xmrig | 148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
Size

1001KB
MD5

3ba93b6e77c7d93173c3b3e302b758a2
SHA1

18d6b807a7aa648329d09f70f9fcdd589d76cae9
SHA256

148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214
SHA512

92490727a231a07d2d967f5f1d98757e9bce378a5775758de60e07511776906d8ada2d6e0b1f7c4386dba3bd9e7693c3702be4cff588633baeba5616c54a4cb2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrb:GezaTF8FcNkNdfE0pZ9ozttwIRQn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012281-2.dat	xmrig
behavioral1/files/0x0008000000016c66-9.dat	xmrig
behavioral1/files/0x0007000000016c88-8.dat	xmrig
behavioral1/files/0x0008000000016ecf-34.dat	xmrig
behavioral1/files/0x000600000001755b-54.dat	xmrig
behavioral1/files/0x0005000000018704-83.dat	xmrig
behavioral1/files/0x000500000001878e-97.dat	xmrig
behavioral1/files/0x0006000000018b4e-108.dat	xmrig
behavioral1/files/0x0005000000019297-155.dat	xmrig
behavioral1/files/0x00050000000193b6-159.dat	xmrig
behavioral1/files/0x0005000000019360-149.dat	xmrig
behavioral1/files/0x0005000000019278-141.dat	xmrig
behavioral1/files/0x00050000000193a6-154.dat	xmrig
behavioral1/files/0x000500000001933f-145.dat	xmrig
behavioral1/files/0x0005000000019250-123.dat	xmrig
behavioral1/files/0x0005000000019284-136.dat	xmrig
behavioral1/files/0x0006000000018c16-113.dat	xmrig
behavioral1/files/0x0005000000019269-127.dat	xmrig
behavioral1/files/0x0005000000019246-118.dat	xmrig
behavioral1/files/0x00050000000187a8-103.dat	xmrig
behavioral1/files/0x0005000000018744-93.dat	xmrig
behavioral1/files/0x0005000000018739-87.dat	xmrig
behavioral1/files/0x00050000000186f4-78.dat	xmrig
behavioral1/files/0x00050000000186f1-73.dat	xmrig
behavioral1/files/0x00050000000186ed-68.dat	xmrig
behavioral1/files/0x00050000000186e7-63.dat	xmrig
behavioral1/files/0x0005000000018686-57.dat	xmrig
behavioral1/files/0x0006000000017497-44.dat	xmrig
behavioral1/files/0x000600000001749c-47.dat	xmrig
behavioral1/files/0x0006000000017049-37.dat	xmrig
behavioral1/files/0x0007000000016cf5-24.dat	xmrig
behavioral1/files/0x000a000000016d2a-27.dat	xmrig
behavioral1/files/0x0007000000016cd7-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2568	ZGTNEBl.exe
2004	oHfvRsS.exe
2376	aGkSgqZ.exe
2552	FlVjrCu.exe
3068	vDocWKI.exe
2400	DTKKFKI.exe
2740	YGdZCOj.exe
2756	nKAMidz.exe
2852	CZaGLKF.exe
3008	MsFMlem.exe
2336	UajFiLb.exe
2912	YOKsuZC.exe
2208	fJJVaYR.exe
2976	ZzGusRH.exe
2884	VOyIChv.exe
2648	OHgLMpd.exe
2680	qQPWZiv.exe
1192	STEcaTY.exe
980	PUGnZiU.exe
1660	SdhMCHD.exe
796	CDUdqTE.exe
1656	LdlGHRy.exe
2464	UNwjLLh.exe
1976	AZwayoT.exe
1812	PdxBLhD.exe
2952	hPiJaIH.exe
1872	ThHoAmB.exe
2708	RJzwCck.exe
2112	yQOBmPV.exe
1096	nCnXXIk.exe
2456	azvKlkB.exe
568	FqGbgmL.exe
632	TeGYTXu.exe
1260	BCSzlaz.exe
2244	RcEkLyu.exe
896	RtqWJeU.exe
952	nvkuQzF.exe
1724	KrglKvR.exe
1640	YHvEbll.exe
2044	zqbpwzW.exe
2164	usfEbPQ.exe
492	GnGCwmr.exe
1984	aqYxVzX.exe
1804	nqTqaWR.exe
1772	sGcNmhQ.exe
656	CYVOpXh.exe
760	RTHVTkI.exe
1048	KMGavgk.exe
2352	IwoWruT.exe
2072	XYSdVhN.exe
624	zSEJcWE.exe
576	zJavwvN.exe
1544	zZsRPEx.exe
2200	LGOzXSC.exe
320	hJGRydJ.exe
872	xwrskOV.exe
1668	WYBANpH.exe
2340	dDMMnmn.exe
2604	hPdtWwX.exe
1864	QpFbSyh.exe
2588	SyxikVA.exe
2984	Umqosxr.exe
2776	RekkcTn.exe
2828	mLqzQFr.exe

Loads dropped DLL 64 IoCs

pid	Process
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XtyQixi.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\mmCECTB.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\MOdcaKk.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\iLfxfku.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\lyygGOV.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\UFoURsd.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ZGTNEBl.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\jkpuEBv.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ruGRKDE.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\aVCggEe.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\nMEkzoW.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\NTAZjLj.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\cPEvdjn.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ZjdzKYU.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\DedxinI.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\PPNfuvl.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\HQAjUDz.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\MQHezfY.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\llhhhvm.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\nEvuHYZ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\XRKtlXs.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\jaDbSmN.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\cOPeHeJ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ldjWWuV.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\JTaaXpw.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\hZihVuZ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\GjpcGSC.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\odCbQHa.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\FlVjrCu.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\KrglKvR.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\nKtsHUL.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\PjNiyEM.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\mlLfHAa.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ZGyWIct.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\jwVUxTL.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\csgblyO.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\FAgoplh.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\xcbarse.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\OTjqjRC.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\BLxykES.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\CYVOpXh.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\BfhqVPG.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\URIiebf.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\fYwQyXi.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\tSWJQuE.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\yGBNFWv.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\UJEOHRB.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\JeyJrgc.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\yZsdGAR.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\MlKywyM.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\vTWtaKK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\FsihaYd.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\nxcQEHU.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\GXhGEVm.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\dkBXkpP.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\BetSYwc.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\GGUEtWO.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\CmPVqzk.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\CFhkQwF.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\AXdDpAE.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\hpYgJZK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\DJOVPzs.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\BCSzlaz.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\TYZyKAL.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2568	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	31
PID 2092 wrote to memory of 2568	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	31
PID 2092 wrote to memory of 2568	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	31
PID 2092 wrote to memory of 2004	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	32
PID 2092 wrote to memory of 2004	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	32
PID 2092 wrote to memory of 2004	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	32
PID 2092 wrote to memory of 2376	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	33
PID 2092 wrote to memory of 2376	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	33
PID 2092 wrote to memory of 2376	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	33
PID 2092 wrote to memory of 2552	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	34
PID 2092 wrote to memory of 2552	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	34
PID 2092 wrote to memory of 2552	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	34
PID 2092 wrote to memory of 3068	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	35
PID 2092 wrote to memory of 3068	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	35
PID 2092 wrote to memory of 3068	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	35
PID 2092 wrote to memory of 2400	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	36
PID 2092 wrote to memory of 2400	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	36
PID 2092 wrote to memory of 2400	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	36
PID 2092 wrote to memory of 2740	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	37
PID 2092 wrote to memory of 2740	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	37
PID 2092 wrote to memory of 2740	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	37
PID 2092 wrote to memory of 2756	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	38
PID 2092 wrote to memory of 2756	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	38
PID 2092 wrote to memory of 2756	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	38
PID 2092 wrote to memory of 2852	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	39
PID 2092 wrote to memory of 2852	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	39
PID 2092 wrote to memory of 2852	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	39
PID 2092 wrote to memory of 3008	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	40
PID 2092 wrote to memory of 3008	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	40
PID 2092 wrote to memory of 3008	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	40
PID 2092 wrote to memory of 2336	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	41
PID 2092 wrote to memory of 2336	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	41
PID 2092 wrote to memory of 2336	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	41
PID 2092 wrote to memory of 2912	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	42
PID 2092 wrote to memory of 2912	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	42
PID 2092 wrote to memory of 2912	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	42
PID 2092 wrote to memory of 2208	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	43
PID 2092 wrote to memory of 2208	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	43
PID 2092 wrote to memory of 2208	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	43
PID 2092 wrote to memory of 2976	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	44
PID 2092 wrote to memory of 2976	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	44
PID 2092 wrote to memory of 2976	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	44
PID 2092 wrote to memory of 2884	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	45
PID 2092 wrote to memory of 2884	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	45
PID 2092 wrote to memory of 2884	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	45
PID 2092 wrote to memory of 2648	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	46
PID 2092 wrote to memory of 2648	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	46
PID 2092 wrote to memory of 2648	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	46
PID 2092 wrote to memory of 2680	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	47
PID 2092 wrote to memory of 2680	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	47
PID 2092 wrote to memory of 2680	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	47
PID 2092 wrote to memory of 1192	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	48
PID 2092 wrote to memory of 1192	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	48
PID 2092 wrote to memory of 1192	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	48
PID 2092 wrote to memory of 980	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	49
PID 2092 wrote to memory of 980	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	49
PID 2092 wrote to memory of 980	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	49
PID 2092 wrote to memory of 1660	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	50
PID 2092 wrote to memory of 1660	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	50
PID 2092 wrote to memory of 1660	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	50
PID 2092 wrote to memory of 796	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	51
PID 2092 wrote to memory of 796	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	51
PID 2092 wrote to memory of 796	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	51
PID 2092 wrote to memory of 1656	2092	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	52

C:\Users\Admin\AppData\Local\Temp\148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
"C:\Users\Admin\AppData\Local\Temp\148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System\ZGTNEBl.exe
  C:\Windows\System\ZGTNEBl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\oHfvRsS.exe
  C:\Windows\System\oHfvRsS.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\aGkSgqZ.exe
  C:\Windows\System\aGkSgqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\FlVjrCu.exe
  C:\Windows\System\FlVjrCu.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\vDocWKI.exe
  C:\Windows\System\vDocWKI.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\DTKKFKI.exe
  C:\Windows\System\DTKKFKI.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YGdZCOj.exe
  C:\Windows\System\YGdZCOj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nKAMidz.exe
  C:\Windows\System\nKAMidz.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\CZaGLKF.exe
  C:\Windows\System\CZaGLKF.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MsFMlem.exe
  C:\Windows\System\MsFMlem.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\UajFiLb.exe
  C:\Windows\System\UajFiLb.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\YOKsuZC.exe
  C:\Windows\System\YOKsuZC.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fJJVaYR.exe
  C:\Windows\System\fJJVaYR.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ZzGusRH.exe
  C:\Windows\System\ZzGusRH.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\VOyIChv.exe
  C:\Windows\System\VOyIChv.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\OHgLMpd.exe
  C:\Windows\System\OHgLMpd.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\qQPWZiv.exe
  C:\Windows\System\qQPWZiv.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\STEcaTY.exe
  C:\Windows\System\STEcaTY.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\PUGnZiU.exe
  C:\Windows\System\PUGnZiU.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\SdhMCHD.exe
  C:\Windows\System\SdhMCHD.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\CDUdqTE.exe
  C:\Windows\System\CDUdqTE.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\LdlGHRy.exe
  C:\Windows\System\LdlGHRy.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\UNwjLLh.exe
  C:\Windows\System\UNwjLLh.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\AZwayoT.exe
  C:\Windows\System\AZwayoT.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\PdxBLhD.exe
  C:\Windows\System\PdxBLhD.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\hPiJaIH.exe
  C:\Windows\System\hPiJaIH.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\RJzwCck.exe
  C:\Windows\System\RJzwCck.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ThHoAmB.exe
  C:\Windows\System\ThHoAmB.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\azvKlkB.exe
  C:\Windows\System\azvKlkB.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\yQOBmPV.exe
  C:\Windows\System\yQOBmPV.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\FqGbgmL.exe
  C:\Windows\System\FqGbgmL.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\nCnXXIk.exe
  C:\Windows\System\nCnXXIk.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\TeGYTXu.exe
  C:\Windows\System\TeGYTXu.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\BCSzlaz.exe
  C:\Windows\System\BCSzlaz.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\RcEkLyu.exe
  C:\Windows\System\RcEkLyu.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\RtqWJeU.exe
  C:\Windows\System\RtqWJeU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\nvkuQzF.exe
  C:\Windows\System\nvkuQzF.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\KrglKvR.exe
  C:\Windows\System\KrglKvR.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\YHvEbll.exe
  C:\Windows\System\YHvEbll.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\zqbpwzW.exe
  C:\Windows\System\zqbpwzW.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\usfEbPQ.exe
  C:\Windows\System\usfEbPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\GnGCwmr.exe
  C:\Windows\System\GnGCwmr.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\aqYxVzX.exe
  C:\Windows\System\aqYxVzX.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\nqTqaWR.exe
  C:\Windows\System\nqTqaWR.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\sGcNmhQ.exe
  C:\Windows\System\sGcNmhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\CYVOpXh.exe
  C:\Windows\System\CYVOpXh.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\RTHVTkI.exe
  C:\Windows\System\RTHVTkI.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\KMGavgk.exe
  C:\Windows\System\KMGavgk.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\IwoWruT.exe
  C:\Windows\System\IwoWruT.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\XYSdVhN.exe
  C:\Windows\System\XYSdVhN.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\zJavwvN.exe
  C:\Windows\System\zJavwvN.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\zSEJcWE.exe
  C:\Windows\System\zSEJcWE.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\hJGRydJ.exe
  C:\Windows\System\hJGRydJ.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\zZsRPEx.exe
  C:\Windows\System\zZsRPEx.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\xwrskOV.exe
  C:\Windows\System\xwrskOV.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\LGOzXSC.exe
  C:\Windows\System\LGOzXSC.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\WYBANpH.exe
  C:\Windows\System\WYBANpH.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\dDMMnmn.exe
  C:\Windows\System\dDMMnmn.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\hPdtWwX.exe
  C:\Windows\System\hPdtWwX.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\QpFbSyh.exe
  C:\Windows\System\QpFbSyh.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SyxikVA.exe
  C:\Windows\System\SyxikVA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\Umqosxr.exe
  C:\Windows\System\Umqosxr.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\RekkcTn.exe
  C:\Windows\System\RekkcTn.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\mLqzQFr.exe
  C:\Windows\System\mLqzQFr.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\aolZexF.exe
  C:\Windows\System\aolZexF.exe
  2⤵
  PID:2896
- C:\Windows\System\GyXSzSd.exe
  C:\Windows\System\GyXSzSd.exe
  2⤵
  PID:2736
- C:\Windows\System\RMKgwbP.exe
  C:\Windows\System\RMKgwbP.exe
  2⤵
  PID:2696
- C:\Windows\System\TNnDqbQ.exe
  C:\Windows\System\TNnDqbQ.exe
  2⤵
  PID:2668
- C:\Windows\System\euktfXa.exe
  C:\Windows\System\euktfXa.exe
  2⤵
  PID:764
- C:\Windows\System\jwaSSIP.exe
  C:\Windows\System\jwaSSIP.exe
  2⤵
  PID:1860
- C:\Windows\System\sfjryOL.exe
  C:\Windows\System\sfjryOL.exe
  2⤵
  PID:1280
- C:\Windows\System\BkqBzNM.exe
  C:\Windows\System\BkqBzNM.exe
  2⤵
  PID:2036
- C:\Windows\System\JkopVmG.exe
  C:\Windows\System\JkopVmG.exe
  2⤵
  PID:1980
- C:\Windows\System\mftHfxC.exe
  C:\Windows\System\mftHfxC.exe
  2⤵
  PID:2084
- C:\Windows\System\WFmKprf.exe
  C:\Windows\System\WFmKprf.exe
  2⤵
  PID:572
- C:\Windows\System\WezJQnh.exe
  C:\Windows\System\WezJQnh.exe
  2⤵
  PID:2688
- C:\Windows\System\EQRzpbs.exe
  C:\Windows\System\EQRzpbs.exe
  2⤵
  PID:536
- C:\Windows\System\RVMgwaz.exe
  C:\Windows\System\RVMgwaz.exe
  2⤵
  PID:1568
- C:\Windows\System\oaSVVfS.exe
  C:\Windows\System\oaSVVfS.exe
  2⤵
  PID:1648
- C:\Windows\System\fMufqKO.exe
  C:\Windows\System\fMufqKO.exe
  2⤵
  PID:1124
- C:\Windows\System\qjKAsUG.exe
  C:\Windows\System\qjKAsUG.exe
  2⤵
  PID:2100
- C:\Windows\System\Nrrasrg.exe
  C:\Windows\System\Nrrasrg.exe
  2⤵
  PID:1780
- C:\Windows\System\VheerfB.exe
  C:\Windows\System\VheerfB.exe
  2⤵
  PID:2240
- C:\Windows\System\oNNdEHK.exe
  C:\Windows\System\oNNdEHK.exe
  2⤵
  PID:3016
- C:\Windows\System\xqGAmxf.exe
  C:\Windows\System\xqGAmxf.exe
  2⤵
  PID:584
- C:\Windows\System\FAgoplh.exe
  C:\Windows\System\FAgoplh.exe
  2⤵
  PID:912
- C:\Windows\System\spbVWKJ.exe
  C:\Windows\System\spbVWKJ.exe
  2⤵
  PID:1236
- C:\Windows\System\nIOymWh.exe
  C:\Windows\System\nIOymWh.exe
  2⤵
  PID:340
- C:\Windows\System\FqkoXsd.exe
  C:\Windows\System\FqkoXsd.exe
  2⤵
  PID:988
- C:\Windows\System\tfXsBDm.exe
  C:\Windows\System\tfXsBDm.exe
  2⤵
  PID:2152
- C:\Windows\System\ZvChazf.exe
  C:\Windows\System\ZvChazf.exe
  2⤵
  PID:1932
- C:\Windows\System\ICyNIzo.exe
  C:\Windows\System\ICyNIzo.exe
  2⤵
  PID:836
- C:\Windows\System\EEzbkNe.exe
  C:\Windows\System\EEzbkNe.exe
  2⤵
  PID:1604
- C:\Windows\System\SsNvwrZ.exe
  C:\Windows\System\SsNvwrZ.exe
  2⤵
  PID:2576
- C:\Windows\System\frCqsZm.exe
  C:\Windows\System\frCqsZm.exe
  2⤵
  PID:2580
- C:\Windows\System\vTWtaKK.exe
  C:\Windows\System\vTWtaKK.exe
  2⤵
  PID:2212
- C:\Windows\System\HlznVci.exe
  C:\Windows\System\HlznVci.exe
  2⤵
  PID:2916
- C:\Windows\System\PCGCAeD.exe
  C:\Windows\System\PCGCAeD.exe
  2⤵
  PID:2816
- C:\Windows\System\MYLWsBp.exe
  C:\Windows\System\MYLWsBp.exe
  2⤵
  PID:2700
- C:\Windows\System\pWnBEgy.exe
  C:\Windows\System\pWnBEgy.exe
  2⤵
  PID:2904
- C:\Windows\System\nBWxcMe.exe
  C:\Windows\System\nBWxcMe.exe
  2⤵
  PID:1784
- C:\Windows\System\xBPIKrk.exe
  C:\Windows\System\xBPIKrk.exe
  2⤵
  PID:1700
- C:\Windows\System\VSxHZET.exe
  C:\Windows\System\VSxHZET.exe
  2⤵
  PID:2056
- C:\Windows\System\JlumVtA.exe
  C:\Windows\System\JlumVtA.exe
  2⤵
  PID:1636
- C:\Windows\System\BVmdnin.exe
  C:\Windows\System\BVmdnin.exe
  2⤵
  PID:1920
- C:\Windows\System\aAMLtGT.exe
  C:\Windows\System\aAMLtGT.exe
  2⤵
  PID:608
- C:\Windows\System\SUZLbwi.exe
  C:\Windows\System\SUZLbwi.exe
  2⤵
  PID:2396
- C:\Windows\System\pkapeHu.exe
  C:\Windows\System\pkapeHu.exe
  2⤵
  PID:1080
- C:\Windows\System\FaIKnPM.exe
  C:\Windows\System\FaIKnPM.exe
  2⤵
  PID:2020
- C:\Windows\System\vwohDTr.exe
  C:\Windows\System\vwohDTr.exe
  2⤵
  PID:2888
- C:\Windows\System\vUKcVDo.exe
  C:\Windows\System\vUKcVDo.exe
  2⤵
  PID:3020
- C:\Windows\System\gQtUjlM.exe
  C:\Windows\System\gQtUjlM.exe
  2⤵
  PID:2628
- C:\Windows\System\bcmSqRO.exe
  C:\Windows\System\bcmSqRO.exe
  2⤵
  PID:876
- C:\Windows\System\VpQrPrK.exe
  C:\Windows\System\VpQrPrK.exe
  2⤵
  PID:2448
- C:\Windows\System\VopaPSj.exe
  C:\Windows\System\VopaPSj.exe
  2⤵
  PID:2564
- C:\Windows\System\UezQZDQ.exe
  C:\Windows\System\UezQZDQ.exe
  2⤵
  PID:2476
- C:\Windows\System\hEuiFjq.exe
  C:\Windows\System\hEuiFjq.exe
  2⤵
  PID:2512
- C:\Windows\System\gkvKMRE.exe
  C:\Windows\System\gkvKMRE.exe
  2⤵
  PID:2724
- C:\Windows\System\ZuznoMY.exe
  C:\Windows\System\ZuznoMY.exe
  2⤵
  PID:2900
- C:\Windows\System\KygnHSN.exe
  C:\Windows\System\KygnHSN.exe
  2⤵
  PID:2692
- C:\Windows\System\gsaoLCn.exe
  C:\Windows\System\gsaoLCn.exe
  2⤵
  PID:2028
- C:\Windows\System\PrjscJZ.exe
  C:\Windows\System\PrjscJZ.exe
  2⤵
  PID:2168
- C:\Windows\System\fwTDEkQ.exe
  C:\Windows\System\fwTDEkQ.exe
  2⤵
  PID:1188
- C:\Windows\System\eBAlYhi.exe
  C:\Windows\System\eBAlYhi.exe
  2⤵
  PID:2228
- C:\Windows\System\oUwbsQG.exe
  C:\Windows\System\oUwbsQG.exe
  2⤵
  PID:3080
- C:\Windows\System\UNDzngt.exe
  C:\Windows\System\UNDzngt.exe
  2⤵
  PID:3100
- C:\Windows\System\xcbarse.exe
  C:\Windows\System\xcbarse.exe
  2⤵
  PID:3120
- C:\Windows\System\brgkyrL.exe
  C:\Windows\System\brgkyrL.exe
  2⤵
  PID:3140
- C:\Windows\System\JqGSvYR.exe
  C:\Windows\System\JqGSvYR.exe
  2⤵
  PID:3160
- C:\Windows\System\YvTsnQx.exe
  C:\Windows\System\YvTsnQx.exe
  2⤵
  PID:3180
- C:\Windows\System\TYZyKAL.exe
  C:\Windows\System\TYZyKAL.exe
  2⤵
  PID:3200
- C:\Windows\System\VvTVZSq.exe
  C:\Windows\System\VvTVZSq.exe
  2⤵
  PID:3216
- C:\Windows\System\MbNSShm.exe
  C:\Windows\System\MbNSShm.exe
  2⤵
  PID:3236
- C:\Windows\System\sqXrCSL.exe
  C:\Windows\System\sqXrCSL.exe
  2⤵
  PID:3256
- C:\Windows\System\GcGkSZk.exe
  C:\Windows\System\GcGkSZk.exe
  2⤵
  PID:3276
- C:\Windows\System\jkpuEBv.exe
  C:\Windows\System\jkpuEBv.exe
  2⤵
  PID:3296
- C:\Windows\System\QYNiCsQ.exe
  C:\Windows\System\QYNiCsQ.exe
  2⤵
  PID:3320
- C:\Windows\System\QnOmKRd.exe
  C:\Windows\System\QnOmKRd.exe
  2⤵
  PID:3340
- C:\Windows\System\QryiiwN.exe
  C:\Windows\System\QryiiwN.exe
  2⤵
  PID:3360
- C:\Windows\System\JGyQObE.exe
  C:\Windows\System\JGyQObE.exe
  2⤵
  PID:3380
- C:\Windows\System\NZqsWrZ.exe
  C:\Windows\System\NZqsWrZ.exe
  2⤵
  PID:3400
- C:\Windows\System\KnBYjGz.exe
  C:\Windows\System\KnBYjGz.exe
  2⤵
  PID:3420
- C:\Windows\System\gHzHLLS.exe
  C:\Windows\System\gHzHLLS.exe
  2⤵
  PID:3440
- C:\Windows\System\WPYsIHZ.exe
  C:\Windows\System\WPYsIHZ.exe
  2⤵
  PID:3456
- C:\Windows\System\HDPAmky.exe
  C:\Windows\System\HDPAmky.exe
  2⤵
  PID:3476
- C:\Windows\System\XWdMfDe.exe
  C:\Windows\System\XWdMfDe.exe
  2⤵
  PID:3496
- C:\Windows\System\qmZNuQc.exe
  C:\Windows\System\qmZNuQc.exe
  2⤵
  PID:3516
- C:\Windows\System\nRrjdmt.exe
  C:\Windows\System\nRrjdmt.exe
  2⤵
  PID:3536
- C:\Windows\System\CwdarIz.exe
  C:\Windows\System\CwdarIz.exe
  2⤵
  PID:3560
- C:\Windows\System\dvmDmoQ.exe
  C:\Windows\System\dvmDmoQ.exe
  2⤵
  PID:3576
- C:\Windows\System\tkYgUPV.exe
  C:\Windows\System\tkYgUPV.exe
  2⤵
  PID:3600
- C:\Windows\System\eOYuvoO.exe
  C:\Windows\System\eOYuvoO.exe
  2⤵
  PID:3616
- C:\Windows\System\XtyQixi.exe
  C:\Windows\System\XtyQixi.exe
  2⤵
  PID:3636
- C:\Windows\System\cHgOoDU.exe
  C:\Windows\System\cHgOoDU.exe
  2⤵
  PID:3652
- C:\Windows\System\ZvydvXf.exe
  C:\Windows\System\ZvydvXf.exe
  2⤵
  PID:3668
- C:\Windows\System\uQXQMtb.exe
  C:\Windows\System\uQXQMtb.exe
  2⤵
  PID:3688
- C:\Windows\System\xjGncHw.exe
  C:\Windows\System\xjGncHw.exe
  2⤵
  PID:3704
- C:\Windows\System\uQPzxRN.exe
  C:\Windows\System\uQPzxRN.exe
  2⤵
  PID:3724
- C:\Windows\System\VFEzOTU.exe
  C:\Windows\System\VFEzOTU.exe
  2⤵
  PID:3748
- C:\Windows\System\qfeXDJh.exe
  C:\Windows\System\qfeXDJh.exe
  2⤵
  PID:3764
- C:\Windows\System\csPuyFf.exe
  C:\Windows\System\csPuyFf.exe
  2⤵
  PID:3780
- C:\Windows\System\oxVEcfc.exe
  C:\Windows\System\oxVEcfc.exe
  2⤵
  PID:3816
- C:\Windows\System\JtecCFC.exe
  C:\Windows\System\JtecCFC.exe
  2⤵
  PID:3832
- C:\Windows\System\HreeNoE.exe
  C:\Windows\System\HreeNoE.exe
  2⤵
  PID:3848
- C:\Windows\System\zyZXiap.exe
  C:\Windows\System\zyZXiap.exe
  2⤵
  PID:3864
- C:\Windows\System\BrLcGpM.exe
  C:\Windows\System\BrLcGpM.exe
  2⤵
  PID:3884
- C:\Windows\System\DOukiyx.exe
  C:\Windows\System\DOukiyx.exe
  2⤵
  PID:3900
- C:\Windows\System\nOlWsAQ.exe
  C:\Windows\System\nOlWsAQ.exe
  2⤵
  PID:3920
- C:\Windows\System\JgsHGkn.exe
  C:\Windows\System\JgsHGkn.exe
  2⤵
  PID:3936
- C:\Windows\System\OAbEWzR.exe
  C:\Windows\System\OAbEWzR.exe
  2⤵
  PID:3952
- C:\Windows\System\ddnVapL.exe
  C:\Windows\System\ddnVapL.exe
  2⤵
  PID:3972
- C:\Windows\System\dfetFCX.exe
  C:\Windows\System\dfetFCX.exe
  2⤵
  PID:3988
- C:\Windows\System\tNBHMFG.exe
  C:\Windows\System\tNBHMFG.exe
  2⤵
  PID:4016
- C:\Windows\System\ggqKsOy.exe
  C:\Windows\System\ggqKsOy.exe
  2⤵
  PID:4032
- C:\Windows\System\uluVjRo.exe
  C:\Windows\System\uluVjRo.exe
  2⤵
  PID:4048
- C:\Windows\System\BfhqVPG.exe
  C:\Windows\System\BfhqVPG.exe
  2⤵
  PID:4068
- C:\Windows\System\aIOZnfR.exe
  C:\Windows\System\aIOZnfR.exe
  2⤵
  PID:4084
- C:\Windows\System\TmfAfel.exe
  C:\Windows\System\TmfAfel.exe
  2⤵
  PID:2964
- C:\Windows\System\dulxWWM.exe
  C:\Windows\System\dulxWWM.exe
  2⤵
  PID:1560
- C:\Windows\System\pvlZyrj.exe
  C:\Windows\System\pvlZyrj.exe
  2⤵
  PID:1704
- C:\Windows\System\gVTqlWm.exe
  C:\Windows\System\gVTqlWm.exe
  2⤵
  PID:2156
- C:\Windows\System\WAMIJiv.exe
  C:\Windows\System\WAMIJiv.exe
  2⤵
  PID:2416
- C:\Windows\System\iEdsIRe.exe
  C:\Windows\System\iEdsIRe.exe
  2⤵
  PID:2800
- C:\Windows\System\ASiyZzz.exe
  C:\Windows\System\ASiyZzz.exe
  2⤵
  PID:2908
- C:\Windows\System\HsJpsTu.exe
  C:\Windows\System\HsJpsTu.exe
  2⤵
  PID:1924
- C:\Windows\System\IGGhWpq.exe
  C:\Windows\System\IGGhWpq.exe
  2⤵
  PID:2148
- C:\Windows\System\YQstgcs.exe
  C:\Windows\System\YQstgcs.exe
  2⤵
  PID:1036
- C:\Windows\System\hFGhVXT.exe
  C:\Windows\System\hFGhVXT.exe
  2⤵
  PID:3116
- C:\Windows\System\ZwYPpVt.exe
  C:\Windows\System\ZwYPpVt.exe
  2⤵
  PID:3088
- C:\Windows\System\snuPGSX.exe
  C:\Windows\System\snuPGSX.exe
  2⤵
  PID:3128
- C:\Windows\System\TzAxSDF.exe
  C:\Windows\System\TzAxSDF.exe
  2⤵
  PID:3152
- C:\Windows\System\EiucWaa.exe
  C:\Windows\System\EiucWaa.exe
  2⤵
  PID:3132
- C:\Windows\System\xqAMkOm.exe
  C:\Windows\System\xqAMkOm.exe
  2⤵
  PID:3196
- C:\Windows\System\IvyiEfM.exe
  C:\Windows\System\IvyiEfM.exe
  2⤵
  PID:3228
- C:\Windows\System\wPsExqx.exe
  C:\Windows\System\wPsExqx.exe
  2⤵
  PID:3208
- C:\Windows\System\pgtgOoc.exe
  C:\Windows\System\pgtgOoc.exe
  2⤵
  PID:3392
- C:\Windows\System\pbGKzPc.exe
  C:\Windows\System\pbGKzPc.exe
  2⤵
  PID:3292
- C:\Windows\System\WBLepaP.exe
  C:\Windows\System\WBLepaP.exe
  2⤵
  PID:3368
- C:\Windows\System\gjYxpzM.exe
  C:\Windows\System\gjYxpzM.exe
  2⤵
  PID:3372
- C:\Windows\System\EzoOnao.exe
  C:\Windows\System\EzoOnao.exe
  2⤵
  PID:3432
- C:\Windows\System\BRbJfFB.exe
  C:\Windows\System\BRbJfFB.exe
  2⤵
  PID:3468
- C:\Windows\System\YPbAySW.exe
  C:\Windows\System\YPbAySW.exe
  2⤵
  PID:3548
- C:\Windows\System\djtRUKx.exe
  C:\Windows\System\djtRUKx.exe
  2⤵
  PID:3592
- C:\Windows\System\tusdnCj.exe
  C:\Windows\System\tusdnCj.exe
  2⤵
  PID:2276
- C:\Windows\System\oVWdMIQ.exe
  C:\Windows\System\oVWdMIQ.exe
  2⤵
  PID:3452
- C:\Windows\System\FybWpxP.exe
  C:\Windows\System\FybWpxP.exe
  2⤵
  PID:3632
- C:\Windows\System\eZTfYyp.exe
  C:\Windows\System\eZTfYyp.exe
  2⤵
  PID:2664
- C:\Windows\System\dlNskFq.exe
  C:\Windows\System\dlNskFq.exe
  2⤵
  PID:3700
- C:\Windows\System\hLWprkZ.exe
  C:\Windows\System\hLWprkZ.exe
  2⤵
  PID:3532
- C:\Windows\System\BMkpXYe.exe
  C:\Windows\System\BMkpXYe.exe
  2⤵
  PID:2120
- C:\Windows\System\yAhoKbO.exe
  C:\Windows\System\yAhoKbO.exe
  2⤵
  PID:3744
- C:\Windows\System\PWsnVXx.exe
  C:\Windows\System\PWsnVXx.exe
  2⤵
  PID:3776
- C:\Windows\System\fYwQyXi.exe
  C:\Windows\System\fYwQyXi.exe
  2⤵
  PID:3680
- C:\Windows\System\lPncGOf.exe
  C:\Windows\System\lPncGOf.exe
  2⤵
  PID:3712
- C:\Windows\System\TJXlhTC.exe
  C:\Windows\System\TJXlhTC.exe
  2⤵
  PID:3612
- C:\Windows\System\rKuFhfw.exe
  C:\Windows\System\rKuFhfw.exe
  2⤵
  PID:3720
- C:\Windows\System\brHqMEw.exe
  C:\Windows\System\brHqMEw.exe
  2⤵
  PID:3796
- C:\Windows\System\TNZBZDD.exe
  C:\Windows\System\TNZBZDD.exe
  2⤵
  PID:2820
- C:\Windows\System\ryWsRnK.exe
  C:\Windows\System\ryWsRnK.exe
  2⤵
  PID:3824
- C:\Windows\System\SjKczPe.exe
  C:\Windows\System\SjKczPe.exe
  2⤵
  PID:3892
- C:\Windows\System\KwKOBup.exe
  C:\Windows\System\KwKOBup.exe
  2⤵
  PID:3932
- C:\Windows\System\LOYspeF.exe
  C:\Windows\System\LOYspeF.exe
  2⤵
  PID:3800
- C:\Windows\System\howFgkf.exe
  C:\Windows\System\howFgkf.exe
  2⤵
  PID:1032
- C:\Windows\System\cSyxJQv.exe
  C:\Windows\System\cSyxJQv.exe
  2⤵
  PID:4004
- C:\Windows\System\KjlsVPD.exe
  C:\Windows\System\KjlsVPD.exe
  2⤵
  PID:4044
- C:\Windows\System\sedqdkQ.exe
  C:\Windows\System\sedqdkQ.exe
  2⤵
  PID:2116
- C:\Windows\System\KaUCqlR.exe
  C:\Windows\System\KaUCqlR.exe
  2⤵
  PID:948
- C:\Windows\System\FejsObT.exe
  C:\Windows\System\FejsObT.exe
  2⤵
  PID:3052
- C:\Windows\System\dhQlpoG.exe
  C:\Windows\System\dhQlpoG.exe
  2⤵
  PID:3916
- C:\Windows\System\tSWJQuE.exe
  C:\Windows\System\tSWJQuE.exe
  2⤵
  PID:2808
- C:\Windows\System\KnIjzzg.exe
  C:\Windows\System\KnIjzzg.exe
  2⤵
  PID:2876
- C:\Windows\System\HusSrre.exe
  C:\Windows\System\HusSrre.exe
  2⤵
  PID:4060
- C:\Windows\System\rfrKcMC.exe
  C:\Windows\System\rfrKcMC.exe
  2⤵
  PID:4092
- C:\Windows\System\UriQhIh.exe
  C:\Windows\System\UriQhIh.exe
  2⤵
  PID:3064
- C:\Windows\System\HZpDCby.exe
  C:\Windows\System\HZpDCby.exe
  2⤵
  PID:3136
- C:\Windows\System\ylpecNI.exe
  C:\Windows\System\ylpecNI.exe
  2⤵
  PID:3268
- C:\Windows\System\IKVoXsq.exe
  C:\Windows\System\IKVoXsq.exe
  2⤵
  PID:2584
- C:\Windows\System\rGRoIIs.exe
  C:\Windows\System\rGRoIIs.exe
  2⤵
  PID:2796
- C:\Windows\System\CXxYEFT.exe
  C:\Windows\System\CXxYEFT.exe
  2⤵
  PID:2792
- C:\Windows\System\BsVoXui.exe
  C:\Windows\System\BsVoXui.exe
  2⤵
  PID:1800
- C:\Windows\System\HVgsgrN.exe
  C:\Windows\System\HVgsgrN.exe
  2⤵
  PID:3224
- C:\Windows\System\woapnWC.exe
  C:\Windows\System\woapnWC.exe
  2⤵
  PID:2180
- C:\Windows\System\gidkTHv.exe
  C:\Windows\System\gidkTHv.exe
  2⤵
  PID:4064
- C:\Windows\System\EwNkGSq.exe
  C:\Windows\System\EwNkGSq.exe
  2⤵
  PID:3984
- C:\Windows\System\upseOmj.exe
  C:\Windows\System\upseOmj.exe
  2⤵
  PID:3284
- C:\Windows\System\JwvUwwS.exe
  C:\Windows\System\JwvUwwS.exe
  2⤵
  PID:3332
- C:\Windows\System\RPtaqYR.exe
  C:\Windows\System\RPtaqYR.exe
  2⤵
  PID:3416
- C:\Windows\System\SbYZQsa.exe
  C:\Windows\System\SbYZQsa.exe
  2⤵
  PID:3488
- C:\Windows\System\stWATmq.exe
  C:\Windows\System\stWATmq.exe
  2⤵
  PID:1728
- C:\Windows\System\QIdFpVE.exe
  C:\Windows\System\QIdFpVE.exe
  2⤵
  PID:348
- C:\Windows\System\wCSiUdd.exe
  C:\Windows\System\wCSiUdd.exe
  2⤵
  PID:3528
- C:\Windows\System\BCbSpMw.exe
  C:\Windows\System\BCbSpMw.exe
  2⤵
  PID:3568
- C:\Windows\System\JrESGen.exe
  C:\Windows\System\JrESGen.exe
  2⤵
  PID:2676
- C:\Windows\System\HfrBMOh.exe
  C:\Windows\System\HfrBMOh.exe
  2⤵
  PID:3644
- C:\Windows\System\FODKXhg.exe
  C:\Windows\System\FODKXhg.exe
  2⤵
  PID:1816
- C:\Windows\System\QswzSGb.exe
  C:\Windows\System\QswzSGb.exe
  2⤵
  PID:3716
- C:\Windows\System\pyRZbaq.exe
  C:\Windows\System\pyRZbaq.exe
  2⤵
  PID:2012
- C:\Windows\System\guqgGjU.exe
  C:\Windows\System\guqgGjU.exe
  2⤵
  PID:3960
- C:\Windows\System\ARvOxJK.exe
  C:\Windows\System\ARvOxJK.exe
  2⤵
  PID:900
- C:\Windows\System\mXJJOYP.exe
  C:\Windows\System\mXJJOYP.exe
  2⤵
  PID:3028
- C:\Windows\System\xqjqUBI.exe
  C:\Windows\System\xqjqUBI.exe
  2⤵
  PID:3860
- C:\Windows\System\uIYyEYz.exe
  C:\Windows\System\uIYyEYz.exe
  2⤵
  PID:3844
- C:\Windows\System\cyvdjDd.exe
  C:\Windows\System\cyvdjDd.exe
  2⤵
  PID:1304
- C:\Windows\System\QUYiXTH.exe
  C:\Windows\System\QUYiXTH.exe
  2⤵
  PID:3808
- C:\Windows\System\jastGJf.exe
  C:\Windows\System\jastGJf.exe
  2⤵
  PID:780
- C:\Windows\System\YphvooZ.exe
  C:\Windows\System\YphvooZ.exe
  2⤵
  PID:2196
- C:\Windows\System\hyBRSQX.exe
  C:\Windows\System\hyBRSQX.exe
  2⤵
  PID:3108
- C:\Windows\System\TccELri.exe
  C:\Windows\System\TccELri.exe
  2⤵
  PID:3096
- C:\Windows\System\HcjxrxF.exe
  C:\Windows\System\HcjxrxF.exe
  2⤵
  PID:1616
- C:\Windows\System\sucZfSo.exe
  C:\Windows\System\sucZfSo.exe
  2⤵
  PID:1856
- C:\Windows\System\BHkAJDV.exe
  C:\Windows\System\BHkAJDV.exe
  2⤵
  PID:4028
- C:\Windows\System\yhLjNEd.exe
  C:\Windows\System\yhLjNEd.exe
  2⤵
  PID:3472
- C:\Windows\System\sUnIjds.exe
  C:\Windows\System\sUnIjds.exe
  2⤵
  PID:3584
- C:\Windows\System\VAXeseY.exe
  C:\Windows\System\VAXeseY.exe
  2⤵
  PID:3544
- C:\Windows\System\JKBbUKS.exe
  C:\Windows\System\JKBbUKS.exe
  2⤵
  PID:2644
- C:\Windows\System\wIrgMzI.exe
  C:\Windows\System\wIrgMzI.exe
  2⤵
  PID:2428
- C:\Windows\System\fQnOtTj.exe
  C:\Windows\System\fQnOtTj.exe
  2⤵
  PID:2932
- C:\Windows\System\zDdzteC.exe
  C:\Windows\System\zDdzteC.exe
  2⤵
  PID:4080
- C:\Windows\System\GGUEtWO.exe
  C:\Windows\System\GGUEtWO.exe
  2⤵
  PID:3996
- C:\Windows\System\IJonQLl.exe
  C:\Windows\System\IJonQLl.exe
  2⤵
  PID:2944
- C:\Windows\System\MjByNnF.exe
  C:\Windows\System\MjByNnF.exe
  2⤵
  PID:2812
- C:\Windows\System\MKCfKTx.exe
  C:\Windows\System\MKCfKTx.exe
  2⤵
  PID:3760
- C:\Windows\System\dkBXkpP.exe
  C:\Windows\System\dkBXkpP.exe
  2⤵
  PID:2872
- C:\Windows\System\XrfiATh.exe
  C:\Windows\System\XrfiATh.exe
  2⤵
  PID:3856
- C:\Windows\System\NNVKIFQ.exe
  C:\Windows\System\NNVKIFQ.exe
  2⤵
  PID:3876
- C:\Windows\System\eXSqdOy.exe
  C:\Windows\System\eXSqdOy.exe
  2⤵
  PID:3272
- C:\Windows\System\GnKVajW.exe
  C:\Windows\System\GnKVajW.exe
  2⤵
  PID:3076
- C:\Windows\System\OzaDdcq.exe
  C:\Windows\System\OzaDdcq.exe
  2⤵
  PID:2192
- C:\Windows\System\GokfYVf.exe
  C:\Windows\System\GokfYVf.exe
  2⤵
  PID:2768
- C:\Windows\System\Pqtkkmh.exe
  C:\Windows\System\Pqtkkmh.exe
  2⤵
  PID:3512
- C:\Windows\System\ytccqyj.exe
  C:\Windows\System\ytccqyj.exe
  2⤵
  PID:4112
- C:\Windows\System\VgqsGxB.exe
  C:\Windows\System\VgqsGxB.exe
  2⤵
  PID:4128
- C:\Windows\System\njLjgvN.exe
  C:\Windows\System\njLjgvN.exe
  2⤵
  PID:4148
- C:\Windows\System\zCPEGWg.exe
  C:\Windows\System\zCPEGWg.exe
  2⤵
  PID:4164
- C:\Windows\System\DcZrHin.exe
  C:\Windows\System\DcZrHin.exe
  2⤵
  PID:4180
- C:\Windows\System\PRPOguS.exe
  C:\Windows\System\PRPOguS.exe
  2⤵
  PID:4200
- C:\Windows\System\dOVnZPa.exe
  C:\Windows\System\dOVnZPa.exe
  2⤵
  PID:4220
- C:\Windows\System\BxaoBCz.exe
  C:\Windows\System\BxaoBCz.exe
  2⤵
  PID:4236
- C:\Windows\System\RPuYUtg.exe
  C:\Windows\System\RPuYUtg.exe
  2⤵
  PID:4252
- C:\Windows\System\ohZOltJ.exe
  C:\Windows\System\ohZOltJ.exe
  2⤵
  PID:4268
- C:\Windows\System\mmCECTB.exe
  C:\Windows\System\mmCECTB.exe
  2⤵
  PID:4284
- C:\Windows\System\DMfVPFm.exe
  C:\Windows\System\DMfVPFm.exe
  2⤵
  PID:4300
- C:\Windows\System\nKtsHUL.exe
  C:\Windows\System\nKtsHUL.exe
  2⤵
  PID:4316
- C:\Windows\System\sEBtWpR.exe
  C:\Windows\System\sEBtWpR.exe
  2⤵
  PID:4332
- C:\Windows\System\gyYycaI.exe
  C:\Windows\System\gyYycaI.exe
  2⤵
  PID:4348
- C:\Windows\System\MGhKBeB.exe
  C:\Windows\System\MGhKBeB.exe
  2⤵
  PID:4364
- C:\Windows\System\nlFWZIg.exe
  C:\Windows\System\nlFWZIg.exe
  2⤵
  PID:4380
- C:\Windows\System\oCSYQLi.exe
  C:\Windows\System\oCSYQLi.exe
  2⤵
  PID:4396
- C:\Windows\System\QwhdAKD.exe
  C:\Windows\System\QwhdAKD.exe
  2⤵
  PID:4412
- C:\Windows\System\xokCbKd.exe
  C:\Windows\System\xokCbKd.exe
  2⤵
  PID:4428
- C:\Windows\System\pmYxgaP.exe
  C:\Windows\System\pmYxgaP.exe
  2⤵
  PID:4444
- C:\Windows\System\GEOwLqQ.exe
  C:\Windows\System\GEOwLqQ.exe
  2⤵
  PID:4460
- C:\Windows\System\pvCkuDS.exe
  C:\Windows\System\pvCkuDS.exe
  2⤵
  PID:4476
- C:\Windows\System\fAollWl.exe
  C:\Windows\System\fAollWl.exe
  2⤵
  PID:4492
- C:\Windows\System\TXAveLZ.exe
  C:\Windows\System\TXAveLZ.exe
  2⤵
  PID:4508
- C:\Windows\System\moJRNPN.exe
  C:\Windows\System\moJRNPN.exe
  2⤵
  PID:4524
- C:\Windows\System\YFHNxXz.exe
  C:\Windows\System\YFHNxXz.exe
  2⤵
  PID:4540
- C:\Windows\System\KjPgIZE.exe
  C:\Windows\System\KjPgIZE.exe
  2⤵
  PID:4556
- C:\Windows\System\BBQdUGi.exe
  C:\Windows\System\BBQdUGi.exe
  2⤵
  PID:4572
- C:\Windows\System\XhGTgKx.exe
  C:\Windows\System\XhGTgKx.exe
  2⤵
  PID:4588
- C:\Windows\System\neMvuon.exe
  C:\Windows\System\neMvuon.exe
  2⤵
  PID:4604
- C:\Windows\System\rfeyNvv.exe
  C:\Windows\System\rfeyNvv.exe
  2⤵
  PID:4620
- C:\Windows\System\ruWnaYE.exe
  C:\Windows\System\ruWnaYE.exe
  2⤵
  PID:4636
- C:\Windows\System\JOPoyXR.exe
  C:\Windows\System\JOPoyXR.exe
  2⤵
  PID:4656
- C:\Windows\System\QbQZeRW.exe
  C:\Windows\System\QbQZeRW.exe
  2⤵
  PID:4672
- C:\Windows\System\GMIoFlf.exe
  C:\Windows\System\GMIoFlf.exe
  2⤵
  PID:4692
- C:\Windows\System\lphGtht.exe
  C:\Windows\System\lphGtht.exe
  2⤵
  PID:4708
- C:\Windows\System\fgjFpBQ.exe
  C:\Windows\System\fgjFpBQ.exe
  2⤵
  PID:4724
- C:\Windows\System\hAbPFbV.exe
  C:\Windows\System\hAbPFbV.exe
  2⤵
  PID:4740
- C:\Windows\System\fuegqmj.exe
  C:\Windows\System\fuegqmj.exe
  2⤵
  PID:4756
- C:\Windows\System\bclzSHk.exe
  C:\Windows\System\bclzSHk.exe
  2⤵
  PID:4772
- C:\Windows\System\RiWwivB.exe
  C:\Windows\System\RiWwivB.exe
  2⤵
  PID:4788
- C:\Windows\System\dtEBYuh.exe
  C:\Windows\System\dtEBYuh.exe
  2⤵
  PID:4804
- C:\Windows\System\EyLSUpA.exe
  C:\Windows\System\EyLSUpA.exe
  2⤵
  PID:4820
- C:\Windows\System\JqUfEsl.exe
  C:\Windows\System\JqUfEsl.exe
  2⤵
  PID:4836
- C:\Windows\System\PoGavIm.exe
  C:\Windows\System\PoGavIm.exe
  2⤵
  PID:4852
- C:\Windows\System\QGjUiCI.exe
  C:\Windows\System\QGjUiCI.exe
  2⤵
  PID:4872
- C:\Windows\System\JTaaXpw.exe
  C:\Windows\System\JTaaXpw.exe
  2⤵
  PID:4888
- C:\Windows\System\PaZBWJs.exe
  C:\Windows\System\PaZBWJs.exe
  2⤵
  PID:4904
- C:\Windows\System\Tuwcyiw.exe
  C:\Windows\System\Tuwcyiw.exe
  2⤵
  PID:4920
- C:\Windows\System\ZFWbesp.exe
  C:\Windows\System\ZFWbesp.exe
  2⤵
  PID:4936
- C:\Windows\System\WEZQTBN.exe
  C:\Windows\System\WEZQTBN.exe
  2⤵
  PID:4952
- C:\Windows\System\icHpcrP.exe
  C:\Windows\System\icHpcrP.exe
  2⤵
  PID:4968
- C:\Windows\System\gLDiFzQ.exe
  C:\Windows\System\gLDiFzQ.exe
  2⤵
  PID:4984
- C:\Windows\System\mHlrqkf.exe
  C:\Windows\System\mHlrqkf.exe
  2⤵
  PID:5000
- C:\Windows\System\RBLUdgx.exe
  C:\Windows\System\RBLUdgx.exe
  2⤵
  PID:5016
- C:\Windows\System\yUVaAvy.exe
  C:\Windows\System\yUVaAvy.exe
  2⤵
  PID:5032
- C:\Windows\System\wPrlpet.exe
  C:\Windows\System\wPrlpet.exe
  2⤵
  PID:5048
- C:\Windows\System\wTRRTpA.exe
  C:\Windows\System\wTRRTpA.exe
  2⤵
  PID:5064
- C:\Windows\System\SyqLPsG.exe
  C:\Windows\System\SyqLPsG.exe
  2⤵
  PID:5080
- C:\Windows\System\kvSGSBB.exe
  C:\Windows\System\kvSGSBB.exe
  2⤵
  PID:5096
- C:\Windows\System\umGYptE.exe
  C:\Windows\System\umGYptE.exe
  2⤵
  PID:5112
- C:\Windows\System\yNysbVI.exe
  C:\Windows\System\yNysbVI.exe
  2⤵
  PID:2764
- C:\Windows\System\OQNxMdJ.exe
  C:\Windows\System\OQNxMdJ.exe
  2⤵
  PID:1300
- C:\Windows\System\NvzsAUa.exe
  C:\Windows\System\NvzsAUa.exe
  2⤵
  PID:4108
- C:\Windows\System\iMbNJxc.exe
  C:\Windows\System\iMbNJxc.exe
  2⤵
  PID:1628
- C:\Windows\System\LDaUhbX.exe
  C:\Windows\System\LDaUhbX.exe
  2⤵
  PID:4124
- C:\Windows\System\OiNNbhZ.exe
  C:\Windows\System\OiNNbhZ.exe
  2⤵
  PID:3376
- C:\Windows\System\kKwpyQx.exe
  C:\Windows\System\kKwpyQx.exe
  2⤵
  PID:4160
- C:\Windows\System\CmPVqzk.exe
  C:\Windows\System\CmPVqzk.exe
  2⤵
  PID:4212
- C:\Windows\System\cfRGeQC.exe
  C:\Windows\System\cfRGeQC.exe
  2⤵
  PID:4196
- C:\Windows\System\GxRjaIE.exe
  C:\Windows\System\GxRjaIE.exe
  2⤵
  PID:4228
- C:\Windows\System\BswcyQf.exe
  C:\Windows\System\BswcyQf.exe
  2⤵
  PID:4264
- C:\Windows\System\fZUTypb.exe
  C:\Windows\System\fZUTypb.exe
  2⤵
  PID:4292
- C:\Windows\System\XZDUzTl.exe
  C:\Windows\System\XZDUzTl.exe
  2⤵
  PID:4356
- C:\Windows\System\kajuBgF.exe
  C:\Windows\System\kajuBgF.exe
  2⤵
  PID:4360
- C:\Windows\System\elAeWiX.exe
  C:\Windows\System\elAeWiX.exe
  2⤵
  PID:4420
- C:\Windows\System\jiJuvBp.exe
  C:\Windows\System\jiJuvBp.exe
  2⤵
  PID:4548
- C:\Windows\System\jcnxHUw.exe
  C:\Windows\System\jcnxHUw.exe
  2⤵
  PID:4564
- C:\Windows\System\bGEGQXq.exe
  C:\Windows\System\bGEGQXq.exe
  2⤵
  PID:4552
- C:\Windows\System\BSmYbCz.exe
  C:\Windows\System\BSmYbCz.exe
  2⤵
  PID:4616
- C:\Windows\System\VIuWOPK.exe
  C:\Windows\System\VIuWOPK.exe
  2⤵
  PID:4700
- C:\Windows\System\kBKQnLR.exe
  C:\Windows\System\kBKQnLR.exe
  2⤵
  PID:4644
- C:\Windows\System\WyYpFCN.exe
  C:\Windows\System\WyYpFCN.exe
  2⤵
  PID:4716
- C:\Windows\System\ZCMfACi.exe
  C:\Windows\System\ZCMfACi.exe
  2⤵
  PID:4652
- C:\Windows\System\CvJmoFc.exe
  C:\Windows\System\CvJmoFc.exe
  2⤵
  PID:4780
- C:\Windows\System\cyLWQIe.exe
  C:\Windows\System\cyLWQIe.exe
  2⤵
  PID:4828
- C:\Windows\System\pmbcSLc.exe
  C:\Windows\System\pmbcSLc.exe
  2⤵
  PID:4864
- C:\Windows\System\FOCIJxv.exe
  C:\Windows\System\FOCIJxv.exe
  2⤵
  PID:4928
- C:\Windows\System\RTdVLev.exe
  C:\Windows\System\RTdVLev.exe
  2⤵
  PID:4816
- C:\Windows\System\uNDAOlB.exe
  C:\Windows\System\uNDAOlB.exe
  2⤵
  PID:4996
- C:\Windows\System\ycsOQPW.exe
  C:\Windows\System\ycsOQPW.exe
  2⤵
  PID:4916
- C:\Windows\System\FiwJIpu.exe
  C:\Windows\System\FiwJIpu.exe
  2⤵
  PID:4948
- C:\Windows\System\NoQuXba.exe
  C:\Windows\System\NoQuXba.exe
  2⤵
  PID:5012
- C:\Windows\System\jzhmLCv.exe
  C:\Windows\System\jzhmLCv.exe
  2⤵
  PID:5044
- C:\Windows\System\xaODFQc.exe
  C:\Windows\System\xaODFQc.exe
  2⤵
  PID:5072
- C:\Windows\System\CFhkQwF.exe
  C:\Windows\System\CFhkQwF.exe
  2⤵
  PID:3556
- C:\Windows\System\QCXoERA.exe
  C:\Windows\System\QCXoERA.exe
  2⤵
  PID:2948
- C:\Windows\System\GLFkSdP.exe
  C:\Windows\System\GLFkSdP.exe
  2⤵
  PID:3948
- C:\Windows\System\EUuoOxc.exe
  C:\Windows\System\EUuoOxc.exe
  2⤵
  PID:4188
- C:\Windows\System\LJZdBeS.exe
  C:\Windows\System\LJZdBeS.exe
  2⤵
  PID:4176
- C:\Windows\System\WPjAvwX.exe
  C:\Windows\System\WPjAvwX.exe
  2⤵
  PID:4260
- C:\Windows\System\RGofrof.exe
  C:\Windows\System\RGofrof.exe
  2⤵
  PID:4392
- C:\Windows\System\tJrxWtm.exe
  C:\Windows\System\tJrxWtm.exe
  2⤵
  PID:4312
- C:\Windows\System\iMFOjKS.exe
  C:\Windows\System\iMFOjKS.exe
  2⤵
  PID:4500
- C:\Windows\System\ZgxKoet.exe
  C:\Windows\System\ZgxKoet.exe
  2⤵
  PID:4532
- C:\Windows\System\appddVi.exe
  C:\Windows\System\appddVi.exe
  2⤵
  PID:4452
- C:\Windows\System\WvwBTcR.exe
  C:\Windows\System\WvwBTcR.exe
  2⤵
  PID:4584
- C:\Windows\System\uyOQHSZ.exe
  C:\Windows\System\uyOQHSZ.exe
  2⤵
  PID:4632
- C:\Windows\System\bSkBSMR.exe
  C:\Windows\System\bSkBSMR.exe
  2⤵
  PID:4668
- C:\Windows\System\VMICJwM.exe
  C:\Windows\System\VMICJwM.exe
  2⤵
  PID:4896
- C:\Windows\System\bERqWQf.exe
  C:\Windows\System\bERqWQf.exe
  2⤵
  PID:4992
- C:\Windows\System\oJaitts.exe
  C:\Windows\System\oJaitts.exe
  2⤵
  PID:5024
- C:\Windows\System\yRKwwfj.exe
  C:\Windows\System\yRKwwfj.exe
  2⤵
  PID:4680
- C:\Windows\System\QyBcEZj.exe
  C:\Windows\System\QyBcEZj.exe
  2⤵
  PID:3428
- C:\Windows\System\CWUeIyA.exe
  C:\Windows\System\CWUeIyA.exe
  2⤵
  PID:4144
- C:\Windows\System\bKlLGfE.exe
  C:\Windows\System\bKlLGfE.exe
  2⤵
  PID:4440
- C:\Windows\System\THxkuIZ.exe
  C:\Windows\System\THxkuIZ.exe
  2⤵
  PID:5028
- C:\Windows\System\CfMeqHl.exe
  C:\Windows\System\CfMeqHl.exe
  2⤵
  PID:4600
- C:\Windows\System\ZjFJdGz.exe
  C:\Windows\System\ZjFJdGz.exe
  2⤵
  PID:4732
- C:\Windows\System\yThwxhn.exe
  C:\Windows\System\yThwxhn.exe
  2⤵
  PID:4684
- C:\Windows\System\PjMbZrQ.exe
  C:\Windows\System\PjMbZrQ.exe
  2⤵
  PID:4596
- C:\Windows\System\RxJrUZn.exe
  C:\Windows\System\RxJrUZn.exe
  2⤵
  PID:4752
- C:\Windows\System\iNFRcBH.exe
  C:\Windows\System\iNFRcBH.exe
  2⤵
  PID:4944
- C:\Windows\System\sIFBNZo.exe
  C:\Windows\System\sIFBNZo.exe
  2⤵
  PID:5008
- C:\Windows\System\ONHIWqE.exe
  C:\Windows\System\ONHIWqE.exe
  2⤵
  PID:2980
- C:\Windows\System\ouqKoHF.exe
  C:\Windows\System\ouqKoHF.exe
  2⤵
  PID:5104
- C:\Windows\System\HhFuMkz.exe
  C:\Windows\System\HhFuMkz.exe
  2⤵
  PID:4536
- C:\Windows\System\bHKZjmY.exe
  C:\Windows\System\bHKZjmY.exe
  2⤵
  PID:4800
- C:\Windows\System\DQPkzUH.exe
  C:\Windows\System\DQPkzUH.exe
  2⤵
  PID:4472
- C:\Windows\System\TCRlvvC.exe
  C:\Windows\System\TCRlvvC.exe
  2⤵
  PID:4344
- C:\Windows\System\HbqMYKx.exe
  C:\Windows\System\HbqMYKx.exe
  2⤵
  PID:5092
- C:\Windows\System\XYpRgYU.exe
  C:\Windows\System\XYpRgYU.exe
  2⤵
  PID:4404
- C:\Windows\System\XaaQYUB.exe
  C:\Windows\System\XaaQYUB.exe
  2⤵
  PID:4768
- C:\Windows\System\xvHKNNu.exe
  C:\Windows\System\xvHKNNu.exe
  2⤵
  PID:5144
- C:\Windows\System\FPEuMfu.exe
  C:\Windows\System\FPEuMfu.exe
  2⤵
  PID:5164
- C:\Windows\System\FsihaYd.exe
  C:\Windows\System\FsihaYd.exe
  2⤵
  PID:5188
- C:\Windows\System\DedxinI.exe
  C:\Windows\System\DedxinI.exe
  2⤵
  PID:5228
- C:\Windows\System\weAgFYY.exe
  C:\Windows\System\weAgFYY.exe
  2⤵
  PID:5248
- C:\Windows\System\uZdqOhD.exe
  C:\Windows\System\uZdqOhD.exe
  2⤵
  PID:5268
- C:\Windows\System\ZJZpNeX.exe
  C:\Windows\System\ZJZpNeX.exe
  2⤵
  PID:5284
- C:\Windows\System\UcdLlFT.exe
  C:\Windows\System\UcdLlFT.exe
  2⤵
  PID:5300
- C:\Windows\System\THjelsj.exe
  C:\Windows\System\THjelsj.exe
  2⤵
  PID:5316
- C:\Windows\System\tZDmEEK.exe
  C:\Windows\System\tZDmEEK.exe
  2⤵
  PID:5332
- C:\Windows\System\JeyJrgc.exe
  C:\Windows\System\JeyJrgc.exe
  2⤵
  PID:5348
- C:\Windows\System\jYYuTqZ.exe
  C:\Windows\System\jYYuTqZ.exe
  2⤵
  PID:5364
- C:\Windows\System\QsTTnIV.exe
  C:\Windows\System\QsTTnIV.exe
  2⤵
  PID:5476
- C:\Windows\System\RwtSmJY.exe
  C:\Windows\System\RwtSmJY.exe
  2⤵
  PID:5624
- C:\Windows\System\TPiRwap.exe
  C:\Windows\System\TPiRwap.exe
  2⤵
  PID:5920
- C:\Windows\System\cQLYeQS.exe
  C:\Windows\System\cQLYeQS.exe
  2⤵
  PID:5952
- C:\Windows\System\AgXWmiK.exe
  C:\Windows\System\AgXWmiK.exe
  2⤵
  PID:5984
- C:\Windows\System\bYLDNJt.exe
  C:\Windows\System\bYLDNJt.exe
  2⤵
  PID:6008
- C:\Windows\System\PUUkVMv.exe
  C:\Windows\System\PUUkVMv.exe
  2⤵
  PID:6024
- C:\Windows\System\QSczlGh.exe
  C:\Windows\System\QSczlGh.exe
  2⤵
  PID:6040
- C:\Windows\System\nEvuHYZ.exe
  C:\Windows\System\nEvuHYZ.exe
  2⤵
  PID:6056
- C:\Windows\System\bNMELHV.exe
  C:\Windows\System\bNMELHV.exe
  2⤵
  PID:6072
- C:\Windows\System\PPNfuvl.exe
  C:\Windows\System\PPNfuvl.exe
  2⤵
  PID:6088
- C:\Windows\System\ieKwrFd.exe
  C:\Windows\System\ieKwrFd.exe
  2⤵
  PID:6108
- C:\Windows\System\bpUgchA.exe
  C:\Windows\System\bpUgchA.exe
  2⤵
  PID:6124
- C:\Windows\System\CVTkyVb.exe
  C:\Windows\System\CVTkyVb.exe
  2⤵
  PID:6140
- C:\Windows\System\XPVIHRX.exe
  C:\Windows\System\XPVIHRX.exe
  2⤵
  PID:4812
- C:\Windows\System\oGKaqlz.exe
  C:\Windows\System\oGKaqlz.exe
  2⤵
  PID:5136
- C:\Windows\System\zpOvahy.exe
  C:\Windows\System\zpOvahy.exe
  2⤵
  PID:5176
- C:\Windows\System\XRKtlXs.exe
  C:\Windows\System\XRKtlXs.exe
  2⤵
  PID:5204
- C:\Windows\System\rKjBxaz.exe
  C:\Windows\System\rKjBxaz.exe
  2⤵
  PID:5236
- C:\Windows\System\HkGLGDt.exe
  C:\Windows\System\HkGLGDt.exe
  2⤵
  PID:5264
- C:\Windows\System\rhnogrF.exe
  C:\Windows\System\rhnogrF.exe
  2⤵
  PID:5308
- C:\Windows\System\azRyuQM.exe
  C:\Windows\System\azRyuQM.exe
  2⤵
  PID:5340
- C:\Windows\System\vvNcmeH.exe
  C:\Windows\System\vvNcmeH.exe
  2⤵
  PID:5356
- C:\Windows\System\CrTdWfB.exe
  C:\Windows\System\CrTdWfB.exe
  2⤵
  PID:5380
- C:\Windows\System\mLKQEYi.exe
  C:\Windows\System\mLKQEYi.exe
  2⤵
  PID:5400
- C:\Windows\System\VJXliUd.exe
  C:\Windows\System\VJXliUd.exe
  2⤵
  PID:5416
- C:\Windows\System\QOaKkYl.exe
  C:\Windows\System\QOaKkYl.exe
  2⤵
  PID:5432
- C:\Windows\System\qrOkLIb.exe
  C:\Windows\System\qrOkLIb.exe
  2⤵
  PID:5448
- C:\Windows\System\ULYtXCj.exe
  C:\Windows\System\ULYtXCj.exe
  2⤵
  PID:5464
- C:\Windows\System\FgNyDLD.exe
  C:\Windows\System\FgNyDLD.exe
  2⤵
  PID:5512
- C:\Windows\System\NOikiym.exe
  C:\Windows\System\NOikiym.exe
  2⤵
  PID:5580
- C:\Windows\System\HQAjUDz.exe
  C:\Windows\System\HQAjUDz.exe
  2⤵
  PID:5596
- C:\Windows\System\ZJhxLyK.exe
  C:\Windows\System\ZJhxLyK.exe
  2⤵
  PID:5604
- C:\Windows\System\rQINFWk.exe
  C:\Windows\System\rQINFWk.exe
  2⤵
  PID:5636
- C:\Windows\System\CpBPril.exe
  C:\Windows\System\CpBPril.exe
  2⤵
  PID:5656
- C:\Windows\System\RCUFtlY.exe
  C:\Windows\System\RCUFtlY.exe
  2⤵
  PID:5672
- C:\Windows\System\exQDApr.exe
  C:\Windows\System\exQDApr.exe
  2⤵
  PID:5692
- C:\Windows\System\oMKiOBf.exe
  C:\Windows\System\oMKiOBf.exe
  2⤵
  PID:5704
- C:\Windows\System\JwxGQUq.exe
  C:\Windows\System\JwxGQUq.exe
  2⤵
  PID:5720
- C:\Windows\System\zRclljQ.exe
  C:\Windows\System\zRclljQ.exe
  2⤵
  PID:5736
- C:\Windows\System\GJJaSGp.exe
  C:\Windows\System\GJJaSGp.exe
  2⤵
  PID:5756
- C:\Windows\System\kMxIJFw.exe
  C:\Windows\System\kMxIJFw.exe
  2⤵
  PID:5768
- C:\Windows\System\QJRKoFv.exe
  C:\Windows\System\QJRKoFv.exe
  2⤵
  PID:5784
- C:\Windows\System\JCPxxIK.exe
  C:\Windows\System\JCPxxIK.exe
  2⤵
  PID:5800
- C:\Windows\System\DQZOYMu.exe
  C:\Windows\System\DQZOYMu.exe
  2⤵
  PID:5816
- C:\Windows\System\kZyXysH.exe
  C:\Windows\System\kZyXysH.exe
  2⤵
  PID:5832
- C:\Windows\System\IaNpaNn.exe
  C:\Windows\System\IaNpaNn.exe
  2⤵
  PID:5856
- C:\Windows\System\OcJZFOZ.exe
  C:\Windows\System\OcJZFOZ.exe
  2⤵
  PID:5880
- C:\Windows\System\eMlZngA.exe
  C:\Windows\System\eMlZngA.exe
  2⤵
  PID:5900
- C:\Windows\System\UUCkjJl.exe
  C:\Windows\System\UUCkjJl.exe
  2⤵
  PID:5928
- C:\Windows\System\HXMulAn.exe
  C:\Windows\System\HXMulAn.exe
  2⤵
  PID:5964
- C:\Windows\System\MlKywyM.exe
  C:\Windows\System\MlKywyM.exe
  2⤵
  PID:5940
- C:\Windows\System\vVfgszi.exe
  C:\Windows\System\vVfgszi.exe
  2⤵
  PID:6004
- C:\Windows\System\IZcRonD.exe
  C:\Windows\System\IZcRonD.exe
  2⤵
  PID:6048
- C:\Windows\System\MGJYbQc.exe
  C:\Windows\System\MGJYbQc.exe
  2⤵
  PID:6096
- C:\Windows\System\ZkkppTi.exe
  C:\Windows\System\ZkkppTi.exe
  2⤵
  PID:6120
- C:\Windows\System\jelbAxg.exe
  C:\Windows\System\jelbAxg.exe
  2⤵
  PID:5152
- C:\Windows\System\FNhbndu.exe
  C:\Windows\System\FNhbndu.exe
  2⤵
  PID:5220
- C:\Windows\System\qZkKKZA.exe
  C:\Windows\System\qZkKKZA.exe
  2⤵
  PID:5280
- C:\Windows\System\RrWbMaw.exe
  C:\Windows\System\RrWbMaw.exe
  2⤵
  PID:5388
- C:\Windows\System\EaCwGXj.exe
  C:\Windows\System\EaCwGXj.exe
  2⤵
  PID:6136
- C:\Windows\System\PWWZteD.exe
  C:\Windows\System\PWWZteD.exe
  2⤵
  PID:5132
- C:\Windows\System\NdiepPH.exe
  C:\Windows\System\NdiepPH.exe
  2⤵
  PID:5224
- C:\Windows\System\SDYTzDF.exe
  C:\Windows\System\SDYTzDF.exe
  2⤵
  PID:5444
- C:\Windows\System\GXRBtTo.exe
  C:\Windows\System\GXRBtTo.exe
  2⤵
  PID:5408
- C:\Windows\System\MOdcaKk.exe
  C:\Windows\System\MOdcaKk.exe
  2⤵
  PID:5484
- C:\Windows\System\rYHGXXo.exe
  C:\Windows\System\rYHGXXo.exe
  2⤵
  PID:1400
- C:\Windows\System\KRuRuYe.exe
  C:\Windows\System\KRuRuYe.exe
  2⤵
  PID:5544
- C:\Windows\System\NswzmIy.exe
  C:\Windows\System\NswzmIy.exe
  2⤵
  PID:5632
- C:\Windows\System\HgLCIMY.exe
  C:\Windows\System\HgLCIMY.exe
  2⤵
  PID:5676
- C:\Windows\System\zFugmbO.exe
  C:\Windows\System\zFugmbO.exe
  2⤵
  PID:5716
- C:\Windows\System\FVUaJZq.exe
  C:\Windows\System\FVUaJZq.exe
  2⤵
  PID:5732
- C:\Windows\System\HJDlVIj.exe
  C:\Windows\System\HJDlVIj.exe
  2⤵
  PID:5780
- C:\Windows\System\WvFxKKY.exe
  C:\Windows\System\WvFxKKY.exe
  2⤵
  PID:5812
- C:\Windows\System\KAxyVns.exe
  C:\Windows\System\KAxyVns.exe
  2⤵
  PID:5848
- C:\Windows\System\HWtCUfa.exe
  C:\Windows\System\HWtCUfa.exe
  2⤵
  PID:5868
- C:\Windows\System\kDFaIQF.exe
  C:\Windows\System\kDFaIQF.exe
  2⤵
  PID:5972
- C:\Windows\System\eenMNoM.exe
  C:\Windows\System\eenMNoM.exe
  2⤵
  PID:6064
- C:\Windows\System\QPksYmU.exe
  C:\Windows\System\QPksYmU.exe
  2⤵
  PID:5996
- C:\Windows\System\iLfxfku.exe
  C:\Windows\System\iLfxfku.exe
  2⤵
  PID:6068
- C:\Windows\System\AugZULi.exe
  C:\Windows\System\AugZULi.exe
  2⤵
  PID:6104
- C:\Windows\System\LLQUYYV.exe
  C:\Windows\System\LLQUYYV.exe
  2⤵
  PID:6132
- C:\Windows\System\DcrPLFs.exe
  C:\Windows\System\DcrPLFs.exe
  2⤵
  PID:5196
- C:\Windows\System\ncOlHzN.exe
  C:\Windows\System\ncOlHzN.exe
  2⤵
  PID:5312
- C:\Windows\System\BRMDEFn.exe
  C:\Windows\System\BRMDEFn.exe
  2⤵
  PID:5532
- C:\Windows\System\ygWPIEj.exe
  C:\Windows\System\ygWPIEj.exe
  2⤵
  PID:5508
- C:\Windows\System\HwNOVqZ.exe
  C:\Windows\System\HwNOVqZ.exe
  2⤵
  PID:5572
- C:\Windows\System\kPImGLM.exe
  C:\Windows\System\kPImGLM.exe
  2⤵
  PID:5540
- C:\Windows\System\NIHjPTD.exe
  C:\Windows\System\NIHjPTD.exe
  2⤵
  PID:5696
- C:\Windows\System\MjwHEoa.exe
  C:\Windows\System\MjwHEoa.exe
  2⤵
  PID:5760
- C:\Windows\System\DvsmZMy.exe
  C:\Windows\System\DvsmZMy.exe
  2⤵
  PID:5744
- C:\Windows\System\cCZeASH.exe
  C:\Windows\System\cCZeASH.exe
  2⤵
  PID:5808
- C:\Windows\System\IjWTbyT.exe
  C:\Windows\System\IjWTbyT.exe
  2⤵
  PID:5932
- C:\Windows\System\ePQBgQm.exe
  C:\Windows\System\ePQBgQm.exe
  2⤵
  PID:5980
- C:\Windows\System\UuLtoji.exe
  C:\Windows\System\UuLtoji.exe
  2⤵
  PID:2752
- C:\Windows\System\FRDykGr.exe
  C:\Windows\System\FRDykGr.exe
  2⤵
  PID:5324
- C:\Windows\System\dGIVzdr.exe
  C:\Windows\System\dGIVzdr.exe
  2⤵
  PID:5876
- C:\Windows\System\NbXzgJT.exe
  C:\Windows\System\NbXzgJT.exe
  2⤵
  PID:5172
- C:\Windows\System\ZpSowzi.exe
  C:\Windows\System\ZpSowzi.exe
  2⤵
  PID:5524
- C:\Windows\System\aEzvZjJ.exe
  C:\Windows\System\aEzvZjJ.exe
  2⤵
  PID:5456
- C:\Windows\System\EPTRKaq.exe
  C:\Windows\System\EPTRKaq.exe
  2⤵
  PID:5496
- C:\Windows\System\aHMPYQZ.exe
  C:\Windows\System\aHMPYQZ.exe
  2⤵
  PID:5520
- C:\Windows\System\nESsLUP.exe
  C:\Windows\System\nESsLUP.exe
  2⤵
  PID:5500
- C:\Windows\System\RfqmPig.exe
  C:\Windows\System\RfqmPig.exe
  2⤵
  PID:5648
- C:\Windows\System\GIWvhkg.exe
  C:\Windows\System\GIWvhkg.exe
  2⤵
  PID:5748
- C:\Windows\System\EFMeRHx.exe
  C:\Windows\System\EFMeRHx.exe
  2⤵
  PID:5644
- C:\Windows\System\SXkUlGf.exe
  C:\Windows\System\SXkUlGf.exe
  2⤵
  PID:5556
- C:\Windows\System\HanlNSq.exe
  C:\Windows\System\HanlNSq.exe
  2⤵
  PID:5564
- C:\Windows\System\jLxYkgD.exe
  C:\Windows\System\jLxYkgD.exe
  2⤵
  PID:5912
- C:\Windows\System\UnyXVUp.exe
  C:\Windows\System\UnyXVUp.exe
  2⤵
  PID:5492
- C:\Windows\System\UwFNfdx.exe
  C:\Windows\System\UwFNfdx.exe
  2⤵
  PID:5276
- C:\Windows\System\CqYHNut.exe
  C:\Windows\System\CqYHNut.exe
  2⤵
  PID:5936
- C:\Windows\System\gogBvuU.exe
  C:\Windows\System\gogBvuU.exe
  2⤵
  PID:6000
- C:\Windows\System\vqrRtIW.exe
  C:\Windows\System\vqrRtIW.exe
  2⤵
  PID:6084
- C:\Windows\System\UfJgJxi.exe
  C:\Windows\System\UfJgJxi.exe
  2⤵
  PID:5944
- C:\Windows\System\kamsxYw.exe
  C:\Windows\System\kamsxYw.exe
  2⤵
  PID:6168
- C:\Windows\System\NDqMJVm.exe
  C:\Windows\System\NDqMJVm.exe
  2⤵
  PID:6188
- C:\Windows\System\SRMUQbZ.exe
  C:\Windows\System\SRMUQbZ.exe
  2⤵
  PID:6204
- C:\Windows\System\uCzwQRG.exe
  C:\Windows\System\uCzwQRG.exe
  2⤵
  PID:6228
- C:\Windows\System\PuWLvSI.exe
  C:\Windows\System\PuWLvSI.exe
  2⤵
  PID:6248
- C:\Windows\System\CEWGwTf.exe
  C:\Windows\System\CEWGwTf.exe
  2⤵
  PID:6268
- C:\Windows\System\yZsdGAR.exe
  C:\Windows\System\yZsdGAR.exe
  2⤵
  PID:6284
- C:\Windows\System\YSeRCeU.exe
  C:\Windows\System\YSeRCeU.exe
  2⤵
  PID:6300
- C:\Windows\System\wGGbQTz.exe
  C:\Windows\System\wGGbQTz.exe
  2⤵
  PID:6316
- C:\Windows\System\eODsiIv.exe
  C:\Windows\System\eODsiIv.exe
  2⤵
  PID:6332
- C:\Windows\System\XiSMwkj.exe
  C:\Windows\System\XiSMwkj.exe
  2⤵
  PID:6348
- C:\Windows\System\QGPnPHg.exe
  C:\Windows\System\QGPnPHg.exe
  2⤵
  PID:6368
- C:\Windows\System\yQLqSbh.exe
  C:\Windows\System\yQLqSbh.exe
  2⤵
  PID:6384
- C:\Windows\System\EAuPchs.exe
  C:\Windows\System\EAuPchs.exe
  2⤵
  PID:6404
- C:\Windows\System\pSjgpiX.exe
  C:\Windows\System\pSjgpiX.exe
  2⤵
  PID:6420
- C:\Windows\System\TyCsNAf.exe
  C:\Windows\System\TyCsNAf.exe
  2⤵
  PID:6436
- C:\Windows\System\PjNiyEM.exe
  C:\Windows\System\PjNiyEM.exe
  2⤵
  PID:6452
- C:\Windows\System\LAcqywW.exe
  C:\Windows\System\LAcqywW.exe
  2⤵
  PID:6468
- C:\Windows\System\DGyQtYF.exe
  C:\Windows\System\DGyQtYF.exe
  2⤵
  PID:6484
- C:\Windows\System\zVUvIrq.exe
  C:\Windows\System\zVUvIrq.exe
  2⤵
  PID:6500
- C:\Windows\System\vBTAZTw.exe
  C:\Windows\System\vBTAZTw.exe
  2⤵
  PID:6516
- C:\Windows\System\bFQadoL.exe
  C:\Windows\System\bFQadoL.exe
  2⤵
  PID:6564
- C:\Windows\System\RVFzbwn.exe
  C:\Windows\System\RVFzbwn.exe
  2⤵
  PID:6580
- C:\Windows\System\SrHjeGL.exe
  C:\Windows\System\SrHjeGL.exe
  2⤵
  PID:6600
- C:\Windows\System\eVzUyFW.exe
  C:\Windows\System\eVzUyFW.exe
  2⤵
  PID:6616
- C:\Windows\System\nbYbvBC.exe
  C:\Windows\System\nbYbvBC.exe
  2⤵
  PID:6632
- C:\Windows\System\VSjQser.exe
  C:\Windows\System\VSjQser.exe
  2⤵
  PID:6648
- C:\Windows\System\kGskFwX.exe
  C:\Windows\System\kGskFwX.exe
  2⤵
  PID:6664
- C:\Windows\System\MglTXFx.exe
  C:\Windows\System\MglTXFx.exe
  2⤵
  PID:6680
- C:\Windows\System\XuJrbZJ.exe
  C:\Windows\System\XuJrbZJ.exe
  2⤵
  PID:6696
- C:\Windows\System\UOlEOIJ.exe
  C:\Windows\System\UOlEOIJ.exe
  2⤵
  PID:6712
- C:\Windows\System\YyiaFye.exe
  C:\Windows\System\YyiaFye.exe
  2⤵
  PID:6728
- C:\Windows\System\TXKPUAW.exe
  C:\Windows\System\TXKPUAW.exe
  2⤵
  PID:6744
- C:\Windows\System\kuwLnOZ.exe
  C:\Windows\System\kuwLnOZ.exe
  2⤵
  PID:6760
- C:\Windows\System\ODcjHQN.exe
  C:\Windows\System\ODcjHQN.exe
  2⤵
  PID:6776
- C:\Windows\System\LsqbJsm.exe
  C:\Windows\System\LsqbJsm.exe
  2⤵
  PID:6792
- C:\Windows\System\TPCZeaw.exe
  C:\Windows\System\TPCZeaw.exe
  2⤵
  PID:6812
- C:\Windows\System\HIsaIDD.exe
  C:\Windows\System\HIsaIDD.exe
  2⤵
  PID:6828
- C:\Windows\System\FtESRSf.exe
  C:\Windows\System\FtESRSf.exe
  2⤵
  PID:6844
- C:\Windows\System\DwpjZDy.exe
  C:\Windows\System\DwpjZDy.exe
  2⤵
  PID:6860
- C:\Windows\System\JTPnSbc.exe
  C:\Windows\System\JTPnSbc.exe
  2⤵
  PID:6880
- C:\Windows\System\wrqCLpX.exe
  C:\Windows\System\wrqCLpX.exe
  2⤵
  PID:6896
- C:\Windows\System\SUoQrYz.exe
  C:\Windows\System\SUoQrYz.exe
  2⤵
  PID:6916
- C:\Windows\System\zhjtCOp.exe
  C:\Windows\System\zhjtCOp.exe
  2⤵
  PID:6932
- C:\Windows\System\wxMYzXP.exe
  C:\Windows\System\wxMYzXP.exe
  2⤵
  PID:6948
- C:\Windows\System\kLUJosu.exe
  C:\Windows\System\kLUJosu.exe
  2⤵
  PID:6964
- C:\Windows\System\MPEKbar.exe
  C:\Windows\System\MPEKbar.exe
  2⤵
  PID:6984
- C:\Windows\System\qlefLDv.exe
  C:\Windows\System\qlefLDv.exe
  2⤵
  PID:7000
- C:\Windows\System\TMRvWqU.exe
  C:\Windows\System\TMRvWqU.exe
  2⤵
  PID:7020
- C:\Windows\System\axItrls.exe
  C:\Windows\System\axItrls.exe
  2⤵
  PID:7036
- C:\Windows\System\bBaXHAx.exe
  C:\Windows\System\bBaXHAx.exe
  2⤵
  PID:7076
- C:\Windows\System\wjqhkkH.exe
  C:\Windows\System\wjqhkkH.exe
  2⤵
  PID:7092
- C:\Windows\System\fttQMvL.exe
  C:\Windows\System\fttQMvL.exe
  2⤵
  PID:7112
- C:\Windows\System\hZihVuZ.exe
  C:\Windows\System\hZihVuZ.exe
  2⤵
  PID:7132
- C:\Windows\System\AdhNoIu.exe
  C:\Windows\System\AdhNoIu.exe
  2⤵
  PID:7148
- C:\Windows\System\YKtwOHS.exe
  C:\Windows\System\YKtwOHS.exe
  2⤵
  PID:5560
- C:\Windows\System\oMAkpxB.exe
  C:\Windows\System\oMAkpxB.exe
  2⤵
  PID:6152
- C:\Windows\System\syXrLbg.exe
  C:\Windows\System\syXrLbg.exe
  2⤵
  PID:6176
- C:\Windows\System\eAXzFdi.exe
  C:\Windows\System\eAXzFdi.exe
  2⤵
  PID:6280
- C:\Windows\System\cIdFWVl.exe
  C:\Windows\System\cIdFWVl.exe
  2⤵
  PID:6212
- C:\Windows\System\AkynBtw.exe
  C:\Windows\System\AkynBtw.exe
  2⤵
  PID:6292
- C:\Windows\System\JvgxUsy.exe
  C:\Windows\System\JvgxUsy.exe
  2⤵
  PID:6296
- C:\Windows\System\GdaVndj.exe
  C:\Windows\System\GdaVndj.exe
  2⤵
  PID:6360
- C:\Windows\System\WrVBcaW.exe
  C:\Windows\System\WrVBcaW.exe
  2⤵
  PID:6444
- C:\Windows\System\ceCWcbT.exe
  C:\Windows\System\ceCWcbT.exe
  2⤵
  PID:6480
- C:\Windows\System\taudeJH.exe
  C:\Windows\System\taudeJH.exe
  2⤵
  PID:6460
- C:\Windows\System\XHIyCke.exe
  C:\Windows\System\XHIyCke.exe
  2⤵
  PID:6532
- C:\Windows\System\jKhfDSq.exe
  C:\Windows\System\jKhfDSq.exe
  2⤵
  PID:6608
- C:\Windows\System\TkNfMwW.exe
  C:\Windows\System\TkNfMwW.exe
  2⤵
  PID:6556
- C:\Windows\System\UdkoiZY.exe
  C:\Windows\System\UdkoiZY.exe
  2⤵
  PID:6624
- C:\Windows\System\jiQCtCc.exe
  C:\Windows\System\jiQCtCc.exe
  2⤵
  PID:6656
- C:\Windows\System\bUxBKKt.exe
  C:\Windows\System\bUxBKKt.exe
  2⤵
  PID:6708
- C:\Windows\System\DOvytOU.exe
  C:\Windows\System\DOvytOU.exe
  2⤵
  PID:6836
- C:\Windows\System\yqueKQI.exe
  C:\Windows\System\yqueKQI.exe
  2⤵
  PID:6904
- C:\Windows\System\PxFfTcl.exe
  C:\Windows\System\PxFfTcl.exe
  2⤵
  PID:5888
- C:\Windows\System\XyQjibg.exe
  C:\Windows\System\XyQjibg.exe
  2⤵
  PID:6976
- C:\Windows\System\gVLiVFp.exe
  C:\Windows\System\gVLiVFp.exe
  2⤵
  PID:6856
- C:\Windows\System\tXoVXVG.exe
  C:\Windows\System\tXoVXVG.exe
  2⤵
  PID:6892
- C:\Windows\System\nmvGfkH.exe
  C:\Windows\System\nmvGfkH.exe
  2⤵
  PID:7012
- C:\Windows\System\AJbISHq.exe
  C:\Windows\System\AJbISHq.exe
  2⤵
  PID:6992
- C:\Windows\System\nJgXwpt.exe
  C:\Windows\System\nJgXwpt.exe
  2⤵
  PID:7060
- C:\Windows\System\ipaPAXn.exe
  C:\Windows\System\ipaPAXn.exe
  2⤵
  PID:7108
- C:\Windows\System\mQiqfoJ.exe
  C:\Windows\System\mQiqfoJ.exe
  2⤵
  PID:7088
- C:\Windows\System\OHTavIV.exe
  C:\Windows\System\OHTavIV.exe
  2⤵
  PID:5908
- C:\Windows\System\yawqoMS.exe
  C:\Windows\System\yawqoMS.exe
  2⤵
  PID:7156
- C:\Windows\System\ZwUjVkG.exe
  C:\Windows\System\ZwUjVkG.exe
  2⤵
  PID:6276
- C:\Windows\System\mlLfHAa.exe
  C:\Windows\System\mlLfHAa.exe
  2⤵
  PID:6340
- C:\Windows\System\gZLeqAH.exe
  C:\Windows\System\gZLeqAH.exe
  2⤵
  PID:6256
- C:\Windows\System\tiadCpT.exe
  C:\Windows\System\tiadCpT.exe
  2⤵
  PID:6396
- C:\Windows\System\KqiliNX.exe
  C:\Windows\System\KqiliNX.exe
  2⤵
  PID:6492
- C:\Windows\System\wkkAFOZ.exe
  C:\Windows\System\wkkAFOZ.exe
  2⤵
  PID:6512
- C:\Windows\System\XHoDITw.exe
  C:\Windows\System\XHoDITw.exe
  2⤵
  PID:6572
- C:\Windows\System\QrSZSpY.exe
  C:\Windows\System\QrSZSpY.exe
  2⤵
  PID:6640
- C:\Windows\System\yIXwTrW.exe
  C:\Windows\System\yIXwTrW.exe
  2⤵
  PID:6688
- C:\Windows\System\mRLGDWy.exe
  C:\Windows\System\mRLGDWy.exe
  2⤵
  PID:6772
- C:\Windows\System\bAasGKP.exe
  C:\Windows\System\bAasGKP.exe
  2⤵
  PID:6876
- C:\Windows\System\iIqdHlO.exe
  C:\Windows\System\iIqdHlO.exe
  2⤵
  PID:6944
- C:\Windows\System\prdFGZk.exe
  C:\Windows\System\prdFGZk.exe
  2⤵
  PID:6980
- C:\Windows\System\oRyPred.exe
  C:\Windows\System\oRyPred.exe
  2⤵
  PID:6852
- C:\Windows\System\lLuQXlN.exe
  C:\Windows\System\lLuQXlN.exe
  2⤵
  PID:6788
- C:\Windows\System\PgCxBnc.exe
  C:\Windows\System\PgCxBnc.exe
  2⤵
  PID:7104
- C:\Windows\System\oGlgKYx.exe
  C:\Windows\System\oGlgKYx.exe
  2⤵
  PID:7124
- C:\Windows\System\PlpoRns.exe
  C:\Windows\System\PlpoRns.exe
  2⤵
  PID:6196
- C:\Windows\System\laPjQsD.exe
  C:\Windows\System\laPjQsD.exe
  2⤵
  PID:6220
- C:\Windows\System\qHKpKCY.exe
  C:\Windows\System\qHKpKCY.exe
  2⤵
  PID:6508
- C:\Windows\System\SwIOeCg.exe
  C:\Windows\System\SwIOeCg.exe
  2⤵
  PID:6672
- C:\Windows\System\BwPmnai.exe
  C:\Windows\System\BwPmnai.exe
  2⤵
  PID:6644
- C:\Windows\System\oOwlOwl.exe
  C:\Windows\System\oOwlOwl.exe
  2⤵
  PID:6768
- C:\Windows\System\kXHHFCc.exe
  C:\Windows\System\kXHHFCc.exe
  2⤵
  PID:6912
- C:\Windows\System\HuvUWUc.exe
  C:\Windows\System\HuvUWUc.exe
  2⤵
  PID:7052
- C:\Windows\System\BvPCdmX.exe
  C:\Windows\System\BvPCdmX.exe
  2⤵
  PID:7144
- C:\Windows\System\MmoLudl.exe
  C:\Windows\System\MmoLudl.exe
  2⤵
  PID:6180
- C:\Windows\System\ufEwYlm.exe
  C:\Windows\System\ufEwYlm.exe
  2⤵
  PID:6476
- C:\Windows\System\WADiUDq.exe
  C:\Windows\System\WADiUDq.exe
  2⤵
  PID:6724
- C:\Windows\System\vSYGcwY.exe
  C:\Windows\System\vSYGcwY.exe
  2⤵
  PID:6808
- C:\Windows\System\YsHiSVM.exe
  C:\Windows\System\YsHiSVM.exe
  2⤵
  PID:6692
- C:\Windows\System\qkTPVnX.exe
  C:\Windows\System\qkTPVnX.exe
  2⤵
  PID:6960
- C:\Windows\System\TdiKmph.exe
  C:\Windows\System\TdiKmph.exe
  2⤵
  PID:6380
- C:\Windows\System\lbgBWTz.exe
  C:\Windows\System\lbgBWTz.exe
  2⤵
  PID:6240
- C:\Windows\System\UtweuOm.exe
  C:\Windows\System\UtweuOm.exe
  2⤵
  PID:6660
- C:\Windows\System\IFtXbtt.exe
  C:\Windows\System\IFtXbtt.exe
  2⤵
  PID:6756
- C:\Windows\System\yekAwgp.exe
  C:\Windows\System\yekAwgp.exe
  2⤵
  PID:6312
- C:\Windows\System\MQHezfY.exe
  C:\Windows\System\MQHezfY.exe
  2⤵
  PID:7084
- C:\Windows\System\WzYIhWb.exe
  C:\Windows\System\WzYIhWb.exe
  2⤵
  PID:7172
- C:\Windows\System\WiqhzOX.exe
  C:\Windows\System\WiqhzOX.exe
  2⤵
  PID:7216
- C:\Windows\System\elbYzbi.exe
  C:\Windows\System\elbYzbi.exe
  2⤵
  PID:7232
- C:\Windows\System\HIgOXEs.exe
  C:\Windows\System\HIgOXEs.exe
  2⤵
  PID:7248
- C:\Windows\System\JYuvTVt.exe
  C:\Windows\System\JYuvTVt.exe
  2⤵
  PID:7264
- C:\Windows\System\CtKEPqk.exe
  C:\Windows\System\CtKEPqk.exe
  2⤵
  PID:7280
- C:\Windows\System\WpNMunD.exe
  C:\Windows\System\WpNMunD.exe
  2⤵
  PID:7296
- C:\Windows\System\PoIHoRt.exe
  C:\Windows\System\PoIHoRt.exe
  2⤵
  PID:7320
- C:\Windows\System\rgQKAdE.exe
  C:\Windows\System\rgQKAdE.exe
  2⤵
  PID:7344
- C:\Windows\System\HASsQVg.exe
  C:\Windows\System\HASsQVg.exe
  2⤵
  PID:7360
- C:\Windows\System\tVlGEgf.exe
  C:\Windows\System\tVlGEgf.exe
  2⤵
  PID:7380
- C:\Windows\System\qYDQXyn.exe
  C:\Windows\System\qYDQXyn.exe
  2⤵
  PID:7396
- C:\Windows\System\TGjjQMh.exe
  C:\Windows\System\TGjjQMh.exe
  2⤵
  PID:7412
- C:\Windows\System\JiASXEb.exe
  C:\Windows\System\JiASXEb.exe
  2⤵
  PID:7428
- C:\Windows\System\ykftMjc.exe
  C:\Windows\System\ykftMjc.exe
  2⤵
  PID:7448
- C:\Windows\System\yahpELR.exe
  C:\Windows\System\yahpELR.exe
  2⤵
  PID:7464
- C:\Windows\System\gpEHfcB.exe
  C:\Windows\System\gpEHfcB.exe
  2⤵
  PID:7480
- C:\Windows\System\nWJYCmu.exe
  C:\Windows\System\nWJYCmu.exe
  2⤵
  PID:7500
- C:\Windows\System\NqaGMFf.exe
  C:\Windows\System\NqaGMFf.exe
  2⤵
  PID:7516
- C:\Windows\System\yGBNFWv.exe
  C:\Windows\System\yGBNFWv.exe
  2⤵
  PID:7536
- C:\Windows\System\SAmZuNi.exe
  C:\Windows\System\SAmZuNi.exe
  2⤵
  PID:7556
- C:\Windows\System\CRfXWfP.exe
  C:\Windows\System\CRfXWfP.exe
  2⤵
  PID:7572
- C:\Windows\System\SDatCgf.exe
  C:\Windows\System\SDatCgf.exe
  2⤵
  PID:7600
- C:\Windows\System\AnCMmwi.exe
  C:\Windows\System\AnCMmwi.exe
  2⤵
  PID:7644
- C:\Windows\System\MHeFoZJ.exe
  C:\Windows\System\MHeFoZJ.exe
  2⤵
  PID:7660
- C:\Windows\System\Kwznebo.exe
  C:\Windows\System\Kwznebo.exe
  2⤵
  PID:7676
- C:\Windows\System\DxNMPWS.exe
  C:\Windows\System\DxNMPWS.exe
  2⤵
  PID:7692
- C:\Windows\System\EEzgHfp.exe
  C:\Windows\System\EEzgHfp.exe
  2⤵
  PID:7736
- C:\Windows\System\qlNnpAf.exe
  C:\Windows\System\qlNnpAf.exe
  2⤵
  PID:7756
- C:\Windows\System\mnZKyRf.exe
  C:\Windows\System\mnZKyRf.exe
  2⤵
  PID:7776
- C:\Windows\System\zORxLvl.exe
  C:\Windows\System\zORxLvl.exe
  2⤵
  PID:7792
- C:\Windows\System\lhpXbmw.exe
  C:\Windows\System\lhpXbmw.exe
  2⤵
  PID:7812
- C:\Windows\System\xUbuEqH.exe
  C:\Windows\System\xUbuEqH.exe
  2⤵
  PID:7832
- C:\Windows\System\BetSYwc.exe
  C:\Windows\System\BetSYwc.exe
  2⤵
  PID:7852
- C:\Windows\System\cJBxsmt.exe
  C:\Windows\System\cJBxsmt.exe
  2⤵
  PID:7872
- C:\Windows\System\ZgUqLXL.exe
  C:\Windows\System\ZgUqLXL.exe
  2⤵
  PID:7888
- C:\Windows\System\TIJGGMw.exe
  C:\Windows\System\TIJGGMw.exe
  2⤵
  PID:7908
- C:\Windows\System\swSCjLI.exe
  C:\Windows\System\swSCjLI.exe
  2⤵
  PID:7924
- C:\Windows\System\uQlNjLy.exe
  C:\Windows\System\uQlNjLy.exe
  2⤵
  PID:7940
- C:\Windows\System\GdkCgrL.exe
  C:\Windows\System\GdkCgrL.exe
  2⤵
  PID:7956
- C:\Windows\System\zwjBVUG.exe
  C:\Windows\System\zwjBVUG.exe
  2⤵
  PID:7980
- C:\Windows\System\cKxrrrg.exe
  C:\Windows\System\cKxrrrg.exe
  2⤵
  PID:8000
- C:\Windows\System\xTzaJOd.exe
  C:\Windows\System\xTzaJOd.exe
  2⤵
  PID:8016
- C:\Windows\System\XJVWViJ.exe
  C:\Windows\System\XJVWViJ.exe
  2⤵
  PID:8032
- C:\Windows\System\clgzusw.exe
  C:\Windows\System\clgzusw.exe
  2⤵
  PID:8048
- C:\Windows\System\NitZzVO.exe
  C:\Windows\System\NitZzVO.exe
  2⤵
  PID:8064
- C:\Windows\System\RxwMEvA.exe
  C:\Windows\System\RxwMEvA.exe
  2⤵
  PID:8080
- C:\Windows\System\YDDBsAD.exe
  C:\Windows\System\YDDBsAD.exe
  2⤵
  PID:8100
- C:\Windows\System\ZWNxnfc.exe
  C:\Windows\System\ZWNxnfc.exe
  2⤵
  PID:8116
- C:\Windows\System\tJRcKVI.exe
  C:\Windows\System\tJRcKVI.exe
  2⤵
  PID:7180
- C:\Windows\System\sjbbtsD.exe
  C:\Windows\System\sjbbtsD.exe
  2⤵
  PID:7204
- C:\Windows\System\Ofksekn.exe
  C:\Windows\System\Ofksekn.exe
  2⤵
  PID:7244
- C:\Windows\System\XDUGMqq.exe
  C:\Windows\System\XDUGMqq.exe
  2⤵
  PID:7304
- C:\Windows\System\NoccjNp.exe
  C:\Windows\System\NoccjNp.exe
  2⤵
  PID:7352
- C:\Windows\System\bcEpHgJ.exe
  C:\Windows\System\bcEpHgJ.exe
  2⤵
  PID:7332
- C:\Windows\System\XdSWlhE.exe
  C:\Windows\System\XdSWlhE.exe
  2⤵
  PID:7256
- C:\Windows\System\UsLPhHA.exe
  C:\Windows\System\UsLPhHA.exe
  2⤵
  PID:7392
- C:\Windows\System\zUjVZxQ.exe
  C:\Windows\System\zUjVZxQ.exe
  2⤵
  PID:7408
- C:\Windows\System\RoLXQdr.exe
  C:\Windows\System\RoLXQdr.exe
  2⤵
  PID:7460
- C:\Windows\System\EVZPrak.exe
  C:\Windows\System\EVZPrak.exe
  2⤵
  PID:7492
- C:\Windows\System\llhhhvm.exe
  C:\Windows\System\llhhhvm.exe
  2⤵
  PID:7528
- C:\Windows\System\oYSGOVQ.exe
  C:\Windows\System\oYSGOVQ.exe
  2⤵
  PID:7580
- C:\Windows\System\NjObZnW.exe
  C:\Windows\System\NjObZnW.exe
  2⤵
  PID:7552
- C:\Windows\System\yOQtRdJ.exe
  C:\Windows\System\yOQtRdJ.exe
  2⤵
  PID:7612
- C:\Windows\System\IlIaRDz.exe
  C:\Windows\System\IlIaRDz.exe
  2⤵
  PID:7624
- C:\Windows\System\hpgYNyq.exe
  C:\Windows\System\hpgYNyq.exe
  2⤵
  PID:7640
- C:\Windows\System\tBnzLqw.exe
  C:\Windows\System\tBnzLqw.exe
  2⤵
  PID:7700
- C:\Windows\System\BoDAfmJ.exe
  C:\Windows\System\BoDAfmJ.exe
  2⤵
  PID:7724
- C:\Windows\System\pOuWwDp.exe
  C:\Windows\System\pOuWwDp.exe
  2⤵
  PID:7684
- C:\Windows\System\PqyBvej.exe
  C:\Windows\System\PqyBvej.exe
  2⤵
  PID:7768
- C:\Windows\System\ZBlUppU.exe
  C:\Windows\System\ZBlUppU.exe
  2⤵
  PID:7788
- C:\Windows\System\OEIUYwa.exe
  C:\Windows\System\OEIUYwa.exe
  2⤵
  PID:7820
- C:\Windows\System\WkfItfM.exe
  C:\Windows\System\WkfItfM.exe
  2⤵
  PID:7844
- C:\Windows\System\REOOUES.exe
  C:\Windows\System\REOOUES.exe
  2⤵
  PID:7868
- C:\Windows\System\VbfgUog.exe
  C:\Windows\System\VbfgUog.exe
  2⤵
  PID:7920
- C:\Windows\System\CujPotD.exe
  C:\Windows\System\CujPotD.exe
  2⤵
  PID:7936
- C:\Windows\System\AtSbOmC.exe
  C:\Windows\System\AtSbOmC.exe
  2⤵
  PID:7968
- C:\Windows\System\ywJsysg.exe
  C:\Windows\System\ywJsysg.exe
  2⤵
  PID:8008
- C:\Windows\System\MJKCaRU.exe
  C:\Windows\System\MJKCaRU.exe
  2⤵
  PID:8092
- C:\Windows\System\XGRHNkz.exe
  C:\Windows\System\XGRHNkz.exe
  2⤵
  PID:8076
- C:\Windows\System\UGtjAqx.exe
  C:\Windows\System\UGtjAqx.exe
  2⤵
  PID:8128
- C:\Windows\System\eFSQDOG.exe
  C:\Windows\System\eFSQDOG.exe
  2⤵
  PID:8148
- C:\Windows\System\YngXGde.exe
  C:\Windows\System\YngXGde.exe
  2⤵
  PID:8180
- C:\Windows\System\yPRGJpD.exe
  C:\Windows\System\yPRGJpD.exe
  2⤵
  PID:7212
- C:\Windows\System\KIXQiBN.exe
  C:\Windows\System\KIXQiBN.exe
  2⤵
  PID:7224
- C:\Windows\System\okSvmRo.exe
  C:\Windows\System\okSvmRo.exe
  2⤵
  PID:7328
- C:\Windows\System\YdJVTks.exe
  C:\Windows\System\YdJVTks.exe
  2⤵
  PID:7388
- C:\Windows\System\xiateWW.exe
  C:\Windows\System\xiateWW.exe
  2⤵
  PID:7440
- C:\Windows\System\pyEPtbw.exe
  C:\Windows\System\pyEPtbw.exe
  2⤵
  PID:7508
- C:\Windows\System\TicpoRe.exe
  C:\Windows\System\TicpoRe.exe
  2⤵
  PID:7456
- C:\Windows\System\IBRRewx.exe
  C:\Windows\System\IBRRewx.exe
  2⤵
  PID:7632
- C:\Windows\System\XhJXCEg.exe
  C:\Windows\System\XhJXCEg.exe
  2⤵
  PID:7668
- C:\Windows\System\dNVlsza.exe
  C:\Windows\System\dNVlsza.exe
  2⤵
  PID:7720
- C:\Windows\System\vusrUhc.exe
  C:\Windows\System\vusrUhc.exe
  2⤵
  PID:7748
- C:\Windows\System\hbTuHEO.exe
  C:\Windows\System\hbTuHEO.exe
  2⤵
  PID:7800
- C:\Windows\System\yQGeKKO.exe
  C:\Windows\System\yQGeKKO.exe
  2⤵
  PID:7860
- C:\Windows\System\OKjFlds.exe
  C:\Windows\System\OKjFlds.exe
  2⤵
  PID:7948
- C:\Windows\System\jNOQSFz.exe
  C:\Windows\System\jNOQSFz.exe
  2⤵
  PID:7972
- C:\Windows\System\FZbiOmO.exe
  C:\Windows\System\FZbiOmO.exe
  2⤵
  PID:8096
- C:\Windows\System\mkbIXiY.exe
  C:\Windows\System\mkbIXiY.exe
  2⤵
  PID:8056
- C:\Windows\System\MgZbdBW.exe
  C:\Windows\System\MgZbdBW.exe
  2⤵
  PID:8124
- C:\Windows\System\JGWHodh.exe
  C:\Windows\System\JGWHodh.exe
  2⤵
  PID:8156
- C:\Windows\System\ZGyWIct.exe
  C:\Windows\System\ZGyWIct.exe
  2⤵
  PID:8188
- C:\Windows\System\XJqRPiX.exe
  C:\Windows\System\XJqRPiX.exe
  2⤵
  PID:7200
- C:\Windows\System\kMEJdXK.exe
  C:\Windows\System\kMEJdXK.exe
  2⤵
  PID:7424
- C:\Windows\System\nceCEhQ.exe
  C:\Windows\System\nceCEhQ.exe
  2⤵
  PID:7240
- C:\Windows\System\AXdDpAE.exe
  C:\Windows\System\AXdDpAE.exe
  2⤵
  PID:7524
- C:\Windows\System\ntWHDkL.exe
  C:\Windows\System\ntWHDkL.exe
  2⤵
  PID:7368
- C:\Windows\System\rECyIaQ.exe
  C:\Windows\System\rECyIaQ.exe
  2⤵
  PID:7568
- C:\Windows\System\YIYahNT.exe
  C:\Windows\System\YIYahNT.exe
  2⤵
  PID:7512
- C:\Windows\System\RDqoSZk.exe
  C:\Windows\System\RDqoSZk.exe
  2⤵
  PID:7884
- C:\Windows\System\RQLCzPy.exe
  C:\Windows\System\RQLCzPy.exe
  2⤵
  PID:7864
- C:\Windows\System\JcOVSDp.exe
  C:\Windows\System\JcOVSDp.exe
  2⤵
  PID:8028
- C:\Windows\System\bHNPqOs.exe
  C:\Windows\System\bHNPqOs.exe
  2⤵
  PID:7008
- C:\Windows\System\xzTCylZ.exe
  C:\Windows\System\xzTCylZ.exe
  2⤵
  PID:6464
- C:\Windows\System\tNPoOlL.exe
  C:\Windows\System\tNPoOlL.exe
  2⤵
  PID:8172
- C:\Windows\System\XtOuZSE.exe
  C:\Windows\System\XtOuZSE.exe
  2⤵
  PID:8168
- C:\Windows\System\zgzIbiv.exe
  C:\Windows\System\zgzIbiv.exe
  2⤵
  PID:7620
- C:\Windows\System\RNfuVvo.exe
  C:\Windows\System\RNfuVvo.exe
  2⤵
  PID:7840
- C:\Windows\System\xzUZcrD.exe
  C:\Windows\System\xzUZcrD.exe
  2⤵
  PID:7916
- C:\Windows\System\TbITdhe.exe
  C:\Windows\System\TbITdhe.exe
  2⤵
  PID:7996
- C:\Windows\System\pVWMPuw.exe
  C:\Windows\System\pVWMPuw.exe
  2⤵
  PID:7608
- C:\Windows\System\BVoHEBy.exe
  C:\Windows\System\BVoHEBy.exe
  2⤵
  PID:7716
- C:\Windows\System\TwofjGt.exe
  C:\Windows\System\TwofjGt.exe
  2⤵
  PID:7476
- C:\Windows\System\vdkGnDZ.exe
  C:\Windows\System\vdkGnDZ.exe
  2⤵
  PID:8140
- C:\Windows\System\aGfJrew.exe
  C:\Windows\System\aGfJrew.exe
  2⤵
  PID:7260
- C:\Windows\System\iALnReY.exe
  C:\Windows\System\iALnReY.exe
  2⤵
  PID:8072
- C:\Windows\System\OHRMBUj.exe
  C:\Windows\System\OHRMBUj.exe
  2⤵
  PID:8204
- C:\Windows\System\JFcBXhK.exe
  C:\Windows\System\JFcBXhK.exe
  2⤵
  PID:8224
- C:\Windows\System\yhEZWZa.exe
  C:\Windows\System\yhEZWZa.exe
  2⤵
  PID:8240
- C:\Windows\System\ccjSjKM.exe
  C:\Windows\System\ccjSjKM.exe
  2⤵
  PID:8256
- C:\Windows\System\YpJcODG.exe
  C:\Windows\System\YpJcODG.exe
  2⤵
  PID:8276
- C:\Windows\System\yoIYlTg.exe
  C:\Windows\System\yoIYlTg.exe
  2⤵
  PID:8292
- C:\Windows\System\YFGFBXg.exe
  C:\Windows\System\YFGFBXg.exe
  2⤵
  PID:8308
- C:\Windows\System\UJEOHRB.exe
  C:\Windows\System\UJEOHRB.exe
  2⤵
  PID:8324
- C:\Windows\System\YnwxBup.exe
  C:\Windows\System\YnwxBup.exe
  2⤵
  PID:8340
- C:\Windows\System\pUWWrLb.exe
  C:\Windows\System\pUWWrLb.exe
  2⤵
  PID:8356
- C:\Windows\System\gcAfSuY.exe
  C:\Windows\System\gcAfSuY.exe
  2⤵
  PID:8376
- C:\Windows\System\scVRgdg.exe
  C:\Windows\System\scVRgdg.exe
  2⤵
  PID:8396
- C:\Windows\System\qZioMee.exe
  C:\Windows\System\qZioMee.exe
  2⤵
  PID:8412
- C:\Windows\System\etYobGf.exe
  C:\Windows\System\etYobGf.exe
  2⤵
  PID:8440
- C:\Windows\System\XJSDbMD.exe
  C:\Windows\System\XJSDbMD.exe
  2⤵
  PID:8460
- C:\Windows\System\SQfZjpd.exe
  C:\Windows\System\SQfZjpd.exe
  2⤵
  PID:8476
- C:\Windows\System\csdlcNX.exe
  C:\Windows\System\csdlcNX.exe
  2⤵
  PID:8496
- C:\Windows\System\cSbCTUL.exe
  C:\Windows\System\cSbCTUL.exe
  2⤵
  PID:8520
- C:\Windows\System\fcdhTcr.exe
  C:\Windows\System\fcdhTcr.exe
  2⤵
  PID:8540
- C:\Windows\System\HuivVam.exe
  C:\Windows\System\HuivVam.exe
  2⤵
  PID:8556
- C:\Windows\System\DZjhpEj.exe
  C:\Windows\System\DZjhpEj.exe
  2⤵
  PID:8572
- C:\Windows\System\fweFsER.exe
  C:\Windows\System\fweFsER.exe
  2⤵
  PID:8588
- C:\Windows\System\qlJvLoj.exe
  C:\Windows\System\qlJvLoj.exe
  2⤵
  PID:8608
- C:\Windows\System\unRPHSd.exe
  C:\Windows\System\unRPHSd.exe
  2⤵
  PID:8624
- C:\Windows\System\RHPOHAL.exe
  C:\Windows\System\RHPOHAL.exe
  2⤵
  PID:8644
- C:\Windows\System\xIPpYFV.exe
  C:\Windows\System\xIPpYFV.exe
  2⤵
  PID:8660
- C:\Windows\System\VdThkBh.exe
  C:\Windows\System\VdThkBh.exe
  2⤵
  PID:8676
- C:\Windows\System\AcOVWme.exe
  C:\Windows\System\AcOVWme.exe
  2⤵
  PID:8696
- C:\Windows\System\DSGPzgj.exe
  C:\Windows\System\DSGPzgj.exe
  2⤵
  PID:8716
- C:\Windows\System\iaDkOMa.exe
  C:\Windows\System\iaDkOMa.exe
  2⤵
  PID:8732
- C:\Windows\System\zTbrDbQ.exe
  C:\Windows\System\zTbrDbQ.exe
  2⤵
  PID:8748
- C:\Windows\System\wRrJrYU.exe
  C:\Windows\System\wRrJrYU.exe
  2⤵
  PID:8772
- C:\Windows\System\tHXUWQm.exe
  C:\Windows\System\tHXUWQm.exe
  2⤵
  PID:8788
- C:\Windows\System\XsMPPqQ.exe
  C:\Windows\System\XsMPPqQ.exe
  2⤵
  PID:8808
- C:\Windows\System\WdiAilv.exe
  C:\Windows\System\WdiAilv.exe
  2⤵
  PID:8824
- C:\Windows\System\tfFzWSy.exe
  C:\Windows\System\tfFzWSy.exe
  2⤵
  PID:8840
- C:\Windows\System\XRnHtoF.exe
  C:\Windows\System\XRnHtoF.exe
  2⤵
  PID:8860
- C:\Windows\System\KkslEko.exe
  C:\Windows\System\KkslEko.exe
  2⤵
  PID:8880
- C:\Windows\System\NDaHmwv.exe
  C:\Windows\System\NDaHmwv.exe
  2⤵
  PID:8896
- C:\Windows\System\tBOhMTU.exe
  C:\Windows\System\tBOhMTU.exe
  2⤵
  PID:8912
- C:\Windows\System\PyNMGVF.exe
  C:\Windows\System\PyNMGVF.exe
  2⤵
  PID:8932
- C:\Windows\System\wLAdWrf.exe
  C:\Windows\System\wLAdWrf.exe
  2⤵
  PID:8952
- C:\Windows\System\ybUnkql.exe
  C:\Windows\System\ybUnkql.exe
  2⤵
  PID:8968
- C:\Windows\System\XVbcaWA.exe
  C:\Windows\System\XVbcaWA.exe
  2⤵
  PID:8984
- C:\Windows\System\YayplNo.exe
  C:\Windows\System\YayplNo.exe
  2⤵
  PID:9000
- C:\Windows\System\ocvewEt.exe
  C:\Windows\System\ocvewEt.exe
  2⤵
  PID:9024
- C:\Windows\System\OcjGIJp.exe
  C:\Windows\System\OcjGIJp.exe
  2⤵
  PID:9040
- C:\Windows\System\ruyFyfl.exe
  C:\Windows\System\ruyFyfl.exe
  2⤵
  PID:9060
- C:\Windows\System\GsrMaqH.exe
  C:\Windows\System\GsrMaqH.exe
  2⤵
  PID:9076
- C:\Windows\System\gxvAFMI.exe
  C:\Windows\System\gxvAFMI.exe
  2⤵
  PID:9092
- C:\Windows\System\OaHTZlN.exe
  C:\Windows\System\OaHTZlN.exe
  2⤵
  PID:9108
- C:\Windows\System\NWvQQGh.exe
  C:\Windows\System\NWvQQGh.exe
  2⤵
  PID:9132
- C:\Windows\System\NvRZpRr.exe
  C:\Windows\System\NvRZpRr.exe
  2⤵
  PID:9156
- C:\Windows\System\VwrTlQB.exe
  C:\Windows\System\VwrTlQB.exe
  2⤵
  PID:9176
- C:\Windows\System\MbWXFTL.exe
  C:\Windows\System\MbWXFTL.exe
  2⤵
  PID:9192
- C:\Windows\System\EGZwvpu.exe
  C:\Windows\System\EGZwvpu.exe
  2⤵
  PID:9208
- C:\Windows\System\bXGvrBE.exe
  C:\Windows\System\bXGvrBE.exe
  2⤵
  PID:7276
- C:\Windows\System\AMxHCkp.exe
  C:\Windows\System\AMxHCkp.exe
  2⤵
  PID:8216
- C:\Windows\System\DiiwFGc.exe
  C:\Windows\System\DiiwFGc.exe
  2⤵
  PID:8248
- C:\Windows\System\JZpvcGA.exe
  C:\Windows\System\JZpvcGA.exe
  2⤵
  PID:8336
- C:\Windows\System\ELWQHGn.exe
  C:\Windows\System\ELWQHGn.exe
  2⤵
  PID:8320
- C:\Windows\System\CSiQwax.exe
  C:\Windows\System\CSiQwax.exe
  2⤵
  PID:8368
- C:\Windows\System\UDITkQb.exe
  C:\Windows\System\UDITkQb.exe
  2⤵
  PID:8408
- C:\Windows\System\Laitxrd.exe
  C:\Windows\System\Laitxrd.exe
  2⤵
  PID:8452
- C:\Windows\System\VTKyFks.exe
  C:\Windows\System\VTKyFks.exe
  2⤵
  PID:8432
- C:\Windows\System\hIdPhYK.exe
  C:\Windows\System\hIdPhYK.exe
  2⤵
  PID:8528
- C:\Windows\System\UBjryGl.exe
  C:\Windows\System\UBjryGl.exe
  2⤵
  PID:8512
- C:\Windows\System\ZJjsprD.exe
  C:\Windows\System\ZJjsprD.exe
  2⤵
  PID:8568
- C:\Windows\System\QKhycCL.exe
  C:\Windows\System\QKhycCL.exe
  2⤵
  PID:8548
- C:\Windows\System\RvjTRWM.exe
  C:\Windows\System\RvjTRWM.exe
  2⤵
  PID:8632
- C:\Windows\System\gAPhkEs.exe
  C:\Windows\System\gAPhkEs.exe
  2⤵
  PID:8616
- C:\Windows\System\UPJyJni.exe
  C:\Windows\System\UPJyJni.exe
  2⤵
  PID:8712
- C:\Windows\System\mIkirub.exe
  C:\Windows\System\mIkirub.exe
  2⤵
  PID:8692
- C:\Windows\System\edIgPDr.exe
  C:\Windows\System\edIgPDr.exe
  2⤵
  PID:8728
- C:\Windows\System\sRYdImO.exe
  C:\Windows\System\sRYdImO.exe
  2⤵
  PID:8784
- C:\Windows\System\GrCiimR.exe
  C:\Windows\System\GrCiimR.exe
  2⤵
  PID:8800
- C:\Windows\System\oFjjjCu.exe
  C:\Windows\System\oFjjjCu.exe
  2⤵
  PID:8856
- C:\Windows\System\tNcbzUM.exe
  C:\Windows\System\tNcbzUM.exe
  2⤵
  PID:8836
- C:\Windows\System\ykHpkJE.exe
  C:\Windows\System\ykHpkJE.exe
  2⤵
  PID:8872
- C:\Windows\System\iHTFznR.exe
  C:\Windows\System\iHTFznR.exe
  2⤵
  PID:8964
- C:\Windows\System\tKZqgvF.exe
  C:\Windows\System\tKZqgvF.exe
  2⤵
  PID:8948
- C:\Windows\System\LsQRTvb.exe
  C:\Windows\System\LsQRTvb.exe
  2⤵
  PID:8980
- C:\Windows\System\NLWQNtf.exe
  C:\Windows\System\NLWQNtf.exe
  2⤵
  PID:9016
- C:\Windows\System\YsczBUx.exe
  C:\Windows\System\YsczBUx.exe
  2⤵
  PID:9056
- C:\Windows\System\mHAlIpT.exe
  C:\Windows\System\mHAlIpT.exe
  2⤵
  PID:9144
- C:\Windows\System\NtsrmNF.exe
  C:\Windows\System\NtsrmNF.exe
  2⤵
  PID:8060
- C:\Windows\System\mVFehwT.exe
  C:\Windows\System\mVFehwT.exe
  2⤵
  PID:9188
- C:\Windows\System\aLzOSol.exe
  C:\Windows\System\aLzOSol.exe
  2⤵
  PID:8200
- C:\Windows\System\QLTeZir.exe
  C:\Windows\System\QLTeZir.exe
  2⤵
  PID:8316
- C:\Windows\System\UxKvgZQ.exe
  C:\Windows\System\UxKvgZQ.exe
  2⤵
  PID:8944
- C:\Windows\System\EYRuvYT.exe
  C:\Windows\System\EYRuvYT.exe
  2⤵
  PID:9048
- C:\Windows\System\bpLlDZN.exe
  C:\Windows\System\bpLlDZN.exe
  2⤵
  PID:8492
- C:\Windows\System\hsIeQPn.exe
  C:\Windows\System\hsIeQPn.exe
  2⤵
  PID:8604
- C:\Windows\System\QfYZyJW.exe
  C:\Windows\System\QfYZyJW.exe
  2⤵
  PID:8740
- C:\Windows\System\TvyDWZC.exe
  C:\Windows\System\TvyDWZC.exe
  2⤵
  PID:8832
- C:\Windows\System\oTtGquR.exe
  C:\Windows\System\oTtGquR.exe
  2⤵
  PID:8652
- C:\Windows\System\cDIivpP.exe
  C:\Windows\System\cDIivpP.exe
  2⤵
  PID:8920
- C:\Windows\System\GkQNerJ.exe
  C:\Windows\System\GkQNerJ.exe
  2⤵
  PID:8960
- C:\Windows\System\OSztysq.exe
  C:\Windows\System\OSztysq.exe
  2⤵
  PID:9128
- C:\Windows\System\gHDXGvL.exe
  C:\Windows\System\gHDXGvL.exe
  2⤵
  PID:8448
- C:\Windows\System\iDaXHVP.exe
  C:\Windows\System\iDaXHVP.exe
  2⤵
  PID:8236
- C:\Windows\System\xZRNdvZ.exe
  C:\Windows\System\xZRNdvZ.exe
  2⤵
  PID:8472
- C:\Windows\System\YnbLBAL.exe
  C:\Windows\System\YnbLBAL.exe
  2⤵
  PID:8668
- C:\Windows\System\KFwWPlv.exe
  C:\Windows\System\KFwWPlv.exe
  2⤵
  PID:8768
- C:\Windows\System\OTjqjRC.exe
  C:\Windows\System\OTjqjRC.exe
  2⤵
  PID:8848
- C:\Windows\System\zgtAcjj.exe
  C:\Windows\System\zgtAcjj.exe
  2⤵
  PID:8232
- C:\Windows\System\TPpynCh.exe
  C:\Windows\System\TPpynCh.exe
  2⤵
  PID:8564
- C:\Windows\System\JmgRNeL.exe
  C:\Windows\System\JmgRNeL.exe
  2⤵
  PID:8288
- C:\Windows\System\fcgIKQO.exe
  C:\Windows\System\fcgIKQO.exe
  2⤵
  PID:8584
- C:\Windows\System\OYOzEbO.exe
  C:\Windows\System\OYOzEbO.exe
  2⤵
  PID:9068
- C:\Windows\System\PbCuIeh.exe
  C:\Windows\System\PbCuIeh.exe
  2⤵
  PID:8488
- C:\Windows\System\NKRkyyq.exe
  C:\Windows\System\NKRkyyq.exe
  2⤵
  PID:8196
- C:\Windows\System\FuzBveO.exe
  C:\Windows\System\FuzBveO.exe
  2⤵
  PID:8436
- C:\Windows\System\bpcuZdp.exe
  C:\Windows\System\bpcuZdp.exe
  2⤵
  PID:8724
- C:\Windows\System\PmGgwQu.exe
  C:\Windows\System\PmGgwQu.exe
  2⤵
  PID:8384
- C:\Windows\System\MsPmWQT.exe
  C:\Windows\System\MsPmWQT.exe
  2⤵
  PID:8504
- C:\Windows\System\KGktwcs.exe
  C:\Windows\System\KGktwcs.exe
  2⤵
  PID:8268
- C:\Windows\System\LvZCYhf.exe
  C:\Windows\System\LvZCYhf.exe
  2⤵
  PID:8404
- C:\Windows\System\EECOTNJ.exe
  C:\Windows\System\EECOTNJ.exe
  2⤵
  PID:9032
- C:\Windows\System\sfgQwWF.exe
  C:\Windows\System\sfgQwWF.exe
  2⤵
  PID:8640
- C:\Windows\System\MyBmMIG.exe
  C:\Windows\System\MyBmMIG.exe
  2⤵
  PID:9120
- C:\Windows\System\pUWGcff.exe
  C:\Windows\System\pUWGcff.exe
  2⤵
  PID:9200
- C:\Windows\System\TjkKOYh.exe
  C:\Windows\System\TjkKOYh.exe
  2⤵
  PID:9100
- C:\Windows\System\rMVrSYU.exe
  C:\Windows\System\rMVrSYU.exe
  2⤵
  PID:8908
- C:\Windows\System\yjlLhgE.exe
  C:\Windows\System\yjlLhgE.exe
  2⤵
  PID:8904
- C:\Windows\System\awxMQMC.exe
  C:\Windows\System\awxMQMC.exe
  2⤵
  PID:8940
- C:\Windows\System\YrdoSCc.exe
  C:\Windows\System\YrdoSCc.exe
  2⤵
  PID:9052
- C:\Windows\System\uIzInWT.exe
  C:\Windows\System\uIzInWT.exe
  2⤵
  PID:9232
- C:\Windows\System\kdEQnUj.exe
  C:\Windows\System\kdEQnUj.exe
  2⤵
  PID:9252
- C:\Windows\System\gJlAJTB.exe
  C:\Windows\System\gJlAJTB.exe
  2⤵
  PID:9272
- C:\Windows\System\uGnkhap.exe
  C:\Windows\System\uGnkhap.exe
  2⤵
  PID:9296
- C:\Windows\System\eFsykgb.exe
  C:\Windows\System\eFsykgb.exe
  2⤵
  PID:9312
- C:\Windows\System\twjCFRt.exe
  C:\Windows\System\twjCFRt.exe
  2⤵
  PID:9332
- C:\Windows\System\hDJHQbc.exe
  C:\Windows\System\hDJHQbc.exe
  2⤵
  PID:9364
- C:\Windows\System\XpnNTuR.exe
  C:\Windows\System\XpnNTuR.exe
  2⤵
  PID:9380
- C:\Windows\System\uoYYVwn.exe
  C:\Windows\System\uoYYVwn.exe
  2⤵
  PID:9396
- C:\Windows\System\nHReWCu.exe
  C:\Windows\System\nHReWCu.exe
  2⤵
  PID:9412
- C:\Windows\System\DCMZHTK.exe
  C:\Windows\System\DCMZHTK.exe
  2⤵
  PID:9436
- C:\Windows\System\eriwtRR.exe
  C:\Windows\System\eriwtRR.exe
  2⤵
  PID:9460
- C:\Windows\System\oqAOFzF.exe
  C:\Windows\System\oqAOFzF.exe
  2⤵
  PID:9480
- C:\Windows\System\spGYFxB.exe
  C:\Windows\System\spGYFxB.exe
  2⤵
  PID:9508
- C:\Windows\System\iGajeBl.exe
  C:\Windows\System\iGajeBl.exe
  2⤵
  PID:9524
- C:\Windows\System\cbISnGY.exe
  C:\Windows\System\cbISnGY.exe
  2⤵
  PID:9540
- C:\Windows\System\XeMLiky.exe
  C:\Windows\System\XeMLiky.exe
  2⤵
  PID:9556
- C:\Windows\System\MldLBFS.exe
  C:\Windows\System\MldLBFS.exe
  2⤵
  PID:9572
- C:\Windows\System\UdlIMyR.exe
  C:\Windows\System\UdlIMyR.exe
  2⤵
  PID:9592
- C:\Windows\System\AnhULto.exe
  C:\Windows\System\AnhULto.exe
  2⤵
  PID:9632
- C:\Windows\System\RtaXHbK.exe
  C:\Windows\System\RtaXHbK.exe
  2⤵
  PID:9652
- C:\Windows\System\BSeHOdI.exe
  C:\Windows\System\BSeHOdI.exe
  2⤵
  PID:9668
- C:\Windows\System\sHnjPCB.exe
  C:\Windows\System\sHnjPCB.exe
  2⤵
  PID:9684
- C:\Windows\System\OAwwMoq.exe
  C:\Windows\System\OAwwMoq.exe
  2⤵
  PID:9708
- C:\Windows\System\fHsDsDO.exe
  C:\Windows\System\fHsDsDO.exe
  2⤵
  PID:9732
- C:\Windows\System\ytLCNBR.exe
  C:\Windows\System\ytLCNBR.exe
  2⤵
  PID:9752
- C:\Windows\System\DsFAYQZ.exe
  C:\Windows\System\DsFAYQZ.exe
  2⤵
  PID:9768
- C:\Windows\System\dAsBiai.exe
  C:\Windows\System\dAsBiai.exe
  2⤵
  PID:9792
- C:\Windows\System\hpYgJZK.exe
  C:\Windows\System\hpYgJZK.exe
  2⤵
  PID:9808
- C:\Windows\System\XylRYoP.exe
  C:\Windows\System\XylRYoP.exe
  2⤵
  PID:9832
- C:\Windows\System\KxCISDj.exe
  C:\Windows\System\KxCISDj.exe
  2⤵
  PID:9852
- C:\Windows\System\JmxPPni.exe
  C:\Windows\System\JmxPPni.exe
  2⤵
  PID:9872
- C:\Windows\System\xKxMArv.exe
  C:\Windows\System\xKxMArv.exe
  2⤵
  PID:9892
- C:\Windows\System\iTRwBYH.exe
  C:\Windows\System\iTRwBYH.exe
  2⤵
  PID:9912
- C:\Windows\System\NrkOWYR.exe
  C:\Windows\System\NrkOWYR.exe
  2⤵
  PID:9936
- C:\Windows\System\wDLQhZa.exe
  C:\Windows\System\wDLQhZa.exe
  2⤵
  PID:9956
- C:\Windows\System\XrVmIdL.exe
  C:\Windows\System\XrVmIdL.exe
  2⤵
  PID:9976
- C:\Windows\System\yJbxApI.exe
  C:\Windows\System\yJbxApI.exe
  2⤵
  PID:9992
- C:\Windows\System\ZzoqegT.exe
  C:\Windows\System\ZzoqegT.exe
  2⤵
  PID:10012
- C:\Windows\System\PFXPacq.exe
  C:\Windows\System\PFXPacq.exe
  2⤵
  PID:10032
- C:\Windows\System\oRAstNG.exe
  C:\Windows\System\oRAstNG.exe
  2⤵
  PID:10052
- C:\Windows\System\kmpklxc.exe
  C:\Windows\System\kmpklxc.exe
  2⤵
  PID:10068
- C:\Windows\System\dErjDgg.exe
  C:\Windows\System\dErjDgg.exe
  2⤵
  PID:10092
- C:\Windows\System\tXMetkK.exe
  C:\Windows\System\tXMetkK.exe
  2⤵
  PID:10112
- C:\Windows\System\aGbdgqL.exe
  C:\Windows\System\aGbdgqL.exe
  2⤵
  PID:10132
- C:\Windows\System\PbMlxGQ.exe
  C:\Windows\System\PbMlxGQ.exe
  2⤵
  PID:10152
- C:\Windows\System\dRvvuqY.exe
  C:\Windows\System\dRvvuqY.exe
  2⤵
  PID:10172
- C:\Windows\System\DEGlRks.exe
  C:\Windows\System\DEGlRks.exe
  2⤵
  PID:10192
- C:\Windows\System\pZJlwRq.exe
  C:\Windows\System\pZJlwRq.exe
  2⤵
  PID:10212
- C:\Windows\System\sHMxIvw.exe
  C:\Windows\System\sHMxIvw.exe
  2⤵
  PID:10228
- C:\Windows\System\MUKdLjI.exe
  C:\Windows\System\MUKdLjI.exe
  2⤵
  PID:8672
- C:\Windows\System\BDZcRBv.exe
  C:\Windows\System\BDZcRBv.exe
  2⤵
  PID:9288
- C:\Windows\System\egcHqLL.exe
  C:\Windows\System\egcHqLL.exe
  2⤵
  PID:9328
- C:\Windows\System\wZOlNdA.exe
  C:\Windows\System\wZOlNdA.exe
  2⤵
  PID:9308
- C:\Windows\System\ynWvCQh.exe
  C:\Windows\System\ynWvCQh.exe
  2⤵
  PID:9356
- C:\Windows\System\jQZFPAp.exe
  C:\Windows\System\jQZFPAp.exe
  2⤵
  PID:9388
- C:\Windows\System\uSuqHVc.exe
  C:\Windows\System\uSuqHVc.exe
  2⤵
  PID:9424
- C:\Windows\System\oULDCvs.exe
  C:\Windows\System\oULDCvs.exe
  2⤵
  PID:9488
- C:\Windows\System\FuvVEso.exe
  C:\Windows\System\FuvVEso.exe
  2⤵
  PID:9492
- C:\Windows\System\wmZqLNF.exe
  C:\Windows\System\wmZqLNF.exe
  2⤵
  PID:9532
- C:\Windows\System\tFzetue.exe
  C:\Windows\System\tFzetue.exe
  2⤵
  PID:9564
- C:\Windows\System\dQLkzIe.exe
  C:\Windows\System\dQLkzIe.exe
  2⤵
  PID:9604
- C:\Windows\System\AuneMkW.exe
  C:\Windows\System\AuneMkW.exe
  2⤵
  PID:9620
- C:\Windows\System\IJTyaoP.exe
  C:\Windows\System\IJTyaoP.exe
  2⤵
  PID:9640
- C:\Windows\System\yUilgxN.exe
  C:\Windows\System\yUilgxN.exe
  2⤵
  PID:9676
- C:\Windows\System\FJtOGxY.exe
  C:\Windows\System\FJtOGxY.exe
  2⤵
  PID:9704
- C:\Windows\System\mRtSqbp.exe
  C:\Windows\System\mRtSqbp.exe
  2⤵
  PID:9748
- C:\Windows\System\CcqNglp.exe
  C:\Windows\System\CcqNglp.exe
  2⤵
  PID:9784
- C:\Windows\System\eIMfZaq.exe
  C:\Windows\System\eIMfZaq.exe
  2⤵
  PID:9824
- C:\Windows\System\vGfTOJa.exe
  C:\Windows\System\vGfTOJa.exe
  2⤵
  PID:9848
- C:\Windows\System\NjOBCLI.exe
  C:\Windows\System\NjOBCLI.exe
  2⤵
  PID:9900
- C:\Windows\System\dgItAhN.exe
  C:\Windows\System\dgItAhN.exe
  2⤵
  PID:9924
- C:\Windows\System\xXZPFIk.exe
  C:\Windows\System\xXZPFIk.exe
  2⤵
  PID:9948
- C:\Windows\System\WixWOaY.exe
  C:\Windows\System\WixWOaY.exe
  2⤵
  PID:9968
- C:\Windows\System\TVnKlle.exe
  C:\Windows\System\TVnKlle.exe
  2⤵
  PID:10004
- C:\Windows\System\AuSFpbw.exe
  C:\Windows\System\AuSFpbw.exe
  2⤵
  PID:10064
- C:\Windows\System\MmLSpVi.exe
  C:\Windows\System\MmLSpVi.exe
  2⤵
  PID:10088
- C:\Windows\System\cOPeHeJ.exe
  C:\Windows\System\cOPeHeJ.exe
  2⤵
  PID:10120
- C:\Windows\System\gHyJINe.exe
  C:\Windows\System\gHyJINe.exe
  2⤵
  PID:10144
- C:\Windows\System\GbCbbgF.exe
  C:\Windows\System\GbCbbgF.exe
  2⤵
  PID:10184
- C:\Windows\System\BTYKwMn.exe
  C:\Windows\System\BTYKwMn.exe
  2⤵
  PID:10220
- C:\Windows\System\moOXLkJ.exe
  C:\Windows\System\moOXLkJ.exe
  2⤵
  PID:9124
- C:\Windows\System\ldjWWuV.exe
  C:\Windows\System\ldjWWuV.exe
  2⤵
  PID:9260
- C:\Windows\System\IUiikvp.exe
  C:\Windows\System\IUiikvp.exe
  2⤵
  PID:9264
- C:\Windows\System\FIgLRGm.exe
  C:\Windows\System\FIgLRGm.exe
  2⤵
  PID:9372
- C:\Windows\System\KGXbPDU.exe
  C:\Windows\System\KGXbPDU.exe
  2⤵
  PID:9420
- C:\Windows\System\shxZjpp.exe
  C:\Windows\System\shxZjpp.exe
  2⤵
  PID:9500
- C:\Windows\System\sVsfgEE.exe
  C:\Windows\System\sVsfgEE.exe
  2⤵
  PID:9588
- C:\Windows\System\JjvZRKg.exe
  C:\Windows\System\JjvZRKg.exe
  2⤵
  PID:868
- C:\Windows\System\EyYiVxd.exe
  C:\Windows\System\EyYiVxd.exe
  2⤵
  PID:9700
- C:\Windows\System\EiYxWlg.exe
  C:\Windows\System\EiYxWlg.exe
  2⤵
  PID:9728
- C:\Windows\System\WxieIuw.exe
  C:\Windows\System\WxieIuw.exe
  2⤵
  PID:9740
- C:\Windows\System\rnBblOF.exe
  C:\Windows\System\rnBblOF.exe
  2⤵
  PID:9840
- C:\Windows\System\zJnbkIz.exe
  C:\Windows\System\zJnbkIz.exe
  2⤵
  PID:9884
- C:\Windows\System\KkLRptr.exe
  C:\Windows\System\KkLRptr.exe
  2⤵
  PID:9944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZwayoT.exe

Filesize
1006KB

MD5
728956ed021a48b9463565c5f6974c65

SHA1
4abc5bd41b6f8705898c3373485bc3cf2d9e2122

SHA256
a5c28b185dacef1a61e2fdb4caf7d8f2c1af9975d7104f8637cf6ffde2178ee6

SHA512
a9476ae7aea8d962a5f03dfe39907501bd75e098aa3762795707d600ee6b4ff3d028cf1bf6fe4f234f29da29307fa240d7a03084c89844c13ddb1e00baa413c6

Download Submit
C:\Windows\system\CDUdqTE.exe

Filesize
1006KB

MD5
925ac5dc2ec06adb49c8141665bbc143

SHA1
1f18054f93c2387a1147f088da573e1c29e7867e

SHA256
d069862aa72946d36f4cb270808a569cbb4e1ce2409c815d477f312cb85438f0

SHA512
305bce6c8d6e23f303b3a4b761d01c73c718b50dc35bb5487b71b26b5d4c64b83ab9abcfbfece97cc808842e329bec8154f4003e0079f6d20f227a1df1082110

Download Submit
C:\Windows\system\CZaGLKF.exe

Filesize
1003KB

MD5
0d92dbc4f7f2f5fca77220724d7be271

SHA1
8cae8ef17431bb5bbb835b90c1cd2d770b19f954

SHA256
a46f8353b79ec7bc15a83e9f031cd941e4429e1ba128c688a3c7af9a81f32a1f

SHA512
30a9ab69d11164abad5ee86a72072d51d75edac0b98ffd4661baa318a2a9918488089db9596c1265c3f3727414c9d7eab20e505b80888a73a9738514e367f69a

Download Submit
C:\Windows\system\DTKKFKI.exe

Filesize
1002KB

MD5
64409afebca2fa02946b8e1784d80a1d

SHA1
f92f11c009fbde47085e0893c7f5a4889624478f

SHA256
fb57f5ab75b8fcc55fcde8ab3ec55c349ef0c106d984d18703d781546bfba93b

SHA512
4b1e99c83f1e84ac5a675a934083d6857a5b177656f7e9414b739f09fea48e30e0c27e09a7ddefbe977c380477e88497eb2b9dbb24971886b84d35eb155b9911

Download Submit
C:\Windows\system\FlVjrCu.exe

Filesize
1001KB

MD5
3914b71f82222eda027bae0e39d24252

SHA1
dbb5ef6955cdeeba515df28c62c055a086055819

SHA256
876f3f564c6d919c486af29c12fe0e926c9e43ee801c3e61da709c811392bd3e

SHA512
397fb02c5b7133ab560b09f8219e8019af0b18e63dfa3b7642b5e6033009c588e7f5f1f76f1d23d60dde75cfa0874d5be0222d2efbafea1e3fa9a732611e125c

Download Submit
C:\Windows\system\LdlGHRy.exe

Filesize
1006KB

MD5
d9781847ae00b862401ec63b5c13c97f

SHA1
b757923198c0949ecd0fa500ecb6b61d23a34d09

SHA256
89e263765b88134a1b58b5726e2ecc3275076baece19c376145e251f5aec42b3

SHA512
0db35820153ad16b87180874de1abcd301b8a5438d5e775692821b92dba24bfa3f4a898c236c6a09726b0e985f966712cb905ecfd6db556f6c1d2db7e5b671de

Download Submit
C:\Windows\system\MsFMlem.exe

Filesize
1003KB

MD5
206ff4bec5caa5badc8defb4c4cb5e87

SHA1
1d8f97e803a0ead7d886bbb926cd10876e671b28

SHA256
4d969829dbf610a5fe4ba8b6fa567fa1bffce96dfc1c11488c8176b9edacadbf

SHA512
2b3abaa40acc0172287203c7bfe74c7480cbb762197edf112ecd714b6ccacf6abdc8c80e61195777d72df8881ed90c4a1d93a1c8e39cc7f35b75fd132f8f5ace

Download Submit
C:\Windows\system\OHgLMpd.exe

Filesize
1004KB

MD5
5ca087c178da3655ebb768b23e0fda13

SHA1
7d683e101222bc983738d005fa1898dea2437ae6

SHA256
10cf1d242e4930ffd2604afbd8a2fa18f8e53d722d2a5ca2aed007290604a588

SHA512
fb7544ddff2788f8189ba1ac2d231859b6664e3278b6d7f4e5cdeccf663f2ffae2db39cba1e020ed7445e7010de7477f42bc92de19a94e46411811a1ae23f084

Download Submit
C:\Windows\system\PUGnZiU.exe

Filesize
1005KB

MD5
400025f306f1002c2d605e81084dcab6

SHA1
2836422cea6202e2689bd146e2ed1f42239515f4

SHA256
4ae6f756a9f32328a86ef09f67f7a2e90450e6c3d19c7223491bb9796df9939f

SHA512
e9c4e840417c7e8f95dfb8e34175829d38f580bac7174e2620f0564c7ad435b84c7010eadfe21e1461b13ff18431798073744f9282055509b0edb13999132896

Download Submit
C:\Windows\system\PdxBLhD.exe

Filesize
1007KB

MD5
6addd6375aaa91ab034a059763ed6225

SHA1
7a3d22f81eb028bf3be8beee9697da437df840fb

SHA256
b41cef737cbd31e2c4703482a31ec0e0c0fc591087676fc8add3f4b0d870ed61

SHA512
021506b3b96be47e3ee42093c135ea15025277bcd888605dd1a73442c56c60cc3a5482cfa65d3e2a987e7cfcffcb1a990efa5965e3a5a803f236b20ba9067496

Download Submit
C:\Windows\system\RJzwCck.exe

Filesize
1007KB

MD5
0c19a3bd3490575f7a77230c85e1cf9e

SHA1
9ae5c6a1f94b310f2cdec28b4e96cd979d3ca8da

SHA256
425c21ddf128db10a92832721ae7148e2c3d43d15a8d5cec06ad49eebd752b41

SHA512
4deae2e0533729e3c83e1a153ed1ef235fc9d1f7f8649413086462fbae697dd93b5de3f318e2f83e0bf0dfe1418b23d2b183d048fad0c056d54b66ddc320a68f

Download Submit
C:\Windows\system\STEcaTY.exe

Filesize
1005KB

MD5
a3587320999f88cb819dbb6002c1bb02

SHA1
560a5b3bf5778b8882c2fd8e982ca7efe3fe51bb

SHA256
ee049259abb2088e43f82fdc79968e8cf360e7062de7353892afe5f9e91c4130

SHA512
75b9a4270a52560410ae520774e077509fabe7adf4042180daf20146f7d2a3b8433902b74ffd077ccc7cf50779ac8f302c4d7c1a1dcb45f4dfdcb8ff8f4c641d

Download Submit
C:\Windows\system\SdhMCHD.exe

Filesize
1005KB

MD5
9f6e0e49976d14cf915e6a02a6c749a8

SHA1
012a15acdb20f6e405091db2b1db56b59a107553

SHA256
7c87686094548a76070aa785bc6f7a6a0c3ebed13a42f27113cf62e197fd424d

SHA512
c11e87ac131362dff114aa10f22a348cd6bc3494988ddfd6cb72f97a21cba4edcbeaf064997bb553082324662f3a897367069af74fee68bbd0877efd288d3b9e

Download Submit
C:\Windows\system\ThHoAmB.exe

Filesize
1007KB

MD5
c32f3654e35bb60804f062ab200fed4b

SHA1
51fb0f11c8d51eab5574497b566f660d732068d0

SHA256
52272c435189eaa0b24667461cedb01da792c79668c61c6c71b35d382b1a13ab

SHA512
dbeec31d7ffb71125ae7f0521a51bd0a8f38ffffd284b37ba1aa70efef8bdeeefc2c82122f7d8e81428c4317a8ca3bdf6e29a971caf7d841928e8ef616c7a90c

Download Submit
C:\Windows\system\UNwjLLh.exe

Filesize
1006KB

MD5
b849c97348f023c141138fbef0027c4a

SHA1
33af183e9b49e87b38f0cff28e5ccb6c7971224d

SHA256
c72d909c31244144a96197f0b3da3be5799c43946c6e91f0c5042db975772c82

SHA512
0e48a42281d3475305bf0f62c339e5c18b1e64ef3f8b3669cd899a6a996acd4a625d6036005009a0f331c097f396c0bf7df60d228579c04feb84fbd41d07682c

Download Submit
C:\Windows\system\UajFiLb.exe

Filesize
1003KB

MD5
c52879e5fffc267a62b0bda4e31d3b34

SHA1
202d5f14ef19ed5803c8b4818a6847544c23ba66

SHA256
25dbcba2c89bb55c064d945494461c1d86d34fb5122beec63ddbe1aa395efd1b

SHA512
3d0830ba693e27a4dbd6ae179001af30ee485d7089b7ee7a39cb914cc9e06607a9ea585f71f3f996a7de6b9a087094112a62408497f11d758d0b49f78f10887d

Download Submit
C:\Windows\system\VOyIChv.exe

Filesize
1004KB

MD5
716a5b49df41eb83562d1d8a7b111100

SHA1
2c4bcb62983073ce6a7d39e84ae84324537a5b12

SHA256
17119f0fd12e62ccbeec1369541c031f51530b764778fb845b6bad25d58063d9

SHA512
c09cd71cdde2875ee2e3f7c2572d0b986f7262fde5534690911bb298207ef9727b7abf3a1e13ebb9f3abeeb9b143ae3c7d7b94c250c518b3644addf027ce8594

Download Submit
C:\Windows\system\YGdZCOj.exe

Filesize
1002KB

MD5
787602aeae45a1ce15925ccd16219d5a

SHA1
729e4dbc0b060504746f3390076ecaef7746cbe5

SHA256
08b6e46698974f06fa80a89e6d21076fab2a8312744c40fd6c0fb5a53897dff3

SHA512
6e5a9543fb72b176a71d4eaaa04910151d895d8bc4c4198023427c3a61180deb3d5db13c5428e5e05c1e4b296b8c75c00ec728f618410681b4860dde714021ae

Download Submit
C:\Windows\system\YOKsuZC.exe

Filesize
1003KB

MD5
46c95235ee927795b91813c29bdb771e

SHA1
43e085097a91dcff9faae4869c63980abb37770d

SHA256
2f7941679e1a279f0c63874924b95668ca45160afb11617103ba3129e034832b

SHA512
5ee0219b145a90eb9335a776e8847c8e0181df002b3eb09c234fb94256c91fac43bd124891597a784ca461c542677fb474847f335fccd629c9d2a27de55771be

Download Submit
C:\Windows\system\ZzGusRH.exe

Filesize
1004KB

MD5
8db6d89c782c2b94fae9cf7eeffb4d4e

SHA1
9a397ee8bd3427becd4379e14b77a6c98822fceb

SHA256
888b114dee7308099bfa440f1e508eac252261a1d3a165b2a55fdd2ec6e9e2e7

SHA512
9e673c58e07d6dc6ada4795324fdd9476313023f4c2d60fc60cccea5f3aea4406f62877f011dbb61c660752fa09b375c9d91fca72c9ec0b2fb04e9906e00c7ef

Download Submit
C:\Windows\system\aGkSgqZ.exe

Filesize
1001KB

MD5
46c5befdde0d2522dea5dce234456d31

SHA1
188947d0478013cef0fab1e6ca725fd5ea406e26

SHA256
59c9935d509eb1743656a1a887fc0e3d5d4dc8d075b71a5fb3b01d048f3fdbf4

SHA512
53333d9f96d17347dc2a188ace5c0600e5f202c17a7452df9993c5585e2850bd7819758a43f0e28d992d8d9b7d2d2c1a812abfd5cde05a8358dfa9384beeab3d

Download Submit
C:\Windows\system\azvKlkB.exe

Filesize
1008KB

MD5
907f09c7812d524fade86734dd3b823b

SHA1
1ddc8eaefbee062c9f5ebd495d05e831c52e4823

SHA256
367e13cbce0c87e3fb6ffbab43d3eea8276cb97ad47d4c7fbcc81f82e82f8b70

SHA512
a093637721ec400d7cb0b34efb0405e398cd8b64c3563322a843ac05258e4a81560732ce33a54a6b26be7099928957ef6b9514f11efe612d879709a48f6711af

Download Submit
C:\Windows\system\fJJVaYR.exe

Filesize
1004KB

MD5
5cb77bc9efd3bd193a1fed28842d7488

SHA1
4c183d461d0a3e7cc617bd28351682cf119b6f0c

SHA256
98ec07d6b638171384071d44c6c597771639d92cb268d4970973152d1e3a6d26

SHA512
05233994226ec93328c215f059bf25f7aee93bd86bac5de1dcb2568180f6c47159545b5afa8a23c36b4af030d3ee301ba58a1a5980b8b277943ee4fcb2541f64

Download Submit
C:\Windows\system\hPiJaIH.exe

Filesize
1007KB

MD5
e5dc402b2ccd19b07c49d596734e0974

SHA1
591cda8e51875d1c22bc7c8807f4b006567d9793

SHA256
fa867d08cfc60ef6f38287cacd291975c56a3e8530269754026b95f3ff9f9813

SHA512
66fd0f7f111301c1e21f9f2b24d92e33a25e003976a98c955e90b3a606d8bf3432fe636a6acd021e7552b18de1ba0bc345cfc44ea43645f9ca5fba0c0093406a

Download Submit
C:\Windows\system\nCnXXIk.exe

Filesize
1008KB

MD5
786c31b44c37d5b6fcfa44bb5f692753

SHA1
a41f494f35636b1ca274a9583e323fca37e4a30f

SHA256
de56b66736cd92a83faf212525244ef6489d4a666827244c0db7a6c6c7da88ee

SHA512
aa0164bedc400e2d9096d74f71b7de957b366b6505d1abcdf648789a69c6c4122e5edc7b8604040f6b1e456cd289ee7518ee7f1261ac97d7086f709d3d0de5dc

Download Submit
C:\Windows\system\nKAMidz.exe

Filesize
1002KB

MD5
fb550155451f6651762681826b3007c9

SHA1
f2e1ee195138a45b9c203f535d9104d7291ed687

SHA256
6eafc19aeaed9e1352468bdb6c2f104a9c479fc1c2f174351bf1f104f9dd1b04

SHA512
e1b730ccbc478dbb561dffa1632c1bd0ee176f50c012d49bce4106a142fabd6bdc8f8ad9855002fb0297d00a4c0bd0efae7e1a4336d1c3105f0fc02c2fae7e40

Download Submit
C:\Windows\system\oHfvRsS.exe

Filesize
1001KB

MD5
06b289f16d3f88a1faf52f13527d88e4

SHA1
d7e571284e3359582947aff3831f2a728fcba287

SHA256
7bc9d717a02407f28c93629010e431fbccb3b17e508078811c92dffb2ecb08bf

SHA512
9836f4991e9b54efd3c253b9e03aec6720c3ddbe719f18ed1cd866d597720fff77590a292579e873cceb940edc276ac4a90e5e40eb6b8f4825e1ebe45da022ae

Download Submit
C:\Windows\system\qQPWZiv.exe

Filesize
1005KB

MD5
d06a75bb7711fc9dda7e11a06c22f03b

SHA1
8c5438fb6259b9c8e7194eb0af64b53e90d1eb1e

SHA256
4d0d27f836e060398a886cba1f73bf0aa77bf3ae2f58eab700d8eeef6243201a

SHA512
f7dabd0a1062069d29897fa70fa7d515ef9ec812b188429438a798255963edd53db86b46b2cd946165f4ea24fda2f7435efd0908da2b4d8d50ebecdfb14543be

Download Submit
C:\Windows\system\vDocWKI.exe

Filesize
1002KB

MD5
870a2cd94ad7625988e116c2b2787631

SHA1
585b18a20bb63487fa381404e919e54a1148b565

SHA256
161b92660b6ea91a9b4ad6d9561d197f289750c3532ecb49a696926563e06643

SHA512
374a6861d9097eff816881529a062568818ed6aba997ab29c755935edbd0f95a48373c96cb9798ec26ab7e60099b37f80411cada4949b9ffe00bb55250b7c248

Download Submit
C:\Windows\system\yQOBmPV.exe

Filesize
1008KB

MD5
51859fda9534424c36d0a17adc3137fb

SHA1
e162235bd5988bdeabb12d612feb665312548736

SHA256
d6b4a7dd6c1bc68ee35e04e1942e88184473516ad897aed090f55dad3918d5f4

SHA512
e899cb037209272649250f1396ba674f42fe1376bd9a66d1923b827a79efe6c31f113cf0ce7893d708113c54eb79615ff0eb69aae7d126ce491b1973c92fa149

Download Submit
\Windows\system\FqGbgmL.exe

Filesize
1008KB

MD5
2baff3ef170e60a730c1560d20b523b4

SHA1
c211182dfb1e8bce7fc6d2ff6a72e3e1e92fc3c6

SHA256
2503c6b00f83ee7a18979883c73facc1b1a23fff6cb200e09d2b5d5a08eaeab0

SHA512
7ba79b90141d928c86beea7bd2a95b6c2e73e07f70f27040ae89518e878c6e5a4597baf6340be7ffa2c107ed2d1be47fd4dea0e7cd5b4db12300cb617ff91228

Download Submit
\Windows\system\TeGYTXu.exe

Filesize
1009KB

MD5
49ebd2eb8c7829ced8dff05d6bfcf747

SHA1
9b5cfe436bdda3d664c63175fc32c45ccd0f7cd7

SHA256
2dc57ceac3474da2754af53ae79a3a3cb0fe4d51529c3cbdf64ea5e16deeb2f1

SHA512
08d3ca1fcb9dd3c4423cfa32913c6d7f8c80c85ca5a49bbcdd41e13a212b570d4792e69e03879449d6e2efa7b922c72624bf45c85e27af2fc7f60b6ac396d1aa

Download Submit
\Windows\system\ZGTNEBl.exe

Filesize
1001KB

MD5
33c990928ed69e3a81b8e144ce02c646

SHA1
da488d8499361e6c3b80bf4488bf160a657c77e5

SHA256
3a4ca52bf329346c4a1d829fede61c509fc52df6b0fc377356d828b9be21b8be

SHA512
6117f18e332abf48e9cdf855c8d50e0056adb6f23fd1d46d12c9de0e4cd291f3d66b565ada57159d1b6af905be8b1c432edf8d434b44428e5efbed929cec4f17

Download Submit
memory/2092-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download