xmrig | 976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
Size

1.5MB
MD5

99b4280651bfd4936332320590b9c624
SHA1

d0f5aa69baf97086c353970a8f6a2d8ef317cde7
SHA256

976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15
SHA512

73f9603b1bb208e6e11b487d83511e6c47a988543f5d4efb30cdf92c3bce4eb85540dc54224575df63473a826f63dbb2fbaccdeb0ec328414e69d1352c248e89
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZUpMiZim:GemTLkNdfE0pZyG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000700000001707c-12.dat	xmrig
behavioral1/files/0x000700000001746a-25.dat	xmrig
behavioral1/files/0x0005000000019268-41.dat	xmrig
behavioral1/files/0x0005000000019275-49.dat	xmrig
behavioral1/files/0x0005000000019278-53.dat	xmrig
behavioral1/files/0x0005000000019319-61.dat	xmrig
behavioral1/files/0x0005000000019387-73.dat	xmrig
behavioral1/files/0x000500000001946a-108.dat	xmrig
behavioral1/files/0x0005000000019485-121.dat	xmrig
behavioral1/files/0x00050000000194df-129.dat	xmrig
behavioral1/files/0x00050000000194d7-125.dat	xmrig
behavioral1/files/0x000500000001947d-117.dat	xmrig
behavioral1/files/0x0005000000019479-113.dat	xmrig
behavioral1/files/0x0005000000019465-103.dat	xmrig
behavioral1/files/0x000500000001945b-101.dat	xmrig
behavioral1/files/0x0005000000019450-97.dat	xmrig
behavioral1/files/0x0005000000019446-93.dat	xmrig
behavioral1/files/0x0005000000019433-89.dat	xmrig
behavioral1/files/0x00050000000193c1-85.dat	xmrig
behavioral1/files/0x00050000000193b3-81.dat	xmrig
behavioral1/files/0x00050000000193a4-77.dat	xmrig
behavioral1/files/0x0005000000019377-69.dat	xmrig
behavioral1/files/0x0005000000019365-65.dat	xmrig
behavioral1/files/0x000500000001929a-57.dat	xmrig
behavioral1/files/0x000500000001926c-45.dat	xmrig
behavioral1/files/0x00080000000174c3-37.dat	xmrig
behavioral1/files/0x00080000000174a6-34.dat	xmrig
behavioral1/files/0x0007000000017488-30.dat	xmrig
behavioral1/files/0x0007000000017403-22.dat	xmrig
behavioral1/files/0x00080000000173f3-18.dat	xmrig
behavioral1/files/0x0008000000016edb-9.dat	xmrig
behavioral1/files/0x0007000000012118-5.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1700	sZvEDrr.exe
2136	ZetWqgY.exe
2052	FUvYMGc.exe
2384	yXKqdYJ.exe
544	jNTvtNB.exe
2708	hfBTiCj.exe
2348	fjiWVfv.exe
2768	zJMagzH.exe
2860	GvUaReU.exe
2844	gonnvMK.exe
2624	bhuzQyT.exe
2732	NTbUNna.exe
2816	TpUaOkP.exe
2832	IsMmXxy.exe
2792	hXHAujB.exe
1748	cCxyoGs.exe
2636	aqfpjNC.exe
2496	BIdVeUT.exe
2336	XoklZjk.exe
3056	IvsoaZy.exe
1284	hhIkmCG.exe
1840	JHOciwY.exe
1348	RkxkAHT.exe
1820	fVotWJK.exe
1996	juXkRGH.exe
2880	lSgTxeS.exe
2020	TMHOhCt.exe
2868	rDWtOUp.exe
1456	vjFwSBa.exe
2808	GZBuDAO.exe
2812	YQPEGQR.exe
2288	sTPaPYS.exe
2232	QUgdDob.exe
2072	AfiGtTh.exe
2304	sIuqAfC.exe
596	IDIpbUw.exe
2484	FxPjAVa.exe
2928	TiVgtpL.exe
448	LqClQOc.exe
304	OMaMLhf.exe
2996	YHOFPst.exe
2992	lNxtlor.exe
820	hUNbYho.exe
1272	yDBBimC.exe
1372	ImFEWOr.exe
1804	tfHRhAw.exe
1204	OgZEIxh.exe
984	EQVAlYE.exe
892	uKfrpIZ.exe
2364	dHnfPwq.exe
1728	vnAbLIQ.exe
344	cDpsTBF.exe
880	VJgClgz.exe
2236	BdbOWrb.exe
784	iTwRxLg.exe
2088	XRJsHfV.exe
2512	XWkyLlP.exe
2980	VKFPCHd.exe
1732	HZPebrx.exe
2344	ljTGqXs.exe
2904	juZNzqt.exe
2820	ahRCCYB.exe
2692	cacBHTr.exe
668	ITDquVW.exe

Loads dropped DLL 64 IoCs

pid	Process
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JfjqfRX.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\MlZumLy.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\sziEIcI.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\zRnnCZF.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\MkJwaXx.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\EbJCDAp.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\FSVStpO.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\zPvlvCq.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\bXnBJbU.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\mRlWcbc.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\vnAbLIQ.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\mTYzAZW.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\ksaweNr.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\zJiJiiV.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\Vbappkh.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\KlubGaz.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\QKheTRc.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\EBVFDsJ.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\znIYQyx.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\nmpIeOI.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\TgQOeSM.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\pnXTwAO.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\Egvgedd.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\SesIdLZ.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\jaSNrve.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\eOGEiKg.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\YowmvsW.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\bqepVBE.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\brBzKXH.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\zsHTOvn.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\LfejXAd.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\CroYGKK.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\JfqiWco.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\yupSXcX.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\bzQPWOa.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\wuYIlwe.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\KmclGFE.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\LuvewdV.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\iXhcIrZ.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\iKxOiLu.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\hjWoeGe.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\BLZzsnr.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\bkBIKmK.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\yDBBimC.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\mIEyQLP.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\MwCTPqp.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\jaWQHYF.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\eellAOO.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\spzOEjT.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\SeLNknM.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\nkEqzUr.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\JrhBkda.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\MgakcRI.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\NExUHcE.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\HsZMPVj.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\UOFHxri.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\dGDuBoN.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\WVfbIsm.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\rDWtOUp.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\dHnfPwq.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\KSKIhcP.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\PZgxFXr.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\uhuExjE.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
File created	C:\Windows\System\VPyxFdH.exe	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1700	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	31
PID 2960 wrote to memory of 1700	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	31
PID 2960 wrote to memory of 1700	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	31
PID 2960 wrote to memory of 2136	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	32
PID 2960 wrote to memory of 2136	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	32
PID 2960 wrote to memory of 2136	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	32
PID 2960 wrote to memory of 2052	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	33
PID 2960 wrote to memory of 2052	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	33
PID 2960 wrote to memory of 2052	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	33
PID 2960 wrote to memory of 2384	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	34
PID 2960 wrote to memory of 2384	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	34
PID 2960 wrote to memory of 2384	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	34
PID 2960 wrote to memory of 544	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	35
PID 2960 wrote to memory of 544	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	35
PID 2960 wrote to memory of 544	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	35
PID 2960 wrote to memory of 2708	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	36
PID 2960 wrote to memory of 2708	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	36
PID 2960 wrote to memory of 2708	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	36
PID 2960 wrote to memory of 2348	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	37
PID 2960 wrote to memory of 2348	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	37
PID 2960 wrote to memory of 2348	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	37
PID 2960 wrote to memory of 2768	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	38
PID 2960 wrote to memory of 2768	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	38
PID 2960 wrote to memory of 2768	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	38
PID 2960 wrote to memory of 2860	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	39
PID 2960 wrote to memory of 2860	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	39
PID 2960 wrote to memory of 2860	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	39
PID 2960 wrote to memory of 2844	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	40
PID 2960 wrote to memory of 2844	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	40
PID 2960 wrote to memory of 2844	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	40
PID 2960 wrote to memory of 2624	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	41
PID 2960 wrote to memory of 2624	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	41
PID 2960 wrote to memory of 2624	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	41
PID 2960 wrote to memory of 2732	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	42
PID 2960 wrote to memory of 2732	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	42
PID 2960 wrote to memory of 2732	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	42
PID 2960 wrote to memory of 2816	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	43
PID 2960 wrote to memory of 2816	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	43
PID 2960 wrote to memory of 2816	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	43
PID 2960 wrote to memory of 2832	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	44
PID 2960 wrote to memory of 2832	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	44
PID 2960 wrote to memory of 2832	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	44
PID 2960 wrote to memory of 2792	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	45
PID 2960 wrote to memory of 2792	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	45
PID 2960 wrote to memory of 2792	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	45
PID 2960 wrote to memory of 1748	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	46
PID 2960 wrote to memory of 1748	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	46
PID 2960 wrote to memory of 1748	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	46
PID 2960 wrote to memory of 2636	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	47
PID 2960 wrote to memory of 2636	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	47
PID 2960 wrote to memory of 2636	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	47
PID 2960 wrote to memory of 2496	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	48
PID 2960 wrote to memory of 2496	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	48
PID 2960 wrote to memory of 2496	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	48
PID 2960 wrote to memory of 2336	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	49
PID 2960 wrote to memory of 2336	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	49
PID 2960 wrote to memory of 2336	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	49
PID 2960 wrote to memory of 3056	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	50
PID 2960 wrote to memory of 3056	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	50
PID 2960 wrote to memory of 3056	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	50
PID 2960 wrote to memory of 1284	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	51
PID 2960 wrote to memory of 1284	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	51
PID 2960 wrote to memory of 1284	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	51
PID 2960 wrote to memory of 1840	2960	976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe	52

C:\Users\Admin\AppData\Local\Temp\976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe
"C:\Users\Admin\AppData\Local\Temp\976ee9c89c017b7c5f9ef5582b1179be6b4693100b5a3555ea91bbb9cf766b15.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System\sZvEDrr.exe
  C:\Windows\System\sZvEDrr.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ZetWqgY.exe
  C:\Windows\System\ZetWqgY.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\FUvYMGc.exe
  C:\Windows\System\FUvYMGc.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\yXKqdYJ.exe
  C:\Windows\System\yXKqdYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\jNTvtNB.exe
  C:\Windows\System\jNTvtNB.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\hfBTiCj.exe
  C:\Windows\System\hfBTiCj.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\fjiWVfv.exe
  C:\Windows\System\fjiWVfv.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\zJMagzH.exe
  C:\Windows\System\zJMagzH.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GvUaReU.exe
  C:\Windows\System\GvUaReU.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\gonnvMK.exe
  C:\Windows\System\gonnvMK.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\bhuzQyT.exe
  C:\Windows\System\bhuzQyT.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NTbUNna.exe
  C:\Windows\System\NTbUNna.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\TpUaOkP.exe
  C:\Windows\System\TpUaOkP.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\IsMmXxy.exe
  C:\Windows\System\IsMmXxy.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\hXHAujB.exe
  C:\Windows\System\hXHAujB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\cCxyoGs.exe
  C:\Windows\System\cCxyoGs.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\aqfpjNC.exe
  C:\Windows\System\aqfpjNC.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\BIdVeUT.exe
  C:\Windows\System\BIdVeUT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\XoklZjk.exe
  C:\Windows\System\XoklZjk.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\IvsoaZy.exe
  C:\Windows\System\IvsoaZy.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\hhIkmCG.exe
  C:\Windows\System\hhIkmCG.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\JHOciwY.exe
  C:\Windows\System\JHOciwY.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\RkxkAHT.exe
  C:\Windows\System\RkxkAHT.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\fVotWJK.exe
  C:\Windows\System\fVotWJK.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\juXkRGH.exe
  C:\Windows\System\juXkRGH.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\TMHOhCt.exe
  C:\Windows\System\TMHOhCt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\lSgTxeS.exe
  C:\Windows\System\lSgTxeS.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\rDWtOUp.exe
  C:\Windows\System\rDWtOUp.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\vjFwSBa.exe
  C:\Windows\System\vjFwSBa.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\GZBuDAO.exe
  C:\Windows\System\GZBuDAO.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\YQPEGQR.exe
  C:\Windows\System\YQPEGQR.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\sTPaPYS.exe
  C:\Windows\System\sTPaPYS.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\QUgdDob.exe
  C:\Windows\System\QUgdDob.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\AfiGtTh.exe
  C:\Windows\System\AfiGtTh.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\sIuqAfC.exe
  C:\Windows\System\sIuqAfC.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IDIpbUw.exe
  C:\Windows\System\IDIpbUw.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\FxPjAVa.exe
  C:\Windows\System\FxPjAVa.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\TiVgtpL.exe
  C:\Windows\System\TiVgtpL.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\LqClQOc.exe
  C:\Windows\System\LqClQOc.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\OMaMLhf.exe
  C:\Windows\System\OMaMLhf.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\YHOFPst.exe
  C:\Windows\System\YHOFPst.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\lNxtlor.exe
  C:\Windows\System\lNxtlor.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\hUNbYho.exe
  C:\Windows\System\hUNbYho.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\yDBBimC.exe
  C:\Windows\System\yDBBimC.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ImFEWOr.exe
  C:\Windows\System\ImFEWOr.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\tfHRhAw.exe
  C:\Windows\System\tfHRhAw.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\OgZEIxh.exe
  C:\Windows\System\OgZEIxh.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\EQVAlYE.exe
  C:\Windows\System\EQVAlYE.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\uKfrpIZ.exe
  C:\Windows\System\uKfrpIZ.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\iTwRxLg.exe
  C:\Windows\System\iTwRxLg.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\dHnfPwq.exe
  C:\Windows\System\dHnfPwq.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\XRJsHfV.exe
  C:\Windows\System\XRJsHfV.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\vnAbLIQ.exe
  C:\Windows\System\vnAbLIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\XWkyLlP.exe
  C:\Windows\System\XWkyLlP.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\cDpsTBF.exe
  C:\Windows\System\cDpsTBF.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\VKFPCHd.exe
  C:\Windows\System\VKFPCHd.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\VJgClgz.exe
  C:\Windows\System\VJgClgz.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\HZPebrx.exe
  C:\Windows\System\HZPebrx.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\BdbOWrb.exe
  C:\Windows\System\BdbOWrb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ljTGqXs.exe
  C:\Windows\System\ljTGqXs.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\juZNzqt.exe
  C:\Windows\System\juZNzqt.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\ahRCCYB.exe
  C:\Windows\System\ahRCCYB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\cacBHTr.exe
  C:\Windows\System\cacBHTr.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ITDquVW.exe
  C:\Windows\System\ITDquVW.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\opDNUaC.exe
  C:\Windows\System\opDNUaC.exe
  2⤵
  PID:2144
- C:\Windows\System\dZFPxiK.exe
  C:\Windows\System\dZFPxiK.exe
  2⤵
  PID:1300
- C:\Windows\System\IFgAGaD.exe
  C:\Windows\System\IFgAGaD.exe
  2⤵
  PID:1388
- C:\Windows\System\CRQpKdW.exe
  C:\Windows\System\CRQpKdW.exe
  2⤵
  PID:1276
- C:\Windows\System\blgLwDU.exe
  C:\Windows\System\blgLwDU.exe
  2⤵
  PID:2240
- C:\Windows\System\ZfPEBBx.exe
  C:\Windows\System\ZfPEBBx.exe
  2⤵
  PID:2068
- C:\Windows\System\YtiaXBm.exe
  C:\Windows\System\YtiaXBm.exe
  2⤵
  PID:2264
- C:\Windows\System\VtEoXIz.exe
  C:\Windows\System\VtEoXIz.exe
  2⤵
  PID:1936
- C:\Windows\System\ImjTCjV.exe
  C:\Windows\System\ImjTCjV.exe
  2⤵
  PID:1048
- C:\Windows\System\UUxpYEj.exe
  C:\Windows\System\UUxpYEj.exe
  2⤵
  PID:376
- C:\Windows\System\DOGvpvn.exe
  C:\Windows\System\DOGvpvn.exe
  2⤵
  PID:2584
- C:\Windows\System\QBErLgH.exe
  C:\Windows\System\QBErLgH.exe
  2⤵
  PID:1308
- C:\Windows\System\vgcxkDe.exe
  C:\Windows\System\vgcxkDe.exe
  2⤵
  PID:1340
- C:\Windows\System\cOknpzF.exe
  C:\Windows\System\cOknpzF.exe
  2⤵
  PID:1052
- C:\Windows\System\GyXAWoZ.exe
  C:\Windows\System\GyXAWoZ.exe
  2⤵
  PID:2252
- C:\Windows\System\mosDtTv.exe
  C:\Windows\System\mosDtTv.exe
  2⤵
  PID:1072
- C:\Windows\System\stKIPOM.exe
  C:\Windows\System\stKIPOM.exe
  2⤵
  PID:2116
- C:\Windows\System\zhcMkad.exe
  C:\Windows\System\zhcMkad.exe
  2⤵
  PID:804
- C:\Windows\System\yUaVXxF.exe
  C:\Windows\System\yUaVXxF.exe
  2⤵
  PID:888
- C:\Windows\System\sziEIcI.exe
  C:\Windows\System\sziEIcI.exe
  2⤵
  PID:1800
- C:\Windows\System\aGsRzzd.exe
  C:\Windows\System\aGsRzzd.exe
  2⤵
  PID:592
- C:\Windows\System\burATMy.exe
  C:\Windows\System\burATMy.exe
  2⤵
  PID:536
- C:\Windows\System\xuRsxha.exe
  C:\Windows\System\xuRsxha.exe
  2⤵
  PID:2540
- C:\Windows\System\LjQdQTS.exe
  C:\Windows\System\LjQdQTS.exe
  2⤵
  PID:636
- C:\Windows\System\Alpuxhd.exe
  C:\Windows\System\Alpuxhd.exe
  2⤵
  PID:2080
- C:\Windows\System\zOBamzT.exe
  C:\Windows\System\zOBamzT.exe
  2⤵
  PID:1592
- C:\Windows\System\QZBaaIr.exe
  C:\Windows\System\QZBaaIr.exe
  2⤵
  PID:1708
- C:\Windows\System\ddnNAra.exe
  C:\Windows\System\ddnNAra.exe
  2⤵
  PID:2984
- C:\Windows\System\qDlonXU.exe
  C:\Windows\System\qDlonXU.exe
  2⤵
  PID:2940
- C:\Windows\System\hjZHgIO.exe
  C:\Windows\System\hjZHgIO.exe
  2⤵
  PID:2176
- C:\Windows\System\yqqDkvI.exe
  C:\Windows\System\yqqDkvI.exe
  2⤵
  PID:580
- C:\Windows\System\bmIiuov.exe
  C:\Windows\System\bmIiuov.exe
  2⤵
  PID:1684
- C:\Windows\System\RzMyHZv.exe
  C:\Windows\System\RzMyHZv.exe
  2⤵
  PID:2040
- C:\Windows\System\nQOcPMJ.exe
  C:\Windows\System\nQOcPMJ.exe
  2⤵
  PID:1636
- C:\Windows\System\lWjUJoL.exe
  C:\Windows\System\lWjUJoL.exe
  2⤵
  PID:2452
- C:\Windows\System\ZiVwWWh.exe
  C:\Windows\System\ZiVwWWh.exe
  2⤵
  PID:3068
- C:\Windows\System\VpXzNDh.exe
  C:\Windows\System\VpXzNDh.exe
  2⤵
  PID:2220
- C:\Windows\System\wGXWuBx.exe
  C:\Windows\System\wGXWuBx.exe
  2⤵
  PID:3092
- C:\Windows\System\IaIQCwt.exe
  C:\Windows\System\IaIQCwt.exe
  2⤵
  PID:3112
- C:\Windows\System\zRnnCZF.exe
  C:\Windows\System\zRnnCZF.exe
  2⤵
  PID:3132
- C:\Windows\System\CAWxsPx.exe
  C:\Windows\System\CAWxsPx.exe
  2⤵
  PID:3152
- C:\Windows\System\JACKvQb.exe
  C:\Windows\System\JACKvQb.exe
  2⤵
  PID:3172
- C:\Windows\System\RPEjvCs.exe
  C:\Windows\System\RPEjvCs.exe
  2⤵
  PID:3192
- C:\Windows\System\xXQzhxh.exe
  C:\Windows\System\xXQzhxh.exe
  2⤵
  PID:3212
- C:\Windows\System\DieskOs.exe
  C:\Windows\System\DieskOs.exe
  2⤵
  PID:3232
- C:\Windows\System\ZnkRrdS.exe
  C:\Windows\System\ZnkRrdS.exe
  2⤵
  PID:3252
- C:\Windows\System\MkJwaXx.exe
  C:\Windows\System\MkJwaXx.exe
  2⤵
  PID:3272
- C:\Windows\System\OOqrvBa.exe
  C:\Windows\System\OOqrvBa.exe
  2⤵
  PID:3292
- C:\Windows\System\lMiXTDE.exe
  C:\Windows\System\lMiXTDE.exe
  2⤵
  PID:3308
- C:\Windows\System\fVMFOrw.exe
  C:\Windows\System\fVMFOrw.exe
  2⤵
  PID:3328
- C:\Windows\System\eIRFgTp.exe
  C:\Windows\System\eIRFgTp.exe
  2⤵
  PID:3352
- C:\Windows\System\QZjlTEc.exe
  C:\Windows\System\QZjlTEc.exe
  2⤵
  PID:3372
- C:\Windows\System\wHzzqWO.exe
  C:\Windows\System\wHzzqWO.exe
  2⤵
  PID:3388
- C:\Windows\System\CNBXqSB.exe
  C:\Windows\System\CNBXqSB.exe
  2⤵
  PID:3408
- C:\Windows\System\XnrbBNr.exe
  C:\Windows\System\XnrbBNr.exe
  2⤵
  PID:3432
- C:\Windows\System\HtuwkXz.exe
  C:\Windows\System\HtuwkXz.exe
  2⤵
  PID:3448
- C:\Windows\System\hKYeqGM.exe
  C:\Windows\System\hKYeqGM.exe
  2⤵
  PID:3472
- C:\Windows\System\aGBaJNH.exe
  C:\Windows\System\aGBaJNH.exe
  2⤵
  PID:3488
- C:\Windows\System\VPyxFdH.exe
  C:\Windows\System\VPyxFdH.exe
  2⤵
  PID:3508
- C:\Windows\System\iCqQABz.exe
  C:\Windows\System\iCqQABz.exe
  2⤵
  PID:3528
- C:\Windows\System\QAVDvWF.exe
  C:\Windows\System\QAVDvWF.exe
  2⤵
  PID:3548
- C:\Windows\System\AeuuHIQ.exe
  C:\Windows\System\AeuuHIQ.exe
  2⤵
  PID:3568
- C:\Windows\System\kgrMbTr.exe
  C:\Windows\System\kgrMbTr.exe
  2⤵
  PID:3592
- C:\Windows\System\bpCzaZf.exe
  C:\Windows\System\bpCzaZf.exe
  2⤵
  PID:3608
- C:\Windows\System\PcPeHkX.exe
  C:\Windows\System\PcPeHkX.exe
  2⤵
  PID:3628
- C:\Windows\System\KPCDLVQ.exe
  C:\Windows\System\KPCDLVQ.exe
  2⤵
  PID:3648
- C:\Windows\System\PYZEaKO.exe
  C:\Windows\System\PYZEaKO.exe
  2⤵
  PID:3672
- C:\Windows\System\BotFszA.exe
  C:\Windows\System\BotFszA.exe
  2⤵
  PID:3692
- C:\Windows\System\IgfqipQ.exe
  C:\Windows\System\IgfqipQ.exe
  2⤵
  PID:3712
- C:\Windows\System\YnpGEJE.exe
  C:\Windows\System\YnpGEJE.exe
  2⤵
  PID:3728
- C:\Windows\System\HgWjRyi.exe
  C:\Windows\System\HgWjRyi.exe
  2⤵
  PID:3748
- C:\Windows\System\okOtVSM.exe
  C:\Windows\System\okOtVSM.exe
  2⤵
  PID:3768
- C:\Windows\System\pJNOMBs.exe
  C:\Windows\System\pJNOMBs.exe
  2⤵
  PID:3788
- C:\Windows\System\ECVOQcY.exe
  C:\Windows\System\ECVOQcY.exe
  2⤵
  PID:3812
- C:\Windows\System\fJkfVEi.exe
  C:\Windows\System\fJkfVEi.exe
  2⤵
  PID:3828
- C:\Windows\System\eCxkGuR.exe
  C:\Windows\System\eCxkGuR.exe
  2⤵
  PID:3848
- C:\Windows\System\wBHHRtR.exe
  C:\Windows\System\wBHHRtR.exe
  2⤵
  PID:3868
- C:\Windows\System\ssrmEMT.exe
  C:\Windows\System\ssrmEMT.exe
  2⤵
  PID:3888
- C:\Windows\System\Nqrdqgh.exe
  C:\Windows\System\Nqrdqgh.exe
  2⤵
  PID:3908
- C:\Windows\System\EFEasIt.exe
  C:\Windows\System\EFEasIt.exe
  2⤵
  PID:3924
- C:\Windows\System\FcllXWt.exe
  C:\Windows\System\FcllXWt.exe
  2⤵
  PID:3944
- C:\Windows\System\uooBwpX.exe
  C:\Windows\System\uooBwpX.exe
  2⤵
  PID:3964
- C:\Windows\System\NbVkwPC.exe
  C:\Windows\System\NbVkwPC.exe
  2⤵
  PID:3984
- C:\Windows\System\PvQttuc.exe
  C:\Windows\System\PvQttuc.exe
  2⤵
  PID:4000
- C:\Windows\System\UtdojwP.exe
  C:\Windows\System\UtdojwP.exe
  2⤵
  PID:4024
- C:\Windows\System\PlkBFal.exe
  C:\Windows\System\PlkBFal.exe
  2⤵
  PID:4040
- C:\Windows\System\nkEqzUr.exe
  C:\Windows\System\nkEqzUr.exe
  2⤵
  PID:4068
- C:\Windows\System\VrdMtpi.exe
  C:\Windows\System\VrdMtpi.exe
  2⤵
  PID:4088
- C:\Windows\System\zQTZfGA.exe
  C:\Windows\System\zQTZfGA.exe
  2⤵
  PID:2392
- C:\Windows\System\eipCWsI.exe
  C:\Windows\System\eipCWsI.exe
  2⤵
  PID:940
- C:\Windows\System\nrPpqaj.exe
  C:\Windows\System\nrPpqaj.exe
  2⤵
  PID:1712
- C:\Windows\System\BKgfaQw.exe
  C:\Windows\System\BKgfaQw.exe
  2⤵
  PID:1380
- C:\Windows\System\deGwOGT.exe
  C:\Windows\System\deGwOGT.exe
  2⤵
  PID:2168
- C:\Windows\System\XNYmSbn.exe
  C:\Windows\System\XNYmSbn.exe
  2⤵
  PID:616
- C:\Windows\System\StZHTbA.exe
  C:\Windows\System\StZHTbA.exe
  2⤵
  PID:612
- C:\Windows\System\LfejXAd.exe
  C:\Windows\System\LfejXAd.exe
  2⤵
  PID:1376
- C:\Windows\System\qvfAbcl.exe
  C:\Windows\System\qvfAbcl.exe
  2⤵
  PID:2172
- C:\Windows\System\KaQWsgx.exe
  C:\Windows\System\KaQWsgx.exe
  2⤵
  PID:1584
- C:\Windows\System\jKWxVeM.exe
  C:\Windows\System\jKWxVeM.exe
  2⤵
  PID:2184
- C:\Windows\System\yIKNedg.exe
  C:\Windows\System\yIKNedg.exe
  2⤵
  PID:2716
- C:\Windows\System\WeppURo.exe
  C:\Windows\System\WeppURo.exe
  2⤵
  PID:1364
- C:\Windows\System\wyNAMPm.exe
  C:\Windows\System\wyNAMPm.exe
  2⤵
  PID:816
- C:\Windows\System\GOtQJUs.exe
  C:\Windows\System\GOtQJUs.exe
  2⤵
  PID:1992
- C:\Windows\System\ApGKXlT.exe
  C:\Windows\System\ApGKXlT.exe
  2⤵
  PID:1656
- C:\Windows\System\KRKaDFP.exe
  C:\Windows\System\KRKaDFP.exe
  2⤵
  PID:1772
- C:\Windows\System\qtgTgBI.exe
  C:\Windows\System\qtgTgBI.exe
  2⤵
  PID:3124
- C:\Windows\System\SVlSwcr.exe
  C:\Windows\System\SVlSwcr.exe
  2⤵
  PID:3144
- C:\Windows\System\KajDUTq.exe
  C:\Windows\System\KajDUTq.exe
  2⤵
  PID:3180
- C:\Windows\System\uhJvATg.exe
  C:\Windows\System\uhJvATg.exe
  2⤵
  PID:3220
- C:\Windows\System\YgJqWIe.exe
  C:\Windows\System\YgJqWIe.exe
  2⤵
  PID:3244
- C:\Windows\System\wDJRhXC.exe
  C:\Windows\System\wDJRhXC.exe
  2⤵
  PID:3284
- C:\Windows\System\dxBGQWA.exe
  C:\Windows\System\dxBGQWA.exe
  2⤵
  PID:3300
- C:\Windows\System\TbkESfd.exe
  C:\Windows\System\TbkESfd.exe
  2⤵
  PID:3344
- C:\Windows\System\EpRESUL.exe
  C:\Windows\System\EpRESUL.exe
  2⤵
  PID:3396
- C:\Windows\System\sUlqUnA.exe
  C:\Windows\System\sUlqUnA.exe
  2⤵
  PID:3416
- C:\Windows\System\oBtOjbU.exe
  C:\Windows\System\oBtOjbU.exe
  2⤵
  PID:3444
- C:\Windows\System\yNLnrLs.exe
  C:\Windows\System\yNLnrLs.exe
  2⤵
  PID:3460
- C:\Windows\System\XMSBCZx.exe
  C:\Windows\System\XMSBCZx.exe
  2⤵
  PID:3556
- C:\Windows\System\BIAvPQa.exe
  C:\Windows\System\BIAvPQa.exe
  2⤵
  PID:3600
- C:\Windows\System\PqYhEGh.exe
  C:\Windows\System\PqYhEGh.exe
  2⤵
  PID:3544
- C:\Windows\System\ILTkTye.exe
  C:\Windows\System\ILTkTye.exe
  2⤵
  PID:3644
- C:\Windows\System\eyItuWI.exe
  C:\Windows\System\eyItuWI.exe
  2⤵
  PID:3688
- C:\Windows\System\VgTfJvv.exe
  C:\Windows\System\VgTfJvv.exe
  2⤵
  PID:3664
- C:\Windows\System\uGRgOBx.exe
  C:\Windows\System\uGRgOBx.exe
  2⤵
  PID:3764
- C:\Windows\System\tcscVru.exe
  C:\Windows\System\tcscVru.exe
  2⤵
  PID:3704
- C:\Windows\System\ySrTJZQ.exe
  C:\Windows\System\ySrTJZQ.exe
  2⤵
  PID:3840
- C:\Windows\System\CHZxgtk.exe
  C:\Windows\System\CHZxgtk.exe
  2⤵
  PID:3776
- C:\Windows\System\vFUGAhA.exe
  C:\Windows\System\vFUGAhA.exe
  2⤵
  PID:3876
- C:\Windows\System\RkGZRsh.exe
  C:\Windows\System\RkGZRsh.exe
  2⤵
  PID:3952
- C:\Windows\System\fytivzR.exe
  C:\Windows\System\fytivzR.exe
  2⤵
  PID:3856
- C:\Windows\System\HVteFOx.exe
  C:\Windows\System\HVteFOx.exe
  2⤵
  PID:4032
- C:\Windows\System\vXSKaEY.exe
  C:\Windows\System\vXSKaEY.exe
  2⤵
  PID:4084
- C:\Windows\System\FsUIPML.exe
  C:\Windows\System\FsUIPML.exe
  2⤵
  PID:4016
- C:\Windows\System\prrZcwe.exe
  C:\Windows\System\prrZcwe.exe
  2⤵
  PID:4012
- C:\Windows\System\lyVaJVo.exe
  C:\Windows\System\lyVaJVo.exe
  2⤵
  PID:2204
- C:\Windows\System\ccyqpQX.exe
  C:\Windows\System\ccyqpQX.exe
  2⤵
  PID:372
- C:\Windows\System\wUeubGx.exe
  C:\Windows\System\wUeubGx.exe
  2⤵
  PID:288
- C:\Windows\System\uuqVrpU.exe
  C:\Windows\System\uuqVrpU.exe
  2⤵
  PID:2424
- C:\Windows\System\FaryLBt.exe
  C:\Windows\System\FaryLBt.exe
  2⤵
  PID:2964
- C:\Windows\System\DoGeKrd.exe
  C:\Windows\System\DoGeKrd.exe
  2⤵
  PID:1528
- C:\Windows\System\qhKcYob.exe
  C:\Windows\System\qhKcYob.exe
  2⤵
  PID:1588
- C:\Windows\System\pOadXSB.exe
  C:\Windows\System\pOadXSB.exe
  2⤵
  PID:1940
- C:\Windows\System\SZWbfZv.exe
  C:\Windows\System\SZWbfZv.exe
  2⤵
  PID:2104
- C:\Windows\System\DDiwSNj.exe
  C:\Windows\System\DDiwSNj.exe
  2⤵
  PID:3120
- C:\Windows\System\kCjrAfu.exe
  C:\Windows\System\kCjrAfu.exe
  2⤵
  PID:3164
- C:\Windows\System\pNSaDgI.exe
  C:\Windows\System\pNSaDgI.exe
  2⤵
  PID:3088
- C:\Windows\System\NjSeYxH.exe
  C:\Windows\System\NjSeYxH.exe
  2⤵
  PID:3108
- C:\Windows\System\oTuYUDF.exe
  C:\Windows\System\oTuYUDF.exe
  2⤵
  PID:3320
- C:\Windows\System\nudnZWt.exe
  C:\Windows\System\nudnZWt.exe
  2⤵
  PID:3420
- C:\Windows\System\WAEsfPx.exe
  C:\Windows\System\WAEsfPx.exe
  2⤵
  PID:3184
- C:\Windows\System\kmQElpx.exe
  C:\Windows\System\kmQElpx.exe
  2⤵
  PID:3268
- C:\Windows\System\mRFqcrS.exe
  C:\Windows\System\mRFqcrS.exe
  2⤵
  PID:3368
- C:\Windows\System\JrhBkda.exe
  C:\Windows\System\JrhBkda.exe
  2⤵
  PID:3536
- C:\Windows\System\KVzcYiS.exe
  C:\Windows\System\KVzcYiS.exe
  2⤵
  PID:3684
- C:\Windows\System\saaKsdD.exe
  C:\Windows\System\saaKsdD.exe
  2⤵
  PID:3524
- C:\Windows\System\dIwZJvw.exe
  C:\Windows\System\dIwZJvw.exe
  2⤵
  PID:3756
- C:\Windows\System\tfSfEVR.exe
  C:\Windows\System\tfSfEVR.exe
  2⤵
  PID:3516
- C:\Windows\System\YIGmEcC.exe
  C:\Windows\System\YIGmEcC.exe
  2⤵
  PID:3804
- C:\Windows\System\anjQGau.exe
  C:\Windows\System\anjQGau.exe
  2⤵
  PID:3820
- C:\Windows\System\zeOSeIG.exe
  C:\Windows\System\zeOSeIG.exe
  2⤵
  PID:3668
- C:\Windows\System\cbCHhxU.exe
  C:\Windows\System\cbCHhxU.exe
  2⤵
  PID:3796
- C:\Windows\System\lLYqYpg.exe
  C:\Windows\System\lLYqYpg.exe
  2⤵
  PID:3780
- C:\Windows\System\lAyFXAw.exe
  C:\Windows\System\lAyFXAw.exe
  2⤵
  PID:3960
- C:\Windows\System\offCXbN.exe
  C:\Windows\System\offCXbN.exe
  2⤵
  PID:2400
- C:\Windows\System\wGlyKof.exe
  C:\Windows\System\wGlyKof.exe
  2⤵
  PID:1244
- C:\Windows\System\eOGEiKg.exe
  C:\Windows\System\eOGEiKg.exe
  2⤵
  PID:1776
- C:\Windows\System\gvKhMWt.exe
  C:\Windows\System\gvKhMWt.exe
  2⤵
  PID:3080
- C:\Windows\System\CnHkbpJ.exe
  C:\Windows\System\CnHkbpJ.exe
  2⤵
  PID:3140
- C:\Windows\System\sKtNmsv.exe
  C:\Windows\System\sKtNmsv.exe
  2⤵
  PID:1028
- C:\Windows\System\rUsKwBw.exe
  C:\Windows\System\rUsKwBw.exe
  2⤵
  PID:3032
- C:\Windows\System\DqPVYpa.exe
  C:\Windows\System\DqPVYpa.exe
  2⤵
  PID:3020
- C:\Windows\System\myJnkyx.exe
  C:\Windows\System\myJnkyx.exe
  2⤵
  PID:2096
- C:\Windows\System\OCSSmQg.exe
  C:\Windows\System\OCSSmQg.exe
  2⤵
  PID:2916
- C:\Windows\System\FwJoBFU.exe
  C:\Windows\System\FwJoBFU.exe
  2⤵
  PID:3468
- C:\Windows\System\znIYQyx.exe
  C:\Windows\System\znIYQyx.exe
  2⤵
  PID:2276
- C:\Windows\System\IHikwcm.exe
  C:\Windows\System\IHikwcm.exe
  2⤵
  PID:2612
- C:\Windows\System\Emuqlyg.exe
  C:\Windows\System\Emuqlyg.exe
  2⤵
  PID:3636
- C:\Windows\System\mTYzAZW.exe
  C:\Windows\System\mTYzAZW.exe
  2⤵
  PID:3504
- C:\Windows\System\yqnVDTb.exe
  C:\Windows\System\yqnVDTb.exe
  2⤵
  PID:2764
- C:\Windows\System\KFvlgAi.exe
  C:\Windows\System\KFvlgAi.exe
  2⤵
  PID:3364
- C:\Windows\System\ddRlKBy.exe
  C:\Windows\System\ddRlKBy.exe
  2⤵
  PID:3784
- C:\Windows\System\vTKDDCK.exe
  C:\Windows\System\vTKDDCK.exe
  2⤵
  PID:3976
- C:\Windows\System\BwCxusv.exe
  C:\Windows\System\BwCxusv.exe
  2⤵
  PID:3996
- C:\Windows\System\zVsJOOC.exe
  C:\Windows\System\zVsJOOC.exe
  2⤵
  PID:3916
- C:\Windows\System\hoDzFYa.exe
  C:\Windows\System\hoDzFYa.exe
  2⤵
  PID:1760
- C:\Windows\System\XUkPObp.exe
  C:\Windows\System\XUkPObp.exe
  2⤵
  PID:1768
- C:\Windows\System\Vndkleb.exe
  C:\Windows\System\Vndkleb.exe
  2⤵
  PID:988
- C:\Windows\System\JurdlrP.exe
  C:\Windows\System\JurdlrP.exe
  2⤵
  PID:3280
- C:\Windows\System\XyQkHMx.exe
  C:\Windows\System\XyQkHMx.exe
  2⤵
  PID:1200
- C:\Windows\System\xenSftK.exe
  C:\Windows\System\xenSftK.exe
  2⤵
  PID:3440
- C:\Windows\System\uynWOtS.exe
  C:\Windows\System\uynWOtS.exe
  2⤵
  PID:1080
- C:\Windows\System\HnbRlxd.exe
  C:\Windows\System\HnbRlxd.exe
  2⤵
  PID:2680
- C:\Windows\System\NwpUVaR.exe
  C:\Windows\System\NwpUVaR.exe
  2⤵
  PID:3336
- C:\Windows\System\JApImCu.exe
  C:\Windows\System\JApImCu.exe
  2⤵
  PID:3616
- C:\Windows\System\joxkWyT.exe
  C:\Windows\System\joxkWyT.exe
  2⤵
  PID:2712
- C:\Windows\System\HOWkRmt.exe
  C:\Windows\System\HOWkRmt.exe
  2⤵
  PID:2212
- C:\Windows\System\nLjJGaC.exe
  C:\Windows\System\nLjJGaC.exe
  2⤵
  PID:3736
- C:\Windows\System\hbUdldc.exe
  C:\Windows\System\hbUdldc.exe
  2⤵
  PID:2684
- C:\Windows\System\CMcpMuf.exe
  C:\Windows\System\CMcpMuf.exe
  2⤵
  PID:3288
- C:\Windows\System\EzgRgSn.exe
  C:\Windows\System\EzgRgSn.exe
  2⤵
  PID:1944
- C:\Windows\System\ijrnGsP.exe
  C:\Windows\System\ijrnGsP.exe
  2⤵
  PID:1316
- C:\Windows\System\XUxMDFM.exe
  C:\Windows\System\XUxMDFM.exe
  2⤵
  PID:2900
- C:\Windows\System\qlQnsvU.exe
  C:\Windows\System\qlQnsvU.exe
  2⤵
  PID:2952
- C:\Windows\System\CGiVmNG.exe
  C:\Windows\System\CGiVmNG.exe
  2⤵
  PID:2972
- C:\Windows\System\IfQlGLp.exe
  C:\Windows\System\IfQlGLp.exe
  2⤵
  PID:584
- C:\Windows\System\OJUCqmK.exe
  C:\Windows\System\OJUCqmK.exe
  2⤵
  PID:2672
- C:\Windows\System\bZxppND.exe
  C:\Windows\System\bZxppND.exe
  2⤵
  PID:3808
- C:\Windows\System\DgpenCV.exe
  C:\Windows\System\DgpenCV.exe
  2⤵
  PID:1812
- C:\Windows\System\yttuyTe.exe
  C:\Windows\System\yttuyTe.exe
  2⤵
  PID:2620
- C:\Windows\System\RoCeBSx.exe
  C:\Windows\System\RoCeBSx.exe
  2⤵
  PID:3204
- C:\Windows\System\eCcgWXv.exe
  C:\Windows\System\eCcgWXv.exe
  2⤵
  PID:1152
- C:\Windows\System\wjPzbBE.exe
  C:\Windows\System\wjPzbBE.exe
  2⤵
  PID:1716
- C:\Windows\System\milVCrH.exe
  C:\Windows\System\milVCrH.exe
  2⤵
  PID:2628
- C:\Windows\System\fjsrmhD.exe
  C:\Windows\System\fjsrmhD.exe
  2⤵
  PID:3656
- C:\Windows\System\vdOAQJR.exe
  C:\Windows\System\vdOAQJR.exe
  2⤵
  PID:2268
- C:\Windows\System\FCFcKxx.exe
  C:\Windows\System\FCFcKxx.exe
  2⤵
  PID:2156
- C:\Windows\System\NCyKbms.exe
  C:\Windows\System\NCyKbms.exe
  2⤵
  PID:2936
- C:\Windows\System\jWuWgTu.exe
  C:\Windows\System\jWuWgTu.exe
  2⤵
  PID:660
- C:\Windows\System\BQQzwPK.exe
  C:\Windows\System\BQQzwPK.exe
  2⤵
  PID:1744
- C:\Windows\System\LiIkYIG.exe
  C:\Windows\System\LiIkYIG.exe
  2⤵
  PID:3560
- C:\Windows\System\hDGxtwD.exe
  C:\Windows\System\hDGxtwD.exe
  2⤵
  PID:2956
- C:\Windows\System\zStLXKP.exe
  C:\Windows\System\zStLXKP.exe
  2⤵
  PID:3324
- C:\Windows\System\ICZniHp.exe
  C:\Windows\System\ICZniHp.exe
  2⤵
  PID:1792
- C:\Windows\System\XPAYhMu.exe
  C:\Windows\System\XPAYhMu.exe
  2⤵
  PID:2888
- C:\Windows\System\ajNQGYJ.exe
  C:\Windows\System\ajNQGYJ.exe
  2⤵
  PID:3680
- C:\Windows\System\NtRKmeX.exe
  C:\Windows\System\NtRKmeX.exe
  2⤵
  PID:2944
- C:\Windows\System\zcwkgiR.exe
  C:\Windows\System\zcwkgiR.exe
  2⤵
  PID:1524
- C:\Windows\System\STDFQnz.exe
  C:\Windows\System\STDFQnz.exe
  2⤵
  PID:2604
- C:\Windows\System\WQCHzXG.exe
  C:\Windows\System\WQCHzXG.exe
  2⤵
  PID:1392
- C:\Windows\System\byDhKUA.exe
  C:\Windows\System\byDhKUA.exe
  2⤵
  PID:4100
- C:\Windows\System\sjbLtaz.exe
  C:\Windows\System\sjbLtaz.exe
  2⤵
  PID:4116
- C:\Windows\System\ZaBJKte.exe
  C:\Windows\System\ZaBJKte.exe
  2⤵
  PID:4136
- C:\Windows\System\FfYFtGQ.exe
  C:\Windows\System\FfYFtGQ.exe
  2⤵
  PID:4152
- C:\Windows\System\lNyQKOr.exe
  C:\Windows\System\lNyQKOr.exe
  2⤵
  PID:4168
- C:\Windows\System\CQmCyyw.exe
  C:\Windows\System\CQmCyyw.exe
  2⤵
  PID:4188
- C:\Windows\System\Jyvxpwp.exe
  C:\Windows\System\Jyvxpwp.exe
  2⤵
  PID:4204
- C:\Windows\System\jEksLdg.exe
  C:\Windows\System\jEksLdg.exe
  2⤵
  PID:4224
- C:\Windows\System\gYZTtFL.exe
  C:\Windows\System\gYZTtFL.exe
  2⤵
  PID:4240
- C:\Windows\System\FXrLESa.exe
  C:\Windows\System\FXrLESa.exe
  2⤵
  PID:4260
- C:\Windows\System\MDoZGRk.exe
  C:\Windows\System\MDoZGRk.exe
  2⤵
  PID:4276
- C:\Windows\System\rpEChTI.exe
  C:\Windows\System\rpEChTI.exe
  2⤵
  PID:4296
- C:\Windows\System\QIJMFlx.exe
  C:\Windows\System\QIJMFlx.exe
  2⤵
  PID:4312
- C:\Windows\System\llaQVsh.exe
  C:\Windows\System\llaQVsh.exe
  2⤵
  PID:4332
- C:\Windows\System\XhAtREO.exe
  C:\Windows\System\XhAtREO.exe
  2⤵
  PID:4348
- C:\Windows\System\BLJetGj.exe
  C:\Windows\System\BLJetGj.exe
  2⤵
  PID:4368
- C:\Windows\System\mTyIEqF.exe
  C:\Windows\System\mTyIEqF.exe
  2⤵
  PID:4384
- C:\Windows\System\zxWzpPa.exe
  C:\Windows\System\zxWzpPa.exe
  2⤵
  PID:4400
- C:\Windows\System\wnFTnTo.exe
  C:\Windows\System\wnFTnTo.exe
  2⤵
  PID:4416
- C:\Windows\System\FtuvYsg.exe
  C:\Windows\System\FtuvYsg.exe
  2⤵
  PID:4432
- C:\Windows\System\kvOQvdN.exe
  C:\Windows\System\kvOQvdN.exe
  2⤵
  PID:4448
- C:\Windows\System\yjBUjEW.exe
  C:\Windows\System\yjBUjEW.exe
  2⤵
  PID:4464
- C:\Windows\System\mpJrlXQ.exe
  C:\Windows\System\mpJrlXQ.exe
  2⤵
  PID:4484
- C:\Windows\System\iGhkqVd.exe
  C:\Windows\System\iGhkqVd.exe
  2⤵
  PID:4504
- C:\Windows\System\UrPNKDx.exe
  C:\Windows\System\UrPNKDx.exe
  2⤵
  PID:4524
- C:\Windows\System\adltULu.exe
  C:\Windows\System\adltULu.exe
  2⤵
  PID:4548
- C:\Windows\System\ITvnZZx.exe
  C:\Windows\System\ITvnZZx.exe
  2⤵
  PID:4564
- C:\Windows\System\EkfNZjv.exe
  C:\Windows\System\EkfNZjv.exe
  2⤵
  PID:4588
- C:\Windows\System\rskVURD.exe
  C:\Windows\System\rskVURD.exe
  2⤵
  PID:4608
- C:\Windows\System\wNwpuGB.exe
  C:\Windows\System\wNwpuGB.exe
  2⤵
  PID:4628
- C:\Windows\System\ahaEMzk.exe
  C:\Windows\System\ahaEMzk.exe
  2⤵
  PID:4708
- C:\Windows\System\GYXtQFA.exe
  C:\Windows\System\GYXtQFA.exe
  2⤵
  PID:4724
- C:\Windows\System\vTRqHMJ.exe
  C:\Windows\System\vTRqHMJ.exe
  2⤵
  PID:4744
- C:\Windows\System\tXXuhhE.exe
  C:\Windows\System\tXXuhhE.exe
  2⤵
  PID:4760
- C:\Windows\System\RoHsGga.exe
  C:\Windows\System\RoHsGga.exe
  2⤵
  PID:4796
- C:\Windows\System\KmclGFE.exe
  C:\Windows\System\KmclGFE.exe
  2⤵
  PID:4812
- C:\Windows\System\iQKWHeL.exe
  C:\Windows\System\iQKWHeL.exe
  2⤵
  PID:4828
- C:\Windows\System\FmakgsG.exe
  C:\Windows\System\FmakgsG.exe
  2⤵
  PID:4848
- C:\Windows\System\YouaDOF.exe
  C:\Windows\System\YouaDOF.exe
  2⤵
  PID:4864
- C:\Windows\System\reXoSau.exe
  C:\Windows\System\reXoSau.exe
  2⤵
  PID:4884
- C:\Windows\System\lbujDdA.exe
  C:\Windows\System\lbujDdA.exe
  2⤵
  PID:4900
- C:\Windows\System\mNEKXaR.exe
  C:\Windows\System\mNEKXaR.exe
  2⤵
  PID:4916
- C:\Windows\System\PreDPAe.exe
  C:\Windows\System\PreDPAe.exe
  2⤵
  PID:4932
- C:\Windows\System\zUvywBT.exe
  C:\Windows\System\zUvywBT.exe
  2⤵
  PID:4952
- C:\Windows\System\yioBNJq.exe
  C:\Windows\System\yioBNJq.exe
  2⤵
  PID:4968
- C:\Windows\System\bLocLZz.exe
  C:\Windows\System\bLocLZz.exe
  2⤵
  PID:4988
- C:\Windows\System\aDcAfBE.exe
  C:\Windows\System\aDcAfBE.exe
  2⤵
  PID:5004
- C:\Windows\System\WXoyqVU.exe
  C:\Windows\System\WXoyqVU.exe
  2⤵
  PID:5024
- C:\Windows\System\XCUkqlH.exe
  C:\Windows\System\XCUkqlH.exe
  2⤵
  PID:5040
- C:\Windows\System\RcptMau.exe
  C:\Windows\System\RcptMau.exe
  2⤵
  PID:5060
- C:\Windows\System\kMYkmDY.exe
  C:\Windows\System\kMYkmDY.exe
  2⤵
  PID:5076
- C:\Windows\System\MhGlWSt.exe
  C:\Windows\System\MhGlWSt.exe
  2⤵
  PID:5092
- C:\Windows\System\lZXyTJf.exe
  C:\Windows\System\lZXyTJf.exe
  2⤵
  PID:5116
- C:\Windows\System\eIfnEdF.exe
  C:\Windows\System\eIfnEdF.exe
  2⤵
  PID:4112
- C:\Windows\System\LkQlkkp.exe
  C:\Windows\System\LkQlkkp.exe
  2⤵
  PID:4212
- C:\Windows\System\CIluknM.exe
  C:\Windows\System\CIluknM.exe
  2⤵
  PID:4252
- C:\Windows\System\gNKVGwR.exe
  C:\Windows\System\gNKVGwR.exe
  2⤵
  PID:4324
- C:\Windows\System\AhPKyjm.exe
  C:\Windows\System\AhPKyjm.exe
  2⤵
  PID:4364
- C:\Windows\System\ZDbOqxa.exe
  C:\Windows\System\ZDbOqxa.exe
  2⤵
  PID:2704
- C:\Windows\System\efYNJqP.exe
  C:\Windows\System\efYNJqP.exe
  2⤵
  PID:4132
- C:\Windows\System\CWQFPzq.exe
  C:\Windows\System\CWQFPzq.exe
  2⤵
  PID:4272
- C:\Windows\System\bzzyThw.exe
  C:\Windows\System\bzzyThw.exe
  2⤵
  PID:4344
- C:\Windows\System\yOXdGRr.exe
  C:\Windows\System\yOXdGRr.exe
  2⤵
  PID:4440
- C:\Windows\System\JfxbGlg.exe
  C:\Windows\System\JfxbGlg.exe
  2⤵
  PID:4164
- C:\Windows\System\HCwzlMp.exe
  C:\Windows\System\HCwzlMp.exe
  2⤵
  PID:3980
- C:\Windows\System\yscmVAP.exe
  C:\Windows\System\yscmVAP.exe
  2⤵
  PID:4496
- C:\Windows\System\EwxxHVH.exe
  C:\Windows\System\EwxxHVH.exe
  2⤵
  PID:4540
- C:\Windows\System\xgvJxaH.exe
  C:\Windows\System\xgvJxaH.exe
  2⤵
  PID:4520
- C:\Windows\System\MRhKLSz.exe
  C:\Windows\System\MRhKLSz.exe
  2⤵
  PID:4604
- C:\Windows\System\YowmvsW.exe
  C:\Windows\System\YowmvsW.exe
  2⤵
  PID:4584
- C:\Windows\System\WutsKgb.exe
  C:\Windows\System\WutsKgb.exe
  2⤵
  PID:4644
- C:\Windows\System\oVQRfOb.exe
  C:\Windows\System\oVQRfOb.exe
  2⤵
  PID:4660
- C:\Windows\System\LFVLWSU.exe
  C:\Windows\System\LFVLWSU.exe
  2⤵
  PID:4676
- C:\Windows\System\NnusNFs.exe
  C:\Windows\System\NnusNFs.exe
  2⤵
  PID:4692
- C:\Windows\System\ghnKqah.exe
  C:\Windows\System\ghnKqah.exe
  2⤵
  PID:4752
- C:\Windows\System\hUBrCaa.exe
  C:\Windows\System\hUBrCaa.exe
  2⤵
  PID:4700
- C:\Windows\System\XeDRJSU.exe
  C:\Windows\System\XeDRJSU.exe
  2⤵
  PID:4740
- C:\Windows\System\NnzrVMy.exe
  C:\Windows\System\NnzrVMy.exe
  2⤵
  PID:4788
- C:\Windows\System\TRpePJj.exe
  C:\Windows\System\TRpePJj.exe
  2⤵
  PID:4860
- C:\Windows\System\RMOPacU.exe
  C:\Windows\System\RMOPacU.exe
  2⤵
  PID:5016
- C:\Windows\System\jGJVyoq.exe
  C:\Windows\System\jGJVyoq.exe
  2⤵
  PID:5056
- C:\Windows\System\MpnfVwu.exe
  C:\Windows\System\MpnfVwu.exe
  2⤵
  PID:4928
- C:\Windows\System\JeJBTPw.exe
  C:\Windows\System\JeJBTPw.exe
  2⤵
  PID:4196
- C:\Windows\System\bvIEEfX.exe
  C:\Windows\System\bvIEEfX.exe
  2⤵
  PID:4476
- C:\Windows\System\GtmYgPe.exe
  C:\Windows\System\GtmYgPe.exe
  2⤵
  PID:4960
- C:\Windows\System\QWPDDnJ.exe
  C:\Windows\System\QWPDDnJ.exe
  2⤵
  PID:5036
- C:\Windows\System\ydKqiGu.exe
  C:\Windows\System\ydKqiGu.exe
  2⤵
  PID:5104
- C:\Windows\System\hItLJOc.exe
  C:\Windows\System\hItLJOc.exe
  2⤵
  PID:4180
- C:\Windows\System\VXDeGvf.exe
  C:\Windows\System\VXDeGvf.exe
  2⤵
  PID:4320
- C:\Windows\System\zYfJSrw.exe
  C:\Windows\System\zYfJSrw.exe
  2⤵
  PID:4408
- C:\Windows\System\mGZQTel.exe
  C:\Windows\System\mGZQTel.exe
  2⤵
  PID:4480
- C:\Windows\System\FUWbudy.exe
  C:\Windows\System\FUWbudy.exe
  2⤵
  PID:4652
- C:\Windows\System\jmXGUEz.exe
  C:\Windows\System\jmXGUEz.exe
  2⤵
  PID:4732
- C:\Windows\System\uZsFlmm.exe
  C:\Windows\System\uZsFlmm.exe
  2⤵
  PID:4784
- C:\Windows\System\LQugJOZ.exe
  C:\Windows\System\LQugJOZ.exe
  2⤵
  PID:4624
- C:\Windows\System\ZDsYxIi.exe
  C:\Windows\System\ZDsYxIi.exe
  2⤵
  PID:4720
- C:\Windows\System\IIZtpRf.exe
  C:\Windows\System\IIZtpRf.exe
  2⤵
  PID:4820
- C:\Windows\System\vaNkujH.exe
  C:\Windows\System\vaNkujH.exe
  2⤵
  PID:4976
- C:\Windows\System\uzXpDGN.exe
  C:\Windows\System\uzXpDGN.exe
  2⤵
  PID:5012
- C:\Windows\System\ttgtbEp.exe
  C:\Windows\System\ttgtbEp.exe
  2⤵
  PID:4108
- C:\Windows\System\tvkLFHG.exe
  C:\Windows\System\tvkLFHG.exe
  2⤵
  PID:5020
- C:\Windows\System\UifAGyY.exe
  C:\Windows\System\UifAGyY.exe
  2⤵
  PID:2728
- C:\Windows\System\MipPxVe.exe
  C:\Windows\System\MipPxVe.exe
  2⤵
  PID:4996
- C:\Windows\System\KooqpxL.exe
  C:\Windows\System\KooqpxL.exe
  2⤵
  PID:4148
- C:\Windows\System\iKbKwhD.exe
  C:\Windows\System\iKbKwhD.exe
  2⤵
  PID:4380
- C:\Windows\System\ftTLOCQ.exe
  C:\Windows\System\ftTLOCQ.exe
  2⤵
  PID:2872
- C:\Windows\System\MYcPVBD.exe
  C:\Windows\System\MYcPVBD.exe
  2⤵
  PID:4516
- C:\Windows\System\qXIzjFN.exe
  C:\Windows\System\qXIzjFN.exe
  2⤵
  PID:4776
- C:\Windows\System\PhbMkNa.exe
  C:\Windows\System\PhbMkNa.exe
  2⤵
  PID:4892
- C:\Windows\System\dOqsSUu.exe
  C:\Windows\System\dOqsSUu.exe
  2⤵
  PID:4876
- C:\Windows\System\nztZTEW.exe
  C:\Windows\System\nztZTEW.exe
  2⤵
  PID:4912
- C:\Windows\System\eykuYDN.exe
  C:\Windows\System\eykuYDN.exe
  2⤵
  PID:4560
- C:\Windows\System\SSnuSMF.exe
  C:\Windows\System\SSnuSMF.exe
  2⤵
  PID:4688
- C:\Windows\System\qGzXQmx.exe
  C:\Windows\System\qGzXQmx.exe
  2⤵
  PID:4924
- C:\Windows\System\QpgbpZL.exe
  C:\Windows\System\QpgbpZL.exe
  2⤵
  PID:2664
- C:\Windows\System\mNHwGzr.exe
  C:\Windows\System\mNHwGzr.exe
  2⤵
  PID:5128
- C:\Windows\System\rqyuBHq.exe
  C:\Windows\System\rqyuBHq.exe
  2⤵
  PID:5144
- C:\Windows\System\kGThGkc.exe
  C:\Windows\System\kGThGkc.exe
  2⤵
  PID:5164
- C:\Windows\System\WKXqpJi.exe
  C:\Windows\System\WKXqpJi.exe
  2⤵
  PID:5180
- C:\Windows\System\EjBOual.exe
  C:\Windows\System\EjBOual.exe
  2⤵
  PID:5208
- C:\Windows\System\EvcQOXJ.exe
  C:\Windows\System\EvcQOXJ.exe
  2⤵
  PID:5228
- C:\Windows\System\jstWHsc.exe
  C:\Windows\System\jstWHsc.exe
  2⤵
  PID:5244
- C:\Windows\System\PIwSlxu.exe
  C:\Windows\System\PIwSlxu.exe
  2⤵
  PID:5260
- C:\Windows\System\JzyQMdD.exe
  C:\Windows\System\JzyQMdD.exe
  2⤵
  PID:5284
- C:\Windows\System\sFdvuYY.exe
  C:\Windows\System\sFdvuYY.exe
  2⤵
  PID:5304
- C:\Windows\System\zngUtro.exe
  C:\Windows\System\zngUtro.exe
  2⤵
  PID:5328
- C:\Windows\System\xdHuMdZ.exe
  C:\Windows\System\xdHuMdZ.exe
  2⤵
  PID:5344
- C:\Windows\System\ZZtuskt.exe
  C:\Windows\System\ZZtuskt.exe
  2⤵
  PID:5364
- C:\Windows\System\WnMCirE.exe
  C:\Windows\System\WnMCirE.exe
  2⤵
  PID:5384
- C:\Windows\System\DRYLbQd.exe
  C:\Windows\System\DRYLbQd.exe
  2⤵
  PID:5400
- C:\Windows\System\ksaweNr.exe
  C:\Windows\System\ksaweNr.exe
  2⤵
  PID:5416
- C:\Windows\System\DypzCMj.exe
  C:\Windows\System\DypzCMj.exe
  2⤵
  PID:5432
- C:\Windows\System\ACiiuzB.exe
  C:\Windows\System\ACiiuzB.exe
  2⤵
  PID:5448
- C:\Windows\System\orXanJL.exe
  C:\Windows\System\orXanJL.exe
  2⤵
  PID:5548
- C:\Windows\System\ummzwKa.exe
  C:\Windows\System\ummzwKa.exe
  2⤵
  PID:5564
- C:\Windows\System\aMtRyfm.exe
  C:\Windows\System\aMtRyfm.exe
  2⤵
  PID:5580
- C:\Windows\System\gmUNnia.exe
  C:\Windows\System\gmUNnia.exe
  2⤵
  PID:5596
- C:\Windows\System\IrAuKic.exe
  C:\Windows\System\IrAuKic.exe
  2⤵
  PID:5612
- C:\Windows\System\GRRVugq.exe
  C:\Windows\System\GRRVugq.exe
  2⤵
  PID:5628
- C:\Windows\System\pzKMrPR.exe
  C:\Windows\System\pzKMrPR.exe
  2⤵
  PID:5644
- C:\Windows\System\PfrZfwG.exe
  C:\Windows\System\PfrZfwG.exe
  2⤵
  PID:5660
- C:\Windows\System\BHhwbwk.exe
  C:\Windows\System\BHhwbwk.exe
  2⤵
  PID:5676
- C:\Windows\System\epddWBe.exe
  C:\Windows\System\epddWBe.exe
  2⤵
  PID:5692
- C:\Windows\System\BepDZWx.exe
  C:\Windows\System\BepDZWx.exe
  2⤵
  PID:5708
- C:\Windows\System\vhorZPA.exe
  C:\Windows\System\vhorZPA.exe
  2⤵
  PID:5728
- C:\Windows\System\AiTnteU.exe
  C:\Windows\System\AiTnteU.exe
  2⤵
  PID:5748
- C:\Windows\System\DAVqBTB.exe
  C:\Windows\System\DAVqBTB.exe
  2⤵
  PID:5768
- C:\Windows\System\skmisPo.exe
  C:\Windows\System\skmisPo.exe
  2⤵
  PID:5784
- C:\Windows\System\ItLwTZF.exe
  C:\Windows\System\ItLwTZF.exe
  2⤵
  PID:5804
- C:\Windows\System\jXzSvJL.exe
  C:\Windows\System\jXzSvJL.exe
  2⤵
  PID:5820
- C:\Windows\System\kKTuraa.exe
  C:\Windows\System\kKTuraa.exe
  2⤵
  PID:5836
- C:\Windows\System\hhedGPn.exe
  C:\Windows\System\hhedGPn.exe
  2⤵
  PID:5852
- C:\Windows\System\MwCTPqp.exe
  C:\Windows\System\MwCTPqp.exe
  2⤵
  PID:5868
- C:\Windows\System\YnYWGJb.exe
  C:\Windows\System\YnYWGJb.exe
  2⤵
  PID:5884
- C:\Windows\System\kOxAsPR.exe
  C:\Windows\System\kOxAsPR.exe
  2⤵
  PID:5980
- C:\Windows\System\ZQXqDKb.exe
  C:\Windows\System\ZQXqDKb.exe
  2⤵
  PID:6000
- C:\Windows\System\WuhtPHD.exe
  C:\Windows\System\WuhtPHD.exe
  2⤵
  PID:6016
- C:\Windows\System\EumYHXI.exe
  C:\Windows\System\EumYHXI.exe
  2⤵
  PID:6032
- C:\Windows\System\jUlShfP.exe
  C:\Windows\System\jUlShfP.exe
  2⤵
  PID:6048
- C:\Windows\System\hYAbwbr.exe
  C:\Windows\System\hYAbwbr.exe
  2⤵
  PID:6064
- C:\Windows\System\AslZERj.exe
  C:\Windows\System\AslZERj.exe
  2⤵
  PID:6080
- C:\Windows\System\YRXzEyj.exe
  C:\Windows\System\YRXzEyj.exe
  2⤵
  PID:6100
- C:\Windows\System\JcVmOBH.exe
  C:\Windows\System\JcVmOBH.exe
  2⤵
  PID:6120
- C:\Windows\System\bRMlAJN.exe
  C:\Windows\System\bRMlAJN.exe
  2⤵
  PID:6136
- C:\Windows\System\wrsneYB.exe
  C:\Windows\System\wrsneYB.exe
  2⤵
  PID:4292
- C:\Windows\System\bPgIjHR.exe
  C:\Windows\System\bPgIjHR.exe
  2⤵
  PID:4872
- C:\Windows\System\nQgNPWU.exe
  C:\Windows\System\nQgNPWU.exe
  2⤵
  PID:4948
- C:\Windows\System\LACAXkI.exe
  C:\Windows\System\LACAXkI.exe
  2⤵
  PID:5156
- C:\Windows\System\fxdmxkc.exe
  C:\Windows\System\fxdmxkc.exe
  2⤵
  PID:5196
- C:\Windows\System\HdJdKcp.exe
  C:\Windows\System\HdJdKcp.exe
  2⤵
  PID:5268
- C:\Windows\System\VPldhfA.exe
  C:\Windows\System\VPldhfA.exe
  2⤵
  PID:5312
- C:\Windows\System\XPsCmny.exe
  C:\Windows\System\XPsCmny.exe
  2⤵
  PID:5356
- C:\Windows\System\ZbUlRgu.exe
  C:\Windows\System\ZbUlRgu.exe
  2⤵
  PID:5424
- C:\Windows\System\sHFvgey.exe
  C:\Windows\System\sHFvgey.exe
  2⤵
  PID:5476
- C:\Windows\System\TMJIwwa.exe
  C:\Windows\System\TMJIwwa.exe
  2⤵
  PID:5492
- C:\Windows\System\LMqhpBp.exe
  C:\Windows\System\LMqhpBp.exe
  2⤵
  PID:4536
- C:\Windows\System\vxKlrFs.exe
  C:\Windows\System\vxKlrFs.exe
  2⤵
  PID:4572
- C:\Windows\System\NBZyBYq.exe
  C:\Windows\System\NBZyBYq.exe
  2⤵
  PID:4284
- C:\Windows\System\EbJCDAp.exe
  C:\Windows\System\EbJCDAp.exe
  2⤵
  PID:4684
- C:\Windows\System\aUzxCvX.exe
  C:\Windows\System\aUzxCvX.exe
  2⤵
  PID:5176
- C:\Windows\System\eNKlCRS.exe
  C:\Windows\System\eNKlCRS.exe
  2⤵
  PID:5256
- C:\Windows\System\jSdDmXi.exe
  C:\Windows\System\jSdDmXi.exe
  2⤵
  PID:5340
- C:\Windows\System\kISRqhh.exe
  C:\Windows\System\kISRqhh.exe
  2⤵
  PID:5412
- C:\Windows\System\qNLuWpi.exe
  C:\Windows\System\qNLuWpi.exe
  2⤵
  PID:5540
- C:\Windows\System\zaFEfob.exe
  C:\Windows\System\zaFEfob.exe
  2⤵
  PID:5592
- C:\Windows\System\dbOsRrp.exe
  C:\Windows\System\dbOsRrp.exe
  2⤵
  PID:5684
- C:\Windows\System\ZovysyW.exe
  C:\Windows\System\ZovysyW.exe
  2⤵
  PID:5724
- C:\Windows\System\GXvvDHJ.exe
  C:\Windows\System\GXvvDHJ.exe
  2⤵
  PID:5792
- C:\Windows\System\eePwlpx.exe
  C:\Windows\System\eePwlpx.exe
  2⤵
  PID:5860
- C:\Windows\System\LyDwOOn.exe
  C:\Windows\System\LyDwOOn.exe
  2⤵
  PID:5916
- C:\Windows\System\mhmEMjc.exe
  C:\Windows\System\mhmEMjc.exe
  2⤵
  PID:5932
- C:\Windows\System\ZOEAIPP.exe
  C:\Windows\System\ZOEAIPP.exe
  2⤵
  PID:5944
- C:\Windows\System\fzsCnfg.exe
  C:\Windows\System\fzsCnfg.exe
  2⤵
  PID:5960
- C:\Windows\System\HWjgxfk.exe
  C:\Windows\System\HWjgxfk.exe
  2⤵
  PID:5968
- C:\Windows\System\sOBbhWr.exe
  C:\Windows\System\sOBbhWr.exe
  2⤵
  PID:6008
- C:\Windows\System\MTHycQR.exe
  C:\Windows\System\MTHycQR.exe
  2⤵
  PID:6076
- C:\Windows\System\PSlaJsE.exe
  C:\Windows\System\PSlaJsE.exe
  2⤵
  PID:4340
- C:\Windows\System\kLzNhTJ.exe
  C:\Windows\System\kLzNhTJ.exe
  2⤵
  PID:5188
- C:\Windows\System\wuXYGmT.exe
  C:\Windows\System\wuXYGmT.exe
  2⤵
  PID:5396
- C:\Windows\System\QtxIvtN.exe
  C:\Windows\System\QtxIvtN.exe
  2⤵
  PID:5700
- C:\Windows\System\jPXrtke.exe
  C:\Windows\System\jPXrtke.exe
  2⤵
  PID:5848
- C:\Windows\System\pTGREFO.exe
  C:\Windows\System\pTGREFO.exe
  2⤵
  PID:5640
- C:\Windows\System\fvwkHae.exe
  C:\Windows\System\fvwkHae.exe
  2⤵
  PID:5524
- C:\Windows\System\UGPvdOe.exe
  C:\Windows\System\UGPvdOe.exe
  2⤵
  PID:4492
- C:\Windows\System\PNhgvVP.exe
  C:\Windows\System\PNhgvVP.exe
  2⤵
  PID:5500
- C:\Windows\System\KNBAhhU.exe
  C:\Windows\System\KNBAhhU.exe
  2⤵
  PID:5780
- C:\Windows\System\zmlYpmK.exe
  C:\Windows\System\zmlYpmK.exe
  2⤵
  PID:4844
- C:\Windows\System\nHSpXop.exe
  C:\Windows\System\nHSpXop.exe
  2⤵
  PID:6028
- C:\Windows\System\KpHaoJk.exe
  C:\Windows\System\KpHaoJk.exe
  2⤵
  PID:6096
- C:\Windows\System\XTSprjQ.exe
  C:\Windows\System\XTSprjQ.exe
  2⤵
  PID:5124
- C:\Windows\System\OfkCawF.exe
  C:\Windows\System\OfkCawF.exe
  2⤵
  PID:5324
- C:\Windows\System\IaIFQyD.exe
  C:\Windows\System\IaIFQyD.exe
  2⤵
  PID:5440
- C:\Windows\System\IkWyRjl.exe
  C:\Windows\System\IkWyRjl.exe
  2⤵
  PID:5252
- C:\Windows\System\yrYTdQh.exe
  C:\Windows\System\yrYTdQh.exe
  2⤵
  PID:5508
- C:\Windows\System\VKYHcdk.exe
  C:\Windows\System\VKYHcdk.exe
  2⤵
  PID:5380
- C:\Windows\System\mMshOEp.exe
  C:\Windows\System\mMshOEp.exe
  2⤵
  PID:5220
- C:\Windows\System\uNlCUiW.exe
  C:\Windows\System\uNlCUiW.exe
  2⤵
  PID:5716
- C:\Windows\System\nmpIeOI.exe
  C:\Windows\System\nmpIeOI.exe
  2⤵
  PID:5900
- C:\Windows\System\XBiYgnw.exe
  C:\Windows\System\XBiYgnw.exe
  2⤵
  PID:5280
- C:\Windows\System\gcRGNYF.exe
  C:\Windows\System\gcRGNYF.exe
  2⤵
  PID:5100
- C:\Windows\System\DQHAYbr.exe
  C:\Windows\System\DQHAYbr.exe
  2⤵
  PID:5608
- C:\Windows\System\TmKmLzY.exe
  C:\Windows\System\TmKmLzY.exe
  2⤵
  PID:5336
- C:\Windows\System\CzUkTPn.exe
  C:\Windows\System\CzUkTPn.exe
  2⤵
  PID:5656
- C:\Windows\System\RHhgGSA.exe
  C:\Windows\System\RHhgGSA.exe
  2⤵
  PID:5520
- C:\Windows\System\GBVJjaM.exe
  C:\Windows\System\GBVJjaM.exe
  2⤵
  PID:5992
- C:\Windows\System\vYJfmXR.exe
  C:\Windows\System\vYJfmXR.exe
  2⤵
  PID:5240
- C:\Windows\System\jvliHzh.exe
  C:\Windows\System\jvliHzh.exe
  2⤵
  PID:5892
- C:\Windows\System\DUwbSQd.exe
  C:\Windows\System\DUwbSQd.exe
  2⤵
  PID:6040
- C:\Windows\System\pyhDadL.exe
  C:\Windows\System\pyhDadL.exe
  2⤵
  PID:4836
- C:\Windows\System\sbwGPFq.exe
  C:\Windows\System\sbwGPFq.exe
  2⤵
  PID:5636
- C:\Windows\System\JKrVqlU.exe
  C:\Windows\System\JKrVqlU.exe
  2⤵
  PID:5456
- C:\Windows\System\jjSFcgA.exe
  C:\Windows\System\jjSFcgA.exe
  2⤵
  PID:5172
- C:\Windows\System\lwJvftf.exe
  C:\Windows\System\lwJvftf.exe
  2⤵
  PID:5588
- C:\Windows\System\qRmVeEb.exe
  C:\Windows\System\qRmVeEb.exe
  2⤵
  PID:5624
- C:\Windows\System\MgakcRI.exe
  C:\Windows\System\MgakcRI.exe
  2⤵
  PID:5204
- C:\Windows\System\geJlSvo.exe
  C:\Windows\System\geJlSvo.exe
  2⤵
  PID:5376
- C:\Windows\System\AyKxpDm.exe
  C:\Windows\System\AyKxpDm.exe
  2⤵
  PID:5800
- C:\Windows\System\bqepVBE.exe
  C:\Windows\System\bqepVBE.exe
  2⤵
  PID:5952
- C:\Windows\System\RwhcaPv.exe
  C:\Windows\System\RwhcaPv.exe
  2⤵
  PID:6092
- C:\Windows\System\kElbMvl.exe
  C:\Windows\System\kElbMvl.exe
  2⤵
  PID:5516
- C:\Windows\System\DloNIEB.exe
  C:\Windows\System\DloNIEB.exe
  2⤵
  PID:5940
- C:\Windows\System\voGrWkZ.exe
  C:\Windows\System\voGrWkZ.exe
  2⤵
  PID:5776
- C:\Windows\System\VsNIveP.exe
  C:\Windows\System\VsNIveP.exe
  2⤵
  PID:5224
- C:\Windows\System\pUOzbkg.exe
  C:\Windows\System\pUOzbkg.exe
  2⤵
  PID:5668
- C:\Windows\System\ByIDdPV.exe
  C:\Windows\System\ByIDdPV.exe
  2⤵
  PID:5976
- C:\Windows\System\Lctpiug.exe
  C:\Windows\System\Lctpiug.exe
  2⤵
  PID:5928
- C:\Windows\System\gCdVYXJ.exe
  C:\Windows\System\gCdVYXJ.exe
  2⤵
  PID:5764
- C:\Windows\System\VpGUNxi.exe
  C:\Windows\System\VpGUNxi.exe
  2⤵
  PID:5740
- C:\Windows\System\tlGZxPu.exe
  C:\Windows\System\tlGZxPu.exe
  2⤵
  PID:4232
- C:\Windows\System\FXGPHty.exe
  C:\Windows\System\FXGPHty.exe
  2⤵
  PID:5532
- C:\Windows\System\FuXNVTh.exe
  C:\Windows\System\FuXNVTh.exe
  2⤵
  PID:6160
- C:\Windows\System\WkUMMjk.exe
  C:\Windows\System\WkUMMjk.exe
  2⤵
  PID:6176
- C:\Windows\System\tmbZJTf.exe
  C:\Windows\System\tmbZJTf.exe
  2⤵
  PID:6192
- C:\Windows\System\hanAdwt.exe
  C:\Windows\System\hanAdwt.exe
  2⤵
  PID:6208
- C:\Windows\System\ucNHLbA.exe
  C:\Windows\System\ucNHLbA.exe
  2⤵
  PID:6224
- C:\Windows\System\NMXJMPM.exe
  C:\Windows\System\NMXJMPM.exe
  2⤵
  PID:6240
- C:\Windows\System\awPLVNL.exe
  C:\Windows\System\awPLVNL.exe
  2⤵
  PID:6256
- C:\Windows\System\qrPvHjZ.exe
  C:\Windows\System\qrPvHjZ.exe
  2⤵
  PID:6272
- C:\Windows\System\Rfuoyen.exe
  C:\Windows\System\Rfuoyen.exe
  2⤵
  PID:6288
- C:\Windows\System\EVIyqqB.exe
  C:\Windows\System\EVIyqqB.exe
  2⤵
  PID:6304
- C:\Windows\System\YQNZZyS.exe
  C:\Windows\System\YQNZZyS.exe
  2⤵
  PID:6320
- C:\Windows\System\YKuDmNB.exe
  C:\Windows\System\YKuDmNB.exe
  2⤵
  PID:6336
- C:\Windows\System\lDHblEm.exe
  C:\Windows\System\lDHblEm.exe
  2⤵
  PID:6352
- C:\Windows\System\LNxKeuD.exe
  C:\Windows\System\LNxKeuD.exe
  2⤵
  PID:6368
- C:\Windows\System\BYCbkso.exe
  C:\Windows\System\BYCbkso.exe
  2⤵
  PID:6384
- C:\Windows\System\FInZzad.exe
  C:\Windows\System\FInZzad.exe
  2⤵
  PID:6400
- C:\Windows\System\arsREUi.exe
  C:\Windows\System\arsREUi.exe
  2⤵
  PID:6416
- C:\Windows\System\iyLfDvt.exe
  C:\Windows\System\iyLfDvt.exe
  2⤵
  PID:6432
- C:\Windows\System\YGkCLGt.exe
  C:\Windows\System\YGkCLGt.exe
  2⤵
  PID:6448
- C:\Windows\System\nGnctZp.exe
  C:\Windows\System\nGnctZp.exe
  2⤵
  PID:6464
- C:\Windows\System\aPBlNOs.exe
  C:\Windows\System\aPBlNOs.exe
  2⤵
  PID:6480
- C:\Windows\System\ZWkPkON.exe
  C:\Windows\System\ZWkPkON.exe
  2⤵
  PID:6496
- C:\Windows\System\LhCbINW.exe
  C:\Windows\System\LhCbINW.exe
  2⤵
  PID:6512
- C:\Windows\System\gkpQEjh.exe
  C:\Windows\System\gkpQEjh.exe
  2⤵
  PID:6528
- C:\Windows\System\JBYOiUM.exe
  C:\Windows\System\JBYOiUM.exe
  2⤵
  PID:6544
- C:\Windows\System\ajlWtTH.exe
  C:\Windows\System\ajlWtTH.exe
  2⤵
  PID:6560
- C:\Windows\System\LUTkxdI.exe
  C:\Windows\System\LUTkxdI.exe
  2⤵
  PID:6576
- C:\Windows\System\yoectTX.exe
  C:\Windows\System\yoectTX.exe
  2⤵
  PID:6592
- C:\Windows\System\dmkqWyb.exe
  C:\Windows\System\dmkqWyb.exe
  2⤵
  PID:6608
- C:\Windows\System\nowpQGQ.exe
  C:\Windows\System\nowpQGQ.exe
  2⤵
  PID:6624
- C:\Windows\System\HqDeBYk.exe
  C:\Windows\System\HqDeBYk.exe
  2⤵
  PID:6640
- C:\Windows\System\ZFhcaAH.exe
  C:\Windows\System\ZFhcaAH.exe
  2⤵
  PID:6656
- C:\Windows\System\XKFKCYf.exe
  C:\Windows\System\XKFKCYf.exe
  2⤵
  PID:6672
- C:\Windows\System\dNuorxR.exe
  C:\Windows\System\dNuorxR.exe
  2⤵
  PID:6688
- C:\Windows\System\AAMSsaS.exe
  C:\Windows\System\AAMSsaS.exe
  2⤵
  PID:6704
- C:\Windows\System\PUDzBYR.exe
  C:\Windows\System\PUDzBYR.exe
  2⤵
  PID:6720
- C:\Windows\System\XjLMpcc.exe
  C:\Windows\System\XjLMpcc.exe
  2⤵
  PID:6736
- C:\Windows\System\ewXRCBp.exe
  C:\Windows\System\ewXRCBp.exe
  2⤵
  PID:6752
- C:\Windows\System\rWEjbNj.exe
  C:\Windows\System\rWEjbNj.exe
  2⤵
  PID:6768
- C:\Windows\System\dfWwRnt.exe
  C:\Windows\System\dfWwRnt.exe
  2⤵
  PID:6784
- C:\Windows\System\XtrpgCa.exe
  C:\Windows\System\XtrpgCa.exe
  2⤵
  PID:6800
- C:\Windows\System\OsnBQeQ.exe
  C:\Windows\System\OsnBQeQ.exe
  2⤵
  PID:6816
- C:\Windows\System\ynIBIeh.exe
  C:\Windows\System\ynIBIeh.exe
  2⤵
  PID:6832
- C:\Windows\System\thFHxjT.exe
  C:\Windows\System\thFHxjT.exe
  2⤵
  PID:6848
- C:\Windows\System\RUlmRnJ.exe
  C:\Windows\System\RUlmRnJ.exe
  2⤵
  PID:6864
- C:\Windows\System\ZXvwzrw.exe
  C:\Windows\System\ZXvwzrw.exe
  2⤵
  PID:6880
- C:\Windows\System\DzSaOQE.exe
  C:\Windows\System\DzSaOQE.exe
  2⤵
  PID:6896
- C:\Windows\System\HCQJLGj.exe
  C:\Windows\System\HCQJLGj.exe
  2⤵
  PID:6912
- C:\Windows\System\ywehWTg.exe
  C:\Windows\System\ywehWTg.exe
  2⤵
  PID:6928
- C:\Windows\System\vGFyrlH.exe
  C:\Windows\System\vGFyrlH.exe
  2⤵
  PID:6944
- C:\Windows\System\jkWpEPV.exe
  C:\Windows\System\jkWpEPV.exe
  2⤵
  PID:6960
- C:\Windows\System\mIEyQLP.exe
  C:\Windows\System\mIEyQLP.exe
  2⤵
  PID:6976
- C:\Windows\System\Gtgtwwy.exe
  C:\Windows\System\Gtgtwwy.exe
  2⤵
  PID:6992
- C:\Windows\System\zJiJiiV.exe
  C:\Windows\System\zJiJiiV.exe
  2⤵
  PID:7008
- C:\Windows\System\GpXujdT.exe
  C:\Windows\System\GpXujdT.exe
  2⤵
  PID:7024
- C:\Windows\System\TzDIAqN.exe
  C:\Windows\System\TzDIAqN.exe
  2⤵
  PID:7040
- C:\Windows\System\KfClylF.exe
  C:\Windows\System\KfClylF.exe
  2⤵
  PID:7056
- C:\Windows\System\zYZGgYz.exe
  C:\Windows\System\zYZGgYz.exe
  2⤵
  PID:7072
- C:\Windows\System\dFHhXtQ.exe
  C:\Windows\System\dFHhXtQ.exe
  2⤵
  PID:7088
- C:\Windows\System\PRvxTlO.exe
  C:\Windows\System\PRvxTlO.exe
  2⤵
  PID:7104
- C:\Windows\System\rdvCnfr.exe
  C:\Windows\System\rdvCnfr.exe
  2⤵
  PID:7120
- C:\Windows\System\AXTGPcq.exe
  C:\Windows\System\AXTGPcq.exe
  2⤵
  PID:7136
- C:\Windows\System\tYiYaFr.exe
  C:\Windows\System\tYiYaFr.exe
  2⤵
  PID:7152
- C:\Windows\System\MSKfWJq.exe
  C:\Windows\System\MSKfWJq.exe
  2⤵
  PID:6132
- C:\Windows\System\ZSlXYMz.exe
  C:\Windows\System\ZSlXYMz.exe
  2⤵
  PID:6184
- C:\Windows\System\lIJewcx.exe
  C:\Windows\System\lIJewcx.exe
  2⤵
  PID:6248
- C:\Windows\System\QzIYRko.exe
  C:\Windows\System\QzIYRko.exe
  2⤵
  PID:5572
- C:\Windows\System\vNhTfHv.exe
  C:\Windows\System\vNhTfHv.exe
  2⤵
  PID:3920
- C:\Windows\System\ZcvwUtn.exe
  C:\Windows\System\ZcvwUtn.exe
  2⤵
  PID:5828
- C:\Windows\System\XkBZxeU.exe
  C:\Windows\System\XkBZxeU.exe
  2⤵
  PID:6204
- C:\Windows\System\ENidnCW.exe
  C:\Windows\System\ENidnCW.exe
  2⤵
  PID:6296
- C:\Windows\System\vYKqvqD.exe
  C:\Windows\System\vYKqvqD.exe
  2⤵
  PID:6348
- C:\Windows\System\PZgxFXr.exe
  C:\Windows\System\PZgxFXr.exe
  2⤵
  PID:6412
- C:\Windows\System\ybhIBnu.exe
  C:\Windows\System\ybhIBnu.exe
  2⤵
  PID:6476
- C:\Windows\System\ZQjXRvg.exe
  C:\Windows\System\ZQjXRvg.exe
  2⤵
  PID:6540
- C:\Windows\System\lHhYtjq.exe
  C:\Windows\System\lHhYtjq.exe
  2⤵
  PID:6604
- C:\Windows\System\lrjCZRq.exe
  C:\Windows\System\lrjCZRq.exe
  2⤵
  PID:6488
- C:\Windows\System\HiUoVUF.exe
  C:\Windows\System\HiUoVUF.exe
  2⤵
  PID:6332
- C:\Windows\System\SpsYvmv.exe
  C:\Windows\System\SpsYvmv.exe
  2⤵
  PID:6396
- C:\Windows\System\EYsyutq.exe
  C:\Windows\System\EYsyutq.exe
  2⤵
  PID:6492
- C:\Windows\System\RVLmHSR.exe
  C:\Windows\System\RVLmHSR.exe
  2⤵
  PID:6584
- C:\Windows\System\yteESuB.exe
  C:\Windows\System\yteESuB.exe
  2⤵
  PID:6664
- C:\Windows\System\pRRXlkG.exe
  C:\Windows\System\pRRXlkG.exe
  2⤵
  PID:6728
- C:\Windows\System\dsCyvyB.exe
  C:\Windows\System\dsCyvyB.exe
  2⤵
  PID:6792
- C:\Windows\System\AjoiiEc.exe
  C:\Windows\System\AjoiiEc.exe
  2⤵
  PID:6856
- C:\Windows\System\vPMIPpc.exe
  C:\Windows\System\vPMIPpc.exe
  2⤵
  PID:6648
- C:\Windows\System\PRLNITl.exe
  C:\Windows\System\PRLNITl.exe
  2⤵
  PID:6904
- C:\Windows\System\cywkXsc.exe
  C:\Windows\System\cywkXsc.exe
  2⤵
  PID:6680
- C:\Windows\System\xdCgkpA.exe
  C:\Windows\System\xdCgkpA.exe
  2⤵
  PID:6776
- C:\Windows\System\vRmXzJx.exe
  C:\Windows\System\vRmXzJx.exe
  2⤵
  PID:6840
- C:\Windows\System\kqNtxHG.exe
  C:\Windows\System\kqNtxHG.exe
  2⤵
  PID:6952
- C:\Windows\System\mzWoECk.exe
  C:\Windows\System\mzWoECk.exe
  2⤵
  PID:7016
- C:\Windows\System\DfQhtBf.exe
  C:\Windows\System\DfQhtBf.exe
  2⤵
  PID:7052
- C:\Windows\System\Vbappkh.exe
  C:\Windows\System\Vbappkh.exe
  2⤵
  PID:7116
- C:\Windows\System\HDFzgxQ.exe
  C:\Windows\System\HDFzgxQ.exe
  2⤵
  PID:6156
- C:\Windows\System\RNRUkBD.exe
  C:\Windows\System\RNRUkBD.exe
  2⤵
  PID:7004
- C:\Windows\System\Hhekflt.exe
  C:\Windows\System\Hhekflt.exe
  2⤵
  PID:7096
- C:\Windows\System\JBbCbUb.exe
  C:\Windows\System\JBbCbUb.exe
  2⤵
  PID:7160
- C:\Windows\System\mnKbrmR.exe
  C:\Windows\System\mnKbrmR.exe
  2⤵
  PID:6200
- C:\Windows\System\DchkClh.exe
  C:\Windows\System\DchkClh.exe
  2⤵
  PID:6284
- C:\Windows\System\jzhpMzv.exe
  C:\Windows\System\jzhpMzv.exe
  2⤵
  PID:6268
- C:\Windows\System\gAYNRdV.exe
  C:\Windows\System\gAYNRdV.exe
  2⤵
  PID:6380
- C:\Windows\System\SSryYTs.exe
  C:\Windows\System\SSryYTs.exe
  2⤵
  PID:6300
- C:\Windows\System\ZCSWUdW.exe
  C:\Windows\System\ZCSWUdW.exe
  2⤵
  PID:6552
- C:\Windows\System\nkSzbVI.exe
  C:\Windows\System\nkSzbVI.exe
  2⤵
  PID:6824
- C:\Windows\System\skCZHdc.exe
  C:\Windows\System\skCZHdc.exe
  2⤵
  PID:6716
- C:\Windows\System\TqxPAPO.exe
  C:\Windows\System\TqxPAPO.exe
  2⤵
  PID:6460
- C:\Windows\System\mlHIqBL.exe
  C:\Windows\System\mlHIqBL.exe
  2⤵
  PID:6600
- C:\Windows\System\IbTTBmE.exe
  C:\Windows\System\IbTTBmE.exe
  2⤵
  PID:6428
- C:\Windows\System\DtmHgvk.exe
  C:\Windows\System\DtmHgvk.exe
  2⤵
  PID:6888
- C:\Windows\System\rCGlydG.exe
  C:\Windows\System\rCGlydG.exe
  2⤵
  PID:6812
- C:\Windows\System\POFrQbd.exe
  C:\Windows\System\POFrQbd.exe
  2⤵
  PID:6908
- C:\Windows\System\ihzlXtX.exe
  C:\Windows\System\ihzlXtX.exe
  2⤵
  PID:6152
- C:\Windows\System\EdkDYyY.exe
  C:\Windows\System\EdkDYyY.exe
  2⤵
  PID:6216
- C:\Windows\System\bkwgJGb.exe
  C:\Windows\System\bkwgJGb.exe
  2⤵
  PID:6968
- C:\Windows\System\DfUGOeo.exe
  C:\Windows\System\DfUGOeo.exe
  2⤵
  PID:6972
- C:\Windows\System\amTUbLS.exe
  C:\Windows\System\amTUbLS.exe
  2⤵
  PID:6264
- C:\Windows\System\upBNHsQ.exe
  C:\Windows\System\upBNHsQ.exe
  2⤵
  PID:6392
- C:\Windows\System\rxoAFET.exe
  C:\Windows\System\rxoAFET.exe
  2⤵
  PID:6636
- C:\Windows\System\urIHrXy.exe
  C:\Windows\System\urIHrXy.exe
  2⤵
  PID:6876
- C:\Windows\System\YAUZwMK.exe
  C:\Windows\System\YAUZwMK.exe
  2⤵
  PID:6652
- C:\Windows\System\TgQOeSM.exe
  C:\Windows\System\TgQOeSM.exe
  2⤵
  PID:7148
- C:\Windows\System\OfAFrUO.exe
  C:\Windows\System\OfAFrUO.exe
  2⤵
  PID:7172
- C:\Windows\System\ffCEIYv.exe
  C:\Windows\System\ffCEIYv.exe
  2⤵
  PID:7188
- C:\Windows\System\tzlEyRr.exe
  C:\Windows\System\tzlEyRr.exe
  2⤵
  PID:7204
- C:\Windows\System\drCeDoR.exe
  C:\Windows\System\drCeDoR.exe
  2⤵
  PID:7220
- C:\Windows\System\UDSMBJm.exe
  C:\Windows\System\UDSMBJm.exe
  2⤵
  PID:7236
- C:\Windows\System\OGqcqmL.exe
  C:\Windows\System\OGqcqmL.exe
  2⤵
  PID:7252
- C:\Windows\System\VAZESFi.exe
  C:\Windows\System\VAZESFi.exe
  2⤵
  PID:7268
- C:\Windows\System\mNypSoD.exe
  C:\Windows\System\mNypSoD.exe
  2⤵
  PID:7284
- C:\Windows\System\UzLiHiY.exe
  C:\Windows\System\UzLiHiY.exe
  2⤵
  PID:7300
- C:\Windows\System\NKkBLiV.exe
  C:\Windows\System\NKkBLiV.exe
  2⤵
  PID:7316
- C:\Windows\System\iMhFhWT.exe
  C:\Windows\System\iMhFhWT.exe
  2⤵
  PID:7332
- C:\Windows\System\JLYYiRV.exe
  C:\Windows\System\JLYYiRV.exe
  2⤵
  PID:7348
- C:\Windows\System\teRdKVg.exe
  C:\Windows\System\teRdKVg.exe
  2⤵
  PID:7364
- C:\Windows\System\vpInCXD.exe
  C:\Windows\System\vpInCXD.exe
  2⤵
  PID:7380
- C:\Windows\System\NKwhzUO.exe
  C:\Windows\System\NKwhzUO.exe
  2⤵
  PID:7396
- C:\Windows\System\HFWKgtp.exe
  C:\Windows\System\HFWKgtp.exe
  2⤵
  PID:7412
- C:\Windows\System\jaWQHYF.exe
  C:\Windows\System\jaWQHYF.exe
  2⤵
  PID:7428
- C:\Windows\System\LCPQvVy.exe
  C:\Windows\System\LCPQvVy.exe
  2⤵
  PID:7444
- C:\Windows\System\rMzqFrs.exe
  C:\Windows\System\rMzqFrs.exe
  2⤵
  PID:7460
- C:\Windows\System\rVYoGBq.exe
  C:\Windows\System\rVYoGBq.exe
  2⤵
  PID:7476
- C:\Windows\System\GuuOHiA.exe
  C:\Windows\System\GuuOHiA.exe
  2⤵
  PID:7492
- C:\Windows\System\ZJhkdCU.exe
  C:\Windows\System\ZJhkdCU.exe
  2⤵
  PID:7508
- C:\Windows\System\dGDuBoN.exe
  C:\Windows\System\dGDuBoN.exe
  2⤵
  PID:7524
- C:\Windows\System\hlOrKEz.exe
  C:\Windows\System\hlOrKEz.exe
  2⤵
  PID:7540
- C:\Windows\System\YCXnRBa.exe
  C:\Windows\System\YCXnRBa.exe
  2⤵
  PID:7556
- C:\Windows\System\gFDUgHp.exe
  C:\Windows\System\gFDUgHp.exe
  2⤵
  PID:7572
- C:\Windows\System\JUjdPoZ.exe
  C:\Windows\System\JUjdPoZ.exe
  2⤵
  PID:7588
- C:\Windows\System\iyhIZbw.exe
  C:\Windows\System\iyhIZbw.exe
  2⤵
  PID:7604
- C:\Windows\System\ythjVzG.exe
  C:\Windows\System\ythjVzG.exe
  2⤵
  PID:7620
- C:\Windows\System\iHTRePk.exe
  C:\Windows\System\iHTRePk.exe
  2⤵
  PID:7636
- C:\Windows\System\trZSVOb.exe
  C:\Windows\System\trZSVOb.exe
  2⤵
  PID:7652
- C:\Windows\System\ajXCyvE.exe
  C:\Windows\System\ajXCyvE.exe
  2⤵
  PID:7668
- C:\Windows\System\dHxZOCV.exe
  C:\Windows\System\dHxZOCV.exe
  2⤵
  PID:7684
- C:\Windows\System\vRQSeZF.exe
  C:\Windows\System\vRQSeZF.exe
  2⤵
  PID:7704
- C:\Windows\System\YngeNWa.exe
  C:\Windows\System\YngeNWa.exe
  2⤵
  PID:7720
- C:\Windows\System\XsdXJpD.exe
  C:\Windows\System\XsdXJpD.exe
  2⤵
  PID:7736
- C:\Windows\System\BQbtnsZ.exe
  C:\Windows\System\BQbtnsZ.exe
  2⤵
  PID:7752
- C:\Windows\System\wYRqOQF.exe
  C:\Windows\System\wYRqOQF.exe
  2⤵
  PID:7768
- C:\Windows\System\gKIYWaA.exe
  C:\Windows\System\gKIYWaA.exe
  2⤵
  PID:7784
- C:\Windows\System\QCjieRC.exe
  C:\Windows\System\QCjieRC.exe
  2⤵
  PID:7800
- C:\Windows\System\kPWzQlL.exe
  C:\Windows\System\kPWzQlL.exe
  2⤵
  PID:7816
- C:\Windows\System\waaTKel.exe
  C:\Windows\System\waaTKel.exe
  2⤵
  PID:7832
- C:\Windows\System\ZzvTndg.exe
  C:\Windows\System\ZzvTndg.exe
  2⤵
  PID:7848
- C:\Windows\System\CRaYHIF.exe
  C:\Windows\System\CRaYHIF.exe
  2⤵
  PID:7864
- C:\Windows\System\tbBaFzy.exe
  C:\Windows\System\tbBaFzy.exe
  2⤵
  PID:7880
- C:\Windows\System\cNbmFNp.exe
  C:\Windows\System\cNbmFNp.exe
  2⤵
  PID:7896
- C:\Windows\System\bmSBkgE.exe
  C:\Windows\System\bmSBkgE.exe
  2⤵
  PID:7912
- C:\Windows\System\IcZaTbe.exe
  C:\Windows\System\IcZaTbe.exe
  2⤵
  PID:7928
- C:\Windows\System\xTDjcxw.exe
  C:\Windows\System\xTDjcxw.exe
  2⤵
  PID:7944
- C:\Windows\System\sbcIVvT.exe
  C:\Windows\System\sbcIVvT.exe
  2⤵
  PID:7960
- C:\Windows\System\Oakuikx.exe
  C:\Windows\System\Oakuikx.exe
  2⤵
  PID:7976
- C:\Windows\System\tuzOATj.exe
  C:\Windows\System\tuzOATj.exe
  2⤵
  PID:7992
- C:\Windows\System\edFVCMN.exe
  C:\Windows\System\edFVCMN.exe
  2⤵
  PID:8008
- C:\Windows\System\arlWKpg.exe
  C:\Windows\System\arlWKpg.exe
  2⤵
  PID:8024
- C:\Windows\System\ixWxiHq.exe
  C:\Windows\System\ixWxiHq.exe
  2⤵
  PID:8040
- C:\Windows\System\VVfiCRj.exe
  C:\Windows\System\VVfiCRj.exe
  2⤵
  PID:8056
- C:\Windows\System\TezKNmK.exe
  C:\Windows\System\TezKNmK.exe
  2⤵
  PID:8072
- C:\Windows\System\YFKRmVO.exe
  C:\Windows\System\YFKRmVO.exe
  2⤵
  PID:8088
- C:\Windows\System\cHmfmgt.exe
  C:\Windows\System\cHmfmgt.exe
  2⤵
  PID:8104
- C:\Windows\System\NgZFGqv.exe
  C:\Windows\System\NgZFGqv.exe
  2⤵
  PID:8120
- C:\Windows\System\LpevZpR.exe
  C:\Windows\System\LpevZpR.exe
  2⤵
  PID:8136
- C:\Windows\System\oSMbvdZ.exe
  C:\Windows\System\oSMbvdZ.exe
  2⤵
  PID:8152
- C:\Windows\System\vXgkYHe.exe
  C:\Windows\System\vXgkYHe.exe
  2⤵
  PID:8168
- C:\Windows\System\GwqDFGW.exe
  C:\Windows\System\GwqDFGW.exe
  2⤵
  PID:8184
- C:\Windows\System\vqDxOWR.exe
  C:\Windows\System\vqDxOWR.exe
  2⤵
  PID:6472
- C:\Windows\System\tYuHTng.exe
  C:\Windows\System\tYuHTng.exe
  2⤵
  PID:6988
- C:\Windows\System\xmGTuJg.exe
  C:\Windows\System\xmGTuJg.exe
  2⤵
  PID:7228
- C:\Windows\System\xFCqGgx.exe
  C:\Windows\System\xFCqGgx.exe
  2⤵
  PID:6924
- C:\Windows\System\daFgcKi.exe
  C:\Windows\System\daFgcKi.exe
  2⤵
  PID:6364
- C:\Windows\System\yhemiGW.exe
  C:\Windows\System\yhemiGW.exe
  2⤵
  PID:7048
- C:\Windows\System\uUqEfec.exe
  C:\Windows\System\uUqEfec.exe
  2⤵
  PID:7216
- C:\Windows\System\CyWBwOI.exe
  C:\Windows\System\CyWBwOI.exe
  2⤵
  PID:4984
- C:\Windows\System\FEAEXch.exe
  C:\Windows\System\FEAEXch.exe
  2⤵
  PID:7328
- C:\Windows\System\wplSrlr.exe
  C:\Windows\System\wplSrlr.exe
  2⤵
  PID:7392
- C:\Windows\System\esXcCoQ.exe
  C:\Windows\System\esXcCoQ.exe
  2⤵
  PID:7456
- C:\Windows\System\jDdDRZk.exe
  C:\Windows\System\jDdDRZk.exe
  2⤵
  PID:7520
- C:\Windows\System\hbbqdBD.exe
  C:\Windows\System\hbbqdBD.exe
  2⤵
  PID:7440
- C:\Windows\System\JTOlLep.exe
  C:\Windows\System\JTOlLep.exe
  2⤵
  PID:7404
- C:\Windows\System\IwNwoFw.exe
  C:\Windows\System\IwNwoFw.exe
  2⤵
  PID:7584
- C:\Windows\System\mHCGMua.exe
  C:\Windows\System\mHCGMua.exe
  2⤵
  PID:7344
- C:\Windows\System\uCXtDCy.exe
  C:\Windows\System\uCXtDCy.exe
  2⤵
  PID:7500
- C:\Windows\System\WTCDsEC.exe
  C:\Windows\System\WTCDsEC.exe
  2⤵
  PID:7616
- C:\Windows\System\sVagOMA.exe
  C:\Windows\System\sVagOMA.exe
  2⤵
  PID:7596
- C:\Windows\System\AzFMlbv.exe
  C:\Windows\System\AzFMlbv.exe
  2⤵
  PID:7632
- C:\Windows\System\UvsdLke.exe
  C:\Windows\System\UvsdLke.exe
  2⤵
  PID:7712
- C:\Windows\System\BJlbeqN.exe
  C:\Windows\System\BJlbeqN.exe
  2⤵
  PID:7776
- C:\Windows\System\JpEtZmP.exe
  C:\Windows\System\JpEtZmP.exe
  2⤵
  PID:7696
- C:\Windows\System\jdRyaAb.exe
  C:\Windows\System\jdRyaAb.exe
  2⤵
  PID:7824
- C:\Windows\System\qBvPBrC.exe
  C:\Windows\System\qBvPBrC.exe
  2⤵
  PID:7764
- C:\Windows\System\fntlUEM.exe
  C:\Windows\System\fntlUEM.exe
  2⤵
  PID:7792
- C:\Windows\System\hBZRFKQ.exe
  C:\Windows\System\hBZRFKQ.exe
  2⤵
  PID:7904
- C:\Windows\System\CroYGKK.exe
  C:\Windows\System\CroYGKK.exe
  2⤵
  PID:7936
- C:\Windows\System\bRmzrmA.exe
  C:\Windows\System\bRmzrmA.exe
  2⤵
  PID:7968
- C:\Windows\System\jIlvZpG.exe
  C:\Windows\System\jIlvZpG.exe
  2⤵
  PID:8000
- C:\Windows\System\uzKGhTF.exe
  C:\Windows\System\uzKGhTF.exe
  2⤵
  PID:8032
- C:\Windows\System\pJfCtuV.exe
  C:\Windows\System\pJfCtuV.exe
  2⤵
  PID:8096
- C:\Windows\System\iRSwbsC.exe
  C:\Windows\System\iRSwbsC.exe
  2⤵
  PID:8052
- C:\Windows\System\pUckete.exe
  C:\Windows\System\pUckete.exe
  2⤵
  PID:8132
- C:\Windows\System\YsXUdJW.exe
  C:\Windows\System\YsXUdJW.exe
  2⤵
  PID:8080
- C:\Windows\System\LAmUPfb.exe
  C:\Windows\System\LAmUPfb.exe
  2⤵
  PID:8148
- C:\Windows\System\pqBJSZQ.exe
  C:\Windows\System\pqBJSZQ.exe
  2⤵
  PID:8176
- C:\Windows\System\aoEUIxN.exe
  C:\Windows\System\aoEUIxN.exe
  2⤵
  PID:6172
- C:\Windows\System\hFwcgsN.exe
  C:\Windows\System\hFwcgsN.exe
  2⤵
  PID:7184
- C:\Windows\System\lnjWbEz.exe
  C:\Windows\System\lnjWbEz.exe
  2⤵
  PID:7324
- C:\Windows\System\LuvewdV.exe
  C:\Windows\System\LuvewdV.exe
  2⤵
  PID:6760
- C:\Windows\System\NCEWxbQ.exe
  C:\Windows\System\NCEWxbQ.exe
  2⤵
  PID:7424
- C:\Windows\System\nTwKnVb.exe
  C:\Windows\System\nTwKnVb.exe
  2⤵
  PID:7468
- C:\Windows\System\JpZGPct.exe
  C:\Windows\System\JpZGPct.exe
  2⤵
  PID:7472
- C:\Windows\System\VtfLjxO.exe
  C:\Windows\System\VtfLjxO.exe
  2⤵
  PID:7536
- C:\Windows\System\qZneZPq.exe
  C:\Windows\System\qZneZPq.exe
  2⤵
  PID:7612
- C:\Windows\System\VNNloLR.exe
  C:\Windows\System\VNNloLR.exe
  2⤵
  PID:7748
- C:\Windows\System\TUPszWF.exe
  C:\Windows\System\TUPszWF.exe
  2⤵
  PID:7812
- C:\Windows\System\oqnfumE.exe
  C:\Windows\System\oqnfumE.exe
  2⤵
  PID:7644
- C:\Windows\System\ffqafOe.exe
  C:\Windows\System\ffqafOe.exe
  2⤵
  PID:7844
- C:\Windows\System\SIeyHkb.exe
  C:\Windows\System\SIeyHkb.exe
  2⤵
  PID:7924
- C:\Windows\System\hByfDvy.exe
  C:\Windows\System\hByfDvy.exe
  2⤵
  PID:7892
- C:\Windows\System\DMFPKST.exe
  C:\Windows\System\DMFPKST.exe
  2⤵
  PID:7860
- C:\Windows\System\DEFypVl.exe
  C:\Windows\System\DEFypVl.exe
  2⤵
  PID:8068
- C:\Windows\System\WqeXsBd.exe
  C:\Windows\System\WqeXsBd.exe
  2⤵
  PID:8128
- C:\Windows\System\MtampVn.exe
  C:\Windows\System\MtampVn.exe
  2⤵
  PID:7408
- C:\Windows\System\wHsbsuc.exe
  C:\Windows\System\wHsbsuc.exe
  2⤵
  PID:8144
- C:\Windows\System\ZcpMaAL.exe
  C:\Windows\System\ZcpMaAL.exe
  2⤵
  PID:7680
- C:\Windows\System\pYtHaLo.exe
  C:\Windows\System\pYtHaLo.exe
  2⤵
  PID:7308
- C:\Windows\System\BkbMgJF.exe
  C:\Windows\System\BkbMgJF.exe
  2⤵
  PID:7732
- C:\Windows\System\BBPEVBc.exe
  C:\Windows\System\BBPEVBc.exe
  2⤵
  PID:7808
- C:\Windows\System\EaATzuS.exe
  C:\Windows\System\EaATzuS.exe
  2⤵
  PID:7856
- C:\Windows\System\XACGLOn.exe
  C:\Windows\System\XACGLOn.exe
  2⤵
  PID:8020
- C:\Windows\System\zMRORhS.exe
  C:\Windows\System\zMRORhS.exe
  2⤵
  PID:6280
- C:\Windows\System\dAjXYNK.exe
  C:\Windows\System\dAjXYNK.exe
  2⤵
  PID:8116
- C:\Windows\System\XXVUNCs.exe
  C:\Windows\System\XXVUNCs.exe
  2⤵
  PID:7660
- C:\Windows\System\ExrYWvD.exe
  C:\Windows\System\ExrYWvD.exe
  2⤵
  PID:7552
- C:\Windows\System\vVMJDEn.exe
  C:\Windows\System\vVMJDEn.exe
  2⤵
  PID:6572
- C:\Windows\System\JeVqoOr.exe
  C:\Windows\System\JeVqoOr.exe
  2⤵
  PID:7312
- C:\Windows\System\JlhdPki.exe
  C:\Windows\System\JlhdPki.exe
  2⤵
  PID:7532
- C:\Windows\System\YCEQODB.exe
  C:\Windows\System\YCEQODB.exe
  2⤵
  PID:8064
- C:\Windows\System\BjCiPnh.exe
  C:\Windows\System\BjCiPnh.exe
  2⤵
  PID:8204
- C:\Windows\System\ucCNOON.exe
  C:\Windows\System\ucCNOON.exe
  2⤵
  PID:8220
- C:\Windows\System\sjcWwsk.exe
  C:\Windows\System\sjcWwsk.exe
  2⤵
  PID:8236
- C:\Windows\System\kUsXQRH.exe
  C:\Windows\System\kUsXQRH.exe
  2⤵
  PID:8252
- C:\Windows\System\niDxKBU.exe
  C:\Windows\System\niDxKBU.exe
  2⤵
  PID:8268
- C:\Windows\System\fYJDqYM.exe
  C:\Windows\System\fYJDqYM.exe
  2⤵
  PID:8284
- C:\Windows\System\CcskEPU.exe
  C:\Windows\System\CcskEPU.exe
  2⤵
  PID:8300
- C:\Windows\System\YxxyIiy.exe
  C:\Windows\System\YxxyIiy.exe
  2⤵
  PID:8316
- C:\Windows\System\MtWOENg.exe
  C:\Windows\System\MtWOENg.exe
  2⤵
  PID:8332
- C:\Windows\System\hkmEXPf.exe
  C:\Windows\System\hkmEXPf.exe
  2⤵
  PID:8348
- C:\Windows\System\xentvuR.exe
  C:\Windows\System\xentvuR.exe
  2⤵
  PID:8364
- C:\Windows\System\gBxKIDx.exe
  C:\Windows\System\gBxKIDx.exe
  2⤵
  PID:8380
- C:\Windows\System\KLZDvNw.exe
  C:\Windows\System\KLZDvNw.exe
  2⤵
  PID:8396
- C:\Windows\System\YNNdIFK.exe
  C:\Windows\System\YNNdIFK.exe
  2⤵
  PID:8412
- C:\Windows\System\AqtsjYW.exe
  C:\Windows\System\AqtsjYW.exe
  2⤵
  PID:8428
- C:\Windows\System\WVfbIsm.exe
  C:\Windows\System\WVfbIsm.exe
  2⤵
  PID:8444
- C:\Windows\System\zNkzjRg.exe
  C:\Windows\System\zNkzjRg.exe
  2⤵
  PID:8460
- C:\Windows\System\mTZBKpS.exe
  C:\Windows\System\mTZBKpS.exe
  2⤵
  PID:8476
- C:\Windows\System\nMaNvRP.exe
  C:\Windows\System\nMaNvRP.exe
  2⤵
  PID:8492
- C:\Windows\System\rmkKzHB.exe
  C:\Windows\System\rmkKzHB.exe
  2⤵
  PID:8508
- C:\Windows\System\mGFiBtV.exe
  C:\Windows\System\mGFiBtV.exe
  2⤵
  PID:8524
- C:\Windows\System\KBromyQ.exe
  C:\Windows\System\KBromyQ.exe
  2⤵
  PID:8540
- C:\Windows\System\TSuvugK.exe
  C:\Windows\System\TSuvugK.exe
  2⤵
  PID:8556
- C:\Windows\System\gCsKDMb.exe
  C:\Windows\System\gCsKDMb.exe
  2⤵
  PID:8572
- C:\Windows\System\hLLrhXA.exe
  C:\Windows\System\hLLrhXA.exe
  2⤵
  PID:8588
- C:\Windows\System\cSRGSHs.exe
  C:\Windows\System\cSRGSHs.exe
  2⤵
  PID:8604
- C:\Windows\System\zqNCBUi.exe
  C:\Windows\System\zqNCBUi.exe
  2⤵
  PID:8620
- C:\Windows\System\KlubGaz.exe
  C:\Windows\System\KlubGaz.exe
  2⤵
  PID:8636
- C:\Windows\System\SthRkxc.exe
  C:\Windows\System\SthRkxc.exe
  2⤵
  PID:8652
- C:\Windows\System\ZXGFuck.exe
  C:\Windows\System\ZXGFuck.exe
  2⤵
  PID:8668
- C:\Windows\System\KUnALAa.exe
  C:\Windows\System\KUnALAa.exe
  2⤵
  PID:8684
- C:\Windows\System\rKWPFlH.exe
  C:\Windows\System\rKWPFlH.exe
  2⤵
  PID:8700
- C:\Windows\System\BcuEMua.exe
  C:\Windows\System\BcuEMua.exe
  2⤵
  PID:8716
- C:\Windows\System\GTnMWdT.exe
  C:\Windows\System\GTnMWdT.exe
  2⤵
  PID:8732
- C:\Windows\System\zoHIeIP.exe
  C:\Windows\System\zoHIeIP.exe
  2⤵
  PID:8748
- C:\Windows\System\yntrvGz.exe
  C:\Windows\System\yntrvGz.exe
  2⤵
  PID:8764
- C:\Windows\System\FnSPWfA.exe
  C:\Windows\System\FnSPWfA.exe
  2⤵
  PID:8780
- C:\Windows\System\lahSptz.exe
  C:\Windows\System\lahSptz.exe
  2⤵
  PID:8796
- C:\Windows\System\qZecfjg.exe
  C:\Windows\System\qZecfjg.exe
  2⤵
  PID:8812
- C:\Windows\System\bPtlLWB.exe
  C:\Windows\System\bPtlLWB.exe
  2⤵
  PID:8828
- C:\Windows\System\MUxzYUC.exe
  C:\Windows\System\MUxzYUC.exe
  2⤵
  PID:8844
- C:\Windows\System\PzgiCcd.exe
  C:\Windows\System\PzgiCcd.exe
  2⤵
  PID:8860
- C:\Windows\System\ixVAoot.exe
  C:\Windows\System\ixVAoot.exe
  2⤵
  PID:8876
- C:\Windows\System\FXqQBlP.exe
  C:\Windows\System\FXqQBlP.exe
  2⤵
  PID:8892
- C:\Windows\System\ECmbxvt.exe
  C:\Windows\System\ECmbxvt.exe
  2⤵
  PID:8908
- C:\Windows\System\PIkGcdi.exe
  C:\Windows\System\PIkGcdi.exe
  2⤵
  PID:8924
- C:\Windows\System\vVBHUUA.exe
  C:\Windows\System\vVBHUUA.exe
  2⤵
  PID:8940
- C:\Windows\System\HGgpATX.exe
  C:\Windows\System\HGgpATX.exe
  2⤵
  PID:8956
- C:\Windows\System\lVpnwol.exe
  C:\Windows\System\lVpnwol.exe
  2⤵
  PID:8972
- C:\Windows\System\utiHpah.exe
  C:\Windows\System\utiHpah.exe
  2⤵
  PID:8988
- C:\Windows\System\bqmZjYI.exe
  C:\Windows\System\bqmZjYI.exe
  2⤵
  PID:9004
- C:\Windows\System\EBSFLAy.exe
  C:\Windows\System\EBSFLAy.exe
  2⤵
  PID:9020
- C:\Windows\System\KOeqtwQ.exe
  C:\Windows\System\KOeqtwQ.exe
  2⤵
  PID:9036
- C:\Windows\System\qBLFVqB.exe
  C:\Windows\System\qBLFVqB.exe
  2⤵
  PID:9052
- C:\Windows\System\bdsxvsN.exe
  C:\Windows\System\bdsxvsN.exe
  2⤵
  PID:9068
- C:\Windows\System\TodrQRv.exe
  C:\Windows\System\TodrQRv.exe
  2⤵
  PID:9084
- C:\Windows\System\vQyRdhr.exe
  C:\Windows\System\vQyRdhr.exe
  2⤵
  PID:9100
- C:\Windows\System\cYtBEvo.exe
  C:\Windows\System\cYtBEvo.exe
  2⤵
  PID:9116
- C:\Windows\System\drBdVOc.exe
  C:\Windows\System\drBdVOc.exe
  2⤵
  PID:9132
- C:\Windows\System\msYBPLT.exe
  C:\Windows\System\msYBPLT.exe
  2⤵
  PID:9148
- C:\Windows\System\pnXTwAO.exe
  C:\Windows\System\pnXTwAO.exe
  2⤵
  PID:9164
- C:\Windows\System\EBzNBUL.exe
  C:\Windows\System\EBzNBUL.exe
  2⤵
  PID:9180
- C:\Windows\System\bRHdwRk.exe
  C:\Windows\System\bRHdwRk.exe
  2⤵
  PID:9196
- C:\Windows\System\KaJCsBi.exe
  C:\Windows\System\KaJCsBi.exe
  2⤵
  PID:9212
- C:\Windows\System\iENdSFl.exe
  C:\Windows\System\iENdSFl.exe
  2⤵
  PID:7956
- C:\Windows\System\oSGxAow.exe
  C:\Windows\System\oSGxAow.exe
  2⤵
  PID:8276
- C:\Windows\System\MuoOFvJ.exe
  C:\Windows\System\MuoOFvJ.exe
  2⤵
  PID:8264
- C:\Windows\System\NExUHcE.exe
  C:\Windows\System\NExUHcE.exe
  2⤵
  PID:8200
- C:\Windows\System\jrvNuMj.exe
  C:\Windows\System\jrvNuMj.exe
  2⤵
  PID:8324
- C:\Windows\System\MhDCmRy.exe
  C:\Windows\System\MhDCmRy.exe
  2⤵
  PID:8372
- C:\Windows\System\mqaRyal.exe
  C:\Windows\System\mqaRyal.exe
  2⤵
  PID:8404
- C:\Windows\System\UIJzmPk.exe
  C:\Windows\System\UIJzmPk.exe
  2⤵
  PID:8440
- C:\Windows\System\xPeMuRs.exe
  C:\Windows\System\xPeMuRs.exe
  2⤵
  PID:8452
- C:\Windows\System\oUSKFFb.exe
  C:\Windows\System\oUSKFFb.exe
  2⤵
  PID:8500
- C:\Windows\System\wwRPpcE.exe
  C:\Windows\System\wwRPpcE.exe
  2⤵
  PID:8564
- C:\Windows\System\yOkuagn.exe
  C:\Windows\System\yOkuagn.exe
  2⤵
  PID:8520
- C:\Windows\System\sFNogfA.exe
  C:\Windows\System\sFNogfA.exe
  2⤵
  PID:8488
- C:\Windows\System\YyiqSjU.exe
  C:\Windows\System\YyiqSjU.exe
  2⤵
  PID:8600
- C:\Windows\System\FLlGEru.exe
  C:\Windows\System\FLlGEru.exe
  2⤵
  PID:8660
- C:\Windows\System\LIooeDU.exe
  C:\Windows\System\LIooeDU.exe
  2⤵
  PID:8724
- C:\Windows\System\qNukNRT.exe
  C:\Windows\System\qNukNRT.exe
  2⤵
  PID:8788
- C:\Windows\System\mesvzDi.exe
  C:\Windows\System\mesvzDi.exe
  2⤵
  PID:8708
- C:\Windows\System\vLjUULO.exe
  C:\Windows\System\vLjUULO.exe
  2⤵
  PID:8676
- C:\Windows\System\IPpoaFz.exe
  C:\Windows\System\IPpoaFz.exe
  2⤵
  PID:8884
- C:\Windows\System\jwTgrvH.exe
  C:\Windows\System\jwTgrvH.exe
  2⤵
  PID:8712
- C:\Windows\System\BFbHIhO.exe
  C:\Windows\System\BFbHIhO.exe
  2⤵
  PID:8744
- C:\Windows\System\xsEvnCX.exe
  C:\Windows\System\xsEvnCX.exe
  2⤵
  PID:8952
- C:\Windows\System\SyZxPNt.exe
  C:\Windows\System\SyZxPNt.exe
  2⤵
  PID:8980
- C:\Windows\System\ZyGFNio.exe
  C:\Windows\System\ZyGFNio.exe
  2⤵
  PID:8964
- C:\Windows\System\DVSDPOd.exe
  C:\Windows\System\DVSDPOd.exe
  2⤵
  PID:8904
- C:\Windows\System\qigazAi.exe
  C:\Windows\System\qigazAi.exe
  2⤵
  PID:9000
- C:\Windows\System\HiUXTeC.exe
  C:\Windows\System\HiUXTeC.exe
  2⤵
  PID:9080
- C:\Windows\System\zUhVHbk.exe
  C:\Windows\System\zUhVHbk.exe
  2⤵
  PID:9144
- C:\Windows\System\fVabzFv.exe
  C:\Windows\System\fVabzFv.exe
  2⤵
  PID:9176
- C:\Windows\System\VwSJvJk.exe
  C:\Windows\System\VwSJvJk.exe
  2⤵
  PID:9124
- C:\Windows\System\OexNsjM.exe
  C:\Windows\System\OexNsjM.exe
  2⤵
  PID:9188
- C:\Windows\System\XBGPGtG.exe
  C:\Windows\System\XBGPGtG.exe
  2⤵
  PID:9192
- C:\Windows\System\fuXeglI.exe
  C:\Windows\System\fuXeglI.exe
  2⤵
  PID:8340
- C:\Windows\System\uNAlmdN.exe
  C:\Windows\System\uNAlmdN.exe
  2⤵
  PID:8296
- C:\Windows\System\RbOgNmo.exe
  C:\Windows\System\RbOgNmo.exe
  2⤵
  PID:8436
- C:\Windows\System\BLZzsnr.exe
  C:\Windows\System\BLZzsnr.exe
  2⤵
  PID:8388
- C:\Windows\System\jfuVcLD.exe
  C:\Windows\System\jfuVcLD.exe
  2⤵
  PID:8536
- C:\Windows\System\RcWHZpL.exe
  C:\Windows\System\RcWHZpL.exe
  2⤵
  PID:8584
- C:\Windows\System\FrSUcBx.exe
  C:\Windows\System\FrSUcBx.exe
  2⤵
  PID:8616
- C:\Windows\System\cxGUNEB.exe
  C:\Windows\System\cxGUNEB.exe
  2⤵
  PID:8756
- C:\Windows\System\HLDsuil.exe
  C:\Windows\System\HLDsuil.exe
  2⤵
  PID:8612
- C:\Windows\System\yuexXrs.exe
  C:\Windows\System\yuexXrs.exe
  2⤵
  PID:8852
- C:\Windows\System\SKvOjNF.exe
  C:\Windows\System\SKvOjNF.exe
  2⤵
  PID:8948
- C:\Windows\System\lAjDJXT.exe
  C:\Windows\System\lAjDJXT.exe
  2⤵
  PID:9028
- C:\Windows\System\OMCSejq.exe
  C:\Windows\System\OMCSejq.exe
  2⤵
  PID:9012
- C:\Windows\System\dOpVgFI.exe
  C:\Windows\System\dOpVgFI.exe
  2⤵
  PID:8244
- C:\Windows\System\JkPyjuF.exe
  C:\Windows\System\JkPyjuF.exe
  2⤵
  PID:9140
- C:\Windows\System\tFDeoVR.exe
  C:\Windows\System\tFDeoVR.exe
  2⤵
  PID:8356
- C:\Windows\System\ZRqiZqb.exe
  C:\Windows\System\ZRqiZqb.exe
  2⤵
  PID:8484
- C:\Windows\System\GWRSobl.exe
  C:\Windows\System\GWRSobl.exe
  2⤵
  PID:8472
- C:\Windows\System\mCkMUUR.exe
  C:\Windows\System\mCkMUUR.exe
  2⤵
  PID:8596
- C:\Windows\System\fWovQLB.exe
  C:\Windows\System\fWovQLB.exe
  2⤵
  PID:8920
- C:\Windows\System\COAUzyw.exe
  C:\Windows\System\COAUzyw.exe
  2⤵
  PID:9112
- C:\Windows\System\RxHMIpV.exe
  C:\Windows\System\RxHMIpV.exe
  2⤵
  PID:9320
- C:\Windows\System\TZeIAAG.exe
  C:\Windows\System\TZeIAAG.exe
  2⤵
  PID:9336
- C:\Windows\System\mkkudjy.exe
  C:\Windows\System\mkkudjy.exe
  2⤵
  PID:9360
- C:\Windows\System\nKteTeg.exe
  C:\Windows\System\nKteTeg.exe
  2⤵
  PID:9376
- C:\Windows\System\gaSdEpU.exe
  C:\Windows\System\gaSdEpU.exe
  2⤵
  PID:9400
- C:\Windows\System\aHIIJWR.exe
  C:\Windows\System\aHIIJWR.exe
  2⤵
  PID:9424
- C:\Windows\System\UAQhKEU.exe
  C:\Windows\System\UAQhKEU.exe
  2⤵
  PID:9460
- C:\Windows\System\BlKlqlc.exe
  C:\Windows\System\BlKlqlc.exe
  2⤵
  PID:9552
- C:\Windows\System\jdGfuHX.exe
  C:\Windows\System\jdGfuHX.exe
  2⤵
  PID:9572
- C:\Windows\System\xBTstKP.exe
  C:\Windows\System\xBTstKP.exe
  2⤵
  PID:9588
- C:\Windows\System\eFQEyem.exe
  C:\Windows\System\eFQEyem.exe
  2⤵
  PID:9604
- C:\Windows\System\eiHIReb.exe
  C:\Windows\System\eiHIReb.exe
  2⤵
  PID:9620
- C:\Windows\System\lIiUUTZ.exe
  C:\Windows\System\lIiUUTZ.exe
  2⤵
  PID:9636
- C:\Windows\System\ZwderZX.exe
  C:\Windows\System\ZwderZX.exe
  2⤵
  PID:9656
- C:\Windows\System\rywlVQe.exe
  C:\Windows\System\rywlVQe.exe
  2⤵
  PID:9672
- C:\Windows\System\fbEWIZW.exe
  C:\Windows\System\fbEWIZW.exe
  2⤵
  PID:9688
- C:\Windows\System\EsbKUEv.exe
  C:\Windows\System\EsbKUEv.exe
  2⤵
  PID:9704
- C:\Windows\System\ZhUbHES.exe
  C:\Windows\System\ZhUbHES.exe
  2⤵
  PID:9720
- C:\Windows\System\NBBTPgW.exe
  C:\Windows\System\NBBTPgW.exe
  2⤵
  PID:9736
- C:\Windows\System\tbsABnH.exe
  C:\Windows\System\tbsABnH.exe
  2⤵
  PID:9752
- C:\Windows\System\tnRUmvW.exe
  C:\Windows\System\tnRUmvW.exe
  2⤵
  PID:9768
- C:\Windows\System\DLKHFzE.exe
  C:\Windows\System\DLKHFzE.exe
  2⤵
  PID:9784
- C:\Windows\System\HZMJAZY.exe
  C:\Windows\System\HZMJAZY.exe
  2⤵
  PID:9800
- C:\Windows\System\KwWYEIU.exe
  C:\Windows\System\KwWYEIU.exe
  2⤵
  PID:9816
- C:\Windows\System\ZIswWtL.exe
  C:\Windows\System\ZIswWtL.exe
  2⤵
  PID:9832
- C:\Windows\System\VVStyxG.exe
  C:\Windows\System\VVStyxG.exe
  2⤵
  PID:9848
- C:\Windows\System\TNgPbbb.exe
  C:\Windows\System\TNgPbbb.exe
  2⤵
  PID:9864
- C:\Windows\System\CbRUSNV.exe
  C:\Windows\System\CbRUSNV.exe
  2⤵
  PID:9880
- C:\Windows\System\AAHDvsg.exe
  C:\Windows\System\AAHDvsg.exe
  2⤵
  PID:9896
- C:\Windows\System\jFLsiVH.exe
  C:\Windows\System\jFLsiVH.exe
  2⤵
  PID:9912
- C:\Windows\System\JProIOI.exe
  C:\Windows\System\JProIOI.exe
  2⤵
  PID:9928
- C:\Windows\System\miAWASp.exe
  C:\Windows\System\miAWASp.exe
  2⤵
  PID:9948
- C:\Windows\System\eellAOO.exe
  C:\Windows\System\eellAOO.exe
  2⤵
  PID:9964
- C:\Windows\System\RhaPjzi.exe
  C:\Windows\System\RhaPjzi.exe
  2⤵
  PID:9980
- C:\Windows\System\rQGwWUW.exe
  C:\Windows\System\rQGwWUW.exe
  2⤵
  PID:9996
- C:\Windows\System\nuxYfNi.exe
  C:\Windows\System\nuxYfNi.exe
  2⤵
  PID:10012
- C:\Windows\System\NoIxTLx.exe
  C:\Windows\System\NoIxTLx.exe
  2⤵
  PID:10028
- C:\Windows\System\KLHYdHz.exe
  C:\Windows\System\KLHYdHz.exe
  2⤵
  PID:10044
- C:\Windows\System\UaPPpJw.exe
  C:\Windows\System\UaPPpJw.exe
  2⤵
  PID:10060
- C:\Windows\System\zTPFxYa.exe
  C:\Windows\System\zTPFxYa.exe
  2⤵
  PID:10080
- C:\Windows\System\qcsDvBt.exe
  C:\Windows\System\qcsDvBt.exe
  2⤵
  PID:10096
- C:\Windows\System\JfqiWco.exe
  C:\Windows\System\JfqiWco.exe
  2⤵
  PID:10112
- C:\Windows\System\lWgXkrM.exe
  C:\Windows\System\lWgXkrM.exe
  2⤵
  PID:10128
- C:\Windows\System\XXFWfpx.exe
  C:\Windows\System\XXFWfpx.exe
  2⤵
  PID:10144
- C:\Windows\System\tzXJMPw.exe
  C:\Windows\System\tzXJMPw.exe
  2⤵
  PID:10160
- C:\Windows\System\WHujKso.exe
  C:\Windows\System\WHujKso.exe
  2⤵
  PID:10176
- C:\Windows\System\qFdrUve.exe
  C:\Windows\System\qFdrUve.exe
  2⤵
  PID:10192
- C:\Windows\System\spzOEjT.exe
  C:\Windows\System\spzOEjT.exe
  2⤵
  PID:10208
- C:\Windows\System\mEgjkWh.exe
  C:\Windows\System\mEgjkWh.exe
  2⤵
  PID:10224
- C:\Windows\System\wVSBkVQ.exe
  C:\Windows\System\wVSBkVQ.exe
  2⤵
  PID:8312
- C:\Windows\System\TZTRgOt.exe
  C:\Windows\System\TZTRgOt.exe
  2⤵
  PID:8376
- C:\Windows\System\EEMWTck.exe
  C:\Windows\System\EEMWTck.exe
  2⤵
  PID:8808
- C:\Windows\System\vkRmllC.exe
  C:\Windows\System\vkRmllC.exe
  2⤵
  PID:9060
- C:\Windows\System\nmXFeHA.exe
  C:\Windows\System\nmXFeHA.exe
  2⤵
  PID:8936
- C:\Windows\System\SeLNknM.exe
  C:\Windows\System\SeLNknM.exe
  2⤵
  PID:9232
- C:\Windows\System\jrgDwzo.exe
  C:\Windows\System\jrgDwzo.exe
  2⤵
  PID:9156
- C:\Windows\System\HTAcQQm.exe
  C:\Windows\System\HTAcQQm.exe
  2⤵
  PID:9256
- C:\Windows\System\IMdCpFu.exe
  C:\Windows\System\IMdCpFu.exe
  2⤵
  PID:9276
- C:\Windows\System\gpZJIAu.exe
  C:\Windows\System\gpZJIAu.exe
  2⤵
  PID:9408
- C:\Windows\System\LUsUfio.exe
  C:\Windows\System\LUsUfio.exe
  2⤵
  PID:9512
- C:\Windows\System\SAZmvKF.exe
  C:\Windows\System\SAZmvKF.exe
  2⤵
  PID:9532
- C:\Windows\System\bkBIKmK.exe
  C:\Windows\System\bkBIKmK.exe
  2⤵
  PID:9548
- C:\Windows\System\RpGjGCP.exe
  C:\Windows\System\RpGjGCP.exe
  2⤵
  PID:9616
- C:\Windows\System\EeXQRQw.exe
  C:\Windows\System\EeXQRQw.exe
  2⤵
  PID:9352
- C:\Windows\System\tdVNOUb.exe
  C:\Windows\System\tdVNOUb.exe
  2⤵
  PID:9384
- C:\Windows\System\dNhzbcG.exe
  C:\Windows\System\dNhzbcG.exe
  2⤵
  PID:9680
- C:\Windows\System\rtEnnMj.exe
  C:\Windows\System\rtEnnMj.exe
  2⤵
  PID:9444
- C:\Windows\System\TGaWkNJ.exe
  C:\Windows\System\TGaWkNJ.exe
  2⤵
  PID:9564
- C:\Windows\System\kcdABRX.exe
  C:\Windows\System\kcdABRX.exe
  2⤵
  PID:9316
- C:\Windows\System\ReoTLCp.exe
  C:\Windows\System\ReoTLCp.exe
  2⤵
  PID:9632
- C:\Windows\System\jyXRksR.exe
  C:\Windows\System\jyXRksR.exe
  2⤵
  PID:9696
- C:\Windows\System\dlIXgzm.exe
  C:\Windows\System\dlIXgzm.exe
  2⤵
  PID:9728
- C:\Windows\System\yZUNpvV.exe
  C:\Windows\System\yZUNpvV.exe
  2⤵
  PID:9780
- C:\Windows\System\laOBsMb.exe
  C:\Windows\System\laOBsMb.exe
  2⤵
  PID:9812
- C:\Windows\System\MePprwJ.exe
  C:\Windows\System\MePprwJ.exe
  2⤵
  PID:9840
- C:\Windows\System\BEWeYUS.exe
  C:\Windows\System\BEWeYUS.exe
  2⤵
  PID:9904
- C:\Windows\System\DPqCCiZ.exe
  C:\Windows\System\DPqCCiZ.exe
  2⤵
  PID:9972
- C:\Windows\System\DVlFHQv.exe
  C:\Windows\System\DVlFHQv.exe
  2⤵
  PID:9956
- C:\Windows\System\AXrIzEM.exe
  C:\Windows\System\AXrIzEM.exe
  2⤵
  PID:10004
- C:\Windows\System\BgdTOOP.exe
  C:\Windows\System\BgdTOOP.exe
  2⤵
  PID:10040
- C:\Windows\System\RCTATTj.exe
  C:\Windows\System\RCTATTj.exe
  2⤵
  PID:10024
- C:\Windows\System\usMiCyz.exe
  C:\Windows\System\usMiCyz.exe
  2⤵
  PID:10088
- C:\Windows\System\TosDiCh.exe
  C:\Windows\System\TosDiCh.exe
  2⤵
  PID:10092
- C:\Windows\System\OwAZoRi.exe
  C:\Windows\System\OwAZoRi.exe
  2⤵
  PID:10152
- C:\Windows\System\WpaHFOQ.exe
  C:\Windows\System\WpaHFOQ.exe
  2⤵
  PID:10184
- C:\Windows\System\iJQFIIe.exe
  C:\Windows\System\iJQFIIe.exe
  2⤵
  PID:10236
- C:\Windows\System\eLQaeIM.exe
  C:\Windows\System\eLQaeIM.exe
  2⤵
  PID:8532
- C:\Windows\System\eyikPPd.exe
  C:\Windows\System\eyikPPd.exe
  2⤵
  PID:8212
- C:\Windows\System\TVXwZJR.exe
  C:\Windows\System\TVXwZJR.exe
  2⤵
  PID:9248
- C:\Windows\System\ctmkpIb.exe
  C:\Windows\System\ctmkpIb.exe
  2⤵
  PID:9268
- C:\Windows\System\jlRfhbN.exe
  C:\Windows\System\jlRfhbN.exe
  2⤵
  PID:9288
- C:\Windows\System\ELXgwIr.exe
  C:\Windows\System\ELXgwIr.exe
  2⤵
  PID:9312
- C:\Windows\System\WnQkeKK.exe
  C:\Windows\System\WnQkeKK.exe
  2⤵
  PID:9372
- C:\Windows\System\VuMAWQR.exe
  C:\Windows\System\VuMAWQR.exe
  2⤵
  PID:9468
- C:\Windows\System\Dttkjtl.exe
  C:\Windows\System\Dttkjtl.exe
  2⤵
  PID:9484
- C:\Windows\System\KWLSsga.exe
  C:\Windows\System\KWLSsga.exe
  2⤵
  PID:9496
- C:\Windows\System\ZYxsqQD.exe
  C:\Windows\System\ZYxsqQD.exe
  2⤵
  PID:9544
- C:\Windows\System\JluYdon.exe
  C:\Windows\System\JluYdon.exe
  2⤵
  PID:9348
- C:\Windows\System\jPIsgsZ.exe
  C:\Windows\System\jPIsgsZ.exe
  2⤵
  PID:9612
- C:\Windows\System\rpdTaUm.exe
  C:\Windows\System\rpdTaUm.exe
  2⤵
  PID:9684
- C:\Windows\System\RkSYiDk.exe
  C:\Windows\System\RkSYiDk.exe
  2⤵
  PID:9712
- C:\Windows\System\hcAuDDW.exe
  C:\Windows\System\hcAuDDW.exe
  2⤵
  PID:9668
- C:\Windows\System\NpPluYf.exe
  C:\Windows\System\NpPluYf.exe
  2⤵
  PID:9776
- C:\Windows\System\CwihDZI.exe
  C:\Windows\System\CwihDZI.exe
  2⤵
  PID:9872
- C:\Windows\System\iYGGcOL.exe
  C:\Windows\System\iYGGcOL.exe
  2⤵
  PID:9876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BIdVeUT.exe

Filesize
1.5MB

MD5
1c566f28043214755e1beb02530cd14e

SHA1
27c9dd5cc3cec54ba8042f222ca9c765ac1c70af

SHA256
18b7eb9dcde05058b7e457dcc78aa6e239730984cada5d0123c8cda41342f3fc

SHA512
02f406333eaf1c9f79858d361ba70bf956a2606a64d425a819eb681837b657b5137fba86e15c356a07e297b86c4dd871ff21d6faca220b2c5cf0132c6f31b7d8

Download Submit
C:\Windows\system\FUvYMGc.exe

Filesize
1.5MB

MD5
3a3f1134330f6ef1fc68de1b77f79c5d

SHA1
2dc938c104dd8cbdb95d1f4975953a946ccfa18d

SHA256
e35351ecea7131385214e359967fe9997c2926f8000a247a587f50095cdddff8

SHA512
ccfc0dae5a48c6802df6a217edacd4e52450d9d1ab9b6f74233757b1df31d80c777cef01e3b96639b293349cf29133b8884a4e5076c8e1281dbb1bbdbe9ecdc5

Download Submit
C:\Windows\system\GZBuDAO.exe

Filesize
1.5MB

MD5
1d6ec7f51b4c2abdd9f5cadeabd52063

SHA1
f3a8d3e3072bbd90efdbc8a5cd0e6b8cc7d88c64

SHA256
c92166cc32e8686a14d6fd0b0ac6470c6823dda7be0e6973876eb2c05c3d5c33

SHA512
de91c4c47d3acbea40c74eb84c450178aeff5c89c8033f129360715a5ef49b2cb61984a9ee59bfbb2fb9fba7f7706cf8e7bae3531a0b4ab1081af3df297edf02

Download Submit
C:\Windows\system\GvUaReU.exe

Filesize
1.5MB

MD5
805280d0f26c61bec55e1654de2e267e

SHA1
7de2d09fdfee11be19023b74f9b40c8464762ea0

SHA256
2c91f9b77f74fc533ca113a64052510dc4763c2f8b3fb472bab428a7bf6f8dd9

SHA512
e35cc6a36ade5baee7104cf5fad8f952c391c425c11d97437e00ccf893682ab1bccbf4ec6996d01084045be4839b10eb14753b7b0e3980d0e4eefec46d38bd33

Download Submit
C:\Windows\system\IsMmXxy.exe

Filesize
1.5MB

MD5
b3a816caed581e38aa4f8ce038d95082

SHA1
1c5fd7b7398b3c0dab57269f613edf5d71c54123

SHA256
afbbb7dc77e10a8000d8600dc58920e2562a2087e863adacc39d56531eac4b0d

SHA512
ec3a82666e7804e9dc3964ec678bdd1aeaca20a4e23e53f7b87c79018171aec5de206842830a36e7a54cee36b545b127d3d3c2122bcf4b478826c7cea83a8167

Download Submit
C:\Windows\system\IvsoaZy.exe

Filesize
1.5MB

MD5
36e46b9b73a68d2635f328d6c12efd25

SHA1
781c9452279707b3f93a3083b79fde70bbd15e4d

SHA256
4edf1a7e347a70fabf8f947ddb5401acc83999568af344f3155a3b7d6846bfc0

SHA512
4aff6abfcc53e1bc9dd185c3ff66ef1174548b2bf35378047d3737452fc13d42f5a3f177b7dc2fe47157164502978e7418811648d5765742c1301023b3feeac3

Download Submit
C:\Windows\system\JHOciwY.exe

Filesize
1.5MB

MD5
48bdad7d44de43b3c4d6536f380b5e75

SHA1
c8e0001f66e17c6223d09590894b76414976f04d

SHA256
3bbeb427c7b5409f0d7158b512fe0065ffc132f4fe17e43b74d503a8cc674a2a

SHA512
67a9b29ec76b97f334b5a2a0ff6e045f2be1c3c69c223591144b6d47b91abc3763f5a8f1ab22f5c6779b2eaad67df5f11401bda9bb3550a0837f191f2cbffafe

Download Submit
C:\Windows\system\NTbUNna.exe

Filesize
1.5MB

MD5
8629b2196f091ee535ba66046d0c2fb1

SHA1
fde00b204d5a5379d3801d22b9644fd982c5081f

SHA256
3d7993c29bf75f80b1a63c8f7bbe67dc25e48e3858d2ea03c0c953211f106133

SHA512
3454294d51dc6bfa2fe47f0ab914856ca090e1b72883a4d2049ec99ffd4082bb0cc93c3db56a26a62e71401a80c6746976bbc1f871a6c4f4afd94f3a4f773d0e

Download Submit
C:\Windows\system\RkxkAHT.exe

Filesize
1.5MB

MD5
599687bf61990d0579f9ddfb434f8468

SHA1
c79ce70400393f9f2acee35fcba4369ec980a38e

SHA256
43fe4719c7ae8e1866ca1897c969039815f6a30a108daaa05a05ad4043486bcb

SHA512
a7f04690ff08ceee2e590658aa4846f846c6e942106f4ceaa6e650bbec7ad80b7017186a164a85fb1403d3f59c95aa83cf77b71f6ad351b184fd226ed0fd5c37

Download Submit
C:\Windows\system\TpUaOkP.exe

Filesize
1.5MB

MD5
764148d7fb4026a5a0447f7100fe4467

SHA1
01c296bdba87175be612ec0b1ce719639eef0e2b

SHA256
80a33c0e624114f188055ce7578e3ea43f32c6c2be8109053cdbfec34e90c4d9

SHA512
e721ea3ff0a89daf4d3f787872acd2612fc30bd1a009ee19a535c8c00f09f898dfa29556627e129044f7c13b7f5b61b9d8c190ffce50e9c2551bc743fdc1e03c

Download Submit
C:\Windows\system\XoklZjk.exe

Filesize
1.5MB

MD5
f089ffe60ca604fe078ecb1ea1a3f8fd

SHA1
607a985a0c097db7d43b49394884efabb91df334

SHA256
4990882d3c021753ac5e4eab6e073e55f6b4921779a3d07e52c42293bd1ce5e6

SHA512
16bfdf4b748650f3b99564a904e90a61ff0af6c6112de6a3b5d2e0b1444d95dd126b986b1964ea268c7b7c8a81ee290e8d29f3e7e3c2c4ef80885c398893ca0d

Download Submit
C:\Windows\system\YQPEGQR.exe

Filesize
1.5MB

MD5
8376aaa8c99928a2eb5f70625a25d825

SHA1
8885f2d2b87f611b75221f812af03788bf9648c5

SHA256
afeed0b3a87382bbba30c259fa873e690174dd9b838f4480b25e916efcc83841

SHA512
dc43f38feb2d27827af6738de36cc935e6c8e8d0521f264fcddedc03333ea113e979fa8dcbbb9dc6933e6ebbd79d444942012a548b5fa05104269decb17ac33f

Download Submit
C:\Windows\system\ZetWqgY.exe

Filesize
1.5MB

MD5
c4331abaa928ebeff7ecce6242957e62

SHA1
5badbb9db55abc272c4bec82f9ee1f1203321b21

SHA256
2ffe82d7fb6391263f35551157bc47ef57a836e3c8782d06ae40e88e654881f1

SHA512
a080edbe39b8cbe9f6c868acf366cc0ed82fdc632fed201bf29768b22cb40b6d28f9b82dd767bca0863b3098c82bc5b355bab69250c6977fad4a3cd27969322c

Download Submit
C:\Windows\system\aqfpjNC.exe

Filesize
1.5MB

MD5
441958dbef4c8f77eee22c8f3e310857

SHA1
226386af8c88e849fcb2f5b45d736ef2f82408d0

SHA256
49f5d39e12f35e0b3afe734c324dac9cd039bfedacff21a2e644a2e24a9bc257

SHA512
445730d4795336b91fd5991f1a1204421740384f7963cb20a489acab6b5e16c56b6d54b5cf0421aa67d3bc002dbc8d06a269fec33acf76f010ff34fd68a370ff

Download Submit
C:\Windows\system\bhuzQyT.exe

Filesize
1.5MB

MD5
6fc97763d571ea6d3c847abf631496d2

SHA1
d9570f69a5b8a4c9a17f4835ec0220adedad49f2

SHA256
4f2db01feeb4a06fbd86e957801a8eebfef29d1a7cc88f9eb3f2bdd1efc80b1a

SHA512
3f92a3ed20297ad4d71e7cdc455fb37b2c4b171fcdd8a12da5444b5542c423ebb0703be4a9edef679627ba7ff2e6fa1e899f8bf34e762ab83ec2cfc1647db29b

Download Submit
C:\Windows\system\cCxyoGs.exe

Filesize
1.5MB

MD5
5fe9e7b57a503d91aa15230a50b845f1

SHA1
96b280fa1af1ccba9111c56c3476e970b9088e31

SHA256
cabda1fe6f276902476a1b71efd355b05acd18a4a5992fa5006d1a57cd04f726

SHA512
2d26a8c439a3382f2bbc59c115067e5b115fd0f4f6ba96babb75bdda40dda8e4e490f0529e708f2952a18e346cd09c9e64e9094ca60af90d98ff6839aeab3e7d

Download Submit
C:\Windows\system\fVotWJK.exe

Filesize
1.5MB

MD5
c909873fb00a049f07bcd7cf2db00100

SHA1
deac7f32b1027488ca103bdb3213554a40d56525

SHA256
a2d5fac9131bf05933a578979090cc0b188ce22a3f0ef502805f033036c1f12a

SHA512
829cf7079a7944bc9246c1c127d92f9ca4d36ebc3efda5a93e5591d13b2468bd5e13f78dd3312730d3dec009c149e1d51a7c1af4059fc6b3f9e415c9dbf25a46

Download Submit
C:\Windows\system\fjiWVfv.exe

Filesize
1.5MB

MD5
55d839a392511edcc889117264c3428d

SHA1
2665bfc2eb998ed723b1dadfe6069be454b9eca8

SHA256
29d7388a6afa13f917a7df64a0f013b81278a3f3d373de1757e3ff32ec152dc4

SHA512
464624088a7062e9e8c5aa7cc5294354077b0caf65964b3f13a865df1ee85bff9c7b5aff6489d4222dfdc82c9027ece0bc751a48fa54d8add52e22193b73f1e4

Download Submit
C:\Windows\system\gonnvMK.exe

Filesize
1.5MB

MD5
8742688651c6cf189cab031145bf32e1

SHA1
1a03d2a9dc069747c23218ec8e29abe1a6876e89

SHA256
77ff0f6f3721ab6fb603c1aec375c0f3cd5c0d07bbae043f882e230943701d02

SHA512
51bc343b6294b8f1dc4a540bbaa30d3dace7fd0d53b3054e63842832767e83a5c79ee616b4fb19e99c60c3d174b5c6bc9d5cd6ed9c36a4c017e56127dc5e8f3a

Download Submit
C:\Windows\system\hXHAujB.exe

Filesize
1.5MB

MD5
5b150f79e5889fc14a331ca710e87216

SHA1
f58f6095b6982f16705268d8258566943d8febdd

SHA256
ddf872217ca4480a472c2f94c1cf46cf31c3deb289bbbd33c83543811a4eebe7

SHA512
dc9459a866d50b6bf18c00a04499e25a253c1c64d9f85e21a69b1ca066ffda7a9f10f0d4b24833c4d347c8383663f8d381e2624edc32957aa51127523e394284

Download Submit
C:\Windows\system\hfBTiCj.exe

Filesize
1.5MB

MD5
d9c7dfa55cbc1978c3229134192c0e01

SHA1
7c733a977da76a5ae11bef0e982bfaf11d468aea

SHA256
124c031037011b26b54962a84c937d6afac0bbe0c4013f008ee94b97ca0f97b9

SHA512
4d27a8cb69ae49afb1e7335b63510d895e89247c84d805b67f2ac3ffa179d5adfaf569e527f5148c3f176bfd46a093064d8700879a5b11ff4d7602aa97e5637e

Download Submit
C:\Windows\system\hhIkmCG.exe

Filesize
1.5MB

MD5
214f9865b7c6334455639774347a9ab9

SHA1
571d83791cd1b52aa25adc963ebf79cac7890e1a

SHA256
b21f3eeac97fdbe719f4175a8914dd36d7168287a2cf8f8872aa5d59adbde251

SHA512
4abe8507b180d2d92108df1ce783c947ccff369e347cb6d492a8534e6b96dbddcc7355c9fbfbe2296259ab6eb4348978a08c2fc3ee2510b1fa0cde2ffe1b2a9c

Download Submit
C:\Windows\system\jNTvtNB.exe

Filesize
1.5MB

MD5
2cd51171ce2161ea8601c07518b9281d

SHA1
da8d8687e5104d8a4bd297aa8ae98ce7251f5f67

SHA256
dff1992a60fd7e1e6988c2cfe884240bc7d89ea18e78ed7c6afdaba697af95f2

SHA512
305a6dddb6441c67179c33ad2778e4460a78f5eb92b2c8ff37c3ac7423f74ba227ca6bd7fd15dd0625bf0cb9951df524d606406f90f7ec0a651a5f1fcea59583

Download Submit
C:\Windows\system\juXkRGH.exe

Filesize
1.5MB

MD5
62886648b04d64a0a924e52f28a998b6

SHA1
a2129239202172354dfabc5837ab49a1f606bdc0

SHA256
a286d420bcb0700e0758b8790e33edc8c86260f1243d818ac6429a1d01f94f35

SHA512
fcde72e54425657e144b7886f94423684547b4665876383c8cdc6a4738774c22d1ee3fc71cec55c928932be069828f8b512609671bc64081b128e9e6c3197f6a

Download Submit
C:\Windows\system\lSgTxeS.exe

Filesize
1.5MB

MD5
a9d65cd1796b10c28c784992a3879167

SHA1
5b2771702c1965fec5235b4fcc1690d5df7a7b9a

SHA256
6b3538961299a2d19291b326f298ae50c3c170dca4fafc9e5ba36f0cdd61a42d

SHA512
61b7af8fc916eba879722cb6df968baf362ea95bcd1727a537cbbb3ff21a385ab8472f4b736a490c5c0a557392d694f05bfbe53d646dd75979e39e83bc92c601

Download Submit
C:\Windows\system\rDWtOUp.exe

Filesize
1.5MB

MD5
110b871a82128964d68510162af5bed3

SHA1
ec45fccf9b7067dc4c4dfc94d7e5adf9ce4c2582

SHA256
9e4d851bda4f6fbad53b09bb9190129dd4b9d0ddda217c191f68e099d727235b

SHA512
d5bc211080f973b6f648336bf81831669d5469acc42d95d045d6b4e9c69b752c2989a94ba6ea8cec97aade0a263e72fabfa88496707c075f258fa1a8c361fd21

Download Submit
C:\Windows\system\sTPaPYS.exe

Filesize
1.5MB

MD5
44465ca06b55cda59a3f040d3a949c9b

SHA1
e2c75f178ea6e719dea4bae525cb7d7a12c66b1c

SHA256
c9b19a3697fc8f9a8fdc5626305a6ad2e716cdee60f95d9c5c490f95bb833a5f

SHA512
f759da9f629ce6899b3d6672a029493c73f898b482299844df1793f6ddd7dccd54338257740f7ff50e16ecc71c7bdc110b977c1e38cb246e2684ff814d319601

Download Submit
C:\Windows\system\sZvEDrr.exe

Filesize
1.5MB

MD5
6c092d0bbb28ee68eb8a983e333a6c86

SHA1
eb858e5c844280850fee307222739d7cdb82bc0d

SHA256
17e49cfbaca69ed8c62da4db8738c8b7068446a7678504f52ae84d0eb4738bf6

SHA512
1f7eaa31623e50f69d8d264bd1201fa88a8a0ea387270f31754eb3452b7c549581b3a7397e6790f9c1e6aee4bc868167ac11e696ff434ff9a6b22f9decbd018c

Download Submit
C:\Windows\system\vjFwSBa.exe

Filesize
1.5MB

MD5
be79e0d451f15b43351d5af4b6045843

SHA1
5a4c5891d78edc93a2bd1cf9e0aac2d35c9d72fe

SHA256
c385a48b6b66083d6718dac31e05ad47ad726b644b0f8d52ba9df7028a6e9279

SHA512
c04213fc76b96c140708bb3758816d30b3e51d7290890eb05f6d750589e9ecb749b7472dd3d2f8cde1d1bb2e08ee2d8c55d71342852597084128f9006616959f

Download Submit
C:\Windows\system\yXKqdYJ.exe

Filesize
1.5MB

MD5
0997c753c3bf1a40c75c44fdb61151b6

SHA1
802944dacf6631f21a1878385da90a976326ed7d

SHA256
8849d49297c92626ea643bb53dce3f88c842fe6ea41ed62eb393bf7f58678b84

SHA512
714443fd585f1dd79a4a682ea9bbd71128340b2a1321533edbb6640ab9d2b8f61a7c6990e7c209001f1374d4493eea5d9f59a5fd8c2ab992ffbc3bf69b1a7e53

Download Submit
C:\Windows\system\zJMagzH.exe

Filesize
1.5MB

MD5
4def01015c694e895fd986a29b62f4d0

SHA1
b4ad390b7fdd3f31d87d009ddd898036979c26f8

SHA256
f60217cf21074fee0c071fd8d2cb7967044c6160841c0028082902f7f6f86e14

SHA512
3effd18cc7a905d722933421069ebf9165565dbeeb9565f84f4c6127889e0067456429eb67c0f69319df5953888ee90a2f8b11e527d35762c46b42b4a5b6dc7a

Download Submit
\Windows\system\TMHOhCt.exe

Filesize
1.5MB

MD5
9b870ceb57f5ac374637889f933a7977

SHA1
75568c22a49dc8a842a19848446d5a34c9e03c49

SHA256
db670c379c7bb505860152c30b56505f6b3d816b27be3cd24e607ac98170ba41

SHA512
d29a7a2a576cbf0e1045b863a2a602851b61811c697337277ea0b405fdf4db1373fae8dc96812f7b9f8c5b3f5faca361065b52d3034fc2ac6df93a821786df6e

Download Submit
memory/2960-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download