xmrig | af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 00:33 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
Size

1.6MB
MD5

0a528b538c9a232f0bf1f0dd0fe82481
SHA1

67e2b2ca958b62925450594fc9826fa509c6be92
SHA256

af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced
SHA512

5be7f5daef5573d4845113ca6af20099729f242854c6b34fb0af6f545d1af724eb854abf20c1aaccf79ce452bfb58f8019f79fe09a0940733dbd7d795c5b8ed8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxR9EurG1:GemTLkNdfE0pZy7

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000018710-2.dat	xmrig
behavioral1/files/0x0006000000019240-8.dat	xmrig
behavioral1/files/0x0006000000019246-9.dat	xmrig
behavioral1/files/0x000600000001926b-17.dat	xmrig
behavioral1/files/0x000800000001930d-21.dat	xmrig
behavioral1/files/0x0005000000019cba-40.dat	xmrig
behavioral1/files/0x000500000001a07e-68.dat	xmrig
behavioral1/files/0x000500000001a307-76.dat	xmrig
behavioral1/files/0x000500000001a42d-100.dat	xmrig
behavioral1/files/0x000500000001a4af-128.dat	xmrig
behavioral1/files/0x000500000001a4a9-124.dat	xmrig
behavioral1/files/0x000500000001a49a-120.dat	xmrig
behavioral1/files/0x000500000001a499-117.dat	xmrig
behavioral1/files/0x000500000001a48d-112.dat	xmrig
behavioral1/files/0x000500000001a48b-108.dat	xmrig
behavioral1/files/0x000500000001a46f-104.dat	xmrig
behavioral1/files/0x000500000001a427-96.dat	xmrig
behavioral1/files/0x000500000001a41e-92.dat	xmrig
behavioral1/files/0x000500000001a41d-89.dat	xmrig
behavioral1/files/0x000500000001a41b-84.dat	xmrig
behavioral1/files/0x000500000001a359-80.dat	xmrig
behavioral1/files/0x000500000001a09e-72.dat	xmrig
behavioral1/files/0x000500000001a075-64.dat	xmrig
behavioral1/files/0x0005000000019f94-60.dat	xmrig
behavioral1/files/0x0005000000019f8a-56.dat	xmrig
behavioral1/files/0x0005000000019dbf-52.dat	xmrig
behavioral1/files/0x0005000000019d8e-48.dat	xmrig
behavioral1/files/0x0005000000019cca-44.dat	xmrig
behavioral1/files/0x0005000000019c57-36.dat	xmrig
behavioral1/files/0x0005000000019c3e-32.dat	xmrig
behavioral1/files/0x00060000000194cd-29.dat	xmrig
behavioral1/files/0x000800000001932d-24.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1488	nJjXsen.exe
2132	KfucBmP.exe
2196	gFBmyYC.exe
2400	mBNxVQC.exe
2312	PWdgCLh.exe
2668	fnAiDHz.exe
3036	NPmmhLG.exe
2632	MMOXLZb.exe
2720	gOGBPXV.exe
2792	TVMuRAk.exe
2596	tsOtnyh.exe
2812	LCtloRe.exe
2180	Oulaxvn.exe
2776	IcmMniD.exe
2684	PjdERli.exe
2288	cBvjGVU.exe
2600	EVROczD.exe
2504	dDayvuV.exe
2564	affzlQE.exe
2940	DePlKRs.exe
2948	lZzqKUL.exe
788	MhlLeOU.exe
2248	xLzoEET.exe
1728	hwvdoid.exe
764	iMlMlTF.exe
1956	fswZuUN.exe
1152	qybOUTo.exe
1764	hxIsrev.exe
1692	UyPEnTq.exe
1112	JievWsx.exe
3068	fpDwcSs.exe
2076	EwjeySf.exe
2348	daXVfXE.exe
2692	TKrSlXS.exe
952	GwutjdQ.exe
2296	ExNwMRL.exe
1828	FfvgPGM.exe
2736	EWaRGkQ.exe
2712	LPAmwUh.exe
772	LPHhTzs.exe
1092	BdoPKcd.exe
1916	rkEHMRF.exe
112	hkSodDP.exe
1596	jAqlJjb.exe
1616	tDSUZyx.exe
1724	gIKAaay.exe
2456	LwiOSEz.exe
740	OdlrZQy.exe
1504	asEYRSj.exe
548	UAuaLZl.exe
1332	GVwgmRp.exe
3016	nJSvkdU.exe
836	oxfWlSc.exe
1716	qOvNHmn.exe
1744	wwUqqup.exe
684	iGmJsWw.exe
3044	yVwvMfi.exe
832	AKpBuQm.exe
568	bvUcMLJ.exe
2728	BtDImZZ.exe
2140	JlhXCJB.exe
2996	vyFZMQj.exe
2176	nLjeXfL.exe
964	TAmpfZa.exe

Loads dropped DLL 64 IoCs

pid	Process
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ksgDohY.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\hONphim.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\gZDEtty.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\IOcYMcl.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\QzjChBt.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\bOtKzhR.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\AHKhYBU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\MhlLeOU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\FrCDRIb.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\pNZUwio.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\ZrlafEh.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\XogjJWS.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\vIJakGA.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\hbjEJPc.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\QzaFeLL.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\VzvMhGN.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\NDEYIMh.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\xVbkruN.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\pFKSmNH.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\JZEZKZJ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\lhekUbz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\YIRdPHM.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\FFTtqUt.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\BWxTmwc.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\lYJwyYq.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\ATvzqOB.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\kGiAdRK.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\uYiNFAN.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\fnAiDHz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\UWzUzUf.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\TCYbTFH.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\biihoBy.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\KjCceKR.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\uyGdPMp.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\rRtizJZ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\AHarGes.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\YxNbFKE.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\JoqUJXO.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\xDhhYDz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\sBaswUs.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\CFbkEMQ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\edNHfwg.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\cFMFTly.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\xPSHIGw.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\aJSgdCw.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\nMcyDBt.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\vEUkqxz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\henvakF.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\hpJRjix.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\RKGQuHN.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\nrHlCjm.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\bHBpGTT.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\MQDLTNC.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\tbsVkrg.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\uImGZsW.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\FGuHDiw.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\udoiCpm.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\rACWBMQ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\FQFxDFu.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\TVUebsk.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\SAvJeHM.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\xGVNPTq.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\qvvukGF.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\xfbmMxq.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1488	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	32
PID 1384 wrote to memory of 1488	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	32
PID 1384 wrote to memory of 1488	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	32
PID 1384 wrote to memory of 2132	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	33
PID 1384 wrote to memory of 2132	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	33
PID 1384 wrote to memory of 2132	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	33
PID 1384 wrote to memory of 2196	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	34
PID 1384 wrote to memory of 2196	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	34
PID 1384 wrote to memory of 2196	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	34
PID 1384 wrote to memory of 2400	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	35
PID 1384 wrote to memory of 2400	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	35
PID 1384 wrote to memory of 2400	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	35
PID 1384 wrote to memory of 2312	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	36
PID 1384 wrote to memory of 2312	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	36
PID 1384 wrote to memory of 2312	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	36
PID 1384 wrote to memory of 2668	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	37
PID 1384 wrote to memory of 2668	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	37
PID 1384 wrote to memory of 2668	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	37
PID 1384 wrote to memory of 3036	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	38
PID 1384 wrote to memory of 3036	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	38
PID 1384 wrote to memory of 3036	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	38
PID 1384 wrote to memory of 2632	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	39
PID 1384 wrote to memory of 2632	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	39
PID 1384 wrote to memory of 2632	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	39
PID 1384 wrote to memory of 2720	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	40
PID 1384 wrote to memory of 2720	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	40
PID 1384 wrote to memory of 2720	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	40
PID 1384 wrote to memory of 2792	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	41
PID 1384 wrote to memory of 2792	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	41
PID 1384 wrote to memory of 2792	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	41
PID 1384 wrote to memory of 2596	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	42
PID 1384 wrote to memory of 2596	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	42
PID 1384 wrote to memory of 2596	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	42
PID 1384 wrote to memory of 2812	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	43
PID 1384 wrote to memory of 2812	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	43
PID 1384 wrote to memory of 2812	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	43
PID 1384 wrote to memory of 2180	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	44
PID 1384 wrote to memory of 2180	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	44
PID 1384 wrote to memory of 2180	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	44
PID 1384 wrote to memory of 2776	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	45
PID 1384 wrote to memory of 2776	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	45
PID 1384 wrote to memory of 2776	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	45
PID 1384 wrote to memory of 2684	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	46
PID 1384 wrote to memory of 2684	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	46
PID 1384 wrote to memory of 2684	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	46
PID 1384 wrote to memory of 2288	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	47
PID 1384 wrote to memory of 2288	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	47
PID 1384 wrote to memory of 2288	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	47
PID 1384 wrote to memory of 2600	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	48
PID 1384 wrote to memory of 2600	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	48
PID 1384 wrote to memory of 2600	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	48
PID 1384 wrote to memory of 2504	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	49
PID 1384 wrote to memory of 2504	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	49
PID 1384 wrote to memory of 2504	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	49
PID 1384 wrote to memory of 2564	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	50
PID 1384 wrote to memory of 2564	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	50
PID 1384 wrote to memory of 2564	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	50
PID 1384 wrote to memory of 2940	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	51
PID 1384 wrote to memory of 2940	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	51
PID 1384 wrote to memory of 2940	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	51
PID 1384 wrote to memory of 2948	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	52
PID 1384 wrote to memory of 2948	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	52
PID 1384 wrote to memory of 2948	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	52
PID 1384 wrote to memory of 788	1384	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	53

C:\Users\Admin\AppData\Local\Temp\af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
"C:\Users\Admin\AppData\Local\Temp\af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\System\nJjXsen.exe
  C:\Windows\System\nJjXsen.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\KfucBmP.exe
  C:\Windows\System\KfucBmP.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\gFBmyYC.exe
  C:\Windows\System\gFBmyYC.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\mBNxVQC.exe
  C:\Windows\System\mBNxVQC.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\PWdgCLh.exe
  C:\Windows\System\PWdgCLh.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\fnAiDHz.exe
  C:\Windows\System\fnAiDHz.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\NPmmhLG.exe
  C:\Windows\System\NPmmhLG.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MMOXLZb.exe
  C:\Windows\System\MMOXLZb.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\gOGBPXV.exe
  C:\Windows\System\gOGBPXV.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\TVMuRAk.exe
  C:\Windows\System\TVMuRAk.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\tsOtnyh.exe
  C:\Windows\System\tsOtnyh.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\LCtloRe.exe
  C:\Windows\System\LCtloRe.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\Oulaxvn.exe
  C:\Windows\System\Oulaxvn.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\IcmMniD.exe
  C:\Windows\System\IcmMniD.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\PjdERli.exe
  C:\Windows\System\PjdERli.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\cBvjGVU.exe
  C:\Windows\System\cBvjGVU.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\EVROczD.exe
  C:\Windows\System\EVROczD.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\dDayvuV.exe
  C:\Windows\System\dDayvuV.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\affzlQE.exe
  C:\Windows\System\affzlQE.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DePlKRs.exe
  C:\Windows\System\DePlKRs.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\lZzqKUL.exe
  C:\Windows\System\lZzqKUL.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\MhlLeOU.exe
  C:\Windows\System\MhlLeOU.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\xLzoEET.exe
  C:\Windows\System\xLzoEET.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\hwvdoid.exe
  C:\Windows\System\hwvdoid.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iMlMlTF.exe
  C:\Windows\System\iMlMlTF.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\fswZuUN.exe
  C:\Windows\System\fswZuUN.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\qybOUTo.exe
  C:\Windows\System\qybOUTo.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\hxIsrev.exe
  C:\Windows\System\hxIsrev.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\UyPEnTq.exe
  C:\Windows\System\UyPEnTq.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\JievWsx.exe
  C:\Windows\System\JievWsx.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\fpDwcSs.exe
  C:\Windows\System\fpDwcSs.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\EwjeySf.exe
  C:\Windows\System\EwjeySf.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\daXVfXE.exe
  C:\Windows\System\daXVfXE.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\TKrSlXS.exe
  C:\Windows\System\TKrSlXS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\GwutjdQ.exe
  C:\Windows\System\GwutjdQ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\ExNwMRL.exe
  C:\Windows\System\ExNwMRL.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\FfvgPGM.exe
  C:\Windows\System\FfvgPGM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\EWaRGkQ.exe
  C:\Windows\System\EWaRGkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\LPAmwUh.exe
  C:\Windows\System\LPAmwUh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\LPHhTzs.exe
  C:\Windows\System\LPHhTzs.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\BdoPKcd.exe
  C:\Windows\System\BdoPKcd.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\rkEHMRF.exe
  C:\Windows\System\rkEHMRF.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\hkSodDP.exe
  C:\Windows\System\hkSodDP.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\jAqlJjb.exe
  C:\Windows\System\jAqlJjb.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\tDSUZyx.exe
  C:\Windows\System\tDSUZyx.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\gIKAaay.exe
  C:\Windows\System\gIKAaay.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\LwiOSEz.exe
  C:\Windows\System\LwiOSEz.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\OdlrZQy.exe
  C:\Windows\System\OdlrZQy.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\asEYRSj.exe
  C:\Windows\System\asEYRSj.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\UAuaLZl.exe
  C:\Windows\System\UAuaLZl.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\GVwgmRp.exe
  C:\Windows\System\GVwgmRp.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\nJSvkdU.exe
  C:\Windows\System\nJSvkdU.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\oxfWlSc.exe
  C:\Windows\System\oxfWlSc.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\qOvNHmn.exe
  C:\Windows\System\qOvNHmn.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\wwUqqup.exe
  C:\Windows\System\wwUqqup.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\iGmJsWw.exe
  C:\Windows\System\iGmJsWw.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\yVwvMfi.exe
  C:\Windows\System\yVwvMfi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\AKpBuQm.exe
  C:\Windows\System\AKpBuQm.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\bvUcMLJ.exe
  C:\Windows\System\bvUcMLJ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\BtDImZZ.exe
  C:\Windows\System\BtDImZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JlhXCJB.exe
  C:\Windows\System\JlhXCJB.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\vyFZMQj.exe
  C:\Windows\System\vyFZMQj.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\nLjeXfL.exe
  C:\Windows\System\nLjeXfL.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\TAmpfZa.exe
  C:\Windows\System\TAmpfZa.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\YwbYnRP.exe
  C:\Windows\System\YwbYnRP.exe
  2⤵
  PID:996
- C:\Windows\System\oCSFhSY.exe
  C:\Windows\System\oCSFhSY.exe
  2⤵
  PID:1980
- C:\Windows\System\IsYXPkC.exe
  C:\Windows\System\IsYXPkC.exe
  2⤵
  PID:2356
- C:\Windows\System\xODdVDh.exe
  C:\Windows\System\xODdVDh.exe
  2⤵
  PID:1804
- C:\Windows\System\arhAaNP.exe
  C:\Windows\System\arhAaNP.exe
  2⤵
  PID:1588
- C:\Windows\System\hqkjPTP.exe
  C:\Windows\System\hqkjPTP.exe
  2⤵
  PID:1696
- C:\Windows\System\fGvlcNh.exe
  C:\Windows\System\fGvlcNh.exe
  2⤵
  PID:1960
- C:\Windows\System\gKbhdNj.exe
  C:\Windows\System\gKbhdNj.exe
  2⤵
  PID:2304
- C:\Windows\System\RiRKjns.exe
  C:\Windows\System\RiRKjns.exe
  2⤵
  PID:2852
- C:\Windows\System\yZDuLhL.exe
  C:\Windows\System\yZDuLhL.exe
  2⤵
  PID:3004
- C:\Windows\System\Vbbvhhv.exe
  C:\Windows\System\Vbbvhhv.exe
  2⤵
  PID:2756
- C:\Windows\System\ViionMs.exe
  C:\Windows\System\ViionMs.exe
  2⤵
  PID:2796
- C:\Windows\System\BVnmVvq.exe
  C:\Windows\System\BVnmVvq.exe
  2⤵
  PID:2648
- C:\Windows\System\YIRdPHM.exe
  C:\Windows\System\YIRdPHM.exe
  2⤵
  PID:2836
- C:\Windows\System\rmEauma.exe
  C:\Windows\System\rmEauma.exe
  2⤵
  PID:2492
- C:\Windows\System\mohHYaB.exe
  C:\Windows\System\mohHYaB.exe
  2⤵
  PID:2112
- C:\Windows\System\UyEHpLt.exe
  C:\Windows\System\UyEHpLt.exe
  2⤵
  PID:2744
- C:\Windows\System\tbkZXwX.exe
  C:\Windows\System\tbkZXwX.exe
  2⤵
  PID:2672
- C:\Windows\System\CKjYsJD.exe
  C:\Windows\System\CKjYsJD.exe
  2⤵
  PID:1048
- C:\Windows\System\IuefiIf.exe
  C:\Windows\System\IuefiIf.exe
  2⤵
  PID:1396
- C:\Windows\System\drJnhjB.exe
  C:\Windows\System\drJnhjB.exe
  2⤵
  PID:1808
- C:\Windows\System\pyxhwUu.exe
  C:\Windows\System\pyxhwUu.exe
  2⤵
  PID:2344
- C:\Windows\System\YCtJuBJ.exe
  C:\Windows\System\YCtJuBJ.exe
  2⤵
  PID:1532
- C:\Windows\System\rkHYPwf.exe
  C:\Windows\System\rkHYPwf.exe
  2⤵
  PID:1648
- C:\Windows\System\rLpcvbD.exe
  C:\Windows\System\rLpcvbD.exe
  2⤵
  PID:2452
- C:\Windows\System\VDSUlMS.exe
  C:\Windows\System\VDSUlMS.exe
  2⤵
  PID:1704
- C:\Windows\System\RzYaEyj.exe
  C:\Windows\System\RzYaEyj.exe
  2⤵
  PID:1612
- C:\Windows\System\sTCsKHE.exe
  C:\Windows\System\sTCsKHE.exe
  2⤵
  PID:2008
- C:\Windows\System\ocPVkCW.exe
  C:\Windows\System\ocPVkCW.exe
  2⤵
  PID:2268
- C:\Windows\System\aNRylMC.exe
  C:\Windows\System\aNRylMC.exe
  2⤵
  PID:2216
- C:\Windows\System\WtiDkhS.exe
  C:\Windows\System\WtiDkhS.exe
  2⤵
  PID:2032
- C:\Windows\System\zkGDDZX.exe
  C:\Windows\System\zkGDDZX.exe
  2⤵
  PID:872
- C:\Windows\System\LeENQcr.exe
  C:\Windows\System\LeENQcr.exe
  2⤵
  PID:3000
- C:\Windows\System\zOKQEyu.exe
  C:\Windows\System\zOKQEyu.exe
  2⤵
  PID:2060
- C:\Windows\System\PJfSGkU.exe
  C:\Windows\System\PJfSGkU.exe
  2⤵
  PID:1968
- C:\Windows\System\MDMvGdE.exe
  C:\Windows\System\MDMvGdE.exe
  2⤵
  PID:2708
- C:\Windows\System\ksgDohY.exe
  C:\Windows\System\ksgDohY.exe
  2⤵
  PID:2136
- C:\Windows\System\froRZiX.exe
  C:\Windows\System\froRZiX.exe
  2⤵
  PID:2612
- C:\Windows\System\QNRLfaR.exe
  C:\Windows\System\QNRLfaR.exe
  2⤵
  PID:2500
- C:\Windows\System\JjyTAmp.exe
  C:\Windows\System\JjyTAmp.exe
  2⤵
  PID:2980
- C:\Windows\System\spqedcB.exe
  C:\Windows\System\spqedcB.exe
  2⤵
  PID:1800
- C:\Windows\System\OMoyuAh.exe
  C:\Windows\System\OMoyuAh.exe
  2⤵
  PID:800
- C:\Windows\System\NmFosci.exe
  C:\Windows\System\NmFosci.exe
  2⤵
  PID:1760
- C:\Windows\System\kPntJIt.exe
  C:\Windows\System\kPntJIt.exe
  2⤵
  PID:1976
- C:\Windows\System\upmANhf.exe
  C:\Windows\System\upmANhf.exe
  2⤵
  PID:1192
- C:\Windows\System\jLETSKl.exe
  C:\Windows\System\jLETSKl.exe
  2⤵
  PID:1628
- C:\Windows\System\LsfAWjJ.exe
  C:\Windows\System\LsfAWjJ.exe
  2⤵
  PID:2840
- C:\Windows\System\AEvynaE.exe
  C:\Windows\System\AEvynaE.exe
  2⤵
  PID:2120
- C:\Windows\System\oaZMcEM.exe
  C:\Windows\System\oaZMcEM.exe
  2⤵
  PID:1732
- C:\Windows\System\mmqZaSn.exe
  C:\Windows\System\mmqZaSn.exe
  2⤵
  PID:316
- C:\Windows\System\AiVhEIT.exe
  C:\Windows\System\AiVhEIT.exe
  2⤵
  PID:1740
- C:\Windows\System\pCnJKNm.exe
  C:\Windows\System\pCnJKNm.exe
  2⤵
  PID:1284
- C:\Windows\System\JvShOmj.exe
  C:\Windows\System\JvShOmj.exe
  2⤵
  PID:1988
- C:\Windows\System\FUESsls.exe
  C:\Windows\System\FUESsls.exe
  2⤵
  PID:3104
- C:\Windows\System\KlhAsqM.exe
  C:\Windows\System\KlhAsqM.exe
  2⤵
  PID:3124
- C:\Windows\System\iHwoNrS.exe
  C:\Windows\System\iHwoNrS.exe
  2⤵
  PID:3152
- C:\Windows\System\KLbzaWh.exe
  C:\Windows\System\KLbzaWh.exe
  2⤵
  PID:3172
- C:\Windows\System\axUWqNd.exe
  C:\Windows\System\axUWqNd.exe
  2⤵
  PID:3188
- C:\Windows\System\eQliljO.exe
  C:\Windows\System\eQliljO.exe
  2⤵
  PID:3216
- C:\Windows\System\iagBFua.exe
  C:\Windows\System\iagBFua.exe
  2⤵
  PID:3376
- C:\Windows\System\ntgtTyQ.exe
  C:\Windows\System\ntgtTyQ.exe
  2⤵
  PID:3400
- C:\Windows\System\TLEBXfc.exe
  C:\Windows\System\TLEBXfc.exe
  2⤵
  PID:3456
- C:\Windows\System\EYHohgb.exe
  C:\Windows\System\EYHohgb.exe
  2⤵
  PID:3492
- C:\Windows\System\GoSIuQE.exe
  C:\Windows\System\GoSIuQE.exe
  2⤵
  PID:3512
- C:\Windows\System\YQZDuPo.exe
  C:\Windows\System\YQZDuPo.exe
  2⤵
  PID:3536
- C:\Windows\System\rgrjizs.exe
  C:\Windows\System\rgrjizs.exe
  2⤵
  PID:3556
- C:\Windows\System\cfUdaWF.exe
  C:\Windows\System\cfUdaWF.exe
  2⤵
  PID:3596
- C:\Windows\System\CYAgUlp.exe
  C:\Windows\System\CYAgUlp.exe
  2⤵
  PID:3620
- C:\Windows\System\CAzZVZN.exe
  C:\Windows\System\CAzZVZN.exe
  2⤵
  PID:3640
- C:\Windows\System\dQvagaE.exe
  C:\Windows\System\dQvagaE.exe
  2⤵
  PID:3660
- C:\Windows\System\bQATLSx.exe
  C:\Windows\System\bQATLSx.exe
  2⤵
  PID:3680
- C:\Windows\System\sEZXZWn.exe
  C:\Windows\System\sEZXZWn.exe
  2⤵
  PID:3700
- C:\Windows\System\oNjvyTw.exe
  C:\Windows\System\oNjvyTw.exe
  2⤵
  PID:3720
- C:\Windows\System\lBLEWUh.exe
  C:\Windows\System\lBLEWUh.exe
  2⤵
  PID:3740
- C:\Windows\System\JBmxRSI.exe
  C:\Windows\System\JBmxRSI.exe
  2⤵
  PID:3760
- C:\Windows\System\hfShTxC.exe
  C:\Windows\System\hfShTxC.exe
  2⤵
  PID:3780
- C:\Windows\System\TETSkNg.exe
  C:\Windows\System\TETSkNg.exe
  2⤵
  PID:3800
- C:\Windows\System\mabZfjv.exe
  C:\Windows\System\mabZfjv.exe
  2⤵
  PID:3820
- C:\Windows\System\ZrWzsjv.exe
  C:\Windows\System\ZrWzsjv.exe
  2⤵
  PID:3836
- C:\Windows\System\EfPNLEI.exe
  C:\Windows\System\EfPNLEI.exe
  2⤵
  PID:3860
- C:\Windows\System\boavmAF.exe
  C:\Windows\System\boavmAF.exe
  2⤵
  PID:3880
- C:\Windows\System\KHooxvs.exe
  C:\Windows\System\KHooxvs.exe
  2⤵
  PID:3900
- C:\Windows\System\OdHBqXV.exe
  C:\Windows\System\OdHBqXV.exe
  2⤵
  PID:3920
- C:\Windows\System\ewVVRGA.exe
  C:\Windows\System\ewVVRGA.exe
  2⤵
  PID:3940
- C:\Windows\System\yRwUrom.exe
  C:\Windows\System\yRwUrom.exe
  2⤵
  PID:3960
- C:\Windows\System\hNsJjdV.exe
  C:\Windows\System\hNsJjdV.exe
  2⤵
  PID:3980
- C:\Windows\System\BVWQYhl.exe
  C:\Windows\System\BVWQYhl.exe
  2⤵
  PID:4000
- C:\Windows\System\NMTkYvQ.exe
  C:\Windows\System\NMTkYvQ.exe
  2⤵
  PID:4020
- C:\Windows\System\qnriOyL.exe
  C:\Windows\System\qnriOyL.exe
  2⤵
  PID:4040
- C:\Windows\System\fmSPmzG.exe
  C:\Windows\System\fmSPmzG.exe
  2⤵
  PID:4060
- C:\Windows\System\EoCPyfi.exe
  C:\Windows\System\EoCPyfi.exe
  2⤵
  PID:4080
- C:\Windows\System\tvrntXC.exe
  C:\Windows\System\tvrntXC.exe
  2⤵
  PID:2320
- C:\Windows\System\hlBeziJ.exe
  C:\Windows\System\hlBeziJ.exe
  2⤵
  PID:2192
- C:\Windows\System\RtIfdXc.exe
  C:\Windows\System\RtIfdXc.exe
  2⤵
  PID:2988
- C:\Windows\System\AgMxUsd.exe
  C:\Windows\System\AgMxUsd.exe
  2⤵
  PID:2904
- C:\Windows\System\CYGUaZb.exe
  C:\Windows\System\CYGUaZb.exe
  2⤵
  PID:2472
- C:\Windows\System\XnccVwr.exe
  C:\Windows\System\XnccVwr.exe
  2⤵
  PID:1652
- C:\Windows\System\IKdqAyS.exe
  C:\Windows\System\IKdqAyS.exe
  2⤵
  PID:3168
- C:\Windows\System\FtiYcdD.exe
  C:\Windows\System\FtiYcdD.exe
  2⤵
  PID:3204
- C:\Windows\System\mivhAqq.exe
  C:\Windows\System\mivhAqq.exe
  2⤵
  PID:2636
- C:\Windows\System\bdfWclw.exe
  C:\Windows\System\bdfWclw.exe
  2⤵
  PID:1560
- C:\Windows\System\UthcUDi.exe
  C:\Windows\System\UthcUDi.exe
  2⤵
  PID:2640
- C:\Windows\System\MKBSWXt.exe
  C:\Windows\System\MKBSWXt.exe
  2⤵
  PID:3384
- C:\Windows\System\HPTmPyA.exe
  C:\Windows\System\HPTmPyA.exe
  2⤵
  PID:3028
- C:\Windows\System\Omgkpki.exe
  C:\Windows\System\Omgkpki.exe
  2⤵
  PID:2676
- C:\Windows\System\GHIqHkh.exe
  C:\Windows\System\GHIqHkh.exe
  2⤵
  PID:3472
- C:\Windows\System\CoktFKR.exe
  C:\Windows\System\CoktFKR.exe
  2⤵
  PID:3476
- C:\Windows\System\sPvQpyU.exe
  C:\Windows\System\sPvQpyU.exe
  2⤵
  PID:2292
- C:\Windows\System\epkprmp.exe
  C:\Windows\System\epkprmp.exe
  2⤵
  PID:1712
- C:\Windows\System\NTmUmyc.exe
  C:\Windows\System\NTmUmyc.exe
  2⤵
  PID:2168
- C:\Windows\System\iVmstiA.exe
  C:\Windows\System\iVmstiA.exe
  2⤵
  PID:3096
- C:\Windows\System\mjmlsVp.exe
  C:\Windows\System\mjmlsVp.exe
  2⤵
  PID:3148
- C:\Windows\System\nBwYzOq.exe
  C:\Windows\System\nBwYzOq.exe
  2⤵
  PID:3236
- C:\Windows\System\RIolfUH.exe
  C:\Windows\System\RIolfUH.exe
  2⤵
  PID:3252
- C:\Windows\System\yOESFdR.exe
  C:\Windows\System\yOESFdR.exe
  2⤵
  PID:3272
- C:\Windows\System\gAQmkel.exe
  C:\Windows\System\gAQmkel.exe
  2⤵
  PID:3288
- C:\Windows\System\VgNoFES.exe
  C:\Windows\System\VgNoFES.exe
  2⤵
  PID:3304
- C:\Windows\System\SkJyBoN.exe
  C:\Windows\System\SkJyBoN.exe
  2⤵
  PID:3320
- C:\Windows\System\mIOxmHk.exe
  C:\Windows\System\mIOxmHk.exe
  2⤵
  PID:3336
- C:\Windows\System\CRboJpG.exe
  C:\Windows\System\CRboJpG.exe
  2⤵
  PID:3356
- C:\Windows\System\QzuHtxF.exe
  C:\Windows\System\QzuHtxF.exe
  2⤵
  PID:3416
- C:\Windows\System\kToocNG.exe
  C:\Windows\System\kToocNG.exe
  2⤵
  PID:3436
- C:\Windows\System\BRIZgNr.exe
  C:\Windows\System\BRIZgNr.exe
  2⤵
  PID:2664
- C:\Windows\System\WhlRwvY.exe
  C:\Windows\System\WhlRwvY.exe
  2⤵
  PID:3544
- C:\Windows\System\WjIXhWj.exe
  C:\Windows\System\WjIXhWj.exe
  2⤵
  PID:3408
- C:\Windows\System\BKasjyT.exe
  C:\Windows\System\BKasjyT.exe
  2⤵
  PID:3180
- C:\Windows\System\CzzZbxR.exe
  C:\Windows\System\CzzZbxR.exe
  2⤵
  PID:3552
- C:\Windows\System\qYqoWRZ.exe
  C:\Windows\System\qYqoWRZ.exe
  2⤵
  PID:2536
- C:\Windows\System\hHeVldz.exe
  C:\Windows\System\hHeVldz.exe
  2⤵
  PID:3672
- C:\Windows\System\pKliWGv.exe
  C:\Windows\System\pKliWGv.exe
  2⤵
  PID:3688
- C:\Windows\System\oVucDFw.exe
  C:\Windows\System\oVucDFw.exe
  2⤵
  PID:3696
- C:\Windows\System\VkoRkbG.exe
  C:\Windows\System\VkoRkbG.exe
  2⤵
  PID:3756
- C:\Windows\System\NRSCZep.exe
  C:\Windows\System\NRSCZep.exe
  2⤵
  PID:3768
- C:\Windows\System\rHONJZK.exe
  C:\Windows\System\rHONJZK.exe
  2⤵
  PID:3796
- C:\Windows\System\uLLcSQm.exe
  C:\Windows\System\uLLcSQm.exe
  2⤵
  PID:3772
- C:\Windows\System\cZlijlX.exe
  C:\Windows\System\cZlijlX.exe
  2⤵
  PID:3816
- C:\Windows\System\FgEeuvy.exe
  C:\Windows\System\FgEeuvy.exe
  2⤵
  PID:3868
- C:\Windows\System\QogeEdO.exe
  C:\Windows\System\QogeEdO.exe
  2⤵
  PID:3852
- C:\Windows\System\KCKNkxI.exe
  C:\Windows\System\KCKNkxI.exe
  2⤵
  PID:3912
- C:\Windows\System\YGhRbHN.exe
  C:\Windows\System\YGhRbHN.exe
  2⤵
  PID:2724
- C:\Windows\System\OXzEVVm.exe
  C:\Windows\System\OXzEVVm.exe
  2⤵
  PID:4028
- C:\Windows\System\jeULMDn.exe
  C:\Windows\System\jeULMDn.exe
  2⤵
  PID:4048
- C:\Windows\System\henvakF.exe
  C:\Windows\System\henvakF.exe
  2⤵
  PID:4088
- C:\Windows\System\epfLlEL.exe
  C:\Windows\System\epfLlEL.exe
  2⤵
  PID:2244
- C:\Windows\System\sIvuTQC.exe
  C:\Windows\System\sIvuTQC.exe
  2⤵
  PID:4092
- C:\Windows\System\aLYURoY.exe
  C:\Windows\System\aLYURoY.exe
  2⤵
  PID:2220
- C:\Windows\System\iztaBbH.exe
  C:\Windows\System\iztaBbH.exe
  2⤵
  PID:2280
- C:\Windows\System\HbLVJQF.exe
  C:\Windows\System\HbLVJQF.exe
  2⤵
  PID:3116
- C:\Windows\System\aqpNrPH.exe
  C:\Windows\System\aqpNrPH.exe
  2⤵
  PID:1352
- C:\Windows\System\TimkOKx.exe
  C:\Windows\System\TimkOKx.exe
  2⤵
  PID:2704
- C:\Windows\System\EXGyyZl.exe
  C:\Windows\System\EXGyyZl.exe
  2⤵
  PID:2936
- C:\Windows\System\zLJMOoc.exe
  C:\Windows\System\zLJMOoc.exe
  2⤵
  PID:2824
- C:\Windows\System\sxJGkYE.exe
  C:\Windows\System\sxJGkYE.exe
  2⤵
  PID:1632
- C:\Windows\System\GIGHlrl.exe
  C:\Windows\System\GIGHlrl.exe
  2⤵
  PID:2044
- C:\Windows\System\YMtNOlA.exe
  C:\Windows\System\YMtNOlA.exe
  2⤵
  PID:3488
- C:\Windows\System\fkfgIYg.exe
  C:\Windows\System\fkfgIYg.exe
  2⤵
  PID:3396
- C:\Windows\System\BhbtVsH.exe
  C:\Windows\System\BhbtVsH.exe
  2⤵
  PID:1172
- C:\Windows\System\WDinwRn.exe
  C:\Windows\System\WDinwRn.exe
  2⤵
  PID:2588
- C:\Windows\System\rkQNnvK.exe
  C:\Windows\System\rkQNnvK.exe
  2⤵
  PID:3228
- C:\Windows\System\BHjaMKh.exe
  C:\Windows\System\BHjaMKh.exe
  2⤵
  PID:3296
- C:\Windows\System\VavJSAQ.exe
  C:\Windows\System\VavJSAQ.exe
  2⤵
  PID:3360
- C:\Windows\System\kGaFHPJ.exe
  C:\Windows\System\kGaFHPJ.exe
  2⤵
  PID:3504
- C:\Windows\System\vWCblrl.exe
  C:\Windows\System\vWCblrl.exe
  2⤵
  PID:1032
- C:\Windows\System\SGsVqmC.exe
  C:\Windows\System\SGsVqmC.exe
  2⤵
  PID:2516
- C:\Windows\System\LReJRDW.exe
  C:\Windows\System\LReJRDW.exe
  2⤵
  PID:3500
- C:\Windows\System\QVNZDcX.exe
  C:\Windows\System\QVNZDcX.exe
  2⤵
  PID:2976
- C:\Windows\System\lnHMxoL.exe
  C:\Windows\System\lnHMxoL.exe
  2⤵
  PID:3312
- C:\Windows\System\dSxtInr.exe
  C:\Windows\System\dSxtInr.exe
  2⤵
  PID:3732
- C:\Windows\System\ughgNIU.exe
  C:\Windows\System\ughgNIU.exe
  2⤵
  PID:3844
- C:\Windows\System\JDamNZI.exe
  C:\Windows\System\JDamNZI.exe
  2⤵
  PID:3244
- C:\Windows\System\OlkLdhS.exe
  C:\Windows\System\OlkLdhS.exe
  2⤵
  PID:1684
- C:\Windows\System\NQpthbU.exe
  C:\Windows\System\NQpthbU.exe
  2⤵
  PID:3568
- C:\Windows\System\XOTWDRC.exe
  C:\Windows\System\XOTWDRC.exe
  2⤵
  PID:3588
- C:\Windows\System\FGuHDiw.exe
  C:\Windows\System\FGuHDiw.exe
  2⤵
  PID:3832
- C:\Windows\System\PJQbxhV.exe
  C:\Windows\System\PJQbxhV.exe
  2⤵
  PID:3956
- C:\Windows\System\MWLpnOd.exe
  C:\Windows\System\MWLpnOd.exe
  2⤵
  PID:2628
- C:\Windows\System\FFTtqUt.exe
  C:\Windows\System\FFTtqUt.exe
  2⤵
  PID:3652
- C:\Windows\System\LJQdmgX.exe
  C:\Windows\System\LJQdmgX.exe
  2⤵
  PID:1620
- C:\Windows\System\kTlQEgS.exe
  C:\Windows\System\kTlQEgS.exe
  2⤵
  PID:3972
- C:\Windows\System\WoLFeBN.exe
  C:\Windows\System\WoLFeBN.exe
  2⤵
  PID:4008
- C:\Windows\System\tSSsGQk.exe
  C:\Windows\System\tSSsGQk.exe
  2⤵
  PID:4072
- C:\Windows\System\QNUUeXo.exe
  C:\Windows\System\QNUUeXo.exe
  2⤵
  PID:1904
- C:\Windows\System\wQuoQGB.exe
  C:\Windows\System\wQuoQGB.exe
  2⤵
  PID:1508
- C:\Windows\System\eSQATdd.exe
  C:\Windows\System\eSQATdd.exe
  2⤵
  PID:2404
- C:\Windows\System\RszREwa.exe
  C:\Windows\System\RszREwa.exe
  2⤵
  PID:3200
- C:\Windows\System\XJJuZqD.exe
  C:\Windows\System\XJJuZqD.exe
  2⤵
  PID:2944
- C:\Windows\System\cBbNVAC.exe
  C:\Windows\System\cBbNVAC.exe
  2⤵
  PID:3088
- C:\Windows\System\AQwgLvX.exe
  C:\Windows\System\AQwgLvX.exe
  2⤵
  PID:3080
- C:\Windows\System\EiWpWvZ.exe
  C:\Windows\System\EiWpWvZ.exe
  2⤵
  PID:2764
- C:\Windows\System\NnzpmBj.exe
  C:\Windows\System\NnzpmBj.exe
  2⤵
  PID:2604
- C:\Windows\System\vMxsZaY.exe
  C:\Windows\System\vMxsZaY.exe
  2⤵
  PID:2576
- C:\Windows\System\NDEYIMh.exe
  C:\Windows\System\NDEYIMh.exe
  2⤵
  PID:3532
- C:\Windows\System\JbjZQXG.exe
  C:\Windows\System\JbjZQXG.exe
  2⤵
  PID:3444
- C:\Windows\System\EDtxrGS.exe
  C:\Windows\System\EDtxrGS.exe
  2⤵
  PID:1028
- C:\Windows\System\ozkbCSd.exe
  C:\Windows\System\ozkbCSd.exe
  2⤵
  PID:3636
- C:\Windows\System\aBnNUNE.exe
  C:\Windows\System\aBnNUNE.exe
  2⤵
  PID:3348
- C:\Windows\System\kBXgMlh.exe
  C:\Windows\System\kBXgMlh.exe
  2⤵
  PID:3528
- C:\Windows\System\zLPCGwp.exe
  C:\Windows\System\zLPCGwp.exe
  2⤵
  PID:3792
- C:\Windows\System\SjaTJkI.exe
  C:\Windows\System\SjaTJkI.exe
  2⤵
  PID:3716
- C:\Windows\System\cGlyHlx.exe
  C:\Windows\System\cGlyHlx.exe
  2⤵
  PID:3184
- C:\Windows\System\wiBTBKM.exe
  C:\Windows\System\wiBTBKM.exe
  2⤵
  PID:1952
- C:\Windows\System\ovCckjH.exe
  C:\Windows\System\ovCckjH.exe
  2⤵
  PID:3976
- C:\Windows\System\uTXRRKf.exe
  C:\Windows\System\uTXRRKf.exe
  2⤵
  PID:3196
- C:\Windows\System\QGfjEUm.exe
  C:\Windows\System\QGfjEUm.exe
  2⤵
  PID:2488
- C:\Windows\System\JphxAqG.exe
  C:\Windows\System\JphxAqG.exe
  2⤵
  PID:1252
- C:\Windows\System\ajAEMvQ.exe
  C:\Windows\System\ajAEMvQ.exe
  2⤵
  PID:3264
- C:\Windows\System\fWrNsVA.exe
  C:\Windows\System\fWrNsVA.exe
  2⤵
  PID:3284
- C:\Windows\System\FsshVeR.exe
  C:\Windows\System\FsshVeR.exe
  2⤵
  PID:4116
- C:\Windows\System\TBsDgTA.exe
  C:\Windows\System\TBsDgTA.exe
  2⤵
  PID:4132
- C:\Windows\System\HOqIADT.exe
  C:\Windows\System\HOqIADT.exe
  2⤵
  PID:4152
- C:\Windows\System\yRcgHcf.exe
  C:\Windows\System\yRcgHcf.exe
  2⤵
  PID:4168
- C:\Windows\System\KwYLBuj.exe
  C:\Windows\System\KwYLBuj.exe
  2⤵
  PID:4192
- C:\Windows\System\rDCPdzu.exe
  C:\Windows\System\rDCPdzu.exe
  2⤵
  PID:4208
- C:\Windows\System\GsgyFTP.exe
  C:\Windows\System\GsgyFTP.exe
  2⤵
  PID:4228
- C:\Windows\System\VKdThNe.exe
  C:\Windows\System\VKdThNe.exe
  2⤵
  PID:4248
- C:\Windows\System\hakZnzv.exe
  C:\Windows\System\hakZnzv.exe
  2⤵
  PID:4276
- C:\Windows\System\jlqODbd.exe
  C:\Windows\System\jlqODbd.exe
  2⤵
  PID:4312
- C:\Windows\System\EOwQrxA.exe
  C:\Windows\System\EOwQrxA.exe
  2⤵
  PID:4328
- C:\Windows\System\XcpLclV.exe
  C:\Windows\System\XcpLclV.exe
  2⤵
  PID:4344
- C:\Windows\System\MnqQPEI.exe
  C:\Windows\System\MnqQPEI.exe
  2⤵
  PID:4364
- C:\Windows\System\CFbkEMQ.exe
  C:\Windows\System\CFbkEMQ.exe
  2⤵
  PID:4380
- C:\Windows\System\qaXiMgv.exe
  C:\Windows\System\qaXiMgv.exe
  2⤵
  PID:4408
- C:\Windows\System\tZgwjOL.exe
  C:\Windows\System\tZgwjOL.exe
  2⤵
  PID:4424
- C:\Windows\System\BnJBrCz.exe
  C:\Windows\System\BnJBrCz.exe
  2⤵
  PID:4448
- C:\Windows\System\qbydPrC.exe
  C:\Windows\System\qbydPrC.exe
  2⤵
  PID:4468
- C:\Windows\System\pFMNbuX.exe
  C:\Windows\System\pFMNbuX.exe
  2⤵
  PID:4488
- C:\Windows\System\myzjzry.exe
  C:\Windows\System\myzjzry.exe
  2⤵
  PID:4504
- C:\Windows\System\xhVQolD.exe
  C:\Windows\System\xhVQolD.exe
  2⤵
  PID:4528
- C:\Windows\System\KhDuZPv.exe
  C:\Windows\System\KhDuZPv.exe
  2⤵
  PID:4580
- C:\Windows\System\tOwxilg.exe
  C:\Windows\System\tOwxilg.exe
  2⤵
  PID:4608
- C:\Windows\System\xjNcxBd.exe
  C:\Windows\System\xjNcxBd.exe
  2⤵
  PID:4624
- C:\Windows\System\fFxZUrh.exe
  C:\Windows\System\fFxZUrh.exe
  2⤵
  PID:4640
- C:\Windows\System\YFJPwnf.exe
  C:\Windows\System\YFJPwnf.exe
  2⤵
  PID:4656
- C:\Windows\System\xKpzCMy.exe
  C:\Windows\System\xKpzCMy.exe
  2⤵
  PID:4716
- C:\Windows\System\WKhxnzT.exe
  C:\Windows\System\WKhxnzT.exe
  2⤵
  PID:4756
- C:\Windows\System\cvjtGAt.exe
  C:\Windows\System\cvjtGAt.exe
  2⤵
  PID:4772
- C:\Windows\System\MajdBVy.exe
  C:\Windows\System\MajdBVy.exe
  2⤵
  PID:4788
- C:\Windows\System\veGSEFy.exe
  C:\Windows\System\veGSEFy.exe
  2⤵
  PID:4804
- C:\Windows\System\PSKYNfC.exe
  C:\Windows\System\PSKYNfC.exe
  2⤵
  PID:4824
- C:\Windows\System\XIMuohx.exe
  C:\Windows\System\XIMuohx.exe
  2⤵
  PID:4868
- C:\Windows\System\arlSlNm.exe
  C:\Windows\System\arlSlNm.exe
  2⤵
  PID:4888
- C:\Windows\System\ySQefOV.exe
  C:\Windows\System\ySQefOV.exe
  2⤵
  PID:4904
- C:\Windows\System\DmWbokq.exe
  C:\Windows\System\DmWbokq.exe
  2⤵
  PID:4920
- C:\Windows\System\GOKHQdW.exe
  C:\Windows\System\GOKHQdW.exe
  2⤵
  PID:4936
- C:\Windows\System\yCUcdBx.exe
  C:\Windows\System\yCUcdBx.exe
  2⤵
  PID:4952
- C:\Windows\System\VsftraQ.exe
  C:\Windows\System\VsftraQ.exe
  2⤵
  PID:4968
- C:\Windows\System\tOUOjej.exe
  C:\Windows\System\tOUOjej.exe
  2⤵
  PID:4988
- C:\Windows\System\mTxOnjo.exe
  C:\Windows\System\mTxOnjo.exe
  2⤵
  PID:5016
- C:\Windows\System\zuklCKJ.exe
  C:\Windows\System\zuklCKJ.exe
  2⤵
  PID:5040
- C:\Windows\System\NrLxPcz.exe
  C:\Windows\System\NrLxPcz.exe
  2⤵
  PID:5056
- C:\Windows\System\YZAusgN.exe
  C:\Windows\System\YZAusgN.exe
  2⤵
  PID:5076
- C:\Windows\System\sKLdWCk.exe
  C:\Windows\System\sKLdWCk.exe
  2⤵
  PID:5092
- C:\Windows\System\zkoMEFR.exe
  C:\Windows\System\zkoMEFR.exe
  2⤵
  PID:5108
- C:\Windows\System\AVQFmjg.exe
  C:\Windows\System\AVQFmjg.exe
  2⤵
  PID:4052
- C:\Windows\System\yjyPzmE.exe
  C:\Windows\System\yjyPzmE.exe
  2⤵
  PID:2800
- C:\Windows\System\JijBdAM.exe
  C:\Windows\System\JijBdAM.exe
  2⤵
  PID:4124
- C:\Windows\System\qcfwroj.exe
  C:\Windows\System\qcfwroj.exe
  2⤵
  PID:4200
- C:\Windows\System\DoNZHIT.exe
  C:\Windows\System\DoNZHIT.exe
  2⤵
  PID:4240
- C:\Windows\System\oFcjrRi.exe
  C:\Windows\System\oFcjrRi.exe
  2⤵
  PID:4104
- C:\Windows\System\egKcgOz.exe
  C:\Windows\System\egKcgOz.exe
  2⤵
  PID:4216
- C:\Windows\System\wxkjERE.exe
  C:\Windows\System\wxkjERE.exe
  2⤵
  PID:3916
- C:\Windows\System\VKkpTPR.exe
  C:\Windows\System\VKkpTPR.exe
  2⤵
  PID:4296
- C:\Windows\System\dGbwIBr.exe
  C:\Windows\System\dGbwIBr.exe
  2⤵
  PID:3480
- C:\Windows\System\JbfCeDy.exe
  C:\Windows\System\JbfCeDy.exe
  2⤵
  PID:3164
- C:\Windows\System\hNoLNZg.exe
  C:\Windows\System\hNoLNZg.exe
  2⤵
  PID:3520
- C:\Windows\System\jmaAFDO.exe
  C:\Windows\System\jmaAFDO.exe
  2⤵
  PID:2552
- C:\Windows\System\DsVxzot.exe
  C:\Windows\System\DsVxzot.exe
  2⤵
  PID:2652
- C:\Windows\System\OEhIwMU.exe
  C:\Windows\System\OEhIwMU.exe
  2⤵
  PID:3268
- C:\Windows\System\bnXopVu.exe
  C:\Windows\System\bnXopVu.exe
  2⤵
  PID:4144
- C:\Windows\System\zGLYFyu.exe
  C:\Windows\System\zGLYFyu.exe
  2⤵
  PID:4188
- C:\Windows\System\TkeqOZg.exe
  C:\Windows\System\TkeqOZg.exe
  2⤵
  PID:4376
- C:\Windows\System\PhWcHWW.exe
  C:\Windows\System\PhWcHWW.exe
  2⤵
  PID:4460
- C:\Windows\System\QgPbRqX.exe
  C:\Windows\System\QgPbRqX.exe
  2⤵
  PID:4536
- C:\Windows\System\kJhBoMB.exe
  C:\Windows\System\kJhBoMB.exe
  2⤵
  PID:4552
- C:\Windows\System\OvwTDfm.exe
  C:\Windows\System\OvwTDfm.exe
  2⤵
  PID:4572
- C:\Windows\System\TmgMhrr.exe
  C:\Windows\System\TmgMhrr.exe
  2⤵
  PID:3828
- C:\Windows\System\LAxqNFp.exe
  C:\Windows\System\LAxqNFp.exe
  2⤵
  PID:3996
- C:\Windows\System\IjkqUsp.exe
  C:\Windows\System\IjkqUsp.exe
  2⤵
  PID:4616
- C:\Windows\System\UnPGbQB.exe
  C:\Windows\System\UnPGbQB.exe
  2⤵
  PID:4388
- C:\Windows\System\scAKeYh.exe
  C:\Windows\System\scAKeYh.exe
  2⤵
  PID:4476
- C:\Windows\System\VDXUGgo.exe
  C:\Windows\System\VDXUGgo.exe
  2⤵
  PID:4516
- C:\Windows\System\DwCdOUt.exe
  C:\Windows\System\DwCdOUt.exe
  2⤵
  PID:4596
- C:\Windows\System\bYKagux.exe
  C:\Windows\System\bYKagux.exe
  2⤵
  PID:4664
- C:\Windows\System\rzUrHPZ.exe
  C:\Windows\System\rzUrHPZ.exe
  2⤵
  PID:4684
- C:\Windows\System\nRwDiuR.exe
  C:\Windows\System\nRwDiuR.exe
  2⤵
  PID:4748
- C:\Windows\System\HLDnUyE.exe
  C:\Windows\System\HLDnUyE.exe
  2⤵
  PID:4784
- C:\Windows\System\NUPRMsh.exe
  C:\Windows\System\NUPRMsh.exe
  2⤵
  PID:4820
- C:\Windows\System\gppgxew.exe
  C:\Windows\System\gppgxew.exe
  2⤵
  PID:4852
- C:\Windows\System\xmXjUKa.exe
  C:\Windows\System\xmXjUKa.exe
  2⤵
  PID:4876
- C:\Windows\System\SAvJeHM.exe
  C:\Windows\System\SAvJeHM.exe
  2⤵
  PID:4916
- C:\Windows\System\stxTvEy.exe
  C:\Windows\System\stxTvEy.exe
  2⤵
  PID:4944
- C:\Windows\System\NYtOqER.exe
  C:\Windows\System\NYtOqER.exe
  2⤵
  PID:4932
- C:\Windows\System\qchDeAM.exe
  C:\Windows\System\qchDeAM.exe
  2⤵
  PID:5024
- C:\Windows\System\sZeQZBP.exe
  C:\Windows\System\sZeQZBP.exe
  2⤵
  PID:5008
- C:\Windows\System\XIDnklx.exe
  C:\Windows\System\XIDnklx.exe
  2⤵
  PID:5004
- C:\Windows\System\Nrxytzl.exe
  C:\Windows\System\Nrxytzl.exe
  2⤵
  PID:5104
- C:\Windows\System\RysYwOb.exe
  C:\Windows\System\RysYwOb.exe
  2⤵
  PID:5084
- C:\Windows\System\kctZVdf.exe
  C:\Windows\System\kctZVdf.exe
  2⤵
  PID:3892
- C:\Windows\System\XHAwrtT.exe
  C:\Windows\System\XHAwrtT.exe
  2⤵
  PID:4164
- C:\Windows\System\WsYnCgj.exe
  C:\Windows\System\WsYnCgj.exe
  2⤵
  PID:2080
- C:\Windows\System\MypfFHN.exe
  C:\Windows\System\MypfFHN.exe
  2⤵
  PID:2028
- C:\Windows\System\LnNfFkB.exe
  C:\Windows\System\LnNfFkB.exe
  2⤵
  PID:4284
- C:\Windows\System\QQrpqlx.exe
  C:\Windows\System\QQrpqlx.exe
  2⤵
  PID:4236
- C:\Windows\System\yBjQDJb.exe
  C:\Windows\System\yBjQDJb.exe
  2⤵
  PID:2876
- C:\Windows\System\UrWlkOb.exe
  C:\Windows\System\UrWlkOb.exe
  2⤵
  PID:3752
- C:\Windows\System\NfpHLJD.exe
  C:\Windows\System\NfpHLJD.exe
  2⤵
  PID:4352
- C:\Windows\System\hagSXWB.exe
  C:\Windows\System\hagSXWB.exe
  2⤵
  PID:4604
- C:\Windows\System\shPzywA.exe
  C:\Windows\System\shPzywA.exe
  2⤵
  PID:4404
- C:\Windows\System\vfvFSwy.exe
  C:\Windows\System\vfvFSwy.exe
  2⤵
  PID:4544
- C:\Windows\System\kNRVYsx.exe
  C:\Windows\System\kNRVYsx.exe
  2⤵
  PID:1492
- C:\Windows\System\zhKPVxW.exe
  C:\Windows\System\zhKPVxW.exe
  2⤵
  PID:4360
- C:\Windows\System\HjEPxWe.exe
  C:\Windows\System\HjEPxWe.exe
  2⤵
  PID:4432
- C:\Windows\System\IurwVzo.exe
  C:\Windows\System\IurwVzo.exe
  2⤵
  PID:4632
- C:\Windows\System\YVCxXsm.exe
  C:\Windows\System\YVCxXsm.exe
  2⤵
  PID:4768
- C:\Windows\System\LJKXtvG.exe
  C:\Windows\System\LJKXtvG.exe
  2⤵
  PID:4976
- C:\Windows\System\SpBRxux.exe
  C:\Windows\System\SpBRxux.exe
  2⤵
  PID:5068
- C:\Windows\System\CKMYlhR.exe
  C:\Windows\System\CKMYlhR.exe
  2⤵
  PID:4712
- C:\Windows\System\UBIPONh.exe
  C:\Windows\System\UBIPONh.exe
  2⤵
  PID:5064
- C:\Windows\System\SPHndWZ.exe
  C:\Windows\System\SPHndWZ.exe
  2⤵
  PID:2732
- C:\Windows\System\MQDLTNC.exe
  C:\Windows\System\MQDLTNC.exe
  2⤵
  PID:1940
- C:\Windows\System\OXCyChd.exe
  C:\Windows\System\OXCyChd.exe
  2⤵
  PID:3388
- C:\Windows\System\mpzBJoo.exe
  C:\Windows\System\mpzBJoo.exe
  2⤵
  PID:4900
- C:\Windows\System\BOwPHZC.exe
  C:\Windows\System\BOwPHZC.exe
  2⤵
  PID:5116
- C:\Windows\System\nJXRQPQ.exe
  C:\Windows\System\nJXRQPQ.exe
  2⤵
  PID:2548
- C:\Windows\System\AUSSjkS.exe
  C:\Windows\System\AUSSjkS.exe
  2⤵
  PID:4292
- C:\Windows\System\GyQLctm.exe
  C:\Windows\System\GyQLctm.exe
  2⤵
  PID:4140
- C:\Windows\System\qmYVIdc.exe
  C:\Windows\System\qmYVIdc.exe
  2⤵
  PID:2152
- C:\Windows\System\VrKjjzH.exe
  C:\Windows\System\VrKjjzH.exe
  2⤵
  PID:4564
- C:\Windows\System\ARjSlcN.exe
  C:\Windows\System\ARjSlcN.exe
  2⤵
  PID:4560
- C:\Windows\System\jwKvhhZ.exe
  C:\Windows\System\jwKvhhZ.exe
  2⤵
  PID:4652
- C:\Windows\System\nxcKorf.exe
  C:\Windows\System\nxcKorf.exe
  2⤵
  PID:4416
- C:\Windows\System\bkqUogH.exe
  C:\Windows\System\bkqUogH.exe
  2⤵
  PID:5000
- C:\Windows\System\qxHLEmA.exe
  C:\Windows\System\qxHLEmA.exe
  2⤵
  PID:3788
- C:\Windows\System\ymeSqcF.exe
  C:\Windows\System\ymeSqcF.exe
  2⤵
  PID:4668
- C:\Windows\System\BTVVUFx.exe
  C:\Windows\System\BTVVUFx.exe
  2⤵
  PID:4724
- C:\Windows\System\uPaQDfS.exe
  C:\Windows\System\uPaQDfS.exe
  2⤵
  PID:4964
- C:\Windows\System\khqJGRL.exe
  C:\Windows\System\khqJGRL.exe
  2⤵
  PID:4400
- C:\Windows\System\FIdjziX.exe
  C:\Windows\System\FIdjziX.exe
  2⤵
  PID:4180
- C:\Windows\System\XotHJcl.exe
  C:\Windows\System\XotHJcl.exe
  2⤵
  PID:4356
- C:\Windows\System\CqjclMI.exe
  C:\Windows\System\CqjclMI.exe
  2⤵
  PID:4884
- C:\Windows\System\AkghUtD.exe
  C:\Windows\System\AkghUtD.exe
  2⤵
  PID:3344
- C:\Windows\System\UtolXbt.exe
  C:\Windows\System\UtolXbt.exe
  2⤵
  PID:4620
- C:\Windows\System\NddYqDt.exe
  C:\Windows\System\NddYqDt.exe
  2⤵
  PID:4860
- C:\Windows\System\uqxdHOS.exe
  C:\Windows\System\uqxdHOS.exe
  2⤵
  PID:4592
- C:\Windows\System\ZKuElmw.exe
  C:\Windows\System\ZKuElmw.exe
  2⤵
  PID:4780
- C:\Windows\System\yBKzXtq.exe
  C:\Windows\System\yBKzXtq.exe
  2⤵
  PID:4112
- C:\Windows\System\WAkxjZM.exe
  C:\Windows\System\WAkxjZM.exe
  2⤵
  PID:5124
- C:\Windows\System\MBqYmSf.exe
  C:\Windows\System\MBqYmSf.exe
  2⤵
  PID:5144
- C:\Windows\System\wdGEGJA.exe
  C:\Windows\System\wdGEGJA.exe
  2⤵
  PID:5164
- C:\Windows\System\DOmfcgz.exe
  C:\Windows\System\DOmfcgz.exe
  2⤵
  PID:5180
- C:\Windows\System\rRpFAxV.exe
  C:\Windows\System\rRpFAxV.exe
  2⤵
  PID:5196
- C:\Windows\System\IEFkIZQ.exe
  C:\Windows\System\IEFkIZQ.exe
  2⤵
  PID:5212
- C:\Windows\System\muzlBZe.exe
  C:\Windows\System\muzlBZe.exe
  2⤵
  PID:5228
- C:\Windows\System\XWUSHGk.exe
  C:\Windows\System\XWUSHGk.exe
  2⤵
  PID:5244
- C:\Windows\System\usNPaXd.exe
  C:\Windows\System\usNPaXd.exe
  2⤵
  PID:5260
- C:\Windows\System\smUzszs.exe
  C:\Windows\System\smUzszs.exe
  2⤵
  PID:5280
- C:\Windows\System\CXQIqPH.exe
  C:\Windows\System\CXQIqPH.exe
  2⤵
  PID:5296
- C:\Windows\System\OOgeQpb.exe
  C:\Windows\System\OOgeQpb.exe
  2⤵
  PID:5316
- C:\Windows\System\HfjVYFK.exe
  C:\Windows\System\HfjVYFK.exe
  2⤵
  PID:5340
- C:\Windows\System\UdufpmB.exe
  C:\Windows\System\UdufpmB.exe
  2⤵
  PID:5360
- C:\Windows\System\TSilwIo.exe
  C:\Windows\System\TSilwIo.exe
  2⤵
  PID:5384
- C:\Windows\System\sCqzCHY.exe
  C:\Windows\System\sCqzCHY.exe
  2⤵
  PID:5436
- C:\Windows\System\sbEQFme.exe
  C:\Windows\System\sbEQFme.exe
  2⤵
  PID:5472
- C:\Windows\System\ivVgzQi.exe
  C:\Windows\System\ivVgzQi.exe
  2⤵
  PID:5492
- C:\Windows\System\hBHHTGL.exe
  C:\Windows\System\hBHHTGL.exe
  2⤵
  PID:5508
- C:\Windows\System\haXWarw.exe
  C:\Windows\System\haXWarw.exe
  2⤵
  PID:5524
- C:\Windows\System\PIjvijx.exe
  C:\Windows\System\PIjvijx.exe
  2⤵
  PID:5540
- C:\Windows\System\MKHCQLV.exe
  C:\Windows\System\MKHCQLV.exe
  2⤵
  PID:5564
- C:\Windows\System\IhPPzDG.exe
  C:\Windows\System\IhPPzDG.exe
  2⤵
  PID:5584
- C:\Windows\System\UzYRAGM.exe
  C:\Windows\System\UzYRAGM.exe
  2⤵
  PID:5612
- C:\Windows\System\wBEagBr.exe
  C:\Windows\System\wBEagBr.exe
  2⤵
  PID:5628
- C:\Windows\System\Uegekbf.exe
  C:\Windows\System\Uegekbf.exe
  2⤵
  PID:5644
- C:\Windows\System\DnkryUp.exe
  C:\Windows\System\DnkryUp.exe
  2⤵
  PID:5664
- C:\Windows\System\xnTDlWb.exe
  C:\Windows\System\xnTDlWb.exe
  2⤵
  PID:5680
- C:\Windows\System\zaPmUMa.exe
  C:\Windows\System\zaPmUMa.exe
  2⤵
  PID:5700
- C:\Windows\System\LbviVzm.exe
  C:\Windows\System\LbviVzm.exe
  2⤵
  PID:5716
- C:\Windows\System\XIOmEMR.exe
  C:\Windows\System\XIOmEMR.exe
  2⤵
  PID:5732
- C:\Windows\System\javlWuE.exe
  C:\Windows\System\javlWuE.exe
  2⤵
  PID:5752
- C:\Windows\System\nIlsBjv.exe
  C:\Windows\System\nIlsBjv.exe
  2⤵
  PID:5768
- C:\Windows\System\yaqkFhA.exe
  C:\Windows\System\yaqkFhA.exe
  2⤵
  PID:5788
- C:\Windows\System\tbsVkrg.exe
  C:\Windows\System\tbsVkrg.exe
  2⤵
  PID:5808
- C:\Windows\System\jjCJKKl.exe
  C:\Windows\System\jjCJKKl.exe
  2⤵
  PID:5832
- C:\Windows\System\RcXDolf.exe
  C:\Windows\System\RcXDolf.exe
  2⤵
  PID:5848
- C:\Windows\System\sXgtopg.exe
  C:\Windows\System\sXgtopg.exe
  2⤵
  PID:5864
- C:\Windows\System\IwUzFZE.exe
  C:\Windows\System\IwUzFZE.exe
  2⤵
  PID:5880
- C:\Windows\System\NBSThZE.exe
  C:\Windows\System\NBSThZE.exe
  2⤵
  PID:5900
- C:\Windows\System\ZHaUEjh.exe
  C:\Windows\System\ZHaUEjh.exe
  2⤵
  PID:5920
- C:\Windows\System\zXYcJoB.exe
  C:\Windows\System\zXYcJoB.exe
  2⤵
  PID:5936
- C:\Windows\System\QrueAjX.exe
  C:\Windows\System\QrueAjX.exe
  2⤵
  PID:5956
- C:\Windows\System\VzvMhGN.exe
  C:\Windows\System\VzvMhGN.exe
  2⤵
  PID:5976
- C:\Windows\System\pvYkUgh.exe
  C:\Windows\System\pvYkUgh.exe
  2⤵
  PID:5996
- C:\Windows\System\GTqBFsq.exe
  C:\Windows\System\GTqBFsq.exe
  2⤵
  PID:6016
- C:\Windows\System\NgkQxSH.exe
  C:\Windows\System\NgkQxSH.exe
  2⤵
  PID:6072
- C:\Windows\System\zyEIvcf.exe
  C:\Windows\System\zyEIvcf.exe
  2⤵
  PID:6092
- C:\Windows\System\cBksLxn.exe
  C:\Windows\System\cBksLxn.exe
  2⤵
  PID:6108
- C:\Windows\System\GlBmxIf.exe
  C:\Windows\System\GlBmxIf.exe
  2⤵
  PID:6124
- C:\Windows\System\SmcrCIO.exe
  C:\Windows\System\SmcrCIO.exe
  2⤵
  PID:6140
- C:\Windows\System\zUrbPPu.exe
  C:\Windows\System\zUrbPPu.exe
  2⤵
  PID:4832
- C:\Windows\System\aoGjLEQ.exe
  C:\Windows\System\aoGjLEQ.exe
  2⤵
  PID:4512
- C:\Windows\System\NgWVtWB.exe
  C:\Windows\System\NgWVtWB.exe
  2⤵
  PID:5220
- C:\Windows\System\NvwWbfZ.exe
  C:\Windows\System\NvwWbfZ.exe
  2⤵
  PID:5332
- C:\Windows\System\mCCBLpr.exe
  C:\Windows\System\mCCBLpr.exe
  2⤵
  PID:5328
- C:\Windows\System\HcLPJOD.exe
  C:\Windows\System\HcLPJOD.exe
  2⤵
  PID:2340
- C:\Windows\System\TcqOeNO.exe
  C:\Windows\System\TcqOeNO.exe
  2⤵
  PID:5236
- C:\Windows\System\JABtAWI.exe
  C:\Windows\System\JABtAWI.exe
  2⤵
  PID:4256
- C:\Windows\System\roauGLR.exe
  C:\Windows\System\roauGLR.exe
  2⤵
  PID:5268
- C:\Windows\System\RlaVImW.exe
  C:\Windows\System\RlaVImW.exe
  2⤵
  PID:5352
- C:\Windows\System\FcXDzGO.exe
  C:\Windows\System\FcXDzGO.exe
  2⤵
  PID:5176
- C:\Windows\System\bKkfQPq.exe
  C:\Windows\System\bKkfQPq.exe
  2⤵
  PID:4588
- C:\Windows\System\EyPKLIZ.exe
  C:\Windows\System\EyPKLIZ.exe
  2⤵
  PID:4484
- C:\Windows\System\OXQFgiz.exe
  C:\Windows\System\OXQFgiz.exe
  2⤵
  PID:5460
- C:\Windows\System\ElaAaJv.exe
  C:\Windows\System\ElaAaJv.exe
  2⤵
  PID:5408
- C:\Windows\System\RwdgYpz.exe
  C:\Windows\System\RwdgYpz.exe
  2⤵
  PID:5424
- C:\Windows\System\sDgtMFn.exe
  C:\Windows\System\sDgtMFn.exe
  2⤵
  PID:5484
- C:\Windows\System\LcvosmW.exe
  C:\Windows\System\LcvosmW.exe
  2⤵
  PID:5576
- C:\Windows\System\UCPdihL.exe
  C:\Windows\System\UCPdihL.exe
  2⤵
  PID:5620
- C:\Windows\System\RbvMqDY.exe
  C:\Windows\System\RbvMqDY.exe
  2⤵
  PID:5548
- C:\Windows\System\YMtbSub.exe
  C:\Windows\System\YMtbSub.exe
  2⤵
  PID:5656
- C:\Windows\System\xzxZmIM.exe
  C:\Windows\System\xzxZmIM.exe
  2⤵
  PID:5760
- C:\Windows\System\JByOaqw.exe
  C:\Windows\System\JByOaqw.exe
  2⤵
  PID:5552
- C:\Windows\System\KCcCYkC.exe
  C:\Windows\System\KCcCYkC.exe
  2⤵
  PID:5916
- C:\Windows\System\iIcyDJc.exe
  C:\Windows\System\iIcyDJc.exe
  2⤵
  PID:5992
- C:\Windows\System\RDupXMo.exe
  C:\Windows\System\RDupXMo.exe
  2⤵
  PID:5608
- C:\Windows\System\iDxNDad.exe
  C:\Windows\System\iDxNDad.exe
  2⤵
  PID:5816
- C:\Windows\System\HHvbBGP.exe
  C:\Windows\System\HHvbBGP.exe
  2⤵
  PID:5928
- C:\Windows\System\gkEWhXP.exe
  C:\Windows\System\gkEWhXP.exe
  2⤵
  PID:5672
- C:\Windows\System\RHMgJwg.exe
  C:\Windows\System\RHMgJwg.exe
  2⤵
  PID:5784
- C:\Windows\System\PPMkfwT.exe
  C:\Windows\System\PPMkfwT.exe
  2⤵
  PID:5708
- C:\Windows\System\vonDEzF.exe
  C:\Windows\System\vonDEzF.exe
  2⤵
  PID:6032
- C:\Windows\System\BrQILll.exe
  C:\Windows\System\BrQILll.exe
  2⤵
  PID:6048
- C:\Windows\System\dyixCYy.exe
  C:\Windows\System\dyixCYy.exe
  2⤵
  PID:6068
- C:\Windows\System\fnIpbTC.exe
  C:\Windows\System\fnIpbTC.exe
  2⤵
  PID:6100
- C:\Windows\System\HoejXni.exe
  C:\Windows\System\HoejXni.exe
  2⤵
  PID:5376
- C:\Windows\System\jHTMgok.exe
  C:\Windows\System\jHTMgok.exe
  2⤵
  PID:4244
- C:\Windows\System\WLNKPyg.exe
  C:\Windows\System\WLNKPyg.exe
  2⤵
  PID:6120
- C:\Windows\System\HAMkWtk.exe
  C:\Windows\System\HAMkWtk.exe
  2⤵
  PID:5052
- C:\Windows\System\cHFVPmI.exe
  C:\Windows\System\cHFVPmI.exe
  2⤵
  PID:5160
- C:\Windows\System\BzHjmjD.exe
  C:\Windows\System\BzHjmjD.exe
  2⤵
  PID:5448
- C:\Windows\System\yJcszmf.exe
  C:\Windows\System\yJcszmf.exe
  2⤵
  PID:5136
- C:\Windows\System\AqoloOG.exe
  C:\Windows\System\AqoloOG.exe
  2⤵
  PID:5208
- C:\Windows\System\MEMjEpj.exe
  C:\Windows\System\MEMjEpj.exe
  2⤵
  PID:5420
- C:\Windows\System\ymkqHCp.exe
  C:\Windows\System\ymkqHCp.exe
  2⤵
  PID:5556
- C:\Windows\System\XnNfHEL.exe
  C:\Windows\System\XnNfHEL.exe
  2⤵
  PID:5692
- C:\Windows\System\hpCdFnY.exe
  C:\Windows\System\hpCdFnY.exe
  2⤵
  PID:5324
- C:\Windows\System\MAiKpvH.exe
  C:\Windows\System\MAiKpvH.exe
  2⤵
  PID:5624
- C:\Windows\System\EmIcejB.exe
  C:\Windows\System\EmIcejB.exe
  2⤵
  PID:5872
- C:\Windows\System\iPdJuwi.exe
  C:\Windows\System\iPdJuwi.exe
  2⤵
  PID:5536
- C:\Windows\System\UIqMDiE.exe
  C:\Windows\System\UIqMDiE.exe
  2⤵
  PID:5796
- C:\Windows\System\IrJaZKk.exe
  C:\Windows\System\IrJaZKk.exe
  2⤵
  PID:5988
- C:\Windows\System\UpKozci.exe
  C:\Windows\System\UpKozci.exe
  2⤵
  PID:5860
- C:\Windows\System\KfNaQKT.exe
  C:\Windows\System\KfNaQKT.exe
  2⤵
  PID:5780
- C:\Windows\System\NvXPxkA.exe
  C:\Windows\System\NvXPxkA.exe
  2⤵
  PID:6028
- C:\Windows\System\fSLOLJY.exe
  C:\Windows\System\fSLOLJY.exe
  2⤵
  PID:6104
- C:\Windows\System\BWxTmwc.exe
  C:\Windows\System\BWxTmwc.exe
  2⤵
  PID:5740
- C:\Windows\System\OePRXck.exe
  C:\Windows\System\OePRXck.exe
  2⤵
  PID:6088
- C:\Windows\System\yKPfqjh.exe
  C:\Windows\System\yKPfqjh.exe
  2⤵
  PID:3260
- C:\Windows\System\lYJwyYq.exe
  C:\Windows\System\lYJwyYq.exe
  2⤵
  PID:4268
- C:\Windows\System\HMPFAls.exe
  C:\Windows\System\HMPFAls.exe
  2⤵
  PID:5468
- C:\Windows\System\VdhbZEf.exe
  C:\Windows\System\VdhbZEf.exe
  2⤵
  PID:4696
- C:\Windows\System\vgEnxkU.exe
  C:\Windows\System\vgEnxkU.exe
  2⤵
  PID:5516
- C:\Windows\System\FrCDRIb.exe
  C:\Windows\System\FrCDRIb.exe
  2⤵
  PID:5428
- C:\Windows\System\iEgqYBf.exe
  C:\Windows\System\iEgqYBf.exe
  2⤵
  PID:5912
- C:\Windows\System\pvvINPX.exe
  C:\Windows\System\pvvINPX.exe
  2⤵
  PID:5828
- C:\Windows\System\gZwGeqz.exe
  C:\Windows\System\gZwGeqz.exe
  2⤵
  PID:6064
- C:\Windows\System\lDtWJFD.exe
  C:\Windows\System\lDtWJFD.exe
  2⤵
  PID:5948
- C:\Windows\System\PfgAWXr.exe
  C:\Windows\System\PfgAWXr.exe
  2⤵
  PID:5380
- C:\Windows\System\stmELSb.exe
  C:\Windows\System\stmELSb.exe
  2⤵
  PID:5964
- C:\Windows\System\fbrXuBh.exe
  C:\Windows\System\fbrXuBh.exe
  2⤵
  PID:5952
- C:\Windows\System\mDHqXpA.exe
  C:\Windows\System\mDHqXpA.exe
  2⤵
  PID:6044
- C:\Windows\System\PgoyaST.exe
  C:\Windows\System\PgoyaST.exe
  2⤵
  PID:5156
- C:\Windows\System\ebdITUX.exe
  C:\Windows\System\ebdITUX.exe
  2⤵
  PID:3992
- C:\Windows\System\oFLbYrW.exe
  C:\Windows\System\oFLbYrW.exe
  2⤵
  PID:5640
- C:\Windows\System\zFehHAs.exe
  C:\Windows\System\zFehHAs.exe
  2⤵
  PID:5652
- C:\Windows\System\zSxpVwQ.exe
  C:\Windows\System\zSxpVwQ.exe
  2⤵
  PID:6116
- C:\Windows\System\WhkxSAc.exe
  C:\Windows\System\WhkxSAc.exe
  2⤵
  PID:5856
- C:\Windows\System\tOijZvL.exe
  C:\Windows\System\tOijZvL.exe
  2⤵
  PID:5600
- C:\Windows\System\ePiWsMQ.exe
  C:\Windows\System\ePiWsMQ.exe
  2⤵
  PID:6164
- C:\Windows\System\MxuyMaj.exe
  C:\Windows\System\MxuyMaj.exe
  2⤵
  PID:6180
- C:\Windows\System\BwHRBbM.exe
  C:\Windows\System\BwHRBbM.exe
  2⤵
  PID:6196
- C:\Windows\System\QvqKeXZ.exe
  C:\Windows\System\QvqKeXZ.exe
  2⤵
  PID:6216
- C:\Windows\System\qCiLcdW.exe
  C:\Windows\System\qCiLcdW.exe
  2⤵
  PID:6280
- C:\Windows\System\FujRsvZ.exe
  C:\Windows\System\FujRsvZ.exe
  2⤵
  PID:6296
- C:\Windows\System\cprflCd.exe
  C:\Windows\System\cprflCd.exe
  2⤵
  PID:6316
- C:\Windows\System\YSfXdAN.exe
  C:\Windows\System\YSfXdAN.exe
  2⤵
  PID:6336
- C:\Windows\System\OhJNUKU.exe
  C:\Windows\System\OhJNUKU.exe
  2⤵
  PID:6352
- C:\Windows\System\EccYfQa.exe
  C:\Windows\System\EccYfQa.exe
  2⤵
  PID:6372
- C:\Windows\System\dhZQzTg.exe
  C:\Windows\System\dhZQzTg.exe
  2⤵
  PID:6388
- C:\Windows\System\FMAHbcD.exe
  C:\Windows\System\FMAHbcD.exe
  2⤵
  PID:6404
- C:\Windows\System\eCPNlMr.exe
  C:\Windows\System\eCPNlMr.exe
  2⤵
  PID:6424
- C:\Windows\System\cFMFTly.exe
  C:\Windows\System\cFMFTly.exe
  2⤵
  PID:6440
- C:\Windows\System\uyGdPMp.exe
  C:\Windows\System\uyGdPMp.exe
  2⤵
  PID:6460
- C:\Windows\System\HUuikHh.exe
  C:\Windows\System\HUuikHh.exe
  2⤵
  PID:6480
- C:\Windows\System\ATvzqOB.exe
  C:\Windows\System\ATvzqOB.exe
  2⤵
  PID:6496
- C:\Windows\System\LVYBcnz.exe
  C:\Windows\System\LVYBcnz.exe
  2⤵
  PID:6516
- C:\Windows\System\haIljhE.exe
  C:\Windows\System\haIljhE.exe
  2⤵
  PID:6536
- C:\Windows\System\awKINcK.exe
  C:\Windows\System\awKINcK.exe
  2⤵
  PID:6552
- C:\Windows\System\bUoyGXr.exe
  C:\Windows\System\bUoyGXr.exe
  2⤵
  PID:6572
- C:\Windows\System\LPkvWov.exe
  C:\Windows\System\LPkvWov.exe
  2⤵
  PID:6592
- C:\Windows\System\NZSjZJs.exe
  C:\Windows\System\NZSjZJs.exe
  2⤵
  PID:6612
- C:\Windows\System\zUvsBHd.exe
  C:\Windows\System\zUvsBHd.exe
  2⤵
  PID:6636
- C:\Windows\System\xGIErOZ.exe
  C:\Windows\System\xGIErOZ.exe
  2⤵
  PID:6656
- C:\Windows\System\qMmDkEH.exe
  C:\Windows\System\qMmDkEH.exe
  2⤵
  PID:6672
- C:\Windows\System\TWjNhYO.exe
  C:\Windows\System\TWjNhYO.exe
  2⤵
  PID:6712
- C:\Windows\System\oOuxISB.exe
  C:\Windows\System\oOuxISB.exe
  2⤵
  PID:6732
- C:\Windows\System\HdWeHSa.exe
  C:\Windows\System\HdWeHSa.exe
  2⤵
  PID:6748
- C:\Windows\System\dXfwpPe.exe
  C:\Windows\System\dXfwpPe.exe
  2⤵
  PID:6764
- C:\Windows\System\rtueaju.exe
  C:\Windows\System\rtueaju.exe
  2⤵
  PID:6780
- C:\Windows\System\ZZBBwFp.exe
  C:\Windows\System\ZZBBwFp.exe
  2⤵
  PID:6796
- C:\Windows\System\gwVkEEs.exe
  C:\Windows\System\gwVkEEs.exe
  2⤵
  PID:6812
- C:\Windows\System\uXNfKsG.exe
  C:\Windows\System\uXNfKsG.exe
  2⤵
  PID:6828
- C:\Windows\System\KMPlFLK.exe
  C:\Windows\System\KMPlFLK.exe
  2⤵
  PID:6844
- C:\Windows\System\EiVnUcI.exe
  C:\Windows\System\EiVnUcI.exe
  2⤵
  PID:6864
- C:\Windows\System\OvprsFe.exe
  C:\Windows\System\OvprsFe.exe
  2⤵
  PID:6880
- C:\Windows\System\EknDAoY.exe
  C:\Windows\System\EknDAoY.exe
  2⤵
  PID:6904
- C:\Windows\System\DQlYeXw.exe
  C:\Windows\System\DQlYeXw.exe
  2⤵
  PID:6924
- C:\Windows\System\RVuwKQU.exe
  C:\Windows\System\RVuwKQU.exe
  2⤵
  PID:6940
- C:\Windows\System\AQYPQQD.exe
  C:\Windows\System\AQYPQQD.exe
  2⤵
  PID:6964
- C:\Windows\System\wnyxoVh.exe
  C:\Windows\System\wnyxoVh.exe
  2⤵
  PID:6980
- C:\Windows\System\tzBWbzs.exe
  C:\Windows\System\tzBWbzs.exe
  2⤵
  PID:7004
- C:\Windows\System\TVpKZYj.exe
  C:\Windows\System\TVpKZYj.exe
  2⤵
  PID:7024
- C:\Windows\System\PhxayZy.exe
  C:\Windows\System\PhxayZy.exe
  2⤵
  PID:7056
- C:\Windows\System\PdDfWsI.exe
  C:\Windows\System\PdDfWsI.exe
  2⤵
  PID:7072
- C:\Windows\System\SYIqkgK.exe
  C:\Windows\System\SYIqkgK.exe
  2⤵
  PID:7120
- C:\Windows\System\iMeHyHy.exe
  C:\Windows\System\iMeHyHy.exe
  2⤵
  PID:7136
- C:\Windows\System\EDZEHtD.exe
  C:\Windows\System\EDZEHtD.exe
  2⤵
  PID:7156
- C:\Windows\System\IJAAKKy.exe
  C:\Windows\System\IJAAKKy.exe
  2⤵
  PID:6156
- C:\Windows\System\xPSHIGw.exe
  C:\Windows\System\xPSHIGw.exe
  2⤵
  PID:6228
- C:\Windows\System\LZCrcsl.exe
  C:\Windows\System\LZCrcsl.exe
  2⤵
  PID:5432
- C:\Windows\System\iUBIzHb.exe
  C:\Windows\System\iUBIzHb.exe
  2⤵
  PID:5132
- C:\Windows\System\xVbkruN.exe
  C:\Windows\System\xVbkruN.exe
  2⤵
  PID:4700
- C:\Windows\System\Jtmtgbn.exe
  C:\Windows\System\Jtmtgbn.exe
  2⤵
  PID:5604
- C:\Windows\System\cwgjjpl.exe
  C:\Windows\System\cwgjjpl.exe
  2⤵
  PID:6012
- C:\Windows\System\bDOfPBD.exe
  C:\Windows\System\bDOfPBD.exe
  2⤵
  PID:6252
- C:\Windows\System\Vytltdm.exe
  C:\Windows\System\Vytltdm.exe
  2⤵
  PID:6204
- C:\Windows\System\yWMWuyL.exe
  C:\Windows\System\yWMWuyL.exe
  2⤵
  PID:6212
- C:\Windows\System\uKrTAut.exe
  C:\Windows\System\uKrTAut.exe
  2⤵
  PID:6312
- C:\Windows\System\RVfBjEz.exe
  C:\Windows\System\RVfBjEz.exe
  2⤵
  PID:6380
- C:\Windows\System\vnAVpam.exe
  C:\Windows\System\vnAVpam.exe
  2⤵
  PID:6420
- C:\Windows\System\unanHkd.exe
  C:\Windows\System\unanHkd.exe
  2⤵
  PID:6324
- C:\Windows\System\FRckpxw.exe
  C:\Windows\System\FRckpxw.exe
  2⤵
  PID:6524
- C:\Windows\System\AlbIyvh.exe
  C:\Windows\System\AlbIyvh.exe
  2⤵
  PID:6568
- C:\Windows\System\yAXeIml.exe
  C:\Windows\System\yAXeIml.exe
  2⤵
  PID:6436
- C:\Windows\System\xFvBOgT.exe
  C:\Windows\System\xFvBOgT.exe
  2⤵
  PID:6396
- C:\Windows\System\UwRsEeu.exe
  C:\Windows\System\UwRsEeu.exe
  2⤵
  PID:6504
- C:\Windows\System\tDUjaiy.exe
  C:\Windows\System\tDUjaiy.exe
  2⤵
  PID:6580
- C:\Windows\System\rfroTXD.exe
  C:\Windows\System\rfroTXD.exe
  2⤵
  PID:6632
- C:\Windows\System\LLBhSCG.exe
  C:\Windows\System\LLBhSCG.exe
  2⤵
  PID:6652
- C:\Windows\System\tMAQHek.exe
  C:\Windows\System\tMAQHek.exe
  2⤵
  PID:6696
- C:\Windows\System\qbkNvqV.exe
  C:\Windows\System\qbkNvqV.exe
  2⤵
  PID:6744
- C:\Windows\System\cifKWuN.exe
  C:\Windows\System\cifKWuN.exe
  2⤵
  PID:6836
- C:\Windows\System\DFiyfWw.exe
  C:\Windows\System\DFiyfWw.exe
  2⤵
  PID:6952
- C:\Windows\System\ohxvpDU.exe
  C:\Windows\System\ohxvpDU.exe
  2⤵
  PID:6760
- C:\Windows\System\LmzJRFr.exe
  C:\Windows\System\LmzJRFr.exe
  2⤵
  PID:7048
- C:\Windows\System\EygpGEz.exe
  C:\Windows\System\EygpGEz.exe
  2⤵
  PID:6756
- C:\Windows\System\rRtizJZ.exe
  C:\Windows\System\rRtizJZ.exe
  2⤵
  PID:6856
- C:\Windows\System\xcsrNmb.exe
  C:\Windows\System\xcsrNmb.exe
  2⤵
  PID:6932
- C:\Windows\System\hpJRjix.exe
  C:\Windows\System\hpJRjix.exe
  2⤵
  PID:7012
- C:\Windows\System\kqgIBkj.exe
  C:\Windows\System\kqgIBkj.exe
  2⤵
  PID:6860
- C:\Windows\System\ubtPElT.exe
  C:\Windows\System\ubtPElT.exe
  2⤵
  PID:7100
- C:\Windows\System\pEZIAPJ.exe
  C:\Windows\System\pEZIAPJ.exe
  2⤵
  PID:7116
- C:\Windows\System\KjCceKR.exe
  C:\Windows\System\KjCceKR.exe
  2⤵
  PID:6192
- C:\Windows\System\SWWHhiW.exe
  C:\Windows\System\SWWHhiW.exe
  2⤵
  PID:5800
- C:\Windows\System\kHpJEpc.exe
  C:\Windows\System\kHpJEpc.exe
  2⤵
  PID:6244
- C:\Windows\System\COdnDZs.exe
  C:\Windows\System\COdnDZs.exe
  2⤵
  PID:6176
- C:\Windows\System\KNLQsvS.exe
  C:\Windows\System\KNLQsvS.exe
  2⤵
  PID:6332
- C:\Windows\System\FjtlZNV.exe
  C:\Windows\System\FjtlZNV.exe
  2⤵
  PID:6560
- C:\Windows\System\JURQkWF.exe
  C:\Windows\System\JURQkWF.exe
  2⤵
  PID:6432
- C:\Windows\System\dsNRnvH.exe
  C:\Windows\System\dsNRnvH.exe
  2⤵
  PID:6740
- C:\Windows\System\MoCHGaK.exe
  C:\Windows\System\MoCHGaK.exe
  2⤵
  PID:6292
- C:\Windows\System\ITrOOdp.exe
  C:\Windows\System\ITrOOdp.exe
  2⤵
  PID:6688
- C:\Windows\System\LDNFgoQ.exe
  C:\Windows\System\LDNFgoQ.exe
  2⤵
  PID:4308
- C:\Windows\System\QyowkvX.exe
  C:\Windows\System\QyowkvX.exe
  2⤵
  PID:6916
- C:\Windows\System\XEZGJKM.exe
  C:\Windows\System\XEZGJKM.exe
  2⤵
  PID:6600
- C:\Windows\System\btpsDsB.exe
  C:\Windows\System\btpsDsB.exe
  2⤵
  PID:6412
- C:\Windows\System\XLUNfdM.exe
  C:\Windows\System\XLUNfdM.exe
  2⤵
  PID:7044
- C:\Windows\System\IjefvRj.exe
  C:\Windows\System\IjefvRj.exe
  2⤵
  PID:7080
- C:\Windows\System\CgJXkls.exe
  C:\Windows\System\CgJXkls.exe
  2⤵
  PID:7084
- C:\Windows\System\jvZKmaJ.exe
  C:\Windows\System\jvZKmaJ.exe
  2⤵
  PID:7096
- C:\Windows\System\AHarGes.exe
  C:\Windows\System\AHarGes.exe
  2⤵
  PID:6668
- C:\Windows\System\vssXKkd.exe
  C:\Windows\System\vssXKkd.exe
  2⤵
  PID:6896
- C:\Windows\System\EOfBHUJ.exe
  C:\Windows\System\EOfBHUJ.exe
  2⤵
  PID:7148
- C:\Windows\System\pFKSmNH.exe
  C:\Windows\System\pFKSmNH.exe
  2⤵
  PID:7152
- C:\Windows\System\HmSIjxV.exe
  C:\Windows\System\HmSIjxV.exe
  2⤵
  PID:6240
- C:\Windows\System\IcVNCGE.exe
  C:\Windows\System\IcVNCGE.exe
  2⤵
  PID:5348
- C:\Windows\System\GIcsymH.exe
  C:\Windows\System\GIcsymH.exe
  2⤵
  PID:6532
- C:\Windows\System\fKYlucT.exe
  C:\Windows\System\fKYlucT.exe
  2⤵
  PID:6472
- C:\Windows\System\XDvRhXU.exe
  C:\Windows\System\XDvRhXU.exe
  2⤵
  PID:6476
- C:\Windows\System\vjPRTGp.exe
  C:\Windows\System\vjPRTGp.exe
  2⤵
  PID:6692
- C:\Windows\System\QEyNzdm.exe
  C:\Windows\System\QEyNzdm.exe
  2⤵
  PID:6608
- C:\Windows\System\zUTZjcy.exe
  C:\Windows\System\zUTZjcy.exe
  2⤵
  PID:7032
- C:\Windows\System\EpNJKMy.exe
  C:\Windows\System\EpNJKMy.exe
  2⤵
  PID:6264
- C:\Windows\System\GFKaJMl.exe
  C:\Windows\System\GFKaJMl.exe
  2⤵
  PID:6468
- C:\Windows\System\ifgNcwb.exe
  C:\Windows\System\ifgNcwb.exe
  2⤵
  PID:6988
- C:\Windows\System\GKwsGur.exe
  C:\Windows\System\GKwsGur.exe
  2⤵
  PID:7068
- C:\Windows\System\SJofWKO.exe
  C:\Windows\System\SJofWKO.exe
  2⤵
  PID:5896
- C:\Windows\System\IHABHsS.exe
  C:\Windows\System\IHABHsS.exe
  2⤵
  PID:6364
- C:\Windows\System\MBWJunq.exe
  C:\Windows\System\MBWJunq.exe
  2⤵
  PID:6512
- C:\Windows\System\imdWdIS.exe
  C:\Windows\System\imdWdIS.exe
  2⤵
  PID:6588
- C:\Windows\System\UneGVTD.exe
  C:\Windows\System\UneGVTD.exe
  2⤵
  PID:6912
- C:\Windows\System\ZPtzRuO.exe
  C:\Windows\System\ZPtzRuO.exe
  2⤵
  PID:6268
- C:\Windows\System\VCHwyIU.exe
  C:\Windows\System\VCHwyIU.exe
  2⤵
  PID:7092
- C:\Windows\System\yOdSHdn.exe
  C:\Windows\System\yOdSHdn.exe
  2⤵
  PID:7020
- C:\Windows\System\qJBJGKk.exe
  C:\Windows\System\qJBJGKk.exe
  2⤵
  PID:5192
- C:\Windows\System\OlKMBLP.exe
  C:\Windows\System\OlKMBLP.exe
  2⤵
  PID:6548
- C:\Windows\System\BjOXapt.exe
  C:\Windows\System\BjOXapt.exe
  2⤵
  PID:6624
- C:\Windows\System\aJSgdCw.exe
  C:\Windows\System\aJSgdCw.exe
  2⤵
  PID:7036
- C:\Windows\System\DARsecH.exe
  C:\Windows\System\DARsecH.exe
  2⤵
  PID:6188
- C:\Windows\System\QVKWQTG.exe
  C:\Windows\System\QVKWQTG.exe
  2⤵
  PID:6992
- C:\Windows\System\OWVrPEv.exe
  C:\Windows\System\OWVrPEv.exe
  2⤵
  PID:7176
- C:\Windows\System\MkcYZgE.exe
  C:\Windows\System\MkcYZgE.exe
  2⤵
  PID:7192
- C:\Windows\System\OZNkJcq.exe
  C:\Windows\System\OZNkJcq.exe
  2⤵
  PID:7212
- C:\Windows\System\ogjvKTv.exe
  C:\Windows\System\ogjvKTv.exe
  2⤵
  PID:7232
- C:\Windows\System\qwzBTPN.exe
  C:\Windows\System\qwzBTPN.exe
  2⤵
  PID:7252
- C:\Windows\System\udoiCpm.exe
  C:\Windows\System\udoiCpm.exe
  2⤵
  PID:7268
- C:\Windows\System\ISHibIF.exe
  C:\Windows\System\ISHibIF.exe
  2⤵
  PID:7288
- C:\Windows\System\bqTSlMJ.exe
  C:\Windows\System\bqTSlMJ.exe
  2⤵
  PID:7312
- C:\Windows\System\KsRbWWh.exe
  C:\Windows\System\KsRbWWh.exe
  2⤵
  PID:7348
- C:\Windows\System\cnuibhI.exe
  C:\Windows\System\cnuibhI.exe
  2⤵
  PID:7364
- C:\Windows\System\MwKQyEZ.exe
  C:\Windows\System\MwKQyEZ.exe
  2⤵
  PID:7384
- C:\Windows\System\ClkamBf.exe
  C:\Windows\System\ClkamBf.exe
  2⤵
  PID:7408
- C:\Windows\System\zjsPGAA.exe
  C:\Windows\System\zjsPGAA.exe
  2⤵
  PID:7424
- C:\Windows\System\mTGavhr.exe
  C:\Windows\System\mTGavhr.exe
  2⤵
  PID:7444
- C:\Windows\System\ipGEYNs.exe
  C:\Windows\System\ipGEYNs.exe
  2⤵
  PID:7460
- C:\Windows\System\xUBgSzP.exe
  C:\Windows\System\xUBgSzP.exe
  2⤵
  PID:7480
- C:\Windows\System\LqTMeJl.exe
  C:\Windows\System\LqTMeJl.exe
  2⤵
  PID:7500
- C:\Windows\System\iZRbPVP.exe
  C:\Windows\System\iZRbPVP.exe
  2⤵
  PID:7516
- C:\Windows\System\fVdfKnT.exe
  C:\Windows\System\fVdfKnT.exe
  2⤵
  PID:7552
- C:\Windows\System\vKjdOOU.exe
  C:\Windows\System\vKjdOOU.exe
  2⤵
  PID:7568
- C:\Windows\System\EcQMkuS.exe
  C:\Windows\System\EcQMkuS.exe
  2⤵
  PID:7584
- C:\Windows\System\vQCxvZv.exe
  C:\Windows\System\vQCxvZv.exe
  2⤵
  PID:7604
- C:\Windows\System\ibDKLPm.exe
  C:\Windows\System\ibDKLPm.exe
  2⤵
  PID:7620
- C:\Windows\System\KLhObbh.exe
  C:\Windows\System\KLhObbh.exe
  2⤵
  PID:7636
- C:\Windows\System\kMJIieP.exe
  C:\Windows\System\kMJIieP.exe
  2⤵
  PID:7664
- C:\Windows\System\wCfdVeE.exe
  C:\Windows\System\wCfdVeE.exe
  2⤵
  PID:7684
- C:\Windows\System\oVARUOx.exe
  C:\Windows\System\oVARUOx.exe
  2⤵
  PID:7700
- C:\Windows\System\ECFNwhe.exe
  C:\Windows\System\ECFNwhe.exe
  2⤵
  PID:7724
- C:\Windows\System\vkihlXI.exe
  C:\Windows\System\vkihlXI.exe
  2⤵
  PID:7740
- C:\Windows\System\DpZQTUI.exe
  C:\Windows\System\DpZQTUI.exe
  2⤵
  PID:7756
- C:\Windows\System\SnxKKzL.exe
  C:\Windows\System\SnxKKzL.exe
  2⤵
  PID:7772
- C:\Windows\System\UPLIYWl.exe
  C:\Windows\System\UPLIYWl.exe
  2⤵
  PID:7796
- C:\Windows\System\hMTGUIk.exe
  C:\Windows\System\hMTGUIk.exe
  2⤵
  PID:7816
- C:\Windows\System\LCchnea.exe
  C:\Windows\System\LCchnea.exe
  2⤵
  PID:7836
- C:\Windows\System\NrxOoro.exe
  C:\Windows\System\NrxOoro.exe
  2⤵
  PID:7860
- C:\Windows\System\PlhCTjb.exe
  C:\Windows\System\PlhCTjb.exe
  2⤵
  PID:7876
- C:\Windows\System\YbHLVTT.exe
  C:\Windows\System\YbHLVTT.exe
  2⤵
  PID:7896
- C:\Windows\System\BZplrZa.exe
  C:\Windows\System\BZplrZa.exe
  2⤵
  PID:7912
- C:\Windows\System\GWyCzHH.exe
  C:\Windows\System\GWyCzHH.exe
  2⤵
  PID:7948
- C:\Windows\System\VmdRVOE.exe
  C:\Windows\System\VmdRVOE.exe
  2⤵
  PID:7968
- C:\Windows\System\AdqAXne.exe
  C:\Windows\System\AdqAXne.exe
  2⤵
  PID:7984
- C:\Windows\System\kGiAdRK.exe
  C:\Windows\System\kGiAdRK.exe
  2⤵
  PID:8000
- C:\Windows\System\RFQGFGt.exe
  C:\Windows\System\RFQGFGt.exe
  2⤵
  PID:8020
- C:\Windows\System\OajyAoC.exe
  C:\Windows\System\OajyAoC.exe
  2⤵
  PID:8044
- C:\Windows\System\XPrcVxd.exe
  C:\Windows\System\XPrcVxd.exe
  2⤵
  PID:8072
- C:\Windows\System\xwlslJC.exe
  C:\Windows\System\xwlslJC.exe
  2⤵
  PID:8088
- C:\Windows\System\JEzNxud.exe
  C:\Windows\System\JEzNxud.exe
  2⤵
  PID:8104
- C:\Windows\System\VkPFIhB.exe
  C:\Windows\System\VkPFIhB.exe
  2⤵
  PID:8124
- C:\Windows\System\soWpidp.exe
  C:\Windows\System\soWpidp.exe
  2⤵
  PID:8140
- C:\Windows\System\oSpFfIA.exe
  C:\Windows\System\oSpFfIA.exe
  2⤵
  PID:8160
- C:\Windows\System\fYCCvbJ.exe
  C:\Windows\System\fYCCvbJ.exe
  2⤵
  PID:8180
- C:\Windows\System\GvSeYbA.exe
  C:\Windows\System\GvSeYbA.exe
  2⤵
  PID:7200
- C:\Windows\System\dEwQLbT.exe
  C:\Windows\System\dEwQLbT.exe
  2⤵
  PID:6452
- C:\Windows\System\lzoCZGg.exe
  C:\Windows\System\lzoCZGg.exe
  2⤵
  PID:7280
- C:\Windows\System\UpPiAMA.exe
  C:\Windows\System\UpPiAMA.exe
  2⤵
  PID:6776
- C:\Windows\System\UjPZtFf.exe
  C:\Windows\System\UjPZtFf.exe
  2⤵
  PID:7184
- C:\Windows\System\kRWyKwa.exe
  C:\Windows\System\kRWyKwa.exe
  2⤵
  PID:7260
- C:\Windows\System\ZCSvjzX.exe
  C:\Windows\System\ZCSvjzX.exe
  2⤵
  PID:7308
- C:\Windows\System\zvpPzBj.exe
  C:\Windows\System\zvpPzBj.exe
  2⤵
  PID:7360
- C:\Windows\System\WIfPNIj.exe
  C:\Windows\System\WIfPNIj.exe
  2⤵
  PID:7416
- C:\Windows\System\rACWBMQ.exe
  C:\Windows\System\rACWBMQ.exe
  2⤵
  PID:7404
- C:\Windows\System\cUthaCk.exe
  C:\Windows\System\cUthaCk.exe
  2⤵
  PID:7492
- C:\Windows\System\sxfdLYA.exe
  C:\Windows\System\sxfdLYA.exe
  2⤵
  PID:7508
- C:\Windows\System\VKppqOS.exe
  C:\Windows\System\VKppqOS.exe
  2⤵
  PID:7472
- C:\Windows\System\WidRxEN.exe
  C:\Windows\System\WidRxEN.exe
  2⤵
  PID:7540
- C:\Windows\System\yNWLkSf.exe
  C:\Windows\System\yNWLkSf.exe
  2⤵
  PID:7616
- C:\Windows\System\RKGQuHN.exe
  C:\Windows\System\RKGQuHN.exe
  2⤵
  PID:7600
- C:\Windows\System\tSaQNsg.exe
  C:\Windows\System\tSaQNsg.exe
  2⤵
  PID:7652
- C:\Windows\System\iqkVhes.exe
  C:\Windows\System\iqkVhes.exe
  2⤵
  PID:7692
- C:\Windows\System\CKJYerj.exe
  C:\Windows\System\CKJYerj.exe
  2⤵
  PID:7764
- C:\Windows\System\aBDVvCQ.exe
  C:\Windows\System\aBDVvCQ.exe
  2⤵
  PID:7812
- C:\Windows\System\WKiLHng.exe
  C:\Windows\System\WKiLHng.exe
  2⤵
  PID:7848
- C:\Windows\System\DcDNOWs.exe
  C:\Windows\System\DcDNOWs.exe
  2⤵
  PID:7680
- C:\Windows\System\tjlrPcY.exe
  C:\Windows\System\tjlrPcY.exe
  2⤵
  PID:7828
- C:\Windows\System\RLzfjZw.exe
  C:\Windows\System\RLzfjZw.exe
  2⤵
  PID:7868
- C:\Windows\System\Izogbbo.exe
  C:\Windows\System\Izogbbo.exe
  2⤵
  PID:7792
- C:\Windows\System\dwAhnoh.exe
  C:\Windows\System\dwAhnoh.exe
  2⤵
  PID:7960
- C:\Windows\System\DSIvYaQ.exe
  C:\Windows\System\DSIvYaQ.exe
  2⤵
  PID:7964
- C:\Windows\System\oiBsdZZ.exe
  C:\Windows\System\oiBsdZZ.exe
  2⤵
  PID:8016
- C:\Windows\System\YrLKaxk.exe
  C:\Windows\System\YrLKaxk.exe
  2⤵
  PID:8036
- C:\Windows\System\GgnLaoJ.exe
  C:\Windows\System\GgnLaoJ.exe
  2⤵
  PID:8080
- C:\Windows\System\NPJsseA.exe
  C:\Windows\System\NPJsseA.exe
  2⤵
  PID:8120
- C:\Windows\System\uObuBfg.exe
  C:\Windows\System\uObuBfg.exe
  2⤵
  PID:8176
- C:\Windows\System\RHrlxrQ.exe
  C:\Windows\System\RHrlxrQ.exe
  2⤵
  PID:7132
- C:\Windows\System\BOKxamd.exe
  C:\Windows\System\BOKxamd.exe
  2⤵
  PID:8188
- C:\Windows\System\fynYphb.exe
  C:\Windows\System\fynYphb.exe
  2⤵
  PID:7248
- C:\Windows\System\VkUyPgE.exe
  C:\Windows\System\VkUyPgE.exe
  2⤵
  PID:6260
- C:\Windows\System\UhnLSod.exe
  C:\Windows\System\UhnLSod.exe
  2⤵
  PID:7228
- C:\Windows\System\VCwTGxt.exe
  C:\Windows\System\VCwTGxt.exe
  2⤵
  PID:7456
- C:\Windows\System\XFFczEN.exe
  C:\Windows\System\XFFczEN.exe
  2⤵
  PID:7512
- C:\Windows\System\cOluTTG.exe
  C:\Windows\System\cOluTTG.exe
  2⤵
  PID:7536
- C:\Windows\System\HbCZcOa.exe
  C:\Windows\System\HbCZcOa.exe
  2⤵
  PID:7576
- C:\Windows\System\WQQNONC.exe
  C:\Windows\System\WQQNONC.exe
  2⤵
  PID:7468
- C:\Windows\System\EzbKEQJ.exe
  C:\Windows\System\EzbKEQJ.exe
  2⤵
  PID:7808
- C:\Windows\System\oUgztBe.exe
  C:\Windows\System\oUgztBe.exe
  2⤵
  PID:6876
- C:\Windows\System\tgKCfaW.exe
  C:\Windows\System\tgKCfaW.exe
  2⤵
  PID:7712
- C:\Windows\System\pNZUwio.exe
  C:\Windows\System\pNZUwio.exe
  2⤵
  PID:7884
- C:\Windows\System\aYIGtIB.exe
  C:\Windows\System\aYIGtIB.exe
  2⤵
  PID:7788
- C:\Windows\System\aWcmUBq.exe
  C:\Windows\System\aWcmUBq.exe
  2⤵
  PID:7928
- C:\Windows\System\CztOsya.exe
  C:\Windows\System\CztOsya.exe
  2⤵
  PID:7992
- C:\Windows\System\xMkuoHw.exe
  C:\Windows\System\xMkuoHw.exe
  2⤵
  PID:8064
- C:\Windows\System\avwHBhG.exe
  C:\Windows\System\avwHBhG.exe
  2⤵
  PID:8172
- C:\Windows\System\QrCWXVG.exe
  C:\Windows\System\QrCWXVG.exe
  2⤵
  PID:8040
- C:\Windows\System\SIDijnT.exe
  C:\Windows\System\SIDijnT.exe
  2⤵
  PID:8100
- C:\Windows\System\gfIacPh.exe
  C:\Windows\System\gfIacPh.exe
  2⤵
  PID:7300
- C:\Windows\System\oGRculL.exe
  C:\Windows\System\oGRculL.exe
  2⤵
  PID:7372
- C:\Windows\System\iYqfvkV.exe
  C:\Windows\System\iYqfvkV.exe
  2⤵
  PID:8116
- C:\Windows\System\zgvFhKr.exe
  C:\Windows\System\zgvFhKr.exe
  2⤵
  PID:7524
- C:\Windows\System\DHCDFEm.exe
  C:\Windows\System\DHCDFEm.exe
  2⤵
  PID:7752
- C:\Windows\System\RCSaeZA.exe
  C:\Windows\System\RCSaeZA.exe
  2⤵
  PID:7596
- C:\Windows\System\wdERQHJ.exe
  C:\Windows\System\wdERQHJ.exe
  2⤵
  PID:8156
- C:\Windows\System\BjdYccs.exe
  C:\Windows\System\BjdYccs.exe
  2⤵
  PID:7632
- C:\Windows\System\gCcHQCM.exe
  C:\Windows\System\gCcHQCM.exe
  2⤵
  PID:8152
- C:\Windows\System\GvMmWQE.exe
  C:\Windows\System\GvMmWQE.exe
  2⤵
  PID:7324
- C:\Windows\System\wTmVVum.exe
  C:\Windows\System\wTmVVum.exe
  2⤵
  PID:8136
- C:\Windows\System\KdESNuc.exe
  C:\Windows\System\KdESNuc.exe
  2⤵
  PID:7656
- C:\Windows\System\DeGzeIU.exe
  C:\Windows\System\DeGzeIU.exe
  2⤵
  PID:8168
- C:\Windows\System\ZbnEVnS.exe
  C:\Windows\System\ZbnEVnS.exe
  2⤵
  PID:7392
- C:\Windows\System\iVwnPJC.exe
  C:\Windows\System\iVwnPJC.exe
  2⤵
  PID:7904
- C:\Windows\System\IPjODsb.exe
  C:\Windows\System\IPjODsb.exe
  2⤵
  PID:6276
- C:\Windows\System\syMSOfh.exe
  C:\Windows\System\syMSOfh.exe
  2⤵
  PID:7380
- C:\Windows\System\pBNExFm.exe
  C:\Windows\System\pBNExFm.exe
  2⤵
  PID:7932
- C:\Windows\System\PImaaix.exe
  C:\Windows\System\PImaaix.exe
  2⤵
  PID:7592
- C:\Windows\System\ovQopJA.exe
  C:\Windows\System\ovQopJA.exe
  2⤵
  PID:7736
- C:\Windows\System\lyOqtpm.exe
  C:\Windows\System\lyOqtpm.exe
  2⤵
  PID:7220
- C:\Windows\System\JFrNOaS.exe
  C:\Windows\System\JFrNOaS.exe
  2⤵
  PID:7996
- C:\Windows\System\PUoBwvC.exe
  C:\Windows\System\PUoBwvC.exe
  2⤵
  PID:7564
- C:\Windows\System\JuUZXuN.exe
  C:\Windows\System\JuUZXuN.exe
  2⤵
  PID:8196
- C:\Windows\System\nMcyDBt.exe
  C:\Windows\System\nMcyDBt.exe
  2⤵
  PID:8216
- C:\Windows\System\kVhMCaq.exe
  C:\Windows\System\kVhMCaq.exe
  2⤵
  PID:8232
- C:\Windows\System\IXwthUz.exe
  C:\Windows\System\IXwthUz.exe
  2⤵
  PID:8252
- C:\Windows\System\xFcsEIK.exe
  C:\Windows\System\xFcsEIK.exe
  2⤵
  PID:8272
- C:\Windows\System\vrdvODb.exe
  C:\Windows\System\vrdvODb.exe
  2⤵
  PID:8288
- C:\Windows\System\YRBJmca.exe
  C:\Windows\System\YRBJmca.exe
  2⤵
  PID:8304
- C:\Windows\System\TluqwAk.exe
  C:\Windows\System\TluqwAk.exe
  2⤵
  PID:8320
- C:\Windows\System\dGeoEjL.exe
  C:\Windows\System\dGeoEjL.exe
  2⤵
  PID:8348
- C:\Windows\System\qJkBruQ.exe
  C:\Windows\System\qJkBruQ.exe
  2⤵
  PID:8376
- C:\Windows\System\NLghpcf.exe
  C:\Windows\System\NLghpcf.exe
  2⤵
  PID:8396
- C:\Windows\System\bFVulDZ.exe
  C:\Windows\System\bFVulDZ.exe
  2⤵
  PID:8412
- C:\Windows\System\IrTNwRX.exe
  C:\Windows\System\IrTNwRX.exe
  2⤵
  PID:8428
- C:\Windows\System\uypoutm.exe
  C:\Windows\System\uypoutm.exe
  2⤵
  PID:8488
- C:\Windows\System\OPAOeez.exe
  C:\Windows\System\OPAOeez.exe
  2⤵
  PID:8508
- C:\Windows\System\ZkczSgw.exe
  C:\Windows\System\ZkczSgw.exe
  2⤵
  PID:8524
- C:\Windows\System\LadQcpt.exe
  C:\Windows\System\LadQcpt.exe
  2⤵
  PID:8540
- C:\Windows\System\rDuwquO.exe
  C:\Windows\System\rDuwquO.exe
  2⤵
  PID:8560
- C:\Windows\System\ZhiOeBb.exe
  C:\Windows\System\ZhiOeBb.exe
  2⤵
  PID:8588
- C:\Windows\System\ZrlafEh.exe
  C:\Windows\System\ZrlafEh.exe
  2⤵
  PID:8608
- C:\Windows\System\qVLQgXb.exe
  C:\Windows\System\qVLQgXb.exe
  2⤵
  PID:8624
- C:\Windows\System\bUtCGYz.exe
  C:\Windows\System\bUtCGYz.exe
  2⤵
  PID:8644
- C:\Windows\System\xiXObBE.exe
  C:\Windows\System\xiXObBE.exe
  2⤵
  PID:8664
- C:\Windows\System\XDPhuEr.exe
  C:\Windows\System\XDPhuEr.exe
  2⤵
  PID:8684
- C:\Windows\System\xbhaLGF.exe
  C:\Windows\System\xbhaLGF.exe
  2⤵
  PID:8708
- C:\Windows\System\daRApAI.exe
  C:\Windows\System\daRApAI.exe
  2⤵
  PID:8724
- C:\Windows\System\TEBgeXm.exe
  C:\Windows\System\TEBgeXm.exe
  2⤵
  PID:8748
- C:\Windows\System\ZHqfDgB.exe
  C:\Windows\System\ZHqfDgB.exe
  2⤵
  PID:8764
- C:\Windows\System\YxNbFKE.exe
  C:\Windows\System\YxNbFKE.exe
  2⤵
  PID:8784
- C:\Windows\System\mfgJKUI.exe
  C:\Windows\System\mfgJKUI.exe
  2⤵
  PID:8804
- C:\Windows\System\HSVbRHH.exe
  C:\Windows\System\HSVbRHH.exe
  2⤵
  PID:8820
- C:\Windows\System\ccGeAan.exe
  C:\Windows\System\ccGeAan.exe
  2⤵
  PID:8840
- C:\Windows\System\JoqUJXO.exe
  C:\Windows\System\JoqUJXO.exe
  2⤵
  PID:8876
- C:\Windows\System\crOocIy.exe
  C:\Windows\System\crOocIy.exe
  2⤵
  PID:8892
- C:\Windows\System\KqynWnv.exe
  C:\Windows\System\KqynWnv.exe
  2⤵
  PID:8908
- C:\Windows\System\vgVnOEU.exe
  C:\Windows\System\vgVnOEU.exe
  2⤵
  PID:8924
- C:\Windows\System\OntGdIC.exe
  C:\Windows\System\OntGdIC.exe
  2⤵
  PID:8944
- C:\Windows\System\hZHuqcU.exe
  C:\Windows\System\hZHuqcU.exe
  2⤵
  PID:8960
- C:\Windows\System\xuaffwT.exe
  C:\Windows\System\xuaffwT.exe
  2⤵
  PID:8980
- C:\Windows\System\jfYZgyu.exe
  C:\Windows\System\jfYZgyu.exe
  2⤵
  PID:9016
- C:\Windows\System\Letbeyt.exe
  C:\Windows\System\Letbeyt.exe
  2⤵
  PID:9032
- C:\Windows\System\ffEwdrW.exe
  C:\Windows\System\ffEwdrW.exe
  2⤵
  PID:9048
- C:\Windows\System\NmWMxuw.exe
  C:\Windows\System\NmWMxuw.exe
  2⤵
  PID:9064
- C:\Windows\System\AeVgefY.exe
  C:\Windows\System\AeVgefY.exe
  2⤵
  PID:9080
- C:\Windows\System\LDFzXHK.exe
  C:\Windows\System\LDFzXHK.exe
  2⤵
  PID:9096
- C:\Windows\System\jFpKHgX.exe
  C:\Windows\System\jFpKHgX.exe
  2⤵
  PID:9112
- C:\Windows\System\ryePURM.exe
  C:\Windows\System\ryePURM.exe
  2⤵
  PID:9132
- C:\Windows\System\yQlSgUO.exe
  C:\Windows\System\yQlSgUO.exe
  2⤵
  PID:9156
- C:\Windows\System\MugcXkK.exe
  C:\Windows\System\MugcXkK.exe
  2⤵
  PID:9172
- C:\Windows\System\qOcsOKc.exe
  C:\Windows\System\qOcsOKc.exe
  2⤵
  PID:8208
- C:\Windows\System\kLsUjtY.exe
  C:\Windows\System\kLsUjtY.exe
  2⤵
  PID:8032
- C:\Windows\System\ZNrtGGq.exe
  C:\Windows\System\ZNrtGGq.exe
  2⤵
  PID:8056
- C:\Windows\System\YYeQSsg.exe
  C:\Windows\System\YYeQSsg.exe
  2⤵
  PID:8284
- C:\Windows\System\xjCXzrT.exe
  C:\Windows\System\xjCXzrT.exe
  2⤵
  PID:7440
- C:\Windows\System\YDgiRFW.exe
  C:\Windows\System\YDgiRFW.exe
  2⤵
  PID:8356
- C:\Windows\System\bnvsrpy.exe
  C:\Windows\System\bnvsrpy.exe
  2⤵
  PID:8260
- C:\Windows\System\XjANjuK.exe
  C:\Windows\System\XjANjuK.exe
  2⤵
  PID:8268
- C:\Windows\System\vBhRtGp.exe
  C:\Windows\System\vBhRtGp.exe
  2⤵
  PID:8340
- C:\Windows\System\UPhvNqZ.exe
  C:\Windows\System\UPhvNqZ.exe
  2⤵
  PID:8388
- C:\Windows\System\IpJWgZq.exe
  C:\Windows\System\IpJWgZq.exe
  2⤵
  PID:8424
- C:\Windows\System\QZPXeSK.exe
  C:\Windows\System\QZPXeSK.exe
  2⤵
  PID:8480
- C:\Windows\System\TyALgnA.exe
  C:\Windows\System\TyALgnA.exe
  2⤵
  PID:8504
- C:\Windows\System\rLkjvBs.exe
  C:\Windows\System\rLkjvBs.exe
  2⤵
  PID:8552
- C:\Windows\System\XogjJWS.exe
  C:\Windows\System\XogjJWS.exe
  2⤵
  PID:8580
- C:\Windows\System\SlwNdwq.exe
  C:\Windows\System\SlwNdwq.exe
  2⤵
  PID:8620
- C:\Windows\System\jPSKBNV.exe
  C:\Windows\System\jPSKBNV.exe
  2⤵
  PID:8660
- C:\Windows\System\yxNJykA.exe
  C:\Windows\System\yxNJykA.exe
  2⤵
  PID:8696
- C:\Windows\System\HbbWLWU.exe
  C:\Windows\System\HbbWLWU.exe
  2⤵
  PID:8732
- C:\Windows\System\qiRLDJk.exe
  C:\Windows\System\qiRLDJk.exe
  2⤵
  PID:8776
- C:\Windows\System\oPgphdc.exe
  C:\Windows\System\oPgphdc.exe
  2⤵
  PID:8800
- C:\Windows\System\tthVOSC.exe
  C:\Windows\System\tthVOSC.exe
  2⤵
  PID:8816
- C:\Windows\System\SfMWgRJ.exe
  C:\Windows\System\SfMWgRJ.exe
  2⤵
  PID:8860
- C:\Windows\System\JZEZKZJ.exe
  C:\Windows\System\JZEZKZJ.exe
  2⤵
  PID:8884
- C:\Windows\System\bAgrMiS.exe
  C:\Windows\System\bAgrMiS.exe
  2⤵
  PID:8920
- C:\Windows\System\WXNwRKR.exe
  C:\Windows\System\WXNwRKR.exe
  2⤵
  PID:8956
- C:\Windows\System\xmRyuLy.exe
  C:\Windows\System\xmRyuLy.exe
  2⤵
  PID:9008
- C:\Windows\System\rVhNReK.exe
  C:\Windows\System\rVhNReK.exe
  2⤵
  PID:9044
- C:\Windows\System\UWzUzUf.exe
  C:\Windows\System\UWzUzUf.exe
  2⤵
  PID:9108
- C:\Windows\System\zqoIQiP.exe
  C:\Windows\System\zqoIQiP.exe
  2⤵
  PID:9152
- C:\Windows\System\TvCwofw.exe
  C:\Windows\System\TvCwofw.exe
  2⤵
  PID:9128
- C:\Windows\System\vIJakGA.exe
  C:\Windows\System\vIJakGA.exe
  2⤵
  PID:9180
- C:\Windows\System\mkgYmsF.exe
  C:\Windows\System\mkgYmsF.exe
  2⤵
  PID:9204
- C:\Windows\System\FLBUuhq.exe
  C:\Windows\System\FLBUuhq.exe
  2⤵
  PID:7924
- C:\Windows\System\pvoSvnx.exe
  C:\Windows\System\pvoSvnx.exe
  2⤵
  PID:8248
- C:\Windows\System\xGVNPTq.exe
  C:\Windows\System\xGVNPTq.exe
  2⤵
  PID:7356
- C:\Windows\System\sxpklUs.exe
  C:\Windows\System\sxpklUs.exe
  2⤵
  PID:8300
- C:\Windows\System\xDKXtQm.exe
  C:\Windows\System\xDKXtQm.exe
  2⤵
  PID:8440
- C:\Windows\System\GgGrdEb.exe
  C:\Windows\System\GgGrdEb.exe
  2⤵
  PID:8464
- C:\Windows\System\GUVgqrH.exe
  C:\Windows\System\GUVgqrH.exe
  2⤵
  PID:8516
- C:\Windows\System\nXCgFfN.exe
  C:\Windows\System\nXCgFfN.exe
  2⤵
  PID:8568
- C:\Windows\System\uOFdPYW.exe
  C:\Windows\System\uOFdPYW.exe
  2⤵
  PID:8600
- C:\Windows\System\NURZhLY.exe
  C:\Windows\System\NURZhLY.exe
  2⤵
  PID:8672
- C:\Windows\System\DGYYtDO.exe
  C:\Windows\System\DGYYtDO.exe
  2⤵
  PID:8716
- C:\Windows\System\yJgugNp.exe
  C:\Windows\System\yJgugNp.exe
  2⤵
  PID:8760
- C:\Windows\System\hLFCZee.exe
  C:\Windows\System\hLFCZee.exe
  2⤵
  PID:8852
- C:\Windows\System\eVEEkrx.exe
  C:\Windows\System\eVEEkrx.exe
  2⤵
  PID:8836
- C:\Windows\System\qvvukGF.exe
  C:\Windows\System\qvvukGF.exe
  2⤵
  PID:8988
- C:\Windows\System\ZjKHMax.exe
  C:\Windows\System\ZjKHMax.exe
  2⤵
  PID:8936
- C:\Windows\System\KIxMtTl.exe
  C:\Windows\System\KIxMtTl.exe
  2⤵
  PID:8976
- C:\Windows\System\FvbUSlV.exe
  C:\Windows\System\FvbUSlV.exe
  2⤵
  PID:9024
- C:\Windows\System\FhvEiuU.exe
  C:\Windows\System\FhvEiuU.exe
  2⤵
  PID:9144
- C:\Windows\System\uRWqmPn.exe
  C:\Windows\System\uRWqmPn.exe
  2⤵
  PID:1664
- C:\Windows\System\LHODpEO.exe
  C:\Windows\System\LHODpEO.exe
  2⤵
  PID:8240
- C:\Windows\System\ZkuGMLX.exe
  C:\Windows\System\ZkuGMLX.exe
  2⤵
  PID:8368
- C:\Windows\System\xDhhYDz.exe
  C:\Windows\System\xDhhYDz.exe
  2⤵
  PID:8332
- C:\Windows\System\Pxsbuvs.exe
  C:\Windows\System\Pxsbuvs.exe
  2⤵
  PID:8548
- C:\Windows\System\xdTJqsb.exe
  C:\Windows\System\xdTJqsb.exe
  2⤵
  PID:9028
- C:\Windows\System\pXZSYMX.exe
  C:\Windows\System\pXZSYMX.exe
  2⤵
  PID:8616
- C:\Windows\System\ZnfgkZq.exe
  C:\Windows\System\ZnfgkZq.exe
  2⤵
  PID:8704
- C:\Windows\System\jomCvJm.exe
  C:\Windows\System\jomCvJm.exe
  2⤵
  PID:8772
- C:\Windows\System\bniWKFM.exe
  C:\Windows\System\bniWKFM.exe
  2⤵
  PID:9000
- C:\Windows\System\ltQHTdE.exe
  C:\Windows\System\ltQHTdE.exe
  2⤵
  PID:8972
- C:\Windows\System\ApUZxuz.exe
  C:\Windows\System\ApUZxuz.exe
  2⤵
  PID:8792
- C:\Windows\System\jkMLVqZ.exe
  C:\Windows\System\jkMLVqZ.exe
  2⤵
  PID:9148
- C:\Windows\System\hOZLfRK.exe
  C:\Windows\System\hOZLfRK.exe
  2⤵
  PID:9192
- C:\Windows\System\nYVSRXq.exe
  C:\Windows\System\nYVSRXq.exe
  2⤵
  PID:8316
- C:\Windows\System\klCpbWG.exe
  C:\Windows\System\klCpbWG.exe
  2⤵
  PID:8556
- C:\Windows\System\WlKXzsq.exe
  C:\Windows\System\WlKXzsq.exe
  2⤵
  PID:8408
- C:\Windows\System\hONphim.exe
  C:\Windows\System\hONphim.exe
  2⤵
  PID:8992
- C:\Windows\System\ValvGNj.exe
  C:\Windows\System\ValvGNj.exe
  2⤵
  PID:9076
- C:\Windows\System\aKKQZhQ.exe
  C:\Windows\System\aKKQZhQ.exe
  2⤵
  PID:8872
- C:\Windows\System\MpNvhIq.exe
  C:\Windows\System\MpNvhIq.exe
  2⤵
  PID:9220
- C:\Windows\System\MVxSoAK.exe
  C:\Windows\System\MVxSoAK.exe
  2⤵
  PID:9240
- C:\Windows\System\FVwWbZq.exe
  C:\Windows\System\FVwWbZq.exe
  2⤵
  PID:9260
- C:\Windows\System\iEpmWGB.exe
  C:\Windows\System\iEpmWGB.exe
  2⤵
  PID:9284
- C:\Windows\System\hbjEJPc.exe
  C:\Windows\System\hbjEJPc.exe
  2⤵
  PID:9304
- C:\Windows\System\ULoUYvA.exe
  C:\Windows\System\ULoUYvA.exe
  2⤵
  PID:9320
- C:\Windows\System\yGzUDdm.exe
  C:\Windows\System\yGzUDdm.exe
  2⤵
  PID:9336
- C:\Windows\System\exOOCoH.exe
  C:\Windows\System\exOOCoH.exe
  2⤵
  PID:9352
- C:\Windows\System\RcUcQdO.exe
  C:\Windows\System\RcUcQdO.exe
  2⤵
  PID:9388
- C:\Windows\System\ocSvUgG.exe
  C:\Windows\System\ocSvUgG.exe
  2⤵
  PID:9408
- C:\Windows\System\rLbvSap.exe
  C:\Windows\System\rLbvSap.exe
  2⤵
  PID:9432
- C:\Windows\System\GgpRagk.exe
  C:\Windows\System\GgpRagk.exe
  2⤵
  PID:9448
- C:\Windows\System\gLofGFp.exe
  C:\Windows\System\gLofGFp.exe
  2⤵
  PID:9488
- C:\Windows\System\PGrEKWH.exe
  C:\Windows\System\PGrEKWH.exe
  2⤵
  PID:9508
- C:\Windows\System\GHatZKj.exe
  C:\Windows\System\GHatZKj.exe
  2⤵
  PID:9524
- C:\Windows\System\Akmovsa.exe
  C:\Windows\System\Akmovsa.exe
  2⤵
  PID:9544
- C:\Windows\System\KsnIVFg.exe
  C:\Windows\System\KsnIVFg.exe
  2⤵
  PID:9560
- C:\Windows\System\TCYbTFH.exe
  C:\Windows\System\TCYbTFH.exe
  2⤵
  PID:9576
- C:\Windows\System\uUZuloq.exe
  C:\Windows\System\uUZuloq.exe
  2⤵
  PID:9596
- C:\Windows\System\kFePnPq.exe
  C:\Windows\System\kFePnPq.exe
  2⤵
  PID:9612
- C:\Windows\System\WTfoDku.exe
  C:\Windows\System\WTfoDku.exe
  2⤵
  PID:9628
- C:\Windows\System\mGLBGKH.exe
  C:\Windows\System\mGLBGKH.exe
  2⤵
  PID:9648
- C:\Windows\System\HoDoFKk.exe
  C:\Windows\System\HoDoFKk.exe
  2⤵
  PID:9664
- C:\Windows\System\DbWtuJf.exe
  C:\Windows\System\DbWtuJf.exe
  2⤵
  PID:9684
- C:\Windows\System\IGhDOSl.exe
  C:\Windows\System\IGhDOSl.exe
  2⤵
  PID:9728
- C:\Windows\System\hQATBPg.exe
  C:\Windows\System\hQATBPg.exe
  2⤵
  PID:9748
- C:\Windows\System\YHNvVvY.exe
  C:\Windows\System\YHNvVvY.exe
  2⤵
  PID:9764
- C:\Windows\System\nrHlCjm.exe
  C:\Windows\System\nrHlCjm.exe
  2⤵
  PID:9784
- C:\Windows\System\KKiXxFt.exe
  C:\Windows\System\KKiXxFt.exe
  2⤵
  PID:9800
- C:\Windows\System\HeMyjaV.exe
  C:\Windows\System\HeMyjaV.exe
  2⤵
  PID:9816
- C:\Windows\System\LmwTVkR.exe
  C:\Windows\System\LmwTVkR.exe
  2⤵
  PID:9836
- C:\Windows\System\QxZETxd.exe
  C:\Windows\System\QxZETxd.exe
  2⤵
  PID:9856
- C:\Windows\System\bqyLBlD.exe
  C:\Windows\System\bqyLBlD.exe
  2⤵
  PID:9892
- C:\Windows\System\uoGGzDJ.exe
  C:\Windows\System\uoGGzDJ.exe
  2⤵
  PID:9912
- C:\Windows\System\mIpUeQm.exe
  C:\Windows\System\mIpUeQm.exe
  2⤵
  PID:9932
- C:\Windows\System\QPCsOzy.exe
  C:\Windows\System\QPCsOzy.exe
  2⤵
  PID:9948
- C:\Windows\System\icacscJ.exe
  C:\Windows\System\icacscJ.exe
  2⤵
  PID:9964
- C:\Windows\System\sCdYStS.exe
  C:\Windows\System\sCdYStS.exe
  2⤵
  PID:9980
- C:\Windows\System\CDxgvTI.exe
  C:\Windows\System\CDxgvTI.exe
  2⤵
  PID:9996
- C:\Windows\System\jShJeuM.exe
  C:\Windows\System\jShJeuM.exe
  2⤵
  PID:10012
- C:\Windows\System\PBBwocF.exe
  C:\Windows\System\PBBwocF.exe
  2⤵
  PID:10036
- C:\Windows\System\uxoWOxa.exe
  C:\Windows\System\uxoWOxa.exe
  2⤵
  PID:10072
- C:\Windows\System\iplOlcB.exe
  C:\Windows\System\iplOlcB.exe
  2⤵
  PID:10088
- C:\Windows\System\pgtlfUW.exe
  C:\Windows\System\pgtlfUW.exe
  2⤵
  PID:10108
- C:\Windows\System\jZzzosN.exe
  C:\Windows\System\jZzzosN.exe
  2⤵
  PID:10124
- C:\Windows\System\mSyssGF.exe
  C:\Windows\System\mSyssGF.exe
  2⤵
  PID:10140
- C:\Windows\System\BWrShcy.exe
  C:\Windows\System\BWrShcy.exe
  2⤵
  PID:10160
- C:\Windows\System\WIuUEpX.exe
  C:\Windows\System\WIuUEpX.exe
  2⤵
  PID:10180
- C:\Windows\System\Rkiqzmr.exe
  C:\Windows\System\Rkiqzmr.exe
  2⤵
  PID:10216
- C:\Windows\System\uImGZsW.exe
  C:\Windows\System\uImGZsW.exe
  2⤵
  PID:10232
- C:\Windows\System\LEqRACU.exe
  C:\Windows\System\LEqRACU.exe
  2⤵
  PID:9200
- C:\Windows\System\QmEIOtb.exe
  C:\Windows\System\QmEIOtb.exe
  2⤵
  PID:8264
- C:\Windows\System\XmonaMJ.exe
  C:\Windows\System\XmonaMJ.exe
  2⤵
  PID:9060
- C:\Windows\System\VKwwQAt.exe
  C:\Windows\System\VKwwQAt.exe
  2⤵
  PID:8500
- C:\Windows\System\mHSSqNI.exe
  C:\Windows\System\mHSSqNI.exe
  2⤵
  PID:8472
- C:\Windows\System\grJGoaD.exe
  C:\Windows\System\grJGoaD.exe
  2⤵
  PID:9236
- C:\Windows\System\tfvlzJI.exe
  C:\Windows\System\tfvlzJI.exe
  2⤵
  PID:9368
- C:\Windows\System\IBTadlQ.exe
  C:\Windows\System\IBTadlQ.exe
  2⤵
  PID:9384
- C:\Windows\System\gBoPqXB.exe
  C:\Windows\System\gBoPqXB.exe
  2⤵
  PID:9280
- C:\Windows\System\ygVkJzl.exe
  C:\Windows\System\ygVkJzl.exe
  2⤵
  PID:9400
- C:\Windows\System\oFIIcOw.exe
  C:\Windows\System\oFIIcOw.exe
  2⤵
  PID:9424
- C:\Windows\System\pdUQFWo.exe
  C:\Windows\System\pdUQFWo.exe
  2⤵
  PID:9464
- C:\Windows\System\VTPQild.exe
  C:\Windows\System\VTPQild.exe
  2⤵
  PID:9056
- C:\Windows\System\CJyExWu.exe
  C:\Windows\System\CJyExWu.exe
  2⤵
  PID:9516
- C:\Windows\System\rGlvGOk.exe
  C:\Windows\System\rGlvGOk.exe
  2⤵
  PID:9556
- C:\Windows\System\YPjFVTr.exe
  C:\Windows\System\YPjFVTr.exe
  2⤵
  PID:9624
- C:\Windows\System\dtwzxuW.exe
  C:\Windows\System\dtwzxuW.exe
  2⤵
  PID:9692
- C:\Windows\System\ipbXHRV.exe
  C:\Windows\System\ipbXHRV.exe
  2⤵
  PID:9604
- C:\Windows\System\bLkygRM.exe
  C:\Windows\System\bLkygRM.exe
  2⤵
  PID:9704
- C:\Windows\System\DMIXdis.exe
  C:\Windows\System\DMIXdis.exe
  2⤵
  PID:9720
- C:\Windows\System\rdVIojE.exe
  C:\Windows\System\rdVIojE.exe
  2⤵
  PID:9740
- C:\Windows\System\HMYMpVT.exe
  C:\Windows\System\HMYMpVT.exe
  2⤵
  PID:9776
- C:\Windows\System\pfQUOER.exe
  C:\Windows\System\pfQUOER.exe
  2⤵
  PID:9828
- C:\Windows\System\uzoGUtm.exe
  C:\Windows\System\uzoGUtm.exe
  2⤵
  PID:9848
- C:\Windows\System\SbdWYgI.exe
  C:\Windows\System\SbdWYgI.exe
  2⤵
  PID:9888
- C:\Windows\System\EMApqsy.exe
  C:\Windows\System\EMApqsy.exe
  2⤵
  PID:9920
- C:\Windows\System\VjdOpHs.exe
  C:\Windows\System\VjdOpHs.exe
  2⤵
  PID:9956
- C:\Windows\System\UmdZavV.exe
  C:\Windows\System\UmdZavV.exe
  2⤵
  PID:9992
- C:\Windows\System\OZCahum.exe
  C:\Windows\System\OZCahum.exe
  2⤵
  PID:10004
- C:\Windows\System\sXKLmKG.exe
  C:\Windows\System\sXKLmKG.exe
  2⤵
  PID:10052
- C:\Windows\System\gmZgCAP.exe
  C:\Windows\System\gmZgCAP.exe
  2⤵
  PID:1556
- C:\Windows\System\cMDHjqT.exe
  C:\Windows\System\cMDHjqT.exe
  2⤵
  PID:10096
- C:\Windows\System\AljXCUl.exe
  C:\Windows\System\AljXCUl.exe
  2⤵
  PID:10156
- C:\Windows\System\CSvzFUM.exe
  C:\Windows\System\CSvzFUM.exe
  2⤵
  PID:10188
- C:\Windows\System\MLDFEyg.exe
  C:\Windows\System\MLDFEyg.exe
  2⤵
  PID:10204
- C:\Windows\System\fIREARZ.exe
  C:\Windows\System\fIREARZ.exe
  2⤵
  PID:10228
- C:\Windows\System\azXiCgy.exe
  C:\Windows\System\azXiCgy.exe
  2⤵
  PID:8384
- C:\Windows\System\DNEtuqt.exe
  C:\Windows\System\DNEtuqt.exe
  2⤵
  PID:9252
- C:\Windows\System\fqCNjPu.exe
  C:\Windows\System\fqCNjPu.exe
  2⤵
  PID:9296
- C:\Windows\System\JRRDinp.exe
  C:\Windows\System\JRRDinp.exe
  2⤵
  PID:9376
- C:\Windows\System\sTTQRpL.exe
  C:\Windows\System\sTTQRpL.exe
  2⤵
  PID:9268
- C:\Windows\System\ifkMuLr.exe
  C:\Windows\System\ifkMuLr.exe
  2⤵
  PID:9312
- C:\Windows\System\cPpmUso.exe
  C:\Windows\System\cPpmUso.exe
  2⤵
  PID:9468
- C:\Windows\System\PfNwaBC.exe
  C:\Windows\System\PfNwaBC.exe
  2⤵
  PID:9500
- C:\Windows\System\nWauVQz.exe
  C:\Windows\System\nWauVQz.exe
  2⤵
  PID:9552
- C:\Windows\System\BhXQXYy.exe
  C:\Windows\System\BhXQXYy.exe
  2⤵
  PID:9640
- C:\Windows\System\RKVNiXJ.exe
  C:\Windows\System\RKVNiXJ.exe
  2⤵
  PID:9700
- C:\Windows\System\CuhMZcr.exe
  C:\Windows\System\CuhMZcr.exe
  2⤵
  PID:9736
- C:\Windows\System\TcizgnK.exe
  C:\Windows\System\TcizgnK.exe
  2⤵
  PID:9780
- C:\Windows\System\UnTqOSb.exe
  C:\Windows\System\UnTqOSb.exe
  2⤵
  PID:9812
- C:\Windows\System\ilBKmFA.exe
  C:\Windows\System\ilBKmFA.exe
  2⤵
  PID:9872
- C:\Windows\System\qyAVUTn.exe
  C:\Windows\System\qyAVUTn.exe
  2⤵
  PID:9904
- C:\Windows\System\YYxjSUd.exe
  C:\Windows\System\YYxjSUd.exe
  2⤵
  PID:9972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DePlKRs.exe

Filesize
1.6MB

MD5
eb6ccf34160098ee393b7cb3596eb398

SHA1
cb12f9a7629b76dcdc38a90cd869411b5abbe505

SHA256
ea18c57de5e76ef9f53634398286aa9384b92869b48c091c471aadf42f7d8909

SHA512
a6c9b8b2412e2a15b4de6916259dd9673e2df2c03ca8cb8d31661bdebe32aad0d88a09404aecd29cc772a631608bfe67eaf685cf47a16c37a3fe0221492966d0

Download Submit
C:\Windows\system\EVROczD.exe

Filesize
1.6MB

MD5
77560f6283440160a3cafb3416653271

SHA1
28c7349b4139331a152ba1f7d43f2fb47fd6bbb5

SHA256
edbcd8e49ac5e401904e93fecf0b9eb7b10ac39caf03fa3cf7da2c1c1d554f84

SHA512
6256e1ee4416bc800d27ca7c1e8e9eb756d3f4d63e30b6e592cfe2fdeef8c105bdb4eda55ff7015c01971fea28de39122e5bc90bd971a8f1cd81bf9be4dd7b3e

Download Submit
C:\Windows\system\EwjeySf.exe

Filesize
1.6MB

MD5
c6d4b2115160243485690511f3e03b80

SHA1
5dc2f8bc001d11ccc606f68d575a6f74407e1ffc

SHA256
2070091599c97ddb3544ab4409453293642a630b724303af78fad4f91a61c7c1

SHA512
0e81355d44ea8d8a800c0a13779594a7f1a5da716c019e473ea3e5662474e1b210dcad4516d2ea4232284a1d4f60f667392275efb70cd0caad3377bfa23b26d9

Download Submit
C:\Windows\system\IcmMniD.exe

Filesize
1.6MB

MD5
904f94404a151a7537ebba8cba8df2aa

SHA1
9552b73621dde9b61cf4ffdcf9c4e4aa1254c311

SHA256
9b195363e6ce9c811bcfbfec35de949f07696e367494762a648bf17bffd2d21f

SHA512
8305f2ab46af8d36c57f4d00f569a40bb3336c4ddb4f387f31289bc8e9316a6354916ace04b0f915c06dc2479cebd09d75180014d58d7d6437760ca497705962

Download Submit
C:\Windows\system\JievWsx.exe

Filesize
1.6MB

MD5
23054d9f1778127b64b4c3d5c2aebcb0

SHA1
60bd0dd0fcd729e97e16d08d0210662a30400291

SHA256
e0657737a0cc2531d0559ca1e20fb16e9b625c352aaaeb9ce1e3a5926aa8d1f8

SHA512
6d248dd55fff071f8f8477759c802f607a49126161bf4d7696dc8a578f35ab3597cd1771b3e970f7bf4716afdc02d52131c02bec96b15a1ce3716512169331af

Download Submit
C:\Windows\system\KfucBmP.exe

Filesize
1.6MB

MD5
997007053042ea48defb6596d1f5e148

SHA1
f64e1d4382468aa7637c3e0061bcede0a180110f

SHA256
ff21348925979126b748eeed7aa5236342fa527bbde2b39ac061c07c8d1c106f

SHA512
a51415af9e068bb7c0622344c51ccded74932dbc09a159c3e33391f352c645e4233a01bb141f5ada6e7dfa41f13e98377b57c991af9035ee8966d6419934c7bc

Download Submit
C:\Windows\system\LCtloRe.exe

Filesize
1.6MB

MD5
147016383197a973804fa2dc7bc1c23d

SHA1
51ec62622c6e75bda020277bccdd3772b841fafd

SHA256
876366c6cc8aa08933686ff531ddefacb82a717fecc22c995436c582c3a2eaa4

SHA512
442a218e88c65d4c789680308d4a69699bd2f0b820ffd2b81abba3778bb04ff03c973d628342b88405ec44e3a34b52da4abe5c8b51e63a3706fccc95b3739e4d

Download Submit
C:\Windows\system\MMOXLZb.exe

Filesize
1.6MB

MD5
c48a52a518446cd5a16790ba9830216d

SHA1
5109c4ba9d8175b455e440dbd0a988fe2002bc67

SHA256
6473a853272a0457b950ac99b3f82c43f69ab2a28d6b97189545e72c1eccfdbe

SHA512
a0768a28128a5e803b438ba1c6528f87006211db78a61c34317804388a5ac7bffdfa445fc27a0d8ad924aad523683edaa505fcc0f8bea8453b266219325cd575

Download Submit
C:\Windows\system\MhlLeOU.exe

Filesize
1.6MB

MD5
50432be2cf38b2e667edfdec5f534abb

SHA1
799a12a642f85257a92e0e42512e0af64adf6669

SHA256
716122b44ff702031cfdfb9b673935811f1402f63437a494e46517313c78fbfd

SHA512
f740336e05b8ca0e3c66122fbbe94097b831e61fdc93370be40839a03b3e34386f11d768cd4c7e61441f14801be6336c851c5ace85ed01ef38a2c8fbfb167d24

Download Submit
C:\Windows\system\NPmmhLG.exe

Filesize
1.6MB

MD5
789768a2b1288e2c9793c82a04129302

SHA1
ecff9fd26188e95a6e50f4db8d847bb84a409667

SHA256
b84c59c8f1ff78210301ff9e42db0ae5cce43bc8bf3d3a8e059bdbd3a37c72c6

SHA512
bc87d7b8de522da81d3aee260f3d8d04cf82bf972cc193a0ad0880fa5394979fe81692452ed35e90825afedff4b71f507d6c68dd3decb6c6660a0f13b58720dc

Download Submit
C:\Windows\system\Oulaxvn.exe

Filesize
1.6MB

MD5
8ed61621eac049777074a436c5dc85cf

SHA1
0617b9b3a81b5820216ac5a5691834ce537e0a17

SHA256
7e6725103cdcf619c7eebca9f12bf67a56756efa9bcb0fbffaccc8015c148f8b

SHA512
77074d5adad59dc6046b715d064cb1b9ae74aa0bfb20754b40872d15948cc37608130096b0f082436f1a0241007c0f85ed27369ed7e44cd84fb8447f50d7c607

Download Submit
C:\Windows\system\PWdgCLh.exe

Filesize
1.6MB

MD5
a7688e05912f0ab10704cf5bdb01f15f

SHA1
b74c937a0351d3c71bd385575c56146c010d88a1

SHA256
8027db558a1d19d523c999e20935eda1419b8c7a1b596eb4569b757448c26fa8

SHA512
42b688458792fd85d75318b4d3f7cac39da1183a706ed65812e758287ff09e2880e612c886740040df70f192fc5ab3955c80df8f5c0b749b7486d832b50663e1

Download Submit
C:\Windows\system\PjdERli.exe

Filesize
1.6MB

MD5
d345dfea1c50e8afbbfd40c0a285bb63

SHA1
bb6b140f83f19d56886dbb7a24dc6c875019e7f6

SHA256
92121619d62bcdafcd57127de9381674fcafc9cf19dc31afa41f6b5a7e15f30e

SHA512
fe4485758a9bc627269ac4ed65e497e50681319dfd3ef7f063c6cdab455319f297aaeebafffe0b6aedf06f974d62f5d78c27daa33065e069403c121adbc1086f

Download Submit
C:\Windows\system\TVMuRAk.exe

Filesize
1.6MB

MD5
cb90051f904bdb6d6bdf56f279c323cc

SHA1
1d51576940b30ad1158a0559dc0b1bca81648c28

SHA256
66ef608923973215c38d9aa366fdc0d199d92d9a165320d48f8f592145cfa1f0

SHA512
eaf31212542d523f45cece660cece8207bec84dd63d701911d5765b98890b56b8437ab3ba9e4b1e5e2595db1ea016357b5bf4928d701476426aaa9956df74706

Download Submit
C:\Windows\system\UyPEnTq.exe

Filesize
1.6MB

MD5
d681a1d6b2ce4371f34b68d3c3c68104

SHA1
096fbc6b5c5eac2b90ccc9ebbee6f4bf2ca48bdc

SHA256
3ebdfc4acb547b13620a76b1789867c845f19e497f8a96fe99ed61187743afc5

SHA512
20f1e9dae046ae36708e0a5bfbfd8f44fecff0e46685a65694c23e768c31a929a582adcd9bec277bb23e27398232cd96e5320518b76eb637291c80022d46c3ad

Download Submit
C:\Windows\system\affzlQE.exe

Filesize
1.6MB

MD5
c873602c0f30601ba6541a60cd4ae3f3

SHA1
5fd24c2c2d2ac96fce673a6df230579b5c7ae796

SHA256
03ae69e8e9b1370c1eb19d0a74e296ca2c76a7c57faeffd52471ae31a11990d3

SHA512
7fbe32f896eb6e136091c8f732f5b67ac87d1f018dbd15da9a97c5c86196324059243bf88a0947da136ac22bb1f62c4887d0734e4d80d414bd67fae038a3b649

Download Submit
C:\Windows\system\cBvjGVU.exe

Filesize
1.6MB

MD5
0c8b680dac4ee316474af67a61c73351

SHA1
1f6adb3673778b7eb4f75b296abf49af4a18dc28

SHA256
3ee3278b426c4869485c327fe41391c0f64e1ee93e69ffe892f36c73eed92228

SHA512
254561e6d8f219ee32ce495e4e4d88eaa3ea9c6bf9175ab05f2b0b824efb19cc00b149afe45565ba623e658add259e8e8b8bbbe84a76f2814af7eecfb5009769

Download Submit
C:\Windows\system\dDayvuV.exe

Filesize
1.6MB

MD5
952ecb25b5a7a46e5363487732d59e8f

SHA1
2d0fe79641b8e94b69d7682d68636c10833b8725

SHA256
6ce9e9a729ef33d4195827a1ece5d198473b5f8194f3fd1f764427c193b0dc02

SHA512
9fbc49d2519ae42d49c5c109b61ce6048b7fd5fcae0237670d32f3012ffd9b89829b704838d93a1b39e493bca8fdfdb054e11776feaa4b0cb1f67d50b9bbc0d7

Download Submit
C:\Windows\system\fnAiDHz.exe

Filesize
1.6MB

MD5
4d5f45e171e2f45a1efa28dd67aaeacf

SHA1
1ae89bb10737763844a8b116f1fdb3a653d31477

SHA256
617dd6bbaf8c21c4fcd43bc145a97a3adc9b1ecdba4d5ac96c5913875cdc3178

SHA512
5dc96c3644bfac8beb583740de333fab7084a1753a16c93ab779dc277ab7642f345da84ccb374322467c19e123f382a0e37c19b3eda568452f779d85111a21c9

Download Submit
C:\Windows\system\fpDwcSs.exe

Filesize
1.6MB

MD5
ba94b8451ae95c76ab8ff6f745a96f94

SHA1
f9d998e6f3b11302ba0a97dccb28e45a78667a83

SHA256
61ad1682061ce80d278fa2f63eb9436ed45c636a16f78c8d4bb31472503412b3

SHA512
cc2ff42c1bc977056d1c141709c2ac8adad47a42182f4812b6e1bb86078c9050a36a10a474fd38e9754ca79f20b4e6c47d7c21d55d34edc010b1adac746f79cb

Download Submit
C:\Windows\system\fswZuUN.exe

Filesize
1.6MB

MD5
c0606eaef79178d7cf7c25bff022dd62

SHA1
b6e5f13856871cf8378b9e739470db657b1916e4

SHA256
ed8bdf904922ccc736e9b491b72fb8e275199a6564f6bf9ec188422a73fcac85

SHA512
6778cd8df13d45c40ce5cb904568181d92a41e5dab96e092df4ca23a414b3a453b562f6a85826eded418753bdf978348aca03741c890261aada1451d81f540fe

Download Submit
C:\Windows\system\gFBmyYC.exe

Filesize
1.6MB

MD5
39e09d45b249817ccb83a39ba3b3c385

SHA1
068efc145c44a4ca71ce6512679957b65ba3c6d3

SHA256
2048b8fc2fd9535a7099ecd37f279e0ae5fcbec9aee8bc60b6c86f4f514a4810

SHA512
3a7526e9ba791c184da53b98263832893f7a64306c17886bbaa1f479fb19d4acdaf0c745518cdda38e22459d69f63570d08cf3750ed99cbd9f3ba1823652cc13

Download Submit
C:\Windows\system\gOGBPXV.exe

Filesize
1.6MB

MD5
2d207d2536935523e37cf28f9c8e8d27

SHA1
b55db80ebd0fc3eed34eee17581294bd456a8d3f

SHA256
a57dd4c3346c64aa72f494347fdbf48ec3001bda63a5b9fd49b0ee2ce66dd636

SHA512
f99043b192cd504fb1cf111269975c45c7cd7c947fff7a285751487b0452a4bfd7b143375edc6eed4ffc84eb38ea53b182087f5855acc96f2a8d724b7dd24374

Download Submit
C:\Windows\system\hwvdoid.exe

Filesize
1.6MB

MD5
cca8630a711abf612d97d0347aad9ae9

SHA1
9ad619e68a51c8fdbc95de218c89e6af21d4dd28

SHA256
52727efd537009035a44227aca795cf2065f46cf75443d26c86e3420a9b57687

SHA512
e05fa672b372d7943e0e606ae27c479661c34d7e5cb70bdb2fa47ea6c269e4bfae96178bccdcc212cd86d7bd6a2ce9225c3b199e66ab3939b283ba921b22af5b

Download Submit
C:\Windows\system\hxIsrev.exe

Filesize
1.6MB

MD5
860ea2c0de0d5b95a2e16d9ea4e81329

SHA1
b78b610f4720c4171a71f3d71c19a8de2a4279ee

SHA256
077420d59f3059cd19d9de123638470608933f1cebc7d364ad01e4192509084d

SHA512
ec710082e007a50afdfe732383c37b390cacc5b9314ef0ab27fa8ebff68ed44e96643703a725220e4a26617a42477bda53a76275fbb1e5a3a0a1b976bba59cd7

Download Submit
C:\Windows\system\iMlMlTF.exe

Filesize
1.6MB

MD5
5b44c819bcd1796d85f7818a92a0b82e

SHA1
5a6fb177bffe994641bef6386297405d6f0b81cd

SHA256
6dd32b17a28c652846ecd5cd322314f85683ea42d89011fc641762757c4e8b4d

SHA512
50e8cf26f710815ed9d07b9c5608678f549f1a7646c2073bc7041b86df466f43340f32269dd0f69532c2bb20f70c4823ef1196ba55b33d3397daf92c7382e0e1

Download Submit
C:\Windows\system\lZzqKUL.exe

Filesize
1.6MB

MD5
5a52a4c81a3983e48927dd58ba397eaf

SHA1
6502d0560b0e5e964e32365cee0508904559c059

SHA256
4736089c728cccc8bcb4e3eb391ae54834132c09115573f75db33b0de3ca6307

SHA512
339ddef680058b018792ef7638470050e66866add93e31ed98fa889b240cc74ea02fcd4ae74f21f4ce188d7b86b2debdda987c63d3d7081ff041fb559c3bb594

Download Submit
C:\Windows\system\mBNxVQC.exe

Filesize
1.6MB

MD5
eabe43794e7a28c0bd3020f4c801bb1d

SHA1
345a7d6c15002cb393890617190a57e15aa007af

SHA256
46258a5d9a5ef4e010cb54177fe1e2657d9db8d1577b36f7dbb8fcc521a9778e

SHA512
c4a0ee787157db1daed4ea48ceb1624c04f8339dacf9079c3dc554731fec8bb95ea955899da64e19ebe6b2fcc4e31644f3cba8d9aa585b0a623851bd18f98d0d

Download Submit
C:\Windows\system\qybOUTo.exe

Filesize
1.6MB

MD5
94d39d69e55a34d93d23db8b5c3965f3

SHA1
18a5e82cec3b9fb265a64de3c0808883cf86c445

SHA256
2d73aa73f3bdf1a542e6b919bba6b6da97b6d194687071450c8877c21bb6d813

SHA512
c62ed30bd3f5230623254540011751c5afb8e14e5eea1193bf91209e8101e79d2e25c3a0a45267ddb983efd18d625c0827d64025ddcef32ad26712dbeed07422

Download Submit
C:\Windows\system\tsOtnyh.exe

Filesize
1.6MB

MD5
c021cba4b788fa3ef835385b16cd1663

SHA1
cf7bf55d6937119a5efab1c23534ac6b51da421c

SHA256
3bbf12f438a73502224914ae7067ad6a1275e4a3e37b6490e687002abb1ea84c

SHA512
6a11ab8a1e54b71e4661af15964ae1aa63fe06a0f6fbb4cd18e773d2c2895e1815d920ad79dbaa33828ead0de0f15662fb76026edbbf07d464f899c342ec6309

Download Submit
C:\Windows\system\xLzoEET.exe

Filesize
1.6MB

MD5
4d49242771b11ae88ad634eb7edbe312

SHA1
4f523111e979cce75dc278f356f5b2379d4ec7c6

SHA256
7c926782555ab8edccb664f06be6acb15d4702f037acaaa0017ef24ace958d4a

SHA512
733d40e5773eea4e7b80e75f4d8c247f46350aeea5c98dc60b7f84df7c87f9779bd77dcb7329c7cfe7217ff6aaf560af377cb45a3be00ffcca7f2f126134fd02

Download Submit
\Windows\system\nJjXsen.exe

Filesize
1.6MB

MD5
be2264f8341a27e8c28b589920656cd7

SHA1
2169baa20dd7b084f3b805c6bb340a5164249e30

SHA256
5b2cd14f53156f5f9274cbe9461d6eba25848f4940ccf705e10299226ab095b4

SHA512
f3e1dafead483b5e782c8e3508db5aae074de9b1ea1f0f2a6f96f660b0adfde8bad98c22b4139b2b02cb25e8e1dd6d8b637157707996353dc9b891a96c0f69c1

Download Submit
memory/1384-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download