wrote to memory of 2156	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	47
PID 2592 wrote to memory of 3056	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	48
PID 2592 wrote to memory of 3056	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	48
PID 2592 wrote to memory of 3056	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	48
PID 2592 wrote to memory of 2340	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	49
PID 2592 wrote to memory of 2340	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	49
PID 2592 wrote to memory of 2340	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	49
PID 2592 wrote to memory of 2368	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	50
PID 2592 wrote to memory of 2368	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	50
PID 2592 wrote to memory of 2368	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	50
PID 2592 wrote to memory of 3032	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	51
PID 2592 wrote to memory of 3032	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	51
PID 2592 wrote to memory of 3032	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	51
PID 2592 wrote to memory of 2736	2592	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	52

C:\Users\Admin\AppData\Local\Temp\9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
"C:\Users\Admin\AppData\Local\Temp\9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System\KWHVXjm.exe
  C:\Windows\System\KWHVXjm.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ZlrSRZT.exe
  C:\Windows\System\ZlrSRZT.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rbjFGmE.exe
  C:\Windows\System\rbjFGmE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\cAlGbPp.exe
  C:\Windows\System\cAlGbPp.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\rzAdJpw.exe
  C:\Windows\System\rzAdJpw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\KbSKunj.exe
  C:\Windows\System\KbSKunj.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\uActEZs.exe
  C:\Windows\System\uActEZs.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\kcpcChu.exe
  C:\Windows\System\kcpcChu.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\aEokwon.exe
  C:\Windows\System\aEokwon.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\lKfXuqT.exe
  C:\Windows\System\lKfXuqT.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\khsxMhC.exe
  C:\Windows\System\khsxMhC.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\iflJkAi.exe
  C:\Windows\System\iflJkAi.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\iOLJPhp.exe
  C:\Windows\System\iOLJPhp.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\BBqAKJt.exe
  C:\Windows\System\BBqAKJt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ItfdAZQ.exe
  C:\Windows\System\ItfdAZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BdNiFIq.exe
  C:\Windows\System\BdNiFIq.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\pkbnARU.exe
  C:\Windows\System\pkbnARU.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ZRRuKkl.exe
  C:\Windows\System\ZRRuKkl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\cEVUfpR.exe
  C:\Windows\System\cEVUfpR.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\fYGvDOO.exe
  C:\Windows\System\fYGvDOO.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\nHJdWIp.exe
  C:\Windows\System\nHJdWIp.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ZtxjlrY.exe
  C:\Windows\System\ZtxjlrY.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\xnlzSmT.exe
  C:\Windows\System\xnlzSmT.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\PqjEshj.exe
  C:\Windows\System\PqjEshj.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\PCOnJeT.exe
  C:\Windows\System\PCOnJeT.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\JeWMONq.exe
  C:\Windows\System\JeWMONq.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\fXPSJYG.exe
  C:\Windows\System\fXPSJYG.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\yedtGko.exe
  C:\Windows\System\yedtGko.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\awnBLCG.exe
  C:\Windows\System\awnBLCG.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\KIFUpjF.exe
  C:\Windows\System\KIFUpjF.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\hWeopJF.exe
  C:\Windows\System\hWeopJF.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\GAHhHZZ.exe
  C:\Windows\System\GAHhHZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\QrYfIqF.exe
  C:\Windows\System\QrYfIqF.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\MRZRjmn.exe
  C:\Windows\System\MRZRjmn.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\YWMPDfx.exe
  C:\Windows\System\YWMPDfx.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\NYYulIp.exe
  C:\Windows\System\NYYulIp.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\iVojJKZ.exe
  C:\Windows\System\iVojJKZ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ipMQexe.exe
  C:\Windows\System\ipMQexe.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\IpiCcBg.exe
  C:\Windows\System\IpiCcBg.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\cYfnxTf.exe
  C:\Windows\System\cYfnxTf.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ptGscQy.exe
  C:\Windows\System\ptGscQy.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\KrodROF.exe
  C:\Windows\System\KrodROF.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\MrMnNDG.exe
  C:\Windows\System\MrMnNDG.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\mVcYugJ.exe
  C:\Windows\System\mVcYugJ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\KGRHUrk.exe
  C:\Windows\System\KGRHUrk.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\RyPIBzQ.exe
  C:\Windows\System\RyPIBzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\IzMtlDR.exe
  C:\Windows\System\IzMtlDR.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\PSiqEhv.exe
  C:\Windows\System\PSiqEhv.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\dfexiDP.exe
  C:\Windows\System\dfexiDP.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\EBegTuT.exe
  C:\Windows\System\EBegTuT.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\anvtgfi.exe
  C:\Windows\System\anvtgfi.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\PnxIOHz.exe
  C:\Windows\System\PnxIOHz.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\LLBOeNG.exe
  C:\Windows\System\LLBOeNG.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\XIuNZcq.exe
  C:\Windows\System\XIuNZcq.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\CCIcxON.exe
  C:\Windows\System\CCIcxON.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\QlYvpAf.exe
  C:\Windows\System\QlYvpAf.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\hPfaWzd.exe
  C:\Windows\System\hPfaWzd.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\iRHohVn.exe
  C:\Windows\System\iRHohVn.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\hvaKpNJ.exe
  C:\Windows\System\hvaKpNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\BVIKhWj.exe
  C:\Windows\System\BVIKhWj.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\CXolKsV.exe
  C:\Windows\System\CXolKsV.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\CgngjZS.exe
  C:\Windows\System\CgngjZS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ciZwWit.exe
  C:\Windows\System\ciZwWit.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\KbtMKiq.exe
  C:\Windows\System\KbtMKiq.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\nxXdHYQ.exe
  C:\Windows\System\nxXdHYQ.exe
  2⤵
  PID:2168
- C:\Windows\System\ElyXzad.exe
  C:\Windows\System\ElyXzad.exe
  2⤵
  PID:2884
- C:\Windows\System\mNdnfFB.exe
  C:\Windows\System\mNdnfFB.exe
  2⤵
  PID:2768
- C:\Windows\System\HEdyIkQ.exe
  C:\Windows\System\HEdyIkQ.exe
  2⤵
  PID:2180
- C:\Windows\System\KhREyYw.exe
  C:\Windows\System\KhREyYw.exe
  2⤵
  PID:2560
- C:\Windows\System\ocxQjac.exe
  C:\Windows\System\ocxQjac.exe
  2⤵
  PID:984
- C:\Windows\System\NdaydHW.exe
  C:\Windows\System\NdaydHW.exe
  2⤵
  PID:2756
- C:\Windows\System\QqJUwRR.exe
  C:\Windows\System\QqJUwRR.exe
  2⤵
  PID:2196
- C:\Windows\System\noLZOLg.exe
  C:\Windows\System\noLZOLg.exe
  2⤵
  PID:2128
- C:\Windows\System\lohYUKE.exe
  C:\Windows\System\lohYUKE.exe
  2⤵
  PID:1980
- C:\Windows\System\SwanSOp.exe
  C:\Windows\System\SwanSOp.exe
  2⤵
  PID:2808
- C:\Windows\System\JMlmsKq.exe
  C:\Windows\System\JMlmsKq.exe
  2⤵
  PID:308
- C:\Windows\System\LUnjyek.exe
  C:\Windows\System\LUnjyek.exe
  2⤵
  PID:2932
- C:\Windows\System\PRjWfQL.exe
  C:\Windows\System\PRjWfQL.exe
  2⤵
  PID:1176
- C:\Windows\System\UopAuib.exe
  C:\Windows\System\UopAuib.exe
  2⤵
  PID:2804
- C:\Windows\System\DCPzGxX.exe
  C:\Windows\System\DCPzGxX.exe
  2⤵
  PID:2464
- C:\Windows\System\kNqBDKO.exe
  C:\Windows\System\kNqBDKO.exe
  2⤵
  PID:2484
- C:\Windows\System\CaEYQHf.exe
  C:\Windows\System\CaEYQHf.exe
  2⤵
  PID:2568
- C:\Windows\System\HTRIVgp.exe
  C:\Windows\System\HTRIVgp.exe
  2⤵
  PID:2520
- C:\Windows\System\aEzTVlo.exe
  C:\Windows\System\aEzTVlo.exe
  2⤵
  PID:1960
- C:\Windows\System\qUBTmFM.exe
  C:\Windows\System\qUBTmFM.exe
  2⤵
  PID:320
- C:\Windows\System\pHTakOx.exe
  C:\Windows\System\pHTakOx.exe
  2⤵
  PID:780
- C:\Windows\System\WeXyDJq.exe
  C:\Windows\System\WeXyDJq.exe
  2⤵
  PID:1668
- C:\Windows\System\uUblUAG.exe
  C:\Windows\System\uUblUAG.exe
  2⤵
  PID:2056
- C:\Windows\System\qkVsfyJ.exe
  C:\Windows\System\qkVsfyJ.exe
  2⤵
  PID:1748
- C:\Windows\System\hFByBxw.exe
  C:\Windows\System\hFByBxw.exe
  2⤵
  PID:2388
- C:\Windows\System\lnSJHht.exe
  C:\Windows\System\lnSJHht.exe
  2⤵
  PID:2100
- C:\Windows\System\ZtJAOrN.exe
  C:\Windows\System\ZtJAOrN.exe
  2⤵
  PID:1192
- C:\Windows\System\ZWKmNJi.exe
  C:\Windows\System\ZWKmNJi.exe
  2⤵
  PID:112
- C:\Windows\System\OzfMSAF.exe
  C:\Windows\System\OzfMSAF.exe
  2⤵
  PID:2316
- C:\Windows\System\IqLRAyD.exe
  C:\Windows\System\IqLRAyD.exe
  2⤵
  PID:2024
- C:\Windows\System\uwwCinO.exe
  C:\Windows\System\uwwCinO.exe
  2⤵
  PID:2660
- C:\Windows\System\DkBpDVZ.exe
  C:\Windows\System\DkBpDVZ.exe
  2⤵
  PID:2676
- C:\Windows\System\ZQeYCrH.exe
  C:\Windows\System\ZQeYCrH.exe
  2⤵
  PID:1664
- C:\Windows\System\RKErMVB.exe
  C:\Windows\System\RKErMVB.exe
  2⤵
  PID:2684
- C:\Windows\System\eJRzFOL.exe
  C:\Windows\System\eJRzFOL.exe
  2⤵
  PID:884
- C:\Windows\System\ynwbBLi.exe
  C:\Windows\System\ynwbBLi.exe
  2⤵
  PID:2580
- C:\Windows\System\THcAFCV.exe
  C:\Windows\System\THcAFCV.exe
  2⤵
  PID:2420
- C:\Windows\System\XcSaXyW.exe
  C:\Windows\System\XcSaXyW.exe
  2⤵
  PID:2408
- C:\Windows\System\oMNCPqp.exe
  C:\Windows\System\oMNCPqp.exe
  2⤵
  PID:1604
- C:\Windows\System\OcfJHfO.exe
  C:\Windows\System\OcfJHfO.exe
  2⤵
  PID:2584
- C:\Windows\System\jVOriUL.exe
  C:\Windows\System\jVOriUL.exe
  2⤵
  PID:1108
- C:\Windows\System\UyOlZap.exe
  C:\Windows\System\UyOlZap.exe
  2⤵
  PID:1468
- C:\Windows\System\uxPYruJ.exe
  C:\Windows\System\uxPYruJ.exe
  2⤵
  PID:1536
- C:\Windows\System\KCrambH.exe
  C:\Windows\System\KCrambH.exe
  2⤵
  PID:2944
- C:\Windows\System\iVmNDyX.exe
  C:\Windows\System\iVmNDyX.exe
  2⤵
  PID:2144
- C:\Windows\System\nzbKyTC.exe
  C:\Windows\System\nzbKyTC.exe
  2⤵
  PID:964
- C:\Windows\System\OXQogSd.exe
  C:\Windows\System\OXQogSd.exe
  2⤵
  PID:2752
- C:\Windows\System\eWyVDqH.exe
  C:\Windows\System\eWyVDqH.exe
  2⤵
  PID:1072
- C:\Windows\System\ogLEMcB.exe
  C:\Windows\System\ogLEMcB.exe
  2⤵
  PID:2604
- C:\Windows\System\QMMoaJl.exe
  C:\Windows\System\QMMoaJl.exe
  2⤵
  PID:1624
- C:\Windows\System\QEbybsq.exe
  C:\Windows\System\QEbybsq.exe
  2⤵
  PID:2204
- C:\Windows\System\cAchYvO.exe
  C:\Windows\System\cAchYvO.exe
  2⤵
  PID:3036
- C:\Windows\System\OcVajlQ.exe
  C:\Windows\System\OcVajlQ.exe
  2⤵
  PID:2836
- C:\Windows\System\FIdbrgD.exe
  C:\Windows\System\FIdbrgD.exe
  2⤵
  PID:2504
- C:\Windows\System\KpByOld.exe
  C:\Windows\System\KpByOld.exe
  2⤵
  PID:2656
- C:\Windows\System\QlcGIjS.exe
  C:\Windows\System\QlcGIjS.exe
  2⤵
  PID:2220
- C:\Windows\System\IoCXuSD.exe
  C:\Windows\System\IoCXuSD.exe
  2⤵
  PID:2304
- C:\Windows\System\neBdFsO.exe
  C:\Windows\System\neBdFsO.exe
  2⤵
  PID:2252
- C:\Windows\System\AbPQiNj.exe
  C:\Windows\System\AbPQiNj.exe
  2⤵
  PID:980
- C:\Windows\System\FvNJoyP.exe
  C:\Windows\System\FvNJoyP.exe
  2⤵
  PID:2532
- C:\Windows\System\rCrItFd.exe
  C:\Windows\System\rCrItFd.exe
  2⤵
  PID:2084
- C:\Windows\System\FXPbBZd.exe
  C:\Windows\System\FXPbBZd.exe
  2⤵
  PID:236
- C:\Windows\System\jrFZHgY.exe
  C:\Windows\System\jrFZHgY.exe
  2⤵
  PID:1380
- C:\Windows\System\svRixmh.exe
  C:\Windows\System\svRixmh.exe
  2⤵
  PID:1216
- C:\Windows\System\peBpGpJ.exe
  C:\Windows\System\peBpGpJ.exe
  2⤵
  PID:2668
- C:\Windows\System\HebCEeB.exe
  C:\Windows\System\HebCEeB.exe
  2⤵
  PID:432
- C:\Windows\System\ufPpwkg.exe
  C:\Windows\System\ufPpwkg.exe
  2⤵
  PID:2360
- C:\Windows\System\uzhAday.exe
  C:\Windows\System\uzhAday.exe
  2⤵
  PID:3060
- C:\Windows\System\zPeRmtg.exe
  C:\Windows\System\zPeRmtg.exe
  2⤵
  PID:2396
- C:\Windows\System\gblqZsT.exe
  C:\Windows\System\gblqZsT.exe
  2⤵
  PID:1312
- C:\Windows\System\QstBKCm.exe
  C:\Windows\System\QstBKCm.exe
  2⤵
  PID:2840
- C:\Windows\System\PWfyqLs.exe
  C:\Windows\System\PWfyqLs.exe
  2⤵
  PID:2892
- C:\Windows\System\EvjOXMm.exe
  C:\Windows\System\EvjOXMm.exe
  2⤵
  PID:2960
- C:\Windows\System\GvAlxmg.exe
  C:\Windows\System\GvAlxmg.exe
  2⤵
  PID:2112
- C:\Windows\System\iaeRnoW.exe
  C:\Windows\System\iaeRnoW.exe
  2⤵
  PID:2596
- C:\Windows\System\SjqpVGB.exe
  C:\Windows\System\SjqpVGB.exe
  2⤵
  PID:640
- C:\Windows\System\EHNiXoy.exe
  C:\Windows\System\EHNiXoy.exe
  2⤵
  PID:3064
- C:\Windows\System\VddKdQZ.exe
  C:\Windows\System\VddKdQZ.exe
  2⤵
  PID:1116
- C:\Windows\System\kPUaIvi.exe
  C:\Windows\System\kPUaIvi.exe
  2⤵
  PID:2508
- C:\Windows\System\rIXvUEo.exe
  C:\Windows\System\rIXvUEo.exe
  2⤵
  PID:612
- C:\Windows\System\yPXamln.exe
  C:\Windows\System\yPXamln.exe
  2⤵
  PID:2060
- C:\Windows\System\lfxhLCi.exe
  C:\Windows\System\lfxhLCi.exe
  2⤵
  PID:2640
- C:\Windows\System\tWamJYV.exe
  C:\Windows\System\tWamJYV.exe
  2⤵
  PID:836
- C:\Windows\System\ZRwLmAB.exe
  C:\Windows\System\ZRwLmAB.exe
  2⤵
  PID:2436
- C:\Windows\System\SzTJuxJ.exe
  C:\Windows\System\SzTJuxJ.exe
  2⤵
  PID:2012
- C:\Windows\System\lrSJekF.exe
  C:\Windows\System\lrSJekF.exe
  2⤵
  PID:1156
- C:\Windows\System\EmGCusn.exe
  C:\Windows\System\EmGCusn.exe
  2⤵
  PID:1132
- C:\Windows\System\GJZPzmi.exe
  C:\Windows\System\GJZPzmi.exe
  2⤵
  PID:2936
- C:\Windows\System\HhsCMjc.exe
  C:\Windows\System\HhsCMjc.exe
  2⤵
  PID:1968
- C:\Windows\System\tyJRPAm.exe
  C:\Windows\System\tyJRPAm.exe
  2⤵
  PID:3012
- C:\Windows\System\lOnWdym.exe
  C:\Windows\System\lOnWdym.exe
  2⤵
  PID:2176
- C:\Windows\System\zxNlDfL.exe
  C:\Windows\System\zxNlDfL.exe
  2⤵
  PID:2372
- C:\Windows\System\XcZfpZY.exe
  C:\Windows\System\XcZfpZY.exe
  2⤵
  PID:2544
- C:\Windows\System\vtWdvIK.exe
  C:\Windows\System\vtWdvIK.exe
  2⤵
  PID:2608
- C:\Windows\System\AohbKvs.exe
  C:\Windows\System\AohbKvs.exe
  2⤵
  PID:2152
- C:\Windows\System\CPHHVtB.exe
  C:\Windows\System\CPHHVtB.exe
  2⤵
  PID:2996
- C:\Windows\System\KPvRdZa.exe
  C:\Windows\System\KPvRdZa.exe
  2⤵
  PID:2300
- C:\Windows\System\qGANyVH.exe
  C:\Windows\System\qGANyVH.exe
  2⤵
  PID:1384
- C:\Windows\System\XZTwsps.exe
  C:\Windows\System\XZTwsps.exe
  2⤵
  PID:1480
- C:\Windows\System\QhAwqVU.exe
  C:\Windows\System\QhAwqVU.exe
  2⤵
  PID:2980
- C:\Windows\System\YLKOLLP.exe
  C:\Windows\System\YLKOLLP.exe
  2⤵
  PID:2968
- C:\Windows\System\qmkNMEX.exe
  C:\Windows\System\qmkNMEX.exe
  2⤵
  PID:2188
- C:\Windows\System\bUGupTM.exe
  C:\Windows\System\bUGupTM.exe
  2⤵
  PID:3052
- C:\Windows\System\TWalUOq.exe
  C:\Windows\System\TWalUOq.exe
  2⤵
  PID:2104
- C:\Windows\System\MUAuDLO.exe
  C:\Windows\System\MUAuDLO.exe
  2⤵
  PID:2200
- C:\Windows\System\ZBUMrWu.exe
  C:\Windows\System\ZBUMrWu.exe
  2⤵
  PID:1552
- C:\Windows\System\infzQAI.exe
  C:\Windows\System\infzQAI.exe
  2⤵
  PID:1572
- C:\Windows\System\MTwbORW.exe
  C:\Windows\System\MTwbORW.exe
  2⤵
  PID:2444
- C:\Windows\System\YjEJxmp.exe
  C:\Windows\System\YjEJxmp.exe
  2⤵
  PID:1616
- C:\Windows\System\XBjOVSu.exe
  C:\Windows\System\XBjOVSu.exe
  2⤵
  PID:2284
- C:\Windows\System\kIlUgWU.exe
  C:\Windows\System\kIlUgWU.exe
  2⤵
  PID:1084
- C:\Windows\System\PeoYAym.exe
  C:\Windows\System\PeoYAym.exe
  2⤵
  PID:2976
- C:\Windows\System\DLMuzlX.exe
  C:\Windows\System\DLMuzlX.exe
  2⤵
  PID:1700
- C:\Windows\System\lCaYFiR.exe
  C:\Windows\System\lCaYFiR.exe
  2⤵
  PID:3076
- C:\Windows\System\lbqSXht.exe
  C:\Windows\System\lbqSXht.exe
  2⤵
  PID:3092
- C:\Windows\System\oZDRzII.exe
  C:\Windows\System\oZDRzII.exe
  2⤵
  PID:3108
- C:\Windows\System\GJCDAOz.exe
  C:\Windows\System\GJCDAOz.exe
  2⤵
  PID:3132
- C:\Windows\System\fofMUvW.exe
  C:\Windows\System\fofMUvW.exe
  2⤵
  PID:3148
- C:\Windows\System\XByOXMk.exe
  C:\Windows\System\XByOXMk.exe
  2⤵
  PID:3168
- C:\Windows\System\shjlarz.exe
  C:\Windows\System\shjlarz.exe
  2⤵
  PID:3196
- C:\Windows\System\gcYDsNz.exe
  C:\Windows\System\gcYDsNz.exe
  2⤵
  PID:3220
- C:\Windows\System\JmgNLQo.exe
  C:\Windows\System\JmgNLQo.exe
  2⤵
  PID:3240
- C:\Windows\System\kbPyKYI.exe
  C:\Windows\System\kbPyKYI.exe
  2⤵
  PID:3264
- C:\Windows\System\ubyjSPM.exe
  C:\Windows\System\ubyjSPM.exe
  2⤵
  PID:3280
- C:\Windows\System\EWJKmqI.exe
  C:\Windows\System\EWJKmqI.exe
  2⤵
  PID:3304
- C:\Windows\System\LDnkmRh.exe
  C:\Windows\System\LDnkmRh.exe
  2⤵
  PID:3320
- C:\Windows\System\HoOAlVD.exe
  C:\Windows\System\HoOAlVD.exe
  2⤵
  PID:3344
- C:\Windows\System\xjgleUf.exe
  C:\Windows\System\xjgleUf.exe
  2⤵
  PID:3360
- C:\Windows\System\sbgkyWW.exe
  C:\Windows\System\sbgkyWW.exe
  2⤵
  PID:3384
- C:\Windows\System\iMszKZl.exe
  C:\Windows\System\iMszKZl.exe
  2⤵
  PID:3400
- C:\Windows\System\JYawCJH.exe
  C:\Windows\System\JYawCJH.exe
  2⤵
  PID:3424
- C:\Windows\System\OdRlkyJ.exe
  C:\Windows\System\OdRlkyJ.exe
  2⤵
  PID:3440
- C:\Windows\System\PghNjYI.exe
  C:\Windows\System\PghNjYI.exe
  2⤵
  PID:3464
- C:\Windows\System\QIpQfmw.exe
  C:\Windows\System\QIpQfmw.exe
  2⤵
  PID:3480
- C:\Windows\System\BmccQuc.exe
  C:\Windows\System\BmccQuc.exe
  2⤵
  PID:3504
- C:\Windows\System\VzMCpyw.exe
  C:\Windows\System\VzMCpyw.exe
  2⤵
  PID:3524
- C:\Windows\System\GZgdXci.exe
  C:\Windows\System\GZgdXci.exe
  2⤵
  PID:3544
- C:\Windows\System\tCSVZgW.exe
  C:\Windows\System\tCSVZgW.exe
  2⤵
  PID:3560
- C:\Windows\System\rfJUZWV.exe
  C:\Windows\System\rfJUZWV.exe
  2⤵
  PID:3584
- C:\Windows\System\ghRZxvP.exe
  C:\Windows\System\ghRZxvP.exe
  2⤵
  PID:3600
- C:\Windows\System\bUFidAU.exe
  C:\Windows\System\bUFidAU.exe
  2⤵
  PID:3624
- C:\Windows\System\TQCUwJv.exe
  C:\Windows\System\TQCUwJv.exe
  2⤵
  PID:3640
- C:\Windows\System\PZmxabT.exe
  C:\Windows\System\PZmxabT.exe
  2⤵
  PID:3664
- C:\Windows\System\ryJorGh.exe
  C:\Windows\System\ryJorGh.exe
  2⤵
  PID:3680
- C:\Windows\System\EkaCQxB.exe
  C:\Windows\System\EkaCQxB.exe
  2⤵
  PID:3704
- C:\Windows\System\JDMIKmm.exe
  C:\Windows\System\JDMIKmm.exe
  2⤵
  PID:3720
- C:\Windows\System\BHXFcPC.exe
  C:\Windows\System\BHXFcPC.exe
  2⤵
  PID:3744
- C:\Windows\System\KeSTTGv.exe
  C:\Windows\System\KeSTTGv.exe
  2⤵
  PID:3760
- C:\Windows\System\kuFfiQl.exe
  C:\Windows\System\kuFfiQl.exe
  2⤵
  PID:3784
- C:\Windows\System\EbPCMiL.exe
  C:\Windows\System\EbPCMiL.exe
  2⤵
  PID:3804
- C:\Windows\System\cUphrGR.exe
  C:\Windows\System\cUphrGR.exe
  2⤵
  PID:3824
- C:\Windows\System\nEfehLX.exe
  C:\Windows\System\nEfehLX.exe
  2⤵
  PID:3840
- C:\Windows\System\NNCOEHt.exe
  C:\Windows\System\NNCOEHt.exe
  2⤵
  PID:3864
- C:\Windows\System\gWryGeZ.exe
  C:\Windows\System\gWryGeZ.exe
  2⤵
  PID:3880
- C:\Windows\System\NiDgeee.exe
  C:\Windows\System\NiDgeee.exe
  2⤵
  PID:3904
- C:\Windows\System\kvYBKri.exe
  C:\Windows\System\kvYBKri.exe
  2⤵
  PID:3920
- C:\Windows\System\JjKqTCX.exe
  C:\Windows\System\JjKqTCX.exe
  2⤵
  PID:3944
- C:\Windows\System\XVGwMJL.exe
  C:\Windows\System\XVGwMJL.exe
  2⤵
  PID:3960
- C:\Windows\System\JhRiGsg.exe
  C:\Windows\System\JhRiGsg.exe
  2⤵
  PID:3992
- C:\Windows\System\ebvMdNI.exe
  C:\Windows\System\ebvMdNI.exe
  2⤵
  PID:4016
- C:\Windows\System\YmcrJFu.exe
  C:\Windows\System\YmcrJFu.exe
  2⤵
  PID:4036
- C:\Windows\System\UVfIUvD.exe
  C:\Windows\System\UVfIUvD.exe
  2⤵
  PID:4056
- C:\Windows\System\hrDEeIw.exe
  C:\Windows\System\hrDEeIw.exe
  2⤵
  PID:4076
- C:\Windows\System\tjotTmA.exe
  C:\Windows\System\tjotTmA.exe
  2⤵
  PID:1928
- C:\Windows\System\OBZEscB.exe
  C:\Windows\System\OBZEscB.exe
  2⤵
  PID:2664
- C:\Windows\System\uSsLbyA.exe
  C:\Windows\System\uSsLbyA.exe
  2⤵
  PID:3140
- C:\Windows\System\oRvvolp.exe
  C:\Windows\System\oRvvolp.exe
  2⤵
  PID:3120
- C:\Windows\System\tZCVVym.exe
  C:\Windows\System\tZCVVym.exe
  2⤵
  PID:3164
- C:\Windows\System\GHxqlgD.exe
  C:\Windows\System\GHxqlgD.exe
  2⤵
  PID:3188
- C:\Windows\System\WwGkYdk.exe
  C:\Windows\System\WwGkYdk.exe
  2⤵
  PID:3228
- C:\Windows\System\nHphbKv.exe
  C:\Windows\System\nHphbKv.exe
  2⤵
  PID:3256
- C:\Windows\System\aXlSaeU.exe
  C:\Windows\System\aXlSaeU.exe
  2⤵
  PID:3296
- C:\Windows\System\PGGkBOe.exe
  C:\Windows\System\PGGkBOe.exe
  2⤵
  PID:3328
- C:\Windows\System\fJpUKWd.exe
  C:\Windows\System\fJpUKWd.exe
  2⤵
  PID:3356
- C:\Windows\System\ROyckXm.exe
  C:\Windows\System\ROyckXm.exe
  2⤵
  PID:3392
- C:\Windows\System\RAPPCWh.exe
  C:\Windows\System\RAPPCWh.exe
  2⤵
  PID:3416
- C:\Windows\System\kCYwyow.exe
  C:\Windows\System\kCYwyow.exe
  2⤵
  PID:3460
- C:\Windows\System\VczJMtL.exe
  C:\Windows\System\VczJMtL.exe
  2⤵
  PID:3500
- C:\Windows\System\fxHiteY.exe
  C:\Windows\System\fxHiteY.exe
  2⤵
  PID:3520
- C:\Windows\System\CLNqjCb.exe
  C:\Windows\System\CLNqjCb.exe
  2⤵
  PID:3552
- C:\Windows\System\ZdtSXHI.exe
  C:\Windows\System\ZdtSXHI.exe
  2⤵
  PID:3592
- C:\Windows\System\nLziHCk.exe
  C:\Windows\System\nLziHCk.exe
  2⤵
  PID:3620
- C:\Windows\System\DFfXlWR.exe
  C:\Windows\System\DFfXlWR.exe
  2⤵
  PID:3660
- C:\Windows\System\tXIvCAM.exe
  C:\Windows\System\tXIvCAM.exe
  2⤵
  PID:3688
- C:\Windows\System\mkyQeCy.exe
  C:\Windows\System\mkyQeCy.exe
  2⤵
  PID:3728
- C:\Windows\System\NqeXNmv.exe
  C:\Windows\System\NqeXNmv.exe
  2⤵
  PID:3756
- C:\Windows\System\EeFflTz.exe
  C:\Windows\System\EeFflTz.exe
  2⤵
  PID:3772
- C:\Windows\System\OYvJZWV.exe
  C:\Windows\System\OYvJZWV.exe
  2⤵
  PID:3820
- C:\Windows\System\mEscdTP.exe
  C:\Windows\System\mEscdTP.exe
  2⤵
  PID:3832
- C:\Windows\System\pdQBLUl.exe
  C:\Windows\System\pdQBLUl.exe
  2⤵
  PID:3860
- C:\Windows\System\ZQCfEEH.exe
  C:\Windows\System\ZQCfEEH.exe
  2⤵
  PID:3896
- C:\Windows\System\blwXKpk.exe
  C:\Windows\System\blwXKpk.exe
  2⤵
  PID:3916
- C:\Windows\System\CwOlOah.exe
  C:\Windows\System\CwOlOah.exe
  2⤵
  PID:3932
- C:\Windows\System\wqRgUOs.exe
  C:\Windows\System\wqRgUOs.exe
  2⤵
  PID:3980
- C:\Windows\System\xrSZbCV.exe
  C:\Windows\System\xrSZbCV.exe
  2⤵
  PID:3976
- C:\Windows\System\sXcsPAJ.exe
  C:\Windows\System\sXcsPAJ.exe
  2⤵
  PID:4024
- C:\Windows\System\bTRMDbM.exe
  C:\Windows\System\bTRMDbM.exe
  2⤵
  PID:4048
- C:\Windows\System\dLvCEwJ.exe
  C:\Windows\System\dLvCEwJ.exe
  2⤵
  PID:4092
- C:\Windows\System\WICDzEj.exe
  C:\Windows\System\WICDzEj.exe
  2⤵
  PID:3020
- C:\Windows\System\LlrhHis.exe
  C:\Windows\System\LlrhHis.exe
  2⤵
  PID:3116
- C:\Windows\System\ywJGXDE.exe
  C:\Windows\System\ywJGXDE.exe
  2⤵
  PID:3156
- C:\Windows\System\HlfJNPx.exe
  C:\Windows\System\HlfJNPx.exe
  2⤵
  PID:3180
- C:\Windows\System\gWOqqoL.exe
  C:\Windows\System\gWOqqoL.exe
  2⤵
  PID:3276
- C:\Windows\System\hkIyxKT.exe
  C:\Windows\System\hkIyxKT.exe
  2⤵
  PID:3352
- C:\Windows\System\eKDRWIh.exe
  C:\Windows\System\eKDRWIh.exe
  2⤵
  PID:3408
- C:\Windows\System\JFcUlPh.exe
  C:\Windows\System\JFcUlPh.exe
  2⤵
  PID:3448
- C:\Windows\System\ZGzCxGJ.exe
  C:\Windows\System\ZGzCxGJ.exe
  2⤵
  PID:3536
- C:\Windows\System\DVRsVbC.exe
  C:\Windows\System\DVRsVbC.exe
  2⤵
  PID:4012
- C:\Windows\System\FhUnHbs.exe
  C:\Windows\System\FhUnHbs.exe
  2⤵
  PID:3676
- C:\Windows\System\kKbASzu.exe
  C:\Windows\System\kKbASzu.exe
  2⤵
  PID:3712
- C:\Windows\System\tNFalea.exe
  C:\Windows\System\tNFalea.exe
  2⤵
  PID:3856
- C:\Windows\System\qXFVxJz.exe
  C:\Windows\System\qXFVxJz.exe
  2⤵
  PID:3968
- C:\Windows\System\mqBAInF.exe
  C:\Windows\System\mqBAInF.exe
  2⤵
  PID:4072
- C:\Windows\System\IIqbxlY.exe
  C:\Windows\System\IIqbxlY.exe
  2⤵
  PID:3088
- C:\Windows\System\nasoavF.exe
  C:\Windows\System\nasoavF.exe
  2⤵
  PID:3184
- C:\Windows\System\kdTsjvr.exe
  C:\Windows\System\kdTsjvr.exe
  2⤵
  PID:3456
- C:\Windows\System\wdcUVRp.exe
  C:\Windows\System\wdcUVRp.exe
  2⤵
  PID:3580
- C:\Windows\System\teagnRa.exe
  C:\Windows\System\teagnRa.exe
  2⤵
  PID:3936
- C:\Windows\System\RfoIyhl.exe
  C:\Windows\System\RfoIyhl.exe
  2⤵
  PID:4052
- C:\Windows\System\vKrCdxy.exe
  C:\Windows\System\vKrCdxy.exe
  2⤵
  PID:3128
- C:\Windows\System\XAonozN.exe
  C:\Windows\System\XAonozN.exe
  2⤵
  PID:3332
- C:\Windows\System\wUcDLLJ.exe
  C:\Windows\System\wUcDLLJ.exe
  2⤵
  PID:3512
- C:\Windows\System\ZNFujcx.exe
  C:\Windows\System\ZNFujcx.exe
  2⤵
  PID:3716
- C:\Windows\System\eOwDYdC.exe
  C:\Windows\System\eOwDYdC.exe
  2⤵
  PID:4068
- C:\Windows\System\uVIehwA.exe
  C:\Windows\System\uVIehwA.exe
  2⤵
  PID:3876
- C:\Windows\System\ahGUHrA.exe
  C:\Windows\System\ahGUHrA.exe
  2⤵
  PID:3488
- C:\Windows\System\rfwTKXZ.exe
  C:\Windows\System\rfwTKXZ.exe
  2⤵
  PID:3956
- C:\Windows\System\cKHQxRN.exe
  C:\Windows\System\cKHQxRN.exe
  2⤵
  PID:2724
- C:\Windows\System\cpuwshq.exe
  C:\Windows\System\cpuwshq.exe
  2⤵
  PID:3692
- C:\Windows\System\TfFVdgF.exe
  C:\Windows\System\TfFVdgF.exe
  2⤵
  PID:4116
- C:\Windows\System\DNfhHun.exe
  C:\Windows\System\DNfhHun.exe
  2⤵
  PID:4164
- C:\Windows\System\zvczsKV.exe
  C:\Windows\System\zvczsKV.exe
  2⤵
  PID:4180
- C:\Windows\System\UKSTYYW.exe
  C:\Windows\System\UKSTYYW.exe
  2⤵
  PID:4200
- C:\Windows\System\lnXJjSg.exe
  C:\Windows\System\lnXJjSg.exe
  2⤵
  PID:4220
- C:\Windows\System\RhkatQe.exe
  C:\Windows\System\RhkatQe.exe
  2⤵
  PID:4236
- C:\Windows\System\iAJtqsD.exe
  C:\Windows\System\iAJtqsD.exe
  2⤵
  PID:4256
- C:\Windows\System\WsXDXeE.exe
  C:\Windows\System\WsXDXeE.exe
  2⤵
  PID:4276
- C:\Windows\System\zgEjeJF.exe
  C:\Windows\System\zgEjeJF.exe
  2⤵
  PID:4292
- C:\Windows\System\ozPNeXx.exe
  C:\Windows\System\ozPNeXx.exe
  2⤵
  PID:4308
- C:\Windows\System\MBkJEuo.exe
  C:\Windows\System\MBkJEuo.exe
  2⤵
  PID:4336
- C:\Windows\System\QxcLVtG.exe
  C:\Windows\System\QxcLVtG.exe
  2⤵
  PID:4352
- C:\Windows\System\nOojoWH.exe
  C:\Windows\System\nOojoWH.exe
  2⤵
  PID:4372
- C:\Windows\System\uEithbC.exe
  C:\Windows\System\uEithbC.exe
  2⤵
  PID:4388
- C:\Windows\System\LcQEXLo.exe
  C:\Windows\System\LcQEXLo.exe
  2⤵
  PID:4404
- C:\Windows\System\WLFkZIO.exe
  C:\Windows\System\WLFkZIO.exe
  2⤵
  PID:4440
- C:\Windows\System\vvUqlJx.exe
  C:\Windows\System\vvUqlJx.exe
  2⤵
  PID:4460
- C:\Windows\System\NusZsNQ.exe
  C:\Windows\System\NusZsNQ.exe
  2⤵
  PID:4476
- C:\Windows\System\nXCkIxo.exe
  C:\Windows\System\nXCkIxo.exe
  2⤵
  PID:4492
- C:\Windows\System\vQkyQpO.exe
  C:\Windows\System\vQkyQpO.exe
  2⤵
  PID:4508
- C:\Windows\System\ofoJcSU.exe
  C:\Windows\System\ofoJcSU.exe
  2⤵
  PID:4528
- C:\Windows\System\ZKJryvj.exe
  C:\Windows\System\ZKJryvj.exe
  2⤵
  PID:4544
- C:\Windows\System\gdTFZLp.exe
  C:\Windows\System\gdTFZLp.exe
  2⤵
  PID:4560
- C:\Windows\System\wcpywop.exe
  C:\Windows\System\wcpywop.exe
  2⤵
  PID:4576
- C:\Windows\System\kkjhWQw.exe
  C:\Windows\System\kkjhWQw.exe
  2⤵
  PID:4592
- C:\Windows\System\qZBUMNG.exe
  C:\Windows\System\qZBUMNG.exe
  2⤵
  PID:4608
- C:\Windows\System\SFfpMfU.exe
  C:\Windows\System\SFfpMfU.exe
  2⤵
  PID:4628
- C:\Windows\System\zpQLykC.exe
  C:\Windows\System\zpQLykC.exe
  2⤵
  PID:4644
- C:\Windows\System\NoqXHCg.exe
  C:\Windows\System\NoqXHCg.exe
  2⤵
  PID:4664
- C:\Windows\System\KYxaCjb.exe
  C:\Windows\System\KYxaCjb.exe
  2⤵
  PID:4684
- C:\Windows\System\dKPnvwo.exe
  C:\Windows\System\dKPnvwo.exe
  2⤵
  PID:4700
- C:\Windows\System\bYemKfg.exe
  C:\Windows\System\bYemKfg.exe
  2⤵
  PID:4764
- C:\Windows\System\KcDjbGa.exe
  C:\Windows\System\KcDjbGa.exe
  2⤵
  PID:4780
- C:\Windows\System\hLtsHEk.exe
  C:\Windows\System\hLtsHEk.exe
  2⤵
  PID:4800
- C:\Windows\System\BegjrST.exe
  C:\Windows\System\BegjrST.exe
  2⤵
  PID:4816
- C:\Windows\System\xLiTMIQ.exe
  C:\Windows\System\xLiTMIQ.exe
  2⤵
  PID:4832
- C:\Windows\System\gAQjeBB.exe
  C:\Windows\System\gAQjeBB.exe
  2⤵
  PID:4856
- C:\Windows\System\WzQKdLe.exe
  C:\Windows\System\WzQKdLe.exe
  2⤵
  PID:4872
- C:\Windows\System\sTqraMt.exe
  C:\Windows\System\sTqraMt.exe
  2⤵
  PID:4900
- C:\Windows\System\tzSKuYm.exe
  C:\Windows\System\tzSKuYm.exe
  2⤵
  PID:4928
- C:\Windows\System\IYhUYBa.exe
  C:\Windows\System\IYhUYBa.exe
  2⤵
  PID:4944
- C:\Windows\System\WcDEVyZ.exe
  C:\Windows\System\WcDEVyZ.exe
  2⤵
  PID:4968
- C:\Windows\System\oDXUuqS.exe
  C:\Windows\System\oDXUuqS.exe
  2⤵
  PID:4984
- C:\Windows\System\suCVnDZ.exe
  C:\Windows\System\suCVnDZ.exe
  2⤵
  PID:5008
- C:\Windows\System\uqiUKPp.exe
  C:\Windows\System\uqiUKPp.exe
  2⤵
  PID:5024
- C:\Windows\System\yyIChpW.exe
  C:\Windows\System\yyIChpW.exe
  2⤵
  PID:5044
- C:\Windows\System\kFiIPzh.exe
  C:\Windows\System\kFiIPzh.exe
  2⤵
  PID:5064
- C:\Windows\System\BJGMaLk.exe
  C:\Windows\System\BJGMaLk.exe
  2⤵
  PID:5088
- C:\Windows\System\gbWzskK.exe
  C:\Windows\System\gbWzskK.exe
  2⤵
  PID:5104
- C:\Windows\System\thilBxP.exe
  C:\Windows\System\thilBxP.exe
  2⤵
  PID:3736
- C:\Windows\System\eMocWAL.exe
  C:\Windows\System\eMocWAL.exe
  2⤵
  PID:3292
- C:\Windows\System\XFCjKdJ.exe
  C:\Windows\System\XFCjKdJ.exe
  2⤵
  PID:4104
- C:\Windows\System\lbDTUuc.exe
  C:\Windows\System\lbDTUuc.exe
  2⤵
  PID:4004
- C:\Windows\System\TzGMxgQ.exe
  C:\Windows\System\TzGMxgQ.exe
  2⤵
  PID:4028
- C:\Windows\System\xZFURRg.exe
  C:\Windows\System\xZFURRg.exe
  2⤵
  PID:3652
- C:\Windows\System\mAHMosr.exe
  C:\Windows\System\mAHMosr.exe
  2⤵
  PID:3540
- C:\Windows\System\dxYQCRa.exe
  C:\Windows\System\dxYQCRa.exe
  2⤵
  PID:3576
- C:\Windows\System\DeoQJnt.exe
  C:\Windows\System\DeoQJnt.exe
  2⤵
  PID:4140
- C:\Windows\System\rITqFtp.exe
  C:\Windows\System\rITqFtp.exe
  2⤵
  PID:4172
- C:\Windows\System\OMcyChX.exe
  C:\Windows\System\OMcyChX.exe
  2⤵
  PID:4208
- C:\Windows\System\qZBJaWn.exe
  C:\Windows\System\qZBJaWn.exe
  2⤵
  PID:4248
- C:\Windows\System\uFLmMyR.exe
  C:\Windows\System\uFLmMyR.exe
  2⤵
  PID:4268
- C:\Windows\System\yIaEHiM.exe
  C:\Windows\System\yIaEHiM.exe
  2⤵
  PID:4284
- C:\Windows\System\IINcyvQ.exe
  C:\Windows\System\IINcyvQ.exe
  2⤵
  PID:4320
- C:\Windows\System\lzXRiOB.exe
  C:\Windows\System\lzXRiOB.exe
  2⤵
  PID:4360
- C:\Windows\System\SVrcruf.exe
  C:\Windows\System\SVrcruf.exe
  2⤵
  PID:4448
- C:\Windows\System\yScFdVo.exe
  C:\Windows\System\yScFdVo.exe
  2⤵
  PID:4484
- C:\Windows\System\AVKdHSq.exe
  C:\Windows\System\AVKdHSq.exe
  2⤵
  PID:4428
- C:\Windows\System\vLDAiNp.exe
  C:\Windows\System\vLDAiNp.exe
  2⤵
  PID:4516
- C:\Windows\System\AdNatPU.exe
  C:\Windows\System\AdNatPU.exe
  2⤵
  PID:4420
- C:\Windows\System\YNBxsJH.exe
  C:\Windows\System\YNBxsJH.exe
  2⤵
  PID:4652
- C:\Windows\System\GkVEIOB.exe
  C:\Windows\System\GkVEIOB.exe
  2⤵
  PID:4696
- C:\Windows\System\BQRQVpA.exe
  C:\Windows\System\BQRQVpA.exe
  2⤵
  PID:4604
- C:\Windows\System\mhboosd.exe
  C:\Windows\System\mhboosd.exe
  2⤵
  PID:4852
- C:\Windows\System\jbDFgyy.exe
  C:\Windows\System\jbDFgyy.exe
  2⤵
  PID:4720
- C:\Windows\System\jMsgdZy.exe
  C:\Windows\System\jMsgdZy.exe
  2⤵
  PID:4636
- C:\Windows\System\IMAHcFo.exe
  C:\Windows\System\IMAHcFo.exe
  2⤵
  PID:4884
- C:\Windows\System\xSvjVUI.exe
  C:\Windows\System\xSvjVUI.exe
  2⤵
  PID:4724
- C:\Windows\System\vehPndn.exe
  C:\Windows\System\vehPndn.exe
  2⤵
  PID:4744
- C:\Windows\System\rCrCqKj.exe
  C:\Windows\System\rCrCqKj.exe
  2⤵
  PID:4896
- C:\Windows\System\MVDVZIO.exe
  C:\Windows\System\MVDVZIO.exe
  2⤵
  PID:4828
- C:\Windows\System\yCgBzXd.exe
  C:\Windows\System\yCgBzXd.exe
  2⤵
  PID:4920
- C:\Windows\System\BlHdFas.exe
  C:\Windows\System\BlHdFas.exe
  2⤵
  PID:4960
- C:\Windows\System\rECqcSX.exe
  C:\Windows\System\rECqcSX.exe
  2⤵
  PID:4976
- C:\Windows\System\xPaFDtP.exe
  C:\Windows\System\xPaFDtP.exe
  2⤵
  PID:5004
- C:\Windows\System\TFjaiaK.exe
  C:\Windows\System\TFjaiaK.exe
  2⤵
  PID:5036
- C:\Windows\System\uqrNSGK.exe
  C:\Windows\System\uqrNSGK.exe
  2⤵
  PID:3236
- C:\Windows\System\nvDiwOj.exe
  C:\Windows\System\nvDiwOj.exe
  2⤵
  PID:4112
- C:\Windows\System\bSkszEf.exe
  C:\Windows\System\bSkszEf.exe
  2⤵
  PID:3432
- C:\Windows\System\FyBewkG.exe
  C:\Windows\System\FyBewkG.exe
  2⤵
  PID:4216
- C:\Windows\System\qzXphBk.exe
  C:\Windows\System\qzXphBk.exe
  2⤵
  PID:4452
- C:\Windows\System\OXiRjzg.exe
  C:\Windows\System\OXiRjzg.exe
  2⤵
  PID:4272
- C:\Windows\System\xauePzu.exe
  C:\Windows\System\xauePzu.exe
  2⤵
  PID:4624
- C:\Windows\System\wDAictp.exe
  C:\Windows\System\wDAictp.exe
  2⤵
  PID:4488
- C:\Windows\System\csCowSQ.exe
  C:\Windows\System\csCowSQ.exe
  2⤵
  PID:4584
- C:\Windows\System\BMqjHiD.exe
  C:\Windows\System\BMqjHiD.exe
  2⤵
  PID:4680
- C:\Windows\System\IbVLiMq.exe
  C:\Windows\System\IbVLiMq.exe
  2⤵
  PID:4468
- C:\Windows\System\SxfVMGX.exe
  C:\Windows\System\SxfVMGX.exe
  2⤵
  PID:4712
- C:\Windows\System\hMDYuVO.exe
  C:\Windows\System\hMDYuVO.exe
  2⤵
  PID:4568
- C:\Windows\System\eSuKWTF.exe
  C:\Windows\System\eSuKWTF.exe
  2⤵
  PID:4740
- C:\Windows\System\bnVmPiH.exe
  C:\Windows\System\bnVmPiH.exe
  2⤵
  PID:4936
- C:\Windows\System\xuQaeBs.exe
  C:\Windows\System\xuQaeBs.exe
  2⤵
  PID:4384
- C:\Windows\System\imoCwMU.exe
  C:\Windows\System\imoCwMU.exe
  2⤵
  PID:4812
- C:\Windows\System\NaTHNkb.exe
  C:\Windows\System\NaTHNkb.exe
  2⤵
  PID:4892
- C:\Windows\System\EOWzSPD.exe
  C:\Windows\System\EOWzSPD.exe
  2⤵
  PID:4864
- C:\Windows\System\RGfflFq.exe
  C:\Windows\System\RGfflFq.exe
  2⤵
  PID:4956
- C:\Windows\System\GDeGKsi.exe
  C:\Windows\System\GDeGKsi.exe
  2⤵
  PID:5076
- C:\Windows\System\eAnYDmM.exe
  C:\Windows\System\eAnYDmM.exe
  2⤵
  PID:5116
- C:\Windows\System\CyoOfuB.exe
  C:\Windows\System\CyoOfuB.exe
  2⤵
  PID:4160
- C:\Windows\System\rQmSsAy.exe
  C:\Windows\System\rQmSsAy.exe
  2⤵
  PID:4400
- C:\Windows\System\ZrgjSWA.exe
  C:\Windows\System\ZrgjSWA.exe
  2⤵
  PID:3232
- C:\Windows\System\BWVHaqX.exe
  C:\Windows\System\BWVHaqX.exe
  2⤵
  PID:4344
- C:\Windows\System\NxsOuID.exe
  C:\Windows\System\NxsOuID.exe
  2⤵
  PID:4228
- C:\Windows\System\VXAXMCC.exe
  C:\Windows\System\VXAXMCC.exe
  2⤵
  PID:4676
- C:\Windows\System\IZDkRNT.exe
  C:\Windows\System\IZDkRNT.exe
  2⤵
  PID:4600
- C:\Windows\System\IlPXHgw.exe
  C:\Windows\System\IlPXHgw.exe
  2⤵
  PID:4416
- C:\Windows\System\EndLNKb.exe
  C:\Windows\System\EndLNKb.exe
  2⤵
  PID:5056
- C:\Windows\System\JxnyuEf.exe
  C:\Windows\System\JxnyuEf.exe
  2⤵
  PID:5040
- C:\Windows\System\CgDnSvc.exe
  C:\Windows\System\CgDnSvc.exe
  2⤵
  PID:3532
- C:\Windows\System\VhEoKtp.exe
  C:\Windows\System\VhEoKtp.exe
  2⤵
  PID:5112
- C:\Windows\System\jwpduHD.exe
  C:\Windows\System\jwpduHD.exe
  2⤵
  PID:5020
- C:\Windows\System\ETDugnZ.exe
  C:\Windows\System\ETDugnZ.exe
  2⤵
  PID:4332
- C:\Windows\System\BjgZatH.exe
  C:\Windows\System\BjgZatH.exe
  2⤵
  PID:4524
- C:\Windows\System\BwTcbsg.exe
  C:\Windows\System\BwTcbsg.exe
  2⤵
  PID:4692
- C:\Windows\System\NdDPaKU.exe
  C:\Windows\System\NdDPaKU.exe
  2⤵
  PID:4888
- C:\Windows\System\GlEnGak.exe
  C:\Windows\System\GlEnGak.exe
  2⤵
  PID:4572
- C:\Windows\System\OvspymZ.exe
  C:\Windows\System\OvspymZ.exe
  2⤵
  PID:4992
- C:\Windows\System\bwlDucE.exe
  C:\Windows\System\bwlDucE.exe
  2⤵
  PID:3648
- C:\Windows\System\HpnRmkh.exe
  C:\Windows\System\HpnRmkh.exe
  2⤵
  PID:4432
- C:\Windows\System\DmTsILN.exe
  C:\Windows\System\DmTsILN.exe
  2⤵
  PID:5124
- C:\Windows\System\GAVildz.exe
  C:\Windows\System\GAVildz.exe
  2⤵
  PID:5144
- C:\Windows\System\zUOwXKw.exe
  C:\Windows\System\zUOwXKw.exe
  2⤵
  PID:5160
- C:\Windows\System\LOkjaSA.exe
  C:\Windows\System\LOkjaSA.exe
  2⤵
  PID:5184
- C:\Windows\System\rHEykyW.exe
  C:\Windows\System\rHEykyW.exe
  2⤵
  PID:5200
- C:\Windows\System\VWBLmcZ.exe
  C:\Windows\System\VWBLmcZ.exe
  2⤵
  PID:5216
- C:\Windows\System\jSMxIPJ.exe
  C:\Windows\System\jSMxIPJ.exe
  2⤵
  PID:5232
- C:\Windows\System\zDQQXxq.exe
  C:\Windows\System\zDQQXxq.exe
  2⤵
  PID:5248
- C:\Windows\System\HPbfucH.exe
  C:\Windows\System\HPbfucH.exe
  2⤵
  PID:5264
- C:\Windows\System\jEPNrKw.exe
  C:\Windows\System\jEPNrKw.exe
  2⤵
  PID:5280
- C:\Windows\System\FUjBiKH.exe
  C:\Windows\System\FUjBiKH.exe
  2⤵
  PID:5304
- C:\Windows\System\juInFGf.exe
  C:\Windows\System\juInFGf.exe
  2⤵
  PID:5320
- C:\Windows\System\pSRwftV.exe
  C:\Windows\System\pSRwftV.exe
  2⤵
  PID:5336
- C:\Windows\System\VMDQYuP.exe
  C:\Windows\System\VMDQYuP.exe
  2⤵
  PID:5352
- C:\Windows\System\lczXVHY.exe
  C:\Windows\System\lczXVHY.exe
  2⤵
  PID:5368
- C:\Windows\System\hSkApvX.exe
  C:\Windows\System\hSkApvX.exe
  2⤵
  PID:5384
- C:\Windows\System\SzXdTrz.exe
  C:\Windows\System\SzXdTrz.exe
  2⤵
  PID:5400
- C:\Windows\System\sNEQlrE.exe
  C:\Windows\System\sNEQlrE.exe
  2⤵
  PID:5416
- C:\Windows\System\msrKAeb.exe
  C:\Windows\System\msrKAeb.exe
  2⤵
  PID:5436
- C:\Windows\System\VfPSzWQ.exe
  C:\Windows\System\VfPSzWQ.exe
  2⤵
  PID:5452
- C:\Windows\System\xKqEJqY.exe
  C:\Windows\System\xKqEJqY.exe
  2⤵
  PID:5468
- C:\Windows\System\tXjfXAg.exe
  C:\Windows\System\tXjfXAg.exe
  2⤵
  PID:5484
- C:\Windows\System\DfPRcno.exe
  C:\Windows\System\DfPRcno.exe
  2⤵
  PID:5504
- C:\Windows\System\jLKeXoV.exe
  C:\Windows\System\jLKeXoV.exe
  2⤵
  PID:5520
- C:\Windows\System\oODxxmn.exe
  C:\Windows\System\oODxxmn.exe
  2⤵
  PID:5536
- C:\Windows\System\efMNoUs.exe
  C:\Windows\System\efMNoUs.exe
  2⤵
  PID:5552
- C:\Windows\System\UQnFBlP.exe
  C:\Windows\System\UQnFBlP.exe
  2⤵
  PID:5568
- C:\Windows\System\HMOPPPN.exe
  C:\Windows\System\HMOPPPN.exe
  2⤵
  PID:5584
- C:\Windows\System\eUuhZqu.exe
  C:\Windows\System\eUuhZqu.exe
  2⤵
  PID:5600
- C:\Windows\System\iTAxxyZ.exe
  C:\Windows\System\iTAxxyZ.exe
  2⤵
  PID:5616
- C:\Windows\System\rRfYDmB.exe
  C:\Windows\System\rRfYDmB.exe
  2⤵
  PID:5632
- C:\Windows\System\OoYPCmt.exe
  C:\Windows\System\OoYPCmt.exe
  2⤵
  PID:5648
- C:\Windows\System\jQQsFTo.exe
  C:\Windows\System\jQQsFTo.exe
  2⤵
  PID:5664
- C:\Windows\System\FpjpfFc.exe
  C:\Windows\System\FpjpfFc.exe
  2⤵
  PID:5680
- C:\Windows\System\CFmiErf.exe
  C:\Windows\System\CFmiErf.exe
  2⤵
  PID:5696
- C:\Windows\System\MPNCeQr.exe
  C:\Windows\System\MPNCeQr.exe
  2⤵
  PID:5712
- C:\Windows\System\YsBJLQZ.exe
  C:\Windows\System\YsBJLQZ.exe
  2⤵
  PID:5732
- C:\Windows\System\GBhvmpt.exe
  C:\Windows\System\GBhvmpt.exe
  2⤵
  PID:5748
- C:\Windows\System\aThYmtb.exe
  C:\Windows\System\aThYmtb.exe
  2⤵
  PID:5764
- C:\Windows\System\gqaEvFr.exe
  C:\Windows\System\gqaEvFr.exe
  2⤵
  PID:5780
- C:\Windows\System\HkzoOiZ.exe
  C:\Windows\System\HkzoOiZ.exe
  2⤵
  PID:5796
- C:\Windows\System\MYDHkaq.exe
  C:\Windows\System\MYDHkaq.exe
  2⤵
  PID:5812
- C:\Windows\System\HZsYQeI.exe
  C:\Windows\System\HZsYQeI.exe
  2⤵
  PID:5832
- C:\Windows\System\JbOpwqv.exe
  C:\Windows\System\JbOpwqv.exe
  2⤵
  PID:5848
- C:\Windows\System\iBNJZbx.exe
  C:\Windows\System\iBNJZbx.exe
  2⤵
  PID:5864
- C:\Windows\System\IYFkmsF.exe
  C:\Windows\System\IYFkmsF.exe
  2⤵
  PID:5888
- C:\Windows\System\pltJwWu.exe
  C:\Windows\System\pltJwWu.exe
  2⤵
  PID:5920
- C:\Windows\System\XpHMmjD.exe
  C:\Windows\System\XpHMmjD.exe
  2⤵
  PID:5980
- C:\Windows\System\QKBCMpL.exe
  C:\Windows\System\QKBCMpL.exe
  2⤵
  PID:6000
- C:\Windows\System\bpzQaqv.exe
  C:\Windows\System\bpzQaqv.exe
  2⤵
  PID:6016
- C:\Windows\System\gdkMGkQ.exe
  C:\Windows\System\gdkMGkQ.exe
  2⤵
  PID:6032
- C:\Windows\System\lkmRAYw.exe
  C:\Windows\System\lkmRAYw.exe
  2⤵
  PID:6048
- C:\Windows\System\DBoUqYq.exe
  C:\Windows\System\DBoUqYq.exe
  2⤵
  PID:6064
- C:\Windows\System\NHoQcoq.exe
  C:\Windows\System\NHoQcoq.exe
  2⤵
  PID:6080
- C:\Windows\System\pdbSSbC.exe
  C:\Windows\System\pdbSSbC.exe
  2⤵
  PID:6096
- C:\Windows\System\tdIYqhz.exe
  C:\Windows\System\tdIYqhz.exe
  2⤵
  PID:6112
- C:\Windows\System\QweevRY.exe
  C:\Windows\System\QweevRY.exe
  2⤵
  PID:6132
- C:\Windows\System\IQHuwBE.exe
  C:\Windows\System\IQHuwBE.exe
  2⤵
  PID:4752
- C:\Windows\System\SHyeBly.exe
  C:\Windows\System\SHyeBly.exe
  2⤵
  PID:4156
- C:\Windows\System\CScWGJC.exe
  C:\Windows\System\CScWGJC.exe
  2⤵
  PID:4916
- C:\Windows\System\GYSTqtf.exe
  C:\Windows\System\GYSTqtf.exe
  2⤵
  PID:4868
- C:\Windows\System\mOCIajs.exe
  C:\Windows\System\mOCIajs.exe
  2⤵
  PID:5152
- C:\Windows\System\crzxOCp.exe
  C:\Windows\System\crzxOCp.exe
  2⤵
  PID:3872
- C:\Windows\System\qWtQEuo.exe
  C:\Windows\System\qWtQEuo.exe
  2⤵
  PID:5224
- C:\Windows\System\mHmtJWE.exe
  C:\Windows\System\mHmtJWE.exe
  2⤵
  PID:5288
- C:\Windows\System\ewYhwFt.exe
  C:\Windows\System\ewYhwFt.exe
  2⤵
  PID:5168
- C:\Windows\System\AneMEEn.exe
  C:\Windows\System\AneMEEn.exe
  2⤵
  PID:5208
- C:\Windows\System\uFcQyCV.exe
  C:\Windows\System\uFcQyCV.exe
  2⤵
  PID:5312
- C:\Windows\System\uMkhqgr.exe
  C:\Windows\System\uMkhqgr.exe
  2⤵
  PID:5360
- C:\Windows\System\tXoJcxV.exe
  C:\Windows\System\tXoJcxV.exe
  2⤵
  PID:5392
- C:\Windows\System\IuSgCrJ.exe
  C:\Windows\System\IuSgCrJ.exe
  2⤵
  PID:5376
- C:\Windows\System\xPocjFE.exe
  C:\Windows\System\xPocjFE.exe
  2⤵
  PID:5424
- C:\Windows\System\mNncpiH.exe
  C:\Windows\System\mNncpiH.exe
  2⤵
  PID:5476
- C:\Windows\System\kXNIQnd.exe
  C:\Windows\System\kXNIQnd.exe
  2⤵
  PID:5464
- C:\Windows\System\JHOoXWO.exe
  C:\Windows\System\JHOoXWO.exe
  2⤵
  PID:5516
- C:\Windows\System\dAUhHtA.exe
  C:\Windows\System\dAUhHtA.exe
  2⤵
  PID:5576
- C:\Windows\System\mPFIYXW.exe
  C:\Windows\System\mPFIYXW.exe
  2⤵
  PID:5960
- C:\Windows\System\mdoxihs.exe
  C:\Windows\System\mdoxihs.exe
  2⤵
  PID:5992
- C:\Windows\System\sUQfrRk.exe
  C:\Windows\System\sUQfrRk.exe
  2⤵
  PID:6012
- C:\Windows\System\PBSJyvT.exe
  C:\Windows\System\PBSJyvT.exe
  2⤵
  PID:6044
- C:\Windows\System\wELXEpr.exe
  C:\Windows\System\wELXEpr.exe
  2⤵
  PID:6088
- C:\Windows\System\TAXzQYX.exe
  C:\Windows\System\TAXzQYX.exe
  2⤵
  PID:6056
- C:\Windows\System\jMHcRfc.exe
  C:\Windows\System\jMHcRfc.exe
  2⤵
  PID:6140
- C:\Windows\System\wEAIHhC.exe
  C:\Windows\System\wEAIHhC.exe
  2⤵
  PID:4556
- C:\Windows\System\gZKOihP.exe
  C:\Windows\System\gZKOihP.exe
  2⤵
  PID:4328
- C:\Windows\System\YYyqUrU.exe
  C:\Windows\System\YYyqUrU.exe
  2⤵
  PID:5140
- C:\Windows\System\fSNAuEZ.exe
  C:\Windows\System\fSNAuEZ.exe
  2⤵
  PID:5396
- C:\Windows\System\oBlDOQb.exe
  C:\Windows\System\oBlDOQb.exe
  2⤵
  PID:5432
- C:\Windows\System\dHutyFi.exe
  C:\Windows\System\dHutyFi.exe
  2⤵
  PID:5348
- C:\Windows\System\iagMKev.exe
  C:\Windows\System\iagMKev.exe
  2⤵
  PID:5460
- C:\Windows\System\hiMeYpp.exe
  C:\Windows\System\hiMeYpp.exe
  2⤵
  PID:5672
- C:\Windows\System\AGOJshO.exe
  C:\Windows\System\AGOJshO.exe
  2⤵
  PID:5592
- C:\Windows\System\wspPUHD.exe
  C:\Windows\System\wspPUHD.exe
  2⤵
  PID:5596
- C:\Windows\System\yiWQzxQ.exe
  C:\Windows\System\yiWQzxQ.exe
  2⤵
  PID:5688
- C:\Windows\System\tltomBQ.exe
  C:\Windows\System\tltomBQ.exe
  2⤵
  PID:5744
- C:\Windows\System\JfEhGJh.exe
  C:\Windows\System\JfEhGJh.exe
  2⤵
  PID:5844
- C:\Windows\System\uLVUylO.exe
  C:\Windows\System\uLVUylO.exe
  2⤵
  PID:5824
- C:\Windows\System\pgAEwaW.exe
  C:\Windows\System\pgAEwaW.exe
  2⤵
  PID:5900
- C:\Windows\System\lNeDTvY.exe
  C:\Windows\System\lNeDTvY.exe
  2⤵
  PID:5880
- C:\Windows\System\tCRwEgV.exe
  C:\Windows\System\tCRwEgV.exe
  2⤵
  PID:5928
- C:\Windows\System\QHVctLS.exe
  C:\Windows\System\QHVctLS.exe
  2⤵
  PID:5944
- C:\Windows\System\mQSYBBA.exe
  C:\Windows\System\mQSYBBA.exe
  2⤵
  PID:1580
- C:\Windows\System\sqFfZhX.exe
  C:\Windows\System\sqFfZhX.exe
  2⤵
  PID:5976
- C:\Windows\System\VjbpzHD.exe
  C:\Windows\System\VjbpzHD.exe
  2⤵
  PID:6008
- C:\Windows\System\HSmZkRq.exe
  C:\Windows\System\HSmZkRq.exe
  2⤵
  PID:5260
- C:\Windows\System\fomEMkp.exe
  C:\Windows\System\fomEMkp.exe
  2⤵
  PID:6076
- C:\Windows\System\WjRZGBV.exe
  C:\Windows\System\WjRZGBV.exe
  2⤵
  PID:4552
- C:\Windows\System\OHXSuEK.exe
  C:\Windows\System\OHXSuEK.exe
  2⤵
  PID:5176
- C:\Windows\System\dAdHtXI.exe
  C:\Windows\System\dAdHtXI.exe
  2⤵
  PID:5496
- C:\Windows\System\zCWHOAs.exe
  C:\Windows\System\zCWHOAs.exe
  2⤵
  PID:5244
- C:\Windows\System\qeDHaqY.exe
  C:\Windows\System\qeDHaqY.exe
  2⤵
  PID:5704
- C:\Windows\System\ZycZBOw.exe
  C:\Windows\System\ZycZBOw.exe
  2⤵
  PID:5656
- C:\Windows\System\eVXKpae.exe
  C:\Windows\System\eVXKpae.exe
  2⤵
  PID:5808
- C:\Windows\System\LiVKOPK.exe
  C:\Windows\System\LiVKOPK.exe
  2⤵
  PID:5876
- C:\Windows\System\uNkiJDK.exe
  C:\Windows\System\uNkiJDK.exe
  2⤵
  PID:5860
- C:\Windows\System\FgGPaUb.exe
  C:\Windows\System\FgGPaUb.exe
  2⤵
  PID:5916
- C:\Windows\System\iTQhlzE.exe
  C:\Windows\System\iTQhlzE.exe
  2⤵
  PID:5296
- C:\Windows\System\XexNKix.exe
  C:\Windows\System\XexNKix.exe
  2⤵
  PID:5532
- C:\Windows\System\GiEBqYD.exe
  C:\Windows\System\GiEBqYD.exe
  2⤵
  PID:5728
- C:\Windows\System\QJJbcTz.exe
  C:\Windows\System\QJJbcTz.exe
  2⤵
  PID:5772
- C:\Windows\System\atoSqiA.exe
  C:\Windows\System\atoSqiA.exe
  2⤵
  PID:5344
- C:\Windows\System\LYDmaCR.exe
  C:\Windows\System\LYDmaCR.exe
  2⤵
  PID:5968
- C:\Windows\System\qDBycQf.exe
  C:\Windows\System\qDBycQf.exe
  2⤵
  PID:5548
- C:\Windows\System\GuOPMaq.exe
  C:\Windows\System\GuOPMaq.exe
  2⤵
  PID:5760
- C:\Windows\System\rEWDEBS.exe
  C:\Windows\System\rEWDEBS.exe
  2⤵
  PID:6152
- C:\Windows\System\ExsXiTg.exe
  C:\Windows\System\ExsXiTg.exe
  2⤵
  PID:6180
- C:\Windows\System\YPmzPUt.exe
  C:\Windows\System\YPmzPUt.exe
  2⤵
  PID:6228
- C:\Windows\System\xYRKINz.exe
  C:\Windows\System\xYRKINz.exe
  2⤵
  PID:6244
- C:\Windows\System\hbZcHEp.exe
  C:\Windows\System\hbZcHEp.exe
  2⤵
  PID:6260
- C:\Windows\System\rWssOyL.exe
  C:\Windows\System\rWssOyL.exe
  2⤵
  PID:6280
- C:\Windows\System\gmNidsk.exe
  C:\Windows\System\gmNidsk.exe
  2⤵
  PID:6296
- C:\Windows\System\AhXKjzn.exe
  C:\Windows\System\AhXKjzn.exe
  2⤵
  PID:6324
- C:\Windows\System\vCiiyzQ.exe
  C:\Windows\System\vCiiyzQ.exe
  2⤵
  PID:6340
- C:\Windows\System\wMbZLEb.exe
  C:\Windows\System\wMbZLEb.exe
  2⤵
  PID:6360
- C:\Windows\System\GQhTTYp.exe
  C:\Windows\System\GQhTTYp.exe
  2⤵
  PID:6380
- C:\Windows\System\MKuWWuC.exe
  C:\Windows\System\MKuWWuC.exe
  2⤵
  PID:6396
- C:\Windows\System\MzOyBmI.exe
  C:\Windows\System\MzOyBmI.exe
  2⤵
  PID:6416
- C:\Windows\System\hAgjAHK.exe
  C:\Windows\System\hAgjAHK.exe
  2⤵
  PID:6436
- C:\Windows\System\vDpUtTe.exe
  C:\Windows\System\vDpUtTe.exe
  2⤵
  PID:6452
- C:\Windows\System\mbzweLO.exe
  C:\Windows\System\mbzweLO.exe
  2⤵
  PID:6468
- C:\Windows\System\LTuEjof.exe
  C:\Windows\System\LTuEjof.exe
  2⤵
  PID:6496
- C:\Windows\System\iTggxyc.exe
  C:\Windows\System\iTggxyc.exe
  2⤵
  PID:6524
- C:\Windows\System\njfSwXQ.exe
  C:\Windows\System\njfSwXQ.exe
  2⤵
  PID:6544
- C:\Windows\System\xGGWDyk.exe
  C:\Windows\System\xGGWDyk.exe
  2⤵
  PID:6572
- C:\Windows\System\ZlRCFlM.exe
  C:\Windows\System\ZlRCFlM.exe
  2⤵
  PID:6588
- C:\Windows\System\boANRdK.exe
  C:\Windows\System\boANRdK.exe
  2⤵
  PID:6604
- C:\Windows\System\CczWqLa.exe
  C:\Windows\System\CczWqLa.exe
  2⤵
  PID:6620
- C:\Windows\System\FZBPxFt.exe
  C:\Windows\System\FZBPxFt.exe
  2⤵
  PID:6636
- C:\Windows\System\DWBCexh.exe
  C:\Windows\System\DWBCexh.exe
  2⤵
  PID:6652
- C:\Windows\System\FxlibJO.exe
  C:\Windows\System\FxlibJO.exe
  2⤵
  PID:6668
- C:\Windows\System\wScFmGa.exe
  C:\Windows\System\wScFmGa.exe
  2⤵
  PID:6684
- C:\Windows\System\Bprkjkh.exe
  C:\Windows\System\Bprkjkh.exe
  2⤵
  PID:6704
- C:\Windows\System\ohQScjL.exe
  C:\Windows\System\ohQScjL.exe
  2⤵
  PID:6724
- C:\Windows\System\cWMKvpe.exe
  C:\Windows\System\cWMKvpe.exe
  2⤵
  PID:6744
- C:\Windows\System\QjEUzAs.exe
  C:\Windows\System\QjEUzAs.exe
  2⤵
  PID:6760
- C:\Windows\System\TBNMpxd.exe
  C:\Windows\System\TBNMpxd.exe
  2⤵
  PID:6796
- C:\Windows\System\MBisqho.exe
  C:\Windows\System\MBisqho.exe
  2⤵
  PID:6816
- C:\Windows\System\hZIgeFV.exe
  C:\Windows\System\hZIgeFV.exe
  2⤵
  PID:6840
- C:\Windows\System\JHWmPtB.exe
  C:\Windows\System\JHWmPtB.exe
  2⤵
  PID:6860
- C:\Windows\System\NMziIDc.exe
  C:\Windows\System\NMziIDc.exe
  2⤵
  PID:6880
- C:\Windows\System\rVupRKu.exe
  C:\Windows\System\rVupRKu.exe
  2⤵
  PID:6896
- C:\Windows\System\mJcTuSc.exe
  C:\Windows\System\mJcTuSc.exe
  2⤵
  PID:6920
- C:\Windows\System\WIVduQK.exe
  C:\Windows\System\WIVduQK.exe
  2⤵
  PID:6936
- C:\Windows\System\fqAicbw.exe
  C:\Windows\System\fqAicbw.exe
  2⤵
  PID:6952
- C:\Windows\System\VZxJjSr.exe
  C:\Windows\System\VZxJjSr.exe
  2⤵
  PID:6972
- C:\Windows\System\rLXOMkg.exe
  C:\Windows\System\rLXOMkg.exe
  2⤵
  PID:6996
- C:\Windows\System\eDrpoaz.exe
  C:\Windows\System\eDrpoaz.exe
  2⤵
  PID:7012
- C:\Windows\System\zzuyxRH.exe
  C:\Windows\System\zzuyxRH.exe
  2⤵
  PID:7028
- C:\Windows\System\motDGyU.exe
  C:\Windows\System\motDGyU.exe
  2⤵
  PID:7044
- C:\Windows\System\emikkzM.exe
  C:\Windows\System\emikkzM.exe
  2⤵
  PID:7060
- C:\Windows\System\sAZActx.exe
  C:\Windows\System\sAZActx.exe
  2⤵
  PID:7084
- C:\Windows\System\SPErddX.exe
  C:\Windows\System\SPErddX.exe
  2⤵
  PID:7108
- C:\Windows\System\ghncgPv.exe
  C:\Windows\System\ghncgPv.exe
  2⤵
  PID:7128
- C:\Windows\System\rwaaDCA.exe
  C:\Windows\System\rwaaDCA.exe
  2⤵
  PID:7144
- C:\Windows\System\zijLpdV.exe
  C:\Windows\System\zijLpdV.exe
  2⤵
  PID:7164
- C:\Windows\System\oGPhPiz.exe
  C:\Windows\System\oGPhPiz.exe
  2⤵
  PID:5884
- C:\Windows\System\CAzsXpK.exe
  C:\Windows\System\CAzsXpK.exe
  2⤵
  PID:5332
- C:\Windows\System\TGtLkVI.exe
  C:\Windows\System\TGtLkVI.exe
  2⤵
  PID:5564
- C:\Windows\System\vektAzd.exe
  C:\Windows\System\vektAzd.exe
  2⤵
  PID:5912
- C:\Windows\System\sJTvWyY.exe
  C:\Windows\System\sJTvWyY.exe
  2⤵
  PID:4188
- C:\Windows\System\mDVNabx.exe
  C:\Windows\System\mDVNabx.exe
  2⤵
  PID:5972
- C:\Windows\System\XJegQLF.exe
  C:\Windows\System\XJegQLF.exe
  2⤵
  PID:6192
- C:\Windows\System\TauSsqH.exe
  C:\Windows\System\TauSsqH.exe
  2⤵
  PID:6220
- C:\Windows\System\gmzhxFm.exe
  C:\Windows\System\gmzhxFm.exe
  2⤵
  PID:6304
- C:\Windows\System\baCkLsJ.exe
  C:\Windows\System\baCkLsJ.exe
  2⤵
  PID:6272
- C:\Windows\System\qFwmOSS.exe
  C:\Windows\System\qFwmOSS.exe
  2⤵
  PID:6392
- C:\Windows\System\RXbuctg.exe
  C:\Windows\System\RXbuctg.exe
  2⤵
  PID:6424
- C:\Windows\System\VnvQpFj.exe
  C:\Windows\System\VnvQpFj.exe
  2⤵
  PID:6372
- C:\Windows\System\xfYGWQs.exe
  C:\Windows\System\xfYGWQs.exe
  2⤵
  PID:6448
- C:\Windows\System\QwBEXoN.exe
  C:\Windows\System\QwBEXoN.exe
  2⤵
  PID:6488
- C:\Windows\System\eijbIih.exe
  C:\Windows\System\eijbIih.exe
  2⤵
  PID:6512
- C:\Windows\System\NMiTArq.exe
  C:\Windows\System\NMiTArq.exe
  2⤵
  PID:6516
- C:\Windows\System\JcgjCTU.exe
  C:\Windows\System\JcgjCTU.exe
  2⤵
  PID:6564
- C:\Windows\System\EGiHGqR.exe
  C:\Windows\System\EGiHGqR.exe
  2⤵
  PID:6580
- C:\Windows\System\buQczCn.exe
  C:\Windows\System\buQczCn.exe
  2⤵
  PID:6716
- C:\Windows\System\gpKZdLX.exe
  C:\Windows\System\gpKZdLX.exe
  2⤵
  PID:6632
- C:\Windows\System\IHWblSh.exe
  C:\Windows\System\IHWblSh.exe
  2⤵
  PID:6696
- C:\Windows\System\JlyCnhu.exe
  C:\Windows\System\JlyCnhu.exe
  2⤵
  PID:6664
- C:\Windows\System\ggJxngI.exe
  C:\Windows\System\ggJxngI.exe
  2⤵
  PID:6828
- C:\Windows\System\YbWELqo.exe
  C:\Windows\System\YbWELqo.exe
  2⤵
  PID:6788
- C:\Windows\System\shBZKgz.exe
  C:\Windows\System\shBZKgz.exe
  2⤵
  PID:6756
- C:\Windows\System\fTBIHUT.exe
  C:\Windows\System\fTBIHUT.exe
  2⤵
  PID:6808
- C:\Windows\System\YjPVcLl.exe
  C:\Windows\System\YjPVcLl.exe
  2⤵
  PID:6856
- C:\Windows\System\yNSzEmS.exe
  C:\Windows\System\yNSzEmS.exe
  2⤵
  PID:6892
- C:\Windows\System\QaZuxuH.exe
  C:\Windows\System\QaZuxuH.exe
  2⤵
  PID:6960
- C:\Windows\System\oNYYQRV.exe
  C:\Windows\System\oNYYQRV.exe
  2⤵
  PID:6944
- C:\Windows\System\CrPQvdE.exe
  C:\Windows\System\CrPQvdE.exe
  2⤵
  PID:7052
- C:\Windows\System\BlDqqCr.exe
  C:\Windows\System\BlDqqCr.exe
  2⤵
  PID:7096
- C:\Windows\System\hyIJzzD.exe
  C:\Windows\System\hyIJzzD.exe
  2⤵
  PID:7024
- C:\Windows\System\cDvGBKw.exe
  C:\Windows\System\cDvGBKw.exe
  2⤵
  PID:7080
- C:\Windows\System\pRjWEZC.exe
  C:\Windows\System\pRjWEZC.exe
  2⤵
  PID:7156
- C:\Windows\System\VFJDSFP.exe
  C:\Windows\System\VFJDSFP.exe
  2⤵
  PID:5628
- C:\Windows\System\XdZOlFe.exe
  C:\Windows\System\XdZOlFe.exe
  2⤵
  PID:5896
- C:\Windows\System\NODjCka.exe
  C:\Windows\System\NODjCka.exe
  2⤵
  PID:5212
- C:\Windows\System\iNZOyYK.exe
  C:\Windows\System\iNZOyYK.exe
  2⤵
  PID:6164
- C:\Windows\System\fMufsZO.exe
  C:\Windows\System\fMufsZO.exe
  2⤵
  PID:6208
- C:\Windows\System\GGaozuq.exe
  C:\Windows\System\GGaozuq.exe
  2⤵
  PID:6236
- C:\Windows\System\yNTnKnt.exe
  C:\Windows\System\yNTnKnt.exe
  2⤵
  PID:6332
- C:\Windows\System\OFwUDIs.exe
  C:\Windows\System\OFwUDIs.exe
  2⤵
  PID:6172
- C:\Windows\System\FrcIIjR.exe
  C:\Windows\System\FrcIIjR.exe
  2⤵
  PID:6320
- C:\Windows\System\Itoknns.exe
  C:\Windows\System\Itoknns.exe
  2⤵
  PID:6540
- C:\Windows\System\bgttJIM.exe
  C:\Windows\System\bgttJIM.exe
  2⤵
  PID:6412
- C:\Windows\System\RGTcLVj.exe
  C:\Windows\System\RGTcLVj.exe
  2⤵
  PID:6464
- C:\Windows\System\xgbnMWC.exe
  C:\Windows\System\xgbnMWC.exe
  2⤵
  PID:6680
- C:\Windows\System\XcDPsNj.exe
  C:\Windows\System\XcDPsNj.exe
  2⤵
  PID:6584
- C:\Windows\System\wsFEEut.exe
  C:\Windows\System\wsFEEut.exe
  2⤵
  PID:6648
- C:\Windows\System\WcQEqXd.exe
  C:\Windows\System\WcQEqXd.exe
  2⤵
  PID:6784
- C:\Windows\System\FyXqgLl.exe
  C:\Windows\System\FyXqgLl.exe
  2⤵
  PID:6700
- C:\Windows\System\GsEFPlc.exe
  C:\Windows\System\GsEFPlc.exe
  2⤵
  PID:7140
- C:\Windows\System\kiXWMMu.exe
  C:\Windows\System\kiXWMMu.exe
  2⤵
  PID:6928
- C:\Windows\System\EXeHVDK.exe
  C:\Windows\System\EXeHVDK.exe
  2⤵
  PID:6984
- C:\Windows\System\pxqdZsG.exe
  C:\Windows\System\pxqdZsG.exe
  2⤵
  PID:4472
- C:\Windows\System\sCszFNo.exe
  C:\Windows\System\sCszFNo.exe
  2⤵
  PID:6988
- C:\Windows\System\ODQXqGf.exe
  C:\Windows\System\ODQXqGf.exe
  2⤵
  PID:7176
- C:\Windows\System\ZGtjDAG.exe
  C:\Windows\System\ZGtjDAG.exe
  2⤵
  PID:7200
- C:\Windows\System\FgRlQrG.exe
  C:\Windows\System\FgRlQrG.exe
  2⤵
  PID:7216
- C:\Windows\System\wdfspGB.exe
  C:\Windows\System\wdfspGB.exe
  2⤵
  PID:7232
- C:\Windows\System\vGWGsHG.exe
  C:\Windows\System\vGWGsHG.exe
  2⤵
  PID:7248
- C:\Windows\System\ZLMzEVL.exe
  C:\Windows\System\ZLMzEVL.exe
  2⤵
  PID:7264
- C:\Windows\System\HYzMrWH.exe
  C:\Windows\System\HYzMrWH.exe
  2⤵
  PID:7280
- C:\Windows\System\ZLISlqQ.exe
  C:\Windows\System\ZLISlqQ.exe
  2⤵
  PID:7304
- C:\Windows\System\ITGwdue.exe
  C:\Windows\System\ITGwdue.exe
  2⤵
  PID:7324
- C:\Windows\System\fmcusSy.exe
  C:\Windows\System\fmcusSy.exe
  2⤵
  PID:7340
- C:\Windows\System\VGzASia.exe
  C:\Windows\System\VGzASia.exe
  2⤵
  PID:7356
- C:\Windows\System\qxwFGXb.exe
  C:\Windows\System\qxwFGXb.exe
  2⤵
  PID:7372
- C:\Windows\System\CIqYjBY.exe
  C:\Windows\System\CIqYjBY.exe
  2⤵
  PID:7388
- C:\Windows\System\ZYeWUYv.exe
  C:\Windows\System\ZYeWUYv.exe
  2⤵
  PID:7408
- C:\Windows\System\QaLegsx.exe
  C:\Windows\System\QaLegsx.exe
  2⤵
  PID:7428
- C:\Windows\System\eAnXYFt.exe
  C:\Windows\System\eAnXYFt.exe
  2⤵
  PID:7444
- C:\Windows\System\CRcMgLf.exe
  C:\Windows\System\CRcMgLf.exe
  2⤵
  PID:7468
- C:\Windows\System\GCtIsEI.exe
  C:\Windows\System\GCtIsEI.exe
  2⤵
  PID:7488
- C:\Windows\System\qXDrUmO.exe
  C:\Windows\System\qXDrUmO.exe
  2⤵
  PID:7504
- C:\Windows\System\rofsKUf.exe
  C:\Windows\System\rofsKUf.exe
  2⤵
  PID:7520
- C:\Windows\System\zfqJVQA.exe
  C:\Windows\System\zfqJVQA.exe
  2⤵
  PID:7536
- C:\Windows\System\AXCGDYM.exe
  C:\Windows\System\AXCGDYM.exe
  2⤵
  PID:7552
- C:\Windows\System\yPVjKaw.exe
  C:\Windows\System\yPVjKaw.exe
  2⤵
  PID:7572
- C:\Windows\System\FZeMddI.exe
  C:\Windows\System\FZeMddI.exe
  2⤵
  PID:7596
- C:\Windows\System\eAioImC.exe
  C:\Windows\System\eAioImC.exe
  2⤵
  PID:7684
- C:\Windows\System\otfIlXA.exe
  C:\Windows\System\otfIlXA.exe
  2⤵
  PID:7700
- C:\Windows\System\bNRxnYN.exe
  C:\Windows\System\bNRxnYN.exe
  2⤵
  PID:7716
- C:\Windows\System\pWzTOpV.exe
  C:\Windows\System\pWzTOpV.exe
  2⤵
  PID:7732
- C:\Windows\System\IjwQkAu.exe
  C:\Windows\System\IjwQkAu.exe
  2⤵
  PID:7748
- C:\Windows\System\TnnSdJn.exe
  C:\Windows\System\TnnSdJn.exe
  2⤵
  PID:7764
- C:\Windows\System\hSTdbiR.exe
  C:\Windows\System\hSTdbiR.exe
  2⤵
  PID:7780
- C:\Windows\System\TTrJnkQ.exe
  C:\Windows\System\TTrJnkQ.exe
  2⤵
  PID:7796
- C:\Windows\System\NogYcUH.exe
  C:\Windows\System\NogYcUH.exe
  2⤵
  PID:7812
- C:\Windows\System\AHRzLxc.exe
  C:\Windows\System\AHRzLxc.exe
  2⤵
  PID:7828
- C:\Windows\System\zoNEYoc.exe
  C:\Windows\System\zoNEYoc.exe
  2⤵
  PID:7844
- C:\Windows\System\XiKsdIb.exe
  C:\Windows\System\XiKsdIb.exe
  2⤵
  PID:7860
- C:\Windows\System\psgFkuA.exe
  C:\Windows\System\psgFkuA.exe
  2⤵
  PID:7876
- C:\Windows\System\HmlxZzX.exe
  C:\Windows\System\HmlxZzX.exe
  2⤵
  PID:7892
- C:\Windows\System\MGzlLtO.exe
  C:\Windows\System\MGzlLtO.exe
  2⤵
  PID:7908
- C:\Windows\System\nnmOprE.exe
  C:\Windows\System\nnmOprE.exe
  2⤵
  PID:7924
- C:\Windows\System\hUTiXUy.exe
  C:\Windows\System\hUTiXUy.exe
  2⤵
  PID:7940
- C:\Windows\System\aiLLywA.exe
  C:\Windows\System\aiLLywA.exe
  2⤵
  PID:7956
- C:\Windows\System\ASUlhOa.exe
  C:\Windows\System\ASUlhOa.exe
  2⤵
  PID:7972
- C:\Windows\System\USiJOVD.exe
  C:\Windows\System\USiJOVD.exe
  2⤵
  PID:7988
- C:\Windows\System\fcRBtyP.exe
  C:\Windows\System\fcRBtyP.exe
  2⤵
  PID:8004
- C:\Windows\System\seMmreq.exe
  C:\Windows\System\seMmreq.exe
  2⤵
  PID:8020
- C:\Windows\System\WEyyyNH.exe
  C:\Windows\System\WEyyyNH.exe
  2⤵
  PID:8036
- C:\Windows\System\TjTIOge.exe
  C:\Windows\System\TjTIOge.exe
  2⤵
  PID:8052
- C:\Windows\System\AOXLACL.exe
  C:\Windows\System\AOXLACL.exe
  2⤵
  PID:8068
- C:\Windows\System\rTQEjqX.exe
  C:\Windows\System\rTQEjqX.exe
  2⤵
  PID:8084
- C:\Windows\System\tSuVGbv.exe
  C:\Windows\System\tSuVGbv.exe
  2⤵
  PID:8100
- C:\Windows\System\crcEaxk.exe
  C:\Windows\System\crcEaxk.exe
  2⤵
  PID:8116
- C:\Windows\System\ATRTFxQ.exe
  C:\Windows\System\ATRTFxQ.exe
  2⤵
  PID:8132
- C:\Windows\System\BETNBtE.exe
  C:\Windows\System\BETNBtE.exe
  2⤵
  PID:8148
- C:\Windows\System\aKEDbdg.exe
  C:\Windows\System\aKEDbdg.exe
  2⤵
  PID:8164
- C:\Windows\System\awLDLJa.exe
  C:\Windows\System\awLDLJa.exe
  2⤵
  PID:8180
- C:\Windows\System\GqDxgPG.exe
  C:\Windows\System\GqDxgPG.exe
  2⤵
  PID:6644
- C:\Windows\System\NbqcXcq.exe
  C:\Windows\System\NbqcXcq.exe
  2⤵
  PID:6804
- C:\Windows\System\NKdGcWj.exe
  C:\Windows\System\NKdGcWj.exe
  2⤵
  PID:6532
- C:\Windows\System\sicZGEg.exe
  C:\Windows\System\sicZGEg.exe
  2⤵
  PID:6520
- C:\Windows\System\nWjONGO.exe
  C:\Windows\System\nWjONGO.exe
  2⤵
  PID:7208
- C:\Windows\System\MgPfIkR.exe
  C:\Windows\System\MgPfIkR.exe
  2⤵
  PID:6308
- C:\Windows\System\oecDdap.exe
  C:\Windows\System\oecDdap.exe
  2⤵
  PID:6980
- C:\Windows\System\xNeMMWB.exe
  C:\Windows\System\xNeMMWB.exe
  2⤵
  PID:7460
- C:\Windows\System\jhcpKIl.exe
  C:\Windows\System\jhcpKIl.exe
  2⤵
  PID:7560
- C:\Windows\System\wkhoHts.exe
  C:\Windows\System\wkhoHts.exe
  2⤵
  PID:5940
- C:\Windows\System\SJhVEsC.exe
  C:\Windows\System\SJhVEsC.exe
  2⤵
  PID:7352
- C:\Windows\System\ByxDpie.exe
  C:\Windows\System\ByxDpie.exe
  2⤵
  PID:7420
- C:\Windows\System\dBmUaVt.exe
  C:\Windows\System\dBmUaVt.exe
  2⤵
  PID:7496
- C:\Windows\System\ojHGpWg.exe
  C:\Windows\System\ojHGpWg.exe
  2⤵
  PID:7568
- C:\Windows\System\rclbCBO.exe
  C:\Windows\System\rclbCBO.exe
  2⤵
  PID:6268
- C:\Windows\System\SGQKDWX.exe
  C:\Windows\System\SGQKDWX.exe
  2⤵
  PID:7104
- C:\Windows\System\SPRjlss.exe
  C:\Windows\System\SPRjlss.exe
  2⤵
  PID:7076
- C:\Windows\System\tfPPpDV.exe
  C:\Windows\System\tfPPpDV.exe
  2⤵
  PID:6160
- C:\Windows\System\pjyafEK.exe
  C:\Windows\System\pjyafEK.exe
  2⤵
  PID:7580
- C:\Windows\System\gFUToYM.exe
  C:\Windows\System\gFUToYM.exe
  2⤵
  PID:6356
- C:\Windows\System\comhLWg.exe
  C:\Windows\System\comhLWg.exe
  2⤵
  PID:6772
- C:\Windows\System\HAXZnGT.exe
  C:\Windows\System\HAXZnGT.exe
  2⤵
  PID:6868
- C:\Windows\System\BvsKyGA.exe
  C:\Windows\System\BvsKyGA.exe
  2⤵
  PID:6240
- C:\Windows\System\YJhnJcR.exe
  C:\Windows\System\YJhnJcR.exe
  2⤵
  PID:7192
- C:\Windows\System\HPJatgX.exe
  C:\Windows\System\HPJatgX.exe
  2⤵
  PID:7288
- C:\Windows\System\yOmnoGl.exe
  C:\Windows\System\yOmnoGl.exe
  2⤵
  PID:7332
- C:\Windows\System\iQYTTGP.exe
  C:\Windows\System\iQYTTGP.exe
  2⤵
  PID:7396
- C:\Windows\System\yzMVogk.exe
  C:\Windows\System\yzMVogk.exe
  2⤵
  PID:7440
- C:\Windows\System\BSvszix.exe
  C:\Windows\System\BSvszix.exe
  2⤵
  PID:7516
- C:\Windows\System\rWaxJyr.exe
  C:\Windows\System\rWaxJyr.exe
  2⤵
  PID:6216
- C:\Windows\System\PUpOyxW.exe
  C:\Windows\System\PUpOyxW.exe
  2⤵
  PID:7592
- C:\Windows\System\XHAuhlK.exe
  C:\Windows\System\XHAuhlK.exe
  2⤵
  PID:7620
- C:\Windows\System\RlkoWHf.exe
  C:\Windows\System\RlkoWHf.exe
  2⤵
  PID:7636
- C:\Windows\System\wBphshG.exe
  C:\Windows\System\wBphshG.exe
  2⤵
  PID:7676
- C:\Windows\System\YdISCcU.exe
  C:\Windows\System\YdISCcU.exe
  2⤵
  PID:7740
- C:\Windows\System\vPeCqYR.exe
  C:\Windows\System\vPeCqYR.exe
  2⤵
  PID:7708
- C:\Windows\System\HUmLxmN.exe
  C:\Windows\System\HUmLxmN.exe
  2⤵
  PID:7804
- C:\Windows\System\jHzGySe.exe
  C:\Windows\System\jHzGySe.exe
  2⤵
  PID:7840
- C:\Windows\System\aLCVWDi.exe
  C:\Windows\System\aLCVWDi.exe
  2⤵
  PID:7904
- C:\Windows\System\hSNSwja.exe
  C:\Windows\System\hSNSwja.exe
  2⤵
  PID:7968
- C:\Windows\System\YMEcEBz.exe
  C:\Windows\System\YMEcEBz.exe
  2⤵
  PID:7788
- C:\Windows\System\DnyyDZO.exe
  C:\Windows\System\DnyyDZO.exe
  2⤵
  PID:7724
- C:\Windows\System\QbXawkP.exe
  C:\Windows\System\QbXawkP.exe
  2⤵
  PID:7792
- C:\Windows\System\GgkJReP.exe
  C:\Windows\System\GgkJReP.exe
  2⤵
  PID:7856
- C:\Windows\System\EWsTIiQ.exe
  C:\Windows\System\EWsTIiQ.exe
  2⤵
  PID:7948
- C:\Windows\System\AmZZVtK.exe
  C:\Windows\System\AmZZVtK.exe
  2⤵
  PID:8016
- C:\Windows\System\JJnrDJR.exe
  C:\Windows\System\JJnrDJR.exe
  2⤵
  PID:8064
- C:\Windows\System\EAgBAKu.exe
  C:\Windows\System\EAgBAKu.exe
  2⤵
  PID:8076
- C:\Windows\System\jKZlQBc.exe
  C:\Windows\System\jKZlQBc.exe
  2⤵
  PID:8128
- C:\Windows\System\FimFpWs.exe
  C:\Windows\System\FimFpWs.exe
  2⤵
  PID:8188
- C:\Windows\System\JPMXQZi.exe
  C:\Windows\System\JPMXQZi.exe
  2⤵
  PID:6616
- C:\Windows\System\pCVfpWM.exe
  C:\Windows\System\pCVfpWM.exe
  2⤵
  PID:8144
- C:\Windows\System\wxnNRaq.exe
  C:\Windows\System\wxnNRaq.exe
  2⤵
  PID:6288
- C:\Windows\System\HBMBwsW.exe
  C:\Windows\System\HBMBwsW.exe
  2⤵
  PID:7320
- C:\Windows\System\RrRcviQ.exe
  C:\Windows\System\RrRcviQ.exe
  2⤵
  PID:7464
- C:\Windows\System\GVkEykj.exe
  C:\Windows\System\GVkEykj.exe
  2⤵
  PID:7068
- C:\Windows\System\bBRCVdF.exe
  C:\Windows\System\bBRCVdF.exe
  2⤵
  PID:6508
- C:\Windows\System\SpbFkfi.exe
  C:\Windows\System\SpbFkfi.exe
  2⤵
  PID:7312
- C:\Windows\System\FFgXOlT.exe
  C:\Windows\System\FFgXOlT.exe
  2⤵
  PID:7416
- C:\Windows\System\drKCkTn.exe
  C:\Windows\System\drKCkTn.exe
  2⤵
  PID:6404
- C:\Windows\System\TTSruct.exe
  C:\Windows\System\TTSruct.exe
  2⤵
  PID:6432
- C:\Windows\System\mhkxKuV.exe
  C:\Windows\System\mhkxKuV.exe
  2⤵
  PID:6736
- C:\Windows\System\MJnupTe.exe
  C:\Windows\System\MJnupTe.exe
  2⤵
  PID:7260
- C:\Windows\System\szWXvcL.exe
  C:\Windows\System\szWXvcL.exe
  2⤵
  PID:7484
- C:\Windows\System\FNLFifn.exe
  C:\Windows\System\FNLFifn.exe
  2⤵
  PID:7300
- C:\Windows\System\qXkqggN.exe
  C:\Windows\System\qXkqggN.exe
  2⤵
  PID:7476
- C:\Windows\System\saUolHT.exe
  C:\Windows\System\saUolHT.exe
  2⤵
  PID:6336
- C:\Windows\System\nWJIfjP.exe
  C:\Windows\System\nWJIfjP.exe
  2⤵
  PID:7664
- C:\Windows\System\AiXYmrz.exe
  C:\Windows\System\AiXYmrz.exe
  2⤵
  PID:8000
- C:\Windows\System\MseDmRf.exe
  C:\Windows\System\MseDmRf.exe
  2⤵
  PID:7756
- C:\Windows\System\TkQFbNL.exe
  C:\Windows\System\TkQFbNL.exe
  2⤵
  PID:8032
- C:\Windows\System\cHsVsCY.exe
  C:\Windows\System\cHsVsCY.exe
  2⤵
  PID:8124
- C:\Windows\System\gBlmNvT.exe
  C:\Windows\System\gBlmNvT.exe
  2⤵
  PID:6832
- C:\Windows\System\WyAuLcl.exe
  C:\Windows\System\WyAuLcl.exe
  2⤵
  PID:7616
- C:\Windows\System\SaBFhjM.exe
  C:\Windows\System\SaBFhjM.exe
  2⤵
  PID:7808
- C:\Windows\System\mJsRgCM.exe
  C:\Windows\System\mJsRgCM.exe
  2⤵
  PID:7964
- C:\Windows\System\mrVmVlf.exe
  C:\Windows\System\mrVmVlf.exe
  2⤵
  PID:7984
- C:\Windows\System\rwYEBCx.exe
  C:\Windows\System\rwYEBCx.exe
  2⤵
  PID:8160
- C:\Windows\System\cbxpvtx.exe
  C:\Windows\System\cbxpvtx.exe
  2⤵
  PID:7040
- C:\Windows\System\SRznbnw.exe
  C:\Windows\System\SRznbnw.exe
  2⤵
  PID:7092
- C:\Windows\System\shKCrlK.exe
  C:\Windows\System\shKCrlK.exe
  2⤵
  PID:6188
- C:\Windows\System\KAGWfup.exe
  C:\Windows\System\KAGWfup.exe
  2⤵
  PID:7680
- C:\Windows\System\XUVBgYH.exe
  C:\Windows\System\XUVBgYH.exe
  2⤵
  PID:5952
- C:\Windows\System\NMmwZIo.exe
  C:\Windows\System\NMmwZIo.exe
  2⤵
  PID:7852
- C:\Windows\System\gwFfgtp.exe
  C:\Windows\System\gwFfgtp.exe
  2⤵
  PID:7544
- C:\Windows\System\OGSMdAj.exe
  C:\Windows\System\OGSMdAj.exe
  2⤵
  PID:6388
- C:\Windows\System\rHvSXBH.exe
  C:\Windows\System\rHvSXBH.exe
  2⤵
  PID:7660
- C:\Windows\System\BLFITlE.exe
  C:\Windows\System\BLFITlE.exe
  2⤵
  PID:8048
- C:\Windows\System\FXbDJhy.exe
  C:\Windows\System\FXbDJhy.exe
  2⤵
  PID:7188
- C:\Windows\System\grDvCVT.exe
  C:\Windows\System\grDvCVT.exe
  2⤵
  PID:6888
- C:\Windows\System\VxTcXDR.exe
  C:\Windows\System\VxTcXDR.exe
  2⤵
  PID:7656
- C:\Windows\System\asipJAd.exe
  C:\Windows\System\asipJAd.exe
  2⤵
  PID:7172
- C:\Windows\System\deXwqKw.exe
  C:\Windows\System\deXwqKw.exe
  2⤵
  PID:7368
- C:\Windows\System\CDAPNMG.exe
  C:\Windows\System\CDAPNMG.exe
  2⤵
  PID:7348
- C:\Windows\System\JrvpxMc.exe
  C:\Windows\System\JrvpxMc.exe
  2⤵
  PID:8044
- C:\Windows\System\IYGNenV.exe
  C:\Windows\System\IYGNenV.exe
  2⤵
  PID:7916
- C:\Windows\System\QnPsigH.exe
  C:\Windows\System\QnPsigH.exe
  2⤵
  PID:7920
- C:\Windows\System\DFfjQet.exe
  C:\Windows\System\DFfjQet.exe
  2⤵
  PID:7644
- C:\Windows\System\EBScOaQ.exe
  C:\Windows\System\EBScOaQ.exe
  2⤵
  PID:8204
- C:\Windows\System\eKqdhQY.exe
  C:\Windows\System\eKqdhQY.exe
  2⤵
  PID:8220
- C:\Windows\System\cazgqJV.exe
  C:\Windows\System\cazgqJV.exe
  2⤵
  PID:8240
- C:\Windows\System\DaYmBvo.exe
  C:\Windows\System\DaYmBvo.exe
  2⤵
  PID:8272
- C:\Windows\System\YbOgvki.exe
  C:\Windows\System\YbOgvki.exe
  2⤵
  PID:8288
- C:\Windows\System\JUDxjfu.exe
  C:\Windows\System\JUDxjfu.exe
  2⤵
  PID:8308
- C:\Windows\System\kpSmTKf.exe
  C:\Windows\System\kpSmTKf.exe
  2⤵
  PID:8324
- C:\Windows\System\gXXmjnx.exe
  C:\Windows\System\gXXmjnx.exe
  2⤵
  PID:8344
- C:\Windows\System\bGUqNmn.exe
  C:\Windows\System\bGUqNmn.exe
  2⤵
  PID:8360
- C:\Windows\System\qNohGEq.exe
  C:\Windows\System\qNohGEq.exe
  2⤵
  PID:8376
- C:\Windows\System\yYTCdPi.exe
  C:\Windows\System\yYTCdPi.exe
  2⤵
  PID:8392
- C:\Windows\System\BRfRMIY.exe
  C:\Windows\System\BRfRMIY.exe
  2⤵
  PID:8408
- C:\Windows\System\qqCQmZI.exe
  C:\Windows\System\qqCQmZI.exe
  2⤵
  PID:8424
- C:\Windows\System\vZRIAqu.exe
  C:\Windows\System\vZRIAqu.exe
  2⤵
  PID:8440
- C:\Windows\System\NnUbvrd.exe
  C:\Windows\System\NnUbvrd.exe
  2⤵
  PID:8460
- C:\Windows\System\DbhNNrx.exe
  C:\Windows\System\DbhNNrx.exe
  2⤵
  PID:8480
- C:\Windows\System\xFPPQKk.exe
  C:\Windows\System\xFPPQKk.exe
  2⤵
  PID:8500
- C:\Windows\System\vneoQGR.exe
  C:\Windows\System\vneoQGR.exe
  2⤵
  PID:8520
- C:\Windows\System\sPURqMK.exe
  C:\Windows\System\sPURqMK.exe
  2⤵
  PID:8540
- C:\Windows\System\ODSzjSF.exe
  C:\Windows\System\ODSzjSF.exe
  2⤵
  PID:8560
- C:\Windows\System\NItUfnY.exe
  C:\Windows\System\NItUfnY.exe
  2⤵
  PID:8580
- C:\Windows\System\ouBeqGn.exe
  C:\Windows\System\ouBeqGn.exe
  2⤵
  PID:8600
- C:\Windows\System\DaUNwcv.exe
  C:\Windows\System\DaUNwcv.exe
  2⤵
  PID:8616
- C:\Windows\System\AXOYqqk.exe
  C:\Windows\System\AXOYqqk.exe
  2⤵
  PID:8632
- C:\Windows\System\XgKryec.exe
  C:\Windows\System\XgKryec.exe
  2⤵
  PID:8648
- C:\Windows\System\PdtkkZD.exe
  C:\Windows\System\PdtkkZD.exe
  2⤵
  PID:8668
- C:\Windows\System\oeGbXhF.exe
  C:\Windows\System\oeGbXhF.exe
  2⤵
  PID:8684
- C:\Windows\System\sXbJOWZ.exe
  C:\Windows\System\sXbJOWZ.exe
  2⤵
  PID:8704
- C:\Windows\System\urosCrw.exe
  C:\Windows\System\urosCrw.exe
  2⤵
  PID:8728
- C:\Windows\System\cuGRwhN.exe
  C:\Windows\System\cuGRwhN.exe
  2⤵
  PID:8748
- C:\Windows\System\dLlMAsD.exe
  C:\Windows\System\dLlMAsD.exe
  2⤵
  PID:8824
- C:\Windows\System\SDiESGy.exe
  C:\Windows\System\SDiESGy.exe
  2⤵
  PID:8840
- C:\Windows\System\RKifbys.exe
  C:\Windows\System\RKifbys.exe
  2⤵
  PID:8856
- C:\Windows\System\OcUFLyj.exe
  C:\Windows\System\OcUFLyj.exe
  2⤵
  PID:8884
- C:\Windows\System\VxqLcZO.exe
  C:\Windows\System\VxqLcZO.exe
  2⤵
  PID:8900
- C:\Windows\System\oemOnWx.exe
  C:\Windows\System\oemOnWx.exe
  2⤵
  PID:8916
- C:\Windows\System\bUttHcJ.exe
  C:\Windows\System\bUttHcJ.exe
  2⤵
  PID:8932
- C:\Windows\System\lySohPN.exe
  C:\Windows\System\lySohPN.exe
  2⤵
  PID:8948
- C:\Windows\System\ukQebGY.exe
  C:\Windows\System\ukQebGY.exe
  2⤵
  PID:8964
- C:\Windows\System\OEHlgxr.exe
  C:\Windows\System\OEHlgxr.exe
  2⤵
  PID:8980
- C:\Windows\System\YXxHCAw.exe
  C:\Windows\System\YXxHCAw.exe
  2⤵
  PID:8996
- C:\Windows\System\UXUbVzZ.exe
  C:\Windows\System\UXUbVzZ.exe
  2⤵
  PID:9012
- C:\Windows\System\lqoyYEd.exe
  C:\Windows\System\lqoyYEd.exe
  2⤵
  PID:9028
- C:\Windows\System\HgeZvOh.exe
  C:\Windows\System\HgeZvOh.exe
  2⤵
  PID:9056
- C:\Windows\System\KLWBktD.exe
  C:\Windows\System\KLWBktD.exe
  2⤵
  PID:9076
- C:\Windows\System\dYKIfrL.exe
  C:\Windows\System\dYKIfrL.exe
  2⤵
  PID:9100
- C:\Windows\System\LFQMMnL.exe
  C:\Windows\System\LFQMMnL.exe
  2⤵
  PID:9120
- C:\Windows\System\JdZGZbz.exe
  C:\Windows\System\JdZGZbz.exe
  2⤵
  PID:9136
- C:\Windows\System\EVolOTu.exe
  C:\Windows\System\EVolOTu.exe
  2⤵
  PID:9156
- C:\Windows\System\DgGtFUV.exe
  C:\Windows\System\DgGtFUV.exe
  2⤵
  PID:9172
- C:\Windows\System\TTgKNaM.exe
  C:\Windows\System\TTgKNaM.exe
  2⤵
  PID:9192
- C:\Windows\System\WKPqqCi.exe
  C:\Windows\System\WKPqqCi.exe
  2⤵
  PID:8416
- C:\Windows\System\BVUAOcd.exe
  C:\Windows\System\BVUAOcd.exe
  2⤵
  PID:8492
- C:\Windows\System\owiiWQs.exe
  C:\Windows\System\owiiWQs.exe
  2⤵
  PID:8532
- C:\Windows\System\npLrIOS.exe
  C:\Windows\System\npLrIOS.exe
  2⤵
  PID:8676
- C:\Windows\System\lrkUYfc.exe
  C:\Windows\System\lrkUYfc.exe
  2⤵
  PID:8640
- C:\Windows\System\iOvqbep.exe
  C:\Windows\System\iOvqbep.exe
  2⤵
  PID:8716
- C:\Windows\System\qfKAtxa.exe
  C:\Windows\System\qfKAtxa.exe
  2⤵
  PID:8768
- C:\Windows\System\IhfRNQM.exe
  C:\Windows\System\IhfRNQM.exe
  2⤵
  PID:8776
- C:\Windows\System\PnonALE.exe
  C:\Windows\System\PnonALE.exe
  2⤵
  PID:8796
- C:\Windows\System\zYryTbR.exe
  C:\Windows\System\zYryTbR.exe
  2⤵
  PID:8432
- C:\Windows\System\vhfdLXi.exe
  C:\Windows\System\vhfdLXi.exe
  2⤵
  PID:8212
- C:\Windows\System\IYDiYdr.exe
  C:\Windows\System\IYDiYdr.exe
  2⤵
  PID:8264
- C:\Windows\System\wBVSAwq.exe
  C:\Windows\System\wBVSAwq.exe
  2⤵
  PID:8336
- C:\Windows\System\jVDouCz.exe
  C:\Windows\System\jVDouCz.exe
  2⤵
  PID:8468
- C:\Windows\System\KbAeaPP.exe
  C:\Windows\System\KbAeaPP.exe
  2⤵
  PID:8516
- C:\Windows\System\TQEVlXa.exe
  C:\Windows\System\TQEVlXa.exe
  2⤵
  PID:8596
- C:\Windows\System\kLrovkS.exe
  C:\Windows\System\kLrovkS.exe
  2⤵
  PID:8660
- C:\Windows\System\qIFiLZq.exe
  C:\Windows\System\qIFiLZq.exe
  2⤵
  PID:8700
- C:\Windows\System\YLkwWmw.exe
  C:\Windows\System\YLkwWmw.exe
  2⤵
  PID:8816
- C:\Windows\System\cZeAAPK.exe
  C:\Windows\System\cZeAAPK.exe
  2⤵
  PID:8848
- C:\Windows\System\MPcoEzG.exe
  C:\Windows\System\MPcoEzG.exe
  2⤵
  PID:8832
- C:\Windows\System\xhmKDeW.exe
  C:\Windows\System\xhmKDeW.exe
  2⤵
  PID:8892
- C:\Windows\System\istQLiV.exe
  C:\Windows\System\istQLiV.exe
  2⤵
  PID:8908
- C:\Windows\System\fHeiXzp.exe
  C:\Windows\System\fHeiXzp.exe
  2⤵
  PID:8988
- C:\Windows\System\MaBPeWm.exe
  C:\Windows\System\MaBPeWm.exe
  2⤵
  PID:8992
- C:\Windows\System\TiGokNe.exe
  C:\Windows\System\TiGokNe.exe
  2⤵
  PID:9096
- C:\Windows\System\xrKcApn.exe
  C:\Windows\System\xrKcApn.exe
  2⤵
  PID:9008
- C:\Windows\System\kLpAmNS.exe
  C:\Windows\System\kLpAmNS.exe
  2⤵
  PID:9052
- C:\Windows\System\skLBaJf.exe
  C:\Windows\System\skLBaJf.exe
  2⤵
  PID:9092
- C:\Windows\System\HeFvACQ.exe
  C:\Windows\System\HeFvACQ.exe
  2⤵
  PID:9144
- C:\Windows\System\OfxwFmN.exe
  C:\Windows\System\OfxwFmN.exe
  2⤵
  PID:8452
- C:\Windows\System\uRxTUcM.exe
  C:\Windows\System\uRxTUcM.exe
  2⤵
  PID:8608
- C:\Windows\System\eiVwJcg.exe
  C:\Windows\System\eiVwJcg.exe
  2⤵
  PID:8300
- C:\Windows\System\uzawWwU.exe
  C:\Windows\System\uzawWwU.exe
  2⤵
  PID:8760
- C:\Windows\System\VMJNrOI.exe
  C:\Windows\System\VMJNrOI.exe
  2⤵
  PID:8592
- C:\Windows\System\ExNyWPA.exe
  C:\Windows\System\ExNyWPA.exe
  2⤵
  PID:8400
- C:\Windows\System\AOVcsan.exe
  C:\Windows\System\AOVcsan.exe
  2⤵
  PID:8252
- C:\Windows\System\zDXIeNb.exe
  C:\Windows\System\zDXIeNb.exe
  2⤵
  PID:8508
- C:\Windows\System\ixWhnzF.exe
  C:\Windows\System\ixWhnzF.exe
  2⤵
  PID:8296
- C:\Windows\System\JSStpQO.exe
  C:\Windows\System\JSStpQO.exe
  2⤵
  PID:8696
- C:\Windows\System\SDjvMLB.exe
  C:\Windows\System\SDjvMLB.exe
  2⤵
  PID:8852
- C:\Windows\System\ZPDRleh.exe
  C:\Windows\System\ZPDRleh.exe
  2⤵
  PID:8740
- C:\Windows\System\aqxXiBN.exe
  C:\Windows\System\aqxXiBN.exe
  2⤵
  PID:8864
- C:\Windows\System\tOhCbhf.exe
  C:\Windows\System\tOhCbhf.exe
  2⤵
  PID:8944
- C:\Windows\System\hnrQZaE.exe
  C:\Windows\System\hnrQZaE.exe
  2⤵
  PID:9004
- C:\Windows\System\CCLTmjc.exe
  C:\Windows\System\CCLTmjc.exe
  2⤵
  PID:9040
- C:\Windows\System\uVFuuae.exe
  C:\Windows\System\uVFuuae.exe
  2⤵
  PID:9024
- C:\Windows\System\jZBrDGq.exe
  C:\Windows\System\jZBrDGq.exe
  2⤵
  PID:9180
- C:\Windows\System\hiUkWjP.exe
  C:\Windows\System\hiUkWjP.exe
  2⤵
  PID:9204
- C:\Windows\System\wrIxqKH.exe
  C:\Windows\System\wrIxqKH.exe
  2⤵
  PID:9168
- C:\Windows\System\FBDoaPz.exe
  C:\Windows\System\FBDoaPz.exe
  2⤵
  PID:8384
- C:\Windows\System\NtYRAFd.exe
  C:\Windows\System\NtYRAFd.exe
  2⤵
  PID:8352
- C:\Windows\System\NTihRpe.exe
  C:\Windows\System\NTihRpe.exe
  2⤵
  PID:8304
- C:\Windows\System\NAgKojF.exe
  C:\Windows\System\NAgKojF.exe
  2⤵
  PID:8880
- C:\Windows\System\vXPfpfl.exe
  C:\Windows\System\vXPfpfl.exe
  2⤵
  PID:8548
- C:\Windows\System\DIXLUBu.exe
  C:\Windows\System\DIXLUBu.exe
  2⤵
  PID:8528
- C:\Windows\System\LyGNMTt.exe
  C:\Windows\System\LyGNMTt.exe
  2⤵
  PID:8248
- C:\Windows\System\IuZJChl.exe
  C:\Windows\System\IuZJChl.exe
  2⤵
  PID:8836
- C:\Windows\System\eQFjvAD.exe
  C:\Windows\System\eQFjvAD.exe
  2⤵
  PID:8200
- C:\Windows\System\GYQJkpo.exe
  C:\Windows\System\GYQJkpo.exe
  2⤵
  PID:8404
- C:\Windows\System\QuLXETm.exe
  C:\Windows\System\QuLXETm.exe
  2⤵
  PID:8656
- C:\Windows\System\svaqtgf.exe
  C:\Windows\System\svaqtgf.exe
  2⤵
  PID:8976
- C:\Windows\System\qHLNThU.exe
  C:\Windows\System\qHLNThU.exe
  2⤵
  PID:8260
- C:\Windows\System\MvHufaF.exe
  C:\Windows\System\MvHufaF.exe
  2⤵
  PID:8784
- C:\Windows\System\mBNbxEI.exe
  C:\Windows\System\mBNbxEI.exe
  2⤵
  PID:9116
- C:\Windows\System\shyGgba.exe
  C:\Windows\System\shyGgba.exe
  2⤵
  PID:9044
- C:\Windows\System\SmKZVJu.exe
  C:\Windows\System\SmKZVJu.exe
  2⤵
  PID:8572
- C:\Windows\System\mpteBHN.exe
  C:\Windows\System\mpteBHN.exe
  2⤵
  PID:8692
- C:\Windows\System\lnVbWvi.exe
  C:\Windows\System\lnVbWvi.exe
  2⤵
  PID:7824
- C:\Windows\System\eTSlsYz.exe
  C:\Windows\System\eTSlsYz.exe
  2⤵
  PID:9084
- C:\Windows\System\jMMmHVz.exe
  C:\Windows\System\jMMmHVz.exe
  2⤵
  PID:9228
- C:\Windows\System\CZWnNEC.exe
  C:\Windows\System\CZWnNEC.exe
  2⤵
  PID:9248
- C:\Windows\System\LklXCBO.exe
  C:\Windows\System\LklXCBO.exe
  2⤵
  PID:9264
- C:\Windows\System\vDQLDam.exe
  C:\Windows\System\vDQLDam.exe
  2⤵
  PID:9280
- C:\Windows\System\FzIOhdZ.exe
  C:\Windows\System\FzIOhdZ.exe
  2⤵
  PID:9296
- C:\Windows\System\pLJwVFn.exe
  C:\Windows\System\pLJwVFn.exe
  2⤵
  PID:9312
- C:\Windows\System\oJmylVV.exe
  C:\Windows\System\oJmylVV.exe
  2⤵
  PID:9340
- C:\Windows\System\lSNonQb.exe
  C:\Windows\System\lSNonQb.exe
  2⤵
  PID:9360
- C:\Windows\System\COcjSDi.exe
  C:\Windows\System\COcjSDi.exe
  2⤵
  PID:9376
- C:\Windows\System\tyFYrOp.exe
  C:\Windows\System\tyFYrOp.exe
  2⤵
  PID:9392
- C:\Windows\System\pmESUWs.exe
  C:\Windows\System\pmESUWs.exe
  2⤵
  PID:9408
- C:\Windows\System\NIIzBBt.exe
  C:\Windows\System\NIIzBBt.exe
  2⤵
  PID:9424
- C:\Windows\System\qaNFlzT.exe
  C:\Windows\System\qaNFlzT.exe
  2⤵
  PID:9440
- C:\Windows\System\xDfdDEN.exe
  C:\Windows\System\xDfdDEN.exe
  2⤵
  PID:9456
- C:\Windows\System\WrQCWSk.exe
  C:\Windows\System\WrQCWSk.exe
  2⤵
  PID:9472
- C:\Windows\System\dQfHFcq.exe
  C:\Windows\System\dQfHFcq.exe
  2⤵
  PID:9548
- C:\Windows\System\fosymxL.exe
  C:\Windows\System\fosymxL.exe
  2⤵
  PID:9572
- C:\Windows\System\KOQcVxq.exe
  C:\Windows\System\KOQcVxq.exe
  2⤵
  PID:9592
- C:\Windows\System\ShqdalI.exe
  C:\Windows\System\ShqdalI.exe
  2⤵
  PID:9608
- C:\Windows\System\CbYIQio.exe
  C:\Windows\System\CbYIQio.exe
  2⤵
  PID:9628
- C:\Windows\System\egbSZWi.exe
  C:\Windows\System\egbSZWi.exe
  2⤵
  PID:9656
- C:\Windows\System\EYgdSzP.exe
  C:\Windows\System\EYgdSzP.exe
  2⤵
  PID:9676
- C:\Windows\System\EOVSnxL.exe
  C:\Windows\System\EOVSnxL.exe
  2⤵
  PID:9692
- C:\Windows\System\wjzVJEe.exe
  C:\Windows\System\wjzVJEe.exe
  2⤵
  PID:9712
- C:\Windows\System\JVpHgzI.exe
  C:\Windows\System\JVpHgzI.exe
  2⤵
  PID:9728
- C:\Windows\System\PjeKSTk.exe
  C:\Windows\System\PjeKSTk.exe
  2⤵
  PID:9744
- C:\Windows\System\jTWZlGm.exe
  C:\Windows\System\jTWZlGm.exe
  2⤵
  PID:9768
- C:\Windows\System\jotAHJI.exe
  C:\Windows\System\jotAHJI.exe
  2⤵
  PID:9784
- C:\Windows\System\ouRZVtG.exe
  C:\Windows\System\ouRZVtG.exe
  2⤵
  PID:9800
- C:\Windows\System\RawDKCV.exe
  C:\Windows\System\RawDKCV.exe
  2⤵
  PID:9820
- C:\Windows\System\vMzNbFc.exe
  C:\Windows\System\vMzNbFc.exe
  2⤵
  PID:9836
- C:\Windows\System\yCIJohr.exe
  C:\Windows\System\yCIJohr.exe
  2⤵
  PID:9860
- C:\Windows\System\tjppBKc.exe
  C:\Windows\System\tjppBKc.exe
  2⤵
  PID:9880
- C:\Windows\System\gilrnhs.exe
  C:\Windows\System\gilrnhs.exe
  2⤵
  PID:9900
- C:\Windows\System\hGRZBjd.exe
  C:\Windows\System\hGRZBjd.exe
  2⤵
  PID:9924
- C:\Windows\System\oVTlbRl.exe
  C:\Windows\System\oVTlbRl.exe
  2⤵
  PID:9940
- C:\Windows\System\YdDjIKX.exe
  C:\Windows\System\YdDjIKX.exe
  2⤵
  PID:9956
- C:\Windows\System\KYKwqyP.exe
  C:\Windows\System\KYKwqyP.exe
  2⤵
  PID:9976
- C:\Windows\System\mDogczL.exe
  C:\Windows\System\mDogczL.exe
  2⤵
  PID:10024
- C:\Windows\System\MPUUVSt.exe
  C:\Windows\System\MPUUVSt.exe
  2⤵
  PID:10040
- C:\Windows\System\GnYCjGs.exe
  C:\Windows\System\GnYCjGs.exe
  2⤵
  PID:10056
- C:\Windows\System\tVfUuto.exe
  C:\Windows\System\tVfUuto.exe
  2⤵
  PID:10072
- C:\Windows\System\LQbBVIM.exe
  C:\Windows\System\LQbBVIM.exe
  2⤵
  PID:10088
- C:\Windows\System\ZrpQkSd.exe
  C:\Windows\System\ZrpQkSd.exe
  2⤵
  PID:10116
- C:\Windows\System\MLIioFf.exe
  C:\Windows\System\MLIioFf.exe
  2⤵
  PID:10132
- C:\Windows\System\EsWAHhu.exe
  C:\Windows\System\EsWAHhu.exe
  2⤵
  PID:10148
- C:\Windows\System\jdcWbKz.exe
  C:\Windows\System\jdcWbKz.exe
  2⤵
  PID:10168
- C:\Windows\System\pxbieQA.exe
  C:\Windows\System\pxbieQA.exe
  2⤵
  PID:10192
- C:\Windows\System\CNTHbHe.exe
  C:\Windows\System\CNTHbHe.exe
  2⤵
  PID:10208
- C:\Windows\System\srhNBMo.exe
  C:\Windows\System\srhNBMo.exe
  2⤵
  PID:10228
- C:\Windows\System\NSPEkDg.exe
  C:\Windows\System\NSPEkDg.exe
  2⤵
  PID:9128
- C:\Windows\System\CGWQomb.exe
  C:\Windows\System\CGWQomb.exe
  2⤵
  PID:9240
- C:\Windows\System\GIYIhIl.exe
  C:\Windows\System\GIYIhIl.exe
  2⤵
  PID:9308
- C:\Windows\System\ColFGvE.exe
  C:\Windows\System\ColFGvE.exe
  2⤵
  PID:9224
- C:\Windows\System\kTptzsn.exe
  C:\Windows\System\kTptzsn.exe
  2⤵
  PID:9292
- C:\Windows\System\PwgFMiZ.exe
  C:\Windows\System\PwgFMiZ.exe
  2⤵
  PID:9368
- C:\Windows\System\CoGIwFw.exe
  C:\Windows\System\CoGIwFw.exe
  2⤵
  PID:9432
- C:\Windows\System\xzinpbT.exe
  C:\Windows\System\xzinpbT.exe
  2⤵
  PID:9420
- C:\Windows\System\ndxOiiv.exe
  C:\Windows\System\ndxOiiv.exe
  2⤵
  PID:9468
- C:\Windows\System\HjaWUuo.exe
  C:\Windows\System\HjaWUuo.exe
  2⤵
  PID:9484
- C:\Windows\System\KYOaSdt.exe
  C:\Windows\System\KYOaSdt.exe
  2⤵
  PID:9512
- C:\Windows\System\pkJcBEv.exe
  C:\Windows\System\pkJcBEv.exe
  2⤵
  PID:9520
- C:\Windows\System\DcVihBF.exe
  C:\Windows\System\DcVihBF.exe
  2⤵
  PID:9584
- C:\Windows\System\IEpRiYq.exe
  C:\Windows\System\IEpRiYq.exe
  2⤵
  PID:9604
- C:\Windows\System\EPbkVtL.exe
  C:\Windows\System\EPbkVtL.exe
  2⤵
  PID:9644
- C:\Windows\System\KtliGfd.exe
  C:\Windows\System\KtliGfd.exe
  2⤵
  PID:9652
- C:\Windows\System\ZEgKCwb.exe
  C:\Windows\System\ZEgKCwb.exe
  2⤵
  PID:9700
- C:\Windows\System\OMPLPOj.exe
  C:\Windows\System\OMPLPOj.exe
  2⤵
  PID:9688
- C:\Windows\System\SJERPeZ.exe
  C:\Windows\System\SJERPeZ.exe
  2⤵
  PID:9780
- C:\Windows\System\OHRBtba.exe
  C:\Windows\System\OHRBtba.exe
  2⤵
  PID:9760
- C:\Windows\System\uOabmQu.exe
  C:\Windows\System\uOabmQu.exe
  2⤵
  PID:9808
- C:\Windows\System\ZaCesgl.exe
  C:\Windows\System\ZaCesgl.exe
  2⤵
  PID:9848
- C:\Windows\System\GrJityo.exe
  C:\Windows\System\GrJityo.exe
  2⤵
  PID:9888
- C:\Windows\System\iYBvTES.exe
  C:\Windows\System\iYBvTES.exe
  2⤵
  PID:9908
- C:\Windows\System\TvarQbF.exe
  C:\Windows\System\TvarQbF.exe
  2⤵
  PID:9964
- C:\Windows\System\gmSAzLB.exe
  C:\Windows\System\gmSAzLB.exe
  2⤵
  PID:9984
- C:\Windows\System\mxGzieY.exe
  C:\Windows\System\mxGzieY.exe
  2⤵
  PID:9992
- C:\Windows\System\eDatWio.exe
  C:\Windows\System\eDatWio.exe
  2⤵
  PID:10012
- C:\Windows\System\XMMykaE.exe
  C:\Windows\System\XMMykaE.exe
  2⤵
  PID:10080
- C:\Windows\System\tzgasET.exe
  C:\Windows\System\tzgasET.exe
  2⤵
  PID:10096
- C:\Windows\System\AjpDcPR.exe
  C:\Windows\System\AjpDcPR.exe
  2⤵
  PID:10100
- C:\Windows\System\UtuugBF.exe
  C:\Windows\System\UtuugBF.exe
  2⤵
  PID:10176
- C:\Windows\System\OaouhTe.exe
  C:\Windows\System\OaouhTe.exe
  2⤵
  PID:8772
- C:\Windows\System\ljLauCV.exe
  C:\Windows\System\ljLauCV.exe
  2⤵
  PID:10200
- C:\Windows\System\NCTMGgn.exe
  C:\Windows\System\NCTMGgn.exe
  2⤵
  PID:9220
- C:\Windows\System\oTIpKJX.exe
  C:\Windows\System\oTIpKJX.exe
  2⤵
  PID:10160
- C:\Windows\System\efLFAsZ.exe
  C:\Windows\System\efLFAsZ.exe
  2⤵
  PID:9244
- C:\Windows\System\kBJEust.exe
  C:\Windows\System\kBJEust.exe
  2⤵
  PID:9324
- C:\Windows\System\pxzSPwv.exe
  C:\Windows\System\pxzSPwv.exe
  2⤵
  PID:9388
- C:\Windows\System\SxeWUXF.exe
  C:\Windows\System\SxeWUXF.exe
  2⤵
  PID:9516
- C:\Windows\System\UrxcwJM.exe
  C:\Windows\System\UrxcwJM.exe
  2⤵
  PID:9500
- C:\Windows\System\BLeuHar.exe
  C:\Windows\System\BLeuHar.exe
  2⤵
  PID:9624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BBqAKJt.exe

Filesize
1.1MB

MD5
3c3934df836cadd836f24668c6cd6e06

SHA1
fc66c0089b5d7c8c4fbbd8327b66ceacbd2cfa3e

SHA256
43d9bbea15cfa9cba4389f501669fa38d5e214cc2e03c81bc09670f9e7b18860

SHA512
44eb5788e3916e059ca05e8b766c3a852685f4dd507511812c11d6510aa77a63549491f745f4af9f9d524ecc49d7a1511f7e939250516ed74326f437c05c8b04

Download Submit
C:\Windows\system\BdNiFIq.exe

Filesize
1.1MB

MD5
6ebbe9fa5004f9d401f47492e90fc566

SHA1
afad8d3d47b79ce548064a3340aaf024a7f3034b

SHA256
81a5a350768190ed9a03a371a34059567f023717696770844c9afd5998d7b9c1

SHA512
ed28e0a2c9dee8e4d6781298e415a2677b422f7dc337046bbeb861aab8ad381d0e6499ca53df1c3a4dc10a1f350ac61b0097903638d49b44f7b665d1416010ae

Download Submit
C:\Windows\system\GAHhHZZ.exe

Filesize
1.1MB

MD5
5f32520f723650f4bd5fd16662f8c70d

SHA1
a2eafae12e7db6e695291a9271e57ec1ecd07c7e

SHA256
a73186fad480fe1b62fd2eae34a36b7b503aca6f2875279a62d463376a577574

SHA512
39518e72cd387e6905d3fe00ec64b1fb6c0b4204fce0036dc13614416dd1fe6948d100fef3eb19865588ba886c1cad40093516b30f5827163698649e2b0594fd

Download Submit
C:\Windows\system\ItfdAZQ.exe

Filesize
1.1MB

MD5
1955c21dcc189cbc5d1c4870a4f4ef9f

SHA1
5cd639fe25103471a779b7ee31006fff2675ff4a

SHA256
4651fd70f131f3796b2c6ad82da86366339f7ad89faea93e17c1ace05c24b0c9

SHA512
4c75d3348d1225a7f3f972a2dbf535e3bc34cbdd12cd6028cd2c1bdbcccdf51fb0f62d32dcf8eca409aada899f102a35b9c69f113bea3a388082afd1d2e3b33f

Download Submit
C:\Windows\system\JeWMONq.exe

Filesize
1.1MB

MD5
a1eb29d0e2f06bb7dceee26f00aaa874

SHA1
4a1f498e7526b324081f9251663bbe32f3a7c027

SHA256
1e48aa1f49d23d34fe772d9c281dc2f157582568a9b7ab521fa703fe0e6353b8

SHA512
d5ed154fe5965c5f98c79fc84b76e26a3e6746f76f14d6a446e303809100354bc2d236ad5b49d5f37353ae5a3d880d0bc57c48b6a7a86a7637b1436f8a2f5c4a

Download Submit
C:\Windows\system\KIFUpjF.exe

Filesize
1.1MB

MD5
8342cbe01d5be36676eb1e9867a71324

SHA1
bc6a7ef6cf3bb6beca9c1b2bdee8e33b4d88d898

SHA256
f32674db4dd7b597f93bb0f016a96a3ef9190c79912a306de11c2eaef80f3a0b

SHA512
67662ca10bb9803541f4d4a8e92ee01db82658c730a0b9b8d850588bbac8f23155fc2cf1bfc87c10232eb1706442516b641f10ec6bfd6a3854baa0f605ab8768

Download Submit
C:\Windows\system\KbSKunj.exe

Filesize
1.1MB

MD5
4e31fbcf8bf34927918a477345faba62

SHA1
c5da1f4266de1180515abd6f02d3b44ba1f79c0f

SHA256
5e187528f42fac28c196d2e35af0a44c22b2e850bf09791f3fe225fda5bc80ed

SHA512
f3cd27a1ebcd031036dff11a7c06662fe31b880f12d05372ba47b654abaa8a0415e47d7821a580d23d50d8e4b4ed4a0082c3739a6f537f2cf7d092b2e44a1696

Download Submit
C:\Windows\system\PCOnJeT.exe

Filesize
1.1MB

MD5
aa93754ba3ea3acda72908b9c060a40e

SHA1
de83d42434dada3191e80e2acac548a039aa77e5

SHA256
82501fcf113fbeec8b6f693815e44a9417f25b3ef79d47cb9b7005ce9a9025a7

SHA512
354265f5586668ff42878a1907f6978430525733c5fda0a06808f0fee1e6ef39ffc6812d6260ecb5f513b4aaa7a960cc5339aad0b7581ba0a9b46212215083b4

Download Submit
C:\Windows\system\PqjEshj.exe

Filesize
1.1MB

MD5
b78f711c75b9ac96381f978a57279242

SHA1
0bee9789285aea3d34f787355ffbd960bbb1c9fc

SHA256
381edf6e0e8d45b98047026005647bf594feb6d6c237e90434e65f04adf89722

SHA512
783a52e24bb1e1a6a0be73e81151df7d01cd7448991634c31ec15fdfa618391478e678b6ad385bf34ae6751169c19bba5da8e1bcb9d5cd975f634c6d6bc6d1a3

Download Submit
C:\Windows\system\ZRRuKkl.exe

Filesize
1.1MB

MD5
699fa95752bab8d442f51abbe2c37758

SHA1
f15f2b1f59af6567ea5773ab0d73b0657eb4e706

SHA256
160dd7b4a4fb4ecb168dafa02a24c6509d5ef07fce27c99fdca2332a28a27f57

SHA512
b78aff38a5e02133c5174db20789561dab0ff3d2edd297a5659f3b36669b090928715496caaf3bdb55d89bb35092323f4d8e827abc7bdb9046a197c21a52059f

Download Submit
C:\Windows\system\ZtxjlrY.exe

Filesize
1.1MB

MD5
3e2cd280db601c18b3336c7200b1f6e7

SHA1
26fe3563e2c5333bce249c5af66f2c9a39e59f73

SHA256
6768501674f989da372f9e09326931689d971d1c3f64a952d42d6efc7729ccb0

SHA512
48502b8230b5a9ff6db1c9840e7d747fc7aa9311e74d06d8951a37a49537ad91e61f959406494d2c2ddd4d7cefdb4944e7764e06f5d2c77fb9c6accb9b927ccc

Download Submit
C:\Windows\system\aEokwon.exe

Filesize
1.1MB

MD5
c0dfc6644902037cc70e6990f0b3f334

SHA1
bbae209dfbb05e08a746e315198f366df457b5e3

SHA256
118978424712e0009a75c6e5de2e912bf467d4922dcb6788812439b01ccc1ff7

SHA512
29d19bc190e537546f3f85337e4f3427fd8b72114b75cb27ecae57c594c600c86397dfa828ab258de31a056a17ee55a196646718895e0ad1cea040bbb7add55f

Download Submit
C:\Windows\system\awnBLCG.exe

Filesize
1.1MB

MD5
3212664c7cfb4ecfc9ce0f2ec269625e

SHA1
01fb868d68084fca65ffd430e5f9277fc65fa7b2

SHA256
3a9bc423453c5b533635c017e707c5784fb1361734100f151a7927be452105b3

SHA512
37d36459413536249f7ac562bb1dce779696ffe74e85a40c8b892e96ef829d8d33d588e7552287475de5dc91446e177d4dec33983034361ed711a666974e87b7

Download Submit
C:\Windows\system\cEVUfpR.exe

Filesize
1.1MB

MD5
77d038ac1084abcf069eb2ba8b50e325

SHA1
b60dba44bc68e70db3a505afc598015238ae9aac

SHA256
fa9af6097122a5385b80c8d1ed17fa369484aea516035064a118cb58642a249d

SHA512
872393924930ad090eaf4030eab65fc7380c16de1e6bd9c3ead1931ad08d4ae53e99f46d59789180c4392c492d7bd40f69bfea905f3e4d4329f7dc63d815bcd0

Download Submit
C:\Windows\system\fXPSJYG.exe

Filesize
1.1MB

MD5
14cc5380ee6884ff9f8f28d41f4417f5

SHA1
92168fc98ae88b169bc8abd4ac681e246d410fbe

SHA256
7882578ef47d24833c5f4708e2f897534f10ff18771d43f341be510ca6b86402

SHA512
9727cb9870026bc6b9022ef35e0ec2f5ff8867faa5fa19f9cefceee3625e77fccd64f3e37a44b5f47f6312dbf53dfcbe4ad0dea3ea9520c4bded22efae64c4e2

Download Submit
C:\Windows\system\fYGvDOO.exe

Filesize
1.1MB

MD5
ae5acd5f16532a3d3927615748f67f33

SHA1
52ab491c19ceb63b4a9d607059a49aa7d3f8b1c3

SHA256
d1f0ee7e621ab4af6c5f4cd0ccc53df1f0b828635505f6bfaffb490880e50918

SHA512
24fdae32957e70cac28c5fceea3218eeeb412fd509e6d51b495069309db52f50e7485443a1a4885057a4a1288f4e720be60052969b951c091fef94ac5c0532b6

Download Submit
C:\Windows\system\hWeopJF.exe

Filesize
1.1MB

MD5
cd2fe5ecbe0c7ee4ef37dc3ea071b2d7

SHA1
c8dd7bc2553f02a3a8e9010f491583fb77da8d44

SHA256
0baa2af49c6cd96368150831b7520ba351965bb412737704d34425e76327736c

SHA512
ecd7474e8eb7cd00a256aed7c1132b96df8501420b048b53318b75e7808455cbcf10d7dfdb466aeddc85fbf9e5ab1e6d6227212469552e50cf71750d9a666f6b

Download Submit
C:\Windows\system\iOLJPhp.exe

Filesize
1.1MB

MD5
83e4223bf9dac10ea56bae24337c1cd7

SHA1
a0a1d4c1526b8da68bb62b93014f346e506349d2

SHA256
7026c02099b83853713e7e68491a4ef038b4881f263ebc4427a13149b1828d9e

SHA512
43d8c9f784a75bbfcad1086aeec7927b64d123d68754a922c479a0bfe10784c68c43b99203c651e91286c650f160293a36d0c894f8cffeac025c4456d031d3ac

Download Submit
C:\Windows\system\iflJkAi.exe

Filesize
1.1MB

MD5
6aee3086cfff6a681079f4a4e7b7b061

SHA1
fb2bcac5799615ebffa0f24fa64fe23c77a23f9e

SHA256
1700da647de63c59b6d46dd72cb962a87c6080946d74fb2213a304e257a69f6a

SHA512
40275d6eaacbf3e1de565af23ee41208ed3b2fbbb23bb50ef109f9644b8a696de8f8f57cbe35a9693adea0470bad8178e17b491bd18fae312622417b57837bbc

Download Submit
C:\Windows\system\kcpcChu.exe

Filesize
1.1MB

MD5
0017c24d30babdc28feffc941f05bd25

SHA1
3425973fdc13b677a9f228cd1539fdd7cdcbf634

SHA256
759e89cb2b64081b46cbe9d64e53bcdc6ec6677873f27c0fb7bfd7d565d31c27

SHA512
475e14005d586a4aae4867f46eecd62251d5e5a772d07354df3ab20cf289e178f3237511a31126c64eb48368318cc883e0e239a3e020c16b3fa1ca1223df039d

Download Submit
C:\Windows\system\khsxMhC.exe

Filesize
1.1MB

MD5
b7cdadd0097f60bc7f3aec134c8f8a94

SHA1
d39ba44c72773ce1081b7862fe533a260aa5a7da

SHA256
2d3f6bfd78890038ab3cba46056bca0db287cd20d3c1b93b349dfecf1eff11da

SHA512
ec85d115f910cb049f995a44509d92ae194d1bb2a3ce86c6c84f43f636cdbf3fbfe8edf42185b89091fa15fdbc97b424d646860692bd75533e2ca604cd34706b

Download Submit
C:\Windows\system\lKfXuqT.exe

Filesize
1.1MB

MD5
38ba82117ad496bfc0065002d7bd9750

SHA1
a928f40cd7147e693aeaabb12ec5f7335990cfd0

SHA256
8c84d96bdc215ea010a26231b05a761164e40e4eab384ef8f984aea1696d1b07

SHA512
238761186444670f092d4ce36b775fa483f31c19ff3bd12619fcace98d8a5336b08fc827b31f444b74dbac86907d99413beebff883c7f37302504a195df0c460

Download Submit
C:\Windows\system\nHJdWIp.exe

Filesize
1.1MB

MD5
a05d329884d91c3776bcba4401c8c6b8

SHA1
5bf74268a66d8730b1fa96c9e6789d63d50d5d4e

SHA256
c1e5e17e03261016f97cd1d1e88fb140e96c4652d28a221a53e237b82d5f2942

SHA512
17dbd457bcaaa3d873c6215c72f340b7d77ad0ca04e21f1e80fc9e86079ba8e2a35cbcc1dcd7591bad88fc2c91fcae9502528cf43ffb86646319f8cf33414aa5

Download Submit
C:\Windows\system\pkbnARU.exe

Filesize
1.1MB

MD5
03a33f4b7376e59d81dcd5db7e8f9f1a

SHA1
ab8e2870f469c10fc556f4f8e5645199e20ec02b

SHA256
5afc4488d22756469cc59e2872f8b79bf9605edc163bfe181d7fb1a0db1acda3

SHA512
1a760efd0c3a548b3b70757b54af5dbc6faf67d84f7e1375fdf803ced215454d1da06e14361499fbe08d43c3b9b2dce52aa0b9b7bd4ad1966be325714ecdaac4

Download Submit
C:\Windows\system\rbjFGmE.exe

Filesize
1.1MB

MD5
ee05e8af6b1245f6f37af0a7342ff77e

SHA1
93f7be3e7317041cdcdcb6f7e89fdcc11bfbdc44

SHA256
fee6c4faa60e9e1eb704fec176825e3a3eb14829dd5868851769445b1674da46

SHA512
15c8cfacb8c44e8eafaba0122fde09b215043222e4f1449a6df7c6a24e641973ed73b369dba1427e4f4e6bac332ad3bed15c482a24b5d7a3ec318206844df949

Download Submit
C:\Windows\system\rzAdJpw.exe

Filesize
1.1MB

MD5
4134a8be14f024a17d6a9a90ee2d46bb

SHA1
b64747da00e9fba8d77e37c8ded24c815ecb5d5a

SHA256
e9ddf0f44033039bc637fa57a3fbbf837be547b1c0116e152e2ae0d5725da9ab

SHA512
49e676fa063d5fdd2ee31cac046c22fc4526db8ee23c2b6f64e88d25f61eaaa7667862f10d033e2339dd0da8249611eac6a2baa0b44aa6e7ca9e3243255176f3

Download Submit
C:\Windows\system\xnlzSmT.exe

Filesize
1.1MB

MD5
5baf2176ef183fe42981c4806ed01222

SHA1
2d0b6d4c4accbe8749f467d103d2519260b7b102

SHA256
c9494e98c7222d1c7b96448bbe15b0cd5e2e755714e6c6a35057b66a4e010b6c

SHA512
5146f768e63276c797762d2f582fbd1f401618491d9dab0ffbc390830e03726c563e99728d43f8e7347ede449b85b93c29f291a7a7b2bd9c59a298b27b6fc9bf

Download Submit
C:\Windows\system\yedtGko.exe

Filesize
1.1MB

MD5
97acce0efa3894311a43574bfaed9359

SHA1
9a89a058df7c4df0f682505a17f5d9ca1ca93cfb

SHA256
af09f5f28ecaf26f2a8874c6f77626148bfa2332c5771e60cf81cf62912905c3

SHA512
e491481c04e754c8424f1f4a36b394b2c3a3662cd8e72e71866e1f5407626d6cb7144f2d007145fb3be8af02516defe65fab2975bd82d260604da83e24e8b4fe

Download Submit
\Windows\system\KWHVXjm.exe

Filesize
1.1MB

MD5
b71d9e13cbbe4c2b58025d8f05e7e956

SHA1
f59830976497f957f32abed18e7fd8de85d9128b

SHA256
0d84002e33bca7cd2f714f8de3788b81643c2f522d9dcaae7838bcf7f20e84c6

SHA512
9c4f64e0e3cf8110b899a5ba26e1c03af9be39d90eb9b95f5d5c78490510b8e1da610b9193b3decd778498cea28ec6f6b2554f624e6dc12350a1f687e08cd2b3

Download Submit
\Windows\system\ZlrSRZT.exe

Filesize
1.1MB

MD5
c935c12f86dd9a0bd3de297723aeb6c8

SHA1
0c11617a818b0562fc704702d3efc1a4988e6829

SHA256
6f4efc891fdeadebc8dc5e949b644e37cc2db16d05ffe54a04bc70d3308c3e41

SHA512
f3921cfc18ab87f5f231bec7cf26ec0c98fa48e989964c16c9d22dc5774d2972c8031ade612d207d110e42ef061f7c6485292af9a5547804d7453570ce44f073

Download Submit
\Windows\system\cAlGbPp.exe

Filesize
1.1MB

MD5
7e0b73fe912c744065df6caeb44875e1

SHA1
41ca1f2006b667d74e0baffed62c18639a3314c9

SHA256
097983e98652dad2e357cac19ce6d2fa018d75c05743a090568af70fd25f07ec

SHA512
0a09d7a271e5af1886d2ea88e59dc1279c6ab1637e5bbe491cd8962837e6b1eb85ce166a81b27927e8982b44ae37257760b71a7c183314d50ab0b7fd13372144

Download Submit
\Windows\system\uActEZs.exe

Filesize
1.1MB

MD5
a69ed01f08b91f25e428046493c60acd

SHA1
69c7cfecfc68808fd186fbd8a21fd1537921f704

SHA256
24a432a1202936265bcd25c7c71780a8b8f43f6759f36249170895059466d624

SHA512
534039a0d1c385ce5706020025a5dc0bc0eabc4c6f78084dcb4d34537c0516b350af7e3d38e75e41ab54dd0a88021833f400b6b799ce48fd64515733333f06e2

Download Submit
memory/2592-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download