xmrig | ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
Size

1.7MB
MD5

192bc2bc35711bec72e0ea9fad630c95
SHA1

4fb095f81e6a82a0c5befa9bd7b899d6a13686bc
SHA256

ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6
SHA512

1cb39f33494c2af1a08f916743165b621ebe98eb4020015e7369e85e8ebb418fcbe71e26433bb1978a9e65354e4b02ee961aa6dfb977d15f9ddc5ef06d85b0a9
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYOMSO:GemTLkNdfE0pZyl

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012266-5.dat	xmrig
behavioral1/files/0x002b0000000195bb-6.dat	xmrig
behavioral1/files/0x00080000000195c6-12.dat	xmrig
behavioral1/files/0x000600000001960c-17.dat	xmrig
behavioral1/files/0x000600000001975a-25.dat	xmrig
behavioral1/files/0x00080000000197fd-29.dat	xmrig
behavioral1/files/0x000600000001a03c-35.dat	xmrig
behavioral1/files/0x002a0000000195bd-39.dat	xmrig
behavioral1/files/0x000500000001a480-45.dat	xmrig
behavioral1/files/0x000500000001a482-49.dat	xmrig
behavioral1/files/0x000500000001a486-59.dat	xmrig
behavioral1/files/0x000500000001a48a-69.dat	xmrig
behavioral1/files/0x000500000001a499-95.dat	xmrig
behavioral1/files/0x000500000001a49e-104.dat	xmrig
behavioral1/files/0x000500000001a49f-109.dat	xmrig
behavioral1/files/0x000500000001a4a9-125.dat	xmrig
behavioral1/files/0x000500000001a4b4-144.dat	xmrig
behavioral1/files/0x000500000001a4ff-159.dat	xmrig
behavioral1/files/0x000500000001a4bf-154.dat	xmrig
behavioral1/files/0x000500000001a4ba-149.dat	xmrig
behavioral1/files/0x000500000001a4ad-140.dat	xmrig
behavioral1/files/0x000500000001a4ab-129.dat	xmrig
behavioral1/files/0x000500000001a4ac-134.dat	xmrig
behavioral1/files/0x000500000001a4a2-119.dat	xmrig
behavioral1/files/0x000500000001a4a1-115.dat	xmrig
behavioral1/files/0x000500000001a49a-99.dat	xmrig
behavioral1/files/0x000500000001a493-89.dat	xmrig
behavioral1/files/0x000500000001a491-85.dat	xmrig
behavioral1/files/0x000500000001a48f-79.dat	xmrig
behavioral1/files/0x000500000001a48d-75.dat	xmrig
behavioral1/files/0x000500000001a488-65.dat	xmrig
behavioral1/files/0x000500000001a484-55.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2928	ofyPSrn.exe
2824	rzwYpOc.exe
2780	GtqlUAb.exe
2688	JkzpfNv.exe
2832	ssnUhFZ.exe
2664	lZKarSX.exe
2736	dhPUyGx.exe
1876	DylkepF.exe
2108	OiUTLsh.exe
612	GvUvCVx.exe
2192	klZCMSn.exe
2640	CeeQIFG.exe
1180	IiJNusd.exe
1676	BjTnVkG.exe
2136	rMElSdt.exe
2276	liFmqmw.exe
2364	kKseONe.exe
1988	qwASYUd.exe
2720	nBuxiSQ.exe
2924	sTXwrJg.exe
2996	mogQAcD.exe
2760	WakGdcU.exe
2452	UsTyMSF.exe
2444	DJBPNpS.exe
2356	mCFpwrB.exe
264	GKQANVm.exe
592	JNVASnA.exe
2480	WyXwjYa.exe
2380	QTNEMPm.exe
948	EaUSapL.exe
2384	pnUJljI.exe
2084	EiFqRZy.exe
1904	qVetjfy.exe
1292	vwNssmP.exe
1768	fQNAqYM.exe
2424	TYyRXbU.exe
2548	RoIjWuj.exe
112	onkgLgJ.exe
1520	XmrtqKD.exe
2224	fihqiLa.exe
2256	jRIdbyU.exe
1528	ADYLISl.exe
1540	nWNbAcl.exe
800	cTPDdNP.exe
940	noDwmtU.exe
860	lIfVQwN.exe
1632	vCRxqQN.exe
1740	cinbxrc.exe
1204	rNbnYVL.exe
1724	QBqneWw.exe
1508	GNLWnOJ.exe
536	kEuIhDC.exe
2612	isQnQXp.exe
2320	ikIXCGA.exe
2128	CFEDPaL.exe
2576	EZaRjKi.exe
1748	lvIZKTR.exe
2572	OcKvhcR.exe
1144	VtzdEDH.exe
1456	WSjNSml.exe
1092	hIQQpfd.exe
3052	UURQFZu.exe
2792	eqkZuGw.exe
1568	yZVsrFP.exe

Loads dropped DLL 64 IoCs

pid	Process
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HNLRqWe.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\wAlAwPr.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\jSvqDHx.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\SiXOrmZ.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\RfUonrI.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\wqIzNBp.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\eyDRoQb.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\DdpLqAM.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\ZciiAyc.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\ihpXgJt.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\AUTKghh.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\lamQeQW.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\jVsGdhL.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\czjdhXh.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\xVrWDby.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\arGKSnD.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\wKqhDmi.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\KKgQSIW.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\YGtOpkI.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\DJSKDiS.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\tnIxvao.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\AAobgHS.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\mrygfPc.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\SKRoSnC.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\ydwWWie.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\gLvcTqY.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\mTLLgcR.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\MMVEjjh.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\HmqyUuA.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\yxFRezj.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\SqFFGNI.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\rLIACUP.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\PjuKHuw.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\LPzvYXe.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\YNKgtyk.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\TYyRXbU.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\LsNkMgQ.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\mySoHZt.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\aUstUHL.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\GNLWnOJ.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\ULaKGnb.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\TySgcWT.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\FMxdrqZ.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\PVDwdod.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\ZPrUVQt.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\cmGHFvk.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\eewDaoS.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\wQmTBLd.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\JBxVVzU.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\cUupDLE.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\DWrXwZC.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\BzyuEbr.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\EBKTNaN.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\sluzcXe.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\JJIfSqX.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\wqFbIEJ.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\rFvXlfp.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\jJAwPJO.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\bRylavo.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\HeAWsvV.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\dORJphc.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\qlvagtR.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\dkgDQhN.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
File created	C:\Windows\System\EPcJQqq.exe	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2928	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	31
PID 3064 wrote to memory of 2928	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	31
PID 3064 wrote to memory of 2928	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	31
PID 3064 wrote to memory of 2824	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	32
PID 3064 wrote to memory of 2824	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	32
PID 3064 wrote to memory of 2824	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	32
PID 3064 wrote to memory of 2780	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	33
PID 3064 wrote to memory of 2780	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	33
PID 3064 wrote to memory of 2780	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	33
PID 3064 wrote to memory of 2688	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	34
PID 3064 wrote to memory of 2688	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	34
PID 3064 wrote to memory of 2688	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	34
PID 3064 wrote to memory of 2832	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	35
PID 3064 wrote to memory of 2832	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	35
PID 3064 wrote to memory of 2832	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	35
PID 3064 wrote to memory of 2664	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	36
PID 3064 wrote to memory of 2664	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	36
PID 3064 wrote to memory of 2664	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	36
PID 3064 wrote to memory of 2736	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	37
PID 3064 wrote to memory of 2736	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	37
PID 3064 wrote to memory of 2736	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	37
PID 3064 wrote to memory of 1876	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	38
PID 3064 wrote to memory of 1876	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	38
PID 3064 wrote to memory of 1876	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	38
PID 3064 wrote to memory of 2108	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	39
PID 3064 wrote to memory of 2108	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	39
PID 3064 wrote to memory of 2108	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	39
PID 3064 wrote to memory of 612	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	40
PID 3064 wrote to memory of 612	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	40
PID 3064 wrote to memory of 612	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	40
PID 3064 wrote to memory of 2192	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	41
PID 3064 wrote to memory of 2192	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	41
PID 3064 wrote to memory of 2192	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	41
PID 3064 wrote to memory of 2640	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	42
PID 3064 wrote to memory of 2640	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	42
PID 3064 wrote to memory of 2640	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	42
PID 3064 wrote to memory of 1180	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	43
PID 3064 wrote to memory of 1180	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	43
PID 3064 wrote to memory of 1180	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	43
PID 3064 wrote to memory of 1676	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	44
PID 3064 wrote to memory of 1676	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	44
PID 3064 wrote to memory of 1676	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	44
PID 3064 wrote to memory of 2136	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	45
PID 3064 wrote to memory of 2136	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	45
PID 3064 wrote to memory of 2136	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	45
PID 3064 wrote to memory of 2276	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	46
PID 3064 wrote to memory of 2276	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	46
PID 3064 wrote to memory of 2276	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	46
PID 3064 wrote to memory of 2364	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	47
PID 3064 wrote to memory of 2364	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	47
PID 3064 wrote to memory of 2364	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	47
PID 3064 wrote to memory of 1988	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	48
PID 3064 wrote to memory of 1988	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	48
PID 3064 wrote to memory of 1988	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	48
PID 3064 wrote to memory of 2720	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	49
PID 3064 wrote to memory of 2720	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	49
PID 3064 wrote to memory of 2720	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	49
PID 3064 wrote to memory of 2924	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	50
PID 3064 wrote to memory of 2924	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	50
PID 3064 wrote to memory of 2924	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	50
PID 3064 wrote to memory of 2996	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	51
PID 3064 wrote to memory of 2996	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	51
PID 3064 wrote to memory of 2996	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	51
PID 3064 wrote to memory of 2760	3064	ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe	52

C:\Users\Admin\AppData\Local\Temp\ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe
"C:\Users\Admin\AppData\Local\Temp\ecd99882e0a658341b8fd00e5acbadf3ee19f46f9aa33da6243186469222aeb6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System\ofyPSrn.exe
  C:\Windows\System\ofyPSrn.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\rzwYpOc.exe
  C:\Windows\System\rzwYpOc.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\GtqlUAb.exe
  C:\Windows\System\GtqlUAb.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JkzpfNv.exe
  C:\Windows\System\JkzpfNv.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ssnUhFZ.exe
  C:\Windows\System\ssnUhFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\lZKarSX.exe
  C:\Windows\System\lZKarSX.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\dhPUyGx.exe
  C:\Windows\System\dhPUyGx.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\DylkepF.exe
  C:\Windows\System\DylkepF.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\OiUTLsh.exe
  C:\Windows\System\OiUTLsh.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\GvUvCVx.exe
  C:\Windows\System\GvUvCVx.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\klZCMSn.exe
  C:\Windows\System\klZCMSn.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\CeeQIFG.exe
  C:\Windows\System\CeeQIFG.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\IiJNusd.exe
  C:\Windows\System\IiJNusd.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\BjTnVkG.exe
  C:\Windows\System\BjTnVkG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rMElSdt.exe
  C:\Windows\System\rMElSdt.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\liFmqmw.exe
  C:\Windows\System\liFmqmw.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\kKseONe.exe
  C:\Windows\System\kKseONe.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\qwASYUd.exe
  C:\Windows\System\qwASYUd.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\nBuxiSQ.exe
  C:\Windows\System\nBuxiSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\sTXwrJg.exe
  C:\Windows\System\sTXwrJg.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\mogQAcD.exe
  C:\Windows\System\mogQAcD.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WakGdcU.exe
  C:\Windows\System\WakGdcU.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\UsTyMSF.exe
  C:\Windows\System\UsTyMSF.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DJBPNpS.exe
  C:\Windows\System\DJBPNpS.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\mCFpwrB.exe
  C:\Windows\System\mCFpwrB.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\GKQANVm.exe
  C:\Windows\System\GKQANVm.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\JNVASnA.exe
  C:\Windows\System\JNVASnA.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\WyXwjYa.exe
  C:\Windows\System\WyXwjYa.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QTNEMPm.exe
  C:\Windows\System\QTNEMPm.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\EaUSapL.exe
  C:\Windows\System\EaUSapL.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pnUJljI.exe
  C:\Windows\System\pnUJljI.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\EiFqRZy.exe
  C:\Windows\System\EiFqRZy.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qVetjfy.exe
  C:\Windows\System\qVetjfy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\vwNssmP.exe
  C:\Windows\System\vwNssmP.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\fQNAqYM.exe
  C:\Windows\System\fQNAqYM.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\TYyRXbU.exe
  C:\Windows\System\TYyRXbU.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\RoIjWuj.exe
  C:\Windows\System\RoIjWuj.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\onkgLgJ.exe
  C:\Windows\System\onkgLgJ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\XmrtqKD.exe
  C:\Windows\System\XmrtqKD.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fihqiLa.exe
  C:\Windows\System\fihqiLa.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\jRIdbyU.exe
  C:\Windows\System\jRIdbyU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ADYLISl.exe
  C:\Windows\System\ADYLISl.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\nWNbAcl.exe
  C:\Windows\System\nWNbAcl.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\cTPDdNP.exe
  C:\Windows\System\cTPDdNP.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\noDwmtU.exe
  C:\Windows\System\noDwmtU.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\lIfVQwN.exe
  C:\Windows\System\lIfVQwN.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\vCRxqQN.exe
  C:\Windows\System\vCRxqQN.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\cinbxrc.exe
  C:\Windows\System\cinbxrc.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\rNbnYVL.exe
  C:\Windows\System\rNbnYVL.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\QBqneWw.exe
  C:\Windows\System\QBqneWw.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\GNLWnOJ.exe
  C:\Windows\System\GNLWnOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\kEuIhDC.exe
  C:\Windows\System\kEuIhDC.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\isQnQXp.exe
  C:\Windows\System\isQnQXp.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ikIXCGA.exe
  C:\Windows\System\ikIXCGA.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CFEDPaL.exe
  C:\Windows\System\CFEDPaL.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\EZaRjKi.exe
  C:\Windows\System\EZaRjKi.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\lvIZKTR.exe
  C:\Windows\System\lvIZKTR.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\OcKvhcR.exe
  C:\Windows\System\OcKvhcR.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\VtzdEDH.exe
  C:\Windows\System\VtzdEDH.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\WSjNSml.exe
  C:\Windows\System\WSjNSml.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\hIQQpfd.exe
  C:\Windows\System\hIQQpfd.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\UURQFZu.exe
  C:\Windows\System\UURQFZu.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\eqkZuGw.exe
  C:\Windows\System\eqkZuGw.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\yZVsrFP.exe
  C:\Windows\System\yZVsrFP.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\TVNicbB.exe
  C:\Windows\System\TVNicbB.exe
  2⤵
  PID:1704
- C:\Windows\System\DvJXMZz.exe
  C:\Windows\System\DvJXMZz.exe
  2⤵
  PID:2900
- C:\Windows\System\gIfuVnx.exe
  C:\Windows\System\gIfuVnx.exe
  2⤵
  PID:2496
- C:\Windows\System\RfItWkw.exe
  C:\Windows\System\RfItWkw.exe
  2⤵
  PID:3032
- C:\Windows\System\RYPbvQX.exe
  C:\Windows\System\RYPbvQX.exe
  2⤵
  PID:2892
- C:\Windows\System\CKRWanP.exe
  C:\Windows\System\CKRWanP.exe
  2⤵
  PID:2660
- C:\Windows\System\YDgaAYs.exe
  C:\Windows\System\YDgaAYs.exe
  2⤵
  PID:2724
- C:\Windows\System\BRSxRDV.exe
  C:\Windows\System\BRSxRDV.exe
  2⤵
  PID:1688
- C:\Windows\System\umoTnNK.exe
  C:\Windows\System\umoTnNK.exe
  2⤵
  PID:2836
- C:\Windows\System\PooanLR.exe
  C:\Windows\System\PooanLR.exe
  2⤵
  PID:1416
- C:\Windows\System\xsvJgEP.exe
  C:\Windows\System\xsvJgEP.exe
  2⤵
  PID:2196
- C:\Windows\System\wZNlxcH.exe
  C:\Windows\System\wZNlxcH.exe
  2⤵
  PID:1056
- C:\Windows\System\niduqxX.exe
  C:\Windows\System\niduqxX.exe
  2⤵
  PID:1672
- C:\Windows\System\awKUgBU.exe
  C:\Windows\System\awKUgBU.exe
  2⤵
  PID:2168
- C:\Windows\System\AhTPMiW.exe
  C:\Windows\System\AhTPMiW.exe
  2⤵
  PID:2204
- C:\Windows\System\vvZDugB.exe
  C:\Windows\System\vvZDugB.exe
  2⤵
  PID:3016
- C:\Windows\System\cjbyFzw.exe
  C:\Windows\System\cjbyFzw.exe
  2⤵
  PID:2644
- C:\Windows\System\PxRJdGV.exe
  C:\Windows\System\PxRJdGV.exe
  2⤵
  PID:3036
- C:\Windows\System\PPxbeLQ.exe
  C:\Windows\System\PPxbeLQ.exe
  2⤵
  PID:3020
- C:\Windows\System\aWqPtTq.exe
  C:\Windows\System\aWqPtTq.exe
  2⤵
  PID:2292
- C:\Windows\System\bdkpyuM.exe
  C:\Windows\System\bdkpyuM.exe
  2⤵
  PID:1020
- C:\Windows\System\omOKxzs.exe
  C:\Windows\System\omOKxzs.exe
  2⤵
  PID:236
- C:\Windows\System\EFkeAjq.exe
  C:\Windows\System\EFkeAjq.exe
  2⤵
  PID:1756
- C:\Windows\System\BxiHdqH.exe
  C:\Windows\System\BxiHdqH.exe
  2⤵
  PID:1708
- C:\Windows\System\TtdMOSb.exe
  C:\Windows\System\TtdMOSb.exe
  2⤵
  PID:2252
- C:\Windows\System\FRSEoYP.exe
  C:\Windows\System\FRSEoYP.exe
  2⤵
  PID:2880
- C:\Windows\System\jiIlIqL.exe
  C:\Windows\System\jiIlIqL.exe
  2⤵
  PID:560
- C:\Windows\System\eVDnzJB.exe
  C:\Windows\System\eVDnzJB.exe
  2⤵
  PID:672
- C:\Windows\System\kwVBxQd.exe
  C:\Windows\System\kwVBxQd.exe
  2⤵
  PID:976
- C:\Windows\System\XjfRDMr.exe
  C:\Windows\System\XjfRDMr.exe
  2⤵
  PID:704
- C:\Windows\System\TPfoTxY.exe
  C:\Windows\System\TPfoTxY.exe
  2⤵
  PID:2552
- C:\Windows\System\aHsPxrn.exe
  C:\Windows\System\aHsPxrn.exe
  2⤵
  PID:776
- C:\Windows\System\UTfzSAf.exe
  C:\Windows\System\UTfzSAf.exe
  2⤵
  PID:652
- C:\Windows\System\PRlRQiZ.exe
  C:\Windows\System\PRlRQiZ.exe
  2⤵
  PID:1964
- C:\Windows\System\hoFyPsx.exe
  C:\Windows\System\hoFyPsx.exe
  2⤵
  PID:1920
- C:\Windows\System\yfttauf.exe
  C:\Windows\System\yfttauf.exe
  2⤵
  PID:1376
- C:\Windows\System\cElVDcJ.exe
  C:\Windows\System\cElVDcJ.exe
  2⤵
  PID:2672
- C:\Windows\System\ArgbmLQ.exe
  C:\Windows\System\ArgbmLQ.exe
  2⤵
  PID:836
- C:\Windows\System\WZrxpKj.exe
  C:\Windows\System\WZrxpKj.exe
  2⤵
  PID:2580
- C:\Windows\System\QxcYCHK.exe
  C:\Windows\System\QxcYCHK.exe
  2⤵
  PID:1888
- C:\Windows\System\VGbrpJh.exe
  C:\Windows\System\VGbrpJh.exe
  2⤵
  PID:1924
- C:\Windows\System\myBBXku.exe
  C:\Windows\System\myBBXku.exe
  2⤵
  PID:2696
- C:\Windows\System\ZkTqzpj.exe
  C:\Windows\System\ZkTqzpj.exe
  2⤵
  PID:2400
- C:\Windows\System\roCOsiY.exe
  C:\Windows\System\roCOsiY.exe
  2⤵
  PID:428
- C:\Windows\System\awZCvkm.exe
  C:\Windows\System\awZCvkm.exe
  2⤵
  PID:2468
- C:\Windows\System\rLIACUP.exe
  C:\Windows\System\rLIACUP.exe
  2⤵
  PID:2164
- C:\Windows\System\bzqrjlY.exe
  C:\Windows\System\bzqrjlY.exe
  2⤵
  PID:2492
- C:\Windows\System\YhmbUyD.exe
  C:\Windows\System\YhmbUyD.exe
  2⤵
  PID:1248
- C:\Windows\System\qhPnsfT.exe
  C:\Windows\System\qhPnsfT.exe
  2⤵
  PID:1348
- C:\Windows\System\gXuPnif.exe
  C:\Windows\System\gXuPnif.exe
  2⤵
  PID:2288
- C:\Windows\System\nUIhLop.exe
  C:\Windows\System\nUIhLop.exe
  2⤵
  PID:1080
- C:\Windows\System\mUqXGSo.exe
  C:\Windows\System\mUqXGSo.exe
  2⤵
  PID:464
- C:\Windows\System\JnkbJxP.exe
  C:\Windows\System\JnkbJxP.exe
  2⤵
  PID:1872
- C:\Windows\System\iHcfWSW.exe
  C:\Windows\System\iHcfWSW.exe
  2⤵
  PID:520
- C:\Windows\System\CMhdVNo.exe
  C:\Windows\System\CMhdVNo.exe
  2⤵
  PID:2228
- C:\Windows\System\WKBzYpT.exe
  C:\Windows\System\WKBzYpT.exe
  2⤵
  PID:2504
- C:\Windows\System\wEcetRf.exe
  C:\Windows\System\wEcetRf.exe
  2⤵
  PID:2456
- C:\Windows\System\jlkGvKE.exe
  C:\Windows\System\jlkGvKE.exe
  2⤵
  PID:2100
- C:\Windows\System\WVyclFf.exe
  C:\Windows\System\WVyclFf.exe
  2⤵
  PID:1096
- C:\Windows\System\OijKsaM.exe
  C:\Windows\System\OijKsaM.exe
  2⤵
  PID:764
- C:\Windows\System\JGHOXCw.exe
  C:\Windows\System\JGHOXCw.exe
  2⤵
  PID:2704
- C:\Windows\System\XSDgQDi.exe
  C:\Windows\System\XSDgQDi.exe
  2⤵
  PID:2500
- C:\Windows\System\bixsoUr.exe
  C:\Windows\System\bixsoUr.exe
  2⤵
  PID:2884
- C:\Windows\System\moATXup.exe
  C:\Windows\System\moATXup.exe
  2⤵
  PID:1100
- C:\Windows\System\YrXJLIg.exe
  C:\Windows\System\YrXJLIg.exe
  2⤵
  PID:2692
- C:\Windows\System\SgbtUeU.exe
  C:\Windows\System\SgbtUeU.exe
  2⤵
  PID:2816
- C:\Windows\System\eMJtXNx.exe
  C:\Windows\System\eMJtXNx.exe
  2⤵
  PID:2216
- C:\Windows\System\DEExhld.exe
  C:\Windows\System\DEExhld.exe
  2⤵
  PID:2544
- C:\Windows\System\aOJgSmX.exe
  C:\Windows\System\aOJgSmX.exe
  2⤵
  PID:2392
- C:\Windows\System\dSqtBOg.exe
  C:\Windows\System\dSqtBOg.exe
  2⤵
  PID:2372
- C:\Windows\System\nwwrasE.exe
  C:\Windows\System\nwwrasE.exe
  2⤵
  PID:2524
- C:\Windows\System\eFIMeLM.exe
  C:\Windows\System\eFIMeLM.exe
  2⤵
  PID:1976
- C:\Windows\System\QEqcDiU.exe
  C:\Windows\System\QEqcDiU.exe
  2⤵
  PID:2200
- C:\Windows\System\HBxHRkc.exe
  C:\Windows\System\HBxHRkc.exe
  2⤵
  PID:768
- C:\Windows\System\RkFvllO.exe
  C:\Windows\System\RkFvllO.exe
  2⤵
  PID:2620
- C:\Windows\System\BcPuWIw.exe
  C:\Windows\System\BcPuWIw.exe
  2⤵
  PID:1808
- C:\Windows\System\dLJtotp.exe
  C:\Windows\System\dLJtotp.exe
  2⤵
  PID:1624
- C:\Windows\System\QMbZwoP.exe
  C:\Windows\System\QMbZwoP.exe
  2⤵
  PID:1116
- C:\Windows\System\zpOBUvH.exe
  C:\Windows\System\zpOBUvH.exe
  2⤵
  PID:2516
- C:\Windows\System\FJkrEWp.exe
  C:\Windows\System\FJkrEWp.exe
  2⤵
  PID:1692
- C:\Windows\System\JTlelpT.exe
  C:\Windows\System\JTlelpT.exe
  2⤵
  PID:2056
- C:\Windows\System\vwECrLH.exe
  C:\Windows\System\vwECrLH.exe
  2⤵
  PID:2556
- C:\Windows\System\EjBUzGI.exe
  C:\Windows\System\EjBUzGI.exe
  2⤵
  PID:888
- C:\Windows\System\HNLRqWe.exe
  C:\Windows\System\HNLRqWe.exe
  2⤵
  PID:2856
- C:\Windows\System\IXAZKHw.exe
  C:\Windows\System\IXAZKHw.exe
  2⤵
  PID:2156
- C:\Windows\System\rFvXlfp.exe
  C:\Windows\System\rFvXlfp.exe
  2⤵
  PID:2300
- C:\Windows\System\duhZzsH.exe
  C:\Windows\System\duhZzsH.exe
  2⤵
  PID:2180
- C:\Windows\System\HfMlbjy.exe
  C:\Windows\System\HfMlbjy.exe
  2⤵
  PID:2728
- C:\Windows\System\rEZDgCt.exe
  C:\Windows\System\rEZDgCt.exe
  2⤵
  PID:2064
- C:\Windows\System\jEseBCU.exe
  C:\Windows\System\jEseBCU.exe
  2⤵
  PID:2860
- C:\Windows\System\pwjLwwz.exe
  C:\Windows\System\pwjLwwz.exe
  2⤵
  PID:2312
- C:\Windows\System\ULaKGnb.exe
  C:\Windows\System\ULaKGnb.exe
  2⤵
  PID:2428
- C:\Windows\System\zipzgIA.exe
  C:\Windows\System\zipzgIA.exe
  2⤵
  PID:1228
- C:\Windows\System\STcLgtP.exe
  C:\Windows\System\STcLgtP.exe
  2⤵
  PID:2584
- C:\Windows\System\yqRzlIp.exe
  C:\Windows\System\yqRzlIp.exe
  2⤵
  PID:2488
- C:\Windows\System\ExjZUIS.exe
  C:\Windows\System\ExjZUIS.exe
  2⤵
  PID:1752
- C:\Windows\System\YEOCsdg.exe
  C:\Windows\System\YEOCsdg.exe
  2⤵
  PID:1408
- C:\Windows\System\GnlTppO.exe
  C:\Windows\System\GnlTppO.exe
  2⤵
  PID:1604
- C:\Windows\System\yMFCyAB.exe
  C:\Windows\System\yMFCyAB.exe
  2⤵
  PID:2604
- C:\Windows\System\LoqtgHr.exe
  C:\Windows\System\LoqtgHr.exe
  2⤵
  PID:2964
- C:\Windows\System\nkKRJWH.exe
  C:\Windows\System\nkKRJWH.exe
  2⤵
  PID:1928
- C:\Windows\System\RrPvgib.exe
  C:\Windows\System\RrPvgib.exe
  2⤵
  PID:3024
- C:\Windows\System\bAWNBsY.exe
  C:\Windows\System\bAWNBsY.exe
  2⤵
  PID:2536
- C:\Windows\System\tSMsIlQ.exe
  C:\Windows\System\tSMsIlQ.exe
  2⤵
  PID:2236
- C:\Windows\System\fKFCexz.exe
  C:\Windows\System\fKFCexz.exe
  2⤵
  PID:1484
- C:\Windows\System\tqCVwca.exe
  C:\Windows\System\tqCVwca.exe
  2⤵
  PID:2284
- C:\Windows\System\PjuKHuw.exe
  C:\Windows\System\PjuKHuw.exe
  2⤵
  PID:3068
- C:\Windows\System\UQHqLAC.exe
  C:\Windows\System\UQHqLAC.exe
  2⤵
  PID:3080
- C:\Windows\System\cZIeFFX.exe
  C:\Windows\System\cZIeFFX.exe
  2⤵
  PID:3096
- C:\Windows\System\utlLStK.exe
  C:\Windows\System\utlLStK.exe
  2⤵
  PID:3116
- C:\Windows\System\UvixAoD.exe
  C:\Windows\System\UvixAoD.exe
  2⤵
  PID:3136
- C:\Windows\System\zeLmpLH.exe
  C:\Windows\System\zeLmpLH.exe
  2⤵
  PID:3164
- C:\Windows\System\ixafjmc.exe
  C:\Windows\System\ixafjmc.exe
  2⤵
  PID:3180
- C:\Windows\System\YOCRalo.exe
  C:\Windows\System\YOCRalo.exe
  2⤵
  PID:3200
- C:\Windows\System\LUjTKtQ.exe
  C:\Windows\System\LUjTKtQ.exe
  2⤵
  PID:3240
- C:\Windows\System\xGZWEWp.exe
  C:\Windows\System\xGZWEWp.exe
  2⤵
  PID:3260
- C:\Windows\System\bYoSIZc.exe
  C:\Windows\System\bYoSIZc.exe
  2⤵
  PID:3276
- C:\Windows\System\EqSEhqa.exe
  C:\Windows\System\EqSEhqa.exe
  2⤵
  PID:3296
- C:\Windows\System\ALkTKtu.exe
  C:\Windows\System\ALkTKtu.exe
  2⤵
  PID:3316
- C:\Windows\System\MYpGbvW.exe
  C:\Windows\System\MYpGbvW.exe
  2⤵
  PID:3340
- C:\Windows\System\wMXfRLm.exe
  C:\Windows\System\wMXfRLm.exe
  2⤵
  PID:3360
- C:\Windows\System\zbCjmLW.exe
  C:\Windows\System\zbCjmLW.exe
  2⤵
  PID:3384
- C:\Windows\System\lqVxQHZ.exe
  C:\Windows\System\lqVxQHZ.exe
  2⤵
  PID:3400
- C:\Windows\System\JWhUteX.exe
  C:\Windows\System\JWhUteX.exe
  2⤵
  PID:3416
- C:\Windows\System\owlxPjJ.exe
  C:\Windows\System\owlxPjJ.exe
  2⤵
  PID:3440
- C:\Windows\System\QoQtXyC.exe
  C:\Windows\System\QoQtXyC.exe
  2⤵
  PID:3456
- C:\Windows\System\NQgblcT.exe
  C:\Windows\System\NQgblcT.exe
  2⤵
  PID:3472
- C:\Windows\System\xdYdwTd.exe
  C:\Windows\System\xdYdwTd.exe
  2⤵
  PID:3496
- C:\Windows\System\HrYfxPf.exe
  C:\Windows\System\HrYfxPf.exe
  2⤵
  PID:3516
- C:\Windows\System\NSaUruY.exe
  C:\Windows\System\NSaUruY.exe
  2⤵
  PID:3536
- C:\Windows\System\DlcKfqE.exe
  C:\Windows\System\DlcKfqE.exe
  2⤵
  PID:3564
- C:\Windows\System\yRuInOj.exe
  C:\Windows\System\yRuInOj.exe
  2⤵
  PID:3580
- C:\Windows\System\WtqXfEB.exe
  C:\Windows\System\WtqXfEB.exe
  2⤵
  PID:3600
- C:\Windows\System\RVaZUid.exe
  C:\Windows\System\RVaZUid.exe
  2⤵
  PID:3616
- C:\Windows\System\pgCNXEh.exe
  C:\Windows\System\pgCNXEh.exe
  2⤵
  PID:3640
- C:\Windows\System\HymVdHa.exe
  C:\Windows\System\HymVdHa.exe
  2⤵
  PID:3660
- C:\Windows\System\DicKKZu.exe
  C:\Windows\System\DicKKZu.exe
  2⤵
  PID:3680
- C:\Windows\System\EsjfZIB.exe
  C:\Windows\System\EsjfZIB.exe
  2⤵
  PID:3696
- C:\Windows\System\Jxgvohc.exe
  C:\Windows\System\Jxgvohc.exe
  2⤵
  PID:3712
- C:\Windows\System\jJAwPJO.exe
  C:\Windows\System\jJAwPJO.exe
  2⤵
  PID:3732
- C:\Windows\System\fcquHNt.exe
  C:\Windows\System\fcquHNt.exe
  2⤵
  PID:3748
- C:\Windows\System\cAyqmji.exe
  C:\Windows\System\cAyqmji.exe
  2⤵
  PID:3776
- C:\Windows\System\PEPHRWg.exe
  C:\Windows\System\PEPHRWg.exe
  2⤵
  PID:3796
- C:\Windows\System\SERpPMn.exe
  C:\Windows\System\SERpPMn.exe
  2⤵
  PID:3812
- C:\Windows\System\IftpslC.exe
  C:\Windows\System\IftpslC.exe
  2⤵
  PID:3832
- C:\Windows\System\vHWlvjk.exe
  C:\Windows\System\vHWlvjk.exe
  2⤵
  PID:3852
- C:\Windows\System\oneqXpJ.exe
  C:\Windows\System\oneqXpJ.exe
  2⤵
  PID:3868
- C:\Windows\System\BGrwbDW.exe
  C:\Windows\System\BGrwbDW.exe
  2⤵
  PID:3884
- C:\Windows\System\AuhrPDW.exe
  C:\Windows\System\AuhrPDW.exe
  2⤵
  PID:3900
- C:\Windows\System\HbybEsn.exe
  C:\Windows\System\HbybEsn.exe
  2⤵
  PID:3916
- C:\Windows\System\AqzpTPR.exe
  C:\Windows\System\AqzpTPR.exe
  2⤵
  PID:3932
- C:\Windows\System\JRqWvzo.exe
  C:\Windows\System\JRqWvzo.exe
  2⤵
  PID:3948
- C:\Windows\System\olWCNHx.exe
  C:\Windows\System\olWCNHx.exe
  2⤵
  PID:3968
- C:\Windows\System\NtKxbTO.exe
  C:\Windows\System\NtKxbTO.exe
  2⤵
  PID:3984
- C:\Windows\System\XQLnBVH.exe
  C:\Windows\System\XQLnBVH.exe
  2⤵
  PID:4000
- C:\Windows\System\vIHGIfT.exe
  C:\Windows\System\vIHGIfT.exe
  2⤵
  PID:4016
- C:\Windows\System\vlbIQns.exe
  C:\Windows\System\vlbIQns.exe
  2⤵
  PID:4032
- C:\Windows\System\MytuZWP.exe
  C:\Windows\System\MytuZWP.exe
  2⤵
  PID:4056
- C:\Windows\System\zkhqWMz.exe
  C:\Windows\System\zkhqWMz.exe
  2⤵
  PID:2208
- C:\Windows\System\ekKeDTf.exe
  C:\Windows\System\ekKeDTf.exe
  2⤵
  PID:1592
- C:\Windows\System\VQwhOsN.exe
  C:\Windows\System\VQwhOsN.exe
  2⤵
  PID:3176
- C:\Windows\System\FqSANje.exe
  C:\Windows\System\FqSANje.exe
  2⤵
  PID:2952
- C:\Windows\System\PyewXnf.exe
  C:\Windows\System\PyewXnf.exe
  2⤵
  PID:3104
- C:\Windows\System\NxuoidL.exe
  C:\Windows\System\NxuoidL.exe
  2⤵
  PID:3156
- C:\Windows\System\FtkjtXD.exe
  C:\Windows\System\FtkjtXD.exe
  2⤵
  PID:3192
- C:\Windows\System\YdsfXvj.exe
  C:\Windows\System\YdsfXvj.exe
  2⤵
  PID:3208
- C:\Windows\System\lpMQUnd.exe
  C:\Windows\System\lpMQUnd.exe
  2⤵
  PID:3224
- C:\Windows\System\qwdCfHF.exe
  C:\Windows\System\qwdCfHF.exe
  2⤵
  PID:3256
- C:\Windows\System\gJuCTeZ.exe
  C:\Windows\System\gJuCTeZ.exe
  2⤵
  PID:3324
- C:\Windows\System\PvcTnYI.exe
  C:\Windows\System\PvcTnYI.exe
  2⤵
  PID:3312
- C:\Windows\System\tCNRYGP.exe
  C:\Windows\System\tCNRYGP.exe
  2⤵
  PID:3332
- C:\Windows\System\vfjtCYl.exe
  C:\Windows\System\vfjtCYl.exe
  2⤵
  PID:3412
- C:\Windows\System\SojBNCX.exe
  C:\Windows\System\SojBNCX.exe
  2⤵
  PID:3480
- C:\Windows\System\jhDCbLG.exe
  C:\Windows\System\jhDCbLG.exe
  2⤵
  PID:3468
- C:\Windows\System\HlAzUrT.exe
  C:\Windows\System\HlAzUrT.exe
  2⤵
  PID:3508
- C:\Windows\System\XTXUTUL.exe
  C:\Windows\System\XTXUTUL.exe
  2⤵
  PID:3528
- C:\Windows\System\gscqKGu.exe
  C:\Windows\System\gscqKGu.exe
  2⤵
  PID:3432
- C:\Windows\System\smvyyug.exe
  C:\Windows\System\smvyyug.exe
  2⤵
  PID:3572
- C:\Windows\System\zJuueiJ.exe
  C:\Windows\System\zJuueiJ.exe
  2⤵
  PID:3592
- C:\Windows\System\CbPNEjc.exe
  C:\Windows\System\CbPNEjc.exe
  2⤵
  PID:3656
- C:\Windows\System\ueOjAxU.exe
  C:\Windows\System\ueOjAxU.exe
  2⤵
  PID:3672
- C:\Windows\System\fzvJNAq.exe
  C:\Windows\System\fzvJNAq.exe
  2⤵
  PID:3720
- C:\Windows\System\UQakfzM.exe
  C:\Windows\System\UQakfzM.exe
  2⤵
  PID:3768
- C:\Windows\System\dnGEkZD.exe
  C:\Windows\System\dnGEkZD.exe
  2⤵
  PID:3704
- C:\Windows\System\KXocUjG.exe
  C:\Windows\System\KXocUjG.exe
  2⤵
  PID:3824
- C:\Windows\System\PDNeroS.exe
  C:\Windows\System\PDNeroS.exe
  2⤵
  PID:3744
- C:\Windows\System\ZgGBbLt.exe
  C:\Windows\System\ZgGBbLt.exe
  2⤵
  PID:4008
- C:\Windows\System\pFNttAS.exe
  C:\Windows\System\pFNttAS.exe
  2⤵
  PID:3912
- C:\Windows\System\vQBvQMp.exe
  C:\Windows\System\vQBvQMp.exe
  2⤵
  PID:4044
- C:\Windows\System\KpLWBKv.exe
  C:\Windows\System\KpLWBKv.exe
  2⤵
  PID:4024
- C:\Windows\System\UmOeXRn.exe
  C:\Windows\System\UmOeXRn.exe
  2⤵
  PID:3992
- C:\Windows\System\hnrALSY.exe
  C:\Windows\System\hnrALSY.exe
  2⤵
  PID:4028
- C:\Windows\System\XjzuCOr.exe
  C:\Windows\System\XjzuCOr.exe
  2⤵
  PID:4080
- C:\Windows\System\MKZmbSb.exe
  C:\Windows\System\MKZmbSb.exe
  2⤵
  PID:2024
- C:\Windows\System\vYrtIiC.exe
  C:\Windows\System\vYrtIiC.exe
  2⤵
  PID:3896
- C:\Windows\System\TRwgVEe.exe
  C:\Windows\System\TRwgVEe.exe
  2⤵
  PID:3964
- C:\Windows\System\jpxMKYX.exe
  C:\Windows\System\jpxMKYX.exe
  2⤵
  PID:3124
- C:\Windows\System\GftdGrM.exe
  C:\Windows\System\GftdGrM.exe
  2⤵
  PID:2988
- C:\Windows\System\cHrzsur.exe
  C:\Windows\System\cHrzsur.exe
  2⤵
  PID:784
- C:\Windows\System\jsFgxPa.exe
  C:\Windows\System\jsFgxPa.exe
  2⤵
  PID:3148
- C:\Windows\System\dvDTRNt.exe
  C:\Windows\System\dvDTRNt.exe
  2⤵
  PID:3248
- C:\Windows\System\LMBwGnx.exe
  C:\Windows\System\LMBwGnx.exe
  2⤵
  PID:3376
- C:\Windows\System\AXAlUgg.exe
  C:\Windows\System\AXAlUgg.exe
  2⤵
  PID:3392
- C:\Windows\System\SWveYTx.exe
  C:\Windows\System\SWveYTx.exe
  2⤵
  PID:3284
- C:\Windows\System\xbotTfw.exe
  C:\Windows\System\xbotTfw.exe
  2⤵
  PID:3452
- C:\Windows\System\yWoTVrq.exe
  C:\Windows\System\yWoTVrq.exe
  2⤵
  PID:3552
- C:\Windows\System\RTCFJmP.exe
  C:\Windows\System\RTCFJmP.exe
  2⤵
  PID:3608
- C:\Windows\System\wYOtpQI.exe
  C:\Windows\System\wYOtpQI.exe
  2⤵
  PID:3708
- C:\Windows\System\BxgRSeH.exe
  C:\Windows\System\BxgRSeH.exe
  2⤵
  PID:3804
- C:\Windows\System\PgCvIaz.exe
  C:\Windows\System\PgCvIaz.exe
  2⤵
  PID:3848
- C:\Windows\System\HNTPTHy.exe
  C:\Windows\System\HNTPTHy.exe
  2⤵
  PID:4084
- C:\Windows\System\UXyzAhu.exe
  C:\Windows\System\UXyzAhu.exe
  2⤵
  PID:4088
- C:\Windows\System\YyCOKKP.exe
  C:\Windows\System\YyCOKKP.exe
  2⤵
  PID:1744
- C:\Windows\System\REpMPCJ.exe
  C:\Windows\System\REpMPCJ.exe
  2⤵
  PID:3076
- C:\Windows\System\JBxVVzU.exe
  C:\Windows\System\JBxVVzU.exe
  2⤵
  PID:3548
- C:\Windows\System\attAZqV.exe
  C:\Windows\System\attAZqV.exe
  2⤵
  PID:4112
- C:\Windows\System\OuDdlCB.exe
  C:\Windows\System\OuDdlCB.exe
  2⤵
  PID:4140
- C:\Windows\System\HDJnfLc.exe
  C:\Windows\System\HDJnfLc.exe
  2⤵
  PID:4156
- C:\Windows\System\QtQiQxk.exe
  C:\Windows\System\QtQiQxk.exe
  2⤵
  PID:4172
- C:\Windows\System\gJzyXXf.exe
  C:\Windows\System\gJzyXXf.exe
  2⤵
  PID:4188
- C:\Windows\System\tRRrOmc.exe
  C:\Windows\System\tRRrOmc.exe
  2⤵
  PID:4208
- C:\Windows\System\PgLdFJs.exe
  C:\Windows\System\PgLdFJs.exe
  2⤵
  PID:4224
- C:\Windows\System\hFlpLyq.exe
  C:\Windows\System\hFlpLyq.exe
  2⤵
  PID:4244
- C:\Windows\System\zhPIpuE.exe
  C:\Windows\System\zhPIpuE.exe
  2⤵
  PID:4264
- C:\Windows\System\UMIwjNk.exe
  C:\Windows\System\UMIwjNk.exe
  2⤵
  PID:4280
- C:\Windows\System\zmIDJMY.exe
  C:\Windows\System\zmIDJMY.exe
  2⤵
  PID:4296
- C:\Windows\System\wdbgVhY.exe
  C:\Windows\System\wdbgVhY.exe
  2⤵
  PID:4320
- C:\Windows\System\xAYYHkw.exe
  C:\Windows\System\xAYYHkw.exe
  2⤵
  PID:4340
- C:\Windows\System\TQbDSPd.exe
  C:\Windows\System\TQbDSPd.exe
  2⤵
  PID:4360
- C:\Windows\System\cTMDJAL.exe
  C:\Windows\System\cTMDJAL.exe
  2⤵
  PID:4380
- C:\Windows\System\BCEEPIn.exe
  C:\Windows\System\BCEEPIn.exe
  2⤵
  PID:4396
- C:\Windows\System\GiaGYfp.exe
  C:\Windows\System\GiaGYfp.exe
  2⤵
  PID:4416
- C:\Windows\System\OcJVANM.exe
  C:\Windows\System\OcJVANM.exe
  2⤵
  PID:4432
- C:\Windows\System\diKMPnu.exe
  C:\Windows\System\diKMPnu.exe
  2⤵
  PID:4456
- C:\Windows\System\OLhOvtA.exe
  C:\Windows\System\OLhOvtA.exe
  2⤵
  PID:4476
- C:\Windows\System\wqBBoBY.exe
  C:\Windows\System\wqBBoBY.exe
  2⤵
  PID:4496
- C:\Windows\System\kPoJebd.exe
  C:\Windows\System\kPoJebd.exe
  2⤵
  PID:4524
- C:\Windows\System\FGJJvuG.exe
  C:\Windows\System\FGJJvuG.exe
  2⤵
  PID:4540
- C:\Windows\System\ELRRcgQ.exe
  C:\Windows\System\ELRRcgQ.exe
  2⤵
  PID:4556
- C:\Windows\System\VKJLTIt.exe
  C:\Windows\System\VKJLTIt.exe
  2⤵
  PID:4576
- C:\Windows\System\fmMmQPA.exe
  C:\Windows\System\fmMmQPA.exe
  2⤵
  PID:4596
- C:\Windows\System\wAlAwPr.exe
  C:\Windows\System\wAlAwPr.exe
  2⤵
  PID:4612
- C:\Windows\System\GbVADlU.exe
  C:\Windows\System\GbVADlU.exe
  2⤵
  PID:4632
- C:\Windows\System\wTnIRZG.exe
  C:\Windows\System\wTnIRZG.exe
  2⤵
  PID:4652
- C:\Windows\System\IpTiSUC.exe
  C:\Windows\System\IpTiSUC.exe
  2⤵
  PID:4780
- C:\Windows\System\MsbWHjS.exe
  C:\Windows\System\MsbWHjS.exe
  2⤵
  PID:4796
- C:\Windows\System\pBnushg.exe
  C:\Windows\System\pBnushg.exe
  2⤵
  PID:4812
- C:\Windows\System\HfPsqBT.exe
  C:\Windows\System\HfPsqBT.exe
  2⤵
  PID:4828
- C:\Windows\System\dhPaOkq.exe
  C:\Windows\System\dhPaOkq.exe
  2⤵
  PID:4848
- C:\Windows\System\yDQOGTc.exe
  C:\Windows\System\yDQOGTc.exe
  2⤵
  PID:4864
- C:\Windows\System\wHDaBjs.exe
  C:\Windows\System\wHDaBjs.exe
  2⤵
  PID:4880
- C:\Windows\System\LfcjBnH.exe
  C:\Windows\System\LfcjBnH.exe
  2⤵
  PID:4896
- C:\Windows\System\mtRDPYw.exe
  C:\Windows\System\mtRDPYw.exe
  2⤵
  PID:4912
- C:\Windows\System\acJTHDs.exe
  C:\Windows\System\acJTHDs.exe
  2⤵
  PID:4932
- C:\Windows\System\OyqtXPA.exe
  C:\Windows\System\OyqtXPA.exe
  2⤵
  PID:4952
- C:\Windows\System\kKgCDNe.exe
  C:\Windows\System\kKgCDNe.exe
  2⤵
  PID:4972
- C:\Windows\System\lmBSEjP.exe
  C:\Windows\System\lmBSEjP.exe
  2⤵
  PID:4988
- C:\Windows\System\SGlacBM.exe
  C:\Windows\System\SGlacBM.exe
  2⤵
  PID:5004
- C:\Windows\System\UzvCDmC.exe
  C:\Windows\System\UzvCDmC.exe
  2⤵
  PID:5024
- C:\Windows\System\SpfQmQl.exe
  C:\Windows\System\SpfQmQl.exe
  2⤵
  PID:5040
- C:\Windows\System\KKgQSIW.exe
  C:\Windows\System\KKgQSIW.exe
  2⤵
  PID:5056
- C:\Windows\System\CRWJoCm.exe
  C:\Windows\System\CRWJoCm.exe
  2⤵
  PID:5072
- C:\Windows\System\lyihtNB.exe
  C:\Windows\System\lyihtNB.exe
  2⤵
  PID:5088
- C:\Windows\System\LHglCBh.exe
  C:\Windows\System\LHglCBh.exe
  2⤵
  PID:5108
- C:\Windows\System\vPKczug.exe
  C:\Windows\System\vPKczug.exe
  2⤵
  PID:3596
- C:\Windows\System\TFnbhen.exe
  C:\Windows\System\TFnbhen.exe
  2⤵
  PID:3668
- C:\Windows\System\HHQpizn.exe
  C:\Windows\System\HHQpizn.exe
  2⤵
  PID:3160
- C:\Windows\System\vmdnMqR.exe
  C:\Windows\System\vmdnMqR.exe
  2⤵
  PID:3352
- C:\Windows\System\bnWLFFu.exe
  C:\Windows\System\bnWLFFu.exe
  2⤵
  PID:4128
- C:\Windows\System\JkNEvpP.exe
  C:\Windows\System\JkNEvpP.exe
  2⤵
  PID:4168
- C:\Windows\System\RwwLxke.exe
  C:\Windows\System\RwwLxke.exe
  2⤵
  PID:4352
- C:\Windows\System\oxQIDLX.exe
  C:\Windows\System\oxQIDLX.exe
  2⤵
  PID:4392
- C:\Windows\System\DXtOoUL.exe
  C:\Windows\System\DXtOoUL.exe
  2⤵
  PID:4428
- C:\Windows\System\OGievZx.exe
  C:\Windows\System\OGievZx.exe
  2⤵
  PID:4468
- C:\Windows\System\mUdtuIl.exe
  C:\Windows\System\mUdtuIl.exe
  2⤵
  PID:4504
- C:\Windows\System\tTUCsLY.exe
  C:\Windows\System\tTUCsLY.exe
  2⤵
  PID:4584
- C:\Windows\System\ckNIrlO.exe
  C:\Windows\System\ckNIrlO.exe
  2⤵
  PID:4628
- C:\Windows\System\JoetWOI.exe
  C:\Windows\System\JoetWOI.exe
  2⤵
  PID:4672
- C:\Windows\System\TXtRsMj.exe
  C:\Windows\System\TXtRsMj.exe
  2⤵
  PID:3760
- C:\Windows\System\zFoVggd.exe
  C:\Windows\System\zFoVggd.exe
  2⤵
  PID:4700
- C:\Windows\System\TieFyxV.exe
  C:\Windows\System\TieFyxV.exe
  2⤵
  PID:4152
- C:\Windows\System\ljdLouk.exe
  C:\Windows\System\ljdLouk.exe
  2⤵
  PID:3820
- C:\Windows\System\BmBvIgp.exe
  C:\Windows\System\BmBvIgp.exe
  2⤵
  PID:4252
- C:\Windows\System\TdJOhNn.exe
  C:\Windows\System\TdJOhNn.exe
  2⤵
  PID:4488
- C:\Windows\System\cSDACzi.exe
  C:\Windows\System\cSDACzi.exe
  2⤵
  PID:4536
- C:\Windows\System\oyplhhS.exe
  C:\Windows\System\oyplhhS.exe
  2⤵
  PID:3196
- C:\Windows\System\RRmdgIh.exe
  C:\Windows\System\RRmdgIh.exe
  2⤵
  PID:3368
- C:\Windows\System\rCIdwJb.exe
  C:\Windows\System\rCIdwJb.exe
  2⤵
  PID:2712
- C:\Windows\System\lWMLUGC.exe
  C:\Windows\System\lWMLUGC.exe
  2⤵
  PID:4668
- C:\Windows\System\hXSQMEk.exe
  C:\Windows\System\hXSQMEk.exe
  2⤵
  PID:4184
- C:\Windows\System\MBZuRyY.exe
  C:\Windows\System\MBZuRyY.exe
  2⤵
  PID:4288
- C:\Windows\System\LflNkct.exe
  C:\Windows\System\LflNkct.exe
  2⤵
  PID:4368
- C:\Windows\System\pwTWhey.exe
  C:\Windows\System\pwTWhey.exe
  2⤵
  PID:4408
- C:\Windows\System\HsWXCbd.exe
  C:\Windows\System\HsWXCbd.exe
  2⤵
  PID:4568
- C:\Windows\System\XKfAJFJ.exe
  C:\Windows\System\XKfAJFJ.exe
  2⤵
  PID:4644
- C:\Windows\System\OqIlrjb.exe
  C:\Windows\System\OqIlrjb.exe
  2⤵
  PID:4788
- C:\Windows\System\hlCskVw.exe
  C:\Windows\System\hlCskVw.exe
  2⤵
  PID:4940
- C:\Windows\System\qZBWNdx.exe
  C:\Windows\System\qZBWNdx.exe
  2⤵
  PID:4980
- C:\Windows\System\ThRWADg.exe
  C:\Windows\System\ThRWADg.exe
  2⤵
  PID:5020
- C:\Windows\System\uvLBmTo.exe
  C:\Windows\System\uvLBmTo.exe
  2⤵
  PID:3544
- C:\Windows\System\xEobxWi.exe
  C:\Windows\System\xEobxWi.exe
  2⤵
  PID:4824
- C:\Windows\System\iVdcXSD.exe
  C:\Windows\System\iVdcXSD.exe
  2⤵
  PID:4512
- C:\Windows\System\LEwfgyd.exe
  C:\Windows\System\LEwfgyd.exe
  2⤵
  PID:4684
- C:\Windows\System\sOfshOO.exe
  C:\Windows\System\sOfshOO.exe
  2⤵
  PID:4124
- C:\Windows\System\wADvCOj.exe
  C:\Windows\System\wADvCOj.exe
  2⤵
  PID:4704
- C:\Windows\System\TKfZErM.exe
  C:\Windows\System\TKfZErM.exe
  2⤵
  PID:4860
- C:\Windows\System\hzeffwf.exe
  C:\Windows\System\hzeffwf.exe
  2⤵
  PID:4924
- C:\Windows\System\UzlXZEC.exe
  C:\Windows\System\UzlXZEC.exe
  2⤵
  PID:3484
- C:\Windows\System\ddmfCaP.exe
  C:\Windows\System\ddmfCaP.exe
  2⤵
  PID:4136
- C:\Windows\System\rQJnWvY.exe
  C:\Windows\System\rQJnWvY.exe
  2⤵
  PID:4308
- C:\Windows\System\EsTYcNj.exe
  C:\Windows\System\EsTYcNj.exe
  2⤵
  PID:4508
- C:\Windows\System\vAdxiRS.exe
  C:\Windows\System\vAdxiRS.exe
  2⤵
  PID:4664
- C:\Windows\System\qnWHgVj.exe
  C:\Windows\System\qnWHgVj.exe
  2⤵
  PID:4716
- C:\Windows\System\ydwWWie.exe
  C:\Windows\System\ydwWWie.exe
  2⤵
  PID:4748
- C:\Windows\System\vbkGQSu.exe
  C:\Windows\System\vbkGQSu.exe
  2⤵
  PID:4604
- C:\Windows\System\KVyltkM.exe
  C:\Windows\System\KVyltkM.exe
  2⤵
  PID:3128
- C:\Windows\System\Iyahjvq.exe
  C:\Windows\System\Iyahjvq.exe
  2⤵
  PID:3784
- C:\Windows\System\IzmBlae.exe
  C:\Windows\System\IzmBlae.exe
  2⤵
  PID:3740
- C:\Windows\System\leZEQqR.exe
  C:\Windows\System\leZEQqR.exe
  2⤵
  PID:3864
- C:\Windows\System\KaFyBWK.exe
  C:\Windows\System\KaFyBWK.exe
  2⤵
  PID:4072
- C:\Windows\System\IEtBxdR.exe
  C:\Windows\System\IEtBxdR.exe
  2⤵
  PID:4532
- C:\Windows\System\wINIEnQ.exe
  C:\Windows\System\wINIEnQ.exe
  2⤵
  PID:3304
- C:\Windows\System\AEXhIYB.exe
  C:\Windows\System\AEXhIYB.exe
  2⤵
  PID:3632
- C:\Windows\System\rTCJzQA.exe
  C:\Windows\System\rTCJzQA.exe
  2⤵
  PID:4108
- C:\Windows\System\KZPtUGd.exe
  C:\Windows\System\KZPtUGd.exe
  2⤵
  PID:4220
- C:\Windows\System\jlidtxu.exe
  C:\Windows\System\jlidtxu.exe
  2⤵
  PID:4404
- C:\Windows\System\XbVbJFU.exe
  C:\Windows\System\XbVbJFU.exe
  2⤵
  PID:5016
- C:\Windows\System\LYEliqO.exe
  C:\Windows\System\LYEliqO.exe
  2⤵
  PID:4836
- C:\Windows\System\QGraGgE.exe
  C:\Windows\System\QGraGgE.exe
  2⤵
  PID:4236
- C:\Windows\System\anjNaTY.exe
  C:\Windows\System\anjNaTY.exe
  2⤵
  PID:4624
- C:\Windows\System\yHoouVQ.exe
  C:\Windows\System\yHoouVQ.exe
  2⤵
  PID:4960
- C:\Windows\System\upypXHp.exe
  C:\Windows\System\upypXHp.exe
  2⤵
  PID:3980
- C:\Windows\System\cFJqxWC.exe
  C:\Windows\System\cFJqxWC.exe
  2⤵
  PID:5100
- C:\Windows\System\ywYBccc.exe
  C:\Windows\System\ywYBccc.exe
  2⤵
  PID:5080
- C:\Windows\System\aFxdgWl.exe
  C:\Windows\System\aFxdgWl.exe
  2⤵
  PID:4464
- C:\Windows\System\FoyMIiJ.exe
  C:\Windows\System\FoyMIiJ.exe
  2⤵
  PID:3956
- C:\Windows\System\PkBOujV.exe
  C:\Windows\System\PkBOujV.exe
  2⤵
  PID:4092
- C:\Windows\System\VVuwcTu.exe
  C:\Windows\System\VVuwcTu.exe
  2⤵
  PID:4840
- C:\Windows\System\JwYiWla.exe
  C:\Windows\System\JwYiWla.exe
  2⤵
  PID:4120
- C:\Windows\System\oXQBUTe.exe
  C:\Windows\System\oXQBUTe.exe
  2⤵
  PID:4696
- C:\Windows\System\ryXYCyl.exe
  C:\Windows\System\ryXYCyl.exe
  2⤵
  PID:3372
- C:\Windows\System\WHZOMnk.exe
  C:\Windows\System\WHZOMnk.exe
  2⤵
  PID:3728
- C:\Windows\System\mYMpSiL.exe
  C:\Windows\System\mYMpSiL.exe
  2⤵
  PID:5012
- C:\Windows\System\onpcBJr.exe
  C:\Windows\System\onpcBJr.exe
  2⤵
  PID:5132
- C:\Windows\System\IhkkOpS.exe
  C:\Windows\System\IhkkOpS.exe
  2⤵
  PID:5152
- C:\Windows\System\qrGhDoe.exe
  C:\Windows\System\qrGhDoe.exe
  2⤵
  PID:5168
- C:\Windows\System\xZfdGns.exe
  C:\Windows\System\xZfdGns.exe
  2⤵
  PID:5184
- C:\Windows\System\DDLKqwM.exe
  C:\Windows\System\DDLKqwM.exe
  2⤵
  PID:5208
- C:\Windows\System\qByzfUL.exe
  C:\Windows\System\qByzfUL.exe
  2⤵
  PID:5224
- C:\Windows\System\mCNYwyw.exe
  C:\Windows\System\mCNYwyw.exe
  2⤵
  PID:5244
- C:\Windows\System\ztfcAUN.exe
  C:\Windows\System\ztfcAUN.exe
  2⤵
  PID:5264
- C:\Windows\System\YBdotWF.exe
  C:\Windows\System\YBdotWF.exe
  2⤵
  PID:5284
- C:\Windows\System\XohupUy.exe
  C:\Windows\System\XohupUy.exe
  2⤵
  PID:5304
- C:\Windows\System\bdkTowv.exe
  C:\Windows\System\bdkTowv.exe
  2⤵
  PID:5320
- C:\Windows\System\TvQSfmC.exe
  C:\Windows\System\TvQSfmC.exe
  2⤵
  PID:5340
- C:\Windows\System\qJhZhZH.exe
  C:\Windows\System\qJhZhZH.exe
  2⤵
  PID:5444
- C:\Windows\System\mFXSuky.exe
  C:\Windows\System\mFXSuky.exe
  2⤵
  PID:5460
- C:\Windows\System\CMMfXPG.exe
  C:\Windows\System\CMMfXPG.exe
  2⤵
  PID:5476
- C:\Windows\System\SJAoznR.exe
  C:\Windows\System\SJAoznR.exe
  2⤵
  PID:5492
- C:\Windows\System\lLitrOP.exe
  C:\Windows\System\lLitrOP.exe
  2⤵
  PID:5512
- C:\Windows\System\jCXcMlk.exe
  C:\Windows\System\jCXcMlk.exe
  2⤵
  PID:5532
- C:\Windows\System\neUDcGU.exe
  C:\Windows\System\neUDcGU.exe
  2⤵
  PID:5556
- C:\Windows\System\nYanTAT.exe
  C:\Windows\System\nYanTAT.exe
  2⤵
  PID:5576
- C:\Windows\System\poCVQSk.exe
  C:\Windows\System\poCVQSk.exe
  2⤵
  PID:5596
- C:\Windows\System\iKSwSQZ.exe
  C:\Windows\System\iKSwSQZ.exe
  2⤵
  PID:5616
- C:\Windows\System\vHsfSzl.exe
  C:\Windows\System\vHsfSzl.exe
  2⤵
  PID:5648
- C:\Windows\System\rtyyfgv.exe
  C:\Windows\System\rtyyfgv.exe
  2⤵
  PID:5664
- C:\Windows\System\WHCDQJF.exe
  C:\Windows\System\WHCDQJF.exe
  2⤵
  PID:5684
- C:\Windows\System\HUYHwWz.exe
  C:\Windows\System\HUYHwWz.exe
  2⤵
  PID:5700
- C:\Windows\System\JGSzKbU.exe
  C:\Windows\System\JGSzKbU.exe
  2⤵
  PID:5720
- C:\Windows\System\YLjNTif.exe
  C:\Windows\System\YLjNTif.exe
  2⤵
  PID:5736
- C:\Windows\System\qWjChdu.exe
  C:\Windows\System\qWjChdu.exe
  2⤵
  PID:5752
- C:\Windows\System\aGRiXLj.exe
  C:\Windows\System\aGRiXLj.exe
  2⤵
  PID:5772
- C:\Windows\System\vfagsMx.exe
  C:\Windows\System\vfagsMx.exe
  2⤵
  PID:5788
- C:\Windows\System\tvljgxX.exe
  C:\Windows\System\tvljgxX.exe
  2⤵
  PID:5812
- C:\Windows\System\ECjdkvT.exe
  C:\Windows\System\ECjdkvT.exe
  2⤵
  PID:5832
- C:\Windows\System\dbHFesk.exe
  C:\Windows\System\dbHFesk.exe
  2⤵
  PID:5848
- C:\Windows\System\hMpLMwq.exe
  C:\Windows\System\hMpLMwq.exe
  2⤵
  PID:5864
- C:\Windows\System\htmsVQv.exe
  C:\Windows\System\htmsVQv.exe
  2⤵
  PID:5880
- C:\Windows\System\HpHjsZd.exe
  C:\Windows\System\HpHjsZd.exe
  2⤵
  PID:5900
- C:\Windows\System\WFQduBK.exe
  C:\Windows\System\WFQduBK.exe
  2⤵
  PID:5924
- C:\Windows\System\TBpCydl.exe
  C:\Windows\System\TBpCydl.exe
  2⤵
  PID:5944
- C:\Windows\System\BNvAMCf.exe
  C:\Windows\System\BNvAMCf.exe
  2⤵
  PID:5960
- C:\Windows\System\cTLoozJ.exe
  C:\Windows\System\cTLoozJ.exe
  2⤵
  PID:5976
- C:\Windows\System\BNIgxsq.exe
  C:\Windows\System\BNIgxsq.exe
  2⤵
  PID:5996
- C:\Windows\System\mvDpsMX.exe
  C:\Windows\System\mvDpsMX.exe
  2⤵
  PID:6016
- C:\Windows\System\TmQeSeT.exe
  C:\Windows\System\TmQeSeT.exe
  2⤵
  PID:6036
- C:\Windows\System\FhntDyt.exe
  C:\Windows\System\FhntDyt.exe
  2⤵
  PID:6052
- C:\Windows\System\NYkFgIS.exe
  C:\Windows\System\NYkFgIS.exe
  2⤵
  PID:6072
- C:\Windows\System\ZpotitK.exe
  C:\Windows\System\ZpotitK.exe
  2⤵
  PID:6088
- C:\Windows\System\zEptZKP.exe
  C:\Windows\System\zEptZKP.exe
  2⤵
  PID:6108
- C:\Windows\System\mtZOLvW.exe
  C:\Windows\System\mtZOLvW.exe
  2⤵
  PID:6128
- C:\Windows\System\ylKLPMh.exe
  C:\Windows\System\ylKLPMh.exe
  2⤵
  PID:5064
- C:\Windows\System\NCTdEAw.exe
  C:\Windows\System\NCTdEAw.exe
  2⤵
  PID:5180
- C:\Windows\System\gRScHZd.exe
  C:\Windows\System\gRScHZd.exe
  2⤵
  PID:5176
- C:\Windows\System\vnNPLUZ.exe
  C:\Windows\System\vnNPLUZ.exe
  2⤵
  PID:5096
- C:\Windows\System\JzBgXNo.exe
  C:\Windows\System\JzBgXNo.exe
  2⤵
  PID:5296
- C:\Windows\System\ZwWvJMi.exe
  C:\Windows\System\ZwWvJMi.exe
  2⤵
  PID:4964
- C:\Windows\System\hMQwDtm.exe
  C:\Windows\System\hMQwDtm.exe
  2⤵
  PID:4516
- C:\Windows\System\ZDRXSru.exe
  C:\Windows\System\ZDRXSru.exe
  2⤵
  PID:5036
- C:\Windows\System\xcEqsrC.exe
  C:\Windows\System\xcEqsrC.exe
  2⤵
  PID:4328
- C:\Windows\System\fBEcmbl.exe
  C:\Windows\System\fBEcmbl.exe
  2⤵
  PID:4904
- C:\Windows\System\cdLZgcW.exe
  C:\Windows\System\cdLZgcW.exe
  2⤵
  PID:4752
- C:\Windows\System\YBHBPkI.exe
  C:\Windows\System\YBHBPkI.exe
  2⤵
  PID:3424
- C:\Windows\System\qaXTZHN.exe
  C:\Windows\System\qaXTZHN.exe
  2⤵
  PID:4736
- C:\Windows\System\lqXcaIs.exe
  C:\Windows\System\lqXcaIs.exe
  2⤵
  PID:4452
- C:\Windows\System\gphloSg.exe
  C:\Windows\System\gphloSg.exe
  2⤵
  PID:4424
- C:\Windows\System\QGRBThs.exe
  C:\Windows\System\QGRBThs.exe
  2⤵
  PID:4968
- C:\Windows\System\YfMkSbE.exe
  C:\Windows\System\YfMkSbE.exe
  2⤵
  PID:3928
- C:\Windows\System\SRXCciY.exe
  C:\Windows\System\SRXCciY.exe
  2⤵
  PID:5128
- C:\Windows\System\eRyeyIi.exe
  C:\Windows\System\eRyeyIi.exe
  2⤵
  PID:5240
- C:\Windows\System\ZtyygwS.exe
  C:\Windows\System\ZtyygwS.exe
  2⤵
  PID:5376
- C:\Windows\System\LkyQeHm.exe
  C:\Windows\System\LkyQeHm.exe
  2⤵
  PID:5400
- C:\Windows\System\yqfLzYL.exe
  C:\Windows\System\yqfLzYL.exe
  2⤵
  PID:5428
- C:\Windows\System\iDuHgwl.exe
  C:\Windows\System\iDuHgwl.exe
  2⤵
  PID:5440
- C:\Windows\System\olTpfqJ.exe
  C:\Windows\System\olTpfqJ.exe
  2⤵
  PID:5472
- C:\Windows\System\TcWWFQK.exe
  C:\Windows\System\TcWWFQK.exe
  2⤵
  PID:5520
- C:\Windows\System\JYYhxyV.exe
  C:\Windows\System\JYYhxyV.exe
  2⤵
  PID:5568
- C:\Windows\System\fxkVSZv.exe
  C:\Windows\System\fxkVSZv.exe
  2⤵
  PID:5508
- C:\Windows\System\ParBKLW.exe
  C:\Windows\System\ParBKLW.exe
  2⤵
  PID:5584
- C:\Windows\System\DXTJVyZ.exe
  C:\Windows\System\DXTJVyZ.exe
  2⤵
  PID:5640
- C:\Windows\System\kwXHgot.exe
  C:\Windows\System\kwXHgot.exe
  2⤵
  PID:5692
- C:\Windows\System\nLghRzk.exe
  C:\Windows\System\nLghRzk.exe
  2⤵
  PID:5760
- C:\Windows\System\laBwREn.exe
  C:\Windows\System\laBwREn.exe
  2⤵
  PID:5808
- C:\Windows\System\uaCzoDB.exe
  C:\Windows\System\uaCzoDB.exe
  2⤵
  PID:5840
- C:\Windows\System\EgJqJCA.exe
  C:\Windows\System\EgJqJCA.exe
  2⤵
  PID:5916
- C:\Windows\System\zpsHbMB.exe
  C:\Windows\System\zpsHbMB.exe
  2⤵
  PID:5984
- C:\Windows\System\DTRZFaB.exe
  C:\Windows\System\DTRZFaB.exe
  2⤵
  PID:5716
- C:\Windows\System\zwfLUqL.exe
  C:\Windows\System\zwfLUqL.exe
  2⤵
  PID:5032
- C:\Windows\System\LwVvNCf.exe
  C:\Windows\System\LwVvNCf.exe
  2⤵
  PID:5748
- C:\Windows\System\hkXgCMm.exe
  C:\Windows\System\hkXgCMm.exe
  2⤵
  PID:5280
- C:\Windows\System\kdRJBOz.exe
  C:\Windows\System\kdRJBOz.exe
  2⤵
  PID:5160
- C:\Windows\System\PPUjdWf.exe
  C:\Windows\System\PPUjdWf.exe
  2⤵
  PID:5084
- C:\Windows\System\oiWIhBj.exe
  C:\Windows\System\oiWIhBj.exe
  2⤵
  PID:5204
- C:\Windows\System\WdUxKjX.exe
  C:\Windows\System\WdUxKjX.exe
  2⤵
  PID:5504
- C:\Windows\System\lkLqwqn.exe
  C:\Windows\System\lkLqwqn.exe
  2⤵
  PID:5628
- C:\Windows\System\Hgdbunt.exe
  C:\Windows\System\Hgdbunt.exe
  2⤵
  PID:5800
- C:\Windows\System\txdBCjI.exe
  C:\Windows\System\txdBCjI.exe
  2⤵
  PID:5860
- C:\Windows\System\HBeFUvg.exe
  C:\Windows\System\HBeFUvg.exe
  2⤵
  PID:5952
- C:\Windows\System\MurvXFj.exe
  C:\Windows\System\MurvXFj.exe
  2⤵
  PID:4820
- C:\Windows\System\RXWCUli.exe
  C:\Windows\System\RXWCUli.exe
  2⤵
  PID:5104
- C:\Windows\System\XkPKDlo.exe
  C:\Windows\System\XkPKDlo.exe
  2⤵
  PID:5968
- C:\Windows\System\bDRkkta.exe
  C:\Windows\System\bDRkkta.exe
  2⤵
  PID:6012
- C:\Windows\System\mMGJPjT.exe
  C:\Windows\System\mMGJPjT.exe
  2⤵
  PID:6116
- C:\Windows\System\DSKfNuM.exe
  C:\Windows\System\DSKfNuM.exe
  2⤵
  PID:4276
- C:\Windows\System\gLvcTqY.exe
  C:\Windows\System\gLvcTqY.exe
  2⤵
  PID:5528
- C:\Windows\System\LPzvYXe.exe
  C:\Windows\System\LPzvYXe.exe
  2⤵
  PID:5420
- C:\Windows\System\mOmQRPv.exe
  C:\Windows\System\mOmQRPv.exe
  2⤵
  PID:5408
- C:\Windows\System\glGLxgB.exe
  C:\Windows\System\glGLxgB.exe
  2⤵
  PID:4808
- C:\Windows\System\vzInfMs.exe
  C:\Windows\System\vzInfMs.exe
  2⤵
  PID:3112
- C:\Windows\System\uhmWKrj.exe
  C:\Windows\System\uhmWKrj.exe
  2⤵
  PID:3996
- C:\Windows\System\UpfBIZG.exe
  C:\Windows\System\UpfBIZG.exe
  2⤵
  PID:5656
- C:\Windows\System\gNJXpNW.exe
  C:\Windows\System\gNJXpNW.exe
  2⤵
  PID:5872
- C:\Windows\System\GIxhTHf.exe
  C:\Windows\System\GIxhTHf.exe
  2⤵
  PID:5992
- C:\Windows\System\BrlXQwn.exe
  C:\Windows\System\BrlXQwn.exe
  2⤵
  PID:6068
- C:\Windows\System\tcSyVON.exe
  C:\Windows\System\tcSyVON.exe
  2⤵
  PID:5328
- C:\Windows\System\aCRRNga.exe
  C:\Windows\System\aCRRNga.exe
  2⤵
  PID:5316
- C:\Windows\System\PKPnkIq.exe
  C:\Windows\System\PKPnkIq.exe
  2⤵
  PID:4148
- C:\Windows\System\uYojGtT.exe
  C:\Windows\System\uYojGtT.exe
  2⤵
  PID:4772
- C:\Windows\System\xITeynn.exe
  C:\Windows\System\xITeynn.exe
  2⤵
  PID:5436
- C:\Windows\System\VyxcyBK.exe
  C:\Windows\System\VyxcyBK.exe
  2⤵
  PID:5896
- C:\Windows\System\RnDMSRo.exe
  C:\Windows\System\RnDMSRo.exe
  2⤵
  PID:5632
- C:\Windows\System\qPCeiir.exe
  C:\Windows\System\qPCeiir.exe
  2⤵
  PID:5256
- C:\Windows\System\sUBTdQt.exe
  C:\Windows\System\sUBTdQt.exe
  2⤵
  PID:5908
- C:\Windows\System\wrBnJct.exe
  C:\Windows\System\wrBnJct.exe
  2⤵
  PID:4640
- C:\Windows\System\OahRujn.exe
  C:\Windows\System\OahRujn.exe
  2⤵
  PID:5052
- C:\Windows\System\OrrSXPV.exe
  C:\Windows\System\OrrSXPV.exe
  2⤵
  PID:5348
- C:\Windows\System\uSsgiOX.exe
  C:\Windows\System\uSsgiOX.exe
  2⤵
  PID:5876
- C:\Windows\System\lLLjryt.exe
  C:\Windows\System\lLLjryt.exe
  2⤵
  PID:5856
- C:\Windows\System\aLYxzjZ.exe
  C:\Windows\System\aLYxzjZ.exe
  2⤵
  PID:6080
- C:\Windows\System\rMVGZql.exe
  C:\Windows\System\rMVGZql.exe
  2⤵
  PID:5540
- C:\Windows\System\MmHYXgr.exe
  C:\Windows\System\MmHYXgr.exe
  2⤵
  PID:6064
- C:\Windows\System\tAjsVmO.exe
  C:\Windows\System\tAjsVmO.exe
  2⤵
  PID:1412
- C:\Windows\System\bDlQCqc.exe
  C:\Windows\System\bDlQCqc.exe
  2⤵
  PID:4388
- C:\Windows\System\petRTFq.exe
  C:\Windows\System\petRTFq.exe
  2⤵
  PID:5196
- C:\Windows\System\gOtmUtd.exe
  C:\Windows\System\gOtmUtd.exe
  2⤵
  PID:5824
- C:\Windows\System\ZJurXiA.exe
  C:\Windows\System\ZJurXiA.exe
  2⤵
  PID:6124
- C:\Windows\System\UwxfSnD.exe
  C:\Windows\System\UwxfSnD.exe
  2⤵
  PID:4104
- C:\Windows\System\PJffUeK.exe
  C:\Windows\System\PJffUeK.exe
  2⤵
  PID:5452
- C:\Windows\System\jmyoXWs.exe
  C:\Windows\System\jmyoXWs.exe
  2⤵
  PID:6032
- C:\Windows\System\RQlBZYX.exe
  C:\Windows\System\RQlBZYX.exe
  2⤵
  PID:5412
- C:\Windows\System\mVMgBkq.exe
  C:\Windows\System\mVMgBkq.exe
  2⤵
  PID:4776
- C:\Windows\System\eZseijL.exe
  C:\Windows\System\eZseijL.exe
  2⤵
  PID:5144
- C:\Windows\System\BmcOeHV.exe
  C:\Windows\System\BmcOeHV.exe
  2⤵
  PID:5484
- C:\Windows\System\vSsadmy.exe
  C:\Windows\System\vSsadmy.exe
  2⤵
  PID:5744
- C:\Windows\System\fmebpWw.exe
  C:\Windows\System\fmebpWw.exe
  2⤵
  PID:5932
- C:\Windows\System\lBjBqMx.exe
  C:\Windows\System\lBjBqMx.exe
  2⤵
  PID:6104
- C:\Windows\System\nJQgoVh.exe
  C:\Windows\System\nJQgoVh.exe
  2⤵
  PID:6084
- C:\Windows\System\yNrbbWT.exe
  C:\Windows\System\yNrbbWT.exe
  2⤵
  PID:4240
- C:\Windows\System\QTeDohc.exe
  C:\Windows\System\QTeDohc.exe
  2⤵
  PID:5676
- C:\Windows\System\biSYokx.exe
  C:\Windows\System\biSYokx.exe
  2⤵
  PID:6004
- C:\Windows\System\dOqhdTf.exe
  C:\Windows\System\dOqhdTf.exe
  2⤵
  PID:5784
- C:\Windows\System\DwGEsWk.exe
  C:\Windows\System\DwGEsWk.exe
  2⤵
  PID:4908
- C:\Windows\System\sRlrERa.exe
  C:\Windows\System\sRlrERa.exe
  2⤵
  PID:5548
- C:\Windows\System\gSSjYuh.exe
  C:\Windows\System\gSSjYuh.exe
  2⤵
  PID:5768
- C:\Windows\System\hUlhjiM.exe
  C:\Windows\System\hUlhjiM.exe
  2⤵
  PID:5796
- C:\Windows\System\lSTcWcc.exe
  C:\Windows\System\lSTcWcc.exe
  2⤵
  PID:6152
- C:\Windows\System\GUyTtyo.exe
  C:\Windows\System\GUyTtyo.exe
  2⤵
  PID:6172
- C:\Windows\System\AIujOrF.exe
  C:\Windows\System\AIujOrF.exe
  2⤵
  PID:6188
- C:\Windows\System\eVWhDpI.exe
  C:\Windows\System\eVWhDpI.exe
  2⤵
  PID:6204
- C:\Windows\System\XXBSyuJ.exe
  C:\Windows\System\XXBSyuJ.exe
  2⤵
  PID:6224
- C:\Windows\System\EirnfKH.exe
  C:\Windows\System\EirnfKH.exe
  2⤵
  PID:6240
- C:\Windows\System\fiJPfeC.exe
  C:\Windows\System\fiJPfeC.exe
  2⤵
  PID:6260
- C:\Windows\System\fOacQGW.exe
  C:\Windows\System\fOacQGW.exe
  2⤵
  PID:6276
- C:\Windows\System\jOxIxqJ.exe
  C:\Windows\System\jOxIxqJ.exe
  2⤵
  PID:6300
- C:\Windows\System\pNxMMxe.exe
  C:\Windows\System\pNxMMxe.exe
  2⤵
  PID:6316
- C:\Windows\System\ZHJeIBA.exe
  C:\Windows\System\ZHJeIBA.exe
  2⤵
  PID:6344
- C:\Windows\System\OvggmjS.exe
  C:\Windows\System\OvggmjS.exe
  2⤵
  PID:6372
- C:\Windows\System\MrsUHza.exe
  C:\Windows\System\MrsUHza.exe
  2⤵
  PID:6388
- C:\Windows\System\yLspAMA.exe
  C:\Windows\System\yLspAMA.exe
  2⤵
  PID:6404
- C:\Windows\System\jgKTDhq.exe
  C:\Windows\System\jgKTDhq.exe
  2⤵
  PID:6420
- C:\Windows\System\vVpeYyr.exe
  C:\Windows\System\vVpeYyr.exe
  2⤵
  PID:6452
- C:\Windows\System\glyLlhY.exe
  C:\Windows\System\glyLlhY.exe
  2⤵
  PID:6468
- C:\Windows\System\EMDDnnE.exe
  C:\Windows\System\EMDDnnE.exe
  2⤵
  PID:6488
- C:\Windows\System\RVUsPiu.exe
  C:\Windows\System\RVUsPiu.exe
  2⤵
  PID:6508
- C:\Windows\System\xVdCoFf.exe
  C:\Windows\System\xVdCoFf.exe
  2⤵
  PID:6524
- C:\Windows\System\aiKTsto.exe
  C:\Windows\System\aiKTsto.exe
  2⤵
  PID:6540
- C:\Windows\System\rCFxviQ.exe
  C:\Windows\System\rCFxviQ.exe
  2⤵
  PID:6556
- C:\Windows\System\EinmLrU.exe
  C:\Windows\System\EinmLrU.exe
  2⤵
  PID:6572
- C:\Windows\System\YkYAqta.exe
  C:\Windows\System\YkYAqta.exe
  2⤵
  PID:6588
- C:\Windows\System\vzCbuVA.exe
  C:\Windows\System\vzCbuVA.exe
  2⤵
  PID:6608
- C:\Windows\System\NsoDGWH.exe
  C:\Windows\System\NsoDGWH.exe
  2⤵
  PID:6656
- C:\Windows\System\nIGjeEl.exe
  C:\Windows\System\nIGjeEl.exe
  2⤵
  PID:6672
- C:\Windows\System\dlTwcjR.exe
  C:\Windows\System\dlTwcjR.exe
  2⤵
  PID:6716
- C:\Windows\System\BLuCrTm.exe
  C:\Windows\System\BLuCrTm.exe
  2⤵
  PID:6740
- C:\Windows\System\bhuqDLz.exe
  C:\Windows\System\bhuqDLz.exe
  2⤵
  PID:6760
- C:\Windows\System\oVvpMYk.exe
  C:\Windows\System\oVvpMYk.exe
  2⤵
  PID:6776
- C:\Windows\System\YWBKmAH.exe
  C:\Windows\System\YWBKmAH.exe
  2⤵
  PID:6796
- C:\Windows\System\EdhDpDI.exe
  C:\Windows\System\EdhDpDI.exe
  2⤵
  PID:6816
- C:\Windows\System\HIwBTyP.exe
  C:\Windows\System\HIwBTyP.exe
  2⤵
  PID:6836
- C:\Windows\System\YTHdsgL.exe
  C:\Windows\System\YTHdsgL.exe
  2⤵
  PID:6852
- C:\Windows\System\SzoopCP.exe
  C:\Windows\System\SzoopCP.exe
  2⤵
  PID:6868
- C:\Windows\System\DRIFipz.exe
  C:\Windows\System\DRIFipz.exe
  2⤵
  PID:6888
- C:\Windows\System\woHSJfK.exe
  C:\Windows\System\woHSJfK.exe
  2⤵
  PID:6908
- C:\Windows\System\TPQiuoH.exe
  C:\Windows\System\TPQiuoH.exe
  2⤵
  PID:6924
- C:\Windows\System\LvlCBrt.exe
  C:\Windows\System\LvlCBrt.exe
  2⤵
  PID:6940
- C:\Windows\System\UQoAoRq.exe
  C:\Windows\System\UQoAoRq.exe
  2⤵
  PID:6984
- C:\Windows\System\nfbNiyu.exe
  C:\Windows\System\nfbNiyu.exe
  2⤵
  PID:7000
- C:\Windows\System\xxNrqBZ.exe
  C:\Windows\System\xxNrqBZ.exe
  2⤵
  PID:7016
- C:\Windows\System\dOeOtLg.exe
  C:\Windows\System\dOeOtLg.exe
  2⤵
  PID:7044
- C:\Windows\System\uHXVVkR.exe
  C:\Windows\System\uHXVVkR.exe
  2⤵
  PID:7060
- C:\Windows\System\feVvtET.exe
  C:\Windows\System\feVvtET.exe
  2⤵
  PID:7080
- C:\Windows\System\auLvjFE.exe
  C:\Windows\System\auLvjFE.exe
  2⤵
  PID:7100
- C:\Windows\System\eMFGRMV.exe
  C:\Windows\System\eMFGRMV.exe
  2⤵
  PID:7120
- C:\Windows\System\sLytxqE.exe
  C:\Windows\System\sLytxqE.exe
  2⤵
  PID:7136
- C:\Windows\System\erpZGxN.exe
  C:\Windows\System\erpZGxN.exe
  2⤵
  PID:7152
- C:\Windows\System\MtQAlZZ.exe
  C:\Windows\System\MtQAlZZ.exe
  2⤵
  PID:6180
- C:\Windows\System\ZJkChPV.exe
  C:\Windows\System\ZJkChPV.exe
  2⤵
  PID:6220
- C:\Windows\System\vGGROCx.exe
  C:\Windows\System\vGGROCx.exe
  2⤵
  PID:6288
- C:\Windows\System\AjzYlKL.exe
  C:\Windows\System\AjzYlKL.exe
  2⤵
  PID:6164
- C:\Windows\System\pNQqfmO.exe
  C:\Windows\System\pNQqfmO.exe
  2⤵
  PID:6200
- C:\Windows\System\eBJHVxp.exe
  C:\Windows\System\eBJHVxp.exe
  2⤵
  PID:6196
- C:\Windows\System\MPzvVCN.exe
  C:\Windows\System\MPzvVCN.exe
  2⤵
  PID:6380
- C:\Windows\System\AzzOcQi.exe
  C:\Windows\System\AzzOcQi.exe
  2⤵
  PID:6368
- C:\Windows\System\extUMHn.exe
  C:\Windows\System\extUMHn.exe
  2⤵
  PID:6444
- C:\Windows\System\SQuCySN.exe
  C:\Windows\System\SQuCySN.exe
  2⤵
  PID:6496
- C:\Windows\System\rCZKySr.exe
  C:\Windows\System\rCZKySr.exe
  2⤵
  PID:6564
- C:\Windows\System\qcjSOKZ.exe
  C:\Windows\System\qcjSOKZ.exe
  2⤵
  PID:6532
- C:\Windows\System\ZYMGeUt.exe
  C:\Windows\System\ZYMGeUt.exe
  2⤵
  PID:6580
- C:\Windows\System\Dopnbpb.exe
  C:\Windows\System\Dopnbpb.exe
  2⤵
  PID:6552
- C:\Windows\System\NYwZCry.exe
  C:\Windows\System\NYwZCry.exe
  2⤵
  PID:6520
- C:\Windows\System\zrHIIzY.exe
  C:\Windows\System\zrHIIzY.exe
  2⤵
  PID:6652
- C:\Windows\System\tUBUgiy.exe
  C:\Windows\System\tUBUgiy.exe
  2⤵
  PID:6692
- C:\Windows\System\MdrFVFz.exe
  C:\Windows\System\MdrFVFz.exe
  2⤵
  PID:6712
- C:\Windows\System\TQmcYcF.exe
  C:\Windows\System\TQmcYcF.exe
  2⤵
  PID:6736
- C:\Windows\System\yeUUIfD.exe
  C:\Windows\System\yeUUIfD.exe
  2⤵
  PID:6772
- C:\Windows\System\MGriWuE.exe
  C:\Windows\System\MGriWuE.exe
  2⤵
  PID:6728
- C:\Windows\System\fojyOGP.exe
  C:\Windows\System\fojyOGP.exe
  2⤵
  PID:6844
- C:\Windows\System\nIeyNkg.exe
  C:\Windows\System\nIeyNkg.exe
  2⤵
  PID:6876
- C:\Windows\System\bYjXHwN.exe
  C:\Windows\System\bYjXHwN.exe
  2⤵
  PID:6932
- C:\Windows\System\uQpPlBk.exe
  C:\Windows\System\uQpPlBk.exe
  2⤵
  PID:6948
- C:\Windows\System\wpYeEAh.exe
  C:\Windows\System\wpYeEAh.exe
  2⤵
  PID:6956
- C:\Windows\System\FRkiSKu.exe
  C:\Windows\System\FRkiSKu.exe
  2⤵
  PID:6992
- C:\Windows\System\CSjjIHd.exe
  C:\Windows\System\CSjjIHd.exe
  2⤵
  PID:7056
- C:\Windows\System\ctQnyBB.exe
  C:\Windows\System\ctQnyBB.exe
  2⤵
  PID:7092
- C:\Windows\System\kyoPxUG.exe
  C:\Windows\System\kyoPxUG.exe
  2⤵
  PID:7112
- C:\Windows\System\yjlLtrr.exe
  C:\Windows\System\yjlLtrr.exe
  2⤵
  PID:7132
- C:\Windows\System\oeamBpK.exe
  C:\Windows\System\oeamBpK.exe
  2⤵
  PID:4444
- C:\Windows\System\gSLHDxn.exe
  C:\Windows\System\gSLHDxn.exe
  2⤵
  PID:1696
- C:\Windows\System\oUOTzSx.exe
  C:\Windows\System\oUOTzSx.exe
  2⤵
  PID:6256
- C:\Windows\System\gRgtYsx.exe
  C:\Windows\System\gRgtYsx.exe
  2⤵
  PID:6340
- C:\Windows\System\rjLyTiq.exe
  C:\Windows\System\rjLyTiq.exe
  2⤵
  PID:6328
- C:\Windows\System\VsPEOTJ.exe
  C:\Windows\System\VsPEOTJ.exe
  2⤵
  PID:6312
- C:\Windows\System\SJPvcjy.exe
  C:\Windows\System\SJPvcjy.exe
  2⤵
  PID:6352
- C:\Windows\System\eaFViMO.exe
  C:\Windows\System\eaFViMO.exe
  2⤵
  PID:6432
- C:\Windows\System\LiydhsG.exe
  C:\Windows\System\LiydhsG.exe
  2⤵
  PID:6536
- C:\Windows\System\tFmmUKR.exe
  C:\Windows\System\tFmmUKR.exe
  2⤵
  PID:6584
- C:\Windows\System\iEiKKgX.exe
  C:\Windows\System\iEiKKgX.exe
  2⤵
  PID:6668
- C:\Windows\System\hxXmREw.exe
  C:\Windows\System\hxXmREw.exe
  2⤵
  PID:6688
- C:\Windows\System\Kesojyr.exe
  C:\Windows\System\Kesojyr.exe
  2⤵
  PID:6732
- C:\Windows\System\IOeYCqG.exe
  C:\Windows\System\IOeYCqG.exe
  2⤵
  PID:6704
- C:\Windows\System\yNeTNXD.exe
  C:\Windows\System\yNeTNXD.exe
  2⤵
  PID:6792
- C:\Windows\System\zWcIuWM.exe
  C:\Windows\System\zWcIuWM.exe
  2⤵
  PID:6860
- C:\Windows\System\RInQHcS.exe
  C:\Windows\System\RInQHcS.exe
  2⤵
  PID:6896
- C:\Windows\System\FXkvSZX.exe
  C:\Windows\System\FXkvSZX.exe
  2⤵
  PID:6960
- C:\Windows\System\TySgcWT.exe
  C:\Windows\System\TySgcWT.exe
  2⤵
  PID:7008
- C:\Windows\System\dYBSDvH.exe
  C:\Windows\System\dYBSDvH.exe
  2⤵
  PID:7040
- C:\Windows\System\IkBIRAc.exe
  C:\Windows\System\IkBIRAc.exe
  2⤵
  PID:1968
- C:\Windows\System\qltPTKN.exe
  C:\Windows\System\qltPTKN.exe
  2⤵
  PID:6284
- C:\Windows\System\alMRstW.exe
  C:\Windows\System\alMRstW.exe
  2⤵
  PID:6600
- C:\Windows\System\EAYEGiN.exe
  C:\Windows\System\EAYEGiN.exe
  2⤵
  PID:6636
- C:\Windows\System\eYCjgtv.exe
  C:\Windows\System\eYCjgtv.exe
  2⤵
  PID:6916
- C:\Windows\System\wgVCiwH.exe
  C:\Windows\System\wgVCiwH.exe
  2⤵
  PID:6900
- C:\Windows\System\wKOfRyv.exe
  C:\Windows\System\wKOfRyv.exe
  2⤵
  PID:7148
- C:\Windows\System\mmVMBpw.exe
  C:\Windows\System\mmVMBpw.exe
  2⤵
  PID:7188
- C:\Windows\System\MLfbCpc.exe
  C:\Windows\System\MLfbCpc.exe
  2⤵
  PID:7212
- C:\Windows\System\uiGvGtK.exe
  C:\Windows\System\uiGvGtK.exe
  2⤵
  PID:7228
- C:\Windows\System\JTphsuO.exe
  C:\Windows\System\JTphsuO.exe
  2⤵
  PID:7248
- C:\Windows\System\dpXlcxe.exe
  C:\Windows\System\dpXlcxe.exe
  2⤵
  PID:7264
- C:\Windows\System\edWVsFD.exe
  C:\Windows\System\edWVsFD.exe
  2⤵
  PID:7288
- C:\Windows\System\XDJBxVO.exe
  C:\Windows\System\XDJBxVO.exe
  2⤵
  PID:7308
- C:\Windows\System\rsWzNpB.exe
  C:\Windows\System\rsWzNpB.exe
  2⤵
  PID:7324
- C:\Windows\System\zrxqWoc.exe
  C:\Windows\System\zrxqWoc.exe
  2⤵
  PID:7340
- C:\Windows\System\qcGsYuX.exe
  C:\Windows\System\qcGsYuX.exe
  2⤵
  PID:7360
- C:\Windows\System\LkIKAVr.exe
  C:\Windows\System\LkIKAVr.exe
  2⤵
  PID:7400
- C:\Windows\System\YHWwAtR.exe
  C:\Windows\System\YHWwAtR.exe
  2⤵
  PID:7416
- C:\Windows\System\IIOPYnw.exe
  C:\Windows\System\IIOPYnw.exe
  2⤵
  PID:7436
- C:\Windows\System\DQRvGpn.exe
  C:\Windows\System\DQRvGpn.exe
  2⤵
  PID:7452
- C:\Windows\System\ZIgWJwN.exe
  C:\Windows\System\ZIgWJwN.exe
  2⤵
  PID:7528
- C:\Windows\System\wdMeSZY.exe
  C:\Windows\System\wdMeSZY.exe
  2⤵
  PID:7544
- C:\Windows\System\aktsVxF.exe
  C:\Windows\System\aktsVxF.exe
  2⤵
  PID:7560
- C:\Windows\System\XvhqQMJ.exe
  C:\Windows\System\XvhqQMJ.exe
  2⤵
  PID:7576
- C:\Windows\System\ocEYoXl.exe
  C:\Windows\System\ocEYoXl.exe
  2⤵
  PID:7592
- C:\Windows\System\jOfjFQx.exe
  C:\Windows\System\jOfjFQx.exe
  2⤵
  PID:7608
- C:\Windows\System\qFMBTjo.exe
  C:\Windows\System\qFMBTjo.exe
  2⤵
  PID:7624
- C:\Windows\System\UXobgPO.exe
  C:\Windows\System\UXobgPO.exe
  2⤵
  PID:7640
- C:\Windows\System\aJYiXxt.exe
  C:\Windows\System\aJYiXxt.exe
  2⤵
  PID:7692
- C:\Windows\System\MQHYISZ.exe
  C:\Windows\System\MQHYISZ.exe
  2⤵
  PID:7708
- C:\Windows\System\zNcvoSr.exe
  C:\Windows\System\zNcvoSr.exe
  2⤵
  PID:7724
- C:\Windows\System\cibGtoH.exe
  C:\Windows\System\cibGtoH.exe
  2⤵
  PID:7740
- C:\Windows\System\finpIcP.exe
  C:\Windows\System\finpIcP.exe
  2⤵
  PID:7760
- C:\Windows\System\CzYOruL.exe
  C:\Windows\System\CzYOruL.exe
  2⤵
  PID:7780
- C:\Windows\System\sNdYuwk.exe
  C:\Windows\System\sNdYuwk.exe
  2⤵
  PID:7796
- C:\Windows\System\sLDhoTw.exe
  C:\Windows\System\sLDhoTw.exe
  2⤵
  PID:7820
- C:\Windows\System\LqBZFPv.exe
  C:\Windows\System\LqBZFPv.exe
  2⤵
  PID:7836
- C:\Windows\System\ElrISeV.exe
  C:\Windows\System\ElrISeV.exe
  2⤵
  PID:7856
- C:\Windows\System\dBAnyVU.exe
  C:\Windows\System\dBAnyVU.exe
  2⤵
  PID:7872
- C:\Windows\System\ANtVQzO.exe
  C:\Windows\System\ANtVQzO.exe
  2⤵
  PID:7896
- C:\Windows\System\DcIDxyS.exe
  C:\Windows\System\DcIDxyS.exe
  2⤵
  PID:7912
- C:\Windows\System\BzZxrek.exe
  C:\Windows\System\BzZxrek.exe
  2⤵
  PID:7932
- C:\Windows\System\WVjfETg.exe
  C:\Windows\System\WVjfETg.exe
  2⤵
  PID:7952
- C:\Windows\System\gZxTkHP.exe
  C:\Windows\System\gZxTkHP.exe
  2⤵
  PID:7968
- C:\Windows\System\uInpfwo.exe
  C:\Windows\System\uInpfwo.exe
  2⤵
  PID:7992
- C:\Windows\System\lypLGsw.exe
  C:\Windows\System\lypLGsw.exe
  2⤵
  PID:8008
- C:\Windows\System\NpzFSKd.exe
  C:\Windows\System\NpzFSKd.exe
  2⤵
  PID:8052
- C:\Windows\System\MfEbabQ.exe
  C:\Windows\System\MfEbabQ.exe
  2⤵
  PID:8068
- C:\Windows\System\vtrXsdf.exe
  C:\Windows\System\vtrXsdf.exe
  2⤵
  PID:8084
- C:\Windows\System\HvCpnIR.exe
  C:\Windows\System\HvCpnIR.exe
  2⤵
  PID:8104
- C:\Windows\System\ORHLmUF.exe
  C:\Windows\System\ORHLmUF.exe
  2⤵
  PID:8120
- C:\Windows\System\gKANuOY.exe
  C:\Windows\System\gKANuOY.exe
  2⤵
  PID:8140
- C:\Windows\System\BbJPAkz.exe
  C:\Windows\System\BbJPAkz.exe
  2⤵
  PID:8156
- C:\Windows\System\NbMlkma.exe
  C:\Windows\System\NbMlkma.exe
  2⤵
  PID:8176
- C:\Windows\System\oHSEVsu.exe
  C:\Windows\System\oHSEVsu.exe
  2⤵
  PID:6968
- C:\Windows\System\LnJieeL.exe
  C:\Windows\System\LnJieeL.exe
  2⤵
  PID:7180
- C:\Windows\System\VikDQCp.exe
  C:\Windows\System\VikDQCp.exe
  2⤵
  PID:7220
- C:\Windows\System\llHeOxG.exe
  C:\Windows\System\llHeOxG.exe
  2⤵
  PID:7300
- C:\Windows\System\LrNBGfJ.exe
  C:\Windows\System\LrNBGfJ.exe
  2⤵
  PID:7368
- C:\Windows\System\OsHAbqM.exe
  C:\Windows\System\OsHAbqM.exe
  2⤵
  PID:7384
- C:\Windows\System\qJSmPZe.exe
  C:\Windows\System\qJSmPZe.exe
  2⤵
  PID:7428
- C:\Windows\System\CNkTyvg.exe
  C:\Windows\System\CNkTyvg.exe
  2⤵
  PID:7468
- C:\Windows\System\iszpWIv.exe
  C:\Windows\System\iszpWIv.exe
  2⤵
  PID:7480
- C:\Windows\System\azeiyjz.exe
  C:\Windows\System\azeiyjz.exe
  2⤵
  PID:7492
- C:\Windows\System\yllIHCc.exe
  C:\Windows\System\yllIHCc.exe
  2⤵
  PID:7052
- C:\Windows\System\NJrLxNJ.exe
  C:\Windows\System\NJrLxNJ.exe
  2⤵
  PID:6440
- C:\Windows\System\WCPgAId.exe
  C:\Windows\System\WCPgAId.exe
  2⤵
  PID:7508
- C:\Windows\System\ZGFIrGL.exe
  C:\Windows\System\ZGFIrGL.exe
  2⤵
  PID:7272
- C:\Windows\System\fEGnMCn.exe
  C:\Windows\System\fEGnMCn.exe
  2⤵
  PID:6412
- C:\Windows\System\AUMPpWs.exe
  C:\Windows\System\AUMPpWs.exe
  2⤵
  PID:6236
- C:\Windows\System\OKnmGGC.exe
  C:\Windows\System\OKnmGGC.exe
  2⤵
  PID:7036
- C:\Windows\System\WPUTIwC.exe
  C:\Windows\System\WPUTIwC.exe
  2⤵
  PID:7520
- C:\Windows\System\EFYjgeJ.exe
  C:\Windows\System\EFYjgeJ.exe
  2⤵
  PID:7244
- C:\Windows\System\nzmDtLg.exe
  C:\Windows\System\nzmDtLg.exe
  2⤵
  PID:7348
- C:\Windows\System\veZVfZF.exe
  C:\Windows\System\veZVfZF.exe
  2⤵
  PID:7444
- C:\Windows\System\qdwHUoD.exe
  C:\Windows\System\qdwHUoD.exe
  2⤵
  PID:7556
- C:\Windows\System\RajUaNN.exe
  C:\Windows\System\RajUaNN.exe
  2⤵
  PID:7664
- C:\Windows\System\WlnwYsS.exe
  C:\Windows\System\WlnwYsS.exe
  2⤵
  PID:7660
- C:\Windows\System\iSQFyqR.exe
  C:\Windows\System\iSQFyqR.exe
  2⤵
  PID:7688
- C:\Windows\System\WENJsvU.exe
  C:\Windows\System\WENJsvU.exe
  2⤵
  PID:6832
- C:\Windows\System\CjTrQNt.exe
  C:\Windows\System\CjTrQNt.exe
  2⤵
  PID:7632
- C:\Windows\System\ByPzULj.exe
  C:\Windows\System\ByPzULj.exe
  2⤵
  PID:7752
- C:\Windows\System\xdoXSqT.exe
  C:\Windows\System\xdoXSqT.exe
  2⤵
  PID:7828
- C:\Windows\System\SysumWT.exe
  C:\Windows\System\SysumWT.exe
  2⤵
  PID:7940
- C:\Windows\System\INJGTRt.exe
  C:\Windows\System\INJGTRt.exe
  2⤵
  PID:7704
- C:\Windows\System\MdlHBKj.exe
  C:\Windows\System\MdlHBKj.exe
  2⤵
  PID:7984
- C:\Windows\System\RXxbCTC.exe
  C:\Windows\System\RXxbCTC.exe
  2⤵
  PID:8032
- C:\Windows\System\MdRGiLa.exe
  C:\Windows\System\MdRGiLa.exe
  2⤵
  PID:7736
- C:\Windows\System\sIAsxkG.exe
  C:\Windows\System\sIAsxkG.exe
  2⤵
  PID:8020
- C:\Windows\System\oAQFkSh.exe
  C:\Windows\System\oAQFkSh.exe
  2⤵
  PID:7844
- C:\Windows\System\Jtvyitm.exe
  C:\Windows\System\Jtvyitm.exe
  2⤵
  PID:6148
- C:\Windows\System\hcCpBFr.exe
  C:\Windows\System\hcCpBFr.exe
  2⤵
  PID:7396
- C:\Windows\System\HbYDgyD.exe
  C:\Windows\System\HbYDgyD.exe
  2⤵
  PID:7888
- C:\Windows\System\uahYNAI.exe
  C:\Windows\System\uahYNAI.exe
  2⤵
  PID:7928
- C:\Windows\System\asulVDP.exe
  C:\Windows\System\asulVDP.exe
  2⤵
  PID:7096
- C:\Windows\System\hwtrBHE.exe
  C:\Windows\System\hwtrBHE.exe
  2⤵
  PID:8128
- C:\Windows\System\cQrjqum.exe
  C:\Windows\System\cQrjqum.exe
  2⤵
  PID:8096
- C:\Windows\System\EXdlccq.exe
  C:\Windows\System\EXdlccq.exe
  2⤵
  PID:6364
- C:\Windows\System\DBXmmcF.exe
  C:\Windows\System\DBXmmcF.exe
  2⤵
  PID:8136
- C:\Windows\System\ZAilCIJ.exe
  C:\Windows\System\ZAilCIJ.exe
  2⤵
  PID:6480
- C:\Windows\System\bZzlKBh.exe
  C:\Windows\System\bZzlKBh.exe
  2⤵
  PID:6828
- C:\Windows\System\RdRbchm.exe
  C:\Windows\System\RdRbchm.exe
  2⤵
  PID:7504
- C:\Windows\System\dRgpxbt.exe
  C:\Windows\System\dRgpxbt.exe
  2⤵
  PID:6724
- C:\Windows\System\XrafvAg.exe
  C:\Windows\System\XrafvAg.exe
  2⤵
  PID:7320
- C:\Windows\System\gTjHvPT.exe
  C:\Windows\System\gTjHvPT.exe
  2⤵
  PID:7356
- C:\Windows\System\NaKyGmg.exe
  C:\Windows\System\NaKyGmg.exe
  2⤵
  PID:7788
- C:\Windows\System\rSHjezV.exe
  C:\Windows\System\rSHjezV.exe
  2⤵
  PID:6952
- C:\Windows\System\sFlmtDP.exe
  C:\Windows\System\sFlmtDP.exe
  2⤵
  PID:6516
- C:\Windows\System\LofBSBS.exe
  C:\Windows\System\LofBSBS.exe
  2⤵
  PID:7676
- C:\Windows\System\jvMglro.exe
  C:\Windows\System\jvMglro.exe
  2⤵
  PID:7672
- C:\Windows\System\uavvyYn.exe
  C:\Windows\System\uavvyYn.exe
  2⤵
  PID:7280
- C:\Windows\System\vOErxVr.exe
  C:\Windows\System\vOErxVr.exe
  2⤵
  PID:7408
- C:\Windows\System\radGuYS.exe
  C:\Windows\System\radGuYS.exe
  2⤵
  PID:7540
- C:\Windows\System\ZOymkIy.exe
  C:\Windows\System\ZOymkIy.exe
  2⤵
  PID:7732
- C:\Windows\System\JzkVCRd.exe
  C:\Windows\System\JzkVCRd.exe
  2⤵
  PID:8044
- C:\Windows\System\dDDzcOV.exe
  C:\Windows\System\dDDzcOV.exe
  2⤵
  PID:7816
- C:\Windows\System\WCyWiUJ.exe
  C:\Windows\System\WCyWiUJ.exe
  2⤵
  PID:7476
- C:\Windows\System\BMEsttS.exe
  C:\Windows\System\BMEsttS.exe
  2⤵
  PID:7496
- C:\Windows\System\HnEMzIB.exe
  C:\Windows\System\HnEMzIB.exe
  2⤵
  PID:8092
- C:\Windows\System\eWYUCEk.exe
  C:\Windows\System\eWYUCEk.exe
  2⤵
  PID:8132
- C:\Windows\System\AKgqVXI.exe
  C:\Windows\System\AKgqVXI.exe
  2⤵
  PID:7260
- C:\Windows\System\zOCzoug.exe
  C:\Windows\System\zOCzoug.exe
  2⤵
  PID:7128
- C:\Windows\System\NOJudhC.exe
  C:\Windows\System\NOJudhC.exe
  2⤵
  PID:7240
- C:\Windows\System\muvCSKg.exe
  C:\Windows\System\muvCSKg.exe
  2⤵
  PID:6396
- C:\Windows\System\XfgYQgD.exe
  C:\Windows\System\XfgYQgD.exe
  2⤵
  PID:6252
- C:\Windows\System\jfQXrGS.exe
  C:\Windows\System\jfQXrGS.exe
  2⤵
  PID:7552
- C:\Windows\System\zZlFeAN.exe
  C:\Windows\System\zZlFeAN.exe
  2⤵
  PID:7684
- C:\Windows\System\hpRzCWu.exe
  C:\Windows\System\hpRzCWu.exe
  2⤵
  PID:1644
- C:\Windows\System\DlUEzvU.exe
  C:\Windows\System\DlUEzvU.exe
  2⤵
  PID:7204
- C:\Windows\System\vBvysBL.exe
  C:\Windows\System\vBvysBL.exe
  2⤵
  PID:7976
- C:\Windows\System\mgFwmIi.exe
  C:\Windows\System\mgFwmIi.exe
  2⤵
  PID:8080
- C:\Windows\System\sluzcXe.exe
  C:\Windows\System\sluzcXe.exe
  2⤵
  PID:8152
- C:\Windows\System\dKcvYzS.exe
  C:\Windows\System\dKcvYzS.exe
  2⤵
  PID:7812
- C:\Windows\System\KCNwggV.exe
  C:\Windows\System\KCNwggV.exe
  2⤵
  PID:7460
- C:\Windows\System\WzSOBBq.exe
  C:\Windows\System\WzSOBBq.exe
  2⤵
  PID:7012
- C:\Windows\System\qTMfVYM.exe
  C:\Windows\System\qTMfVYM.exe
  2⤵
  PID:7904
- C:\Windows\System\LrojqVB.exe
  C:\Windows\System\LrojqVB.exe
  2⤵
  PID:7516
- C:\Windows\System\xVrWDby.exe
  C:\Windows\System\xVrWDby.exe
  2⤵
  PID:7652
- C:\Windows\System\PzrtFek.exe
  C:\Windows\System\PzrtFek.exe
  2⤵
  PID:7716
- C:\Windows\System\ymOvCGG.exe
  C:\Windows\System\ymOvCGG.exe
  2⤵
  PID:8024
- C:\Windows\System\mmeRmIr.exe
  C:\Windows\System\mmeRmIr.exe
  2⤵
  PID:8188
- C:\Windows\System\nazReLo.exe
  C:\Windows\System\nazReLo.exe
  2⤵
  PID:7572
- C:\Windows\System\RtXnVvI.exe
  C:\Windows\System\RtXnVvI.exe
  2⤵
  PID:8112
- C:\Windows\System\XrJOPWe.exe
  C:\Windows\System\XrJOPWe.exe
  2⤵
  PID:7332
- C:\Windows\System\DlMkMyM.exe
  C:\Windows\System\DlMkMyM.exe
  2⤵
  PID:7296
- C:\Windows\System\KVlYmBz.exe
  C:\Windows\System\KVlYmBz.exe
  2⤵
  PID:7584
- C:\Windows\System\cAsEAVD.exe
  C:\Windows\System\cAsEAVD.exe
  2⤵
  PID:7808
- C:\Windows\System\BlXYbmd.exe
  C:\Windows\System\BlXYbmd.exe
  2⤵
  PID:7924
- C:\Windows\System\eTtgrxT.exe
  C:\Windows\System\eTtgrxT.exe
  2⤵
  PID:7336
- C:\Windows\System\dcpglMz.exe
  C:\Windows\System\dcpglMz.exe
  2⤵
  PID:8028
- C:\Windows\System\YoiYIMJ.exe
  C:\Windows\System\YoiYIMJ.exe
  2⤵
  PID:7804
- C:\Windows\System\EWfCXbf.exe
  C:\Windows\System\EWfCXbf.exe
  2⤵
  PID:8196
- C:\Windows\System\GPxLaVw.exe
  C:\Windows\System\GPxLaVw.exe
  2⤵
  PID:8216
- C:\Windows\System\zEvJhbY.exe
  C:\Windows\System\zEvJhbY.exe
  2⤵
  PID:8232
- C:\Windows\System\BMkbiHm.exe
  C:\Windows\System\BMkbiHm.exe
  2⤵
  PID:8248
- C:\Windows\System\lShccvT.exe
  C:\Windows\System\lShccvT.exe
  2⤵
  PID:8268
- C:\Windows\System\wqtVLPE.exe
  C:\Windows\System\wqtVLPE.exe
  2⤵
  PID:8288
- C:\Windows\System\hAyMzbM.exe
  C:\Windows\System\hAyMzbM.exe
  2⤵
  PID:8304
- C:\Windows\System\xkNZUib.exe
  C:\Windows\System\xkNZUib.exe
  2⤵
  PID:8320
- C:\Windows\System\XiORhbi.exe
  C:\Windows\System\XiORhbi.exe
  2⤵
  PID:8336
- C:\Windows\System\GqxeUWy.exe
  C:\Windows\System\GqxeUWy.exe
  2⤵
  PID:8356
- C:\Windows\System\Kgwuclf.exe
  C:\Windows\System\Kgwuclf.exe
  2⤵
  PID:8376
- C:\Windows\System\zIUpFGe.exe
  C:\Windows\System\zIUpFGe.exe
  2⤵
  PID:8396
- C:\Windows\System\aZnDxxF.exe
  C:\Windows\System\aZnDxxF.exe
  2⤵
  PID:8416
- C:\Windows\System\PBJQUVt.exe
  C:\Windows\System\PBJQUVt.exe
  2⤵
  PID:8436
- C:\Windows\System\sBBedFb.exe
  C:\Windows\System\sBBedFb.exe
  2⤵
  PID:8452
- C:\Windows\System\hzFOgEF.exe
  C:\Windows\System\hzFOgEF.exe
  2⤵
  PID:8476
- C:\Windows\System\UPlFynm.exe
  C:\Windows\System\UPlFynm.exe
  2⤵
  PID:8496
- C:\Windows\System\mgUTJaB.exe
  C:\Windows\System\mgUTJaB.exe
  2⤵
  PID:8516
- C:\Windows\System\NOPkcmv.exe
  C:\Windows\System\NOPkcmv.exe
  2⤵
  PID:8536
- C:\Windows\System\GqKbJtW.exe
  C:\Windows\System\GqKbJtW.exe
  2⤵
  PID:8552
- C:\Windows\System\vbGbkPF.exe
  C:\Windows\System\vbGbkPF.exe
  2⤵
  PID:8568
- C:\Windows\System\ZgAnOFs.exe
  C:\Windows\System\ZgAnOFs.exe
  2⤵
  PID:8588
- C:\Windows\System\HrMhzEI.exe
  C:\Windows\System\HrMhzEI.exe
  2⤵
  PID:8608
- C:\Windows\System\XkTPfgM.exe
  C:\Windows\System\XkTPfgM.exe
  2⤵
  PID:8628
- C:\Windows\System\jJyMIgX.exe
  C:\Windows\System\jJyMIgX.exe
  2⤵
  PID:8644
- C:\Windows\System\FNRxYPl.exe
  C:\Windows\System\FNRxYPl.exe
  2⤵
  PID:8660
- C:\Windows\System\WDaoHra.exe
  C:\Windows\System\WDaoHra.exe
  2⤵
  PID:8680
- C:\Windows\System\gAHnSDJ.exe
  C:\Windows\System\gAHnSDJ.exe
  2⤵
  PID:8700
- C:\Windows\System\uNjcUJB.exe
  C:\Windows\System\uNjcUJB.exe
  2⤵
  PID:8720
- C:\Windows\System\mTLLgcR.exe
  C:\Windows\System\mTLLgcR.exe
  2⤵
  PID:8736
- C:\Windows\System\EZzuzKP.exe
  C:\Windows\System\EZzuzKP.exe
  2⤵
  PID:8752
- C:\Windows\System\loATmbM.exe
  C:\Windows\System\loATmbM.exe
  2⤵
  PID:8768
- C:\Windows\System\qtiOVvm.exe
  C:\Windows\System\qtiOVvm.exe
  2⤵
  PID:8788
- C:\Windows\System\FMzFWFY.exe
  C:\Windows\System\FMzFWFY.exe
  2⤵
  PID:8804
- C:\Windows\System\dgQWbXp.exe
  C:\Windows\System\dgQWbXp.exe
  2⤵
  PID:8820
- C:\Windows\System\YRnXkQb.exe
  C:\Windows\System\YRnXkQb.exe
  2⤵
  PID:8840
- C:\Windows\System\uVwDaCb.exe
  C:\Windows\System\uVwDaCb.exe
  2⤵
  PID:8860
- C:\Windows\System\nvfDYyD.exe
  C:\Windows\System\nvfDYyD.exe
  2⤵
  PID:8880
- C:\Windows\System\FwunsKE.exe
  C:\Windows\System\FwunsKE.exe
  2⤵
  PID:8896
- C:\Windows\System\QgtUjAZ.exe
  C:\Windows\System\QgtUjAZ.exe
  2⤵
  PID:8912
- C:\Windows\System\WeXVdHW.exe
  C:\Windows\System\WeXVdHW.exe
  2⤵
  PID:8988
- C:\Windows\System\qkRtyRY.exe
  C:\Windows\System\qkRtyRY.exe
  2⤵
  PID:9004
- C:\Windows\System\FPEQAkz.exe
  C:\Windows\System\FPEQAkz.exe
  2⤵
  PID:9020
- C:\Windows\System\LdBcYoM.exe
  C:\Windows\System\LdBcYoM.exe
  2⤵
  PID:9036
- C:\Windows\System\zZCgCwn.exe
  C:\Windows\System\zZCgCwn.exe
  2⤵
  PID:9052
- C:\Windows\System\bRylavo.exe
  C:\Windows\System\bRylavo.exe
  2⤵
  PID:9068
- C:\Windows\System\GSkpfTC.exe
  C:\Windows\System\GSkpfTC.exe
  2⤵
  PID:9084
- C:\Windows\System\JlGwKjx.exe
  C:\Windows\System\JlGwKjx.exe
  2⤵
  PID:9100
- C:\Windows\System\UZjDKRH.exe
  C:\Windows\System\UZjDKRH.exe
  2⤵
  PID:9116
- C:\Windows\System\pUnvAwR.exe
  C:\Windows\System\pUnvAwR.exe
  2⤵
  PID:9132
- C:\Windows\System\bjFIgSq.exe
  C:\Windows\System\bjFIgSq.exe
  2⤵
  PID:9148
- C:\Windows\System\ZKnZQcg.exe
  C:\Windows\System\ZKnZQcg.exe
  2⤵
  PID:9164
- C:\Windows\System\poxFZbE.exe
  C:\Windows\System\poxFZbE.exe
  2⤵
  PID:9180
- C:\Windows\System\rzpMOyw.exe
  C:\Windows\System\rzpMOyw.exe
  2⤵
  PID:9196
- C:\Windows\System\yKJeIkH.exe
  C:\Windows\System\yKJeIkH.exe
  2⤵
  PID:9212
- C:\Windows\System\QqQmZnG.exe
  C:\Windows\System\QqQmZnG.exe
  2⤵
  PID:7884
- C:\Windows\System\qJBTVKQ.exe
  C:\Windows\System\qJBTVKQ.exe
  2⤵
  PID:7648
- C:\Windows\System\RugRnAc.exe
  C:\Windows\System\RugRnAc.exe
  2⤵
  PID:8316
- C:\Windows\System\LaUwCSa.exe
  C:\Windows\System\LaUwCSa.exe
  2⤵
  PID:8348
- C:\Windows\System\FDSgliQ.exe
  C:\Windows\System\FDSgliQ.exe
  2⤵
  PID:8464
- C:\Windows\System\vGvHWZl.exe
  C:\Windows\System\vGvHWZl.exe
  2⤵
  PID:8504
- C:\Windows\System\cCrUJYw.exe
  C:\Windows\System\cCrUJYw.exe
  2⤵
  PID:8508
- C:\Windows\System\YfTkPTE.exe
  C:\Windows\System\YfTkPTE.exe
  2⤵
  PID:8580
- C:\Windows\System\ulIgkkj.exe
  C:\Windows\System\ulIgkkj.exe
  2⤵
  PID:8616
- C:\Windows\System\pWEXjsN.exe
  C:\Windows\System\pWEXjsN.exe
  2⤵
  PID:8692
- C:\Windows\System\pVeeLAC.exe
  C:\Windows\System\pVeeLAC.exe
  2⤵
  PID:8728
- C:\Windows\System\bZCXbSa.exe
  C:\Windows\System\bZCXbSa.exe
  2⤵
  PID:8764
- C:\Windows\System\gSkAdeG.exe
  C:\Windows\System\gSkAdeG.exe
  2⤵
  PID:8832
- C:\Windows\System\hiMupUR.exe
  C:\Windows\System\hiMupUR.exe
  2⤵
  PID:8260
- C:\Windows\System\oPeefjz.exe
  C:\Windows\System\oPeefjz.exe
  2⤵
  PID:8364
- C:\Windows\System\mQCtwvp.exe
  C:\Windows\System\mQCtwvp.exe
  2⤵
  PID:8908
- C:\Windows\System\QJJPQFQ.exe
  C:\Windows\System\QJJPQFQ.exe
  2⤵
  PID:8444
- C:\Windows\System\WjZfsEc.exe
  C:\Windows\System\WjZfsEc.exe
  2⤵
  PID:8256
- C:\Windows\System\uWxNlOf.exe
  C:\Windows\System\uWxNlOf.exe
  2⤵
  PID:8640
- C:\Windows\System\YWzBRyz.exe
  C:\Windows\System\YWzBRyz.exe
  2⤵
  PID:8744
- C:\Windows\System\parLldg.exe
  C:\Windows\System\parLldg.exe
  2⤵
  PID:8848
- C:\Windows\System\GgobOUz.exe
  C:\Windows\System\GgobOUz.exe
  2⤵
  PID:8892
- C:\Windows\System\PajdIVQ.exe
  C:\Windows\System\PajdIVQ.exe
  2⤵
  PID:8532
- C:\Windows\System\AXIRemR.exe
  C:\Windows\System\AXIRemR.exe
  2⤵
  PID:8712
- C:\Windows\System\oOvJCkk.exe
  C:\Windows\System\oOvJCkk.exe
  2⤵
  PID:8784
- C:\Windows\System\OTOPpex.exe
  C:\Windows\System\OTOPpex.exe
  2⤵
  PID:8368
- C:\Windows\System\ShovKKQ.exe
  C:\Windows\System\ShovKKQ.exe
  2⤵
  PID:8924
- C:\Windows\System\AzudbhE.exe
  C:\Windows\System\AzudbhE.exe
  2⤵
  PID:8484
- C:\Windows\System\DxDHaQo.exe
  C:\Windows\System\DxDHaQo.exe
  2⤵
  PID:8964
- C:\Windows\System\mSIyMCa.exe
  C:\Windows\System\mSIyMCa.exe
  2⤵
  PID:8984
- C:\Windows\System\WWdAHVL.exe
  C:\Windows\System\WWdAHVL.exe
  2⤵
  PID:9000
- C:\Windows\System\wqIzNBp.exe
  C:\Windows\System\wqIzNBp.exe
  2⤵
  PID:9032
- C:\Windows\System\Irviaoo.exe
  C:\Windows\System\Irviaoo.exe
  2⤵
  PID:9076
- C:\Windows\System\VuzluwA.exe
  C:\Windows\System\VuzluwA.exe
  2⤵
  PID:9140
- C:\Windows\System\QrcsJgx.exe
  C:\Windows\System\QrcsJgx.exe
  2⤵
  PID:9124
- C:\Windows\System\jgDcvtw.exe
  C:\Windows\System\jgDcvtw.exe
  2⤵
  PID:9192
- C:\Windows\System\mgZmZuq.exe
  C:\Windows\System\mgZmZuq.exe
  2⤵
  PID:9176
- C:\Windows\System\aQjSikT.exe
  C:\Windows\System\aQjSikT.exe
  2⤵
  PID:8284
- C:\Windows\System\FAFKRmf.exe
  C:\Windows\System\FAFKRmf.exe
  2⤵
  PID:8244
- C:\Windows\System\bJkpvLE.exe
  C:\Windows\System\bJkpvLE.exe
  2⤵
  PID:8168
- C:\Windows\System\ziUfbwt.exe
  C:\Windows\System\ziUfbwt.exe
  2⤵
  PID:8388
- C:\Windows\System\YGKsXyk.exe
  C:\Windows\System\YGKsXyk.exe
  2⤵
  PID:8548
- C:\Windows\System\zSdFyFJ.exe
  C:\Windows\System\zSdFyFJ.exe
  2⤵
  PID:8688
- C:\Windows\System\aDEQRik.exe
  C:\Windows\System\aDEQRik.exe
  2⤵
  PID:8328
- C:\Windows\System\xnIgLUq.exe
  C:\Windows\System\xnIgLUq.exe
  2⤵
  PID:8868
- C:\Windows\System\ipeVXcZ.exe
  C:\Windows\System\ipeVXcZ.exe
  2⤵
  PID:8228
- C:\Windows\System\zojlxIt.exe
  C:\Windows\System\zojlxIt.exe
  2⤵
  PID:8296
- C:\Windows\System\VkXsVPL.exe
  C:\Windows\System\VkXsVPL.exe
  2⤵
  PID:8708
- C:\Windows\System\IvAljyk.exe
  C:\Windows\System\IvAljyk.exe
  2⤵
  PID:8812
- C:\Windows\System\cfrjdMb.exe
  C:\Windows\System\cfrjdMb.exe
  2⤵
  PID:8888
- C:\Windows\System\HrRHtkJ.exe
  C:\Windows\System\HrRHtkJ.exe
  2⤵
  PID:8940
- C:\Windows\System\veRECyS.exe
  C:\Windows\System\veRECyS.exe
  2⤵
  PID:8944
- C:\Windows\System\alrhNBO.exe
  C:\Windows\System\alrhNBO.exe
  2⤵
  PID:8976
- C:\Windows\System\pSQzerK.exe
  C:\Windows\System\pSQzerK.exe
  2⤵
  PID:9044
- C:\Windows\System\wpdBxDs.exe
  C:\Windows\System\wpdBxDs.exe
  2⤵
  PID:9108
- C:\Windows\System\LKzOdSU.exe
  C:\Windows\System\LKzOdSU.exe
  2⤵
  PID:9208
- C:\Windows\System\MlKoAtb.exe
  C:\Windows\System\MlKoAtb.exe
  2⤵
  PID:8148
- C:\Windows\System\HqATPPq.exe
  C:\Windows\System\HqATPPq.exe
  2⤵
  PID:9320
- C:\Windows\System\fQgIphK.exe
  C:\Windows\System\fQgIphK.exe
  2⤵
  PID:9344
- C:\Windows\System\kHMQFtd.exe
  C:\Windows\System\kHMQFtd.exe
  2⤵
  PID:9372
- C:\Windows\System\ohWlpjU.exe
  C:\Windows\System\ohWlpjU.exe
  2⤵
  PID:9388
- C:\Windows\System\ADhlKgg.exe
  C:\Windows\System\ADhlKgg.exe
  2⤵
  PID:9404
- C:\Windows\System\sVEyRPv.exe
  C:\Windows\System\sVEyRPv.exe
  2⤵
  PID:9420
- C:\Windows\System\mJWzmnW.exe
  C:\Windows\System\mJWzmnW.exe
  2⤵
  PID:9440
- C:\Windows\System\uwtgPiz.exe
  C:\Windows\System\uwtgPiz.exe
  2⤵
  PID:9456
- C:\Windows\System\HWfoTzz.exe
  C:\Windows\System\HWfoTzz.exe
  2⤵
  PID:9472
- C:\Windows\System\iaqSmIw.exe
  C:\Windows\System\iaqSmIw.exe
  2⤵
  PID:9488
- C:\Windows\System\wQzZTms.exe
  C:\Windows\System\wQzZTms.exe
  2⤵
  PID:9504
- C:\Windows\System\HwgpCgZ.exe
  C:\Windows\System\HwgpCgZ.exe
  2⤵
  PID:9520
- C:\Windows\System\BLkNPPZ.exe
  C:\Windows\System\BLkNPPZ.exe
  2⤵
  PID:9540
- C:\Windows\System\laVCpWk.exe
  C:\Windows\System\laVCpWk.exe
  2⤵
  PID:9556
- C:\Windows\System\BYclWbZ.exe
  C:\Windows\System\BYclWbZ.exe
  2⤵
  PID:9572
- C:\Windows\System\UgOJeMj.exe
  C:\Windows\System\UgOJeMj.exe
  2⤵
  PID:9592
- C:\Windows\System\gGYrcSI.exe
  C:\Windows\System\gGYrcSI.exe
  2⤵
  PID:9612
- C:\Windows\System\yOdlzkR.exe
  C:\Windows\System\yOdlzkR.exe
  2⤵
  PID:9628
- C:\Windows\System\SzegoiS.exe
  C:\Windows\System\SzegoiS.exe
  2⤵
  PID:9656
- C:\Windows\System\jTuqrba.exe
  C:\Windows\System\jTuqrba.exe
  2⤵
  PID:9684
- C:\Windows\System\pmEZYZS.exe
  C:\Windows\System\pmEZYZS.exe
  2⤵
  PID:9712
- C:\Windows\System\jwIJVVB.exe
  C:\Windows\System\jwIJVVB.exe
  2⤵
  PID:9728
- C:\Windows\System\FYFRxZi.exe
  C:\Windows\System\FYFRxZi.exe
  2⤵
  PID:9748
- C:\Windows\System\KvdLjvR.exe
  C:\Windows\System\KvdLjvR.exe
  2⤵
  PID:9780
- C:\Windows\System\LOvBLzT.exe
  C:\Windows\System\LOvBLzT.exe
  2⤵
  PID:9796
- C:\Windows\System\waYlacA.exe
  C:\Windows\System\waYlacA.exe
  2⤵
  PID:9812
- C:\Windows\System\xJemfuV.exe
  C:\Windows\System\xJemfuV.exe
  2⤵
  PID:9828
- C:\Windows\System\tEVuPpW.exe
  C:\Windows\System\tEVuPpW.exe
  2⤵
  PID:9844
- C:\Windows\System\OAaFVnQ.exe
  C:\Windows\System\OAaFVnQ.exe
  2⤵
  PID:9860
- C:\Windows\System\awXkmsh.exe
  C:\Windows\System\awXkmsh.exe
  2⤵
  PID:9876
- C:\Windows\System\uclcmYQ.exe
  C:\Windows\System\uclcmYQ.exe
  2⤵
  PID:9892
- C:\Windows\System\reKSJnJ.exe
  C:\Windows\System\reKSJnJ.exe
  2⤵
  PID:9908
- C:\Windows\System\jSvqDHx.exe
  C:\Windows\System\jSvqDHx.exe
  2⤵
  PID:9924
- C:\Windows\System\kRLwYHP.exe
  C:\Windows\System\kRLwYHP.exe
  2⤵
  PID:9940
- C:\Windows\System\rNEQzyo.exe
  C:\Windows\System\rNEQzyo.exe
  2⤵
  PID:9956
- C:\Windows\System\ZvffAPf.exe
  C:\Windows\System\ZvffAPf.exe
  2⤵
  PID:9972
- C:\Windows\System\ZdqTKop.exe
  C:\Windows\System\ZdqTKop.exe
  2⤵
  PID:9992
- C:\Windows\System\mVverjq.exe
  C:\Windows\System\mVverjq.exe
  2⤵
  PID:10012
- C:\Windows\System\zBycLgG.exe
  C:\Windows\System\zBycLgG.exe
  2⤵
  PID:10028
- C:\Windows\System\ccJjDvi.exe
  C:\Windows\System\ccJjDvi.exe
  2⤵
  PID:10044
- C:\Windows\System\hzWTIOF.exe
  C:\Windows\System\hzWTIOF.exe
  2⤵
  PID:10064
- C:\Windows\System\VFmPyOB.exe
  C:\Windows\System\VFmPyOB.exe
  2⤵
  PID:10088
- C:\Windows\System\DHBzlHh.exe
  C:\Windows\System\DHBzlHh.exe
  2⤵
  PID:10104
- C:\Windows\System\pDKoAaY.exe
  C:\Windows\System\pDKoAaY.exe
  2⤵
  PID:10124
- C:\Windows\System\GAozptj.exe
  C:\Windows\System\GAozptj.exe
  2⤵
  PID:10140
- C:\Windows\System\ZXfkXsQ.exe
  C:\Windows\System\ZXfkXsQ.exe
  2⤵
  PID:10156
- C:\Windows\System\FMxdrqZ.exe
  C:\Windows\System\FMxdrqZ.exe
  2⤵
  PID:10172
- C:\Windows\System\lyQqihN.exe
  C:\Windows\System\lyQqihN.exe
  2⤵
  PID:10188
- C:\Windows\System\EvlLNrn.exe
  C:\Windows\System\EvlLNrn.exe
  2⤵
  PID:10204
- C:\Windows\System\TbpYyNK.exe
  C:\Windows\System\TbpYyNK.exe
  2⤵
  PID:10220
- C:\Windows\System\jsYXcdJ.exe
  C:\Windows\System\jsYXcdJ.exe
  2⤵
  PID:8576
- C:\Windows\System\rEIhSJJ.exe
  C:\Windows\System\rEIhSJJ.exe
  2⤵
  PID:8624
- C:\Windows\System\myUqHiB.exe
  C:\Windows\System\myUqHiB.exe
  2⤵
  PID:8948
- C:\Windows\System\eyDRoQb.exe
  C:\Windows\System\eyDRoQb.exe
  2⤵
  PID:6752
- C:\Windows\System\CbnQyVm.exe
  C:\Windows\System\CbnQyVm.exe
  2⤵
  PID:7720
- C:\Windows\System\EYdJAYi.exe
  C:\Windows\System\EYdJAYi.exe
  2⤵
  PID:8528
- C:\Windows\System\cCqqcLQ.exe
  C:\Windows\System\cCqqcLQ.exe
  2⤵
  PID:8876
- C:\Windows\System\VsrkIRD.exe
  C:\Windows\System\VsrkIRD.exe
  2⤵
  PID:8748
- C:\Windows\System\sOLyBEc.exe
  C:\Windows\System\sOLyBEc.exe
  2⤵
  PID:9064
- C:\Windows\System\moRNBoF.exe
  C:\Windows\System\moRNBoF.exe
  2⤵
  PID:9188
- C:\Windows\System\OZSgIRV.exe
  C:\Windows\System\OZSgIRV.exe
  2⤵
  PID:9220
- C:\Windows\System\tCAqxZP.exe
  C:\Windows\System\tCAqxZP.exe
  2⤵
  PID:9236
- C:\Windows\System\mhDjMXj.exe
  C:\Windows\System\mhDjMXj.exe
  2⤵
  PID:9252
- C:\Windows\System\TNfWUmA.exe
  C:\Windows\System\TNfWUmA.exe
  2⤵
  PID:9268
- C:\Windows\System\wjXQfeW.exe
  C:\Windows\System\wjXQfeW.exe
  2⤵
  PID:9288
- C:\Windows\System\sowYaKT.exe
  C:\Windows\System\sowYaKT.exe
  2⤵
  PID:9328
- C:\Windows\System\RrPGZWi.exe
  C:\Windows\System\RrPGZWi.exe
  2⤵
  PID:9380
- C:\Windows\System\BDDxfst.exe
  C:\Windows\System\BDDxfst.exe
  2⤵
  PID:9480
- C:\Windows\System\mUivVjP.exe
  C:\Windows\System\mUivVjP.exe
  2⤵
  PID:9552
- C:\Windows\System\oBxxFnl.exe
  C:\Windows\System\oBxxFnl.exe
  2⤵
  PID:9512
- C:\Windows\System\kzVxXyN.exe
  C:\Windows\System\kzVxXyN.exe
  2⤵
  PID:9428
- C:\Windows\System\AfqviBn.exe
  C:\Windows\System\AfqviBn.exe
  2⤵
  PID:9312
- C:\Windows\System\mucZhJm.exe
  C:\Windows\System\mucZhJm.exe
  2⤵
  PID:9364
- C:\Windows\System\PVDwdod.exe
  C:\Windows\System\PVDwdod.exe
  2⤵
  PID:9580
- C:\Windows\System\QTHdqxQ.exe
  C:\Windows\System\QTHdqxQ.exe
  2⤵
  PID:9400
- C:\Windows\System\fdwdCCj.exe
  C:\Windows\System\fdwdCCj.exe
  2⤵
  PID:9528
- C:\Windows\System\nadFJsD.exe
  C:\Windows\System\nadFJsD.exe
  2⤵
  PID:9568
- C:\Windows\System\fnEzWQz.exe
  C:\Windows\System\fnEzWQz.exe
  2⤵
  PID:9636
- C:\Windows\System\jFrLoQb.exe
  C:\Windows\System\jFrLoQb.exe
  2⤵
  PID:9652
- C:\Windows\System\CMxpRaO.exe
  C:\Windows\System\CMxpRaO.exe
  2⤵
  PID:9680
- C:\Windows\System\EYCbsaL.exe
  C:\Windows\System\EYCbsaL.exe
  2⤵
  PID:9744
- C:\Windows\System\dHaVnRF.exe
  C:\Windows\System\dHaVnRF.exe
  2⤵
  PID:9804
- C:\Windows\System\dWOStgl.exe
  C:\Windows\System\dWOStgl.exe
  2⤵
  PID:9696
- C:\Windows\System\FIrnKdM.exe
  C:\Windows\System\FIrnKdM.exe
  2⤵
  PID:9700
- C:\Windows\System\YAtvswu.exe
  C:\Windows\System\YAtvswu.exe
  2⤵
  PID:9792
- C:\Windows\System\XfTGJTq.exe
  C:\Windows\System\XfTGJTq.exe
  2⤵
  PID:9824
- C:\Windows\System\lTydVvA.exe
  C:\Windows\System\lTydVvA.exe
  2⤵
  PID:9932
- C:\Windows\System\kqtJqkI.exe
  C:\Windows\System\kqtJqkI.exe
  2⤵
  PID:9856
- C:\Windows\System\eiHcmeK.exe
  C:\Windows\System\eiHcmeK.exe
  2⤵
  PID:9952
- C:\Windows\System\XxugXPa.exe
  C:\Windows\System\XxugXPa.exe
  2⤵
  PID:9988
- C:\Windows\System\iiiZjkm.exe
  C:\Windows\System\iiiZjkm.exe
  2⤵
  PID:10036
- C:\Windows\System\yMaMSed.exe
  C:\Windows\System\yMaMSed.exe
  2⤵
  PID:10004
- C:\Windows\System\JZUVqZk.exe
  C:\Windows\System\JZUVqZk.exe
  2⤵
  PID:10072
- C:\Windows\System\lYShOWd.exe
  C:\Windows\System\lYShOWd.exe
  2⤵
  PID:10112
- C:\Windows\System\iVlnqgX.exe
  C:\Windows\System\iVlnqgX.exe
  2⤵
  PID:10152
- C:\Windows\System\lLBailo.exe
  C:\Windows\System\lLBailo.exe
  2⤵
  PID:10216
- C:\Windows\System\kUagpkB.exe
  C:\Windows\System\kUagpkB.exe
  2⤵
  PID:10100
- C:\Windows\System\bEAgMKi.exe
  C:\Windows\System\bEAgMKi.exe
  2⤵
  PID:10164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BjTnVkG.exe

Filesize
1.7MB

MD5
5e5cacf382629136447802e83b0966f9

SHA1
6e6991248d96d31a778ab01ec5d7fea9ef73182f

SHA256
1ded59e794430346fc0fcf8cbe5ef598ba27e8cf61fc84ac772efdcc8e7e6615

SHA512
4abd7ffc2feda9e4426f30073247ca655f5fdc729e7b4b088a06b558f637e6cc69a8b03c3c480e1d96d6e6a3b674049df9ab7c575607df8507a8cd4d3e3b1cd7

Download Submit
C:\Windows\system\CeeQIFG.exe

Filesize
1.7MB

MD5
25549720d4893c43f07c77ce3dab6748

SHA1
6a4ccc6a72e88df944e3514a9ed9d2112e5460ba

SHA256
ead02f4c50eca3ff169f0eba8e512a7c4295ea5db8a672901e2856719614f0b4

SHA512
20ef4d641dd6da2ff1b0dc43e4b018952b37707ead9dd306dd15c339c5ae2b5f3d64df29a8a50e42a2cb03d3a6632dd25f3c31732a13834f6fb4ce82cb54981c

Download Submit
C:\Windows\system\DJBPNpS.exe

Filesize
1.7MB

MD5
29178d11942c815290dd18096bc927e3

SHA1
4eda1f384fb6f19e621d73fedc395804de0d4837

SHA256
399f04832f0c7d5404b0b926488b618be61d05f5980c84318102e3c62a26f47b

SHA512
564bee48dfa4575cdaf7ddc9c63af4367bfe9a61fef8a6d0dc413048db3b17d8b5953812ead963284bc983b287a38a58af3fc0f2437a0a18cfa4873d2e65b543

Download Submit
C:\Windows\system\DylkepF.exe

Filesize
1.7MB

MD5
ca71dd352e4448606150b829c50812bf

SHA1
18019c60b44192328be03a775f962b1ed5e65555

SHA256
b9584cf992c3ebba40c2d909a8b1b31f3019354aac1780189dfede495e7d57b6

SHA512
d718cbf09a3dceb5271dc889e6e625631f91e0fa94e13c64239b2e86bdc92740137835678bac6fac769845d18933252850bbeec480c58ba123d6278871ead02e

Download Submit
C:\Windows\system\EaUSapL.exe

Filesize
1.7MB

MD5
91f093a302b785a5fbf554a261ee3f50

SHA1
e6f3f0347e66957d9120577f8074bb93b0af6625

SHA256
646dccc6600983ea2f611bfea9fd4d4264d4bdda9b02ead4e677bc281603beb1

SHA512
64fefdc56711c036cf0907ed4858adbc74c84dd7f693526d821ca1af48274fa1128fcd487ee28d817d5242a5a9ec316bc0587a1833425cdb72a4fafa27f2cb79

Download Submit
C:\Windows\system\EiFqRZy.exe

Filesize
1.7MB

MD5
c880c229c81553c509cbf0349d11b13e

SHA1
71a33cd721f43297b7bcdd9c547d144ec7b96040

SHA256
2874d45df480a8bc8bf6ceb214bb4942a29efd980a6a6558d3c5df23fa67b79d

SHA512
566d3b9375be5b5d99fe20176b30d69a918bebafa3516bd71989de44cca32755e6c6dfa83fbde27cf75da41512a3ec98c5f9aa47c5cfbfed3dd7049bb8486d0d

Download Submit
C:\Windows\system\GKQANVm.exe

Filesize
1.7MB

MD5
3b9b97ccd2489f68b639987d7a80f8ec

SHA1
e3e51af699dd0b8e10245f7358d49706f7217413

SHA256
98401c6e4387b4b231c155545e5c975ee2a3e68ee083861663e3e26a554b1147

SHA512
b65c680ec154f9d12c53abc178a5b0edcd75aa301cf1009bc5df711fc41f514090e2d199a05fffc3144c8db2bc1fd9c20748c1ba810ac0ae0b8d2051770252c8

Download Submit
C:\Windows\system\GvUvCVx.exe

Filesize
1.7MB

MD5
f925cd55d9e9e53406b064841e77f537

SHA1
3bb20596b8ae3cb538b0e1d23b2c9e3dbf498577

SHA256
10ec9cbcc762abe3a0d137c724994a36142a21894b1486e8449951bbfde83d72

SHA512
b42bf26f7e8868f8c0cef8ca10f6f4207d6469c67f562fb73415a42c64a3daa55f43c355ba190cf3102dd132c519e6bf69cbbb7d0cdcd2715a07225869d3dff0

Download Submit
C:\Windows\system\IiJNusd.exe

Filesize
1.7MB

MD5
f86b596ce1e047d16dd8e8e63e3f0610

SHA1
4ab16ce6228cc7b6158a869d1e593d38d273bb4e

SHA256
3e8885e08863bf14e2c4aeb6e902b2a0cd2b17aa605182cdfc5f7d8b12a7108b

SHA512
24e799471ba4030740a40dbe7c132a8a9f36a252fe9d545d3061cb19ced6d68b4502230c7f3608649a523592200728c131561c17fe161ace228786e970fac182

Download Submit
C:\Windows\system\JNVASnA.exe

Filesize
1.7MB

MD5
2f61828c4cdf654c68c574c3bb12d2ca

SHA1
33ef3155a6684ca4e7f10de963ba02ab15734088

SHA256
0972cc230148beedf412957c0678fd544cc0c7db86767d90e362748a068c379c

SHA512
41465add0ec569e34ae09b084caae884ffc6d6122a6f06d1f57ccae57571746e26e5b851fc85c25e5eca949428e2812c361dabff506c812b16574c1749e84de9

Download Submit
C:\Windows\system\OiUTLsh.exe

Filesize
1.7MB

MD5
9201200eb4e0a1a860e03a4eeaed6631

SHA1
c1d20177cccc38b0d18e3c58ec085e30ec804dac

SHA256
6ad1b9bc7e7f90dd988a67418631c27ed62a1eab12cf681e6a3a1ae7f7a659a6

SHA512
a2dc4ba2fa1dcaa0cb7193ebe7aafc6332f872cfb19cce4f32b57f64fa3899f1ac802142b0350ab5e4d2e45535bbe2c20f2c9e6201a8da106b7fbd765e452288

Download Submit
C:\Windows\system\QTNEMPm.exe

Filesize
1.7MB

MD5
041671289195e8e13465d17476f1f141

SHA1
b0fb188e40aafe3f69e2b044fb9577d673face86

SHA256
5d1f6667483f7e98fee12849bda6b4dcce9da505cbe8923e92a058a810ba3345

SHA512
448866e5db01784e5002f4ff107ebca80b031292cb9344d7604042eb82357838acb732063a22c12e3d1d9ea355bf6700f2ca25e3e0d24f65cbb5366bd8c746bb

Download Submit
C:\Windows\system\UsTyMSF.exe

Filesize
1.7MB

MD5
6542bdf8bd3c4d83e91e82b43c07bc57

SHA1
d88dd275a1dfe817bc1416bbb65b3613b25ec3d6

SHA256
01271e3f807cc89e6e11d89ffb985cd53641515b979d7b084e6481f054524d2d

SHA512
3582328479b793ce9090df1d7e4226ef030b727f2ff8c777d4b506deeacd60cb5303dd9dc9934fb386cb2e197465f6456b200ae7ea90b632c17c376d31442296

Download Submit
C:\Windows\system\WakGdcU.exe

Filesize
1.7MB

MD5
e53edd172163a3b1575347ed6ce5514a

SHA1
167e593941f765a36eb4e90fbace92eb6b77203b

SHA256
4f9344e205efd5f8467dff5bcc7abfc2f50d18add74b57278569e6935ee6c74f

SHA512
b1c395707b9c180d39e24a7e1d1adecb37dd60cae91fa987d4efe7f898b60a1a7b3322211eb32e757c079147b230a33e0656e2d2ba6204f5ce9cfeb156ed259b

Download Submit
C:\Windows\system\WyXwjYa.exe

Filesize
1.7MB

MD5
842ea38c020c1fd148a31a3d0ca41903

SHA1
e5d52bcfdcf5c2122b721f865f3bebe415ec24a8

SHA256
85ca9e0a07bb4cefffd8c70e0bc315c4ddf47bc51d2dcaa9a9aeaa9108e759a3

SHA512
9fcd4775cc0aa95a509a434353349cb30c1432e379cb49e40f11a59523ec77fdedbdb973e8fb0f2fcef9e37d58f70814eb4ad6e25a6494caf786da0030d5bd3c

Download Submit
C:\Windows\system\dhPUyGx.exe

Filesize
1.7MB

MD5
fdceee88f715603620aadaf3602daa77

SHA1
47641adf36b4aefd8b93b5e58f0f783c304c6afb

SHA256
defc69775033bad6fbbaa35df959fb9643c81748a2f999de6216b0127622d725

SHA512
8777ebba2bdcdab67f78ae8aadbf9a18709337617943232b2e6b65fe779185d4697611f3c70d2459b289aa30ae66367eae5500ea2aeb97f70b5f1971e764e439

Download Submit
C:\Windows\system\kKseONe.exe

Filesize
1.7MB

MD5
8ede254d1aa27247ec653cbd02b545b3

SHA1
67631a3f79215d2e776a05b9bcd4cd6704c8944c

SHA256
5263dab3ae7a0cc0237f3e88ba43e3ddf4b981813c0083a037694200e233b2fd

SHA512
7ba9dc073a7e5566b59f76ad621c844363e63ab4b2ed1361a183506209253d328ef528e075cff63adc26f9207bdb84857b0057d0dfbddadfa886561b0fc47161

Download Submit
C:\Windows\system\klZCMSn.exe

Filesize
1.7MB

MD5
594640bfda2d0f1ff4b626b22bcf7e1f

SHA1
6b997aed6503ea2bb9a32919fdd5d628578ec152

SHA256
4f186104a580e49fced45c2f6db9fb76f96e83a7c5444e59b689463a589903ad

SHA512
96cbe250fdb70acf558e300dcfba2424f296ec77bdd29abbc6c5cf4d1a6c4c1144d14ade753d7891fa20c2428a4086600fe90f652d3feb7e94c6c70ea0977f83

Download Submit
C:\Windows\system\lZKarSX.exe

Filesize
1.7MB

MD5
ba9ad4cadeb2e9ad865e342cb3bd1836

SHA1
82acc7d4a0f0ad195040250e2448de67d82621a5

SHA256
1b677a80e1202600a6e8a9691aed0b60c12f3d5c6e68e8aa9c5826eefe3a41ad

SHA512
ba7a7f302793576c4f32ee173309ad86d70484ec4702d83a5733837fb111042dace2714d288cb9b2854eadfa5c6f171b7e818dd6a53b75a61d815fa7cbffc1e8

Download Submit
C:\Windows\system\liFmqmw.exe

Filesize
1.7MB

MD5
558bd8164ee3683f183bd5111ac75363

SHA1
030f1aef7dcf6283233bd0d571de7be0b08437ea

SHA256
6e6e849588c0ea6fbfe7e889d2b46f53427f987db4bff8a8aaaca6c2a53b8e96

SHA512
fd119d330919ff3da2fd22b6ca2c004c10159dc23de5e7dbeb1fd026d0f615a26071f8fec2c3e5948cd0caf0ae4525dc6c0444f9c47bc6aaa910090b32072887

Download Submit
C:\Windows\system\mCFpwrB.exe

Filesize
1.7MB

MD5
1ad4af080813c13f1e40abb34216cb9b

SHA1
1e11625f8640b4d301efda5888ff7ba61bbb3e32

SHA256
ec317762015dfcb71a734fb0f2dad387ab743aa7fc6b6e9a84996c52fe6c6c33

SHA512
6154f12d3596b98bec4a7db04cb26585f4eb6a06fcc6939622a56e1ba6520f968a361a6c9ca79a8feb0488eb54a0348087f9e1c8cf14559a49f8e02bcbe58004

Download Submit
C:\Windows\system\mogQAcD.exe

Filesize
1.7MB

MD5
0f53e83a3e999318dbde2e813fb3a391

SHA1
d8f53f95014bacb260650c7d20ffd26dd02fef81

SHA256
ba0e09c6c971910911ceb4b1677454c460f463dbe2630aa58ca4fb1553274e8c

SHA512
fab77242b78b4efe2d84baa99d21cdf372c27f017bb0ba0424ff079334f04ee353a726390b6921f9ba092a765fc2ea1828918b35573794dd43795f8be90424f6

Download Submit
C:\Windows\system\nBuxiSQ.exe

Filesize
1.7MB

MD5
b5b943e9c2a5e1d6a821f056d5dc16b8

SHA1
fd423016482ab6f63428d752f33d7c3abd080a64

SHA256
46071836c4e4069bcb9abc96987bed44d6648bf6f694792b914bbfe26abfccdc

SHA512
98fc4ffb0349119ffc5d8720b606f2fab779ac550ca530e12bf1aa787502adaad4e22fdc5dee1c1b83d203b853147f4785a8730b00e28dc1fb6f436cff7a3550

Download Submit
C:\Windows\system\ofyPSrn.exe

Filesize
1.7MB

MD5
0309ca51d312f8817d09f1b39eaf2118

SHA1
7fc87873c2aca4fee71853fac1361c66eda3a82c

SHA256
491e75f1c4d0c8cfcc0fb25359d383bbb58e1c81d5ce9cd073db20734a962790

SHA512
9080d198bb965d437066aa8d55757467ab3eb7b23d5de2e14da98bbba2265b2288fc6442c807342eb61c7367651ae2a8a94276452768534850041a43e4ffd62d

Download Submit
C:\Windows\system\pnUJljI.exe

Filesize
1.7MB

MD5
ad3520959c19c49381fd49e7b443abc5

SHA1
a90a559a2027bdb14f93c2d85a89476f2460d43b

SHA256
09eb2c1ad6471acd77fdcbb03db677c9eb321f079a025fca59e016465b473c08

SHA512
06c793b242d0ad70ce84a5df2cf3d367cd4ccfc66d06ca2bd10a3b4cdec0a451014eee6288bb5a5205904b93baf22fe218f96c4a5d118e3bc537befa84f443b6

Download Submit
C:\Windows\system\qwASYUd.exe

Filesize
1.7MB

MD5
8f862ace07582cdecade0a6a2d4f1b2e

SHA1
c3915ac91e012125e4e9fc9a9d9680e877b99d7a

SHA256
d1aa85837750f51f2276b01d9de28a213ce17cad491c4d67399e147817b26180

SHA512
64c4956669dfb6f0cbc0a3619c115d7cc0a79bb34b44744f46abe689f957e83eb8fce5e6e8576d844a561bdee6ce58290b9672877f71fbbf59b30056bc793456

Download Submit
C:\Windows\system\rMElSdt.exe

Filesize
1.7MB

MD5
f0a83481124d5b1e3e704c72417b75ac

SHA1
18cee486182eb512e5c63fc975efbd04e0f146cc

SHA256
7e7fe57b95bcf9790e95deb4cabd4c6038ba7be9b2b298da95f44e0e6b4e60f3

SHA512
013ba22e4f7d181f867c9ce1571ea1ad793b7b833501b50bf37a505d82467a207b6b62d86d7c082e5959cdae77bdf58752a57132586ff2db6fc860812b337e10

Download Submit
C:\Windows\system\sTXwrJg.exe

Filesize
1.7MB

MD5
e5efaf9ea20e060052af6e57f2221540

SHA1
97e3ae3a35a10356bac88d52a33c3f0074bd7321

SHA256
8f33c7bf036706f3aaefa17eafe2934f2ace32a6fbf8909046b3533f6054affc

SHA512
e9dbbf0dbcdc3ce1d3bab74430944faada2ae286f781851c44bbd681992d7927af2cbac75a002dfe91301c52e49ca2801fb37ad49c8b183d1ffe8e0764a6634a

Download Submit
C:\Windows\system\ssnUhFZ.exe

Filesize
1.7MB

MD5
62bb7ce2a3929d60faebfbbc4c17ad45

SHA1
b4379c037f8f10a77ae9e434a5baab988542c49c

SHA256
636a3af58d00330c41a7aca9ec3e8b40a14f59cd69933c50a8adaece3f9eb875

SHA512
61958d522cabb26e50360b2cdf72d756f51de6f55b058f8a584fffc66a6ba5ee16892708b3bd17cf96810134b96b6a3b58bb2e74ab80c1b8d25b235417d15f7b

Download Submit
\Windows\system\GtqlUAb.exe

Filesize
1.7MB

MD5
8ad8c7e35ebcb23956ceb6ad90f008f7

SHA1
9d218ee20dde47c8b197da2880d236f002ac606e

SHA256
749f6c41e397d7253bb491516721eb153458cc9110505f7b30314dc81988eeee

SHA512
8814ebcb975c59337038d552d2816bc1b3c717ff0d874ad201d3c653c5b372ac54a70551350314a6e80eb7780537d28f20b4c04de708d4d8a9d8b09c1071e161

Download Submit
\Windows\system\JkzpfNv.exe

Filesize
1.7MB

MD5
0f93305d262b83827f89f34f748104e0

SHA1
424b741aecb79a8bca625903edc57f173e72810d

SHA256
9028446a5ef70e8dd51c0434dce500a94ca5dc2eb9355aebfc2b8429d7a9d641

SHA512
883bece888b7ee088c239e9fc11ae2a9b9ddda1172e065d9d01b82a4f7f23cffb5164eace04cceef1072ae27aaf59ddf1d3b5ac83dcfc241105636a4040b4180

Download Submit
\Windows\system\rzwYpOc.exe

Filesize
1.7MB

MD5
a0a72b0d26f756d8589e04b1c6d8070e

SHA1
9e7d9942287d730f11ff5653728beed28f0b5e1a

SHA256
63f4e137674c7a06e5260225a6b54fa18e7a6d46b28a0244c0a40cf14105c2ef

SHA512
ad7220ba057504e9c4e73b5a74e6c5834c485dc1dbf8cad928b175b64741d45d74cfae546ba5181fbb2d36cf3bc141ea2c9496acb4b59b4923dfd3eff258c5e6

Download Submit
memory/3064-0-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download