xmrig | 8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0

Analysis

max time kernel
73s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
Size

1.4MB
MD5

776e55b94ce243c8dbde883721f818f8
SHA1

dec1bb8537e9ddead1cc3d88c009a9d9a2b4000b
SHA256

8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0
SHA512

6ac8abcceb84be241d2f952bde677937bf9609536130f9dc05cb28487e7e689fa7fe695642eceb019a6e3de686aec48ba9088a5158005dfa66df59592cc9d310
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLEU4s:GezaTF8FcNkNdfE0pZ9ozttwIRxeq/U

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120fd-2.dat	xmrig
behavioral1/files/0x000700000001939b-6.dat	xmrig
behavioral1/files/0x00070000000193b3-8.dat	xmrig
behavioral1/files/0x00060000000193e8-17.dat	xmrig
behavioral1/files/0x00060000000193f7-22.dat	xmrig
behavioral1/files/0x000600000001949e-27.dat	xmrig
behavioral1/files/0x00080000000194cd-31.dat	xmrig
behavioral1/files/0x00060000000194d2-36.dat	xmrig
behavioral1/files/0x000500000001a4bb-155.dat	xmrig
behavioral1/files/0x000500000001a4b7-145.dat	xmrig
behavioral1/files/0x000500000001a4bd-159.dat	xmrig
behavioral1/files/0x000500000001a4b9-149.dat	xmrig
behavioral1/files/0x000500000001a4b3-134.dat	xmrig
behavioral1/files/0x000500000001a4b5-139.dat	xmrig
behavioral1/files/0x000500000001a4af-124.dat	xmrig
behavioral1/files/0x000500000001a4b1-130.dat	xmrig
behavioral1/files/0x000500000001a4a9-119.dat	xmrig
behavioral1/files/0x000500000001a49a-114.dat	xmrig
behavioral1/files/0x000500000001a499-110.dat	xmrig
behavioral1/files/0x000500000001a48d-104.dat	xmrig
behavioral1/files/0x000500000001a48b-99.dat	xmrig
behavioral1/files/0x000500000001a46f-94.dat	xmrig
behavioral1/files/0x000500000001a42d-89.dat	xmrig
behavioral1/files/0x000500000001a427-84.dat	xmrig
behavioral1/files/0x000500000001a41e-79.dat	xmrig
behavioral1/files/0x000500000001a41d-75.dat	xmrig
behavioral1/files/0x000500000001a41b-68.dat	xmrig
behavioral1/files/0x000500000001a359-63.dat	xmrig
behavioral1/files/0x000500000001a307-58.dat	xmrig
behavioral1/files/0x003200000001930d-53.dat	xmrig
behavioral1/files/0x000500000001a09e-49.dat	xmrig
behavioral1/files/0x000600000001954e-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1832	XSEQzKu.exe
2696	YaDVZfw.exe
1388	tBfbwOT.exe
2808	FLjNwUb.exe
2812	oqnrfOP.exe
2736	tjpzNiA.exe
2720	dgyqkLn.exe
2836	RtHkddl.exe
3016	DEVouIU.exe
2652	DSNCrkS.exe
2604	DwcDLQu.exe
2668	OoXShlw.exe
1092	YVlRRKC.exe
2292	pxAmisY.exe
2012	zzVXXoB.exe
2068	dvWGfHC.exe
2072	KvcAZOR.exe
2308	GhZLOdc.exe
1992	KFUseac.exe
2588	jhDfFrs.exe
1556	ckAkMKE.exe
2876	mlxistY.exe
2644	ghpdSEP.exe
1060	ADRdOmi.exe
1516	KBeYmlB.exe
272	slNtLdC.exe
2172	cAKiCXM.exe
2164	bOpmnQK.exe
2384	IteawYE.exe
2332	VRKqzhk.exe
1932	lIhkvZw.exe
764	UhsxOLH.exe
1940	UGZnbDM.exe
1672	RdQhFOn.exe
2500	nFZlcPr.exe
1808	NmLDuSB.exe
1508	XaGLNBI.exe
2080	nShcQfs.exe
2400	zLNcTYh.exe
472	qWxqneq.exe
2084	JYUOUvV.exe
1548	CGOcloj.exe
236	ONWJTWO.exe
1748	XyhNdgq.exe
1740	nPiNiLd.exe
1968	sVlrLwH.exe
1796	EzHjvQw.exe
944	fnBidmc.exe
3056	ILENbTd.exe
3008	VFVPnsc.exe
796	cPWEXUX.exe
2320	NZbkPLR.exe
984	pKcWhHy.exe
2992	BMPoSeL.exe
892	TDfAFTE.exe
2344	zOabYAp.exe
1592	shzRNon.exe
1704	DDXsCij.exe
1016	IiBBVqT.exe
2100	EFcwMsc.exe
2828	NIiTQBp.exe
2848	qIqLbQV.exe
2108	TcGGltm.exe
2748	UoFfghS.exe

Loads dropped DLL 64 IoCs

pid	Process
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wkJOByA.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\NaqRGWo.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\VgJISBm.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\sfRdaQk.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\jNmXCqd.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\PzbdCBx.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\DvmhDtX.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\gLmTeHv.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\TAZJdAN.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\PiVoPyY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\DGLKblY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\gNqzgFR.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\aepWFjt.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\bcxMldW.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\DQJvMHz.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ghqjTfL.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\EuQGBHv.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ZeoiLdm.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\yYFYDfX.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\FLjNwUb.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\jneMhHD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\aUYIgPk.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\rPLCmsv.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\BHzpyIm.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\zpjfFKl.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\nobHtOc.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\BrcnoGa.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\dWgglPV.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ogoFsJE.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\XOOFfsj.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ujjciHY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\NIiTQBp.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\xXfDzny.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\tsKtcZg.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\nGCRyCE.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\jaSyTGS.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\TNWqNxq.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\BnottAz.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\pByyEMD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ObMpvgp.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\msjjsXI.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\PmtXhkH.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\EcmarAI.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\EKsiKxo.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\sfKjmnt.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\TuuNsAw.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ruiNMHE.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\Irrzutc.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ZLIGAsC.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\sVlrLwH.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fjZTwex.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\CMCwgRC.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\qMGDPMb.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\qwGdGHE.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\YVlRRKC.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\AncInUS.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\YgdMvnX.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\tmAUbAN.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ItnLlHl.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fGRSJCn.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\DqQCrTM.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\oRyiKAJ.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\PMdPJlD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\lWqYnlA.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1832	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	30
PID 2540 wrote to memory of 1832	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	30
PID 2540 wrote to memory of 1832	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	30
PID 2540 wrote to memory of 2696	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	31
PID 2540 wrote to memory of 2696	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	31
PID 2540 wrote to memory of 2696	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	31
PID 2540 wrote to memory of 1388	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	32
PID 2540 wrote to memory of 1388	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	32
PID 2540 wrote to memory of 1388	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	32
PID 2540 wrote to memory of 2808	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	33
PID 2540 wrote to memory of 2808	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	33
PID 2540 wrote to memory of 2808	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	33
PID 2540 wrote to memory of 2812	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	34
PID 2540 wrote to memory of 2812	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	34
PID 2540 wrote to memory of 2812	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	34
PID 2540 wrote to memory of 2736	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	35
PID 2540 wrote to memory of 2736	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	35
PID 2540 wrote to memory of 2736	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	35
PID 2540 wrote to memory of 2720	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	36
PID 2540 wrote to memory of 2720	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	36
PID 2540 wrote to memory of 2720	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	36
PID 2540 wrote to memory of 2836	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	37
PID 2540 wrote to memory of 2836	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	37
PID 2540 wrote to memory of 2836	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	37
PID 2540 wrote to memory of 3016	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	38
PID 2540 wrote to memory of 3016	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	38
PID 2540 wrote to memory of 3016	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	38
PID 2540 wrote to memory of 2652	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	39
PID 2540 wrote to memory of 2652	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	39
PID 2540 wrote to memory of 2652	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	39
PID 2540 wrote to memory of 2604	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	40
PID 2540 wrote to memory of 2604	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	40
PID 2540 wrote to memory of 2604	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	40
PID 2540 wrote to memory of 2668	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	41
PID 2540 wrote to memory of 2668	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	41
PID 2540 wrote to memory of 2668	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	41
PID 2540 wrote to memory of 1092	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	42
PID 2540 wrote to memory of 1092	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	42
PID 2540 wrote to memory of 1092	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	42
PID 2540 wrote to memory of 2292	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	43
PID 2540 wrote to memory of 2292	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	43
PID 2540 wrote to memory of 2292	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	43
PID 2540 wrote to memory of 2012	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	44
PID 2540 wrote to memory of 2012	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	44
PID 2540 wrote to memory of 2012	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	44
PID 2540 wrote to memory of 2068	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	45
PID 2540 wrote to memory of 2068	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	45
PID 2540 wrote to memory of 2068	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	45
PID 2540 wrote to memory of 2072	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	46
PID 2540 wrote to memory of 2072	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	46
PID 2540 wrote to memory of 2072	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	46
PID 2540 wrote to memory of 2308	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	47
PID 2540 wrote to memory of 2308	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	47
PID 2540 wrote to memory of 2308	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	47
PID 2540 wrote to memory of 1992	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	48
PID 2540 wrote to memory of 1992	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	48
PID 2540 wrote to memory of 1992	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	48
PID 2540 wrote to memory of 2588	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	49
PID 2540 wrote to memory of 2588	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	49
PID 2540 wrote to memory of 2588	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	49
PID 2540 wrote to memory of 1556	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	50
PID 2540 wrote to memory of 1556	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	50
PID 2540 wrote to memory of 1556	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	50
PID 2540 wrote to memory of 2876	2540	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	51

C:\Users\Admin\AppData\Local\Temp\8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
"C:\Users\Admin\AppData\Local\Temp\8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System\XSEQzKu.exe
  C:\Windows\System\XSEQzKu.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\YaDVZfw.exe
  C:\Windows\System\YaDVZfw.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\tBfbwOT.exe
  C:\Windows\System\tBfbwOT.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\FLjNwUb.exe
  C:\Windows\System\FLjNwUb.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\oqnrfOP.exe
  C:\Windows\System\oqnrfOP.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\tjpzNiA.exe
  C:\Windows\System\tjpzNiA.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\dgyqkLn.exe
  C:\Windows\System\dgyqkLn.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\RtHkddl.exe
  C:\Windows\System\RtHkddl.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\DEVouIU.exe
  C:\Windows\System\DEVouIU.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\DSNCrkS.exe
  C:\Windows\System\DSNCrkS.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\DwcDLQu.exe
  C:\Windows\System\DwcDLQu.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\OoXShlw.exe
  C:\Windows\System\OoXShlw.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\YVlRRKC.exe
  C:\Windows\System\YVlRRKC.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\pxAmisY.exe
  C:\Windows\System\pxAmisY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zzVXXoB.exe
  C:\Windows\System\zzVXXoB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\dvWGfHC.exe
  C:\Windows\System\dvWGfHC.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\KvcAZOR.exe
  C:\Windows\System\KvcAZOR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GhZLOdc.exe
  C:\Windows\System\GhZLOdc.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\KFUseac.exe
  C:\Windows\System\KFUseac.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\jhDfFrs.exe
  C:\Windows\System\jhDfFrs.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ckAkMKE.exe
  C:\Windows\System\ckAkMKE.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\mlxistY.exe
  C:\Windows\System\mlxistY.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ghpdSEP.exe
  C:\Windows\System\ghpdSEP.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ADRdOmi.exe
  C:\Windows\System\ADRdOmi.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\KBeYmlB.exe
  C:\Windows\System\KBeYmlB.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\slNtLdC.exe
  C:\Windows\System\slNtLdC.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\cAKiCXM.exe
  C:\Windows\System\cAKiCXM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\bOpmnQK.exe
  C:\Windows\System\bOpmnQK.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\IteawYE.exe
  C:\Windows\System\IteawYE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\VRKqzhk.exe
  C:\Windows\System\VRKqzhk.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\lIhkvZw.exe
  C:\Windows\System\lIhkvZw.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\UhsxOLH.exe
  C:\Windows\System\UhsxOLH.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\UGZnbDM.exe
  C:\Windows\System\UGZnbDM.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\RdQhFOn.exe
  C:\Windows\System\RdQhFOn.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\nFZlcPr.exe
  C:\Windows\System\nFZlcPr.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\NmLDuSB.exe
  C:\Windows\System\NmLDuSB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\XaGLNBI.exe
  C:\Windows\System\XaGLNBI.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\nShcQfs.exe
  C:\Windows\System\nShcQfs.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\zLNcTYh.exe
  C:\Windows\System\zLNcTYh.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\qWxqneq.exe
  C:\Windows\System\qWxqneq.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\JYUOUvV.exe
  C:\Windows\System\JYUOUvV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\CGOcloj.exe
  C:\Windows\System\CGOcloj.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\ONWJTWO.exe
  C:\Windows\System\ONWJTWO.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\XyhNdgq.exe
  C:\Windows\System\XyhNdgq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\nPiNiLd.exe
  C:\Windows\System\nPiNiLd.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\sVlrLwH.exe
  C:\Windows\System\sVlrLwH.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\EzHjvQw.exe
  C:\Windows\System\EzHjvQw.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fnBidmc.exe
  C:\Windows\System\fnBidmc.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ILENbTd.exe
  C:\Windows\System\ILENbTd.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\VFVPnsc.exe
  C:\Windows\System\VFVPnsc.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\cPWEXUX.exe
  C:\Windows\System\cPWEXUX.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\NZbkPLR.exe
  C:\Windows\System\NZbkPLR.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\pKcWhHy.exe
  C:\Windows\System\pKcWhHy.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\BMPoSeL.exe
  C:\Windows\System\BMPoSeL.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\TDfAFTE.exe
  C:\Windows\System\TDfAFTE.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\zOabYAp.exe
  C:\Windows\System\zOabYAp.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\shzRNon.exe
  C:\Windows\System\shzRNon.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\DDXsCij.exe
  C:\Windows\System\DDXsCij.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\IiBBVqT.exe
  C:\Windows\System\IiBBVqT.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\EFcwMsc.exe
  C:\Windows\System\EFcwMsc.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\NIiTQBp.exe
  C:\Windows\System\NIiTQBp.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\qIqLbQV.exe
  C:\Windows\System\qIqLbQV.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\TcGGltm.exe
  C:\Windows\System\TcGGltm.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\UoFfghS.exe
  C:\Windows\System\UoFfghS.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ULeLtNw.exe
  C:\Windows\System\ULeLtNw.exe
  2⤵
  PID:2832
- C:\Windows\System\fyceHXJ.exe
  C:\Windows\System\fyceHXJ.exe
  2⤵
  PID:2916
- C:\Windows\System\nLuxGXc.exe
  C:\Windows\System\nLuxGXc.exe
  2⤵
  PID:2784
- C:\Windows\System\ZeyWbWl.exe
  C:\Windows\System\ZeyWbWl.exe
  2⤵
  PID:2648
- C:\Windows\System\LExHDQp.exe
  C:\Windows\System\LExHDQp.exe
  2⤵
  PID:2088
- C:\Windows\System\RrEhoaC.exe
  C:\Windows\System\RrEhoaC.exe
  2⤵
  PID:2896
- C:\Windows\System\bOyPEZo.exe
  C:\Windows\System\bOyPEZo.exe
  2⤵
  PID:2272
- C:\Windows\System\CoEsXfD.exe
  C:\Windows\System\CoEsXfD.exe
  2⤵
  PID:2452
- C:\Windows\System\AdULlkh.exe
  C:\Windows\System\AdULlkh.exe
  2⤵
  PID:1624
- C:\Windows\System\wupwgIm.exe
  C:\Windows\System\wupwgIm.exe
  2⤵
  PID:1820
- C:\Windows\System\GwKQXqh.exe
  C:\Windows\System\GwKQXqh.exe
  2⤵
  PID:2028
- C:\Windows\System\xEuoetp.exe
  C:\Windows\System\xEuoetp.exe
  2⤵
  PID:316
- C:\Windows\System\PgJbmJB.exe
  C:\Windows\System\PgJbmJB.exe
  2⤵
  PID:2864
- C:\Windows\System\AIOGKyl.exe
  C:\Windows\System\AIOGKyl.exe
  2⤵
  PID:2392
- C:\Windows\System\biWeDbz.exe
  C:\Windows\System\biWeDbz.exe
  2⤵
  PID:880
- C:\Windows\System\YSvYFEE.exe
  C:\Windows\System\YSvYFEE.exe
  2⤵
  PID:2208
- C:\Windows\System\vubJikG.exe
  C:\Windows\System\vubJikG.exe
  2⤵
  PID:2436
- C:\Windows\System\AsRZawP.exe
  C:\Windows\System\AsRZawP.exe
  2⤵
  PID:1964
- C:\Windows\System\CcknzXs.exe
  C:\Windows\System\CcknzXs.exe
  2⤵
  PID:620
- C:\Windows\System\hMUMeqL.exe
  C:\Windows\System\hMUMeqL.exe
  2⤵
  PID:1200
- C:\Windows\System\wAwdwDq.exe
  C:\Windows\System\wAwdwDq.exe
  2⤵
  PID:2408
- C:\Windows\System\xrIRrbp.exe
  C:\Windows\System\xrIRrbp.exe
  2⤵
  PID:2376
- C:\Windows\System\HnWFHdV.exe
  C:\Windows\System\HnWFHdV.exe
  2⤵
  PID:1628
- C:\Windows\System\oyBriAR.exe
  C:\Windows\System\oyBriAR.exe
  2⤵
  PID:1712
- C:\Windows\System\sxratZK.exe
  C:\Windows\System\sxratZK.exe
  2⤵
  PID:1224
- C:\Windows\System\YhpbaNk.exe
  C:\Windows\System\YhpbaNk.exe
  2⤵
  PID:1784
- C:\Windows\System\nDAvddh.exe
  C:\Windows\System\nDAvddh.exe
  2⤵
  PID:1540
- C:\Windows\System\sqhHEIi.exe
  C:\Windows\System\sqhHEIi.exe
  2⤵
  PID:540
- C:\Windows\System\afJvnrc.exe
  C:\Windows\System\afJvnrc.exe
  2⤵
  PID:3060
- C:\Windows\System\xbyQznc.exe
  C:\Windows\System\xbyQznc.exe
  2⤵
  PID:2148
- C:\Windows\System\pyrZhDC.exe
  C:\Windows\System\pyrZhDC.exe
  2⤵
  PID:2144
- C:\Windows\System\ljgchgV.exe
  C:\Windows\System\ljgchgV.exe
  2⤵
  PID:2524
- C:\Windows\System\DRncFei.exe
  C:\Windows\System\DRncFei.exe
  2⤵
  PID:704
- C:\Windows\System\YZloYet.exe
  C:\Windows\System\YZloYet.exe
  2⤵
  PID:1716
- C:\Windows\System\WXIegIN.exe
  C:\Windows\System\WXIegIN.exe
  2⤵
  PID:2752
- C:\Windows\System\UIdamIv.exe
  C:\Windows\System\UIdamIv.exe
  2⤵
  PID:2288
- C:\Windows\System\AuCEcOh.exe
  C:\Windows\System\AuCEcOh.exe
  2⤵
  PID:2944
- C:\Windows\System\JFPGXqj.exe
  C:\Windows\System\JFPGXqj.exe
  2⤵
  PID:2800
- C:\Windows\System\dBlReGg.exe
  C:\Windows\System\dBlReGg.exe
  2⤵
  PID:2580
- C:\Windows\System\ayaFCpi.exe
  C:\Windows\System\ayaFCpi.exe
  2⤵
  PID:2772
- C:\Windows\System\XRMEOox.exe
  C:\Windows\System\XRMEOox.exe
  2⤵
  PID:2620
- C:\Windows\System\tMwjkjG.exe
  C:\Windows\System\tMwjkjG.exe
  2⤵
  PID:268
- C:\Windows\System\gLmTeHv.exe
  C:\Windows\System\gLmTeHv.exe
  2⤵
  PID:2252
- C:\Windows\System\fjZTwex.exe
  C:\Windows\System\fjZTwex.exe
  2⤵
  PID:2920
- C:\Windows\System\xaqCIuy.exe
  C:\Windows\System\xaqCIuy.exe
  2⤵
  PID:3032
- C:\Windows\System\ntIqsAK.exe
  C:\Windows\System\ntIqsAK.exe
  2⤵
  PID:2692
- C:\Windows\System\DprLjrP.exe
  C:\Windows\System\DprLjrP.exe
  2⤵
  PID:956
- C:\Windows\System\gQhwDGh.exe
  C:\Windows\System\gQhwDGh.exe
  2⤵
  PID:568
- C:\Windows\System\AJrbtZz.exe
  C:\Windows\System\AJrbtZz.exe
  2⤵
  PID:992
- C:\Windows\System\fntDvcg.exe
  C:\Windows\System\fntDvcg.exe
  2⤵
  PID:2280
- C:\Windows\System\UtmImXQ.exe
  C:\Windows\System\UtmImXQ.exe
  2⤵
  PID:2104
- C:\Windows\System\SXAOEVB.exe
  C:\Windows\System\SXAOEVB.exe
  2⤵
  PID:2420
- C:\Windows\System\nobHtOc.exe
  C:\Windows\System\nobHtOc.exe
  2⤵
  PID:2560
- C:\Windows\System\TuuNsAw.exe
  C:\Windows\System\TuuNsAw.exe
  2⤵
  PID:648
- C:\Windows\System\rBBPDec.exe
  C:\Windows\System\rBBPDec.exe
  2⤵
  PID:3052
- C:\Windows\System\DICMVOy.exe
  C:\Windows\System\DICMVOy.exe
  2⤵
  PID:1444
- C:\Windows\System\fepevqr.exe
  C:\Windows\System\fepevqr.exe
  2⤵
  PID:768
- C:\Windows\System\mhBeMZh.exe
  C:\Windows\System\mhBeMZh.exe
  2⤵
  PID:928
- C:\Windows\System\qfmuysY.exe
  C:\Windows\System\qfmuysY.exe
  2⤵
  PID:1700
- C:\Windows\System\ttWkSeU.exe
  C:\Windows\System\ttWkSeU.exe
  2⤵
  PID:2336
- C:\Windows\System\DxiGsFH.exe
  C:\Windows\System\DxiGsFH.exe
  2⤵
  PID:1504
- C:\Windows\System\aLkdMYY.exe
  C:\Windows\System\aLkdMYY.exe
  2⤵
  PID:3064
- C:\Windows\System\uFEscDw.exe
  C:\Windows\System\uFEscDw.exe
  2⤵
  PID:2960
- C:\Windows\System\vTvSaso.exe
  C:\Windows\System\vTvSaso.exe
  2⤵
  PID:572
- C:\Windows\System\axLtEln.exe
  C:\Windows\System\axLtEln.exe
  2⤵
  PID:2948
- C:\Windows\System\zNNfjca.exe
  C:\Windows\System\zNNfjca.exe
  2⤵
  PID:3044
- C:\Windows\System\CFWkGgH.exe
  C:\Windows\System\CFWkGgH.exe
  2⤵
  PID:2636
- C:\Windows\System\WzUWbks.exe
  C:\Windows\System\WzUWbks.exe
  2⤵
  PID:2576
- C:\Windows\System\aGdIlAy.exe
  C:\Windows\System\aGdIlAy.exe
  2⤵
  PID:1768
- C:\Windows\System\GxyZoEB.exe
  C:\Windows\System\GxyZoEB.exe
  2⤵
  PID:2792
- C:\Windows\System\WZUjJRO.exe
  C:\Windows\System\WZUjJRO.exe
  2⤵
  PID:444
- C:\Windows\System\DIhNIvk.exe
  C:\Windows\System\DIhNIvk.exe
  2⤵
  PID:2220
- C:\Windows\System\eTZcZIU.exe
  C:\Windows\System\eTZcZIU.exe
  2⤵
  PID:1696
- C:\Windows\System\RpmDmuR.exe
  C:\Windows\System\RpmDmuR.exe
  2⤵
  PID:2020
- C:\Windows\System\WvVadla.exe
  C:\Windows\System\WvVadla.exe
  2⤵
  PID:2284
- C:\Windows\System\fWrVfca.exe
  C:\Windows\System\fWrVfca.exe
  2⤵
  PID:1612
- C:\Windows\System\JKmiOCz.exe
  C:\Windows\System\JKmiOCz.exe
  2⤵
  PID:2112
- C:\Windows\System\UdzYuQS.exe
  C:\Windows\System\UdzYuQS.exe
  2⤵
  PID:3036
- C:\Windows\System\VoyjfCH.exe
  C:\Windows\System\VoyjfCH.exe
  2⤵
  PID:1012
- C:\Windows\System\AlNGiIZ.exe
  C:\Windows\System\AlNGiIZ.exe
  2⤵
  PID:2228
- C:\Windows\System\zPJZfCk.exe
  C:\Windows\System\zPJZfCk.exe
  2⤵
  PID:3012
- C:\Windows\System\LKedDBl.exe
  C:\Windows\System\LKedDBl.exe
  2⤵
  PID:2508
- C:\Windows\System\qiRCXjT.exe
  C:\Windows\System\qiRCXjT.exe
  2⤵
  PID:1760
- C:\Windows\System\BxxPbQn.exe
  C:\Windows\System\BxxPbQn.exe
  2⤵
  PID:3020
- C:\Windows\System\lrRbnts.exe
  C:\Windows\System\lrRbnts.exe
  2⤵
  PID:1588
- C:\Windows\System\zEPTldE.exe
  C:\Windows\System\zEPTldE.exe
  2⤵
  PID:1148
- C:\Windows\System\QuCvLJT.exe
  C:\Windows\System\QuCvLJT.exe
  2⤵
  PID:2912
- C:\Windows\System\wkJOByA.exe
  C:\Windows\System\wkJOByA.exe
  2⤵
  PID:2060
- C:\Windows\System\ZPmiFEw.exe
  C:\Windows\System\ZPmiFEw.exe
  2⤵
  PID:844
- C:\Windows\System\NZrVTXK.exe
  C:\Windows\System\NZrVTXK.exe
  2⤵
  PID:1436
- C:\Windows\System\DSXApCF.exe
  C:\Windows\System\DSXApCF.exe
  2⤵
  PID:936
- C:\Windows\System\Dbszgvk.exe
  C:\Windows\System\Dbszgvk.exe
  2⤵
  PID:2268
- C:\Windows\System\oQCYIbt.exe
  C:\Windows\System\oQCYIbt.exe
  2⤵
  PID:876
- C:\Windows\System\yjwtHRq.exe
  C:\Windows\System\yjwtHRq.exe
  2⤵
  PID:2908
- C:\Windows\System\PecIARU.exe
  C:\Windows\System\PecIARU.exe
  2⤵
  PID:2592
- C:\Windows\System\vwQAmqX.exe
  C:\Windows\System\vwQAmqX.exe
  2⤵
  PID:1580
- C:\Windows\System\tCcnAxG.exe
  C:\Windows\System\tCcnAxG.exe
  2⤵
  PID:344
- C:\Windows\System\QsvnaoP.exe
  C:\Windows\System\QsvnaoP.exe
  2⤵
  PID:2520
- C:\Windows\System\VMtXBDa.exe
  C:\Windows\System\VMtXBDa.exe
  2⤵
  PID:1600
- C:\Windows\System\tLyzKJa.exe
  C:\Windows\System\tLyzKJa.exe
  2⤵
  PID:2448
- C:\Windows\System\ZuoxNMy.exe
  C:\Windows\System\ZuoxNMy.exe
  2⤵
  PID:1728
- C:\Windows\System\yOUQXxS.exe
  C:\Windows\System\yOUQXxS.exe
  2⤵
  PID:3084
- C:\Windows\System\WJtgUtl.exe
  C:\Windows\System\WJtgUtl.exe
  2⤵
  PID:3108
- C:\Windows\System\PNQUwpc.exe
  C:\Windows\System\PNQUwpc.exe
  2⤵
  PID:3124
- C:\Windows\System\rAnlruq.exe
  C:\Windows\System\rAnlruq.exe
  2⤵
  PID:3140
- C:\Windows\System\HNHCqDh.exe
  C:\Windows\System\HNHCqDh.exe
  2⤵
  PID:3156
- C:\Windows\System\tYUeLBY.exe
  C:\Windows\System\tYUeLBY.exe
  2⤵
  PID:3172
- C:\Windows\System\NakjzbR.exe
  C:\Windows\System\NakjzbR.exe
  2⤵
  PID:3188
- C:\Windows\System\AYobAkm.exe
  C:\Windows\System\AYobAkm.exe
  2⤵
  PID:3212
- C:\Windows\System\dHXkiwu.exe
  C:\Windows\System\dHXkiwu.exe
  2⤵
  PID:3240
- C:\Windows\System\MuXWbeD.exe
  C:\Windows\System\MuXWbeD.exe
  2⤵
  PID:3268
- C:\Windows\System\WhmCnxO.exe
  C:\Windows\System\WhmCnxO.exe
  2⤵
  PID:3300
- C:\Windows\System\GlVUmjV.exe
  C:\Windows\System\GlVUmjV.exe
  2⤵
  PID:3324
- C:\Windows\System\ydPxOWI.exe
  C:\Windows\System\ydPxOWI.exe
  2⤵
  PID:3340
- C:\Windows\System\wYwGPbp.exe
  C:\Windows\System\wYwGPbp.exe
  2⤵
  PID:3356
- C:\Windows\System\ZTUHVUl.exe
  C:\Windows\System\ZTUHVUl.exe
  2⤵
  PID:3372
- C:\Windows\System\iKzZjfi.exe
  C:\Windows\System\iKzZjfi.exe
  2⤵
  PID:3388
- C:\Windows\System\shpITFD.exe
  C:\Windows\System\shpITFD.exe
  2⤵
  PID:3404
- C:\Windows\System\ZJnRCQF.exe
  C:\Windows\System\ZJnRCQF.exe
  2⤵
  PID:3420
- C:\Windows\System\javiEqu.exe
  C:\Windows\System\javiEqu.exe
  2⤵
  PID:3436
- C:\Windows\System\NFahFDE.exe
  C:\Windows\System\NFahFDE.exe
  2⤵
  PID:3452
- C:\Windows\System\lCZQVKu.exe
  C:\Windows\System\lCZQVKu.exe
  2⤵
  PID:3472
- C:\Windows\System\sYvQOfs.exe
  C:\Windows\System\sYvQOfs.exe
  2⤵
  PID:3496
- C:\Windows\System\dXvjBvY.exe
  C:\Windows\System\dXvjBvY.exe
  2⤵
  PID:3520
- C:\Windows\System\hPaVKCd.exe
  C:\Windows\System\hPaVKCd.exe
  2⤵
  PID:3540
- C:\Windows\System\ZkweiQh.exe
  C:\Windows\System\ZkweiQh.exe
  2⤵
  PID:3556
- C:\Windows\System\kAIVzBj.exe
  C:\Windows\System\kAIVzBj.exe
  2⤵
  PID:3572
- C:\Windows\System\DGfeqRa.exe
  C:\Windows\System\DGfeqRa.exe
  2⤵
  PID:3588
- C:\Windows\System\TtsSynD.exe
  C:\Windows\System\TtsSynD.exe
  2⤵
  PID:3604
- C:\Windows\System\mUwdlvJ.exe
  C:\Windows\System\mUwdlvJ.exe
  2⤵
  PID:3620
- C:\Windows\System\yWbDcYZ.exe
  C:\Windows\System\yWbDcYZ.exe
  2⤵
  PID:3680
- C:\Windows\System\SdZdPpv.exe
  C:\Windows\System\SdZdPpv.exe
  2⤵
  PID:3704
- C:\Windows\System\NLpCBaG.exe
  C:\Windows\System\NLpCBaG.exe
  2⤵
  PID:3720
- C:\Windows\System\hArLAjK.exe
  C:\Windows\System\hArLAjK.exe
  2⤵
  PID:3736
- C:\Windows\System\UeFGhix.exe
  C:\Windows\System\UeFGhix.exe
  2⤵
  PID:3752
- C:\Windows\System\QLsfbAQ.exe
  C:\Windows\System\QLsfbAQ.exe
  2⤵
  PID:3768
- C:\Windows\System\jneMhHD.exe
  C:\Windows\System\jneMhHD.exe
  2⤵
  PID:3784
- C:\Windows\System\VkQPzly.exe
  C:\Windows\System\VkQPzly.exe
  2⤵
  PID:3808
- C:\Windows\System\eGUdFnz.exe
  C:\Windows\System\eGUdFnz.exe
  2⤵
  PID:3824
- C:\Windows\System\OCkNgXx.exe
  C:\Windows\System\OCkNgXx.exe
  2⤵
  PID:3840
- C:\Windows\System\UoICDox.exe
  C:\Windows\System\UoICDox.exe
  2⤵
  PID:3860
- C:\Windows\System\WDvSySt.exe
  C:\Windows\System\WDvSySt.exe
  2⤵
  PID:3876
- C:\Windows\System\lXOHfFn.exe
  C:\Windows\System\lXOHfFn.exe
  2⤵
  PID:3896
- C:\Windows\System\HkphptJ.exe
  C:\Windows\System\HkphptJ.exe
  2⤵
  PID:3912
- C:\Windows\System\AOWXhsD.exe
  C:\Windows\System\AOWXhsD.exe
  2⤵
  PID:3932
- C:\Windows\System\lkkBHny.exe
  C:\Windows\System\lkkBHny.exe
  2⤵
  PID:3948
- C:\Windows\System\qdYZtLi.exe
  C:\Windows\System\qdYZtLi.exe
  2⤵
  PID:3964
- C:\Windows\System\LIdNUvI.exe
  C:\Windows\System\LIdNUvI.exe
  2⤵
  PID:3984
- C:\Windows\System\TbgqsZd.exe
  C:\Windows\System\TbgqsZd.exe
  2⤵
  PID:4000
- C:\Windows\System\PlkfwWv.exe
  C:\Windows\System\PlkfwWv.exe
  2⤵
  PID:4020
- C:\Windows\System\XaNJEyu.exe
  C:\Windows\System\XaNJEyu.exe
  2⤵
  PID:4036
- C:\Windows\System\gaLmxzO.exe
  C:\Windows\System\gaLmxzO.exe
  2⤵
  PID:4052
- C:\Windows\System\DfZBJDk.exe
  C:\Windows\System\DfZBJDk.exe
  2⤵
  PID:4076
- C:\Windows\System\OAFMKSq.exe
  C:\Windows\System\OAFMKSq.exe
  2⤵
  PID:4092
- C:\Windows\System\bpHuAjk.exe
  C:\Windows\System\bpHuAjk.exe
  2⤵
  PID:2860
- C:\Windows\System\kizRxqX.exe
  C:\Windows\System\kizRxqX.exe
  2⤵
  PID:3100
- C:\Windows\System\WtzaLxE.exe
  C:\Windows\System\WtzaLxE.exe
  2⤵
  PID:3164
- C:\Windows\System\SRiRvrp.exe
  C:\Windows\System\SRiRvrp.exe
  2⤵
  PID:3148
- C:\Windows\System\kPsifKA.exe
  C:\Windows\System\kPsifKA.exe
  2⤵
  PID:2760
- C:\Windows\System\EcqwZtk.exe
  C:\Windows\System\EcqwZtk.exe
  2⤵
  PID:3080
- C:\Windows\System\dNQdTIO.exe
  C:\Windows\System\dNQdTIO.exe
  2⤵
  PID:3180
- C:\Windows\System\nrTjFMk.exe
  C:\Windows\System\nrTjFMk.exe
  2⤵
  PID:3252
- C:\Windows\System\kdzpsHy.exe
  C:\Windows\System\kdzpsHy.exe
  2⤵
  PID:3412
- C:\Windows\System\XobLaGT.exe
  C:\Windows\System\XobLaGT.exe
  2⤵
  PID:3480
- C:\Windows\System\OBHCJEy.exe
  C:\Windows\System\OBHCJEy.exe
  2⤵
  PID:3536
- C:\Windows\System\YgdMvnX.exe
  C:\Windows\System\YgdMvnX.exe
  2⤵
  PID:3396
- C:\Windows\System\FTsGnvj.exe
  C:\Windows\System\FTsGnvj.exe
  2⤵
  PID:3600
- C:\Windows\System\UUDEkLG.exe
  C:\Windows\System\UUDEkLG.exe
  2⤵
  PID:3640
- C:\Windows\System\AhipFTj.exe
  C:\Windows\System\AhipFTj.exe
  2⤵
  PID:3644
- C:\Windows\System\iSIeuxS.exe
  C:\Windows\System\iSIeuxS.exe
  2⤵
  PID:3468
- C:\Windows\System\jJypfGk.exe
  C:\Windows\System\jJypfGk.exe
  2⤵
  PID:3516
- C:\Windows\System\ZmKiaAe.exe
  C:\Windows\System\ZmKiaAe.exe
  2⤵
  PID:3672
- C:\Windows\System\ziTNXrg.exe
  C:\Windows\System\ziTNXrg.exe
  2⤵
  PID:3744
- C:\Windows\System\sygVkDD.exe
  C:\Windows\System\sygVkDD.exe
  2⤵
  PID:3848
- C:\Windows\System\TfyAnos.exe
  C:\Windows\System\TfyAnos.exe
  2⤵
  PID:3856
- C:\Windows\System\MGoSRBe.exe
  C:\Windows\System\MGoSRBe.exe
  2⤵
  PID:3924
- C:\Windows\System\byiwMxl.exe
  C:\Windows\System\byiwMxl.exe
  2⤵
  PID:3996
- C:\Windows\System\lblbXMH.exe
  C:\Windows\System\lblbXMH.exe
  2⤵
  PID:4064
- C:\Windows\System\ktnkiop.exe
  C:\Windows\System\ktnkiop.exe
  2⤵
  PID:2660
- C:\Windows\System\XQXybOr.exe
  C:\Windows\System\XQXybOr.exe
  2⤵
  PID:3120
- C:\Windows\System\CHgITGC.exe
  C:\Windows\System\CHgITGC.exe
  2⤵
  PID:3308
- C:\Windows\System\neeJeCL.exe
  C:\Windows\System\neeJeCL.exe
  2⤵
  PID:3796
- C:\Windows\System\WyUiZab.exe
  C:\Windows\System\WyUiZab.exe
  2⤵
  PID:3692
- C:\Windows\System\zMuImrq.exe
  C:\Windows\System\zMuImrq.exe
  2⤵
  PID:2216
- C:\Windows\System\cBOQGwu.exe
  C:\Windows\System\cBOQGwu.exe
  2⤵
  PID:3200
- C:\Windows\System\oDOTrQa.exe
  C:\Windows\System\oDOTrQa.exe
  2⤵
  PID:2700
- C:\Windows\System\iBuyoLb.exe
  C:\Windows\System\iBuyoLb.exe
  2⤵
  PID:3728
- C:\Windows\System\PzrFQnB.exe
  C:\Windows\System\PzrFQnB.exe
  2⤵
  PID:3800
- C:\Windows\System\OHhxSsl.exe
  C:\Windows\System\OHhxSsl.exe
  2⤵
  PID:3760
- C:\Windows\System\irLRoDm.exe
  C:\Windows\System\irLRoDm.exe
  2⤵
  PID:3976
- C:\Windows\System\vYsQOCQ.exe
  C:\Windows\System\vYsQOCQ.exe
  2⤵
  PID:4048
- C:\Windows\System\vwXKAnm.exe
  C:\Windows\System\vwXKAnm.exe
  2⤵
  PID:3980
- C:\Windows\System\yLItBSU.exe
  C:\Windows\System\yLItBSU.exe
  2⤵
  PID:3232
- C:\Windows\System\CXXbJPf.exe
  C:\Windows\System\CXXbJPf.exe
  2⤵
  PID:3280
- C:\Windows\System\tPJbBpr.exe
  C:\Windows\System\tPJbBpr.exe
  2⤵
  PID:3528
- C:\Windows\System\cdNekmo.exe
  C:\Windows\System\cdNekmo.exe
  2⤵
  PID:3568
- C:\Windows\System\oAiogFK.exe
  C:\Windows\System\oAiogFK.exe
  2⤵
  PID:3712
- C:\Windows\System\TSDxrlv.exe
  C:\Windows\System\TSDxrlv.exe
  2⤵
  PID:3960
- C:\Windows\System\EFVjyWy.exe
  C:\Windows\System\EFVjyWy.exe
  2⤵
  PID:3136
- C:\Windows\System\dpvZgXP.exe
  C:\Windows\System\dpvZgXP.exe
  2⤵
  PID:4012
- C:\Windows\System\ehSbdRP.exe
  C:\Windows\System\ehSbdRP.exe
  2⤵
  PID:1020
- C:\Windows\System\Offzeig.exe
  C:\Windows\System\Offzeig.exe
  2⤵
  PID:3868
- C:\Windows\System\CwSMYqu.exe
  C:\Windows\System\CwSMYqu.exe
  2⤵
  PID:3224
- C:\Windows\System\TPcDNGx.exe
  C:\Windows\System\TPcDNGx.exe
  2⤵
  PID:3292
- C:\Windows\System\zGAmzsN.exe
  C:\Windows\System\zGAmzsN.exe
  2⤵
  PID:3512
- C:\Windows\System\boOJmjB.exe
  C:\Windows\System\boOJmjB.exe
  2⤵
  PID:4072
- C:\Windows\System\SHUOHDF.exe
  C:\Windows\System\SHUOHDF.exe
  2⤵
  PID:4108
- C:\Windows\System\vmewucs.exe
  C:\Windows\System\vmewucs.exe
  2⤵
  PID:4128
- C:\Windows\System\LqfkjmT.exe
  C:\Windows\System\LqfkjmT.exe
  2⤵
  PID:4144
- C:\Windows\System\IqbZRPS.exe
  C:\Windows\System\IqbZRPS.exe
  2⤵
  PID:4160
- C:\Windows\System\iKnJpqX.exe
  C:\Windows\System\iKnJpqX.exe
  2⤵
  PID:4184
- C:\Windows\System\AgEmBga.exe
  C:\Windows\System\AgEmBga.exe
  2⤵
  PID:4200
- C:\Windows\System\YqQBLmp.exe
  C:\Windows\System\YqQBLmp.exe
  2⤵
  PID:4220
- C:\Windows\System\txVanPk.exe
  C:\Windows\System\txVanPk.exe
  2⤵
  PID:4236
- C:\Windows\System\lozdluX.exe
  C:\Windows\System\lozdluX.exe
  2⤵
  PID:4256
- C:\Windows\System\QXOOnxy.exe
  C:\Windows\System\QXOOnxy.exe
  2⤵
  PID:4276
- C:\Windows\System\APSqhyF.exe
  C:\Windows\System\APSqhyF.exe
  2⤵
  PID:4292
- C:\Windows\System\fbojDse.exe
  C:\Windows\System\fbojDse.exe
  2⤵
  PID:4312
- C:\Windows\System\TswIRHD.exe
  C:\Windows\System\TswIRHD.exe
  2⤵
  PID:4328
- C:\Windows\System\DXkyagf.exe
  C:\Windows\System\DXkyagf.exe
  2⤵
  PID:4348
- C:\Windows\System\DuykkIC.exe
  C:\Windows\System\DuykkIC.exe
  2⤵
  PID:4364
- C:\Windows\System\wJrQXsN.exe
  C:\Windows\System\wJrQXsN.exe
  2⤵
  PID:4388
- C:\Windows\System\yWIOGrJ.exe
  C:\Windows\System\yWIOGrJ.exe
  2⤵
  PID:4404
- C:\Windows\System\ystsjio.exe
  C:\Windows\System\ystsjio.exe
  2⤵
  PID:4424
- C:\Windows\System\jtbWhus.exe
  C:\Windows\System\jtbWhus.exe
  2⤵
  PID:4448
- C:\Windows\System\bFngKFY.exe
  C:\Windows\System\bFngKFY.exe
  2⤵
  PID:4468
- C:\Windows\System\TyFnmRJ.exe
  C:\Windows\System\TyFnmRJ.exe
  2⤵
  PID:4484
- C:\Windows\System\AnjtXPY.exe
  C:\Windows\System\AnjtXPY.exe
  2⤵
  PID:4500
- C:\Windows\System\nAXtWWh.exe
  C:\Windows\System\nAXtWWh.exe
  2⤵
  PID:4520
- C:\Windows\System\lcUOeBZ.exe
  C:\Windows\System\lcUOeBZ.exe
  2⤵
  PID:4536
- C:\Windows\System\CXWXGBK.exe
  C:\Windows\System\CXWXGBK.exe
  2⤵
  PID:4556
- C:\Windows\System\NaMhybe.exe
  C:\Windows\System\NaMhybe.exe
  2⤵
  PID:4572
- C:\Windows\System\xXfDzny.exe
  C:\Windows\System\xXfDzny.exe
  2⤵
  PID:4600
- C:\Windows\System\JvOmUFH.exe
  C:\Windows\System\JvOmUFH.exe
  2⤵
  PID:4620
- C:\Windows\System\plakoDE.exe
  C:\Windows\System\plakoDE.exe
  2⤵
  PID:4636
- C:\Windows\System\YoUwJEo.exe
  C:\Windows\System\YoUwJEo.exe
  2⤵
  PID:4652
- C:\Windows\System\izjYLkD.exe
  C:\Windows\System\izjYLkD.exe
  2⤵
  PID:4672
- C:\Windows\System\OXxwyye.exe
  C:\Windows\System\OXxwyye.exe
  2⤵
  PID:4692
- C:\Windows\System\gvskvCm.exe
  C:\Windows\System\gvskvCm.exe
  2⤵
  PID:4708
- C:\Windows\System\hGXZtqw.exe
  C:\Windows\System\hGXZtqw.exe
  2⤵
  PID:4728
- C:\Windows\System\xZiidim.exe
  C:\Windows\System\xZiidim.exe
  2⤵
  PID:4748
- C:\Windows\System\TAxOKdM.exe
  C:\Windows\System\TAxOKdM.exe
  2⤵
  PID:4764
- C:\Windows\System\cfjqLYw.exe
  C:\Windows\System\cfjqLYw.exe
  2⤵
  PID:4784
- C:\Windows\System\CfyhkfW.exe
  C:\Windows\System\CfyhkfW.exe
  2⤵
  PID:4816
- C:\Windows\System\FXPkhyO.exe
  C:\Windows\System\FXPkhyO.exe
  2⤵
  PID:4836
- C:\Windows\System\ooSOsHF.exe
  C:\Windows\System\ooSOsHF.exe
  2⤵
  PID:4856
- C:\Windows\System\UlHRwwi.exe
  C:\Windows\System\UlHRwwi.exe
  2⤵
  PID:4872
- C:\Windows\System\Hthidak.exe
  C:\Windows\System\Hthidak.exe
  2⤵
  PID:4888
- C:\Windows\System\ufFkwgZ.exe
  C:\Windows\System\ufFkwgZ.exe
  2⤵
  PID:4904
- C:\Windows\System\XnUjrgO.exe
  C:\Windows\System\XnUjrgO.exe
  2⤵
  PID:4920
- C:\Windows\System\oZulcZl.exe
  C:\Windows\System\oZulcZl.exe
  2⤵
  PID:4936
- C:\Windows\System\rleRLoc.exe
  C:\Windows\System\rleRLoc.exe
  2⤵
  PID:4952
- C:\Windows\System\pIIOIIp.exe
  C:\Windows\System\pIIOIIp.exe
  2⤵
  PID:4968
- C:\Windows\System\BPeOHyx.exe
  C:\Windows\System\BPeOHyx.exe
  2⤵
  PID:4984
- C:\Windows\System\NePKBnd.exe
  C:\Windows\System\NePKBnd.exe
  2⤵
  PID:5092
- C:\Windows\System\DiUzBry.exe
  C:\Windows\System\DiUzBry.exe
  2⤵
  PID:5108
- C:\Windows\System\TCTzQgG.exe
  C:\Windows\System\TCTzQgG.exe
  2⤵
  PID:3196
- C:\Windows\System\qNAOoVd.exe
  C:\Windows\System\qNAOoVd.exe
  2⤵
  PID:3580
- C:\Windows\System\gHYUwfD.exe
  C:\Windows\System\gHYUwfD.exe
  2⤵
  PID:4136
- C:\Windows\System\omMVgCG.exe
  C:\Windows\System\omMVgCG.exe
  2⤵
  PID:4176
- C:\Windows\System\LVFWwdc.exe
  C:\Windows\System\LVFWwdc.exe
  2⤵
  PID:4216
- C:\Windows\System\OoOsbGJ.exe
  C:\Windows\System\OoOsbGJ.exe
  2⤵
  PID:4284
- C:\Windows\System\KBxTHRD.exe
  C:\Windows\System\KBxTHRD.exe
  2⤵
  PID:4324
- C:\Windows\System\WnkUHbJ.exe
  C:\Windows\System\WnkUHbJ.exe
  2⤵
  PID:3928
- C:\Windows\System\TAZJdAN.exe
  C:\Windows\System\TAZJdAN.exe
  2⤵
  PID:4440
- C:\Windows\System\jyfsTwc.exe
  C:\Windows\System\jyfsTwc.exe
  2⤵
  PID:4436
- C:\Windows\System\ueEAwOJ.exe
  C:\Windows\System\ueEAwOJ.exe
  2⤵
  PID:4512
- C:\Windows\System\jSPwWAh.exe
  C:\Windows\System\jSPwWAh.exe
  2⤵
  PID:4552
- C:\Windows\System\uPcjAmx.exe
  C:\Windows\System\uPcjAmx.exe
  2⤵
  PID:3368
- C:\Windows\System\tVpUCgm.exe
  C:\Windows\System\tVpUCgm.exe
  2⤵
  PID:4592
- C:\Windows\System\DuuQbtE.exe
  C:\Windows\System\DuuQbtE.exe
  2⤵
  PID:4668
- C:\Windows\System\rYXRtgy.exe
  C:\Windows\System\rYXRtgy.exe
  2⤵
  PID:3632
- C:\Windows\System\FHPjsbh.exe
  C:\Windows\System\FHPjsbh.exe
  2⤵
  PID:3548
- C:\Windows\System\PTPOlkh.exe
  C:\Windows\System\PTPOlkh.exe
  2⤵
  PID:4152
- C:\Windows\System\Gsgunuf.exe
  C:\Windows\System\Gsgunuf.exe
  2⤵
  PID:4308
- C:\Windows\System\WaCqDit.exe
  C:\Windows\System\WaCqDit.exe
  2⤵
  PID:4456
- C:\Windows\System\BwBRsxx.exe
  C:\Windows\System\BwBRsxx.exe
  2⤵
  PID:3320
- C:\Windows\System\NedISPq.exe
  C:\Windows\System\NedISPq.exe
  2⤵
  PID:4608
- C:\Windows\System\IIYLahp.exe
  C:\Windows\System\IIYLahp.exe
  2⤵
  PID:3664
- C:\Windows\System\Axnjwhm.exe
  C:\Windows\System\Axnjwhm.exe
  2⤵
  PID:544
- C:\Windows\System\GOTKFEG.exe
  C:\Windows\System\GOTKFEG.exe
  2⤵
  PID:3092
- C:\Windows\System\EZVzjzd.exe
  C:\Windows\System\EZVzjzd.exe
  2⤵
  PID:3352
- C:\Windows\System\HGfQhYA.exe
  C:\Windows\System\HGfQhYA.exe
  2⤵
  PID:3832
- C:\Windows\System\UlltbaA.exe
  C:\Windows\System\UlltbaA.exe
  2⤵
  PID:3236
- C:\Windows\System\CyiHTBL.exe
  C:\Windows\System\CyiHTBL.exe
  2⤵
  PID:3852
- C:\Windows\System\YGXZjVm.exe
  C:\Windows\System\YGXZjVm.exe
  2⤵
  PID:3904
- C:\Windows\System\THyxqss.exe
  C:\Windows\System\THyxqss.exe
  2⤵
  PID:4116
- C:\Windows\System\UgJCuRj.exe
  C:\Windows\System\UgJCuRj.exe
  2⤵
  PID:4304
- C:\Windows\System\jbqxsou.exe
  C:\Windows\System\jbqxsou.exe
  2⤵
  PID:4412
- C:\Windows\System\PrAJqov.exe
  C:\Windows\System\PrAJqov.exe
  2⤵
  PID:4464
- C:\Windows\System\TKFqKYH.exe
  C:\Windows\System\TKFqKYH.exe
  2⤵
  PID:4736
- C:\Windows\System\zfKWvHL.exe
  C:\Windows\System\zfKWvHL.exe
  2⤵
  PID:4780
- C:\Windows\System\JGMUiKT.exe
  C:\Windows\System\JGMUiKT.exe
  2⤵
  PID:4720
- C:\Windows\System\bifHKaw.exe
  C:\Windows\System\bifHKaw.exe
  2⤵
  PID:4868
- C:\Windows\System\dUDyRHq.exe
  C:\Windows\System\dUDyRHq.exe
  2⤵
  PID:4792
- C:\Windows\System\aoBumUO.exe
  C:\Windows\System\aoBumUO.exe
  2⤵
  PID:4808
- C:\Windows\System\fbAUBHu.exe
  C:\Windows\System\fbAUBHu.exe
  2⤵
  PID:4900
- C:\Windows\System\EngrEuC.exe
  C:\Windows\System\EngrEuC.exe
  2⤵
  PID:4964
- C:\Windows\System\oVjkIfe.exe
  C:\Windows\System\oVjkIfe.exe
  2⤵
  PID:4916
- C:\Windows\System\MsskgMc.exe
  C:\Windows\System\MsskgMc.exe
  2⤵
  PID:4976
- C:\Windows\System\NJcPyGo.exe
  C:\Windows\System\NJcPyGo.exe
  2⤵
  PID:5008
- C:\Windows\System\ZKNKJdt.exe
  C:\Windows\System\ZKNKJdt.exe
  2⤵
  PID:5024
- C:\Windows\System\rImSLgG.exe
  C:\Windows\System\rImSLgG.exe
  2⤵
  PID:5040
- C:\Windows\System\PivOXhC.exe
  C:\Windows\System\PivOXhC.exe
  2⤵
  PID:5056
- C:\Windows\System\OtFfbPg.exe
  C:\Windows\System\OtFfbPg.exe
  2⤵
  PID:5072
- C:\Windows\System\yBhSfjN.exe
  C:\Windows\System\yBhSfjN.exe
  2⤵
  PID:5088
- C:\Windows\System\ZskNycC.exe
  C:\Windows\System\ZskNycC.exe
  2⤵
  PID:4100
- C:\Windows\System\EEbVlQl.exe
  C:\Windows\System\EEbVlQl.exe
  2⤵
  PID:4288
- C:\Windows\System\EQKkhYp.exe
  C:\Windows\System\EQKkhYp.exe
  2⤵
  PID:4476
- C:\Windows\System\rAicrTT.exe
  C:\Windows\System\rAicrTT.exe
  2⤵
  PID:3364
- C:\Windows\System\NdWvfJD.exe
  C:\Windows\System\NdWvfJD.exe
  2⤵
  PID:4544
- C:\Windows\System\fOqaHHq.exe
  C:\Windows\System\fOqaHHq.exe
  2⤵
  PID:4244
- C:\Windows\System\tmAUbAN.exe
  C:\Windows\System\tmAUbAN.exe
  2⤵
  PID:4060
- C:\Windows\System\CnDLSSA.exe
  C:\Windows\System\CnDLSSA.exe
  2⤵
  PID:3444
- C:\Windows\System\mZroyFC.exe
  C:\Windows\System\mZroyFC.exe
  2⤵
  PID:3596
- C:\Windows\System\lkkESgw.exe
  C:\Windows\System\lkkESgw.exe
  2⤵
  PID:4664
- C:\Windows\System\PUIIAus.exe
  C:\Windows\System\PUIIAus.exe
  2⤵
  PID:4300
- C:\Windows\System\WtADhUV.exe
  C:\Windows\System\WtADhUV.exe
  2⤵
  PID:4644
- C:\Windows\System\gddOEPU.exe
  C:\Windows\System\gddOEPU.exe
  2⤵
  PID:3972
- C:\Windows\System\XIvZPtV.exe
  C:\Windows\System\XIvZPtV.exe
  2⤵
  PID:3820
- C:\Windows\System\nTBcPyh.exe
  C:\Windows\System\nTBcPyh.exe
  2⤵
  PID:4372
- C:\Windows\System\yXmeJtJ.exe
  C:\Windows\System\yXmeJtJ.exe
  2⤵
  PID:3688
- C:\Windows\System\svApoYL.exe
  C:\Windows\System\svApoYL.exe
  2⤵
  PID:2432
- C:\Windows\System\SdHYgiZ.exe
  C:\Windows\System\SdHYgiZ.exe
  2⤵
  PID:4268
- C:\Windows\System\LFxhPAO.exe
  C:\Windows\System\LFxhPAO.exe
  2⤵
  PID:4384
- C:\Windows\System\wJgncUZ.exe
  C:\Windows\System\wJgncUZ.exe
  2⤵
  PID:4688
- C:\Windows\System\KDoxkNC.exe
  C:\Windows\System\KDoxkNC.exe
  2⤵
  PID:4724
- C:\Windows\System\bdyjANm.exe
  C:\Windows\System\bdyjANm.exe
  2⤵
  PID:4912
- C:\Windows\System\bVLJlmL.exe
  C:\Windows\System\bVLJlmL.exe
  2⤵
  PID:4776
- C:\Windows\System\QQtFCkf.exe
  C:\Windows\System\QQtFCkf.exe
  2⤵
  PID:4800
- C:\Windows\System\qYzZHxP.exe
  C:\Windows\System\qYzZHxP.exe
  2⤵
  PID:4932
- C:\Windows\System\luBvHeX.exe
  C:\Windows\System\luBvHeX.exe
  2⤵
  PID:5004
- C:\Windows\System\tsKtcZg.exe
  C:\Windows\System\tsKtcZg.exe
  2⤵
  PID:5068
- C:\Windows\System\yhGNeIs.exe
  C:\Windows\System\yhGNeIs.exe
  2⤵
  PID:3804
- C:\Windows\System\RivUfHc.exe
  C:\Windows\System\RivUfHc.exe
  2⤵
  PID:4632
- C:\Windows\System\nGCRyCE.exe
  C:\Windows\System\nGCRyCE.exe
  2⤵
  PID:5080
- C:\Windows\System\lmhiyvT.exe
  C:\Windows\System\lmhiyvT.exe
  2⤵
  PID:4584
- C:\Windows\System\SjYcbjg.exe
  C:\Windows\System\SjYcbjg.exe
  2⤵
  PID:4172
- C:\Windows\System\DQJvMHz.exe
  C:\Windows\System\DQJvMHz.exe
  2⤵
  PID:4120
- C:\Windows\System\jJzQsba.exe
  C:\Windows\System\jJzQsba.exe
  2⤵
  PID:5104
- C:\Windows\System\aGPxPmb.exe
  C:\Windows\System\aGPxPmb.exe
  2⤵
  PID:4336
- C:\Windows\System\vRgIFgV.exe
  C:\Windows\System\vRgIFgV.exe
  2⤵
  PID:4828
- C:\Windows\System\WpNEbwk.exe
  C:\Windows\System\WpNEbwk.exe
  2⤵
  PID:4804
- C:\Windows\System\kVQhXDq.exe
  C:\Windows\System\kVQhXDq.exe
  2⤵
  PID:3564
- C:\Windows\System\bKbRpeF.exe
  C:\Windows\System\bKbRpeF.exe
  2⤵
  PID:5036
- C:\Windows\System\tnmkJXb.exe
  C:\Windows\System\tnmkJXb.exe
  2⤵
  PID:4848
- C:\Windows\System\QnCDqyx.exe
  C:\Windows\System\QnCDqyx.exe
  2⤵
  PID:5016
- C:\Windows\System\rJxoRkL.exe
  C:\Windows\System\rJxoRkL.exe
  2⤵
  PID:4432
- C:\Windows\System\oSLPkkg.exe
  C:\Windows\System\oSLPkkg.exe
  2⤵
  PID:4156
- C:\Windows\System\PdPRUhp.exe
  C:\Windows\System\PdPRUhp.exe
  2⤵
  PID:4088
- C:\Windows\System\aVQLFVT.exe
  C:\Windows\System\aVQLFVT.exe
  2⤵
  PID:4008
- C:\Windows\System\CMCwgRC.exe
  C:\Windows\System\CMCwgRC.exe
  2⤵
  PID:4980
- C:\Windows\System\FDXTXOy.exe
  C:\Windows\System\FDXTXOy.exe
  2⤵
  PID:4376
- C:\Windows\System\bNfzoMJ.exe
  C:\Windows\System\bNfzoMJ.exe
  2⤵
  PID:4684
- C:\Windows\System\CyKpDRA.exe
  C:\Windows\System\CyKpDRA.exe
  2⤵
  PID:5048
- C:\Windows\System\ZRUScDO.exe
  C:\Windows\System\ZRUScDO.exe
  2⤵
  PID:4084
- C:\Windows\System\msjjsXI.exe
  C:\Windows\System\msjjsXI.exe
  2⤵
  PID:3776
- C:\Windows\System\AtlDrTE.exe
  C:\Windows\System\AtlDrTE.exe
  2⤵
  PID:4568
- C:\Windows\System\CfHsQcr.exe
  C:\Windows\System\CfHsQcr.exe
  2⤵
  PID:5100
- C:\Windows\System\gawTILV.exe
  C:\Windows\System\gawTILV.exe
  2⤵
  PID:4612
- C:\Windows\System\PtMPAbc.exe
  C:\Windows\System\PtMPAbc.exe
  2⤵
  PID:5124
- C:\Windows\System\ErQRCNV.exe
  C:\Windows\System\ErQRCNV.exe
  2⤵
  PID:5140
- C:\Windows\System\qQFZGwz.exe
  C:\Windows\System\qQFZGwz.exe
  2⤵
  PID:5156
- C:\Windows\System\jNkiDQY.exe
  C:\Windows\System\jNkiDQY.exe
  2⤵
  PID:5172
- C:\Windows\System\MdmvPXs.exe
  C:\Windows\System\MdmvPXs.exe
  2⤵
  PID:5192
- C:\Windows\System\fqceLLW.exe
  C:\Windows\System\fqceLLW.exe
  2⤵
  PID:5208
- C:\Windows\System\EPyQzFq.exe
  C:\Windows\System\EPyQzFq.exe
  2⤵
  PID:5224
- C:\Windows\System\FtVHzur.exe
  C:\Windows\System\FtVHzur.exe
  2⤵
  PID:5240
- C:\Windows\System\xnLfBPD.exe
  C:\Windows\System\xnLfBPD.exe
  2⤵
  PID:5260
- C:\Windows\System\xSDuarZ.exe
  C:\Windows\System\xSDuarZ.exe
  2⤵
  PID:5276
- C:\Windows\System\NNnZTPD.exe
  C:\Windows\System\NNnZTPD.exe
  2⤵
  PID:5292
- C:\Windows\System\DGYNfta.exe
  C:\Windows\System\DGYNfta.exe
  2⤵
  PID:5308
- C:\Windows\System\MgLRnjz.exe
  C:\Windows\System\MgLRnjz.exe
  2⤵
  PID:5324
- C:\Windows\System\dBBKbnD.exe
  C:\Windows\System\dBBKbnD.exe
  2⤵
  PID:5344
- C:\Windows\System\MbErGCA.exe
  C:\Windows\System\MbErGCA.exe
  2⤵
  PID:5360
- C:\Windows\System\vWwKbRi.exe
  C:\Windows\System\vWwKbRi.exe
  2⤵
  PID:5384
- C:\Windows\System\nPxGhwH.exe
  C:\Windows\System\nPxGhwH.exe
  2⤵
  PID:5400
- C:\Windows\System\VrfYnZy.exe
  C:\Windows\System\VrfYnZy.exe
  2⤵
  PID:5416
- C:\Windows\System\IElAvHS.exe
  C:\Windows\System\IElAvHS.exe
  2⤵
  PID:5432
- C:\Windows\System\twWROTh.exe
  C:\Windows\System\twWROTh.exe
  2⤵
  PID:5448
- C:\Windows\System\xEimuWK.exe
  C:\Windows\System\xEimuWK.exe
  2⤵
  PID:5464
- C:\Windows\System\qFdynPC.exe
  C:\Windows\System\qFdynPC.exe
  2⤵
  PID:5480
- C:\Windows\System\aKClcII.exe
  C:\Windows\System\aKClcII.exe
  2⤵
  PID:5496
- C:\Windows\System\TlXvYgD.exe
  C:\Windows\System\TlXvYgD.exe
  2⤵
  PID:5516
- C:\Windows\System\ctKzmfR.exe
  C:\Windows\System\ctKzmfR.exe
  2⤵
  PID:5536
- C:\Windows\System\KtdCTCZ.exe
  C:\Windows\System\KtdCTCZ.exe
  2⤵
  PID:5552
- C:\Windows\System\rvGnPZq.exe
  C:\Windows\System\rvGnPZq.exe
  2⤵
  PID:5568
- C:\Windows\System\vOIdhWW.exe
  C:\Windows\System\vOIdhWW.exe
  2⤵
  PID:5584
- C:\Windows\System\ehqVkvm.exe
  C:\Windows\System\ehqVkvm.exe
  2⤵
  PID:5600
- C:\Windows\System\ELCAkxW.exe
  C:\Windows\System\ELCAkxW.exe
  2⤵
  PID:5616
- C:\Windows\System\dfVOdkV.exe
  C:\Windows\System\dfVOdkV.exe
  2⤵
  PID:5632
- C:\Windows\System\AzefXtb.exe
  C:\Windows\System\AzefXtb.exe
  2⤵
  PID:5648
- C:\Windows\System\wnFUBjD.exe
  C:\Windows\System\wnFUBjD.exe
  2⤵
  PID:5664
- C:\Windows\System\CxPzDCB.exe
  C:\Windows\System\CxPzDCB.exe
  2⤵
  PID:5680
- C:\Windows\System\bBTysAw.exe
  C:\Windows\System\bBTysAw.exe
  2⤵
  PID:5700
- C:\Windows\System\YsStILv.exe
  C:\Windows\System\YsStILv.exe
  2⤵
  PID:5716
- C:\Windows\System\lxErGiN.exe
  C:\Windows\System\lxErGiN.exe
  2⤵
  PID:5732
- C:\Windows\System\ZCntjQD.exe
  C:\Windows\System\ZCntjQD.exe
  2⤵
  PID:5748
- C:\Windows\System\hXXOQgR.exe
  C:\Windows\System\hXXOQgR.exe
  2⤵
  PID:5764
- C:\Windows\System\LvSDFmR.exe
  C:\Windows\System\LvSDFmR.exe
  2⤵
  PID:5780
- C:\Windows\System\DXzqkbX.exe
  C:\Windows\System\DXzqkbX.exe
  2⤵
  PID:5796
- C:\Windows\System\lQKOosN.exe
  C:\Windows\System\lQKOosN.exe
  2⤵
  PID:5856
- C:\Windows\System\kFYBavJ.exe
  C:\Windows\System\kFYBavJ.exe
  2⤵
  PID:5920
- C:\Windows\System\qmPwmQH.exe
  C:\Windows\System\qmPwmQH.exe
  2⤵
  PID:5940
- C:\Windows\System\oUmqVYR.exe
  C:\Windows\System\oUmqVYR.exe
  2⤵
  PID:5964
- C:\Windows\System\QBbOYvh.exe
  C:\Windows\System\QBbOYvh.exe
  2⤵
  PID:5980
- C:\Windows\System\aUYIgPk.exe
  C:\Windows\System\aUYIgPk.exe
  2⤵
  PID:5996
- C:\Windows\System\UmKjXmg.exe
  C:\Windows\System\UmKjXmg.exe
  2⤵
  PID:6016
- C:\Windows\System\mcajubt.exe
  C:\Windows\System\mcajubt.exe
  2⤵
  PID:6032
- C:\Windows\System\OwVlABY.exe
  C:\Windows\System\OwVlABY.exe
  2⤵
  PID:6052
- C:\Windows\System\sNrghuR.exe
  C:\Windows\System\sNrghuR.exe
  2⤵
  PID:6068
- C:\Windows\System\geEwyNu.exe
  C:\Windows\System\geEwyNu.exe
  2⤵
  PID:6084
- C:\Windows\System\WdZzXgU.exe
  C:\Windows\System\WdZzXgU.exe
  2⤵
  PID:6108
- C:\Windows\System\DVFDclM.exe
  C:\Windows\System\DVFDclM.exe
  2⤵
  PID:6124
- C:\Windows\System\ixpIQpH.exe
  C:\Windows\System\ixpIQpH.exe
  2⤵
  PID:4772
- C:\Windows\System\IvJSYPL.exe
  C:\Windows\System\IvJSYPL.exe
  2⤵
  PID:5000
- C:\Windows\System\GAQLGvH.exe
  C:\Windows\System\GAQLGvH.exe
  2⤵
  PID:5184
- C:\Windows\System\jaSyTGS.exe
  C:\Windows\System\jaSyTGS.exe
  2⤵
  PID:5200
- C:\Windows\System\WdImTYs.exe
  C:\Windows\System\WdImTYs.exe
  2⤵
  PID:5256
- C:\Windows\System\EAtcwzv.exe
  C:\Windows\System\EAtcwzv.exe
  2⤵
  PID:5336
- C:\Windows\System\cOqTQKw.exe
  C:\Windows\System\cOqTQKw.exe
  2⤵
  PID:5356
- C:\Windows\System\XyeuLMu.exe
  C:\Windows\System\XyeuLMu.exe
  2⤵
  PID:5424
- C:\Windows\System\OXSYjBl.exe
  C:\Windows\System\OXSYjBl.exe
  2⤵
  PID:5488
- C:\Windows\System\BDsWdzr.exe
  C:\Windows\System\BDsWdzr.exe
  2⤵
  PID:5440
- C:\Windows\System\dAiFGuy.exe
  C:\Windows\System\dAiFGuy.exe
  2⤵
  PID:5508
- C:\Windows\System\PHxDGOL.exe
  C:\Windows\System\PHxDGOL.exe
  2⤵
  PID:5544
- C:\Windows\System\UHMHymE.exe
  C:\Windows\System\UHMHymE.exe
  2⤵
  PID:5576
- C:\Windows\System\UsTcqTC.exe
  C:\Windows\System\UsTcqTC.exe
  2⤵
  PID:5624
- C:\Windows\System\LapMqEY.exe
  C:\Windows\System\LapMqEY.exe
  2⤵
  PID:5688
- C:\Windows\System\LwOBWtX.exe
  C:\Windows\System\LwOBWtX.exe
  2⤵
  PID:5728
- C:\Windows\System\UvxwwyA.exe
  C:\Windows\System\UvxwwyA.exe
  2⤵
  PID:5644
- C:\Windows\System\McDhdpQ.exe
  C:\Windows\System\McDhdpQ.exe
  2⤵
  PID:5672
- C:\Windows\System\abFdbnX.exe
  C:\Windows\System\abFdbnX.exe
  2⤵
  PID:5712
- C:\Windows\System\wqGCwRY.exe
  C:\Windows\System\wqGCwRY.exe
  2⤵
  PID:5808
- C:\Windows\System\qlOxLLf.exe
  C:\Windows\System\qlOxLLf.exe
  2⤵
  PID:5828
- C:\Windows\System\huEvEyt.exe
  C:\Windows\System\huEvEyt.exe
  2⤵
  PID:5852
- C:\Windows\System\XPUGsss.exe
  C:\Windows\System\XPUGsss.exe
  2⤵
  PID:5872
- C:\Windows\System\gZmKWPn.exe
  C:\Windows\System\gZmKWPn.exe
  2⤵
  PID:5888
- C:\Windows\System\FfNSBzP.exe
  C:\Windows\System\FfNSBzP.exe
  2⤵
  PID:5912
- C:\Windows\System\EHPqRRS.exe
  C:\Windows\System\EHPqRRS.exe
  2⤵
  PID:5956
- C:\Windows\System\jqibzXJ.exe
  C:\Windows\System\jqibzXJ.exe
  2⤵
  PID:5936
- C:\Windows\System\YHQWWev.exe
  C:\Windows\System\YHQWWev.exe
  2⤵
  PID:6008
- C:\Windows\System\TgcJJqJ.exe
  C:\Windows\System\TgcJJqJ.exe
  2⤵
  PID:6028
- C:\Windows\System\cXqtlaP.exe
  C:\Windows\System\cXqtlaP.exe
  2⤵
  PID:6064
- C:\Windows\System\LDUcvPg.exe
  C:\Windows\System\LDUcvPg.exe
  2⤵
  PID:6044
- C:\Windows\System\XeIXCkE.exe
  C:\Windows\System\XeIXCkE.exe
  2⤵
  PID:5180
- C:\Windows\System\WVzvPPl.exe
  C:\Windows\System\WVzvPPl.exe
  2⤵
  PID:6080
- C:\Windows\System\XOIujtA.exe
  C:\Windows\System\XOIujtA.exe
  2⤵
  PID:5288
- C:\Windows\System\nZGppkz.exe
  C:\Windows\System\nZGppkz.exe
  2⤵
  PID:5320
- C:\Windows\System\uyyHQdw.exe
  C:\Windows\System\uyyHQdw.exe
  2⤵
  PID:5352
- C:\Windows\System\rmlxMho.exe
  C:\Windows\System\rmlxMho.exe
  2⤵
  PID:5492
- C:\Windows\System\FodAuKz.exe
  C:\Windows\System\FodAuKz.exe
  2⤵
  PID:5560
- C:\Windows\System\KIcyXJO.exe
  C:\Windows\System\KIcyXJO.exe
  2⤵
  PID:5472
- C:\Windows\System\mWuoUxM.exe
  C:\Windows\System\mWuoUxM.exe
  2⤵
  PID:5628
- C:\Windows\System\hAWynCm.exe
  C:\Windows\System\hAWynCm.exe
  2⤵
  PID:5820
- C:\Windows\System\aEiINOG.exe
  C:\Windows\System\aEiINOG.exe
  2⤵
  PID:5904
- C:\Windows\System\XLRFWxw.exe
  C:\Windows\System\XLRFWxw.exe
  2⤵
  PID:6024
- C:\Windows\System\zPLWLhP.exe
  C:\Windows\System\zPLWLhP.exe
  2⤵
  PID:6048
- C:\Windows\System\PiVoPyY.exe
  C:\Windows\System\PiVoPyY.exe
  2⤵
  PID:5456
- C:\Windows\System\KACyScb.exe
  C:\Windows\System\KACyScb.exe
  2⤵
  PID:5136
- C:\Windows\System\slQSWpa.exe
  C:\Windows\System\slQSWpa.exe
  2⤵
  PID:5232
- C:\Windows\System\qMGDPMb.exe
  C:\Windows\System\qMGDPMb.exe
  2⤵
  PID:5532
- C:\Windows\System\QqeAMov.exe
  C:\Windows\System\QqeAMov.exe
  2⤵
  PID:5640
- C:\Windows\System\PsbFvbM.exe
  C:\Windows\System\PsbFvbM.exe
  2⤵
  PID:5760
- C:\Windows\System\DqQCrTM.exe
  C:\Windows\System\DqQCrTM.exe
  2⤵
  PID:5776
- C:\Windows\System\UMmaWui.exe
  C:\Windows\System\UMmaWui.exe
  2⤵
  PID:5864
- C:\Windows\System\gtkciUb.exe
  C:\Windows\System\gtkciUb.exe
  2⤵
  PID:5836
- C:\Windows\System\rJLzDge.exe
  C:\Windows\System\rJLzDge.exe
  2⤵
  PID:5900
- C:\Windows\System\qCOEcUJ.exe
  C:\Windows\System\qCOEcUJ.exe
  2⤵
  PID:6012
- C:\Windows\System\aDwsgLG.exe
  C:\Windows\System\aDwsgLG.exe
  2⤵
  PID:5976
- C:\Windows\System\wFXKZGh.exe
  C:\Windows\System\wFXKZGh.exe
  2⤵
  PID:6140
- C:\Windows\System\hGyOqGF.exe
  C:\Windows\System\hGyOqGF.exe
  2⤵
  PID:5216
- C:\Windows\System\bXAPmsf.exe
  C:\Windows\System\bXAPmsf.exe
  2⤵
  PID:5372
- C:\Windows\System\UWhPyFh.exe
  C:\Windows\System\UWhPyFh.exe
  2⤵
  PID:5412
- C:\Windows\System\lNZNbMY.exe
  C:\Windows\System\lNZNbMY.exe
  2⤵
  PID:5804
- C:\Windows\System\YWuIHSP.exe
  C:\Windows\System\YWuIHSP.exe
  2⤵
  PID:5132
- C:\Windows\System\tgQYxeC.exe
  C:\Windows\System\tgQYxeC.exe
  2⤵
  PID:5724
- C:\Windows\System\mfHAVZV.exe
  C:\Windows\System\mfHAVZV.exe
  2⤵
  PID:5948
- C:\Windows\System\xeIqcsJ.exe
  C:\Windows\System\xeIqcsJ.exe
  2⤵
  PID:5880
- C:\Windows\System\WpUdWXk.exe
  C:\Windows\System\WpUdWXk.exe
  2⤵
  PID:5992
- C:\Windows\System\ojsLtgR.exe
  C:\Windows\System\ojsLtgR.exe
  2⤵
  PID:5528
- C:\Windows\System\zTjFNeD.exe
  C:\Windows\System\zTjFNeD.exe
  2⤵
  PID:6120
- C:\Windows\System\iMzedYY.exe
  C:\Windows\System\iMzedYY.exe
  2⤵
  PID:5792
- C:\Windows\System\mVZdVCZ.exe
  C:\Windows\System\mVZdVCZ.exe
  2⤵
  PID:5236
- C:\Windows\System\RnjoCOs.exe
  C:\Windows\System\RnjoCOs.exe
  2⤵
  PID:5744
- C:\Windows\System\sEyLDUk.exe
  C:\Windows\System\sEyLDUk.exe
  2⤵
  PID:6152
- C:\Windows\System\jhlrPlV.exe
  C:\Windows\System\jhlrPlV.exe
  2⤵
  PID:6168
- C:\Windows\System\vcwRXJg.exe
  C:\Windows\System\vcwRXJg.exe
  2⤵
  PID:6184
- C:\Windows\System\mBcOtJx.exe
  C:\Windows\System\mBcOtJx.exe
  2⤵
  PID:6200
- C:\Windows\System\COUStMk.exe
  C:\Windows\System\COUStMk.exe
  2⤵
  PID:6220
- C:\Windows\System\jqgBAjc.exe
  C:\Windows\System\jqgBAjc.exe
  2⤵
  PID:6236
- C:\Windows\System\DlogOCl.exe
  C:\Windows\System\DlogOCl.exe
  2⤵
  PID:6252
- C:\Windows\System\zeStrHq.exe
  C:\Windows\System\zeStrHq.exe
  2⤵
  PID:6268
- C:\Windows\System\BrcnoGa.exe
  C:\Windows\System\BrcnoGa.exe
  2⤵
  PID:6288
- C:\Windows\System\txkiVrX.exe
  C:\Windows\System\txkiVrX.exe
  2⤵
  PID:6304
- C:\Windows\System\yWzHqRn.exe
  C:\Windows\System\yWzHqRn.exe
  2⤵
  PID:6320
- C:\Windows\System\FUhWynQ.exe
  C:\Windows\System\FUhWynQ.exe
  2⤵
  PID:6340
- C:\Windows\System\HKicroO.exe
  C:\Windows\System\HKicroO.exe
  2⤵
  PID:6356
- C:\Windows\System\TNWqNxq.exe
  C:\Windows\System\TNWqNxq.exe
  2⤵
  PID:6372
- C:\Windows\System\BjjLuaU.exe
  C:\Windows\System\BjjLuaU.exe
  2⤵
  PID:6392
- C:\Windows\System\bnXAGjY.exe
  C:\Windows\System\bnXAGjY.exe
  2⤵
  PID:6408
- C:\Windows\System\GqPdJaF.exe
  C:\Windows\System\GqPdJaF.exe
  2⤵
  PID:6428
- C:\Windows\System\sheElHq.exe
  C:\Windows\System\sheElHq.exe
  2⤵
  PID:6448
- C:\Windows\System\gGzrpaN.exe
  C:\Windows\System\gGzrpaN.exe
  2⤵
  PID:6464
- C:\Windows\System\tuhqCuR.exe
  C:\Windows\System\tuhqCuR.exe
  2⤵
  PID:6484
- C:\Windows\System\IePEjRq.exe
  C:\Windows\System\IePEjRq.exe
  2⤵
  PID:6500
- C:\Windows\System\dyxymeI.exe
  C:\Windows\System\dyxymeI.exe
  2⤵
  PID:6520
- C:\Windows\System\AryYpJC.exe
  C:\Windows\System\AryYpJC.exe
  2⤵
  PID:6536
- C:\Windows\System\iSEceiw.exe
  C:\Windows\System\iSEceiw.exe
  2⤵
  PID:6552
- C:\Windows\System\DdUMdWD.exe
  C:\Windows\System\DdUMdWD.exe
  2⤵
  PID:6572
- C:\Windows\System\ghqjTfL.exe
  C:\Windows\System\ghqjTfL.exe
  2⤵
  PID:6588
- C:\Windows\System\ruiNMHE.exe
  C:\Windows\System\ruiNMHE.exe
  2⤵
  PID:6604
- C:\Windows\System\lblRwxi.exe
  C:\Windows\System\lblRwxi.exe
  2⤵
  PID:6620
- C:\Windows\System\iyvIXRO.exe
  C:\Windows\System\iyvIXRO.exe
  2⤵
  PID:6636
- C:\Windows\System\LNsVvud.exe
  C:\Windows\System\LNsVvud.exe
  2⤵
  PID:6656
- C:\Windows\System\WclPrlV.exe
  C:\Windows\System\WclPrlV.exe
  2⤵
  PID:6672
- C:\Windows\System\CHHDMwN.exe
  C:\Windows\System\CHHDMwN.exe
  2⤵
  PID:6688
- C:\Windows\System\WUmGElH.exe
  C:\Windows\System\WUmGElH.exe
  2⤵
  PID:6704
- C:\Windows\System\UjOUwcI.exe
  C:\Windows\System\UjOUwcI.exe
  2⤵
  PID:6720
- C:\Windows\System\zcDRYJp.exe
  C:\Windows\System\zcDRYJp.exe
  2⤵
  PID:6740
- C:\Windows\System\thkFWVa.exe
  C:\Windows\System\thkFWVa.exe
  2⤵
  PID:6756
- C:\Windows\System\FQYhcGM.exe
  C:\Windows\System\FQYhcGM.exe
  2⤵
  PID:6772
- C:\Windows\System\YbACAlb.exe
  C:\Windows\System\YbACAlb.exe
  2⤵
  PID:6788
- C:\Windows\System\KCVhHJc.exe
  C:\Windows\System\KCVhHJc.exe
  2⤵
  PID:6808
- C:\Windows\System\wxltURv.exe
  C:\Windows\System\wxltURv.exe
  2⤵
  PID:6828
- C:\Windows\System\NUhwAYJ.exe
  C:\Windows\System\NUhwAYJ.exe
  2⤵
  PID:6844
- C:\Windows\System\cnMQFFD.exe
  C:\Windows\System\cnMQFFD.exe
  2⤵
  PID:6860
- C:\Windows\System\kwOrOOb.exe
  C:\Windows\System\kwOrOOb.exe
  2⤵
  PID:6880
- C:\Windows\System\dWgglPV.exe
  C:\Windows\System\dWgglPV.exe
  2⤵
  PID:6896
- C:\Windows\System\bcyBHGm.exe
  C:\Windows\System\bcyBHGm.exe
  2⤵
  PID:6920
- C:\Windows\System\BNRnxmc.exe
  C:\Windows\System\BNRnxmc.exe
  2⤵
  PID:6992
- C:\Windows\System\aRhxlAW.exe
  C:\Windows\System\aRhxlAW.exe
  2⤵
  PID:7060
- C:\Windows\System\YjcGGKd.exe
  C:\Windows\System\YjcGGKd.exe
  2⤵
  PID:7116
- C:\Windows\System\fHNQLCE.exe
  C:\Windows\System\fHNQLCE.exe
  2⤵
  PID:7156
- C:\Windows\System\Ifxvvgj.exe
  C:\Windows\System\Ifxvvgj.exe
  2⤵
  PID:6300
- C:\Windows\System\ORSmLtm.exe
  C:\Windows\System\ORSmLtm.exe
  2⤵
  PID:6336
- C:\Windows\System\OZmVDdx.exe
  C:\Windows\System\OZmVDdx.exe
  2⤵
  PID:6400
- C:\Windows\System\NaqRGWo.exe
  C:\Windows\System\NaqRGWo.exe
  2⤵
  PID:6424
- C:\Windows\System\NOQyHge.exe
  C:\Windows\System\NOQyHge.exe
  2⤵
  PID:6444
- C:\Windows\System\NSXaxbo.exe
  C:\Windows\System\NSXaxbo.exe
  2⤵
  PID:6480
- C:\Windows\System\DbMKRGo.exe
  C:\Windows\System\DbMKRGo.exe
  2⤵
  PID:6508
- C:\Windows\System\mDDLBYK.exe
  C:\Windows\System\mDDLBYK.exe
  2⤵
  PID:6548
- C:\Windows\System\WubIUYv.exe
  C:\Windows\System\WubIUYv.exe
  2⤵
  PID:6612
- C:\Windows\System\pENRqYj.exe
  C:\Windows\System\pENRqYj.exe
  2⤵
  PID:6600
- C:\Windows\System\NUfoFsY.exe
  C:\Windows\System\NUfoFsY.exe
  2⤵
  PID:6632
- C:\Windows\System\jsttxDe.exe
  C:\Windows\System\jsttxDe.exe
  2⤵
  PID:6664
- C:\Windows\System\SXEwmWb.exe
  C:\Windows\System\SXEwmWb.exe
  2⤵
  PID:6716
- C:\Windows\System\dMcxWxE.exe
  C:\Windows\System\dMcxWxE.exe
  2⤵
  PID:6780
- C:\Windows\System\vAIymIS.exe
  C:\Windows\System\vAIymIS.exe
  2⤵
  PID:6736
- C:\Windows\System\XAaWokE.exe
  C:\Windows\System\XAaWokE.exe
  2⤵
  PID:6804
- C:\Windows\System\bxblaFx.exe
  C:\Windows\System\bxblaFx.exe
  2⤵
  PID:6768
- C:\Windows\System\MhqQkVZ.exe
  C:\Windows\System\MhqQkVZ.exe
  2⤵
  PID:6904
- C:\Windows\System\JLhlPkO.exe
  C:\Windows\System\JLhlPkO.exe
  2⤵
  PID:6876
- C:\Windows\System\OgPClUJ.exe
  C:\Windows\System\OgPClUJ.exe
  2⤵
  PID:6928
- C:\Windows\System\WJBwIdm.exe
  C:\Windows\System\WJBwIdm.exe
  2⤵
  PID:6944
- C:\Windows\System\IXxiGJh.exe
  C:\Windows\System\IXxiGJh.exe
  2⤵
  PID:6964
- C:\Windows\System\bdfrasw.exe
  C:\Windows\System\bdfrasw.exe
  2⤵
  PID:6980
- C:\Windows\System\VAMvvwO.exe
  C:\Windows\System\VAMvvwO.exe
  2⤵
  PID:7008
- C:\Windows\System\ZlSgBzn.exe
  C:\Windows\System\ZlSgBzn.exe
  2⤵
  PID:7024
- C:\Windows\System\oFsqISt.exe
  C:\Windows\System\oFsqISt.exe
  2⤵
  PID:7048
- C:\Windows\System\OTxdIfD.exe
  C:\Windows\System\OTxdIfD.exe
  2⤵
  PID:7080
- C:\Windows\System\rtLSJYU.exe
  C:\Windows\System\rtLSJYU.exe
  2⤵
  PID:7096
- C:\Windows\System\oxQUQQp.exe
  C:\Windows\System\oxQUQQp.exe
  2⤵
  PID:7124
- C:\Windows\System\bnNeQOc.exe
  C:\Windows\System\bnNeQOc.exe
  2⤵
  PID:7144
- C:\Windows\System\LpjyHHA.exe
  C:\Windows\System\LpjyHHA.exe
  2⤵
  PID:6104
- C:\Windows\System\hYfypxo.exe
  C:\Windows\System\hYfypxo.exe
  2⤵
  PID:5988
- C:\Windows\System\BQxwozr.exe
  C:\Windows\System\BQxwozr.exe
  2⤵
  PID:6176
- C:\Windows\System\NqIxblr.exe
  C:\Windows\System\NqIxblr.exe
  2⤵
  PID:6192
- C:\Windows\System\JsYcIFC.exe
  C:\Windows\System\JsYcIFC.exe
  2⤵
  PID:6232
- C:\Windows\System\rAOXaZF.exe
  C:\Windows\System\rAOXaZF.exe
  2⤵
  PID:6264
- C:\Windows\System\ABKARtN.exe
  C:\Windows\System\ABKARtN.exe
  2⤵
  PID:6276
- C:\Windows\System\jkxJwQK.exe
  C:\Windows\System\jkxJwQK.exe
  2⤵
  PID:6368
- C:\Windows\System\NURsyyo.exe
  C:\Windows\System\NURsyyo.exe
  2⤵
  PID:6416
- C:\Windows\System\kRmvnDj.exe
  C:\Windows\System\kRmvnDj.exe
  2⤵
  PID:6472
- C:\Windows\System\kjdyzmG.exe
  C:\Windows\System\kjdyzmG.exe
  2⤵
  PID:6528
- C:\Windows\System\kqZVHPD.exe
  C:\Windows\System\kqZVHPD.exe
  2⤵
  PID:6648
- C:\Windows\System\xywAsVF.exe
  C:\Windows\System\xywAsVF.exe
  2⤵
  PID:6856
- C:\Windows\System\yLhWYkD.exe
  C:\Windows\System\yLhWYkD.exe
  2⤵
  PID:6892
- C:\Windows\System\rDdodtd.exe
  C:\Windows\System\rDdodtd.exe
  2⤵
  PID:6960
- C:\Windows\System\kGTHbXx.exe
  C:\Windows\System\kGTHbXx.exe
  2⤵
  PID:7004
- C:\Windows\System\qiPlDxr.exe
  C:\Windows\System\qiPlDxr.exe
  2⤵
  PID:7044
- C:\Windows\System\MXdLpVP.exe
  C:\Windows\System\MXdLpVP.exe
  2⤵
  PID:7068
- C:\Windows\System\wrWBuWH.exe
  C:\Windows\System\wrWBuWH.exe
  2⤵
  PID:7088
- C:\Windows\System\ZFqLWNj.exe
  C:\Windows\System\ZFqLWNj.exe
  2⤵
  PID:7132
- C:\Windows\System\BwffHOR.exe
  C:\Windows\System\BwffHOR.exe
  2⤵
  PID:5408
- C:\Windows\System\yopVYJL.exe
  C:\Windows\System\yopVYJL.exe
  2⤵
  PID:6228
- C:\Windows\System\VzLpIWy.exe
  C:\Windows\System\VzLpIWy.exe
  2⤵
  PID:6208
- C:\Windows\System\MAwjxRD.exe
  C:\Windows\System\MAwjxRD.exe
  2⤵
  PID:6380
- C:\Windows\System\DcEpUee.exe
  C:\Windows\System\DcEpUee.exe
  2⤵
  PID:6492
- C:\Windows\System\yiTHljn.exe
  C:\Windows\System\yiTHljn.exe
  2⤵
  PID:6544
- C:\Windows\System\XRxeWBr.exe
  C:\Windows\System\XRxeWBr.exe
  2⤵
  PID:6700
- C:\Windows\System\QwljkeN.exe
  C:\Windows\System\QwljkeN.exe
  2⤵
  PID:6616
- C:\Windows\System\BIotrCw.exe
  C:\Windows\System\BIotrCw.exe
  2⤵
  PID:6680
- C:\Windows\System\LTolhDZ.exe
  C:\Windows\System\LTolhDZ.exe
  2⤵
  PID:6752
- C:\Windows\System\GYTbuuY.exe
  C:\Windows\System\GYTbuuY.exe
  2⤵
  PID:6936
- C:\Windows\System\THzKfrP.exe
  C:\Windows\System\THzKfrP.exe
  2⤵
  PID:7040
- C:\Windows\System\ODGBSZk.exe
  C:\Windows\System\ODGBSZk.exe
  2⤵
  PID:6984
- C:\Windows\System\tQginpw.exe
  C:\Windows\System\tQginpw.exe
  2⤵
  PID:7020
- C:\Windows\System\ifKDItX.exe
  C:\Windows\System\ifKDItX.exe
  2⤵
  PID:5164
- C:\Windows\System\iEwWbty.exe
  C:\Windows\System\iEwWbty.exe
  2⤵
  PID:6216
- C:\Windows\System\fbumnJY.exe
  C:\Windows\System\fbumnJY.exe
  2⤵
  PID:6212
- C:\Windows\System\ffwoRxL.exe
  C:\Windows\System\ffwoRxL.exe
  2⤵
  PID:6328
- C:\Windows\System\maoogBX.exe
  C:\Windows\System\maoogBX.exe
  2⤵
  PID:6696
- C:\Windows\System\dRbSvjP.exe
  C:\Windows\System\dRbSvjP.exe
  2⤵
  PID:6912
- C:\Windows\System\mRyImnp.exe
  C:\Windows\System\mRyImnp.exe
  2⤵
  PID:7076
- C:\Windows\System\pMveGjl.exe
  C:\Windows\System\pMveGjl.exe
  2⤵
  PID:6956
- C:\Windows\System\GSmEIeH.exe
  C:\Windows\System\GSmEIeH.exe
  2⤵
  PID:6628
- C:\Windows\System\faWSYTi.exe
  C:\Windows\System\faWSYTi.exe
  2⤵
  PID:6732
- C:\Windows\System\ISddoYJ.exe
  C:\Windows\System\ISddoYJ.exe
  2⤵
  PID:7016
- C:\Windows\System\gcwVcGJ.exe
  C:\Windows\System\gcwVcGJ.exe
  2⤵
  PID:6868
- C:\Windows\System\eGZOEid.exe
  C:\Windows\System\eGZOEid.exe
  2⤵
  PID:7036
- C:\Windows\System\bBvzjnY.exe
  C:\Windows\System\bBvzjnY.exe
  2⤵
  PID:6164
- C:\Windows\System\ttHkEnA.exe
  C:\Windows\System\ttHkEnA.exe
  2⤵
  PID:6824
- C:\Windows\System\kmcREQI.exe
  C:\Windows\System\kmcREQI.exe
  2⤵
  PID:7192
- C:\Windows\System\ImTFqIL.exe
  C:\Windows\System\ImTFqIL.exe
  2⤵
  PID:7292
- C:\Windows\System\KZZZyus.exe
  C:\Windows\System\KZZZyus.exe
  2⤵
  PID:7312
- C:\Windows\System\tPCzeOc.exe
  C:\Windows\System\tPCzeOc.exe
  2⤵
  PID:7328
- C:\Windows\System\KjHqYlw.exe
  C:\Windows\System\KjHqYlw.exe
  2⤵
  PID:7344
- C:\Windows\System\sTDDicQ.exe
  C:\Windows\System\sTDDicQ.exe
  2⤵
  PID:7364
- C:\Windows\System\LnhoVzy.exe
  C:\Windows\System\LnhoVzy.exe
  2⤵
  PID:7380
- C:\Windows\System\WduJrDd.exe
  C:\Windows\System\WduJrDd.exe
  2⤵
  PID:7396
- C:\Windows\System\rPLCmsv.exe
  C:\Windows\System\rPLCmsv.exe
  2⤵
  PID:7412
- C:\Windows\System\qqjoSng.exe
  C:\Windows\System\qqjoSng.exe
  2⤵
  PID:7428
- C:\Windows\System\jTWiViH.exe
  C:\Windows\System\jTWiViH.exe
  2⤵
  PID:7444
- C:\Windows\System\lggbLiC.exe
  C:\Windows\System\lggbLiC.exe
  2⤵
  PID:7468
- C:\Windows\System\OQVssnQ.exe
  C:\Windows\System\OQVssnQ.exe
  2⤵
  PID:7492
- C:\Windows\System\tYjiGhW.exe
  C:\Windows\System\tYjiGhW.exe
  2⤵
  PID:7556
- C:\Windows\System\EjigCxy.exe
  C:\Windows\System\EjigCxy.exe
  2⤵
  PID:7576
- C:\Windows\System\PoomqWC.exe
  C:\Windows\System\PoomqWC.exe
  2⤵
  PID:7596
- C:\Windows\System\LgDOFQA.exe
  C:\Windows\System\LgDOFQA.exe
  2⤵
  PID:7612
- C:\Windows\System\UAgvETJ.exe
  C:\Windows\System\UAgvETJ.exe
  2⤵
  PID:7628
- C:\Windows\System\alnEzGh.exe
  C:\Windows\System\alnEzGh.exe
  2⤵
  PID:7652
- C:\Windows\System\UDadjzw.exe
  C:\Windows\System\UDadjzw.exe
  2⤵
  PID:7672
- C:\Windows\System\bvXKHDk.exe
  C:\Windows\System\bvXKHDk.exe
  2⤵
  PID:7688
- C:\Windows\System\TjJTCpK.exe
  C:\Windows\System\TjJTCpK.exe
  2⤵
  PID:7712
- C:\Windows\System\cgStEqn.exe
  C:\Windows\System\cgStEqn.exe
  2⤵
  PID:7732
- C:\Windows\System\rObIJAi.exe
  C:\Windows\System\rObIJAi.exe
  2⤵
  PID:7748
- C:\Windows\System\srrsaMc.exe
  C:\Windows\System\srrsaMc.exe
  2⤵
  PID:7768
- C:\Windows\System\LjGXvlT.exe
  C:\Windows\System\LjGXvlT.exe
  2⤵
  PID:7784
- C:\Windows\System\QKFGVJZ.exe
  C:\Windows\System\QKFGVJZ.exe
  2⤵
  PID:7800
- C:\Windows\System\nXSaPdG.exe
  C:\Windows\System\nXSaPdG.exe
  2⤵
  PID:7820
- C:\Windows\System\vnpFwTT.exe
  C:\Windows\System\vnpFwTT.exe
  2⤵
  PID:7856
- C:\Windows\System\jmLZkdB.exe
  C:\Windows\System\jmLZkdB.exe
  2⤵
  PID:7888
- C:\Windows\System\pdhHRFa.exe
  C:\Windows\System\pdhHRFa.exe
  2⤵
  PID:7908
- C:\Windows\System\uxsXRHF.exe
  C:\Windows\System\uxsXRHF.exe
  2⤵
  PID:7924
- C:\Windows\System\Irrzutc.exe
  C:\Windows\System\Irrzutc.exe
  2⤵
  PID:7940
- C:\Windows\System\PNgxLwg.exe
  C:\Windows\System\PNgxLwg.exe
  2⤵
  PID:7956
- C:\Windows\System\zJNOCQs.exe
  C:\Windows\System\zJNOCQs.exe
  2⤵
  PID:7972
- C:\Windows\System\TVZJgmN.exe
  C:\Windows\System\TVZJgmN.exe
  2⤵
  PID:7988
- C:\Windows\System\QAASqNm.exe
  C:\Windows\System\QAASqNm.exe
  2⤵
  PID:8004
- C:\Windows\System\BnottAz.exe
  C:\Windows\System\BnottAz.exe
  2⤵
  PID:8024
- C:\Windows\System\BluQTVO.exe
  C:\Windows\System\BluQTVO.exe
  2⤵
  PID:8040
- C:\Windows\System\XLLKTaE.exe
  C:\Windows\System\XLLKTaE.exe
  2⤵
  PID:8056
- C:\Windows\System\BKQKOlr.exe
  C:\Windows\System\BKQKOlr.exe
  2⤵
  PID:8072
- C:\Windows\System\AVWXbUp.exe
  C:\Windows\System\AVWXbUp.exe
  2⤵
  PID:8088
- C:\Windows\System\FgyLgwO.exe
  C:\Windows\System\FgyLgwO.exe
  2⤵
  PID:8104
- C:\Windows\System\zjOAWpJ.exe
  C:\Windows\System\zjOAWpJ.exe
  2⤵
  PID:8120
- C:\Windows\System\CajqSfP.exe
  C:\Windows\System\CajqSfP.exe
  2⤵
  PID:8136
- C:\Windows\System\skLApsX.exe
  C:\Windows\System\skLApsX.exe
  2⤵
  PID:8152
- C:\Windows\System\CvkplWh.exe
  C:\Windows\System\CvkplWh.exe
  2⤵
  PID:8168
- C:\Windows\System\ooCFfeu.exe
  C:\Windows\System\ooCFfeu.exe
  2⤵
  PID:8184
- C:\Windows\System\ujjciHY.exe
  C:\Windows\System\ujjciHY.exe
  2⤵
  PID:7140
- C:\Windows\System\jQmtGHj.exe
  C:\Windows\System\jQmtGHj.exe
  2⤵
  PID:7180
- C:\Windows\System\LLrGEiw.exe
  C:\Windows\System\LLrGEiw.exe
  2⤵
  PID:7208
- C:\Windows\System\XotekRt.exe
  C:\Windows\System\XotekRt.exe
  2⤵
  PID:7224
- C:\Windows\System\NbHwNyI.exe
  C:\Windows\System\NbHwNyI.exe
  2⤵
  PID:7244
- C:\Windows\System\XGpjYwT.exe
  C:\Windows\System\XGpjYwT.exe
  2⤵
  PID:7260
- C:\Windows\System\zpLdhPD.exe
  C:\Windows\System\zpLdhPD.exe
  2⤵
  PID:7276
- C:\Windows\System\ljcvKRy.exe
  C:\Windows\System\ljcvKRy.exe
  2⤵
  PID:7300
- C:\Windows\System\OvyybRR.exe
  C:\Windows\System\OvyybRR.exe
  2⤵
  PID:7352
- C:\Windows\System\jNPDEhg.exe
  C:\Windows\System\jNPDEhg.exe
  2⤵
  PID:7340
- C:\Windows\System\izBPcQU.exe
  C:\Windows\System\izBPcQU.exe
  2⤵
  PID:7308
- C:\Windows\System\RaOgAUS.exe
  C:\Windows\System\RaOgAUS.exe
  2⤵
  PID:7420
- C:\Windows\System\osUuALf.exe
  C:\Windows\System\osUuALf.exe
  2⤵
  PID:7436
- C:\Windows\System\eLERITB.exe
  C:\Windows\System\eLERITB.exe
  2⤵
  PID:7476
- C:\Windows\System\HbcAwhu.exe
  C:\Windows\System\HbcAwhu.exe
  2⤵
  PID:7500
- C:\Windows\System\rFDPxBV.exe
  C:\Windows\System\rFDPxBV.exe
  2⤵
  PID:7520
- C:\Windows\System\YdRxtLG.exe
  C:\Windows\System\YdRxtLG.exe
  2⤵
  PID:7536
- C:\Windows\System\gpbQKoK.exe
  C:\Windows\System\gpbQKoK.exe
  2⤵
  PID:7548
- C:\Windows\System\YkeijJf.exe
  C:\Windows\System\YkeijJf.exe
  2⤵
  PID:7588
- C:\Windows\System\oRZYpIL.exe
  C:\Windows\System\oRZYpIL.exe
  2⤵
  PID:7572
- C:\Windows\System\JpNTtAK.exe
  C:\Windows\System\JpNTtAK.exe
  2⤵
  PID:7624
- C:\Windows\System\bMXLnJV.exe
  C:\Windows\System\bMXLnJV.exe
  2⤵
  PID:7660
- C:\Windows\System\VAlHtVc.exe
  C:\Windows\System\VAlHtVc.exe
  2⤵
  PID:7680
- C:\Windows\System\mcOArvN.exe
  C:\Windows\System\mcOArvN.exe
  2⤵
  PID:7704
- C:\Windows\System\gjSrpVC.exe
  C:\Windows\System\gjSrpVC.exe
  2⤵
  PID:7756
- C:\Windows\System\mlnuDGW.exe
  C:\Windows\System\mlnuDGW.exe
  2⤵
  PID:7760
- C:\Windows\System\aMNuszY.exe
  C:\Windows\System\aMNuszY.exe
  2⤵
  PID:7808
- C:\Windows\System\juOfZsL.exe
  C:\Windows\System\juOfZsL.exe
  2⤵
  PID:7816
- C:\Windows\System\SndoefY.exe
  C:\Windows\System\SndoefY.exe
  2⤵
  PID:7840
- C:\Windows\System\OXbhqIX.exe
  C:\Windows\System\OXbhqIX.exe
  2⤵
  PID:7864
- C:\Windows\System\yanZEow.exe
  C:\Windows\System\yanZEow.exe
  2⤵
  PID:7880
- C:\Windows\System\DGLKblY.exe
  C:\Windows\System\DGLKblY.exe
  2⤵
  PID:7900
- C:\Windows\System\DeJckix.exe
  C:\Windows\System\DeJckix.exe
  2⤵
  PID:7952
- C:\Windows\System\GXdxAWA.exe
  C:\Windows\System\GXdxAWA.exe
  2⤵
  PID:7984
- C:\Windows\System\XImHhYh.exe
  C:\Windows\System\XImHhYh.exe
  2⤵
  PID:7964
- C:\Windows\System\QozIqRn.exe
  C:\Windows\System\QozIqRn.exe
  2⤵
  PID:8048
- C:\Windows\System\DwJuKid.exe
  C:\Windows\System\DwJuKid.exe
  2⤵
  PID:8112
- C:\Windows\System\yYxqtOm.exe
  C:\Windows\System\yYxqtOm.exe
  2⤵
  PID:8180
- C:\Windows\System\iorbUbm.exe
  C:\Windows\System\iorbUbm.exe
  2⤵
  PID:8036
- C:\Windows\System\qwGdGHE.exe
  C:\Windows\System\qwGdGHE.exe
  2⤵
  PID:6560
- C:\Windows\System\STAUBUH.exe
  C:\Windows\System\STAUBUH.exe
  2⤵
  PID:8132
- C:\Windows\System\jEfwXDQ.exe
  C:\Windows\System\jEfwXDQ.exe
  2⤵
  PID:7216
- C:\Windows\System\NBmMAcj.exe
  C:\Windows\System\NBmMAcj.exe
  2⤵
  PID:7240
- C:\Windows\System\TueGbMI.exe
  C:\Windows\System\TueGbMI.exe
  2⤵
  PID:7268
- C:\Windows\System\UmKJpVj.exe
  C:\Windows\System\UmKJpVj.exe
  2⤵
  PID:7320
- C:\Windows\System\bjvmBHD.exe
  C:\Windows\System\bjvmBHD.exe
  2⤵
  PID:7372
- C:\Windows\System\MSPpGfk.exe
  C:\Windows\System\MSPpGfk.exe
  2⤵
  PID:7456
- C:\Windows\System\ybLCsnl.exe
  C:\Windows\System\ybLCsnl.exe
  2⤵
  PID:7568
- C:\Windows\System\vRIxzor.exe
  C:\Windows\System\vRIxzor.exe
  2⤵
  PID:7452
- C:\Windows\System\MBVPRhZ.exe
  C:\Windows\System\MBVPRhZ.exe
  2⤵
  PID:7744
- C:\Windows\System\RUWRfXY.exe
  C:\Windows\System\RUWRfXY.exe
  2⤵
  PID:7852
- C:\Windows\System\HoOZZub.exe
  C:\Windows\System\HoOZZub.exe
  2⤵
  PID:6456
- C:\Windows\System\qQgLCfE.exe
  C:\Windows\System\qQgLCfE.exe
  2⤵
  PID:7668
- C:\Windows\System\SvSxMAc.exe
  C:\Windows\System\SvSxMAc.exe
  2⤵
  PID:7764
- C:\Windows\System\XzWLZVz.exe
  C:\Windows\System\XzWLZVz.exe
  2⤵
  PID:7872
- C:\Windows\System\LifbLXe.exe
  C:\Windows\System\LifbLXe.exe
  2⤵
  PID:7920
- C:\Windows\System\TrhmTbE.exe
  C:\Windows\System\TrhmTbE.exe
  2⤵
  PID:8016
- C:\Windows\System\vnFPkUo.exe
  C:\Windows\System\vnFPkUo.exe
  2⤵
  PID:8176
- C:\Windows\System\FbPzKUT.exe
  C:\Windows\System\FbPzKUT.exe
  2⤵
  PID:7812
- C:\Windows\System\EoAyRTK.exe
  C:\Windows\System\EoAyRTK.exe
  2⤵
  PID:7608
- C:\Windows\System\ugfApDE.exe
  C:\Windows\System\ugfApDE.exe
  2⤵
  PID:7948
- C:\Windows\System\tGfJqUR.exe
  C:\Windows\System\tGfJqUR.exe
  2⤵
  PID:7996
- C:\Windows\System\wYrfkxg.exe
  C:\Windows\System\wYrfkxg.exe
  2⤵
  PID:7256
- C:\Windows\System\ifLBkUL.exe
  C:\Windows\System\ifLBkUL.exe
  2⤵
  PID:8128
- C:\Windows\System\VgJISBm.exe
  C:\Windows\System\VgJISBm.exe
  2⤵
  PID:7220
- C:\Windows\System\NPNqkIx.exe
  C:\Windows\System\NPNqkIx.exe
  2⤵
  PID:7408
- C:\Windows\System\ImfAPxO.exe
  C:\Windows\System\ImfAPxO.exe
  2⤵
  PID:7528
- C:\Windows\System\MewVRZL.exe
  C:\Windows\System\MewVRZL.exe
  2⤵
  PID:7728
- C:\Windows\System\jTUsTcl.exe
  C:\Windows\System\jTUsTcl.exe
  2⤵
  PID:7792
- C:\Windows\System\UZYDOsm.exe
  C:\Windows\System\UZYDOsm.exe
  2⤵
  PID:7188
- C:\Windows\System\vWhXbus.exe
  C:\Windows\System\vWhXbus.exe
  2⤵
  PID:7832
- C:\Windows\System\UNkvcaJ.exe
  C:\Windows\System\UNkvcaJ.exe
  2⤵
  PID:8096
- C:\Windows\System\ZLIGAsC.exe
  C:\Windows\System\ZLIGAsC.exe
  2⤵
  PID:7324
- C:\Windows\System\DFrBMHK.exe
  C:\Windows\System\DFrBMHK.exe
  2⤵
  PID:7544
- C:\Windows\System\tElofCl.exe
  C:\Windows\System\tElofCl.exe
  2⤵
  PID:7836
- C:\Windows\System\crWJgLJ.exe
  C:\Windows\System\crWJgLJ.exe
  2⤵
  PID:8196
- C:\Windows\System\xTdIidA.exe
  C:\Windows\System\xTdIidA.exe
  2⤵
  PID:8212
- C:\Windows\System\KVkIzeV.exe
  C:\Windows\System\KVkIzeV.exe
  2⤵
  PID:8232
- C:\Windows\System\JmBvVfw.exe
  C:\Windows\System\JmBvVfw.exe
  2⤵
  PID:8252
- C:\Windows\System\FZYGjop.exe
  C:\Windows\System\FZYGjop.exe
  2⤵
  PID:8272
- C:\Windows\System\NaKhiqB.exe
  C:\Windows\System\NaKhiqB.exe
  2⤵
  PID:8292
- C:\Windows\System\mJaSCDK.exe
  C:\Windows\System\mJaSCDK.exe
  2⤵
  PID:8316
- C:\Windows\System\mwPbSyA.exe
  C:\Windows\System\mwPbSyA.exe
  2⤵
  PID:8384
- C:\Windows\System\tpfXQqf.exe
  C:\Windows\System\tpfXQqf.exe
  2⤵
  PID:8444
- C:\Windows\System\VGzNgNY.exe
  C:\Windows\System\VGzNgNY.exe
  2⤵
  PID:8460
- C:\Windows\System\OqDAmgG.exe
  C:\Windows\System\OqDAmgG.exe
  2⤵
  PID:8476
- C:\Windows\System\grXiNOU.exe
  C:\Windows\System\grXiNOU.exe
  2⤵
  PID:8492
- C:\Windows\System\OKfAYlo.exe
  C:\Windows\System\OKfAYlo.exe
  2⤵
  PID:8508
- C:\Windows\System\qRETYtl.exe
  C:\Windows\System\qRETYtl.exe
  2⤵
  PID:8524
- C:\Windows\System\gNqzgFR.exe
  C:\Windows\System\gNqzgFR.exe
  2⤵
  PID:8540
- C:\Windows\System\EJxHZtQ.exe
  C:\Windows\System\EJxHZtQ.exe
  2⤵
  PID:8556
- C:\Windows\System\rybPgqZ.exe
  C:\Windows\System\rybPgqZ.exe
  2⤵
  PID:8572
- C:\Windows\System\yZJXCQP.exe
  C:\Windows\System\yZJXCQP.exe
  2⤵
  PID:8588
- C:\Windows\System\vdEAQIj.exe
  C:\Windows\System\vdEAQIj.exe
  2⤵
  PID:8604
- C:\Windows\System\ruKcjSg.exe
  C:\Windows\System\ruKcjSg.exe
  2⤵
  PID:8624
- C:\Windows\System\rguquqd.exe
  C:\Windows\System\rguquqd.exe
  2⤵
  PID:8640
- C:\Windows\System\pByyEMD.exe
  C:\Windows\System\pByyEMD.exe
  2⤵
  PID:8656
- C:\Windows\System\ljilXth.exe
  C:\Windows\System\ljilXth.exe
  2⤵
  PID:8672
- C:\Windows\System\YWfiGdM.exe
  C:\Windows\System\YWfiGdM.exe
  2⤵
  PID:8688
- C:\Windows\System\PzIqdqb.exe
  C:\Windows\System\PzIqdqb.exe
  2⤵
  PID:8704
- C:\Windows\System\LOUDkbV.exe
  C:\Windows\System\LOUDkbV.exe
  2⤵
  PID:8724
- C:\Windows\System\NBqyaZJ.exe
  C:\Windows\System\NBqyaZJ.exe
  2⤵
  PID:8744
- C:\Windows\System\fjIRgBp.exe
  C:\Windows\System\fjIRgBp.exe
  2⤵
  PID:8760
- C:\Windows\System\lCKbdhN.exe
  C:\Windows\System\lCKbdhN.exe
  2⤵
  PID:8780
- C:\Windows\System\eUHfpAj.exe
  C:\Windows\System\eUHfpAj.exe
  2⤵
  PID:8796
- C:\Windows\System\eLbezBb.exe
  C:\Windows\System\eLbezBb.exe
  2⤵
  PID:8812
- C:\Windows\System\iEtNRJH.exe
  C:\Windows\System\iEtNRJH.exe
  2⤵
  PID:8828
- C:\Windows\System\hqGRrcr.exe
  C:\Windows\System\hqGRrcr.exe
  2⤵
  PID:8844
- C:\Windows\System\cybRkUx.exe
  C:\Windows\System\cybRkUx.exe
  2⤵
  PID:8864
- C:\Windows\System\ItnLlHl.exe
  C:\Windows\System\ItnLlHl.exe
  2⤵
  PID:8880
- C:\Windows\System\BIvGndP.exe
  C:\Windows\System\BIvGndP.exe
  2⤵
  PID:8896
- C:\Windows\System\OcDiuph.exe
  C:\Windows\System\OcDiuph.exe
  2⤵
  PID:8916
- C:\Windows\System\jRguUqC.exe
  C:\Windows\System\jRguUqC.exe
  2⤵
  PID:8932
- C:\Windows\System\DuSIXhX.exe
  C:\Windows\System\DuSIXhX.exe
  2⤵
  PID:8948
- C:\Windows\System\vjEZPFI.exe
  C:\Windows\System\vjEZPFI.exe
  2⤵
  PID:8968
- C:\Windows\System\pUerqtZ.exe
  C:\Windows\System\pUerqtZ.exe
  2⤵
  PID:8984
- C:\Windows\System\YkuRYSR.exe
  C:\Windows\System\YkuRYSR.exe
  2⤵
  PID:9000
- C:\Windows\System\UyemCRX.exe
  C:\Windows\System\UyemCRX.exe
  2⤵
  PID:9024
- C:\Windows\System\wLeNHIF.exe
  C:\Windows\System\wLeNHIF.exe
  2⤵
  PID:9040
- C:\Windows\System\TAZRmFq.exe
  C:\Windows\System\TAZRmFq.exe
  2⤵
  PID:9056
- C:\Windows\System\ydoGwph.exe
  C:\Windows\System\ydoGwph.exe
  2⤵
  PID:9072
- C:\Windows\System\EuQGBHv.exe
  C:\Windows\System\EuQGBHv.exe
  2⤵
  PID:9092
- C:\Windows\System\yCSkmiu.exe
  C:\Windows\System\yCSkmiu.exe
  2⤵
  PID:9116
- C:\Windows\System\TfAmvto.exe
  C:\Windows\System\TfAmvto.exe
  2⤵
  PID:9132
- C:\Windows\System\GSsiGKA.exe
  C:\Windows\System\GSsiGKA.exe
  2⤵
  PID:9152
- C:\Windows\System\SpdfBBL.exe
  C:\Windows\System\SpdfBBL.exe
  2⤵
  PID:9172
- C:\Windows\System\PvvvKYU.exe
  C:\Windows\System\PvvvKYU.exe
  2⤵
  PID:9188
- C:\Windows\System\sfRdaQk.exe
  C:\Windows\System\sfRdaQk.exe
  2⤵
  PID:9204
- C:\Windows\System\KuKGuqZ.exe
  C:\Windows\System\KuKGuqZ.exe
  2⤵
  PID:7204
- C:\Windows\System\WoLyKkg.exe
  C:\Windows\System\WoLyKkg.exe
  2⤵
  PID:8144
- C:\Windows\System\dkMmduT.exe
  C:\Windows\System\dkMmduT.exe
  2⤵
  PID:7876
- C:\Windows\System\oRyiKAJ.exe
  C:\Windows\System\oRyiKAJ.exe
  2⤵
  PID:8204
- C:\Windows\System\hqNdIct.exe
  C:\Windows\System\hqNdIct.exe
  2⤵
  PID:8148
- C:\Windows\System\RQvveOh.exe
  C:\Windows\System\RQvveOh.exe
  2⤵
  PID:8280
- C:\Windows\System\ZqfQtee.exe
  C:\Windows\System\ZqfQtee.exe
  2⤵
  PID:8312
- C:\Windows\System\PmtXhkH.exe
  C:\Windows\System\PmtXhkH.exe
  2⤵
  PID:8336
- C:\Windows\System\WhVgmds.exe
  C:\Windows\System\WhVgmds.exe
  2⤵
  PID:8348
- C:\Windows\System\UjzpghV.exe
  C:\Windows\System\UjzpghV.exe
  2⤵
  PID:8376
- C:\Windows\System\AhyrXid.exe
  C:\Windows\System\AhyrXid.exe
  2⤵
  PID:8396
- C:\Windows\System\BuOFDqU.exe
  C:\Windows\System\BuOFDqU.exe
  2⤵
  PID:8416
- C:\Windows\System\uawuHZE.exe
  C:\Windows\System\uawuHZE.exe
  2⤵
  PID:8428
- C:\Windows\System\XawIAux.exe
  C:\Windows\System\XawIAux.exe
  2⤵
  PID:8452
- C:\Windows\System\BDBFfkE.exe
  C:\Windows\System\BDBFfkE.exe
  2⤵
  PID:8484
- C:\Windows\System\AwiGkkY.exe
  C:\Windows\System\AwiGkkY.exe
  2⤵
  PID:8536
- C:\Windows\System\tVGXLEx.exe
  C:\Windows\System\tVGXLEx.exe
  2⤵
  PID:8520
- C:\Windows\System\mUISOlH.exe
  C:\Windows\System\mUISOlH.exe
  2⤵
  PID:8584
- C:\Windows\System\sTFBDkJ.exe
  C:\Windows\System\sTFBDkJ.exe
  2⤵
  PID:8620
- C:\Windows\System\pZtFTLI.exe
  C:\Windows\System\pZtFTLI.exe
  2⤵
  PID:8664
- C:\Windows\System\CgHrNvJ.exe
  C:\Windows\System\CgHrNvJ.exe
  2⤵
  PID:8680
- C:\Windows\System\WPdBewR.exe
  C:\Windows\System\WPdBewR.exe
  2⤵
  PID:8740
- C:\Windows\System\KUkfyHA.exe
  C:\Windows\System\KUkfyHA.exe
  2⤵
  PID:8772
- C:\Windows\System\CAFkYUa.exe
  C:\Windows\System\CAFkYUa.exe
  2⤵
  PID:8840
- C:\Windows\System\ToJaLVB.exe
  C:\Windows\System\ToJaLVB.exe
  2⤵
  PID:8852
- C:\Windows\System\xvsjKcq.exe
  C:\Windows\System\xvsjKcq.exe
  2⤵
  PID:8908
- C:\Windows\System\HOmMglX.exe
  C:\Windows\System\HOmMglX.exe
  2⤵
  PID:8888
- C:\Windows\System\wjbRPwo.exe
  C:\Windows\System\wjbRPwo.exe
  2⤵
  PID:8928
- C:\Windows\System\lPDAcXZ.exe
  C:\Windows\System\lPDAcXZ.exe
  2⤵
  PID:8992
- C:\Windows\System\lIWgMme.exe
  C:\Windows\System\lIWgMme.exe
  2⤵
  PID:9020
- C:\Windows\System\RPltplR.exe
  C:\Windows\System\RPltplR.exe
  2⤵
  PID:9088
- C:\Windows\System\EpyPHVA.exe
  C:\Windows\System\EpyPHVA.exe
  2⤵
  PID:9036
- C:\Windows\System\dyvxoNy.exe
  C:\Windows\System\dyvxoNy.exe
  2⤵
  PID:9104
- C:\Windows\System\PwSAQbG.exe
  C:\Windows\System\PwSAQbG.exe
  2⤵
  PID:9180
- C:\Windows\System\ZQADUuP.exe
  C:\Windows\System\ZQADUuP.exe
  2⤵
  PID:7288
- C:\Windows\System\Hbnusrd.exe
  C:\Windows\System\Hbnusrd.exe
  2⤵
  PID:7484
- C:\Windows\System\vXMMHGJ.exe
  C:\Windows\System\vXMMHGJ.exe
  2⤵
  PID:8268
- C:\Windows\System\AegWdCv.exe
  C:\Windows\System\AegWdCv.exe
  2⤵
  PID:8360
- C:\Windows\System\PHfIgty.exe
  C:\Windows\System\PHfIgty.exe
  2⤵
  PID:8408
- C:\Windows\System\wnodWgR.exe
  C:\Windows\System\wnodWgR.exe
  2⤵
  PID:8304
- C:\Windows\System\sDqZowT.exe
  C:\Windows\System\sDqZowT.exe
  2⤵
  PID:8392
- C:\Windows\System\CouwXHG.exe
  C:\Windows\System\CouwXHG.exe
  2⤵
  PID:8568
- C:\Windows\System\DHFIFYD.exe
  C:\Windows\System\DHFIFYD.exe
  2⤵
  PID:8344
- C:\Windows\System\hgVKOCI.exe
  C:\Windows\System\hgVKOCI.exe
  2⤵
  PID:8636
- C:\Windows\System\VMWNGAH.exe
  C:\Windows\System\VMWNGAH.exe
  2⤵
  PID:8756
- C:\Windows\System\omYmTAB.exe
  C:\Windows\System\omYmTAB.exe
  2⤵
  PID:8516
- C:\Windows\System\EEyltiv.exe
  C:\Windows\System\EEyltiv.exe
  2⤵
  PID:8600
- C:\Windows\System\DRPqqEj.exe
  C:\Windows\System\DRPqqEj.exe
  2⤵
  PID:8808
- C:\Windows\System\iWvJRlP.exe
  C:\Windows\System\iWvJRlP.exe
  2⤵
  PID:9008
- C:\Windows\System\wRWTBWj.exe
  C:\Windows\System\wRWTBWj.exe
  2⤵
  PID:8976
- C:\Windows\System\dWLZege.exe
  C:\Windows\System\dWLZege.exe
  2⤵
  PID:9168
- C:\Windows\System\dmlADUV.exe
  C:\Windows\System\dmlADUV.exe
  2⤵
  PID:7376
- C:\Windows\System\uHUzIvW.exe
  C:\Windows\System\uHUzIvW.exe
  2⤵
  PID:8264
- C:\Windows\System\dkeoyVO.exe
  C:\Windows\System\dkeoyVO.exe
  2⤵
  PID:8420
- C:\Windows\System\uBJllDM.exe
  C:\Windows\System\uBJllDM.exe
  2⤵
  PID:8364
- C:\Windows\System\XuXsjaq.exe
  C:\Windows\System\XuXsjaq.exe
  2⤵
  PID:8580
- C:\Windows\System\MyicOfJ.exe
  C:\Windows\System\MyicOfJ.exe
  2⤵
  PID:2348
- C:\Windows\System\rfOHOBI.exe
  C:\Windows\System\rfOHOBI.exe
  2⤵
  PID:8684
- C:\Windows\System\XhGqMdZ.exe
  C:\Windows\System\XhGqMdZ.exe
  2⤵
  PID:8892
- C:\Windows\System\zbAKuXk.exe
  C:\Windows\System\zbAKuXk.exe
  2⤵
  PID:8996
- C:\Windows\System\JEqlZug.exe
  C:\Windows\System\JEqlZug.exe
  2⤵
  PID:9016
- C:\Windows\System\gOXpSLb.exe
  C:\Windows\System\gOXpSLb.exe
  2⤵
  PID:8372
- C:\Windows\System\drRuUey.exe
  C:\Windows\System\drRuUey.exe
  2⤵
  PID:8404
- C:\Windows\System\nCcTqKT.exe
  C:\Windows\System\nCcTqKT.exe
  2⤵
  PID:8732
- C:\Windows\System\iOWbmgZ.exe
  C:\Windows\System\iOWbmgZ.exe
  2⤵
  PID:8836
- C:\Windows\System\IyNYYds.exe
  C:\Windows\System\IyNYYds.exe
  2⤵
  PID:9032
- C:\Windows\System\jmrMEFj.exe
  C:\Windows\System\jmrMEFj.exe
  2⤵
  PID:8332
- C:\Windows\System\CKDCfzd.exe
  C:\Windows\System\CKDCfzd.exe
  2⤵
  PID:8424
- C:\Windows\System\DpobzlY.exe
  C:\Windows\System\DpobzlY.exe
  2⤵
  PID:8548
- C:\Windows\System\SbUQpOL.exe
  C:\Windows\System\SbUQpOL.exe
  2⤵
  PID:9212
- C:\Windows\System\xDMLvwd.exe
  C:\Windows\System\xDMLvwd.exe
  2⤵
  PID:8248
- C:\Windows\System\aXvfzQZ.exe
  C:\Windows\System\aXvfzQZ.exe
  2⤵
  PID:8696
- C:\Windows\System\ZRdtTfc.exe
  C:\Windows\System\ZRdtTfc.exe
  2⤵
  PID:8456
- C:\Windows\System\UChPwSm.exe
  C:\Windows\System\UChPwSm.exe
  2⤵
  PID:9220
- C:\Windows\System\jagGajh.exe
  C:\Windows\System\jagGajh.exe
  2⤵
  PID:9236
- C:\Windows\System\MnIULVt.exe
  C:\Windows\System\MnIULVt.exe
  2⤵
  PID:9252
- C:\Windows\System\rNbxKmf.exe
  C:\Windows\System\rNbxKmf.exe
  2⤵
  PID:9272
- C:\Windows\System\nHWMqIT.exe
  C:\Windows\System\nHWMqIT.exe
  2⤵
  PID:9312
- C:\Windows\System\PWEyUNw.exe
  C:\Windows\System\PWEyUNw.exe
  2⤵
  PID:9328
- C:\Windows\System\iXKWDOa.exe
  C:\Windows\System\iXKWDOa.exe
  2⤵
  PID:9344
- C:\Windows\System\zxtUkHX.exe
  C:\Windows\System\zxtUkHX.exe
  2⤵
  PID:9364
- C:\Windows\System\xHaduHx.exe
  C:\Windows\System\xHaduHx.exe
  2⤵
  PID:9384
- C:\Windows\System\CmVQCkV.exe
  C:\Windows\System\CmVQCkV.exe
  2⤵
  PID:9412
- C:\Windows\System\CcehKou.exe
  C:\Windows\System\CcehKou.exe
  2⤵
  PID:9432
- C:\Windows\System\qVISETc.exe
  C:\Windows\System\qVISETc.exe
  2⤵
  PID:9448
- C:\Windows\System\drwfNGL.exe
  C:\Windows\System\drwfNGL.exe
  2⤵
  PID:9468
- C:\Windows\System\muRPWgO.exe
  C:\Windows\System\muRPWgO.exe
  2⤵
  PID:9488
- C:\Windows\System\nuAtKJv.exe
  C:\Windows\System\nuAtKJv.exe
  2⤵
  PID:9504
- C:\Windows\System\OmdzLQz.exe
  C:\Windows\System\OmdzLQz.exe
  2⤵
  PID:9536
- C:\Windows\System\rTtRzOf.exe
  C:\Windows\System\rTtRzOf.exe
  2⤵
  PID:9552
- C:\Windows\System\aepWFjt.exe
  C:\Windows\System\aepWFjt.exe
  2⤵
  PID:9580
- C:\Windows\System\kGvFaes.exe
  C:\Windows\System\kGvFaes.exe
  2⤵
  PID:9596
- C:\Windows\System\RRihcAW.exe
  C:\Windows\System\RRihcAW.exe
  2⤵
  PID:9616
- C:\Windows\System\SVdtzlg.exe
  C:\Windows\System\SVdtzlg.exe
  2⤵
  PID:9632
- C:\Windows\System\OLaKMCf.exe
  C:\Windows\System\OLaKMCf.exe
  2⤵
  PID:9648
- C:\Windows\System\gKkdeSz.exe
  C:\Windows\System\gKkdeSz.exe
  2⤵
  PID:9680
- C:\Windows\System\oFnckin.exe
  C:\Windows\System\oFnckin.exe
  2⤵
  PID:9696
- C:\Windows\System\zXdRExc.exe
  C:\Windows\System\zXdRExc.exe
  2⤵
  PID:9712
- C:\Windows\System\eBXvZtd.exe
  C:\Windows\System\eBXvZtd.exe
  2⤵
  PID:9732
- C:\Windows\System\mRlhcAr.exe
  C:\Windows\System\mRlhcAr.exe
  2⤵
  PID:9764
- C:\Windows\System\LQNatiH.exe
  C:\Windows\System\LQNatiH.exe
  2⤵
  PID:9780
- C:\Windows\System\YfnbipA.exe
  C:\Windows\System\YfnbipA.exe
  2⤵
  PID:9796
- C:\Windows\System\UVRPBWY.exe
  C:\Windows\System\UVRPBWY.exe
  2⤵
  PID:9812
- C:\Windows\System\kLCFucc.exe
  C:\Windows\System\kLCFucc.exe
  2⤵
  PID:9832
- C:\Windows\System\RccFLfF.exe
  C:\Windows\System\RccFLfF.exe
  2⤵
  PID:9864
- C:\Windows\System\JukQIQX.exe
  C:\Windows\System\JukQIQX.exe
  2⤵
  PID:9880
- C:\Windows\System\stlnzoi.exe
  C:\Windows\System\stlnzoi.exe
  2⤵
  PID:9896
- C:\Windows\System\LnfzChl.exe
  C:\Windows\System\LnfzChl.exe
  2⤵
  PID:9912
- C:\Windows\System\ODvqefQ.exe
  C:\Windows\System\ODvqefQ.exe
  2⤵
  PID:9948
- C:\Windows\System\NKzYDjZ.exe
  C:\Windows\System\NKzYDjZ.exe
  2⤵
  PID:9964
- C:\Windows\System\FmxLOzs.exe
  C:\Windows\System\FmxLOzs.exe
  2⤵
  PID:9980
- C:\Windows\System\TihfjVB.exe
  C:\Windows\System\TihfjVB.exe
  2⤵
  PID:10004
- C:\Windows\System\jNmXCqd.exe
  C:\Windows\System\jNmXCqd.exe
  2⤵
  PID:10020
- C:\Windows\System\oGEenmQ.exe
  C:\Windows\System\oGEenmQ.exe
  2⤵
  PID:10036
- C:\Windows\System\UhXSWsb.exe
  C:\Windows\System\UhXSWsb.exe
  2⤵
  PID:10056
- C:\Windows\System\PZzosKK.exe
  C:\Windows\System\PZzosKK.exe
  2⤵
  PID:10088
- C:\Windows\System\AZzaayZ.exe
  C:\Windows\System\AZzaayZ.exe
  2⤵
  PID:10104
- C:\Windows\System\ibDWsao.exe
  C:\Windows\System\ibDWsao.exe
  2⤵
  PID:10120
- C:\Windows\System\ncvcoFk.exe
  C:\Windows\System\ncvcoFk.exe
  2⤵
  PID:10136
- C:\Windows\System\YMXbZwZ.exe
  C:\Windows\System\YMXbZwZ.exe
  2⤵
  PID:10160
- C:\Windows\System\wckBvkN.exe
  C:\Windows\System\wckBvkN.exe
  2⤵
  PID:10180
- C:\Windows\System\AyLSoDH.exe
  C:\Windows\System\AyLSoDH.exe
  2⤵
  PID:10200
- C:\Windows\System\AXLRkFK.exe
  C:\Windows\System\AXLRkFK.exe
  2⤵
  PID:10232
- C:\Windows\System\Cpvntws.exe
  C:\Windows\System\Cpvntws.exe
  2⤵
  PID:8440
- C:\Windows\System\dNecGrq.exe
  C:\Windows\System\dNecGrq.exe
  2⤵
  PID:9264
- C:\Windows\System\dgTgSUH.exe
  C:\Windows\System\dgTgSUH.exe
  2⤵
  PID:9296
- C:\Windows\System\VxewrXQ.exe
  C:\Windows\System\VxewrXQ.exe
  2⤵
  PID:9324
- C:\Windows\System\NJkNUBq.exe
  C:\Windows\System\NJkNUBq.exe
  2⤵
  PID:9376
- C:\Windows\System\zTBbPIO.exe
  C:\Windows\System\zTBbPIO.exe
  2⤵
  PID:9360
- C:\Windows\System\FiONmIN.exe
  C:\Windows\System\FiONmIN.exe
  2⤵
  PID:9424
- C:\Windows\System\MLKsqZn.exe
  C:\Windows\System\MLKsqZn.exe
  2⤵
  PID:9460
- C:\Windows\System\itzopee.exe
  C:\Windows\System\itzopee.exe
  2⤵
  PID:9484
- C:\Windows\System\ZssBLwW.exe
  C:\Windows\System\ZssBLwW.exe
  2⤵
  PID:9516
- C:\Windows\System\shxxBzP.exe
  C:\Windows\System\shxxBzP.exe
  2⤵
  PID:9532
- C:\Windows\System\PJzchjm.exe
  C:\Windows\System\PJzchjm.exe
  2⤵
  PID:9576
- C:\Windows\System\NkGpHtm.exe
  C:\Windows\System\NkGpHtm.exe
  2⤵
  PID:9612
- C:\Windows\System\zPJQBAI.exe
  C:\Windows\System\zPJQBAI.exe
  2⤵
  PID:9644
- C:\Windows\System\GHbNFLf.exe
  C:\Windows\System\GHbNFLf.exe
  2⤵
  PID:9672
- C:\Windows\System\SekVHiT.exe
  C:\Windows\System\SekVHiT.exe
  2⤵
  PID:9708
- C:\Windows\System\edSqcfD.exe
  C:\Windows\System\edSqcfD.exe
  2⤵
  PID:9744
- C:\Windows\System\grYlaRt.exe
  C:\Windows\System\grYlaRt.exe
  2⤵
  PID:9772
- C:\Windows\System\EcmarAI.exe
  C:\Windows\System\EcmarAI.exe
  2⤵
  PID:9856
- C:\Windows\System\DHOhGWq.exe
  C:\Windows\System\DHOhGWq.exe
  2⤵
  PID:9876
- C:\Windows\System\FmmwAGw.exe
  C:\Windows\System\FmmwAGw.exe
  2⤵
  PID:9908
- C:\Windows\System\XzjDhoJ.exe
  C:\Windows\System\XzjDhoJ.exe
  2⤵
  PID:9936
- C:\Windows\System\JpWOOJI.exe
  C:\Windows\System\JpWOOJI.exe
  2⤵
  PID:9972
- C:\Windows\System\lsKLMJg.exe
  C:\Windows\System\lsKLMJg.exe
  2⤵
  PID:10000
- C:\Windows\System\NkRsOwh.exe
  C:\Windows\System\NkRsOwh.exe
  2⤵
  PID:10044
- C:\Windows\System\ixWJmUT.exe
  C:\Windows\System\ixWJmUT.exe
  2⤵
  PID:10072
- C:\Windows\System\oTERiqR.exe
  C:\Windows\System\oTERiqR.exe
  2⤵
  PID:9940
- C:\Windows\System\LGBhCIc.exe
  C:\Windows\System\LGBhCIc.exe
  2⤵
  PID:10132
- C:\Windows\System\DnUqSow.exe
  C:\Windows\System\DnUqSow.exe
  2⤵
  PID:10168
- C:\Windows\System\LkoDaPW.exe
  C:\Windows\System\LkoDaPW.exe
  2⤵
  PID:10192
- C:\Windows\System\jYSeFky.exe
  C:\Windows\System\jYSeFky.exe
  2⤵
  PID:10228
- C:\Windows\System\OqRpFLS.exe
  C:\Windows\System\OqRpFLS.exe
  2⤵
  PID:9232
- C:\Windows\System\WvZAZDR.exe
  C:\Windows\System\WvZAZDR.exe
  2⤵
  PID:9320
- C:\Windows\System\aKafHLm.exe
  C:\Windows\System\aKafHLm.exe
  2⤵
  PID:9392
- C:\Windows\System\sbuGbCB.exe
  C:\Windows\System\sbuGbCB.exe
  2⤵
  PID:9408
- C:\Windows\System\BHzpyIm.exe
  C:\Windows\System\BHzpyIm.exe
  2⤵
  PID:9476
- C:\Windows\System\hzfTIol.exe
  C:\Windows\System\hzfTIol.exe
  2⤵
  PID:9592
- C:\Windows\System\IFltZLF.exe
  C:\Windows\System\IFltZLF.exe
  2⤵
  PID:9564
- C:\Windows\System\gsbtkbo.exe
  C:\Windows\System\gsbtkbo.exe
  2⤵
  PID:9628
- C:\Windows\System\UPHNkyu.exe
  C:\Windows\System\UPHNkyu.exe
  2⤵
  PID:9788
- C:\Windows\System\ftznDQb.exe
  C:\Windows\System\ftznDQb.exe
  2⤵
  PID:9752
- C:\Windows\System\AETxhQt.exe
  C:\Windows\System\AETxhQt.exe
  2⤵
  PID:9808
- C:\Windows\System\PzbdCBx.exe
  C:\Windows\System\PzbdCBx.exe
  2⤵
  PID:9756
- C:\Windows\System\DMrwJCr.exe
  C:\Windows\System\DMrwJCr.exe
  2⤵
  PID:9956
- C:\Windows\System\DMmUrmm.exe
  C:\Windows\System\DMmUrmm.exe
  2⤵
  PID:10028
- C:\Windows\System\TiRrneA.exe
  C:\Windows\System\TiRrneA.exe
  2⤵
  PID:9988
- C:\Windows\System\CVlmgxV.exe
  C:\Windows\System\CVlmgxV.exe
  2⤵
  PID:10116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADRdOmi.exe

Filesize
1.4MB

MD5
f5a351c9a3e8ae1edd1f34c6b7ff05b3

SHA1
05ca432bb8fd5d3fd638b4c59926d3eb0b2f74e0

SHA256
79d8d7bb96589acb0e989cab02094180190867a056fd432902f115c71603f302

SHA512
08313bdb257b75191f5f27a97f8b3d0614f1a1ea5282aa2dfee62cc1b56d8872468719ef4a24f0005da155eb045547069ae921b561ef0742ed69835f2f1b9f60

Download Submit
C:\Windows\system\DEVouIU.exe

Filesize
1.4MB

MD5
3695600aa64f2656d7a1ad8a5847b369

SHA1
b95ed10d2accc3fc4ef67aa1b826adbea7a0ceb8

SHA256
f7733b650253ddd905884eb136f69d317b5c2630957135cdd71da3ef6e89bc7e

SHA512
fe297583f98e2d146b3b6145b09fed45be5ae104d7c1053a62eeca46d983036d0873f583a0d04e179091adee83d2654aa218ff133c866aa5b478fca386db2669

Download Submit
C:\Windows\system\DSNCrkS.exe

Filesize
1.4MB

MD5
d315bd23830441ddebc1380d475e7631

SHA1
910f5967e07aed3063f6a03143efe81ce23e2249

SHA256
f07c5ae3effe79f903267c18d1f3bdbc955ceb39ab8c1bbc641549567f513a2a

SHA512
b9ce73536d3ea44e58adf476c15a5fa72314a42d1f9e8c9342151f8fc1ef9441a5f3ea9cd9aeed07148d9afc603c1c36c71ad05a2d4e6de842cd10ab8271cea0

Download Submit
C:\Windows\system\DwcDLQu.exe

Filesize
1.4MB

MD5
e097221eaf65851d228ecd7a6a8f4f54

SHA1
d78af7c3910637ca147ce63e5e9fff48184f2944

SHA256
118161ac17edfa3a09254a84b1c40e0304288916e530c0c9436632eb13889b54

SHA512
3521f12b349e74d59d77952793d593cd512850946c9f0207fa0adfe16f5f65a7a90d451e32e4bfaa0a48b00a22a4bcc2b089d0ffc13a6fe5defa5afd8e79d386

Download Submit
C:\Windows\system\GhZLOdc.exe

Filesize
1.4MB

MD5
500f44e2ce1157d2951a371fc2248cff

SHA1
22bc329e2c05acafb1ee274ead4a420957788caf

SHA256
d237dc139a8fe6352e957e47fcb69ff64a709da7cafc4431c0637ccd1b712e75

SHA512
259dc9a598d985683cd140c3ca531b4be55cb6666cbf047cd72fda5cd54fff1fd8e925df3f45f8380805c16fea95c1361f5c518838005cfedecb507b5c07a562

Download Submit
C:\Windows\system\IteawYE.exe

Filesize
1.4MB

MD5
8a2fcfe7d44df90646f448c6a01e1735

SHA1
482cb4b3ca8187a6a231482faac2645f2fa09757

SHA256
cf69703115775a6e75a33cb9a155c668f71a63183f2f641749cbf31fb9d84625

SHA512
3661195f2a1fa27911909d888b4c207b5b6fc7eb9529491bc53296d4cb21642beebe9fd0f2f2bf1fffdee88ba1fcf67eba3277f1bc065c23ac5fcbb54d65b641

Download Submit
C:\Windows\system\KBeYmlB.exe

Filesize
1.4MB

MD5
bd7efbdacbf5884ad1b3beb04eba46fb

SHA1
cae898fbb357b69c18d9a397dd66a4ad8577c68d

SHA256
da4592ce9724f846697cc9de08b19815a8fe39eccc1389d2a20a83c87f568fb8

SHA512
ada95c601fa2eff2fa364a36c562d1fe3313c4fa43ab99eaab29f388beb93c7113f53158ad664c6905927fec09c26dfa85f0b9340a0b659daf082e2f68c4f105

Download Submit
C:\Windows\system\KFUseac.exe

Filesize
1.4MB

MD5
4cffbf2a69d39c339eba004936901ec7

SHA1
f65e9f2adc949885ea060369bca211544b3868d7

SHA256
7e2efe4a2e7dd9afc8bdc6a1494e7419229e85e0b78002e2eb2e639f816be99f

SHA512
039ce7b4a0db5c2d200ec2852ce93930103d2ee82b6d782366508a2510bb95d4882a3d1d609432d8a48617193eeeea80943eb704068045210b7e5893f03af7e0

Download Submit
C:\Windows\system\KvcAZOR.exe

Filesize
1.4MB

MD5
68f0ddc784e9011a1f55758b713bac8e

SHA1
419256a8d73527a59a9ad00adba94d264182163f

SHA256
9698b7f4efefe216590b43f131e7dae564710fc15dd3d2d532c59b609b538d1c

SHA512
c228ba0ee2e8004fa96223cb64732889cdd776d04cba1ad501595c56059708b6fa06ce867543d49c8e5061e241a43e3dff0261be059a632b010ff3b47f06e2e4

Download Submit
C:\Windows\system\OoXShlw.exe

Filesize
1.4MB

MD5
457614ed88a2c6888c2cdcd8f5249663

SHA1
53466b24dd84bdd477a68852aebf21e31b07ca69

SHA256
298e7415c2c94db5ed2dbd3519b47aa65d29c5fe6c8845ff9c9d9545b08e58f4

SHA512
397466f8943f693deac70c310a1821378e51648498db218cf63e456b93946572184cd1b8db9d45d1487c063a87764cc624c9839ce727731681682cac16e96833

Download Submit
C:\Windows\system\UhsxOLH.exe

Filesize
1.4MB

MD5
5d6d3165090dc0425da3ab1076038b22

SHA1
85650fc68f92ec3fb09574d3cc313d9addbb81d3

SHA256
f678c53ab5ccabb9b6c1c9112887f198cf9cb99f525a5047147e62d505f665c8

SHA512
81dd8b2729073ac78294c88fb461664243bb587b34bcb7094657349d07ce78fe4fbf3ae4ecc2ae9bc07b3ae0f16a5e79e6df49bda3e60b00e87a956e4b3736ad

Download Submit
C:\Windows\system\VRKqzhk.exe

Filesize
1.4MB

MD5
e68735627fcf3921c9a376bf430e22cd

SHA1
1915b02452ae5541acdd369588673fcf9ce97436

SHA256
cb9fe613aefe80af39e7c674e22ed6f9fdd0ea327a498ded330ed75e9eb76eca

SHA512
314685725ecf03fe62e3241eae18a341e30eff49d016964f5b5e05d065345bd97cf3f66d5ff1b02586bf0fb9e1651b326ccc78d74c9b9c502c3c9aa38831c452

Download Submit
C:\Windows\system\YVlRRKC.exe

Filesize
1.4MB

MD5
aa6dffc8d45f6877d0079d62a9a43a9b

SHA1
748bcb249106f630220326f71238c92342e13b93

SHA256
c6f34b1998b5ec61835a56228d2cc89ade9fc88634d5812e4976c2411d96453f

SHA512
3cd6438ceae8774c4d9b5eb0bbd20dfdad52312958ea3d16a3b56eb891b7cf3a6aded8e1d37f63d61100417a9de4a3c8c0a64ca9bc2a41a85e7c64a609ca6d1a

Download Submit
C:\Windows\system\bOpmnQK.exe

Filesize
1.4MB

MD5
835ab6c71a2e43a4a26f71d6f330a7f0

SHA1
13e863d0c630a4a0d81e1b79700cd2c14bab113a

SHA256
80d0d865e4d44b817e8f9361cd0b10aab37c4f9953be1d6c9e2d181d2cd1f0fd

SHA512
9a10123e35c6576eda75a56bad520dfd73156c73fb8c7c7ed20a8019a02f2802fcc5a2bf6ed40b7d3aa10b7ec77b8c7c7648d990088651dd200b3b8d470ba599

Download Submit
C:\Windows\system\cAKiCXM.exe

Filesize
1.4MB

MD5
6c74bec15d7c8d43378a7d6e1e9a01af

SHA1
f5ad081f24d1c52f724da4338ea32789fed46fb4

SHA256
8f6ba84c3310e3f56a7e5a6fd13876ae72aca190daf4667034faad03892ba2b2

SHA512
a667c1a87c6ecde9158bbf88c48b60d1dbfd763d8e65ef96c5e2f5b45a8c03e48bb7344ae901394d2317c51334cfef5be4ae2fddaafdd2858106755cfba22a19

Download Submit
C:\Windows\system\ckAkMKE.exe

Filesize
1.4MB

MD5
43c788907b462096c984a72e9852d299

SHA1
2ea6797e3678f541ee79be54d0e0e697fe00f45d

SHA256
28ead46bc5479d2163f615626e9fde3c3fb3ae7e43df97dfd3bb54c2d003ca31

SHA512
c1c487049002563b53926ac5f1d54290e1a94790218c2d8fea78a6acf04fa32dc97c008bbef36236530bfde3be2463fc9dfcc04ab37319d268c439ac8519fbe8

Download Submit
C:\Windows\system\dvWGfHC.exe

Filesize
1.4MB

MD5
b3c8999f7385454bc3dacc2557e24871

SHA1
33bb76a7b24b0c408c3e3a81b546ac4b3c5089eb

SHA256
04ae90a91b4afc5da8360bc5f2351b607a8be2fbc56a9cfc58c9ff7c43763fee

SHA512
39af4a9465a94224825c24165bb28ac350d7f30393cc110dce5b3d15d2814eea68b7d434bc0f0f713e9454a67954ea27b21935fcabbb19fa81e383b9ad5c7303

Download Submit
C:\Windows\system\ghpdSEP.exe

Filesize
1.4MB

MD5
092182a98e25d50e01b81be2a8cf8726

SHA1
f751d4c7a6112d2f879e48db7d25f95ed297463f

SHA256
6c833d0dc5e8ed6ae1ab0b11ee451a1e3d114deb094264c49362ad2ccf0005de

SHA512
1288e7fc50db1de9ffda79fff5e09ceb2e9b76456d74dca954f7df3ca92a023f590759e6afd1864617a32bd7b5f87d42294ed37dbc120a69715363cbc00ecabc

Download Submit
C:\Windows\system\jhDfFrs.exe

Filesize
1.4MB

MD5
cd26659c0d6ed5c77af2f4f5cd2d3e25

SHA1
97c2a10f08fdc42e4d10135579073f545b777516

SHA256
ea2cdf7999811a2e30dbe3156fba522d28a33d4b445c07e942f85d8762b4d9fa

SHA512
e8b5ec5bf52a9145f817619314d1c6c54acc37ca97a51a01e1e9adf19955e8c494994523f0428c62a3a296ebfdaab6b325efa8421eb5abd92bd2be5969a494c5

Download Submit
C:\Windows\system\lIhkvZw.exe

Filesize
1.4MB

MD5
d97487b1bb2ed4109ceff023392b1590

SHA1
74511dae1f4878d8e391d6d61e371f9c29a4d84e

SHA256
51ab8a5883390e52740be197e0aab7fa38b4ced182c9b76fb022a09b74fe452a

SHA512
05a94f4f2a33680c898c5309ce775bf1ff0259fa6b35ad97fef0d13852869082c92aab41d4f965460c322ba62f1fc2d7699c1b5486661d4a1ac10c5c0cfff19d

Download Submit
C:\Windows\system\mlxistY.exe

Filesize
1.4MB

MD5
dca6a9f119f205e8632c0ae9222bd574

SHA1
23d607237e8b6814400400f9ef910305e90edfec

SHA256
030d54897c66961b2b42c3fed26fa1cc02ca6b44f77db63f689349e78a469578

SHA512
91bb2fa93adac4183442e5893f53e8cdeee1109bbf4906b1dba0eacb65f3dcca4b3bbc9c681b2e93ef3d971ed70b5bc597936cdceacf199a434d1ee767316313

Download Submit
C:\Windows\system\pxAmisY.exe

Filesize
1.4MB

MD5
2894298d947d07433a7a26bc9b8ab06a

SHA1
d869fa3ac61d1bbb3bcffd429579974e90d58221

SHA256
cc285ba1f5956eb3188276cb8565ce9d5c543b1c7ffce3ea362566645fd23120

SHA512
52dc201588e307f2ec632b0c6d68f7393798182d0bd1bcefa37033f0b5b6ad878cfe1de6b894748b9257ff3a8d38cf7c5cc15eec5bc7b562d52c23a228318ea8

Download Submit
C:\Windows\system\slNtLdC.exe

Filesize
1.4MB

MD5
33931ddec8d5a9020b38e31107f1e1f3

SHA1
ac5a941f094fc44c6e0e4359d3262c1f2cf2133e

SHA256
cbecec95c3c7cf91d8c96df5eed36951b044ee26293eb6f98036bdd9f48429e8

SHA512
09b5498c44cdb8b6a06c87f157a69e6bcd7de8c9eeaeb5522b7d3c5aad5f2148946f2284f4c47528fedcc3cd1120ec97f3a0af0ca9ebc6f1aee6958f9c3ed5a3

Download Submit
C:\Windows\system\tBfbwOT.exe

Filesize
1.4MB

MD5
b4cc07484d92645865f5000add256fc5

SHA1
b706c53716f638c1f7cb668dad0411876dd2e75e

SHA256
c050ed6a3c542b6c91a8c7917a2a2cc11410d8be572f4e1c7e22abb55ea7cba0

SHA512
2f3b217c5c33a8843f9068c57d2117f1a2524ba02d77e25a9569b81eb4d9094c5123338f6f49d189893f3abddb6c7a72deecc0a2e842992d242d7c2c9505b9c0

Download Submit
C:\Windows\system\zzVXXoB.exe

Filesize
1.4MB

MD5
d198cea3a19c0155439db1ba70b40bce

SHA1
36ac1be00844bca48e30084ff3f509ca5ae0caf8

SHA256
83160c37db4cf1189cc97421cf2b1d2296705985589decae9d7d5ae0b7965986

SHA512
fe364010699a39a149ce5dff902ab5670661d50d6f8919beebefca6468121360c152ffb9cbd25924aa3301e9ab80f3befbd7b47b89a0bcc0dcb210c06dfdad25

Download Submit
\Windows\system\FLjNwUb.exe

Filesize
1.4MB

MD5
856f540836f1a96652ceb9d8fcb8e99b

SHA1
1eef02a7574b84e00d70b39cc1cf3039ca55dcfa

SHA256
179766120d117fa3e5a27de080464addf8c7c6e6b822bd0b3fc2732746e38285

SHA512
55581cc639c23512fb05d106dbb0a03eaa0039d343be9e6f820b98835faf21021714b249d37c0ae466957ffea5c263de2e063d415c8b3762ec3b5dcf20fd8618

Download Submit
\Windows\system\RtHkddl.exe

Filesize
1.4MB

MD5
e52c12c9c608eb2b28984f31eb76a75a

SHA1
fdd769d4b262790fe1c21f8010b147d702804eef

SHA256
43b0300dbb7184da21f68121246bcb89a71ef8fa5f1619d23694247b45606e34

SHA512
47ba23704c529afc5f1cad16256613b606dd4815eea8f78add37cd364a55f38489d1b09c82ae7b16dab3d1e1763a79eecdeca19a6a98b9989d766745d5453af1

Download Submit
\Windows\system\XSEQzKu.exe

Filesize
1.4MB

MD5
429843d85e5471a6935157c48f0af339

SHA1
049c8ac612a447302b15016f2a3d2314ac59a2d6

SHA256
e46888023262ff70173dee48f44018f7af0acd0e6440bf8622685a7512e5495a

SHA512
efa2e4ad98802cef4957643688b09b85a345c0ceaed6b5f0252048d8521e3ab82bdca3dbe35a401c6af13c117d8a3057a23ddf6807fa40ce0d8f6809b5c1a05d

Download Submit
\Windows\system\YaDVZfw.exe

Filesize
1.4MB

MD5
c1489e31f8f8d0a23692f322686d9bd0

SHA1
8c40c74418a95e9e3a7ff9bbf62bf4d1874ddf03

SHA256
78e4078df6f55415b006f6c742a572c51cd973107a7adc20f5d61de4665f437d

SHA512
e063c731dc657d9c671c4383b72eb5c6ac925b9ea189d45efa9ad7a7acc961508f9633e629c637c1b7876bd9e079b46b26581045369fbe90e644617a89b55c08

Download Submit
\Windows\system\dgyqkLn.exe

Filesize
1.4MB

MD5
7793619ea330bcc5d713b32f82f36943

SHA1
646313d65948f3b53388b329b0901341b890f17e

SHA256
8a6dd77335c903e3ebd2486cd609c30d4a7ece6eef7304426c179e130d2d588d

SHA512
5f709a695972e1fd4c35aba7aaaf4c6332e39a7b0e06b8b3dd5374863d601e300981329bd3de8c27ea24130decf1e63f05c28373b0c25716d87b5cfc3e64a80c

Download Submit
\Windows\system\oqnrfOP.exe

Filesize
1.4MB

MD5
e8c99f857361dfb3fa2fe0bf44dde5b9

SHA1
ff5912824752526bfc301d0f5a4a079e46770eb4

SHA256
af50ce3ae88069308240243bd35b9467155c0b4a3eecf1763be9b6f4947084de

SHA512
480294633a9ac28e9800dceee1fd4f1f6d20fcc61e0cb44157adef762ee4cad17057a586e81923b87002441c562f402f523b48795c24ada41bc4f5f0000bc6d0

Download Submit
\Windows\system\tjpzNiA.exe

Filesize
1.4MB

MD5
f80e6b5c691e8a49bcf96520cb55bc61

SHA1
f6e87c3e7f146d7ff45a59c0586e6b24e02f3117

SHA256
e915f9b3d43470b2f19014a551c2d79d491aacf14ca212de9d09728384b21901

SHA512
00b2891246f7cdfb3db4099f7a83d53371b5bb130897c3c8addbf286f85924cb57037b76ef09e43de7c1c1c5942592cf6444aaed5dabcafadb381526e9debb07

Download Submit
memory/2540-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download