xmrig | 46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
Size

1.6MB
MD5

0ae317f7c9df60857a260336e1062587
SHA1

a3b0fb5e6c91bb64c1f438ad61301de9ce407aa5
SHA256

46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02
SHA512

7af8b46a2e65f8e883f163f1df653b0e02520733b8a650da05f3b62f6917e146c27575af4892ff4b997f6697d075dc95a581f4660bb79ec596378e69d1432425
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3Qi+PWiJpv:GemTLkNdfE0pZyG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000b000000012281-2.dat	xmrig
behavioral1/files/0x0007000000019467-9.dat	xmrig
behavioral1/files/0x0006000000019496-8.dat	xmrig
behavioral1/files/0x00060000000194d0-24.dat	xmrig
behavioral1/files/0x00060000000194ef-28.dat	xmrig
behavioral1/files/0x000700000001963b-38.dat	xmrig
behavioral1/files/0x000500000001970b-53.dat	xmrig
behavioral1/files/0x00050000000199b9-58.dat	xmrig
behavioral1/files/0x0005000000019c54-64.dat	xmrig
behavioral1/files/0x0005000000019dd7-98.dat	xmrig
behavioral1/files/0x0005000000019fbc-103.dat	xmrig
behavioral1/files/0x000500000001a322-128.dat	xmrig
behavioral1/files/0x000500000001a44b-157.dat	xmrig
behavioral1/files/0x000500000001a445-153.dat	xmrig
behavioral1/files/0x000500000001a443-148.dat	xmrig
behavioral1/files/0x000500000001a441-144.dat	xmrig
behavioral1/files/0x000500000001a43f-138.dat	xmrig
behavioral1/files/0x000500000001a377-133.dat	xmrig
behavioral1/files/0x000500000001a0b8-123.dat	xmrig
behavioral1/files/0x000500000001a094-113.dat	xmrig
behavioral1/files/0x000500000001a09f-118.dat	xmrig
behavioral1/files/0x0005000000019fda-108.dat	xmrig
behavioral1/files/0x0005000000019dcb-93.dat	xmrig
behavioral1/files/0x0005000000019d62-88.dat	xmrig
behavioral1/files/0x0005000000019d3d-83.dat	xmrig
behavioral1/files/0x0005000000019c58-73.dat	xmrig
behavioral1/files/0x0005000000019c73-78.dat	xmrig
behavioral1/files/0x0005000000019c56-68.dat	xmrig
behavioral1/files/0x00050000000196c0-48.dat	xmrig
behavioral1/files/0x000500000001967f-43.dat	xmrig
behavioral1/files/0x0008000000019506-34.dat	xmrig
behavioral1/files/0x00060000000194ad-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2316	hECEMfF.exe
2336	JplVeKx.exe
2356	mVbRuPa.exe
2744	VBJUifu.exe
2212	XeWZZut.exe
1976	pKDXbOz.exe
2816	hbcaPLw.exe
2716	ShNxUWc.exe
2564	ECfhMAF.exe
2720	ccVHqyF.exe
2860	ObiSqGp.exe
2724	BbDOzhO.exe
1176	SnGBTvq.exe
2576	VSqtmlY.exe
2680	yEftfbY.exe
2396	PyGcHUC.exe
1492	dPbNiME.exe
1956	ZtkSMCy.exe
2736	hbZbYfb.exe
2296	iFGfgiD.exe
2628	vJfdXhp.exe
2384	pWKePZZ.exe
2084	qarLxec.exe
2896	sFErcps.exe
1968	npXlhPq.exe
2152	ixlmNwf.exe
684	lTUoQKv.exe
2196	KifaDno.exe
1972	IlGpAGH.exe
1060	XAZNmPN.exe
1476	HQXmUwX.exe
696	YtBvrrK.exe
1244	McjBaJJ.exe
1896	vIVUgWe.exe
1728	pyQVGcy.exe
1732	bOpXKUP.exe
912	pdYMLEX.exe
1768	DDADnpN.exe
1752	FbCYBzT.exe
812	EWcUgNq.exe
1516	ftgTjyj.exe
1668	mJKbqTL.exe
992	VMTDgyE.exe
2376	DBNJyuf.exe
2228	MNEvcco.exe
3028	paWGofq.exe
2408	AZoSbAr.exe
2128	apvGPyL.exe
2160	ZusXxaD.exe
580	VrimEZp.exe
1096	DsvajIl.exe
884	HkjfurF.exe
1960	kTRZJsP.exe
2276	wnZcwHa.exe
1556	xapqsgV.exe
752	UCKNeDn.exe
604	YHRStDT.exe
2424	LlSqXmE.exe
2668	WqZBBak.exe
2776	KqzERms.exe
2768	UGWovSb.exe
2808	iIdcEwQ.exe
2696	WdpcSMi.exe
2572	nGyaWff.exe

Loads dropped DLL 64 IoCs

pid	Process
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ODYNKmD.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\oAtGtVA.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\rZJVqqH.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\PVWzzJy.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\nclJqSX.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\pdYMLEX.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\PRyfipf.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\NwdTPzj.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zVhoiMx.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ozgVVLZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zPtiBZP.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ZlzMcEb.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\TnIuZYg.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ublcbpP.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\vDVHirL.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\isNFLbR.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\AzRGOdp.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\VCsovPB.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ovOYYmd.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\XYltMVI.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\fXCXYsC.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zBlAojg.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\XnrUbhU.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\uqjSyKB.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\nRvNApW.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\GVPEtoL.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\slpIBtR.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\pONkGdb.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\yTLtwye.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\DwHneqt.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\rwtSeOU.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\eoQIvLx.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\UQEtNbC.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\dfzwHXZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\vRxGhhJ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\WlpXRmm.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\cBDvFou.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\uhMrUiK.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\QSLKyYX.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\JsKreSU.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\FQLCwSc.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\oTiwHLF.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\gKFRaxJ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\qkFxzES.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\MmZqOGv.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\TNQSBVP.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\plDirNz.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\lNmfyPL.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ilWpEQV.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\QLEkRXb.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\XLFxeCU.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\IZOqGBa.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zyWwxgq.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ojnkpfa.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\GOUjFws.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\uQMPKQg.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\XzzUsdn.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\rzbNWky.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\SXDVaMx.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\SxpTvAk.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\OkYeqOM.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\qQEXAkw.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ncqjXFh.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\FVsISKZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2316	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	32
PID 2096 wrote to memory of 2316	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	32
PID 2096 wrote to memory of 2316	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	32
PID 2096 wrote to memory of 2336	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	33
PID 2096 wrote to memory of 2336	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	33
PID 2096 wrote to memory of 2336	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	33
PID 2096 wrote to memory of 2356	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	34
PID 2096 wrote to memory of 2356	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	34
PID 2096 wrote to memory of 2356	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	34
PID 2096 wrote to memory of 2744	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	35
PID 2096 wrote to memory of 2744	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	35
PID 2096 wrote to memory of 2744	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	35
PID 2096 wrote to memory of 2212	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	36
PID 2096 wrote to memory of 2212	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	36
PID 2096 wrote to memory of 2212	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	36
PID 2096 wrote to memory of 1976	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	37
PID 2096 wrote to memory of 1976	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	37
PID 2096 wrote to memory of 1976	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	37
PID 2096 wrote to memory of 2816	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	38
PID 2096 wrote to memory of 2816	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	38
PID 2096 wrote to memory of 2816	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	38
PID 2096 wrote to memory of 2716	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	39
PID 2096 wrote to memory of 2716	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	39
PID 2096 wrote to memory of 2716	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	39
PID 2096 wrote to memory of 2564	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	40
PID 2096 wrote to memory of 2564	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	40
PID 2096 wrote to memory of 2564	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	40
PID 2096 wrote to memory of 2720	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	41
PID 2096 wrote to memory of 2720	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	41
PID 2096 wrote to memory of 2720	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	41
PID 2096 wrote to memory of 2860	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	42
PID 2096 wrote to memory of 2860	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	42
PID 2096 wrote to memory of 2860	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	42
PID 2096 wrote to memory of 2724	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	43
PID 2096 wrote to memory of 2724	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	43
PID 2096 wrote to memory of 2724	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	43
PID 2096 wrote to memory of 1176	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	44
PID 2096 wrote to memory of 1176	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	44
PID 2096 wrote to memory of 1176	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	44
PID 2096 wrote to memory of 2576	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	45
PID 2096 wrote to memory of 2576	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	45
PID 2096 wrote to memory of 2576	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	45
PID 2096 wrote to memory of 2680	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	46
PID 2096 wrote to memory of 2680	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	46
PID 2096 wrote to memory of 2680	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	46
PID 2096 wrote to memory of 2396	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	47
PID 2096 wrote to memory of 2396	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	47
PID 2096 wrote to memory of 2396	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	47
PID 2096 wrote to memory of 1492	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	48
PID 2096 wrote to memory of 1492	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	48
PID 2096 wrote to memory of 1492	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	48
PID 2096 wrote to memory of 1956	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	49
PID 2096 wrote to memory of 1956	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	49
PID 2096 wrote to memory of 1956	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	49
PID 2096 wrote to memory of 2736	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	50
PID 2096 wrote to memory of 2736	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	50
PID 2096 wrote to memory of 2736	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	50
PID 2096 wrote to memory of 2296	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	51
PID 2096 wrote to memory of 2296	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	51
PID 2096 wrote to memory of 2296	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	51
PID 2096 wrote to memory of 2628	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	52
PID 2096 wrote to memory of 2628	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	52
PID 2096 wrote to memory of 2628	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	52
PID 2096 wrote to memory of 2384	2096	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	53

C:\Users\Admin\AppData\Local\Temp\46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
"C:\Users\Admin\AppData\Local\Temp\46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System\hECEMfF.exe
  C:\Windows\System\hECEMfF.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\JplVeKx.exe
  C:\Windows\System\JplVeKx.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\mVbRuPa.exe
  C:\Windows\System\mVbRuPa.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\VBJUifu.exe
  C:\Windows\System\VBJUifu.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\XeWZZut.exe
  C:\Windows\System\XeWZZut.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\pKDXbOz.exe
  C:\Windows\System\pKDXbOz.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\hbcaPLw.exe
  C:\Windows\System\hbcaPLw.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ShNxUWc.exe
  C:\Windows\System\ShNxUWc.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ECfhMAF.exe
  C:\Windows\System\ECfhMAF.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ccVHqyF.exe
  C:\Windows\System\ccVHqyF.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ObiSqGp.exe
  C:\Windows\System\ObiSqGp.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\BbDOzhO.exe
  C:\Windows\System\BbDOzhO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\SnGBTvq.exe
  C:\Windows\System\SnGBTvq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\VSqtmlY.exe
  C:\Windows\System\VSqtmlY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yEftfbY.exe
  C:\Windows\System\yEftfbY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\PyGcHUC.exe
  C:\Windows\System\PyGcHUC.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\dPbNiME.exe
  C:\Windows\System\dPbNiME.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ZtkSMCy.exe
  C:\Windows\System\ZtkSMCy.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\hbZbYfb.exe
  C:\Windows\System\hbZbYfb.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\iFGfgiD.exe
  C:\Windows\System\iFGfgiD.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\vJfdXhp.exe
  C:\Windows\System\vJfdXhp.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\pWKePZZ.exe
  C:\Windows\System\pWKePZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\qarLxec.exe
  C:\Windows\System\qarLxec.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\sFErcps.exe
  C:\Windows\System\sFErcps.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\npXlhPq.exe
  C:\Windows\System\npXlhPq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ixlmNwf.exe
  C:\Windows\System\ixlmNwf.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\lTUoQKv.exe
  C:\Windows\System\lTUoQKv.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\KifaDno.exe
  C:\Windows\System\KifaDno.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\IlGpAGH.exe
  C:\Windows\System\IlGpAGH.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\XAZNmPN.exe
  C:\Windows\System\XAZNmPN.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\HQXmUwX.exe
  C:\Windows\System\HQXmUwX.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\YtBvrrK.exe
  C:\Windows\System\YtBvrrK.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\McjBaJJ.exe
  C:\Windows\System\McjBaJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\vIVUgWe.exe
  C:\Windows\System\vIVUgWe.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\pyQVGcy.exe
  C:\Windows\System\pyQVGcy.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\bOpXKUP.exe
  C:\Windows\System\bOpXKUP.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pdYMLEX.exe
  C:\Windows\System\pdYMLEX.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\DDADnpN.exe
  C:\Windows\System\DDADnpN.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\FbCYBzT.exe
  C:\Windows\System\FbCYBzT.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\EWcUgNq.exe
  C:\Windows\System\EWcUgNq.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\ftgTjyj.exe
  C:\Windows\System\ftgTjyj.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\mJKbqTL.exe
  C:\Windows\System\mJKbqTL.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VMTDgyE.exe
  C:\Windows\System\VMTDgyE.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\DBNJyuf.exe
  C:\Windows\System\DBNJyuf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\MNEvcco.exe
  C:\Windows\System\MNEvcco.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\paWGofq.exe
  C:\Windows\System\paWGofq.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AZoSbAr.exe
  C:\Windows\System\AZoSbAr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\apvGPyL.exe
  C:\Windows\System\apvGPyL.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\ZusXxaD.exe
  C:\Windows\System\ZusXxaD.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\VrimEZp.exe
  C:\Windows\System\VrimEZp.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\DsvajIl.exe
  C:\Windows\System\DsvajIl.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\HkjfurF.exe
  C:\Windows\System\HkjfurF.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\kTRZJsP.exe
  C:\Windows\System\kTRZJsP.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\wnZcwHa.exe
  C:\Windows\System\wnZcwHa.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\xapqsgV.exe
  C:\Windows\System\xapqsgV.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\UCKNeDn.exe
  C:\Windows\System\UCKNeDn.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\YHRStDT.exe
  C:\Windows\System\YHRStDT.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\LlSqXmE.exe
  C:\Windows\System\LlSqXmE.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WqZBBak.exe
  C:\Windows\System\WqZBBak.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\KqzERms.exe
  C:\Windows\System\KqzERms.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\UGWovSb.exe
  C:\Windows\System\UGWovSb.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\iIdcEwQ.exe
  C:\Windows\System\iIdcEwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\WdpcSMi.exe
  C:\Windows\System\WdpcSMi.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\nGyaWff.exe
  C:\Windows\System\nGyaWff.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bYuNkbE.exe
  C:\Windows\System\bYuNkbE.exe
  2⤵
  PID:1644
- C:\Windows\System\CBbzHEY.exe
  C:\Windows\System\CBbzHEY.exe
  2⤵
  PID:700
- C:\Windows\System\AipqvjS.exe
  C:\Windows\System\AipqvjS.exe
  2⤵
  PID:2388
- C:\Windows\System\dYMcCwI.exe
  C:\Windows\System\dYMcCwI.exe
  2⤵
  PID:1892
- C:\Windows\System\CiYylNp.exe
  C:\Windows\System\CiYylNp.exe
  2⤵
  PID:556
- C:\Windows\System\IAoyXTO.exe
  C:\Windows\System\IAoyXTO.exe
  2⤵
  PID:1996
- C:\Windows\System\DOmvmoN.exe
  C:\Windows\System\DOmvmoN.exe
  2⤵
  PID:2856
- C:\Windows\System\IppjXIa.exe
  C:\Windows\System\IppjXIa.exe
  2⤵
  PID:3024
- C:\Windows\System\CqBNGLZ.exe
  C:\Windows\System\CqBNGLZ.exe
  2⤵
  PID:2104
- C:\Windows\System\mfAVIDL.exe
  C:\Windows\System\mfAVIDL.exe
  2⤵
  PID:2492
- C:\Windows\System\krDTKFO.exe
  C:\Windows\System\krDTKFO.exe
  2⤵
  PID:2308
- C:\Windows\System\YimEdNK.exe
  C:\Windows\System\YimEdNK.exe
  2⤵
  PID:1988
- C:\Windows\System\TlFNqsT.exe
  C:\Windows\System\TlFNqsT.exe
  2⤵
  PID:1716
- C:\Windows\System\lLKWGoA.exe
  C:\Windows\System\lLKWGoA.exe
  2⤵
  PID:908
- C:\Windows\System\PRyfipf.exe
  C:\Windows\System\PRyfipf.exe
  2⤵
  PID:2800
- C:\Windows\System\GTrtYvy.exe
  C:\Windows\System\GTrtYvy.exe
  2⤵
  PID:2028
- C:\Windows\System\TEnKrsj.exe
  C:\Windows\System\TEnKrsj.exe
  2⤵
  PID:560
- C:\Windows\System\QJKabPG.exe
  C:\Windows\System\QJKabPG.exe
  2⤵
  PID:2192
- C:\Windows\System\zyWwxgq.exe
  C:\Windows\System\zyWwxgq.exe
  2⤵
  PID:3020
- C:\Windows\System\BwyQLFA.exe
  C:\Windows\System\BwyQLFA.exe
  2⤵
  PID:2240
- C:\Windows\System\uhMrUiK.exe
  C:\Windows\System\uhMrUiK.exe
  2⤵
  PID:1328
- C:\Windows\System\ppUtgtF.exe
  C:\Windows\System\ppUtgtF.exe
  2⤵
  PID:2880
- C:\Windows\System\qHfRIDe.exe
  C:\Windows\System\qHfRIDe.exe
  2⤵
  PID:2272
- C:\Windows\System\YttXkiP.exe
  C:\Windows\System\YttXkiP.exe
  2⤵
  PID:1088
- C:\Windows\System\gTTdxcb.exe
  C:\Windows\System\gTTdxcb.exe
  2⤵
  PID:3004
- C:\Windows\System\HSOziwL.exe
  C:\Windows\System\HSOziwL.exe
  2⤵
  PID:2488
- C:\Windows\System\MMLAvQL.exe
  C:\Windows\System\MMLAvQL.exe
  2⤵
  PID:2352
- C:\Windows\System\bcLZskq.exe
  C:\Windows\System\bcLZskq.exe
  2⤵
  PID:2412
- C:\Windows\System\qMxbhVs.exe
  C:\Windows\System\qMxbhVs.exe
  2⤵
  PID:2280
- C:\Windows\System\VTiIUza.exe
  C:\Windows\System\VTiIUza.exe
  2⤵
  PID:2252
- C:\Windows\System\dCPckys.exe
  C:\Windows\System\dCPckys.exe
  2⤵
  PID:2612
- C:\Windows\System\oViwszb.exe
  C:\Windows\System\oViwszb.exe
  2⤵
  PID:3048
- C:\Windows\System\NwdTPzj.exe
  C:\Windows\System\NwdTPzj.exe
  2⤵
  PID:2904
- C:\Windows\System\lVeDqXR.exe
  C:\Windows\System\lVeDqXR.exe
  2⤵
  PID:320
- C:\Windows\System\wtaUBIv.exe
  C:\Windows\System\wtaUBIv.exe
  2⤵
  PID:1196
- C:\Windows\System\LGebqro.exe
  C:\Windows\System\LGebqro.exe
  2⤵
  PID:1664
- C:\Windows\System\KhOdjsC.exe
  C:\Windows\System\KhOdjsC.exe
  2⤵
  PID:2100
- C:\Windows\System\GVEHbfU.exe
  C:\Windows\System\GVEHbfU.exe
  2⤵
  PID:1620
- C:\Windows\System\lQRQkvN.exe
  C:\Windows\System\lQRQkvN.exe
  2⤵
  PID:972
- C:\Windows\System\jEIYlyE.exe
  C:\Windows\System\jEIYlyE.exe
  2⤵
  PID:1592
- C:\Windows\System\XkHjrVM.exe
  C:\Windows\System\XkHjrVM.exe
  2⤵
  PID:1528
- C:\Windows\System\wVutEVT.exe
  C:\Windows\System\wVutEVT.exe
  2⤵
  PID:1596
- C:\Windows\System\tgKDxBT.exe
  C:\Windows\System\tgKDxBT.exe
  2⤵
  PID:3016
- C:\Windows\System\ADEqjSw.exe
  C:\Windows\System\ADEqjSw.exe
  2⤵
  PID:2140
- C:\Windows\System\ilWpEQV.exe
  C:\Windows\System\ilWpEQV.exe
  2⤵
  PID:1076
- C:\Windows\System\ahCvyWv.exe
  C:\Windows\System\ahCvyWv.exe
  2⤵
  PID:2836
- C:\Windows\System\BvCpYUG.exe
  C:\Windows\System\BvCpYUG.exe
  2⤵
  PID:1764
- C:\Windows\System\AWdWCOG.exe
  C:\Windows\System\AWdWCOG.exe
  2⤵
  PID:2480
- C:\Windows\System\bYDRwHh.exe
  C:\Windows\System\bYDRwHh.exe
  2⤵
  PID:2784
- C:\Windows\System\QUIkUot.exe
  C:\Windows\System\QUIkUot.exe
  2⤵
  PID:2704
- C:\Windows\System\iMXRSLh.exe
  C:\Windows\System\iMXRSLh.exe
  2⤵
  PID:1984
- C:\Windows\System\SXDVaMx.exe
  C:\Windows\System\SXDVaMx.exe
  2⤵
  PID:1400
- C:\Windows\System\iWXXqGi.exe
  C:\Windows\System\iWXXqGi.exe
  2⤵
  PID:2340
- C:\Windows\System\EKhzOcK.exe
  C:\Windows\System\EKhzOcK.exe
  2⤵
  PID:1772
- C:\Windows\System\nOFfJWc.exe
  C:\Windows\System\nOFfJWc.exe
  2⤵
  PID:2620
- C:\Windows\System\IcTjcqS.exe
  C:\Windows\System\IcTjcqS.exe
  2⤵
  PID:1876
- C:\Windows\System\HjSyADm.exe
  C:\Windows\System\HjSyADm.exe
  2⤵
  PID:3008
- C:\Windows\System\bskMYnW.exe
  C:\Windows\System\bskMYnW.exe
  2⤵
  PID:3036
- C:\Windows\System\kyWhwlu.exe
  C:\Windows\System\kyWhwlu.exe
  2⤵
  PID:1720
- C:\Windows\System\wjTSULI.exe
  C:\Windows\System\wjTSULI.exe
  2⤵
  PID:2952
- C:\Windows\System\vSpAFjw.exe
  C:\Windows\System\vSpAFjw.exe
  2⤵
  PID:940
- C:\Windows\System\GZdFBvj.exe
  C:\Windows\System\GZdFBvj.exe
  2⤵
  PID:2752
- C:\Windows\System\QMjjzDl.exe
  C:\Windows\System\QMjjzDl.exe
  2⤵
  PID:2732
- C:\Windows\System\BCwfWIu.exe
  C:\Windows\System\BCwfWIu.exe
  2⤵
  PID:572
- C:\Windows\System\AQfHeGl.exe
  C:\Windows\System\AQfHeGl.exe
  2⤵
  PID:2516
- C:\Windows\System\tEsRnjr.exe
  C:\Windows\System\tEsRnjr.exe
  2⤵
  PID:2440
- C:\Windows\System\ITfSwJT.exe
  C:\Windows\System\ITfSwJT.exe
  2⤵
  PID:1744
- C:\Windows\System\YxjxDAk.exe
  C:\Windows\System\YxjxDAk.exe
  2⤵
  PID:2200
- C:\Windows\System\WyYbxSW.exe
  C:\Windows\System\WyYbxSW.exe
  2⤵
  PID:528
- C:\Windows\System\vmmjQLp.exe
  C:\Windows\System\vmmjQLp.exe
  2⤵
  PID:2840
- C:\Windows\System\piSiQIM.exe
  C:\Windows\System\piSiQIM.exe
  2⤵
  PID:2484
- C:\Windows\System\QMkJGkY.exe
  C:\Windows\System\QMkJGkY.exe
  2⤵
  PID:2792
- C:\Windows\System\xfFMNyQ.exe
  C:\Windows\System\xfFMNyQ.exe
  2⤵
  PID:2756
- C:\Windows\System\fWVAlyt.exe
  C:\Windows\System\fWVAlyt.exe
  2⤵
  PID:2868
- C:\Windows\System\XnrUbhU.exe
  C:\Windows\System\XnrUbhU.exe
  2⤵
  PID:1136
- C:\Windows\System\ePFtNlp.exe
  C:\Windows\System\ePFtNlp.exe
  2⤵
  PID:2556
- C:\Windows\System\JDDhQxP.exe
  C:\Windows\System\JDDhQxP.exe
  2⤵
  PID:2592
- C:\Windows\System\cxaiULz.exe
  C:\Windows\System\cxaiULz.exe
  2⤵
  PID:2664
- C:\Windows\System\oTiwHLF.exe
  C:\Windows\System\oTiwHLF.exe
  2⤵
  PID:1108
- C:\Windows\System\PIbdnDn.exe
  C:\Windows\System\PIbdnDn.exe
  2⤵
  PID:2608
- C:\Windows\System\VCsovPB.exe
  C:\Windows\System\VCsovPB.exe
  2⤵
  PID:2684
- C:\Windows\System\kIMicNq.exe
  C:\Windows\System\kIMicNq.exe
  2⤵
  PID:2932
- C:\Windows\System\qguACCC.exe
  C:\Windows\System\qguACCC.exe
  2⤵
  PID:2760
- C:\Windows\System\UcEbjTv.exe
  C:\Windows\System\UcEbjTv.exe
  2⤵
  PID:3080
- C:\Windows\System\jrHYxcD.exe
  C:\Windows\System\jrHYxcD.exe
  2⤵
  PID:3100
- C:\Windows\System\RRaSrJB.exe
  C:\Windows\System\RRaSrJB.exe
  2⤵
  PID:3124
- C:\Windows\System\ZlzMcEb.exe
  C:\Windows\System\ZlzMcEb.exe
  2⤵
  PID:3164
- C:\Windows\System\RpEMJkS.exe
  C:\Windows\System\RpEMJkS.exe
  2⤵
  PID:3180
- C:\Windows\System\cnHsibb.exe
  C:\Windows\System\cnHsibb.exe
  2⤵
  PID:3208
- C:\Windows\System\SNpFiaE.exe
  C:\Windows\System\SNpFiaE.exe
  2⤵
  PID:3228
- C:\Windows\System\eMNoWPH.exe
  C:\Windows\System\eMNoWPH.exe
  2⤵
  PID:3252
- C:\Windows\System\PPYeuxm.exe
  C:\Windows\System\PPYeuxm.exe
  2⤵
  PID:3272
- C:\Windows\System\KBLxFFq.exe
  C:\Windows\System\KBLxFFq.exe
  2⤵
  PID:3288
- C:\Windows\System\iXnUlOu.exe
  C:\Windows\System\iXnUlOu.exe
  2⤵
  PID:3348
- C:\Windows\System\mSXgbvy.exe
  C:\Windows\System\mSXgbvy.exe
  2⤵
  PID:3364
- C:\Windows\System\SVdOFVR.exe
  C:\Windows\System\SVdOFVR.exe
  2⤵
  PID:3380
- C:\Windows\System\OVkDhDE.exe
  C:\Windows\System\OVkDhDE.exe
  2⤵
  PID:3396
- C:\Windows\System\FmSTQZI.exe
  C:\Windows\System\FmSTQZI.exe
  2⤵
  PID:3420
- C:\Windows\System\xPbWkwM.exe
  C:\Windows\System\xPbWkwM.exe
  2⤵
  PID:3436
- C:\Windows\System\mMbWwxI.exe
  C:\Windows\System\mMbWwxI.exe
  2⤵
  PID:3452
- C:\Windows\System\NwktnBh.exe
  C:\Windows\System\NwktnBh.exe
  2⤵
  PID:3476
- C:\Windows\System\JgUaFNS.exe
  C:\Windows\System\JgUaFNS.exe
  2⤵
  PID:3496
- C:\Windows\System\AvISoXB.exe
  C:\Windows\System\AvISoXB.exe
  2⤵
  PID:3512
- C:\Windows\System\EZipxZv.exe
  C:\Windows\System\EZipxZv.exe
  2⤵
  PID:3528
- C:\Windows\System\sPvohfw.exe
  C:\Windows\System\sPvohfw.exe
  2⤵
  PID:3568
- C:\Windows\System\TDZshso.exe
  C:\Windows\System\TDZshso.exe
  2⤵
  PID:3584
- C:\Windows\System\zXDcYaU.exe
  C:\Windows\System\zXDcYaU.exe
  2⤵
  PID:3600
- C:\Windows\System\cGoBSBd.exe
  C:\Windows\System\cGoBSBd.exe
  2⤵
  PID:3616
- C:\Windows\System\FYvfoEG.exe
  C:\Windows\System\FYvfoEG.exe
  2⤵
  PID:3632
- C:\Windows\System\beCmjQn.exe
  C:\Windows\System\beCmjQn.exe
  2⤵
  PID:3648
- C:\Windows\System\VWwHJXD.exe
  C:\Windows\System\VWwHJXD.exe
  2⤵
  PID:3664
- C:\Windows\System\YSmHmCy.exe
  C:\Windows\System\YSmHmCy.exe
  2⤵
  PID:3680
- C:\Windows\System\ZWSEMoD.exe
  C:\Windows\System\ZWSEMoD.exe
  2⤵
  PID:3696
- C:\Windows\System\agVaAlZ.exe
  C:\Windows\System\agVaAlZ.exe
  2⤵
  PID:3712
- C:\Windows\System\WQHfUsO.exe
  C:\Windows\System\WQHfUsO.exe
  2⤵
  PID:3728
- C:\Windows\System\YUiVbQP.exe
  C:\Windows\System\YUiVbQP.exe
  2⤵
  PID:3744
- C:\Windows\System\JUAgXkh.exe
  C:\Windows\System\JUAgXkh.exe
  2⤵
  PID:3796
- C:\Windows\System\gKFRaxJ.exe
  C:\Windows\System\gKFRaxJ.exe
  2⤵
  PID:3812
- C:\Windows\System\IqBtsmy.exe
  C:\Windows\System\IqBtsmy.exe
  2⤵
  PID:3832
- C:\Windows\System\fkmVPPu.exe
  C:\Windows\System\fkmVPPu.exe
  2⤵
  PID:3852
- C:\Windows\System\xJrsgCP.exe
  C:\Windows\System\xJrsgCP.exe
  2⤵
  PID:3868
- C:\Windows\System\UfFCsRY.exe
  C:\Windows\System\UfFCsRY.exe
  2⤵
  PID:3884
- C:\Windows\System\RGUZLRk.exe
  C:\Windows\System\RGUZLRk.exe
  2⤵
  PID:3900
- C:\Windows\System\iIFeWqK.exe
  C:\Windows\System\iIFeWqK.exe
  2⤵
  PID:3916
- C:\Windows\System\XdXVHia.exe
  C:\Windows\System\XdXVHia.exe
  2⤵
  PID:3932
- C:\Windows\System\BsTNMWQ.exe
  C:\Windows\System\BsTNMWQ.exe
  2⤵
  PID:3952
- C:\Windows\System\NwWArKb.exe
  C:\Windows\System\NwWArKb.exe
  2⤵
  PID:3972
- C:\Windows\System\dhdxjeW.exe
  C:\Windows\System\dhdxjeW.exe
  2⤵
  PID:3988
- C:\Windows\System\RisEBEN.exe
  C:\Windows\System\RisEBEN.exe
  2⤵
  PID:4004
- C:\Windows\System\RWXnaQi.exe
  C:\Windows\System\RWXnaQi.exe
  2⤵
  PID:4020
- C:\Windows\System\ySznJIJ.exe
  C:\Windows\System\ySznJIJ.exe
  2⤵
  PID:4036
- C:\Windows\System\vrfheIT.exe
  C:\Windows\System\vrfheIT.exe
  2⤵
  PID:4052
- C:\Windows\System\AQeMxYz.exe
  C:\Windows\System\AQeMxYz.exe
  2⤵
  PID:4068
- C:\Windows\System\KidPXNW.exe
  C:\Windows\System\KidPXNW.exe
  2⤵
  PID:4084
- C:\Windows\System\KnFbfnl.exe
  C:\Windows\System\KnFbfnl.exe
  2⤵
  PID:2672
- C:\Windows\System\CLWLgdr.exe
  C:\Windows\System\CLWLgdr.exe
  2⤵
  PID:3088
- C:\Windows\System\zVhoiMx.exe
  C:\Windows\System\zVhoiMx.exe
  2⤵
  PID:2644
- C:\Windows\System\dTmOXlw.exe
  C:\Windows\System\dTmOXlw.exe
  2⤵
  PID:2472
- C:\Windows\System\nJSJCbq.exe
  C:\Windows\System\nJSJCbq.exe
  2⤵
  PID:3144
- C:\Windows\System\IBKoTzL.exe
  C:\Windows\System\IBKoTzL.exe
  2⤵
  PID:2044
- C:\Windows\System\pkfhWdl.exe
  C:\Windows\System\pkfhWdl.exe
  2⤵
  PID:1652
- C:\Windows\System\zwCEbYY.exe
  C:\Windows\System\zwCEbYY.exe
  2⤵
  PID:3244
- C:\Windows\System\VrrSirq.exe
  C:\Windows\System\VrrSirq.exe
  2⤵
  PID:1396
- C:\Windows\System\ywNybAx.exe
  C:\Windows\System\ywNybAx.exe
  2⤵
  PID:3176
- C:\Windows\System\fpNpcNq.exe
  C:\Windows\System\fpNpcNq.exe
  2⤵
  PID:3264
- C:\Windows\System\WdPuSMq.exe
  C:\Windows\System\WdPuSMq.exe
  2⤵
  PID:3220
- C:\Windows\System\MlplyZj.exe
  C:\Windows\System\MlplyZj.exe
  2⤵
  PID:236
- C:\Windows\System\OtCIBVV.exe
  C:\Windows\System\OtCIBVV.exe
  2⤵
  PID:3336
- C:\Windows\System\JAqiiTg.exe
  C:\Windows\System\JAqiiTg.exe
  2⤵
  PID:3392
- C:\Windows\System\EilRXLO.exe
  C:\Windows\System\EilRXLO.exe
  2⤵
  PID:3412
- C:\Windows\System\MZoipbm.exe
  C:\Windows\System\MZoipbm.exe
  2⤵
  PID:3508
- C:\Windows\System\ojnkpfa.exe
  C:\Windows\System\ojnkpfa.exe
  2⤵
  PID:3544
- C:\Windows\System\YnMZWiC.exe
  C:\Windows\System\YnMZWiC.exe
  2⤵
  PID:3488
- C:\Windows\System\OUXzblh.exe
  C:\Windows\System\OUXzblh.exe
  2⤵
  PID:3552
- C:\Windows\System\JMxUVwz.exe
  C:\Windows\System\JMxUVwz.exe
  2⤵
  PID:1312
- C:\Windows\System\PTJhyAy.exe
  C:\Windows\System\PTJhyAy.exe
  2⤵
  PID:3672
- C:\Windows\System\LykHUah.exe
  C:\Windows\System\LykHUah.exe
  2⤵
  PID:3564
- C:\Windows\System\qgozCQd.exe
  C:\Windows\System\qgozCQd.exe
  2⤵
  PID:3628
- C:\Windows\System\wLgzrYs.exe
  C:\Windows\System\wLgzrYs.exe
  2⤵
  PID:3692
- C:\Windows\System\JPXYVjW.exe
  C:\Windows\System\JPXYVjW.exe
  2⤵
  PID:3760
- C:\Windows\System\PrvVVvz.exe
  C:\Windows\System\PrvVVvz.exe
  2⤵
  PID:3784
- C:\Windows\System\GOUjFws.exe
  C:\Windows\System\GOUjFws.exe
  2⤵
  PID:3704
- C:\Windows\System\QQCliKC.exe
  C:\Windows\System\QQCliKC.exe
  2⤵
  PID:3792
- C:\Windows\System\pGaqUqK.exe
  C:\Windows\System\pGaqUqK.exe
  2⤵
  PID:3860
- C:\Windows\System\KibKGLd.exe
  C:\Windows\System\KibKGLd.exe
  2⤵
  PID:3960
- C:\Windows\System\jExbJNu.exe
  C:\Windows\System\jExbJNu.exe
  2⤵
  PID:4000
- C:\Windows\System\vWNiOpo.exe
  C:\Windows\System\vWNiOpo.exe
  2⤵
  PID:4092
- C:\Windows\System\GSHxBcm.exe
  C:\Windows\System\GSHxBcm.exe
  2⤵
  PID:3136
- C:\Windows\System\AgPclMO.exe
  C:\Windows\System\AgPclMO.exe
  2⤵
  PID:1820
- C:\Windows\System\AcvjSIt.exe
  C:\Windows\System\AcvjSIt.exe
  2⤵
  PID:4012
- C:\Windows\System\XNDFEsA.exe
  C:\Windows\System\XNDFEsA.exe
  2⤵
  PID:1836
- C:\Windows\System\oCdHvDo.exe
  C:\Windows\System\oCdHvDo.exe
  2⤵
  PID:2584
- C:\Windows\System\yumZQWj.exe
  C:\Windows\System\yumZQWj.exe
  2⤵
  PID:2780
- C:\Windows\System\knKvVlZ.exe
  C:\Windows\System\knKvVlZ.exe
  2⤵
  PID:3980
- C:\Windows\System\eirmBZr.exe
  C:\Windows\System\eirmBZr.exe
  2⤵
  PID:3908
- C:\Windows\System\ZtZXJwK.exe
  C:\Windows\System\ZtZXJwK.exe
  2⤵
  PID:864
- C:\Windows\System\TOZSGbv.exe
  C:\Windows\System\TOZSGbv.exe
  2⤵
  PID:1632
- C:\Windows\System\MAkgDKe.exe
  C:\Windows\System\MAkgDKe.exe
  2⤵
  PID:2852
- C:\Windows\System\kTFSrOn.exe
  C:\Windows\System\kTFSrOn.exe
  2⤵
  PID:2524
- C:\Windows\System\ylDDyCI.exe
  C:\Windows\System\ylDDyCI.exe
  2⤵
  PID:2848
- C:\Windows\System\jBYzzzh.exe
  C:\Windows\System\jBYzzzh.exe
  2⤵
  PID:3660
- C:\Windows\System\LcyeLOO.exe
  C:\Windows\System\LcyeLOO.exe
  2⤵
  PID:3736
- C:\Windows\System\xQbqsZH.exe
  C:\Windows\System\xQbqsZH.exe
  2⤵
  PID:3896
- C:\Windows\System\ucTAodS.exe
  C:\Windows\System\ucTAodS.exe
  2⤵
  PID:4060
- C:\Windows\System\DUscWUg.exe
  C:\Windows\System\DUscWUg.exe
  2⤵
  PID:3340
- C:\Windows\System\XlAIlcE.exe
  C:\Windows\System\XlAIlcE.exe
  2⤵
  PID:3376
- C:\Windows\System\idulxyj.exe
  C:\Windows\System\idulxyj.exe
  2⤵
  PID:2928
- C:\Windows\System\cPKwxpi.exe
  C:\Windows\System\cPKwxpi.exe
  2⤵
  PID:4044
- C:\Windows\System\RDXdJGV.exe
  C:\Windows\System\RDXdJGV.exe
  2⤵
  PID:4048
- C:\Windows\System\vAduEox.exe
  C:\Windows\System\vAduEox.exe
  2⤵
  PID:2712
- C:\Windows\System\SxpTvAk.exe
  C:\Windows\System\SxpTvAk.exe
  2⤵
  PID:3468
- C:\Windows\System\jnEzLNa.exe
  C:\Windows\System\jnEzLNa.exe
  2⤵
  PID:3448
- C:\Windows\System\FZqouhc.exe
  C:\Windows\System\FZqouhc.exe
  2⤵
  PID:3536
- C:\Windows\System\LoRdeqe.exe
  C:\Windows\System\LoRdeqe.exe
  2⤵
  PID:3504
- C:\Windows\System\NVdUNsr.exe
  C:\Windows\System\NVdUNsr.exe
  2⤵
  PID:3160
- C:\Windows\System\uqjSyKB.exe
  C:\Windows\System\uqjSyKB.exe
  2⤵
  PID:3408
- C:\Windows\System\faTRYrF.exe
  C:\Windows\System\faTRYrF.exe
  2⤵
  PID:3240
- C:\Windows\System\YrEJQXm.exe
  C:\Windows\System\YrEJQXm.exe
  2⤵
  PID:2804
- C:\Windows\System\PpaKQVZ.exe
  C:\Windows\System\PpaKQVZ.exe
  2⤵
  PID:2332
- C:\Windows\System\VtiWyDL.exe
  C:\Windows\System\VtiWyDL.exe
  2⤵
  PID:408
- C:\Windows\System\FMlLdBU.exe
  C:\Windows\System\FMlLdBU.exe
  2⤵
  PID:3524
- C:\Windows\System\sgcpMSf.exe
  C:\Windows\System\sgcpMSf.exe
  2⤵
  PID:588
- C:\Windows\System\KXTaKdV.exe
  C:\Windows\System\KXTaKdV.exe
  2⤵
  PID:3464
- C:\Windows\System\GXXkGpD.exe
  C:\Windows\System\GXXkGpD.exe
  2⤵
  PID:3808
- C:\Windows\System\HwmObda.exe
  C:\Windows\System\HwmObda.exe
  2⤵
  PID:3092
- C:\Windows\System\hkvIEJI.exe
  C:\Windows\System\hkvIEJI.exe
  2⤵
  PID:3844
- C:\Windows\System\tXUHWnB.exe
  C:\Windows\System\tXUHWnB.exe
  2⤵
  PID:2448
- C:\Windows\System\CrqTybv.exe
  C:\Windows\System\CrqTybv.exe
  2⤵
  PID:3360
- C:\Windows\System\dhvnaql.exe
  C:\Windows\System\dhvnaql.exe
  2⤵
  PID:3776
- C:\Windows\System\heGSrgc.exe
  C:\Windows\System\heGSrgc.exe
  2⤵
  PID:2920
- C:\Windows\System\ueuWepA.exe
  C:\Windows\System\ueuWepA.exe
  2⤵
  PID:3912
- C:\Windows\System\gHNjxVt.exe
  C:\Windows\System\gHNjxVt.exe
  2⤵
  PID:3460
- C:\Windows\System\pJSVaHL.exe
  C:\Windows\System\pJSVaHL.exe
  2⤵
  PID:3656
- C:\Windows\System\osoKttb.exe
  C:\Windows\System\osoKttb.exe
  2⤵
  PID:3108
- C:\Windows\System\nhqJhqE.exe
  C:\Windows\System\nhqJhqE.exe
  2⤵
  PID:3216
- C:\Windows\System\FgkxRHf.exe
  C:\Windows\System\FgkxRHf.exe
  2⤵
  PID:3752
- C:\Windows\System\MNOhbYY.exe
  C:\Windows\System\MNOhbYY.exe
  2⤵
  PID:3820
- C:\Windows\System\sFjkGJq.exe
  C:\Windows\System\sFjkGJq.exe
  2⤵
  PID:3928
- C:\Windows\System\tWEIXqk.exe
  C:\Windows\System\tWEIXqk.exe
  2⤵
  PID:3556
- C:\Windows\System\KUzPczw.exe
  C:\Windows\System\KUzPczw.exe
  2⤵
  PID:3372
- C:\Windows\System\CiDWsJY.exe
  C:\Windows\System\CiDWsJY.exe
  2⤵
  PID:3260
- C:\Windows\System\rfbnaNX.exe
  C:\Windows\System\rfbnaNX.exe
  2⤵
  PID:3996
- C:\Windows\System\ZUxrovr.exe
  C:\Windows\System\ZUxrovr.exe
  2⤵
  PID:3596
- C:\Windows\System\dBEmpbZ.exe
  C:\Windows\System\dBEmpbZ.exe
  2⤵
  PID:3608
- C:\Windows\System\jLbJHyR.exe
  C:\Windows\System\jLbJHyR.exe
  2⤵
  PID:3308
- C:\Windows\System\xcpkaNt.exe
  C:\Windows\System\xcpkaNt.exe
  2⤵
  PID:3284
- C:\Windows\System\wkMkkgE.exe
  C:\Windows\System\wkMkkgE.exe
  2⤵
  PID:3708
- C:\Windows\System\ACIlxSX.exe
  C:\Windows\System\ACIlxSX.exe
  2⤵
  PID:4032
- C:\Windows\System\AQSUxqt.exe
  C:\Windows\System\AQSUxqt.exe
  2⤵
  PID:4104
- C:\Windows\System\RRHxrhJ.exe
  C:\Windows\System\RRHxrhJ.exe
  2⤵
  PID:4124
- C:\Windows\System\ebJsaPp.exe
  C:\Windows\System\ebJsaPp.exe
  2⤵
  PID:4140
- C:\Windows\System\eFLmxJK.exe
  C:\Windows\System\eFLmxJK.exe
  2⤵
  PID:4156
- C:\Windows\System\LWQemZf.exe
  C:\Windows\System\LWQemZf.exe
  2⤵
  PID:4172
- C:\Windows\System\KEnCzKf.exe
  C:\Windows\System\KEnCzKf.exe
  2⤵
  PID:4188
- C:\Windows\System\UHOqbnu.exe
  C:\Windows\System\UHOqbnu.exe
  2⤵
  PID:4204
- C:\Windows\System\bEGTRtJ.exe
  C:\Windows\System\bEGTRtJ.exe
  2⤵
  PID:4220
- C:\Windows\System\MokfTpm.exe
  C:\Windows\System\MokfTpm.exe
  2⤵
  PID:4236
- C:\Windows\System\sywqBli.exe
  C:\Windows\System\sywqBli.exe
  2⤵
  PID:4252
- C:\Windows\System\JzTMqqK.exe
  C:\Windows\System\JzTMqqK.exe
  2⤵
  PID:4268
- C:\Windows\System\kcsosPi.exe
  C:\Windows\System\kcsosPi.exe
  2⤵
  PID:4284
- C:\Windows\System\MXGJBCF.exe
  C:\Windows\System\MXGJBCF.exe
  2⤵
  PID:4300
- C:\Windows\System\pKayqdL.exe
  C:\Windows\System\pKayqdL.exe
  2⤵
  PID:4316
- C:\Windows\System\rdtBoEU.exe
  C:\Windows\System\rdtBoEU.exe
  2⤵
  PID:4332
- C:\Windows\System\bMQMCIs.exe
  C:\Windows\System\bMQMCIs.exe
  2⤵
  PID:4348
- C:\Windows\System\ZdilbYB.exe
  C:\Windows\System\ZdilbYB.exe
  2⤵
  PID:4364
- C:\Windows\System\WOsgVVF.exe
  C:\Windows\System\WOsgVVF.exe
  2⤵
  PID:4380
- C:\Windows\System\ObtpWTm.exe
  C:\Windows\System\ObtpWTm.exe
  2⤵
  PID:4396
- C:\Windows\System\YnYbyEg.exe
  C:\Windows\System\YnYbyEg.exe
  2⤵
  PID:4412
- C:\Windows\System\gMmaCpS.exe
  C:\Windows\System\gMmaCpS.exe
  2⤵
  PID:4428
- C:\Windows\System\wDWpAVg.exe
  C:\Windows\System\wDWpAVg.exe
  2⤵
  PID:4444
- C:\Windows\System\ePSxzob.exe
  C:\Windows\System\ePSxzob.exe
  2⤵
  PID:4460
- C:\Windows\System\FGlZJTm.exe
  C:\Windows\System\FGlZJTm.exe
  2⤵
  PID:4476
- C:\Windows\System\pNFNSHh.exe
  C:\Windows\System\pNFNSHh.exe
  2⤵
  PID:4492
- C:\Windows\System\plDirNz.exe
  C:\Windows\System\plDirNz.exe
  2⤵
  PID:4508
- C:\Windows\System\rTZlKdv.exe
  C:\Windows\System\rTZlKdv.exe
  2⤵
  PID:4524
- C:\Windows\System\bkGtXRb.exe
  C:\Windows\System\bkGtXRb.exe
  2⤵
  PID:4540
- C:\Windows\System\ZZEZpSl.exe
  C:\Windows\System\ZZEZpSl.exe
  2⤵
  PID:4556
- C:\Windows\System\DYNHsdv.exe
  C:\Windows\System\DYNHsdv.exe
  2⤵
  PID:4572
- C:\Windows\System\azWhMeG.exe
  C:\Windows\System\azWhMeG.exe
  2⤵
  PID:4588
- C:\Windows\System\NqNGkAV.exe
  C:\Windows\System\NqNGkAV.exe
  2⤵
  PID:4604
- C:\Windows\System\NDDWDGw.exe
  C:\Windows\System\NDDWDGw.exe
  2⤵
  PID:4620
- C:\Windows\System\eVogKAI.exe
  C:\Windows\System\eVogKAI.exe
  2⤵
  PID:4636
- C:\Windows\System\zYHMeyU.exe
  C:\Windows\System\zYHMeyU.exe
  2⤵
  PID:4652
- C:\Windows\System\OyZdPuP.exe
  C:\Windows\System\OyZdPuP.exe
  2⤵
  PID:4668
- C:\Windows\System\ORrYdZz.exe
  C:\Windows\System\ORrYdZz.exe
  2⤵
  PID:4684
- C:\Windows\System\RAqUUMv.exe
  C:\Windows\System\RAqUUMv.exe
  2⤵
  PID:4700
- C:\Windows\System\hMHnFRl.exe
  C:\Windows\System\hMHnFRl.exe
  2⤵
  PID:4716
- C:\Windows\System\zLYDXyO.exe
  C:\Windows\System\zLYDXyO.exe
  2⤵
  PID:4732
- C:\Windows\System\ObjioyV.exe
  C:\Windows\System\ObjioyV.exe
  2⤵
  PID:4748
- C:\Windows\System\PNFLvUq.exe
  C:\Windows\System\PNFLvUq.exe
  2⤵
  PID:4764
- C:\Windows\System\UwSOMSP.exe
  C:\Windows\System\UwSOMSP.exe
  2⤵
  PID:4780
- C:\Windows\System\gZmEYWy.exe
  C:\Windows\System\gZmEYWy.exe
  2⤵
  PID:4796
- C:\Windows\System\ODlgGav.exe
  C:\Windows\System\ODlgGav.exe
  2⤵
  PID:4812
- C:\Windows\System\GfnmUpe.exe
  C:\Windows\System\GfnmUpe.exe
  2⤵
  PID:4828
- C:\Windows\System\vlyjyLC.exe
  C:\Windows\System\vlyjyLC.exe
  2⤵
  PID:4844
- C:\Windows\System\BrUlqAs.exe
  C:\Windows\System\BrUlqAs.exe
  2⤵
  PID:4860
- C:\Windows\System\DFCbGQp.exe
  C:\Windows\System\DFCbGQp.exe
  2⤵
  PID:4876
- C:\Windows\System\mXNCQGi.exe
  C:\Windows\System\mXNCQGi.exe
  2⤵
  PID:4892
- C:\Windows\System\VKcHFgg.exe
  C:\Windows\System\VKcHFgg.exe
  2⤵
  PID:4908
- C:\Windows\System\vJjBMts.exe
  C:\Windows\System\vJjBMts.exe
  2⤵
  PID:4924
- C:\Windows\System\TnIuZYg.exe
  C:\Windows\System\TnIuZYg.exe
  2⤵
  PID:4940
- C:\Windows\System\ECiymmo.exe
  C:\Windows\System\ECiymmo.exe
  2⤵
  PID:4956
- C:\Windows\System\AIpIFhu.exe
  C:\Windows\System\AIpIFhu.exe
  2⤵
  PID:4972
- C:\Windows\System\NiiuzEo.exe
  C:\Windows\System\NiiuzEo.exe
  2⤵
  PID:4988
- C:\Windows\System\rwVUvEk.exe
  C:\Windows\System\rwVUvEk.exe
  2⤵
  PID:5004
- C:\Windows\System\PiiaXub.exe
  C:\Windows\System\PiiaXub.exe
  2⤵
  PID:5020
- C:\Windows\System\JzbFwCG.exe
  C:\Windows\System\JzbFwCG.exe
  2⤵
  PID:5036
- C:\Windows\System\POvItcE.exe
  C:\Windows\System\POvItcE.exe
  2⤵
  PID:5052
- C:\Windows\System\DEYTHUZ.exe
  C:\Windows\System\DEYTHUZ.exe
  2⤵
  PID:5068
- C:\Windows\System\pixkvGa.exe
  C:\Windows\System\pixkvGa.exe
  2⤵
  PID:5084
- C:\Windows\System\popzqQs.exe
  C:\Windows\System\popzqQs.exe
  2⤵
  PID:5100
- C:\Windows\System\ySsaLJX.exe
  C:\Windows\System\ySsaLJX.exe
  2⤵
  PID:5116
- C:\Windows\System\IonVkXK.exe
  C:\Windows\System\IonVkXK.exe
  2⤵
  PID:4132
- C:\Windows\System\fcpOOrP.exe
  C:\Windows\System\fcpOOrP.exe
  2⤵
  PID:4112
- C:\Windows\System\gELFzvK.exe
  C:\Windows\System\gELFzvK.exe
  2⤵
  PID:4152
- C:\Windows\System\EPNfIOa.exe
  C:\Windows\System\EPNfIOa.exe
  2⤵
  PID:4184
- C:\Windows\System\SJqVdQL.exe
  C:\Windows\System\SJqVdQL.exe
  2⤵
  PID:4260
- C:\Windows\System\eQiNLAx.exe
  C:\Windows\System\eQiNLAx.exe
  2⤵
  PID:4296
- C:\Windows\System\CTXMSXQ.exe
  C:\Windows\System\CTXMSXQ.exe
  2⤵
  PID:4360
- C:\Windows\System\ieIBIVC.exe
  C:\Windows\System\ieIBIVC.exe
  2⤵
  PID:4312
- C:\Windows\System\MIhyytp.exe
  C:\Windows\System\MIhyytp.exe
  2⤵
  PID:4248
- C:\Windows\System\UOqLKUy.exe
  C:\Windows\System\UOqLKUy.exe
  2⤵
  PID:4404
- C:\Windows\System\ppfoFDH.exe
  C:\Windows\System\ppfoFDH.exe
  2⤵
  PID:4456
- C:\Windows\System\hJZJvPQ.exe
  C:\Windows\System\hJZJvPQ.exe
  2⤵
  PID:4516
- C:\Windows\System\lNmfyPL.exe
  C:\Windows\System\lNmfyPL.exe
  2⤵
  PID:4504
- C:\Windows\System\moGxdhK.exe
  C:\Windows\System\moGxdhK.exe
  2⤵
  PID:4520
- C:\Windows\System\AOQkiJb.exe
  C:\Windows\System\AOQkiJb.exe
  2⤵
  PID:4584
- C:\Windows\System\VkeuthO.exe
  C:\Windows\System\VkeuthO.exe
  2⤵
  PID:4568
- C:\Windows\System\iYbXCKP.exe
  C:\Windows\System\iYbXCKP.exe
  2⤵
  PID:4600
- C:\Windows\System\pWacevM.exe
  C:\Windows\System\pWacevM.exe
  2⤵
  PID:4676
- C:\Windows\System\mLHmGVw.exe
  C:\Windows\System\mLHmGVw.exe
  2⤵
  PID:4664
- C:\Windows\System\fCrlnXN.exe
  C:\Windows\System\fCrlnXN.exe
  2⤵
  PID:4724
- C:\Windows\System\VKZrnRc.exe
  C:\Windows\System\VKZrnRc.exe
  2⤵
  PID:4728
- C:\Windows\System\Hjisjfg.exe
  C:\Windows\System\Hjisjfg.exe
  2⤵
  PID:4808
- C:\Windows\System\zVFdVQn.exe
  C:\Windows\System\zVFdVQn.exe
  2⤵
  PID:4872
- C:\Windows\System\GLIDzhY.exe
  C:\Windows\System\GLIDzhY.exe
  2⤵
  PID:4760
- C:\Windows\System\DpfqfFF.exe
  C:\Windows\System\DpfqfFF.exe
  2⤵
  PID:4968
- C:\Windows\System\LTCoSxl.exe
  C:\Windows\System\LTCoSxl.exe
  2⤵
  PID:5032
- C:\Windows\System\PzFYOBh.exe
  C:\Windows\System\PzFYOBh.exe
  2⤵
  PID:4788
- C:\Windows\System\Itqvmel.exe
  C:\Windows\System\Itqvmel.exe
  2⤵
  PID:4820
- C:\Windows\System\tSfQBNF.exe
  C:\Windows\System\tSfQBNF.exe
  2⤵
  PID:4884
- C:\Windows\System\YHUlLtE.exe
  C:\Windows\System\YHUlLtE.exe
  2⤵
  PID:4952
- C:\Windows\System\xEKiIIR.exe
  C:\Windows\System\xEKiIIR.exe
  2⤵
  PID:4984
- C:\Windows\System\vTeMLNQ.exe
  C:\Windows\System\vTeMLNQ.exe
  2⤵
  PID:5080
- C:\Windows\System\UfpYFfj.exe
  C:\Windows\System\UfpYFfj.exe
  2⤵
  PID:4080
- C:\Windows\System\UclqOJx.exe
  C:\Windows\System\UclqOJx.exe
  2⤵
  PID:4164
- C:\Windows\System\zwlLGDm.exe
  C:\Windows\System\zwlLGDm.exe
  2⤵
  PID:4356
- C:\Windows\System\gibDUCY.exe
  C:\Windows\System\gibDUCY.exe
  2⤵
  PID:4452
- C:\Windows\System\vihjrIQ.exe
  C:\Windows\System\vihjrIQ.exe
  2⤵
  PID:4500
- C:\Windows\System\MfqbAXE.exe
  C:\Windows\System\MfqbAXE.exe
  2⤵
  PID:4292
- C:\Windows\System\rYFYjuF.exe
  C:\Windows\System\rYFYjuF.exe
  2⤵
  PID:4340
- C:\Windows\System\IJawJuw.exe
  C:\Windows\System\IJawJuw.exe
  2⤵
  PID:4436
- C:\Windows\System\PBTbRsE.exe
  C:\Windows\System\PBTbRsE.exe
  2⤵
  PID:4616
- C:\Windows\System\dMLfbjz.exe
  C:\Windows\System\dMLfbjz.exe
  2⤵
  PID:4744
- C:\Windows\System\kzJnsow.exe
  C:\Windows\System\kzJnsow.exe
  2⤵
  PID:4804
- C:\Windows\System\DOkFnbq.exe
  C:\Windows\System\DOkFnbq.exe
  2⤵
  PID:4644
- C:\Windows\System\ytNfwOI.exe
  C:\Windows\System\ytNfwOI.exe
  2⤵
  PID:4964
- C:\Windows\System\Vyfyovs.exe
  C:\Windows\System\Vyfyovs.exe
  2⤵
  PID:4852
- C:\Windows\System\ZcogpZp.exe
  C:\Windows\System\ZcogpZp.exe
  2⤵
  PID:4792
- C:\Windows\System\KrYMpzS.exe
  C:\Windows\System\KrYMpzS.exe
  2⤵
  PID:5012
- C:\Windows\System\OfolFeZ.exe
  C:\Windows\System\OfolFeZ.exe
  2⤵
  PID:5076
- C:\Windows\System\VPtzCCj.exe
  C:\Windows\System\VPtzCCj.exe
  2⤵
  PID:4328
- C:\Windows\System\XRbvwyD.exe
  C:\Windows\System\XRbvwyD.exe
  2⤵
  PID:4244
- C:\Windows\System\XpKuvTC.exe
  C:\Windows\System\XpKuvTC.exe
  2⤵
  PID:4280
- C:\Windows\System\izfFNgG.exe
  C:\Windows\System\izfFNgG.exe
  2⤵
  PID:4488
- C:\Windows\System\VCUhZQP.exe
  C:\Windows\System\VCUhZQP.exe
  2⤵
  PID:4632
- C:\Windows\System\wdNYaxl.exe
  C:\Windows\System\wdNYaxl.exe
  2⤵
  PID:4756
- C:\Windows\System\EaVwcdo.exe
  C:\Windows\System\EaVwcdo.exe
  2⤵
  PID:5064
- C:\Windows\System\lySTZRo.exe
  C:\Windows\System\lySTZRo.exe
  2⤵
  PID:4472
- C:\Windows\System\aHhjZOm.exe
  C:\Windows\System\aHhjZOm.exe
  2⤵
  PID:4552
- C:\Windows\System\xDKixgf.exe
  C:\Windows\System\xDKixgf.exe
  2⤵
  PID:4148
- C:\Windows\System\XGZyMOo.exe
  C:\Windows\System\XGZyMOo.exe
  2⤵
  PID:4740
- C:\Windows\System\vNhYURR.exe
  C:\Windows\System\vNhYURR.exe
  2⤵
  PID:4536
- C:\Windows\System\TfDYXFv.exe
  C:\Windows\System\TfDYXFv.exe
  2⤵
  PID:4392
- C:\Windows\System\tmEyztD.exe
  C:\Windows\System\tmEyztD.exe
  2⤵
  PID:4936
- C:\Windows\System\wIQJEvR.exe
  C:\Windows\System\wIQJEvR.exe
  2⤵
  PID:5132
- C:\Windows\System\OwnqeQs.exe
  C:\Windows\System\OwnqeQs.exe
  2⤵
  PID:5148
- C:\Windows\System\szcBmZf.exe
  C:\Windows\System\szcBmZf.exe
  2⤵
  PID:5164
- C:\Windows\System\CLZnuXE.exe
  C:\Windows\System\CLZnuXE.exe
  2⤵
  PID:5180
- C:\Windows\System\zNyzXdw.exe
  C:\Windows\System\zNyzXdw.exe
  2⤵
  PID:5196
- C:\Windows\System\hhcTaHJ.exe
  C:\Windows\System\hhcTaHJ.exe
  2⤵
  PID:5212
- C:\Windows\System\knLobTk.exe
  C:\Windows\System\knLobTk.exe
  2⤵
  PID:5228
- C:\Windows\System\frKBAcm.exe
  C:\Windows\System\frKBAcm.exe
  2⤵
  PID:5244
- C:\Windows\System\oyPBCxk.exe
  C:\Windows\System\oyPBCxk.exe
  2⤵
  PID:5260
- C:\Windows\System\OUEFBqE.exe
  C:\Windows\System\OUEFBqE.exe
  2⤵
  PID:5276
- C:\Windows\System\zbFPJWp.exe
  C:\Windows\System\zbFPJWp.exe
  2⤵
  PID:5292
- C:\Windows\System\oMsulWP.exe
  C:\Windows\System\oMsulWP.exe
  2⤵
  PID:5308
- C:\Windows\System\zCgmdIC.exe
  C:\Windows\System\zCgmdIC.exe
  2⤵
  PID:5324
- C:\Windows\System\ycwTIgC.exe
  C:\Windows\System\ycwTIgC.exe
  2⤵
  PID:5340
- C:\Windows\System\uBdDLZF.exe
  C:\Windows\System\uBdDLZF.exe
  2⤵
  PID:5356
- C:\Windows\System\XWyPvuy.exe
  C:\Windows\System\XWyPvuy.exe
  2⤵
  PID:5372
- C:\Windows\System\BdsnMtj.exe
  C:\Windows\System\BdsnMtj.exe
  2⤵
  PID:5392
- C:\Windows\System\QySxGBU.exe
  C:\Windows\System\QySxGBU.exe
  2⤵
  PID:5408
- C:\Windows\System\bbFvkhN.exe
  C:\Windows\System\bbFvkhN.exe
  2⤵
  PID:5424
- C:\Windows\System\aEKxzew.exe
  C:\Windows\System\aEKxzew.exe
  2⤵
  PID:5440
- C:\Windows\System\QfMkUtw.exe
  C:\Windows\System\QfMkUtw.exe
  2⤵
  PID:5456
- C:\Windows\System\CkspGVf.exe
  C:\Windows\System\CkspGVf.exe
  2⤵
  PID:5472
- C:\Windows\System\HjdOOlR.exe
  C:\Windows\System\HjdOOlR.exe
  2⤵
  PID:5488
- C:\Windows\System\mhOqmYg.exe
  C:\Windows\System\mhOqmYg.exe
  2⤵
  PID:5504
- C:\Windows\System\vhXYThg.exe
  C:\Windows\System\vhXYThg.exe
  2⤵
  PID:5520
- C:\Windows\System\qFrbHYV.exe
  C:\Windows\System\qFrbHYV.exe
  2⤵
  PID:5536
- C:\Windows\System\VaeggEV.exe
  C:\Windows\System\VaeggEV.exe
  2⤵
  PID:5552
- C:\Windows\System\znuawVd.exe
  C:\Windows\System\znuawVd.exe
  2⤵
  PID:5568
- C:\Windows\System\yUNpVBT.exe
  C:\Windows\System\yUNpVBT.exe
  2⤵
  PID:5584
- C:\Windows\System\JpfmXQw.exe
  C:\Windows\System\JpfmXQw.exe
  2⤵
  PID:5600
- C:\Windows\System\jqeAFuG.exe
  C:\Windows\System\jqeAFuG.exe
  2⤵
  PID:5616
- C:\Windows\System\JYRnvrN.exe
  C:\Windows\System\JYRnvrN.exe
  2⤵
  PID:5632
- C:\Windows\System\tNZcpZy.exe
  C:\Windows\System\tNZcpZy.exe
  2⤵
  PID:5648
- C:\Windows\System\wamBDqH.exe
  C:\Windows\System\wamBDqH.exe
  2⤵
  PID:5664
- C:\Windows\System\BsSybMV.exe
  C:\Windows\System\BsSybMV.exe
  2⤵
  PID:5680
- C:\Windows\System\TZzZoeC.exe
  C:\Windows\System\TZzZoeC.exe
  2⤵
  PID:5700
- C:\Windows\System\oVfGBfR.exe
  C:\Windows\System\oVfGBfR.exe
  2⤵
  PID:5716
- C:\Windows\System\EZrgumX.exe
  C:\Windows\System\EZrgumX.exe
  2⤵
  PID:5732
- C:\Windows\System\MuJrEHJ.exe
  C:\Windows\System\MuJrEHJ.exe
  2⤵
  PID:5748
- C:\Windows\System\KvKqxLy.exe
  C:\Windows\System\KvKqxLy.exe
  2⤵
  PID:5764
- C:\Windows\System\MvxbBFs.exe
  C:\Windows\System\MvxbBFs.exe
  2⤵
  PID:5780
- C:\Windows\System\RaZkNoQ.exe
  C:\Windows\System\RaZkNoQ.exe
  2⤵
  PID:5796
- C:\Windows\System\eDOWBtH.exe
  C:\Windows\System\eDOWBtH.exe
  2⤵
  PID:5812
- C:\Windows\System\qfkqlBr.exe
  C:\Windows\System\qfkqlBr.exe
  2⤵
  PID:5828
- C:\Windows\System\cqJWxYq.exe
  C:\Windows\System\cqJWxYq.exe
  2⤵
  PID:5844
- C:\Windows\System\HVYAzIL.exe
  C:\Windows\System\HVYAzIL.exe
  2⤵
  PID:5860
- C:\Windows\System\NcVbMrr.exe
  C:\Windows\System\NcVbMrr.exe
  2⤵
  PID:5876
- C:\Windows\System\USxlshc.exe
  C:\Windows\System\USxlshc.exe
  2⤵
  PID:5892
- C:\Windows\System\TZxCmha.exe
  C:\Windows\System\TZxCmha.exe
  2⤵
  PID:5908
- C:\Windows\System\nJlkkeB.exe
  C:\Windows\System\nJlkkeB.exe
  2⤵
  PID:5924
- C:\Windows\System\PNDvgNk.exe
  C:\Windows\System\PNDvgNk.exe
  2⤵
  PID:5940
- C:\Windows\System\FZKeAWB.exe
  C:\Windows\System\FZKeAWB.exe
  2⤵
  PID:5956
- C:\Windows\System\NACXmnt.exe
  C:\Windows\System\NACXmnt.exe
  2⤵
  PID:5972
- C:\Windows\System\dQPnzXP.exe
  C:\Windows\System\dQPnzXP.exe
  2⤵
  PID:5988
- C:\Windows\System\UZlrorT.exe
  C:\Windows\System\UZlrorT.exe
  2⤵
  PID:6004
- C:\Windows\System\xtwpouo.exe
  C:\Windows\System\xtwpouo.exe
  2⤵
  PID:5512
- C:\Windows\System\aCxXLJp.exe
  C:\Windows\System\aCxXLJp.exe
  2⤵
  PID:5580
- C:\Windows\System\pXtaIDR.exe
  C:\Windows\System\pXtaIDR.exe
  2⤵
  PID:5628
- C:\Windows\System\OpBquoX.exe
  C:\Windows\System\OpBquoX.exe
  2⤵
  PID:5612
- C:\Windows\System\lYtIbBP.exe
  C:\Windows\System\lYtIbBP.exe
  2⤵
  PID:5692
- C:\Windows\System\dxlwXBZ.exe
  C:\Windows\System\dxlwXBZ.exe
  2⤵
  PID:5728
- C:\Windows\System\WIfyPha.exe
  C:\Windows\System\WIfyPha.exe
  2⤵
  PID:5760
- C:\Windows\System\XUEpbhW.exe
  C:\Windows\System\XUEpbhW.exe
  2⤵
  PID:5712
- C:\Windows\System\icpJEHw.exe
  C:\Windows\System\icpJEHw.exe
  2⤵
  PID:5824
- C:\Windows\System\NLRqWRW.exe
  C:\Windows\System\NLRqWRW.exe
  2⤵
  PID:5836
- C:\Windows\System\VqBQUnC.exe
  C:\Windows\System\VqBQUnC.exe
  2⤵
  PID:5980
- C:\Windows\System\NgDGAqC.exe
  C:\Windows\System\NgDGAqC.exe
  2⤵
  PID:6048
- C:\Windows\System\PnvgeyG.exe
  C:\Windows\System\PnvgeyG.exe
  2⤵
  PID:6108
- C:\Windows\System\ABaEuRl.exe
  C:\Windows\System\ABaEuRl.exe
  2⤵
  PID:5140
- C:\Windows\System\bqPzAhm.exe
  C:\Windows\System\bqPzAhm.exe
  2⤵
  PID:5124
- C:\Windows\System\bpfTHAA.exe
  C:\Windows\System\bpfTHAA.exe
  2⤵
  PID:5224
- C:\Windows\System\pVRbCva.exe
  C:\Windows\System\pVRbCva.exe
  2⤵
  PID:5208
- C:\Windows\System\bPqbVzK.exe
  C:\Windows\System\bPqbVzK.exe
  2⤵
  PID:5272
- C:\Windows\System\VbqrPkw.exe
  C:\Windows\System\VbqrPkw.exe
  2⤵
  PID:5252
- C:\Windows\System\udocSAq.exe
  C:\Windows\System\udocSAq.exe
  2⤵
  PID:5368
- C:\Windows\System\LYBKLJR.exe
  C:\Windows\System\LYBKLJR.exe
  2⤵
  PID:5352
- C:\Windows\System\fqOMDDU.exe
  C:\Windows\System\fqOMDDU.exe
  2⤵
  PID:5400
- C:\Windows\System\CYyZUkh.exe
  C:\Windows\System\CYyZUkh.exe
  2⤵
  PID:5436
- C:\Windows\System\bNriRgk.exe
  C:\Windows\System\bNriRgk.exe
  2⤵
  PID:5448
- C:\Windows\System\zKKqQAd.exe
  C:\Windows\System\zKKqQAd.exe
  2⤵
  PID:5480
- C:\Windows\System\yPDhudP.exe
  C:\Windows\System\yPDhudP.exe
  2⤵
  PID:5544
- C:\Windows\System\DwQcYBf.exe
  C:\Windows\System\DwQcYBf.exe
  2⤵
  PID:5548
- C:\Windows\System\tRdLXdc.exe
  C:\Windows\System\tRdLXdc.exe
  2⤵
  PID:5688
- C:\Windows\System\dayyOiv.exe
  C:\Windows\System\dayyOiv.exe
  2⤵
  PID:5756
- C:\Windows\System\aPQLsDO.exe
  C:\Windows\System\aPQLsDO.exe
  2⤵
  PID:5744
- C:\Windows\System\aMgKTwa.exe
  C:\Windows\System\aMgKTwa.exe
  2⤵
  PID:5856
- C:\Windows\System\wlzkNNz.exe
  C:\Windows\System\wlzkNNz.exe
  2⤵
  PID:5888
- C:\Windows\System\esCSfeR.exe
  C:\Windows\System\esCSfeR.exe
  2⤵
  PID:5904
- C:\Windows\System\HYwSMQn.exe
  C:\Windows\System\HYwSMQn.exe
  2⤵
  PID:5920
- C:\Windows\System\ublcbpP.exe
  C:\Windows\System\ublcbpP.exe
  2⤵
  PID:5968
- C:\Windows\System\uWjSTKA.exe
  C:\Windows\System\uWjSTKA.exe
  2⤵
  PID:6028
- C:\Windows\System\LNHCXPs.exe
  C:\Windows\System\LNHCXPs.exe
  2⤵
  PID:6036
- C:\Windows\System\TbTjgcJ.exe
  C:\Windows\System\TbTjgcJ.exe
  2⤵
  PID:6060
- C:\Windows\System\UIvZreF.exe
  C:\Windows\System\UIvZreF.exe
  2⤵
  PID:6084
- C:\Windows\System\skqPTkJ.exe
  C:\Windows\System\skqPTkJ.exe
  2⤵
  PID:6096
- C:\Windows\System\HDOcSMu.exe
  C:\Windows\System\HDOcSMu.exe
  2⤵
  PID:6112
- C:\Windows\System\GlQDPUu.exe
  C:\Windows\System\GlQDPUu.exe
  2⤵
  PID:4920
- C:\Windows\System\GwqfNRg.exe
  C:\Windows\System\GwqfNRg.exe
  2⤵
  PID:4100
- C:\Windows\System\mNotySX.exe
  C:\Windows\System\mNotySX.exe
  2⤵
  PID:5304
- C:\Windows\System\KEaNLpY.exe
  C:\Windows\System\KEaNLpY.exe
  2⤵
  PID:5188
- C:\Windows\System\qnyJVmM.exe
  C:\Windows\System\qnyJVmM.exe
  2⤵
  PID:5288
- C:\Windows\System\oBOzbwy.exe
  C:\Windows\System\oBOzbwy.exe
  2⤵
  PID:5404
- C:\Windows\System\yzCSEAn.exe
  C:\Windows\System\yzCSEAn.exe
  2⤵
  PID:5496
- C:\Windows\System\zNmvrCU.exe
  C:\Windows\System\zNmvrCU.exe
  2⤵
  PID:5564
- C:\Windows\System\MOhJvzD.exe
  C:\Windows\System\MOhJvzD.exe
  2⤵
  PID:6020
- C:\Windows\System\VDvkZZF.exe
  C:\Windows\System\VDvkZZF.exe
  2⤵
  PID:5792
- C:\Windows\System\zAmixGZ.exe
  C:\Windows\System\zAmixGZ.exe
  2⤵
  PID:5932
- C:\Windows\System\JMUnPBR.exe
  C:\Windows\System\JMUnPBR.exe
  2⤵
  PID:6040
- C:\Windows\System\vRQDanf.exe
  C:\Windows\System\vRQDanf.exe
  2⤵
  PID:6072
- C:\Windows\System\LZdDgGp.exe
  C:\Windows\System\LZdDgGp.exe
  2⤵
  PID:5740
- C:\Windows\System\DSOoEfP.exe
  C:\Windows\System\DSOoEfP.exe
  2⤵
  PID:5804
- C:\Windows\System\BGhmSCk.exe
  C:\Windows\System\BGhmSCk.exe
  2⤵
  PID:6128
- C:\Windows\System\rEmhsmN.exe
  C:\Windows\System\rEmhsmN.exe
  2⤵
  PID:6124
- C:\Windows\System\VaEyfSO.exe
  C:\Windows\System\VaEyfSO.exe
  2⤵
  PID:5332
- C:\Windows\System\QLEkRXb.exe
  C:\Windows\System\QLEkRXb.exe
  2⤵
  PID:5380
- C:\Windows\System\Odieepu.exe
  C:\Windows\System\Odieepu.exe
  2⤵
  PID:5432
- C:\Windows\System\QGCQsIA.exe
  C:\Windows\System\QGCQsIA.exe
  2⤵
  PID:5676
- C:\Windows\System\PqTTSeL.exe
  C:\Windows\System\PqTTSeL.exe
  2⤵
  PID:5484
- C:\Windows\System\YPYZOIH.exe
  C:\Windows\System\YPYZOIH.exe
  2⤵
  PID:6068
- C:\Windows\System\IkZxsgo.exe
  C:\Windows\System\IkZxsgo.exe
  2⤵
  PID:5948
- C:\Windows\System\EQGZHkm.exe
  C:\Windows\System\EQGZHkm.exe
  2⤵
  PID:6104
- C:\Windows\System\WULxVue.exe
  C:\Windows\System\WULxVue.exe
  2⤵
  PID:5160
- C:\Windows\System\cHyQEOP.exe
  C:\Windows\System\cHyQEOP.exe
  2⤵
  PID:5660
- C:\Windows\System\FSNdvNq.exe
  C:\Windows\System\FSNdvNq.exe
  2⤵
  PID:6044
- C:\Windows\System\IbMytty.exe
  C:\Windows\System\IbMytty.exe
  2⤵
  PID:5268
- C:\Windows\System\dISbfJr.exe
  C:\Windows\System\dISbfJr.exe
  2⤵
  PID:6012
- C:\Windows\System\lnwtrtt.exe
  C:\Windows\System\lnwtrtt.exe
  2⤵
  PID:5420
- C:\Windows\System\wYSQwSl.exe
  C:\Windows\System\wYSQwSl.exe
  2⤵
  PID:6152
- C:\Windows\System\ynWGtma.exe
  C:\Windows\System\ynWGtma.exe
  2⤵
  PID:6168
- C:\Windows\System\qIKVOjl.exe
  C:\Windows\System\qIKVOjl.exe
  2⤵
  PID:6184
- C:\Windows\System\KSzBIKA.exe
  C:\Windows\System\KSzBIKA.exe
  2⤵
  PID:6200
- C:\Windows\System\EcqrgtG.exe
  C:\Windows\System\EcqrgtG.exe
  2⤵
  PID:6216
- C:\Windows\System\zZAKIOg.exe
  C:\Windows\System\zZAKIOg.exe
  2⤵
  PID:6232
- C:\Windows\System\tJWGgSW.exe
  C:\Windows\System\tJWGgSW.exe
  2⤵
  PID:6248
- C:\Windows\System\QtOPSWk.exe
  C:\Windows\System\QtOPSWk.exe
  2⤵
  PID:6264
- C:\Windows\System\ovOYYmd.exe
  C:\Windows\System\ovOYYmd.exe
  2⤵
  PID:6280
- C:\Windows\System\NZFzhpa.exe
  C:\Windows\System\NZFzhpa.exe
  2⤵
  PID:6296
- C:\Windows\System\KdruIjR.exe
  C:\Windows\System\KdruIjR.exe
  2⤵
  PID:6312
- C:\Windows\System\Zcwwwcp.exe
  C:\Windows\System\Zcwwwcp.exe
  2⤵
  PID:6328
- C:\Windows\System\ZGPJiXm.exe
  C:\Windows\System\ZGPJiXm.exe
  2⤵
  PID:6348
- C:\Windows\System\FVXVEmo.exe
  C:\Windows\System\FVXVEmo.exe
  2⤵
  PID:6364
- C:\Windows\System\ttBWiTe.exe
  C:\Windows\System\ttBWiTe.exe
  2⤵
  PID:6380
- C:\Windows\System\OknsyjQ.exe
  C:\Windows\System\OknsyjQ.exe
  2⤵
  PID:6396
- C:\Windows\System\dEdGAbB.exe
  C:\Windows\System\dEdGAbB.exe
  2⤵
  PID:6412
- C:\Windows\System\uLqqVvF.exe
  C:\Windows\System\uLqqVvF.exe
  2⤵
  PID:6428
- C:\Windows\System\JVQzfCa.exe
  C:\Windows\System\JVQzfCa.exe
  2⤵
  PID:6444
- C:\Windows\System\CYdOBhH.exe
  C:\Windows\System\CYdOBhH.exe
  2⤵
  PID:6460
- C:\Windows\System\wyqtDkh.exe
  C:\Windows\System\wyqtDkh.exe
  2⤵
  PID:6480
- C:\Windows\System\GnvmBWO.exe
  C:\Windows\System\GnvmBWO.exe
  2⤵
  PID:6496
- C:\Windows\System\CoRJhhP.exe
  C:\Windows\System\CoRJhhP.exe
  2⤵
  PID:6516
- C:\Windows\System\XTfvXui.exe
  C:\Windows\System\XTfvXui.exe
  2⤵
  PID:6536
- C:\Windows\System\wXNjcJH.exe
  C:\Windows\System\wXNjcJH.exe
  2⤵
  PID:6552
- C:\Windows\System\vpFLDHl.exe
  C:\Windows\System\vpFLDHl.exe
  2⤵
  PID:6568
- C:\Windows\System\EtykfSo.exe
  C:\Windows\System\EtykfSo.exe
  2⤵
  PID:6584
- C:\Windows\System\eQoqMYh.exe
  C:\Windows\System\eQoqMYh.exe
  2⤵
  PID:6604
- C:\Windows\System\uwGbQhm.exe
  C:\Windows\System\uwGbQhm.exe
  2⤵
  PID:6620
- C:\Windows\System\ZEANWdN.exe
  C:\Windows\System\ZEANWdN.exe
  2⤵
  PID:6636
- C:\Windows\System\KsMXgrZ.exe
  C:\Windows\System\KsMXgrZ.exe
  2⤵
  PID:6652
- C:\Windows\System\KdFBYMM.exe
  C:\Windows\System\KdFBYMM.exe
  2⤵
  PID:6668
- C:\Windows\System\yVRWMKk.exe
  C:\Windows\System\yVRWMKk.exe
  2⤵
  PID:6684
- C:\Windows\System\fKYXECN.exe
  C:\Windows\System\fKYXECN.exe
  2⤵
  PID:6704
- C:\Windows\System\iWYgOlR.exe
  C:\Windows\System\iWYgOlR.exe
  2⤵
  PID:6720
- C:\Windows\System\azqhPQE.exe
  C:\Windows\System\azqhPQE.exe
  2⤵
  PID:6736
- C:\Windows\System\NElfcKW.exe
  C:\Windows\System\NElfcKW.exe
  2⤵
  PID:6756
- C:\Windows\System\iQLNdJK.exe
  C:\Windows\System\iQLNdJK.exe
  2⤵
  PID:6772
- C:\Windows\System\samUuoa.exe
  C:\Windows\System\samUuoa.exe
  2⤵
  PID:6788
- C:\Windows\System\GAmZzqW.exe
  C:\Windows\System\GAmZzqW.exe
  2⤵
  PID:6804
- C:\Windows\System\pfQttPe.exe
  C:\Windows\System\pfQttPe.exe
  2⤵
  PID:6820
- C:\Windows\System\UHBMHps.exe
  C:\Windows\System\UHBMHps.exe
  2⤵
  PID:6840
- C:\Windows\System\zWKNdTO.exe
  C:\Windows\System\zWKNdTO.exe
  2⤵
  PID:6864
- C:\Windows\System\geqJSKK.exe
  C:\Windows\System\geqJSKK.exe
  2⤵
  PID:6888
- C:\Windows\System\jygnwlB.exe
  C:\Windows\System\jygnwlB.exe
  2⤵
  PID:6904
- C:\Windows\System\vAaVTfJ.exe
  C:\Windows\System\vAaVTfJ.exe
  2⤵
  PID:6920
- C:\Windows\System\GrOxjmN.exe
  C:\Windows\System\GrOxjmN.exe
  2⤵
  PID:6936
- C:\Windows\System\zWyUbBb.exe
  C:\Windows\System\zWyUbBb.exe
  2⤵
  PID:6952
- C:\Windows\System\cHHEFQF.exe
  C:\Windows\System\cHHEFQF.exe
  2⤵
  PID:6976
- C:\Windows\System\nMojoWj.exe
  C:\Windows\System\nMojoWj.exe
  2⤵
  PID:6992
- C:\Windows\System\avyhZUf.exe
  C:\Windows\System\avyhZUf.exe
  2⤵
  PID:7008
- C:\Windows\System\eHDsvQg.exe
  C:\Windows\System\eHDsvQg.exe
  2⤵
  PID:7024
- C:\Windows\System\vzDQVIN.exe
  C:\Windows\System\vzDQVIN.exe
  2⤵
  PID:7040
- C:\Windows\System\pLEyWGM.exe
  C:\Windows\System\pLEyWGM.exe
  2⤵
  PID:7056
- C:\Windows\System\xmQMgDe.exe
  C:\Windows\System\xmQMgDe.exe
  2⤵
  PID:7072
- C:\Windows\System\CYJUMZg.exe
  C:\Windows\System\CYJUMZg.exe
  2⤵
  PID:7088
- C:\Windows\System\lCFelbI.exe
  C:\Windows\System\lCFelbI.exe
  2⤵
  PID:7116
- C:\Windows\System\OHTNFmd.exe
  C:\Windows\System\OHTNFmd.exe
  2⤵
  PID:7136
- C:\Windows\System\JzzkXiR.exe
  C:\Windows\System\JzzkXiR.exe
  2⤵
  PID:7152
- C:\Windows\System\TgrXjDh.exe
  C:\Windows\System\TgrXjDh.exe
  2⤵
  PID:4232
- C:\Windows\System\UKysZQj.exe
  C:\Windows\System\UKysZQj.exe
  2⤵
  PID:6180
- C:\Windows\System\lEmdbyf.exe
  C:\Windows\System\lEmdbyf.exe
  2⤵
  PID:6212
- C:\Windows\System\fZtSRnC.exe
  C:\Windows\System\fZtSRnC.exe
  2⤵
  PID:6244
- C:\Windows\System\wRKmeDw.exe
  C:\Windows\System\wRKmeDw.exe
  2⤵
  PID:6288
- C:\Windows\System\NEpkwGm.exe
  C:\Windows\System\NEpkwGm.exe
  2⤵
  PID:6356
- C:\Windows\System\DUYjXNw.exe
  C:\Windows\System\DUYjXNw.exe
  2⤵
  PID:6436
- C:\Windows\System\hVlLnwB.exe
  C:\Windows\System\hVlLnwB.exe
  2⤵
  PID:6456
- C:\Windows\System\Ktkfqhw.exe
  C:\Windows\System\Ktkfqhw.exe
  2⤵
  PID:6508
- C:\Windows\System\VKiwcGk.exe
  C:\Windows\System\VKiwcGk.exe
  2⤵
  PID:6548
- C:\Windows\System\TktPycj.exe
  C:\Windows\System\TktPycj.exe
  2⤵
  PID:6580
- C:\Windows\System\DsayxaE.exe
  C:\Windows\System\DsayxaE.exe
  2⤵
  PID:6532
- C:\Windows\System\KKTSVFx.exe
  C:\Windows\System\KKTSVFx.exe
  2⤵
  PID:6560
- C:\Windows\System\tAJaZrG.exe
  C:\Windows\System\tAJaZrG.exe
  2⤵
  PID:6648
- C:\Windows\System\KQeWrWV.exe
  C:\Windows\System\KQeWrWV.exe
  2⤵
  PID:6680
- C:\Windows\System\IGqZKji.exe
  C:\Windows\System\IGqZKji.exe
  2⤵
  PID:6748
- C:\Windows\System\cccCAkQ.exe
  C:\Windows\System\cccCAkQ.exe
  2⤵
  PID:6696
- C:\Windows\System\LUOBoEm.exe
  C:\Windows\System\LUOBoEm.exe
  2⤵
  PID:6784
- C:\Windows\System\MLKDpDv.exe
  C:\Windows\System\MLKDpDv.exe
  2⤵
  PID:6852
- C:\Windows\System\ZXQkaay.exe
  C:\Windows\System\ZXQkaay.exe
  2⤵
  PID:6800
- C:\Windows\System\yGKfbDV.exe
  C:\Windows\System\yGKfbDV.exe
  2⤵
  PID:6832
- C:\Windows\System\dCHZoAC.exe
  C:\Windows\System\dCHZoAC.exe
  2⤵
  PID:6960
- C:\Windows\System\ynrNVJe.exe
  C:\Windows\System\ynrNVJe.exe
  2⤵
  PID:6968
- C:\Windows\System\kMANlcO.exe
  C:\Windows\System\kMANlcO.exe
  2⤵
  PID:6948
- C:\Windows\System\rAuLngT.exe
  C:\Windows\System\rAuLngT.exe
  2⤵
  PID:7036
- C:\Windows\System\XejzFHF.exe
  C:\Windows\System\XejzFHF.exe
  2⤵
  PID:7068
- C:\Windows\System\sqxuQuS.exe
  C:\Windows\System\sqxuQuS.exe
  2⤵
  PID:7100
- C:\Windows\System\Oaiapqj.exe
  C:\Windows\System\Oaiapqj.exe
  2⤵
  PID:7144
- C:\Windows\System\UcONtUN.exe
  C:\Windows\System\UcONtUN.exe
  2⤵
  PID:7148
- C:\Windows\System\UJmEkRq.exe
  C:\Windows\System\UJmEkRq.exe
  2⤵
  PID:6240
- C:\Windows\System\SSSWkth.exe
  C:\Windows\System\SSSWkth.exe
  2⤵
  PID:6292
- C:\Windows\System\AyGKaFr.exe
  C:\Windows\System\AyGKaFr.exe
  2⤵
  PID:6260
- C:\Windows\System\vCdNyAF.exe
  C:\Windows\System\vCdNyAF.exe
  2⤵
  PID:6272
- C:\Windows\System\JMhrrhL.exe
  C:\Windows\System\JMhrrhL.exe
  2⤵
  PID:6392
- C:\Windows\System\oBrEojR.exe
  C:\Windows\System\oBrEojR.exe
  2⤵
  PID:6420
- C:\Windows\System\dySTrbD.exe
  C:\Windows\System\dySTrbD.exe
  2⤵
  PID:6528
- C:\Windows\System\eVzIZYs.exe
  C:\Windows\System\eVzIZYs.exe
  2⤵
  PID:6744
- C:\Windows\System\XCsXGwi.exe
  C:\Windows\System\XCsXGwi.exe
  2⤵
  PID:6504
- C:\Windows\System\wfwdarK.exe
  C:\Windows\System\wfwdarK.exe
  2⤵
  PID:6676
- C:\Windows\System\TitWjXT.exe
  C:\Windows\System\TitWjXT.exe
  2⤵
  PID:6732
- C:\Windows\System\WvVbBBL.exe
  C:\Windows\System\WvVbBBL.exe
  2⤵
  PID:6884
- C:\Windows\System\Ykdbfru.exe
  C:\Windows\System\Ykdbfru.exe
  2⤵
  PID:6932
- C:\Windows\System\zRbIZqK.exe
  C:\Windows\System\zRbIZqK.exe
  2⤵
  PID:7052
- C:\Windows\System\DAqTasO.exe
  C:\Windows\System\DAqTasO.exe
  2⤵
  PID:6988
- C:\Windows\System\HjVNNBV.exe
  C:\Windows\System\HjVNNBV.exe
  2⤵
  PID:7108
- C:\Windows\System\dbFniUR.exe
  C:\Windows\System\dbFniUR.exe
  2⤵
  PID:7164
- C:\Windows\System\XYltMVI.exe
  C:\Windows\System\XYltMVI.exe
  2⤵
  PID:6196
- C:\Windows\System\ydleYlX.exe
  C:\Windows\System\ydleYlX.exe
  2⤵
  PID:6320
- C:\Windows\System\goPuICa.exe
  C:\Windows\System\goPuICa.exe
  2⤵
  PID:6512
- C:\Windows\System\NBdkmXE.exe
  C:\Windows\System\NBdkmXE.exe
  2⤵
  PID:6728
- C:\Windows\System\ZBbGoQf.exe
  C:\Windows\System\ZBbGoQf.exe
  2⤵
  PID:6836
- C:\Windows\System\xOckLyw.exe
  C:\Windows\System\xOckLyw.exe
  2⤵
  PID:7032
- C:\Windows\System\UyMVewk.exe
  C:\Windows\System\UyMVewk.exe
  2⤵
  PID:7160
- C:\Windows\System\BqoFOvO.exe
  C:\Windows\System\BqoFOvO.exe
  2⤵
  PID:7084
- C:\Windows\System\SxmLRBz.exe
  C:\Windows\System\SxmLRBz.exe
  2⤵
  PID:6344
- C:\Windows\System\TeiMrfp.exe
  C:\Windows\System\TeiMrfp.exe
  2⤵
  PID:6360
- C:\Windows\System\rEGCjJc.exe
  C:\Windows\System\rEGCjJc.exe
  2⤵
  PID:6612
- C:\Windows\System\wWQBWJK.exe
  C:\Windows\System\wWQBWJK.exe
  2⤵
  PID:6632
- C:\Windows\System\PXdrLBV.exe
  C:\Windows\System\PXdrLBV.exe
  2⤵
  PID:6860
- C:\Windows\System\qGSYCbv.exe
  C:\Windows\System\qGSYCbv.exe
  2⤵
  PID:6896
- C:\Windows\System\GVeCKgp.exe
  C:\Windows\System\GVeCKgp.exe
  2⤵
  PID:7020
- C:\Windows\System\DXQPRMh.exe
  C:\Windows\System\DXQPRMh.exe
  2⤵
  PID:6160
- C:\Windows\System\TSRXsDX.exe
  C:\Windows\System\TSRXsDX.exe
  2⤵
  PID:6544
- C:\Windows\System\uFbfsjI.exe
  C:\Windows\System\uFbfsjI.exe
  2⤵
  PID:6816
- C:\Windows\System\BJhEIfj.exe
  C:\Windows\System\BJhEIfj.exe
  2⤵
  PID:7004
- C:\Windows\System\CmblZii.exe
  C:\Windows\System\CmblZii.exe
  2⤵
  PID:6916
- C:\Windows\System\bEOXlEy.exe
  C:\Windows\System\bEOXlEy.exe
  2⤵
  PID:6276
- C:\Windows\System\GTxftFM.exe
  C:\Windows\System\GTxftFM.exe
  2⤵
  PID:6032
- C:\Windows\System\IrrDJqo.exe
  C:\Windows\System\IrrDJqo.exe
  2⤵
  PID:7184
- C:\Windows\System\mHSMwQt.exe
  C:\Windows\System\mHSMwQt.exe
  2⤵
  PID:7248
- C:\Windows\System\gfXSRMx.exe
  C:\Windows\System\gfXSRMx.exe
  2⤵
  PID:7264
- C:\Windows\System\lFAFgeZ.exe
  C:\Windows\System\lFAFgeZ.exe
  2⤵
  PID:7280
- C:\Windows\System\iBZmVHD.exe
  C:\Windows\System\iBZmVHD.exe
  2⤵
  PID:7296
- C:\Windows\System\yKXrdeW.exe
  C:\Windows\System\yKXrdeW.exe
  2⤵
  PID:7316
- C:\Windows\System\xSkUnLS.exe
  C:\Windows\System\xSkUnLS.exe
  2⤵
  PID:7332
- C:\Windows\System\ktjUYZZ.exe
  C:\Windows\System\ktjUYZZ.exe
  2⤵
  PID:7352
- C:\Windows\System\yxneABf.exe
  C:\Windows\System\yxneABf.exe
  2⤵
  PID:7372
- C:\Windows\System\wEbIGBz.exe
  C:\Windows\System\wEbIGBz.exe
  2⤵
  PID:7400
- C:\Windows\System\rcvOPyi.exe
  C:\Windows\System\rcvOPyi.exe
  2⤵
  PID:7416
- C:\Windows\System\YKcBjVM.exe
  C:\Windows\System\YKcBjVM.exe
  2⤵
  PID:7432
- C:\Windows\System\OKOGijw.exe
  C:\Windows\System\OKOGijw.exe
  2⤵
  PID:7448
- C:\Windows\System\hkpAOIY.exe
  C:\Windows\System\hkpAOIY.exe
  2⤵
  PID:7464
- C:\Windows\System\wAsghgk.exe
  C:\Windows\System\wAsghgk.exe
  2⤵
  PID:7480
- C:\Windows\System\Mngwjfs.exe
  C:\Windows\System\Mngwjfs.exe
  2⤵
  PID:7496
- C:\Windows\System\NjbGgUy.exe
  C:\Windows\System\NjbGgUy.exe
  2⤵
  PID:7516
- C:\Windows\System\mSztYKA.exe
  C:\Windows\System\mSztYKA.exe
  2⤵
  PID:7532
- C:\Windows\System\RpfWQlB.exe
  C:\Windows\System\RpfWQlB.exe
  2⤵
  PID:7548
- C:\Windows\System\oDScLMG.exe
  C:\Windows\System\oDScLMG.exe
  2⤵
  PID:7564
- C:\Windows\System\IZoOUCz.exe
  C:\Windows\System\IZoOUCz.exe
  2⤵
  PID:7584
- C:\Windows\System\hQhGBgw.exe
  C:\Windows\System\hQhGBgw.exe
  2⤵
  PID:7600
- C:\Windows\System\TfJxAcT.exe
  C:\Windows\System\TfJxAcT.exe
  2⤵
  PID:7620
- C:\Windows\System\JdwVneh.exe
  C:\Windows\System\JdwVneh.exe
  2⤵
  PID:7640
- C:\Windows\System\LMEAmcc.exe
  C:\Windows\System\LMEAmcc.exe
  2⤵
  PID:7660
- C:\Windows\System\BKKgYSV.exe
  C:\Windows\System\BKKgYSV.exe
  2⤵
  PID:7680
- C:\Windows\System\ZocXKxI.exe
  C:\Windows\System\ZocXKxI.exe
  2⤵
  PID:7696
- C:\Windows\System\uqxbJJG.exe
  C:\Windows\System\uqxbJJG.exe
  2⤵
  PID:7772
- C:\Windows\System\emkFmwv.exe
  C:\Windows\System\emkFmwv.exe
  2⤵
  PID:7804
- C:\Windows\System\bdwRrJK.exe
  C:\Windows\System\bdwRrJK.exe
  2⤵
  PID:7924
- C:\Windows\System\tJYbaGx.exe
  C:\Windows\System\tJYbaGx.exe
  2⤵
  PID:7944
- C:\Windows\System\mdsxTOA.exe
  C:\Windows\System\mdsxTOA.exe
  2⤵
  PID:7960
- C:\Windows\System\DwHneqt.exe
  C:\Windows\System\DwHneqt.exe
  2⤵
  PID:7976
- C:\Windows\System\WXZpPMo.exe
  C:\Windows\System\WXZpPMo.exe
  2⤵
  PID:7992
- C:\Windows\System\geRahkj.exe
  C:\Windows\System\geRahkj.exe
  2⤵
  PID:8012
- C:\Windows\System\meFAAmu.exe
  C:\Windows\System\meFAAmu.exe
  2⤵
  PID:8084
- C:\Windows\System\CHVYtAe.exe
  C:\Windows\System\CHVYtAe.exe
  2⤵
  PID:8100
- C:\Windows\System\WGalHzg.exe
  C:\Windows\System\WGalHzg.exe
  2⤵
  PID:8116
- C:\Windows\System\pEGvYES.exe
  C:\Windows\System\pEGvYES.exe
  2⤵
  PID:8132
- C:\Windows\System\CfnNYLA.exe
  C:\Windows\System\CfnNYLA.exe
  2⤵
  PID:8148
- C:\Windows\System\WumhQaZ.exe
  C:\Windows\System\WumhQaZ.exe
  2⤵
  PID:8164
- C:\Windows\System\XLFxeCU.exe
  C:\Windows\System\XLFxeCU.exe
  2⤵
  PID:8180
- C:\Windows\System\ejbBGpL.exe
  C:\Windows\System\ejbBGpL.exe
  2⤵
  PID:6944
- C:\Windows\System\vnGoLqO.exe
  C:\Windows\System\vnGoLqO.exe
  2⤵
  PID:7180
- C:\Windows\System\AgEFRsE.exe
  C:\Windows\System\AgEFRsE.exe
  2⤵
  PID:7204
- C:\Windows\System\qpXcBFq.exe
  C:\Windows\System\qpXcBFq.exe
  2⤵
  PID:7212
- C:\Windows\System\JGiwNzq.exe
  C:\Windows\System\JGiwNzq.exe
  2⤵
  PID:7236
- C:\Windows\System\kKmtlxO.exe
  C:\Windows\System\kKmtlxO.exe
  2⤵
  PID:7260
- C:\Windows\System\PFVGJUy.exe
  C:\Windows\System\PFVGJUy.exe
  2⤵
  PID:7308
- C:\Windows\System\fQUjoDo.exe
  C:\Windows\System\fQUjoDo.exe
  2⤵
  PID:7340
- C:\Windows\System\NLimELK.exe
  C:\Windows\System\NLimELK.exe
  2⤵
  PID:7348
- C:\Windows\System\LklrUzs.exe
  C:\Windows\System\LklrUzs.exe
  2⤵
  PID:7388
- C:\Windows\System\HlSaMIv.exe
  C:\Windows\System\HlSaMIv.exe
  2⤵
  PID:7424
- C:\Windows\System\onWzNuu.exe
  C:\Windows\System\onWzNuu.exe
  2⤵
  PID:7368
- C:\Windows\System\DfIcJFS.exe
  C:\Windows\System\DfIcJFS.exe
  2⤵
  PID:7408
- C:\Windows\System\nncKbnL.exe
  C:\Windows\System\nncKbnL.exe
  2⤵
  PID:7476
- C:\Windows\System\vABJvkL.exe
  C:\Windows\System\vABJvkL.exe
  2⤵
  PID:7556
- C:\Windows\System\TchIAmK.exe
  C:\Windows\System\TchIAmK.exe
  2⤵
  PID:7540
- C:\Windows\System\gbDjxsX.exe
  C:\Windows\System\gbDjxsX.exe
  2⤵
  PID:7628
- C:\Windows\System\IrsKNqf.exe
  C:\Windows\System\IrsKNqf.exe
  2⤵
  PID:7608
- C:\Windows\System\LHQYHqv.exe
  C:\Windows\System\LHQYHqv.exe
  2⤵
  PID:7636
- C:\Windows\System\VMEMqDB.exe
  C:\Windows\System\VMEMqDB.exe
  2⤵
  PID:7668
- C:\Windows\System\rgZGSMZ.exe
  C:\Windows\System\rgZGSMZ.exe
  2⤵
  PID:7692
- C:\Windows\System\znaSOVE.exe
  C:\Windows\System\znaSOVE.exe
  2⤵
  PID:7716
- C:\Windows\System\nQHobfh.exe
  C:\Windows\System\nQHobfh.exe
  2⤵
  PID:7732
- C:\Windows\System\iNHrzWE.exe
  C:\Windows\System\iNHrzWE.exe
  2⤵
  PID:7748
- C:\Windows\System\EyyQKas.exe
  C:\Windows\System\EyyQKas.exe
  2⤵
  PID:7764
- C:\Windows\System\rdEHYJK.exe
  C:\Windows\System\rdEHYJK.exe
  2⤵
  PID:7788
- C:\Windows\System\pGXMdgU.exe
  C:\Windows\System\pGXMdgU.exe
  2⤵
  PID:7812
- C:\Windows\System\WuYsouW.exe
  C:\Windows\System\WuYsouW.exe
  2⤵
  PID:7828
- C:\Windows\System\oLaCAgj.exe
  C:\Windows\System\oLaCAgj.exe
  2⤵
  PID:7840
- C:\Windows\System\xuMRlMw.exe
  C:\Windows\System\xuMRlMw.exe
  2⤵
  PID:7860
- C:\Windows\System\QnOGKCR.exe
  C:\Windows\System\QnOGKCR.exe
  2⤵
  PID:7876
- C:\Windows\System\VoQGHAt.exe
  C:\Windows\System\VoQGHAt.exe
  2⤵
  PID:7892
- C:\Windows\System\kxMxlRq.exe
  C:\Windows\System\kxMxlRq.exe
  2⤵
  PID:7908
- C:\Windows\System\WGQcnnL.exe
  C:\Windows\System\WGQcnnL.exe
  2⤵
  PID:7932
- C:\Windows\System\fQncRJw.exe
  C:\Windows\System\fQncRJw.exe
  2⤵
  PID:7952
- C:\Windows\System\CtJUXHR.exe
  C:\Windows\System\CtJUXHR.exe
  2⤵
  PID:8000
- C:\Windows\System\DAdeOzh.exe
  C:\Windows\System\DAdeOzh.exe
  2⤵
  PID:8020
- C:\Windows\System\KPpLRwF.exe
  C:\Windows\System\KPpLRwF.exe
  2⤵
  PID:8036
- C:\Windows\System\goYxYjI.exe
  C:\Windows\System\goYxYjI.exe
  2⤵
  PID:8052
- C:\Windows\System\heKJbVW.exe
  C:\Windows\System\heKJbVW.exe
  2⤵
  PID:8072
- C:\Windows\System\cXRRAJj.exe
  C:\Windows\System\cXRRAJj.exe
  2⤵
  PID:8108
- C:\Windows\System\OdeHEUz.exe
  C:\Windows\System\OdeHEUz.exe
  2⤵
  PID:8124
- C:\Windows\System\ooqjWPB.exe
  C:\Windows\System\ooqjWPB.exe
  2⤵
  PID:8172
- C:\Windows\System\bjHUeQi.exe
  C:\Windows\System\bjHUeQi.exe
  2⤵
  PID:7224
- C:\Windows\System\skPVyjc.exe
  C:\Windows\System\skPVyjc.exe
  2⤵
  PID:7244
- C:\Windows\System\IZOqGBa.exe
  C:\Windows\System\IZOqGBa.exe
  2⤵
  PID:8160
- C:\Windows\System\fHcXTkJ.exe
  C:\Windows\System\fHcXTkJ.exe
  2⤵
  PID:7328
- C:\Windows\System\QuQVjwV.exe
  C:\Windows\System\QuQVjwV.exe
  2⤵
  PID:7276
- C:\Windows\System\UkHLCtC.exe
  C:\Windows\System\UkHLCtC.exe
  2⤵
  PID:7384
- C:\Windows\System\VpWcbaC.exe
  C:\Windows\System\VpWcbaC.exe
  2⤵
  PID:7440
- C:\Windows\System\eDbUzHA.exe
  C:\Windows\System\eDbUzHA.exe
  2⤵
  PID:7508
- C:\Windows\System\OzUiZMb.exe
  C:\Windows\System\OzUiZMb.exe
  2⤵
  PID:7528
- C:\Windows\System\ssUxHSb.exe
  C:\Windows\System\ssUxHSb.exe
  2⤵
  PID:7616
- C:\Windows\System\QlyZBkU.exe
  C:\Windows\System\QlyZBkU.exe
  2⤵
  PID:7708
- C:\Windows\System\CmyqGJi.exe
  C:\Windows\System\CmyqGJi.exe
  2⤵
  PID:7728
- C:\Windows\System\avcnIOn.exe
  C:\Windows\System\avcnIOn.exe
  2⤵
  PID:7760
- C:\Windows\System\EOzNzjl.exe
  C:\Windows\System\EOzNzjl.exe
  2⤵
  PID:7824
- C:\Windows\System\TBDSwdd.exe
  C:\Windows\System\TBDSwdd.exe
  2⤵
  PID:7884
- C:\Windows\System\NBNeCze.exe
  C:\Windows\System\NBNeCze.exe
  2⤵
  PID:7916
- C:\Windows\System\whYFdea.exe
  C:\Windows\System\whYFdea.exe
  2⤵
  PID:7872
- C:\Windows\System\NjnLfbK.exe
  C:\Windows\System\NjnLfbK.exe
  2⤵
  PID:7940
- C:\Windows\System\JnVNDpZ.exe
  C:\Windows\System\JnVNDpZ.exe
  2⤵
  PID:8028
- C:\Windows\System\zImNWQy.exe
  C:\Windows\System\zImNWQy.exe
  2⤵
  PID:8008
- C:\Windows\System\CmnXzSk.exe
  C:\Windows\System\CmnXzSk.exe
  2⤵
  PID:8044
- C:\Windows\System\ZXwjWAM.exe
  C:\Windows\System\ZXwjWAM.exe
  2⤵
  PID:7968
- C:\Windows\System\JECRdnF.exe
  C:\Windows\System\JECRdnF.exe
  2⤵
  PID:7292
- C:\Windows\System\fCKafit.exe
  C:\Windows\System\fCKafit.exe
  2⤵
  PID:7460
- C:\Windows\System\jfNObpu.exe
  C:\Windows\System\jfNObpu.exe
  2⤵
  PID:7324
- C:\Windows\System\aSYmFWp.exe
  C:\Windows\System\aSYmFWp.exe
  2⤵
  PID:7196
- C:\Windows\System\DzdVIPK.exe
  C:\Windows\System\DzdVIPK.exe
  2⤵
  PID:7576
- C:\Windows\System\YnEHHRY.exe
  C:\Windows\System\YnEHHRY.exe
  2⤵
  PID:7688
- C:\Windows\System\CByVxti.exe
  C:\Windows\System\CByVxti.exe
  2⤵
  PID:7784
- C:\Windows\System\YuhORQX.exe
  C:\Windows\System\YuhORQX.exe
  2⤵
  PID:8204
- C:\Windows\System\QSLKyYX.exe
  C:\Windows\System\QSLKyYX.exe
  2⤵
  PID:8220
- C:\Windows\System\rUOsDbw.exe
  C:\Windows\System\rUOsDbw.exe
  2⤵
  PID:8236
- C:\Windows\System\DctMheV.exe
  C:\Windows\System\DctMheV.exe
  2⤵
  PID:8252
- C:\Windows\System\JZCypCj.exe
  C:\Windows\System\JZCypCj.exe
  2⤵
  PID:8268
- C:\Windows\System\senTECV.exe
  C:\Windows\System\senTECV.exe
  2⤵
  PID:8284
- C:\Windows\System\OfmMoFe.exe
  C:\Windows\System\OfmMoFe.exe
  2⤵
  PID:8300
- C:\Windows\System\xnxtYcN.exe
  C:\Windows\System\xnxtYcN.exe
  2⤵
  PID:8316
- C:\Windows\System\wKPpwbS.exe
  C:\Windows\System\wKPpwbS.exe
  2⤵
  PID:8332
- C:\Windows\System\gkFJBBf.exe
  C:\Windows\System\gkFJBBf.exe
  2⤵
  PID:8348
- C:\Windows\System\oWTCXFt.exe
  C:\Windows\System\oWTCXFt.exe
  2⤵
  PID:8364
- C:\Windows\System\fSvmcEm.exe
  C:\Windows\System\fSvmcEm.exe
  2⤵
  PID:8380
- C:\Windows\System\tbLlbIA.exe
  C:\Windows\System\tbLlbIA.exe
  2⤵
  PID:8396
- C:\Windows\System\tbvXlFf.exe
  C:\Windows\System\tbvXlFf.exe
  2⤵
  PID:8412
- C:\Windows\System\DTdRtoL.exe
  C:\Windows\System\DTdRtoL.exe
  2⤵
  PID:8428
- C:\Windows\System\HzmniOD.exe
  C:\Windows\System\HzmniOD.exe
  2⤵
  PID:8444
- C:\Windows\System\XqqEALa.exe
  C:\Windows\System\XqqEALa.exe
  2⤵
  PID:8460
- C:\Windows\System\mzYNcKX.exe
  C:\Windows\System\mzYNcKX.exe
  2⤵
  PID:8476
- C:\Windows\System\somwYBI.exe
  C:\Windows\System\somwYBI.exe
  2⤵
  PID:8496
- C:\Windows\System\JkWbNME.exe
  C:\Windows\System\JkWbNME.exe
  2⤵
  PID:8512
- C:\Windows\System\NkrDxZk.exe
  C:\Windows\System\NkrDxZk.exe
  2⤵
  PID:8532
- C:\Windows\System\KhyQnhy.exe
  C:\Windows\System\KhyQnhy.exe
  2⤵
  PID:8552
- C:\Windows\System\zwnmkYk.exe
  C:\Windows\System\zwnmkYk.exe
  2⤵
  PID:8568
- C:\Windows\System\bCUcTUX.exe
  C:\Windows\System\bCUcTUX.exe
  2⤵
  PID:8584
- C:\Windows\System\QsTuIId.exe
  C:\Windows\System\QsTuIId.exe
  2⤵
  PID:8600
- C:\Windows\System\NUrPczy.exe
  C:\Windows\System\NUrPczy.exe
  2⤵
  PID:8616
- C:\Windows\System\BYigGum.exe
  C:\Windows\System\BYigGum.exe
  2⤵
  PID:8632
- C:\Windows\System\TDGvBlB.exe
  C:\Windows\System\TDGvBlB.exe
  2⤵
  PID:8648
- C:\Windows\System\XcUwCfT.exe
  C:\Windows\System\XcUwCfT.exe
  2⤵
  PID:8664
- C:\Windows\System\VZqcCzl.exe
  C:\Windows\System\VZqcCzl.exe
  2⤵
  PID:8680
- C:\Windows\System\eXKwMyz.exe
  C:\Windows\System\eXKwMyz.exe
  2⤵
  PID:8696
- C:\Windows\System\OFUEaIc.exe
  C:\Windows\System\OFUEaIc.exe
  2⤵
  PID:8716
- C:\Windows\System\CXXPFgw.exe
  C:\Windows\System\CXXPFgw.exe
  2⤵
  PID:8732
- C:\Windows\System\quhvhOJ.exe
  C:\Windows\System\quhvhOJ.exe
  2⤵
  PID:8748
- C:\Windows\System\IHMOyrK.exe
  C:\Windows\System\IHMOyrK.exe
  2⤵
  PID:8764
- C:\Windows\System\JuWMVsm.exe
  C:\Windows\System\JuWMVsm.exe
  2⤵
  PID:8784
- C:\Windows\System\uUtExbT.exe
  C:\Windows\System\uUtExbT.exe
  2⤵
  PID:8808
- C:\Windows\System\yGpxnIu.exe
  C:\Windows\System\yGpxnIu.exe
  2⤵
  PID:8868
- C:\Windows\System\tJDmUOC.exe
  C:\Windows\System\tJDmUOC.exe
  2⤵
  PID:8884
- C:\Windows\System\ABRXeXe.exe
  C:\Windows\System\ABRXeXe.exe
  2⤵
  PID:8900
- C:\Windows\System\alesThq.exe
  C:\Windows\System\alesThq.exe
  2⤵
  PID:8916
- C:\Windows\System\WTFqyoS.exe
  C:\Windows\System\WTFqyoS.exe
  2⤵
  PID:8932
- C:\Windows\System\ZtCJnJg.exe
  C:\Windows\System\ZtCJnJg.exe
  2⤵
  PID:8948
- C:\Windows\System\LaxwgOA.exe
  C:\Windows\System\LaxwgOA.exe
  2⤵
  PID:8964
- C:\Windows\System\dfzwHXZ.exe
  C:\Windows\System\dfzwHXZ.exe
  2⤵
  PID:8980
- C:\Windows\System\hKOcRpO.exe
  C:\Windows\System\hKOcRpO.exe
  2⤵
  PID:8996
- C:\Windows\System\PPjBqdw.exe
  C:\Windows\System\PPjBqdw.exe
  2⤵
  PID:9012
- C:\Windows\System\UZnhBMX.exe
  C:\Windows\System\UZnhBMX.exe
  2⤵
  PID:9028
- C:\Windows\System\nPFWCmn.exe
  C:\Windows\System\nPFWCmn.exe
  2⤵
  PID:9044
- C:\Windows\System\hnYgECQ.exe
  C:\Windows\System\hnYgECQ.exe
  2⤵
  PID:9060
- C:\Windows\System\QYanGNi.exe
  C:\Windows\System\QYanGNi.exe
  2⤵
  PID:9076
- C:\Windows\System\FCGzgcN.exe
  C:\Windows\System\FCGzgcN.exe
  2⤵
  PID:9092
- C:\Windows\System\zxnfyXr.exe
  C:\Windows\System\zxnfyXr.exe
  2⤵
  PID:9112
- C:\Windows\System\sVXaBaE.exe
  C:\Windows\System\sVXaBaE.exe
  2⤵
  PID:9128
- C:\Windows\System\tNxJjmn.exe
  C:\Windows\System\tNxJjmn.exe
  2⤵
  PID:9144
- C:\Windows\System\Tkfdvel.exe
  C:\Windows\System\Tkfdvel.exe
  2⤵
  PID:9160
- C:\Windows\System\fQjPsZU.exe
  C:\Windows\System\fQjPsZU.exe
  2⤵
  PID:9176
- C:\Windows\System\yMEvnhI.exe
  C:\Windows\System\yMEvnhI.exe
  2⤵
  PID:9192
- C:\Windows\System\rwtSeOU.exe
  C:\Windows\System\rwtSeOU.exe
  2⤵
  PID:9208
- C:\Windows\System\odgFKBh.exe
  C:\Windows\System\odgFKBh.exe
  2⤵
  PID:7856
- C:\Windows\System\ZNkEYeF.exe
  C:\Windows\System\ZNkEYeF.exe
  2⤵
  PID:7756
- C:\Windows\System\pCQrhQp.exe
  C:\Windows\System\pCQrhQp.exe
  2⤵
  PID:8144
- C:\Windows\System\Ckelxnv.exe
  C:\Windows\System\Ckelxnv.exe
  2⤵
  PID:7488
- C:\Windows\System\EeLvifR.exe
  C:\Windows\System\EeLvifR.exe
  2⤵
  PID:8212
- C:\Windows\System\biasTBT.exe
  C:\Windows\System\biasTBT.exe
  2⤵
  PID:8244
- C:\Windows\System\ODYNKmD.exe
  C:\Windows\System\ODYNKmD.exe
  2⤵
  PID:8196
- C:\Windows\System\jVsFPZg.exe
  C:\Windows\System\jVsFPZg.exe
  2⤵
  PID:7904
- C:\Windows\System\Pegzftn.exe
  C:\Windows\System\Pegzftn.exe
  2⤵
  PID:8064
- C:\Windows\System\ovbMyIm.exe
  C:\Windows\System\ovbMyIm.exe
  2⤵
  PID:8344
- C:\Windows\System\MKqpUAG.exe
  C:\Windows\System\MKqpUAG.exe
  2⤵
  PID:8292
- C:\Windows\System\ztqTMnV.exe
  C:\Windows\System\ztqTMnV.exe
  2⤵
  PID:8232
- C:\Windows\System\YSPyygQ.exe
  C:\Windows\System\YSPyygQ.exe
  2⤵
  PID:8328
- C:\Windows\System\gdayMOA.exe
  C:\Windows\System\gdayMOA.exe
  2⤵
  PID:8392
- C:\Windows\System\SQMNtmY.exe
  C:\Windows\System\SQMNtmY.exe
  2⤵
  PID:8424
- C:\Windows\System\VzvxVGq.exe
  C:\Windows\System\VzvxVGq.exe
  2⤵
  PID:8468
- C:\Windows\System\gyOtRER.exe
  C:\Windows\System\gyOtRER.exe
  2⤵
  PID:8508
- C:\Windows\System\IAjUYGw.exe
  C:\Windows\System\IAjUYGw.exe
  2⤵
  PID:8492
- C:\Windows\System\WZsqdcx.exe
  C:\Windows\System\WZsqdcx.exe
  2⤵
  PID:8576
- C:\Windows\System\wuNGjOl.exe
  C:\Windows\System\wuNGjOl.exe
  2⤵
  PID:8640
- C:\Windows\System\OTDzdrj.exe
  C:\Windows\System\OTDzdrj.exe
  2⤵
  PID:8672
- C:\Windows\System\jgTqQwz.exe
  C:\Windows\System\jgTqQwz.exe
  2⤵
  PID:8692
- C:\Windows\System\rciMMPp.exe
  C:\Windows\System\rciMMPp.exe
  2⤵
  PID:8560
- C:\Windows\System\fwNtckv.exe
  C:\Windows\System\fwNtckv.exe
  2⤵
  PID:8744
- C:\Windows\System\gfYxved.exe
  C:\Windows\System\gfYxved.exe
  2⤵
  PID:8596
- C:\Windows\System\UDWtpkB.exe
  C:\Windows\System\UDWtpkB.exe
  2⤵
  PID:8776
- C:\Windows\System\KFEpDir.exe
  C:\Windows\System\KFEpDir.exe
  2⤵
  PID:8796
- C:\Windows\System\clvqFnL.exe
  C:\Windows\System\clvqFnL.exe
  2⤵
  PID:8820
- C:\Windows\System\eHmmXZO.exe
  C:\Windows\System\eHmmXZO.exe
  2⤵
  PID:8852
- C:\Windows\System\sbJBEJu.exe
  C:\Windows\System\sbJBEJu.exe
  2⤵
  PID:8836
- C:\Windows\System\uaBLwkO.exe
  C:\Windows\System\uaBLwkO.exe
  2⤵
  PID:8880
- C:\Windows\System\FFRLIOH.exe
  C:\Windows\System\FFRLIOH.exe
  2⤵
  PID:8908
- C:\Windows\System\DuvgpeX.exe
  C:\Windows\System\DuvgpeX.exe
  2⤵
  PID:8940
- C:\Windows\System\NiyGZkJ.exe
  C:\Windows\System\NiyGZkJ.exe
  2⤵
  PID:8972
- C:\Windows\System\bckPkCz.exe
  C:\Windows\System\bckPkCz.exe
  2⤵
  PID:8976
- C:\Windows\System\AuIUQTO.exe
  C:\Windows\System\AuIUQTO.exe
  2⤵
  PID:9052
- C:\Windows\System\IDQYkWQ.exe
  C:\Windows\System\IDQYkWQ.exe
  2⤵
  PID:9036
- C:\Windows\System\tYCqQif.exe
  C:\Windows\System\tYCqQif.exe
  2⤵
  PID:9120
- C:\Windows\System\QfLSKIn.exe
  C:\Windows\System\QfLSKIn.exe
  2⤵
  PID:9136
- C:\Windows\System\oMMwLrx.exe
  C:\Windows\System\oMMwLrx.exe
  2⤵
  PID:9172
- C:\Windows\System\GHSaiyd.exe
  C:\Windows\System\GHSaiyd.exe
  2⤵
  PID:8096
- C:\Windows\System\eoQIvLx.exe
  C:\Windows\System\eoQIvLx.exe
  2⤵
  PID:7984
- C:\Windows\System\oAtGtVA.exe
  C:\Windows\System\oAtGtVA.exe
  2⤵
  PID:7592
- C:\Windows\System\EiUhwkH.exe
  C:\Windows\System\EiUhwkH.exe
  2⤵
  PID:8276
- C:\Windows\System\GDhktMT.exe
  C:\Windows\System\GDhktMT.exe
  2⤵
  PID:7304
- C:\Windows\System\sqyPWbB.exe
  C:\Windows\System\sqyPWbB.exe
  2⤵
  PID:7832
- C:\Windows\System\ERwbPnL.exe
  C:\Windows\System\ERwbPnL.exe
  2⤵
  PID:8264
- C:\Windows\System\oQiUPCD.exe
  C:\Windows\System\oQiUPCD.exe
  2⤵
  PID:8228
- C:\Windows\System\VGycxwy.exe
  C:\Windows\System\VGycxwy.exe
  2⤵
  PID:8520
- C:\Windows\System\TsRLQOH.exe
  C:\Windows\System\TsRLQOH.exe
  2⤵
  PID:8688
- C:\Windows\System\uYmUqCD.exe
  C:\Windows\System\uYmUqCD.exe
  2⤵
  PID:8804
- C:\Windows\System\RAjBVqm.exe
  C:\Windows\System\RAjBVqm.exe
  2⤵
  PID:8504
- C:\Windows\System\UHfbpDU.exe
  C:\Windows\System\UHfbpDU.exe
  2⤵
  PID:8644
- C:\Windows\System\iZMdCQf.exe
  C:\Windows\System\iZMdCQf.exe
  2⤵
  PID:8780
- C:\Windows\System\pIrLEAp.exe
  C:\Windows\System\pIrLEAp.exe
  2⤵
  PID:8828
- C:\Windows\System\OkYeqOM.exe
  C:\Windows\System\OkYeqOM.exe
  2⤵
  PID:8484
- C:\Windows\System\eTcUNeQ.exe
  C:\Windows\System\eTcUNeQ.exe
  2⤵
  PID:8912
- C:\Windows\System\LiSewMN.exe
  C:\Windows\System\LiSewMN.exe
  2⤵
  PID:9024
- C:\Windows\System\aHKyLOS.exe
  C:\Windows\System\aHKyLOS.exe
  2⤵
  PID:9108
- C:\Windows\System\NJCZUyI.exe
  C:\Windows\System\NJCZUyI.exe
  2⤵
  PID:9068
- C:\Windows\System\Bdbniwm.exe
  C:\Windows\System\Bdbniwm.exe
  2⤵
  PID:9200
- C:\Windows\System\VSClYur.exe
  C:\Windows\System\VSClYur.exe
  2⤵
  PID:8076
- C:\Windows\System\bPxclQw.exe
  C:\Windows\System\bPxclQw.exe
  2⤵
  PID:8200
- C:\Windows\System\RbpLoKe.exe
  C:\Windows\System\RbpLoKe.exe
  2⤵
  PID:7220
- C:\Windows\System\UhjrekX.exe
  C:\Windows\System\UhjrekX.exe
  2⤵
  PID:8360
- C:\Windows\System\BXAuIQi.exe
  C:\Windows\System\BXAuIQi.exe
  2⤵
  PID:8740
- C:\Windows\System\KdZXotf.exe
  C:\Windows\System\KdZXotf.exe
  2⤵
  PID:8548
- C:\Windows\System\SovaOuH.exe
  C:\Windows\System\SovaOuH.exe
  2⤵
  PID:8792
- C:\Windows\System\XOrxajl.exe
  C:\Windows\System\XOrxajl.exe
  2⤵
  PID:9104
- C:\Windows\System\BcHNfAu.exe
  C:\Windows\System\BcHNfAu.exe
  2⤵
  PID:8340
- C:\Windows\System\SCPxjNQ.exe
  C:\Windows\System\SCPxjNQ.exe
  2⤵
  PID:8564
- C:\Windows\System\zadPGeD.exe
  C:\Windows\System\zadPGeD.exe
  2⤵
  PID:8436
- C:\Windows\System\eyscurT.exe
  C:\Windows\System\eyscurT.exe
  2⤵
  PID:9020
- C:\Windows\System\lTqJiIR.exe
  C:\Windows\System\lTqJiIR.exe
  2⤵
  PID:7796
- C:\Windows\System\wCSFNYm.exe
  C:\Windows\System\wCSFNYm.exe
  2⤵
  PID:8440
- C:\Windows\System\deZiciN.exe
  C:\Windows\System\deZiciN.exe
  2⤵
  PID:8896
- C:\Windows\System\NUMExxD.exe
  C:\Windows\System\NUMExxD.exe
  2⤵
  PID:8704
- C:\Windows\System\ERLsuDE.exe
  C:\Windows\System\ERLsuDE.exe
  2⤵
  PID:8324
- C:\Windows\System\BLxQZvJ.exe
  C:\Windows\System\BLxQZvJ.exe
  2⤵
  PID:9224
- C:\Windows\System\SZQfBDW.exe
  C:\Windows\System\SZQfBDW.exe
  2⤵
  PID:9240
- C:\Windows\System\RbyuuKj.exe
  C:\Windows\System\RbyuuKj.exe
  2⤵
  PID:9256
- C:\Windows\System\BpiPQtt.exe
  C:\Windows\System\BpiPQtt.exe
  2⤵
  PID:9272
- C:\Windows\System\eLTIEit.exe
  C:\Windows\System\eLTIEit.exe
  2⤵
  PID:9288
- C:\Windows\System\XUdsQGT.exe
  C:\Windows\System\XUdsQGT.exe
  2⤵
  PID:9308
- C:\Windows\System\eCfjbpA.exe
  C:\Windows\System\eCfjbpA.exe
  2⤵
  PID:9324
- C:\Windows\System\qLIWtXK.exe
  C:\Windows\System\qLIWtXK.exe
  2⤵
  PID:9340
- C:\Windows\System\iJnibiQ.exe
  C:\Windows\System\iJnibiQ.exe
  2⤵
  PID:9356
- C:\Windows\System\xMlthLs.exe
  C:\Windows\System\xMlthLs.exe
  2⤵
  PID:9372
- C:\Windows\System\Hurcbnh.exe
  C:\Windows\System\Hurcbnh.exe
  2⤵
  PID:9392
- C:\Windows\System\QugHVsr.exe
  C:\Windows\System\QugHVsr.exe
  2⤵
  PID:9412
- C:\Windows\System\ySIQJCS.exe
  C:\Windows\System\ySIQJCS.exe
  2⤵
  PID:9428
- C:\Windows\System\PBFmyYH.exe
  C:\Windows\System\PBFmyYH.exe
  2⤵
  PID:9444
- C:\Windows\System\cIDgmbe.exe
  C:\Windows\System\cIDgmbe.exe
  2⤵
  PID:9460
- C:\Windows\System\gYpaLuW.exe
  C:\Windows\System\gYpaLuW.exe
  2⤵
  PID:9476
- C:\Windows\System\BbZCnGH.exe
  C:\Windows\System\BbZCnGH.exe
  2⤵
  PID:9492
- C:\Windows\System\ibwTUyW.exe
  C:\Windows\System\ibwTUyW.exe
  2⤵
  PID:9508
- C:\Windows\System\PGZranQ.exe
  C:\Windows\System\PGZranQ.exe
  2⤵
  PID:9524
- C:\Windows\System\McWAYWg.exe
  C:\Windows\System\McWAYWg.exe
  2⤵
  PID:9540
- C:\Windows\System\YUaIfAk.exe
  C:\Windows\System\YUaIfAk.exe
  2⤵
  PID:9556
- C:\Windows\System\VoMvLtm.exe
  C:\Windows\System\VoMvLtm.exe
  2⤵
  PID:9580
- C:\Windows\System\IZfhSYo.exe
  C:\Windows\System\IZfhSYo.exe
  2⤵
  PID:9596
- C:\Windows\System\qCBMdDd.exe
  C:\Windows\System\qCBMdDd.exe
  2⤵
  PID:9620
- C:\Windows\System\zqHZyAG.exe
  C:\Windows\System\zqHZyAG.exe
  2⤵
  PID:9696
- C:\Windows\System\DycbOJr.exe
  C:\Windows\System\DycbOJr.exe
  2⤵
  PID:9712
- C:\Windows\System\XuyegwO.exe
  C:\Windows\System\XuyegwO.exe
  2⤵
  PID:9732
- C:\Windows\System\IqrYRWU.exe
  C:\Windows\System\IqrYRWU.exe
  2⤵
  PID:9748
- C:\Windows\System\GktOFGN.exe
  C:\Windows\System\GktOFGN.exe
  2⤵
  PID:9772
- C:\Windows\System\dHgUYsx.exe
  C:\Windows\System\dHgUYsx.exe
  2⤵
  PID:9788
- C:\Windows\System\WUYRPNw.exe
  C:\Windows\System\WUYRPNw.exe
  2⤵
  PID:9804
- C:\Windows\System\hZrNrUr.exe
  C:\Windows\System\hZrNrUr.exe
  2⤵
  PID:9820
- C:\Windows\System\YhBNdjt.exe
  C:\Windows\System\YhBNdjt.exe
  2⤵
  PID:9836
- C:\Windows\System\CQLlKuk.exe
  C:\Windows\System\CQLlKuk.exe
  2⤵
  PID:9852
- C:\Windows\System\qQEXAkw.exe
  C:\Windows\System\qQEXAkw.exe
  2⤵
  PID:9868
- C:\Windows\System\Cslvctm.exe
  C:\Windows\System\Cslvctm.exe
  2⤵
  PID:9888
- C:\Windows\System\uXbyFOm.exe
  C:\Windows\System\uXbyFOm.exe
  2⤵
  PID:9904
- C:\Windows\System\RDCcocZ.exe
  C:\Windows\System\RDCcocZ.exe
  2⤵
  PID:9920
- C:\Windows\System\lArphwx.exe
  C:\Windows\System\lArphwx.exe
  2⤵
  PID:9940
- C:\Windows\System\JJDWQJd.exe
  C:\Windows\System\JJDWQJd.exe
  2⤵
  PID:9956
- C:\Windows\System\qkFxzES.exe
  C:\Windows\System\qkFxzES.exe
  2⤵
  PID:9972
- C:\Windows\System\gNKbdHc.exe
  C:\Windows\System\gNKbdHc.exe
  2⤵
  PID:9988
- C:\Windows\System\LtICMSF.exe
  C:\Windows\System\LtICMSF.exe
  2⤵
  PID:10008
- C:\Windows\System\QqfWxvQ.exe
  C:\Windows\System\QqfWxvQ.exe
  2⤵
  PID:10024
- C:\Windows\System\rHlYYlf.exe
  C:\Windows\System\rHlYYlf.exe
  2⤵
  PID:10040
- C:\Windows\System\ugVBJDT.exe
  C:\Windows\System\ugVBJDT.exe
  2⤵
  PID:10056
- C:\Windows\System\dVROuXU.exe
  C:\Windows\System\dVROuXU.exe
  2⤵
  PID:10080
- C:\Windows\System\epKVtiQ.exe
  C:\Windows\System\epKVtiQ.exe
  2⤵
  PID:10096
- C:\Windows\System\zZdueNF.exe
  C:\Windows\System\zZdueNF.exe
  2⤵
  PID:10112
- C:\Windows\System\kslrehb.exe
  C:\Windows\System\kslrehb.exe
  2⤵
  PID:10128
- C:\Windows\System\kufoUCP.exe
  C:\Windows\System\kufoUCP.exe
  2⤵
  PID:10144
- C:\Windows\System\YQdETLX.exe
  C:\Windows\System\YQdETLX.exe
  2⤵
  PID:10184
- C:\Windows\System\ASppkEv.exe
  C:\Windows\System\ASppkEv.exe
  2⤵
  PID:10216
- C:\Windows\System\LUKDXjr.exe
  C:\Windows\System\LUKDXjr.exe
  2⤵
  PID:8060
- C:\Windows\System\bQRTKYl.exe
  C:\Windows\System\bQRTKYl.exe
  2⤵
  PID:8408
- C:\Windows\System\OmEHxrT.exe
  C:\Windows\System\OmEHxrT.exe
  2⤵
  PID:9284
- C:\Windows\System\wdgkred.exe
  C:\Windows\System\wdgkred.exe
  2⤵
  PID:9548
- C:\Windows\System\CwwEZqM.exe
  C:\Windows\System\CwwEZqM.exe
  2⤵
  PID:9616
- C:\Windows\System\ETwDTAO.exe
  C:\Windows\System\ETwDTAO.exe
  2⤵
  PID:9720
- C:\Windows\System\gTkzhJM.exe
  C:\Windows\System\gTkzhJM.exe
  2⤵
  PID:9764
- C:\Windows\System\PgzAExw.exe
  C:\Windows\System\PgzAExw.exe
  2⤵
  PID:9704
- C:\Windows\System\pSbRAiB.exe
  C:\Windows\System\pSbRAiB.exe
  2⤵
  PID:10136
- C:\Windows\System\UBcZTDX.exe
  C:\Windows\System\UBcZTDX.exe
  2⤵
  PID:9724
- C:\Windows\System\THrROov.exe
  C:\Windows\System\THrROov.exe
  2⤵
  PID:9844
- C:\Windows\System\StKwYir.exe
  C:\Windows\System\StKwYir.exe
  2⤵
  PID:9880
- C:\Windows\System\OXtXGSQ.exe
  C:\Windows\System\OXtXGSQ.exe
  2⤵
  PID:9876
- C:\Windows\System\WhqOmgU.exe
  C:\Windows\System\WhqOmgU.exe
  2⤵
  PID:9932
- C:\Windows\System\nRHOEZz.exe
  C:\Windows\System\nRHOEZz.exe
  2⤵
  PID:9664
- C:\Windows\System\GLKobcg.exe
  C:\Windows\System\GLKobcg.exe
  2⤵
  PID:9996
- C:\Windows\System\IJPJpPX.exe
  C:\Windows\System\IJPJpPX.exe
  2⤵
  PID:10052
- C:\Windows\System\IlyPdou.exe
  C:\Windows\System\IlyPdou.exe
  2⤵
  PID:10020
- C:\Windows\System\cnSEsCc.exe
  C:\Windows\System\cnSEsCc.exe
  2⤵
  PID:9796
- C:\Windows\System\idaReSf.exe
  C:\Windows\System\idaReSf.exe
  2⤵
  PID:10124
- C:\Windows\System\rWmvptM.exe
  C:\Windows\System\rWmvptM.exe
  2⤵
  PID:10156
- C:\Windows\System\qDjKlvP.exe
  C:\Windows\System\qDjKlvP.exe
  2⤵
  PID:10104
- C:\Windows\System\qHopxZK.exe
  C:\Windows\System\qHopxZK.exe
  2⤵
  PID:10200
- C:\Windows\System\RxzJYMA.exe
  C:\Windows\System\RxzJYMA.exe
  2⤵
  PID:9072
- C:\Windows\System\XAmKXRs.exe
  C:\Windows\System\XAmKXRs.exe
  2⤵
  PID:9252
- C:\Windows\System\TwuPdve.exe
  C:\Windows\System\TwuPdve.exe
  2⤵
  PID:10172
- C:\Windows\System\jiBVDlw.exe
  C:\Windows\System\jiBVDlw.exe
  2⤵
  PID:9300
- C:\Windows\System\hWoWuVM.exe
  C:\Windows\System\hWoWuVM.exe
  2⤵
  PID:10232
- C:\Windows\System\qqluisU.exe
  C:\Windows\System\qqluisU.exe
  2⤵
  PID:2256
- C:\Windows\System\bQHcZjL.exe
  C:\Windows\System\bQHcZjL.exe
  2⤵
  PID:9452
- C:\Windows\System\RpteXuY.exe
  C:\Windows\System\RpteXuY.exe
  2⤵
  PID:9488
- C:\Windows\System\lNCvgpL.exe
  C:\Windows\System\lNCvgpL.exe
  2⤵
  PID:9520
- C:\Windows\System\jBanKku.exe
  C:\Windows\System\jBanKku.exe
  2⤵
  PID:9440
- C:\Windows\System\RNsBgHk.exe
  C:\Windows\System\RNsBgHk.exe
  2⤵
  PID:9348
- C:\Windows\System\ctFffQm.exe
  C:\Windows\System\ctFffQm.exe
  2⤵
  PID:9472
- C:\Windows\System\bhulSpN.exe
  C:\Windows\System\bhulSpN.exe
  2⤵
  PID:9632
- C:\Windows\System\ClQVDPQ.exe
  C:\Windows\System\ClQVDPQ.exe
  2⤵
  PID:9608
- C:\Windows\System\TlzEYdy.exe
  C:\Windows\System\TlzEYdy.exe
  2⤵
  PID:9660
- C:\Windows\System\XHokqxg.exe
  C:\Windows\System\XHokqxg.exe
  2⤵
  PID:9848
- C:\Windows\System\ncqjXFh.exe
  C:\Windows\System\ncqjXFh.exe
  2⤵
  PID:9740
- C:\Windows\System\MijTcFo.exe
  C:\Windows\System\MijTcFo.exe
  2⤵
  PID:9744
- C:\Windows\System\nNtXVgv.exe
  C:\Windows\System\nNtXVgv.exe
  2⤵
  PID:10048
- C:\Windows\System\SdsRlMb.exe
  C:\Windows\System\SdsRlMb.exe
  2⤵
  PID:10004
- C:\Windows\System\KFEvaJT.exe
  C:\Windows\System\KFEvaJT.exe
  2⤵
  PID:10072
- C:\Windows\System\gqZseZT.exe
  C:\Windows\System\gqZseZT.exe
  2⤵
  PID:9980
- C:\Windows\System\yPLYYzM.exe
  C:\Windows\System\yPLYYzM.exe
  2⤵
  PID:9352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BbDOzhO.exe

Filesize
1.6MB

MD5
2ccdf2a073454ab0d9f6191060d1b1b0

SHA1
fc50db282a45612052d219388ecce51068c4aed6

SHA256
f0a71845ce571f8b3b3c797a9848471efe7a743ce2350596f62a8c8704f03194

SHA512
9e4166e5499846bc2211c87d6bcb9cf1916c28ec347da18085c39cb8da9f5a61b93265a264b7e6dc67d2c3abcd86ac574baf3fccc9997ab5986c931b948ef199

Download Submit
C:\Windows\system\ECfhMAF.exe

Filesize
1.6MB

MD5
3b8158e242885635faaa67a9a12fbf1a

SHA1
04396de8a59a85158cd52012d569d736f175f4dc

SHA256
c868fa98be01f172a14b5a5db3568dbad2570b8eaf2f7bbdad17c5911afdeac7

SHA512
adf9374b12a17aa7719a63a2f35af36c42fa2ea15f309a92b884776d3c69c417a175e2427eeb8dbda5d8bf961982f9d240060f67b42109e7583ddb4fa0762f63

Download Submit
C:\Windows\system\HQXmUwX.exe

Filesize
1.6MB

MD5
1fb9663c9bd7c790f1696e4d2b3ed26c

SHA1
881a51af66eb92b4a6c0de6948851b3589031c4f

SHA256
e040ddcfbae8707d4533e6c94a6e16fd2fc9eabfc2234a5d82f17d4ad73bbc1e

SHA512
0b82646cae2a369ddbfabd1e3f028c0ff3019b0a28d170da22a0aa577d9414c587a9eaafafb35875e7067c2a3cf30b0353f08af79753130aed09e63549e54f25

Download Submit
C:\Windows\system\IlGpAGH.exe

Filesize
1.6MB

MD5
4c2b56b68ee0f15482ca2255bdec378d

SHA1
8da6235b68149b4a8bb18cb2ea755925031462fb

SHA256
dcc8f6eea2f59a72621374607131d68f173604612b5bf75ee17bd42578dbf59d

SHA512
3f1ac443ac5abeeade4c262d93e2b5a98b4ca050a28535fcc50d8826c64686e49779c97428bd0c8329956a32409b21268837df1875f730de0965904ab6bb5367

Download Submit
C:\Windows\system\JplVeKx.exe

Filesize
1.6MB

MD5
dd6bc043548dc2ebf90ec2f7ec63e947

SHA1
542ce19dcb703507515bc07ae8a0a61da2fcdf59

SHA256
d7019dd1355216d4b65b88a5cb72b1015c9988b5ea70b64b1335a8444faeb4da

SHA512
193309b2d7399f857d2a75a542db05173463078598cf6a5aef7e63e2d1f0947f645bb009570339647923ac3feb044771a806102d6f7070427354067ee572543d

Download Submit
C:\Windows\system\KifaDno.exe

Filesize
1.6MB

MD5
463ee057cf89d62d9072447c1ad9483a

SHA1
1d3b44709de889d4dda251d783d10a4c8950beed

SHA256
e083672691048afc3dddc29ce624e03a03e0f478efdd694fc259aa4ce6249e64

SHA512
72dc81f94886e0d2ffeb061b27117960602e561a97cccf9126c6e0c1513d3064c5c58592bfa22e8da378405826c6c383e2ea15ea950b2b10ced0b7575e103a25

Download Submit
C:\Windows\system\ObiSqGp.exe

Filesize
1.6MB

MD5
d76eebc51460edd30b09550e5f41241a

SHA1
25d863a62c292a3583e2bd6c891ff388874dbf9c

SHA256
3501e9163aadbe0ff0bb47dd25e195af2700167b50cfb3d52a4d3bd856b36ee1

SHA512
45588c4eb2e4a0189597f9ab8262f64572774955ce7326478f2e4122b8afce6bb9c9c4d0a276117fecc154295910cce9a8fbda4d87e02e9568053505458adbbd

Download Submit
C:\Windows\system\PyGcHUC.exe

Filesize
1.6MB

MD5
a93ddd1b7efd6effdb2c1b5408851e28

SHA1
106c6aa2bdbf9fe6283e5cb49687aec72ee5d820

SHA256
4b59addd6fa4e82b9d171dbd1325c21d10f7a16a7f38dd62b901ce30a26f94d6

SHA512
ebeefd2189b6319ca2e541dc7085e0848fe2c494c306cd29c038a166ce1447af3007e64a86a7c91f10d407ec59b5f882a95b17e280cafd1651bb68503ad50a82

Download Submit
C:\Windows\system\ShNxUWc.exe

Filesize
1.6MB

MD5
ed9426271b097c96eaa5116cdcc22104

SHA1
c71750f4d89a808bc9896bb93e58d659114726db

SHA256
92726a8372d82883ec2afc7980f80ca3af0a845cb73238c6ad30deb60f82488f

SHA512
4e88f03a70fcb649933735762b13d99019b5849cb7aa6a2924b8b0085302c7871759d41ad79f16b70a2a664d751212c60b340cf34cc722b957372b5fe1a55716

Download Submit
C:\Windows\system\SnGBTvq.exe

Filesize
1.6MB

MD5
0862a2f95272b7b09f857f00b6405997

SHA1
41cb7198b9d643aa143b2a6b50e9a43687e11dc4

SHA256
30295b218b226f643e3e5ce130a4790ce4f261074b2bf9194c1a114a8713da6a

SHA512
f104661bc157c753321aeb15984164f03c76b4cd709c7869b5007e901f35045110739bd809bc252a492c1b8d19c4034fc3e006f5f0e2a91f309f3c7c0a4bb03a

Download Submit
C:\Windows\system\VBJUifu.exe

Filesize
1.6MB

MD5
3bbe4bef49f105ff0fc680c66d1ff36d

SHA1
13d129100581b4b3734d5cd7828d499ecf187dc2

SHA256
26cf43e2c8c1cb82519a9bffa845985ab20499564305457b51029ff47934f38f

SHA512
1e425955b3f39de4c0de140ea65fe8583063020d5369dc6ad15680ca7b3f49a432a96f19b52ea03a66d0be052bf815aa9b5751812d496eb9d7acc7989cb57161

Download Submit
C:\Windows\system\VSqtmlY.exe

Filesize
1.6MB

MD5
ba989c0eb399881142b58e8df7a10279

SHA1
d4f53b78da1b5490c253cf6b3d8988ade0eafbed

SHA256
57c546f8f16ec34346d42a493ddfbf67341e9adffcdc517a1baa7db80b29f61d

SHA512
43df5090d225bd001465cd3e36149bde86bee36663e6ff3214c1227e0c869691dceeaecedc46f3281fb8cb5f4d887b1e25ddc9e86420206e5e2d8c3418fa4e96

Download Submit
C:\Windows\system\XAZNmPN.exe

Filesize
1.6MB

MD5
ad65e34ea42f229afd1607ef8750b500

SHA1
589b6108d49454280258e1541f6d3ff532383767

SHA256
c5779fa8cc4ea9bcf4b3f4ea2871e75ba42abcf572d957df892f862ca5c7d084

SHA512
a6ad8002ee329b27b7360bca81bcbac59ac70c46471383045e772c9aed52fc38aa70e6a01fe86dbcac783ad306063a96054429acc816f9e66a04096cfa3bdb8d

Download Submit
C:\Windows\system\XeWZZut.exe

Filesize
1.6MB

MD5
a6d63a4182c4af55e0abeca511386a8c

SHA1
66a4a65a56301f6100b4789a991efb7b5fa01b4f

SHA256
38ce36986a554d239ba88e6595ca7ed92b14b815ccda6ee44aa8d6953bbfd5f7

SHA512
6ec3fe720fab97156844eafe3dd8d5820567e0754e479c5afece88d16ab16926440aef94eb201fb4a084e9bd79438e7fb5a2247365a287169781acb355ea289b

Download Submit
C:\Windows\system\YtBvrrK.exe

Filesize
1.6MB

MD5
dfef19ef0b5d46deb8347deb34d1e79f

SHA1
6d1e8f16936cb3c5fbfa981297a35fb7544f826d

SHA256
0ca6e6477dde3f4b225200f52f1db720d3a3f20dced9f51835d0c188df6d6cdc

SHA512
991af6f24148c67b1115df01f282269fb17bf95ac8c93545024ad428d333ea3576b91ef5ba3b9fec37b57ee97e5db8c930f9003b648895d867dc19e6f3e74ae4

Download Submit
C:\Windows\system\ZtkSMCy.exe

Filesize
1.6MB

MD5
7ed04fbd9e45aeb6d6adaf5ac062b8bd

SHA1
60c898edfdd8ff75094eb1935ad30a54993523f3

SHA256
5e80cc1b277e173855515142f0d08378cf6c9cdafdc8b2c90e1e873e0a23dd3c

SHA512
646ebad2816f41de80842bec942a4f9474c94a1277a4bb0864073e69fe47f99852ce151f295ccffb58b8b9fd1369eb30daf60ba7245e466d2f161b843331e380

Download Submit
C:\Windows\system\ccVHqyF.exe

Filesize
1.6MB

MD5
56372ac24ff1475c2bb597e3ff58a838

SHA1
36f3c73814e95ec3426bd744737de656d9a9ab35

SHA256
f9ad67dfa800ce1162fe86c0ce8bc0a5b376683fb5ed636e9ea24f657ab5db89

SHA512
89a8f4ffec2def4edf421443baaf5890b5c97578b1c52f634e796fb259215f621a1de0af493950ac4613cee05ef9f2edf8ac074c3748ff669b4bfdb58a4116b1

Download Submit
C:\Windows\system\dPbNiME.exe

Filesize
1.6MB

MD5
888680adcfe56ba377a14b390858ad6d

SHA1
cb53c8abf95675595ba786d0f65a9c527c55a7e8

SHA256
4eedfd083c135217e313c0985ebd1c1444d403a59a29c1ce7081f7cd09fe3731

SHA512
eb948e5b85cc9a73be6b60d374ab9c49cc1217ef032628a8d43c708b109e2979ab02f7bffa7158f57ebe53aa94f123fd2d260a6a90663a634d0e5994c6acd5e3

Download Submit
C:\Windows\system\hbZbYfb.exe

Filesize
1.6MB

MD5
36b4834c14cb99c3bd74b925020ac820

SHA1
43aa85a5a2227d0d3ea31a63732671d177234121

SHA256
abd76577802ef8d81bab9f5f23626b8ee54312d9652152e5079f10f79fd503aa

SHA512
8e9b6ac18e4f19adf00201a856e2725c991836fa18eb29def2bea8ca13ecafe342a733f9fe52be51754c4ef42c14f549ca007ecf60d2c8d7eb4b7df2f1b3dae6

Download Submit
C:\Windows\system\hbcaPLw.exe

Filesize
1.6MB

MD5
72039eafc32d0f3f50c779761c21eccf

SHA1
5a9280af3a8aefd333e1f28439f3a6afc10dc067

SHA256
3fe89315a2f39080bf58d41b29477ebfbf9c627c983036627f24a7106b034278

SHA512
d6934490caf482071ced2cda27927ae4643685cc5ca4cf07aabe9b855eb135e55dad04c7eae6d58f254bc2b7324dc3f9cc5cbd109277f9217a5284ec1059f85e

Download Submit
C:\Windows\system\iFGfgiD.exe

Filesize
1.6MB

MD5
0e8af61d5748fb144aea8e49c36fb0e2

SHA1
cf276efbf6f3124ec1a29ee927462f590550d3e2

SHA256
aeea1faec6512c99493efc1de752d7bfc892813de2e778c9971bbf6eeeef4f19

SHA512
7ebe59cd17d0106eedba6a0aaa9a0bffb622a00b74be93129fffcdb1e3bfeceda76681680a2ebb427dab722de5e32cd776351d6117edc877f142bed809a5214c

Download Submit
C:\Windows\system\ixlmNwf.exe

Filesize
1.6MB

MD5
dcd0c064f0ac2335f2c7461144b2678e

SHA1
6c6628c8d42d2773f32d94cc37fc8296c5dd3ec2

SHA256
356f9e862217fd3e8ca95a56e3294d260802370704992bdc8b39ed9ba4254362

SHA512
04bd61274ada4a2eeca0cf53d4c3e40a3795813f53c768e38c9dc51b07522dc26cc754e231c06668988a9f517c7b03a91e2b37b027b2eb1ac72fb4c167ea1dd1

Download Submit
C:\Windows\system\lTUoQKv.exe

Filesize
1.6MB

MD5
4014ad961054c9d87128ed9dee8b776e

SHA1
cf203ba0d5ca444da8dfed80ab7e7e1eda93fa46

SHA256
7234f871effa17e282581dffa397a7ab3d87d5863ccd43623c9da3a95d85f631

SHA512
c62ae4dfdc45e0bd55a5d259173030350fb6bdd4f84e8f517e7a369ea211fcf1c34c9620fbdce5e39d6cdd25e5c5c7f9f2c80824e1dea195d33b196fd6cd51b9

Download Submit
C:\Windows\system\mVbRuPa.exe

Filesize
1.6MB

MD5
bf851c498de5ad62daa48efaadb680cf

SHA1
e6c79146ce84484061bedf4205765d784728c6bd

SHA256
643448a7938e52b33c582244c1e78f9bb7dd726ec8b9fe023166a1a928b9ae87

SHA512
be297a898de9098ab33ca1ce9bced74c6248b894841226601dda40296804a3c656f9f9fbeaa9e89cea32b2abf3c1f8df430d931a0f800b222c0635f877a0898c

Download Submit
C:\Windows\system\npXlhPq.exe

Filesize
1.6MB

MD5
8e49a6f2e455e18b15be20114ff816d5

SHA1
8b0c7b1bb32acc22f5d36c24c0a0cb2e9d80ce2a

SHA256
5f341b931f111a8c9d00b722ea459f335d9d46585b5a787c56405f239303e63b

SHA512
c6b192d43de4f1c0dc52e8f1f8eede58132a86b68e4aed84e414e7796fa9df3f581f6a87339e5ef97d4c7c348d7a011a8df53ae5ea6b39102f0812da79a7b55f

Download Submit
C:\Windows\system\pKDXbOz.exe

Filesize
1.6MB

MD5
762e28facf0a839b708ab61c3e10ae20

SHA1
0c2a5b9f5e06b85637deefc71a4e4fb0d1e2c953

SHA256
3b5f84e5f255727f9548b69fc17517ddc1fcd09e035292cde856e24800304d20

SHA512
05896cdd9eeea6af895e94342204f632c81da1b496a771af6ffcbbff2e04cfd082f8f230f4de887e5bdcab0b045387281541a42cc90a06c788e88fa8b816ace4

Download Submit
C:\Windows\system\pWKePZZ.exe

Filesize
1.6MB

MD5
70c41113266d510e3d304728bd7b2d4d

SHA1
51c7c843f9bd7aa34ba06d58880ae961dd9df3b6

SHA256
0a6e95d911916f8f3b71557740695074e64c85bffba91e365feec8daa64478dd

SHA512
abcc0ca13d412b9e4ec7bad6aa0e4ab202c0aff10315322bac97c6e97cbfeaa8bf203fa5774468cb7b6eba0bc8e9be3d5daadca6c3397d4b92a0150ab40316fd

Download Submit
C:\Windows\system\qarLxec.exe

Filesize
1.6MB

MD5
d11c6d54294ac33fffeb01f9a4647e7d

SHA1
d17309243122fbe21a0fe54b6152439af7c8989a

SHA256
20e98bf280690018cb1baa16710404c2e90aba510efb140c57b5a7e43eb1042a

SHA512
69c141cf4906ff1ea33932a40b5f853ff2be7877bca4773bbaf6184b08cd01f26d92473cdae8af786b671c78c5ddb685e0b4643ff83323d573d830a33464dad6

Download Submit
C:\Windows\system\sFErcps.exe

Filesize
1.6MB

MD5
f0ed001eee5917ad4d6a93fce525eb6e

SHA1
ac6b5b90d1ce366eec4194f3e384fb40bc93e472

SHA256
1ce4ebde23304470964b18d78f4a3f1a69d08ae024498944ae3cd988a71dff0c

SHA512
3175702240b5cbfff6a53390be176c862b360a0eca7a5e386a553bd67d1b80b5449d3fb738772c7eede9342cece677a732ec996060692a76c77d78340efa00ec

Download Submit
C:\Windows\system\vJfdXhp.exe

Filesize
1.6MB

MD5
ec794a0b56f10b563994f8de09bc0ba4

SHA1
3571f59761231359a6fcacb7fe8048b1c07bb01a

SHA256
081ac0244130f9ddad71ff0d0e3811d988f1f19c8df909fc8e38a7a006b4326e

SHA512
b261e922e341c10e0f32de2cfc2930e2a8d1783653dc0d84cb4761ce163fbb4ac42abdbf3fa4b89c18d74396bb42d6a448029fa3d440793208a257dee57dd041

Download Submit
C:\Windows\system\yEftfbY.exe

Filesize
1.6MB

MD5
33714a6fa13cd6dc989dcd59ffd53775

SHA1
84d432bcc63ad96e747e3e4a8e6202b065060b18

SHA256
de6a6b65414deb48649e24a21eb2e16b568bb43d193e153284dc7925a8a7dd90

SHA512
e5b9c6003348267a7b8d909d084f4efeaf3ff9c4f522bce0fe989bab5350ce40fe94a3557bfc7bf045903e110e9ad363b4d1de684d84eb755f5cc91ff85a1cff

Download Submit
\Windows\system\hECEMfF.exe

Filesize
1.6MB

MD5
24a3341c0d0f96e750746d17b6550986

SHA1
f72715a93503aa04b79966f4fc780361c83c4e20

SHA256
eec316b148c71ce9b7617dd88a96664a80278a0a3d181b13c33e010c458da88d

SHA512
922ec0cedc66d1e85572d22052fe789183152bafe8c28a8d29cd6feb532fd17bb8b9ab52143903ba56bbf921bae38d819e950e5baac16435961c67b477d4c834

Download Submit
memory/2096-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download