xmrig | f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114

Analysis

max time kernel
148s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
Size

1.3MB
MD5

724570932215ecbba321da2e88e74421
SHA1

5fdd1c6ba198db60d18e0d9084a22d30ffb8c129
SHA256

f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114
SHA512

07b4c21ca4bc19774d139eff980e2392800b77ef21fb003fee1482f16ee5d3123e5d3f16f65cb41924f4e43747331bac778c2ad716b3e213fa48e16677d3f03d
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvYF:GezaTF8FcNkNdfE0pZ9ozttwIRakG37y

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012262-5.dat	xmrig
behavioral1/files/0x0009000000016d69-6.dat	xmrig
behavioral1/files/0x0008000000016fc9-14.dat	xmrig
behavioral1/files/0x00070000000170f8-20.dat	xmrig
behavioral1/files/0x000700000001756b-25.dat	xmrig
behavioral1/files/0x000700000001756e-29.dat	xmrig
behavioral1/files/0x0002000000018334-35.dat	xmrig
behavioral1/files/0x0012000000016d3f-40.dat	xmrig
behavioral1/files/0x000600000001932a-49.dat	xmrig
behavioral1/files/0x00080000000186b7-45.dat	xmrig
behavioral1/files/0x00050000000195bd-54.dat	xmrig
behavioral1/files/0x00050000000195c1-60.dat	xmrig
behavioral1/files/0x00050000000195c3-64.dat	xmrig
behavioral1/files/0x00050000000195c6-75.dat	xmrig
behavioral1/files/0x00050000000195c7-79.dat	xmrig
behavioral1/files/0x000500000001960c-84.dat	xmrig
behavioral1/files/0x000500000001975a-94.dat	xmrig
behavioral1/files/0x0005000000019bf5-120.dat	xmrig
behavioral1/files/0x0005000000019bf6-124.dat	xmrig
behavioral1/files/0x0005000000019bf9-129.dat	xmrig
behavioral1/files/0x0005000000019c3c-134.dat	xmrig
behavioral1/files/0x0005000000019d61-140.dat	xmrig
behavioral1/files/0x0005000000019d62-144.dat	xmrig
behavioral1/files/0x0005000000019d6d-149.dat	xmrig
behavioral1/files/0x0005000000019e92-154.dat	xmrig
behavioral1/files/0x0005000000019fd4-159.dat	xmrig
behavioral1/files/0x000500000001998d-114.dat	xmrig
behavioral1/files/0x0005000000019820-109.dat	xmrig
behavioral1/files/0x00050000000197fd-104.dat	xmrig
behavioral1/files/0x0005000000019761-99.dat	xmrig
behavioral1/files/0x0005000000019643-89.dat	xmrig
behavioral1/files/0x00050000000195c5-70.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3000	YyoIuzy.exe
2272	lzluezg.exe
2884	LlPjKsV.exe
2980	SYGKzzn.exe
2844	lfVdYUX.exe
2948	OrVWbZU.exe
2944	DTmnlEZ.exe
3068	WeZafHN.exe
864	idGropx.exe
2788	EMnKSUI.exe
2452	sbAtbSI.exe
2552	FKGoEvi.exe
1784	UiabNtM.exe
2268	CGiDVWg.exe
2412	HkXNgSH.exe
2648	wKdpsCx.exe
1976	KOVTpmn.exe
3012	SbxzYgC.exe
2112	eNdmnNU.exe
1892	XBzrEVz.exe
3036	yzERlHa.exe
2808	TeZDNAb.exe
2152	LlWhiyP.exe
2568	rDwEmyS.exe
2296	gbylUkx.exe
2432	OAbPRQb.exe
1708	hCGhnOA.exe
2288	kpGRHPs.exe
2292	wMnDxDX.exe
288	QfRtGRi.exe
1972	bqJVKuc.exe
2712	fiFkWKX.exe
2164	MTfkVgP.exe
1956	wyohwek.exe
2064	GwwspFD.exe
960	OphRBNW.exe
2012	NtNQgcO.exe
2368	EkVZkcl.exe
1912	msIQnwa.exe
1952	DHgUsGF.exe
1452	sjxQxoa.exe
2636	MGnsDIz.exe
2144	GLTMuys.exe
2360	ciDEhNF.exe
392	CFvdjFn.exe
612	OcHxaHL.exe
1740	dKFYkCY.exe
1620	WpaiIDL.exe
2232	QpgHDSo.exe
812	YaLMVpe.exe
2136	CXVIOxI.exe
2824	AlxebFL.exe
2464	VLiwXfM.exe
2684	uVIQewn.exe
2128	eWmMIBU.exe
2324	UFyRvUP.exe
884	sQFNUYo.exe
2584	gmQtzIB.exe
2124	dvrEEBP.exe
3064	aUYbibY.exe
2932	lXDrntK.exe
2976	icywADW.exe
2276	VEHXBUB.exe
1468	NxPvqOj.exe

Loads dropped DLL 64 IoCs

pid	Process
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KdHAAiG.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\yQlaJfi.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\ZvqbpuF.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\sChsYPM.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\FOtlvnA.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\xZXkFAM.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\YyoIuzy.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\rQjjjxc.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\EFLCAPA.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\VflYHDm.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\zZvzuDK.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\eFXgcYa.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\NapxBeH.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\mLtXQFp.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\CeCOQyj.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\cyqNmWP.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\OKKGDbi.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\ccaJwZN.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\stZEmjZ.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\LZsRltG.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\ngqusVI.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\TVuVeWM.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\PalPJSH.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\tZhSxsI.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\jeNhxmR.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\SfYIVKF.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\fiHIlSb.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\AoNhPKh.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\aOYPnok.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\pwVrtkC.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\wGycsTt.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\qcAgbTI.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\GIWLCor.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\CbIDaYY.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\UYfneII.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\jpsDsZj.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\IaKgqnT.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\YVxbmsd.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\zNQXnzP.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\byWnNCP.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\CZypZHq.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\pnQaEYB.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\InDieMp.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\ltaWScD.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\OAtdYUp.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\cOwPYwE.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\kameXlq.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\PFWMEtL.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\vowNHjm.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\VNbDHar.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\wCBLBrW.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\YJlWXzU.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\aCjgflM.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\HEgFnDd.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\pPnpZiz.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\yBDjazy.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\owHkcJm.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\wvZwBPu.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\GZLZfFC.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\xzwYaBt.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\UJLZRWc.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\kffRYJo.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\XOFimMA.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
File created	C:\Windows\System\AcnnHuY.exe	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3000	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	31
PID 2820 wrote to memory of 3000	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	31
PID 2820 wrote to memory of 3000	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	31
PID 2820 wrote to memory of 2272	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	32
PID 2820 wrote to memory of 2272	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	32
PID 2820 wrote to memory of 2272	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	32
PID 2820 wrote to memory of 2884	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	33
PID 2820 wrote to memory of 2884	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	33
PID 2820 wrote to memory of 2884	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	33
PID 2820 wrote to memory of 2980	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	34
PID 2820 wrote to memory of 2980	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	34
PID 2820 wrote to memory of 2980	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	34
PID 2820 wrote to memory of 2844	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	35
PID 2820 wrote to memory of 2844	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	35
PID 2820 wrote to memory of 2844	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	35
PID 2820 wrote to memory of 2948	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	36
PID 2820 wrote to memory of 2948	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	36
PID 2820 wrote to memory of 2948	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	36
PID 2820 wrote to memory of 2944	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	37
PID 2820 wrote to memory of 2944	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	37
PID 2820 wrote to memory of 2944	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	37
PID 2820 wrote to memory of 3068	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	38
PID 2820 wrote to memory of 3068	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	38
PID 2820 wrote to memory of 3068	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	38
PID 2820 wrote to memory of 864	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	39
PID 2820 wrote to memory of 864	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	39
PID 2820 wrote to memory of 864	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	39
PID 2820 wrote to memory of 2788	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	40
PID 2820 wrote to memory of 2788	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	40
PID 2820 wrote to memory of 2788	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	40
PID 2820 wrote to memory of 2452	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	41
PID 2820 wrote to memory of 2452	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	41
PID 2820 wrote to memory of 2452	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	41
PID 2820 wrote to memory of 2552	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	42
PID 2820 wrote to memory of 2552	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	42
PID 2820 wrote to memory of 2552	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	42
PID 2820 wrote to memory of 1784	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	43
PID 2820 wrote to memory of 1784	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	43
PID 2820 wrote to memory of 1784	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	43
PID 2820 wrote to memory of 2268	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	44
PID 2820 wrote to memory of 2268	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	44
PID 2820 wrote to memory of 2268	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	44
PID 2820 wrote to memory of 2412	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	45
PID 2820 wrote to memory of 2412	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	45
PID 2820 wrote to memory of 2412	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	45
PID 2820 wrote to memory of 2648	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	46
PID 2820 wrote to memory of 2648	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	46
PID 2820 wrote to memory of 2648	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	46
PID 2820 wrote to memory of 1976	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	47
PID 2820 wrote to memory of 1976	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	47
PID 2820 wrote to memory of 1976	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	47
PID 2820 wrote to memory of 3012	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	48
PID 2820 wrote to memory of 3012	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	48
PID 2820 wrote to memory of 3012	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	48
PID 2820 wrote to memory of 2112	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	49
PID 2820 wrote to memory of 2112	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	49
PID 2820 wrote to memory of 2112	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	49
PID 2820 wrote to memory of 1892	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	50
PID 2820 wrote to memory of 1892	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	50
PID 2820 wrote to memory of 1892	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	50
PID 2820 wrote to memory of 3036	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	51
PID 2820 wrote to memory of 3036	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	51
PID 2820 wrote to memory of 3036	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	51
PID 2820 wrote to memory of 2808	2820	f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe	52

C:\Users\Admin\AppData\Local\Temp\f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe
"C:\Users\Admin\AppData\Local\Temp\f51e367e767a3eecfdbfb2cefba01154eebe04bb44426b1774087d5d99d2e114.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\System\YyoIuzy.exe
  C:\Windows\System\YyoIuzy.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\lzluezg.exe
  C:\Windows\System\lzluezg.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\LlPjKsV.exe
  C:\Windows\System\LlPjKsV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\SYGKzzn.exe
  C:\Windows\System\SYGKzzn.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\lfVdYUX.exe
  C:\Windows\System\lfVdYUX.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\OrVWbZU.exe
  C:\Windows\System\OrVWbZU.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\DTmnlEZ.exe
  C:\Windows\System\DTmnlEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\WeZafHN.exe
  C:\Windows\System\WeZafHN.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\idGropx.exe
  C:\Windows\System\idGropx.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\EMnKSUI.exe
  C:\Windows\System\EMnKSUI.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\sbAtbSI.exe
  C:\Windows\System\sbAtbSI.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\FKGoEvi.exe
  C:\Windows\System\FKGoEvi.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\UiabNtM.exe
  C:\Windows\System\UiabNtM.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\CGiDVWg.exe
  C:\Windows\System\CGiDVWg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\HkXNgSH.exe
  C:\Windows\System\HkXNgSH.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wKdpsCx.exe
  C:\Windows\System\wKdpsCx.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\KOVTpmn.exe
  C:\Windows\System\KOVTpmn.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\SbxzYgC.exe
  C:\Windows\System\SbxzYgC.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\eNdmnNU.exe
  C:\Windows\System\eNdmnNU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\XBzrEVz.exe
  C:\Windows\System\XBzrEVz.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\yzERlHa.exe
  C:\Windows\System\yzERlHa.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\TeZDNAb.exe
  C:\Windows\System\TeZDNAb.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\LlWhiyP.exe
  C:\Windows\System\LlWhiyP.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\rDwEmyS.exe
  C:\Windows\System\rDwEmyS.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\gbylUkx.exe
  C:\Windows\System\gbylUkx.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\OAbPRQb.exe
  C:\Windows\System\OAbPRQb.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\hCGhnOA.exe
  C:\Windows\System\hCGhnOA.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\kpGRHPs.exe
  C:\Windows\System\kpGRHPs.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\wMnDxDX.exe
  C:\Windows\System\wMnDxDX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QfRtGRi.exe
  C:\Windows\System\QfRtGRi.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\bqJVKuc.exe
  C:\Windows\System\bqJVKuc.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\fiFkWKX.exe
  C:\Windows\System\fiFkWKX.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\MTfkVgP.exe
  C:\Windows\System\MTfkVgP.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\wyohwek.exe
  C:\Windows\System\wyohwek.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\GwwspFD.exe
  C:\Windows\System\GwwspFD.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\OphRBNW.exe
  C:\Windows\System\OphRBNW.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\NtNQgcO.exe
  C:\Windows\System\NtNQgcO.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\EkVZkcl.exe
  C:\Windows\System\EkVZkcl.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\msIQnwa.exe
  C:\Windows\System\msIQnwa.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\DHgUsGF.exe
  C:\Windows\System\DHgUsGF.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\sjxQxoa.exe
  C:\Windows\System\sjxQxoa.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\MGnsDIz.exe
  C:\Windows\System\MGnsDIz.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\GLTMuys.exe
  C:\Windows\System\GLTMuys.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ciDEhNF.exe
  C:\Windows\System\ciDEhNF.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\CFvdjFn.exe
  C:\Windows\System\CFvdjFn.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\dKFYkCY.exe
  C:\Windows\System\dKFYkCY.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\OcHxaHL.exe
  C:\Windows\System\OcHxaHL.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\QpgHDSo.exe
  C:\Windows\System\QpgHDSo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\WpaiIDL.exe
  C:\Windows\System\WpaiIDL.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\YaLMVpe.exe
  C:\Windows\System\YaLMVpe.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\CXVIOxI.exe
  C:\Windows\System\CXVIOxI.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\AlxebFL.exe
  C:\Windows\System\AlxebFL.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\VLiwXfM.exe
  C:\Windows\System\VLiwXfM.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\uVIQewn.exe
  C:\Windows\System\uVIQewn.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\eWmMIBU.exe
  C:\Windows\System\eWmMIBU.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\UFyRvUP.exe
  C:\Windows\System\UFyRvUP.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\sQFNUYo.exe
  C:\Windows\System\sQFNUYo.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\gmQtzIB.exe
  C:\Windows\System\gmQtzIB.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\dvrEEBP.exe
  C:\Windows\System\dvrEEBP.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\aUYbibY.exe
  C:\Windows\System\aUYbibY.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\lXDrntK.exe
  C:\Windows\System\lXDrntK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\VEHXBUB.exe
  C:\Windows\System\VEHXBUB.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\icywADW.exe
  C:\Windows\System\icywADW.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\TmTaYWm.exe
  C:\Windows\System\TmTaYWm.exe
  2⤵
  PID:2952
- C:\Windows\System\NxPvqOj.exe
  C:\Windows\System\NxPvqOj.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\vyqDhuy.exe
  C:\Windows\System\vyqDhuy.exe
  2⤵
  PID:2928
- C:\Windows\System\GiMMbnf.exe
  C:\Windows\System\GiMMbnf.exe
  2⤵
  PID:2972
- C:\Windows\System\EjEDUhU.exe
  C:\Windows\System\EjEDUhU.exe
  2⤵
  PID:2848
- C:\Windows\System\VIOkKRi.exe
  C:\Windows\System\VIOkKRi.exe
  2⤵
  PID:2720
- C:\Windows\System\wiSOFWU.exe
  C:\Windows\System\wiSOFWU.exe
  2⤵
  PID:2992
- C:\Windows\System\uZSPRcV.exe
  C:\Windows\System\uZSPRcV.exe
  2⤵
  PID:1624
- C:\Windows\System\fosHwBh.exe
  C:\Windows\System\fosHwBh.exe
  2⤵
  PID:1640
- C:\Windows\System\RAFhkKv.exe
  C:\Windows\System\RAFhkKv.exe
  2⤵
  PID:1348
- C:\Windows\System\LSzREzR.exe
  C:\Windows\System\LSzREzR.exe
  2⤵
  PID:3044
- C:\Windows\System\zkFmUnF.exe
  C:\Windows\System\zkFmUnF.exe
  2⤵
  PID:3004
- C:\Windows\System\ozENyYp.exe
  C:\Windows\System\ozENyYp.exe
  2⤵
  PID:2876
- C:\Windows\System\EKjyJrM.exe
  C:\Windows\System\EKjyJrM.exe
  2⤵
  PID:2776
- C:\Windows\System\MdzhMwU.exe
  C:\Windows\System\MdzhMwU.exe
  2⤵
  PID:2484
- C:\Windows\System\FwdCaXv.exe
  C:\Windows\System\FwdCaXv.exe
  2⤵
  PID:1396
- C:\Windows\System\LlnUudu.exe
  C:\Windows\System\LlnUudu.exe
  2⤵
  PID:1496
- C:\Windows\System\WAVlfbk.exe
  C:\Windows\System\WAVlfbk.exe
  2⤵
  PID:2196
- C:\Windows\System\BpKfnrW.exe
  C:\Windows\System\BpKfnrW.exe
  2⤵
  PID:1160
- C:\Windows\System\NkfyjFb.exe
  C:\Windows\System\NkfyjFb.exe
  2⤵
  PID:1404
- C:\Windows\System\Okhydcb.exe
  C:\Windows\System\Okhydcb.exe
  2⤵
  PID:1644
- C:\Windows\System\XGswmOC.exe
  C:\Windows\System\XGswmOC.exe
  2⤵
  PID:2704
- C:\Windows\System\BPEGFwH.exe
  C:\Windows\System\BPEGFwH.exe
  2⤵
  PID:1060
- C:\Windows\System\eiwOAWI.exe
  C:\Windows\System\eiwOAWI.exe
  2⤵
  PID:584
- C:\Windows\System\qYHVHwd.exe
  C:\Windows\System\qYHVHwd.exe
  2⤵
  PID:872
- C:\Windows\System\CxkSXwB.exe
  C:\Windows\System\CxkSXwB.exe
  2⤵
  PID:1456
- C:\Windows\System\DBrMgow.exe
  C:\Windows\System\DBrMgow.exe
  2⤵
  PID:1040
- C:\Windows\System\rfBvFYk.exe
  C:\Windows\System\rfBvFYk.exe
  2⤵
  PID:2668
- C:\Windows\System\HtqmDws.exe
  C:\Windows\System\HtqmDws.exe
  2⤵
  PID:1940
- C:\Windows\System\BGERyHR.exe
  C:\Windows\System\BGERyHR.exe
  2⤵
  PID:1084
- C:\Windows\System\zNQXnzP.exe
  C:\Windows\System\zNQXnzP.exe
  2⤵
  PID:2376
- C:\Windows\System\ADoZatg.exe
  C:\Windows\System\ADoZatg.exe
  2⤵
  PID:908
- C:\Windows\System\TTaGAiN.exe
  C:\Windows\System\TTaGAiN.exe
  2⤵
  PID:1716
- C:\Windows\System\NIvozOK.exe
  C:\Windows\System\NIvozOK.exe
  2⤵
  PID:2544
- C:\Windows\System\jwwnoJl.exe
  C:\Windows\System\jwwnoJl.exe
  2⤵
  PID:2028
- C:\Windows\System\bFTHkoM.exe
  C:\Windows\System\bFTHkoM.exe
  2⤵
  PID:1004
- C:\Windows\System\JeXTMnG.exe
  C:\Windows\System\JeXTMnG.exe
  2⤵
  PID:2132
- C:\Windows\System\xPuvOzG.exe
  C:\Windows\System\xPuvOzG.exe
  2⤵
  PID:2840
- C:\Windows\System\bJwKUZT.exe
  C:\Windows\System\bJwKUZT.exe
  2⤵
  PID:1588
- C:\Windows\System\jKDkGpu.exe
  C:\Windows\System\jKDkGpu.exe
  2⤵
  PID:2260
- C:\Windows\System\GgVrwsV.exe
  C:\Windows\System\GgVrwsV.exe
  2⤵
  PID:2284
- C:\Windows\System\JDbgJqB.exe
  C:\Windows\System\JDbgJqB.exe
  2⤵
  PID:2624
- C:\Windows\System\zEiaGxq.exe
  C:\Windows\System\zEiaGxq.exe
  2⤵
  PID:2092
- C:\Windows\System\UlhKXBy.exe
  C:\Windows\System\UlhKXBy.exe
  2⤵
  PID:2940
- C:\Windows\System\CbIDaYY.exe
  C:\Windows\System\CbIDaYY.exe
  2⤵
  PID:2176
- C:\Windows\System\XIDmSbC.exe
  C:\Windows\System\XIDmSbC.exe
  2⤵
  PID:1096
- C:\Windows\System\edKpGVp.exe
  C:\Windows\System\edKpGVp.exe
  2⤵
  PID:2924
- C:\Windows\System\ZOCPWOJ.exe
  C:\Windows\System\ZOCPWOJ.exe
  2⤵
  PID:1704
- C:\Windows\System\rpyWqmO.exe
  C:\Windows\System\rpyWqmO.exe
  2⤵
  PID:2244
- C:\Windows\System\LlbhMAt.exe
  C:\Windows\System\LlbhMAt.exe
  2⤵
  PID:1124
- C:\Windows\System\mbvvqMW.exe
  C:\Windows\System\mbvvqMW.exe
  2⤵
  PID:2080
- C:\Windows\System\TkqwkKx.exe
  C:\Windows\System\TkqwkKx.exe
  2⤵
  PID:940
- C:\Windows\System\oXDFWvs.exe
  C:\Windows\System\oXDFWvs.exe
  2⤵
  PID:2700
- C:\Windows\System\yAiHNUO.exe
  C:\Windows\System\yAiHNUO.exe
  2⤵
  PID:2488
- C:\Windows\System\IhkNsvJ.exe
  C:\Windows\System\IhkNsvJ.exe
  2⤵
  PID:3008
- C:\Windows\System\EwHzGCB.exe
  C:\Windows\System\EwHzGCB.exe
  2⤵
  PID:2096
- C:\Windows\System\FIHPfCN.exe
  C:\Windows\System\FIHPfCN.exe
  2⤵
  PID:2900
- C:\Windows\System\KSaZLuX.exe
  C:\Windows\System\KSaZLuX.exe
  2⤵
  PID:2828
- C:\Windows\System\yxlonin.exe
  C:\Windows\System\yxlonin.exe
  2⤵
  PID:2020
- C:\Windows\System\TtqumhQ.exe
  C:\Windows\System\TtqumhQ.exe
  2⤵
  PID:2456
- C:\Windows\System\UoXLSdk.exe
  C:\Windows\System\UoXLSdk.exe
  2⤵
  PID:3040
- C:\Windows\System\QFWMqmE.exe
  C:\Windows\System\QFWMqmE.exe
  2⤵
  PID:2116
- C:\Windows\System\auyclbP.exe
  C:\Windows\System\auyclbP.exe
  2⤵
  PID:2320
- C:\Windows\System\lUbJBhB.exe
  C:\Windows\System\lUbJBhB.exe
  2⤵
  PID:1120
- C:\Windows\System\LMUISod.exe
  C:\Windows\System\LMUISod.exe
  2⤵
  PID:928
- C:\Windows\System\HxvfpDk.exe
  C:\Windows\System\HxvfpDk.exe
  2⤵
  PID:1616
- C:\Windows\System\UoYnUKC.exe
  C:\Windows\System\UoYnUKC.exe
  2⤵
  PID:1520
- C:\Windows\System\MiQhFYD.exe
  C:\Windows\System\MiQhFYD.exe
  2⤵
  PID:2204
- C:\Windows\System\fbzJFqS.exe
  C:\Windows\System\fbzJFqS.exe
  2⤵
  PID:948
- C:\Windows\System\tALzRCD.exe
  C:\Windows\System\tALzRCD.exe
  2⤵
  PID:1748
- C:\Windows\System\POWcnCs.exe
  C:\Windows\System\POWcnCs.exe
  2⤵
  PID:2572
- C:\Windows\System\uPXJUTq.exe
  C:\Windows\System\uPXJUTq.exe
  2⤵
  PID:1692
- C:\Windows\System\UYfneII.exe
  C:\Windows\System\UYfneII.exe
  2⤵
  PID:2996
- C:\Windows\System\YLKDopm.exe
  C:\Windows\System\YLKDopm.exe
  2⤵
  PID:2100
- C:\Windows\System\gaukcbx.exe
  C:\Windows\System\gaukcbx.exe
  2⤵
  PID:2956
- C:\Windows\System\ZvPXNpb.exe
  C:\Windows\System\ZvPXNpb.exe
  2⤵
  PID:1648
- C:\Windows\System\EUnLClk.exe
  C:\Windows\System\EUnLClk.exe
  2⤵
  PID:2736
- C:\Windows\System\fkdUbJy.exe
  C:\Windows\System\fkdUbJy.exe
  2⤵
  PID:620
- C:\Windows\System\UHGYhdx.exe
  C:\Windows\System\UHGYhdx.exe
  2⤵
  PID:2380
- C:\Windows\System\xIBUUhM.exe
  C:\Windows\System\xIBUUhM.exe
  2⤵
  PID:1332
- C:\Windows\System\KrtPCfR.exe
  C:\Windows\System\KrtPCfR.exe
  2⤵
  PID:2936
- C:\Windows\System\UuUdLnM.exe
  C:\Windows\System\UuUdLnM.exe
  2⤵
  PID:1900
- C:\Windows\System\YdkLCBR.exe
  C:\Windows\System\YdkLCBR.exe
  2⤵
  PID:2172
- C:\Windows\System\rciUjbQ.exe
  C:\Windows\System\rciUjbQ.exe
  2⤵
  PID:2436
- C:\Windows\System\yogtJNH.exe
  C:\Windows\System\yogtJNH.exe
  2⤵
  PID:1136
- C:\Windows\System\bkoaBJI.exe
  C:\Windows\System\bkoaBJI.exe
  2⤵
  PID:932
- C:\Windows\System\fRuEJiD.exe
  C:\Windows\System\fRuEJiD.exe
  2⤵
  PID:1196
- C:\Windows\System\qPAoJUe.exe
  C:\Windows\System\qPAoJUe.exe
  2⤵
  PID:1700
- C:\Windows\System\cyqNmWP.exe
  C:\Windows\System\cyqNmWP.exe
  2⤵
  PID:760
- C:\Windows\System\mkIeWns.exe
  C:\Windows\System\mkIeWns.exe
  2⤵
  PID:2672
- C:\Windows\System\MBkjMkD.exe
  C:\Windows\System\MBkjMkD.exe
  2⤵
  PID:1448
- C:\Windows\System\MSQtkuS.exe
  C:\Windows\System\MSQtkuS.exe
  2⤵
  PID:1592
- C:\Windows\System\TNpFCkA.exe
  C:\Windows\System\TNpFCkA.exe
  2⤵
  PID:2896
- C:\Windows\System\izhXnle.exe
  C:\Windows\System\izhXnle.exe
  2⤵
  PID:2348
- C:\Windows\System\yTOKgYZ.exe
  C:\Windows\System\yTOKgYZ.exe
  2⤵
  PID:364
- C:\Windows\System\LemTZuw.exe
  C:\Windows\System\LemTZuw.exe
  2⤵
  PID:832
- C:\Windows\System\iKMfrHa.exe
  C:\Windows\System\iKMfrHa.exe
  2⤵
  PID:1088
- C:\Windows\System\cbQhAuo.exe
  C:\Windows\System\cbQhAuo.exe
  2⤵
  PID:2384
- C:\Windows\System\CBMVqdY.exe
  C:\Windows\System\CBMVqdY.exe
  2⤵
  PID:2428
- C:\Windows\System\zMhFxRn.exe
  C:\Windows\System\zMhFxRn.exe
  2⤵
  PID:3060
- C:\Windows\System\wxUqmHK.exe
  C:\Windows\System\wxUqmHK.exe
  2⤵
  PID:2388
- C:\Windows\System\Mkfeaas.exe
  C:\Windows\System\Mkfeaas.exe
  2⤵
  PID:892
- C:\Windows\System\GUtYrMF.exe
  C:\Windows\System\GUtYrMF.exe
  2⤵
  PID:304
- C:\Windows\System\qQXQRZr.exe
  C:\Windows\System\qQXQRZr.exe
  2⤵
  PID:2588
- C:\Windows\System\UnStFgf.exe
  C:\Windows\System\UnStFgf.exe
  2⤵
  PID:1828
- C:\Windows\System\HrXKMbL.exe
  C:\Windows\System\HrXKMbL.exe
  2⤵
  PID:3032
- C:\Windows\System\sxORmoy.exe
  C:\Windows\System\sxORmoy.exe
  2⤵
  PID:836
- C:\Windows\System\SOLCVSF.exe
  C:\Windows\System\SOLCVSF.exe
  2⤵
  PID:1100
- C:\Windows\System\UVOVWGL.exe
  C:\Windows\System\UVOVWGL.exe
  2⤵
  PID:2540
- C:\Windows\System\jqWyGlX.exe
  C:\Windows\System\jqWyGlX.exe
  2⤵
  PID:2160
- C:\Windows\System\UAMrzoJ.exe
  C:\Windows\System\UAMrzoJ.exe
  2⤵
  PID:1600
- C:\Windows\System\NJnqIwg.exe
  C:\Windows\System\NJnqIwg.exe
  2⤵
  PID:2852
- C:\Windows\System\SwMcyjm.exe
  C:\Windows\System\SwMcyjm.exe
  2⤵
  PID:2084
- C:\Windows\System\BOaKyXk.exe
  C:\Windows\System\BOaKyXk.exe
  2⤵
  PID:936
- C:\Windows\System\mPLYELs.exe
  C:\Windows\System\mPLYELs.exe
  2⤵
  PID:2764
- C:\Windows\System\eAWJHsd.exe
  C:\Windows\System\eAWJHsd.exe
  2⤵
  PID:2492
- C:\Windows\System\txvaPja.exe
  C:\Windows\System\txvaPja.exe
  2⤵
  PID:800
- C:\Windows\System\CiqVIuZ.exe
  C:\Windows\System\CiqVIuZ.exe
  2⤵
  PID:3056
- C:\Windows\System\LNGXxZn.exe
  C:\Windows\System\LNGXxZn.exe
  2⤵
  PID:2000
- C:\Windows\System\DRCxvVn.exe
  C:\Windows\System\DRCxvVn.exe
  2⤵
  PID:2396
- C:\Windows\System\dqIGsAK.exe
  C:\Windows\System\dqIGsAK.exe
  2⤵
  PID:3088
- C:\Windows\System\Mihrlij.exe
  C:\Windows\System\Mihrlij.exe
  2⤵
  PID:3104
- C:\Windows\System\WupUQAP.exe
  C:\Windows\System\WupUQAP.exe
  2⤵
  PID:3132
- C:\Windows\System\vNdcyGr.exe
  C:\Windows\System\vNdcyGr.exe
  2⤵
  PID:3152
- C:\Windows\System\DhgJRqg.exe
  C:\Windows\System\DhgJRqg.exe
  2⤵
  PID:3172
- C:\Windows\System\WxmUOXU.exe
  C:\Windows\System\WxmUOXU.exe
  2⤵
  PID:3188
- C:\Windows\System\kUjihNB.exe
  C:\Windows\System\kUjihNB.exe
  2⤵
  PID:3212
- C:\Windows\System\UoFgaeX.exe
  C:\Windows\System\UoFgaeX.exe
  2⤵
  PID:3228
- C:\Windows\System\OJNVivn.exe
  C:\Windows\System\OJNVivn.exe
  2⤵
  PID:3252
- C:\Windows\System\rxuyLLo.exe
  C:\Windows\System\rxuyLLo.exe
  2⤵
  PID:3272
- C:\Windows\System\RICXIiQ.exe
  C:\Windows\System\RICXIiQ.exe
  2⤵
  PID:3288
- C:\Windows\System\OAtdYUp.exe
  C:\Windows\System\OAtdYUp.exe
  2⤵
  PID:3312
- C:\Windows\System\QnpBMlg.exe
  C:\Windows\System\QnpBMlg.exe
  2⤵
  PID:3328
- C:\Windows\System\XOZqNgG.exe
  C:\Windows\System\XOZqNgG.exe
  2⤵
  PID:3352
- C:\Windows\System\cOwPYwE.exe
  C:\Windows\System\cOwPYwE.exe
  2⤵
  PID:3368
- C:\Windows\System\zGXdxQn.exe
  C:\Windows\System\zGXdxQn.exe
  2⤵
  PID:3388
- C:\Windows\System\rTOvhrt.exe
  C:\Windows\System\rTOvhrt.exe
  2⤵
  PID:3412
- C:\Windows\System\toJoTbo.exe
  C:\Windows\System\toJoTbo.exe
  2⤵
  PID:3428
- C:\Windows\System\RYmmUEO.exe
  C:\Windows\System\RYmmUEO.exe
  2⤵
  PID:3452
- C:\Windows\System\LtJIAnM.exe
  C:\Windows\System\LtJIAnM.exe
  2⤵
  PID:3468
- C:\Windows\System\uKRjybD.exe
  C:\Windows\System\uKRjybD.exe
  2⤵
  PID:3488
- C:\Windows\System\ZlGudMy.exe
  C:\Windows\System\ZlGudMy.exe
  2⤵
  PID:3512
- C:\Windows\System\kHkVWZe.exe
  C:\Windows\System\kHkVWZe.exe
  2⤵
  PID:3532
- C:\Windows\System\JVLwQHU.exe
  C:\Windows\System\JVLwQHU.exe
  2⤵
  PID:3548
- C:\Windows\System\LoMJLvK.exe
  C:\Windows\System\LoMJLvK.exe
  2⤵
  PID:3568
- C:\Windows\System\qBAjvet.exe
  C:\Windows\System\qBAjvet.exe
  2⤵
  PID:3588
- C:\Windows\System\XAuDLFq.exe
  C:\Windows\System\XAuDLFq.exe
  2⤵
  PID:3612
- C:\Windows\System\UXknNxO.exe
  C:\Windows\System\UXknNxO.exe
  2⤵
  PID:3628
- C:\Windows\System\gtdbARf.exe
  C:\Windows\System\gtdbARf.exe
  2⤵
  PID:3652
- C:\Windows\System\jIQbkpo.exe
  C:\Windows\System\jIQbkpo.exe
  2⤵
  PID:3672
- C:\Windows\System\PcZCEXP.exe
  C:\Windows\System\PcZCEXP.exe
  2⤵
  PID:3692
- C:\Windows\System\kSaAqRo.exe
  C:\Windows\System\kSaAqRo.exe
  2⤵
  PID:3708
- C:\Windows\System\mIxZKJe.exe
  C:\Windows\System\mIxZKJe.exe
  2⤵
  PID:3732
- C:\Windows\System\PgVnnxo.exe
  C:\Windows\System\PgVnnxo.exe
  2⤵
  PID:3752
- C:\Windows\System\UjdTCVQ.exe
  C:\Windows\System\UjdTCVQ.exe
  2⤵
  PID:3772
- C:\Windows\System\wUznkNr.exe
  C:\Windows\System\wUznkNr.exe
  2⤵
  PID:3788
- C:\Windows\System\dettdvw.exe
  C:\Windows\System\dettdvw.exe
  2⤵
  PID:3812
- C:\Windows\System\NTHNGGd.exe
  C:\Windows\System\NTHNGGd.exe
  2⤵
  PID:3832
- C:\Windows\System\HtmkHrH.exe
  C:\Windows\System\HtmkHrH.exe
  2⤵
  PID:3856
- C:\Windows\System\vBdzoex.exe
  C:\Windows\System\vBdzoex.exe
  2⤵
  PID:3872
- C:\Windows\System\lAJFPJN.exe
  C:\Windows\System\lAJFPJN.exe
  2⤵
  PID:3892
- C:\Windows\System\MdEkveH.exe
  C:\Windows\System\MdEkveH.exe
  2⤵
  PID:3908
- C:\Windows\System\spkrFiK.exe
  C:\Windows\System\spkrFiK.exe
  2⤵
  PID:3924
- C:\Windows\System\KmILHao.exe
  C:\Windows\System\KmILHao.exe
  2⤵
  PID:3944
- C:\Windows\System\NnvPXtp.exe
  C:\Windows\System\NnvPXtp.exe
  2⤵
  PID:3964
- C:\Windows\System\mMkoHyE.exe
  C:\Windows\System\mMkoHyE.exe
  2⤵
  PID:3980
- C:\Windows\System\jOwpGCj.exe
  C:\Windows\System\jOwpGCj.exe
  2⤵
  PID:4004
- C:\Windows\System\OkSrmYw.exe
  C:\Windows\System\OkSrmYw.exe
  2⤵
  PID:4020
- C:\Windows\System\plrLrLz.exe
  C:\Windows\System\plrLrLz.exe
  2⤵
  PID:4040
- C:\Windows\System\WfdFDym.exe
  C:\Windows\System\WfdFDym.exe
  2⤵
  PID:4076
- C:\Windows\System\ZByfODJ.exe
  C:\Windows\System\ZByfODJ.exe
  2⤵
  PID:4092
- C:\Windows\System\XOtTRGP.exe
  C:\Windows\System\XOtTRGP.exe
  2⤵
  PID:3084
- C:\Windows\System\UXLTZeG.exe
  C:\Windows\System\UXLTZeG.exe
  2⤵
  PID:3120
- C:\Windows\System\vCeaHMf.exe
  C:\Windows\System\vCeaHMf.exe
  2⤵
  PID:3140
- C:\Windows\System\gDhXLAq.exe
  C:\Windows\System\gDhXLAq.exe
  2⤵
  PID:3168
- C:\Windows\System\GoCfKdu.exe
  C:\Windows\System\GoCfKdu.exe
  2⤵
  PID:3196
- C:\Windows\System\nWTWgph.exe
  C:\Windows\System\nWTWgph.exe
  2⤵
  PID:3236
- C:\Windows\System\Ibcwrpn.exe
  C:\Windows\System\Ibcwrpn.exe
  2⤵
  PID:3260
- C:\Windows\System\qBjqzrM.exe
  C:\Windows\System\qBjqzrM.exe
  2⤵
  PID:3304
- C:\Windows\System\pvTJPeP.exe
  C:\Windows\System\pvTJPeP.exe
  2⤵
  PID:3344
- C:\Windows\System\bkaMIPE.exe
  C:\Windows\System\bkaMIPE.exe
  2⤵
  PID:3364
- C:\Windows\System\RUjOEYq.exe
  C:\Windows\System\RUjOEYq.exe
  2⤵
  PID:3396
- C:\Windows\System\bSvHlZN.exe
  C:\Windows\System\bSvHlZN.exe
  2⤵
  PID:3420
- C:\Windows\System\LIEDrAp.exe
  C:\Windows\System\LIEDrAp.exe
  2⤵
  PID:1932
- C:\Windows\System\ELtLezw.exe
  C:\Windows\System\ELtLezw.exe
  2⤵
  PID:3480
- C:\Windows\System\kOeHSlW.exe
  C:\Windows\System\kOeHSlW.exe
  2⤵
  PID:3500
- C:\Windows\System\FNavaPF.exe
  C:\Windows\System\FNavaPF.exe
  2⤵
  PID:3600
- C:\Windows\System\fBkhWnp.exe
  C:\Windows\System\fBkhWnp.exe
  2⤵
  PID:3620
- C:\Windows\System\risoLCc.exe
  C:\Windows\System\risoLCc.exe
  2⤵
  PID:3640
- C:\Windows\System\rkNIQGO.exe
  C:\Windows\System\rkNIQGO.exe
  2⤵
  PID:3664
- C:\Windows\System\gHmvUCr.exe
  C:\Windows\System\gHmvUCr.exe
  2⤵
  PID:3716
- C:\Windows\System\gyOEehy.exe
  C:\Windows\System\gyOEehy.exe
  2⤵
  PID:3748
- C:\Windows\System\sUPeKHT.exe
  C:\Windows\System\sUPeKHT.exe
  2⤵
  PID:3764
- C:\Windows\System\zXbdQeh.exe
  C:\Windows\System\zXbdQeh.exe
  2⤵
  PID:3804
- C:\Windows\System\cEwiiTB.exe
  C:\Windows\System\cEwiiTB.exe
  2⤵
  PID:3840
- C:\Windows\System\WSCNJCl.exe
  C:\Windows\System\WSCNJCl.exe
  2⤵
  PID:3868
- C:\Windows\System\BphfHLG.exe
  C:\Windows\System\BphfHLG.exe
  2⤵
  PID:3920
- C:\Windows\System\BreBfiW.exe
  C:\Windows\System\BreBfiW.exe
  2⤵
  PID:3972
- C:\Windows\System\tEMwchF.exe
  C:\Windows\System\tEMwchF.exe
  2⤵
  PID:3988
- C:\Windows\System\pupmOUL.exe
  C:\Windows\System\pupmOUL.exe
  2⤵
  PID:4000
- C:\Windows\System\iMNPGYs.exe
  C:\Windows\System\iMNPGYs.exe
  2⤵
  PID:4048
- C:\Windows\System\PpbOxov.exe
  C:\Windows\System\PpbOxov.exe
  2⤵
  PID:4072
- C:\Windows\System\VxuYdle.exe
  C:\Windows\System\VxuYdle.exe
  2⤵
  PID:3180
- C:\Windows\System\jOjgsXz.exe
  C:\Windows\System\jOjgsXz.exe
  2⤵
  PID:3300
- C:\Windows\System\AIldwBb.exe
  C:\Windows\System\AIldwBb.exe
  2⤵
  PID:3380
- C:\Windows\System\CBgIJbZ.exe
  C:\Windows\System\CBgIJbZ.exe
  2⤵
  PID:3220
- C:\Windows\System\aLjIizX.exe
  C:\Windows\System\aLjIizX.exe
  2⤵
  PID:3096
- C:\Windows\System\TmviXLl.exe
  C:\Windows\System\TmviXLl.exe
  2⤵
  PID:3224
- C:\Windows\System\oHiLxba.exe
  C:\Windows\System\oHiLxba.exe
  2⤵
  PID:3284
- C:\Windows\System\mYmiCzy.exe
  C:\Windows\System\mYmiCzy.exe
  2⤵
  PID:3464
- C:\Windows\System\oqMOxFt.exe
  C:\Windows\System\oqMOxFt.exe
  2⤵
  PID:3540
- C:\Windows\System\MBLpjvD.exe
  C:\Windows\System\MBLpjvD.exe
  2⤵
  PID:3544
- C:\Windows\System\PCdKHMX.exe
  C:\Windows\System\PCdKHMX.exe
  2⤵
  PID:3580
- C:\Windows\System\NapxBeH.exe
  C:\Windows\System\NapxBeH.exe
  2⤵
  PID:3636
- C:\Windows\System\MTfbKPc.exe
  C:\Windows\System\MTfbKPc.exe
  2⤵
  PID:3760
- C:\Windows\System\GsGiqZS.exe
  C:\Windows\System\GsGiqZS.exe
  2⤵
  PID:3740
- C:\Windows\System\aQFtaMT.exe
  C:\Windows\System\aQFtaMT.exe
  2⤵
  PID:3864
- C:\Windows\System\ZUBZEVP.exe
  C:\Windows\System\ZUBZEVP.exe
  2⤵
  PID:3828
- C:\Windows\System\iciZdvz.exe
  C:\Windows\System\iciZdvz.exe
  2⤵
  PID:3916
- C:\Windows\System\EoqUhYF.exe
  C:\Windows\System\EoqUhYF.exe
  2⤵
  PID:4068
- C:\Windows\System\EMcnCYp.exe
  C:\Windows\System\EMcnCYp.exe
  2⤵
  PID:3240
- C:\Windows\System\glsDuZi.exe
  C:\Windows\System\glsDuZi.exe
  2⤵
  PID:3504
- C:\Windows\System\aghjqxV.exe
  C:\Windows\System\aghjqxV.exe
  2⤵
  PID:3408
- C:\Windows\System\QkTcNZq.exe
  C:\Windows\System\QkTcNZq.exe
  2⤵
  PID:4032
- C:\Windows\System\CtXpkzO.exe
  C:\Windows\System\CtXpkzO.exe
  2⤵
  PID:3608
- C:\Windows\System\tFuNmcO.exe
  C:\Windows\System\tFuNmcO.exe
  2⤵
  PID:3524
- C:\Windows\System\hMMkpTO.exe
  C:\Windows\System\hMMkpTO.exe
  2⤵
  PID:3644
- C:\Windows\System\oXPlGYU.exe
  C:\Windows\System\oXPlGYU.exe
  2⤵
  PID:3720
- C:\Windows\System\rncKfuK.exe
  C:\Windows\System\rncKfuK.exe
  2⤵
  PID:3808
- C:\Windows\System\IjSnNnO.exe
  C:\Windows\System\IjSnNnO.exe
  2⤵
  PID:3932
- C:\Windows\System\FqhPget.exe
  C:\Windows\System\FqhPget.exe
  2⤵
  PID:4012
- C:\Windows\System\nIzvmFB.exe
  C:\Windows\System\nIzvmFB.exe
  2⤵
  PID:3888
- C:\Windows\System\hSFAqEF.exe
  C:\Windows\System\hSFAqEF.exe
  2⤵
  PID:3184
- C:\Windows\System\nZKaccE.exe
  C:\Windows\System\nZKaccE.exe
  2⤵
  PID:4084
- C:\Windows\System\cYGNUaV.exe
  C:\Windows\System\cYGNUaV.exe
  2⤵
  PID:2596
- C:\Windows\System\HkrfNgT.exe
  C:\Windows\System\HkrfNgT.exe
  2⤵
  PID:3124
- C:\Windows\System\haSsXoZ.exe
  C:\Windows\System\haSsXoZ.exe
  2⤵
  PID:3244
- C:\Windows\System\tdBBagg.exe
  C:\Windows\System\tdBBagg.exe
  2⤵
  PID:3884
- C:\Windows\System\gEIsCgT.exe
  C:\Windows\System\gEIsCgT.exe
  2⤵
  PID:3460
- C:\Windows\System\wjLlnwp.exe
  C:\Windows\System\wjLlnwp.exe
  2⤵
  PID:3728
- C:\Windows\System\DeNYCvN.exe
  C:\Windows\System\DeNYCvN.exe
  2⤵
  PID:4108
- C:\Windows\System\EcnksFe.exe
  C:\Windows\System\EcnksFe.exe
  2⤵
  PID:4136
- C:\Windows\System\hDzbknm.exe
  C:\Windows\System\hDzbknm.exe
  2⤵
  PID:4160
- C:\Windows\System\jwYBYVX.exe
  C:\Windows\System\jwYBYVX.exe
  2⤵
  PID:4180
- C:\Windows\System\iEGYAkW.exe
  C:\Windows\System\iEGYAkW.exe
  2⤵
  PID:4208
- C:\Windows\System\vcHvdbK.exe
  C:\Windows\System\vcHvdbK.exe
  2⤵
  PID:4224
- C:\Windows\System\kEWUxkH.exe
  C:\Windows\System\kEWUxkH.exe
  2⤵
  PID:4240
- C:\Windows\System\AfLwOMH.exe
  C:\Windows\System\AfLwOMH.exe
  2⤵
  PID:4256
- C:\Windows\System\OeHNaPQ.exe
  C:\Windows\System\OeHNaPQ.exe
  2⤵
  PID:4272
- C:\Windows\System\UOxoWGS.exe
  C:\Windows\System\UOxoWGS.exe
  2⤵
  PID:4292
- C:\Windows\System\DnDqNfl.exe
  C:\Windows\System\DnDqNfl.exe
  2⤵
  PID:4312
- C:\Windows\System\aSjCUkk.exe
  C:\Windows\System\aSjCUkk.exe
  2⤵
  PID:4328
- C:\Windows\System\gQhhIAd.exe
  C:\Windows\System\gQhhIAd.exe
  2⤵
  PID:4348
- C:\Windows\System\EulHGYC.exe
  C:\Windows\System\EulHGYC.exe
  2⤵
  PID:4380
- C:\Windows\System\pGrICFl.exe
  C:\Windows\System\pGrICFl.exe
  2⤵
  PID:4440
- C:\Windows\System\yghmxzA.exe
  C:\Windows\System\yghmxzA.exe
  2⤵
  PID:4456
- C:\Windows\System\BKIzYAJ.exe
  C:\Windows\System\BKIzYAJ.exe
  2⤵
  PID:4472
- C:\Windows\System\hYSnRve.exe
  C:\Windows\System\hYSnRve.exe
  2⤵
  PID:4500
- C:\Windows\System\PFylwxI.exe
  C:\Windows\System\PFylwxI.exe
  2⤵
  PID:4516
- C:\Windows\System\KOXdikg.exe
  C:\Windows\System\KOXdikg.exe
  2⤵
  PID:4532
- C:\Windows\System\AWPOYXU.exe
  C:\Windows\System\AWPOYXU.exe
  2⤵
  PID:4552
- C:\Windows\System\yHnvlBS.exe
  C:\Windows\System\yHnvlBS.exe
  2⤵
  PID:4568
- C:\Windows\System\MxfjIZZ.exe
  C:\Windows\System\MxfjIZZ.exe
  2⤵
  PID:4584
- C:\Windows\System\BuYlKTw.exe
  C:\Windows\System\BuYlKTw.exe
  2⤵
  PID:4600
- C:\Windows\System\QUZaLUB.exe
  C:\Windows\System\QUZaLUB.exe
  2⤵
  PID:4616
- C:\Windows\System\KPGamDS.exe
  C:\Windows\System\KPGamDS.exe
  2⤵
  PID:4636
- C:\Windows\System\hVCSULv.exe
  C:\Windows\System\hVCSULv.exe
  2⤵
  PID:4652
- C:\Windows\System\jiJcEbY.exe
  C:\Windows\System\jiJcEbY.exe
  2⤵
  PID:4668
- C:\Windows\System\jsvImlO.exe
  C:\Windows\System\jsvImlO.exe
  2⤵
  PID:4684
- C:\Windows\System\afWtSrt.exe
  C:\Windows\System\afWtSrt.exe
  2⤵
  PID:4700
- C:\Windows\System\xPxEtEo.exe
  C:\Windows\System\xPxEtEo.exe
  2⤵
  PID:4716
- C:\Windows\System\aQqNqlW.exe
  C:\Windows\System\aQqNqlW.exe
  2⤵
  PID:4732
- C:\Windows\System\MEtBcLj.exe
  C:\Windows\System\MEtBcLj.exe
  2⤵
  PID:4752
- C:\Windows\System\XYHntfT.exe
  C:\Windows\System\XYHntfT.exe
  2⤵
  PID:4808
- C:\Windows\System\IbzxQWr.exe
  C:\Windows\System\IbzxQWr.exe
  2⤵
  PID:4824
- C:\Windows\System\ceGKDOy.exe
  C:\Windows\System\ceGKDOy.exe
  2⤵
  PID:4860
- C:\Windows\System\vUmWgZz.exe
  C:\Windows\System\vUmWgZz.exe
  2⤵
  PID:4876
- C:\Windows\System\XIZOyLz.exe
  C:\Windows\System\XIZOyLz.exe
  2⤵
  PID:4896
- C:\Windows\System\RjfRTNc.exe
  C:\Windows\System\RjfRTNc.exe
  2⤵
  PID:4912
- C:\Windows\System\ichNUbI.exe
  C:\Windows\System\ichNUbI.exe
  2⤵
  PID:4928
- C:\Windows\System\OvMIEof.exe
  C:\Windows\System\OvMIEof.exe
  2⤵
  PID:4944
- C:\Windows\System\opwRMUP.exe
  C:\Windows\System\opwRMUP.exe
  2⤵
  PID:4960
- C:\Windows\System\gITgMBE.exe
  C:\Windows\System\gITgMBE.exe
  2⤵
  PID:4980
- C:\Windows\System\inlJfwi.exe
  C:\Windows\System\inlJfwi.exe
  2⤵
  PID:4996
- C:\Windows\System\XWgPjXl.exe
  C:\Windows\System\XWgPjXl.exe
  2⤵
  PID:5016
- C:\Windows\System\CKSAbwF.exe
  C:\Windows\System\CKSAbwF.exe
  2⤵
  PID:5040
- C:\Windows\System\hwNLrlH.exe
  C:\Windows\System\hwNLrlH.exe
  2⤵
  PID:5056
- C:\Windows\System\OcfyBeW.exe
  C:\Windows\System\OcfyBeW.exe
  2⤵
  PID:5076
- C:\Windows\System\zwgOOCJ.exe
  C:\Windows\System\zwgOOCJ.exe
  2⤵
  PID:5092
- C:\Windows\System\HJSXogF.exe
  C:\Windows\System\HJSXogF.exe
  2⤵
  PID:5108
- C:\Windows\System\JtoFvZb.exe
  C:\Windows\System\JtoFvZb.exe
  2⤵
  PID:3484
- C:\Windows\System\BWCDOih.exe
  C:\Windows\System\BWCDOih.exe
  2⤵
  PID:4124
- C:\Windows\System\unXeyea.exe
  C:\Windows\System\unXeyea.exe
  2⤵
  PID:4172
- C:\Windows\System\owHkcJm.exe
  C:\Windows\System\owHkcJm.exe
  2⤵
  PID:3784
- C:\Windows\System\wiRGAhE.exe
  C:\Windows\System\wiRGAhE.exe
  2⤵
  PID:3080
- C:\Windows\System\JIyASda.exe
  C:\Windows\System\JIyASda.exe
  2⤵
  PID:4216
- C:\Windows\System\JOatKxF.exe
  C:\Windows\System\JOatKxF.exe
  2⤵
  PID:4280
- C:\Windows\System\gHsdZVn.exe
  C:\Windows\System\gHsdZVn.exe
  2⤵
  PID:3668
- C:\Windows\System\fFCPLzY.exe
  C:\Windows\System\fFCPLzY.exe
  2⤵
  PID:4148
- C:\Windows\System\roizSCV.exe
  C:\Windows\System\roizSCV.exe
  2⤵
  PID:4204
- C:\Windows\System\XRAmxmF.exe
  C:\Windows\System\XRAmxmF.exe
  2⤵
  PID:4416
- C:\Windows\System\PHtklQs.exe
  C:\Windows\System\PHtklQs.exe
  2⤵
  PID:4448
- C:\Windows\System\yVwvRSx.exe
  C:\Windows\System\yVwvRSx.exe
  2⤵
  PID:4468
- C:\Windows\System\kQHFoKQ.exe
  C:\Windows\System\kQHFoKQ.exe
  2⤵
  PID:4492
- C:\Windows\System\vxcRBWo.exe
  C:\Windows\System\vxcRBWo.exe
  2⤵
  PID:4596
- C:\Windows\System\qTpmIcp.exe
  C:\Windows\System\qTpmIcp.exe
  2⤵
  PID:4580
- C:\Windows\System\eGfstwq.exe
  C:\Windows\System\eGfstwq.exe
  2⤵
  PID:4564
- C:\Windows\System\MQdkHIh.exe
  C:\Windows\System\MQdkHIh.exe
  2⤵
  PID:4608
- C:\Windows\System\LgpVrNg.exe
  C:\Windows\System\LgpVrNg.exe
  2⤵
  PID:4724
- C:\Windows\System\ZKowEKL.exe
  C:\Windows\System\ZKowEKL.exe
  2⤵
  PID:4712
- C:\Windows\System\bivfLKi.exe
  C:\Windows\System\bivfLKi.exe
  2⤵
  PID:4820
- C:\Windows\System\DjIuoch.exe
  C:\Windows\System\DjIuoch.exe
  2⤵
  PID:4760
- C:\Windows\System\zsgeaLL.exe
  C:\Windows\System\zsgeaLL.exe
  2⤵
  PID:4784
- C:\Windows\System\eTaMFPy.exe
  C:\Windows\System\eTaMFPy.exe
  2⤵
  PID:4804
- C:\Windows\System\RoIImjb.exe
  C:\Windows\System\RoIImjb.exe
  2⤵
  PID:4844
- C:\Windows\System\EDDDeHG.exe
  C:\Windows\System\EDDDeHG.exe
  2⤵
  PID:4848
- C:\Windows\System\mLtXQFp.exe
  C:\Windows\System\mLtXQFp.exe
  2⤵
  PID:4832
- C:\Windows\System\XOFimMA.exe
  C:\Windows\System\XOFimMA.exe
  2⤵
  PID:5024
- C:\Windows\System\mWmUkeD.exe
  C:\Windows\System\mWmUkeD.exe
  2⤵
  PID:5028
- C:\Windows\System\FKKVLvf.exe
  C:\Windows\System\FKKVLvf.exe
  2⤵
  PID:5100
- C:\Windows\System\xnmLXth.exe
  C:\Windows\System\xnmLXth.exe
  2⤵
  PID:4120
- C:\Windows\System\PHLSAzz.exe
  C:\Windows\System\PHLSAzz.exe
  2⤵
  PID:4324
- C:\Windows\System\sChsYPM.exe
  C:\Windows\System\sChsYPM.exe
  2⤵
  PID:4356
- C:\Windows\System\cEYwhis.exe
  C:\Windows\System\cEYwhis.exe
  2⤵
  PID:4868
- C:\Windows\System\nlnjVuu.exe
  C:\Windows\System\nlnjVuu.exe
  2⤵
  PID:4940
- C:\Windows\System\yxNoppz.exe
  C:\Windows\System\yxNoppz.exe
  2⤵
  PID:5048
- C:\Windows\System\PYHYibB.exe
  C:\Windows\System\PYHYibB.exe
  2⤵
  PID:3296
- C:\Windows\System\BnuhlwG.exe
  C:\Windows\System\BnuhlwG.exe
  2⤵
  PID:3280
- C:\Windows\System\JbYJqyA.exe
  C:\Windows\System\JbYJqyA.exe
  2⤵
  PID:4336
- C:\Windows\System\KRkDClh.exe
  C:\Windows\System\KRkDClh.exe
  2⤵
  PID:4300
- C:\Windows\System\zkSfjar.exe
  C:\Windows\System\zkSfjar.exe
  2⤵
  PID:3436
- C:\Windows\System\ackzLPT.exe
  C:\Windows\System\ackzLPT.exe
  2⤵
  PID:4104
- C:\Windows\System\YvbJzXq.exe
  C:\Windows\System\YvbJzXq.exe
  2⤵
  PID:4392
- C:\Windows\System\JYoKYgM.exe
  C:\Windows\System\JYoKYgM.exe
  2⤵
  PID:4508
- C:\Windows\System\xEFevnR.exe
  C:\Windows\System\xEFevnR.exe
  2⤵
  PID:4304
- C:\Windows\System\Cveusqf.exe
  C:\Windows\System\Cveusqf.exe
  2⤵
  PID:4528
- C:\Windows\System\nAkKcBv.exe
  C:\Windows\System\nAkKcBv.exe
  2⤵
  PID:4692
- C:\Windows\System\xQaJGZY.exe
  C:\Windows\System\xQaJGZY.exe
  2⤵
  PID:4680
- C:\Windows\System\UyJvQHy.exe
  C:\Windows\System\UyJvQHy.exe
  2⤵
  PID:4436
- C:\Windows\System\SVZHYuD.exe
  C:\Windows\System\SVZHYuD.exe
  2⤵
  PID:4544
- C:\Windows\System\EnuhxYX.exe
  C:\Windows\System\EnuhxYX.exe
  2⤵
  PID:4776
- C:\Windows\System\YUeuhpq.exe
  C:\Windows\System\YUeuhpq.exe
  2⤵
  PID:4920
- C:\Windows\System\AoNhPKh.exe
  C:\Windows\System\AoNhPKh.exe
  2⤵
  PID:4956
- C:\Windows\System\zsBKWcm.exe
  C:\Windows\System\zsBKWcm.exe
  2⤵
  PID:4772
- C:\Windows\System\QQgvvhB.exe
  C:\Windows\System\QQgvvhB.exe
  2⤵
  PID:4792
- C:\Windows\System\hWgzjWr.exe
  C:\Windows\System\hWgzjWr.exe
  2⤵
  PID:3704
- C:\Windows\System\tCcaVPr.exe
  C:\Windows\System\tCcaVPr.exe
  2⤵
  PID:4548
- C:\Windows\System\QNExmdc.exe
  C:\Windows\System\QNExmdc.exe
  2⤵
  PID:4252
- C:\Windows\System\EBXgnWl.exe
  C:\Windows\System\EBXgnWl.exe
  2⤵
  PID:5104
- C:\Windows\System\HRgBWIq.exe
  C:\Windows\System\HRgBWIq.exe
  2⤵
  PID:3904
- C:\Windows\System\JIXGocF.exe
  C:\Windows\System\JIXGocF.exe
  2⤵
  PID:4168
- C:\Windows\System\ZBpDpyf.exe
  C:\Windows\System\ZBpDpyf.exe
  2⤵
  PID:4404
- C:\Windows\System\LKaauBm.exe
  C:\Windows\System\LKaauBm.exe
  2⤵
  PID:5084
- C:\Windows\System\eKJbtrY.exe
  C:\Windows\System\eKJbtrY.exe
  2⤵
  PID:4340
- C:\Windows\System\YMANZXH.exe
  C:\Windows\System\YMANZXH.exe
  2⤵
  PID:4560
- C:\Windows\System\ZElIvFN.exe
  C:\Windows\System\ZElIvFN.exe
  2⤵
  PID:4840
- C:\Windows\System\jEAvZgq.exe
  C:\Windows\System\jEAvZgq.exe
  2⤵
  PID:4976
- C:\Windows\System\IrpawLY.exe
  C:\Windows\System\IrpawLY.exe
  2⤵
  PID:3560
- C:\Windows\System\BnOPgva.exe
  C:\Windows\System\BnOPgva.exe
  2⤵
  PID:4904
- C:\Windows\System\QpPstLz.exe
  C:\Windows\System\QpPstLz.exe
  2⤵
  PID:4264
- C:\Windows\System\vEsmjrb.exe
  C:\Windows\System\vEsmjrb.exe
  2⤵
  PID:4388
- C:\Windows\System\XVlBJcq.exe
  C:\Windows\System\XVlBJcq.exe
  2⤵
  PID:4644
- C:\Windows\System\VxugAYp.exe
  C:\Windows\System\VxugAYp.exe
  2⤵
  PID:4800
- C:\Windows\System\NwYaRZB.exe
  C:\Windows\System\NwYaRZB.exe
  2⤵
  PID:4748
- C:\Windows\System\OtThtOY.exe
  C:\Windows\System\OtThtOY.exe
  2⤵
  PID:5036
- C:\Windows\System\oDRreRG.exe
  C:\Windows\System\oDRreRG.exe
  2⤵
  PID:4376
- C:\Windows\System\gKjcuLq.exe
  C:\Windows\System\gKjcuLq.exe
  2⤵
  PID:4628
- C:\Windows\System\IFkbTGH.exe
  C:\Windows\System\IFkbTGH.exe
  2⤵
  PID:3844
- C:\Windows\System\FvHCWyR.exe
  C:\Windows\System\FvHCWyR.exe
  2⤵
  PID:4132
- C:\Windows\System\QyZpvGw.exe
  C:\Windows\System\QyZpvGw.exe
  2⤵
  PID:5128
- C:\Windows\System\stkUYmN.exe
  C:\Windows\System\stkUYmN.exe
  2⤵
  PID:5144
- C:\Windows\System\MWOzSMN.exe
  C:\Windows\System\MWOzSMN.exe
  2⤵
  PID:5160
- C:\Windows\System\gBaBRsD.exe
  C:\Windows\System\gBaBRsD.exe
  2⤵
  PID:5176
- C:\Windows\System\RsYEHbr.exe
  C:\Windows\System\RsYEHbr.exe
  2⤵
  PID:5192
- C:\Windows\System\apSTpmA.exe
  C:\Windows\System\apSTpmA.exe
  2⤵
  PID:5208
- C:\Windows\System\GnsaKaL.exe
  C:\Windows\System\GnsaKaL.exe
  2⤵
  PID:5224
- C:\Windows\System\rRmPjIQ.exe
  C:\Windows\System\rRmPjIQ.exe
  2⤵
  PID:5240
- C:\Windows\System\pddYcBu.exe
  C:\Windows\System\pddYcBu.exe
  2⤵
  PID:5256
- C:\Windows\System\ekhGDAc.exe
  C:\Windows\System\ekhGDAc.exe
  2⤵
  PID:5272
- C:\Windows\System\tCKvuCB.exe
  C:\Windows\System\tCKvuCB.exe
  2⤵
  PID:5288
- C:\Windows\System\aWfozBC.exe
  C:\Windows\System\aWfozBC.exe
  2⤵
  PID:5304
- C:\Windows\System\aBxwvwA.exe
  C:\Windows\System\aBxwvwA.exe
  2⤵
  PID:5320
- C:\Windows\System\hnMhInq.exe
  C:\Windows\System\hnMhInq.exe
  2⤵
  PID:5336
- C:\Windows\System\QVZiQHO.exe
  C:\Windows\System\QVZiQHO.exe
  2⤵
  PID:5352
- C:\Windows\System\MmUjXvc.exe
  C:\Windows\System\MmUjXvc.exe
  2⤵
  PID:5368
- C:\Windows\System\LWLWfBI.exe
  C:\Windows\System\LWLWfBI.exe
  2⤵
  PID:5384
- C:\Windows\System\FBbCpuD.exe
  C:\Windows\System\FBbCpuD.exe
  2⤵
  PID:5400
- C:\Windows\System\mhRDpyP.exe
  C:\Windows\System\mhRDpyP.exe
  2⤵
  PID:5416
- C:\Windows\System\MwSGRIB.exe
  C:\Windows\System\MwSGRIB.exe
  2⤵
  PID:5432
- C:\Windows\System\xizuBli.exe
  C:\Windows\System\xizuBli.exe
  2⤵
  PID:5452
- C:\Windows\System\wPeCHwO.exe
  C:\Windows\System\wPeCHwO.exe
  2⤵
  PID:5468
- C:\Windows\System\HYrDgjn.exe
  C:\Windows\System\HYrDgjn.exe
  2⤵
  PID:5484
- C:\Windows\System\tcsMSsV.exe
  C:\Windows\System\tcsMSsV.exe
  2⤵
  PID:5500
- C:\Windows\System\PkAqhtk.exe
  C:\Windows\System\PkAqhtk.exe
  2⤵
  PID:5520
- C:\Windows\System\tZekcJp.exe
  C:\Windows\System\tZekcJp.exe
  2⤵
  PID:5536
- C:\Windows\System\cACKGgA.exe
  C:\Windows\System\cACKGgA.exe
  2⤵
  PID:5552
- C:\Windows\System\mUOzPlB.exe
  C:\Windows\System\mUOzPlB.exe
  2⤵
  PID:5568
- C:\Windows\System\zLuCjdR.exe
  C:\Windows\System\zLuCjdR.exe
  2⤵
  PID:5588
- C:\Windows\System\fSXBwdH.exe
  C:\Windows\System\fSXBwdH.exe
  2⤵
  PID:5604
- C:\Windows\System\fSBFhuE.exe
  C:\Windows\System\fSBFhuE.exe
  2⤵
  PID:5620
- C:\Windows\System\VrjPFHt.exe
  C:\Windows\System\VrjPFHt.exe
  2⤵
  PID:5636
- C:\Windows\System\MuCNmDF.exe
  C:\Windows\System\MuCNmDF.exe
  2⤵
  PID:5652
- C:\Windows\System\WTjxpRb.exe
  C:\Windows\System\WTjxpRb.exe
  2⤵
  PID:5668
- C:\Windows\System\IjtAmPm.exe
  C:\Windows\System\IjtAmPm.exe
  2⤵
  PID:5684
- C:\Windows\System\myQxILr.exe
  C:\Windows\System\myQxILr.exe
  2⤵
  PID:5700
- C:\Windows\System\QSnGtgT.exe
  C:\Windows\System\QSnGtgT.exe
  2⤵
  PID:5716
- C:\Windows\System\htVWmKZ.exe
  C:\Windows\System\htVWmKZ.exe
  2⤵
  PID:5732
- C:\Windows\System\VQIBvTk.exe
  C:\Windows\System\VQIBvTk.exe
  2⤵
  PID:5748
- C:\Windows\System\eQDZDCx.exe
  C:\Windows\System\eQDZDCx.exe
  2⤵
  PID:5764
- C:\Windows\System\CcevViD.exe
  C:\Windows\System\CcevViD.exe
  2⤵
  PID:5780
- C:\Windows\System\CeJcXnB.exe
  C:\Windows\System\CeJcXnB.exe
  2⤵
  PID:5796
- C:\Windows\System\oloRvWB.exe
  C:\Windows\System\oloRvWB.exe
  2⤵
  PID:5812
- C:\Windows\System\SRcLNDi.exe
  C:\Windows\System\SRcLNDi.exe
  2⤵
  PID:5828
- C:\Windows\System\noChBEm.exe
  C:\Windows\System\noChBEm.exe
  2⤵
  PID:5844
- C:\Windows\System\jxIWQKE.exe
  C:\Windows\System\jxIWQKE.exe
  2⤵
  PID:5860
- C:\Windows\System\WvBVbxY.exe
  C:\Windows\System\WvBVbxY.exe
  2⤵
  PID:5876
- C:\Windows\System\umkqmBO.exe
  C:\Windows\System\umkqmBO.exe
  2⤵
  PID:5892
- C:\Windows\System\fPZMuZA.exe
  C:\Windows\System\fPZMuZA.exe
  2⤵
  PID:5908
- C:\Windows\System\LnZpsvV.exe
  C:\Windows\System\LnZpsvV.exe
  2⤵
  PID:5924
- C:\Windows\System\MYEJRxv.exe
  C:\Windows\System\MYEJRxv.exe
  2⤵
  PID:5940
- C:\Windows\System\URUveBq.exe
  C:\Windows\System\URUveBq.exe
  2⤵
  PID:5956
- C:\Windows\System\PhXXpVp.exe
  C:\Windows\System\PhXXpVp.exe
  2⤵
  PID:5972
- C:\Windows\System\SYmafzh.exe
  C:\Windows\System\SYmafzh.exe
  2⤵
  PID:5988
- C:\Windows\System\MTaFugh.exe
  C:\Windows\System\MTaFugh.exe
  2⤵
  PID:6004
- C:\Windows\System\xQRqFNv.exe
  C:\Windows\System\xQRqFNv.exe
  2⤵
  PID:6020
- C:\Windows\System\PgIjUeV.exe
  C:\Windows\System\PgIjUeV.exe
  2⤵
  PID:6036
- C:\Windows\System\qreEpJw.exe
  C:\Windows\System\qreEpJw.exe
  2⤵
  PID:6056
- C:\Windows\System\uSWNNcv.exe
  C:\Windows\System\uSWNNcv.exe
  2⤵
  PID:6072
- C:\Windows\System\WaQPdAU.exe
  C:\Windows\System\WaQPdAU.exe
  2⤵
  PID:6088
- C:\Windows\System\cKhRfLd.exe
  C:\Windows\System\cKhRfLd.exe
  2⤵
  PID:6104
- C:\Windows\System\wUQGLqr.exe
  C:\Windows\System\wUQGLqr.exe
  2⤵
  PID:6120
- C:\Windows\System\OGceNeC.exe
  C:\Windows\System\OGceNeC.exe
  2⤵
  PID:6136
- C:\Windows\System\znKLkag.exe
  C:\Windows\System\znKLkag.exe
  2⤵
  PID:5152
- C:\Windows\System\YhfChPY.exe
  C:\Windows\System\YhfChPY.exe
  2⤵
  PID:5216
- C:\Windows\System\UWYMnxx.exe
  C:\Windows\System\UWYMnxx.exe
  2⤵
  PID:5252
- C:\Windows\System\rDEmTRj.exe
  C:\Windows\System\rDEmTRj.exe
  2⤵
  PID:5140
- C:\Windows\System\rXpNCdh.exe
  C:\Windows\System\rXpNCdh.exe
  2⤵
  PID:5168
- C:\Windows\System\BsBgEUR.exe
  C:\Windows\System\BsBgEUR.exe
  2⤵
  PID:4952
- C:\Windows\System\TMviaNT.exe
  C:\Windows\System\TMviaNT.exe
  2⤵
  PID:5380
- C:\Windows\System\fkOziDZ.exe
  C:\Windows\System\fkOziDZ.exe
  2⤵
  PID:5376
- C:\Windows\System\SMsjyuH.exe
  C:\Windows\System\SMsjyuH.exe
  2⤵
  PID:5172
- C:\Windows\System\xPvuebS.exe
  C:\Windows\System\xPvuebS.exe
  2⤵
  PID:5232
- C:\Windows\System\emrgKaC.exe
  C:\Windows\System\emrgKaC.exe
  2⤵
  PID:5448
- C:\Windows\System\FvGvrND.exe
  C:\Windows\System\FvGvrND.exe
  2⤵
  PID:5332
- C:\Windows\System\CKKJKnX.exe
  C:\Windows\System\CKKJKnX.exe
  2⤵
  PID:5476
- C:\Windows\System\LahLZJv.exe
  C:\Windows\System\LahLZJv.exe
  2⤵
  PID:5544
- C:\Windows\System\xsjMIeo.exe
  C:\Windows\System\xsjMIeo.exe
  2⤵
  PID:5576
- C:\Windows\System\xdGZIEZ.exe
  C:\Windows\System\xdGZIEZ.exe
  2⤵
  PID:5492
- C:\Windows\System\ngqusVI.exe
  C:\Windows\System\ngqusVI.exe
  2⤵
  PID:5528
- C:\Windows\System\oCIItmK.exe
  C:\Windows\System\oCIItmK.exe
  2⤵
  PID:5644
- C:\Windows\System\VieMfBE.exe
  C:\Windows\System\VieMfBE.exe
  2⤵
  PID:5708
- C:\Windows\System\TVuVeWM.exe
  C:\Windows\System\TVuVeWM.exe
  2⤵
  PID:5744
- C:\Windows\System\aAmqwwL.exe
  C:\Windows\System\aAmqwwL.exe
  2⤵
  PID:5600
- C:\Windows\System\YJlWXzU.exe
  C:\Windows\System\YJlWXzU.exe
  2⤵
  PID:5660
- C:\Windows\System\miyZQgX.exe
  C:\Windows\System\miyZQgX.exe
  2⤵
  PID:5808
- C:\Windows\System\qaNrRCA.exe
  C:\Windows\System\qaNrRCA.exe
  2⤵
  PID:5872
- C:\Windows\System\QwkajPt.exe
  C:\Windows\System\QwkajPt.exe
  2⤵
  PID:5696
- C:\Windows\System\yDmzsYD.exe
  C:\Windows\System\yDmzsYD.exe
  2⤵
  PID:5756
- C:\Windows\System\BZitWlp.exe
  C:\Windows\System\BZitWlp.exe
  2⤵
  PID:5792
- C:\Windows\System\tYBhuaj.exe
  C:\Windows\System\tYBhuaj.exe
  2⤵
  PID:5920
- C:\Windows\System\dBeEOFF.exe
  C:\Windows\System\dBeEOFF.exe
  2⤵
  PID:5820
- C:\Windows\System\pasSvfM.exe
  C:\Windows\System\pasSvfM.exe
  2⤵
  PID:6000
- C:\Windows\System\VRjScis.exe
  C:\Windows\System\VRjScis.exe
  2⤵
  PID:6012
- C:\Windows\System\NGyNNxd.exe
  C:\Windows\System\NGyNNxd.exe
  2⤵
  PID:6064
- C:\Windows\System\DdSrPJl.exe
  C:\Windows\System\DdSrPJl.exe
  2⤵
  PID:5188
- C:\Windows\System\sMxjiqD.exe
  C:\Windows\System\sMxjiqD.exe
  2⤵
  PID:6128
- C:\Windows\System\IAqvrwf.exe
  C:\Windows\System\IAqvrwf.exe
  2⤵
  PID:5344
- C:\Windows\System\NTMxlkk.exe
  C:\Windows\System\NTMxlkk.exe
  2⤵
  PID:6084
- C:\Windows\System\RiQSfAc.exe
  C:\Windows\System\RiQSfAc.exe
  2⤵
  PID:5424
- C:\Windows\System\vgIGWrG.exe
  C:\Windows\System\vgIGWrG.exe
  2⤵
  PID:5328
- C:\Windows\System\CPnFJgu.exe
  C:\Windows\System\CPnFJgu.exe
  2⤵
  PID:5348
- C:\Windows\System\UVphXRL.exe
  C:\Windows\System\UVphXRL.exe
  2⤵
  PID:4908
- C:\Windows\System\DKbLMYH.exe
  C:\Windows\System\DKbLMYH.exe
  2⤵
  PID:5264
- C:\Windows\System\ZrvMyVf.exe
  C:\Windows\System\ZrvMyVf.exe
  2⤵
  PID:5004
- C:\Windows\System\ReuJHXI.exe
  C:\Windows\System\ReuJHXI.exe
  2⤵
  PID:5616
- C:\Windows\System\gwfBAIg.exe
  C:\Windows\System\gwfBAIg.exe
  2⤵
  PID:5532
- C:\Windows\System\JxvHLqL.exe
  C:\Windows\System\JxvHLqL.exe
  2⤵
  PID:5728
- C:\Windows\System\igQxVRn.exe
  C:\Windows\System\igQxVRn.exe
  2⤵
  PID:5836
- C:\Windows\System\hLyPnCm.exe
  C:\Windows\System\hLyPnCm.exe
  2⤵
  PID:5932
- C:\Windows\System\jBwglGO.exe
  C:\Windows\System\jBwglGO.exe
  2⤵
  PID:5964
- C:\Windows\System\ECaxcqL.exe
  C:\Windows\System\ECaxcqL.exe
  2⤵
  PID:5888
- C:\Windows\System\UZAfZhL.exe
  C:\Windows\System\UZAfZhL.exe
  2⤵
  PID:5952
- C:\Windows\System\QohNJGd.exe
  C:\Windows\System\QohNJGd.exe
  2⤵
  PID:6080
- C:\Windows\System\XjwBhtL.exe
  C:\Windows\System\XjwBhtL.exe
  2⤵
  PID:5516
- C:\Windows\System\zXJwvFP.exe
  C:\Windows\System\zXJwvFP.exe
  2⤵
  PID:5612
- C:\Windows\System\VWpsgNT.exe
  C:\Windows\System\VWpsgNT.exe
  2⤵
  PID:6028
- C:\Windows\System\VGffKyQ.exe
  C:\Windows\System\VGffKyQ.exe
  2⤵
  PID:5852
- C:\Windows\System\pxLfbAq.exe
  C:\Windows\System\pxLfbAq.exe
  2⤵
  PID:6100
- C:\Windows\System\ivPqlIq.exe
  C:\Windows\System\ivPqlIq.exe
  2⤵
  PID:5124
- C:\Windows\System\UUBLOmg.exe
  C:\Windows\System\UUBLOmg.exe
  2⤵
  PID:5364
- C:\Windows\System\aIDJXzN.exe
  C:\Windows\System\aIDJXzN.exe
  2⤵
  PID:5804
- C:\Windows\System\PGRvdIg.exe
  C:\Windows\System\PGRvdIg.exe
  2⤵
  PID:4660
- C:\Windows\System\EfEuYuM.exe
  C:\Windows\System\EfEuYuM.exe
  2⤵
  PID:6116
- C:\Windows\System\LHdXOVo.exe
  C:\Windows\System\LHdXOVo.exe
  2⤵
  PID:6044
- C:\Windows\System\ZzAuDsF.exe
  C:\Windows\System\ZzAuDsF.exe
  2⤵
  PID:6156
- C:\Windows\System\VVSnLzR.exe
  C:\Windows\System\VVSnLzR.exe
  2⤵
  PID:6172
- C:\Windows\System\waZXbXZ.exe
  C:\Windows\System\waZXbXZ.exe
  2⤵
  PID:6188
- C:\Windows\System\xZjsCyX.exe
  C:\Windows\System\xZjsCyX.exe
  2⤵
  PID:6204
- C:\Windows\System\fNBboPo.exe
  C:\Windows\System\fNBboPo.exe
  2⤵
  PID:6220
- C:\Windows\System\BXRUJqw.exe
  C:\Windows\System\BXRUJqw.exe
  2⤵
  PID:6236
- C:\Windows\System\zpisbqg.exe
  C:\Windows\System\zpisbqg.exe
  2⤵
  PID:6252
- C:\Windows\System\zeaEpVJ.exe
  C:\Windows\System\zeaEpVJ.exe
  2⤵
  PID:6268
- C:\Windows\System\VkSBuDW.exe
  C:\Windows\System\VkSBuDW.exe
  2⤵
  PID:6284
- C:\Windows\System\YFOOGSs.exe
  C:\Windows\System\YFOOGSs.exe
  2⤵
  PID:6300
- C:\Windows\System\liRfGkE.exe
  C:\Windows\System\liRfGkE.exe
  2⤵
  PID:6316
- C:\Windows\System\OKKGDbi.exe
  C:\Windows\System\OKKGDbi.exe
  2⤵
  PID:6332
- C:\Windows\System\orYZmQj.exe
  C:\Windows\System\orYZmQj.exe
  2⤵
  PID:6348
- C:\Windows\System\FQxGJRH.exe
  C:\Windows\System\FQxGJRH.exe
  2⤵
  PID:6364
- C:\Windows\System\kapdfwP.exe
  C:\Windows\System\kapdfwP.exe
  2⤵
  PID:6380
- C:\Windows\System\katYEGb.exe
  C:\Windows\System\katYEGb.exe
  2⤵
  PID:6396
- C:\Windows\System\PWhoOjj.exe
  C:\Windows\System\PWhoOjj.exe
  2⤵
  PID:6412
- C:\Windows\System\DBeyXJV.exe
  C:\Windows\System\DBeyXJV.exe
  2⤵
  PID:6428
- C:\Windows\System\FAUdqIj.exe
  C:\Windows\System\FAUdqIj.exe
  2⤵
  PID:6444
- C:\Windows\System\KesUOOn.exe
  C:\Windows\System\KesUOOn.exe
  2⤵
  PID:6460
- C:\Windows\System\MzINCKU.exe
  C:\Windows\System\MzINCKU.exe
  2⤵
  PID:6476
- C:\Windows\System\XvgMACr.exe
  C:\Windows\System\XvgMACr.exe
  2⤵
  PID:6492
- C:\Windows\System\hQNsmXm.exe
  C:\Windows\System\hQNsmXm.exe
  2⤵
  PID:6508
- C:\Windows\System\xQbHigj.exe
  C:\Windows\System\xQbHigj.exe
  2⤵
  PID:6524
- C:\Windows\System\JPpOIWI.exe
  C:\Windows\System\JPpOIWI.exe
  2⤵
  PID:6540
- C:\Windows\System\iVlgVHi.exe
  C:\Windows\System\iVlgVHi.exe
  2⤵
  PID:6556
- C:\Windows\System\iSYUNuq.exe
  C:\Windows\System\iSYUNuq.exe
  2⤵
  PID:6572
- C:\Windows\System\BHSBpeC.exe
  C:\Windows\System\BHSBpeC.exe
  2⤵
  PID:6588
- C:\Windows\System\hTrFJln.exe
  C:\Windows\System\hTrFJln.exe
  2⤵
  PID:6604
- C:\Windows\System\piTjTQh.exe
  C:\Windows\System\piTjTQh.exe
  2⤵
  PID:6620
- C:\Windows\System\AetFxbx.exe
  C:\Windows\System\AetFxbx.exe
  2⤵
  PID:6636
- C:\Windows\System\RiOSIRV.exe
  C:\Windows\System\RiOSIRV.exe
  2⤵
  PID:6652
- C:\Windows\System\MQepjxG.exe
  C:\Windows\System\MQepjxG.exe
  2⤵
  PID:6668
- C:\Windows\System\kuNKcKG.exe
  C:\Windows\System\kuNKcKG.exe
  2⤵
  PID:6684
- C:\Windows\System\flxrHYz.exe
  C:\Windows\System\flxrHYz.exe
  2⤵
  PID:6700
- C:\Windows\System\hyziZFA.exe
  C:\Windows\System\hyziZFA.exe
  2⤵
  PID:6716
- C:\Windows\System\JDlwnbJ.exe
  C:\Windows\System\JDlwnbJ.exe
  2⤵
  PID:6732
- C:\Windows\System\sSvtBZD.exe
  C:\Windows\System\sSvtBZD.exe
  2⤵
  PID:6748
- C:\Windows\System\BWexlXF.exe
  C:\Windows\System\BWexlXF.exe
  2⤵
  PID:6768
- C:\Windows\System\pfZxlbT.exe
  C:\Windows\System\pfZxlbT.exe
  2⤵
  PID:6784
- C:\Windows\System\sxniyFf.exe
  C:\Windows\System\sxniyFf.exe
  2⤵
  PID:6800
- C:\Windows\System\sLEOjWp.exe
  C:\Windows\System\sLEOjWp.exe
  2⤵
  PID:6816
- C:\Windows\System\bcbVLmv.exe
  C:\Windows\System\bcbVLmv.exe
  2⤵
  PID:6832
- C:\Windows\System\xyBSTeH.exe
  C:\Windows\System\xyBSTeH.exe
  2⤵
  PID:6848
- C:\Windows\System\IUYrnDO.exe
  C:\Windows\System\IUYrnDO.exe
  2⤵
  PID:6864
- C:\Windows\System\LSbYrSZ.exe
  C:\Windows\System\LSbYrSZ.exe
  2⤵
  PID:6880
- C:\Windows\System\iqgJQIM.exe
  C:\Windows\System\iqgJQIM.exe
  2⤵
  PID:6896
- C:\Windows\System\xobVnfj.exe
  C:\Windows\System\xobVnfj.exe
  2⤵
  PID:6912
- C:\Windows\System\xxnSdFR.exe
  C:\Windows\System\xxnSdFR.exe
  2⤵
  PID:6928
- C:\Windows\System\aHQByRv.exe
  C:\Windows\System\aHQByRv.exe
  2⤵
  PID:6944
- C:\Windows\System\xDUIuLf.exe
  C:\Windows\System\xDUIuLf.exe
  2⤵
  PID:6960
- C:\Windows\System\DUcQbMP.exe
  C:\Windows\System\DUcQbMP.exe
  2⤵
  PID:6976
- C:\Windows\System\FLyobXr.exe
  C:\Windows\System\FLyobXr.exe
  2⤵
  PID:6992
- C:\Windows\System\ERvNtup.exe
  C:\Windows\System\ERvNtup.exe
  2⤵
  PID:7008
- C:\Windows\System\KyVOnnw.exe
  C:\Windows\System\KyVOnnw.exe
  2⤵
  PID:7024
- C:\Windows\System\aCjgflM.exe
  C:\Windows\System\aCjgflM.exe
  2⤵
  PID:7040
- C:\Windows\System\MMnxXYn.exe
  C:\Windows\System\MMnxXYn.exe
  2⤵
  PID:7056
- C:\Windows\System\AcnnHuY.exe
  C:\Windows\System\AcnnHuY.exe
  2⤵
  PID:7072
- C:\Windows\System\ihpmakW.exe
  C:\Windows\System\ihpmakW.exe
  2⤵
  PID:7088
- C:\Windows\System\qhUsHNY.exe
  C:\Windows\System\qhUsHNY.exe
  2⤵
  PID:7104
- C:\Windows\System\FgzVrqw.exe
  C:\Windows\System\FgzVrqw.exe
  2⤵
  PID:7120
- C:\Windows\System\bSMezxO.exe
  C:\Windows\System\bSMezxO.exe
  2⤵
  PID:7136
- C:\Windows\System\uZJCuxQ.exe
  C:\Windows\System\uZJCuxQ.exe
  2⤵
  PID:7152
- C:\Windows\System\tjCkqMc.exe
  C:\Windows\System\tjCkqMc.exe
  2⤵
  PID:5440
- C:\Windows\System\bedXqpL.exe
  C:\Windows\System\bedXqpL.exe
  2⤵
  PID:5680
- C:\Windows\System\xrSSAoU.exe
  C:\Windows\System\xrSSAoU.exe
  2⤵
  PID:6196
- C:\Windows\System\MLAzTkw.exe
  C:\Windows\System\MLAzTkw.exe
  2⤵
  PID:6232
- C:\Windows\System\OWBsyjL.exe
  C:\Windows\System\OWBsyjL.exe
  2⤵
  PID:6324
- C:\Windows\System\xLSDOfV.exe
  C:\Windows\System\xLSDOfV.exe
  2⤵
  PID:6276
- C:\Windows\System\eJXaXgO.exe
  C:\Windows\System\eJXaXgO.exe
  2⤵
  PID:5632
- C:\Windows\System\kjRUGlP.exe
  C:\Windows\System\kjRUGlP.exe
  2⤵
  PID:6152
- C:\Windows\System\RTLfgfb.exe
  C:\Windows\System\RTLfgfb.exe
  2⤵
  PID:6216
- C:\Windows\System\oZXHdvN.exe
  C:\Windows\System\oZXHdvN.exe
  2⤵
  PID:5428
- C:\Windows\System\fkoeJQr.exe
  C:\Windows\System\fkoeJQr.exe
  2⤵
  PID:6356
- C:\Windows\System\XDHyfzT.exe
  C:\Windows\System\XDHyfzT.exe
  2⤵
  PID:6452
- C:\Windows\System\saMYayn.exe
  C:\Windows\System\saMYayn.exe
  2⤵
  PID:6516
- C:\Windows\System\vKpaani.exe
  C:\Windows\System\vKpaani.exe
  2⤵
  PID:6456
- C:\Windows\System\zjhexGJ.exe
  C:\Windows\System\zjhexGJ.exe
  2⤵
  PID:6548
- C:\Windows\System\HbddwIY.exe
  C:\Windows\System\HbddwIY.exe
  2⤵
  PID:7048
- C:\Windows\System\wZluEIW.exe
  C:\Windows\System\wZluEIW.exe
  2⤵
  PID:6264
- C:\Windows\System\twNuQwN.exe
  C:\Windows\System\twNuQwN.exe
  2⤵
  PID:6552
- C:\Windows\System\myDgKUU.exe
  C:\Windows\System\myDgKUU.exe
  2⤵
  PID:6408
- C:\Windows\System\iPKQlML.exe
  C:\Windows\System\iPKQlML.exe
  2⤵
  PID:6596
- C:\Windows\System\lzpSWoF.exe
  C:\Windows\System\lzpSWoF.exe
  2⤵
  PID:6632
- C:\Windows\System\XGHmGap.exe
  C:\Windows\System\XGHmGap.exe
  2⤵
  PID:6664
- C:\Windows\System\SIxpfjI.exe
  C:\Windows\System\SIxpfjI.exe
  2⤵
  PID:6740
- C:\Windows\System\VNFTIlV.exe
  C:\Windows\System\VNFTIlV.exe
  2⤵
  PID:6692
- C:\Windows\System\GUlzqed.exe
  C:\Windows\System\GUlzqed.exe
  2⤵
  PID:6872
- C:\Windows\System\ZDCtPzV.exe
  C:\Windows\System\ZDCtPzV.exe
  2⤵
  PID:6760
- C:\Windows\System\vgArVKX.exe
  C:\Windows\System\vgArVKX.exe
  2⤵
  PID:6860
- C:\Windows\System\AwwZYaO.exe
  C:\Windows\System\AwwZYaO.exe
  2⤵
  PID:6952
- C:\Windows\System\iUExiDB.exe
  C:\Windows\System\iUExiDB.exe
  2⤵
  PID:6956
- C:\Windows\System\MUnJJKw.exe
  C:\Windows\System\MUnJJKw.exe
  2⤵
  PID:7068
- C:\Windows\System\AiaRGvw.exe
  C:\Windows\System\AiaRGvw.exe
  2⤵
  PID:7132
- C:\Windows\System\CJVhmUV.exe
  C:\Windows\System\CJVhmUV.exe
  2⤵
  PID:6168
- C:\Windows\System\RGECvQo.exe
  C:\Windows\System\RGECvQo.exe
  2⤵
  PID:5856
- C:\Windows\System\VrmFufU.exe
  C:\Windows\System\VrmFufU.exe
  2⤵
  PID:7116
- C:\Windows\System\pAaCSZo.exe
  C:\Windows\System\pAaCSZo.exe
  2⤵
  PID:5316
- C:\Windows\System\ncsfbUT.exe
  C:\Windows\System\ncsfbUT.exe
  2⤵
  PID:6488
- C:\Windows\System\QpGjbSW.exe
  C:\Windows\System\QpGjbSW.exe
  2⤵
  PID:5184
- C:\Windows\System\FgXlLDM.exe
  C:\Windows\System\FgXlLDM.exe
  2⤵
  PID:6472
- C:\Windows\System\nYjwHER.exe
  C:\Windows\System\nYjwHER.exe
  2⤵
  PID:6436
- C:\Windows\System\PkmSqyd.exe
  C:\Windows\System\PkmSqyd.exe
  2⤵
  PID:6712
- C:\Windows\System\niOdYPO.exe
  C:\Windows\System\niOdYPO.exe
  2⤵
  PID:6840
- C:\Windows\System\UIuQjII.exe
  C:\Windows\System\UIuQjII.exe
  2⤵
  PID:6856
- C:\Windows\System\BCBmphE.exe
  C:\Windows\System\BCBmphE.exe
  2⤵
  PID:6728
- C:\Windows\System\jTryiFN.exe
  C:\Windows\System\jTryiFN.exe
  2⤵
  PID:6920
- C:\Windows\System\GWCDGOI.exe
  C:\Windows\System\GWCDGOI.exe
  2⤵
  PID:7000
- C:\Windows\System\ZodPksi.exe
  C:\Windows\System\ZodPksi.exe
  2⤵
  PID:6796
- C:\Windows\System\tWzLnpE.exe
  C:\Windows\System\tWzLnpE.exe
  2⤵
  PID:7064
- C:\Windows\System\jHrhNJp.exe
  C:\Windows\System\jHrhNJp.exe
  2⤵
  PID:7100
- C:\Windows\System\SqBAGxp.exe
  C:\Windows\System\SqBAGxp.exe
  2⤵
  PID:6756
- C:\Windows\System\uUmLjvQ.exe
  C:\Windows\System\uUmLjvQ.exe
  2⤵
  PID:7148
- C:\Windows\System\VrXwaEU.exe
  C:\Windows\System\VrXwaEU.exe
  2⤵
  PID:5204
- C:\Windows\System\WELiahl.exe
  C:\Windows\System\WELiahl.exe
  2⤵
  PID:6296
- C:\Windows\System\iDTyNGu.exe
  C:\Windows\System\iDTyNGu.exe
  2⤵
  PID:6344
- C:\Windows\System\FKTXhsw.exe
  C:\Windows\System\FKTXhsw.exe
  2⤵
  PID:6536
- C:\Windows\System\xZfhvbd.exe
  C:\Windows\System\xZfhvbd.exe
  2⤵
  PID:6424
- C:\Windows\System\zVrydMB.exe
  C:\Windows\System\zVrydMB.exe
  2⤵
  PID:6532
- C:\Windows\System\SshAEZu.exe
  C:\Windows\System\SshAEZu.exe
  2⤵
  PID:6844
- C:\Windows\System\FstMvMm.exe
  C:\Windows\System\FstMvMm.exe
  2⤵
  PID:6808
- C:\Windows\System\HEgFnDd.exe
  C:\Windows\System\HEgFnDd.exe
  2⤵
  PID:6908
- C:\Windows\System\ZCPtvUB.exe
  C:\Windows\System\ZCPtvUB.exe
  2⤵
  PID:7004
- C:\Windows\System\JCpazrT.exe
  C:\Windows\System\JCpazrT.exe
  2⤵
  PID:6312
- C:\Windows\System\EWMEkJO.exe
  C:\Windows\System\EWMEkJO.exe
  2⤵
  PID:5868
- C:\Windows\System\ufbXeaT.exe
  C:\Windows\System\ufbXeaT.exe
  2⤵
  PID:6708
- C:\Windows\System\Cgdgrws.exe
  C:\Windows\System\Cgdgrws.exe
  2⤵
  PID:6468
- C:\Windows\System\aSiyTDO.exe
  C:\Windows\System\aSiyTDO.exe
  2⤵
  PID:6988
- C:\Windows\System\OCEnkAJ.exe
  C:\Windows\System\OCEnkAJ.exe
  2⤵
  PID:6892
- C:\Windows\System\KXQqrbQ.exe
  C:\Windows\System\KXQqrbQ.exe
  2⤵
  PID:5564
- C:\Windows\System\zjEaYHB.exe
  C:\Windows\System\zjEaYHB.exe
  2⤵
  PID:6440
- C:\Windows\System\CHtaasa.exe
  C:\Windows\System\CHtaasa.exe
  2⤵
  PID:7184
- C:\Windows\System\fQGxtXA.exe
  C:\Windows\System\fQGxtXA.exe
  2⤵
  PID:7200
- C:\Windows\System\zKUUzPT.exe
  C:\Windows\System\zKUUzPT.exe
  2⤵
  PID:7216
- C:\Windows\System\yraRFOB.exe
  C:\Windows\System\yraRFOB.exe
  2⤵
  PID:7232
- C:\Windows\System\CvEiQKk.exe
  C:\Windows\System\CvEiQKk.exe
  2⤵
  PID:7252
- C:\Windows\System\cOnWPqY.exe
  C:\Windows\System\cOnWPqY.exe
  2⤵
  PID:7268
- C:\Windows\System\fCMlbpl.exe
  C:\Windows\System\fCMlbpl.exe
  2⤵
  PID:7284
- C:\Windows\System\TiadRyM.exe
  C:\Windows\System\TiadRyM.exe
  2⤵
  PID:7300
- C:\Windows\System\YeUPivn.exe
  C:\Windows\System\YeUPivn.exe
  2⤵
  PID:7316
- C:\Windows\System\sYDCwPL.exe
  C:\Windows\System\sYDCwPL.exe
  2⤵
  PID:7332
- C:\Windows\System\tIFAhAB.exe
  C:\Windows\System\tIFAhAB.exe
  2⤵
  PID:7352
- C:\Windows\System\KdHAAiG.exe
  C:\Windows\System\KdHAAiG.exe
  2⤵
  PID:7368
- C:\Windows\System\byWnNCP.exe
  C:\Windows\System\byWnNCP.exe
  2⤵
  PID:7384
- C:\Windows\System\MojdJvk.exe
  C:\Windows\System\MojdJvk.exe
  2⤵
  PID:7400
- C:\Windows\System\rQjjjxc.exe
  C:\Windows\System\rQjjjxc.exe
  2⤵
  PID:7416
- C:\Windows\System\lVZWWQy.exe
  C:\Windows\System\lVZWWQy.exe
  2⤵
  PID:7432
- C:\Windows\System\yAhhpJf.exe
  C:\Windows\System\yAhhpJf.exe
  2⤵
  PID:7448
- C:\Windows\System\kDiTUss.exe
  C:\Windows\System\kDiTUss.exe
  2⤵
  PID:7640
- C:\Windows\System\JAzLHdX.exe
  C:\Windows\System\JAzLHdX.exe
  2⤵
  PID:7656
- C:\Windows\System\figwMRI.exe
  C:\Windows\System\figwMRI.exe
  2⤵
  PID:7672
- C:\Windows\System\pAvnLBd.exe
  C:\Windows\System\pAvnLBd.exe
  2⤵
  PID:7688
- C:\Windows\System\DVhuZqO.exe
  C:\Windows\System\DVhuZqO.exe
  2⤵
  PID:7728
- C:\Windows\System\VUMkQVF.exe
  C:\Windows\System\VUMkQVF.exe
  2⤵
  PID:7744
- C:\Windows\System\ATkOYSc.exe
  C:\Windows\System\ATkOYSc.exe
  2⤵
  PID:7760
- C:\Windows\System\TGMHeeJ.exe
  C:\Windows\System\TGMHeeJ.exe
  2⤵
  PID:7776
- C:\Windows\System\mDgwnQi.exe
  C:\Windows\System\mDgwnQi.exe
  2⤵
  PID:7792
- C:\Windows\System\fNxzBbW.exe
  C:\Windows\System\fNxzBbW.exe
  2⤵
  PID:7808
- C:\Windows\System\UgIyjkx.exe
  C:\Windows\System\UgIyjkx.exe
  2⤵
  PID:7824
- C:\Windows\System\MIvMqwZ.exe
  C:\Windows\System\MIvMqwZ.exe
  2⤵
  PID:7840
- C:\Windows\System\bgsDsLt.exe
  C:\Windows\System\bgsDsLt.exe
  2⤵
  PID:7856
- C:\Windows\System\iZJrQgZ.exe
  C:\Windows\System\iZJrQgZ.exe
  2⤵
  PID:7872
- C:\Windows\System\yBrCBkV.exe
  C:\Windows\System\yBrCBkV.exe
  2⤵
  PID:7888
- C:\Windows\System\vNHdMJs.exe
  C:\Windows\System\vNHdMJs.exe
  2⤵
  PID:7908
- C:\Windows\System\ggOehky.exe
  C:\Windows\System\ggOehky.exe
  2⤵
  PID:7924
- C:\Windows\System\FMfodLN.exe
  C:\Windows\System\FMfodLN.exe
  2⤵
  PID:7940
- C:\Windows\System\VpBVKfK.exe
  C:\Windows\System\VpBVKfK.exe
  2⤵
  PID:7956
- C:\Windows\System\PPDnoIs.exe
  C:\Windows\System\PPDnoIs.exe
  2⤵
  PID:7972
- C:\Windows\System\AUaYzzh.exe
  C:\Windows\System\AUaYzzh.exe
  2⤵
  PID:8000
- C:\Windows\System\ohcvbTT.exe
  C:\Windows\System\ohcvbTT.exe
  2⤵
  PID:8024
- C:\Windows\System\xCbrvRh.exe
  C:\Windows\System\xCbrvRh.exe
  2⤵
  PID:8048
- C:\Windows\System\syhZptI.exe
  C:\Windows\System\syhZptI.exe
  2⤵
  PID:8068
- C:\Windows\System\ScXsLmo.exe
  C:\Windows\System\ScXsLmo.exe
  2⤵
  PID:8084
- C:\Windows\System\nRTdQhB.exe
  C:\Windows\System\nRTdQhB.exe
  2⤵
  PID:8104
- C:\Windows\System\JxQmUVm.exe
  C:\Windows\System\JxQmUVm.exe
  2⤵
  PID:8120
- C:\Windows\System\rDwjCsk.exe
  C:\Windows\System\rDwjCsk.exe
  2⤵
  PID:8140
- C:\Windows\System\UDLlfHb.exe
  C:\Windows\System\UDLlfHb.exe
  2⤵
  PID:8156
- C:\Windows\System\ybvhlBO.exe
  C:\Windows\System\ybvhlBO.exe
  2⤵
  PID:8172
- C:\Windows\System\RjNgrcU.exe
  C:\Windows\System\RjNgrcU.exe
  2⤵
  PID:8188
- C:\Windows\System\HnQuCyu.exe
  C:\Windows\System\HnQuCyu.exe
  2⤵
  PID:6968
- C:\Windows\System\UmMOVSq.exe
  C:\Windows\System\UmMOVSq.exe
  2⤵
  PID:7176
- C:\Windows\System\hYWcORD.exe
  C:\Windows\System\hYWcORD.exe
  2⤵
  PID:7208
- C:\Windows\System\pNyMTwF.exe
  C:\Windows\System\pNyMTwF.exe
  2⤵
  PID:7248
- C:\Windows\System\pxDsFLv.exe
  C:\Windows\System\pxDsFLv.exe
  2⤵
  PID:7344
- C:\Windows\System\jrtmnfF.exe
  C:\Windows\System\jrtmnfF.exe
  2⤵
  PID:7376
- C:\Windows\System\AwgkJnr.exe
  C:\Windows\System\AwgkJnr.exe
  2⤵
  PID:7196
- C:\Windows\System\HZFIyRi.exe
  C:\Windows\System\HZFIyRi.exe
  2⤵
  PID:7224
- C:\Windows\System\dHJDifT.exe
  C:\Windows\System\dHJDifT.exe
  2⤵
  PID:7296
- C:\Windows\System\xzwYaBt.exe
  C:\Windows\System\xzwYaBt.exe
  2⤵
  PID:7364
- C:\Windows\System\EsSRHsy.exe
  C:\Windows\System\EsSRHsy.exe
  2⤵
  PID:7468
- C:\Windows\System\vnfIXpA.exe
  C:\Windows\System\vnfIXpA.exe
  2⤵
  PID:7500
- C:\Windows\System\KTDaJrS.exe
  C:\Windows\System\KTDaJrS.exe
  2⤵
  PID:7516
- C:\Windows\System\nrujtqC.exe
  C:\Windows\System\nrujtqC.exe
  2⤵
  PID:7532
- C:\Windows\System\grwIOIj.exe
  C:\Windows\System\grwIOIj.exe
  2⤵
  PID:7552
- C:\Windows\System\SubtqdY.exe
  C:\Windows\System\SubtqdY.exe
  2⤵
  PID:7568
- C:\Windows\System\ehcJIeS.exe
  C:\Windows\System\ehcJIeS.exe
  2⤵
  PID:7580
- C:\Windows\System\wkzkWQZ.exe
  C:\Windows\System\wkzkWQZ.exe
  2⤵
  PID:7600
- C:\Windows\System\LGSNMWO.exe
  C:\Windows\System\LGSNMWO.exe
  2⤵
  PID:7620
- C:\Windows\System\xnNNbOk.exe
  C:\Windows\System\xnNNbOk.exe
  2⤵
  PID:7636
- C:\Windows\System\KdWkdxa.exe
  C:\Windows\System\KdWkdxa.exe
  2⤵
  PID:7668
- C:\Windows\System\FEoLBTn.exe
  C:\Windows\System\FEoLBTn.exe
  2⤵
  PID:7700
- C:\Windows\System\UeKUsck.exe
  C:\Windows\System\UeKUsck.exe
  2⤵
  PID:7716
- C:\Windows\System\fAAEIig.exe
  C:\Windows\System\fAAEIig.exe
  2⤵
  PID:7736
- C:\Windows\System\cXxcsbg.exe
  C:\Windows\System\cXxcsbg.exe
  2⤵
  PID:7804
- C:\Windows\System\EcVnXnS.exe
  C:\Windows\System\EcVnXnS.exe
  2⤵
  PID:7932
- C:\Windows\System\KMlHSSc.exe
  C:\Windows\System\KMlHSSc.exe
  2⤵
  PID:7820
- C:\Windows\System\orfsCyn.exe
  C:\Windows\System\orfsCyn.exe
  2⤵
  PID:7920
- C:\Windows\System\JuuIcOK.exe
  C:\Windows\System\JuuIcOK.exe
  2⤵
  PID:7988
- C:\Windows\System\VLPGlAr.exe
  C:\Windows\System\VLPGlAr.exe
  2⤵
  PID:8016
- C:\Windows\System\YCkEcmj.exe
  C:\Windows\System\YCkEcmj.exe
  2⤵
  PID:8060
- C:\Windows\System\dpHQrxn.exe
  C:\Windows\System\dpHQrxn.exe
  2⤵
  PID:8096
- C:\Windows\System\zjnybdB.exe
  C:\Windows\System\zjnybdB.exe
  2⤵
  PID:8080
- C:\Windows\System\YbJXWKu.exe
  C:\Windows\System\YbJXWKu.exe
  2⤵
  PID:8136
- C:\Windows\System\eipIoLc.exe
  C:\Windows\System\eipIoLc.exe
  2⤵
  PID:8152
- C:\Windows\System\ZJlXEwr.exe
  C:\Windows\System\ZJlXEwr.exe
  2⤵
  PID:6280
- C:\Windows\System\kWduWZL.exe
  C:\Windows\System\kWduWZL.exe
  2⤵
  PID:7280
- C:\Windows\System\tvSYqcj.exe
  C:\Windows\System\tvSYqcj.exe
  2⤵
  PID:7308
- C:\Windows\System\stPeWZz.exe
  C:\Windows\System\stPeWZz.exe
  2⤵
  PID:7348
- C:\Windows\System\YOobSMg.exe
  C:\Windows\System\YOobSMg.exe
  2⤵
  PID:7292
- C:\Windows\System\CMvCdfc.exe
  C:\Windows\System\CMvCdfc.exe
  2⤵
  PID:7360
- C:\Windows\System\PalPJSH.exe
  C:\Windows\System\PalPJSH.exe
  2⤵
  PID:7512
- C:\Windows\System\ADkIOjy.exe
  C:\Windows\System\ADkIOjy.exe
  2⤵
  PID:7576
- C:\Windows\System\jvNcfPN.exe
  C:\Windows\System\jvNcfPN.exe
  2⤵
  PID:7524
- C:\Windows\System\WYKfbgJ.exe
  C:\Windows\System\WYKfbgJ.exe
  2⤵
  PID:7592
- C:\Windows\System\itJHcjA.exe
  C:\Windows\System\itJHcjA.exe
  2⤵
  PID:7652
- C:\Windows\System\xkyyAFD.exe
  C:\Windows\System\xkyyAFD.exe
  2⤵
  PID:7612
- C:\Windows\System\ntzNUda.exe
  C:\Windows\System\ntzNUda.exe
  2⤵
  PID:7836
- C:\Windows\System\sZPewHe.exe
  C:\Windows\System\sZPewHe.exe
  2⤵
  PID:7696
- C:\Windows\System\azmWQBe.exe
  C:\Windows\System\azmWQBe.exe
  2⤵
  PID:7936
- C:\Windows\System\PTvDVqK.exe
  C:\Windows\System\PTvDVqK.exe
  2⤵
  PID:7752
- C:\Windows\System\FwlZmav.exe
  C:\Windows\System\FwlZmav.exe
  2⤵
  PID:7980
- C:\Windows\System\fPEOyaL.exe
  C:\Windows\System\fPEOyaL.exe
  2⤵
  PID:8040
- C:\Windows\System\yQlaJfi.exe
  C:\Windows\System\yQlaJfi.exe
  2⤵
  PID:8148
- C:\Windows\System\DBFVjfS.exe
  C:\Windows\System\DBFVjfS.exe
  2⤵
  PID:7396
- C:\Windows\System\mLTsQNg.exe
  C:\Windows\System\mLTsQNg.exe
  2⤵
  PID:7548
- C:\Windows\System\rUuImaZ.exe
  C:\Windows\System\rUuImaZ.exe
  2⤵
  PID:7708
- C:\Windows\System\iONQexk.exe
  C:\Windows\System\iONQexk.exe
  2⤵
  PID:8092
- C:\Windows\System\vKTYqRV.exe
  C:\Windows\System\vKTYqRV.exe
  2⤵
  PID:8184
- C:\Windows\System\ZEgVXLr.exe
  C:\Windows\System\ZEgVXLr.exe
  2⤵
  PID:7264
- C:\Windows\System\iayZXPm.exe
  C:\Windows\System\iayZXPm.exe
  2⤵
  PID:7852
- C:\Windows\System\boaJvui.exe
  C:\Windows\System\boaJvui.exe
  2⤵
  PID:7240
- C:\Windows\System\ofmzoYg.exe
  C:\Windows\System\ofmzoYg.exe
  2⤵
  PID:7800
- C:\Windows\System\IscuxLS.exe
  C:\Windows\System\IscuxLS.exe
  2⤵
  PID:7768
- C:\Windows\System\FQPoGVS.exe
  C:\Windows\System\FQPoGVS.exe
  2⤵
  PID:7816
- C:\Windows\System\eSNISwr.exe
  C:\Windows\System\eSNISwr.exe
  2⤵
  PID:7632
- C:\Windows\System\AuefucH.exe
  C:\Windows\System\AuefucH.exe
  2⤵
  PID:6212
- C:\Windows\System\MxIsRqT.exe
  C:\Windows\System\MxIsRqT.exe
  2⤵
  PID:7428
- C:\Windows\System\HYSzUQi.exe
  C:\Windows\System\HYSzUQi.exe
  2⤵
  PID:7628
- C:\Windows\System\yUDZOQE.exe
  C:\Windows\System\yUDZOQE.exe
  2⤵
  PID:7608
- C:\Windows\System\qtCpKdJ.exe
  C:\Windows\System\qtCpKdJ.exe
  2⤵
  PID:7616
- C:\Windows\System\AeUbyqV.exe
  C:\Windows\System\AeUbyqV.exe
  2⤵
  PID:7720
- C:\Windows\System\OGutRKe.exe
  C:\Windows\System\OGutRKe.exe
  2⤵
  PID:7684
- C:\Windows\System\aTtihWr.exe
  C:\Windows\System\aTtihWr.exe
  2⤵
  PID:8012
- C:\Windows\System\RjdWQfz.exe
  C:\Windows\System\RjdWQfz.exe
  2⤵
  PID:8196
- C:\Windows\System\ZznGWll.exe
  C:\Windows\System\ZznGWll.exe
  2⤵
  PID:8212
- C:\Windows\System\qLbPwkJ.exe
  C:\Windows\System\qLbPwkJ.exe
  2⤵
  PID:8228
- C:\Windows\System\EIqeaGZ.exe
  C:\Windows\System\EIqeaGZ.exe
  2⤵
  PID:8244
- C:\Windows\System\rUmcRtv.exe
  C:\Windows\System\rUmcRtv.exe
  2⤵
  PID:8260
- C:\Windows\System\vDbUipi.exe
  C:\Windows\System\vDbUipi.exe
  2⤵
  PID:8276
- C:\Windows\System\HMoyKUa.exe
  C:\Windows\System\HMoyKUa.exe
  2⤵
  PID:8292
- C:\Windows\System\bmlyHao.exe
  C:\Windows\System\bmlyHao.exe
  2⤵
  PID:8308
- C:\Windows\System\JEwNDGT.exe
  C:\Windows\System\JEwNDGT.exe
  2⤵
  PID:8324
- C:\Windows\System\hozBYpT.exe
  C:\Windows\System\hozBYpT.exe
  2⤵
  PID:8340
- C:\Windows\System\ZqLzHlz.exe
  C:\Windows\System\ZqLzHlz.exe
  2⤵
  PID:8356
- C:\Windows\System\rPsZNXT.exe
  C:\Windows\System\rPsZNXT.exe
  2⤵
  PID:8432
- C:\Windows\System\CeCOQyj.exe
  C:\Windows\System\CeCOQyj.exe
  2⤵
  PID:8488
- C:\Windows\System\yEmvsDd.exe
  C:\Windows\System\yEmvsDd.exe
  2⤵
  PID:8508
- C:\Windows\System\CMZKZat.exe
  C:\Windows\System\CMZKZat.exe
  2⤵
  PID:8524
- C:\Windows\System\XwjqEAL.exe
  C:\Windows\System\XwjqEAL.exe
  2⤵
  PID:8552
- C:\Windows\System\GnRdFMI.exe
  C:\Windows\System\GnRdFMI.exe
  2⤵
  PID:8636
- C:\Windows\System\SOOigOc.exe
  C:\Windows\System\SOOigOc.exe
  2⤵
  PID:8740
- C:\Windows\System\jlLYLJb.exe
  C:\Windows\System\jlLYLJb.exe
  2⤵
  PID:8756
- C:\Windows\System\bMVlYce.exe
  C:\Windows\System\bMVlYce.exe
  2⤵
  PID:8772
- C:\Windows\System\jpsDsZj.exe
  C:\Windows\System\jpsDsZj.exe
  2⤵
  PID:8788
- C:\Windows\System\XAGKimW.exe
  C:\Windows\System\XAGKimW.exe
  2⤵
  PID:8808
- C:\Windows\System\WZHkxPn.exe
  C:\Windows\System\WZHkxPn.exe
  2⤵
  PID:8848
- C:\Windows\System\ESgLGca.exe
  C:\Windows\System\ESgLGca.exe
  2⤵
  PID:8864
- C:\Windows\System\XjbkLKA.exe
  C:\Windows\System\XjbkLKA.exe
  2⤵
  PID:8880
- C:\Windows\System\lTMTmdC.exe
  C:\Windows\System\lTMTmdC.exe
  2⤵
  PID:8896
- C:\Windows\System\SjApBln.exe
  C:\Windows\System\SjApBln.exe
  2⤵
  PID:8912
- C:\Windows\System\xyBgyVQ.exe
  C:\Windows\System\xyBgyVQ.exe
  2⤵
  PID:8928
- C:\Windows\System\dyweTRd.exe
  C:\Windows\System\dyweTRd.exe
  2⤵
  PID:8944
- C:\Windows\System\vHonMFK.exe
  C:\Windows\System\vHonMFK.exe
  2⤵
  PID:8960
- C:\Windows\System\KWDHHfQ.exe
  C:\Windows\System\KWDHHfQ.exe
  2⤵
  PID:8976
- C:\Windows\System\fnyakBZ.exe
  C:\Windows\System\fnyakBZ.exe
  2⤵
  PID:8992
- C:\Windows\System\FkMxcQI.exe
  C:\Windows\System\FkMxcQI.exe
  2⤵
  PID:9008
- C:\Windows\System\cTgQZwa.exe
  C:\Windows\System\cTgQZwa.exe
  2⤵
  PID:9024
- C:\Windows\System\LgUJVVi.exe
  C:\Windows\System\LgUJVVi.exe
  2⤵
  PID:9040
- C:\Windows\System\KOsEgMm.exe
  C:\Windows\System\KOsEgMm.exe
  2⤵
  PID:9056
- C:\Windows\System\tbhKkcx.exe
  C:\Windows\System\tbhKkcx.exe
  2⤵
  PID:9072
- C:\Windows\System\YQTfsrl.exe
  C:\Windows\System\YQTfsrl.exe
  2⤵
  PID:9088
- C:\Windows\System\aOYPnok.exe
  C:\Windows\System\aOYPnok.exe
  2⤵
  PID:9104
- C:\Windows\System\bBpWUKJ.exe
  C:\Windows\System\bBpWUKJ.exe
  2⤵
  PID:9120
- C:\Windows\System\DEmNyye.exe
  C:\Windows\System\DEmNyye.exe
  2⤵
  PID:9136
- C:\Windows\System\aDwSckp.exe
  C:\Windows\System\aDwSckp.exe
  2⤵
  PID:9152
- C:\Windows\System\JFmTFox.exe
  C:\Windows\System\JFmTFox.exe
  2⤵
  PID:9168
- C:\Windows\System\NliRDLM.exe
  C:\Windows\System\NliRDLM.exe
  2⤵
  PID:9184
- C:\Windows\System\Mpdunex.exe
  C:\Windows\System\Mpdunex.exe
  2⤵
  PID:9200
- C:\Windows\System\bzIsDeY.exe
  C:\Windows\System\bzIsDeY.exe
  2⤵
  PID:8036
- C:\Windows\System\fRRCDSC.exe
  C:\Windows\System\fRRCDSC.exe
  2⤵
  PID:8252
- C:\Windows\System\JefXLMy.exe
  C:\Windows\System\JefXLMy.exe
  2⤵
  PID:8256
- C:\Windows\System\GKztVCC.exe
  C:\Windows\System\GKztVCC.exe
  2⤵
  PID:8320
- C:\Windows\System\SHiygDp.exe
  C:\Windows\System\SHiygDp.exe
  2⤵
  PID:7880
- C:\Windows\System\pwVrtkC.exe
  C:\Windows\System\pwVrtkC.exe
  2⤵
  PID:7916
- C:\Windows\System\jssXdrt.exe
  C:\Windows\System\jssXdrt.exe
  2⤵
  PID:8240
- C:\Windows\System\HMPGZjV.exe
  C:\Windows\System\HMPGZjV.exe
  2⤵
  PID:8304
- C:\Windows\System\VJeURvf.exe
  C:\Windows\System\VJeURvf.exe
  2⤵
  PID:8376
- C:\Windows\System\QtsTluG.exe
  C:\Windows\System\QtsTluG.exe
  2⤵
  PID:8392
- C:\Windows\System\DwmpFHC.exe
  C:\Windows\System\DwmpFHC.exe
  2⤵
  PID:8408
- C:\Windows\System\OCOtDjG.exe
  C:\Windows\System\OCOtDjG.exe
  2⤵
  PID:8424
- C:\Windows\System\gHxpNTs.exe
  C:\Windows\System\gHxpNTs.exe
  2⤵
  PID:8448
- C:\Windows\System\FykuIDb.exe
  C:\Windows\System\FykuIDb.exe
  2⤵
  PID:8464
- C:\Windows\System\OFstLEg.exe
  C:\Windows\System\OFstLEg.exe
  2⤵
  PID:8496
- C:\Windows\System\FXmgnWv.exe
  C:\Windows\System\FXmgnWv.exe
  2⤵
  PID:8444
- C:\Windows\System\wDepfkm.exe
  C:\Windows\System\wDepfkm.exe
  2⤵
  PID:8540
- C:\Windows\System\xdekbMe.exe
  C:\Windows\System\xdekbMe.exe
  2⤵
  PID:8560
- C:\Windows\System\CZypZHq.exe
  C:\Windows\System\CZypZHq.exe
  2⤵
  PID:8592
- C:\Windows\System\FVwDimO.exe
  C:\Windows\System\FVwDimO.exe
  2⤵
  PID:8616
- C:\Windows\System\AzVpofp.exe
  C:\Windows\System\AzVpofp.exe
  2⤵
  PID:8600
- C:\Windows\System\xucDdRx.exe
  C:\Windows\System\xucDdRx.exe
  2⤵
  PID:8620
- C:\Windows\System\uaEuRFf.exe
  C:\Windows\System\uaEuRFf.exe
  2⤵
  PID:8648
- C:\Windows\System\LdLhOjL.exe
  C:\Windows\System\LdLhOjL.exe
  2⤵
  PID:8660
- C:\Windows\System\kHeqqxa.exe
  C:\Windows\System\kHeqqxa.exe
  2⤵
  PID:8680
- C:\Windows\System\pbnBjAS.exe
  C:\Windows\System\pbnBjAS.exe
  2⤵
  PID:8688
- C:\Windows\System\ePaLZAN.exe
  C:\Windows\System\ePaLZAN.exe
  2⤵
  PID:8716
- C:\Windows\System\rdCSKza.exe
  C:\Windows\System\rdCSKza.exe
  2⤵
  PID:8728
- C:\Windows\System\vBPIkDn.exe
  C:\Windows\System\vBPIkDn.exe
  2⤵
  PID:8780
- C:\Windows\System\baFsfCp.exe
  C:\Windows\System\baFsfCp.exe
  2⤵
  PID:8816
- C:\Windows\System\neGVtKm.exe
  C:\Windows\System\neGVtKm.exe
  2⤵
  PID:8840
- C:\Windows\System\FOFhcqm.exe
  C:\Windows\System\FOFhcqm.exe
  2⤵
  PID:8804
- C:\Windows\System\NvBJGwl.exe
  C:\Windows\System\NvBJGwl.exe
  2⤵
  PID:8872
- C:\Windows\System\NfsGhfF.exe
  C:\Windows\System\NfsGhfF.exe
  2⤵
  PID:8936
- C:\Windows\System\CBpmZBW.exe
  C:\Windows\System\CBpmZBW.exe
  2⤵
  PID:8888
- C:\Windows\System\tsGidoT.exe
  C:\Windows\System\tsGidoT.exe
  2⤵
  PID:8892
- C:\Windows\System\RmDaycW.exe
  C:\Windows\System\RmDaycW.exe
  2⤵
  PID:9004
- C:\Windows\System\LGAEEma.exe
  C:\Windows\System\LGAEEma.exe
  2⤵
  PID:8988
- C:\Windows\System\ZxSCCnW.exe
  C:\Windows\System\ZxSCCnW.exe
  2⤵
  PID:9052
- C:\Windows\System\iNCUzuX.exe
  C:\Windows\System\iNCUzuX.exe
  2⤵
  PID:9096
- C:\Windows\System\IOBnasT.exe
  C:\Windows\System\IOBnasT.exe
  2⤵
  PID:9164
- C:\Windows\System\lFJYJcN.exe
  C:\Windows\System\lFJYJcN.exe
  2⤵
  PID:8128
- C:\Windows\System\nvMHHPn.exe
  C:\Windows\System\nvMHHPn.exe
  2⤵
  PID:8336
- C:\Windows\System\aOtVKWd.exe
  C:\Windows\System\aOtVKWd.exe
  2⤵
  PID:8236
- C:\Windows\System\dLxNAqZ.exe
  C:\Windows\System\dLxNAqZ.exe
  2⤵
  PID:8388
- C:\Windows\System\rqKIyCd.exe
  C:\Windows\System\rqKIyCd.exe
  2⤵
  PID:8460
- C:\Windows\System\udDZqdC.exe
  C:\Windows\System\udDZqdC.exe
  2⤵
  PID:8372
- C:\Windows\System\Wkffbjz.exe
  C:\Windows\System\Wkffbjz.exe
  2⤵
  PID:8440
- C:\Windows\System\xWVjwUO.exe
  C:\Windows\System\xWVjwUO.exe
  2⤵
  PID:8536
- C:\Windows\System\LNiZAqw.exe
  C:\Windows\System\LNiZAqw.exe
  2⤵
  PID:8576
- C:\Windows\System\mmXIFJS.exe
  C:\Windows\System\mmXIFJS.exe
  2⤵
  PID:8056
- C:\Windows\System\xPXunho.exe
  C:\Windows\System\xPXunho.exe
  2⤵
  PID:8664
- C:\Windows\System\VgqSvbK.exe
  C:\Windows\System\VgqSvbK.exe
  2⤵
  PID:8676
- C:\Windows\System\rBbvYbW.exe
  C:\Windows\System\rBbvYbW.exe
  2⤵
  PID:8748
- C:\Windows\System\jgBLrhw.exe
  C:\Windows\System\jgBLrhw.exe
  2⤵
  PID:8904
- C:\Windows\System\aqrQvaG.exe
  C:\Windows\System\aqrQvaG.exe
  2⤵
  PID:9116
- C:\Windows\System\IpOGBNN.exe
  C:\Windows\System\IpOGBNN.exe
  2⤵
  PID:9212
- C:\Windows\System\hMgnlwS.exe
  C:\Windows\System\hMgnlwS.exe
  2⤵
  PID:8548
- C:\Windows\System\UhoixdN.exe
  C:\Windows\System\UhoixdN.exe
  2⤵
  PID:8656
- C:\Windows\System\CgzvMHd.exe
  C:\Windows\System\CgzvMHd.exe
  2⤵
  PID:7544
- C:\Windows\System\QygCSpG.exe
  C:\Windows\System\QygCSpG.exe
  2⤵
  PID:8272
- C:\Windows\System\DGwtJXA.exe
  C:\Windows\System\DGwtJXA.exe
  2⤵
  PID:8596
- C:\Windows\System\tyBKllV.exe
  C:\Windows\System\tyBKllV.exe
  2⤵
  PID:8672
- C:\Windows\System\KaynaIY.exe
  C:\Windows\System\KaynaIY.exe
  2⤵
  PID:8920
- C:\Windows\System\bxQALgX.exe
  C:\Windows\System\bxQALgX.exe
  2⤵
  PID:8968
- C:\Windows\System\ckmczIH.exe
  C:\Windows\System\ckmczIH.exe
  2⤵
  PID:8572
- C:\Windows\System\XpFqhMz.exe
  C:\Windows\System\XpFqhMz.exe
  2⤵
  PID:8428
- C:\Windows\System\VBcDRga.exe
  C:\Windows\System\VBcDRga.exe
  2⤵
  PID:8644
- C:\Windows\System\wvZwBPu.exe
  C:\Windows\System\wvZwBPu.exe
  2⤵
  PID:9080
- C:\Windows\System\LoclgYh.exe
  C:\Windows\System\LoclgYh.exe
  2⤵
  PID:8268
- C:\Windows\System\tGraLno.exe
  C:\Windows\System\tGraLno.exe
  2⤵
  PID:8820
- C:\Windows\System\IaKgqnT.exe
  C:\Windows\System\IaKgqnT.exe
  2⤵
  PID:9020
- C:\Windows\System\mUNBtbZ.exe
  C:\Windows\System\mUNBtbZ.exe
  2⤵
  PID:9148
- C:\Windows\System\NufHniG.exe
  C:\Windows\System\NufHniG.exe
  2⤵
  PID:8224
- C:\Windows\System\Tpkzoib.exe
  C:\Windows\System\Tpkzoib.exe
  2⤵
  PID:8316
- C:\Windows\System\DNmbJrP.exe
  C:\Windows\System\DNmbJrP.exe
  2⤵
  PID:8724
- C:\Windows\System\FQXYsCd.exe
  C:\Windows\System\FQXYsCd.exe
  2⤵
  PID:8736
- C:\Windows\System\ySDQpan.exe
  C:\Windows\System\ySDQpan.exe
  2⤵
  PID:8956
- C:\Windows\System\TrWjkjr.exe
  C:\Windows\System\TrWjkjr.exe
  2⤵
  PID:8332
- C:\Windows\System\lhYoDhd.exe
  C:\Windows\System\lhYoDhd.exe
  2⤵
  PID:8860
- C:\Windows\System\AWdiuve.exe
  C:\Windows\System\AWdiuve.exe
  2⤵
  PID:9196
- C:\Windows\System\tUImnMi.exe
  C:\Windows\System\tUImnMi.exe
  2⤵
  PID:8404
- C:\Windows\System\dOfbKxc.exe
  C:\Windows\System\dOfbKxc.exe
  2⤵
  PID:8824
- C:\Windows\System\UZMPiWj.exe
  C:\Windows\System\UZMPiWj.exe
  2⤵
  PID:9228
- C:\Windows\System\AhedCUu.exe
  C:\Windows\System\AhedCUu.exe
  2⤵
  PID:9248
- C:\Windows\System\GfNamrY.exe
  C:\Windows\System\GfNamrY.exe
  2⤵
  PID:9264
- C:\Windows\System\yxPDYjx.exe
  C:\Windows\System\yxPDYjx.exe
  2⤵
  PID:9280
- C:\Windows\System\RvhPuZL.exe
  C:\Windows\System\RvhPuZL.exe
  2⤵
  PID:9296
- C:\Windows\System\PFWMEtL.exe
  C:\Windows\System\PFWMEtL.exe
  2⤵
  PID:9316
- C:\Windows\System\ZfDBLbq.exe
  C:\Windows\System\ZfDBLbq.exe
  2⤵
  PID:9348
- C:\Windows\System\gmvtpOg.exe
  C:\Windows\System\gmvtpOg.exe
  2⤵
  PID:9364
- C:\Windows\System\ksUSWoj.exe
  C:\Windows\System\ksUSWoj.exe
  2⤵
  PID:9380
- C:\Windows\System\VflYHDm.exe
  C:\Windows\System\VflYHDm.exe
  2⤵
  PID:9396
- C:\Windows\System\JQvaLbq.exe
  C:\Windows\System\JQvaLbq.exe
  2⤵
  PID:9412
- C:\Windows\System\XCGzHHC.exe
  C:\Windows\System\XCGzHHC.exe
  2⤵
  PID:9428
- C:\Windows\System\ukRFGBe.exe
  C:\Windows\System\ukRFGBe.exe
  2⤵
  PID:9444
- C:\Windows\System\ylXiUCz.exe
  C:\Windows\System\ylXiUCz.exe
  2⤵
  PID:9460
- C:\Windows\System\hdMMVXC.exe
  C:\Windows\System\hdMMVXC.exe
  2⤵
  PID:9484
- C:\Windows\System\gSjFIbo.exe
  C:\Windows\System\gSjFIbo.exe
  2⤵
  PID:9508
- C:\Windows\System\TEqvyIb.exe
  C:\Windows\System\TEqvyIb.exe
  2⤵
  PID:9524
- C:\Windows\System\xSyjykb.exe
  C:\Windows\System\xSyjykb.exe
  2⤵
  PID:9540
- C:\Windows\System\GKBPWTv.exe
  C:\Windows\System\GKBPWTv.exe
  2⤵
  PID:9560
- C:\Windows\System\FPQEoot.exe
  C:\Windows\System\FPQEoot.exe
  2⤵
  PID:9576
- C:\Windows\System\LJuqxWP.exe
  C:\Windows\System\LJuqxWP.exe
  2⤵
  PID:9596
- C:\Windows\System\cCgYvjP.exe
  C:\Windows\System\cCgYvjP.exe
  2⤵
  PID:9612
- C:\Windows\System\aplVpXX.exe
  C:\Windows\System\aplVpXX.exe
  2⤵
  PID:9640
- C:\Windows\System\UvjGMPv.exe
  C:\Windows\System\UvjGMPv.exe
  2⤵
  PID:9656
- C:\Windows\System\FsXBLOB.exe
  C:\Windows\System\FsXBLOB.exe
  2⤵
  PID:9672
- C:\Windows\System\LTdZhYY.exe
  C:\Windows\System\LTdZhYY.exe
  2⤵
  PID:9688
- C:\Windows\System\IwRibzd.exe
  C:\Windows\System\IwRibzd.exe
  2⤵
  PID:9704
- C:\Windows\System\vFCEgDP.exe
  C:\Windows\System\vFCEgDP.exe
  2⤵
  PID:9720
- C:\Windows\System\disPGwi.exe
  C:\Windows\System\disPGwi.exe
  2⤵
  PID:9736
- C:\Windows\System\iJyPFzU.exe
  C:\Windows\System\iJyPFzU.exe
  2⤵
  PID:9752
- C:\Windows\System\ZlLJkoU.exe
  C:\Windows\System\ZlLJkoU.exe
  2⤵
  PID:9768
- C:\Windows\System\JMASbZp.exe
  C:\Windows\System\JMASbZp.exe
  2⤵
  PID:9784
- C:\Windows\System\IYGeTfC.exe
  C:\Windows\System\IYGeTfC.exe
  2⤵
  PID:9800
- C:\Windows\System\YBdqcSb.exe
  C:\Windows\System\YBdqcSb.exe
  2⤵
  PID:9816
- C:\Windows\System\yWChElQ.exe
  C:\Windows\System\yWChElQ.exe
  2⤵
  PID:9832
- C:\Windows\System\dXwrOAi.exe
  C:\Windows\System\dXwrOAi.exe
  2⤵
  PID:9848
- C:\Windows\System\kTDLYzl.exe
  C:\Windows\System\kTDLYzl.exe
  2⤵
  PID:9868
- C:\Windows\System\AtiDHIE.exe
  C:\Windows\System\AtiDHIE.exe
  2⤵
  PID:9884
- C:\Windows\System\RmSYbKY.exe
  C:\Windows\System\RmSYbKY.exe
  2⤵
  PID:9900
- C:\Windows\System\IzgZvor.exe
  C:\Windows\System\IzgZvor.exe
  2⤵
  PID:9916
- C:\Windows\System\ZTbJHpd.exe
  C:\Windows\System\ZTbJHpd.exe
  2⤵
  PID:9932
- C:\Windows\System\LmfvjsP.exe
  C:\Windows\System\LmfvjsP.exe
  2⤵
  PID:9948
- C:\Windows\System\QVtqymy.exe
  C:\Windows\System\QVtqymy.exe
  2⤵
  PID:9964
- C:\Windows\System\WVmkZxr.exe
  C:\Windows\System\WVmkZxr.exe
  2⤵
  PID:9980
- C:\Windows\System\BwyLkFn.exe
  C:\Windows\System\BwyLkFn.exe
  2⤵
  PID:9996
- C:\Windows\System\eqZLoqc.exe
  C:\Windows\System\eqZLoqc.exe
  2⤵
  PID:10012
- C:\Windows\System\DXJFemc.exe
  C:\Windows\System\DXJFemc.exe
  2⤵
  PID:10028
- C:\Windows\System\sTrJAkJ.exe
  C:\Windows\System\sTrJAkJ.exe
  2⤵
  PID:10048
- C:\Windows\System\PagUSKT.exe
  C:\Windows\System\PagUSKT.exe
  2⤵
  PID:10064
- C:\Windows\System\rgncdxk.exe
  C:\Windows\System\rgncdxk.exe
  2⤵
  PID:10080
- C:\Windows\System\MvPHMiZ.exe
  C:\Windows\System\MvPHMiZ.exe
  2⤵
  PID:10096
- C:\Windows\System\DgpDguQ.exe
  C:\Windows\System\DgpDguQ.exe
  2⤵
  PID:10112
- C:\Windows\System\BdfPhjd.exe
  C:\Windows\System\BdfPhjd.exe
  2⤵
  PID:10128
- C:\Windows\System\KZEBeMd.exe
  C:\Windows\System\KZEBeMd.exe
  2⤵
  PID:10144
- C:\Windows\System\KBwqsFv.exe
  C:\Windows\System\KBwqsFv.exe
  2⤵
  PID:10160
- C:\Windows\System\qcRwECi.exe
  C:\Windows\System\qcRwECi.exe
  2⤵
  PID:10176
- C:\Windows\System\MijZgol.exe
  C:\Windows\System\MijZgol.exe
  2⤵
  PID:10192
- C:\Windows\System\ADXYrwX.exe
  C:\Windows\System\ADXYrwX.exe
  2⤵
  PID:10208
- C:\Windows\System\xGaSoyE.exe
  C:\Windows\System\xGaSoyE.exe
  2⤵
  PID:10224
- C:\Windows\System\itHjNYz.exe
  C:\Windows\System\itHjNYz.exe
  2⤵
  PID:8516
- C:\Windows\System\qAsCpPc.exe
  C:\Windows\System\qAsCpPc.exe
  2⤵
  PID:8856
- C:\Windows\System\nPPYRDb.exe
  C:\Windows\System\nPPYRDb.exe
  2⤵
  PID:8480
- C:\Windows\System\RtERXfm.exe
  C:\Windows\System\RtERXfm.exe
  2⤵
  PID:9016
- C:\Windows\System\zRhhoQQ.exe
  C:\Windows\System\zRhhoQQ.exe
  2⤵
  PID:9288
- C:\Windows\System\PEHzPKq.exe
  C:\Windows\System\PEHzPKq.exe
  2⤵
  PID:9308
- C:\Windows\System\VSYMfgq.exe
  C:\Windows\System\VSYMfgq.exe
  2⤵
  PID:9332
- C:\Windows\System\rHiKxZp.exe
  C:\Windows\System\rHiKxZp.exe
  2⤵
  PID:9356
- C:\Windows\System\rgKPFTI.exe
  C:\Windows\System\rgKPFTI.exe
  2⤵
  PID:9376
- C:\Windows\System\zWWEWtf.exe
  C:\Windows\System\zWWEWtf.exe
  2⤵
  PID:9388
- C:\Windows\System\yTeCGan.exe
  C:\Windows\System\yTeCGan.exe
  2⤵
  PID:9468
- C:\Windows\System\GIWLCor.exe
  C:\Windows\System\GIWLCor.exe
  2⤵
  PID:9476
- C:\Windows\System\eYhCyCK.exe
  C:\Windows\System\eYhCyCK.exe
  2⤵
  PID:9516
- C:\Windows\System\QyaCYpi.exe
  C:\Windows\System\QyaCYpi.exe
  2⤵
  PID:9504
- C:\Windows\System\ltcuNhm.exe
  C:\Windows\System\ltcuNhm.exe
  2⤵
  PID:9572
- C:\Windows\System\ddYvUhN.exe
  C:\Windows\System\ddYvUhN.exe
  2⤵
  PID:9592
- C:\Windows\System\VSICdXZ.exe
  C:\Windows\System\VSICdXZ.exe
  2⤵
  PID:9620
- C:\Windows\System\besAgDd.exe
  C:\Windows\System\besAgDd.exe
  2⤵
  PID:9664
- C:\Windows\System\mpaAMwb.exe
  C:\Windows\System\mpaAMwb.exe
  2⤵
  PID:9728
- C:\Windows\System\CVSrkVj.exe
  C:\Windows\System\CVSrkVj.exe
  2⤵
  PID:9652
- C:\Windows\System\ttdLTuf.exe
  C:\Windows\System\ttdLTuf.exe
  2⤵
  PID:9760
- C:\Windows\System\YXDUQAu.exe
  C:\Windows\System\YXDUQAu.exe
  2⤵
  PID:9796
- C:\Windows\System\fXetlsR.exe
  C:\Windows\System\fXetlsR.exe
  2⤵
  PID:9864
- C:\Windows\System\hUuXdpz.exe
  C:\Windows\System\hUuXdpz.exe
  2⤵
  PID:9896
- C:\Windows\System\upNLskI.exe
  C:\Windows\System\upNLskI.exe
  2⤵
  PID:9928
- C:\Windows\System\JhFqmpn.exe
  C:\Windows\System\JhFqmpn.exe
  2⤵
  PID:9940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CGiDVWg.exe

Filesize
1.3MB

MD5
786876b9d11e58112cc15f7e1a143de4

SHA1
9a4dd2e5970095076353d7d50cbef6501644b8b1

SHA256
452dbbc2dbf782408b828164e85856b75a9f0ef299b161926bba180bf4c844ee

SHA512
c7b5501fa39d060f815fdeb2d90e22b2e8c33a810aadd048122dff48d891661c909d4365c6eb7eca251eb9628721c6011b99d7b8281addd3837658121df4aa65

Download Submit
C:\Windows\system\DTmnlEZ.exe

Filesize
1.3MB

MD5
61404e7c0f4a124d7ec5518b239c5f8f

SHA1
d649ac0dc7d2194da0f5ae6007faf6c3df68fece

SHA256
aed99f2534c007aa7949bd89d2578882666afc34c69462199beb4defe6c7e601

SHA512
f422c86c975f72010f11852121c671c674191854b22530cf75e0688b5b1003d8219239ae8d5d398c87c79a3eac15e937dfe6cdbbf55ff9819200d36cd6798d3d

Download Submit
C:\Windows\system\EMnKSUI.exe

Filesize
1.3MB

MD5
d45f3f3e2245182f2f70f2c8f517bfe2

SHA1
d1e019eaa61527c6b9c35de77e11b664d01d0464

SHA256
5ff14d55d81128ec0886bb1e50c102b1bb391b25694638c265fa5a08615050a5

SHA512
14ce02b5f8579f9648b1c5426885a9e55c54a51a7f260a4029211abae18b6b97c22c361396e3d42028e28b9dc0b6274465f421c8815fca7f5a2427d085cd8e81

Download Submit
C:\Windows\system\FKGoEvi.exe

Filesize
1.3MB

MD5
89fbb980d0e3088172094588909fe63e

SHA1
60a3d79d1d12d3da0da5316690d9add590f88633

SHA256
8c9d8c5b35225a417fcc2047323aee7b89b09cc4422f22df5063fb06b75699df

SHA512
9754e70b7512311641cf3146745d463a37baf599ef1066d3fad0bc44b157e54be5f3643f788a14163499f0725dcac6c089a444a7570d747a473e04a49fd8f6d5

Download Submit
C:\Windows\system\HkXNgSH.exe

Filesize
1.3MB

MD5
a0bc8975c2b6b1203f934d7ca6dd7b1d

SHA1
0d2d2f99a117506dd9fa3515083008a21e88dc14

SHA256
5d586ec49cb6d1ee1ee2b8c409189971d48a7a920dad927e28f191b089b6fcf7

SHA512
3ecdc87cf32a1e63ca1eca51eb8b3ee72fb43786026fc679cbfca021f6152ea221e3673f43c1cb19bdedc4452a8347f9afaa3151a0627193bcaca86708c579db

Download Submit
C:\Windows\system\KOVTpmn.exe

Filesize
1.3MB

MD5
df119aa1e36799fb8fc879e2417e943c

SHA1
67f2664a3c2906166be2cb31e04c270a995b3382

SHA256
410f53fc61df2a26f091d2c8f81e2c6be6c02d2b6969ca127366ca60939fcf7a

SHA512
e041eff6d72e15a2eea47930a6b3d794d530f8e54645fd179d0c5ddff2e37f4b9e3fc40388531ea55ff89480d6dc542065d417a560603118d8f07f2e1a0306e6

Download Submit
C:\Windows\system\LlPjKsV.exe

Filesize
1.3MB

MD5
897197d804111073654387ce7b9ff655

SHA1
6c5cddd750c706f1503211c346e1cb9f1aad2497

SHA256
71763db5f38293b504f21ab854f8be4d0a653cabe555a1209f4b2029c98d1d9b

SHA512
864d57107a1c56ec258dfa27eb1e4a8f73f2196711c2dc71387a83060b622802360047909eaa49ec22f350181e9da562d5e9182182ef068b0629cd1ad968ef37

Download Submit
C:\Windows\system\LlWhiyP.exe

Filesize
1.3MB

MD5
085e3161cb86da479ce302345cac15eb

SHA1
f0135a8c130263d09a783c202ea1929f37effa31

SHA256
9a364ee3379671c18755acc05785cd8818ff8ba5d4df06a6573dae1ff8ecfaf7

SHA512
59df94f7a8d5952f2f0a5db331449c664e0d4d13e549c1fa0763f26d84428181ddd19915b6ff6159a7da92ea56b85976bfea99f6bb8f50402e920d3c797aad2c

Download Submit
C:\Windows\system\OAbPRQb.exe

Filesize
1.3MB

MD5
d732ef9bb31c6ff903b75919744c05ea

SHA1
16b3473acf6749c0345a51606e3946343ef75cd8

SHA256
6f7b2ab2524074f1e008e0d8cbbcfe4757f0e070009cdc061c9929ae1c255970

SHA512
d8015543af5065998f77a9f0545732287d42bf8aacdd7407338b832c948de1e68a79d12efd3751465ffb3287892738e7cad922baee1901b8cdfa60e4fb5c87cd

Download Submit
C:\Windows\system\OrVWbZU.exe

Filesize
1.3MB

MD5
0a2b52b71a4bbd09a4074b376082dfbf

SHA1
b98fcf4e9597773bbb4bbc6d073423c52f34800a

SHA256
8b330163de05980e50354f32e2d5a1a5b7d5e0129c153430eb0cba05c9d83fcf

SHA512
664d8c9bc897dc516d84c009bb13dcafc7533fb4b29db6091978d5a77ab19d8ea35e7d42ea48c50514832d2175a21f3f92d251e9e76ce05d79529cfb53e1220c

Download Submit
C:\Windows\system\QfRtGRi.exe

Filesize
1.3MB

MD5
3728d96b48c219ba16d09047a08eb28e

SHA1
1c78d3f6ab5fee0b2a1bc86cf6648bd59afe7623

SHA256
ddce23c1984e5a699858aba6394726694bbfdb0abd403306e55bd484d80d754f

SHA512
6458fb88f247d964901710091eaedd2278980d8d048c443377ae47653c7a77a95edd8beaf6ca31463292bc44191d0cf32cf66aecb9f52f5b0d3c46c1fee2ef67

Download Submit
C:\Windows\system\SYGKzzn.exe

Filesize
1.3MB

MD5
850f09893cb2a0e2d33406b901139c86

SHA1
50c10a8dd1641ec04e06952467ba47dc4fccc235

SHA256
1fcb9994816b1d23a1cff66c77c5e4e04518ab05252cf5f1e21045278e142227

SHA512
39a6ea901cb3d944addd30ce1a6546571f903429053782126e5f969868794d8489a89e58c85bed7947e0ce99f21e9ef0a71af4a66ba569d2964213b900a84107

Download Submit
C:\Windows\system\SbxzYgC.exe

Filesize
1.3MB

MD5
b2187053b1270bc79304b7b14e54e78b

SHA1
3a52b01621ff7a65a05b6a8657f9bb8ff6c44c1c

SHA256
5215190e2f71b41d0f2939b2f8557de181b8e70aa64e238e574dc8e2dec91578

SHA512
17b5e4e8c6473a4e8bbaaf0f928110f764c8d2f0f70af1b2f573d6862266855ebed29e14d3631955a48e2f8f7cc2f8ba854045d415916018c721fa9ae3202404

Download Submit
C:\Windows\system\TeZDNAb.exe

Filesize
1.3MB

MD5
2b799f32d08bc3dce2294c94466d065d

SHA1
93f92f2e2942b934e84d8abc3adcd5cf4c2904aa

SHA256
a945d5dac35a8e3172f414a7112253768828bb11d03928ad9fcdbe6878462018

SHA512
89e6c950e948afb69d1497030d3923cb748d6345685d0815221cf6938561eeb50ebc054c2b5f95a1d4794d7df336daf7eca817947da8e36a35d363243eefac2f

Download Submit
C:\Windows\system\UiabNtM.exe

Filesize
1.3MB

MD5
50a9c56cbe2b55f81cb8e9ffe849b24a

SHA1
691431ff227aba5c996e35cd972ec2dad964831a

SHA256
526596326167d59f18f7a2b775b623e3ba699a2027e376f5de0ba4318bb465fc

SHA512
00215d6fea734406ec213cac8d3b264bdbc0064419badf30adc57e78e26241fd41f692cc54a5d5f2d6bcf924aca76e3f2dc417c1d1082962ad45525b82aa3cb1

Download Submit
C:\Windows\system\WeZafHN.exe

Filesize
1.3MB

MD5
d558fc4f7ef294d286d9f2462c3dc68f

SHA1
bd9470f620e76cdabb2af75fdc238cc29c515584

SHA256
39f3ef21573ff2888d6a6591913b60f1654b997dbc7f11c2eec82f11319b76b8

SHA512
aecbc5e80b3ac83cdaab9f8a39c3c1a6fdad2e5feaf2b772ad2e6684226047c0abdd8235a76e79fbb52156eb55b864a992d89c0fd9ae4935dbecf25fe2cc57af

Download Submit
C:\Windows\system\XBzrEVz.exe

Filesize
1.3MB

MD5
3f8a032fbb803d6fee583dba89473147

SHA1
3eb26f3bd308d3d81f12c3caf27d9ff11cba7f7e

SHA256
892763d667e8e3f9dbdbc82a3149f4c92d97762fe7978a7bca0ad5dbade95322

SHA512
3a13a88239b54a9ae3c901de498045cd8405870cf199fac10c21b3a8ba51940cd17b8ee0ebbc26fbcaee0e4e63240cf4f13a00016969414cbd652f43df814f98

Download Submit
C:\Windows\system\YyoIuzy.exe

Filesize
1.3MB

MD5
989aa1e26a0309842f3f7e6a82ae2578

SHA1
aa9b43908b691879e177f74bcbb508448e087def

SHA256
aa8ef66b785c4fb7e8c02b2dc09083854fb95b1990664a3417b9474c0b54a10e

SHA512
d3ae5b98f36ad8ad36d5611d39c5c4a9d44fa0820402b329ef5ee05eaf1d1bdcff1c2e70f7a0ccdf3dbb84a0e2ee8f4a3dae5c01c1e9d56a6d0f00bc05ea6830

Download Submit
C:\Windows\system\bqJVKuc.exe

Filesize
1.3MB

MD5
5a5fac559cfc3c7d55b9c3ca1a1d517a

SHA1
8a44402e8988a17f77f32b2c62c90cef68147afe

SHA256
9e171eaa345fc0486ba2629f3a31bf30dc946f79ac44f9712d67c291bd7df6b6

SHA512
ceb34add265c889eae163b5ce84221a6988fec7bde54389fa7d6467dcf903e68169b199564d29a7026716f9d8e6e8c9cc48834af58a4cdd19e46782067d139ba

Download Submit
C:\Windows\system\eNdmnNU.exe

Filesize
1.3MB

MD5
6a2c921840ab3c39f7bbfc9c068bcc68

SHA1
064e97c9c9e8698ff54ae3cc0f85de44716dc82c

SHA256
391ab285f373a28e772cac679920512b14c0b3e9b22feceafee7666773749220

SHA512
f27ef7ea8d2e75b2cd8488d165e13f30909c07167f2c8326277fdb933b0f5ed039416f0fcc3b5ed56b63ad338d8cd822e63eede60fe74c284e1a0e6aa28aaa6d

Download Submit
C:\Windows\system\fiFkWKX.exe

Filesize
1.3MB

MD5
0b7e2c84735ececda2867865813f88ae

SHA1
e294241cd7b1a5f5eb2f345f7409619c6feb0b6a

SHA256
f496de52751bc0e62a766b1eee664f406da74f90b90f525d88a30bc559f85b6b

SHA512
b7d699d47a74e141ea9a4cf1e219b430ac50aa511999b9c33a95b3954590262792c183c7567076c4b1eda5a1b4832e71d0dd80e15de9a578eaadc9dd23ca6416

Download Submit
C:\Windows\system\gbylUkx.exe

Filesize
1.3MB

MD5
ca7eaafa6f23d4428fc654ce7c9c3fb6

SHA1
745121e40caa041c39508209702296ae1b93cd33

SHA256
2266061e2f64c5c3a026c70e11449133600b4971fe97d8c2c79cd333e5859bd0

SHA512
16bb3a333132c307e530cad38674895d27220c01ddf21603bcddc0193281aa5c9843740d8f16e733b65f9363b952f26a421f9942c22b03544cdd916c3c048f19

Download Submit
C:\Windows\system\hCGhnOA.exe

Filesize
1.3MB

MD5
94160c16620bf4feb7ec9f8cc7579ac8

SHA1
c12f0470d4dac41143968d55dfc07136a5c84dab

SHA256
c6ddbc34eaaf7a38fa7081faadc580df521ba25fd6915e143e2e6cdb87a33d92

SHA512
5373e298ee14b2d1c2fe65866244f2b3104dffa0c2451c16149ce5e57dd61cf7edd7a7a79047844a815115a710ee1fd374dd1b156cfe1dc39af833c1545bb01f

Download Submit
C:\Windows\system\idGropx.exe

Filesize
1.3MB

MD5
41941321b13721be412a7f07a225bb0e

SHA1
4cf0abad8098bc790d682c52cb19afb241863519

SHA256
7b0bf38a5d86dcb7e4511c3227abec9d2d4f469639d4d5e8b9a9d88262d764da

SHA512
13cd82c0968cf9625efde2a1d89f09b37107aae3b512439a9d400188c92d12e769ae14c2da4795beeff4d6a48e9b44a4c7ce5f84735b396df0158f3285617c65

Download Submit
C:\Windows\system\kpGRHPs.exe

Filesize
1.3MB

MD5
e9aba805ece2368b4d258dce11ac472c

SHA1
1646ec3332a2ea656f3915ef66f89a0700425aeb

SHA256
1d49933f784802fa2866869028ce0fba9a020c906bf8a4082c639cb5dae84f7c

SHA512
e79b861e6883070e3fe75806a5f13c9d01175e7b416fe177b40eabedefd6c76a02619fe65355cfc08a5b9c0edecac44c691213110d1880ca3a9115e5fae39f84

Download Submit
C:\Windows\system\lfVdYUX.exe

Filesize
1.3MB

MD5
d9c105bfed20b05cc2f4243501ee809f

SHA1
044d9dca921a409deabdf3911a07fb4a4a1f1597

SHA256
7b05c7bfa768e0f5f36cd950a99113ddfe781f7527c87e825c94dbec6c2b7349

SHA512
ce0a31e235337b81d3d7a01917312d0b180cb7b1c771ed47fac2020f0686ff5c57cab9dba5bd673e16d914555e703b28663f836427befa9588f51c5585d28c59

Download Submit
C:\Windows\system\rDwEmyS.exe

Filesize
1.3MB

MD5
db57ce307b81a65c021674b418dc46d6

SHA1
8aa38625a84428e41569dfde9203c7d1d1d9be8e

SHA256
80591ba689c832302bb1362b859668a934420fa80febc7295670c2f401327bc7

SHA512
1c13b5061ba733d9fda74e720b8484d7f93b4377bc057ed55f48fa18aefc58f87dc740a82ea62191113b8920441d1c2ec214da959b97e161af014bf1b72fa87f

Download Submit
C:\Windows\system\sbAtbSI.exe

Filesize
1.3MB

MD5
dc2275f10da2b33d4e4e4d18fd142c57

SHA1
cde0cde30d78582692eac7a2a5027245b3e6ca21

SHA256
8d8a0c3206ea54b5eeb3fa3f77d4257218f1d6907b9a8ffa3aa4071c2a1d5d22

SHA512
c02fdc959a6666d477b4dcd92efcc397832d2618b1c8c6f6a177e3de2a1435f3c8e87b6b2df072da8db58b076ce66ee019ab222f16964d06ad64d853af371f89

Download Submit
C:\Windows\system\wKdpsCx.exe

Filesize
1.3MB

MD5
1cdbf570de72e2e48e7ceed8aafb6c91

SHA1
c3e33e5c2adc955f7d18f51ef1b1eadf68bb140f

SHA256
25fa353c4eaa59b549bc7a637a4f96b49a12ce4cc73f9b068122645db1d5b679

SHA512
269d777557eda1511263be9688f66e5e38a12a66b152606ce108c91e0a2ccc2143c4fd2aef4986af2f17d838537e8ddabe0d9096502e97469e677690856e5512

Download Submit
C:\Windows\system\wMnDxDX.exe

Filesize
1.3MB

MD5
60be8bfb2b2f18ce1132909ea78cc43b

SHA1
810f46038505b832b01fddfea2073f2ebcf9a52f

SHA256
f85b057a1cec166e17a72189572cb154ee92a0ea48f3605a4bfd477de1ce1395

SHA512
d80e744559fd1a17c084b1cf4357514d6421188ec20591c9c05cd790408500a8b6d9ffc91991e2bbb8c72737b762116bc7971bde7c992a7abf902eaa5a85989b

Download Submit
C:\Windows\system\yzERlHa.exe

Filesize
1.3MB

MD5
fac6d9ab566fab1c5a85b9c5d7bd6dbb

SHA1
f85974ea85fde486529d492c8b15c15da4547628

SHA256
b4be828852baa098cc91a59b5c592cfb2f41c94ff508e63b9553601c4f8fba90

SHA512
340403fd18ff925c1372004ad5e4289d62ffb0a98bf54c046f1fcbf500a72781611e53d5e4749db35d37c46556f9d1820b859a3259ef69ca042b6c8e28bd3370

Download Submit
\Windows\system\lzluezg.exe

Filesize
1.3MB

MD5
5e563b13a11b9fa1ba29efb6365ea584

SHA1
cac0d31938a1931ccd4d8e621d48a35a3f604e1f

SHA256
a2e8eabed1da41c103083b81c559b22db5b66b670d061f749bea51ffcfd35152

SHA512
98405af7485b88e3a7bf488aca8773ed6455602b90639109bc419d3edfbfb8b37e8213c14a1e19b86ca66bc3890c7b5706d4c4245c86dedc3c7ca6e398650be8

Download Submit
memory/2820-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download