xmrig | af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
Size

1.4MB
MD5

9678cc7e5ff09215d7bcbce83336829c
SHA1

3a96b85339cb4cfee7e941b9f09f0512eeafc11c
SHA256

af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc
SHA512

877604fff65003016fe006c9656c8d1ae4657c673c76268f4b7832b85705d3d9996a259f1f5e55e10979414311edc4c6d09b37b6255d9ea45419a6dba79ce25b
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbci:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5w

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001227e-2.dat	xmrig
behavioral1/files/0x0008000000016d0e-9.dat	xmrig
behavioral1/files/0x0008000000016d18-13.dat	xmrig
behavioral1/files/0x0008000000016d21-18.dat	xmrig
behavioral1/files/0x0007000000016d3a-25.dat	xmrig
behavioral1/files/0x0007000000016d42-30.dat	xmrig
behavioral1/files/0x0006000000018683-37.dat	xmrig
behavioral1/files/0x00050000000186e4-41.dat	xmrig
behavioral1/files/0x0005000000018728-57.dat	xmrig
behavioral1/files/0x0005000000018784-63.dat	xmrig
behavioral1/files/0x0005000000019350-97.dat	xmrig
behavioral1/files/0x000500000001941e-113.dat	xmrig
behavioral1/files/0x000500000001944f-129.dat	xmrig
behavioral1/files/0x0005000000019441-125.dat	xmrig
behavioral1/files/0x0005000000019431-121.dat	xmrig
behavioral1/files/0x0005000000019427-117.dat	xmrig
behavioral1/files/0x00050000000193e1-109.dat	xmrig
behavioral1/files/0x00050000000193c2-105.dat	xmrig
behavioral1/files/0x00050000000193b4-101.dat	xmrig
behavioral1/files/0x0005000000019334-93.dat	xmrig
behavioral1/files/0x0005000000019282-89.dat	xmrig
behavioral1/files/0x0005000000019261-85.dat	xmrig
behavioral1/files/0x000500000001925e-81.dat	xmrig
behavioral1/files/0x0006000000019023-77.dat	xmrig
behavioral1/files/0x00050000000187a5-73.dat	xmrig
behavioral1/files/0x000500000001878f-69.dat	xmrig
behavioral1/files/0x000500000001873d-61.dat	xmrig
behavioral1/files/0x00050000000186fd-53.dat	xmrig
behavioral1/files/0x00050000000186ee-49.dat	xmrig
behavioral1/files/0x00050000000186ea-45.dat	xmrig
behavioral1/files/0x0008000000016d5e-34.dat	xmrig
behavioral1/files/0x0007000000016d31-22.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2688	rjaZHAA.exe
2848	GwRgkxu.exe
2648	dWcOJCl.exe
2556	lEEIYVw.exe
1592	LeMUYsI.exe
2584	NDcWJYQ.exe
2544	fyKWaMk.exe
2604	srVoaGg.exe
2252	XRIrbpk.exe
2704	ZfXasvY.exe
572	odulmgX.exe
584	xtipyHQ.exe
2084	fyayqdX.exe
2072	qmdhwFY.exe
2628	qLMdWTS.exe
2068	YpnisJv.exe
1600	mWqliLQ.exe
2900	jTiLWzk.exe
2496	pYOiTgr.exe
2600	hrjzqrb.exe
2912	EvqojUr.exe
2820	sesNOnq.exe
2880	vECMeEi.exe
2916	sHdbOQs.exe
2944	wqbtmbx.exe
1564	RgmEvEw.exe
1736	mNEgllQ.exe
1752	UoMNJCL.exe
2092	VERjGfY.exe
1452	QrtrXZc.exe
1856	gUobQkP.exe
1976	NKrjojq.exe
2340	YYLMIyt.exe
2488	maEhZzE.exe
1888	XZrCMqn.exe
2992	AQmddEB.exe
2392	ukFzVKR.exe
468	nEDFEhT.exe
1716	gZvGLeV.exe
1420	cBfHKcQ.exe
1800	TcOaIIj.exe
2256	Bdaajut.exe
2400	uBJKzsV.exe
676	WgaEeCJ.exe
1112	YRVjfQd.exe
2120	HjxJacl.exe
1964	hiBzUjx.exe
2044	cAZzCBg.exe
852	oUerRvH.exe
968	UXEKCgk.exe
1548	mroJzHE.exe
688	RSNRCKH.exe
1732	xFxazeN.exe
1296	wtpsymz.exe
276	RTLhlOG.exe
1196	mvAExRS.exe
1660	UQXgPou.exe
920	hptiAVg.exe
628	fjYjIAK.exe
568	jVSIlsZ.exe
1712	QYmVGMk.exe
2284	zEMyfgx.exe
272	sdQVImg.exe
2452	aYXftfP.exe

Loads dropped DLL 64 IoCs

pid	Process
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FMMSLmn.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\FfxLyig.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ehotwOh.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\NlsqYbR.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\udmDHcK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\CdhfHGG.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\QQNgWWg.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\GFpydGT.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\qzEXVCM.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\TNKdwSH.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\weakEEm.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\VTwzSjp.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\wqbtmbx.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\QChqLdN.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\cfKGwii.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ksTQARv.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\SpFRLPG.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xlsHyxB.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\pdiGMNY.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\iYhfLhO.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\FvecYEx.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\FHQKTCF.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ZGZsFJP.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\NDjiYHO.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\cZerzNX.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\VuVGErl.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\kzZMpit.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\bHvkwHJ.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\HIXlVib.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\TyjrqpP.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\EQfGYIJ.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\CnWPKVH.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\lsukdxb.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\hDHCnsH.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\OJkavsz.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xdEHsAh.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\DLDGDwK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\aClrEGo.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\MsvgobI.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\HjFymTw.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\srVoaGg.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\VOwvNnL.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\NsCdcgX.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\AZKJvWM.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\nEDFEhT.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\CvFXVDW.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\ImcVgZq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\WOZULiq.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\YECKhIo.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\lrlsGWM.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\KvjlBat.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\uxKwDFw.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\oUerRvH.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\yOnOyZm.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\xqzqhPS.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\oSycrPO.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\XOWdMYl.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\JEuQvkS.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\buTmixI.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\RDPdJCV.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\QqatonK.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\MnEzOrN.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\zQyadMa.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
File created	C:\Windows\System\cRITSsR.exe	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2688	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	31
PID 2728 wrote to memory of 2688	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	31
PID 2728 wrote to memory of 2688	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	31
PID 2728 wrote to memory of 2848	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	32
PID 2728 wrote to memory of 2848	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	32
PID 2728 wrote to memory of 2848	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	32
PID 2728 wrote to memory of 2648	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	33
PID 2728 wrote to memory of 2648	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	33
PID 2728 wrote to memory of 2648	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	33
PID 2728 wrote to memory of 2556	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	34
PID 2728 wrote to memory of 2556	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	34
PID 2728 wrote to memory of 2556	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	34
PID 2728 wrote to memory of 1592	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	35
PID 2728 wrote to memory of 1592	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	35
PID 2728 wrote to memory of 1592	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	35
PID 2728 wrote to memory of 2584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	36
PID 2728 wrote to memory of 2584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	36
PID 2728 wrote to memory of 2584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	36
PID 2728 wrote to memory of 2544	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	37
PID 2728 wrote to memory of 2544	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	37
PID 2728 wrote to memory of 2544	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	37
PID 2728 wrote to memory of 2604	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	38
PID 2728 wrote to memory of 2604	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	38
PID 2728 wrote to memory of 2604	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	38
PID 2728 wrote to memory of 2252	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	39
PID 2728 wrote to memory of 2252	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	39
PID 2728 wrote to memory of 2252	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	39
PID 2728 wrote to memory of 2704	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	40
PID 2728 wrote to memory of 2704	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	40
PID 2728 wrote to memory of 2704	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	40
PID 2728 wrote to memory of 572	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	41
PID 2728 wrote to memory of 572	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	41
PID 2728 wrote to memory of 572	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	41
PID 2728 wrote to memory of 584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	42
PID 2728 wrote to memory of 584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	42
PID 2728 wrote to memory of 584	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	42
PID 2728 wrote to memory of 2084	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	43
PID 2728 wrote to memory of 2084	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	43
PID 2728 wrote to memory of 2084	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	43
PID 2728 wrote to memory of 2072	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	44
PID 2728 wrote to memory of 2072	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	44
PID 2728 wrote to memory of 2072	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	44
PID 2728 wrote to memory of 2628	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	45
PID 2728 wrote to memory of 2628	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	45
PID 2728 wrote to memory of 2628	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	45
PID 2728 wrote to memory of 2068	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	46
PID 2728 wrote to memory of 2068	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	46
PID 2728 wrote to memory of 2068	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	46
PID 2728 wrote to memory of 1600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	47
PID 2728 wrote to memory of 1600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	47
PID 2728 wrote to memory of 1600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	47
PID 2728 wrote to memory of 2900	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	48
PID 2728 wrote to memory of 2900	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	48
PID 2728 wrote to memory of 2900	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	48
PID 2728 wrote to memory of 2496	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	49
PID 2728 wrote to memory of 2496	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	49
PID 2728 wrote to memory of 2496	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	49
PID 2728 wrote to memory of 2600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	50
PID 2728 wrote to memory of 2600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	50
PID 2728 wrote to memory of 2600	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	50
PID 2728 wrote to memory of 2912	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	51
PID 2728 wrote to memory of 2912	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	51
PID 2728 wrote to memory of 2912	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	51
PID 2728 wrote to memory of 2820	2728	af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe	52

C:\Users\Admin\AppData\Local\Temp\af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe
"C:\Users\Admin\AppData\Local\Temp\af02a091bf1898cb4d9cbec6621238fba6b195fba1e00bbfaff038baaf6dd4dc.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System\rjaZHAA.exe
  C:\Windows\System\rjaZHAA.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\GwRgkxu.exe
  C:\Windows\System\GwRgkxu.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\dWcOJCl.exe
  C:\Windows\System\dWcOJCl.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\lEEIYVw.exe
  C:\Windows\System\lEEIYVw.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\LeMUYsI.exe
  C:\Windows\System\LeMUYsI.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\NDcWJYQ.exe
  C:\Windows\System\NDcWJYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\fyKWaMk.exe
  C:\Windows\System\fyKWaMk.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\srVoaGg.exe
  C:\Windows\System\srVoaGg.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\XRIrbpk.exe
  C:\Windows\System\XRIrbpk.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ZfXasvY.exe
  C:\Windows\System\ZfXasvY.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\odulmgX.exe
  C:\Windows\System\odulmgX.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\xtipyHQ.exe
  C:\Windows\System\xtipyHQ.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\fyayqdX.exe
  C:\Windows\System\fyayqdX.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qmdhwFY.exe
  C:\Windows\System\qmdhwFY.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qLMdWTS.exe
  C:\Windows\System\qLMdWTS.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\YpnisJv.exe
  C:\Windows\System\YpnisJv.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\mWqliLQ.exe
  C:\Windows\System\mWqliLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\jTiLWzk.exe
  C:\Windows\System\jTiLWzk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\pYOiTgr.exe
  C:\Windows\System\pYOiTgr.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\hrjzqrb.exe
  C:\Windows\System\hrjzqrb.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\EvqojUr.exe
  C:\Windows\System\EvqojUr.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\sesNOnq.exe
  C:\Windows\System\sesNOnq.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\vECMeEi.exe
  C:\Windows\System\vECMeEi.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\sHdbOQs.exe
  C:\Windows\System\sHdbOQs.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wqbtmbx.exe
  C:\Windows\System\wqbtmbx.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\RgmEvEw.exe
  C:\Windows\System\RgmEvEw.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\mNEgllQ.exe
  C:\Windows\System\mNEgllQ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\UoMNJCL.exe
  C:\Windows\System\UoMNJCL.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\VERjGfY.exe
  C:\Windows\System\VERjGfY.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\QrtrXZc.exe
  C:\Windows\System\QrtrXZc.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\gUobQkP.exe
  C:\Windows\System\gUobQkP.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\NKrjojq.exe
  C:\Windows\System\NKrjojq.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\YYLMIyt.exe
  C:\Windows\System\YYLMIyt.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\maEhZzE.exe
  C:\Windows\System\maEhZzE.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\XZrCMqn.exe
  C:\Windows\System\XZrCMqn.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\AQmddEB.exe
  C:\Windows\System\AQmddEB.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ukFzVKR.exe
  C:\Windows\System\ukFzVKR.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\nEDFEhT.exe
  C:\Windows\System\nEDFEhT.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\gZvGLeV.exe
  C:\Windows\System\gZvGLeV.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\cBfHKcQ.exe
  C:\Windows\System\cBfHKcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\TcOaIIj.exe
  C:\Windows\System\TcOaIIj.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\Bdaajut.exe
  C:\Windows\System\Bdaajut.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\uBJKzsV.exe
  C:\Windows\System\uBJKzsV.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\WgaEeCJ.exe
  C:\Windows\System\WgaEeCJ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\YRVjfQd.exe
  C:\Windows\System\YRVjfQd.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\HjxJacl.exe
  C:\Windows\System\HjxJacl.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\hiBzUjx.exe
  C:\Windows\System\hiBzUjx.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cAZzCBg.exe
  C:\Windows\System\cAZzCBg.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\oUerRvH.exe
  C:\Windows\System\oUerRvH.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\UXEKCgk.exe
  C:\Windows\System\UXEKCgk.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\mroJzHE.exe
  C:\Windows\System\mroJzHE.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\RSNRCKH.exe
  C:\Windows\System\RSNRCKH.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\xFxazeN.exe
  C:\Windows\System\xFxazeN.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\wtpsymz.exe
  C:\Windows\System\wtpsymz.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\RTLhlOG.exe
  C:\Windows\System\RTLhlOG.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\mvAExRS.exe
  C:\Windows\System\mvAExRS.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\UQXgPou.exe
  C:\Windows\System\UQXgPou.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\hptiAVg.exe
  C:\Windows\System\hptiAVg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\fjYjIAK.exe
  C:\Windows\System\fjYjIAK.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jVSIlsZ.exe
  C:\Windows\System\jVSIlsZ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\QYmVGMk.exe
  C:\Windows\System\QYmVGMk.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\zEMyfgx.exe
  C:\Windows\System\zEMyfgx.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\sdQVImg.exe
  C:\Windows\System\sdQVImg.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\aYXftfP.exe
  C:\Windows\System\aYXftfP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\AFHTWCH.exe
  C:\Windows\System\AFHTWCH.exe
  2⤵
  PID:2324
- C:\Windows\System\KtFatHj.exe
  C:\Windows\System\KtFatHj.exe
  2⤵
  PID:3012
- C:\Windows\System\bmAeggl.exe
  C:\Windows\System\bmAeggl.exe
  2⤵
  PID:2504
- C:\Windows\System\sxXKHpM.exe
  C:\Windows\System\sxXKHpM.exe
  2⤵
  PID:1240
- C:\Windows\System\CeHRcJZ.exe
  C:\Windows\System\CeHRcJZ.exe
  2⤵
  PID:2464
- C:\Windows\System\sqIvITP.exe
  C:\Windows\System\sqIvITP.exe
  2⤵
  PID:908
- C:\Windows\System\vDLlgDD.exe
  C:\Windows\System\vDLlgDD.exe
  2⤵
  PID:2448
- C:\Windows\System\DKwcQKq.exe
  C:\Windows\System\DKwcQKq.exe
  2⤵
  PID:3024
- C:\Windows\System\PNRuLRp.exe
  C:\Windows\System\PNRuLRp.exe
  2⤵
  PID:2764
- C:\Windows\System\GqerrLv.exe
  C:\Windows\System\GqerrLv.exe
  2⤵
  PID:2640
- C:\Windows\System\rUYjvBm.exe
  C:\Windows\System\rUYjvBm.exe
  2⤵
  PID:1536
- C:\Windows\System\bqAKWCX.exe
  C:\Windows\System\bqAKWCX.exe
  2⤵
  PID:2656
- C:\Windows\System\CxuLjwQ.exe
  C:\Windows\System\CxuLjwQ.exe
  2⤵
  PID:2836
- C:\Windows\System\YtUuKpl.exe
  C:\Windows\System\YtUuKpl.exe
  2⤵
  PID:2796
- C:\Windows\System\wvXfymW.exe
  C:\Windows\System\wvXfymW.exe
  2⤵
  PID:2540
- C:\Windows\System\OtaFVTy.exe
  C:\Windows\System\OtaFVTy.exe
  2⤵
  PID:2212
- C:\Windows\System\fBPzHHx.exe
  C:\Windows\System\fBPzHHx.exe
  2⤵
  PID:2532
- C:\Windows\System\lOwzUAh.exe
  C:\Windows\System\lOwzUAh.exe
  2⤵
  PID:624
- C:\Windows\System\bdqNhmC.exe
  C:\Windows\System\bdqNhmC.exe
  2⤵
  PID:3020
- C:\Windows\System\JDMkJjD.exe
  C:\Windows\System\JDMkJjD.exe
  2⤵
  PID:1456
- C:\Windows\System\gdORDfM.exe
  C:\Windows\System\gdORDfM.exe
  2⤵
  PID:2884
- C:\Windows\System\Hircqoz.exe
  C:\Windows\System\Hircqoz.exe
  2⤵
  PID:1728
- C:\Windows\System\kQsMLSp.exe
  C:\Windows\System\kQsMLSp.exe
  2⤵
  PID:2812
- C:\Windows\System\lMSJcXv.exe
  C:\Windows\System\lMSJcXv.exe
  2⤵
  PID:2800
- C:\Windows\System\mRhRkNC.exe
  C:\Windows\System\mRhRkNC.exe
  2⤵
  PID:2864
- C:\Windows\System\lWAvETk.exe
  C:\Windows\System\lWAvETk.exe
  2⤵
  PID:2936
- C:\Windows\System\njNLTdc.exe
  C:\Windows\System\njNLTdc.exe
  2⤵
  PID:1724
- C:\Windows\System\uPIooEG.exe
  C:\Windows\System\uPIooEG.exe
  2⤵
  PID:2116
- C:\Windows\System\ikLiDty.exe
  C:\Windows\System\ikLiDty.exe
  2⤵
  PID:2228
- C:\Windows\System\XYsfMHV.exe
  C:\Windows\System\XYsfMHV.exe
  2⤵
  PID:2192
- C:\Windows\System\yOnOyZm.exe
  C:\Windows\System\yOnOyZm.exe
  2⤵
  PID:2632
- C:\Windows\System\oLwbBuA.exe
  C:\Windows\System\oLwbBuA.exe
  2⤵
  PID:608
- C:\Windows\System\zDOyxOu.exe
  C:\Windows\System\zDOyxOu.exe
  2⤵
  PID:1072
- C:\Windows\System\opbXBUZ.exe
  C:\Windows\System\opbXBUZ.exe
  2⤵
  PID:1012
- C:\Windows\System\fsxjuOz.exe
  C:\Windows\System\fsxjuOz.exe
  2⤵
  PID:1900
- C:\Windows\System\TWjrfeM.exe
  C:\Windows\System\TWjrfeM.exe
  2⤵
  PID:2200
- C:\Windows\System\KYJbaQY.exe
  C:\Windows\System\KYJbaQY.exe
  2⤵
  PID:2364
- C:\Windows\System\gHNmMSx.exe
  C:\Windows\System\gHNmMSx.exe
  2⤵
  PID:1324
- C:\Windows\System\EFISsJJ.exe
  C:\Windows\System\EFISsJJ.exe
  2⤵
  PID:948
- C:\Windows\System\GKkonXC.exe
  C:\Windows\System\GKkonXC.exe
  2⤵
  PID:1480
- C:\Windows\System\fvXWIzp.exe
  C:\Windows\System\fvXWIzp.exe
  2⤵
  PID:2208
- C:\Windows\System\ysRqjTB.exe
  C:\Windows\System\ysRqjTB.exe
  2⤵
  PID:1652
- C:\Windows\System\MUDCdWR.exe
  C:\Windows\System\MUDCdWR.exe
  2⤵
  PID:2320
- C:\Windows\System\qLsjOlN.exe
  C:\Windows\System\qLsjOlN.exe
  2⤵
  PID:2240
- C:\Windows\System\oGwoCWG.exe
  C:\Windows\System\oGwoCWG.exe
  2⤵
  PID:2268
- C:\Windows\System\htDwcDb.exe
  C:\Windows\System\htDwcDb.exe
  2⤵
  PID:1008
- C:\Windows\System\MDykuTf.exe
  C:\Windows\System\MDykuTf.exe
  2⤵
  PID:912
- C:\Windows\System\aglUFYA.exe
  C:\Windows\System\aglUFYA.exe
  2⤵
  PID:2472
- C:\Windows\System\uJRhcZK.exe
  C:\Windows\System\uJRhcZK.exe
  2⤵
  PID:896
- C:\Windows\System\QkklHPB.exe
  C:\Windows\System\QkklHPB.exe
  2⤵
  PID:1960
- C:\Windows\System\XlGcEcv.exe
  C:\Windows\System\XlGcEcv.exe
  2⤵
  PID:3016
- C:\Windows\System\CHgxrPn.exe
  C:\Windows\System\CHgxrPn.exe
  2⤵
  PID:1648
- C:\Windows\System\duumYyf.exe
  C:\Windows\System\duumYyf.exe
  2⤵
  PID:2572
- C:\Windows\System\sayFVZD.exe
  C:\Windows\System\sayFVZD.exe
  2⤵
  PID:2672
- C:\Windows\System\BGJzyUx.exe
  C:\Windows\System\BGJzyUx.exe
  2⤵
  PID:880
- C:\Windows\System\OpQyaex.exe
  C:\Windows\System\OpQyaex.exe
  2⤵
  PID:2652
- C:\Windows\System\RlsuiOn.exe
  C:\Windows\System\RlsuiOn.exe
  2⤵
  PID:2104
- C:\Windows\System\BLEciWf.exe
  C:\Windows\System\BLEciWf.exe
  2⤵
  PID:2064
- C:\Windows\System\dBpdvxL.exe
  C:\Windows\System\dBpdvxL.exe
  2⤵
  PID:1580
- C:\Windows\System\gztFkOI.exe
  C:\Windows\System\gztFkOI.exe
  2⤵
  PID:2828
- C:\Windows\System\nHcAGdO.exe
  C:\Windows\System\nHcAGdO.exe
  2⤵
  PID:3036
- C:\Windows\System\cAvfAqu.exe
  C:\Windows\System\cAvfAqu.exe
  2⤵
  PID:1720
- C:\Windows\System\SjFWsNt.exe
  C:\Windows\System\SjFWsNt.exe
  2⤵
  PID:2996
- C:\Windows\System\JRIpTnT.exe
  C:\Windows\System\JRIpTnT.exe
  2⤵
  PID:1864
- C:\Windows\System\oZsoJnX.exe
  C:\Windows\System\oZsoJnX.exe
  2⤵
  PID:684
- C:\Windows\System\zWWkMfz.exe
  C:\Windows\System\zWWkMfz.exe
  2⤵
  PID:1228
- C:\Windows\System\dSAgtLF.exe
  C:\Windows\System\dSAgtLF.exe
  2⤵
  PID:2204
- C:\Windows\System\ZwuovcS.exe
  C:\Windows\System\ZwuovcS.exe
  2⤵
  PID:1672
- C:\Windows\System\yuzzjAB.exe
  C:\Windows\System\yuzzjAB.exe
  2⤵
  PID:1644
- C:\Windows\System\iqncqJU.exe
  C:\Windows\System\iqncqJU.exe
  2⤵
  PID:1744
- C:\Windows\System\ymACVSv.exe
  C:\Windows\System\ymACVSv.exe
  2⤵
  PID:1992
- C:\Windows\System\LVUCIcE.exe
  C:\Windows\System\LVUCIcE.exe
  2⤵
  PID:1376
- C:\Windows\System\DaRfPIM.exe
  C:\Windows\System\DaRfPIM.exe
  2⤵
  PID:2460
- C:\Windows\System\jgeVQlB.exe
  C:\Windows\System\jgeVQlB.exe
  2⤵
  PID:2696
- C:\Windows\System\BIrNSoL.exe
  C:\Windows\System\BIrNSoL.exe
  2⤵
  PID:2740
- C:\Windows\System\XQGiOAT.exe
  C:\Windows\System\XQGiOAT.exe
  2⤵
  PID:3028
- C:\Windows\System\Ezkhuak.exe
  C:\Windows\System\Ezkhuak.exe
  2⤵
  PID:1540
- C:\Windows\System\tiObwgE.exe
  C:\Windows\System\tiObwgE.exe
  2⤵
  PID:2888
- C:\Windows\System\dZJfusD.exe
  C:\Windows\System\dZJfusD.exe
  2⤵
  PID:2304
- C:\Windows\System\ctXxNbz.exe
  C:\Windows\System\ctXxNbz.exe
  2⤵
  PID:2964
- C:\Windows\System\eHcAUiv.exe
  C:\Windows\System\eHcAUiv.exe
  2⤵
  PID:2060
- C:\Windows\System\zNInwGO.exe
  C:\Windows\System\zNInwGO.exe
  2⤵
  PID:3064
- C:\Windows\System\RoyaEdV.exe
  C:\Windows\System\RoyaEdV.exe
  2⤵
  PID:2480
- C:\Windows\System\AelQJSh.exe
  C:\Windows\System\AelQJSh.exe
  2⤵
  PID:2988
- C:\Windows\System\VOwvNnL.exe
  C:\Windows\System\VOwvNnL.exe
  2⤵
  PID:716
- C:\Windows\System\ZMCFXcW.exe
  C:\Windows\System\ZMCFXcW.exe
  2⤵
  PID:1796
- C:\Windows\System\nZFLfsk.exe
  C:\Windows\System\nZFLfsk.exe
  2⤵
  PID:1252
- C:\Windows\System\XYgTYfS.exe
  C:\Windows\System\XYgTYfS.exe
  2⤵
  PID:2908
- C:\Windows\System\tIyFHTs.exe
  C:\Windows\System\tIyFHTs.exe
  2⤵
  PID:2860
- C:\Windows\System\pfDYmMo.exe
  C:\Windows\System\pfDYmMo.exe
  2⤵
  PID:1220
- C:\Windows\System\xZELAzD.exe
  C:\Windows\System\xZELAzD.exe
  2⤵
  PID:2892
- C:\Windows\System\ajqSuKp.exe
  C:\Windows\System\ajqSuKp.exe
  2⤵
  PID:3052
- C:\Windows\System\zcPMbpQ.exe
  C:\Windows\System\zcPMbpQ.exe
  2⤵
  PID:1788
- C:\Windows\System\gvPdldv.exe
  C:\Windows\System\gvPdldv.exe
  2⤵
  PID:2336
- C:\Windows\System\ZNpbUhN.exe
  C:\Windows\System\ZNpbUhN.exe
  2⤵
  PID:2552
- C:\Windows\System\zDuHrnF.exe
  C:\Windows\System\zDuHrnF.exe
  2⤵
  PID:2580
- C:\Windows\System\wggdmVE.exe
  C:\Windows\System\wggdmVE.exe
  2⤵
  PID:1952
- C:\Windows\System\qomyXvw.exe
  C:\Windows\System\qomyXvw.exe
  2⤵
  PID:2412
- C:\Windows\System\DVMkLYe.exe
  C:\Windows\System\DVMkLYe.exe
  2⤵
  PID:2784
- C:\Windows\System\ByjUQrB.exe
  C:\Windows\System\ByjUQrB.exe
  2⤵
  PID:2128
- C:\Windows\System\BgmrukF.exe
  C:\Windows\System\BgmrukF.exe
  2⤵
  PID:904
- C:\Windows\System\PEBdFmE.exe
  C:\Windows\System\PEBdFmE.exe
  2⤵
  PID:2056
- C:\Windows\System\xqEwJXG.exe
  C:\Windows\System\xqEwJXG.exe
  2⤵
  PID:2436
- C:\Windows\System\TGnlSQU.exe
  C:\Windows\System\TGnlSQU.exe
  2⤵
  PID:2596
- C:\Windows\System\przVHjA.exe
  C:\Windows\System\przVHjA.exe
  2⤵
  PID:2564
- C:\Windows\System\fSFmFah.exe
  C:\Windows\System\fSFmFah.exe
  2⤵
  PID:2592
- C:\Windows\System\OPzeRNv.exe
  C:\Windows\System\OPzeRNv.exe
  2⤵
  PID:1916
- C:\Windows\System\FcewyTq.exe
  C:\Windows\System\FcewyTq.exe
  2⤵
  PID:1956
- C:\Windows\System\BixSVDS.exe
  C:\Windows\System\BixSVDS.exe
  2⤵
  PID:2088
- C:\Windows\System\EwgiKWW.exe
  C:\Windows\System\EwgiKWW.exe
  2⤵
  PID:2028
- C:\Windows\System\FmNgMEb.exe
  C:\Windows\System\FmNgMEb.exe
  2⤵
  PID:3088
- C:\Windows\System\wQGjxcf.exe
  C:\Windows\System\wQGjxcf.exe
  2⤵
  PID:3104
- C:\Windows\System\eXXxPyf.exe
  C:\Windows\System\eXXxPyf.exe
  2⤵
  PID:3120
- C:\Windows\System\xFyyScV.exe
  C:\Windows\System\xFyyScV.exe
  2⤵
  PID:3136
- C:\Windows\System\LzqhTmZ.exe
  C:\Windows\System\LzqhTmZ.exe
  2⤵
  PID:3156
- C:\Windows\System\yKiRpsz.exe
  C:\Windows\System\yKiRpsz.exe
  2⤵
  PID:3176
- C:\Windows\System\GDIWHzk.exe
  C:\Windows\System\GDIWHzk.exe
  2⤵
  PID:3216
- C:\Windows\System\KczeLTV.exe
  C:\Windows\System\KczeLTV.exe
  2⤵
  PID:3232
- C:\Windows\System\kquvilJ.exe
  C:\Windows\System\kquvilJ.exe
  2⤵
  PID:3248
- C:\Windows\System\pbpEuKD.exe
  C:\Windows\System\pbpEuKD.exe
  2⤵
  PID:3264
- C:\Windows\System\LbpKwwB.exe
  C:\Windows\System\LbpKwwB.exe
  2⤵
  PID:3280
- C:\Windows\System\FornacI.exe
  C:\Windows\System\FornacI.exe
  2⤵
  PID:3296
- C:\Windows\System\OTsPZAU.exe
  C:\Windows\System\OTsPZAU.exe
  2⤵
  PID:3316
- C:\Windows\System\gGDMrbU.exe
  C:\Windows\System\gGDMrbU.exe
  2⤵
  PID:3332
- C:\Windows\System\GZmnpYH.exe
  C:\Windows\System\GZmnpYH.exe
  2⤵
  PID:3348
- C:\Windows\System\kyhaNUc.exe
  C:\Windows\System\kyhaNUc.exe
  2⤵
  PID:3364
- C:\Windows\System\XsoSwzX.exe
  C:\Windows\System\XsoSwzX.exe
  2⤵
  PID:3380
- C:\Windows\System\YWrojQW.exe
  C:\Windows\System\YWrojQW.exe
  2⤵
  PID:3396
- C:\Windows\System\Wrknosn.exe
  C:\Windows\System\Wrknosn.exe
  2⤵
  PID:3412
- C:\Windows\System\rDAkZkR.exe
  C:\Windows\System\rDAkZkR.exe
  2⤵
  PID:3428
- C:\Windows\System\vOulQnn.exe
  C:\Windows\System\vOulQnn.exe
  2⤵
  PID:3444
- C:\Windows\System\wRIkOrx.exe
  C:\Windows\System\wRIkOrx.exe
  2⤵
  PID:3460
- C:\Windows\System\daoGUwQ.exe
  C:\Windows\System\daoGUwQ.exe
  2⤵
  PID:3476
- C:\Windows\System\mvKflXi.exe
  C:\Windows\System\mvKflXi.exe
  2⤵
  PID:3492
- C:\Windows\System\buTmixI.exe
  C:\Windows\System\buTmixI.exe
  2⤵
  PID:3508
- C:\Windows\System\jXpnyLR.exe
  C:\Windows\System\jXpnyLR.exe
  2⤵
  PID:3524
- C:\Windows\System\YplniHD.exe
  C:\Windows\System\YplniHD.exe
  2⤵
  PID:3540
- C:\Windows\System\gnXgfpK.exe
  C:\Windows\System\gnXgfpK.exe
  2⤵
  PID:3556
- C:\Windows\System\QDLfHgX.exe
  C:\Windows\System\QDLfHgX.exe
  2⤵
  PID:3572
- C:\Windows\System\JzPpZCM.exe
  C:\Windows\System\JzPpZCM.exe
  2⤵
  PID:3588
- C:\Windows\System\HVOsrZM.exe
  C:\Windows\System\HVOsrZM.exe
  2⤵
  PID:3604
- C:\Windows\System\vYSiWWH.exe
  C:\Windows\System\vYSiWWH.exe
  2⤵
  PID:3620
- C:\Windows\System\rxqWWOO.exe
  C:\Windows\System\rxqWWOO.exe
  2⤵
  PID:3636
- C:\Windows\System\CksamgH.exe
  C:\Windows\System\CksamgH.exe
  2⤵
  PID:3652
- C:\Windows\System\zaPsJdW.exe
  C:\Windows\System\zaPsJdW.exe
  2⤵
  PID:3668
- C:\Windows\System\OkkzCuK.exe
  C:\Windows\System\OkkzCuK.exe
  2⤵
  PID:3684
- C:\Windows\System\vsIXymi.exe
  C:\Windows\System\vsIXymi.exe
  2⤵
  PID:3748
- C:\Windows\System\YGYbolU.exe
  C:\Windows\System\YGYbolU.exe
  2⤵
  PID:3764
- C:\Windows\System\xGSqeVy.exe
  C:\Windows\System\xGSqeVy.exe
  2⤵
  PID:3780
- C:\Windows\System\cTEsTwS.exe
  C:\Windows\System\cTEsTwS.exe
  2⤵
  PID:3800
- C:\Windows\System\wMSAzRN.exe
  C:\Windows\System\wMSAzRN.exe
  2⤵
  PID:3824
- C:\Windows\System\dQcSHlX.exe
  C:\Windows\System\dQcSHlX.exe
  2⤵
  PID:3840
- C:\Windows\System\zqmDCVT.exe
  C:\Windows\System\zqmDCVT.exe
  2⤵
  PID:3856
- C:\Windows\System\tVUBHHL.exe
  C:\Windows\System\tVUBHHL.exe
  2⤵
  PID:3872
- C:\Windows\System\ubLAubN.exe
  C:\Windows\System\ubLAubN.exe
  2⤵
  PID:3888
- C:\Windows\System\VBMOhza.exe
  C:\Windows\System\VBMOhza.exe
  2⤵
  PID:3916
- C:\Windows\System\MccQJeg.exe
  C:\Windows\System\MccQJeg.exe
  2⤵
  PID:3948
- C:\Windows\System\rEUWOae.exe
  C:\Windows\System\rEUWOae.exe
  2⤵
  PID:3964
- C:\Windows\System\zySKilR.exe
  C:\Windows\System\zySKilR.exe
  2⤵
  PID:3984
- C:\Windows\System\ewokxCl.exe
  C:\Windows\System\ewokxCl.exe
  2⤵
  PID:4000
- C:\Windows\System\qaWwTIQ.exe
  C:\Windows\System\qaWwTIQ.exe
  2⤵
  PID:4016
- C:\Windows\System\FiTCfXT.exe
  C:\Windows\System\FiTCfXT.exe
  2⤵
  PID:4032
- C:\Windows\System\QjYalcA.exe
  C:\Windows\System\QjYalcA.exe
  2⤵
  PID:4048
- C:\Windows\System\pDXXeou.exe
  C:\Windows\System\pDXXeou.exe
  2⤵
  PID:4064
- C:\Windows\System\FkgYMVZ.exe
  C:\Windows\System\FkgYMVZ.exe
  2⤵
  PID:4080
- C:\Windows\System\kzZMpit.exe
  C:\Windows\System\kzZMpit.exe
  2⤵
  PID:1980
- C:\Windows\System\FNklbuU.exe
  C:\Windows\System\FNklbuU.exe
  2⤵
  PID:3080
- C:\Windows\System\dyfwbOI.exe
  C:\Windows\System\dyfwbOI.exe
  2⤵
  PID:328
- C:\Windows\System\aRmafVh.exe
  C:\Windows\System\aRmafVh.exe
  2⤵
  PID:1912
- C:\Windows\System\UZjfCOQ.exe
  C:\Windows\System\UZjfCOQ.exe
  2⤵
  PID:2184
- C:\Windows\System\xKrbHeZ.exe
  C:\Windows\System\xKrbHeZ.exe
  2⤵
  PID:3100
- C:\Windows\System\SqGwJlL.exe
  C:\Windows\System\SqGwJlL.exe
  2⤵
  PID:3152
- C:\Windows\System\mmGJNYJ.exe
  C:\Windows\System\mmGJNYJ.exe
  2⤵
  PID:3164
- C:\Windows\System\CGpawNG.exe
  C:\Windows\System\CGpawNG.exe
  2⤵
  PID:3212
- C:\Windows\System\xzMafIc.exe
  C:\Windows\System\xzMafIc.exe
  2⤵
  PID:3228
- C:\Windows\System\ybpeAux.exe
  C:\Windows\System\ybpeAux.exe
  2⤵
  PID:3276
- C:\Windows\System\UropyvB.exe
  C:\Windows\System\UropyvB.exe
  2⤵
  PID:3304
- C:\Windows\System\NZBbjXI.exe
  C:\Windows\System\NZBbjXI.exe
  2⤵
  PID:3372
- C:\Windows\System\jgaKUOW.exe
  C:\Windows\System\jgaKUOW.exe
  2⤵
  PID:3408
- C:\Windows\System\HPHLCZB.exe
  C:\Windows\System\HPHLCZB.exe
  2⤵
  PID:3436
- C:\Windows\System\Dvrrtap.exe
  C:\Windows\System\Dvrrtap.exe
  2⤵
  PID:3500
- C:\Windows\System\TsqResj.exe
  C:\Windows\System\TsqResj.exe
  2⤵
  PID:3420
- C:\Windows\System\wPCSeGu.exe
  C:\Windows\System\wPCSeGu.exe
  2⤵
  PID:3456
- C:\Windows\System\JBHMDOY.exe
  C:\Windows\System\JBHMDOY.exe
  2⤵
  PID:3520
- C:\Windows\System\AkBhrWN.exe
  C:\Windows\System\AkBhrWN.exe
  2⤵
  PID:3580
- C:\Windows\System\RFYKHjQ.exe
  C:\Windows\System\RFYKHjQ.exe
  2⤵
  PID:3628
- C:\Windows\System\AVcCEQr.exe
  C:\Windows\System\AVcCEQr.exe
  2⤵
  PID:3648
- C:\Windows\System\VOxBCoR.exe
  C:\Windows\System\VOxBCoR.exe
  2⤵
  PID:3676
- C:\Windows\System\dCebeUn.exe
  C:\Windows\System\dCebeUn.exe
  2⤵
  PID:3700
- C:\Windows\System\eByoPJc.exe
  C:\Windows\System\eByoPJc.exe
  2⤵
  PID:3716
- C:\Windows\System\WmDVtpy.exe
  C:\Windows\System\WmDVtpy.exe
  2⤵
  PID:3732
- C:\Windows\System\fqqzhLI.exe
  C:\Windows\System\fqqzhLI.exe
  2⤵
  PID:3772
- C:\Windows\System\BmfVTtF.exe
  C:\Windows\System\BmfVTtF.exe
  2⤵
  PID:3788
- C:\Windows\System\TPTIJvk.exe
  C:\Windows\System\TPTIJvk.exe
  2⤵
  PID:3812
- C:\Windows\System\FNQQFOl.exe
  C:\Windows\System\FNQQFOl.exe
  2⤵
  PID:3852
- C:\Windows\System\dHlCWBN.exe
  C:\Windows\System\dHlCWBN.exe
  2⤵
  PID:3836
- C:\Windows\System\RBzlaTy.exe
  C:\Windows\System\RBzlaTy.exe
  2⤵
  PID:3900
- C:\Windows\System\sznAXBt.exe
  C:\Windows\System\sznAXBt.exe
  2⤵
  PID:3928
- C:\Windows\System\RsaAMTD.exe
  C:\Windows\System\RsaAMTD.exe
  2⤵
  PID:3940
- C:\Windows\System\jZLyqRV.exe
  C:\Windows\System\jZLyqRV.exe
  2⤵
  PID:3976
- C:\Windows\System\LmzCuCk.exe
  C:\Windows\System\LmzCuCk.exe
  2⤵
  PID:4012
- C:\Windows\System\BUtbJmS.exe
  C:\Windows\System\BUtbJmS.exe
  2⤵
  PID:4072
- C:\Windows\System\KhMCZdC.exe
  C:\Windows\System\KhMCZdC.exe
  2⤵
  PID:556
- C:\Windows\System\FkziBUD.exe
  C:\Windows\System\FkziBUD.exe
  2⤵
  PID:4060
- C:\Windows\System\CnWPKVH.exe
  C:\Windows\System\CnWPKVH.exe
  2⤵
  PID:3132
- C:\Windows\System\wkaAIpk.exe
  C:\Windows\System\wkaAIpk.exe
  2⤵
  PID:2788
- C:\Windows\System\PTnXqEZ.exe
  C:\Windows\System\PTnXqEZ.exe
  2⤵
  PID:3112
- C:\Windows\System\kDXHGqj.exe
  C:\Windows\System\kDXHGqj.exe
  2⤵
  PID:1868
- C:\Windows\System\CuSfjQK.exe
  C:\Windows\System\CuSfjQK.exe
  2⤵
  PID:3328
- C:\Windows\System\oKFICLd.exe
  C:\Windows\System\oKFICLd.exe
  2⤵
  PID:3392
- C:\Windows\System\qDjcqJX.exe
  C:\Windows\System\qDjcqJX.exe
  2⤵
  PID:3344
- C:\Windows\System\bHvkwHJ.exe
  C:\Windows\System\bHvkwHJ.exe
  2⤵
  PID:3488
- C:\Windows\System\yyqCANo.exe
  C:\Windows\System\yyqCANo.exe
  2⤵
  PID:3568
- C:\Windows\System\OApjEcn.exe
  C:\Windows\System\OApjEcn.exe
  2⤵
  PID:3692
- C:\Windows\System\nUVwsOm.exe
  C:\Windows\System\nUVwsOm.exe
  2⤵
  PID:3516
- C:\Windows\System\vkQWHhM.exe
  C:\Windows\System\vkQWHhM.exe
  2⤵
  PID:3664
- C:\Windows\System\XxtzRnD.exe
  C:\Windows\System\XxtzRnD.exe
  2⤵
  PID:3708
- C:\Windows\System\VpFuyIh.exe
  C:\Windows\System\VpFuyIh.exe
  2⤵
  PID:3896
- C:\Windows\System\kIfhjgm.exe
  C:\Windows\System\kIfhjgm.exe
  2⤵
  PID:3808
- C:\Windows\System\hVNRYrz.exe
  C:\Windows\System\hVNRYrz.exe
  2⤵
  PID:3956
- C:\Windows\System\lsukdxb.exe
  C:\Windows\System\lsukdxb.exe
  2⤵
  PID:3908
- C:\Windows\System\IWJpEoW.exe
  C:\Windows\System\IWJpEoW.exe
  2⤵
  PID:2296
- C:\Windows\System\HdCAsdv.exe
  C:\Windows\System\HdCAsdv.exe
  2⤵
  PID:4056
- C:\Windows\System\dLwdAaF.exe
  C:\Windows\System\dLwdAaF.exe
  2⤵
  PID:3324
- C:\Windows\System\zaShZbc.exe
  C:\Windows\System\zaShZbc.exe
  2⤵
  PID:3388
- C:\Windows\System\jIVqStM.exe
  C:\Windows\System\jIVqStM.exe
  2⤵
  PID:3564
- C:\Windows\System\UkyRlRG.exe
  C:\Windows\System\UkyRlRG.exe
  2⤵
  PID:3796
- C:\Windows\System\nOZtzMV.exe
  C:\Windows\System\nOZtzMV.exe
  2⤵
  PID:3712
- C:\Windows\System\xDTREcZ.exe
  C:\Windows\System\xDTREcZ.exe
  2⤵
  PID:3848
- C:\Windows\System\PfINCZS.exe
  C:\Windows\System\PfINCZS.exe
  2⤵
  PID:4044
- C:\Windows\System\nmWRkMz.exe
  C:\Windows\System\nmWRkMz.exe
  2⤵
  PID:4024
- C:\Windows\System\vKLWWqb.exe
  C:\Windows\System\vKLWWqb.exe
  2⤵
  PID:3116
- C:\Windows\System\swEfPki.exe
  C:\Windows\System\swEfPki.exe
  2⤵
  PID:3760
- C:\Windows\System\BKddYYN.exe
  C:\Windows\System\BKddYYN.exe
  2⤵
  PID:3224
- C:\Windows\System\EQxpvdm.exe
  C:\Windows\System\EQxpvdm.exe
  2⤵
  PID:4008
- C:\Windows\System\GiinVrW.exe
  C:\Windows\System\GiinVrW.exe
  2⤵
  PID:3816
- C:\Windows\System\XlAwngQ.exe
  C:\Windows\System\XlAwngQ.exe
  2⤵
  PID:3776
- C:\Windows\System\dgsFfXY.exe
  C:\Windows\System\dgsFfXY.exe
  2⤵
  PID:4100
- C:\Windows\System\GNynhrF.exe
  C:\Windows\System\GNynhrF.exe
  2⤵
  PID:4116
- C:\Windows\System\ImcVgZq.exe
  C:\Windows\System\ImcVgZq.exe
  2⤵
  PID:4132
- C:\Windows\System\xgQmKEb.exe
  C:\Windows\System\xgQmKEb.exe
  2⤵
  PID:4148
- C:\Windows\System\CpJsuHP.exe
  C:\Windows\System\CpJsuHP.exe
  2⤵
  PID:4164
- C:\Windows\System\wlAArvm.exe
  C:\Windows\System\wlAArvm.exe
  2⤵
  PID:4180
- C:\Windows\System\fyUbIZU.exe
  C:\Windows\System\fyUbIZU.exe
  2⤵
  PID:4196
- C:\Windows\System\jLXdoCA.exe
  C:\Windows\System\jLXdoCA.exe
  2⤵
  PID:4212
- C:\Windows\System\FOVydiv.exe
  C:\Windows\System\FOVydiv.exe
  2⤵
  PID:4228
- C:\Windows\System\CmZPDHZ.exe
  C:\Windows\System\CmZPDHZ.exe
  2⤵
  PID:4244
- C:\Windows\System\xDHUvZg.exe
  C:\Windows\System\xDHUvZg.exe
  2⤵
  PID:4260
- C:\Windows\System\riYHibK.exe
  C:\Windows\System\riYHibK.exe
  2⤵
  PID:4276
- C:\Windows\System\pdiGMNY.exe
  C:\Windows\System\pdiGMNY.exe
  2⤵
  PID:4292
- C:\Windows\System\aOpGmiG.exe
  C:\Windows\System\aOpGmiG.exe
  2⤵
  PID:4308
- C:\Windows\System\VdJVtUz.exe
  C:\Windows\System\VdJVtUz.exe
  2⤵
  PID:4324
- C:\Windows\System\MkacxGS.exe
  C:\Windows\System\MkacxGS.exe
  2⤵
  PID:4340
- C:\Windows\System\CquNEmE.exe
  C:\Windows\System\CquNEmE.exe
  2⤵
  PID:4456
- C:\Windows\System\rdovBui.exe
  C:\Windows\System\rdovBui.exe
  2⤵
  PID:4476
- C:\Windows\System\vhDvxUR.exe
  C:\Windows\System\vhDvxUR.exe
  2⤵
  PID:4500
- C:\Windows\System\HzRVLmI.exe
  C:\Windows\System\HzRVLmI.exe
  2⤵
  PID:4516
- C:\Windows\System\ofHVuYB.exe
  C:\Windows\System\ofHVuYB.exe
  2⤵
  PID:4536
- C:\Windows\System\YIEflZS.exe
  C:\Windows\System\YIEflZS.exe
  2⤵
  PID:4552
- C:\Windows\System\sflYGEy.exe
  C:\Windows\System\sflYGEy.exe
  2⤵
  PID:4572
- C:\Windows\System\dMOZPaL.exe
  C:\Windows\System\dMOZPaL.exe
  2⤵
  PID:4588
- C:\Windows\System\AALxaOt.exe
  C:\Windows\System\AALxaOt.exe
  2⤵
  PID:4604
- C:\Windows\System\GMIJxAq.exe
  C:\Windows\System\GMIJxAq.exe
  2⤵
  PID:4636
- C:\Windows\System\HWTFYrM.exe
  C:\Windows\System\HWTFYrM.exe
  2⤵
  PID:4652
- C:\Windows\System\EgdIuAK.exe
  C:\Windows\System\EgdIuAK.exe
  2⤵
  PID:4672
- C:\Windows\System\XywLowh.exe
  C:\Windows\System\XywLowh.exe
  2⤵
  PID:4688
- C:\Windows\System\Njuefxh.exe
  C:\Windows\System\Njuefxh.exe
  2⤵
  PID:4704
- C:\Windows\System\LrSilhy.exe
  C:\Windows\System\LrSilhy.exe
  2⤵
  PID:4720
- C:\Windows\System\JMjSMQM.exe
  C:\Windows\System\JMjSMQM.exe
  2⤵
  PID:4736
- C:\Windows\System\WOZULiq.exe
  C:\Windows\System\WOZULiq.exe
  2⤵
  PID:4752
- C:\Windows\System\uWOTDZJ.exe
  C:\Windows\System\uWOTDZJ.exe
  2⤵
  PID:4768
- C:\Windows\System\GqTxPuW.exe
  C:\Windows\System\GqTxPuW.exe
  2⤵
  PID:4784
- C:\Windows\System\oloMgXI.exe
  C:\Windows\System\oloMgXI.exe
  2⤵
  PID:4800
- C:\Windows\System\DbsuASv.exe
  C:\Windows\System\DbsuASv.exe
  2⤵
  PID:4816
- C:\Windows\System\YGLugJW.exe
  C:\Windows\System\YGLugJW.exe
  2⤵
  PID:4832
- C:\Windows\System\UKdAQNy.exe
  C:\Windows\System\UKdAQNy.exe
  2⤵
  PID:4848
- C:\Windows\System\jafOcWZ.exe
  C:\Windows\System\jafOcWZ.exe
  2⤵
  PID:4864
- C:\Windows\System\NudAlvi.exe
  C:\Windows\System\NudAlvi.exe
  2⤵
  PID:4880
- C:\Windows\System\dqgSAOp.exe
  C:\Windows\System\dqgSAOp.exe
  2⤵
  PID:4896
- C:\Windows\System\tHGOWms.exe
  C:\Windows\System\tHGOWms.exe
  2⤵
  PID:4916
- C:\Windows\System\VSQOkAw.exe
  C:\Windows\System\VSQOkAw.exe
  2⤵
  PID:4932
- C:\Windows\System\amPwLOS.exe
  C:\Windows\System\amPwLOS.exe
  2⤵
  PID:4948
- C:\Windows\System\eFVLxSj.exe
  C:\Windows\System\eFVLxSj.exe
  2⤵
  PID:4964
- C:\Windows\System\EiVezra.exe
  C:\Windows\System\EiVezra.exe
  2⤵
  PID:4980
- C:\Windows\System\WHCJmCK.exe
  C:\Windows\System\WHCJmCK.exe
  2⤵
  PID:4996
- C:\Windows\System\vuhnFwn.exe
  C:\Windows\System\vuhnFwn.exe
  2⤵
  PID:5012
- C:\Windows\System\RiNlrsK.exe
  C:\Windows\System\RiNlrsK.exe
  2⤵
  PID:5028
- C:\Windows\System\QLWTlTT.exe
  C:\Windows\System\QLWTlTT.exe
  2⤵
  PID:5044
- C:\Windows\System\ygWRmtK.exe
  C:\Windows\System\ygWRmtK.exe
  2⤵
  PID:5064
- C:\Windows\System\WaDHOxd.exe
  C:\Windows\System\WaDHOxd.exe
  2⤵
  PID:5080
- C:\Windows\System\VhMUsrq.exe
  C:\Windows\System\VhMUsrq.exe
  2⤵
  PID:5096
- C:\Windows\System\QTvqxEo.exe
  C:\Windows\System\QTvqxEo.exe
  2⤵
  PID:5112
- C:\Windows\System\ZCbYyFk.exe
  C:\Windows\System\ZCbYyFk.exe
  2⤵
  PID:4112
- C:\Windows\System\olmwXod.exe
  C:\Windows\System\olmwXod.exe
  2⤵
  PID:3472
- C:\Windows\System\Tsvfqxj.exe
  C:\Windows\System\Tsvfqxj.exe
  2⤵
  PID:4124
- C:\Windows\System\JtSOfAm.exe
  C:\Windows\System\JtSOfAm.exe
  2⤵
  PID:4144
- C:\Windows\System\olNZUid.exe
  C:\Windows\System\olNZUid.exe
  2⤵
  PID:4160
- C:\Windows\System\CvFXVDW.exe
  C:\Windows\System\CvFXVDW.exe
  2⤵
  PID:4208
- C:\Windows\System\bqsXdxO.exe
  C:\Windows\System\bqsXdxO.exe
  2⤵
  PID:4272
- C:\Windows\System\PvZMdIK.exe
  C:\Windows\System\PvZMdIK.exe
  2⤵
  PID:4224
- C:\Windows\System\kYssMdt.exe
  C:\Windows\System\kYssMdt.exe
  2⤵
  PID:4332
- C:\Windows\System\zknrNYu.exe
  C:\Windows\System\zknrNYu.exe
  2⤵
  PID:4336
- C:\Windows\System\yBjqXCQ.exe
  C:\Windows\System\yBjqXCQ.exe
  2⤵
  PID:4360
- C:\Windows\System\LIQCfWW.exe
  C:\Windows\System\LIQCfWW.exe
  2⤵
  PID:4380
- C:\Windows\System\vDYnBEb.exe
  C:\Windows\System\vDYnBEb.exe
  2⤵
  PID:4396
- C:\Windows\System\mUKODds.exe
  C:\Windows\System\mUKODds.exe
  2⤵
  PID:4412
- C:\Windows\System\QyCjAKx.exe
  C:\Windows\System\QyCjAKx.exe
  2⤵
  PID:4428
- C:\Windows\System\NmTSOFM.exe
  C:\Windows\System\NmTSOFM.exe
  2⤵
  PID:4444
- C:\Windows\System\QLpvlMW.exe
  C:\Windows\System\QLpvlMW.exe
  2⤵
  PID:4464
- C:\Windows\System\WZTPwnU.exe
  C:\Windows\System\WZTPwnU.exe
  2⤵
  PID:4496
- C:\Windows\System\HzjjYAw.exe
  C:\Windows\System\HzjjYAw.exe
  2⤵
  PID:4512
- C:\Windows\System\qYPwxtY.exe
  C:\Windows\System\qYPwxtY.exe
  2⤵
  PID:4580
- C:\Windows\System\IFCcakL.exe
  C:\Windows\System\IFCcakL.exe
  2⤵
  PID:4532
- C:\Windows\System\WaRWOsT.exe
  C:\Windows\System\WaRWOsT.exe
  2⤵
  PID:4560
- C:\Windows\System\gjXKNlA.exe
  C:\Windows\System\gjXKNlA.exe
  2⤵
  PID:4628
- C:\Windows\System\vtZYYsL.exe
  C:\Windows\System\vtZYYsL.exe
  2⤵
  PID:4696
- C:\Windows\System\HdgNCtU.exe
  C:\Windows\System\HdgNCtU.exe
  2⤵
  PID:4644
- C:\Windows\System\RhlkSne.exe
  C:\Windows\System\RhlkSne.exe
  2⤵
  PID:4648
- C:\Windows\System\eeVvKPv.exe
  C:\Windows\System\eeVvKPv.exe
  2⤵
  PID:4828
- C:\Windows\System\OpFnzLp.exe
  C:\Windows\System\OpFnzLp.exe
  2⤵
  PID:4712
- C:\Windows\System\jFiwGGh.exe
  C:\Windows\System\jFiwGGh.exe
  2⤵
  PID:4840
- C:\Windows\System\FSRyybt.exe
  C:\Windows\System\FSRyybt.exe
  2⤵
  PID:4844
- C:\Windows\System\XOZavPm.exe
  C:\Windows\System\XOZavPm.exe
  2⤵
  PID:4928
- C:\Windows\System\mIgYiNI.exe
  C:\Windows\System\mIgYiNI.exe
  2⤵
  PID:4960
- C:\Windows\System\dLzJOkL.exe
  C:\Windows\System\dLzJOkL.exe
  2⤵
  PID:5020
- C:\Windows\System\mbbzFfa.exe
  C:\Windows\System\mbbzFfa.exe
  2⤵
  PID:4908
- C:\Windows\System\GZFQXWf.exe
  C:\Windows\System\GZFQXWf.exe
  2⤵
  PID:5056
- C:\Windows\System\PLHlUoK.exe
  C:\Windows\System\PLHlUoK.exe
  2⤵
  PID:4940
- C:\Windows\System\QAaMnCZ.exe
  C:\Windows\System\QAaMnCZ.exe
  2⤵
  PID:5060
- C:\Windows\System\kvwgqdg.exe
  C:\Windows\System\kvwgqdg.exe
  2⤵
  PID:3292
- C:\Windows\System\wleLWWf.exe
  C:\Windows\System\wleLWWf.exe
  2⤵
  PID:4204
- C:\Windows\System\ErVgSyr.exe
  C:\Windows\System\ErVgSyr.exe
  2⤵
  PID:4304
- C:\Windows\System\wtRzzPZ.exe
  C:\Windows\System\wtRzzPZ.exe
  2⤵
  PID:3260
- C:\Windows\System\TNMDqIB.exe
  C:\Windows\System\TNMDqIB.exe
  2⤵
  PID:4376
- C:\Windows\System\uulyHOX.exe
  C:\Windows\System\uulyHOX.exe
  2⤵
  PID:4156
- C:\Windows\System\xEITbwY.exe
  C:\Windows\System\xEITbwY.exe
  2⤵
  PID:4288
- C:\Windows\System\LIBnlla.exe
  C:\Windows\System\LIBnlla.exe
  2⤵
  PID:3832
- C:\Windows\System\NtgQAfA.exe
  C:\Windows\System\NtgQAfA.exe
  2⤵
  PID:4352
- C:\Windows\System\LIBptTt.exe
  C:\Windows\System\LIBptTt.exe
  2⤵
  PID:4620
- C:\Windows\System\iDSDkTZ.exe
  C:\Windows\System\iDSDkTZ.exe
  2⤵
  PID:4472
- C:\Windows\System\QChqLdN.exe
  C:\Windows\System\QChqLdN.exe
  2⤵
  PID:4548
- C:\Windows\System\LitjiBh.exe
  C:\Windows\System\LitjiBh.exe
  2⤵
  PID:4600
- C:\Windows\System\pZOodbR.exe
  C:\Windows\System\pZOodbR.exe
  2⤵
  PID:4744
- C:\Windows\System\HKtHXZr.exe
  C:\Windows\System\HKtHXZr.exe
  2⤵
  PID:4780
- C:\Windows\System\VoZwnIz.exe
  C:\Windows\System\VoZwnIz.exe
  2⤵
  PID:4872
- C:\Windows\System\qmnzDOm.exe
  C:\Windows\System\qmnzDOm.exe
  2⤵
  PID:4860
- C:\Windows\System\UGfiGDm.exe
  C:\Windows\System\UGfiGDm.exe
  2⤵
  PID:4912
- C:\Windows\System\pRUGSXq.exe
  C:\Windows\System\pRUGSXq.exe
  2⤵
  PID:5072
- C:\Windows\System\vJWDHIE.exe
  C:\Windows\System\vJWDHIE.exe
  2⤵
  PID:3660
- C:\Windows\System\wgcwXRJ.exe
  C:\Windows\System\wgcwXRJ.exe
  2⤵
  PID:4300
- C:\Windows\System\BMMcVrC.exe
  C:\Windows\System\BMMcVrC.exe
  2⤵
  PID:4384
- C:\Windows\System\cyEmQTp.exe
  C:\Windows\System\cyEmQTp.exe
  2⤵
  PID:4392
- C:\Windows\System\nTtTPHF.exe
  C:\Windows\System\nTtTPHF.exe
  2⤵
  PID:4424
- C:\Windows\System\RDPdJCV.exe
  C:\Windows\System\RDPdJCV.exe
  2⤵
  PID:4528
- C:\Windows\System\KlcoBIu.exe
  C:\Windows\System\KlcoBIu.exe
  2⤵
  PID:5008
- C:\Windows\System\ShwBvMF.exe
  C:\Windows\System\ShwBvMF.exe
  2⤵
  PID:4808
- C:\Windows\System\VoISyDG.exe
  C:\Windows\System\VoISyDG.exe
  2⤵
  PID:5092
- C:\Windows\System\ToraQfY.exe
  C:\Windows\System\ToraQfY.exe
  2⤵
  PID:4824
- C:\Windows\System\pwcsgCs.exe
  C:\Windows\System\pwcsgCs.exe
  2⤵
  PID:4320
- C:\Windows\System\YwxqfDw.exe
  C:\Windows\System\YwxqfDw.exe
  2⤵
  PID:5040
- C:\Windows\System\Psijobs.exe
  C:\Windows\System\Psijobs.exe
  2⤵
  PID:4268
- C:\Windows\System\IYmOQNG.exe
  C:\Windows\System\IYmOQNG.exe
  2⤵
  PID:4176
- C:\Windows\System\eogOZDe.exe
  C:\Windows\System\eogOZDe.exe
  2⤵
  PID:4624
- C:\Windows\System\WzfEyNf.exe
  C:\Windows\System\WzfEyNf.exe
  2⤵
  PID:2792
- C:\Windows\System\mrQdysl.exe
  C:\Windows\System\mrQdysl.exe
  2⤵
  PID:4764
- C:\Windows\System\rGcfcaS.exe
  C:\Windows\System\rGcfcaS.exe
  2⤵
  PID:4404
- C:\Windows\System\fGngKdN.exe
  C:\Windows\System\fGngKdN.exe
  2⤵
  PID:5132
- C:\Windows\System\pKiSAFW.exe
  C:\Windows\System\pKiSAFW.exe
  2⤵
  PID:5148
- C:\Windows\System\YECKhIo.exe
  C:\Windows\System\YECKhIo.exe
  2⤵
  PID:5164
- C:\Windows\System\nwsxeVZ.exe
  C:\Windows\System\nwsxeVZ.exe
  2⤵
  PID:5180
- C:\Windows\System\VOaiLPz.exe
  C:\Windows\System\VOaiLPz.exe
  2⤵
  PID:5196
- C:\Windows\System\FvecYEx.exe
  C:\Windows\System\FvecYEx.exe
  2⤵
  PID:5212
- C:\Windows\System\VOLGdko.exe
  C:\Windows\System\VOLGdko.exe
  2⤵
  PID:5228
- C:\Windows\System\BCMVrHm.exe
  C:\Windows\System\BCMVrHm.exe
  2⤵
  PID:5248
- C:\Windows\System\GlUBlwN.exe
  C:\Windows\System\GlUBlwN.exe
  2⤵
  PID:5264
- C:\Windows\System\ywoxtqS.exe
  C:\Windows\System\ywoxtqS.exe
  2⤵
  PID:5280
- C:\Windows\System\zObrZhy.exe
  C:\Windows\System\zObrZhy.exe
  2⤵
  PID:5296
- C:\Windows\System\uxFvaUB.exe
  C:\Windows\System\uxFvaUB.exe
  2⤵
  PID:5312
- C:\Windows\System\CXCPPHZ.exe
  C:\Windows\System\CXCPPHZ.exe
  2⤵
  PID:5328
- C:\Windows\System\XaElbQr.exe
  C:\Windows\System\XaElbQr.exe
  2⤵
  PID:5344
- C:\Windows\System\idvrJah.exe
  C:\Windows\System\idvrJah.exe
  2⤵
  PID:5360
- C:\Windows\System\lOcykXt.exe
  C:\Windows\System\lOcykXt.exe
  2⤵
  PID:5376
- C:\Windows\System\ztdNawd.exe
  C:\Windows\System\ztdNawd.exe
  2⤵
  PID:5392
- C:\Windows\System\CzvYYjA.exe
  C:\Windows\System\CzvYYjA.exe
  2⤵
  PID:5408
- C:\Windows\System\RRuGuCC.exe
  C:\Windows\System\RRuGuCC.exe
  2⤵
  PID:5424
- C:\Windows\System\etPkgHJ.exe
  C:\Windows\System\etPkgHJ.exe
  2⤵
  PID:5512
- C:\Windows\System\pRLHeGt.exe
  C:\Windows\System\pRLHeGt.exe
  2⤵
  PID:5532
- C:\Windows\System\RzOmizv.exe
  C:\Windows\System\RzOmizv.exe
  2⤵
  PID:5548
- C:\Windows\System\hpJzcvL.exe
  C:\Windows\System\hpJzcvL.exe
  2⤵
  PID:5564
- C:\Windows\System\zDKtQDw.exe
  C:\Windows\System\zDKtQDw.exe
  2⤵
  PID:5580
- C:\Windows\System\DgBHJid.exe
  C:\Windows\System\DgBHJid.exe
  2⤵
  PID:5604
- C:\Windows\System\nTxJDev.exe
  C:\Windows\System\nTxJDev.exe
  2⤵
  PID:5620
- C:\Windows\System\axSuvvZ.exe
  C:\Windows\System\axSuvvZ.exe
  2⤵
  PID:5636
- C:\Windows\System\qwmRGjK.exe
  C:\Windows\System\qwmRGjK.exe
  2⤵
  PID:5660
- C:\Windows\System\TKCofAz.exe
  C:\Windows\System\TKCofAz.exe
  2⤵
  PID:5716
- C:\Windows\System\KtGlGvI.exe
  C:\Windows\System\KtGlGvI.exe
  2⤵
  PID:5740
- C:\Windows\System\kpggtZB.exe
  C:\Windows\System\kpggtZB.exe
  2⤵
  PID:5772
- C:\Windows\System\KVNswpZ.exe
  C:\Windows\System\KVNswpZ.exe
  2⤵
  PID:5788
- C:\Windows\System\lQrvsjq.exe
  C:\Windows\System\lQrvsjq.exe
  2⤵
  PID:5804
- C:\Windows\System\niazdIR.exe
  C:\Windows\System\niazdIR.exe
  2⤵
  PID:5820
- C:\Windows\System\FudiXmS.exe
  C:\Windows\System\FudiXmS.exe
  2⤵
  PID:5836
- C:\Windows\System\kFEgmaQ.exe
  C:\Windows\System\kFEgmaQ.exe
  2⤵
  PID:5852
- C:\Windows\System\GWjkPuT.exe
  C:\Windows\System\GWjkPuT.exe
  2⤵
  PID:5868
- C:\Windows\System\PCiYQkE.exe
  C:\Windows\System\PCiYQkE.exe
  2⤵
  PID:5884
- C:\Windows\System\xRwAMdg.exe
  C:\Windows\System\xRwAMdg.exe
  2⤵
  PID:5900
- C:\Windows\System\LgHljgS.exe
  C:\Windows\System\LgHljgS.exe
  2⤵
  PID:5916
- C:\Windows\System\izfEOWm.exe
  C:\Windows\System\izfEOWm.exe
  2⤵
  PID:5940
- C:\Windows\System\hsNQiZR.exe
  C:\Windows\System\hsNQiZR.exe
  2⤵
  PID:5956
- C:\Windows\System\PwaETpu.exe
  C:\Windows\System\PwaETpu.exe
  2⤵
  PID:5976
- C:\Windows\System\vloucrO.exe
  C:\Windows\System\vloucrO.exe
  2⤵
  PID:5992
- C:\Windows\System\WuzltxV.exe
  C:\Windows\System\WuzltxV.exe
  2⤵
  PID:6008
- C:\Windows\System\YZXpKbT.exe
  C:\Windows\System\YZXpKbT.exe
  2⤵
  PID:6024
- C:\Windows\System\RgXthUl.exe
  C:\Windows\System\RgXthUl.exe
  2⤵
  PID:6040
- C:\Windows\System\gLiLlVh.exe
  C:\Windows\System\gLiLlVh.exe
  2⤵
  PID:6056
- C:\Windows\System\LHxGMtX.exe
  C:\Windows\System\LHxGMtX.exe
  2⤵
  PID:6072
- C:\Windows\System\oZrlSXS.exe
  C:\Windows\System\oZrlSXS.exe
  2⤵
  PID:6088
- C:\Windows\System\ecSQdZg.exe
  C:\Windows\System\ecSQdZg.exe
  2⤵
  PID:6104
- C:\Windows\System\AoMDGxc.exe
  C:\Windows\System\AoMDGxc.exe
  2⤵
  PID:6120
- C:\Windows\System\mZsNQeJ.exe
  C:\Windows\System\mZsNQeJ.exe
  2⤵
  PID:6136
- C:\Windows\System\zxgHxrn.exe
  C:\Windows\System\zxgHxrn.exe
  2⤵
  PID:5124
- C:\Windows\System\RSqOYDv.exe
  C:\Windows\System\RSqOYDv.exe
  2⤵
  PID:4420
- C:\Windows\System\dOnPJZV.exe
  C:\Windows\System\dOnPJZV.exe
  2⤵
  PID:5160
- C:\Windows\System\WqjQqze.exe
  C:\Windows\System\WqjQqze.exe
  2⤵
  PID:5192
- C:\Windows\System\iSxywkB.exe
  C:\Windows\System\iSxywkB.exe
  2⤵
  PID:5208
- C:\Windows\System\AsRnQNd.exe
  C:\Windows\System\AsRnQNd.exe
  2⤵
  PID:5240
- C:\Windows\System\GhkVFjB.exe
  C:\Windows\System\GhkVFjB.exe
  2⤵
  PID:5288
- C:\Windows\System\BttBLSY.exe
  C:\Windows\System\BttBLSY.exe
  2⤵
  PID:5272
- C:\Windows\System\kXsmaJG.exe
  C:\Windows\System\kXsmaJG.exe
  2⤵
  PID:5384
- C:\Windows\System\fNCCzQl.exe
  C:\Windows\System\fNCCzQl.exe
  2⤵
  PID:5308
- C:\Windows\System\RixaHHm.exe
  C:\Windows\System\RixaHHm.exe
  2⤵
  PID:5400
- C:\Windows\System\PdTZlfm.exe
  C:\Windows\System\PdTZlfm.exe
  2⤵
  PID:2636
- C:\Windows\System\AkJkflk.exe
  C:\Windows\System\AkJkflk.exe
  2⤵
  PID:5440
- C:\Windows\System\GiYXEja.exe
  C:\Windows\System\GiYXEja.exe
  2⤵
  PID:5460
- C:\Windows\System\gmQAIeB.exe
  C:\Windows\System\gmQAIeB.exe
  2⤵
  PID:5476
- C:\Windows\System\iKXVkdJ.exe
  C:\Windows\System\iKXVkdJ.exe
  2⤵
  PID:5520
- C:\Windows\System\XrjpenL.exe
  C:\Windows\System\XrjpenL.exe
  2⤵
  PID:5596
- C:\Windows\System\jNTyjhx.exe
  C:\Windows\System\jNTyjhx.exe
  2⤵
  PID:5616
- C:\Windows\System\aQsHiLB.exe
  C:\Windows\System\aQsHiLB.exe
  2⤵
  PID:5692
- C:\Windows\System\qhlHGPC.exe
  C:\Windows\System\qhlHGPC.exe
  2⤵
  PID:5712
- C:\Windows\System\ihHPvKU.exe
  C:\Windows\System\ihHPvKU.exe
  2⤵
  PID:5796
- C:\Windows\System\YRLIsNS.exe
  C:\Windows\System\YRLIsNS.exe
  2⤵
  PID:5732
- C:\Windows\System\TVTRMay.exe
  C:\Windows\System\TVTRMay.exe
  2⤵
  PID:5880
- C:\Windows\System\MzKNfdN.exe
  C:\Windows\System\MzKNfdN.exe
  2⤵
  PID:5844
- C:\Windows\System\BuhJuPd.exe
  C:\Windows\System\BuhJuPd.exe
  2⤵
  PID:5876
- C:\Windows\System\qhPRKle.exe
  C:\Windows\System\qhPRKle.exe
  2⤵
  PID:5932
- C:\Windows\System\cjGjeLN.exe
  C:\Windows\System\cjGjeLN.exe
  2⤵
  PID:6004
- C:\Windows\System\mSQejQp.exe
  C:\Windows\System\mSQejQp.exe
  2⤵
  PID:6064
- C:\Windows\System\hCLSOpS.exe
  C:\Windows\System\hCLSOpS.exe
  2⤵
  PID:5952
- C:\Windows\System\WPiuSxo.exe
  C:\Windows\System\WPiuSxo.exe
  2⤵
  PID:6096
- C:\Windows\System\vwHyEQL.exe
  C:\Windows\System\vwHyEQL.exe
  2⤵
  PID:6084
- C:\Windows\System\wObTQbQ.exe
  C:\Windows\System\wObTQbQ.exe
  2⤵
  PID:5324
- C:\Windows\System\XQsPigI.exe
  C:\Windows\System\XQsPigI.exe
  2⤵
  PID:5388
- C:\Windows\System\hjIkPDB.exe
  C:\Windows\System\hjIkPDB.exe
  2⤵
  PID:5432
- C:\Windows\System\tBvRXDv.exe
  C:\Windows\System\tBvRXDv.exe
  2⤵
  PID:5464
- C:\Windows\System\qgQjjzY.exe
  C:\Windows\System\qgQjjzY.exe
  2⤵
  PID:5496
- C:\Windows\System\YocyDSw.exe
  C:\Windows\System\YocyDSw.exe
  2⤵
  PID:5528
- C:\Windows\System\dglEgEz.exe
  C:\Windows\System\dglEgEz.exe
  2⤵
  PID:5632
- C:\Windows\System\cIMHUyy.exe
  C:\Windows\System\cIMHUyy.exe
  2⤵
  PID:5544
- C:\Windows\System\qTQpuMP.exe
  C:\Windows\System\qTQpuMP.exe
  2⤵
  PID:5540
- C:\Windows\System\rJbVavj.exe
  C:\Windows\System\rJbVavj.exe
  2⤵
  PID:5684
- C:\Windows\System\bpdppoJ.exe
  C:\Windows\System\bpdppoJ.exe
  2⤵
  PID:5676
- C:\Windows\System\nsFlHia.exe
  C:\Windows\System\nsFlHia.exe
  2⤵
  PID:5768
- C:\Windows\System\mQjjoHx.exe
  C:\Windows\System\mQjjoHx.exe
  2⤵
  PID:5800
- C:\Windows\System\eXpqJdp.exe
  C:\Windows\System\eXpqJdp.exe
  2⤵
  PID:5828
- C:\Windows\System\RdsrJEW.exe
  C:\Windows\System\RdsrJEW.exe
  2⤵
  PID:5928
- C:\Windows\System\HGWfDCT.exe
  C:\Windows\System\HGWfDCT.exe
  2⤵
  PID:5812
- C:\Windows\System\VomwrUo.exe
  C:\Windows\System\VomwrUo.exe
  2⤵
  PID:5964
- C:\Windows\System\nyxfwJZ.exe
  C:\Windows\System\nyxfwJZ.exe
  2⤵
  PID:6052
- C:\Windows\System\aQUJmTe.exe
  C:\Windows\System\aQUJmTe.exe
  2⤵
  PID:5128
- C:\Windows\System\tLJqoSH.exe
  C:\Windows\System\tLJqoSH.exe
  2⤵
  PID:6128
- C:\Windows\System\GxjWHus.exe
  C:\Windows\System\GxjWHus.exe
  2⤵
  PID:5172
- C:\Windows\System\EeSybbW.exe
  C:\Windows\System\EeSybbW.exe
  2⤵
  PID:6116
- C:\Windows\System\ztaDaZj.exe
  C:\Windows\System\ztaDaZj.exe
  2⤵
  PID:3596
- C:\Windows\System\vweKfmc.exe
  C:\Windows\System\vweKfmc.exe
  2⤵
  PID:5356
- C:\Windows\System\suIBSkO.exe
  C:\Windows\System\suIBSkO.exe
  2⤵
  PID:5336
- C:\Windows\System\dzwuJyF.exe
  C:\Windows\System\dzwuJyF.exe
  2⤵
  PID:5456
- C:\Windows\System\uqmjRhd.exe
  C:\Windows\System\uqmjRhd.exe
  2⤵
  PID:5560
- C:\Windows\System\VkTxnIp.exe
  C:\Windows\System\VkTxnIp.exe
  2⤵
  PID:5652
- C:\Windows\System\YlmjfEd.exe
  C:\Windows\System\YlmjfEd.exe
  2⤵
  PID:5748
- C:\Windows\System\DnUlCGp.exe
  C:\Windows\System\DnUlCGp.exe
  2⤵
  PID:5756
- C:\Windows\System\IXHAjWB.exe
  C:\Windows\System\IXHAjWB.exe
  2⤵
  PID:5780
- C:\Windows\System\LAPmhlq.exe
  C:\Windows\System\LAPmhlq.exe
  2⤵
  PID:6036
- C:\Windows\System\btKettu.exe
  C:\Windows\System\btKettu.exe
  2⤵
  PID:6048
- C:\Windows\System\pLnjUeS.exe
  C:\Windows\System\pLnjUeS.exe
  2⤵
  PID:5984
- C:\Windows\System\hcGKcsn.exe
  C:\Windows\System\hcGKcsn.exe
  2⤵
  PID:2680
- C:\Windows\System\IgeDGLX.exe
  C:\Windows\System\IgeDGLX.exe
  2⤵
  PID:6112
- C:\Windows\System\kxSWwnu.exe
  C:\Windows\System\kxSWwnu.exe
  2⤵
  PID:5592
- C:\Windows\System\EAaEsvl.exe
  C:\Windows\System\EAaEsvl.exe
  2⤵
  PID:5972
- C:\Windows\System\nyEFZhL.exe
  C:\Windows\System\nyEFZhL.exe
  2⤵
  PID:5860
- C:\Windows\System\bVftssM.exe
  C:\Windows\System\bVftssM.exe
  2⤵
  PID:4664
- C:\Windows\System\wtPZMju.exe
  C:\Windows\System\wtPZMju.exe
  2⤵
  PID:5924
- C:\Windows\System\oiwrDlR.exe
  C:\Windows\System\oiwrDlR.exe
  2⤵
  PID:5556
- C:\Windows\System\lrlsGWM.exe
  C:\Windows\System\lrlsGWM.exe
  2⤵
  PID:5204
- C:\Windows\System\xLhsWbg.exe
  C:\Windows\System\xLhsWbg.exe
  2⤵
  PID:5484
- C:\Windows\System\papYLRg.exe
  C:\Windows\System\papYLRg.exe
  2⤵
  PID:5728
- C:\Windows\System\SxMuAfW.exe
  C:\Windows\System\SxMuAfW.exe
  2⤵
  PID:5848
- C:\Windows\System\vaxzErS.exe
  C:\Windows\System\vaxzErS.exe
  2⤵
  PID:6156
- C:\Windows\System\JtgYvZA.exe
  C:\Windows\System\JtgYvZA.exe
  2⤵
  PID:6172
- C:\Windows\System\TJRyUJB.exe
  C:\Windows\System\TJRyUJB.exe
  2⤵
  PID:6188
- C:\Windows\System\HrsscaO.exe
  C:\Windows\System\HrsscaO.exe
  2⤵
  PID:6204
- C:\Windows\System\EYYevQZ.exe
  C:\Windows\System\EYYevQZ.exe
  2⤵
  PID:6220
- C:\Windows\System\JkvPJbh.exe
  C:\Windows\System\JkvPJbh.exe
  2⤵
  PID:6236
- C:\Windows\System\FHQKTCF.exe
  C:\Windows\System\FHQKTCF.exe
  2⤵
  PID:6252
- C:\Windows\System\HRTqXHx.exe
  C:\Windows\System\HRTqXHx.exe
  2⤵
  PID:6268
- C:\Windows\System\IVnRIJz.exe
  C:\Windows\System\IVnRIJz.exe
  2⤵
  PID:6284
- C:\Windows\System\sYhHRyG.exe
  C:\Windows\System\sYhHRyG.exe
  2⤵
  PID:6300
- C:\Windows\System\qzEXVCM.exe
  C:\Windows\System\qzEXVCM.exe
  2⤵
  PID:6320
- C:\Windows\System\luOIqef.exe
  C:\Windows\System\luOIqef.exe
  2⤵
  PID:6336
- C:\Windows\System\xJQsyFZ.exe
  C:\Windows\System\xJQsyFZ.exe
  2⤵
  PID:6352
- C:\Windows\System\kDOKcyK.exe
  C:\Windows\System\kDOKcyK.exe
  2⤵
  PID:6368
- C:\Windows\System\oECuYkS.exe
  C:\Windows\System\oECuYkS.exe
  2⤵
  PID:6384
- C:\Windows\System\VQsEjII.exe
  C:\Windows\System\VQsEjII.exe
  2⤵
  PID:6400
- C:\Windows\System\YqEZFQw.exe
  C:\Windows\System\YqEZFQw.exe
  2⤵
  PID:6416
- C:\Windows\System\EisJCbl.exe
  C:\Windows\System\EisJCbl.exe
  2⤵
  PID:6432
- C:\Windows\System\LkblExF.exe
  C:\Windows\System\LkblExF.exe
  2⤵
  PID:6448
- C:\Windows\System\DmAvWIx.exe
  C:\Windows\System\DmAvWIx.exe
  2⤵
  PID:6464
- C:\Windows\System\dRsHYyn.exe
  C:\Windows\System\dRsHYyn.exe
  2⤵
  PID:6480
- C:\Windows\System\qgAoCbc.exe
  C:\Windows\System\qgAoCbc.exe
  2⤵
  PID:6496
- C:\Windows\System\gqOTtXE.exe
  C:\Windows\System\gqOTtXE.exe
  2⤵
  PID:6512
- C:\Windows\System\kUIwezT.exe
  C:\Windows\System\kUIwezT.exe
  2⤵
  PID:6528
- C:\Windows\System\rtrIkVd.exe
  C:\Windows\System\rtrIkVd.exe
  2⤵
  PID:6544
- C:\Windows\System\psEhMMS.exe
  C:\Windows\System\psEhMMS.exe
  2⤵
  PID:6560
- C:\Windows\System\SUmAkyK.exe
  C:\Windows\System\SUmAkyK.exe
  2⤵
  PID:6576
- C:\Windows\System\aizfvXD.exe
  C:\Windows\System\aizfvXD.exe
  2⤵
  PID:6592
- C:\Windows\System\LpKfTdn.exe
  C:\Windows\System\LpKfTdn.exe
  2⤵
  PID:6608
- C:\Windows\System\yAxHaGk.exe
  C:\Windows\System\yAxHaGk.exe
  2⤵
  PID:6624
- C:\Windows\System\xqzqhPS.exe
  C:\Windows\System\xqzqhPS.exe
  2⤵
  PID:6640
- C:\Windows\System\BseTsIU.exe
  C:\Windows\System\BseTsIU.exe
  2⤵
  PID:6660
- C:\Windows\System\PeCSToU.exe
  C:\Windows\System\PeCSToU.exe
  2⤵
  PID:6676
- C:\Windows\System\iaFXNHG.exe
  C:\Windows\System\iaFXNHG.exe
  2⤵
  PID:6692
- C:\Windows\System\EVvpuKY.exe
  C:\Windows\System\EVvpuKY.exe
  2⤵
  PID:6708
- C:\Windows\System\goYCYGv.exe
  C:\Windows\System\goYCYGv.exe
  2⤵
  PID:6724
- C:\Windows\System\EitYjHU.exe
  C:\Windows\System\EitYjHU.exe
  2⤵
  PID:6740
- C:\Windows\System\JwRphXu.exe
  C:\Windows\System\JwRphXu.exe
  2⤵
  PID:6760
- C:\Windows\System\QiafUtk.exe
  C:\Windows\System\QiafUtk.exe
  2⤵
  PID:6860
- C:\Windows\System\DIMRSHP.exe
  C:\Windows\System\DIMRSHP.exe
  2⤵
  PID:6908
- C:\Windows\System\SNpxmUc.exe
  C:\Windows\System\SNpxmUc.exe
  2⤵
  PID:6932
- C:\Windows\System\YzFXpTy.exe
  C:\Windows\System\YzFXpTy.exe
  2⤵
  PID:6952
- C:\Windows\System\eaqJdGf.exe
  C:\Windows\System\eaqJdGf.exe
  2⤵
  PID:6968
- C:\Windows\System\ZrEmpVQ.exe
  C:\Windows\System\ZrEmpVQ.exe
  2⤵
  PID:6984
- C:\Windows\System\IPKrshA.exe
  C:\Windows\System\IPKrshA.exe
  2⤵
  PID:7000
- C:\Windows\System\ZSbdFwL.exe
  C:\Windows\System\ZSbdFwL.exe
  2⤵
  PID:7016
- C:\Windows\System\SXKKSpY.exe
  C:\Windows\System\SXKKSpY.exe
  2⤵
  PID:7032
- C:\Windows\System\rNJePys.exe
  C:\Windows\System\rNJePys.exe
  2⤵
  PID:7048
- C:\Windows\System\TXYudvb.exe
  C:\Windows\System\TXYudvb.exe
  2⤵
  PID:7064
- C:\Windows\System\KMSNujf.exe
  C:\Windows\System\KMSNujf.exe
  2⤵
  PID:7088
- C:\Windows\System\IchUUur.exe
  C:\Windows\System\IchUUur.exe
  2⤵
  PID:7104
- C:\Windows\System\uuNKGkq.exe
  C:\Windows\System\uuNKGkq.exe
  2⤵
  PID:7124
- C:\Windows\System\qBWHzbq.exe
  C:\Windows\System\qBWHzbq.exe
  2⤵
  PID:7140
- C:\Windows\System\WBtpgka.exe
  C:\Windows\System\WBtpgka.exe
  2⤵
  PID:7156
- C:\Windows\System\FuAHeLu.exe
  C:\Windows\System\FuAHeLu.exe
  2⤵
  PID:5704
- C:\Windows\System\jKViePo.exe
  C:\Windows\System\jKViePo.exe
  2⤵
  PID:5492
- C:\Windows\System\HSqHqWa.exe
  C:\Windows\System\HSqHqWa.exe
  2⤵
  PID:6196
- C:\Windows\System\hFDmVit.exe
  C:\Windows\System\hFDmVit.exe
  2⤵
  PID:6216
- C:\Windows\System\rayGjaO.exe
  C:\Windows\System\rayGjaO.exe
  2⤵
  PID:6308
- C:\Windows\System\ZqTfLVm.exe
  C:\Windows\System\ZqTfLVm.exe
  2⤵
  PID:6348
- C:\Windows\System\iYhfLhO.exe
  C:\Windows\System\iYhfLhO.exe
  2⤵
  PID:6412
- C:\Windows\System\LOwsJbz.exe
  C:\Windows\System\LOwsJbz.exe
  2⤵
  PID:6476
- C:\Windows\System\NgjGCjM.exe
  C:\Windows\System\NgjGCjM.exe
  2⤵
  PID:6536
- C:\Windows\System\xOJJsDj.exe
  C:\Windows\System\xOJJsDj.exe
  2⤵
  PID:6292
- C:\Windows\System\CklqUVu.exe
  C:\Windows\System\CklqUVu.exe
  2⤵
  PID:6524
- C:\Windows\System\mbmBZdu.exe
  C:\Windows\System\mbmBZdu.exe
  2⤵
  PID:6552
- C:\Windows\System\YYYnNLZ.exe
  C:\Windows\System\YYYnNLZ.exe
  2⤵
  PID:6428
- C:\Windows\System\ZWgSDMb.exe
  C:\Windows\System\ZWgSDMb.exe
  2⤵
  PID:6364
- C:\Windows\System\haZbZks.exe
  C:\Windows\System\haZbZks.exe
  2⤵
  PID:6584
- C:\Windows\System\eORKkeW.exe
  C:\Windows\System\eORKkeW.exe
  2⤵
  PID:6620
- C:\Windows\System\nmvlUFx.exe
  C:\Windows\System\nmvlUFx.exe
  2⤵
  PID:6700
- C:\Windows\System\HwbNdFZ.exe
  C:\Windows\System\HwbNdFZ.exe
  2⤵
  PID:6684
- C:\Windows\System\JnVUIMS.exe
  C:\Windows\System\JnVUIMS.exe
  2⤵
  PID:6688
- C:\Windows\System\VHMqsgh.exe
  C:\Windows\System\VHMqsgh.exe
  2⤵
  PID:6752
- C:\Windows\System\AaKNNEf.exe
  C:\Windows\System\AaKNNEf.exe
  2⤵
  PID:6772
- C:\Windows\System\UtuVGZj.exe
  C:\Windows\System\UtuVGZj.exe
  2⤵
  PID:6792
- C:\Windows\System\htuEHXc.exe
  C:\Windows\System\htuEHXc.exe
  2⤵
  PID:6812
- C:\Windows\System\zkmsapw.exe
  C:\Windows\System\zkmsapw.exe
  2⤵
  PID:6828
- C:\Windows\System\jcghZkH.exe
  C:\Windows\System\jcghZkH.exe
  2⤵
  PID:6844
- C:\Windows\System\JavXuBQ.exe
  C:\Windows\System\JavXuBQ.exe
  2⤵
  PID:6856
- C:\Windows\System\ZzaGdis.exe
  C:\Windows\System\ZzaGdis.exe
  2⤵
  PID:6880
- C:\Windows\System\VkGtqom.exe
  C:\Windows\System\VkGtqom.exe
  2⤵
  PID:6904
- C:\Windows\System\jVMvLRm.exe
  C:\Windows\System\jVMvLRm.exe
  2⤵
  PID:6928
- C:\Windows\System\YegJLhE.exe
  C:\Windows\System\YegJLhE.exe
  2⤵
  PID:6992
- C:\Windows\System\GaFuAOo.exe
  C:\Windows\System\GaFuAOo.exe
  2⤵
  PID:7028
- C:\Windows\System\txERSKB.exe
  C:\Windows\System\txERSKB.exe
  2⤵
  PID:6980
- C:\Windows\System\TmUxLjx.exe
  C:\Windows\System\TmUxLjx.exe
  2⤵
  PID:7044
- C:\Windows\System\NHxWfSS.exe
  C:\Windows\System\NHxWfSS.exe
  2⤵
  PID:7076
- C:\Windows\System\TgQidFl.exe
  C:\Windows\System\TgQidFl.exe
  2⤵
  PID:7164
- C:\Windows\System\jrFIeOd.exe
  C:\Windows\System\jrFIeOd.exe
  2⤵
  PID:7148
- C:\Windows\System\hYWnsOp.exe
  C:\Windows\System\hYWnsOp.exe
  2⤵
  PID:6168
- C:\Windows\System\zZJcYDM.exe
  C:\Windows\System\zZJcYDM.exe
  2⤵
  PID:6244
- C:\Windows\System\zIVSbrM.exe
  C:\Windows\System\zIVSbrM.exe
  2⤵
  PID:6264
- C:\Windows\System\XJUpSqI.exe
  C:\Windows\System\XJUpSqI.exe
  2⤵
  PID:6488
- C:\Windows\System\adfXaeQ.exe
  C:\Windows\System\adfXaeQ.exe
  2⤵
  PID:6332
- C:\Windows\System\odfgIkO.exe
  C:\Windows\System\odfgIkO.exe
  2⤵
  PID:6392
- C:\Windows\System\fcYEFRr.exe
  C:\Windows\System\fcYEFRr.exe
  2⤵
  PID:6672
- C:\Windows\System\iiSsGrA.exe
  C:\Windows\System\iiSsGrA.exe
  2⤵
  PID:6748
- C:\Windows\System\rmhGfzE.exe
  C:\Windows\System\rmhGfzE.exe
  2⤵
  PID:6800
- C:\Windows\System\DvhfNCe.exe
  C:\Windows\System\DvhfNCe.exe
  2⤵
  PID:6808
- C:\Windows\System\NwkjmcB.exe
  C:\Windows\System\NwkjmcB.exe
  2⤵
  PID:6784
- C:\Windows\System\UXRwDYG.exe
  C:\Windows\System\UXRwDYG.exe
  2⤵
  PID:6848
- C:\Windows\System\ggwfiUc.exe
  C:\Windows\System\ggwfiUc.exe
  2⤵
  PID:6900
- C:\Windows\System\pxssAsi.exe
  C:\Windows\System\pxssAsi.exe
  2⤵
  PID:6944
- C:\Windows\System\GtrxKEL.exe
  C:\Windows\System\GtrxKEL.exe
  2⤵
  PID:7132
- C:\Windows\System\ZGZsFJP.exe
  C:\Windows\System\ZGZsFJP.exe
  2⤵
  PID:7116
- C:\Windows\System\JBRbmAf.exe
  C:\Windows\System\JBRbmAf.exe
  2⤵
  PID:6152
- C:\Windows\System\qosVUrR.exe
  C:\Windows\System\qosVUrR.exe
  2⤵
  PID:6408
- C:\Windows\System\hFyPwJC.exe
  C:\Windows\System\hFyPwJC.exe
  2⤵
  PID:6876
- C:\Windows\System\nKHMDbK.exe
  C:\Windows\System\nKHMDbK.exe
  2⤵
  PID:6572
- C:\Windows\System\vEFoNrM.exe
  C:\Windows\System\vEFoNrM.exe
  2⤵
  PID:6444
- C:\Windows\System\znoXLEH.exe
  C:\Windows\System\znoXLEH.exe
  2⤵
  PID:6396
- C:\Windows\System\xojfLLL.exe
  C:\Windows\System\xojfLLL.exe
  2⤵
  PID:6720
- C:\Windows\System\RUedCvc.exe
  C:\Windows\System\RUedCvc.exe
  2⤵
  PID:6884
- C:\Windows\System\urpOZNj.exe
  C:\Windows\System\urpOZNj.exe
  2⤵
  PID:6964
- C:\Windows\System\Namssan.exe
  C:\Windows\System\Namssan.exe
  2⤵
  PID:6852
- C:\Windows\System\mqEsbEI.exe
  C:\Windows\System\mqEsbEI.exe
  2⤵
  PID:7060
- C:\Windows\System\GfGNJte.exe
  C:\Windows\System\GfGNJte.exe
  2⤵
  PID:6260
- C:\Windows\System\bZxeoTU.exe
  C:\Windows\System\bZxeoTU.exe
  2⤵
  PID:6344
- C:\Windows\System\ezJgKYu.exe
  C:\Windows\System\ezJgKYu.exe
  2⤵
  PID:6768
- C:\Windows\System\XzWbeSq.exe
  C:\Windows\System\XzWbeSq.exe
  2⤵
  PID:6976
- C:\Windows\System\jUJkYNy.exe
  C:\Windows\System\jUJkYNy.exe
  2⤵
  PID:6788
- C:\Windows\System\XKTLnCa.exe
  C:\Windows\System\XKTLnCa.exe
  2⤵
  PID:6148
- C:\Windows\System\NsCdcgX.exe
  C:\Windows\System\NsCdcgX.exe
  2⤵
  PID:6212
- C:\Windows\System\clKOqKf.exe
  C:\Windows\System\clKOqKf.exe
  2⤵
  PID:6716
- C:\Windows\System\bGnLUzH.exe
  C:\Windows\System\bGnLUzH.exe
  2⤵
  PID:7136
- C:\Windows\System\vYLSBwY.exe
  C:\Windows\System\vYLSBwY.exe
  2⤵
  PID:6600
- C:\Windows\System\kuLAdcz.exe
  C:\Windows\System\kuLAdcz.exe
  2⤵
  PID:7184
- C:\Windows\System\DLsAkko.exe
  C:\Windows\System\DLsAkko.exe
  2⤵
  PID:7200
- C:\Windows\System\wkhSpDz.exe
  C:\Windows\System\wkhSpDz.exe
  2⤵
  PID:7216
- C:\Windows\System\JTFYBSA.exe
  C:\Windows\System\JTFYBSA.exe
  2⤵
  PID:7232
- C:\Windows\System\uubSdWI.exe
  C:\Windows\System\uubSdWI.exe
  2⤵
  PID:7248
- C:\Windows\System\nQkshyW.exe
  C:\Windows\System\nQkshyW.exe
  2⤵
  PID:7264
- C:\Windows\System\yOejwZd.exe
  C:\Windows\System\yOejwZd.exe
  2⤵
  PID:7280
- C:\Windows\System\ubxupMG.exe
  C:\Windows\System\ubxupMG.exe
  2⤵
  PID:7300
- C:\Windows\System\wrZESBU.exe
  C:\Windows\System\wrZESBU.exe
  2⤵
  PID:7316
- C:\Windows\System\prLtcbt.exe
  C:\Windows\System\prLtcbt.exe
  2⤵
  PID:7364
- C:\Windows\System\ytJqlbL.exe
  C:\Windows\System\ytJqlbL.exe
  2⤵
  PID:7428
- C:\Windows\System\DFaVHrI.exe
  C:\Windows\System\DFaVHrI.exe
  2⤵
  PID:7444
- C:\Windows\System\oZmtlbs.exe
  C:\Windows\System\oZmtlbs.exe
  2⤵
  PID:7464
- C:\Windows\System\xIekfjS.exe
  C:\Windows\System\xIekfjS.exe
  2⤵
  PID:7480
- C:\Windows\System\UPpswob.exe
  C:\Windows\System\UPpswob.exe
  2⤵
  PID:7496
- C:\Windows\System\JZIKGbW.exe
  C:\Windows\System\JZIKGbW.exe
  2⤵
  PID:7512
- C:\Windows\System\FfSCbPQ.exe
  C:\Windows\System\FfSCbPQ.exe
  2⤵
  PID:7528
- C:\Windows\System\rmvytFS.exe
  C:\Windows\System\rmvytFS.exe
  2⤵
  PID:7544
- C:\Windows\System\qBlxkTe.exe
  C:\Windows\System\qBlxkTe.exe
  2⤵
  PID:7560
- C:\Windows\System\uZvWPHl.exe
  C:\Windows\System\uZvWPHl.exe
  2⤵
  PID:7576
- C:\Windows\System\UTLSXFs.exe
  C:\Windows\System\UTLSXFs.exe
  2⤵
  PID:7592
- C:\Windows\System\qGrZZjs.exe
  C:\Windows\System\qGrZZjs.exe
  2⤵
  PID:7608
- C:\Windows\System\aMvNplM.exe
  C:\Windows\System\aMvNplM.exe
  2⤵
  PID:7624
- C:\Windows\System\FLUiWmv.exe
  C:\Windows\System\FLUiWmv.exe
  2⤵
  PID:7640
- C:\Windows\System\WyHNGWA.exe
  C:\Windows\System\WyHNGWA.exe
  2⤵
  PID:7656
- C:\Windows\System\lYgweht.exe
  C:\Windows\System\lYgweht.exe
  2⤵
  PID:7672
- C:\Windows\System\JLTALXv.exe
  C:\Windows\System\JLTALXv.exe
  2⤵
  PID:7688
- C:\Windows\System\tQbWKzi.exe
  C:\Windows\System\tQbWKzi.exe
  2⤵
  PID:7704
- C:\Windows\System\iCjEMSv.exe
  C:\Windows\System\iCjEMSv.exe
  2⤵
  PID:7720
- C:\Windows\System\OfEClnl.exe
  C:\Windows\System\OfEClnl.exe
  2⤵
  PID:7736
- C:\Windows\System\DJBBZyN.exe
  C:\Windows\System\DJBBZyN.exe
  2⤵
  PID:7752
- C:\Windows\System\RCprPho.exe
  C:\Windows\System\RCprPho.exe
  2⤵
  PID:7768
- C:\Windows\System\zBmiXyA.exe
  C:\Windows\System\zBmiXyA.exe
  2⤵
  PID:7784
- C:\Windows\System\RYwtTlT.exe
  C:\Windows\System\RYwtTlT.exe
  2⤵
  PID:7800
- C:\Windows\System\FJDSlks.exe
  C:\Windows\System\FJDSlks.exe
  2⤵
  PID:7816
- C:\Windows\System\HjwwFxm.exe
  C:\Windows\System\HjwwFxm.exe
  2⤵
  PID:7832
- C:\Windows\System\dUGmJue.exe
  C:\Windows\System\dUGmJue.exe
  2⤵
  PID:7848
- C:\Windows\System\bWTrAvw.exe
  C:\Windows\System\bWTrAvw.exe
  2⤵
  PID:7864
- C:\Windows\System\MDAAQZf.exe
  C:\Windows\System\MDAAQZf.exe
  2⤵
  PID:7880
- C:\Windows\System\PwVlLyi.exe
  C:\Windows\System\PwVlLyi.exe
  2⤵
  PID:7896
- C:\Windows\System\wKMkXzN.exe
  C:\Windows\System\wKMkXzN.exe
  2⤵
  PID:7912
- C:\Windows\System\tIogxOD.exe
  C:\Windows\System\tIogxOD.exe
  2⤵
  PID:7928
- C:\Windows\System\LQWyjNy.exe
  C:\Windows\System\LQWyjNy.exe
  2⤵
  PID:7944
- C:\Windows\System\rbJQpte.exe
  C:\Windows\System\rbJQpte.exe
  2⤵
  PID:7960
- C:\Windows\System\aHHyIRO.exe
  C:\Windows\System\aHHyIRO.exe
  2⤵
  PID:7976
- C:\Windows\System\XhIHTov.exe
  C:\Windows\System\XhIHTov.exe
  2⤵
  PID:7992
- C:\Windows\System\XoZWFhR.exe
  C:\Windows\System\XoZWFhR.exe
  2⤵
  PID:8008
- C:\Windows\System\qOHEowO.exe
  C:\Windows\System\qOHEowO.exe
  2⤵
  PID:8024
- C:\Windows\System\XgYxlPI.exe
  C:\Windows\System\XgYxlPI.exe
  2⤵
  PID:8040
- C:\Windows\System\QoVSVDH.exe
  C:\Windows\System\QoVSVDH.exe
  2⤵
  PID:8056
- C:\Windows\System\wDsCjcv.exe
  C:\Windows\System\wDsCjcv.exe
  2⤵
  PID:8072
- C:\Windows\System\TNKdwSH.exe
  C:\Windows\System\TNKdwSH.exe
  2⤵
  PID:8088
- C:\Windows\System\GhbwbAq.exe
  C:\Windows\System\GhbwbAq.exe
  2⤵
  PID:8104
- C:\Windows\System\DDXyqLG.exe
  C:\Windows\System\DDXyqLG.exe
  2⤵
  PID:8120
- C:\Windows\System\MCbBvSL.exe
  C:\Windows\System\MCbBvSL.exe
  2⤵
  PID:8136
- C:\Windows\System\EddcDeH.exe
  C:\Windows\System\EddcDeH.exe
  2⤵
  PID:8152
- C:\Windows\System\NIdPgsc.exe
  C:\Windows\System\NIdPgsc.exe
  2⤵
  PID:8168
- C:\Windows\System\wiGlTmb.exe
  C:\Windows\System\wiGlTmb.exe
  2⤵
  PID:8184
- C:\Windows\System\qfHqand.exe
  C:\Windows\System\qfHqand.exe
  2⤵
  PID:6840
- C:\Windows\System\CSgxWop.exe
  C:\Windows\System\CSgxWop.exe
  2⤵
  PID:7224
- C:\Windows\System\nvzWpHq.exe
  C:\Windows\System\nvzWpHq.exe
  2⤵
  PID:6960
- C:\Windows\System\qmUWfZD.exe
  C:\Windows\System\qmUWfZD.exe
  2⤵
  PID:7176
- C:\Windows\System\aUAIYDc.exe
  C:\Windows\System\aUAIYDc.exe
  2⤵
  PID:7288
- C:\Windows\System\kWrddVW.exe
  C:\Windows\System\kWrddVW.exe
  2⤵
  PID:7308
- C:\Windows\System\juCERXG.exe
  C:\Windows\System\juCERXG.exe
  2⤵
  PID:7328
- C:\Windows\System\vwOoYOO.exe
  C:\Windows\System\vwOoYOO.exe
  2⤵
  PID:7348
- C:\Windows\System\xJlIvXb.exe
  C:\Windows\System\xJlIvXb.exe
  2⤵
  PID:7380
- C:\Windows\System\TxiyXTO.exe
  C:\Windows\System\TxiyXTO.exe
  2⤵
  PID:7392
- C:\Windows\System\QoVdoYH.exe
  C:\Windows\System\QoVdoYH.exe
  2⤵
  PID:7404
- C:\Windows\System\NVxnXeb.exe
  C:\Windows\System\NVxnXeb.exe
  2⤵
  PID:7408
- C:\Windows\System\XPLvXgo.exe
  C:\Windows\System\XPLvXgo.exe
  2⤵
  PID:7452
- C:\Windows\System\TmClPCg.exe
  C:\Windows\System\TmClPCg.exe
  2⤵
  PID:7476
- C:\Windows\System\FuABsHi.exe
  C:\Windows\System\FuABsHi.exe
  2⤵
  PID:7536
- C:\Windows\System\zoPhniu.exe
  C:\Windows\System\zoPhniu.exe
  2⤵
  PID:7524
- C:\Windows\System\DjbGXLp.exe
  C:\Windows\System\DjbGXLp.exe
  2⤵
  PID:7572
- C:\Windows\System\iUHpUxl.exe
  C:\Windows\System\iUHpUxl.exe
  2⤵
  PID:7632
- C:\Windows\System\fzcEJZS.exe
  C:\Windows\System\fzcEJZS.exe
  2⤵
  PID:7668
- C:\Windows\System\FKaZlYz.exe
  C:\Windows\System\FKaZlYz.exe
  2⤵
  PID:7728
- C:\Windows\System\XkDLaSA.exe
  C:\Windows\System\XkDLaSA.exe
  2⤵
  PID:7760
- C:\Windows\System\RUQunqC.exe
  C:\Windows\System\RUQunqC.exe
  2⤵
  PID:7792
- C:\Windows\System\JwqXasn.exe
  C:\Windows\System\JwqXasn.exe
  2⤵
  PID:7652
- C:\Windows\System\cCyJevZ.exe
  C:\Windows\System\cCyJevZ.exe
  2⤵
  PID:7744
- C:\Windows\System\MqFjhrF.exe
  C:\Windows\System\MqFjhrF.exe
  2⤵
  PID:7828
- C:\Windows\System\RirVNGI.exe
  C:\Windows\System\RirVNGI.exe
  2⤵
  PID:7892
- C:\Windows\System\GfROMAB.exe
  C:\Windows\System\GfROMAB.exe
  2⤵
  PID:7904
- C:\Windows\System\TvXSlST.exe
  C:\Windows\System\TvXSlST.exe
  2⤵
  PID:7876
- C:\Windows\System\NNusxAQ.exe
  C:\Windows\System\NNusxAQ.exe
  2⤵
  PID:7968
- C:\Windows\System\Jycxkxz.exe
  C:\Windows\System\Jycxkxz.exe
  2⤵
  PID:7988
- C:\Windows\System\LxfMPdF.exe
  C:\Windows\System\LxfMPdF.exe
  2⤵
  PID:8048
- C:\Windows\System\yNkDjtD.exe
  C:\Windows\System\yNkDjtD.exe
  2⤵
  PID:8052
- C:\Windows\System\IpqQFVc.exe
  C:\Windows\System\IpqQFVc.exe
  2⤵
  PID:8036
- C:\Windows\System\IzdGRli.exe
  C:\Windows\System\IzdGRli.exe
  2⤵
  PID:8096
- C:\Windows\System\rUlCxEq.exe
  C:\Windows\System\rUlCxEq.exe
  2⤵
  PID:8180
- C:\Windows\System\uWZudxh.exe
  C:\Windows\System\uWZudxh.exe
  2⤵
  PID:8128
- C:\Windows\System\AxOIsBq.exe
  C:\Windows\System\AxOIsBq.exe
  2⤵
  PID:8160
- C:\Windows\System\DkCxdQM.exe
  C:\Windows\System\DkCxdQM.exe
  2⤵
  PID:7228
- C:\Windows\System\aVFEzKU.exe
  C:\Windows\System\aVFEzKU.exe
  2⤵
  PID:7340
- C:\Windows\System\FeQANBQ.exe
  C:\Windows\System\FeQANBQ.exe
  2⤵
  PID:7372
- C:\Windows\System\QQNgWWg.exe
  C:\Windows\System\QQNgWWg.exe
  2⤵
  PID:7332
- C:\Windows\System\KnIvuMk.exe
  C:\Windows\System\KnIvuMk.exe
  2⤵
  PID:7400
- C:\Windows\System\oGRFOFz.exe
  C:\Windows\System\oGRFOFz.exe
  2⤵
  PID:7504
- C:\Windows\System\hfUbbQH.exe
  C:\Windows\System\hfUbbQH.exe
  2⤵
  PID:7540
- C:\Windows\System\fhyzGex.exe
  C:\Windows\System\fhyzGex.exe
  2⤵
  PID:7556
- C:\Windows\System\XZuiYQE.exe
  C:\Windows\System\XZuiYQE.exe
  2⤵
  PID:7636
- C:\Windows\System\TLeFlsj.exe
  C:\Windows\System\TLeFlsj.exe
  2⤵
  PID:7716
- C:\Windows\System\CkZFlZA.exe
  C:\Windows\System\CkZFlZA.exe
  2⤵
  PID:7684
- C:\Windows\System\QqslHul.exe
  C:\Windows\System\QqslHul.exe
  2⤵
  PID:7888
- C:\Windows\System\uKTvPLU.exe
  C:\Windows\System\uKTvPLU.exe
  2⤵
  PID:7872
- C:\Windows\System\rwtyIjR.exe
  C:\Windows\System\rwtyIjR.exe
  2⤵
  PID:8004
- C:\Windows\System\hWYlQAY.exe
  C:\Windows\System\hWYlQAY.exe
  2⤵
  PID:7012
- C:\Windows\System\NDjiYHO.exe
  C:\Windows\System\NDjiYHO.exe
  2⤵
  PID:8100
- C:\Windows\System\jOALnsc.exe
  C:\Windows\System\jOALnsc.exe
  2⤵
  PID:8144
- C:\Windows\System\HVRrFIM.exe
  C:\Windows\System\HVRrFIM.exe
  2⤵
  PID:7256
- C:\Windows\System\KxfUrbx.exe
  C:\Windows\System\KxfUrbx.exe
  2⤵
  PID:7344
- C:\Windows\System\AuDXuLG.exe
  C:\Windows\System\AuDXuLG.exe
  2⤵
  PID:7440
- C:\Windows\System\QzUlqox.exe
  C:\Windows\System\QzUlqox.exe
  2⤵
  PID:7424
- C:\Windows\System\tVSLiFd.exe
  C:\Windows\System\tVSLiFd.exe
  2⤵
  PID:7492
- C:\Windows\System\vTTInSP.exe
  C:\Windows\System\vTTInSP.exe
  2⤵
  PID:7812
- C:\Windows\System\IbjjcmK.exe
  C:\Windows\System\IbjjcmK.exe
  2⤵
  PID:7920
- C:\Windows\System\nTNlJlT.exe
  C:\Windows\System\nTNlJlT.exe
  2⤵
  PID:7808
- C:\Windows\System\cdjjghw.exe
  C:\Windows\System\cdjjghw.exe
  2⤵
  PID:8064
- C:\Windows\System\rOhKAxd.exe
  C:\Windows\System\rOhKAxd.exe
  2⤵
  PID:7208
- C:\Windows\System\IyPANiI.exe
  C:\Windows\System\IyPANiI.exe
  2⤵
  PID:7460
- C:\Windows\System\GFzfTnf.exe
  C:\Windows\System\GFzfTnf.exe
  2⤵
  PID:7680
- C:\Windows\System\okgRCiq.exe
  C:\Windows\System\okgRCiq.exe
  2⤵
  PID:7940
- C:\Windows\System\EjYGrKW.exe
  C:\Windows\System\EjYGrKW.exe
  2⤵
  PID:6616
- C:\Windows\System\zwxEzGP.exe
  C:\Windows\System\zwxEzGP.exe
  2⤵
  PID:8220
- C:\Windows\System\uJSbEGZ.exe
  C:\Windows\System\uJSbEGZ.exe
  2⤵
  PID:8236
- C:\Windows\System\bGDFWHw.exe
  C:\Windows\System\bGDFWHw.exe
  2⤵
  PID:8252
- C:\Windows\System\UCvTNru.exe
  C:\Windows\System\UCvTNru.exe
  2⤵
  PID:8268
- C:\Windows\System\LiCqbZX.exe
  C:\Windows\System\LiCqbZX.exe
  2⤵
  PID:8284
- C:\Windows\System\kTZNHFb.exe
  C:\Windows\System\kTZNHFb.exe
  2⤵
  PID:8300
- C:\Windows\System\trSijVL.exe
  C:\Windows\System\trSijVL.exe
  2⤵
  PID:8316
- C:\Windows\System\KTqlHnM.exe
  C:\Windows\System\KTqlHnM.exe
  2⤵
  PID:8332
- C:\Windows\System\vVfGvmt.exe
  C:\Windows\System\vVfGvmt.exe
  2⤵
  PID:8348
- C:\Windows\System\qOyAoAv.exe
  C:\Windows\System\qOyAoAv.exe
  2⤵
  PID:8364
- C:\Windows\System\GFpydGT.exe
  C:\Windows\System\GFpydGT.exe
  2⤵
  PID:8380
- C:\Windows\System\ijjsEgT.exe
  C:\Windows\System\ijjsEgT.exe
  2⤵
  PID:8396
- C:\Windows\System\UcKnpKp.exe
  C:\Windows\System\UcKnpKp.exe
  2⤵
  PID:8412
- C:\Windows\System\MupqucB.exe
  C:\Windows\System\MupqucB.exe
  2⤵
  PID:8428
- C:\Windows\System\XaFtNyN.exe
  C:\Windows\System\XaFtNyN.exe
  2⤵
  PID:8444
- C:\Windows\System\RNEmsjL.exe
  C:\Windows\System\RNEmsjL.exe
  2⤵
  PID:8460
- C:\Windows\System\oWZJZYJ.exe
  C:\Windows\System\oWZJZYJ.exe
  2⤵
  PID:8476
- C:\Windows\System\vcywkQz.exe
  C:\Windows\System\vcywkQz.exe
  2⤵
  PID:8492
- C:\Windows\System\qVszXqZ.exe
  C:\Windows\System\qVszXqZ.exe
  2⤵
  PID:8508
- C:\Windows\System\LImLaot.exe
  C:\Windows\System\LImLaot.exe
  2⤵
  PID:8524
- C:\Windows\System\RvqosRT.exe
  C:\Windows\System\RvqosRT.exe
  2⤵
  PID:8540
- C:\Windows\System\NZzJaza.exe
  C:\Windows\System\NZzJaza.exe
  2⤵
  PID:8556
- C:\Windows\System\DjCgdTD.exe
  C:\Windows\System\DjCgdTD.exe
  2⤵
  PID:8572
- C:\Windows\System\ITbezvp.exe
  C:\Windows\System\ITbezvp.exe
  2⤵
  PID:8588
- C:\Windows\System\KvjlBat.exe
  C:\Windows\System\KvjlBat.exe
  2⤵
  PID:8604
- C:\Windows\System\jLjvbwn.exe
  C:\Windows\System\jLjvbwn.exe
  2⤵
  PID:8624
- C:\Windows\System\wvToiYZ.exe
  C:\Windows\System\wvToiYZ.exe
  2⤵
  PID:8640
- C:\Windows\System\QxjCUIe.exe
  C:\Windows\System\QxjCUIe.exe
  2⤵
  PID:8656
- C:\Windows\System\KMOFqBV.exe
  C:\Windows\System\KMOFqBV.exe
  2⤵
  PID:8672
- C:\Windows\System\guZvwKC.exe
  C:\Windows\System\guZvwKC.exe
  2⤵
  PID:8692
- C:\Windows\System\ucZvabC.exe
  C:\Windows\System\ucZvabC.exe
  2⤵
  PID:8712
- C:\Windows\System\PETKMYv.exe
  C:\Windows\System\PETKMYv.exe
  2⤵
  PID:8728
- C:\Windows\System\wciVwgR.exe
  C:\Windows\System\wciVwgR.exe
  2⤵
  PID:8744
- C:\Windows\System\SAnmivF.exe
  C:\Windows\System\SAnmivF.exe
  2⤵
  PID:8768
- C:\Windows\System\BhGvyDk.exe
  C:\Windows\System\BhGvyDk.exe
  2⤵
  PID:8784
- C:\Windows\System\bpfOXsr.exe
  C:\Windows\System\bpfOXsr.exe
  2⤵
  PID:8800
- C:\Windows\System\oDZnVan.exe
  C:\Windows\System\oDZnVan.exe
  2⤵
  PID:8816
- C:\Windows\System\qPNCBGA.exe
  C:\Windows\System\qPNCBGA.exe
  2⤵
  PID:8836
- C:\Windows\System\SvgmPUV.exe
  C:\Windows\System\SvgmPUV.exe
  2⤵
  PID:8852
- C:\Windows\System\mUyUMqF.exe
  C:\Windows\System\mUyUMqF.exe
  2⤵
  PID:8868
- C:\Windows\System\zsANUqM.exe
  C:\Windows\System\zsANUqM.exe
  2⤵
  PID:8888
- C:\Windows\System\qcemSpU.exe
  C:\Windows\System\qcemSpU.exe
  2⤵
  PID:8904
- C:\Windows\System\WzFyZKX.exe
  C:\Windows\System\WzFyZKX.exe
  2⤵
  PID:8920
- C:\Windows\System\taoueLX.exe
  C:\Windows\System\taoueLX.exe
  2⤵
  PID:8936
- C:\Windows\System\pPwIdtg.exe
  C:\Windows\System\pPwIdtg.exe
  2⤵
  PID:8952
- C:\Windows\System\ZoxGCDq.exe
  C:\Windows\System\ZoxGCDq.exe
  2⤵
  PID:8968
- C:\Windows\System\nCilksQ.exe
  C:\Windows\System\nCilksQ.exe
  2⤵
  PID:8984
- C:\Windows\System\HigGDxP.exe
  C:\Windows\System\HigGDxP.exe
  2⤵
  PID:9000
- C:\Windows\System\tggVudl.exe
  C:\Windows\System\tggVudl.exe
  2⤵
  PID:9016
- C:\Windows\System\GXcdPNc.exe
  C:\Windows\System\GXcdPNc.exe
  2⤵
  PID:9032
- C:\Windows\System\cFbiQzY.exe
  C:\Windows\System\cFbiQzY.exe
  2⤵
  PID:9048
- C:\Windows\System\ebHdyuT.exe
  C:\Windows\System\ebHdyuT.exe
  2⤵
  PID:9064
- C:\Windows\System\QtblMgw.exe
  C:\Windows\System\QtblMgw.exe
  2⤵
  PID:9080
- C:\Windows\System\KNsdxnO.exe
  C:\Windows\System\KNsdxnO.exe
  2⤵
  PID:9096
- C:\Windows\System\fGNFleC.exe
  C:\Windows\System\fGNFleC.exe
  2⤵
  PID:9112
- C:\Windows\System\wzosSIa.exe
  C:\Windows\System\wzosSIa.exe
  2⤵
  PID:9128
- C:\Windows\System\aeSfiap.exe
  C:\Windows\System\aeSfiap.exe
  2⤵
  PID:9144
- C:\Windows\System\MebkYzE.exe
  C:\Windows\System\MebkYzE.exe
  2⤵
  PID:9160
- C:\Windows\System\vBGbyHM.exe
  C:\Windows\System\vBGbyHM.exe
  2⤵
  PID:9176
- C:\Windows\System\JcQKdMR.exe
  C:\Windows\System\JcQKdMR.exe
  2⤵
  PID:9192
- C:\Windows\System\SgHcjCm.exe
  C:\Windows\System\SgHcjCm.exe
  2⤵
  PID:9208
- C:\Windows\System\mcvKeAw.exe
  C:\Windows\System\mcvKeAw.exe
  2⤵
  PID:8228
- C:\Windows\System\GyIDfcX.exe
  C:\Windows\System\GyIDfcX.exe
  2⤵
  PID:8244
- C:\Windows\System\qXMTsYx.exe
  C:\Windows\System\qXMTsYx.exe
  2⤵
  PID:8296
- C:\Windows\System\JBcvPkm.exe
  C:\Windows\System\JBcvPkm.exe
  2⤵
  PID:8340
- C:\Windows\System\DiMPnSh.exe
  C:\Windows\System\DiMPnSh.exe
  2⤵
  PID:8452
- C:\Windows\System\qdgSuZV.exe
  C:\Windows\System\qdgSuZV.exe
  2⤵
  PID:8484
- C:\Windows\System\reTwtgf.exe
  C:\Windows\System\reTwtgf.exe
  2⤵
  PID:8552
- C:\Windows\System\UngepQl.exe
  C:\Windows\System\UngepQl.exe
  2⤵
  PID:8532
- C:\Windows\System\iFElRtD.exe
  C:\Windows\System\iFElRtD.exe
  2⤵
  PID:8564
- C:\Windows\System\ccfzquY.exe
  C:\Windows\System\ccfzquY.exe
  2⤵
  PID:8636
- C:\Windows\System\IHIJSeb.exe
  C:\Windows\System\IHIJSeb.exe
  2⤵
  PID:8664
- C:\Windows\System\NNdXrED.exe
  C:\Windows\System\NNdXrED.exe
  2⤵
  PID:8720
- C:\Windows\System\AEVtKlw.exe
  C:\Windows\System\AEVtKlw.exe
  2⤵
  PID:8792
- C:\Windows\System\fvObUzc.exe
  C:\Windows\System\fvObUzc.exe
  2⤵
  PID:8876
- C:\Windows\System\cfKGwii.exe
  C:\Windows\System\cfKGwii.exe
  2⤵
  PID:8916
- C:\Windows\System\WBCsspp.exe
  C:\Windows\System\WBCsspp.exe
  2⤵
  PID:8960
- C:\Windows\System\XwcDXUg.exe
  C:\Windows\System\XwcDXUg.exe
  2⤵
  PID:8980
- C:\Windows\System\evuNBbK.exe
  C:\Windows\System\evuNBbK.exe
  2⤵
  PID:9028
- C:\Windows\System\FaXtGXy.exe
  C:\Windows\System\FaXtGXy.exe
  2⤵
  PID:9092
- C:\Windows\System\bRlNQOs.exe
  C:\Windows\System\bRlNQOs.exe
  2⤵
  PID:9040
- C:\Windows\System\fPURqSm.exe
  C:\Windows\System\fPURqSm.exe
  2⤵
  PID:9072
- C:\Windows\System\yFLtrhG.exe
  C:\Windows\System\yFLtrhG.exe
  2⤵
  PID:9156
- C:\Windows\System\szsXmFO.exe
  C:\Windows\System\szsXmFO.exe
  2⤵
  PID:8148
- C:\Windows\System\zPNKAEA.exe
  C:\Windows\System\zPNKAEA.exe
  2⤵
  PID:9172
- C:\Windows\System\Atxulpn.exe
  C:\Windows\System\Atxulpn.exe
  2⤵
  PID:9200
- C:\Windows\System\JSuBSGq.exe
  C:\Windows\System\JSuBSGq.exe
  2⤵
  PID:8356
- C:\Windows\System\NyZcnFK.exe
  C:\Windows\System\NyZcnFK.exe
  2⤵
  PID:8308
- C:\Windows\System\paQthMj.exe
  C:\Windows\System\paQthMj.exe
  2⤵
  PID:8420
- C:\Windows\System\fRhclGB.exe
  C:\Windows\System\fRhclGB.exe
  2⤵
  PID:8440
- C:\Windows\System\dBBpoOo.exe
  C:\Windows\System\dBBpoOo.exe
  2⤵
  PID:8488
- C:\Windows\System\dNtvBPW.exe
  C:\Windows\System\dNtvBPW.exe
  2⤵
  PID:8584
- C:\Windows\System\FCHToiM.exe
  C:\Windows\System\FCHToiM.exe
  2⤵
  PID:8612
- C:\Windows\System\IhttQkd.exe
  C:\Windows\System\IhttQkd.exe
  2⤵
  PID:8536
- C:\Windows\System\zREeXBc.exe
  C:\Windows\System\zREeXBc.exe
  2⤵
  PID:8704
- C:\Windows\System\nSyAIVd.exe
  C:\Windows\System\nSyAIVd.exe
  2⤵
  PID:8752
- C:\Windows\System\yMSxbKF.exe
  C:\Windows\System\yMSxbKF.exe
  2⤵
  PID:8808
- C:\Windows\System\oyyuUVk.exe
  C:\Windows\System\oyyuUVk.exe
  2⤵
  PID:8812
- C:\Windows\System\FMMSLmn.exe
  C:\Windows\System\FMMSLmn.exe
  2⤵
  PID:8900
- C:\Windows\System\wGJvmTC.exe
  C:\Windows\System\wGJvmTC.exe
  2⤵
  PID:8848
- C:\Windows\System\chiOSYd.exe
  C:\Windows\System\chiOSYd.exe
  2⤵
  PID:9056
- C:\Windows\System\hiLWvVk.exe
  C:\Windows\System\hiLWvVk.exe
  2⤵
  PID:8932
- C:\Windows\System\icyJgjp.exe
  C:\Windows\System\icyJgjp.exe
  2⤵
  PID:9108
- C:\Windows\System\AQxGEqS.exe
  C:\Windows\System\AQxGEqS.exe
  2⤵
  PID:9012
- C:\Windows\System\KNIeWyB.exe
  C:\Windows\System\KNIeWyB.exe
  2⤵
  PID:9152
- C:\Windows\System\WdAIAzd.exe
  C:\Windows\System\WdAIAzd.exe
  2⤵
  PID:8436
- C:\Windows\System\lPgQPWv.exe
  C:\Windows\System\lPgQPWv.exe
  2⤵
  PID:8620
- C:\Windows\System\iFTkudG.exe
  C:\Windows\System\iFTkudG.exe
  2⤵
  PID:8472
- C:\Windows\System\PkgDRKx.exe
  C:\Windows\System\PkgDRKx.exe
  2⤵
  PID:8388
- C:\Windows\System\UFBxcwe.exe
  C:\Windows\System\UFBxcwe.exe
  2⤵
  PID:8600
- C:\Windows\System\xyySVNF.exe
  C:\Windows\System\xyySVNF.exe
  2⤵
  PID:8736
- C:\Windows\System\uuJhEBW.exe
  C:\Windows\System\uuJhEBW.exe
  2⤵
  PID:8776
- C:\Windows\System\DqInlXA.exe
  C:\Windows\System\DqInlXA.exe
  2⤵
  PID:8832
- C:\Windows\System\TujdyVd.exe
  C:\Windows\System\TujdyVd.exe
  2⤵
  PID:8976
- C:\Windows\System\UByqobG.exe
  C:\Windows\System\UByqobG.exe
  2⤵
  PID:9188
- C:\Windows\System\ksTQARv.exe
  C:\Windows\System\ksTQARv.exe
  2⤵
  PID:8548
- C:\Windows\System\LnEgUah.exe
  C:\Windows\System\LnEgUah.exe
  2⤵
  PID:8520
- C:\Windows\System\gCcOLZb.exe
  C:\Windows\System\gCcOLZb.exe
  2⤵
  PID:8780
- C:\Windows\System\imTxwPU.exe
  C:\Windows\System\imTxwPU.exe
  2⤵
  PID:8280
- C:\Windows\System\NyaXDzV.exe
  C:\Windows\System\NyaXDzV.exe
  2⤵
  PID:8944
- C:\Windows\System\fnwygqW.exe
  C:\Windows\System\fnwygqW.exe
  2⤵
  PID:8312
- C:\Windows\System\PPtCHxG.exe
  C:\Windows\System\PPtCHxG.exe
  2⤵
  PID:9224
- C:\Windows\System\ukyYHUj.exe
  C:\Windows\System\ukyYHUj.exe
  2⤵
  PID:9240
- C:\Windows\System\ssNovvW.exe
  C:\Windows\System\ssNovvW.exe
  2⤵
  PID:9256
- C:\Windows\System\RSpIfQb.exe
  C:\Windows\System\RSpIfQb.exe
  2⤵
  PID:9272
- C:\Windows\System\OqjWkXI.exe
  C:\Windows\System\OqjWkXI.exe
  2⤵
  PID:9292
- C:\Windows\System\OLScUtN.exe
  C:\Windows\System\OLScUtN.exe
  2⤵
  PID:9308
- C:\Windows\System\QqatonK.exe
  C:\Windows\System\QqatonK.exe
  2⤵
  PID:9324
- C:\Windows\System\CczAuLn.exe
  C:\Windows\System\CczAuLn.exe
  2⤵
  PID:9340
- C:\Windows\System\FUhKrqC.exe
  C:\Windows\System\FUhKrqC.exe
  2⤵
  PID:9356
- C:\Windows\System\KkjAcpO.exe
  C:\Windows\System\KkjAcpO.exe
  2⤵
  PID:9372
- C:\Windows\System\hsPgudd.exe
  C:\Windows\System\hsPgudd.exe
  2⤵
  PID:9388
- C:\Windows\System\izPpJcL.exe
  C:\Windows\System\izPpJcL.exe
  2⤵
  PID:9404
- C:\Windows\System\QOFteDD.exe
  C:\Windows\System\QOFteDD.exe
  2⤵
  PID:9420
- C:\Windows\System\FHaNtfS.exe
  C:\Windows\System\FHaNtfS.exe
  2⤵
  PID:9436
- C:\Windows\System\KkYFHvS.exe
  C:\Windows\System\KkYFHvS.exe
  2⤵
  PID:9452
- C:\Windows\System\EPvrPGC.exe
  C:\Windows\System\EPvrPGC.exe
  2⤵
  PID:9468
- C:\Windows\System\YvDwMKl.exe
  C:\Windows\System\YvDwMKl.exe
  2⤵
  PID:9488
- C:\Windows\System\AMAVpKv.exe
  C:\Windows\System\AMAVpKv.exe
  2⤵
  PID:9508
- C:\Windows\System\NWNSMbO.exe
  C:\Windows\System\NWNSMbO.exe
  2⤵
  PID:9524
- C:\Windows\System\fWfGVjI.exe
  C:\Windows\System\fWfGVjI.exe
  2⤵
  PID:9540
- C:\Windows\System\udcheCm.exe
  C:\Windows\System\udcheCm.exe
  2⤵
  PID:9556
- C:\Windows\System\PeazOMD.exe
  C:\Windows\System\PeazOMD.exe
  2⤵
  PID:9576
- C:\Windows\System\hUbDvdk.exe
  C:\Windows\System\hUbDvdk.exe
  2⤵
  PID:9596
- C:\Windows\System\VbJUqbg.exe
  C:\Windows\System\VbJUqbg.exe
  2⤵
  PID:9612
- C:\Windows\System\xfdJPcJ.exe
  C:\Windows\System\xfdJPcJ.exe
  2⤵
  PID:9632
- C:\Windows\System\vdzLEyS.exe
  C:\Windows\System\vdzLEyS.exe
  2⤵
  PID:9648
- C:\Windows\System\nklxHCB.exe
  C:\Windows\System\nklxHCB.exe
  2⤵
  PID:9668
- C:\Windows\System\hLUdzNB.exe
  C:\Windows\System\hLUdzNB.exe
  2⤵
  PID:9684
- C:\Windows\System\YEJbJxz.exe
  C:\Windows\System\YEJbJxz.exe
  2⤵
  PID:9700
- C:\Windows\System\eaqEXQm.exe
  C:\Windows\System\eaqEXQm.exe
  2⤵
  PID:9716
- C:\Windows\System\uKgGRZv.exe
  C:\Windows\System\uKgGRZv.exe
  2⤵
  PID:9732
- C:\Windows\System\vsLDppG.exe
  C:\Windows\System\vsLDppG.exe
  2⤵
  PID:9768
- C:\Windows\System\hkevckI.exe
  C:\Windows\System\hkevckI.exe
  2⤵
  PID:9820
- C:\Windows\System\qnHWPZb.exe
  C:\Windows\System\qnHWPZb.exe
  2⤵
  PID:9840
- C:\Windows\System\vMNbGFP.exe
  C:\Windows\System\vMNbGFP.exe
  2⤵
  PID:9860
- C:\Windows\System\vcChhRv.exe
  C:\Windows\System\vcChhRv.exe
  2⤵
  PID:9892
- C:\Windows\System\QnGnunC.exe
  C:\Windows\System\QnGnunC.exe
  2⤵
  PID:9916
- C:\Windows\System\vsfAdmv.exe
  C:\Windows\System\vsfAdmv.exe
  2⤵
  PID:9932
- C:\Windows\System\fXeiLnS.exe
  C:\Windows\System\fXeiLnS.exe
  2⤵
  PID:9948
- C:\Windows\System\SuYTDVC.exe
  C:\Windows\System\SuYTDVC.exe
  2⤵
  PID:9964
- C:\Windows\System\ollIlaX.exe
  C:\Windows\System\ollIlaX.exe
  2⤵
  PID:9988
- C:\Windows\System\EXLKeaJ.exe
  C:\Windows\System\EXLKeaJ.exe
  2⤵
  PID:10032
- C:\Windows\System\DMeOZaz.exe
  C:\Windows\System\DMeOZaz.exe
  2⤵
  PID:8648
- C:\Windows\System\svDOSQr.exe
  C:\Windows\System\svDOSQr.exe
  2⤵
  PID:8964
- C:\Windows\System\tteuKlP.exe
  C:\Windows\System\tteuKlP.exe
  2⤵
  PID:9280
- C:\Windows\System\kQjPJle.exe
  C:\Windows\System\kQjPJle.exe
  2⤵
  PID:9320
- C:\Windows\System\vplgiPu.exe
  C:\Windows\System\vplgiPu.exe
  2⤵
  PID:9300
- C:\Windows\System\bMrJMpG.exe
  C:\Windows\System\bMrJMpG.exe
  2⤵
  PID:9416
- C:\Windows\System\hXCNynD.exe
  C:\Windows\System\hXCNynD.exe
  2⤵
  PID:9268
- C:\Windows\System\dLNrbDX.exe
  C:\Windows\System\dLNrbDX.exe
  2⤵
  PID:9368
- C:\Windows\System\ZOEaOqq.exe
  C:\Windows\System\ZOEaOqq.exe
  2⤵
  PID:9448
- C:\Windows\System\MUuUHYd.exe
  C:\Windows\System\MUuUHYd.exe
  2⤵
  PID:9484
- C:\Windows\System\zrWFMje.exe
  C:\Windows\System\zrWFMje.exe
  2⤵
  PID:9520
- C:\Windows\System\JbNhxhb.exe
  C:\Windows\System\JbNhxhb.exe
  2⤵
  PID:9496
- C:\Windows\System\gxgkLKI.exe
  C:\Windows\System\gxgkLKI.exe
  2⤵
  PID:9536
- C:\Windows\System\ACzHQsQ.exe
  C:\Windows\System\ACzHQsQ.exe
  2⤵
  PID:9568
- C:\Windows\System\ajugioz.exe
  C:\Windows\System\ajugioz.exe
  2⤵
  PID:9624
- C:\Windows\System\BxbmjtI.exe
  C:\Windows\System\BxbmjtI.exe
  2⤵
  PID:9604
- C:\Windows\System\kCCyXgQ.exe
  C:\Windows\System\kCCyXgQ.exe
  2⤵
  PID:9664
- C:\Windows\System\rFiniOx.exe
  C:\Windows\System\rFiniOx.exe
  2⤵
  PID:9724
- C:\Windows\System\iHCsvsf.exe
  C:\Windows\System\iHCsvsf.exe
  2⤵
  PID:9712
- C:\Windows\System\kzzgnXD.exe
  C:\Windows\System\kzzgnXD.exe
  2⤵
  PID:9760
- C:\Windows\System\vRSACEj.exe
  C:\Windows\System\vRSACEj.exe
  2⤵
  PID:9788
- C:\Windows\System\plpAuxQ.exe
  C:\Windows\System\plpAuxQ.exe
  2⤵
  PID:9804
- C:\Windows\System\VmdCWTy.exe
  C:\Windows\System\VmdCWTy.exe
  2⤵
  PID:9784
- C:\Windows\System\ZUMadNE.exe
  C:\Windows\System\ZUMadNE.exe
  2⤵
  PID:9908
- C:\Windows\System\ehixwhn.exe
  C:\Windows\System\ehixwhn.exe
  2⤵
  PID:9972
- C:\Windows\System\fPkYcwH.exe
  C:\Windows\System\fPkYcwH.exe
  2⤵
  PID:9944
- C:\Windows\System\WcmOzov.exe
  C:\Windows\System\WcmOzov.exe
  2⤵
  PID:9960
- C:\Windows\System\pNRHlTE.exe
  C:\Windows\System\pNRHlTE.exe
  2⤵
  PID:9884
- C:\Windows\System\vRwbhRP.exe
  C:\Windows\System\vRwbhRP.exe
  2⤵
  PID:9836
- C:\Windows\System\VRtkmJQ.exe
  C:\Windows\System\VRtkmJQ.exe
  2⤵
  PID:9868
- C:\Windows\System\SAyYDZY.exe
  C:\Windows\System\SAyYDZY.exe
  2⤵
  PID:10012
- C:\Windows\System\xXeWUaZ.exe
  C:\Windows\System\xXeWUaZ.exe
  2⤵
  PID:10028
- C:\Windows\System\FfxLyig.exe
  C:\Windows\System\FfxLyig.exe
  2⤵
  PID:10080
- C:\Windows\System\oireICs.exe
  C:\Windows\System\oireICs.exe
  2⤵
  PID:10100
- C:\Windows\System\ODrFkqV.exe
  C:\Windows\System\ODrFkqV.exe
  2⤵
  PID:10156
- C:\Windows\System\EzlXMfR.exe
  C:\Windows\System\EzlXMfR.exe
  2⤵
  PID:10064
- C:\Windows\System\dYEhxtU.exe
  C:\Windows\System\dYEhxtU.exe
  2⤵
  PID:10112
- C:\Windows\System\OHwFvfG.exe
  C:\Windows\System\OHwFvfG.exe
  2⤵
  PID:10132
- C:\Windows\System\WMxeGns.exe
  C:\Windows\System\WMxeGns.exe
  2⤵
  PID:10172
- C:\Windows\System\aaAsEaK.exe
  C:\Windows\System\aaAsEaK.exe
  2⤵
  PID:10196
- C:\Windows\System\PhiwBVL.exe
  C:\Windows\System\PhiwBVL.exe
  2⤵
  PID:10212
- C:\Windows\System\BbRNMeK.exe
  C:\Windows\System\BbRNMeK.exe
  2⤵
  PID:10236
- C:\Windows\System\xyxHPqz.exe
  C:\Windows\System\xyxHPqz.exe
  2⤵
  PID:8824
- C:\Windows\System\qqMAmci.exe
  C:\Windows\System\qqMAmci.exe
  2⤵
  PID:9248
- C:\Windows\System\WRQTFxB.exe
  C:\Windows\System\WRQTFxB.exe
  2⤵
  PID:9384
- C:\Windows\System\IaPxFMt.exe
  C:\Windows\System\IaPxFMt.exe
  2⤵
  PID:9264
- C:\Windows\System\WYJzhte.exe
  C:\Windows\System\WYJzhte.exe
  2⤵
  PID:9504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EvqojUr.exe

Filesize
1.5MB

MD5
fd24ddd0bb41f39599a12360d8ede19e

SHA1
dd66e892ab0819bb8b260c337e814500f0ccf142

SHA256
71f6629937052cf7c87afeddb70342bd383071dd8f24957c1df8b5128361686a

SHA512
4a6f0670365ae6b171632755c541ddcbae22b4d5f294cb3d42f789b035c51f0d999b2864ba053ab9a8c8d415b48c0e19f770b1f2bc72d8a8e46cf6cf880214d5

Download Submit
C:\Windows\system\GwRgkxu.exe

Filesize
1.4MB

MD5
60bbc956a5b3c52b9f9655b33ef51271

SHA1
9436aea81d964cb4f0079f6e10edc516436311a5

SHA256
2f62f9ac5885a7f4a42152453545c676142314a32156e2953c13da5556040b81

SHA512
ea2b36bca0ed51081f180d4220c1081aaf328fc69fe5def029d53643e36a425fdf9d0d1c4776aed2df1ac96a3eb29e8610c9ff61d2cac211e315a962e318efc4

Download Submit
C:\Windows\system\LeMUYsI.exe

Filesize
1.4MB

MD5
c8066c6ccf50bdc7a8874e25766ae34a

SHA1
4e4d3df55de0278d87124d6f2292504f8c4c7db5

SHA256
14b8105737e3f173764f3d604e3e6df64df8a5c4ef685bf0ad40254ee04f1509

SHA512
5728e977c76fe51acab934ff85c1b28c0b156133fd39d1777b3630e4f8764431838ba4b39ce588cd71588c13296b11254e1e7b452a823185d58d4550f94036b5

Download Submit
C:\Windows\system\NDcWJYQ.exe

Filesize
1.4MB

MD5
804cd4400a2cb670a6cdb35ebfb22a50

SHA1
9406be4647029bae2491a3a87055e8df5ff8b6e7

SHA256
4a71df55d1b62d523348ac3ca0c7731837c2aa674812a58cc400eed3426fe53d

SHA512
b192c7850a644e12015b52c9f933fea436c0ec8f3cce5e5c32986abaa631d99efca1628dc8e728820787d0822ea92157a46f5aabb458dd88f7a39c138f7c28f8

Download Submit
C:\Windows\system\NKrjojq.exe

Filesize
1.5MB

MD5
f93aef07772157172ffc40eacd499712

SHA1
0d2a17bcfa968928e57479b562b16e226afa7c06

SHA256
6b31d9ce8b7b156328a04d0495ba8f9e354eeddb7adb3ee40ab2159cda053a98

SHA512
8c2a0d7efc2324052dbb5c1ec8dda75c1cc9c506e2d7027c3d1eb0852ddfde9115d136d33a74c7fbfb6b6f65c69149ea0455b0451584d80ac33ab1d2e35d1f5b

Download Submit
C:\Windows\system\QrtrXZc.exe

Filesize
1.5MB

MD5
3fd053876a7d3991270887c9614c1774

SHA1
c31e7fd94dcdcb9fb4d5ec02890fdef6626b00f7

SHA256
c04615c6789fad774ce14329d281abb50b755762baca891e155398d31fa8561b

SHA512
59ae0c773b4c116e9bbdb6a8dd1de0893d061a31e47534dfaed016d70eafc7c0f7038e0fdd830a5c11d9d339170591056f9bdef66bd5b73a3c1ed3df93723965

Download Submit
C:\Windows\system\RgmEvEw.exe

Filesize
1.5MB

MD5
69c0c03e755299e9ae29cfa645a3e7cd

SHA1
4ae1f69767181ef021b9c08405cfc0f6c304b718

SHA256
c06a41a98af18ee30cb6864c972017588cb57ab7e32538def883d55fc35946ad

SHA512
a58671b783c5ad58e5f2d97b762f078b0e332ee4e8dbc2c914ec81f348f146e08d256064449ae1517ee2fee33efaf09d1d6efb35783bab6396a34ac31d05eba9

Download Submit
C:\Windows\system\UoMNJCL.exe

Filesize
1.5MB

MD5
828581dffa1ecaef34c3fee6d2ac2ee5

SHA1
50fa11a571ee9ab21323bc1422e59a551ad78d08

SHA256
3dde3095cafca5964da4e683faa54a30384b1b662632e624bada28294568a990

SHA512
34649030cfaa15baac85321a17711c7ab81823412b8fa468633d10aab8bf6c04355acea3c8516ea24b66c6e290578a3fd826eab01489b558d13c019372c12f1a

Download Submit
C:\Windows\system\VERjGfY.exe

Filesize
1.5MB

MD5
d355746efb39abbf973ff924ba87320d

SHA1
1018dc998d071f8f6c1a38582df34c4afc8db097

SHA256
42f4e82e32a367a3bf7a29930b316a49d06f343735a9efb84bf4b57bfb1a2186

SHA512
0592973bc5d59945831d9c0ca0805dc8e8ae7e0505435aaa07e6af951c985e7e9dc1ffa97b10df7bac2decf78f58afc3d69846d6b9131aa7d04a3fe8b4698626

Download Submit
C:\Windows\system\XRIrbpk.exe

Filesize
1.4MB

MD5
b02014a7b7f554223eba7496e90c27c4

SHA1
8517003a36e7651ba7bd0651c081c0a6fb1fd55d

SHA256
0d2d592b74ff2dc657039e2d5d235b346d53a3a817eebdcdee4bc9263e287014

SHA512
e5017a63dc4ca88751879b3f5ab65c24ce22bf05f41b04a7a24fa6333cf028be760958d77a8183a30f57fd5ccf9ad709761ffaffc2c7157cb7d0d04aed49801a

Download Submit
C:\Windows\system\ZfXasvY.exe

Filesize
1.4MB

MD5
a09f55ca74080e24f30d8b932a4601ea

SHA1
2d3e9fea94b129e5c6862188adf08bf1d851a4bf

SHA256
37311e73f18f2ca15936bbbe87347933ce701336974176ebf03592726587e3a7

SHA512
0d9debcb525ce002a86c37d29cba01d2653d6ef686aa05796e1584fd03aad0814e495a7b42f4e6855ed452d19cf1d1d8d6e1a520fd358790bdde30b2a05513f8

Download Submit
C:\Windows\system\dWcOJCl.exe

Filesize
1.4MB

MD5
28283f340a7bcc66ac2c9f480d271f39

SHA1
1cd49646229387472eb4e8a415398be8d6202696

SHA256
fbe7fe0280a68ac2aac8ecfae62a52bdfb6c3a94d083424fb3ad6f3bd87f5b5b

SHA512
b61f9c7ff588fed3200237f058ee283106fff4f95ad2427c1ba702d006a8ac97024757f470afa40db1bd90be95e19d7802435933f1ad5db7c82c4a6aef9b6266

Download Submit
C:\Windows\system\fyKWaMk.exe

Filesize
1.4MB

MD5
733f454b1c8af8653e98dd71e7b2714b

SHA1
ef25417923f12e0ab4c10dafbc65eb1e084cd590

SHA256
689c0671ddeab8ca807e10de3e080680f138400251c652dfad79783757d281d4

SHA512
6c4cc833dff29fa80acc9d54a282a0b984b7de927898f63865fece8bdaeea0a457b63d6dbb163dd5a30a066a7514519b9440f30e022bbd03feb8b8e151fa4eb2

Download Submit
C:\Windows\system\fyayqdX.exe

Filesize
1.4MB

MD5
539d65eb0be58267e8976bb544fb56cd

SHA1
f8f420a01da4f98a162883d95f9b009211cc6801

SHA256
4bf6f944f248972943fdd5edb0d07412377e92c0f2ec0e8b75770ba3b2e17b89

SHA512
931425db9b83f5ce946b964de34df526ed39d8d1f33247a4e00a96f70fdc687e116f64093d8c64362e46296e6e463c81715877f28f57bdd7faa0757f16e62cd6

Download Submit
C:\Windows\system\gUobQkP.exe

Filesize
1.5MB

MD5
28a1022305a60aab06d04e5e4d163b03

SHA1
44ff8863ec542b116e8f8662d10aeb23349f2044

SHA256
e271d37dcc73781842b6749781816e203efdea2eedff647d5df3b429e623aadf

SHA512
002c1e961e1c7ac1caa8554222f596b8b6c5b1358ffb5b01aa5d39d85e35c84a40786a6566f26186a93977aded597af0eefddf9fa5c2793cb60a02b77d0b9cb4

Download Submit
C:\Windows\system\hrjzqrb.exe

Filesize
1.5MB

MD5
122a3fbf838906790ac1f6a6e5a629c0

SHA1
13c3676eb0d952aedf750a3e5bf45d42a71821ea

SHA256
1b98a4c5cf21c33afedfbad8eb58303a324e50bf8eb37bdeee40a93442744d1d

SHA512
3096a741a069d555005b8a5388db5d8833d7435f42c3cca41d2916b649ecf68752c706abd167a9b13d316601d7ba249c5163d82bcd055b033e15a07a03d3523e

Download Submit
C:\Windows\system\jTiLWzk.exe

Filesize
1.5MB

MD5
c711df16c2dbcd8e23ab78dc0bc51788

SHA1
345637f4114e88897bd5658a18afd34041925576

SHA256
96acc62858d1783be991e60d95f846775dfb8234635e089ddab93617fdc30656

SHA512
d16da59a61fbd1a2c733d0132aec8919a0d1274135a49c4b238a39cd59daa10a3c48e460cbbe8896da7dd607968dbaf584227f765804aa400aa5db8f2c393cd9

Download Submit
C:\Windows\system\lEEIYVw.exe

Filesize
1.4MB

MD5
4f634e3e3de8fb0604efcc8df616d66d

SHA1
e4350873282b743def19ae5d7286d65e9c137155

SHA256
1ef2d5ec20f022b251fd8b5765719946e7419a20de25898e13464ed0e530e256

SHA512
836b82cd3b570fc8051a87895fdc56a900c156cb53687c3d421966348024288fadc9735a004560507ee82d555a5dac10912d1521ca8781ffcb771ce79a23b54f

Download Submit
C:\Windows\system\mNEgllQ.exe

Filesize
1.5MB

MD5
292eb927ef8c4ba9e654f08d048b58a8

SHA1
9f8bd361100b0410013ba62008d09a59b3dea9bb

SHA256
f62baadf05b96188ab0d3f1a25d04e16ea3bda4cc1cef3dcbc86bd1681cf95df

SHA512
df6e1861720eaa7bd569b9151fd0979e8fa21133f782445a760d70a81390ca1eb18de109293e75999f0c8b928071c12a2711c68807619f233cab36b95ecc09ea

Download Submit
C:\Windows\system\mWqliLQ.exe

Filesize
1.5MB

MD5
e9a08c57b446d804992da51429ab2de2

SHA1
afb73560219bd8f29dc8bf0f8a85348ab0c924ab

SHA256
735472e1e88feed8e17e4453d5b055999652a6918d75879acc18498f02cd10d4

SHA512
0ee4a75f68dc121314bc381bc8f1d9d42b91bf902e77b1b9b56620816cd84aa75479b7cd32510cb883cb848be5c856e8dcaf673cecfd3bb2d58caa9f0c2e3ad2

Download Submit
C:\Windows\system\odulmgX.exe

Filesize
1.4MB

MD5
fd8872c659681024ad68df077c220f0c

SHA1
20e7e93c86434d7370440bb0a241659338cbaffe

SHA256
ed08bad4f55cd99675fd5516bc3f97e9c22703b925b759943d8cb5aacb5a5edf

SHA512
ca70b84408a20a58e32da14830e8a832273c7a326a7e8cade8f6da5585223db1ac185b8ae112fc35cc890bc6436035297fb0eacf9a559949384913dc2de38aed

Download Submit
C:\Windows\system\pYOiTgr.exe

Filesize
1.5MB

MD5
1cf31d0db431b34410f14d8afa23fdbc

SHA1
3428ba3b08bad721def103381da59db4c45a6c9d

SHA256
0aa23bad637e893235ae362032b30a9cb3ac8f3f0243b2853e4d74e17042f9d1

SHA512
6e9b64d0c820addee6e51339fe62c2873d0bc8a3fbc6aa925bd3cbccc3843d3faa5eb8c225c4fc412e7192cec5538da4147ba953da9eaf48eb29ef899eb0637f

Download Submit
C:\Windows\system\qLMdWTS.exe

Filesize
1.5MB

MD5
bd93af9df4cf32f9801a1204f8bd9087

SHA1
ef7c817bb74a807e6b7e20e246b52e7f571f1c13

SHA256
216e066e4125d5ff6d8a5541e5d687da7e0194d93f26652a4b7eed364442ba22

SHA512
42caf46d861d5ee11ca78dfa19d8ff72f32afd4b1b9313a4c76cb3e9c21b721ce2ba8d2e921888c6fa260373a7d6cd2c9fb70a3e088719e6eb10f4688e796acb

Download Submit
C:\Windows\system\qmdhwFY.exe

Filesize
1.5MB

MD5
822b63ca9180fdb655cf9a3aab16661d

SHA1
5f4e4755b58d7d8049806fb5afd0e91555ffa3bf

SHA256
77d60d881002981731978f682044cb75e9f94e51c34c349adf451b804d590be0

SHA512
d2ef56f03dc213a74c900f2f3a43236d2f812eca23d131e0e9a189f6bed8c817f4ab0e8ca1d9023489e4e3281247219f59dd5716bfa3af07f067ebd73ae02319

Download Submit
C:\Windows\system\sHdbOQs.exe

Filesize
1.5MB

MD5
b626a7cad45bd1cb9c77194e01f68ad2

SHA1
d50b439c0a0d2ce2d1e243c6efdbb373a858a86d

SHA256
88722db48761e2d6a4d7545d3ab6ef877b4156f26caed5e0fb7a08177f08b11e

SHA512
bab2f32ada7545e63cb96606f586ef5fafe223d56cc13027367d58a4970071da0d37b75a7aa0a8f1cf88d4224727a27f168c257c2418e3286593d2685b59abcb

Download Submit
C:\Windows\system\sesNOnq.exe

Filesize
1.5MB

MD5
464c846d2170ae254892e21ae18dd6e8

SHA1
b334736d1a60d5f3b1e2d1f46415a68266b77493

SHA256
4e01d802b1706ce0c4253c86fdc767d1b547265973364a74461e6b4afbc8f621

SHA512
59978c09e4a18dd2f7d378417c061ca13b4bfd0b6402a098f1e2820f2a940eb4c3dfe39abce1047d04bc079491ba859b7cd557f47debb45e39205d5cf17815e2

Download Submit
C:\Windows\system\srVoaGg.exe

Filesize
1.4MB

MD5
07d784394be79ffd7a0230d5b9a975d6

SHA1
bae46ece46e1715b1526711a3d22532b5d5145ca

SHA256
5137c6db0f671606c7549d60dce7f34df6b118d48377c4f05dc5606dcf23aacb

SHA512
15cbadc4cbdca02ab2d9f040aea56afa99c72f632c68a37a442210aa0f7c7039b23eafb1098be762d5f33b4ac8ba99e9b5b4ec1c9bc2ceeefc8d41fb1a1ba0ef

Download Submit
C:\Windows\system\vECMeEi.exe

Filesize
1.5MB

MD5
f21b0b2d2d8dcaf83e6e4fa5077c6596

SHA1
3424c189648591f0a3526fd595921fd3b6ba3b7c

SHA256
bd72047078501bcd0ff11c8c6812931e1b020a20ec1df0c946f1c0489798887d

SHA512
f0105ee8beba8b3e7e4715a36f9d20d8a1acc7745d68aea9b5fc83cb05782c0ab5aa29a87e2605bee86014c11c8a0e3ee48185b700cb17beaa9693295e135b87

Download Submit
C:\Windows\system\wqbtmbx.exe

Filesize
1.5MB

MD5
7e43f9faa9b747c31d72729b21c2bc7a

SHA1
1e5c259f4c5bec601af78486e366f7f1e5890f46

SHA256
00e5e1e439a235b7b1617561e4fb7da297361097160fb44b59f4acd0c22c77d9

SHA512
eac3e341199ecee794401fe35ab753ae7c740515fce0ad32bf4509d6b6b253392df66bdc11935c523eada88ce949f99b8ae4bb1018b05965bd0a79edad270733

Download Submit
C:\Windows\system\xtipyHQ.exe

Filesize
1.4MB

MD5
4438e32ef5bb72f2454e3c9cda484ec6

SHA1
db348fa57ac31deb5197b7b88d3cbfddb495d687

SHA256
2fb01b708722f9a295fe95ae8b3e5366c1f636dea3c341c96be22f3a1911c7bf

SHA512
607ab939c533ac5841ceae58d900198c344b1ba1e4abee1bea0f486b56ec1e390211c26f153640c171ced9c7663b8b7064e5d8769d15da78543595982343ed55

Download Submit
\Windows\system\YpnisJv.exe

Filesize
1.5MB

MD5
334417846526a0c57dedbf710c4de1cb

SHA1
d97f988e810f967c40d36f26bf80475167ecab04

SHA256
ff9e5687dfc39ef98f10f4628dc338a44e4ac659cb7d73db2dd2fa16c858eebc

SHA512
e4739f12a8022235d9019e742da2b8ef2e1ea61e4ae0871eab4b929d87401d110d525aa6977567d42883dd16b3b6d16000da3005052a22dee25498ba38975a23

Download Submit
\Windows\system\rjaZHAA.exe

Filesize
1.4MB

MD5
3f36baa63b55cfcd0ef386505860b707

SHA1
8ab5a149f60582572f219178f769876c5b0a2a8f

SHA256
77e7cd30db75df4508a0bdf8de65779ab2c8e494108f6863f6a3132dceab50da

SHA512
02cff05060845bb16650ef8be0acf1093780cd3e19f597d0e5b9614ba0a69015953bc638f5fa8d8b74369db51b745352f9abf5bcecd7f7d161d6eb2fd6f9e139

Download Submit
memory/2728-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download