xmrig | adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
Size

1.3MB
MD5

a68a46ff69b0d6a7be9fa616940eee8b
SHA1

534d08c1593726c9d89c9f73d043c18ce346a8c6
SHA256

adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd
SHA512

e01fc4ba42a1bdac48bc9945d2f2be508dad508596f72cbfb61adf711588c68a3c81733b26321211af958914e3c2c919f978a1467b806ebae9037f8139b30e05
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p904aohckF:GezaTF8FcNkNdfE0pZ9ozttwIRxGDKZR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0009000000012266-2.dat	xmrig
behavioral1/files/0x0003000000018334-9.dat	xmrig
behavioral1/files/0x0009000000018b28-8.dat	xmrig
behavioral1/files/0x0008000000018b50-16.dat	xmrig
behavioral1/files/0x0008000000018b54-21.dat	xmrig
behavioral1/files/0x0007000000018b64-28.dat	xmrig
behavioral1/files/0x0007000000018b71-33.dat	xmrig
behavioral1/files/0x0007000000018b89-39.dat	xmrig
behavioral1/files/0x0008000000018baf-44.dat	xmrig
behavioral1/files/0x0008000000018bbf-49.dat	xmrig
behavioral1/files/0x0005000000019820-58.dat	xmrig
behavioral1/files/0x00280000000186b7-53.dat	xmrig
behavioral1/files/0x000500000001998d-64.dat	xmrig
behavioral1/files/0x0005000000019bf6-68.dat	xmrig
behavioral1/files/0x0005000000019c3c-78.dat	xmrig
behavioral1/files/0x0005000000019d62-88.dat	xmrig
behavioral1/files/0x0005000000019e92-98.dat	xmrig
behavioral1/files/0x0005000000019fdd-108.dat	xmrig
behavioral1/files/0x000500000001a049-118.dat	xmrig
behavioral1/files/0x000500000001a309-128.dat	xmrig
behavioral1/files/0x000500000001a3f6-136.dat	xmrig
behavioral1/files/0x000500000001a3f8-141.dat	xmrig
behavioral1/files/0x000500000001a404-157.dat	xmrig
behavioral1/files/0x000500000001a400-153.dat	xmrig
behavioral1/files/0x000500000001a3fd-148.dat	xmrig
behavioral1/files/0x000500000001a3ab-133.dat	xmrig
behavioral1/files/0x000500000001a0b6-123.dat	xmrig
behavioral1/files/0x000500000001a03c-113.dat	xmrig
behavioral1/files/0x0005000000019fd4-103.dat	xmrig
behavioral1/files/0x0005000000019d6d-93.dat	xmrig
behavioral1/files/0x0005000000019d61-84.dat	xmrig
behavioral1/files/0x0005000000019bf9-73.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1692	zOgqkeR.exe
604	kIGgxUy.exe
2920	qgDCByp.exe
3012	uWpuHIe.exe
2896	VUAXAXt.exe
2996	SrLGacB.exe
3040	qhRicnE.exe
636	XREVMDs.exe
2936	XZMBxnr.exe
2944	cBYCtma.exe
2812	LhhCWbO.exe
2940	YAQwkbY.exe
1652	QYvHtWn.exe
1044	SxWEFcI.exe
1992	uReZrSb.exe
2280	TwWCqDC.exe
2700	hlZDoJP.exe
1564	zdUFQgd.exe
2416	TVQKcsc.exe
1956	jCAXzDL.exe
2860	vBgXKak.exe
2480	WWEbhup.exe
3024	fRteblN.exe
2024	NsUVTun.exe
284	DFCXcDi.exe
2080	LQbcCUO.exe
2372	joXupqa.exe
2152	BVjebXm.exe
2408	SGNaPIm.exe
2148	sMNTvNZ.exe
2256	cWUAcpd.exe
2632	otLGwzp.exe
2068	QiCMJQC.exe
2200	byeMLEL.exe
1716	nYgwqpj.exe
2692	UwVCXID.exe
2584	JitjioW.exe
1104	eDGaoOx.exe
1924	fKAiNGC.exe
2140	TyqTYUj.exe
1356	CuzYWwE.exe
1492	YWhIQqt.exe
1512	snrQbSL.exe
2600	ytKyrdO.exe
2704	mtUgWkh.exe
2060	gJqPjKn.exe
1544	HuIAVZX.exe
1436	eYiJGNh.exe
1552	sytvgWF.exe
1676	iBJASXz.exe
1168	MQHVnqo.exe
2764	MsIdnON.exe
2608	hvmQMTF.exe
1532	goZNOmC.exe
940	STmqbhM.exe
1040	gDEfHpS.exe
1580	OtalHvD.exe
2560	MfTyocw.exe
1608	JlBZpMW.exe
2556	gglGfIP.exe
2396	CmLudNR.exe
3008	cwAelkv.exe
2776	zKQBWCK.exe
2932	jVRnRhj.exe

Loads dropped DLL 64 IoCs

pid	Process
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HhaKreO.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\CwQFCLd.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\cGCmiBe.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\MgxSpJW.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\TBZPIkB.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\DQOKVTc.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\rRJdoXd.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\cONeABg.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\DAYVLqP.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\gEOKzWH.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\rYgdqYH.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\mfDDAVx.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\RgrpUUq.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\OZwNIzh.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\JxsYwHo.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\iTQXAvj.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ETFMHBR.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\RaesYSK.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\UPbAQhm.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\BaYChrZ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\YAAcqVe.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\FFYrpHN.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\STmqbhM.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\BHdhuus.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\CVFQxDP.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\uEvDsSm.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\gZzroXi.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\sRGvQqH.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\gADEgDq.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ZqHepwS.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\dVUqnuc.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\dUmNMts.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\hUBNYbQ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\yXMGfdp.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\lkQVHnn.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\hqQCzjD.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\NHgQzPa.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\tuabLRb.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\xzwkZQc.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\hvwNArK.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\whIsohB.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\NqtpbpM.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\qhbjOoh.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\TMDDPCx.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\sTOEWEV.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\bHaHhVN.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\aGgJYHb.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\mNnBPcI.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\qxDIGto.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ziJmweI.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\aVnfbjj.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\oOcIyAq.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\rVNgQnT.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\jyNvujV.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\OTUQGYD.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\vWekgQP.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\xMEVCze.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\AWNPmxL.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\LqgeqmW.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\LrkUYmq.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\OPBRufZ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\bycfYRZ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\jhfBEbe.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\khVTHAu.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1692	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	31
PID 2528 wrote to memory of 1692	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	31
PID 2528 wrote to memory of 1692	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	31
PID 2528 wrote to memory of 604	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	32
PID 2528 wrote to memory of 604	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	32
PID 2528 wrote to memory of 604	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	32
PID 2528 wrote to memory of 2920	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	33
PID 2528 wrote to memory of 2920	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	33
PID 2528 wrote to memory of 2920	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	33
PID 2528 wrote to memory of 3012	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	34
PID 2528 wrote to memory of 3012	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	34
PID 2528 wrote to memory of 3012	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	34
PID 2528 wrote to memory of 2896	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	35
PID 2528 wrote to memory of 2896	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	35
PID 2528 wrote to memory of 2896	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	35
PID 2528 wrote to memory of 2996	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	36
PID 2528 wrote to memory of 2996	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	36
PID 2528 wrote to memory of 2996	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	36
PID 2528 wrote to memory of 3040	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	37
PID 2528 wrote to memory of 3040	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	37
PID 2528 wrote to memory of 3040	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	37
PID 2528 wrote to memory of 636	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	38
PID 2528 wrote to memory of 636	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	38
PID 2528 wrote to memory of 636	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	38
PID 2528 wrote to memory of 2936	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	39
PID 2528 wrote to memory of 2936	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	39
PID 2528 wrote to memory of 2936	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	39
PID 2528 wrote to memory of 2944	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	40
PID 2528 wrote to memory of 2944	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	40
PID 2528 wrote to memory of 2944	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	40
PID 2528 wrote to memory of 2812	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	41
PID 2528 wrote to memory of 2812	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	41
PID 2528 wrote to memory of 2812	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	41
PID 2528 wrote to memory of 2940	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	42
PID 2528 wrote to memory of 2940	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	42
PID 2528 wrote to memory of 2940	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	42
PID 2528 wrote to memory of 1652	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	43
PID 2528 wrote to memory of 1652	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	43
PID 2528 wrote to memory of 1652	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	43
PID 2528 wrote to memory of 1044	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	44
PID 2528 wrote to memory of 1044	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	44
PID 2528 wrote to memory of 1044	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	44
PID 2528 wrote to memory of 1992	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	45
PID 2528 wrote to memory of 1992	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	45
PID 2528 wrote to memory of 1992	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	45
PID 2528 wrote to memory of 2280	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	46
PID 2528 wrote to memory of 2280	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	46
PID 2528 wrote to memory of 2280	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	46
PID 2528 wrote to memory of 2700	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	47
PID 2528 wrote to memory of 2700	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	47
PID 2528 wrote to memory of 2700	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	47
PID 2528 wrote to memory of 1564	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	48
PID 2528 wrote to memory of 1564	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	48
PID 2528 wrote to memory of 1564	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	48
PID 2528 wrote to memory of 2416	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	49
PID 2528 wrote to memory of 2416	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	49
PID 2528 wrote to memory of 2416	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	49
PID 2528 wrote to memory of 1956	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	50
PID 2528 wrote to memory of 1956	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	50
PID 2528 wrote to memory of 1956	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	50
PID 2528 wrote to memory of 2860	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	51
PID 2528 wrote to memory of 2860	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	51
PID 2528 wrote to memory of 2860	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	51
PID 2528 wrote to memory of 2480	2528	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	52

C:\Users\Admin\AppData\Local\Temp\adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
"C:\Users\Admin\AppData\Local\Temp\adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System\zOgqkeR.exe
  C:\Windows\System\zOgqkeR.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\kIGgxUy.exe
  C:\Windows\System\kIGgxUy.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\qgDCByp.exe
  C:\Windows\System\qgDCByp.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\uWpuHIe.exe
  C:\Windows\System\uWpuHIe.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\VUAXAXt.exe
  C:\Windows\System\VUAXAXt.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\SrLGacB.exe
  C:\Windows\System\SrLGacB.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\qhRicnE.exe
  C:\Windows\System\qhRicnE.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\XREVMDs.exe
  C:\Windows\System\XREVMDs.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\XZMBxnr.exe
  C:\Windows\System\XZMBxnr.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\cBYCtma.exe
  C:\Windows\System\cBYCtma.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\LhhCWbO.exe
  C:\Windows\System\LhhCWbO.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YAQwkbY.exe
  C:\Windows\System\YAQwkbY.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\QYvHtWn.exe
  C:\Windows\System\QYvHtWn.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\SxWEFcI.exe
  C:\Windows\System\SxWEFcI.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\uReZrSb.exe
  C:\Windows\System\uReZrSb.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\TwWCqDC.exe
  C:\Windows\System\TwWCqDC.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\hlZDoJP.exe
  C:\Windows\System\hlZDoJP.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\zdUFQgd.exe
  C:\Windows\System\zdUFQgd.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\TVQKcsc.exe
  C:\Windows\System\TVQKcsc.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\jCAXzDL.exe
  C:\Windows\System\jCAXzDL.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\vBgXKak.exe
  C:\Windows\System\vBgXKak.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\WWEbhup.exe
  C:\Windows\System\WWEbhup.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\fRteblN.exe
  C:\Windows\System\fRteblN.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\NsUVTun.exe
  C:\Windows\System\NsUVTun.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DFCXcDi.exe
  C:\Windows\System\DFCXcDi.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\LQbcCUO.exe
  C:\Windows\System\LQbcCUO.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\joXupqa.exe
  C:\Windows\System\joXupqa.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\BVjebXm.exe
  C:\Windows\System\BVjebXm.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\SGNaPIm.exe
  C:\Windows\System\SGNaPIm.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\sMNTvNZ.exe
  C:\Windows\System\sMNTvNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\cWUAcpd.exe
  C:\Windows\System\cWUAcpd.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\otLGwzp.exe
  C:\Windows\System\otLGwzp.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\QiCMJQC.exe
  C:\Windows\System\QiCMJQC.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\byeMLEL.exe
  C:\Windows\System\byeMLEL.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\nYgwqpj.exe
  C:\Windows\System\nYgwqpj.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\UwVCXID.exe
  C:\Windows\System\UwVCXID.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\JitjioW.exe
  C:\Windows\System\JitjioW.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\eDGaoOx.exe
  C:\Windows\System\eDGaoOx.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fKAiNGC.exe
  C:\Windows\System\fKAiNGC.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\TyqTYUj.exe
  C:\Windows\System\TyqTYUj.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\CuzYWwE.exe
  C:\Windows\System\CuzYWwE.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\YWhIQqt.exe
  C:\Windows\System\YWhIQqt.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\snrQbSL.exe
  C:\Windows\System\snrQbSL.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\ytKyrdO.exe
  C:\Windows\System\ytKyrdO.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\mtUgWkh.exe
  C:\Windows\System\mtUgWkh.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\gJqPjKn.exe
  C:\Windows\System\gJqPjKn.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\HuIAVZX.exe
  C:\Windows\System\HuIAVZX.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\eYiJGNh.exe
  C:\Windows\System\eYiJGNh.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\sytvgWF.exe
  C:\Windows\System\sytvgWF.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\iBJASXz.exe
  C:\Windows\System\iBJASXz.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\MQHVnqo.exe
  C:\Windows\System\MQHVnqo.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\MsIdnON.exe
  C:\Windows\System\MsIdnON.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\hvmQMTF.exe
  C:\Windows\System\hvmQMTF.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\goZNOmC.exe
  C:\Windows\System\goZNOmC.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\STmqbhM.exe
  C:\Windows\System\STmqbhM.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\gDEfHpS.exe
  C:\Windows\System\gDEfHpS.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\OtalHvD.exe
  C:\Windows\System\OtalHvD.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\MfTyocw.exe
  C:\Windows\System\MfTyocw.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JlBZpMW.exe
  C:\Windows\System\JlBZpMW.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\gglGfIP.exe
  C:\Windows\System\gglGfIP.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\CmLudNR.exe
  C:\Windows\System\CmLudNR.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\cwAelkv.exe
  C:\Windows\System\cwAelkv.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zKQBWCK.exe
  C:\Windows\System\zKQBWCK.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\jVRnRhj.exe
  C:\Windows\System\jVRnRhj.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\eaJqukm.exe
  C:\Windows\System\eaJqukm.exe
  2⤵
  PID:1988
- C:\Windows\System\WyOUPGf.exe
  C:\Windows\System\WyOUPGf.exe
  2⤵
  PID:2992
- C:\Windows\System\AWNPmxL.exe
  C:\Windows\System\AWNPmxL.exe
  2⤵
  PID:2564
- C:\Windows\System\WbDhiJP.exe
  C:\Windows\System\WbDhiJP.exe
  2⤵
  PID:2880
- C:\Windows\System\LxtjqmJ.exe
  C:\Windows\System\LxtjqmJ.exe
  2⤵
  PID:2968
- C:\Windows\System\PnnXiyL.exe
  C:\Windows\System\PnnXiyL.exe
  2⤵
  PID:932
- C:\Windows\System\DrHSXBK.exe
  C:\Windows\System\DrHSXBK.exe
  2⤵
  PID:2240
- C:\Windows\System\LaOIvoR.exe
  C:\Windows\System\LaOIvoR.exe
  2⤵
  PID:320
- C:\Windows\System\yGgoEDy.exe
  C:\Windows\System\yGgoEDy.exe
  2⤵
  PID:3056
- C:\Windows\System\RhaHiOc.exe
  C:\Windows\System\RhaHiOc.exe
  2⤵
  PID:2332
- C:\Windows\System\mCBqSai.exe
  C:\Windows\System\mCBqSai.exe
  2⤵
  PID:1148
- C:\Windows\System\lFsEAXG.exe
  C:\Windows\System\lFsEAXG.exe
  2⤵
  PID:2336
- C:\Windows\System\DUlFxAO.exe
  C:\Windows\System\DUlFxAO.exe
  2⤵
  PID:2348
- C:\Windows\System\bWUwmGj.exe
  C:\Windows\System\bWUwmGj.exe
  2⤵
  PID:1872
- C:\Windows\System\uvdyCMN.exe
  C:\Windows\System\uvdyCMN.exe
  2⤵
  PID:2420
- C:\Windows\System\LqgeqmW.exe
  C:\Windows\System\LqgeqmW.exe
  2⤵
  PID:2884
- C:\Windows\System\GjQsGKR.exe
  C:\Windows\System\GjQsGKR.exe
  2⤵
  PID:2392
- C:\Windows\System\iRsKcdt.exe
  C:\Windows\System\iRsKcdt.exe
  2⤵
  PID:2220
- C:\Windows\System\DbMbaMU.exe
  C:\Windows\System\DbMbaMU.exe
  2⤵
  PID:2772
- C:\Windows\System\roTRQce.exe
  C:\Windows\System\roTRQce.exe
  2⤵
  PID:1820
- C:\Windows\System\YwhPynN.exe
  C:\Windows\System\YwhPynN.exe
  2⤵
  PID:864
- C:\Windows\System\isqlxmc.exe
  C:\Windows\System\isqlxmc.exe
  2⤵
  PID:2828
- C:\Windows\System\DCicfHw.exe
  C:\Windows\System\DCicfHw.exe
  2⤵
  PID:2004
- C:\Windows\System\GrXRFyr.exe
  C:\Windows\System\GrXRFyr.exe
  2⤵
  PID:2572
- C:\Windows\System\pFmBdDj.exe
  C:\Windows\System\pFmBdDj.exe
  2⤵
  PID:2724
- C:\Windows\System\xWyYKQM.exe
  C:\Windows\System\xWyYKQM.exe
  2⤵
  PID:2228
- C:\Windows\System\fhIFtFa.exe
  C:\Windows\System\fhIFtFa.exe
  2⤵
  PID:2484
- C:\Windows\System\MVrIZrm.exe
  C:\Windows\System\MVrIZrm.exe
  2⤵
  PID:1536
- C:\Windows\System\VkzpqJE.exe
  C:\Windows\System\VkzpqJE.exe
  2⤵
  PID:1700
- C:\Windows\System\sfLsJrK.exe
  C:\Windows\System\sfLsJrK.exe
  2⤵
  PID:108
- C:\Windows\System\PiyirVQ.exe
  C:\Windows\System\PiyirVQ.exe
  2⤵
  PID:2352
- C:\Windows\System\sodHSHL.exe
  C:\Windows\System\sodHSHL.exe
  2⤵
  PID:2296
- C:\Windows\System\IvFkqae.exe
  C:\Windows\System\IvFkqae.exe
  2⤵
  PID:1028
- C:\Windows\System\tmpkgWh.exe
  C:\Windows\System\tmpkgWh.exe
  2⤵
  PID:524
- C:\Windows\System\khVTHAu.exe
  C:\Windows\System\khVTHAu.exe
  2⤵
  PID:1332
- C:\Windows\System\KYWlNob.exe
  C:\Windows\System\KYWlNob.exe
  2⤵
  PID:2628
- C:\Windows\System\YMEmHlI.exe
  C:\Windows\System\YMEmHlI.exe
  2⤵
  PID:1832
- C:\Windows\System\GwBAnne.exe
  C:\Windows\System\GwBAnne.exe
  2⤵
  PID:2620
- C:\Windows\System\wQbwIZh.exe
  C:\Windows\System\wQbwIZh.exe
  2⤵
  PID:2832
- C:\Windows\System\GhwjLwk.exe
  C:\Windows\System\GhwjLwk.exe
  2⤵
  PID:1656
- C:\Windows\System\VQvdixp.exe
  C:\Windows\System\VQvdixp.exe
  2⤵
  PID:2976
- C:\Windows\System\WagAulS.exe
  C:\Windows\System\WagAulS.exe
  2⤵
  PID:2448
- C:\Windows\System\sigkdTh.exe
  C:\Windows\System\sigkdTh.exe
  2⤵
  PID:3064
- C:\Windows\System\rhbcsOd.exe
  C:\Windows\System\rhbcsOd.exe
  2⤵
  PID:1880
- C:\Windows\System\LYJjKdl.exe
  C:\Windows\System\LYJjKdl.exe
  2⤵
  PID:2780
- C:\Windows\System\ttxZVpg.exe
  C:\Windows\System\ttxZVpg.exe
  2⤵
  PID:2452
- C:\Windows\System\NOWxHaI.exe
  C:\Windows\System\NOWxHaI.exe
  2⤵
  PID:2036
- C:\Windows\System\zzadcxv.exe
  C:\Windows\System\zzadcxv.exe
  2⤵
  PID:1528
- C:\Windows\System\SyDkJym.exe
  C:\Windows\System\SyDkJym.exe
  2⤵
  PID:2980
- C:\Windows\System\goduqQH.exe
  C:\Windows\System\goduqQH.exe
  2⤵
  PID:2376
- C:\Windows\System\XuvvFig.exe
  C:\Windows\System\XuvvFig.exe
  2⤵
  PID:1392
- C:\Windows\System\qfJTLSU.exe
  C:\Windows\System\qfJTLSU.exe
  2⤵
  PID:368
- C:\Windows\System\IygYTRp.exe
  C:\Windows\System\IygYTRp.exe
  2⤵
  PID:2368
- C:\Windows\System\SrOExZY.exe
  C:\Windows\System\SrOExZY.exe
  2⤵
  PID:2000
- C:\Windows\System\XkVKYfd.exe
  C:\Windows\System\XkVKYfd.exe
  2⤵
  PID:1540
- C:\Windows\System\QoCMtwr.exe
  C:\Windows\System\QoCMtwr.exe
  2⤵
  PID:2164
- C:\Windows\System\EBOQdYN.exe
  C:\Windows\System\EBOQdYN.exe
  2⤵
  PID:2248
- C:\Windows\System\sCEZCKV.exe
  C:\Windows\System\sCEZCKV.exe
  2⤵
  PID:2844
- C:\Windows\System\uTYfvBU.exe
  C:\Windows\System\uTYfvBU.exe
  2⤵
  PID:904
- C:\Windows\System\PImzWxZ.exe
  C:\Windows\System\PImzWxZ.exe
  2⤵
  PID:2768
- C:\Windows\System\kjJqwxY.exe
  C:\Windows\System\kjJqwxY.exe
  2⤵
  PID:1684
- C:\Windows\System\JfyCcPR.exe
  C:\Windows\System\JfyCcPR.exe
  2⤵
  PID:1208
- C:\Windows\System\jrsjsqZ.exe
  C:\Windows\System\jrsjsqZ.exe
  2⤵
  PID:2624
- C:\Windows\System\rJgPZjs.exe
  C:\Windows\System\rJgPZjs.exe
  2⤵
  PID:2472
- C:\Windows\System\oxratVe.exe
  C:\Windows\System\oxratVe.exe
  2⤵
  PID:2664
- C:\Windows\System\ndUesEF.exe
  C:\Windows\System\ndUesEF.exe
  2⤵
  PID:2012
- C:\Windows\System\HuKTDcD.exe
  C:\Windows\System\HuKTDcD.exe
  2⤵
  PID:2852
- C:\Windows\System\OpPBnQq.exe
  C:\Windows\System\OpPBnQq.exe
  2⤵
  PID:2616
- C:\Windows\System\LEBZRRR.exe
  C:\Windows\System\LEBZRRR.exe
  2⤵
  PID:2736
- C:\Windows\System\NawdgNN.exe
  C:\Windows\System\NawdgNN.exe
  2⤵
  PID:1592
- C:\Windows\System\xVqFwlX.exe
  C:\Windows\System\xVqFwlX.exe
  2⤵
  PID:2988
- C:\Windows\System\KwbxCds.exe
  C:\Windows\System\KwbxCds.exe
  2⤵
  PID:980
- C:\Windows\System\ZDJkNGo.exe
  C:\Windows\System\ZDJkNGo.exe
  2⤵
  PID:804
- C:\Windows\System\fOeHeOr.exe
  C:\Windows\System\fOeHeOr.exe
  2⤵
  PID:2788
- C:\Windows\System\jCbJStC.exe
  C:\Windows\System\jCbJStC.exe
  2⤵
  PID:2900
- C:\Windows\System\dSWIjJT.exe
  C:\Windows\System\dSWIjJT.exe
  2⤵
  PID:792
- C:\Windows\System\PBdxaRP.exe
  C:\Windows\System\PBdxaRP.exe
  2⤵
  PID:2948
- C:\Windows\System\FavQxLR.exe
  C:\Windows\System\FavQxLR.exe
  2⤵
  PID:3068
- C:\Windows\System\bkKnnIG.exe
  C:\Windows\System\bkKnnIG.exe
  2⤵
  PID:3060
- C:\Windows\System\dGVRpMU.exe
  C:\Windows\System\dGVRpMU.exe
  2⤵
  PID:384
- C:\Windows\System\uAJWOhZ.exe
  C:\Windows\System\uAJWOhZ.exe
  2⤵
  PID:1204
- C:\Windows\System\ryneBmm.exe
  C:\Windows\System\ryneBmm.exe
  2⤵
  PID:2384
- C:\Windows\System\dMweooV.exe
  C:\Windows\System\dMweooV.exe
  2⤵
  PID:2552
- C:\Windows\System\HtGIIbg.exe
  C:\Windows\System\HtGIIbg.exe
  2⤵
  PID:1704
- C:\Windows\System\QUVWDrY.exe
  C:\Windows\System\QUVWDrY.exe
  2⤵
  PID:1936
- C:\Windows\System\OiOcnky.exe
  C:\Windows\System\OiOcnky.exe
  2⤵
  PID:2868
- C:\Windows\System\QPZuGCX.exe
  C:\Windows\System\QPZuGCX.exe
  2⤵
  PID:2008
- C:\Windows\System\lLdYjNp.exe
  C:\Windows\System\lLdYjNp.exe
  2⤵
  PID:2388
- C:\Windows\System\LRaDwxa.exe
  C:\Windows\System\LRaDwxa.exe
  2⤵
  PID:1272
- C:\Windows\System\pfYaTEE.exe
  C:\Windows\System\pfYaTEE.exe
  2⤵
  PID:1984
- C:\Windows\System\KkdDhsC.exe
  C:\Windows\System\KkdDhsC.exe
  2⤵
  PID:2824
- C:\Windows\System\YcYuVxF.exe
  C:\Windows\System\YcYuVxF.exe
  2⤵
  PID:2300
- C:\Windows\System\KwxnCpw.exe
  C:\Windows\System\KwxnCpw.exe
  2⤵
  PID:2432
- C:\Windows\System\tzVTuTr.exe
  C:\Windows\System\tzVTuTr.exe
  2⤵
  PID:2468
- C:\Windows\System\llYIYAZ.exe
  C:\Windows\System\llYIYAZ.exe
  2⤵
  PID:588
- C:\Windows\System\VViGwrf.exe
  C:\Windows\System\VViGwrf.exe
  2⤵
  PID:960
- C:\Windows\System\VBixYBR.exe
  C:\Windows\System\VBixYBR.exe
  2⤵
  PID:1100
- C:\Windows\System\BofsBgP.exe
  C:\Windows\System\BofsBgP.exe
  2⤵
  PID:1060
- C:\Windows\System\KsCkVWu.exe
  C:\Windows\System\KsCkVWu.exe
  2⤵
  PID:1960
- C:\Windows\System\kLgRpFS.exe
  C:\Windows\System\kLgRpFS.exe
  2⤵
  PID:1732
- C:\Windows\System\hMtXYdX.exe
  C:\Windows\System\hMtXYdX.exe
  2⤵
  PID:976
- C:\Windows\System\GptKwJL.exe
  C:\Windows\System\GptKwJL.exe
  2⤵
  PID:2428
- C:\Windows\System\mpPSiur.exe
  C:\Windows\System\mpPSiur.exe
  2⤵
  PID:2380
- C:\Windows\System\XChKSBX.exe
  C:\Windows\System\XChKSBX.exe
  2⤵
  PID:2356
- C:\Windows\System\olJHpMA.exe
  C:\Windows\System\olJHpMA.exe
  2⤵
  PID:840
- C:\Windows\System\ucGvNrj.exe
  C:\Windows\System\ucGvNrj.exe
  2⤵
  PID:1772
- C:\Windows\System\qWpmjkU.exe
  C:\Windows\System\qWpmjkU.exe
  2⤵
  PID:1612
- C:\Windows\System\jSZzwZU.exe
  C:\Windows\System\jSZzwZU.exe
  2⤵
  PID:572
- C:\Windows\System\vQBwDGu.exe
  C:\Windows\System\vQBwDGu.exe
  2⤵
  PID:272
- C:\Windows\System\HNwkNLw.exe
  C:\Windows\System\HNwkNLw.exe
  2⤵
  PID:2276
- C:\Windows\System\PtVnjFF.exe
  C:\Windows\System\PtVnjFF.exe
  2⤵
  PID:2808
- C:\Windows\System\OjAHCJD.exe
  C:\Windows\System\OjAHCJD.exe
  2⤵
  PID:2032
- C:\Windows\System\hxiuELS.exe
  C:\Windows\System\hxiuELS.exe
  2⤵
  PID:2184
- C:\Windows\System\sIQzjUp.exe
  C:\Windows\System\sIQzjUp.exe
  2⤵
  PID:1280
- C:\Windows\System\UZrwEia.exe
  C:\Windows\System\UZrwEia.exe
  2⤵
  PID:2612
- C:\Windows\System\sKrauoS.exe
  C:\Windows\System\sKrauoS.exe
  2⤵
  PID:1828
- C:\Windows\System\QjeuWMO.exe
  C:\Windows\System\QjeuWMO.exe
  2⤵
  PID:3096
- C:\Windows\System\MLETTqG.exe
  C:\Windows\System\MLETTqG.exe
  2⤵
  PID:3112
- C:\Windows\System\jYUiUTq.exe
  C:\Windows\System\jYUiUTq.exe
  2⤵
  PID:3136
- C:\Windows\System\WrEJnvx.exe
  C:\Windows\System\WrEJnvx.exe
  2⤵
  PID:3156
- C:\Windows\System\XpSwFqq.exe
  C:\Windows\System\XpSwFqq.exe
  2⤵
  PID:3176
- C:\Windows\System\hTkztID.exe
  C:\Windows\System\hTkztID.exe
  2⤵
  PID:3196
- C:\Windows\System\mDKUZtI.exe
  C:\Windows\System\mDKUZtI.exe
  2⤵
  PID:3216
- C:\Windows\System\aznPszx.exe
  C:\Windows\System\aznPszx.exe
  2⤵
  PID:3232
- C:\Windows\System\cdqhsBg.exe
  C:\Windows\System\cdqhsBg.exe
  2⤵
  PID:3248
- C:\Windows\System\WGNvCjv.exe
  C:\Windows\System\WGNvCjv.exe
  2⤵
  PID:3264
- C:\Windows\System\swOKcPq.exe
  C:\Windows\System\swOKcPq.exe
  2⤵
  PID:3284
- C:\Windows\System\uuGBIlW.exe
  C:\Windows\System\uuGBIlW.exe
  2⤵
  PID:3300
- C:\Windows\System\WNCTHzF.exe
  C:\Windows\System\WNCTHzF.exe
  2⤵
  PID:3320
- C:\Windows\System\qVaTtWU.exe
  C:\Windows\System\qVaTtWU.exe
  2⤵
  PID:3336
- C:\Windows\System\ZfaZADc.exe
  C:\Windows\System\ZfaZADc.exe
  2⤵
  PID:3368
- C:\Windows\System\SWDpWUZ.exe
  C:\Windows\System\SWDpWUZ.exe
  2⤵
  PID:3384
- C:\Windows\System\lkQVHnn.exe
  C:\Windows\System\lkQVHnn.exe
  2⤵
  PID:3400
- C:\Windows\System\MNjHEOp.exe
  C:\Windows\System\MNjHEOp.exe
  2⤵
  PID:3416
- C:\Windows\System\nejSXXr.exe
  C:\Windows\System\nejSXXr.exe
  2⤵
  PID:3460
- C:\Windows\System\jvQNVFT.exe
  C:\Windows\System\jvQNVFT.exe
  2⤵
  PID:3476
- C:\Windows\System\cYfMVGt.exe
  C:\Windows\System\cYfMVGt.exe
  2⤵
  PID:3500
- C:\Windows\System\AMuJLir.exe
  C:\Windows\System\AMuJLir.exe
  2⤵
  PID:3516
- C:\Windows\System\ynxSqjY.exe
  C:\Windows\System\ynxSqjY.exe
  2⤵
  PID:3532
- C:\Windows\System\NqtpbpM.exe
  C:\Windows\System\NqtpbpM.exe
  2⤵
  PID:3556
- C:\Windows\System\CEFEuGU.exe
  C:\Windows\System\CEFEuGU.exe
  2⤵
  PID:3580
- C:\Windows\System\HiEZiNv.exe
  C:\Windows\System\HiEZiNv.exe
  2⤵
  PID:3596
- C:\Windows\System\bZrdmZm.exe
  C:\Windows\System\bZrdmZm.exe
  2⤵
  PID:3612
- C:\Windows\System\JLhCRSW.exe
  C:\Windows\System\JLhCRSW.exe
  2⤵
  PID:3628
- C:\Windows\System\iNmwwNF.exe
  C:\Windows\System\iNmwwNF.exe
  2⤵
  PID:3656
- C:\Windows\System\HpqUpGk.exe
  C:\Windows\System\HpqUpGk.exe
  2⤵
  PID:3672
- C:\Windows\System\xRzknDr.exe
  C:\Windows\System\xRzknDr.exe
  2⤵
  PID:3692
- C:\Windows\System\zmrfGUG.exe
  C:\Windows\System\zmrfGUG.exe
  2⤵
  PID:3712
- C:\Windows\System\ReMnLPk.exe
  C:\Windows\System\ReMnLPk.exe
  2⤵
  PID:3728
- C:\Windows\System\GOGYsPD.exe
  C:\Windows\System\GOGYsPD.exe
  2⤵
  PID:3748
- C:\Windows\System\pLlYSbN.exe
  C:\Windows\System\pLlYSbN.exe
  2⤵
  PID:3776
- C:\Windows\System\KhuSOQz.exe
  C:\Windows\System\KhuSOQz.exe
  2⤵
  PID:3796
- C:\Windows\System\qNPFJEd.exe
  C:\Windows\System\qNPFJEd.exe
  2⤵
  PID:3820
- C:\Windows\System\YdKHkEM.exe
  C:\Windows\System\YdKHkEM.exe
  2⤵
  PID:3836
- C:\Windows\System\PYMzpGU.exe
  C:\Windows\System\PYMzpGU.exe
  2⤵
  PID:3856
- C:\Windows\System\XUKifAX.exe
  C:\Windows\System\XUKifAX.exe
  2⤵
  PID:3872
- C:\Windows\System\JxVrlFN.exe
  C:\Windows\System\JxVrlFN.exe
  2⤵
  PID:3900
- C:\Windows\System\mVAuhYC.exe
  C:\Windows\System\mVAuhYC.exe
  2⤵
  PID:3920
- C:\Windows\System\fIETogm.exe
  C:\Windows\System\fIETogm.exe
  2⤵
  PID:3940
- C:\Windows\System\tgRMSHP.exe
  C:\Windows\System\tgRMSHP.exe
  2⤵
  PID:3960
- C:\Windows\System\RBrmZmQ.exe
  C:\Windows\System\RBrmZmQ.exe
  2⤵
  PID:3980
- C:\Windows\System\rQkunVm.exe
  C:\Windows\System\rQkunVm.exe
  2⤵
  PID:4000
- C:\Windows\System\bMBvalj.exe
  C:\Windows\System\bMBvalj.exe
  2⤵
  PID:4016
- C:\Windows\System\yaLpncw.exe
  C:\Windows\System\yaLpncw.exe
  2⤵
  PID:4032
- C:\Windows\System\sRGvQqH.exe
  C:\Windows\System\sRGvQqH.exe
  2⤵
  PID:4052
- C:\Windows\System\KiKpjJf.exe
  C:\Windows\System\KiKpjJf.exe
  2⤵
  PID:4084
- C:\Windows\System\kjsRqUZ.exe
  C:\Windows\System\kjsRqUZ.exe
  2⤵
  PID:2964
- C:\Windows\System\vsBzJgX.exe
  C:\Windows\System\vsBzJgX.exe
  2⤵
  PID:3108
- C:\Windows\System\npjuCFi.exe
  C:\Windows\System\npjuCFi.exe
  2⤵
  PID:3152
- C:\Windows\System\kPntUYi.exe
  C:\Windows\System\kPntUYi.exe
  2⤵
  PID:3168
- C:\Windows\System\mAATVwc.exe
  C:\Windows\System\mAATVwc.exe
  2⤵
  PID:3212
- C:\Windows\System\ImBWRRu.exe
  C:\Windows\System\ImBWRRu.exe
  2⤵
  PID:3228
- C:\Windows\System\saRMTvI.exe
  C:\Windows\System\saRMTvI.exe
  2⤵
  PID:3296
- C:\Windows\System\ZVxXolD.exe
  C:\Windows\System\ZVxXolD.exe
  2⤵
  PID:3276
- C:\Windows\System\qQxRxNp.exe
  C:\Windows\System\qQxRxNp.exe
  2⤵
  PID:3280
- C:\Windows\System\MxWbUpM.exe
  C:\Windows\System\MxWbUpM.exe
  2⤵
  PID:3364
- C:\Windows\System\LoagVrB.exe
  C:\Windows\System\LoagVrB.exe
  2⤵
  PID:3396
- C:\Windows\System\HCSLbJj.exe
  C:\Windows\System\HCSLbJj.exe
  2⤵
  PID:3448
- C:\Windows\System\HaRrqZM.exe
  C:\Windows\System\HaRrqZM.exe
  2⤵
  PID:3412
- C:\Windows\System\upiSvPb.exe
  C:\Windows\System\upiSvPb.exe
  2⤵
  PID:3472
- C:\Windows\System\vCOaEiF.exe
  C:\Windows\System\vCOaEiF.exe
  2⤵
  PID:3496
- C:\Windows\System\fJnrPQK.exe
  C:\Windows\System\fJnrPQK.exe
  2⤵
  PID:3508
- C:\Windows\System\UoZjJZd.exe
  C:\Windows\System\UoZjJZd.exe
  2⤵
  PID:3564
- C:\Windows\System\awxUamY.exe
  C:\Windows\System\awxUamY.exe
  2⤵
  PID:3588
- C:\Windows\System\RJgBfPW.exe
  C:\Windows\System\RJgBfPW.exe
  2⤵
  PID:3624
- C:\Windows\System\ViznrBm.exe
  C:\Windows\System\ViznrBm.exe
  2⤵
  PID:3640
- C:\Windows\System\oAnnTNQ.exe
  C:\Windows\System\oAnnTNQ.exe
  2⤵
  PID:3688
- C:\Windows\System\OyatXzB.exe
  C:\Windows\System\OyatXzB.exe
  2⤵
  PID:3664
- C:\Windows\System\iZazLRp.exe
  C:\Windows\System\iZazLRp.exe
  2⤵
  PID:3736
- C:\Windows\System\ToVgGZX.exe
  C:\Windows\System\ToVgGZX.exe
  2⤵
  PID:3772
- C:\Windows\System\ABsxLau.exe
  C:\Windows\System\ABsxLau.exe
  2⤵
  PID:3740
- C:\Windows\System\umUiYOd.exe
  C:\Windows\System\umUiYOd.exe
  2⤵
  PID:3848
- C:\Windows\System\RDGJKGm.exe
  C:\Windows\System\RDGJKGm.exe
  2⤵
  PID:3888
- C:\Windows\System\nzGevjw.exe
  C:\Windows\System\nzGevjw.exe
  2⤵
  PID:3896
- C:\Windows\System\dHVCClN.exe
  C:\Windows\System\dHVCClN.exe
  2⤵
  PID:3932
- C:\Windows\System\TypCoaL.exe
  C:\Windows\System\TypCoaL.exe
  2⤵
  PID:3936
- C:\Windows\System\tqrtKtB.exe
  C:\Windows\System\tqrtKtB.exe
  2⤵
  PID:4008
- C:\Windows\System\WIifyxs.exe
  C:\Windows\System\WIifyxs.exe
  2⤵
  PID:3988
- C:\Windows\System\BPhnkyK.exe
  C:\Windows\System\BPhnkyK.exe
  2⤵
  PID:3996
- C:\Windows\System\FdzoRIs.exe
  C:\Windows\System\FdzoRIs.exe
  2⤵
  PID:4076
- C:\Windows\System\QtutDHZ.exe
  C:\Windows\System\QtutDHZ.exe
  2⤵
  PID:3080
- C:\Windows\System\gQhWbdl.exe
  C:\Windows\System\gQhWbdl.exe
  2⤵
  PID:3104
- C:\Windows\System\MVCGqJy.exe
  C:\Windows\System\MVCGqJy.exe
  2⤵
  PID:3164
- C:\Windows\System\OelLuub.exe
  C:\Windows\System\OelLuub.exe
  2⤵
  PID:3208
- C:\Windows\System\GkIlLTX.exe
  C:\Windows\System\GkIlLTX.exe
  2⤵
  PID:3316
- C:\Windows\System\dtNWVcD.exe
  C:\Windows\System\dtNWVcD.exe
  2⤵
  PID:3308
- C:\Windows\System\cCajXIt.exe
  C:\Windows\System\cCajXIt.exe
  2⤵
  PID:3332
- C:\Windows\System\ryECNPp.exe
  C:\Windows\System\ryECNPp.exe
  2⤵
  PID:3376
- C:\Windows\System\nCtjcvk.exe
  C:\Windows\System\nCtjcvk.exe
  2⤵
  PID:3548
- C:\Windows\System\QCPhVjH.exe
  C:\Windows\System\QCPhVjH.exe
  2⤵
  PID:2536
- C:\Windows\System\zZVBRGy.exe
  C:\Windows\System\zZVBRGy.exe
  2⤵
  PID:3756
- C:\Windows\System\kHBDxWL.exe
  C:\Windows\System\kHBDxWL.exe
  2⤵
  PID:3592
- C:\Windows\System\thKfEPx.exe
  C:\Windows\System\thKfEPx.exe
  2⤵
  PID:3568
- C:\Windows\System\WbcUTwj.exe
  C:\Windows\System\WbcUTwj.exe
  2⤵
  PID:3724
- C:\Windows\System\qrKEBay.exe
  C:\Windows\System\qrKEBay.exe
  2⤵
  PID:3432
- C:\Windows\System\CtreAGX.exe
  C:\Windows\System\CtreAGX.exe
  2⤵
  PID:3512
- C:\Windows\System\EcmAwVT.exe
  C:\Windows\System\EcmAwVT.exe
  2⤵
  PID:3812
- C:\Windows\System\EsKzEXq.exe
  C:\Windows\System\EsKzEXq.exe
  2⤵
  PID:3972
- C:\Windows\System\tajdJoj.exe
  C:\Windows\System\tajdJoj.exe
  2⤵
  PID:3844
- C:\Windows\System\fOhtPgM.exe
  C:\Windows\System\fOhtPgM.exe
  2⤵
  PID:3956
- C:\Windows\System\uoNWhxW.exe
  C:\Windows\System\uoNWhxW.exe
  2⤵
  PID:3868
- C:\Windows\System\DXRRpvs.exe
  C:\Windows\System\DXRRpvs.exe
  2⤵
  PID:4060
- C:\Windows\System\euFvWJy.exe
  C:\Windows\System\euFvWJy.exe
  2⤵
  PID:3224
- C:\Windows\System\XkUtQyx.exe
  C:\Windows\System\XkUtQyx.exe
  2⤵
  PID:3188
- C:\Windows\System\KmGAXQJ.exe
  C:\Windows\System\KmGAXQJ.exe
  2⤵
  PID:3356
- C:\Windows\System\vpAnkSv.exe
  C:\Windows\System\vpAnkSv.exe
  2⤵
  PID:3428
- C:\Windows\System\iuwSITa.exe
  C:\Windows\System\iuwSITa.exe
  2⤵
  PID:3668
- C:\Windows\System\QAHKQty.exe
  C:\Windows\System\QAHKQty.exe
  2⤵
  PID:3440
- C:\Windows\System\FMGKVZt.exe
  C:\Windows\System\FMGKVZt.exe
  2⤵
  PID:3644
- C:\Windows\System\LrkUYmq.exe
  C:\Windows\System\LrkUYmq.exe
  2⤵
  PID:3884
- C:\Windows\System\RDuoNQu.exe
  C:\Windows\System\RDuoNQu.exe
  2⤵
  PID:3976
- C:\Windows\System\lwwTgcc.exe
  C:\Windows\System\lwwTgcc.exe
  2⤵
  PID:4040
- C:\Windows\System\KqvhUvs.exe
  C:\Windows\System\KqvhUvs.exe
  2⤵
  PID:3144
- C:\Windows\System\IAktOBi.exe
  C:\Windows\System\IAktOBi.exe
  2⤵
  PID:3392
- C:\Windows\System\YDSaIrK.exe
  C:\Windows\System\YDSaIrK.exe
  2⤵
  PID:3456
- C:\Windows\System\UdVClLf.exe
  C:\Windows\System\UdVClLf.exe
  2⤵
  PID:3492
- C:\Windows\System\AxUXccD.exe
  C:\Windows\System\AxUXccD.exe
  2⤵
  PID:3468
- C:\Windows\System\LcPacSV.exe
  C:\Windows\System\LcPacSV.exe
  2⤵
  PID:4064
- C:\Windows\System\BSCjqrb.exe
  C:\Windows\System\BSCjqrb.exe
  2⤵
  PID:3832
- C:\Windows\System\XxvOCwi.exe
  C:\Windows\System\XxvOCwi.exe
  2⤵
  PID:3912
- C:\Windows\System\SGHbIPM.exe
  C:\Windows\System\SGHbIPM.exe
  2⤵
  PID:4104
- C:\Windows\System\buHpAsT.exe
  C:\Windows\System\buHpAsT.exe
  2⤵
  PID:4120
- C:\Windows\System\pEitEQw.exe
  C:\Windows\System\pEitEQw.exe
  2⤵
  PID:4136
- C:\Windows\System\AwLmeMg.exe
  C:\Windows\System\AwLmeMg.exe
  2⤵
  PID:4152
- C:\Windows\System\TiSJvAk.exe
  C:\Windows\System\TiSJvAk.exe
  2⤵
  PID:4168
- C:\Windows\System\dUwDdQq.exe
  C:\Windows\System\dUwDdQq.exe
  2⤵
  PID:4188
- C:\Windows\System\NkeZBdf.exe
  C:\Windows\System\NkeZBdf.exe
  2⤵
  PID:4208
- C:\Windows\System\xTJWMUh.exe
  C:\Windows\System\xTJWMUh.exe
  2⤵
  PID:4228
- C:\Windows\System\jcnyAUa.exe
  C:\Windows\System\jcnyAUa.exe
  2⤵
  PID:4244
- C:\Windows\System\ivhWeaT.exe
  C:\Windows\System\ivhWeaT.exe
  2⤵
  PID:4260
- C:\Windows\System\EiDVudC.exe
  C:\Windows\System\EiDVudC.exe
  2⤵
  PID:4276
- C:\Windows\System\qdaToYI.exe
  C:\Windows\System\qdaToYI.exe
  2⤵
  PID:4292
- C:\Windows\System\rbifjUI.exe
  C:\Windows\System\rbifjUI.exe
  2⤵
  PID:4308
- C:\Windows\System\geqOERH.exe
  C:\Windows\System\geqOERH.exe
  2⤵
  PID:4612
- C:\Windows\System\NBTFMWC.exe
  C:\Windows\System\NBTFMWC.exe
  2⤵
  PID:4632
- C:\Windows\System\xfcWlzS.exe
  C:\Windows\System\xfcWlzS.exe
  2⤵
  PID:4652
- C:\Windows\System\sqUHUvY.exe
  C:\Windows\System\sqUHUvY.exe
  2⤵
  PID:4672
- C:\Windows\System\aXekwsN.exe
  C:\Windows\System\aXekwsN.exe
  2⤵
  PID:4692
- C:\Windows\System\TvHGXTM.exe
  C:\Windows\System\TvHGXTM.exe
  2⤵
  PID:4712
- C:\Windows\System\fPLrfNI.exe
  C:\Windows\System\fPLrfNI.exe
  2⤵
  PID:4732
- C:\Windows\System\bWMOpyx.exe
  C:\Windows\System\bWMOpyx.exe
  2⤵
  PID:4748
- C:\Windows\System\oCDmWpv.exe
  C:\Windows\System\oCDmWpv.exe
  2⤵
  PID:4768
- C:\Windows\System\zvQdDnI.exe
  C:\Windows\System\zvQdDnI.exe
  2⤵
  PID:4784
- C:\Windows\System\qEutUTx.exe
  C:\Windows\System\qEutUTx.exe
  2⤵
  PID:4808
- C:\Windows\System\jBeGiqc.exe
  C:\Windows\System\jBeGiqc.exe
  2⤵
  PID:4828
- C:\Windows\System\pKfVsor.exe
  C:\Windows\System\pKfVsor.exe
  2⤵
  PID:4844
- C:\Windows\System\rBKFaPC.exe
  C:\Windows\System\rBKFaPC.exe
  2⤵
  PID:4876
- C:\Windows\System\HhaFHpy.exe
  C:\Windows\System\HhaFHpy.exe
  2⤵
  PID:4896
- C:\Windows\System\dTLtAjS.exe
  C:\Windows\System\dTLtAjS.exe
  2⤵
  PID:4916
- C:\Windows\System\LYAwnqj.exe
  C:\Windows\System\LYAwnqj.exe
  2⤵
  PID:4940
- C:\Windows\System\NyKqexv.exe
  C:\Windows\System\NyKqexv.exe
  2⤵
  PID:4960
- C:\Windows\System\PaykyQm.exe
  C:\Windows\System\PaykyQm.exe
  2⤵
  PID:4976
- C:\Windows\System\caVmyPF.exe
  C:\Windows\System\caVmyPF.exe
  2⤵
  PID:4996
- C:\Windows\System\EkMRSaE.exe
  C:\Windows\System\EkMRSaE.exe
  2⤵
  PID:5016
- C:\Windows\System\USWkkdi.exe
  C:\Windows\System\USWkkdi.exe
  2⤵
  PID:5032
- C:\Windows\System\oTwbzij.exe
  C:\Windows\System\oTwbzij.exe
  2⤵
  PID:5056
- C:\Windows\System\bKXFNzH.exe
  C:\Windows\System\bKXFNzH.exe
  2⤵
  PID:5080
- C:\Windows\System\bjXpArX.exe
  C:\Windows\System\bjXpArX.exe
  2⤵
  PID:5096
- C:\Windows\System\XOoMuKi.exe
  C:\Windows\System\XOoMuKi.exe
  2⤵
  PID:3132
- C:\Windows\System\TOKJeAo.exe
  C:\Windows\System\TOKJeAo.exe
  2⤵
  PID:3084
- C:\Windows\System\LXdwGUI.exe
  C:\Windows\System\LXdwGUI.exe
  2⤵
  PID:4132
- C:\Windows\System\PFyRROt.exe
  C:\Windows\System\PFyRROt.exe
  2⤵
  PID:3916
- C:\Windows\System\GlVnddD.exe
  C:\Windows\System\GlVnddD.exe
  2⤵
  PID:4204
- C:\Windows\System\idNCRjR.exe
  C:\Windows\System\idNCRjR.exe
  2⤵
  PID:4272
- C:\Windows\System\RBYDdQB.exe
  C:\Windows\System\RBYDdQB.exe
  2⤵
  PID:4256
- C:\Windows\System\YtHxwAe.exe
  C:\Windows\System\YtHxwAe.exe
  2⤵
  PID:4316
- C:\Windows\System\BRXfRgt.exe
  C:\Windows\System\BRXfRgt.exe
  2⤵
  PID:4348
- C:\Windows\System\CejEKBw.exe
  C:\Windows\System\CejEKBw.exe
  2⤵
  PID:4376
- C:\Windows\System\zqiOMMi.exe
  C:\Windows\System\zqiOMMi.exe
  2⤵
  PID:4396
- C:\Windows\System\RXAiGLN.exe
  C:\Windows\System\RXAiGLN.exe
  2⤵
  PID:4412
- C:\Windows\System\PKSzBBN.exe
  C:\Windows\System\PKSzBBN.exe
  2⤵
  PID:4424
- C:\Windows\System\jiBEqLi.exe
  C:\Windows\System\jiBEqLi.exe
  2⤵
  PID:4452
- C:\Windows\System\UUFPGRX.exe
  C:\Windows\System\UUFPGRX.exe
  2⤵
  PID:4464
- C:\Windows\System\bzrEQSU.exe
  C:\Windows\System\bzrEQSU.exe
  2⤵
  PID:4488
- C:\Windows\System\QkuopOp.exe
  C:\Windows\System\QkuopOp.exe
  2⤵
  PID:4516
- C:\Windows\System\FmyakbP.exe
  C:\Windows\System\FmyakbP.exe
  2⤵
  PID:4536
- C:\Windows\System\OSYtFDB.exe
  C:\Windows\System\OSYtFDB.exe
  2⤵
  PID:4560
- C:\Windows\System\mjzgdyv.exe
  C:\Windows\System\mjzgdyv.exe
  2⤵
  PID:4596
- C:\Windows\System\hwYoCfY.exe
  C:\Windows\System\hwYoCfY.exe
  2⤵
  PID:4608
- C:\Windows\System\BlznDnc.exe
  C:\Windows\System\BlznDnc.exe
  2⤵
  PID:4640
- C:\Windows\System\yqFQZQY.exe
  C:\Windows\System\yqFQZQY.exe
  2⤵
  PID:4700
- C:\Windows\System\mnKrOMO.exe
  C:\Windows\System\mnKrOMO.exe
  2⤵
  PID:4688
- C:\Windows\System\Mgtvorp.exe
  C:\Windows\System\Mgtvorp.exe
  2⤵
  PID:4776
- C:\Windows\System\kqLoQbh.exe
  C:\Windows\System\kqLoQbh.exe
  2⤵
  PID:4824
- C:\Windows\System\dpljOut.exe
  C:\Windows\System\dpljOut.exe
  2⤵
  PID:4756
- C:\Windows\System\mLDaYEE.exe
  C:\Windows\System\mLDaYEE.exe
  2⤵
  PID:4800
- C:\Windows\System\AILyrKJ.exe
  C:\Windows\System\AILyrKJ.exe
  2⤵
  PID:4868
- C:\Windows\System\nacjWrj.exe
  C:\Windows\System\nacjWrj.exe
  2⤵
  PID:4884
- C:\Windows\System\CIRXehZ.exe
  C:\Windows\System\CIRXehZ.exe
  2⤵
  PID:4932
- C:\Windows\System\EORFdhh.exe
  C:\Windows\System\EORFdhh.exe
  2⤵
  PID:4952
- C:\Windows\System\KrpLvqR.exe
  C:\Windows\System\KrpLvqR.exe
  2⤵
  PID:5004
- C:\Windows\System\hfEmriu.exe
  C:\Windows\System\hfEmriu.exe
  2⤵
  PID:5012
- C:\Windows\System\KqHAyEE.exe
  C:\Windows\System\KqHAyEE.exe
  2⤵
  PID:5072
- C:\Windows\System\GBmIRDU.exe
  C:\Windows\System\GBmIRDU.exe
  2⤵
  PID:5048
- C:\Windows\System\SPfGYwI.exe
  C:\Windows\System\SPfGYwI.exe
  2⤵
  PID:5108
- C:\Windows\System\xDHiXoK.exe
  C:\Windows\System\xDHiXoK.exe
  2⤵
  PID:4128
- C:\Windows\System\hqQCzjD.exe
  C:\Windows\System\hqQCzjD.exe
  2⤵
  PID:4304
- C:\Windows\System\RkgsEjm.exe
  C:\Windows\System\RkgsEjm.exe
  2⤵
  PID:4388
- C:\Windows\System\uJYlboB.exe
  C:\Windows\System\uJYlboB.exe
  2⤵
  PID:4268
- C:\Windows\System\OFkpRYP.exe
  C:\Windows\System\OFkpRYP.exe
  2⤵
  PID:4428
- C:\Windows\System\nwyyoys.exe
  C:\Windows\System\nwyyoys.exe
  2⤵
  PID:4504
- C:\Windows\System\IFBUGsP.exe
  C:\Windows\System\IFBUGsP.exe
  2⤵
  PID:4544
- C:\Windows\System\vutghEs.exe
  C:\Windows\System\vutghEs.exe
  2⤵
  PID:4440
- C:\Windows\System\gbzJcbg.exe
  C:\Windows\System\gbzJcbg.exe
  2⤵
  PID:4484
- C:\Windows\System\krZLkky.exe
  C:\Windows\System\krZLkky.exe
  2⤵
  PID:4532
- C:\Windows\System\zEQTRvc.exe
  C:\Windows\System\zEQTRvc.exe
  2⤵
  PID:4604
- C:\Windows\System\pEUXtNS.exe
  C:\Windows\System\pEUXtNS.exe
  2⤵
  PID:4588
- C:\Windows\System\psMtoqA.exe
  C:\Windows\System\psMtoqA.exe
  2⤵
  PID:4648
- C:\Windows\System\jwENwra.exe
  C:\Windows\System\jwENwra.exe
  2⤵
  PID:4708
- C:\Windows\System\MqoAFHH.exe
  C:\Windows\System\MqoAFHH.exe
  2⤵
  PID:4816
- C:\Windows\System\hrpvvwj.exe
  C:\Windows\System\hrpvvwj.exe
  2⤵
  PID:4836
- C:\Windows\System\jkYIOuU.exe
  C:\Windows\System\jkYIOuU.exe
  2⤵
  PID:4924
- C:\Windows\System\CyoLAjT.exe
  C:\Windows\System\CyoLAjT.exe
  2⤵
  PID:4972
- C:\Windows\System\KPXrORe.exe
  C:\Windows\System\KPXrORe.exe
  2⤵
  PID:5088
- C:\Windows\System\tmjOLvt.exe
  C:\Windows\System\tmjOLvt.exe
  2⤵
  PID:4948
- C:\Windows\System\mQwxqNA.exe
  C:\Windows\System\mQwxqNA.exe
  2⤵
  PID:5116
- C:\Windows\System\JutKLIm.exe
  C:\Windows\System\JutKLIm.exe
  2⤵
  PID:5040
- C:\Windows\System\qcQXnyp.exe
  C:\Windows\System\qcQXnyp.exe
  2⤵
  PID:4384
- C:\Windows\System\qVierMI.exe
  C:\Windows\System\qVierMI.exe
  2⤵
  PID:4364
- C:\Windows\System\NHgQzPa.exe
  C:\Windows\System\NHgQzPa.exe
  2⤵
  PID:4552
- C:\Windows\System\XRESCOy.exe
  C:\Windows\System\XRESCOy.exe
  2⤵
  PID:4576
- C:\Windows\System\TLfejvF.exe
  C:\Windows\System\TLfejvF.exe
  2⤵
  PID:3648
- C:\Windows\System\YNMkdcd.exe
  C:\Windows\System\YNMkdcd.exe
  2⤵
  PID:4988
- C:\Windows\System\blpjluy.exe
  C:\Windows\System\blpjluy.exe
  2⤵
  PID:4236
- C:\Windows\System\VWyoBMI.exe
  C:\Windows\System\VWyoBMI.exe
  2⤵
  PID:4480
- C:\Windows\System\kcZKidN.exe
  C:\Windows\System\kcZKidN.exe
  2⤵
  PID:4892
- C:\Windows\System\GzJfeup.exe
  C:\Windows\System\GzJfeup.exe
  2⤵
  PID:4564
- C:\Windows\System\mDTLibI.exe
  C:\Windows\System\mDTLibI.exe
  2⤵
  PID:4300
- C:\Windows\System\DXGExTF.exe
  C:\Windows\System\DXGExTF.exe
  2⤵
  PID:4288
- C:\Windows\System\anqiRaq.exe
  C:\Windows\System\anqiRaq.exe
  2⤵
  PID:3764
- C:\Windows\System\ACCEHdI.exe
  C:\Windows\System\ACCEHdI.exe
  2⤵
  PID:4436
- C:\Windows\System\wRgtVIU.exe
  C:\Windows\System\wRgtVIU.exe
  2⤵
  PID:4852
- C:\Windows\System\YqfWfyN.exe
  C:\Windows\System\YqfWfyN.exe
  2⤵
  PID:4796
- C:\Windows\System\KQKMULQ.exe
  C:\Windows\System\KQKMULQ.exe
  2⤵
  PID:4512
- C:\Windows\System\KLHqfui.exe
  C:\Windows\System\KLHqfui.exe
  2⤵
  PID:5068
- C:\Windows\System\lwfmOXG.exe
  C:\Windows\System\lwfmOXG.exe
  2⤵
  PID:4448
- C:\Windows\System\eGMnzsL.exe
  C:\Windows\System\eGMnzsL.exe
  2⤵
  PID:4356
- C:\Windows\System\wzDRVqZ.exe
  C:\Windows\System\wzDRVqZ.exe
  2⤵
  PID:4912
- C:\Windows\System\mkGhjls.exe
  C:\Windows\System\mkGhjls.exe
  2⤵
  PID:4624
- C:\Windows\System\HSsXjGa.exe
  C:\Windows\System\HSsXjGa.exe
  2⤵
  PID:5024
- C:\Windows\System\ixyJktN.exe
  C:\Windows\System\ixyJktN.exe
  2⤵
  PID:5128
- C:\Windows\System\bjepQbC.exe
  C:\Windows\System\bjepQbC.exe
  2⤵
  PID:5152
- C:\Windows\System\HHsZViw.exe
  C:\Windows\System\HHsZViw.exe
  2⤵
  PID:5176
- C:\Windows\System\eESgjNv.exe
  C:\Windows\System\eESgjNv.exe
  2⤵
  PID:5192
- C:\Windows\System\igKIGYd.exe
  C:\Windows\System\igKIGYd.exe
  2⤵
  PID:5208
- C:\Windows\System\MpekjEi.exe
  C:\Windows\System\MpekjEi.exe
  2⤵
  PID:5240
- C:\Windows\System\eOQbYwa.exe
  C:\Windows\System\eOQbYwa.exe
  2⤵
  PID:5268
- C:\Windows\System\QZKYrRp.exe
  C:\Windows\System\QZKYrRp.exe
  2⤵
  PID:5284
- C:\Windows\System\geRflKO.exe
  C:\Windows\System\geRflKO.exe
  2⤵
  PID:5304
- C:\Windows\System\PJaGhfO.exe
  C:\Windows\System\PJaGhfO.exe
  2⤵
  PID:5324
- C:\Windows\System\ydHtORr.exe
  C:\Windows\System\ydHtORr.exe
  2⤵
  PID:5344
- C:\Windows\System\trvoqPy.exe
  C:\Windows\System\trvoqPy.exe
  2⤵
  PID:5364
- C:\Windows\System\LwjUaen.exe
  C:\Windows\System\LwjUaen.exe
  2⤵
  PID:5380
- C:\Windows\System\uHMuvRj.exe
  C:\Windows\System\uHMuvRj.exe
  2⤵
  PID:5396
- C:\Windows\System\kOxifAG.exe
  C:\Windows\System\kOxifAG.exe
  2⤵
  PID:5420
- C:\Windows\System\sVChpIZ.exe
  C:\Windows\System\sVChpIZ.exe
  2⤵
  PID:5440
- C:\Windows\System\ZJJzyoW.exe
  C:\Windows\System\ZJJzyoW.exe
  2⤵
  PID:5456
- C:\Windows\System\gADEgDq.exe
  C:\Windows\System\gADEgDq.exe
  2⤵
  PID:5484
- C:\Windows\System\etlFTHQ.exe
  C:\Windows\System\etlFTHQ.exe
  2⤵
  PID:5504
- C:\Windows\System\ZRhtlAX.exe
  C:\Windows\System\ZRhtlAX.exe
  2⤵
  PID:5524
- C:\Windows\System\CLCkXqk.exe
  C:\Windows\System\CLCkXqk.exe
  2⤵
  PID:5540
- C:\Windows\System\mqIXKyB.exe
  C:\Windows\System\mqIXKyB.exe
  2⤵
  PID:5556
- C:\Windows\System\fFqqELX.exe
  C:\Windows\System\fFqqELX.exe
  2⤵
  PID:5576
- C:\Windows\System\ZqHepwS.exe
  C:\Windows\System\ZqHepwS.exe
  2⤵
  PID:5592
- C:\Windows\System\yduZaqT.exe
  C:\Windows\System\yduZaqT.exe
  2⤵
  PID:5608
- C:\Windows\System\DozUcka.exe
  C:\Windows\System\DozUcka.exe
  2⤵
  PID:5628
- C:\Windows\System\FaVZrVm.exe
  C:\Windows\System\FaVZrVm.exe
  2⤵
  PID:5648
- C:\Windows\System\kmsMQho.exe
  C:\Windows\System\kmsMQho.exe
  2⤵
  PID:5668
- C:\Windows\System\CyFKExk.exe
  C:\Windows\System\CyFKExk.exe
  2⤵
  PID:5688
- C:\Windows\System\lqDINDt.exe
  C:\Windows\System\lqDINDt.exe
  2⤵
  PID:5712
- C:\Windows\System\PTVSEpy.exe
  C:\Windows\System\PTVSEpy.exe
  2⤵
  PID:5732
- C:\Windows\System\KKBEfBk.exe
  C:\Windows\System\KKBEfBk.exe
  2⤵
  PID:5756
- C:\Windows\System\LYmTsFI.exe
  C:\Windows\System\LYmTsFI.exe
  2⤵
  PID:5780
- C:\Windows\System\WTkASxo.exe
  C:\Windows\System\WTkASxo.exe
  2⤵
  PID:5812
- C:\Windows\System\YTPynlF.exe
  C:\Windows\System\YTPynlF.exe
  2⤵
  PID:5828
- C:\Windows\System\AbsrjEB.exe
  C:\Windows\System\AbsrjEB.exe
  2⤵
  PID:5848
- C:\Windows\System\NgAtZeF.exe
  C:\Windows\System\NgAtZeF.exe
  2⤵
  PID:5864
- C:\Windows\System\cJEuApc.exe
  C:\Windows\System\cJEuApc.exe
  2⤵
  PID:5888
- C:\Windows\System\CplyrLe.exe
  C:\Windows\System\CplyrLe.exe
  2⤵
  PID:5904
- C:\Windows\System\eQAxKVy.exe
  C:\Windows\System\eQAxKVy.exe
  2⤵
  PID:5920
- C:\Windows\System\eVrfpbO.exe
  C:\Windows\System\eVrfpbO.exe
  2⤵
  PID:5940
- C:\Windows\System\iOykUtU.exe
  C:\Windows\System\iOykUtU.exe
  2⤵
  PID:5964
- C:\Windows\System\flVjJWC.exe
  C:\Windows\System\flVjJWC.exe
  2⤵
  PID:5980
- C:\Windows\System\JKZSpzk.exe
  C:\Windows\System\JKZSpzk.exe
  2⤵
  PID:5996
- C:\Windows\System\FNfqoFC.exe
  C:\Windows\System\FNfqoFC.exe
  2⤵
  PID:6024
- C:\Windows\System\UPUhsFv.exe
  C:\Windows\System\UPUhsFv.exe
  2⤵
  PID:6044
- C:\Windows\System\BYQtmzb.exe
  C:\Windows\System\BYQtmzb.exe
  2⤵
  PID:6064
- C:\Windows\System\IKPjMsi.exe
  C:\Windows\System\IKPjMsi.exe
  2⤵
  PID:6080
- C:\Windows\System\sYkRnKP.exe
  C:\Windows\System\sYkRnKP.exe
  2⤵
  PID:6108
- C:\Windows\System\jRzBDLi.exe
  C:\Windows\System\jRzBDLi.exe
  2⤵
  PID:6124
- C:\Windows\System\vehKWTP.exe
  C:\Windows\System\vehKWTP.exe
  2⤵
  PID:6140
- C:\Windows\System\WQNoFof.exe
  C:\Windows\System\WQNoFof.exe
  2⤵
  PID:4728
- C:\Windows\System\uncGNRD.exe
  C:\Windows\System\uncGNRD.exe
  2⤵
  PID:5172
- C:\Windows\System\LseUBWG.exe
  C:\Windows\System\LseUBWG.exe
  2⤵
  PID:5248
- C:\Windows\System\rAfVbnF.exe
  C:\Windows\System\rAfVbnF.exe
  2⤵
  PID:5140
- C:\Windows\System\lawyPad.exe
  C:\Windows\System\lawyPad.exe
  2⤵
  PID:5144
- C:\Windows\System\ZJiNotU.exe
  C:\Windows\System\ZJiNotU.exe
  2⤵
  PID:5224
- C:\Windows\System\YesMSjQ.exe
  C:\Windows\System\YesMSjQ.exe
  2⤵
  PID:5264
- C:\Windows\System\zKzkJPU.exe
  C:\Windows\System\zKzkJPU.exe
  2⤵
  PID:5280
- C:\Windows\System\UhaBxRl.exe
  C:\Windows\System\UhaBxRl.exe
  2⤵
  PID:5312
- C:\Windows\System\JiVhFaj.exe
  C:\Windows\System\JiVhFaj.exe
  2⤵
  PID:5360
- C:\Windows\System\UiZClBN.exe
  C:\Windows\System\UiZClBN.exe
  2⤵
  PID:5408
- C:\Windows\System\sXsWMam.exe
  C:\Windows\System\sXsWMam.exe
  2⤵
  PID:5448
- C:\Windows\System\fjsrfsz.exe
  C:\Windows\System\fjsrfsz.exe
  2⤵
  PID:5464
- C:\Windows\System\ZIVrxIk.exe
  C:\Windows\System\ZIVrxIk.exe
  2⤵
  PID:5492
- C:\Windows\System\tlgFfbl.exe
  C:\Windows\System\tlgFfbl.exe
  2⤵
  PID:5532
- C:\Windows\System\MzEMHAo.exe
  C:\Windows\System\MzEMHAo.exe
  2⤵
  PID:5600
- C:\Windows\System\bmSKVMe.exe
  C:\Windows\System\bmSKVMe.exe
  2⤵
  PID:5684
- C:\Windows\System\UImqjTD.exe
  C:\Windows\System\UImqjTD.exe
  2⤵
  PID:5512
- C:\Windows\System\KnQZati.exe
  C:\Windows\System\KnQZati.exe
  2⤵
  PID:5764
- C:\Windows\System\KvhHDiv.exe
  C:\Windows\System\KvhHDiv.exe
  2⤵
  PID:5516
- C:\Windows\System\VtgTdnX.exe
  C:\Windows\System\VtgTdnX.exe
  2⤵
  PID:5696
- C:\Windows\System\nUhkPvt.exe
  C:\Windows\System\nUhkPvt.exe
  2⤵
  PID:5616
- C:\Windows\System\qKpcSmy.exe
  C:\Windows\System\qKpcSmy.exe
  2⤵
  PID:5800
- C:\Windows\System\GNGbFeO.exe
  C:\Windows\System\GNGbFeO.exe
  2⤵
  PID:5808
- C:\Windows\System\oYLGvxb.exe
  C:\Windows\System\oYLGvxb.exe
  2⤵
  PID:5840
- C:\Windows\System\CZYHdyV.exe
  C:\Windows\System\CZYHdyV.exe
  2⤵
  PID:5928
- C:\Windows\System\tJHBfZc.exe
  C:\Windows\System\tJHBfZc.exe
  2⤵
  PID:6008
- C:\Windows\System\VguqloF.exe
  C:\Windows\System\VguqloF.exe
  2⤵
  PID:6020
- C:\Windows\System\QQLbsdN.exe
  C:\Windows\System\QQLbsdN.exe
  2⤵
  PID:6052
- C:\Windows\System\vPLCdvX.exe
  C:\Windows\System\vPLCdvX.exe
  2⤵
  PID:5988
- C:\Windows\System\oKmTPre.exe
  C:\Windows\System\oKmTPre.exe
  2⤵
  PID:6104
- C:\Windows\System\wZiPpax.exe
  C:\Windows\System\wZiPpax.exe
  2⤵
  PID:6032
- C:\Windows\System\FyEhlXo.exe
  C:\Windows\System\FyEhlXo.exe
  2⤵
  PID:6036
- C:\Windows\System\QSHsTcO.exe
  C:\Windows\System\QSHsTcO.exe
  2⤵
  PID:5164
- C:\Windows\System\gnIvuTS.exe
  C:\Windows\System\gnIvuTS.exe
  2⤵
  PID:5200
- C:\Windows\System\YkpQPZI.exe
  C:\Windows\System\YkpQPZI.exe
  2⤵
  PID:5260
- C:\Windows\System\iDZRGoB.exe
  C:\Windows\System\iDZRGoB.exe
  2⤵
  PID:5104
- C:\Windows\System\FGzKaBR.exe
  C:\Windows\System\FGzKaBR.exe
  2⤵
  PID:5296
- C:\Windows\System\NpMSyAf.exe
  C:\Windows\System\NpMSyAf.exe
  2⤵
  PID:5340
- C:\Windows\System\lTtYtOI.exe
  C:\Windows\System\lTtYtOI.exe
  2⤵
  PID:5388
- C:\Windows\System\xFOXCGm.exe
  C:\Windows\System\xFOXCGm.exe
  2⤵
  PID:5416
- C:\Windows\System\HuUkDNH.exe
  C:\Windows\System\HuUkDNH.exe
  2⤵
  PID:5572
- C:\Windows\System\ovbdAId.exe
  C:\Windows\System\ovbdAId.exe
  2⤵
  PID:5640
- C:\Windows\System\dnjayTe.exe
  C:\Windows\System\dnjayTe.exe
  2⤵
  PID:5680
- C:\Windows\System\tGtdDzJ.exe
  C:\Windows\System\tGtdDzJ.exe
  2⤵
  PID:5548
- C:\Windows\System\qLqjjVo.exe
  C:\Windows\System\qLqjjVo.exe
  2⤵
  PID:5768
- C:\Windows\System\hSIkADO.exe
  C:\Windows\System\hSIkADO.exe
  2⤵
  PID:5796
- C:\Windows\System\yUUhsdx.exe
  C:\Windows\System\yUUhsdx.exe
  2⤵
  PID:5656
- C:\Windows\System\NdsvuMd.exe
  C:\Windows\System\NdsvuMd.exe
  2⤵
  PID:6012
- C:\Windows\System\WzQMvxo.exe
  C:\Windows\System\WzQMvxo.exe
  2⤵
  PID:5792
- C:\Windows\System\PziaYvZ.exe
  C:\Windows\System\PziaYvZ.exe
  2⤵
  PID:5916
- C:\Windows\System\YIkLEpZ.exe
  C:\Windows\System\YIkLEpZ.exe
  2⤵
  PID:6088
- C:\Windows\System\RtULDVy.exe
  C:\Windows\System\RtULDVy.exe
  2⤵
  PID:5112
- C:\Windows\System\vxawuDq.exe
  C:\Windows\System\vxawuDq.exe
  2⤵
  PID:6076
- C:\Windows\System\MhUfhjQ.exe
  C:\Windows\System\MhUfhjQ.exe
  2⤵
  PID:4744
- C:\Windows\System\SnoakTS.exe
  C:\Windows\System\SnoakTS.exe
  2⤵
  PID:4904
- C:\Windows\System\OBYdKjd.exe
  C:\Windows\System\OBYdKjd.exe
  2⤵
  PID:5336
- C:\Windows\System\RHyhlHE.exe
  C:\Windows\System\RHyhlHE.exe
  2⤵
  PID:5564
- C:\Windows\System\tuabLRb.exe
  C:\Windows\System\tuabLRb.exe
  2⤵
  PID:5776
- C:\Windows\System\jeODZQl.exe
  C:\Windows\System\jeODZQl.exe
  2⤵
  PID:5428
- C:\Windows\System\YIfaaNK.exe
  C:\Windows\System\YIfaaNK.exe
  2⤵
  PID:5740
- C:\Windows\System\PifrGdh.exe
  C:\Windows\System\PifrGdh.exe
  2⤵
  PID:5660
- C:\Windows\System\wjMccps.exe
  C:\Windows\System\wjMccps.exe
  2⤵
  PID:5620
- C:\Windows\System\uCYHjTn.exe
  C:\Windows\System\uCYHjTn.exe
  2⤵
  PID:5824
- C:\Windows\System\aipfNYZ.exe
  C:\Windows\System\aipfNYZ.exe
  2⤵
  PID:6116
- C:\Windows\System\wIgohzZ.exe
  C:\Windows\System\wIgohzZ.exe
  2⤵
  PID:6132
- C:\Windows\System\FxfmKEl.exe
  C:\Windows\System\FxfmKEl.exe
  2⤵
  PID:4468
- C:\Windows\System\aFEDmjC.exe
  C:\Windows\System\aFEDmjC.exe
  2⤵
  PID:5392
- C:\Windows\System\zxgFqAX.exe
  C:\Windows\System\zxgFqAX.exe
  2⤵
  PID:5860
- C:\Windows\System\iMxmLmW.exe
  C:\Windows\System\iMxmLmW.exe
  2⤵
  PID:5584
- C:\Windows\System\BpNPQyl.exe
  C:\Windows\System\BpNPQyl.exe
  2⤵
  PID:5724
- C:\Windows\System\DmSJrzL.exe
  C:\Windows\System\DmSJrzL.exe
  2⤵
  PID:6016
- C:\Windows\System\DKLBiQL.exe
  C:\Windows\System\DKLBiQL.exe
  2⤵
  PID:5956
- C:\Windows\System\vLxyqpt.exe
  C:\Windows\System\vLxyqpt.exe
  2⤵
  PID:5500
- C:\Windows\System\hNHMDxZ.exe
  C:\Windows\System\hNHMDxZ.exe
  2⤵
  PID:5900
- C:\Windows\System\eiHQvEA.exe
  C:\Windows\System\eiHQvEA.exe
  2⤵
  PID:6060
- C:\Windows\System\dVUqnuc.exe
  C:\Windows\System\dVUqnuc.exe
  2⤵
  PID:4408
- C:\Windows\System\tPNIdJy.exe
  C:\Windows\System\tPNIdJy.exe
  2⤵
  PID:6148
- C:\Windows\System\alowXuR.exe
  C:\Windows\System\alowXuR.exe
  2⤵
  PID:6188
- C:\Windows\System\XVPKKzC.exe
  C:\Windows\System\XVPKKzC.exe
  2⤵
  PID:6212
- C:\Windows\System\MUPQOYX.exe
  C:\Windows\System\MUPQOYX.exe
  2⤵
  PID:6232
- C:\Windows\System\gKFbgen.exe
  C:\Windows\System\gKFbgen.exe
  2⤵
  PID:6248
- C:\Windows\System\JxSofAI.exe
  C:\Windows\System\JxSofAI.exe
  2⤵
  PID:6268
- C:\Windows\System\hUDZMPq.exe
  C:\Windows\System\hUDZMPq.exe
  2⤵
  PID:6288
- C:\Windows\System\ZjBlkht.exe
  C:\Windows\System\ZjBlkht.exe
  2⤵
  PID:6308
- C:\Windows\System\ewveTOA.exe
  C:\Windows\System\ewveTOA.exe
  2⤵
  PID:6324
- C:\Windows\System\nMexLMS.exe
  C:\Windows\System\nMexLMS.exe
  2⤵
  PID:6340
- C:\Windows\System\DlUkQky.exe
  C:\Windows\System\DlUkQky.exe
  2⤵
  PID:6360
- C:\Windows\System\fhcpCRQ.exe
  C:\Windows\System\fhcpCRQ.exe
  2⤵
  PID:6376
- C:\Windows\System\UktUImh.exe
  C:\Windows\System\UktUImh.exe
  2⤵
  PID:6396
- C:\Windows\System\MKwgBkk.exe
  C:\Windows\System\MKwgBkk.exe
  2⤵
  PID:6440
- C:\Windows\System\mKUWFeY.exe
  C:\Windows\System\mKUWFeY.exe
  2⤵
  PID:6456
- C:\Windows\System\rlkPTOe.exe
  C:\Windows\System\rlkPTOe.exe
  2⤵
  PID:6476
- C:\Windows\System\yxTyujD.exe
  C:\Windows\System\yxTyujD.exe
  2⤵
  PID:6492
- C:\Windows\System\TVtsrff.exe
  C:\Windows\System\TVtsrff.exe
  2⤵
  PID:6512
- C:\Windows\System\RGnIYQv.exe
  C:\Windows\System\RGnIYQv.exe
  2⤵
  PID:6532
- C:\Windows\System\VPctjzr.exe
  C:\Windows\System\VPctjzr.exe
  2⤵
  PID:6552
- C:\Windows\System\pGHrDOp.exe
  C:\Windows\System\pGHrDOp.exe
  2⤵
  PID:6568
- C:\Windows\System\GLekQtW.exe
  C:\Windows\System\GLekQtW.exe
  2⤵
  PID:6584
- C:\Windows\System\pXtnMnc.exe
  C:\Windows\System\pXtnMnc.exe
  2⤵
  PID:6624
- C:\Windows\System\OTmcOsi.exe
  C:\Windows\System\OTmcOsi.exe
  2⤵
  PID:6640
- C:\Windows\System\wLFqgIv.exe
  C:\Windows\System\wLFqgIv.exe
  2⤵
  PID:6660
- C:\Windows\System\ALpqwXp.exe
  C:\Windows\System\ALpqwXp.exe
  2⤵
  PID:6680
- C:\Windows\System\IbcDvmk.exe
  C:\Windows\System\IbcDvmk.exe
  2⤵
  PID:6704
- C:\Windows\System\awdnWMM.exe
  C:\Windows\System\awdnWMM.exe
  2⤵
  PID:6720
- C:\Windows\System\aQukqZo.exe
  C:\Windows\System\aQukqZo.exe
  2⤵
  PID:6740
- C:\Windows\System\PwMHFrQ.exe
  C:\Windows\System\PwMHFrQ.exe
  2⤵
  PID:6760
- C:\Windows\System\EajaOGI.exe
  C:\Windows\System\EajaOGI.exe
  2⤵
  PID:6780
- C:\Windows\System\bkwFzBj.exe
  C:\Windows\System\bkwFzBj.exe
  2⤵
  PID:6800
- C:\Windows\System\OZbfbfs.exe
  C:\Windows\System\OZbfbfs.exe
  2⤵
  PID:6816
- C:\Windows\System\rGOeJgV.exe
  C:\Windows\System\rGOeJgV.exe
  2⤵
  PID:6836
- C:\Windows\System\megSlRZ.exe
  C:\Windows\System\megSlRZ.exe
  2⤵
  PID:6856
- C:\Windows\System\uTWQARE.exe
  C:\Windows\System\uTWQARE.exe
  2⤵
  PID:6872
- C:\Windows\System\xvjvQoc.exe
  C:\Windows\System\xvjvQoc.exe
  2⤵
  PID:6892
- C:\Windows\System\hEVGWLh.exe
  C:\Windows\System\hEVGWLh.exe
  2⤵
  PID:6908
- C:\Windows\System\hHQxcoc.exe
  C:\Windows\System\hHQxcoc.exe
  2⤵
  PID:6940
- C:\Windows\System\qcPAoAM.exe
  C:\Windows\System\qcPAoAM.exe
  2⤵
  PID:6960
- C:\Windows\System\oPPaNlk.exe
  C:\Windows\System\oPPaNlk.exe
  2⤵
  PID:6976
- C:\Windows\System\IKOdmZl.exe
  C:\Windows\System\IKOdmZl.exe
  2⤵
  PID:6996
- C:\Windows\System\HXpgfcP.exe
  C:\Windows\System\HXpgfcP.exe
  2⤵
  PID:7016
- C:\Windows\System\XYHYcqp.exe
  C:\Windows\System\XYHYcqp.exe
  2⤵
  PID:7032
- C:\Windows\System\HicuvNS.exe
  C:\Windows\System\HicuvNS.exe
  2⤵
  PID:7052
- C:\Windows\System\GAOPtCr.exe
  C:\Windows\System\GAOPtCr.exe
  2⤵
  PID:7076
- C:\Windows\System\AIhJWHd.exe
  C:\Windows\System\AIhJWHd.exe
  2⤵
  PID:7092
- C:\Windows\System\qUzcxxL.exe
  C:\Windows\System\qUzcxxL.exe
  2⤵
  PID:7116
- C:\Windows\System\WfzVoKz.exe
  C:\Windows\System\WfzVoKz.exe
  2⤵
  PID:7132
- C:\Windows\System\PfMkWmP.exe
  C:\Windows\System\PfMkWmP.exe
  2⤵
  PID:7156
- C:\Windows\System\EcfTIvj.exe
  C:\Windows\System\EcfTIvj.exe
  2⤵
  PID:5728
- C:\Windows\System\HSGpkEa.exe
  C:\Windows\System\HSGpkEa.exe
  2⤵
  PID:5856
- C:\Windows\System\kHvYVBp.exe
  C:\Windows\System\kHvYVBp.exe
  2⤵
  PID:6156
- C:\Windows\System\yZJgZPX.exe
  C:\Windows\System\yZJgZPX.exe
  2⤵
  PID:6172
- C:\Windows\System\xhbGKZJ.exe
  C:\Windows\System\xhbGKZJ.exe
  2⤵
  PID:6204
- C:\Windows\System\jxKuAVz.exe
  C:\Windows\System\jxKuAVz.exe
  2⤵
  PID:968
- C:\Windows\System\bLBXRAX.exe
  C:\Windows\System\bLBXRAX.exe
  2⤵
  PID:6220
- C:\Windows\System\IudtCFD.exe
  C:\Windows\System\IudtCFD.exe
  2⤵
  PID:6284
- C:\Windows\System\oEdpFPP.exe
  C:\Windows\System\oEdpFPP.exe
  2⤵
  PID:6356
- C:\Windows\System\avBhtFc.exe
  C:\Windows\System\avBhtFc.exe
  2⤵
  PID:6264
- C:\Windows\System\ziJmweI.exe
  C:\Windows\System\ziJmweI.exe
  2⤵
  PID:6372
- C:\Windows\System\WYDrzyD.exe
  C:\Windows\System\WYDrzyD.exe
  2⤵
  PID:6404
- C:\Windows\System\NtrDfQo.exe
  C:\Windows\System\NtrDfQo.exe
  2⤵
  PID:6432
- C:\Windows\System\aVnfbjj.exe
  C:\Windows\System\aVnfbjj.exe
  2⤵
  PID:6448
- C:\Windows\System\xhTvGbD.exe
  C:\Windows\System\xhTvGbD.exe
  2⤵
  PID:6484
- C:\Windows\System\VakRiiT.exe
  C:\Windows\System\VakRiiT.exe
  2⤵
  PID:6524
- C:\Windows\System\wkpiVMl.exe
  C:\Windows\System\wkpiVMl.exe
  2⤵
  PID:6596
- C:\Windows\System\BWBHoOE.exe
  C:\Windows\System\BWBHoOE.exe
  2⤵
  PID:6544
- C:\Windows\System\iiwPdUI.exe
  C:\Windows\System\iiwPdUI.exe
  2⤵
  PID:6604
- C:\Windows\System\cGCmiBe.exe
  C:\Windows\System\cGCmiBe.exe
  2⤵
  PID:5220
- C:\Windows\System\wBdjmZM.exe
  C:\Windows\System\wBdjmZM.exe
  2⤵
  PID:6700
- C:\Windows\System\LfuFKGx.exe
  C:\Windows\System\LfuFKGx.exe
  2⤵
  PID:6732
- C:\Windows\System\JdKMVDi.exe
  C:\Windows\System\JdKMVDi.exe
  2⤵
  PID:6748
- C:\Windows\System\TDPEcqM.exe
  C:\Windows\System\TDPEcqM.exe
  2⤵
  PID:6808
- C:\Windows\System\DQVbbVD.exe
  C:\Windows\System\DQVbbVD.exe
  2⤵
  PID:6848
- C:\Windows\System\miihzaM.exe
  C:\Windows\System\miihzaM.exe
  2⤵
  PID:6888
- C:\Windows\System\bIwFEqD.exe
  C:\Windows\System\bIwFEqD.exe
  2⤵
  PID:6920
- C:\Windows\System\vKCgGYc.exe
  C:\Windows\System\vKCgGYc.exe
  2⤵
  PID:6936
- C:\Windows\System\AgDujKq.exe
  C:\Windows\System\AgDujKq.exe
  2⤵
  PID:6968
- C:\Windows\System\QwPOmXs.exe
  C:\Windows\System\QwPOmXs.exe
  2⤵
  PID:7008
- C:\Windows\System\tejTZVC.exe
  C:\Windows\System\tejTZVC.exe
  2⤵
  PID:7024
- C:\Windows\System\XxTUiCd.exe
  C:\Windows\System\XxTUiCd.exe
  2⤵
  PID:7088
- C:\Windows\System\jNrXjeG.exe
  C:\Windows\System\jNrXjeG.exe
  2⤵
  PID:7108
- C:\Windows\System\yQqzXga.exe
  C:\Windows\System\yQqzXga.exe
  2⤵
  PID:7068
- C:\Windows\System\wgKcjrl.exe
  C:\Windows\System\wgKcjrl.exe
  2⤵
  PID:5636
- C:\Windows\System\nnFRthO.exe
  C:\Windows\System\nnFRthO.exe
  2⤵
  PID:5188
- C:\Windows\System\nFKuDYv.exe
  C:\Windows\System\nFKuDYv.exe
  2⤵
  PID:6164
- C:\Windows\System\nASJXPg.exe
  C:\Windows\System\nASJXPg.exe
  2⤵
  PID:2284
- C:\Windows\System\nAoQRxU.exe
  C:\Windows\System\nAoQRxU.exe
  2⤵
  PID:1980
- C:\Windows\System\ibIJOib.exe
  C:\Windows\System\ibIJOib.exe
  2⤵
  PID:6352
- C:\Windows\System\UjWrVew.exe
  C:\Windows\System\UjWrVew.exe
  2⤵
  PID:6416
- C:\Windows\System\POCTYLM.exe
  C:\Windows\System\POCTYLM.exe
  2⤵
  PID:6468
- C:\Windows\System\bEffSZV.exe
  C:\Windows\System\bEffSZV.exe
  2⤵
  PID:6332
- C:\Windows\System\iECCorW.exe
  C:\Windows\System\iECCorW.exe
  2⤵
  PID:6436
- C:\Windows\System\yEPnsvC.exe
  C:\Windows\System\yEPnsvC.exe
  2⤵
  PID:6676
- C:\Windows\System\izjjDmL.exe
  C:\Windows\System\izjjDmL.exe
  2⤵
  PID:6688
- C:\Windows\System\qPpcJmb.exe
  C:\Windows\System\qPpcJmb.exe
  2⤵
  PID:6620
- C:\Windows\System\Tkonmuh.exe
  C:\Windows\System\Tkonmuh.exe
  2⤵
  PID:6728
- C:\Windows\System\AXYquNr.exe
  C:\Windows\System\AXYquNr.exe
  2⤵
  PID:6916
- C:\Windows\System\gJQdbIj.exe
  C:\Windows\System\gJQdbIj.exe
  2⤵
  PID:6900
- C:\Windows\System\TBAMtba.exe
  C:\Windows\System\TBAMtba.exe
  2⤵
  PID:7040
- C:\Windows\System\kKtsCMc.exe
  C:\Windows\System\kKtsCMc.exe
  2⤵
  PID:6884
- C:\Windows\System\KmejShy.exe
  C:\Windows\System\KmejShy.exe
  2⤵
  PID:6952
- C:\Windows\System\JYNYonW.exe
  C:\Windows\System\JYNYonW.exe
  2⤵
  PID:7072
- C:\Windows\System\BOMEKpt.exe
  C:\Windows\System\BOMEKpt.exe
  2⤵
  PID:5912
- C:\Windows\System\rMKGzvr.exe
  C:\Windows\System\rMKGzvr.exe
  2⤵
  PID:5748
- C:\Windows\System\Coikftg.exe
  C:\Windows\System\Coikftg.exe
  2⤵
  PID:5972
- C:\Windows\System\UOYvIyN.exe
  C:\Windows\System\UOYvIyN.exe
  2⤵
  PID:6296
- C:\Windows\System\cgpRIWO.exe
  C:\Windows\System\cgpRIWO.exe
  2⤵
  PID:6316
- C:\Windows\System\bjGDMBO.exe
  C:\Windows\System\bjGDMBO.exe
  2⤵
  PID:6564
- C:\Windows\System\aOccNfB.exe
  C:\Windows\System\aOccNfB.exe
  2⤵
  PID:6508
- C:\Windows\System\CNnsoWq.exe
  C:\Windows\System\CNnsoWq.exe
  2⤵
  PID:6672
- C:\Windows\System\JYkoUtv.exe
  C:\Windows\System\JYkoUtv.exe
  2⤵
  PID:6608
- C:\Windows\System\VsUEnnU.exe
  C:\Windows\System\VsUEnnU.exe
  2⤵
  PID:6756
- C:\Windows\System\nYgJRLd.exe
  C:\Windows\System\nYgJRLd.exe
  2⤵
  PID:6932
- C:\Windows\System\LjwBtXS.exe
  C:\Windows\System\LjwBtXS.exe
  2⤵
  PID:7004
- C:\Windows\System\WAKLeWF.exe
  C:\Windows\System\WAKLeWF.exe
  2⤵
  PID:7084
- C:\Windows\System\wxpEvMo.exe
  C:\Windows\System\wxpEvMo.exe
  2⤵
  PID:7140
- C:\Windows\System\pGqlwgg.exe
  C:\Windows\System\pGqlwgg.exe
  2⤵
  PID:6276
- C:\Windows\System\yzkCrWj.exe
  C:\Windows\System\yzkCrWj.exe
  2⤵
  PID:6244
- C:\Windows\System\UtXxwUk.exe
  C:\Windows\System\UtXxwUk.exe
  2⤵
  PID:6548
- C:\Windows\System\wNkGQsm.exe
  C:\Windows\System\wNkGQsm.exe
  2⤵
  PID:6464
- C:\Windows\System\IMGDbjA.exe
  C:\Windows\System\IMGDbjA.exe
  2⤵
  PID:6788
- C:\Windows\System\pnwWefQ.exe
  C:\Windows\System\pnwWefQ.exe
  2⤵
  PID:6776
- C:\Windows\System\xzwkZQc.exe
  C:\Windows\System\xzwkZQc.exe
  2⤵
  PID:7128
- C:\Windows\System\viEaVql.exe
  C:\Windows\System\viEaVql.exe
  2⤵
  PID:6200
- C:\Windows\System\MIwiOub.exe
  C:\Windows\System\MIwiOub.exe
  2⤵
  PID:7152
- C:\Windows\System\AzsHDJD.exe
  C:\Windows\System\AzsHDJD.exe
  2⤵
  PID:6336
- C:\Windows\System\SPlalDY.exe
  C:\Windows\System\SPlalDY.exe
  2⤵
  PID:6392
- C:\Windows\System\JUktmNy.exe
  C:\Windows\System\JUktmNy.exe
  2⤵
  PID:6652
- C:\Windows\System\riqiYql.exe
  C:\Windows\System\riqiYql.exe
  2⤵
  PID:6984
- C:\Windows\System\ifEXpaM.exe
  C:\Windows\System\ifEXpaM.exe
  2⤵
  PID:7044
- C:\Windows\System\jLdVPPu.exe
  C:\Windows\System\jLdVPPu.exe
  2⤵
  PID:6864
- C:\Windows\System\nnGqXXv.exe
  C:\Windows\System\nnGqXXv.exe
  2⤵
  PID:6424
- C:\Windows\System\XhZFnJS.exe
  C:\Windows\System\XhZFnJS.exe
  2⤵
  PID:7172
- C:\Windows\System\vwdsxjy.exe
  C:\Windows\System\vwdsxjy.exe
  2⤵
  PID:7188
- C:\Windows\System\tpdDxGz.exe
  C:\Windows\System\tpdDxGz.exe
  2⤵
  PID:7208
- C:\Windows\System\klTOuUe.exe
  C:\Windows\System\klTOuUe.exe
  2⤵
  PID:7228
- C:\Windows\System\ikJoaGq.exe
  C:\Windows\System\ikJoaGq.exe
  2⤵
  PID:7244
- C:\Windows\System\RKBgfFn.exe
  C:\Windows\System\RKBgfFn.exe
  2⤵
  PID:7268
- C:\Windows\System\lKikUeh.exe
  C:\Windows\System\lKikUeh.exe
  2⤵
  PID:7284
- C:\Windows\System\uCFIAaW.exe
  C:\Windows\System\uCFIAaW.exe
  2⤵
  PID:7304
- C:\Windows\System\KBAAUXc.exe
  C:\Windows\System\KBAAUXc.exe
  2⤵
  PID:7320
- C:\Windows\System\vEqjBTz.exe
  C:\Windows\System\vEqjBTz.exe
  2⤵
  PID:7336
- C:\Windows\System\hvxgCFs.exe
  C:\Windows\System\hvxgCFs.exe
  2⤵
  PID:7356
- C:\Windows\System\tLMTuVA.exe
  C:\Windows\System\tLMTuVA.exe
  2⤵
  PID:7376
- C:\Windows\System\clGpmnv.exe
  C:\Windows\System\clGpmnv.exe
  2⤵
  PID:7392
- C:\Windows\System\mwogxwH.exe
  C:\Windows\System\mwogxwH.exe
  2⤵
  PID:7416
- C:\Windows\System\ljcwENC.exe
  C:\Windows\System\ljcwENC.exe
  2⤵
  PID:7436
- C:\Windows\System\RfVezbY.exe
  C:\Windows\System\RfVezbY.exe
  2⤵
  PID:7452
- C:\Windows\System\MrsxRql.exe
  C:\Windows\System\MrsxRql.exe
  2⤵
  PID:7468
- C:\Windows\System\ffJgQuL.exe
  C:\Windows\System\ffJgQuL.exe
  2⤵
  PID:7520
- C:\Windows\System\DAcSXof.exe
  C:\Windows\System\DAcSXof.exe
  2⤵
  PID:7540
- C:\Windows\System\WZXjQsb.exe
  C:\Windows\System\WZXjQsb.exe
  2⤵
  PID:7560
- C:\Windows\System\PWnPXmK.exe
  C:\Windows\System\PWnPXmK.exe
  2⤵
  PID:7580
- C:\Windows\System\AojtMsI.exe
  C:\Windows\System\AojtMsI.exe
  2⤵
  PID:7600
- C:\Windows\System\OavJaIU.exe
  C:\Windows\System\OavJaIU.exe
  2⤵
  PID:7616
- C:\Windows\System\pgOShZc.exe
  C:\Windows\System\pgOShZc.exe
  2⤵
  PID:7640
- C:\Windows\System\JjpUUVr.exe
  C:\Windows\System\JjpUUVr.exe
  2⤵
  PID:7660
- C:\Windows\System\ATYtzDj.exe
  C:\Windows\System\ATYtzDj.exe
  2⤵
  PID:7680
- C:\Windows\System\vNUlinx.exe
  C:\Windows\System\vNUlinx.exe
  2⤵
  PID:7700
- C:\Windows\System\xHceoya.exe
  C:\Windows\System\xHceoya.exe
  2⤵
  PID:7720
- C:\Windows\System\YBvZbkt.exe
  C:\Windows\System\YBvZbkt.exe
  2⤵
  PID:7736
- C:\Windows\System\JGYTNBU.exe
  C:\Windows\System\JGYTNBU.exe
  2⤵
  PID:7756
- C:\Windows\System\OpRbThg.exe
  C:\Windows\System\OpRbThg.exe
  2⤵
  PID:7784
- C:\Windows\System\naKFsLi.exe
  C:\Windows\System\naKFsLi.exe
  2⤵
  PID:7800
- C:\Windows\System\IYEaqTP.exe
  C:\Windows\System\IYEaqTP.exe
  2⤵
  PID:7816
- C:\Windows\System\OyKWJCp.exe
  C:\Windows\System\OyKWJCp.exe
  2⤵
  PID:7832
- C:\Windows\System\zYGgByW.exe
  C:\Windows\System\zYGgByW.exe
  2⤵
  PID:7856
- C:\Windows\System\fspZUlW.exe
  C:\Windows\System\fspZUlW.exe
  2⤵
  PID:7872
- C:\Windows\System\DbmriST.exe
  C:\Windows\System\DbmriST.exe
  2⤵
  PID:7892
- C:\Windows\System\VMuMnXP.exe
  C:\Windows\System\VMuMnXP.exe
  2⤵
  PID:7912
- C:\Windows\System\CuNzSYr.exe
  C:\Windows\System\CuNzSYr.exe
  2⤵
  PID:7932
- C:\Windows\System\cVsTKlQ.exe
  C:\Windows\System\cVsTKlQ.exe
  2⤵
  PID:7960
- C:\Windows\System\cXJwTJX.exe
  C:\Windows\System\cXJwTJX.exe
  2⤵
  PID:7976
- C:\Windows\System\cINfEyO.exe
  C:\Windows\System\cINfEyO.exe
  2⤵
  PID:7996
- C:\Windows\System\wpejWRD.exe
  C:\Windows\System\wpejWRD.exe
  2⤵
  PID:8012
- C:\Windows\System\sPmahIZ.exe
  C:\Windows\System\sPmahIZ.exe
  2⤵
  PID:8028
- C:\Windows\System\dpcSiGk.exe
  C:\Windows\System\dpcSiGk.exe
  2⤵
  PID:8044
- C:\Windows\System\XbDBsbV.exe
  C:\Windows\System\XbDBsbV.exe
  2⤵
  PID:8068
- C:\Windows\System\CaIcyTr.exe
  C:\Windows\System\CaIcyTr.exe
  2⤵
  PID:8088
- C:\Windows\System\WhhAHeQ.exe
  C:\Windows\System\WhhAHeQ.exe
  2⤵
  PID:8116
- C:\Windows\System\syvpJxK.exe
  C:\Windows\System\syvpJxK.exe
  2⤵
  PID:8136
- C:\Windows\System\OPBRufZ.exe
  C:\Windows\System\OPBRufZ.exe
  2⤵
  PID:8156
- C:\Windows\System\qjmnOqf.exe
  C:\Windows\System\qjmnOqf.exe
  2⤵
  PID:8172
- C:\Windows\System\PiWRqLT.exe
  C:\Windows\System\PiWRqLT.exe
  2⤵
  PID:8188
- C:\Windows\System\ZVzMGze.exe
  C:\Windows\System\ZVzMGze.exe
  2⤵
  PID:7200
- C:\Windows\System\UHEDNfI.exe
  C:\Windows\System\UHEDNfI.exe
  2⤵
  PID:7276
- C:\Windows\System\lpqZHpp.exe
  C:\Windows\System\lpqZHpp.exe
  2⤵
  PID:7316
- C:\Windows\System\oopuRiy.exe
  C:\Windows\System\oopuRiy.exe
  2⤵
  PID:7348
- C:\Windows\System\euCWvhK.exe
  C:\Windows\System\euCWvhK.exe
  2⤵
  PID:7460
- C:\Windows\System\lnudfWs.exe
  C:\Windows\System\lnudfWs.exe
  2⤵
  PID:7464
- C:\Windows\System\KBJVjJH.exe
  C:\Windows\System\KBJVjJH.exe
  2⤵
  PID:7400
- C:\Windows\System\gxeYVTS.exe
  C:\Windows\System\gxeYVTS.exe
  2⤵
  PID:7256
- C:\Windows\System\wwqzbDi.exe
  C:\Windows\System\wwqzbDi.exe
  2⤵
  PID:7300
- C:\Windows\System\YFZHboH.exe
  C:\Windows\System\YFZHboH.exe
  2⤵
  PID:7364
- C:\Windows\System\itRqoIJ.exe
  C:\Windows\System\itRqoIJ.exe
  2⤵
  PID:7488
- C:\Windows\System\iAseWbX.exe
  C:\Windows\System\iAseWbX.exe
  2⤵
  PID:7496
- C:\Windows\System\zxXoGeL.exe
  C:\Windows\System\zxXoGeL.exe
  2⤵
  PID:7568
- C:\Windows\System\FHwKYMQ.exe
  C:\Windows\System\FHwKYMQ.exe
  2⤵
  PID:7612
- C:\Windows\System\Utzyzyj.exe
  C:\Windows\System\Utzyzyj.exe
  2⤵
  PID:7648
- C:\Windows\System\onxTXRq.exe
  C:\Windows\System\onxTXRq.exe
  2⤵
  PID:7676
- C:\Windows\System\qChZaON.exe
  C:\Windows\System\qChZaON.exe
  2⤵
  PID:7708
- C:\Windows\System\BiVNpph.exe
  C:\Windows\System\BiVNpph.exe
  2⤵
  PID:7780
- C:\Windows\System\EJcljBk.exe
  C:\Windows\System\EJcljBk.exe
  2⤵
  PID:7844
- C:\Windows\System\VOBBFBM.exe
  C:\Windows\System\VOBBFBM.exe
  2⤵
  PID:7824
- C:\Windows\System\jmtyuxs.exe
  C:\Windows\System\jmtyuxs.exe
  2⤵
  PID:7796
- C:\Windows\System\UyEvYGj.exe
  C:\Windows\System\UyEvYGj.exe
  2⤵
  PID:7908
- C:\Windows\System\IrEepiF.exe
  C:\Windows\System\IrEepiF.exe
  2⤵
  PID:7944
- C:\Windows\System\SLIgBTU.exe
  C:\Windows\System\SLIgBTU.exe
  2⤵
  PID:7956
- C:\Windows\System\nrEZdEU.exe
  C:\Windows\System\nrEZdEU.exe
  2⤵
  PID:8080
- C:\Windows\System\HgEzthQ.exe
  C:\Windows\System\HgEzthQ.exe
  2⤵
  PID:8024
- C:\Windows\System\AItzEFU.exe
  C:\Windows\System\AItzEFU.exe
  2⤵
  PID:8112
- C:\Windows\System\PHyUACi.exe
  C:\Windows\System\PHyUACi.exe
  2⤵
  PID:8104
- C:\Windows\System\uFwewdn.exe
  C:\Windows\System\uFwewdn.exe
  2⤵
  PID:8164
- C:\Windows\System\FbMqVcL.exe
  C:\Windows\System\FbMqVcL.exe
  2⤵
  PID:7180
- C:\Windows\System\iApoIdW.exe
  C:\Windows\System\iApoIdW.exe
  2⤵
  PID:8052
- C:\Windows\System\kExTbLQ.exe
  C:\Windows\System\kExTbLQ.exe
  2⤵
  PID:7424
- C:\Windows\System\gKrVOhR.exe
  C:\Windows\System\gKrVOhR.exe
  2⤵
  PID:7224
- C:\Windows\System\VWiamPr.exe
  C:\Windows\System\VWiamPr.exe
  2⤵
  PID:7344
- C:\Windows\System\HJbNizD.exe
  C:\Windows\System\HJbNizD.exe
  2⤵
  PID:7448
- C:\Windows\System\RoaSVNk.exe
  C:\Windows\System\RoaSVNk.exe
  2⤵
  PID:6388
- C:\Windows\System\QdsbSZX.exe
  C:\Windows\System\QdsbSZX.exe
  2⤵
  PID:7692
- C:\Windows\System\omxcYUx.exe
  C:\Windows\System\omxcYUx.exe
  2⤵
  PID:7408
- C:\Windows\System\fHMzNRy.exe
  C:\Windows\System\fHMzNRy.exe
  2⤵
  PID:7536
- C:\Windows\System\NRwsurU.exe
  C:\Windows\System\NRwsurU.exe
  2⤵
  PID:7636
- C:\Windows\System\rwZmEXx.exe
  C:\Windows\System\rwZmEXx.exe
  2⤵
  PID:7752
- C:\Windows\System\jLJCUnR.exe
  C:\Windows\System\jLJCUnR.exe
  2⤵
  PID:7840
- C:\Windows\System\wfFywSc.exe
  C:\Windows\System\wfFywSc.exe
  2⤵
  PID:7848
- C:\Windows\System\KXVkwMA.exe
  C:\Windows\System\KXVkwMA.exe
  2⤵
  PID:7864
- C:\Windows\System\tZYhIsk.exe
  C:\Windows\System\tZYhIsk.exe
  2⤵
  PID:7940
- C:\Windows\System\pyiHeQC.exe
  C:\Windows\System\pyiHeQC.exe
  2⤵
  PID:8060
- C:\Windows\System\RNufmZG.exe
  C:\Windows\System\RNufmZG.exe
  2⤵
  PID:8064
- C:\Windows\System\qSQfuCa.exe
  C:\Windows\System\qSQfuCa.exe
  2⤵
  PID:7372
- C:\Windows\System\KUFVFmM.exe
  C:\Windows\System\KUFVFmM.exe
  2⤵
  PID:8180
- C:\Windows\System\DuABIrp.exe
  C:\Windows\System\DuABIrp.exe
  2⤵
  PID:7432
- C:\Windows\System\LnocIUF.exe
  C:\Windows\System\LnocIUF.exe
  2⤵
  PID:6924
- C:\Windows\System\hmiVyIR.exe
  C:\Windows\System\hmiVyIR.exe
  2⤵
  PID:7292
- C:\Windows\System\RYXITsV.exe
  C:\Windows\System\RYXITsV.exe
  2⤵
  PID:7332
- C:\Windows\System\kNigvpT.exe
  C:\Windows\System\kNigvpT.exe
  2⤵
  PID:7728
- C:\Windows\System\IBSvWXu.exe
  C:\Windows\System\IBSvWXu.exe
  2⤵
  PID:7672
- C:\Windows\System\mcAKfAg.exe
  C:\Windows\System\mcAKfAg.exe
  2⤵
  PID:7808
- C:\Windows\System\VQQublY.exe
  C:\Windows\System\VQQublY.exe
  2⤵
  PID:7792
- C:\Windows\System\QnvCGJE.exe
  C:\Windows\System\QnvCGJE.exe
  2⤵
  PID:7988
- C:\Windows\System\YuFwXYq.exe
  C:\Windows\System\YuFwXYq.exe
  2⤵
  PID:8100
- C:\Windows\System\osHEgCr.exe
  C:\Windows\System\osHEgCr.exe
  2⤵
  PID:7476
- C:\Windows\System\cRJuknv.exe
  C:\Windows\System\cRJuknv.exe
  2⤵
  PID:7576
- C:\Windows\System\pEBbpLf.exe
  C:\Windows\System\pEBbpLf.exe
  2⤵
  PID:7656
- C:\Windows\System\gtGCKlW.exe
  C:\Windows\System\gtGCKlW.exe
  2⤵
  PID:7252
- C:\Windows\System\FIniNpo.exe
  C:\Windows\System\FIniNpo.exe
  2⤵
  PID:7220
- C:\Windows\System\lYObgqK.exe
  C:\Windows\System\lYObgqK.exe
  2⤵
  PID:8056
- C:\Windows\System\MiZtGpa.exe
  C:\Windows\System\MiZtGpa.exe
  2⤵
  PID:7716
- C:\Windows\System\bBLghmX.exe
  C:\Windows\System\bBLghmX.exe
  2⤵
  PID:7484
- C:\Windows\System\ytIaYFy.exe
  C:\Windows\System\ytIaYFy.exe
  2⤵
  PID:7924
- C:\Windows\System\ZzquLGA.exe
  C:\Windows\System\ZzquLGA.exe
  2⤵
  PID:7236
- C:\Windows\System\owWGAGW.exe
  C:\Windows\System\owWGAGW.exe
  2⤵
  PID:8208
- C:\Windows\System\iGOmLYq.exe
  C:\Windows\System\iGOmLYq.exe
  2⤵
  PID:8240
- C:\Windows\System\yfPtFRX.exe
  C:\Windows\System\yfPtFRX.exe
  2⤵
  PID:8256
- C:\Windows\System\gJOcaAV.exe
  C:\Windows\System\gJOcaAV.exe
  2⤵
  PID:8272
- C:\Windows\System\KNegsrV.exe
  C:\Windows\System\KNegsrV.exe
  2⤵
  PID:8288
- C:\Windows\System\WiROiOR.exe
  C:\Windows\System\WiROiOR.exe
  2⤵
  PID:8308
- C:\Windows\System\ZAfnzIi.exe
  C:\Windows\System\ZAfnzIi.exe
  2⤵
  PID:8328
- C:\Windows\System\boRoohm.exe
  C:\Windows\System\boRoohm.exe
  2⤵
  PID:8356
- C:\Windows\System\aQaCXAX.exe
  C:\Windows\System\aQaCXAX.exe
  2⤵
  PID:8376
- C:\Windows\System\oFJinMm.exe
  C:\Windows\System\oFJinMm.exe
  2⤵
  PID:8392
- C:\Windows\System\loIaNyb.exe
  C:\Windows\System\loIaNyb.exe
  2⤵
  PID:8408
- C:\Windows\System\kVjwtOW.exe
  C:\Windows\System\kVjwtOW.exe
  2⤵
  PID:8428
- C:\Windows\System\oRzGxjL.exe
  C:\Windows\System\oRzGxjL.exe
  2⤵
  PID:8444
- C:\Windows\System\mbNdXzp.exe
  C:\Windows\System\mbNdXzp.exe
  2⤵
  PID:8468
- C:\Windows\System\cVbuYOc.exe
  C:\Windows\System\cVbuYOc.exe
  2⤵
  PID:8492
- C:\Windows\System\FfcwXWf.exe
  C:\Windows\System\FfcwXWf.exe
  2⤵
  PID:8508
- C:\Windows\System\oydOsqF.exe
  C:\Windows\System\oydOsqF.exe
  2⤵
  PID:8528
- C:\Windows\System\fHcMWkO.exe
  C:\Windows\System\fHcMWkO.exe
  2⤵
  PID:8544
- C:\Windows\System\RJnUpVB.exe
  C:\Windows\System\RJnUpVB.exe
  2⤵
  PID:8568
- C:\Windows\System\XzdkUtb.exe
  C:\Windows\System\XzdkUtb.exe
  2⤵
  PID:8588
- C:\Windows\System\PMJarDE.exe
  C:\Windows\System\PMJarDE.exe
  2⤵
  PID:8608
- C:\Windows\System\xjWwdKA.exe
  C:\Windows\System\xjWwdKA.exe
  2⤵
  PID:8624
- C:\Windows\System\BOEDPvL.exe
  C:\Windows\System\BOEDPvL.exe
  2⤵
  PID:8648
- C:\Windows\System\ruEjazb.exe
  C:\Windows\System\ruEjazb.exe
  2⤵
  PID:8664
- C:\Windows\System\UZBnWix.exe
  C:\Windows\System\UZBnWix.exe
  2⤵
  PID:8688
- C:\Windows\System\KXvgzHc.exe
  C:\Windows\System\KXvgzHc.exe
  2⤵
  PID:8708
- C:\Windows\System\INJapEa.exe
  C:\Windows\System\INJapEa.exe
  2⤵
  PID:8732
- C:\Windows\System\zcyRUEF.exe
  C:\Windows\System\zcyRUEF.exe
  2⤵
  PID:8748
- C:\Windows\System\DfpRmER.exe
  C:\Windows\System\DfpRmER.exe
  2⤵
  PID:8768
- C:\Windows\System\uRRcqiY.exe
  C:\Windows\System\uRRcqiY.exe
  2⤵
  PID:8784
- C:\Windows\System\gXsqWOI.exe
  C:\Windows\System\gXsqWOI.exe
  2⤵
  PID:8800
- C:\Windows\System\jWYxKjf.exe
  C:\Windows\System\jWYxKjf.exe
  2⤵
  PID:8824
- C:\Windows\System\RSQfkkg.exe
  C:\Windows\System\RSQfkkg.exe
  2⤵
  PID:8840
- C:\Windows\System\MgxSpJW.exe
  C:\Windows\System\MgxSpJW.exe
  2⤵
  PID:8868
- C:\Windows\System\LznYnXQ.exe
  C:\Windows\System\LznYnXQ.exe
  2⤵
  PID:8884
- C:\Windows\System\jphdZBW.exe
  C:\Windows\System\jphdZBW.exe
  2⤵
  PID:8900
- C:\Windows\System\cbLJOPw.exe
  C:\Windows\System\cbLJOPw.exe
  2⤵
  PID:8916
- C:\Windows\System\MaBfmvw.exe
  C:\Windows\System\MaBfmvw.exe
  2⤵
  PID:8940
- C:\Windows\System\xvUnXiZ.exe
  C:\Windows\System\xvUnXiZ.exe
  2⤵
  PID:8956
- C:\Windows\System\PKxdBRH.exe
  C:\Windows\System\PKxdBRH.exe
  2⤵
  PID:8972
- C:\Windows\System\PcOuPmv.exe
  C:\Windows\System\PcOuPmv.exe
  2⤵
  PID:8988
- C:\Windows\System\KvXopSd.exe
  C:\Windows\System\KvXopSd.exe
  2⤵
  PID:9060
- C:\Windows\System\WpxkTio.exe
  C:\Windows\System\WpxkTio.exe
  2⤵
  PID:9076
- C:\Windows\System\wyDZlCp.exe
  C:\Windows\System\wyDZlCp.exe
  2⤵
  PID:9092
- C:\Windows\System\YnAKXrq.exe
  C:\Windows\System\YnAKXrq.exe
  2⤵
  PID:9112
- C:\Windows\System\etegGZw.exe
  C:\Windows\System\etegGZw.exe
  2⤵
  PID:9132
- C:\Windows\System\LLWSQnm.exe
  C:\Windows\System\LLWSQnm.exe
  2⤵
  PID:9164
- C:\Windows\System\DUXBMau.exe
  C:\Windows\System\DUXBMau.exe
  2⤵
  PID:9180
- C:\Windows\System\fjvsKQN.exe
  C:\Windows\System\fjvsKQN.exe
  2⤵
  PID:9196
- C:\Windows\System\DRaslOc.exe
  C:\Windows\System\DRaslOc.exe
  2⤵
  PID:9212
- C:\Windows\System\eqJdxYo.exe
  C:\Windows\System\eqJdxYo.exe
  2⤵
  PID:7388
- C:\Windows\System\rBjEJTp.exe
  C:\Windows\System\rBjEJTp.exe
  2⤵
  PID:8224
- C:\Windows\System\hKBvVAl.exe
  C:\Windows\System\hKBvVAl.exe
  2⤵
  PID:8200
- C:\Windows\System\gjNbbwy.exe
  C:\Windows\System\gjNbbwy.exe
  2⤵
  PID:8220
- C:\Windows\System\vfGxcAC.exe
  C:\Windows\System\vfGxcAC.exe
  2⤵
  PID:8296
- C:\Windows\System\QUQvQoL.exe
  C:\Windows\System\QUQvQoL.exe
  2⤵
  PID:8336
- C:\Windows\System\iTQXAvj.exe
  C:\Windows\System\iTQXAvj.exe
  2⤵
  PID:8384
- C:\Windows\System\BirxHqf.exe
  C:\Windows\System\BirxHqf.exe
  2⤵
  PID:8424
- C:\Windows\System\AvwzgGT.exe
  C:\Windows\System\AvwzgGT.exe
  2⤵
  PID:8464
- C:\Windows\System\fJlBrca.exe
  C:\Windows\System\fJlBrca.exe
  2⤵
  PID:8540
- C:\Windows\System\PRzYSMs.exe
  C:\Windows\System\PRzYSMs.exe
  2⤵
  PID:8616
- C:\Windows\System\PePbXCf.exe
  C:\Windows\System\PePbXCf.exe
  2⤵
  PID:8372
- C:\Windows\System\vCNbkBh.exe
  C:\Windows\System\vCNbkBh.exe
  2⤵
  PID:8780
- C:\Windows\System\oVejgtg.exe
  C:\Windows\System\oVejgtg.exe
  2⤵
  PID:8816
- C:\Windows\System\RvRuIOx.exe
  C:\Windows\System\RvRuIOx.exe
  2⤵
  PID:8600
- C:\Windows\System\fzkjJFP.exe
  C:\Windows\System\fzkjJFP.exe
  2⤵
  PID:8632
- C:\Windows\System\lfIJRTF.exe
  C:\Windows\System\lfIJRTF.exe
  2⤵
  PID:8896
- C:\Windows\System\xDMrScA.exe
  C:\Windows\System\xDMrScA.exe
  2⤵
  PID:8484
- C:\Windows\System\TBxlTMq.exe
  C:\Windows\System\TBxlTMq.exe
  2⤵
  PID:8552
- C:\Windows\System\BgkYoHW.exe
  C:\Windows\System\BgkYoHW.exe
  2⤵
  PID:8604
- C:\Windows\System\IwTYLfY.exe
  C:\Windows\System\IwTYLfY.exe
  2⤵
  PID:8480
- C:\Windows\System\fTcwHFh.exe
  C:\Windows\System\fTcwHFh.exe
  2⤵
  PID:8556
- C:\Windows\System\oyqUPcH.exe
  C:\Windows\System\oyqUPcH.exe
  2⤵
  PID:8792
- C:\Windows\System\oIwPFDd.exe
  C:\Windows\System\oIwPFDd.exe
  2⤵
  PID:8680
- C:\Windows\System\BKdsWqJ.exe
  C:\Windows\System\BKdsWqJ.exe
  2⤵
  PID:8636
- C:\Windows\System\FiJxpFk.exe
  C:\Windows\System\FiJxpFk.exe
  2⤵
  PID:8984
- C:\Windows\System\TMRgibn.exe
  C:\Windows\System\TMRgibn.exe
  2⤵
  PID:9020
- C:\Windows\System\SCVkXWS.exe
  C:\Windows\System\SCVkXWS.exe
  2⤵
  PID:7764
- C:\Windows\System\gsFNVYk.exe
  C:\Windows\System\gsFNVYk.exe
  2⤵
  PID:9088
- C:\Windows\System\QnQHGIG.exe
  C:\Windows\System\QnQHGIG.exe
  2⤵
  PID:9100
- C:\Windows\System\RXhHvpn.exe
  C:\Windows\System\RXhHvpn.exe
  2⤵
  PID:9148
- C:\Windows\System\PTFDmNR.exe
  C:\Windows\System\PTFDmNR.exe
  2⤵
  PID:9176
- C:\Windows\System\VoRCRLQ.exe
  C:\Windows\System\VoRCRLQ.exe
  2⤵
  PID:7972
- C:\Windows\System\OhxmwRD.exe
  C:\Windows\System\OhxmwRD.exe
  2⤵
  PID:9192
- C:\Windows\System\szbyMnz.exe
  C:\Windows\System\szbyMnz.exe
  2⤵
  PID:7548
- C:\Windows\System\NjdsueQ.exe
  C:\Windows\System\NjdsueQ.exe
  2⤵
  PID:8196
- C:\Windows\System\YMzrghj.exe
  C:\Windows\System\YMzrghj.exe
  2⤵
  PID:8420
- C:\Windows\System\RLSceiX.exe
  C:\Windows\System\RLSceiX.exe
  2⤵
  PID:8268
- C:\Windows\System\aJmyoor.exe
  C:\Windows\System\aJmyoor.exe
  2⤵
  PID:8316
- C:\Windows\System\KurnwLi.exe
  C:\Windows\System\KurnwLi.exe
  2⤵
  PID:8700
- C:\Windows\System\rbFskSy.exe
  C:\Windows\System\rbFskSy.exe
  2⤵
  PID:8812
- C:\Windows\System\wPUFzCq.exe
  C:\Windows\System\wPUFzCq.exe
  2⤵
  PID:8284
- C:\Windows\System\MEqcxOK.exe
  C:\Windows\System\MEqcxOK.exe
  2⤵
  PID:8724
- C:\Windows\System\XMLxKUq.exe
  C:\Windows\System\XMLxKUq.exe
  2⤵
  PID:8776
- C:\Windows\System\nWrgRdm.exe
  C:\Windows\System\nWrgRdm.exe
  2⤵
  PID:8756
- C:\Windows\System\aPxhIDp.exe
  C:\Windows\System\aPxhIDp.exe
  2⤵
  PID:8520
- C:\Windows\System\hrfAwAT.exe
  C:\Windows\System\hrfAwAT.exe
  2⤵
  PID:9000
- C:\Windows\System\UosVgvJ.exe
  C:\Windows\System\UosVgvJ.exe
  2⤵
  PID:8640
- C:\Windows\System\HsxUxWV.exe
  C:\Windows\System\HsxUxWV.exe
  2⤵
  PID:8980
- C:\Windows\System\aEtcrgE.exe
  C:\Windows\System\aEtcrgE.exe
  2⤵
  PID:8228
- C:\Windows\System\CjvdGFz.exe
  C:\Windows\System\CjvdGFz.exe
  2⤵
  PID:9048
- C:\Windows\System\qjbCwQe.exe
  C:\Windows\System\qjbCwQe.exe
  2⤵
  PID:9140
- C:\Windows\System\ZqNmLGQ.exe
  C:\Windows\System\ZqNmLGQ.exe
  2⤵
  PID:9204
- C:\Windows\System\VzLqbNm.exe
  C:\Windows\System\VzLqbNm.exe
  2⤵
  PID:8416
- C:\Windows\System\WLUkxMi.exe
  C:\Windows\System\WLUkxMi.exe
  2⤵
  PID:8344
- C:\Windows\System\sAMdXkb.exe
  C:\Windows\System\sAMdXkb.exe
  2⤵
  PID:8456
- C:\Windows\System\NuKbNXy.exe
  C:\Windows\System\NuKbNXy.exe
  2⤵
  PID:8660
- C:\Windows\System\ziQsldT.exe
  C:\Windows\System\ziQsldT.exe
  2⤵
  PID:8856
- C:\Windows\System\uYKIgqm.exe
  C:\Windows\System\uYKIgqm.exe
  2⤵
  PID:8928
- C:\Windows\System\TFkaYdM.exe
  C:\Windows\System\TFkaYdM.exe
  2⤵
  PID:8744
- C:\Windows\System\IMrNwdR.exe
  C:\Windows\System\IMrNwdR.exe
  2⤵
  PID:8644
- C:\Windows\System\WITvMMT.exe
  C:\Windows\System\WITvMMT.exe
  2⤵
  PID:8832
- C:\Windows\System\XTifmLc.exe
  C:\Windows\System\XTifmLc.exe
  2⤵
  PID:8952
- C:\Windows\System\rVgtBfR.exe
  C:\Windows\System\rVgtBfR.exe
  2⤵
  PID:9108
- C:\Windows\System\UmtrjXJ.exe
  C:\Windows\System\UmtrjXJ.exe
  2⤵
  PID:9172
- C:\Windows\System\bbYFOtH.exe
  C:\Windows\System\bbYFOtH.exe
  2⤵
  PID:8340
- C:\Windows\System\VZnhnhO.exe
  C:\Windows\System\VZnhnhO.exe
  2⤵
  PID:9208
- C:\Windows\System\zuwAoIz.exe
  C:\Windows\System\zuwAoIz.exe
  2⤵
  PID:8656
- C:\Windows\System\ludHmzX.exe
  C:\Windows\System\ludHmzX.exe
  2⤵
  PID:8852
- C:\Windows\System\IrpFnZC.exe
  C:\Windows\System\IrpFnZC.exe
  2⤵
  PID:9156
- C:\Windows\System\lrmKAWo.exe
  C:\Windows\System\lrmKAWo.exe
  2⤵
  PID:8760
- C:\Windows\System\vLxmHJo.exe
  C:\Windows\System\vLxmHJo.exe
  2⤵
  PID:7628
- C:\Windows\System\RRjOajn.exe
  C:\Windows\System\RRjOajn.exe
  2⤵
  PID:8264
- C:\Windows\System\jLbZpjY.exe
  C:\Windows\System\jLbZpjY.exe
  2⤵
  PID:7552
- C:\Windows\System\jsHfXtJ.exe
  C:\Windows\System\jsHfXtJ.exe
  2⤵
  PID:8440
- C:\Windows\System\iZOfBKX.exe
  C:\Windows\System\iZOfBKX.exe
  2⤵
  PID:9012
- C:\Windows\System\JveRbbf.exe
  C:\Windows\System\JveRbbf.exe
  2⤵
  PID:9124
- C:\Windows\System\cCoBnFw.exe
  C:\Windows\System\cCoBnFw.exe
  2⤵
  PID:9236
- C:\Windows\System\cTDIhCK.exe
  C:\Windows\System\cTDIhCK.exe
  2⤵
  PID:9252
- C:\Windows\System\PUzwZgQ.exe
  C:\Windows\System\PUzwZgQ.exe
  2⤵
  PID:9284
- C:\Windows\System\CgAAxwA.exe
  C:\Windows\System\CgAAxwA.exe
  2⤵
  PID:9308
- C:\Windows\System\NuqcVUN.exe
  C:\Windows\System\NuqcVUN.exe
  2⤵
  PID:9324
- C:\Windows\System\plhYwKz.exe
  C:\Windows\System\plhYwKz.exe
  2⤵
  PID:9352
- C:\Windows\System\yTCxGwh.exe
  C:\Windows\System\yTCxGwh.exe
  2⤵
  PID:9368
- C:\Windows\System\TXQyUoW.exe
  C:\Windows\System\TXQyUoW.exe
  2⤵
  PID:9384
- C:\Windows\System\zWxBwfv.exe
  C:\Windows\System\zWxBwfv.exe
  2⤵
  PID:9408
- C:\Windows\System\JayGazU.exe
  C:\Windows\System\JayGazU.exe
  2⤵
  PID:9432
- C:\Windows\System\oOcIyAq.exe
  C:\Windows\System\oOcIyAq.exe
  2⤵
  PID:9448
- C:\Windows\System\XOhxonI.exe
  C:\Windows\System\XOhxonI.exe
  2⤵
  PID:9464
- C:\Windows\System\DBhmdBH.exe
  C:\Windows\System\DBhmdBH.exe
  2⤵
  PID:9480
- C:\Windows\System\TnJPLIX.exe
  C:\Windows\System\TnJPLIX.exe
  2⤵
  PID:9496
- C:\Windows\System\AuUqAvh.exe
  C:\Windows\System\AuUqAvh.exe
  2⤵
  PID:9512
- C:\Windows\System\szNfgcv.exe
  C:\Windows\System\szNfgcv.exe
  2⤵
  PID:9532
- C:\Windows\System\qfoXfbA.exe
  C:\Windows\System\qfoXfbA.exe
  2⤵
  PID:9552
- C:\Windows\System\FNoDfDz.exe
  C:\Windows\System\FNoDfDz.exe
  2⤵
  PID:9568
- C:\Windows\System\DnDjDbg.exe
  C:\Windows\System\DnDjDbg.exe
  2⤵
  PID:9592
- C:\Windows\System\kEfcNEH.exe
  C:\Windows\System\kEfcNEH.exe
  2⤵
  PID:9608
- C:\Windows\System\IcBWHZr.exe
  C:\Windows\System\IcBWHZr.exe
  2⤵
  PID:9632
- C:\Windows\System\xSGeSph.exe
  C:\Windows\System\xSGeSph.exe
  2⤵
  PID:9648
- C:\Windows\System\OVMunFW.exe
  C:\Windows\System\OVMunFW.exe
  2⤵
  PID:9672
- C:\Windows\System\SzwLXZu.exe
  C:\Windows\System\SzwLXZu.exe
  2⤵
  PID:9688
- C:\Windows\System\rEtGMSa.exe
  C:\Windows\System\rEtGMSa.exe
  2⤵
  PID:9704
- C:\Windows\System\PCOcpRv.exe
  C:\Windows\System\PCOcpRv.exe
  2⤵
  PID:9720
- C:\Windows\System\qFgsLcO.exe
  C:\Windows\System\qFgsLcO.exe
  2⤵
  PID:9764
- C:\Windows\System\PUYAfnC.exe
  C:\Windows\System\PUYAfnC.exe
  2⤵
  PID:9780
- C:\Windows\System\zsmjaJY.exe
  C:\Windows\System\zsmjaJY.exe
  2⤵
  PID:9804
- C:\Windows\System\KBMvxCT.exe
  C:\Windows\System\KBMvxCT.exe
  2⤵
  PID:9848
- C:\Windows\System\fjgZCix.exe
  C:\Windows\System\fjgZCix.exe
  2⤵
  PID:9864
- C:\Windows\System\LpyKHOg.exe
  C:\Windows\System\LpyKHOg.exe
  2⤵
  PID:9880
- C:\Windows\System\VALNZIa.exe
  C:\Windows\System\VALNZIa.exe
  2⤵
  PID:9900
- C:\Windows\System\wGBTdnU.exe
  C:\Windows\System\wGBTdnU.exe
  2⤵
  PID:9916
- C:\Windows\System\FNTNxjg.exe
  C:\Windows\System\FNTNxjg.exe
  2⤵
  PID:9952
- C:\Windows\System\eKztoae.exe
  C:\Windows\System\eKztoae.exe
  2⤵
  PID:9968
- C:\Windows\System\SFdBolb.exe
  C:\Windows\System\SFdBolb.exe
  2⤵
  PID:9984
- C:\Windows\System\AbLdwAF.exe
  C:\Windows\System\AbLdwAF.exe
  2⤵
  PID:10000
- C:\Windows\System\GNAYStd.exe
  C:\Windows\System\GNAYStd.exe
  2⤵
  PID:10020
- C:\Windows\System\gOSbKkD.exe
  C:\Windows\System\gOSbKkD.exe
  2⤵
  PID:10044
- C:\Windows\System\DUyTDOT.exe
  C:\Windows\System\DUyTDOT.exe
  2⤵
  PID:10060
- C:\Windows\System\QzKhitC.exe
  C:\Windows\System\QzKhitC.exe
  2⤵
  PID:10080
- C:\Windows\System\OMnWGoI.exe
  C:\Windows\System\OMnWGoI.exe
  2⤵
  PID:10100
- C:\Windows\System\aVelTjO.exe
  C:\Windows\System\aVelTjO.exe
  2⤵
  PID:10116
- C:\Windows\System\pnoWhAb.exe
  C:\Windows\System\pnoWhAb.exe
  2⤵
  PID:10140
- C:\Windows\System\PckfXGZ.exe
  C:\Windows\System\PckfXGZ.exe
  2⤵
  PID:10160
- C:\Windows\System\yulfmpe.exe
  C:\Windows\System\yulfmpe.exe
  2⤵
  PID:10180
- C:\Windows\System\qBaAaUI.exe
  C:\Windows\System\qBaAaUI.exe
  2⤵
  PID:10196
- C:\Windows\System\YUcNWhW.exe
  C:\Windows\System\YUcNWhW.exe
  2⤵
  PID:10228
- C:\Windows\System\SNBsyaE.exe
  C:\Windows\System\SNBsyaE.exe
  2⤵
  PID:9036
- C:\Windows\System\bIDPkON.exe
  C:\Windows\System\bIDPkON.exe
  2⤵
  PID:9224
- C:\Windows\System\QbkMlqH.exe
  C:\Windows\System\QbkMlqH.exe
  2⤵
  PID:9272
- C:\Windows\System\pTVpQfv.exe
  C:\Windows\System\pTVpQfv.exe
  2⤵
  PID:7368
- C:\Windows\System\CELUuYi.exe
  C:\Windows\System\CELUuYi.exe
  2⤵
  PID:9316
- C:\Windows\System\XrCIljh.exe
  C:\Windows\System\XrCIljh.exe
  2⤵
  PID:9300
- C:\Windows\System\LUGyrUU.exe
  C:\Windows\System\LUGyrUU.exe
  2⤵
  PID:9340
- C:\Windows\System\ohuMgxR.exe
  C:\Windows\System\ohuMgxR.exe
  2⤵
  PID:9376
- C:\Windows\System\qVoLvJD.exe
  C:\Windows\System\qVoLvJD.exe
  2⤵
  PID:9416
- C:\Windows\System\tLUGSdM.exe
  C:\Windows\System\tLUGSdM.exe
  2⤵
  PID:9444
- C:\Windows\System\tMKvtsw.exe
  C:\Windows\System\tMKvtsw.exe
  2⤵
  PID:9476
- C:\Windows\System\qvktMEr.exe
  C:\Windows\System\qvktMEr.exe
  2⤵
  PID:9544
- C:\Windows\System\mqfrHUp.exe
  C:\Windows\System\mqfrHUp.exe
  2⤵
  PID:9588
- C:\Windows\System\TWIvUmR.exe
  C:\Windows\System\TWIvUmR.exe
  2⤵
  PID:9604
- C:\Windows\System\zTQvXaN.exe
  C:\Windows\System\zTQvXaN.exe
  2⤵
  PID:9660
- C:\Windows\System\DSantLL.exe
  C:\Windows\System\DSantLL.exe
  2⤵
  PID:9668
- C:\Windows\System\NhJZaRH.exe
  C:\Windows\System\NhJZaRH.exe
  2⤵
  PID:9728
- C:\Windows\System\AgDijoU.exe
  C:\Windows\System\AgDijoU.exe
  2⤵
  PID:9748
- C:\Windows\System\GDCpNqw.exe
  C:\Windows\System\GDCpNqw.exe
  2⤵
  PID:9756
- C:\Windows\System\TEGxVQG.exe
  C:\Windows\System\TEGxVQG.exe
  2⤵
  PID:9788
- C:\Windows\System\rtBWjKK.exe
  C:\Windows\System\rtBWjKK.exe
  2⤵
  PID:9832
- C:\Windows\System\hgTYswc.exe
  C:\Windows\System\hgTYswc.exe
  2⤵
  PID:9860
- C:\Windows\System\jeLVUGK.exe
  C:\Windows\System\jeLVUGK.exe
  2⤵
  PID:9876
- C:\Windows\System\HIifMvd.exe
  C:\Windows\System\HIifMvd.exe
  2⤵
  PID:9928
- C:\Windows\System\LLaqBiP.exe
  C:\Windows\System\LLaqBiP.exe
  2⤵
  PID:9736
- C:\Windows\System\cFqCszn.exe
  C:\Windows\System\cFqCszn.exe
  2⤵
  PID:9976
- C:\Windows\System\bXYgCyU.exe
  C:\Windows\System\bXYgCyU.exe
  2⤵
  PID:9996
- C:\Windows\System\sBdpojD.exe
  C:\Windows\System\sBdpojD.exe
  2⤵
  PID:10036
- C:\Windows\System\LRqqtzV.exe
  C:\Windows\System\LRqqtzV.exe
  2⤵
  PID:10072
- C:\Windows\System\wkSWEBZ.exe
  C:\Windows\System\wkSWEBZ.exe
  2⤵
  PID:10112
- C:\Windows\System\PtVPtWV.exe
  C:\Windows\System\PtVPtWV.exe
  2⤵
  PID:10156
- C:\Windows\System\UHKwedB.exe
  C:\Windows\System\UHKwedB.exe
  2⤵
  PID:10192
- C:\Windows\System\umuKSOc.exe
  C:\Windows\System\umuKSOc.exe
  2⤵
  PID:10212
- C:\Windows\System\auffvOy.exe
  C:\Windows\System\auffvOy.exe
  2⤵
  PID:8876
- C:\Windows\System\lbXLZNc.exe
  C:\Windows\System\lbXLZNc.exe
  2⤵
  PID:8936
- C:\Windows\System\fAfhLMF.exe
  C:\Windows\System\fAfhLMF.exe
  2⤵
  PID:9280
- C:\Windows\System\CQWDfYP.exe
  C:\Windows\System\CQWDfYP.exe
  2⤵
  PID:9292
- C:\Windows\System\uViXUhh.exe
  C:\Windows\System\uViXUhh.exe
  2⤵
  PID:9304
- C:\Windows\System\FxdYIrQ.exe
  C:\Windows\System\FxdYIrQ.exe
  2⤵
  PID:9392
- C:\Windows\System\pIUFEcI.exe
  C:\Windows\System\pIUFEcI.exe
  2⤵
  PID:9508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DFCXcDi.exe

Filesize
1.4MB

MD5
3091a203e5c6a9957e9b5ce87a21ad7c

SHA1
fc56bac0c4713ee746a74cb16925878a850fc9e5

SHA256
915aa5a0b65d38859ba24c085b48b03ec6b13222d4b67f97dbb0fb9315c5de8d

SHA512
7c208fe2a6a230d03b20ba0cceff771987fb6e1e3a64069701d1559cb1fba896db88f32dc44e38d4d26b98413f13bc44d205cab678681a1ee50bf1a60549978f

Download Submit
C:\Windows\system\LQbcCUO.exe

Filesize
1.4MB

MD5
04e6195bd3645e205b593c00a8afac57

SHA1
7271e82bda02ea4b825333fed8c5d2d503908c83

SHA256
5991e956e8642caed9b4c4f7004be0b03815cf5ee687486ac63ccd3fe5a71c2a

SHA512
f49db4252e88fd7b5f62092452f56d2c782347fd107ca81da3926576439c15a18793c7c5296418fe319ee1f656fe006285c221016c0fd3bf04b7e9d9c063d046

Download Submit
C:\Windows\system\LhhCWbO.exe

Filesize
1.3MB

MD5
998965b6b195d2494e0f22c663dc266e

SHA1
ddd51aaf9bf4accf8e7efd174b988e13ef3b4179

SHA256
899a96fc082fbc1a3bfb3606d32d690b7d9436a0a7ef006ad10cf1188008791c

SHA512
e4cdfe2d92ad2742bf498216bb5e837d636cad4a83a0e2828f80c4a6fb2cae7c2673249e8a35ebbf0bb3e5728fec6b275fefe8bffdfaf3d9d13306c03c21d6af

Download Submit
C:\Windows\system\NsUVTun.exe

Filesize
1.4MB

MD5
2299d341f65fcadd9d8c6a3ef49ff65b

SHA1
99bc538f9dea2f9e9c37ac807ac29805ac70ebcf

SHA256
e5e96060ea70a199b1e3f973a5495d464c142cd75d56b2dee0135f81fe88255b

SHA512
c9f2af8a88831bca493c0ab3973246f3d9f4b3cd53af0af2a5bbd4b32529a9d2835fc6779c5fa241378314b9f564b74be03c9692f8d381aebf408f11b92fcb0c

Download Submit
C:\Windows\system\QYvHtWn.exe

Filesize
1.3MB

MD5
088434766232a2f61da3a09c0f372b2a

SHA1
880b9cfdecb508b6fe324cb408ec48a9c98bae66

SHA256
31f7a7c34ccab5a70e4e44cedd14abdea50f02d7db1ef71c83e07e176e1f7932

SHA512
44eee844477a2928a8f45a61d47b4ef820113fa1e07867c3cd712692f059ee95d9c872e67422884bd444f85c6e1a24ba9605a09ff0fe0cab8702c8028729d162

Download Submit
C:\Windows\system\SrLGacB.exe

Filesize
1.3MB

MD5
4fcd4f55b2b9fe17fcd136437167e518

SHA1
9d76bc31d6dee0233265874875017ec81ef023b3

SHA256
4b8a2302a3462662e0681e77e5ef1ba85a361d0d8b2fbde0398b386d6eb56915

SHA512
9a9a9ec36f2c088a93e9e88439d8f1d9a3be5b92e7db4735b25666bad48cc39290052a569d3578207ed956646b9333840eb299944be72ac6ca0ae64870ad83d5

Download Submit
C:\Windows\system\SxWEFcI.exe

Filesize
1.3MB

MD5
3642d40ae17fdf03495af917fe6d24a1

SHA1
646c57052888d9fa527b7a87a5616df3f4e2048a

SHA256
28f571811cc6a2971ff1b03f810fb3d0b35f10f825d3dc4e34cd6501b5735605

SHA512
60e1a77a2131eca527a573d79c6d58ee4ed746ab7ff6f65d32065f5f414e119a60aa1efe88763362727989f4103c1f2e95f2cde662ec9714f78d74bbd7e9e0c7

Download Submit
C:\Windows\system\TVQKcsc.exe

Filesize
1.3MB

MD5
46ef33831bb5c4a7ea53cc68486be5e1

SHA1
181853df33e0c4a8f2c97e23621508bd3a7ab33a

SHA256
bb143515ead187c1c4ffc3a65bdf5c99b0a8310b37b94b035180ba171d8540f3

SHA512
aa930b482f6b19182b9c912f79432ae838ae3a94a0157bcaba7f22e9fdb2ccd178a27d65905b1c12b443a03fbd257edd2ad07dec84330b4a40b59d8064b1c94f

Download Submit
C:\Windows\system\TwWCqDC.exe

Filesize
1.3MB

MD5
be077db745e8da967b641bf8b303d244

SHA1
eb662810cbf773a3203b4b55de9b57651c7e294a

SHA256
e7ed43cd6235155ca93d505991ff3bf6ba798f93034b984ec0f44ca8b5832697

SHA512
f3173390181a1e17cf4ad9907abe5a2b29c855f59156bf22dfd73112b26e3d44a75f6de6a88eccf02f5d9a08403054583447d38a0ef2f51e2f346a60fce36364

Download Submit
C:\Windows\system\WWEbhup.exe

Filesize
1.4MB

MD5
a730ae133b834fe1a8d32bb299cc6ae1

SHA1
da3d798304b88112eaaaf31d43e3fb16dab21523

SHA256
79e061fd8a492e310f3ba4c207d75751afc4e5f8d99cc66ca853b1adb991cbd8

SHA512
9f762b083ba8ee2b9f60370918f4712bbe8985c3d6ad1ae742598b71dcf3cf6a284eeaedec8f9767a6ffc521385f06deea248f240e6e081fe3fa92c4f7df2cea

Download Submit
C:\Windows\system\XREVMDs.exe

Filesize
1.3MB

MD5
5e240a4e89e8f4c6d46f3b85b26cfb21

SHA1
fd97ee747ed64ce4ede0a2b9128be9368f40eef6

SHA256
4d3d8e249359ee0e255b894e813b453c7669fd60ac66ce67c266e8837db8ef09

SHA512
fe9ea34a55f2b3a0d765b935d51c6afa5a60eb447de065672e36500574b9d4c324fddff74519a008586c184c9eddbf934624684603ae73d0a443c57d358f31c0

Download Submit
C:\Windows\system\XZMBxnr.exe

Filesize
1.3MB

MD5
a8013a042578107760b374fdda305047

SHA1
d6918acb33d9658df0392f50e361da9137cced17

SHA256
41a783b0279f3eebb8aaf4326e41afeec9680b01dcdd83e13ef1d4074259702c

SHA512
42d87c74441d390c278ac9104659821cbbcce579f9b4bcbf8fa362f5b618dcae39658069ab39d7d89ddcfba7f723d096192214ce6b1a251475ca0762507b6d65

Download Submit
C:\Windows\system\YAQwkbY.exe

Filesize
1.3MB

MD5
ba0f04dc427661860e4f88fd1dd87713

SHA1
870b9c5003ca3297f4d92f1f0c6b999c69be1a47

SHA256
9721a25412db44620c192815cfb994a7e4f8a043c6ff7fbb6834c60b73ff3085

SHA512
233d70d11b2348e122e2ba52ce459fff0a2e93e6a38d1290198b5d58f5f23fb5315678e3adf094b558de22718ffd8f668538e9cdf71f7bd178e07691ea7bfbfa

Download Submit
C:\Windows\system\cBYCtma.exe

Filesize
1.3MB

MD5
eaa9b2a7d0ee84cac68552801dc52982

SHA1
0083ef405fd40094b6b2def8222934491fb61d2d

SHA256
731ed7a14e7b92af6eb14dfc81af44f5076cb7488454dba2e1466c127181e301

SHA512
1ef0ff9e4007c8f9623ec638a179d5f19c59a99afe5decca58895bf86e465a45bfc2b25a1bf45d700f24a487b8f0b61827df88ec748e99c725e9804efccc258c

Download Submit
C:\Windows\system\cWUAcpd.exe

Filesize
1.4MB

MD5
c343ed7273257c004bceb4ea238ba1d5

SHA1
c8f2f4c9688cea6136a8f20a3e1f99d61d86c1a2

SHA256
2552491dddfbfbb04000c829b9d83f32a586a9e366dcfa1b7ea168e539b72863

SHA512
1f3bc5ba4433fc206ea1db11b349783582b63c28cb36e5c1f4067d4eaa7077843927a40ff6afb0785c935f1e119698526b73963efe2eb31ce3e856f1bf5f9523

Download Submit
C:\Windows\system\fRteblN.exe

Filesize
1.4MB

MD5
cf0aef772dcdb88532e55520ac6bdbec

SHA1
ebcf2eaee237e23942aa79201a0e832702b1c45d

SHA256
4b45f6ca651b463376a80b809d5966024fa9d22713b211a6ef784434d75f0f88

SHA512
4095d609213e6228f564f468f523a8976cdb9f582d34a2c7468bc89d636f5401271f3d34bbff3d32f7656a683a405dea95322ef2a5a7788fc1bca85ff1d63a46

Download Submit
C:\Windows\system\hlZDoJP.exe

Filesize
1.3MB

MD5
c10280ae5d373e3b5c7fd8d336b1f8c4

SHA1
4c2b54eb08dc3da2813239a884d2e68b5df36b25

SHA256
779e3db8aa0ff52fbdf6785190c5d20f387ea7212850368697ff0125bc320e11

SHA512
2c3e174c7582d073eda23b69a4feb062804ee8a7aeb223d074b35e8dc946734186db9af64345ad24237c03568ac112e72705080e6b928710af3d859dfba88466

Download Submit
C:\Windows\system\jCAXzDL.exe

Filesize
1.3MB

MD5
e9c8f2fbe948148623afba4cdebb91f9

SHA1
e99363fe68d0a59363a1151c957f803fddcb8b1c

SHA256
83e3d2d021a12cabe65ff9aa0d64a1b3051c5a4b47dead5c4facfb8e90b91f50

SHA512
dbbea445f70b5f76ef61dcf136c2bd0dae4d4eb68b9d781dbab6ff74507e2609a23a7dbc57b6a8efc2969782448287b4ba84338ffc78bc13425d976d220d98dd

Download Submit
C:\Windows\system\joXupqa.exe

Filesize
1.4MB

MD5
d6c0bcfd9e40206f0b5f906c1372b708

SHA1
2192328124249ece1c145bcc336f18e54c574b44

SHA256
7129aae0fb26b5f0455f3f9a1bd1464f2132a53b9206684b88df819eb186d5c4

SHA512
95a4fbd4eb91dbdccc9c53218fc2294e29335e2bf0486dc01e3556f62e91fd75b3b01343f1b57178373b4fb6ee66d29188b65fb1cc8eff3856dfc57bd577b78f

Download Submit
C:\Windows\system\kIGgxUy.exe

Filesize
1.3MB

MD5
2269c960bf30c31576a975185a7f17fd

SHA1
04c796f2a54121ce09818c8cee09109341a074d7

SHA256
19e5baf7af4fde2e76ff2700207ae31ff1be84d5e7079dd68d1bf82d6424a3f8

SHA512
235a5f33770920d10bd69c66d6cce1c99432d95708f43b2bdfbf04d2ade45155c9f70b4b01137dbc9af3ab8db36e53d4be95254839faf3c6417de4f29059cc6b

Download Submit
C:\Windows\system\otLGwzp.exe

Filesize
1.4MB

MD5
33da139d09e5bf6b00f708169cbce0a3

SHA1
fb66b8c42e27ad3640569a8ae04612c7b77c7aef

SHA256
2e5b1a4826db5420fd0eedf3f0bedf4a561706bcff1303e9a392c4088b2dcbbb

SHA512
c3f9dcd3f9ab32bf7ad2404215627ce62ab56450fda5ce62c67fb9d28c9b737ef31d00dae7e1e486537ccc429dbf95678aeb3fdb9e2346e897bbcec6c57f83b1

Download Submit
C:\Windows\system\qgDCByp.exe

Filesize
1.3MB

MD5
af19cbf3e7d944b7db791fd30bd963e1

SHA1
d747ab92b9892a8e74b7af5e9dbc1db6d89b3359

SHA256
e376aa0d0c23714b313a446cce58579cb87c9a6b8d8e06b6be6eb8f50a5a8a5b

SHA512
4c2da2dae0aeb87f31cb4b3551981a51ad4162bc724386b2f237e147144833a696b722a1799606e349954e4a5ac3929b2434aac7b6ac80bf52a5eeebee5b5bbd

Download Submit
C:\Windows\system\qhRicnE.exe

Filesize
1.3MB

MD5
b1e340649c845ea1f0e60c913ccd78fb

SHA1
a948da33280db20b8bf30c8dc1e8f1f2cd3e8099

SHA256
66e5fa367b21b611ddaa22373fb94c5310e8e183bae0790016a9054a21bd876c

SHA512
6f563d22ca0fc800939ca0ba2555f2bbcf36ee93619da19051bdb9c3e9b457def6b2c30f482a9110011ab0c404154295be4201e66aaa2a36ce43167bc5fb642f

Download Submit
C:\Windows\system\sMNTvNZ.exe

Filesize
1.4MB

MD5
a1a4929b307cc3db94c1bc9d6ea68857

SHA1
cfeddaf464b5714f9bfbcee14397c04624781ebb

SHA256
445f8c8ce7d255dbd22d135789b2d56938c55f1015bc0c5bee24e8d8562571a5

SHA512
710ee9abee61f69baa25f08ee70fee7ed1d2fec7eacda0a90f45e09cd2e78209137d9af7623d5805957fe62ecaf62cb66775bd5df9f2c0448a4140df00d36dd0

Download Submit
C:\Windows\system\uReZrSb.exe

Filesize
1.3MB

MD5
be987f46f4c8cfb3515b8da2a00cf1db

SHA1
96e4697c44d36f55c894fd16ddba8c6ecab010ea

SHA256
76639c8b8f6c3164760190042f059172ee0e8e8ad31d0b6a86ac198103f981cc

SHA512
9f4ff9ea6efd33438cfcd7ec634423a0240985b1c96a712b1672483d5ac61edf36964d8c282e3d17500a33f589dbdbe95128de41f2cca48dc20832a153c356ce

Download Submit
C:\Windows\system\vBgXKak.exe

Filesize
1.4MB

MD5
2ed7524aa1c86803b4857a5cbcd98aba

SHA1
20dfc0ad41ba5f949c1e0cccd615094c5259d372

SHA256
5cb71f59c4454f2c1121217a0daed48227f586b153d3488edce4f8b28673ba02

SHA512
f8c90a0d6046e5d30ae9b8974e59fbf6ed52dcbecd8bc6c0181697155f5ea33936d9a4891df4b0df67972e18638c4cbd56a59a1e11cdc0815090b9e8fc888da4

Download Submit
C:\Windows\system\zdUFQgd.exe

Filesize
1.3MB

MD5
c06b2a7e86e563720761bdb63af98e59

SHA1
bc00a5bfb886bff1387193f5a1a16a814ec7a984

SHA256
1b1a01d452987a89c00075f6dfe2bc72a9959ff5274d6f884eefe397b1cbce8c

SHA512
e21f14d6bd0172c62e2c82b0a6face559b258a1d6617df499a5783d74e6dda7be6cec800dfd8c91761b6bec88816e9c04dc265f68522a6e55539b2ce60d40e1c

Download Submit
\Windows\system\BVjebXm.exe

Filesize
1.4MB

MD5
f87efe1ea7c6abff3e69357aeec0fa7c

SHA1
a0d5d3189e99af66979b1867aae1b2e407d36887

SHA256
641c62e6550fd86bf4b2398d51246fc117119fef637192e355d34e763ed14bee

SHA512
e4cc6fc3ad1d910917ce2c610199bf027df0150c35008a11473b9470440d6bb4c56909f8711bdb592b661bfbbab5d2505a6c915987749c62cfc9c7507b3740a7

Download Submit
\Windows\system\SGNaPIm.exe

Filesize
1.4MB

MD5
2f9cf670d3ee600ff4e2ed43bafcd24f

SHA1
ed3cfd1f7b8e5dc75b50721b355f55c549110e93

SHA256
d515f350cd60dc72fe1fa021a1e61611c5bac0e28910d196fc4d0f14e30faca1

SHA512
919dd10fafb5e98cf68f95436a2ed043bd6337d7eefcf4da6bae57ace688660ecddd7d50ab8d0e5179dc1237f94afae1f3fde1691b5f96eb57e5afbaab20fd03

Download Submit
\Windows\system\VUAXAXt.exe

Filesize
1.3MB

MD5
65cfba30e6925d2d30551a418e1e90fa

SHA1
1cb6e9ded0f9b8462f9ab3a4de405c3910842176

SHA256
75940ede4bd48dfe03d41d636b924f104ee4f3e7e3f2a0c4189adbf456eacc0d

SHA512
c0573dd2cf186eddb00d4d39cee2177728a4e970eb4a0659c1a3c9e80feb85fa20c721d7545dd4106644183d285290fe0e0f1ae757f886d45714fc5f734c3231

Download Submit
\Windows\system\uWpuHIe.exe

Filesize
1.3MB

MD5
d5c3b057569b83a95444c28870d8b486

SHA1
a5d730cfc16d4e60f27947c0cd97eda1a6d05662

SHA256
aeac654f4c19af174e3695957798adefe60dc413a66ccc6ee1293a172a5668ef

SHA512
10d44c38e4095661520f895ddd17722410b9510a267ff6a1c4270652c6377095d998aaf98049d133fb9256b3a8c01cba87b34e09691e9c1293060a9a1cd7d99f

Download Submit
\Windows\system\zOgqkeR.exe

Filesize
1.3MB

MD5
96b0b084ac8f4bbbcbe0a253bd78ee9e

SHA1
e43b574baa083a5cfcd7c990263a3dec454c6200

SHA256
68cd64078072f7a6637cd747efa4661d9bac7aecab7217b7d1e83385c3014371

SHA512
a7092745a91128e01e8237785590ef354b11b40c5849f7b70fefa357781a9b27ecbc284eca54d15a9c2c5d9cfecbcf79cdc101f7b3a2ebe3c5e6a1af9226c747

Download Submit
memory/2528-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download