xmrig | ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
Size

1.4MB
MD5

ecb09942df46b743d66b98ab112ed321
SHA1

1202734fd31ba8b0339c6a505216e5296c873b4b
SHA256

ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072
SHA512

e78a388ff8637a9838a4958f229d3d5ed1d0034a7ce520521a12d9ba06ec7d685da1ffd78f3a9d6dcae24f6d06302923f5ca44eb0cc8b337266e0084d29e3e52
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcK:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5w

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012116-2.dat	xmrig
behavioral1/files/0x0008000000016d06-9.dat	xmrig
behavioral1/files/0x0008000000016d0e-13.dat	xmrig
behavioral1/files/0x0007000000016d31-21.dat	xmrig
behavioral1/files/0x0007000000016d3a-22.dat	xmrig
behavioral1/files/0x0008000000016d5e-37.dat	xmrig
behavioral1/files/0x00060000000186ea-40.dat	xmrig
behavioral1/files/0x00050000000186ee-44.dat	xmrig
behavioral1/files/0x0005000000018784-60.dat	xmrig
behavioral1/files/0x00050000000187a5-68.dat	xmrig
behavioral1/files/0x00050000000193b4-96.dat	xmrig
behavioral1/files/0x00050000000193e1-105.dat	xmrig
behavioral1/files/0x0005000000019461-128.dat	xmrig
behavioral1/files/0x000500000001944f-124.dat	xmrig
behavioral1/files/0x0005000000019441-120.dat	xmrig
behavioral1/files/0x0005000000019431-116.dat	xmrig
behavioral1/files/0x0005000000019427-112.dat	xmrig
behavioral1/files/0x000500000001941e-108.dat	xmrig
behavioral1/files/0x00050000000193c2-100.dat	xmrig
behavioral1/files/0x0005000000019350-92.dat	xmrig
behavioral1/files/0x0005000000019334-88.dat	xmrig
behavioral1/files/0x0005000000019282-84.dat	xmrig
behavioral1/files/0x0005000000019261-80.dat	xmrig
behavioral1/files/0x000500000001925e-76.dat	xmrig
behavioral1/files/0x0006000000019023-72.dat	xmrig
behavioral1/files/0x000500000001878f-64.dat	xmrig
behavioral1/files/0x000500000001873d-56.dat	xmrig
behavioral1/files/0x0005000000018728-52.dat	xmrig
behavioral1/files/0x00050000000186fd-48.dat	xmrig
behavioral1/files/0x0009000000016d4a-33.dat	xmrig
behavioral1/files/0x0007000000016d42-29.dat	xmrig
behavioral1/files/0x0008000000016d21-17.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2568	IbfqnXu.exe
1680	WUmsVvY.exe
1460	RrRicMV.exe
2560	pRoPUor.exe
316	eLTmzKO.exe
2512	EBVtVhO.exe
2744	aApWrIF.exe
2828	PPakvAe.exe
2864	oTsstPI.exe
2792	wNylTPu.exe
2492	iOYXGNA.exe
2920	AaFycle.exe
2900	BwvIxKw.exe
2676	sGrnrzW.exe
2804	jltyxOy.exe
2636	xkaHYRJ.exe
2668	ttoKrAV.exe
2388	tRBielx.exe
1932	Bfkyazx.exe
1936	LOTmDrA.exe
3004	Frkagzx.exe
988	ngKDOSU.exe
2204	RzVvDYN.exe
2984	vByoLGD.exe
2964	TySxzPr.exe
2384	tthsOHN.exe
2456	kubtzVR.exe
1452	qnorZYg.exe
2116	RmFVino.exe
2112	JMDbVVR.exe
748	vFAKZNv.exe
2584	bNapoZD.exe
1188	TrOaFhj.exe
1016	itGAvCE.exe
2088	yascPku.exe
2944	ZHBVzlj.exe
1516	fyFcobu.exe
1124	KozAbdo.exe
848	iOlalJD.exe
408	OAHvJUd.exe
2172	NqxiEzA.exe
2616	ZUxJeSK.exe
1968	fueWxBq.exe
2344	liCArcP.exe
1296	EkncdQU.exe
1856	YYXuxSa.exe
1108	vKHJyzl.exe
2052	xfzEkKm.exe
1228	mWxeJMw.exe
1708	BfCZQlC.exe
1588	kQlHOZw.exe
1572	aWDKvug.exe
1548	pTcQifp.exe
912	kTSurzg.exe
2480	osIlxwq.exe
2212	CWJRSMf.exe
2056	NhJERVc.exe
2272	QBbjJDd.exe
280	bXxHVTq.exe
780	MQGuiYR.exe
568	wfzPPZt.exe
2184	IpiZLHr.exe
2600	mOcCJOH.exe
2440	aThqYUF.exe

Loads dropped DLL 64 IoCs

pid	Process
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QHyPhyi.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\TlRBDIa.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\joKincH.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\QqkmxUj.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\GkpWDrT.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\kRVKccx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\YlomWwY.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\GAhvvcx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\TyXhkPI.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\UBPYdYm.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\RjQbEhc.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\fNGKOwR.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\wGFPjtL.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\vwffrrZ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\OaQoQOk.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ZeqIAQe.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\kubtzVR.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\aDkPfPq.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\epfJPNE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NTYAoCq.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\DzBiAef.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\QOqqXxl.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\dENdcjE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\OXBwAUr.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\PEWyINI.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\BVspBgJ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\VRKTBzW.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NJeuPmP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pRnKatA.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\RzVvDYN.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ibxMyQB.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\HEQRkGP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\kHVsDeb.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ZgRcFxf.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\obqPBeS.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\CGCAtTJ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\fIMNzHQ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\TZhxauE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\yATxEmF.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\nRUGHmS.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\JSgBltX.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pPLprqx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\XtIPlWK.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\EVzTARW.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\sLZLIMx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\tqLLjBC.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\MopYvtM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\RONJOCj.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\jUYwHGA.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\LvytNLv.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\sMhPlMc.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NmQWEYu.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\sshdryi.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\SMzdHeA.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pDlOSTE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\hjsXibM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\aZQdpVL.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\WikBXjt.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\XTVXwpQ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\XuamZse.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\YMJpsMa.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\rOAYyUM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\VjCKYTa.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\RXzzBeo.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2568	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	31
PID 1904 wrote to memory of 2568	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	31
PID 1904 wrote to memory of 2568	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	31
PID 1904 wrote to memory of 1680	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	32
PID 1904 wrote to memory of 1680	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	32
PID 1904 wrote to memory of 1680	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	32
PID 1904 wrote to memory of 1460	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	33
PID 1904 wrote to memory of 1460	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	33
PID 1904 wrote to memory of 1460	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	33
PID 1904 wrote to memory of 2560	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	34
PID 1904 wrote to memory of 2560	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	34
PID 1904 wrote to memory of 2560	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	34
PID 1904 wrote to memory of 316	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	35
PID 1904 wrote to memory of 316	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	35
PID 1904 wrote to memory of 316	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	35
PID 1904 wrote to memory of 2512	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	36
PID 1904 wrote to memory of 2512	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	36
PID 1904 wrote to memory of 2512	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	36
PID 1904 wrote to memory of 2744	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	37
PID 1904 wrote to memory of 2744	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	37
PID 1904 wrote to memory of 2744	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	37
PID 1904 wrote to memory of 2828	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	38
PID 1904 wrote to memory of 2828	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	38
PID 1904 wrote to memory of 2828	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	38
PID 1904 wrote to memory of 2864	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	39
PID 1904 wrote to memory of 2864	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	39
PID 1904 wrote to memory of 2864	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	39
PID 1904 wrote to memory of 2792	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	40
PID 1904 wrote to memory of 2792	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	40
PID 1904 wrote to memory of 2792	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	40
PID 1904 wrote to memory of 2492	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	41
PID 1904 wrote to memory of 2492	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	41
PID 1904 wrote to memory of 2492	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	41
PID 1904 wrote to memory of 2920	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	42
PID 1904 wrote to memory of 2920	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	42
PID 1904 wrote to memory of 2920	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	42
PID 1904 wrote to memory of 2900	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	43
PID 1904 wrote to memory of 2900	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	43
PID 1904 wrote to memory of 2900	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	43
PID 1904 wrote to memory of 2676	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	44
PID 1904 wrote to memory of 2676	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	44
PID 1904 wrote to memory of 2676	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	44
PID 1904 wrote to memory of 2804	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	45
PID 1904 wrote to memory of 2804	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	45
PID 1904 wrote to memory of 2804	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	45
PID 1904 wrote to memory of 2636	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	46
PID 1904 wrote to memory of 2636	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	46
PID 1904 wrote to memory of 2636	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	46
PID 1904 wrote to memory of 2668	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	47
PID 1904 wrote to memory of 2668	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	47
PID 1904 wrote to memory of 2668	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	47
PID 1904 wrote to memory of 2388	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	48
PID 1904 wrote to memory of 2388	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	48
PID 1904 wrote to memory of 2388	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	48
PID 1904 wrote to memory of 1932	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	49
PID 1904 wrote to memory of 1932	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	49
PID 1904 wrote to memory of 1932	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	49
PID 1904 wrote to memory of 1936	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	50
PID 1904 wrote to memory of 1936	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	50
PID 1904 wrote to memory of 1936	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	50
PID 1904 wrote to memory of 3004	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	51
PID 1904 wrote to memory of 3004	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	51
PID 1904 wrote to memory of 3004	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	51
PID 1904 wrote to memory of 988	1904	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	52

C:\Users\Admin\AppData\Local\Temp\ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
"C:\Users\Admin\AppData\Local\Temp\ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System\IbfqnXu.exe
  C:\Windows\System\IbfqnXu.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\WUmsVvY.exe
  C:\Windows\System\WUmsVvY.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\RrRicMV.exe
  C:\Windows\System\RrRicMV.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\pRoPUor.exe
  C:\Windows\System\pRoPUor.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\eLTmzKO.exe
  C:\Windows\System\eLTmzKO.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\EBVtVhO.exe
  C:\Windows\System\EBVtVhO.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\aApWrIF.exe
  C:\Windows\System\aApWrIF.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\PPakvAe.exe
  C:\Windows\System\PPakvAe.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oTsstPI.exe
  C:\Windows\System\oTsstPI.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\wNylTPu.exe
  C:\Windows\System\wNylTPu.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\iOYXGNA.exe
  C:\Windows\System\iOYXGNA.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\AaFycle.exe
  C:\Windows\System\AaFycle.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BwvIxKw.exe
  C:\Windows\System\BwvIxKw.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\sGrnrzW.exe
  C:\Windows\System\sGrnrzW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\jltyxOy.exe
  C:\Windows\System\jltyxOy.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xkaHYRJ.exe
  C:\Windows\System\xkaHYRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\ttoKrAV.exe
  C:\Windows\System\ttoKrAV.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\tRBielx.exe
  C:\Windows\System\tRBielx.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\Bfkyazx.exe
  C:\Windows\System\Bfkyazx.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\LOTmDrA.exe
  C:\Windows\System\LOTmDrA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\Frkagzx.exe
  C:\Windows\System\Frkagzx.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ngKDOSU.exe
  C:\Windows\System\ngKDOSU.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\RzVvDYN.exe
  C:\Windows\System\RzVvDYN.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\vByoLGD.exe
  C:\Windows\System\vByoLGD.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\TySxzPr.exe
  C:\Windows\System\TySxzPr.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\tthsOHN.exe
  C:\Windows\System\tthsOHN.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\kubtzVR.exe
  C:\Windows\System\kubtzVR.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\qnorZYg.exe
  C:\Windows\System\qnorZYg.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\RmFVino.exe
  C:\Windows\System\RmFVino.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\JMDbVVR.exe
  C:\Windows\System\JMDbVVR.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\vFAKZNv.exe
  C:\Windows\System\vFAKZNv.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\bNapoZD.exe
  C:\Windows\System\bNapoZD.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\TrOaFhj.exe
  C:\Windows\System\TrOaFhj.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\itGAvCE.exe
  C:\Windows\System\itGAvCE.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\yascPku.exe
  C:\Windows\System\yascPku.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ZHBVzlj.exe
  C:\Windows\System\ZHBVzlj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\fyFcobu.exe
  C:\Windows\System\fyFcobu.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\KozAbdo.exe
  C:\Windows\System\KozAbdo.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\iOlalJD.exe
  C:\Windows\System\iOlalJD.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\OAHvJUd.exe
  C:\Windows\System\OAHvJUd.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\NqxiEzA.exe
  C:\Windows\System\NqxiEzA.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ZUxJeSK.exe
  C:\Windows\System\ZUxJeSK.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\fueWxBq.exe
  C:\Windows\System\fueWxBq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\liCArcP.exe
  C:\Windows\System\liCArcP.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\EkncdQU.exe
  C:\Windows\System\EkncdQU.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\YYXuxSa.exe
  C:\Windows\System\YYXuxSa.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\vKHJyzl.exe
  C:\Windows\System\vKHJyzl.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\xfzEkKm.exe
  C:\Windows\System\xfzEkKm.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mWxeJMw.exe
  C:\Windows\System\mWxeJMw.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\BfCZQlC.exe
  C:\Windows\System\BfCZQlC.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\kQlHOZw.exe
  C:\Windows\System\kQlHOZw.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\aWDKvug.exe
  C:\Windows\System\aWDKvug.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\pTcQifp.exe
  C:\Windows\System\pTcQifp.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\kTSurzg.exe
  C:\Windows\System\kTSurzg.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\osIlxwq.exe
  C:\Windows\System\osIlxwq.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\CWJRSMf.exe
  C:\Windows\System\CWJRSMf.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\NhJERVc.exe
  C:\Windows\System\NhJERVc.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\QBbjJDd.exe
  C:\Windows\System\QBbjJDd.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\bXxHVTq.exe
  C:\Windows\System\bXxHVTq.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\MQGuiYR.exe
  C:\Windows\System\MQGuiYR.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\wfzPPZt.exe
  C:\Windows\System\wfzPPZt.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\IpiZLHr.exe
  C:\Windows\System\IpiZLHr.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\mOcCJOH.exe
  C:\Windows\System\mOcCJOH.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\aThqYUF.exe
  C:\Windows\System\aThqYUF.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ImXboSR.exe
  C:\Windows\System\ImXboSR.exe
  2⤵
  PID:2436
- C:\Windows\System\iIuabQb.exe
  C:\Windows\System\iIuabQb.exe
  2⤵
  PID:1804
- C:\Windows\System\APngYYS.exe
  C:\Windows\System\APngYYS.exe
  2⤵
  PID:1436
- C:\Windows\System\zAIdrIt.exe
  C:\Windows\System\zAIdrIt.exe
  2⤵
  PID:1660
- C:\Windows\System\IlfmcCU.exe
  C:\Windows\System\IlfmcCU.exe
  2⤵
  PID:2076
- C:\Windows\System\usWxpcj.exe
  C:\Windows\System\usWxpcj.exe
  2⤵
  PID:1952
- C:\Windows\System\ERTdXMx.exe
  C:\Windows\System\ERTdXMx.exe
  2⤵
  PID:1544
- C:\Windows\System\AmmtEtl.exe
  C:\Windows\System\AmmtEtl.exe
  2⤵
  PID:1536
- C:\Windows\System\FzaDxXG.exe
  C:\Windows\System\FzaDxXG.exe
  2⤵
  PID:1652
- C:\Windows\System\DOZUOpb.exe
  C:\Windows\System\DOZUOpb.exe
  2⤵
  PID:1148
- C:\Windows\System\LfUadjS.exe
  C:\Windows\System\LfUadjS.exe
  2⤵
  PID:2728
- C:\Windows\System\jKYjZjP.exe
  C:\Windows\System\jKYjZjP.exe
  2⤵
  PID:2780
- C:\Windows\System\rTsVfUT.exe
  C:\Windows\System\rTsVfUT.exe
  2⤵
  PID:2832
- C:\Windows\System\fkesZBr.exe
  C:\Windows\System\fkesZBr.exe
  2⤵
  PID:2752
- C:\Windows\System\soFIVJP.exe
  C:\Windows\System\soFIVJP.exe
  2⤵
  PID:2660
- C:\Windows\System\GmOzLPv.exe
  C:\Windows\System\GmOzLPv.exe
  2⤵
  PID:1624
- C:\Windows\System\QjTRWHS.exe
  C:\Windows\System\QjTRWHS.exe
  2⤵
  PID:2708
- C:\Windows\System\LIKkEWI.exe
  C:\Windows\System\LIKkEWI.exe
  2⤵
  PID:2200
- C:\Windows\System\MopYvtM.exe
  C:\Windows\System\MopYvtM.exe
  2⤵
  PID:2688
- C:\Windows\System\iaEYJli.exe
  C:\Windows\System\iaEYJli.exe
  2⤵
  PID:2100
- C:\Windows\System\fDdsInG.exe
  C:\Windows\System\fDdsInG.exe
  2⤵
  PID:2896
- C:\Windows\System\oPyVDAu.exe
  C:\Windows\System\oPyVDAu.exe
  2⤵
  PID:2020
- C:\Windows\System\rknZNwE.exe
  C:\Windows\System\rknZNwE.exe
  2⤵
  PID:2408
- C:\Windows\System\ZGozwYv.exe
  C:\Windows\System\ZGozwYv.exe
  2⤵
  PID:584
- C:\Windows\System\MphDyUY.exe
  C:\Windows\System\MphDyUY.exe
  2⤵
  PID:468
- C:\Windows\System\zWZvFub.exe
  C:\Windows\System\zWZvFub.exe
  2⤵
  PID:1764
- C:\Windows\System\QMhwPkU.exe
  C:\Windows\System\QMhwPkU.exe
  2⤵
  PID:2420
- C:\Windows\System\VTfPMHX.exe
  C:\Windows\System\VTfPMHX.exe
  2⤵
  PID:2068
- C:\Windows\System\dkcBFxz.exe
  C:\Windows\System\dkcBFxz.exe
  2⤵
  PID:2176
- C:\Windows\System\LrmbNjh.exe
  C:\Windows\System\LrmbNjh.exe
  2⤵
  PID:1788
- C:\Windows\System\LyLXnjl.exe
  C:\Windows\System\LyLXnjl.exe
  2⤵
  PID:1096
- C:\Windows\System\YyAvaWZ.exe
  C:\Windows\System\YyAvaWZ.exe
  2⤵
  PID:1964
- C:\Windows\System\zOCeTVc.exe
  C:\Windows\System\zOCeTVc.exe
  2⤵
  PID:1608
- C:\Windows\System\PKvGbVd.exe
  C:\Windows\System\PKvGbVd.exe
  2⤵
  PID:340
- C:\Windows\System\bSvRoqZ.exe
  C:\Windows\System\bSvRoqZ.exe
  2⤵
  PID:900
- C:\Windows\System\fqeJXmb.exe
  C:\Windows\System\fqeJXmb.exe
  2⤵
  PID:956
- C:\Windows\System\gOENlUV.exe
  C:\Windows\System\gOENlUV.exe
  2⤵
  PID:1704
- C:\Windows\System\UPsHDQS.exe
  C:\Windows\System\UPsHDQS.exe
  2⤵
  PID:2308
- C:\Windows\System\agWdUIr.exe
  C:\Windows\System\agWdUIr.exe
  2⤵
  PID:356
- C:\Windows\System\scVfYTu.exe
  C:\Windows\System\scVfYTu.exe
  2⤵
  PID:764
- C:\Windows\System\ozmFDqK.exe
  C:\Windows\System\ozmFDqK.exe
  2⤵
  PID:844
- C:\Windows\System\nTeyZID.exe
  C:\Windows\System\nTeyZID.exe
  2⤵
  PID:1816
- C:\Windows\System\QGtzLzA.exe
  C:\Windows\System\QGtzLzA.exe
  2⤵
  PID:2220
- C:\Windows\System\KknVPNj.exe
  C:\Windows\System\KknVPNj.exe
  2⤵
  PID:1512
- C:\Windows\System\zcJvBEF.exe
  C:\Windows\System\zcJvBEF.exe
  2⤵
  PID:2012
- C:\Windows\System\YUknJrz.exe
  C:\Windows\System\YUknJrz.exe
  2⤵
  PID:2720
- C:\Windows\System\JVIbvTz.exe
  C:\Windows\System\JVIbvTz.exe
  2⤵
  PID:2740
- C:\Windows\System\txvteIh.exe
  C:\Windows\System\txvteIh.exe
  2⤵
  PID:2392
- C:\Windows\System\hHMsVrX.exe
  C:\Windows\System\hHMsVrX.exe
  2⤵
  PID:2800
- C:\Windows\System\EzdaNQT.exe
  C:\Windows\System\EzdaNQT.exe
  2⤵
  PID:2648
- C:\Windows\System\kqUxCBl.exe
  C:\Windows\System\kqUxCBl.exe
  2⤵
  PID:1928
- C:\Windows\System\WxBGXxP.exe
  C:\Windows\System\WxBGXxP.exe
  2⤵
  PID:1404
- C:\Windows\System\emHnmGr.exe
  C:\Windows\System\emHnmGr.exe
  2⤵
  PID:2024
- C:\Windows\System\BKCDtGU.exe
  C:\Windows\System\BKCDtGU.exe
  2⤵
  PID:1564
- C:\Windows\System\YiusWbE.exe
  C:\Windows\System\YiusWbE.exe
  2⤵
  PID:536
- C:\Windows\System\ZFtsxLh.exe
  C:\Windows\System\ZFtsxLh.exe
  2⤵
  PID:772
- C:\Windows\System\AWWDCEY.exe
  C:\Windows\System\AWWDCEY.exe
  2⤵
  PID:1576
- C:\Windows\System\ZUATYCP.exe
  C:\Windows\System\ZUATYCP.exe
  2⤵
  PID:1084
- C:\Windows\System\yUjLNSW.exe
  C:\Windows\System\yUjLNSW.exe
  2⤵
  PID:1476
- C:\Windows\System\hKASYiI.exe
  C:\Windows\System\hKASYiI.exe
  2⤵
  PID:1376
- C:\Windows\System\JKjuEFK.exe
  C:\Windows\System\JKjuEFK.exe
  2⤵
  PID:1248
- C:\Windows\System\cBktOsz.exe
  C:\Windows\System\cBktOsz.exe
  2⤵
  PID:2368
- C:\Windows\System\mwwmwZA.exe
  C:\Windows\System\mwwmwZA.exe
  2⤵
  PID:1820
- C:\Windows\System\eSClaVj.exe
  C:\Windows\System\eSClaVj.exe
  2⤵
  PID:3080
- C:\Windows\System\ERvRbzP.exe
  C:\Windows\System\ERvRbzP.exe
  2⤵
  PID:3096
- C:\Windows\System\ZqNseSr.exe
  C:\Windows\System\ZqNseSr.exe
  2⤵
  PID:3112
- C:\Windows\System\KcowUDb.exe
  C:\Windows\System\KcowUDb.exe
  2⤵
  PID:3128
- C:\Windows\System\ZmiHIDG.exe
  C:\Windows\System\ZmiHIDG.exe
  2⤵
  PID:3144
- C:\Windows\System\QchZYff.exe
  C:\Windows\System\QchZYff.exe
  2⤵
  PID:3160
- C:\Windows\System\AkIxfQK.exe
  C:\Windows\System\AkIxfQK.exe
  2⤵
  PID:3176
- C:\Windows\System\yBHNUuR.exe
  C:\Windows\System\yBHNUuR.exe
  2⤵
  PID:3192
- C:\Windows\System\zqmpReV.exe
  C:\Windows\System\zqmpReV.exe
  2⤵
  PID:3208
- C:\Windows\System\Oeqajwj.exe
  C:\Windows\System\Oeqajwj.exe
  2⤵
  PID:3224
- C:\Windows\System\UUiCQLM.exe
  C:\Windows\System\UUiCQLM.exe
  2⤵
  PID:3240
- C:\Windows\System\LffwUhd.exe
  C:\Windows\System\LffwUhd.exe
  2⤵
  PID:3256
- C:\Windows\System\mCMgEfu.exe
  C:\Windows\System\mCMgEfu.exe
  2⤵
  PID:3272
- C:\Windows\System\cbkQWOe.exe
  C:\Windows\System\cbkQWOe.exe
  2⤵
  PID:3288
- C:\Windows\System\VvuVUkw.exe
  C:\Windows\System\VvuVUkw.exe
  2⤵
  PID:3304
- C:\Windows\System\BuqYHFn.exe
  C:\Windows\System\BuqYHFn.exe
  2⤵
  PID:3320
- C:\Windows\System\VyqaWoz.exe
  C:\Windows\System\VyqaWoz.exe
  2⤵
  PID:3336
- C:\Windows\System\nAKlanC.exe
  C:\Windows\System\nAKlanC.exe
  2⤵
  PID:3352
- C:\Windows\System\LhisTbI.exe
  C:\Windows\System\LhisTbI.exe
  2⤵
  PID:3368
- C:\Windows\System\mTiJxWA.exe
  C:\Windows\System\mTiJxWA.exe
  2⤵
  PID:3384
- C:\Windows\System\VhbqCRr.exe
  C:\Windows\System\VhbqCRr.exe
  2⤵
  PID:3400
- C:\Windows\System\LVIMoCc.exe
  C:\Windows\System\LVIMoCc.exe
  2⤵
  PID:3416
- C:\Windows\System\tlDbyHk.exe
  C:\Windows\System\tlDbyHk.exe
  2⤵
  PID:3432
- C:\Windows\System\RsDQlWq.exe
  C:\Windows\System\RsDQlWq.exe
  2⤵
  PID:3448
- C:\Windows\System\mWdViZn.exe
  C:\Windows\System\mWdViZn.exe
  2⤵
  PID:3464
- C:\Windows\System\dIFCqRP.exe
  C:\Windows\System\dIFCqRP.exe
  2⤵
  PID:3480
- C:\Windows\System\WoGsJlW.exe
  C:\Windows\System\WoGsJlW.exe
  2⤵
  PID:3496
- C:\Windows\System\esTKvjY.exe
  C:\Windows\System\esTKvjY.exe
  2⤵
  PID:3512
- C:\Windows\System\MLLgmQS.exe
  C:\Windows\System\MLLgmQS.exe
  2⤵
  PID:3528
- C:\Windows\System\nIRWESL.exe
  C:\Windows\System\nIRWESL.exe
  2⤵
  PID:3544
- C:\Windows\System\ydWHqDx.exe
  C:\Windows\System\ydWHqDx.exe
  2⤵
  PID:3560
- C:\Windows\System\nccBSSL.exe
  C:\Windows\System\nccBSSL.exe
  2⤵
  PID:3576
- C:\Windows\System\owQMAyE.exe
  C:\Windows\System\owQMAyE.exe
  2⤵
  PID:3592
- C:\Windows\System\nZCmXPI.exe
  C:\Windows\System\nZCmXPI.exe
  2⤵
  PID:3608
- C:\Windows\System\LwLTYFn.exe
  C:\Windows\System\LwLTYFn.exe
  2⤵
  PID:3624
- C:\Windows\System\SwlNCvV.exe
  C:\Windows\System\SwlNCvV.exe
  2⤵
  PID:3640
- C:\Windows\System\ugguZJe.exe
  C:\Windows\System\ugguZJe.exe
  2⤵
  PID:3656
- C:\Windows\System\bgqFSok.exe
  C:\Windows\System\bgqFSok.exe
  2⤵
  PID:3672
- C:\Windows\System\mmeNSJH.exe
  C:\Windows\System\mmeNSJH.exe
  2⤵
  PID:3688
- C:\Windows\System\bvBJJxK.exe
  C:\Windows\System\bvBJJxK.exe
  2⤵
  PID:3704
- C:\Windows\System\UBOOMyx.exe
  C:\Windows\System\UBOOMyx.exe
  2⤵
  PID:3720
- C:\Windows\System\zjFpEue.exe
  C:\Windows\System\zjFpEue.exe
  2⤵
  PID:3736
- C:\Windows\System\vwTpLWh.exe
  C:\Windows\System\vwTpLWh.exe
  2⤵
  PID:3752
- C:\Windows\System\eskKOFc.exe
  C:\Windows\System\eskKOFc.exe
  2⤵
  PID:3768
- C:\Windows\System\vdSLtYB.exe
  C:\Windows\System\vdSLtYB.exe
  2⤵
  PID:3784
- C:\Windows\System\NFPSefv.exe
  C:\Windows\System\NFPSefv.exe
  2⤵
  PID:3800
- C:\Windows\System\hZHpUNQ.exe
  C:\Windows\System\hZHpUNQ.exe
  2⤵
  PID:3816
- C:\Windows\System\ibxMyQB.exe
  C:\Windows\System\ibxMyQB.exe
  2⤵
  PID:3832
- C:\Windows\System\HbaJJVp.exe
  C:\Windows\System\HbaJJVp.exe
  2⤵
  PID:3848
- C:\Windows\System\URwGvMk.exe
  C:\Windows\System\URwGvMk.exe
  2⤵
  PID:3864
- C:\Windows\System\llLZyfS.exe
  C:\Windows\System\llLZyfS.exe
  2⤵
  PID:3880
- C:\Windows\System\OdONuET.exe
  C:\Windows\System\OdONuET.exe
  2⤵
  PID:3896
- C:\Windows\System\FcYmIdi.exe
  C:\Windows\System\FcYmIdi.exe
  2⤵
  PID:3912
- C:\Windows\System\tLiUZJa.exe
  C:\Windows\System\tLiUZJa.exe
  2⤵
  PID:3928
- C:\Windows\System\eAYECuO.exe
  C:\Windows\System\eAYECuO.exe
  2⤵
  PID:3944
- C:\Windows\System\NUkrVgq.exe
  C:\Windows\System\NUkrVgq.exe
  2⤵
  PID:3960
- C:\Windows\System\HVTVlig.exe
  C:\Windows\System\HVTVlig.exe
  2⤵
  PID:3976
- C:\Windows\System\vDdShgH.exe
  C:\Windows\System\vDdShgH.exe
  2⤵
  PID:3992
- C:\Windows\System\PKfWIdD.exe
  C:\Windows\System\PKfWIdD.exe
  2⤵
  PID:4008
- C:\Windows\System\QuJCxkX.exe
  C:\Windows\System\QuJCxkX.exe
  2⤵
  PID:4024
- C:\Windows\System\qvfPpZZ.exe
  C:\Windows\System\qvfPpZZ.exe
  2⤵
  PID:4040
- C:\Windows\System\kmSzpVZ.exe
  C:\Windows\System\kmSzpVZ.exe
  2⤵
  PID:4056
- C:\Windows\System\weaKbLX.exe
  C:\Windows\System\weaKbLX.exe
  2⤵
  PID:4072
- C:\Windows\System\vVxRlGD.exe
  C:\Windows\System\vVxRlGD.exe
  2⤵
  PID:4088
- C:\Windows\System\ZHWHrpL.exe
  C:\Windows\System\ZHWHrpL.exe
  2⤵
  PID:1808
- C:\Windows\System\QbsQEht.exe
  C:\Windows\System\QbsQEht.exe
  2⤵
  PID:2580
- C:\Windows\System\iRychSL.exe
  C:\Windows\System\iRychSL.exe
  2⤵
  PID:1100
- C:\Windows\System\aDkPfPq.exe
  C:\Windows\System\aDkPfPq.exe
  2⤵
  PID:2572
- C:\Windows\System\MPEaDOK.exe
  C:\Windows\System\MPEaDOK.exe
  2⤵
  PID:2656
- C:\Windows\System\pVTixLM.exe
  C:\Windows\System\pVTixLM.exe
  2⤵
  PID:3040
- C:\Windows\System\mOGTWJQ.exe
  C:\Windows\System\mOGTWJQ.exe
  2⤵
  PID:2148
- C:\Windows\System\cxoxQlT.exe
  C:\Windows\System\cxoxQlT.exe
  2⤵
  PID:2276
- C:\Windows\System\oggGXrO.exe
  C:\Windows\System\oggGXrO.exe
  2⤵
  PID:2824
- C:\Windows\System\nwbSHrn.exe
  C:\Windows\System\nwbSHrn.exe
  2⤵
  PID:1440
- C:\Windows\System\IQCCPNP.exe
  C:\Windows\System\IQCCPNP.exe
  2⤵
  PID:3068
- C:\Windows\System\BDNYjbh.exe
  C:\Windows\System\BDNYjbh.exe
  2⤵
  PID:2288
- C:\Windows\System\dCVyhlp.exe
  C:\Windows\System\dCVyhlp.exe
  2⤵
  PID:3088
- C:\Windows\System\PNnyBvH.exe
  C:\Windows\System\PNnyBvH.exe
  2⤵
  PID:3120
- C:\Windows\System\TBTvFdN.exe
  C:\Windows\System\TBTvFdN.exe
  2⤵
  PID:2856
- C:\Windows\System\DRoYvjy.exe
  C:\Windows\System\DRoYvjy.exe
  2⤵
  PID:2788
- C:\Windows\System\LgALIpb.exe
  C:\Windows\System\LgALIpb.exe
  2⤵
  PID:3184
- C:\Windows\System\SNXSZdd.exe
  C:\Windows\System\SNXSZdd.exe
  2⤵
  PID:3216
- C:\Windows\System\tAmDGAx.exe
  C:\Windows\System\tAmDGAx.exe
  2⤵
  PID:3248
- C:\Windows\System\dXxxDnJ.exe
  C:\Windows\System\dXxxDnJ.exe
  2⤵
  PID:3280
- C:\Windows\System\dbCpVGD.exe
  C:\Windows\System\dbCpVGD.exe
  2⤵
  PID:3328
- C:\Windows\System\FMezzZI.exe
  C:\Windows\System\FMezzZI.exe
  2⤵
  PID:3316
- C:\Windows\System\XTVXwpQ.exe
  C:\Windows\System\XTVXwpQ.exe
  2⤵
  PID:3364
- C:\Windows\System\fYQjjqf.exe
  C:\Windows\System\fYQjjqf.exe
  2⤵
  PID:3392
- C:\Windows\System\VbOmXqF.exe
  C:\Windows\System\VbOmXqF.exe
  2⤵
  PID:3424
- C:\Windows\System\PmSRYIq.exe
  C:\Windows\System\PmSRYIq.exe
  2⤵
  PID:3460
- C:\Windows\System\IApQpLi.exe
  C:\Windows\System\IApQpLi.exe
  2⤵
  PID:3504
- C:\Windows\System\DdYGHqK.exe
  C:\Windows\System\DdYGHqK.exe
  2⤵
  PID:3552
- C:\Windows\System\kahhyqD.exe
  C:\Windows\System\kahhyqD.exe
  2⤵
  PID:3584
- C:\Windows\System\kRmPbcA.exe
  C:\Windows\System\kRmPbcA.exe
  2⤵
  PID:3572
- C:\Windows\System\sDoBOQQ.exe
  C:\Windows\System\sDoBOQQ.exe
  2⤵
  PID:3620
- C:\Windows\System\QlFfcTT.exe
  C:\Windows\System\QlFfcTT.exe
  2⤵
  PID:2672
- C:\Windows\System\KEXfdug.exe
  C:\Windows\System\KEXfdug.exe
  2⤵
  PID:3680
- C:\Windows\System\TfkKOGq.exe
  C:\Windows\System\TfkKOGq.exe
  2⤵
  PID:3712
- C:\Windows\System\ZYebdnz.exe
  C:\Windows\System\ZYebdnz.exe
  2⤵
  PID:3744
- C:\Windows\System\DMHvgkm.exe
  C:\Windows\System\DMHvgkm.exe
  2⤵
  PID:2748
- C:\Windows\System\ANGHduU.exe
  C:\Windows\System\ANGHduU.exe
  2⤵
  PID:3780
- C:\Windows\System\wQzgvIV.exe
  C:\Windows\System\wQzgvIV.exe
  2⤵
  PID:3796
- C:\Windows\System\ZtlFHYj.exe
  C:\Windows\System\ZtlFHYj.exe
  2⤵
  PID:3844
- C:\Windows\System\fIMNzHQ.exe
  C:\Windows\System\fIMNzHQ.exe
  2⤵
  PID:2700
- C:\Windows\System\DvaTDJB.exe
  C:\Windows\System\DvaTDJB.exe
  2⤵
  PID:3876
- C:\Windows\System\mwsqjvh.exe
  C:\Windows\System\mwsqjvh.exe
  2⤵
  PID:3892
- C:\Windows\System\FmvuuDJ.exe
  C:\Windows\System\FmvuuDJ.exe
  2⤵
  PID:3936
- C:\Windows\System\bcNIJON.exe
  C:\Windows\System\bcNIJON.exe
  2⤵
  PID:3952
- C:\Windows\System\ZjehRkw.exe
  C:\Windows\System\ZjehRkw.exe
  2⤵
  PID:3984
- C:\Windows\System\pobbcqm.exe
  C:\Windows\System\pobbcqm.exe
  2⤵
  PID:4016
- C:\Windows\System\lEHDcBP.exe
  C:\Windows\System\lEHDcBP.exe
  2⤵
  PID:4048
- C:\Windows\System\jRQjXLZ.exe
  C:\Windows\System\jRQjXLZ.exe
  2⤵
  PID:4068
- C:\Windows\System\IMMUgCa.exe
  C:\Windows\System\IMMUgCa.exe
  2⤵
  PID:4084
- C:\Windows\System\nytVvzd.exe
  C:\Windows\System\nytVvzd.exe
  2⤵
  PID:2960
- C:\Windows\System\McAsjCV.exe
  C:\Windows\System\McAsjCV.exe
  2⤵
  PID:1216
- C:\Windows\System\rePkRTX.exe
  C:\Windows\System\rePkRTX.exe
  2⤵
  PID:1408
- C:\Windows\System\paovMfz.exe
  C:\Windows\System\paovMfz.exe
  2⤵
  PID:1004
- C:\Windows\System\HhsUFIS.exe
  C:\Windows\System\HhsUFIS.exe
  2⤵
  PID:3064
- C:\Windows\System\vViBUcM.exe
  C:\Windows\System\vViBUcM.exe
  2⤵
  PID:2876
- C:\Windows\System\NikOKvq.exe
  C:\Windows\System\NikOKvq.exe
  2⤵
  PID:2936
- C:\Windows\System\jDpBdQc.exe
  C:\Windows\System\jDpBdQc.exe
  2⤵
  PID:3076
- C:\Windows\System\zLwhDSt.exe
  C:\Windows\System\zLwhDSt.exe
  2⤵
  PID:2016
- C:\Windows\System\gwWHrvD.exe
  C:\Windows\System\gwWHrvD.exe
  2⤵
  PID:3188
- C:\Windows\System\jGVENfJ.exe
  C:\Windows\System\jGVENfJ.exe
  2⤵
  PID:2424
- C:\Windows\System\ckjpMeq.exe
  C:\Windows\System\ckjpMeq.exe
  2⤵
  PID:3168
- C:\Windows\System\KFFHSco.exe
  C:\Windows\System\KFFHSco.exe
  2⤵
  PID:576
- C:\Windows\System\ZyGTuzt.exe
  C:\Windows\System\ZyGTuzt.exe
  2⤵
  PID:3344
- C:\Windows\System\nCnqAgV.exe
  C:\Windows\System\nCnqAgV.exe
  2⤵
  PID:3488
- C:\Windows\System\yGZvVdn.exe
  C:\Windows\System\yGZvVdn.exe
  2⤵
  PID:3492
- C:\Windows\System\QNrrgJN.exe
  C:\Windows\System\QNrrgJN.exe
  2⤵
  PID:3568
- C:\Windows\System\FafHgbN.exe
  C:\Windows\System\FafHgbN.exe
  2⤵
  PID:1580
- C:\Windows\System\sbflndm.exe
  C:\Windows\System\sbflndm.exe
  2⤵
  PID:3716
- C:\Windows\System\TtPFkMO.exe
  C:\Windows\System\TtPFkMO.exe
  2⤵
  PID:3860
- C:\Windows\System\FokaGPp.exe
  C:\Windows\System\FokaGPp.exe
  2⤵
  PID:3972
- C:\Windows\System\pVeUxFG.exe
  C:\Windows\System\pVeUxFG.exe
  2⤵
  PID:3204
- C:\Windows\System\XEmmCKc.exe
  C:\Windows\System\XEmmCKc.exe
  2⤵
  PID:3684
- C:\Windows\System\ozCzBnd.exe
  C:\Windows\System\ozCzBnd.exe
  2⤵
  PID:3968
- C:\Windows\System\ouobBXq.exe
  C:\Windows\System\ouobBXq.exe
  2⤵
  PID:2760
- C:\Windows\System\NZuJVKf.exe
  C:\Windows\System\NZuJVKf.exe
  2⤵
  PID:3440
- C:\Windows\System\RqCLaQG.exe
  C:\Windows\System\RqCLaQG.exe
  2⤵
  PID:3444
- C:\Windows\System\JNHdVsC.exe
  C:\Windows\System\JNHdVsC.exe
  2⤵
  PID:3536
- C:\Windows\System\ElNqVUA.exe
  C:\Windows\System\ElNqVUA.exe
  2⤵
  PID:3924
- C:\Windows\System\yjhSVsg.exe
  C:\Windows\System\yjhSVsg.exe
  2⤵
  PID:4032
- C:\Windows\System\kygdOCs.exe
  C:\Windows\System\kygdOCs.exe
  2⤵
  PID:1824
- C:\Windows\System\CPWUjqJ.exe
  C:\Windows\System\CPWUjqJ.exe
  2⤵
  PID:3024
- C:\Windows\System\JCwfygz.exe
  C:\Windows\System\JCwfygz.exe
  2⤵
  PID:2692
- C:\Windows\System\yUNophf.exe
  C:\Windows\System\yUNophf.exe
  2⤵
  PID:3092
- C:\Windows\System\zdQfJsD.exe
  C:\Windows\System\zdQfJsD.exe
  2⤵
  PID:2860
- C:\Windows\System\hyLdiZm.exe
  C:\Windows\System\hyLdiZm.exe
  2⤵
  PID:1584
- C:\Windows\System\WdIofTx.exe
  C:\Windows\System\WdIofTx.exe
  2⤵
  PID:2652
- C:\Windows\System\okwPzvn.exe
  C:\Windows\System\okwPzvn.exe
  2⤵
  PID:1812
- C:\Windows\System\aTrrvwX.exe
  C:\Windows\System\aTrrvwX.exe
  2⤵
  PID:2844
- C:\Windows\System\qudtVCn.exe
  C:\Windows\System\qudtVCn.exe
  2⤵
  PID:1948
- C:\Windows\System\oxAtRFk.exe
  C:\Windows\System\oxAtRFk.exe
  2⤵
  PID:3220
- C:\Windows\System\cWLfANz.exe
  C:\Windows\System\cWLfANz.exe
  2⤵
  PID:3428
- C:\Windows\System\dkcsDPU.exe
  C:\Windows\System\dkcsDPU.exe
  2⤵
  PID:3792
- C:\Windows\System\LtjzkdD.exe
  C:\Windows\System\LtjzkdD.exe
  2⤵
  PID:3252
- C:\Windows\System\WYWKKIq.exe
  C:\Windows\System\WYWKKIq.exe
  2⤵
  PID:3664
- C:\Windows\System\nhSiYUO.exe
  C:\Windows\System\nhSiYUO.exe
  2⤵
  PID:1556
- C:\Windows\System\MhLiQGD.exe
  C:\Windows\System\MhLiQGD.exe
  2⤵
  PID:2956
- C:\Windows\System\iWaFTtZ.exe
  C:\Windows\System\iWaFTtZ.exe
  2⤵
  PID:3732
- C:\Windows\System\vJbUKPU.exe
  C:\Windows\System\vJbUKPU.exe
  2⤵
  PID:3632
- C:\Windows\System\RONJOCj.exe
  C:\Windows\System\RONJOCj.exe
  2⤵
  PID:3696
- C:\Windows\System\uJDEKpR.exe
  C:\Windows\System\uJDEKpR.exe
  2⤵
  PID:3456
- C:\Windows\System\HKickQR.exe
  C:\Windows\System\HKickQR.exe
  2⤵
  PID:3908
- C:\Windows\System\XpgtgPT.exe
  C:\Windows\System\XpgtgPT.exe
  2⤵
  PID:2664
- C:\Windows\System\DfqNWAO.exe
  C:\Windows\System\DfqNWAO.exe
  2⤵
  PID:4108
- C:\Windows\System\vSYrgDN.exe
  C:\Windows\System\vSYrgDN.exe
  2⤵
  PID:4124
- C:\Windows\System\XHJfnPu.exe
  C:\Windows\System\XHJfnPu.exe
  2⤵
  PID:4140
- C:\Windows\System\yUEXAzI.exe
  C:\Windows\System\yUEXAzI.exe
  2⤵
  PID:4156
- C:\Windows\System\qfmuBwx.exe
  C:\Windows\System\qfmuBwx.exe
  2⤵
  PID:4172
- C:\Windows\System\eFmgZTT.exe
  C:\Windows\System\eFmgZTT.exe
  2⤵
  PID:4188
- C:\Windows\System\eMaEkeF.exe
  C:\Windows\System\eMaEkeF.exe
  2⤵
  PID:4204
- C:\Windows\System\bgXrlNO.exe
  C:\Windows\System\bgXrlNO.exe
  2⤵
  PID:4220
- C:\Windows\System\KgkuTay.exe
  C:\Windows\System\KgkuTay.exe
  2⤵
  PID:4236
- C:\Windows\System\pvQOvXd.exe
  C:\Windows\System\pvQOvXd.exe
  2⤵
  PID:4252
- C:\Windows\System\OaSGLmI.exe
  C:\Windows\System\OaSGLmI.exe
  2⤵
  PID:4268
- C:\Windows\System\PfMkpbB.exe
  C:\Windows\System\PfMkpbB.exe
  2⤵
  PID:4284
- C:\Windows\System\utYEoIe.exe
  C:\Windows\System\utYEoIe.exe
  2⤵
  PID:4300
- C:\Windows\System\tNEBNKs.exe
  C:\Windows\System\tNEBNKs.exe
  2⤵
  PID:4316
- C:\Windows\System\hdJxOPg.exe
  C:\Windows\System\hdJxOPg.exe
  2⤵
  PID:4332
- C:\Windows\System\KRGzVDb.exe
  C:\Windows\System\KRGzVDb.exe
  2⤵
  PID:4348
- C:\Windows\System\dXmoNrZ.exe
  C:\Windows\System\dXmoNrZ.exe
  2⤵
  PID:4364
- C:\Windows\System\RTVnCju.exe
  C:\Windows\System\RTVnCju.exe
  2⤵
  PID:4380
- C:\Windows\System\Rvebkqp.exe
  C:\Windows\System\Rvebkqp.exe
  2⤵
  PID:4396
- C:\Windows\System\OjxqOey.exe
  C:\Windows\System\OjxqOey.exe
  2⤵
  PID:4412
- C:\Windows\System\LFMrftN.exe
  C:\Windows\System\LFMrftN.exe
  2⤵
  PID:4428
- C:\Windows\System\ZAQwVos.exe
  C:\Windows\System\ZAQwVos.exe
  2⤵
  PID:4444
- C:\Windows\System\hlAjJYC.exe
  C:\Windows\System\hlAjJYC.exe
  2⤵
  PID:4460
- C:\Windows\System\hIadbKx.exe
  C:\Windows\System\hIadbKx.exe
  2⤵
  PID:4476
- C:\Windows\System\mFUFzxr.exe
  C:\Windows\System\mFUFzxr.exe
  2⤵
  PID:4492
- C:\Windows\System\gPGHwHW.exe
  C:\Windows\System\gPGHwHW.exe
  2⤵
  PID:4508
- C:\Windows\System\pHLjnYR.exe
  C:\Windows\System\pHLjnYR.exe
  2⤵
  PID:4524
- C:\Windows\System\YjSeJTM.exe
  C:\Windows\System\YjSeJTM.exe
  2⤵
  PID:4540
- C:\Windows\System\SAvBbDk.exe
  C:\Windows\System\SAvBbDk.exe
  2⤵
  PID:4556
- C:\Windows\System\QWdlncL.exe
  C:\Windows\System\QWdlncL.exe
  2⤵
  PID:4572
- C:\Windows\System\hiAlILw.exe
  C:\Windows\System\hiAlILw.exe
  2⤵
  PID:4588
- C:\Windows\System\jUYwHGA.exe
  C:\Windows\System\jUYwHGA.exe
  2⤵
  PID:4604
- C:\Windows\System\bzjLhyr.exe
  C:\Windows\System\bzjLhyr.exe
  2⤵
  PID:4620
- C:\Windows\System\ZQJLqZF.exe
  C:\Windows\System\ZQJLqZF.exe
  2⤵
  PID:4636
- C:\Windows\System\REHGbHc.exe
  C:\Windows\System\REHGbHc.exe
  2⤵
  PID:4652
- C:\Windows\System\yUDpVpg.exe
  C:\Windows\System\yUDpVpg.exe
  2⤵
  PID:4668
- C:\Windows\System\csQLMXA.exe
  C:\Windows\System\csQLMXA.exe
  2⤵
  PID:4684
- C:\Windows\System\PaCpdMp.exe
  C:\Windows\System\PaCpdMp.exe
  2⤵
  PID:4700
- C:\Windows\System\gnHYaBv.exe
  C:\Windows\System\gnHYaBv.exe
  2⤵
  PID:4716
- C:\Windows\System\XqCBsVX.exe
  C:\Windows\System\XqCBsVX.exe
  2⤵
  PID:4732
- C:\Windows\System\JAxJnwS.exe
  C:\Windows\System\JAxJnwS.exe
  2⤵
  PID:4748
- C:\Windows\System\OEkuucF.exe
  C:\Windows\System\OEkuucF.exe
  2⤵
  PID:4764
- C:\Windows\System\sAjyDWo.exe
  C:\Windows\System\sAjyDWo.exe
  2⤵
  PID:4780
- C:\Windows\System\MbrFtGF.exe
  C:\Windows\System\MbrFtGF.exe
  2⤵
  PID:4796
- C:\Windows\System\UmeQIVv.exe
  C:\Windows\System\UmeQIVv.exe
  2⤵
  PID:4812
- C:\Windows\System\yZmcDRS.exe
  C:\Windows\System\yZmcDRS.exe
  2⤵
  PID:4828
- C:\Windows\System\FDoVxZF.exe
  C:\Windows\System\FDoVxZF.exe
  2⤵
  PID:4844
- C:\Windows\System\sshdryi.exe
  C:\Windows\System\sshdryi.exe
  2⤵
  PID:4860
- C:\Windows\System\JlYXtUS.exe
  C:\Windows\System\JlYXtUS.exe
  2⤵
  PID:4876
- C:\Windows\System\kWKYOnH.exe
  C:\Windows\System\kWKYOnH.exe
  2⤵
  PID:4892
- C:\Windows\System\NCoPfeD.exe
  C:\Windows\System\NCoPfeD.exe
  2⤵
  PID:4908
- C:\Windows\System\aCvezEV.exe
  C:\Windows\System\aCvezEV.exe
  2⤵
  PID:4924
- C:\Windows\System\OxwAwzR.exe
  C:\Windows\System\OxwAwzR.exe
  2⤵
  PID:4940
- C:\Windows\System\GonuopI.exe
  C:\Windows\System\GonuopI.exe
  2⤵
  PID:4956
- C:\Windows\System\TgLFELH.exe
  C:\Windows\System\TgLFELH.exe
  2⤵
  PID:4972
- C:\Windows\System\fVBAdlJ.exe
  C:\Windows\System\fVBAdlJ.exe
  2⤵
  PID:4988
- C:\Windows\System\temFZIr.exe
  C:\Windows\System\temFZIr.exe
  2⤵
  PID:5004
- C:\Windows\System\NyruSrC.exe
  C:\Windows\System\NyruSrC.exe
  2⤵
  PID:5020
- C:\Windows\System\gxzZWoH.exe
  C:\Windows\System\gxzZWoH.exe
  2⤵
  PID:5036
- C:\Windows\System\vGEOdVl.exe
  C:\Windows\System\vGEOdVl.exe
  2⤵
  PID:5052
- C:\Windows\System\HVyabYV.exe
  C:\Windows\System\HVyabYV.exe
  2⤵
  PID:5068
- C:\Windows\System\DoHbMdl.exe
  C:\Windows\System\DoHbMdl.exe
  2⤵
  PID:5084
- C:\Windows\System\ivvLQER.exe
  C:\Windows\System\ivvLQER.exe
  2⤵
  PID:5100
- C:\Windows\System\UATJNWC.exe
  C:\Windows\System\UATJNWC.exe
  2⤵
  PID:5116
- C:\Windows\System\JNPGgqM.exe
  C:\Windows\System\JNPGgqM.exe
  2⤵
  PID:696
- C:\Windows\System\YDuIvIx.exe
  C:\Windows\System\YDuIvIx.exe
  2⤵
  PID:4104
- C:\Windows\System\epfJPNE.exe
  C:\Windows\System\epfJPNE.exe
  2⤵
  PID:3236
- C:\Windows\System\ZzKtPke.exe
  C:\Windows\System\ZzKtPke.exe
  2⤵
  PID:4148
- C:\Windows\System\pIEtQpj.exe
  C:\Windows\System\pIEtQpj.exe
  2⤵
  PID:4228
- C:\Windows\System\QsGTIUa.exe
  C:\Windows\System\QsGTIUa.exe
  2⤵
  PID:4200
- C:\Windows\System\scgUMux.exe
  C:\Windows\System\scgUMux.exe
  2⤵
  PID:4292
- C:\Windows\System\vqitenA.exe
  C:\Windows\System\vqitenA.exe
  2⤵
  PID:4356
- C:\Windows\System\PPFSoqg.exe
  C:\Windows\System\PPFSoqg.exe
  2⤵
  PID:4392
- C:\Windows\System\DQJtUxs.exe
  C:\Windows\System\DQJtUxs.exe
  2⤵
  PID:4248
- C:\Windows\System\XpaSySE.exe
  C:\Windows\System\XpaSySE.exe
  2⤵
  PID:4488
- C:\Windows\System\WrrQhJv.exe
  C:\Windows\System\WrrQhJv.exe
  2⤵
  PID:4584
- C:\Windows\System\VITgVyM.exe
  C:\Windows\System\VITgVyM.exe
  2⤵
  PID:4552
- C:\Windows\System\eVPuFYC.exe
  C:\Windows\System\eVPuFYC.exe
  2⤵
  PID:4644
- C:\Windows\System\VeggWUc.exe
  C:\Windows\System\VeggWUc.exe
  2⤵
  PID:4372
- C:\Windows\System\oeKpdBe.exe
  C:\Windows\System\oeKpdBe.exe
  2⤵
  PID:4468
- C:\Windows\System\GErCQkd.exe
  C:\Windows\System\GErCQkd.exe
  2⤵
  PID:4596
- C:\Windows\System\eQqcjRZ.exe
  C:\Windows\System\eQqcjRZ.exe
  2⤵
  PID:4660
- C:\Windows\System\RUaBoso.exe
  C:\Windows\System\RUaBoso.exe
  2⤵
  PID:4184
- C:\Windows\System\iujPMTz.exe
  C:\Windows\System\iujPMTz.exe
  2⤵
  PID:4532
- C:\Windows\System\svthjfo.exe
  C:\Windows\System\svthjfo.exe
  2⤵
  PID:4664
- C:\Windows\System\wDjfaqc.exe
  C:\Windows\System\wDjfaqc.exe
  2⤵
  PID:4728
- C:\Windows\System\vqaiwcR.exe
  C:\Windows\System\vqaiwcR.exe
  2⤵
  PID:4680
- C:\Windows\System\XuamZse.exe
  C:\Windows\System\XuamZse.exe
  2⤵
  PID:4772
- C:\Windows\System\ekuQSlH.exe
  C:\Windows\System\ekuQSlH.exe
  2⤵
  PID:4824
- C:\Windows\System\ZfydgBr.exe
  C:\Windows\System\ZfydgBr.exe
  2⤵
  PID:4888
- C:\Windows\System\OZAAafj.exe
  C:\Windows\System\OZAAafj.exe
  2⤵
  PID:4952
- C:\Windows\System\pQbWhqf.exe
  C:\Windows\System\pQbWhqf.exe
  2⤵
  PID:5016
- C:\Windows\System\FZCdKjt.exe
  C:\Windows\System\FZCdKjt.exe
  2⤵
  PID:5080
- C:\Windows\System\WpWAzaN.exe
  C:\Windows\System\WpWAzaN.exe
  2⤵
  PID:4100
- C:\Windows\System\wmdCeTu.exe
  C:\Windows\System\wmdCeTu.exe
  2⤵
  PID:4196
- C:\Windows\System\kSPpslL.exe
  C:\Windows\System\kSPpslL.exe
  2⤵
  PID:4900
- C:\Windows\System\GRlefcH.exe
  C:\Windows\System\GRlefcH.exe
  2⤵
  PID:4216
- C:\Windows\System\cyZSMBN.exe
  C:\Windows\System\cyZSMBN.exe
  2⤵
  PID:4612
- C:\Windows\System\dCiMMnJ.exe
  C:\Windows\System\dCiMMnJ.exe
  2⤵
  PID:4628
- C:\Windows\System\EaczbFR.exe
  C:\Windows\System\EaczbFR.exe
  2⤵
  PID:4696
- C:\Windows\System\mcSvnHK.exe
  C:\Windows\System\mcSvnHK.exe
  2⤵
  PID:4856
- C:\Windows\System\colGtJE.exe
  C:\Windows\System\colGtJE.exe
  2⤵
  PID:4808
- C:\Windows\System\MevQCAH.exe
  C:\Windows\System\MevQCAH.exe
  2⤵
  PID:4904
- C:\Windows\System\UQKrLFX.exe
  C:\Windows\System\UQKrLFX.exe
  2⤵
  PID:4968
- C:\Windows\System\TZhxauE.exe
  C:\Windows\System\TZhxauE.exe
  2⤵
  PID:5032
- C:\Windows\System\oFmkFGF.exe
  C:\Windows\System\oFmkFGF.exe
  2⤵
  PID:5096
- C:\Windows\System\ryPsSuo.exe
  C:\Windows\System\ryPsSuo.exe
  2⤵
  PID:3284
- C:\Windows\System\YnjPbAp.exe
  C:\Windows\System\YnjPbAp.exe
  2⤵
  PID:4264
- C:\Windows\System\lmDzPor.exe
  C:\Windows\System\lmDzPor.exe
  2⤵
  PID:4484
- C:\Windows\System\cenfFtz.exe
  C:\Windows\System\cenfFtz.exe
  2⤵
  PID:4308
- C:\Windows\System\hlzWqXu.exe
  C:\Windows\System\hlzWqXu.exe
  2⤵
  PID:4120
- C:\Windows\System\NkJfggJ.exe
  C:\Windows\System\NkJfggJ.exe
  2⤵
  PID:4568
- C:\Windows\System\fWmFFuH.exe
  C:\Windows\System\fWmFFuH.exe
  2⤵
  PID:4820
- C:\Windows\System\rJShXrN.exe
  C:\Windows\System\rJShXrN.exe
  2⤵
  PID:4168
- C:\Windows\System\uMdkhpU.exe
  C:\Windows\System\uMdkhpU.exe
  2⤵
  PID:4712
- C:\Windows\System\zUcPkoZ.exe
  C:\Windows\System\zUcPkoZ.exe
  2⤵
  PID:4868
- C:\Windows\System\SGdkwFN.exe
  C:\Windows\System\SGdkwFN.exe
  2⤵
  PID:4504
- C:\Windows\System\hyJSECF.exe
  C:\Windows\System\hyJSECF.exe
  2⤵
  PID:4964
- C:\Windows\System\yGwMmml.exe
  C:\Windows\System\yGwMmml.exe
  2⤵
  PID:4064
- C:\Windows\System\yPLwNZF.exe
  C:\Windows\System\yPLwNZF.exe
  2⤵
  PID:5000
- C:\Windows\System\sDHkfzr.exe
  C:\Windows\System\sDHkfzr.exe
  2⤵
  PID:4792
- C:\Windows\System\ayIemVw.exe
  C:\Windows\System\ayIemVw.exe
  2⤵
  PID:4564
- C:\Windows\System\kGswsnG.exe
  C:\Windows\System\kGswsnG.exe
  2⤵
  PID:5128
- C:\Windows\System\AXdAuha.exe
  C:\Windows\System\AXdAuha.exe
  2⤵
  PID:5144
- C:\Windows\System\LCPpVRo.exe
  C:\Windows\System\LCPpVRo.exe
  2⤵
  PID:5160
- C:\Windows\System\WpKmuhx.exe
  C:\Windows\System\WpKmuhx.exe
  2⤵
  PID:5176
- C:\Windows\System\tgeirlY.exe
  C:\Windows\System\tgeirlY.exe
  2⤵
  PID:5192
- C:\Windows\System\vRyLexq.exe
  C:\Windows\System\vRyLexq.exe
  2⤵
  PID:5208
- C:\Windows\System\EfSPXNi.exe
  C:\Windows\System\EfSPXNi.exe
  2⤵
  PID:5224
- C:\Windows\System\QDJPEXM.exe
  C:\Windows\System\QDJPEXM.exe
  2⤵
  PID:5240
- C:\Windows\System\ucBnXOD.exe
  C:\Windows\System\ucBnXOD.exe
  2⤵
  PID:5256
- C:\Windows\System\ZDNbkuK.exe
  C:\Windows\System\ZDNbkuK.exe
  2⤵
  PID:5272
- C:\Windows\System\FEWPnJl.exe
  C:\Windows\System\FEWPnJl.exe
  2⤵
  PID:5288
- C:\Windows\System\TlRBDIa.exe
  C:\Windows\System\TlRBDIa.exe
  2⤵
  PID:5304
- C:\Windows\System\aYjcTzE.exe
  C:\Windows\System\aYjcTzE.exe
  2⤵
  PID:5320
- C:\Windows\System\uRTqsRG.exe
  C:\Windows\System\uRTqsRG.exe
  2⤵
  PID:5336
- C:\Windows\System\TCROvyJ.exe
  C:\Windows\System\TCROvyJ.exe
  2⤵
  PID:5352
- C:\Windows\System\FBDGEoe.exe
  C:\Windows\System\FBDGEoe.exe
  2⤵
  PID:5368
- C:\Windows\System\lTqZlSA.exe
  C:\Windows\System\lTqZlSA.exe
  2⤵
  PID:5384
- C:\Windows\System\VjMJbIp.exe
  C:\Windows\System\VjMJbIp.exe
  2⤵
  PID:5400
- C:\Windows\System\joKincH.exe
  C:\Windows\System\joKincH.exe
  2⤵
  PID:5416
- C:\Windows\System\FPKsSid.exe
  C:\Windows\System\FPKsSid.exe
  2⤵
  PID:5432
- C:\Windows\System\VoHHIvv.exe
  C:\Windows\System\VoHHIvv.exe
  2⤵
  PID:5448
- C:\Windows\System\kRBxOaZ.exe
  C:\Windows\System\kRBxOaZ.exe
  2⤵
  PID:5464
- C:\Windows\System\YYpegnY.exe
  C:\Windows\System\YYpegnY.exe
  2⤵
  PID:5480
- C:\Windows\System\OFFRPdr.exe
  C:\Windows\System\OFFRPdr.exe
  2⤵
  PID:5496
- C:\Windows\System\nHVokxj.exe
  C:\Windows\System\nHVokxj.exe
  2⤵
  PID:5512
- C:\Windows\System\COaswan.exe
  C:\Windows\System\COaswan.exe
  2⤵
  PID:5528
- C:\Windows\System\orVvvAI.exe
  C:\Windows\System\orVvvAI.exe
  2⤵
  PID:5544
- C:\Windows\System\mUZwafe.exe
  C:\Windows\System\mUZwafe.exe
  2⤵
  PID:5560
- C:\Windows\System\tCZBlWP.exe
  C:\Windows\System\tCZBlWP.exe
  2⤵
  PID:5576
- C:\Windows\System\fRWaGOl.exe
  C:\Windows\System\fRWaGOl.exe
  2⤵
  PID:5592
- C:\Windows\System\TTFkECP.exe
  C:\Windows\System\TTFkECP.exe
  2⤵
  PID:5608
- C:\Windows\System\dysXpwX.exe
  C:\Windows\System\dysXpwX.exe
  2⤵
  PID:5624
- C:\Windows\System\RwshkRr.exe
  C:\Windows\System\RwshkRr.exe
  2⤵
  PID:5640
- C:\Windows\System\JFlzfDF.exe
  C:\Windows\System\JFlzfDF.exe
  2⤵
  PID:5656
- C:\Windows\System\iWlzyWO.exe
  C:\Windows\System\iWlzyWO.exe
  2⤵
  PID:5672
- C:\Windows\System\LzCpQEV.exe
  C:\Windows\System\LzCpQEV.exe
  2⤵
  PID:5688
- C:\Windows\System\bzcXdxP.exe
  C:\Windows\System\bzcXdxP.exe
  2⤵
  PID:5704
- C:\Windows\System\WJlZyrA.exe
  C:\Windows\System\WJlZyrA.exe
  2⤵
  PID:5724
- C:\Windows\System\kuRiXgK.exe
  C:\Windows\System\kuRiXgK.exe
  2⤵
  PID:5740
- C:\Windows\System\KFuMIrr.exe
  C:\Windows\System\KFuMIrr.exe
  2⤵
  PID:5756
- C:\Windows\System\jqtdbGm.exe
  C:\Windows\System\jqtdbGm.exe
  2⤵
  PID:5772
- C:\Windows\System\OnRpzjW.exe
  C:\Windows\System\OnRpzjW.exe
  2⤵
  PID:5788
- C:\Windows\System\OjDtGLx.exe
  C:\Windows\System\OjDtGLx.exe
  2⤵
  PID:5804
- C:\Windows\System\irwZstV.exe
  C:\Windows\System\irwZstV.exe
  2⤵
  PID:5820
- C:\Windows\System\YMJpsMa.exe
  C:\Windows\System\YMJpsMa.exe
  2⤵
  PID:5836
- C:\Windows\System\IpVrbhp.exe
  C:\Windows\System\IpVrbhp.exe
  2⤵
  PID:5852
- C:\Windows\System\Cifpoqc.exe
  C:\Windows\System\Cifpoqc.exe
  2⤵
  PID:5868
- C:\Windows\System\ypczurR.exe
  C:\Windows\System\ypczurR.exe
  2⤵
  PID:5884
- C:\Windows\System\xHeERlt.exe
  C:\Windows\System\xHeERlt.exe
  2⤵
  PID:5900
- C:\Windows\System\brZOqNk.exe
  C:\Windows\System\brZOqNk.exe
  2⤵
  PID:5916
- C:\Windows\System\ozjwnQx.exe
  C:\Windows\System\ozjwnQx.exe
  2⤵
  PID:5932
- C:\Windows\System\YRPJXEc.exe
  C:\Windows\System\YRPJXEc.exe
  2⤵
  PID:5948
- C:\Windows\System\VqnzFDT.exe
  C:\Windows\System\VqnzFDT.exe
  2⤵
  PID:5964
- C:\Windows\System\QKUxUJF.exe
  C:\Windows\System\QKUxUJF.exe
  2⤵
  PID:5980
- C:\Windows\System\FiQOXNw.exe
  C:\Windows\System\FiQOXNw.exe
  2⤵
  PID:5996
- C:\Windows\System\BPADJub.exe
  C:\Windows\System\BPADJub.exe
  2⤵
  PID:6012
- C:\Windows\System\tXGHXkC.exe
  C:\Windows\System\tXGHXkC.exe
  2⤵
  PID:6028
- C:\Windows\System\VBttXmo.exe
  C:\Windows\System\VBttXmo.exe
  2⤵
  PID:6044
- C:\Windows\System\NlpiIux.exe
  C:\Windows\System\NlpiIux.exe
  2⤵
  PID:6060
- C:\Windows\System\laWElTL.exe
  C:\Windows\System\laWElTL.exe
  2⤵
  PID:6080
- C:\Windows\System\OIKoKCr.exe
  C:\Windows\System\OIKoKCr.exe
  2⤵
  PID:6100
- C:\Windows\System\rfgPVlj.exe
  C:\Windows\System\rfgPVlj.exe
  2⤵
  PID:6116
- C:\Windows\System\bDtfAXL.exe
  C:\Windows\System\bDtfAXL.exe
  2⤵
  PID:6132
- C:\Windows\System\PhmigxG.exe
  C:\Windows\System\PhmigxG.exe
  2⤵
  PID:4760
- C:\Windows\System\SkYiSVP.exe
  C:\Windows\System\SkYiSVP.exe
  2⤵
  PID:4280
- C:\Windows\System\kAvLJbV.exe
  C:\Windows\System\kAvLJbV.exe
  2⤵
  PID:5076
- C:\Windows\System\lpvTeCE.exe
  C:\Windows\System\lpvTeCE.exe
  2⤵
  PID:4936
- C:\Windows\System\AfQqUxL.exe
  C:\Windows\System\AfQqUxL.exe
  2⤵
  PID:4500
- C:\Windows\System\kMltcQr.exe
  C:\Windows\System\kMltcQr.exe
  2⤵
  PID:5172
- C:\Windows\System\JXYEbsI.exe
  C:\Windows\System\JXYEbsI.exe
  2⤵
  PID:5204
- C:\Windows\System\LwKJxKm.exe
  C:\Windows\System\LwKJxKm.exe
  2⤵
  PID:5300
- C:\Windows\System\xrESoEq.exe
  C:\Windows\System\xrESoEq.exe
  2⤵
  PID:5364
- C:\Windows\System\NddODfT.exe
  C:\Windows\System\NddODfT.exe
  2⤵
  PID:5152
- C:\Windows\System\pOQisiC.exe
  C:\Windows\System\pOQisiC.exe
  2⤵
  PID:5380
- C:\Windows\System\YdOfyld.exe
  C:\Windows\System\YdOfyld.exe
  2⤵
  PID:5184
- C:\Windows\System\obHtHcf.exe
  C:\Windows\System\obHtHcf.exe
  2⤵
  PID:5252
- C:\Windows\System\HEQRkGP.exe
  C:\Windows\System\HEQRkGP.exe
  2⤵
  PID:5524
- C:\Windows\System\ezouRvO.exe
  C:\Windows\System\ezouRvO.exe
  2⤵
  PID:5680
- C:\Windows\System\YEFPgxt.exe
  C:\Windows\System\YEFPgxt.exe
  2⤵
  PID:5620
- C:\Windows\System\fhqLqBj.exe
  C:\Windows\System\fhqLqBj.exe
  2⤵
  PID:5716
- C:\Windows\System\uWEGJRy.exe
  C:\Windows\System\uWEGJRy.exe
  2⤵
  PID:5780
- C:\Windows\System\VrOSMVS.exe
  C:\Windows\System\VrOSMVS.exe
  2⤵
  PID:5848
- C:\Windows\System\jeYXcBP.exe
  C:\Windows\System\jeYXcBP.exe
  2⤵
  PID:5976
- C:\Windows\System\KXLyCjh.exe
  C:\Windows\System\KXLyCjh.exe
  2⤵
  PID:5800
- C:\Windows\System\FFcvJDV.exe
  C:\Windows\System\FFcvJDV.exe
  2⤵
  PID:5896
- C:\Windows\System\aGErKwa.exe
  C:\Windows\System\aGErKwa.exe
  2⤵
  PID:6020
- C:\Windows\System\OYMqrYb.exe
  C:\Windows\System\OYMqrYb.exe
  2⤵
  PID:6040
- C:\Windows\System\fJlsVuY.exe
  C:\Windows\System\fJlsVuY.exe
  2⤵
  PID:6108
- C:\Windows\System\sDEjFWw.exe
  C:\Windows\System\sDEjFWw.exe
  2⤵
  PID:5048
- C:\Windows\System\yACeaPN.exe
  C:\Windows\System\yACeaPN.exe
  2⤵
  PID:6096
- C:\Windows\System\howWQZJ.exe
  C:\Windows\System\howWQZJ.exe
  2⤵
  PID:4408
- C:\Windows\System\SLGMnTQ.exe
  C:\Windows\System\SLGMnTQ.exe
  2⤵
  PID:5140
- C:\Windows\System\PBedNqF.exe
  C:\Windows\System\PBedNqF.exe
  2⤵
  PID:5360
- C:\Windows\System\JZtMQsZ.exe
  C:\Windows\System\JZtMQsZ.exe
  2⤵
  PID:5220
- C:\Windows\System\oRWcDFK.exe
  C:\Windows\System\oRWcDFK.exe
  2⤵
  PID:1692
- C:\Windows\System\bmefgst.exe
  C:\Windows\System\bmefgst.exe
  2⤵
  PID:5284
- C:\Windows\System\rOAYyUM.exe
  C:\Windows\System\rOAYyUM.exe
  2⤵
  PID:5440
- C:\Windows\System\qRstnaC.exe
  C:\Windows\System\qRstnaC.exe
  2⤵
  PID:5472
- C:\Windows\System\ZKyVllk.exe
  C:\Windows\System\ZKyVllk.exe
  2⤵
  PID:5536
- C:\Windows\System\xuKZcFl.exe
  C:\Windows\System\xuKZcFl.exe
  2⤵
  PID:5568
- C:\Windows\System\HTYNHlz.exe
  C:\Windows\System\HTYNHlz.exe
  2⤵
  PID:5668
- C:\Windows\System\DeDvHmW.exe
  C:\Windows\System\DeDvHmW.exe
  2⤵
  PID:5696
- C:\Windows\System\LHtCuiQ.exe
  C:\Windows\System\LHtCuiQ.exe
  2⤵
  PID:5460
- C:\Windows\System\Znwkzul.exe
  C:\Windows\System\Znwkzul.exe
  2⤵
  PID:5616
- C:\Windows\System\WocsRpt.exe
  C:\Windows\System\WocsRpt.exe
  2⤵
  PID:5812
- C:\Windows\System\XrHVCqB.exe
  C:\Windows\System\XrHVCqB.exe
  2⤵
  PID:5752
- C:\Windows\System\EmvXGjd.exe
  C:\Windows\System\EmvXGjd.exe
  2⤵
  PID:5940
- C:\Windows\System\CIuSQIj.exe
  C:\Windows\System\CIuSQIj.exe
  2⤵
  PID:5876
- C:\Windows\System\QZQWcew.exe
  C:\Windows\System\QZQWcew.exe
  2⤵
  PID:5860
- C:\Windows\System\NDISXwP.exe
  C:\Windows\System\NDISXwP.exe
  2⤵
  PID:5796
- C:\Windows\System\SyOGAXQ.exe
  C:\Windows\System\SyOGAXQ.exe
  2⤵
  PID:5956
- C:\Windows\System\gpgSwRL.exe
  C:\Windows\System\gpgSwRL.exe
  2⤵
  PID:6052
- C:\Windows\System\pQgzhpL.exe
  C:\Windows\System\pQgzhpL.exe
  2⤵
  PID:4744
- C:\Windows\System\DuXWYPH.exe
  C:\Windows\System\DuXWYPH.exe
  2⤵
  PID:4840
- C:\Windows\System\VSzQSfr.exe
  C:\Windows\System\VSzQSfr.exe
  2⤵
  PID:5248
- C:\Windows\System\SxiKGbX.exe
  C:\Windows\System\SxiKGbX.exe
  2⤵
  PID:5232
- C:\Windows\System\hrthvMP.exe
  C:\Windows\System\hrthvMP.exe
  2⤵
  PID:5348
- C:\Windows\System\dlqZEiq.exe
  C:\Windows\System\dlqZEiq.exe
  2⤵
  PID:5412
- C:\Windows\System\TWcJLmc.exe
  C:\Windows\System\TWcJLmc.exe
  2⤵
  PID:5636
- C:\Windows\System\sJqSaNP.exe
  C:\Windows\System\sJqSaNP.exe
  2⤵
  PID:5456
- C:\Windows\System\vBaFRfp.exe
  C:\Windows\System\vBaFRfp.exe
  2⤵
  PID:5816
- C:\Windows\System\rloYgty.exe
  C:\Windows\System\rloYgty.exe
  2⤵
  PID:5732
- C:\Windows\System\tVIvhOD.exe
  C:\Windows\System\tVIvhOD.exe
  2⤵
  PID:5652
- C:\Windows\System\FDjGNcu.exe
  C:\Windows\System\FDjGNcu.exe
  2⤵
  PID:6008
- C:\Windows\System\OtdkxEw.exe
  C:\Windows\System\OtdkxEw.exe
  2⤵
  PID:6068
- C:\Windows\System\iMYNYgl.exe
  C:\Windows\System\iMYNYgl.exe
  2⤵
  PID:5268
- C:\Windows\System\egEgmAd.exe
  C:\Windows\System\egEgmAd.exe
  2⤵
  PID:5504
- C:\Windows\System\kIdgsCO.exe
  C:\Windows\System\kIdgsCO.exe
  2⤵
  PID:5520
- C:\Windows\System\nxHeZrA.exe
  C:\Windows\System\nxHeZrA.exe
  2⤵
  PID:5908
- C:\Windows\System\JkTrirz.exe
  C:\Windows\System\JkTrirz.exe
  2⤵
  PID:5396
- C:\Windows\System\WhGEEXJ.exe
  C:\Windows\System\WhGEEXJ.exe
  2⤵
  PID:6124
- C:\Windows\System\TrFGrwu.exe
  C:\Windows\System\TrFGrwu.exe
  2⤵
  PID:6156
- C:\Windows\System\zDlJrJA.exe
  C:\Windows\System\zDlJrJA.exe
  2⤵
  PID:6172
- C:\Windows\System\ILtMdOO.exe
  C:\Windows\System\ILtMdOO.exe
  2⤵
  PID:6188
- C:\Windows\System\mVvgoBu.exe
  C:\Windows\System\mVvgoBu.exe
  2⤵
  PID:6204
- C:\Windows\System\SjduFmA.exe
  C:\Windows\System\SjduFmA.exe
  2⤵
  PID:6220
- C:\Windows\System\aAtJPUZ.exe
  C:\Windows\System\aAtJPUZ.exe
  2⤵
  PID:6236
- C:\Windows\System\dcJilEV.exe
  C:\Windows\System\dcJilEV.exe
  2⤵
  PID:6252
- C:\Windows\System\dvKGthC.exe
  C:\Windows\System\dvKGthC.exe
  2⤵
  PID:6268
- C:\Windows\System\snEcHvd.exe
  C:\Windows\System\snEcHvd.exe
  2⤵
  PID:6284
- C:\Windows\System\eHZjzfR.exe
  C:\Windows\System\eHZjzfR.exe
  2⤵
  PID:6300
- C:\Windows\System\hZEsvEb.exe
  C:\Windows\System\hZEsvEb.exe
  2⤵
  PID:6316
- C:\Windows\System\WKyMzpw.exe
  C:\Windows\System\WKyMzpw.exe
  2⤵
  PID:6332
- C:\Windows\System\hpKgiIP.exe
  C:\Windows\System\hpKgiIP.exe
  2⤵
  PID:6348
- C:\Windows\System\lyiWIMt.exe
  C:\Windows\System\lyiWIMt.exe
  2⤵
  PID:6364
- C:\Windows\System\huQkqEH.exe
  C:\Windows\System\huQkqEH.exe
  2⤵
  PID:6380
- C:\Windows\System\dqwmuJN.exe
  C:\Windows\System\dqwmuJN.exe
  2⤵
  PID:6396
- C:\Windows\System\FocaeMe.exe
  C:\Windows\System\FocaeMe.exe
  2⤵
  PID:6412
- C:\Windows\System\JZmnfhv.exe
  C:\Windows\System\JZmnfhv.exe
  2⤵
  PID:6428
- C:\Windows\System\eQWVvJP.exe
  C:\Windows\System\eQWVvJP.exe
  2⤵
  PID:6444
- C:\Windows\System\zgwHpOY.exe
  C:\Windows\System\zgwHpOY.exe
  2⤵
  PID:6460
- C:\Windows\System\YtvWptU.exe
  C:\Windows\System\YtvWptU.exe
  2⤵
  PID:6476
- C:\Windows\System\CBJwVfG.exe
  C:\Windows\System\CBJwVfG.exe
  2⤵
  PID:6492
- C:\Windows\System\KXTByFn.exe
  C:\Windows\System\KXTByFn.exe
  2⤵
  PID:6508
- C:\Windows\System\YvPFQxH.exe
  C:\Windows\System\YvPFQxH.exe
  2⤵
  PID:6524
- C:\Windows\System\wHJKcgI.exe
  C:\Windows\System\wHJKcgI.exe
  2⤵
  PID:6540
- C:\Windows\System\NhDKmLl.exe
  C:\Windows\System\NhDKmLl.exe
  2⤵
  PID:6556
- C:\Windows\System\dDrVSpW.exe
  C:\Windows\System\dDrVSpW.exe
  2⤵
  PID:6572
- C:\Windows\System\uTbMtRo.exe
  C:\Windows\System\uTbMtRo.exe
  2⤵
  PID:6588
- C:\Windows\System\QdCiZav.exe
  C:\Windows\System\QdCiZav.exe
  2⤵
  PID:6604
- C:\Windows\System\SByFFJW.exe
  C:\Windows\System\SByFFJW.exe
  2⤵
  PID:6620
- C:\Windows\System\XtIPlWK.exe
  C:\Windows\System\XtIPlWK.exe
  2⤵
  PID:6636
- C:\Windows\System\bzyllQo.exe
  C:\Windows\System\bzyllQo.exe
  2⤵
  PID:6652
- C:\Windows\System\OaAQQCb.exe
  C:\Windows\System\OaAQQCb.exe
  2⤵
  PID:6668
- C:\Windows\System\KaFvvza.exe
  C:\Windows\System\KaFvvza.exe
  2⤵
  PID:6684
- C:\Windows\System\NBjEpgt.exe
  C:\Windows\System\NBjEpgt.exe
  2⤵
  PID:6700
- C:\Windows\System\eEXHzyN.exe
  C:\Windows\System\eEXHzyN.exe
  2⤵
  PID:6716
- C:\Windows\System\MZoUXwi.exe
  C:\Windows\System\MZoUXwi.exe
  2⤵
  PID:6732
- C:\Windows\System\pIlFbwN.exe
  C:\Windows\System\pIlFbwN.exe
  2⤵
  PID:6748
- C:\Windows\System\SMzdHeA.exe
  C:\Windows\System\SMzdHeA.exe
  2⤵
  PID:6764
- C:\Windows\System\wsmvxOf.exe
  C:\Windows\System\wsmvxOf.exe
  2⤵
  PID:6780
- C:\Windows\System\VjCKYTa.exe
  C:\Windows\System\VjCKYTa.exe
  2⤵
  PID:6796
- C:\Windows\System\EacUqFB.exe
  C:\Windows\System\EacUqFB.exe
  2⤵
  PID:6812
- C:\Windows\System\xGGgjLW.exe
  C:\Windows\System\xGGgjLW.exe
  2⤵
  PID:6828
- C:\Windows\System\ZqGEnmD.exe
  C:\Windows\System\ZqGEnmD.exe
  2⤵
  PID:6844
- C:\Windows\System\edlqtgl.exe
  C:\Windows\System\edlqtgl.exe
  2⤵
  PID:6860
- C:\Windows\System\HUeUsLL.exe
  C:\Windows\System\HUeUsLL.exe
  2⤵
  PID:6876
- C:\Windows\System\fRGeLOl.exe
  C:\Windows\System\fRGeLOl.exe
  2⤵
  PID:6892
- C:\Windows\System\UGVHWlj.exe
  C:\Windows\System\UGVHWlj.exe
  2⤵
  PID:6908
- C:\Windows\System\mfVJkKL.exe
  C:\Windows\System\mfVJkKL.exe
  2⤵
  PID:6924
- C:\Windows\System\RXvcKfG.exe
  C:\Windows\System\RXvcKfG.exe
  2⤵
  PID:6940
- C:\Windows\System\MODrtzh.exe
  C:\Windows\System\MODrtzh.exe
  2⤵
  PID:6956
- C:\Windows\System\NGpMxtr.exe
  C:\Windows\System\NGpMxtr.exe
  2⤵
  PID:6972
- C:\Windows\System\LvytNLv.exe
  C:\Windows\System\LvytNLv.exe
  2⤵
  PID:6988
- C:\Windows\System\qUBVoGx.exe
  C:\Windows\System\qUBVoGx.exe
  2⤵
  PID:7004
- C:\Windows\System\NZwrDKY.exe
  C:\Windows\System\NZwrDKY.exe
  2⤵
  PID:7020
- C:\Windows\System\PTdHNOe.exe
  C:\Windows\System\PTdHNOe.exe
  2⤵
  PID:7036
- C:\Windows\System\GmWGSMe.exe
  C:\Windows\System\GmWGSMe.exe
  2⤵
  PID:7052
- C:\Windows\System\frFBRks.exe
  C:\Windows\System\frFBRks.exe
  2⤵
  PID:7068
- C:\Windows\System\nXEtQDZ.exe
  C:\Windows\System\nXEtQDZ.exe
  2⤵
  PID:7084
- C:\Windows\System\iDcVPkX.exe
  C:\Windows\System\iDcVPkX.exe
  2⤵
  PID:7100
- C:\Windows\System\ZDFKjZN.exe
  C:\Windows\System\ZDFKjZN.exe
  2⤵
  PID:7116
- C:\Windows\System\BaVlvNz.exe
  C:\Windows\System\BaVlvNz.exe
  2⤵
  PID:7132
- C:\Windows\System\qAsMJjR.exe
  C:\Windows\System\qAsMJjR.exe
  2⤵
  PID:7148
- C:\Windows\System\UDEvBwr.exe
  C:\Windows\System\UDEvBwr.exe
  2⤵
  PID:7164
- C:\Windows\System\RsdwBbS.exe
  C:\Windows\System\RsdwBbS.exe
  2⤵
  PID:5892
- C:\Windows\System\jrjCcHh.exe
  C:\Windows\System\jrjCcHh.exe
  2⤵
  PID:5944
- C:\Windows\System\mMhiyzC.exe
  C:\Windows\System\mMhiyzC.exe
  2⤵
  PID:5476
- C:\Windows\System\dBJrmFN.exe
  C:\Windows\System\dBJrmFN.exe
  2⤵
  PID:6152
- C:\Windows\System\fnjuZOl.exe
  C:\Windows\System\fnjuZOl.exe
  2⤵
  PID:6216
- C:\Windows\System\RgwusoP.exe
  C:\Windows\System\RgwusoP.exe
  2⤵
  PID:6280
- C:\Windows\System\BafKFkQ.exe
  C:\Windows\System\BafKFkQ.exe
  2⤵
  PID:6344
- C:\Windows\System\sMhPlMc.exe
  C:\Windows\System\sMhPlMc.exe
  2⤵
  PID:6356
- C:\Windows\System\iMkKXGV.exe
  C:\Windows\System\iMkKXGV.exe
  2⤵
  PID:6408
- C:\Windows\System\wSrpcVi.exe
  C:\Windows\System\wSrpcVi.exe
  2⤵
  PID:6472
- C:\Windows\System\BeItpNt.exe
  C:\Windows\System\BeItpNt.exe
  2⤵
  PID:6228
- C:\Windows\System\XApeQrj.exe
  C:\Windows\System\XApeQrj.exe
  2⤵
  PID:6328
- C:\Windows\System\rpAewFG.exe
  C:\Windows\System\rpAewFG.exe
  2⤵
  PID:6536
- C:\Windows\System\yATxEmF.exe
  C:\Windows\System\yATxEmF.exe
  2⤵
  PID:6424
- C:\Windows\System\pBovfsS.exe
  C:\Windows\System\pBovfsS.exe
  2⤵
  PID:6488
- C:\Windows\System\FHUgzev.exe
  C:\Windows\System\FHUgzev.exe
  2⤵
  PID:6552
- C:\Windows\System\CjEorxV.exe
  C:\Windows\System\CjEorxV.exe
  2⤵
  PID:6568
- C:\Windows\System\GdAAAxD.exe
  C:\Windows\System\GdAAAxD.exe
  2⤵
  PID:6632
- C:\Windows\System\QwnpnNi.exe
  C:\Windows\System\QwnpnNi.exe
  2⤵
  PID:6676
- C:\Windows\System\qXOschM.exe
  C:\Windows\System\qXOschM.exe
  2⤵
  PID:6756
- C:\Windows\System\hQtqnVg.exe
  C:\Windows\System\hQtqnVg.exe
  2⤵
  PID:6648
- C:\Windows\System\PdCAFbg.exe
  C:\Windows\System\PdCAFbg.exe
  2⤵
  PID:6856
- C:\Windows\System\qNyBQlo.exe
  C:\Windows\System\qNyBQlo.exe
  2⤵
  PID:6920
- C:\Windows\System\eAseshm.exe
  C:\Windows\System\eAseshm.exe
  2⤵
  PID:6984
- C:\Windows\System\lVtUxMF.exe
  C:\Windows\System\lVtUxMF.exe
  2⤵
  PID:7048
- C:\Windows\System\LEOPuxJ.exe
  C:\Windows\System\LEOPuxJ.exe
  2⤵
  PID:7112
- C:\Windows\System\HzwIUOt.exe
  C:\Windows\System\HzwIUOt.exe
  2⤵
  PID:5988
- C:\Windows\System\HNyNBnl.exe
  C:\Windows\System\HNyNBnl.exe
  2⤵
  PID:6644
- C:\Windows\System\RXzzBeo.exe
  C:\Windows\System\RXzzBeo.exe
  2⤵
  PID:6212
- C:\Windows\System\otkOUvu.exe
  C:\Windows\System\otkOUvu.exe
  2⤵
  PID:6404
- C:\Windows\System\XZFqlAd.exe
  C:\Windows\System\XZFqlAd.exe
  2⤵
  PID:6504
- C:\Windows\System\OxejRmB.exe
  C:\Windows\System\OxejRmB.exe
  2⤵
  PID:6744
- C:\Windows\System\dhKRdXR.exe
  C:\Windows\System\dhKRdXR.exe
  2⤵
  PID:7028
- C:\Windows\System\hlrCNqk.exe
  C:\Windows\System\hlrCNqk.exe
  2⤵
  PID:6840
- C:\Windows\System\uFnkWhx.exe
  C:\Windows\System\uFnkWhx.exe
  2⤵
  PID:6904
- C:\Windows\System\ZsJkirV.exe
  C:\Windows\System\ZsJkirV.exe
  2⤵
  PID:7000
- C:\Windows\System\TSsMemX.exe
  C:\Windows\System\TSsMemX.exe
  2⤵
  PID:7092
- C:\Windows\System\RFteOGq.exe
  C:\Windows\System\RFteOGq.exe
  2⤵
  PID:5296
- C:\Windows\System\kMTtJoR.exe
  C:\Windows\System\kMTtJoR.exe
  2⤵
  PID:6248
- C:\Windows\System\iTxWttF.exe
  C:\Windows\System\iTxWttF.exe
  2⤵
  PID:6440
- C:\Windows\System\mbWtkCW.exe
  C:\Windows\System\mbWtkCW.exe
  2⤵
  PID:6388
- C:\Windows\System\YzFOOOy.exe
  C:\Windows\System\YzFOOOy.exe
  2⤵
  PID:6420
- C:\Windows\System\Xomkemv.exe
  C:\Windows\System\Xomkemv.exe
  2⤵
  PID:6456
- C:\Windows\System\ctTXTHx.exe
  C:\Windows\System\ctTXTHx.exe
  2⤵
  PID:6664
- C:\Windows\System\wFvylxu.exe
  C:\Windows\System\wFvylxu.exe
  2⤵
  PID:6888
- C:\Windows\System\fpKcYyr.exe
  C:\Windows\System\fpKcYyr.exe
  2⤵
  PID:7144
- C:\Windows\System\XEnnpHe.exe
  C:\Windows\System\XEnnpHe.exe
  2⤵
  PID:6680
- C:\Windows\System\hUywWzQ.exe
  C:\Windows\System\hUywWzQ.exe
  2⤵
  PID:6872
- C:\Windows\System\ILWvHRI.exe
  C:\Windows\System\ILWvHRI.exe
  2⤵
  PID:6340
- C:\Windows\System\mDSzYrg.exe
  C:\Windows\System\mDSzYrg.exe
  2⤵
  PID:6724
- C:\Windows\System\etUlSno.exe
  C:\Windows\System\etUlSno.exe
  2⤵
  PID:6852
- C:\Windows\System\TVPYNmx.exe
  C:\Windows\System\TVPYNmx.exe
  2⤵
  PID:6296
- C:\Windows\System\OsvFKyq.exe
  C:\Windows\System\OsvFKyq.exe
  2⤵
  PID:6616
- C:\Windows\System\QwXQSQz.exe
  C:\Windows\System\QwXQSQz.exe
  2⤵
  PID:6708
- C:\Windows\System\XtBKdVg.exe
  C:\Windows\System\XtBKdVg.exe
  2⤵
  PID:6996
- C:\Windows\System\MHvBqyt.exe
  C:\Windows\System\MHvBqyt.exe
  2⤵
  PID:6548
- C:\Windows\System\xTRoDLY.exe
  C:\Windows\System\xTRoDLY.exe
  2⤵
  PID:6628
- C:\Windows\System\DLCbkGf.exe
  C:\Windows\System\DLCbkGf.exe
  2⤵
  PID:7016
- C:\Windows\System\GoSEEtK.exe
  C:\Windows\System\GoSEEtK.exe
  2⤵
  PID:7060
- C:\Windows\System\lXRuqpc.exe
  C:\Windows\System\lXRuqpc.exe
  2⤵
  PID:6376
- C:\Windows\System\jZyMUmk.exe
  C:\Windows\System\jZyMUmk.exe
  2⤵
  PID:6612
- C:\Windows\System\SGPfuSP.exe
  C:\Windows\System\SGPfuSP.exe
  2⤵
  PID:6292
- C:\Windows\System\nYpNSyy.exe
  C:\Windows\System\nYpNSyy.exe
  2⤵
  PID:6564
- C:\Windows\System\RuJdTAa.exe
  C:\Windows\System\RuJdTAa.exe
  2⤵
  PID:6952
- C:\Windows\System\NrEEsVg.exe
  C:\Windows\System\NrEEsVg.exe
  2⤵
  PID:6260
- C:\Windows\System\OWacvXR.exe
  C:\Windows\System\OWacvXR.exe
  2⤵
  PID:6200
- C:\Windows\System\ePYPUxa.exe
  C:\Windows\System\ePYPUxa.exe
  2⤵
  PID:7180
- C:\Windows\System\gFIrGjO.exe
  C:\Windows\System\gFIrGjO.exe
  2⤵
  PID:7196
- C:\Windows\System\QSHXicc.exe
  C:\Windows\System\QSHXicc.exe
  2⤵
  PID:7212
- C:\Windows\System\XiKdscz.exe
  C:\Windows\System\XiKdscz.exe
  2⤵
  PID:7228
- C:\Windows\System\RkLfLJV.exe
  C:\Windows\System\RkLfLJV.exe
  2⤵
  PID:7244
- C:\Windows\System\xieHAfr.exe
  C:\Windows\System\xieHAfr.exe
  2⤵
  PID:7260
- C:\Windows\System\OXYqnFZ.exe
  C:\Windows\System\OXYqnFZ.exe
  2⤵
  PID:7276
- C:\Windows\System\GNDUPpe.exe
  C:\Windows\System\GNDUPpe.exe
  2⤵
  PID:7292
- C:\Windows\System\EgmgrNM.exe
  C:\Windows\System\EgmgrNM.exe
  2⤵
  PID:7308
- C:\Windows\System\kFslfyE.exe
  C:\Windows\System\kFslfyE.exe
  2⤵
  PID:7324
- C:\Windows\System\KwmFYzx.exe
  C:\Windows\System\KwmFYzx.exe
  2⤵
  PID:7340
- C:\Windows\System\yITeQde.exe
  C:\Windows\System\yITeQde.exe
  2⤵
  PID:7356
- C:\Windows\System\pDlOSTE.exe
  C:\Windows\System\pDlOSTE.exe
  2⤵
  PID:7372
- C:\Windows\System\TSTctGP.exe
  C:\Windows\System\TSTctGP.exe
  2⤵
  PID:7392
- C:\Windows\System\JnvagpQ.exe
  C:\Windows\System\JnvagpQ.exe
  2⤵
  PID:7408
- C:\Windows\System\WBAFbKP.exe
  C:\Windows\System\WBAFbKP.exe
  2⤵
  PID:7424
- C:\Windows\System\EVzTARW.exe
  C:\Windows\System\EVzTARW.exe
  2⤵
  PID:7440
- C:\Windows\System\UiguBnc.exe
  C:\Windows\System\UiguBnc.exe
  2⤵
  PID:7456
- C:\Windows\System\yjQmznC.exe
  C:\Windows\System\yjQmznC.exe
  2⤵
  PID:7472
- C:\Windows\System\KGKmKPg.exe
  C:\Windows\System\KGKmKPg.exe
  2⤵
  PID:7488
- C:\Windows\System\OjltxWk.exe
  C:\Windows\System\OjltxWk.exe
  2⤵
  PID:7540
- C:\Windows\System\umddJBD.exe
  C:\Windows\System\umddJBD.exe
  2⤵
  PID:7560
- C:\Windows\System\nIjfKjH.exe
  C:\Windows\System\nIjfKjH.exe
  2⤵
  PID:7576
- C:\Windows\System\FGudPaY.exe
  C:\Windows\System\FGudPaY.exe
  2⤵
  PID:7592
- C:\Windows\System\kdsfGWA.exe
  C:\Windows\System\kdsfGWA.exe
  2⤵
  PID:7636
- C:\Windows\System\MOSTybm.exe
  C:\Windows\System\MOSTybm.exe
  2⤵
  PID:7772
- C:\Windows\System\SFQnbgB.exe
  C:\Windows\System\SFQnbgB.exe
  2⤵
  PID:7840
- C:\Windows\System\EIlQXoi.exe
  C:\Windows\System\EIlQXoi.exe
  2⤵
  PID:7940
- C:\Windows\System\hwgVwPP.exe
  C:\Windows\System\hwgVwPP.exe
  2⤵
  PID:7960
- C:\Windows\System\AutEUAT.exe
  C:\Windows\System\AutEUAT.exe
  2⤵
  PID:7976
- C:\Windows\System\uwrRaXV.exe
  C:\Windows\System\uwrRaXV.exe
  2⤵
  PID:7992
- C:\Windows\System\pAWCiWq.exe
  C:\Windows\System\pAWCiWq.exe
  2⤵
  PID:8008
- C:\Windows\System\hfRaQqC.exe
  C:\Windows\System\hfRaQqC.exe
  2⤵
  PID:8024
- C:\Windows\System\ZYNzfVR.exe
  C:\Windows\System\ZYNzfVR.exe
  2⤵
  PID:8040
- C:\Windows\System\CXyauvO.exe
  C:\Windows\System\CXyauvO.exe
  2⤵
  PID:8056
- C:\Windows\System\jnxJEsh.exe
  C:\Windows\System\jnxJEsh.exe
  2⤵
  PID:8072
- C:\Windows\System\mLBCSUu.exe
  C:\Windows\System\mLBCSUu.exe
  2⤵
  PID:8088
- C:\Windows\System\ioOPsoV.exe
  C:\Windows\System\ioOPsoV.exe
  2⤵
  PID:8104
- C:\Windows\System\JZVbAZj.exe
  C:\Windows\System\JZVbAZj.exe
  2⤵
  PID:8120
- C:\Windows\System\pIvtAFJ.exe
  C:\Windows\System\pIvtAFJ.exe
  2⤵
  PID:8136
- C:\Windows\System\qfGffQs.exe
  C:\Windows\System\qfGffQs.exe
  2⤵
  PID:8152
- C:\Windows\System\UANCJNW.exe
  C:\Windows\System\UANCJNW.exe
  2⤵
  PID:8168
- C:\Windows\System\PsuLGsm.exe
  C:\Windows\System\PsuLGsm.exe
  2⤵
  PID:8184
- C:\Windows\System\aHauwfB.exe
  C:\Windows\System\aHauwfB.exe
  2⤵
  PID:5604
- C:\Windows\System\rWcUZim.exe
  C:\Windows\System\rWcUZim.exe
  2⤵
  PID:7204
- C:\Windows\System\MoTUWRK.exe
  C:\Windows\System\MoTUWRK.exe
  2⤵
  PID:6776
- C:\Windows\System\hoLQqDO.exe
  C:\Windows\System\hoLQqDO.exe
  2⤵
  PID:7268
- C:\Windows\System\KzjvcJF.exe
  C:\Windows\System\KzjvcJF.exe
  2⤵
  PID:7224
- C:\Windows\System\xNLhjTV.exe
  C:\Windows\System\xNLhjTV.exe
  2⤵
  PID:7336
- C:\Windows\System\tcCIoki.exe
  C:\Windows\System\tcCIoki.exe
  2⤵
  PID:7364
- C:\Windows\System\BxdFhfg.exe
  C:\Windows\System\BxdFhfg.exe
  2⤵
  PID:7320
- C:\Windows\System\wmhexlB.exe
  C:\Windows\System\wmhexlB.exe
  2⤵
  PID:7404
- C:\Windows\System\OpfrgVs.exe
  C:\Windows\System\OpfrgVs.exe
  2⤵
  PID:7468
- C:\Windows\System\TkjGyuW.exe
  C:\Windows\System\TkjGyuW.exe
  2⤵
  PID:7416
- C:\Windows\System\SNbZEDK.exe
  C:\Windows\System\SNbZEDK.exe
  2⤵
  PID:7480
- C:\Windows\System\PMRFpNC.exe
  C:\Windows\System\PMRFpNC.exe
  2⤵
  PID:7504
- C:\Windows\System\vSYtYko.exe
  C:\Windows\System\vSYtYko.exe
  2⤵
  PID:7516
- C:\Windows\System\ZGIYbzz.exe
  C:\Windows\System\ZGIYbzz.exe
  2⤵
  PID:7568
- C:\Windows\System\wzNUqUC.exe
  C:\Windows\System\wzNUqUC.exe
  2⤵
  PID:7548
- C:\Windows\System\VLjHFXY.exe
  C:\Windows\System\VLjHFXY.exe
  2⤵
  PID:7604
- C:\Windows\System\oXIuKOp.exe
  C:\Windows\System\oXIuKOp.exe
  2⤵
  PID:7620
- C:\Windows\System\wHReBfC.exe
  C:\Windows\System\wHReBfC.exe
  2⤵
  PID:7644
- C:\Windows\System\jsXXvji.exe
  C:\Windows\System\jsXXvji.exe
  2⤵
  PID:7660
- C:\Windows\System\WINCZcc.exe
  C:\Windows\System\WINCZcc.exe
  2⤵
  PID:7676
- C:\Windows\System\cYzCqhU.exe
  C:\Windows\System\cYzCqhU.exe
  2⤵
  PID:7692
- C:\Windows\System\vRALgin.exe
  C:\Windows\System\vRALgin.exe
  2⤵
  PID:7708
- C:\Windows\System\hRDkinT.exe
  C:\Windows\System\hRDkinT.exe
  2⤵
  PID:7724
- C:\Windows\System\SZTolgY.exe
  C:\Windows\System\SZTolgY.exe
  2⤵
  PID:7736
- C:\Windows\System\GZXQjHV.exe
  C:\Windows\System\GZXQjHV.exe
  2⤵
  PID:7752
- C:\Windows\System\xFXiolv.exe
  C:\Windows\System\xFXiolv.exe
  2⤵
  PID:7780
- C:\Windows\System\DYaVLbf.exe
  C:\Windows\System\DYaVLbf.exe
  2⤵
  PID:7796
- C:\Windows\System\sPYfEKd.exe
  C:\Windows\System\sPYfEKd.exe
  2⤵
  PID:7812
- C:\Windows\System\hwjvxGQ.exe
  C:\Windows\System\hwjvxGQ.exe
  2⤵
  PID:7828
- C:\Windows\System\SGhopTx.exe
  C:\Windows\System\SGhopTx.exe
  2⤵
  PID:7852
- C:\Windows\System\wDywiea.exe
  C:\Windows\System\wDywiea.exe
  2⤵
  PID:7868
- C:\Windows\System\HKuiMqM.exe
  C:\Windows\System\HKuiMqM.exe
  2⤵
  PID:7884
- C:\Windows\System\RxUmDKe.exe
  C:\Windows\System\RxUmDKe.exe
  2⤵
  PID:7900
- C:\Windows\System\wGFPjtL.exe
  C:\Windows\System\wGFPjtL.exe
  2⤵
  PID:7924
- C:\Windows\System\bFtalpp.exe
  C:\Windows\System\bFtalpp.exe
  2⤵
  PID:7932
- C:\Windows\System\PFCQvZy.exe
  C:\Windows\System\PFCQvZy.exe
  2⤵
  PID:7952
- C:\Windows\System\bkyUBlv.exe
  C:\Windows\System\bkyUBlv.exe
  2⤵
  PID:7972
- C:\Windows\System\aZQdpVL.exe
  C:\Windows\System\aZQdpVL.exe
  2⤵
  PID:8052
- C:\Windows\System\sqVLNHY.exe
  C:\Windows\System\sqVLNHY.exe
  2⤵
  PID:8112
- C:\Windows\System\LBobHeS.exe
  C:\Windows\System\LBobHeS.exe
  2⤵
  PID:8004
- C:\Windows\System\qQqBzxf.exe
  C:\Windows\System\qQqBzxf.exe
  2⤵
  PID:8096
- C:\Windows\System\YmUQyIU.exe
  C:\Windows\System\YmUQyIU.exe
  2⤵
  PID:8148
- C:\Windows\System\nRUGHmS.exe
  C:\Windows\System\nRUGHmS.exe
  2⤵
  PID:6980
- C:\Windows\System\EoTYTDN.exe
  C:\Windows\System\EoTYTDN.exe
  2⤵
  PID:7240
- C:\Windows\System\OQnfUCd.exe
  C:\Windows\System\OQnfUCd.exe
  2⤵
  PID:7348
- C:\Windows\System\eDPmvhN.exe
  C:\Windows\System\eDPmvhN.exe
  2⤵
  PID:7436
- C:\Windows\System\kDPBbjY.exe
  C:\Windows\System\kDPBbjY.exe
  2⤵
  PID:7716
- C:\Windows\System\GHRuFAw.exe
  C:\Windows\System\GHRuFAw.exe
  2⤵
  PID:7632
- C:\Windows\System\KnHVkEk.exe
  C:\Windows\System\KnHVkEk.exe
  2⤵
  PID:7760
- C:\Windows\System\InHcMad.exe
  C:\Windows\System\InHcMad.exe
  2⤵
  PID:7824
- C:\Windows\System\NubEbPu.exe
  C:\Windows\System\NubEbPu.exe
  2⤵
  PID:7892
- C:\Windows\System\lGjOQtS.exe
  C:\Windows\System\lGjOQtS.exe
  2⤵
  PID:7928
- C:\Windows\System\KLPzafJ.exe
  C:\Windows\System\KLPzafJ.exe
  2⤵
  PID:7988
- C:\Windows\System\QYGFCmj.exe
  C:\Windows\System\QYGFCmj.exe
  2⤵
  PID:7804
- C:\Windows\System\GjZgRxs.exe
  C:\Windows\System\GjZgRxs.exe
  2⤵
  PID:8032
- C:\Windows\System\PEDujhY.exe
  C:\Windows\System\PEDujhY.exe
  2⤵
  PID:7948
- C:\Windows\System\EHIoNyK.exe
  C:\Windows\System\EHIoNyK.exe
  2⤵
  PID:8036
- C:\Windows\System\dOXLwaK.exe
  C:\Windows\System\dOXLwaK.exe
  2⤵
  PID:8068
- C:\Windows\System\iUfPcve.exe
  C:\Windows\System\iUfPcve.exe
  2⤵
  PID:8176
- C:\Windows\System\FACdgpA.exe
  C:\Windows\System\FACdgpA.exe
  2⤵
  PID:8084
- C:\Windows\System\kHVsDeb.exe
  C:\Windows\System\kHVsDeb.exe
  2⤵
  PID:7512
- C:\Windows\System\jPYpKNO.exe
  C:\Windows\System\jPYpKNO.exe
  2⤵
  PID:7172
- C:\Windows\System\prKBBtx.exe
  C:\Windows\System\prKBBtx.exe
  2⤵
  PID:7500
- C:\Windows\System\GcNgMBg.exe
  C:\Windows\System\GcNgMBg.exe
  2⤵
  PID:7252
- C:\Windows\System\vwffrrZ.exe
  C:\Windows\System\vwffrrZ.exe
  2⤵
  PID:7400
- C:\Windows\System\uBKTyfx.exe
  C:\Windows\System\uBKTyfx.exe
  2⤵
  PID:7684
- C:\Windows\System\nnXHVJp.exe
  C:\Windows\System\nnXHVJp.exe
  2⤵
  PID:7740
- C:\Windows\System\rCQUmFB.exe
  C:\Windows\System\rCQUmFB.exe
  2⤵
  PID:7732
- C:\Windows\System\OTiDsbW.exe
  C:\Windows\System\OTiDsbW.exe
  2⤵
  PID:7668
- C:\Windows\System\XCCBAUv.exe
  C:\Windows\System\XCCBAUv.exe
  2⤵
  PID:7908
- C:\Windows\System\FxYKPBu.exe
  C:\Windows\System\FxYKPBu.exe
  2⤵
  PID:7880
- C:\Windows\System\CqJurLN.exe
  C:\Windows\System\CqJurLN.exe
  2⤵
  PID:8020
- C:\Windows\System\IMKcKTv.exe
  C:\Windows\System\IMKcKTv.exe
  2⤵
  PID:7448
- C:\Windows\System\QOqqXxl.exe
  C:\Windows\System\QOqqXxl.exe
  2⤵
  PID:7384
- C:\Windows\System\qNbpFuO.exe
  C:\Windows\System\qNbpFuO.exe
  2⤵
  PID:7256
- C:\Windows\System\ccsInNr.exe
  C:\Windows\System\ccsInNr.exe
  2⤵
  PID:7192
- C:\Windows\System\rSRZQVX.exe
  C:\Windows\System\rSRZQVX.exe
  2⤵
  PID:7616
- C:\Windows\System\kQjnKXy.exe
  C:\Windows\System\kQjnKXy.exe
  2⤵
  PID:6324
- C:\Windows\System\uxYYTYb.exe
  C:\Windows\System\uxYYTYb.exe
  2⤵
  PID:7860
- C:\Windows\System\CdniQsy.exe
  C:\Windows\System\CdniQsy.exe
  2⤵
  PID:7332
- C:\Windows\System\lOMhzMw.exe
  C:\Windows\System\lOMhzMw.exe
  2⤵
  PID:7628
- C:\Windows\System\RalpbPc.exe
  C:\Windows\System\RalpbPc.exe
  2⤵
  PID:8132
- C:\Windows\System\nmYlqdd.exe
  C:\Windows\System\nmYlqdd.exe
  2⤵
  PID:7536
- C:\Windows\System\iCeUAYW.exe
  C:\Windows\System\iCeUAYW.exe
  2⤵
  PID:7848
- C:\Windows\System\kXMpUiX.exe
  C:\Windows\System\kXMpUiX.exe
  2⤵
  PID:7792
- C:\Windows\System\zUqkIHY.exe
  C:\Windows\System\zUqkIHY.exe
  2⤵
  PID:7496
- C:\Windows\System\rjoPQgt.exe
  C:\Windows\System\rjoPQgt.exe
  2⤵
  PID:8196
- C:\Windows\System\XGfNyTe.exe
  C:\Windows\System\XGfNyTe.exe
  2⤵
  PID:8212
- C:\Windows\System\aKgGlwB.exe
  C:\Windows\System\aKgGlwB.exe
  2⤵
  PID:8228
- C:\Windows\System\KGjjgTB.exe
  C:\Windows\System\KGjjgTB.exe
  2⤵
  PID:8244
- C:\Windows\System\MmMqPJC.exe
  C:\Windows\System\MmMqPJC.exe
  2⤵
  PID:8260
- C:\Windows\System\DhunUiX.exe
  C:\Windows\System\DhunUiX.exe
  2⤵
  PID:8276
- C:\Windows\System\cxYrjFC.exe
  C:\Windows\System\cxYrjFC.exe
  2⤵
  PID:8292
- C:\Windows\System\PTLIhaR.exe
  C:\Windows\System\PTLIhaR.exe
  2⤵
  PID:8308
- C:\Windows\System\jSrEzwv.exe
  C:\Windows\System\jSrEzwv.exe
  2⤵
  PID:8324
- C:\Windows\System\ihNUoQr.exe
  C:\Windows\System\ihNUoQr.exe
  2⤵
  PID:8340
- C:\Windows\System\BrjSivn.exe
  C:\Windows\System\BrjSivn.exe
  2⤵
  PID:8356
- C:\Windows\System\eECZthZ.exe
  C:\Windows\System\eECZthZ.exe
  2⤵
  PID:8372
- C:\Windows\System\iJbgupj.exe
  C:\Windows\System\iJbgupj.exe
  2⤵
  PID:8388
- C:\Windows\System\oUMjayP.exe
  C:\Windows\System\oUMjayP.exe
  2⤵
  PID:8404
- C:\Windows\System\AlAAmRi.exe
  C:\Windows\System\AlAAmRi.exe
  2⤵
  PID:8420
- C:\Windows\System\gHgYbqN.exe
  C:\Windows\System\gHgYbqN.exe
  2⤵
  PID:8436
- C:\Windows\System\JknUKAV.exe
  C:\Windows\System\JknUKAV.exe
  2⤵
  PID:8452
- C:\Windows\System\aRuGfWo.exe
  C:\Windows\System\aRuGfWo.exe
  2⤵
  PID:8468
- C:\Windows\System\PlsfcCe.exe
  C:\Windows\System\PlsfcCe.exe
  2⤵
  PID:8484
- C:\Windows\System\kcDYvDX.exe
  C:\Windows\System\kcDYvDX.exe
  2⤵
  PID:8500
- C:\Windows\System\mMRHgFK.exe
  C:\Windows\System\mMRHgFK.exe
  2⤵
  PID:8516
- C:\Windows\System\uOFPtfy.exe
  C:\Windows\System\uOFPtfy.exe
  2⤵
  PID:8532
- C:\Windows\System\roBbuCe.exe
  C:\Windows\System\roBbuCe.exe
  2⤵
  PID:8548
- C:\Windows\System\YvlVBgo.exe
  C:\Windows\System\YvlVBgo.exe
  2⤵
  PID:8564
- C:\Windows\System\mlXHEHe.exe
  C:\Windows\System\mlXHEHe.exe
  2⤵
  PID:8580
- C:\Windows\System\epMitJm.exe
  C:\Windows\System\epMitJm.exe
  2⤵
  PID:8596
- C:\Windows\System\XKIWnTZ.exe
  C:\Windows\System\XKIWnTZ.exe
  2⤵
  PID:8612
- C:\Windows\System\uLcTZLK.exe
  C:\Windows\System\uLcTZLK.exe
  2⤵
  PID:8628
- C:\Windows\System\qtiZwGw.exe
  C:\Windows\System\qtiZwGw.exe
  2⤵
  PID:8644
- C:\Windows\System\xcYDVhW.exe
  C:\Windows\System\xcYDVhW.exe
  2⤵
  PID:8660
- C:\Windows\System\pQUbMLs.exe
  C:\Windows\System\pQUbMLs.exe
  2⤵
  PID:8676
- C:\Windows\System\rjkRvoF.exe
  C:\Windows\System\rjkRvoF.exe
  2⤵
  PID:8692
- C:\Windows\System\ZrxqCEu.exe
  C:\Windows\System\ZrxqCEu.exe
  2⤵
  PID:8708
- C:\Windows\System\aqlXOCN.exe
  C:\Windows\System\aqlXOCN.exe
  2⤵
  PID:8724
- C:\Windows\System\zFQvmVq.exe
  C:\Windows\System\zFQvmVq.exe
  2⤵
  PID:8740
- C:\Windows\System\pKGBkUk.exe
  C:\Windows\System\pKGBkUk.exe
  2⤵
  PID:8756
- C:\Windows\System\NBJewIx.exe
  C:\Windows\System\NBJewIx.exe
  2⤵
  PID:8772
- C:\Windows\System\eUOlvHW.exe
  C:\Windows\System\eUOlvHW.exe
  2⤵
  PID:8788
- C:\Windows\System\JxrkvrL.exe
  C:\Windows\System\JxrkvrL.exe
  2⤵
  PID:8804
- C:\Windows\System\TGJFhmt.exe
  C:\Windows\System\TGJFhmt.exe
  2⤵
  PID:8820
- C:\Windows\System\clQfXvP.exe
  C:\Windows\System\clQfXvP.exe
  2⤵
  PID:8840
- C:\Windows\System\ohrncWb.exe
  C:\Windows\System\ohrncWb.exe
  2⤵
  PID:8856
- C:\Windows\System\fyjdrJb.exe
  C:\Windows\System\fyjdrJb.exe
  2⤵
  PID:8872
- C:\Windows\System\lIpwWkG.exe
  C:\Windows\System\lIpwWkG.exe
  2⤵
  PID:8888
- C:\Windows\System\AISJoaR.exe
  C:\Windows\System\AISJoaR.exe
  2⤵
  PID:8904
- C:\Windows\System\IpzxWnU.exe
  C:\Windows\System\IpzxWnU.exe
  2⤵
  PID:8920
- C:\Windows\System\SXcAtKl.exe
  C:\Windows\System\SXcAtKl.exe
  2⤵
  PID:8936
- C:\Windows\System\CsnTLBK.exe
  C:\Windows\System\CsnTLBK.exe
  2⤵
  PID:8952
- C:\Windows\System\MxJIKBq.exe
  C:\Windows\System\MxJIKBq.exe
  2⤵
  PID:8968
- C:\Windows\System\CzhpunS.exe
  C:\Windows\System\CzhpunS.exe
  2⤵
  PID:8984
- C:\Windows\System\rvmhRzJ.exe
  C:\Windows\System\rvmhRzJ.exe
  2⤵
  PID:9000
- C:\Windows\System\jnYYMco.exe
  C:\Windows\System\jnYYMco.exe
  2⤵
  PID:9016
- C:\Windows\System\cTYoXMH.exe
  C:\Windows\System\cTYoXMH.exe
  2⤵
  PID:9032
- C:\Windows\System\ELdUdUM.exe
  C:\Windows\System\ELdUdUM.exe
  2⤵
  PID:9048
- C:\Windows\System\trZAJPb.exe
  C:\Windows\System\trZAJPb.exe
  2⤵
  PID:9064
- C:\Windows\System\cfErrlc.exe
  C:\Windows\System\cfErrlc.exe
  2⤵
  PID:9080
- C:\Windows\System\suZoiVj.exe
  C:\Windows\System\suZoiVj.exe
  2⤵
  PID:9096
- C:\Windows\System\xGFrnYR.exe
  C:\Windows\System\xGFrnYR.exe
  2⤵
  PID:9112
- C:\Windows\System\ToiUPUy.exe
  C:\Windows\System\ToiUPUy.exe
  2⤵
  PID:9128
- C:\Windows\System\YqjOlaW.exe
  C:\Windows\System\YqjOlaW.exe
  2⤵
  PID:9144
- C:\Windows\System\pmlexqq.exe
  C:\Windows\System\pmlexqq.exe
  2⤵
  PID:9160
- C:\Windows\System\GsEoKMH.exe
  C:\Windows\System\GsEoKMH.exe
  2⤵
  PID:9176
- C:\Windows\System\mDltyWL.exe
  C:\Windows\System\mDltyWL.exe
  2⤵
  PID:9192
- C:\Windows\System\OzgmKuT.exe
  C:\Windows\System\OzgmKuT.exe
  2⤵
  PID:9208
- C:\Windows\System\oFDCMKC.exe
  C:\Windows\System\oFDCMKC.exe
  2⤵
  PID:8204
- C:\Windows\System\zdWIHax.exe
  C:\Windows\System\zdWIHax.exe
  2⤵
  PID:8224
- C:\Windows\System\HHLVZmo.exe
  C:\Windows\System\HHLVZmo.exe
  2⤵
  PID:8288
- C:\Windows\System\WZfDAVL.exe
  C:\Windows\System\WZfDAVL.exe
  2⤵
  PID:8304
- C:\Windows\System\uKNmnOK.exe
  C:\Windows\System\uKNmnOK.exe
  2⤵
  PID:8352
- C:\Windows\System\yjtoCSU.exe
  C:\Windows\System\yjtoCSU.exe
  2⤵
  PID:8380
- C:\Windows\System\RQgPqJg.exe
  C:\Windows\System\RQgPqJg.exe
  2⤵
  PID:8416
- C:\Windows\System\Zrilyao.exe
  C:\Windows\System\Zrilyao.exe
  2⤵
  PID:8396
- C:\Windows\System\eohRVPy.exe
  C:\Windows\System\eohRVPy.exe
  2⤵
  PID:8540
- C:\Windows\System\sBSRIhI.exe
  C:\Windows\System\sBSRIhI.exe
  2⤵
  PID:8572
- C:\Windows\System\GkcTbeT.exe
  C:\Windows\System\GkcTbeT.exe
  2⤵
  PID:8636
- C:\Windows\System\TQDGbPc.exe
  C:\Windows\System\TQDGbPc.exe
  2⤵
  PID:8460
- C:\Windows\System\kuXVbYh.exe
  C:\Windows\System\kuXVbYh.exe
  2⤵
  PID:8464
- C:\Windows\System\BDvKoQc.exe
  C:\Windows\System\BDvKoQc.exe
  2⤵
  PID:8652
- C:\Windows\System\GAhvvcx.exe
  C:\Windows\System\GAhvvcx.exe
  2⤵
  PID:8588
- C:\Windows\System\zlCgqgW.exe
  C:\Windows\System\zlCgqgW.exe
  2⤵
  PID:8688
- C:\Windows\System\rCyygXl.exe
  C:\Windows\System\rCyygXl.exe
  2⤵
  PID:8736
- C:\Windows\System\bXjVowr.exe
  C:\Windows\System\bXjVowr.exe
  2⤵
  PID:8800
- C:\Windows\System\odixOIT.exe
  C:\Windows\System\odixOIT.exe
  2⤵
  PID:7532
- C:\Windows\System\eXZAYyf.exe
  C:\Windows\System\eXZAYyf.exe
  2⤵
  PID:8896
- C:\Windows\System\zQADFjb.exe
  C:\Windows\System\zQADFjb.exe
  2⤵
  PID:8716
- C:\Windows\System\VTwHlwP.exe
  C:\Windows\System\VTwHlwP.exe
  2⤵
  PID:8780
- C:\Windows\System\przVJpx.exe
  C:\Windows\System\przVJpx.exe
  2⤵
  PID:8880
- C:\Windows\System\BzApNQZ.exe
  C:\Windows\System\BzApNQZ.exe
  2⤵
  PID:8960
- C:\Windows\System\LOxqNOA.exe
  C:\Windows\System\LOxqNOA.exe
  2⤵
  PID:8976
- C:\Windows\System\AQOJcNG.exe
  C:\Windows\System\AQOJcNG.exe
  2⤵
  PID:8996
- C:\Windows\System\gAGTIbR.exe
  C:\Windows\System\gAGTIbR.exe
  2⤵
  PID:9012
- C:\Windows\System\OwAARLf.exe
  C:\Windows\System\OwAARLf.exe
  2⤵
  PID:9044
- C:\Windows\System\JSgBltX.exe
  C:\Windows\System\JSgBltX.exe
  2⤵
  PID:9076
- C:\Windows\System\dGHVrqF.exe
  C:\Windows\System\dGHVrqF.exe
  2⤵
  PID:9124
- C:\Windows\System\iLJZyvp.exe
  C:\Windows\System\iLJZyvp.exe
  2⤵
  PID:9156
- C:\Windows\System\vqjZSLC.exe
  C:\Windows\System\vqjZSLC.exe
  2⤵
  PID:9188
- C:\Windows\System\pjCVleH.exe
  C:\Windows\System\pjCVleH.exe
  2⤵
  PID:8236
- C:\Windows\System\XZuVdvO.exe
  C:\Windows\System\XZuVdvO.exe
  2⤵
  PID:8256
- C:\Windows\System\WsdCWmE.exe
  C:\Windows\System\WsdCWmE.exe
  2⤵
  PID:8412
- C:\Windows\System\QnxeMaT.exe
  C:\Windows\System\QnxeMaT.exe
  2⤵
  PID:8300
- C:\Windows\System\aoZLUSS.exe
  C:\Windows\System\aoZLUSS.exe
  2⤵
  PID:8448
- C:\Windows\System\OTMiArO.exe
  C:\Windows\System\OTMiArO.exe
  2⤵
  PID:8608
- C:\Windows\System\jJFPURs.exe
  C:\Windows\System\jJFPURs.exe
  2⤵
  PID:8620
- C:\Windows\System\nkGWylg.exe
  C:\Windows\System\nkGWylg.exe
  2⤵
  PID:8732
- C:\Windows\System\fjqySLM.exe
  C:\Windows\System\fjqySLM.exe
  2⤵
  PID:8816
- C:\Windows\System\ZBkGsXI.exe
  C:\Windows\System\ZBkGsXI.exe
  2⤵
  PID:8672
- C:\Windows\System\EbktdId.exe
  C:\Windows\System\EbktdId.exe
  2⤵
  PID:8556
- C:\Windows\System\DxrfGIn.exe
  C:\Windows\System\DxrfGIn.exe
  2⤵
  PID:9072
- C:\Windows\System\vWMtjjD.exe
  C:\Windows\System\vWMtjjD.exe
  2⤵
  PID:9140
- C:\Windows\System\RsHewST.exe
  C:\Windows\System\RsHewST.exe
  2⤵
  PID:8932
- C:\Windows\System\wQpsutB.exe
  C:\Windows\System\wQpsutB.exe
  2⤵
  PID:9104
- C:\Windows\System\wCeFcEN.exe
  C:\Windows\System\wCeFcEN.exe
  2⤵
  PID:9060
- C:\Windows\System\ANaGsLd.exe
  C:\Windows\System\ANaGsLd.exe
  2⤵
  PID:8252
- C:\Windows\System\sKfCpsg.exe
  C:\Windows\System\sKfCpsg.exe
  2⤵
  PID:8364
- C:\Windows\System\WloYjQO.exe
  C:\Windows\System\WloYjQO.exe
  2⤵
  PID:8832
- C:\Windows\System\UlaBFyk.exe
  C:\Windows\System\UlaBFyk.exe
  2⤵
  PID:8512
- C:\Windows\System\TyXhkPI.exe
  C:\Windows\System\TyXhkPI.exe
  2⤵
  PID:8928
- C:\Windows\System\RnvoskD.exe
  C:\Windows\System\RnvoskD.exe
  2⤵
  PID:8656
- C:\Windows\System\UncVdkU.exe
  C:\Windows\System\UncVdkU.exe
  2⤵
  PID:8944
- C:\Windows\System\stGzyZy.exe
  C:\Windows\System\stGzyZy.exe
  2⤵
  PID:9024
- C:\Windows\System\RvXlbFS.exe
  C:\Windows\System\RvXlbFS.exe
  2⤵
  PID:9120
- C:\Windows\System\aUffSbt.exe
  C:\Windows\System\aUffSbt.exe
  2⤵
  PID:8384
- C:\Windows\System\MSULVxA.exe
  C:\Windows\System\MSULVxA.exe
  2⤵
  PID:8992
- C:\Windows\System\FQJPooe.exe
  C:\Windows\System\FQJPooe.exe
  2⤵
  PID:8948
- C:\Windows\System\dENdcjE.exe
  C:\Windows\System\dENdcjE.exe
  2⤵
  PID:8704
- C:\Windows\System\uSMgJjr.exe
  C:\Windows\System\uSMgJjr.exe
  2⤵
  PID:9220
- C:\Windows\System\mgQFcOR.exe
  C:\Windows\System\mgQFcOR.exe
  2⤵
  PID:9236
- C:\Windows\System\WikBXjt.exe
  C:\Windows\System\WikBXjt.exe
  2⤵
  PID:9252
- C:\Windows\System\aPHVumb.exe
  C:\Windows\System\aPHVumb.exe
  2⤵
  PID:9268
- C:\Windows\System\JltKYYx.exe
  C:\Windows\System\JltKYYx.exe
  2⤵
  PID:9284
- C:\Windows\System\cLDtDpm.exe
  C:\Windows\System\cLDtDpm.exe
  2⤵
  PID:9300
- C:\Windows\System\vldRIOb.exe
  C:\Windows\System\vldRIOb.exe
  2⤵
  PID:9316
- C:\Windows\System\yzllsPz.exe
  C:\Windows\System\yzllsPz.exe
  2⤵
  PID:9332
- C:\Windows\System\AIFtJNV.exe
  C:\Windows\System\AIFtJNV.exe
  2⤵
  PID:9348
- C:\Windows\System\BcXRUcs.exe
  C:\Windows\System\BcXRUcs.exe
  2⤵
  PID:9364
- C:\Windows\System\fzyaCcq.exe
  C:\Windows\System\fzyaCcq.exe
  2⤵
  PID:9380
- C:\Windows\System\AmQuKbV.exe
  C:\Windows\System\AmQuKbV.exe
  2⤵
  PID:9396
- C:\Windows\System\UUDRIZR.exe
  C:\Windows\System\UUDRIZR.exe
  2⤵
  PID:9412
- C:\Windows\System\KRdhWjC.exe
  C:\Windows\System\KRdhWjC.exe
  2⤵
  PID:9428
- C:\Windows\System\JVSpmuE.exe
  C:\Windows\System\JVSpmuE.exe
  2⤵
  PID:9456
- C:\Windows\System\AFHNITK.exe
  C:\Windows\System\AFHNITK.exe
  2⤵
  PID:9480
- C:\Windows\System\yJoubYY.exe
  C:\Windows\System\yJoubYY.exe
  2⤵
  PID:9500
- C:\Windows\System\jkSIgmu.exe
  C:\Windows\System\jkSIgmu.exe
  2⤵
  PID:9516
- C:\Windows\System\yHxRsUa.exe
  C:\Windows\System\yHxRsUa.exe
  2⤵
  PID:9536
- C:\Windows\System\QTWxRDM.exe
  C:\Windows\System\QTWxRDM.exe
  2⤵
  PID:9552
- C:\Windows\System\ODolRLU.exe
  C:\Windows\System\ODolRLU.exe
  2⤵
  PID:9568
- C:\Windows\System\wKmvHIM.exe
  C:\Windows\System\wKmvHIM.exe
  2⤵
  PID:9620
- C:\Windows\System\OkyGdcI.exe
  C:\Windows\System\OkyGdcI.exe
  2⤵
  PID:9640
- C:\Windows\System\eOTxbBu.exe
  C:\Windows\System\eOTxbBu.exe
  2⤵
  PID:9656
- C:\Windows\System\EcdDMDe.exe
  C:\Windows\System\EcdDMDe.exe
  2⤵
  PID:9736
- C:\Windows\System\ynTRfIN.exe
  C:\Windows\System\ynTRfIN.exe
  2⤵
  PID:10096
- C:\Windows\System\bXJhvOi.exe
  C:\Windows\System\bXJhvOi.exe
  2⤵
  PID:10144
- C:\Windows\System\pPLprqx.exe
  C:\Windows\System\pPLprqx.exe
  2⤵
  PID:10160
- C:\Windows\System\wdsKzsb.exe
  C:\Windows\System\wdsKzsb.exe
  2⤵
  PID:10176
- C:\Windows\System\muAxWRL.exe
  C:\Windows\System\muAxWRL.exe
  2⤵
  PID:10196
- C:\Windows\System\MTXoBEF.exe
  C:\Windows\System\MTXoBEF.exe
  2⤵
  PID:10212
- C:\Windows\System\OMmzyUM.exe
  C:\Windows\System\OMmzyUM.exe
  2⤵
  PID:10228
- C:\Windows\System\pLHDouO.exe
  C:\Windows\System\pLHDouO.exe
  2⤵
  PID:9228
- C:\Windows\System\JTUBxTv.exe
  C:\Windows\System\JTUBxTv.exe
  2⤵
  PID:8524
- C:\Windows\System\zEXaYoe.exe
  C:\Windows\System\zEXaYoe.exe
  2⤵
  PID:8748
- C:\Windows\System\cjUJGhC.exe
  C:\Windows\System\cjUJGhC.exe
  2⤵
  PID:9292
- C:\Windows\System\FGCXYjR.exe
  C:\Windows\System\FGCXYjR.exe
  2⤵
  PID:9328
- C:\Windows\System\gOryjgN.exe
  C:\Windows\System\gOryjgN.exe
  2⤵
  PID:9308
- C:\Windows\System\gbDOozD.exe
  C:\Windows\System\gbDOozD.exe
  2⤵
  PID:9340
- C:\Windows\System\OwQnRPD.exe
  C:\Windows\System\OwQnRPD.exe
  2⤵
  PID:9440
- C:\Windows\System\vmTcqcW.exe
  C:\Windows\System\vmTcqcW.exe
  2⤵
  PID:9424
- C:\Windows\System\zyxQENG.exe
  C:\Windows\System\zyxQENG.exe
  2⤵
  PID:9452
- C:\Windows\System\LFxIQCh.exe
  C:\Windows\System\LFxIQCh.exe
  2⤵
  PID:9476
- C:\Windows\System\yxqKckB.exe
  C:\Windows\System\yxqKckB.exe
  2⤵
  PID:9548
- C:\Windows\System\EGEjAUz.exe
  C:\Windows\System\EGEjAUz.exe
  2⤵
  PID:9528
- C:\Windows\System\ggGhKyN.exe
  C:\Windows\System\ggGhKyN.exe
  2⤵
  PID:9564
- C:\Windows\System\bDwaahS.exe
  C:\Windows\System\bDwaahS.exe
  2⤵
  PID:9592
- C:\Windows\System\siFcmUJ.exe
  C:\Windows\System\siFcmUJ.exe
  2⤵
  PID:9604
- C:\Windows\System\CCYhQax.exe
  C:\Windows\System\CCYhQax.exe
  2⤵
  PID:9612
- C:\Windows\System\ozNaPXu.exe
  C:\Windows\System\ozNaPXu.exe
  2⤵
  PID:9652
- C:\Windows\System\rjVcrYK.exe
  C:\Windows\System\rjVcrYK.exe
  2⤵
  PID:9676
- C:\Windows\System\ogMVESY.exe
  C:\Windows\System\ogMVESY.exe
  2⤵
  PID:9692
- C:\Windows\System\kDBiUkP.exe
  C:\Windows\System\kDBiUkP.exe
  2⤵
  PID:9732
- C:\Windows\System\IzCLPqy.exe
  C:\Windows\System\IzCLPqy.exe
  2⤵
  PID:9772
- C:\Windows\System\zAbkqYi.exe
  C:\Windows\System\zAbkqYi.exe
  2⤵
  PID:9788
- C:\Windows\System\JKBQyoX.exe
  C:\Windows\System\JKBQyoX.exe
  2⤵
  PID:9800
- C:\Windows\System\GxSwFRO.exe
  C:\Windows\System\GxSwFRO.exe
  2⤵
  PID:9820
- C:\Windows\System\yfKNmxL.exe
  C:\Windows\System\yfKNmxL.exe
  2⤵
  PID:9836
- C:\Windows\System\UKlHcOe.exe
  C:\Windows\System\UKlHcOe.exe
  2⤵
  PID:9856
- C:\Windows\System\XMyXTZs.exe
  C:\Windows\System\XMyXTZs.exe
  2⤵
  PID:9872
- C:\Windows\System\NLceufz.exe
  C:\Windows\System\NLceufz.exe
  2⤵
  PID:9888
- C:\Windows\System\ygnzdTQ.exe
  C:\Windows\System\ygnzdTQ.exe
  2⤵
  PID:9904
- C:\Windows\System\YkiSOOT.exe
  C:\Windows\System\YkiSOOT.exe
  2⤵
  PID:9920
- C:\Windows\System\Ajwvngv.exe
  C:\Windows\System\Ajwvngv.exe
  2⤵
  PID:9944
- C:\Windows\System\GLYkjvL.exe
  C:\Windows\System\GLYkjvL.exe
  2⤵
  PID:9964
- C:\Windows\System\ovLPjxr.exe
  C:\Windows\System\ovLPjxr.exe
  2⤵
  PID:9980
- C:\Windows\System\ZgRcFxf.exe
  C:\Windows\System\ZgRcFxf.exe
  2⤵
  PID:10000
- C:\Windows\System\cYLxyIS.exe
  C:\Windows\System\cYLxyIS.exe
  2⤵
  PID:9924
- C:\Windows\System\obqPBeS.exe
  C:\Windows\System\obqPBeS.exe
  2⤵
  PID:10020
- C:\Windows\System\ALQZQGP.exe
  C:\Windows\System\ALQZQGP.exe
  2⤵
  PID:10040
- C:\Windows\System\HPaCgjg.exe
  C:\Windows\System\HPaCgjg.exe
  2⤵
  PID:10056
- C:\Windows\System\NmQWEYu.exe
  C:\Windows\System\NmQWEYu.exe
  2⤵
  PID:10072
- C:\Windows\System\fVGXTJA.exe
  C:\Windows\System\fVGXTJA.exe
  2⤵
  PID:10028
- C:\Windows\System\iDBxLmg.exe
  C:\Windows\System\iDBxLmg.exe
  2⤵
  PID:10156
- C:\Windows\System\BazEoXn.exe
  C:\Windows\System\BazEoXn.exe
  2⤵
  PID:10220
- C:\Windows\System\vDwUNhr.exe
  C:\Windows\System\vDwUNhr.exe
  2⤵
  PID:9260
- C:\Windows\System\OIHbdWY.exe
  C:\Windows\System\OIHbdWY.exe
  2⤵
  PID:9372
- C:\Windows\System\DaUggBc.exe
  C:\Windows\System\DaUggBc.exe
  2⤵
  PID:10204
- C:\Windows\System\iIdSQoJ.exe
  C:\Windows\System\iIdSQoJ.exe
  2⤵
  PID:9496
- C:\Windows\System\OmqjhJX.exe
  C:\Windows\System\OmqjhJX.exe
  2⤵
  PID:9600
- C:\Windows\System\HbpLMtI.exe
  C:\Windows\System\HbpLMtI.exe
  2⤵
  PID:10236
- C:\Windows\System\OpBTaFX.exe
  C:\Windows\System\OpBTaFX.exe
  2⤵
  PID:10112
- C:\Windows\System\sItWAxJ.exe
  C:\Windows\System\sItWAxJ.exe
  2⤵
  PID:10128
- C:\Windows\System\WMrsEBu.exe
  C:\Windows\System\WMrsEBu.exe
  2⤵
  PID:9636
- C:\Windows\System\nQzJiRt.exe
  C:\Windows\System\nQzJiRt.exe
  2⤵
  PID:9684
- C:\Windows\System\dloaqyQ.exe
  C:\Windows\System\dloaqyQ.exe
  2⤵
  PID:9280
- C:\Windows\System\UWDnGWG.exe
  C:\Windows\System\UWDnGWG.exe
  2⤵
  PID:9436
- C:\Windows\System\XuBeEXd.exe
  C:\Windows\System\XuBeEXd.exe
  2⤵
  PID:9492
- C:\Windows\System\XtSoQXw.exe
  C:\Windows\System\XtSoQXw.exe
  2⤵
  PID:9748
- C:\Windows\System\hITheWm.exe
  C:\Windows\System\hITheWm.exe
  2⤵
  PID:9760
- C:\Windows\System\dOSaMuy.exe
  C:\Windows\System\dOSaMuy.exe
  2⤵
  PID:9808
- C:\Windows\System\jbDivjY.exe
  C:\Windows\System\jbDivjY.exe
  2⤵
  PID:9828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AaFycle.exe

Filesize
1.4MB

MD5
322569a5aa5ef59562daeae537d3b8f6

SHA1
843fcb61b7bb5226573c0dd0b70e414e7f0c0b0a

SHA256
19c0341d4dbdd36bc494c53e5905095298c77564749c71b328c4b1a28c6ffbba

SHA512
6ffa7c916026462db4db3d33d43b094e5cb65162ba9a880bbf8f7b66575b643a171b4e9dfe56946b88b9778ab811d4ae8790cb361234046ba9dc7ec5240cf396

Download Submit
C:\Windows\system\Bfkyazx.exe

Filesize
1.4MB

MD5
22cdeb9a0fed0916d671d76bcb4f0154

SHA1
9258c94fb808e7d8d58fdc364622798af1c5b004

SHA256
62329fa1d2dd3a0238618082713b406a615c045c0896d0609acfa06a5c0a52a2

SHA512
21f9fd65d63b1493ed65d7125c76a4eae26ec79ba3929333e4c26a3eae9fbe71f8084c0cfd8427d17276acdeb4b067730270f6589faa57bab81d770944b3b7a5

Download Submit
C:\Windows\system\BwvIxKw.exe

Filesize
1.4MB

MD5
f8eebfee401f8509ec259ccfdf4af428

SHA1
afadb3c9a34243fcc9f0a0b910db3b4280c948db

SHA256
f9aa274e8ea5efe0182601b25d99364589c037454b4a6b7aada9c88bd62472a0

SHA512
91a4794fdc657a7c8ee1a0ac93fef51ecfe68eea6bfebda970c609694e281dcf79996c1dfd5c6145622f87f5d07979cdda7fe68591c437a2ff5591b9bcb4b6dd

Download Submit
C:\Windows\system\Frkagzx.exe

Filesize
1.4MB

MD5
062136d2d6e7c2d07e27bd90ff23f3c9

SHA1
e4ecf95144fb27fe815c0e3d29f3073ece8493cf

SHA256
fe4b9c36ab59c94f4ea66c6b5e9d134be17fe55b35d14689bac2045bd4bca3f1

SHA512
0c7e08626907b843e5d4f0858e55e56a0a331528b38f46dde30f8534da7f519daea124f80c38476e8889dda9556944b14f9209c61e358959bce25cfcee39a4d1

Download Submit
C:\Windows\system\JMDbVVR.exe

Filesize
1.4MB

MD5
268ec2e9d8b3d7e0c67922dcbcd552af

SHA1
9db89ae0bd6ba7fbdb67889dc76458d399c42187

SHA256
958e49c49fbedb509e6286ca8f4b2adb5b7aafae4ed5e5f23c11d37f7ef13547

SHA512
9c47e9226e7ac0f60f63d8b5afd49bae8c62275706726401686a79a553079104b77c6cf2efd3fe2ce40e624e5ea5ef1b93a86219ce12b4320e138010d86767d5

Download Submit
C:\Windows\system\LOTmDrA.exe

Filesize
1.4MB

MD5
b1e930958b5c9b1380060983505f7bd5

SHA1
25ee10bbff9388a5913a5f4b8e9323ba949676e2

SHA256
0f48caef369c93db69d2ce8ee83216083ca3791095335d59106ed227a7fd7697

SHA512
96b41f86e44dd5650299765bd3f10b0dfd1a191af67d49948b0a9b9c054d5f20e53d3498655c434d335a9b28b41a67762d42a441f53357fe5081c743ce63cff2

Download Submit
C:\Windows\system\PPakvAe.exe

Filesize
1.4MB

MD5
94c1180eb6a5d9eade0a55822e57579a

SHA1
1f8e2d73b7142bb90b7ec1e705f2ae9fc1125f36

SHA256
434b52d11904cc5a67d743ddb4debd28d5fbabda19dbcfb617723f85c14bf35c

SHA512
245b408171764960e3053c9c30a557fbe5c8b6ed7e1345e2c9df00c6a2a7f6a2d3214e629cc4098e47e51390f02722f7bf2fb182fd0b0e35f8582fc4fc7db11b

Download Submit
C:\Windows\system\RmFVino.exe

Filesize
1.4MB

MD5
30688b7ac35758d0398ec559cf16d136

SHA1
a2a4ddad1aef98e837a48a9b0ea99bdb7ddb6adf

SHA256
e22d3ac99bb6536ce382584d6fe1079f6a7b39dbe9c5917863ceca4270487818

SHA512
be8eed09fad9f22e1fac97ee6045ee9850929f466f81a9ec5ae5fe36834f2e49a59ff91ab5322472e2556ee2ea7d8439101d75e6138a56d0b3f3a67f4c83be08

Download Submit
C:\Windows\system\RrRicMV.exe

Filesize
1.4MB

MD5
d4d64bf59b67961c2cb01ae6003e2b59

SHA1
b417d06db40ae9b9f5c07ec2bc632c8c191369bd

SHA256
181dc0c7d7c31e556fde121c7e5fd3b9b98060d22ba2de8a40ee686c7b88a191

SHA512
4d0498c614c2eeb0b91e768426f2f9dddbd73cfc3b0b5ea7650b61a6ec88c2f8ae15a9c54cc866b0e911cae3a0d7e5b96e16fa52e9349c554e5f54020895fc72

Download Submit
C:\Windows\system\RzVvDYN.exe

Filesize
1.4MB

MD5
3c30cf105fe4261575390cc440cc2daa

SHA1
5cfefa0ac13fbe9d6e20df38c2b4105366a01c18

SHA256
cffe7fe27840d1611ea6e10dd16b7bba6fb106ab617dfd5355c868499ffd4e08

SHA512
65aed651a06465e7dc794afc47e03f0f37e796b54d11416fe2a7238c13999acbf2a2598d6865c838f7bada18d27ce204ced89f2902f776cd25b900537f601b68

Download Submit
C:\Windows\system\TySxzPr.exe

Filesize
1.4MB

MD5
845c663938a0ab97b6cd0f95179195e1

SHA1
e125321beb37983fe9b1417195add2eeaacec91b

SHA256
be772d71da6b0fa04286a267d3b09f80af63929a1972df5d2fbaead6a74b76b3

SHA512
f16bdf404ef9c9d6808b4535bfa8433b9003a10e0d0647b5da72e5828e5f4d059797afb001548432be11e8fc3f83d5322b1b5e1815af084fd794473753e1d282

Download Submit
C:\Windows\system\WUmsVvY.exe

Filesize
1.4MB

MD5
196a84b44a900d46f7ee91413e4333f2

SHA1
3020d0578b33733f161f9ea0a791aa858d4911a5

SHA256
fae9ce04d51ee49627c9d012ed6ce282490db5d30823bba29a84215cc3d2202e

SHA512
b0a46c19320d39876b762a3388cd0ce00d50c4e25783b434bb1a91b352b8e411fabc57cd278606e49995eed48e681d3eb170c32486a779279dcfcfb3c41c5aa1

Download Submit
C:\Windows\system\aApWrIF.exe

Filesize
1.4MB

MD5
624a98c55de397a23807e19e7a982022

SHA1
7244962730b47cab457725f09a1ed9c52a25bc05

SHA256
8cf8e0056f942cd7dd690313f46e285d297c0aa75057555e7c99975c6a6614be

SHA512
63351e865729c1042392a0fe5c9e6399cd6d38593ed54042259bb650e0868a6805555b3e1ef90d77ab26831d04dba69646b5bff8b021b7832b6dfda8fcf8f2b0

Download Submit
C:\Windows\system\bNapoZD.exe

Filesize
1.4MB

MD5
dacff0742db92f976c653f2a066c70d1

SHA1
59165ccd5d4e20cfc62f17828b68a2e539f77bb1

SHA256
11e72a7cf53799a9f45361595025e15367552cd56b725a17c04867ceaccc5d7e

SHA512
dfb264e9a818f8e86b43e0cebdae16eac477dfe97d91ffb3ae06846e5c1a9337f0f959189ad428ca75fcbffeb5612a13ee8f9c0e858d289edfd9df04c349b959

Download Submit
C:\Windows\system\eLTmzKO.exe

Filesize
1.4MB

MD5
7f411fecccb32980ee07aa7a34d7c8fe

SHA1
f87fcc0836571f5995789d177216d38b74a0ad60

SHA256
61c1f9af506f03dfbec3416b0ef513972d3bbc29fa116ce60c88f7bdd252ea95

SHA512
3a26ce4bf74c3d1a150c3bdfc3389e93a9147b5f7e4036d36af1397de143fc64e9ee8e473d1c3089cb3ebbf4e3b4b26db4400a418a8badfde46dd844c0645bc8

Download Submit
C:\Windows\system\iOYXGNA.exe

Filesize
1.4MB

MD5
4d9242d223bc772d936895f2776343bc

SHA1
befd8384aa7e8af244439be1ea198236c6332f9d

SHA256
57a90ffeffe61f1c6c0b1d6c49d78242bcab90775e36b87d62a7132023b01620

SHA512
67527d6d649bebc368ad53a08dbffbfd8c46b2e2d0e9be0e2072dc2e2e4c8f75bff0a100dfc15c36d32edc3e411b0b690c8848f93a2aa7efd68a66bfc2ff4ba8

Download Submit
C:\Windows\system\jltyxOy.exe

Filesize
1.4MB

MD5
93c1dd2600e37b43eadaf143f7cd4efb

SHA1
1cb1245e42dd53b416f8ebf73ac382d216da2cbb

SHA256
84fa176b705c51de5c19e41819da98f659154b7ba7dddca44fbe701ad3a4a199

SHA512
512123e15343305b5614f1c788fa6c1c23ece64e41a630ec812971525a5520814d065886bf2b4b5f314950b2b8226808425fd18a46c2c81d191f570be733ae7e

Download Submit
C:\Windows\system\kubtzVR.exe

Filesize
1.4MB

MD5
1ecaeeb498a2a9f8bd8aaa882d455bfa

SHA1
0c49f2bd22c8ae25b103db107f5bc74014799bab

SHA256
dd34f9179352d14a34a42e798155da9711d951fabb16f518cdeaea23a649ab09

SHA512
ca1968f5844534b860c90f5d7dfad1bbe1b19d889f67c057329d36a2409d913c723abfe3f0c7c2c80c8a9b2995b107ffed27161cd7b6d4c72f3996c6f541f495

Download Submit
C:\Windows\system\ngKDOSU.exe

Filesize
1.4MB

MD5
88adb6e1c2cd6b56063dc895ffd7d8a9

SHA1
6f7be6b54afb46e5cb0274f1b09564070e4f823b

SHA256
756e26421c1396d93d79f419fade9b6b52912d4cd47633b1e8abcb7d420f719b

SHA512
93b319e9a333a821fb496484a7a77544b638b3823d2b5330854640e948c055100f8f333afd33edb89894332ced0b449c6b140b94b6612f33aeb527418bc3caaf

Download Submit
C:\Windows\system\oTsstPI.exe

Filesize
1.4MB

MD5
e7a81eb3507e9796e7459d3cfd8399a4

SHA1
4d2f9983db1555b8332cfe6fe6135c382b34245e

SHA256
44ccb7932cba760d5a17de15899df1d2e1b951aeac593181b45287ee7cab2c41

SHA512
1d045ac7063ac9c13fce844705f1bf2ee676bd7a8505181cf84c8f39d9f27d564c726d51710817273befc716b37da16de733b27bec78e76d079269a809c7029c

Download Submit
C:\Windows\system\pRoPUor.exe

Filesize
1.4MB

MD5
4c50058ef7ecad0efd2135f7d85f7aa3

SHA1
872f24796e870e7f656dca44c87aecfd922397bc

SHA256
9a1a8f24bfd1c279408b015b46d8bdb7084e523c6d4aebeaec34abfa8bf6d2a7

SHA512
0fd4f14fb4d6eb548e11f195147cbf556d41fdea1207d174d779492ccefabc028d80d38a5ae693dd36604c5292bcb0814bfd2179a3d13ed8e7423bf80395a7bc

Download Submit
C:\Windows\system\qnorZYg.exe

Filesize
1.4MB

MD5
100f0b935ed5fede98b713f680fc0244

SHA1
d2c5c370d1282c8744d2938db30c8cd9930ff348

SHA256
b6cf3798b84f8aaf739ea99cc200db4a1e14532c3737cfecf7f38bc210c7fcd6

SHA512
df915d8d5ba44c509bf851ab0d61bb0f47ec175cff849d805f6a5e2652e35b6f19c111a3652730dd16d40ebc19a3d7b94c7c859a2b567a7eab3d6fffa21b78a3

Download Submit
C:\Windows\system\sGrnrzW.exe

Filesize
1.4MB

MD5
100c3f43764c564de2036178cb5b2bb6

SHA1
1ede528ca4cdb2a96885aea0419b7377f034bf5f

SHA256
23695069b88070e722aa831daddb6051bd13d80c127fa35bca48dfdc826827df

SHA512
ca198503da98963c42c1f06a2ead8c34924c4c80dced76173759381712e00f320c019fa2ad20415994e75dfb7fffef3d921c4c60c626c5e57ead735eba636923

Download Submit
C:\Windows\system\tRBielx.exe

Filesize
1.4MB

MD5
ce24e2759e4ec0e70fc67904974a8973

SHA1
59a674f39a55e1a0c67d365816146630df0658ef

SHA256
0f5783d94f8108de169b1fe6454a5dbb07796f21d41553def18923eec8a9e72f

SHA512
0b63db2786276042a0fbd0275c93ec45fb0764eff75c6a4d02bf68eb81983430e860e3a35e7de95ed5cf6f874ba0bf40c6d1a81b3d9ad8049b8a84ce7dbc765f

Download Submit
C:\Windows\system\tthsOHN.exe

Filesize
1.4MB

MD5
7310f4d3686dc5800230c297b2003927

SHA1
af0fbb09cc2baa07561ac91e2f10ac228719b95e

SHA256
46c9f984b385317a0449b7e54e11afc031c27c0e3726f7cd3804cb5f31a4f539

SHA512
f2330f386bd9c819d3fe40195b4bdcce11e2269d3aad626603b3aba6aeea0a2e88dea0d267758a7c3dc1eecb1fe3b2dc724ff6f81b10d7819084ec2628e593a9

Download Submit
C:\Windows\system\ttoKrAV.exe

Filesize
1.4MB

MD5
afba25c46f4f64779ccfac3a3cc85aef

SHA1
d16459fcf14c9feaa26a9d77d603190cb4e22d45

SHA256
ee1bf81ff3c4a685866fbe50abb9446fa4bbf83aad1b70bfcbbdcff82ba9061a

SHA512
7eea8917a3963169a8556aaab733d55aa0661a8d6d0ab61d0d1bb2f18f7d1bacb9fb2e7f32fc8ae3ced3ef1909add196bc65e5e13f92b3334f8f14b8b45f7442

Download Submit
C:\Windows\system\vByoLGD.exe

Filesize
1.4MB

MD5
353461e810cd123790c91a31e8140403

SHA1
aa7d29b48dfe07292e3f505fcfe3cdb5974b1d0d

SHA256
654b5db64aecba9af483b7b8bda520d9f09fc20317326f05be8dbb7199b20830

SHA512
21ded90b40b7f08d43b947679b8f599b5f3704e7ae74f3fef29e85d2de78919c92a1fd12f207acde16ee90c97eda7dcabd4ea46e55209796a0cccb8749d49a45

Download Submit
C:\Windows\system\vFAKZNv.exe

Filesize
1.4MB

MD5
f0e6f3d45ee0341a89374af1dacce15c

SHA1
23ed2501d930a23565c331944f3edb504faa091b

SHA256
1fc527d3b1249c92bbd83ff84dff035e02d64c8f8b0e17777829a747a59cbd16

SHA512
c03153f540cd53f4f992c75272724ef4ff71a23721bafb07fa541eff253411edbaf7e0ad5d2f1692a2b06e40fa1285f8b3e04ec8284fd57f0aecc05a2ffe45fa

Download Submit
C:\Windows\system\wNylTPu.exe

Filesize
1.4MB

MD5
4bd69236b47a66803f7d0f95feb94b11

SHA1
d04db881cf487f17968f58f0c60d914372dbafc4

SHA256
e520ffa1fa01754232ae841d3ca9f719b26269b4904d6ee766a8830250083456

SHA512
8632f7e5ebf195e1f8f76fb8888bc6ace27079002b91e1ce6f3efe81fee7c7ab306164b590ae4416821ab49da3f5d9507e4390d59bdbd31bb2547a47221e7943

Download Submit
C:\Windows\system\xkaHYRJ.exe

Filesize
1.4MB

MD5
dda16365e5b642d82bd6699b2a7706bc

SHA1
37fef91498ba9a275194e24f2143e9443b422dd8

SHA256
ddf2e5fdd28fe076bc3b42fa5365d369c786aab182bc2c9e37dd7a15be030d1c

SHA512
2826c3ab2e6c73f91e444ed8cacff6a754c2bb66689e8a311b382c6c754355c374d2d6863f93628a3a91370c9038c0cd3a5fcd365ecc6b63b6dd261bd773f74c

Download Submit
\Windows\system\EBVtVhO.exe

Filesize
1.4MB

MD5
c164bf237eac118e05db0adfa2cd7b93

SHA1
04af607e2448f4c78245f02be63258bf6b96fa5d

SHA256
66930a503480127d6ff58319a52e93f2c5a9d7fd6190937cc5592481a5c82c37

SHA512
43f2192fe6689fe70fef1414709281014f4801c8c38978c9b3d771dbb30d59882283eec568007364f75f4a3ba209248b3c000db65aa295f4c7755bd0e833518b

Download Submit
\Windows\system\IbfqnXu.exe

Filesize
1.4MB

MD5
597532d10c1ad3f46439eb53399b2b29

SHA1
a51f9f3ba10120156f505f38f2a8119f6836faaf

SHA256
2ac761cca98cde254bcb1764e1dd510c1134abcd6d40a42c01ac8229e580728f

SHA512
644fd4458c884b1447534e7c4b2ae989734913471fb5c948c945e0beed602c54aeab6a36b3e47ced4a35019d1ba94f27e1cd847761361ca4bb7af1e82a126d3d

Download Submit
memory/1904-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download