xmrig | 0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
Size

1.3MB
MD5

78bbb849f98e0d04fab8516b8848337b
SHA1

87cbdcf77c67cff7b459b81d8ee71dfe8ee773b3
SHA256

0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac
SHA512

2d6f8271486867b54e8170126e1db840d240f614336365f7bd9cc632e837fbaea8043d3e99a94abca872c6d26b5f3a8699a8f808fb8ae1cd1d686f3bf29a1df2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pbkqqan:GezaTF8FcNkNdfE0pZ9ozttwIRx3/LR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	xmrig
behavioral1/files/0x0008000000016ab9-6.dat	xmrig
behavioral1/files/0x0008000000016c56-8.dat	xmrig
behavioral1/files/0x0008000000016c73-14.dat	xmrig
behavioral1/files/0x0007000000016cc5-21.dat	xmrig
behavioral1/files/0x0007000000016ce7-22.dat	xmrig
behavioral1/files/0x0007000000016d1d-27.dat	xmrig
behavioral1/files/0x00060000000175e7-45.dat	xmrig
behavioral1/files/0x001400000001866f-58.dat	xmrig
behavioral1/files/0x000500000001868b-66.dat	xmrig
behavioral1/files/0x0005000000018742-82.dat	xmrig
behavioral1/files/0x000500000001925e-106.dat	xmrig
behavioral1/files/0x0005000000019261-111.dat	xmrig
behavioral1/files/0x0005000000019279-118.dat	xmrig
behavioral1/files/0x000500000001939d-138.dat	xmrig
behavioral1/files/0x0005000000019379-134.dat	xmrig
behavioral1/files/0x00050000000192a9-130.dat	xmrig
behavioral1/files/0x00090000000165a7-126.dat	xmrig
behavioral1/files/0x0005000000019284-123.dat	xmrig
behavioral1/files/0x000500000001926a-114.dat	xmrig
behavioral1/files/0x000500000001922c-102.dat	xmrig
behavioral1/files/0x0005000000019227-98.dat	xmrig
behavioral1/files/0x0006000000018bf3-94.dat	xmrig
behavioral1/files/0x000500000001878c-90.dat	xmrig
behavioral1/files/0x0005000000018781-86.dat	xmrig
behavioral1/files/0x0005000000018731-78.dat	xmrig
behavioral1/files/0x00050000000186f8-74.dat	xmrig
behavioral1/files/0x00050000000186f2-70.dat	xmrig
behavioral1/files/0x0011000000018682-62.dat	xmrig
behavioral1/files/0x0006000000018669-53.dat	xmrig
behavioral1/files/0x0008000000016d36-41.dat	xmrig
behavioral1/files/0x0008000000016d2e-34.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2268	KaglmoF.exe
2340	IGSczdf.exe
2420	OcBbSzP.exe
2500	nkqvNLo.exe
2360	McKRDLD.exe
2864	QplDsrg.exe
2792	GOCxGZw.exe
2292	vFBxbAY.exe
2752	iwnIIOo.exe
1632	BVwJaca.exe
2852	JPrDJRw.exe
2940	kEQPLyY.exe
2844	xEzfkAV.exe
2620	vyifRWq.exe
2816	jOcsDlX.exe
2708	tFbzCUx.exe
2612	WKnxQQE.exe
2668	dguiSRF.exe
3036	WQxzMwM.exe
3048	tUkwwWJ.exe
1792	URPfejp.exe
3024	uksSpoQ.exe
1864	JfIvmfw.exe
868	fTCpcIz.exe
2664	ftWwRIk.exe
1252	PEqOwzm.exe
540	kfqokMg.exe
3068	qeTXCyl.exe
3028	eSoVKLj.exe
2220	ZNrjMjE.exe
2120	RdIgknt.exe
2052	nrPpSpv.exe
2556	FdcYYgi.exe
1160	CdaeRGe.exe
2452	GlWevXE.exe
1276	miRoNUk.exe
1104	RzUyKYA.exe
2136	QXGsMdS.exe
1028	GjGkZpz.exe
2080	grHMvJR.exe
380	lKPuezm.exe
908	IEiNPhO.exe
2028	FjhACcm.exe
1960	pYeIcce.exe
2572	DRxIDyG.exe
1260	tJqgsVI.exe
2200	TtyxzCx.exe
2008	iULXVmz.exe
1692	RztZXrH.exe
912	GRxUwAF.exe
1540	mcIhkia.exe
1380	BxHPaQY.exe
1532	mqWsXRj.exe
756	OVfsuhw.exe
2460	FugtauF.exe
1064	CvaTUUV.exe
2324	kGODilr.exe
2520	WrwuvQt.exe
2216	snjUjkF.exe
2960	eCmhUUW.exe
2172	hqQprlR.exe
2576	YxxghtI.exe
2532	iHMpBeI.exe
892	xqhFkPq.exe

Loads dropped DLL 64 IoCs

pid	Process
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uWbSwdQ.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\qSdmBhH.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\FdcYYgi.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\RbVnzcI.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\SUoyGhh.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\dhyKeTX.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\bTmuVcD.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\uCajQvS.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\dguiSRF.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\LnyLBpS.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\MJRuoLK.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\npybadA.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\woNtkEG.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\PvHTibU.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\KOybiaG.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\RjBgLly.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\idewzKZ.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\MIhYttF.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\jnZYWsq.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\LNeKLee.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\DwemecA.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\xasEdPd.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\wWKoddA.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\nSMHkxY.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\erKgWAm.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\lQGoPeS.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\knXYiYd.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\uksSpoQ.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\GlWevXE.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\grHMvJR.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\EDSXlif.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\UyOiSqy.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\SynIryy.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\ZPbLAUN.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\FsrMYzX.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\gSnjLKz.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\CxRSauP.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\eQYFQrw.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\alOQVVt.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\ItvGGXn.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\uWkZpia.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\qsgsPAL.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\BLwuGWv.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\KJxubtB.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\cwXuLHI.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\XbvoGVY.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\ejRwMvP.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\FuQphhO.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\gELXMjT.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\pxxpepg.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\NLJSVzq.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\PJuvnFg.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\qbWWaTd.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\DTyKugD.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\DtIjHGX.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\ZGbAXtW.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\OVApZbK.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\mequRJJ.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\UfcXfjM.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\uwSvehz.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\tupDKxd.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\IUVplre.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\olHjKEo.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
File created	C:\Windows\System\CFkBBFb.exe	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2268	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	31
PID 2116 wrote to memory of 2268	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	31
PID 2116 wrote to memory of 2268	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	31
PID 2116 wrote to memory of 2420	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	32
PID 2116 wrote to memory of 2420	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	32
PID 2116 wrote to memory of 2420	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	32
PID 2116 wrote to memory of 2340	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	33
PID 2116 wrote to memory of 2340	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	33
PID 2116 wrote to memory of 2340	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	33
PID 2116 wrote to memory of 2500	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	34
PID 2116 wrote to memory of 2500	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	34
PID 2116 wrote to memory of 2500	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	34
PID 2116 wrote to memory of 2360	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	35
PID 2116 wrote to memory of 2360	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	35
PID 2116 wrote to memory of 2360	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	35
PID 2116 wrote to memory of 2864	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	36
PID 2116 wrote to memory of 2864	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	36
PID 2116 wrote to memory of 2864	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	36
PID 2116 wrote to memory of 2292	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	37
PID 2116 wrote to memory of 2292	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	37
PID 2116 wrote to memory of 2292	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	37
PID 2116 wrote to memory of 2792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	38
PID 2116 wrote to memory of 2792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	38
PID 2116 wrote to memory of 2792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	38
PID 2116 wrote to memory of 2752	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	39
PID 2116 wrote to memory of 2752	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	39
PID 2116 wrote to memory of 2752	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	39
PID 2116 wrote to memory of 1632	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	40
PID 2116 wrote to memory of 1632	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	40
PID 2116 wrote to memory of 1632	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	40
PID 2116 wrote to memory of 2852	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	41
PID 2116 wrote to memory of 2852	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	41
PID 2116 wrote to memory of 2852	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	41
PID 2116 wrote to memory of 2940	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	42
PID 2116 wrote to memory of 2940	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	42
PID 2116 wrote to memory of 2940	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	42
PID 2116 wrote to memory of 2844	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	43
PID 2116 wrote to memory of 2844	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	43
PID 2116 wrote to memory of 2844	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	43
PID 2116 wrote to memory of 2620	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	44
PID 2116 wrote to memory of 2620	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	44
PID 2116 wrote to memory of 2620	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	44
PID 2116 wrote to memory of 2816	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	45
PID 2116 wrote to memory of 2816	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	45
PID 2116 wrote to memory of 2816	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	45
PID 2116 wrote to memory of 2708	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	46
PID 2116 wrote to memory of 2708	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	46
PID 2116 wrote to memory of 2708	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	46
PID 2116 wrote to memory of 2612	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	47
PID 2116 wrote to memory of 2612	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	47
PID 2116 wrote to memory of 2612	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	47
PID 2116 wrote to memory of 2668	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	48
PID 2116 wrote to memory of 2668	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	48
PID 2116 wrote to memory of 2668	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	48
PID 2116 wrote to memory of 3036	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	49
PID 2116 wrote to memory of 3036	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	49
PID 2116 wrote to memory of 3036	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	49
PID 2116 wrote to memory of 3048	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	50
PID 2116 wrote to memory of 3048	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	50
PID 2116 wrote to memory of 3048	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	50
PID 2116 wrote to memory of 1792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	51
PID 2116 wrote to memory of 1792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	51
PID 2116 wrote to memory of 1792	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	51
PID 2116 wrote to memory of 3024	2116	0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe	52

C:\Users\Admin\AppData\Local\Temp\0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe
"C:\Users\Admin\AppData\Local\Temp\0a928aeeaff4a759c0ca1bab8e8403af918be0e7e567540befc65d8df904bcac.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System\KaglmoF.exe
  C:\Windows\System\KaglmoF.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\OcBbSzP.exe
  C:\Windows\System\OcBbSzP.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\IGSczdf.exe
  C:\Windows\System\IGSczdf.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\nkqvNLo.exe
  C:\Windows\System\nkqvNLo.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\McKRDLD.exe
  C:\Windows\System\McKRDLD.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\QplDsrg.exe
  C:\Windows\System\QplDsrg.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\vFBxbAY.exe
  C:\Windows\System\vFBxbAY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\GOCxGZw.exe
  C:\Windows\System\GOCxGZw.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\iwnIIOo.exe
  C:\Windows\System\iwnIIOo.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\BVwJaca.exe
  C:\Windows\System\BVwJaca.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\JPrDJRw.exe
  C:\Windows\System\JPrDJRw.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\kEQPLyY.exe
  C:\Windows\System\kEQPLyY.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\xEzfkAV.exe
  C:\Windows\System\xEzfkAV.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\vyifRWq.exe
  C:\Windows\System\vyifRWq.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\jOcsDlX.exe
  C:\Windows\System\jOcsDlX.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\tFbzCUx.exe
  C:\Windows\System\tFbzCUx.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\WKnxQQE.exe
  C:\Windows\System\WKnxQQE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dguiSRF.exe
  C:\Windows\System\dguiSRF.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\WQxzMwM.exe
  C:\Windows\System\WQxzMwM.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\tUkwwWJ.exe
  C:\Windows\System\tUkwwWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\URPfejp.exe
  C:\Windows\System\URPfejp.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\uksSpoQ.exe
  C:\Windows\System\uksSpoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\JfIvmfw.exe
  C:\Windows\System\JfIvmfw.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\fTCpcIz.exe
  C:\Windows\System\fTCpcIz.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\ftWwRIk.exe
  C:\Windows\System\ftWwRIk.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\PEqOwzm.exe
  C:\Windows\System\PEqOwzm.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\kfqokMg.exe
  C:\Windows\System\kfqokMg.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\qeTXCyl.exe
  C:\Windows\System\qeTXCyl.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\eSoVKLj.exe
  C:\Windows\System\eSoVKLj.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ZNrjMjE.exe
  C:\Windows\System\ZNrjMjE.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\RdIgknt.exe
  C:\Windows\System\RdIgknt.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nrPpSpv.exe
  C:\Windows\System\nrPpSpv.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\FdcYYgi.exe
  C:\Windows\System\FdcYYgi.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\CdaeRGe.exe
  C:\Windows\System\CdaeRGe.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\GlWevXE.exe
  C:\Windows\System\GlWevXE.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\miRoNUk.exe
  C:\Windows\System\miRoNUk.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\RzUyKYA.exe
  C:\Windows\System\RzUyKYA.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\QXGsMdS.exe
  C:\Windows\System\QXGsMdS.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\GjGkZpz.exe
  C:\Windows\System\GjGkZpz.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\grHMvJR.exe
  C:\Windows\System\grHMvJR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\lKPuezm.exe
  C:\Windows\System\lKPuezm.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\IEiNPhO.exe
  C:\Windows\System\IEiNPhO.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\FjhACcm.exe
  C:\Windows\System\FjhACcm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\pYeIcce.exe
  C:\Windows\System\pYeIcce.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\DRxIDyG.exe
  C:\Windows\System\DRxIDyG.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\tJqgsVI.exe
  C:\Windows\System\tJqgsVI.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\TtyxzCx.exe
  C:\Windows\System\TtyxzCx.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\iULXVmz.exe
  C:\Windows\System\iULXVmz.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\RztZXrH.exe
  C:\Windows\System\RztZXrH.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\GRxUwAF.exe
  C:\Windows\System\GRxUwAF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mcIhkia.exe
  C:\Windows\System\mcIhkia.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\BxHPaQY.exe
  C:\Windows\System\BxHPaQY.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\mqWsXRj.exe
  C:\Windows\System\mqWsXRj.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\OVfsuhw.exe
  C:\Windows\System\OVfsuhw.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\FugtauF.exe
  C:\Windows\System\FugtauF.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\CvaTUUV.exe
  C:\Windows\System\CvaTUUV.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\kGODilr.exe
  C:\Windows\System\kGODilr.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\WrwuvQt.exe
  C:\Windows\System\WrwuvQt.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\snjUjkF.exe
  C:\Windows\System\snjUjkF.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\eCmhUUW.exe
  C:\Windows\System\eCmhUUW.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\hqQprlR.exe
  C:\Windows\System\hqQprlR.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\YxxghtI.exe
  C:\Windows\System\YxxghtI.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\iHMpBeI.exe
  C:\Windows\System\iHMpBeI.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\xqhFkPq.exe
  C:\Windows\System\xqhFkPq.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\mjKWOLX.exe
  C:\Windows\System\mjKWOLX.exe
  2⤵
  PID:2488
- C:\Windows\System\mKQALep.exe
  C:\Windows\System\mKQALep.exe
  2⤵
  PID:1992
- C:\Windows\System\jpuSayO.exe
  C:\Windows\System\jpuSayO.exe
  2⤵
  PID:1564
- C:\Windows\System\yTZjUKg.exe
  C:\Windows\System\yTZjUKg.exe
  2⤵
  PID:2224
- C:\Windows\System\pxxpepg.exe
  C:\Windows\System\pxxpepg.exe
  2⤵
  PID:2348
- C:\Windows\System\lcogwOs.exe
  C:\Windows\System\lcogwOs.exe
  2⤵
  PID:2932
- C:\Windows\System\xTPdKRV.exe
  C:\Windows\System\xTPdKRV.exe
  2⤵
  PID:2808
- C:\Windows\System\gNwgULi.exe
  C:\Windows\System\gNwgULi.exe
  2⤵
  PID:2868
- C:\Windows\System\CQprMFS.exe
  C:\Windows\System\CQprMFS.exe
  2⤵
  PID:2724
- C:\Windows\System\lLFacLy.exe
  C:\Windows\System\lLFacLy.exe
  2⤵
  PID:2748
- C:\Windows\System\EjJjNSd.exe
  C:\Windows\System\EjJjNSd.exe
  2⤵
  PID:2728
- C:\Windows\System\eTCrhNa.exe
  C:\Windows\System\eTCrhNa.exe
  2⤵
  PID:2848
- C:\Windows\System\gtjFMxC.exe
  C:\Windows\System\gtjFMxC.exe
  2⤵
  PID:2900
- C:\Windows\System\GrrygSX.exe
  C:\Windows\System\GrrygSX.exe
  2⤵
  PID:1908
- C:\Windows\System\jWXFVsJ.exe
  C:\Windows\System\jWXFVsJ.exe
  2⤵
  PID:2608
- C:\Windows\System\VfteQly.exe
  C:\Windows\System\VfteQly.exe
  2⤵
  PID:3044
- C:\Windows\System\tnsJNgo.exe
  C:\Windows\System\tnsJNgo.exe
  2⤵
  PID:2352
- C:\Windows\System\WEyfCyi.exe
  C:\Windows\System\WEyfCyi.exe
  2⤵
  PID:2996
- C:\Windows\System\AmQnhYB.exe
  C:\Windows\System\AmQnhYB.exe
  2⤵
  PID:1916
- C:\Windows\System\VpwWCXV.exe
  C:\Windows\System\VpwWCXV.exe
  2⤵
  PID:2196
- C:\Windows\System\czLSnEJ.exe
  C:\Windows\System\czLSnEJ.exe
  2⤵
  PID:2548
- C:\Windows\System\yomXqku.exe
  C:\Windows\System\yomXqku.exe
  2⤵
  PID:1764
- C:\Windows\System\wWuYXOI.exe
  C:\Windows\System\wWuYXOI.exe
  2⤵
  PID:3060
- C:\Windows\System\ufWYKvh.exe
  C:\Windows\System\ufWYKvh.exe
  2⤵
  PID:2188
- C:\Windows\System\iObQnFw.exe
  C:\Windows\System\iObQnFw.exe
  2⤵
  PID:2084
- C:\Windows\System\kkdVrsv.exe
  C:\Windows\System\kkdVrsv.exe
  2⤵
  PID:2140
- C:\Windows\System\skmttIR.exe
  C:\Windows\System\skmttIR.exe
  2⤵
  PID:1128
- C:\Windows\System\kSUcffZ.exe
  C:\Windows\System\kSUcffZ.exe
  2⤵
  PID:1144
- C:\Windows\System\eMePIKU.exe
  C:\Windows\System\eMePIKU.exe
  2⤵
  PID:2108
- C:\Windows\System\ooMSlWo.exe
  C:\Windows\System\ooMSlWo.exe
  2⤵
  PID:2528
- C:\Windows\System\jIGxaas.exe
  C:\Windows\System\jIGxaas.exe
  2⤵
  PID:1040
- C:\Windows\System\zpaHmuj.exe
  C:\Windows\System\zpaHmuj.exe
  2⤵
  PID:2456
- C:\Windows\System\xVSysvR.exe
  C:\Windows\System\xVSysvR.exe
  2⤵
  PID:1672
- C:\Windows\System\ugZdbKe.exe
  C:\Windows\System\ugZdbKe.exe
  2⤵
  PID:1680
- C:\Windows\System\wUqWrFw.exe
  C:\Windows\System\wUqWrFw.exe
  2⤵
  PID:812
- C:\Windows\System\sEbOPLN.exe
  C:\Windows\System\sEbOPLN.exe
  2⤵
  PID:1636
- C:\Windows\System\bDxDccJ.exe
  C:\Windows\System\bDxDccJ.exe
  2⤵
  PID:1124
- C:\Windows\System\IFsHAXr.exe
  C:\Windows\System\IFsHAXr.exe
  2⤵
  PID:2424
- C:\Windows\System\emNsCwj.exe
  C:\Windows\System\emNsCwj.exe
  2⤵
  PID:2228
- C:\Windows\System\OOaGCIs.exe
  C:\Windows\System\OOaGCIs.exe
  2⤵
  PID:2512
- C:\Windows\System\ZrhggTa.exe
  C:\Windows\System\ZrhggTa.exe
  2⤵
  PID:1484
- C:\Windows\System\acivAGR.exe
  C:\Windows\System\acivAGR.exe
  2⤵
  PID:1752
- C:\Windows\System\lNREOIB.exe
  C:\Windows\System\lNREOIB.exe
  2⤵
  PID:2332
- C:\Windows\System\ANCoZdK.exe
  C:\Windows\System\ANCoZdK.exe
  2⤵
  PID:2796
- C:\Windows\System\OyiozQh.exe
  C:\Windows\System\OyiozQh.exe
  2⤵
  PID:2780
- C:\Windows\System\xOsGVAo.exe
  C:\Windows\System\xOsGVAo.exe
  2⤵
  PID:2436
- C:\Windows\System\KTNfIIn.exe
  C:\Windows\System\KTNfIIn.exe
  2⤵
  PID:1272
- C:\Windows\System\IPsGOFE.exe
  C:\Windows\System\IPsGOFE.exe
  2⤵
  PID:2736
- C:\Windows\System\cciKQTT.exe
  C:\Windows\System\cciKQTT.exe
  2⤵
  PID:2700
- C:\Windows\System\PJWItec.exe
  C:\Windows\System\PJWItec.exe
  2⤵
  PID:2012
- C:\Windows\System\ENILaHM.exe
  C:\Windows\System\ENILaHM.exe
  2⤵
  PID:2660
- C:\Windows\System\cNOWfZg.exe
  C:\Windows\System\cNOWfZg.exe
  2⤵
  PID:2712
- C:\Windows\System\AFQoPlS.exe
  C:\Windows\System\AFQoPlS.exe
  2⤵
  PID:1920
- C:\Windows\System\FPsDrYa.exe
  C:\Windows\System\FPsDrYa.exe
  2⤵
  PID:2676
- C:\Windows\System\RHzyprY.exe
  C:\Windows\System\RHzyprY.exe
  2⤵
  PID:2208
- C:\Windows\System\CjSEPkQ.exe
  C:\Windows\System\CjSEPkQ.exe
  2⤵
  PID:1052
- C:\Windows\System\kIRirbZ.exe
  C:\Windows\System\kIRirbZ.exe
  2⤵
  PID:1476
- C:\Windows\System\atSVJMt.exe
  C:\Windows\System\atSVJMt.exe
  2⤵
  PID:2480
- C:\Windows\System\yWGOLCp.exe
  C:\Windows\System\yWGOLCp.exe
  2⤵
  PID:1868
- C:\Windows\System\lDtuanV.exe
  C:\Windows\System\lDtuanV.exe
  2⤵
  PID:2032
- C:\Windows\System\uoCJWhf.exe
  C:\Windows\System\uoCJWhf.exe
  2⤵
  PID:924
- C:\Windows\System\IEjndZL.exe
  C:\Windows\System\IEjndZL.exe
  2⤵
  PID:1772
- C:\Windows\System\TtxbQhM.exe
  C:\Windows\System\TtxbQhM.exe
  2⤵
  PID:1048
- C:\Windows\System\TiabLXu.exe
  C:\Windows\System\TiabLXu.exe
  2⤵
  PID:564
- C:\Windows\System\VKHFCyT.exe
  C:\Windows\System\VKHFCyT.exe
  2⤵
  PID:884
- C:\Windows\System\WpUKKfC.exe
  C:\Windows\System\WpUKKfC.exe
  2⤵
  PID:1804
- C:\Windows\System\yHDoLYp.exe
  C:\Windows\System\yHDoLYp.exe
  2⤵
  PID:1592
- C:\Windows\System\MYvOqMK.exe
  C:\Windows\System\MYvOqMK.exe
  2⤵
  PID:2788
- C:\Windows\System\RbVnzcI.exe
  C:\Windows\System\RbVnzcI.exe
  2⤵
  PID:2704
- C:\Windows\System\AEegTYG.exe
  C:\Windows\System\AEegTYG.exe
  2⤵
  PID:1536
- C:\Windows\System\SHsMNec.exe
  C:\Windows\System\SHsMNec.exe
  2⤵
  PID:2024
- C:\Windows\System\uEvMxXX.exe
  C:\Windows\System\uEvMxXX.exe
  2⤵
  PID:2924
- C:\Windows\System\XdFkwTU.exe
  C:\Windows\System\XdFkwTU.exe
  2⤵
  PID:2492
- C:\Windows\System\BRDxszQ.exe
  C:\Windows\System\BRDxszQ.exe
  2⤵
  PID:1712
- C:\Windows\System\mShEkFc.exe
  C:\Windows\System\mShEkFc.exe
  2⤵
  PID:2784
- C:\Windows\System\KAqOvnS.exe
  C:\Windows\System\KAqOvnS.exe
  2⤵
  PID:2760
- C:\Windows\System\AKhrVUe.exe
  C:\Windows\System\AKhrVUe.exe
  2⤵
  PID:2628
- C:\Windows\System\zSTfXGP.exe
  C:\Windows\System\zSTfXGP.exe
  2⤵
  PID:3052
- C:\Windows\System\gKKpmRM.exe
  C:\Windows\System\gKKpmRM.exe
  2⤵
  PID:3032
- C:\Windows\System\poUinfm.exe
  C:\Windows\System\poUinfm.exe
  2⤵
  PID:3016
- C:\Windows\System\iKLAmsB.exe
  C:\Windows\System\iKLAmsB.exe
  2⤵
  PID:1016
- C:\Windows\System\WTIRZkn.exe
  C:\Windows\System\WTIRZkn.exe
  2⤵
  PID:2600
- C:\Windows\System\xLlAYlF.exe
  C:\Windows\System\xLlAYlF.exe
  2⤵
  PID:2364
- C:\Windows\System\LkLPzsB.exe
  C:\Windows\System\LkLPzsB.exe
  2⤵
  PID:2688
- C:\Windows\System\lALKjMH.exe
  C:\Windows\System\lALKjMH.exe
  2⤵
  PID:2468
- C:\Windows\System\jsjbnCh.exe
  C:\Windows\System\jsjbnCh.exe
  2⤵
  PID:1872
- C:\Windows\System\ArrbUAV.exe
  C:\Windows\System\ArrbUAV.exe
  2⤵
  PID:2484
- C:\Windows\System\FCuMuAm.exe
  C:\Windows\System\FCuMuAm.exe
  2⤵
  PID:2132
- C:\Windows\System\LFDaBJF.exe
  C:\Windows\System\LFDaBJF.exe
  2⤵
  PID:2692
- C:\Windows\System\aAisADC.exe
  C:\Windows\System\aAisADC.exe
  2⤵
  PID:968
- C:\Windows\System\lVobkiZ.exe
  C:\Windows\System\lVobkiZ.exe
  2⤵
  PID:2060
- C:\Windows\System\kFZPXAf.exe
  C:\Windows\System\kFZPXAf.exe
  2⤵
  PID:940
- C:\Windows\System\zKktFqL.exe
  C:\Windows\System\zKktFqL.exe
  2⤵
  PID:284
- C:\Windows\System\orfkzkp.exe
  C:\Windows\System\orfkzkp.exe
  2⤵
  PID:2068
- C:\Windows\System\MWPQRUI.exe
  C:\Windows\System\MWPQRUI.exe
  2⤵
  PID:2884
- C:\Windows\System\DCJaJxa.exe
  C:\Windows\System\DCJaJxa.exe
  2⤵
  PID:2716
- C:\Windows\System\XyPaoye.exe
  C:\Windows\System\XyPaoye.exe
  2⤵
  PID:3076
- C:\Windows\System\FmedrUx.exe
  C:\Windows\System\FmedrUx.exe
  2⤵
  PID:3092
- C:\Windows\System\XKIGWEI.exe
  C:\Windows\System\XKIGWEI.exe
  2⤵
  PID:3108
- C:\Windows\System\lfJemcT.exe
  C:\Windows\System\lfJemcT.exe
  2⤵
  PID:3124
- C:\Windows\System\KyhkQqM.exe
  C:\Windows\System\KyhkQqM.exe
  2⤵
  PID:3140
- C:\Windows\System\WARkjBJ.exe
  C:\Windows\System\WARkjBJ.exe
  2⤵
  PID:3156
- C:\Windows\System\fLsynyc.exe
  C:\Windows\System\fLsynyc.exe
  2⤵
  PID:3172
- C:\Windows\System\kICTUcv.exe
  C:\Windows\System\kICTUcv.exe
  2⤵
  PID:3188
- C:\Windows\System\ktjJizr.exe
  C:\Windows\System\ktjJizr.exe
  2⤵
  PID:3204
- C:\Windows\System\APrWItH.exe
  C:\Windows\System\APrWItH.exe
  2⤵
  PID:3220
- C:\Windows\System\yCfRvGE.exe
  C:\Windows\System\yCfRvGE.exe
  2⤵
  PID:3236
- C:\Windows\System\tGQiZBs.exe
  C:\Windows\System\tGQiZBs.exe
  2⤵
  PID:3252
- C:\Windows\System\xrQZVoi.exe
  C:\Windows\System\xrQZVoi.exe
  2⤵
  PID:3272
- C:\Windows\System\DGqDWeS.exe
  C:\Windows\System\DGqDWeS.exe
  2⤵
  PID:3428
- C:\Windows\System\DXacOFf.exe
  C:\Windows\System\DXacOFf.exe
  2⤵
  PID:3484
- C:\Windows\System\bqKWMDw.exe
  C:\Windows\System\bqKWMDw.exe
  2⤵
  PID:3500
- C:\Windows\System\QFZWtmp.exe
  C:\Windows\System\QFZWtmp.exe
  2⤵
  PID:3516
- C:\Windows\System\MYwEtdD.exe
  C:\Windows\System\MYwEtdD.exe
  2⤵
  PID:3536
- C:\Windows\System\RmBSqNC.exe
  C:\Windows\System\RmBSqNC.exe
  2⤵
  PID:3552
- C:\Windows\System\ZDkglSZ.exe
  C:\Windows\System\ZDkglSZ.exe
  2⤵
  PID:3568
- C:\Windows\System\PQolmDc.exe
  C:\Windows\System\PQolmDc.exe
  2⤵
  PID:3584
- C:\Windows\System\JXZMkDO.exe
  C:\Windows\System\JXZMkDO.exe
  2⤵
  PID:3600
- C:\Windows\System\exehcbb.exe
  C:\Windows\System\exehcbb.exe
  2⤵
  PID:3616
- C:\Windows\System\dirKEBD.exe
  C:\Windows\System\dirKEBD.exe
  2⤵
  PID:3632
- C:\Windows\System\mEGbrNc.exe
  C:\Windows\System\mEGbrNc.exe
  2⤵
  PID:3648
- C:\Windows\System\KChldZl.exe
  C:\Windows\System\KChldZl.exe
  2⤵
  PID:3664
- C:\Windows\System\hxewBHR.exe
  C:\Windows\System\hxewBHR.exe
  2⤵
  PID:3680
- C:\Windows\System\VeXthNS.exe
  C:\Windows\System\VeXthNS.exe
  2⤵
  PID:3696
- C:\Windows\System\GmpaMCl.exe
  C:\Windows\System\GmpaMCl.exe
  2⤵
  PID:3712
- C:\Windows\System\FhoIYJv.exe
  C:\Windows\System\FhoIYJv.exe
  2⤵
  PID:3728
- C:\Windows\System\CRSwWAJ.exe
  C:\Windows\System\CRSwWAJ.exe
  2⤵
  PID:3744
- C:\Windows\System\tdozkxQ.exe
  C:\Windows\System\tdozkxQ.exe
  2⤵
  PID:3760
- C:\Windows\System\eCMOuVw.exe
  C:\Windows\System\eCMOuVw.exe
  2⤵
  PID:3776
- C:\Windows\System\RjBgLly.exe
  C:\Windows\System\RjBgLly.exe
  2⤵
  PID:3792
- C:\Windows\System\UpyjHQC.exe
  C:\Windows\System\UpyjHQC.exe
  2⤵
  PID:3808
- C:\Windows\System\gGBMpVM.exe
  C:\Windows\System\gGBMpVM.exe
  2⤵
  PID:3824
- C:\Windows\System\OkrkTgT.exe
  C:\Windows\System\OkrkTgT.exe
  2⤵
  PID:3840
- C:\Windows\System\tvTqXRJ.exe
  C:\Windows\System\tvTqXRJ.exe
  2⤵
  PID:3860
- C:\Windows\System\RRNWMSg.exe
  C:\Windows\System\RRNWMSg.exe
  2⤵
  PID:3908
- C:\Windows\System\JvLkogb.exe
  C:\Windows\System\JvLkogb.exe
  2⤵
  PID:3968
- C:\Windows\System\LUcEpIj.exe
  C:\Windows\System\LUcEpIj.exe
  2⤵
  PID:3988
- C:\Windows\System\ZGbAXtW.exe
  C:\Windows\System\ZGbAXtW.exe
  2⤵
  PID:4004
- C:\Windows\System\VoNhEqC.exe
  C:\Windows\System\VoNhEqC.exe
  2⤵
  PID:4020
- C:\Windows\System\cnCUSeq.exe
  C:\Windows\System\cnCUSeq.exe
  2⤵
  PID:4036
- C:\Windows\System\PnDOgUp.exe
  C:\Windows\System\PnDOgUp.exe
  2⤵
  PID:4052
- C:\Windows\System\qqSTeeL.exe
  C:\Windows\System\qqSTeeL.exe
  2⤵
  PID:4068
- C:\Windows\System\lNzvQPc.exe
  C:\Windows\System\lNzvQPc.exe
  2⤵
  PID:4084
- C:\Windows\System\VJdjBfR.exe
  C:\Windows\System\VJdjBfR.exe
  2⤵
  PID:1168
- C:\Windows\System\davlLDM.exe
  C:\Windows\System\davlLDM.exe
  2⤵
  PID:1308
- C:\Windows\System\XuyfNYD.exe
  C:\Windows\System\XuyfNYD.exe
  2⤵
  PID:2168
- C:\Windows\System\HYTtZEw.exe
  C:\Windows\System\HYTtZEw.exe
  2⤵
  PID:2144
- C:\Windows\System\TERSVZL.exe
  C:\Windows\System\TERSVZL.exe
  2⤵
  PID:3184
- C:\Windows\System\NRhXxFZ.exe
  C:\Windows\System\NRhXxFZ.exe
  2⤵
  PID:3248
- C:\Windows\System\HPmtIRB.exe
  C:\Windows\System\HPmtIRB.exe
  2⤵
  PID:3136
- C:\Windows\System\vSrGpXf.exe
  C:\Windows\System\vSrGpXf.exe
  2⤵
  PID:3040
- C:\Windows\System\JmEwBjG.exe
  C:\Windows\System\JmEwBjG.exe
  2⤵
  PID:3260
- C:\Windows\System\aRaessq.exe
  C:\Windows\System\aRaessq.exe
  2⤵
  PID:3228
- C:\Windows\System\dbssffx.exe
  C:\Windows\System\dbssffx.exe
  2⤵
  PID:3280
- C:\Windows\System\qKCNphA.exe
  C:\Windows\System\qKCNphA.exe
  2⤵
  PID:3292
- C:\Windows\System\GtJGfEC.exe
  C:\Windows\System\GtJGfEC.exe
  2⤵
  PID:3308
- C:\Windows\System\nXYpoEm.exe
  C:\Windows\System\nXYpoEm.exe
  2⤵
  PID:2448
- C:\Windows\System\LNqtARc.exe
  C:\Windows\System\LNqtARc.exe
  2⤵
  PID:3324
- C:\Windows\System\yQfCALG.exe
  C:\Windows\System\yQfCALG.exe
  2⤵
  PID:3340
- C:\Windows\System\DfaOhBk.exe
  C:\Windows\System\DfaOhBk.exe
  2⤵
  PID:3356
- C:\Windows\System\rpvlMgH.exe
  C:\Windows\System\rpvlMgH.exe
  2⤵
  PID:3376
- C:\Windows\System\FwIFJfX.exe
  C:\Windows\System\FwIFJfX.exe
  2⤵
  PID:3404
- C:\Windows\System\qsgsPAL.exe
  C:\Windows\System\qsgsPAL.exe
  2⤵
  PID:3416
- C:\Windows\System\EMyRoGi.exe
  C:\Windows\System\EMyRoGi.exe
  2⤵
  PID:3424
- C:\Windows\System\YdpCvlP.exe
  C:\Windows\System\YdpCvlP.exe
  2⤵
  PID:3456
- C:\Windows\System\idewzKZ.exe
  C:\Windows\System\idewzKZ.exe
  2⤵
  PID:3496
- C:\Windows\System\EBefBEC.exe
  C:\Windows\System\EBefBEC.exe
  2⤵
  PID:3532
- C:\Windows\System\PrHGcmR.exe
  C:\Windows\System\PrHGcmR.exe
  2⤵
  PID:3564
- C:\Windows\System\lNMkoPV.exe
  C:\Windows\System\lNMkoPV.exe
  2⤵
  PID:3624
- C:\Windows\System\aydVyqB.exe
  C:\Windows\System\aydVyqB.exe
  2⤵
  PID:3688
- C:\Windows\System\bmKLTxq.exe
  C:\Windows\System\bmKLTxq.exe
  2⤵
  PID:3480
- C:\Windows\System\UiSXNtP.exe
  C:\Windows\System\UiSXNtP.exe
  2⤵
  PID:3788
- C:\Windows\System\lnjGOpf.exe
  C:\Windows\System\lnjGOpf.exe
  2⤵
  PID:3820
- C:\Windows\System\zzKbLnl.exe
  C:\Windows\System\zzKbLnl.exe
  2⤵
  PID:3852
- C:\Windows\System\GYLbIzD.exe
  C:\Windows\System\GYLbIzD.exe
  2⤵
  PID:3832
- C:\Windows\System\tBJPxlX.exe
  C:\Windows\System\tBJPxlX.exe
  2⤵
  PID:3708
- C:\Windows\System\SUIkCag.exe
  C:\Windows\System\SUIkCag.exe
  2⤵
  PID:3644
- C:\Windows\System\RLvUSdl.exe
  C:\Windows\System\RLvUSdl.exe
  2⤵
  PID:3872
- C:\Windows\System\vzvRIhD.exe
  C:\Windows\System\vzvRIhD.exe
  2⤵
  PID:3736
- C:\Windows\System\pCyxDSw.exe
  C:\Windows\System\pCyxDSw.exe
  2⤵
  PID:3888
- C:\Windows\System\dXkuTbu.exe
  C:\Windows\System\dXkuTbu.exe
  2⤵
  PID:3928
- C:\Windows\System\YgYfNtG.exe
  C:\Windows\System\YgYfNtG.exe
  2⤵
  PID:3936
- C:\Windows\System\OMTeUro.exe
  C:\Windows\System\OMTeUro.exe
  2⤵
  PID:3952
- C:\Windows\System\ElpdnJN.exe
  C:\Windows\System\ElpdnJN.exe
  2⤵
  PID:3996
- C:\Windows\System\jJHnDCk.exe
  C:\Windows\System\jJHnDCk.exe
  2⤵
  PID:4032
- C:\Windows\System\GXOyPMf.exe
  C:\Windows\System\GXOyPMf.exe
  2⤵
  PID:4012
- C:\Windows\System\bfgDRsE.exe
  C:\Windows\System\bfgDRsE.exe
  2⤵
  PID:4076
- C:\Windows\System\YrByfTP.exe
  C:\Windows\System\YrByfTP.exe
  2⤵
  PID:3100
- C:\Windows\System\STlMgIh.exe
  C:\Windows\System\STlMgIh.exe
  2⤵
  PID:3296
- C:\Windows\System\xTdUnlc.exe
  C:\Windows\System\xTdUnlc.exe
  2⤵
  PID:3352
- C:\Windows\System\EDSXlif.exe
  C:\Windows\System\EDSXlif.exe
  2⤵
  PID:3368
- C:\Windows\System\EgDPXQy.exe
  C:\Windows\System\EgDPXQy.exe
  2⤵
  PID:3288
- C:\Windows\System\VzLyGrX.exe
  C:\Windows\System\VzLyGrX.exe
  2⤵
  PID:3380
- C:\Windows\System\FpTyalS.exe
  C:\Windows\System\FpTyalS.exe
  2⤵
  PID:3464
- C:\Windows\System\DXRvJJS.exe
  C:\Windows\System\DXRvJJS.exe
  2⤵
  PID:3400
- C:\Windows\System\eRVcsSU.exe
  C:\Windows\System\eRVcsSU.exe
  2⤵
  PID:3660
- C:\Windows\System\qEenwil.exe
  C:\Windows\System\qEenwil.exe
  2⤵
  PID:3524
- C:\Windows\System\sObUYyN.exe
  C:\Windows\System\sObUYyN.exe
  2⤵
  PID:3452
- C:\Windows\System\CksmMmY.exe
  C:\Windows\System\CksmMmY.exe
  2⤵
  PID:3724
- C:\Windows\System\bIZFlKL.exe
  C:\Windows\System\bIZFlKL.exe
  2⤵
  PID:3740
- C:\Windows\System\BZzPVyk.exe
  C:\Windows\System\BZzPVyk.exe
  2⤵
  PID:3608
- C:\Windows\System\pDUfgpT.exe
  C:\Windows\System\pDUfgpT.exe
  2⤵
  PID:3880
- C:\Windows\System\gLLXvow.exe
  C:\Windows\System\gLLXvow.exe
  2⤵
  PID:3836
- C:\Windows\System\pDREswo.exe
  C:\Windows\System\pDREswo.exe
  2⤵
  PID:3960
- C:\Windows\System\yTHimSL.exe
  C:\Windows\System\yTHimSL.exe
  2⤵
  PID:3948
- C:\Windows\System\bMxmuyg.exe
  C:\Windows\System\bMxmuyg.exe
  2⤵
  PID:4016
- C:\Windows\System\LNMAWYZ.exe
  C:\Windows\System\LNMAWYZ.exe
  2⤵
  PID:3148
- C:\Windows\System\ZOmQJdo.exe
  C:\Windows\System\ZOmQJdo.exe
  2⤵
  PID:3200
- C:\Windows\System\rUVVwOX.exe
  C:\Windows\System\rUVVwOX.exe
  2⤵
  PID:3304
- C:\Windows\System\MFJiIpb.exe
  C:\Windows\System\MFJiIpb.exe
  2⤵
  PID:3372
- C:\Windows\System\JwurElK.exe
  C:\Windows\System\JwurElK.exe
  2⤵
  PID:2308
- C:\Windows\System\aCvozlO.exe
  C:\Windows\System\aCvozlO.exe
  2⤵
  PID:3856
- C:\Windows\System\OVApZbK.exe
  C:\Windows\System\OVApZbK.exe
  2⤵
  PID:3876
- C:\Windows\System\NLJSVzq.exe
  C:\Windows\System\NLJSVzq.exe
  2⤵
  PID:3672
- C:\Windows\System\LLKXHgu.exe
  C:\Windows\System\LLKXHgu.exe
  2⤵
  PID:3924
- C:\Windows\System\cgbhBfC.exe
  C:\Windows\System\cgbhBfC.exe
  2⤵
  PID:4028
- C:\Windows\System\sDJSGrd.exe
  C:\Windows\System\sDJSGrd.exe
  2⤵
  PID:2812
- C:\Windows\System\fCnhwFn.exe
  C:\Windows\System\fCnhwFn.exe
  2⤵
  PID:2204
- C:\Windows\System\OeWkoGL.exe
  C:\Windows\System\OeWkoGL.exe
  2⤵
  PID:3164
- C:\Windows\System\KizLocJ.exe
  C:\Windows\System\KizLocJ.exe
  2⤵
  PID:3216
- C:\Windows\System\LVVshXc.exe
  C:\Windows\System\LVVshXc.exe
  2⤵
  PID:3348
- C:\Windows\System\IgQZJfD.exe
  C:\Windows\System\IgQZJfD.exe
  2⤵
  PID:3784
- C:\Windows\System\PJuvnFg.exe
  C:\Windows\System\PJuvnFg.exe
  2⤵
  PID:3336
- C:\Windows\System\bgbuPjq.exe
  C:\Windows\System\bgbuPjq.exe
  2⤵
  PID:3932
- C:\Windows\System\hpKaQqi.exe
  C:\Windows\System\hpKaQqi.exe
  2⤵
  PID:3596
- C:\Windows\System\dWynpkc.exe
  C:\Windows\System\dWynpkc.exe
  2⤵
  PID:3180
- C:\Windows\System\hJcNBqN.exe
  C:\Windows\System\hJcNBqN.exe
  2⤵
  PID:3472
- C:\Windows\System\RSeCvzC.exe
  C:\Windows\System\RSeCvzC.exe
  2⤵
  PID:3900
- C:\Windows\System\brWxDmY.exe
  C:\Windows\System\brWxDmY.exe
  2⤵
  PID:2016
- C:\Windows\System\orKGsDF.exe
  C:\Windows\System\orKGsDF.exe
  2⤵
  PID:3316
- C:\Windows\System\KpHveiy.exe
  C:\Windows\System\KpHveiy.exe
  2⤵
  PID:4100
- C:\Windows\System\xsJpWdu.exe
  C:\Windows\System\xsJpWdu.exe
  2⤵
  PID:4116
- C:\Windows\System\MqJyzeg.exe
  C:\Windows\System\MqJyzeg.exe
  2⤵
  PID:4132
- C:\Windows\System\AlQlFAy.exe
  C:\Windows\System\AlQlFAy.exe
  2⤵
  PID:4148
- C:\Windows\System\DGGVhWb.exe
  C:\Windows\System\DGGVhWb.exe
  2⤵
  PID:4164
- C:\Windows\System\avCbOlX.exe
  C:\Windows\System\avCbOlX.exe
  2⤵
  PID:4180
- C:\Windows\System\IvXwkAf.exe
  C:\Windows\System\IvXwkAf.exe
  2⤵
  PID:4196
- C:\Windows\System\etCZhBx.exe
  C:\Windows\System\etCZhBx.exe
  2⤵
  PID:4212
- C:\Windows\System\TTQWdbt.exe
  C:\Windows\System\TTQWdbt.exe
  2⤵
  PID:4232
- C:\Windows\System\jQpRIyB.exe
  C:\Windows\System\jQpRIyB.exe
  2⤵
  PID:4248
- C:\Windows\System\nhORMcM.exe
  C:\Windows\System\nhORMcM.exe
  2⤵
  PID:4264
- C:\Windows\System\OBvuecN.exe
  C:\Windows\System\OBvuecN.exe
  2⤵
  PID:4284
- C:\Windows\System\ZLvZgza.exe
  C:\Windows\System\ZLvZgza.exe
  2⤵
  PID:4300
- C:\Windows\System\GzfQhiL.exe
  C:\Windows\System\GzfQhiL.exe
  2⤵
  PID:4316
- C:\Windows\System\ARGgyMW.exe
  C:\Windows\System\ARGgyMW.exe
  2⤵
  PID:4332
- C:\Windows\System\VDeBKLs.exe
  C:\Windows\System\VDeBKLs.exe
  2⤵
  PID:4348
- C:\Windows\System\PlsnfPF.exe
  C:\Windows\System\PlsnfPF.exe
  2⤵
  PID:4368
- C:\Windows\System\MIhYttF.exe
  C:\Windows\System\MIhYttF.exe
  2⤵
  PID:4400
- C:\Windows\System\xYLOcPa.exe
  C:\Windows\System\xYLOcPa.exe
  2⤵
  PID:4416
- C:\Windows\System\mETPvlQ.exe
  C:\Windows\System\mETPvlQ.exe
  2⤵
  PID:4432
- C:\Windows\System\GJeyPAe.exe
  C:\Windows\System\GJeyPAe.exe
  2⤵
  PID:4448
- C:\Windows\System\tupDKxd.exe
  C:\Windows\System\tupDKxd.exe
  2⤵
  PID:4464
- C:\Windows\System\vEfeOdR.exe
  C:\Windows\System\vEfeOdR.exe
  2⤵
  PID:4480
- C:\Windows\System\bfRfzUm.exe
  C:\Windows\System\bfRfzUm.exe
  2⤵
  PID:4500
- C:\Windows\System\cqVRQEm.exe
  C:\Windows\System\cqVRQEm.exe
  2⤵
  PID:4516
- C:\Windows\System\qCDIZFn.exe
  C:\Windows\System\qCDIZFn.exe
  2⤵
  PID:4536
- C:\Windows\System\GjmJGxq.exe
  C:\Windows\System\GjmJGxq.exe
  2⤵
  PID:4552
- C:\Windows\System\RSqiXbI.exe
  C:\Windows\System\RSqiXbI.exe
  2⤵
  PID:4572
- C:\Windows\System\GAazNAG.exe
  C:\Windows\System\GAazNAG.exe
  2⤵
  PID:4588
- C:\Windows\System\eDVrufN.exe
  C:\Windows\System\eDVrufN.exe
  2⤵
  PID:4612
- C:\Windows\System\fpOCoOe.exe
  C:\Windows\System\fpOCoOe.exe
  2⤵
  PID:4628
- C:\Windows\System\ewenEzC.exe
  C:\Windows\System\ewenEzC.exe
  2⤵
  PID:4684
- C:\Windows\System\SszJkRy.exe
  C:\Windows\System\SszJkRy.exe
  2⤵
  PID:4728
- C:\Windows\System\uyEOYHl.exe
  C:\Windows\System\uyEOYHl.exe
  2⤵
  PID:4744
- C:\Windows\System\RXNMBXu.exe
  C:\Windows\System\RXNMBXu.exe
  2⤵
  PID:4764
- C:\Windows\System\dUpzGeo.exe
  C:\Windows\System\dUpzGeo.exe
  2⤵
  PID:4780
- C:\Windows\System\KpBVEop.exe
  C:\Windows\System\KpBVEop.exe
  2⤵
  PID:4796
- C:\Windows\System\ghwfPZm.exe
  C:\Windows\System\ghwfPZm.exe
  2⤵
  PID:4812
- C:\Windows\System\abvCxGp.exe
  C:\Windows\System\abvCxGp.exe
  2⤵
  PID:4828
- C:\Windows\System\LnyLBpS.exe
  C:\Windows\System\LnyLBpS.exe
  2⤵
  PID:4844
- C:\Windows\System\LaDEnxX.exe
  C:\Windows\System\LaDEnxX.exe
  2⤵
  PID:4860
- C:\Windows\System\GaFqTwG.exe
  C:\Windows\System\GaFqTwG.exe
  2⤵
  PID:4876
- C:\Windows\System\CQWPBZg.exe
  C:\Windows\System\CQWPBZg.exe
  2⤵
  PID:4896
- C:\Windows\System\lLWeFIV.exe
  C:\Windows\System\lLWeFIV.exe
  2⤵
  PID:4912
- C:\Windows\System\zsOlpTj.exe
  C:\Windows\System\zsOlpTj.exe
  2⤵
  PID:4928
- C:\Windows\System\SKbtAJC.exe
  C:\Windows\System\SKbtAJC.exe
  2⤵
  PID:4944
- C:\Windows\System\TqYfXzm.exe
  C:\Windows\System\TqYfXzm.exe
  2⤵
  PID:4960
- C:\Windows\System\lpHVGJE.exe
  C:\Windows\System\lpHVGJE.exe
  2⤵
  PID:4976
- C:\Windows\System\ahdqxCq.exe
  C:\Windows\System\ahdqxCq.exe
  2⤵
  PID:4992
- C:\Windows\System\sLrrcxQ.exe
  C:\Windows\System\sLrrcxQ.exe
  2⤵
  PID:4176
- C:\Windows\System\QvKYVap.exe
  C:\Windows\System\QvKYVap.exe
  2⤵
  PID:4244
- C:\Windows\System\VofOEFc.exe
  C:\Windows\System\VofOEFc.exe
  2⤵
  PID:4128
- C:\Windows\System\vujMesE.exe
  C:\Windows\System\vujMesE.exe
  2⤵
  PID:4260
- C:\Windows\System\MJRuoLK.exe
  C:\Windows\System\MJRuoLK.exe
  2⤵
  PID:4324
- C:\Windows\System\cJrJAIu.exe
  C:\Windows\System\cJrJAIu.exe
  2⤵
  PID:4488
- C:\Windows\System\TFtTnIc.exe
  C:\Windows\System\TFtTnIc.exe
  2⤵
  PID:4508
- C:\Windows\System\yzRmJaw.exe
  C:\Windows\System\yzRmJaw.exe
  2⤵
  PID:4560
- C:\Windows\System\csOjQvq.exe
  C:\Windows\System\csOjQvq.exe
  2⤵
  PID:4544
- C:\Windows\System\hrUWlPe.exe
  C:\Windows\System\hrUWlPe.exe
  2⤵
  PID:4620
- C:\Windows\System\RLKIkeg.exe
  C:\Windows\System\RLKIkeg.exe
  2⤵
  PID:4716
- C:\Windows\System\AedwCOS.exe
  C:\Windows\System\AedwCOS.exe
  2⤵
  PID:4936
- C:\Windows\System\EKdPKoj.exe
  C:\Windows\System\EKdPKoj.exe
  2⤵
  PID:4972
- C:\Windows\System\CpoQCxV.exe
  C:\Windows\System\CpoQCxV.exe
  2⤵
  PID:5000
- C:\Windows\System\NoNbkEv.exe
  C:\Windows\System\NoNbkEv.exe
  2⤵
  PID:5024
- C:\Windows\System\WGjVgbS.exe
  C:\Windows\System\WGjVgbS.exe
  2⤵
  PID:5044
- C:\Windows\System\gaUNiKG.exe
  C:\Windows\System\gaUNiKG.exe
  2⤵
  PID:5060
- C:\Windows\System\RVILtdB.exe
  C:\Windows\System\RVILtdB.exe
  2⤵
  PID:5080
- C:\Windows\System\HsEiHwB.exe
  C:\Windows\System\HsEiHwB.exe
  2⤵
  PID:5096
- C:\Windows\System\omgMdpw.exe
  C:\Windows\System\omgMdpw.exe
  2⤵
  PID:5112
- C:\Windows\System\SJSNnNh.exe
  C:\Windows\System\SJSNnNh.exe
  2⤵
  PID:3804
- C:\Windows\System\ovELRIu.exe
  C:\Windows\System\ovELRIu.exe
  2⤵
  PID:4112
- C:\Windows\System\SZhtCha.exe
  C:\Windows\System\SZhtCha.exe
  2⤵
  PID:4240
- C:\Windows\System\eLraPks.exe
  C:\Windows\System\eLraPks.exe
  2⤵
  PID:780
- C:\Windows\System\qSiTRcq.exe
  C:\Windows\System\qSiTRcq.exe
  2⤵
  PID:4256
- C:\Windows\System\SQPpJLN.exe
  C:\Windows\System\SQPpJLN.exe
  2⤵
  PID:4356
- C:\Windows\System\TfAXggl.exe
  C:\Windows\System\TfAXggl.exe
  2⤵
  PID:4312
- C:\Windows\System\ErfaTWB.exe
  C:\Windows\System\ErfaTWB.exe
  2⤵
  PID:4380
- C:\Windows\System\GuPmSiM.exe
  C:\Windows\System\GuPmSiM.exe
  2⤵
  PID:4384
- C:\Windows\System\XPgmrzC.exe
  C:\Windows\System\XPgmrzC.exe
  2⤵
  PID:4460
- C:\Windows\System\cAwmoMz.exe
  C:\Windows\System\cAwmoMz.exe
  2⤵
  PID:4472
- C:\Windows\System\HAgSfWg.exe
  C:\Windows\System\HAgSfWg.exe
  2⤵
  PID:4456
- C:\Windows\System\YuBcVMN.exe
  C:\Windows\System\YuBcVMN.exe
  2⤵
  PID:4528
- C:\Windows\System\WIyDYMA.exe
  C:\Windows\System\WIyDYMA.exe
  2⤵
  PID:4600
- C:\Windows\System\PAKkWfl.exe
  C:\Windows\System\PAKkWfl.exe
  2⤵
  PID:4648
- C:\Windows\System\JTWSMRr.exe
  C:\Windows\System\JTWSMRr.exe
  2⤵
  PID:4644
- C:\Windows\System\xmJGoDF.exe
  C:\Windows\System\xmJGoDF.exe
  2⤵
  PID:4692
- C:\Windows\System\fBxpOTf.exe
  C:\Windows\System\fBxpOTf.exe
  2⤵
  PID:4700
- C:\Windows\System\DpHAWil.exe
  C:\Windows\System\DpHAWil.exe
  2⤵
  PID:4736
- C:\Windows\System\ujDBPdi.exe
  C:\Windows\System\ujDBPdi.exe
  2⤵
  PID:4756
- C:\Windows\System\VsNlhgv.exe
  C:\Windows\System\VsNlhgv.exe
  2⤵
  PID:4804
- C:\Windows\System\toTSTyK.exe
  C:\Windows\System\toTSTyK.exe
  2⤵
  PID:4836
- C:\Windows\System\VzXKDei.exe
  C:\Windows\System\VzXKDei.exe
  2⤵
  PID:5056
- C:\Windows\System\WtAgnRl.exe
  C:\Windows\System\WtAgnRl.exe
  2⤵
  PID:5104
- C:\Windows\System\oCflhcH.exe
  C:\Windows\System\oCflhcH.exe
  2⤵
  PID:4548
- C:\Windows\System\cYWVprG.exe
  C:\Windows\System\cYWVprG.exe
  2⤵
  PID:4156
- C:\Windows\System\tPBqUAc.exe
  C:\Windows\System\tPBqUAc.exe
  2⤵
  PID:4296
- C:\Windows\System\fXwTXgV.exe
  C:\Windows\System\fXwTXgV.exe
  2⤵
  PID:4788
- C:\Windows\System\YbrxdhD.exe
  C:\Windows\System\YbrxdhD.exe
  2⤵
  PID:4160
- C:\Windows\System\TXmIGHd.exe
  C:\Windows\System\TXmIGHd.exe
  2⤵
  PID:4604
- C:\Windows\System\yEgMLAX.exe
  C:\Windows\System\yEgMLAX.exe
  2⤵
  PID:4696
- C:\Windows\System\pOFhHyF.exe
  C:\Windows\System\pOFhHyF.exe
  2⤵
  PID:4760
- C:\Windows\System\IUVplre.exe
  C:\Windows\System\IUVplre.exe
  2⤵
  PID:4840
- C:\Windows\System\ZjNfjrt.exe
  C:\Windows\System\ZjNfjrt.exe
  2⤵
  PID:5008
- C:\Windows\System\coLHFXW.exe
  C:\Windows\System\coLHFXW.exe
  2⤵
  PID:5052
- C:\Windows\System\ZtqCWBf.exe
  C:\Windows\System\ZtqCWBf.exe
  2⤵
  PID:4884
- C:\Windows\System\aqAoDhD.exe
  C:\Windows\System\aqAoDhD.exe
  2⤵
  PID:4920
- C:\Windows\System\YlbMXPx.exe
  C:\Windows\System\YlbMXPx.exe
  2⤵
  PID:3768
- C:\Windows\System\ONUywFW.exe
  C:\Windows\System\ONUywFW.exe
  2⤵
  PID:4108
- C:\Windows\System\yknspLs.exe
  C:\Windows\System\yknspLs.exe
  2⤵
  PID:4224
- C:\Windows\System\VDKsuAb.exe
  C:\Windows\System\VDKsuAb.exe
  2⤵
  PID:4640
- C:\Windows\System\oBGKfVh.exe
  C:\Windows\System\oBGKfVh.exe
  2⤵
  PID:5108
- C:\Windows\System\vtZPHKk.exe
  C:\Windows\System\vtZPHKk.exe
  2⤵
  PID:4440
- C:\Windows\System\jUyBXHQ.exe
  C:\Windows\System\jUyBXHQ.exe
  2⤵
  PID:4656
- C:\Windows\System\UNUJQAt.exe
  C:\Windows\System\UNUJQAt.exe
  2⤵
  PID:4968
- C:\Windows\System\BAfgPRq.exe
  C:\Windows\System\BAfgPRq.exe
  2⤵
  PID:5032
- C:\Windows\System\ETokxCM.exe
  C:\Windows\System\ETokxCM.exe
  2⤵
  PID:5040
- C:\Windows\System\gZNQtMl.exe
  C:\Windows\System\gZNQtMl.exe
  2⤵
  PID:4172
- C:\Windows\System\ICXRtfI.exe
  C:\Windows\System\ICXRtfI.exe
  2⤵
  PID:4292
- C:\Windows\System\VqiSJzC.exe
  C:\Windows\System\VqiSJzC.exe
  2⤵
  PID:4340
- C:\Windows\System\cPmzcwy.exe
  C:\Windows\System\cPmzcwy.exe
  2⤵
  PID:4724
- C:\Windows\System\jOKQJYV.exe
  C:\Windows\System\jOKQJYV.exe
  2⤵
  PID:4984
- C:\Windows\System\sMqdbIi.exe
  C:\Windows\System\sMqdbIi.exe
  2⤵
  PID:4388
- C:\Windows\System\DnBBJoT.exe
  C:\Windows\System\DnBBJoT.exe
  2⤵
  PID:4672
- C:\Windows\System\mobPAqD.exe
  C:\Windows\System\mobPAqD.exe
  2⤵
  PID:5140
- C:\Windows\System\HfHDtAe.exe
  C:\Windows\System\HfHDtAe.exe
  2⤵
  PID:5160
- C:\Windows\System\NYrthIK.exe
  C:\Windows\System\NYrthIK.exe
  2⤵
  PID:5176
- C:\Windows\System\tbkgfBp.exe
  C:\Windows\System\tbkgfBp.exe
  2⤵
  PID:5192
- C:\Windows\System\feqHUIt.exe
  C:\Windows\System\feqHUIt.exe
  2⤵
  PID:5208
- C:\Windows\System\ZhyGiEw.exe
  C:\Windows\System\ZhyGiEw.exe
  2⤵
  PID:5228
- C:\Windows\System\TzBVsxh.exe
  C:\Windows\System\TzBVsxh.exe
  2⤵
  PID:5248
- C:\Windows\System\cSmaYrq.exe
  C:\Windows\System\cSmaYrq.exe
  2⤵
  PID:5284
- C:\Windows\System\hKWDjaA.exe
  C:\Windows\System\hKWDjaA.exe
  2⤵
  PID:5320
- C:\Windows\System\xBWLnhv.exe
  C:\Windows\System\xBWLnhv.exe
  2⤵
  PID:5336
- C:\Windows\System\LRBiPcf.exe
  C:\Windows\System\LRBiPcf.exe
  2⤵
  PID:5352
- C:\Windows\System\zSjGIrI.exe
  C:\Windows\System\zSjGIrI.exe
  2⤵
  PID:5372
- C:\Windows\System\xrvdwyw.exe
  C:\Windows\System\xrvdwyw.exe
  2⤵
  PID:5408
- C:\Windows\System\MpRauoA.exe
  C:\Windows\System\MpRauoA.exe
  2⤵
  PID:5424
- C:\Windows\System\UYYShMT.exe
  C:\Windows\System\UYYShMT.exe
  2⤵
  PID:5444
- C:\Windows\System\uMjsOJg.exe
  C:\Windows\System\uMjsOJg.exe
  2⤵
  PID:5464
- C:\Windows\System\wdiCIVQ.exe
  C:\Windows\System\wdiCIVQ.exe
  2⤵
  PID:5480
- C:\Windows\System\OnRjTTf.exe
  C:\Windows\System\OnRjTTf.exe
  2⤵
  PID:5496
- C:\Windows\System\IWGTppp.exe
  C:\Windows\System\IWGTppp.exe
  2⤵
  PID:5516
- C:\Windows\System\eVwZXkw.exe
  C:\Windows\System\eVwZXkw.exe
  2⤵
  PID:5532
- C:\Windows\System\xuBNtGL.exe
  C:\Windows\System\xuBNtGL.exe
  2⤵
  PID:5552
- C:\Windows\System\ZJLrPxI.exe
  C:\Windows\System\ZJLrPxI.exe
  2⤵
  PID:5568
- C:\Windows\System\EcDtOow.exe
  C:\Windows\System\EcDtOow.exe
  2⤵
  PID:5588
- C:\Windows\System\VCwzlkg.exe
  C:\Windows\System\VCwzlkg.exe
  2⤵
  PID:5604
- C:\Windows\System\roRLOHZ.exe
  C:\Windows\System\roRLOHZ.exe
  2⤵
  PID:5624
- C:\Windows\System\wwyLWQH.exe
  C:\Windows\System\wwyLWQH.exe
  2⤵
  PID:5640
- C:\Windows\System\SLTnHPJ.exe
  C:\Windows\System\SLTnHPJ.exe
  2⤵
  PID:5668
- C:\Windows\System\QpdktCN.exe
  C:\Windows\System\QpdktCN.exe
  2⤵
  PID:5688
- C:\Windows\System\BEdgOle.exe
  C:\Windows\System\BEdgOle.exe
  2⤵
  PID:5708
- C:\Windows\System\qNkYOOb.exe
  C:\Windows\System\qNkYOOb.exe
  2⤵
  PID:5724
- C:\Windows\System\jSrXCQK.exe
  C:\Windows\System\jSrXCQK.exe
  2⤵
  PID:5744
- C:\Windows\System\WqImvbE.exe
  C:\Windows\System\WqImvbE.exe
  2⤵
  PID:5760
- C:\Windows\System\uwcjgzn.exe
  C:\Windows\System\uwcjgzn.exe
  2⤵
  PID:5784
- C:\Windows\System\dRPJrvP.exe
  C:\Windows\System\dRPJrvP.exe
  2⤵
  PID:5804
- C:\Windows\System\oyRVNgi.exe
  C:\Windows\System\oyRVNgi.exe
  2⤵
  PID:5824
- C:\Windows\System\dIVppuu.exe
  C:\Windows\System\dIVppuu.exe
  2⤵
  PID:5840
- C:\Windows\System\Hoyztov.exe
  C:\Windows\System\Hoyztov.exe
  2⤵
  PID:5860
- C:\Windows\System\zehHfDe.exe
  C:\Windows\System\zehHfDe.exe
  2⤵
  PID:5876
- C:\Windows\System\nMIjccY.exe
  C:\Windows\System\nMIjccY.exe
  2⤵
  PID:5900
- C:\Windows\System\ItynXbB.exe
  C:\Windows\System\ItynXbB.exe
  2⤵
  PID:5916
- C:\Windows\System\SUoyGhh.exe
  C:\Windows\System\SUoyGhh.exe
  2⤵
  PID:5936
- C:\Windows\System\srWkoxk.exe
  C:\Windows\System\srWkoxk.exe
  2⤵
  PID:5952
- C:\Windows\System\jFVpsAb.exe
  C:\Windows\System\jFVpsAb.exe
  2⤵
  PID:5972
- C:\Windows\System\NKEAryx.exe
  C:\Windows\System\NKEAryx.exe
  2⤵
  PID:6036
- C:\Windows\System\MXWuEJf.exe
  C:\Windows\System\MXWuEJf.exe
  2⤵
  PID:6056
- C:\Windows\System\KCMfsZM.exe
  C:\Windows\System\KCMfsZM.exe
  2⤵
  PID:6072
- C:\Windows\System\feZvuYa.exe
  C:\Windows\System\feZvuYa.exe
  2⤵
  PID:6088
- C:\Windows\System\MIeEIZw.exe
  C:\Windows\System\MIeEIZw.exe
  2⤵
  PID:6104
- C:\Windows\System\QHzfJDj.exe
  C:\Windows\System\QHzfJDj.exe
  2⤵
  PID:6128
- C:\Windows\System\YUFoSlc.exe
  C:\Windows\System\YUFoSlc.exe
  2⤵
  PID:4188
- C:\Windows\System\WSdqxXe.exe
  C:\Windows\System\WSdqxXe.exe
  2⤵
  PID:5168
- C:\Windows\System\pFMdxAL.exe
  C:\Windows\System\pFMdxAL.exe
  2⤵
  PID:5236
- C:\Windows\System\nOFYtDQ.exe
  C:\Windows\System\nOFYtDQ.exe
  2⤵
  PID:5156
- C:\Windows\System\CWqtVbi.exe
  C:\Windows\System\CWqtVbi.exe
  2⤵
  PID:5256
- C:\Windows\System\YPaEjdO.exe
  C:\Windows\System\YPaEjdO.exe
  2⤵
  PID:4988
- C:\Windows\System\xXTIuPh.exe
  C:\Windows\System\xXTIuPh.exe
  2⤵
  PID:5296
- C:\Windows\System\WsWjNIz.exe
  C:\Windows\System\WsWjNIz.exe
  2⤵
  PID:5312
- C:\Windows\System\ZEsBTBd.exe
  C:\Windows\System\ZEsBTBd.exe
  2⤵
  PID:5388
- C:\Windows\System\qtTFCNg.exe
  C:\Windows\System\qtTFCNg.exe
  2⤵
  PID:5396
- C:\Windows\System\hKKUJwN.exe
  C:\Windows\System\hKKUJwN.exe
  2⤵
  PID:5432
- C:\Windows\System\LDNuOQF.exe
  C:\Windows\System\LDNuOQF.exe
  2⤵
  PID:5476
- C:\Windows\System\GEXAEwK.exe
  C:\Windows\System\GEXAEwK.exe
  2⤵
  PID:5544
- C:\Windows\System\dHjnovZ.exe
  C:\Windows\System\dHjnovZ.exe
  2⤵
  PID:5452
- C:\Windows\System\bJZmWhJ.exe
  C:\Windows\System\bJZmWhJ.exe
  2⤵
  PID:5332
- C:\Windows\System\yEuivAB.exe
  C:\Windows\System\yEuivAB.exe
  2⤵
  PID:5664
- C:\Windows\System\vXjTqPq.exe
  C:\Windows\System\vXjTqPq.exe
  2⤵
  PID:5732
- C:\Windows\System\JIFXIcm.exe
  C:\Windows\System\JIFXIcm.exe
  2⤵
  PID:5772
- C:\Windows\System\sohdSTU.exe
  C:\Windows\System\sohdSTU.exe
  2⤵
  PID:5816
- C:\Windows\System\wlotBYZ.exe
  C:\Windows\System\wlotBYZ.exe
  2⤵
  PID:5856
- C:\Windows\System\laxOYtL.exe
  C:\Windows\System\laxOYtL.exe
  2⤵
  PID:5896
- C:\Windows\System\qPiCJmz.exe
  C:\Windows\System\qPiCJmz.exe
  2⤵
  PID:5960
- C:\Windows\System\iMQADBE.exe
  C:\Windows\System\iMQADBE.exe
  2⤵
  PID:5488
- C:\Windows\System\YDohRBe.exe
  C:\Windows\System\YDohRBe.exe
  2⤵
  PID:5528
- C:\Windows\System\rEdLXvy.exe
  C:\Windows\System\rEdLXvy.exe
  2⤵
  PID:5996
- C:\Windows\System\HfTCsSb.exe
  C:\Windows\System\HfTCsSb.exe
  2⤵
  PID:5720
- C:\Windows\System\zpquQaZ.exe
  C:\Windows\System\zpquQaZ.exe
  2⤵
  PID:5800
- C:\Windows\System\hPoGOyD.exe
  C:\Windows\System\hPoGOyD.exe
  2⤵
  PID:5984
- C:\Windows\System\IljUcUF.exe
  C:\Windows\System\IljUcUF.exe
  2⤵
  PID:6000
- C:\Windows\System\PxbJaNi.exe
  C:\Windows\System\PxbJaNi.exe
  2⤵
  PID:5868
- C:\Windows\System\pamlsjL.exe
  C:\Windows\System\pamlsjL.exe
  2⤵
  PID:6024
- C:\Windows\System\lGeNawy.exe
  C:\Windows\System\lGeNawy.exe
  2⤵
  PID:6084
- C:\Windows\System\sSIlWNw.exe
  C:\Windows\System\sSIlWNw.exe
  2⤵
  PID:5128
- C:\Windows\System\kcQSrUo.exe
  C:\Windows\System\kcQSrUo.exe
  2⤵
  PID:5136
- C:\Windows\System\xmRhouq.exe
  C:\Windows\System\xmRhouq.exe
  2⤵
  PID:6100
- C:\Windows\System\EyNTLik.exe
  C:\Windows\System\EyNTLik.exe
  2⤵
  PID:4772
- C:\Windows\System\NHBXjDl.exe
  C:\Windows\System\NHBXjDl.exe
  2⤵
  PID:5152
- C:\Windows\System\UyOiSqy.exe
  C:\Windows\System\UyOiSqy.exe
  2⤵
  PID:5308
- C:\Windows\System\GGOaCcd.exe
  C:\Windows\System\GGOaCcd.exe
  2⤵
  PID:5392
- C:\Windows\System\cIGKNlL.exe
  C:\Windows\System\cIGKNlL.exe
  2⤵
  PID:5616
- C:\Windows\System\gNoMXUW.exe
  C:\Windows\System\gNoMXUW.exe
  2⤵
  PID:5584
- C:\Windows\System\NGZnaUH.exe
  C:\Windows\System\NGZnaUH.exe
  2⤵
  PID:5660
- C:\Windows\System\lJqQFTi.exe
  C:\Windows\System\lJqQFTi.exe
  2⤵
  PID:5768
- C:\Windows\System\dhyKeTX.exe
  C:\Windows\System\dhyKeTX.exe
  2⤵
  PID:5928
- C:\Windows\System\UZYqdnK.exe
  C:\Windows\System\UZYqdnK.exe
  2⤵
  PID:5636
- C:\Windows\System\SHrlGGt.exe
  C:\Windows\System\SHrlGGt.exe
  2⤵
  PID:5792
- C:\Windows\System\qykdggf.exe
  C:\Windows\System\qykdggf.exe
  2⤵
  PID:5776
- C:\Windows\System\eAbIweX.exe
  C:\Windows\System\eAbIweX.exe
  2⤵
  PID:5812
- C:\Windows\System\ghHoRrk.exe
  C:\Windows\System\ghHoRrk.exe
  2⤵
  PID:6068
- C:\Windows\System\PUegUsi.exe
  C:\Windows\System\PUegUsi.exe
  2⤵
  PID:5892
- C:\Windows\System\yrMiTfc.exe
  C:\Windows\System\yrMiTfc.exe
  2⤵
  PID:5220
- C:\Windows\System\OSbiZnw.exe
  C:\Windows\System\OSbiZnw.exe
  2⤵
  PID:5908
- C:\Windows\System\owBqvGb.exe
  C:\Windows\System\owBqvGb.exe
  2⤵
  PID:5508
- C:\Windows\System\iduzalY.exe
  C:\Windows\System\iduzalY.exe
  2⤵
  PID:6120
- C:\Windows\System\CoRsYfG.exe
  C:\Windows\System\CoRsYfG.exe
  2⤵
  PID:5648
- C:\Windows\System\zrlEsvP.exe
  C:\Windows\System\zrlEsvP.exe
  2⤵
  PID:5944
- C:\Windows\System\gwINzOS.exe
  C:\Windows\System\gwINzOS.exe
  2⤵
  PID:5780
- C:\Windows\System\QQdwHIp.exe
  C:\Windows\System\QQdwHIp.exe
  2⤵
  PID:5188
- C:\Windows\System\pJwDpXM.exe
  C:\Windows\System\pJwDpXM.exe
  2⤵
  PID:5992
- C:\Windows\System\tzBfsnZ.exe
  C:\Windows\System\tzBfsnZ.exe
  2⤵
  PID:5948
- C:\Windows\System\ldVqCpN.exe
  C:\Windows\System\ldVqCpN.exe
  2⤵
  PID:5740
- C:\Windows\System\sRPfiEm.exe
  C:\Windows\System\sRPfiEm.exe
  2⤵
  PID:5348
- C:\Windows\System\OVJGimY.exe
  C:\Windows\System\OVJGimY.exe
  2⤵
  PID:5796
- C:\Windows\System\FsrMYzX.exe
  C:\Windows\System\FsrMYzX.exe
  2⤵
  PID:5848
- C:\Windows\System\jnZYWsq.exe
  C:\Windows\System\jnZYWsq.exe
  2⤵
  PID:6016
- C:\Windows\System\FLnWDOd.exe
  C:\Windows\System\FLnWDOd.exe
  2⤵
  PID:5596
- C:\Windows\System\KIXFiRl.exe
  C:\Windows\System\KIXFiRl.exe
  2⤵
  PID:5328
- C:\Windows\System\NkwjvgW.exe
  C:\Windows\System\NkwjvgW.exe
  2⤵
  PID:6096
- C:\Windows\System\fhqBbcW.exe
  C:\Windows\System\fhqBbcW.exe
  2⤵
  PID:5512
- C:\Windows\System\EkOzwjG.exe
  C:\Windows\System\EkOzwjG.exe
  2⤵
  PID:5836
- C:\Windows\System\XQSZZgU.exe
  C:\Windows\System\XQSZZgU.exe
  2⤵
  PID:5756
- C:\Windows\System\ROWyyhJ.exe
  C:\Windows\System\ROWyyhJ.exe
  2⤵
  PID:5888
- C:\Windows\System\TDtrLRg.exe
  C:\Windows\System\TDtrLRg.exe
  2⤵
  PID:5068
- C:\Windows\System\zRCZDYw.exe
  C:\Windows\System\zRCZDYw.exe
  2⤵
  PID:5576
- C:\Windows\System\yOEiOqM.exe
  C:\Windows\System\yOEiOqM.exe
  2⤵
  PID:6148
- C:\Windows\System\klQUIMB.exe
  C:\Windows\System\klQUIMB.exe
  2⤵
  PID:6172
- C:\Windows\System\DDPPjpp.exe
  C:\Windows\System\DDPPjpp.exe
  2⤵
  PID:6192
- C:\Windows\System\WeiyXLu.exe
  C:\Windows\System\WeiyXLu.exe
  2⤵
  PID:6216
- C:\Windows\System\OctumaR.exe
  C:\Windows\System\OctumaR.exe
  2⤵
  PID:6232
- C:\Windows\System\igVtXcT.exe
  C:\Windows\System\igVtXcT.exe
  2⤵
  PID:6252
- C:\Windows\System\OjMvuvc.exe
  C:\Windows\System\OjMvuvc.exe
  2⤵
  PID:6276
- C:\Windows\System\uJFXfkW.exe
  C:\Windows\System\uJFXfkW.exe
  2⤵
  PID:6292
- C:\Windows\System\LNeKLee.exe
  C:\Windows\System\LNeKLee.exe
  2⤵
  PID:6308
- C:\Windows\System\jqwmKny.exe
  C:\Windows\System\jqwmKny.exe
  2⤵
  PID:6332
- C:\Windows\System\YsycSxr.exe
  C:\Windows\System\YsycSxr.exe
  2⤵
  PID:6352
- C:\Windows\System\VotIvoJ.exe
  C:\Windows\System\VotIvoJ.exe
  2⤵
  PID:6380
- C:\Windows\System\tYEkSao.exe
  C:\Windows\System\tYEkSao.exe
  2⤵
  PID:6396
- C:\Windows\System\flgDBGH.exe
  C:\Windows\System\flgDBGH.exe
  2⤵
  PID:6412
- C:\Windows\System\gbmolnn.exe
  C:\Windows\System\gbmolnn.exe
  2⤵
  PID:6428
- C:\Windows\System\VPAAVVj.exe
  C:\Windows\System\VPAAVVj.exe
  2⤵
  PID:6448
- C:\Windows\System\vgPOkcV.exe
  C:\Windows\System\vgPOkcV.exe
  2⤵
  PID:6468
- C:\Windows\System\kcpPYin.exe
  C:\Windows\System\kcpPYin.exe
  2⤵
  PID:6484
- C:\Windows\System\NePVmzw.exe
  C:\Windows\System\NePVmzw.exe
  2⤵
  PID:6508
- C:\Windows\System\uuMlygp.exe
  C:\Windows\System\uuMlygp.exe
  2⤵
  PID:6528
- C:\Windows\System\qBYEGIU.exe
  C:\Windows\System\qBYEGIU.exe
  2⤵
  PID:6544
- C:\Windows\System\PnGdyhk.exe
  C:\Windows\System\PnGdyhk.exe
  2⤵
  PID:6568
- C:\Windows\System\DNAIXtZ.exe
  C:\Windows\System\DNAIXtZ.exe
  2⤵
  PID:6588
- C:\Windows\System\qjxnlqk.exe
  C:\Windows\System\qjxnlqk.exe
  2⤵
  PID:6616
- C:\Windows\System\MjLBIGP.exe
  C:\Windows\System\MjLBIGP.exe
  2⤵
  PID:6640
- C:\Windows\System\ZUEgQnu.exe
  C:\Windows\System\ZUEgQnu.exe
  2⤵
  PID:6660
- C:\Windows\System\ETuSXBX.exe
  C:\Windows\System\ETuSXBX.exe
  2⤵
  PID:6676
- C:\Windows\System\MjWwcRg.exe
  C:\Windows\System\MjWwcRg.exe
  2⤵
  PID:6704
- C:\Windows\System\BwaTzsX.exe
  C:\Windows\System\BwaTzsX.exe
  2⤵
  PID:6720
- C:\Windows\System\VbwhdEN.exe
  C:\Windows\System\VbwhdEN.exe
  2⤵
  PID:6736
- C:\Windows\System\TyfiKmR.exe
  C:\Windows\System\TyfiKmR.exe
  2⤵
  PID:6752
- C:\Windows\System\vvOaRkO.exe
  C:\Windows\System\vvOaRkO.exe
  2⤵
  PID:6772
- C:\Windows\System\acIdwmO.exe
  C:\Windows\System\acIdwmO.exe
  2⤵
  PID:6792
- C:\Windows\System\wXagOwS.exe
  C:\Windows\System\wXagOwS.exe
  2⤵
  PID:6808
- C:\Windows\System\wjrrNPV.exe
  C:\Windows\System\wjrrNPV.exe
  2⤵
  PID:6828
- C:\Windows\System\FAoIkNK.exe
  C:\Windows\System\FAoIkNK.exe
  2⤵
  PID:6848
- C:\Windows\System\XkralQv.exe
  C:\Windows\System\XkralQv.exe
  2⤵
  PID:6864
- C:\Windows\System\HgXmuOG.exe
  C:\Windows\System\HgXmuOG.exe
  2⤵
  PID:6880
- C:\Windows\System\kFpeBkI.exe
  C:\Windows\System\kFpeBkI.exe
  2⤵
  PID:6896
- C:\Windows\System\XoSBLXP.exe
  C:\Windows\System\XoSBLXP.exe
  2⤵
  PID:6920
- C:\Windows\System\TOwAPFK.exe
  C:\Windows\System\TOwAPFK.exe
  2⤵
  PID:6936
- C:\Windows\System\YeuJazp.exe
  C:\Windows\System\YeuJazp.exe
  2⤵
  PID:6952
- C:\Windows\System\EPwnEoh.exe
  C:\Windows\System\EPwnEoh.exe
  2⤵
  PID:7004
- C:\Windows\System\ZZqLpwr.exe
  C:\Windows\System\ZZqLpwr.exe
  2⤵
  PID:7020
- C:\Windows\System\nRvEpfs.exe
  C:\Windows\System\nRvEpfs.exe
  2⤵
  PID:7044
- C:\Windows\System\kTYDbKw.exe
  C:\Windows\System\kTYDbKw.exe
  2⤵
  PID:7060
- C:\Windows\System\PVLmVkr.exe
  C:\Windows\System\PVLmVkr.exe
  2⤵
  PID:7080
- C:\Windows\System\rMIFykY.exe
  C:\Windows\System\rMIFykY.exe
  2⤵
  PID:7096
- C:\Windows\System\VfWRBpt.exe
  C:\Windows\System\VfWRBpt.exe
  2⤵
  PID:7116
- C:\Windows\System\xFbDQNQ.exe
  C:\Windows\System\xFbDQNQ.exe
  2⤵
  PID:7136
- C:\Windows\System\pNtwEwg.exe
  C:\Windows\System\pNtwEwg.exe
  2⤵
  PID:7152
- C:\Windows\System\BUWXdKY.exe
  C:\Windows\System\BUWXdKY.exe
  2⤵
  PID:5404
- C:\Windows\System\evTXoHt.exe
  C:\Windows\System\evTXoHt.exe
  2⤵
  PID:6168
- C:\Windows\System\zBoCFJl.exe
  C:\Windows\System\zBoCFJl.exe
  2⤵
  PID:5368
- C:\Windows\System\tBNRwpI.exe
  C:\Windows\System\tBNRwpI.exe
  2⤵
  PID:6248
- C:\Windows\System\CFPlNoS.exe
  C:\Windows\System\CFPlNoS.exe
  2⤵
  PID:6140
- C:\Windows\System\POoWtMV.exe
  C:\Windows\System\POoWtMV.exe
  2⤵
  PID:6080
- C:\Windows\System\xlLFUch.exe
  C:\Windows\System\xlLFUch.exe
  2⤵
  PID:6136
- C:\Windows\System\PZFPBAG.exe
  C:\Windows\System\PZFPBAG.exe
  2⤵
  PID:6368
- C:\Windows\System\UZqwLEo.exe
  C:\Windows\System\UZqwLEo.exe
  2⤵
  PID:6376
- C:\Windows\System\fWMuQGx.exe
  C:\Windows\System\fWMuQGx.exe
  2⤵
  PID:6344
- C:\Windows\System\EbqCWjn.exe
  C:\Windows\System\EbqCWjn.exe
  2⤵
  PID:6436
- C:\Windows\System\MxWJJdO.exe
  C:\Windows\System\MxWJJdO.exe
  2⤵
  PID:6516
- C:\Windows\System\RKVjYOB.exe
  C:\Windows\System\RKVjYOB.exe
  2⤵
  PID:6556
- C:\Windows\System\nNGhuFB.exe
  C:\Windows\System\nNGhuFB.exe
  2⤵
  PID:6420
- C:\Windows\System\QwJlaYq.exe
  C:\Windows\System\QwJlaYq.exe
  2⤵
  PID:6392
- C:\Windows\System\jXylzBi.exe
  C:\Windows\System\jXylzBi.exe
  2⤵
  PID:6536
- C:\Windows\System\vVFtUqX.exe
  C:\Windows\System\vVFtUqX.exe
  2⤵
  PID:6580
- C:\Windows\System\HcEVbKZ.exe
  C:\Windows\System\HcEVbKZ.exe
  2⤵
  PID:6612
- C:\Windows\System\joFRukP.exe
  C:\Windows\System\joFRukP.exe
  2⤵
  PID:6688
- C:\Windows\System\mnGgHWe.exe
  C:\Windows\System\mnGgHWe.exe
  2⤵
  PID:6636
- C:\Windows\System\GjFGfPQ.exe
  C:\Windows\System\GjFGfPQ.exe
  2⤵
  PID:6728
- C:\Windows\System\ShlASzs.exe
  C:\Windows\System\ShlASzs.exe
  2⤵
  PID:6672
- C:\Windows\System\jhDSmuU.exe
  C:\Windows\System\jhDSmuU.exe
  2⤵
  PID:6800
- C:\Windows\System\BAvtAVM.exe
  C:\Windows\System\BAvtAVM.exe
  2⤵
  PID:6844
- C:\Windows\System\oshiMnW.exe
  C:\Windows\System\oshiMnW.exe
  2⤵
  PID:6748
- C:\Windows\System\rGILRcp.exe
  C:\Windows\System\rGILRcp.exe
  2⤵
  PID:6912
- C:\Windows\System\mNJuIgg.exe
  C:\Windows\System\mNJuIgg.exe
  2⤵
  PID:6948
- C:\Windows\System\lxkGOMc.exe
  C:\Windows\System\lxkGOMc.exe
  2⤵
  PID:6892
- C:\Windows\System\dcMZDDF.exe
  C:\Windows\System\dcMZDDF.exe
  2⤵
  PID:6960
- C:\Windows\System\vGVIVLl.exe
  C:\Windows\System\vGVIVLl.exe
  2⤵
  PID:6980
- C:\Windows\System\JygSGth.exe
  C:\Windows\System\JygSGth.exe
  2⤵
  PID:7000
- C:\Windows\System\JBbchmz.exe
  C:\Windows\System\JBbchmz.exe
  2⤵
  PID:7016
- C:\Windows\System\JTCKzBe.exe
  C:\Windows\System\JTCKzBe.exe
  2⤵
  PID:7092
- C:\Windows\System\BiuywRt.exe
  C:\Windows\System\BiuywRt.exe
  2⤵
  PID:7128
- C:\Windows\System\AkgNZDA.exe
  C:\Windows\System\AkgNZDA.exe
  2⤵
  PID:6284
- C:\Windows\System\ObBjqLk.exe
  C:\Windows\System\ObBjqLk.exe
  2⤵
  PID:7068
- C:\Windows\System\qMxkEAx.exe
  C:\Windows\System\qMxkEAx.exe
  2⤵
  PID:5420
- C:\Windows\System\bTmuVcD.exe
  C:\Windows\System\bTmuVcD.exe
  2⤵
  PID:6328
- C:\Windows\System\lvyPyLm.exe
  C:\Windows\System\lvyPyLm.exe
  2⤵
  PID:6320
- C:\Windows\System\YgXgjvH.exe
  C:\Windows\System\YgXgjvH.exe
  2⤵
  PID:6404
- C:\Windows\System\gsnSFGk.exe
  C:\Windows\System\gsnSFGk.exe
  2⤵
  PID:6156
- C:\Windows\System\uCajQvS.exe
  C:\Windows\System\uCajQvS.exe
  2⤵
  PID:6240
- C:\Windows\System\CZbpYpG.exe
  C:\Windows\System\CZbpYpG.exe
  2⤵
  PID:6496
- C:\Windows\System\SynIryy.exe
  C:\Windows\System\SynIryy.exe
  2⤵
  PID:6696
- C:\Windows\System\XOicVsW.exe
  C:\Windows\System\XOicVsW.exe
  2⤵
  PID:6744
- C:\Windows\System\DIbmMTR.exe
  C:\Windows\System\DIbmMTR.exe
  2⤵
  PID:7056
- C:\Windows\System\sTpfSyu.exe
  C:\Windows\System\sTpfSyu.exe
  2⤵
  PID:5300
- C:\Windows\System\fOOKEPy.exe
  C:\Windows\System\fOOKEPy.exe
  2⤵
  PID:6304
- C:\Windows\System\gRKEBOG.exe
  C:\Windows\System\gRKEBOG.exe
  2⤵
  PID:6464
- C:\Windows\System\DwemecA.exe
  C:\Windows\System\DwemecA.exe
  2⤵
  PID:6124
- C:\Windows\System\rPoQuok.exe
  C:\Windows\System\rPoQuok.exe
  2⤵
  PID:7148
- C:\Windows\System\gYPmsXH.exe
  C:\Windows\System\gYPmsXH.exe
  2⤵
  PID:6204
- C:\Windows\System\qGpxjKd.exe
  C:\Windows\System\qGpxjKd.exe
  2⤵
  PID:6764
- C:\Windows\System\xUmmmJT.exe
  C:\Windows\System\xUmmmJT.exe
  2⤵
  PID:7108
- C:\Windows\System\ErhVTuw.exe
  C:\Windows\System\ErhVTuw.exe
  2⤵
  PID:6408
- C:\Windows\System\asCHgBp.exe
  C:\Windows\System\asCHgBp.exe
  2⤵
  PID:6460
- C:\Windows\System\lxWXbhN.exe
  C:\Windows\System\lxWXbhN.exe
  2⤵
  PID:6976
- C:\Windows\System\BLwuGWv.exe
  C:\Windows\System\BLwuGWv.exe
  2⤵
  PID:6784
- C:\Windows\System\ZhvSwcT.exe
  C:\Windows\System\ZhvSwcT.exe
  2⤵
  PID:6668
- C:\Windows\System\DdTnwYj.exe
  C:\Windows\System\DdTnwYj.exe
  2⤵
  PID:6604
- C:\Windows\System\MiZdyAx.exe
  C:\Windows\System\MiZdyAx.exe
  2⤵
  PID:6988
- C:\Windows\System\xpEVnVq.exe
  C:\Windows\System\xpEVnVq.exe
  2⤵
  PID:6504
- C:\Windows\System\jsMNwWE.exe
  C:\Windows\System\jsMNwWE.exe
  2⤵
  PID:7124
- C:\Windows\System\oLIdvTs.exe
  C:\Windows\System\oLIdvTs.exe
  2⤵
  PID:6608
- C:\Windows\System\muSYVFh.exe
  C:\Windows\System\muSYVFh.exe
  2⤵
  PID:6324
- C:\Windows\System\ETwGyIo.exe
  C:\Windows\System\ETwGyIo.exe
  2⤵
  PID:4792
- C:\Windows\System\sJCZZUn.exe
  C:\Windows\System\sJCZZUn.exe
  2⤵
  PID:6888
- C:\Windows\System\sgLCkEV.exe
  C:\Windows\System\sgLCkEV.exe
  2⤵
  PID:6684
- C:\Windows\System\xFbzQSP.exe
  C:\Windows\System\xFbzQSP.exe
  2⤵
  PID:6188
- C:\Windows\System\VVqbVQF.exe
  C:\Windows\System\VVqbVQF.exe
  2⤵
  PID:7144
- C:\Windows\System\YbgiukB.exe
  C:\Windows\System\YbgiukB.exe
  2⤵
  PID:6524
- C:\Windows\System\kXHsjLY.exe
  C:\Windows\System\kXHsjLY.exe
  2⤵
  PID:6628
- C:\Windows\System\MGowUWe.exe
  C:\Windows\System\MGowUWe.exe
  2⤵
  PID:6820
- C:\Windows\System\hSVVLvG.exe
  C:\Windows\System\hSVVLvG.exe
  2⤵
  PID:7052
- C:\Windows\System\XfUbEzr.exe
  C:\Windows\System\XfUbEzr.exe
  2⤵
  PID:7160
- C:\Windows\System\eblUJsz.exe
  C:\Windows\System\eblUJsz.exe
  2⤵
  PID:6860
- C:\Windows\System\aGCkCHA.exe
  C:\Windows\System\aGCkCHA.exe
  2⤵
  PID:7176
- C:\Windows\System\lQGoPeS.exe
  C:\Windows\System\lQGoPeS.exe
  2⤵
  PID:7196
- C:\Windows\System\NdiAsDR.exe
  C:\Windows\System\NdiAsDR.exe
  2⤵
  PID:7216
- C:\Windows\System\YhoFSBz.exe
  C:\Windows\System\YhoFSBz.exe
  2⤵
  PID:7236
- C:\Windows\System\YbRVrJD.exe
  C:\Windows\System\YbRVrJD.exe
  2⤵
  PID:7260
- C:\Windows\System\RyJaEFq.exe
  C:\Windows\System\RyJaEFq.exe
  2⤵
  PID:7280
- C:\Windows\System\sznanXP.exe
  C:\Windows\System\sznanXP.exe
  2⤵
  PID:7300
- C:\Windows\System\SKlmjdL.exe
  C:\Windows\System\SKlmjdL.exe
  2⤵
  PID:7320
- C:\Windows\System\vcbrqCL.exe
  C:\Windows\System\vcbrqCL.exe
  2⤵
  PID:7336
- C:\Windows\System\qGlGTaE.exe
  C:\Windows\System\qGlGTaE.exe
  2⤵
  PID:7352
- C:\Windows\System\LZpEDJQ.exe
  C:\Windows\System\LZpEDJQ.exe
  2⤵
  PID:7376
- C:\Windows\System\gqewLQa.exe
  C:\Windows\System\gqewLQa.exe
  2⤵
  PID:7392
- C:\Windows\System\LPBZPkt.exe
  C:\Windows\System\LPBZPkt.exe
  2⤵
  PID:7416
- C:\Windows\System\nRfZcdn.exe
  C:\Windows\System\nRfZcdn.exe
  2⤵
  PID:7436
- C:\Windows\System\ByTacQr.exe
  C:\Windows\System\ByTacQr.exe
  2⤵
  PID:7452
- C:\Windows\System\PTmwEDg.exe
  C:\Windows\System\PTmwEDg.exe
  2⤵
  PID:7468
- C:\Windows\System\gWTAYEw.exe
  C:\Windows\System\gWTAYEw.exe
  2⤵
  PID:7484
- C:\Windows\System\jQnBAXf.exe
  C:\Windows\System\jQnBAXf.exe
  2⤵
  PID:7504
- C:\Windows\System\MjvcUQQ.exe
  C:\Windows\System\MjvcUQQ.exe
  2⤵
  PID:7524
- C:\Windows\System\vCumPhk.exe
  C:\Windows\System\vCumPhk.exe
  2⤵
  PID:7548
- C:\Windows\System\MDkTfvj.exe
  C:\Windows\System\MDkTfvj.exe
  2⤵
  PID:7564
- C:\Windows\System\npybadA.exe
  C:\Windows\System\npybadA.exe
  2⤵
  PID:7588
- C:\Windows\System\CgDqFjA.exe
  C:\Windows\System\CgDqFjA.exe
  2⤵
  PID:7604
- C:\Windows\System\gSnjLKz.exe
  C:\Windows\System\gSnjLKz.exe
  2⤵
  PID:7632
- C:\Windows\System\gfFrGyw.exe
  C:\Windows\System\gfFrGyw.exe
  2⤵
  PID:7656
- C:\Windows\System\LHHQVve.exe
  C:\Windows\System\LHHQVve.exe
  2⤵
  PID:7672
- C:\Windows\System\KkrpIeO.exe
  C:\Windows\System\KkrpIeO.exe
  2⤵
  PID:7692
- C:\Windows\System\zTOEkoz.exe
  C:\Windows\System\zTOEkoz.exe
  2⤵
  PID:7712
- C:\Windows\System\cUlJvVr.exe
  C:\Windows\System\cUlJvVr.exe
  2⤵
  PID:7732
- C:\Windows\System\trYFNWu.exe
  C:\Windows\System\trYFNWu.exe
  2⤵
  PID:7752
- C:\Windows\System\DIEKFHm.exe
  C:\Windows\System\DIEKFHm.exe
  2⤵
  PID:7780
- C:\Windows\System\CmoAKXn.exe
  C:\Windows\System\CmoAKXn.exe
  2⤵
  PID:7796
- C:\Windows\System\oWFssAn.exe
  C:\Windows\System\oWFssAn.exe
  2⤵
  PID:7812
- C:\Windows\System\wOLsjdI.exe
  C:\Windows\System\wOLsjdI.exe
  2⤵
  PID:7832
- C:\Windows\System\TFYWKOr.exe
  C:\Windows\System\TFYWKOr.exe
  2⤵
  PID:7848
- C:\Windows\System\fnIjcPM.exe
  C:\Windows\System\fnIjcPM.exe
  2⤵
  PID:7888
- C:\Windows\System\HFBBfYq.exe
  C:\Windows\System\HFBBfYq.exe
  2⤵
  PID:7908
- C:\Windows\System\FdvdHPW.exe
  C:\Windows\System\FdvdHPW.exe
  2⤵
  PID:7924
- C:\Windows\System\MzKbwrR.exe
  C:\Windows\System\MzKbwrR.exe
  2⤵
  PID:7944
- C:\Windows\System\UnGGAEZ.exe
  C:\Windows\System\UnGGAEZ.exe
  2⤵
  PID:7960
- C:\Windows\System\bxXQuNJ.exe
  C:\Windows\System\bxXQuNJ.exe
  2⤵
  PID:7988
- C:\Windows\System\GmIhyLH.exe
  C:\Windows\System\GmIhyLH.exe
  2⤵
  PID:8004
- C:\Windows\System\uavdEQA.exe
  C:\Windows\System\uavdEQA.exe
  2⤵
  PID:8020
- C:\Windows\System\CejKACO.exe
  C:\Windows\System\CejKACO.exe
  2⤵
  PID:8048
- C:\Windows\System\gQbIXDK.exe
  C:\Windows\System\gQbIXDK.exe
  2⤵
  PID:8068
- C:\Windows\System\ebRjLMQ.exe
  C:\Windows\System\ebRjLMQ.exe
  2⤵
  PID:8084
- C:\Windows\System\yAkWsGG.exe
  C:\Windows\System\yAkWsGG.exe
  2⤵
  PID:8104
- C:\Windows\System\CxRSauP.exe
  C:\Windows\System\CxRSauP.exe
  2⤵
  PID:8120
- C:\Windows\System\AVesJDq.exe
  C:\Windows\System\AVesJDq.exe
  2⤵
  PID:8136
- C:\Windows\System\GLvhPOD.exe
  C:\Windows\System\GLvhPOD.exe
  2⤵
  PID:8156
- C:\Windows\System\HhQyVvR.exe
  C:\Windows\System\HhQyVvR.exe
  2⤵
  PID:8180
- C:\Windows\System\RivECFx.exe
  C:\Windows\System\RivECFx.exe
  2⤵
  PID:6300
- C:\Windows\System\XEgKMet.exe
  C:\Windows\System\XEgKMet.exe
  2⤵
  PID:6632
- C:\Windows\System\BkglgpP.exe
  C:\Windows\System\BkglgpP.exe
  2⤵
  PID:6316
- C:\Windows\System\qxGsiRs.exe
  C:\Windows\System\qxGsiRs.exe
  2⤵
  PID:7244
- C:\Windows\System\rNisWsp.exe
  C:\Windows\System\rNisWsp.exe
  2⤵
  PID:7288
- C:\Windows\System\OyGHuwa.exe
  C:\Windows\System\OyGHuwa.exe
  2⤵
  PID:7188
- C:\Windows\System\iDxpAuw.exe
  C:\Windows\System\iDxpAuw.exe
  2⤵
  PID:7364
- C:\Windows\System\ViRBIPG.exe
  C:\Windows\System\ViRBIPG.exe
  2⤵
  PID:7268
- C:\Windows\System\czADiCv.exe
  C:\Windows\System\czADiCv.exe
  2⤵
  PID:7412
- C:\Windows\System\QSOGgJn.exe
  C:\Windows\System\QSOGgJn.exe
  2⤵
  PID:7448
- C:\Windows\System\CzVvGLZ.exe
  C:\Windows\System\CzVvGLZ.exe
  2⤵
  PID:7516
- C:\Windows\System\aHjUQQH.exe
  C:\Windows\System\aHjUQQH.exe
  2⤵
  PID:7224
- C:\Windows\System\HRwnXAD.exe
  C:\Windows\System\HRwnXAD.exe
  2⤵
  PID:7600
- C:\Windows\System\tvnjzZo.exe
  C:\Windows\System\tvnjzZo.exe
  2⤵
  PID:7384
- C:\Windows\System\uPfJfJi.exe
  C:\Windows\System\uPfJfJi.exe
  2⤵
  PID:7316
- C:\Windows\System\ZYiCfRs.exe
  C:\Windows\System\ZYiCfRs.exe
  2⤵
  PID:7460
- C:\Windows\System\UBBkmQR.exe
  C:\Windows\System\UBBkmQR.exe
  2⤵
  PID:7624
- C:\Windows\System\ddvmAjr.exe
  C:\Windows\System\ddvmAjr.exe
  2⤵
  PID:7680
- C:\Windows\System\mequRJJ.exe
  C:\Windows\System\mequRJJ.exe
  2⤵
  PID:7728
- C:\Windows\System\RSyIKLS.exe
  C:\Windows\System\RSyIKLS.exe
  2⤵
  PID:7776
- C:\Windows\System\CRVkknq.exe
  C:\Windows\System\CRVkknq.exe
  2⤵
  PID:7844
- C:\Windows\System\bhZnWUr.exe
  C:\Windows\System\bhZnWUr.exe
  2⤵
  PID:7668
- C:\Windows\System\RdeZWSo.exe
  C:\Windows\System\RdeZWSo.exe
  2⤵
  PID:7748
- C:\Windows\System\sbTdwfA.exe
  C:\Windows\System\sbTdwfA.exe
  2⤵
  PID:7824
- C:\Windows\System\tFhKlfJ.exe
  C:\Windows\System\tFhKlfJ.exe
  2⤵
  PID:7868
- C:\Windows\System\DqThfDQ.exe
  C:\Windows\System\DqThfDQ.exe
  2⤵
  PID:7896
- C:\Windows\System\YyRujFe.exe
  C:\Windows\System\YyRujFe.exe
  2⤵
  PID:7936
- C:\Windows\System\ciaObeZ.exe
  C:\Windows\System\ciaObeZ.exe
  2⤵
  PID:7976
- C:\Windows\System\wtOGpIH.exe
  C:\Windows\System\wtOGpIH.exe
  2⤵
  PID:7952
- C:\Windows\System\ofOOFZA.exe
  C:\Windows\System\ofOOFZA.exe
  2⤵
  PID:8028
- C:\Windows\System\wOMkBSd.exe
  C:\Windows\System\wOMkBSd.exe
  2⤵
  PID:8056
- C:\Windows\System\dBwQijP.exe
  C:\Windows\System\dBwQijP.exe
  2⤵
  PID:8112
- C:\Windows\System\jEQrirR.exe
  C:\Windows\System\jEQrirR.exe
  2⤵
  PID:8152
- C:\Windows\System\fHUVRLv.exe
  C:\Windows\System\fHUVRLv.exe
  2⤵
  PID:8132
- C:\Windows\System\uJWrUKo.exe
  C:\Windows\System\uJWrUKo.exe
  2⤵
  PID:8176
- C:\Windows\System\cobMkli.exe
  C:\Windows\System\cobMkli.exe
  2⤵
  PID:7212
- C:\Windows\System\PvHTibU.exe
  C:\Windows\System\PvHTibU.exe
  2⤵
  PID:7296
- C:\Windows\System\wvIAtbz.exe
  C:\Windows\System\wvIAtbz.exe
  2⤵
  PID:7556
- C:\Windows\System\SXUyrzx.exe
  C:\Windows\System\SXUyrzx.exe
  2⤵
  PID:7388
- C:\Windows\System\iSnNeOM.exe
  C:\Windows\System\iSnNeOM.exe
  2⤵
  PID:7404
- C:\Windows\System\vgRSAFV.exe
  C:\Windows\System\vgRSAFV.exe
  2⤵
  PID:7540
- C:\Windows\System\doUVndm.exe
  C:\Windows\System\doUVndm.exe
  2⤵
  PID:7584
- C:\Windows\System\nhGaPgj.exe
  C:\Windows\System\nhGaPgj.exe
  2⤵
  PID:7652
- C:\Windows\System\IiNwZUO.exe
  C:\Windows\System\IiNwZUO.exe
  2⤵
  PID:7764
- C:\Windows\System\iBWLvqH.exe
  C:\Windows\System\iBWLvqH.exe
  2⤵
  PID:7596
- C:\Windows\System\wsTmfLy.exe
  C:\Windows\System\wsTmfLy.exe
  2⤵
  PID:7432
- C:\Windows\System\uFIjsQp.exe
  C:\Windows\System\uFIjsQp.exe
  2⤵
  PID:7820
- C:\Windows\System\zJtreXd.exe
  C:\Windows\System\zJtreXd.exe
  2⤵
  PID:7880
- C:\Windows\System\OGAjsyn.exe
  C:\Windows\System\OGAjsyn.exe
  2⤵
  PID:8016
- C:\Windows\System\KJxubtB.exe
  C:\Windows\System\KJxubtB.exe
  2⤵
  PID:7904
- C:\Windows\System\pfbmwqB.exe
  C:\Windows\System\pfbmwqB.exe
  2⤵
  PID:8032
- C:\Windows\System\VJpHAcu.exe
  C:\Windows\System\VJpHAcu.exe
  2⤵
  PID:7688
- C:\Windows\System\QmzSTif.exe
  C:\Windows\System\QmzSTif.exe
  2⤵
  PID:8092
- C:\Windows\System\itBBary.exe
  C:\Windows\System\itBBary.exe
  2⤵
  PID:6444
- C:\Windows\System\oAAUQOe.exe
  C:\Windows\System\oAAUQOe.exe
  2⤵
  PID:6260
- C:\Windows\System\brAbBWZ.exe
  C:\Windows\System\brAbBWZ.exe
  2⤵
  PID:8040
- C:\Windows\System\MKgvdjk.exe
  C:\Windows\System\MKgvdjk.exe
  2⤵
  PID:7204
- C:\Windows\System\cjSuhCv.exe
  C:\Windows\System\cjSuhCv.exe
  2⤵
  PID:7400
- C:\Windows\System\BdsrhPN.exe
  C:\Windows\System\BdsrhPN.exe
  2⤵
  PID:7580
- C:\Windows\System\DqpPhzY.exe
  C:\Windows\System\DqpPhzY.exe
  2⤵
  PID:7312
- C:\Windows\System\ecXhFBN.exe
  C:\Windows\System\ecXhFBN.exe
  2⤵
  PID:7920
- C:\Windows\System\xnWxhuJ.exe
  C:\Windows\System\xnWxhuJ.exe
  2⤵
  PID:7856
- C:\Windows\System\eoQKWBK.exe
  C:\Windows\System\eoQKWBK.exe
  2⤵
  PID:7724
- C:\Windows\System\qUrmxPz.exe
  C:\Windows\System\qUrmxPz.exe
  2⤵
  PID:7996
- C:\Windows\System\NzUiIzv.exe
  C:\Windows\System\NzUiIzv.exe
  2⤵
  PID:8076
- C:\Windows\System\ImiMdVx.exe
  C:\Windows\System\ImiMdVx.exe
  2⤵
  PID:7648
- C:\Windows\System\PTTBuVg.exe
  C:\Windows\System\PTTBuVg.exe
  2⤵
  PID:8080
- C:\Windows\System\UdGAaDJ.exe
  C:\Windows\System\UdGAaDJ.exe
  2⤵
  PID:7012
- C:\Windows\System\STGzeRw.exe
  C:\Windows\System\STGzeRw.exe
  2⤵
  PID:7572
- C:\Windows\System\OCZOpxK.exe
  C:\Windows\System\OCZOpxK.exe
  2⤵
  PID:8204
- C:\Windows\System\MEhzRaS.exe
  C:\Windows\System\MEhzRaS.exe
  2⤵
  PID:8224
- C:\Windows\System\HTxjKCY.exe
  C:\Windows\System\HTxjKCY.exe
  2⤵
  PID:8288
- C:\Windows\System\RVwNIJD.exe
  C:\Windows\System\RVwNIJD.exe
  2⤵
  PID:8308
- C:\Windows\System\RGaQdyQ.exe
  C:\Windows\System\RGaQdyQ.exe
  2⤵
  PID:8324
- C:\Windows\System\AigTeId.exe
  C:\Windows\System\AigTeId.exe
  2⤵
  PID:8340
- C:\Windows\System\hjLGSbe.exe
  C:\Windows\System\hjLGSbe.exe
  2⤵
  PID:8356
- C:\Windows\System\RydQjye.exe
  C:\Windows\System\RydQjye.exe
  2⤵
  PID:8376
- C:\Windows\System\ehzFpiN.exe
  C:\Windows\System\ehzFpiN.exe
  2⤵
  PID:8392
- C:\Windows\System\TxlCpeh.exe
  C:\Windows\System\TxlCpeh.exe
  2⤵
  PID:8408
- C:\Windows\System\zAdiBod.exe
  C:\Windows\System\zAdiBod.exe
  2⤵
  PID:8424
- C:\Windows\System\laBaWPN.exe
  C:\Windows\System\laBaWPN.exe
  2⤵
  PID:8440
- C:\Windows\System\aDiTACB.exe
  C:\Windows\System\aDiTACB.exe
  2⤵
  PID:8460
- C:\Windows\System\xoucOUp.exe
  C:\Windows\System\xoucOUp.exe
  2⤵
  PID:8476
- C:\Windows\System\CtVuUZk.exe
  C:\Windows\System\CtVuUZk.exe
  2⤵
  PID:8496
- C:\Windows\System\iLafcWh.exe
  C:\Windows\System\iLafcWh.exe
  2⤵
  PID:8512
- C:\Windows\System\tpWlyis.exe
  C:\Windows\System\tpWlyis.exe
  2⤵
  PID:8568
- C:\Windows\System\RhdtUca.exe
  C:\Windows\System\RhdtUca.exe
  2⤵
  PID:8588
- C:\Windows\System\XDQIBBh.exe
  C:\Windows\System\XDQIBBh.exe
  2⤵
  PID:8604
- C:\Windows\System\EezLwCh.exe
  C:\Windows\System\EezLwCh.exe
  2⤵
  PID:8628
- C:\Windows\System\GxHhSQW.exe
  C:\Windows\System\GxHhSQW.exe
  2⤵
  PID:8648
- C:\Windows\System\FEGxHdW.exe
  C:\Windows\System\FEGxHdW.exe
  2⤵
  PID:8664
- C:\Windows\System\LyGHUtL.exe
  C:\Windows\System\LyGHUtL.exe
  2⤵
  PID:8680
- C:\Windows\System\GqTpImJ.exe
  C:\Windows\System\GqTpImJ.exe
  2⤵
  PID:8700
- C:\Windows\System\DJEfrit.exe
  C:\Windows\System\DJEfrit.exe
  2⤵
  PID:8716
- C:\Windows\System\QDVXtui.exe
  C:\Windows\System\QDVXtui.exe
  2⤵
  PID:8736
- C:\Windows\System\FopXtZs.exe
  C:\Windows\System\FopXtZs.exe
  2⤵
  PID:8752
- C:\Windows\System\FIxOdBM.exe
  C:\Windows\System\FIxOdBM.exe
  2⤵
  PID:8768
- C:\Windows\System\amBrtAm.exe
  C:\Windows\System\amBrtAm.exe
  2⤵
  PID:8784
- C:\Windows\System\ozphaZZ.exe
  C:\Windows\System\ozphaZZ.exe
  2⤵
  PID:8804
- C:\Windows\System\WjEapIk.exe
  C:\Windows\System\WjEapIk.exe
  2⤵
  PID:8820
- C:\Windows\System\KxPAnaF.exe
  C:\Windows\System\KxPAnaF.exe
  2⤵
  PID:8840
- C:\Windows\System\jJdlUgo.exe
  C:\Windows\System\jJdlUgo.exe
  2⤵
  PID:8856
- C:\Windows\System\CaPdLCe.exe
  C:\Windows\System\CaPdLCe.exe
  2⤵
  PID:8912
- C:\Windows\System\YenoBhv.exe
  C:\Windows\System\YenoBhv.exe
  2⤵
  PID:8928
- C:\Windows\System\OqGQBGL.exe
  C:\Windows\System\OqGQBGL.exe
  2⤵
  PID:8948
- C:\Windows\System\JkFJWXs.exe
  C:\Windows\System\JkFJWXs.exe
  2⤵
  PID:8964
- C:\Windows\System\KdTCQyC.exe
  C:\Windows\System\KdTCQyC.exe
  2⤵
  PID:8984
- C:\Windows\System\tEzSSZc.exe
  C:\Windows\System\tEzSSZc.exe
  2⤵
  PID:9012
- C:\Windows\System\NASoCHO.exe
  C:\Windows\System\NASoCHO.exe
  2⤵
  PID:9028
- C:\Windows\System\SLpIblt.exe
  C:\Windows\System\SLpIblt.exe
  2⤵
  PID:9044
- C:\Windows\System\XbDGvey.exe
  C:\Windows\System\XbDGvey.exe
  2⤵
  PID:9064
- C:\Windows\System\aFWvjro.exe
  C:\Windows\System\aFWvjro.exe
  2⤵
  PID:9080
- C:\Windows\System\uScawdj.exe
  C:\Windows\System\uScawdj.exe
  2⤵
  PID:9108
- C:\Windows\System\lAezmbX.exe
  C:\Windows\System\lAezmbX.exe
  2⤵
  PID:9132
- C:\Windows\System\PorhFRZ.exe
  C:\Windows\System\PorhFRZ.exe
  2⤵
  PID:9148
- C:\Windows\System\ScKQmjx.exe
  C:\Windows\System\ScKQmjx.exe
  2⤵
  PID:9168
- C:\Windows\System\IwFLwuD.exe
  C:\Windows\System\IwFLwuD.exe
  2⤵
  PID:9184
- C:\Windows\System\DUBRitP.exe
  C:\Windows\System\DUBRitP.exe
  2⤵
  PID:9204
- C:\Windows\System\uZpkxiY.exe
  C:\Windows\System\uZpkxiY.exe
  2⤵
  PID:7744
- C:\Windows\System\RmdAGwr.exe
  C:\Windows\System\RmdAGwr.exe
  2⤵
  PID:7760
- C:\Windows\System\sMvvhQj.exe
  C:\Windows\System\sMvvhQj.exe
  2⤵
  PID:7512
- C:\Windows\System\PRStdIa.exe
  C:\Windows\System\PRStdIa.exe
  2⤵
  PID:7704
- C:\Windows\System\eAPCiZY.exe
  C:\Windows\System\eAPCiZY.exe
  2⤵
  PID:8240
- C:\Windows\System\sTYMJly.exe
  C:\Windows\System\sTYMJly.exe
  2⤵
  PID:8232
- C:\Windows\System\CnTofCP.exe
  C:\Windows\System\CnTofCP.exe
  2⤵
  PID:8256
- C:\Windows\System\FdKRUVQ.exe
  C:\Windows\System\FdKRUVQ.exe
  2⤵
  PID:8276
- C:\Windows\System\LlWLOOE.exe
  C:\Windows\System\LlWLOOE.exe
  2⤵
  PID:8236
- C:\Windows\System\KIeAKvT.exe
  C:\Windows\System\KIeAKvT.exe
  2⤵
  PID:7348
- C:\Windows\System\qGlSvlj.exe
  C:\Windows\System\qGlSvlj.exe
  2⤵
  PID:8296
- C:\Windows\System\JjuvwxA.exe
  C:\Windows\System\JjuvwxA.exe
  2⤵
  PID:8416
- C:\Windows\System\IUidsYt.exe
  C:\Windows\System\IUidsYt.exe
  2⤵
  PID:8448
- C:\Windows\System\eQYFQrw.exe
  C:\Windows\System\eQYFQrw.exe
  2⤵
  PID:8492
- C:\Windows\System\FMjipdz.exe
  C:\Windows\System\FMjipdz.exe
  2⤵
  PID:8536
- C:\Windows\System\wiOoMyP.exe
  C:\Windows\System\wiOoMyP.exe
  2⤵
  PID:8552
- C:\Windows\System\ypOXwLD.exe
  C:\Windows\System\ypOXwLD.exe
  2⤵
  PID:8336
- C:\Windows\System\gWEPtJU.exe
  C:\Windows\System\gWEPtJU.exe
  2⤵
  PID:8432
- C:\Windows\System\VkXSzIB.exe
  C:\Windows\System\VkXSzIB.exe
  2⤵
  PID:8576
- C:\Windows\System\iGXCxlH.exe
  C:\Windows\System\iGXCxlH.exe
  2⤵
  PID:8596
- C:\Windows\System\lfzWZjm.exe
  C:\Windows\System\lfzWZjm.exe
  2⤵
  PID:8708
- C:\Windows\System\AjgkLLg.exe
  C:\Windows\System\AjgkLLg.exe
  2⤵
  PID:8776
- C:\Windows\System\TjnAJdh.exe
  C:\Windows\System\TjnAJdh.exe
  2⤵
  PID:8816
- C:\Windows\System\tpuCaGn.exe
  C:\Windows\System\tpuCaGn.exe
  2⤵
  PID:8792
- C:\Windows\System\VDkLpgf.exe
  C:\Windows\System\VDkLpgf.exe
  2⤵
  PID:8828
- C:\Windows\System\OWLpAFa.exe
  C:\Windows\System\OWLpAFa.exe
  2⤵
  PID:8764
- C:\Windows\System\JRRGqSR.exe
  C:\Windows\System\JRRGqSR.exe
  2⤵
  PID:8888
- C:\Windows\System\QUqdJvC.exe
  C:\Windows\System\QUqdJvC.exe
  2⤵
  PID:8904
- C:\Windows\System\qDlxsOa.exe
  C:\Windows\System\qDlxsOa.exe
  2⤵
  PID:8920
- C:\Windows\System\ffaBLVF.exe
  C:\Windows\System\ffaBLVF.exe
  2⤵
  PID:8944
- C:\Windows\System\CJsnCrA.exe
  C:\Windows\System\CJsnCrA.exe
  2⤵
  PID:8992
- C:\Windows\System\BiqjeUj.exe
  C:\Windows\System\BiqjeUj.exe
  2⤵
  PID:8996
- C:\Windows\System\VkgVkoY.exe
  C:\Windows\System\VkgVkoY.exe
  2⤵
  PID:9072
- C:\Windows\System\cwXuLHI.exe
  C:\Windows\System\cwXuLHI.exe
  2⤵
  PID:9060
- C:\Windows\System\ZwsGCET.exe
  C:\Windows\System\ZwsGCET.exe
  2⤵
  PID:9104
- C:\Windows\System\msPywiH.exe
  C:\Windows\System\msPywiH.exe
  2⤵
  PID:9120
- C:\Windows\System\fAfqOVv.exe
  C:\Windows\System\fAfqOVv.exe
  2⤵
  PID:9160
- C:\Windows\System\OlPZKWQ.exe
  C:\Windows\System\OlPZKWQ.exe
  2⤵
  PID:6816
- C:\Windows\System\MrSBEdT.exe
  C:\Windows\System\MrSBEdT.exe
  2⤵
  PID:8128
- C:\Windows\System\TUYOxSL.exe
  C:\Windows\System\TUYOxSL.exe
  2⤵
  PID:7532
- C:\Windows\System\dvjiLfJ.exe
  C:\Windows\System\dvjiLfJ.exe
  2⤵
  PID:8168
- C:\Windows\System\OBlFPrG.exe
  C:\Windows\System\OBlFPrG.exe
  2⤵
  PID:8044
- C:\Windows\System\KNhwUDQ.exe
  C:\Windows\System\KNhwUDQ.exe
  2⤵
  PID:8248
- C:\Windows\System\ChzOnzV.exe
  C:\Windows\System\ChzOnzV.exe
  2⤵
  PID:6916
- C:\Windows\System\rfmhMlz.exe
  C:\Windows\System\rfmhMlz.exe
  2⤵
  PID:8300
- C:\Windows\System\oGWZIFB.exe
  C:\Windows\System\oGWZIFB.exe
  2⤵
  PID:8384
- C:\Windows\System\OKFiXqx.exe
  C:\Windows\System\OKFiXqx.exe
  2⤵
  PID:8520
- C:\Windows\System\UhqTjdp.exe
  C:\Windows\System\UhqTjdp.exe
  2⤵
  PID:8584
- C:\Windows\System\CdasxmP.exe
  C:\Windows\System\CdasxmP.exe
  2⤵
  PID:8676
- C:\Windows\System\cchKvvH.exe
  C:\Windows\System\cchKvvH.exe
  2⤵
  PID:8724
- C:\Windows\System\XybTCyv.exe
  C:\Windows\System\XybTCyv.exe
  2⤵
  PID:8508
- C:\Windows\System\qbWWaTd.exe
  C:\Windows\System\qbWWaTd.exe
  2⤵
  PID:8692
- C:\Windows\System\knXYiYd.exe
  C:\Windows\System\knXYiYd.exe
  2⤵
  PID:8800
- C:\Windows\System\DNnMpda.exe
  C:\Windows\System\DNnMpda.exe
  2⤵
  PID:8624
- C:\Windows\System\BPCtkts.exe
  C:\Windows\System\BPCtkts.exe
  2⤵
  PID:8940
- C:\Windows\System\mwhIvMB.exe
  C:\Windows\System\mwhIvMB.exe
  2⤵
  PID:9076
- C:\Windows\System\VQilgNl.exe
  C:\Windows\System\VQilgNl.exe
  2⤵
  PID:9124
- C:\Windows\System\LQOpHjg.exe
  C:\Windows\System\LQOpHjg.exe
  2⤵
  PID:9024
- C:\Windows\System\lYDkEHQ.exe
  C:\Windows\System\lYDkEHQ.exe
  2⤵
  PID:9100
- C:\Windows\System\xjQuXSk.exe
  C:\Windows\System\xjQuXSk.exe
  2⤵
  PID:7792
- C:\Windows\System\jaasCbD.exe
  C:\Windows\System\jaasCbD.exe
  2⤵
  PID:8212
- C:\Windows\System\LOTpKHI.exe
  C:\Windows\System\LOTpKHI.exe
  2⤵
  PID:7772
- C:\Windows\System\QygJzcn.exe
  C:\Windows\System\QygJzcn.exe
  2⤵
  PID:8264
- C:\Windows\System\ikBLajm.exe
  C:\Windows\System\ikBLajm.exe
  2⤵
  PID:8400
- C:\Windows\System\XaHBcNm.exe
  C:\Windows\System\XaHBcNm.exe
  2⤵
  PID:8468
- C:\Windows\System\VWofLSy.exe
  C:\Windows\System\VWofLSy.exe
  2⤵
  PID:8852
- C:\Windows\System\DTyKugD.exe
  C:\Windows\System\DTyKugD.exe
  2⤵
  PID:8688
- C:\Windows\System\vQecrzN.exe
  C:\Windows\System\vQecrzN.exe
  2⤵
  PID:8620
- C:\Windows\System\uFNucOA.exe
  C:\Windows\System\uFNucOA.exe
  2⤵
  PID:8484
- C:\Windows\System\CgYGPJS.exe
  C:\Windows\System\CgYGPJS.exe
  2⤵
  PID:8876
- C:\Windows\System\SNMYXkw.exe
  C:\Windows\System\SNMYXkw.exe
  2⤵
  PID:9176
- C:\Windows\System\GuUYQDB.exe
  C:\Windows\System\GuUYQDB.exe
  2⤵
  PID:9196
- C:\Windows\System\DuthZVC.exe
  C:\Windows\System\DuthZVC.exe
  2⤵
  PID:8196
- C:\Windows\System\NmbJyDj.exe
  C:\Windows\System\NmbJyDj.exe
  2⤵
  PID:8420
- C:\Windows\System\tqVCWGH.exe
  C:\Windows\System\tqVCWGH.exe
  2⤵
  PID:8220
- C:\Windows\System\boOetvh.exe
  C:\Windows\System\boOetvh.exe
  2⤵
  PID:8616
- C:\Windows\System\mivnaHo.exe
  C:\Windows\System\mivnaHo.exe
  2⤵
  PID:8732
- C:\Windows\System\cHfqcFu.exe
  C:\Windows\System\cHfqcFu.exe
  2⤵
  PID:8748
- C:\Windows\System\UNZqxWA.exe
  C:\Windows\System\UNZqxWA.exe
  2⤵
  PID:8880
- C:\Windows\System\XhuojCt.exe
  C:\Windows\System\XhuojCt.exe
  2⤵
  PID:8900
- C:\Windows\System\cisaCCj.exe
  C:\Windows\System\cisaCCj.exe
  2⤵
  PID:8976
- C:\Windows\System\PDyuvfg.exe
  C:\Windows\System\PDyuvfg.exe
  2⤵
  PID:7980
- C:\Windows\System\DseROqH.exe
  C:\Windows\System\DseROqH.exe
  2⤵
  PID:8352
- C:\Windows\System\qJNGPxF.exe
  C:\Windows\System\qJNGPxF.exe
  2⤵
  PID:8548
- C:\Windows\System\EJssFjU.exe
  C:\Windows\System\EJssFjU.exe
  2⤵
  PID:8456
- C:\Windows\System\YauztZx.exe
  C:\Windows\System\YauztZx.exe
  2⤵
  PID:3008
- C:\Windows\System\VguuGWK.exe
  C:\Windows\System\VguuGWK.exe
  2⤵
  PID:8368
- C:\Windows\System\mTwlQWC.exe
  C:\Windows\System\mTwlQWC.exe
  2⤵
  PID:8348
- C:\Windows\System\nsAVQgg.exe
  C:\Windows\System\nsAVQgg.exe
  2⤵
  PID:9192
- C:\Windows\System\ZVZzCLx.exe
  C:\Windows\System\ZVZzCLx.exe
  2⤵
  PID:9092
- C:\Windows\System\jGzVycD.exe
  C:\Windows\System\jGzVycD.exe
  2⤵
  PID:8712
- C:\Windows\System\xtDYBpn.exe
  C:\Windows\System\xtDYBpn.exe
  2⤵
  PID:9224
- C:\Windows\System\aooldgc.exe
  C:\Windows\System\aooldgc.exe
  2⤵
  PID:9248
- C:\Windows\System\kNkAoOV.exe
  C:\Windows\System\kNkAoOV.exe
  2⤵
  PID:9264
- C:\Windows\System\arcvGpV.exe
  C:\Windows\System\arcvGpV.exe
  2⤵
  PID:9284
- C:\Windows\System\QZqaCRq.exe
  C:\Windows\System\QZqaCRq.exe
  2⤵
  PID:9300
- C:\Windows\System\ZedSlhF.exe
  C:\Windows\System\ZedSlhF.exe
  2⤵
  PID:9348
- C:\Windows\System\YHOzwgg.exe
  C:\Windows\System\YHOzwgg.exe
  2⤵
  PID:9364
- C:\Windows\System\BVoIlSq.exe
  C:\Windows\System\BVoIlSq.exe
  2⤵
  PID:9380
- C:\Windows\System\eyYDjij.exe
  C:\Windows\System\eyYDjij.exe
  2⤵
  PID:9400
- C:\Windows\System\feSyKgC.exe
  C:\Windows\System\feSyKgC.exe
  2⤵
  PID:9424
- C:\Windows\System\uUSnLNQ.exe
  C:\Windows\System\uUSnLNQ.exe
  2⤵
  PID:9440
- C:\Windows\System\iXJWXvr.exe
  C:\Windows\System\iXJWXvr.exe
  2⤵
  PID:9456
- C:\Windows\System\WKIcave.exe
  C:\Windows\System\WKIcave.exe
  2⤵
  PID:9472
- C:\Windows\System\mIaXyyp.exe
  C:\Windows\System\mIaXyyp.exe
  2⤵
  PID:9496
- C:\Windows\System\qUklSMN.exe
  C:\Windows\System\qUklSMN.exe
  2⤵
  PID:9516
- C:\Windows\System\QEIwDYh.exe
  C:\Windows\System\QEIwDYh.exe
  2⤵
  PID:9552
- C:\Windows\System\xMTKLsK.exe
  C:\Windows\System\xMTKLsK.exe
  2⤵
  PID:9568
- C:\Windows\System\FEcdvYH.exe
  C:\Windows\System\FEcdvYH.exe
  2⤵
  PID:9584
- C:\Windows\System\zhNIFTN.exe
  C:\Windows\System\zhNIFTN.exe
  2⤵
  PID:9604
- C:\Windows\System\tiPMoos.exe
  C:\Windows\System\tiPMoos.exe
  2⤵
  PID:9620
- C:\Windows\System\aeKVKBc.exe
  C:\Windows\System\aeKVKBc.exe
  2⤵
  PID:9636
- C:\Windows\System\ygbIdDS.exe
  C:\Windows\System\ygbIdDS.exe
  2⤵
  PID:9676
- C:\Windows\System\eDnOhJI.exe
  C:\Windows\System\eDnOhJI.exe
  2⤵
  PID:9692
- C:\Windows\System\CvryvWo.exe
  C:\Windows\System\CvryvWo.exe
  2⤵
  PID:9708
- C:\Windows\System\zedghgJ.exe
  C:\Windows\System\zedghgJ.exe
  2⤵
  PID:9724
- C:\Windows\System\oCWtwRW.exe
  C:\Windows\System\oCWtwRW.exe
  2⤵
  PID:9740
- C:\Windows\System\QyEkDde.exe
  C:\Windows\System\QyEkDde.exe
  2⤵
  PID:9776
- C:\Windows\System\hVYybph.exe
  C:\Windows\System\hVYybph.exe
  2⤵
  PID:9792
- C:\Windows\System\dfFGXWj.exe
  C:\Windows\System\dfFGXWj.exe
  2⤵
  PID:9812
- C:\Windows\System\jSbCktY.exe
  C:\Windows\System\jSbCktY.exe
  2⤵
  PID:9832
- C:\Windows\System\iAcWwaO.exe
  C:\Windows\System\iAcWwaO.exe
  2⤵
  PID:9852
- C:\Windows\System\SPJwAxW.exe
  C:\Windows\System\SPJwAxW.exe
  2⤵
  PID:9868
- C:\Windows\System\hOYwVvQ.exe
  C:\Windows\System\hOYwVvQ.exe
  2⤵
  PID:9888
- C:\Windows\System\xNnJEVF.exe
  C:\Windows\System\xNnJEVF.exe
  2⤵
  PID:9904
- C:\Windows\System\prOWZFK.exe
  C:\Windows\System\prOWZFK.exe
  2⤵
  PID:9940
- C:\Windows\System\IEskgzS.exe
  C:\Windows\System\IEskgzS.exe
  2⤵
  PID:9956
- C:\Windows\System\HtEAugi.exe
  C:\Windows\System\HtEAugi.exe
  2⤵
  PID:9972
- C:\Windows\System\tyGSwxq.exe
  C:\Windows\System\tyGSwxq.exe
  2⤵
  PID:9996
- C:\Windows\System\ETDttbW.exe
  C:\Windows\System\ETDttbW.exe
  2⤵
  PID:10012
- C:\Windows\System\TsgLfIE.exe
  C:\Windows\System\TsgLfIE.exe
  2⤵
  PID:10028
- C:\Windows\System\DSEovzz.exe
  C:\Windows\System\DSEovzz.exe
  2⤵
  PID:10044
- C:\Windows\System\jPKmWvF.exe
  C:\Windows\System\jPKmWvF.exe
  2⤵
  PID:10060
- C:\Windows\System\fthwnyx.exe
  C:\Windows\System\fthwnyx.exe
  2⤵
  PID:10084
- C:\Windows\System\aIOdFto.exe
  C:\Windows\System\aIOdFto.exe
  2⤵
  PID:10104
- C:\Windows\System\CwllABf.exe
  C:\Windows\System\CwllABf.exe
  2⤵
  PID:10124
- C:\Windows\System\kOZTuoe.exe
  C:\Windows\System\kOZTuoe.exe
  2⤵
  PID:10140
- C:\Windows\System\lmMlTCh.exe
  C:\Windows\System\lmMlTCh.exe
  2⤵
  PID:10160
- C:\Windows\System\bAsnGfd.exe
  C:\Windows\System\bAsnGfd.exe
  2⤵
  PID:10176
- C:\Windows\System\JZwKhWe.exe
  C:\Windows\System\JZwKhWe.exe
  2⤵
  PID:10200
- C:\Windows\System\XyQrxqY.exe
  C:\Windows\System\XyQrxqY.exe
  2⤵
  PID:10220
- C:\Windows\System\LJqAyUE.exe
  C:\Windows\System\LJqAyUE.exe
  2⤵
  PID:10236
- C:\Windows\System\AVcLgYF.exe
  C:\Windows\System\AVcLgYF.exe
  2⤵
  PID:9260
- C:\Windows\System\lVWPKal.exe
  C:\Windows\System\lVWPKal.exe
  2⤵
  PID:9312
- C:\Windows\System\qmfHBGW.exe
  C:\Windows\System\qmfHBGW.exe
  2⤵
  PID:6996
- C:\Windows\System\stQIqdq.exe
  C:\Windows\System\stQIqdq.exe
  2⤵
  PID:9328
- C:\Windows\System\TnnHlTO.exe
  C:\Windows\System\TnnHlTO.exe
  2⤵
  PID:9356
- C:\Windows\System\vfIiyTj.exe
  C:\Windows\System\vfIiyTj.exe
  2⤵
  PID:9392
- C:\Windows\System\Fltktmf.exe
  C:\Windows\System\Fltktmf.exe
  2⤵
  PID:9408
- C:\Windows\System\vRNryxh.exe
  C:\Windows\System\vRNryxh.exe
  2⤵
  PID:9452
- C:\Windows\System\fsmQdpr.exe
  C:\Windows\System\fsmQdpr.exe
  2⤵
  PID:9504
- C:\Windows\System\GnFryyO.exe
  C:\Windows\System\GnFryyO.exe
  2⤵
  PID:9548
- C:\Windows\System\IJdkEBB.exe
  C:\Windows\System\IJdkEBB.exe
  2⤵
  PID:9600
- C:\Windows\System\tmNTZcV.exe
  C:\Windows\System\tmNTZcV.exe
  2⤵
  PID:9612
- C:\Windows\System\rgBqCyK.exe
  C:\Windows\System\rgBqCyK.exe
  2⤵
  PID:9644
- C:\Windows\System\HpJvXVv.exe
  C:\Windows\System\HpJvXVv.exe
  2⤵
  PID:9672
- C:\Windows\System\jmRDLuP.exe
  C:\Windows\System\jmRDLuP.exe
  2⤵
  PID:9752
- C:\Windows\System\BessYoB.exe
  C:\Windows\System\BessYoB.exe
  2⤵
  PID:9704
- C:\Windows\System\yQIEkdF.exe
  C:\Windows\System\yQIEkdF.exe
  2⤵
  PID:9764
- C:\Windows\System\wtAZaib.exe
  C:\Windows\System\wtAZaib.exe
  2⤵
  PID:9788
- C:\Windows\System\JRSQhEF.exe
  C:\Windows\System\JRSQhEF.exe
  2⤵
  PID:9824
- C:\Windows\System\ibcWaBl.exe
  C:\Windows\System\ibcWaBl.exe
  2⤵
  PID:9860
- C:\Windows\System\yiwQoIt.exe
  C:\Windows\System\yiwQoIt.exe
  2⤵
  PID:9924
- C:\Windows\System\KDvZQPb.exe
  C:\Windows\System\KDvZQPb.exe
  2⤵
  PID:9952
- C:\Windows\System\hJlBGXF.exe
  C:\Windows\System\hJlBGXF.exe
  2⤵
  PID:9988
- C:\Windows\System\tbxCHdP.exe
  C:\Windows\System\tbxCHdP.exe
  2⤵
  PID:10068
- C:\Windows\System\MrivFmq.exe
  C:\Windows\System\MrivFmq.exe
  2⤵
  PID:9992
- C:\Windows\System\rkjQAiT.exe
  C:\Windows\System\rkjQAiT.exe
  2⤵
  PID:10152
- C:\Windows\System\SgHvMvf.exe
  C:\Windows\System\SgHvMvf.exe
  2⤵
  PID:10192
- C:\Windows\System\nZeYFZK.exe
  C:\Windows\System\nZeYFZK.exe
  2⤵
  PID:10024
- C:\Windows\System\FZXbmhv.exe
  C:\Windows\System\FZXbmhv.exe
  2⤵
  PID:10056
- C:\Windows\System\RvDziCT.exe
  C:\Windows\System\RvDziCT.exe
  2⤵
  PID:9240
- C:\Windows\System\BWcjBvn.exe
  C:\Windows\System\BWcjBvn.exe
  2⤵
  PID:8640
- C:\Windows\System\BkCxAoE.exe
  C:\Windows\System\BkCxAoE.exe
  2⤵
  PID:9232
- C:\Windows\System\saTTYXO.exe
  C:\Windows\System\saTTYXO.exe
  2⤵
  PID:9308
- C:\Windows\System\XRtBxNo.exe
  C:\Windows\System\XRtBxNo.exe
  2⤵
  PID:3004
- C:\Windows\System\eyBBITN.exe
  C:\Windows\System\eyBBITN.exe
  2⤵
  PID:9432
- C:\Windows\System\GAAlQLm.exe
  C:\Windows\System\GAAlQLm.exe
  2⤵
  PID:9468
- C:\Windows\System\LaSLshu.exe
  C:\Windows\System\LaSLshu.exe
  2⤵
  PID:9484
- C:\Windows\System\gJEmqXg.exe
  C:\Windows\System\gJEmqXg.exe
  2⤵
  PID:9580
- C:\Windows\System\mSFZNCY.exe
  C:\Windows\System\mSFZNCY.exe
  2⤵
  PID:9660
- C:\Windows\System\WuCQGAq.exe
  C:\Windows\System\WuCQGAq.exe
  2⤵
  PID:9732
- C:\Windows\System\uHSBlCp.exe
  C:\Windows\System\uHSBlCp.exe
  2⤵
  PID:9748
- C:\Windows\System\JDQLWTS.exe
  C:\Windows\System\JDQLWTS.exe
  2⤵
  PID:9828
- C:\Windows\System\sONjdPy.exe
  C:\Windows\System\sONjdPy.exe
  2⤵
  PID:9804
- C:\Windows\System\wGCpRxo.exe
  C:\Windows\System\wGCpRxo.exe
  2⤵
  PID:9900
- C:\Windows\System\FVzfgnO.exe
  C:\Windows\System\FVzfgnO.exe
  2⤵
  PID:9936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GOCxGZw.exe

Filesize
1.3MB

MD5
93ca17c09ae5e3bb240c6f4380785dc0

SHA1
9923d777415baef8afa294511f30e144abb4a78f

SHA256
059eb3c756f7ddabc950e0bf7820c01c67be82f6fa8eaa6c8fbe3e24537c67fe

SHA512
aa71073cad8024e6071bc2194164d370a14153045c48bea0531f5dce7b1fc023d2a878beca309695b320e0f57e742469ff87ed808be034364539f76e0d685c1c

Download Submit
C:\Windows\system\IGSczdf.exe

Filesize
1.3MB

MD5
01d8d8dac21638ff8d7ec1e2c271deb1

SHA1
78fe146a19fafcf6e1543ecff8acc0487f3e08dd

SHA256
d5bf87d2362a7d6a321870407d9e27e9cba6f84f4e4091c163ecda48b824f85c

SHA512
b245c8084e92057d3a2347118601f57a13c90b6d08b811acdd761044349d390f3f70a54cda5cb4a13821cac981484bce4aad0257ac82458b607a8156e28005e5

Download Submit
C:\Windows\system\JPrDJRw.exe

Filesize
1.3MB

MD5
ee6f480c5826b4bf969c7c5d664e8493

SHA1
4a1f1424bb0dc8d460e554bce879050e7f934f2a

SHA256
8cec264517ae2d474b26515ef6303774467538e3fbd8df17d718191ef5de23b8

SHA512
fb3af733cc9afd6e07cf9e0c12a9e941a8335d85d6ce56b59d7cc1ae7e90c9c9f42d7cb10fc248ac0bf6456e5214e695d6a238950cbf4e47c085db522a21b4db

Download Submit
C:\Windows\system\JfIvmfw.exe

Filesize
1.3MB

MD5
a759aa4fd774e5ca7b3d17a87fa90513

SHA1
564ecabdfcdc68009d29df71e8248c5da4039641

SHA256
2d8dcf090c5ca855e749161312ca630af1cd273ffe12c4bb1aee3bb86316ca92

SHA512
e2a2630126dbd68f2a94cdf148919defcd1e2c56c58e418efc380fb04b8ad8591dcf757ff62edc9a406e81cd9152a6705ebe8e3b8cda14802bdecf5ea6c20a4a

Download Submit
C:\Windows\system\McKRDLD.exe

Filesize
1.3MB

MD5
41e179345ad353dab9cc35db88a53f61

SHA1
b6f3c768715b6cf763ac3735ac1fcd71cd03d489

SHA256
b1f6a809423a09914f426194d2cf595d532cc17645557bb38b0a0b8b0449a9bd

SHA512
da5a09e4cc767e1dc90e07862b97b75f45addf6f4416b228299916badf1dadca9f136401900d75a82c850d4948af089047a228326671ac04d9020ebda6299849

Download Submit
C:\Windows\system\PEqOwzm.exe

Filesize
1.3MB

MD5
84f89629cd399c62e331bb966b6c8aa3

SHA1
ce42ac6df70c990b2cc2f4a2abb332be11f734b0

SHA256
ae2e4fa83002534bf7c460446792f964f89fb6772e5a7a73df94a7dbdd32d03a

SHA512
b0a5d811c46302fb9b522e2ef837bfe3a8845fc0a99c84eba47a9fcf4baaf3b1101ed869bffa847b2b493dd1a03447d823fd0f99de1edbd30e5f6a719d515f63

Download Submit
C:\Windows\system\RdIgknt.exe

Filesize
1.3MB

MD5
57db5cd1c8ca6dc660947448fbdc2eb3

SHA1
432c8d6b90bbe432259a724e4a4cd36ab0e48f7d

SHA256
8ec615058f777174345edf544aeafcaa0d17e936ff1447a83af64ced11e47555

SHA512
415a7c68d9c5b03748eb470f04002fa72446bc6f11e01a8583eab3a0287c38e41d61d6594ef968318bb3fdee93934877c63a1dc79c4f32edc5c1ccb097558a67

Download Submit
C:\Windows\system\URPfejp.exe

Filesize
1.3MB

MD5
51693de23455c56e3420d3eb5fcf8115

SHA1
808ebb9398c398f398f8742b99027c310566b3f2

SHA256
7ab7898f67d41c165fff4a63689d002e1a592f64592f7305167fd844cc213e5a

SHA512
68dff47e1625d3483c1ab02af89061f4678b7ef43275fbc5967e6d9cfc2a544d6dd1dc4f3ed0e57eb3473eafc1807fa09a771330701796a6a171335d18397c5b

Download Submit
C:\Windows\system\WKnxQQE.exe

Filesize
1.3MB

MD5
a3e8797f9777018ba205253e52fe82f0

SHA1
cc6d9a35ef2f264bfc49a88a244b45c6d3f9cc3d

SHA256
092d892811f09e48107319ae9dc53843a287f9aa23390c001db45af290a50809

SHA512
89c5e43d38ac99082f90deed2cc5c8e3fdb54d1c0781d08b9cd0f8c2bf4ce970eb6b82a3332d971562a6b71c5be85657a2f4dd7f33f7971edef23285ac89ac23

Download Submit
C:\Windows\system\WQxzMwM.exe

Filesize
1.3MB

MD5
e43399a137612463b7e38083658ef63c

SHA1
6bac212d9ae65459af093766712499e75fcac404

SHA256
7f1e27d0f962b2ac4fa84955203925128277aec2a523abd041220acd9c78bcfb

SHA512
eb45983d6c31b280bbc1bde1a2f8599b61df84a4fe1ac831bf632f4cce8a7c7dc65696299e3cc3a84f18c5e85708481f7020706291debd179e766bb903fda206

Download Submit
C:\Windows\system\ZNrjMjE.exe

Filesize
1.3MB

MD5
d625d37278de428823f10e09e65a6027

SHA1
39c7e287d84cec0dbee94aead2193456c88c3389

SHA256
d18e466f44d49e7ec20c01b581e7888d320d42caaf60f98c0b21b1e643eb67dd

SHA512
27730d4c95ff415007d40e7fd5e888bb2c5504fae87a01a76960eaf9e44f65de9dec3b81916bb2fa9bad15612bc4cb2d6cc65510f5a3164ce1bf3a1d66a45607

Download Submit
C:\Windows\system\dguiSRF.exe

Filesize
1.3MB

MD5
d9282a276a9ad1f7b41768f030db5d32

SHA1
65a31a84fb51593222440633e545888e26aecca8

SHA256
77d43a466a06dacdd61643cefdadf611167462d3f6b3378eafa66ae451f5339f

SHA512
79013b13723cd419b2f2857eb9841c43224eba10826087eb331bc8807dc6f7907e7645d977328e764bd9a7eb156864403f601b363d3e9cfc387b8f0674e47c4b

Download Submit
C:\Windows\system\eSoVKLj.exe

Filesize
1.3MB

MD5
49760fdec862ec038727264b6761f665

SHA1
d3beb39c59cae108fbb43ad0cdb50d8a2762ad56

SHA256
a27d34ba3b4654930339889a5291cb4376392eae15e6161589b729756378a461

SHA512
ac862f6b9927e1a2aba34f88ea456c0a261b85a7ce875dd6a4ab1d1ae024213375b7728049a99d486d31b330864cdfedfd88dcebbde5ebff1f32b4d2079e5ccf

Download Submit
C:\Windows\system\fTCpcIz.exe

Filesize
1.3MB

MD5
4a0fdc3317c7338582e40342f2336cc8

SHA1
0c0fe60f7bcaacc68f84f7c2cd2264740760da73

SHA256
8d9486a0a2e9428acda21c0f22c6651ff06d8104c39d33def387d54e61102b09

SHA512
f87b61609495ed9cb71952dca519dffdd678511d7fcb2be71fe781ec6ab6ba436aaa85d72f303cbc333d937dea8fd4baf1d289f1e7270a3320ca7593752e746e

Download Submit
C:\Windows\system\ftWwRIk.exe

Filesize
1.3MB

MD5
049332d32545f319babb25e6e3cefe78

SHA1
de3b4b5683aefa2375f4597de3407a2a63736b24

SHA256
a4cc8fcf073eac2d629c38ceebcd58a2449a71020fce75c00fbf7d10c7b62239

SHA512
d1092bfe30dd8e266ffcf2a48cf5663ac7e7409d19f964f32c3aded6a34608ca6d87f3b5f53473c9ffeec03f7d1c201cbaf018abcc72ee6e1a39443434a8f5d2

Download Submit
C:\Windows\system\jOcsDlX.exe

Filesize
1.3MB

MD5
177fa6b634323837dbd52b433c2a537f

SHA1
134f84f3acfd044fdb09e36c8e4a30bf099a1df0

SHA256
341075511633945f3e2fefd8824c7fa8b962e6480465274d3d61bca7ec6a3a35

SHA512
49b657a115ccb4cd79720f5c58d6ed8d6131b4e6e56a1fbdaaa0aa220ce4bbcda272242196a32ad4c8d0a30a75165422a1999021616b095c0afeb0800c122664

Download Submit
C:\Windows\system\kEQPLyY.exe

Filesize
1.3MB

MD5
e1f99dfc4f920714995957cef880482b

SHA1
c66400f008e927d7ec9d3a7f8c2733158f9e1d93

SHA256
992afac3afec3d58ebe53db124cb1da15b00e740338c61995ba58e85a9f3b6e2

SHA512
fbbae441fb702e323cc128cbf355fccaada156a0496da7df9e74c2b2f3dc61c925a1ee3bd2aa2ca4b331a45bd50ced5a1d8ac9ebd184ec19fc12684a89e88dec

Download Submit
C:\Windows\system\kfqokMg.exe

Filesize
1.3MB

MD5
31b41e71747f12fae5e276b7bcb84baf

SHA1
eb8f6c83db233c1c0dedc3d25fb5fbc8437788cb

SHA256
089262fb24cd1ebadfe1ad2b5a4cad4d0ea4a8c295f328c975544b19c0b996d5

SHA512
05cc7be1c36cf2fb22c412513cc2e62756928ec44f3022c600cbead356d3b77751091d152f3160d8758aaed489f3550c8f760bb2a66d609029874346042ba9bc

Download Submit
C:\Windows\system\nrPpSpv.exe

Filesize
1.3MB

MD5
47f16e775d60f91eec6a1a93b9753e71

SHA1
d00ad1e377f2ae1925093fba931bdd4403848abd

SHA256
a5814d435d12625ac1e5e43812fa7cce50d2197805feb55867ad055c00ebcff4

SHA512
092a41f83e4f3670f21cf924751ac0c82e187dedd15a9751ad15093b77cc9f26e42a53aa65fcef4bc7ee4bc5c9d06a0f395e7b61fec394f1f108f575fc585901

Download Submit
C:\Windows\system\qeTXCyl.exe

Filesize
1.3MB

MD5
fa58bc97a246a7e1d3932a8f54ab1eb9

SHA1
c0ee46e2b41b52d1f47e5d27baa2bba65427c965

SHA256
23403e44a0fd2086f3016693269207dc5db82f4f3f2f6ff06c5714264d7fdfee

SHA512
32fc3634dd935dee7808dc4ea2cc6c4151b4cdab9bf40e35ceb4ecc61005e4be45fc34647de3ea362d04b6028b0f0863844d10b75052526fefb2bf09f3c7610a

Download Submit
C:\Windows\system\tFbzCUx.exe

Filesize
1.3MB

MD5
af721dbc6106b07b3175654815c77bdd

SHA1
9fe8dc0fdd425188d299258cbde9311cf7113972

SHA256
505e32744ac4ac785c0456906a642d4638d1ced77ef49633c02df46956019955

SHA512
5cf623a552de06fe53ea547ebdf431332fc60c0bfc3bba39fd32d0d05b43cc76b63b5c32d465c9d760ca2bd9859915bf9dd2d0dce02d19032deaa1972d5f6a04

Download Submit
C:\Windows\system\tUkwwWJ.exe

Filesize
1.3MB

MD5
9f606f0c5900f4ea853d441ccfd6354e

SHA1
84f6cc02b54e0a14ae09c265e42eef6ede187b2e

SHA256
f89838eec0de7a6da1b3e71f0ff1ce2c7b058ffa63a1666334a6ffd97b936680

SHA512
7b3f955af093fd757970df2ddbab8014dbddb1022049f0da44549eff669bbe296e7ba119ca756255af35251eab47e32dec64323d48124c5de42dac48356a8c1d

Download Submit
C:\Windows\system\uksSpoQ.exe

Filesize
1.3MB

MD5
9e9e97fdbff2c4ecdcc30af20ce9aee7

SHA1
e98784294350bcb2f7ac02d1054489c176720661

SHA256
4a1ccebd4397154a1f10a5d042fc98da70e66c5ea8c74a82542827dae66e1a38

SHA512
84a2825913545eeaf1bab4428ef4f64462c7735372cb9215ec1ab2d6bc6b1ba0e497266532bbfd76a4cb07d123653a4f2086f784bd1fab3f143761d565cb80a6

Download Submit
C:\Windows\system\vyifRWq.exe

Filesize
1.3MB

MD5
1e0eba340e4a3eb4a2a8dcc845407b63

SHA1
82ae1a46fe24f0564c54162cdc4fc2177285e902

SHA256
5d4202e8add8a1822b9fe1992aba7db1d6d456118c14883918dbfa0bceb81152

SHA512
a85053163f04448b2b9c2dd0ce66e16a4c39febaf6c3850798c9661c36f62a853ca688879e785992336a58097a18805629372f6b7049260b6c9a7f8dba6dfdcc

Download Submit
C:\Windows\system\xEzfkAV.exe

Filesize
1.3MB

MD5
c0ca462b133895b23eb7cf0bdb9b628a

SHA1
799ab87a3f3cdfc1013d17f350d122799bf0b92c

SHA256
9f5632faa1cfc9559ed144076bf5a17943c2dfdc466bd904f5f41afe22931a7b

SHA512
1b051e3e78f11d3cf8818e3539a10e13514194981574a2bb72de58cd34d7514e9062406795491f68f3a41faf1cd763ece10b5e8939bc901b2a45bf86ebf9b0a4

Download Submit
\Windows\system\BVwJaca.exe

Filesize
1.3MB

MD5
fb5e38ea20d61fa009c7520f45cc90e2

SHA1
d27e5fbe1e5697f2d9d041019e30f144094495a8

SHA256
a9435d344eebecd20e1d150aa001a57d34213e6822c8e94a7c14bb6307c5468f

SHA512
155d087c6e3d4b217dbb72b02273a0f81ae05f82a8f51def46efe6c3e134d3b870376a5b7a6448a42a4c6f22dd788364ff0600733c1277eae09090105ab82dae

Download Submit
\Windows\system\KaglmoF.exe

Filesize
1.3MB

MD5
61760a08e6010a2db76b63e703d706e6

SHA1
6a1b411b47683308904ff06b738acadd708552e6

SHA256
526906765a77207a7bd29f93c257779477481591d70191fc200e346dcdb13661

SHA512
eeab10efd4fdd8db3002308763f9a4cc1fe378ba4c2b306ef341724c2f9eec82648512f2d5dfee5180af7eadac5efacc52c8f2f7be658753ee05bcd9695ffd96

Download Submit
\Windows\system\OcBbSzP.exe

Filesize
1.3MB

MD5
a5ef7fcbf9ce32a7424f45baf1fabef7

SHA1
848e12e5dd3d5f35b5c1166fd9824c0ed02f5922

SHA256
44ba1cae058c3cd82048e64325edb0749be487f656ce13348e4930cc2f9254e8

SHA512
8c61f568ac04740756d338ea8f43eef46a08dc7e70d41aed93ad5454b12f587f3df1bae3ff618420948698723742573f9bdfac08607a39984200baad5326850b

Download Submit
\Windows\system\QplDsrg.exe

Filesize
1.3MB

MD5
6eff094fb3d15532060bab2ab609420c

SHA1
8d77e25e7b43b3e209ac963c1dba78b3acbdff3c

SHA256
a5388c30ccf068fe7b363762d074b918e01408e6193d69693c1077bbce0ef47e

SHA512
4509bb07190be0fdff832133b6fc67aee0085e386221f3404791b624a14cd0e8d5e4ea1a05f179508c153bf67c74131c9ae28c035a689ec5ad73e980d8434aa9

Download Submit
\Windows\system\iwnIIOo.exe

Filesize
1.3MB

MD5
8c1ff067fada4592f8ad4fda9439dc42

SHA1
8c1e659d947bb48a1a355b5fdca9f812fea8e95c

SHA256
3d3d984d1bf8b1ffbfa6c5411797023a4ebc124cb4b322535c41be79f2bd43f3

SHA512
9390291b44b8c2845fcc5efab53ba31b0559f5427ae1fbcfc1d82207a3a73f85c34f73213ab87191f6a18f32671616366342638bd9dbfff74292770b98a81a43

Download Submit
\Windows\system\nkqvNLo.exe

Filesize
1.3MB

MD5
263fe4d3979be13c02c43b40173573c8

SHA1
4e7c2aff4349a32e10b212a4d2e43609e8b4773b

SHA256
c0b084ae522b856ceefb15a46391531436610c9136f94d9659f76fcd3a6fa46a

SHA512
6b11eface23725890d39c40d336f6751fbab8e0806030d0d033d357c374da0e080845ca8a7d3aa5f7d6face1bb4cf6341ec4c88198a78adb3fda79afca29b11e

Download Submit
\Windows\system\vFBxbAY.exe

Filesize
1.3MB

MD5
6348daa21fb4dceee0f65fed531ccf7d

SHA1
8ed56172745f78c9f843a5b28f1f35eece5eccf3

SHA256
3ccdbf91cb7ef0798b8be11319c28b9d496a0b0da9d39b1fd5286d16c6dae46b

SHA512
44b3c4a7ae672951713c29a42c9b8b3d8e38db779095ec97d3463af30d96673607b6b723799180dedea7b241622d60dd02777ce849bf043416b38af895781d9f

Download Submit
memory/2116-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download