xmrig | e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
Size

1.4MB
MD5

7bb18d0e2be9965fdb0711daa9af800e
SHA1

721b3b7d692d42eb44a04cf5c6b503a4825620d8
SHA256

e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108
SHA512

aba2c242776d06a77c329072c3ee9d2e961b83a3cd9ea917f1c1582b09f8344f78abbc1a12f1bbbf1b13a635dcac047925167f2a98897b198d534f043fc64d33
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwyM9u:GezaTF8FcNkNdfE0pZ9ozttwIRx2VQ9u

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000015cc9-9.dat	xmrig
behavioral1/files/0x00080000000167dc-40.dat	xmrig
behavioral1/files/0x0007000000015cf2-26.dat	xmrig
behavioral1/files/0x0006000000016c58-64.dat	xmrig
behavioral1/files/0x0006000000016d13-87.dat	xmrig
behavioral1/files/0x0006000000016d36-109.dat	xmrig
behavioral1/files/0x0006000000016d9f-129.dat	xmrig
behavioral1/files/0x000600000001739c-159.dat	xmrig
behavioral1/files/0x000600000001739a-153.dat	xmrig
behavioral1/files/0x0006000000016f9c-149.dat	xmrig
behavioral1/files/0x0006000000016dc8-139.dat	xmrig
behavioral1/files/0x0006000000016e74-143.dat	xmrig
behavioral1/files/0x0006000000016dad-134.dat	xmrig
behavioral1/files/0x0006000000016d50-124.dat	xmrig
behavioral1/files/0x0006000000016d47-119.dat	xmrig
behavioral1/files/0x0006000000016d3f-114.dat	xmrig
behavioral1/files/0x0006000000016d2e-104.dat	xmrig
behavioral1/files/0x0006000000016d24-99.dat	xmrig
behavioral1/files/0x0006000000016d1b-94.dat	xmrig
behavioral1/files/0x0006000000016d0b-84.dat	xmrig
behavioral1/files/0x0006000000016cfe-79.dat	xmrig
behavioral1/files/0x0006000000016cd3-74.dat	xmrig
behavioral1/files/0x0006000000016ca2-69.dat	xmrig
behavioral1/files/0x0006000000016c4e-59.dat	xmrig
behavioral1/files/0x0006000000016a47-47.dat	xmrig
behavioral1/files/0x0007000000015d0e-36.dat	xmrig
behavioral1/files/0x0009000000015d2a-33.dat	xmrig
behavioral1/files/0x0007000000015d04-23.dat	xmrig
behavioral1/files/0x0006000000016c3d-51.dat	xmrig
behavioral1/files/0x0007000000015ce5-22.dat	xmrig
behavioral1/files/0x0008000000015cd1-17.dat	xmrig
behavioral1/files/0x0007000000012117-5.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3028	YpndEpK.exe
2256	mqqtTFn.exe
1620	PSBYaXZ.exe
2108	qXGdpqL.exe
2968	SCwlYBE.exe
2336	IVQglQK.exe
2840	wLvVWhF.exe
2080	hWwMaVk.exe
2764	VvEnIib.exe
2268	myCHUvT.exe
2776	zbscxBW.exe
2960	AsRYEyg.exe
2884	nCySONs.exe
2656	RKffZwD.exe
2628	gjcaloC.exe
2736	tKXmBMz.exe
2896	ivWplxs.exe
1292	gMcTCcb.exe
1572	IuNcrOY.exe
1760	CJdnfDC.exe
832	qtBNOWM.exe
1732	nfrBSDM.exe
820	EKuUksA.exe
2880	oybglTd.exe
2136	LDTlmUA.exe
740	mjBGhxu.exe
2936	LewLwOA.exe
2464	xIZpdyb.exe
788	McUhVrp.exe
904	HczzxdI.exe
2176	ywIwFTX.exe
1748	rcFShfY.exe
1364	qQLXgFv.exe
2324	PPGRGqw.exe
2252	mYBCocc.exe
2032	MJZlxop.exe
2116	CEDbpaY.exe
2004	viSNKfs.exe
1700	ulmCioL.exe
1756	oKqKouw.exe
1548	CdKvSaO.exe
2076	QfSvJlD.exe
1036	lGhFJkO.exe
2044	eTtfodo.exe
2272	bLTJWbl.exe
2376	Mixpryc.exe
2564	QmKKfKK.exe
1028	RTINoTS.exe
1980	VPnBWeR.exe
744	PKjmOIR.exe
1652	dRliDUJ.exe
2568	yOyjFzJ.exe
2120	cWENSOH.exe
2392	ixplDVT.exe
1604	SrbxARb.exe
2104	AmlqDjX.exe
2552	yWXjzEE.exe
2432	dSIAxtv.exe
2980	nTsWNLp.exe
2848	QKZxTwe.exe
2344	ZhcoVdg.exe
2904	JJkfOYb.exe
1056	bHPKtRJ.exe
2668	JNKoKep.exe

Loads dropped DLL 64 IoCs

pid	Process
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FQjtaen.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\oYAONOl.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\zKhBWRb.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\lgOfzWD.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\seoQHSb.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\AnWYnRF.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\PMkQQYN.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\NvfJMKa.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\eswVBNw.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\DRtReSX.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\nIAmLKb.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\HEAaMZn.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\GDQfssU.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\JANaEDu.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\yjlqDiu.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\IuHuLHn.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\GBTVdhc.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\gKklkVU.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\sDncEMK.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\ZJQUPjh.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\wUpJnnX.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\UjMvDGl.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\cPngjIo.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\vHHItMu.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\zqQICEx.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\NKeMZib.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\URrUHkI.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\BsBIaRU.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\oJeOuQk.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\tPFhwZP.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\uhjMTPW.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\tYfJFbC.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\mQsuujW.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\fljENxQ.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\GijqFfB.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\JshTIVC.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\vBdCEbK.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\ZBuliQR.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\KRDqLCY.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\iXrHfvs.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\aUgyaPe.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\ROTWeOD.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\BemFNlG.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\zgPEuZz.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\uFEmZch.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\aCFAylk.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\TiKembE.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\jFbeLQB.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\mYBCocc.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\vNkoYsV.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\CXjjyWG.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\LDikskJ.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\AJxdkcx.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\JDXdCFZ.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\rYjCFYN.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\oeoAeuU.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\xIZpdyb.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\UvsBPLp.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\eKzKLBq.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\UdebFeE.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\vnKXblB.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\XgBdpJf.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\TgaIvsq.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
File created	C:\Windows\System\unQVEzz.exe	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3028	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	31
PID 2420 wrote to memory of 3028	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	31
PID 2420 wrote to memory of 3028	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	31
PID 2420 wrote to memory of 2256	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	32
PID 2420 wrote to memory of 2256	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	32
PID 2420 wrote to memory of 2256	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	32
PID 2420 wrote to memory of 1620	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	33
PID 2420 wrote to memory of 1620	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	33
PID 2420 wrote to memory of 1620	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	33
PID 2420 wrote to memory of 2108	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	34
PID 2420 wrote to memory of 2108	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	34
PID 2420 wrote to memory of 2108	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	34
PID 2420 wrote to memory of 2968	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	35
PID 2420 wrote to memory of 2968	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	35
PID 2420 wrote to memory of 2968	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	35
PID 2420 wrote to memory of 2080	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	36
PID 2420 wrote to memory of 2080	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	36
PID 2420 wrote to memory of 2080	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	36
PID 2420 wrote to memory of 2336	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	37
PID 2420 wrote to memory of 2336	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	37
PID 2420 wrote to memory of 2336	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	37
PID 2420 wrote to memory of 2764	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	38
PID 2420 wrote to memory of 2764	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	38
PID 2420 wrote to memory of 2764	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	38
PID 2420 wrote to memory of 2840	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	39
PID 2420 wrote to memory of 2840	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	39
PID 2420 wrote to memory of 2840	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	39
PID 2420 wrote to memory of 2268	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	40
PID 2420 wrote to memory of 2268	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	40
PID 2420 wrote to memory of 2268	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	40
PID 2420 wrote to memory of 2776	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	41
PID 2420 wrote to memory of 2776	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	41
PID 2420 wrote to memory of 2776	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	41
PID 2420 wrote to memory of 2960	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	42
PID 2420 wrote to memory of 2960	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	42
PID 2420 wrote to memory of 2960	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	42
PID 2420 wrote to memory of 2884	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	43
PID 2420 wrote to memory of 2884	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	43
PID 2420 wrote to memory of 2884	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	43
PID 2420 wrote to memory of 2656	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	44
PID 2420 wrote to memory of 2656	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	44
PID 2420 wrote to memory of 2656	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	44
PID 2420 wrote to memory of 2628	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	45
PID 2420 wrote to memory of 2628	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	45
PID 2420 wrote to memory of 2628	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	45
PID 2420 wrote to memory of 2736	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	46
PID 2420 wrote to memory of 2736	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	46
PID 2420 wrote to memory of 2736	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	46
PID 2420 wrote to memory of 2896	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	47
PID 2420 wrote to memory of 2896	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	47
PID 2420 wrote to memory of 2896	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	47
PID 2420 wrote to memory of 1292	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	48
PID 2420 wrote to memory of 1292	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	48
PID 2420 wrote to memory of 1292	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	48
PID 2420 wrote to memory of 1572	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	49
PID 2420 wrote to memory of 1572	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	49
PID 2420 wrote to memory of 1572	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	49
PID 2420 wrote to memory of 1760	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	50
PID 2420 wrote to memory of 1760	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	50
PID 2420 wrote to memory of 1760	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	50
PID 2420 wrote to memory of 832	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	51
PID 2420 wrote to memory of 832	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	51
PID 2420 wrote to memory of 832	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	51
PID 2420 wrote to memory of 1732	2420	e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe	52

C:\Users\Admin\AppData\Local\Temp\e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe
"C:\Users\Admin\AppData\Local\Temp\e26b3d6c610bacc85429fb100bc90be8743b0aa7dfa76a4981693f1c2fb09108.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\System\YpndEpK.exe
  C:\Windows\System\YpndEpK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\mqqtTFn.exe
  C:\Windows\System\mqqtTFn.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\PSBYaXZ.exe
  C:\Windows\System\PSBYaXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\qXGdpqL.exe
  C:\Windows\System\qXGdpqL.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\SCwlYBE.exe
  C:\Windows\System\SCwlYBE.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hWwMaVk.exe
  C:\Windows\System\hWwMaVk.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\IVQglQK.exe
  C:\Windows\System\IVQglQK.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\VvEnIib.exe
  C:\Windows\System\VvEnIib.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\wLvVWhF.exe
  C:\Windows\System\wLvVWhF.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\myCHUvT.exe
  C:\Windows\System\myCHUvT.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\zbscxBW.exe
  C:\Windows\System\zbscxBW.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\AsRYEyg.exe
  C:\Windows\System\AsRYEyg.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\nCySONs.exe
  C:\Windows\System\nCySONs.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\RKffZwD.exe
  C:\Windows\System\RKffZwD.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\gjcaloC.exe
  C:\Windows\System\gjcaloC.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\tKXmBMz.exe
  C:\Windows\System\tKXmBMz.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\ivWplxs.exe
  C:\Windows\System\ivWplxs.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\gMcTCcb.exe
  C:\Windows\System\gMcTCcb.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\IuNcrOY.exe
  C:\Windows\System\IuNcrOY.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\CJdnfDC.exe
  C:\Windows\System\CJdnfDC.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\qtBNOWM.exe
  C:\Windows\System\qtBNOWM.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\nfrBSDM.exe
  C:\Windows\System\nfrBSDM.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\EKuUksA.exe
  C:\Windows\System\EKuUksA.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\oybglTd.exe
  C:\Windows\System\oybglTd.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\LDTlmUA.exe
  C:\Windows\System\LDTlmUA.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\mjBGhxu.exe
  C:\Windows\System\mjBGhxu.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\LewLwOA.exe
  C:\Windows\System\LewLwOA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\xIZpdyb.exe
  C:\Windows\System\xIZpdyb.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\McUhVrp.exe
  C:\Windows\System\McUhVrp.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\HczzxdI.exe
  C:\Windows\System\HczzxdI.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\ywIwFTX.exe
  C:\Windows\System\ywIwFTX.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\rcFShfY.exe
  C:\Windows\System\rcFShfY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qQLXgFv.exe
  C:\Windows\System\qQLXgFv.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\PPGRGqw.exe
  C:\Windows\System\PPGRGqw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\mYBCocc.exe
  C:\Windows\System\mYBCocc.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\MJZlxop.exe
  C:\Windows\System\MJZlxop.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\CEDbpaY.exe
  C:\Windows\System\CEDbpaY.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\viSNKfs.exe
  C:\Windows\System\viSNKfs.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ulmCioL.exe
  C:\Windows\System\ulmCioL.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\oKqKouw.exe
  C:\Windows\System\oKqKouw.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\CdKvSaO.exe
  C:\Windows\System\CdKvSaO.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\QfSvJlD.exe
  C:\Windows\System\QfSvJlD.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\lGhFJkO.exe
  C:\Windows\System\lGhFJkO.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\eTtfodo.exe
  C:\Windows\System\eTtfodo.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bLTJWbl.exe
  C:\Windows\System\bLTJWbl.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\Mixpryc.exe
  C:\Windows\System\Mixpryc.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\QmKKfKK.exe
  C:\Windows\System\QmKKfKK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\RTINoTS.exe
  C:\Windows\System\RTINoTS.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\VPnBWeR.exe
  C:\Windows\System\VPnBWeR.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\PKjmOIR.exe
  C:\Windows\System\PKjmOIR.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\dRliDUJ.exe
  C:\Windows\System\dRliDUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\yOyjFzJ.exe
  C:\Windows\System\yOyjFzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\cWENSOH.exe
  C:\Windows\System\cWENSOH.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ixplDVT.exe
  C:\Windows\System\ixplDVT.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\SrbxARb.exe
  C:\Windows\System\SrbxARb.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\AmlqDjX.exe
  C:\Windows\System\AmlqDjX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\yWXjzEE.exe
  C:\Windows\System\yWXjzEE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\dSIAxtv.exe
  C:\Windows\System\dSIAxtv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\nTsWNLp.exe
  C:\Windows\System\nTsWNLp.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\QKZxTwe.exe
  C:\Windows\System\QKZxTwe.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ZhcoVdg.exe
  C:\Windows\System\ZhcoVdg.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\JJkfOYb.exe
  C:\Windows\System\JJkfOYb.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\bHPKtRJ.exe
  C:\Windows\System\bHPKtRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\JNKoKep.exe
  C:\Windows\System\JNKoKep.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fFFObsn.exe
  C:\Windows\System\fFFObsn.exe
  2⤵
  PID:2608
- C:\Windows\System\EVdUZOw.exe
  C:\Windows\System\EVdUZOw.exe
  2⤵
  PID:2660
- C:\Windows\System\MIbkqdG.exe
  C:\Windows\System\MIbkqdG.exe
  2⤵
  PID:1524
- C:\Windows\System\RymgdUC.exe
  C:\Windows\System\RymgdUC.exe
  2⤵
  PID:1124
- C:\Windows\System\MuEjBLm.exe
  C:\Windows\System\MuEjBLm.exe
  2⤵
  PID:2144
- C:\Windows\System\QGKRRjL.exe
  C:\Windows\System\QGKRRjL.exe
  2⤵
  PID:1832
- C:\Windows\System\ivpJtgS.exe
  C:\Windows\System\ivpJtgS.exe
  2⤵
  PID:1884
- C:\Windows\System\spKaKQS.exe
  C:\Windows\System\spKaKQS.exe
  2⤵
  PID:2308
- C:\Windows\System\UlkfTCO.exe
  C:\Windows\System\UlkfTCO.exe
  2⤵
  PID:2020
- C:\Windows\System\eyOIvNg.exe
  C:\Windows\System\eyOIvNg.exe
  2⤵
  PID:2652
- C:\Windows\System\iBIVvPc.exe
  C:\Windows\System\iBIVvPc.exe
  2⤵
  PID:772
- C:\Windows\System\BBdLHMi.exe
  C:\Windows\System\BBdLHMi.exe
  2⤵
  PID:1812
- C:\Windows\System\ipvAxFq.exe
  C:\Windows\System\ipvAxFq.exe
  2⤵
  PID:1280
- C:\Windows\System\zvDAtCR.exe
  C:\Windows\System\zvDAtCR.exe
  2⤵
  PID:2300
- C:\Windows\System\lhJGobe.exe
  C:\Windows\System\lhJGobe.exe
  2⤵
  PID:2996
- C:\Windows\System\FbskQMI.exe
  C:\Windows\System\FbskQMI.exe
  2⤵
  PID:1696
- C:\Windows\System\lMUBMLB.exe
  C:\Windows\System\lMUBMLB.exe
  2⤵
  PID:1552
- C:\Windows\System\bzfXRik.exe
  C:\Windows\System\bzfXRik.exe
  2⤵
  PID:2576
- C:\Windows\System\bUhTxXL.exe
  C:\Windows\System\bUhTxXL.exe
  2⤵
  PID:1520
- C:\Windows\System\DHajaKP.exe
  C:\Windows\System\DHajaKP.exe
  2⤵
  PID:2984
- C:\Windows\System\XyrXnjC.exe
  C:\Windows\System\XyrXnjC.exe
  2⤵
  PID:856
- C:\Windows\System\yTIENMj.exe
  C:\Windows\System\yTIENMj.exe
  2⤵
  PID:784
- C:\Windows\System\DxLYtwJ.exe
  C:\Windows\System\DxLYtwJ.exe
  2⤵
  PID:872
- C:\Windows\System\UPZcMHh.exe
  C:\Windows\System\UPZcMHh.exe
  2⤵
  PID:1720
- C:\Windows\System\kuMevgG.exe
  C:\Windows\System\kuMevgG.exe
  2⤵
  PID:3012
- C:\Windows\System\nXlZTRL.exe
  C:\Windows\System\nXlZTRL.exe
  2⤵
  PID:1584
- C:\Windows\System\YgYewqb.exe
  C:\Windows\System\YgYewqb.exe
  2⤵
  PID:3024
- C:\Windows\System\bxFkpxh.exe
  C:\Windows\System\bxFkpxh.exe
  2⤵
  PID:1728
- C:\Windows\System\faoJQdb.exe
  C:\Windows\System\faoJQdb.exe
  2⤵
  PID:2828
- C:\Windows\System\qtivWPo.exe
  C:\Windows\System\qtivWPo.exe
  2⤵
  PID:2952
- C:\Windows\System\yqZaAWi.exe
  C:\Windows\System\yqZaAWi.exe
  2⤵
  PID:2752
- C:\Windows\System\uDJEHTY.exe
  C:\Windows\System\uDJEHTY.exe
  2⤵
  PID:2276
- C:\Windows\System\HOinlgO.exe
  C:\Windows\System\HOinlgO.exe
  2⤵
  PID:576
- C:\Windows\System\BqPjYLk.exe
  C:\Windows\System\BqPjYLk.exe
  2⤵
  PID:1804
- C:\Windows\System\xdIqnKb.exe
  C:\Windows\System\xdIqnKb.exe
  2⤵
  PID:1808
- C:\Windows\System\JntrNRS.exe
  C:\Windows\System\JntrNRS.exe
  2⤵
  PID:2052
- C:\Windows\System\cNqWgOz.exe
  C:\Windows\System\cNqWgOz.exe
  2⤵
  PID:292
- C:\Windows\System\soYFkNA.exe
  C:\Windows\System\soYFkNA.exe
  2⤵
  PID:1540
- C:\Windows\System\UHRAjyf.exe
  C:\Windows\System\UHRAjyf.exe
  2⤵
  PID:596
- C:\Windows\System\mQpkZkK.exe
  C:\Windows\System\mQpkZkK.exe
  2⤵
  PID:2072
- C:\Windows\System\BgByfED.exe
  C:\Windows\System\BgByfED.exe
  2⤵
  PID:668
- C:\Windows\System\AJJCeCk.exe
  C:\Windows\System\AJJCeCk.exe
  2⤵
  PID:2532
- C:\Windows\System\BGkwBoQ.exe
  C:\Windows\System\BGkwBoQ.exe
  2⤵
  PID:2500
- C:\Windows\System\XArgkNZ.exe
  C:\Windows\System\XArgkNZ.exe
  2⤵
  PID:1680
- C:\Windows\System\ZZdbgkV.exe
  C:\Windows\System\ZZdbgkV.exe
  2⤵
  PID:324
- C:\Windows\System\GkjSvaS.exe
  C:\Windows\System\GkjSvaS.exe
  2⤵
  PID:1096
- C:\Windows\System\XekpRhO.exe
  C:\Windows\System\XekpRhO.exe
  2⤵
  PID:3020
- C:\Windows\System\lCdZEKT.exe
  C:\Windows\System\lCdZEKT.exe
  2⤵
  PID:2868
- C:\Windows\System\RWdcIcb.exe
  C:\Windows\System\RWdcIcb.exe
  2⤵
  PID:3088
- C:\Windows\System\wXbClTh.exe
  C:\Windows\System\wXbClTh.exe
  2⤵
  PID:3112
- C:\Windows\System\nbFRSBX.exe
  C:\Windows\System\nbFRSBX.exe
  2⤵
  PID:3132
- C:\Windows\System\pdjOLJH.exe
  C:\Windows\System\pdjOLJH.exe
  2⤵
  PID:3148
- C:\Windows\System\eRyZFqV.exe
  C:\Windows\System\eRyZFqV.exe
  2⤵
  PID:3172
- C:\Windows\System\WPXnxCn.exe
  C:\Windows\System\WPXnxCn.exe
  2⤵
  PID:3196
- C:\Windows\System\Rfjuqrg.exe
  C:\Windows\System\Rfjuqrg.exe
  2⤵
  PID:3212
- C:\Windows\System\GijqFfB.exe
  C:\Windows\System\GijqFfB.exe
  2⤵
  PID:3228
- C:\Windows\System\vduyxhq.exe
  C:\Windows\System\vduyxhq.exe
  2⤵
  PID:3248
- C:\Windows\System\jIkxcwt.exe
  C:\Windows\System\jIkxcwt.exe
  2⤵
  PID:3268
- C:\Windows\System\BDMrPmk.exe
  C:\Windows\System\BDMrPmk.exe
  2⤵
  PID:3296
- C:\Windows\System\uRIBYQo.exe
  C:\Windows\System\uRIBYQo.exe
  2⤵
  PID:3316
- C:\Windows\System\zXevJrE.exe
  C:\Windows\System\zXevJrE.exe
  2⤵
  PID:3332
- C:\Windows\System\soesIIi.exe
  C:\Windows\System\soesIIi.exe
  2⤵
  PID:3348
- C:\Windows\System\lzksjfu.exe
  C:\Windows\System\lzksjfu.exe
  2⤵
  PID:3368
- C:\Windows\System\thyMjAO.exe
  C:\Windows\System\thyMjAO.exe
  2⤵
  PID:3384
- C:\Windows\System\KnoNQiL.exe
  C:\Windows\System\KnoNQiL.exe
  2⤵
  PID:3404
- C:\Windows\System\pAvizJG.exe
  C:\Windows\System\pAvizJG.exe
  2⤵
  PID:3424
- C:\Windows\System\KhjktcH.exe
  C:\Windows\System\KhjktcH.exe
  2⤵
  PID:3440
- C:\Windows\System\gHXhndg.exe
  C:\Windows\System\gHXhndg.exe
  2⤵
  PID:3460
- C:\Windows\System\vteRudR.exe
  C:\Windows\System\vteRudR.exe
  2⤵
  PID:3480
- C:\Windows\System\aCFAylk.exe
  C:\Windows\System\aCFAylk.exe
  2⤵
  PID:3500
- C:\Windows\System\gaXknIS.exe
  C:\Windows\System\gaXknIS.exe
  2⤵
  PID:3516
- C:\Windows\System\hHatXbW.exe
  C:\Windows\System\hHatXbW.exe
  2⤵
  PID:3532
- C:\Windows\System\zIhzctr.exe
  C:\Windows\System\zIhzctr.exe
  2⤵
  PID:3548
- C:\Windows\System\zqQICEx.exe
  C:\Windows\System\zqQICEx.exe
  2⤵
  PID:3564
- C:\Windows\System\DfmfRxm.exe
  C:\Windows\System\DfmfRxm.exe
  2⤵
  PID:3588
- C:\Windows\System\iqKVreG.exe
  C:\Windows\System\iqKVreG.exe
  2⤵
  PID:3604
- C:\Windows\System\nkaHjGQ.exe
  C:\Windows\System\nkaHjGQ.exe
  2⤵
  PID:3628
- C:\Windows\System\hJjXNYv.exe
  C:\Windows\System\hJjXNYv.exe
  2⤵
  PID:3672
- C:\Windows\System\lYnAsKw.exe
  C:\Windows\System\lYnAsKw.exe
  2⤵
  PID:3692
- C:\Windows\System\yvBzGFP.exe
  C:\Windows\System\yvBzGFP.exe
  2⤵
  PID:3708
- C:\Windows\System\blSrmgt.exe
  C:\Windows\System\blSrmgt.exe
  2⤵
  PID:3732
- C:\Windows\System\nIAmLKb.exe
  C:\Windows\System\nIAmLKb.exe
  2⤵
  PID:3748
- C:\Windows\System\UKPZIdf.exe
  C:\Windows\System\UKPZIdf.exe
  2⤵
  PID:3764
- C:\Windows\System\bdIgCkf.exe
  C:\Windows\System\bdIgCkf.exe
  2⤵
  PID:3788
- C:\Windows\System\taIxLaY.exe
  C:\Windows\System\taIxLaY.exe
  2⤵
  PID:3816
- C:\Windows\System\oJeOuQk.exe
  C:\Windows\System\oJeOuQk.exe
  2⤵
  PID:3832
- C:\Windows\System\uFJDwQN.exe
  C:\Windows\System\uFJDwQN.exe
  2⤵
  PID:3852
- C:\Windows\System\hQBDGDY.exe
  C:\Windows\System\hQBDGDY.exe
  2⤵
  PID:3868
- C:\Windows\System\oHVmyfj.exe
  C:\Windows\System\oHVmyfj.exe
  2⤵
  PID:3896
- C:\Windows\System\WrcIvix.exe
  C:\Windows\System\WrcIvix.exe
  2⤵
  PID:3912
- C:\Windows\System\aVPaIjq.exe
  C:\Windows\System\aVPaIjq.exe
  2⤵
  PID:3932
- C:\Windows\System\EceZrqq.exe
  C:\Windows\System\EceZrqq.exe
  2⤵
  PID:3952
- C:\Windows\System\sDncEMK.exe
  C:\Windows\System\sDncEMK.exe
  2⤵
  PID:3976
- C:\Windows\System\ddLyMhx.exe
  C:\Windows\System\ddLyMhx.exe
  2⤵
  PID:3992
- C:\Windows\System\LNWPhPM.exe
  C:\Windows\System\LNWPhPM.exe
  2⤵
  PID:4012
- C:\Windows\System\WdEThBV.exe
  C:\Windows\System\WdEThBV.exe
  2⤵
  PID:4028
- C:\Windows\System\PuJNxif.exe
  C:\Windows\System\PuJNxif.exe
  2⤵
  PID:4056
- C:\Windows\System\coCmtaM.exe
  C:\Windows\System\coCmtaM.exe
  2⤵
  PID:4076
- C:\Windows\System\XWVKCKH.exe
  C:\Windows\System\XWVKCKH.exe
  2⤵
  PID:4092
- C:\Windows\System\BmyklSZ.exe
  C:\Windows\System\BmyklSZ.exe
  2⤵
  PID:2836
- C:\Windows\System\VJciiAC.exe
  C:\Windows\System\VJciiAC.exe
  2⤵
  PID:1160
- C:\Windows\System\AgIbDmj.exe
  C:\Windows\System\AgIbDmj.exe
  2⤵
  PID:2780
- C:\Windows\System\WaxEZLS.exe
  C:\Windows\System\WaxEZLS.exe
  2⤵
  PID:1836
- C:\Windows\System\lCnfDYk.exe
  C:\Windows\System\lCnfDYk.exe
  2⤵
  PID:2196
- C:\Windows\System\UAZDWdS.exe
  C:\Windows\System\UAZDWdS.exe
  2⤵
  PID:652
- C:\Windows\System\iCCAvze.exe
  C:\Windows\System\iCCAvze.exe
  2⤵
  PID:1596
- C:\Windows\System\PBGMwiW.exe
  C:\Windows\System\PBGMwiW.exe
  2⤵
  PID:1656
- C:\Windows\System\DeCidkZ.exe
  C:\Windows\System\DeCidkZ.exe
  2⤵
  PID:1012
- C:\Windows\System\IjuCWSy.exe
  C:\Windows\System\IjuCWSy.exe
  2⤵
  PID:532
- C:\Windows\System\wCaeMJL.exe
  C:\Windows\System\wCaeMJL.exe
  2⤵
  PID:2744
- C:\Windows\System\JfXmNva.exe
  C:\Windows\System\JfXmNva.exe
  2⤵
  PID:3104
- C:\Windows\System\LoolwBS.exe
  C:\Windows\System\LoolwBS.exe
  2⤵
  PID:3184
- C:\Windows\System\hyQhUMv.exe
  C:\Windows\System\hyQhUMv.exe
  2⤵
  PID:3256
- C:\Windows\System\gcKNfne.exe
  C:\Windows\System\gcKNfne.exe
  2⤵
  PID:836
- C:\Windows\System\HoBEHox.exe
  C:\Windows\System\HoBEHox.exe
  2⤵
  PID:2284
- C:\Windows\System\TLWOvHE.exe
  C:\Windows\System\TLWOvHE.exe
  2⤵
  PID:3076
- C:\Windows\System\hvOZroT.exe
  C:\Windows\System\hvOZroT.exe
  2⤵
  PID:3160
- C:\Windows\System\mTxsdOC.exe
  C:\Windows\System\mTxsdOC.exe
  2⤵
  PID:3340
- C:\Windows\System\TQzqKQD.exe
  C:\Windows\System\TQzqKQD.exe
  2⤵
  PID:3416
- C:\Windows\System\yjARboD.exe
  C:\Windows\System\yjARboD.exe
  2⤵
  PID:3488
- C:\Windows\System\XqGDNKi.exe
  C:\Windows\System\XqGDNKi.exe
  2⤵
  PID:3244
- C:\Windows\System\TiKembE.exe
  C:\Windows\System\TiKembE.exe
  2⤵
  PID:3496
- C:\Windows\System\IiepRVg.exe
  C:\Windows\System\IiepRVg.exe
  2⤵
  PID:2748
- C:\Windows\System\bMroPDk.exe
  C:\Windows\System\bMroPDk.exe
  2⤵
  PID:3328
- C:\Windows\System\HrSDsSh.exe
  C:\Windows\System\HrSDsSh.exe
  2⤵
  PID:3364
- C:\Windows\System\LXxILWv.exe
  C:\Windows\System\LXxILWv.exe
  2⤵
  PID:3572
- C:\Windows\System\bRurrVd.exe
  C:\Windows\System\bRurrVd.exe
  2⤵
  PID:3512
- C:\Windows\System\ShoJGsr.exe
  C:\Windows\System\ShoJGsr.exe
  2⤵
  PID:3436
- C:\Windows\System\ctIDmAd.exe
  C:\Windows\System\ctIDmAd.exe
  2⤵
  PID:2648
- C:\Windows\System\GWLNQMp.exe
  C:\Windows\System\GWLNQMp.exe
  2⤵
  PID:3648
- C:\Windows\System\bcGskEy.exe
  C:\Windows\System\bcGskEy.exe
  2⤵
  PID:3660
- C:\Windows\System\KYgATdJ.exe
  C:\Windows\System\KYgATdJ.exe
  2⤵
  PID:3744
- C:\Windows\System\kGjjKpp.exe
  C:\Windows\System\kGjjKpp.exe
  2⤵
  PID:3684
- C:\Windows\System\QgIBMRo.exe
  C:\Windows\System\QgIBMRo.exe
  2⤵
  PID:3724
- C:\Windows\System\eWthmbI.exe
  C:\Windows\System\eWthmbI.exe
  2⤵
  PID:3796
- C:\Windows\System\bYtIUTW.exe
  C:\Windows\System\bYtIUTW.exe
  2⤵
  PID:3828
- C:\Windows\System\OATCwAq.exe
  C:\Windows\System\OATCwAq.exe
  2⤵
  PID:2784
- C:\Windows\System\CxJdEoa.exe
  C:\Windows\System\CxJdEoa.exe
  2⤵
  PID:3840
- C:\Windows\System\ubrgCNY.exe
  C:\Windows\System\ubrgCNY.exe
  2⤵
  PID:3908
- C:\Windows\System\KZzkRLt.exe
  C:\Windows\System\KZzkRLt.exe
  2⤵
  PID:3884
- C:\Windows\System\NlwWdRD.exe
  C:\Windows\System\NlwWdRD.exe
  2⤵
  PID:3940
- C:\Windows\System\WIYcbQO.exe
  C:\Windows\System\WIYcbQO.exe
  2⤵
  PID:2316
- C:\Windows\System\ykGAeMA.exe
  C:\Windows\System\ykGAeMA.exe
  2⤵
  PID:2644
- C:\Windows\System\UvsBPLp.exe
  C:\Windows\System\UvsBPLp.exe
  2⤵
  PID:3924
- C:\Windows\System\pEdrwAD.exe
  C:\Windows\System\pEdrwAD.exe
  2⤵
  PID:3972
- C:\Windows\System\adYWKTq.exe
  C:\Windows\System\adYWKTq.exe
  2⤵
  PID:4068
- C:\Windows\System\faXEZBI.exe
  C:\Windows\System\faXEZBI.exe
  2⤵
  PID:2536
- C:\Windows\System\bxTIgxm.exe
  C:\Windows\System\bxTIgxm.exe
  2⤵
  PID:4040
- C:\Windows\System\Wywnbqr.exe
  C:\Windows\System\Wywnbqr.exe
  2⤵
  PID:2452
- C:\Windows\System\WPVdNHE.exe
  C:\Windows\System\WPVdNHE.exe
  2⤵
  PID:4052
- C:\Windows\System\RaAPNSk.exe
  C:\Windows\System\RaAPNSk.exe
  2⤵
  PID:2624
- C:\Windows\System\fnnTMBN.exe
  C:\Windows\System\fnnTMBN.exe
  2⤵
  PID:1872
- C:\Windows\System\HIoULSD.exe
  C:\Windows\System\HIoULSD.exe
  2⤵
  PID:2876
- C:\Windows\System\GdNzYkw.exe
  C:\Windows\System\GdNzYkw.exe
  2⤵
  PID:3144
- C:\Windows\System\SxgNPZK.exe
  C:\Windows\System\SxgNPZK.exe
  2⤵
  PID:2796
- C:\Windows\System\ewvMrfa.exe
  C:\Windows\System\ewvMrfa.exe
  2⤵
  PID:1356
- C:\Windows\System\bfxAWDp.exe
  C:\Windows\System\bfxAWDp.exe
  2⤵
  PID:1612
- C:\Windows\System\PZweAJO.exe
  C:\Windows\System\PZweAJO.exe
  2⤵
  PID:1828
- C:\Windows\System\XNQaogY.exe
  C:\Windows\System\XNQaogY.exe
  2⤵
  PID:2292
- C:\Windows\System\tSGhfvj.exe
  C:\Windows\System\tSGhfvj.exe
  2⤵
  PID:2672
- C:\Windows\System\jrRWWfO.exe
  C:\Windows\System\jrRWWfO.exe
  2⤵
  PID:3156
- C:\Windows\System\VdjlXft.exe
  C:\Windows\System\VdjlXft.exe
  2⤵
  PID:1508
- C:\Windows\System\KBJqFyY.exe
  C:\Windows\System\KBJqFyY.exe
  2⤵
  PID:3276
- C:\Windows\System\pagSYqU.exe
  C:\Windows\System\pagSYqU.exe
  2⤵
  PID:3288
- C:\Windows\System\mlgPQaq.exe
  C:\Windows\System\mlgPQaq.exe
  2⤵
  PID:3324
- C:\Windows\System\rIfrUGM.exe
  C:\Windows\System\rIfrUGM.exe
  2⤵
  PID:1704
- C:\Windows\System\fHSuZIX.exe
  C:\Windows\System\fHSuZIX.exe
  2⤵
  PID:3544
- C:\Windows\System\eKzKLBq.exe
  C:\Windows\System\eKzKLBq.exe
  2⤵
  PID:3600
- C:\Windows\System\LMVrCZx.exe
  C:\Windows\System\LMVrCZx.exe
  2⤵
  PID:2620
- C:\Windows\System\qfrErxn.exe
  C:\Windows\System\qfrErxn.exe
  2⤵
  PID:3640
- C:\Windows\System\LDikskJ.exe
  C:\Windows\System\LDikskJ.exe
  2⤵
  PID:3700
- C:\Windows\System\fOhTYGn.exe
  C:\Windows\System\fOhTYGn.exe
  2⤵
  PID:3612
- C:\Windows\System\tVFVMlD.exe
  C:\Windows\System\tVFVMlD.exe
  2⤵
  PID:3392
- C:\Windows\System\VxdtTXK.exe
  C:\Windows\System\VxdtTXK.exe
  2⤵
  PID:2440
- C:\Windows\System\bKOVmln.exe
  C:\Windows\System\bKOVmln.exe
  2⤵
  PID:1296
- C:\Windows\System\mZnKkCh.exe
  C:\Windows\System\mZnKkCh.exe
  2⤵
  PID:2948
- C:\Windows\System\hnbAWIq.exe
  C:\Windows\System\hnbAWIq.exe
  2⤵
  PID:352
- C:\Windows\System\JEPhBgH.exe
  C:\Windows\System\JEPhBgH.exe
  2⤵
  PID:3772
- C:\Windows\System\Ycufdgk.exe
  C:\Windows\System\Ycufdgk.exe
  2⤵
  PID:2488
- C:\Windows\System\ltZpgzY.exe
  C:\Windows\System\ltZpgzY.exe
  2⤵
  PID:3864
- C:\Windows\System\KQhBNqa.exe
  C:\Windows\System\KQhBNqa.exe
  2⤵
  PID:3892
- C:\Windows\System\GQsqbIH.exe
  C:\Windows\System\GQsqbIH.exe
  2⤵
  PID:3812
- C:\Windows\System\CZsXbsl.exe
  C:\Windows\System\CZsXbsl.exe
  2⤵
  PID:3960
- C:\Windows\System\AGEVReG.exe
  C:\Windows\System\AGEVReG.exe
  2⤵
  PID:4008
- C:\Windows\System\iQCaPWJ.exe
  C:\Windows\System\iQCaPWJ.exe
  2⤵
  PID:4084
- C:\Windows\System\EKXvUkP.exe
  C:\Windows\System\EKXvUkP.exe
  2⤵
  PID:1164
- C:\Windows\System\RMzfueM.exe
  C:\Windows\System\RMzfueM.exe
  2⤵
  PID:1692
- C:\Windows\System\cJXcXBz.exe
  C:\Windows\System\cJXcXBz.exe
  2⤵
  PID:2704
- C:\Windows\System\szVPLny.exe
  C:\Windows\System\szVPLny.exe
  2⤵
  PID:2820
- C:\Windows\System\VcktnET.exe
  C:\Windows\System\VcktnET.exe
  2⤵
  PID:4064
- C:\Windows\System\dIsxkVq.exe
  C:\Windows\System\dIsxkVq.exe
  2⤵
  PID:4048
- C:\Windows\System\JwpNyGa.exe
  C:\Windows\System\JwpNyGa.exe
  2⤵
  PID:3068
- C:\Windows\System\xYcSqIW.exe
  C:\Windows\System\xYcSqIW.exe
  2⤵
  PID:3304
- C:\Windows\System\KfCYBRN.exe
  C:\Windows\System\KfCYBRN.exe
  2⤵
  PID:2588
- C:\Windows\System\kfjsSxR.exe
  C:\Windows\System\kfjsSxR.exe
  2⤵
  PID:2224
- C:\Windows\System\zaWBIIp.exe
  C:\Windows\System\zaWBIIp.exe
  2⤵
  PID:3312
- C:\Windows\System\ffOleKt.exe
  C:\Windows\System\ffOleKt.exe
  2⤵
  PID:3224
- C:\Windows\System\RkQMAVH.exe
  C:\Windows\System\RkQMAVH.exe
  2⤵
  PID:3380
- C:\Windows\System\LLgMnZQ.exe
  C:\Windows\System\LLgMnZQ.exe
  2⤵
  PID:3292
- C:\Windows\System\fwaypVP.exe
  C:\Windows\System\fwaypVP.exe
  2⤵
  PID:3716
- C:\Windows\System\UlqOZxH.exe
  C:\Windows\System\UlqOZxH.exe
  2⤵
  PID:3240
- C:\Windows\System\uLIvPFB.exe
  C:\Windows\System\uLIvPFB.exe
  2⤵
  PID:1956
- C:\Windows\System\qbvSciE.exe
  C:\Windows\System\qbvSciE.exe
  2⤵
  PID:2740
- C:\Windows\System\KxlKRbL.exe
  C:\Windows\System\KxlKRbL.exe
  2⤵
  PID:2444
- C:\Windows\System\BilxXpe.exe
  C:\Windows\System\BilxXpe.exe
  2⤵
  PID:688
- C:\Windows\System\MQtfjEh.exe
  C:\Windows\System\MQtfjEh.exe
  2⤵
  PID:1264
- C:\Windows\System\VtKSOdv.exe
  C:\Windows\System\VtKSOdv.exe
  2⤵
  PID:3644
- C:\Windows\System\hNxgRbl.exe
  C:\Windows\System\hNxgRbl.exe
  2⤵
  PID:3396
- C:\Windows\System\yrdFJgz.exe
  C:\Windows\System\yrdFJgz.exe
  2⤵
  PID:3776
- C:\Windows\System\OYvqPxd.exe
  C:\Windows\System\OYvqPxd.exe
  2⤵
  PID:4020
- C:\Windows\System\faKDTtV.exe
  C:\Windows\System\faKDTtV.exe
  2⤵
  PID:2888
- C:\Windows\System\zimCUdD.exe
  C:\Windows\System\zimCUdD.exe
  2⤵
  PID:2760
- C:\Windows\System\IdytfvS.exe
  C:\Windows\System\IdytfvS.exe
  2⤵
  PID:1432
- C:\Windows\System\HuELRJC.exe
  C:\Windows\System\HuELRJC.exe
  2⤵
  PID:3456
- C:\Windows\System\jFbeLQB.exe
  C:\Windows\System\jFbeLQB.exe
  2⤵
  PID:3284
- C:\Windows\System\bysHCwK.exe
  C:\Windows\System\bysHCwK.exe
  2⤵
  PID:4004
- C:\Windows\System\fTycpzx.exe
  C:\Windows\System\fTycpzx.exe
  2⤵
  PID:2864
- C:\Windows\System\oDSGkPY.exe
  C:\Windows\System\oDSGkPY.exe
  2⤵
  PID:3680
- C:\Windows\System\wplJyFy.exe
  C:\Windows\System\wplJyFy.exe
  2⤵
  PID:3452
- C:\Windows\System\iFxKArQ.exe
  C:\Windows\System\iFxKArQ.exe
  2⤵
  PID:3580
- C:\Windows\System\PnpQFMA.exe
  C:\Windows\System\PnpQFMA.exe
  2⤵
  PID:3260
- C:\Windows\System\xaRplYZ.exe
  C:\Windows\System\xaRplYZ.exe
  2⤵
  PID:2360
- C:\Windows\System\HyKekYX.exe
  C:\Windows\System\HyKekYX.exe
  2⤵
  PID:3824
- C:\Windows\System\InWcYbS.exe
  C:\Windows\System\InWcYbS.exe
  2⤵
  PID:1284
- C:\Windows\System\DNeoljQ.exe
  C:\Windows\System\DNeoljQ.exe
  2⤵
  PID:2228
- C:\Windows\System\vqTkjMD.exe
  C:\Windows\System\vqTkjMD.exe
  2⤵
  PID:2616
- C:\Windows\System\yMUWHMd.exe
  C:\Windows\System\yMUWHMd.exe
  2⤵
  PID:3704
- C:\Windows\System\ZfqaMdY.exe
  C:\Windows\System\ZfqaMdY.exe
  2⤵
  PID:2640
- C:\Windows\System\CzDDyti.exe
  C:\Windows\System\CzDDyti.exe
  2⤵
  PID:3376
- C:\Windows\System\XGAefZl.exe
  C:\Windows\System\XGAefZl.exe
  2⤵
  PID:3476
- C:\Windows\System\MhcvfrT.exe
  C:\Windows\System\MhcvfrT.exe
  2⤵
  PID:2220
- C:\Windows\System\heixovu.exe
  C:\Windows\System\heixovu.exe
  2⤵
  PID:4036
- C:\Windows\System\heqEcUR.exe
  C:\Windows\System\heqEcUR.exe
  2⤵
  PID:4112
- C:\Windows\System\LWpDzxS.exe
  C:\Windows\System\LWpDzxS.exe
  2⤵
  PID:4128
- C:\Windows\System\McNQvog.exe
  C:\Windows\System\McNQvog.exe
  2⤵
  PID:4144
- C:\Windows\System\PCqqVow.exe
  C:\Windows\System\PCqqVow.exe
  2⤵
  PID:4160
- C:\Windows\System\UtbABNp.exe
  C:\Windows\System\UtbABNp.exe
  2⤵
  PID:4176
- C:\Windows\System\iGxFIEz.exe
  C:\Windows\System\iGxFIEz.exe
  2⤵
  PID:4192
- C:\Windows\System\pJavsCM.exe
  C:\Windows\System\pJavsCM.exe
  2⤵
  PID:4208
- C:\Windows\System\jRXfDQt.exe
  C:\Windows\System\jRXfDQt.exe
  2⤵
  PID:4224
- C:\Windows\System\dBDVVvY.exe
  C:\Windows\System\dBDVVvY.exe
  2⤵
  PID:4240
- C:\Windows\System\MwrlTDt.exe
  C:\Windows\System\MwrlTDt.exe
  2⤵
  PID:4256
- C:\Windows\System\LsXmuNf.exe
  C:\Windows\System\LsXmuNf.exe
  2⤵
  PID:4272
- C:\Windows\System\aUgyaPe.exe
  C:\Windows\System\aUgyaPe.exe
  2⤵
  PID:4288
- C:\Windows\System\ZBemveW.exe
  C:\Windows\System\ZBemveW.exe
  2⤵
  PID:4304
- C:\Windows\System\hmQfuGm.exe
  C:\Windows\System\hmQfuGm.exe
  2⤵
  PID:4320
- C:\Windows\System\csJzTXZ.exe
  C:\Windows\System\csJzTXZ.exe
  2⤵
  PID:4336
- C:\Windows\System\jYTBGRO.exe
  C:\Windows\System\jYTBGRO.exe
  2⤵
  PID:4352
- C:\Windows\System\JLwnihT.exe
  C:\Windows\System\JLwnihT.exe
  2⤵
  PID:4368
- C:\Windows\System\CxuMWOf.exe
  C:\Windows\System\CxuMWOf.exe
  2⤵
  PID:4384
- C:\Windows\System\vxiBzgg.exe
  C:\Windows\System\vxiBzgg.exe
  2⤵
  PID:4400
- C:\Windows\System\ZKTKFnc.exe
  C:\Windows\System\ZKTKFnc.exe
  2⤵
  PID:4416
- C:\Windows\System\EqyLFcQ.exe
  C:\Windows\System\EqyLFcQ.exe
  2⤵
  PID:4432
- C:\Windows\System\ziUZFZB.exe
  C:\Windows\System\ziUZFZB.exe
  2⤵
  PID:4448
- C:\Windows\System\PELhrga.exe
  C:\Windows\System\PELhrga.exe
  2⤵
  PID:4464
- C:\Windows\System\CKlmlcw.exe
  C:\Windows\System\CKlmlcw.exe
  2⤵
  PID:4480
- C:\Windows\System\bVxEoYu.exe
  C:\Windows\System\bVxEoYu.exe
  2⤵
  PID:4496
- C:\Windows\System\rbHDWrx.exe
  C:\Windows\System\rbHDWrx.exe
  2⤵
  PID:4512
- C:\Windows\System\oakksfY.exe
  C:\Windows\System\oakksfY.exe
  2⤵
  PID:4528
- C:\Windows\System\RKBFvPP.exe
  C:\Windows\System\RKBFvPP.exe
  2⤵
  PID:4544
- C:\Windows\System\LQVsxIu.exe
  C:\Windows\System\LQVsxIu.exe
  2⤵
  PID:4560
- C:\Windows\System\TUxBWjN.exe
  C:\Windows\System\TUxBWjN.exe
  2⤵
  PID:4576
- C:\Windows\System\gdkules.exe
  C:\Windows\System\gdkules.exe
  2⤵
  PID:4592
- C:\Windows\System\knmalMZ.exe
  C:\Windows\System\knmalMZ.exe
  2⤵
  PID:4608
- C:\Windows\System\iXBdfyj.exe
  C:\Windows\System\iXBdfyj.exe
  2⤵
  PID:4624
- C:\Windows\System\QQOQYDY.exe
  C:\Windows\System\QQOQYDY.exe
  2⤵
  PID:4640
- C:\Windows\System\wiloIBz.exe
  C:\Windows\System\wiloIBz.exe
  2⤵
  PID:4656
- C:\Windows\System\tGDenWf.exe
  C:\Windows\System\tGDenWf.exe
  2⤵
  PID:4672
- C:\Windows\System\DKoUYBK.exe
  C:\Windows\System\DKoUYBK.exe
  2⤵
  PID:4688
- C:\Windows\System\kNflVjK.exe
  C:\Windows\System\kNflVjK.exe
  2⤵
  PID:4704
- C:\Windows\System\FHyjEON.exe
  C:\Windows\System\FHyjEON.exe
  2⤵
  PID:4720
- C:\Windows\System\DDRvGbV.exe
  C:\Windows\System\DDRvGbV.exe
  2⤵
  PID:4736
- C:\Windows\System\kMJprqq.exe
  C:\Windows\System\kMJprqq.exe
  2⤵
  PID:4752
- C:\Windows\System\DXsSNwa.exe
  C:\Windows\System\DXsSNwa.exe
  2⤵
  PID:4768
- C:\Windows\System\pBQjkHm.exe
  C:\Windows\System\pBQjkHm.exe
  2⤵
  PID:4784
- C:\Windows\System\usKiCQf.exe
  C:\Windows\System\usKiCQf.exe
  2⤵
  PID:4800
- C:\Windows\System\zXyjLBG.exe
  C:\Windows\System\zXyjLBG.exe
  2⤵
  PID:4816
- C:\Windows\System\Avozznv.exe
  C:\Windows\System\Avozznv.exe
  2⤵
  PID:4832
- C:\Windows\System\UgHzbJd.exe
  C:\Windows\System\UgHzbJd.exe
  2⤵
  PID:4848
- C:\Windows\System\NcsLXfw.exe
  C:\Windows\System\NcsLXfw.exe
  2⤵
  PID:4864
- C:\Windows\System\eqiyFcq.exe
  C:\Windows\System\eqiyFcq.exe
  2⤵
  PID:4880
- C:\Windows\System\DscKgAE.exe
  C:\Windows\System\DscKgAE.exe
  2⤵
  PID:4896
- C:\Windows\System\vzYtBdX.exe
  C:\Windows\System\vzYtBdX.exe
  2⤵
  PID:4912
- C:\Windows\System\DgYxPRp.exe
  C:\Windows\System\DgYxPRp.exe
  2⤵
  PID:4928
- C:\Windows\System\ZJQUPjh.exe
  C:\Windows\System\ZJQUPjh.exe
  2⤵
  PID:4944
- C:\Windows\System\HYYqkfH.exe
  C:\Windows\System\HYYqkfH.exe
  2⤵
  PID:4960
- C:\Windows\System\mAOVevY.exe
  C:\Windows\System\mAOVevY.exe
  2⤵
  PID:4976
- C:\Windows\System\KepTBwd.exe
  C:\Windows\System\KepTBwd.exe
  2⤵
  PID:4992
- C:\Windows\System\OsTpdWl.exe
  C:\Windows\System\OsTpdWl.exe
  2⤵
  PID:5008
- C:\Windows\System\fJWjcWy.exe
  C:\Windows\System\fJWjcWy.exe
  2⤵
  PID:5024
- C:\Windows\System\ZFGOpDL.exe
  C:\Windows\System\ZFGOpDL.exe
  2⤵
  PID:5040
- C:\Windows\System\kNBhSXc.exe
  C:\Windows\System\kNBhSXc.exe
  2⤵
  PID:5056
- C:\Windows\System\KlsnviL.exe
  C:\Windows\System\KlsnviL.exe
  2⤵
  PID:5072
- C:\Windows\System\FpNyYbH.exe
  C:\Windows\System\FpNyYbH.exe
  2⤵
  PID:5088
- C:\Windows\System\hMOxWyq.exe
  C:\Windows\System\hMOxWyq.exe
  2⤵
  PID:5104
- C:\Windows\System\xcrIMqK.exe
  C:\Windows\System\xcrIMqK.exe
  2⤵
  PID:2716
- C:\Windows\System\TVIYDrN.exe
  C:\Windows\System\TVIYDrN.exe
  2⤵
  PID:4104
- C:\Windows\System\qdjOfqp.exe
  C:\Windows\System\qdjOfqp.exe
  2⤵
  PID:4168
- C:\Windows\System\mQDcldJ.exe
  C:\Windows\System\mQDcldJ.exe
  2⤵
  PID:3988
- C:\Windows\System\mYGPTln.exe
  C:\Windows\System\mYGPTln.exe
  2⤵
  PID:4156
- C:\Windows\System\UwbvzKH.exe
  C:\Windows\System\UwbvzKH.exe
  2⤵
  PID:3220
- C:\Windows\System\HUpPOQU.exe
  C:\Windows\System\HUpPOQU.exe
  2⤵
  PID:4264
- C:\Windows\System\aCKKQJT.exe
  C:\Windows\System\aCKKQJT.exe
  2⤵
  PID:4248
- C:\Windows\System\uEXImjJ.exe
  C:\Windows\System\uEXImjJ.exe
  2⤵
  PID:4284
- C:\Windows\System\gJvcWhp.exe
  C:\Windows\System\gJvcWhp.exe
  2⤵
  PID:4332
- C:\Windows\System\YexREHX.exe
  C:\Windows\System\YexREHX.exe
  2⤵
  PID:4380
- C:\Windows\System\sKipTPT.exe
  C:\Windows\System\sKipTPT.exe
  2⤵
  PID:4348
- C:\Windows\System\LholGur.exe
  C:\Windows\System\LholGur.exe
  2⤵
  PID:4424
- C:\Windows\System\tkSSEfa.exe
  C:\Windows\System\tkSSEfa.exe
  2⤵
  PID:4460
- C:\Windows\System\UVUqXrh.exe
  C:\Windows\System\UVUqXrh.exe
  2⤵
  PID:4556
- C:\Windows\System\NcUFDyN.exe
  C:\Windows\System\NcUFDyN.exe
  2⤵
  PID:4476
- C:\Windows\System\fyQtrOy.exe
  C:\Windows\System\fyQtrOy.exe
  2⤵
  PID:4540
- C:\Windows\System\AANCLjr.exe
  C:\Windows\System\AANCLjr.exe
  2⤵
  PID:4584
- C:\Windows\System\HEAaMZn.exe
  C:\Windows\System\HEAaMZn.exe
  2⤵
  PID:4620
- C:\Windows\System\DhcrrfC.exe
  C:\Windows\System\DhcrrfC.exe
  2⤵
  PID:4652
- C:\Windows\System\dhYbpDx.exe
  C:\Windows\System\dhYbpDx.exe
  2⤵
  PID:4748
- C:\Windows\System\AQKnDTe.exe
  C:\Windows\System\AQKnDTe.exe
  2⤵
  PID:4664
- C:\Windows\System\gBEPNJq.exe
  C:\Windows\System\gBEPNJq.exe
  2⤵
  PID:4636
- C:\Windows\System\IlCXIjp.exe
  C:\Windows\System\IlCXIjp.exe
  2⤵
  PID:4872
- C:\Windows\System\crPHkrE.exe
  C:\Windows\System\crPHkrE.exe
  2⤵
  PID:4936
- C:\Windows\System\ISXUDKI.exe
  C:\Windows\System\ISXUDKI.exe
  2⤵
  PID:4700
- C:\Windows\System\qCgqOKm.exe
  C:\Windows\System\qCgqOKm.exe
  2⤵
  PID:4764
- C:\Windows\System\xjasinA.exe
  C:\Windows\System\xjasinA.exe
  2⤵
  PID:4828
- C:\Windows\System\mDsCAdb.exe
  C:\Windows\System\mDsCAdb.exe
  2⤵
  PID:4892
- C:\Windows\System\xPdmUjD.exe
  C:\Windows\System\xPdmUjD.exe
  2⤵
  PID:4952
- C:\Windows\System\jJbRJxh.exe
  C:\Windows\System\jJbRJxh.exe
  2⤵
  PID:5016
- C:\Windows\System\YwYtVSa.exe
  C:\Windows\System\YwYtVSa.exe
  2⤵
  PID:5000
- C:\Windows\System\rplBlLj.exe
  C:\Windows\System\rplBlLj.exe
  2⤵
  PID:5064
- C:\Windows\System\QTtGbmW.exe
  C:\Windows\System\QTtGbmW.exe
  2⤵
  PID:4204
- C:\Windows\System\AdTFmCb.exe
  C:\Windows\System\AdTFmCb.exe
  2⤵
  PID:4124
- C:\Windows\System\DkeixsM.exe
  C:\Windows\System\DkeixsM.exe
  2⤵
  PID:5112
- C:\Windows\System\dgvImQG.exe
  C:\Windows\System\dgvImQG.exe
  2⤵
  PID:4188
- C:\Windows\System\ywVrpzD.exe
  C:\Windows\System\ywVrpzD.exe
  2⤵
  PID:4220
- C:\Windows\System\dTyEEZN.exe
  C:\Windows\System\dTyEEZN.exe
  2⤵
  PID:4376
- C:\Windows\System\squpXBy.exe
  C:\Windows\System\squpXBy.exe
  2⤵
  PID:4472
- C:\Windows\System\qgESmVp.exe
  C:\Windows\System\qgESmVp.exe
  2⤵
  PID:4684
- C:\Windows\System\RaBHyss.exe
  C:\Windows\System\RaBHyss.exe
  2⤵
  PID:4844
- C:\Windows\System\jloGGsG.exe
  C:\Windows\System\jloGGsG.exe
  2⤵
  PID:4796
- C:\Windows\System\hrsGsaV.exe
  C:\Windows\System\hrsGsaV.exe
  2⤵
  PID:5048
- C:\Windows\System\pnqAxrZ.exe
  C:\Windows\System\pnqAxrZ.exe
  2⤵
  PID:5084
- C:\Windows\System\wsWuulW.exe
  C:\Windows\System\wsWuulW.exe
  2⤵
  PID:4456
- C:\Windows\System\wUpJnnX.exe
  C:\Windows\System\wUpJnnX.exe
  2⤵
  PID:5132
- C:\Windows\System\iZkiEFU.exe
  C:\Windows\System\iZkiEFU.exe
  2⤵
  PID:5148
- C:\Windows\System\pZKQMkn.exe
  C:\Windows\System\pZKQMkn.exe
  2⤵
  PID:5164
- C:\Windows\System\QvWbnjF.exe
  C:\Windows\System\QvWbnjF.exe
  2⤵
  PID:5180
- C:\Windows\System\ZUuNPVY.exe
  C:\Windows\System\ZUuNPVY.exe
  2⤵
  PID:5196
- C:\Windows\System\gBFtnrp.exe
  C:\Windows\System\gBFtnrp.exe
  2⤵
  PID:5212
- C:\Windows\System\LfTnrUI.exe
  C:\Windows\System\LfTnrUI.exe
  2⤵
  PID:5228
- C:\Windows\System\dnFtRSN.exe
  C:\Windows\System\dnFtRSN.exe
  2⤵
  PID:5244
- C:\Windows\System\QUqNElT.exe
  C:\Windows\System\QUqNElT.exe
  2⤵
  PID:5260
- C:\Windows\System\lYVaVxQ.exe
  C:\Windows\System\lYVaVxQ.exe
  2⤵
  PID:5276
- C:\Windows\System\cJOOhWB.exe
  C:\Windows\System\cJOOhWB.exe
  2⤵
  PID:5292
- C:\Windows\System\JYZcXFF.exe
  C:\Windows\System\JYZcXFF.exe
  2⤵
  PID:5308
- C:\Windows\System\YMcqUOV.exe
  C:\Windows\System\YMcqUOV.exe
  2⤵
  PID:5324
- C:\Windows\System\JqyKHnB.exe
  C:\Windows\System\JqyKHnB.exe
  2⤵
  PID:5340
- C:\Windows\System\mMJWBsy.exe
  C:\Windows\System\mMJWBsy.exe
  2⤵
  PID:5356
- C:\Windows\System\RCMcgXx.exe
  C:\Windows\System\RCMcgXx.exe
  2⤵
  PID:5372
- C:\Windows\System\YFKZedF.exe
  C:\Windows\System\YFKZedF.exe
  2⤵
  PID:5388
- C:\Windows\System\FIwyvEL.exe
  C:\Windows\System\FIwyvEL.exe
  2⤵
  PID:5404
- C:\Windows\System\fePjAjG.exe
  C:\Windows\System\fePjAjG.exe
  2⤵
  PID:5420
- C:\Windows\System\IhKSAsz.exe
  C:\Windows\System\IhKSAsz.exe
  2⤵
  PID:5436
- C:\Windows\System\DTfJOoJ.exe
  C:\Windows\System\DTfJOoJ.exe
  2⤵
  PID:5452
- C:\Windows\System\DorIHHt.exe
  C:\Windows\System\DorIHHt.exe
  2⤵
  PID:5468
- C:\Windows\System\VScmPtJ.exe
  C:\Windows\System\VScmPtJ.exe
  2⤵
  PID:5484
- C:\Windows\System\OzSLjlG.exe
  C:\Windows\System\OzSLjlG.exe
  2⤵
  PID:5500
- C:\Windows\System\PbmAOUn.exe
  C:\Windows\System\PbmAOUn.exe
  2⤵
  PID:5516
- C:\Windows\System\rMbImMB.exe
  C:\Windows\System\rMbImMB.exe
  2⤵
  PID:5532
- C:\Windows\System\SPxFYTy.exe
  C:\Windows\System\SPxFYTy.exe
  2⤵
  PID:5548
- C:\Windows\System\qFcmEag.exe
  C:\Windows\System\qFcmEag.exe
  2⤵
  PID:5564
- C:\Windows\System\SjahNzf.exe
  C:\Windows\System\SjahNzf.exe
  2⤵
  PID:5580
- C:\Windows\System\SUcdbSw.exe
  C:\Windows\System\SUcdbSw.exe
  2⤵
  PID:5596
- C:\Windows\System\IyZeEQH.exe
  C:\Windows\System\IyZeEQH.exe
  2⤵
  PID:5612
- C:\Windows\System\DzdTVAj.exe
  C:\Windows\System\DzdTVAj.exe
  2⤵
  PID:5628
- C:\Windows\System\yddzhXS.exe
  C:\Windows\System\yddzhXS.exe
  2⤵
  PID:5644
- C:\Windows\System\OSedezf.exe
  C:\Windows\System\OSedezf.exe
  2⤵
  PID:5660
- C:\Windows\System\aCISsTu.exe
  C:\Windows\System\aCISsTu.exe
  2⤵
  PID:5676
- C:\Windows\System\SRwjhMB.exe
  C:\Windows\System\SRwjhMB.exe
  2⤵
  PID:5692
- C:\Windows\System\NhFvdhM.exe
  C:\Windows\System\NhFvdhM.exe
  2⤵
  PID:5708
- C:\Windows\System\dEldzrU.exe
  C:\Windows\System\dEldzrU.exe
  2⤵
  PID:5724
- C:\Windows\System\NdmSWDj.exe
  C:\Windows\System\NdmSWDj.exe
  2⤵
  PID:5740
- C:\Windows\System\jOFcdPi.exe
  C:\Windows\System\jOFcdPi.exe
  2⤵
  PID:5756
- C:\Windows\System\uJKLCZe.exe
  C:\Windows\System\uJKLCZe.exe
  2⤵
  PID:5772
- C:\Windows\System\RfzHmRT.exe
  C:\Windows\System\RfzHmRT.exe
  2⤵
  PID:5788
- C:\Windows\System\QjkcKgM.exe
  C:\Windows\System\QjkcKgM.exe
  2⤵
  PID:5804
- C:\Windows\System\AJxdkcx.exe
  C:\Windows\System\AJxdkcx.exe
  2⤵
  PID:5820
- C:\Windows\System\qEaFCef.exe
  C:\Windows\System\qEaFCef.exe
  2⤵
  PID:5836
- C:\Windows\System\MHQwnnd.exe
  C:\Windows\System\MHQwnnd.exe
  2⤵
  PID:5852
- C:\Windows\System\OlQyiVz.exe
  C:\Windows\System\OlQyiVz.exe
  2⤵
  PID:5868
- C:\Windows\System\sFdxnzJ.exe
  C:\Windows\System\sFdxnzJ.exe
  2⤵
  PID:5884
- C:\Windows\System\osNGaWP.exe
  C:\Windows\System\osNGaWP.exe
  2⤵
  PID:5900
- C:\Windows\System\UpFvXye.exe
  C:\Windows\System\UpFvXye.exe
  2⤵
  PID:5916
- C:\Windows\System\IzqUgkq.exe
  C:\Windows\System\IzqUgkq.exe
  2⤵
  PID:5932
- C:\Windows\System\hQSgFRb.exe
  C:\Windows\System\hQSgFRb.exe
  2⤵
  PID:5948
- C:\Windows\System\mMGLXrv.exe
  C:\Windows\System\mMGLXrv.exe
  2⤵
  PID:5964
- C:\Windows\System\BRxENZp.exe
  C:\Windows\System\BRxENZp.exe
  2⤵
  PID:5980
- C:\Windows\System\DDKhHqH.exe
  C:\Windows\System\DDKhHqH.exe
  2⤵
  PID:5996
- C:\Windows\System\bWKKZCc.exe
  C:\Windows\System\bWKKZCc.exe
  2⤵
  PID:6012
- C:\Windows\System\BKJeVKo.exe
  C:\Windows\System\BKJeVKo.exe
  2⤵
  PID:6028
- C:\Windows\System\TzkGDjZ.exe
  C:\Windows\System\TzkGDjZ.exe
  2⤵
  PID:6044
- C:\Windows\System\vQyxnsD.exe
  C:\Windows\System\vQyxnsD.exe
  2⤵
  PID:6060
- C:\Windows\System\ptXswgB.exe
  C:\Windows\System\ptXswgB.exe
  2⤵
  PID:6076
- C:\Windows\System\LWCqfZs.exe
  C:\Windows\System\LWCqfZs.exe
  2⤵
  PID:6092
- C:\Windows\System\KUXdItY.exe
  C:\Windows\System\KUXdItY.exe
  2⤵
  PID:6108
- C:\Windows\System\XvQgNku.exe
  C:\Windows\System\XvQgNku.exe
  2⤵
  PID:6124
- C:\Windows\System\zgwsQBA.exe
  C:\Windows\System\zgwsQBA.exe
  2⤵
  PID:6140
- C:\Windows\System\lfytQvF.exe
  C:\Windows\System\lfytQvF.exe
  2⤵
  PID:4316
- C:\Windows\System\ebpHHAp.exe
  C:\Windows\System\ebpHHAp.exe
  2⤵
  PID:4492
- C:\Windows\System\WFUoEfu.exe
  C:\Windows\System\WFUoEfu.exe
  2⤵
  PID:4808
- C:\Windows\System\KVTpuGn.exe
  C:\Windows\System\KVTpuGn.exe
  2⤵
  PID:3756
- C:\Windows\System\Lbqcusa.exe
  C:\Windows\System\Lbqcusa.exe
  2⤵
  PID:5172
- C:\Windows\System\nWFdVtj.exe
  C:\Windows\System\nWFdVtj.exe
  2⤵
  PID:4120
- C:\Windows\System\eInfJRe.exe
  C:\Windows\System\eInfJRe.exe
  2⤵
  PID:4732
- C:\Windows\System\WAFJauP.exe
  C:\Windows\System\WAFJauP.exe
  2⤵
  PID:4604
- C:\Windows\System\FRyGnGW.exe
  C:\Windows\System\FRyGnGW.exe
  2⤵
  PID:5272
- C:\Windows\System\ElSRSWr.exe
  C:\Windows\System\ElSRSWr.exe
  2⤵
  PID:4888
- C:\Windows\System\JDXdCFZ.exe
  C:\Windows\System\JDXdCFZ.exe
  2⤵
  PID:5036
- C:\Windows\System\LhYRDWD.exe
  C:\Windows\System\LhYRDWD.exe
  2⤵
  PID:5304
- C:\Windows\System\wmkdric.exe
  C:\Windows\System\wmkdric.exe
  2⤵
  PID:4572
- C:\Windows\System\WSsnQQg.exe
  C:\Windows\System\WSsnQQg.exe
  2⤵
  PID:5068
- C:\Windows\System\ZgRILYG.exe
  C:\Windows\System\ZgRILYG.exe
  2⤵
  PID:5156
- C:\Windows\System\NKjIlyv.exe
  C:\Windows\System\NKjIlyv.exe
  2⤵
  PID:5188
- C:\Windows\System\ayZpVlh.exe
  C:\Windows\System\ayZpVlh.exe
  2⤵
  PID:5252
- C:\Windows\System\hdYcSoj.exe
  C:\Windows\System\hdYcSoj.exe
  2⤵
  PID:5316
- C:\Windows\System\HLujbQY.exe
  C:\Windows\System\HLujbQY.exe
  2⤵
  PID:5380
- C:\Windows\System\ZKRKXtI.exe
  C:\Windows\System\ZKRKXtI.exe
  2⤵
  PID:5400
- C:\Windows\System\tYxlFPi.exe
  C:\Windows\System\tYxlFPi.exe
  2⤵
  PID:5412
- C:\Windows\System\NKeMZib.exe
  C:\Windows\System\NKeMZib.exe
  2⤵
  PID:5464
- C:\Windows\System\UOeAQHu.exe
  C:\Windows\System\UOeAQHu.exe
  2⤵
  PID:5528
- C:\Windows\System\CkIGUka.exe
  C:\Windows\System\CkIGUka.exe
  2⤵
  PID:5560
- C:\Windows\System\nrYyUPc.exe
  C:\Windows\System\nrYyUPc.exe
  2⤵
  PID:5624
- C:\Windows\System\PjdrKGp.exe
  C:\Windows\System\PjdrKGp.exe
  2⤵
  PID:5688
- C:\Windows\System\ccqamhH.exe
  C:\Windows\System\ccqamhH.exe
  2⤵
  PID:5780
- C:\Windows\System\tLuRUSi.exe
  C:\Windows\System\tLuRUSi.exe
  2⤵
  PID:5508
- C:\Windows\System\GMKOSta.exe
  C:\Windows\System\GMKOSta.exe
  2⤵
  PID:5576
- C:\Windows\System\KUQwXzZ.exe
  C:\Windows\System\KUQwXzZ.exe
  2⤵
  PID:5640
- C:\Windows\System\AheKkFR.exe
  C:\Windows\System\AheKkFR.exe
  2⤵
  PID:5704
- C:\Windows\System\bEuvhLc.exe
  C:\Windows\System\bEuvhLc.exe
  2⤵
  PID:5768
- C:\Windows\System\YLWSxfK.exe
  C:\Windows\System\YLWSxfK.exe
  2⤵
  PID:5832
- C:\Windows\System\jsSjNIv.exe
  C:\Windows\System\jsSjNIv.exe
  2⤵
  PID:5812
- C:\Windows\System\eSiqsuI.exe
  C:\Windows\System\eSiqsuI.exe
  2⤵
  PID:5848
- C:\Windows\System\IUTnltL.exe
  C:\Windows\System\IUTnltL.exe
  2⤵
  PID:5908
- C:\Windows\System\UWItiWi.exe
  C:\Windows\System\UWItiWi.exe
  2⤵
  PID:5924
- C:\Windows\System\dCpnbBm.exe
  C:\Windows\System\dCpnbBm.exe
  2⤵
  PID:6004
- C:\Windows\System\MGYPBFF.exe
  C:\Windows\System\MGYPBFF.exe
  2⤵
  PID:6040
- C:\Windows\System\DCusuot.exe
  C:\Windows\System\DCusuot.exe
  2⤵
  PID:6104
- C:\Windows\System\yqzJhro.exe
  C:\Windows\System\yqzJhro.exe
  2⤵
  PID:5988
- C:\Windows\System\FyLRixL.exe
  C:\Windows\System\FyLRixL.exe
  2⤵
  PID:4924
- C:\Windows\System\VTnBINx.exe
  C:\Windows\System\VTnBINx.exe
  2⤵
  PID:4268
- C:\Windows\System\ZNARCRU.exe
  C:\Windows\System\ZNARCRU.exe
  2⤵
  PID:4536
- C:\Windows\System\QNghJLd.exe
  C:\Windows\System\QNghJLd.exe
  2⤵
  PID:6056
- C:\Windows\System\UngZQpf.exe
  C:\Windows\System\UngZQpf.exe
  2⤵
  PID:6120
- C:\Windows\System\OMYkiRl.exe
  C:\Windows\System\OMYkiRl.exe
  2⤵
  PID:4716
- C:\Windows\System\xLajuEc.exe
  C:\Windows\System\xLajuEc.exe
  2⤵
  PID:5100
- C:\Windows\System\ovPGMqh.exe
  C:\Windows\System\ovPGMqh.exe
  2⤵
  PID:5336
- C:\Windows\System\oLTKWcV.exe
  C:\Windows\System\oLTKWcV.exe
  2⤵
  PID:5368
- C:\Windows\System\ePbgwmi.exe
  C:\Windows\System\ePbgwmi.exe
  2⤵
  PID:5512
- C:\Windows\System\GVvJRjD.exe
  C:\Windows\System\GVvJRjD.exe
  2⤵
  PID:5476
- C:\Windows\System\BmMUTks.exe
  C:\Windows\System\BmMUTks.exe
  2⤵
  PID:5764
- C:\Windows\System\PxAHwKb.exe
  C:\Windows\System\PxAHwKb.exe
  2⤵
  PID:5880
- C:\Windows\System\iEfHJiT.exe
  C:\Windows\System\iEfHJiT.exe
  2⤵
  PID:6072
- C:\Windows\System\xsJeijW.exe
  C:\Windows\System\xsJeijW.exe
  2⤵
  PID:6024
- C:\Windows\System\gnVtXid.exe
  C:\Windows\System\gnVtXid.exe
  2⤵
  PID:6152
- C:\Windows\System\RcqMytX.exe
  C:\Windows\System\RcqMytX.exe
  2⤵
  PID:6168
- C:\Windows\System\GrqkPjc.exe
  C:\Windows\System\GrqkPjc.exe
  2⤵
  PID:6184
- C:\Windows\System\dFxiTMU.exe
  C:\Windows\System\dFxiTMU.exe
  2⤵
  PID:6200
- C:\Windows\System\aOzzHQu.exe
  C:\Windows\System\aOzzHQu.exe
  2⤵
  PID:6216
- C:\Windows\System\YslJsmr.exe
  C:\Windows\System\YslJsmr.exe
  2⤵
  PID:6232
- C:\Windows\System\JshTIVC.exe
  C:\Windows\System\JshTIVC.exe
  2⤵
  PID:6248
- C:\Windows\System\Pbkzbbl.exe
  C:\Windows\System\Pbkzbbl.exe
  2⤵
  PID:6264
- C:\Windows\System\NrPPveS.exe
  C:\Windows\System\NrPPveS.exe
  2⤵
  PID:6280
- C:\Windows\System\DmOioid.exe
  C:\Windows\System\DmOioid.exe
  2⤵
  PID:6296
- C:\Windows\System\NwnAsmF.exe
  C:\Windows\System\NwnAsmF.exe
  2⤵
  PID:6312
- C:\Windows\System\cMASDcQ.exe
  C:\Windows\System\cMASDcQ.exe
  2⤵
  PID:6328
- C:\Windows\System\gaYossM.exe
  C:\Windows\System\gaYossM.exe
  2⤵
  PID:6344
- C:\Windows\System\XeUqWpW.exe
  C:\Windows\System\XeUqWpW.exe
  2⤵
  PID:6360
- C:\Windows\System\WFYdNdL.exe
  C:\Windows\System\WFYdNdL.exe
  2⤵
  PID:6376
- C:\Windows\System\ZoIpnQF.exe
  C:\Windows\System\ZoIpnQF.exe
  2⤵
  PID:6392
- C:\Windows\System\qKyFTOX.exe
  C:\Windows\System\qKyFTOX.exe
  2⤵
  PID:6408
- C:\Windows\System\yfjvFrh.exe
  C:\Windows\System\yfjvFrh.exe
  2⤵
  PID:6424
- C:\Windows\System\HLpMJZe.exe
  C:\Windows\System\HLpMJZe.exe
  2⤵
  PID:6440
- C:\Windows\System\dgrEITI.exe
  C:\Windows\System\dgrEITI.exe
  2⤵
  PID:6456
- C:\Windows\System\hjWkzgx.exe
  C:\Windows\System\hjWkzgx.exe
  2⤵
  PID:6472
- C:\Windows\System\dpGjFiY.exe
  C:\Windows\System\dpGjFiY.exe
  2⤵
  PID:6488
- C:\Windows\System\rKKFJcK.exe
  C:\Windows\System\rKKFJcK.exe
  2⤵
  PID:6504
- C:\Windows\System\rBAhlaS.exe
  C:\Windows\System\rBAhlaS.exe
  2⤵
  PID:6520
- C:\Windows\System\swwQXxz.exe
  C:\Windows\System\swwQXxz.exe
  2⤵
  PID:6536
- C:\Windows\System\MPodiUZ.exe
  C:\Windows\System\MPodiUZ.exe
  2⤵
  PID:6552
- C:\Windows\System\UXIyGLR.exe
  C:\Windows\System\UXIyGLR.exe
  2⤵
  PID:6568
- C:\Windows\System\KtEErgb.exe
  C:\Windows\System\KtEErgb.exe
  2⤵
  PID:6584
- C:\Windows\System\VQXNvDj.exe
  C:\Windows\System\VQXNvDj.exe
  2⤵
  PID:6600
- C:\Windows\System\YonQXGJ.exe
  C:\Windows\System\YonQXGJ.exe
  2⤵
  PID:6616
- C:\Windows\System\ufprYCl.exe
  C:\Windows\System\ufprYCl.exe
  2⤵
  PID:6632
- C:\Windows\System\HtgWHBC.exe
  C:\Windows\System\HtgWHBC.exe
  2⤵
  PID:6648
- C:\Windows\System\ikmbzQJ.exe
  C:\Windows\System\ikmbzQJ.exe
  2⤵
  PID:6664
- C:\Windows\System\YvPVfTo.exe
  C:\Windows\System\YvPVfTo.exe
  2⤵
  PID:6680
- C:\Windows\System\UVJXobu.exe
  C:\Windows\System\UVJXobu.exe
  2⤵
  PID:6696
- C:\Windows\System\zFQbmKa.exe
  C:\Windows\System\zFQbmKa.exe
  2⤵
  PID:6712
- C:\Windows\System\vgtOGIX.exe
  C:\Windows\System\vgtOGIX.exe
  2⤵
  PID:6728
- C:\Windows\System\wgrgjEr.exe
  C:\Windows\System\wgrgjEr.exe
  2⤵
  PID:6744
- C:\Windows\System\UJEDZRW.exe
  C:\Windows\System\UJEDZRW.exe
  2⤵
  PID:6760
- C:\Windows\System\sReYRTj.exe
  C:\Windows\System\sReYRTj.exe
  2⤵
  PID:6776
- C:\Windows\System\aJBbzBc.exe
  C:\Windows\System\aJBbzBc.exe
  2⤵
  PID:6792
- C:\Windows\System\TgaIvsq.exe
  C:\Windows\System\TgaIvsq.exe
  2⤵
  PID:6816
- C:\Windows\System\HJPzkSK.exe
  C:\Windows\System\HJPzkSK.exe
  2⤵
  PID:6832
- C:\Windows\System\GrCFfED.exe
  C:\Windows\System\GrCFfED.exe
  2⤵
  PID:6848
- C:\Windows\System\KGaKyNQ.exe
  C:\Windows\System\KGaKyNQ.exe
  2⤵
  PID:6864
- C:\Windows\System\aELtzLu.exe
  C:\Windows\System\aELtzLu.exe
  2⤵
  PID:6880
- C:\Windows\System\vxveOXZ.exe
  C:\Windows\System\vxveOXZ.exe
  2⤵
  PID:6896
- C:\Windows\System\YNCBPmK.exe
  C:\Windows\System\YNCBPmK.exe
  2⤵
  PID:6912
- C:\Windows\System\XVuSWtF.exe
  C:\Windows\System\XVuSWtF.exe
  2⤵
  PID:6928
- C:\Windows\System\ZGpebFd.exe
  C:\Windows\System\ZGpebFd.exe
  2⤵
  PID:6944
- C:\Windows\System\EdVSqwW.exe
  C:\Windows\System\EdVSqwW.exe
  2⤵
  PID:6960
- C:\Windows\System\gyXImWq.exe
  C:\Windows\System\gyXImWq.exe
  2⤵
  PID:6976
- C:\Windows\System\kGUckBP.exe
  C:\Windows\System\kGUckBP.exe
  2⤵
  PID:6992
- C:\Windows\System\GximBsd.exe
  C:\Windows\System\GximBsd.exe
  2⤵
  PID:7008
- C:\Windows\System\WUKssYZ.exe
  C:\Windows\System\WUKssYZ.exe
  2⤵
  PID:7024
- C:\Windows\System\UXPKMfj.exe
  C:\Windows\System\UXPKMfj.exe
  2⤵
  PID:7040
- C:\Windows\System\rwuwYFZ.exe
  C:\Windows\System\rwuwYFZ.exe
  2⤵
  PID:7056
- C:\Windows\System\LlNUjKj.exe
  C:\Windows\System\LlNUjKj.exe
  2⤵
  PID:7072
- C:\Windows\System\CDFbKhm.exe
  C:\Windows\System\CDFbKhm.exe
  2⤵
  PID:7088
- C:\Windows\System\GEJRysy.exe
  C:\Windows\System\GEJRysy.exe
  2⤵
  PID:7104
- C:\Windows\System\JANaEDu.exe
  C:\Windows\System\JANaEDu.exe
  2⤵
  PID:7120
- C:\Windows\System\UAsZoVV.exe
  C:\Windows\System\UAsZoVV.exe
  2⤵
  PID:7136
- C:\Windows\System\opAwBaq.exe
  C:\Windows\System\opAwBaq.exe
  2⤵
  PID:7152
- C:\Windows\System\pUilpEd.exe
  C:\Windows\System\pUilpEd.exe
  2⤵
  PID:6116
- C:\Windows\System\gJmnfRU.exe
  C:\Windows\System\gJmnfRU.exe
  2⤵
  PID:5720
- C:\Windows\System\HDQZqCr.exe
  C:\Windows\System\HDQZqCr.exe
  2⤵
  PID:5800
- C:\Windows\System\iNBfiAL.exe
  C:\Windows\System\iNBfiAL.exe
  2⤵
  PID:5892
- C:\Windows\System\JHXPDXh.exe
  C:\Windows\System\JHXPDXh.exe
  2⤵
  PID:6160
- C:\Windows\System\uhTvPjp.exe
  C:\Windows\System\uhTvPjp.exe
  2⤵
  PID:4908
- C:\Windows\System\lAFdwhf.exe
  C:\Windows\System\lAFdwhf.exe
  2⤵
  PID:4412
- C:\Windows\System\bbIPrpI.exe
  C:\Windows\System\bbIPrpI.exe
  2⤵
  PID:5220
- C:\Windows\System\pOrSFhM.exe
  C:\Windows\System\pOrSFhM.exe
  2⤵
  PID:5432
- C:\Windows\System\AwSfEwC.exe
  C:\Windows\System\AwSfEwC.exe
  2⤵
  PID:5524
- C:\Windows\System\vmpUugb.exe
  C:\Windows\System\vmpUugb.exe
  2⤵
  PID:5620
- C:\Windows\System\ZfNVkSm.exe
  C:\Windows\System\ZfNVkSm.exe
  2⤵
  PID:5672
- C:\Windows\System\CsSYJJH.exe
  C:\Windows\System\CsSYJJH.exe
  2⤵
  PID:6292
- C:\Windows\System\uLdMTBC.exe
  C:\Windows\System\uLdMTBC.exe
  2⤵
  PID:5896
- C:\Windows\System\xZdugaN.exe
  C:\Windows\System\xZdugaN.exe
  2⤵
  PID:6324
- C:\Windows\System\pkZhTIq.exe
  C:\Windows\System\pkZhTIq.exe
  2⤵
  PID:5960
- C:\Windows\System\VzJCAeI.exe
  C:\Windows\System\VzJCAeI.exe
  2⤵
  PID:5268
- C:\Windows\System\eNjbgNU.exe
  C:\Windows\System\eNjbgNU.exe
  2⤵
  PID:5608
- C:\Windows\System\UNxuZuN.exe
  C:\Windows\System\UNxuZuN.exe
  2⤵
  PID:6148
- C:\Windows\System\XvHsdis.exe
  C:\Windows\System\XvHsdis.exe
  2⤵
  PID:6212
- C:\Windows\System\DEehLqv.exe
  C:\Windows\System\DEehLqv.exe
  2⤵
  PID:6276
- C:\Windows\System\jfYoNbd.exe
  C:\Windows\System\jfYoNbd.exe
  2⤵
  PID:6340
- C:\Windows\System\qfKYRWA.exe
  C:\Windows\System\qfKYRWA.exe
  2⤵
  PID:6384
- C:\Windows\System\UlfcaGX.exe
  C:\Windows\System\UlfcaGX.exe
  2⤵
  PID:6372
- C:\Windows\System\angOBHO.exe
  C:\Windows\System\angOBHO.exe
  2⤵
  PID:6436
- C:\Windows\System\BjrRyYp.exe
  C:\Windows\System\BjrRyYp.exe
  2⤵
  PID:6500
- C:\Windows\System\fGYEkIm.exe
  C:\Windows\System\fGYEkIm.exe
  2⤵
  PID:6564
- C:\Windows\System\qajGduY.exe
  C:\Windows\System\qajGduY.exe
  2⤵
  PID:6624
- C:\Windows\System\SMYQlLZ.exe
  C:\Windows\System\SMYQlLZ.exe
  2⤵
  PID:6576
- C:\Windows\System\OPXYpgl.exe
  C:\Windows\System\OPXYpgl.exe
  2⤵
  PID:6452
- C:\Windows\System\adDVAXI.exe
  C:\Windows\System\adDVAXI.exe
  2⤵
  PID:6640
- C:\Windows\System\wlgpoPH.exe
  C:\Windows\System\wlgpoPH.exe
  2⤵
  PID:6704
- C:\Windows\System\aJztzXH.exe
  C:\Windows\System\aJztzXH.exe
  2⤵
  PID:6656
- C:\Windows\System\JixSIpn.exe
  C:\Windows\System\JixSIpn.exe
  2⤵
  PID:6720
- C:\Windows\System\boKtmAe.exe
  C:\Windows\System\boKtmAe.exe
  2⤵
  PID:6768
- C:\Windows\System\FBrdNHs.exe
  C:\Windows\System\FBrdNHs.exe
  2⤵
  PID:6828
- C:\Windows\System\QtTaukp.exe
  C:\Windows\System\QtTaukp.exe
  2⤵
  PID:6892
- C:\Windows\System\qnuDekg.exe
  C:\Windows\System\qnuDekg.exe
  2⤵
  PID:6956
- C:\Windows\System\HHQHiPt.exe
  C:\Windows\System\HHQHiPt.exe
  2⤵
  PID:7020
- C:\Windows\System\fifbUMC.exe
  C:\Windows\System\fifbUMC.exe
  2⤵
  PID:7084
- C:\Windows\System\jxdJtNF.exe
  C:\Windows\System\jxdJtNF.exe
  2⤵
  PID:7148
- C:\Windows\System\TxvbmPd.exe
  C:\Windows\System\TxvbmPd.exe
  2⤵
  PID:4904
- C:\Windows\System\HQPKOnM.exe
  C:\Windows\System\HQPKOnM.exe
  2⤵
  PID:5956
- C:\Windows\System\iHffAbI.exe
  C:\Windows\System\iHffAbI.exe
  2⤵
  PID:6256
- C:\Windows\System\DMLgiPV.exe
  C:\Windows\System\DMLgiPV.exe
  2⤵
  PID:6136
- C:\Windows\System\AVjUWsb.exe
  C:\Windows\System\AVjUWsb.exe
  2⤵
  PID:6784
- C:\Windows\System\MUnEqvN.exe
  C:\Windows\System\MUnEqvN.exe
  2⤵
  PID:6308
- C:\Windows\System\mIqrUIn.exe
  C:\Windows\System\mIqrUIn.exe
  2⤵
  PID:6528
- C:\Windows\System\IIVZHJX.exe
  C:\Windows\System\IIVZHJX.exe
  2⤵
  PID:6352
- C:\Windows\System\LMJEUps.exe
  C:\Windows\System\LMJEUps.exe
  2⤵
  PID:6840
- C:\Windows\System\JMfMOoX.exe
  C:\Windows\System\JMfMOoX.exe
  2⤵
  PID:6904
- C:\Windows\System\ZDGYrII.exe
  C:\Windows\System\ZDGYrII.exe
  2⤵
  PID:6968
- C:\Windows\System\YcYUwpH.exe
  C:\Windows\System\YcYUwpH.exe
  2⤵
  PID:7032
- C:\Windows\System\VBOQDBT.exe
  C:\Windows\System\VBOQDBT.exe
  2⤵
  PID:7096
- C:\Windows\System\JDIitIn.exe
  C:\Windows\System\JDIitIn.exe
  2⤵
  PID:7160
- C:\Windows\System\yhfyPGI.exe
  C:\Windows\System\yhfyPGI.exe
  2⤵
  PID:4392
- C:\Windows\System\ojidlKj.exe
  C:\Windows\System\ojidlKj.exe
  2⤵
  PID:5348
- C:\Windows\System\GCmzWYn.exe
  C:\Windows\System\GCmzWYn.exe
  2⤵
  PID:6260
- C:\Windows\System\iBUQayz.exe
  C:\Windows\System\iBUQayz.exe
  2⤵
  PID:5144
- C:\Windows\System\MGyjVCf.exe
  C:\Windows\System\MGyjVCf.exe
  2⤵
  PID:6244
- C:\Windows\System\GITagpn.exe
  C:\Windows\System\GITagpn.exe
  2⤵
  PID:6676
- C:\Windows\System\XBUMszM.exe
  C:\Windows\System\XBUMszM.exe
  2⤵
  PID:6824
- C:\Windows\System\ajcXnlk.exe
  C:\Windows\System\ajcXnlk.exe
  2⤵
  PID:7080
- C:\Windows\System\Vkpyiwv.exe
  C:\Windows\System\Vkpyiwv.exe
  2⤵
  PID:6548
- C:\Windows\System\LLjNxeo.exe
  C:\Windows\System\LLjNxeo.exe
  2⤵
  PID:6404
- C:\Windows\System\DTzrpQq.exe
  C:\Windows\System\DTzrpQq.exe
  2⤵
  PID:5496
- C:\Windows\System\JrjEPWW.exe
  C:\Windows\System\JrjEPWW.exe
  2⤵
  PID:7116
- C:\Windows\System\hPSbRjS.exe
  C:\Windows\System\hPSbRjS.exe
  2⤵
  PID:6468
- C:\Windows\System\AtPKxBa.exe
  C:\Windows\System\AtPKxBa.exe
  2⤵
  PID:6936
- C:\Windows\System\AApMbkQ.exe
  C:\Windows\System\AApMbkQ.exe
  2⤵
  PID:7016
- C:\Windows\System\PeoofgU.exe
  C:\Windows\System\PeoofgU.exe
  2⤵
  PID:5288
- C:\Windows\System\dGfypQp.exe
  C:\Windows\System\dGfypQp.exe
  2⤵
  PID:5128
- C:\Windows\System\lPhByxD.exe
  C:\Windows\System\lPhByxD.exe
  2⤵
  PID:6608
- C:\Windows\System\XqNSudo.exe
  C:\Windows\System\XqNSudo.exe
  2⤵
  PID:7000
- C:\Windows\System\rPUHycQ.exe
  C:\Windows\System\rPUHycQ.exe
  2⤵
  PID:5032
- C:\Windows\System\bAKuToX.exe
  C:\Windows\System\bAKuToX.exe
  2⤵
  PID:4328
- C:\Windows\System\nKcVNVl.exe
  C:\Windows\System\nKcVNVl.exe
  2⤵
  PID:6800
- C:\Windows\System\lTxEczR.exe
  C:\Windows\System\lTxEczR.exe
  2⤵
  PID:6592
- C:\Windows\System\MXxnMQK.exe
  C:\Windows\System\MXxnMQK.exe
  2⤵
  PID:5592
- C:\Windows\System\rsHfKDY.exe
  C:\Windows\System\rsHfKDY.exe
  2⤵
  PID:6860
- C:\Windows\System\UZFvwez.exe
  C:\Windows\System\UZFvwez.exe
  2⤵
  PID:6196
- C:\Windows\System\WZUyLPC.exe
  C:\Windows\System\WZUyLPC.exe
  2⤵
  PID:5976
- C:\Windows\System\JKfwLBP.exe
  C:\Windows\System\JKfwLBP.exe
  2⤵
  PID:6812
- C:\Windows\System\pPPToBi.exe
  C:\Windows\System\pPPToBi.exe
  2⤵
  PID:5572
- C:\Windows\System\YoTgMdZ.exe
  C:\Windows\System\YoTgMdZ.exe
  2⤵
  PID:7128
- C:\Windows\System\XWQIYHj.exe
  C:\Windows\System\XWQIYHj.exe
  2⤵
  PID:6876
- C:\Windows\System\IpcRpmN.exe
  C:\Windows\System\IpcRpmN.exe
  2⤵
  PID:5940
- C:\Windows\System\uoCOEYk.exe
  C:\Windows\System\uoCOEYk.exe
  2⤵
  PID:7172
- C:\Windows\System\vwGvgRS.exe
  C:\Windows\System\vwGvgRS.exe
  2⤵
  PID:7188
- C:\Windows\System\SkXIypM.exe
  C:\Windows\System\SkXIypM.exe
  2⤵
  PID:7204
- C:\Windows\System\WHhtDGO.exe
  C:\Windows\System\WHhtDGO.exe
  2⤵
  PID:7220
- C:\Windows\System\DNiyDrX.exe
  C:\Windows\System\DNiyDrX.exe
  2⤵
  PID:7236
- C:\Windows\System\OFhiIVt.exe
  C:\Windows\System\OFhiIVt.exe
  2⤵
  PID:7252
- C:\Windows\System\JJRcXOv.exe
  C:\Windows\System\JJRcXOv.exe
  2⤵
  PID:7268
- C:\Windows\System\AZihkFT.exe
  C:\Windows\System\AZihkFT.exe
  2⤵
  PID:7284
- C:\Windows\System\JcMQnLY.exe
  C:\Windows\System\JcMQnLY.exe
  2⤵
  PID:7300
- C:\Windows\System\LEdxuiR.exe
  C:\Windows\System\LEdxuiR.exe
  2⤵
  PID:7316
- C:\Windows\System\YdMTrFV.exe
  C:\Windows\System\YdMTrFV.exe
  2⤵
  PID:7332
- C:\Windows\System\LGxHuHG.exe
  C:\Windows\System\LGxHuHG.exe
  2⤵
  PID:7348
- C:\Windows\System\MoMmmws.exe
  C:\Windows\System\MoMmmws.exe
  2⤵
  PID:7364
- C:\Windows\System\tqLIymn.exe
  C:\Windows\System\tqLIymn.exe
  2⤵
  PID:7380
- C:\Windows\System\rxpPZSG.exe
  C:\Windows\System\rxpPZSG.exe
  2⤵
  PID:7396
- C:\Windows\System\oFJzFHM.exe
  C:\Windows\System\oFJzFHM.exe
  2⤵
  PID:7412
- C:\Windows\System\bACpkDw.exe
  C:\Windows\System\bACpkDw.exe
  2⤵
  PID:7428
- C:\Windows\System\joamUrR.exe
  C:\Windows\System\joamUrR.exe
  2⤵
  PID:7444
- C:\Windows\System\kVjcbnI.exe
  C:\Windows\System\kVjcbnI.exe
  2⤵
  PID:7460
- C:\Windows\System\fqMPzdg.exe
  C:\Windows\System\fqMPzdg.exe
  2⤵
  PID:7476
- C:\Windows\System\fwZwbFA.exe
  C:\Windows\System\fwZwbFA.exe
  2⤵
  PID:7492
- C:\Windows\System\gOLuzlf.exe
  C:\Windows\System\gOLuzlf.exe
  2⤵
  PID:7508
- C:\Windows\System\RviKCpW.exe
  C:\Windows\System\RviKCpW.exe
  2⤵
  PID:7524
- C:\Windows\System\EYnXcvi.exe
  C:\Windows\System\EYnXcvi.exe
  2⤵
  PID:7540
- C:\Windows\System\kEKGUIQ.exe
  C:\Windows\System\kEKGUIQ.exe
  2⤵
  PID:7556
- C:\Windows\System\JKaGzBZ.exe
  C:\Windows\System\JKaGzBZ.exe
  2⤵
  PID:7572
- C:\Windows\System\SdoJgRO.exe
  C:\Windows\System\SdoJgRO.exe
  2⤵
  PID:7588
- C:\Windows\System\IChZDXm.exe
  C:\Windows\System\IChZDXm.exe
  2⤵
  PID:7604
- C:\Windows\System\nDdFwhr.exe
  C:\Windows\System\nDdFwhr.exe
  2⤵
  PID:7620
- C:\Windows\System\jDoCPje.exe
  C:\Windows\System\jDoCPje.exe
  2⤵
  PID:7636
- C:\Windows\System\cYwkxlP.exe
  C:\Windows\System\cYwkxlP.exe
  2⤵
  PID:7652
- C:\Windows\System\rwHfFZT.exe
  C:\Windows\System\rwHfFZT.exe
  2⤵
  PID:7668
- C:\Windows\System\RnKaoHe.exe
  C:\Windows\System\RnKaoHe.exe
  2⤵
  PID:7684
- C:\Windows\System\meEkPjb.exe
  C:\Windows\System\meEkPjb.exe
  2⤵
  PID:7700
- C:\Windows\System\JVfCRxQ.exe
  C:\Windows\System\JVfCRxQ.exe
  2⤵
  PID:7716
- C:\Windows\System\cGQCCWm.exe
  C:\Windows\System\cGQCCWm.exe
  2⤵
  PID:7732
- C:\Windows\System\zfunvvc.exe
  C:\Windows\System\zfunvvc.exe
  2⤵
  PID:7748
- C:\Windows\System\mJuNtEP.exe
  C:\Windows\System\mJuNtEP.exe
  2⤵
  PID:7764
- C:\Windows\System\zhCmvoq.exe
  C:\Windows\System\zhCmvoq.exe
  2⤵
  PID:7780
- C:\Windows\System\yIlaReE.exe
  C:\Windows\System\yIlaReE.exe
  2⤵
  PID:7796
- C:\Windows\System\rfkLKOf.exe
  C:\Windows\System\rfkLKOf.exe
  2⤵
  PID:7812
- C:\Windows\System\SWGxUOk.exe
  C:\Windows\System\SWGxUOk.exe
  2⤵
  PID:7828
- C:\Windows\System\tPFhwZP.exe
  C:\Windows\System\tPFhwZP.exe
  2⤵
  PID:7844
- C:\Windows\System\qjzFyVf.exe
  C:\Windows\System\qjzFyVf.exe
  2⤵
  PID:7860
- C:\Windows\System\AbGqcmi.exe
  C:\Windows\System\AbGqcmi.exe
  2⤵
  PID:7876
- C:\Windows\System\ThPDVeV.exe
  C:\Windows\System\ThPDVeV.exe
  2⤵
  PID:7892
- C:\Windows\System\LBWluic.exe
  C:\Windows\System\LBWluic.exe
  2⤵
  PID:7908
- C:\Windows\System\OgKEVQi.exe
  C:\Windows\System\OgKEVQi.exe
  2⤵
  PID:7924
- C:\Windows\System\VnKHIqE.exe
  C:\Windows\System\VnKHIqE.exe
  2⤵
  PID:7940
- C:\Windows\System\WQyoLmX.exe
  C:\Windows\System\WQyoLmX.exe
  2⤵
  PID:7956
- C:\Windows\System\uWoWONF.exe
  C:\Windows\System\uWoWONF.exe
  2⤵
  PID:7972
- C:\Windows\System\ihjBwYo.exe
  C:\Windows\System\ihjBwYo.exe
  2⤵
  PID:7988
- C:\Windows\System\bhWjquA.exe
  C:\Windows\System\bhWjquA.exe
  2⤵
  PID:8004
- C:\Windows\System\XcEYHZS.exe
  C:\Windows\System\XcEYHZS.exe
  2⤵
  PID:8020
- C:\Windows\System\LrgcGGB.exe
  C:\Windows\System\LrgcGGB.exe
  2⤵
  PID:8036
- C:\Windows\System\NcsHpYW.exe
  C:\Windows\System\NcsHpYW.exe
  2⤵
  PID:8052
- C:\Windows\System\VFRziBl.exe
  C:\Windows\System\VFRziBl.exe
  2⤵
  PID:8068
- C:\Windows\System\jCgcUPz.exe
  C:\Windows\System\jCgcUPz.exe
  2⤵
  PID:8084
- C:\Windows\System\RvykUcE.exe
  C:\Windows\System\RvykUcE.exe
  2⤵
  PID:8100
- C:\Windows\System\uXuPbmA.exe
  C:\Windows\System\uXuPbmA.exe
  2⤵
  PID:8116
- C:\Windows\System\gpFTKQJ.exe
  C:\Windows\System\gpFTKQJ.exe
  2⤵
  PID:8132
- C:\Windows\System\xGguOvC.exe
  C:\Windows\System\xGguOvC.exe
  2⤵
  PID:8148
- C:\Windows\System\tICzmwx.exe
  C:\Windows\System\tICzmwx.exe
  2⤵
  PID:8164
- C:\Windows\System\cdJqBkT.exe
  C:\Windows\System\cdJqBkT.exe
  2⤵
  PID:8180
- C:\Windows\System\TdwVTZH.exe
  C:\Windows\System\TdwVTZH.exe
  2⤵
  PID:7196
- C:\Windows\System\OJbcskr.exe
  C:\Windows\System\OJbcskr.exe
  2⤵
  PID:6496
- C:\Windows\System\jdUloyj.exe
  C:\Windows\System\jdUloyj.exe
  2⤵
  PID:6036
- C:\Windows\System\MUPogPs.exe
  C:\Windows\System\MUPogPs.exe
  2⤵
  PID:7180
- C:\Windows\System\JenmRFn.exe
  C:\Windows\System\JenmRFn.exe
  2⤵
  PID:7232
- C:\Windows\System\yuaHhiV.exe
  C:\Windows\System\yuaHhiV.exe
  2⤵
  PID:7296
- C:\Windows\System\uXSooKG.exe
  C:\Windows\System\uXSooKG.exe
  2⤵
  PID:7360
- C:\Windows\System\pkLqNFH.exe
  C:\Windows\System\pkLqNFH.exe
  2⤵
  PID:7420
- C:\Windows\System\eZcyTOD.exe
  C:\Windows\System\eZcyTOD.exe
  2⤵
  PID:7244
- C:\Windows\System\pyRVRyv.exe
  C:\Windows\System\pyRVRyv.exe
  2⤵
  PID:7308
- C:\Windows\System\KmAuDQx.exe
  C:\Windows\System\KmAuDQx.exe
  2⤵
  PID:7452
- C:\Windows\System\OeJzkmV.exe
  C:\Windows\System\OeJzkmV.exe
  2⤵
  PID:7404
- C:\Windows\System\hiLYjNY.exe
  C:\Windows\System\hiLYjNY.exe
  2⤵
  PID:7548
- C:\Windows\System\mszMdaf.exe
  C:\Windows\System\mszMdaf.exe
  2⤵
  PID:7580
- C:\Windows\System\lWzAcIk.exe
  C:\Windows\System\lWzAcIk.exe
  2⤵
  PID:7616
- C:\Windows\System\GDQfssU.exe
  C:\Windows\System\GDQfssU.exe
  2⤵
  PID:7644
- C:\Windows\System\JPiIGcR.exe
  C:\Windows\System\JPiIGcR.exe
  2⤵
  PID:7600
- C:\Windows\System\OnxPbfR.exe
  C:\Windows\System\OnxPbfR.exe
  2⤵
  PID:7568
- C:\Windows\System\hjnEKfa.exe
  C:\Windows\System\hjnEKfa.exe
  2⤵
  PID:7676
- C:\Windows\System\KdOxpev.exe
  C:\Windows\System\KdOxpev.exe
  2⤵
  PID:7692
- C:\Windows\System\SIWBacg.exe
  C:\Windows\System\SIWBacg.exe
  2⤵
  PID:7772
- C:\Windows\System\xJximWC.exe
  C:\Windows\System\xJximWC.exe
  2⤵
  PID:7724
- C:\Windows\System\jgIMtnu.exe
  C:\Windows\System\jgIMtnu.exe
  2⤵
  PID:7760
- C:\Windows\System\WPRBKRT.exe
  C:\Windows\System\WPRBKRT.exe
  2⤵
  PID:7836
- C:\Windows\System\KWnfNEs.exe
  C:\Windows\System\KWnfNEs.exe
  2⤵
  PID:7900
- C:\Windows\System\LXqDziD.exe
  C:\Windows\System\LXqDziD.exe
  2⤵
  PID:7824
- C:\Windows\System\qndDiYj.exe
  C:\Windows\System\qndDiYj.exe
  2⤵
  PID:7968
- C:\Windows\System\ridXasB.exe
  C:\Windows\System\ridXasB.exe
  2⤵
  PID:7916
- C:\Windows\System\Lnznsfa.exe
  C:\Windows\System\Lnznsfa.exe
  2⤵
  PID:8032
- C:\Windows\System\SgKLQpk.exe
  C:\Windows\System\SgKLQpk.exe
  2⤵
  PID:8044
- C:\Windows\System\xOYnjDP.exe
  C:\Windows\System\xOYnjDP.exe
  2⤵
  PID:8012
- C:\Windows\System\aImIkbS.exe
  C:\Windows\System\aImIkbS.exe
  2⤵
  PID:8096
- C:\Windows\System\bnBBWkD.exe
  C:\Windows\System\bnBBWkD.exe
  2⤵
  PID:8108
- C:\Windows\System\xAEbfNN.exe
  C:\Windows\System\xAEbfNN.exe
  2⤵
  PID:8156
- C:\Windows\System\IxQqGag.exe
  C:\Windows\System\IxQqGag.exe
  2⤵
  PID:6788
- C:\Windows\System\aoYiYdw.exe
  C:\Windows\System\aoYiYdw.exe
  2⤵
  PID:7328
- C:\Windows\System\gwJzdtu.exe
  C:\Windows\System\gwJzdtu.exe
  2⤵
  PID:7340
- C:\Windows\System\CUCnvTu.exe
  C:\Windows\System\CUCnvTu.exe
  2⤵
  PID:6516
- C:\Windows\System\tgOwWyu.exe
  C:\Windows\System\tgOwWyu.exe
  2⤵
  PID:8176
- C:\Windows\System\rVONvMw.exe
  C:\Windows\System\rVONvMw.exe
  2⤵
  PID:7392
- C:\Windows\System\fkiaSzN.exe
  C:\Windows\System\fkiaSzN.exe
  2⤵
  PID:7484
- C:\Windows\System\Hcfxuqp.exe
  C:\Windows\System\Hcfxuqp.exe
  2⤵
  PID:7468
- C:\Windows\System\zYXNFWS.exe
  C:\Windows\System\zYXNFWS.exe
  2⤵
  PID:7596
- C:\Windows\System\zlwVLrI.exe
  C:\Windows\System\zlwVLrI.exe
  2⤵
  PID:7740
- C:\Windows\System\xbUKieK.exe
  C:\Windows\System\xbUKieK.exe
  2⤵
  PID:7712
- C:\Windows\System\GBTmqOG.exe
  C:\Windows\System\GBTmqOG.exe
  2⤵
  PID:7872
- C:\Windows\System\sGdeVFV.exe
  C:\Windows\System\sGdeVFV.exe
  2⤵
  PID:7756
- C:\Windows\System\EJSQQWI.exe
  C:\Windows\System\EJSQQWI.exe
  2⤵
  PID:7820
- C:\Windows\System\yAKaRPK.exe
  C:\Windows\System\yAKaRPK.exe
  2⤵
  PID:7996
- C:\Windows\System\pYdjcwz.exe
  C:\Windows\System\pYdjcwz.exe
  2⤵
  PID:8060
- C:\Windows\System\gyxRXNR.exe
  C:\Windows\System\gyxRXNR.exe
  2⤵
  PID:7984
- C:\Windows\System\hRoZDPC.exe
  C:\Windows\System\hRoZDPC.exe
  2⤵
  PID:7212
- C:\Windows\System\gFkcVeu.exe
  C:\Windows\System\gFkcVeu.exe
  2⤵
  PID:7276
- C:\Windows\System\kEHdfXp.exe
  C:\Windows\System\kEHdfXp.exe
  2⤵
  PID:6544
- C:\Windows\System\CKFcTjC.exe
  C:\Windows\System\CKFcTjC.exe
  2⤵
  PID:7708
- C:\Windows\System\sNVoNIU.exe
  C:\Windows\System\sNVoNIU.exe
  2⤵
  PID:7376
- C:\Windows\System\HvIWUpE.exe
  C:\Windows\System\HvIWUpE.exe
  2⤵
  PID:7776
- C:\Windows\System\NDVxkxo.exe
  C:\Windows\System\NDVxkxo.exe
  2⤵
  PID:7660
- C:\Windows\System\INdfStI.exe
  C:\Windows\System\INdfStI.exe
  2⤵
  PID:7936
- C:\Windows\System\LFyVwnU.exe
  C:\Windows\System\LFyVwnU.exe
  2⤵
  PID:8128
- C:\Windows\System\kODTVhd.exe
  C:\Windows\System\kODTVhd.exe
  2⤵
  PID:7808
- C:\Windows\System\ZBuliQR.exe
  C:\Windows\System\ZBuliQR.exe
  2⤵
  PID:7436
- C:\Windows\System\QiDfsGY.exe
  C:\Windows\System\QiDfsGY.exe
  2⤵
  PID:8140
- C:\Windows\System\idFfYDR.exe
  C:\Windows\System\idFfYDR.exe
  2⤵
  PID:8196
- C:\Windows\System\fbkWwFB.exe
  C:\Windows\System\fbkWwFB.exe
  2⤵
  PID:8216
- C:\Windows\System\GITBWMs.exe
  C:\Windows\System\GITBWMs.exe
  2⤵
  PID:8232
- C:\Windows\System\TwOEwHI.exe
  C:\Windows\System\TwOEwHI.exe
  2⤵
  PID:8248
- C:\Windows\System\enBJTkJ.exe
  C:\Windows\System\enBJTkJ.exe
  2⤵
  PID:8264
- C:\Windows\System\dLnyKsD.exe
  C:\Windows\System\dLnyKsD.exe
  2⤵
  PID:8280
- C:\Windows\System\ZhAJInq.exe
  C:\Windows\System\ZhAJInq.exe
  2⤵
  PID:8296
- C:\Windows\System\ofOxBnJ.exe
  C:\Windows\System\ofOxBnJ.exe
  2⤵
  PID:8312
- C:\Windows\System\TOPrtan.exe
  C:\Windows\System\TOPrtan.exe
  2⤵
  PID:8328
- C:\Windows\System\XGGCspR.exe
  C:\Windows\System\XGGCspR.exe
  2⤵
  PID:8344
- C:\Windows\System\NPMVLnu.exe
  C:\Windows\System\NPMVLnu.exe
  2⤵
  PID:8360
- C:\Windows\System\cfVnYHI.exe
  C:\Windows\System\cfVnYHI.exe
  2⤵
  PID:8376
- C:\Windows\System\wCOGYbb.exe
  C:\Windows\System\wCOGYbb.exe
  2⤵
  PID:8392
- C:\Windows\System\DXtCrAN.exe
  C:\Windows\System\DXtCrAN.exe
  2⤵
  PID:8408
- C:\Windows\System\TIgmNeS.exe
  C:\Windows\System\TIgmNeS.exe
  2⤵
  PID:8424
- C:\Windows\System\IeUpLgz.exe
  C:\Windows\System\IeUpLgz.exe
  2⤵
  PID:8440
- C:\Windows\System\GLFvWuw.exe
  C:\Windows\System\GLFvWuw.exe
  2⤵
  PID:8456
- C:\Windows\System\oHPOtho.exe
  C:\Windows\System\oHPOtho.exe
  2⤵
  PID:8472
- C:\Windows\System\lccUubJ.exe
  C:\Windows\System\lccUubJ.exe
  2⤵
  PID:8488
- C:\Windows\System\ROTWeOD.exe
  C:\Windows\System\ROTWeOD.exe
  2⤵
  PID:8504
- C:\Windows\System\dhEeKux.exe
  C:\Windows\System\dhEeKux.exe
  2⤵
  PID:8524
- C:\Windows\System\OLxaYws.exe
  C:\Windows\System\OLxaYws.exe
  2⤵
  PID:8540
- C:\Windows\System\tRbQmaB.exe
  C:\Windows\System\tRbQmaB.exe
  2⤵
  PID:8556
- C:\Windows\System\vNcTYKv.exe
  C:\Windows\System\vNcTYKv.exe
  2⤵
  PID:8572
- C:\Windows\System\mNpkIol.exe
  C:\Windows\System\mNpkIol.exe
  2⤵
  PID:8588
- C:\Windows\System\sRoDwqD.exe
  C:\Windows\System\sRoDwqD.exe
  2⤵
  PID:8604
- C:\Windows\System\PfYAeBS.exe
  C:\Windows\System\PfYAeBS.exe
  2⤵
  PID:8620
- C:\Windows\System\RKWAlSq.exe
  C:\Windows\System\RKWAlSq.exe
  2⤵
  PID:8636
- C:\Windows\System\uftMuwK.exe
  C:\Windows\System\uftMuwK.exe
  2⤵
  PID:8656
- C:\Windows\System\waslEmy.exe
  C:\Windows\System\waslEmy.exe
  2⤵
  PID:8672
- C:\Windows\System\oFMtXZQ.exe
  C:\Windows\System\oFMtXZQ.exe
  2⤵
  PID:8688
- C:\Windows\System\jrCbRKw.exe
  C:\Windows\System\jrCbRKw.exe
  2⤵
  PID:8704
- C:\Windows\System\eLrVfyX.exe
  C:\Windows\System\eLrVfyX.exe
  2⤵
  PID:8720
- C:\Windows\System\iDRRaPK.exe
  C:\Windows\System\iDRRaPK.exe
  2⤵
  PID:8736
- C:\Windows\System\ytDjUTm.exe
  C:\Windows\System\ytDjUTm.exe
  2⤵
  PID:8752
- C:\Windows\System\OuSwdhL.exe
  C:\Windows\System\OuSwdhL.exe
  2⤵
  PID:8768
- C:\Windows\System\sgMlYbo.exe
  C:\Windows\System\sgMlYbo.exe
  2⤵
  PID:8784
- C:\Windows\System\WFKnaZl.exe
  C:\Windows\System\WFKnaZl.exe
  2⤵
  PID:8800
- C:\Windows\System\VziKKxz.exe
  C:\Windows\System\VziKKxz.exe
  2⤵
  PID:8816
- C:\Windows\System\wWBmRpu.exe
  C:\Windows\System\wWBmRpu.exe
  2⤵
  PID:8832
- C:\Windows\System\yUlMFnh.exe
  C:\Windows\System\yUlMFnh.exe
  2⤵
  PID:8848
- C:\Windows\System\wqSfJvG.exe
  C:\Windows\System\wqSfJvG.exe
  2⤵
  PID:8864
- C:\Windows\System\SQzlUIW.exe
  C:\Windows\System\SQzlUIW.exe
  2⤵
  PID:8880
- C:\Windows\System\BeqAgyA.exe
  C:\Windows\System\BeqAgyA.exe
  2⤵
  PID:8896
- C:\Windows\System\flNyOIG.exe
  C:\Windows\System\flNyOIG.exe
  2⤵
  PID:8912
- C:\Windows\System\EWWCksH.exe
  C:\Windows\System\EWWCksH.exe
  2⤵
  PID:8928
- C:\Windows\System\QbIfpmX.exe
  C:\Windows\System\QbIfpmX.exe
  2⤵
  PID:8944
- C:\Windows\System\yuMrPdS.exe
  C:\Windows\System\yuMrPdS.exe
  2⤵
  PID:8960
- C:\Windows\System\GJFpiQC.exe
  C:\Windows\System\GJFpiQC.exe
  2⤵
  PID:8976
- C:\Windows\System\OrfLvPD.exe
  C:\Windows\System\OrfLvPD.exe
  2⤵
  PID:8992
- C:\Windows\System\OzDLxjc.exe
  C:\Windows\System\OzDLxjc.exe
  2⤵
  PID:9008
- C:\Windows\System\iQamuvb.exe
  C:\Windows\System\iQamuvb.exe
  2⤵
  PID:9024
- C:\Windows\System\AZhikYj.exe
  C:\Windows\System\AZhikYj.exe
  2⤵
  PID:9040
- C:\Windows\System\nUZFrfh.exe
  C:\Windows\System\nUZFrfh.exe
  2⤵
  PID:9056
- C:\Windows\System\AUIcEFP.exe
  C:\Windows\System\AUIcEFP.exe
  2⤵
  PID:9072
- C:\Windows\System\qYhoToP.exe
  C:\Windows\System\qYhoToP.exe
  2⤵
  PID:9088
- C:\Windows\System\gkpJEOW.exe
  C:\Windows\System\gkpJEOW.exe
  2⤵
  PID:9104
- C:\Windows\System\wbIOwJC.exe
  C:\Windows\System\wbIOwJC.exe
  2⤵
  PID:9120
- C:\Windows\System\IyFifcR.exe
  C:\Windows\System\IyFifcR.exe
  2⤵
  PID:9136
- C:\Windows\System\fQUJakn.exe
  C:\Windows\System\fQUJakn.exe
  2⤵
  PID:9152
- C:\Windows\System\bsuJjbr.exe
  C:\Windows\System\bsuJjbr.exe
  2⤵
  PID:9168
- C:\Windows\System\PbXmLXt.exe
  C:\Windows\System\PbXmLXt.exe
  2⤵
  PID:9188
- C:\Windows\System\BFUjbMn.exe
  C:\Windows\System\BFUjbMn.exe
  2⤵
  PID:9204
- C:\Windows\System\FiXvRyf.exe
  C:\Windows\System\FiXvRyf.exe
  2⤵
  PID:6560
- C:\Windows\System\NvYATzs.exe
  C:\Windows\System\NvYATzs.exe
  2⤵
  PID:7472
- C:\Windows\System\fzcKzwR.exe
  C:\Windows\System\fzcKzwR.exe
  2⤵
  PID:7264
- C:\Windows\System\ALOnRuG.exe
  C:\Windows\System\ALOnRuG.exe
  2⤵
  PID:7788
- C:\Windows\System\HYcFduU.exe
  C:\Windows\System\HYcFduU.exe
  2⤵
  PID:8228
- C:\Windows\System\kLAlPnt.exe
  C:\Windows\System\kLAlPnt.exe
  2⤵
  PID:8276
- C:\Windows\System\CequzIQ.exe
  C:\Windows\System\CequzIQ.exe
  2⤵
  PID:8340
- C:\Windows\System\ohrqhqn.exe
  C:\Windows\System\ohrqhqn.exe
  2⤵
  PID:8372
- C:\Windows\System\AnQNqkO.exe
  C:\Windows\System\AnQNqkO.exe
  2⤵
  PID:8292
- C:\Windows\System\LXlMEDV.exe
  C:\Windows\System\LXlMEDV.exe
  2⤵
  PID:8432
- C:\Windows\System\nNHQsXq.exe
  C:\Windows\System\nNHQsXq.exe
  2⤵
  PID:8468
- C:\Windows\System\erJNxSh.exe
  C:\Windows\System\erJNxSh.exe
  2⤵
  PID:8388
- C:\Windows\System\mOTLkst.exe
  C:\Windows\System\mOTLkst.exe
  2⤵
  PID:8480
- C:\Windows\System\HoTuRwH.exe
  C:\Windows\System\HoTuRwH.exe
  2⤵
  PID:8520
- C:\Windows\System\qHyDzUG.exe
  C:\Windows\System\qHyDzUG.exe
  2⤵
  PID:8564
- C:\Windows\System\nAJrjJQ.exe
  C:\Windows\System\nAJrjJQ.exe
  2⤵
  PID:8596
- C:\Windows\System\iNMetMC.exe
  C:\Windows\System\iNMetMC.exe
  2⤵
  PID:8664
- C:\Windows\System\omBIkVB.exe
  C:\Windows\System\omBIkVB.exe
  2⤵
  PID:8728
- C:\Windows\System\OJwOHpO.exe
  C:\Windows\System\OJwOHpO.exe
  2⤵
  PID:8612
- C:\Windows\System\bwlmcpb.exe
  C:\Windows\System\bwlmcpb.exe
  2⤵
  PID:8764
- C:\Windows\System\pKAxcUr.exe
  C:\Windows\System\pKAxcUr.exe
  2⤵
  PID:8684
- C:\Windows\System\jqAhHGZ.exe
  C:\Windows\System\jqAhHGZ.exe
  2⤵
  PID:8796
- C:\Windows\System\bOPHOmF.exe
  C:\Windows\System\bOPHOmF.exe
  2⤵
  PID:8712
- C:\Windows\System\AqeBElu.exe
  C:\Windows\System\AqeBElu.exe
  2⤵
  PID:8776
- C:\Windows\System\McLFmOJ.exe
  C:\Windows\System\McLFmOJ.exe
  2⤵
  PID:8840
- C:\Windows\System\nqAPWUr.exe
  C:\Windows\System\nqAPWUr.exe
  2⤵
  PID:8924
- C:\Windows\System\pZSgBjc.exe
  C:\Windows\System\pZSgBjc.exe
  2⤵
  PID:8956
- C:\Windows\System\luuhlRC.exe
  C:\Windows\System\luuhlRC.exe
  2⤵
  PID:8988
- C:\Windows\System\TSDLCns.exe
  C:\Windows\System\TSDLCns.exe
  2⤵
  PID:8972
- C:\Windows\System\kdBXTUa.exe
  C:\Windows\System\kdBXTUa.exe
  2⤵
  PID:9084
- C:\Windows\System\XQzXkqK.exe
  C:\Windows\System\XQzXkqK.exe
  2⤵
  PID:9004
- C:\Windows\System\iQeqDtE.exe
  C:\Windows\System\iQeqDtE.exe
  2⤵
  PID:9100
- C:\Windows\System\XnjbKyy.exe
  C:\Windows\System\XnjbKyy.exe
  2⤵
  PID:9096
- C:\Windows\System\wpbnSPo.exe
  C:\Windows\System\wpbnSPo.exe
  2⤵
  PID:9132
- C:\Windows\System\QlZsoqv.exe
  C:\Windows\System\QlZsoqv.exe
  2⤵
  PID:5460
- C:\Windows\System\pKJmEHZ.exe
  C:\Windows\System\pKJmEHZ.exe
  2⤵
  PID:9200
- C:\Windows\System\LhEEVMk.exe
  C:\Windows\System\LhEEVMk.exe
  2⤵
  PID:8212
- C:\Windows\System\mIqBtEP.exe
  C:\Windows\System\mIqBtEP.exe
  2⤵
  PID:8272
- C:\Windows\System\rQCPTKo.exe
  C:\Windows\System\rQCPTKo.exe
  2⤵
  PID:8260
- C:\Windows\System\jMjonWr.exe
  C:\Windows\System\jMjonWr.exe
  2⤵
  PID:8452
- C:\Windows\System\xnLVfVu.exe
  C:\Windows\System\xnLVfVu.exe
  2⤵
  PID:8500
- C:\Windows\System\OrfjyXG.exe
  C:\Windows\System\OrfjyXG.exe
  2⤵
  PID:8512
- C:\Windows\System\IhKCdDa.exe
  C:\Windows\System\IhKCdDa.exe
  2⤵
  PID:8732
- C:\Windows\System\qYiVezj.exe
  C:\Windows\System\qYiVezj.exe
  2⤵
  PID:8616
- C:\Windows\System\fyWsUlh.exe
  C:\Windows\System\fyWsUlh.exe
  2⤵
  PID:8904
- C:\Windows\System\nRyWScs.exe
  C:\Windows\System\nRyWScs.exe
  2⤵
  PID:9116
- C:\Windows\System\JoSWiuZ.exe
  C:\Windows\System\JoSWiuZ.exe
  2⤵
  PID:9064
- C:\Windows\System\mGCiKwt.exe
  C:\Windows\System\mGCiKwt.exe
  2⤵
  PID:9148
- C:\Windows\System\fZcINCI.exe
  C:\Windows\System\fZcINCI.exe
  2⤵
  PID:8188
- C:\Windows\System\jYOhLQi.exe
  C:\Windows\System\jYOhLQi.exe
  2⤵
  PID:8224
- C:\Windows\System\yjlqDiu.exe
  C:\Windows\System\yjlqDiu.exe
  2⤵
  PID:8464
- C:\Windows\System\QtPylEZ.exe
  C:\Windows\System\QtPylEZ.exe
  2⤵
  PID:8448
- C:\Windows\System\smHtbdz.exe
  C:\Windows\System\smHtbdz.exe
  2⤵
  PID:8548
- C:\Windows\System\OXKaPdj.exe
  C:\Windows\System\OXKaPdj.exe
  2⤵
  PID:8828
- C:\Windows\System\rWoGNpR.exe
  C:\Windows\System\rWoGNpR.exe
  2⤵
  PID:8952
- C:\Windows\System\zKhBWRb.exe
  C:\Windows\System\zKhBWRb.exe
  2⤵
  PID:8968
- C:\Windows\System\wZfVQfN.exe
  C:\Windows\System\wZfVQfN.exe
  2⤵
  PID:9052
- C:\Windows\System\OPzikgQ.exe
  C:\Windows\System\OPzikgQ.exe
  2⤵
  PID:8700
- C:\Windows\System\CTItqYC.exe
  C:\Windows\System\CTItqYC.exe
  2⤵
  PID:8888
- C:\Windows\System\wJjbBsv.exe
  C:\Windows\System\wJjbBsv.exe
  2⤵
  PID:8716
- C:\Windows\System\JZoxoPM.exe
  C:\Windows\System\JZoxoPM.exe
  2⤵
  PID:7980
- C:\Windows\System\TtbDrqs.exe
  C:\Windows\System\TtbDrqs.exe
  2⤵
  PID:8384
- C:\Windows\System\nvFewxu.exe
  C:\Windows\System\nvFewxu.exe
  2⤵
  PID:8940
- C:\Windows\System\BOPvGkb.exe
  C:\Windows\System\BOPvGkb.exe
  2⤵
  PID:9212
- C:\Windows\System\YiGAyeH.exe
  C:\Windows\System\YiGAyeH.exe
  2⤵
  PID:9020
- C:\Windows\System\utxZBkv.exe
  C:\Windows\System\utxZBkv.exe
  2⤵
  PID:8860
- C:\Windows\System\PnYIseU.exe
  C:\Windows\System\PnYIseU.exe
  2⤵
  PID:9160
- C:\Windows\System\clbcLIB.exe
  C:\Windows\System\clbcLIB.exe
  2⤵
  PID:9164
- C:\Windows\System\TliRwgW.exe
  C:\Windows\System\TliRwgW.exe
  2⤵
  PID:8244
- C:\Windows\System\pUkixOP.exe
  C:\Windows\System\pUkixOP.exe
  2⤵
  PID:9240
- C:\Windows\System\hNnWgty.exe
  C:\Windows\System\hNnWgty.exe
  2⤵
  PID:9260
- C:\Windows\System\bCiJrQe.exe
  C:\Windows\System\bCiJrQe.exe
  2⤵
  PID:9276
- C:\Windows\System\yKNdSvf.exe
  C:\Windows\System\yKNdSvf.exe
  2⤵
  PID:9292
- C:\Windows\System\UEedjiK.exe
  C:\Windows\System\UEedjiK.exe
  2⤵
  PID:9308
- C:\Windows\System\XoyERbp.exe
  C:\Windows\System\XoyERbp.exe
  2⤵
  PID:9324
- C:\Windows\System\lvBFDpp.exe
  C:\Windows\System\lvBFDpp.exe
  2⤵
  PID:9340
- C:\Windows\System\fOdcRwd.exe
  C:\Windows\System\fOdcRwd.exe
  2⤵
  PID:9360
- C:\Windows\System\gXdpYwu.exe
  C:\Windows\System\gXdpYwu.exe
  2⤵
  PID:9376
- C:\Windows\System\IbRdaGs.exe
  C:\Windows\System\IbRdaGs.exe
  2⤵
  PID:9392
- C:\Windows\System\ydLRDTE.exe
  C:\Windows\System\ydLRDTE.exe
  2⤵
  PID:9408
- C:\Windows\System\lgOfzWD.exe
  C:\Windows\System\lgOfzWD.exe
  2⤵
  PID:9424
- C:\Windows\System\jZIQdRz.exe
  C:\Windows\System\jZIQdRz.exe
  2⤵
  PID:9440
- C:\Windows\System\fHupuwz.exe
  C:\Windows\System\fHupuwz.exe
  2⤵
  PID:9456
- C:\Windows\System\WQdjSoY.exe
  C:\Windows\System\WQdjSoY.exe
  2⤵
  PID:9472
- C:\Windows\System\AnWYnRF.exe
  C:\Windows\System\AnWYnRF.exe
  2⤵
  PID:9492
- C:\Windows\System\BwTOHEE.exe
  C:\Windows\System\BwTOHEE.exe
  2⤵
  PID:9508
- C:\Windows\System\HrwdMAP.exe
  C:\Windows\System\HrwdMAP.exe
  2⤵
  PID:9524
- C:\Windows\System\sltHvrK.exe
  C:\Windows\System\sltHvrK.exe
  2⤵
  PID:9544
- C:\Windows\System\bjlfwbT.exe
  C:\Windows\System\bjlfwbT.exe
  2⤵
  PID:9560
- C:\Windows\System\qGqGnFm.exe
  C:\Windows\System\qGqGnFm.exe
  2⤵
  PID:9580
- C:\Windows\System\OWNgTIw.exe
  C:\Windows\System\OWNgTIw.exe
  2⤵
  PID:9600
- C:\Windows\System\NkprYBS.exe
  C:\Windows\System\NkprYBS.exe
  2⤵
  PID:9616
- C:\Windows\System\VbxAMod.exe
  C:\Windows\System\VbxAMod.exe
  2⤵
  PID:9632
- C:\Windows\System\SseEHDU.exe
  C:\Windows\System\SseEHDU.exe
  2⤵
  PID:9648
- C:\Windows\System\IGxxLUH.exe
  C:\Windows\System\IGxxLUH.exe
  2⤵
  PID:9668
- C:\Windows\System\LkVlVAN.exe
  C:\Windows\System\LkVlVAN.exe
  2⤵
  PID:9688
- C:\Windows\System\ACLMLHY.exe
  C:\Windows\System\ACLMLHY.exe
  2⤵
  PID:9704
- C:\Windows\System\gHVIsoe.exe
  C:\Windows\System\gHVIsoe.exe
  2⤵
  PID:9720
- C:\Windows\System\hsqNjYE.exe
  C:\Windows\System\hsqNjYE.exe
  2⤵
  PID:9740
- C:\Windows\System\tddKQdQ.exe
  C:\Windows\System\tddKQdQ.exe
  2⤵
  PID:9760
- C:\Windows\System\VIrTHez.exe
  C:\Windows\System\VIrTHez.exe
  2⤵
  PID:9780
- C:\Windows\System\XpMMLRV.exe
  C:\Windows\System\XpMMLRV.exe
  2⤵
  PID:9796
- C:\Windows\System\sOsTnUM.exe
  C:\Windows\System\sOsTnUM.exe
  2⤵
  PID:9816
- C:\Windows\System\uBBEqqh.exe
  C:\Windows\System\uBBEqqh.exe
  2⤵
  PID:9832
- C:\Windows\System\fjnvlzT.exe
  C:\Windows\System\fjnvlzT.exe
  2⤵
  PID:9848
- C:\Windows\System\gZImbBQ.exe
  C:\Windows\System\gZImbBQ.exe
  2⤵
  PID:9864
- C:\Windows\System\EunHndd.exe
  C:\Windows\System\EunHndd.exe
  2⤵
  PID:9880
- C:\Windows\System\MXDJsvC.exe
  C:\Windows\System\MXDJsvC.exe
  2⤵
  PID:9896
- C:\Windows\System\QKevmHE.exe
  C:\Windows\System\QKevmHE.exe
  2⤵
  PID:9912
- C:\Windows\System\DOVDLUM.exe
  C:\Windows\System\DOVDLUM.exe
  2⤵
  PID:9928
- C:\Windows\System\XlkuzCX.exe
  C:\Windows\System\XlkuzCX.exe
  2⤵
  PID:9964
- C:\Windows\System\TGsrUCP.exe
  C:\Windows\System\TGsrUCP.exe
  2⤵
  PID:9980
- C:\Windows\System\YzURDsG.exe
  C:\Windows\System\YzURDsG.exe
  2⤵
  PID:9996
- C:\Windows\System\BemFNlG.exe
  C:\Windows\System\BemFNlG.exe
  2⤵
  PID:10016
- C:\Windows\System\eAHXZpE.exe
  C:\Windows\System\eAHXZpE.exe
  2⤵
  PID:10076
- C:\Windows\System\ICSOghY.exe
  C:\Windows\System\ICSOghY.exe
  2⤵
  PID:8744
- C:\Windows\System\RWJupRj.exe
  C:\Windows\System\RWJupRj.exe
  2⤵
  PID:9256
- C:\Windows\System\MyIpryN.exe
  C:\Windows\System\MyIpryN.exe
  2⤵
  PID:9232
- C:\Windows\System\VfaLOQd.exe
  C:\Windows\System\VfaLOQd.exe
  2⤵
  PID:9236
- C:\Windows\System\ahvtepa.exe
  C:\Windows\System\ahvtepa.exe
  2⤵
  PID:9304
- C:\Windows\System\sBcVMuj.exe
  C:\Windows\System\sBcVMuj.exe
  2⤵
  PID:9332
- C:\Windows\System\yhkrbQQ.exe
  C:\Windows\System\yhkrbQQ.exe
  2⤵
  PID:9448
- C:\Windows\System\yEZGJyt.exe
  C:\Windows\System\yEZGJyt.exe
  2⤵
  PID:9400
- C:\Windows\System\mjkwUtG.exe
  C:\Windows\System\mjkwUtG.exe
  2⤵
  PID:9552
- C:\Windows\System\PPQrDVo.exe
  C:\Windows\System\PPQrDVo.exe
  2⤵
  PID:9404
- C:\Windows\System\bfgfJlc.exe
  C:\Windows\System\bfgfJlc.exe
  2⤵
  PID:9464
- C:\Windows\System\EdiGBuX.exe
  C:\Windows\System\EdiGBuX.exe
  2⤵
  PID:9628
- C:\Windows\System\JtuRDiq.exe
  C:\Windows\System\JtuRDiq.exe
  2⤵
  PID:9656
- C:\Windows\System\URrUHkI.exe
  C:\Windows\System\URrUHkI.exe
  2⤵
  PID:9568
- C:\Windows\System\tSMPbGo.exe
  C:\Windows\System\tSMPbGo.exe
  2⤵
  PID:9612
- C:\Windows\System\mAZjiba.exe
  C:\Windows\System\mAZjiba.exe
  2⤵
  PID:9728
- C:\Windows\System\JiaaoUt.exe
  C:\Windows\System\JiaaoUt.exe
  2⤵
  PID:9644
- C:\Windows\System\Wrabtez.exe
  C:\Windows\System\Wrabtez.exe
  2⤵
  PID:9768
- C:\Windows\System\yuYOsog.exe
  C:\Windows\System\yuYOsog.exe
  2⤵
  PID:9772
- C:\Windows\System\NbSiAgA.exe
  C:\Windows\System\NbSiAgA.exe
  2⤵
  PID:9812
- C:\Windows\System\FliqeWk.exe
  C:\Windows\System\FliqeWk.exe
  2⤵
  PID:9876
- C:\Windows\System\holWqLA.exe
  C:\Windows\System\holWqLA.exe
  2⤵
  PID:9788
- C:\Windows\System\DAWGSiB.exe
  C:\Windows\System\DAWGSiB.exe
  2⤵
  PID:9856
- C:\Windows\System\zJtHjfm.exe
  C:\Windows\System\zJtHjfm.exe
  2⤵
  PID:9920
- C:\Windows\System\eNsycGa.exe
  C:\Windows\System\eNsycGa.exe
  2⤵
  PID:9952
- C:\Windows\System\cPngjIo.exe
  C:\Windows\System\cPngjIo.exe
  2⤵
  PID:9988
- C:\Windows\System\CvsFkjX.exe
  C:\Windows\System\CvsFkjX.exe
  2⤵
  PID:10004
- C:\Windows\System\npLsVoG.exe
  C:\Windows\System\npLsVoG.exe
  2⤵
  PID:10028
- C:\Windows\System\yAeVoFX.exe
  C:\Windows\System\yAeVoFX.exe
  2⤵
  PID:10048
- C:\Windows\System\hNeNhpX.exe
  C:\Windows\System\hNeNhpX.exe
  2⤵
  PID:10064
- C:\Windows\System\cbFFufh.exe
  C:\Windows\System\cbFFufh.exe
  2⤵
  PID:10096
- C:\Windows\System\dLERKCq.exe
  C:\Windows\System\dLERKCq.exe
  2⤵
  PID:10112
- C:\Windows\System\iHPpAoH.exe
  C:\Windows\System\iHPpAoH.exe
  2⤵
  PID:10128
- C:\Windows\System\repwYRN.exe
  C:\Windows\System\repwYRN.exe
  2⤵
  PID:10160
- C:\Windows\System\PjcdzSR.exe
  C:\Windows\System\PjcdzSR.exe
  2⤵
  PID:10176
- C:\Windows\System\rYjCFYN.exe
  C:\Windows\System\rYjCFYN.exe
  2⤵
  PID:10188
- C:\Windows\System\LwxbMYc.exe
  C:\Windows\System\LwxbMYc.exe
  2⤵
  PID:10208
- C:\Windows\System\kQxiilt.exe
  C:\Windows\System\kQxiilt.exe
  2⤵
  PID:10224
- C:\Windows\System\SmCGIAN.exe
  C:\Windows\System\SmCGIAN.exe
  2⤵
  PID:10236
- C:\Windows\System\asACLce.exe
  C:\Windows\System\asACLce.exe
  2⤵
  PID:8288
- C:\Windows\System\GxcoiLX.exe
  C:\Windows\System\GxcoiLX.exe
  2⤵
  PID:9316
- C:\Windows\System\LpgDcvQ.exe
  C:\Windows\System\LpgDcvQ.exe
  2⤵
  PID:9480
- C:\Windows\System\LMcbrEG.exe
  C:\Windows\System\LMcbrEG.exe
  2⤵
  PID:9416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AsRYEyg.exe

Filesize
1.4MB

MD5
a120b8507558de3b00b8a320b70fe610

SHA1
45d1d2591b70ebaafd64c210a29b866937d6e154

SHA256
d905246fbb8157f9796505de9ce57845a1e80a9a43002134145cdb81c87e88ba

SHA512
fd50f0ced54e9d24ed2b5cb5540f186ad0d4b51bf0f2738e82f79e32532bb4b9b85ae7b0d6386e9ecf9d0af7e9458f24de8213fe07837359ec1eff02054abc77

Download Submit
C:\Windows\system\CJdnfDC.exe

Filesize
1.4MB

MD5
4b9de5518cbd0912f7ec35da4923a78d

SHA1
8fb662ab8a4fedd939f6eb80f292dc7e14bd03d2

SHA256
8b3158f478d93eae432ee657d43ef0987a7b32e30936b1be42680909f3c9bf58

SHA512
9b874f566df7c86bb16bafd3bf55e581602307d228983ef7aa9ca458d3dad8433d0b432287dfdfd2a1437ed5eab90a14a3e89ca71b3257e8ccad922def41c035

Download Submit
C:\Windows\system\EKuUksA.exe

Filesize
1.4MB

MD5
f2ccc12e931d15656e7aec3fea98901a

SHA1
8e4560ef7fd46feeb289fae691733bcf9b7ba8a7

SHA256
8993b7c1fdd567bf990d71790ff7c5aa6a07c2e80eab7f31048d1a942795f8d3

SHA512
5961b95443eca68445d4a7e50bc839a0d3031aba4bf1319ed79221b9e32629ad168634bf9a1c8a5f439ec5d2d6f272cd3b68959f13e3b1c18e70568e79e0c135

Download Submit
C:\Windows\system\HczzxdI.exe

Filesize
1.4MB

MD5
19f7874d8b6a84a0c59425dccc406330

SHA1
d1723ea8866a187fec70b6a4b4669f3da58b0969

SHA256
d2dc6c26937c71fdb0b9a878d79b37864db871af362977b3d1a07d0830a94aab

SHA512
c37322c4825c5e709311127b30c542213d09eae57bceddc97004b80e9504bcf1b96db7795bbeb4e6d2ca2729a2ea9e3d06a176f3382df7a1d2e9597b3ac4f293

Download Submit
C:\Windows\system\IVQglQK.exe

Filesize
1.4MB

MD5
ccb8a3a91b3f5f650957a2fd72c4c983

SHA1
7cc233401bd812c58c042f0c090fdafa7268bfca

SHA256
a280ef453a0422598894683e88153dae30f203133fa9e578a12de5808bc1c953

SHA512
72325acec10e2802d9de908b05c2845a77ce27d6a39325c9a5d61d28ac1b28abf1cd5eac30dabfe13ea01d89bc47dfdc6828275e58614391f6d562e85401d5c6

Download Submit
C:\Windows\system\IuNcrOY.exe

Filesize
1.4MB

MD5
53ba2e15b6f085add7c724b8407e9299

SHA1
6db7fb762e42823170e3a55e2f0676a4d80dd0e2

SHA256
2d5206aebfe9b469f7010846834ca27da833dde0b194cd8df740287d70f327c8

SHA512
a1bb2b64de07e4702f38f80e8539d76bb2271a4c4b48669ad23f34e2b400479bbee40c92e6455bf98d5750efd63576041e7a35f65cd9cbe5441690078d26b665

Download Submit
C:\Windows\system\LDTlmUA.exe

Filesize
1.4MB

MD5
06b9c9ebe6aac67615191234f7fe8731

SHA1
80274c67ca2b83bdf27b5b29ae2cf207886b59e0

SHA256
c70eb62491283344e8b846d4a0e05b179997b4cae7d127b333d649cd347d9f46

SHA512
247ec7cc3b771d441aa9b17b9bca31c236224a813e54b97cba618ba8a2ec049655abccb05262f541861e1c5336ddd784818b364cd18c2dbf1de45228e0b98e49

Download Submit
C:\Windows\system\LewLwOA.exe

Filesize
1.4MB

MD5
0de81b579e78e35f49e2842fad78b2e8

SHA1
48b49678b939bfccfdf694c3cc7be7076c734ff5

SHA256
df7e5005a77f39e7736cb5643ac8b6411fb62f83e64c5fc8defad73325879a3c

SHA512
0fb5fcdf16a5d7cb1ed6b417c6e8f583b2daaf368252822d8af487bf3a0fe26b941dd29032906f864b5790685fe622ee34f27f5e2ba359b62d6715a7c63e4373

Download Submit
C:\Windows\system\McUhVrp.exe

Filesize
1.4MB

MD5
ba97875b96155882c6f09da7b1f43309

SHA1
06242244df3dc7d9a03ddc31430269f7cd8ed603

SHA256
0aadc7912dc7fb307e24263490fbb4cc57abfb1f3976a3504e56beea62af3475

SHA512
b173ac1c464df09b33fdcb9b47f3dc81fd2dfc9aeae4b802b898aed55a19e0ebcdd869398a57fb1f1e46faf1ef9def40a1600b1340c5ce200076a72246c0cdc6

Download Submit
C:\Windows\system\PSBYaXZ.exe

Filesize
1.4MB

MD5
4a6376380ecbb8b78e9f8fdf5d61a8ee

SHA1
99587800818734f0701eb3dee5c47986f98134f0

SHA256
8e31399020d1e6302f20ab81e72a064a4b01616146c203ee71658d2a1510415a

SHA512
5879ee14bfe701fa13b33bd3d92a56618ddcec05b9378d3c2fa11312d4d4640593c42573766a9ded0cf3fafd760c141cefd054c90e400f02ef6739c21d4df5de

Download Submit
C:\Windows\system\RKffZwD.exe

Filesize
1.4MB

MD5
de56831a684050aef5da25df7c3bf127

SHA1
82ffda6ff4157d79bdbe88ee924e7ad4e602eb74

SHA256
3136e9ade6cd7accd80d5c93cc10016eda3f57f374ae0500616307a0b4cf1397

SHA512
cae2d987812427e119cf42d2e61a4febe39e2117b6edef4d97958fc4d8abff24452b3680a6ed4ff8dc6191ab3946f254d1bccbab497cce843d37b25be20c7d40

Download Submit
C:\Windows\system\SCwlYBE.exe

Filesize
1.4MB

MD5
3c9e89da3926ef10d9a8d7112d1cd3bc

SHA1
b0c68e6bccd8863aecb30f56e1ea98aee3c39651

SHA256
feac3496e6435326d9792a6b7bcfa505d8454547a1fa9d773361e0fddf89b9aa

SHA512
91cd8027b2ab8e735bd067fb7d2b454c304537a0871f427df26208a6f6bbec2e36d80dbcecb6f8b4c45e6e3deea85bdbc165fb95cc8ba8e77a0cb645904972ca

Download Submit
C:\Windows\system\YpndEpK.exe

Filesize
1.4MB

MD5
143e0f0f27c0a3778817f9481acaf60b

SHA1
9388814099defd9862338c0a701c060f8115b991

SHA256
ee5d0a943d60893be2d111a3de4c77e7e965efacaef14a1a8b9874a8a9a2d2b4

SHA512
80fa0bfe20b21f2cd2acd0e72305b1ec63173796fb18be8af674d7db5cadeb7db8276388dbb01b0e537c0aa9cb651a589294e4b39a8c9bee5c37c13e8a1ecfd1

Download Submit
C:\Windows\system\gjcaloC.exe

Filesize
1.4MB

MD5
e62ba63ed3db45e05f8b1f3fb5da2d5d

SHA1
ea92a45103b9786da8a52c91d52045850d13a0bf

SHA256
463d67a52ffc62049296dfcd5d40bc0dc2764abba77e030ccec7001a5e774e2d

SHA512
293f092ec6ea1f0caf304f00a446e3c06ab24a7b98749e3b818edd05e1bf140c0ff4a11c7a69ab251c26e4bc5597a0a0ca34612c653278f6bdd6557ad630723a

Download Submit
C:\Windows\system\ivWplxs.exe

Filesize
1.4MB

MD5
bc1f55452538f79ddc6a3482cc66f460

SHA1
a0396f7abc44b98030ee0449cedc77ca8b680db8

SHA256
d88e0c76664c57d1015581d84141e6ec464373f10e1d341fc39f35c71870a925

SHA512
e1c62c757d329429e2a3aa94b5791b9c48f49e30bfe152a172227e3537e8a7acb2d560b2a6cdc3373921df48fe8c68d1c8a8ffd1e2687b348c8e9bb03814c3c5

Download Submit
C:\Windows\system\mjBGhxu.exe

Filesize
1.4MB

MD5
d7415a5dbac7c8e212fb2c949134051f

SHA1
27f0a721e86173470e8580c1d4104566bbf50faf

SHA256
6cbd58e82248d02041c39e060972360d83744571fa2a75f8575a96c6a780d9ed

SHA512
0d1a7f31eb197d91be9e44bb770b7a6b44379081a219649e95ce2362559a6223307508465cdb5dfdd0b145518776f6b64d1fb1813aa647f74f7bd562992a8a50

Download Submit
C:\Windows\system\mqqtTFn.exe

Filesize
1.4MB

MD5
09241378c022317770816397c470be38

SHA1
4dd5fa319222623d76ef544537f49ff761d9bf9d

SHA256
88cecae6ccb46c168d3591221b154ba4ca708cf497ef74d86557e6bdb31a6657

SHA512
6db886978b96205e6bb4445dd1322bda79b7f60be1fb7ed70d07d74f424eb5bb1194cec9576a1129fdefb6fe39a2efc42973699e3ffa46a2892b22f4c69a8e54

Download Submit
C:\Windows\system\myCHUvT.exe

Filesize
1.4MB

MD5
672c420159cb9b1bbb2b269e1a65a066

SHA1
2cb7bb31e2bb77ab09224d0e7f66eed6db47b9d1

SHA256
16d95e19e7769b4a3f2d9a9e60b0e62d5240e702c31c11a2298d3a5dc8fc83e1

SHA512
5da1ffe32e398378dcb15c178bc4e5658c5490f3ed14ad0aba695ee9e7de2e1e5515919f0a604085e6790c2ae654df275014338c64faadadc962f0c36e27dc30

Download Submit
C:\Windows\system\nCySONs.exe

Filesize
1.4MB

MD5
fd8f16a7fbc30deff53f867423e230eb

SHA1
e0ff26edda423a93e494d366adc4f15f2a65bce8

SHA256
9a52ea1b0486a03e52d06486edb83c9c1ad8a6a51b82b6f64e4470890e73e892

SHA512
2e64fd4a4034b1636ba53ac8f2e53a4f94decb632e43c1684839d7f018a27c0c5b5105a2ccdf1da13a71e85740cc31c2f3c7f2f9d074a97ab55455855a500402

Download Submit
C:\Windows\system\nfrBSDM.exe

Filesize
1.4MB

MD5
1f144d296aa0b749dab122a2aba9fc51

SHA1
44bcec8ada031e6d4252e5d80ea577edbf4858c1

SHA256
2dc22cfd1282d6a84107a8d2fe1a6d5095962269751e679841abb7b071c7229a

SHA512
198e29876a8c827050e3d6c83fc84845e27d797d273c3ddbc5089c3a62a63b0816d5fb19c9ab8e3fa5ab22b9d3bf4661dd4c536b61e10f3cece4b4d6cd5317af

Download Submit
C:\Windows\system\oybglTd.exe

Filesize
1.4MB

MD5
de5a6c0a02bd62b4825f2c78671dce58

SHA1
295abbecbe2b1738d83db7a02b967698322af45e

SHA256
c34304ecb2ad12bb2bf136d39839721b6b1b5eb8186ff1c4b799cb4a4757fd2a

SHA512
d1c13248df154a82ec53dcfa066a237445a5308b9d920370a85348b7202c38dc60bc110132a58e930267cb7f0f7f11e9968e58748d95af15b85d15d494b5a1f7

Download Submit
C:\Windows\system\qXGdpqL.exe

Filesize
1.4MB

MD5
459451d853247bc1c4c78a9a0f587572

SHA1
ca42602ab20f1af99783a340169b49fcafafd44c

SHA256
1556b081b52e3b3cfcf03ccf672a67049a7c7b4f2bff544ae92c3f0c50f3ce63

SHA512
b389c2d01441fc9c135434bd066dc594d6b74ef58fa7858ec309bdfa006f520d7df47b89bab0bcedd7ea019704efa48f62c2afabece20ea77578f72000f3fa4e

Download Submit
C:\Windows\system\qtBNOWM.exe

Filesize
1.4MB

MD5
c0e5edd2364dfa75b1ad50094ee2e034

SHA1
f87a3aa656980a143b02d937888ad2f57a19461c

SHA256
9793e8b7d55203d86c0fab2d1b0a17d5486ef53cd76397f087e5a8fd10bcee99

SHA512
8f18dca7d0c27ba104bb7af2ab65bc842498be980d7822ef861a245a30765c3d5e4e70f4cf4b9873c9c72d5b46272a92e4171d79765ed8a571ea404dd920a7b4

Download Submit
C:\Windows\system\rcFShfY.exe

Filesize
1.4MB

MD5
8938c72a033e5ae449c1f8bf3eb7706f

SHA1
d4eb4a031b67b02ae274ff0ec3b59d92f827a71d

SHA256
15a1ce4da5ab3eeaca8ce08eaf0c23f748a52e89933c6301ae574618ad1bd3a8

SHA512
dbf3a5404d61326d8392a5fe2dfd697cb6b34ea567aa52394f267552f9e0221212b6a8b941b0d5c0df04609205103a84b730502a56dce37e9aca907680160523

Download Submit
C:\Windows\system\tKXmBMz.exe

Filesize
1.4MB

MD5
2e65d662ccd09f92fb6907e48468f4e7

SHA1
786e45a0e619d97d16c310a9ffa4f440c4fc97bf

SHA256
08c3632671c4ac78ea14c59201d660d962a03256de890ec6f1120c2d8c85b06c

SHA512
30039047a4de2ae8999aad3663396c44ca441f42383b95e9c6a319732693b9ce4b313cb3a053ab5f6a0ddcdeb2247bff2abb27d21a81a307299a0ed385b612b9

Download Submit
C:\Windows\system\wLvVWhF.exe

Filesize
1.4MB

MD5
ee2d3e0e836ab255b33f6fc65f90caa6

SHA1
c6f96eddc3323a068b2a9b14e13ed363eeb9d1cf

SHA256
f0ccdc48d2d29a2121584aa60e6fb539530f020ceb6cc641d912663fa1aec93a

SHA512
6476a72b0be2ed06890ec605405575e75a2c6a4cfd72f60e30c1bdc72c462ee806b7d2b56a69f2658d6e5d2b2bdb58c43497a3479a0405b43f8051599b1380eb

Download Submit
C:\Windows\system\xIZpdyb.exe

Filesize
1.4MB

MD5
0f459bfa175bfd3ff94dc89ce8f22074

SHA1
4cec5e762b27b3cdaacaced04e0a8df9f57d09b2

SHA256
d2f46cefcc5abedeccd5d9637fd2683ec4203e7b1e03aeb71fbaac8b598b49eb

SHA512
2659dfac2f5e4155ee28fe19f511708b392599e51f5e6282133d4884fa51ae0c7320d0882d1fc5d37ab9022fc599a96f793622295d2134fe89dad71a4aaff612

Download Submit
C:\Windows\system\ywIwFTX.exe

Filesize
1.4MB

MD5
d5f620bd675e332dbb9c06d760c6b2d2

SHA1
3bcc51d5b36737c8757e8a087118158fc4cdf1d9

SHA256
9b8c41286a2f95fc4bb4dacfc360991a559864f918a6d5bba0682ba282da334a

SHA512
49af6cb0e4b8fe8e2fb2b2a9e09c57f716ecaa25cd285b1cca2085d2283933758e613b53117da0fd4b414e54349ebb445473973a9845bf3dbf0cceae0954c37d

Download Submit
C:\Windows\system\zbscxBW.exe

Filesize
1.4MB

MD5
22040d0b00d07682cae9e83add81cb2a

SHA1
c0f3fa49cd0eeae90775d41702f7e2717cad9287

SHA256
e600855307632ec62d2ba478f4aa4c7e9e79e88e590a83a55a9eb8893d6514bf

SHA512
a044ffde1a27e3d44c63ffc4fd76e380a40e4902d0604d38158364aea4f5e2963f97f3da16de05ae5b57f8d9ae86b2e3382b502f8c86ddf5c3164902fa77d0b9

Download Submit
\Windows\system\VvEnIib.exe

Filesize
1.4MB

MD5
014d6d3ea1b513eafa6f44faf99ef41d

SHA1
248f6f6152c3f98de0e34f3922d5227463114fc1

SHA256
34ef3fb6f2717cb2d313b98375b1ede968fb8ef1a4d57adc0d3243a22bbd9309

SHA512
b73598b6c4dd89d739d2360980e34dd9226153b713d7796f47421af1c3cb751002e75bcad1e90d05f6db2d9bb53943ca8b1fb2f2c7dcfd449442fbe2eb70d00c

Download Submit
\Windows\system\gMcTCcb.exe

Filesize
1.4MB

MD5
66a755495590f11838eefcc4a94b0ca2

SHA1
38ea946a97f5e0f104b689052d8720eab03b79be

SHA256
622cf13964a83e5d73c57df71bf2c0027b2cd1520d0761d8ebdeda62f525f5d3

SHA512
8693240acaa7d672d969084499d21b454eb501566220e4d77716d11dd096d920bcf0a595acf0558024eaa2632cabcaa973a93e1cac73b6a4130b79882ff0e3de

Download Submit
\Windows\system\hWwMaVk.exe

Filesize
1.4MB

MD5
3d9346bbdf57583b0d1155c2b348d1d9

SHA1
5cae135b38f18beb617a59403ee505e0954d2174

SHA256
10e2333df1d94b4b597c7a79027ca9099174279d863d6e8b5e33d354586377d5

SHA512
0b1f1b2aad0d711a405c49df20c16869dd88da8bc32fded6a288a0fd11a2d38505a7591a8ccffe57d756459cbb37533589d4d0edc4647998ae6dcd113f2f1e49

Download Submit
memory/2420-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download