xmrig | d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
Size

1.7MB
MD5

35b6fa72b4ec910f0e93ed669ccc17db
SHA1

394c429fb8aff5a04aef326d0fb5b3cc86a45e6b
SHA256

d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0
SHA512

b9681d3fe7f2a284d6a5186fbd312188fb6340ee3d4405a3adde57fc0b5e0ecaa990201e76973f1fea34cd46203d086d7a2356851c12dec7869dff36dd16897b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbkWyTsn:GemTLkNdfE0pZyQ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012262-2.dat	xmrig
behavioral1/files/0x0027000000016d2c-10.dat	xmrig
behavioral1/files/0x0008000000016fc9-15.dat	xmrig
behavioral1/files/0x00070000000170f8-17.dat	xmrig
behavioral1/files/0x0012000000016d3f-24.dat	xmrig
behavioral1/files/0x000700000001756b-28.dat	xmrig
behavioral1/files/0x000700000001756e-35.dat	xmrig
behavioral1/files/0x0002000000018334-40.dat	xmrig
behavioral1/files/0x00080000000186b7-45.dat	xmrig
behavioral1/files/0x000600000001932a-49.dat	xmrig
behavioral1/files/0x00050000000195bd-54.dat	xmrig
behavioral1/files/0x00050000000195c3-64.dat	xmrig
behavioral1/files/0x00050000000195c5-70.dat	xmrig
behavioral1/files/0x000500000001960c-84.dat	xmrig
behavioral1/files/0x000500000001975a-94.dat	xmrig
behavioral1/files/0x0005000000019761-99.dat	xmrig
behavioral1/files/0x00050000000197fd-104.dat	xmrig
behavioral1/files/0x0005000000019820-109.dat	xmrig
behavioral1/files/0x0005000000019c3c-134.dat	xmrig
behavioral1/files/0x0005000000019d61-137.dat	xmrig
behavioral1/files/0x0005000000019e92-154.dat	xmrig
behavioral1/files/0x0005000000019fd4-159.dat	xmrig
behavioral1/files/0x0005000000019d6d-150.dat	xmrig
behavioral1/files/0x0005000000019bf9-129.dat	xmrig
behavioral1/files/0x0005000000019d62-142.dat	xmrig
behavioral1/files/0x0005000000019bf5-120.dat	xmrig
behavioral1/files/0x0005000000019bf6-124.dat	xmrig
behavioral1/files/0x000500000001998d-114.dat	xmrig
behavioral1/files/0x0005000000019643-89.dat	xmrig
behavioral1/files/0x00050000000195c7-79.dat	xmrig
behavioral1/files/0x00050000000195c6-75.dat	xmrig
behavioral1/files/0x00050000000195c1-60.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2260	UrjtLPI.exe
2884	zHzGUHI.exe
2960	OXkXmNJ.exe
2328	FUcqyuK.exe
2160	CHLiAdT.exe
1016	ApNPduB.exe
2168	UZcJJZx.exe
2912	aLRtjgM.exe
2740	htkGJHN.exe
2804	OBQZEGf.exe
640	fLXXAqe.exe
2596	RWDRLQq.exe
1184	lhBQQJV.exe
3040	EUVMDkz.exe
2700	pSksHLK.exe
2384	TUekpLq.exe
2508	BpUbqWQ.exe
3060	SZxDgAr.exe
2840	wrsWRzx.exe
3048	eJtVWan.exe
2176	SDVREGJ.exe
2028	slcfFWA.exe
1704	CZePHKw.exe
2284	VYrVPuY.exe
2172	pNfQHsv.exe
1096	aZEtEOQ.exe
2020	srzDHvm.exe
2080	rGjovKQ.exe
2244	IBDxFXo.exe
2084	XholMJK.exe
1200	neliAWD.exe
1644	RwwaljZ.exe
2704	wUQkgps.exe
1136	REmzuWc.exe
1148	iytfclC.exe
1060	rYrZlQS.exe
548	IfvDAPg.exe
2116	lVJRAEx.exe
2640	ycdnqmR.exe
1040	QqHGDuF.exe
692	gDSfwat.exe
2052	YPjyMhn.exe
1656	kLPYaxX.exe
2396	rpnoiqK.exe
1084	tEREFNe.exe
2388	pNIRPTY.exe
2188	PMSauEp.exe
2660	nkcseUw.exe
952	iGxLssV.exe
760	LLJZuuc.exe
800	YQSoICg.exe
2136	depzkaB.exe
1672	ogvXquR.exe
1564	lhAfnId.exe
1144	nMjzRdE.exe
1748	gtbRWyY.exe
580	WEqofyO.exe
2572	YypMjCo.exe
1964	yfxdaqN.exe
688	bzoQYBN.exe
1692	xWAmxgL.exe
2832	GeHxhlS.exe
2956	dADatzi.exe
2888	hllnUbS.exe

Loads dropped DLL 64 IoCs

pid	Process
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QzANyFs.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\XswyQAQ.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\ZGRVIox.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\zToRKgE.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\haySxng.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\PdgkSpb.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\JjCIxqV.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\waZTAwp.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\IUJWACx.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\oMWwePI.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\gOTXcjB.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\KPpmoOQ.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\hNteGcY.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\HBlRFbp.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\eqwxriT.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\ucfIfam.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\dHJhKGM.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\qZdVcGV.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\KfQsRaz.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\YDQUZoO.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\IUnJGaU.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\eTJCTJv.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\RGuCfEA.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\PKITdSV.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\OOAzfnA.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\nejwGMs.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\gOhvGAo.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\LxyxtLr.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\WGlOZbv.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\prcSwFC.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\zSJLvCr.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\EPCBWIA.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\hBoIPLK.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\CofTcnU.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\oUGHfpN.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\LAbmhRr.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\NVjxEEJ.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\EUVMDkz.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\ylFhDCw.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\hFpaira.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\VlGhxDr.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\vbESEzj.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\EVoCxfL.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\hxAQyui.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\MieLphz.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\EhZhSTf.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\adHTXLd.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\lMFumoK.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\CNWIahO.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\xpBpGfx.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\ThcNtug.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\xBvndWV.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\GyhjwkW.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\PNhCMIb.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\lHStidF.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\TgNaOUh.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\ZozllEB.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\GlwERtM.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\cJFDeyq.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\xSSOFPE.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\lKxZSSM.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\btONWlJ.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\uKjBEaA.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
File created	C:\Windows\System\APoSeAP.exe	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2260	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	31
PID 1684 wrote to memory of 2260	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	31
PID 1684 wrote to memory of 2260	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	31
PID 1684 wrote to memory of 2884	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	32
PID 1684 wrote to memory of 2884	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	32
PID 1684 wrote to memory of 2884	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	32
PID 1684 wrote to memory of 2960	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	33
PID 1684 wrote to memory of 2960	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	33
PID 1684 wrote to memory of 2960	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	33
PID 1684 wrote to memory of 2328	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	34
PID 1684 wrote to memory of 2328	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	34
PID 1684 wrote to memory of 2328	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	34
PID 1684 wrote to memory of 2160	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	35
PID 1684 wrote to memory of 2160	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	35
PID 1684 wrote to memory of 2160	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	35
PID 1684 wrote to memory of 1016	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	36
PID 1684 wrote to memory of 1016	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	36
PID 1684 wrote to memory of 1016	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	36
PID 1684 wrote to memory of 2168	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	37
PID 1684 wrote to memory of 2168	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	37
PID 1684 wrote to memory of 2168	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	37
PID 1684 wrote to memory of 2912	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	38
PID 1684 wrote to memory of 2912	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	38
PID 1684 wrote to memory of 2912	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	38
PID 1684 wrote to memory of 2740	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	39
PID 1684 wrote to memory of 2740	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	39
PID 1684 wrote to memory of 2740	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	39
PID 1684 wrote to memory of 2804	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	40
PID 1684 wrote to memory of 2804	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	40
PID 1684 wrote to memory of 2804	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	40
PID 1684 wrote to memory of 640	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	41
PID 1684 wrote to memory of 640	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	41
PID 1684 wrote to memory of 640	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	41
PID 1684 wrote to memory of 2596	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	42
PID 1684 wrote to memory of 2596	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	42
PID 1684 wrote to memory of 2596	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	42
PID 1684 wrote to memory of 1184	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	43
PID 1684 wrote to memory of 1184	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	43
PID 1684 wrote to memory of 1184	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	43
PID 1684 wrote to memory of 3040	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	44
PID 1684 wrote to memory of 3040	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	44
PID 1684 wrote to memory of 3040	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	44
PID 1684 wrote to memory of 2700	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	45
PID 1684 wrote to memory of 2700	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	45
PID 1684 wrote to memory of 2700	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	45
PID 1684 wrote to memory of 2384	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	46
PID 1684 wrote to memory of 2384	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	46
PID 1684 wrote to memory of 2384	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	46
PID 1684 wrote to memory of 2508	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	47
PID 1684 wrote to memory of 2508	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	47
PID 1684 wrote to memory of 2508	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	47
PID 1684 wrote to memory of 3060	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	48
PID 1684 wrote to memory of 3060	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	48
PID 1684 wrote to memory of 3060	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	48
PID 1684 wrote to memory of 2840	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	49
PID 1684 wrote to memory of 2840	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	49
PID 1684 wrote to memory of 2840	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	49
PID 1684 wrote to memory of 3048	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	50
PID 1684 wrote to memory of 3048	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	50
PID 1684 wrote to memory of 3048	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	50
PID 1684 wrote to memory of 2176	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	51
PID 1684 wrote to memory of 2176	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	51
PID 1684 wrote to memory of 2176	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	51
PID 1684 wrote to memory of 2028	1684	d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe	52

C:\Users\Admin\AppData\Local\Temp\d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe
"C:\Users\Admin\AppData\Local\Temp\d8c45b8eb419cdcd44eeb29d5c69404c9004bccdbb408c0c23852734a5da81b0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\System\UrjtLPI.exe
  C:\Windows\System\UrjtLPI.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\zHzGUHI.exe
  C:\Windows\System\zHzGUHI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\OXkXmNJ.exe
  C:\Windows\System\OXkXmNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\FUcqyuK.exe
  C:\Windows\System\FUcqyuK.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\CHLiAdT.exe
  C:\Windows\System\CHLiAdT.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ApNPduB.exe
  C:\Windows\System\ApNPduB.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\UZcJJZx.exe
  C:\Windows\System\UZcJJZx.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\aLRtjgM.exe
  C:\Windows\System\aLRtjgM.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\htkGJHN.exe
  C:\Windows\System\htkGJHN.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\OBQZEGf.exe
  C:\Windows\System\OBQZEGf.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\fLXXAqe.exe
  C:\Windows\System\fLXXAqe.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\RWDRLQq.exe
  C:\Windows\System\RWDRLQq.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\lhBQQJV.exe
  C:\Windows\System\lhBQQJV.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\EUVMDkz.exe
  C:\Windows\System\EUVMDkz.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\pSksHLK.exe
  C:\Windows\System\pSksHLK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\TUekpLq.exe
  C:\Windows\System\TUekpLq.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\BpUbqWQ.exe
  C:\Windows\System\BpUbqWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\SZxDgAr.exe
  C:\Windows\System\SZxDgAr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\wrsWRzx.exe
  C:\Windows\System\wrsWRzx.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\eJtVWan.exe
  C:\Windows\System\eJtVWan.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\SDVREGJ.exe
  C:\Windows\System\SDVREGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\slcfFWA.exe
  C:\Windows\System\slcfFWA.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\CZePHKw.exe
  C:\Windows\System\CZePHKw.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\VYrVPuY.exe
  C:\Windows\System\VYrVPuY.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\pNfQHsv.exe
  C:\Windows\System\pNfQHsv.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\aZEtEOQ.exe
  C:\Windows\System\aZEtEOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\srzDHvm.exe
  C:\Windows\System\srzDHvm.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\IBDxFXo.exe
  C:\Windows\System\IBDxFXo.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\rGjovKQ.exe
  C:\Windows\System\rGjovKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\XholMJK.exe
  C:\Windows\System\XholMJK.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\neliAWD.exe
  C:\Windows\System\neliAWD.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\RwwaljZ.exe
  C:\Windows\System\RwwaljZ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\wUQkgps.exe
  C:\Windows\System\wUQkgps.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\REmzuWc.exe
  C:\Windows\System\REmzuWc.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\iytfclC.exe
  C:\Windows\System\iytfclC.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\rYrZlQS.exe
  C:\Windows\System\rYrZlQS.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\IfvDAPg.exe
  C:\Windows\System\IfvDAPg.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\lVJRAEx.exe
  C:\Windows\System\lVJRAEx.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ycdnqmR.exe
  C:\Windows\System\ycdnqmR.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\QqHGDuF.exe
  C:\Windows\System\QqHGDuF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\gDSfwat.exe
  C:\Windows\System\gDSfwat.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\YPjyMhn.exe
  C:\Windows\System\YPjyMhn.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\kLPYaxX.exe
  C:\Windows\System\kLPYaxX.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\rpnoiqK.exe
  C:\Windows\System\rpnoiqK.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tEREFNe.exe
  C:\Windows\System\tEREFNe.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\pNIRPTY.exe
  C:\Windows\System\pNIRPTY.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\PMSauEp.exe
  C:\Windows\System\PMSauEp.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nkcseUw.exe
  C:\Windows\System\nkcseUw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\iGxLssV.exe
  C:\Windows\System\iGxLssV.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\LLJZuuc.exe
  C:\Windows\System\LLJZuuc.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\YQSoICg.exe
  C:\Windows\System\YQSoICg.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\depzkaB.exe
  C:\Windows\System\depzkaB.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ogvXquR.exe
  C:\Windows\System\ogvXquR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\lhAfnId.exe
  C:\Windows\System\lhAfnId.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\nMjzRdE.exe
  C:\Windows\System\nMjzRdE.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\WEqofyO.exe
  C:\Windows\System\WEqofyO.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\gtbRWyY.exe
  C:\Windows\System\gtbRWyY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\yfxdaqN.exe
  C:\Windows\System\yfxdaqN.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\YypMjCo.exe
  C:\Windows\System\YypMjCo.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bzoQYBN.exe
  C:\Windows\System\bzoQYBN.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\xWAmxgL.exe
  C:\Windows\System\xWAmxgL.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\GeHxhlS.exe
  C:\Windows\System\GeHxhlS.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\dADatzi.exe
  C:\Windows\System\dADatzi.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\hllnUbS.exe
  C:\Windows\System\hllnUbS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ZunXpFf.exe
  C:\Windows\System\ZunXpFf.exe
  2⤵
  PID:2948
- C:\Windows\System\VLcSpXv.exe
  C:\Windows\System\VLcSpXv.exe
  2⤵
  PID:2768
- C:\Windows\System\UZlWrOu.exe
  C:\Windows\System\UZlWrOu.exe
  2⤵
  PID:2780
- C:\Windows\System\KsMBZup.exe
  C:\Windows\System\KsMBZup.exe
  2⤵
  PID:2924
- C:\Windows\System\LuAjJCk.exe
  C:\Windows\System\LuAjJCk.exe
  2⤵
  PID:2812
- C:\Windows\System\nerYxJY.exe
  C:\Windows\System\nerYxJY.exe
  2⤵
  PID:2504
- C:\Windows\System\wLoggRw.exe
  C:\Windows\System\wLoggRw.exe
  2⤵
  PID:2968
- C:\Windows\System\KCSpzwb.exe
  C:\Windows\System\KCSpzwb.exe
  2⤵
  PID:1624
- C:\Windows\System\kPYuXJh.exe
  C:\Windows\System\kPYuXJh.exe
  2⤵
  PID:2648
- C:\Windows\System\gBWHDyz.exe
  C:\Windows\System\gBWHDyz.exe
  2⤵
  PID:1312
- C:\Windows\System\CIeztHq.exe
  C:\Windows\System\CIeztHq.exe
  2⤵
  PID:3016
- C:\Windows\System\FMtHbSf.exe
  C:\Windows\System\FMtHbSf.exe
  2⤵
  PID:2096
- C:\Windows\System\eCwMouE.exe
  C:\Windows\System\eCwMouE.exe
  2⤵
  PID:2000
- C:\Windows\System\YrSraZt.exe
  C:\Windows\System\YrSraZt.exe
  2⤵
  PID:2916
- C:\Windows\System\FQkfcRv.exe
  C:\Windows\System\FQkfcRv.exe
  2⤵
  PID:2568
- C:\Windows\System\jUDcKVe.exe
  C:\Windows\System\jUDcKVe.exe
  2⤵
  PID:1496
- C:\Windows\System\VKTKOMf.exe
  C:\Windows\System\VKTKOMf.exe
  2⤵
  PID:2432
- C:\Windows\System\nGKYxGi.exe
  C:\Windows\System\nGKYxGi.exe
  2⤵
  PID:3068
- C:\Windows\System\jjOsrAd.exe
  C:\Windows\System\jjOsrAd.exe
  2⤵
  PID:2088
- C:\Windows\System\nNWExjI.exe
  C:\Windows\System\nNWExjI.exe
  2⤵
  PID:1992
- C:\Windows\System\pNdRDdK.exe
  C:\Windows\System\pNdRDdK.exe
  2⤵
  PID:2628
- C:\Windows\System\GUNTAUK.exe
  C:\Windows\System\GUNTAUK.exe
  2⤵
  PID:2064
- C:\Windows\System\pBrImjw.exe
  C:\Windows\System\pBrImjw.exe
  2⤵
  PID:960
- C:\Windows\System\APoSeAP.exe
  C:\Windows\System\APoSeAP.exe
  2⤵
  PID:1480
- C:\Windows\System\jpgatPA.exe
  C:\Windows\System\jpgatPA.exe
  2⤵
  PID:1912
- C:\Windows\System\MuXAEul.exe
  C:\Windows\System\MuXAEul.exe
  2⤵
  PID:1824
- C:\Windows\System\nFntdIS.exe
  C:\Windows\System\nFntdIS.exe
  2⤵
  PID:2688
- C:\Windows\System\UmhRVji.exe
  C:\Windows\System\UmhRVji.exe
  2⤵
  PID:2104
- C:\Windows\System\KzZtiNs.exe
  C:\Windows\System\KzZtiNs.exe
  2⤵
  PID:2356
- C:\Windows\System\yemMXDp.exe
  C:\Windows\System\yemMXDp.exe
  2⤵
  PID:1616
- C:\Windows\System\JOPzrHg.exe
  C:\Windows\System\JOPzrHg.exe
  2⤵
  PID:944
- C:\Windows\System\yAkdlvs.exe
  C:\Windows\System\yAkdlvs.exe
  2⤵
  PID:812
- C:\Windows\System\wdkfltU.exe
  C:\Windows\System\wdkfltU.exe
  2⤵
  PID:1004
- C:\Windows\System\PWpJntR.exe
  C:\Windows\System\PWpJntR.exe
  2⤵
  PID:2208
- C:\Windows\System\LmsANVu.exe
  C:\Windows\System\LmsANVu.exe
  2⤵
  PID:2128
- C:\Windows\System\aRAyDmf.exe
  C:\Windows\System\aRAyDmf.exe
  2⤵
  PID:2696
- C:\Windows\System\eqwxriT.exe
  C:\Windows\System\eqwxriT.exe
  2⤵
  PID:568
- C:\Windows\System\isUMMYt.exe
  C:\Windows\System\isUMMYt.exe
  2⤵
  PID:1588
- C:\Windows\System\yBFZqCg.exe
  C:\Windows\System\yBFZqCg.exe
  2⤵
  PID:2848
- C:\Windows\System\Dnytzpe.exe
  C:\Windows\System\Dnytzpe.exe
  2⤵
  PID:2984
- C:\Windows\System\jFdfokw.exe
  C:\Windows\System\jFdfokw.exe
  2⤵
  PID:2344
- C:\Windows\System\TvxtyGf.exe
  C:\Windows\System\TvxtyGf.exe
  2⤵
  PID:3020
- C:\Windows\System\pUapCHD.exe
  C:\Windows\System\pUapCHD.exe
  2⤵
  PID:2764
- C:\Windows\System\ofomMxz.exe
  C:\Windows\System\ofomMxz.exe
  2⤵
  PID:2184
- C:\Windows\System\ZgBUllI.exe
  C:\Windows\System\ZgBUllI.exe
  2⤵
  PID:752
- C:\Windows\System\tGYAUcm.exe
  C:\Windows\System\tGYAUcm.exe
  2⤵
  PID:2652
- C:\Windows\System\RjafWsf.exe
  C:\Windows\System\RjafWsf.exe
  2⤵
  PID:1636
- C:\Windows\System\YQBAyjY.exe
  C:\Windows\System\YQBAyjY.exe
  2⤵
  PID:1868
- C:\Windows\System\ModQERi.exe
  C:\Windows\System\ModQERi.exe
  2⤵
  PID:2340
- C:\Windows\System\bpcITfi.exe
  C:\Windows\System\bpcITfi.exe
  2⤵
  PID:1708
- C:\Windows\System\eDrATKm.exe
  C:\Windows\System\eDrATKm.exe
  2⤵
  PID:2776
- C:\Windows\System\ArjcvSP.exe
  C:\Windows\System\ArjcvSP.exe
  2⤵
  PID:2476
- C:\Windows\System\oPrXkHb.exe
  C:\Windows\System\oPrXkHb.exe
  2⤵
  PID:1888
- C:\Windows\System\ddnkJRV.exe
  C:\Windows\System\ddnkJRV.exe
  2⤵
  PID:2500
- C:\Windows\System\qoaPNub.exe
  C:\Windows\System\qoaPNub.exe
  2⤵
  PID:2456
- C:\Windows\System\wFZsfjI.exe
  C:\Windows\System\wFZsfjI.exe
  2⤵
  PID:2760
- C:\Windows\System\rheYlWR.exe
  C:\Windows\System\rheYlWR.exe
  2⤵
  PID:2012
- C:\Windows\System\aALFQPL.exe
  C:\Windows\System\aALFQPL.exe
  2⤵
  PID:2632
- C:\Windows\System\lMFumoK.exe
  C:\Windows\System\lMFumoK.exe
  2⤵
  PID:832
- C:\Windows\System\TXicRNX.exe
  C:\Windows\System\TXicRNX.exe
  2⤵
  PID:2228
- C:\Windows\System\cawmwHe.exe
  C:\Windows\System\cawmwHe.exe
  2⤵
  PID:2512
- C:\Windows\System\eODqprx.exe
  C:\Windows\System\eODqprx.exe
  2⤵
  PID:1396
- C:\Windows\System\NZCFYnZ.exe
  C:\Windows\System\NZCFYnZ.exe
  2⤵
  PID:2200
- C:\Windows\System\gApWmLN.exe
  C:\Windows\System\gApWmLN.exe
  2⤵
  PID:2488
- C:\Windows\System\IEkvyEZ.exe
  C:\Windows\System\IEkvyEZ.exe
  2⤵
  PID:1820
- C:\Windows\System\SQJzzJT.exe
  C:\Windows\System\SQJzzJT.exe
  2⤵
  PID:928
- C:\Windows\System\UfdylBB.exe
  C:\Windows\System\UfdylBB.exe
  2⤵
  PID:1568
- C:\Windows\System\LfmACpf.exe
  C:\Windows\System\LfmACpf.exe
  2⤵
  PID:2232
- C:\Windows\System\mVZUqmU.exe
  C:\Windows\System\mVZUqmU.exe
  2⤵
  PID:2324
- C:\Windows\System\rGjNETu.exe
  C:\Windows\System\rGjNETu.exe
  2⤵
  PID:2716
- C:\Windows\System\UzzGJZp.exe
  C:\Windows\System\UzzGJZp.exe
  2⤵
  PID:1728
- C:\Windows\System\tdDPwNT.exe
  C:\Windows\System\tdDPwNT.exe
  2⤵
  PID:1736
- C:\Windows\System\xPShvco.exe
  C:\Windows\System\xPShvco.exe
  2⤵
  PID:976
- C:\Windows\System\dxsmgdI.exe
  C:\Windows\System\dxsmgdI.exe
  2⤵
  PID:2756
- C:\Windows\System\huEtvqP.exe
  C:\Windows\System\huEtvqP.exe
  2⤵
  PID:2996
- C:\Windows\System\iNAciNY.exe
  C:\Windows\System\iNAciNY.exe
  2⤵
  PID:2256
- C:\Windows\System\eoKSwhQ.exe
  C:\Windows\System\eoKSwhQ.exe
  2⤵
  PID:1468
- C:\Windows\System\NYBSUzL.exe
  C:\Windows\System\NYBSUzL.exe
  2⤵
  PID:940
- C:\Windows\System\RRcWwXk.exe
  C:\Windows\System\RRcWwXk.exe
  2⤵
  PID:3024
- C:\Windows\System\BdcpJlT.exe
  C:\Windows\System\BdcpJlT.exe
  2⤵
  PID:296
- C:\Windows\System\utklVvx.exe
  C:\Windows\System\utklVvx.exe
  2⤵
  PID:2100
- C:\Windows\System\jGrZCDv.exe
  C:\Windows\System\jGrZCDv.exe
  2⤵
  PID:1088
- C:\Windows\System\wrgiCgC.exe
  C:\Windows\System\wrgiCgC.exe
  2⤵
  PID:1816
- C:\Windows\System\RvZWTFA.exe
  C:\Windows\System\RvZWTFA.exe
  2⤵
  PID:1956
- C:\Windows\System\lgpWfrV.exe
  C:\Windows\System\lgpWfrV.exe
  2⤵
  PID:788
- C:\Windows\System\MkwFWCQ.exe
  C:\Windows\System\MkwFWCQ.exe
  2⤵
  PID:1972
- C:\Windows\System\wshVXpS.exe
  C:\Windows\System\wshVXpS.exe
  2⤵
  PID:1160
- C:\Windows\System\hKBgawA.exe
  C:\Windows\System\hKBgawA.exe
  2⤵
  PID:2224
- C:\Windows\System\DkysRmI.exe
  C:\Windows\System\DkysRmI.exe
  2⤵
  PID:2748
- C:\Windows\System\dHhQNds.exe
  C:\Windows\System\dHhQNds.exe
  2⤵
  PID:612
- C:\Windows\System\NTaEPSJ.exe
  C:\Windows\System\NTaEPSJ.exe
  2⤵
  PID:2684
- C:\Windows\System\QBdxIDH.exe
  C:\Windows\System\QBdxIDH.exe
  2⤵
  PID:1020
- C:\Windows\System\NxfEafh.exe
  C:\Windows\System\NxfEafh.exe
  2⤵
  PID:2944
- C:\Windows\System\mtGZFJo.exe
  C:\Windows\System\mtGZFJo.exe
  2⤵
  PID:2772
- C:\Windows\System\LkPTKhk.exe
  C:\Windows\System\LkPTKhk.exe
  2⤵
  PID:776
- C:\Windows\System\iPkSFxN.exe
  C:\Windows\System\iPkSFxN.exe
  2⤵
  PID:2336
- C:\Windows\System\MAGlNSF.exe
  C:\Windows\System\MAGlNSF.exe
  2⤵
  PID:2092
- C:\Windows\System\zMkJZCI.exe
  C:\Windows\System\zMkJZCI.exe
  2⤵
  PID:2264
- C:\Windows\System\TnJPfCL.exe
  C:\Windows\System\TnJPfCL.exe
  2⤵
  PID:2320
- C:\Windows\System\aFyPfAD.exe
  C:\Windows\System\aFyPfAD.exe
  2⤵
  PID:676
- C:\Windows\System\yKUPLPj.exe
  C:\Windows\System\yKUPLPj.exe
  2⤵
  PID:1532
- C:\Windows\System\hUInGhR.exe
  C:\Windows\System\hUInGhR.exe
  2⤵
  PID:2280
- C:\Windows\System\qwuWBWl.exe
  C:\Windows\System\qwuWBWl.exe
  2⤵
  PID:2612
- C:\Windows\System\qsZVIBK.exe
  C:\Windows\System\qsZVIBK.exe
  2⤵
  PID:1780
- C:\Windows\System\sIuymjz.exe
  C:\Windows\System\sIuymjz.exe
  2⤵
  PID:2824
- C:\Windows\System\uTysFKh.exe
  C:\Windows\System\uTysFKh.exe
  2⤵
  PID:2556
- C:\Windows\System\VpwzuXB.exe
  C:\Windows\System\VpwzuXB.exe
  2⤵
  PID:2452
- C:\Windows\System\lHeeMQz.exe
  C:\Windows\System\lHeeMQz.exe
  2⤵
  PID:2268
- C:\Windows\System\cPxENDc.exe
  C:\Windows\System\cPxENDc.exe
  2⤵
  PID:1892
- C:\Windows\System\zqWiHJU.exe
  C:\Windows\System\zqWiHJU.exe
  2⤵
  PID:1744
- C:\Windows\System\jNrHNYS.exe
  C:\Windows\System\jNrHNYS.exe
  2⤵
  PID:2852
- C:\Windows\System\IdCeXBa.exe
  C:\Windows\System\IdCeXBa.exe
  2⤵
  PID:1224
- C:\Windows\System\ucfIfam.exe
  C:\Windows\System\ucfIfam.exe
  2⤵
  PID:3088
- C:\Windows\System\qrjMdKB.exe
  C:\Windows\System\qrjMdKB.exe
  2⤵
  PID:3104
- C:\Windows\System\HhypWkG.exe
  C:\Windows\System\HhypWkG.exe
  2⤵
  PID:3136
- C:\Windows\System\sujsAJZ.exe
  C:\Windows\System\sujsAJZ.exe
  2⤵
  PID:3152
- C:\Windows\System\aZfRiBz.exe
  C:\Windows\System\aZfRiBz.exe
  2⤵
  PID:3176
- C:\Windows\System\yTqtGVN.exe
  C:\Windows\System\yTqtGVN.exe
  2⤵
  PID:3196
- C:\Windows\System\hBoIPLK.exe
  C:\Windows\System\hBoIPLK.exe
  2⤵
  PID:3220
- C:\Windows\System\FWHMzLQ.exe
  C:\Windows\System\FWHMzLQ.exe
  2⤵
  PID:3240
- C:\Windows\System\urvJrdp.exe
  C:\Windows\System\urvJrdp.exe
  2⤵
  PID:3256
- C:\Windows\System\IJlOqaP.exe
  C:\Windows\System\IJlOqaP.exe
  2⤵
  PID:3304
- C:\Windows\System\QXINGEl.exe
  C:\Windows\System\QXINGEl.exe
  2⤵
  PID:3320
- C:\Windows\System\nZETdFA.exe
  C:\Windows\System\nZETdFA.exe
  2⤵
  PID:3344
- C:\Windows\System\dVsbMHy.exe
  C:\Windows\System\dVsbMHy.exe
  2⤵
  PID:3364
- C:\Windows\System\TstzkVk.exe
  C:\Windows\System\TstzkVk.exe
  2⤵
  PID:3396
- C:\Windows\System\GYripbL.exe
  C:\Windows\System\GYripbL.exe
  2⤵
  PID:3412
- C:\Windows\System\BApjROD.exe
  C:\Windows\System\BApjROD.exe
  2⤵
  PID:3428
- C:\Windows\System\OIzbBzf.exe
  C:\Windows\System\OIzbBzf.exe
  2⤵
  PID:3448
- C:\Windows\System\CYeKqMl.exe
  C:\Windows\System\CYeKqMl.exe
  2⤵
  PID:3464
- C:\Windows\System\QNpDUxt.exe
  C:\Windows\System\QNpDUxt.exe
  2⤵
  PID:3484
- C:\Windows\System\CHlSGpB.exe
  C:\Windows\System\CHlSGpB.exe
  2⤵
  PID:3504
- C:\Windows\System\gAmHkAM.exe
  C:\Windows\System\gAmHkAM.exe
  2⤵
  PID:3520
- C:\Windows\System\cHcNGeM.exe
  C:\Windows\System\cHcNGeM.exe
  2⤵
  PID:3540
- C:\Windows\System\NFnyNFz.exe
  C:\Windows\System\NFnyNFz.exe
  2⤵
  PID:3560
- C:\Windows\System\CkXZpNm.exe
  C:\Windows\System\CkXZpNm.exe
  2⤵
  PID:3580
- C:\Windows\System\hGlAfye.exe
  C:\Windows\System\hGlAfye.exe
  2⤵
  PID:3600
- C:\Windows\System\BtxqtKT.exe
  C:\Windows\System\BtxqtKT.exe
  2⤵
  PID:3620
- C:\Windows\System\OXKLGwO.exe
  C:\Windows\System\OXKLGwO.exe
  2⤵
  PID:3644
- C:\Windows\System\AolofkU.exe
  C:\Windows\System\AolofkU.exe
  2⤵
  PID:3664
- C:\Windows\System\EVoCxfL.exe
  C:\Windows\System\EVoCxfL.exe
  2⤵
  PID:3680
- C:\Windows\System\LyiXFUB.exe
  C:\Windows\System\LyiXFUB.exe
  2⤵
  PID:3700
- C:\Windows\System\FIfDyNA.exe
  C:\Windows\System\FIfDyNA.exe
  2⤵
  PID:3720
- C:\Windows\System\GNkXAry.exe
  C:\Windows\System\GNkXAry.exe
  2⤵
  PID:3740
- C:\Windows\System\PSmGzmv.exe
  C:\Windows\System\PSmGzmv.exe
  2⤵
  PID:3768
- C:\Windows\System\dKrATBB.exe
  C:\Windows\System\dKrATBB.exe
  2⤵
  PID:3784
- C:\Windows\System\NvqqCFE.exe
  C:\Windows\System\NvqqCFE.exe
  2⤵
  PID:3800
- C:\Windows\System\HoSskbA.exe
  C:\Windows\System\HoSskbA.exe
  2⤵
  PID:3816
- C:\Windows\System\ZaFsHex.exe
  C:\Windows\System\ZaFsHex.exe
  2⤵
  PID:3840
- C:\Windows\System\XDBrORW.exe
  C:\Windows\System\XDBrORW.exe
  2⤵
  PID:3876
- C:\Windows\System\gRasDGd.exe
  C:\Windows\System\gRasDGd.exe
  2⤵
  PID:3896
- C:\Windows\System\lVBreyj.exe
  C:\Windows\System\lVBreyj.exe
  2⤵
  PID:3912
- C:\Windows\System\DtiKoKn.exe
  C:\Windows\System\DtiKoKn.exe
  2⤵
  PID:3932
- C:\Windows\System\MVXaaZc.exe
  C:\Windows\System\MVXaaZc.exe
  2⤵
  PID:3948
- C:\Windows\System\iWlsFbR.exe
  C:\Windows\System\iWlsFbR.exe
  2⤵
  PID:3964
- C:\Windows\System\NLrcBTd.exe
  C:\Windows\System\NLrcBTd.exe
  2⤵
  PID:3980
- C:\Windows\System\CKdfiTE.exe
  C:\Windows\System\CKdfiTE.exe
  2⤵
  PID:4000
- C:\Windows\System\LjrdpDC.exe
  C:\Windows\System\LjrdpDC.exe
  2⤵
  PID:4016
- C:\Windows\System\WxpyOgF.exe
  C:\Windows\System\WxpyOgF.exe
  2⤵
  PID:4032
- C:\Windows\System\Fyzfmon.exe
  C:\Windows\System\Fyzfmon.exe
  2⤵
  PID:4048
- C:\Windows\System\GRuSvHZ.exe
  C:\Windows\System\GRuSvHZ.exe
  2⤵
  PID:4064
- C:\Windows\System\SLOmgll.exe
  C:\Windows\System\SLOmgll.exe
  2⤵
  PID:4080
- C:\Windows\System\CDvLeOC.exe
  C:\Windows\System\CDvLeOC.exe
  2⤵
  PID:2656
- C:\Windows\System\GLGqvev.exe
  C:\Windows\System\GLGqvev.exe
  2⤵
  PID:2152
- C:\Windows\System\Bphezms.exe
  C:\Windows\System\Bphezms.exe
  2⤵
  PID:1576
- C:\Windows\System\gjScXGx.exe
  C:\Windows\System\gjScXGx.exe
  2⤵
  PID:2372
- C:\Windows\System\nZdKueH.exe
  C:\Windows\System\nZdKueH.exe
  2⤵
  PID:2872
- C:\Windows\System\ytbfCYL.exe
  C:\Windows\System\ytbfCYL.exe
  2⤵
  PID:3084
- C:\Windows\System\hxAQyui.exe
  C:\Windows\System\hxAQyui.exe
  2⤵
  PID:1208
- C:\Windows\System\vfrlcMd.exe
  C:\Windows\System\vfrlcMd.exe
  2⤵
  PID:3116
- C:\Windows\System\fbKKrBt.exe
  C:\Windows\System\fbKKrBt.exe
  2⤵
  PID:3160
- C:\Windows\System\nJuWbHL.exe
  C:\Windows\System\nJuWbHL.exe
  2⤵
  PID:3144
- C:\Windows\System\CXJyHUR.exe
  C:\Windows\System\CXJyHUR.exe
  2⤵
  PID:3192
- C:\Windows\System\RglHhTB.exe
  C:\Windows\System\RglHhTB.exe
  2⤵
  PID:3216
- C:\Windows\System\SxuGiMA.exe
  C:\Windows\System\SxuGiMA.exe
  2⤵
  PID:3248
- C:\Windows\System\Dlqtgwy.exe
  C:\Windows\System\Dlqtgwy.exe
  2⤵
  PID:3312
- C:\Windows\System\CbmXMji.exe
  C:\Windows\System\CbmXMji.exe
  2⤵
  PID:3272
- C:\Windows\System\gWBRXEa.exe
  C:\Windows\System\gWBRXEa.exe
  2⤵
  PID:3372
- C:\Windows\System\CXSzedI.exe
  C:\Windows\System\CXSzedI.exe
  2⤵
  PID:3300
- C:\Windows\System\FwxDMND.exe
  C:\Windows\System\FwxDMND.exe
  2⤵
  PID:3340
- C:\Windows\System\qTeIMNI.exe
  C:\Windows\System\qTeIMNI.exe
  2⤵
  PID:3376
- C:\Windows\System\zHQIqGY.exe
  C:\Windows\System\zHQIqGY.exe
  2⤵
  PID:3444
- C:\Windows\System\BtPrYlg.exe
  C:\Windows\System\BtPrYlg.exe
  2⤵
  PID:3492
- C:\Windows\System\EHVqXgl.exe
  C:\Windows\System\EHVqXgl.exe
  2⤵
  PID:3480
- C:\Windows\System\bLGiHxc.exe
  C:\Windows\System\bLGiHxc.exe
  2⤵
  PID:3548
- C:\Windows\System\NuvYCUY.exe
  C:\Windows\System\NuvYCUY.exe
  2⤵
  PID:3592
- C:\Windows\System\eRGKbZq.exe
  C:\Windows\System\eRGKbZq.exe
  2⤵
  PID:3640
- C:\Windows\System\welezRF.exe
  C:\Windows\System\welezRF.exe
  2⤵
  PID:3708
- C:\Windows\System\uxXJwuH.exe
  C:\Windows\System\uxXJwuH.exe
  2⤵
  PID:3756
- C:\Windows\System\cxZbqIe.exe
  C:\Windows\System\cxZbqIe.exe
  2⤵
  PID:3792
- C:\Windows\System\LOmzVfh.exe
  C:\Windows\System\LOmzVfh.exe
  2⤵
  PID:3532
- C:\Windows\System\evAdZbV.exe
  C:\Windows\System\evAdZbV.exe
  2⤵
  PID:3572
- C:\Windows\System\GmQSDux.exe
  C:\Windows\System\GmQSDux.exe
  2⤵
  PID:3660
- C:\Windows\System\QoeZFOI.exe
  C:\Windows\System\QoeZFOI.exe
  2⤵
  PID:3776
- C:\Windows\System\iEMyLAr.exe
  C:\Windows\System\iEMyLAr.exe
  2⤵
  PID:3652
- C:\Windows\System\MieLphz.exe
  C:\Windows\System\MieLphz.exe
  2⤵
  PID:3836
- C:\Windows\System\MsWHHEf.exe
  C:\Windows\System\MsWHHEf.exe
  2⤵
  PID:3868
- C:\Windows\System\FzrMOEF.exe
  C:\Windows\System\FzrMOEF.exe
  2⤵
  PID:3996
- C:\Windows\System\udcqAuI.exe
  C:\Windows\System\udcqAuI.exe
  2⤵
  PID:4088
- C:\Windows\System\yvjFnva.exe
  C:\Windows\System\yvjFnva.exe
  2⤵
  PID:968
- C:\Windows\System\fWmlZZt.exe
  C:\Windows\System\fWmlZZt.exe
  2⤵
  PID:1828
- C:\Windows\System\EmaQaZX.exe
  C:\Windows\System\EmaQaZX.exe
  2⤵
  PID:3940
- C:\Windows\System\BxMnlru.exe
  C:\Windows\System\BxMnlru.exe
  2⤵
  PID:3188
- C:\Windows\System\OBALrQM.exe
  C:\Windows\System\OBALrQM.exe
  2⤵
  PID:3944
- C:\Windows\System\Nrtenmn.exe
  C:\Windows\System\Nrtenmn.exe
  2⤵
  PID:4012
- C:\Windows\System\BIgkEZG.exe
  C:\Windows\System\BIgkEZG.exe
  2⤵
  PID:4076
- C:\Windows\System\aYHQnPs.exe
  C:\Windows\System\aYHQnPs.exe
  2⤵
  PID:2708
- C:\Windows\System\udIWoHm.exe
  C:\Windows\System\udIWoHm.exe
  2⤵
  PID:3356
- C:\Windows\System\IymLwpV.exe
  C:\Windows\System\IymLwpV.exe
  2⤵
  PID:3212
- C:\Windows\System\uzHTGeV.exe
  C:\Windows\System\uzHTGeV.exe
  2⤵
  PID:3392
- C:\Windows\System\fMrWSwJ.exe
  C:\Windows\System\fMrWSwJ.exe
  2⤵
  PID:3284
- C:\Windows\System\aCclvhf.exe
  C:\Windows\System\aCclvhf.exe
  2⤵
  PID:3436
- C:\Windows\System\XkUfAjv.exe
  C:\Windows\System\XkUfAjv.exe
  2⤵
  PID:3588
- C:\Windows\System\iFDMlcD.exe
  C:\Windows\System\iFDMlcD.exe
  2⤵
  PID:3632
- C:\Windows\System\pvwbxTz.exe
  C:\Windows\System\pvwbxTz.exe
  2⤵
  PID:3528
- C:\Windows\System\IAcbTXj.exe
  C:\Windows\System\IAcbTXj.exe
  2⤵
  PID:3856
- C:\Windows\System\nsvymuv.exe
  C:\Windows\System\nsvymuv.exe
  2⤵
  PID:3656
- C:\Windows\System\meVZXje.exe
  C:\Windows\System\meVZXje.exe
  2⤵
  PID:3688
- C:\Windows\System\dBnJQGP.exe
  C:\Windows\System\dBnJQGP.exe
  2⤵
  PID:3828
- C:\Windows\System\KuamAvJ.exe
  C:\Windows\System\KuamAvJ.exe
  2⤵
  PID:3988
- C:\Windows\System\BMCEDlA.exe
  C:\Windows\System\BMCEDlA.exe
  2⤵
  PID:3884
- C:\Windows\System\obxtEqc.exe
  C:\Windows\System\obxtEqc.exe
  2⤵
  PID:3908
- C:\Windows\System\dHJhKGM.exe
  C:\Windows\System\dHJhKGM.exe
  2⤵
  PID:2876
- C:\Windows\System\baGukWS.exe
  C:\Windows\System\baGukWS.exe
  2⤵
  PID:3976
- C:\Windows\System\DwDLlEA.exe
  C:\Windows\System\DwDLlEA.exe
  2⤵
  PID:108
- C:\Windows\System\kFsIAWP.exe
  C:\Windows\System\kFsIAWP.exe
  2⤵
  PID:3168
- C:\Windows\System\rjQoeQX.exe
  C:\Windows\System\rjQoeQX.exe
  2⤵
  PID:3112
- C:\Windows\System\IbUxEAi.exe
  C:\Windows\System\IbUxEAi.exe
  2⤵
  PID:3556
- C:\Windows\System\bsVionU.exe
  C:\Windows\System\bsVionU.exe
  2⤵
  PID:3904
- C:\Windows\System\DbGpnOY.exe
  C:\Windows\System\DbGpnOY.exe
  2⤵
  PID:3860
- C:\Windows\System\ZZVOGnX.exe
  C:\Windows\System\ZZVOGnX.exe
  2⤵
  PID:4024
- C:\Windows\System\eHkRIti.exe
  C:\Windows\System\eHkRIti.exe
  2⤵
  PID:3296
- C:\Windows\System\mRIFScM.exe
  C:\Windows\System\mRIFScM.exe
  2⤵
  PID:3232
- C:\Windows\System\LIEnEUy.exe
  C:\Windows\System\LIEnEUy.exe
  2⤵
  PID:3280
- C:\Windows\System\QFrSQSK.exe
  C:\Windows\System\QFrSQSK.exe
  2⤵
  PID:3500
- C:\Windows\System\NdYYAun.exe
  C:\Windows\System\NdYYAun.exe
  2⤵
  PID:3736
- C:\Windows\System\SKEBVmY.exe
  C:\Windows\System\SKEBVmY.exe
  2⤵
  PID:3676
- C:\Windows\System\TEefmMe.exe
  C:\Windows\System\TEefmMe.exe
  2⤵
  PID:1668
- C:\Windows\System\yXnsCYl.exe
  C:\Windows\System\yXnsCYl.exe
  2⤵
  PID:3924
- C:\Windows\System\nquMiFD.exe
  C:\Windows\System\nquMiFD.exe
  2⤵
  PID:3752
- C:\Windows\System\yTWSAUx.exe
  C:\Windows\System\yTWSAUx.exe
  2⤵
  PID:3460
- C:\Windows\System\YNHXRvB.exe
  C:\Windows\System\YNHXRvB.exe
  2⤵
  PID:3728
- C:\Windows\System\waNLDjb.exe
  C:\Windows\System\waNLDjb.exe
  2⤵
  PID:2784
- C:\Windows\System\uzkZitF.exe
  C:\Windows\System\uzkZitF.exe
  2⤵
  PID:3100
- C:\Windows\System\GyhjwkW.exe
  C:\Windows\System\GyhjwkW.exe
  2⤵
  PID:4104
- C:\Windows\System\pJPisbA.exe
  C:\Windows\System\pJPisbA.exe
  2⤵
  PID:4120
- C:\Windows\System\azwZkuS.exe
  C:\Windows\System\azwZkuS.exe
  2⤵
  PID:4136
- C:\Windows\System\eILwpPA.exe
  C:\Windows\System\eILwpPA.exe
  2⤵
  PID:4152
- C:\Windows\System\bFuCiBn.exe
  C:\Windows\System\bFuCiBn.exe
  2⤵
  PID:4168
- C:\Windows\System\MEdPicO.exe
  C:\Windows\System\MEdPicO.exe
  2⤵
  PID:4184
- C:\Windows\System\jcYUZNc.exe
  C:\Windows\System\jcYUZNc.exe
  2⤵
  PID:4200
- C:\Windows\System\OMDngBe.exe
  C:\Windows\System\OMDngBe.exe
  2⤵
  PID:4216
- C:\Windows\System\lVmcJXC.exe
  C:\Windows\System\lVmcJXC.exe
  2⤵
  PID:4232
- C:\Windows\System\pQrWuSA.exe
  C:\Windows\System\pQrWuSA.exe
  2⤵
  PID:4252
- C:\Windows\System\UtmPQrD.exe
  C:\Windows\System\UtmPQrD.exe
  2⤵
  PID:4268
- C:\Windows\System\AjLERWa.exe
  C:\Windows\System\AjLERWa.exe
  2⤵
  PID:4284
- C:\Windows\System\SWOIINC.exe
  C:\Windows\System\SWOIINC.exe
  2⤵
  PID:4300
- C:\Windows\System\dFVaFzV.exe
  C:\Windows\System\dFVaFzV.exe
  2⤵
  PID:4316
- C:\Windows\System\PqPlDdK.exe
  C:\Windows\System\PqPlDdK.exe
  2⤵
  PID:4332
- C:\Windows\System\ELgveZg.exe
  C:\Windows\System\ELgveZg.exe
  2⤵
  PID:4348
- C:\Windows\System\DnWkruD.exe
  C:\Windows\System\DnWkruD.exe
  2⤵
  PID:4364
- C:\Windows\System\jIPelnO.exe
  C:\Windows\System\jIPelnO.exe
  2⤵
  PID:4380
- C:\Windows\System\ggrdhOV.exe
  C:\Windows\System\ggrdhOV.exe
  2⤵
  PID:4396
- C:\Windows\System\NjLOtbj.exe
  C:\Windows\System\NjLOtbj.exe
  2⤵
  PID:4412
- C:\Windows\System\tJVGBcP.exe
  C:\Windows\System\tJVGBcP.exe
  2⤵
  PID:4428
- C:\Windows\System\RKeuMih.exe
  C:\Windows\System\RKeuMih.exe
  2⤵
  PID:4444
- C:\Windows\System\bDFwUFw.exe
  C:\Windows\System\bDFwUFw.exe
  2⤵
  PID:4460
- C:\Windows\System\FIdxyDD.exe
  C:\Windows\System\FIdxyDD.exe
  2⤵
  PID:4476
- C:\Windows\System\dhuvNUw.exe
  C:\Windows\System\dhuvNUw.exe
  2⤵
  PID:4492
- C:\Windows\System\HPYcmPC.exe
  C:\Windows\System\HPYcmPC.exe
  2⤵
  PID:4508
- C:\Windows\System\IbYjySL.exe
  C:\Windows\System\IbYjySL.exe
  2⤵
  PID:4524
- C:\Windows\System\YmkXkaE.exe
  C:\Windows\System\YmkXkaE.exe
  2⤵
  PID:4540
- C:\Windows\System\rwrDXEW.exe
  C:\Windows\System\rwrDXEW.exe
  2⤵
  PID:4556
- C:\Windows\System\WDfMNcL.exe
  C:\Windows\System\WDfMNcL.exe
  2⤵
  PID:4572
- C:\Windows\System\dQIMnmy.exe
  C:\Windows\System\dQIMnmy.exe
  2⤵
  PID:4588
- C:\Windows\System\mbAxRLz.exe
  C:\Windows\System\mbAxRLz.exe
  2⤵
  PID:4604
- C:\Windows\System\rXnYWja.exe
  C:\Windows\System\rXnYWja.exe
  2⤵
  PID:4620
- C:\Windows\System\qwTwbLI.exe
  C:\Windows\System\qwTwbLI.exe
  2⤵
  PID:4636
- C:\Windows\System\mwDJGxE.exe
  C:\Windows\System\mwDJGxE.exe
  2⤵
  PID:4652
- C:\Windows\System\ewsRRRl.exe
  C:\Windows\System\ewsRRRl.exe
  2⤵
  PID:4668
- C:\Windows\System\UFaJaae.exe
  C:\Windows\System\UFaJaae.exe
  2⤵
  PID:4684
- C:\Windows\System\DnGAlAR.exe
  C:\Windows\System\DnGAlAR.exe
  2⤵
  PID:4700
- C:\Windows\System\zLpHUvC.exe
  C:\Windows\System\zLpHUvC.exe
  2⤵
  PID:4716
- C:\Windows\System\EMnPfPG.exe
  C:\Windows\System\EMnPfPG.exe
  2⤵
  PID:4732
- C:\Windows\System\wibtUZe.exe
  C:\Windows\System\wibtUZe.exe
  2⤵
  PID:4748
- C:\Windows\System\mwybmtu.exe
  C:\Windows\System\mwybmtu.exe
  2⤵
  PID:4764
- C:\Windows\System\tsiqsgo.exe
  C:\Windows\System\tsiqsgo.exe
  2⤵
  PID:4780
- C:\Windows\System\ylFhDCw.exe
  C:\Windows\System\ylFhDCw.exe
  2⤵
  PID:4796
- C:\Windows\System\qdWWUpr.exe
  C:\Windows\System\qdWWUpr.exe
  2⤵
  PID:4816
- C:\Windows\System\QkFbANP.exe
  C:\Windows\System\QkFbANP.exe
  2⤵
  PID:4832
- C:\Windows\System\TgNaOUh.exe
  C:\Windows\System\TgNaOUh.exe
  2⤵
  PID:4848
- C:\Windows\System\hhDexed.exe
  C:\Windows\System\hhDexed.exe
  2⤵
  PID:4864
- C:\Windows\System\vQxASmt.exe
  C:\Windows\System\vQxASmt.exe
  2⤵
  PID:4880
- C:\Windows\System\kiHFpXb.exe
  C:\Windows\System\kiHFpXb.exe
  2⤵
  PID:4896
- C:\Windows\System\nevtJUA.exe
  C:\Windows\System\nevtJUA.exe
  2⤵
  PID:4912
- C:\Windows\System\kMiRPQm.exe
  C:\Windows\System\kMiRPQm.exe
  2⤵
  PID:4928
- C:\Windows\System\hrpFvrO.exe
  C:\Windows\System\hrpFvrO.exe
  2⤵
  PID:4944
- C:\Windows\System\tsgGIix.exe
  C:\Windows\System\tsgGIix.exe
  2⤵
  PID:4960
- C:\Windows\System\ACgEqIM.exe
  C:\Windows\System\ACgEqIM.exe
  2⤵
  PID:4980
- C:\Windows\System\xffqgSa.exe
  C:\Windows\System\xffqgSa.exe
  2⤵
  PID:4996
- C:\Windows\System\FmjVTDA.exe
  C:\Windows\System\FmjVTDA.exe
  2⤵
  PID:5012
- C:\Windows\System\uHVLJir.exe
  C:\Windows\System\uHVLJir.exe
  2⤵
  PID:5028
- C:\Windows\System\SjqhdUb.exe
  C:\Windows\System\SjqhdUb.exe
  2⤵
  PID:5044
- C:\Windows\System\XyWlNhp.exe
  C:\Windows\System\XyWlNhp.exe
  2⤵
  PID:5060
- C:\Windows\System\ymljixc.exe
  C:\Windows\System\ymljixc.exe
  2⤵
  PID:5076
- C:\Windows\System\nHsrwBy.exe
  C:\Windows\System\nHsrwBy.exe
  2⤵
  PID:5092
- C:\Windows\System\VwwDYsX.exe
  C:\Windows\System\VwwDYsX.exe
  2⤵
  PID:5108
- C:\Windows\System\IpMHzFa.exe
  C:\Windows\System\IpMHzFa.exe
  2⤵
  PID:1556
- C:\Windows\System\AMMAIlD.exe
  C:\Windows\System\AMMAIlD.exe
  2⤵
  PID:4112
- C:\Windows\System\jJTwZgC.exe
  C:\Windows\System\jJTwZgC.exe
  2⤵
  PID:4132
- C:\Windows\System\UriCakf.exe
  C:\Windows\System\UriCakf.exe
  2⤵
  PID:3472
- C:\Windows\System\bOEYfJF.exe
  C:\Windows\System\bOEYfJF.exe
  2⤵
  PID:4228
- C:\Windows\System\NNwBTJe.exe
  C:\Windows\System\NNwBTJe.exe
  2⤵
  PID:4116
- C:\Windows\System\WxqECZf.exe
  C:\Windows\System\WxqECZf.exe
  2⤵
  PID:4144
- C:\Windows\System\KvSeLcE.exe
  C:\Windows\System\KvSeLcE.exe
  2⤵
  PID:4388
- C:\Windows\System\opiUEqi.exe
  C:\Windows\System\opiUEqi.exe
  2⤵
  PID:4148
- C:\Windows\System\ScBUrfD.exe
  C:\Windows\System\ScBUrfD.exe
  2⤵
  PID:4212
- C:\Windows\System\DYacFZy.exe
  C:\Windows\System\DYacFZy.exe
  2⤵
  PID:4276
- C:\Windows\System\njQWNgw.exe
  C:\Windows\System\njQWNgw.exe
  2⤵
  PID:4456
- C:\Windows\System\xaZJOTQ.exe
  C:\Windows\System\xaZJOTQ.exe
  2⤵
  PID:4488
- C:\Windows\System\zMptHsT.exe
  C:\Windows\System\zMptHsT.exe
  2⤵
  PID:4376
- C:\Windows\System\BWFUZBU.exe
  C:\Windows\System\BWFUZBU.exe
  2⤵
  PID:4468
- C:\Windows\System\mBqaPAn.exe
  C:\Windows\System\mBqaPAn.exe
  2⤵
  PID:4516
- C:\Windows\System\YyAWuFp.exe
  C:\Windows\System\YyAWuFp.exe
  2⤵
  PID:4616
- C:\Windows\System\NfJejat.exe
  C:\Windows\System\NfJejat.exe
  2⤵
  PID:4644
- C:\Windows\System\KEdITiD.exe
  C:\Windows\System\KEdITiD.exe
  2⤵
  PID:4740
- C:\Windows\System\bsgolvN.exe
  C:\Windows\System\bsgolvN.exe
  2⤵
  PID:4504
- C:\Windows\System\eOGwEFG.exe
  C:\Windows\System\eOGwEFG.exe
  2⤵
  PID:4808
- C:\Windows\System\rmpyAzd.exe
  C:\Windows\System\rmpyAzd.exe
  2⤵
  PID:4844
- C:\Windows\System\kOKWXxR.exe
  C:\Windows\System\kOKWXxR.exe
  2⤵
  PID:4908
- C:\Windows\System\UwqSdkT.exe
  C:\Windows\System\UwqSdkT.exe
  2⤵
  PID:4536
- C:\Windows\System\cNfnTGD.exe
  C:\Windows\System\cNfnTGD.exe
  2⤵
  PID:4628
- C:\Windows\System\vbPCYvL.exe
  C:\Windows\System\vbPCYvL.exe
  2⤵
  PID:4692
- C:\Windows\System\PwxXLZj.exe
  C:\Windows\System\PwxXLZj.exe
  2⤵
  PID:5036
- C:\Windows\System\rFfCUEz.exe
  C:\Windows\System\rFfCUEz.exe
  2⤵
  PID:4728
- C:\Windows\System\ljTwxHr.exe
  C:\Windows\System\ljTwxHr.exe
  2⤵
  PID:5052
- C:\Windows\System\JLDWdLr.exe
  C:\Windows\System\JLDWdLr.exe
  2⤵
  PID:5020
- C:\Windows\System\AciegdK.exe
  C:\Windows\System\AciegdK.exe
  2⤵
  PID:4892
- C:\Windows\System\YNoHRBa.exe
  C:\Windows\System\YNoHRBa.exe
  2⤵
  PID:4956
- C:\Windows\System\uFJwtph.exe
  C:\Windows\System\uFJwtph.exe
  2⤵
  PID:5072
- C:\Windows\System\zaNFYpP.exe
  C:\Windows\System\zaNFYpP.exe
  2⤵
  PID:4164
- C:\Windows\System\LpQbDeh.exe
  C:\Windows\System\LpQbDeh.exe
  2⤵
  PID:4260
- C:\Windows\System\EfYexPC.exe
  C:\Windows\System\EfYexPC.exe
  2⤵
  PID:4128
- C:\Windows\System\avXPfiw.exe
  C:\Windows\System\avXPfiw.exe
  2⤵
  PID:5116
- C:\Windows\System\KtPcNyg.exe
  C:\Windows\System\KtPcNyg.exe
  2⤵
  PID:4312
- C:\Windows\System\iZrhwLe.exe
  C:\Windows\System\iZrhwLe.exe
  2⤵
  PID:4360
- C:\Windows\System\EuLSpGv.exe
  C:\Windows\System\EuLSpGv.exe
  2⤵
  PID:4244
- C:\Windows\System\zrtTccO.exe
  C:\Windows\System\zrtTccO.exe
  2⤵
  PID:4452
- C:\Windows\System\wwQASUO.exe
  C:\Windows\System\wwQASUO.exe
  2⤵
  PID:4520
- C:\Windows\System\ZwfVyLb.exe
  C:\Windows\System\ZwfVyLb.exe
  2⤵
  PID:4840
- C:\Windows\System\qyQfRPr.exe
  C:\Windows\System\qyQfRPr.exe
  2⤵
  PID:4664
- C:\Windows\System\BZnGaRT.exe
  C:\Windows\System\BZnGaRT.exe
  2⤵
  PID:4924
- C:\Windows\System\pIHlXia.exe
  C:\Windows\System\pIHlXia.exe
  2⤵
  PID:4612
- C:\Windows\System\jDbLtat.exe
  C:\Windows\System\jDbLtat.exe
  2⤵
  PID:4860
- C:\Windows\System\OhlZLaV.exe
  C:\Windows\System\OhlZLaV.exe
  2⤵
  PID:4596
- C:\Windows\System\QFkrEsY.exe
  C:\Windows\System\QFkrEsY.exe
  2⤵
  PID:3516
- C:\Windows\System\CwoPxfz.exe
  C:\Windows\System\CwoPxfz.exe
  2⤵
  PID:4976
- C:\Windows\System\prGEiYW.exe
  C:\Windows\System\prGEiYW.exe
  2⤵
  PID:5084
- C:\Windows\System\yCviWgo.exe
  C:\Windows\System\yCviWgo.exe
  2⤵
  PID:4876
- C:\Windows\System\wKnBCBU.exe
  C:\Windows\System\wKnBCBU.exe
  2⤵
  PID:4308
- C:\Windows\System\wOwYQir.exe
  C:\Windows\System\wOwYQir.exe
  2⤵
  PID:4392
- C:\Windows\System\SdAmFrx.exe
  C:\Windows\System\SdAmFrx.exe
  2⤵
  PID:4968
- C:\Windows\System\eAhLZBZ.exe
  C:\Windows\System\eAhLZBZ.exe
  2⤵
  PID:4772
- C:\Windows\System\MrIDXpp.exe
  C:\Windows\System\MrIDXpp.exe
  2⤵
  PID:4100
- C:\Windows\System\HmFqvGy.exe
  C:\Windows\System\HmFqvGy.exe
  2⤵
  PID:4600
- C:\Windows\System\mvptbrD.exe
  C:\Windows\System\mvptbrD.exe
  2⤵
  PID:4680
- C:\Windows\System\HxqmWpv.exe
  C:\Windows\System\HxqmWpv.exe
  2⤵
  PID:4972
- C:\Windows\System\RDVUALC.exe
  C:\Windows\System\RDVUALC.exe
  2⤵
  PID:4440
- C:\Windows\System\AzFzzmf.exe
  C:\Windows\System\AzFzzmf.exe
  2⤵
  PID:5132
- C:\Windows\System\lWdLMlo.exe
  C:\Windows\System\lWdLMlo.exe
  2⤵
  PID:5148
- C:\Windows\System\EbSFCnS.exe
  C:\Windows\System\EbSFCnS.exe
  2⤵
  PID:5164
- C:\Windows\System\rwvITqW.exe
  C:\Windows\System\rwvITqW.exe
  2⤵
  PID:5180
- C:\Windows\System\gviWQsB.exe
  C:\Windows\System\gviWQsB.exe
  2⤵
  PID:5196
- C:\Windows\System\iUSxcVV.exe
  C:\Windows\System\iUSxcVV.exe
  2⤵
  PID:5212
- C:\Windows\System\ulmXbOg.exe
  C:\Windows\System\ulmXbOg.exe
  2⤵
  PID:5228
- C:\Windows\System\aTlBVJL.exe
  C:\Windows\System\aTlBVJL.exe
  2⤵
  PID:5252
- C:\Windows\System\XUjnDlU.exe
  C:\Windows\System\XUjnDlU.exe
  2⤵
  PID:5268
- C:\Windows\System\jLOJwxR.exe
  C:\Windows\System\jLOJwxR.exe
  2⤵
  PID:5284
- C:\Windows\System\sGwGyoS.exe
  C:\Windows\System\sGwGyoS.exe
  2⤵
  PID:5300
- C:\Windows\System\fHknOmS.exe
  C:\Windows\System\fHknOmS.exe
  2⤵
  PID:5316
- C:\Windows\System\isUWpEC.exe
  C:\Windows\System\isUWpEC.exe
  2⤵
  PID:5332
- C:\Windows\System\ujHCLwr.exe
  C:\Windows\System\ujHCLwr.exe
  2⤵
  PID:5348
- C:\Windows\System\yGzMFMV.exe
  C:\Windows\System\yGzMFMV.exe
  2⤵
  PID:5364
- C:\Windows\System\xCLSvag.exe
  C:\Windows\System\xCLSvag.exe
  2⤵
  PID:5380
- C:\Windows\System\gFPGszM.exe
  C:\Windows\System\gFPGszM.exe
  2⤵
  PID:5396
- C:\Windows\System\vvLyaNh.exe
  C:\Windows\System\vvLyaNh.exe
  2⤵
  PID:5412
- C:\Windows\System\UMcsQiq.exe
  C:\Windows\System\UMcsQiq.exe
  2⤵
  PID:5428
- C:\Windows\System\dkGxACW.exe
  C:\Windows\System\dkGxACW.exe
  2⤵
  PID:5444
- C:\Windows\System\JbIqHtM.exe
  C:\Windows\System\JbIqHtM.exe
  2⤵
  PID:5460
- C:\Windows\System\ZCdovVv.exe
  C:\Windows\System\ZCdovVv.exe
  2⤵
  PID:5476
- C:\Windows\System\ezKFYQp.exe
  C:\Windows\System\ezKFYQp.exe
  2⤵
  PID:5492
- C:\Windows\System\SCxMEZH.exe
  C:\Windows\System\SCxMEZH.exe
  2⤵
  PID:5508
- C:\Windows\System\SdbNaGy.exe
  C:\Windows\System\SdbNaGy.exe
  2⤵
  PID:5524
- C:\Windows\System\bHmbiTW.exe
  C:\Windows\System\bHmbiTW.exe
  2⤵
  PID:5540
- C:\Windows\System\UuGNyOs.exe
  C:\Windows\System\UuGNyOs.exe
  2⤵
  PID:5556
- C:\Windows\System\AAGbfKR.exe
  C:\Windows\System\AAGbfKR.exe
  2⤵
  PID:5572
- C:\Windows\System\MRDBnRc.exe
  C:\Windows\System\MRDBnRc.exe
  2⤵
  PID:5588
- C:\Windows\System\fIYZOib.exe
  C:\Windows\System\fIYZOib.exe
  2⤵
  PID:5604
- C:\Windows\System\iQUUVLx.exe
  C:\Windows\System\iQUUVLx.exe
  2⤵
  PID:5620
- C:\Windows\System\cAefvFY.exe
  C:\Windows\System\cAefvFY.exe
  2⤵
  PID:5636
- C:\Windows\System\txHwNuU.exe
  C:\Windows\System\txHwNuU.exe
  2⤵
  PID:5652
- C:\Windows\System\NFJpFET.exe
  C:\Windows\System\NFJpFET.exe
  2⤵
  PID:5668
- C:\Windows\System\DuJvjLH.exe
  C:\Windows\System\DuJvjLH.exe
  2⤵
  PID:5684
- C:\Windows\System\TyYWobc.exe
  C:\Windows\System\TyYWobc.exe
  2⤵
  PID:5700
- C:\Windows\System\kZLIPle.exe
  C:\Windows\System\kZLIPle.exe
  2⤵
  PID:5716
- C:\Windows\System\whgVGpV.exe
  C:\Windows\System\whgVGpV.exe
  2⤵
  PID:5732
- C:\Windows\System\qlbGQVr.exe
  C:\Windows\System\qlbGQVr.exe
  2⤵
  PID:5748
- C:\Windows\System\IfSDWVi.exe
  C:\Windows\System\IfSDWVi.exe
  2⤵
  PID:5764
- C:\Windows\System\YOxmuGy.exe
  C:\Windows\System\YOxmuGy.exe
  2⤵
  PID:5780
- C:\Windows\System\cmAfUEV.exe
  C:\Windows\System\cmAfUEV.exe
  2⤵
  PID:5796
- C:\Windows\System\zttraIO.exe
  C:\Windows\System\zttraIO.exe
  2⤵
  PID:5812
- C:\Windows\System\OVpOnwx.exe
  C:\Windows\System\OVpOnwx.exe
  2⤵
  PID:5828
- C:\Windows\System\kaYcVUP.exe
  C:\Windows\System\kaYcVUP.exe
  2⤵
  PID:5844
- C:\Windows\System\siTGNqE.exe
  C:\Windows\System\siTGNqE.exe
  2⤵
  PID:5860
- C:\Windows\System\nHEDEJd.exe
  C:\Windows\System\nHEDEJd.exe
  2⤵
  PID:5876
- C:\Windows\System\ShBYmxP.exe
  C:\Windows\System\ShBYmxP.exe
  2⤵
  PID:5892
- C:\Windows\System\RJdXMPg.exe
  C:\Windows\System\RJdXMPg.exe
  2⤵
  PID:5908
- C:\Windows\System\pmHNySM.exe
  C:\Windows\System\pmHNySM.exe
  2⤵
  PID:5924
- C:\Windows\System\rZNeQrG.exe
  C:\Windows\System\rZNeQrG.exe
  2⤵
  PID:5940
- C:\Windows\System\rvjfKaa.exe
  C:\Windows\System\rvjfKaa.exe
  2⤵
  PID:5956
- C:\Windows\System\sgnbwzz.exe
  C:\Windows\System\sgnbwzz.exe
  2⤵
  PID:5972
- C:\Windows\System\mumGplY.exe
  C:\Windows\System\mumGplY.exe
  2⤵
  PID:5988
- C:\Windows\System\ugkjKlo.exe
  C:\Windows\System\ugkjKlo.exe
  2⤵
  PID:6004
- C:\Windows\System\IXLzGhH.exe
  C:\Windows\System\IXLzGhH.exe
  2⤵
  PID:6020
- C:\Windows\System\johbLJU.exe
  C:\Windows\System\johbLJU.exe
  2⤵
  PID:6036
- C:\Windows\System\ytrLjho.exe
  C:\Windows\System\ytrLjho.exe
  2⤵
  PID:6052
- C:\Windows\System\TXRyYQz.exe
  C:\Windows\System\TXRyYQz.exe
  2⤵
  PID:6068
- C:\Windows\System\ZdCPgtk.exe
  C:\Windows\System\ZdCPgtk.exe
  2⤵
  PID:6084
- C:\Windows\System\zKjcujK.exe
  C:\Windows\System\zKjcujK.exe
  2⤵
  PID:6104
- C:\Windows\System\yOHrMNn.exe
  C:\Windows\System\yOHrMNn.exe
  2⤵
  PID:6120
- C:\Windows\System\cxrRaiw.exe
  C:\Windows\System\cxrRaiw.exe
  2⤵
  PID:6136
- C:\Windows\System\CofTcnU.exe
  C:\Windows\System\CofTcnU.exe
  2⤵
  PID:5156
- C:\Windows\System\NuazTvx.exe
  C:\Windows\System\NuazTvx.exe
  2⤵
  PID:4888
- C:\Windows\System\VlGhxDr.exe
  C:\Windows\System\VlGhxDr.exe
  2⤵
  PID:4580
- C:\Windows\System\GKgbNDy.exe
  C:\Windows\System\GKgbNDy.exe
  2⤵
  PID:5144
- C:\Windows\System\eGDbxuW.exe
  C:\Windows\System\eGDbxuW.exe
  2⤵
  PID:5160
- C:\Windows\System\LqItRBQ.exe
  C:\Windows\System\LqItRBQ.exe
  2⤵
  PID:5204
- C:\Windows\System\uMqIGqz.exe
  C:\Windows\System\uMqIGqz.exe
  2⤵
  PID:5188
- C:\Windows\System\ZKATPgJ.exe
  C:\Windows\System\ZKATPgJ.exe
  2⤵
  PID:5264
- C:\Windows\System\EFFPRLD.exe
  C:\Windows\System\EFFPRLD.exe
  2⤵
  PID:5324
- C:\Windows\System\aMYoidi.exe
  C:\Windows\System\aMYoidi.exe
  2⤵
  PID:5244
- C:\Windows\System\GIzcRnI.exe
  C:\Windows\System\GIzcRnI.exe
  2⤵
  PID:5312
- C:\Windows\System\gRBjpOR.exe
  C:\Windows\System\gRBjpOR.exe
  2⤵
  PID:5360
- C:\Windows\System\bYWCnrx.exe
  C:\Windows\System\bYWCnrx.exe
  2⤵
  PID:5424
- C:\Windows\System\BZewscG.exe
  C:\Windows\System\BZewscG.exe
  2⤵
  PID:5488
- C:\Windows\System\uUtGDfz.exe
  C:\Windows\System\uUtGDfz.exe
  2⤵
  PID:5408
- C:\Windows\System\hcEaglp.exe
  C:\Windows\System\hcEaglp.exe
  2⤵
  PID:5472
- C:\Windows\System\ECFcdUh.exe
  C:\Windows\System\ECFcdUh.exe
  2⤵
  PID:5520
- C:\Windows\System\mLGZpPA.exe
  C:\Windows\System\mLGZpPA.exe
  2⤵
  PID:5552
- C:\Windows\System\YgiCMYn.exe
  C:\Windows\System\YgiCMYn.exe
  2⤵
  PID:5600
- C:\Windows\System\gmKbKZG.exe
  C:\Windows\System\gmKbKZG.exe
  2⤵
  PID:5644
- C:\Windows\System\CLdydui.exe
  C:\Windows\System\CLdydui.exe
  2⤵
  PID:5692
- C:\Windows\System\gfnGxdJ.exe
  C:\Windows\System\gfnGxdJ.exe
  2⤵
  PID:5580
- C:\Windows\System\RuWwGsz.exe
  C:\Windows\System\RuWwGsz.exe
  2⤵
  PID:5708
- C:\Windows\System\mkOVFVp.exe
  C:\Windows\System\mkOVFVp.exe
  2⤵
  PID:5744
- C:\Windows\System\ByvEcMZ.exe
  C:\Windows\System\ByvEcMZ.exe
  2⤵
  PID:5776
- C:\Windows\System\mKeHTJj.exe
  C:\Windows\System\mKeHTJj.exe
  2⤵
  PID:5792
- C:\Windows\System\UcBgOmR.exe
  C:\Windows\System\UcBgOmR.exe
  2⤵
  PID:5836
- C:\Windows\System\idmuHeD.exe
  C:\Windows\System\idmuHeD.exe
  2⤵
  PID:5888
- C:\Windows\System\JSQDSWA.exe
  C:\Windows\System\JSQDSWA.exe
  2⤵
  PID:5884
- C:\Windows\System\bDzWwRz.exe
  C:\Windows\System\bDzWwRz.exe
  2⤵
  PID:5936
- C:\Windows\System\PNhCMIb.exe
  C:\Windows\System\PNhCMIb.exe
  2⤵
  PID:5996
- C:\Windows\System\WNzZgZc.exe
  C:\Windows\System\WNzZgZc.exe
  2⤵
  PID:6060
- C:\Windows\System\XoRfhiX.exe
  C:\Windows\System\XoRfhiX.exe
  2⤵
  PID:6012
- C:\Windows\System\dxCBAuc.exe
  C:\Windows\System\dxCBAuc.exe
  2⤵
  PID:5984
- C:\Windows\System\sOPqJRZ.exe
  C:\Windows\System\sOPqJRZ.exe
  2⤵
  PID:5980
- C:\Windows\System\UjcwmXu.exe
  C:\Windows\System\UjcwmXu.exe
  2⤵
  PID:6116
- C:\Windows\System\cJFDeyq.exe
  C:\Windows\System\cJFDeyq.exe
  2⤵
  PID:4292
- C:\Windows\System\xIRHXTb.exe
  C:\Windows\System\xIRHXTb.exe
  2⤵
  PID:5124
- C:\Windows\System\yWwqDkF.exe
  C:\Windows\System\yWwqDkF.exe
  2⤵
  PID:4724
- C:\Windows\System\FkwhFjn.exe
  C:\Windows\System\FkwhFjn.exe
  2⤵
  PID:5192
- C:\Windows\System\tmkLlyo.exe
  C:\Windows\System\tmkLlyo.exe
  2⤵
  PID:5344
- C:\Windows\System\TexebGE.exe
  C:\Windows\System\TexebGE.exe
  2⤵
  PID:5236
- C:\Windows\System\VkcqUrO.exe
  C:\Windows\System\VkcqUrO.exe
  2⤵
  PID:5484
- C:\Windows\System\VZZwbrm.exe
  C:\Windows\System\VZZwbrm.exe
  2⤵
  PID:5536
- C:\Windows\System\qFPQyJV.exe
  C:\Windows\System\qFPQyJV.exe
  2⤵
  PID:5420
- C:\Windows\System\CUUhAnm.exe
  C:\Windows\System\CUUhAnm.exe
  2⤵
  PID:5632
- C:\Windows\System\oKUmaNt.exe
  C:\Windows\System\oKUmaNt.exe
  2⤵
  PID:5712
- C:\Windows\System\duetCwP.exe
  C:\Windows\System\duetCwP.exe
  2⤵
  PID:5760
- C:\Windows\System\mBrvSXx.exe
  C:\Windows\System\mBrvSXx.exe
  2⤵
  PID:5808
- C:\Windows\System\hVhIPxi.exe
  C:\Windows\System\hVhIPxi.exe
  2⤵
  PID:5824
- C:\Windows\System\pBQHUTN.exe
  C:\Windows\System\pBQHUTN.exe
  2⤵
  PID:6028
- C:\Windows\System\LWBnyxG.exe
  C:\Windows\System\LWBnyxG.exe
  2⤵
  PID:6048
- C:\Windows\System\jYzqahY.exe
  C:\Windows\System\jYzqahY.exe
  2⤵
  PID:6132
- C:\Windows\System\ocBEfYt.exe
  C:\Windows\System\ocBEfYt.exe
  2⤵
  PID:5968
- C:\Windows\System\cTcvPjx.exe
  C:\Windows\System\cTcvPjx.exe
  2⤵
  PID:4584
- C:\Windows\System\eQzvNOP.exe
  C:\Windows\System\eQzvNOP.exe
  2⤵
  PID:4296
- C:\Windows\System\mtLSXuI.exe
  C:\Windows\System\mtLSXuI.exe
  2⤵
  PID:5468
- C:\Windows\System\HsjEJlR.exe
  C:\Windows\System\HsjEJlR.exe
  2⤵
  PID:5372
- C:\Windows\System\YuSelab.exe
  C:\Windows\System\YuSelab.exe
  2⤵
  PID:5440
- C:\Windows\System\iFpPgJe.exe
  C:\Windows\System\iFpPgJe.exe
  2⤵
  PID:5872
- C:\Windows\System\uCuysNO.exe
  C:\Windows\System\uCuysNO.exe
  2⤵
  PID:6076
- C:\Windows\System\WrhczCz.exe
  C:\Windows\System\WrhczCz.exe
  2⤵
  PID:5328
- C:\Windows\System\zODfrvS.exe
  C:\Windows\System\zODfrvS.exe
  2⤵
  PID:6044
- C:\Windows\System\CoTQlaw.exe
  C:\Windows\System\CoTQlaw.exe
  2⤵
  PID:5660
- C:\Windows\System\uxOHVYf.exe
  C:\Windows\System\uxOHVYf.exe
  2⤵
  PID:5788
- C:\Windows\System\ITyCRNj.exe
  C:\Windows\System\ITyCRNj.exe
  2⤵
  PID:5240
- C:\Windows\System\oMWwePI.exe
  C:\Windows\System\oMWwePI.exe
  2⤵
  PID:5276
- C:\Windows\System\iRersyr.exe
  C:\Windows\System\iRersyr.exe
  2⤵
  PID:6128
- C:\Windows\System\GiIiiDW.exe
  C:\Windows\System\GiIiiDW.exe
  2⤵
  PID:5404
- C:\Windows\System\BRxJjol.exe
  C:\Windows\System\BRxJjol.exe
  2⤵
  PID:6152
- C:\Windows\System\CXDLLPM.exe
  C:\Windows\System\CXDLLPM.exe
  2⤵
  PID:6168
- C:\Windows\System\wsjpxSR.exe
  C:\Windows\System\wsjpxSR.exe
  2⤵
  PID:6184
- C:\Windows\System\pDtngnh.exe
  C:\Windows\System\pDtngnh.exe
  2⤵
  PID:6200
- C:\Windows\System\hLrYctk.exe
  C:\Windows\System\hLrYctk.exe
  2⤵
  PID:6216
- C:\Windows\System\gOTXcjB.exe
  C:\Windows\System\gOTXcjB.exe
  2⤵
  PID:6232
- C:\Windows\System\UAiKpfi.exe
  C:\Windows\System\UAiKpfi.exe
  2⤵
  PID:6248
- C:\Windows\System\frrkvIU.exe
  C:\Windows\System\frrkvIU.exe
  2⤵
  PID:6264
- C:\Windows\System\vdXYcdf.exe
  C:\Windows\System\vdXYcdf.exe
  2⤵
  PID:6296
- C:\Windows\System\GgJWyik.exe
  C:\Windows\System\GgJWyik.exe
  2⤵
  PID:6312
- C:\Windows\System\ZIziRWx.exe
  C:\Windows\System\ZIziRWx.exe
  2⤵
  PID:6364
- C:\Windows\System\xWOAgTg.exe
  C:\Windows\System\xWOAgTg.exe
  2⤵
  PID:6384
- C:\Windows\System\lUnPkWo.exe
  C:\Windows\System\lUnPkWo.exe
  2⤵
  PID:6400
- C:\Windows\System\fhsvuUG.exe
  C:\Windows\System\fhsvuUG.exe
  2⤵
  PID:6416
- C:\Windows\System\btTzAnM.exe
  C:\Windows\System\btTzAnM.exe
  2⤵
  PID:6432
- C:\Windows\System\cJabJLi.exe
  C:\Windows\System\cJabJLi.exe
  2⤵
  PID:6448
- C:\Windows\System\trRLPUk.exe
  C:\Windows\System\trRLPUk.exe
  2⤵
  PID:6464
- C:\Windows\System\Nkxajcf.exe
  C:\Windows\System\Nkxajcf.exe
  2⤵
  PID:6480
- C:\Windows\System\qfAZdiQ.exe
  C:\Windows\System\qfAZdiQ.exe
  2⤵
  PID:6496
- C:\Windows\System\uJhCFQV.exe
  C:\Windows\System\uJhCFQV.exe
  2⤵
  PID:6512
- C:\Windows\System\fpToOYD.exe
  C:\Windows\System\fpToOYD.exe
  2⤵
  PID:6528
- C:\Windows\System\fdkPLsS.exe
  C:\Windows\System\fdkPLsS.exe
  2⤵
  PID:6544
- C:\Windows\System\rXGblsQ.exe
  C:\Windows\System\rXGblsQ.exe
  2⤵
  PID:6560
- C:\Windows\System\KpCiDCa.exe
  C:\Windows\System\KpCiDCa.exe
  2⤵
  PID:6576
- C:\Windows\System\RFWsMAL.exe
  C:\Windows\System\RFWsMAL.exe
  2⤵
  PID:6592
- C:\Windows\System\VFMjsaS.exe
  C:\Windows\System\VFMjsaS.exe
  2⤵
  PID:6608
- C:\Windows\System\GtnxyEW.exe
  C:\Windows\System\GtnxyEW.exe
  2⤵
  PID:6624
- C:\Windows\System\TSvQYtA.exe
  C:\Windows\System\TSvQYtA.exe
  2⤵
  PID:6640
- C:\Windows\System\yjOJeVz.exe
  C:\Windows\System\yjOJeVz.exe
  2⤵
  PID:6656
- C:\Windows\System\zjVfXcF.exe
  C:\Windows\System\zjVfXcF.exe
  2⤵
  PID:6672
- C:\Windows\System\cwUfqti.exe
  C:\Windows\System\cwUfqti.exe
  2⤵
  PID:6688
- C:\Windows\System\nejwGMs.exe
  C:\Windows\System\nejwGMs.exe
  2⤵
  PID:6704
- C:\Windows\System\QHaUzzt.exe
  C:\Windows\System\QHaUzzt.exe
  2⤵
  PID:6720
- C:\Windows\System\FCbvDbR.exe
  C:\Windows\System\FCbvDbR.exe
  2⤵
  PID:6736
- C:\Windows\System\xyuHQtL.exe
  C:\Windows\System\xyuHQtL.exe
  2⤵
  PID:6752
- C:\Windows\System\paOFaRd.exe
  C:\Windows\System\paOFaRd.exe
  2⤵
  PID:6768
- C:\Windows\System\bfnShii.exe
  C:\Windows\System\bfnShii.exe
  2⤵
  PID:6784
- C:\Windows\System\EOgqxIM.exe
  C:\Windows\System\EOgqxIM.exe
  2⤵
  PID:6800
- C:\Windows\System\RoOHCpM.exe
  C:\Windows\System\RoOHCpM.exe
  2⤵
  PID:6820
- C:\Windows\System\ufKazmk.exe
  C:\Windows\System\ufKazmk.exe
  2⤵
  PID:6840
- C:\Windows\System\TDvDUzW.exe
  C:\Windows\System\TDvDUzW.exe
  2⤵
  PID:6856
- C:\Windows\System\MIPhmcB.exe
  C:\Windows\System\MIPhmcB.exe
  2⤵
  PID:6872
- C:\Windows\System\HPeDSbl.exe
  C:\Windows\System\HPeDSbl.exe
  2⤵
  PID:6888
- C:\Windows\System\JBUPjcB.exe
  C:\Windows\System\JBUPjcB.exe
  2⤵
  PID:6904
- C:\Windows\System\yHbMafs.exe
  C:\Windows\System\yHbMafs.exe
  2⤵
  PID:6920
- C:\Windows\System\UwoHDrj.exe
  C:\Windows\System\UwoHDrj.exe
  2⤵
  PID:6940
- C:\Windows\System\ePoqFiW.exe
  C:\Windows\System\ePoqFiW.exe
  2⤵
  PID:6956
- C:\Windows\System\XuhwZMq.exe
  C:\Windows\System\XuhwZMq.exe
  2⤵
  PID:6972
- C:\Windows\System\rYTyrsN.exe
  C:\Windows\System\rYTyrsN.exe
  2⤵
  PID:6988
- C:\Windows\System\XagPIQv.exe
  C:\Windows\System\XagPIQv.exe
  2⤵
  PID:7004
- C:\Windows\System\TafOCQu.exe
  C:\Windows\System\TafOCQu.exe
  2⤵
  PID:7020
- C:\Windows\System\OXvSgOX.exe
  C:\Windows\System\OXvSgOX.exe
  2⤵
  PID:7036
- C:\Windows\System\QXDRJMJ.exe
  C:\Windows\System\QXDRJMJ.exe
  2⤵
  PID:7052
- C:\Windows\System\lbtBcMB.exe
  C:\Windows\System\lbtBcMB.exe
  2⤵
  PID:7068
- C:\Windows\System\gbkBEoT.exe
  C:\Windows\System\gbkBEoT.exe
  2⤵
  PID:7084
- C:\Windows\System\bMUdvls.exe
  C:\Windows\System\bMUdvls.exe
  2⤵
  PID:7100
- C:\Windows\System\XzLwIjW.exe
  C:\Windows\System\XzLwIjW.exe
  2⤵
  PID:7116
- C:\Windows\System\VVQDZBt.exe
  C:\Windows\System\VVQDZBt.exe
  2⤵
  PID:7132
- C:\Windows\System\lsXamXI.exe
  C:\Windows\System\lsXamXI.exe
  2⤵
  PID:7148
- C:\Windows\System\UqgUaJF.exe
  C:\Windows\System\UqgUaJF.exe
  2⤵
  PID:7164
- C:\Windows\System\jmzcKnx.exe
  C:\Windows\System\jmzcKnx.exe
  2⤵
  PID:5516
- C:\Windows\System\lLCccxz.exe
  C:\Windows\System\lLCccxz.exe
  2⤵
  PID:6244
- C:\Windows\System\BorkYwO.exe
  C:\Windows\System\BorkYwO.exe
  2⤵
  PID:6284
- C:\Windows\System\uojUenm.exe
  C:\Windows\System\uojUenm.exe
  2⤵
  PID:5220
- C:\Windows\System\usuPmlI.exe
  C:\Windows\System\usuPmlI.exe
  2⤵
  PID:6256
- C:\Windows\System\XMWJPki.exe
  C:\Windows\System\XMWJPki.exe
  2⤵
  PID:6260
- C:\Windows\System\MJAnuMt.exe
  C:\Windows\System\MJAnuMt.exe
  2⤵
  PID:6192
- C:\Windows\System\oNpvZVM.exe
  C:\Windows\System\oNpvZVM.exe
  2⤵
  PID:6328
- C:\Windows\System\tnMcMWt.exe
  C:\Windows\System\tnMcMWt.exe
  2⤵
  PID:6340
- C:\Windows\System\sIionJQ.exe
  C:\Windows\System\sIionJQ.exe
  2⤵
  PID:6360
- C:\Windows\System\xMKFuxB.exe
  C:\Windows\System\xMKFuxB.exe
  2⤵
  PID:6380
- C:\Windows\System\EgxNBVP.exe
  C:\Windows\System\EgxNBVP.exe
  2⤵
  PID:6444
- C:\Windows\System\fNkQMRf.exe
  C:\Windows\System\fNkQMRf.exe
  2⤵
  PID:6508
- C:\Windows\System\DlLwfpA.exe
  C:\Windows\System\DlLwfpA.exe
  2⤵
  PID:6456
- C:\Windows\System\iubOlHB.exe
  C:\Windows\System\iubOlHB.exe
  2⤵
  PID:6524
- C:\Windows\System\FKbJzBd.exe
  C:\Windows\System\FKbJzBd.exe
  2⤵
  PID:6588
- C:\Windows\System\EyJtpKb.exe
  C:\Windows\System\EyJtpKb.exe
  2⤵
  PID:6556
- C:\Windows\System\xSSOFPE.exe
  C:\Windows\System\xSSOFPE.exe
  2⤵
  PID:6716
- C:\Windows\System\JdYwrCw.exe
  C:\Windows\System\JdYwrCw.exe
  2⤵
  PID:6780
- C:\Windows\System\zEZHLzJ.exe
  C:\Windows\System\zEZHLzJ.exe
  2⤵
  PID:6760
- C:\Windows\System\JXfWZpM.exe
  C:\Windows\System\JXfWZpM.exe
  2⤵
  PID:6792
- C:\Windows\System\mNOgvnW.exe
  C:\Windows\System\mNOgvnW.exe
  2⤵
  PID:6668
- C:\Windows\System\QknEvnH.exe
  C:\Windows\System\QknEvnH.exe
  2⤵
  PID:6604
- C:\Windows\System\KVPsDzH.exe
  C:\Windows\System\KVPsDzH.exe
  2⤵
  PID:1920
- C:\Windows\System\sWasbED.exe
  C:\Windows\System\sWasbED.exe
  2⤵
  PID:2400
- C:\Windows\System\ReeXcgA.exe
  C:\Windows\System\ReeXcgA.exe
  2⤵
  PID:2248
- C:\Windows\System\ehpuoQy.exe
  C:\Windows\System\ehpuoQy.exe
  2⤵
  PID:6832
- C:\Windows\System\krzELCj.exe
  C:\Windows\System\krzELCj.exe
  2⤵
  PID:6848
- C:\Windows\System\WIqrGAM.exe
  C:\Windows\System\WIqrGAM.exe
  2⤵
  PID:6932
- C:\Windows\System\HnAqbpx.exe
  C:\Windows\System\HnAqbpx.exe
  2⤵
  PID:6928
- C:\Windows\System\DGNRCbr.exe
  C:\Windows\System\DGNRCbr.exe
  2⤵
  PID:6868
- C:\Windows\System\PPxmDaa.exe
  C:\Windows\System\PPxmDaa.exe
  2⤵
  PID:7000
- C:\Windows\System\LIMVSpr.exe
  C:\Windows\System\LIMVSpr.exe
  2⤵
  PID:7044
- C:\Windows\System\PhbtNtr.exe
  C:\Windows\System\PhbtNtr.exe
  2⤵
  PID:7080
- C:\Windows\System\nlnKaVY.exe
  C:\Windows\System\nlnKaVY.exe
  2⤵
  PID:7060
- C:\Windows\System\VpnPBzt.exe
  C:\Windows\System\VpnPBzt.exe
  2⤵
  PID:7064
- C:\Windows\System\qWbGLZA.exe
  C:\Windows\System\qWbGLZA.exe
  2⤵
  PID:7128
- C:\Windows\System\AMfqafc.exe
  C:\Windows\System\AMfqafc.exe
  2⤵
  PID:5932
- C:\Windows\System\JVhFOzL.exe
  C:\Windows\System\JVhFOzL.exe
  2⤵
  PID:5724
- C:\Windows\System\kaHQOmj.exe
  C:\Windows\System\kaHQOmj.exe
  2⤵
  PID:6288
- C:\Windows\System\zPudPvv.exe
  C:\Windows\System\zPudPvv.exe
  2⤵
  PID:6212
- C:\Windows\System\WMHIKDP.exe
  C:\Windows\System\WMHIKDP.exe
  2⤵
  PID:6336
- C:\Windows\System\IbSnVIn.exe
  C:\Windows\System\IbSnVIn.exe
  2⤵
  PID:6616
- C:\Windows\System\HvDryby.exe
  C:\Windows\System\HvDryby.exe
  2⤵
  PID:6492
- C:\Windows\System\OBuThiM.exe
  C:\Windows\System\OBuThiM.exe
  2⤵
  PID:6764
- C:\Windows\System\dlnTBvl.exe
  C:\Windows\System\dlnTBvl.exe
  2⤵
  PID:6412
- C:\Windows\System\aybxpir.exe
  C:\Windows\System\aybxpir.exe
  2⤵
  PID:6440
- C:\Windows\System\SJkVNPj.exe
  C:\Windows\System\SJkVNPj.exe
  2⤵
  PID:6684
- C:\Windows\System\zruDXQN.exe
  C:\Windows\System\zruDXQN.exe
  2⤵
  PID:6428
- C:\Windows\System\dLbUCxb.exe
  C:\Windows\System\dLbUCxb.exe
  2⤵
  PID:1380
- C:\Windows\System\DxbCgQF.exe
  C:\Windows\System\DxbCgQF.exe
  2⤵
  PID:6912
- C:\Windows\System\EHsePCT.exe
  C:\Windows\System\EHsePCT.exe
  2⤵
  PID:6852
- C:\Windows\System\EktFkWm.exe
  C:\Windows\System\EktFkWm.exe
  2⤵
  PID:6952
- C:\Windows\System\GQSmPBA.exe
  C:\Windows\System\GQSmPBA.exe
  2⤵
  PID:6880
- C:\Windows\System\IGNlBZN.exe
  C:\Windows\System\IGNlBZN.exe
  2⤵
  PID:7140
- C:\Windows\System\FBvzaTw.exe
  C:\Windows\System\FBvzaTw.exe
  2⤵
  PID:7048
- C:\Windows\System\JvJFIDF.exe
  C:\Windows\System\JvJFIDF.exe
  2⤵
  PID:7160
- C:\Windows\System\AoXKABw.exe
  C:\Windows\System\AoXKABw.exe
  2⤵
  PID:6228
- C:\Windows\System\dWQcdBK.exe
  C:\Windows\System\dWQcdBK.exe
  2⤵
  PID:6376
- C:\Windows\System\GFvaUhp.exe
  C:\Windows\System\GFvaUhp.exe
  2⤵
  PID:6700
- C:\Windows\System\vMEqaCW.exe
  C:\Windows\System\vMEqaCW.exe
  2⤵
  PID:6520
- C:\Windows\System\XSbaNUY.exe
  C:\Windows\System\XSbaNUY.exe
  2⤵
  PID:6828
- C:\Windows\System\cDOjKQH.exe
  C:\Windows\System\cDOjKQH.exe
  2⤵
  PID:632
- C:\Windows\System\RvhvPfL.exe
  C:\Windows\System\RvhvPfL.exe
  2⤵
  PID:6808
- C:\Windows\System\PwpdyIe.exe
  C:\Windows\System\PwpdyIe.exe
  2⤵
  PID:7032
- C:\Windows\System\BjlpSJI.exe
  C:\Windows\System\BjlpSJI.exe
  2⤵
  PID:7092
- C:\Windows\System\vbESEzj.exe
  C:\Windows\System\vbESEzj.exe
  2⤵
  PID:6552
- C:\Windows\System\LpANMct.exe
  C:\Windows\System\LpANMct.exe
  2⤵
  PID:6896
- C:\Windows\System\ZozllEB.exe
  C:\Windows\System\ZozllEB.exe
  2⤵
  PID:6180
- C:\Windows\System\taLWJOz.exe
  C:\Windows\System\taLWJOz.exe
  2⤵
  PID:6356
- C:\Windows\System\JjCIxqV.exe
  C:\Windows\System\JjCIxqV.exe
  2⤵
  PID:6352
- C:\Windows\System\KPMwqZp.exe
  C:\Windows\System\KPMwqZp.exe
  2⤵
  PID:7112
- C:\Windows\System\RGNDCuy.exe
  C:\Windows\System\RGNDCuy.exe
  2⤵
  PID:6980
- C:\Windows\System\UKZGniZ.exe
  C:\Windows\System\UKZGniZ.exe
  2⤵
  PID:6620
- C:\Windows\System\mLixbCt.exe
  C:\Windows\System\mLixbCt.exe
  2⤵
  PID:7180
- C:\Windows\System\xwZmWKh.exe
  C:\Windows\System\xwZmWKh.exe
  2⤵
  PID:7196
- C:\Windows\System\BOpeVHP.exe
  C:\Windows\System\BOpeVHP.exe
  2⤵
  PID:7212
- C:\Windows\System\gAyKPwH.exe
  C:\Windows\System\gAyKPwH.exe
  2⤵
  PID:7228
- C:\Windows\System\kmxczAU.exe
  C:\Windows\System\kmxczAU.exe
  2⤵
  PID:7244
- C:\Windows\System\DHYXjVf.exe
  C:\Windows\System\DHYXjVf.exe
  2⤵
  PID:7260
- C:\Windows\System\kHZSSqy.exe
  C:\Windows\System\kHZSSqy.exe
  2⤵
  PID:7276
- C:\Windows\System\WvPRxsj.exe
  C:\Windows\System\WvPRxsj.exe
  2⤵
  PID:7292
- C:\Windows\System\aIpOfUl.exe
  C:\Windows\System\aIpOfUl.exe
  2⤵
  PID:7308
- C:\Windows\System\OONJEos.exe
  C:\Windows\System\OONJEos.exe
  2⤵
  PID:7324
- C:\Windows\System\obtGdvC.exe
  C:\Windows\System\obtGdvC.exe
  2⤵
  PID:7340
- C:\Windows\System\ITUpKrh.exe
  C:\Windows\System\ITUpKrh.exe
  2⤵
  PID:7356
- C:\Windows\System\lbUdowl.exe
  C:\Windows\System\lbUdowl.exe
  2⤵
  PID:7372
- C:\Windows\System\cRgwxgq.exe
  C:\Windows\System\cRgwxgq.exe
  2⤵
  PID:7388
- C:\Windows\System\lxHTwrj.exe
  C:\Windows\System\lxHTwrj.exe
  2⤵
  PID:7404
- C:\Windows\System\efIVSFI.exe
  C:\Windows\System\efIVSFI.exe
  2⤵
  PID:7420
- C:\Windows\System\UYwJnPJ.exe
  C:\Windows\System\UYwJnPJ.exe
  2⤵
  PID:7436
- C:\Windows\System\PjpZBKF.exe
  C:\Windows\System\PjpZBKF.exe
  2⤵
  PID:7452
- C:\Windows\System\FOwjgWU.exe
  C:\Windows\System\FOwjgWU.exe
  2⤵
  PID:7468
- C:\Windows\System\BbNZBHL.exe
  C:\Windows\System\BbNZBHL.exe
  2⤵
  PID:7484
- C:\Windows\System\wuIHZeA.exe
  C:\Windows\System\wuIHZeA.exe
  2⤵
  PID:7504
- C:\Windows\System\xoSpjSh.exe
  C:\Windows\System\xoSpjSh.exe
  2⤵
  PID:7520
- C:\Windows\System\hSbHlVa.exe
  C:\Windows\System\hSbHlVa.exe
  2⤵
  PID:7536
- C:\Windows\System\bKsVAZC.exe
  C:\Windows\System\bKsVAZC.exe
  2⤵
  PID:7552
- C:\Windows\System\gOhvGAo.exe
  C:\Windows\System\gOhvGAo.exe
  2⤵
  PID:7568
- C:\Windows\System\BbdanaK.exe
  C:\Windows\System\BbdanaK.exe
  2⤵
  PID:7584
- C:\Windows\System\aZfJtiK.exe
  C:\Windows\System\aZfJtiK.exe
  2⤵
  PID:7600
- C:\Windows\System\QIMJLCD.exe
  C:\Windows\System\QIMJLCD.exe
  2⤵
  PID:7616
- C:\Windows\System\abzNbdO.exe
  C:\Windows\System\abzNbdO.exe
  2⤵
  PID:7632
- C:\Windows\System\hukkAVq.exe
  C:\Windows\System\hukkAVq.exe
  2⤵
  PID:7652
- C:\Windows\System\QJzYfDP.exe
  C:\Windows\System\QJzYfDP.exe
  2⤵
  PID:7668
- C:\Windows\System\iyqWstN.exe
  C:\Windows\System\iyqWstN.exe
  2⤵
  PID:7684
- C:\Windows\System\WPmIgac.exe
  C:\Windows\System\WPmIgac.exe
  2⤵
  PID:7700
- C:\Windows\System\ZGaqkAE.exe
  C:\Windows\System\ZGaqkAE.exe
  2⤵
  PID:7716
- C:\Windows\System\oQFPCbo.exe
  C:\Windows\System\oQFPCbo.exe
  2⤵
  PID:7736
- C:\Windows\System\nnxFCHg.exe
  C:\Windows\System\nnxFCHg.exe
  2⤵
  PID:7752
- C:\Windows\System\WnCVLpQ.exe
  C:\Windows\System\WnCVLpQ.exe
  2⤵
  PID:7768
- C:\Windows\System\BmZDzDC.exe
  C:\Windows\System\BmZDzDC.exe
  2⤵
  PID:7784
- C:\Windows\System\CQideGS.exe
  C:\Windows\System\CQideGS.exe
  2⤵
  PID:7800
- C:\Windows\System\lHStidF.exe
  C:\Windows\System\lHStidF.exe
  2⤵
  PID:7820
- C:\Windows\System\KyuXQpJ.exe
  C:\Windows\System\KyuXQpJ.exe
  2⤵
  PID:7836
- C:\Windows\System\xmxCjZU.exe
  C:\Windows\System\xmxCjZU.exe
  2⤵
  PID:7852
- C:\Windows\System\IUnJGaU.exe
  C:\Windows\System\IUnJGaU.exe
  2⤵
  PID:7868
- C:\Windows\System\iPpBVfV.exe
  C:\Windows\System\iPpBVfV.exe
  2⤵
  PID:7884
- C:\Windows\System\GIZmEWv.exe
  C:\Windows\System\GIZmEWv.exe
  2⤵
  PID:7900
- C:\Windows\System\XHOSRLi.exe
  C:\Windows\System\XHOSRLi.exe
  2⤵
  PID:7916
- C:\Windows\System\TdoEenF.exe
  C:\Windows\System\TdoEenF.exe
  2⤵
  PID:7932
- C:\Windows\System\aRFMwAt.exe
  C:\Windows\System\aRFMwAt.exe
  2⤵
  PID:7948
- C:\Windows\System\YoOpXAb.exe
  C:\Windows\System\YoOpXAb.exe
  2⤵
  PID:7964
- C:\Windows\System\ogoHkJS.exe
  C:\Windows\System\ogoHkJS.exe
  2⤵
  PID:7980
- C:\Windows\System\WwMkYId.exe
  C:\Windows\System\WwMkYId.exe
  2⤵
  PID:7996
- C:\Windows\System\mRrlIiq.exe
  C:\Windows\System\mRrlIiq.exe
  2⤵
  PID:8024
- C:\Windows\System\ooWXQGG.exe
  C:\Windows\System\ooWXQGG.exe
  2⤵
  PID:8044
- C:\Windows\System\shjvajI.exe
  C:\Windows\System\shjvajI.exe
  2⤵
  PID:8060
- C:\Windows\System\fvNJsCz.exe
  C:\Windows\System\fvNJsCz.exe
  2⤵
  PID:8076
- C:\Windows\System\IeATxYe.exe
  C:\Windows\System\IeATxYe.exe
  2⤵
  PID:8100
- C:\Windows\System\QKodRMC.exe
  C:\Windows\System\QKodRMC.exe
  2⤵
  PID:8124
- C:\Windows\System\RXuZhdE.exe
  C:\Windows\System\RXuZhdE.exe
  2⤵
  PID:8140
- C:\Windows\System\mPrFwar.exe
  C:\Windows\System\mPrFwar.exe
  2⤵
  PID:8160
- C:\Windows\System\fzOzRgL.exe
  C:\Windows\System\fzOzRgL.exe
  2⤵
  PID:8176
- C:\Windows\System\WYuoTRc.exe
  C:\Windows\System\WYuoTRc.exe
  2⤵
  PID:6280
- C:\Windows\System\OBfDMXb.exe
  C:\Windows\System\OBfDMXb.exe
  2⤵
  PID:7204
- C:\Windows\System\jXZMQDP.exe
  C:\Windows\System\jXZMQDP.exe
  2⤵
  PID:7192
- C:\Windows\System\dFwNXon.exe
  C:\Windows\System\dFwNXon.exe
  2⤵
  PID:7300
- C:\Windows\System\FjGPRZf.exe
  C:\Windows\System\FjGPRZf.exe
  2⤵
  PID:7364
- C:\Windows\System\LxyxtLr.exe
  C:\Windows\System\LxyxtLr.exe
  2⤵
  PID:7316
- C:\Windows\System\GfSVDPO.exe
  C:\Windows\System\GfSVDPO.exe
  2⤵
  PID:7448
- C:\Windows\System\GyPjGUn.exe
  C:\Windows\System\GyPjGUn.exe
  2⤵
  PID:7528
- C:\Windows\System\eVpiRNv.exe
  C:\Windows\System\eVpiRNv.exe
  2⤵
  PID:7476
- C:\Windows\System\QTgqkDT.exe
  C:\Windows\System\QTgqkDT.exe
  2⤵
  PID:7480
- C:\Windows\System\sqOmYmJ.exe
  C:\Windows\System\sqOmYmJ.exe
  2⤵
  PID:7624
- C:\Windows\System\aJENBvv.exe
  C:\Windows\System\aJENBvv.exe
  2⤵
  PID:7576
- C:\Windows\System\NDdifQo.exe
  C:\Windows\System\NDdifQo.exe
  2⤵
  PID:7644
- C:\Windows\System\WyzDDNj.exe
  C:\Windows\System\WyzDDNj.exe
  2⤵
  PID:7724
- C:\Windows\System\pYensER.exe
  C:\Windows\System\pYensER.exe
  2⤵
  PID:7760
- C:\Windows\System\qYgJbGv.exe
  C:\Windows\System\qYgJbGv.exe
  2⤵
  PID:7828
- C:\Windows\System\ksPKEaj.exe
  C:\Windows\System\ksPKEaj.exe
  2⤵
  PID:7832
- C:\Windows\System\NiBlcff.exe
  C:\Windows\System\NiBlcff.exe
  2⤵
  PID:7860
- C:\Windows\System\EXZubjf.exe
  C:\Windows\System\EXZubjf.exe
  2⤵
  PID:7864
- C:\Windows\System\RgqHNJu.exe
  C:\Windows\System\RgqHNJu.exe
  2⤵
  PID:7844
- C:\Windows\System\xuvePvD.exe
  C:\Windows\System\xuvePvD.exe
  2⤵
  PID:7924
- C:\Windows\System\SxBJvSJ.exe
  C:\Windows\System\SxBJvSJ.exe
  2⤵
  PID:7908
- C:\Windows\System\nJHhCbV.exe
  C:\Windows\System\nJHhCbV.exe
  2⤵
  PID:7944
- C:\Windows\System\AdgCmdx.exe
  C:\Windows\System\AdgCmdx.exe
  2⤵
  PID:8004
- C:\Windows\System\DolVPuB.exe
  C:\Windows\System\DolVPuB.exe
  2⤵
  PID:8032
- C:\Windows\System\KGjZozf.exe
  C:\Windows\System\KGjZozf.exe
  2⤵
  PID:8040
- C:\Windows\System\QzANyFs.exe
  C:\Windows\System\QzANyFs.exe
  2⤵
  PID:7428
- C:\Windows\System\BnNafin.exe
  C:\Windows\System\BnNafin.exe
  2⤵
  PID:8096
- C:\Windows\System\LYIpkIF.exe
  C:\Windows\System\LYIpkIF.exe
  2⤵
  PID:8172
- C:\Windows\System\FKsIbVb.exe
  C:\Windows\System\FKsIbVb.exe
  2⤵
  PID:7512
- C:\Windows\System\JZfxzEU.exe
  C:\Windows\System\JZfxzEU.exe
  2⤵
  PID:7220
- C:\Windows\System\VqbLPyJ.exe
  C:\Windows\System\VqbLPyJ.exe
  2⤵
  PID:7368
- C:\Windows\System\grOBiUp.exe
  C:\Windows\System\grOBiUp.exe
  2⤵
  PID:7696
- C:\Windows\System\RbptqvY.exe
  C:\Windows\System\RbptqvY.exe
  2⤵
  PID:7500
- C:\Windows\System\RBhFJIc.exe
  C:\Windows\System\RBhFJIc.exe
  2⤵
  PID:7896
- C:\Windows\System\ZhNyvQn.exe
  C:\Windows\System\ZhNyvQn.exe
  2⤵
  PID:7972
- C:\Windows\System\iLWGEmz.exe
  C:\Windows\System\iLWGEmz.exe
  2⤵
  PID:7956
- C:\Windows\System\HSaRFxq.exe
  C:\Windows\System\HSaRFxq.exe
  2⤵
  PID:7960
- C:\Windows\System\VmzNIGx.exe
  C:\Windows\System\VmzNIGx.exe
  2⤵
  PID:8120
- C:\Windows\System\xUtNWKn.exe
  C:\Windows\System\xUtNWKn.exe
  2⤵
  PID:8156
- C:\Windows\System\OvWUEEl.exe
  C:\Windows\System\OvWUEEl.exe
  2⤵
  PID:7208
- C:\Windows\System\cmZfKqD.exe
  C:\Windows\System\cmZfKqD.exe
  2⤵
  PID:8020
- C:\Windows\System\UEBjAob.exe
  C:\Windows\System\UEBjAob.exe
  2⤵
  PID:7288
- C:\Windows\System\cupkyrF.exe
  C:\Windows\System\cupkyrF.exe
  2⤵
  PID:7396
- C:\Windows\System\BzkwgES.exe
  C:\Windows\System\BzkwgES.exe
  2⤵
  PID:7432
- C:\Windows\System\onwqCAY.exe
  C:\Windows\System\onwqCAY.exe
  2⤵
  PID:6540
- C:\Windows\System\DdAHgMp.exe
  C:\Windows\System\DdAHgMp.exe
  2⤵
  PID:7748
- C:\Windows\System\XllLGBh.exe
  C:\Windows\System\XllLGBh.exe
  2⤵
  PID:8152
- C:\Windows\System\tIauxYV.exe
  C:\Windows\System\tIauxYV.exe
  2⤵
  PID:7416
- C:\Windows\System\DRUFcNt.exe
  C:\Windows\System\DRUFcNt.exe
  2⤵
  PID:7732
- C:\Windows\System\iytqyXU.exe
  C:\Windows\System\iytqyXU.exe
  2⤵
  PID:7252
- C:\Windows\System\njnbJVL.exe
  C:\Windows\System\njnbJVL.exe
  2⤵
  PID:7712
- C:\Windows\System\uLxmdOt.exe
  C:\Windows\System\uLxmdOt.exe
  2⤵
  PID:7564
- C:\Windows\System\AFPeStr.exe
  C:\Windows\System\AFPeStr.exe
  2⤵
  PID:7460
- C:\Windows\System\PRQcTzw.exe
  C:\Windows\System\PRQcTzw.exe
  2⤵
  PID:7548
- C:\Windows\System\BytWydE.exe
  C:\Windows\System\BytWydE.exe
  2⤵
  PID:8012
- C:\Windows\System\xGwCuXt.exe
  C:\Windows\System\xGwCuXt.exe
  2⤵
  PID:7268
- C:\Windows\System\iuskZmC.exe
  C:\Windows\System\iuskZmC.exe
  2⤵
  PID:7796
- C:\Windows\System\sZbYpAP.exe
  C:\Windows\System\sZbYpAP.exe
  2⤵
  PID:7384
- C:\Windows\System\tevKdMq.exe
  C:\Windows\System\tevKdMq.exe
  2⤵
  PID:7812
- C:\Windows\System\veIBDkW.exe
  C:\Windows\System\veIBDkW.exe
  2⤵
  PID:7628
- C:\Windows\System\YDjRpSa.exe
  C:\Windows\System\YDjRpSa.exe
  2⤵
  PID:7580
- C:\Windows\System\zSLqVdn.exe
  C:\Windows\System\zSLqVdn.exe
  2⤵
  PID:7236
- C:\Windows\System\ODmysdb.exe
  C:\Windows\System\ODmysdb.exe
  2⤵
  PID:8132
- C:\Windows\System\grQAkLf.exe
  C:\Windows\System\grQAkLf.exe
  2⤵
  PID:8204
- C:\Windows\System\hnKPmYj.exe
  C:\Windows\System\hnKPmYj.exe
  2⤵
  PID:8224
- C:\Windows\System\wqqRvIT.exe
  C:\Windows\System\wqqRvIT.exe
  2⤵
  PID:8244
- C:\Windows\System\yjHlQNX.exe
  C:\Windows\System\yjHlQNX.exe
  2⤵
  PID:8260
- C:\Windows\System\efVODWT.exe
  C:\Windows\System\efVODWT.exe
  2⤵
  PID:8276
- C:\Windows\System\aIRXnwZ.exe
  C:\Windows\System\aIRXnwZ.exe
  2⤵
  PID:8292
- C:\Windows\System\KnWVdha.exe
  C:\Windows\System\KnWVdha.exe
  2⤵
  PID:8308
- C:\Windows\System\JiJzLHe.exe
  C:\Windows\System\JiJzLHe.exe
  2⤵
  PID:8324
- C:\Windows\System\UpOnwrF.exe
  C:\Windows\System\UpOnwrF.exe
  2⤵
  PID:8340
- C:\Windows\System\socSpfg.exe
  C:\Windows\System\socSpfg.exe
  2⤵
  PID:8356
- C:\Windows\System\SPtJaCX.exe
  C:\Windows\System\SPtJaCX.exe
  2⤵
  PID:8372
- C:\Windows\System\fLlDqwt.exe
  C:\Windows\System\fLlDqwt.exe
  2⤵
  PID:8388
- C:\Windows\System\KPpmoOQ.exe
  C:\Windows\System\KPpmoOQ.exe
  2⤵
  PID:8404
- C:\Windows\System\yQTsZal.exe
  C:\Windows\System\yQTsZal.exe
  2⤵
  PID:8420
- C:\Windows\System\pIzFlga.exe
  C:\Windows\System\pIzFlga.exe
  2⤵
  PID:8436
- C:\Windows\System\pGZxPWh.exe
  C:\Windows\System\pGZxPWh.exe
  2⤵
  PID:8452
- C:\Windows\System\HAjWyYR.exe
  C:\Windows\System\HAjWyYR.exe
  2⤵
  PID:8468
- C:\Windows\System\tmJPQAF.exe
  C:\Windows\System\tmJPQAF.exe
  2⤵
  PID:8484
- C:\Windows\System\DegwkPe.exe
  C:\Windows\System\DegwkPe.exe
  2⤵
  PID:8500
- C:\Windows\System\XNrWssJ.exe
  C:\Windows\System\XNrWssJ.exe
  2⤵
  PID:8516
- C:\Windows\System\EddUsxm.exe
  C:\Windows\System\EddUsxm.exe
  2⤵
  PID:8532
- C:\Windows\System\edOIiGG.exe
  C:\Windows\System\edOIiGG.exe
  2⤵
  PID:8548
- C:\Windows\System\gYtrGBL.exe
  C:\Windows\System\gYtrGBL.exe
  2⤵
  PID:8564
- C:\Windows\System\gxNPwAD.exe
  C:\Windows\System\gxNPwAD.exe
  2⤵
  PID:8580
- C:\Windows\System\iEHlUpy.exe
  C:\Windows\System\iEHlUpy.exe
  2⤵
  PID:8596
- C:\Windows\System\FPYWtny.exe
  C:\Windows\System\FPYWtny.exe
  2⤵
  PID:8612
- C:\Windows\System\fJTmPpH.exe
  C:\Windows\System\fJTmPpH.exe
  2⤵
  PID:8628
- C:\Windows\System\ZJasPiS.exe
  C:\Windows\System\ZJasPiS.exe
  2⤵
  PID:8644
- C:\Windows\System\CNpfSvM.exe
  C:\Windows\System\CNpfSvM.exe
  2⤵
  PID:8660
- C:\Windows\System\BERVmMv.exe
  C:\Windows\System\BERVmMv.exe
  2⤵
  PID:8676
- C:\Windows\System\jMTyBdx.exe
  C:\Windows\System\jMTyBdx.exe
  2⤵
  PID:8692
- C:\Windows\System\eqMIOGv.exe
  C:\Windows\System\eqMIOGv.exe
  2⤵
  PID:8708
- C:\Windows\System\uVygomI.exe
  C:\Windows\System\uVygomI.exe
  2⤵
  PID:8728
- C:\Windows\System\HTeDcGa.exe
  C:\Windows\System\HTeDcGa.exe
  2⤵
  PID:8744
- C:\Windows\System\EvVdOFQ.exe
  C:\Windows\System\EvVdOFQ.exe
  2⤵
  PID:8760
- C:\Windows\System\zvHzmiY.exe
  C:\Windows\System\zvHzmiY.exe
  2⤵
  PID:8776
- C:\Windows\System\xOxpRAH.exe
  C:\Windows\System\xOxpRAH.exe
  2⤵
  PID:8792
- C:\Windows\System\yNwvUTf.exe
  C:\Windows\System\yNwvUTf.exe
  2⤵
  PID:8808
- C:\Windows\System\wtNbuvk.exe
  C:\Windows\System\wtNbuvk.exe
  2⤵
  PID:8824
- C:\Windows\System\cfuhtiq.exe
  C:\Windows\System\cfuhtiq.exe
  2⤵
  PID:8840
- C:\Windows\System\jscfvMN.exe
  C:\Windows\System\jscfvMN.exe
  2⤵
  PID:8860
- C:\Windows\System\dXgjdfp.exe
  C:\Windows\System\dXgjdfp.exe
  2⤵
  PID:8876
- C:\Windows\System\AjxXNqH.exe
  C:\Windows\System\AjxXNqH.exe
  2⤵
  PID:8892
- C:\Windows\System\VaYJHbi.exe
  C:\Windows\System\VaYJHbi.exe
  2⤵
  PID:8908
- C:\Windows\System\CNWIahO.exe
  C:\Windows\System\CNWIahO.exe
  2⤵
  PID:8924
- C:\Windows\System\yeIknHZ.exe
  C:\Windows\System\yeIknHZ.exe
  2⤵
  PID:8944
- C:\Windows\System\QJgZngn.exe
  C:\Windows\System\QJgZngn.exe
  2⤵
  PID:8964
- C:\Windows\System\MATrFrN.exe
  C:\Windows\System\MATrFrN.exe
  2⤵
  PID:8980
- C:\Windows\System\VLtqsxH.exe
  C:\Windows\System\VLtqsxH.exe
  2⤵
  PID:9000
- C:\Windows\System\XAHuQZf.exe
  C:\Windows\System\XAHuQZf.exe
  2⤵
  PID:9016
- C:\Windows\System\dFPrlLX.exe
  C:\Windows\System\dFPrlLX.exe
  2⤵
  PID:9032
- C:\Windows\System\mkwzGIP.exe
  C:\Windows\System\mkwzGIP.exe
  2⤵
  PID:9048
- C:\Windows\System\rSHFAal.exe
  C:\Windows\System\rSHFAal.exe
  2⤵
  PID:9068
- C:\Windows\System\cUTlLdv.exe
  C:\Windows\System\cUTlLdv.exe
  2⤵
  PID:9084
- C:\Windows\System\LSwlXde.exe
  C:\Windows\System\LSwlXde.exe
  2⤵
  PID:9100
- C:\Windows\System\hFpaira.exe
  C:\Windows\System\hFpaira.exe
  2⤵
  PID:9116
- C:\Windows\System\qfDQhEX.exe
  C:\Windows\System\qfDQhEX.exe
  2⤵
  PID:9132
- C:\Windows\System\rwcacKq.exe
  C:\Windows\System\rwcacKq.exe
  2⤵
  PID:9152
- C:\Windows\System\GISKQPr.exe
  C:\Windows\System\GISKQPr.exe
  2⤵
  PID:9172
- C:\Windows\System\JdFeFvX.exe
  C:\Windows\System\JdFeFvX.exe
  2⤵
  PID:9192
- C:\Windows\System\MCcXNBj.exe
  C:\Windows\System\MCcXNBj.exe
  2⤵
  PID:9208
- C:\Windows\System\OOAzfnA.exe
  C:\Windows\System\OOAzfnA.exe
  2⤵
  PID:8196
- C:\Windows\System\uCTHtnU.exe
  C:\Windows\System\uCTHtnU.exe
  2⤵
  PID:8148
- C:\Windows\System\BgPBSbv.exe
  C:\Windows\System\BgPBSbv.exe
  2⤵
  PID:8212
- C:\Windows\System\yYLqrit.exe
  C:\Windows\System\yYLqrit.exe
  2⤵
  PID:8240
- C:\Windows\System\PKITdSV.exe
  C:\Windows\System\PKITdSV.exe
  2⤵
  PID:8252
- C:\Windows\System\bvdxGgy.exe
  C:\Windows\System\bvdxGgy.exe
  2⤵
  PID:8288
- C:\Windows\System\hNteGcY.exe
  C:\Windows\System\hNteGcY.exe
  2⤵
  PID:8284
- C:\Windows\System\OeAtmFU.exe
  C:\Windows\System\OeAtmFU.exe
  2⤵
  PID:8400
- C:\Windows\System\lyepYVm.exe
  C:\Windows\System\lyepYVm.exe
  2⤵
  PID:8384
- C:\Windows\System\ZQWXcBg.exe
  C:\Windows\System\ZQWXcBg.exe
  2⤵
  PID:8352
- C:\Windows\System\YrJCjPU.exe
  C:\Windows\System\YrJCjPU.exe
  2⤵
  PID:8444
- C:\Windows\System\AMZnbsU.exe
  C:\Windows\System\AMZnbsU.exe
  2⤵
  PID:8496
- C:\Windows\System\mgLnXxw.exe
  C:\Windows\System\mgLnXxw.exe
  2⤵
  PID:8560
- C:\Windows\System\DTiLmCh.exe
  C:\Windows\System\DTiLmCh.exe
  2⤵
  PID:8624
- C:\Windows\System\MoxynjF.exe
  C:\Windows\System\MoxynjF.exe
  2⤵
  PID:8640
- C:\Windows\System\rOdodmi.exe
  C:\Windows\System\rOdodmi.exe
  2⤵
  PID:8544
- C:\Windows\System\bcQpyTf.exe
  C:\Windows\System\bcQpyTf.exe
  2⤵
  PID:8572
- C:\Windows\System\AdHgWRB.exe
  C:\Windows\System\AdHgWRB.exe
  2⤵
  PID:8716
- C:\Windows\System\xbAjJuj.exe
  C:\Windows\System\xbAjJuj.exe
  2⤵
  PID:8784
- C:\Windows\System\ShxOLJz.exe
  C:\Windows\System\ShxOLJz.exe
  2⤵
  PID:8768
- C:\Windows\System\IGpyonN.exe
  C:\Windows\System\IGpyonN.exe
  2⤵
  PID:8740
- C:\Windows\System\ysdsQHE.exe
  C:\Windows\System\ysdsQHE.exe
  2⤵
  PID:8820
- C:\Windows\System\YfYDnUp.exe
  C:\Windows\System\YfYDnUp.exe
  2⤵
  PID:8856
- C:\Windows\System\SszTtKq.exe
  C:\Windows\System\SszTtKq.exe
  2⤵
  PID:8868
- C:\Windows\System\yTVOJLO.exe
  C:\Windows\System\yTVOJLO.exe
  2⤵
  PID:8888
- C:\Windows\System\jbSTemb.exe
  C:\Windows\System\jbSTemb.exe
  2⤵
  PID:8952
- C:\Windows\System\IXIDuvJ.exe
  C:\Windows\System\IXIDuvJ.exe
  2⤵
  PID:9028
- C:\Windows\System\taUdPce.exe
  C:\Windows\System\taUdPce.exe
  2⤵
  PID:9012
- C:\Windows\System\nZARbMi.exe
  C:\Windows\System\nZARbMi.exe
  2⤵
  PID:9064
- C:\Windows\System\nuDGVRo.exe
  C:\Windows\System\nuDGVRo.exe
  2⤵
  PID:8940
- C:\Windows\System\IXGbjkq.exe
  C:\Windows\System\IXGbjkq.exe
  2⤵
  PID:9044
- C:\Windows\System\bzbLwLE.exe
  C:\Windows\System\bzbLwLE.exe
  2⤵
  PID:9108
- C:\Windows\System\rfcFDfj.exe
  C:\Windows\System\rfcFDfj.exe
  2⤵
  PID:9200
- C:\Windows\System\bgaBBcX.exe
  C:\Windows\System\bgaBBcX.exe
  2⤵
  PID:8084
- C:\Windows\System\DwPsDSM.exe
  C:\Windows\System\DwPsDSM.exe
  2⤵
  PID:8304
- C:\Windows\System\ltsSBJe.exe
  C:\Windows\System\ltsSBJe.exe
  2⤵
  PID:9180
- C:\Windows\System\sXinIAn.exe
  C:\Windows\System\sXinIAn.exe
  2⤵
  PID:7560
- C:\Windows\System\GfTZOev.exe
  C:\Windows\System\GfTZOev.exe
  2⤵
  PID:8272
- C:\Windows\System\TmhNuOC.exe
  C:\Windows\System\TmhNuOC.exe
  2⤵
  PID:8348
- C:\Windows\System\ayXuXQN.exe
  C:\Windows\System\ayXuXQN.exe
  2⤵
  PID:8480
- C:\Windows\System\GhLxmsQ.exe
  C:\Windows\System\GhLxmsQ.exe
  2⤵
  PID:8652
- C:\Windows\System\awHTtzt.exe
  C:\Windows\System\awHTtzt.exe
  2⤵
  PID:8528
- C:\Windows\System\cotXaOQ.exe
  C:\Windows\System\cotXaOQ.exe
  2⤵
  PID:8720
- C:\Windows\System\toksIrh.exe
  C:\Windows\System\toksIrh.exe
  2⤵
  PID:8832
- C:\Windows\System\AgshBLh.exe
  C:\Windows\System\AgshBLh.exe
  2⤵
  PID:8540
- C:\Windows\System\wTSTJtT.exe
  C:\Windows\System\wTSTJtT.exe
  2⤵
  PID:8604
- C:\Windows\System\VGeOhVI.exe
  C:\Windows\System\VGeOhVI.exe
  2⤵
  PID:8852
- C:\Windows\System\hPXovEX.exe
  C:\Windows\System\hPXovEX.exe
  2⤵
  PID:8976
- C:\Windows\System\mrGKrLg.exe
  C:\Windows\System\mrGKrLg.exe
  2⤵
  PID:9080
- C:\Windows\System\UOEVGqe.exe
  C:\Windows\System\UOEVGqe.exe
  2⤵
  PID:9060
- C:\Windows\System\OmDnbxg.exe
  C:\Windows\System\OmDnbxg.exe
  2⤵
  PID:9168
- C:\Windows\System\sQahPzA.exe
  C:\Windows\System\sQahPzA.exe
  2⤵
  PID:8200
- C:\Windows\System\waZTAwp.exe
  C:\Windows\System\waZTAwp.exe
  2⤵
  PID:8316
- C:\Windows\System\ZBbLyLe.exe
  C:\Windows\System\ZBbLyLe.exe
  2⤵
  PID:8492
- C:\Windows\System\ASNYYGY.exe
  C:\Windows\System\ASNYYGY.exe
  2⤵
  PID:8816
- C:\Windows\System\idAoIzO.exe
  C:\Windows\System\idAoIzO.exe
  2⤵
  PID:8688
- C:\Windows\System\ZpFbvSj.exe
  C:\Windows\System\ZpFbvSj.exe
  2⤵
  PID:8052
- C:\Windows\System\NvYjXdN.exe
  C:\Windows\System\NvYjXdN.exe
  2⤵
  PID:9008
- C:\Windows\System\SHeSdav.exe
  C:\Windows\System\SHeSdav.exe
  2⤵
  PID:9144
- C:\Windows\System\nHsxEWh.exe
  C:\Windows\System\nHsxEWh.exe
  2⤵
  PID:8368
- C:\Windows\System\iasJlVb.exe
  C:\Windows\System\iasJlVb.exe
  2⤵
  PID:8900
- C:\Windows\System\keLAWJb.exe
  C:\Windows\System\keLAWJb.exe
  2⤵
  PID:8512
- C:\Windows\System\cxPUaAC.exe
  C:\Windows\System\cxPUaAC.exe
  2⤵
  PID:9188
- C:\Windows\System\tFHFwtX.exe
  C:\Windows\System\tFHFwtX.exe
  2⤵
  PID:8756
- C:\Windows\System\GfsVzly.exe
  C:\Windows\System\GfsVzly.exe
  2⤵
  PID:8960
- C:\Windows\System\byyKPjT.exe
  C:\Windows\System\byyKPjT.exe
  2⤵
  PID:9228
- C:\Windows\System\BbaCfFT.exe
  C:\Windows\System\BbaCfFT.exe
  2⤵
  PID:9244
- C:\Windows\System\xnEMJdb.exe
  C:\Windows\System\xnEMJdb.exe
  2⤵
  PID:9264
- C:\Windows\System\vAOJhHs.exe
  C:\Windows\System\vAOJhHs.exe
  2⤵
  PID:9280
- C:\Windows\System\GbeIXmm.exe
  C:\Windows\System\GbeIXmm.exe
  2⤵
  PID:9296
- C:\Windows\System\qgGpQMr.exe
  C:\Windows\System\qgGpQMr.exe
  2⤵
  PID:9312
- C:\Windows\System\NOfSqub.exe
  C:\Windows\System\NOfSqub.exe
  2⤵
  PID:9328
- C:\Windows\System\FSUCzHz.exe
  C:\Windows\System\FSUCzHz.exe
  2⤵
  PID:9344
- C:\Windows\System\CptNHHD.exe
  C:\Windows\System\CptNHHD.exe
  2⤵
  PID:9360
- C:\Windows\System\ozrNKHq.exe
  C:\Windows\System\ozrNKHq.exe
  2⤵
  PID:9376
- C:\Windows\System\IUJWACx.exe
  C:\Windows\System\IUJWACx.exe
  2⤵
  PID:9392
- C:\Windows\System\DhGFJJo.exe
  C:\Windows\System\DhGFJJo.exe
  2⤵
  PID:9408
- C:\Windows\System\ekFUdij.exe
  C:\Windows\System\ekFUdij.exe
  2⤵
  PID:9424
- C:\Windows\System\TWpVJNb.exe
  C:\Windows\System\TWpVJNb.exe
  2⤵
  PID:9440
- C:\Windows\System\eicLHwe.exe
  C:\Windows\System\eicLHwe.exe
  2⤵
  PID:9456
- C:\Windows\System\lKGweZZ.exe
  C:\Windows\System\lKGweZZ.exe
  2⤵
  PID:9472
- C:\Windows\System\lOvoMwC.exe
  C:\Windows\System\lOvoMwC.exe
  2⤵
  PID:9488
- C:\Windows\System\JCtgGuE.exe
  C:\Windows\System\JCtgGuE.exe
  2⤵
  PID:9508
- C:\Windows\System\XdIYrzg.exe
  C:\Windows\System\XdIYrzg.exe
  2⤵
  PID:9572
- C:\Windows\System\UnRaBwX.exe
  C:\Windows\System\UnRaBwX.exe
  2⤵
  PID:9588
- C:\Windows\System\mgAEbfj.exe
  C:\Windows\System\mgAEbfj.exe
  2⤵
  PID:9604
- C:\Windows\System\DlttYuQ.exe
  C:\Windows\System\DlttYuQ.exe
  2⤵
  PID:9620
- C:\Windows\System\WjsXTZI.exe
  C:\Windows\System\WjsXTZI.exe
  2⤵
  PID:9636
- C:\Windows\System\jXqUSvW.exe
  C:\Windows\System\jXqUSvW.exe
  2⤵
  PID:9664
- C:\Windows\System\xGAvKlJ.exe
  C:\Windows\System\xGAvKlJ.exe
  2⤵
  PID:9712
- C:\Windows\System\JwYSeFe.exe
  C:\Windows\System\JwYSeFe.exe
  2⤵
  PID:9748
- C:\Windows\System\hGaQggh.exe
  C:\Windows\System\hGaQggh.exe
  2⤵
  PID:9796
- C:\Windows\System\zToRKgE.exe
  C:\Windows\System\zToRKgE.exe
  2⤵
  PID:9828
- C:\Windows\System\MFVNPZy.exe
  C:\Windows\System\MFVNPZy.exe
  2⤵
  PID:9844
- C:\Windows\System\GBuztgw.exe
  C:\Windows\System\GBuztgw.exe
  2⤵
  PID:9872
- C:\Windows\System\OlkQQuy.exe
  C:\Windows\System\OlkQQuy.exe
  2⤵
  PID:9896
- C:\Windows\System\hlwMzvy.exe
  C:\Windows\System\hlwMzvy.exe
  2⤵
  PID:9912
- C:\Windows\System\SYpoBJz.exe
  C:\Windows\System\SYpoBJz.exe
  2⤵
  PID:9928
- C:\Windows\System\utzPCCC.exe
  C:\Windows\System\utzPCCC.exe
  2⤵
  PID:9952
- C:\Windows\System\QncTYoI.exe
  C:\Windows\System\QncTYoI.exe
  2⤵
  PID:9972
- C:\Windows\System\gQpHoYl.exe
  C:\Windows\System\gQpHoYl.exe
  2⤵
  PID:9996
- C:\Windows\System\eCywlbS.exe
  C:\Windows\System\eCywlbS.exe
  2⤵
  PID:10012
- C:\Windows\System\mkyMnIi.exe
  C:\Windows\System\mkyMnIi.exe
  2⤵
  PID:10048
- C:\Windows\System\PimPhHx.exe
  C:\Windows\System\PimPhHx.exe
  2⤵
  PID:10064
- C:\Windows\System\uAshrOB.exe
  C:\Windows\System\uAshrOB.exe
  2⤵
  PID:10104
- C:\Windows\System\ifgwpEH.exe
  C:\Windows\System\ifgwpEH.exe
  2⤵
  PID:10216
- C:\Windows\System\QrKNmBq.exe
  C:\Windows\System\QrKNmBq.exe
  2⤵
  PID:9352
- C:\Windows\System\HBlRFbp.exe
  C:\Windows\System\HBlRFbp.exe
  2⤵
  PID:9356
- C:\Windows\System\SJyUKUm.exe
  C:\Windows\System\SJyUKUm.exe
  2⤵
  PID:9388
- C:\Windows\System\JNmKvHK.exe
  C:\Windows\System\JNmKvHK.exe
  2⤵
  PID:9304
- C:\Windows\System\vafUnlY.exe
  C:\Windows\System\vafUnlY.exe
  2⤵
  PID:9336
- C:\Windows\System\UFoRayR.exe
  C:\Windows\System\UFoRayR.exe
  2⤵
  PID:9372
- C:\Windows\System\Oexreys.exe
  C:\Windows\System\Oexreys.exe
  2⤵
  PID:9496
- C:\Windows\System\XLQemLn.exe
  C:\Windows\System\XLQemLn.exe
  2⤵
  PID:9528
- C:\Windows\System\tydOfjH.exe
  C:\Windows\System\tydOfjH.exe
  2⤵
  PID:9552
- C:\Windows\System\FWgXYBN.exe
  C:\Windows\System\FWgXYBN.exe
  2⤵
  PID:9568
- C:\Windows\System\gxKuNMO.exe
  C:\Windows\System\gxKuNMO.exe
  2⤵
  PID:9580
- C:\Windows\System\eoJbCLk.exe
  C:\Windows\System\eoJbCLk.exe
  2⤵
  PID:8992
- C:\Windows\System\FHVyXFo.exe
  C:\Windows\System\FHVyXFo.exe
  2⤵
  PID:9680
- C:\Windows\System\EcqFMbl.exe
  C:\Windows\System\EcqFMbl.exe
  2⤵
  PID:9704
- C:\Windows\System\akRstvf.exe
  C:\Windows\System\akRstvf.exe
  2⤵
  PID:9720
- C:\Windows\System\moPiUrB.exe
  C:\Windows\System\moPiUrB.exe
  2⤵
  PID:9728
- C:\Windows\System\ziNUaNk.exe
  C:\Windows\System\ziNUaNk.exe
  2⤵
  PID:9768
- C:\Windows\System\eYPWojD.exe
  C:\Windows\System\eYPWojD.exe
  2⤵
  PID:9784
- C:\Windows\System\sUYpKim.exe
  C:\Windows\System\sUYpKim.exe
  2⤵
  PID:9836
- C:\Windows\System\PGGYXfO.exe
  C:\Windows\System\PGGYXfO.exe
  2⤵
  PID:9888
- C:\Windows\System\FNdjUTn.exe
  C:\Windows\System\FNdjUTn.exe
  2⤵
  PID:9960
- C:\Windows\System\zxqZnrc.exe
  C:\Windows\System\zxqZnrc.exe
  2⤵
  PID:10004
- C:\Windows\System\WigZTCj.exe
  C:\Windows\System\WigZTCj.exe
  2⤵
  PID:10112
- C:\Windows\System\UmtzRZD.exe
  C:\Windows\System\UmtzRZD.exe
  2⤵
  PID:9944
- C:\Windows\System\GZLXmfe.exe
  C:\Windows\System\GZLXmfe.exe
  2⤵
  PID:10144
- C:\Windows\System\hsTsRsV.exe
  C:\Windows\System\hsTsRsV.exe
  2⤵
  PID:10020
- C:\Windows\System\yvfZpih.exe
  C:\Windows\System\yvfZpih.exe
  2⤵
  PID:10168
- C:\Windows\System\uYofvXJ.exe
  C:\Windows\System\uYofvXJ.exe
  2⤵
  PID:9820
- C:\Windows\System\PrckDXP.exe
  C:\Windows\System\PrckDXP.exe
  2⤵
  PID:9948
- C:\Windows\System\PupYPSr.exe
  C:\Windows\System\PupYPSr.exe
  2⤵
  PID:10196
- C:\Windows\System\JccmhBz.exe
  C:\Windows\System\JccmhBz.exe
  2⤵
  PID:9868
- C:\Windows\System\uOUVvsE.exe
  C:\Windows\System\uOUVvsE.exe
  2⤵
  PID:9984
- C:\Windows\System\gRaWTis.exe
  C:\Windows\System\gRaWTis.exe
  2⤵
  PID:10036
- C:\Windows\System\cDfZDPn.exe
  C:\Windows\System\cDfZDPn.exe
  2⤵
  PID:10076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ApNPduB.exe

Filesize
1.7MB

MD5
fd410d0c3e60286249fa01cbf5730537

SHA1
c52abc5780efbea9010ed06113bb5dc6494c1b34

SHA256
fdc122723504fec7433944d1b7aaa70229a6b429bff272cd4463140542ae7548

SHA512
f6450f6d531dcca6a53f56e5fb21bade00b46e35a8f0464b2b2aa6954f77509eff370e733711d177b48bef25840a23baa40228f14ac10149fb59e3a7e5c976f8

Download Submit
C:\Windows\system\BpUbqWQ.exe

Filesize
1.7MB

MD5
eff99a73bfa13ef2435808dc8aad06e0

SHA1
97566dcf3cc85e69c8f9f83dcaee0a7f0a3fa79d

SHA256
33928921950ca1a5e5ae48bef1abf3ad6179f68a0452c8fdbb06df55e84b4f69

SHA512
7028ded35a8a4f945f764401ecc18c5249b19485e637c735e6633640644dedd6944b4bfce19c2b8b64084ee92de5f55e1baeb00b70098c2ddd2c04926ccdd398

Download Submit
C:\Windows\system\CHLiAdT.exe

Filesize
1.7MB

MD5
8fa88325bc83ee40c3b5910f8c5cbbcd

SHA1
054cef075065dbebe2790af6ba42cdfcd4e63185

SHA256
cf17c25dede1a50967347277966e473dff72b3c076b3f68e8f37cf8375a13224

SHA512
20d38b4ea41c70eea174a18e4793009c81b2611d1f3988a755b05f06168abf9aa075d97ebcb30ab5aba9b8dbff4c2a8bf7c14f14333737e9b8a2fc34abe26488

Download Submit
C:\Windows\system\CZePHKw.exe

Filesize
1.7MB

MD5
87f3f2af60e340af2f23f4dc5ff46976

SHA1
feeca78060637bf98423e1cd9327e457df5b15c8

SHA256
a91a3ca0f8166bbd14d87ac9363096d25c2205f0dce9f0bd252ab48843d3ae96

SHA512
09181f3489acca17346ec4070e8840fa8f1e2e578c33067d3ead374798fc64ceffbaf67d7f343ea2809e04f13cc4c23fb9d76b33efa464dde03c0a8280d7ad0d

Download Submit
C:\Windows\system\EUVMDkz.exe

Filesize
1.7MB

MD5
eac43653479b339e2a8feecb3c39acb3

SHA1
85ab3c1dcc3e50c45d3e4944b24b745a98df74f7

SHA256
655aa6455980d3864f514d25295dd87cfcf9f564da9a9a424d5351864f2750a9

SHA512
3b74197eca5402459bcdb67f0350fa0371925921ac551486407997ccf3783572fec1c1eec9919012bc38cfd32cedff399481e8a396d97297c86102c01d30b0e4

Download Submit
C:\Windows\system\OBQZEGf.exe

Filesize
1.7MB

MD5
d494f9661995436a49339cf667df2d0d

SHA1
3f0dfc99d189dee0f6e842d75de76b54c3edf19e

SHA256
eeb7aba236cc8906d9d7728f4751295788952728099ca4d00c3dbee377b66d7e

SHA512
19608a06ea56ceb5b29202931ff49e0255a361fb26dc02ac226f7397fcdf753e89ffae0da3612a24c9688ce653e6b0055ba5221557e31d114d7a3f6e42290dd5

Download Submit
C:\Windows\system\OXkXmNJ.exe

Filesize
1.7MB

MD5
a380b2de5cdd7300f5bd74a274edabac

SHA1
324e970ff5d23fb2f9373eba52f457c8d923538a

SHA256
a027eb76a30e0f9b0a3ba1da3d3222bf19795d3f41b4a85d4b12b994eafda61d

SHA512
15115d5e7cff3bc3d96657cd9a38e7192c1e8920b86b76d5f146dd2b843915ba49515aa8c54d170edb1426a8d396fc101517c3ba2fbbfee5568bfb40d0aedaa1

Download Submit
C:\Windows\system\RWDRLQq.exe

Filesize
1.7MB

MD5
16c7e1eeae827f4fdce02af183403e03

SHA1
9afea9f92cbdbb95f32720cc86e33a0296661896

SHA256
8bbabc11fefc2f0758a6e5963a300ceca2b527666a20ba6b1c34161ad8598eb1

SHA512
0547600131ad4483d48d166341324bfee63d9ce2efcad2a9d1b0cb0d32b16d282b1f27da432d8c99921cb2d2bcc074ceebb29b23d0ffae1adb0a08c99fec4ecb

Download Submit
C:\Windows\system\RwwaljZ.exe

Filesize
1.7MB

MD5
7421cf6087c1664037dcb61215cbf162

SHA1
2e953b58528dff298e6c0764b6bb68d7e01c0d12

SHA256
b2e92cb4283f235776195d859c9ed54399b0d8dc328fca9674ac443b893add09

SHA512
99e0851304978bdab47e1aad3020ff85cf7217b5d84c64278d433d950d89da19c11a697b7f94df63f10bbccba5ac1e5ee39f4332dc596093705230e6e9e9d157

Download Submit
C:\Windows\system\SDVREGJ.exe

Filesize
1.7MB

MD5
2aaa995dca87246e96bcc9d88a832db1

SHA1
0c60cae387982fe4b07428a278db5be9e4cfbe50

SHA256
41f8da289a9d2ee3351aed9889020c0c09ed5e35554e4e9b5d7bfb25f5418dfc

SHA512
a2b6030324daf64bb13f073edec4080f896f8b80771451bf9be2211fc58f41a82db05849e1dc4857148a96287fa43de442bce15b775dd13e1318c31be88d6144

Download Submit
C:\Windows\system\SZxDgAr.exe

Filesize
1.7MB

MD5
b7984144ff5cbe04efde0ba1636c37f6

SHA1
88c97c606089f980d5b1cea6f7aa00049b6df61f

SHA256
e665be0c308442bc2964c054e5c047ccd9b85a07769e0c4803e43f370b6cf543

SHA512
756f8eaed9b6b3a33d094be0269f02fdf4efdd0c289851bd72553d5cc3fdf2e4c1248dc6a11031c3e57c79122cc86e58de9d7e52f16f600dce18bae9e57ff6a6

Download Submit
C:\Windows\system\TUekpLq.exe

Filesize
1.7MB

MD5
24605271d2f60eee9853f93b132ff496

SHA1
816c2e48f10c167e9c060bf53b20154bbfaa2fd6

SHA256
3e4361be4985f30bf4f865945a815a1840fcdbd8f1ae6eb37544ff452e8dfc28

SHA512
2a678660061735d7da1a5e83d8c9df12f8ced1be3c92ac11fbaddd084e605b7eff5425b79a42156387723939be5ae1c874ac9f03903a55f277d5f0548419b553

Download Submit
C:\Windows\system\UZcJJZx.exe

Filesize
1.7MB

MD5
2b1057bef70d74fa8f9367d7e0aa19b1

SHA1
4c1aabdf15bc06087535b2587f19203e640d35ea

SHA256
02b7b7b8c6b55aafafc310b50cf6dfc2c83ff395ddbd23817a32c7f3d057fb43

SHA512
7d2797dfaacd82d67d056e6eea7cef14749055673530525be84a01c58f4e5069613742486e33ae97e0e85f0fdc51fd2a3ad7006d0ada77ee7157a5ba66cf4567

Download Submit
C:\Windows\system\VYrVPuY.exe

Filesize
1.7MB

MD5
b1e2a57b9fbbdf3df5e7c679e0ca47c5

SHA1
5e31ee9a721893584d9622e6573afca5df50147e

SHA256
2c2739d26ff8994dfcdeee685f6c91953b2092f64c635325ab7aaaa3e074e43d

SHA512
e5ec527b6c35ffeb2108b5d67ae3ef5c43b6d4be3860771ba6820d88b4919122780d3956c25350bfcc78053296d1cd6e20e9f93d4c363d9b4a22ea7da5351fd5

Download Submit
C:\Windows\system\XholMJK.exe

Filesize
1.7MB

MD5
ce0a29753b50c3f217c51c9b88a5530e

SHA1
49e15747b4270943a730c3916444c1fdb8b2239b

SHA256
f767091ffc5c04731f23962a8c590e9b186168ef5d1b6272d32d1c0b2994465f

SHA512
8ce374bcb70bc8f4de31f5c4584cd2d90bf8fdd4f7f280fdf92834001f9b1cf2f6e4e57831310e5a1a1e4bb0ba5f15b80a11d41c6500b8f98438b845a13e894d

Download Submit
C:\Windows\system\aLRtjgM.exe

Filesize
1.7MB

MD5
ac8c8afe736a8401272095dfb1c129fb

SHA1
b3241d346abf168f8a3a2fd9507a290a7d9ab5c1

SHA256
4455cb996fdf81cdf82982a24605acdd8994545cca724b997e81e42b39544b6e

SHA512
e6f45eeb7f64b727903c0a824b3feb6f21c22da787bc128dd91ff2c3edc6a8f4da18836dd0f86f0b75dbe4205ff3dc133147cb6d5c5881b0033a5a7677fe1ee1

Download Submit
C:\Windows\system\aZEtEOQ.exe

Filesize
1.7MB

MD5
164d8bf013369d219a044f908a155333

SHA1
9d98ecf435bee8bbfc63317b234bf8cf8d5a5bbf

SHA256
c519978a26ebbb4303048333a0d861b10fdc8dc24a2e1aa020cb3dac44bd69b1

SHA512
cb6c38ac56995764d95e3d9d344995238fc17fc3637b1f4c078185a09cd669e1dc81b3a790f2b9e89311b25339c9d64ecb4c75009bd505df5409ea3ba993e4ff

Download Submit
C:\Windows\system\eJtVWan.exe

Filesize
1.7MB

MD5
2091d7582a530de1b0766248659ad266

SHA1
57b12864fa3966e7ab913a81f98bb7bc10567e2d

SHA256
b7a4ea3c903f0e8d7827e19c5f43aa27785fbc5820496665135119a777b00478

SHA512
6e002b0ea5ed396c05b129347300dc7c068af741b1baeef12b9d09bbf9026fe2d63dabd61772acf1b0417946ab6e8130f074d6a63cb5c0a26f500d93d984284e

Download Submit
C:\Windows\system\fLXXAqe.exe

Filesize
1.7MB

MD5
e85b8d5d88b55d447e5883b344bffe00

SHA1
e1ed67d65a3f9afa2ff3c5c3bc36895bcdb38d53

SHA256
b3f9cdad3151a28e9f78b952922e799983b416091b6dd17695ccb675ed907c7c

SHA512
21e00d863868dcd5e8b9aa499370a060d678e58ca4df15f8835156d29b65e5d5617365b0b1b1344f83a4254ccc5507d693cacbaa25f9a54fa9032976c0219f5c

Download Submit
C:\Windows\system\htkGJHN.exe

Filesize
1.7MB

MD5
e088ea02f21a20a01d57a72341ac727b

SHA1
1911a688a9e7770c277c8b5fec762b7890c7db15

SHA256
afde350924dbcb1c62c1508811234d9cc5f7c7f82cd518b8adee7ec8b006d72a

SHA512
869e911911ea5da66e91376b8fe15d97b98988b7c191fded305e3dfd5001d807ab750199d10a8cef296cb25047f10e0bbae11d294b9153f1f7540273d97560cf

Download Submit
C:\Windows\system\lhBQQJV.exe

Filesize
1.7MB

MD5
990ff32323d1b60ed9452962eb0716f6

SHA1
7f3b9edd442b13c15d8d4305f61a0eccd8d0a274

SHA256
a1b283547c4453baaae6113ad37768fc94d3a1bb64781434fdfa8214af4fd7aa

SHA512
312d38e83876ddd450f6ec1b48fe4bbfcb506925bfc285efed0bfa732f804a3787859e146a5e38d4553aa8a9e27be1b763b8b16b6cba586551e17f3761839912

Download Submit
C:\Windows\system\neliAWD.exe

Filesize
1.7MB

MD5
39c0d151204aebdf1fef4f8a78e13df3

SHA1
a7a3295abfd6917a67c98a41cb455ce2da8d062c

SHA256
319b8c9a051f93cde7fc3e1d1f8d97a1c7ef019011e77a261d38dfa2ae01e7ec

SHA512
aadfac96e7b10979882f5bf9ccae2d018230379e150a00f850fd35406c4c145d47456c14a3fcf2e24e6ca9eacae61b4efbaeb1111f0a63fb2fa286d80a8e8ca9

Download Submit
C:\Windows\system\pNfQHsv.exe

Filesize
1.7MB

MD5
3f77a7f354818dbf980dcbc0d2716858

SHA1
a9e01a0e213b3602bf84749cf78b145c852a31ea

SHA256
7d6d4965ad83e17da4a01009bbc4a2246225ffbd777a68f657b57031e0cd6fde

SHA512
4b391a6a360a9d42604cddd4ab4830e01248c9244dd9da9a974d028de0bfc6d7d91e17096c4568fba30fdcf525c5e53b8846a3d2398cec153272389749644518

Download Submit
C:\Windows\system\pSksHLK.exe

Filesize
1.7MB

MD5
02426da376b61ae2ab12bbc98ca80a17

SHA1
a138ea756ef74af0ea7e4a04daac88eba41c7d1f

SHA256
7cad8f529692990c611303bfacad17ac2bb4c8948077d959f47e4acc7499662f

SHA512
4bab94f3db105458c243079d40a4bbedf90e1da856e361cf2977e3e017ca42f7711a823f730f57d7941e11dfa93eedf3407ed5a67578df3d8b01446617767743

Download Submit
C:\Windows\system\rGjovKQ.exe

Filesize
1.7MB

MD5
17fbf8a0e722ba49d7296e5b63042af8

SHA1
e8a247c71bf8b9937cfbcc4c0072661246d1ec9f

SHA256
5bd2b4182a55644a13e602dd236f2a40ea3b2482631e27fd52b9a7edf672146b

SHA512
fca997ff145129b0205f44bce06997fd4bdebbfe9b35e07d230caec27b660f71a1dc6b45ff3ee710a9b60855004388ec62b1868033c2669e2aa614d30871e735

Download Submit
C:\Windows\system\slcfFWA.exe

Filesize
1.7MB

MD5
b98ed7ffdca962ad72ca30c15f6572df

SHA1
6eb5b7dbddcd987df032b2bef04b84ec02ce9dd7

SHA256
3637ab9cddac68c3ebfffabe67564b87314fad8c0279824c1c852655356f4e56

SHA512
7d1a0119dac0dd9c2f92e9242ccc07e9047f8d17b2c0df40c70e58e12868c1cf7d6d66bec215c3e9f9d693af38c77c0d72e37abbdb30197925fc2db72932c10d

Download Submit
C:\Windows\system\srzDHvm.exe

Filesize
1.7MB

MD5
9aff3d804b9f1e0ab3c04c4bd8a57be5

SHA1
ccd6ccfdabdf8b6fbe8b6b561c7f0e72a33fe27d

SHA256
160d5887da68b26de2e7409c82491ef8c947c8724f146eafb9f21c8ce5ed41aa

SHA512
dc8e009ed7db8494c4a43b5bab3d5a9430858557b1b59f5102fea77f61405d55d12b5271aa98c5a9c1aa55d2bfc53198f33d80349736b502695915cdbed5d2fd

Download Submit
C:\Windows\system\wrsWRzx.exe

Filesize
1.7MB

MD5
0d77a0002612ea304c7e3104d6aea1ab

SHA1
df77a3e8bb60d5e772747c5abd814e095b3d3d2a

SHA256
2cd760b7c3a418b256150d7fb179543d0959dbaf753170d64491fee2f2ad2a38

SHA512
311caff10e411d1ff24a1a6cd54f8e3fcbac09b3b30dcc383ff8f4b231e12fc11cc80e35fb06f2ed34b4b7d1cabcadee8f4cbc1936d3edeec48ac5c611cac0eb

Download Submit
C:\Windows\system\zHzGUHI.exe

Filesize
1.7MB

MD5
fe664af85cf611439bc85baf174f2d38

SHA1
4663ca15af2e204e464f755215d472f53ea092ca

SHA256
ea0009a19dfaaae2bfddb8f01983b3f93e6f0063c91230066ab869619d788594

SHA512
1b556c233cfb72b633635cbb0a57d48301d22529845118a068d96a314b199ecfb54d72823a2d2d95584a8f1aa29c1d4c13e00dbb1f2056fc2fd4a80b8afa4c09

Download Submit
\Windows\system\FUcqyuK.exe

Filesize
1.7MB

MD5
fa3e06a3502c8e06a08bc67c8341074a

SHA1
8929ff21a2f0984512950c305d321b40adc690ae

SHA256
bb9ede0e90bc70db52e6d5a05f59069b1fc6a7c8f43fa766cc2f5ca5a9930ddc

SHA512
d6ec3120fedd06ad152092a2ba9a8742c7e966581c907ed4b7ceac6aceebbdabdf857d23ee44a6a98a32268a4b9c124334ef2d33d4823b05af9a73da32126892

Download Submit
\Windows\system\IBDxFXo.exe

Filesize
1.7MB

MD5
9763a7d434ee2ac548bcaeeb73b2193f

SHA1
98aed816a5fbfdf552b423ab8e954eb2e253a89b

SHA256
072f9df65ae8140d8c9a78fb5f2591c370261686ac603d3e8e4b3cd958c8d687

SHA512
8c3616cbe4211a0a1dba9a1968e34b41047f3cc14fef3a23e368503c72a2b7981d965199785729b3f9263ce3da89b063ee4bda923d21a574d7a7bb2f6ecc6bb8

Download Submit
\Windows\system\UrjtLPI.exe

Filesize
1.7MB

MD5
4d96cdd537ca198c8d78954fcfb06bbb

SHA1
4f34b769604e52dcc93ce9f62dde1994db025318

SHA256
999bf89383a02732e20256d1887bd74ea869102fc70003cac0eb500925e18b94

SHA512
40a8004d678116b0b202032018db1eb2b294cb9e1753cf8f4fb3c955b7476a6460b72c001978864d354039f1d84bf9f5263751ceecd949820dcfc4c8b4f8e279

Download Submit
memory/1684-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download