xmrig | 04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
Size

1.8MB
MD5

03d37bdfeac66ecf68ae18b43117c5fa
SHA1

2ef6073296dd4d27c9a07b69170d2720ef92fe27
SHA256

04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3
SHA512

d28f925533391419a2274e8e064beefc715b943f9cf351a024810f97ca8cc7bdf59ece037999b70ebfb624278f36d0635c686ce7dc6957d18226aaab0b097c9c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7eq0:GemTLkNdfE0pZyF

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012263-2.dat	xmrig
behavioral1/files/0x00080000000186bb-7.dat	xmrig
behavioral1/files/0x00080000000186c3-9.dat	xmrig
behavioral1/files/0x0008000000018b05-16.dat	xmrig
behavioral1/files/0x001500000001756e-24.dat	xmrig
behavioral1/files/0x0007000000018b50-25.dat	xmrig
behavioral1/files/0x0007000000018b54-33.dat	xmrig
behavioral1/files/0x0007000000018b59-35.dat	xmrig
behavioral1/files/0x000600000001948c-43.dat	xmrig
behavioral1/files/0x000500000001975a-48.dat	xmrig
behavioral1/files/0x0005000000019761-53.dat	xmrig
behavioral1/files/0x00050000000197fd-58.dat	xmrig
behavioral1/files/0x000500000001998d-66.dat	xmrig
behavioral1/files/0x0005000000019d62-96.dat	xmrig
behavioral1/files/0x000500000001a049-128.dat	xmrig
behavioral1/files/0x000500000001a309-138.dat	xmrig
behavioral1/files/0x000500000001a3f8-153.dat	xmrig
behavioral1/files/0x000500000001a3fd-158.dat	xmrig
behavioral1/files/0x000500000001a3f6-148.dat	xmrig
behavioral1/files/0x000500000001a3ab-143.dat	xmrig
behavioral1/files/0x000500000001a0b6-133.dat	xmrig
behavioral1/files/0x000500000001a03c-123.dat	xmrig
behavioral1/files/0x0005000000019fd4-113.dat	xmrig
behavioral1/files/0x0005000000019fdd-118.dat	xmrig
behavioral1/files/0x0005000000019d6d-103.dat	xmrig
behavioral1/files/0x0005000000019e92-108.dat	xmrig
behavioral1/files/0x0005000000019d61-94.dat	xmrig
behavioral1/files/0x0005000000019c3c-88.dat	xmrig
behavioral1/files/0x0005000000019bf9-83.dat	xmrig
behavioral1/files/0x0005000000019bf6-78.dat	xmrig
behavioral1/files/0x0005000000019bf5-74.dat	xmrig
behavioral1/files/0x0005000000019820-63.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1396	DBSGVEo.exe
2804	mfpwWMB.exe
2828	cbUsrOo.exe
1076	veJJyko.exe
2712	PyrwZDJ.exe
2764	VIMHnRh.exe
2884	LqYvKGD.exe
2724	hncmSWx.exe
2688	tlDhYgu.exe
2748	RfmLXCG.exe
2228	UaQjeqF.exe
2424	YeOzhDn.exe
2660	JkAZoxo.exe
1788	aaZHdfJ.exe
1500	wZTNVcc.exe
2628	ygDZhJx.exe
1936	XLHNRpL.exe
2356	EdNdFcd.exe
2736	iHKVyTa.exe
2992	fpXWfUp.exe
2716	dKMSorS.exe
2344	osOCZJp.exe
3060	YkHMpCc.exe
1300	dboIkFp.exe
2408	gkupJcE.exe
588	EqalbUI.exe
1400	vriXznG.exe
1844	zFIEmtH.exe
2324	XEoggQB.exe
2600	EMJVKJA.exe
1220	kLoztsE.exe
2512	eCSRAxN.exe
1576	vjwuvmS.exe
1264	BmPVdHm.exe
1800	vRexNhP.exe
1236	OBlTRmu.exe
700	KzUUUIR.exe
840	NYoFaNe.exe
940	kutJOTo.exe
1848	iSbRHXn.exe
1376	VZXrgcw.exe
1444	hLlPGLb.exe
1252	WjFPiBn.exe
1736	bFrTbId.exe
1964	psCzyLu.exe
1864	GaWVUde.exe
2072	jahIEFs.exe
2052	yYJTUrY.exe
1304	XUCAKaE.exe
1608	pFbMqTS.exe
1048	ZkFmfXO.exe
2112	OMvuVhA.exe
2156	qKHFbNp.exe
2468	UjUCqvJ.exe
2140	xPYjkrp.exe
1408	dYCGeuM.exe
896	lQKeCGs.exe
1792	YVTjmtt.exe
2592	FOBpSLo.exe
1988	TcCykEf.exe
1532	RBmsTxH.exe
1508	IBMEDTh.exe
2832	erYvSOj.exe
2928	EBXzQss.exe

Loads dropped DLL 64 IoCs

pid	Process
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jrgPgjx.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\hjwXMMJ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\GbFWybA.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\zgEFIHb.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\yEKHMvK.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\aGfADWt.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\fkVhpHL.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\kZOEPEJ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\lzIGzMD.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\XPDEgZi.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\TzDBVDS.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\XUSyXnW.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\dZaHnkb.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\ZaiRPPQ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\FBcULIL.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\GgFmCib.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\zFIEmtH.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\SSqisUe.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\QgNfdUI.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\LIiJdip.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\Qirlmpw.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\Pfufrgv.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\bUYHBvi.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\hGjIOxd.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\SxKoFWl.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\lzFeAri.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\lYZHklf.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\IJblNMt.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\sKoZMaa.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\YcnEZFZ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\aGLcKDd.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\NSVUpgM.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\sciLvSr.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\AzBwbYi.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\KXVBwWZ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\vllGJLZ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\MslnUpL.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\tMGxuwI.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\OoleObh.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\QDfVqSh.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\WfMkeJM.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\dfuvtST.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\wdtdnnl.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\ovAsXyT.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\GMxTaDG.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\jhOxBtc.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\ZlSisgK.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\MJdjqqo.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\UEoMgma.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\JopwwxV.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\HWbbQcJ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\zcSBLgI.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\inVfPvt.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\KySQrAs.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\PvJgDqi.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\hQzIgmO.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\SJzzpTG.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\RKIhkAX.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\sEIYAOZ.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\EZAlcom.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\GuHuFDR.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\QCfFmzB.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\oGxzZzH.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
File created	C:\Windows\System\nxjkiju.exe	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1396	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	31
PID 564 wrote to memory of 1396	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	31
PID 564 wrote to memory of 1396	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	31
PID 564 wrote to memory of 2804	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	32
PID 564 wrote to memory of 2804	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	32
PID 564 wrote to memory of 2804	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	32
PID 564 wrote to memory of 2828	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	33
PID 564 wrote to memory of 2828	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	33
PID 564 wrote to memory of 2828	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	33
PID 564 wrote to memory of 1076	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	34
PID 564 wrote to memory of 1076	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	34
PID 564 wrote to memory of 1076	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	34
PID 564 wrote to memory of 2712	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	35
PID 564 wrote to memory of 2712	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	35
PID 564 wrote to memory of 2712	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	35
PID 564 wrote to memory of 2764	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	36
PID 564 wrote to memory of 2764	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	36
PID 564 wrote to memory of 2764	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	36
PID 564 wrote to memory of 2884	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	37
PID 564 wrote to memory of 2884	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	37
PID 564 wrote to memory of 2884	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	37
PID 564 wrote to memory of 2724	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	38
PID 564 wrote to memory of 2724	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	38
PID 564 wrote to memory of 2724	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	38
PID 564 wrote to memory of 2688	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	39
PID 564 wrote to memory of 2688	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	39
PID 564 wrote to memory of 2688	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	39
PID 564 wrote to memory of 2748	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	40
PID 564 wrote to memory of 2748	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	40
PID 564 wrote to memory of 2748	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	40
PID 564 wrote to memory of 2228	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	41
PID 564 wrote to memory of 2228	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	41
PID 564 wrote to memory of 2228	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	41
PID 564 wrote to memory of 2424	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	42
PID 564 wrote to memory of 2424	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	42
PID 564 wrote to memory of 2424	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	42
PID 564 wrote to memory of 2660	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	43
PID 564 wrote to memory of 2660	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	43
PID 564 wrote to memory of 2660	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	43
PID 564 wrote to memory of 1788	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	44
PID 564 wrote to memory of 1788	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	44
PID 564 wrote to memory of 1788	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	44
PID 564 wrote to memory of 1500	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	45
PID 564 wrote to memory of 1500	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	45
PID 564 wrote to memory of 1500	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	45
PID 564 wrote to memory of 2628	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	46
PID 564 wrote to memory of 2628	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	46
PID 564 wrote to memory of 2628	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	46
PID 564 wrote to memory of 1936	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	47
PID 564 wrote to memory of 1936	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	47
PID 564 wrote to memory of 1936	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	47
PID 564 wrote to memory of 2356	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	48
PID 564 wrote to memory of 2356	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	48
PID 564 wrote to memory of 2356	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	48
PID 564 wrote to memory of 2736	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	49
PID 564 wrote to memory of 2736	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	49
PID 564 wrote to memory of 2736	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	49
PID 564 wrote to memory of 2992	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	50
PID 564 wrote to memory of 2992	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	50
PID 564 wrote to memory of 2992	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	50
PID 564 wrote to memory of 2716	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	51
PID 564 wrote to memory of 2716	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	51
PID 564 wrote to memory of 2716	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	51
PID 564 wrote to memory of 2344	564	04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe	52

C:\Users\Admin\AppData\Local\Temp\04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe
"C:\Users\Admin\AppData\Local\Temp\04bcffb66a16eb420559d93b75aa352b3334ad6031783d6f18ecd8b85ddfe9a3.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\System\DBSGVEo.exe
  C:\Windows\System\DBSGVEo.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\mfpwWMB.exe
  C:\Windows\System\mfpwWMB.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\cbUsrOo.exe
  C:\Windows\System\cbUsrOo.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\veJJyko.exe
  C:\Windows\System\veJJyko.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\PyrwZDJ.exe
  C:\Windows\System\PyrwZDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\VIMHnRh.exe
  C:\Windows\System\VIMHnRh.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\LqYvKGD.exe
  C:\Windows\System\LqYvKGD.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\hncmSWx.exe
  C:\Windows\System\hncmSWx.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\tlDhYgu.exe
  C:\Windows\System\tlDhYgu.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\RfmLXCG.exe
  C:\Windows\System\RfmLXCG.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\UaQjeqF.exe
  C:\Windows\System\UaQjeqF.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\YeOzhDn.exe
  C:\Windows\System\YeOzhDn.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\JkAZoxo.exe
  C:\Windows\System\JkAZoxo.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\aaZHdfJ.exe
  C:\Windows\System\aaZHdfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\wZTNVcc.exe
  C:\Windows\System\wZTNVcc.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ygDZhJx.exe
  C:\Windows\System\ygDZhJx.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\XLHNRpL.exe
  C:\Windows\System\XLHNRpL.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\EdNdFcd.exe
  C:\Windows\System\EdNdFcd.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\iHKVyTa.exe
  C:\Windows\System\iHKVyTa.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\fpXWfUp.exe
  C:\Windows\System\fpXWfUp.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\dKMSorS.exe
  C:\Windows\System\dKMSorS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\osOCZJp.exe
  C:\Windows\System\osOCZJp.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\YkHMpCc.exe
  C:\Windows\System\YkHMpCc.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\dboIkFp.exe
  C:\Windows\System\dboIkFp.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\gkupJcE.exe
  C:\Windows\System\gkupJcE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\EqalbUI.exe
  C:\Windows\System\EqalbUI.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\vriXznG.exe
  C:\Windows\System\vriXznG.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\zFIEmtH.exe
  C:\Windows\System\zFIEmtH.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\XEoggQB.exe
  C:\Windows\System\XEoggQB.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\EMJVKJA.exe
  C:\Windows\System\EMJVKJA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\kLoztsE.exe
  C:\Windows\System\kLoztsE.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\eCSRAxN.exe
  C:\Windows\System\eCSRAxN.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vjwuvmS.exe
  C:\Windows\System\vjwuvmS.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\BmPVdHm.exe
  C:\Windows\System\BmPVdHm.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\vRexNhP.exe
  C:\Windows\System\vRexNhP.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\OBlTRmu.exe
  C:\Windows\System\OBlTRmu.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\KzUUUIR.exe
  C:\Windows\System\KzUUUIR.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\NYoFaNe.exe
  C:\Windows\System\NYoFaNe.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\kutJOTo.exe
  C:\Windows\System\kutJOTo.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\iSbRHXn.exe
  C:\Windows\System\iSbRHXn.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\VZXrgcw.exe
  C:\Windows\System\VZXrgcw.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\hLlPGLb.exe
  C:\Windows\System\hLlPGLb.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WjFPiBn.exe
  C:\Windows\System\WjFPiBn.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\bFrTbId.exe
  C:\Windows\System\bFrTbId.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\psCzyLu.exe
  C:\Windows\System\psCzyLu.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\GaWVUde.exe
  C:\Windows\System\GaWVUde.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\jahIEFs.exe
  C:\Windows\System\jahIEFs.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\yYJTUrY.exe
  C:\Windows\System\yYJTUrY.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\XUCAKaE.exe
  C:\Windows\System\XUCAKaE.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\pFbMqTS.exe
  C:\Windows\System\pFbMqTS.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ZkFmfXO.exe
  C:\Windows\System\ZkFmfXO.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\OMvuVhA.exe
  C:\Windows\System\OMvuVhA.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\qKHFbNp.exe
  C:\Windows\System\qKHFbNp.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\UjUCqvJ.exe
  C:\Windows\System\UjUCqvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xPYjkrp.exe
  C:\Windows\System\xPYjkrp.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\dYCGeuM.exe
  C:\Windows\System\dYCGeuM.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\lQKeCGs.exe
  C:\Windows\System\lQKeCGs.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\YVTjmtt.exe
  C:\Windows\System\YVTjmtt.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\FOBpSLo.exe
  C:\Windows\System\FOBpSLo.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TcCykEf.exe
  C:\Windows\System\TcCykEf.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\RBmsTxH.exe
  C:\Windows\System\RBmsTxH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\IBMEDTh.exe
  C:\Windows\System\IBMEDTh.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\erYvSOj.exe
  C:\Windows\System\erYvSOj.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\EBXzQss.exe
  C:\Windows\System\EBXzQss.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\nAyAcRg.exe
  C:\Windows\System\nAyAcRg.exe
  2⤵
  PID:2880
- C:\Windows\System\xJSAAiY.exe
  C:\Windows\System\xJSAAiY.exe
  2⤵
  PID:2328
- C:\Windows\System\AYTozNs.exe
  C:\Windows\System\AYTozNs.exe
  2⤵
  PID:1676
- C:\Windows\System\gEDhqtU.exe
  C:\Windows\System\gEDhqtU.exe
  2⤵
  PID:2732
- C:\Windows\System\aTjIoIi.exe
  C:\Windows\System\aTjIoIi.exe
  2⤵
  PID:2708
- C:\Windows\System\tkUJxMi.exe
  C:\Windows\System\tkUJxMi.exe
  2⤵
  PID:2132
- C:\Windows\System\IGrPDHf.exe
  C:\Windows\System\IGrPDHf.exe
  2⤵
  PID:2020
- C:\Windows\System\LsXgGnO.exe
  C:\Windows\System\LsXgGnO.exe
  2⤵
  PID:1652
- C:\Windows\System\NFcAemH.exe
  C:\Windows\System\NFcAemH.exe
  2⤵
  PID:2620
- C:\Windows\System\CdpsOFo.exe
  C:\Windows\System\CdpsOFo.exe
  2⤵
  PID:1412
- C:\Windows\System\kjpTwoj.exe
  C:\Windows\System\kjpTwoj.exe
  2⤵
  PID:2264
- C:\Windows\System\gfYukJB.exe
  C:\Windows\System\gfYukJB.exe
  2⤵
  PID:3008
- C:\Windows\System\esEXHZG.exe
  C:\Windows\System\esEXHZG.exe
  2⤵
  PID:2224
- C:\Windows\System\tyNCZYQ.exe
  C:\Windows\System\tyNCZYQ.exe
  2⤵
  PID:2312
- C:\Windows\System\usKlKDJ.exe
  C:\Windows\System\usKlKDJ.exe
  2⤵
  PID:1968
- C:\Windows\System\ZVgkdLT.exe
  C:\Windows\System\ZVgkdLT.exe
  2⤵
  PID:2192
- C:\Windows\System\jGxNmIW.exe
  C:\Windows\System\jGxNmIW.exe
  2⤵
  PID:1680
- C:\Windows\System\pYzTrDv.exe
  C:\Windows\System\pYzTrDv.exe
  2⤵
  PID:2496
- C:\Windows\System\rXUuJiO.exe
  C:\Windows\System\rXUuJiO.exe
  2⤵
  PID:1944
- C:\Windows\System\SZdZrYo.exe
  C:\Windows\System\SZdZrYo.exe
  2⤵
  PID:1624
- C:\Windows\System\xOHrzhA.exe
  C:\Windows\System\xOHrzhA.exe
  2⤵
  PID:1544
- C:\Windows\System\UYIymOL.exe
  C:\Windows\System\UYIymOL.exe
  2⤵
  PID:2104
- C:\Windows\System\iimHZNC.exe
  C:\Windows\System\iimHZNC.exe
  2⤵
  PID:960
- C:\Windows\System\WGvlxQx.exe
  C:\Windows\System\WGvlxQx.exe
  2⤵
  PID:584
- C:\Windows\System\QSejGbr.exe
  C:\Windows\System\QSejGbr.exe
  2⤵
  PID:772
- C:\Windows\System\QWWmAhm.exe
  C:\Windows\System\QWWmAhm.exe
  2⤵
  PID:2460
- C:\Windows\System\pHMuGgg.exe
  C:\Windows\System\pHMuGgg.exe
  2⤵
  PID:1292
- C:\Windows\System\oPNysVD.exe
  C:\Windows\System\oPNysVD.exe
  2⤵
  PID:888
- C:\Windows\System\SFNsgxq.exe
  C:\Windows\System\SFNsgxq.exe
  2⤵
  PID:304
- C:\Windows\System\UZbfldp.exe
  C:\Windows\System\UZbfldp.exe
  2⤵
  PID:3040
- C:\Windows\System\OXMVRwx.exe
  C:\Windows\System\OXMVRwx.exe
  2⤵
  PID:620
- C:\Windows\System\OXTeLXN.exe
  C:\Windows\System\OXTeLXN.exe
  2⤵
  PID:2772
- C:\Windows\System\FtqGxgR.exe
  C:\Windows\System\FtqGxgR.exe
  2⤵
  PID:2308
- C:\Windows\System\OsPbWCh.exe
  C:\Windows\System\OsPbWCh.exe
  2⤵
  PID:1664
- C:\Windows\System\ryAAMmS.exe
  C:\Windows\System\ryAAMmS.exe
  2⤵
  PID:1540
- C:\Windows\System\tmlcIzi.exe
  C:\Windows\System\tmlcIzi.exe
  2⤵
  PID:1580
- C:\Windows\System\GetIUYX.exe
  C:\Windows\System\GetIUYX.exe
  2⤵
  PID:2128
- C:\Windows\System\MIqNGQH.exe
  C:\Windows\System\MIqNGQH.exe
  2⤵
  PID:1524
- C:\Windows\System\lsxFjWa.exe
  C:\Windows\System\lsxFjWa.exe
  2⤵
  PID:2168
- C:\Windows\System\QkIvjRQ.exe
  C:\Windows\System\QkIvjRQ.exe
  2⤵
  PID:1612
- C:\Windows\System\kGQjKkT.exe
  C:\Windows\System\kGQjKkT.exe
  2⤵
  PID:2792
- C:\Windows\System\XnJBbZw.exe
  C:\Windows\System\XnJBbZw.exe
  2⤵
  PID:2932
- C:\Windows\System\qKLrpzX.exe
  C:\Windows\System\qKLrpzX.exe
  2⤵
  PID:2676
- C:\Windows\System\LfxeCJs.exe
  C:\Windows\System\LfxeCJs.exe
  2⤵
  PID:2960
- C:\Windows\System\McWcFDQ.exe
  C:\Windows\System\McWcFDQ.exe
  2⤵
  PID:2332
- C:\Windows\System\wniUVZu.exe
  C:\Windows\System\wniUVZu.exe
  2⤵
  PID:3024
- C:\Windows\System\LARhgIg.exe
  C:\Windows\System\LARhgIg.exe
  2⤵
  PID:836
- C:\Windows\System\WfMkeJM.exe
  C:\Windows\System\WfMkeJM.exe
  2⤵
  PID:2200
- C:\Windows\System\YPrFFxH.exe
  C:\Windows\System\YPrFFxH.exe
  2⤵
  PID:2320
- C:\Windows\System\gVQBfbN.exe
  C:\Windows\System\gVQBfbN.exe
  2⤵
  PID:2908
- C:\Windows\System\pEWhpfm.exe
  C:\Windows\System\pEWhpfm.exe
  2⤵
  PID:2488
- C:\Windows\System\nsbEgtu.exe
  C:\Windows\System\nsbEgtu.exe
  2⤵
  PID:2608
- C:\Windows\System\nwLTTje.exe
  C:\Windows\System\nwLTTje.exe
  2⤵
  PID:2384
- C:\Windows\System\ibcsNjX.exe
  C:\Windows\System\ibcsNjX.exe
  2⤵
  PID:2184
- C:\Windows\System\GWKtsBU.exe
  C:\Windows\System\GWKtsBU.exe
  2⤵
  PID:2024
- C:\Windows\System\VkcRrmw.exe
  C:\Windows\System\VkcRrmw.exe
  2⤵
  PID:2188
- C:\Windows\System\ljOdDnQ.exe
  C:\Windows\System\ljOdDnQ.exe
  2⤵
  PID:2680
- C:\Windows\System\tPQcJGd.exe
  C:\Windows\System\tPQcJGd.exe
  2⤵
  PID:988
- C:\Windows\System\MsYhrXT.exe
  C:\Windows\System\MsYhrXT.exe
  2⤵
  PID:1732
- C:\Windows\System\cDzEeeg.exe
  C:\Windows\System\cDzEeeg.exe
  2⤵
  PID:2416
- C:\Windows\System\SLdffMM.exe
  C:\Windows\System\SLdffMM.exe
  2⤵
  PID:2232
- C:\Windows\System\PYrJXZH.exe
  C:\Windows\System\PYrJXZH.exe
  2⤵
  PID:1744
- C:\Windows\System\dfuvtST.exe
  C:\Windows\System\dfuvtST.exe
  2⤵
  PID:2092
- C:\Windows\System\RElRBOW.exe
  C:\Windows\System\RElRBOW.exe
  2⤵
  PID:1668
- C:\Windows\System\aZLdMYZ.exe
  C:\Windows\System\aZLdMYZ.exe
  2⤵
  PID:2380
- C:\Windows\System\IcABsCv.exe
  C:\Windows\System\IcABsCv.exe
  2⤵
  PID:852
- C:\Windows\System\uhtSKnP.exe
  C:\Windows\System\uhtSKnP.exe
  2⤵
  PID:1688
- C:\Windows\System\gsFcDyz.exe
  C:\Windows\System\gsFcDyz.exe
  2⤵
  PID:596
- C:\Windows\System\vcBsPYa.exe
  C:\Windows\System\vcBsPYa.exe
  2⤵
  PID:2348
- C:\Windows\System\RncSFEu.exe
  C:\Windows\System\RncSFEu.exe
  2⤵
  PID:2244
- C:\Windows\System\QFvPgRC.exe
  C:\Windows\System\QFvPgRC.exe
  2⤵
  PID:1520
- C:\Windows\System\vTvgqyj.exe
  C:\Windows\System\vTvgqyj.exe
  2⤵
  PID:2768
- C:\Windows\System\LvxTdTn.exe
  C:\Windows\System\LvxTdTn.exe
  2⤵
  PID:2872
- C:\Windows\System\BzivNjO.exe
  C:\Windows\System\BzivNjO.exe
  2⤵
  PID:2780
- C:\Windows\System\sVAUQNR.exe
  C:\Windows\System\sVAUQNR.exe
  2⤵
  PID:1016
- C:\Windows\System\zWmJQHO.exe
  C:\Windows\System\zWmJQHO.exe
  2⤵
  PID:944
- C:\Windows\System\gRvyWnt.exe
  C:\Windows\System\gRvyWnt.exe
  2⤵
  PID:2068
- C:\Windows\System\rJJMjHh.exe
  C:\Windows\System\rJJMjHh.exe
  2⤵
  PID:3036
- C:\Windows\System\UeQlVCk.exe
  C:\Windows\System\UeQlVCk.exe
  2⤵
  PID:1148
- C:\Windows\System\FGsOQch.exe
  C:\Windows\System\FGsOQch.exe
  2⤵
  PID:580
- C:\Windows\System\GwvEYYk.exe
  C:\Windows\System\GwvEYYk.exe
  2⤵
  PID:2376
- C:\Windows\System\TsWCJNG.exe
  C:\Windows\System\TsWCJNG.exe
  2⤵
  PID:1144
- C:\Windows\System\mfwwPTO.exe
  C:\Windows\System\mfwwPTO.exe
  2⤵
  PID:2520
- C:\Windows\System\QIjNFwq.exe
  C:\Windows\System\QIjNFwq.exe
  2⤵
  PID:920
- C:\Windows\System\jDoFJKj.exe
  C:\Windows\System\jDoFJKj.exe
  2⤵
  PID:1172
- C:\Windows\System\QLOdHPU.exe
  C:\Windows\System\QLOdHPU.exe
  2⤵
  PID:2240
- C:\Windows\System\mjBylFW.exe
  C:\Windows\System\mjBylFW.exe
  2⤵
  PID:2364
- C:\Windows\System\gVAbVdt.exe
  C:\Windows\System\gVAbVdt.exe
  2⤵
  PID:1564
- C:\Windows\System\AWmSATc.exe
  C:\Windows\System\AWmSATc.exe
  2⤵
  PID:2492
- C:\Windows\System\WKpcEiR.exe
  C:\Windows\System\WKpcEiR.exe
  2⤵
  PID:2548
- C:\Windows\System\lzFeAri.exe
  C:\Windows\System\lzFeAri.exe
  2⤵
  PID:2696
- C:\Windows\System\MUHTHJN.exe
  C:\Windows\System\MUHTHJN.exe
  2⤵
  PID:1440
- C:\Windows\System\GXsukxD.exe
  C:\Windows\System\GXsukxD.exe
  2⤵
  PID:2784
- C:\Windows\System\jCyASZH.exe
  C:\Windows\System\jCyASZH.exe
  2⤵
  PID:2980
- C:\Windows\System\zGVGSsc.exe
  C:\Windows\System\zGVGSsc.exe
  2⤵
  PID:1240
- C:\Windows\System\bUKZOtV.exe
  C:\Windows\System\bUKZOtV.exe
  2⤵
  PID:1120
- C:\Windows\System\FOwZoXl.exe
  C:\Windows\System\FOwZoXl.exe
  2⤵
  PID:2372
- C:\Windows\System\IQRnuPI.exe
  C:\Windows\System\IQRnuPI.exe
  2⤵
  PID:2700
- C:\Windows\System\LDVVDFF.exe
  C:\Windows\System\LDVVDFF.exe
  2⤵
  PID:2396
- C:\Windows\System\baGWwZU.exe
  C:\Windows\System\baGWwZU.exe
  2⤵
  PID:1956
- C:\Windows\System\nVcNMEG.exe
  C:\Windows\System\nVcNMEG.exe
  2⤵
  PID:3044
- C:\Windows\System\VZssYUW.exe
  C:\Windows\System\VZssYUW.exe
  2⤵
  PID:2952
- C:\Windows\System\ckNpJuG.exe
  C:\Windows\System\ckNpJuG.exe
  2⤵
  PID:1068
- C:\Windows\System\CTotGGJ.exe
  C:\Windows\System\CTotGGJ.exe
  2⤵
  PID:1436
- C:\Windows\System\qlxKicH.exe
  C:\Windows\System\qlxKicH.exe
  2⤵
  PID:2816
- C:\Windows\System\yQPwUWo.exe
  C:\Windows\System\yQPwUWo.exe
  2⤵
  PID:2940
- C:\Windows\System\ubfJbTL.exe
  C:\Windows\System\ubfJbTL.exe
  2⤵
  PID:2508
- C:\Windows\System\SbsEuVi.exe
  C:\Windows\System\SbsEuVi.exe
  2⤵
  PID:2084
- C:\Windows\System\BNTSfTn.exe
  C:\Windows\System\BNTSfTn.exe
  2⤵
  PID:2516
- C:\Windows\System\CnqWrZw.exe
  C:\Windows\System\CnqWrZw.exe
  2⤵
  PID:108
- C:\Windows\System\GKqjZDm.exe
  C:\Windows\System\GKqjZDm.exe
  2⤵
  PID:2440
- C:\Windows\System\iuhGahE.exe
  C:\Windows\System\iuhGahE.exe
  2⤵
  PID:2904
- C:\Windows\System\dIDqCxo.exe
  C:\Windows\System\dIDqCxo.exe
  2⤵
  PID:2996
- C:\Windows\System\VRefoOP.exe
  C:\Windows\System\VRefoOP.exe
  2⤵
  PID:2172
- C:\Windows\System\GEteOGv.exe
  C:\Windows\System\GEteOGv.exe
  2⤵
  PID:2368
- C:\Windows\System\GGHdFmT.exe
  C:\Windows\System\GGHdFmT.exe
  2⤵
  PID:1644
- C:\Windows\System\SEWKLzP.exe
  C:\Windows\System\SEWKLzP.exe
  2⤵
  PID:1952
- C:\Windows\System\XZsFRFz.exe
  C:\Windows\System\XZsFRFz.exe
  2⤵
  PID:2116
- C:\Windows\System\CAtEJjN.exe
  C:\Windows\System\CAtEJjN.exe
  2⤵
  PID:1872
- C:\Windows\System\NvAnPlU.exe
  C:\Windows\System\NvAnPlU.exe
  2⤵
  PID:2744
- C:\Windows\System\EcySGhK.exe
  C:\Windows\System\EcySGhK.exe
  2⤵
  PID:3084
- C:\Windows\System\PxgEvxq.exe
  C:\Windows\System\PxgEvxq.exe
  2⤵
  PID:3100
- C:\Windows\System\wGiWbyI.exe
  C:\Windows\System\wGiWbyI.exe
  2⤵
  PID:3120
- C:\Windows\System\wRMBKZb.exe
  C:\Windows\System\wRMBKZb.exe
  2⤵
  PID:3140
- C:\Windows\System\ZhrIixi.exe
  C:\Windows\System\ZhrIixi.exe
  2⤵
  PID:3164
- C:\Windows\System\SSqisUe.exe
  C:\Windows\System\SSqisUe.exe
  2⤵
  PID:3180
- C:\Windows\System\UFgGIXd.exe
  C:\Windows\System\UFgGIXd.exe
  2⤵
  PID:3204
- C:\Windows\System\nQKtCrc.exe
  C:\Windows\System\nQKtCrc.exe
  2⤵
  PID:3220
- C:\Windows\System\sCfOFDJ.exe
  C:\Windows\System\sCfOFDJ.exe
  2⤵
  PID:3236
- C:\Windows\System\lYZHklf.exe
  C:\Windows\System\lYZHklf.exe
  2⤵
  PID:3256
- C:\Windows\System\dioKgzW.exe
  C:\Windows\System\dioKgzW.exe
  2⤵
  PID:3272
- C:\Windows\System\wnLgqoc.exe
  C:\Windows\System\wnLgqoc.exe
  2⤵
  PID:3288
- C:\Windows\System\YlRHAzj.exe
  C:\Windows\System\YlRHAzj.exe
  2⤵
  PID:3304
- C:\Windows\System\cwkHdkB.exe
  C:\Windows\System\cwkHdkB.exe
  2⤵
  PID:3324
- C:\Windows\System\umjWDLr.exe
  C:\Windows\System\umjWDLr.exe
  2⤵
  PID:3352
- C:\Windows\System\EKGSQUM.exe
  C:\Windows\System\EKGSQUM.exe
  2⤵
  PID:3368
- C:\Windows\System\NkieFmg.exe
  C:\Windows\System\NkieFmg.exe
  2⤵
  PID:3384
- C:\Windows\System\AmxEbLZ.exe
  C:\Windows\System\AmxEbLZ.exe
  2⤵
  PID:3400
- C:\Windows\System\RjtLABH.exe
  C:\Windows\System\RjtLABH.exe
  2⤵
  PID:3420
- C:\Windows\System\ODFTRCA.exe
  C:\Windows\System\ODFTRCA.exe
  2⤵
  PID:3436
- C:\Windows\System\PSfDcHD.exe
  C:\Windows\System\PSfDcHD.exe
  2⤵
  PID:3456
- C:\Windows\System\BmZlBpY.exe
  C:\Windows\System\BmZlBpY.exe
  2⤵
  PID:3508
- C:\Windows\System\QbiIMKt.exe
  C:\Windows\System\QbiIMKt.exe
  2⤵
  PID:3528
- C:\Windows\System\aYrleXO.exe
  C:\Windows\System\aYrleXO.exe
  2⤵
  PID:3544
- C:\Windows\System\QJeHkAk.exe
  C:\Windows\System\QJeHkAk.exe
  2⤵
  PID:3560
- C:\Windows\System\OpUvhmc.exe
  C:\Windows\System\OpUvhmc.exe
  2⤵
  PID:3580
- C:\Windows\System\pLXMvjf.exe
  C:\Windows\System\pLXMvjf.exe
  2⤵
  PID:3596
- C:\Windows\System\WeCMwKJ.exe
  C:\Windows\System\WeCMwKJ.exe
  2⤵
  PID:3620
- C:\Windows\System\iZwtalW.exe
  C:\Windows\System\iZwtalW.exe
  2⤵
  PID:3640
- C:\Windows\System\KhYgeUL.exe
  C:\Windows\System\KhYgeUL.exe
  2⤵
  PID:3656
- C:\Windows\System\aGfADWt.exe
  C:\Windows\System\aGfADWt.exe
  2⤵
  PID:3680
- C:\Windows\System\HuTLUNl.exe
  C:\Windows\System\HuTLUNl.exe
  2⤵
  PID:3712
- C:\Windows\System\KtyLYPP.exe
  C:\Windows\System\KtyLYPP.exe
  2⤵
  PID:3728
- C:\Windows\System\hDNMIJv.exe
  C:\Windows\System\hDNMIJv.exe
  2⤵
  PID:3744
- C:\Windows\System\lrgxWyw.exe
  C:\Windows\System\lrgxWyw.exe
  2⤵
  PID:3760
- C:\Windows\System\nvUALSJ.exe
  C:\Windows\System\nvUALSJ.exe
  2⤵
  PID:3780
- C:\Windows\System\wdtdnnl.exe
  C:\Windows\System\wdtdnnl.exe
  2⤵
  PID:3796
- C:\Windows\System\qsBInas.exe
  C:\Windows\System\qsBInas.exe
  2⤵
  PID:3816
- C:\Windows\System\srBbDhK.exe
  C:\Windows\System\srBbDhK.exe
  2⤵
  PID:3840
- C:\Windows\System\ymUmsBF.exe
  C:\Windows\System\ymUmsBF.exe
  2⤵
  PID:3860
- C:\Windows\System\xJfUzyk.exe
  C:\Windows\System\xJfUzyk.exe
  2⤵
  PID:3876
- C:\Windows\System\fkVhpHL.exe
  C:\Windows\System\fkVhpHL.exe
  2⤵
  PID:3928
- C:\Windows\System\MdHrUSh.exe
  C:\Windows\System\MdHrUSh.exe
  2⤵
  PID:3944
- C:\Windows\System\IwWOVso.exe
  C:\Windows\System\IwWOVso.exe
  2⤵
  PID:3968
- C:\Windows\System\eRlVfSJ.exe
  C:\Windows\System\eRlVfSJ.exe
  2⤵
  PID:4004
- C:\Windows\System\BmqDnJT.exe
  C:\Windows\System\BmqDnJT.exe
  2⤵
  PID:4020
- C:\Windows\System\nbhUsPs.exe
  C:\Windows\System\nbhUsPs.exe
  2⤵
  PID:4036
- C:\Windows\System\hOdOMtq.exe
  C:\Windows\System\hOdOMtq.exe
  2⤵
  PID:4052
- C:\Windows\System\wQGwvoS.exe
  C:\Windows\System\wQGwvoS.exe
  2⤵
  PID:4072
- C:\Windows\System\qxTSXCN.exe
  C:\Windows\System\qxTSXCN.exe
  2⤵
  PID:4092
- C:\Windows\System\QTNVUGH.exe
  C:\Windows\System\QTNVUGH.exe
  2⤵
  PID:1960
- C:\Windows\System\MuOyrex.exe
  C:\Windows\System\MuOyrex.exe
  2⤵
  PID:3112
- C:\Windows\System\iDzSdld.exe
  C:\Windows\System\iDzSdld.exe
  2⤵
  PID:3160
- C:\Windows\System\vqqnpWo.exe
  C:\Windows\System\vqqnpWo.exe
  2⤵
  PID:3172
- C:\Windows\System\EKeHbLy.exe
  C:\Windows\System\EKeHbLy.exe
  2⤵
  PID:3192
- C:\Windows\System\QjICWbQ.exe
  C:\Windows\System\QjICWbQ.exe
  2⤵
  PID:3264
- C:\Windows\System\QYgrkhL.exe
  C:\Windows\System\QYgrkhL.exe
  2⤵
  PID:3244
- C:\Windows\System\CqHTUAN.exe
  C:\Windows\System\CqHTUAN.exe
  2⤵
  PID:3340
- C:\Windows\System\TJapKLf.exe
  C:\Windows\System\TJapKLf.exe
  2⤵
  PID:3380
- C:\Windows\System\VnnZSQV.exe
  C:\Windows\System\VnnZSQV.exe
  2⤵
  PID:3444
- C:\Windows\System\xgLmBNY.exe
  C:\Windows\System\xgLmBNY.exe
  2⤵
  PID:3312
- C:\Windows\System\LeYmCyM.exe
  C:\Windows\System\LeYmCyM.exe
  2⤵
  PID:3392
- C:\Windows\System\yZwKIGR.exe
  C:\Windows\System\yZwKIGR.exe
  2⤵
  PID:3428
- C:\Windows\System\LIiJdip.exe
  C:\Windows\System\LIiJdip.exe
  2⤵
  PID:3480
- C:\Windows\System\KsyQmca.exe
  C:\Windows\System\KsyQmca.exe
  2⤵
  PID:3500
- C:\Windows\System\bFZYEAm.exe
  C:\Windows\System\bFZYEAm.exe
  2⤵
  PID:3556
- C:\Windows\System\FhSVOrE.exe
  C:\Windows\System\FhSVOrE.exe
  2⤵
  PID:3576
- C:\Windows\System\DCqaCIw.exe
  C:\Windows\System\DCqaCIw.exe
  2⤵
  PID:3628
- C:\Windows\System\VYgehAQ.exe
  C:\Windows\System\VYgehAQ.exe
  2⤵
  PID:3676
- C:\Windows\System\fKNbiLo.exe
  C:\Windows\System\fKNbiLo.exe
  2⤵
  PID:3724
- C:\Windows\System\qFTZEwG.exe
  C:\Windows\System\qFTZEwG.exe
  2⤵
  PID:3828
- C:\Windows\System\uAFXtuG.exe
  C:\Windows\System\uAFXtuG.exe
  2⤵
  PID:3872
- C:\Windows\System\RQEHXeC.exe
  C:\Windows\System\RQEHXeC.exe
  2⤵
  PID:3848
- C:\Windows\System\XcczCiK.exe
  C:\Windows\System\XcczCiK.exe
  2⤵
  PID:3912
- C:\Windows\System\FgyjxaF.exe
  C:\Windows\System\FgyjxaF.exe
  2⤵
  PID:3812
- C:\Windows\System\SxpupDI.exe
  C:\Windows\System\SxpupDI.exe
  2⤵
  PID:3952
- C:\Windows\System\fjXrIYo.exe
  C:\Windows\System\fjXrIYo.exe
  2⤵
  PID:3980
- C:\Windows\System\FwpcuSx.exe
  C:\Windows\System\FwpcuSx.exe
  2⤵
  PID:4016
- C:\Windows\System\prqpraq.exe
  C:\Windows\System\prqpraq.exe
  2⤵
  PID:4060
- C:\Windows\System\SxqdutN.exe
  C:\Windows\System\SxqdutN.exe
  2⤵
  PID:4048
- C:\Windows\System\KIsRucQ.exe
  C:\Windows\System\KIsRucQ.exe
  2⤵
  PID:4044
- C:\Windows\System\RZuOQWE.exe
  C:\Windows\System\RZuOQWE.exe
  2⤵
  PID:3200
- C:\Windows\System\gCAvHHZ.exe
  C:\Windows\System\gCAvHHZ.exe
  2⤵
  PID:3332
- C:\Windows\System\gIbNXGV.exe
  C:\Windows\System\gIbNXGV.exe
  2⤵
  PID:3360
- C:\Windows\System\rkKeJfW.exe
  C:\Windows\System\rkKeJfW.exe
  2⤵
  PID:3664
- C:\Windows\System\lqxzERp.exe
  C:\Windows\System\lqxzERp.exe
  2⤵
  PID:3768
- C:\Windows\System\oGtylzA.exe
  C:\Windows\System\oGtylzA.exe
  2⤵
  PID:4084
- C:\Windows\System\oSHezVJ.exe
  C:\Windows\System\oSHezVJ.exe
  2⤵
  PID:3736
- C:\Windows\System\ZccSEwL.exe
  C:\Windows\System\ZccSEwL.exe
  2⤵
  PID:4080
- C:\Windows\System\uSnKlRu.exe
  C:\Windows\System\uSnKlRu.exe
  2⤵
  PID:3232
- C:\Windows\System\JZzmvCf.exe
  C:\Windows\System\JZzmvCf.exe
  2⤵
  PID:3364
- C:\Windows\System\eyUSrYr.exe
  C:\Windows\System\eyUSrYr.exe
  2⤵
  PID:3892
- C:\Windows\System\mzuWKrk.exe
  C:\Windows\System\mzuWKrk.exe
  2⤵
  PID:3524
- C:\Windows\System\wureKrr.exe
  C:\Windows\System\wureKrr.exe
  2⤵
  PID:3752
- C:\Windows\System\ZkSOCzu.exe
  C:\Windows\System\ZkSOCzu.exe
  2⤵
  PID:3960
- C:\Windows\System\YKYtrzS.exe
  C:\Windows\System\YKYtrzS.exe
  2⤵
  PID:3996
- C:\Windows\System\QajBEQA.exe
  C:\Windows\System\QajBEQA.exe
  2⤵
  PID:3148
- C:\Windows\System\NRASnaO.exe
  C:\Windows\System\NRASnaO.exe
  2⤵
  PID:3492
- C:\Windows\System\XgpZbKW.exe
  C:\Windows\System\XgpZbKW.exe
  2⤵
  PID:3116
- C:\Windows\System\eJuFcwn.exe
  C:\Windows\System\eJuFcwn.exe
  2⤵
  PID:3452
- C:\Windows\System\GwACtwa.exe
  C:\Windows\System\GwACtwa.exe
  2⤵
  PID:3692
- C:\Windows\System\LCYJekf.exe
  C:\Windows\System\LCYJekf.exe
  2⤵
  PID:3412
- C:\Windows\System\jjWzqLW.exe
  C:\Windows\System\jjWzqLW.exe
  2⤵
  PID:3520
- C:\Windows\System\ONsEBfJ.exe
  C:\Windows\System\ONsEBfJ.exe
  2⤵
  PID:3700
- C:\Windows\System\cbCPwOI.exe
  C:\Windows\System\cbCPwOI.exe
  2⤵
  PID:3608
- C:\Windows\System\MQHYviH.exe
  C:\Windows\System\MQHYviH.exe
  2⤵
  PID:3720
- C:\Windows\System\nUoThbY.exe
  C:\Windows\System\nUoThbY.exe
  2⤵
  PID:4012
- C:\Windows\System\klSjzfH.exe
  C:\Windows\System\klSjzfH.exe
  2⤵
  PID:3852
- C:\Windows\System\NlMVhCQ.exe
  C:\Windows\System\NlMVhCQ.exe
  2⤵
  PID:3788
- C:\Windows\System\dlkuzGu.exe
  C:\Windows\System\dlkuzGu.exe
  2⤵
  PID:3536
- C:\Windows\System\IxYulNI.exe
  C:\Windows\System\IxYulNI.exe
  2⤵
  PID:3376
- C:\Windows\System\OmNwtDc.exe
  C:\Windows\System\OmNwtDc.exe
  2⤵
  PID:3472
- C:\Windows\System\slTzcOz.exe
  C:\Windows\System\slTzcOz.exe
  2⤵
  PID:3856
- C:\Windows\System\bzNptYa.exe
  C:\Windows\System\bzNptYa.exe
  2⤵
  PID:3696
- C:\Windows\System\XdKugzE.exe
  C:\Windows\System\XdKugzE.exe
  2⤵
  PID:3920
- C:\Windows\System\NoNkKQr.exe
  C:\Windows\System\NoNkKQr.exe
  2⤵
  PID:3132
- C:\Windows\System\pNJnVhs.exe
  C:\Windows\System\pNJnVhs.exe
  2⤵
  PID:3188
- C:\Windows\System\fHqYpgL.exe
  C:\Windows\System\fHqYpgL.exe
  2⤵
  PID:4032
- C:\Windows\System\lwvkeYA.exe
  C:\Windows\System\lwvkeYA.exe
  2⤵
  PID:3416
- C:\Windows\System\nnOgZcs.exe
  C:\Windows\System\nnOgZcs.exe
  2⤵
  PID:332
- C:\Windows\System\DGcsDyY.exe
  C:\Windows\System\DGcsDyY.exe
  2⤵
  PID:4112
- C:\Windows\System\twJMfog.exe
  C:\Windows\System\twJMfog.exe
  2⤵
  PID:4152
- C:\Windows\System\STNdWzg.exe
  C:\Windows\System\STNdWzg.exe
  2⤵
  PID:4168
- C:\Windows\System\fbQeoma.exe
  C:\Windows\System\fbQeoma.exe
  2⤵
  PID:4192
- C:\Windows\System\CYJRPKg.exe
  C:\Windows\System\CYJRPKg.exe
  2⤵
  PID:4208
- C:\Windows\System\KeUClxM.exe
  C:\Windows\System\KeUClxM.exe
  2⤵
  PID:4228
- C:\Windows\System\MMvPjWv.exe
  C:\Windows\System\MMvPjWv.exe
  2⤵
  PID:4244
- C:\Windows\System\eFuyTxx.exe
  C:\Windows\System\eFuyTxx.exe
  2⤵
  PID:4260
- C:\Windows\System\gnLpvLs.exe
  C:\Windows\System\gnLpvLs.exe
  2⤵
  PID:4276
- C:\Windows\System\jVBvkVf.exe
  C:\Windows\System\jVBvkVf.exe
  2⤵
  PID:4292
- C:\Windows\System\vFgCsfY.exe
  C:\Windows\System\vFgCsfY.exe
  2⤵
  PID:4312
- C:\Windows\System\BZEGktT.exe
  C:\Windows\System\BZEGktT.exe
  2⤵
  PID:4336
- C:\Windows\System\KjqVSvF.exe
  C:\Windows\System\KjqVSvF.exe
  2⤵
  PID:4352
- C:\Windows\System\MZwLVLY.exe
  C:\Windows\System\MZwLVLY.exe
  2⤵
  PID:4368
- C:\Windows\System\jJCTWGd.exe
  C:\Windows\System\jJCTWGd.exe
  2⤵
  PID:4384
- C:\Windows\System\WBSyksY.exe
  C:\Windows\System\WBSyksY.exe
  2⤵
  PID:4404
- C:\Windows\System\CZJTnmO.exe
  C:\Windows\System\CZJTnmO.exe
  2⤵
  PID:4420
- C:\Windows\System\mEalUKe.exe
  C:\Windows\System\mEalUKe.exe
  2⤵
  PID:4440
- C:\Windows\System\GPyVFEV.exe
  C:\Windows\System\GPyVFEV.exe
  2⤵
  PID:4460
- C:\Windows\System\wtocGKZ.exe
  C:\Windows\System\wtocGKZ.exe
  2⤵
  PID:4480
- C:\Windows\System\PGkwQcd.exe
  C:\Windows\System\PGkwQcd.exe
  2⤵
  PID:4500
- C:\Windows\System\PutUNzj.exe
  C:\Windows\System\PutUNzj.exe
  2⤵
  PID:4516
- C:\Windows\System\GtOQHWM.exe
  C:\Windows\System\GtOQHWM.exe
  2⤵
  PID:4532
- C:\Windows\System\NhBiiYL.exe
  C:\Windows\System\NhBiiYL.exe
  2⤵
  PID:4548
- C:\Windows\System\uulDpEW.exe
  C:\Windows\System\uulDpEW.exe
  2⤵
  PID:4564
- C:\Windows\System\LhlaMHj.exe
  C:\Windows\System\LhlaMHj.exe
  2⤵
  PID:4640
- C:\Windows\System\vKyilEL.exe
  C:\Windows\System\vKyilEL.exe
  2⤵
  PID:4656
- C:\Windows\System\dnWzueI.exe
  C:\Windows\System\dnWzueI.exe
  2⤵
  PID:4676
- C:\Windows\System\MaLGxVs.exe
  C:\Windows\System\MaLGxVs.exe
  2⤵
  PID:4692
- C:\Windows\System\ZsVsNpB.exe
  C:\Windows\System\ZsVsNpB.exe
  2⤵
  PID:4712
- C:\Windows\System\XoggrwF.exe
  C:\Windows\System\XoggrwF.exe
  2⤵
  PID:4728
- C:\Windows\System\EVdIDhj.exe
  C:\Windows\System\EVdIDhj.exe
  2⤵
  PID:4744
- C:\Windows\System\BSDcaan.exe
  C:\Windows\System\BSDcaan.exe
  2⤵
  PID:4760
- C:\Windows\System\fYpmTKB.exe
  C:\Windows\System\fYpmTKB.exe
  2⤵
  PID:4776
- C:\Windows\System\HjNpiXA.exe
  C:\Windows\System\HjNpiXA.exe
  2⤵
  PID:4792
- C:\Windows\System\tBqowKv.exe
  C:\Windows\System\tBqowKv.exe
  2⤵
  PID:4808
- C:\Windows\System\keOdFDA.exe
  C:\Windows\System\keOdFDA.exe
  2⤵
  PID:4828
- C:\Windows\System\xJpFvCq.exe
  C:\Windows\System\xJpFvCq.exe
  2⤵
  PID:4852
- C:\Windows\System\LZhfzRk.exe
  C:\Windows\System\LZhfzRk.exe
  2⤵
  PID:4872
- C:\Windows\System\NoYkkwm.exe
  C:\Windows\System\NoYkkwm.exe
  2⤵
  PID:4892
- C:\Windows\System\BuPiimX.exe
  C:\Windows\System\BuPiimX.exe
  2⤵
  PID:4908
- C:\Windows\System\OfhJAHZ.exe
  C:\Windows\System\OfhJAHZ.exe
  2⤵
  PID:4924
- C:\Windows\System\WyMOyyh.exe
  C:\Windows\System\WyMOyyh.exe
  2⤵
  PID:4944
- C:\Windows\System\waDGeqI.exe
  C:\Windows\System\waDGeqI.exe
  2⤵
  PID:4964
- C:\Windows\System\uYFohsE.exe
  C:\Windows\System\uYFohsE.exe
  2⤵
  PID:4980
- C:\Windows\System\kefFVOY.exe
  C:\Windows\System\kefFVOY.exe
  2⤵
  PID:5004
- C:\Windows\System\eyHQKFP.exe
  C:\Windows\System\eyHQKFP.exe
  2⤵
  PID:5020
- C:\Windows\System\KEyIZMJ.exe
  C:\Windows\System\KEyIZMJ.exe
  2⤵
  PID:5076
- C:\Windows\System\esEJmvj.exe
  C:\Windows\System\esEJmvj.exe
  2⤵
  PID:5096
- C:\Windows\System\thYQtnP.exe
  C:\Windows\System\thYQtnP.exe
  2⤵
  PID:5112
- C:\Windows\System\zHfldeg.exe
  C:\Windows\System\zHfldeg.exe
  2⤵
  PID:3216
- C:\Windows\System\vNPryyr.exe
  C:\Windows\System\vNPryyr.exe
  2⤵
  PID:3592
- C:\Windows\System\OaGguJD.exe
  C:\Windows\System\OaGguJD.exe
  2⤵
  PID:4124
- C:\Windows\System\zTfIQQk.exe
  C:\Windows\System\zTfIQQk.exe
  2⤵
  PID:4140
- C:\Windows\System\FdcRCru.exe
  C:\Windows\System\FdcRCru.exe
  2⤵
  PID:4164
- C:\Windows\System\bHvYpcx.exe
  C:\Windows\System\bHvYpcx.exe
  2⤵
  PID:4180
- C:\Windows\System\glRpLYF.exe
  C:\Windows\System\glRpLYF.exe
  2⤵
  PID:4272
- C:\Windows\System\ZtlGvVz.exe
  C:\Windows\System\ZtlGvVz.exe
  2⤵
  PID:4348
- C:\Windows\System\rTsVUfA.exe
  C:\Windows\System\rTsVUfA.exe
  2⤵
  PID:4216
- C:\Windows\System\GETFWTj.exe
  C:\Windows\System\GETFWTj.exe
  2⤵
  PID:4496
- C:\Windows\System\xcUWpwr.exe
  C:\Windows\System\xcUWpwr.exe
  2⤵
  PID:4224
- C:\Windows\System\auqxufL.exe
  C:\Windows\System\auqxufL.exe
  2⤵
  PID:4320
- C:\Windows\System\aNMoHdU.exe
  C:\Windows\System\aNMoHdU.exe
  2⤵
  PID:4572
- C:\Windows\System\HFdPfws.exe
  C:\Windows\System\HFdPfws.exe
  2⤵
  PID:4580
- C:\Windows\System\wsVYckX.exe
  C:\Windows\System\wsVYckX.exe
  2⤵
  PID:4396
- C:\Windows\System\kWWfVbu.exe
  C:\Windows\System\kWWfVbu.exe
  2⤵
  PID:4436
- C:\Windows\System\CFHrdis.exe
  C:\Windows\System\CFHrdis.exe
  2⤵
  PID:4540
- C:\Windows\System\MBYWotJ.exe
  C:\Windows\System\MBYWotJ.exe
  2⤵
  PID:4592
- C:\Windows\System\cNqscia.exe
  C:\Windows\System\cNqscia.exe
  2⤵
  PID:4632
- C:\Windows\System\wBtaMkS.exe
  C:\Windows\System\wBtaMkS.exe
  2⤵
  PID:4720
- C:\Windows\System\mmuRsur.exe
  C:\Windows\System\mmuRsur.exe
  2⤵
  PID:4816
- C:\Windows\System\OrxcAUl.exe
  C:\Windows\System\OrxcAUl.exe
  2⤵
  PID:4868
- C:\Windows\System\cMbmtMN.exe
  C:\Windows\System\cMbmtMN.exe
  2⤵
  PID:4936
- C:\Windows\System\ZFDPHoI.exe
  C:\Windows\System\ZFDPHoI.exe
  2⤵
  PID:5012
- C:\Windows\System\fBIllKw.exe
  C:\Windows\System\fBIllKw.exe
  2⤵
  PID:4840
- C:\Windows\System\KflDbVh.exe
  C:\Windows\System\KflDbVh.exe
  2⤵
  PID:4668
- C:\Windows\System\MLKLffT.exe
  C:\Windows\System\MLKLffT.exe
  2⤵
  PID:5000
- C:\Windows\System\QezWGUS.exe
  C:\Windows\System\QezWGUS.exe
  2⤵
  PID:4804
- C:\Windows\System\bvplMEa.exe
  C:\Windows\System\bvplMEa.exe
  2⤵
  PID:5048
- C:\Windows\System\nGBCdAD.exe
  C:\Windows\System\nGBCdAD.exe
  2⤵
  PID:4956
- C:\Windows\System\RBJXrnE.exe
  C:\Windows\System\RBJXrnE.exe
  2⤵
  PID:5036
- C:\Windows\System\uethttB.exe
  C:\Windows\System\uethttB.exe
  2⤵
  PID:4108
- C:\Windows\System\ZzMSVwF.exe
  C:\Windows\System\ZzMSVwF.exe
  2⤵
  PID:5044
- C:\Windows\System\JQKWUKQ.exe
  C:\Windows\System\JQKWUKQ.exe
  2⤵
  PID:5104
- C:\Windows\System\IlewTCK.exe
  C:\Windows\System\IlewTCK.exe
  2⤵
  PID:5032
- C:\Windows\System\fbpsxOE.exe
  C:\Windows\System\fbpsxOE.exe
  2⤵
  PID:4268
- C:\Windows\System\KbjmNrT.exe
  C:\Windows\System\KbjmNrT.exe
  2⤵
  PID:4448
- C:\Windows\System\pauBuyM.exe
  C:\Windows\System\pauBuyM.exe
  2⤵
  PID:4412
- C:\Windows\System\RbzMAkS.exe
  C:\Windows\System\RbzMAkS.exe
  2⤵
  PID:4136
- C:\Windows\System\euOLfUu.exe
  C:\Windows\System\euOLfUu.exe
  2⤵
  PID:4308
- C:\Windows\System\IaVSani.exe
  C:\Windows\System\IaVSani.exe
  2⤵
  PID:4220
- C:\Windows\System\hwxEKfN.exe
  C:\Windows\System\hwxEKfN.exe
  2⤵
  PID:4588
- C:\Windows\System\PuqXVFX.exe
  C:\Windows\System\PuqXVFX.exe
  2⤵
  PID:4328
- C:\Windows\System\cNNgitm.exe
  C:\Windows\System\cNNgitm.exe
  2⤵
  PID:4468
- C:\Windows\System\BpPeKRx.exe
  C:\Windows\System\BpPeKRx.exe
  2⤵
  PID:4616
- C:\Windows\System\kZOEPEJ.exe
  C:\Windows\System\kZOEPEJ.exe
  2⤵
  PID:4756
- C:\Windows\System\ALGWRYZ.exe
  C:\Windows\System\ALGWRYZ.exe
  2⤵
  PID:4688
- C:\Windows\System\dnRgJCc.exe
  C:\Windows\System\dnRgJCc.exe
  2⤵
  PID:4932
- C:\Windows\System\FiyBpvF.exe
  C:\Windows\System\FiyBpvF.exe
  2⤵
  PID:4772
- C:\Windows\System\gfZCnVZ.exe
  C:\Windows\System\gfZCnVZ.exe
  2⤵
  PID:4992
- C:\Windows\System\CSTKYiv.exe
  C:\Windows\System\CSTKYiv.exe
  2⤵
  PID:5040
- C:\Windows\System\dicORpL.exe
  C:\Windows\System\dicORpL.exe
  2⤵
  PID:1504
- C:\Windows\System\AQEIQMh.exe
  C:\Windows\System\AQEIQMh.exe
  2⤵
  PID:4528
- C:\Windows\System\ISZVxQf.exe
  C:\Windows\System\ISZVxQf.exe
  2⤵
  PID:4972
- C:\Windows\System\NhgChIx.exe
  C:\Windows\System\NhgChIx.exe
  2⤵
  PID:4596
- C:\Windows\System\oSwGNBg.exe
  C:\Windows\System\oSwGNBg.exe
  2⤵
  PID:4988
- C:\Windows\System\uBlBlIP.exe
  C:\Windows\System\uBlBlIP.exe
  2⤵
  PID:4456
- C:\Windows\System\kpJuqFG.exe
  C:\Windows\System\kpJuqFG.exe
  2⤵
  PID:4132
- C:\Windows\System\WMBACiC.exe
  C:\Windows\System\WMBACiC.exe
  2⤵
  PID:5124
- C:\Windows\System\HFXAiJv.exe
  C:\Windows\System\HFXAiJv.exe
  2⤵
  PID:5144
- C:\Windows\System\IXMbooX.exe
  C:\Windows\System\IXMbooX.exe
  2⤵
  PID:5160
- C:\Windows\System\AMSBsUJ.exe
  C:\Windows\System\AMSBsUJ.exe
  2⤵
  PID:5220
- C:\Windows\System\bjrPVMA.exe
  C:\Windows\System\bjrPVMA.exe
  2⤵
  PID:5236
- C:\Windows\System\wzmTBTK.exe
  C:\Windows\System\wzmTBTK.exe
  2⤵
  PID:5252
- C:\Windows\System\UHogAbE.exe
  C:\Windows\System\UHogAbE.exe
  2⤵
  PID:5268
- C:\Windows\System\VjnDXPt.exe
  C:\Windows\System\VjnDXPt.exe
  2⤵
  PID:5284
- C:\Windows\System\rUJQSfa.exe
  C:\Windows\System\rUJQSfa.exe
  2⤵
  PID:5300
- C:\Windows\System\VjdmKLH.exe
  C:\Windows\System\VjdmKLH.exe
  2⤵
  PID:5316
- C:\Windows\System\RstTRhH.exe
  C:\Windows\System\RstTRhH.exe
  2⤵
  PID:5332
- C:\Windows\System\OsPZljD.exe
  C:\Windows\System\OsPZljD.exe
  2⤵
  PID:5348
- C:\Windows\System\nvTSLye.exe
  C:\Windows\System\nvTSLye.exe
  2⤵
  PID:5364
- C:\Windows\System\JMkkHcg.exe
  C:\Windows\System\JMkkHcg.exe
  2⤵
  PID:5384
- C:\Windows\System\pNJCqWM.exe
  C:\Windows\System\pNJCqWM.exe
  2⤵
  PID:5400
- C:\Windows\System\ZLSWyqV.exe
  C:\Windows\System\ZLSWyqV.exe
  2⤵
  PID:5428
- C:\Windows\System\GHmKsue.exe
  C:\Windows\System\GHmKsue.exe
  2⤵
  PID:5448
- C:\Windows\System\BBWiJJC.exe
  C:\Windows\System\BBWiJJC.exe
  2⤵
  PID:5468
- C:\Windows\System\pxVsoLD.exe
  C:\Windows\System\pxVsoLD.exe
  2⤵
  PID:5488
- C:\Windows\System\kXjcYOx.exe
  C:\Windows\System\kXjcYOx.exe
  2⤵
  PID:5508
- C:\Windows\System\xYqzxKB.exe
  C:\Windows\System\xYqzxKB.exe
  2⤵
  PID:5532
- C:\Windows\System\hxVgftp.exe
  C:\Windows\System\hxVgftp.exe
  2⤵
  PID:5556
- C:\Windows\System\cMzfSzd.exe
  C:\Windows\System\cMzfSzd.exe
  2⤵
  PID:5572
- C:\Windows\System\AalhMgm.exe
  C:\Windows\System\AalhMgm.exe
  2⤵
  PID:5596
- C:\Windows\System\ezNmMUP.exe
  C:\Windows\System\ezNmMUP.exe
  2⤵
  PID:5620
- C:\Windows\System\yRROtcC.exe
  C:\Windows\System\yRROtcC.exe
  2⤵
  PID:5636
- C:\Windows\System\uKJBiPs.exe
  C:\Windows\System\uKJBiPs.exe
  2⤵
  PID:5656
- C:\Windows\System\PZlklNq.exe
  C:\Windows\System\PZlklNq.exe
  2⤵
  PID:5680
- C:\Windows\System\LgUGIUz.exe
  C:\Windows\System\LgUGIUz.exe
  2⤵
  PID:5696
- C:\Windows\System\kefRmGF.exe
  C:\Windows\System\kefRmGF.exe
  2⤵
  PID:5716
- C:\Windows\System\TiyNOrN.exe
  C:\Windows\System\TiyNOrN.exe
  2⤵
  PID:5740
- C:\Windows\System\KQjGnHg.exe
  C:\Windows\System\KQjGnHg.exe
  2⤵
  PID:5760
- C:\Windows\System\AcNOuvl.exe
  C:\Windows\System\AcNOuvl.exe
  2⤵
  PID:5780
- C:\Windows\System\MiaSDpi.exe
  C:\Windows\System\MiaSDpi.exe
  2⤵
  PID:5800
- C:\Windows\System\jrgPgjx.exe
  C:\Windows\System\jrgPgjx.exe
  2⤵
  PID:5840
- C:\Windows\System\WhKMqbJ.exe
  C:\Windows\System\WhKMqbJ.exe
  2⤵
  PID:5856
- C:\Windows\System\IAibtxg.exe
  C:\Windows\System\IAibtxg.exe
  2⤵
  PID:5876
- C:\Windows\System\vAmWtqZ.exe
  C:\Windows\System\vAmWtqZ.exe
  2⤵
  PID:5892
- C:\Windows\System\EPMobrc.exe
  C:\Windows\System\EPMobrc.exe
  2⤵
  PID:5924
- C:\Windows\System\xidgTDK.exe
  C:\Windows\System\xidgTDK.exe
  2⤵
  PID:5940
- C:\Windows\System\KFzdkLP.exe
  C:\Windows\System\KFzdkLP.exe
  2⤵
  PID:5956
- C:\Windows\System\ujyYutK.exe
  C:\Windows\System\ujyYutK.exe
  2⤵
  PID:5972
- C:\Windows\System\yHTAJIN.exe
  C:\Windows\System\yHTAJIN.exe
  2⤵
  PID:5988
- C:\Windows\System\DIdpdDi.exe
  C:\Windows\System\DIdpdDi.exe
  2⤵
  PID:6008
- C:\Windows\System\wzdWFdU.exe
  C:\Windows\System\wzdWFdU.exe
  2⤵
  PID:6040
- C:\Windows\System\uHmrpaF.exe
  C:\Windows\System\uHmrpaF.exe
  2⤵
  PID:6060
- C:\Windows\System\iTLrWRM.exe
  C:\Windows\System\iTLrWRM.exe
  2⤵
  PID:6076
- C:\Windows\System\MMQYfYo.exe
  C:\Windows\System\MMQYfYo.exe
  2⤵
  PID:6092
- C:\Windows\System\itLzjgG.exe
  C:\Windows\System\itLzjgG.exe
  2⤵
  PID:6112
- C:\Windows\System\uxGtpLG.exe
  C:\Windows\System\uxGtpLG.exe
  2⤵
  PID:6132
- C:\Windows\System\yMCImYG.exe
  C:\Windows\System\yMCImYG.exe
  2⤵
  PID:4884
- C:\Windows\System\apAGlCv.exe
  C:\Windows\System\apAGlCv.exe
  2⤵
  PID:4648
- C:\Windows\System\bCxgNry.exe
  C:\Windows\System\bCxgNry.exe
  2⤵
  PID:3824
- C:\Windows\System\pyLTmtT.exe
  C:\Windows\System\pyLTmtT.exe
  2⤵
  PID:4428
- C:\Windows\System\FdVcOxR.exe
  C:\Windows\System\FdVcOxR.exe
  2⤵
  PID:5176
- C:\Windows\System\ezYEKBF.exe
  C:\Windows\System\ezYEKBF.exe
  2⤵
  PID:4904
- C:\Windows\System\VCUkxMe.exe
  C:\Windows\System\VCUkxMe.exe
  2⤵
  PID:4996
- C:\Windows\System\AyGgIxb.exe
  C:\Windows\System\AyGgIxb.exe
  2⤵
  PID:5072
- C:\Windows\System\AhAZiDU.exe
  C:\Windows\System\AhAZiDU.exe
  2⤵
  PID:4284
- C:\Windows\System\LoVIUCf.exe
  C:\Windows\System\LoVIUCf.exe
  2⤵
  PID:4608
- C:\Windows\System\MKEmQTk.exe
  C:\Windows\System\MKEmQTk.exe
  2⤵
  PID:5172
- C:\Windows\System\UmFgdbb.exe
  C:\Windows\System\UmFgdbb.exe
  2⤵
  PID:5132
- C:\Windows\System\fMQCDci.exe
  C:\Windows\System\fMQCDci.exe
  2⤵
  PID:5292
- C:\Windows\System\AXjhLtj.exe
  C:\Windows\System\AXjhLtj.exe
  2⤵
  PID:5360
- C:\Windows\System\gVOiJbc.exe
  C:\Windows\System\gVOiJbc.exe
  2⤵
  PID:5440
- C:\Windows\System\GGmbsQE.exe
  C:\Windows\System\GGmbsQE.exe
  2⤵
  PID:5516
- C:\Windows\System\FHBfmnV.exe
  C:\Windows\System\FHBfmnV.exe
  2⤵
  PID:5528
- C:\Windows\System\HYEMTWm.exe
  C:\Windows\System\HYEMTWm.exe
  2⤵
  PID:5212
- C:\Windows\System\DRqUxuj.exe
  C:\Windows\System\DRqUxuj.exe
  2⤵
  PID:5608
- C:\Windows\System\jJirpFe.exe
  C:\Windows\System\jJirpFe.exe
  2⤵
  PID:5692
- C:\Windows\System\iHMhSMX.exe
  C:\Windows\System\iHMhSMX.exe
  2⤵
  PID:5728
- C:\Windows\System\rQcKsca.exe
  C:\Windows\System\rQcKsca.exe
  2⤵
  PID:5208
- C:\Windows\System\GuHuFDR.exe
  C:\Windows\System\GuHuFDR.exe
  2⤵
  PID:5424
- C:\Windows\System\eqYXuCB.exe
  C:\Windows\System\eqYXuCB.exe
  2⤵
  PID:5808
- C:\Windows\System\oNpshpp.exe
  C:\Windows\System\oNpshpp.exe
  2⤵
  PID:5344
- C:\Windows\System\yupUnxB.exe
  C:\Windows\System\yupUnxB.exe
  2⤵
  PID:5592
- C:\Windows\System\xsgvstK.exe
  C:\Windows\System\xsgvstK.exe
  2⤵
  PID:5464
- C:\Windows\System\dEcULWp.exe
  C:\Windows\System\dEcULWp.exe
  2⤵
  PID:5864
- C:\Windows\System\XdUUsDl.exe
  C:\Windows\System\XdUUsDl.exe
  2⤵
  PID:5552
- C:\Windows\System\gJhPsCV.exe
  C:\Windows\System\gJhPsCV.exe
  2⤵
  PID:5792
- C:\Windows\System\cUaVSbt.exe
  C:\Windows\System\cUaVSbt.exe
  2⤵
  PID:5668
- C:\Windows\System\OaXiQxe.exe
  C:\Windows\System\OaXiQxe.exe
  2⤵
  PID:5712
- C:\Windows\System\sciLvSr.exe
  C:\Windows\System\sciLvSr.exe
  2⤵
  PID:5900
- C:\Windows\System\eZmekfF.exe
  C:\Windows\System\eZmekfF.exe
  2⤵
  PID:5908
- C:\Windows\System\NqPjcRE.exe
  C:\Windows\System\NqPjcRE.exe
  2⤵
  PID:5980
- C:\Windows\System\zFmSndA.exe
  C:\Windows\System\zFmSndA.exe
  2⤵
  PID:6028
- C:\Windows\System\ugUQTnm.exe
  C:\Windows\System\ugUQTnm.exe
  2⤵
  PID:6004
- C:\Windows\System\gKVhegN.exe
  C:\Windows\System\gKVhegN.exe
  2⤵
  PID:6000
- C:\Windows\System\GmiJXmM.exe
  C:\Windows\System\GmiJXmM.exe
  2⤵
  PID:6084
- C:\Windows\System\vxqpyAY.exe
  C:\Windows\System\vxqpyAY.exe
  2⤵
  PID:6120
- C:\Windows\System\SZoCxgh.exe
  C:\Windows\System\SZoCxgh.exe
  2⤵
  PID:4392
- C:\Windows\System\VoIpggv.exe
  C:\Windows\System\VoIpggv.exe
  2⤵
  PID:5092
- C:\Windows\System\erRiBto.exe
  C:\Windows\System\erRiBto.exe
  2⤵
  PID:5152
- C:\Windows\System\YMFgnXO.exe
  C:\Windows\System\YMFgnXO.exe
  2⤵
  PID:5184
- C:\Windows\System\NLSulHG.exe
  C:\Windows\System\NLSulHG.exe
  2⤵
  PID:4508
- C:\Windows\System\OzhOooy.exe
  C:\Windows\System\OzhOooy.exe
  2⤵
  PID:5204
- C:\Windows\System\AZduttX.exe
  C:\Windows\System\AZduttX.exe
  2⤵
  PID:5260
- C:\Windows\System\apWZCGA.exe
  C:\Windows\System\apWZCGA.exe
  2⤵
  PID:5140
- C:\Windows\System\dOPIVre.exe
  C:\Windows\System\dOPIVre.exe
  2⤵
  PID:5476
- C:\Windows\System\ZbZMKhH.exe
  C:\Windows\System\ZbZMKhH.exe
  2⤵
  PID:5520
- C:\Windows\System\OZnykXi.exe
  C:\Windows\System\OZnykXi.exe
  2⤵
  PID:5604
- C:\Windows\System\RSOdQOt.exe
  C:\Windows\System\RSOdQOt.exe
  2⤵
  PID:5416
- C:\Windows\System\dcLflVw.exe
  C:\Windows\System\dcLflVw.exe
  2⤵
  PID:5644
- C:\Windows\System\YOEtbMe.exe
  C:\Windows\System\YOEtbMe.exe
  2⤵
  PID:5308
- C:\Windows\System\mOdDFjt.exe
  C:\Windows\System\mOdDFjt.exe
  2⤵
  PID:5776
- C:\Windows\System\glHnzUL.exe
  C:\Windows\System\glHnzUL.exe
  2⤵
  PID:5456
- C:\Windows\System\oKvltFM.exe
  C:\Windows\System\oKvltFM.exe
  2⤵
  PID:5836
- C:\Windows\System\JmfXnOg.exe
  C:\Windows\System\JmfXnOg.exe
  2⤵
  PID:5812
- C:\Windows\System\RxGLGro.exe
  C:\Windows\System\RxGLGro.exe
  2⤵
  PID:5632
- C:\Windows\System\bpjveMc.exe
  C:\Windows\System\bpjveMc.exe
  2⤵
  PID:5704
- C:\Windows\System\ptzuJND.exe
  C:\Windows\System\ptzuJND.exe
  2⤵
  PID:5948
- C:\Windows\System\uHDhKqd.exe
  C:\Windows\System\uHDhKqd.exe
  2⤵
  PID:6036
- C:\Windows\System\HqGEBmp.exe
  C:\Windows\System\HqGEBmp.exe
  2⤵
  PID:6056
- C:\Windows\System\bjOVdRc.exe
  C:\Windows\System\bjOVdRc.exe
  2⤵
  PID:5996
- C:\Windows\System\mNJhrHS.exe
  C:\Windows\System\mNJhrHS.exe
  2⤵
  PID:4824
- C:\Windows\System\xqhpjKO.exe
  C:\Windows\System\xqhpjKO.exe
  2⤵
  PID:6104
- C:\Windows\System\JMUViGJ.exe
  C:\Windows\System\JMUViGJ.exe
  2⤵
  PID:4952
- C:\Windows\System\JVLhKvW.exe
  C:\Windows\System\JVLhKvW.exe
  2⤵
  PID:4612
- C:\Windows\System\qFCoqna.exe
  C:\Windows\System\qFCoqna.exe
  2⤵
  PID:5232
- C:\Windows\System\LqWZCyb.exe
  C:\Windows\System\LqWZCyb.exe
  2⤵
  PID:5328
- C:\Windows\System\uTewSxR.exe
  C:\Windows\System\uTewSxR.exe
  2⤵
  PID:5196
- C:\Windows\System\iFJpwOM.exe
  C:\Windows\System\iFJpwOM.exe
  2⤵
  PID:5732
- C:\Windows\System\QCfFmzB.exe
  C:\Windows\System\QCfFmzB.exe
  2⤵
  PID:5832
- C:\Windows\System\wYTMbPQ.exe
  C:\Windows\System\wYTMbPQ.exe
  2⤵
  PID:5872
- C:\Windows\System\CiRGtDO.exe
  C:\Windows\System\CiRGtDO.exe
  2⤵
  PID:5276
- C:\Windows\System\EusYsPS.exe
  C:\Windows\System\EusYsPS.exe
  2⤵
  PID:5852
- C:\Windows\System\VgVtAME.exe
  C:\Windows\System\VgVtAME.exe
  2⤵
  PID:6128
- C:\Windows\System\fzZQEFO.exe
  C:\Windows\System\fzZQEFO.exe
  2⤵
  PID:5504
- C:\Windows\System\TLGmziK.exe
  C:\Windows\System\TLGmziK.exe
  2⤵
  PID:5312
- C:\Windows\System\QeyWkIv.exe
  C:\Windows\System\QeyWkIv.exe
  2⤵
  PID:4160
- C:\Windows\System\FhaGFLe.exe
  C:\Windows\System\FhaGFLe.exe
  2⤵
  PID:4556
- C:\Windows\System\jVwpgPu.exe
  C:\Windows\System\jVwpgPu.exe
  2⤵
  PID:5084
- C:\Windows\System\TpyZLIA.exe
  C:\Windows\System\TpyZLIA.exe
  2⤵
  PID:5324
- C:\Windows\System\YcFMgXC.exe
  C:\Windows\System\YcFMgXC.exe
  2⤵
  PID:5372
- C:\Windows\System\JAJvbSr.exe
  C:\Windows\System\JAJvbSr.exe
  2⤵
  PID:5588
- C:\Windows\System\gMZhbhV.exe
  C:\Windows\System\gMZhbhV.exe
  2⤵
  PID:5888
- C:\Windows\System\KFaVAmZ.exe
  C:\Windows\System\KFaVAmZ.exe
  2⤵
  PID:5748
- C:\Windows\System\SnrkeSZ.exe
  C:\Windows\System\SnrkeSZ.exe
  2⤵
  PID:5824
- C:\Windows\System\ypFKBxe.exe
  C:\Windows\System\ypFKBxe.exe
  2⤵
  PID:4708
- C:\Windows\System\zwudhay.exe
  C:\Windows\System\zwudhay.exe
  2⤵
  PID:4784
- C:\Windows\System\dnSEXlX.exe
  C:\Windows\System\dnSEXlX.exe
  2⤵
  PID:5396
- C:\Windows\System\vczxKXK.exe
  C:\Windows\System\vczxKXK.exe
  2⤵
  PID:5616
- C:\Windows\System\nMBUNrS.exe
  C:\Windows\System\nMBUNrS.exe
  2⤵
  PID:4236
- C:\Windows\System\mFYjDCz.exe
  C:\Windows\System\mFYjDCz.exe
  2⤵
  PID:5916
- C:\Windows\System\bUJMrmY.exe
  C:\Windows\System\bUJMrmY.exe
  2⤵
  PID:6032
- C:\Windows\System\vFLVIVl.exe
  C:\Windows\System\vFLVIVl.exe
  2⤵
  PID:5768
- C:\Windows\System\aZfKmJe.exe
  C:\Windows\System\aZfKmJe.exe
  2⤵
  PID:5380
- C:\Windows\System\eowqHHa.exe
  C:\Windows\System\eowqHHa.exe
  2⤵
  PID:6152
- C:\Windows\System\UbImjNC.exe
  C:\Windows\System\UbImjNC.exe
  2⤵
  PID:6172
- C:\Windows\System\uZlOfMz.exe
  C:\Windows\System\uZlOfMz.exe
  2⤵
  PID:6192
- C:\Windows\System\pwsrjdD.exe
  C:\Windows\System\pwsrjdD.exe
  2⤵
  PID:6208
- C:\Windows\System\GUKXNNL.exe
  C:\Windows\System\GUKXNNL.exe
  2⤵
  PID:6232
- C:\Windows\System\AVKSaJW.exe
  C:\Windows\System\AVKSaJW.exe
  2⤵
  PID:6256
- C:\Windows\System\CzjglFB.exe
  C:\Windows\System\CzjglFB.exe
  2⤵
  PID:6276
- C:\Windows\System\BrgqJiz.exe
  C:\Windows\System\BrgqJiz.exe
  2⤵
  PID:6300
- C:\Windows\System\AnJcGmM.exe
  C:\Windows\System\AnJcGmM.exe
  2⤵
  PID:6320
- C:\Windows\System\kEiWaPf.exe
  C:\Windows\System\kEiWaPf.exe
  2⤵
  PID:6340
- C:\Windows\System\hrRBQmH.exe
  C:\Windows\System\hrRBQmH.exe
  2⤵
  PID:6360
- C:\Windows\System\wpFScCK.exe
  C:\Windows\System\wpFScCK.exe
  2⤵
  PID:6380
- C:\Windows\System\shDZLzW.exe
  C:\Windows\System\shDZLzW.exe
  2⤵
  PID:6400
- C:\Windows\System\ePgInul.exe
  C:\Windows\System\ePgInul.exe
  2⤵
  PID:6424
- C:\Windows\System\HymjGJV.exe
  C:\Windows\System\HymjGJV.exe
  2⤵
  PID:6440
- C:\Windows\System\HQWhnEJ.exe
  C:\Windows\System\HQWhnEJ.exe
  2⤵
  PID:6456
- C:\Windows\System\SnaCVpq.exe
  C:\Windows\System\SnaCVpq.exe
  2⤵
  PID:6472
- C:\Windows\System\mJdVHuK.exe
  C:\Windows\System\mJdVHuK.exe
  2⤵
  PID:6492
- C:\Windows\System\hqgFLEd.exe
  C:\Windows\System\hqgFLEd.exe
  2⤵
  PID:6512
- C:\Windows\System\CtTlOdw.exe
  C:\Windows\System\CtTlOdw.exe
  2⤵
  PID:6528
- C:\Windows\System\GRfmAis.exe
  C:\Windows\System\GRfmAis.exe
  2⤵
  PID:6552
- C:\Windows\System\mDmrhVC.exe
  C:\Windows\System\mDmrhVC.exe
  2⤵
  PID:6580
- C:\Windows\System\eSoerMy.exe
  C:\Windows\System\eSoerMy.exe
  2⤵
  PID:6596
- C:\Windows\System\CfYSqHy.exe
  C:\Windows\System\CfYSqHy.exe
  2⤵
  PID:6620
- C:\Windows\System\xhGWtUh.exe
  C:\Windows\System\xhGWtUh.exe
  2⤵
  PID:6640
- C:\Windows\System\qyQLRFS.exe
  C:\Windows\System\qyQLRFS.exe
  2⤵
  PID:6660
- C:\Windows\System\dovmPoD.exe
  C:\Windows\System\dovmPoD.exe
  2⤵
  PID:6680
- C:\Windows\System\pDRDAtS.exe
  C:\Windows\System\pDRDAtS.exe
  2⤵
  PID:6696
- C:\Windows\System\jhOxBtc.exe
  C:\Windows\System\jhOxBtc.exe
  2⤵
  PID:6712
- C:\Windows\System\xnnudqN.exe
  C:\Windows\System\xnnudqN.exe
  2⤵
  PID:6740
- C:\Windows\System\TEzwKjn.exe
  C:\Windows\System\TEzwKjn.exe
  2⤵
  PID:6756
- C:\Windows\System\mqoKJWs.exe
  C:\Windows\System\mqoKJWs.exe
  2⤵
  PID:6772
- C:\Windows\System\NkgawZB.exe
  C:\Windows\System\NkgawZB.exe
  2⤵
  PID:6792
- C:\Windows\System\BgTagyJ.exe
  C:\Windows\System\BgTagyJ.exe
  2⤵
  PID:6808
- C:\Windows\System\TuxvFzV.exe
  C:\Windows\System\TuxvFzV.exe
  2⤵
  PID:6828
- C:\Windows\System\sxwauaz.exe
  C:\Windows\System\sxwauaz.exe
  2⤵
  PID:6848
- C:\Windows\System\jYRpcvP.exe
  C:\Windows\System\jYRpcvP.exe
  2⤵
  PID:6864
- C:\Windows\System\wAauCkB.exe
  C:\Windows\System\wAauCkB.exe
  2⤵
  PID:6884
- C:\Windows\System\TjkOpff.exe
  C:\Windows\System\TjkOpff.exe
  2⤵
  PID:6900
- C:\Windows\System\ypHVnLB.exe
  C:\Windows\System\ypHVnLB.exe
  2⤵
  PID:6920
- C:\Windows\System\CHmmtXx.exe
  C:\Windows\System\CHmmtXx.exe
  2⤵
  PID:6940
- C:\Windows\System\XUSyXnW.exe
  C:\Windows\System\XUSyXnW.exe
  2⤵
  PID:6964
- C:\Windows\System\GzJyrie.exe
  C:\Windows\System\GzJyrie.exe
  2⤵
  PID:6980
- C:\Windows\System\dYBxQqv.exe
  C:\Windows\System\dYBxQqv.exe
  2⤵
  PID:7000
- C:\Windows\System\FXgfHyX.exe
  C:\Windows\System\FXgfHyX.exe
  2⤵
  PID:7032
- C:\Windows\System\LtELJUA.exe
  C:\Windows\System\LtELJUA.exe
  2⤵
  PID:7056
- C:\Windows\System\JVxYgxR.exe
  C:\Windows\System\JVxYgxR.exe
  2⤵
  PID:7080
- C:\Windows\System\IqfcSUU.exe
  C:\Windows\System\IqfcSUU.exe
  2⤵
  PID:7096
- C:\Windows\System\pnLjlfX.exe
  C:\Windows\System\pnLjlfX.exe
  2⤵
  PID:7112
- C:\Windows\System\xQhyBzE.exe
  C:\Windows\System\xQhyBzE.exe
  2⤵
  PID:7132
- C:\Windows\System\aoiTKGu.exe
  C:\Windows\System\aoiTKGu.exe
  2⤵
  PID:7148
- C:\Windows\System\lKQHkQY.exe
  C:\Windows\System\lKQHkQY.exe
  2⤵
  PID:5788
- C:\Windows\System\nSmbnjK.exe
  C:\Windows\System\nSmbnjK.exe
  2⤵
  PID:5540
- C:\Windows\System\LskmqYA.exe
  C:\Windows\System\LskmqYA.exe
  2⤵
  PID:6200
- C:\Windows\System\NcmAAbn.exe
  C:\Windows\System\NcmAAbn.exe
  2⤵
  PID:6252
- C:\Windows\System\fwOubRt.exe
  C:\Windows\System\fwOubRt.exe
  2⤵
  PID:6216
- C:\Windows\System\pTQzKlY.exe
  C:\Windows\System\pTQzKlY.exe
  2⤵
  PID:6284
- C:\Windows\System\CFckqRy.exe
  C:\Windows\System\CFckqRy.exe
  2⤵
  PID:6292
- C:\Windows\System\yZIMIyr.exe
  C:\Windows\System\yZIMIyr.exe
  2⤵
  PID:6316
- C:\Windows\System\nZMCBez.exe
  C:\Windows\System\nZMCBez.exe
  2⤵
  PID:6372
- C:\Windows\System\DfIroHc.exe
  C:\Windows\System\DfIroHc.exe
  2⤵
  PID:6392
- C:\Windows\System\sGtSvsz.exe
  C:\Windows\System\sGtSvsz.exe
  2⤵
  PID:6480
- C:\Windows\System\bMQlaiO.exe
  C:\Windows\System\bMQlaiO.exe
  2⤵
  PID:6524
- C:\Windows\System\LJMYPJv.exe
  C:\Windows\System\LJMYPJv.exe
  2⤵
  PID:6560
- C:\Windows\System\aoMMGZH.exe
  C:\Windows\System\aoMMGZH.exe
  2⤵
  PID:6508
- C:\Windows\System\TrqQYdS.exe
  C:\Windows\System\TrqQYdS.exe
  2⤵
  PID:6588
- C:\Windows\System\PNnAZJi.exe
  C:\Windows\System\PNnAZJi.exe
  2⤵
  PID:6612
- C:\Windows\System\GtufmuQ.exe
  C:\Windows\System\GtufmuQ.exe
  2⤵
  PID:6632
- C:\Windows\System\wxzmRKS.exe
  C:\Windows\System\wxzmRKS.exe
  2⤵
  PID:6692
- C:\Windows\System\itbkHsv.exe
  C:\Windows\System\itbkHsv.exe
  2⤵
  PID:6732
- C:\Windows\System\ZccCNvf.exe
  C:\Windows\System\ZccCNvf.exe
  2⤵
  PID:6704
- C:\Windows\System\PnPyGxH.exe
  C:\Windows\System\PnPyGxH.exe
  2⤵
  PID:6768
- C:\Windows\System\BwEpofJ.exe
  C:\Windows\System\BwEpofJ.exe
  2⤵
  PID:6908
- C:\Windows\System\RwfdteA.exe
  C:\Windows\System\RwfdteA.exe
  2⤵
  PID:6948
- C:\Windows\System\HWbbQcJ.exe
  C:\Windows\System\HWbbQcJ.exe
  2⤵
  PID:6972
- C:\Windows\System\YYFTOHT.exe
  C:\Windows\System\YYFTOHT.exe
  2⤵
  PID:6748
- C:\Windows\System\eFSwGWI.exe
  C:\Windows\System\eFSwGWI.exe
  2⤵
  PID:6856
- C:\Windows\System\gddIkhk.exe
  C:\Windows\System\gddIkhk.exe
  2⤵
  PID:5052
- C:\Windows\System\YyxJqQL.exe
  C:\Windows\System\YyxJqQL.exe
  2⤵
  PID:7044
- C:\Windows\System\wwtZGRu.exe
  C:\Windows\System\wwtZGRu.exe
  2⤵
  PID:7020
- C:\Windows\System\gvCFLIR.exe
  C:\Windows\System\gvCFLIR.exe
  2⤵
  PID:7068
- C:\Windows\System\DDuzgpl.exe
  C:\Windows\System\DDuzgpl.exe
  2⤵
  PID:7092
- C:\Windows\System\puUbwRd.exe
  C:\Windows\System\puUbwRd.exe
  2⤵
  PID:7164
- C:\Windows\System\hfdjBYZ.exe
  C:\Windows\System\hfdjBYZ.exe
  2⤵
  PID:6188
- C:\Windows\System\HHSeXtA.exe
  C:\Windows\System\HHSeXtA.exe
  2⤵
  PID:6272
- C:\Windows\System\EFBBZik.exe
  C:\Windows\System\EFBBZik.exe
  2⤵
  PID:6356
- C:\Windows\System\bZFsbdr.exe
  C:\Windows\System\bZFsbdr.exe
  2⤵
  PID:6416
- C:\Windows\System\vjILxaO.exe
  C:\Windows\System\vjILxaO.exe
  2⤵
  PID:4176
- C:\Windows\System\JYbzxFv.exe
  C:\Windows\System\JYbzxFv.exe
  2⤵
  PID:6432
- C:\Windows\System\lRazpXL.exe
  C:\Windows\System\lRazpXL.exe
  2⤵
  PID:6332
- C:\Windows\System\RzpOWbH.exe
  C:\Windows\System\RzpOWbH.exe
  2⤵
  PID:6544
- C:\Windows\System\yChpZHp.exe
  C:\Windows\System\yChpZHp.exe
  2⤵
  PID:6568
- C:\Windows\System\khZYmsW.exe
  C:\Windows\System\khZYmsW.exe
  2⤵
  PID:6564
- C:\Windows\System\sFTfFNo.exe
  C:\Windows\System\sFTfFNo.exe
  2⤵
  PID:6764
- C:\Windows\System\KwIjEay.exe
  C:\Windows\System\KwIjEay.exe
  2⤵
  PID:6676
- C:\Windows\System\AVfipKU.exe
  C:\Windows\System\AVfipKU.exe
  2⤵
  PID:6952
- C:\Windows\System\mahVgLL.exe
  C:\Windows\System\mahVgLL.exe
  2⤵
  PID:6936
- C:\Windows\System\lLXiLys.exe
  C:\Windows\System\lLXiLys.exe
  2⤵
  PID:6840
- C:\Windows\System\SThkLKI.exe
  C:\Windows\System\SThkLKI.exe
  2⤵
  PID:6976
- C:\Windows\System\LaatpxR.exe
  C:\Windows\System\LaatpxR.exe
  2⤵
  PID:7088
- C:\Windows\System\WIkGGku.exe
  C:\Windows\System\WIkGGku.exe
  2⤵
  PID:7024
- C:\Windows\System\WWQRZdo.exe
  C:\Windows\System\WWQRZdo.exe
  2⤵
  PID:6164
- C:\Windows\System\ILDWUNF.exe
  C:\Windows\System\ILDWUNF.exe
  2⤵
  PID:6184
- C:\Windows\System\cWOEkoa.exe
  C:\Windows\System\cWOEkoa.exe
  2⤵
  PID:6264
- C:\Windows\System\tANlmdm.exe
  C:\Windows\System\tANlmdm.exe
  2⤵
  PID:6268
- C:\Windows\System\MFgxvgI.exe
  C:\Windows\System\MFgxvgI.exe
  2⤵
  PID:6412
- C:\Windows\System\UcUlIrx.exe
  C:\Windows\System\UcUlIrx.exe
  2⤵
  PID:6228
- C:\Windows\System\pReLguG.exe
  C:\Windows\System\pReLguG.exe
  2⤵
  PID:6520
- C:\Windows\System\zEyuTwi.exe
  C:\Windows\System\zEyuTwi.exe
  2⤵
  PID:6608
- C:\Windows\System\ocMVhBz.exe
  C:\Windows\System\ocMVhBz.exe
  2⤵
  PID:6836
- C:\Windows\System\BSFqNaQ.exe
  C:\Windows\System\BSFqNaQ.exe
  2⤵
  PID:6780
- C:\Windows\System\mywboFs.exe
  C:\Windows\System\mywboFs.exe
  2⤵
  PID:6752
- C:\Windows\System\TtbrxlY.exe
  C:\Windows\System\TtbrxlY.exe
  2⤵
  PID:7008
- C:\Windows\System\byImhnJ.exe
  C:\Windows\System\byImhnJ.exe
  2⤵
  PID:7124
- C:\Windows\System\lcFonRT.exe
  C:\Windows\System\lcFonRT.exe
  2⤵
  PID:6148
- C:\Windows\System\zcSBLgI.exe
  C:\Windows\System\zcSBLgI.exe
  2⤵
  PID:6452
- C:\Windows\System\mLrSAut.exe
  C:\Windows\System\mLrSAut.exe
  2⤵
  PID:6736
- C:\Windows\System\hBwBSIk.exe
  C:\Windows\System\hBwBSIk.exe
  2⤵
  PID:6916
- C:\Windows\System\niBZPon.exe
  C:\Windows\System\niBZPon.exe
  2⤵
  PID:6628
- C:\Windows\System\AJbLziW.exe
  C:\Windows\System\AJbLziW.exe
  2⤵
  PID:6932
- C:\Windows\System\RbsziTb.exe
  C:\Windows\System\RbsziTb.exe
  2⤵
  PID:7040
- C:\Windows\System\duHIGCs.exe
  C:\Windows\System\duHIGCs.exe
  2⤵
  PID:6860
- C:\Windows\System\mvTdNMJ.exe
  C:\Windows\System\mvTdNMJ.exe
  2⤵
  PID:6336
- C:\Windows\System\JyRNMfQ.exe
  C:\Windows\System\JyRNMfQ.exe
  2⤵
  PID:6656
- C:\Windows\System\jhnqZpC.exe
  C:\Windows\System\jhnqZpC.exe
  2⤵
  PID:6504
- C:\Windows\System\JQwlrAv.exe
  C:\Windows\System\JQwlrAv.exe
  2⤵
  PID:6168
- C:\Windows\System\KZBkoUt.exe
  C:\Windows\System\KZBkoUt.exe
  2⤵
  PID:7108
- C:\Windows\System\PnyStmO.exe
  C:\Windows\System\PnyStmO.exe
  2⤵
  PID:7160
- C:\Windows\System\AZqzrij.exe
  C:\Windows\System\AZqzrij.exe
  2⤵
  PID:7176
- C:\Windows\System\chLyyuU.exe
  C:\Windows\System\chLyyuU.exe
  2⤵
  PID:7192
- C:\Windows\System\wfuTnly.exe
  C:\Windows\System\wfuTnly.exe
  2⤵
  PID:7208
- C:\Windows\System\YymClSF.exe
  C:\Windows\System\YymClSF.exe
  2⤵
  PID:7228
- C:\Windows\System\EwxAOgc.exe
  C:\Windows\System\EwxAOgc.exe
  2⤵
  PID:7248
- C:\Windows\System\phbkcAZ.exe
  C:\Windows\System\phbkcAZ.exe
  2⤵
  PID:7268
- C:\Windows\System\fodpKVM.exe
  C:\Windows\System\fodpKVM.exe
  2⤵
  PID:7292
- C:\Windows\System\AKrZJwW.exe
  C:\Windows\System\AKrZJwW.exe
  2⤵
  PID:7308
- C:\Windows\System\aMpHZvy.exe
  C:\Windows\System\aMpHZvy.exe
  2⤵
  PID:7340
- C:\Windows\System\FaQolFj.exe
  C:\Windows\System\FaQolFj.exe
  2⤵
  PID:7360
- C:\Windows\System\WpUkvtW.exe
  C:\Windows\System\WpUkvtW.exe
  2⤵
  PID:7380
- C:\Windows\System\RrwhODU.exe
  C:\Windows\System\RrwhODU.exe
  2⤵
  PID:7396
- C:\Windows\System\DQESXaw.exe
  C:\Windows\System\DQESXaw.exe
  2⤵
  PID:7412
- C:\Windows\System\YJUeEnS.exe
  C:\Windows\System\YJUeEnS.exe
  2⤵
  PID:7436
- C:\Windows\System\ThJjAHE.exe
  C:\Windows\System\ThJjAHE.exe
  2⤵
  PID:7464
- C:\Windows\System\XLttPqW.exe
  C:\Windows\System\XLttPqW.exe
  2⤵
  PID:7484
- C:\Windows\System\jjDKBGM.exe
  C:\Windows\System\jjDKBGM.exe
  2⤵
  PID:7504
- C:\Windows\System\yYrOzFt.exe
  C:\Windows\System\yYrOzFt.exe
  2⤵
  PID:7520
- C:\Windows\System\jWafldC.exe
  C:\Windows\System\jWafldC.exe
  2⤵
  PID:7544
- C:\Windows\System\NWyMNlJ.exe
  C:\Windows\System\NWyMNlJ.exe
  2⤵
  PID:7560
- C:\Windows\System\gXlKiEW.exe
  C:\Windows\System\gXlKiEW.exe
  2⤵
  PID:7576
- C:\Windows\System\WrSozKp.exe
  C:\Windows\System\WrSozKp.exe
  2⤵
  PID:7596
- C:\Windows\System\yrKGMny.exe
  C:\Windows\System\yrKGMny.exe
  2⤵
  PID:7620
- C:\Windows\System\jCFXhis.exe
  C:\Windows\System\jCFXhis.exe
  2⤵
  PID:7636
- C:\Windows\System\TkbqMMq.exe
  C:\Windows\System\TkbqMMq.exe
  2⤵
  PID:7668
- C:\Windows\System\QcBfOHB.exe
  C:\Windows\System\QcBfOHB.exe
  2⤵
  PID:7684
- C:\Windows\System\ZTBnpUS.exe
  C:\Windows\System\ZTBnpUS.exe
  2⤵
  PID:7704
- C:\Windows\System\sVXRqDk.exe
  C:\Windows\System\sVXRqDk.exe
  2⤵
  PID:7720
- C:\Windows\System\rLJrMoZ.exe
  C:\Windows\System\rLJrMoZ.exe
  2⤵
  PID:7740
- C:\Windows\System\gzIEobs.exe
  C:\Windows\System\gzIEobs.exe
  2⤵
  PID:7772
- C:\Windows\System\VKESLyq.exe
  C:\Windows\System\VKESLyq.exe
  2⤵
  PID:7788
- C:\Windows\System\WzjCFDq.exe
  C:\Windows\System\WzjCFDq.exe
  2⤵
  PID:7804
- C:\Windows\System\QRkxLDS.exe
  C:\Windows\System\QRkxLDS.exe
  2⤵
  PID:7824
- C:\Windows\System\cZKacLx.exe
  C:\Windows\System\cZKacLx.exe
  2⤵
  PID:7844
- C:\Windows\System\aBAKtvz.exe
  C:\Windows\System\aBAKtvz.exe
  2⤵
  PID:7860
- C:\Windows\System\nYdiKGi.exe
  C:\Windows\System\nYdiKGi.exe
  2⤵
  PID:7884
- C:\Windows\System\InItWbj.exe
  C:\Windows\System\InItWbj.exe
  2⤵
  PID:7904
- C:\Windows\System\WxluLNI.exe
  C:\Windows\System\WxluLNI.exe
  2⤵
  PID:7928
- C:\Windows\System\fCKOYgd.exe
  C:\Windows\System\fCKOYgd.exe
  2⤵
  PID:7944
- C:\Windows\System\BrCwLme.exe
  C:\Windows\System\BrCwLme.exe
  2⤵
  PID:7960
- C:\Windows\System\tdVubxD.exe
  C:\Windows\System\tdVubxD.exe
  2⤵
  PID:7996
- C:\Windows\System\zFpwLNg.exe
  C:\Windows\System\zFpwLNg.exe
  2⤵
  PID:8016
- C:\Windows\System\weOmZjt.exe
  C:\Windows\System\weOmZjt.exe
  2⤵
  PID:8036
- C:\Windows\System\PSeqmpR.exe
  C:\Windows\System\PSeqmpR.exe
  2⤵
  PID:8052
- C:\Windows\System\rlUMYCH.exe
  C:\Windows\System\rlUMYCH.exe
  2⤵
  PID:8076
- C:\Windows\System\fnaVhoF.exe
  C:\Windows\System\fnaVhoF.exe
  2⤵
  PID:8096
- C:\Windows\System\wCdwsgO.exe
  C:\Windows\System\wCdwsgO.exe
  2⤵
  PID:8112
- C:\Windows\System\vgSIffD.exe
  C:\Windows\System\vgSIffD.exe
  2⤵
  PID:8136
- C:\Windows\System\HEKAwCd.exe
  C:\Windows\System\HEKAwCd.exe
  2⤵
  PID:8152
- C:\Windows\System\PWwyeHV.exe
  C:\Windows\System\PWwyeHV.exe
  2⤵
  PID:8172
- C:\Windows\System\ydiLDKj.exe
  C:\Windows\System\ydiLDKj.exe
  2⤵
  PID:6816
- C:\Windows\System\RDuECbE.exe
  C:\Windows\System\RDuECbE.exe
  2⤵
  PID:7216
- C:\Windows\System\UyEAyWm.exe
  C:\Windows\System\UyEAyWm.exe
  2⤵
  PID:7264
- C:\Windows\System\YRWlGXQ.exe
  C:\Windows\System\YRWlGXQ.exe
  2⤵
  PID:4844
- C:\Windows\System\ZIkhvCp.exe
  C:\Windows\System\ZIkhvCp.exe
  2⤵
  PID:7280
- C:\Windows\System\fBvTzcV.exe
  C:\Windows\System\fBvTzcV.exe
  2⤵
  PID:676
- C:\Windows\System\lTjIJPZ.exe
  C:\Windows\System\lTjIJPZ.exe
  2⤵
  PID:7304
- C:\Windows\System\LKhMEIb.exe
  C:\Windows\System\LKhMEIb.exe
  2⤵
  PID:7352
- C:\Windows\System\fZkoSRH.exe
  C:\Windows\System\fZkoSRH.exe
  2⤵
  PID:7316
- C:\Windows\System\kkEuinZ.exe
  C:\Windows\System\kkEuinZ.exe
  2⤵
  PID:7376
- C:\Windows\System\SdORDLf.exe
  C:\Windows\System\SdORDLf.exe
  2⤵
  PID:7420
- C:\Windows\System\QyQtBHi.exe
  C:\Windows\System\QyQtBHi.exe
  2⤵
  PID:7452
- C:\Windows\System\gMSqMCz.exe
  C:\Windows\System\gMSqMCz.exe
  2⤵
  PID:7480
- C:\Windows\System\qQbUwjT.exe
  C:\Windows\System\qQbUwjT.exe
  2⤵
  PID:7516
- C:\Windows\System\fWKkgSA.exe
  C:\Windows\System\fWKkgSA.exe
  2⤵
  PID:7592
- C:\Windows\System\RqZwFfQ.exe
  C:\Windows\System\RqZwFfQ.exe
  2⤵
  PID:7608
- C:\Windows\System\jpzIcIV.exe
  C:\Windows\System\jpzIcIV.exe
  2⤵
  PID:7644
- C:\Windows\System\yQVVawj.exe
  C:\Windows\System\yQVVawj.exe
  2⤵
  PID:7568
- C:\Windows\System\kzyatrb.exe
  C:\Windows\System\kzyatrb.exe
  2⤵
  PID:7656
- C:\Windows\System\mSkWPcD.exe
  C:\Windows\System\mSkWPcD.exe
  2⤵
  PID:7716
- C:\Windows\System\wWGSwUf.exe
  C:\Windows\System\wWGSwUf.exe
  2⤵
  PID:7732
- C:\Windows\System\JcXscAG.exe
  C:\Windows\System\JcXscAG.exe
  2⤵
  PID:7836
- C:\Windows\System\piYTwdj.exe
  C:\Windows\System\piYTwdj.exe
  2⤵
  PID:7880
- C:\Windows\System\ortHGNA.exe
  C:\Windows\System\ortHGNA.exe
  2⤵
  PID:7912
- C:\Windows\System\LeepZwY.exe
  C:\Windows\System\LeepZwY.exe
  2⤵
  PID:7896
- C:\Windows\System\DzVhKpJ.exe
  C:\Windows\System\DzVhKpJ.exe
  2⤵
  PID:7956
- C:\Windows\System\fCDMYaW.exe
  C:\Windows\System\fCDMYaW.exe
  2⤵
  PID:7976
- C:\Windows\System\lgNdnMd.exe
  C:\Windows\System\lgNdnMd.exe
  2⤵
  PID:8008
- C:\Windows\System\yWVNrwy.exe
  C:\Windows\System\yWVNrwy.exe
  2⤵
  PID:8024
- C:\Windows\System\utsFYtr.exe
  C:\Windows\System\utsFYtr.exe
  2⤵
  PID:8084
- C:\Windows\System\jZLkVeT.exe
  C:\Windows\System\jZLkVeT.exe
  2⤵
  PID:8104
- C:\Windows\System\YYpHOGI.exe
  C:\Windows\System\YYpHOGI.exe
  2⤵
  PID:8164
- C:\Windows\System\ezaIlre.exe
  C:\Windows\System\ezaIlre.exe
  2⤵
  PID:7184
- C:\Windows\System\eJtqbRd.exe
  C:\Windows\System\eJtqbRd.exe
  2⤵
  PID:8184
- C:\Windows\System\fRgWjYq.exe
  C:\Windows\System\fRgWjYq.exe
  2⤵
  PID:972
- C:\Windows\System\ajxtAQD.exe
  C:\Windows\System\ajxtAQD.exe
  2⤵
  PID:7240
- C:\Windows\System\xsLYfpU.exe
  C:\Windows\System\xsLYfpU.exe
  2⤵
  PID:7432
- C:\Windows\System\GjubVSQ.exe
  C:\Windows\System\GjubVSQ.exe
  2⤵
  PID:7512
- C:\Windows\System\CcJeLVA.exe
  C:\Windows\System\CcJeLVA.exe
  2⤵
  PID:7172
- C:\Windows\System\SgDbUPe.exe
  C:\Windows\System\SgDbUPe.exe
  2⤵
  PID:7536
- C:\Windows\System\XMXuzYi.exe
  C:\Windows\System\XMXuzYi.exe
  2⤵
  PID:7328
- C:\Windows\System\sxfrSaT.exe
  C:\Windows\System\sxfrSaT.exe
  2⤵
  PID:7712
- C:\Windows\System\uNsuzhf.exe
  C:\Windows\System\uNsuzhf.exe
  2⤵
  PID:7476
- C:\Windows\System\lGwYuXD.exe
  C:\Windows\System\lGwYuXD.exe
  2⤵
  PID:7700
- C:\Windows\System\qjSsEGM.exe
  C:\Windows\System\qjSsEGM.exe
  2⤵
  PID:7728
- C:\Windows\System\HnTBDlS.exe
  C:\Windows\System\HnTBDlS.exe
  2⤵
  PID:7760
- C:\Windows\System\QshulWZ.exe
  C:\Windows\System\QshulWZ.exe
  2⤵
  PID:7840
- C:\Windows\System\yZCWRNR.exe
  C:\Windows\System\yZCWRNR.exe
  2⤵
  PID:7952
- C:\Windows\System\HrtetLj.exe
  C:\Windows\System\HrtetLj.exe
  2⤵
  PID:7988
- C:\Windows\System\FDycvWH.exe
  C:\Windows\System\FDycvWH.exe
  2⤵
  PID:8032
- C:\Windows\System\BUDFDxZ.exe
  C:\Windows\System\BUDFDxZ.exe
  2⤵
  PID:8108
- C:\Windows\System\rwEEEYI.exe
  C:\Windows\System\rwEEEYI.exe
  2⤵
  PID:8128
- C:\Windows\System\ijNKUrK.exe
  C:\Windows\System\ijNKUrK.exe
  2⤵
  PID:8168
- C:\Windows\System\sCSOvor.exe
  C:\Windows\System\sCSOvor.exe
  2⤵
  PID:6728
- C:\Windows\System\CnXFKJl.exe
  C:\Windows\System\CnXFKJl.exe
  2⤵
  PID:7288
- C:\Windows\System\KAKKwXK.exe
  C:\Windows\System\KAKKwXK.exe
  2⤵
  PID:7448
- C:\Windows\System\xhJRMml.exe
  C:\Windows\System\xhJRMml.exe
  2⤵
  PID:7616
- C:\Windows\System\OxwrErx.exe
  C:\Windows\System\OxwrErx.exe
  2⤵
  PID:5280
- C:\Windows\System\rkTazUC.exe
  C:\Windows\System\rkTazUC.exe
  2⤵
  PID:7648
- C:\Windows\System\ynGHoWE.exe
  C:\Windows\System\ynGHoWE.exe
  2⤵
  PID:7236
- C:\Windows\System\OwhxXHy.exe
  C:\Windows\System\OwhxXHy.exe
  2⤵
  PID:7876
- C:\Windows\System\opEqTWv.exe
  C:\Windows\System\opEqTWv.exe
  2⤵
  PID:8072
- C:\Windows\System\zUboqlS.exe
  C:\Windows\System\zUboqlS.exe
  2⤵
  PID:7940
- C:\Windows\System\zVLSUIP.exe
  C:\Windows\System\zVLSUIP.exe
  2⤵
  PID:7832
- C:\Windows\System\DKlfymj.exe
  C:\Windows\System\DKlfymj.exe
  2⤵
  PID:7372
- C:\Windows\System\tPMtXMd.exe
  C:\Windows\System\tPMtXMd.exe
  2⤵
  PID:7324
- C:\Windows\System\dgVNpOJ.exe
  C:\Windows\System\dgVNpOJ.exe
  2⤵
  PID:7204
- C:\Windows\System\AHHfRtg.exe
  C:\Windows\System\AHHfRtg.exe
  2⤵
  PID:7588
- C:\Windows\System\ZwTMYkV.exe
  C:\Windows\System\ZwTMYkV.exe
  2⤵
  PID:7920
- C:\Windows\System\STwPQTC.exe
  C:\Windows\System\STwPQTC.exe
  2⤵
  PID:7696
- C:\Windows\System\DAUnLav.exe
  C:\Windows\System\DAUnLav.exe
  2⤵
  PID:7408
- C:\Windows\System\pozDbuF.exe
  C:\Windows\System\pozDbuF.exe
  2⤵
  PID:8180
- C:\Windows\System\RnLsRAw.exe
  C:\Windows\System\RnLsRAw.exe
  2⤵
  PID:932
- C:\Windows\System\oCVcYlW.exe
  C:\Windows\System\oCVcYlW.exe
  2⤵
  PID:7612
- C:\Windows\System\sLSMvaC.exe
  C:\Windows\System\sLSMvaC.exe
  2⤵
  PID:8148
- C:\Windows\System\navYXBW.exe
  C:\Windows\System\navYXBW.exe
  2⤵
  PID:7444
- C:\Windows\System\hiTMVIy.exe
  C:\Windows\System\hiTMVIy.exe
  2⤵
  PID:8200
- C:\Windows\System\QsxWlFy.exe
  C:\Windows\System\QsxWlFy.exe
  2⤵
  PID:8216
- C:\Windows\System\nMNPcIh.exe
  C:\Windows\System\nMNPcIh.exe
  2⤵
  PID:8240
- C:\Windows\System\EaOaZVK.exe
  C:\Windows\System\EaOaZVK.exe
  2⤵
  PID:8272
- C:\Windows\System\CbTCERt.exe
  C:\Windows\System\CbTCERt.exe
  2⤵
  PID:8292
- C:\Windows\System\aXRjCxc.exe
  C:\Windows\System\aXRjCxc.exe
  2⤵
  PID:8312
- C:\Windows\System\bnvrMet.exe
  C:\Windows\System\bnvrMet.exe
  2⤵
  PID:8332
- C:\Windows\System\rXwdyax.exe
  C:\Windows\System\rXwdyax.exe
  2⤵
  PID:8348
- C:\Windows\System\pKAQckY.exe
  C:\Windows\System\pKAQckY.exe
  2⤵
  PID:8372
- C:\Windows\System\ccfnVRJ.exe
  C:\Windows\System\ccfnVRJ.exe
  2⤵
  PID:8388
- C:\Windows\System\FodVntM.exe
  C:\Windows\System\FodVntM.exe
  2⤵
  PID:8408
- C:\Windows\System\SzrNUZT.exe
  C:\Windows\System\SzrNUZT.exe
  2⤵
  PID:8428
- C:\Windows\System\cbfhqWy.exe
  C:\Windows\System\cbfhqWy.exe
  2⤵
  PID:8448
- C:\Windows\System\vLsnmyj.exe
  C:\Windows\System\vLsnmyj.exe
  2⤵
  PID:8468
- C:\Windows\System\SiddzvO.exe
  C:\Windows\System\SiddzvO.exe
  2⤵
  PID:8488
- C:\Windows\System\LVBNSPz.exe
  C:\Windows\System\LVBNSPz.exe
  2⤵
  PID:8504
- C:\Windows\System\glJyEhf.exe
  C:\Windows\System\glJyEhf.exe
  2⤵
  PID:8528
- C:\Windows\System\UhsYKsX.exe
  C:\Windows\System\UhsYKsX.exe
  2⤵
  PID:8552
- C:\Windows\System\AuRAhUO.exe
  C:\Windows\System\AuRAhUO.exe
  2⤵
  PID:8572
- C:\Windows\System\JqbpCzp.exe
  C:\Windows\System\JqbpCzp.exe
  2⤵
  PID:8600
- C:\Windows\System\FxwPfEz.exe
  C:\Windows\System\FxwPfEz.exe
  2⤵
  PID:8620
- C:\Windows\System\ZlSisgK.exe
  C:\Windows\System\ZlSisgK.exe
  2⤵
  PID:8636
- C:\Windows\System\uTgZQgE.exe
  C:\Windows\System\uTgZQgE.exe
  2⤵
  PID:8656
- C:\Windows\System\jiuMRFt.exe
  C:\Windows\System\jiuMRFt.exe
  2⤵
  PID:8672
- C:\Windows\System\XLBpiXX.exe
  C:\Windows\System\XLBpiXX.exe
  2⤵
  PID:8692
- C:\Windows\System\QDjGPfq.exe
  C:\Windows\System\QDjGPfq.exe
  2⤵
  PID:8708
- C:\Windows\System\aOBYFqu.exe
  C:\Windows\System\aOBYFqu.exe
  2⤵
  PID:8728
- C:\Windows\System\DsiWwnN.exe
  C:\Windows\System\DsiWwnN.exe
  2⤵
  PID:8744
- C:\Windows\System\SZjXkiW.exe
  C:\Windows\System\SZjXkiW.exe
  2⤵
  PID:8764
- C:\Windows\System\FWWidIe.exe
  C:\Windows\System\FWWidIe.exe
  2⤵
  PID:8780
- C:\Windows\System\gNkdfKn.exe
  C:\Windows\System\gNkdfKn.exe
  2⤵
  PID:8800
- C:\Windows\System\vVeFXWP.exe
  C:\Windows\System\vVeFXWP.exe
  2⤵
  PID:8820
- C:\Windows\System\XKrWNkU.exe
  C:\Windows\System\XKrWNkU.exe
  2⤵
  PID:8840
- C:\Windows\System\uaeBmPo.exe
  C:\Windows\System\uaeBmPo.exe
  2⤵
  PID:8876
- C:\Windows\System\QotSHXp.exe
  C:\Windows\System\QotSHXp.exe
  2⤵
  PID:8908
- C:\Windows\System\PAWpUgG.exe
  C:\Windows\System\PAWpUgG.exe
  2⤵
  PID:8924
- C:\Windows\System\dqbftKO.exe
  C:\Windows\System\dqbftKO.exe
  2⤵
  PID:8944
- C:\Windows\System\jSKATwl.exe
  C:\Windows\System\jSKATwl.exe
  2⤵
  PID:8960
- C:\Windows\System\msesJFm.exe
  C:\Windows\System\msesJFm.exe
  2⤵
  PID:8976
- C:\Windows\System\SAxYYGA.exe
  C:\Windows\System\SAxYYGA.exe
  2⤵
  PID:8992
- C:\Windows\System\czZleXi.exe
  C:\Windows\System\czZleXi.exe
  2⤵
  PID:9016
- C:\Windows\System\jDSFlTH.exe
  C:\Windows\System\jDSFlTH.exe
  2⤵
  PID:9032
- C:\Windows\System\tlnikXe.exe
  C:\Windows\System\tlnikXe.exe
  2⤵
  PID:9048
- C:\Windows\System\IVMMnWS.exe
  C:\Windows\System\IVMMnWS.exe
  2⤵
  PID:9064
- C:\Windows\System\bMTBjDg.exe
  C:\Windows\System\bMTBjDg.exe
  2⤵
  PID:9080
- C:\Windows\System\qnQqwXI.exe
  C:\Windows\System\qnQqwXI.exe
  2⤵
  PID:9132
- C:\Windows\System\NFWTOkX.exe
  C:\Windows\System\NFWTOkX.exe
  2⤵
  PID:9152
- C:\Windows\System\HksXOHX.exe
  C:\Windows\System\HksXOHX.exe
  2⤵
  PID:9168
- C:\Windows\System\ghVuMqc.exe
  C:\Windows\System\ghVuMqc.exe
  2⤵
  PID:9192
- C:\Windows\System\IltfgRO.exe
  C:\Windows\System\IltfgRO.exe
  2⤵
  PID:9208
- C:\Windows\System\RISoLvX.exe
  C:\Windows\System\RISoLvX.exe
  2⤵
  PID:7532
- C:\Windows\System\iTjZHGu.exe
  C:\Windows\System\iTjZHGu.exe
  2⤵
  PID:8248
- C:\Windows\System\hsOdkEk.exe
  C:\Windows\System\hsOdkEk.exe
  2⤵
  PID:7220
- C:\Windows\System\WLwIIsh.exe
  C:\Windows\System\WLwIIsh.exe
  2⤵
  PID:8264
- C:\Windows\System\OFrGJCb.exe
  C:\Windows\System\OFrGJCb.exe
  2⤵
  PID:8300
- C:\Windows\System\yNNCXhE.exe
  C:\Windows\System\yNNCXhE.exe
  2⤵
  PID:8280
- C:\Windows\System\tHjLaDU.exe
  C:\Windows\System\tHjLaDU.exe
  2⤵
  PID:8356
- C:\Windows\System\gdxKLed.exe
  C:\Windows\System\gdxKLed.exe
  2⤵
  PID:8320
- C:\Windows\System\turAoYK.exe
  C:\Windows\System\turAoYK.exe
  2⤵
  PID:8420
- C:\Windows\System\RQWCjZN.exe
  C:\Windows\System\RQWCjZN.exe
  2⤵
  PID:8464
- C:\Windows\System\FPgBkKy.exe
  C:\Windows\System\FPgBkKy.exe
  2⤵
  PID:8548
- C:\Windows\System\BlJgIKD.exe
  C:\Windows\System\BlJgIKD.exe
  2⤵
  PID:8444
- C:\Windows\System\pZyGbiz.exe
  C:\Windows\System\pZyGbiz.exe
  2⤵
  PID:8520
- C:\Windows\System\sZkwMRS.exe
  C:\Windows\System\sZkwMRS.exe
  2⤵
  PID:8584
- C:\Windows\System\lzIGzMD.exe
  C:\Windows\System\lzIGzMD.exe
  2⤵
  PID:8628
- C:\Windows\System\KOnjOzb.exe
  C:\Windows\System\KOnjOzb.exe
  2⤵
  PID:8700
- C:\Windows\System\kKRPOMz.exe
  C:\Windows\System\kKRPOMz.exe
  2⤵
  PID:8740
- C:\Windows\System\LscbCQL.exe
  C:\Windows\System\LscbCQL.exe
  2⤵
  PID:8776
- C:\Windows\System\jrZLHVY.exe
  C:\Windows\System\jrZLHVY.exe
  2⤵
  PID:8760
- C:\Windows\System\jWIyCVm.exe
  C:\Windows\System\jWIyCVm.exe
  2⤵
  PID:8644
- C:\Windows\System\RrdstGB.exe
  C:\Windows\System\RrdstGB.exe
  2⤵
  PID:8616
- C:\Windows\System\GKGqITv.exe
  C:\Windows\System\GKGqITv.exe
  2⤵
  PID:8852
- C:\Windows\System\YmhBIgG.exe
  C:\Windows\System\YmhBIgG.exe
  2⤵
  PID:8868
- C:\Windows\System\nHfRDya.exe
  C:\Windows\System\nHfRDya.exe
  2⤵
  PID:8896
- C:\Windows\System\enNwJlW.exe
  C:\Windows\System\enNwJlW.exe
  2⤵
  PID:8920
- C:\Windows\System\gtErPyk.exe
  C:\Windows\System\gtErPyk.exe
  2⤵
  PID:8984
- C:\Windows\System\LwCKSPE.exe
  C:\Windows\System\LwCKSPE.exe
  2⤵
  PID:8936
- C:\Windows\System\PJlyMek.exe
  C:\Windows\System\PJlyMek.exe
  2⤵
  PID:9088
- C:\Windows\System\YtcXPZt.exe
  C:\Windows\System\YtcXPZt.exe
  2⤵
  PID:9056
- C:\Windows\System\miagzJK.exe
  C:\Windows\System\miagzJK.exe
  2⤵
  PID:9104
- C:\Windows\System\ZAuDhim.exe
  C:\Windows\System\ZAuDhim.exe
  2⤵
  PID:9120
- C:\Windows\System\KEErinp.exe
  C:\Windows\System\KEErinp.exe
  2⤵
  PID:9124
- C:\Windows\System\KxlxrWR.exe
  C:\Windows\System\KxlxrWR.exe
  2⤵
  PID:7796
- C:\Windows\System\OLduMBw.exe
  C:\Windows\System\OLduMBw.exe
  2⤵
  PID:9148
- C:\Windows\System\abwbRMv.exe
  C:\Windows\System\abwbRMv.exe
  2⤵
  PID:8068
- C:\Windows\System\UdhLYdD.exe
  C:\Windows\System\UdhLYdD.exe
  2⤵
  PID:7680
- C:\Windows\System\ETzYfBx.exe
  C:\Windows\System\ETzYfBx.exe
  2⤵
  PID:8224
- C:\Windows\System\hPyUppv.exe
  C:\Windows\System\hPyUppv.exe
  2⤵
  PID:8328
- C:\Windows\System\xxaCrfo.exe
  C:\Windows\System\xxaCrfo.exe
  2⤵
  PID:8460
- C:\Windows\System\hBcFmYD.exe
  C:\Windows\System\hBcFmYD.exe
  2⤵
  PID:8416
- C:\Windows\System\HszUKNl.exe
  C:\Windows\System\HszUKNl.exe
  2⤵
  PID:8512
- C:\Windows\System\vCscYIi.exe
  C:\Windows\System\vCscYIi.exe
  2⤵
  PID:8592
- C:\Windows\System\SWZGsna.exe
  C:\Windows\System\SWZGsna.exe
  2⤵
  PID:8608
- C:\Windows\System\mribvke.exe
  C:\Windows\System\mribvke.exe
  2⤵
  PID:8612
- C:\Windows\System\hjwXMMJ.exe
  C:\Windows\System\hjwXMMJ.exe
  2⤵
  PID:8796
- C:\Windows\System\DatsgEj.exe
  C:\Windows\System\DatsgEj.exe
  2⤵
  PID:8848
- C:\Windows\System\nEsAsdH.exe
  C:\Windows\System\nEsAsdH.exe
  2⤵
  PID:8892
- C:\Windows\System\RPasaRM.exe
  C:\Windows\System\RPasaRM.exe
  2⤵
  PID:8932
- C:\Windows\System\CtCrPPs.exe
  C:\Windows\System\CtCrPPs.exe
  2⤵
  PID:8916
- C:\Windows\System\cKNwYnB.exe
  C:\Windows\System\cKNwYnB.exe
  2⤵
  PID:9004
- C:\Windows\System\IZwWfXC.exe
  C:\Windows\System\IZwWfXC.exe
  2⤵
  PID:9076
- C:\Windows\System\DVPmHdX.exe
  C:\Windows\System\DVPmHdX.exe
  2⤵
  PID:9112
- C:\Windows\System\FDynwJF.exe
  C:\Windows\System\FDynwJF.exe
  2⤵
  PID:9116
- C:\Windows\System\dokuECM.exe
  C:\Windows\System\dokuECM.exe
  2⤵
  PID:9188
- C:\Windows\System\xKwMJzo.exe
  C:\Windows\System\xKwMJzo.exe
  2⤵
  PID:8256
- C:\Windows\System\WjuHXTJ.exe
  C:\Windows\System\WjuHXTJ.exe
  2⤵
  PID:7200
- C:\Windows\System\kQWPCvY.exe
  C:\Windows\System\kQWPCvY.exe
  2⤵
  PID:8440
- C:\Windows\System\RstVDuJ.exe
  C:\Windows\System\RstVDuJ.exe
  2⤵
  PID:8368
- C:\Windows\System\yojXtLw.exe
  C:\Windows\System\yojXtLw.exe
  2⤵
  PID:8516
- C:\Windows\System\DDOaYSj.exe
  C:\Windows\System\DDOaYSj.exe
  2⤵
  PID:8684
- C:\Windows\System\rFAomEL.exe
  C:\Windows\System\rFAomEL.exe
  2⤵
  PID:8720
- C:\Windows\System\FWJsPOC.exe
  C:\Windows\System\FWJsPOC.exe
  2⤵
  PID:7300
- C:\Windows\System\MJivCuU.exe
  C:\Windows\System\MJivCuU.exe
  2⤵
  PID:8972
- C:\Windows\System\mbnUalr.exe
  C:\Windows\System\mbnUalr.exe
  2⤵
  PID:9040
- C:\Windows\System\gBzTjcA.exe
  C:\Windows\System\gBzTjcA.exe
  2⤵
  PID:9128
- C:\Windows\System\UvXAnwg.exe
  C:\Windows\System\UvXAnwg.exe
  2⤵
  PID:8456
- C:\Windows\System\BvisSFB.exe
  C:\Windows\System\BvisSFB.exe
  2⤵
  PID:8404
- C:\Windows\System\cECwMPO.exe
  C:\Windows\System\cECwMPO.exe
  2⤵
  PID:8212
- C:\Windows\System\tYMPqkq.exe
  C:\Windows\System\tYMPqkq.exe
  2⤵
  PID:9200
- C:\Windows\System\QgNfdUI.exe
  C:\Windows\System\QgNfdUI.exe
  2⤵
  PID:8236
- C:\Windows\System\fMPaVTI.exe
  C:\Windows\System\fMPaVTI.exe
  2⤵
  PID:8792
- C:\Windows\System\xYTlKdr.exe
  C:\Windows\System\xYTlKdr.exe
  2⤵
  PID:9184
- C:\Windows\System\FQQvRgc.exe
  C:\Windows\System\FQQvRgc.exe
  2⤵
  PID:8480
- C:\Windows\System\ZkcFEhL.exe
  C:\Windows\System\ZkcFEhL.exe
  2⤵
  PID:8956
- C:\Windows\System\lXvhxjM.exe
  C:\Windows\System\lXvhxjM.exe
  2⤵
  PID:8396
- C:\Windows\System\cxumUmh.exe
  C:\Windows\System\cxumUmh.exe
  2⤵
  PID:8344
- C:\Windows\System\qxeQJqG.exe
  C:\Windows\System\qxeQJqG.exe
  2⤵
  PID:9164
- C:\Windows\System\GOvRQoW.exe
  C:\Windows\System\GOvRQoW.exe
  2⤵
  PID:8812
- C:\Windows\System\QKOAeIX.exe
  C:\Windows\System\QKOAeIX.exe
  2⤵
  PID:7584
- C:\Windows\System\mHlzgyv.exe
  C:\Windows\System\mHlzgyv.exe
  2⤵
  PID:9144
- C:\Windows\System\mlANEQU.exe
  C:\Windows\System\mlANEQU.exe
  2⤵
  PID:8860
- C:\Windows\System\ZpqwNfx.exe
  C:\Windows\System\ZpqwNfx.exe
  2⤵
  PID:9236
- C:\Windows\System\lSFAdwI.exe
  C:\Windows\System\lSFAdwI.exe
  2⤵
  PID:9256
- C:\Windows\System\GCgKBHk.exe
  C:\Windows\System\GCgKBHk.exe
  2⤵
  PID:9276
- C:\Windows\System\uZWxmqb.exe
  C:\Windows\System\uZWxmqb.exe
  2⤵
  PID:9304
- C:\Windows\System\igqYFGF.exe
  C:\Windows\System\igqYFGF.exe
  2⤵
  PID:9324
- C:\Windows\System\ucPtitY.exe
  C:\Windows\System\ucPtitY.exe
  2⤵
  PID:9340
- C:\Windows\System\QorPyEN.exe
  C:\Windows\System\QorPyEN.exe
  2⤵
  PID:9360
- C:\Windows\System\sqSprHs.exe
  C:\Windows\System\sqSprHs.exe
  2⤵
  PID:9380
- C:\Windows\System\UCKwHgk.exe
  C:\Windows\System\UCKwHgk.exe
  2⤵
  PID:9408
- C:\Windows\System\uGHNiCW.exe
  C:\Windows\System\uGHNiCW.exe
  2⤵
  PID:9424
- C:\Windows\System\VGErRgG.exe
  C:\Windows\System\VGErRgG.exe
  2⤵
  PID:9440
- C:\Windows\System\yarXcfh.exe
  C:\Windows\System\yarXcfh.exe
  2⤵
  PID:9464
- C:\Windows\System\aDFkAml.exe
  C:\Windows\System\aDFkAml.exe
  2⤵
  PID:9480
- C:\Windows\System\dZaHnkb.exe
  C:\Windows\System\dZaHnkb.exe
  2⤵
  PID:9500
- C:\Windows\System\KagKHbN.exe
  C:\Windows\System\KagKHbN.exe
  2⤵
  PID:9520
- C:\Windows\System\iADJxOp.exe
  C:\Windows\System\iADJxOp.exe
  2⤵
  PID:9540
- C:\Windows\System\eiLSvfh.exe
  C:\Windows\System\eiLSvfh.exe
  2⤵
  PID:9556
- C:\Windows\System\ByHSaKg.exe
  C:\Windows\System\ByHSaKg.exe
  2⤵
  PID:9584
- C:\Windows\System\gGWWQtn.exe
  C:\Windows\System\gGWWQtn.exe
  2⤵
  PID:9600
- C:\Windows\System\pZHKvvz.exe
  C:\Windows\System\pZHKvvz.exe
  2⤵
  PID:9616
- C:\Windows\System\IUvKjLO.exe
  C:\Windows\System\IUvKjLO.exe
  2⤵
  PID:9636
- C:\Windows\System\heIzprM.exe
  C:\Windows\System\heIzprM.exe
  2⤵
  PID:9656
- C:\Windows\System\OmlYaSh.exe
  C:\Windows\System\OmlYaSh.exe
  2⤵
  PID:9676
- C:\Windows\System\GGHxNSc.exe
  C:\Windows\System\GGHxNSc.exe
  2⤵
  PID:9692
- C:\Windows\System\rCTTCOt.exe
  C:\Windows\System\rCTTCOt.exe
  2⤵
  PID:9712
- C:\Windows\System\TFyavTu.exe
  C:\Windows\System\TFyavTu.exe
  2⤵
  PID:9740
- C:\Windows\System\lxNRobB.exe
  C:\Windows\System\lxNRobB.exe
  2⤵
  PID:9756
- C:\Windows\System\VBUlTHB.exe
  C:\Windows\System\VBUlTHB.exe
  2⤵
  PID:9776
- C:\Windows\System\DuQAnML.exe
  C:\Windows\System\DuQAnML.exe
  2⤵
  PID:9792
- C:\Windows\System\itNZLXc.exe
  C:\Windows\System\itNZLXc.exe
  2⤵
  PID:9808
- C:\Windows\System\sIaejtH.exe
  C:\Windows\System\sIaejtH.exe
  2⤵
  PID:9828
- C:\Windows\System\FWWZLCj.exe
  C:\Windows\System\FWWZLCj.exe
  2⤵
  PID:9844
- C:\Windows\System\retilOL.exe
  C:\Windows\System\retilOL.exe
  2⤵
  PID:9860
- C:\Windows\System\duzihvy.exe
  C:\Windows\System\duzihvy.exe
  2⤵
  PID:9876
- C:\Windows\System\IJblNMt.exe
  C:\Windows\System\IJblNMt.exe
  2⤵
  PID:9904
- C:\Windows\System\cEChgCS.exe
  C:\Windows\System\cEChgCS.exe
  2⤵
  PID:9920
- C:\Windows\System\liVxrFM.exe
  C:\Windows\System\liVxrFM.exe
  2⤵
  PID:9936
- C:\Windows\System\tPwyZcE.exe
  C:\Windows\System\tPwyZcE.exe
  2⤵
  PID:9956
- C:\Windows\System\nWKJiDd.exe
  C:\Windows\System\nWKJiDd.exe
  2⤵
  PID:9984
- C:\Windows\System\JIKHrnx.exe
  C:\Windows\System\JIKHrnx.exe
  2⤵
  PID:10020
- C:\Windows\System\duTbUqZ.exe
  C:\Windows\System\duTbUqZ.exe
  2⤵
  PID:10036
- C:\Windows\System\bYdbOxN.exe
  C:\Windows\System\bYdbOxN.exe
  2⤵
  PID:10056
- C:\Windows\System\VTyYDkz.exe
  C:\Windows\System\VTyYDkz.exe
  2⤵
  PID:10072
- C:\Windows\System\sALlgAF.exe
  C:\Windows\System\sALlgAF.exe
  2⤵
  PID:10096
- C:\Windows\System\nHkHvoF.exe
  C:\Windows\System\nHkHvoF.exe
  2⤵
  PID:10112
- C:\Windows\System\Qzajhqm.exe
  C:\Windows\System\Qzajhqm.exe
  2⤵
  PID:10132
- C:\Windows\System\IsxApCC.exe
  C:\Windows\System\IsxApCC.exe
  2⤵
  PID:10156
- C:\Windows\System\MGqjibS.exe
  C:\Windows\System\MGqjibS.exe
  2⤵
  PID:10176
- C:\Windows\System\GWPWQjx.exe
  C:\Windows\System\GWPWQjx.exe
  2⤵
  PID:10196
- C:\Windows\System\uWfhfIe.exe
  C:\Windows\System\uWfhfIe.exe
  2⤵
  PID:10212
- C:\Windows\System\HdeSzIP.exe
  C:\Windows\System\HdeSzIP.exe
  2⤵
  PID:10232
- C:\Windows\System\EqSTVWE.exe
  C:\Windows\System\EqSTVWE.exe
  2⤵
  PID:9228
- C:\Windows\System\grEWhxA.exe
  C:\Windows\System\grEWhxA.exe
  2⤵
  PID:9268
- C:\Windows\System\lwOsSnX.exe
  C:\Windows\System\lwOsSnX.exe
  2⤵
  PID:9244
- C:\Windows\System\ZHQYHSi.exe
  C:\Windows\System\ZHQYHSi.exe
  2⤵
  PID:9348
- C:\Windows\System\GajXMbD.exe
  C:\Windows\System\GajXMbD.exe
  2⤵
  PID:9372
- C:\Windows\System\sJXbOZb.exe
  C:\Windows\System\sJXbOZb.exe
  2⤵
  PID:9368
- C:\Windows\System\rINVamC.exe
  C:\Windows\System\rINVamC.exe
  2⤵
  PID:9416
- C:\Windows\System\bFCxPsP.exe
  C:\Windows\System\bFCxPsP.exe
  2⤵
  PID:9448
- C:\Windows\System\CTeZEHD.exe
  C:\Windows\System\CTeZEHD.exe
  2⤵
  PID:9512
- C:\Windows\System\dDUETxi.exe
  C:\Windows\System\dDUETxi.exe
  2⤵
  PID:9532
- C:\Windows\System\bETBjMF.exe
  C:\Windows\System\bETBjMF.exe
  2⤵
  PID:9564
- C:\Windows\System\WKPQwmQ.exe
  C:\Windows\System\WKPQwmQ.exe
  2⤵
  PID:9576
- C:\Windows\System\htgQKOO.exe
  C:\Windows\System\htgQKOO.exe
  2⤵
  PID:9632
- C:\Windows\System\yckYcLG.exe
  C:\Windows\System\yckYcLG.exe
  2⤵
  PID:9700
- C:\Windows\System\UbnoDlk.exe
  C:\Windows\System\UbnoDlk.exe
  2⤵
  PID:9748
- C:\Windows\System\ZTXEnAu.exe
  C:\Windows\System\ZTXEnAu.exe
  2⤵
  PID:9824
- C:\Windows\System\bJsdBAT.exe
  C:\Windows\System\bJsdBAT.exe
  2⤵
  PID:9688
- C:\Windows\System\XwMBNBr.exe
  C:\Windows\System\XwMBNBr.exe
  2⤵
  PID:9888
- C:\Windows\System\IoJyoeL.exe
  C:\Windows\System\IoJyoeL.exe
  2⤵
  PID:9768
- C:\Windows\System\hUwISXa.exe
  C:\Windows\System\hUwISXa.exe
  2⤵
  PID:9896
- C:\Windows\System\nWuPffN.exe
  C:\Windows\System\nWuPffN.exe
  2⤵
  PID:9836
- C:\Windows\System\sKoZMaa.exe
  C:\Windows\System\sKoZMaa.exe
  2⤵
  PID:9932
- C:\Windows\System\rNOhhYo.exe
  C:\Windows\System\rNOhhYo.exe
  2⤵
  PID:9944
- C:\Windows\System\HNJuKxb.exe
  C:\Windows\System\HNJuKxb.exe
  2⤵
  PID:9976
- C:\Windows\System\iTuguas.exe
  C:\Windows\System\iTuguas.exe
  2⤵
  PID:9996
- C:\Windows\System\QGbBwZo.exe
  C:\Windows\System\QGbBwZo.exe
  2⤵
  PID:10008
- C:\Windows\System\hRDHPjb.exe
  C:\Windows\System\hRDHPjb.exe
  2⤵
  PID:10064
- C:\Windows\System\xWIMNAH.exe
  C:\Windows\System\xWIMNAH.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EMJVKJA.exe

Filesize
1.8MB

MD5
a4b88e6993c668b2177c14da2776a39e

SHA1
83969ae3a89b63af5ef5dcbcc7023acddfd63e09

SHA256
b1a0643ec1cf542b6b1dbf2b7f3ee25859acd40db6b7882432703d6ac4578b18

SHA512
078e7c473733eb6f7f606c0552ef8276f30dc9bb4689396e2a32357f273a6f2a460125674b3f0359e5020bd9a0246ad051578df0bdc5fe8f3347a7c821893aa8

Download Submit
C:\Windows\system\EdNdFcd.exe

Filesize
1.8MB

MD5
873fd9d7373d9bc4744bf07440071260

SHA1
917077ac7aae319cf4786b836f287e8cfb2e8dc4

SHA256
a568494d6b05098443c2519a9fea0cf37724e38c5fd2fff907677e91771e0b4a

SHA512
ec145c6e5dadebe1c6879d1ebf6d86fd4e24c98752516a9a98ad634e09572bd0f4b9f0a67d03dad218f4c15b6264fdfd6ff3f8b9038844a1f5425128eaaec2cf

Download Submit
C:\Windows\system\EqalbUI.exe

Filesize
1.8MB

MD5
0d17d89ea9010187cc6970b9a672af3b

SHA1
74d217b68f7c42eecd1a96c73a749632c05a050e

SHA256
480ba34dc5e51382d63f13b3fc6b520064726bdaa91ef247bfeeef81adfac21b

SHA512
9268b296647d250b8010cfeb6f738e9e918d88858262f4daeea7dc188faea9e72892ea927c68f31b7271127a55fe8f3830cb9c298904eabad8def21fe2a48f8e

Download Submit
C:\Windows\system\JkAZoxo.exe

Filesize
1.8MB

MD5
1b8cabb6f3c99660803002ddc29fb403

SHA1
441c6cab8ca16e02dcedb5f8d2becb06e15de742

SHA256
db32f5dda0673dd2f129e7aeabfad0f17ed017e9d293c648e2431c1806dabaf6

SHA512
68f2b36f5ab9ab0bf67150a670e2298343a69b63f64b815d92d932ea0675e8b2ad06e344867ce56fc509c3e5f480f90f86fcea6ea43e976084c2a01d8a5ac275

Download Submit
C:\Windows\system\LqYvKGD.exe

Filesize
1.8MB

MD5
d73a3c2ac57f0ed05bdc5ef2e8286081

SHA1
0c1482bbab88999e11546831a980feb879465073

SHA256
20ceb780cb98da067aa6e1beb0eb55f4ae3fdf2b974c7d63d04d490bc7e26ab6

SHA512
afa05942e9f20f13259ddcc469234ae823b3ca14e7443517e7dd6350a47abb586ffe47da03b83b682b9e617d91d185c3f94f2106f5f0f50dac5f916f99b43e58

Download Submit
C:\Windows\system\PyrwZDJ.exe

Filesize
1.8MB

MD5
77669e7c7ee2c0c5b6b29d70dfc8c685

SHA1
0cea8089871718ec07d4254919c39736c239fa7b

SHA256
3f04cad9ae40f3725a9e91f3081bcf5ba8ef575d23e8cd9442967afb96aff1d9

SHA512
0d79ea1a888f218badb67d7308b19888d6de6b094732209486579ae8a91537c0deca7a425213b2fa312da6c43291ce468cd9b93ca1469f8c60cd1a4a26370111

Download Submit
C:\Windows\system\RfmLXCG.exe

Filesize
1.8MB

MD5
b9e7babc09aef21891a1375713476b30

SHA1
80d96e1b47aa952551d1ba676bf4e36ac759c581

SHA256
af936c49a88c3f5fab3eb827c05378e87e436168d6ccaca7c1acb8813adaf8c0

SHA512
855455809c957bba66e06b4498397749592a819d2a8bb090175067140469a094b592070a1d296a132d26dc86623c8539768ec3e8ed3956dec7230579c42ad96f

Download Submit
C:\Windows\system\UaQjeqF.exe

Filesize
1.8MB

MD5
bb0ebdb75c9e99d6c13ca048ccc7194d

SHA1
2938a9a105fd311647219cfa4a90eeaee4083f68

SHA256
7c697f991cabce6827616d0a1d1145695a51a75d2d18a9899f3d3fc3c6bdeb09

SHA512
8013ab0e48bbf753d47696a44555a4a37cb74200157814cad02c2064ebf01a0381695ceddb703cba8cb16a2c605d4b4ac81f4efb1fd37cd3faaa8587f1d02736

Download Submit
C:\Windows\system\XEoggQB.exe

Filesize
1.8MB

MD5
892066590ab73f32fddecb3d932906a9

SHA1
9a4c4078b6470558420c96c93062b9d84f3e67f6

SHA256
dbf45990d6e6bf28bcd5636ad3c8361af28a740ea7aabfe4f3644bf166d2a003

SHA512
c6a397106ad428aede30a3dc05e1d18b235378ab5139e32569352c3dc997151fada873854a1b2d3e7b44c2f3d3340cc0b88fe0fcee5c0121566c58f0ca2c8d1d

Download Submit
C:\Windows\system\XLHNRpL.exe

Filesize
1.8MB

MD5
13c1de01b524e2d48cb94a7aac7f7233

SHA1
6bb1857a6b803b904f03a6e04155ca5d30c4480e

SHA256
db733dce3dbf4c8f75f4617ee7c8f66c568b1602b3b36c2100aa4b645e99c0ef

SHA512
3eac2c6210e5cd7ebbba9b1acb9650701f18f6005159f18951f3343014e2627c9bf02a023be9e1a2910fb3afffc66825e6e658f7f20693bb2f6aa3c6cb8612df

Download Submit
C:\Windows\system\YeOzhDn.exe

Filesize
1.8MB

MD5
05496e5279fbf892ef361dfddecf0622

SHA1
88212c444af8f531f035ef11fdaf8d92cf9f3ed8

SHA256
59438f89bb92e040a72cb7e8e05272733ef7c9a0da9a50782d600975de42596e

SHA512
74d54c407f396a99d68657b31f33ae0a54639a276f59cc3be09f845782358626714f6055652baf74937d2e521f1a3950bbe714bb74da186ebc7c372c699dd673

Download Submit
C:\Windows\system\YkHMpCc.exe

Filesize
1.8MB

MD5
9e6d8612234146cd565d7e7f9a04f220

SHA1
7fd799eeecb5975c1bffe36c015b8e0471ebd8be

SHA256
db5d0fae8ce9031d648f3e97fbc6af215c048228fb6d5f5130f9a1082d50c8d2

SHA512
09e94e6450e17b353d3aeb35b1c0ea848e1da29c92692e2c7a661cd806ea6168be2e1da0e72a941b28828716ab81eb5690adf26e82bb6d8b779457e3a46222a9

Download Submit
C:\Windows\system\cbUsrOo.exe

Filesize
1.8MB

MD5
f6b8df1c8e52e3dc62a5769bee478a6e

SHA1
053d3b88cc1e97b305eb70b9ee65e2eb9773bc02

SHA256
4061a1c05c3cbc0544119992d3f5e9a80f0f0b3bf29bf81a6cf324c2d35b5537

SHA512
9c91683191cd6d2be6800bac15fb10c6eed8adb9408bdc09b05d987f390ca2230305cada6e86103daaa7a707e715ddcfed6497013289b1457add275afcb1460f

Download Submit
C:\Windows\system\dKMSorS.exe

Filesize
1.8MB

MD5
9db7581ad4b2477c1d6e3df32bfffdbe

SHA1
edcac252eeb52d9d01b4bede21f0b860c615c6fd

SHA256
b54fb6331455c59d3a5347d84873c8d66bde832715f54bb09dc0e841c7b76def

SHA512
1f2e4ed1bc03776f60a8ef1c2cb4b8eb0bfb7f82c47f94528bbdcf39e19ed133d3f5c905971817d29f4f6b9dcde1af4722634a09d5f8467c35d1694ebda24b4f

Download Submit
C:\Windows\system\dboIkFp.exe

Filesize
1.8MB

MD5
7e7d8a9e19badd1e2036c641371120f6

SHA1
91b4acd367353e30dcff088dd20b472aebeaacac

SHA256
041a771600dbd11ce34d4ba9abf84cfa188734dac67345c70034751ebd510a77

SHA512
a2757e2bd97aceea69cc2b777723d089a588488228fd2f623558ec16f8a0bf7b6a6cd088a4c1e3d384516b7bbb3b17a423a64af115d62a8572c82913b46ee136

Download Submit
C:\Windows\system\eCSRAxN.exe

Filesize
1.8MB

MD5
e490cea6989dc49956db6ba27134677b

SHA1
04233aabb04a70c063ca4d74e1fdb6d056c4b642

SHA256
5263467429c2e5bd5249d8912c0bca7d5e7e23d2c0230899be82e0885662bbb6

SHA512
f71fd13d2f09c494d879483ee8edbc59f735dfcc6e008f26258abc4b50fcd9274d6d09ed8f630a263207e1cb7877c6a24a22d39d8e35093c95fbcc190e87d1de

Download Submit
C:\Windows\system\gkupJcE.exe

Filesize
1.8MB

MD5
4043cb2608f34cfd6815524bc4408579

SHA1
1590384cb8b333e9ed8a5af085f3d208130449cb

SHA256
32acda086d01b9a1845694853425bfb80d01af07d9906f73fae2539cf80a58b7

SHA512
b99db504b54a18b84958b21f9fb7dcbb5258a5620f091de8ffed521c97bceec4f855addd7eaf726a64153a3d029dfc8938d6f2325e5aec62c899bad5c479d6dc

Download Submit
C:\Windows\system\iHKVyTa.exe

Filesize
1.8MB

MD5
af886e514bcfce08c77e139a01c2948d

SHA1
8d9e42d335721b9ad7205c9636baec992ceb34a3

SHA256
9b0d3d1cc650ac7c85aabc6eb535048f5c4d9110f30933a183f89b6e4a14a1b1

SHA512
97a2762df29deb867bf01463a3510e3cf9f4396a3d2e5614cef2354a72b4e9edab1360951f5b6dfe10da88b34b91776975d5c1a954a550e9aafd90c303547232

Download Submit
C:\Windows\system\kLoztsE.exe

Filesize
1.8MB

MD5
f502eda1b4576953df51622accf449bd

SHA1
6dd2c23a467a75257c69f260421fbe5d105c0716

SHA256
28adac69d649be4b6e3e80b531ea82cc30b6d2d3f8644eb726aefc2079b21f6d

SHA512
e746d980dd38ce5bc1e4670d0b1088be7bc4b623ac45c6d18ebd3f411f502cdb8eddfd6cfcb4cf9dd424dacf7393b8c74d73b0f1d24ebe84c5cf8f3fe5a3bce8

Download Submit
C:\Windows\system\osOCZJp.exe

Filesize
1.8MB

MD5
4de3eb24f42a3f8f20408544220c6912

SHA1
fe315c5b1335e73b7db068555d0feb765b92aed2

SHA256
52e88556b9be769e4d3b6ead85b5fb6d2da1d0fb91b2d4c266d12147839b5b58

SHA512
413050f1e42c27d00d700d6de0093effe762d34ccbeef32064c372298461799a19160935d3ea09c3acc06cd762918277af0a1607a8796b73643f19b48eb854fa

Download Submit
C:\Windows\system\tlDhYgu.exe

Filesize
1.8MB

MD5
a1cebdcd75a07b081bdc7d5a4d5a8b4c

SHA1
cb4137c4ce7382bb078931cab67d190021656a20

SHA256
2f72fb8179c94676b88890b682d33da24de3f8c4ff3e6572bf2cdb7126a90de3

SHA512
f0d5aeb961e382a19e0158c9f3913e1721ff8b70b1d23adb22d850c6b48c643f543e1ff171453494f87632b4cedcf482703886ae98a66e4837674f5b777dd0d8

Download Submit
C:\Windows\system\vriXznG.exe

Filesize
1.8MB

MD5
d24db5ce53f57f11d9e49d123d8c4352

SHA1
f0dae66334e4522fff2ccaa109b6ed7ffddc242b

SHA256
6772a49bb17e9494da9324b191b22b940a6379f28d16d0b50376ac129e6a593f

SHA512
271058af872c3647b2b04d4eb9e75860397e2a723556ea2f47ff4659e1ba807c7310402f48c5647d69ada9d26fb1cd53735befd02ddf9f2953316ef1b5540001

Download Submit
C:\Windows\system\wZTNVcc.exe

Filesize
1.8MB

MD5
78e1d6e7e66864d57fc4bdc944d67b8a

SHA1
e83423fa95a540005fa4f1d6458a77e955b8f3e0

SHA256
ac7fbc450fff79bbb6d3b29580ac53692b5f3544c86eaf64d6ee2f2cd3a11ac3

SHA512
6096acf722ce2391a5d896ee218b022fe52865a6dfeed28ad7ba9456be8ee34ecbf133aaca3cb5093354798aba68d0a3b697b27f4f4cb3a61752d6350a60a4ef

Download Submit
C:\Windows\system\ygDZhJx.exe

Filesize
1.8MB

MD5
1d51ee02574a465bbfd63b08bdc0bf1f

SHA1
bb363db50d16c9257e929e784e59eed7289b2bf5

SHA256
93c5d3ab485082d4ce0bb90830c613570df052816d1d7911a6b76f142088fd9f

SHA512
da6f2754c6fda7143c9b50fb76d38d6c5fee71547bf56f15ab72cd81b215517b93340eb7ed4102da89812d926b9436126c50cae23eb2816f3db353c1529eef38

Download Submit
C:\Windows\system\zFIEmtH.exe

Filesize
1.8MB

MD5
da217ff4ec69b6cc2c6af3f18742f867

SHA1
822c6d75cb23561585cce5a6ce0af8b2b46fbb3f

SHA256
7169c8da98d2e477d86c71c64a79175980b77e9c5097bca6dfc1590a8ab8674b

SHA512
695b6f441b0d2afa400440526c4f9b87e75d809f03ba1de58286f97d980bc7314548b19678a3d9e68058ac475b7b19ac9f9ef52c2b33a775f07cc624a110140c

Download Submit
\Windows\system\DBSGVEo.exe

Filesize
1.8MB

MD5
0687d126dd989821a65d2cdf041a3e4e

SHA1
41b2724208d10c3fabf6bedbb718417ea688dbff

SHA256
4a6bc6cc55e41e21d3e6f365ba8a45d75468f3a3bfdaeafc6731cf8d89e55761

SHA512
a60c858f2942ed73534090002a6ce9fd71f2830fca3ce8005eb96f7163bc7d7f27b87daff2e4ccad1ac8eebe401ad4b6754a8c9fe1b434b19d1e4600019870a9

Download Submit
\Windows\system\VIMHnRh.exe

Filesize
1.8MB

MD5
9e3c720d7cdce889abd8950c0f02e214

SHA1
ada0e94e2a529519340691d45b1029455a70660b

SHA256
0031b52747ab4fa643133b792c6543eb59361743166758463aa7c10c95a6021d

SHA512
b16d51a3a2b639db3a1388e9b35c42e4d483bbd1d14729b74e1e58cd56885b337bc32072803f0aed04ccb0459b50b68389ea25ea8dfcb9557f2df7365bf48277

Download Submit
\Windows\system\aaZHdfJ.exe

Filesize
1.8MB

MD5
236e753d7a93872873c3b01352d843f4

SHA1
f3a30bfae02c81fb4a45655b01b9a3d142a16624

SHA256
c7131e3858700ac5080ef70a9e46eadbcf2c8d3794c1e7df588e1bd7e52c38cf

SHA512
81ca6c1e903ad9f124078b852ec7d824b3c74341faaa2a4f630e5a55d36a97082029d824e0eddc2fa26c8db1becd026e57c4ed2e0715f53e71b866368e8761fe

Download Submit
\Windows\system\fpXWfUp.exe

Filesize
1.8MB

MD5
40230faae60dc07791ba42101843fc4d

SHA1
e1db9d7e26606c26e279228f39b31202aa1ae706

SHA256
39072ebe98aeeb14649eccd907dbd1d33b79c5f9b18a2fcb4ac440ff48906826

SHA512
3b4e5dc779aa91c6422281e8f2f1a149fc2ab9bf4b2d7e9946ff55b214e2aab8abc1607297695c933df009685cb75ade0650364950b133b5a059ca8416be8272

Download Submit
\Windows\system\hncmSWx.exe

Filesize
1.8MB

MD5
2db0c77532eb04a954e244f62bb3516a

SHA1
85fb53ec5d0ffb39cf58bafff2e0b8d2cae70061

SHA256
7cc205ab5628ad0526192a793e3177a9d69e8e736cc66f4b8ba1ea300f4f3ad6

SHA512
946e5a0640ea3f3fdad5decd06929a9a381b890ea7c5204537f1965227cae71493d01182f3221517f1380507abe68a0c2db0c0687f09bab91c812f62a175f67d

Download Submit
\Windows\system\mfpwWMB.exe

Filesize
1.8MB

MD5
d63a78f90d969f671b7e453dcf52f8df

SHA1
1cb366be146ae691dde84589e2c930e9fde9bca8

SHA256
1e0d5ad7b5b83b16c3b9aaadb4bc37d72cb2c47605a9174e7f21900743014d67

SHA512
39e37ff73dacd214eb08f5d5adfbbce1471d5f4edcaa5ab6a00e0a9ede0afeb14023a7bd5c1f7a354244e7b760863830681e2baa9c1ff7e8e66af351f7f48bdc

Download Submit
\Windows\system\veJJyko.exe

Filesize
1.8MB

MD5
b3abe7155a98e7786c018cf76eb57f2d

SHA1
7a0976f166e69e971a30c9e65b7d71cbc8a6abe3

SHA256
6874a5a5cc6cb1e0b51ae5d882d47cb061648e54f35e49c18e78a09abee63885

SHA512
f09239c30631871d3cb424c71dcdab52e83aa323139bb6eb294105f04712fcfe322df68bd9d0c6d2e1da6b051b3bbf7027569a38c4ec20ae320289e2a6fb07ab

Download Submit
memory/564-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download