xmrig | c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4

Analysis

max time kernel
72s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
Size

1.7MB
MD5

26ae7de57c0658bd0bc31d1f75ff87b6
SHA1

9f143e331d8faa9df4284b7bbcf19d3988be8f1a
SHA256

c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4
SHA512

51aa5f60946d1642e7ffc98940c8c51ce88018331e39f82c4ea1e9afde5af8166f282575648248de27d5537650a2edc915048e1ce991257863f5dee57c0196e3
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLjA9:GemTLkNdfE0pZyf

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120fd-2.dat	xmrig
behavioral1/files/0x0011000000019606-9.dat	xmrig
behavioral1/files/0x0007000000019608-8.dat	xmrig
behavioral1/files/0x000700000001960a-19.dat	xmrig
behavioral1/files/0x000700000001961c-24.dat	xmrig
behavioral1/files/0x0006000000019667-28.dat	xmrig
behavioral1/files/0x00060000000196a1-34.dat	xmrig
behavioral1/files/0x000500000001a4cd-69.dat	xmrig
behavioral1/files/0x000500000001a4d5-89.dat	xmrig
behavioral1/files/0x000500000001a4d9-99.dat	xmrig
behavioral1/files/0x000500000001a4db-103.dat	xmrig
behavioral1/files/0x000500000001a4e2-118.dat	xmrig
behavioral1/files/0x000500000001a4eb-136.dat	xmrig
behavioral1/files/0x000500000001a4e8-142.dat	xmrig
behavioral1/files/0x000500000001a4ed-159.dat	xmrig
behavioral1/files/0x000500000001a50b-157.dat	xmrig
behavioral1/files/0x000500000001a4f1-148.dat	xmrig
behavioral1/files/0x000500000001a4f7-154.dat	xmrig
behavioral1/files/0x000500000001a4e4-124.dat	xmrig
behavioral1/files/0x000500000001a4ef-145.dat	xmrig
behavioral1/files/0x000500000001a4e6-127.dat	xmrig
behavioral1/files/0x000500000001a4e0-114.dat	xmrig
behavioral1/files/0x000500000001a4de-108.dat	xmrig
behavioral1/files/0x000500000001a4d7-93.dat	xmrig
behavioral1/files/0x000500000001a4d3-83.dat	xmrig
behavioral1/files/0x000500000001a4d1-79.dat	xmrig
behavioral1/files/0x000500000001a4cf-73.dat	xmrig
behavioral1/files/0x000500000001a4cb-63.dat	xmrig
behavioral1/files/0x000500000001a4c7-53.dat	xmrig
behavioral1/files/0x000500000001a4c9-59.dat	xmrig
behavioral1/files/0x0008000000019c3c-49.dat	xmrig
behavioral1/files/0x0008000000019c34-44.dat	xmrig
behavioral1/files/0x0006000000019926-39.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1300	shyQzWi.exe
1448	tiVFfPM.exe
2332	JcjfMes.exe
2968	iDVyFgo.exe
2992	XmNknjN.exe
2832	pgWkgfY.exe
3016	ZGxGQFR.exe
3008	ElsRQCC.exe
2920	cfkLKwu.exe
2880	VVwRNNC.exe
2760	ESiEwOk.exe
776	JmrsHyX.exe
2828	zMGXfZO.exe
2172	UleBzXx.exe
1352	LelqUVK.exe
2528	BnCJpbA.exe
2468	zsqpCIn.exe
444	JsxIphT.exe
636	zROzrVm.exe
1696	LeOosUL.exe
2120	ApIvliy.exe
2340	HGCbwlT.exe
2264	dJMRnWk.exe
2128	NGXCenx.exe
3040	BUTFozv.exe
760	ZwRhuRU.exe
1944	KVWGFTg.exe
2392	lMPkngE.exe
2428	cnmXPle.exe
976	CtiGnAu.exe
2328	StNnYDo.exe
2192	vJeYdes.exe
2060	RzSKJai.exe
2448	crvupqw.exe
2084	AtDDIbA.exe
2604	GNLoRRX.exe
1512	nBpBIel.exe
1076	bCNePJy.exe
1516	NmGAjxf.exe
1616	yxTWCxO.exe
1788	EqOzhsb.exe
1640	qZUdTlg.exe
2376	CiDTAeG.exe
1676	pzxJWhL.exe
1704	ukfNlRS.exe
1876	ZXbtNZB.exe
988	EoMRubr.exe
984	ffaBMnY.exe
1188	laJEuKF.exe
1472	OrHBsjW.exe
608	pMfMkPi.exe
1724	QVsrfcy.exe
1164	XicHsfj.exe
884	pcjSdVz.exe
1780	wFOVOYz.exe
1732	NwUuISk.exe
2320	dJXIyYL.exe
1548	oBPiIWi.exe
1576	qIXdMiC.exe
2952	PdnZbvL.exe
2096	onBdHyL.exe
2848	MXshVhP.exe
2224	UAkPRNk.exe
2072	QGGxsmq.exe

Loads dropped DLL 64 IoCs

pid	Process
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WhabXKh.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\hGddokB.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\EcuuTsN.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\tmmCSQk.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\IWWHHDY.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\SsnUQVA.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\FFhvGWd.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\iDVyFgo.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\PdnZbvL.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\YRCpYAF.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\GcIwXbP.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\wrlNRAP.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\cdgXUFO.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\DWOHitk.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\JSCPXpv.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\fNDoqUE.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\FHRowxN.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\ovpsTFm.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\rIIhDeH.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\NwUuISk.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\hlDeQQy.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\GUsFltT.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\qWzfeBX.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\WJSawgk.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\OBOABNf.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\TnfdlWN.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\RxvqzkB.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\tiVFfPM.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\JdYgKua.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\noPwMaT.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\fTcBdKl.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\CtaYHQQ.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\gfoXUKl.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\pDtFLlx.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\FmOUQGj.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\YbZIqBf.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\seMAGCl.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\URmiKic.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\BJSJPpt.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\oHslNDn.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\qcYLYtQ.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\JmrsHyX.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\WiKXQNG.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\zpRTNpl.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\tvQaKiL.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\jhSkubB.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\bZHFygb.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\qaidmVP.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\KGuXfFj.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\CQupElX.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\EcqgAaE.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\YQeVROc.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\frpAGwH.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\SRmaGzP.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\PIhiucG.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\vBVxsOw.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\KgYjGig.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\CNVWhRy.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\kPwJvSz.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\jGsHcNJ.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\RnQzoKW.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\MzgMPHM.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\GmLexas.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
File created	C:\Windows\System\dKsamTb.exe	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1300	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	32
PID 2004 wrote to memory of 1300	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	32
PID 2004 wrote to memory of 1300	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	32
PID 2004 wrote to memory of 1448	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	33
PID 2004 wrote to memory of 1448	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	33
PID 2004 wrote to memory of 1448	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	33
PID 2004 wrote to memory of 2332	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	34
PID 2004 wrote to memory of 2332	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	34
PID 2004 wrote to memory of 2332	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	34
PID 2004 wrote to memory of 2968	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	35
PID 2004 wrote to memory of 2968	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	35
PID 2004 wrote to memory of 2968	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	35
PID 2004 wrote to memory of 2992	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	36
PID 2004 wrote to memory of 2992	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	36
PID 2004 wrote to memory of 2992	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	36
PID 2004 wrote to memory of 2832	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	37
PID 2004 wrote to memory of 2832	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	37
PID 2004 wrote to memory of 2832	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	37
PID 2004 wrote to memory of 3016	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	38
PID 2004 wrote to memory of 3016	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	38
PID 2004 wrote to memory of 3016	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	38
PID 2004 wrote to memory of 3008	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	39
PID 2004 wrote to memory of 3008	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	39
PID 2004 wrote to memory of 3008	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	39
PID 2004 wrote to memory of 2920	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	40
PID 2004 wrote to memory of 2920	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	40
PID 2004 wrote to memory of 2920	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	40
PID 2004 wrote to memory of 2880	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	41
PID 2004 wrote to memory of 2880	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	41
PID 2004 wrote to memory of 2880	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	41
PID 2004 wrote to memory of 2760	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	42
PID 2004 wrote to memory of 2760	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	42
PID 2004 wrote to memory of 2760	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	42
PID 2004 wrote to memory of 776	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	43
PID 2004 wrote to memory of 776	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	43
PID 2004 wrote to memory of 776	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	43
PID 2004 wrote to memory of 2828	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	44
PID 2004 wrote to memory of 2828	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	44
PID 2004 wrote to memory of 2828	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	44
PID 2004 wrote to memory of 2172	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	45
PID 2004 wrote to memory of 2172	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	45
PID 2004 wrote to memory of 2172	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	45
PID 2004 wrote to memory of 1352	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	46
PID 2004 wrote to memory of 1352	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	46
PID 2004 wrote to memory of 1352	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	46
PID 2004 wrote to memory of 2528	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	47
PID 2004 wrote to memory of 2528	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	47
PID 2004 wrote to memory of 2528	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	47
PID 2004 wrote to memory of 2468	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	48
PID 2004 wrote to memory of 2468	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	48
PID 2004 wrote to memory of 2468	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	48
PID 2004 wrote to memory of 444	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	49
PID 2004 wrote to memory of 444	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	49
PID 2004 wrote to memory of 444	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	49
PID 2004 wrote to memory of 636	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	50
PID 2004 wrote to memory of 636	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	50
PID 2004 wrote to memory of 636	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	50
PID 2004 wrote to memory of 1696	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	51
PID 2004 wrote to memory of 1696	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	51
PID 2004 wrote to memory of 1696	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	51
PID 2004 wrote to memory of 2120	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	52
PID 2004 wrote to memory of 2120	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	52
PID 2004 wrote to memory of 2120	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	52
PID 2004 wrote to memory of 2340	2004	c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe	53

C:\Users\Admin\AppData\Local\Temp\c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe
"C:\Users\Admin\AppData\Local\Temp\c39e6d32dbed86dfac0e182d98d0252da257fce0f0b93c74d6cafb7d6e77bec4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System\shyQzWi.exe
  C:\Windows\System\shyQzWi.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\tiVFfPM.exe
  C:\Windows\System\tiVFfPM.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\JcjfMes.exe
  C:\Windows\System\JcjfMes.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\iDVyFgo.exe
  C:\Windows\System\iDVyFgo.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\XmNknjN.exe
  C:\Windows\System\XmNknjN.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pgWkgfY.exe
  C:\Windows\System\pgWkgfY.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ZGxGQFR.exe
  C:\Windows\System\ZGxGQFR.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ElsRQCC.exe
  C:\Windows\System\ElsRQCC.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\cfkLKwu.exe
  C:\Windows\System\cfkLKwu.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\VVwRNNC.exe
  C:\Windows\System\VVwRNNC.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ESiEwOk.exe
  C:\Windows\System\ESiEwOk.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\JmrsHyX.exe
  C:\Windows\System\JmrsHyX.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\zMGXfZO.exe
  C:\Windows\System\zMGXfZO.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\UleBzXx.exe
  C:\Windows\System\UleBzXx.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\LelqUVK.exe
  C:\Windows\System\LelqUVK.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\BnCJpbA.exe
  C:\Windows\System\BnCJpbA.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\zsqpCIn.exe
  C:\Windows\System\zsqpCIn.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\JsxIphT.exe
  C:\Windows\System\JsxIphT.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\zROzrVm.exe
  C:\Windows\System\zROzrVm.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\LeOosUL.exe
  C:\Windows\System\LeOosUL.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ApIvliy.exe
  C:\Windows\System\ApIvliy.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\HGCbwlT.exe
  C:\Windows\System\HGCbwlT.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\dJMRnWk.exe
  C:\Windows\System\dJMRnWk.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\NGXCenx.exe
  C:\Windows\System\NGXCenx.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\BUTFozv.exe
  C:\Windows\System\BUTFozv.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ZwRhuRU.exe
  C:\Windows\System\ZwRhuRU.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\lMPkngE.exe
  C:\Windows\System\lMPkngE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\KVWGFTg.exe
  C:\Windows\System\KVWGFTg.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\StNnYDo.exe
  C:\Windows\System\StNnYDo.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\cnmXPle.exe
  C:\Windows\System\cnmXPle.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\vJeYdes.exe
  C:\Windows\System\vJeYdes.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\CtiGnAu.exe
  C:\Windows\System\CtiGnAu.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\RzSKJai.exe
  C:\Windows\System\RzSKJai.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\crvupqw.exe
  C:\Windows\System\crvupqw.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\AtDDIbA.exe
  C:\Windows\System\AtDDIbA.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\GNLoRRX.exe
  C:\Windows\System\GNLoRRX.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\nBpBIel.exe
  C:\Windows\System\nBpBIel.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bCNePJy.exe
  C:\Windows\System\bCNePJy.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\NmGAjxf.exe
  C:\Windows\System\NmGAjxf.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\yxTWCxO.exe
  C:\Windows\System\yxTWCxO.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\EqOzhsb.exe
  C:\Windows\System\EqOzhsb.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\qZUdTlg.exe
  C:\Windows\System\qZUdTlg.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\CiDTAeG.exe
  C:\Windows\System\CiDTAeG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\pzxJWhL.exe
  C:\Windows\System\pzxJWhL.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ukfNlRS.exe
  C:\Windows\System\ukfNlRS.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\ZXbtNZB.exe
  C:\Windows\System\ZXbtNZB.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\EoMRubr.exe
  C:\Windows\System\EoMRubr.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\ffaBMnY.exe
  C:\Windows\System\ffaBMnY.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\laJEuKF.exe
  C:\Windows\System\laJEuKF.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\OrHBsjW.exe
  C:\Windows\System\OrHBsjW.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\pMfMkPi.exe
  C:\Windows\System\pMfMkPi.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\QVsrfcy.exe
  C:\Windows\System\QVsrfcy.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\XicHsfj.exe
  C:\Windows\System\XicHsfj.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\pcjSdVz.exe
  C:\Windows\System\pcjSdVz.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\wFOVOYz.exe
  C:\Windows\System\wFOVOYz.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\NwUuISk.exe
  C:\Windows\System\NwUuISk.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\dJXIyYL.exe
  C:\Windows\System\dJXIyYL.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\oBPiIWi.exe
  C:\Windows\System\oBPiIWi.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\qIXdMiC.exe
  C:\Windows\System\qIXdMiC.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\PdnZbvL.exe
  C:\Windows\System\PdnZbvL.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\onBdHyL.exe
  C:\Windows\System\onBdHyL.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\MXshVhP.exe
  C:\Windows\System\MXshVhP.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\UAkPRNk.exe
  C:\Windows\System\UAkPRNk.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\QGGxsmq.exe
  C:\Windows\System\QGGxsmq.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\zmJqUro.exe
  C:\Windows\System\zmJqUro.exe
  2⤵
  PID:2768
- C:\Windows\System\RcRgSsf.exe
  C:\Windows\System\RcRgSsf.exe
  2⤵
  PID:2720
- C:\Windows\System\bmyMtHj.exe
  C:\Windows\System\bmyMtHj.exe
  2⤵
  PID:2568
- C:\Windows\System\rcHcbWd.exe
  C:\Windows\System\rcHcbWd.exe
  2⤵
  PID:2744
- C:\Windows\System\izKtubE.exe
  C:\Windows\System\izKtubE.exe
  2⤵
  PID:1032
- C:\Windows\System\FaFPvwX.exe
  C:\Windows\System\FaFPvwX.exe
  2⤵
  PID:1980
- C:\Windows\System\NWokKxT.exe
  C:\Windows\System\NWokKxT.exe
  2⤵
  PID:2912
- C:\Windows\System\DgxBoef.exe
  C:\Windows\System\DgxBoef.exe
  2⤵
  PID:2256
- C:\Windows\System\JrOGPej.exe
  C:\Windows\System\JrOGPej.exe
  2⤵
  PID:2940
- C:\Windows\System\ZXHJnUL.exe
  C:\Windows\System\ZXHJnUL.exe
  2⤵
  PID:2372
- C:\Windows\System\PVxqJAP.exe
  C:\Windows\System\PVxqJAP.exe
  2⤵
  PID:2200
- C:\Windows\System\lepDuwU.exe
  C:\Windows\System\lepDuwU.exe
  2⤵
  PID:3036
- C:\Windows\System\XRqURFc.exe
  C:\Windows\System\XRqURFc.exe
  2⤵
  PID:2396
- C:\Windows\System\BFWZtER.exe
  C:\Windows\System\BFWZtER.exe
  2⤵
  PID:2148
- C:\Windows\System\jbEnYPs.exe
  C:\Windows\System\jbEnYPs.exe
  2⤵
  PID:896
- C:\Windows\System\jYVPCvA.exe
  C:\Windows\System\jYVPCvA.exe
  2⤵
  PID:596
- C:\Windows\System\ZEEiFmB.exe
  C:\Windows\System\ZEEiFmB.exe
  2⤵
  PID:2444
- C:\Windows\System\zTAxvem.exe
  C:\Windows\System\zTAxvem.exe
  2⤵
  PID:1612
- C:\Windows\System\lXHwNhT.exe
  C:\Windows\System\lXHwNhT.exe
  2⤵
  PID:1768
- C:\Windows\System\LNlayzZ.exe
  C:\Windows\System\LNlayzZ.exe
  2⤵
  PID:2572
- C:\Windows\System\ZUvRNEo.exe
  C:\Windows\System\ZUvRNEo.exe
  2⤵
  PID:1708
- C:\Windows\System\ZXUiWrY.exe
  C:\Windows\System\ZXUiWrY.exe
  2⤵
  PID:1664
- C:\Windows\System\cdgXUFO.exe
  C:\Windows\System\cdgXUFO.exe
  2⤵
  PID:1916
- C:\Windows\System\qCTIMPG.exe
  C:\Windows\System\qCTIMPG.exe
  2⤵
  PID:1864
- C:\Windows\System\NAQxgAt.exe
  C:\Windows\System\NAQxgAt.exe
  2⤵
  PID:1956
- C:\Windows\System\wRYXXpm.exe
  C:\Windows\System\wRYXXpm.exe
  2⤵
  PID:2456
- C:\Windows\System\wBDlAcI.exe
  C:\Windows\System\wBDlAcI.exe
  2⤵
  PID:2052
- C:\Windows\System\xhrQTJx.exe
  C:\Windows\System\xhrQTJx.exe
  2⤵
  PID:1712
- C:\Windows\System\wvMlAbb.exe
  C:\Windows\System\wvMlAbb.exe
  2⤵
  PID:2112
- C:\Windows\System\IwejoQW.exe
  C:\Windows\System\IwejoQW.exe
  2⤵
  PID:2436
- C:\Windows\System\FBkEyqy.exe
  C:\Windows\System\FBkEyqy.exe
  2⤵
  PID:2536
- C:\Windows\System\eWjZuyg.exe
  C:\Windows\System\eWjZuyg.exe
  2⤵
  PID:2180
- C:\Windows\System\aQWEAUd.exe
  C:\Windows\System\aQWEAUd.exe
  2⤵
  PID:2824
- C:\Windows\System\jGsHcNJ.exe
  C:\Windows\System\jGsHcNJ.exe
  2⤵
  PID:2808
- C:\Windows\System\gccSMOB.exe
  C:\Windows\System\gccSMOB.exe
  2⤵
  PID:2756
- C:\Windows\System\wqxyRJp.exe
  C:\Windows\System\wqxyRJp.exe
  2⤵
  PID:2700
- C:\Windows\System\eCRCgGg.exe
  C:\Windows\System\eCRCgGg.exe
  2⤵
  PID:2464
- C:\Windows\System\Rtfyhol.exe
  C:\Windows\System\Rtfyhol.exe
  2⤵
  PID:2000
- C:\Windows\System\MbAUtkg.exe
  C:\Windows\System\MbAUtkg.exe
  2⤵
  PID:2420
- C:\Windows\System\vRYYtsV.exe
  C:\Windows\System\vRYYtsV.exe
  2⤵
  PID:1932
- C:\Windows\System\AUlAGVX.exe
  C:\Windows\System\AUlAGVX.exe
  2⤵
  PID:2360
- C:\Windows\System\HDlAmbm.exe
  C:\Windows\System\HDlAmbm.exe
  2⤵
  PID:2188
- C:\Windows\System\NvZlmRF.exe
  C:\Windows\System\NvZlmRF.exe
  2⤵
  PID:2988
- C:\Windows\System\IpFWtfj.exe
  C:\Windows\System\IpFWtfj.exe
  2⤵
  PID:1648
- C:\Windows\System\IikrWzm.exe
  C:\Windows\System\IikrWzm.exe
  2⤵
  PID:696
- C:\Windows\System\ymQXbQo.exe
  C:\Windows\System\ymQXbQo.exe
  2⤵
  PID:692
- C:\Windows\System\tlQqcGu.exe
  C:\Windows\System\tlQqcGu.exe
  2⤵
  PID:1500
- C:\Windows\System\ivXLreb.exe
  C:\Windows\System\ivXLreb.exe
  2⤵
  PID:2488
- C:\Windows\System\vmYdwak.exe
  C:\Windows\System\vmYdwak.exe
  2⤵
  PID:2352
- C:\Windows\System\DfPABOy.exe
  C:\Windows\System\DfPABOy.exe
  2⤵
  PID:2936
- C:\Windows\System\tPQTRIw.exe
  C:\Windows\System\tPQTRIw.exe
  2⤵
  PID:1884
- C:\Windows\System\mIbaXMF.exe
  C:\Windows\System\mIbaXMF.exe
  2⤵
  PID:1896
- C:\Windows\System\gjydGad.exe
  C:\Windows\System\gjydGad.exe
  2⤵
  PID:1680
- C:\Windows\System\MmoalIe.exe
  C:\Windows\System\MmoalIe.exe
  2⤵
  PID:2836
- C:\Windows\System\qHQRrWN.exe
  C:\Windows\System\qHQRrWN.exe
  2⤵
  PID:2852
- C:\Windows\System\FRhumkb.exe
  C:\Windows\System\FRhumkb.exe
  2⤵
  PID:3068
- C:\Windows\System\ZMDuzLk.exe
  C:\Windows\System\ZMDuzLk.exe
  2⤵
  PID:3060
- C:\Windows\System\spZsrdc.exe
  C:\Windows\System\spZsrdc.exe
  2⤵
  PID:2772
- C:\Windows\System\ZDaOqmp.exe
  C:\Windows\System\ZDaOqmp.exe
  2⤵
  PID:2712
- C:\Windows\System\tjPiiUL.exe
  C:\Windows\System\tjPiiUL.exe
  2⤵
  PID:2316
- C:\Windows\System\oepMmQD.exe
  C:\Windows\System\oepMmQD.exe
  2⤵
  PID:3044
- C:\Windows\System\ziBvLXD.exe
  C:\Windows\System\ziBvLXD.exe
  2⤵
  PID:2644
- C:\Windows\System\igTkpvH.exe
  C:\Windows\System\igTkpvH.exe
  2⤵
  PID:2580
- C:\Windows\System\AGOYBQQ.exe
  C:\Windows\System\AGOYBQQ.exe
  2⤵
  PID:2664
- C:\Windows\System\KocNKOw.exe
  C:\Windows\System\KocNKOw.exe
  2⤵
  PID:2896
- C:\Windows\System\asqiUlp.exe
  C:\Windows\System\asqiUlp.exe
  2⤵
  PID:2388
- C:\Windows\System\WrHRlZi.exe
  C:\Windows\System\WrHRlZi.exe
  2⤵
  PID:2668
- C:\Windows\System\SlVmFHL.exe
  C:\Windows\System\SlVmFHL.exe
  2⤵
  PID:1096
- C:\Windows\System\XvBqPnj.exe
  C:\Windows\System\XvBqPnj.exe
  2⤵
  PID:2548
- C:\Windows\System\UFPLIDD.exe
  C:\Windows\System\UFPLIDD.exe
  2⤵
  PID:1744
- C:\Windows\System\UGwakTz.exe
  C:\Windows\System\UGwakTz.exe
  2⤵
  PID:3032
- C:\Windows\System\vRsFiSf.exe
  C:\Windows\System\vRsFiSf.exe
  2⤵
  PID:3004
- C:\Windows\System\NYXiUKq.exe
  C:\Windows\System\NYXiUKq.exe
  2⤵
  PID:1940
- C:\Windows\System\CEbkfvU.exe
  C:\Windows\System\CEbkfvU.exe
  2⤵
  PID:2276
- C:\Windows\System\npCnIPS.exe
  C:\Windows\System\npCnIPS.exe
  2⤵
  PID:2716
- C:\Windows\System\jyKyRdb.exe
  C:\Windows\System\jyKyRdb.exe
  2⤵
  PID:2820
- C:\Windows\System\fYkfJlj.exe
  C:\Windows\System\fYkfJlj.exe
  2⤵
  PID:1684
- C:\Windows\System\UWOxEee.exe
  C:\Windows\System\UWOxEee.exe
  2⤵
  PID:376
- C:\Windows\System\lcUCHEk.exe
  C:\Windows\System\lcUCHEk.exe
  2⤵
  PID:656
- C:\Windows\System\yLhpSSi.exe
  C:\Windows\System\yLhpSSi.exe
  2⤵
  PID:2132
- C:\Windows\System\FUrwRfI.exe
  C:\Windows\System\FUrwRfI.exe
  2⤵
  PID:2864
- C:\Windows\System\TVaqXnc.exe
  C:\Windows\System\TVaqXnc.exe
  2⤵
  PID:2976
- C:\Windows\System\wjipNML.exe
  C:\Windows\System\wjipNML.exe
  2⤵
  PID:2684
- C:\Windows\System\GXYusnJ.exe
  C:\Windows\System\GXYusnJ.exe
  2⤵
  PID:1936
- C:\Windows\System\SoxaRPe.exe
  C:\Windows\System\SoxaRPe.exe
  2⤵
  PID:2708
- C:\Windows\System\WkRiosw.exe
  C:\Windows\System\WkRiosw.exe
  2⤵
  PID:2176
- C:\Windows\System\SEvSNpm.exe
  C:\Windows\System\SEvSNpm.exe
  2⤵
  PID:1652
- C:\Windows\System\wVtJNkm.exe
  C:\Windows\System\wVtJNkm.exe
  2⤵
  PID:2324
- C:\Windows\System\YQeVROc.exe
  C:\Windows\System\YQeVROc.exe
  2⤵
  PID:2308
- C:\Windows\System\UEsNzck.exe
  C:\Windows\System\UEsNzck.exe
  2⤵
  PID:1064
- C:\Windows\System\fgctzwL.exe
  C:\Windows\System\fgctzwL.exe
  2⤵
  PID:2924
- C:\Windows\System\KdJQugQ.exe
  C:\Windows\System\KdJQugQ.exe
  2⤵
  PID:1796
- C:\Windows\System\DAOODTR.exe
  C:\Windows\System\DAOODTR.exe
  2⤵
  PID:2364
- C:\Windows\System\alCwWFQ.exe
  C:\Windows\System\alCwWFQ.exe
  2⤵
  PID:1604
- C:\Windows\System\hlDeQQy.exe
  C:\Windows\System\hlDeQQy.exe
  2⤵
  PID:1992
- C:\Windows\System\GiiUkFe.exe
  C:\Windows\System\GiiUkFe.exe
  2⤵
  PID:2368
- C:\Windows\System\iZVAcFq.exe
  C:\Windows\System\iZVAcFq.exe
  2⤵
  PID:2636
- C:\Windows\System\fLHbSot.exe
  C:\Windows\System\fLHbSot.exe
  2⤵
  PID:1852
- C:\Windows\System\dSmZHKO.exe
  C:\Windows\System\dSmZHKO.exe
  2⤵
  PID:2972
- C:\Windows\System\VTKlqXI.exe
  C:\Windows\System\VTKlqXI.exe
  2⤵
  PID:2932
- C:\Windows\System\PRmNbij.exe
  C:\Windows\System\PRmNbij.exe
  2⤵
  PID:2412
- C:\Windows\System\tTqvXoC.exe
  C:\Windows\System\tTqvXoC.exe
  2⤵
  PID:1072
- C:\Windows\System\XhdWXWr.exe
  C:\Windows\System\XhdWXWr.exe
  2⤵
  PID:1180
- C:\Windows\System\tzwdrWH.exe
  C:\Windows\System\tzwdrWH.exe
  2⤵
  PID:844
- C:\Windows\System\QiAXkwo.exe
  C:\Windows\System\QiAXkwo.exe
  2⤵
  PID:1444
- C:\Windows\System\EicXfaK.exe
  C:\Windows\System\EicXfaK.exe
  2⤵
  PID:264
- C:\Windows\System\iLNNfLQ.exe
  C:\Windows\System\iLNNfLQ.exe
  2⤵
  PID:2804
- C:\Windows\System\GTwAxLM.exe
  C:\Windows\System\GTwAxLM.exe
  2⤵
  PID:1800
- C:\Windows\System\TSugJZS.exe
  C:\Windows\System\TSugJZS.exe
  2⤵
  PID:1716
- C:\Windows\System\lFWjjiY.exe
  C:\Windows\System\lFWjjiY.exe
  2⤵
  PID:2400
- C:\Windows\System\NyHlaIr.exe
  C:\Windows\System\NyHlaIr.exe
  2⤵
  PID:1476
- C:\Windows\System\RhHxkuS.exe
  C:\Windows\System\RhHxkuS.exe
  2⤵
  PID:1608
- C:\Windows\System\FuZECUd.exe
  C:\Windows\System\FuZECUd.exe
  2⤵
  PID:3088
- C:\Windows\System\FhpiRFS.exe
  C:\Windows\System\FhpiRFS.exe
  2⤵
  PID:3108
- C:\Windows\System\GUsFltT.exe
  C:\Windows\System\GUsFltT.exe
  2⤵
  PID:3132
- C:\Windows\System\yKdGItO.exe
  C:\Windows\System\yKdGItO.exe
  2⤵
  PID:3148
- C:\Windows\System\OLaNihr.exe
  C:\Windows\System\OLaNihr.exe
  2⤵
  PID:3168
- C:\Windows\System\ejWqyGa.exe
  C:\Windows\System\ejWqyGa.exe
  2⤵
  PID:3188
- C:\Windows\System\LBxndCc.exe
  C:\Windows\System\LBxndCc.exe
  2⤵
  PID:3212
- C:\Windows\System\VZYZqqF.exe
  C:\Windows\System\VZYZqqF.exe
  2⤵
  PID:3232
- C:\Windows\System\LOmRMdm.exe
  C:\Windows\System\LOmRMdm.exe
  2⤵
  PID:3252
- C:\Windows\System\drtyAFa.exe
  C:\Windows\System\drtyAFa.exe
  2⤵
  PID:3268
- C:\Windows\System\AGeBmRV.exe
  C:\Windows\System\AGeBmRV.exe
  2⤵
  PID:3288
- C:\Windows\System\dFaldyN.exe
  C:\Windows\System\dFaldyN.exe
  2⤵
  PID:3308
- C:\Windows\System\RALzwjL.exe
  C:\Windows\System\RALzwjL.exe
  2⤵
  PID:3332
- C:\Windows\System\VkXPCHz.exe
  C:\Windows\System\VkXPCHz.exe
  2⤵
  PID:3352
- C:\Windows\System\kIVWBSL.exe
  C:\Windows\System\kIVWBSL.exe
  2⤵
  PID:3372
- C:\Windows\System\YxUPjXO.exe
  C:\Windows\System\YxUPjXO.exe
  2⤵
  PID:3388
- C:\Windows\System\bRndoEW.exe
  C:\Windows\System\bRndoEW.exe
  2⤵
  PID:3408
- C:\Windows\System\oWCYVvL.exe
  C:\Windows\System\oWCYVvL.exe
  2⤵
  PID:3428
- C:\Windows\System\BJaZfic.exe
  C:\Windows\System\BJaZfic.exe
  2⤵
  PID:3448
- C:\Windows\System\UXqSsmo.exe
  C:\Windows\System\UXqSsmo.exe
  2⤵
  PID:3468
- C:\Windows\System\nVVpDjR.exe
  C:\Windows\System\nVVpDjR.exe
  2⤵
  PID:3488
- C:\Windows\System\ebJlAxg.exe
  C:\Windows\System\ebJlAxg.exe
  2⤵
  PID:3508
- C:\Windows\System\hWXOSUU.exe
  C:\Windows\System\hWXOSUU.exe
  2⤵
  PID:3532
- C:\Windows\System\fMcEXrc.exe
  C:\Windows\System\fMcEXrc.exe
  2⤵
  PID:3548
- C:\Windows\System\kIssGEa.exe
  C:\Windows\System\kIssGEa.exe
  2⤵
  PID:3572
- C:\Windows\System\weFjCyN.exe
  C:\Windows\System\weFjCyN.exe
  2⤵
  PID:3588
- C:\Windows\System\okRzyiE.exe
  C:\Windows\System\okRzyiE.exe
  2⤵
  PID:3612
- C:\Windows\System\UufaBxP.exe
  C:\Windows\System\UufaBxP.exe
  2⤵
  PID:3628
- C:\Windows\System\kFruQxg.exe
  C:\Windows\System\kFruQxg.exe
  2⤵
  PID:3648
- C:\Windows\System\PvFvwja.exe
  C:\Windows\System\PvFvwja.exe
  2⤵
  PID:3668
- C:\Windows\System\yJXxAni.exe
  C:\Windows\System\yJXxAni.exe
  2⤵
  PID:3688
- C:\Windows\System\KMkOBOp.exe
  C:\Windows\System\KMkOBOp.exe
  2⤵
  PID:3708
- C:\Windows\System\rhkseSt.exe
  C:\Windows\System\rhkseSt.exe
  2⤵
  PID:3732
- C:\Windows\System\bholTVG.exe
  C:\Windows\System\bholTVG.exe
  2⤵
  PID:3748
- C:\Windows\System\UtOVkHL.exe
  C:\Windows\System\UtOVkHL.exe
  2⤵
  PID:3764
- C:\Windows\System\EBCLLOX.exe
  C:\Windows\System\EBCLLOX.exe
  2⤵
  PID:3780
- C:\Windows\System\UPzGeqf.exe
  C:\Windows\System\UPzGeqf.exe
  2⤵
  PID:3796
- C:\Windows\System\lOmXfXF.exe
  C:\Windows\System\lOmXfXF.exe
  2⤵
  PID:3816
- C:\Windows\System\KUuePoA.exe
  C:\Windows\System\KUuePoA.exe
  2⤵
  PID:3848
- C:\Windows\System\aZJuVIL.exe
  C:\Windows\System\aZJuVIL.exe
  2⤵
  PID:3864
- C:\Windows\System\JhPTabp.exe
  C:\Windows\System\JhPTabp.exe
  2⤵
  PID:3880
- C:\Windows\System\BZKelYK.exe
  C:\Windows\System\BZKelYK.exe
  2⤵
  PID:3896
- C:\Windows\System\LJPzsrX.exe
  C:\Windows\System\LJPzsrX.exe
  2⤵
  PID:3912
- C:\Windows\System\WJalJqx.exe
  C:\Windows\System\WJalJqx.exe
  2⤵
  PID:3936
- C:\Windows\System\WbQbhbq.exe
  C:\Windows\System\WbQbhbq.exe
  2⤵
  PID:3952
- C:\Windows\System\jdxjFsc.exe
  C:\Windows\System\jdxjFsc.exe
  2⤵
  PID:3968
- C:\Windows\System\ceBgLsb.exe
  C:\Windows\System\ceBgLsb.exe
  2⤵
  PID:3984
- C:\Windows\System\mHnJgbX.exe
  C:\Windows\System\mHnJgbX.exe
  2⤵
  PID:4000
- C:\Windows\System\pOXttfV.exe
  C:\Windows\System\pOXttfV.exe
  2⤵
  PID:4024
- C:\Windows\System\jGPGyoB.exe
  C:\Windows\System\jGPGyoB.exe
  2⤵
  PID:4040
- C:\Windows\System\jSZDhNV.exe
  C:\Windows\System\jSZDhNV.exe
  2⤵
  PID:4060
- C:\Windows\System\wVThLzp.exe
  C:\Windows\System\wVThLzp.exe
  2⤵
  PID:4076
- C:\Windows\System\IiFEYed.exe
  C:\Windows\System\IiFEYed.exe
  2⤵
  PID:2796
- C:\Windows\System\sqPpayR.exe
  C:\Windows\System\sqPpayR.exe
  2⤵
  PID:3096
- C:\Windows\System\YbZIqBf.exe
  C:\Windows\System\YbZIqBf.exe
  2⤵
  PID:3128
- C:\Windows\System\bDFtjkN.exe
  C:\Windows\System\bDFtjkN.exe
  2⤵
  PID:3164
- C:\Windows\System\mJnvDJT.exe
  C:\Windows\System\mJnvDJT.exe
  2⤵
  PID:3196
- C:\Windows\System\mUJUMZX.exe
  C:\Windows\System\mUJUMZX.exe
  2⤵
  PID:3228
- C:\Windows\System\vETdaOC.exe
  C:\Windows\System\vETdaOC.exe
  2⤵
  PID:3244
- C:\Windows\System\qWzfeBX.exe
  C:\Windows\System\qWzfeBX.exe
  2⤵
  PID:3280
- C:\Windows\System\XsKcEQZ.exe
  C:\Windows\System\XsKcEQZ.exe
  2⤵
  PID:3316
- C:\Windows\System\ugfDHGe.exe
  C:\Windows\System\ugfDHGe.exe
  2⤵
  PID:3420
- C:\Windows\System\HUehlgy.exe
  C:\Windows\System\HUehlgy.exe
  2⤵
  PID:3528
- C:\Windows\System\llQlsqo.exe
  C:\Windows\System\llQlsqo.exe
  2⤵
  PID:3556
- C:\Windows\System\ZzPsNAL.exe
  C:\Windows\System\ZzPsNAL.exe
  2⤵
  PID:3604
- C:\Windows\System\HqMLgJi.exe
  C:\Windows\System\HqMLgJi.exe
  2⤵
  PID:3620
- C:\Windows\System\sbhrPDB.exe
  C:\Windows\System\sbhrPDB.exe
  2⤵
  PID:3640
- C:\Windows\System\NczUFVA.exe
  C:\Windows\System\NczUFVA.exe
  2⤵
  PID:3684
- C:\Windows\System\oUMBtgE.exe
  C:\Windows\System\oUMBtgE.exe
  2⤵
  PID:3700
- C:\Windows\System\DlGjviM.exe
  C:\Windows\System\DlGjviM.exe
  2⤵
  PID:3740
- C:\Windows\System\uLltrsQ.exe
  C:\Windows\System\uLltrsQ.exe
  2⤵
  PID:3788
- C:\Windows\System\hfAfhxj.exe
  C:\Windows\System\hfAfhxj.exe
  2⤵
  PID:3824
- C:\Windows\System\HlAWlox.exe
  C:\Windows\System\HlAWlox.exe
  2⤵
  PID:3804
- C:\Windows\System\GjyWYdH.exe
  C:\Windows\System\GjyWYdH.exe
  2⤵
  PID:3876
- C:\Windows\System\MqMQRBU.exe
  C:\Windows\System\MqMQRBU.exe
  2⤵
  PID:3948
- C:\Windows\System\IckQADg.exe
  C:\Windows\System\IckQADg.exe
  2⤵
  PID:4008
- C:\Windows\System\jIyZxpe.exe
  C:\Windows\System\jIyZxpe.exe
  2⤵
  PID:4012
- C:\Windows\System\NLsYtFW.exe
  C:\Windows\System\NLsYtFW.exe
  2⤵
  PID:4088
- C:\Windows\System\oVTJKgl.exe
  C:\Windows\System\oVTJKgl.exe
  2⤵
  PID:3176
- C:\Windows\System\lafoRCf.exe
  C:\Windows\System\lafoRCf.exe
  2⤵
  PID:3200
- C:\Windows\System\TWuijgO.exe
  C:\Windows\System\TWuijgO.exe
  2⤵
  PID:3892
- C:\Windows\System\TmvpUIZ.exe
  C:\Windows\System\TmvpUIZ.exe
  2⤵
  PID:3996
- C:\Windows\System\hKXtEES.exe
  C:\Windows\System\hKXtEES.exe
  2⤵
  PID:3140
- C:\Windows\System\VgDGLYy.exe
  C:\Windows\System\VgDGLYy.exe
  2⤵
  PID:3284
- C:\Windows\System\VNfEqDz.exe
  C:\Windows\System\VNfEqDz.exe
  2⤵
  PID:3440
- C:\Windows\System\iGfoqQg.exe
  C:\Windows\System\iGfoqQg.exe
  2⤵
  PID:3480
- C:\Windows\System\BqxzCir.exe
  C:\Windows\System\BqxzCir.exe
  2⤵
  PID:3496
- C:\Windows\System\rVamzXQ.exe
  C:\Windows\System\rVamzXQ.exe
  2⤵
  PID:3568
- C:\Windows\System\VlZKdQc.exe
  C:\Windows\System\VlZKdQc.exe
  2⤵
  PID:3644
- C:\Windows\System\OPQUYtd.exe
  C:\Windows\System\OPQUYtd.exe
  2⤵
  PID:3840
- C:\Windows\System\FkNzDEC.exe
  C:\Windows\System\FkNzDEC.exe
  2⤵
  PID:3540
- C:\Windows\System\seMAGCl.exe
  C:\Windows\System\seMAGCl.exe
  2⤵
  PID:3124
- C:\Windows\System\aUwgtNC.exe
  C:\Windows\System\aUwgtNC.exe
  2⤵
  PID:3856
- C:\Windows\System\TPQfQeq.exe
  C:\Windows\System\TPQfQeq.exe
  2⤵
  PID:3920
- C:\Windows\System\KCGFlAG.exe
  C:\Windows\System\KCGFlAG.exe
  2⤵
  PID:3664
- C:\Windows\System\unzyuWX.exe
  C:\Windows\System\unzyuWX.exe
  2⤵
  PID:3296
- C:\Windows\System\ZpigzcU.exe
  C:\Windows\System\ZpigzcU.exe
  2⤵
  PID:3084
- C:\Windows\System\nuJYNCb.exe
  C:\Windows\System\nuJYNCb.exe
  2⤵
  PID:3436
- C:\Windows\System\sRcQyvn.exe
  C:\Windows\System\sRcQyvn.exe
  2⤵
  PID:3872
- C:\Windows\System\sIwZCaK.exe
  C:\Windows\System\sIwZCaK.exe
  2⤵
  PID:3908
- C:\Windows\System\PDQSjKI.exe
  C:\Windows\System\PDQSjKI.exe
  2⤵
  PID:3776
- C:\Windows\System\LwydXLc.exe
  C:\Windows\System\LwydXLc.exe
  2⤵
  PID:3728
- C:\Windows\System\NAIIhZr.exe
  C:\Windows\System\NAIIhZr.exe
  2⤵
  PID:3504
- C:\Windows\System\FQySLRD.exe
  C:\Windows\System\FQySLRD.exe
  2⤵
  PID:4068
- C:\Windows\System\FmrSMhX.exe
  C:\Windows\System\FmrSMhX.exe
  2⤵
  PID:4112
- C:\Windows\System\SQiiyUD.exe
  C:\Windows\System\SQiiyUD.exe
  2⤵
  PID:4136
- C:\Windows\System\TgYioPB.exe
  C:\Windows\System\TgYioPB.exe
  2⤵
  PID:4156
- C:\Windows\System\UBGOVWv.exe
  C:\Windows\System\UBGOVWv.exe
  2⤵
  PID:4176
- C:\Windows\System\GTReVMD.exe
  C:\Windows\System\GTReVMD.exe
  2⤵
  PID:4192
- C:\Windows\System\SqrGUWN.exe
  C:\Windows\System\SqrGUWN.exe
  2⤵
  PID:4216
- C:\Windows\System\VyqcCPG.exe
  C:\Windows\System\VyqcCPG.exe
  2⤵
  PID:4236
- C:\Windows\System\EbFyzOk.exe
  C:\Windows\System\EbFyzOk.exe
  2⤵
  PID:4252
- C:\Windows\System\iQWOqcJ.exe
  C:\Windows\System\iQWOqcJ.exe
  2⤵
  PID:4272
- C:\Windows\System\IfpUBnc.exe
  C:\Windows\System\IfpUBnc.exe
  2⤵
  PID:4288
- C:\Windows\System\NbWfJFp.exe
  C:\Windows\System\NbWfJFp.exe
  2⤵
  PID:4304
- C:\Windows\System\uqgalxY.exe
  C:\Windows\System\uqgalxY.exe
  2⤵
  PID:4328
- C:\Windows\System\CZWXEOP.exe
  C:\Windows\System\CZWXEOP.exe
  2⤵
  PID:4344
- C:\Windows\System\lgxoGip.exe
  C:\Windows\System\lgxoGip.exe
  2⤵
  PID:4364
- C:\Windows\System\jhSkubB.exe
  C:\Windows\System\jhSkubB.exe
  2⤵
  PID:4392
- C:\Windows\System\XtkhSPr.exe
  C:\Windows\System\XtkhSPr.exe
  2⤵
  PID:4436
- C:\Windows\System\qoaIalg.exe
  C:\Windows\System\qoaIalg.exe
  2⤵
  PID:4472
- C:\Windows\System\tEbhqVf.exe
  C:\Windows\System\tEbhqVf.exe
  2⤵
  PID:4488
- C:\Windows\System\EMuAEZs.exe
  C:\Windows\System\EMuAEZs.exe
  2⤵
  PID:4520
- C:\Windows\System\ewBDrao.exe
  C:\Windows\System\ewBDrao.exe
  2⤵
  PID:4544
- C:\Windows\System\jMcQcCx.exe
  C:\Windows\System\jMcQcCx.exe
  2⤵
  PID:4564
- C:\Windows\System\uuHxXMm.exe
  C:\Windows\System\uuHxXMm.exe
  2⤵
  PID:4580
- C:\Windows\System\EZhKkuy.exe
  C:\Windows\System\EZhKkuy.exe
  2⤵
  PID:4596
- C:\Windows\System\FvuprJG.exe
  C:\Windows\System\FvuprJG.exe
  2⤵
  PID:4624
- C:\Windows\System\ofkNsee.exe
  C:\Windows\System\ofkNsee.exe
  2⤵
  PID:4640
- C:\Windows\System\ixhXdkF.exe
  C:\Windows\System\ixhXdkF.exe
  2⤵
  PID:4656
- C:\Windows\System\rJQvsAC.exe
  C:\Windows\System\rJQvsAC.exe
  2⤵
  PID:4672
- C:\Windows\System\PHJeXbN.exe
  C:\Windows\System\PHJeXbN.exe
  2⤵
  PID:4696
- C:\Windows\System\fkTALfd.exe
  C:\Windows\System\fkTALfd.exe
  2⤵
  PID:4712
- C:\Windows\System\qSXiRMo.exe
  C:\Windows\System\qSXiRMo.exe
  2⤵
  PID:4732
- C:\Windows\System\MxRpGwa.exe
  C:\Windows\System\MxRpGwa.exe
  2⤵
  PID:4748
- C:\Windows\System\TmCNbjx.exe
  C:\Windows\System\TmCNbjx.exe
  2⤵
  PID:4772
- C:\Windows\System\PzPXwGq.exe
  C:\Windows\System\PzPXwGq.exe
  2⤵
  PID:4792
- C:\Windows\System\ztsOyWk.exe
  C:\Windows\System\ztsOyWk.exe
  2⤵
  PID:4808
- C:\Windows\System\NsUFWRT.exe
  C:\Windows\System\NsUFWRT.exe
  2⤵
  PID:4832
- C:\Windows\System\uuTIMad.exe
  C:\Windows\System\uuTIMad.exe
  2⤵
  PID:4852
- C:\Windows\System\NtnKMvV.exe
  C:\Windows\System\NtnKMvV.exe
  2⤵
  PID:4884
- C:\Windows\System\ousuEqC.exe
  C:\Windows\System\ousuEqC.exe
  2⤵
  PID:4904
- C:\Windows\System\PhIlorB.exe
  C:\Windows\System\PhIlorB.exe
  2⤵
  PID:4920
- C:\Windows\System\qEkoZtk.exe
  C:\Windows\System\qEkoZtk.exe
  2⤵
  PID:4936
- C:\Windows\System\lMURfRr.exe
  C:\Windows\System\lMURfRr.exe
  2⤵
  PID:4952
- C:\Windows\System\KMlgCNq.exe
  C:\Windows\System\KMlgCNq.exe
  2⤵
  PID:4972
- C:\Windows\System\yBFHcVr.exe
  C:\Windows\System\yBFHcVr.exe
  2⤵
  PID:4992
- C:\Windows\System\IqLMbzN.exe
  C:\Windows\System\IqLMbzN.exe
  2⤵
  PID:5008
- C:\Windows\System\zMnhTvB.exe
  C:\Windows\System\zMnhTvB.exe
  2⤵
  PID:5024
- C:\Windows\System\lNccoCB.exe
  C:\Windows\System\lNccoCB.exe
  2⤵
  PID:5040
- C:\Windows\System\IGvyyPc.exe
  C:\Windows\System\IGvyyPc.exe
  2⤵
  PID:5064
- C:\Windows\System\lwRnZMP.exe
  C:\Windows\System\lwRnZMP.exe
  2⤵
  PID:5080
- C:\Windows\System\FSBOovE.exe
  C:\Windows\System\FSBOovE.exe
  2⤵
  PID:5096
- C:\Windows\System\hGddokB.exe
  C:\Windows\System\hGddokB.exe
  2⤵
  PID:5112
- C:\Windows\System\DnbluDY.exe
  C:\Windows\System\DnbluDY.exe
  2⤵
  PID:4100
- C:\Windows\System\zncTohI.exe
  C:\Windows\System\zncTohI.exe
  2⤵
  PID:4148
- C:\Windows\System\tRbwpyb.exe
  C:\Windows\System\tRbwpyb.exe
  2⤵
  PID:3304
- C:\Windows\System\XwmLxnl.exe
  C:\Windows\System\XwmLxnl.exe
  2⤵
  PID:3184
- C:\Windows\System\dQEnjvj.exe
  C:\Windows\System\dQEnjvj.exe
  2⤵
  PID:4188
- C:\Windows\System\XUxSudB.exe
  C:\Windows\System\XUxSudB.exe
  2⤵
  PID:3928
- C:\Windows\System\pWriJfZ.exe
  C:\Windows\System\pWriJfZ.exe
  2⤵
  PID:3276
- C:\Windows\System\ASvZurw.exe
  C:\Windows\System\ASvZurw.exe
  2⤵
  PID:4268
- C:\Windows\System\pbneeLe.exe
  C:\Windows\System\pbneeLe.exe
  2⤵
  PID:4372
- C:\Windows\System\DSOUblb.exe
  C:\Windows\System\DSOUblb.exe
  2⤵
  PID:4388
- C:\Windows\System\OWekCJN.exe
  C:\Windows\System\OWekCJN.exe
  2⤵
  PID:3704
- C:\Windows\System\UxfkLqA.exe
  C:\Windows\System\UxfkLqA.exe
  2⤵
  PID:3116
- C:\Windows\System\WJSawgk.exe
  C:\Windows\System\WJSawgk.exe
  2⤵
  PID:3636
- C:\Windows\System\NtpBoxG.exe
  C:\Windows\System\NtpBoxG.exe
  2⤵
  PID:4032
- C:\Windows\System\UGHuDaH.exe
  C:\Windows\System\UGHuDaH.exe
  2⤵
  PID:4132
- C:\Windows\System\NKYqaxE.exe
  C:\Windows\System\NKYqaxE.exe
  2⤵
  PID:4444
- C:\Windows\System\UdHPnzI.exe
  C:\Windows\System\UdHPnzI.exe
  2⤵
  PID:4460
- C:\Windows\System\pquRCDT.exe
  C:\Windows\System\pquRCDT.exe
  2⤵
  PID:4500
- C:\Windows\System\HqLdfEg.exe
  C:\Windows\System\HqLdfEg.exe
  2⤵
  PID:4516
- C:\Windows\System\ZzGrkJQ.exe
  C:\Windows\System\ZzGrkJQ.exe
  2⤵
  PID:4428
- C:\Windows\System\NykFqAW.exe
  C:\Windows\System\NykFqAW.exe
  2⤵
  PID:4212
- C:\Windows\System\xFpyAtx.exe
  C:\Windows\System\xFpyAtx.exe
  2⤵
  PID:4284
- C:\Windows\System\JBktcvv.exe
  C:\Windows\System\JBktcvv.exe
  2⤵
  PID:4352
- C:\Windows\System\xOICWvz.exe
  C:\Windows\System\xOICWvz.exe
  2⤵
  PID:4588
- C:\Windows\System\QDNbEpo.exe
  C:\Windows\System\QDNbEpo.exe
  2⤵
  PID:4532
- C:\Windows\System\PwFQbBA.exe
  C:\Windows\System\PwFQbBA.exe
  2⤵
  PID:4636
- C:\Windows\System\AelkniB.exe
  C:\Windows\System\AelkniB.exe
  2⤵
  PID:4612
- C:\Windows\System\mHeJedT.exe
  C:\Windows\System\mHeJedT.exe
  2⤵
  PID:4616
- C:\Windows\System\FDqVmCA.exe
  C:\Windows\System\FDqVmCA.exe
  2⤵
  PID:4684
- C:\Windows\System\uOcskKU.exe
  C:\Windows\System\uOcskKU.exe
  2⤵
  PID:4620
- C:\Windows\System\NaorRqW.exe
  C:\Windows\System\NaorRqW.exe
  2⤵
  PID:4724
- C:\Windows\System\wmfhQIX.exe
  C:\Windows\System\wmfhQIX.exe
  2⤵
  PID:4760
- C:\Windows\System\uibCoot.exe
  C:\Windows\System\uibCoot.exe
  2⤵
  PID:4804
- C:\Windows\System\XfLYVkS.exe
  C:\Windows\System\XfLYVkS.exe
  2⤵
  PID:4828
- C:\Windows\System\gXAioln.exe
  C:\Windows\System\gXAioln.exe
  2⤵
  PID:4876
- C:\Windows\System\diAwocb.exe
  C:\Windows\System\diAwocb.exe
  2⤵
  PID:4944
- C:\Windows\System\MCbopWA.exe
  C:\Windows\System\MCbopWA.exe
  2⤵
  PID:5016
- C:\Windows\System\CXXkMlQ.exe
  C:\Windows\System\CXXkMlQ.exe
  2⤵
  PID:5020
- C:\Windows\System\NYZTYqA.exe
  C:\Windows\System\NYZTYqA.exe
  2⤵
  PID:5052
- C:\Windows\System\WqgitgQ.exe
  C:\Windows\System\WqgitgQ.exe
  2⤵
  PID:3828
- C:\Windows\System\SosHUyL.exe
  C:\Windows\System\SosHUyL.exe
  2⤵
  PID:3220
- C:\Windows\System\Limeqbm.exe
  C:\Windows\System\Limeqbm.exe
  2⤵
  PID:4892
- C:\Windows\System\vywajuh.exe
  C:\Windows\System\vywajuh.exe
  2⤵
  PID:4968
- C:\Windows\System\EcuuTsN.exe
  C:\Windows\System\EcuuTsN.exe
  2⤵
  PID:5108
- C:\Windows\System\lzJCZCW.exe
  C:\Windows\System\lzJCZCW.exe
  2⤵
  PID:4056
- C:\Windows\System\YAiBHaC.exe
  C:\Windows\System\YAiBHaC.exe
  2⤵
  PID:3564
- C:\Windows\System\xCBCGml.exe
  C:\Windows\System\xCBCGml.exe
  2⤵
  PID:4380
- C:\Windows\System\yeodrOR.exe
  C:\Windows\System\yeodrOR.exe
  2⤵
  PID:5032
- C:\Windows\System\eUVqDlt.exe
  C:\Windows\System\eUVqDlt.exe
  2⤵
  PID:3080
- C:\Windows\System\yVBaFrQ.exe
  C:\Windows\System\yVBaFrQ.exe
  2⤵
  PID:3980
- C:\Windows\System\URmiKic.exe
  C:\Windows\System\URmiKic.exe
  2⤵
  PID:4124
- C:\Windows\System\NxoBdcP.exe
  C:\Windows\System\NxoBdcP.exe
  2⤵
  PID:3600
- C:\Windows\System\UWBjmhe.exe
  C:\Windows\System\UWBjmhe.exe
  2⤵
  PID:4468
- C:\Windows\System\VBfkMsc.exe
  C:\Windows\System\VBfkMsc.exe
  2⤵
  PID:4208
- C:\Windows\System\mNFszBd.exe
  C:\Windows\System\mNFszBd.exe
  2⤵
  PID:4412
- C:\Windows\System\ZJxbvXb.exe
  C:\Windows\System\ZJxbvXb.exe
  2⤵
  PID:4484
- C:\Windows\System\PiUMKrs.exe
  C:\Windows\System\PiUMKrs.exe
  2⤵
  PID:4404
- C:\Windows\System\eQwHQMK.exe
  C:\Windows\System\eQwHQMK.exe
  2⤵
  PID:4632
- C:\Windows\System\SgIOzcj.exe
  C:\Windows\System\SgIOzcj.exe
  2⤵
  PID:4784
- C:\Windows\System\XUBgahz.exe
  C:\Windows\System\XUBgahz.exe
  2⤵
  PID:4768
- C:\Windows\System\uOxpqWW.exe
  C:\Windows\System\uOxpqWW.exe
  2⤵
  PID:4872
- C:\Windows\System\TuXXmZS.exe
  C:\Windows\System\TuXXmZS.exe
  2⤵
  PID:5056
- C:\Windows\System\QiNfpfZ.exe
  C:\Windows\System\QiNfpfZ.exe
  2⤵
  PID:4820
- C:\Windows\System\VPQEubo.exe
  C:\Windows\System\VPQEubo.exe
  2⤵
  PID:3208
- C:\Windows\System\ioHHDSl.exe
  C:\Windows\System\ioHHDSl.exe
  2⤵
  PID:4740
- C:\Windows\System\kzUnCnd.exe
  C:\Windows\System\kzUnCnd.exe
  2⤵
  PID:4144
- C:\Windows\System\IpTwkSf.exe
  C:\Windows\System\IpTwkSf.exe
  2⤵
  PID:4916
- C:\Windows\System\tSgYeux.exe
  C:\Windows\System\tSgYeux.exe
  2⤵
  PID:4932
- C:\Windows\System\qReydwN.exe
  C:\Windows\System\qReydwN.exe
  2⤵
  PID:3608
- C:\Windows\System\sMMoYhi.exe
  C:\Windows\System\sMMoYhi.exe
  2⤵
  PID:4300
- C:\Windows\System\HaDlvwr.exe
  C:\Windows\System\HaDlvwr.exe
  2⤵
  PID:4424
- C:\Windows\System\eoGqtxF.exe
  C:\Windows\System\eoGqtxF.exe
  2⤵
  PID:4608
- C:\Windows\System\SMZLZTF.exe
  C:\Windows\System\SMZLZTF.exe
  2⤵
  PID:4228
- C:\Windows\System\xhXwMuO.exe
  C:\Windows\System\xhXwMuO.exe
  2⤵
  PID:4552
- C:\Windows\System\OThCMQh.exe
  C:\Windows\System\OThCMQh.exe
  2⤵
  PID:4260
- C:\Windows\System\nvqIHoe.exe
  C:\Windows\System\nvqIHoe.exe
  2⤵
  PID:3744
- C:\Windows\System\WhgWkWD.exe
  C:\Windows\System\WhgWkWD.exe
  2⤵
  PID:3464
- C:\Windows\System\lQNzcal.exe
  C:\Windows\System\lQNzcal.exe
  2⤵
  PID:4824
- C:\Windows\System\RnTTiVQ.exe
  C:\Windows\System\RnTTiVQ.exe
  2⤵
  PID:4420
- C:\Windows\System\DpfAZtw.exe
  C:\Windows\System\DpfAZtw.exe
  2⤵
  PID:5004
- C:\Windows\System\edPvpTW.exe
  C:\Windows\System\edPvpTW.exe
  2⤵
  PID:5060
- C:\Windows\System\BmKarHA.exe
  C:\Windows\System\BmKarHA.exe
  2⤵
  PID:5092
- C:\Windows\System\YXKPlBZ.exe
  C:\Windows\System\YXKPlBZ.exe
  2⤵
  PID:4248
- C:\Windows\System\ttYYpnk.exe
  C:\Windows\System\ttYYpnk.exe
  2⤵
  PID:4400
- C:\Windows\System\UDcDnnQ.exe
  C:\Windows\System\UDcDnnQ.exe
  2⤵
  PID:4720
- C:\Windows\System\YRCpYAF.exe
  C:\Windows\System\YRCpYAF.exe
  2⤵
  PID:4692
- C:\Windows\System\wfNNTsu.exe
  C:\Windows\System\wfNNTsu.exe
  2⤵
  PID:4868
- C:\Windows\System\zklGaiO.exe
  C:\Windows\System\zklGaiO.exe
  2⤵
  PID:4928
- C:\Windows\System\bVOWaVL.exe
  C:\Windows\System\bVOWaVL.exe
  2⤵
  PID:4964
- C:\Windows\System\eaBcmEy.exe
  C:\Windows\System\eaBcmEy.exe
  2⤵
  PID:4512
- C:\Windows\System\jetIUHy.exe
  C:\Windows\System\jetIUHy.exe
  2⤵
  PID:4232
- C:\Windows\System\BmCuvmO.exe
  C:\Windows\System\BmCuvmO.exe
  2⤵
  PID:5144
- C:\Windows\System\qCFPzMZ.exe
  C:\Windows\System\qCFPzMZ.exe
  2⤵
  PID:5164
- C:\Windows\System\TMyNwcF.exe
  C:\Windows\System\TMyNwcF.exe
  2⤵
  PID:5180
- C:\Windows\System\nxtCitq.exe
  C:\Windows\System\nxtCitq.exe
  2⤵
  PID:5196
- C:\Windows\System\kisFgHG.exe
  C:\Windows\System\kisFgHG.exe
  2⤵
  PID:5212
- C:\Windows\System\ViJTnnK.exe
  C:\Windows\System\ViJTnnK.exe
  2⤵
  PID:5236
- C:\Windows\System\jNNaPFm.exe
  C:\Windows\System\jNNaPFm.exe
  2⤵
  PID:5256
- C:\Windows\System\hTxPhfS.exe
  C:\Windows\System\hTxPhfS.exe
  2⤵
  PID:5276
- C:\Windows\System\zFHwaKy.exe
  C:\Windows\System\zFHwaKy.exe
  2⤵
  PID:5292
- C:\Windows\System\GMxvZdn.exe
  C:\Windows\System\GMxvZdn.exe
  2⤵
  PID:5312
- C:\Windows\System\oyhCMGN.exe
  C:\Windows\System\oyhCMGN.exe
  2⤵
  PID:5332
- C:\Windows\System\NJxyRZH.exe
  C:\Windows\System\NJxyRZH.exe
  2⤵
  PID:5348
- C:\Windows\System\mtdEwXj.exe
  C:\Windows\System\mtdEwXj.exe
  2⤵
  PID:5364
- C:\Windows\System\tmmCSQk.exe
  C:\Windows\System\tmmCSQk.exe
  2⤵
  PID:5384
- C:\Windows\System\StrvxFu.exe
  C:\Windows\System\StrvxFu.exe
  2⤵
  PID:5408
- C:\Windows\System\vKuLiaR.exe
  C:\Windows\System\vKuLiaR.exe
  2⤵
  PID:5424
- C:\Windows\System\cOOazCc.exe
  C:\Windows\System\cOOazCc.exe
  2⤵
  PID:5440
- C:\Windows\System\lqphxvc.exe
  C:\Windows\System\lqphxvc.exe
  2⤵
  PID:5460
- C:\Windows\System\XILZuJf.exe
  C:\Windows\System\XILZuJf.exe
  2⤵
  PID:5476
- C:\Windows\System\lJuZWct.exe
  C:\Windows\System\lJuZWct.exe
  2⤵
  PID:5492
- C:\Windows\System\RcanTmN.exe
  C:\Windows\System\RcanTmN.exe
  2⤵
  PID:5508
- C:\Windows\System\IvgCBZL.exe
  C:\Windows\System\IvgCBZL.exe
  2⤵
  PID:5524
- C:\Windows\System\dTOlfWs.exe
  C:\Windows\System\dTOlfWs.exe
  2⤵
  PID:5540
- C:\Windows\System\PLbCThi.exe
  C:\Windows\System\PLbCThi.exe
  2⤵
  PID:5556
- C:\Windows\System\xtwFKVX.exe
  C:\Windows\System\xtwFKVX.exe
  2⤵
  PID:5572
- C:\Windows\System\sqmNVhR.exe
  C:\Windows\System\sqmNVhR.exe
  2⤵
  PID:5588
- C:\Windows\System\PgjvKXA.exe
  C:\Windows\System\PgjvKXA.exe
  2⤵
  PID:5604
- C:\Windows\System\mjzBQzi.exe
  C:\Windows\System\mjzBQzi.exe
  2⤵
  PID:5624
- C:\Windows\System\uvfVaNT.exe
  C:\Windows\System\uvfVaNT.exe
  2⤵
  PID:5640
- C:\Windows\System\BJSJPpt.exe
  C:\Windows\System\BJSJPpt.exe
  2⤵
  PID:5660
- C:\Windows\System\iiPzhgB.exe
  C:\Windows\System\iiPzhgB.exe
  2⤵
  PID:5680
- C:\Windows\System\dvnyWoM.exe
  C:\Windows\System\dvnyWoM.exe
  2⤵
  PID:5700
- C:\Windows\System\XrWzqfM.exe
  C:\Windows\System\XrWzqfM.exe
  2⤵
  PID:5720
- C:\Windows\System\SKCdTCG.exe
  C:\Windows\System\SKCdTCG.exe
  2⤵
  PID:5736
- C:\Windows\System\ZBRSeBR.exe
  C:\Windows\System\ZBRSeBR.exe
  2⤵
  PID:5752
- C:\Windows\System\hvZVVOc.exe
  C:\Windows\System\hvZVVOc.exe
  2⤵
  PID:5772
- C:\Windows\System\VaYXgnM.exe
  C:\Windows\System\VaYXgnM.exe
  2⤵
  PID:5792
- C:\Windows\System\RnQzoKW.exe
  C:\Windows\System\RnQzoKW.exe
  2⤵
  PID:5812
- C:\Windows\System\jIHYkqw.exe
  C:\Windows\System\jIHYkqw.exe
  2⤵
  PID:5836
- C:\Windows\System\Hmpvdfz.exe
  C:\Windows\System\Hmpvdfz.exe
  2⤵
  PID:5852
- C:\Windows\System\yPSjoTb.exe
  C:\Windows\System\yPSjoTb.exe
  2⤵
  PID:5868
- C:\Windows\System\hLXmIoi.exe
  C:\Windows\System\hLXmIoi.exe
  2⤵
  PID:5884
- C:\Windows\System\OmlxSGb.exe
  C:\Windows\System\OmlxSGb.exe
  2⤵
  PID:5900
- C:\Windows\System\NzHsWkH.exe
  C:\Windows\System\NzHsWkH.exe
  2⤵
  PID:5916
- C:\Windows\System\xMfibPu.exe
  C:\Windows\System\xMfibPu.exe
  2⤵
  PID:5932
- C:\Windows\System\AybDDzY.exe
  C:\Windows\System\AybDDzY.exe
  2⤵
  PID:5948
- C:\Windows\System\RMLhVpq.exe
  C:\Windows\System\RMLhVpq.exe
  2⤵
  PID:5964
- C:\Windows\System\OmzfQcV.exe
  C:\Windows\System\OmzfQcV.exe
  2⤵
  PID:5980
- C:\Windows\System\pteVdzS.exe
  C:\Windows\System\pteVdzS.exe
  2⤵
  PID:5996
- C:\Windows\System\BxVHVRL.exe
  C:\Windows\System\BxVHVRL.exe
  2⤵
  PID:6012
- C:\Windows\System\SJkUafg.exe
  C:\Windows\System\SJkUafg.exe
  2⤵
  PID:6028
- C:\Windows\System\tkDJSuk.exe
  C:\Windows\System\tkDJSuk.exe
  2⤵
  PID:6044
- C:\Windows\System\bbzRSOM.exe
  C:\Windows\System\bbzRSOM.exe
  2⤵
  PID:6060
- C:\Windows\System\oHsDVEs.exe
  C:\Windows\System\oHsDVEs.exe
  2⤵
  PID:6076
- C:\Windows\System\DjaDJqn.exe
  C:\Windows\System\DjaDJqn.exe
  2⤵
  PID:6092
- C:\Windows\System\uKHTNaZ.exe
  C:\Windows\System\uKHTNaZ.exe
  2⤵
  PID:6116
- C:\Windows\System\BepbeXy.exe
  C:\Windows\System\BepbeXy.exe
  2⤵
  PID:6132
- C:\Windows\System\RgRqkjY.exe
  C:\Windows\System\RgRqkjY.exe
  2⤵
  PID:4572
- C:\Windows\System\LDNcbbV.exe
  C:\Windows\System\LDNcbbV.exe
  2⤵
  PID:5152
- C:\Windows\System\UhWuSLI.exe
  C:\Windows\System\UhWuSLI.exe
  2⤵
  PID:5156
- C:\Windows\System\KEUWkyg.exe
  C:\Windows\System\KEUWkyg.exe
  2⤵
  PID:4960
- C:\Windows\System\gZIImhS.exe
  C:\Windows\System\gZIImhS.exe
  2⤵
  PID:5220
- C:\Windows\System\cUsRCRG.exe
  C:\Windows\System\cUsRCRG.exe
  2⤵
  PID:5208
- C:\Windows\System\nnSwQXv.exe
  C:\Windows\System\nnSwQXv.exe
  2⤵
  PID:5264
- C:\Windows\System\qJnBdRP.exe
  C:\Windows\System\qJnBdRP.exe
  2⤵
  PID:5304
- C:\Windows\System\pkYikcU.exe
  C:\Windows\System\pkYikcU.exe
  2⤵
  PID:5372
- C:\Windows\System\wRtmzDq.exe
  C:\Windows\System\wRtmzDq.exe
  2⤵
  PID:5420
- C:\Windows\System\MIjzjDY.exe
  C:\Windows\System\MIjzjDY.exe
  2⤵
  PID:5488
- C:\Windows\System\YoPDSDF.exe
  C:\Windows\System\YoPDSDF.exe
  2⤵
  PID:5552
- C:\Windows\System\dINTRqz.exe
  C:\Windows\System\dINTRqz.exe
  2⤵
  PID:5472
- C:\Windows\System\GAuWaXk.exe
  C:\Windows\System\GAuWaXk.exe
  2⤵
  PID:5532
- C:\Windows\System\vqTUGuc.exe
  C:\Windows\System\vqTUGuc.exe
  2⤵
  PID:5600
- C:\Windows\System\rsvRQSb.exe
  C:\Windows\System\rsvRQSb.exe
  2⤵
  PID:5288
- C:\Windows\System\veOYjhg.exe
  C:\Windows\System\veOYjhg.exe
  2⤵
  PID:5356
- C:\Windows\System\mvobKuS.exe
  C:\Windows\System\mvobKuS.exe
  2⤵
  PID:5400
- C:\Windows\System\jNFHiWD.exe
  C:\Windows\System\jNFHiWD.exe
  2⤵
  PID:5620
- C:\Windows\System\ninyxLR.exe
  C:\Windows\System\ninyxLR.exe
  2⤵
  PID:5732
- C:\Windows\System\WVxIfeE.exe
  C:\Windows\System\WVxIfeE.exe
  2⤵
  PID:5800
- C:\Windows\System\nIAMMdv.exe
  C:\Windows\System\nIAMMdv.exe
  2⤵
  PID:5848
- C:\Windows\System\UUugoGp.exe
  C:\Windows\System\UUugoGp.exe
  2⤵
  PID:5636
- C:\Windows\System\AcFQqWY.exe
  C:\Windows\System\AcFQqWY.exe
  2⤵
  PID:5676
- C:\Windows\System\DwEIetz.exe
  C:\Windows\System\DwEIetz.exe
  2⤵
  PID:5708
- C:\Windows\System\yzmTEAU.exe
  C:\Windows\System\yzmTEAU.exe
  2⤵
  PID:5780
- C:\Windows\System\cAYGSkX.exe
  C:\Windows\System\cAYGSkX.exe
  2⤵
  PID:5824
- C:\Windows\System\kVWstjZ.exe
  C:\Windows\System\kVWstjZ.exe
  2⤵
  PID:5896
- C:\Windows\System\TYkFLuh.exe
  C:\Windows\System\TYkFLuh.exe
  2⤵
  PID:5956
- C:\Windows\System\rSoItTC.exe
  C:\Windows\System\rSoItTC.exe
  2⤵
  PID:6008
- C:\Windows\System\vMBcuYc.exe
  C:\Windows\System\vMBcuYc.exe
  2⤵
  PID:6072
- C:\Windows\System\kofajYY.exe
  C:\Windows\System\kofajYY.exe
  2⤵
  PID:6112
- C:\Windows\System\bHStIju.exe
  C:\Windows\System\bHStIju.exe
  2⤵
  PID:5128
- C:\Windows\System\nupYKOs.exe
  C:\Windows\System\nupYKOs.exe
  2⤵
  PID:5224
- C:\Windows\System\EtwqxsY.exe
  C:\Windows\System\EtwqxsY.exe
  2⤵
  PID:6128
- C:\Windows\System\PQPPEyb.exe
  C:\Windows\System\PQPPEyb.exe
  2⤵
  PID:5076
- C:\Windows\System\HSlpnDN.exe
  C:\Windows\System\HSlpnDN.exe
  2⤵
  PID:6056
- C:\Windows\System\ysXojuR.exe
  C:\Windows\System\ysXojuR.exe
  2⤵
  PID:6088
- C:\Windows\System\NbXRjhk.exe
  C:\Windows\System\NbXRjhk.exe
  2⤵
  PID:5484
- C:\Windows\System\GyeypDm.exe
  C:\Windows\System\GyeypDm.exe
  2⤵
  PID:5432
- C:\Windows\System\MnjrZxj.exe
  C:\Windows\System\MnjrZxj.exe
  2⤵
  PID:5328
- C:\Windows\System\ZruZUus.exe
  C:\Windows\System\ZruZUus.exe
  2⤵
  PID:5764
- C:\Windows\System\cNEwWac.exe
  C:\Windows\System\cNEwWac.exe
  2⤵
  PID:5252
- C:\Windows\System\ufSZsia.exe
  C:\Windows\System\ufSZsia.exe
  2⤵
  PID:5688
- C:\Windows\System\FVLHHxy.exe
  C:\Windows\System\FVLHHxy.exe
  2⤵
  PID:5436
- C:\Windows\System\hVGqYUo.exe
  C:\Windows\System\hVGqYUo.exe
  2⤵
  PID:5844
- C:\Windows\System\AeAaxkT.exe
  C:\Windows\System\AeAaxkT.exe
  2⤵
  PID:5672
- C:\Windows\System\FMzWHrm.exe
  C:\Windows\System\FMzWHrm.exe
  2⤵
  PID:5928
- C:\Windows\System\jxpuIhP.exe
  C:\Windows\System\jxpuIhP.exe
  2⤵
  PID:5988
- C:\Windows\System\YZrytOE.exe
  C:\Windows\System\YZrytOE.exe
  2⤵
  PID:5340
- C:\Windows\System\FsjtVyA.exe
  C:\Windows\System\FsjtVyA.exe
  2⤵
  PID:6052
- C:\Windows\System\wyKRHou.exe
  C:\Windows\System\wyKRHou.exe
  2⤵
  PID:6020
- C:\Windows\System\mPAvTru.exe
  C:\Windows\System\mPAvTru.exe
  2⤵
  PID:5188
- C:\Windows\System\MzgMPHM.exe
  C:\Windows\System\MzgMPHM.exe
  2⤵
  PID:5548
- C:\Windows\System\bUBCfXx.exe
  C:\Windows\System\bUBCfXx.exe
  2⤵
  PID:5596
- C:\Windows\System\dsNcjEv.exe
  C:\Windows\System\dsNcjEv.exe
  2⤵
  PID:5696
- C:\Windows\System\miuIWjJ.exe
  C:\Windows\System\miuIWjJ.exe
  2⤵
  PID:5976
- C:\Windows\System\rIXQvUm.exe
  C:\Windows\System\rIXQvUm.exe
  2⤵
  PID:5652
- C:\Windows\System\LlOUeWJ.exe
  C:\Windows\System\LlOUeWJ.exe
  2⤵
  PID:5284
- C:\Windows\System\ibamNiM.exe
  C:\Windows\System\ibamNiM.exe
  2⤵
  PID:5892
- C:\Windows\System\HecZXYt.exe
  C:\Windows\System\HecZXYt.exe
  2⤵
  PID:6124
- C:\Windows\System\kwhtXmE.exe
  C:\Windows\System\kwhtXmE.exe
  2⤵
  PID:6104
- C:\Windows\System\IjSbfzd.exe
  C:\Windows\System\IjSbfzd.exe
  2⤵
  PID:5912
- C:\Windows\System\PzaXcZq.exe
  C:\Windows\System\PzaXcZq.exe
  2⤵
  PID:6024
- C:\Windows\System\VAhCeTN.exe
  C:\Windows\System\VAhCeTN.exe
  2⤵
  PID:6164
- C:\Windows\System\bXWZtbl.exe
  C:\Windows\System\bXWZtbl.exe
  2⤵
  PID:6184
- C:\Windows\System\wjPxmsW.exe
  C:\Windows\System\wjPxmsW.exe
  2⤵
  PID:6200
- C:\Windows\System\JdYgKua.exe
  C:\Windows\System\JdYgKua.exe
  2⤵
  PID:6216
- C:\Windows\System\MUoGhZA.exe
  C:\Windows\System\MUoGhZA.exe
  2⤵
  PID:6240
- C:\Windows\System\EKfaWnX.exe
  C:\Windows\System\EKfaWnX.exe
  2⤵
  PID:6264
- C:\Windows\System\nHuObUb.exe
  C:\Windows\System\nHuObUb.exe
  2⤵
  PID:6292
- C:\Windows\System\qYTFnSu.exe
  C:\Windows\System\qYTFnSu.exe
  2⤵
  PID:6308
- C:\Windows\System\jfHyCyQ.exe
  C:\Windows\System\jfHyCyQ.exe
  2⤵
  PID:6328
- C:\Windows\System\ZUaCkme.exe
  C:\Windows\System\ZUaCkme.exe
  2⤵
  PID:6344
- C:\Windows\System\HccEwXH.exe
  C:\Windows\System\HccEwXH.exe
  2⤵
  PID:6360
- C:\Windows\System\dQMIQCM.exe
  C:\Windows\System\dQMIQCM.exe
  2⤵
  PID:6376
- C:\Windows\System\VUTjhyr.exe
  C:\Windows\System\VUTjhyr.exe
  2⤵
  PID:6392
- C:\Windows\System\gzfHxwb.exe
  C:\Windows\System\gzfHxwb.exe
  2⤵
  PID:6408
- C:\Windows\System\VLXgJVZ.exe
  C:\Windows\System\VLXgJVZ.exe
  2⤵
  PID:6424
- C:\Windows\System\BwWjHVJ.exe
  C:\Windows\System\BwWjHVJ.exe
  2⤵
  PID:6440
- C:\Windows\System\TsfllYX.exe
  C:\Windows\System\TsfllYX.exe
  2⤵
  PID:6456
- C:\Windows\System\htRXLWW.exe
  C:\Windows\System\htRXLWW.exe
  2⤵
  PID:6472
- C:\Windows\System\omlYYwF.exe
  C:\Windows\System\omlYYwF.exe
  2⤵
  PID:6488
- C:\Windows\System\glmOZLT.exe
  C:\Windows\System\glmOZLT.exe
  2⤵
  PID:6504
- C:\Windows\System\GjaFOEo.exe
  C:\Windows\System\GjaFOEo.exe
  2⤵
  PID:6520
- C:\Windows\System\TrAzFrV.exe
  C:\Windows\System\TrAzFrV.exe
  2⤵
  PID:6536
- C:\Windows\System\RwkDAtg.exe
  C:\Windows\System\RwkDAtg.exe
  2⤵
  PID:6552
- C:\Windows\System\NHAjTBv.exe
  C:\Windows\System\NHAjTBv.exe
  2⤵
  PID:6568
- C:\Windows\System\zHXwvWv.exe
  C:\Windows\System\zHXwvWv.exe
  2⤵
  PID:6584
- C:\Windows\System\WDTpsHY.exe
  C:\Windows\System\WDTpsHY.exe
  2⤵
  PID:6600
- C:\Windows\System\GcIwXbP.exe
  C:\Windows\System\GcIwXbP.exe
  2⤵
  PID:6616
- C:\Windows\System\NUbESXg.exe
  C:\Windows\System\NUbESXg.exe
  2⤵
  PID:6632
- C:\Windows\System\iGaLrqy.exe
  C:\Windows\System\iGaLrqy.exe
  2⤵
  PID:6652
- C:\Windows\System\LRshASy.exe
  C:\Windows\System\LRshASy.exe
  2⤵
  PID:6668
- C:\Windows\System\ECgSwXq.exe
  C:\Windows\System\ECgSwXq.exe
  2⤵
  PID:6684
- C:\Windows\System\doqxhdu.exe
  C:\Windows\System\doqxhdu.exe
  2⤵
  PID:6700
- C:\Windows\System\YUaaYrk.exe
  C:\Windows\System\YUaaYrk.exe
  2⤵
  PID:6716
- C:\Windows\System\jhwpIhz.exe
  C:\Windows\System\jhwpIhz.exe
  2⤵
  PID:6732
- C:\Windows\System\ljglHen.exe
  C:\Windows\System\ljglHen.exe
  2⤵
  PID:6748
- C:\Windows\System\IbMzBwv.exe
  C:\Windows\System\IbMzBwv.exe
  2⤵
  PID:6764
- C:\Windows\System\ulJHpBZ.exe
  C:\Windows\System\ulJHpBZ.exe
  2⤵
  PID:6780
- C:\Windows\System\vOGjOVj.exe
  C:\Windows\System\vOGjOVj.exe
  2⤵
  PID:6796
- C:\Windows\System\NipfPpI.exe
  C:\Windows\System\NipfPpI.exe
  2⤵
  PID:6812
- C:\Windows\System\DllOOdB.exe
  C:\Windows\System\DllOOdB.exe
  2⤵
  PID:6828
- C:\Windows\System\WzkWYnO.exe
  C:\Windows\System\WzkWYnO.exe
  2⤵
  PID:6844
- C:\Windows\System\ZLcuEYq.exe
  C:\Windows\System\ZLcuEYq.exe
  2⤵
  PID:6860
- C:\Windows\System\zWHMQlC.exe
  C:\Windows\System\zWHMQlC.exe
  2⤵
  PID:6876
- C:\Windows\System\vCtOuOl.exe
  C:\Windows\System\vCtOuOl.exe
  2⤵
  PID:6892
- C:\Windows\System\ZQYqJZi.exe
  C:\Windows\System\ZQYqJZi.exe
  2⤵
  PID:6908
- C:\Windows\System\uOZpPwC.exe
  C:\Windows\System\uOZpPwC.exe
  2⤵
  PID:6924
- C:\Windows\System\EANbHZT.exe
  C:\Windows\System\EANbHZT.exe
  2⤵
  PID:6940
- C:\Windows\System\PegTuUX.exe
  C:\Windows\System\PegTuUX.exe
  2⤵
  PID:6960
- C:\Windows\System\QThNstr.exe
  C:\Windows\System\QThNstr.exe
  2⤵
  PID:6980
- C:\Windows\System\MzLicmc.exe
  C:\Windows\System\MzLicmc.exe
  2⤵
  PID:6996
- C:\Windows\System\HlTcmtf.exe
  C:\Windows\System\HlTcmtf.exe
  2⤵
  PID:7016
- C:\Windows\System\AzjrDOp.exe
  C:\Windows\System\AzjrDOp.exe
  2⤵
  PID:7032
- C:\Windows\System\WKmJKXU.exe
  C:\Windows\System\WKmJKXU.exe
  2⤵
  PID:7048
- C:\Windows\System\xqYnuiT.exe
  C:\Windows\System\xqYnuiT.exe
  2⤵
  PID:7064
- C:\Windows\System\pjKJwzE.exe
  C:\Windows\System\pjKJwzE.exe
  2⤵
  PID:7084
- C:\Windows\System\MqXfaom.exe
  C:\Windows\System\MqXfaom.exe
  2⤵
  PID:7100
- C:\Windows\System\CTuTDKV.exe
  C:\Windows\System\CTuTDKV.exe
  2⤵
  PID:7120
- C:\Windows\System\xypPKJo.exe
  C:\Windows\System\xypPKJo.exe
  2⤵
  PID:7136
- C:\Windows\System\wnIxPDT.exe
  C:\Windows\System\wnIxPDT.exe
  2⤵
  PID:6152
- C:\Windows\System\nNluLDL.exe
  C:\Windows\System\nNluLDL.exe
  2⤵
  PID:5416
- C:\Windows\System\bUxLRoK.exe
  C:\Windows\System\bUxLRoK.exe
  2⤵
  PID:4604
- C:\Windows\System\bZHFygb.exe
  C:\Windows\System\bZHFygb.exe
  2⤵
  PID:5744
- C:\Windows\System\HTzKMwg.exe
  C:\Windows\System\HTzKMwg.exe
  2⤵
  PID:5204
- C:\Windows\System\PBbQnxo.exe
  C:\Windows\System\PBbQnxo.exe
  2⤵
  PID:6180
- C:\Windows\System\rdVvMcU.exe
  C:\Windows\System\rdVvMcU.exe
  2⤵
  PID:5880
- C:\Windows\System\PSsdFaI.exe
  C:\Windows\System\PSsdFaI.exe
  2⤵
  PID:6248
- C:\Windows\System\yRXUuQT.exe
  C:\Windows\System\yRXUuQT.exe
  2⤵
  PID:6272
- C:\Windows\System\dhmONGP.exe
  C:\Windows\System\dhmONGP.exe
  2⤵
  PID:6316
- C:\Windows\System\qwRCCdq.exe
  C:\Windows\System\qwRCCdq.exe
  2⤵
  PID:6384
- C:\Windows\System\vYqxTAq.exe
  C:\Windows\System\vYqxTAq.exe
  2⤵
  PID:6388
- C:\Windows\System\IBrIotj.exe
  C:\Windows\System\IBrIotj.exe
  2⤵
  PID:6420
- C:\Windows\System\FYGyGly.exe
  C:\Windows\System\FYGyGly.exe
  2⤵
  PID:6452
- C:\Windows\System\QhtXpWm.exe
  C:\Windows\System\QhtXpWm.exe
  2⤵
  PID:6512
- C:\Windows\System\TxxVgGK.exe
  C:\Windows\System\TxxVgGK.exe
  2⤵
  PID:6528
- C:\Windows\System\lbMDftA.exe
  C:\Windows\System\lbMDftA.exe
  2⤵
  PID:6560
- C:\Windows\System\HaCxomq.exe
  C:\Windows\System\HaCxomq.exe
  2⤵
  PID:5648
- C:\Windows\System\lveVktf.exe
  C:\Windows\System\lveVktf.exe
  2⤵
  PID:6648
- C:\Windows\System\YiocuXg.exe
  C:\Windows\System\YiocuXg.exe
  2⤵
  PID:6664
- C:\Windows\System\FJhzDAr.exe
  C:\Windows\System\FJhzDAr.exe
  2⤵
  PID:6724
- C:\Windows\System\rjdOzxp.exe
  C:\Windows\System\rjdOzxp.exe
  2⤵
  PID:6772
- C:\Windows\System\hiIgPRf.exe
  C:\Windows\System\hiIgPRf.exe
  2⤵
  PID:6836
- C:\Windows\System\BKEuPzq.exe
  C:\Windows\System\BKEuPzq.exe
  2⤵
  PID:6820
- C:\Windows\System\EHUfvdN.exe
  C:\Windows\System\EHUfvdN.exe
  2⤵
  PID:6872
- C:\Windows\System\anTmYDw.exe
  C:\Windows\System\anTmYDw.exe
  2⤵
  PID:6904
- C:\Windows\System\kjptMXc.exe
  C:\Windows\System\kjptMXc.exe
  2⤵
  PID:6968
- C:\Windows\System\COAciEG.exe
  C:\Windows\System\COAciEG.exe
  2⤵
  PID:6988
- C:\Windows\System\PjjmvJv.exe
  C:\Windows\System\PjjmvJv.exe
  2⤵
  PID:7012
- C:\Windows\System\qRCsYRK.exe
  C:\Windows\System\qRCsYRK.exe
  2⤵
  PID:7028
- C:\Windows\System\SBhStdS.exe
  C:\Windows\System\SBhStdS.exe
  2⤵
  PID:7080
- C:\Windows\System\yldKWur.exe
  C:\Windows\System\yldKWur.exe
  2⤵
  PID:7092
- C:\Windows\System\qTBnsHQ.exe
  C:\Windows\System\qTBnsHQ.exe
  2⤵
  PID:7156
- C:\Windows\System\FRCTyMU.exe
  C:\Windows\System\FRCTyMU.exe
  2⤵
  PID:6148
- C:\Windows\System\OnGQVPX.exe
  C:\Windows\System\OnGQVPX.exe
  2⤵
  PID:5632
- C:\Windows\System\yMhTDkD.exe
  C:\Windows\System\yMhTDkD.exe
  2⤵
  PID:5396
- C:\Windows\System\hCuCUCj.exe
  C:\Windows\System\hCuCUCj.exe
  2⤵
  PID:6084
- C:\Windows\System\FfdkYcy.exe
  C:\Windows\System\FfdkYcy.exe
  2⤵
  PID:6232
- C:\Windows\System\EZhgNlM.exe
  C:\Windows\System\EZhgNlM.exe
  2⤵
  PID:6300
- C:\Windows\System\EulZCta.exe
  C:\Windows\System\EulZCta.exe
  2⤵
  PID:6288
- C:\Windows\System\gJYlead.exe
  C:\Windows\System\gJYlead.exe
  2⤵
  PID:6404
- C:\Windows\System\GAuWEev.exe
  C:\Windows\System\GAuWEev.exe
  2⤵
  PID:6432
- C:\Windows\System\qHLVtEp.exe
  C:\Windows\System\qHLVtEp.exe
  2⤵
  PID:6644
- C:\Windows\System\QoRCRTX.exe
  C:\Windows\System\QoRCRTX.exe
  2⤵
  PID:6612
- C:\Windows\System\HHplmyU.exe
  C:\Windows\System\HHplmyU.exe
  2⤵
  PID:6624
- C:\Windows\System\TMNEvli.exe
  C:\Windows\System\TMNEvli.exe
  2⤵
  PID:6628
- C:\Windows\System\OsMRrWr.exe
  C:\Windows\System\OsMRrWr.exe
  2⤵
  PID:6804
- C:\Windows\System\hRnnklH.exe
  C:\Windows\System\hRnnklH.exe
  2⤵
  PID:6852
- C:\Windows\System\YnNFfKG.exe
  C:\Windows\System\YnNFfKG.exe
  2⤵
  PID:6856
- C:\Windows\System\dYuOUSj.exe
  C:\Windows\System\dYuOUSj.exe
  2⤵
  PID:6920
- C:\Windows\System\iFCEtMu.exe
  C:\Windows\System\iFCEtMu.exe
  2⤵
  PID:6948
- C:\Windows\System\CvgNMSC.exe
  C:\Windows\System\CvgNMSC.exe
  2⤵
  PID:7040
- C:\Windows\System\SMcfgae.exe
  C:\Windows\System\SMcfgae.exe
  2⤵
  PID:7148
- C:\Windows\System\gbJlKIi.exe
  C:\Windows\System\gbJlKIi.exe
  2⤵
  PID:7152
- C:\Windows\System\INOcpXc.exe
  C:\Windows\System\INOcpXc.exe
  2⤵
  PID:7164
- C:\Windows\System\UbEoRbI.exe
  C:\Windows\System\UbEoRbI.exe
  2⤵
  PID:6212
- C:\Windows\System\IWWHHDY.exe
  C:\Windows\System\IWWHHDY.exe
  2⤵
  PID:6340
- C:\Windows\System\sFdkEIo.exe
  C:\Windows\System\sFdkEIo.exe
  2⤵
  PID:6548
- C:\Windows\System\RPZfXTB.exe
  C:\Windows\System\RPZfXTB.exe
  2⤵
  PID:6160
- C:\Windows\System\OOToRoM.exe
  C:\Windows\System\OOToRoM.exe
  2⤵
  PID:6356
- C:\Windows\System\bYksVnz.exe
  C:\Windows\System\bYksVnz.exe
  2⤵
  PID:6436
- C:\Windows\System\mkGYFOX.exe
  C:\Windows\System\mkGYFOX.exe
  2⤵
  PID:6756
- C:\Windows\System\RDeDVIW.exe
  C:\Windows\System\RDeDVIW.exe
  2⤵
  PID:6728
- C:\Windows\System\kxUyMzG.exe
  C:\Windows\System\kxUyMzG.exe
  2⤵
  PID:7044
- C:\Windows\System\IEfmBqr.exe
  C:\Windows\System\IEfmBqr.exe
  2⤵
  PID:7132
- C:\Windows\System\AgLREoO.exe
  C:\Windows\System\AgLREoO.exe
  2⤵
  PID:6224
- C:\Windows\System\fIXEVJz.exe
  C:\Windows\System\fIXEVJz.exe
  2⤵
  PID:5820
- C:\Windows\System\qaidmVP.exe
  C:\Windows\System\qaidmVP.exe
  2⤵
  PID:6176
- C:\Windows\System\nkNpAZv.exe
  C:\Windows\System\nkNpAZv.exe
  2⤵
  PID:6676
- C:\Windows\System\zHoSurD.exe
  C:\Windows\System\zHoSurD.exe
  2⤵
  PID:6484
- C:\Windows\System\hGouzTx.exe
  C:\Windows\System\hGouzTx.exe
  2⤵
  PID:6868
- C:\Windows\System\oeYxjeL.exe
  C:\Windows\System\oeYxjeL.exe
  2⤵
  PID:7072
- C:\Windows\System\XjvUzdp.exe
  C:\Windows\System\XjvUzdp.exe
  2⤵
  PID:6416
- C:\Windows\System\ZDtrwaB.exe
  C:\Windows\System\ZDtrwaB.exe
  2⤵
  PID:6592
- C:\Windows\System\cGsxqZf.exe
  C:\Windows\System\cGsxqZf.exe
  2⤵
  PID:6660
- C:\Windows\System\laNhYDz.exe
  C:\Windows\System\laNhYDz.exe
  2⤵
  PID:6932
- C:\Windows\System\pVZNsSb.exe
  C:\Windows\System\pVZNsSb.exe
  2⤵
  PID:6792
- C:\Windows\System\KvVwdCk.exe
  C:\Windows\System\KvVwdCk.exe
  2⤵
  PID:6196
- C:\Windows\System\HgnZxlF.exe
  C:\Windows\System\HgnZxlF.exe
  2⤵
  PID:7180
- C:\Windows\System\qEagblC.exe
  C:\Windows\System\qEagblC.exe
  2⤵
  PID:7200
- C:\Windows\System\hSovFFv.exe
  C:\Windows\System\hSovFFv.exe
  2⤵
  PID:7216
- C:\Windows\System\BbCwauM.exe
  C:\Windows\System\BbCwauM.exe
  2⤵
  PID:7236
- C:\Windows\System\HbTjSRv.exe
  C:\Windows\System\HbTjSRv.exe
  2⤵
  PID:7252
- C:\Windows\System\nlonSMC.exe
  C:\Windows\System\nlonSMC.exe
  2⤵
  PID:7276
- C:\Windows\System\suJdjTY.exe
  C:\Windows\System\suJdjTY.exe
  2⤵
  PID:7296
- C:\Windows\System\rfPPXAK.exe
  C:\Windows\System\rfPPXAK.exe
  2⤵
  PID:7316
- C:\Windows\System\ScswSnB.exe
  C:\Windows\System\ScswSnB.exe
  2⤵
  PID:7340
- C:\Windows\System\BJcRFny.exe
  C:\Windows\System\BJcRFny.exe
  2⤵
  PID:7356
- C:\Windows\System\nRHzeYn.exe
  C:\Windows\System\nRHzeYn.exe
  2⤵
  PID:7376
- C:\Windows\System\NamNxzh.exe
  C:\Windows\System\NamNxzh.exe
  2⤵
  PID:7392
- C:\Windows\System\OBOABNf.exe
  C:\Windows\System\OBOABNf.exe
  2⤵
  PID:7408
- C:\Windows\System\gpjFMST.exe
  C:\Windows\System\gpjFMST.exe
  2⤵
  PID:7424
- C:\Windows\System\KzUbFlu.exe
  C:\Windows\System\KzUbFlu.exe
  2⤵
  PID:7448
- C:\Windows\System\BPlpVQo.exe
  C:\Windows\System\BPlpVQo.exe
  2⤵
  PID:7464
- C:\Windows\System\wIXwspF.exe
  C:\Windows\System\wIXwspF.exe
  2⤵
  PID:7480
- C:\Windows\System\fWViQyL.exe
  C:\Windows\System\fWViQyL.exe
  2⤵
  PID:7496
- C:\Windows\System\FCdfSdP.exe
  C:\Windows\System\FCdfSdP.exe
  2⤵
  PID:7516
- C:\Windows\System\HEyWUZa.exe
  C:\Windows\System\HEyWUZa.exe
  2⤵
  PID:7536
- C:\Windows\System\aKbtbPv.exe
  C:\Windows\System\aKbtbPv.exe
  2⤵
  PID:7560
- C:\Windows\System\XvdyfvC.exe
  C:\Windows\System\XvdyfvC.exe
  2⤵
  PID:7580
- C:\Windows\System\TREqLNk.exe
  C:\Windows\System\TREqLNk.exe
  2⤵
  PID:7596
- C:\Windows\System\MXbNnBE.exe
  C:\Windows\System\MXbNnBE.exe
  2⤵
  PID:7612
- C:\Windows\System\yCNbiJR.exe
  C:\Windows\System\yCNbiJR.exe
  2⤵
  PID:7632
- C:\Windows\System\JSwpipV.exe
  C:\Windows\System\JSwpipV.exe
  2⤵
  PID:7648
- C:\Windows\System\ivMalZk.exe
  C:\Windows\System\ivMalZk.exe
  2⤵
  PID:7668
- C:\Windows\System\ZjbpSZN.exe
  C:\Windows\System\ZjbpSZN.exe
  2⤵
  PID:7684
- C:\Windows\System\GmLexas.exe
  C:\Windows\System\GmLexas.exe
  2⤵
  PID:7704
- C:\Windows\System\vHfDhsE.exe
  C:\Windows\System\vHfDhsE.exe
  2⤵
  PID:7720
- C:\Windows\System\QGWVXjw.exe
  C:\Windows\System\QGWVXjw.exe
  2⤵
  PID:7736
- C:\Windows\System\KMMiZzB.exe
  C:\Windows\System\KMMiZzB.exe
  2⤵
  PID:7752
- C:\Windows\System\gRAamvR.exe
  C:\Windows\System\gRAamvR.exe
  2⤵
  PID:7768
- C:\Windows\System\Chgjmul.exe
  C:\Windows\System\Chgjmul.exe
  2⤵
  PID:7788
- C:\Windows\System\cdrYqRn.exe
  C:\Windows\System\cdrYqRn.exe
  2⤵
  PID:7804
- C:\Windows\System\EwBRXGQ.exe
  C:\Windows\System\EwBRXGQ.exe
  2⤵
  PID:7820
- C:\Windows\System\steZEsZ.exe
  C:\Windows\System\steZEsZ.exe
  2⤵
  PID:7836
- C:\Windows\System\AcODtGP.exe
  C:\Windows\System\AcODtGP.exe
  2⤵
  PID:7852
- C:\Windows\System\EisXgoM.exe
  C:\Windows\System\EisXgoM.exe
  2⤵
  PID:7868
- C:\Windows\System\nVNYPCK.exe
  C:\Windows\System\nVNYPCK.exe
  2⤵
  PID:7884
- C:\Windows\System\yDeAPnX.exe
  C:\Windows\System\yDeAPnX.exe
  2⤵
  PID:7900
- C:\Windows\System\QNsuQoo.exe
  C:\Windows\System\QNsuQoo.exe
  2⤵
  PID:7916
- C:\Windows\System\MHJHEMS.exe
  C:\Windows\System\MHJHEMS.exe
  2⤵
  PID:7932
- C:\Windows\System\ZGIUNDT.exe
  C:\Windows\System\ZGIUNDT.exe
  2⤵
  PID:7948
- C:\Windows\System\mCGUXgS.exe
  C:\Windows\System\mCGUXgS.exe
  2⤵
  PID:7964
- C:\Windows\System\UFqSxnP.exe
  C:\Windows\System\UFqSxnP.exe
  2⤵
  PID:7980
- C:\Windows\System\yscJYLN.exe
  C:\Windows\System\yscJYLN.exe
  2⤵
  PID:7996
- C:\Windows\System\uzrOJJZ.exe
  C:\Windows\System\uzrOJJZ.exe
  2⤵
  PID:8012
- C:\Windows\System\mIiJYMN.exe
  C:\Windows\System\mIiJYMN.exe
  2⤵
  PID:8028
- C:\Windows\System\vLcHloT.exe
  C:\Windows\System\vLcHloT.exe
  2⤵
  PID:8044
- C:\Windows\System\uahtHox.exe
  C:\Windows\System\uahtHox.exe
  2⤵
  PID:8064
- C:\Windows\System\KferkNd.exe
  C:\Windows\System\KferkNd.exe
  2⤵
  PID:8088
- C:\Windows\System\wGjsvan.exe
  C:\Windows\System\wGjsvan.exe
  2⤵
  PID:8108
- C:\Windows\System\KLHHiLA.exe
  C:\Windows\System\KLHHiLA.exe
  2⤵
  PID:8124
- C:\Windows\System\nkMeWiO.exe
  C:\Windows\System\nkMeWiO.exe
  2⤵
  PID:8140
- C:\Windows\System\hssVtzD.exe
  C:\Windows\System\hssVtzD.exe
  2⤵
  PID:8156
- C:\Windows\System\cwbubcH.exe
  C:\Windows\System\cwbubcH.exe
  2⤵
  PID:8184
- C:\Windows\System\itCERpZ.exe
  C:\Windows\System\itCERpZ.exe
  2⤵
  PID:6976
- C:\Windows\System\eJDyZVx.exe
  C:\Windows\System\eJDyZVx.exe
  2⤵
  PID:7188
- C:\Windows\System\eniPtad.exe
  C:\Windows\System\eniPtad.exe
  2⤵
  PID:7244
- C:\Windows\System\yHNcZik.exe
  C:\Windows\System\yHNcZik.exe
  2⤵
  PID:7264
- C:\Windows\System\ptvyyMF.exe
  C:\Windows\System\ptvyyMF.exe
  2⤵
  PID:7272
- C:\Windows\System\UHBZXPy.exe
  C:\Windows\System\UHBZXPy.exe
  2⤵
  PID:7312
- C:\Windows\System\mzInNRk.exe
  C:\Windows\System\mzInNRk.exe
  2⤵
  PID:7336
- C:\Windows\System\dndhFZf.exe
  C:\Windows\System\dndhFZf.exe
  2⤵
  PID:7368
- C:\Windows\System\CRAdcwF.exe
  C:\Windows\System\CRAdcwF.exe
  2⤵
  PID:7400
- C:\Windows\System\oScINrf.exe
  C:\Windows\System\oScINrf.exe
  2⤵
  PID:7440
- C:\Windows\System\UiYXTmp.exe
  C:\Windows\System\UiYXTmp.exe
  2⤵
  PID:7472
- C:\Windows\System\VeicOFG.exe
  C:\Windows\System\VeicOFG.exe
  2⤵
  PID:7144
- C:\Windows\System\UwoTUTG.exe
  C:\Windows\System\UwoTUTG.exe
  2⤵
  PID:7512
- C:\Windows\System\NiOSDDo.exe
  C:\Windows\System\NiOSDDo.exe
  2⤵
  PID:7548
- C:\Windows\System\FHRowxN.exe
  C:\Windows\System\FHRowxN.exe
  2⤵
  PID:7524
- C:\Windows\System\JWYJesF.exe
  C:\Windows\System\JWYJesF.exe
  2⤵
  PID:7572
- C:\Windows\System\xzOSusp.exe
  C:\Windows\System\xzOSusp.exe
  2⤵
  PID:7624
- C:\Windows\System\wKuENtu.exe
  C:\Windows\System\wKuENtu.exe
  2⤵
  PID:7656
- C:\Windows\System\UQjXdLK.exe
  C:\Windows\System\UQjXdLK.exe
  2⤵
  PID:7644
- C:\Windows\System\VxsWQwG.exe
  C:\Windows\System\VxsWQwG.exe
  2⤵
  PID:7728
- C:\Windows\System\UBGfeLj.exe
  C:\Windows\System\UBGfeLj.exe
  2⤵
  PID:7716
- C:\Windows\System\JOzYJtU.exe
  C:\Windows\System\JOzYJtU.exe
  2⤵
  PID:7780
- C:\Windows\System\KqmjHNz.exe
  C:\Windows\System\KqmjHNz.exe
  2⤵
  PID:7816
- C:\Windows\System\NfoUPwD.exe
  C:\Windows\System\NfoUPwD.exe
  2⤵
  PID:7912
- C:\Windows\System\lRGtoZC.exe
  C:\Windows\System\lRGtoZC.exe
  2⤵
  PID:7972
- C:\Windows\System\XCVJViw.exe
  C:\Windows\System\XCVJViw.exe
  2⤵
  PID:7976
- C:\Windows\System\RFEvROV.exe
  C:\Windows\System\RFEvROV.exe
  2⤵
  PID:8040
- C:\Windows\System\zEaEDIr.exe
  C:\Windows\System\zEaEDIr.exe
  2⤵
  PID:8076
- C:\Windows\System\LGRLYJy.exe
  C:\Windows\System\LGRLYJy.exe
  2⤵
  PID:8084
- C:\Windows\System\WVVxFEc.exe
  C:\Windows\System\WVVxFEc.exe
  2⤵
  PID:8164
- C:\Windows\System\RjdjnhY.exe
  C:\Windows\System\RjdjnhY.exe
  2⤵
  PID:8152
- C:\Windows\System\LvnXYgg.exe
  C:\Windows\System\LvnXYgg.exe
  2⤵
  PID:7176
- C:\Windows\System\DcxzMkT.exe
  C:\Windows\System\DcxzMkT.exe
  2⤵
  PID:7172
- C:\Windows\System\XhoUtZo.exe
  C:\Windows\System\XhoUtZo.exe
  2⤵
  PID:7284
- C:\Windows\System\dwFDmzU.exe
  C:\Windows\System\dwFDmzU.exe
  2⤵
  PID:7384
- C:\Windows\System\vQhmPRD.exe
  C:\Windows\System\vQhmPRD.exe
  2⤵
  PID:7308
- C:\Windows\System\URlwdqn.exe
  C:\Windows\System\URlwdqn.exe
  2⤵
  PID:7352
- C:\Windows\System\HPZJzIn.exe
  C:\Windows\System\HPZJzIn.exe
  2⤵
  PID:7504
- C:\Windows\System\ffuGLoR.exe
  C:\Windows\System\ffuGLoR.exe
  2⤵
  PID:7456
- C:\Windows\System\dyjcPHF.exe
  C:\Windows\System\dyjcPHF.exe
  2⤵
  PID:7568
- C:\Windows\System\QXraHUa.exe
  C:\Windows\System\QXraHUa.exe
  2⤵
  PID:7608
- C:\Windows\System\aiFDqGy.exe
  C:\Windows\System\aiFDqGy.exe
  2⤵
  PID:7680
- C:\Windows\System\DFyzWqS.exe
  C:\Windows\System\DFyzWqS.exe
  2⤵
  PID:7760
- C:\Windows\System\uHXuJMU.exe
  C:\Windows\System\uHXuJMU.exe
  2⤵
  PID:7800
- C:\Windows\System\BtXtXAu.exe
  C:\Windows\System\BtXtXAu.exe
  2⤵
  PID:7892
- C:\Windows\System\riqCDZn.exe
  C:\Windows\System\riqCDZn.exe
  2⤵
  PID:7956
- C:\Windows\System\pDwQACQ.exe
  C:\Windows\System\pDwQACQ.exe
  2⤵
  PID:7992
- C:\Windows\System\LZBRFNj.exe
  C:\Windows\System\LZBRFNj.exe
  2⤵
  PID:7940
- C:\Windows\System\RJIQfYb.exe
  C:\Windows\System\RJIQfYb.exe
  2⤵
  PID:8060
- C:\Windows\System\uVnBqGe.exe
  C:\Windows\System\uVnBqGe.exe
  2⤵
  PID:8136
- C:\Windows\System\epuEcVe.exe
  C:\Windows\System\epuEcVe.exe
  2⤵
  PID:8168
- C:\Windows\System\frpAGwH.exe
  C:\Windows\System\frpAGwH.exe
  2⤵
  PID:7228
- C:\Windows\System\mlRdytP.exe
  C:\Windows\System\mlRdytP.exe
  2⤵
  PID:7420
- C:\Windows\System\CSllxjj.exe
  C:\Windows\System\CSllxjj.exe
  2⤵
  PID:7592
- C:\Windows\System\ZhFRhLt.exe
  C:\Windows\System\ZhFRhLt.exe
  2⤵
  PID:7332
- C:\Windows\System\SViPsyV.exe
  C:\Windows\System\SViPsyV.exe
  2⤵
  PID:7776
- C:\Windows\System\THnIMOs.exe
  C:\Windows\System\THnIMOs.exe
  2⤵
  PID:7324
- C:\Windows\System\LreZqgI.exe
  C:\Windows\System\LreZqgI.exe
  2⤵
  PID:7860
- C:\Windows\System\EznMmmr.exe
  C:\Windows\System\EznMmmr.exe
  2⤵
  PID:7896
- C:\Windows\System\BGljErb.exe
  C:\Windows\System\BGljErb.exe
  2⤵
  PID:7928
- C:\Windows\System\OEJajkL.exe
  C:\Windows\System\OEJajkL.exe
  2⤵
  PID:8132
- C:\Windows\System\IqibHXk.exe
  C:\Windows\System\IqibHXk.exe
  2⤵
  PID:6324
- C:\Windows\System\BWTaWCl.exe
  C:\Windows\System\BWTaWCl.exe
  2⤵
  PID:7460
- C:\Windows\System\fdayzIv.exe
  C:\Windows\System\fdayzIv.exe
  2⤵
  PID:7924
- C:\Windows\System\geFqwFb.exe
  C:\Windows\System\geFqwFb.exe
  2⤵
  PID:7552
- C:\Windows\System\EoqhrrW.exe
  C:\Windows\System\EoqhrrW.exe
  2⤵
  PID:7588
- C:\Windows\System\kOhLFnG.exe
  C:\Windows\System\kOhLFnG.exe
  2⤵
  PID:8036
- C:\Windows\System\mCDOeOg.exe
  C:\Windows\System\mCDOeOg.exe
  2⤵
  PID:8080
- C:\Windows\System\wjJZdEs.exe
  C:\Windows\System\wjJZdEs.exe
  2⤵
  PID:7196
- C:\Windows\System\avbMoIx.exe
  C:\Windows\System\avbMoIx.exe
  2⤵
  PID:7880
- C:\Windows\System\NaeTyjx.exe
  C:\Windows\System\NaeTyjx.exe
  2⤵
  PID:8204
- C:\Windows\System\temRxIZ.exe
  C:\Windows\System\temRxIZ.exe
  2⤵
  PID:8228
- C:\Windows\System\CobdcQM.exe
  C:\Windows\System\CobdcQM.exe
  2⤵
  PID:8268
- C:\Windows\System\WeIqxbl.exe
  C:\Windows\System\WeIqxbl.exe
  2⤵
  PID:8284
- C:\Windows\System\wSPZbye.exe
  C:\Windows\System\wSPZbye.exe
  2⤵
  PID:8304
- C:\Windows\System\rrWztNt.exe
  C:\Windows\System\rrWztNt.exe
  2⤵
  PID:8328
- C:\Windows\System\EbnAywk.exe
  C:\Windows\System\EbnAywk.exe
  2⤵
  PID:8348
- C:\Windows\System\ifhGsWY.exe
  C:\Windows\System\ifhGsWY.exe
  2⤵
  PID:8372
- C:\Windows\System\ObTzukS.exe
  C:\Windows\System\ObTzukS.exe
  2⤵
  PID:8388
- C:\Windows\System\nwvLXgu.exe
  C:\Windows\System\nwvLXgu.exe
  2⤵
  PID:8416
- C:\Windows\System\DWOHitk.exe
  C:\Windows\System\DWOHitk.exe
  2⤵
  PID:8440
- C:\Windows\System\bfMCihq.exe
  C:\Windows\System\bfMCihq.exe
  2⤵
  PID:8456
- C:\Windows\System\wUFsToS.exe
  C:\Windows\System\wUFsToS.exe
  2⤵
  PID:8476
- C:\Windows\System\YULAaGR.exe
  C:\Windows\System\YULAaGR.exe
  2⤵
  PID:8492
- C:\Windows\System\GFRXpWQ.exe
  C:\Windows\System\GFRXpWQ.exe
  2⤵
  PID:8508
- C:\Windows\System\xXvYUtW.exe
  C:\Windows\System\xXvYUtW.exe
  2⤵
  PID:8524
- C:\Windows\System\XZgHOcv.exe
  C:\Windows\System\XZgHOcv.exe
  2⤵
  PID:8540
- C:\Windows\System\oyGBXpm.exe
  C:\Windows\System\oyGBXpm.exe
  2⤵
  PID:8556
- C:\Windows\System\vllECJF.exe
  C:\Windows\System\vllECJF.exe
  2⤵
  PID:8572
- C:\Windows\System\nWkzcNW.exe
  C:\Windows\System\nWkzcNW.exe
  2⤵
  PID:8588
- C:\Windows\System\cALgYbL.exe
  C:\Windows\System\cALgYbL.exe
  2⤵
  PID:8604
- C:\Windows\System\RrnTNhv.exe
  C:\Windows\System\RrnTNhv.exe
  2⤵
  PID:8620
- C:\Windows\System\eeAkptg.exe
  C:\Windows\System\eeAkptg.exe
  2⤵
  PID:8636
- C:\Windows\System\hMDPlks.exe
  C:\Windows\System\hMDPlks.exe
  2⤵
  PID:8652
- C:\Windows\System\lvLuQet.exe
  C:\Windows\System\lvLuQet.exe
  2⤵
  PID:8668
- C:\Windows\System\XZKwjhh.exe
  C:\Windows\System\XZKwjhh.exe
  2⤵
  PID:8684
- C:\Windows\System\lrPAdQB.exe
  C:\Windows\System\lrPAdQB.exe
  2⤵
  PID:8700
- C:\Windows\System\mongyEO.exe
  C:\Windows\System\mongyEO.exe
  2⤵
  PID:8716
- C:\Windows\System\JXkItFe.exe
  C:\Windows\System\JXkItFe.exe
  2⤵
  PID:8732
- C:\Windows\System\VYUajXx.exe
  C:\Windows\System\VYUajXx.exe
  2⤵
  PID:8748
- C:\Windows\System\ZkqLqSs.exe
  C:\Windows\System\ZkqLqSs.exe
  2⤵
  PID:8764
- C:\Windows\System\qLuvFyu.exe
  C:\Windows\System\qLuvFyu.exe
  2⤵
  PID:8780
- C:\Windows\System\XrBbeGr.exe
  C:\Windows\System\XrBbeGr.exe
  2⤵
  PID:8796
- C:\Windows\System\ZTqAgoP.exe
  C:\Windows\System\ZTqAgoP.exe
  2⤵
  PID:8812
- C:\Windows\System\WYwsCVa.exe
  C:\Windows\System\WYwsCVa.exe
  2⤵
  PID:8828
- C:\Windows\System\rkaMuaj.exe
  C:\Windows\System\rkaMuaj.exe
  2⤵
  PID:8844
- C:\Windows\System\PdAlHOD.exe
  C:\Windows\System\PdAlHOD.exe
  2⤵
  PID:8860
- C:\Windows\System\BuGBCwX.exe
  C:\Windows\System\BuGBCwX.exe
  2⤵
  PID:8876
- C:\Windows\System\wrlNRAP.exe
  C:\Windows\System\wrlNRAP.exe
  2⤵
  PID:8892
- C:\Windows\System\asKEEKN.exe
  C:\Windows\System\asKEEKN.exe
  2⤵
  PID:8908
- C:\Windows\System\xdMtOsz.exe
  C:\Windows\System\xdMtOsz.exe
  2⤵
  PID:8924
- C:\Windows\System\inlUcFN.exe
  C:\Windows\System\inlUcFN.exe
  2⤵
  PID:8940
- C:\Windows\System\vQjMrRt.exe
  C:\Windows\System\vQjMrRt.exe
  2⤵
  PID:8956
- C:\Windows\System\PSVnlyj.exe
  C:\Windows\System\PSVnlyj.exe
  2⤵
  PID:8972
- C:\Windows\System\dZBOKIQ.exe
  C:\Windows\System\dZBOKIQ.exe
  2⤵
  PID:8988
- C:\Windows\System\JSCPXpv.exe
  C:\Windows\System\JSCPXpv.exe
  2⤵
  PID:9016
- C:\Windows\System\NMIRXNZ.exe
  C:\Windows\System\NMIRXNZ.exe
  2⤵
  PID:9032
- C:\Windows\System\StApNQp.exe
  C:\Windows\System\StApNQp.exe
  2⤵
  PID:9048
- C:\Windows\System\LgSVmnC.exe
  C:\Windows\System\LgSVmnC.exe
  2⤵
  PID:9064
- C:\Windows\System\IGNOcGf.exe
  C:\Windows\System\IGNOcGf.exe
  2⤵
  PID:9084
- C:\Windows\System\UhmMqPY.exe
  C:\Windows\System\UhmMqPY.exe
  2⤵
  PID:9100
- C:\Windows\System\vJXaaGR.exe
  C:\Windows\System\vJXaaGR.exe
  2⤵
  PID:9120
- C:\Windows\System\fhJUfXp.exe
  C:\Windows\System\fhJUfXp.exe
  2⤵
  PID:9136
- C:\Windows\System\PtkdsoT.exe
  C:\Windows\System\PtkdsoT.exe
  2⤵
  PID:9156
- C:\Windows\System\oCaCZLY.exe
  C:\Windows\System\oCaCZLY.exe
  2⤵
  PID:9172
- C:\Windows\System\ClRezti.exe
  C:\Windows\System\ClRezti.exe
  2⤵
  PID:9192
- C:\Windows\System\AQHLzeF.exe
  C:\Windows\System\AQHLzeF.exe
  2⤵
  PID:7432
- C:\Windows\System\cuQsoSY.exe
  C:\Windows\System\cuQsoSY.exe
  2⤵
  PID:7416
- C:\Windows\System\fNaXrNt.exe
  C:\Windows\System\fNaXrNt.exe
  2⤵
  PID:8240
- C:\Windows\System\pWtFOOF.exe
  C:\Windows\System\pWtFOOF.exe
  2⤵
  PID:8256
- C:\Windows\System\GeGRHPy.exe
  C:\Windows\System\GeGRHPy.exe
  2⤵
  PID:8300
- C:\Windows\System\JnDfaTV.exe
  C:\Windows\System\JnDfaTV.exe
  2⤵
  PID:8316
- C:\Windows\System\mmOcoBa.exe
  C:\Windows\System\mmOcoBa.exe
  2⤵
  PID:8356
- C:\Windows\System\KOCGXpk.exe
  C:\Windows\System\KOCGXpk.exe
  2⤵
  PID:8396
- C:\Windows\System\ueRJbqo.exe
  C:\Windows\System\ueRJbqo.exe
  2⤵
  PID:8448
- C:\Windows\System\QVvniZi.exe
  C:\Windows\System\QVvniZi.exe
  2⤵
  PID:8516
- C:\Windows\System\qKdlHgK.exe
  C:\Windows\System\qKdlHgK.exe
  2⤵
  PID:8424
- C:\Windows\System\StLFuuw.exe
  C:\Windows\System\StLFuuw.exe
  2⤵
  PID:8552
- C:\Windows\System\QBIeOeX.exe
  C:\Windows\System\QBIeOeX.exe
  2⤵
  PID:8340
- C:\Windows\System\mSgWzhD.exe
  C:\Windows\System\mSgWzhD.exe
  2⤵
  PID:8344
- C:\Windows\System\bjrHBMb.exe
  C:\Windows\System\bjrHBMb.exe
  2⤵
  PID:8472
- C:\Windows\System\AmNetCU.exe
  C:\Windows\System\AmNetCU.exe
  2⤵
  PID:8536
- C:\Windows\System\yjgHcVA.exe
  C:\Windows\System\yjgHcVA.exe
  2⤵
  PID:8632
- C:\Windows\System\YniSYJB.exe
  C:\Windows\System\YniSYJB.exe
  2⤵
  PID:8660
- C:\Windows\System\FTzPcmb.exe
  C:\Windows\System\FTzPcmb.exe
  2⤵
  PID:8692
- C:\Windows\System\aRatzyh.exe
  C:\Windows\System\aRatzyh.exe
  2⤵
  PID:8724
- C:\Windows\System\FOVksYa.exe
  C:\Windows\System\FOVksYa.exe
  2⤵
  PID:8756
- C:\Windows\System\IYhdztD.exe
  C:\Windows\System\IYhdztD.exe
  2⤵
  PID:8804
- C:\Windows\System\noPwMaT.exe
  C:\Windows\System\noPwMaT.exe
  2⤵
  PID:8820
- C:\Windows\System\NuhLhyg.exe
  C:\Windows\System\NuhLhyg.exe
  2⤵
  PID:8856
- C:\Windows\System\tQgUWNp.exe
  C:\Windows\System\tQgUWNp.exe
  2⤵
  PID:8888
- C:\Windows\System\KGuXfFj.exe
  C:\Windows\System\KGuXfFj.exe
  2⤵
  PID:8932
- C:\Windows\System\CQupElX.exe
  C:\Windows\System\CQupElX.exe
  2⤵
  PID:8968
- C:\Windows\System\GazWQmW.exe
  C:\Windows\System\GazWQmW.exe
  2⤵
  PID:8980
- C:\Windows\System\HKBcKFY.exe
  C:\Windows\System\HKBcKFY.exe
  2⤵
  PID:9024
- C:\Windows\System\cAtlCGm.exe
  C:\Windows\System\cAtlCGm.exe
  2⤵
  PID:9076
- C:\Windows\System\zlTnjjs.exe
  C:\Windows\System\zlTnjjs.exe
  2⤵
  PID:8292
- C:\Windows\System\pdrQcXE.exe
  C:\Windows\System\pdrQcXE.exe
  2⤵
  PID:8320
- C:\Windows\System\nfsuZOj.exe
  C:\Windows\System\nfsuZOj.exe
  2⤵
  PID:8324
- C:\Windows\System\dKsamTb.exe
  C:\Windows\System\dKsamTb.exe
  2⤵
  PID:9212
- C:\Windows\System\lpGJxYP.exe
  C:\Windows\System\lpGJxYP.exe
  2⤵
  PID:8488
- C:\Windows\System\ovpsTFm.exe
  C:\Windows\System\ovpsTFm.exe
  2⤵
  PID:8568
- C:\Windows\System\hNJbbsw.exe
  C:\Windows\System\hNJbbsw.exe
  2⤵
  PID:8468
- C:\Windows\System\LmgkHyP.exe
  C:\Windows\System\LmgkHyP.exe
  2⤵
  PID:8584
- C:\Windows\System\QmgHcIq.exe
  C:\Windows\System\QmgHcIq.exe
  2⤵
  PID:8628
- C:\Windows\System\OkAhyrw.exe
  C:\Windows\System\OkAhyrw.exe
  2⤵
  PID:8760
- C:\Windows\System\SfadqTX.exe
  C:\Windows\System\SfadqTX.exe
  2⤵
  PID:8744
- C:\Windows\System\HspcZMm.exe
  C:\Windows\System\HspcZMm.exe
  2⤵
  PID:8840
- C:\Windows\System\hyKxIDq.exe
  C:\Windows\System\hyKxIDq.exe
  2⤵
  PID:8920
- C:\Windows\System\WuDezXZ.exe
  C:\Windows\System\WuDezXZ.exe
  2⤵
  PID:8884
- C:\Windows\System\TnbZvzH.exe
  C:\Windows\System\TnbZvzH.exe
  2⤵
  PID:9008
- C:\Windows\System\YIrwsgN.exe
  C:\Windows\System\YIrwsgN.exe
  2⤵
  PID:9056
- C:\Windows\System\uMxWEvJ.exe
  C:\Windows\System\uMxWEvJ.exe
  2⤵
  PID:9116
- C:\Windows\System\eZbcTIm.exe
  C:\Windows\System\eZbcTIm.exe
  2⤵
  PID:9188
- C:\Windows\System\sbDfgMQ.exe
  C:\Windows\System\sbDfgMQ.exe
  2⤵
  PID:9184
- C:\Windows\System\QKEobjB.exe
  C:\Windows\System\QKEobjB.exe
  2⤵
  PID:8312
- C:\Windows\System\FYjPfKo.exe
  C:\Windows\System\FYjPfKo.exe
  2⤵
  PID:8220
- C:\Windows\System\fUmTwNm.exe
  C:\Windows\System\fUmTwNm.exe
  2⤵
  PID:8368
- C:\Windows\System\EoZgKqm.exe
  C:\Windows\System\EoZgKqm.exe
  2⤵
  PID:9164
- C:\Windows\System\rIIhDeH.exe
  C:\Windows\System\rIIhDeH.exe
  2⤵
  PID:9208
- C:\Windows\System\IEWONzN.exe
  C:\Windows\System\IEWONzN.exe
  2⤵
  PID:1244
- C:\Windows\System\HjRXAUG.exe
  C:\Windows\System\HjRXAUG.exe
  2⤵
  PID:8616
- C:\Windows\System\TjvmMdl.exe
  C:\Windows\System\TjvmMdl.exe
  2⤵
  PID:8712
- C:\Windows\System\xcjjBBL.exe
  C:\Windows\System\xcjjBBL.exe
  2⤵
  PID:8788
- C:\Windows\System\phEbHNg.exe
  C:\Windows\System\phEbHNg.exe
  2⤵
  PID:8852
- C:\Windows\System\pfQEyqs.exe
  C:\Windows\System\pfQEyqs.exe
  2⤵
  PID:9112
- C:\Windows\System\DuxviUS.exe
  C:\Windows\System\DuxviUS.exe
  2⤵
  PID:8196
- C:\Windows\System\yxWGztG.exe
  C:\Windows\System\yxWGztG.exe
  2⤵
  PID:9200
- C:\Windows\System\IDXHnUL.exe
  C:\Windows\System\IDXHnUL.exe
  2⤵
  PID:8264
- C:\Windows\System\YXttZXD.exe
  C:\Windows\System\YXttZXD.exe
  2⤵
  PID:8384
- C:\Windows\System\aTOSERH.exe
  C:\Windows\System\aTOSERH.exe
  2⤵
  PID:9012
- C:\Windows\System\fQabuGQ.exe
  C:\Windows\System\fQabuGQ.exe
  2⤵
  PID:8500
- C:\Windows\System\mycrAtS.exe
  C:\Windows\System\mycrAtS.exe
  2⤵
  PID:9180
- C:\Windows\System\QFEuJYZ.exe
  C:\Windows\System\QFEuJYZ.exe
  2⤵
  PID:9204
- C:\Windows\System\tkYrUkF.exe
  C:\Windows\System\tkYrUkF.exe
  2⤵
  PID:9092
- C:\Windows\System\yqgDRUV.exe
  C:\Windows\System\yqgDRUV.exe
  2⤵
  PID:9044
- C:\Windows\System\uJLcMBJ.exe
  C:\Windows\System\uJLcMBJ.exe
  2⤵
  PID:8280
- C:\Windows\System\GuzcSbC.exe
  C:\Windows\System\GuzcSbC.exe
  2⤵
  PID:9004
- C:\Windows\System\uaWzlos.exe
  C:\Windows\System\uaWzlos.exe
  2⤵
  PID:9220
- C:\Windows\System\CNMGwHE.exe
  C:\Windows\System\CNMGwHE.exe
  2⤵
  PID:9236
- C:\Windows\System\IpwkoEw.exe
  C:\Windows\System\IpwkoEw.exe
  2⤵
  PID:9252
- C:\Windows\System\hJqODmZ.exe
  C:\Windows\System\hJqODmZ.exe
  2⤵
  PID:9268
- C:\Windows\System\xeKKHDX.exe
  C:\Windows\System\xeKKHDX.exe
  2⤵
  PID:9288
- C:\Windows\System\OTnxjxJ.exe
  C:\Windows\System\OTnxjxJ.exe
  2⤵
  PID:9308
- C:\Windows\System\ImdCQpU.exe
  C:\Windows\System\ImdCQpU.exe
  2⤵
  PID:9348
- C:\Windows\System\GgvQTpQ.exe
  C:\Windows\System\GgvQTpQ.exe
  2⤵
  PID:9376
- C:\Windows\System\RnhcDoY.exe
  C:\Windows\System\RnhcDoY.exe
  2⤵
  PID:9392
- C:\Windows\System\XFJuxIe.exe
  C:\Windows\System\XFJuxIe.exe
  2⤵
  PID:9412
- C:\Windows\System\wjSZJLF.exe
  C:\Windows\System\wjSZJLF.exe
  2⤵
  PID:9436
- C:\Windows\System\TnfdlWN.exe
  C:\Windows\System\TnfdlWN.exe
  2⤵
  PID:9484
- C:\Windows\System\WiKXQNG.exe
  C:\Windows\System\WiKXQNG.exe
  2⤵
  PID:9500
- C:\Windows\System\dCXsyYN.exe
  C:\Windows\System\dCXsyYN.exe
  2⤵
  PID:9516
- C:\Windows\System\rYFFwxn.exe
  C:\Windows\System\rYFFwxn.exe
  2⤵
  PID:9532
- C:\Windows\System\fTcBdKl.exe
  C:\Windows\System\fTcBdKl.exe
  2⤵
  PID:9548
- C:\Windows\System\XTxZesd.exe
  C:\Windows\System\XTxZesd.exe
  2⤵
  PID:9564
- C:\Windows\System\aFfecmF.exe
  C:\Windows\System\aFfecmF.exe
  2⤵
  PID:9580
- C:\Windows\System\hFUisQh.exe
  C:\Windows\System\hFUisQh.exe
  2⤵
  PID:9596
- C:\Windows\System\URKDkFv.exe
  C:\Windows\System\URKDkFv.exe
  2⤵
  PID:9612
- C:\Windows\System\jtsbviu.exe
  C:\Windows\System\jtsbviu.exe
  2⤵
  PID:9628
- C:\Windows\System\DsFyKHV.exe
  C:\Windows\System\DsFyKHV.exe
  2⤵
  PID:9644
- C:\Windows\System\TxGylrt.exe
  C:\Windows\System\TxGylrt.exe
  2⤵
  PID:9660
- C:\Windows\System\iYUwuTP.exe
  C:\Windows\System\iYUwuTP.exe
  2⤵
  PID:9676
- C:\Windows\System\oPtjPAM.exe
  C:\Windows\System\oPtjPAM.exe
  2⤵
  PID:9692
- C:\Windows\System\mMVaSEr.exe
  C:\Windows\System\mMVaSEr.exe
  2⤵
  PID:9708
- C:\Windows\System\ERoxYcw.exe
  C:\Windows\System\ERoxYcw.exe
  2⤵
  PID:9724
- C:\Windows\System\NNEqhoT.exe
  C:\Windows\System\NNEqhoT.exe
  2⤵
  PID:9740
- C:\Windows\System\joILjym.exe
  C:\Windows\System\joILjym.exe
  2⤵
  PID:9756
- C:\Windows\System\OqPWoVp.exe
  C:\Windows\System\OqPWoVp.exe
  2⤵
  PID:9772
- C:\Windows\System\ZxsECly.exe
  C:\Windows\System\ZxsECly.exe
  2⤵
  PID:9788
- C:\Windows\System\iskyeJy.exe
  C:\Windows\System\iskyeJy.exe
  2⤵
  PID:9804
- C:\Windows\System\HzswCBM.exe
  C:\Windows\System\HzswCBM.exe
  2⤵
  PID:9820
- C:\Windows\System\FyAJoWX.exe
  C:\Windows\System\FyAJoWX.exe
  2⤵
  PID:9836
- C:\Windows\System\tbONcVS.exe
  C:\Windows\System\tbONcVS.exe
  2⤵
  PID:9852
- C:\Windows\System\VUrVBXF.exe
  C:\Windows\System\VUrVBXF.exe
  2⤵
  PID:9868
- C:\Windows\System\oHslNDn.exe
  C:\Windows\System\oHslNDn.exe
  2⤵
  PID:9884
- C:\Windows\System\YktVCYT.exe
  C:\Windows\System\YktVCYT.exe
  2⤵
  PID:9900
- C:\Windows\System\LmSwsLg.exe
  C:\Windows\System\LmSwsLg.exe
  2⤵
  PID:9916
- C:\Windows\System\vzSNtOs.exe
  C:\Windows\System\vzSNtOs.exe
  2⤵
  PID:9932
- C:\Windows\System\CyOvrSb.exe
  C:\Windows\System\CyOvrSb.exe
  2⤵
  PID:9948
- C:\Windows\System\ppOFfgi.exe
  C:\Windows\System\ppOFfgi.exe
  2⤵
  PID:9964
- C:\Windows\System\sLNGhXW.exe
  C:\Windows\System\sLNGhXW.exe
  2⤵
  PID:9980
- C:\Windows\System\VKgAYRL.exe
  C:\Windows\System\VKgAYRL.exe
  2⤵
  PID:9996
- C:\Windows\System\LhQdhFX.exe
  C:\Windows\System\LhQdhFX.exe
  2⤵
  PID:10012
- C:\Windows\System\ysESxzv.exe
  C:\Windows\System\ysESxzv.exe
  2⤵
  PID:10028
- C:\Windows\System\JMABLnC.exe
  C:\Windows\System\JMABLnC.exe
  2⤵
  PID:10044
- C:\Windows\System\obDdBoj.exe
  C:\Windows\System\obDdBoj.exe
  2⤵
  PID:10060
- C:\Windows\System\aqntLim.exe
  C:\Windows\System\aqntLim.exe
  2⤵
  PID:10084
- C:\Windows\System\NtRpyJg.exe
  C:\Windows\System\NtRpyJg.exe
  2⤵
  PID:10100
- C:\Windows\System\bnHFijA.exe
  C:\Windows\System\bnHFijA.exe
  2⤵
  PID:10116
- C:\Windows\System\OBojfIY.exe
  C:\Windows\System\OBojfIY.exe
  2⤵
  PID:10132
- C:\Windows\System\vQnGYen.exe
  C:\Windows\System\vQnGYen.exe
  2⤵
  PID:10148
- C:\Windows\System\xkAHcqd.exe
  C:\Windows\System\xkAHcqd.exe
  2⤵
  PID:10164
- C:\Windows\System\cpbBifX.exe
  C:\Windows\System\cpbBifX.exe
  2⤵
  PID:10180
- C:\Windows\System\ProvekI.exe
  C:\Windows\System\ProvekI.exe
  2⤵
  PID:10204
- C:\Windows\System\uxEyDKO.exe
  C:\Windows\System\uxEyDKO.exe
  2⤵
  PID:10220
- C:\Windows\System\edLHMTI.exe
  C:\Windows\System\edLHMTI.exe
  2⤵
  PID:8728
- C:\Windows\System\excqcdX.exe
  C:\Windows\System\excqcdX.exe
  2⤵
  PID:9264
- C:\Windows\System\GQSUllD.exe
  C:\Windows\System\GQSUllD.exe
  2⤵
  PID:9300
- C:\Windows\System\RdrLcoB.exe
  C:\Windows\System\RdrLcoB.exe
  2⤵
  PID:9316
- C:\Windows\System\rLDmGxg.exe
  C:\Windows\System\rLDmGxg.exe
  2⤵
  PID:9356
- C:\Windows\System\FokWNSt.exe
  C:\Windows\System\FokWNSt.exe
  2⤵
  PID:9400
- C:\Windows\System\CtaYHQQ.exe
  C:\Windows\System\CtaYHQQ.exe
  2⤵
  PID:9460
- C:\Windows\System\MGLzEoC.exe
  C:\Windows\System\MGLzEoC.exe
  2⤵
  PID:9476
- C:\Windows\System\jIQafAf.exe
  C:\Windows\System\jIQafAf.exe
  2⤵
  PID:9344
- C:\Windows\System\aDIWQga.exe
  C:\Windows\System\aDIWQga.exe
  2⤵
  PID:9388
- C:\Windows\System\aBIzhhk.exe
  C:\Windows\System\aBIzhhk.exe
  2⤵
  PID:9428
- C:\Windows\System\SRmaGzP.exe
  C:\Windows\System\SRmaGzP.exe
  2⤵
  PID:9512
- C:\Windows\System\fugqShr.exe
  C:\Windows\System\fugqShr.exe
  2⤵
  PID:9576
- C:\Windows\System\oekDEJq.exe
  C:\Windows\System\oekDEJq.exe
  2⤵
  PID:9608
- C:\Windows\System\dTDuFpr.exe
  C:\Windows\System\dTDuFpr.exe
  2⤵
  PID:9560
- C:\Windows\System\GPZaadF.exe
  C:\Windows\System\GPZaadF.exe
  2⤵
  PID:9592
- C:\Windows\System\xYDvASA.exe
  C:\Windows\System\xYDvASA.exe
  2⤵
  PID:9700
- C:\Windows\System\TBPLYgv.exe
  C:\Windows\System\TBPLYgv.exe
  2⤵
  PID:9656
- C:\Windows\System\GYgHHni.exe
  C:\Windows\System\GYgHHni.exe
  2⤵
  PID:9748
- C:\Windows\System\zstySmF.exe
  C:\Windows\System\zstySmF.exe
  2⤵
  PID:9768
- C:\Windows\System\ufYLcje.exe
  C:\Windows\System\ufYLcje.exe
  2⤵
  PID:9828
- C:\Windows\System\SEKgJzZ.exe
  C:\Windows\System\SEKgJzZ.exe
  2⤵
  PID:8664
- C:\Windows\System\oyJecbF.exe
  C:\Windows\System\oyJecbF.exe
  2⤵
  PID:9244
- C:\Windows\System\rWlQjCr.exe
  C:\Windows\System\rWlQjCr.exe
  2⤵
  PID:9340
- C:\Windows\System\xcTzeuV.exe
  C:\Windows\System\xcTzeuV.exe
  2⤵
  PID:9384
- C:\Windows\System\RpARKka.exe
  C:\Windows\System\RpARKka.exe
  2⤵
  PID:9604
- C:\Windows\System\kygpBGO.exe
  C:\Windows\System\kygpBGO.exe
  2⤵
  PID:10096
- C:\Windows\System\sLIJisi.exe
  C:\Windows\System\sLIJisi.exe
  2⤵
  PID:10072
- C:\Windows\System\eJDKQVM.exe
  C:\Windows\System\eJDKQVM.exe
  2⤵
  PID:9468
- C:\Windows\System\qcYLYtQ.exe
  C:\Windows\System\qcYLYtQ.exe
  2⤵
  PID:9492
- C:\Windows\System\fVvgyru.exe
  C:\Windows\System\fVvgyru.exe
  2⤵
  PID:9640
- C:\Windows\System\UoRdaXV.exe
  C:\Windows\System\UoRdaXV.exe
  2⤵
  PID:9704
- C:\Windows\System\exDTrjM.exe
  C:\Windows\System\exDTrjM.exe
  2⤵
  PID:9752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ApIvliy.exe

Filesize
1.7MB

MD5
b0989672342c7c5c16871bb7780b6955

SHA1
283e7b42673c10884c3cd2ac8aed86c3a5ee7278

SHA256
da10ed904298cbab2ce7b7d3415a3f4a76deccccfb351702170304cf628863a7

SHA512
e39caea600c07191c9ebcf6b546c12d3310ce7b64d0c52b9ffeefdd16c57a0cf9affc1709b6d569354b75425b06b161a57170aaf18361e1b6f751149a9f2cf89

Download Submit
C:\Windows\system\BUTFozv.exe

Filesize
1.7MB

MD5
f6e9b0a94f3aad58bac2bd014f82a8b3

SHA1
7a7f0e2a0e168039af5b1674d55479f0991eaacf

SHA256
ecad6b928a824e6230c9fc048f75c1a5465a53d71024fd6a5490000869701a9e

SHA512
643ae3753230d8a4bca4300c01d1d278f5a51727e992c61bb3a19740cc0a6484ec5dec86a50547dbf372c9393c48bfa1893b5f083833c019dcd62d75012272dc

Download Submit
C:\Windows\system\BnCJpbA.exe

Filesize
1.7MB

MD5
8ad2ba74498c7a9e006a4495066cd395

SHA1
a80de86bdab1cab671bb7a2debc9b5af03c16f4f

SHA256
bf8300ed753198f9fadef587fdb11a30c7c029a5d0e58304d0cfa46bdaea0994

SHA512
26d849f9670ce87a6958d05b01453e53c30f2b0ee945846c300987afba168e2164492745ef982aab8739ea0a1bfd2d45fb6877a47db78db85e002ea9f9daba80

Download Submit
C:\Windows\system\CtiGnAu.exe

Filesize
1.7MB

MD5
08c5e3865ee6733dff5a051dc198e740

SHA1
d024090e561ef5dd10a215a3f60795187d9565ca

SHA256
738a79bfcf2452add53537d57381add8000bbc3925c4af3dfccbcdbca041fd6b

SHA512
7dbce1ec3d57ca6305c0b1448a0acc6de3f73b6d20842f4f3a653549c0d63a1b1501e76dc62cd2d58af72a2a9e73b59e252e88607e3bb2db07773759f15be02e

Download Submit
C:\Windows\system\ESiEwOk.exe

Filesize
1.7MB

MD5
89299fe3af174c7f368cd1e6228d8a0c

SHA1
3fd04a8eeab174e6a78b68342d68393d50b649eb

SHA256
d4cc80b13c0f346606b639e7777b24b8d0deaa356db6fda7fb7284892f25ecb5

SHA512
8b8d39d75fc68fef0b5c3af080d8a8a78489e7893e46b49f2c010e2aa3a67ecb25632ed88e1ef3050a3fd65cd558abab666ecced9cadf96ecc39bc29e916b74c

Download Submit
C:\Windows\system\ElsRQCC.exe

Filesize
1.7MB

MD5
4165606c56ac4301905debe36916b602

SHA1
4cb859969c0f2ac3cf738e50ccab2eae349f5064

SHA256
011614103becce8cc8b2857003df2e657461e3234ffa06c8e2a729ba2ee3a3a9

SHA512
b5a4264d9af490869efda424e9d0bbb11f5209eda437f290a25aea94a4301c9ed09cb29bc1a40e71977a0bf0a1de999b7c290fb0a2ee3f24e78a43f0936e2691

Download Submit
C:\Windows\system\HGCbwlT.exe

Filesize
1.7MB

MD5
f7432ce50fa708022cf4294f1d822a27

SHA1
804b1eff520c9bed89c25dcd3ba310cecef7c340

SHA256
6f902462ba8d5e888bdebaf0afc594b05ae5540f8b5a86f3ad49d5accf5455bd

SHA512
e3427500178321ff07a608660cd9e1fffdef652c087d8bfb4882616b026ee2ab1ad48ec49f190f3beea3d9e33d41528a7e1a9834f366b078c20d11992d921c2e

Download Submit
C:\Windows\system\JcjfMes.exe

Filesize
1.7MB

MD5
1770ffd13853a50da8c47f02aee1102b

SHA1
e73b728decfac02249220211c402270f8b2275cd

SHA256
bcc73be387007e78e583d112c6a9b906475f59323aa51a510d3da1b340e2b434

SHA512
dd454a87c7da5c1e815aad8ba2295ecb30e636723fc5d623f3036626ca88dc063c85c94e9e618c4237ea1fa99a9837d3b536804dc8feed99ae96e7c6870dc563

Download Submit
C:\Windows\system\JmrsHyX.exe

Filesize
1.7MB

MD5
e89df11339fbb57ea010327f74163713

SHA1
f357f5bc6d803790195effc10c1515065490fba1

SHA256
0ae87bc8e386864227f71d8a1226a2d7fae0dcc5effbe9d515a7e6f455c09198

SHA512
36e9cd4255395665095b296d5c7d29a5327abdaa708dfe37c6ec6976b39772f6d1a0243085187017d1cf1cefe41444c9496770388cd8e9145cd1e76894115168

Download Submit
C:\Windows\system\JsxIphT.exe

Filesize
1.7MB

MD5
863b4bbbe81b5ca92bffbeeec9c75845

SHA1
79001f7a8a53865ed28c998d3bab22413a7d0afc

SHA256
9aacecb22d8aaaae14471620e072c3276a6702fa20d7ffa770ce63e8f3fa9bb3

SHA512
97f77d435bfd31fef8653b50a72d3ebaa1a94ec5ec75ad689c823cb88b2f8ed4a681ad5deca5e09bccc897bcc039e71a49390dfa75928be69c161696164c1c83

Download Submit
C:\Windows\system\KVWGFTg.exe

Filesize
1.7MB

MD5
69519d06cdfdb5e3e661caa520792aff

SHA1
12b4074575927d1357b41b8cdaa6287283d50740

SHA256
c0b851d503ce58227ea1a8de592e10050889e8f73d6b24f8ed2b7ffacfa4169d

SHA512
76ba93e9715e411d3803af33499ff5ece708509626e13d0ae8d69550eaeaf7f4828755d7407b918350a7b121c334346e1022630befe3b53c7a24c39a01e91139

Download Submit
C:\Windows\system\LeOosUL.exe

Filesize
1.7MB

MD5
83ceebcf21e587ce8ee0bd4138c0a49c

SHA1
92ae58f2cfd4bbe43ea150de147d87675441ff18

SHA256
75d34a9bcea62ffef2f3046080fbbdf2f16f986088d18d71b61b8ed70484dd91

SHA512
b3d262815b081d3707474c1e6bc33fd93ec5e85ca2c1dbd303f91bd68f8250c46ed6320534e5142fe5dccdc3f23c294a60bc0384e143bd2f3f8caac923ba9198

Download Submit
C:\Windows\system\LelqUVK.exe

Filesize
1.7MB

MD5
fdbac99ca8d221a048767382115473c4

SHA1
fe083e9c5d898275b23e3cfdb6c2b1d511bc574d

SHA256
6fb4037897574d20b708c1760aa8d973176ec5d77552aed9da28764cd9074277

SHA512
b2cc97483daa660c8130ed7869b56be06f9c421f368a5bc841e5f08c8b24131359e2b080d96f0c7dcd340181b275379f60c6813bdf8981866644af4275877f5d

Download Submit
C:\Windows\system\NGXCenx.exe

Filesize
1.7MB

MD5
b2abf394b0c357c7fa9492e5c858dab0

SHA1
a8f2e6425696ccdf85dd897341545f1e2ac43196

SHA256
c138f9796924fd3a8428da69a5ce71312547ebc7a36c71abb5b6364c6a818c6f

SHA512
a23307e96d12c21f56c0c849ada2f6571bba259b7aa74d3ca14caf095157bd903e6c1b9f4e1d0fccb83f8f39bc0ac173f2a6c6be3473b885a94c64bc0a8c10b2

Download Submit
C:\Windows\system\StNnYDo.exe

Filesize
1.7MB

MD5
eae76d2fa1afb25a4046a945958763e2

SHA1
a078be87df566c5bb4b62fb6e70e61a22f3ecfc1

SHA256
25a73b8610422d002ae6e53cef2a166a34fa6ba218e449b974b76decad5c554e

SHA512
00b0953da973001805906ab42e3c4f7c3555975e561d9e499b183c46585030872df0b950cdc7d30f6157ae8f528f67de782f5df8c9b08fa132468e6baece6bf8

Download Submit
C:\Windows\system\UleBzXx.exe

Filesize
1.7MB

MD5
cf81720e47557d3807e25a47a0c50589

SHA1
ec2acb196a40155b90a619d2b324601df42f21d9

SHA256
7038cdf6cf71d544af54c599605ce8bfec02f7716a97def73d3e89866ac64471

SHA512
ea8af9c55d39adfcdad4806275b3beebd5e6b3320958f53f60313ffebb6558f1423d97e38353a8d15c1a4b48f8bcb9dba9b7ad9650eecdf97d2f88aa96df52b7

Download Submit
C:\Windows\system\VVwRNNC.exe

Filesize
1.7MB

MD5
8bd16f5a20c9cc59ea92c1cc328e731b

SHA1
0198626df1a5ea37368b79f4497aad3c3b7e836c

SHA256
8d56ff8b292fe779a87d53b7fdbae54c51d64e20fb32e4ba04cc19dfc89a0ccb

SHA512
6494e936718cd64bce1c28025d4799173c245459e5cd08bb843208afc5e43c0a228fb44d631480a69e9724dce15cb219c4c1d977aaca5a4a70cd6eb7ede3973d

Download Submit
C:\Windows\system\XmNknjN.exe

Filesize
1.7MB

MD5
2746e0d4a6861ef477a4ac18f41cd41b

SHA1
e6bbb905a980fee115e98b6c465375367a0dd11e

SHA256
23ecfc519b79c47593d96ff31767534c9275d9b1118aaae259d0375117dcd008

SHA512
74c3c33d384d2d4f01e4840930ba7e70c38faae11049732f39b3b92d5b0337bb3cdafd7a0fd4893587deb806cc44aa36c7ff70b23576a6bf483110dacd69e681

Download Submit
C:\Windows\system\ZGxGQFR.exe

Filesize
1.7MB

MD5
e425df95ca604908e5f77c4feeb0c752

SHA1
29e022ea2008fec5f34cba7d562bc3a70cc84c2f

SHA256
3458cfa2407d6a241b87c2f6e989e9392fc07eefa4dd113c792c71c2c6f6216e

SHA512
2f1aa23b64446eab95ba765e782c2da08ad7602ed9fe9985e231903f42998f5f557c526110943d618760886a45aa91271c409b791cf7b69fe279bd0043a66cf2

Download Submit
C:\Windows\system\ZwRhuRU.exe

Filesize
1.7MB

MD5
0a15a57bfd6c5f661e1a579fc49cba4a

SHA1
70ac70463b5fe1938e447a891eb26ff2e6693cde

SHA256
440cb45099ac04fa47b018f47346ba42518eca35c3786bb74274db653e98971d

SHA512
0d5e1b695c6d51f2d2e1d8f900a161b46b00fe04b94fb43ef61ea45e8c223f42fd168dd0c35b04c306d3a4313ded4e95341b6b9c264d1c694d075002aeed4374

Download Submit
C:\Windows\system\cfkLKwu.exe

Filesize
1.7MB

MD5
57e4839afb338ef6354207a1fc690b76

SHA1
3ba946096465c437af9fb896abea8d7a88134041

SHA256
7907a6078a802ca17d6ef4d6c8f07472e5328693b7e3b846356934c880c75c0e

SHA512
a9d7330bac76d8993e9e7f1692a6fb688a5f920dc4c78b6082917820a71c1f84219766320f143675d14b408cdc551983d30d108a1f4c1b8f463a5793915597ce

Download Submit
C:\Windows\system\cnmXPle.exe

Filesize
1.7MB

MD5
a7175b5f1efccabad2aad65be994c43e

SHA1
2a1f72e740ae4eb9207898670ea34e490d3caea9

SHA256
93d19d852395f7d197ca687db8a5725c8d9cfd51a4365fe249be22a6c9e77b7a

SHA512
4b1d0d52d343cef7848cb634cfdefe42db4003cfdb3952618281546c5e727460d8d6b1408b50104bac25dd8bf14f717631f7f6825f5d28e31e18b9238118ac52

Download Submit
C:\Windows\system\dJMRnWk.exe

Filesize
1.7MB

MD5
6a6edfcab719a1624ddaaa2f4c44ee55

SHA1
89cc819b8dcd02c06d58486beff71b04f786cc72

SHA256
279d86e4c7555dd5a3ac523d10e594f045500d1db7eb9137490e335f03f5ff2a

SHA512
0b542be6df806aa07ed26ed1b35c8107f862d241b3e87dd2a95eab4fa2623206634866508e1a0226dca83f9eeedba7c71676f2cba95faddc77ec276ca6e60af5

Download Submit
C:\Windows\system\iDVyFgo.exe

Filesize
1.7MB

MD5
f5912ea3872ba7f1f88048c610105dde

SHA1
c734e12d95925459f31f149f361ae7dfa17e1b16

SHA256
1aca7845e6419be52af0422ce8e9d028fbe2dc39b3be15cbcfe348732c1a4f87

SHA512
139bfe75657fb6d3860eec8b516494b8702ad3cfb3fd9820e905a7fdc8ef5be31552db5f009a28b9f576dbeb31f08d524b5ba8e86f11efa47712c945d348b502

Download Submit
C:\Windows\system\lMPkngE.exe

Filesize
1.7MB

MD5
34f13a998b2ede5b1bf647540b8a58a5

SHA1
276bfffc35a70ab7fc8056cb1d64314267471778

SHA256
199d4d7ae172a7ea8d8ca5e32fa1e11d798238b7293ca755b539c2806293d58d

SHA512
3530385eda65ed68e87c698d6074647c1203e0319f584e31e9d128fe228280753d48fa410eda1bdc0f14948358895dddc9bc7dca6788bef56193228d50c08011

Download Submit
C:\Windows\system\pgWkgfY.exe

Filesize
1.7MB

MD5
da18ffa0c69cb5bb7405a80a709fb0ec

SHA1
79ab48d618a3182633884ac4c63f15d9bcc1d274

SHA256
25db031af7ef3ee45277fb27755d5c03fcae46551cfc6f31ec8366bb044bd4b7

SHA512
eb7d63ac1ca8a93bcab4cee8027793faca63be5459adcca8f4ea321aeeff35e887b697699678d91e6abfc65b7b6d3f4cdb43cfe79293d919f2e0c0973d029507

Download Submit
C:\Windows\system\tiVFfPM.exe

Filesize
1.7MB

MD5
44feab52b879e0dc71d57862f7858448

SHA1
f4912bf23d197d1b5c312465d63096f0d44f94d9

SHA256
a0a2203b3e9f3a39df03882934b8793e7e107b6598ef531973bcf79242fdd8b7

SHA512
b371860cb7b9205cea922a3f1ab794ce2c7e97ccf8ef635152c5182f2bb365991742edc2066e7c3ab0d88eac670dd4b0e3adcf714d4343cf7cdf8a9ff4282b67

Download Submit
C:\Windows\system\zMGXfZO.exe

Filesize
1.7MB

MD5
0e35a45c7ae0a02b567cc0cd9394b636

SHA1
997de8dca9f187e1f4d60b7f0369183626725453

SHA256
6b34686b245b4f5d2ee03f6e79644fab6c71c7200698e7c5482fdc37c79cc1a3

SHA512
35ec66757f7ad40af5d5d66af38f2831517e73b38c03c90b1a76cffdc4d98d8d0bda87bee331817275b8b18baf681f81119ce5d6da3b586c3603e9b1f7914632

Download Submit
C:\Windows\system\zROzrVm.exe

Filesize
1.7MB

MD5
b04b60ad234d96f687cef3957e166ec5

SHA1
8c5bd54ed71bcc6c068a3c2cccfebe7d47c5c11d

SHA256
fd3e18e78d97f625ae61a373b0864405fc9dd26401c72780c30d13ac9387281f

SHA512
6515efc2463ed85d3f6b7d31203606eb16c9fc16993fa025c3f0b2f6b0182eeee42b4979bcf30720cfad6a9c8f140e5f517fc7d6c9b361f3745faceb263ef37b

Download Submit
C:\Windows\system\zsqpCIn.exe

Filesize
1.7MB

MD5
9ac9c24c543a290d05f038b6b03f2dd6

SHA1
52d98c50b9d88aba6092c94da5a7a5c6f371718c

SHA256
1273316fa841caa59f334a34e07c7e0a9bf1850f6e55fc2c208743f0ea2c1555

SHA512
04d5acc85e2b465e9a34d468041ec20efd24eb94bd8c809e1b331c1aea8246f7f346496666c98360c0b875ebaa2b10e1f3006b4ea33deec527ff325c15ae7498

Download Submit
\Windows\system\RzSKJai.exe

Filesize
1.7MB

MD5
13432413132f224e3f052d7b379044a2

SHA1
c17af7ea93a4eb63cbd7fbc6ef7b57adca39a5b8

SHA256
74c85e350ad9a7b5dcdff84dd7fd58d54f40042ea45a21a46fe5fc27968192ad

SHA512
b9f0cb3546c83d7ac19c33ddd158ae0d265ca30d4b2dc3ff0a4fd17aff575b95cb143651cb83fd1e3964b58fae919839335072668bdcd1cb5be77a8a997d821d

Download Submit
\Windows\system\shyQzWi.exe

Filesize
1.7MB

MD5
eda3410334ca0e35214a64d9d9262750

SHA1
223c964895c526acaea6578f5edf749a99320b70

SHA256
2b264aa81ddc711c9919732d4c6e91ffbb0863fec6021f2493212d525b0e1f21

SHA512
ab3aff93add4dde54aa48a3c39edba1e80b9ca40d49089119ccb80895400f3acb23e5ec5a78b9687ae490bbdd0b1b554fb2e280378cadc0553f88e47b545bfbe

Download Submit
\Windows\system\vJeYdes.exe

Filesize
1.7MB

MD5
3da773e00acfc2c452f531a73b016a51

SHA1
c73157a9b2da5a2430b7e990d5eeed44ec6d3dd0

SHA256
db00e87892a6401266cf549abff7cc3d1ed36dd1dd652125b2752986204ea071

SHA512
81d9b6ef37348dd710266cd2f57e758953644629b70689d9b9bb733b04d53847741f98c48e6b0981b625446d6d556ab38225624dc63e271df59a23b10890f40b

Download Submit
memory/2004-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download