xmrig | 60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
Size

1.1MB
MD5

1551374d8fe0c3dfe27ac05409d03ca8
SHA1

5ca7816cf6dd00faeeb20cd0142dacc024ec888f
SHA256

60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069
SHA512

01484e5d4b89e20d59ff52f4a82a72cea08dc3b73faadadcc76cbaaaa368b4056b1e0e74087443e91f15abfed8882f42256f9e769c8b11a0fb6f02c83a156e36
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszCTuMImxkEJr:GezaTF8FcNkNdfE0pZ9ozttwIRRds

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a0000000120d6-2.dat	xmrig
behavioral1/files/0x000f000000018683-8.dat	xmrig
behavioral1/files/0x0006000000018697-9.dat	xmrig
behavioral1/files/0x0007000000018706-14.dat	xmrig
behavioral1/files/0x000600000001871c-22.dat	xmrig
behavioral1/files/0x0006000000018745-25.dat	xmrig
behavioral1/files/0x0007000000018be7-30.dat	xmrig
behavioral1/files/0x0008000000018d83-33.dat	xmrig
behavioral1/files/0x000500000001939f-37.dat	xmrig
behavioral1/files/0x00050000000193cc-41.dat	xmrig
behavioral1/files/0x00050000000193d0-45.dat	xmrig
behavioral1/files/0x0005000000019426-55.dat	xmrig
behavioral1/files/0x0005000000019428-61.dat	xmrig
behavioral1/files/0x000500000001952e-103.dat	xmrig
behavioral1/files/0x0005000000019647-125.dat	xmrig
behavioral1/files/0x000500000001964f-129.dat	xmrig
behavioral1/files/0x0005000000019645-122.dat	xmrig
behavioral1/files/0x00050000000195a8-117.dat	xmrig
behavioral1/files/0x0005000000019543-113.dat	xmrig
behavioral1/files/0x0005000000019535-109.dat	xmrig
behavioral1/files/0x000500000001952b-102.dat	xmrig
behavioral1/files/0x0005000000019518-93.dat	xmrig
behavioral1/files/0x0005000000019520-97.dat	xmrig
behavioral1/files/0x0005000000019510-89.dat	xmrig
behavioral1/files/0x0005000000019508-85.dat	xmrig
behavioral1/files/0x0005000000019502-81.dat	xmrig
behavioral1/files/0x00050000000194e1-77.dat	xmrig
behavioral1/files/0x00050000000194d5-73.dat	xmrig
behavioral1/files/0x00050000000194c3-69.dat	xmrig
behavioral1/files/0x00050000000194ad-65.dat	xmrig
behavioral1/files/0x00050000000193f9-53.dat	xmrig
behavioral1/files/0x00050000000193dc-49.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2656	mkrtGoS.exe
2496	AIGDbNi.exe
2924	THnpHut.exe
2128	JcZVtmD.exe
2084	mGOipRA.exe
2108	suBBuRL.exe
2492	mSRvtfG.exe
2928	UnkKLtW.exe
2756	YAgyfyv.exe
2172	dvgcNEv.exe
2716	ZnGKzzt.exe
2788	iWUWGIH.exe
2832	upYlquj.exe
2212	vfbDaMx.exe
2296	yoGMdZD.exe
2844	lvFmYod.exe
2164	uKXssXz.exe
2604	hfZzPWF.exe
2744	uKOBBjU.exe
2576	shicOgk.exe
2620	zEJJOZK.exe
2364	LYcHzRI.exe
2816	SBpckZb.exe
2592	SnHdxwH.exe
1420	QNjFnNn.exe
2324	oWuoZay.exe
1988	khUxPvL.exe
1848	LeDEQmb.exe
1664	MZzQxkI.exe
1960	ujPxTZe.exe
1272	tKdikuX.exe
1440	MjTAubf.exe
1284	uadSQXt.exe
1744	YORGfbY.exe
2888	YzdjOLu.exe
1708	vIpNnZV.exe
1812	fZOEDhd.exe
2152	WMBTcQZ.exe
2996	VUDBZOF.exe
1904	DbgOgiN.exe
2448	WEflBoy.exe
2884	lwjpmoU.exe
2672	ZdNFmDy.exe
884	lAaEXNa.exe
584	ByPLSzG.exe
1128	HNswQuD.exe
2464	MEjRIUU.exe
2760	UiDwpAj.exe
2472	vurjZNf.exe
1716	sntqrHI.exe
1356	jpbtiXj.exe
1808	msJyhXJ.exe
1216	uDRMQtI.exe
2036	QYzOgez.exe
628	kIivAoA.exe
2040	ICdpZsa.exe
848	GcixfqO.exe
832	mpZKkMZ.exe
1564	aKEcZaa.exe
952	qqhEzKH.exe
556	iVEaGLP.exe
1756	cZehFEK.exe
1044	SLNpiDO.exe
1752	GuHnYme.exe

Loads dropped DLL 64 IoCs

pid	Process
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DkoMKFh.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\EFAiyjx.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\GeKZdQM.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\WQCgOTk.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\FSsvSmx.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\aDpdABB.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\vpZrRkn.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\mKTODGV.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\IUVrKzV.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\suBBuRL.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\uKXssXz.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\ouxNuSV.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\AVrmVTs.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\WjsuTgv.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\dDNvbQc.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\wKjKviS.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\ZIXqaDd.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\lvFmYod.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\RsCpFmv.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\qAvKPCk.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\KZzeILS.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\QTiqcam.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\mHSmqRE.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\TWnkiPR.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\ZkmnQvL.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\hmXMeXd.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\PquVnTG.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\QTRHIec.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\qRvyyFC.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\CSzNSGd.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\inDpzTz.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\jlQDRbE.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\QqEBPza.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\YzGeRjI.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\cBGHdUh.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\YLcvtbS.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\mIBQWWA.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\lZoxutU.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\uLlpnvG.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\XCjpvoL.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\CKjXklh.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\JoqoNGP.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\tcmhMVW.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\GgjqJqs.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\pnFFTKG.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\nGeZAkv.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\ikIiuFF.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\PTIZeFs.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\FOcjxpp.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\xWfUwAo.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\XQbihDD.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\MoXAWnU.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\tKllCos.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\qUywRwj.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\IWFzqgW.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\HxSKmby.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\ckDoTQd.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\YXIBhmY.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\WpzvoKv.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\NqpmpdM.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\AlOQksi.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\khUxPvL.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\LkmuSQA.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
File created	C:\Windows\System\GVYMFZZ.exe	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2656	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	31
PID 2236 wrote to memory of 2656	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	31
PID 2236 wrote to memory of 2656	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	31
PID 2236 wrote to memory of 2496	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	32
PID 2236 wrote to memory of 2496	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	32
PID 2236 wrote to memory of 2496	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	32
PID 2236 wrote to memory of 2924	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	33
PID 2236 wrote to memory of 2924	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	33
PID 2236 wrote to memory of 2924	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	33
PID 2236 wrote to memory of 2128	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	34
PID 2236 wrote to memory of 2128	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	34
PID 2236 wrote to memory of 2128	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	34
PID 2236 wrote to memory of 2084	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	35
PID 2236 wrote to memory of 2084	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	35
PID 2236 wrote to memory of 2084	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	35
PID 2236 wrote to memory of 2108	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	36
PID 2236 wrote to memory of 2108	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	36
PID 2236 wrote to memory of 2108	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	36
PID 2236 wrote to memory of 2492	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	37
PID 2236 wrote to memory of 2492	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	37
PID 2236 wrote to memory of 2492	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	37
PID 2236 wrote to memory of 2928	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	38
PID 2236 wrote to memory of 2928	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	38
PID 2236 wrote to memory of 2928	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	38
PID 2236 wrote to memory of 2756	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	39
PID 2236 wrote to memory of 2756	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	39
PID 2236 wrote to memory of 2756	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	39
PID 2236 wrote to memory of 2172	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	40
PID 2236 wrote to memory of 2172	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	40
PID 2236 wrote to memory of 2172	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	40
PID 2236 wrote to memory of 2716	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	41
PID 2236 wrote to memory of 2716	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	41
PID 2236 wrote to memory of 2716	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	41
PID 2236 wrote to memory of 2788	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	42
PID 2236 wrote to memory of 2788	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	42
PID 2236 wrote to memory of 2788	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	42
PID 2236 wrote to memory of 2832	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	43
PID 2236 wrote to memory of 2832	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	43
PID 2236 wrote to memory of 2832	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	43
PID 2236 wrote to memory of 2212	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	44
PID 2236 wrote to memory of 2212	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	44
PID 2236 wrote to memory of 2212	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	44
PID 2236 wrote to memory of 2296	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	45
PID 2236 wrote to memory of 2296	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	45
PID 2236 wrote to memory of 2296	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	45
PID 2236 wrote to memory of 2844	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	46
PID 2236 wrote to memory of 2844	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	46
PID 2236 wrote to memory of 2844	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	46
PID 2236 wrote to memory of 2164	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	47
PID 2236 wrote to memory of 2164	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	47
PID 2236 wrote to memory of 2164	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	47
PID 2236 wrote to memory of 2604	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	48
PID 2236 wrote to memory of 2604	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	48
PID 2236 wrote to memory of 2604	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	48
PID 2236 wrote to memory of 2744	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	49
PID 2236 wrote to memory of 2744	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	49
PID 2236 wrote to memory of 2744	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	49
PID 2236 wrote to memory of 2576	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	50
PID 2236 wrote to memory of 2576	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	50
PID 2236 wrote to memory of 2576	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	50
PID 2236 wrote to memory of 2620	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	51
PID 2236 wrote to memory of 2620	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	51
PID 2236 wrote to memory of 2620	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	51
PID 2236 wrote to memory of 2364	2236	60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe	52

C:\Users\Admin\AppData\Local\Temp\60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe
"C:\Users\Admin\AppData\Local\Temp\60ddd76cca15c0538687fb6fd149d91fa9968b521a16087203bd0b9091c4b069.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System\mkrtGoS.exe
  C:\Windows\System\mkrtGoS.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\AIGDbNi.exe
  C:\Windows\System\AIGDbNi.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\THnpHut.exe
  C:\Windows\System\THnpHut.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\JcZVtmD.exe
  C:\Windows\System\JcZVtmD.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\mGOipRA.exe
  C:\Windows\System\mGOipRA.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\suBBuRL.exe
  C:\Windows\System\suBBuRL.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\mSRvtfG.exe
  C:\Windows\System\mSRvtfG.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\UnkKLtW.exe
  C:\Windows\System\UnkKLtW.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\YAgyfyv.exe
  C:\Windows\System\YAgyfyv.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\dvgcNEv.exe
  C:\Windows\System\dvgcNEv.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ZnGKzzt.exe
  C:\Windows\System\ZnGKzzt.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\iWUWGIH.exe
  C:\Windows\System\iWUWGIH.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\upYlquj.exe
  C:\Windows\System\upYlquj.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\vfbDaMx.exe
  C:\Windows\System\vfbDaMx.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yoGMdZD.exe
  C:\Windows\System\yoGMdZD.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\lvFmYod.exe
  C:\Windows\System\lvFmYod.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\uKXssXz.exe
  C:\Windows\System\uKXssXz.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\hfZzPWF.exe
  C:\Windows\System\hfZzPWF.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\uKOBBjU.exe
  C:\Windows\System\uKOBBjU.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\shicOgk.exe
  C:\Windows\System\shicOgk.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\zEJJOZK.exe
  C:\Windows\System\zEJJOZK.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\LYcHzRI.exe
  C:\Windows\System\LYcHzRI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SBpckZb.exe
  C:\Windows\System\SBpckZb.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\SnHdxwH.exe
  C:\Windows\System\SnHdxwH.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QNjFnNn.exe
  C:\Windows\System\QNjFnNn.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\oWuoZay.exe
  C:\Windows\System\oWuoZay.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\khUxPvL.exe
  C:\Windows\System\khUxPvL.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LeDEQmb.exe
  C:\Windows\System\LeDEQmb.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\MZzQxkI.exe
  C:\Windows\System\MZzQxkI.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ujPxTZe.exe
  C:\Windows\System\ujPxTZe.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\tKdikuX.exe
  C:\Windows\System\tKdikuX.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\MjTAubf.exe
  C:\Windows\System\MjTAubf.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\uadSQXt.exe
  C:\Windows\System\uadSQXt.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\YORGfbY.exe
  C:\Windows\System\YORGfbY.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\YzdjOLu.exe
  C:\Windows\System\YzdjOLu.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\vIpNnZV.exe
  C:\Windows\System\vIpNnZV.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\fZOEDhd.exe
  C:\Windows\System\fZOEDhd.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\WMBTcQZ.exe
  C:\Windows\System\WMBTcQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\VUDBZOF.exe
  C:\Windows\System\VUDBZOF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\DbgOgiN.exe
  C:\Windows\System\DbgOgiN.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\WEflBoy.exe
  C:\Windows\System\WEflBoy.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\lwjpmoU.exe
  C:\Windows\System\lwjpmoU.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ZdNFmDy.exe
  C:\Windows\System\ZdNFmDy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\lAaEXNa.exe
  C:\Windows\System\lAaEXNa.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ByPLSzG.exe
  C:\Windows\System\ByPLSzG.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\HNswQuD.exe
  C:\Windows\System\HNswQuD.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\MEjRIUU.exe
  C:\Windows\System\MEjRIUU.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UiDwpAj.exe
  C:\Windows\System\UiDwpAj.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vurjZNf.exe
  C:\Windows\System\vurjZNf.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\sntqrHI.exe
  C:\Windows\System\sntqrHI.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\jpbtiXj.exe
  C:\Windows\System\jpbtiXj.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\msJyhXJ.exe
  C:\Windows\System\msJyhXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\uDRMQtI.exe
  C:\Windows\System\uDRMQtI.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\QYzOgez.exe
  C:\Windows\System\QYzOgez.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\kIivAoA.exe
  C:\Windows\System\kIivAoA.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\ICdpZsa.exe
  C:\Windows\System\ICdpZsa.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\GcixfqO.exe
  C:\Windows\System\GcixfqO.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mpZKkMZ.exe
  C:\Windows\System\mpZKkMZ.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\aKEcZaa.exe
  C:\Windows\System\aKEcZaa.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\qqhEzKH.exe
  C:\Windows\System\qqhEzKH.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\iVEaGLP.exe
  C:\Windows\System\iVEaGLP.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\cZehFEK.exe
  C:\Windows\System\cZehFEK.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\SLNpiDO.exe
  C:\Windows\System\SLNpiDO.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\GuHnYme.exe
  C:\Windows\System\GuHnYme.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\DFJwRrj.exe
  C:\Windows\System\DFJwRrj.exe
  2⤵
  PID:2112
- C:\Windows\System\TybhEEB.exe
  C:\Windows\System\TybhEEB.exe
  2⤵
  PID:2144
- C:\Windows\System\NNjvQlR.exe
  C:\Windows\System\NNjvQlR.exe
  2⤵
  PID:1040
- C:\Windows\System\PkXdhWH.exe
  C:\Windows\System\PkXdhWH.exe
  2⤵
  PID:2504
- C:\Windows\System\qhctJig.exe
  C:\Windows\System\qhctJig.exe
  2⤵
  PID:2532
- C:\Windows\System\WqbVVYC.exe
  C:\Windows\System\WqbVVYC.exe
  2⤵
  PID:828
- C:\Windows\System\kHKLkBW.exe
  C:\Windows\System\kHKLkBW.exe
  2⤵
  PID:880
- C:\Windows\System\nqGVgIr.exe
  C:\Windows\System\nqGVgIr.exe
  2⤵
  PID:2536
- C:\Windows\System\JTwAgUa.exe
  C:\Windows\System\JTwAgUa.exe
  2⤵
  PID:2156
- C:\Windows\System\eLToxKX.exe
  C:\Windows\System\eLToxKX.exe
  2⤵
  PID:296
- C:\Windows\System\YjzMfZX.exe
  C:\Windows\System\YjzMfZX.exe
  2⤵
  PID:2100
- C:\Windows\System\YyQeYXZ.exe
  C:\Windows\System\YyQeYXZ.exe
  2⤵
  PID:3048
- C:\Windows\System\npOeEBf.exe
  C:\Windows\System\npOeEBf.exe
  2⤵
  PID:1908
- C:\Windows\System\lgDKSrm.exe
  C:\Windows\System\lgDKSrm.exe
  2⤵
  PID:2500
- C:\Windows\System\WlDFwTb.exe
  C:\Windows\System\WlDFwTb.exe
  2⤵
  PID:2540
- C:\Windows\System\Pfzflqx.exe
  C:\Windows\System\Pfzflqx.exe
  2⤵
  PID:2288
- C:\Windows\System\oZqEQmF.exe
  C:\Windows\System\oZqEQmF.exe
  2⤵
  PID:1592
- C:\Windows\System\ULDfPEb.exe
  C:\Windows\System\ULDfPEb.exe
  2⤵
  PID:1512
- C:\Windows\System\aItDjPi.exe
  C:\Windows\System\aItDjPi.exe
  2⤵
  PID:2264
- C:\Windows\System\ySgPlYr.exe
  C:\Windows\System\ySgPlYr.exe
  2⤵
  PID:2776
- C:\Windows\System\qAqgJUY.exe
  C:\Windows\System\qAqgJUY.exe
  2⤵
  PID:2728
- C:\Windows\System\bvYgbuQ.exe
  C:\Windows\System\bvYgbuQ.exe
  2⤵
  PID:2840
- C:\Windows\System\TVRHYqJ.exe
  C:\Windows\System\TVRHYqJ.exe
  2⤵
  PID:2676
- C:\Windows\System\xduiYWz.exe
  C:\Windows\System\xduiYWz.exe
  2⤵
  PID:2812
- C:\Windows\System\MLqxWqI.exe
  C:\Windows\System\MLqxWqI.exe
  2⤵
  PID:3068
- C:\Windows\System\mNnbtrC.exe
  C:\Windows\System\mNnbtrC.exe
  2⤵
  PID:2056
- C:\Windows\System\RWwlvlp.exe
  C:\Windows\System\RWwlvlp.exe
  2⤵
  PID:2160
- C:\Windows\System\UwWWYxP.exe
  C:\Windows\System\UwWWYxP.exe
  2⤵
  PID:1968
- C:\Windows\System\hkKLzmf.exe
  C:\Windows\System\hkKLzmf.exe
  2⤵
  PID:1648
- C:\Windows\System\fPiVmgh.exe
  C:\Windows\System\fPiVmgh.exe
  2⤵
  PID:2028
- C:\Windows\System\TFVJkyo.exe
  C:\Windows\System\TFVJkyo.exe
  2⤵
  PID:1768
- C:\Windows\System\lFBJyyZ.exe
  C:\Windows\System\lFBJyyZ.exe
  2⤵
  PID:2636
- C:\Windows\System\MpdmGqh.exe
  C:\Windows\System\MpdmGqh.exe
  2⤵
  PID:324
- C:\Windows\System\xbRFcCz.exe
  C:\Windows\System\xbRFcCz.exe
  2⤵
  PID:2916
- C:\Windows\System\FYVbQtz.exe
  C:\Windows\System\FYVbQtz.exe
  2⤵
  PID:2436
- C:\Windows\System\jmOBDsR.exe
  C:\Windows\System\jmOBDsR.exe
  2⤵
  PID:2820
- C:\Windows\System\MgMKRLL.exe
  C:\Windows\System\MgMKRLL.exe
  2⤵
  PID:1560
- C:\Windows\System\mOyDXBQ.exe
  C:\Windows\System\mOyDXBQ.exe
  2⤵
  PID:404
- C:\Windows\System\nZggFIW.exe
  C:\Windows\System\nZggFIW.exe
  2⤵
  PID:2176
- C:\Windows\System\sBSXYSe.exe
  C:\Windows\System\sBSXYSe.exe
  2⤵
  PID:1296
- C:\Windows\System\vnQtkfD.exe
  C:\Windows\System\vnQtkfD.exe
  2⤵
  PID:956
- C:\Windows\System\PVYsoXK.exe
  C:\Windows\System\PVYsoXK.exe
  2⤵
  PID:2768
- C:\Windows\System\ZjUusYa.exe
  C:\Windows\System\ZjUusYa.exe
  2⤵
  PID:1796
- C:\Windows\System\DvrjnRa.exe
  C:\Windows\System\DvrjnRa.exe
  2⤵
  PID:896
- C:\Windows\System\ceBFYOa.exe
  C:\Windows\System\ceBFYOa.exe
  2⤵
  PID:2328
- C:\Windows\System\wuUQhLG.exe
  C:\Windows\System\wuUQhLG.exe
  2⤵
  PID:604
- C:\Windows\System\Pujkutn.exe
  C:\Windows\System\Pujkutn.exe
  2⤵
  PID:2828
- C:\Windows\System\ujjUIfF.exe
  C:\Windows\System\ujjUIfF.exe
  2⤵
  PID:980
- C:\Windows\System\QTRHIec.exe
  C:\Windows\System\QTRHIec.exe
  2⤵
  PID:2136
- C:\Windows\System\GzjfLFO.exe
  C:\Windows\System\GzjfLFO.exe
  2⤵
  PID:2044
- C:\Windows\System\yeZMxit.exe
  C:\Windows\System\yeZMxit.exe
  2⤵
  PID:1488
- C:\Windows\System\piaFXiU.exe
  C:\Windows\System\piaFXiU.exe
  2⤵
  PID:768
- C:\Windows\System\HvAqJxg.exe
  C:\Windows\System\HvAqJxg.exe
  2⤵
  PID:1580
- C:\Windows\System\RchQPWr.exe
  C:\Windows\System\RchQPWr.exe
  2⤵
  PID:1184
- C:\Windows\System\JoqoNGP.exe
  C:\Windows\System\JoqoNGP.exe
  2⤵
  PID:2104
- C:\Windows\System\VOLQFCm.exe
  C:\Windows\System\VOLQFCm.exe
  2⤵
  PID:2080
- C:\Windows\System\yWeEzsg.exe
  C:\Windows\System\yWeEzsg.exe
  2⤵
  PID:2032
- C:\Windows\System\lCkfiLw.exe
  C:\Windows\System\lCkfiLw.exe
  2⤵
  PID:2792
- C:\Windows\System\UcJMfGq.exe
  C:\Windows\System\UcJMfGq.exe
  2⤵
  PID:2856
- C:\Windows\System\PAqlYWU.exe
  C:\Windows\System\PAqlYWU.exe
  2⤵
  PID:2748
- C:\Windows\System\CryiXNy.exe
  C:\Windows\System\CryiXNy.exe
  2⤵
  PID:1940
- C:\Windows\System\NlusBkH.exe
  C:\Windows\System\NlusBkH.exe
  2⤵
  PID:1952
- C:\Windows\System\moLVVmm.exe
  C:\Windows\System\moLVVmm.exe
  2⤵
  PID:1276
- C:\Windows\System\AdKXNne.exe
  C:\Windows\System\AdKXNne.exe
  2⤵
  PID:804
- C:\Windows\System\DSXIbdD.exe
  C:\Windows\System\DSXIbdD.exe
  2⤵
  PID:2900
- C:\Windows\System\fFbyRmk.exe
  C:\Windows\System\fFbyRmk.exe
  2⤵
  PID:2912
- C:\Windows\System\dUyQlnL.exe
  C:\Windows\System\dUyQlnL.exe
  2⤵
  PID:1084
- C:\Windows\System\oouFYPT.exe
  C:\Windows\System\oouFYPT.exe
  2⤵
  PID:2344
- C:\Windows\System\IpoSSCE.exe
  C:\Windows\System\IpoSSCE.exe
  2⤵
  PID:492
- C:\Windows\System\fmmenUd.exe
  C:\Windows\System\fmmenUd.exe
  2⤵
  PID:1672
- C:\Windows\System\qEXIBEJ.exe
  C:\Windows\System\qEXIBEJ.exe
  2⤵
  PID:3040
- C:\Windows\System\PrnohvN.exe
  C:\Windows\System\PrnohvN.exe
  2⤵
  PID:2544
- C:\Windows\System\ftijQUY.exe
  C:\Windows\System\ftijQUY.exe
  2⤵
  PID:1240
- C:\Windows\System\ktKadyw.exe
  C:\Windows\System\ktKadyw.exe
  2⤵
  PID:2476
- C:\Windows\System\FGAcbPC.exe
  C:\Windows\System\FGAcbPC.exe
  2⤵
  PID:3084
- C:\Windows\System\eNiDEoe.exe
  C:\Windows\System\eNiDEoe.exe
  2⤵
  PID:3100
- C:\Windows\System\tEDdnIX.exe
  C:\Windows\System\tEDdnIX.exe
  2⤵
  PID:3116
- C:\Windows\System\aBYchAW.exe
  C:\Windows\System\aBYchAW.exe
  2⤵
  PID:3140
- C:\Windows\System\TSOYtaS.exe
  C:\Windows\System\TSOYtaS.exe
  2⤵
  PID:3156
- C:\Windows\System\bNzaPny.exe
  C:\Windows\System\bNzaPny.exe
  2⤵
  PID:3172
- C:\Windows\System\ncXRWOq.exe
  C:\Windows\System\ncXRWOq.exe
  2⤵
  PID:3188
- C:\Windows\System\qmclTRS.exe
  C:\Windows\System\qmclTRS.exe
  2⤵
  PID:3208
- C:\Windows\System\kzHcemd.exe
  C:\Windows\System\kzHcemd.exe
  2⤵
  PID:3232
- C:\Windows\System\YGsyWWe.exe
  C:\Windows\System\YGsyWWe.exe
  2⤵
  PID:3256
- C:\Windows\System\olzeMdH.exe
  C:\Windows\System\olzeMdH.exe
  2⤵
  PID:3272
- C:\Windows\System\fdGWBJE.exe
  C:\Windows\System\fdGWBJE.exe
  2⤵
  PID:3288
- C:\Windows\System\EVayzBK.exe
  C:\Windows\System\EVayzBK.exe
  2⤵
  PID:3304
- C:\Windows\System\KoEqMcE.exe
  C:\Windows\System\KoEqMcE.exe
  2⤵
  PID:3320
- C:\Windows\System\EsHanJn.exe
  C:\Windows\System\EsHanJn.exe
  2⤵
  PID:3340
- C:\Windows\System\yubYlYb.exe
  C:\Windows\System\yubYlYb.exe
  2⤵
  PID:3356
- C:\Windows\System\sAOIXHo.exe
  C:\Windows\System\sAOIXHo.exe
  2⤵
  PID:3372
- C:\Windows\System\dfHupZC.exe
  C:\Windows\System\dfHupZC.exe
  2⤵
  PID:3388
- C:\Windows\System\RFQcMID.exe
  C:\Windows\System\RFQcMID.exe
  2⤵
  PID:3404
- C:\Windows\System\jTKOGRH.exe
  C:\Windows\System\jTKOGRH.exe
  2⤵
  PID:3420
- C:\Windows\System\aguBRLs.exe
  C:\Windows\System\aguBRLs.exe
  2⤵
  PID:3436
- C:\Windows\System\NptZmRZ.exe
  C:\Windows\System\NptZmRZ.exe
  2⤵
  PID:3452
- C:\Windows\System\XMOCrGp.exe
  C:\Windows\System\XMOCrGp.exe
  2⤵
  PID:3468
- C:\Windows\System\hZxnRVX.exe
  C:\Windows\System\hZxnRVX.exe
  2⤵
  PID:3484
- C:\Windows\System\MirJBzi.exe
  C:\Windows\System\MirJBzi.exe
  2⤵
  PID:3500
- C:\Windows\System\jYDytQc.exe
  C:\Windows\System\jYDytQc.exe
  2⤵
  PID:3516
- C:\Windows\System\LFaCwtj.exe
  C:\Windows\System\LFaCwtj.exe
  2⤵
  PID:3532
- C:\Windows\System\SInIDsa.exe
  C:\Windows\System\SInIDsa.exe
  2⤵
  PID:3548
- C:\Windows\System\VKfUswz.exe
  C:\Windows\System\VKfUswz.exe
  2⤵
  PID:3564
- C:\Windows\System\jVejZVN.exe
  C:\Windows\System\jVejZVN.exe
  2⤵
  PID:3580
- C:\Windows\System\YZybNDK.exe
  C:\Windows\System\YZybNDK.exe
  2⤵
  PID:3596
- C:\Windows\System\ikIiuFF.exe
  C:\Windows\System\ikIiuFF.exe
  2⤵
  PID:3612
- C:\Windows\System\sijhnbb.exe
  C:\Windows\System\sijhnbb.exe
  2⤵
  PID:3628
- C:\Windows\System\NHpWofg.exe
  C:\Windows\System\NHpWofg.exe
  2⤵
  PID:3644
- C:\Windows\System\mrdSHcH.exe
  C:\Windows\System\mrdSHcH.exe
  2⤵
  PID:3660
- C:\Windows\System\mTSqRxL.exe
  C:\Windows\System\mTSqRxL.exe
  2⤵
  PID:3676
- C:\Windows\System\OBQiGOu.exe
  C:\Windows\System\OBQiGOu.exe
  2⤵
  PID:3692
- C:\Windows\System\DuxbUxh.exe
  C:\Windows\System\DuxbUxh.exe
  2⤵
  PID:3708
- C:\Windows\System\pwQpeBR.exe
  C:\Windows\System\pwQpeBR.exe
  2⤵
  PID:3724
- C:\Windows\System\KUbLbCl.exe
  C:\Windows\System\KUbLbCl.exe
  2⤵
  PID:3740
- C:\Windows\System\EYjeDZJ.exe
  C:\Windows\System\EYjeDZJ.exe
  2⤵
  PID:3756
- C:\Windows\System\JwElbGZ.exe
  C:\Windows\System\JwElbGZ.exe
  2⤵
  PID:3772
- C:\Windows\System\NtufChl.exe
  C:\Windows\System\NtufChl.exe
  2⤵
  PID:3788
- C:\Windows\System\XQlCtrT.exe
  C:\Windows\System\XQlCtrT.exe
  2⤵
  PID:3804
- C:\Windows\System\SLcJFVi.exe
  C:\Windows\System\SLcJFVi.exe
  2⤵
  PID:3820
- C:\Windows\System\xgFNlMQ.exe
  C:\Windows\System\xgFNlMQ.exe
  2⤵
  PID:3836
- C:\Windows\System\znXrSPe.exe
  C:\Windows\System\znXrSPe.exe
  2⤵
  PID:3852
- C:\Windows\System\mPBgJKg.exe
  C:\Windows\System\mPBgJKg.exe
  2⤵
  PID:3868
- C:\Windows\System\EqZiuWM.exe
  C:\Windows\System\EqZiuWM.exe
  2⤵
  PID:3884
- C:\Windows\System\pPHDDHk.exe
  C:\Windows\System\pPHDDHk.exe
  2⤵
  PID:3900
- C:\Windows\System\kHvkdOn.exe
  C:\Windows\System\kHvkdOn.exe
  2⤵
  PID:3916
- C:\Windows\System\JpOTONe.exe
  C:\Windows\System\JpOTONe.exe
  2⤵
  PID:3932
- C:\Windows\System\HITxBqK.exe
  C:\Windows\System\HITxBqK.exe
  2⤵
  PID:3948
- C:\Windows\System\YpkqDIw.exe
  C:\Windows\System\YpkqDIw.exe
  2⤵
  PID:3964
- C:\Windows\System\kGKMTYK.exe
  C:\Windows\System\kGKMTYK.exe
  2⤵
  PID:3980
- C:\Windows\System\yTLOWZV.exe
  C:\Windows\System\yTLOWZV.exe
  2⤵
  PID:3996
- C:\Windows\System\HxsQHdG.exe
  C:\Windows\System\HxsQHdG.exe
  2⤵
  PID:4012
- C:\Windows\System\iEGeNOV.exe
  C:\Windows\System\iEGeNOV.exe
  2⤵
  PID:4028
- C:\Windows\System\tCcmrxe.exe
  C:\Windows\System\tCcmrxe.exe
  2⤵
  PID:4044
- C:\Windows\System\ZuyfLWj.exe
  C:\Windows\System\ZuyfLWj.exe
  2⤵
  PID:4060
- C:\Windows\System\oYSKVZA.exe
  C:\Windows\System\oYSKVZA.exe
  2⤵
  PID:4076
- C:\Windows\System\VaPwGuo.exe
  C:\Windows\System\VaPwGuo.exe
  2⤵
  PID:4092
- C:\Windows\System\sXcLiVx.exe
  C:\Windows\System\sXcLiVx.exe
  2⤵
  PID:3052
- C:\Windows\System\pwzjmne.exe
  C:\Windows\System\pwzjmne.exe
  2⤵
  PID:1588
- C:\Windows\System\hmIGvMO.exe
  C:\Windows\System\hmIGvMO.exe
  2⤵
  PID:2060
- C:\Windows\System\QwQBmGS.exe
  C:\Windows\System\QwQBmGS.exe
  2⤵
  PID:2680
- C:\Windows\System\KkjrNmN.exe
  C:\Windows\System\KkjrNmN.exe
  2⤵
  PID:2616
- C:\Windows\System\ImeAmPJ.exe
  C:\Windows\System\ImeAmPJ.exe
  2⤵
  PID:2336
- C:\Windows\System\gaCLEmw.exe
  C:\Windows\System\gaCLEmw.exe
  2⤵
  PID:2876
- C:\Windows\System\MJnYoPU.exe
  C:\Windows\System\MJnYoPU.exe
  2⤵
  PID:2148
- C:\Windows\System\dydqzvt.exe
  C:\Windows\System\dydqzvt.exe
  2⤵
  PID:1976
- C:\Windows\System\NZEfHHS.exe
  C:\Windows\System\NZEfHHS.exe
  2⤵
  PID:2348
- C:\Windows\System\AgYzctN.exe
  C:\Windows\System\AgYzctN.exe
  2⤵
  PID:2188
- C:\Windows\System\ylECaZP.exe
  C:\Windows\System\ylECaZP.exe
  2⤵
  PID:796
- C:\Windows\System\UAKLHjT.exe
  C:\Windows\System\UAKLHjT.exe
  2⤵
  PID:1476
- C:\Windows\System\TyMMRZD.exe
  C:\Windows\System\TyMMRZD.exe
  2⤵
  PID:3112
- C:\Windows\System\JEoyQNy.exe
  C:\Windows\System\JEoyQNy.exe
  2⤵
  PID:3152
- C:\Windows\System\oNFBgKP.exe
  C:\Windows\System\oNFBgKP.exe
  2⤵
  PID:3196
- C:\Windows\System\VVYMaiS.exe
  C:\Windows\System\VVYMaiS.exe
  2⤵
  PID:3240
- C:\Windows\System\cBGHdUh.exe
  C:\Windows\System\cBGHdUh.exe
  2⤵
  PID:3264
- C:\Windows\System\BjQljAQ.exe
  C:\Windows\System\BjQljAQ.exe
  2⤵
  PID:3296
- C:\Windows\System\OAdRdjI.exe
  C:\Windows\System\OAdRdjI.exe
  2⤵
  PID:3348
- C:\Windows\System\iYtbmNg.exe
  C:\Windows\System\iYtbmNg.exe
  2⤵
  PID:3364
- C:\Windows\System\ouzQgfk.exe
  C:\Windows\System\ouzQgfk.exe
  2⤵
  PID:3368
- C:\Windows\System\dKMFBjb.exe
  C:\Windows\System\dKMFBjb.exe
  2⤵
  PID:3400
- C:\Windows\System\GytAxXJ.exe
  C:\Windows\System\GytAxXJ.exe
  2⤵
  PID:2804
- C:\Windows\System\CqwyiYv.exe
  C:\Windows\System\CqwyiYv.exe
  2⤵
  PID:3460
- C:\Windows\System\DqwUaPQ.exe
  C:\Windows\System\DqwUaPQ.exe
  2⤵
  PID:3492
- C:\Windows\System\tppunFh.exe
  C:\Windows\System\tppunFh.exe
  2⤵
  PID:3512
- C:\Windows\System\LBinpia.exe
  C:\Windows\System\LBinpia.exe
  2⤵
  PID:3524
- C:\Windows\System\hcrpnGr.exe
  C:\Windows\System\hcrpnGr.exe
  2⤵
  PID:3572
- C:\Windows\System\OpuOOZE.exe
  C:\Windows\System\OpuOOZE.exe
  2⤵
  PID:3604
- C:\Windows\System\neGMsej.exe
  C:\Windows\System\neGMsej.exe
  2⤵
  PID:3636
- C:\Windows\System\JeSpCvM.exe
  C:\Windows\System\JeSpCvM.exe
  2⤵
  PID:2692
- C:\Windows\System\aLVFIdF.exe
  C:\Windows\System\aLVFIdF.exe
  2⤵
  PID:2868
- C:\Windows\System\gIXeIYi.exe
  C:\Windows\System\gIXeIYi.exe
  2⤵
  PID:3704
- C:\Windows\System\YLcvtbS.exe
  C:\Windows\System\YLcvtbS.exe
  2⤵
  PID:3736
- C:\Windows\System\fRwOPOy.exe
  C:\Windows\System\fRwOPOy.exe
  2⤵
  PID:3780
- C:\Windows\System\WOFRiuF.exe
  C:\Windows\System\WOFRiuF.exe
  2⤵
  PID:2896
- C:\Windows\System\cjEjrQU.exe
  C:\Windows\System\cjEjrQU.exe
  2⤵
  PID:3844
- C:\Windows\System\UzjOUes.exe
  C:\Windows\System\UzjOUes.exe
  2⤵
  PID:3876
- C:\Windows\System\WfusIYy.exe
  C:\Windows\System\WfusIYy.exe
  2⤵
  PID:3896
- C:\Windows\System\FYdqBNo.exe
  C:\Windows\System\FYdqBNo.exe
  2⤵
  PID:3912
- C:\Windows\System\peXpfbe.exe
  C:\Windows\System\peXpfbe.exe
  2⤵
  PID:3944
- C:\Windows\System\rgfDOUS.exe
  C:\Windows\System\rgfDOUS.exe
  2⤵
  PID:3976
- C:\Windows\System\ZeTVqcW.exe
  C:\Windows\System\ZeTVqcW.exe
  2⤵
  PID:4036
- C:\Windows\System\yBDHzEU.exe
  C:\Windows\System\yBDHzEU.exe
  2⤵
  PID:4068
- C:\Windows\System\BQWVsSV.exe
  C:\Windows\System\BQWVsSV.exe
  2⤵
  PID:2596
- C:\Windows\System\XrTcTyP.exe
  C:\Windows\System\XrTcTyP.exe
  2⤵
  PID:2260
- C:\Windows\System\LkdVVSv.exe
  C:\Windows\System\LkdVVSv.exe
  2⤵
  PID:3020
- C:\Windows\System\TftDeFe.exe
  C:\Windows\System\TftDeFe.exe
  2⤵
  PID:2612
- C:\Windows\System\pnunvkt.exe
  C:\Windows\System\pnunvkt.exe
  2⤵
  PID:1728
- C:\Windows\System\ebgWcpn.exe
  C:\Windows\System\ebgWcpn.exe
  2⤵
  PID:2452
- C:\Windows\System\SMNFgpg.exe
  C:\Windows\System\SMNFgpg.exe
  2⤵
  PID:1784
- C:\Windows\System\ZQwpPnM.exe
  C:\Windows\System\ZQwpPnM.exe
  2⤵
  PID:976
- C:\Windows\System\aggPBgA.exe
  C:\Windows\System\aggPBgA.exe
  2⤵
  PID:2168
- C:\Windows\System\IcDtgUV.exe
  C:\Windows\System\IcDtgUV.exe
  2⤵
  PID:2092
- C:\Windows\System\zTxwNIj.exe
  C:\Windows\System\zTxwNIj.exe
  2⤵
  PID:3168
- C:\Windows\System\ZSblRJU.exe
  C:\Windows\System\ZSblRJU.exe
  2⤵
  PID:3200
- C:\Windows\System\bmdozfT.exe
  C:\Windows\System\bmdozfT.exe
  2⤵
  PID:2116
- C:\Windows\System\vTGKxzO.exe
  C:\Windows\System\vTGKxzO.exe
  2⤵
  PID:3284
- C:\Windows\System\MorAsjr.exe
  C:\Windows\System\MorAsjr.exe
  2⤵
  PID:1704
- C:\Windows\System\HBaIoQZ.exe
  C:\Windows\System\HBaIoQZ.exe
  2⤵
  PID:3380
- C:\Windows\System\LarZxCQ.exe
  C:\Windows\System\LarZxCQ.exe
  2⤵
  PID:1992
- C:\Windows\System\mYeVevF.exe
  C:\Windows\System\mYeVevF.exe
  2⤵
  PID:3412
- C:\Windows\System\aqDcXYF.exe
  C:\Windows\System\aqDcXYF.exe
  2⤵
  PID:3432
- C:\Windows\System\KdTXGfi.exe
  C:\Windows\System\KdTXGfi.exe
  2⤵
  PID:3448
- C:\Windows\System\cxEDaXh.exe
  C:\Windows\System\cxEDaXh.exe
  2⤵
  PID:3588
- C:\Windows\System\KkzAwiX.exe
  C:\Windows\System\KkzAwiX.exe
  2⤵
  PID:3496
- C:\Windows\System\KboPzal.exe
  C:\Windows\System\KboPzal.exe
  2⤵
  PID:3592
- C:\Windows\System\xWfUwAo.exe
  C:\Windows\System\xWfUwAo.exe
  2⤵
  PID:3656
- C:\Windows\System\iWtgloI.exe
  C:\Windows\System\iWtgloI.exe
  2⤵
  PID:3768
- C:\Windows\System\kCXfyNe.exe
  C:\Windows\System\kCXfyNe.exe
  2⤵
  PID:3832
- C:\Windows\System\AXyVyXv.exe
  C:\Windows\System\AXyVyXv.exe
  2⤵
  PID:3940
- C:\Windows\System\gYwwhmM.exe
  C:\Windows\System\gYwwhmM.exe
  2⤵
  PID:3972
- C:\Windows\System\mTTGLfb.exe
  C:\Windows\System\mTTGLfb.exe
  2⤵
  PID:3848
- C:\Windows\System\fnwJLfy.exe
  C:\Windows\System\fnwJLfy.exe
  2⤵
  PID:2836
- C:\Windows\System\sBqrLKb.exe
  C:\Windows\System\sBqrLKb.exe
  2⤵
  PID:2488
- C:\Windows\System\KNQueoE.exe
  C:\Windows\System\KNQueoE.exe
  2⤵
  PID:3800
- C:\Windows\System\jAEvcPZ.exe
  C:\Windows\System\jAEvcPZ.exe
  2⤵
  PID:1036
- C:\Windows\System\erDyLrt.exe
  C:\Windows\System\erDyLrt.exe
  2⤵
  PID:1800
- C:\Windows\System\FkxGUPy.exe
  C:\Windows\System\FkxGUPy.exe
  2⤵
  PID:1996
- C:\Windows\System\iqTCwEN.exe
  C:\Windows\System\iqTCwEN.exe
  2⤵
  PID:3124
- C:\Windows\System\VVVGqsV.exe
  C:\Windows\System\VVVGqsV.exe
  2⤵
  PID:2240
- C:\Windows\System\oVdVcNN.exe
  C:\Windows\System\oVdVcNN.exe
  2⤵
  PID:3280
- C:\Windows\System\YaUCnmt.exe
  C:\Windows\System\YaUCnmt.exe
  2⤵
  PID:1636
- C:\Windows\System\NIJGQaO.exe
  C:\Windows\System\NIJGQaO.exe
  2⤵
  PID:1856
- C:\Windows\System\dJWSJjc.exe
  C:\Windows\System\dJWSJjc.exe
  2⤵
  PID:1788
- C:\Windows\System\YszOLPy.exe
  C:\Windows\System\YszOLPy.exe
  2⤵
  PID:3556
- C:\Windows\System\SlsRNRO.exe
  C:\Windows\System\SlsRNRO.exe
  2⤵
  PID:2688
- C:\Windows\System\BMDTPHF.exe
  C:\Windows\System\BMDTPHF.exe
  2⤵
  PID:2940
- C:\Windows\System\XjyAvgn.exe
  C:\Windows\System\XjyAvgn.exe
  2⤵
  PID:3732
- C:\Windows\System\EmWmoqe.exe
  C:\Windows\System\EmWmoqe.exe
  2⤵
  PID:4088
- C:\Windows\System\LDudDdz.exe
  C:\Windows\System\LDudDdz.exe
  2⤵
  PID:1556
- C:\Windows\System\kcYXPHU.exe
  C:\Windows\System\kcYXPHU.exe
  2⤵
  PID:3028
- C:\Windows\System\GPyovzt.exe
  C:\Windows\System\GPyovzt.exe
  2⤵
  PID:3216
- C:\Windows\System\xuPUSZm.exe
  C:\Windows\System\xuPUSZm.exe
  2⤵
  PID:1660
- C:\Windows\System\YhFSjeN.exe
  C:\Windows\System\YhFSjeN.exe
  2⤵
  PID:1772
- C:\Windows\System\vpZrRkn.exe
  C:\Windows\System\vpZrRkn.exe
  2⤵
  PID:3688
- C:\Windows\System\MyFNbpQ.exe
  C:\Windows\System\MyFNbpQ.exe
  2⤵
  PID:2600
- C:\Windows\System\PyJscex.exe
  C:\Windows\System\PyJscex.exe
  2⤵
  PID:3720
- C:\Windows\System\tUEfRrP.exe
  C:\Windows\System\tUEfRrP.exe
  2⤵
  PID:4040
- C:\Windows\System\YTkjZcl.exe
  C:\Windows\System\YTkjZcl.exe
  2⤵
  PID:1956
- C:\Windows\System\eHsijNM.exe
  C:\Windows\System\eHsijNM.exe
  2⤵
  PID:3464
- C:\Windows\System\TYaWxzV.exe
  C:\Windows\System\TYaWxzV.exe
  2⤵
  PID:1428
- C:\Windows\System\rJnsztL.exe
  C:\Windows\System\rJnsztL.exe
  2⤵
  PID:3640
- C:\Windows\System\GPqpXvf.exe
  C:\Windows\System\GPqpXvf.exe
  2⤵
  PID:3924
- C:\Windows\System\BPqSHsg.exe
  C:\Windows\System\BPqSHsg.exe
  2⤵
  PID:3672
- C:\Windows\System\lOviMeU.exe
  C:\Windows\System\lOviMeU.exe
  2⤵
  PID:4108
- C:\Windows\System\dTzyqIK.exe
  C:\Windows\System\dTzyqIK.exe
  2⤵
  PID:4124
- C:\Windows\System\hDvygPA.exe
  C:\Windows\System\hDvygPA.exe
  2⤵
  PID:4140
- C:\Windows\System\jDAESLO.exe
  C:\Windows\System\jDAESLO.exe
  2⤵
  PID:4156
- C:\Windows\System\weWGXhM.exe
  C:\Windows\System\weWGXhM.exe
  2⤵
  PID:4172
- C:\Windows\System\btdTxXA.exe
  C:\Windows\System\btdTxXA.exe
  2⤵
  PID:4188
- C:\Windows\System\AQZgcsO.exe
  C:\Windows\System\AQZgcsO.exe
  2⤵
  PID:4204
- C:\Windows\System\LgSUeiz.exe
  C:\Windows\System\LgSUeiz.exe
  2⤵
  PID:4220
- C:\Windows\System\CtOebcX.exe
  C:\Windows\System\CtOebcX.exe
  2⤵
  PID:4236
- C:\Windows\System\zWxgfuL.exe
  C:\Windows\System\zWxgfuL.exe
  2⤵
  PID:4252
- C:\Windows\System\TjvJRYr.exe
  C:\Windows\System\TjvJRYr.exe
  2⤵
  PID:4268
- C:\Windows\System\vfzorRq.exe
  C:\Windows\System\vfzorRq.exe
  2⤵
  PID:4284
- C:\Windows\System\pMtGJMm.exe
  C:\Windows\System\pMtGJMm.exe
  2⤵
  PID:4300
- C:\Windows\System\THRpbsj.exe
  C:\Windows\System\THRpbsj.exe
  2⤵
  PID:4316
- C:\Windows\System\KCxuhbu.exe
  C:\Windows\System\KCxuhbu.exe
  2⤵
  PID:4332
- C:\Windows\System\GzfcxQR.exe
  C:\Windows\System\GzfcxQR.exe
  2⤵
  PID:4348
- C:\Windows\System\ZLezqww.exe
  C:\Windows\System\ZLezqww.exe
  2⤵
  PID:4364
- C:\Windows\System\aLCiJlA.exe
  C:\Windows\System\aLCiJlA.exe
  2⤵
  PID:4380
- C:\Windows\System\oiYCWTN.exe
  C:\Windows\System\oiYCWTN.exe
  2⤵
  PID:4396
- C:\Windows\System\hRWzBTt.exe
  C:\Windows\System\hRWzBTt.exe
  2⤵
  PID:4412
- C:\Windows\System\IEIYVvl.exe
  C:\Windows\System\IEIYVvl.exe
  2⤵
  PID:4428
- C:\Windows\System\ofNCAqq.exe
  C:\Windows\System\ofNCAqq.exe
  2⤵
  PID:4444
- C:\Windows\System\nugkMUd.exe
  C:\Windows\System\nugkMUd.exe
  2⤵
  PID:4460
- C:\Windows\System\lIQtHDm.exe
  C:\Windows\System\lIQtHDm.exe
  2⤵
  PID:4476
- C:\Windows\System\GvFkoSx.exe
  C:\Windows\System\GvFkoSx.exe
  2⤵
  PID:4492
- C:\Windows\System\VVhqpsY.exe
  C:\Windows\System\VVhqpsY.exe
  2⤵
  PID:4508
- C:\Windows\System\exhfnKk.exe
  C:\Windows\System\exhfnKk.exe
  2⤵
  PID:4524
- C:\Windows\System\ouxNuSV.exe
  C:\Windows\System\ouxNuSV.exe
  2⤵
  PID:4540
- C:\Windows\System\NKVTVtO.exe
  C:\Windows\System\NKVTVtO.exe
  2⤵
  PID:4556
- C:\Windows\System\jqEwIrP.exe
  C:\Windows\System\jqEwIrP.exe
  2⤵
  PID:4572
- C:\Windows\System\DyIjCvq.exe
  C:\Windows\System\DyIjCvq.exe
  2⤵
  PID:4588
- C:\Windows\System\emiVbcV.exe
  C:\Windows\System\emiVbcV.exe
  2⤵
  PID:4604
- C:\Windows\System\EIjiKhx.exe
  C:\Windows\System\EIjiKhx.exe
  2⤵
  PID:4620
- C:\Windows\System\GwYcThj.exe
  C:\Windows\System\GwYcThj.exe
  2⤵
  PID:4636
- C:\Windows\System\mHmbFxP.exe
  C:\Windows\System\mHmbFxP.exe
  2⤵
  PID:4652
- C:\Windows\System\LBQrdfm.exe
  C:\Windows\System\LBQrdfm.exe
  2⤵
  PID:4684
- C:\Windows\System\oOIocWD.exe
  C:\Windows\System\oOIocWD.exe
  2⤵
  PID:4708
- C:\Windows\System\NUsJgEr.exe
  C:\Windows\System\NUsJgEr.exe
  2⤵
  PID:4724
- C:\Windows\System\uKbBYsm.exe
  C:\Windows\System\uKbBYsm.exe
  2⤵
  PID:4740
- C:\Windows\System\LPKvfIx.exe
  C:\Windows\System\LPKvfIx.exe
  2⤵
  PID:4760
- C:\Windows\System\ZrRskeL.exe
  C:\Windows\System\ZrRskeL.exe
  2⤵
  PID:4776
- C:\Windows\System\JXIrfvV.exe
  C:\Windows\System\JXIrfvV.exe
  2⤵
  PID:4796
- C:\Windows\System\DloWiOp.exe
  C:\Windows\System\DloWiOp.exe
  2⤵
  PID:4812
- C:\Windows\System\eUZBEcv.exe
  C:\Windows\System\eUZBEcv.exe
  2⤵
  PID:4828
- C:\Windows\System\zlkzDqP.exe
  C:\Windows\System\zlkzDqP.exe
  2⤵
  PID:4844
- C:\Windows\System\LJmRNfp.exe
  C:\Windows\System\LJmRNfp.exe
  2⤵
  PID:4860
- C:\Windows\System\gVvtaBq.exe
  C:\Windows\System\gVvtaBq.exe
  2⤵
  PID:4876
- C:\Windows\System\xXfWkyy.exe
  C:\Windows\System\xXfWkyy.exe
  2⤵
  PID:4892
- C:\Windows\System\hNmwKbs.exe
  C:\Windows\System\hNmwKbs.exe
  2⤵
  PID:4908
- C:\Windows\System\rTPzHGA.exe
  C:\Windows\System\rTPzHGA.exe
  2⤵
  PID:4924
- C:\Windows\System\CRjEGUH.exe
  C:\Windows\System\CRjEGUH.exe
  2⤵
  PID:4940
- C:\Windows\System\ScbHvXp.exe
  C:\Windows\System\ScbHvXp.exe
  2⤵
  PID:4956
- C:\Windows\System\juJSPSs.exe
  C:\Windows\System\juJSPSs.exe
  2⤵
  PID:4976
- C:\Windows\System\upzVoLz.exe
  C:\Windows\System\upzVoLz.exe
  2⤵
  PID:4996
- C:\Windows\System\FCeyoaI.exe
  C:\Windows\System\FCeyoaI.exe
  2⤵
  PID:5012
- C:\Windows\System\KZnfibT.exe
  C:\Windows\System\KZnfibT.exe
  2⤵
  PID:5028
- C:\Windows\System\IWFzqgW.exe
  C:\Windows\System\IWFzqgW.exe
  2⤵
  PID:5044
- C:\Windows\System\gCSEgxT.exe
  C:\Windows\System\gCSEgxT.exe
  2⤵
  PID:5060
- C:\Windows\System\ktSLgJJ.exe
  C:\Windows\System\ktSLgJJ.exe
  2⤵
  PID:5080
- C:\Windows\System\gmhJqAr.exe
  C:\Windows\System\gmhJqAr.exe
  2⤵
  PID:5096
- C:\Windows\System\mKTODGV.exe
  C:\Windows\System\mKTODGV.exe
  2⤵
  PID:5112
- C:\Windows\System\qlTGXDS.exe
  C:\Windows\System\qlTGXDS.exe
  2⤵
  PID:4116
- C:\Windows\System\fXsAqHY.exe
  C:\Windows\System\fXsAqHY.exe
  2⤵
  PID:4132
- C:\Windows\System\UoEuQUO.exe
  C:\Windows\System\UoEuQUO.exe
  2⤵
  PID:4164
- C:\Windows\System\IVWkrUr.exe
  C:\Windows\System\IVWkrUr.exe
  2⤵
  PID:4196
- C:\Windows\System\KzpYJWO.exe
  C:\Windows\System\KzpYJWO.exe
  2⤵
  PID:4228
- C:\Windows\System\iaCLOll.exe
  C:\Windows\System\iaCLOll.exe
  2⤵
  PID:4264
- C:\Windows\System\CqfcZRf.exe
  C:\Windows\System\CqfcZRf.exe
  2⤵
  PID:4376
- C:\Windows\System\NQnCNdg.exe
  C:\Windows\System\NQnCNdg.exe
  2⤵
  PID:4500
- C:\Windows\System\BUIsFEh.exe
  C:\Windows\System\BUIsFEh.exe
  2⤵
  PID:4628
- C:\Windows\System\RslxBUZ.exe
  C:\Windows\System\RslxBUZ.exe
  2⤵
  PID:4752
- C:\Windows\System\efVhIPS.exe
  C:\Windows\System\efVhIPS.exe
  2⤵
  PID:4792
- C:\Windows\System\NIsUZvv.exe
  C:\Windows\System\NIsUZvv.exe
  2⤵
  PID:4856
- C:\Windows\System\pKSTUwt.exe
  C:\Windows\System\pKSTUwt.exe
  2⤵
  PID:4736
- C:\Windows\System\EzWnToH.exe
  C:\Windows\System\EzWnToH.exe
  2⤵
  PID:4872
- C:\Windows\System\YhzBPnT.exe
  C:\Windows\System\YhzBPnT.exe
  2⤵
  PID:4916
- C:\Windows\System\WLoAsNn.exe
  C:\Windows\System\WLoAsNn.exe
  2⤵
  PID:4988
- C:\Windows\System\qwtoVDA.exe
  C:\Windows\System\qwtoVDA.exe
  2⤵
  PID:5052
- C:\Windows\System\LtbcXTi.exe
  C:\Windows\System\LtbcXTi.exe
  2⤵
  PID:5092
- C:\Windows\System\npvcqZJ.exe
  C:\Windows\System\npvcqZJ.exe
  2⤵
  PID:5036
- C:\Windows\System\NZayoca.exe
  C:\Windows\System\NZayoca.exe
  2⤵
  PID:4344
- C:\Windows\System\ZJdZERQ.exe
  C:\Windows\System\ZJdZERQ.exe
  2⤵
  PID:4452
- C:\Windows\System\qZdVPqa.exe
  C:\Windows\System\qZdVPqa.exe
  2⤵
  PID:4580
- C:\Windows\System\cXxGLdA.exe
  C:\Windows\System\cXxGLdA.exe
  2⤵
  PID:4696
- C:\Windows\System\HASXnBt.exe
  C:\Windows\System\HASXnBt.exe
  2⤵
  PID:4732
- C:\Windows\System\ZrDrJgh.exe
  C:\Windows\System\ZrDrJgh.exe
  2⤵
  PID:4804
- C:\Windows\System\ZrCNYaU.exe
  C:\Windows\System\ZrCNYaU.exe
  2⤵
  PID:4808
- C:\Windows\System\ooWmXCT.exe
  C:\Windows\System\ooWmXCT.exe
  2⤵
  PID:4952
- C:\Windows\System\AVrmVTs.exe
  C:\Windows\System\AVrmVTs.exe
  2⤵
  PID:5088
- C:\Windows\System\HDDKenJ.exe
  C:\Windows\System\HDDKenJ.exe
  2⤵
  PID:2224
- C:\Windows\System\JyHFuPZ.exe
  C:\Windows\System\JyHFuPZ.exe
  2⤵
  PID:4152
- C:\Windows\System\qRvyyFC.exe
  C:\Windows\System\qRvyyFC.exe
  2⤵
  PID:5072
- C:\Windows\System\fpggXOG.exe
  C:\Windows\System\fpggXOG.exe
  2⤵
  PID:4104
- C:\Windows\System\fHiuGKx.exe
  C:\Windows\System\fHiuGKx.exe
  2⤵
  PID:4184
- C:\Windows\System\GDtCUdo.exe
  C:\Windows\System\GDtCUdo.exe
  2⤵
  PID:4292
- C:\Windows\System\byvSgYo.exe
  C:\Windows\System\byvSgYo.exe
  2⤵
  PID:4340
- C:\Windows\System\LueBdfB.exe
  C:\Windows\System\LueBdfB.exe
  2⤵
  PID:4360
- C:\Windows\System\QSwWNpy.exe
  C:\Windows\System\QSwWNpy.exe
  2⤵
  PID:4420
- C:\Windows\System\MbPINJm.exe
  C:\Windows\System\MbPINJm.exe
  2⤵
  PID:4472
- C:\Windows\System\vNqzEci.exe
  C:\Windows\System\vNqzEci.exe
  2⤵
  PID:4520
- C:\Windows\System\NYldrLt.exe
  C:\Windows\System\NYldrLt.exe
  2⤵
  PID:4564
- C:\Windows\System\OVbUxNp.exe
  C:\Windows\System\OVbUxNp.exe
  2⤵
  PID:4644
- C:\Windows\System\XyQJBVG.exe
  C:\Windows\System\XyQJBVG.exe
  2⤵
  PID:4676
- C:\Windows\System\kXXOLLL.exe
  C:\Windows\System\kXXOLLL.exe
  2⤵
  PID:4648
- C:\Windows\System\sggltWb.exe
  C:\Windows\System\sggltWb.exe
  2⤵
  PID:4836
- C:\Windows\System\LwxdqSB.exe
  C:\Windows\System\LwxdqSB.exe
  2⤵
  PID:5076
- C:\Windows\System\rtqmAiJ.exe
  C:\Windows\System\rtqmAiJ.exe
  2⤵
  PID:4984
- C:\Windows\System\XSClcPZ.exe
  C:\Windows\System\XSClcPZ.exe
  2⤵
  PID:4148
- C:\Windows\System\GqZxxKf.exe
  C:\Windows\System\GqZxxKf.exe
  2⤵
  PID:4216
- C:\Windows\System\fMDvxIN.exe
  C:\Windows\System\fMDvxIN.exe
  2⤵
  PID:4100
- C:\Windows\System\TaNEzPi.exe
  C:\Windows\System\TaNEzPi.exe
  2⤵
  PID:4424
- C:\Windows\System\lIfiKXn.exe
  C:\Windows\System\lIfiKXn.exe
  2⤵
  PID:4392
- C:\Windows\System\NuZNEci.exe
  C:\Windows\System\NuZNEci.exe
  2⤵
  PID:4372
- C:\Windows\System\rktGFNz.exe
  C:\Windows\System\rktGFNz.exe
  2⤵
  PID:4552
- C:\Windows\System\lpmPdoP.exe
  C:\Windows\System\lpmPdoP.exe
  2⤵
  PID:4660
- C:\Windows\System\qYxWcFX.exe
  C:\Windows\System\qYxWcFX.exe
  2⤵
  PID:4700
- C:\Windows\System\uRPYyMl.exe
  C:\Windows\System\uRPYyMl.exe
  2⤵
  PID:4748
- C:\Windows\System\WDIzeJj.exe
  C:\Windows\System\WDIzeJj.exe
  2⤵
  PID:5104
- C:\Windows\System\bWECdgc.exe
  C:\Windows\System\bWECdgc.exe
  2⤵
  PID:4516
- C:\Windows\System\aeDLUgL.exe
  C:\Windows\System\aeDLUgL.exe
  2⤵
  PID:4668
- C:\Windows\System\eEDtVSc.exe
  C:\Windows\System\eEDtVSc.exe
  2⤵
  PID:4408
- C:\Windows\System\eXMCemi.exe
  C:\Windows\System\eXMCemi.exe
  2⤵
  PID:5068
- C:\Windows\System\qlHTDab.exe
  C:\Windows\System\qlHTDab.exe
  2⤵
  PID:4600
- C:\Windows\System\aSvBqRd.exe
  C:\Windows\System\aSvBqRd.exe
  2⤵
  PID:4716
- C:\Windows\System\mTpQYmd.exe
  C:\Windows\System\mTpQYmd.exe
  2⤵
  PID:4548
- C:\Windows\System\wDhvwIS.exe
  C:\Windows\System\wDhvwIS.exe
  2⤵
  PID:4720
- C:\Windows\System\FqIfwQF.exe
  C:\Windows\System\FqIfwQF.exe
  2⤵
  PID:4612
- C:\Windows\System\wYlEAQq.exe
  C:\Windows\System\wYlEAQq.exe
  2⤵
  PID:5128
- C:\Windows\System\WqcAKlf.exe
  C:\Windows\System\WqcAKlf.exe
  2⤵
  PID:5144
- C:\Windows\System\CATWyhw.exe
  C:\Windows\System\CATWyhw.exe
  2⤵
  PID:5164
- C:\Windows\System\WjsuTgv.exe
  C:\Windows\System\WjsuTgv.exe
  2⤵
  PID:5180
- C:\Windows\System\QEEQzpX.exe
  C:\Windows\System\QEEQzpX.exe
  2⤵
  PID:5196
- C:\Windows\System\buOGZPv.exe
  C:\Windows\System\buOGZPv.exe
  2⤵
  PID:5212
- C:\Windows\System\eMhoyMP.exe
  C:\Windows\System\eMhoyMP.exe
  2⤵
  PID:5228
- C:\Windows\System\KQLzcOi.exe
  C:\Windows\System\KQLzcOi.exe
  2⤵
  PID:5248
- C:\Windows\System\AfvsfMu.exe
  C:\Windows\System\AfvsfMu.exe
  2⤵
  PID:5264
- C:\Windows\System\piFsYdK.exe
  C:\Windows\System\piFsYdK.exe
  2⤵
  PID:5280
- C:\Windows\System\eDnXgzR.exe
  C:\Windows\System\eDnXgzR.exe
  2⤵
  PID:5296
- C:\Windows\System\PaMspEE.exe
  C:\Windows\System\PaMspEE.exe
  2⤵
  PID:5316
- C:\Windows\System\RjADtXr.exe
  C:\Windows\System\RjADtXr.exe
  2⤵
  PID:5332
- C:\Windows\System\rKEWeEP.exe
  C:\Windows\System\rKEWeEP.exe
  2⤵
  PID:5348
- C:\Windows\System\PLfGzyv.exe
  C:\Windows\System\PLfGzyv.exe
  2⤵
  PID:5364
- C:\Windows\System\swLfrRF.exe
  C:\Windows\System\swLfrRF.exe
  2⤵
  PID:5380
- C:\Windows\System\ChPKACX.exe
  C:\Windows\System\ChPKACX.exe
  2⤵
  PID:5400
- C:\Windows\System\nUpcOhV.exe
  C:\Windows\System\nUpcOhV.exe
  2⤵
  PID:5416
- C:\Windows\System\jjqUmGr.exe
  C:\Windows\System\jjqUmGr.exe
  2⤵
  PID:5440
- C:\Windows\System\vJpIogd.exe
  C:\Windows\System\vJpIogd.exe
  2⤵
  PID:5456
- C:\Windows\System\aaWaUav.exe
  C:\Windows\System\aaWaUav.exe
  2⤵
  PID:5472
- C:\Windows\System\dDNvbQc.exe
  C:\Windows\System\dDNvbQc.exe
  2⤵
  PID:5488
- C:\Windows\System\kUUyCht.exe
  C:\Windows\System\kUUyCht.exe
  2⤵
  PID:5508
- C:\Windows\System\DkoMKFh.exe
  C:\Windows\System\DkoMKFh.exe
  2⤵
  PID:5524
- C:\Windows\System\NeUOgNq.exe
  C:\Windows\System\NeUOgNq.exe
  2⤵
  PID:5540
- C:\Windows\System\wDTsaLQ.exe
  C:\Windows\System\wDTsaLQ.exe
  2⤵
  PID:5564
- C:\Windows\System\eYSyRwS.exe
  C:\Windows\System\eYSyRwS.exe
  2⤵
  PID:5580
- C:\Windows\System\DpPtKYj.exe
  C:\Windows\System\DpPtKYj.exe
  2⤵
  PID:5596
- C:\Windows\System\gUNArzV.exe
  C:\Windows\System\gUNArzV.exe
  2⤵
  PID:5620
- C:\Windows\System\MDwhPSt.exe
  C:\Windows\System\MDwhPSt.exe
  2⤵
  PID:5640
- C:\Windows\System\RNqakhX.exe
  C:\Windows\System\RNqakhX.exe
  2⤵
  PID:5656
- C:\Windows\System\GgjqJqs.exe
  C:\Windows\System\GgjqJqs.exe
  2⤵
  PID:5672
- C:\Windows\System\rRQdJQx.exe
  C:\Windows\System\rRQdJQx.exe
  2⤵
  PID:5692
- C:\Windows\System\MdTTAAt.exe
  C:\Windows\System\MdTTAAt.exe
  2⤵
  PID:5712
- C:\Windows\System\HIhRYTg.exe
  C:\Windows\System\HIhRYTg.exe
  2⤵
  PID:5728
- C:\Windows\System\EtnfEhz.exe
  C:\Windows\System\EtnfEhz.exe
  2⤵
  PID:5748
- C:\Windows\System\wGJIYGd.exe
  C:\Windows\System\wGJIYGd.exe
  2⤵
  PID:5772
- C:\Windows\System\HCgAkmJ.exe
  C:\Windows\System\HCgAkmJ.exe
  2⤵
  PID:5788
- C:\Windows\System\NdktxNU.exe
  C:\Windows\System\NdktxNU.exe
  2⤵
  PID:5804
- C:\Windows\System\UBOJpwO.exe
  C:\Windows\System\UBOJpwO.exe
  2⤵
  PID:5820
- C:\Windows\System\HgHoQei.exe
  C:\Windows\System\HgHoQei.exe
  2⤵
  PID:5836
- C:\Windows\System\SWyRKak.exe
  C:\Windows\System\SWyRKak.exe
  2⤵
  PID:5964
- C:\Windows\System\YEQbWmf.exe
  C:\Windows\System\YEQbWmf.exe
  2⤵
  PID:5984
- C:\Windows\System\ASEECiv.exe
  C:\Windows\System\ASEECiv.exe
  2⤵
  PID:6004
- C:\Windows\System\IozlrYn.exe
  C:\Windows\System\IozlrYn.exe
  2⤵
  PID:6032
- C:\Windows\System\NzIghrr.exe
  C:\Windows\System\NzIghrr.exe
  2⤵
  PID:6048
- C:\Windows\System\JXzAxNq.exe
  C:\Windows\System\JXzAxNq.exe
  2⤵
  PID:6064
- C:\Windows\System\STHTLQF.exe
  C:\Windows\System\STHTLQF.exe
  2⤵
  PID:6084
- C:\Windows\System\bjHOXnx.exe
  C:\Windows\System\bjHOXnx.exe
  2⤵
  PID:6100
- C:\Windows\System\WMAhGET.exe
  C:\Windows\System\WMAhGET.exe
  2⤵
  PID:6116
- C:\Windows\System\woAKqpy.exe
  C:\Windows\System\woAKqpy.exe
  2⤵
  PID:6132
- C:\Windows\System\LmfwFMY.exe
  C:\Windows\System\LmfwFMY.exe
  2⤵
  PID:5124
- C:\Windows\System\fcMyTcW.exe
  C:\Windows\System\fcMyTcW.exe
  2⤵
  PID:5160
- C:\Windows\System\IIjmuUF.exe
  C:\Windows\System\IIjmuUF.exe
  2⤵
  PID:5172
- C:\Windows\System\EfZozKH.exe
  C:\Windows\System\EfZozKH.exe
  2⤵
  PID:5436
- C:\Windows\System\NfTSEtn.exe
  C:\Windows\System\NfTSEtn.exe
  2⤵
  PID:5412
- C:\Windows\System\hZHuLRo.exe
  C:\Windows\System\hZHuLRo.exe
  2⤵
  PID:5484
- C:\Windows\System\vzNmsUH.exe
  C:\Windows\System\vzNmsUH.exe
  2⤵
  PID:5516
- C:\Windows\System\JRspGnY.exe
  C:\Windows\System\JRspGnY.exe
  2⤵
  PID:5572
- C:\Windows\System\TWnkiPR.exe
  C:\Windows\System\TWnkiPR.exe
  2⤵
  PID:5588
- C:\Windows\System\ooyhEHy.exe
  C:\Windows\System\ooyhEHy.exe
  2⤵
  PID:5560
- C:\Windows\System\BLvRTQH.exe
  C:\Windows\System\BLvRTQH.exe
  2⤵
  PID:5628
- C:\Windows\System\DKHHgRQ.exe
  C:\Windows\System\DKHHgRQ.exe
  2⤵
  PID:5684
- C:\Windows\System\SAJToLd.exe
  C:\Windows\System\SAJToLd.exe
  2⤵
  PID:5700
- C:\Windows\System\vZpptbP.exe
  C:\Windows\System\vZpptbP.exe
  2⤵
  PID:5724
- C:\Windows\System\mIBQWWA.exe
  C:\Windows\System\mIBQWWA.exe
  2⤵
  PID:5760
- C:\Windows\System\WkXBhlB.exe
  C:\Windows\System\WkXBhlB.exe
  2⤵
  PID:5736
- C:\Windows\System\rJiVFtm.exe
  C:\Windows\System\rJiVFtm.exe
  2⤵
  PID:5744
- C:\Windows\System\myBdvjK.exe
  C:\Windows\System\myBdvjK.exe
  2⤵
  PID:5780
- C:\Windows\System\YstXjrJ.exe
  C:\Windows\System\YstXjrJ.exe
  2⤵
  PID:5852
- C:\Windows\System\QmfmiMD.exe
  C:\Windows\System\QmfmiMD.exe
  2⤵
  PID:5888
- C:\Windows\System\vPxqdyb.exe
  C:\Windows\System\vPxqdyb.exe
  2⤵
  PID:5904
- C:\Windows\System\ASpxadf.exe
  C:\Windows\System\ASpxadf.exe
  2⤵
  PID:5928
- C:\Windows\System\TJsjvnZ.exe
  C:\Windows\System\TJsjvnZ.exe
  2⤵
  PID:5948
- C:\Windows\System\sHScJMt.exe
  C:\Windows\System\sHScJMt.exe
  2⤵
  PID:5960
- C:\Windows\System\UetrAbq.exe
  C:\Windows\System\UetrAbq.exe
  2⤵
  PID:5980
- C:\Windows\System\aZDSxha.exe
  C:\Windows\System\aZDSxha.exe
  2⤵
  PID:6012
- C:\Windows\System\sAVOhIz.exe
  C:\Windows\System\sAVOhIz.exe
  2⤵
  PID:6040
- C:\Windows\System\SYdqhBW.exe
  C:\Windows\System\SYdqhBW.exe
  2⤵
  PID:6072
- C:\Windows\System\RjwOpkQ.exe
  C:\Windows\System\RjwOpkQ.exe
  2⤵
  PID:6108
- C:\Windows\System\wuWWpil.exe
  C:\Windows\System\wuWWpil.exe
  2⤵
  PID:5156
- C:\Windows\System\AxXtFVC.exe
  C:\Windows\System\AxXtFVC.exe
  2⤵
  PID:5176
- C:\Windows\System\GVYMFZZ.exe
  C:\Windows\System\GVYMFZZ.exe
  2⤵
  PID:5260
- C:\Windows\System\iLINyFA.exe
  C:\Windows\System\iLINyFA.exe
  2⤵
  PID:5396
- C:\Windows\System\VMraCIA.exe
  C:\Windows\System\VMraCIA.exe
  2⤵
  PID:5340
- C:\Windows\System\YxiglBS.exe
  C:\Windows\System\YxiglBS.exe
  2⤵
  PID:5344
- C:\Windows\System\BiTgcqt.exe
  C:\Windows\System\BiTgcqt.exe
  2⤵
  PID:5408
- C:\Windows\System\NgIqXnu.exe
  C:\Windows\System\NgIqXnu.exe
  2⤵
  PID:5536
- C:\Windows\System\MqewFIp.exe
  C:\Windows\System\MqewFIp.exe
  2⤵
  PID:5556
- C:\Windows\System\OgrTvnC.exe
  C:\Windows\System\OgrTvnC.exe
  2⤵
  PID:5816
- C:\Windows\System\RtqjyfW.exe
  C:\Windows\System\RtqjyfW.exe
  2⤵
  PID:5324
- C:\Windows\System\qtfIpIW.exe
  C:\Windows\System\qtfIpIW.exe
  2⤵
  PID:5424
- C:\Windows\System\OzlHGWk.exe
  C:\Windows\System\OzlHGWk.exe
  2⤵
  PID:5608
- C:\Windows\System\FWycBWL.exe
  C:\Windows\System\FWycBWL.exe
  2⤵
  PID:6080
- C:\Windows\System\qRZVSAv.exe
  C:\Windows\System\qRZVSAv.exe
  2⤵
  PID:5224
- C:\Windows\System\ZkmnQvL.exe
  C:\Windows\System\ZkmnQvL.exe
  2⤵
  PID:5796
- C:\Windows\System\dBgsZPe.exe
  C:\Windows\System\dBgsZPe.exe
  2⤵
  PID:5388
- C:\Windows\System\jPsHTJf.exe
  C:\Windows\System\jPsHTJf.exe
  2⤵
  PID:5520
- C:\Windows\System\hmXMeXd.exe
  C:\Windows\System\hmXMeXd.exe
  2⤵
  PID:5680
- C:\Windows\System\LwpgAhp.exe
  C:\Windows\System\LwpgAhp.exe
  2⤵
  PID:5800
- C:\Windows\System\wZtJjDw.exe
  C:\Windows\System\wZtJjDw.exe
  2⤵
  PID:5740
- C:\Windows\System\AgIPPqF.exe
  C:\Windows\System\AgIPPqF.exe
  2⤵
  PID:5872
- C:\Windows\System\zSxdONw.exe
  C:\Windows\System\zSxdONw.exe
  2⤵
  PID:5924
- C:\Windows\System\lkRSbZI.exe
  C:\Windows\System\lkRSbZI.exe
  2⤵
  PID:6056
- C:\Windows\System\PHOBxIW.exe
  C:\Windows\System\PHOBxIW.exe
  2⤵
  PID:5860
- C:\Windows\System\GezLHyx.exe
  C:\Windows\System\GezLHyx.exe
  2⤵
  PID:6128
- C:\Windows\System\WgzqsIx.exe
  C:\Windows\System\WgzqsIx.exe
  2⤵
  PID:5204
- C:\Windows\System\ERkhtNh.exe
  C:\Windows\System\ERkhtNh.exe
  2⤵
  PID:5432
- C:\Windows\System\NiqewGr.exe
  C:\Windows\System\NiqewGr.exe
  2⤵
  PID:5188
- C:\Windows\System\RnQDYWy.exe
  C:\Windows\System\RnQDYWy.exe
  2⤵
  PID:5272
- C:\Windows\System\xpSYOdM.exe
  C:\Windows\System\xpSYOdM.exe
  2⤵
  PID:5652
- C:\Windows\System\GDbOUKP.exe
  C:\Windows\System\GDbOUKP.exe
  2⤵
  PID:5844
- C:\Windows\System\YDVwlnD.exe
  C:\Windows\System\YDVwlnD.exe
  2⤵
  PID:5944
- C:\Windows\System\irNbJIw.exe
  C:\Windows\System\irNbJIw.exe
  2⤵
  PID:6024
- C:\Windows\System\lgNuQzw.exe
  C:\Windows\System\lgNuQzw.exe
  2⤵
  PID:5240
- C:\Windows\System\HgENcou.exe
  C:\Windows\System\HgENcou.exe
  2⤵
  PID:5372
- C:\Windows\System\IkkbptL.exe
  C:\Windows\System\IkkbptL.exe
  2⤵
  PID:5952
- C:\Windows\System\TqpNJCR.exe
  C:\Windows\System\TqpNJCR.exe
  2⤵
  PID:6060
- C:\Windows\System\kkEzNbA.exe
  C:\Windows\System\kkEzNbA.exe
  2⤵
  PID:6152
- C:\Windows\System\fnkTGTC.exe
  C:\Windows\System\fnkTGTC.exe
  2⤵
  PID:6180
- C:\Windows\System\BtdwuRK.exe
  C:\Windows\System\BtdwuRK.exe
  2⤵
  PID:6264
- C:\Windows\System\vQTNPWf.exe
  C:\Windows\System\vQTNPWf.exe
  2⤵
  PID:6284
- C:\Windows\System\seNMIve.exe
  C:\Windows\System\seNMIve.exe
  2⤵
  PID:6328
- C:\Windows\System\ldjdGHZ.exe
  C:\Windows\System\ldjdGHZ.exe
  2⤵
  PID:6344
- C:\Windows\System\CvKyBnT.exe
  C:\Windows\System\CvKyBnT.exe
  2⤵
  PID:6364
- C:\Windows\System\oPbkMYx.exe
  C:\Windows\System\oPbkMYx.exe
  2⤵
  PID:6384
- C:\Windows\System\pfYVYRm.exe
  C:\Windows\System\pfYVYRm.exe
  2⤵
  PID:6400
- C:\Windows\System\PDLcaXM.exe
  C:\Windows\System\PDLcaXM.exe
  2⤵
  PID:6420
- C:\Windows\System\swMVWCt.exe
  C:\Windows\System\swMVWCt.exe
  2⤵
  PID:6440
- C:\Windows\System\EUBFFXn.exe
  C:\Windows\System\EUBFFXn.exe
  2⤵
  PID:6464
- C:\Windows\System\nTHNOYe.exe
  C:\Windows\System\nTHNOYe.exe
  2⤵
  PID:6484
- C:\Windows\System\HxSKmby.exe
  C:\Windows\System\HxSKmby.exe
  2⤵
  PID:6500
- C:\Windows\System\RMcjdWk.exe
  C:\Windows\System\RMcjdWk.exe
  2⤵
  PID:6516
- C:\Windows\System\WtFkoUq.exe
  C:\Windows\System\WtFkoUq.exe
  2⤵
  PID:6532
- C:\Windows\System\FajXrjn.exe
  C:\Windows\System\FajXrjn.exe
  2⤵
  PID:6568
- C:\Windows\System\AqVxIYM.exe
  C:\Windows\System\AqVxIYM.exe
  2⤵
  PID:6588
- C:\Windows\System\ONJtFdS.exe
  C:\Windows\System\ONJtFdS.exe
  2⤵
  PID:6608
- C:\Windows\System\UhrleAd.exe
  C:\Windows\System\UhrleAd.exe
  2⤵
  PID:6632
- C:\Windows\System\GjOZVbF.exe
  C:\Windows\System\GjOZVbF.exe
  2⤵
  PID:6660
- C:\Windows\System\nLZhCPN.exe
  C:\Windows\System\nLZhCPN.exe
  2⤵
  PID:6680
- C:\Windows\System\EaytnMI.exe
  C:\Windows\System\EaytnMI.exe
  2⤵
  PID:6696
- C:\Windows\System\CSzNSGd.exe
  C:\Windows\System\CSzNSGd.exe
  2⤵
  PID:6716
- C:\Windows\System\ruSdPzj.exe
  C:\Windows\System\ruSdPzj.exe
  2⤵
  PID:6772
- C:\Windows\System\jhPWGJq.exe
  C:\Windows\System\jhPWGJq.exe
  2⤵
  PID:6824
- C:\Windows\System\ftUejGQ.exe
  C:\Windows\System\ftUejGQ.exe
  2⤵
  PID:6880
- C:\Windows\System\fnsZPoA.exe
  C:\Windows\System\fnsZPoA.exe
  2⤵
  PID:6956
- C:\Windows\System\AHndDaK.exe
  C:\Windows\System\AHndDaK.exe
  2⤵
  PID:6972
- C:\Windows\System\juiQELd.exe
  C:\Windows\System\juiQELd.exe
  2⤵
  PID:6988
- C:\Windows\System\PxynzDN.exe
  C:\Windows\System\PxynzDN.exe
  2⤵
  PID:7004
- C:\Windows\System\SEMqRDL.exe
  C:\Windows\System\SEMqRDL.exe
  2⤵
  PID:7020
- C:\Windows\System\USihuLr.exe
  C:\Windows\System\USihuLr.exe
  2⤵
  PID:7040
- C:\Windows\System\okRmVJS.exe
  C:\Windows\System\okRmVJS.exe
  2⤵
  PID:7060
- C:\Windows\System\CnaJqyu.exe
  C:\Windows\System\CnaJqyu.exe
  2⤵
  PID:7076
- C:\Windows\System\uaZOMCN.exe
  C:\Windows\System\uaZOMCN.exe
  2⤵
  PID:7100
- C:\Windows\System\MuIYRLd.exe
  C:\Windows\System\MuIYRLd.exe
  2⤵
  PID:7132
- C:\Windows\System\oXqCwYz.exe
  C:\Windows\System\oXqCwYz.exe
  2⤵
  PID:7148
- C:\Windows\System\EdemcKC.exe
  C:\Windows\System\EdemcKC.exe
  2⤵
  PID:5996
- C:\Windows\System\bgAypxA.exe
  C:\Windows\System\bgAypxA.exe
  2⤵
  PID:6148
- C:\Windows\System\MHAfxqg.exe
  C:\Windows\System\MHAfxqg.exe
  2⤵
  PID:5152
- C:\Windows\System\dETMxLK.exe
  C:\Windows\System\dETMxLK.exe
  2⤵
  PID:5244
- C:\Windows\System\tqeZCmZ.exe
  C:\Windows\System\tqeZCmZ.exe
  2⤵
  PID:6192
- C:\Windows\System\cBkGiJS.exe
  C:\Windows\System\cBkGiJS.exe
  2⤵
  PID:6204
- C:\Windows\System\ckDoTQd.exe
  C:\Windows\System\ckDoTQd.exe
  2⤵
  PID:6228
- C:\Windows\System\jFwVwEL.exe
  C:\Windows\System\jFwVwEL.exe
  2⤵
  PID:6308
- C:\Windows\System\tROjlBh.exe
  C:\Windows\System\tROjlBh.exe
  2⤵
  PID:6324
- C:\Windows\System\mhpmJkI.exe
  C:\Windows\System\mhpmJkI.exe
  2⤵
  PID:6356
- C:\Windows\System\KgsDKIN.exe
  C:\Windows\System\KgsDKIN.exe
  2⤵
  PID:6432
- C:\Windows\System\vblnvHq.exe
  C:\Windows\System\vblnvHq.exe
  2⤵
  PID:6372
- C:\Windows\System\yEwFqjf.exe
  C:\Windows\System\yEwFqjf.exe
  2⤵
  PID:6408
- C:\Windows\System\LXkFoBg.exe
  C:\Windows\System\LXkFoBg.exe
  2⤵
  PID:6460
- C:\Windows\System\kYEalEp.exe
  C:\Windows\System\kYEalEp.exe
  2⤵
  PID:6512
- C:\Windows\System\bRYErEd.exe
  C:\Windows\System\bRYErEd.exe
  2⤵
  PID:6492
- C:\Windows\System\jTKHcKr.exe
  C:\Windows\System\jTKHcKr.exe
  2⤵
  PID:6564
- C:\Windows\System\IrYfwDc.exe
  C:\Windows\System\IrYfwDc.exe
  2⤵
  PID:6600
- C:\Windows\System\PYsauOb.exe
  C:\Windows\System\PYsauOb.exe
  2⤵
  PID:6620
- C:\Windows\System\FvAbsCd.exe
  C:\Windows\System\FvAbsCd.exe
  2⤵
  PID:6652
- C:\Windows\System\utTAjjD.exe
  C:\Windows\System\utTAjjD.exe
  2⤵
  PID:6672
- C:\Windows\System\TtSjjrO.exe
  C:\Windows\System\TtSjjrO.exe
  2⤵
  PID:6708
- C:\Windows\System\tDqLZfd.exe
  C:\Windows\System\tDqLZfd.exe
  2⤵
  PID:6844
- C:\Windows\System\xFIHMvd.exe
  C:\Windows\System\xFIHMvd.exe
  2⤵
  PID:6892
- C:\Windows\System\IvOwxbz.exe
  C:\Windows\System\IvOwxbz.exe
  2⤵
  PID:6964
- C:\Windows\System\ehDtyFv.exe
  C:\Windows\System\ehDtyFv.exe
  2⤵
  PID:7012
- C:\Windows\System\inDpzTz.exe
  C:\Windows\System\inDpzTz.exe
  2⤵
  PID:7052
- C:\Windows\System\aOxtBan.exe
  C:\Windows\System\aOxtBan.exe
  2⤵
  PID:7116
- C:\Windows\System\vbLgJlJ.exe
  C:\Windows\System\vbLgJlJ.exe
  2⤵
  PID:7156
- C:\Windows\System\YPHLSvk.exe
  C:\Windows\System\YPHLSvk.exe
  2⤵
  PID:7088
- C:\Windows\System\jiToIci.exe
  C:\Windows\System\jiToIci.exe
  2⤵
  PID:5720
- C:\Windows\System\GedINzm.exe
  C:\Windows\System\GedINzm.exe
  2⤵
  PID:6208
- C:\Windows\System\hxjcwwC.exe
  C:\Windows\System\hxjcwwC.exe
  2⤵
  PID:6316
- C:\Windows\System\YLFvDRt.exe
  C:\Windows\System\YLFvDRt.exe
  2⤵
  PID:6352
- C:\Windows\System\ARAGVVN.exe
  C:\Windows\System\ARAGVVN.exe
  2⤵
  PID:6376
- C:\Windows\System\lAOayVK.exe
  C:\Windows\System\lAOayVK.exe
  2⤵
  PID:6476
- C:\Windows\System\ngTXThV.exe
  C:\Windows\System\ngTXThV.exe
  2⤵
  PID:6556
- C:\Windows\System\ZmFGEXu.exe
  C:\Windows\System\ZmFGEXu.exe
  2⤵
  PID:6528
- C:\Windows\System\IXBtlId.exe
  C:\Windows\System\IXBtlId.exe
  2⤵
  PID:6584
- C:\Windows\System\ETGVAUg.exe
  C:\Windows\System\ETGVAUg.exe
  2⤵
  PID:6640
- C:\Windows\System\EFAiyjx.exe
  C:\Windows\System\EFAiyjx.exe
  2⤵
  PID:6704
- C:\Windows\System\wKjKviS.exe
  C:\Windows\System\wKjKviS.exe
  2⤵
  PID:6732
- C:\Windows\System\QgyXojR.exe
  C:\Windows\System\QgyXojR.exe
  2⤵
  PID:6748
- C:\Windows\System\ZEWVpPP.exe
  C:\Windows\System\ZEWVpPP.exe
  2⤵
  PID:6760
- C:\Windows\System\yvNUUJt.exe
  C:\Windows\System\yvNUUJt.exe
  2⤵
  PID:6784
- C:\Windows\System\HnhiVFX.exe
  C:\Windows\System\HnhiVFX.exe
  2⤵
  PID:6808
- C:\Windows\System\IOEnCDf.exe
  C:\Windows\System\IOEnCDf.exe
  2⤵
  PID:6836
- C:\Windows\System\oeZeRNN.exe
  C:\Windows\System\oeZeRNN.exe
  2⤵
  PID:6856
- C:\Windows\System\ZTbxPQd.exe
  C:\Windows\System\ZTbxPQd.exe
  2⤵
  PID:6872
- C:\Windows\System\QoTqaGy.exe
  C:\Windows\System\QoTqaGy.exe
  2⤵
  PID:6904
- C:\Windows\System\OuqXCNw.exe
  C:\Windows\System\OuqXCNw.exe
  2⤵
  PID:6916
- C:\Windows\System\wCKLZUj.exe
  C:\Windows\System\wCKLZUj.exe
  2⤵
  PID:6944
- C:\Windows\System\ZqiLVqh.exe
  C:\Windows\System\ZqiLVqh.exe
  2⤵
  PID:6984
- C:\Windows\System\AzwfdAr.exe
  C:\Windows\System\AzwfdAr.exe
  2⤵
  PID:7048
- C:\Windows\System\DILqyYv.exe
  C:\Windows\System\DILqyYv.exe
  2⤵
  PID:7108
- C:\Windows\System\GHkGuAq.exe
  C:\Windows\System\GHkGuAq.exe
  2⤵
  PID:7084
- C:\Windows\System\iGWZKwB.exe
  C:\Windows\System\iGWZKwB.exe
  2⤵
  PID:7164
- C:\Windows\System\RxqoHbT.exe
  C:\Windows\System\RxqoHbT.exe
  2⤵
  PID:5328
- C:\Windows\System\Vgowjjq.exe
  C:\Windows\System\Vgowjjq.exe
  2⤵
  PID:6216
- C:\Windows\System\ujQxqmN.exe
  C:\Windows\System\ujQxqmN.exe
  2⤵
  PID:6016
- C:\Windows\System\ihZIsso.exe
  C:\Windows\System\ihZIsso.exe
  2⤵
  PID:6248
- C:\Windows\System\wNvnxFE.exe
  C:\Windows\System\wNvnxFE.exe
  2⤵
  PID:6276
- C:\Windows\System\DiSqCxD.exe
  C:\Windows\System\DiSqCxD.exe
  2⤵
  PID:6396
- C:\Windows\System\LeMSgoY.exe
  C:\Windows\System\LeMSgoY.exe
  2⤵
  PID:6416
- C:\Windows\System\DfPyQgL.exe
  C:\Windows\System\DfPyQgL.exe
  2⤵
  PID:6540
- C:\Windows\System\AtQCHFM.exe
  C:\Windows\System\AtQCHFM.exe
  2⤵
  PID:6648
- C:\Windows\System\lmGXPsa.exe
  C:\Windows\System\lmGXPsa.exe
  2⤵
  PID:6744
- C:\Windows\System\gokysvo.exe
  C:\Windows\System\gokysvo.exe
  2⤵
  PID:6800
- C:\Windows\System\vFwwnAF.exe
  C:\Windows\System\vFwwnAF.exe
  2⤵
  PID:6840
- C:\Windows\System\HuzoyRy.exe
  C:\Windows\System\HuzoyRy.exe
  2⤵
  PID:6852
- C:\Windows\System\XJXkBrc.exe
  C:\Windows\System\XJXkBrc.exe
  2⤵
  PID:6912
- C:\Windows\System\OXpvoLv.exe
  C:\Windows\System\OXpvoLv.exe
  2⤵
  PID:6932
- C:\Windows\System\ScoCwkO.exe
  C:\Windows\System\ScoCwkO.exe
  2⤵
  PID:7000
- C:\Windows\System\cWXPNvC.exe
  C:\Windows\System\cWXPNvC.exe
  2⤵
  PID:7028
- C:\Windows\System\ckrMvTM.exe
  C:\Windows\System\ckrMvTM.exe
  2⤵
  PID:7092
- C:\Windows\System\olbRtff.exe
  C:\Windows\System\olbRtff.exe
  2⤵
  PID:6236
- C:\Windows\System\kONXgMp.exe
  C:\Windows\System\kONXgMp.exe
  2⤵
  PID:6292
- C:\Windows\System\DKogZkU.exe
  C:\Windows\System\DKogZkU.exe
  2⤵
  PID:6552
- C:\Windows\System\WDayUJx.exe
  C:\Windows\System\WDayUJx.exe
  2⤵
  PID:6252
- C:\Windows\System\HfvSuLC.exe
  C:\Windows\System\HfvSuLC.exe
  2⤵
  PID:6688
- C:\Windows\System\MQkZtfq.exe
  C:\Windows\System\MQkZtfq.exe
  2⤵
  PID:6172
- C:\Windows\System\geKIrGt.exe
  C:\Windows\System\geKIrGt.exe
  2⤵
  PID:6920
- C:\Windows\System\nBCDbhX.exe
  C:\Windows\System\nBCDbhX.exe
  2⤵
  PID:5900
- C:\Windows\System\lnJcpft.exe
  C:\Windows\System\lnJcpft.exe
  2⤵
  PID:6724
- C:\Windows\System\jlQDRbE.exe
  C:\Windows\System\jlQDRbE.exe
  2⤵
  PID:6596
- C:\Windows\System\bTmXWqJ.exe
  C:\Windows\System\bTmXWqJ.exe
  2⤵
  PID:6864
- C:\Windows\System\Wmxpgol.exe
  C:\Windows\System\Wmxpgol.exe
  2⤵
  PID:6948
- C:\Windows\System\yKXRsVd.exe
  C:\Windows\System\yKXRsVd.exe
  2⤵
  PID:7036
- C:\Windows\System\JqkGqHL.exe
  C:\Windows\System\JqkGqHL.exe
  2⤵
  PID:6272
- C:\Windows\System\VumaGax.exe
  C:\Windows\System\VumaGax.exe
  2⤵
  PID:6820
- C:\Windows\System\ykkCEni.exe
  C:\Windows\System\ykkCEni.exe
  2⤵
  PID:6448
- C:\Windows\System\wKMDPcA.exe
  C:\Windows\System\wKMDPcA.exe
  2⤵
  PID:6792
- C:\Windows\System\kyYOptq.exe
  C:\Windows\System\kyYOptq.exe
  2⤵
  PID:6788
- C:\Windows\System\znCjpwe.exe
  C:\Windows\System\znCjpwe.exe
  2⤵
  PID:6340
- C:\Windows\System\iOqwTyK.exe
  C:\Windows\System\iOqwTyK.exe
  2⤵
  PID:7180
- C:\Windows\System\ognVRiR.exe
  C:\Windows\System\ognVRiR.exe
  2⤵
  PID:7196
- C:\Windows\System\DXOWpzF.exe
  C:\Windows\System\DXOWpzF.exe
  2⤵
  PID:7216
- C:\Windows\System\sLPzwMR.exe
  C:\Windows\System\sLPzwMR.exe
  2⤵
  PID:7232
- C:\Windows\System\iZMaZFO.exe
  C:\Windows\System\iZMaZFO.exe
  2⤵
  PID:7256
- C:\Windows\System\LqaUQBb.exe
  C:\Windows\System\LqaUQBb.exe
  2⤵
  PID:7276
- C:\Windows\System\MicAAAp.exe
  C:\Windows\System\MicAAAp.exe
  2⤵
  PID:7292
- C:\Windows\System\ThzdEnf.exe
  C:\Windows\System\ThzdEnf.exe
  2⤵
  PID:7308
- C:\Windows\System\lZoxutU.exe
  C:\Windows\System\lZoxutU.exe
  2⤵
  PID:7324
- C:\Windows\System\gGlPuwW.exe
  C:\Windows\System\gGlPuwW.exe
  2⤵
  PID:7340
- C:\Windows\System\vSodIJd.exe
  C:\Windows\System\vSodIJd.exe
  2⤵
  PID:7360
- C:\Windows\System\uLlpnvG.exe
  C:\Windows\System\uLlpnvG.exe
  2⤵
  PID:7388
- C:\Windows\System\YXIBhmY.exe
  C:\Windows\System\YXIBhmY.exe
  2⤵
  PID:7404
- C:\Windows\System\nushcLV.exe
  C:\Windows\System\nushcLV.exe
  2⤵
  PID:7420
- C:\Windows\System\sVfNEVi.exe
  C:\Windows\System\sVfNEVi.exe
  2⤵
  PID:7436
- C:\Windows\System\EHWtweh.exe
  C:\Windows\System\EHWtweh.exe
  2⤵
  PID:7456
- C:\Windows\System\CGuGyRI.exe
  C:\Windows\System\CGuGyRI.exe
  2⤵
  PID:7472
- C:\Windows\System\bXrRfUf.exe
  C:\Windows\System\bXrRfUf.exe
  2⤵
  PID:7488
- C:\Windows\System\XcJNdjW.exe
  C:\Windows\System\XcJNdjW.exe
  2⤵
  PID:7504
- C:\Windows\System\piLiAPv.exe
  C:\Windows\System\piLiAPv.exe
  2⤵
  PID:7524
- C:\Windows\System\vPVnRLn.exe
  C:\Windows\System\vPVnRLn.exe
  2⤵
  PID:7540
- C:\Windows\System\qUywRwj.exe
  C:\Windows\System\qUywRwj.exe
  2⤵
  PID:7556
- C:\Windows\System\kkScLJW.exe
  C:\Windows\System\kkScLJW.exe
  2⤵
  PID:7572
- C:\Windows\System\WpzvoKv.exe
  C:\Windows\System\WpzvoKv.exe
  2⤵
  PID:7588
- C:\Windows\System\KBYgAUK.exe
  C:\Windows\System\KBYgAUK.exe
  2⤵
  PID:7608
- C:\Windows\System\XSMvYsJ.exe
  C:\Windows\System\XSMvYsJ.exe
  2⤵
  PID:7624
- C:\Windows\System\ZDXjLHc.exe
  C:\Windows\System\ZDXjLHc.exe
  2⤵
  PID:7640
- C:\Windows\System\MjmvfJi.exe
  C:\Windows\System\MjmvfJi.exe
  2⤵
  PID:7656
- C:\Windows\System\dDSGVLj.exe
  C:\Windows\System\dDSGVLj.exe
  2⤵
  PID:7672
- C:\Windows\System\smnqdEr.exe
  C:\Windows\System\smnqdEr.exe
  2⤵
  PID:7688
- C:\Windows\System\zasCJJv.exe
  C:\Windows\System\zasCJJv.exe
  2⤵
  PID:7708
- C:\Windows\System\BKAvOjd.exe
  C:\Windows\System\BKAvOjd.exe
  2⤵
  PID:7728
- C:\Windows\System\SWGZqIo.exe
  C:\Windows\System\SWGZqIo.exe
  2⤵
  PID:7744
- C:\Windows\System\JPRpwXb.exe
  C:\Windows\System\JPRpwXb.exe
  2⤵
  PID:7760
- C:\Windows\System\OkGDuIH.exe
  C:\Windows\System\OkGDuIH.exe
  2⤵
  PID:7776
- C:\Windows\System\yrVWHHs.exe
  C:\Windows\System\yrVWHHs.exe
  2⤵
  PID:7796
- C:\Windows\System\AbbeOVd.exe
  C:\Windows\System\AbbeOVd.exe
  2⤵
  PID:7812
- C:\Windows\System\UrfECax.exe
  C:\Windows\System\UrfECax.exe
  2⤵
  PID:7836
- C:\Windows\System\HuCSAHG.exe
  C:\Windows\System\HuCSAHG.exe
  2⤵
  PID:7904
- C:\Windows\System\VcRMudc.exe
  C:\Windows\System\VcRMudc.exe
  2⤵
  PID:7948
- C:\Windows\System\ulsFBvy.exe
  C:\Windows\System\ulsFBvy.exe
  2⤵
  PID:7964
- C:\Windows\System\fPVFYlw.exe
  C:\Windows\System\fPVFYlw.exe
  2⤵
  PID:7980
- C:\Windows\System\vDMuVSa.exe
  C:\Windows\System\vDMuVSa.exe
  2⤵
  PID:8000
- C:\Windows\System\uGioidT.exe
  C:\Windows\System\uGioidT.exe
  2⤵
  PID:8016
- C:\Windows\System\QCtXkWL.exe
  C:\Windows\System\QCtXkWL.exe
  2⤵
  PID:8036
- C:\Windows\System\xXRYikL.exe
  C:\Windows\System\xXRYikL.exe
  2⤵
  PID:8056
- C:\Windows\System\HKNAhOI.exe
  C:\Windows\System\HKNAhOI.exe
  2⤵
  PID:8076
- C:\Windows\System\BvyLjKR.exe
  C:\Windows\System\BvyLjKR.exe
  2⤵
  PID:8092
- C:\Windows\System\EOlLJkk.exe
  C:\Windows\System\EOlLJkk.exe
  2⤵
  PID:8108
- C:\Windows\System\NqpmpdM.exe
  C:\Windows\System\NqpmpdM.exe
  2⤵
  PID:8128
- C:\Windows\System\qAOYEXo.exe
  C:\Windows\System\qAOYEXo.exe
  2⤵
  PID:8148
- C:\Windows\System\QeZlgqB.exe
  C:\Windows\System\QeZlgqB.exe
  2⤵
  PID:8164
- C:\Windows\System\mfmzHZl.exe
  C:\Windows\System\mfmzHZl.exe
  2⤵
  PID:8180
- C:\Windows\System\UyUxNuN.exe
  C:\Windows\System\UyUxNuN.exe
  2⤵
  PID:6176
- C:\Windows\System\pGotrCj.exe
  C:\Windows\System\pGotrCj.exe
  2⤵
  PID:7212
- C:\Windows\System\ZkUNQta.exe
  C:\Windows\System\ZkUNQta.exe
  2⤵
  PID:7252
- C:\Windows\System\nNlTVDw.exe
  C:\Windows\System\nNlTVDw.exe
  2⤵
  PID:7316
- C:\Windows\System\QiRZEgm.exe
  C:\Windows\System\QiRZEgm.exe
  2⤵
  PID:7300
- C:\Windows\System\aVkYaBZ.exe
  C:\Windows\System\aVkYaBZ.exe
  2⤵
  PID:7268
- C:\Windows\System\kETbrle.exe
  C:\Windows\System\kETbrle.exe
  2⤵
  PID:7348
- C:\Windows\System\sSppCiH.exe
  C:\Windows\System\sSppCiH.exe
  2⤵
  PID:7376
- C:\Windows\System\TRIaHns.exe
  C:\Windows\System\TRIaHns.exe
  2⤵
  PID:7384
- C:\Windows\System\bbogUcL.exe
  C:\Windows\System\bbogUcL.exe
  2⤵
  PID:7448
- C:\Windows\System\JRpuBwh.exe
  C:\Windows\System\JRpuBwh.exe
  2⤵
  PID:7468
- C:\Windows\System\tSalXiB.exe
  C:\Windows\System\tSalXiB.exe
  2⤵
  PID:7500
- C:\Windows\System\pEghBts.exe
  C:\Windows\System\pEghBts.exe
  2⤵
  PID:7512
- C:\Windows\System\GgFBADe.exe
  C:\Windows\System\GgFBADe.exe
  2⤵
  PID:7596
- C:\Windows\System\fuSPoRQ.exe
  C:\Windows\System\fuSPoRQ.exe
  2⤵
  PID:7552
- C:\Windows\System\ifKsKML.exe
  C:\Windows\System\ifKsKML.exe
  2⤵
  PID:7616
- C:\Windows\System\EHvKhuA.exe
  C:\Windows\System\EHvKhuA.exe
  2⤵
  PID:7668
- C:\Windows\System\wWtfhWS.exe
  C:\Windows\System\wWtfhWS.exe
  2⤵
  PID:7684
- C:\Windows\System\AaBqDvt.exe
  C:\Windows\System\AaBqDvt.exe
  2⤵
  PID:7740
- C:\Windows\System\OAEDism.exe
  C:\Windows\System\OAEDism.exe
  2⤵
  PID:7768
- C:\Windows\System\KLygMFq.exe
  C:\Windows\System\KLygMFq.exe
  2⤵
  PID:7788
- C:\Windows\System\OOKwgFY.exe
  C:\Windows\System\OOKwgFY.exe
  2⤵
  PID:7828
- C:\Windows\System\QzloyJM.exe
  C:\Windows\System\QzloyJM.exe
  2⤵
  PID:7852
- C:\Windows\System\PrKSecg.exe
  C:\Windows\System\PrKSecg.exe
  2⤵
  PID:7868
- C:\Windows\System\YMbGOWH.exe
  C:\Windows\System\YMbGOWH.exe
  2⤵
  PID:7884
- C:\Windows\System\kCJpnsM.exe
  C:\Windows\System\kCJpnsM.exe
  2⤵
  PID:7892
- C:\Windows\System\zQnuIep.exe
  C:\Windows\System\zQnuIep.exe
  2⤵
  PID:7928
- C:\Windows\System\xcxhEBx.exe
  C:\Windows\System\xcxhEBx.exe
  2⤵
  PID:7960
- C:\Windows\System\pdpHiSh.exe
  C:\Windows\System\pdpHiSh.exe
  2⤵
  PID:7972
- C:\Windows\System\ZIXqaDd.exe
  C:\Windows\System\ZIXqaDd.exe
  2⤵
  PID:8008
- C:\Windows\System\DCtwkqD.exe
  C:\Windows\System\DCtwkqD.exe
  2⤵
  PID:8032
- C:\Windows\System\zPbaLAr.exe
  C:\Windows\System\zPbaLAr.exe
  2⤵
  PID:8044
- C:\Windows\System\MhEaEau.exe
  C:\Windows\System\MhEaEau.exe
  2⤵
  PID:8084
- C:\Windows\System\mYljhQJ.exe
  C:\Windows\System\mYljhQJ.exe
  2⤵
  PID:8140
- C:\Windows\System\fsVTDhA.exe
  C:\Windows\System\fsVTDhA.exe
  2⤵
  PID:8116
- C:\Windows\System\FpCCwSd.exe
  C:\Windows\System\FpCCwSd.exe
  2⤵
  PID:7368
- C:\Windows\System\bKULOwF.exe
  C:\Windows\System\bKULOwF.exe
  2⤵
  PID:7720
- C:\Windows\System\IgCeyEO.exe
  C:\Windows\System\IgCeyEO.exe
  2⤵
  PID:7824
- C:\Windows\System\vQfKdgE.exe
  C:\Windows\System\vQfKdgE.exe
  2⤵
  PID:7916
- C:\Windows\System\GRmurGI.exe
  C:\Windows\System\GRmurGI.exe
  2⤵
  PID:7900
- C:\Windows\System\zFjDSIt.exe
  C:\Windows\System\zFjDSIt.exe
  2⤵
  PID:7880
- C:\Windows\System\zEZraqX.exe
  C:\Windows\System\zEZraqX.exe
  2⤵
  PID:8028
- C:\Windows\System\vdMZgCf.exe
  C:\Windows\System\vdMZgCf.exe
  2⤵
  PID:8100
- C:\Windows\System\VOykvRk.exe
  C:\Windows\System\VOykvRk.exe
  2⤵
  PID:8160
- C:\Windows\System\ZWGPMyP.exe
  C:\Windows\System\ZWGPMyP.exe
  2⤵
  PID:7204
- C:\Windows\System\YlyAWpS.exe
  C:\Windows\System\YlyAWpS.exe
  2⤵
  PID:7288
- C:\Windows\System\UcrXxqW.exe
  C:\Windows\System\UcrXxqW.exe
  2⤵
  PID:7228
- C:\Windows\System\tRrQlmd.exe
  C:\Windows\System\tRrQlmd.exe
  2⤵
  PID:7304
- C:\Windows\System\QKDDxOV.exe
  C:\Windows\System\QKDDxOV.exe
  2⤵
  PID:7452
- C:\Windows\System\idavZIg.exe
  C:\Windows\System\idavZIg.exe
  2⤵
  PID:7464
- C:\Windows\System\Ugerxca.exe
  C:\Windows\System\Ugerxca.exe
  2⤵
  PID:7532
- C:\Windows\System\JGHzQRQ.exe
  C:\Windows\System\JGHzQRQ.exe
  2⤵
  PID:7584
- C:\Windows\System\OhJVgXH.exe
  C:\Windows\System\OhJVgXH.exe
  2⤵
  PID:7652
- C:\Windows\System\oBwNJIJ.exe
  C:\Windows\System\oBwNJIJ.exe
  2⤵
  PID:7724
- C:\Windows\System\oCGFGzX.exe
  C:\Windows\System\oCGFGzX.exe
  2⤵
  PID:6980
- C:\Windows\System\GeKZdQM.exe
  C:\Windows\System\GeKZdQM.exe
  2⤵
  PID:7936
- C:\Windows\System\rdxPkLC.exe
  C:\Windows\System\rdxPkLC.exe
  2⤵
  PID:8048
- C:\Windows\System\gjADSLF.exe
  C:\Windows\System\gjADSLF.exe
  2⤵
  PID:8156
- C:\Windows\System\VVYMgEM.exe
  C:\Windows\System\VVYMgEM.exe
  2⤵
  PID:6832
- C:\Windows\System\jAZcIEa.exe
  C:\Windows\System\jAZcIEa.exe
  2⤵
  PID:8188
- C:\Windows\System\tXSGgGL.exe
  C:\Windows\System\tXSGgGL.exe
  2⤵
  PID:7396
- C:\Windows\System\IUVrKzV.exe
  C:\Windows\System\IUVrKzV.exe
  2⤵
  PID:7352
- C:\Windows\System\kcqvrwg.exe
  C:\Windows\System\kcqvrwg.exe
  2⤵
  PID:7568
- C:\Windows\System\GbexIAn.exe
  C:\Windows\System\GbexIAn.exe
  2⤵
  PID:7756
- C:\Windows\System\MlEzrPL.exe
  C:\Windows\System\MlEzrPL.exe
  2⤵
  PID:8052
- C:\Windows\System\CNryWpm.exe
  C:\Windows\System\CNryWpm.exe
  2⤵
  PID:7784
- C:\Windows\System\xWeFDTY.exe
  C:\Windows\System\xWeFDTY.exe
  2⤵
  PID:7700
- C:\Windows\System\IHuKQDm.exe
  C:\Windows\System\IHuKQDm.exe
  2⤵
  PID:7416
- C:\Windows\System\sPOEomt.exe
  C:\Windows\System\sPOEomt.exe
  2⤵
  PID:7620
- C:\Windows\System\PrFgpgL.exe
  C:\Windows\System\PrFgpgL.exe
  2⤵
  PID:7736
- C:\Windows\System\rtgcOhy.exe
  C:\Windows\System\rtgcOhy.exe
  2⤵
  PID:7844
- C:\Windows\System\dmRjQCt.exe
  C:\Windows\System\dmRjQCt.exe
  2⤵
  PID:7564
- C:\Windows\System\pvZSljD.exe
  C:\Windows\System\pvZSljD.exe
  2⤵
  PID:7248
- C:\Windows\System\MmXEQzO.exe
  C:\Windows\System\MmXEQzO.exe
  2⤵
  PID:7988
- C:\Windows\System\AlOQksi.exe
  C:\Windows\System\AlOQksi.exe
  2⤵
  PID:7996
- C:\Windows\System\RhnXakr.exe
  C:\Windows\System\RhnXakr.exe
  2⤵
  PID:8204
- C:\Windows\System\otIMNwU.exe
  C:\Windows\System\otIMNwU.exe
  2⤵
  PID:8220
- C:\Windows\System\FtiotaL.exe
  C:\Windows\System\FtiotaL.exe
  2⤵
  PID:8236
- C:\Windows\System\bsfkNPq.exe
  C:\Windows\System\bsfkNPq.exe
  2⤵
  PID:8252
- C:\Windows\System\QqEBPza.exe
  C:\Windows\System\QqEBPza.exe
  2⤵
  PID:8272
- C:\Windows\System\GkCeLdj.exe
  C:\Windows\System\GkCeLdj.exe
  2⤵
  PID:8292
- C:\Windows\System\tbhBCfF.exe
  C:\Windows\System\tbhBCfF.exe
  2⤵
  PID:8308
- C:\Windows\System\OJtHrKo.exe
  C:\Windows\System\OJtHrKo.exe
  2⤵
  PID:8328
- C:\Windows\System\vCJlPxH.exe
  C:\Windows\System\vCJlPxH.exe
  2⤵
  PID:8344
- C:\Windows\System\WNbcWxL.exe
  C:\Windows\System\WNbcWxL.exe
  2⤵
  PID:8360
- C:\Windows\System\JjddTfv.exe
  C:\Windows\System\JjddTfv.exe
  2⤵
  PID:8376
- C:\Windows\System\KnuEHkq.exe
  C:\Windows\System\KnuEHkq.exe
  2⤵
  PID:8396
- C:\Windows\System\siPhXWR.exe
  C:\Windows\System\siPhXWR.exe
  2⤵
  PID:8412
- C:\Windows\System\eizwlek.exe
  C:\Windows\System\eizwlek.exe
  2⤵
  PID:8428
- C:\Windows\System\DwagDLr.exe
  C:\Windows\System\DwagDLr.exe
  2⤵
  PID:8444
- C:\Windows\System\EgarLqS.exe
  C:\Windows\System\EgarLqS.exe
  2⤵
  PID:8460
- C:\Windows\System\vjGloaV.exe
  C:\Windows\System\vjGloaV.exe
  2⤵
  PID:8476
- C:\Windows\System\oZtHVrJ.exe
  C:\Windows\System\oZtHVrJ.exe
  2⤵
  PID:8492
- C:\Windows\System\DUvIlMA.exe
  C:\Windows\System\DUvIlMA.exe
  2⤵
  PID:8508
- C:\Windows\System\JTomybu.exe
  C:\Windows\System\JTomybu.exe
  2⤵
  PID:8524
- C:\Windows\System\sfYgCpM.exe
  C:\Windows\System\sfYgCpM.exe
  2⤵
  PID:8540
- C:\Windows\System\etiRJJw.exe
  C:\Windows\System\etiRJJw.exe
  2⤵
  PID:8556
- C:\Windows\System\KqUZkjV.exe
  C:\Windows\System\KqUZkjV.exe
  2⤵
  PID:8572
- C:\Windows\System\DZHQRPq.exe
  C:\Windows\System\DZHQRPq.exe
  2⤵
  PID:8596
- C:\Windows\System\MxWZmxX.exe
  C:\Windows\System\MxWZmxX.exe
  2⤵
  PID:8612
- C:\Windows\System\YkrJEUi.exe
  C:\Windows\System\YkrJEUi.exe
  2⤵
  PID:8628
- C:\Windows\System\HEBJvqL.exe
  C:\Windows\System\HEBJvqL.exe
  2⤵
  PID:8644
- C:\Windows\System\fFZeOJq.exe
  C:\Windows\System\fFZeOJq.exe
  2⤵
  PID:8660
- C:\Windows\System\enNZWRy.exe
  C:\Windows\System\enNZWRy.exe
  2⤵
  PID:8680
- C:\Windows\System\SjZFZVN.exe
  C:\Windows\System\SjZFZVN.exe
  2⤵
  PID:8708
- C:\Windows\System\tDaSQbg.exe
  C:\Windows\System\tDaSQbg.exe
  2⤵
  PID:8728
- C:\Windows\System\ISXGpDy.exe
  C:\Windows\System\ISXGpDy.exe
  2⤵
  PID:8748
- C:\Windows\System\ZJgAfgc.exe
  C:\Windows\System\ZJgAfgc.exe
  2⤵
  PID:8772
- C:\Windows\System\PeBHwYU.exe
  C:\Windows\System\PeBHwYU.exe
  2⤵
  PID:8788
- C:\Windows\System\bykmAkd.exe
  C:\Windows\System\bykmAkd.exe
  2⤵
  PID:8804
- C:\Windows\System\WQCgOTk.exe
  C:\Windows\System\WQCgOTk.exe
  2⤵
  PID:8820
- C:\Windows\System\wJmIsTK.exe
  C:\Windows\System\wJmIsTK.exe
  2⤵
  PID:8848
- C:\Windows\System\gsobPYs.exe
  C:\Windows\System\gsobPYs.exe
  2⤵
  PID:8864
- C:\Windows\System\qpJeDqD.exe
  C:\Windows\System\qpJeDqD.exe
  2⤵
  PID:8888
- C:\Windows\System\SxOlBDm.exe
  C:\Windows\System\SxOlBDm.exe
  2⤵
  PID:8904
- C:\Windows\System\kaLtIhI.exe
  C:\Windows\System\kaLtIhI.exe
  2⤵
  PID:8920
- C:\Windows\System\nMLkcBW.exe
  C:\Windows\System\nMLkcBW.exe
  2⤵
  PID:8940
- C:\Windows\System\dLaSvlD.exe
  C:\Windows\System\dLaSvlD.exe
  2⤵
  PID:8960
- C:\Windows\System\eCArcAa.exe
  C:\Windows\System\eCArcAa.exe
  2⤵
  PID:8976
- C:\Windows\System\yrzCKaB.exe
  C:\Windows\System\yrzCKaB.exe
  2⤵
  PID:8992
- C:\Windows\System\dGyrNQY.exe
  C:\Windows\System\dGyrNQY.exe
  2⤵
  PID:9008
- C:\Windows\System\YSHxszS.exe
  C:\Windows\System\YSHxszS.exe
  2⤵
  PID:9024
- C:\Windows\System\ThxnqGf.exe
  C:\Windows\System\ThxnqGf.exe
  2⤵
  PID:9040
- C:\Windows\System\RDGXZTU.exe
  C:\Windows\System\RDGXZTU.exe
  2⤵
  PID:9056
- C:\Windows\System\kyubjwr.exe
  C:\Windows\System\kyubjwr.exe
  2⤵
  PID:9076
- C:\Windows\System\mkuHGuJ.exe
  C:\Windows\System\mkuHGuJ.exe
  2⤵
  PID:9092
- C:\Windows\System\QDvdkTb.exe
  C:\Windows\System\QDvdkTb.exe
  2⤵
  PID:9112
- C:\Windows\System\RUdmFmr.exe
  C:\Windows\System\RUdmFmr.exe
  2⤵
  PID:9128
- C:\Windows\System\EPWmbdh.exe
  C:\Windows\System\EPWmbdh.exe
  2⤵
  PID:9152
- C:\Windows\System\JhpxsTm.exe
  C:\Windows\System\JhpxsTm.exe
  2⤵
  PID:9168
- C:\Windows\System\wWvASFq.exe
  C:\Windows\System\wWvASFq.exe
  2⤵
  PID:9184
- C:\Windows\System\NhUpVNT.exe
  C:\Windows\System\NhUpVNT.exe
  2⤵
  PID:9200
- C:\Windows\System\vGjlZPZ.exe
  C:\Windows\System\vGjlZPZ.exe
  2⤵
  PID:7944
- C:\Windows\System\wxuvRpw.exe
  C:\Windows\System\wxuvRpw.exe
  2⤵
  PID:8232
- C:\Windows\System\eVjzYXl.exe
  C:\Windows\System\eVjzYXl.exe
  2⤵
  PID:8304
- C:\Windows\System\YYwbTgo.exe
  C:\Windows\System\YYwbTgo.exe
  2⤵
  PID:8340
- C:\Windows\System\UNrmpVd.exe
  C:\Windows\System\UNrmpVd.exe
  2⤵
  PID:8404
- C:\Windows\System\fneCzqK.exe
  C:\Windows\System\fneCzqK.exe
  2⤵
  PID:8468
- C:\Windows\System\OaPckcE.exe
  C:\Windows\System\OaPckcE.exe
  2⤵
  PID:8216
- C:\Windows\System\YtKBSsQ.exe
  C:\Windows\System\YtKBSsQ.exe
  2⤵
  PID:8352
- C:\Windows\System\ptXONOy.exe
  C:\Windows\System\ptXONOy.exe
  2⤵
  PID:8284
- C:\Windows\System\sxAEkOr.exe
  C:\Windows\System\sxAEkOr.exe
  2⤵
  PID:8324
- C:\Windows\System\bvIGxOP.exe
  C:\Windows\System\bvIGxOP.exe
  2⤵
  PID:8424
- C:\Windows\System\cPoNEGq.exe
  C:\Windows\System\cPoNEGq.exe
  2⤵
  PID:8520
- C:\Windows\System\AMtmAOm.exe
  C:\Windows\System\AMtmAOm.exe
  2⤵
  PID:8552
- C:\Windows\System\pacKokF.exe
  C:\Windows\System\pacKokF.exe
  2⤵
  PID:8608
- C:\Windows\System\LtRNXto.exe
  C:\Windows\System\LtRNXto.exe
  2⤵
  PID:8672
- C:\Windows\System\AAYTjkj.exe
  C:\Windows\System\AAYTjkj.exe
  2⤵
  PID:8588
- C:\Windows\System\YtwmJAJ.exe
  C:\Windows\System\YtwmJAJ.exe
  2⤵
  PID:8652
- C:\Windows\System\cyqGgyd.exe
  C:\Windows\System\cyqGgyd.exe
  2⤵
  PID:8724
- C:\Windows\System\YHQIiOv.exe
  C:\Windows\System\YHQIiOv.exe
  2⤵
  PID:8800
- C:\Windows\System\UpCjEkw.exe
  C:\Windows\System\UpCjEkw.exe
  2⤵
  PID:8812
- C:\Windows\System\wvxenPX.exe
  C:\Windows\System\wvxenPX.exe
  2⤵
  PID:8872
- C:\Windows\System\PkGtSxv.exe
  C:\Windows\System\PkGtSxv.exe
  2⤵
  PID:8912
- C:\Windows\System\vMJunxs.exe
  C:\Windows\System\vMJunxs.exe
  2⤵
  PID:8956
- C:\Windows\System\xQgJiNj.exe
  C:\Windows\System\xQgJiNj.exe
  2⤵
  PID:8856
- C:\Windows\System\yDBSQAG.exe
  C:\Windows\System\yDBSQAG.exe
  2⤵
  PID:8968
- C:\Windows\System\JLUytUh.exe
  C:\Windows\System\JLUytUh.exe
  2⤵
  PID:9020
- C:\Windows\System\PTIZeFs.exe
  C:\Windows\System\PTIZeFs.exe
  2⤵
  PID:9032
- C:\Windows\System\YuZkNhq.exe
  C:\Windows\System\YuZkNhq.exe
  2⤵
  PID:9120
- C:\Windows\System\YuCwtWW.exe
  C:\Windows\System\YuCwtWW.exe
  2⤵
  PID:9072
- C:\Windows\System\IRKFqtK.exe
  C:\Windows\System\IRKFqtK.exe
  2⤵
  PID:8228
- C:\Windows\System\UwodcxB.exe
  C:\Windows\System\UwodcxB.exe
  2⤵
  PID:8456
- C:\Windows\System\IBaZDuA.exe
  C:\Windows\System\IBaZDuA.exe
  2⤵
  PID:8504
- C:\Windows\System\IQRqCss.exe
  C:\Windows\System\IQRqCss.exe
  2⤵
  PID:8268
- C:\Windows\System\mHlxWlQ.exe
  C:\Windows\System\mHlxWlQ.exe
  2⤵
  PID:9164
- C:\Windows\System\OhpvAYC.exe
  C:\Windows\System\OhpvAYC.exe
  2⤵
  PID:7632
- C:\Windows\System\vwAjIou.exe
  C:\Windows\System\vwAjIou.exe
  2⤵
  PID:9104
- C:\Windows\System\pUmYSQb.exe
  C:\Windows\System\pUmYSQb.exe
  2⤵
  PID:8280
- C:\Windows\System\PomeHta.exe
  C:\Windows\System\PomeHta.exe
  2⤵
  PID:8688
- C:\Windows\System\ssHNQcy.exe
  C:\Windows\System\ssHNQcy.exe
  2⤵
  PID:8696
- C:\Windows\System\zcYmouK.exe
  C:\Windows\System\zcYmouK.exe
  2⤵
  PID:8744
- C:\Windows\System\qXewctC.exe
  C:\Windows\System\qXewctC.exe
  2⤵
  PID:8832
- C:\Windows\System\AwaWRNB.exe
  C:\Windows\System\AwaWRNB.exe
  2⤵
  PID:8836
- C:\Windows\System\hjUnDzp.exe
  C:\Windows\System\hjUnDzp.exe
  2⤵
  PID:8948
- C:\Windows\System\gSGzKzG.exe
  C:\Windows\System\gSGzKzG.exe
  2⤵
  PID:9004
- C:\Windows\System\JqoMQrX.exe
  C:\Windows\System\JqoMQrX.exe
  2⤵
  PID:9068
- C:\Windows\System\OsClFyO.exe
  C:\Windows\System\OsClFyO.exe
  2⤵
  PID:8200
- C:\Windows\System\XlgcTac.exe
  C:\Windows\System\XlgcTac.exe
  2⤵
  PID:9100
- C:\Windows\System\SJJJAuq.exe
  C:\Windows\System\SJJJAuq.exe
  2⤵
  PID:8420
- C:\Windows\System\yptLino.exe
  C:\Windows\System\yptLino.exe
  2⤵
  PID:8604
- C:\Windows\System\FpmeUix.exe
  C:\Windows\System\FpmeUix.exe
  2⤵
  PID:9208
- C:\Windows\System\IJqxYYg.exe
  C:\Windows\System\IJqxYYg.exe
  2⤵
  PID:9180
- C:\Windows\System\TvAsXjd.exe
  C:\Windows\System\TvAsXjd.exe
  2⤵
  PID:8716
- C:\Windows\System\VHZpaYx.exe
  C:\Windows\System\VHZpaYx.exe
  2⤵
  PID:8624
- C:\Windows\System\sGRurzA.exe
  C:\Windows\System\sGRurzA.exe
  2⤵
  PID:8768
- C:\Windows\System\oEENwug.exe
  C:\Windows\System\oEENwug.exe
  2⤵
  PID:8736
- C:\Windows\System\NOqYmFl.exe
  C:\Windows\System\NOqYmFl.exe
  2⤵
  PID:8884
- C:\Windows\System\ErnAfms.exe
  C:\Windows\System\ErnAfms.exe
  2⤵
  PID:8568
- C:\Windows\System\ElBJToE.exe
  C:\Windows\System\ElBJToE.exe
  2⤵
  PID:8580
- C:\Windows\System\OnPRSdT.exe
  C:\Windows\System\OnPRSdT.exe
  2⤵
  PID:8896
- C:\Windows\System\BxUKptC.exe
  C:\Windows\System\BxUKptC.exe
  2⤵
  PID:9160
- C:\Windows\System\mHSmqRE.exe
  C:\Windows\System\mHSmqRE.exe
  2⤵
  PID:8764
- C:\Windows\System\sXUGZym.exe
  C:\Windows\System\sXUGZym.exe
  2⤵
  PID:8844
- C:\Windows\System\LuzJABE.exe
  C:\Windows\System\LuzJABE.exe
  2⤵
  PID:8440
- C:\Windows\System\AuaZVJJ.exe
  C:\Windows\System\AuaZVJJ.exe
  2⤵
  PID:8932
- C:\Windows\System\CeCcjjg.exe
  C:\Windows\System\CeCcjjg.exe
  2⤵
  PID:9176
- C:\Windows\System\ydPygen.exe
  C:\Windows\System\ydPygen.exe
  2⤵
  PID:8336
- C:\Windows\System\YzGeRjI.exe
  C:\Windows\System\YzGeRjI.exe
  2⤵
  PID:9084
- C:\Windows\System\rTiWTly.exe
  C:\Windows\System\rTiWTly.exe
  2⤵
  PID:7400
- C:\Windows\System\kZDUToP.exe
  C:\Windows\System\kZDUToP.exe
  2⤵
  PID:9000
- C:\Windows\System\exLbgnP.exe
  C:\Windows\System\exLbgnP.exe
  2⤵
  PID:9212
- C:\Windows\System\ATxURVI.exe
  C:\Windows\System\ATxURVI.exe
  2⤵
  PID:8536
- C:\Windows\System\ZtZCFIo.exe
  C:\Windows\System\ZtZCFIo.exe
  2⤵
  PID:8384
- C:\Windows\System\HqLNdDC.exe
  C:\Windows\System\HqLNdDC.exe
  2⤵
  PID:9232
- C:\Windows\System\IJzMmks.exe
  C:\Windows\System\IJzMmks.exe
  2⤵
  PID:9248
- C:\Windows\System\jqAHtcT.exe
  C:\Windows\System\jqAHtcT.exe
  2⤵
  PID:9264
- C:\Windows\System\SoiCqgE.exe
  C:\Windows\System\SoiCqgE.exe
  2⤵
  PID:9284
- C:\Windows\System\SiiBBpy.exe
  C:\Windows\System\SiiBBpy.exe
  2⤵
  PID:9304
- C:\Windows\System\aXAPrnt.exe
  C:\Windows\System\aXAPrnt.exe
  2⤵
  PID:9320
- C:\Windows\System\ZtHTxQn.exe
  C:\Windows\System\ZtHTxQn.exe
  2⤵
  PID:9340
- C:\Windows\System\wfPqjPs.exe
  C:\Windows\System\wfPqjPs.exe
  2⤵
  PID:9356
- C:\Windows\System\zSzvHLV.exe
  C:\Windows\System\zSzvHLV.exe
  2⤵
  PID:9376
- C:\Windows\System\XCjpvoL.exe
  C:\Windows\System\XCjpvoL.exe
  2⤵
  PID:9396
- C:\Windows\System\pDloJdn.exe
  C:\Windows\System\pDloJdn.exe
  2⤵
  PID:9428
- C:\Windows\System\GPnxjCa.exe
  C:\Windows\System\GPnxjCa.exe
  2⤵
  PID:9468
- C:\Windows\System\mZalCfI.exe
  C:\Windows\System\mZalCfI.exe
  2⤵
  PID:9484
- C:\Windows\System\hSGHrUD.exe
  C:\Windows\System\hSGHrUD.exe
  2⤵
  PID:9500
- C:\Windows\System\sSqSzWh.exe
  C:\Windows\System\sSqSzWh.exe
  2⤵
  PID:9520
- C:\Windows\System\FOgkshE.exe
  C:\Windows\System\FOgkshE.exe
  2⤵
  PID:9540
- C:\Windows\System\LjbRUFG.exe
  C:\Windows\System\LjbRUFG.exe
  2⤵
  PID:9556
- C:\Windows\System\NHFAkVB.exe
  C:\Windows\System\NHFAkVB.exe
  2⤵
  PID:9572
- C:\Windows\System\eiUfIRK.exe
  C:\Windows\System\eiUfIRK.exe
  2⤵
  PID:9592
- C:\Windows\System\GZvHyFi.exe
  C:\Windows\System\GZvHyFi.exe
  2⤵
  PID:9608
- C:\Windows\System\QmqMZvk.exe
  C:\Windows\System\QmqMZvk.exe
  2⤵
  PID:9644
- C:\Windows\System\vIrIDeO.exe
  C:\Windows\System\vIrIDeO.exe
  2⤵
  PID:9660
- C:\Windows\System\zMwZVdU.exe
  C:\Windows\System\zMwZVdU.exe
  2⤵
  PID:9676
- C:\Windows\System\OpeZxLg.exe
  C:\Windows\System\OpeZxLg.exe
  2⤵
  PID:9696
- C:\Windows\System\KbLmYXn.exe
  C:\Windows\System\KbLmYXn.exe
  2⤵
  PID:9712
- C:\Windows\System\qtJoxoe.exe
  C:\Windows\System\qtJoxoe.exe
  2⤵
  PID:9728
- C:\Windows\System\zxGAaOz.exe
  C:\Windows\System\zxGAaOz.exe
  2⤵
  PID:9752
- C:\Windows\System\cTrbBxv.exe
  C:\Windows\System\cTrbBxv.exe
  2⤵
  PID:9792
- C:\Windows\System\fXllkQG.exe
  C:\Windows\System\fXllkQG.exe
  2⤵
  PID:9808
- C:\Windows\System\YLbIFmg.exe
  C:\Windows\System\YLbIFmg.exe
  2⤵
  PID:9828
- C:\Windows\System\YCvusuU.exe
  C:\Windows\System\YCvusuU.exe
  2⤵
  PID:9844
- C:\Windows\System\WktXAQB.exe
  C:\Windows\System\WktXAQB.exe
  2⤵
  PID:9864
- C:\Windows\System\GrqTnHP.exe
  C:\Windows\System\GrqTnHP.exe
  2⤵
  PID:9884
- C:\Windows\System\mUHpVWl.exe
  C:\Windows\System\mUHpVWl.exe
  2⤵
  PID:9908
- C:\Windows\System\ZvJUuvB.exe
  C:\Windows\System\ZvJUuvB.exe
  2⤵
  PID:9924
- C:\Windows\System\EYxkEIP.exe
  C:\Windows\System\EYxkEIP.exe
  2⤵
  PID:9944
- C:\Windows\System\tKllCos.exe
  C:\Windows\System\tKllCos.exe
  2⤵
  PID:9964
- C:\Windows\System\YdlkhUw.exe
  C:\Windows\System\YdlkhUw.exe
  2⤵
  PID:9980
- C:\Windows\System\bUWXgNn.exe
  C:\Windows\System\bUWXgNn.exe
  2⤵
  PID:9996
- C:\Windows\System\TkCJJPo.exe
  C:\Windows\System\TkCJJPo.exe
  2⤵
  PID:10016
- C:\Windows\System\UKUlgLk.exe
  C:\Windows\System\UKUlgLk.exe
  2⤵
  PID:10032
- C:\Windows\System\PIGtTVO.exe
  C:\Windows\System\PIGtTVO.exe
  2⤵
  PID:10048
- C:\Windows\System\VGlktlQ.exe
  C:\Windows\System\VGlktlQ.exe
  2⤵
  PID:10092
- C:\Windows\System\VYDFULW.exe
  C:\Windows\System\VYDFULW.exe
  2⤵
  PID:10108
- C:\Windows\System\BhVxAUd.exe
  C:\Windows\System\BhVxAUd.exe
  2⤵
  PID:10136
- C:\Windows\System\uRwbxIB.exe
  C:\Windows\System\uRwbxIB.exe
  2⤵
  PID:10152
- C:\Windows\System\qaTNSQM.exe
  C:\Windows\System\qaTNSQM.exe
  2⤵
  PID:10172
- C:\Windows\System\UgonFeb.exe
  C:\Windows\System\UgonFeb.exe
  2⤵
  PID:10188
- C:\Windows\System\OemhTcj.exe
  C:\Windows\System\OemhTcj.exe
  2⤵
  PID:10208
- C:\Windows\System\gWdwsDx.exe
  C:\Windows\System\gWdwsDx.exe
  2⤵
  PID:10224
- C:\Windows\System\dkAgPuR.exe
  C:\Windows\System\dkAgPuR.exe
  2⤵
  PID:9224
- C:\Windows\System\lHIiKui.exe
  C:\Windows\System\lHIiKui.exe
  2⤵
  PID:9336
- C:\Windows\System\GrXPJzH.exe
  C:\Windows\System\GrXPJzH.exe
  2⤵
  PID:9372
- C:\Windows\System\iDbzEXX.exe
  C:\Windows\System\iDbzEXX.exe
  2⤵
  PID:9412
- C:\Windows\System\YvziteE.exe
  C:\Windows\System\YvziteE.exe
  2⤵
  PID:9312
- C:\Windows\System\rkBgqST.exe
  C:\Windows\System\rkBgqST.exe
  2⤵
  PID:9384
- C:\Windows\System\nYOVXPP.exe
  C:\Windows\System\nYOVXPP.exe
  2⤵
  PID:9440
- C:\Windows\System\RlMtRTg.exe
  C:\Windows\System\RlMtRTg.exe
  2⤵
  PID:9460
- C:\Windows\System\bkTYMBZ.exe
  C:\Windows\System\bkTYMBZ.exe
  2⤵
  PID:9492
- C:\Windows\System\GQHcEzm.exe
  C:\Windows\System\GQHcEzm.exe
  2⤵
  PID:9564
- C:\Windows\System\fEvgrKd.exe
  C:\Windows\System\fEvgrKd.exe
  2⤵
  PID:9588
- C:\Windows\System\YaeNDSa.exe
  C:\Windows\System\YaeNDSa.exe
  2⤵
  PID:9632
- C:\Windows\System\UhSMOwv.exe
  C:\Windows\System\UhSMOwv.exe
  2⤵
  PID:9668
- C:\Windows\System\OcmVdyc.exe
  C:\Windows\System\OcmVdyc.exe
  2⤵
  PID:9652
- C:\Windows\System\eZzKVuJ.exe
  C:\Windows\System\eZzKVuJ.exe
  2⤵
  PID:9740
- C:\Windows\System\wOHjaLj.exe
  C:\Windows\System\wOHjaLj.exe
  2⤵
  PID:9684
- C:\Windows\System\zebUGqJ.exe
  C:\Windows\System\zebUGqJ.exe
  2⤵
  PID:9772
- C:\Windows\System\trvDHIt.exe
  C:\Windows\System\trvDHIt.exe
  2⤵
  PID:9788
- C:\Windows\System\CEPzPCU.exe
  C:\Windows\System\CEPzPCU.exe
  2⤵
  PID:9836
- C:\Windows\System\viWzHpP.exe
  C:\Windows\System\viWzHpP.exe
  2⤵
  PID:9824
- C:\Windows\System\XSAmRxN.exe
  C:\Windows\System\XSAmRxN.exe
  2⤵
  PID:9892
- C:\Windows\System\riJGKGQ.exe
  C:\Windows\System\riJGKGQ.exe
  2⤵
  PID:9940
- C:\Windows\System\jxhZwCx.exe
  C:\Windows\System\jxhZwCx.exe
  2⤵
  PID:9960
- C:\Windows\System\FEHzTte.exe
  C:\Windows\System\FEHzTte.exe
  2⤵
  PID:10040
- C:\Windows\System\IafAPGk.exe
  C:\Windows\System\IafAPGk.exe
  2⤵
  PID:10028
- C:\Windows\System\UMbBQjo.exe
  C:\Windows\System\UMbBQjo.exe
  2⤵
  PID:10068
- C:\Windows\System\joYQyJz.exe
  C:\Windows\System\joYQyJz.exe
  2⤵
  PID:10100
- C:\Windows\System\MCfLrrX.exe
  C:\Windows\System\MCfLrrX.exe
  2⤵
  PID:9784
- C:\Windows\System\PjikBMe.exe
  C:\Windows\System\PjikBMe.exe
  2⤵
  PID:10164
- C:\Windows\System\jfeEXir.exe
  C:\Windows\System\jfeEXir.exe
  2⤵
  PID:10200
- C:\Windows\System\FNmMdbq.exe
  C:\Windows\System\FNmMdbq.exe
  2⤵
  PID:10220
- C:\Windows\System\APXEkyp.exe
  C:\Windows\System\APXEkyp.exe
  2⤵
  PID:9260
- C:\Windows\System\yfHkEdC.exe
  C:\Windows\System\yfHkEdC.exe
  2⤵
  PID:9240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIGDbNi.exe

Filesize
1.1MB

MD5
787ab3006fa2b5d10e4d5398550e88af

SHA1
b5c10314688a45b0506265e1d7dbe24115eeaa23

SHA256
aa257a74e8efda35100d7f05546c038de512b336ec104e216e3eb3cfe6360ede

SHA512
a60a3a9fa3de75ffb39549f2007f4a55b69b92426b6f7ea3f7337adf7c3a3da2fcfded259578c3b5189b3e21ef7fb29f3884d2b470caa1f08777a5c041d39865

Download Submit
C:\Windows\system\LYcHzRI.exe

Filesize
1.1MB

MD5
c9ff23edca355292243da45ff4437733

SHA1
3f7fc7a33b3560852786add521a7bab0686d5792

SHA256
d0f8986175b0360a3f3c27b3bb990da3b33c2dcbf8be608d396ab069cbf6ea12

SHA512
c216d5963367fa25453b1ddbc0dcc4277ce6058e5f66e9dff8eae28b87030966bb444ead7d0aa8ff30aa34829ed71c701b9c2bfd9cb1ffa05711e04a8af3c239

Download Submit
C:\Windows\system\LeDEQmb.exe

Filesize
1.1MB

MD5
33c28b443e22b34c17010974d258a27a

SHA1
98f9b658d1298ad6e36a65dee9f43d2e0092258a

SHA256
a42aa6aad67b59576a99343a48503709ce399bd756cd79d90bf073dbd58db994

SHA512
5daee20cbc5a6bad0ef90b39a67b37cda0cc9a754e579996d157a62bf9f6afc3f5ceab747db5c585fb9511c3905a246692dbf52d76becf51574cb51d8c582dc0

Download Submit
C:\Windows\system\MZzQxkI.exe

Filesize
1.1MB

MD5
c6ffb84d8414f1543f5db72eb54a3167

SHA1
b3e2ab9e900026fe01429c27d9a788c22f74a358

SHA256
3a9f9905fb62bb5ff954573f4c82691129d3788ec6046be890dfe3229de51203

SHA512
6fc1561c8fb9231e3f3ae3cac4442aa7222562398952f75a339481b53b06bc2e8215a799ae18986d0efc367c10ea69b8326d6d6aa5236313a324f059542820f5

Download Submit
C:\Windows\system\MjTAubf.exe

Filesize
1.1MB

MD5
98d3ecdb697214244548c1c13068224b

SHA1
ba3700462e3add22ae7201c24f10075b4c503a85

SHA256
ca6510befe0010b1788af128d6e25cd7bfde75894d863c04f3036b7d4b31673c

SHA512
562dff31da57973dc5ae1551a1904abffd9f0aa70dd72cdc791ac0dd9edd23acedf15c1cb7b8140968cea46e2a1a4a57e8d9467c07de0b359c6e0a1369033f07

Download Submit
C:\Windows\system\QNjFnNn.exe

Filesize
1.1MB

MD5
1edd5eb6cd5d75ed4648ca495302b423

SHA1
59f2ccf7ed3900e3d2abc2162c58d47fe2894145

SHA256
741e5c8d2fca95ec49f8327723365e2d8946906a4fc20305e83f41854b4e1c5e

SHA512
5f6e4f8899f58b9c9587f64d934755d891a1c5ff69bee7ab4c5fe272a9c2bc08fdc0234c6b5833c294ecd438b40dbcedb2152148c3ad82407fe7dbbf519b1769

Download Submit
C:\Windows\system\SBpckZb.exe

Filesize
1.1MB

MD5
082016f34748c8dcce3e94773ee33b99

SHA1
ae746593a3326932e8f2d96f1cf467d32e00af60

SHA256
59713e1d6aca778481c4370b961531f021057dcacdfbfa18616302b695abe4c0

SHA512
2bf7175ad9e307d7f7b7ddf4f6c4769964ea4175541fb2f9f6aaee6ee4c11faca7a7ba7c99cbdb5e2639d72dfbe7f27f234c6b464243847055c69d8086c620b1

Download Submit
C:\Windows\system\SnHdxwH.exe

Filesize
1.1MB

MD5
04549c94ed8505c6e4fda1a93c99673d

SHA1
cfee4ced7611754506460cfc6bca41461a4c3f0d

SHA256
4d8d354c7a807716120da8dd6dde48331a5ce2d3b54c60725b5cb31a3bd7e7c1

SHA512
20102cf3450b2208b0dfd11916d979411318bc46005dda060281aa0b5d055a56134c23fc128e8f48e4ede3d58d6635380da9f25216a4969bb35c294d439790c9

Download Submit
C:\Windows\system\THnpHut.exe

Filesize
1.1MB

MD5
4cdc2291a94d8ee98713e12ca10f384f

SHA1
beddb4e75fe418768bdad9dc8c45d61259663c44

SHA256
142cb24961968f05efdf43261b7cefa36a5fd9722e2b3542ebc2147f500a3bba

SHA512
b3ab160f2eac52c100485c9d651a49f3c5979e025b052d108e53abd5575850fb7fca0d066700db081051b97a2baff9ee424055e3cff8cd139ab67b6768e2c5b2

Download Submit
C:\Windows\system\UnkKLtW.exe

Filesize
1.1MB

MD5
de80373522e1e6f743b1d0fd8aa2a310

SHA1
580f9afb7dc396233966d010c3b4894131ec89b8

SHA256
a7ce4fd188e0cec08b9547e548e8b953c9438433823180e7ec6ac29268cf5fb4

SHA512
dca3dd8f1ff5a54f5d8aa72ccaf788673645b4e113c2d7617ac4f112c4db5a2d2321f59e02d252d154d9f76682d30d75062c9ebdea07dc7397f434a4eecf78e9

Download Submit
C:\Windows\system\YAgyfyv.exe

Filesize
1.1MB

MD5
252beddf79135cbda15f9a1782ec0e67

SHA1
226bae54767074f52fa159c2046a85555279af78

SHA256
e1cc61cc11a19be6dc722177c853e5f797c4612efcba23417b7ebfa4f2523c29

SHA512
6ed3d456b6759f5c6848e99e5d07b93d76812321e3a8123541140a9120a3b9c9404916de54034c2b608c7841b29ea0493868ed288f580900c437f006b2012f13

Download Submit
C:\Windows\system\ZnGKzzt.exe

Filesize
1.1MB

MD5
fe51a7df12b08ab0e2ce6f6a6ec9d48a

SHA1
26c43c7eb9a0d01f1552725910c3576f1eb9ed6d

SHA256
c4ae5a5a15535f7eab21228bcc31833c7a95eac68c3e2dcbc027b78c370ae4cd

SHA512
3c584f6da81a9cc53d08d6c9985b72cc35e345064ca217456b248ce6eeb625010c05b5832131338d712baab0ce8b8880aa806b6bd0ef757d3679f42ba0c1ddf2

Download Submit
C:\Windows\system\dvgcNEv.exe

Filesize
1.1MB

MD5
4b26740004b27bf6fa913ae87ca4beec

SHA1
421ecfa60d66a1f7598748e60c5e8aa95fea8004

SHA256
d8369614b95b926764783d97ffc638e9d4861e03f1a6cade342fd7227ebf3333

SHA512
a2e8d9542334494381f520928abd6eb6ed43bb9ac47ac8acb30f1251a25438147dc404ec98d231e404a11ed1e306ac7848bb684f0c2336990c96df2a1389f812

Download Submit
C:\Windows\system\hfZzPWF.exe

Filesize
1.1MB

MD5
1bb048f4274e6ef1c9fba3d87533183a

SHA1
c1a213c529de6a9f71f853499aff869d95829767

SHA256
8f182ff7af77fe1ed5a6e649dc6071907b98775a911df465e290af89509a91a6

SHA512
78bc31f02ec459f0cc813bf1f01945f71bb843d8a3be4d90e3ae5d1125fb487641ddadd8e6182bba20392a8eb2788548c6e9428d39ac438d848404bd5a6cb3a4

Download Submit
C:\Windows\system\iWUWGIH.exe

Filesize
1.1MB

MD5
db5afa3ab0638f647c1059baf15a5523

SHA1
a57977b554d340af01f8405337a376b56ca39a80

SHA256
687062b122cdd3b3601a0342728987be6ec1096f4257335947def70bf6ee8430

SHA512
eb72195338d6408146b6a95b496b33dfe1a760786075d0dd904133ef23cb1a473b18c816e5711fd14edd26f5b8d1abd9a71535c9b8730c94f8a84d43492bdf2d

Download Submit
C:\Windows\system\khUxPvL.exe

Filesize
1.1MB

MD5
88f9229bbae66b1ab29c8215d0665582

SHA1
88bdc83c056fb8c07f2c5214a6e823e17b8f4860

SHA256
9c58bd46bd6600b69e3a2c8129fd5ef8e4f44e04bcdda8f157f8ce36398921dc

SHA512
2295c4ff6a85b8195d99d91b7f586e60e182101dbd30cc436f5cde5cbc430df72d0c30da06d8347d58d76b53c6ba31ef47c097523b4ee8bfef4a7d7fd20a714e

Download Submit
C:\Windows\system\lvFmYod.exe

Filesize
1.1MB

MD5
a18c94f5b5617dc2a0a6740b2da29890

SHA1
5135f04de240de966e58b9218be0a9126fe4850b

SHA256
c3ecc4c3a965a0e8eeffabc1e587113f6fc393eab93a266cef70acc7799593bb

SHA512
a2b255347803f817ee977e7c074bee3df0599705c8227891f428956fda7af95275045a1d7bd6a4dfb7a408c33f6ea85cc3a9a066319f8c218f6fd003c91af219

Download Submit
C:\Windows\system\mGOipRA.exe

Filesize
1.1MB

MD5
34eed2610ae73da9eb2ad98f4b4bfcb0

SHA1
ed0f866c7fa06d109b7500978cc8ea4efdee88d6

SHA256
59a2ccebde6671f7f6a6ba7840ca7f2be9651ade84dc8f81995760360cd4c600

SHA512
8b2548e6123fcd729d68c58816e2dcfd40db1d10eed9cbfd91b2781b6c389d753abd5a5102258b903c6ffdbdfc50d254fbea7760064d1163eddf3c09f649b741

Download Submit
C:\Windows\system\mSRvtfG.exe

Filesize
1.1MB

MD5
77779b31f31ad82ca27362473ef7dad6

SHA1
c8a164f5f8058373e08e934773f73b290a9f0599

SHA256
ccab057914d3c5bf09dbfad8bf12a5713544e1622faea197b67d4b915986c5f9

SHA512
a7233bb5ea573c9c0a55f9e3d3171c0ea0bd591137179cbec289d5364ccc9b6b20cb7cf439521bbae68738c1ed8b8be8d0f527d3893a5fb493821d90635d66aa

Download Submit
C:\Windows\system\shicOgk.exe

Filesize
1.1MB

MD5
ea825804531317a7558a4f3b360dd594

SHA1
e79bd7be23da65d48132b610640b168ade9471ee

SHA256
009ad3abdc55f746b1cd1fc17f85f3ac9c145142c4264bf69855b2df9b1b2a91

SHA512
658097e5ae9273088a9823706fa5c436451f69c86c5b9842782c427e48d729a10bb58526b1393a628463d230f10ae21f74072e47e55a158b1186cf2b1da48539

Download Submit
C:\Windows\system\suBBuRL.exe

Filesize
1.1MB

MD5
01a8a6864b7e6fce36eeb25337f99903

SHA1
e9af879dac22783762d091c4e9eff4456933894c

SHA256
29c6676e5ae1efd72484f415755c84ec400c7c6f620518755620e34e9679f727

SHA512
03f3f70a2976defa846c655d5d2b40f8759b39af987275ea4211e0bd94532ebdc07e9e799ea398eedcdd783343c92c36c408686039200ff8f6391fcdd75a2c14

Download Submit
C:\Windows\system\tKdikuX.exe

Filesize
1.1MB

MD5
114854dda314cdf4a925d6bd59ef1f47

SHA1
90010b1ec73c3f84c7faf9f1b7bde58c9a16023f

SHA256
a92a29f753eeee9343427edcce699f2015c12bbae3fad3c100e6e86eaa454468

SHA512
b9ffc4115ceea7c5bf4baba1f9a0433ea555ef374169e2212b9699747f1a21ea0ae76b91adde33be17d3c6f3e79e5cd9539a73415d58a0d56b0a1a2415d47672

Download Submit
C:\Windows\system\uKOBBjU.exe

Filesize
1.1MB

MD5
e2a2530147513501d69c2e15bd7f1d9a

SHA1
fbe12cc7e35f255dc6b39428a2b8ad2471efe7c5

SHA256
9736cb11f9957e29906db5a56ad0a55f0a5fe4cfdfd5242c8a0ae04d90f72a37

SHA512
42418d22eb8c12d2a2d15ffe46b921d6a85c751692f6ca60b30a0acd144b098565765a0cd2e1792e03679bbed107f19b950be1c91967d1af2d586deb5d4a3303

Download Submit
C:\Windows\system\uKXssXz.exe

Filesize
1.1MB

MD5
c475eb895496db38f2a6eb3e10965c84

SHA1
844a299a87a9f6fdc4c508dc870c1c4f477967e9

SHA256
dcdada6df67bae85cab1a8ac39c69e3034c01e88e99a185d1a37f0916ce8a928

SHA512
c948b13e7eae78e8cbda1f4a7f0be4453413c0cffcaf53f3bc733efde0f9ef65b0faf0b4fad473b30efb8a186cd839be8efb3049efdd23e2776c7940a1766436

Download Submit
C:\Windows\system\ujPxTZe.exe

Filesize
1.1MB

MD5
6b545b3a35a2325ddb5ae13fff40be45

SHA1
dd3c2e183acb1a344ac7216acf1e37ef9f3ec353

SHA256
38946435ffff31bd633cf5e96b119aa7f5fd8109c8139f907d2c648a58367317

SHA512
a327221794e61d0de04875759f0bc67d31198963102ecb88e21a1e067e095528cb8c5d47026c903611caa3231bb6b3ca3d2145e4cbea9075e18fb1b62ac9c562

Download Submit
C:\Windows\system\upYlquj.exe

Filesize
1.1MB

MD5
0c056c015d0f5ff50039754c1487fa79

SHA1
104fe11d80ff1a7c38efcfd6349b07b47d5b4e66

SHA256
2ce2866964018a35ec143ef7392edab0f81b63bbf73aca806277e3539ba880a7

SHA512
b0c0bec51aaaf46d748f5adb5cd779c74356e11ac991fe8aa209e6551e50d88f69c0e0c86ef4943b340e73cf7ded561c80786b31292dd3c8e15a17c93955581f

Download Submit
C:\Windows\system\yoGMdZD.exe

Filesize
1.1MB

MD5
403d68af5b05b4963cf4afcabc62bfec

SHA1
9807330f847e4b5228616610827b7282f73fe304

SHA256
41bbb704228aab469b6934eb65af5d3942728b93c88efaab473eb13d8008b4c9

SHA512
c927c8d65e70386a79d23f2d6ed510f25319a5eb8b3c1f3db13ae0af4b2984d5e7de97eafdbc7542a6b9e1b3e5a49126d3ab4d0c645be87aeb73407214f1f845

Download Submit
C:\Windows\system\zEJJOZK.exe

Filesize
1.1MB

MD5
92031db369415e45ea33ef95caf4296d

SHA1
9217701d3722d77edfe5874a3a0f7858d3088447

SHA256
6cf9c7576eb2165b846f9b3034f03a92a724056562ddd72f50353d598f4ac19e

SHA512
63b3e374ebf2dafc156fc6366a8a72f65f5a4fc6576faf7616ad1a8c06cbf9ba5dcdaad0a22decad7baf1eae5a5c8af34d2bfd20feafdffbc80a6749d1412728

Download Submit
\Windows\system\JcZVtmD.exe

Filesize
1.1MB

MD5
68867352dd87c8b0d18931046843f9fa

SHA1
86e47e6dcee784e64eae4616ca0e4682cf489ffe

SHA256
12ecbf42d9e845cf036087a8fb0d883a9ea260ad6fb89ab7db089c311a943806

SHA512
dda801584d86be96914b25d470a95d65367fafdb85bf24dd487430589c934a31047eb1b1f5b6285f396abd8fa0c9d92ee65e2801fa9fb64aece92980ead0fcf0

Download Submit
\Windows\system\mkrtGoS.exe

Filesize
1.1MB

MD5
4f1a4ca562fede7c5d3850e39214878c

SHA1
ec107d2591ad775b1d1bb0f6fe93007a6736b01a

SHA256
73d074b65decb25cf4a19baab59c00b001e3a90ab803d10562c195deed7f2493

SHA512
8741b65ddf73da4711366b9dc5122b562d87fc9df4e9f412948df9eaf55e149bbfa48e9d82de61cae2de44530c52601fe48099a716b17ec060973bd638bab863

Download Submit
\Windows\system\oWuoZay.exe

Filesize
1.1MB

MD5
70a2bd11a3b50e5bbbecbbadfb3a2e58

SHA1
2486176fa1b98674dd44100c2a9e3c76a1059ad8

SHA256
28d8ca71f22e4bca67e13269c2d5d7853884239a93dd6870fcf12fd687dd895d

SHA512
184d52e027334698656d8edac4c4a31b062129d2a242431b428f322a6977565fc9af010ce048549faf7077c304d6a70e855495dc46dff39063ad5367956dcaec

Download Submit
\Windows\system\vfbDaMx.exe

Filesize
1.1MB

MD5
419028f65ebdf7c971a4f34a49de3a7a

SHA1
978c5eb334c7e2d4dcb56ef682fef93490a318b0

SHA256
10e07569e5124a46e21bc3d7b6843174b7f57240f9b99ca760a7d9480aa2d57f

SHA512
df5ede2fa6cae893080912cc4bf6104903c70d8a42662111d146de545b07d482cc7618cb1febecc323096f01b8e152e052883a844a250f9672cc3fb654fb97b6

Download Submit
memory/2236-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download