xmrig | fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/12/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
Size

1.7MB
MD5

0cc624240d8f6e99a8e0688621b24711
SHA1

36c8cba3965277012f479ceb902fa6383c05c8bc
SHA256

fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61
SHA512

7039533a5ca6f0e7d3f4e77da62caed76f022d82d7fb8feda64109078cd4e126cc9d4f3eb0d94848f893b52c00ce9f1a1646bc9a399c400d0c6d30e12d84b778
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvbAgc:GemTLkNdfE0pZyn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	xmrig
behavioral1/files/0x00080000000162e4-6.dat	xmrig
behavioral1/files/0x00080000000164de-14.dat	xmrig
behavioral1/files/0x0007000000016c89-29.dat	xmrig
behavioral1/files/0x000d000000018683-56.dat	xmrig
behavioral1/files/0x0005000000018745-76.dat	xmrig
behavioral1/files/0x0006000000018d83-88.dat	xmrig
behavioral1/files/0x00050000000192a1-128.dat	xmrig
behavioral1/files/0x0005000000019299-124.dat	xmrig
behavioral1/files/0x000500000001927a-120.dat	xmrig
behavioral1/files/0x0005000000019274-116.dat	xmrig
behavioral1/files/0x0005000000019261-112.dat	xmrig
behavioral1/files/0x000500000001924f-108.dat	xmrig
behavioral1/files/0x0005000000019237-105.dat	xmrig
behavioral1/files/0x0005000000019203-100.dat	xmrig
behavioral1/files/0x0006000000019056-96.dat	xmrig
behavioral1/files/0x0006000000018fdf-92.dat	xmrig
behavioral1/files/0x0006000000018d7b-84.dat	xmrig
behavioral1/files/0x0006000000018be7-80.dat	xmrig
behavioral1/files/0x000500000001871c-72.dat	xmrig
behavioral1/files/0x000500000001870c-68.dat	xmrig
behavioral1/files/0x0005000000018706-64.dat	xmrig
behavioral1/files/0x0005000000018697-60.dat	xmrig
behavioral1/files/0x00060000000175f7-52.dat	xmrig
behavioral1/files/0x00060000000175f1-48.dat	xmrig
behavioral1/files/0x0006000000017570-44.dat	xmrig
behavioral1/files/0x00060000000174f8-40.dat	xmrig
behavioral1/files/0x0009000000016cf0-36.dat	xmrig
behavioral1/files/0x0007000000016ca0-33.dat	xmrig
behavioral1/files/0x0007000000016b86-24.dat	xmrig
behavioral1/files/0x0008000000016689-21.dat	xmrig
behavioral1/files/0x0008000000016399-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2408	PafBDDQ.exe
2348	zeTUtsR.exe
812	izYcysU.exe
2092	zRAcDsz.exe
2700	FYyjIUo.exe
2748	DnsgJoB.exe
2872	RuZFjcV.exe
2908	uELodxE.exe
2712	bdPoaNV.exe
2840	Lbfxjyy.exe
1932	WBiCzix.exe
1700	zNkCAGP.exe
2628	MeIHOYx.exe
2780	EgYpZoJ.exe
2720	QDCcVuN.exe
2624	tMdGapW.exe
2728	eDxfhCy.exe
1948	qYkGipx.exe
2084	ARulGFM.exe
1800	EivRDaA.exe
900	hgttLAN.exe
1108	faIjPnR.exe
2592	NRGQGEt.exe
600	LPeEZVH.exe
588	GhqIqut.exe
1636	YcGAxEF.exe
1980	CnobLcc.exe
2932	TtcSucx.exe
2708	vNAQtwu.exe
2696	KflZfQD.exe
2432	cjoAeJq.exe
2444	hycRxqg.exe
2220	GLBnSfA.exe
2256	tVuWdRS.exe
2532	TJvsUFQ.exe
1520	JZendht.exe
644	VVoBByS.exe
444	XcooLWG.exe
1296	dEvTLvI.exe
3016	YTHERnA.exe
3008	iCJekTr.exe
2588	pkrdksH.exe
1332	PijADNo.exe
1368	yzOxFTu.exe
1104	GDxEYmx.exe
1396	gkxejZg.exe
2844	uQzoSUc.exe
660	ocadwCC.exe
1828	FobfTRf.exe
1312	wnFecrt.exe
1276	xzsoHgU.exe
1292	qMbTknG.exe
1696	rKNnaqi.exe
952	jwhRNAh.exe
1300	oKRvpoz.exe
2268	rFnyzUS.exe
1444	DMQwhnf.exe
1092	shfTXgw.exe
1780	Zktwrxt.exe
2436	PRycVYM.exe
2484	YqTPFIp.exe
3028	uKLeMsV.exe
2140	JNxSGTQ.exe
3032	iTCohWj.exe

Loads dropped DLL 64 IoCs

pid	Process
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XSdczhe.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\YqsCSzM.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\JeeGpMK.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\QBCafFH.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\xOxmEso.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\rrDpcJg.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\qZlbdQZ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\azSHdkm.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\WOFNiLn.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\hNNbQhG.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\UzQuaVH.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\AAPZbFB.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\pwSRrjf.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\zlCwqvg.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\XBhdHYn.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\iTCohWj.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\trLSAMQ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\bUHgevP.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\ggASvxr.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\TjNKtkx.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\UetPbDL.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\MleXQUJ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\ocadwCC.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\dctYlyl.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\lXffguX.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\LWFUsMv.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\RHKqPub.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\WNaRqzv.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\lLqfOAF.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\KbTZCgA.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\tLIRboR.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\DMaIsuA.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\LxsAZeS.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\rgBKxdG.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\sIbhsyd.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\YJzssbF.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\QHpbgjs.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\DvVOTjs.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\oSiXuko.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\AQYMYOi.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\TZAvMXj.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\eXyxFOj.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\gwebjxy.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\aIrIEcE.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\LuRnyvI.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\bdhOGfZ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\BvXNOoh.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\YhSzuRK.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\kmNZWEa.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\TvgmyMG.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\CUDgBSJ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\mLDIjle.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\IwNIbtc.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\tagmcOY.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\AJsgqAF.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\XmoxPBc.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\KNLvCJC.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\wOORofm.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\xUBOEzD.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\kIIbLFu.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\EioldZJ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\GZUSMOk.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\VwPnSql.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
File created	C:\Windows\System\kLnksHZ.exe	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2408	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	31
PID 3048 wrote to memory of 2408	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	31
PID 3048 wrote to memory of 2408	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	31
PID 3048 wrote to memory of 2348	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	32
PID 3048 wrote to memory of 2348	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	32
PID 3048 wrote to memory of 2348	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	32
PID 3048 wrote to memory of 812	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	33
PID 3048 wrote to memory of 812	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	33
PID 3048 wrote to memory of 812	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	33
PID 3048 wrote to memory of 2092	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	34
PID 3048 wrote to memory of 2092	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	34
PID 3048 wrote to memory of 2092	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	34
PID 3048 wrote to memory of 2700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	35
PID 3048 wrote to memory of 2700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	35
PID 3048 wrote to memory of 2700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	35
PID 3048 wrote to memory of 2748	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	36
PID 3048 wrote to memory of 2748	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	36
PID 3048 wrote to memory of 2748	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	36
PID 3048 wrote to memory of 2872	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	37
PID 3048 wrote to memory of 2872	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	37
PID 3048 wrote to memory of 2872	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	37
PID 3048 wrote to memory of 2908	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	38
PID 3048 wrote to memory of 2908	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	38
PID 3048 wrote to memory of 2908	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	38
PID 3048 wrote to memory of 2712	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	39
PID 3048 wrote to memory of 2712	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	39
PID 3048 wrote to memory of 2712	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	39
PID 3048 wrote to memory of 2840	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	40
PID 3048 wrote to memory of 2840	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	40
PID 3048 wrote to memory of 2840	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	40
PID 3048 wrote to memory of 1932	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	41
PID 3048 wrote to memory of 1932	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	41
PID 3048 wrote to memory of 1932	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	41
PID 3048 wrote to memory of 1700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	42
PID 3048 wrote to memory of 1700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	42
PID 3048 wrote to memory of 1700	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	42
PID 3048 wrote to memory of 2628	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	43
PID 3048 wrote to memory of 2628	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	43
PID 3048 wrote to memory of 2628	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	43
PID 3048 wrote to memory of 2780	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	44
PID 3048 wrote to memory of 2780	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	44
PID 3048 wrote to memory of 2780	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	44
PID 3048 wrote to memory of 2720	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	45
PID 3048 wrote to memory of 2720	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	45
PID 3048 wrote to memory of 2720	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	45
PID 3048 wrote to memory of 2624	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	46
PID 3048 wrote to memory of 2624	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	46
PID 3048 wrote to memory of 2624	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	46
PID 3048 wrote to memory of 2728	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	47
PID 3048 wrote to memory of 2728	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	47
PID 3048 wrote to memory of 2728	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	47
PID 3048 wrote to memory of 1948	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	48
PID 3048 wrote to memory of 1948	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	48
PID 3048 wrote to memory of 1948	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	48
PID 3048 wrote to memory of 2084	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	49
PID 3048 wrote to memory of 2084	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	49
PID 3048 wrote to memory of 2084	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	49
PID 3048 wrote to memory of 1800	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	50
PID 3048 wrote to memory of 1800	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	50
PID 3048 wrote to memory of 1800	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	50
PID 3048 wrote to memory of 900	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	51
PID 3048 wrote to memory of 900	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	51
PID 3048 wrote to memory of 900	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	51
PID 3048 wrote to memory of 1108	3048	fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe	52

C:\Users\Admin\AppData\Local\Temp\fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe
"C:\Users\Admin\AppData\Local\Temp\fef441b86fd42e74c8d0f2476d6010ae0d10bb25f7954b5ca369132d8f1a3a61.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System\PafBDDQ.exe
  C:\Windows\System\PafBDDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\zeTUtsR.exe
  C:\Windows\System\zeTUtsR.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\izYcysU.exe
  C:\Windows\System\izYcysU.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\zRAcDsz.exe
  C:\Windows\System\zRAcDsz.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FYyjIUo.exe
  C:\Windows\System\FYyjIUo.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\DnsgJoB.exe
  C:\Windows\System\DnsgJoB.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\RuZFjcV.exe
  C:\Windows\System\RuZFjcV.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\uELodxE.exe
  C:\Windows\System\uELodxE.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\bdPoaNV.exe
  C:\Windows\System\bdPoaNV.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\Lbfxjyy.exe
  C:\Windows\System\Lbfxjyy.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\WBiCzix.exe
  C:\Windows\System\WBiCzix.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\zNkCAGP.exe
  C:\Windows\System\zNkCAGP.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\MeIHOYx.exe
  C:\Windows\System\MeIHOYx.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\EgYpZoJ.exe
  C:\Windows\System\EgYpZoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\QDCcVuN.exe
  C:\Windows\System\QDCcVuN.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\tMdGapW.exe
  C:\Windows\System\tMdGapW.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\eDxfhCy.exe
  C:\Windows\System\eDxfhCy.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qYkGipx.exe
  C:\Windows\System\qYkGipx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ARulGFM.exe
  C:\Windows\System\ARulGFM.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\EivRDaA.exe
  C:\Windows\System\EivRDaA.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\hgttLAN.exe
  C:\Windows\System\hgttLAN.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\faIjPnR.exe
  C:\Windows\System\faIjPnR.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\NRGQGEt.exe
  C:\Windows\System\NRGQGEt.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\LPeEZVH.exe
  C:\Windows\System\LPeEZVH.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\GhqIqut.exe
  C:\Windows\System\GhqIqut.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\YcGAxEF.exe
  C:\Windows\System\YcGAxEF.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\CnobLcc.exe
  C:\Windows\System\CnobLcc.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\TtcSucx.exe
  C:\Windows\System\TtcSucx.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\vNAQtwu.exe
  C:\Windows\System\vNAQtwu.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\KflZfQD.exe
  C:\Windows\System\KflZfQD.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\cjoAeJq.exe
  C:\Windows\System\cjoAeJq.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\hycRxqg.exe
  C:\Windows\System\hycRxqg.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\GLBnSfA.exe
  C:\Windows\System\GLBnSfA.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\tVuWdRS.exe
  C:\Windows\System\tVuWdRS.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\TJvsUFQ.exe
  C:\Windows\System\TJvsUFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JZendht.exe
  C:\Windows\System\JZendht.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\VVoBByS.exe
  C:\Windows\System\VVoBByS.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\XcooLWG.exe
  C:\Windows\System\XcooLWG.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\dEvTLvI.exe
  C:\Windows\System\dEvTLvI.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\YTHERnA.exe
  C:\Windows\System\YTHERnA.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\iCJekTr.exe
  C:\Windows\System\iCJekTr.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\pkrdksH.exe
  C:\Windows\System\pkrdksH.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\PijADNo.exe
  C:\Windows\System\PijADNo.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\yzOxFTu.exe
  C:\Windows\System\yzOxFTu.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\GDxEYmx.exe
  C:\Windows\System\GDxEYmx.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\gkxejZg.exe
  C:\Windows\System\gkxejZg.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\uQzoSUc.exe
  C:\Windows\System\uQzoSUc.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ocadwCC.exe
  C:\Windows\System\ocadwCC.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\FobfTRf.exe
  C:\Windows\System\FobfTRf.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\wnFecrt.exe
  C:\Windows\System\wnFecrt.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\xzsoHgU.exe
  C:\Windows\System\xzsoHgU.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\qMbTknG.exe
  C:\Windows\System\qMbTknG.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\rKNnaqi.exe
  C:\Windows\System\rKNnaqi.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\jwhRNAh.exe
  C:\Windows\System\jwhRNAh.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\oKRvpoz.exe
  C:\Windows\System\oKRvpoz.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\rFnyzUS.exe
  C:\Windows\System\rFnyzUS.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\DMQwhnf.exe
  C:\Windows\System\DMQwhnf.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\shfTXgw.exe
  C:\Windows\System\shfTXgw.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\Zktwrxt.exe
  C:\Windows\System\Zktwrxt.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\PRycVYM.exe
  C:\Windows\System\PRycVYM.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\YqTPFIp.exe
  C:\Windows\System\YqTPFIp.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\uKLeMsV.exe
  C:\Windows\System\uKLeMsV.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\JNxSGTQ.exe
  C:\Windows\System\JNxSGTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\iTCohWj.exe
  C:\Windows\System\iTCohWj.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\CGUlnaE.exe
  C:\Windows\System\CGUlnaE.exe
  2⤵
  PID:1616
- C:\Windows\System\akxIjqe.exe
  C:\Windows\System\akxIjqe.exe
  2⤵
  PID:1512
- C:\Windows\System\XmoxPBc.exe
  C:\Windows\System\XmoxPBc.exe
  2⤵
  PID:1652
- C:\Windows\System\vULXJeh.exe
  C:\Windows\System\vULXJeh.exe
  2⤵
  PID:1412
- C:\Windows\System\KBTLbEr.exe
  C:\Windows\System\KBTLbEr.exe
  2⤵
  PID:2324
- C:\Windows\System\UEPcBUM.exe
  C:\Windows\System\UEPcBUM.exe
  2⤵
  PID:1608
- C:\Windows\System\AEypQUs.exe
  C:\Windows\System\AEypQUs.exe
  2⤵
  PID:1704
- C:\Windows\System\HQpTgna.exe
  C:\Windows\System\HQpTgna.exe
  2⤵
  PID:1076
- C:\Windows\System\TkDludW.exe
  C:\Windows\System\TkDludW.exe
  2⤵
  PID:2328
- C:\Windows\System\imhfQbZ.exe
  C:\Windows\System\imhfQbZ.exe
  2⤵
  PID:2756
- C:\Windows\System\WGTymTa.exe
  C:\Windows\System\WGTymTa.exe
  2⤵
  PID:2764
- C:\Windows\System\LoCgsmx.exe
  C:\Windows\System\LoCgsmx.exe
  2⤵
  PID:2828
- C:\Windows\System\TQICDcp.exe
  C:\Windows\System\TQICDcp.exe
  2⤵
  PID:2944
- C:\Windows\System\BbZtlEl.exe
  C:\Windows\System\BbZtlEl.exe
  2⤵
  PID:2652
- C:\Windows\System\RKcbztP.exe
  C:\Windows\System\RKcbztP.exe
  2⤵
  PID:2656
- C:\Windows\System\jBlGIZU.exe
  C:\Windows\System\jBlGIZU.exe
  2⤵
  PID:2476
- C:\Windows\System\TrZRdhU.exe
  C:\Windows\System\TrZRdhU.exe
  2⤵
  PID:1660
- C:\Windows\System\yzosOIe.exe
  C:\Windows\System\yzosOIe.exe
  2⤵
  PID:572
- C:\Windows\System\TXKqbZu.exe
  C:\Windows\System\TXKqbZu.exe
  2⤵
  PID:2968
- C:\Windows\System\jPrgqeW.exe
  C:\Windows\System\jPrgqeW.exe
  2⤵
  PID:2800
- C:\Windows\System\QRzSjpM.exe
  C:\Windows\System\QRzSjpM.exe
  2⤵
  PID:3068
- C:\Windows\System\pwSRrjf.exe
  C:\Windows\System\pwSRrjf.exe
  2⤵
  PID:1788
- C:\Windows\System\OsYuLSc.exe
  C:\Windows\System\OsYuLSc.exe
  2⤵
  PID:3020
- C:\Windows\System\XYqBOgu.exe
  C:\Windows\System\XYqBOgu.exe
  2⤵
  PID:1376
- C:\Windows\System\MtbkeDx.exe
  C:\Windows\System\MtbkeDx.exe
  2⤵
  PID:708
- C:\Windows\System\pcDFpgN.exe
  C:\Windows\System\pcDFpgN.exe
  2⤵
  PID:700
- C:\Windows\System\HGgnVrG.exe
  C:\Windows\System\HGgnVrG.exe
  2⤵
  PID:1944
- C:\Windows\System\xFDPPGS.exe
  C:\Windows\System\xFDPPGS.exe
  2⤵
  PID:3164
- C:\Windows\System\FUWZYqK.exe
  C:\Windows\System\FUWZYqK.exe
  2⤵
  PID:3184
- C:\Windows\System\xvDzrCS.exe
  C:\Windows\System\xvDzrCS.exe
  2⤵
  PID:3204
- C:\Windows\System\buJVYNP.exe
  C:\Windows\System\buJVYNP.exe
  2⤵
  PID:3224
- C:\Windows\System\xLRGdat.exe
  C:\Windows\System\xLRGdat.exe
  2⤵
  PID:3244
- C:\Windows\System\zNiMzpC.exe
  C:\Windows\System\zNiMzpC.exe
  2⤵
  PID:3264
- C:\Windows\System\DWOQGwe.exe
  C:\Windows\System\DWOQGwe.exe
  2⤵
  PID:3284
- C:\Windows\System\mLefrlX.exe
  C:\Windows\System\mLefrlX.exe
  2⤵
  PID:3304
- C:\Windows\System\VanDrqh.exe
  C:\Windows\System\VanDrqh.exe
  2⤵
  PID:3324
- C:\Windows\System\FztFtdb.exe
  C:\Windows\System\FztFtdb.exe
  2⤵
  PID:3344
- C:\Windows\System\FgxAuWE.exe
  C:\Windows\System\FgxAuWE.exe
  2⤵
  PID:3364
- C:\Windows\System\KXzmHkM.exe
  C:\Windows\System\KXzmHkM.exe
  2⤵
  PID:3384
- C:\Windows\System\yDvJOVe.exe
  C:\Windows\System\yDvJOVe.exe
  2⤵
  PID:3404
- C:\Windows\System\YhQOLEI.exe
  C:\Windows\System\YhQOLEI.exe
  2⤵
  PID:3424
- C:\Windows\System\YdxfCsT.exe
  C:\Windows\System\YdxfCsT.exe
  2⤵
  PID:3444
- C:\Windows\System\PdcIaAW.exe
  C:\Windows\System\PdcIaAW.exe
  2⤵
  PID:3464
- C:\Windows\System\svgydwV.exe
  C:\Windows\System\svgydwV.exe
  2⤵
  PID:3484
- C:\Windows\System\adXMzWY.exe
  C:\Windows\System\adXMzWY.exe
  2⤵
  PID:3504
- C:\Windows\System\nLCpevk.exe
  C:\Windows\System\nLCpevk.exe
  2⤵
  PID:3524
- C:\Windows\System\zlCwqvg.exe
  C:\Windows\System\zlCwqvg.exe
  2⤵
  PID:3544
- C:\Windows\System\dibRHFF.exe
  C:\Windows\System\dibRHFF.exe
  2⤵
  PID:3564
- C:\Windows\System\OvkdMQz.exe
  C:\Windows\System\OvkdMQz.exe
  2⤵
  PID:3584
- C:\Windows\System\FhiqzTF.exe
  C:\Windows\System\FhiqzTF.exe
  2⤵
  PID:3604
- C:\Windows\System\RwXLSsl.exe
  C:\Windows\System\RwXLSsl.exe
  2⤵
  PID:3624
- C:\Windows\System\GfVzQzu.exe
  C:\Windows\System\GfVzQzu.exe
  2⤵
  PID:3644
- C:\Windows\System\BgvMHFH.exe
  C:\Windows\System\BgvMHFH.exe
  2⤵
  PID:3664
- C:\Windows\System\uAtPnMR.exe
  C:\Windows\System\uAtPnMR.exe
  2⤵
  PID:3684
- C:\Windows\System\kiKwGcm.exe
  C:\Windows\System\kiKwGcm.exe
  2⤵
  PID:3704
- C:\Windows\System\lCqAWzA.exe
  C:\Windows\System\lCqAWzA.exe
  2⤵
  PID:3724
- C:\Windows\System\wEofFqH.exe
  C:\Windows\System\wEofFqH.exe
  2⤵
  PID:3744
- C:\Windows\System\sjkcMWV.exe
  C:\Windows\System\sjkcMWV.exe
  2⤵
  PID:3764
- C:\Windows\System\hcFvuTo.exe
  C:\Windows\System\hcFvuTo.exe
  2⤵
  PID:3784
- C:\Windows\System\XeoENkd.exe
  C:\Windows\System\XeoENkd.exe
  2⤵
  PID:3804
- C:\Windows\System\AAPZbFB.exe
  C:\Windows\System\AAPZbFB.exe
  2⤵
  PID:3824
- C:\Windows\System\bvwjkDs.exe
  C:\Windows\System\bvwjkDs.exe
  2⤵
  PID:3844
- C:\Windows\System\sDcUdbm.exe
  C:\Windows\System\sDcUdbm.exe
  2⤵
  PID:3864
- C:\Windows\System\GZgtdhq.exe
  C:\Windows\System\GZgtdhq.exe
  2⤵
  PID:3884
- C:\Windows\System\HTfnGMR.exe
  C:\Windows\System\HTfnGMR.exe
  2⤵
  PID:3904
- C:\Windows\System\VNrwvVt.exe
  C:\Windows\System\VNrwvVt.exe
  2⤵
  PID:3924
- C:\Windows\System\cftGUyF.exe
  C:\Windows\System\cftGUyF.exe
  2⤵
  PID:3944
- C:\Windows\System\UPlgBKX.exe
  C:\Windows\System\UPlgBKX.exe
  2⤵
  PID:3964
- C:\Windows\System\BBcbYFR.exe
  C:\Windows\System\BBcbYFR.exe
  2⤵
  PID:3984
- C:\Windows\System\SWpJZPQ.exe
  C:\Windows\System\SWpJZPQ.exe
  2⤵
  PID:4004
- C:\Windows\System\QHpbgjs.exe
  C:\Windows\System\QHpbgjs.exe
  2⤵
  PID:4024
- C:\Windows\System\SssKQaP.exe
  C:\Windows\System\SssKQaP.exe
  2⤵
  PID:4044
- C:\Windows\System\EDlcRoM.exe
  C:\Windows\System\EDlcRoM.exe
  2⤵
  PID:4064
- C:\Windows\System\lksdfGm.exe
  C:\Windows\System\lksdfGm.exe
  2⤵
  PID:4084
- C:\Windows\System\uSEWfRB.exe
  C:\Windows\System\uSEWfRB.exe
  2⤵
  PID:1672
- C:\Windows\System\ggTEEpk.exe
  C:\Windows\System\ggTEEpk.exe
  2⤵
  PID:2600
- C:\Windows\System\cqIoloH.exe
  C:\Windows\System\cqIoloH.exe
  2⤵
  PID:2924
- C:\Windows\System\rHtfzeV.exe
  C:\Windows\System\rHtfzeV.exe
  2⤵
  PID:2056
- C:\Windows\System\rWRcdHp.exe
  C:\Windows\System\rWRcdHp.exe
  2⤵
  PID:2360
- C:\Windows\System\UUqlJqE.exe
  C:\Windows\System\UUqlJqE.exe
  2⤵
  PID:1088
- C:\Windows\System\tMMkIvq.exe
  C:\Windows\System\tMMkIvq.exe
  2⤵
  PID:2156
- C:\Windows\System\RoUOQcC.exe
  C:\Windows\System\RoUOQcC.exe
  2⤵
  PID:1560
- C:\Windows\System\pjnPBdq.exe
  C:\Windows\System\pjnPBdq.exe
  2⤵
  PID:1760
- C:\Windows\System\ngqMEFk.exe
  C:\Windows\System\ngqMEFk.exe
  2⤵
  PID:1664
- C:\Windows\System\nxJDtqm.exe
  C:\Windows\System\nxJDtqm.exe
  2⤵
  PID:1920
- C:\Windows\System\BKXXPSN.exe
  C:\Windows\System\BKXXPSN.exe
  2⤵
  PID:2136
- C:\Windows\System\EZPecOu.exe
  C:\Windows\System\EZPecOu.exe
  2⤵
  PID:1548
- C:\Windows\System\isKtoDj.exe
  C:\Windows\System\isKtoDj.exe
  2⤵
  PID:1152
- C:\Windows\System\zlaNqIZ.exe
  C:\Windows\System\zlaNqIZ.exe
  2⤵
  PID:1752
- C:\Windows\System\QIlWLIo.exe
  C:\Windows\System\QIlWLIo.exe
  2⤵
  PID:1612
- C:\Windows\System\MHAiBLn.exe
  C:\Windows\System\MHAiBLn.exe
  2⤵
  PID:2244
- C:\Windows\System\vWkFrKb.exe
  C:\Windows\System\vWkFrKb.exe
  2⤵
  PID:1676
- C:\Windows\System\HucNJjl.exe
  C:\Windows\System\HucNJjl.exe
  2⤵
  PID:1516
- C:\Windows\System\VwPnSql.exe
  C:\Windows\System\VwPnSql.exe
  2⤵
  PID:1488
- C:\Windows\System\eTlDxcH.exe
  C:\Windows\System\eTlDxcH.exe
  2⤵
  PID:3092
- C:\Windows\System\ciHDGYt.exe
  C:\Windows\System\ciHDGYt.exe
  2⤵
  PID:3112
- C:\Windows\System\YQaCYiI.exe
  C:\Windows\System\YQaCYiI.exe
  2⤵
  PID:3132
- C:\Windows\System\HqFWkbo.exe
  C:\Windows\System\HqFWkbo.exe
  2⤵
  PID:3160
- C:\Windows\System\IcIlHbX.exe
  C:\Windows\System\IcIlHbX.exe
  2⤵
  PID:3180
- C:\Windows\System\WfdpZix.exe
  C:\Windows\System\WfdpZix.exe
  2⤵
  PID:3220
- C:\Windows\System\ApidqEq.exe
  C:\Windows\System\ApidqEq.exe
  2⤵
  PID:3252
- C:\Windows\System\YkvqvzC.exe
  C:\Windows\System\YkvqvzC.exe
  2⤵
  PID:3312
- C:\Windows\System\ZWpHTJT.exe
  C:\Windows\System\ZWpHTJT.exe
  2⤵
  PID:3296
- C:\Windows\System\DefCkMB.exe
  C:\Windows\System\DefCkMB.exe
  2⤵
  PID:3336
- C:\Windows\System\wFGECcF.exe
  C:\Windows\System\wFGECcF.exe
  2⤵
  PID:3380
- C:\Windows\System\GEUthch.exe
  C:\Windows\System\GEUthch.exe
  2⤵
  PID:3440
- C:\Windows\System\eWUQTUW.exe
  C:\Windows\System\eWUQTUW.exe
  2⤵
  PID:3480
- C:\Windows\System\ffDtwVb.exe
  C:\Windows\System\ffDtwVb.exe
  2⤵
  PID:3512
- C:\Windows\System\uqtgMja.exe
  C:\Windows\System\uqtgMja.exe
  2⤵
  PID:3516
- C:\Windows\System\cnBOEij.exe
  C:\Windows\System\cnBOEij.exe
  2⤵
  PID:3560
- C:\Windows\System\mckqFBR.exe
  C:\Windows\System\mckqFBR.exe
  2⤵
  PID:3576
- C:\Windows\System\SDfoktW.exe
  C:\Windows\System\SDfoktW.exe
  2⤵
  PID:3612
- C:\Windows\System\lugZgtk.exe
  C:\Windows\System\lugZgtk.exe
  2⤵
  PID:3672
- C:\Windows\System\ZBwFoMo.exe
  C:\Windows\System\ZBwFoMo.exe
  2⤵
  PID:3676
- C:\Windows\System\xvBGzcE.exe
  C:\Windows\System\xvBGzcE.exe
  2⤵
  PID:3720
- C:\Windows\System\ezJgQZq.exe
  C:\Windows\System\ezJgQZq.exe
  2⤵
  PID:3756
- C:\Windows\System\zVZZqQZ.exe
  C:\Windows\System\zVZZqQZ.exe
  2⤵
  PID:3800
- C:\Windows\System\StrCMaB.exe
  C:\Windows\System\StrCMaB.exe
  2⤵
  PID:3832
- C:\Windows\System\VLUSaSV.exe
  C:\Windows\System\VLUSaSV.exe
  2⤵
  PID:3852
- C:\Windows\System\yFAXPHc.exe
  C:\Windows\System\yFAXPHc.exe
  2⤵
  PID:3880
- C:\Windows\System\etKbEAH.exe
  C:\Windows\System\etKbEAH.exe
  2⤵
  PID:3896
- C:\Windows\System\HjukedZ.exe
  C:\Windows\System\HjukedZ.exe
  2⤵
  PID:3940
- C:\Windows\System\hvNuKBK.exe
  C:\Windows\System\hvNuKBK.exe
  2⤵
  PID:3992
- C:\Windows\System\FnMZxOD.exe
  C:\Windows\System\FnMZxOD.exe
  2⤵
  PID:4012
- C:\Windows\System\TODPWsf.exe
  C:\Windows\System\TODPWsf.exe
  2⤵
  PID:4036
- C:\Windows\System\KAEySYa.exe
  C:\Windows\System\KAEySYa.exe
  2⤵
  PID:4060
- C:\Windows\System\URJTItR.exe
  C:\Windows\System\URJTItR.exe
  2⤵
  PID:4092
- C:\Windows\System\FuNFLlm.exe
  C:\Windows\System\FuNFLlm.exe
  2⤵
  PID:2176
- C:\Windows\System\NwcGVgl.exe
  C:\Windows\System\NwcGVgl.exe
  2⤵
  PID:2168
- C:\Windows\System\YchgrNK.exe
  C:\Windows\System\YchgrNK.exe
  2⤵
  PID:1836
- C:\Windows\System\XrhOrnJ.exe
  C:\Windows\System\XrhOrnJ.exe
  2⤵
  PID:2644
- C:\Windows\System\NnADYlJ.exe
  C:\Windows\System\NnADYlJ.exe
  2⤵
  PID:1724
- C:\Windows\System\ovlTNql.exe
  C:\Windows\System\ovlTNql.exe
  2⤵
  PID:2192
- C:\Windows\System\CVssswN.exe
  C:\Windows\System\CVssswN.exe
  2⤵
  PID:2368
- C:\Windows\System\tfOWrNb.exe
  C:\Windows\System\tfOWrNb.exe
  2⤵
  PID:2336
- C:\Windows\System\xhOosUB.exe
  C:\Windows\System\xhOosUB.exe
  2⤵
  PID:2772
- C:\Windows\System\azqVOdR.exe
  C:\Windows\System\azqVOdR.exe
  2⤵
  PID:2524
- C:\Windows\System\fIXGWsZ.exe
  C:\Windows\System\fIXGWsZ.exe
  2⤵
  PID:1032
- C:\Windows\System\cENuYTq.exe
  C:\Windows\System\cENuYTq.exe
  2⤵
  PID:3084
- C:\Windows\System\xEZeyXK.exe
  C:\Windows\System\xEZeyXK.exe
  2⤵
  PID:3148
- C:\Windows\System\tagmcOY.exe
  C:\Windows\System\tagmcOY.exe
  2⤵
  PID:3196
- C:\Windows\System\WoHqobg.exe
  C:\Windows\System\WoHqobg.exe
  2⤵
  PID:3192
- C:\Windows\System\XvDbBMc.exe
  C:\Windows\System\XvDbBMc.exe
  2⤵
  PID:3280
- C:\Windows\System\LmXliYW.exe
  C:\Windows\System\LmXliYW.exe
  2⤵
  PID:3360
- C:\Windows\System\AlMVqMF.exe
  C:\Windows\System\AlMVqMF.exe
  2⤵
  PID:3396
- C:\Windows\System\rcEMvRv.exe
  C:\Windows\System\rcEMvRv.exe
  2⤵
  PID:3460
- C:\Windows\System\SFnMMiY.exe
  C:\Windows\System\SFnMMiY.exe
  2⤵
  PID:3532
- C:\Windows\System\cmMiFPS.exe
  C:\Windows\System\cmMiFPS.exe
  2⤵
  PID:3540
- C:\Windows\System\kLnksHZ.exe
  C:\Windows\System\kLnksHZ.exe
  2⤵
  PID:3656
- C:\Windows\System\mRuvBYk.exe
  C:\Windows\System\mRuvBYk.exe
  2⤵
  PID:3580
- C:\Windows\System\nWRoION.exe
  C:\Windows\System\nWRoION.exe
  2⤵
  PID:3640
- C:\Windows\System\lWrpzTi.exe
  C:\Windows\System\lWrpzTi.exe
  2⤵
  PID:3796
- C:\Windows\System\EijpAaG.exe
  C:\Windows\System\EijpAaG.exe
  2⤵
  PID:3856
- C:\Windows\System\nprayRQ.exe
  C:\Windows\System\nprayRQ.exe
  2⤵
  PID:3916
- C:\Windows\System\rvwoNYG.exe
  C:\Windows\System\rvwoNYG.exe
  2⤵
  PID:3900
- C:\Windows\System\DHrCvSN.exe
  C:\Windows\System\DHrCvSN.exe
  2⤵
  PID:3960
- C:\Windows\System\zLyhWSW.exe
  C:\Windows\System\zLyhWSW.exe
  2⤵
  PID:4080
- C:\Windows\System\iiuZYZU.exe
  C:\Windows\System\iiuZYZU.exe
  2⤵
  PID:4020
- C:\Windows\System\LXEzmhf.exe
  C:\Windows\System\LXEzmhf.exe
  2⤵
  PID:544
- C:\Windows\System\fsYjVaG.exe
  C:\Windows\System\fsYjVaG.exe
  2⤵
  PID:2988
- C:\Windows\System\mLsLkpr.exe
  C:\Windows\System\mLsLkpr.exe
  2⤵
  PID:840
- C:\Windows\System\PxhXTXw.exe
  C:\Windows\System\PxhXTXw.exe
  2⤵
  PID:1776
- C:\Windows\System\JXjwhcm.exe
  C:\Windows\System\JXjwhcm.exe
  2⤵
  PID:316
- C:\Windows\System\FSWZeEm.exe
  C:\Windows\System\FSWZeEm.exe
  2⤵
  PID:2552
- C:\Windows\System\CwHERcT.exe
  C:\Windows\System\CwHERcT.exe
  2⤵
  PID:3088
- C:\Windows\System\oxMeHww.exe
  C:\Windows\System\oxMeHww.exe
  2⤵
  PID:3200
- C:\Windows\System\cWlBNUn.exe
  C:\Windows\System\cWlBNUn.exe
  2⤵
  PID:3144
- C:\Windows\System\XjAaczn.exe
  C:\Windows\System\XjAaczn.exe
  2⤵
  PID:3272
- C:\Windows\System\hFNwPee.exe
  C:\Windows\System\hFNwPee.exe
  2⤵
  PID:3256
- C:\Windows\System\XBTuxuR.exe
  C:\Windows\System\XBTuxuR.exe
  2⤵
  PID:3416
- C:\Windows\System\cCJQhBg.exe
  C:\Windows\System\cCJQhBg.exe
  2⤵
  PID:2544
- C:\Windows\System\vzNGSER.exe
  C:\Windows\System\vzNGSER.exe
  2⤵
  PID:3632
- C:\Windows\System\wREQmlF.exe
  C:\Windows\System\wREQmlF.exe
  2⤵
  PID:3616
- C:\Windows\System\FUCcxNT.exe
  C:\Windows\System\FUCcxNT.exe
  2⤵
  PID:4100
- C:\Windows\System\KHQVnVa.exe
  C:\Windows\System\KHQVnVa.exe
  2⤵
  PID:4116
- C:\Windows\System\djInCpi.exe
  C:\Windows\System\djInCpi.exe
  2⤵
  PID:4140
- C:\Windows\System\lRlnIZk.exe
  C:\Windows\System\lRlnIZk.exe
  2⤵
  PID:4156
- C:\Windows\System\tMKhxQg.exe
  C:\Windows\System\tMKhxQg.exe
  2⤵
  PID:4176
- C:\Windows\System\UhwsFtW.exe
  C:\Windows\System\UhwsFtW.exe
  2⤵
  PID:4192
- C:\Windows\System\InPXjOe.exe
  C:\Windows\System\InPXjOe.exe
  2⤵
  PID:4216
- C:\Windows\System\ItLNJgi.exe
  C:\Windows\System\ItLNJgi.exe
  2⤵
  PID:4236
- C:\Windows\System\sCLnIjB.exe
  C:\Windows\System\sCLnIjB.exe
  2⤵
  PID:4260
- C:\Windows\System\mMpfJqQ.exe
  C:\Windows\System\mMpfJqQ.exe
  2⤵
  PID:4276
- C:\Windows\System\mDnloQT.exe
  C:\Windows\System\mDnloQT.exe
  2⤵
  PID:4300
- C:\Windows\System\pOONWkY.exe
  C:\Windows\System\pOONWkY.exe
  2⤵
  PID:4316
- C:\Windows\System\ZqEEOAu.exe
  C:\Windows\System\ZqEEOAu.exe
  2⤵
  PID:4340
- C:\Windows\System\glhFLoC.exe
  C:\Windows\System\glhFLoC.exe
  2⤵
  PID:4356
- C:\Windows\System\DMaIsuA.exe
  C:\Windows\System\DMaIsuA.exe
  2⤵
  PID:4380
- C:\Windows\System\taYliyn.exe
  C:\Windows\System\taYliyn.exe
  2⤵
  PID:4396
- C:\Windows\System\SOdbUYp.exe
  C:\Windows\System\SOdbUYp.exe
  2⤵
  PID:4420
- C:\Windows\System\xIdcGZn.exe
  C:\Windows\System\xIdcGZn.exe
  2⤵
  PID:4436
- C:\Windows\System\PFXVrFJ.exe
  C:\Windows\System\PFXVrFJ.exe
  2⤵
  PID:4456
- C:\Windows\System\kyDbGaK.exe
  C:\Windows\System\kyDbGaK.exe
  2⤵
  PID:4480
- C:\Windows\System\RKbThpl.exe
  C:\Windows\System\RKbThpl.exe
  2⤵
  PID:4496
- C:\Windows\System\WCSubuP.exe
  C:\Windows\System\WCSubuP.exe
  2⤵
  PID:4516
- C:\Windows\System\gAKzjHb.exe
  C:\Windows\System\gAKzjHb.exe
  2⤵
  PID:4540
- C:\Windows\System\CUqSsss.exe
  C:\Windows\System\CUqSsss.exe
  2⤵
  PID:4560
- C:\Windows\System\HsuAKzN.exe
  C:\Windows\System\HsuAKzN.exe
  2⤵
  PID:4576
- C:\Windows\System\LzWjpBX.exe
  C:\Windows\System\LzWjpBX.exe
  2⤵
  PID:4596
- C:\Windows\System\uudyCou.exe
  C:\Windows\System\uudyCou.exe
  2⤵
  PID:4616
- C:\Windows\System\hoZcXxm.exe
  C:\Windows\System\hoZcXxm.exe
  2⤵
  PID:4636
- C:\Windows\System\XDFjrQi.exe
  C:\Windows\System\XDFjrQi.exe
  2⤵
  PID:4660
- C:\Windows\System\mGilaax.exe
  C:\Windows\System\mGilaax.exe
  2⤵
  PID:4676
- C:\Windows\System\sJKhEPx.exe
  C:\Windows\System\sJKhEPx.exe
  2⤵
  PID:4696
- C:\Windows\System\RdUXggX.exe
  C:\Windows\System\RdUXggX.exe
  2⤵
  PID:4712
- C:\Windows\System\aRwTlPk.exe
  C:\Windows\System\aRwTlPk.exe
  2⤵
  PID:4736
- C:\Windows\System\LckTZfq.exe
  C:\Windows\System\LckTZfq.exe
  2⤵
  PID:4756
- C:\Windows\System\ebvIUTC.exe
  C:\Windows\System\ebvIUTC.exe
  2⤵
  PID:4772
- C:\Windows\System\wvDLvPT.exe
  C:\Windows\System\wvDLvPT.exe
  2⤵
  PID:4800
- C:\Windows\System\gjURvOz.exe
  C:\Windows\System\gjURvOz.exe
  2⤵
  PID:4816
- C:\Windows\System\TbYoJDV.exe
  C:\Windows\System\TbYoJDV.exe
  2⤵
  PID:4836
- C:\Windows\System\itDeaDt.exe
  C:\Windows\System\itDeaDt.exe
  2⤵
  PID:4852
- C:\Windows\System\RIdMQWP.exe
  C:\Windows\System\RIdMQWP.exe
  2⤵
  PID:4876
- C:\Windows\System\AwwpDAW.exe
  C:\Windows\System\AwwpDAW.exe
  2⤵
  PID:4900
- C:\Windows\System\jLRPGPo.exe
  C:\Windows\System\jLRPGPo.exe
  2⤵
  PID:4916
- C:\Windows\System\avDNjMP.exe
  C:\Windows\System\avDNjMP.exe
  2⤵
  PID:4940
- C:\Windows\System\RQCOecK.exe
  C:\Windows\System\RQCOecK.exe
  2⤵
  PID:4956
- C:\Windows\System\gihGifD.exe
  C:\Windows\System\gihGifD.exe
  2⤵
  PID:4976
- C:\Windows\System\aeknXRD.exe
  C:\Windows\System\aeknXRD.exe
  2⤵
  PID:5000
- C:\Windows\System\lmUvlsC.exe
  C:\Windows\System\lmUvlsC.exe
  2⤵
  PID:5020
- C:\Windows\System\fKQwgZS.exe
  C:\Windows\System\fKQwgZS.exe
  2⤵
  PID:5036
- C:\Windows\System\dsLECGf.exe
  C:\Windows\System\dsLECGf.exe
  2⤵
  PID:5060
- C:\Windows\System\sZwJNZc.exe
  C:\Windows\System\sZwJNZc.exe
  2⤵
  PID:5080
- C:\Windows\System\JdmHEUe.exe
  C:\Windows\System\JdmHEUe.exe
  2⤵
  PID:5096
- C:\Windows\System\aPRwjHG.exe
  C:\Windows\System\aPRwjHG.exe
  2⤵
  PID:5116
- C:\Windows\System\Caesgfi.exe
  C:\Windows\System\Caesgfi.exe
  2⤵
  PID:4000
- C:\Windows\System\NheGHXr.exe
  C:\Windows\System\NheGHXr.exe
  2⤵
  PID:3932
- C:\Windows\System\YdhCCRW.exe
  C:\Windows\System\YdhCCRW.exe
  2⤵
  PID:4016
- C:\Windows\System\bjYrMAa.exe
  C:\Windows\System\bjYrMAa.exe
  2⤵
  PID:2108
- C:\Windows\System\eWqzfTf.exe
  C:\Windows\System\eWqzfTf.exe
  2⤵
  PID:1912
- C:\Windows\System\lvUwzhX.exe
  C:\Windows\System\lvUwzhX.exe
  2⤵
  PID:1020
- C:\Windows\System\WyklgzH.exe
  C:\Windows\System\WyklgzH.exe
  2⤵
  PID:2304
- C:\Windows\System\jSThrLI.exe
  C:\Windows\System\jSThrLI.exe
  2⤵
  PID:3100
- C:\Windows\System\cKmnjXD.exe
  C:\Windows\System\cKmnjXD.exe
  2⤵
  PID:3520
- C:\Windows\System\OYznQaB.exe
  C:\Windows\System\OYznQaB.exe
  2⤵
  PID:3128
- C:\Windows\System\IwNIbtc.exe
  C:\Windows\System\IwNIbtc.exe
  2⤵
  PID:3536
- C:\Windows\System\xfKPErL.exe
  C:\Windows\System\xfKPErL.exe
  2⤵
  PID:3736
- C:\Windows\System\cSRYFmM.exe
  C:\Windows\System\cSRYFmM.exe
  2⤵
  PID:3872
- C:\Windows\System\PypfcXu.exe
  C:\Windows\System\PypfcXu.exe
  2⤵
  PID:4128
- C:\Windows\System\fpVedeb.exe
  C:\Windows\System\fpVedeb.exe
  2⤵
  PID:4152
- C:\Windows\System\tKFqGcx.exe
  C:\Windows\System\tKFqGcx.exe
  2⤵
  PID:2260
- C:\Windows\System\vmdgsmD.exe
  C:\Windows\System\vmdgsmD.exe
  2⤵
  PID:4244
- C:\Windows\System\iGfCQHx.exe
  C:\Windows\System\iGfCQHx.exe
  2⤵
  PID:4188
- C:\Windows\System\fQnsNqP.exe
  C:\Windows\System\fQnsNqP.exe
  2⤵
  PID:4296
- C:\Windows\System\MjtFOFx.exe
  C:\Windows\System\MjtFOFx.exe
  2⤵
  PID:4332
- C:\Windows\System\msVufLK.exe
  C:\Windows\System\msVufLK.exe
  2⤵
  PID:2212
- C:\Windows\System\ZmERsJy.exe
  C:\Windows\System\ZmERsJy.exe
  2⤵
  PID:4352
- C:\Windows\System\dLFOLlj.exe
  C:\Windows\System\dLFOLlj.exe
  2⤵
  PID:4412
- C:\Windows\System\RIQdcWA.exe
  C:\Windows\System\RIQdcWA.exe
  2⤵
  PID:4448
- C:\Windows\System\mMikOIC.exe
  C:\Windows\System\mMikOIC.exe
  2⤵
  PID:4492
- C:\Windows\System\mNBbNHc.exe
  C:\Windows\System\mNBbNHc.exe
  2⤵
  PID:4464
- C:\Windows\System\XnqACKa.exe
  C:\Windows\System\XnqACKa.exe
  2⤵
  PID:4508
- C:\Windows\System\eJMCzCG.exe
  C:\Windows\System\eJMCzCG.exe
  2⤵
  PID:4548
- C:\Windows\System\nhtldjJ.exe
  C:\Windows\System\nhtldjJ.exe
  2⤵
  PID:4612
- C:\Windows\System\gwebjxy.exe
  C:\Windows\System\gwebjxy.exe
  2⤵
  PID:4656
- C:\Windows\System\IfJBTSu.exe
  C:\Windows\System\IfJBTSu.exe
  2⤵
  PID:4684
- C:\Windows\System\IEJmqDG.exe
  C:\Windows\System\IEJmqDG.exe
  2⤵
  PID:4724
- C:\Windows\System\NaByEiK.exe
  C:\Windows\System\NaByEiK.exe
  2⤵
  PID:4704
- C:\Windows\System\gPbKNUP.exe
  C:\Windows\System\gPbKNUP.exe
  2⤵
  PID:4752
- C:\Windows\System\JZGJRvy.exe
  C:\Windows\System\JZGJRvy.exe
  2⤵
  PID:4812
- C:\Windows\System\TUvJUTA.exe
  C:\Windows\System\TUvJUTA.exe
  2⤵
  PID:2736
- C:\Windows\System\JESyXqF.exe
  C:\Windows\System\JESyXqF.exe
  2⤵
  PID:2900
- C:\Windows\System\ucnNaUr.exe
  C:\Windows\System\ucnNaUr.exe
  2⤵
  PID:4860
- C:\Windows\System\HYXvNoR.exe
  C:\Windows\System\HYXvNoR.exe
  2⤵
  PID:4924
- C:\Windows\System\thpczLs.exe
  C:\Windows\System\thpczLs.exe
  2⤵
  PID:4912
- C:\Windows\System\PtcURsp.exe
  C:\Windows\System\PtcURsp.exe
  2⤵
  PID:5008
- C:\Windows\System\PZjEyqr.exe
  C:\Windows\System\PZjEyqr.exe
  2⤵
  PID:5044
- C:\Windows\System\YyRmNGz.exe
  C:\Windows\System\YyRmNGz.exe
  2⤵
  PID:5088
- C:\Windows\System\AShEyGv.exe
  C:\Windows\System\AShEyGv.exe
  2⤵
  PID:5092
- C:\Windows\System\TyaqBqp.exe
  C:\Windows\System\TyaqBqp.exe
  2⤵
  PID:5076
- C:\Windows\System\VKbJYpp.exe
  C:\Windows\System\VKbJYpp.exe
  2⤵
  PID:3816
- C:\Windows\System\cfUPcGc.exe
  C:\Windows\System\cfUPcGc.exe
  2⤵
  PID:3956
- C:\Windows\System\FSQPzdK.exe
  C:\Windows\System\FSQPzdK.exe
  2⤵
  PID:1924
- C:\Windows\System\UUoeMgo.exe
  C:\Windows\System\UUoeMgo.exe
  2⤵
  PID:3300
- C:\Windows\System\aidjuFr.exe
  C:\Windows\System\aidjuFr.exe
  2⤵
  PID:1864
- C:\Windows\System\JcMvZGP.exe
  C:\Windows\System\JcMvZGP.exe
  2⤵
  PID:2716
- C:\Windows\System\crXQBRP.exe
  C:\Windows\System\crXQBRP.exe
  2⤵
  PID:3140
- C:\Windows\System\bsnhkLo.exe
  C:\Windows\System\bsnhkLo.exe
  2⤵
  PID:2768
- C:\Windows\System\lhXUZIr.exe
  C:\Windows\System\lhXUZIr.exe
  2⤵
  PID:3752
- C:\Windows\System\XSAsMJm.exe
  C:\Windows\System\XSAsMJm.exe
  2⤵
  PID:4184
- C:\Windows\System\YeLUDMv.exe
  C:\Windows\System\YeLUDMv.exe
  2⤵
  PID:4112
- C:\Windows\System\VBjRHlg.exe
  C:\Windows\System\VBjRHlg.exe
  2⤵
  PID:4284
- C:\Windows\System\TgUFWPK.exe
  C:\Windows\System\TgUFWPK.exe
  2⤵
  PID:4272
- C:\Windows\System\fogeTQU.exe
  C:\Windows\System\fogeTQU.exe
  2⤵
  PID:2952
- C:\Windows\System\SwDXoxH.exe
  C:\Windows\System\SwDXoxH.exe
  2⤵
  PID:2744
- C:\Windows\System\MDRpOua.exe
  C:\Windows\System\MDRpOua.exe
  2⤵
  PID:2612
- C:\Windows\System\fTmQIUx.exe
  C:\Windows\System\fTmQIUx.exe
  2⤵
  PID:4392
- C:\Windows\System\NEsvhXg.exe
  C:\Windows\System\NEsvhXg.exe
  2⤵
  PID:2608
- C:\Windows\System\eQvktEA.exe
  C:\Windows\System\eQvktEA.exe
  2⤵
  PID:2616
- C:\Windows\System\HWatNAC.exe
  C:\Windows\System\HWatNAC.exe
  2⤵
  PID:4536
- C:\Windows\System\lpprfqC.exe
  C:\Windows\System\lpprfqC.exe
  2⤵
  PID:4644
- C:\Windows\System\xkeEaFr.exe
  C:\Windows\System\xkeEaFr.exe
  2⤵
  PID:2128
- C:\Windows\System\koKWsdo.exe
  C:\Windows\System\koKWsdo.exe
  2⤵
  PID:2972
- C:\Windows\System\IBzqVMN.exe
  C:\Windows\System\IBzqVMN.exe
  2⤵
  PID:4784
- C:\Windows\System\KEoJkBL.exe
  C:\Windows\System\KEoJkBL.exe
  2⤵
  PID:4788
- C:\Windows\System\lIRsCgV.exe
  C:\Windows\System\lIRsCgV.exe
  2⤵
  PID:2856
- C:\Windows\System\aAHobvN.exe
  C:\Windows\System\aAHobvN.exe
  2⤵
  PID:4896
- C:\Windows\System\zIhrBeP.exe
  C:\Windows\System\zIhrBeP.exe
  2⤵
  PID:4972
- C:\Windows\System\CpAaYYD.exe
  C:\Windows\System\CpAaYYD.exe
  2⤵
  PID:4936
- C:\Windows\System\nGbTsuv.exe
  C:\Windows\System\nGbTsuv.exe
  2⤵
  PID:5048
- C:\Windows\System\SgFusmX.exe
  C:\Windows\System\SgFusmX.exe
  2⤵
  PID:2852
- C:\Windows\System\EEGdgWo.exe
  C:\Windows\System\EEGdgWo.exe
  2⤵
  PID:3976
- C:\Windows\System\tOtJFkX.exe
  C:\Windows\System\tOtJFkX.exe
  2⤵
  PID:2820
- C:\Windows\System\ZyWldXi.exe
  C:\Windows\System\ZyWldXi.exe
  2⤵
  PID:5104
- C:\Windows\System\TjvjcxG.exe
  C:\Windows\System\TjvjcxG.exe
  2⤵
  PID:2052
- C:\Windows\System\trLSAMQ.exe
  C:\Windows\System\trLSAMQ.exe
  2⤵
  PID:2760
- C:\Windows\System\PBywghS.exe
  C:\Windows\System\PBywghS.exe
  2⤵
  PID:3276
- C:\Windows\System\baWeukX.exe
  C:\Windows\System\baWeukX.exe
  2⤵
  PID:4132
- C:\Windows\System\UwUNPCh.exe
  C:\Windows\System\UwUNPCh.exe
  2⤵
  PID:1040
- C:\Windows\System\WKBmNxu.exe
  C:\Windows\System\WKBmNxu.exe
  2⤵
  PID:4148
- C:\Windows\System\dFBpJDq.exe
  C:\Windows\System\dFBpJDq.exe
  2⤵
  PID:4256
- C:\Windows\System\POADLWd.exe
  C:\Windows\System\POADLWd.exe
  2⤵
  PID:680
- C:\Windows\System\qjcvYMZ.exe
  C:\Windows\System\qjcvYMZ.exe
  2⤵
  PID:4212
- C:\Windows\System\GNQPIdY.exe
  C:\Windows\System\GNQPIdY.exe
  2⤵
  PID:2064
- C:\Windows\System\wjJwlcM.exe
  C:\Windows\System\wjJwlcM.exe
  2⤵
  PID:4288
- C:\Windows\System\wGtSvgU.exe
  C:\Windows\System\wGtSvgU.exe
  2⤵
  PID:1908
- C:\Windows\System\jWVTxGe.exe
  C:\Windows\System\jWVTxGe.exe
  2⤵
  PID:4348
- C:\Windows\System\xMLRhIo.exe
  C:\Windows\System\xMLRhIo.exe
  2⤵
  PID:4556
- C:\Windows\System\XNtDkqV.exe
  C:\Windows\System\XNtDkqV.exe
  2⤵
  PID:4324
- C:\Windows\System\wUngEMF.exe
  C:\Windows\System\wUngEMF.exe
  2⤵
  PID:1584
- C:\Windows\System\JLcKOfz.exe
  C:\Windows\System\JLcKOfz.exe
  2⤵
  PID:4452
- C:\Windows\System\BhEUEzu.exe
  C:\Windows\System\BhEUEzu.exe
  2⤵
  PID:852
- C:\Windows\System\tLIRboR.exe
  C:\Windows\System\tLIRboR.exe
  2⤵
  PID:4728
- C:\Windows\System\ibMoNqA.exe
  C:\Windows\System\ibMoNqA.exe
  2⤵
  PID:1684
- C:\Windows\System\bTgThXm.exe
  C:\Windows\System\bTgThXm.exe
  2⤵
  PID:4720
- C:\Windows\System\YYLuPvi.exe
  C:\Windows\System\YYLuPvi.exe
  2⤵
  PID:4868
- C:\Windows\System\CqutXxr.exe
  C:\Windows\System\CqutXxr.exe
  2⤵
  PID:4968
- C:\Windows\System\bCeMaha.exe
  C:\Windows\System\bCeMaha.exe
  2⤵
  PID:5016
- C:\Windows\System\DrgefAJ.exe
  C:\Windows\System\DrgefAJ.exe
  2⤵
  PID:5012
- C:\Windows\System\DZLQsBe.exe
  C:\Windows\System\DZLQsBe.exe
  2⤵
  PID:4988
- C:\Windows\System\HAAvnGG.exe
  C:\Windows\System\HAAvnGG.exe
  2⤵
  PID:3772
- C:\Windows\System\VcaQBQq.exe
  C:\Windows\System\VcaQBQq.exe
  2⤵
  PID:2236
- C:\Windows\System\WSBpYBu.exe
  C:\Windows\System\WSBpYBu.exe
  2⤵
  PID:4208
- C:\Windows\System\CZGiDfN.exe
  C:\Windows\System\CZGiDfN.exe
  2⤵
  PID:4408
- C:\Windows\System\rYcMyFc.exe
  C:\Windows\System\rYcMyFc.exe
  2⤵
  PID:4624
- C:\Windows\System\RRCxUdd.exe
  C:\Windows\System\RRCxUdd.exe
  2⤵
  PID:5136
- C:\Windows\System\cFTZqid.exe
  C:\Windows\System\cFTZqid.exe
  2⤵
  PID:5152
- C:\Windows\System\DvVOTjs.exe
  C:\Windows\System\DvVOTjs.exe
  2⤵
  PID:5168
- C:\Windows\System\BRCrRgg.exe
  C:\Windows\System\BRCrRgg.exe
  2⤵
  PID:5184
- C:\Windows\System\mEgGUYy.exe
  C:\Windows\System\mEgGUYy.exe
  2⤵
  PID:5200
- C:\Windows\System\LZWbkEF.exe
  C:\Windows\System\LZWbkEF.exe
  2⤵
  PID:5216
- C:\Windows\System\rdUKcVf.exe
  C:\Windows\System\rdUKcVf.exe
  2⤵
  PID:5232
- C:\Windows\System\zELOKbC.exe
  C:\Windows\System\zELOKbC.exe
  2⤵
  PID:5248
- C:\Windows\System\WFVzHbI.exe
  C:\Windows\System\WFVzHbI.exe
  2⤵
  PID:5264
- C:\Windows\System\ACDwjmX.exe
  C:\Windows\System\ACDwjmX.exe
  2⤵
  PID:5280
- C:\Windows\System\xvpZZAv.exe
  C:\Windows\System\xvpZZAv.exe
  2⤵
  PID:5300
- C:\Windows\System\oQNqWhP.exe
  C:\Windows\System\oQNqWhP.exe
  2⤵
  PID:5316
- C:\Windows\System\msxzEUi.exe
  C:\Windows\System\msxzEUi.exe
  2⤵
  PID:5336
- C:\Windows\System\kBhWFBi.exe
  C:\Windows\System\kBhWFBi.exe
  2⤵
  PID:5352
- C:\Windows\System\BDecqNq.exe
  C:\Windows\System\BDecqNq.exe
  2⤵
  PID:5372
- C:\Windows\System\jNrFKVe.exe
  C:\Windows\System\jNrFKVe.exe
  2⤵
  PID:5388
- C:\Windows\System\ZGCunLA.exe
  C:\Windows\System\ZGCunLA.exe
  2⤵
  PID:5408
- C:\Windows\System\saDROPX.exe
  C:\Windows\System\saDROPX.exe
  2⤵
  PID:5428
- C:\Windows\System\FwmFkyI.exe
  C:\Windows\System\FwmFkyI.exe
  2⤵
  PID:5444
- C:\Windows\System\vgMdoWb.exe
  C:\Windows\System\vgMdoWb.exe
  2⤵
  PID:5464
- C:\Windows\System\nEFRsbn.exe
  C:\Windows\System\nEFRsbn.exe
  2⤵
  PID:5484
- C:\Windows\System\bUHgevP.exe
  C:\Windows\System\bUHgevP.exe
  2⤵
  PID:5500
- C:\Windows\System\kfOXbNs.exe
  C:\Windows\System\kfOXbNs.exe
  2⤵
  PID:5520
- C:\Windows\System\xWOYAcD.exe
  C:\Windows\System\xWOYAcD.exe
  2⤵
  PID:5540
- C:\Windows\System\OhCjJFh.exe
  C:\Windows\System\OhCjJFh.exe
  2⤵
  PID:5560
- C:\Windows\System\ealxClX.exe
  C:\Windows\System\ealxClX.exe
  2⤵
  PID:5580
- C:\Windows\System\aecfZly.exe
  C:\Windows\System\aecfZly.exe
  2⤵
  PID:5596
- C:\Windows\System\uZVkuLk.exe
  C:\Windows\System\uZVkuLk.exe
  2⤵
  PID:5620
- C:\Windows\System\nJrVHZy.exe
  C:\Windows\System\nJrVHZy.exe
  2⤵
  PID:5636
- C:\Windows\System\OvnVJhd.exe
  C:\Windows\System\OvnVJhd.exe
  2⤵
  PID:5652
- C:\Windows\System\FyOUSMw.exe
  C:\Windows\System\FyOUSMw.exe
  2⤵
  PID:5668
- C:\Windows\System\gTLuQwc.exe
  C:\Windows\System\gTLuQwc.exe
  2⤵
  PID:5684
- C:\Windows\System\ONPLGBM.exe
  C:\Windows\System\ONPLGBM.exe
  2⤵
  PID:5700
- C:\Windows\System\KYnllBr.exe
  C:\Windows\System\KYnllBr.exe
  2⤵
  PID:5716
- C:\Windows\System\aStgpXb.exe
  C:\Windows\System\aStgpXb.exe
  2⤵
  PID:5900
- C:\Windows\System\DvFpVEq.exe
  C:\Windows\System\DvFpVEq.exe
  2⤵
  PID:5916
- C:\Windows\System\sgyhGJc.exe
  C:\Windows\System\sgyhGJc.exe
  2⤵
  PID:5932
- C:\Windows\System\qvKIWgM.exe
  C:\Windows\System\qvKIWgM.exe
  2⤵
  PID:5948
- C:\Windows\System\LVwIrSX.exe
  C:\Windows\System\LVwIrSX.exe
  2⤵
  PID:5964
- C:\Windows\System\asESicp.exe
  C:\Windows\System\asESicp.exe
  2⤵
  PID:5980
- C:\Windows\System\BPTgEpO.exe
  C:\Windows\System\BPTgEpO.exe
  2⤵
  PID:5996
- C:\Windows\System\VWzigsa.exe
  C:\Windows\System\VWzigsa.exe
  2⤵
  PID:6012
- C:\Windows\System\ekKmzOY.exe
  C:\Windows\System\ekKmzOY.exe
  2⤵
  PID:6028
- C:\Windows\System\wZqChQG.exe
  C:\Windows\System\wZqChQG.exe
  2⤵
  PID:6044
- C:\Windows\System\exVCEUW.exe
  C:\Windows\System\exVCEUW.exe
  2⤵
  PID:6060
- C:\Windows\System\CKdfQio.exe
  C:\Windows\System\CKdfQio.exe
  2⤵
  PID:6076
- C:\Windows\System\QIzesdr.exe
  C:\Windows\System\QIzesdr.exe
  2⤵
  PID:6092
- C:\Windows\System\zhPoXbg.exe
  C:\Windows\System\zhPoXbg.exe
  2⤵
  PID:6108
- C:\Windows\System\orJDiae.exe
  C:\Windows\System\orJDiae.exe
  2⤵
  PID:6124
- C:\Windows\System\fftYkKI.exe
  C:\Windows\System\fftYkKI.exe
  2⤵
  PID:6140
- C:\Windows\System\PnqPRFP.exe
  C:\Windows\System\PnqPRFP.exe
  2⤵
  PID:4872
- C:\Windows\System\VFdweQR.exe
  C:\Windows\System\VFdweQR.exe
  2⤵
  PID:2632
- C:\Windows\System\YtMKtUr.exe
  C:\Windows\System\YtMKtUr.exe
  2⤵
  PID:1640
- C:\Windows\System\uIeFXHD.exe
  C:\Windows\System\uIeFXHD.exe
  2⤵
  PID:5144
- C:\Windows\System\gSvomOe.exe
  C:\Windows\System\gSvomOe.exe
  2⤵
  PID:5208
- C:\Windows\System\IcsTiVQ.exe
  C:\Windows\System\IcsTiVQ.exe
  2⤵
  PID:5272
- C:\Windows\System\yOxtzHF.exe
  C:\Windows\System\yOxtzHF.exe
  2⤵
  PID:5308
- C:\Windows\System\WJJBpTr.exe
  C:\Windows\System\WJJBpTr.exe
  2⤵
  PID:5384
- C:\Windows\System\RvvIcCK.exe
  C:\Windows\System\RvvIcCK.exe
  2⤵
  PID:5452
- C:\Windows\System\uNiJRjk.exe
  C:\Windows\System\uNiJRjk.exe
  2⤵
  PID:5492
- C:\Windows\System\jPNhwcJ.exe
  C:\Windows\System\jPNhwcJ.exe
  2⤵
  PID:5536
- C:\Windows\System\UtehkNf.exe
  C:\Windows\System\UtehkNf.exe
  2⤵
  PID:5576
- C:\Windows\System\dctYlyl.exe
  C:\Windows\System\dctYlyl.exe
  2⤵
  PID:5616
- C:\Windows\System\jTrZHZT.exe
  C:\Windows\System\jTrZHZT.exe
  2⤵
  PID:5680
- C:\Windows\System\majHyqL.exe
  C:\Windows\System\majHyqL.exe
  2⤵
  PID:5480
- C:\Windows\System\TRscZRc.exe
  C:\Windows\System\TRscZRc.exe
  2⤵
  PID:4780
- C:\Windows\System\pSRqGaa.exe
  C:\Windows\System\pSRqGaa.exe
  2⤵
  PID:4828
- C:\Windows\System\TybqQnC.exe
  C:\Windows\System\TybqQnC.exe
  2⤵
  PID:2500
- C:\Windows\System\ghFLFMp.exe
  C:\Windows\System\ghFLFMp.exe
  2⤵
  PID:4292
- C:\Windows\System\hqkOfYl.exe
  C:\Windows\System\hqkOfYl.exe
  2⤵
  PID:4232
- C:\Windows\System\VekdjBN.exe
  C:\Windows\System\VekdjBN.exe
  2⤵
  PID:4476
- C:\Windows\System\HkdTmJd.exe
  C:\Windows\System\HkdTmJd.exe
  2⤵
  PID:4584
- C:\Windows\System\lqKKnec.exe
  C:\Windows\System\lqKKnec.exe
  2⤵
  PID:2152
- C:\Windows\System\JhISSss.exe
  C:\Windows\System\JhISSss.exe
  2⤵
  PID:4312
- C:\Windows\System\oHPvgXs.exe
  C:\Windows\System\oHPvgXs.exe
  2⤵
  PID:5164
- C:\Windows\System\oqxHvAO.exe
  C:\Windows\System\oqxHvAO.exe
  2⤵
  PID:5228
- C:\Windows\System\PQZWnVI.exe
  C:\Windows\System\PQZWnVI.exe
  2⤵
  PID:5292
- C:\Windows\System\JYEEXKQ.exe
  C:\Windows\System\JYEEXKQ.exe
  2⤵
  PID:5364
- C:\Windows\System\rLpEQvd.exe
  C:\Windows\System\rLpEQvd.exe
  2⤵
  PID:5436
- C:\Windows\System\oxWMDFv.exe
  C:\Windows\System\oxWMDFv.exe
  2⤵
  PID:5508
- C:\Windows\System\kmNZWEa.exe
  C:\Windows\System\kmNZWEa.exe
  2⤵
  PID:5556
- C:\Windows\System\TLicupG.exe
  C:\Windows\System\TLicupG.exe
  2⤵
  PID:5628
- C:\Windows\System\VNLRcot.exe
  C:\Windows\System\VNLRcot.exe
  2⤵
  PID:5724
- C:\Windows\System\hifpSWK.exe
  C:\Windows\System\hifpSWK.exe
  2⤵
  PID:5744
- C:\Windows\System\ixOzeoI.exe
  C:\Windows\System\ixOzeoI.exe
  2⤵
  PID:5760
- C:\Windows\System\iuAiVdZ.exe
  C:\Windows\System\iuAiVdZ.exe
  2⤵
  PID:5776
- C:\Windows\System\wnnpAIS.exe
  C:\Windows\System\wnnpAIS.exe
  2⤵
  PID:5792
- C:\Windows\System\xljRzFk.exe
  C:\Windows\System\xljRzFk.exe
  2⤵
  PID:5808
- C:\Windows\System\btXmpff.exe
  C:\Windows\System\btXmpff.exe
  2⤵
  PID:5824
- C:\Windows\System\TphPEut.exe
  C:\Windows\System\TphPEut.exe
  2⤵
  PID:5840
- C:\Windows\System\QeTfJIO.exe
  C:\Windows\System\QeTfJIO.exe
  2⤵
  PID:5856
- C:\Windows\System\dHDCEuH.exe
  C:\Windows\System\dHDCEuH.exe
  2⤵
  PID:5872
- C:\Windows\System\bURciaR.exe
  C:\Windows\System\bURciaR.exe
  2⤵
  PID:5892
- C:\Windows\System\xFuvPtJ.exe
  C:\Windows\System\xFuvPtJ.exe
  2⤵
  PID:5912
- C:\Windows\System\fCPBYtR.exe
  C:\Windows\System\fCPBYtR.exe
  2⤵
  PID:5976
- C:\Windows\System\sRoDvrt.exe
  C:\Windows\System\sRoDvrt.exe
  2⤵
  PID:6040
- C:\Windows\System\prwJUzs.exe
  C:\Windows\System\prwJUzs.exe
  2⤵
  PID:6100
- C:\Windows\System\KupWZfY.exe
  C:\Windows\System\KupWZfY.exe
  2⤵
  PID:5956
- C:\Windows\System\qfcObHs.exe
  C:\Windows\System\qfcObHs.exe
  2⤵
  PID:6020
- C:\Windows\System\HHkdHgg.exe
  C:\Windows\System\HHkdHgg.exe
  2⤵
  PID:6084
- C:\Windows\System\mPdfZpM.exe
  C:\Windows\System\mPdfZpM.exe
  2⤵
  PID:4708
- C:\Windows\System\UpFjOCe.exe
  C:\Windows\System\UpFjOCe.exe
  2⤵
  PID:876
- C:\Windows\System\NFgIgiH.exe
  C:\Windows\System\NFgIgiH.exe
  2⤵
  PID:4964
- C:\Windows\System\tEhxmfw.exe
  C:\Windows\System\tEhxmfw.exe
  2⤵
  PID:1984
- C:\Windows\System\dnyhWgd.exe
  C:\Windows\System\dnyhWgd.exe
  2⤵
  PID:5344
- C:\Windows\System\sSsuCCW.exe
  C:\Windows\System\sSsuCCW.exe
  2⤵
  PID:5456
- C:\Windows\System\oWoRusK.exe
  C:\Windows\System\oWoRusK.exe
  2⤵
  PID:5648
- C:\Windows\System\oZeXDua.exe
  C:\Windows\System\oZeXDua.exe
  2⤵
  PID:1624
- C:\Windows\System\RuQzXnQ.exe
  C:\Windows\System\RuQzXnQ.exe
  2⤵
  PID:1968
- C:\Windows\System\VMeXQcJ.exe
  C:\Windows\System\VMeXQcJ.exe
  2⤵
  PID:1992
- C:\Windows\System\JMhGufH.exe
  C:\Windows\System\JMhGufH.exe
  2⤵
  PID:5360
- C:\Windows\System\xPnQdSr.exe
  C:\Windows\System\xPnQdSr.exe
  2⤵
  PID:5876
- C:\Windows\System\CUIGClN.exe
  C:\Windows\System\CUIGClN.exe
  2⤵
  PID:5420
- C:\Windows\System\bnVYCDx.exe
  C:\Windows\System\bnVYCDx.exe
  2⤵
  PID:5608
- C:\Windows\System\hjNITsH.exe
  C:\Windows\System\hjNITsH.exe
  2⤵
  PID:2272
- C:\Windows\System\kmizDhD.exe
  C:\Windows\System\kmizDhD.exe
  2⤵
  PID:5512
- C:\Windows\System\coOQsAq.exe
  C:\Windows\System\coOQsAq.exe
  2⤵
  PID:5768
- C:\Windows\System\grTrXXR.exe
  C:\Windows\System\grTrXXR.exe
  2⤵
  PID:5832
- C:\Windows\System\lfCXwJT.exe
  C:\Windows\System\lfCXwJT.exe
  2⤵
  PID:5664
- C:\Windows\System\GPAONoQ.exe
  C:\Windows\System\GPAONoQ.exe
  2⤵
  PID:5404
- C:\Windows\System\ldAKlFW.exe
  C:\Windows\System\ldAKlFW.exe
  2⤵
  PID:5160
- C:\Windows\System\RckqGuZ.exe
  C:\Windows\System\RckqGuZ.exe
  2⤵
  PID:4504
- C:\Windows\System\GxazNAD.exe
  C:\Windows\System\GxazNAD.exe
  2⤵
  PID:6008
- C:\Windows\System\NsDrwVQ.exe
  C:\Windows\System\NsDrwVQ.exe
  2⤵
  PID:5788
- C:\Windows\System\PDumKjw.exe
  C:\Windows\System\PDumKjw.exe
  2⤵
  PID:5848
- C:\Windows\System\UGrVUqm.exe
  C:\Windows\System\UGrVUqm.exe
  2⤵
  PID:5944
- C:\Windows\System\ufuPWZK.exe
  C:\Windows\System\ufuPWZK.exe
  2⤵
  PID:5988
- C:\Windows\System\UDkMnCW.exe
  C:\Windows\System\UDkMnCW.exe
  2⤵
  PID:5924
- C:\Windows\System\pxQgdnA.exe
  C:\Windows\System\pxQgdnA.exe
  2⤵
  PID:1280
- C:\Windows\System\gJjFCHH.exe
  C:\Windows\System\gJjFCHH.exe
  2⤵
  PID:5380
- C:\Windows\System\ffiafOu.exe
  C:\Windows\System\ffiafOu.exe
  2⤵
  PID:3572
- C:\Windows\System\UChINLn.exe
  C:\Windows\System\UChINLn.exe
  2⤵
  PID:5244
- C:\Windows\System\WOFNiLn.exe
  C:\Windows\System\WOFNiLn.exe
  2⤵
  PID:5240
- C:\Windows\System\ahzpQRP.exe
  C:\Windows\System\ahzpQRP.exe
  2⤵
  PID:5800
- C:\Windows\System\TEmpRMU.exe
  C:\Windows\System\TEmpRMU.exe
  2⤵
  PID:5572
- C:\Windows\System\wAxkthp.exe
  C:\Windows\System\wAxkthp.exe
  2⤵
  PID:3812
- C:\Windows\System\XdzQTdd.exe
  C:\Windows\System\XdzQTdd.exe
  2⤵
  PID:5296
- C:\Windows\System\bNwKQXJ.exe
  C:\Windows\System\bNwKQXJ.exe
  2⤵
  PID:6132
- C:\Windows\System\iexSFcX.exe
  C:\Windows\System\iexSFcX.exe
  2⤵
  PID:5592
- C:\Windows\System\zIKMBEz.exe
  C:\Windows\System\zIKMBEz.exe
  2⤵
  PID:5260
- C:\Windows\System\MIbeCyy.exe
  C:\Windows\System\MIbeCyy.exe
  2⤵
  PID:5908
- C:\Windows\System\xajOuso.exe
  C:\Windows\System\xajOuso.exe
  2⤵
  PID:2660
- C:\Windows\System\CkvSaeN.exe
  C:\Windows\System\CkvSaeN.exe
  2⤵
  PID:5660
- C:\Windows\System\CFeEPbo.exe
  C:\Windows\System\CFeEPbo.exe
  2⤵
  PID:5712
- C:\Windows\System\KNLvCJC.exe
  C:\Windows\System\KNLvCJC.exe
  2⤵
  PID:5784
- C:\Windows\System\zSroVJx.exe
  C:\Windows\System\zSroVJx.exe
  2⤵
  PID:5288
- C:\Windows\System\IBPlgPI.exe
  C:\Windows\System\IBPlgPI.exe
  2⤵
  PID:5736
- C:\Windows\System\KGnmVPX.exe
  C:\Windows\System\KGnmVPX.exe
  2⤵
  PID:4488
- C:\Windows\System\eipaqwN.exe
  C:\Windows\System\eipaqwN.exe
  2⤵
  PID:6160
- C:\Windows\System\wDCUdgB.exe
  C:\Windows\System\wDCUdgB.exe
  2⤵
  PID:6176
- C:\Windows\System\OvnhUJR.exe
  C:\Windows\System\OvnhUJR.exe
  2⤵
  PID:6192
- C:\Windows\System\uEOPJVc.exe
  C:\Windows\System\uEOPJVc.exe
  2⤵
  PID:6208
- C:\Windows\System\HrcEGFL.exe
  C:\Windows\System\HrcEGFL.exe
  2⤵
  PID:6224
- C:\Windows\System\BMvTBqf.exe
  C:\Windows\System\BMvTBqf.exe
  2⤵
  PID:6240
- C:\Windows\System\BhbyLpN.exe
  C:\Windows\System\BhbyLpN.exe
  2⤵
  PID:6256
- C:\Windows\System\yUscnqE.exe
  C:\Windows\System\yUscnqE.exe
  2⤵
  PID:6272
- C:\Windows\System\tAhYoGM.exe
  C:\Windows\System\tAhYoGM.exe
  2⤵
  PID:6288
- C:\Windows\System\DatpTWX.exe
  C:\Windows\System\DatpTWX.exe
  2⤵
  PID:6304
- C:\Windows\System\uRXzFVh.exe
  C:\Windows\System\uRXzFVh.exe
  2⤵
  PID:6320
- C:\Windows\System\azSHdkm.exe
  C:\Windows\System\azSHdkm.exe
  2⤵
  PID:6336
- C:\Windows\System\kkGeQvh.exe
  C:\Windows\System\kkGeQvh.exe
  2⤵
  PID:6352
- C:\Windows\System\kFRvkIZ.exe
  C:\Windows\System\kFRvkIZ.exe
  2⤵
  PID:6368
- C:\Windows\System\tQjECXv.exe
  C:\Windows\System\tQjECXv.exe
  2⤵
  PID:6384
- C:\Windows\System\JOwWHgk.exe
  C:\Windows\System\JOwWHgk.exe
  2⤵
  PID:6400
- C:\Windows\System\hXyaMTt.exe
  C:\Windows\System\hXyaMTt.exe
  2⤵
  PID:6416
- C:\Windows\System\YaTBAxF.exe
  C:\Windows\System\YaTBAxF.exe
  2⤵
  PID:6432
- C:\Windows\System\QFnVDIw.exe
  C:\Windows\System\QFnVDIw.exe
  2⤵
  PID:6448
- C:\Windows\System\oQopZIQ.exe
  C:\Windows\System\oQopZIQ.exe
  2⤵
  PID:6464
- C:\Windows\System\lKVFqrJ.exe
  C:\Windows\System\lKVFqrJ.exe
  2⤵
  PID:6480
- C:\Windows\System\BHqwcvn.exe
  C:\Windows\System\BHqwcvn.exe
  2⤵
  PID:6496
- C:\Windows\System\eGrnfCm.exe
  C:\Windows\System\eGrnfCm.exe
  2⤵
  PID:6512
- C:\Windows\System\ijjbqAJ.exe
  C:\Windows\System\ijjbqAJ.exe
  2⤵
  PID:6528
- C:\Windows\System\NHBayti.exe
  C:\Windows\System\NHBayti.exe
  2⤵
  PID:6544
- C:\Windows\System\benfGyE.exe
  C:\Windows\System\benfGyE.exe
  2⤵
  PID:6560
- C:\Windows\System\qFeaoQy.exe
  C:\Windows\System\qFeaoQy.exe
  2⤵
  PID:6576
- C:\Windows\System\wNAxrUa.exe
  C:\Windows\System\wNAxrUa.exe
  2⤵
  PID:6592
- C:\Windows\System\gdaUnwe.exe
  C:\Windows\System\gdaUnwe.exe
  2⤵
  PID:6608
- C:\Windows\System\fArpDnP.exe
  C:\Windows\System\fArpDnP.exe
  2⤵
  PID:6624
- C:\Windows\System\iOrajLk.exe
  C:\Windows\System\iOrajLk.exe
  2⤵
  PID:6640
- C:\Windows\System\eOMNxmv.exe
  C:\Windows\System\eOMNxmv.exe
  2⤵
  PID:6656
- C:\Windows\System\YwnRXjh.exe
  C:\Windows\System\YwnRXjh.exe
  2⤵
  PID:6672
- C:\Windows\System\qtRRzwO.exe
  C:\Windows\System\qtRRzwO.exe
  2⤵
  PID:6688
- C:\Windows\System\rWmniWY.exe
  C:\Windows\System\rWmniWY.exe
  2⤵
  PID:6704
- C:\Windows\System\CLezmNY.exe
  C:\Windows\System\CLezmNY.exe
  2⤵
  PID:6720
- C:\Windows\System\SivuZvu.exe
  C:\Windows\System\SivuZvu.exe
  2⤵
  PID:6736
- C:\Windows\System\CkONHDf.exe
  C:\Windows\System\CkONHDf.exe
  2⤵
  PID:6752
- C:\Windows\System\bVeSfHP.exe
  C:\Windows\System\bVeSfHP.exe
  2⤵
  PID:6768
- C:\Windows\System\OHtMwjW.exe
  C:\Windows\System\OHtMwjW.exe
  2⤵
  PID:6784
- C:\Windows\System\TPqyvQH.exe
  C:\Windows\System\TPqyvQH.exe
  2⤵
  PID:6800
- C:\Windows\System\oKIxGbc.exe
  C:\Windows\System\oKIxGbc.exe
  2⤵
  PID:6816
- C:\Windows\System\kUsMbGT.exe
  C:\Windows\System\kUsMbGT.exe
  2⤵
  PID:6832
- C:\Windows\System\uEQonvx.exe
  C:\Windows\System\uEQonvx.exe
  2⤵
  PID:6848
- C:\Windows\System\rLZCVwv.exe
  C:\Windows\System\rLZCVwv.exe
  2⤵
  PID:6864
- C:\Windows\System\qWAkznO.exe
  C:\Windows\System\qWAkznO.exe
  2⤵
  PID:6880
- C:\Windows\System\MOCdMeN.exe
  C:\Windows\System\MOCdMeN.exe
  2⤵
  PID:6896
- C:\Windows\System\Qkmavji.exe
  C:\Windows\System\Qkmavji.exe
  2⤵
  PID:6912
- C:\Windows\System\SwLlihS.exe
  C:\Windows\System\SwLlihS.exe
  2⤵
  PID:6928
- C:\Windows\System\OfiLqCj.exe
  C:\Windows\System\OfiLqCj.exe
  2⤵
  PID:6944
- C:\Windows\System\HXhbaaz.exe
  C:\Windows\System\HXhbaaz.exe
  2⤵
  PID:6960
- C:\Windows\System\tAnEsMo.exe
  C:\Windows\System\tAnEsMo.exe
  2⤵
  PID:6976
- C:\Windows\System\IzUaxVN.exe
  C:\Windows\System\IzUaxVN.exe
  2⤵
  PID:6992
- C:\Windows\System\yiqjSGG.exe
  C:\Windows\System\yiqjSGG.exe
  2⤵
  PID:7008
- C:\Windows\System\nokAWwU.exe
  C:\Windows\System\nokAWwU.exe
  2⤵
  PID:7024
- C:\Windows\System\dIesBRz.exe
  C:\Windows\System\dIesBRz.exe
  2⤵
  PID:7040
- C:\Windows\System\ftrslJE.exe
  C:\Windows\System\ftrslJE.exe
  2⤵
  PID:7056
- C:\Windows\System\FnGzquG.exe
  C:\Windows\System\FnGzquG.exe
  2⤵
  PID:7072
- C:\Windows\System\ClSqrVk.exe
  C:\Windows\System\ClSqrVk.exe
  2⤵
  PID:7088
- C:\Windows\System\GJZmCEN.exe
  C:\Windows\System\GJZmCEN.exe
  2⤵
  PID:7104
- C:\Windows\System\kTlZgSF.exe
  C:\Windows\System\kTlZgSF.exe
  2⤵
  PID:7120
- C:\Windows\System\gBGSsEJ.exe
  C:\Windows\System\gBGSsEJ.exe
  2⤵
  PID:7136
- C:\Windows\System\iHsIaLY.exe
  C:\Windows\System\iHsIaLY.exe
  2⤵
  PID:7152
- C:\Windows\System\FVyWCtj.exe
  C:\Windows\System\FVyWCtj.exe
  2⤵
  PID:4076
- C:\Windows\System\PwfoKCy.exe
  C:\Windows\System\PwfoKCy.exe
  2⤵
  PID:1644
- C:\Windows\System\xTohuwO.exe
  C:\Windows\System\xTohuwO.exe
  2⤵
  PID:6156
- C:\Windows\System\FoEebxk.exe
  C:\Windows\System\FoEebxk.exe
  2⤵
  PID:6200
- C:\Windows\System\VQXvWwF.exe
  C:\Windows\System\VQXvWwF.exe
  2⤵
  PID:6264
- C:\Windows\System\SgRugUG.exe
  C:\Windows\System\SgRugUG.exe
  2⤵
  PID:6184
- C:\Windows\System\dUoEFgh.exe
  C:\Windows\System\dUoEFgh.exe
  2⤵
  PID:6392
- C:\Windows\System\hmKpSmu.exe
  C:\Windows\System\hmKpSmu.exe
  2⤵
  PID:6248
- C:\Windows\System\jUmVMzb.exe
  C:\Windows\System\jUmVMzb.exe
  2⤵
  PID:6312
- C:\Windows\System\kcgyVFr.exe
  C:\Windows\System\kcgyVFr.exe
  2⤵
  PID:6376
- C:\Windows\System\kZMezjs.exe
  C:\Windows\System\kZMezjs.exe
  2⤵
  PID:6444
- C:\Windows\System\uulDILG.exe
  C:\Windows\System\uulDILG.exe
  2⤵
  PID:6424
- C:\Windows\System\QGyQewQ.exe
  C:\Windows\System\QGyQewQ.exe
  2⤵
  PID:6472
- C:\Windows\System\qvXPcDR.exe
  C:\Windows\System\qvXPcDR.exe
  2⤵
  PID:6536
- C:\Windows\System\uIwfCwG.exe
  C:\Windows\System\uIwfCwG.exe
  2⤵
  PID:6568
- C:\Windows\System\vyJdeAo.exe
  C:\Windows\System\vyJdeAo.exe
  2⤵
  PID:6632
- C:\Windows\System\zMDOvFy.exe
  C:\Windows\System\zMDOvFy.exe
  2⤵
  PID:6696
- C:\Windows\System\uPRTlES.exe
  C:\Windows\System\uPRTlES.exe
  2⤵
  PID:6616
- C:\Windows\System\YhSzuRK.exe
  C:\Windows\System\YhSzuRK.exe
  2⤵
  PID:6712
- C:\Windows\System\gCYwGxt.exe
  C:\Windows\System\gCYwGxt.exe
  2⤵
  PID:6552
- C:\Windows\System\kByjPNb.exe
  C:\Windows\System\kByjPNb.exe
  2⤵
  PID:6584
- C:\Windows\System\zIIgqvw.exe
  C:\Windows\System\zIIgqvw.exe
  2⤵
  PID:6652
- C:\Windows\System\TIrYBzk.exe
  C:\Windows\System\TIrYBzk.exe
  2⤵
  PID:6812
- C:\Windows\System\XZlICFI.exe
  C:\Windows\System\XZlICFI.exe
  2⤵
  PID:6828
- C:\Windows\System\cFsnyuB.exe
  C:\Windows\System\cFsnyuB.exe
  2⤵
  PID:6920
- C:\Windows\System\PMonLeA.exe
  C:\Windows\System\PMonLeA.exe
  2⤵
  PID:6860
- C:\Windows\System\vdwiFUx.exe
  C:\Windows\System\vdwiFUx.exe
  2⤵
  PID:6984
- C:\Windows\System\BfQVoge.exe
  C:\Windows\System\BfQVoge.exe
  2⤵
  PID:6904
- C:\Windows\System\UkorYwK.exe
  C:\Windows\System\UkorYwK.exe
  2⤵
  PID:6972
- C:\Windows\System\FUpyNoK.exe
  C:\Windows\System\FUpyNoK.exe
  2⤵
  PID:6876
- C:\Windows\System\xqDAbVI.exe
  C:\Windows\System\xqDAbVI.exe
  2⤵
  PID:7064
- C:\Windows\System\aLajbDg.exe
  C:\Windows\System\aLajbDg.exe
  2⤵
  PID:7128
- C:\Windows\System\fkxHQom.exe
  C:\Windows\System\fkxHQom.exe
  2⤵
  PID:6056
- C:\Windows\System\uIxDktc.exe
  C:\Windows\System\uIxDktc.exe
  2⤵
  PID:7080
- C:\Windows\System\mWfidSF.exe
  C:\Windows\System\mWfidSF.exe
  2⤵
  PID:7144
- C:\Windows\System\zdUWrpN.exe
  C:\Windows\System\zdUWrpN.exe
  2⤵
  PID:6172
- C:\Windows\System\XrWCPBh.exe
  C:\Windows\System\XrWCPBh.exe
  2⤵
  PID:6232
- C:\Windows\System\OXTFOjH.exe
  C:\Windows\System\OXTFOjH.exe
  2⤵
  PID:6280
- C:\Windows\System\YExdCSl.exe
  C:\Windows\System\YExdCSl.exe
  2⤵
  PID:6456
- C:\Windows\System\WXptLCF.exe
  C:\Windows\System\WXptLCF.exe
  2⤵
  PID:6664
- C:\Windows\System\nMPRROO.exe
  C:\Windows\System\nMPRROO.exe
  2⤵
  PID:6344
- C:\Windows\System\RXrjYEL.exe
  C:\Windows\System\RXrjYEL.exe
  2⤵
  PID:6348
- C:\Windows\System\mEFwBAT.exe
  C:\Windows\System\mEFwBAT.exe
  2⤵
  PID:6504
- C:\Windows\System\rBlbKpr.exe
  C:\Windows\System\rBlbKpr.exe
  2⤵
  PID:6744
- C:\Windows\System\VdtOhed.exe
  C:\Windows\System\VdtOhed.exe
  2⤵
  PID:6844
- C:\Windows\System\pEnuyuw.exe
  C:\Windows\System\pEnuyuw.exe
  2⤵
  PID:7016
- C:\Windows\System\pswcLKS.exe
  C:\Windows\System\pswcLKS.exe
  2⤵
  PID:7096
- C:\Windows\System\HQjADfR.exe
  C:\Windows\System\HQjADfR.exe
  2⤵
  PID:5176
- C:\Windows\System\nFUwedz.exe
  C:\Windows\System\nFUwedz.exe
  2⤵
  PID:6952
- C:\Windows\System\bPreNtd.exe
  C:\Windows\System\bPreNtd.exe
  2⤵
  PID:6908
- C:\Windows\System\CzptQUu.exe
  C:\Windows\System\CzptQUu.exe
  2⤵
  PID:6520
- C:\Windows\System\gifLTaW.exe
  C:\Windows\System\gifLTaW.exe
  2⤵
  PID:6296
- C:\Windows\System\ViUNRKU.exe
  C:\Windows\System\ViUNRKU.exe
  2⤵
  PID:6412
- C:\Windows\System\dgusgyr.exe
  C:\Windows\System\dgusgyr.exe
  2⤵
  PID:6540
- C:\Windows\System\eomxKjP.exe
  C:\Windows\System\eomxKjP.exe
  2⤵
  PID:6604
- C:\Windows\System\QMvVVqP.exe
  C:\Windows\System\QMvVVqP.exe
  2⤵
  PID:7048
- C:\Windows\System\vankZVs.exe
  C:\Windows\System\vankZVs.exe
  2⤵
  PID:6396
- C:\Windows\System\DDVTKLO.exe
  C:\Windows\System\DDVTKLO.exe
  2⤵
  PID:7004
- C:\Windows\System\XSdczhe.exe
  C:\Windows\System\XSdczhe.exe
  2⤵
  PID:7160
- C:\Windows\System\zXHDXyA.exe
  C:\Windows\System\zXHDXyA.exe
  2⤵
  PID:6588
- C:\Windows\System\euqdwUz.exe
  C:\Windows\System\euqdwUz.exe
  2⤵
  PID:7184
- C:\Windows\System\IXELCtF.exe
  C:\Windows\System\IXELCtF.exe
  2⤵
  PID:7200
- C:\Windows\System\aBaadmM.exe
  C:\Windows\System\aBaadmM.exe
  2⤵
  PID:7216
- C:\Windows\System\wMtTybf.exe
  C:\Windows\System\wMtTybf.exe
  2⤵
  PID:7232
- C:\Windows\System\YXCunXt.exe
  C:\Windows\System\YXCunXt.exe
  2⤵
  PID:7248
- C:\Windows\System\dvCHdjL.exe
  C:\Windows\System\dvCHdjL.exe
  2⤵
  PID:7264
- C:\Windows\System\FJGuIQi.exe
  C:\Windows\System\FJGuIQi.exe
  2⤵
  PID:7280
- C:\Windows\System\VRzVdkX.exe
  C:\Windows\System\VRzVdkX.exe
  2⤵
  PID:7296
- C:\Windows\System\EEOUeRt.exe
  C:\Windows\System\EEOUeRt.exe
  2⤵
  PID:7312
- C:\Windows\System\sPrPTMC.exe
  C:\Windows\System\sPrPTMC.exe
  2⤵
  PID:7328
- C:\Windows\System\NNufkpD.exe
  C:\Windows\System\NNufkpD.exe
  2⤵
  PID:7344
- C:\Windows\System\UCmDerh.exe
  C:\Windows\System\UCmDerh.exe
  2⤵
  PID:7360
- C:\Windows\System\LewaqEg.exe
  C:\Windows\System\LewaqEg.exe
  2⤵
  PID:7376
- C:\Windows\System\htsahSK.exe
  C:\Windows\System\htsahSK.exe
  2⤵
  PID:7392
- C:\Windows\System\UHLXQxa.exe
  C:\Windows\System\UHLXQxa.exe
  2⤵
  PID:7408
- C:\Windows\System\UHxQvoD.exe
  C:\Windows\System\UHxQvoD.exe
  2⤵
  PID:7424
- C:\Windows\System\AVNzWqp.exe
  C:\Windows\System\AVNzWqp.exe
  2⤵
  PID:7440
- C:\Windows\System\fpVounL.exe
  C:\Windows\System\fpVounL.exe
  2⤵
  PID:7456
- C:\Windows\System\hQQUEGc.exe
  C:\Windows\System\hQQUEGc.exe
  2⤵
  PID:7472
- C:\Windows\System\ggASvxr.exe
  C:\Windows\System\ggASvxr.exe
  2⤵
  PID:7488
- C:\Windows\System\sMnZFGO.exe
  C:\Windows\System\sMnZFGO.exe
  2⤵
  PID:7504
- C:\Windows\System\PsOtCrz.exe
  C:\Windows\System\PsOtCrz.exe
  2⤵
  PID:7520
- C:\Windows\System\HDRFplC.exe
  C:\Windows\System\HDRFplC.exe
  2⤵
  PID:7536
- C:\Windows\System\lXHxQsq.exe
  C:\Windows\System\lXHxQsq.exe
  2⤵
  PID:7552
- C:\Windows\System\mntLAYX.exe
  C:\Windows\System\mntLAYX.exe
  2⤵
  PID:7568
- C:\Windows\System\BokIscF.exe
  C:\Windows\System\BokIscF.exe
  2⤵
  PID:7584
- C:\Windows\System\WuWuFWO.exe
  C:\Windows\System\WuWuFWO.exe
  2⤵
  PID:7600
- C:\Windows\System\juAypZB.exe
  C:\Windows\System\juAypZB.exe
  2⤵
  PID:7616
- C:\Windows\System\NFlLjao.exe
  C:\Windows\System\NFlLjao.exe
  2⤵
  PID:7632
- C:\Windows\System\tCtZcZb.exe
  C:\Windows\System\tCtZcZb.exe
  2⤵
  PID:7648
- C:\Windows\System\vspxEzg.exe
  C:\Windows\System\vspxEzg.exe
  2⤵
  PID:7664
- C:\Windows\System\sBIFkLC.exe
  C:\Windows\System\sBIFkLC.exe
  2⤵
  PID:7680
- C:\Windows\System\VUfzXfV.exe
  C:\Windows\System\VUfzXfV.exe
  2⤵
  PID:7696
- C:\Windows\System\ZxjcwxT.exe
  C:\Windows\System\ZxjcwxT.exe
  2⤵
  PID:7712
- C:\Windows\System\YghYmSZ.exe
  C:\Windows\System\YghYmSZ.exe
  2⤵
  PID:7728
- C:\Windows\System\lMhrJDq.exe
  C:\Windows\System\lMhrJDq.exe
  2⤵
  PID:7744
- C:\Windows\System\ERjNEfb.exe
  C:\Windows\System\ERjNEfb.exe
  2⤵
  PID:7760
- C:\Windows\System\lpiHBJL.exe
  C:\Windows\System\lpiHBJL.exe
  2⤵
  PID:7776
- C:\Windows\System\CehqTBC.exe
  C:\Windows\System\CehqTBC.exe
  2⤵
  PID:7792
- C:\Windows\System\HlppGHi.exe
  C:\Windows\System\HlppGHi.exe
  2⤵
  PID:7808
- C:\Windows\System\YIUSDsu.exe
  C:\Windows\System\YIUSDsu.exe
  2⤵
  PID:7824
- C:\Windows\System\aNaIULv.exe
  C:\Windows\System\aNaIULv.exe
  2⤵
  PID:7840
- C:\Windows\System\cNTzxUH.exe
  C:\Windows\System\cNTzxUH.exe
  2⤵
  PID:7856
- C:\Windows\System\dxZvnqJ.exe
  C:\Windows\System\dxZvnqJ.exe
  2⤵
  PID:7872
- C:\Windows\System\iflKzFk.exe
  C:\Windows\System\iflKzFk.exe
  2⤵
  PID:7888
- C:\Windows\System\QZLNXLm.exe
  C:\Windows\System\QZLNXLm.exe
  2⤵
  PID:7904
- C:\Windows\System\ghmbZnJ.exe
  C:\Windows\System\ghmbZnJ.exe
  2⤵
  PID:7920
- C:\Windows\System\XuoncrE.exe
  C:\Windows\System\XuoncrE.exe
  2⤵
  PID:7936
- C:\Windows\System\ZetuHkU.exe
  C:\Windows\System\ZetuHkU.exe
  2⤵
  PID:7952
- C:\Windows\System\qrpfIVn.exe
  C:\Windows\System\qrpfIVn.exe
  2⤵
  PID:7968
- C:\Windows\System\xGFGKEF.exe
  C:\Windows\System\xGFGKEF.exe
  2⤵
  PID:7984
- C:\Windows\System\aJceXhz.exe
  C:\Windows\System\aJceXhz.exe
  2⤵
  PID:8000
- C:\Windows\System\tNNdbam.exe
  C:\Windows\System\tNNdbam.exe
  2⤵
  PID:8016
- C:\Windows\System\xSxOQgl.exe
  C:\Windows\System\xSxOQgl.exe
  2⤵
  PID:8032
- C:\Windows\System\wjgSsLe.exe
  C:\Windows\System\wjgSsLe.exe
  2⤵
  PID:8048
- C:\Windows\System\qibgKdZ.exe
  C:\Windows\System\qibgKdZ.exe
  2⤵
  PID:8064
- C:\Windows\System\pwGHCqg.exe
  C:\Windows\System\pwGHCqg.exe
  2⤵
  PID:8080
- C:\Windows\System\kHnxsvH.exe
  C:\Windows\System\kHnxsvH.exe
  2⤵
  PID:8096
- C:\Windows\System\YqsCSzM.exe
  C:\Windows\System\YqsCSzM.exe
  2⤵
  PID:8112
- C:\Windows\System\TjNKtkx.exe
  C:\Windows\System\TjNKtkx.exe
  2⤵
  PID:8128
- C:\Windows\System\nnwcfLE.exe
  C:\Windows\System\nnwcfLE.exe
  2⤵
  PID:8144
- C:\Windows\System\IqlQGHd.exe
  C:\Windows\System\IqlQGHd.exe
  2⤵
  PID:8160
- C:\Windows\System\NbdJpoM.exe
  C:\Windows\System\NbdJpoM.exe
  2⤵
  PID:8176
- C:\Windows\System\BiTGmCo.exe
  C:\Windows\System\BiTGmCo.exe
  2⤵
  PID:6300
- C:\Windows\System\kUZamqg.exe
  C:\Windows\System\kUZamqg.exe
  2⤵
  PID:6220
- C:\Windows\System\syvQJQU.exe
  C:\Windows\System\syvQJQU.exe
  2⤵
  PID:6856
- C:\Windows\System\dOGHGyc.exe
  C:\Windows\System\dOGHGyc.exe
  2⤵
  PID:6892
- C:\Windows\System\Bnipyog.exe
  C:\Windows\System\Bnipyog.exe
  2⤵
  PID:7180
- C:\Windows\System\WXlJNuQ.exe
  C:\Windows\System\WXlJNuQ.exe
  2⤵
  PID:7224
- C:\Windows\System\lKgTLig.exe
  C:\Windows\System\lKgTLig.exe
  2⤵
  PID:7240
- C:\Windows\System\sWYuLdM.exe
  C:\Windows\System\sWYuLdM.exe
  2⤵
  PID:7288
- C:\Windows\System\KrpWPWW.exe
  C:\Windows\System\KrpWPWW.exe
  2⤵
  PID:7352
- C:\Windows\System\ICnjepi.exe
  C:\Windows\System\ICnjepi.exe
  2⤵
  PID:7416
- C:\Windows\System\FlkwbQJ.exe
  C:\Windows\System\FlkwbQJ.exe
  2⤵
  PID:7272
- C:\Windows\System\jWDouwV.exe
  C:\Windows\System\jWDouwV.exe
  2⤵
  PID:7340
- C:\Windows\System\CEedPhO.exe
  C:\Windows\System\CEedPhO.exe
  2⤵
  PID:7400
- C:\Windows\System\DrGulxP.exe
  C:\Windows\System\DrGulxP.exe
  2⤵
  PID:7464
- C:\Windows\System\WzfoUGa.exe
  C:\Windows\System\WzfoUGa.exe
  2⤵
  PID:7612
- C:\Windows\System\vXCsjMX.exe
  C:\Windows\System\vXCsjMX.exe
  2⤵
  PID:7548
- C:\Windows\System\CFDklYg.exe
  C:\Windows\System\CFDklYg.exe
  2⤵
  PID:7644
- C:\Windows\System\VZqnRXz.exe
  C:\Windows\System\VZqnRXz.exe
  2⤵
  PID:7708
- C:\Windows\System\QaXwlUA.exe
  C:\Windows\System\QaXwlUA.exe
  2⤵
  PID:7772
- C:\Windows\System\apPWIPp.exe
  C:\Windows\System\apPWIPp.exe
  2⤵
  PID:7836
- C:\Windows\System\tYzimHx.exe
  C:\Windows\System\tYzimHx.exe
  2⤵
  PID:7788
- C:\Windows\System\XTTBAcI.exe
  C:\Windows\System\XTTBAcI.exe
  2⤵
  PID:7692
- C:\Windows\System\KFhFOel.exe
  C:\Windows\System\KFhFOel.exe
  2⤵
  PID:7688
- C:\Windows\System\RPASuuH.exe
  C:\Windows\System\RPASuuH.exe
  2⤵
  PID:7624
- C:\Windows\System\IpkzRzI.exe
  C:\Windows\System\IpkzRzI.exe
  2⤵
  PID:7532
- C:\Windows\System\ppnJgRP.exe
  C:\Windows\System\ppnJgRP.exe
  2⤵
  PID:7852
- C:\Windows\System\KSHnKOZ.exe
  C:\Windows\System\KSHnKOZ.exe
  2⤵
  PID:7916
- C:\Windows\System\SYLJMbb.exe
  C:\Windows\System\SYLJMbb.exe
  2⤵
  PID:7944
- C:\Windows\System\qfbzVFP.exe
  C:\Windows\System\qfbzVFP.exe
  2⤵
  PID:7980
- C:\Windows\System\ZTqLpGF.exe
  C:\Windows\System\ZTqLpGF.exe
  2⤵
  PID:7960
- C:\Windows\System\htkZMqN.exe
  C:\Windows\System\htkZMqN.exe
  2⤵
  PID:8024
- C:\Windows\System\vdvkBHN.exe
  C:\Windows\System\vdvkBHN.exe
  2⤵
  PID:8072
- C:\Windows\System\JwHCnkS.exe
  C:\Windows\System\JwHCnkS.exe
  2⤵
  PID:8136
- C:\Windows\System\bQvdiVh.exe
  C:\Windows\System\bQvdiVh.exe
  2⤵
  PID:8060
- C:\Windows\System\UeOxwqX.exe
  C:\Windows\System\UeOxwqX.exe
  2⤵
  PID:8124
- C:\Windows\System\LrJiJSz.exe
  C:\Windows\System\LrJiJSz.exe
  2⤵
  PID:8172
- C:\Windows\System\Diowkgq.exe
  C:\Windows\System\Diowkgq.exe
  2⤵
  PID:7112
- C:\Windows\System\IBlqNKB.exe
  C:\Windows\System\IBlqNKB.exe
  2⤵
  PID:7260
- C:\Windows\System\FnkAIrO.exe
  C:\Windows\System\FnkAIrO.exe
  2⤵
  PID:7336
- C:\Windows\System\lwHSfgJ.exe
  C:\Windows\System\lwHSfgJ.exe
  2⤵
  PID:6408
- C:\Windows\System\hRMPNoI.exe
  C:\Windows\System\hRMPNoI.exe
  2⤵
  PID:6940
- C:\Windows\System\PNMQGdH.exe
  C:\Windows\System\PNMQGdH.exe
  2⤵
  PID:7324
- C:\Windows\System\VvmzTTU.exe
  C:\Windows\System\VvmzTTU.exe
  2⤵
  PID:7436
- C:\Windows\System\Inmrvpx.exe
  C:\Windows\System\Inmrvpx.exe
  2⤵
  PID:7704
- C:\Windows\System\XtNhRCb.exe
  C:\Windows\System\XtNhRCb.exe
  2⤵
  PID:7640
- C:\Windows\System\FFPOHpM.exe
  C:\Windows\System\FFPOHpM.exe
  2⤵
  PID:7580
- C:\Windows\System\TvgmyMG.exe
  C:\Windows\System\TvgmyMG.exe
  2⤵
  PID:7496
- C:\Windows\System\JhQhaWA.exe
  C:\Windows\System\JhQhaWA.exe
  2⤵
  PID:7932
- C:\Windows\System\IsttekZ.exe
  C:\Windows\System\IsttekZ.exe
  2⤵
  PID:8028
- C:\Windows\System\PQXfUws.exe
  C:\Windows\System\PQXfUws.exe
  2⤵
  PID:7256
- C:\Windows\System\atjPAYc.exe
  C:\Windows\System\atjPAYc.exe
  2⤵
  PID:7740
- C:\Windows\System\ypRVEQx.exe
  C:\Windows\System\ypRVEQx.exe
  2⤵
  PID:7752
- C:\Windows\System\EJlQsTM.exe
  C:\Windows\System\EJlQsTM.exe
  2⤵
  PID:7564
- C:\Windows\System\nHHbwhw.exe
  C:\Windows\System\nHHbwhw.exe
  2⤵
  PID:7996
- C:\Windows\System\pFxSxJI.exe
  C:\Windows\System\pFxSxJI.exe
  2⤵
  PID:7676
- C:\Windows\System\CUDgBSJ.exe
  C:\Windows\System\CUDgBSJ.exe
  2⤵
  PID:7900
- C:\Windows\System\dOCvxuJ.exe
  C:\Windows\System\dOCvxuJ.exe
  2⤵
  PID:8120
- C:\Windows\System\KOrDWtM.exe
  C:\Windows\System\KOrDWtM.exe
  2⤵
  PID:7308
- C:\Windows\System\flJhqJO.exe
  C:\Windows\System\flJhqJO.exe
  2⤵
  PID:7372
- C:\Windows\System\DZMAcpW.exe
  C:\Windows\System\DZMAcpW.exe
  2⤵
  PID:7500
- C:\Windows\System\GBMDiWN.exe
  C:\Windows\System\GBMDiWN.exe
  2⤵
  PID:6508
- C:\Windows\System\PnhvmNm.exe
  C:\Windows\System\PnhvmNm.exe
  2⤵
  PID:7784
- C:\Windows\System\ehnfamL.exe
  C:\Windows\System\ehnfamL.exe
  2⤵
  PID:7656
- C:\Windows\System\tUgpdEI.exe
  C:\Windows\System\tUgpdEI.exe
  2⤵
  PID:7212
- C:\Windows\System\NRhmpxA.exe
  C:\Windows\System\NRhmpxA.exe
  2⤵
  PID:7544
- C:\Windows\System\OCzZibe.exe
  C:\Windows\System\OCzZibe.exe
  2⤵
  PID:7276
- C:\Windows\System\ugSVqbN.exe
  C:\Windows\System\ugSVqbN.exe
  2⤵
  PID:7756
- C:\Windows\System\uHvWuRD.exe
  C:\Windows\System\uHvWuRD.exe
  2⤵
  PID:6968
- C:\Windows\System\UJPPDRL.exe
  C:\Windows\System\UJPPDRL.exe
  2⤵
  PID:8208
- C:\Windows\System\sClsBuq.exe
  C:\Windows\System\sClsBuq.exe
  2⤵
  PID:8224
- C:\Windows\System\JmkJsYF.exe
  C:\Windows\System\JmkJsYF.exe
  2⤵
  PID:8240
- C:\Windows\System\PlWubyx.exe
  C:\Windows\System\PlWubyx.exe
  2⤵
  PID:8256
- C:\Windows\System\VWZEfKW.exe
  C:\Windows\System\VWZEfKW.exe
  2⤵
  PID:8272
- C:\Windows\System\KTuIBkv.exe
  C:\Windows\System\KTuIBkv.exe
  2⤵
  PID:8288
- C:\Windows\System\pWiBttG.exe
  C:\Windows\System\pWiBttG.exe
  2⤵
  PID:8304
- C:\Windows\System\qUFSgOY.exe
  C:\Windows\System\qUFSgOY.exe
  2⤵
  PID:8320
- C:\Windows\System\oCKHdAB.exe
  C:\Windows\System\oCKHdAB.exe
  2⤵
  PID:8336
- C:\Windows\System\JOQOtQo.exe
  C:\Windows\System\JOQOtQo.exe
  2⤵
  PID:8352
- C:\Windows\System\cZIrWFR.exe
  C:\Windows\System\cZIrWFR.exe
  2⤵
  PID:8368
- C:\Windows\System\aWqcvLi.exe
  C:\Windows\System\aWqcvLi.exe
  2⤵
  PID:8384
- C:\Windows\System\WLrgmeB.exe
  C:\Windows\System\WLrgmeB.exe
  2⤵
  PID:8400
- C:\Windows\System\TtAuTiI.exe
  C:\Windows\System\TtAuTiI.exe
  2⤵
  PID:8416
- C:\Windows\System\LxsAZeS.exe
  C:\Windows\System\LxsAZeS.exe
  2⤵
  PID:8432
- C:\Windows\System\cuXPkXX.exe
  C:\Windows\System\cuXPkXX.exe
  2⤵
  PID:8448
- C:\Windows\System\MvzielF.exe
  C:\Windows\System\MvzielF.exe
  2⤵
  PID:8464
- C:\Windows\System\CMPLIHV.exe
  C:\Windows\System\CMPLIHV.exe
  2⤵
  PID:8480
- C:\Windows\System\ybuSJaS.exe
  C:\Windows\System\ybuSJaS.exe
  2⤵
  PID:8500
- C:\Windows\System\Kyjvbsv.exe
  C:\Windows\System\Kyjvbsv.exe
  2⤵
  PID:8516
- C:\Windows\System\cIXOKzx.exe
  C:\Windows\System\cIXOKzx.exe
  2⤵
  PID:8536
- C:\Windows\System\dMvAoZr.exe
  C:\Windows\System\dMvAoZr.exe
  2⤵
  PID:8552
- C:\Windows\System\asjFGUC.exe
  C:\Windows\System\asjFGUC.exe
  2⤵
  PID:8568
- C:\Windows\System\jzXiCCI.exe
  C:\Windows\System\jzXiCCI.exe
  2⤵
  PID:8584
- C:\Windows\System\oGmYzWQ.exe
  C:\Windows\System\oGmYzWQ.exe
  2⤵
  PID:8600
- C:\Windows\System\AYjSUqI.exe
  C:\Windows\System\AYjSUqI.exe
  2⤵
  PID:8616
- C:\Windows\System\JQGenbc.exe
  C:\Windows\System\JQGenbc.exe
  2⤵
  PID:8632
- C:\Windows\System\BNEWnQk.exe
  C:\Windows\System\BNEWnQk.exe
  2⤵
  PID:8648
- C:\Windows\System\jQYVZYa.exe
  C:\Windows\System\jQYVZYa.exe
  2⤵
  PID:8664
- C:\Windows\System\OwBVcFs.exe
  C:\Windows\System\OwBVcFs.exe
  2⤵
  PID:8680
- C:\Windows\System\CYxahAl.exe
  C:\Windows\System\CYxahAl.exe
  2⤵
  PID:8696
- C:\Windows\System\AynWOgF.exe
  C:\Windows\System\AynWOgF.exe
  2⤵
  PID:8712
- C:\Windows\System\kwvvwOQ.exe
  C:\Windows\System\kwvvwOQ.exe
  2⤵
  PID:8728
- C:\Windows\System\SfbzDGC.exe
  C:\Windows\System\SfbzDGC.exe
  2⤵
  PID:8744
- C:\Windows\System\SpBbDFO.exe
  C:\Windows\System\SpBbDFO.exe
  2⤵
  PID:8760
- C:\Windows\System\KpNmIEf.exe
  C:\Windows\System\KpNmIEf.exe
  2⤵
  PID:8776
- C:\Windows\System\cOMOTTN.exe
  C:\Windows\System\cOMOTTN.exe
  2⤵
  PID:8792
- C:\Windows\System\kzWjNxE.exe
  C:\Windows\System\kzWjNxE.exe
  2⤵
  PID:8808
- C:\Windows\System\raBqroA.exe
  C:\Windows\System\raBqroA.exe
  2⤵
  PID:8824
- C:\Windows\System\xdwosEQ.exe
  C:\Windows\System\xdwosEQ.exe
  2⤵
  PID:8840
- C:\Windows\System\AvtfUDX.exe
  C:\Windows\System\AvtfUDX.exe
  2⤵
  PID:8856
- C:\Windows\System\zmRiDyb.exe
  C:\Windows\System\zmRiDyb.exe
  2⤵
  PID:8872
- C:\Windows\System\MdsDgIh.exe
  C:\Windows\System\MdsDgIh.exe
  2⤵
  PID:8888
- C:\Windows\System\dTlDRxa.exe
  C:\Windows\System\dTlDRxa.exe
  2⤵
  PID:8904
- C:\Windows\System\KzNhOMG.exe
  C:\Windows\System\KzNhOMG.exe
  2⤵
  PID:8920
- C:\Windows\System\xbzyzfk.exe
  C:\Windows\System\xbzyzfk.exe
  2⤵
  PID:8936
- C:\Windows\System\lOoOUgc.exe
  C:\Windows\System\lOoOUgc.exe
  2⤵
  PID:8952
- C:\Windows\System\oBPTRzA.exe
  C:\Windows\System\oBPTRzA.exe
  2⤵
  PID:8968
- C:\Windows\System\hfHieyL.exe
  C:\Windows\System\hfHieyL.exe
  2⤵
  PID:8984
- C:\Windows\System\PYRfyQr.exe
  C:\Windows\System\PYRfyQr.exe
  2⤵
  PID:9004
- C:\Windows\System\VacBBJT.exe
  C:\Windows\System\VacBBJT.exe
  2⤵
  PID:9020
- C:\Windows\System\KpCQsWK.exe
  C:\Windows\System\KpCQsWK.exe
  2⤵
  PID:9036
- C:\Windows\System\ZPGcHqQ.exe
  C:\Windows\System\ZPGcHqQ.exe
  2⤵
  PID:9052
- C:\Windows\System\kdmhVSc.exe
  C:\Windows\System\kdmhVSc.exe
  2⤵
  PID:9068
- C:\Windows\System\ciGaove.exe
  C:\Windows\System\ciGaove.exe
  2⤵
  PID:9084
- C:\Windows\System\OweXquL.exe
  C:\Windows\System\OweXquL.exe
  2⤵
  PID:9100
- C:\Windows\System\EZHIMOu.exe
  C:\Windows\System\EZHIMOu.exe
  2⤵
  PID:9116
- C:\Windows\System\JeeGpMK.exe
  C:\Windows\System\JeeGpMK.exe
  2⤵
  PID:9132
- C:\Windows\System\eUbHosy.exe
  C:\Windows\System\eUbHosy.exe
  2⤵
  PID:9148
- C:\Windows\System\xDXFhRy.exe
  C:\Windows\System\xDXFhRy.exe
  2⤵
  PID:9164
- C:\Windows\System\VFxYWWw.exe
  C:\Windows\System\VFxYWWw.exe
  2⤵
  PID:9180
- C:\Windows\System\CuqNefY.exe
  C:\Windows\System\CuqNefY.exe
  2⤵
  PID:9204
- C:\Windows\System\EwsKQvc.exe
  C:\Windows\System\EwsKQvc.exe
  2⤵
  PID:8056
- C:\Windows\System\DQiLxXv.exe
  C:\Windows\System\DQiLxXv.exe
  2⤵
  PID:8236
- C:\Windows\System\LittKnN.exe
  C:\Windows\System\LittKnN.exe
  2⤵
  PID:8300
- C:\Windows\System\oItaSyO.exe
  C:\Windows\System\oItaSyO.exe
  2⤵
  PID:8364
- C:\Windows\System\HfdNQlb.exe
  C:\Windows\System\HfdNQlb.exe
  2⤵
  PID:8428
- C:\Windows\System\cnMOhUz.exe
  C:\Windows\System\cnMOhUz.exe
  2⤵
  PID:8496
- C:\Windows\System\EtPcvAB.exe
  C:\Windows\System\EtPcvAB.exe
  2⤵
  PID:7592
- C:\Windows\System\BmYWWBQ.exe
  C:\Windows\System\BmYWWBQ.exe
  2⤵
  PID:8528
- C:\Windows\System\NJMpMat.exe
  C:\Windows\System\NJMpMat.exe
  2⤵
  PID:8252
- C:\Windows\System\KjaygLm.exe
  C:\Windows\System\KjaygLm.exe
  2⤵
  PID:8564
- C:\Windows\System\oNyVMIe.exe
  C:\Windows\System\oNyVMIe.exe
  2⤵
  PID:8628
- C:\Windows\System\zoOGWbQ.exe
  C:\Windows\System\zoOGWbQ.exe
  2⤵
  PID:8692
- C:\Windows\System\QQvzced.exe
  C:\Windows\System\QQvzced.exe
  2⤵
  PID:8316
- C:\Windows\System\XkVwQTi.exe
  C:\Windows\System\XkVwQTi.exe
  2⤵
  PID:8380
- C:\Windows\System\HmivzSm.exe
  C:\Windows\System\HmivzSm.exe
  2⤵
  PID:8444
- C:\Windows\System\qnNxVVe.exe
  C:\Windows\System\qnNxVVe.exe
  2⤵
  PID:8512
- C:\Windows\System\eDiTeYi.exe
  C:\Windows\System\eDiTeYi.exe
  2⤵
  PID:8784
- C:\Windows\System\PoWBvJd.exe
  C:\Windows\System\PoWBvJd.exe
  2⤵
  PID:8816
- C:\Windows\System\LQGdCdu.exe
  C:\Windows\System\LQGdCdu.exe
  2⤵
  PID:8880
- C:\Windows\System\xhTOhOH.exe
  C:\Windows\System\xhTOhOH.exe
  2⤵
  PID:8944
- C:\Windows\System\nuWZTac.exe
  C:\Windows\System\nuWZTac.exe
  2⤵
  PID:9012
- C:\Windows\System\yEDUmOt.exe
  C:\Windows\System\yEDUmOt.exe
  2⤵
  PID:9076
- C:\Windows\System\QrpMRLK.exe
  C:\Windows\System\QrpMRLK.exe
  2⤵
  PID:8576
- C:\Windows\System\KLJISsD.exe
  C:\Windows\System\KLJISsD.exe
  2⤵
  PID:8644
- C:\Windows\System\JIXLPuF.exe
  C:\Windows\System\JIXLPuF.exe
  2⤵
  PID:8708
- C:\Windows\System\xjUUsxG.exe
  C:\Windows\System\xjUUsxG.exe
  2⤵
  PID:9144
- C:\Windows\System\tLVwVwr.exe
  C:\Windows\System\tLVwVwr.exe
  2⤵
  PID:8772
- C:\Windows\System\GgYgFnl.exe
  C:\Windows\System\GgYgFnl.exe
  2⤵
  PID:8268
- C:\Windows\System\rgBKxdG.exe
  C:\Windows\System\rgBKxdG.exe
  2⤵
  PID:8012
- C:\Windows\System\arekmhq.exe
  C:\Windows\System\arekmhq.exe
  2⤵
  PID:8596
- C:\Windows\System\iUvCmqO.exe
  C:\Windows\System\iUvCmqO.exe
  2⤵
  PID:8412
- C:\Windows\System\zqKKCEQ.exe
  C:\Windows\System\zqKKCEQ.exe
  2⤵
  PID:8848
- C:\Windows\System\wCwqvaB.exe
  C:\Windows\System\wCwqvaB.exe
  2⤵
  PID:9108
- C:\Windows\System\XuszDdS.exe
  C:\Windows\System\XuszDdS.exe
  2⤵
  PID:8836
- C:\Windows\System\ZEbnlVR.exe
  C:\Windows\System\ZEbnlVR.exe
  2⤵
  PID:8900
- C:\Windows\System\QgBzeKh.exe
  C:\Windows\System\QgBzeKh.exe
  2⤵
  PID:8964
- C:\Windows\System\ogQfRNh.exe
  C:\Windows\System\ogQfRNh.exe
  2⤵
  PID:9032
- C:\Windows\System\LUbmusC.exe
  C:\Windows\System\LUbmusC.exe
  2⤵
  PID:9156
- C:\Windows\System\EjvzFNu.exe
  C:\Windows\System\EjvzFNu.exe
  2⤵
  PID:9192
- C:\Windows\System\lyrUGTN.exe
  C:\Windows\System\lyrUGTN.exe
  2⤵
  PID:9140
- C:\Windows\System\UhZQkui.exe
  C:\Windows\System\UhZQkui.exe
  2⤵
  PID:8360
- C:\Windows\System\UkImUqH.exe
  C:\Windows\System\UkImUqH.exe
  2⤵
  PID:8092
- C:\Windows\System\EYtQwZB.exe
  C:\Windows\System\EYtQwZB.exe
  2⤵
  PID:8688
- C:\Windows\System\QJHipvH.exe
  C:\Windows\System\QJHipvH.exe
  2⤵
  PID:8508
- C:\Windows\System\HQmTtHd.exe
  C:\Windows\System\HQmTtHd.exe
  2⤵
  PID:9044
- C:\Windows\System\UcDRYxm.exe
  C:\Windows\System\UcDRYxm.exe
  2⤵
  PID:8740
- C:\Windows\System\pGKKGuQ.exe
  C:\Windows\System\pGKKGuQ.exe
  2⤵
  PID:8724
- C:\Windows\System\dDNHmEE.exe
  C:\Windows\System\dDNHmEE.exe
  2⤵
  PID:8868
- C:\Windows\System\vJDSuZN.exe
  C:\Windows\System\vJDSuZN.exe
  2⤵
  PID:7948
- C:\Windows\System\oVGtxhk.exe
  C:\Windows\System\oVGtxhk.exe
  2⤵
  PID:8804
- C:\Windows\System\KwYQmGk.exe
  C:\Windows\System\KwYQmGk.exe
  2⤵
  PID:8932
- C:\Windows\System\jvDnKXd.exe
  C:\Windows\System\jvDnKXd.exe
  2⤵
  PID:8232
- C:\Windows\System\qfohxcH.exe
  C:\Windows\System\qfohxcH.exe
  2⤵
  PID:8608
- C:\Windows\System\KMRJnnB.exe
  C:\Windows\System\KMRJnnB.exe
  2⤵
  PID:9028
- C:\Windows\System\KFsSQNU.exe
  C:\Windows\System\KFsSQNU.exe
  2⤵
  PID:8660
- C:\Windows\System\UFHBnLM.exe
  C:\Windows\System\UFHBnLM.exe
  2⤵
  PID:9224
- C:\Windows\System\NBoiQqI.exe
  C:\Windows\System\NBoiQqI.exe
  2⤵
  PID:9240
- C:\Windows\System\XgjMniZ.exe
  C:\Windows\System\XgjMniZ.exe
  2⤵
  PID:9256
- C:\Windows\System\ZQCAvlm.exe
  C:\Windows\System\ZQCAvlm.exe
  2⤵
  PID:9272
- C:\Windows\System\DXEVycQ.exe
  C:\Windows\System\DXEVycQ.exe
  2⤵
  PID:9292
- C:\Windows\System\aVmhqAF.exe
  C:\Windows\System\aVmhqAF.exe
  2⤵
  PID:9308
- C:\Windows\System\QwHFnCP.exe
  C:\Windows\System\QwHFnCP.exe
  2⤵
  PID:9324
- C:\Windows\System\DRjgbJR.exe
  C:\Windows\System\DRjgbJR.exe
  2⤵
  PID:9340
- C:\Windows\System\XhMfIRW.exe
  C:\Windows\System\XhMfIRW.exe
  2⤵
  PID:9356
- C:\Windows\System\NbIiPEV.exe
  C:\Windows\System\NbIiPEV.exe
  2⤵
  PID:9372
- C:\Windows\System\urEFjvv.exe
  C:\Windows\System\urEFjvv.exe
  2⤵
  PID:9388
- C:\Windows\System\VZCCZGI.exe
  C:\Windows\System\VZCCZGI.exe
  2⤵
  PID:9404
- C:\Windows\System\bMBtorU.exe
  C:\Windows\System\bMBtorU.exe
  2⤵
  PID:9420
- C:\Windows\System\mYCSQQw.exe
  C:\Windows\System\mYCSQQw.exe
  2⤵
  PID:9436
- C:\Windows\System\lQLtjnr.exe
  C:\Windows\System\lQLtjnr.exe
  2⤵
  PID:9452
- C:\Windows\System\YJyqtap.exe
  C:\Windows\System\YJyqtap.exe
  2⤵
  PID:9468
- C:\Windows\System\oJvWTtp.exe
  C:\Windows\System\oJvWTtp.exe
  2⤵
  PID:9484
- C:\Windows\System\jHpFTUW.exe
  C:\Windows\System\jHpFTUW.exe
  2⤵
  PID:9500
- C:\Windows\System\LapQkeV.exe
  C:\Windows\System\LapQkeV.exe
  2⤵
  PID:9516
- C:\Windows\System\IQOuJgx.exe
  C:\Windows\System\IQOuJgx.exe
  2⤵
  PID:9532
- C:\Windows\System\TthyoGt.exe
  C:\Windows\System\TthyoGt.exe
  2⤵
  PID:9548
- C:\Windows\System\trkOsCp.exe
  C:\Windows\System\trkOsCp.exe
  2⤵
  PID:9564
- C:\Windows\System\IspLGsJ.exe
  C:\Windows\System\IspLGsJ.exe
  2⤵
  PID:9580
- C:\Windows\System\RyCjSiv.exe
  C:\Windows\System\RyCjSiv.exe
  2⤵
  PID:9596
- C:\Windows\System\aIsfdSI.exe
  C:\Windows\System\aIsfdSI.exe
  2⤵
  PID:9612
- C:\Windows\System\LbBKAnZ.exe
  C:\Windows\System\LbBKAnZ.exe
  2⤵
  PID:9628
- C:\Windows\System\jDTglGj.exe
  C:\Windows\System\jDTglGj.exe
  2⤵
  PID:9644
- C:\Windows\System\RgBNQRG.exe
  C:\Windows\System\RgBNQRG.exe
  2⤵
  PID:9664
- C:\Windows\System\qHnkfmw.exe
  C:\Windows\System\qHnkfmw.exe
  2⤵
  PID:9684
- C:\Windows\System\pljWokp.exe
  C:\Windows\System\pljWokp.exe
  2⤵
  PID:9700
- C:\Windows\System\GIasuFF.exe
  C:\Windows\System\GIasuFF.exe
  2⤵
  PID:9716
- C:\Windows\System\efwnkZg.exe
  C:\Windows\System\efwnkZg.exe
  2⤵
  PID:9732
- C:\Windows\System\AbFigCT.exe
  C:\Windows\System\AbFigCT.exe
  2⤵
  PID:9748
- C:\Windows\System\UGHVxKb.exe
  C:\Windows\System\UGHVxKb.exe
  2⤵
  PID:9764
- C:\Windows\System\sLHsgmw.exe
  C:\Windows\System\sLHsgmw.exe
  2⤵
  PID:9780
- C:\Windows\System\yHYINuo.exe
  C:\Windows\System\yHYINuo.exe
  2⤵
  PID:9796
- C:\Windows\System\UuhrmVc.exe
  C:\Windows\System\UuhrmVc.exe
  2⤵
  PID:9812
- C:\Windows\System\eBPmzrt.exe
  C:\Windows\System\eBPmzrt.exe
  2⤵
  PID:9828
- C:\Windows\System\vYfhjix.exe
  C:\Windows\System\vYfhjix.exe
  2⤵
  PID:9844
- C:\Windows\System\uJQxiHz.exe
  C:\Windows\System\uJQxiHz.exe
  2⤵
  PID:9860
- C:\Windows\System\EUIhKqo.exe
  C:\Windows\System\EUIhKqo.exe
  2⤵
  PID:9876
- C:\Windows\System\UOzyjdL.exe
  C:\Windows\System\UOzyjdL.exe
  2⤵
  PID:9892
- C:\Windows\System\OvaGiAM.exe
  C:\Windows\System\OvaGiAM.exe
  2⤵
  PID:9908
- C:\Windows\System\JLSyrwX.exe
  C:\Windows\System\JLSyrwX.exe
  2⤵
  PID:9924
- C:\Windows\System\Jfnbrbj.exe
  C:\Windows\System\Jfnbrbj.exe
  2⤵
  PID:9940
- C:\Windows\System\TvtmeHp.exe
  C:\Windows\System\TvtmeHp.exe
  2⤵
  PID:9956
- C:\Windows\System\EaqVlhQ.exe
  C:\Windows\System\EaqVlhQ.exe
  2⤵
  PID:9972
- C:\Windows\System\ZhMJRak.exe
  C:\Windows\System\ZhMJRak.exe
  2⤵
  PID:9988
- C:\Windows\System\nBJDWRW.exe
  C:\Windows\System\nBJDWRW.exe
  2⤵
  PID:10004
- C:\Windows\System\EKpJGVW.exe
  C:\Windows\System\EKpJGVW.exe
  2⤵
  PID:10020
- C:\Windows\System\EUGTQHN.exe
  C:\Windows\System\EUGTQHN.exe
  2⤵
  PID:10036
- C:\Windows\System\bEpJBXC.exe
  C:\Windows\System\bEpJBXC.exe
  2⤵
  PID:10052
- C:\Windows\System\YHGtcFC.exe
  C:\Windows\System\YHGtcFC.exe
  2⤵
  PID:10068
- C:\Windows\System\OoeMJol.exe
  C:\Windows\System\OoeMJol.exe
  2⤵
  PID:10084
- C:\Windows\System\LUoGlGA.exe
  C:\Windows\System\LUoGlGA.exe
  2⤵
  PID:10100
- C:\Windows\System\iCmJBKl.exe
  C:\Windows\System\iCmJBKl.exe
  2⤵
  PID:10116
- C:\Windows\System\uTVRBUk.exe
  C:\Windows\System\uTVRBUk.exe
  2⤵
  PID:10132
- C:\Windows\System\gWllMiN.exe
  C:\Windows\System\gWllMiN.exe
  2⤵
  PID:10148
- C:\Windows\System\AmdyFVA.exe
  C:\Windows\System\AmdyFVA.exe
  2⤵
  PID:10164
- C:\Windows\System\pjOdSav.exe
  C:\Windows\System\pjOdSav.exe
  2⤵
  PID:10180
- C:\Windows\System\OtljrAQ.exe
  C:\Windows\System\OtljrAQ.exe
  2⤵
  PID:10196
- C:\Windows\System\NgTychn.exe
  C:\Windows\System\NgTychn.exe
  2⤵
  PID:10212
- C:\Windows\System\VOVRHsu.exe
  C:\Windows\System\VOVRHsu.exe
  2⤵
  PID:10228
- C:\Windows\System\wPJSQCz.exe
  C:\Windows\System\wPJSQCz.exe
  2⤵
  PID:9236
- C:\Windows\System\hWSaAhc.exe
  C:\Windows\System\hWSaAhc.exe
  2⤵
  PID:6776
- C:\Windows\System\Jvitkyp.exe
  C:\Windows\System\Jvitkyp.exe
  2⤵
  PID:8188
- C:\Windows\System\BJtnLoe.exe
  C:\Windows\System\BJtnLoe.exe
  2⤵
  PID:8640
- C:\Windows\System\hFCYUCw.exe
  C:\Windows\System\hFCYUCw.exe
  2⤵
  PID:9212
- C:\Windows\System\cmtDhUE.exe
  C:\Windows\System\cmtDhUE.exe
  2⤵
  PID:8424
- C:\Windows\System\XyThfrA.exe
  C:\Windows\System\XyThfrA.exe
  2⤵
  PID:9332
- C:\Windows\System\qxDEOQB.exe
  C:\Windows\System\qxDEOQB.exe
  2⤵
  PID:9364
- C:\Windows\System\RjXBjIB.exe
  C:\Windows\System\RjXBjIB.exe
  2⤵
  PID:8912
- C:\Windows\System\NZjHuKk.exe
  C:\Windows\System\NZjHuKk.exe
  2⤵
  PID:9320
- C:\Windows\System\BMTizKk.exe
  C:\Windows\System\BMTizKk.exe
  2⤵
  PID:9432
- C:\Windows\System\iWnksqz.exe
  C:\Windows\System\iWnksqz.exe
  2⤵
  PID:9448
- C:\Windows\System\nbcrqZW.exe
  C:\Windows\System\nbcrqZW.exe
  2⤵
  PID:9496
- C:\Windows\System\GvqKDsk.exe
  C:\Windows\System\GvqKDsk.exe
  2⤵
  PID:9556
- C:\Windows\System\xaMZKyC.exe
  C:\Windows\System\xaMZKyC.exe
  2⤵
  PID:9480
- C:\Windows\System\YPNQvaW.exe
  C:\Windows\System\YPNQvaW.exe
  2⤵
  PID:9624
- C:\Windows\System\OpVBrKp.exe
  C:\Windows\System\OpVBrKp.exe
  2⤵
  PID:9608
- C:\Windows\System\VsFnzDz.exe
  C:\Windows\System\VsFnzDz.exe
  2⤵
  PID:9696
- C:\Windows\System\Vznxsfx.exe
  C:\Windows\System\Vznxsfx.exe
  2⤵
  PID:9788
- C:\Windows\System\VuyPXss.exe
  C:\Windows\System\VuyPXss.exe
  2⤵
  PID:9576
- C:\Windows\System\DdGmzYX.exe
  C:\Windows\System\DdGmzYX.exe
  2⤵
  PID:9740
- C:\Windows\System\LUfNALp.exe
  C:\Windows\System\LUfNALp.exe
  2⤵
  PID:9852
- C:\Windows\System\SnfuIFV.exe
  C:\Windows\System\SnfuIFV.exe
  2⤵
  PID:9744
- C:\Windows\System\gnVehJD.exe
  C:\Windows\System\gnVehJD.exe
  2⤵
  PID:9856
- C:\Windows\System\MGRloMF.exe
  C:\Windows\System\MGRloMF.exe
  2⤵
  PID:9920
- C:\Windows\System\kXhVJFK.exe
  C:\Windows\System\kXhVJFK.exe
  2⤵
  PID:9932
- C:\Windows\System\MCnhrLK.exe
  C:\Windows\System\MCnhrLK.exe
  2⤵
  PID:9980
- C:\Windows\System\gGuFShF.exe
  C:\Windows\System\gGuFShF.exe
  2⤵
  PID:10044
- C:\Windows\System\ivFfvVI.exe
  C:\Windows\System\ivFfvVI.exe
  2⤵
  PID:10108
- C:\Windows\System\CNbSCnj.exe
  C:\Windows\System\CNbSCnj.exe
  2⤵
  PID:10140
- C:\Windows\System\oNXxkkn.exe
  C:\Windows\System\oNXxkkn.exe
  2⤵
  PID:10144
- C:\Windows\System\crCcbgz.exe
  C:\Windows\System\crCcbgz.exe
  2⤵
  PID:10092
- C:\Windows\System\dgKfRxG.exe
  C:\Windows\System\dgKfRxG.exe
  2⤵
  PID:10128
- C:\Windows\System\fAHqNyj.exe
  C:\Windows\System\fAHqNyj.exe
  2⤵
  PID:10188
- C:\Windows\System\lXffguX.exe
  C:\Windows\System\lXffguX.exe
  2⤵
  PID:9232
- C:\Windows\System\hYtKcNB.exe
  C:\Windows\System\hYtKcNB.exe
  2⤵
  PID:8492
- C:\Windows\System\pafzuZb.exe
  C:\Windows\System\pafzuZb.exe
  2⤵
  PID:10220
- C:\Windows\System\kjzRlvJ.exe
  C:\Windows\System\kjzRlvJ.exe
  2⤵
  PID:9092
- C:\Windows\System\eSSljvc.exe
  C:\Windows\System\eSSljvc.exe
  2⤵
  PID:9248
- C:\Windows\System\OrVCsIz.exe
  C:\Windows\System\OrVCsIz.exe
  2⤵
  PID:9428
- C:\Windows\System\QmLxBPX.exe
  C:\Windows\System\QmLxBPX.exe
  2⤵
  PID:9352
- C:\Windows\System\buNxdiM.exe
  C:\Windows\System\buNxdiM.exe
  2⤵
  PID:9588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ARulGFM.exe

Filesize
1.7MB

MD5
4c4ab5654eb5131b929762af3e4ef7b5

SHA1
aa876bde7ba34b2503c3f00b985050479f9501ed

SHA256
f6db16a77ef5dabe99fdb63a9e7a81cf2589e41ee0a1b6b0eaf694a4cb4f8e15

SHA512
27a1db3c314bd55dcc544b8ba81db67ab4dd3b35019b3409e493fae05213fc2d587bc0da54af08c00deebf5637db49bc50dfeef6389098013a6aba43907cac83

Download Submit
C:\Windows\system\CnobLcc.exe

Filesize
1.7MB

MD5
f1184ded948dae01426ccfc7e702e0e7

SHA1
258a30f4602bc4856628298852e8c0425df2cb52

SHA256
31c5e25095e1d1d5dd8aad87b2ef8a3258d635aee042ddfb3782fdd7a27e7503

SHA512
0cf63e0b280203e60e826b109ce4fb7f899a66114a45cbd4573c6eb263e86b762d8daab274ac02931d97614c54e74ebed6ad1e80027c13f77f467d56f0c88345

Download Submit
C:\Windows\system\DnsgJoB.exe

Filesize
1.7MB

MD5
30fbcb44dc89874c98541b616213f2ec

SHA1
fe192e0cec0ae90bfbf7e40a273db8d79d8f0133

SHA256
fbeac5d21c71dc5b380f93670ce403c2d20b5e4c3b12a3d625fd9bec5126e695

SHA512
49ea1c185f0f84f78dcd741762d74016c317e2d5170dd63da8c493c1647e659ded800ba31a7072fa5ef80034e2584fa87156a1cbee8ac9170b1b71092896c92c

Download Submit
C:\Windows\system\EgYpZoJ.exe

Filesize
1.7MB

MD5
21a85b9f70c824304613fa5ea46e338c

SHA1
0f5921a04a54a6198d2d77d6d95e822711bbfa75

SHA256
02e4e804b89e10dec4cca72db11b2c69dd0171701fc4dbc8dc845bd1ac1628eb

SHA512
ebe88a14920b4561b9399880de9e3a1017098a586546aad89a0321092ae1bc96e87a79d1100b02ac6762c8e77c52657769963203e2a306f84c516087d4a35db8

Download Submit
C:\Windows\system\EivRDaA.exe

Filesize
1.7MB

MD5
aa1190171e19f4d247e0b549cebd85af

SHA1
de17512df2617e989b82e023e55b5c0a50b00180

SHA256
7edd3d479cd51f78c62fd1ecc8cd2319ca7e9052024e0b5245237d56407b85ab

SHA512
98c3f6a3fb05697aba65636c3c609b1851565c442700b2764d6486ce01494d482e92043af95a21d064beef3d03047097ec7dcb4e874db782cbb37d08ee8262a7

Download Submit
C:\Windows\system\FYyjIUo.exe

Filesize
1.7MB

MD5
8f829da1ccaaf370b622e2fa37e497f1

SHA1
3d760954d219a675cedf4508302a7125f774643d

SHA256
ec252e91ad3ec2890e38280924ec991e6f09c47ca6c7d9ff007f28e43a3585c1

SHA512
5fcaffe6a5742cd34a08f5e3979abaf33e549b98d9ec9574de07925e9558fa5e2419d3974ebb18087133c0c5bcba75768910d8c440244406d9e10dc0a9b25d8c

Download Submit
C:\Windows\system\GhqIqut.exe

Filesize
1.7MB

MD5
841f72107b153ad935679d490c49f54b

SHA1
f5202dbccea1f57ba7b015d59b6bb8a1ba761817

SHA256
4588d0c92c1cf353f0a506d16c8ce5a5c7860c1f4976667640844d7d57f0e465

SHA512
87911b0d7b36c8e7feb8d46d99953c3f94b6810056d49ba0c81d2ad5784fdc21048420e120197cd36f664d8af8e9edab0bd8df13bfb6151defa36ef05449a658

Download Submit
C:\Windows\system\KflZfQD.exe

Filesize
1.7MB

MD5
d0a38942df212bd0c63c4ef064d35369

SHA1
158b7e1b8e79acb0455159e83a89e67f896cb733

SHA256
f5ac8f30859671d5cbb2ea94e68ded2af3971e4117f2a91578663143b64273e3

SHA512
c1db9ac1c86cff1976eb151670332f818356310b253422f0ac83fbddb5a2938367ad662891cff475a25a573c1266cc1c0b6548cbaef246b607740bdf17fa35b9

Download Submit
C:\Windows\system\LPeEZVH.exe

Filesize
1.7MB

MD5
57133848998071c352261efc3de108f2

SHA1
77323ec46edd5c0cd7501e1a449c9234e0983923

SHA256
f205e67ca4c410ac53938128ea53e0654ed28fb3477004371a2b6fa586bf1007

SHA512
4a5fb3928edc7a6bef809344a6e45d3219575a52cc3c816f3b7ff420c9ec62da48b5e480b866e4ba79d7f4aeef41e2cc6d95fd61a362ca2623a6468b980e25f7

Download Submit
C:\Windows\system\Lbfxjyy.exe

Filesize
1.7MB

MD5
98844a82cc1a2523cbee628a6a77da4d

SHA1
3b7133f79c4f2b80a7b161b61d7ba28d86dae682

SHA256
87262a71632c174cb11c20beca181d859f2f51b253e2732ab0718850fdbc469c

SHA512
a88f4bc665df3156da405df050148afd8db06fd62d157853a35dfb7bd6de5bca60c12509f3d7801822fee20f75eb87dd7a1b31418cab5e94b855fcc6ee2de10f

Download Submit
C:\Windows\system\MeIHOYx.exe

Filesize
1.7MB

MD5
6b43a41f7c4aba7309b38686d9827c68

SHA1
1cf6355c361935f5110ac4a6475020d75b5fc6b1

SHA256
09fd6fe9aa30a6b2f8d80e05b0add23fea3318f4fbc548b08ee41ef4146ca0d9

SHA512
8842bc3bb2cc0164965e3461d333b8251ab816a45c7d2b039d5bcffbb9fd35ce7b407a6473fdade0604d5e71244d6a4d991398bcbfeabaa21dd3ac19d3b63b17

Download Submit
C:\Windows\system\NRGQGEt.exe

Filesize
1.7MB

MD5
92265f12237f25e646b80aae938888c9

SHA1
22930ae19426cf104f4fb183b09c9e1465f949b0

SHA256
528d6994bcfd447ef97baab86181b83be5e06e3456dd7ba39388630061ce54cb

SHA512
829b69ee11a8de52bfe05756bb7e4e3d4b099e7e3d7f45d9acc0d372bf47c9d36016ab172c4e9a4c602b994bbbe6f058c14c5ba3edeafd3d8a84a04ae6514804

Download Submit
C:\Windows\system\QDCcVuN.exe

Filesize
1.7MB

MD5
508abce847ef5ff375aefd39ad1d3460

SHA1
b6001ab5b4c7907a8468e2e8f830e80019f02e97

SHA256
72cdc76bc75b56ca5558ab975aa6629e582958ac46ce1139f7e0dd5fc19765ee

SHA512
2c262899eb8f031dea8f0ca1e81990490c372486b87da3c921a727c5e402d32497e0a3b0b2df617ce49cc0ecdf02d9be67f9629b90fb3a3c1624ce29ec4c4ea8

Download Submit
C:\Windows\system\RuZFjcV.exe

Filesize
1.7MB

MD5
0152840ec0103a62a2f76c421e841691

SHA1
3f83b3b26c2630b09e0f67a90ed5a9553936bdc1

SHA256
6c9c652edaa6f3defa80c7fc42789aad6ea077510dd5d25033a0981488b4c031

SHA512
dcfe1c327f7fb6d7e312af157aad7f7a8ca8fcace7ffa340f987c6e28b55054821412b87ebb871434d76a6d82bd017e5cf2882babad2a0c0607dd78dfde361b8

Download Submit
C:\Windows\system\TtcSucx.exe

Filesize
1.7MB

MD5
373527198f8640baad2f71c7e05657c3

SHA1
2bd791e090775fd9c6aef3a0d20c195b27dfb9d4

SHA256
29401997ab1338675611d54541dd7a08ad0e16dd1648aebfa137b73fa9b50de1

SHA512
e28f57d3c098dce4d1352575dcb5e16a16cfd56c7f42e7902334a588a6aa4cc772375e65fddc64fc4d62023b92b6832fe54149ab6b4a6810fe2d6cb77a441112

Download Submit
C:\Windows\system\WBiCzix.exe

Filesize
1.7MB

MD5
882004653e078b99ebb3750e78721260

SHA1
eb4b41e87487b56bcccc34aea73585ce212e882d

SHA256
270412ce83f9aedf4158030362a7aee11587b5b240350ad91f58e34c9dbf297c

SHA512
2186dad4dd91f3b50e9046eb8ec7f8ba4df157fdd9c1e20a946f61e4a019400f5785bc1a84c343085295ceef90038a92eed491746c3a1b8422fac5a054b561b9

Download Submit
C:\Windows\system\YcGAxEF.exe

Filesize
1.7MB

MD5
e040ef2bbdce789210e179a159c33702

SHA1
4db78531bdb721cdc30432a6196c79407ca8a6e6

SHA256
3db8c18515b38fb7a53247b5c20ec2ae799e76572e3666bd92bf2d0bd0bb5552

SHA512
6faee2fcde3d26d76215aa57dfed83dee368436455584b65243fdba0b3fa921729a9f3821d5dcaa9b61f5b3944dc777fd9b2798bcdd290867b3d31b44a6b1efd

Download Submit
C:\Windows\system\bdPoaNV.exe

Filesize
1.7MB

MD5
ac82512a1cd5f395306cec5b99da0ef0

SHA1
b3aff9079ae59561c502c893fa93a8eb571a12c0

SHA256
fd565fbba6d0d057e938b542760146c06124ce9b308c6602cbf66ab9db4313fc

SHA512
686cdd6ab7d2ab3ab4ea1d64e6e64e06b5abb55c8219cbc6fb20142238e2dbbd2cfa11bc5faf948954c869ba23e7de4b9961f2b545386bbf9a145b45f36942f8

Download Submit
C:\Windows\system\cjoAeJq.exe

Filesize
1.7MB

MD5
3b89027a0ba270344dcd67c964fb8bef

SHA1
9afbd11640aff80e17e1d21be596cfe11b545600

SHA256
09be561935c80448b859c7ac31a737b621008daa2096c69f15b6781b48d81dd4

SHA512
c098c97bb1e787345cbc1f5e017dc2e5f32fd231459b5347caeb85c119fd3ad0bfd0d5d34c2f80a81fedc8f870e4a4d5fcb3c48fed2f78e501b3afaacfde578d

Download Submit
C:\Windows\system\eDxfhCy.exe

Filesize
1.7MB

MD5
b08febc32a4175d1cea415750b83cb56

SHA1
7a8bf0623bc0b61c99114e20a091fe4765ad83d3

SHA256
a37957f87b1bdfdd3626e2e829c138281c88acce1edea198d551f15095832725

SHA512
8c527b0ba25049b8ae9e7e37bb2896ad85850ebe5ff0fe279ff17536e78fd1a2bf1349de1658227be83348ed727b9a726e59145642bb7bb3001053662773dbb7

Download Submit
C:\Windows\system\faIjPnR.exe

Filesize
1.7MB

MD5
16d2d37a74c6c873cd14038fbd8241c0

SHA1
bb85b1af140a828a0c5dd997cecf94312b6e6be3

SHA256
d2da1937290c69f16badb2beaba9be87e052526127c0362a6bcc85f54fc36fa9

SHA512
db857c236502b0ea63d4c163250c1ed2e4158c221625116bbda55a74fe7a070f8f8eb5e55cfeff9019165cfcc7ca4fe0f064833aa773668f3cc4da9b55b1eec0

Download Submit
C:\Windows\system\hgttLAN.exe

Filesize
1.7MB

MD5
0920c39bd98c08488323212b2ab8cfce

SHA1
34b22eba0ab22016c1c97bb894cd7420cff694da

SHA256
c4978e41d84df3f77ba84fc2ea3abe9afc6d51fbca1c39a23a31aa19f3ccad50

SHA512
57dbe38cccdf60ded47f5d5daa334431724229447655427c07077523efdc693d8f073b270b4a15fdf39002366d5e750d3665981cc60d5cbedb767cd61961a969

Download Submit
C:\Windows\system\hycRxqg.exe

Filesize
1.7MB

MD5
1d348aafb96ad5a569b7237b619ed0a1

SHA1
cbb78bdc8b6eab482b451996f43c665d04dc7796

SHA256
e586980d0d1f318e77b2a16e1fcc81aeaf3eff7232191bdaf20ddb142174b697

SHA512
3d020864d7829d9e9dd0cfa8f261b2b2d1897cbccab756ce728503609b062273990a6d9c214790ce1108f5dc2f1ceb3847bda4817640678417bd66800fc437d3

Download Submit
C:\Windows\system\izYcysU.exe

Filesize
1.7MB

MD5
bc7bcb739ccafa186d4d305bc12a039a

SHA1
bc610b7ebd7baef9ef375d019088ba78caa4573e

SHA256
ddd9fa72a6512dccee6f8e2eef9742eca3e6f8faf8d1ae520c6d3312ebbf82c6

SHA512
4ea0cd24479bd319b01eee29e4ac0ee05ada1e2126eada2f2b78cd17f23a39da74aa6759b79091ec44a927bcaf643c12ea1c533dc9fd480d03a7cbf6c30cf1f9

Download Submit
C:\Windows\system\qYkGipx.exe

Filesize
1.7MB

MD5
0894e1f1af0eec972514a103cf761be9

SHA1
baac5c7a3b990980d498b0002202798d8b0e558e

SHA256
3f10f76827914bf570ebca1c7cba006773808297503dcd03bdb2517bf884a98b

SHA512
934582ebe66d299639da6c33a1bfafce0ca0611483bb77fa4e68bac53a36c4a9100d20d00f4b377dfcb8ec1d09a9c15e75f15f80b459a684b366254a3ed8e404

Download Submit
C:\Windows\system\tMdGapW.exe

Filesize
1.7MB

MD5
a7d1328f85d6d69dda10467403b18b32

SHA1
f1616e8df9c8b1ba3a58ea20c8a9bcf4d66e8c9d

SHA256
be61ab4513887dab575b6c2ef2e383115b9d01f8d09229d610e0803693c6defa

SHA512
0e38a960e2b715289cbaaba96fa692cff9688cc0c1a26b63d93ac4c12854008325fc49334f1d12bd6e9f5906eaf675c9c11ebca8922966a61209975f2bd775c0

Download Submit
C:\Windows\system\uELodxE.exe

Filesize
1.7MB

MD5
db382c95f5327ee1a86f0173a2fd1b4d

SHA1
281fc1972b92564745350ac9ee9ccc77aa771320

SHA256
c2caa0d4be1fdaca5f93adb7e540625135cf90c863588e1646b63fab2ab74467

SHA512
55e84cac0555498f4000b3002111c01c9229421ea8e7034180452589d355b42816309d57d38ac71860fb67680c09ad2300bca0f00e90c0ac21f9fc2aa429599c

Download Submit
C:\Windows\system\vNAQtwu.exe

Filesize
1.7MB

MD5
65bfbecfaabc631900bb2bb5c026d952

SHA1
30fc2dd4bd91e1cd609356b239ff003648167f56

SHA256
517b56f727bc1e22a837078aa0750d8802e3e04ab42285a9f7d4270a40691e5b

SHA512
d66afe8884fa86cc65ae9e0542cbc7a5786917cb37b3d5c52323fbe2f74d85d0142c69546286037b6bf525968088f4fd4cef06e52dc969501c3078aba6b28c1b

Download Submit
C:\Windows\system\zNkCAGP.exe

Filesize
1.7MB

MD5
d17bb5e9eb0c2cc1af5f63395f14594d

SHA1
ff3e94566eef24af08c65c6f39c7e4f4a842e1c2

SHA256
039c0bbc00f3f0f908026cc91a493586d6c216a9d3b5b2accf0b03c85bec838f

SHA512
f1aadebbc38340c899b208ca021e43520ae9dc782a2055a4165023cd0a876748e63ff9f3bc9db96bc13e2856d672dc19a9c7042f10134afcb6938cab98e002dc

Download Submit
\Windows\system\PafBDDQ.exe

Filesize
1.7MB

MD5
f0007fcd815721a77837d5a3a10f75de

SHA1
bc43bef4b01162afd865bebcf3ea0e14aa0b8faa

SHA256
db0754b1e45bec8268c2b79f69729f0d6d8410a9e9461b6e5aa1c9723a088aec

SHA512
c360b13e1816ffe45a6d34f68045085905ac67c9054e099de50f8eb7ade1c2cf4ac8eeab9dc2b1017744a462351567d2c4803e6ea7bbd4317ce5dfb1597e1a7e

Download Submit
\Windows\system\zRAcDsz.exe

Filesize
1.7MB

MD5
2e0f1f2b88ce10883b81991130a2ec4c

SHA1
5df3f20ae66478cebe20258e7c8c9688c0528f10

SHA256
80a9eded7b69e7f0505541f20d24262fa1a7514803f934937a6e2bae29ebf3b2

SHA512
1c856211330468371d6d65b265145cd21fdf20d6441b40db2b186720f0a8efffa9e40898b2660c0d3fe4ef0c4b065ae2372820ec83c4344936ae9a72d4786268

Download Submit
\Windows\system\zeTUtsR.exe

Filesize
1.7MB

MD5
9bb42a9a599c4804d39819749fd499ff

SHA1
cbc5338ce9819754efec448e39bb6e2a9fdfa11e

SHA256
b7caf8efa7568bab76a2c8ed82541edeabe0001db2d3bc826b675c0354e67495

SHA512
84b7dd9002b18d36c11f2a530ebe32025a8c640d4c89ecd573aadba24b574a6c34d516572c017e3e31a6b74e365727231e1c8fc7d1273b27cbae108da59345c4

Download Submit
memory/3048-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download