xmrig | 68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
Size

1.8MB
MD5

410400a97c17b95bbbc20bb602270ae9
SHA1

0b5e306cb95097e6eeb82407bda7d1b32dd8ac7b
SHA256

68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141
SHA512

6400d8d96db0a0ab7d97195d167661e4fcde759dd42cf898efc572c626725681d26f85aaf6a3b10d8d98e44d8d7d3df648d2b66a5ef5fedd3f53c7fa8736236d
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbkWyTsf5o:GemTLkNdfE0pZyv

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000b000000012259-2.dat	xmrig
behavioral1/files/0x0008000000015dc3-6.dat	xmrig
behavioral1/files/0x0008000000015e47-19.dat	xmrig
behavioral1/files/0x0008000000015e25-14.dat	xmrig
behavioral1/files/0x0007000000015f2a-21.dat	xmrig
behavioral1/files/0x00070000000160ae-28.dat	xmrig
behavioral1/files/0x00070000000160d5-34.dat	xmrig
behavioral1/files/0x000700000001903d-38.dat	xmrig
behavioral1/files/0x000500000001920f-43.dat	xmrig
behavioral1/files/0x0005000000019241-59.dat	xmrig
behavioral1/files/0x000500000001932a-79.dat	xmrig
behavioral1/files/0x000500000001933e-84.dat	xmrig
behavioral1/files/0x00050000000193a2-99.dat	xmrig
behavioral1/files/0x00050000000193c9-109.dat	xmrig
behavioral1/files/0x0005000000019494-129.dat	xmrig
behavioral1/files/0x00050000000194e2-151.dat	xmrig
behavioral1/files/0x00050000000194ea-158.dat	xmrig
behavioral1/files/0x00050000000194d4-145.dat	xmrig
behavioral1/files/0x00050000000194a7-135.dat	xmrig
behavioral1/files/0x00050000000194da-148.dat	xmrig
behavioral1/files/0x00050000000194b4-138.dat	xmrig
behavioral1/files/0x0005000000019408-124.dat	xmrig
behavioral1/files/0x00050000000193f8-115.dat	xmrig
behavioral1/files/0x00050000000193fa-119.dat	xmrig
behavioral1/files/0x00050000000193af-104.dat	xmrig
behavioral1/files/0x0005000000019384-94.dat	xmrig
behavioral1/files/0x0005000000019346-89.dat	xmrig
behavioral1/files/0x00050000000192f0-74.dat	xmrig
behavioral1/files/0x000500000001925c-65.dat	xmrig
behavioral1/files/0x0005000000019273-69.dat	xmrig
behavioral1/files/0x0005000000019234-54.dat	xmrig
behavioral1/files/0x0005000000019228-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2752	DCDvuuc.exe
2872	cRqnwXZ.exe
2888	bZSCKMi.exe
2732	ZvEvlOt.exe
2992	fRFgPVz.exe
2928	BSxzTza.exe
2632	fTKFFat.exe
2772	dFdNGtC.exe
2660	EicPwKc.exe
2620	vdIkYdw.exe
2728	mpvwSze.exe
3068	chYVkob.exe
1940	WHereZA.exe
1240	QvSHibX.exe
2428	DpYDUgQ.exe
2056	loBbZpr.exe
2520	BcgTSKl.exe
532	VsSqjrr.exe
1280	psnVfJr.exe
2804	SInpDfx.exe
2792	dTxgLMX.exe
2420	oCfIRJy.exe
1248	LfmoXWv.exe
1616	zotUsDz.exe
2452	YZHZShY.exe
584	pDOAdcT.exe
1804	AnGEpWq.exe
2252	VchgqAI.exe
2484	VLdjFRb.exe
1708	fyADLgW.exe
2200	GLgWglj.exe
3016	YyscJUG.exe
288	zpwRLWq.exe
1124	dhstoQi.exe
2236	mpONAvx.exe
1112	XGngEFq.exe
1344	RqyEOnn.exe
320	jyRgusF.exe
1768	zCWasiM.exe
2300	AtPzGbX.exe
1004	cntvoCY.exe
1764	TVUbbMt.exe
1776	IsMQTCP.exe
688	oQZsTdQ.exe
600	yMKQOzo.exe
3044	CWlTfTE.exe
2244	JzaYcbP.exe
2688	hTcDUvq.exe
1252	HymLcbl.exe
1052	njqRsuE.exe
2536	Kmbyacf.exe
284	DLsRtQM.exe
1040	sPfCOOf.exe
1692	MAEdRrA.exe
1308	hCcoPmA.exe
2416	YIJbkUI.exe
1564	RMvCNzd.exe
1728	AUrtrSF.exe
1140	iHQSEoB.exe
2896	kOekEmu.exe
2140	qlbVhRX.exe
2828	cKpehPV.exe
2868	yzXsNNI.exe
2184	QPJXEnp.exe

Loads dropped DLL 64 IoCs

pid	Process
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SDRdKhm.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\mpONAvx.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\EYDjlZz.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\xRAcamR.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\BXcCFdG.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\THjBiUN.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\zjTvPvx.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\twTRzIz.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\eDfHBQr.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\TKpfauZ.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\WgYafRy.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\beFOgEG.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\KJtItlg.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\VsPvmfn.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\swaiAFo.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\TVtmjOd.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\uPAtdBa.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\kXpOHFG.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\qKxsUob.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\CTkpKhq.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\TMAXuqW.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\MYOweui.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\eRRKaeC.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\JzaYcbP.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\UdbJuAk.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\uiQKkwy.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\aRjLSiF.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\kCNOjIN.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\MnEojpa.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\fsVUUZG.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\XPxCsSq.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\opugnqd.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\GfjYCQo.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\MQYxbTA.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\CJFKLAq.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\MQnkuVw.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\YARgrdA.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\gxdQVsS.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\NkhIgwC.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\vTUjvbY.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\wXqkgBr.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\BcgTSKl.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\XyeufUt.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\MyCpwaW.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\SxvWlSt.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\XCDiVNS.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\AnGEpWq.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\kXFDSLz.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\LkBJMjB.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\JnEqgcb.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\QRcFkxx.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\SgxCQFf.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\PsRqcbP.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\FcJMWhs.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\HcdDqWs.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\KNVUEiL.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\pnEIcET.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\FzNBGuJ.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\SRasQMH.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\cfkpgWp.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\bHoGFoh.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\yukKkXC.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\VOUMRzI.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
File created	C:\Windows\System\kyfkSgU.exe	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2752	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	31
PID 2940 wrote to memory of 2752	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	31
PID 2940 wrote to memory of 2752	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	31
PID 2940 wrote to memory of 2872	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	32
PID 2940 wrote to memory of 2872	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	32
PID 2940 wrote to memory of 2872	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	32
PID 2940 wrote to memory of 2888	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	33
PID 2940 wrote to memory of 2888	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	33
PID 2940 wrote to memory of 2888	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	33
PID 2940 wrote to memory of 2732	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	34
PID 2940 wrote to memory of 2732	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	34
PID 2940 wrote to memory of 2732	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	34
PID 2940 wrote to memory of 2992	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	35
PID 2940 wrote to memory of 2992	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	35
PID 2940 wrote to memory of 2992	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	35
PID 2940 wrote to memory of 2928	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	36
PID 2940 wrote to memory of 2928	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	36
PID 2940 wrote to memory of 2928	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	36
PID 2940 wrote to memory of 2632	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	37
PID 2940 wrote to memory of 2632	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	37
PID 2940 wrote to memory of 2632	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	37
PID 2940 wrote to memory of 2772	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	38
PID 2940 wrote to memory of 2772	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	38
PID 2940 wrote to memory of 2772	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	38
PID 2940 wrote to memory of 2660	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	39
PID 2940 wrote to memory of 2660	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	39
PID 2940 wrote to memory of 2660	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	39
PID 2940 wrote to memory of 2620	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	40
PID 2940 wrote to memory of 2620	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	40
PID 2940 wrote to memory of 2620	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	40
PID 2940 wrote to memory of 2728	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	41
PID 2940 wrote to memory of 2728	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	41
PID 2940 wrote to memory of 2728	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	41
PID 2940 wrote to memory of 3068	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	42
PID 2940 wrote to memory of 3068	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	42
PID 2940 wrote to memory of 3068	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	42
PID 2940 wrote to memory of 1940	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	43
PID 2940 wrote to memory of 1940	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	43
PID 2940 wrote to memory of 1940	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	43
PID 2940 wrote to memory of 1240	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	44
PID 2940 wrote to memory of 1240	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	44
PID 2940 wrote to memory of 1240	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	44
PID 2940 wrote to memory of 2428	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	45
PID 2940 wrote to memory of 2428	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	45
PID 2940 wrote to memory of 2428	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	45
PID 2940 wrote to memory of 2056	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	46
PID 2940 wrote to memory of 2056	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	46
PID 2940 wrote to memory of 2056	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	46
PID 2940 wrote to memory of 2520	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	47
PID 2940 wrote to memory of 2520	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	47
PID 2940 wrote to memory of 2520	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	47
PID 2940 wrote to memory of 532	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	48
PID 2940 wrote to memory of 532	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	48
PID 2940 wrote to memory of 532	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	48
PID 2940 wrote to memory of 1280	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	49
PID 2940 wrote to memory of 1280	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	49
PID 2940 wrote to memory of 1280	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	49
PID 2940 wrote to memory of 2804	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	50
PID 2940 wrote to memory of 2804	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	50
PID 2940 wrote to memory of 2804	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	50
PID 2940 wrote to memory of 2792	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	51
PID 2940 wrote to memory of 2792	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	51
PID 2940 wrote to memory of 2792	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	51
PID 2940 wrote to memory of 2420	2940	68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe	52

C:\Users\Admin\AppData\Local\Temp\68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe
"C:\Users\Admin\AppData\Local\Temp\68c7fb57ba398fddcf73c637aac53564a4fd950bcc5a938b405460721a98d141.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System\DCDvuuc.exe
  C:\Windows\System\DCDvuuc.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\cRqnwXZ.exe
  C:\Windows\System\cRqnwXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\bZSCKMi.exe
  C:\Windows\System\bZSCKMi.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ZvEvlOt.exe
  C:\Windows\System\ZvEvlOt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\fRFgPVz.exe
  C:\Windows\System\fRFgPVz.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\BSxzTza.exe
  C:\Windows\System\BSxzTza.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\fTKFFat.exe
  C:\Windows\System\fTKFFat.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\dFdNGtC.exe
  C:\Windows\System\dFdNGtC.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\EicPwKc.exe
  C:\Windows\System\EicPwKc.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\vdIkYdw.exe
  C:\Windows\System\vdIkYdw.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\mpvwSze.exe
  C:\Windows\System\mpvwSze.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\chYVkob.exe
  C:\Windows\System\chYVkob.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\WHereZA.exe
  C:\Windows\System\WHereZA.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\QvSHibX.exe
  C:\Windows\System\QvSHibX.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\DpYDUgQ.exe
  C:\Windows\System\DpYDUgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\loBbZpr.exe
  C:\Windows\System\loBbZpr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\BcgTSKl.exe
  C:\Windows\System\BcgTSKl.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\VsSqjrr.exe
  C:\Windows\System\VsSqjrr.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\psnVfJr.exe
  C:\Windows\System\psnVfJr.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\SInpDfx.exe
  C:\Windows\System\SInpDfx.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\dTxgLMX.exe
  C:\Windows\System\dTxgLMX.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\oCfIRJy.exe
  C:\Windows\System\oCfIRJy.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\LfmoXWv.exe
  C:\Windows\System\LfmoXWv.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\zotUsDz.exe
  C:\Windows\System\zotUsDz.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\YZHZShY.exe
  C:\Windows\System\YZHZShY.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\pDOAdcT.exe
  C:\Windows\System\pDOAdcT.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\AnGEpWq.exe
  C:\Windows\System\AnGEpWq.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\VchgqAI.exe
  C:\Windows\System\VchgqAI.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\VLdjFRb.exe
  C:\Windows\System\VLdjFRb.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\fyADLgW.exe
  C:\Windows\System\fyADLgW.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\GLgWglj.exe
  C:\Windows\System\GLgWglj.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\YyscJUG.exe
  C:\Windows\System\YyscJUG.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\zpwRLWq.exe
  C:\Windows\System\zpwRLWq.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\dhstoQi.exe
  C:\Windows\System\dhstoQi.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\mpONAvx.exe
  C:\Windows\System\mpONAvx.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\XGngEFq.exe
  C:\Windows\System\XGngEFq.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\RqyEOnn.exe
  C:\Windows\System\RqyEOnn.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\jyRgusF.exe
  C:\Windows\System\jyRgusF.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\zCWasiM.exe
  C:\Windows\System\zCWasiM.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\AtPzGbX.exe
  C:\Windows\System\AtPzGbX.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\cntvoCY.exe
  C:\Windows\System\cntvoCY.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\TVUbbMt.exe
  C:\Windows\System\TVUbbMt.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\IsMQTCP.exe
  C:\Windows\System\IsMQTCP.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\oQZsTdQ.exe
  C:\Windows\System\oQZsTdQ.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\yMKQOzo.exe
  C:\Windows\System\yMKQOzo.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\CWlTfTE.exe
  C:\Windows\System\CWlTfTE.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\JzaYcbP.exe
  C:\Windows\System\JzaYcbP.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\hTcDUvq.exe
  C:\Windows\System\hTcDUvq.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\HymLcbl.exe
  C:\Windows\System\HymLcbl.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\njqRsuE.exe
  C:\Windows\System\njqRsuE.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\Kmbyacf.exe
  C:\Windows\System\Kmbyacf.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\DLsRtQM.exe
  C:\Windows\System\DLsRtQM.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\sPfCOOf.exe
  C:\Windows\System\sPfCOOf.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\MAEdRrA.exe
  C:\Windows\System\MAEdRrA.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\hCcoPmA.exe
  C:\Windows\System\hCcoPmA.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\YIJbkUI.exe
  C:\Windows\System\YIJbkUI.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\RMvCNzd.exe
  C:\Windows\System\RMvCNzd.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\AUrtrSF.exe
  C:\Windows\System\AUrtrSF.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iHQSEoB.exe
  C:\Windows\System\iHQSEoB.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\kOekEmu.exe
  C:\Windows\System\kOekEmu.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\qlbVhRX.exe
  C:\Windows\System\qlbVhRX.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\cKpehPV.exe
  C:\Windows\System\cKpehPV.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\yzXsNNI.exe
  C:\Windows\System\yzXsNNI.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\QPJXEnp.exe
  C:\Windows\System\QPJXEnp.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\sGMmrcN.exe
  C:\Windows\System\sGMmrcN.exe
  2⤵
  PID:2600
- C:\Windows\System\aaEefUs.exe
  C:\Windows\System\aaEefUs.exe
  2⤵
  PID:2656
- C:\Windows\System\kQMzUBt.exe
  C:\Windows\System\kQMzUBt.exe
  2⤵
  PID:888
- C:\Windows\System\qzhZnHQ.exe
  C:\Windows\System\qzhZnHQ.exe
  2⤵
  PID:2864
- C:\Windows\System\tNTJmaL.exe
  C:\Windows\System\tNTJmaL.exe
  2⤵
  PID:2144
- C:\Windows\System\SEYoZMV.exe
  C:\Windows\System\SEYoZMV.exe
  2⤵
  PID:2740
- C:\Windows\System\WpBVVIE.exe
  C:\Windows\System\WpBVVIE.exe
  2⤵
  PID:2884
- C:\Windows\System\MBUxdVq.exe
  C:\Windows\System\MBUxdVq.exe
  2⤵
  PID:2952
- C:\Windows\System\XKhUjaT.exe
  C:\Windows\System\XKhUjaT.exe
  2⤵
  PID:2912
- C:\Windows\System\vAbntWO.exe
  C:\Windows\System\vAbntWO.exe
  2⤵
  PID:2152
- C:\Windows\System\xbZzxCj.exe
  C:\Windows\System\xbZzxCj.exe
  2⤵
  PID:2424
- C:\Windows\System\jTktTgq.exe
  C:\Windows\System\jTktTgq.exe
  2⤵
  PID:3004
- C:\Windows\System\ETcVpgV.exe
  C:\Windows\System\ETcVpgV.exe
  2⤵
  PID:2700
- C:\Windows\System\XDsckmT.exe
  C:\Windows\System\XDsckmT.exe
  2⤵
  PID:2120
- C:\Windows\System\fNpCMGS.exe
  C:\Windows\System\fNpCMGS.exe
  2⤵
  PID:628
- C:\Windows\System\wdejqsr.exe
  C:\Windows\System\wdejqsr.exe
  2⤵
  PID:2012
- C:\Windows\System\HHFHQox.exe
  C:\Windows\System\HHFHQox.exe
  2⤵
  PID:820
- C:\Windows\System\GjuGpXf.exe
  C:\Windows\System\GjuGpXf.exe
  2⤵
  PID:2336
- C:\Windows\System\ocWEtAV.exe
  C:\Windows\System\ocWEtAV.exe
  2⤵
  PID:1048
- C:\Windows\System\iNyxPok.exe
  C:\Windows\System\iNyxPok.exe
  2⤵
  PID:1524
- C:\Windows\System\bqAEcgL.exe
  C:\Windows\System\bqAEcgL.exe
  2⤵
  PID:1576
- C:\Windows\System\LeSUjJw.exe
  C:\Windows\System\LeSUjJw.exe
  2⤵
  PID:1772
- C:\Windows\System\kcbZkYI.exe
  C:\Windows\System\kcbZkYI.exe
  2⤵
  PID:1164
- C:\Windows\System\fDrBebk.exe
  C:\Windows\System\fDrBebk.exe
  2⤵
  PID:1568
- C:\Windows\System\WwBmDim.exe
  C:\Windows\System\WwBmDim.exe
  2⤵
  PID:2936
- C:\Windows\System\KaJVtWL.exe
  C:\Windows\System\KaJVtWL.exe
  2⤵
  PID:2088
- C:\Windows\System\cuAJPJp.exe
  C:\Windows\System\cuAJPJp.exe
  2⤵
  PID:2176
- C:\Windows\System\Cartvcr.exe
  C:\Windows\System\Cartvcr.exe
  2⤵
  PID:1848
- C:\Windows\System\EyRJCTZ.exe
  C:\Windows\System\EyRJCTZ.exe
  2⤵
  PID:876
- C:\Windows\System\RGDoGjp.exe
  C:\Windows\System\RGDoGjp.exe
  2⤵
  PID:2344
- C:\Windows\System\TxpNcDK.exe
  C:\Windows\System\TxpNcDK.exe
  2⤵
  PID:1592
- C:\Windows\System\aejcAba.exe
  C:\Windows\System\aejcAba.exe
  2⤵
  PID:1596
- C:\Windows\System\RoPnHAi.exe
  C:\Windows\System\RoPnHAi.exe
  2⤵
  PID:2876
- C:\Windows\System\uZVTjqR.exe
  C:\Windows\System\uZVTjqR.exe
  2⤵
  PID:2944
- C:\Windows\System\CkDNyJU.exe
  C:\Windows\System\CkDNyJU.exe
  2⤵
  PID:2616
- C:\Windows\System\dGmopGw.exe
  C:\Windows\System\dGmopGw.exe
  2⤵
  PID:2232
- C:\Windows\System\HdNZzYm.exe
  C:\Windows\System\HdNZzYm.exe
  2⤵
  PID:1196
- C:\Windows\System\uHmjaKz.exe
  C:\Windows\System\uHmjaKz.exe
  2⤵
  PID:1636
- C:\Windows\System\JBOelLQ.exe
  C:\Windows\System\JBOelLQ.exe
  2⤵
  PID:2848
- C:\Windows\System\WOxpkwf.exe
  C:\Windows\System\WOxpkwf.exe
  2⤵
  PID:2008
- C:\Windows\System\MsCIfVU.exe
  C:\Windows\System\MsCIfVU.exe
  2⤵
  PID:112
- C:\Windows\System\zOcktIg.exe
  C:\Windows\System\zOcktIg.exe
  2⤵
  PID:1628
- C:\Windows\System\AYLVjoi.exe
  C:\Windows\System\AYLVjoi.exe
  2⤵
  PID:2492
- C:\Windows\System\pDlkGcI.exe
  C:\Windows\System\pDlkGcI.exe
  2⤵
  PID:1816
- C:\Windows\System\rkfZxrt.exe
  C:\Windows\System\rkfZxrt.exe
  2⤵
  PID:448
- C:\Windows\System\FIXUWwA.exe
  C:\Windows\System\FIXUWwA.exe
  2⤵
  PID:952
- C:\Windows\System\jjZNCSk.exe
  C:\Windows\System\jjZNCSk.exe
  2⤵
  PID:2092
- C:\Windows\System\YnPckaA.exe
  C:\Windows\System\YnPckaA.exe
  2⤵
  PID:2328
- C:\Windows\System\vQVYURB.exe
  C:\Windows\System\vQVYURB.exe
  2⤵
  PID:1688
- C:\Windows\System\DXabaLk.exe
  C:\Windows\System\DXabaLk.exe
  2⤵
  PID:2512
- C:\Windows\System\kOUIJUR.exe
  C:\Windows\System\kOUIJUR.exe
  2⤵
  PID:2528
- C:\Windows\System\sUZXLBz.exe
  C:\Windows\System\sUZXLBz.exe
  2⤵
  PID:2036
- C:\Windows\System\ekAbReN.exe
  C:\Windows\System\ekAbReN.exe
  2⤵
  PID:2712
- C:\Windows\System\FfRYhMh.exe
  C:\Windows\System\FfRYhMh.exe
  2⤵
  PID:1916
- C:\Windows\System\qxlddKj.exe
  C:\Windows\System\qxlddKj.exe
  2⤵
  PID:2680
- C:\Windows\System\loyeSsR.exe
  C:\Windows\System\loyeSsR.exe
  2⤵
  PID:2900
- C:\Windows\System\XRYvSeA.exe
  C:\Windows\System\XRYvSeA.exe
  2⤵
  PID:3064
- C:\Windows\System\ORfvAfP.exe
  C:\Windows\System\ORfvAfP.exe
  2⤵
  PID:664
- C:\Windows\System\jsTEIKW.exe
  C:\Windows\System\jsTEIKW.exe
  2⤵
  PID:1080
- C:\Windows\System\pRDxdlC.exe
  C:\Windows\System\pRDxdlC.exe
  2⤵
  PID:1420
- C:\Windows\System\nAWHqZN.exe
  C:\Windows\System\nAWHqZN.exe
  2⤵
  PID:2216
- C:\Windows\System\JgDTuwt.exe
  C:\Windows\System\JgDTuwt.exe
  2⤵
  PID:1660
- C:\Windows\System\RhzFnfb.exe
  C:\Windows\System\RhzFnfb.exe
  2⤵
  PID:1244
- C:\Windows\System\CFBHNFL.exe
  C:\Windows\System\CFBHNFL.exe
  2⤵
  PID:1876
- C:\Windows\System\gcxCRTt.exe
  C:\Windows\System\gcxCRTt.exe
  2⤵
  PID:1612
- C:\Windows\System\VnwWhSX.exe
  C:\Windows\System\VnwWhSX.exe
  2⤵
  PID:892
- C:\Windows\System\vyoWVIc.exe
  C:\Windows\System\vyoWVIc.exe
  2⤵
  PID:1892
- C:\Windows\System\BrXuCsN.exe
  C:\Windows\System\BrXuCsN.exe
  2⤵
  PID:2984
- C:\Windows\System\IvPzMeH.exe
  C:\Windows\System\IvPzMeH.exe
  2⤵
  PID:1684
- C:\Windows\System\icfgTKb.exe
  C:\Windows\System\icfgTKb.exe
  2⤵
  PID:2168
- C:\Windows\System\IZBFDyE.exe
  C:\Windows\System\IZBFDyE.exe
  2⤵
  PID:2764
- C:\Windows\System\QexfIfT.exe
  C:\Windows\System\QexfIfT.exe
  2⤵
  PID:2648
- C:\Windows\System\SRasQMH.exe
  C:\Windows\System\SRasQMH.exe
  2⤵
  PID:1880
- C:\Windows\System\rYktsxT.exe
  C:\Windows\System\rYktsxT.exe
  2⤵
  PID:540
- C:\Windows\System\pyCMaPE.exe
  C:\Windows\System\pyCMaPE.exe
  2⤵
  PID:2172
- C:\Windows\System\MERtMlb.exe
  C:\Windows\System\MERtMlb.exe
  2⤵
  PID:2376
- C:\Windows\System\EzIcGta.exe
  C:\Windows\System\EzIcGta.exe
  2⤵
  PID:1008
- C:\Windows\System\pLqQcxM.exe
  C:\Windows\System\pLqQcxM.exe
  2⤵
  PID:3024
- C:\Windows\System\ZErpWtV.exe
  C:\Windows\System\ZErpWtV.exe
  2⤵
  PID:2540
- C:\Windows\System\okONLrj.exe
  C:\Windows\System\okONLrj.exe
  2⤵
  PID:2784
- C:\Windows\System\lUmGaOz.exe
  C:\Windows\System\lUmGaOz.exe
  2⤵
  PID:2460
- C:\Windows\System\ejlWGVr.exe
  C:\Windows\System\ejlWGVr.exe
  2⤵
  PID:2780
- C:\Windows\System\xwGlLUL.exe
  C:\Windows\System\xwGlLUL.exe
  2⤵
  PID:1836
- C:\Windows\System\FJGhEKV.exe
  C:\Windows\System\FJGhEKV.exe
  2⤵
  PID:2028
- C:\Windows\System\BWGyUHk.exe
  C:\Windows\System\BWGyUHk.exe
  2⤵
  PID:2776
- C:\Windows\System\BRdEBKs.exe
  C:\Windows\System\BRdEBKs.exe
  2⤵
  PID:920
- C:\Windows\System\JInVTbo.exe
  C:\Windows\System\JInVTbo.exe
  2⤵
  PID:2524
- C:\Windows\System\PTzbPdC.exe
  C:\Windows\System\PTzbPdC.exe
  2⤵
  PID:1896
- C:\Windows\System\kSuncce.exe
  C:\Windows\System\kSuncce.exe
  2⤵
  PID:2892
- C:\Windows\System\MdmrQWa.exe
  C:\Windows\System\MdmrQWa.exe
  2⤵
  PID:1784
- C:\Windows\System\tcgHtjo.exe
  C:\Windows\System\tcgHtjo.exe
  2⤵
  PID:3096
- C:\Windows\System\WnQFcps.exe
  C:\Windows\System\WnQFcps.exe
  2⤵
  PID:3116
- C:\Windows\System\wGHhbfr.exe
  C:\Windows\System\wGHhbfr.exe
  2⤵
  PID:3148
- C:\Windows\System\BtOprmK.exe
  C:\Windows\System\BtOprmK.exe
  2⤵
  PID:3172
- C:\Windows\System\AKvTSxQ.exe
  C:\Windows\System\AKvTSxQ.exe
  2⤵
  PID:3188
- C:\Windows\System\JaEJzwC.exe
  C:\Windows\System\JaEJzwC.exe
  2⤵
  PID:3204
- C:\Windows\System\LGiYIkN.exe
  C:\Windows\System\LGiYIkN.exe
  2⤵
  PID:3224
- C:\Windows\System\fTxiZid.exe
  C:\Windows\System\fTxiZid.exe
  2⤵
  PID:3240
- C:\Windows\System\HPayWGf.exe
  C:\Windows\System\HPayWGf.exe
  2⤵
  PID:3256
- C:\Windows\System\GlafyXD.exe
  C:\Windows\System\GlafyXD.exe
  2⤵
  PID:3272
- C:\Windows\System\nZOwqPY.exe
  C:\Windows\System\nZOwqPY.exe
  2⤵
  PID:3316
- C:\Windows\System\USfVzUU.exe
  C:\Windows\System\USfVzUU.exe
  2⤵
  PID:3344
- C:\Windows\System\XyeufUt.exe
  C:\Windows\System\XyeufUt.exe
  2⤵
  PID:3364
- C:\Windows\System\QrZCWkI.exe
  C:\Windows\System\QrZCWkI.exe
  2⤵
  PID:3380
- C:\Windows\System\CoiAExu.exe
  C:\Windows\System\CoiAExu.exe
  2⤵
  PID:3400
- C:\Windows\System\YIXWiGo.exe
  C:\Windows\System\YIXWiGo.exe
  2⤵
  PID:3416
- C:\Windows\System\wZdWuYF.exe
  C:\Windows\System\wZdWuYF.exe
  2⤵
  PID:3432
- C:\Windows\System\Tqqwrnr.exe
  C:\Windows\System\Tqqwrnr.exe
  2⤵
  PID:3448
- C:\Windows\System\cAqrqJq.exe
  C:\Windows\System\cAqrqJq.exe
  2⤵
  PID:3464
- C:\Windows\System\mYtDOZz.exe
  C:\Windows\System\mYtDOZz.exe
  2⤵
  PID:3480
- C:\Windows\System\foVFChm.exe
  C:\Windows\System\foVFChm.exe
  2⤵
  PID:3496
- C:\Windows\System\YYEjmkf.exe
  C:\Windows\System\YYEjmkf.exe
  2⤵
  PID:3512
- C:\Windows\System\yEklGPK.exe
  C:\Windows\System\yEklGPK.exe
  2⤵
  PID:3544
- C:\Windows\System\pIovGTs.exe
  C:\Windows\System\pIovGTs.exe
  2⤵
  PID:3560
- C:\Windows\System\ISUryKr.exe
  C:\Windows\System\ISUryKr.exe
  2⤵
  PID:3576
- C:\Windows\System\RDXEfQj.exe
  C:\Windows\System\RDXEfQj.exe
  2⤵
  PID:3592
- C:\Windows\System\YKmteAn.exe
  C:\Windows\System\YKmteAn.exe
  2⤵
  PID:3608
- C:\Windows\System\saeWjhg.exe
  C:\Windows\System\saeWjhg.exe
  2⤵
  PID:3624
- C:\Windows\System\OOOVgjk.exe
  C:\Windows\System\OOOVgjk.exe
  2⤵
  PID:3640
- C:\Windows\System\pwhLKYu.exe
  C:\Windows\System\pwhLKYu.exe
  2⤵
  PID:3656
- C:\Windows\System\cpycJip.exe
  C:\Windows\System\cpycJip.exe
  2⤵
  PID:3672
- C:\Windows\System\sfNapyc.exe
  C:\Windows\System\sfNapyc.exe
  2⤵
  PID:3688
- C:\Windows\System\cxcfbof.exe
  C:\Windows\System\cxcfbof.exe
  2⤵
  PID:3708
- C:\Windows\System\hXNiccM.exe
  C:\Windows\System\hXNiccM.exe
  2⤵
  PID:3724
- C:\Windows\System\JPDprbn.exe
  C:\Windows\System\JPDprbn.exe
  2⤵
  PID:3744
- C:\Windows\System\iQCgHWv.exe
  C:\Windows\System\iQCgHWv.exe
  2⤵
  PID:3760
- C:\Windows\System\LpSxvNY.exe
  C:\Windows\System\LpSxvNY.exe
  2⤵
  PID:3792
- C:\Windows\System\ylrOCll.exe
  C:\Windows\System\ylrOCll.exe
  2⤵
  PID:3808
- C:\Windows\System\vNWBJTD.exe
  C:\Windows\System\vNWBJTD.exe
  2⤵
  PID:3852
- C:\Windows\System\dFPNvcW.exe
  C:\Windows\System\dFPNvcW.exe
  2⤵
  PID:3912
- C:\Windows\System\SuySViP.exe
  C:\Windows\System\SuySViP.exe
  2⤵
  PID:3936
- C:\Windows\System\ztATSRY.exe
  C:\Windows\System\ztATSRY.exe
  2⤵
  PID:3952
- C:\Windows\System\MZVTlhM.exe
  C:\Windows\System\MZVTlhM.exe
  2⤵
  PID:3968
- C:\Windows\System\CjfELtK.exe
  C:\Windows\System\CjfELtK.exe
  2⤵
  PID:3984
- C:\Windows\System\xUsMpym.exe
  C:\Windows\System\xUsMpym.exe
  2⤵
  PID:4000
- C:\Windows\System\iDwaFBb.exe
  C:\Windows\System\iDwaFBb.exe
  2⤵
  PID:4020
- C:\Windows\System\IKTTtNi.exe
  C:\Windows\System\IKTTtNi.exe
  2⤵
  PID:4036
- C:\Windows\System\dUQcLnx.exe
  C:\Windows\System\dUQcLnx.exe
  2⤵
  PID:4056
- C:\Windows\System\qtkfDDl.exe
  C:\Windows\System\qtkfDDl.exe
  2⤵
  PID:4072
- C:\Windows\System\JItEdav.exe
  C:\Windows\System\JItEdav.exe
  2⤵
  PID:4088
- C:\Windows\System\MgBFDdP.exe
  C:\Windows\System\MgBFDdP.exe
  2⤵
  PID:1824
- C:\Windows\System\CQETERY.exe
  C:\Windows\System\CQETERY.exe
  2⤵
  PID:2384
- C:\Windows\System\fpgzAdX.exe
  C:\Windows\System\fpgzAdX.exe
  2⤵
  PID:3088
- C:\Windows\System\obgloIr.exe
  C:\Windows\System\obgloIr.exe
  2⤵
  PID:3124
- C:\Windows\System\WcrJyVg.exe
  C:\Windows\System\WcrJyVg.exe
  2⤵
  PID:3144
- C:\Windows\System\uYidCOr.exe
  C:\Windows\System\uYidCOr.exe
  2⤵
  PID:800
- C:\Windows\System\XgVjwIy.exe
  C:\Windows\System\XgVjwIy.exe
  2⤵
  PID:3216
- C:\Windows\System\YARgrdA.exe
  C:\Windows\System\YARgrdA.exe
  2⤵
  PID:3288
- C:\Windows\System\gWuZzcs.exe
  C:\Windows\System\gWuZzcs.exe
  2⤵
  PID:2948
- C:\Windows\System\jqgUlcL.exe
  C:\Windows\System\jqgUlcL.exe
  2⤵
  PID:2672
- C:\Windows\System\JfQmyDG.exe
  C:\Windows\System\JfQmyDG.exe
  2⤵
  PID:3104
- C:\Windows\System\NEJLwRb.exe
  C:\Windows\System\NEJLwRb.exe
  2⤵
  PID:3164
- C:\Windows\System\sfUjHyV.exe
  C:\Windows\System\sfUjHyV.exe
  2⤵
  PID:3232
- C:\Windows\System\LhhYrwW.exe
  C:\Windows\System\LhhYrwW.exe
  2⤵
  PID:3328
- C:\Windows\System\AgarJsP.exe
  C:\Windows\System\AgarJsP.exe
  2⤵
  PID:3340
- C:\Windows\System\eqeKHOb.exe
  C:\Windows\System\eqeKHOb.exe
  2⤵
  PID:2352
- C:\Windows\System\wqnniXF.exe
  C:\Windows\System\wqnniXF.exe
  2⤵
  PID:3428
- C:\Windows\System\VfxRtvB.exe
  C:\Windows\System\VfxRtvB.exe
  2⤵
  PID:3488
- C:\Windows\System\MOQFUMo.exe
  C:\Windows\System\MOQFUMo.exe
  2⤵
  PID:2508
- C:\Windows\System\xAvNRYv.exe
  C:\Windows\System\xAvNRYv.exe
  2⤵
  PID:2284
- C:\Windows\System\MWVZuwq.exe
  C:\Windows\System\MWVZuwq.exe
  2⤵
  PID:3408
- C:\Windows\System\FdiXuos.exe
  C:\Windows\System\FdiXuos.exe
  2⤵
  PID:3528
- C:\Windows\System\ZbnpGJv.exe
  C:\Windows\System\ZbnpGJv.exe
  2⤵
  PID:3568
- C:\Windows\System\KWRGlZd.exe
  C:\Windows\System\KWRGlZd.exe
  2⤵
  PID:3632
- C:\Windows\System\cmJsxhL.exe
  C:\Windows\System\cmJsxhL.exe
  2⤵
  PID:3696
- C:\Windows\System\BtVbZPL.exe
  C:\Windows\System\BtVbZPL.exe
  2⤵
  PID:3816
- C:\Windows\System\XutVSpd.exe
  C:\Windows\System\XutVSpd.exe
  2⤵
  PID:3720
- C:\Windows\System\McjEjig.exe
  C:\Windows\System\McjEjig.exe
  2⤵
  PID:3556
- C:\Windows\System\LjjHDhZ.exe
  C:\Windows\System\LjjHDhZ.exe
  2⤵
  PID:3648
- C:\Windows\System\aWTuegX.exe
  C:\Windows\System\aWTuegX.exe
  2⤵
  PID:3584
- C:\Windows\System\KDgiRHA.exe
  C:\Windows\System\KDgiRHA.exe
  2⤵
  PID:2668
- C:\Windows\System\LTjDRWH.exe
  C:\Windows\System\LTjDRWH.exe
  2⤵
  PID:3884
- C:\Windows\System\UJTPqWY.exe
  C:\Windows\System\UJTPqWY.exe
  2⤵
  PID:2132
- C:\Windows\System\zvLjzss.exe
  C:\Windows\System\zvLjzss.exe
  2⤵
  PID:3964
- C:\Windows\System\SRUtPpT.exe
  C:\Windows\System\SRUtPpT.exe
  2⤵
  PID:3304
- C:\Windows\System\hyrgAoh.exe
  C:\Windows\System\hyrgAoh.exe
  2⤵
  PID:2852
- C:\Windows\System\NnsmkWd.exe
  C:\Windows\System\NnsmkWd.exe
  2⤵
  PID:3352
- C:\Windows\System\YdYYqNx.exe
  C:\Windows\System\YdYYqNx.exe
  2⤵
  PID:3376
- C:\Windows\System\wfhRTSC.exe
  C:\Windows\System\wfhRTSC.exe
  2⤵
  PID:3540
- C:\Windows\System\ZlgFwzF.exe
  C:\Windows\System\ZlgFwzF.exe
  2⤵
  PID:2816
- C:\Windows\System\shHhbYa.exe
  C:\Windows\System\shHhbYa.exe
  2⤵
  PID:1324
- C:\Windows\System\fyzIJfx.exe
  C:\Windows\System\fyzIJfx.exe
  2⤵
  PID:3280
- C:\Windows\System\WOuOldb.exe
  C:\Windows\System\WOuOldb.exe
  2⤵
  PID:1268
- C:\Windows\System\JBGWiqU.exe
  C:\Windows\System\JBGWiqU.exe
  2⤵
  PID:3372
- C:\Windows\System\cfkpgWp.exe
  C:\Windows\System\cfkpgWp.exe
  2⤵
  PID:3704
- C:\Windows\System\gxdQVsS.exe
  C:\Windows\System\gxdQVsS.exe
  2⤵
  PID:3264
- C:\Windows\System\zanoSTM.exe
  C:\Windows\System\zanoSTM.exe
  2⤵
  PID:3248
- C:\Windows\System\UsHqPUo.exe
  C:\Windows\System\UsHqPUo.exe
  2⤵
  PID:3084
- C:\Windows\System\JIyqWYR.exe
  C:\Windows\System\JIyqWYR.exe
  2⤵
  PID:4048
- C:\Windows\System\hLBQBYL.exe
  C:\Windows\System\hLBQBYL.exe
  2⤵
  PID:3980
- C:\Windows\System\NMmdNpP.exe
  C:\Windows\System\NMmdNpP.exe
  2⤵
  PID:3716
- C:\Windows\System\yMQutQL.exe
  C:\Windows\System\yMQutQL.exe
  2⤵
  PID:3892
- C:\Windows\System\dxTzyHO.exe
  C:\Windows\System\dxTzyHO.exe
  2⤵
  PID:3996
- C:\Windows\System\yrjEDQm.exe
  C:\Windows\System\yrjEDQm.exe
  2⤵
  PID:3800
- C:\Windows\System\HGGsxmS.exe
  C:\Windows\System\HGGsxmS.exe
  2⤵
  PID:3868
- C:\Windows\System\dNGUfPx.exe
  C:\Windows\System\dNGUfPx.exe
  2⤵
  PID:3924
- C:\Windows\System\poeMemo.exe
  C:\Windows\System\poeMemo.exe
  2⤵
  PID:4068
- C:\Windows\System\dAiMzoo.exe
  C:\Windows\System\dAiMzoo.exe
  2⤵
  PID:3080
- C:\Windows\System\iuYvlKH.exe
  C:\Windows\System\iuYvlKH.exe
  2⤵
  PID:3212
- C:\Windows\System\QVSXqMI.exe
  C:\Windows\System\QVSXqMI.exe
  2⤵
  PID:3336
- C:\Windows\System\oWkDAIf.exe
  C:\Windows\System\oWkDAIf.exe
  2⤵
  PID:2044
- C:\Windows\System\YEmUcYz.exe
  C:\Windows\System\YEmUcYz.exe
  2⤵
  PID:2812
- C:\Windows\System\EpVXrZq.exe
  C:\Windows\System\EpVXrZq.exe
  2⤵
  PID:2572
- C:\Windows\System\VeanHYM.exe
  C:\Windows\System\VeanHYM.exe
  2⤵
  PID:3268
- C:\Windows\System\CxxEjrw.exe
  C:\Windows\System\CxxEjrw.exe
  2⤵
  PID:4012
- C:\Windows\System\iZKvGFa.exe
  C:\Windows\System\iZKvGFa.exe
  2⤵
  PID:4052
- C:\Windows\System\kcyQDRi.exe
  C:\Windows\System\kcyQDRi.exe
  2⤵
  PID:3652
- C:\Windows\System\GHUSXkQ.exe
  C:\Windows\System\GHUSXkQ.exe
  2⤵
  PID:2844
- C:\Windows\System\aGNjrQq.exe
  C:\Windows\System\aGNjrQq.exe
  2⤵
  PID:3756
- C:\Windows\System\DqdRRCk.exe
  C:\Windows\System\DqdRRCk.exe
  2⤵
  PID:4064
- C:\Windows\System\OWGrBuo.exe
  C:\Windows\System\OWGrBuo.exe
  2⤵
  PID:3412
- C:\Windows\System\hdJvukq.exe
  C:\Windows\System\hdJvukq.exe
  2⤵
  PID:3296
- C:\Windows\System\xfPCtoR.exe
  C:\Windows\System\xfPCtoR.exe
  2⤵
  PID:3848
- C:\Windows\System\XaPkqmj.exe
  C:\Windows\System\XaPkqmj.exe
  2⤵
  PID:3876
- C:\Windows\System\UodNzDW.exe
  C:\Windows\System\UodNzDW.exe
  2⤵
  PID:3200
- C:\Windows\System\kxNArdd.exe
  C:\Windows\System\kxNArdd.exe
  2⤵
  PID:3524
- C:\Windows\System\crLoTkx.exe
  C:\Windows\System\crLoTkx.exe
  2⤵
  PID:3948
- C:\Windows\System\bySiklC.exe
  C:\Windows\System\bySiklC.exe
  2⤵
  PID:3460
- C:\Windows\System\HUSNRHS.exe
  C:\Windows\System\HUSNRHS.exe
  2⤵
  PID:676
- C:\Windows\System\goAyDcg.exe
  C:\Windows\System\goAyDcg.exe
  2⤵
  PID:3944
- C:\Windows\System\uqZGVFj.exe
  C:\Windows\System\uqZGVFj.exe
  2⤵
  PID:3680
- C:\Windows\System\RPgykzW.exe
  C:\Windows\System\RPgykzW.exe
  2⤵
  PID:2612
- C:\Windows\System\WMincTe.exe
  C:\Windows\System\WMincTe.exe
  2⤵
  PID:1724
- C:\Windows\System\eGlFKaD.exe
  C:\Windows\System\eGlFKaD.exe
  2⤵
  PID:3396
- C:\Windows\System\zBBthIR.exe
  C:\Windows\System\zBBthIR.exe
  2⤵
  PID:3668
- C:\Windows\System\lLWxGiw.exe
  C:\Windows\System\lLWxGiw.exe
  2⤵
  PID:4016
- C:\Windows\System\ZnPuVqW.exe
  C:\Windows\System\ZnPuVqW.exe
  2⤵
  PID:4080
- C:\Windows\System\VaJNwgp.exe
  C:\Windows\System\VaJNwgp.exe
  2⤵
  PID:3588
- C:\Windows\System\ZbTTPWR.exe
  C:\Windows\System\ZbTTPWR.exe
  2⤵
  PID:2644
- C:\Windows\System\lxioJTX.exe
  C:\Windows\System\lxioJTX.exe
  2⤵
  PID:4112
- C:\Windows\System\jBhIybC.exe
  C:\Windows\System\jBhIybC.exe
  2⤵
  PID:4132
- C:\Windows\System\JLQEYTJ.exe
  C:\Windows\System\JLQEYTJ.exe
  2⤵
  PID:4152
- C:\Windows\System\sQpKaWT.exe
  C:\Windows\System\sQpKaWT.exe
  2⤵
  PID:4168
- C:\Windows\System\KRSHlUr.exe
  C:\Windows\System\KRSHlUr.exe
  2⤵
  PID:4184
- C:\Windows\System\VJevONf.exe
  C:\Windows\System\VJevONf.exe
  2⤵
  PID:4208
- C:\Windows\System\yukKkXC.exe
  C:\Windows\System\yukKkXC.exe
  2⤵
  PID:4228
- C:\Windows\System\gnyVaah.exe
  C:\Windows\System\gnyVaah.exe
  2⤵
  PID:4244
- C:\Windows\System\XxludSj.exe
  C:\Windows\System\XxludSj.exe
  2⤵
  PID:4268
- C:\Windows\System\pvIxRaJ.exe
  C:\Windows\System\pvIxRaJ.exe
  2⤵
  PID:4288
- C:\Windows\System\ggoeJXD.exe
  C:\Windows\System\ggoeJXD.exe
  2⤵
  PID:4308
- C:\Windows\System\uxrKIuT.exe
  C:\Windows\System\uxrKIuT.exe
  2⤵
  PID:4324
- C:\Windows\System\EPCntSF.exe
  C:\Windows\System\EPCntSF.exe
  2⤵
  PID:4344
- C:\Windows\System\SotIeWg.exe
  C:\Windows\System\SotIeWg.exe
  2⤵
  PID:4364
- C:\Windows\System\AOuFmCi.exe
  C:\Windows\System\AOuFmCi.exe
  2⤵
  PID:4396
- C:\Windows\System\SkaLSHB.exe
  C:\Windows\System\SkaLSHB.exe
  2⤵
  PID:4412
- C:\Windows\System\ZixRxSQ.exe
  C:\Windows\System\ZixRxSQ.exe
  2⤵
  PID:4440
- C:\Windows\System\UdbJuAk.exe
  C:\Windows\System\UdbJuAk.exe
  2⤵
  PID:4464
- C:\Windows\System\qatuNSC.exe
  C:\Windows\System\qatuNSC.exe
  2⤵
  PID:4484
- C:\Windows\System\wDPlQnu.exe
  C:\Windows\System\wDPlQnu.exe
  2⤵
  PID:4500
- C:\Windows\System\xMDHEBg.exe
  C:\Windows\System\xMDHEBg.exe
  2⤵
  PID:4516
- C:\Windows\System\vJoCnaZ.exe
  C:\Windows\System\vJoCnaZ.exe
  2⤵
  PID:4532
- C:\Windows\System\KLhZXQS.exe
  C:\Windows\System\KLhZXQS.exe
  2⤵
  PID:4556
- C:\Windows\System\ZRcUIrc.exe
  C:\Windows\System\ZRcUIrc.exe
  2⤵
  PID:4596
- C:\Windows\System\QkooxDC.exe
  C:\Windows\System\QkooxDC.exe
  2⤵
  PID:4612
- C:\Windows\System\BiRofIk.exe
  C:\Windows\System\BiRofIk.exe
  2⤵
  PID:4628
- C:\Windows\System\IEHbYii.exe
  C:\Windows\System\IEHbYii.exe
  2⤵
  PID:4644
- C:\Windows\System\rzdFAYE.exe
  C:\Windows\System\rzdFAYE.exe
  2⤵
  PID:4660
- C:\Windows\System\IyylniF.exe
  C:\Windows\System\IyylniF.exe
  2⤵
  PID:4676
- C:\Windows\System\dvJPnFO.exe
  C:\Windows\System\dvJPnFO.exe
  2⤵
  PID:4712
- C:\Windows\System\exzZdWI.exe
  C:\Windows\System\exzZdWI.exe
  2⤵
  PID:4728
- C:\Windows\System\oDYrNix.exe
  C:\Windows\System\oDYrNix.exe
  2⤵
  PID:4744
- C:\Windows\System\SIxHhoM.exe
  C:\Windows\System\SIxHhoM.exe
  2⤵
  PID:4764
- C:\Windows\System\lmIuBau.exe
  C:\Windows\System\lmIuBau.exe
  2⤵
  PID:4784
- C:\Windows\System\sseiJOM.exe
  C:\Windows\System\sseiJOM.exe
  2⤵
  PID:4812
- C:\Windows\System\YEdJofm.exe
  C:\Windows\System\YEdJofm.exe
  2⤵
  PID:4828
- C:\Windows\System\AlRqlbF.exe
  C:\Windows\System\AlRqlbF.exe
  2⤵
  PID:4844
- C:\Windows\System\DSUNWuT.exe
  C:\Windows\System\DSUNWuT.exe
  2⤵
  PID:4864
- C:\Windows\System\LbPSHTo.exe
  C:\Windows\System\LbPSHTo.exe
  2⤵
  PID:4880
- C:\Windows\System\ZLLVWMG.exe
  C:\Windows\System\ZLLVWMG.exe
  2⤵
  PID:4896
- C:\Windows\System\WUQJJHK.exe
  C:\Windows\System\WUQJJHK.exe
  2⤵
  PID:4916
- C:\Windows\System\kuPKQmg.exe
  C:\Windows\System\kuPKQmg.exe
  2⤵
  PID:4944
- C:\Windows\System\BsyeRGo.exe
  C:\Windows\System\BsyeRGo.exe
  2⤵
  PID:4964
- C:\Windows\System\ZzOWxYv.exe
  C:\Windows\System\ZzOWxYv.exe
  2⤵
  PID:4980
- C:\Windows\System\CQLLsEZ.exe
  C:\Windows\System\CQLLsEZ.exe
  2⤵
  PID:4996
- C:\Windows\System\antNUuf.exe
  C:\Windows\System\antNUuf.exe
  2⤵
  PID:5016
- C:\Windows\System\OdoZbEe.exe
  C:\Windows\System\OdoZbEe.exe
  2⤵
  PID:5032
- C:\Windows\System\SokQqjN.exe
  C:\Windows\System\SokQqjN.exe
  2⤵
  PID:5056
- C:\Windows\System\XpvrVFp.exe
  C:\Windows\System\XpvrVFp.exe
  2⤵
  PID:5080
- C:\Windows\System\qMGtdzJ.exe
  C:\Windows\System\qMGtdzJ.exe
  2⤵
  PID:5108
- C:\Windows\System\YGfHJHS.exe
  C:\Windows\System\YGfHJHS.exe
  2⤵
  PID:2296
- C:\Windows\System\LZZDEkY.exe
  C:\Windows\System\LZZDEkY.exe
  2⤵
  PID:3788
- C:\Windows\System\NgZWZtN.exe
  C:\Windows\System\NgZWZtN.exe
  2⤵
  PID:4164
- C:\Windows\System\MlpowYF.exe
  C:\Windows\System\MlpowYF.exe
  2⤵
  PID:4204
- C:\Windows\System\uoKBsfP.exe
  C:\Windows\System\uoKBsfP.exe
  2⤵
  PID:4276
- C:\Windows\System\xoyTnWq.exe
  C:\Windows\System\xoyTnWq.exe
  2⤵
  PID:4320
- C:\Windows\System\DCLtQpO.exe
  C:\Windows\System\DCLtQpO.exe
  2⤵
  PID:4356
- C:\Windows\System\wNEsFvP.exe
  C:\Windows\System\wNEsFvP.exe
  2⤵
  PID:4108
- C:\Windows\System\MsBYyjM.exe
  C:\Windows\System\MsBYyjM.exe
  2⤵
  PID:4104
- C:\Windows\System\qzUFmZe.exe
  C:\Windows\System\qzUFmZe.exe
  2⤵
  PID:4408
- C:\Windows\System\mLEthCT.exe
  C:\Windows\System\mLEthCT.exe
  2⤵
  PID:4388
- C:\Windows\System\RwIgfry.exe
  C:\Windows\System\RwIgfry.exe
  2⤵
  PID:4264
- C:\Windows\System\jVtXFro.exe
  C:\Windows\System\jVtXFro.exe
  2⤵
  PID:4448
- C:\Windows\System\swaiAFo.exe
  C:\Windows\System\swaiAFo.exe
  2⤵
  PID:4420
- C:\Windows\System\UVIVFPi.exe
  C:\Windows\System\UVIVFPi.exe
  2⤵
  PID:4492
- C:\Windows\System\mLBqLKm.exe
  C:\Windows\System\mLBqLKm.exe
  2⤵
  PID:4480
- C:\Windows\System\kdrBzXa.exe
  C:\Windows\System\kdrBzXa.exe
  2⤵
  PID:4548
- C:\Windows\System\rwmByvX.exe
  C:\Windows\System\rwmByvX.exe
  2⤵
  PID:4572
- C:\Windows\System\bxPucmj.exe
  C:\Windows\System\bxPucmj.exe
  2⤵
  PID:4588
- C:\Windows\System\kkmNrhD.exe
  C:\Windows\System\kkmNrhD.exe
  2⤵
  PID:4640
- C:\Windows\System\NkhIgwC.exe
  C:\Windows\System\NkhIgwC.exe
  2⤵
  PID:4684
- C:\Windows\System\BarspEL.exe
  C:\Windows\System\BarspEL.exe
  2⤵
  PID:4704
- C:\Windows\System\CiTZgaU.exe
  C:\Windows\System\CiTZgaU.exe
  2⤵
  PID:4720
- C:\Windows\System\mlIksTm.exe
  C:\Windows\System\mlIksTm.exe
  2⤵
  PID:4796
- C:\Windows\System\TajiVxi.exe
  C:\Windows\System\TajiVxi.exe
  2⤵
  PID:4780
- C:\Windows\System\TlfqBee.exe
  C:\Windows\System\TlfqBee.exe
  2⤵
  PID:4824
- C:\Windows\System\ppHgHea.exe
  C:\Windows\System\ppHgHea.exe
  2⤵
  PID:4892
- C:\Windows\System\MLzwdwH.exe
  C:\Windows\System\MLzwdwH.exe
  2⤵
  PID:4924
- C:\Windows\System\ehkdFHp.exe
  C:\Windows\System\ehkdFHp.exe
  2⤵
  PID:5008
- C:\Windows\System\okbWNlD.exe
  C:\Windows\System\okbWNlD.exe
  2⤵
  PID:5044
- C:\Windows\System\LMKaaNa.exe
  C:\Windows\System\LMKaaNa.exe
  2⤵
  PID:4988
- C:\Windows\System\KCwhADX.exe
  C:\Windows\System\KCwhADX.exe
  2⤵
  PID:5088
- C:\Windows\System\hxaULaD.exe
  C:\Windows\System\hxaULaD.exe
  2⤵
  PID:4952
- C:\Windows\System\qrtwKRy.exe
  C:\Windows\System\qrtwKRy.exe
  2⤵
  PID:4124
- C:\Windows\System\XofXGku.exe
  C:\Windows\System\XofXGku.exe
  2⤵
  PID:4284
- C:\Windows\System\xIQWkni.exe
  C:\Windows\System\xIQWkni.exe
  2⤵
  PID:5072
- C:\Windows\System\DlXRRVG.exe
  C:\Windows\System\DlXRRVG.exe
  2⤵
  PID:4240
- C:\Windows\System\DyQkKtO.exe
  C:\Windows\System\DyQkKtO.exe
  2⤵
  PID:3312
- C:\Windows\System\GUUYNfi.exe
  C:\Windows\System\GUUYNfi.exe
  2⤵
  PID:4256
- C:\Windows\System\wKFfeZv.exe
  C:\Windows\System\wKFfeZv.exe
  2⤵
  PID:4384
- C:\Windows\System\HRbLWao.exe
  C:\Windows\System\HRbLWao.exe
  2⤵
  PID:3960
- C:\Windows\System\vsaXfVh.exe
  C:\Windows\System\vsaXfVh.exe
  2⤵
  PID:4540
- C:\Windows\System\fZXUNAN.exe
  C:\Windows\System\fZXUNAN.exe
  2⤵
  PID:4508
- C:\Windows\System\IABYBzu.exe
  C:\Windows\System\IABYBzu.exe
  2⤵
  PID:4460
- C:\Windows\System\WPpBtmx.exe
  C:\Windows\System\WPpBtmx.exe
  2⤵
  PID:4692
- C:\Windows\System\LnZcQNm.exe
  C:\Windows\System\LnZcQNm.exe
  2⤵
  PID:4756
- C:\Windows\System\fjJuwoq.exe
  C:\Windows\System\fjJuwoq.exe
  2⤵
  PID:4820
- C:\Windows\System\MRowfcr.exe
  C:\Windows\System\MRowfcr.exe
  2⤵
  PID:4656
- C:\Windows\System\tTPSgrZ.exe
  C:\Windows\System\tTPSgrZ.exe
  2⤵
  PID:4772
- C:\Windows\System\sNOghnn.exe
  C:\Windows\System\sNOghnn.exe
  2⤵
  PID:4932
- C:\Windows\System\RHzqFdL.exe
  C:\Windows\System\RHzqFdL.exe
  2⤵
  PID:4908
- C:\Windows\System\QXJUBGF.exe
  C:\Windows\System\QXJUBGF.exe
  2⤵
  PID:4956
- C:\Windows\System\FmcAsma.exe
  C:\Windows\System\FmcAsma.exe
  2⤵
  PID:5104
- C:\Windows\System\tCPrVUT.exe
  C:\Windows\System\tCPrVUT.exe
  2⤵
  PID:4316
- C:\Windows\System\UqnEhgE.exe
  C:\Windows\System\UqnEhgE.exe
  2⤵
  PID:4236
- C:\Windows\System\jrBzVoI.exe
  C:\Windows\System\jrBzVoI.exe
  2⤵
  PID:3908
- C:\Windows\System\pRrezDF.exe
  C:\Windows\System\pRrezDF.exe
  2⤵
  PID:4220
- C:\Windows\System\nHQTtgl.exe
  C:\Windows\System\nHQTtgl.exe
  2⤵
  PID:4392
- C:\Windows\System\dGKuVFd.exe
  C:\Windows\System\dGKuVFd.exe
  2⤵
  PID:4524
- C:\Windows\System\gGOoqqR.exe
  C:\Windows\System\gGOoqqR.exe
  2⤵
  PID:4568
- C:\Windows\System\pYwzoZH.exe
  C:\Windows\System\pYwzoZH.exe
  2⤵
  PID:4580
- C:\Windows\System\tSmYbYa.exe
  C:\Windows\System\tSmYbYa.exe
  2⤵
  PID:4700
- C:\Windows\System\tiiKQdu.exe
  C:\Windows\System\tiiKQdu.exe
  2⤵
  PID:4652
- C:\Windows\System\wePMoFt.exe
  C:\Windows\System\wePMoFt.exe
  2⤵
  PID:4904
- C:\Windows\System\RBnIjDI.exe
  C:\Windows\System\RBnIjDI.exe
  2⤵
  PID:4792
- C:\Windows\System\RanPqAM.exe
  C:\Windows\System\RanPqAM.exe
  2⤵
  PID:4668
- C:\Windows\System\jayrUQh.exe
  C:\Windows\System\jayrUQh.exe
  2⤵
  PID:5096
- C:\Windows\System\OGFNiBJ.exe
  C:\Windows\System\OGFNiBJ.exe
  2⤵
  PID:4196
- C:\Windows\System\DzEkWvQ.exe
  C:\Windows\System\DzEkWvQ.exe
  2⤵
  PID:4380
- C:\Windows\System\dihWgNl.exe
  C:\Windows\System\dihWgNl.exe
  2⤵
  PID:5136
- C:\Windows\System\Ujutprn.exe
  C:\Windows\System\Ujutprn.exe
  2⤵
  PID:5152
- C:\Windows\System\tFqdTYZ.exe
  C:\Windows\System\tFqdTYZ.exe
  2⤵
  PID:5172
- C:\Windows\System\koCASPM.exe
  C:\Windows\System\koCASPM.exe
  2⤵
  PID:5192
- C:\Windows\System\sbkRXXd.exe
  C:\Windows\System\sbkRXXd.exe
  2⤵
  PID:5212
- C:\Windows\System\MSUrHMb.exe
  C:\Windows\System\MSUrHMb.exe
  2⤵
  PID:5228
- C:\Windows\System\TyozkSd.exe
  C:\Windows\System\TyozkSd.exe
  2⤵
  PID:5248
- C:\Windows\System\ZWJVzek.exe
  C:\Windows\System\ZWJVzek.exe
  2⤵
  PID:5264
- C:\Windows\System\YzIgcLn.exe
  C:\Windows\System\YzIgcLn.exe
  2⤵
  PID:5280
- C:\Windows\System\XThKTEw.exe
  C:\Windows\System\XThKTEw.exe
  2⤵
  PID:5296
- C:\Windows\System\cbdEBmE.exe
  C:\Windows\System\cbdEBmE.exe
  2⤵
  PID:5360
- C:\Windows\System\fRssNJH.exe
  C:\Windows\System\fRssNJH.exe
  2⤵
  PID:5380
- C:\Windows\System\GuDXAiC.exe
  C:\Windows\System\GuDXAiC.exe
  2⤵
  PID:5396
- C:\Windows\System\QBGvBzD.exe
  C:\Windows\System\QBGvBzD.exe
  2⤵
  PID:5412
- C:\Windows\System\ZPsdvQi.exe
  C:\Windows\System\ZPsdvQi.exe
  2⤵
  PID:5428
- C:\Windows\System\KtCyCZh.exe
  C:\Windows\System\KtCyCZh.exe
  2⤵
  PID:5444
- C:\Windows\System\otSxDBs.exe
  C:\Windows\System\otSxDBs.exe
  2⤵
  PID:5464
- C:\Windows\System\IRCjxqr.exe
  C:\Windows\System\IRCjxqr.exe
  2⤵
  PID:5484
- C:\Windows\System\rtAaANN.exe
  C:\Windows\System\rtAaANN.exe
  2⤵
  PID:5500
- C:\Windows\System\EOZLodQ.exe
  C:\Windows\System\EOZLodQ.exe
  2⤵
  PID:5516
- C:\Windows\System\jQiSOPQ.exe
  C:\Windows\System\jQiSOPQ.exe
  2⤵
  PID:5532
- C:\Windows\System\rMhyswL.exe
  C:\Windows\System\rMhyswL.exe
  2⤵
  PID:5548
- C:\Windows\System\sRfefwC.exe
  C:\Windows\System\sRfefwC.exe
  2⤵
  PID:5564
- C:\Windows\System\fbeBFQm.exe
  C:\Windows\System\fbeBFQm.exe
  2⤵
  PID:5580
- C:\Windows\System\voLvzOm.exe
  C:\Windows\System\voLvzOm.exe
  2⤵
  PID:5596
- C:\Windows\System\TYECrxq.exe
  C:\Windows\System\TYECrxq.exe
  2⤵
  PID:5616
- C:\Windows\System\fCacwOF.exe
  C:\Windows\System\fCacwOF.exe
  2⤵
  PID:5636
- C:\Windows\System\MjSTpXd.exe
  C:\Windows\System\MjSTpXd.exe
  2⤵
  PID:5656
- C:\Windows\System\zNDzdvw.exe
  C:\Windows\System\zNDzdvw.exe
  2⤵
  PID:5676
- C:\Windows\System\yMahLSc.exe
  C:\Windows\System\yMahLSc.exe
  2⤵
  PID:5692
- C:\Windows\System\fvKEnWs.exe
  C:\Windows\System\fvKEnWs.exe
  2⤵
  PID:5708
- C:\Windows\System\khRInLR.exe
  C:\Windows\System\khRInLR.exe
  2⤵
  PID:5728
- C:\Windows\System\ShZlueh.exe
  C:\Windows\System\ShZlueh.exe
  2⤵
  PID:5744
- C:\Windows\System\zjTvPvx.exe
  C:\Windows\System\zjTvPvx.exe
  2⤵
  PID:5764
- C:\Windows\System\TVtmjOd.exe
  C:\Windows\System\TVtmjOd.exe
  2⤵
  PID:5784
- C:\Windows\System\PzmoGdT.exe
  C:\Windows\System\PzmoGdT.exe
  2⤵
  PID:5824
- C:\Windows\System\DskhfrH.exe
  C:\Windows\System\DskhfrH.exe
  2⤵
  PID:5880
- C:\Windows\System\QOmFzcB.exe
  C:\Windows\System\QOmFzcB.exe
  2⤵
  PID:5908
- C:\Windows\System\ISUmenh.exe
  C:\Windows\System\ISUmenh.exe
  2⤵
  PID:5924
- C:\Windows\System\prDIFiY.exe
  C:\Windows\System\prDIFiY.exe
  2⤵
  PID:5940
- C:\Windows\System\wnIammX.exe
  C:\Windows\System\wnIammX.exe
  2⤵
  PID:5960
- C:\Windows\System\fsVUUZG.exe
  C:\Windows\System\fsVUUZG.exe
  2⤵
  PID:5980
- C:\Windows\System\NydimpS.exe
  C:\Windows\System\NydimpS.exe
  2⤵
  PID:5996
- C:\Windows\System\CbvseTG.exe
  C:\Windows\System\CbvseTG.exe
  2⤵
  PID:6012
- C:\Windows\System\ypYWDLr.exe
  C:\Windows\System\ypYWDLr.exe
  2⤵
  PID:6032
- C:\Windows\System\kaPwsVV.exe
  C:\Windows\System\kaPwsVV.exe
  2⤵
  PID:6052
- C:\Windows\System\BtgJism.exe
  C:\Windows\System\BtgJism.exe
  2⤵
  PID:6080
- C:\Windows\System\bRBqWOZ.exe
  C:\Windows\System\bRBqWOZ.exe
  2⤵
  PID:6096
- C:\Windows\System\WGSmOWV.exe
  C:\Windows\System\WGSmOWV.exe
  2⤵
  PID:6112
- C:\Windows\System\GGduyHg.exe
  C:\Windows\System\GGduyHg.exe
  2⤵
  PID:6128
- C:\Windows\System\SXvvsqC.exe
  C:\Windows\System\SXvvsqC.exe
  2⤵
  PID:1948
- C:\Windows\System\LqtMzbx.exe
  C:\Windows\System\LqtMzbx.exe
  2⤵
  PID:4840
- C:\Windows\System\FZaFVuW.exe
  C:\Windows\System\FZaFVuW.exe
  2⤵
  PID:5076
- C:\Windows\System\SeojqQG.exe
  C:\Windows\System\SeojqQG.exe
  2⤵
  PID:5168
- C:\Windows\System\epNBIYU.exe
  C:\Windows\System\epNBIYU.exe
  2⤵
  PID:5200
- C:\Windows\System\stosXyP.exe
  C:\Windows\System\stosXyP.exe
  2⤵
  PID:4564
- C:\Windows\System\lxOGGwD.exe
  C:\Windows\System\lxOGGwD.exe
  2⤵
  PID:5272
- C:\Windows\System\PSqsMFF.exe
  C:\Windows\System\PSqsMFF.exe
  2⤵
  PID:5304
- C:\Windows\System\gbYDszf.exe
  C:\Windows\System\gbYDszf.exe
  2⤵
  PID:5348
- C:\Windows\System\zcOCAKu.exe
  C:\Windows\System\zcOCAKu.exe
  2⤵
  PID:5392
- C:\Windows\System\KNCOGQT.exe
  C:\Windows\System\KNCOGQT.exe
  2⤵
  PID:5588
- C:\Windows\System\bkKmnhu.exe
  C:\Windows\System\bkKmnhu.exe
  2⤵
  PID:5492
- C:\Windows\System\ggknnMw.exe
  C:\Windows\System\ggknnMw.exe
  2⤵
  PID:4976
- C:\Windows\System\yJGrJLE.exe
  C:\Windows\System\yJGrJLE.exe
  2⤵
  PID:4176
- C:\Windows\System\PsRqcbP.exe
  C:\Windows\System\PsRqcbP.exe
  2⤵
  PID:5180
- C:\Windows\System\NHaIDdb.exe
  C:\Windows\System\NHaIDdb.exe
  2⤵
  PID:5256
- C:\Windows\System\JXoOWxa.exe
  C:\Windows\System\JXoOWxa.exe
  2⤵
  PID:5668
- C:\Windows\System\gnKaMlp.exe
  C:\Windows\System\gnKaMlp.exe
  2⤵
  PID:5632
- C:\Windows\System\OSroqde.exe
  C:\Windows\System\OSroqde.exe
  2⤵
  PID:5704
- C:\Windows\System\PbiqBtf.exe
  C:\Windows\System\PbiqBtf.exe
  2⤵
  PID:5780
- C:\Windows\System\NgihxTx.exe
  C:\Windows\System\NgihxTx.exe
  2⤵
  PID:5808
- C:\Windows\System\xKZbuTG.exe
  C:\Windows\System\xKZbuTG.exe
  2⤵
  PID:5688
- C:\Windows\System\OJMLojK.exe
  C:\Windows\System\OJMLojK.exe
  2⤵
  PID:5644
- C:\Windows\System\lPTKhNj.exe
  C:\Windows\System\lPTKhNj.exe
  2⤵
  PID:5476
- C:\Windows\System\qauihOE.exe
  C:\Windows\System\qauihOE.exe
  2⤵
  PID:5440
- C:\Windows\System\rlbhDyY.exe
  C:\Windows\System\rlbhDyY.exe
  2⤵
  PID:5376
- C:\Windows\System\QLxNGQm.exe
  C:\Windows\System\QLxNGQm.exe
  2⤵
  PID:5840
- C:\Windows\System\bqbleXT.exe
  C:\Windows\System\bqbleXT.exe
  2⤵
  PID:5860
- C:\Windows\System\UjBPSyu.exe
  C:\Windows\System\UjBPSyu.exe
  2⤵
  PID:5916
- C:\Windows\System\PRLMsnC.exe
  C:\Windows\System\PRLMsnC.exe
  2⤵
  PID:5988
- C:\Windows\System\fVnzfxy.exe
  C:\Windows\System\fVnzfxy.exe
  2⤵
  PID:6064
- C:\Windows\System\RugNuXU.exe
  C:\Windows\System\RugNuXU.exe
  2⤵
  PID:5932
- C:\Windows\System\zEwhNXK.exe
  C:\Windows\System\zEwhNXK.exe
  2⤵
  PID:6136
- C:\Windows\System\OWomeAb.exe
  C:\Windows\System\OWomeAb.exe
  2⤵
  PID:5968
- C:\Windows\System\OuqpJdM.exe
  C:\Windows\System\OuqpJdM.exe
  2⤵
  PID:4872
- C:\Windows\System\aEyigBA.exe
  C:\Windows\System\aEyigBA.exe
  2⤵
  PID:5896
- C:\Windows\System\pROWMjo.exe
  C:\Windows\System\pROWMjo.exe
  2⤵
  PID:6088
- C:\Windows\System\Yfkdaph.exe
  C:\Windows\System\Yfkdaph.exe
  2⤵
  PID:4624
- C:\Windows\System\QRcFkxx.exe
  C:\Windows\System\QRcFkxx.exe
  2⤵
  PID:4436
- C:\Windows\System\moFDyyD.exe
  C:\Windows\System\moFDyyD.exe
  2⤵
  PID:5244
- C:\Windows\System\jYfSNfg.exe
  C:\Windows\System\jYfSNfg.exe
  2⤵
  PID:5316
- C:\Windows\System\dTrEtUX.exe
  C:\Windows\System\dTrEtUX.exe
  2⤵
  PID:5340
- C:\Windows\System\QWWWlOz.exe
  C:\Windows\System\QWWWlOz.exe
  2⤵
  PID:5424
- C:\Windows\System\KhTJYmm.exe
  C:\Windows\System\KhTJYmm.exe
  2⤵
  PID:5560
- C:\Windows\System\GMVbytG.exe
  C:\Windows\System\GMVbytG.exe
  2⤵
  PID:5292
- C:\Windows\System\DwraDBF.exe
  C:\Windows\System\DwraDBF.exe
  2⤵
  PID:5700
- C:\Windows\System\FcJMWhs.exe
  C:\Windows\System\FcJMWhs.exe
  2⤵
  PID:5540
- C:\Windows\System\HcXOKMG.exe
  C:\Windows\System\HcXOKMG.exe
  2⤵
  PID:5188
- C:\Windows\System\YOJsEXI.exe
  C:\Windows\System\YOJsEXI.exe
  2⤵
  PID:5776
- C:\Windows\System\QlHyCnC.exe
  C:\Windows\System\QlHyCnC.exe
  2⤵
  PID:5720
- C:\Windows\System\ZuaiYmn.exe
  C:\Windows\System\ZuaiYmn.exe
  2⤵
  PID:5372
- C:\Windows\System\xinDsqV.exe
  C:\Windows\System\xinDsqV.exe
  2⤵
  PID:5604
- C:\Windows\System\ulxnCSJ.exe
  C:\Windows\System\ulxnCSJ.exe
  2⤵
  PID:5856
- C:\Windows\System\nWZEXWW.exe
  C:\Windows\System\nWZEXWW.exe
  2⤵
  PID:5876
- C:\Windows\System\yVdufKY.exe
  C:\Windows\System\yVdufKY.exe
  2⤵
  PID:5952
- C:\Windows\System\fowOmrR.exe
  C:\Windows\System\fowOmrR.exe
  2⤵
  PID:6104
- C:\Windows\System\SmpcewD.exe
  C:\Windows\System\SmpcewD.exe
  2⤵
  PID:5160
- C:\Windows\System\dEZzPRr.exe
  C:\Windows\System\dEZzPRr.exe
  2⤵
  PID:4888
- C:\Windows\System\PjGUSoQ.exe
  C:\Windows\System\PjGUSoQ.exe
  2⤵
  PID:6044
- C:\Windows\System\rZVrWcj.exe
  C:\Windows\System\rZVrWcj.exe
  2⤵
  PID:6048
- C:\Windows\System\cvKUXFE.exe
  C:\Windows\System\cvKUXFE.exe
  2⤵
  PID:5344
- C:\Windows\System\fZXclqY.exe
  C:\Windows\System\fZXclqY.exe
  2⤵
  PID:5512
- C:\Windows\System\gyaAHvn.exe
  C:\Windows\System\gyaAHvn.exe
  2⤵
  PID:6124
- C:\Windows\System\XxkYIOG.exe
  C:\Windows\System\XxkYIOG.exe
  2⤵
  PID:5772
- C:\Windows\System\rddDUVW.exe
  C:\Windows\System\rddDUVW.exe
  2⤵
  PID:5528
- C:\Windows\System\FhmkvBm.exe
  C:\Windows\System\FhmkvBm.exe
  2⤵
  PID:5024
- C:\Windows\System\tqnSrEV.exe
  C:\Windows\System\tqnSrEV.exe
  2⤵
  PID:5648
- C:\Windows\System\wyfqKzX.exe
  C:\Windows\System\wyfqKzX.exe
  2⤵
  PID:5608
- C:\Windows\System\ixicgQP.exe
  C:\Windows\System\ixicgQP.exe
  2⤵
  PID:5408
- C:\Windows\System\mBwqfwN.exe
  C:\Windows\System\mBwqfwN.exe
  2⤵
  PID:5900
- C:\Windows\System\usQBRCo.exe
  C:\Windows\System\usQBRCo.exe
  2⤵
  PID:6072
- C:\Windows\System\sdKaqyq.exe
  C:\Windows\System\sdKaqyq.exe
  2⤵
  PID:6024
- C:\Windows\System\IbWlSVI.exe
  C:\Windows\System\IbWlSVI.exe
  2⤵
  PID:6060
- C:\Windows\System\KACOMoQ.exe
  C:\Windows\System\KACOMoQ.exe
  2⤵
  PID:4688
- C:\Windows\System\qPUxKhs.exe
  C:\Windows\System\qPUxKhs.exe
  2⤵
  PID:5288
- C:\Windows\System\rzsmVZO.exe
  C:\Windows\System\rzsmVZO.exe
  2⤵
  PID:6120
- C:\Windows\System\MehzzFY.exe
  C:\Windows\System\MehzzFY.exe
  2⤵
  PID:5460
- C:\Windows\System\RGFRlnR.exe
  C:\Windows\System\RGFRlnR.exe
  2⤵
  PID:5356
- C:\Windows\System\ljUTAbi.exe
  C:\Windows\System\ljUTAbi.exe
  2⤵
  PID:5948
- C:\Windows\System\QyxTrUF.exe
  C:\Windows\System\QyxTrUF.exe
  2⤵
  PID:6156
- C:\Windows\System\pwyySrs.exe
  C:\Windows\System\pwyySrs.exe
  2⤵
  PID:6176
- C:\Windows\System\aQMVaeO.exe
  C:\Windows\System\aQMVaeO.exe
  2⤵
  PID:6200
- C:\Windows\System\uobDiQK.exe
  C:\Windows\System\uobDiQK.exe
  2⤵
  PID:6228
- C:\Windows\System\DUWrlpr.exe
  C:\Windows\System\DUWrlpr.exe
  2⤵
  PID:6248
- C:\Windows\System\FjpkELh.exe
  C:\Windows\System\FjpkELh.exe
  2⤵
  PID:6276
- C:\Windows\System\dEdUGcH.exe
  C:\Windows\System\dEdUGcH.exe
  2⤵
  PID:6292
- C:\Windows\System\opOLOGl.exe
  C:\Windows\System\opOLOGl.exe
  2⤵
  PID:6308
- C:\Windows\System\ButCxjQ.exe
  C:\Windows\System\ButCxjQ.exe
  2⤵
  PID:6324
- C:\Windows\System\KnOntfG.exe
  C:\Windows\System\KnOntfG.exe
  2⤵
  PID:6340
- C:\Windows\System\NaAfwtB.exe
  C:\Windows\System\NaAfwtB.exe
  2⤵
  PID:6356
- C:\Windows\System\JCmXewU.exe
  C:\Windows\System\JCmXewU.exe
  2⤵
  PID:6376
- C:\Windows\System\nfKphxg.exe
  C:\Windows\System\nfKphxg.exe
  2⤵
  PID:6396
- C:\Windows\System\rUnzkOp.exe
  C:\Windows\System\rUnzkOp.exe
  2⤵
  PID:6412
- C:\Windows\System\bvMlQyt.exe
  C:\Windows\System\bvMlQyt.exe
  2⤵
  PID:6432
- C:\Windows\System\EBzDszw.exe
  C:\Windows\System\EBzDszw.exe
  2⤵
  PID:6448
- C:\Windows\System\eDfHBQr.exe
  C:\Windows\System\eDfHBQr.exe
  2⤵
  PID:6468
- C:\Windows\System\OhQrcaV.exe
  C:\Windows\System\OhQrcaV.exe
  2⤵
  PID:6488
- C:\Windows\System\VDKDfhm.exe
  C:\Windows\System\VDKDfhm.exe
  2⤵
  PID:6512
- C:\Windows\System\kGWkNvG.exe
  C:\Windows\System\kGWkNvG.exe
  2⤵
  PID:6528
- C:\Windows\System\HIwXPld.exe
  C:\Windows\System\HIwXPld.exe
  2⤵
  PID:6548
- C:\Windows\System\wZabcNP.exe
  C:\Windows\System\wZabcNP.exe
  2⤵
  PID:6564
- C:\Windows\System\bSWgNHG.exe
  C:\Windows\System\bSWgNHG.exe
  2⤵
  PID:6580
- C:\Windows\System\NHnNBnQ.exe
  C:\Windows\System\NHnNBnQ.exe
  2⤵
  PID:6596
- C:\Windows\System\lVLCTfL.exe
  C:\Windows\System\lVLCTfL.exe
  2⤵
  PID:6628
- C:\Windows\System\itkUfcy.exe
  C:\Windows\System\itkUfcy.exe
  2⤵
  PID:6648
- C:\Windows\System\nrHDkPZ.exe
  C:\Windows\System\nrHDkPZ.exe
  2⤵
  PID:6672
- C:\Windows\System\wZdVOax.exe
  C:\Windows\System\wZdVOax.exe
  2⤵
  PID:6688
- C:\Windows\System\fbpyfZp.exe
  C:\Windows\System\fbpyfZp.exe
  2⤵
  PID:6712
- C:\Windows\System\zdnEUKH.exe
  C:\Windows\System\zdnEUKH.exe
  2⤵
  PID:6732
- C:\Windows\System\eieBwsc.exe
  C:\Windows\System\eieBwsc.exe
  2⤵
  PID:6756
- C:\Windows\System\SjPIdPj.exe
  C:\Windows\System\SjPIdPj.exe
  2⤵
  PID:6776
- C:\Windows\System\OESVeGx.exe
  C:\Windows\System\OESVeGx.exe
  2⤵
  PID:6796
- C:\Windows\System\NCpaTeG.exe
  C:\Windows\System\NCpaTeG.exe
  2⤵
  PID:6812
- C:\Windows\System\eoaeyjx.exe
  C:\Windows\System\eoaeyjx.exe
  2⤵
  PID:6836
- C:\Windows\System\rLwvnNW.exe
  C:\Windows\System\rLwvnNW.exe
  2⤵
  PID:6860
- C:\Windows\System\IUuzInJ.exe
  C:\Windows\System\IUuzInJ.exe
  2⤵
  PID:6880
- C:\Windows\System\QkIMtzd.exe
  C:\Windows\System\QkIMtzd.exe
  2⤵
  PID:6904
- C:\Windows\System\skPzRAh.exe
  C:\Windows\System\skPzRAh.exe
  2⤵
  PID:6928
- C:\Windows\System\RKoPDQp.exe
  C:\Windows\System\RKoPDQp.exe
  2⤵
  PID:6948
- C:\Windows\System\pWoQMCh.exe
  C:\Windows\System\pWoQMCh.exe
  2⤵
  PID:6972
- C:\Windows\System\ihZBTHq.exe
  C:\Windows\System\ihZBTHq.exe
  2⤵
  PID:6992
- C:\Windows\System\qhNcwOk.exe
  C:\Windows\System\qhNcwOk.exe
  2⤵
  PID:7008
- C:\Windows\System\QUrJyyT.exe
  C:\Windows\System\QUrJyyT.exe
  2⤵
  PID:7024
- C:\Windows\System\opugnqd.exe
  C:\Windows\System\opugnqd.exe
  2⤵
  PID:7040
- C:\Windows\System\ASZQSNK.exe
  C:\Windows\System\ASZQSNK.exe
  2⤵
  PID:7060
- C:\Windows\System\SFURlzA.exe
  C:\Windows\System\SFURlzA.exe
  2⤵
  PID:7084
- C:\Windows\System\TKpfauZ.exe
  C:\Windows\System\TKpfauZ.exe
  2⤵
  PID:7104
- C:\Windows\System\bbGJXmr.exe
  C:\Windows\System\bbGJXmr.exe
  2⤵
  PID:7156
- C:\Windows\System\gGbbxgk.exe
  C:\Windows\System\gGbbxgk.exe
  2⤵
  PID:5208
- C:\Windows\System\NoAWKaH.exe
  C:\Windows\System\NoAWKaH.exe
  2⤵
  PID:6164
- C:\Windows\System\thFWhCq.exe
  C:\Windows\System\thFWhCq.exe
  2⤵
  PID:6216
- C:\Windows\System\fGdWNHA.exe
  C:\Windows\System\fGdWNHA.exe
  2⤵
  PID:6220
- C:\Windows\System\XlBoADa.exe
  C:\Windows\System\XlBoADa.exe
  2⤵
  PID:6264
- C:\Windows\System\XPxCsSq.exe
  C:\Windows\System\XPxCsSq.exe
  2⤵
  PID:5976
- C:\Windows\System\IYFezbS.exe
  C:\Windows\System\IYFezbS.exe
  2⤵
  PID:6336
- C:\Windows\System\sSqoocg.exe
  C:\Windows\System\sSqoocg.exe
  2⤵
  PID:6404
- C:\Windows\System\vaXXMlL.exe
  C:\Windows\System\vaXXMlL.exe
  2⤵
  PID:6480
- C:\Windows\System\TwZPTxb.exe
  C:\Windows\System\TwZPTxb.exe
  2⤵
  PID:6556
- C:\Windows\System\JfjPQPf.exe
  C:\Windows\System\JfjPQPf.exe
  2⤵
  PID:6592
- C:\Windows\System\NjLkeXe.exe
  C:\Windows\System\NjLkeXe.exe
  2⤵
  PID:6680
- C:\Windows\System\FewlLyo.exe
  C:\Windows\System\FewlLyo.exe
  2⤵
  PID:6724
- C:\Windows\System\kRzbHpZ.exe
  C:\Windows\System\kRzbHpZ.exe
  2⤵
  PID:6848
- C:\Windows\System\NPhPaHN.exe
  C:\Windows\System\NPhPaHN.exe
  2⤵
  PID:5760
- C:\Windows\System\PntNDgJ.exe
  C:\Windows\System\PntNDgJ.exe
  2⤵
  PID:6892
- C:\Windows\System\TLwlHCZ.exe
  C:\Windows\System\TLwlHCZ.exe
  2⤵
  PID:6612
- C:\Windows\System\tFVGWZD.exe
  C:\Windows\System\tFVGWZD.exe
  2⤵
  PID:5868
- C:\Windows\System\twTRzIz.exe
  C:\Windows\System\twTRzIz.exe
  2⤵
  PID:6284
- C:\Windows\System\gSMeVQD.exe
  C:\Windows\System\gSMeVQD.exe
  2⤵
  PID:6988
- C:\Windows\System\aProzeF.exe
  C:\Windows\System\aProzeF.exe
  2⤵
  PID:7052
- C:\Windows\System\YZhksRG.exe
  C:\Windows\System\YZhksRG.exe
  2⤵
  PID:7096
- C:\Windows\System\fpKOQUw.exe
  C:\Windows\System\fpKOQUw.exe
  2⤵
  PID:6832
- C:\Windows\System\BoXBeeM.exe
  C:\Windows\System\BoXBeeM.exe
  2⤵
  PID:6536
- C:\Windows\System\urXwnUy.exe
  C:\Windows\System\urXwnUy.exe
  2⤵
  PID:6152
- C:\Windows\System\YTXfnnu.exe
  C:\Windows\System\YTXfnnu.exe
  2⤵
  PID:6620
- C:\Windows\System\tJgAXEZ.exe
  C:\Windows\System\tJgAXEZ.exe
  2⤵
  PID:6320
- C:\Windows\System\sRXbMig.exe
  C:\Windows\System\sRXbMig.exe
  2⤵
  PID:6428
- C:\Windows\System\LpDElxp.exe
  C:\Windows\System\LpDElxp.exe
  2⤵
  PID:6540
- C:\Windows\System\CXWqAGv.exe
  C:\Windows\System\CXWqAGv.exe
  2⤵
  PID:6656
- C:\Windows\System\yKoVvAG.exe
  C:\Windows\System\yKoVvAG.exe
  2⤵
  PID:6964
- C:\Windows\System\RliwReJ.exe
  C:\Windows\System\RliwReJ.exe
  2⤵
  PID:7000
- C:\Windows\System\UqQQvWW.exe
  C:\Windows\System\UqQQvWW.exe
  2⤵
  PID:6748
- C:\Windows\System\VEBNkqN.exe
  C:\Windows\System\VEBNkqN.exe
  2⤵
  PID:7140
- C:\Windows\System\xFyGvia.exe
  C:\Windows\System\xFyGvia.exe
  2⤵
  PID:6784
- C:\Windows\System\whluWXm.exe
  C:\Windows\System\whluWXm.exe
  2⤵
  PID:6824
- C:\Windows\System\faQfsWz.exe
  C:\Windows\System\faQfsWz.exe
  2⤵
  PID:6916
- C:\Windows\System\mMouwaZ.exe
  C:\Windows\System\mMouwaZ.exe
  2⤵
  PID:7128
- C:\Windows\System\ARlvgfg.exe
  C:\Windows\System\ARlvgfg.exe
  2⤵
  PID:7164
- C:\Windows\System\rqlqMFd.exe
  C:\Windows\System\rqlqMFd.exe
  2⤵
  PID:6172
- C:\Windows\System\VRqGSdu.exe
  C:\Windows\System\VRqGSdu.exe
  2⤵
  PID:5508
- C:\Windows\System\ePFHfxY.exe
  C:\Windows\System\ePFHfxY.exe
  2⤵
  PID:5672
- C:\Windows\System\rfjLEGl.exe
  C:\Windows\System\rfjLEGl.exe
  2⤵
  PID:6440
- C:\Windows\System\adSJKvf.exe
  C:\Windows\System\adSJKvf.exe
  2⤵
  PID:6728
- C:\Windows\System\ACHixNF.exe
  C:\Windows\System\ACHixNF.exe
  2⤵
  PID:6604
- C:\Windows\System\vSgiKgI.exe
  C:\Windows\System\vSgiKgI.exe
  2⤵
  PID:5068
- C:\Windows\System\lDnCPrm.exe
  C:\Windows\System\lDnCPrm.exe
  2⤵
  PID:6944
- C:\Windows\System\UXyjrIG.exe
  C:\Windows\System\UXyjrIG.exe
  2⤵
  PID:6460
- C:\Windows\System\pdCwLFK.exe
  C:\Windows\System\pdCwLFK.exe
  2⤵
  PID:6744
- C:\Windows\System\yHoQIak.exe
  C:\Windows\System\yHoQIak.exe
  2⤵
  PID:6420
- C:\Windows\System\siSHORq.exe
  C:\Windows\System\siSHORq.exe
  2⤵
  PID:6772
- C:\Windows\System\MyAggXV.exe
  C:\Windows\System\MyAggXV.exe
  2⤵
  PID:7148
- C:\Windows\System\UghkvYB.exe
  C:\Windows\System\UghkvYB.exe
  2⤵
  PID:6524
- C:\Windows\System\sECRhJT.exe
  C:\Windows\System\sECRhJT.exe
  2⤵
  PID:6236
- C:\Windows\System\FFlzuxq.exe
  C:\Windows\System\FFlzuxq.exe
  2⤵
  PID:6196
- C:\Windows\System\mEspUls.exe
  C:\Windows\System\mEspUls.exe
  2⤵
  PID:6388
- C:\Windows\System\ZmuNRXP.exe
  C:\Windows\System\ZmuNRXP.exe
  2⤵
  PID:6392
- C:\Windows\System\neIXbFy.exe
  C:\Windows\System\neIXbFy.exe
  2⤵
  PID:6896
- C:\Windows\System\fsZKoAF.exe
  C:\Windows\System\fsZKoAF.exe
  2⤵
  PID:6808
- C:\Windows\System\RpoyoCs.exe
  C:\Windows\System\RpoyoCs.exe
  2⤵
  PID:5388
- C:\Windows\System\RSWmpzo.exe
  C:\Windows\System\RSWmpzo.exe
  2⤵
  PID:6168
- C:\Windows\System\pXeNylq.exe
  C:\Windows\System\pXeNylq.exe
  2⤵
  PID:6700
- C:\Windows\System\kslrJUz.exe
  C:\Windows\System\kslrJUz.exe
  2⤵
  PID:6960
- C:\Windows\System\GHVuniZ.exe
  C:\Windows\System\GHVuniZ.exe
  2⤵
  PID:6768
- C:\Windows\System\PZmvDAE.exe
  C:\Windows\System\PZmvDAE.exe
  2⤵
  PID:6188
- C:\Windows\System\RPlhENE.exe
  C:\Windows\System\RPlhENE.exe
  2⤵
  PID:6004
- C:\Windows\System\kcPDFFl.exe
  C:\Windows\System\kcPDFFl.exe
  2⤵
  PID:4608
- C:\Windows\System\rDxgDvC.exe
  C:\Windows\System\rDxgDvC.exe
  2⤵
  PID:7180
- C:\Windows\System\EqjGXdR.exe
  C:\Windows\System\EqjGXdR.exe
  2⤵
  PID:7204
- C:\Windows\System\HcdDqWs.exe
  C:\Windows\System\HcdDqWs.exe
  2⤵
  PID:7220
- C:\Windows\System\MdQRQrP.exe
  C:\Windows\System\MdQRQrP.exe
  2⤵
  PID:7248
- C:\Windows\System\MyWtEeu.exe
  C:\Windows\System\MyWtEeu.exe
  2⤵
  PID:7268
- C:\Windows\System\svFpspI.exe
  C:\Windows\System\svFpspI.exe
  2⤵
  PID:7332
- C:\Windows\System\odKSBUh.exe
  C:\Windows\System\odKSBUh.exe
  2⤵
  PID:7352
- C:\Windows\System\IjyBiKY.exe
  C:\Windows\System\IjyBiKY.exe
  2⤵
  PID:7372
- C:\Windows\System\Qkpomkf.exe
  C:\Windows\System\Qkpomkf.exe
  2⤵
  PID:7388
- C:\Windows\System\whVYpYA.exe
  C:\Windows\System\whVYpYA.exe
  2⤵
  PID:7404
- C:\Windows\System\VSWNBer.exe
  C:\Windows\System\VSWNBer.exe
  2⤵
  PID:7420
- C:\Windows\System\tMpQUUI.exe
  C:\Windows\System\tMpQUUI.exe
  2⤵
  PID:7436
- C:\Windows\System\ZfxXxZL.exe
  C:\Windows\System\ZfxXxZL.exe
  2⤵
  PID:7460
- C:\Windows\System\gRexSdk.exe
  C:\Windows\System\gRexSdk.exe
  2⤵
  PID:7480
- C:\Windows\System\BvPsukc.exe
  C:\Windows\System\BvPsukc.exe
  2⤵
  PID:7500
- C:\Windows\System\gnDrZAv.exe
  C:\Windows\System\gnDrZAv.exe
  2⤵
  PID:7516
- C:\Windows\System\SgxCQFf.exe
  C:\Windows\System\SgxCQFf.exe
  2⤵
  PID:7536
- C:\Windows\System\ILjHIYq.exe
  C:\Windows\System\ILjHIYq.exe
  2⤵
  PID:7552
- C:\Windows\System\idBtCgq.exe
  C:\Windows\System\idBtCgq.exe
  2⤵
  PID:7568
- C:\Windows\System\ICweJMY.exe
  C:\Windows\System\ICweJMY.exe
  2⤵
  PID:7592
- C:\Windows\System\oRxoIhl.exe
  C:\Windows\System\oRxoIhl.exe
  2⤵
  PID:7608
- C:\Windows\System\QCzFmWh.exe
  C:\Windows\System\QCzFmWh.exe
  2⤵
  PID:7628
- C:\Windows\System\HusFqoH.exe
  C:\Windows\System\HusFqoH.exe
  2⤵
  PID:7648
- C:\Windows\System\ASidxcc.exe
  C:\Windows\System\ASidxcc.exe
  2⤵
  PID:7664
- C:\Windows\System\nQnuuGZ.exe
  C:\Windows\System\nQnuuGZ.exe
  2⤵
  PID:7680
- C:\Windows\System\ZHyjmLl.exe
  C:\Windows\System\ZHyjmLl.exe
  2⤵
  PID:7696
- C:\Windows\System\kXcnmmO.exe
  C:\Windows\System\kXcnmmO.exe
  2⤵
  PID:7720
- C:\Windows\System\RXMllfY.exe
  C:\Windows\System\RXMllfY.exe
  2⤵
  PID:7736
- C:\Windows\System\cfBNWtF.exe
  C:\Windows\System\cfBNWtF.exe
  2⤵
  PID:7756
- C:\Windows\System\JchmUfe.exe
  C:\Windows\System\JchmUfe.exe
  2⤵
  PID:7772
- C:\Windows\System\WCfVfgM.exe
  C:\Windows\System\WCfVfgM.exe
  2⤵
  PID:7788
- C:\Windows\System\lOiMBVA.exe
  C:\Windows\System\lOiMBVA.exe
  2⤵
  PID:7808
- C:\Windows\System\bKoXPnj.exe
  C:\Windows\System\bKoXPnj.exe
  2⤵
  PID:7828
- C:\Windows\System\fTJbqxS.exe
  C:\Windows\System\fTJbqxS.exe
  2⤵
  PID:7852
- C:\Windows\System\HYjgJJS.exe
  C:\Windows\System\HYjgJJS.exe
  2⤵
  PID:7868
- C:\Windows\System\kgheyOP.exe
  C:\Windows\System\kgheyOP.exe
  2⤵
  PID:7892
- C:\Windows\System\vpQNiPx.exe
  C:\Windows\System\vpQNiPx.exe
  2⤵
  PID:7912
- C:\Windows\System\CDzcmLE.exe
  C:\Windows\System\CDzcmLE.exe
  2⤵
  PID:7928
- C:\Windows\System\Cskphxy.exe
  C:\Windows\System\Cskphxy.exe
  2⤵
  PID:7944
- C:\Windows\System\dLyFPPw.exe
  C:\Windows\System\dLyFPPw.exe
  2⤵
  PID:7960
- C:\Windows\System\VIlugPW.exe
  C:\Windows\System\VIlugPW.exe
  2⤵
  PID:7980
- C:\Windows\System\fIxPhDz.exe
  C:\Windows\System\fIxPhDz.exe
  2⤵
  PID:7996
- C:\Windows\System\IJHsdMD.exe
  C:\Windows\System\IJHsdMD.exe
  2⤵
  PID:8012
- C:\Windows\System\IYSWMGp.exe
  C:\Windows\System\IYSWMGp.exe
  2⤵
  PID:8032
- C:\Windows\System\qUGhJLJ.exe
  C:\Windows\System\qUGhJLJ.exe
  2⤵
  PID:8048
- C:\Windows\System\seWhwME.exe
  C:\Windows\System\seWhwME.exe
  2⤵
  PID:8068
- C:\Windows\System\CrrbdHH.exe
  C:\Windows\System\CrrbdHH.exe
  2⤵
  PID:8088
- C:\Windows\System\YFgbnud.exe
  C:\Windows\System\YFgbnud.exe
  2⤵
  PID:8112
- C:\Windows\System\tgDrOpC.exe
  C:\Windows\System\tgDrOpC.exe
  2⤵
  PID:8128
- C:\Windows\System\soIBMSW.exe
  C:\Windows\System\soIBMSW.exe
  2⤵
  PID:8144
- C:\Windows\System\szYPiAf.exe
  C:\Windows\System\szYPiAf.exe
  2⤵
  PID:8164
- C:\Windows\System\OkYPolM.exe
  C:\Windows\System\OkYPolM.exe
  2⤵
  PID:8188
- C:\Windows\System\nTpKwEM.exe
  C:\Windows\System\nTpKwEM.exe
  2⤵
  PID:7188
- C:\Windows\System\fmfetLP.exe
  C:\Windows\System\fmfetLP.exe
  2⤵
  PID:7228
- C:\Windows\System\ZBMDxzr.exe
  C:\Windows\System\ZBMDxzr.exe
  2⤵
  PID:6924
- C:\Windows\System\SyDLCTZ.exe
  C:\Windows\System\SyDLCTZ.exe
  2⤵
  PID:7036
- C:\Windows\System\ACEaXFy.exe
  C:\Windows\System\ACEaXFy.exe
  2⤵
  PID:6820
- C:\Windows\System\HCeCzUq.exe
  C:\Windows\System\HCeCzUq.exe
  2⤵
  PID:5888
- C:\Windows\System\mrQeRvK.exe
  C:\Windows\System\mrQeRvK.exe
  2⤵
  PID:6876
- C:\Windows\System\hWYxTFJ.exe
  C:\Windows\System\hWYxTFJ.exe
  2⤵
  PID:6332
- C:\Windows\System\AeQHxfe.exe
  C:\Windows\System\AeQHxfe.exe
  2⤵
  PID:6272
- C:\Windows\System\GfoGWJv.exe
  C:\Windows\System\GfoGWJv.exe
  2⤵
  PID:7256
- C:\Windows\System\rjYOlrx.exe
  C:\Windows\System\rjYOlrx.exe
  2⤵
  PID:6476
- C:\Windows\System\ygKqGty.exe
  C:\Windows\System\ygKqGty.exe
  2⤵
  PID:7368
- C:\Windows\System\kZjDwBv.exe
  C:\Windows\System\kZjDwBv.exe
  2⤵
  PID:7468
- C:\Windows\System\rMLmJhl.exe
  C:\Windows\System\rMLmJhl.exe
  2⤵
  PID:6384
- C:\Windows\System\iwtbxts.exe
  C:\Windows\System\iwtbxts.exe
  2⤵
  PID:7576
- C:\Windows\System\kWAVQVA.exe
  C:\Windows\System\kWAVQVA.exe
  2⤵
  PID:7620
- C:\Windows\System\uQieNZh.exe
  C:\Windows\System\uQieNZh.exe
  2⤵
  PID:7732
- C:\Windows\System\haOawRX.exe
  C:\Windows\System\haOawRX.exe
  2⤵
  PID:7796
- C:\Windows\System\bKVzuhf.exe
  C:\Windows\System\bKVzuhf.exe
  2⤵
  PID:7848
- C:\Windows\System\dUZSCNw.exe
  C:\Windows\System\dUZSCNw.exe
  2⤵
  PID:7884
- C:\Windows\System\cBRimcj.exe
  C:\Windows\System\cBRimcj.exe
  2⤵
  PID:7496
- C:\Windows\System\nuAdbio.exe
  C:\Windows\System\nuAdbio.exe
  2⤵
  PID:6936
- C:\Windows\System\tiEetRO.exe
  C:\Windows\System\tiEetRO.exe
  2⤵
  PID:7176
- C:\Windows\System\rNiCkhc.exe
  C:\Windows\System\rNiCkhc.exe
  2⤵
  PID:7988
- C:\Windows\System\KNVUEiL.exe
  C:\Windows\System\KNVUEiL.exe
  2⤵
  PID:8100
- C:\Windows\System\ByFAttB.exe
  C:\Windows\System\ByFAttB.exe
  2⤵
  PID:8108
- C:\Windows\System\KZrptMZ.exe
  C:\Windows\System\KZrptMZ.exe
  2⤵
  PID:8176
- C:\Windows\System\yYohcxN.exe
  C:\Windows\System\yYohcxN.exe
  2⤵
  PID:7200
- C:\Windows\System\GfjYCQo.exe
  C:\Windows\System\GfjYCQo.exe
  2⤵
  PID:7120
- C:\Windows\System\gXOTNUq.exe
  C:\Windows\System\gXOTNUq.exe
  2⤵
  PID:7708
- C:\Windows\System\HPihurZ.exe
  C:\Windows\System\HPihurZ.exe
  2⤵
  PID:7824
- C:\Windows\System\uXMrwfn.exe
  C:\Windows\System\uXMrwfn.exe
  2⤵
  PID:7216
- C:\Windows\System\SknnvhZ.exe
  C:\Windows\System\SknnvhZ.exe
  2⤵
  PID:7360
- C:\Windows\System\WnchmFZ.exe
  C:\Windows\System\WnchmFZ.exe
  2⤵
  PID:8044
- C:\Windows\System\gowMUbt.exe
  C:\Windows\System\gowMUbt.exe
  2⤵
  PID:8076
- C:\Windows\System\eFcdAVt.exe
  C:\Windows\System\eFcdAVt.exe
  2⤵
  PID:7384
- C:\Windows\System\CrIPLQh.exe
  C:\Windows\System\CrIPLQh.exe
  2⤵
  PID:7768
- C:\Windows\System\naLLFXl.exe
  C:\Windows\System\naLLFXl.exe
  2⤵
  PID:7880
- C:\Windows\System\JYVzpen.exe
  C:\Windows\System\JYVzpen.exe
  2⤵
  PID:7956
- C:\Windows\System\pKqyPWC.exe
  C:\Windows\System\pKqyPWC.exe
  2⤵
  PID:8064
- C:\Windows\System\OzIVoIS.exe
  C:\Windows\System\OzIVoIS.exe
  2⤵
  PID:7712
- C:\Windows\System\GyZjiAH.exe
  C:\Windows\System\GyZjiAH.exe
  2⤵
  PID:7672
- C:\Windows\System\UQLnmSs.exe
  C:\Windows\System\UQLnmSs.exe
  2⤵
  PID:7908
- C:\Windows\System\dKamBps.exe
  C:\Windows\System\dKamBps.exe
  2⤵
  PID:7936
- C:\Windows\System\LkBJMjB.exe
  C:\Windows\System\LkBJMjB.exe
  2⤵
  PID:7528
- C:\Windows\System\FxAmsfl.exe
  C:\Windows\System\FxAmsfl.exe
  2⤵
  PID:7844
- C:\Windows\System\kXpOHFG.exe
  C:\Windows\System\kXpOHFG.exe
  2⤵
  PID:7864
- C:\Windows\System\dovnYQb.exe
  C:\Windows\System\dovnYQb.exe
  2⤵
  PID:7924
- C:\Windows\System\XfKIaWo.exe
  C:\Windows\System\XfKIaWo.exe
  2⤵
  PID:7508
- C:\Windows\System\LsJhDaM.exe
  C:\Windows\System\LsJhDaM.exe
  2⤵
  PID:7276
- C:\Windows\System\XKqhGIJ.exe
  C:\Windows\System\XKqhGIJ.exe
  2⤵
  PID:8160
- C:\Windows\System\GWpinAQ.exe
  C:\Windows\System\GWpinAQ.exe
  2⤵
  PID:6788
- C:\Windows\System\ObCgQqY.exe
  C:\Windows\System\ObCgQqY.exe
  2⤵
  PID:7636
- C:\Windows\System\TvlAkQt.exe
  C:\Windows\System\TvlAkQt.exe
  2⤵
  PID:7300
- C:\Windows\System\kPShVNY.exe
  C:\Windows\System\kPShVNY.exe
  2⤵
  PID:6940
- C:\Windows\System\shqgMMA.exe
  C:\Windows\System\shqgMMA.exe
  2⤵
  PID:6500
- C:\Windows\System\WgWqpem.exe
  C:\Windows\System\WgWqpem.exe
  2⤵
  PID:7428
- C:\Windows\System\yqveyYQ.exe
  C:\Windows\System\yqveyYQ.exe
  2⤵
  PID:6888
- C:\Windows\System\UwIUube.exe
  C:\Windows\System\UwIUube.exe
  2⤵
  PID:8120
- C:\Windows\System\IpSecfa.exe
  C:\Windows\System\IpSecfa.exe
  2⤵
  PID:7244
- C:\Windows\System\jYdEfeK.exe
  C:\Windows\System\jYdEfeK.exe
  2⤵
  PID:7588
- C:\Windows\System\eZVwIYC.exe
  C:\Windows\System\eZVwIYC.exe
  2⤵
  PID:6572
- C:\Windows\System\uhzFEnx.exe
  C:\Windows\System\uhzFEnx.exe
  2⤵
  PID:7488
- C:\Windows\System\gchqSvF.exe
  C:\Windows\System\gchqSvF.exe
  2⤵
  PID:7448
- C:\Windows\System\zyljWQL.exe
  C:\Windows\System\zyljWQL.exe
  2⤵
  PID:8096
- C:\Windows\System\xNfiFQg.exe
  C:\Windows\System\xNfiFQg.exe
  2⤵
  PID:7904
- C:\Windows\System\tczVrwx.exe
  C:\Windows\System\tczVrwx.exe
  2⤵
  PID:8156
- C:\Windows\System\kXFDSLz.exe
  C:\Windows\System\kXFDSLz.exe
  2⤵
  PID:5628
- C:\Windows\System\MgrwSbR.exe
  C:\Windows\System\MgrwSbR.exe
  2⤵
  PID:8028
- C:\Windows\System\mXwHorg.exe
  C:\Windows\System\mXwHorg.exe
  2⤵
  PID:7644
- C:\Windows\System\naxGIOd.exe
  C:\Windows\System\naxGIOd.exe
  2⤵
  PID:7752
- C:\Windows\System\gcNtkFA.exe
  C:\Windows\System\gcNtkFA.exe
  2⤵
  PID:7840
- C:\Windows\System\drzzkcR.exe
  C:\Windows\System\drzzkcR.exe
  2⤵
  PID:7764
- C:\Windows\System\YcLoTaj.exe
  C:\Windows\System\YcLoTaj.exe
  2⤵
  PID:6792
- C:\Windows\System\yMNItIb.exe
  C:\Windows\System\yMNItIb.exe
  2⤵
  PID:7692
- C:\Windows\System\XcESodK.exe
  C:\Windows\System\XcESodK.exe
  2⤵
  PID:6368
- C:\Windows\System\GEjckVR.exe
  C:\Windows\System\GEjckVR.exe
  2⤵
  PID:7676
- C:\Windows\System\Xikjyks.exe
  C:\Windows\System\Xikjyks.exe
  2⤵
  PID:7068
- C:\Windows\System\BuSjman.exe
  C:\Windows\System\BuSjman.exe
  2⤵
  PID:7816
- C:\Windows\System\GgfHfim.exe
  C:\Windows\System\GgfHfim.exe
  2⤵
  PID:7976
- C:\Windows\System\jhDiPsG.exe
  C:\Windows\System\jhDiPsG.exe
  2⤵
  PID:5756
- C:\Windows\System\dYYjmyM.exe
  C:\Windows\System\dYYjmyM.exe
  2⤵
  PID:6240
- C:\Windows\System\nUeuXCe.exe
  C:\Windows\System\nUeuXCe.exe
  2⤵
  PID:6588
- C:\Windows\System\qlIYTIh.exe
  C:\Windows\System\qlIYTIh.exe
  2⤵
  PID:7748
- C:\Windows\System\OHEREyc.exe
  C:\Windows\System\OHEREyc.exe
  2⤵
  PID:7212
- C:\Windows\System\ojRUUKs.exe
  C:\Windows\System\ojRUUKs.exe
  2⤵
  PID:7344
- C:\Windows\System\JdfzOYB.exe
  C:\Windows\System\JdfzOYB.exe
  2⤵
  PID:7380
- C:\Windows\System\qKxugIz.exe
  C:\Windows\System\qKxugIz.exe
  2⤵
  PID:8180
- C:\Windows\System\ibtWkMm.exe
  C:\Windows\System\ibtWkMm.exe
  2⤵
  PID:8020
- C:\Windows\System\JpPqKxc.exe
  C:\Windows\System\JpPqKxc.exe
  2⤵
  PID:7656
- C:\Windows\System\MUauvgG.exe
  C:\Windows\System\MUauvgG.exe
  2⤵
  PID:7820
- C:\Windows\System\Hosvkzx.exe
  C:\Windows\System\Hosvkzx.exe
  2⤵
  PID:7716
- C:\Windows\System\vTUjvbY.exe
  C:\Windows\System\vTUjvbY.exe
  2⤵
  PID:8184
- C:\Windows\System\IZOsduS.exe
  C:\Windows\System\IZOsduS.exe
  2⤵
  PID:7804
- C:\Windows\System\XgbICGW.exe
  C:\Windows\System\XgbICGW.exe
  2⤵
  PID:7968
- C:\Windows\System\kpnKvRr.exe
  C:\Windows\System\kpnKvRr.exe
  2⤵
  PID:6424
- C:\Windows\System\QFKqMGD.exe
  C:\Windows\System\QFKqMGD.exe
  2⤵
  PID:7784
- C:\Windows\System\nzhJjAg.exe
  C:\Windows\System\nzhJjAg.exe
  2⤵
  PID:8212
- C:\Windows\System\OEZNuZq.exe
  C:\Windows\System\OEZNuZq.exe
  2⤵
  PID:8232
- C:\Windows\System\wzKtUbr.exe
  C:\Windows\System\wzKtUbr.exe
  2⤵
  PID:8256
- C:\Windows\System\vLMVbhi.exe
  C:\Windows\System\vLMVbhi.exe
  2⤵
  PID:8276
- C:\Windows\System\DpmhEmF.exe
  C:\Windows\System\DpmhEmF.exe
  2⤵
  PID:8296
- C:\Windows\System\BhzbpQT.exe
  C:\Windows\System\BhzbpQT.exe
  2⤵
  PID:8320
- C:\Windows\System\WdygLGp.exe
  C:\Windows\System\WdygLGp.exe
  2⤵
  PID:8336
- C:\Windows\System\DODlnwO.exe
  C:\Windows\System\DODlnwO.exe
  2⤵
  PID:8352
- C:\Windows\System\pmSvJNT.exe
  C:\Windows\System\pmSvJNT.exe
  2⤵
  PID:8372
- C:\Windows\System\AblWsmD.exe
  C:\Windows\System\AblWsmD.exe
  2⤵
  PID:8396
- C:\Windows\System\rVfbZSL.exe
  C:\Windows\System\rVfbZSL.exe
  2⤵
  PID:8412
- C:\Windows\System\Mbsdoly.exe
  C:\Windows\System\Mbsdoly.exe
  2⤵
  PID:8428
- C:\Windows\System\PnlxFrV.exe
  C:\Windows\System\PnlxFrV.exe
  2⤵
  PID:8448
- C:\Windows\System\AlMsOaT.exe
  C:\Windows\System\AlMsOaT.exe
  2⤵
  PID:8472
- C:\Windows\System\PEWCNMm.exe
  C:\Windows\System\PEWCNMm.exe
  2⤵
  PID:8488
- C:\Windows\System\CnkGeKQ.exe
  C:\Windows\System\CnkGeKQ.exe
  2⤵
  PID:8504
- C:\Windows\System\anDOZiq.exe
  C:\Windows\System\anDOZiq.exe
  2⤵
  PID:8524
- C:\Windows\System\htzWpyj.exe
  C:\Windows\System\htzWpyj.exe
  2⤵
  PID:8540
- C:\Windows\System\ugsDRKD.exe
  C:\Windows\System\ugsDRKD.exe
  2⤵
  PID:8568
- C:\Windows\System\MDZIgfv.exe
  C:\Windows\System\MDZIgfv.exe
  2⤵
  PID:8584
- C:\Windows\System\QGoMuks.exe
  C:\Windows\System\QGoMuks.exe
  2⤵
  PID:8620
- C:\Windows\System\nXFKGiH.exe
  C:\Windows\System\nXFKGiH.exe
  2⤵
  PID:8636
- C:\Windows\System\KPQDgwA.exe
  C:\Windows\System\KPQDgwA.exe
  2⤵
  PID:8652
- C:\Windows\System\KeCPhax.exe
  C:\Windows\System\KeCPhax.exe
  2⤵
  PID:8668
- C:\Windows\System\ABvidli.exe
  C:\Windows\System\ABvidli.exe
  2⤵
  PID:8688
- C:\Windows\System\nlULlaC.exe
  C:\Windows\System\nlULlaC.exe
  2⤵
  PID:8704
- C:\Windows\System\KllGLJp.exe
  C:\Windows\System\KllGLJp.exe
  2⤵
  PID:8720
- C:\Windows\System\GcdmIWf.exe
  C:\Windows\System\GcdmIWf.exe
  2⤵
  PID:8740
- C:\Windows\System\pnEIcET.exe
  C:\Windows\System\pnEIcET.exe
  2⤵
  PID:8784
- C:\Windows\System\QJJjgLV.exe
  C:\Windows\System\QJJjgLV.exe
  2⤵
  PID:8800
- C:\Windows\System\bsBGGEr.exe
  C:\Windows\System\bsBGGEr.exe
  2⤵
  PID:8816
- C:\Windows\System\SbdbVZc.exe
  C:\Windows\System\SbdbVZc.exe
  2⤵
  PID:8832
- C:\Windows\System\JyQZjaI.exe
  C:\Windows\System\JyQZjaI.exe
  2⤵
  PID:8848
- C:\Windows\System\ZjPJArK.exe
  C:\Windows\System\ZjPJArK.exe
  2⤵
  PID:8864
- C:\Windows\System\hOvPbPf.exe
  C:\Windows\System\hOvPbPf.exe
  2⤵
  PID:8884
- C:\Windows\System\lCgLMrI.exe
  C:\Windows\System\lCgLMrI.exe
  2⤵
  PID:8908
- C:\Windows\System\KkQWAVq.exe
  C:\Windows\System\KkQWAVq.exe
  2⤵
  PID:8924
- C:\Windows\System\jUTdliB.exe
  C:\Windows\System\jUTdliB.exe
  2⤵
  PID:8944
- C:\Windows\System\cboHwra.exe
  C:\Windows\System\cboHwra.exe
  2⤵
  PID:8984
- C:\Windows\System\qzOzXfy.exe
  C:\Windows\System\qzOzXfy.exe
  2⤵
  PID:9000
- C:\Windows\System\ZfeTYYi.exe
  C:\Windows\System\ZfeTYYi.exe
  2⤵
  PID:9016
- C:\Windows\System\uCwIljA.exe
  C:\Windows\System\uCwIljA.exe
  2⤵
  PID:9032
- C:\Windows\System\PCiRzeL.exe
  C:\Windows\System\PCiRzeL.exe
  2⤵
  PID:9048
- C:\Windows\System\OLRnQVe.exe
  C:\Windows\System\OLRnQVe.exe
  2⤵
  PID:9064
- C:\Windows\System\NZUqPOX.exe
  C:\Windows\System\NZUqPOX.exe
  2⤵
  PID:9080
- C:\Windows\System\ujLGzjb.exe
  C:\Windows\System\ujLGzjb.exe
  2⤵
  PID:9100
- C:\Windows\System\oLIOtik.exe
  C:\Windows\System\oLIOtik.exe
  2⤵
  PID:9120
- C:\Windows\System\INreawa.exe
  C:\Windows\System\INreawa.exe
  2⤵
  PID:9136
- C:\Windows\System\tNaMhUn.exe
  C:\Windows\System\tNaMhUn.exe
  2⤵
  PID:9168
- C:\Windows\System\bbZSCdt.exe
  C:\Windows\System\bbZSCdt.exe
  2⤵
  PID:9184
- C:\Windows\System\mQLINhp.exe
  C:\Windows\System\mQLINhp.exe
  2⤵
  PID:9208
- C:\Windows\System\gBstOHR.exe
  C:\Windows\System\gBstOHR.exe
  2⤵
  PID:8240
- C:\Windows\System\hpxEEhg.exe
  C:\Windows\System\hpxEEhg.exe
  2⤵
  PID:8220
- C:\Windows\System\MrCgbMF.exe
  C:\Windows\System\MrCgbMF.exe
  2⤵
  PID:8228
- C:\Windows\System\CxnkDlq.exe
  C:\Windows\System\CxnkDlq.exe
  2⤵
  PID:8316
- C:\Windows\System\FaJiJuS.exe
  C:\Windows\System\FaJiJuS.exe
  2⤵
  PID:8360
- C:\Windows\System\sLGRcHt.exe
  C:\Windows\System\sLGRcHt.exe
  2⤵
  PID:8404
- C:\Windows\System\TsfGkSM.exe
  C:\Windows\System\TsfGkSM.exe
  2⤵
  PID:8348
- C:\Windows\System\qTgASxr.exe
  C:\Windows\System\qTgASxr.exe
  2⤵
  PID:8548
- C:\Windows\System\QrHZXUF.exe
  C:\Windows\System\QrHZXUF.exe
  2⤵
  PID:8380
- C:\Windows\System\yzsfgcP.exe
  C:\Windows\System\yzsfgcP.exe
  2⤵
  PID:8424
- C:\Windows\System\WYjcMmm.exe
  C:\Windows\System\WYjcMmm.exe
  2⤵
  PID:8460
- C:\Windows\System\EYDjlZz.exe
  C:\Windows\System\EYDjlZz.exe
  2⤵
  PID:8580
- C:\Windows\System\oeUExjf.exe
  C:\Windows\System\oeUExjf.exe
  2⤵
  PID:8604
- C:\Windows\System\jZSgdMB.exe
  C:\Windows\System\jZSgdMB.exe
  2⤵
  PID:8648
- C:\Windows\System\GPxTGaw.exe
  C:\Windows\System\GPxTGaw.exe
  2⤵
  PID:8712
- C:\Windows\System\kYAddmZ.exe
  C:\Windows\System\kYAddmZ.exe
  2⤵
  PID:8700
- C:\Windows\System\UYSJLhL.exe
  C:\Windows\System\UYSJLhL.exe
  2⤵
  PID:8696
- C:\Windows\System\IFvhhzG.exe
  C:\Windows\System\IFvhhzG.exe
  2⤵
  PID:8752
- C:\Windows\System\xYZWCqV.exe
  C:\Windows\System\xYZWCqV.exe
  2⤵
  PID:8768
- C:\Windows\System\MsQYLiP.exe
  C:\Windows\System\MsQYLiP.exe
  2⤵
  PID:8844
- C:\Windows\System\nnGRoUU.exe
  C:\Windows\System\nnGRoUU.exe
  2⤵
  PID:8916
- C:\Windows\System\YgvflTt.exe
  C:\Windows\System\YgvflTt.exe
  2⤵
  PID:8892
- C:\Windows\System\srNXtge.exe
  C:\Windows\System\srNXtge.exe
  2⤵
  PID:8828
- C:\Windows\System\FCvMLfP.exe
  C:\Windows\System\FCvMLfP.exe
  2⤵
  PID:8972
- C:\Windows\System\iDiibdY.exe
  C:\Windows\System\iDiibdY.exe
  2⤵
  PID:9008
- C:\Windows\System\HKIXcyQ.exe
  C:\Windows\System\HKIXcyQ.exe
  2⤵
  PID:9040
- C:\Windows\System\rdDdenb.exe
  C:\Windows\System\rdDdenb.exe
  2⤵
  PID:9112
- C:\Windows\System\qNZCdby.exe
  C:\Windows\System\qNZCdby.exe
  2⤵
  PID:9152
- C:\Windows\System\wSrocKf.exe
  C:\Windows\System\wSrocKf.exe
  2⤵
  PID:9164
- C:\Windows\System\ZGZeZiq.exe
  C:\Windows\System\ZGZeZiq.exe
  2⤵
  PID:9128
- C:\Windows\System\pottdii.exe
  C:\Windows\System\pottdii.exe
  2⤵
  PID:8200
- C:\Windows\System\VREkcpn.exe
  C:\Windows\System\VREkcpn.exe
  2⤵
  PID:7456
- C:\Windows\System\HkHJfMC.exe
  C:\Windows\System\HkHJfMC.exe
  2⤵
  PID:8252
- C:\Windows\System\iqUBkmO.exe
  C:\Windows\System\iqUBkmO.exe
  2⤵
  PID:8264
- C:\Windows\System\yeIuFZJ.exe
  C:\Windows\System\yeIuFZJ.exe
  2⤵
  PID:8308
- C:\Windows\System\oahbmvv.exe
  C:\Windows\System\oahbmvv.exe
  2⤵
  PID:8344
- C:\Windows\System\xzzYTPT.exe
  C:\Windows\System\xzzYTPT.exe
  2⤵
  PID:8444
- C:\Windows\System\wOsyqyG.exe
  C:\Windows\System\wOsyqyG.exe
  2⤵
  PID:8456
- C:\Windows\System\STyDgft.exe
  C:\Windows\System\STyDgft.exe
  2⤵
  PID:8616
- C:\Windows\System\wvrMrvq.exe
  C:\Windows\System\wvrMrvq.exe
  2⤵
  PID:8600
- C:\Windows\System\CwyGQoz.exe
  C:\Windows\System\CwyGQoz.exe
  2⤵
  PID:8760
- C:\Windows\System\NlKWmqP.exe
  C:\Windows\System\NlKWmqP.exe
  2⤵
  PID:8792
- C:\Windows\System\tYYIwfP.exe
  C:\Windows\System\tYYIwfP.exe
  2⤵
  PID:8880
- C:\Windows\System\gFmbOIR.exe
  C:\Windows\System\gFmbOIR.exe
  2⤵
  PID:8932
- C:\Windows\System\LSOflXj.exe
  C:\Windows\System\LSOflXj.exe
  2⤵
  PID:8856
- C:\Windows\System\JRSxCYi.exe
  C:\Windows\System\JRSxCYi.exe
  2⤵
  PID:8980
- C:\Windows\System\DsaOwBM.exe
  C:\Windows\System\DsaOwBM.exe
  2⤵
  PID:8776
- C:\Windows\System\BgWrMsp.exe
  C:\Windows\System\BgWrMsp.exe
  2⤵
  PID:9156
- C:\Windows\System\MxTEMWf.exe
  C:\Windows\System\MxTEMWf.exe
  2⤵
  PID:9196
- C:\Windows\System\IaaKnCh.exe
  C:\Windows\System\IaaKnCh.exe
  2⤵
  PID:9088
- C:\Windows\System\uRxtSis.exe
  C:\Windows\System\uRxtSis.exe
  2⤵
  PID:8292
- C:\Windows\System\gDNCczB.exe
  C:\Windows\System\gDNCczB.exe
  2⤵
  PID:6704
- C:\Windows\System\dWqDsdZ.exe
  C:\Windows\System\dWqDsdZ.exe
  2⤵
  PID:8520
- C:\Windows\System\aBIJbHP.exe
  C:\Windows\System\aBIJbHP.exe
  2⤵
  PID:1800
- C:\Windows\System\zsRCrFu.exe
  C:\Windows\System\zsRCrFu.exe
  2⤵
  PID:8748
- C:\Windows\System\qKxsUob.exe
  C:\Windows\System\qKxsUob.exe
  2⤵
  PID:8680
- C:\Windows\System\jWiPanQ.exe
  C:\Windows\System\jWiPanQ.exe
  2⤵
  PID:8872
- C:\Windows\System\fEGuaub.exe
  C:\Windows\System\fEGuaub.exe
  2⤵
  PID:8808
- C:\Windows\System\bbIBKUy.exe
  C:\Windows\System\bbIBKUy.exe
  2⤵
  PID:8904
- C:\Windows\System\oafvvcq.exe
  C:\Windows\System\oafvvcq.exe
  2⤵
  PID:9108
- C:\Windows\System\wTgqTdP.exe
  C:\Windows\System\wTgqTdP.exe
  2⤵
  PID:9060
- C:\Windows\System\LlIgZuw.exe
  C:\Windows\System\LlIgZuw.exe
  2⤵
  PID:8368
- C:\Windows\System\mvWrtOg.exe
  C:\Windows\System\mvWrtOg.exe
  2⤵
  PID:8564
- C:\Windows\System\VCylQym.exe
  C:\Windows\System\VCylQym.exe
  2⤵
  PID:1704
- C:\Windows\System\rkSYemi.exe
  C:\Windows\System\rkSYemi.exe
  2⤵
  PID:8500
- C:\Windows\System\YrKuDSx.exe
  C:\Windows\System\YrKuDSx.exe
  2⤵
  PID:8596
- C:\Windows\System\NztciAv.exe
  C:\Windows\System\NztciAv.exe
  2⤵
  PID:8876
- C:\Windows\System\vMfglOC.exe
  C:\Windows\System\vMfglOC.exe
  2⤵
  PID:9180
- C:\Windows\System\EBeHLFN.exe
  C:\Windows\System\EBeHLFN.exe
  2⤵
  PID:9204
- C:\Windows\System\enBWXwl.exe
  C:\Windows\System\enBWXwl.exe
  2⤵
  PID:7264
- C:\Windows\System\QglLgim.exe
  C:\Windows\System\QglLgim.exe
  2⤵
  PID:8732
- C:\Windows\System\yktAcQr.exe
  C:\Windows\System\yktAcQr.exe
  2⤵
  PID:8436
- C:\Windows\System\HwArGHK.exe
  C:\Windows\System\HwArGHK.exe
  2⤵
  PID:8964
- C:\Windows\System\UytkSco.exe
  C:\Windows\System\UytkSco.exe
  2⤵
  PID:8764
- C:\Windows\System\ZSkyzDT.exe
  C:\Windows\System\ZSkyzDT.exe
  2⤵
  PID:9096
- C:\Windows\System\iziSLAS.exe
  C:\Windows\System\iziSLAS.exe
  2⤵
  PID:8960
- C:\Windows\System\wtndUVV.exe
  C:\Windows\System\wtndUVV.exe
  2⤵
  PID:8440
- C:\Windows\System\SWHfwpU.exe
  C:\Windows\System\SWHfwpU.exe
  2⤵
  PID:9228
- C:\Windows\System\SMjHRpS.exe
  C:\Windows\System\SMjHRpS.exe
  2⤵
  PID:9248
- C:\Windows\System\wrvEYZk.exe
  C:\Windows\System\wrvEYZk.exe
  2⤵
  PID:9284
- C:\Windows\System\PliPRbQ.exe
  C:\Windows\System\PliPRbQ.exe
  2⤵
  PID:9304
- C:\Windows\System\aBWGqXy.exe
  C:\Windows\System\aBWGqXy.exe
  2⤵
  PID:9320
- C:\Windows\System\PijRdwU.exe
  C:\Windows\System\PijRdwU.exe
  2⤵
  PID:9336
- C:\Windows\System\IsImuXS.exe
  C:\Windows\System\IsImuXS.exe
  2⤵
  PID:9352
- C:\Windows\System\qbhMhKg.exe
  C:\Windows\System\qbhMhKg.exe
  2⤵
  PID:9372
- C:\Windows\System\aRjLSiF.exe
  C:\Windows\System\aRjLSiF.exe
  2⤵
  PID:9388
- C:\Windows\System\iXcVNmO.exe
  C:\Windows\System\iXcVNmO.exe
  2⤵
  PID:9408
- C:\Windows\System\OewUGVq.exe
  C:\Windows\System\OewUGVq.exe
  2⤵
  PID:9424
- C:\Windows\System\hzlJphi.exe
  C:\Windows\System\hzlJphi.exe
  2⤵
  PID:9444
- C:\Windows\System\EqtaXPU.exe
  C:\Windows\System\EqtaXPU.exe
  2⤵
  PID:9460
- C:\Windows\System\aYKCTBl.exe
  C:\Windows\System\aYKCTBl.exe
  2⤵
  PID:9480
- C:\Windows\System\iSpgURK.exe
  C:\Windows\System\iSpgURK.exe
  2⤵
  PID:9504
- C:\Windows\System\SoZdHzz.exe
  C:\Windows\System\SoZdHzz.exe
  2⤵
  PID:9524
- C:\Windows\System\jyvqVOp.exe
  C:\Windows\System\jyvqVOp.exe
  2⤵
  PID:9564
- C:\Windows\System\NwtZzVx.exe
  C:\Windows\System\NwtZzVx.exe
  2⤵
  PID:9580
- C:\Windows\System\osPYvQO.exe
  C:\Windows\System\osPYvQO.exe
  2⤵
  PID:9604
- C:\Windows\System\nSKsKqZ.exe
  C:\Windows\System\nSKsKqZ.exe
  2⤵
  PID:9620
- C:\Windows\System\ajbXZiB.exe
  C:\Windows\System\ajbXZiB.exe
  2⤵
  PID:9636
- C:\Windows\System\bLTqUPs.exe
  C:\Windows\System\bLTqUPs.exe
  2⤵
  PID:9652
- C:\Windows\System\UJgWoln.exe
  C:\Windows\System\UJgWoln.exe
  2⤵
  PID:9692
- C:\Windows\System\LHzEtsf.exe
  C:\Windows\System\LHzEtsf.exe
  2⤵
  PID:9708
- C:\Windows\System\kCNOjIN.exe
  C:\Windows\System\kCNOjIN.exe
  2⤵
  PID:9724
- C:\Windows\System\byCJKXN.exe
  C:\Windows\System\byCJKXN.exe
  2⤵
  PID:9740
- C:\Windows\System\YvWroOl.exe
  C:\Windows\System\YvWroOl.exe
  2⤵
  PID:9760
- C:\Windows\System\UNiQbxI.exe
  C:\Windows\System\UNiQbxI.exe
  2⤵
  PID:9792
- C:\Windows\System\ywRCEkE.exe
  C:\Windows\System\ywRCEkE.exe
  2⤵
  PID:9808
- C:\Windows\System\JWjolYI.exe
  C:\Windows\System\JWjolYI.exe
  2⤵
  PID:9824
- C:\Windows\System\NPWrImb.exe
  C:\Windows\System\NPWrImb.exe
  2⤵
  PID:9860
- C:\Windows\System\tlquyxI.exe
  C:\Windows\System\tlquyxI.exe
  2⤵
  PID:9876
- C:\Windows\System\DQHcVrW.exe
  C:\Windows\System\DQHcVrW.exe
  2⤵
  PID:9896
- C:\Windows\System\KZDJzhi.exe
  C:\Windows\System\KZDJzhi.exe
  2⤵
  PID:9916
- C:\Windows\System\lVgaDdp.exe
  C:\Windows\System\lVgaDdp.exe
  2⤵
  PID:9932
- C:\Windows\System\LcQSEbq.exe
  C:\Windows\System\LcQSEbq.exe
  2⤵
  PID:9948
- C:\Windows\System\CdOcSiX.exe
  C:\Windows\System\CdOcSiX.exe
  2⤵
  PID:9968
- C:\Windows\System\YQUQBfd.exe
  C:\Windows\System\YQUQBfd.exe
  2⤵
  PID:10000
- C:\Windows\System\anwmOqX.exe
  C:\Windows\System\anwmOqX.exe
  2⤵
  PID:10016
- C:\Windows\System\QnJGyNu.exe
  C:\Windows\System\QnJGyNu.exe
  2⤵
  PID:10032
- C:\Windows\System\pxravSO.exe
  C:\Windows\System\pxravSO.exe
  2⤵
  PID:10052
- C:\Windows\System\xqZNxiv.exe
  C:\Windows\System\xqZNxiv.exe
  2⤵
  PID:10068
- C:\Windows\System\JuYSdGZ.exe
  C:\Windows\System\JuYSdGZ.exe
  2⤵
  PID:10104
- C:\Windows\System\MzgNAfO.exe
  C:\Windows\System\MzgNAfO.exe
  2⤵
  PID:10120
- C:\Windows\System\eAvwlZT.exe
  C:\Windows\System\eAvwlZT.exe
  2⤵
  PID:10140
- C:\Windows\System\fxVXKSf.exe
  C:\Windows\System\fxVXKSf.exe
  2⤵
  PID:10160
- C:\Windows\System\VJlmvJQ.exe
  C:\Windows\System\VJlmvJQ.exe
  2⤵
  PID:10176
- C:\Windows\System\XAMpoGf.exe
  C:\Windows\System\XAMpoGf.exe
  2⤵
  PID:10192
- C:\Windows\System\BHDoWlo.exe
  C:\Windows\System\BHDoWlo.exe
  2⤵
  PID:10212
- C:\Windows\System\pjuezGr.exe
  C:\Windows\System\pjuezGr.exe
  2⤵
  PID:10236
- C:\Windows\System\LKadJvi.exe
  C:\Windows\System\LKadJvi.exe
  2⤵
  PID:9220
- C:\Windows\System\kITzGYH.exe
  C:\Windows\System\kITzGYH.exe
  2⤵
  PID:9236
- C:\Windows\System\seGZxeZ.exe
  C:\Windows\System\seGZxeZ.exe
  2⤵
  PID:9264
- C:\Windows\System\mWRUzhb.exe
  C:\Windows\System\mWRUzhb.exe
  2⤵
  PID:9292
- C:\Windows\System\CTkpKhq.exe
  C:\Windows\System\CTkpKhq.exe
  2⤵
  PID:9364
- C:\Windows\System\tCqrykN.exe
  C:\Windows\System\tCqrykN.exe
  2⤵
  PID:9384
- C:\Windows\System\LTkovbG.exe
  C:\Windows\System\LTkovbG.exe
  2⤵
  PID:9456
- C:\Windows\System\hVCeUuv.exe
  C:\Windows\System\hVCeUuv.exe
  2⤵
  PID:9440
- C:\Windows\System\oceEcrR.exe
  C:\Windows\System\oceEcrR.exe
  2⤵
  PID:9396
- C:\Windows\System\nVHMdJv.exe
  C:\Windows\System\nVHMdJv.exe
  2⤵
  PID:9500
- C:\Windows\System\EFcyoGE.exe
  C:\Windows\System\EFcyoGE.exe
  2⤵
  PID:9532
- C:\Windows\System\OrJZjgO.exe
  C:\Windows\System\OrJZjgO.exe
  2⤵
  PID:9548
- C:\Windows\System\MrjGHmi.exe
  C:\Windows\System\MrjGHmi.exe
  2⤵
  PID:9572
- C:\Windows\System\qqBHzvl.exe
  C:\Windows\System\qqBHzvl.exe
  2⤵
  PID:9592
- C:\Windows\System\UWkuVCh.exe
  C:\Windows\System\UWkuVCh.exe
  2⤵
  PID:9716
- C:\Windows\System\rJLtEjA.exe
  C:\Windows\System\rJLtEjA.exe
  2⤵
  PID:9732
- C:\Windows\System\PtpPLNZ.exe
  C:\Windows\System\PtpPLNZ.exe
  2⤵
  PID:9780
- C:\Windows\System\fjwSDUV.exe
  C:\Windows\System\fjwSDUV.exe
  2⤵
  PID:9804
- C:\Windows\System\xSfhaeD.exe
  C:\Windows\System\xSfhaeD.exe
  2⤵
  PID:9856
- C:\Windows\System\RiyUYTy.exe
  C:\Windows\System\RiyUYTy.exe
  2⤵
  PID:9884
- C:\Windows\System\shSqYcN.exe
  C:\Windows\System\shSqYcN.exe
  2⤵
  PID:9908
- C:\Windows\System\sexXkbf.exe
  C:\Windows\System\sexXkbf.exe
  2⤵
  PID:9976
- C:\Windows\System\nRIuhyX.exe
  C:\Windows\System\nRIuhyX.exe
  2⤵
  PID:9992
- C:\Windows\System\tQEewii.exe
  C:\Windows\System\tQEewii.exe
  2⤵
  PID:10044
- C:\Windows\System\epZVaTz.exe
  C:\Windows\System\epZVaTz.exe
  2⤵
  PID:10080
- C:\Windows\System\dLLCGGc.exe
  C:\Windows\System\dLLCGGc.exe
  2⤵
  PID:10088
- C:\Windows\System\SjYLdIg.exe
  C:\Windows\System\SjYLdIg.exe
  2⤵
  PID:10132
- C:\Windows\System\fSdWJQJ.exe
  C:\Windows\System\fSdWJQJ.exe
  2⤵
  PID:10204
- C:\Windows\System\YcHAaBO.exe
  C:\Windows\System\YcHAaBO.exe
  2⤵
  PID:10224
- C:\Windows\System\WgYafRy.exe
  C:\Windows\System\WgYafRy.exe
  2⤵
  PID:9224
- C:\Windows\System\MSahbUZ.exe
  C:\Windows\System\MSahbUZ.exe
  2⤵
  PID:9316
- C:\Windows\System\DIEngek.exe
  C:\Windows\System\DIEngek.exe
  2⤵
  PID:9312
- C:\Windows\System\ZZHcAgD.exe
  C:\Windows\System\ZZHcAgD.exe
  2⤵
  PID:9380
- C:\Windows\System\cnwlTwI.exe
  C:\Windows\System\cnwlTwI.exe
  2⤵
  PID:9492
- C:\Windows\System\iMMAIuT.exe
  C:\Windows\System\iMMAIuT.exe
  2⤵
  PID:9512
- C:\Windows\System\DLCWxTV.exe
  C:\Windows\System\DLCWxTV.exe
  2⤵
  PID:9516
- C:\Windows\System\JtlOxpb.exe
  C:\Windows\System\JtlOxpb.exe
  2⤵
  PID:9596
- C:\Windows\System\YxTEtKE.exe
  C:\Windows\System\YxTEtKE.exe
  2⤵
  PID:9648
- C:\Windows\System\udGJCrx.exe
  C:\Windows\System\udGJCrx.exe
  2⤵
  PID:9704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AnGEpWq.exe

Filesize
1.9MB

MD5
2f37644e635af3b2688b1ca5e6d41218

SHA1
6dd81f60bec8c7562d91270a60850f850ce9104c

SHA256
d019898406fddef52ea4989ae4084921bdf80bc072aa85f42b97bfa88f85d98c

SHA512
2c67a91f2c165ad179855c7cd4be88cfdba5db0a603f1071467bfbeced676e2f534d84ba097721045a1a3a1b88d0a8d71b10d7bfee37ea02b8b28c1982a47fbf

Download Submit
C:\Windows\system\BSxzTza.exe

Filesize
1.8MB

MD5
277ddc85ed4262791bf23059f0379cba

SHA1
9b4ea559cc02852f7960424dcd3a04edd3fc2b8e

SHA256
90399b2ed1d84b7f7475931f99a162f9434b55a160401aef0deb5fa01b8b2bcd

SHA512
5dabb1342efb3d8708cfb868d3129176fad43d669187adcd701e04a874bd5a9874e86f2f32fff641ba1fe8811621c9f93d4d7ebd21ecbda4c53157850a8d3f69

Download Submit
C:\Windows\system\BcgTSKl.exe

Filesize
1.8MB

MD5
c8618467f84b589845bd780910dce7b1

SHA1
41746a3b3181b2c00453ee2e21461c3cc6312cec

SHA256
862c83b30cb16ebf29bf6f8659e8676821fd41e515e8f604f5e703ef4916aae7

SHA512
955acec4e5d202e151853f31748edb1260c52826ff7fff4255f8d1490aba27c266c6e697863803eb9a69cb45095c71e0c585e9eb4d6794c4c05f7eb3e0783097

Download Submit
C:\Windows\system\DpYDUgQ.exe

Filesize
1.8MB

MD5
7b3bd04c506519c2190acf7af90cb237

SHA1
bdcf5a5874035b63234f4fd08ac019252f54d0ad

SHA256
95c7cddd0ec8460b42469eb275b6c070fdeac15ec15b042d4e48198b7d44b7f9

SHA512
03bf279b4d8201a5722f36df5892da2c1742ddbcbe3c25a375ccd18f841535188040605048826a2275e240227a2877489d4310fbb0f583c1aed7f9822d655b14

Download Submit
C:\Windows\system\EicPwKc.exe

Filesize
1.8MB

MD5
b3c41c314de6c39248642375d0186e22

SHA1
c77484b687683f0dba0241fbf1549cd5ba74806b

SHA256
67a954a6b9098d199747a898bc78487cb48e4ff9a122bac72a654badd2ecfc1f

SHA512
eff1acf35b811b6114016ad7bf5eecbd84cb8ab4a9acd1f8988edcf0353ac0a3f7f040fc9ed96a3a674114ddcff0840937266b5f8a5c4294303fb6d8627588f7

Download Submit
C:\Windows\system\LfmoXWv.exe

Filesize
1.8MB

MD5
57b0016889bc37075ebd4fd95cb7c88e

SHA1
af736a9aeffe56afc0d49bdc1c4e9fb22fc9d4f6

SHA256
33875b50ea75c72fe5e671a33c648c55d95f08e0ef076edb38155e20175c24ea

SHA512
dff0fa61ac02628acb4f700085eac0d688eecb40dc75e393819ee469b08cd3682a45a9ee46ea954cc61426c3c11848c220618e3e305039ac833238c8f60d9908

Download Submit
C:\Windows\system\QvSHibX.exe

Filesize
1.8MB

MD5
420ea6598e73f4a253392b71410db94f

SHA1
4527db8cee2271112ee1bff3dfdc4fe743a4a631

SHA256
730b365c4c4e46a59a70a0edfd455ee7efdb73f5700f9c406eedc2ea44ed447e

SHA512
7deda82e693c66654d3bb0e4a39b27d7507ebf2676ab4a781853268330d952481cf396369749dea6fb9ec986906d481e86d4de96c6dbb9445d5b68ea5f498312

Download Submit
C:\Windows\system\SInpDfx.exe

Filesize
1.8MB

MD5
7eba1bf632b2702c61713e045f6e098e

SHA1
8ad95a387fe06bf2fd837c0261ba53c3781fd34a

SHA256
9fa07df230fa6169367e49bddbd3c31839cc28aacf84dbc5a69722e800f99d10

SHA512
2d2282d4d6193288cf91b0b675dfef1fa52180a208c488a1f811bfbbbeea9f500ddd550c27e3c1829a8dafc2f48725657a435659f56ad5bc5d54de8adbea7060

Download Submit
C:\Windows\system\VLdjFRb.exe

Filesize
1.9MB

MD5
ebd6a77eac0b912ce1895283199fb4c8

SHA1
06b3daf0bb9ee9c6f967d311bd82beeab41e84a4

SHA256
5b2c52e95dffdddb11ad8fc8f1dc719f697a7dbae7d9230177b5cd0ef5ac31f4

SHA512
e319db55274abec06b5294037b118dedb798b674acb489198f41dac47357dcce29c066ab39140fd13e669dd943a3a50cadebb5de53898efc72694a4aeddfda79

Download Submit
C:\Windows\system\VchgqAI.exe

Filesize
1.9MB

MD5
157801c0ad1494d52cd8824579b04ab1

SHA1
bf78c2d49bb66bfd4b8ac65584c07d4f528354f1

SHA256
1edd6423e6e43b2a89f874f6f217d3b47d8c97fd0873178bf49f3d6c3985dd4f

SHA512
1e3ecb1bf37aa5e0628a12129715858cdee657549f19feefcd36ab1511f18ca73a82f17f4c329175f0258a0369c0db0d35390b934599e9c3d1fd410fd8a64920

Download Submit
C:\Windows\system\VsSqjrr.exe

Filesize
1.8MB

MD5
a62612676b911fa0a75d87f613c91693

SHA1
3111708c57a7b2acd029e76aa5f1867c117ccbf8

SHA256
652b6a6256ff6693aef28151baa3129e8268b009c53ed6d6a563f3feb994cfad

SHA512
7b5da23a35a8de741448cd560447e80e15748368727a48cefe65f6d049da92e4f9e10a6acbb6e32c7c03b97f8543f903e0fa06bbbfbcf830e357edb66b1e3afa

Download Submit
C:\Windows\system\WHereZA.exe

Filesize
1.8MB

MD5
2a9490f64c55c132be2c78f4f80d5bb9

SHA1
6b423d9b7f7633615d5f700c1c4f17c0130a8455

SHA256
1d42a5c2ea6e24206326c560bd3225b1ada915ef996a310b05d4258f5fad0c1a

SHA512
a2d51f0660fc421c8f3f669ddd80811af0940aa3e16b1865bc9944064adc153c30bd116fc52410d4db7a63aaab373ab9d4d6537a7455646e26a1255afb430b9d

Download Submit
C:\Windows\system\YZHZShY.exe

Filesize
1.9MB

MD5
b743cf6648782e0f7fd2789453f648ab

SHA1
1292c8459548286d978b95cdf6087d5e0a3994be

SHA256
b5d2fd2a181ac90dfc1580ddb83942ec69bd511ff5cad511ae0d1439a4308b60

SHA512
1e04cf9ec4a6b33c3c2964275100ded496bb0dcb33832b1c6b5c42976baecea32d0cd4f569405bfc0d1a728551bf356afb66fab46822161760b4728d0d5964ba

Download Submit
C:\Windows\system\YyscJUG.exe

Filesize
1.9MB

MD5
f7800ff731b2d4a3f3c868df74512361

SHA1
3811534a9862b3fec1735d0a6f02323f88aaf9ab

SHA256
0d0857e9037d2e1eb6f89116a811dea3e87b06ef583e44fd95b830c0ff4d90da

SHA512
2afdadc69876fc2580dce698bce0d354bf3f77a48c00abae9e36cc439d7d7c29a6da0f10686535dd90644ca775d72814c80a6ebc88edecd92da4f0f79ddbfbd6

Download Submit
C:\Windows\system\ZvEvlOt.exe

Filesize
1.8MB

MD5
909d6f16f0ec742d82ffb63087fb6065

SHA1
fa0557f11cb284a32ce2bdc7adbbf89850d09b9d

SHA256
53f9fdb0f2b5c32be6bddda169e3ff9d507f6d9e0af2408cb57257be6bb9580f

SHA512
289bc3ebb77d6a5b469e0505629845bde70d450ef004e4ad9cea3594868f91741dabcd88bf828a9071b69810b6ffe150f83dac4d8e85a559b8dc5802cd2e3148

Download Submit
C:\Windows\system\bZSCKMi.exe

Filesize
1.8MB

MD5
4daada33c1feabd1f4a97d3aac331dce

SHA1
9e5e2dcb65bcfaa510b4cbd2c5a6f0d48c5ddb9c

SHA256
c38fb1e92f4f118f0e7d4b9995a00e7d6fa6c6af21aba3e408002756cd77bfa0

SHA512
b46ae4eacb58174e5ee6d73fd4f2fc95a95e24cdd9631550cf36b3a4c66c44605ed5906d74a092c0a005dc7f79a4496d54fa93e01715e87d59847a73d9666724

Download Submit
C:\Windows\system\chYVkob.exe

Filesize
1.8MB

MD5
2e1d64e2c06dbbae1da29a27ad6eda54

SHA1
e165848c79992b13fb7d40430959c942f30f960b

SHA256
8740d4519247848de455f19feb6f58db123ca72ec058cfa0040976b6d42f482d

SHA512
bb748f06dc144c514d1bb3408706824f272ea484c42500f6cf4e8f5d4b92fd145bbc45573c9d74ae44c7c561f78cb003f19a208d962192f1f414f610d98dcc02

Download Submit
C:\Windows\system\dFdNGtC.exe

Filesize
1.8MB

MD5
8e6b1abd4274d5319cc0858ae4578028

SHA1
8f0d19cdaba4096ddd6ee1e6cb026bd189f11cb3

SHA256
714f9d6cb2f840908614bca6f1dfc4e15a88fb4e3d7c2b375442865cae6daf4c

SHA512
28bfb1bf4c917378c003542f9a26f1564e188c44194118dc160572312bdde371c45f5a8e9e9f59c421a9e7c6668155b5e344c6f701b814e21947e8e80618ce7c

Download Submit
C:\Windows\system\dTxgLMX.exe

Filesize
1.8MB

MD5
8d44ce78be776109aa9aafd687a65166

SHA1
b2b929b231ac058f9e97c0b63eb4c37fe865989b

SHA256
f23ad9ea9afd78adfd45e0950bf4a9f57543de35b9fd132e5cb2c3d54d25f375

SHA512
6c5dd4b90c7e329879526c284647fde573e294ad9733f713c2b4e0e64bf4edf500016826eef63c7f9ce9e0b39ac108e2e2a62115dc3be57d348915ebb68e4e33

Download Submit
C:\Windows\system\fTKFFat.exe

Filesize
1.8MB

MD5
e8f0756c371b252095ba0a9397f0d082

SHA1
02f3832b7345a95ffb53bb047df73b5569e11b0c

SHA256
1ee44dad1f06ae4edfb907f603d0eb3cda103b91e2b6563043d542c5ed5afa6c

SHA512
9ec7f8006aa5d976b036be75f4eba52ffa60e9e99e213fb0c40d697c80099e06bd6aea8d1ad0f99296baf72f5ed09f5f66bc292e71863591c1e28a93515b00c6

Download Submit
C:\Windows\system\fyADLgW.exe

Filesize
1.9MB

MD5
31ad51c78eaec90fbd11745a119e7fbb

SHA1
d1032089d52581f52838943e9b284a9cdb7e7aa3

SHA256
b1ede8dcab876c906a45139edf820b2990d5b7a25c58bda6a99aec00684c4add

SHA512
af39a6563fa1af8a9da6e5dcf092db34b9e73813e5af8aa64ac81ec8be5a882f059dab086a4ad27988ba7c3a657f9acdd24ac8c6273b77ee3374acbfb1dbb008

Download Submit
C:\Windows\system\loBbZpr.exe

Filesize
1.8MB

MD5
9d88427550276a593e688deab66d1755

SHA1
cddef4d68465c8ee0f0e68beb14d7e943507d784

SHA256
866973a86422674e99e351cc092f43731b397f86d1999087ea0809795376beb3

SHA512
e139bbd4ff417976f1ca2678b2031d267be7ddcbb4f065296eacf16d944b6d1bbeca19d767324f82f899b8dd13c3fc8e1c13739e33868419a45330b666055dd8

Download Submit
C:\Windows\system\mpvwSze.exe

Filesize
1.8MB

MD5
2b71f75534e16d18f532a6dd94f1556f

SHA1
bdfbde06a48730a74ebd0134eadd4595f095f9f3

SHA256
6cbd59f6180decf1032df8bbb82e2da71ced9d33cf12f20473a91ee87c5280d3

SHA512
6a01dee10c16362db589b1cc9cad42141697062b9d510e7f79b9cbbcda41e16276956ec0580d9b945ad2aebeaef0a71c71f871738d128b9b320d8f18982bcd1a

Download Submit
C:\Windows\system\oCfIRJy.exe

Filesize
1.8MB

MD5
f0fb8563e2e5a10f45b74e5670753b8e

SHA1
23b87b3a70587f0aea249df0aadf20e4864d9d73

SHA256
4632882883a04337111a7d9bd8b02fe8b26acdf300c81559c9b46023303e0dc8

SHA512
dede474af9336a6fc663847a266ac79475f12bd11d87658157b8a25100756d63a44405c3235540645b32e107a614225d848255f7a55f0205b2794dbbaad797ca

Download Submit
C:\Windows\system\pDOAdcT.exe

Filesize
1.9MB

MD5
0d6961d4d6be5740b1c3f803614ec54c

SHA1
84c91f548a9f109748ea9f28e24e0497f7eaf059

SHA256
d44192c6820ad6fb38cd348ad535fc157b1d339202d1b064efde91341105c85d

SHA512
27e36e30f67bad4f4ce04b90811065136cde346b67373b379eeae16400fb98b2cd01f5ce16e83367387939b005234c5818346797e15d992e3150fe2cf6ffa89b

Download Submit
C:\Windows\system\psnVfJr.exe

Filesize
1.8MB

MD5
077da236b80c2fe9de2f208895d9cf14

SHA1
8c20fc4a924a11afc17d13b3f2801aa01ec4d882

SHA256
f9d412d30254f37c9fb4955271f07469116d17ad262b9a3540c246f6061448b8

SHA512
ebe63f9924b0ca9541d144e185452319734b2d4d7bd51f6e0d8f758c96a981126941729d75d640f8ee4d97a82547ae55d533a22dff4685c2322878644b37bbdb

Download Submit
C:\Windows\system\vdIkYdw.exe

Filesize
1.8MB

MD5
e2b7501c38e45c8d405fc7e299b4af09

SHA1
a26e01f5bc8d320ec53035cbf0864e9a0ec7f90b

SHA256
514c3d7d7e188b61c6edb59c509acc6cc32e774f9ff484b6e61c76f01248954d

SHA512
c1a0c5da7272548958530a6790edf28b4a1e1e5e206248a4f2c03258757b46be7dc4bd853f4e96cb7aae1a078b13eb7bde26e0f35bd3e01508e15b61ccaefc1a

Download Submit
C:\Windows\system\zotUsDz.exe

Filesize
1.9MB

MD5
ebab2dbd936e736f25e93f4641ae617c

SHA1
f9cdda266c628348a3598be0b834bd4d6be6c21c

SHA256
8be7d4a31d75c698464f0bac32f1e5d555bca317a7b52b11d5b89459795923a8

SHA512
5be82d8e987ac25b30693b9551a8d62d358086afecdd0857ffe260bd52ca14979a52b7238aa50274bc074a43ba41eed4884323e84d5c72eff5c93a4fc4598a8a

Download Submit
\Windows\system\DCDvuuc.exe

Filesize
1.8MB

MD5
420e26b29a1068baee6aaf87cbf4ce0b

SHA1
18963be4cbb27d2125b565cff5ad79d60d50c661

SHA256
389b2829073ba01da7a680f2bcc15889ae277f867424caf0c79e4be74b71a2bf

SHA512
a078dd8e175b2a87744713e1681ebf6bf00cc5ccfc421cf8a6bdc80f9857499f89da0007cfd4969007cd9d6aa4b66bcc00d57e0234875d2c0547237d44dab895

Download Submit
\Windows\system\GLgWglj.exe

Filesize
1.9MB

MD5
ff11e334cb5f7852d7e46de9c79d0375

SHA1
c6e0e2de30ed81537aec3fa313602c556693b75c

SHA256
5a73bcb659e56d0ff79078ab0b49a78ed546808c56d596ef01118d458e33b26d

SHA512
f13f1f48bbba596b9e97b39e5cad62b4e9d64281e8ba90ca610ebde5265579de95b403288eedc569dd22cd9d6020d61005513441d0fc33838fabea5f4f4d61eb

Download Submit
\Windows\system\cRqnwXZ.exe

Filesize
1.8MB

MD5
ccdc2ad4fc2b392d60f7342f99185e8a

SHA1
fbd3753ee1224f2d6a9fe1c6c3a47fe8c13d0999

SHA256
99a195f7066635b7e1e97bf9f2843455ee6da92ee810525cda26265c18a9b135

SHA512
debd322667753be24560b3bc7ad73f08c82bcbf880a178479c10fc07c61a79313383a4def8504361f2d3c172e033e5fb36734dfa35ac8b9c4a997e3394db4df8

Download Submit
\Windows\system\fRFgPVz.exe

Filesize
1.8MB

MD5
b99bf3f70d959a8e2aa3e8369c3dbd0f

SHA1
f9e8327677f508d18c613a4859385cd7d38ec976

SHA256
5686c0d8ace1c1c53f5b7497ce1c385130ec742693eed583881d0b56be58753b

SHA512
147024f37509f9c6e8c14b5a464715f8f1e5f32fba18058ea64381dfaa3ca3f6c9c9bd9ac75c84791d55b732eda8c7ca706e974643a6a7133fd02f3aca937c27

Download Submit
memory/2940-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download