xmrig | 14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/12/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
Size

1.3MB
MD5

1d6d53667a149cdac0d06e74496c794e
SHA1

db0f6d53510a0b2658ce1b429f54c2353be4273b
SHA256

14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b
SHA512

3e8a1a5f24e88f1b64aceab5aa98face2fce34a95f2378defd3cdee9d77b1c79d88e9dc013b4d1cda5373f9cde232a7eac967bed16df64429287f0213ffdf60e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BnTLkp6F:GezaTF8FcNkNdfE0pZ9ozttwIRakGn3R

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012262-2.dat	xmrig
behavioral1/files/0x00080000000162e9-7.dat	xmrig
behavioral1/files/0x0007000000016458-10.dat	xmrig
behavioral1/files/0x000700000001658d-17.dat	xmrig
behavioral1/files/0x000900000001660b-21.dat	xmrig
behavioral1/files/0x00090000000167e3-25.dat	xmrig
behavioral1/files/0x0014000000015e9a-33.dat	xmrig
behavioral1/files/0x0007000000016d2c-39.dat	xmrig
behavioral1/files/0x0002000000018334-43.dat	xmrig
behavioral1/files/0x0005000000019326-48.dat	xmrig
behavioral1/files/0x000500000001932a-53.dat	xmrig
behavioral1/files/0x0005000000019394-58.dat	xmrig
behavioral1/files/0x00050000000193b8-68.dat	xmrig
behavioral1/files/0x0005000000019470-78.dat	xmrig
behavioral1/files/0x0005000000019489-88.dat	xmrig
behavioral1/files/0x000500000001948c-93.dat	xmrig
behavioral1/files/0x0005000000019490-98.dat	xmrig
behavioral1/files/0x00050000000194eb-108.dat	xmrig
behavioral1/files/0x00050000000195af-158.dat	xmrig
behavioral1/files/0x00050000000195ad-154.dat	xmrig
behavioral1/files/0x00050000000195a9-144.dat	xmrig
behavioral1/files/0x00050000000195ab-147.dat	xmrig
behavioral1/files/0x00050000000195a7-138.dat	xmrig
behavioral1/files/0x000500000001957c-133.dat	xmrig
behavioral1/files/0x0005000000019515-123.dat	xmrig
behavioral1/files/0x0005000000019547-127.dat	xmrig
behavioral1/files/0x000500000001950f-118.dat	xmrig
behavioral1/files/0x00050000000194ef-113.dat	xmrig
behavioral1/files/0x00050000000194a3-103.dat	xmrig
behavioral1/files/0x0005000000019480-83.dat	xmrig
behavioral1/files/0x00050000000193c7-73.dat	xmrig
behavioral1/files/0x00050000000193a0-63.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2852	NCGPtey.exe
2784	wBhRLQA.exe
2912	OSfPJxD.exe
3044	mAkmPIs.exe
2664	zUXtDRF.exe
2692	SLRkKqd.exe
2632	TgkpCpB.exe
2708	vVfrnkW.exe
1980	OASUOQY.exe
2588	cuNtctF.exe
1696	ngPSaur.exe
820	RhNdSJL.exe
2176	jIVEfzM.exe
1308	JxhCVqW.exe
2820	pMYzkdM.exe
760	yitQLDu.exe
1320	FSQtjNj.exe
2088	NbxRPjR.exe
1492	wicLonT.exe
2980	BdYdnWO.exe
2884	bNOqkbT.exe
2956	XjVAKgt.exe
2984	SvcBIXA.exe
1948	nuYQfBQ.exe
1388	fquBxXH.exe
2136	SwbNgPA.exe
2100	JXawtIz.exe
1748	BONxqvx.exe
2172	IXJZQtl.exe
2168	ZbumkDv.exe
2388	pWRUMPq.exe
2072	yTgdqBr.exe
2476	WMOUxAV.exe
1840	lQrMeOU.exe
1644	pdekkye.exe
1608	OAvwGXv.exe
872	gcEePWK.exe
880	VBYKqRR.exe
1672	FphjOAU.exe
580	FKkdmxz.exe
1628	TgXawAD.exe
1868	wjHIdOC.exe
1340	YaBMUbO.exe
1336	ONwDIMQ.exe
2716	OwzZwyv.exe
1796	sGhWXnR.exe
1780	tZFrorA.exe
1464	IDaTlSf.exe
908	LgFVYVc.exe
2540	SUZeimA.exe
2312	AQPYIEj.exe
1800	DZlSHhz.exe
556	ktljCLT.exe
2364	kUJovRL.exe
1488	dyCTKWl.exe
2352	uJwkpXA.exe
1316	IbSmDWG.exe
1816	ZHNTTFu.exe
2488	ZQIQllv.exe
744	CuTaIxa.exe
2204	fFipokP.exe
1684	OHPXnCM.exe
2872	XnSfekM.exe
2780	BUiVIVT.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NxdukaN.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ZblnODy.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\iKxRNAm.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\nAbMHol.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\wgQBaDm.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\KwZDbSI.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\HbOWjod.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\UqXFwjG.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\CwNdmAO.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ZkXQPRT.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\WaWokym.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\kVPEHzw.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\nldhTNv.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\attXHQM.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\aAIEFWi.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\OmElDqZ.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\NZFUUGJ.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\LPxknMQ.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\zrCwMMd.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\lBonXay.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\YEfVHOa.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\aGFTwnT.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\aTLglaO.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\mXNbOCV.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\BUFCZMX.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\FpvmTEe.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\TGtkphT.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\GciRYVd.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\jvJAywp.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\JnDIdVG.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\CZlEkWo.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\LpfpQSf.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\FTwxHoI.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\fDCWKdk.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\tLfpWXq.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ThZrbuM.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ksygcKn.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\xvYMjIB.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\wQubeGv.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\KnVKMOY.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\lqScFiF.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\PObbSsS.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\NxduHFJ.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\LsVLSwr.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\sjDsJsJ.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\dHTjyvV.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\KblvOgq.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\qeOKXSP.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\sTMuyWM.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\WqkBmYY.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\sOVhNUd.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ddzNUvA.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\McfRswF.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\tgLZNMp.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\HmXwpiP.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\RAzIhLM.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\QNBWpaR.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\OeybYGc.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\CTdoDqO.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\qcvWJKk.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\UrPJWxX.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\GlLziaE.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\ygwcEdF.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
File created	C:\Windows\System\QjSUrjR.exe	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2852	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	31
PID 2740 wrote to memory of 2852	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	31
PID 2740 wrote to memory of 2852	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	31
PID 2740 wrote to memory of 2784	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	32
PID 2740 wrote to memory of 2784	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	32
PID 2740 wrote to memory of 2784	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	32
PID 2740 wrote to memory of 2912	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	33
PID 2740 wrote to memory of 2912	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	33
PID 2740 wrote to memory of 2912	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	33
PID 2740 wrote to memory of 3044	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	34
PID 2740 wrote to memory of 3044	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	34
PID 2740 wrote to memory of 3044	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	34
PID 2740 wrote to memory of 2664	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	35
PID 2740 wrote to memory of 2664	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	35
PID 2740 wrote to memory of 2664	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	35
PID 2740 wrote to memory of 2692	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	36
PID 2740 wrote to memory of 2692	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	36
PID 2740 wrote to memory of 2692	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	36
PID 2740 wrote to memory of 2632	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	37
PID 2740 wrote to memory of 2632	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	37
PID 2740 wrote to memory of 2632	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	37
PID 2740 wrote to memory of 2708	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	38
PID 2740 wrote to memory of 2708	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	38
PID 2740 wrote to memory of 2708	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	38
PID 2740 wrote to memory of 1980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	39
PID 2740 wrote to memory of 1980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	39
PID 2740 wrote to memory of 1980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	39
PID 2740 wrote to memory of 2588	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	40
PID 2740 wrote to memory of 2588	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	40
PID 2740 wrote to memory of 2588	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	40
PID 2740 wrote to memory of 1696	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	41
PID 2740 wrote to memory of 1696	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	41
PID 2740 wrote to memory of 1696	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	41
PID 2740 wrote to memory of 820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	42
PID 2740 wrote to memory of 820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	42
PID 2740 wrote to memory of 820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	42
PID 2740 wrote to memory of 2176	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	43
PID 2740 wrote to memory of 2176	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	43
PID 2740 wrote to memory of 2176	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	43
PID 2740 wrote to memory of 1308	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	44
PID 2740 wrote to memory of 1308	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	44
PID 2740 wrote to memory of 1308	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	44
PID 2740 wrote to memory of 2820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	45
PID 2740 wrote to memory of 2820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	45
PID 2740 wrote to memory of 2820	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	45
PID 2740 wrote to memory of 760	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	46
PID 2740 wrote to memory of 760	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	46
PID 2740 wrote to memory of 760	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	46
PID 2740 wrote to memory of 1320	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	47
PID 2740 wrote to memory of 1320	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	47
PID 2740 wrote to memory of 1320	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	47
PID 2740 wrote to memory of 2088	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	48
PID 2740 wrote to memory of 2088	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	48
PID 2740 wrote to memory of 2088	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	48
PID 2740 wrote to memory of 1492	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	49
PID 2740 wrote to memory of 1492	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	49
PID 2740 wrote to memory of 1492	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	49
PID 2740 wrote to memory of 2980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	50
PID 2740 wrote to memory of 2980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	50
PID 2740 wrote to memory of 2980	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	50
PID 2740 wrote to memory of 2884	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	51
PID 2740 wrote to memory of 2884	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	51
PID 2740 wrote to memory of 2884	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	51
PID 2740 wrote to memory of 2956	2740	14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe	52

C:\Users\Admin\AppData\Local\Temp\14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe
"C:\Users\Admin\AppData\Local\Temp\14f51a01609afc5ddb30c58361070725a0a369c1c8bf920102cfa29439300a2b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System\NCGPtey.exe
  C:\Windows\System\NCGPtey.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\wBhRLQA.exe
  C:\Windows\System\wBhRLQA.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\OSfPJxD.exe
  C:\Windows\System\OSfPJxD.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\mAkmPIs.exe
  C:\Windows\System\mAkmPIs.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\zUXtDRF.exe
  C:\Windows\System\zUXtDRF.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\SLRkKqd.exe
  C:\Windows\System\SLRkKqd.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\TgkpCpB.exe
  C:\Windows\System\TgkpCpB.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\vVfrnkW.exe
  C:\Windows\System\vVfrnkW.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OASUOQY.exe
  C:\Windows\System\OASUOQY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\cuNtctF.exe
  C:\Windows\System\cuNtctF.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ngPSaur.exe
  C:\Windows\System\ngPSaur.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\RhNdSJL.exe
  C:\Windows\System\RhNdSJL.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\jIVEfzM.exe
  C:\Windows\System\jIVEfzM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\JxhCVqW.exe
  C:\Windows\System\JxhCVqW.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\pMYzkdM.exe
  C:\Windows\System\pMYzkdM.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\yitQLDu.exe
  C:\Windows\System\yitQLDu.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\FSQtjNj.exe
  C:\Windows\System\FSQtjNj.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\NbxRPjR.exe
  C:\Windows\System\NbxRPjR.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\wicLonT.exe
  C:\Windows\System\wicLonT.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BdYdnWO.exe
  C:\Windows\System\BdYdnWO.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\bNOqkbT.exe
  C:\Windows\System\bNOqkbT.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\XjVAKgt.exe
  C:\Windows\System\XjVAKgt.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\SvcBIXA.exe
  C:\Windows\System\SvcBIXA.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\nuYQfBQ.exe
  C:\Windows\System\nuYQfBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\fquBxXH.exe
  C:\Windows\System\fquBxXH.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\SwbNgPA.exe
  C:\Windows\System\SwbNgPA.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\JXawtIz.exe
  C:\Windows\System\JXawtIz.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\BONxqvx.exe
  C:\Windows\System\BONxqvx.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\IXJZQtl.exe
  C:\Windows\System\IXJZQtl.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ZbumkDv.exe
  C:\Windows\System\ZbumkDv.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\pWRUMPq.exe
  C:\Windows\System\pWRUMPq.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\yTgdqBr.exe
  C:\Windows\System\yTgdqBr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\WMOUxAV.exe
  C:\Windows\System\WMOUxAV.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\lQrMeOU.exe
  C:\Windows\System\lQrMeOU.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\pdekkye.exe
  C:\Windows\System\pdekkye.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\OAvwGXv.exe
  C:\Windows\System\OAvwGXv.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\gcEePWK.exe
  C:\Windows\System\gcEePWK.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\VBYKqRR.exe
  C:\Windows\System\VBYKqRR.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\FphjOAU.exe
  C:\Windows\System\FphjOAU.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\FKkdmxz.exe
  C:\Windows\System\FKkdmxz.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\TgXawAD.exe
  C:\Windows\System\TgXawAD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\wjHIdOC.exe
  C:\Windows\System\wjHIdOC.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\YaBMUbO.exe
  C:\Windows\System\YaBMUbO.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\ONwDIMQ.exe
  C:\Windows\System\ONwDIMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\OwzZwyv.exe
  C:\Windows\System\OwzZwyv.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\sGhWXnR.exe
  C:\Windows\System\sGhWXnR.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\tZFrorA.exe
  C:\Windows\System\tZFrorA.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\IDaTlSf.exe
  C:\Windows\System\IDaTlSf.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\LgFVYVc.exe
  C:\Windows\System\LgFVYVc.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\SUZeimA.exe
  C:\Windows\System\SUZeimA.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\AQPYIEj.exe
  C:\Windows\System\AQPYIEj.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\DZlSHhz.exe
  C:\Windows\System\DZlSHhz.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\ktljCLT.exe
  C:\Windows\System\ktljCLT.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\kUJovRL.exe
  C:\Windows\System\kUJovRL.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\dyCTKWl.exe
  C:\Windows\System\dyCTKWl.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\uJwkpXA.exe
  C:\Windows\System\uJwkpXA.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\IbSmDWG.exe
  C:\Windows\System\IbSmDWG.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ZHNTTFu.exe
  C:\Windows\System\ZHNTTFu.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ZQIQllv.exe
  C:\Windows\System\ZQIQllv.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\CuTaIxa.exe
  C:\Windows\System\CuTaIxa.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\fFipokP.exe
  C:\Windows\System\fFipokP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OHPXnCM.exe
  C:\Windows\System\OHPXnCM.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XnSfekM.exe
  C:\Windows\System\XnSfekM.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\BUiVIVT.exe
  C:\Windows\System\BUiVIVT.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\SXEnYgY.exe
  C:\Windows\System\SXEnYgY.exe
  2⤵
  PID:2644
- C:\Windows\System\lBpAVmY.exe
  C:\Windows\System\lBpAVmY.exe
  2⤵
  PID:2772
- C:\Windows\System\JBOccUJ.exe
  C:\Windows\System\JBOccUJ.exe
  2⤵
  PID:2640
- C:\Windows\System\TsUHroa.exe
  C:\Windows\System\TsUHroa.exe
  2⤵
  PID:2680
- C:\Windows\System\eAuDWVC.exe
  C:\Windows\System\eAuDWVC.exe
  2⤵
  PID:2248
- C:\Windows\System\gDeOohR.exe
  C:\Windows\System\gDeOohR.exe
  2⤵
  PID:2108
- C:\Windows\System\tRUeUQW.exe
  C:\Windows\System\tRUeUQW.exe
  2⤵
  PID:2804
- C:\Windows\System\MHAPPjN.exe
  C:\Windows\System\MHAPPjN.exe
  2⤵
  PID:432
- C:\Windows\System\pvfTWmb.exe
  C:\Windows\System\pvfTWmb.exe
  2⤵
  PID:2140
- C:\Windows\System\mOyKHKT.exe
  C:\Windows\System\mOyKHKT.exe
  2⤵
  PID:2112
- C:\Windows\System\qYXXtkz.exe
  C:\Windows\System\qYXXtkz.exe
  2⤵
  PID:1236
- C:\Windows\System\HQYGgbk.exe
  C:\Windows\System\HQYGgbk.exe
  2⤵
  PID:2752
- C:\Windows\System\zFfVlCx.exe
  C:\Windows\System\zFfVlCx.exe
  2⤵
  PID:2652
- C:\Windows\System\UlcRwjG.exe
  C:\Windows\System\UlcRwjG.exe
  2⤵
  PID:1260
- C:\Windows\System\flGkeJX.exe
  C:\Windows\System\flGkeJX.exe
  2⤵
  PID:2972
- C:\Windows\System\mXJqdjc.exe
  C:\Windows\System\mXJqdjc.exe
  2⤵
  PID:1992
- C:\Windows\System\TYxJRxv.exe
  C:\Windows\System\TYxJRxv.exe
  2⤵
  PID:672
- C:\Windows\System\AtQELRh.exe
  C:\Windows\System\AtQELRh.exe
  2⤵
  PID:2008
- C:\Windows\System\UxzRbJE.exe
  C:\Windows\System\UxzRbJE.exe
  2⤵
  PID:2160
- C:\Windows\System\AtRjIzb.exe
  C:\Windows\System\AtRjIzb.exe
  2⤵
  PID:2156
- C:\Windows\System\hbRDfpH.exe
  C:\Windows\System\hbRDfpH.exe
  2⤵
  PID:2504
- C:\Windows\System\qAlFYlv.exe
  C:\Windows\System\qAlFYlv.exe
  2⤵
  PID:1936
- C:\Windows\System\KbwpPAr.exe
  C:\Windows\System\KbwpPAr.exe
  2⤵
  PID:1384
- C:\Windows\System\zaEHoLL.exe
  C:\Windows\System\zaEHoLL.exe
  2⤵
  PID:1288
- C:\Windows\System\fzzUOMI.exe
  C:\Windows\System\fzzUOMI.exe
  2⤵
  PID:736
- C:\Windows\System\VOLzysy.exe
  C:\Windows\System\VOLzysy.exe
  2⤵
  PID:936
- C:\Windows\System\EPUJjhL.exe
  C:\Windows\System\EPUJjhL.exe
  2⤵
  PID:856
- C:\Windows\System\hcIqkoN.exe
  C:\Windows\System\hcIqkoN.exe
  2⤵
  PID:1988
- C:\Windows\System\PnxFXiq.exe
  C:\Windows\System\PnxFXiq.exe
  2⤵
  PID:1756
- C:\Windows\System\imapjgR.exe
  C:\Windows\System\imapjgR.exe
  2⤵
  PID:2320
- C:\Windows\System\YhCEiCb.exe
  C:\Windows\System\YhCEiCb.exe
  2⤵
  PID:640
- C:\Windows\System\BpgiNzt.exe
  C:\Windows\System\BpgiNzt.exe
  2⤵
  PID:328
- C:\Windows\System\uWgMYYU.exe
  C:\Windows\System\uWgMYYU.exe
  2⤵
  PID:2288
- C:\Windows\System\eyVnZEe.exe
  C:\Windows\System\eyVnZEe.exe
  2⤵
  PID:1848
- C:\Windows\System\geqCwHy.exe
  C:\Windows\System\geqCwHy.exe
  2⤵
  PID:1856
- C:\Windows\System\DJnhneS.exe
  C:\Windows\System\DJnhneS.exe
  2⤵
  PID:1808
- C:\Windows\System\GJmmwPP.exe
  C:\Windows\System\GJmmwPP.exe
  2⤵
  PID:1008
- C:\Windows\System\aBmwYOW.exe
  C:\Windows\System\aBmwYOW.exe
  2⤵
  PID:2344
- C:\Windows\System\gacREHE.exe
  C:\Windows\System\gacREHE.exe
  2⤵
  PID:1928
- C:\Windows\System\XKLSLzg.exe
  C:\Windows\System\XKLSLzg.exe
  2⤵
  PID:1600
- C:\Windows\System\kKmbPmt.exe
  C:\Windows\System\kKmbPmt.exe
  2⤵
  PID:2848
- C:\Windows\System\kDTMngs.exe
  C:\Windows\System\kDTMngs.exe
  2⤵
  PID:2792
- C:\Windows\System\CaoXCSZ.exe
  C:\Windows\System\CaoXCSZ.exe
  2⤵
  PID:2096
- C:\Windows\System\yrhZweJ.exe
  C:\Windows\System\yrhZweJ.exe
  2⤵
  PID:2636
- C:\Windows\System\WnGPLQe.exe
  C:\Windows\System\WnGPLQe.exe
  2⤵
  PID:2904
- C:\Windows\System\hGGHIpw.exe
  C:\Windows\System\hGGHIpw.exe
  2⤵
  PID:2616
- C:\Windows\System\LTbELaV.exe
  C:\Windows\System\LTbELaV.exe
  2⤵
  PID:1484
- C:\Windows\System\HJVMGPV.exe
  C:\Windows\System\HJVMGPV.exe
  2⤵
  PID:2424
- C:\Windows\System\YfmwaoB.exe
  C:\Windows\System\YfmwaoB.exe
  2⤵
  PID:2196
- C:\Windows\System\HMhqgLa.exe
  C:\Windows\System\HMhqgLa.exe
  2⤵
  PID:2604
- C:\Windows\System\ghLroaV.exe
  C:\Windows\System\ghLroaV.exe
  2⤵
  PID:2928
- C:\Windows\System\KSKoWgt.exe
  C:\Windows\System\KSKoWgt.exe
  2⤵
  PID:2816
- C:\Windows\System\MXDSxRP.exe
  C:\Windows\System\MXDSxRP.exe
  2⤵
  PID:2888
- C:\Windows\System\GvqhBcZ.exe
  C:\Windows\System\GvqhBcZ.exe
  2⤵
  PID:1120
- C:\Windows\System\PtxyDkj.exe
  C:\Windows\System\PtxyDkj.exe
  2⤵
  PID:1776
- C:\Windows\System\rIEwwAh.exe
  C:\Windows\System\rIEwwAh.exe
  2⤵
  PID:2000
- C:\Windows\System\WXNnuTO.exe
  C:\Windows\System\WXNnuTO.exe
  2⤵
  PID:2452
- C:\Windows\System\aGkYQPx.exe
  C:\Windows\System\aGkYQPx.exe
  2⤵
  PID:2372
- C:\Windows\System\jUJgSkA.exe
  C:\Windows\System\jUJgSkA.exe
  2⤵
  PID:1972
- C:\Windows\System\MTspMWS.exe
  C:\Windows\System\MTspMWS.exe
  2⤵
  PID:2128
- C:\Windows\System\qPyiVwn.exe
  C:\Windows\System\qPyiVwn.exe
  2⤵
  PID:2132
- C:\Windows\System\UNRcdCN.exe
  C:\Windows\System\UNRcdCN.exe
  2⤵
  PID:2020
- C:\Windows\System\BfDXEVO.exe
  C:\Windows\System\BfDXEVO.exe
  2⤵
  PID:2560
- C:\Windows\System\GSNkCBA.exe
  C:\Windows\System\GSNkCBA.exe
  2⤵
  PID:2064
- C:\Windows\System\aKLjsyx.exe
  C:\Windows\System\aKLjsyx.exe
  2⤵
  PID:1908
- C:\Windows\System\GpYBTzA.exe
  C:\Windows\System\GpYBTzA.exe
  2⤵
  PID:2940
- C:\Windows\System\wBDeesz.exe
  C:\Windows\System\wBDeesz.exe
  2⤵
  PID:3060
- C:\Windows\System\WaAEthy.exe
  C:\Windows\System\WaAEthy.exe
  2⤵
  PID:1772
- C:\Windows\System\rtijbnn.exe
  C:\Windows\System\rtijbnn.exe
  2⤵
  PID:928
- C:\Windows\System\RBfUDQj.exe
  C:\Windows\System\RBfUDQj.exe
  2⤵
  PID:2228
- C:\Windows\System\WBZWIrq.exe
  C:\Windows\System\WBZWIrq.exe
  2⤵
  PID:812
- C:\Windows\System\aVUVSkA.exe
  C:\Windows\System\aVUVSkA.exe
  2⤵
  PID:740
- C:\Windows\System\PEsSfpI.exe
  C:\Windows\System\PEsSfpI.exe
  2⤵
  PID:1592
- C:\Windows\System\imCRRFZ.exe
  C:\Windows\System\imCRRFZ.exe
  2⤵
  PID:2244
- C:\Windows\System\jxgVfcC.exe
  C:\Windows\System\jxgVfcC.exe
  2⤵
  PID:2996
- C:\Windows\System\ASLemyU.exe
  C:\Windows\System\ASLemyU.exe
  2⤵
  PID:2896
- C:\Windows\System\Lqvjpne.exe
  C:\Windows\System\Lqvjpne.exe
  2⤵
  PID:980
- C:\Windows\System\SwsPkRH.exe
  C:\Windows\System\SwsPkRH.exe
  2⤵
  PID:1616
- C:\Windows\System\QIQMdeV.exe
  C:\Windows\System\QIQMdeV.exe
  2⤵
  PID:1524
- C:\Windows\System\jRHpBen.exe
  C:\Windows\System\jRHpBen.exe
  2⤵
  PID:1760
- C:\Windows\System\jxPQkyd.exe
  C:\Windows\System\jxPQkyd.exe
  2⤵
  PID:2052
- C:\Windows\System\xvYMjIB.exe
  C:\Windows\System\xvYMjIB.exe
  2⤵
  PID:544
- C:\Windows\System\hlcxQrA.exe
  C:\Windows\System\hlcxQrA.exe
  2⤵
  PID:320
- C:\Windows\System\WXDRzYG.exe
  C:\Windows\System\WXDRzYG.exe
  2⤵
  PID:824
- C:\Windows\System\zhjtRpG.exe
  C:\Windows\System\zhjtRpG.exe
  2⤵
  PID:1300
- C:\Windows\System\gIOtKiy.exe
  C:\Windows\System\gIOtKiy.exe
  2⤵
  PID:2120
- C:\Windows\System\gpVtPWJ.exe
  C:\Windows\System\gpVtPWJ.exe
  2⤵
  PID:2192
- C:\Windows\System\BvRgNnv.exe
  C:\Windows\System\BvRgNnv.exe
  2⤵
  PID:3004
- C:\Windows\System\vDgqcOA.exe
  C:\Windows\System\vDgqcOA.exe
  2⤵
  PID:1040
- C:\Windows\System\MJpSzrp.exe
  C:\Windows\System\MJpSzrp.exe
  2⤵
  PID:1704
- C:\Windows\System\JDsnkxM.exe
  C:\Windows\System\JDsnkxM.exe
  2⤵
  PID:996
- C:\Windows\System\UILGXKA.exe
  C:\Windows\System\UILGXKA.exe
  2⤵
  PID:2272
- C:\Windows\System\aeufaOI.exe
  C:\Windows\System\aeufaOI.exe
  2⤵
  PID:992
- C:\Windows\System\KPVDklp.exe
  C:\Windows\System\KPVDklp.exe
  2⤵
  PID:2876
- C:\Windows\System\CazHghW.exe
  C:\Windows\System\CazHghW.exe
  2⤵
  PID:2800
- C:\Windows\System\YwjwunW.exe
  C:\Windows\System\YwjwunW.exe
  2⤵
  PID:2184
- C:\Windows\System\JnDIdVG.exe
  C:\Windows\System\JnDIdVG.exe
  2⤵
  PID:2024
- C:\Windows\System\ZRtVFgh.exe
  C:\Windows\System\ZRtVFgh.exe
  2⤵
  PID:3020
- C:\Windows\System\AcFBUzP.exe
  C:\Windows\System\AcFBUzP.exe
  2⤵
  PID:2688
- C:\Windows\System\iRARhOf.exe
  C:\Windows\System\iRARhOf.exe
  2⤵
  PID:2356
- C:\Windows\System\huCthnY.exe
  C:\Windows\System\huCthnY.exe
  2⤵
  PID:548
- C:\Windows\System\LxvhNXt.exe
  C:\Windows\System\LxvhNXt.exe
  2⤵
  PID:1852
- C:\Windows\System\TJPPivH.exe
  C:\Windows\System\TJPPivH.exe
  2⤵
  PID:1036
- C:\Windows\System\OLAYLoa.exe
  C:\Windows\System\OLAYLoa.exe
  2⤵
  PID:2856
- C:\Windows\System\zzhDPtN.exe
  C:\Windows\System\zzhDPtN.exe
  2⤵
  PID:1728
- C:\Windows\System\GjyWldy.exe
  C:\Windows\System\GjyWldy.exe
  2⤵
  PID:1688
- C:\Windows\System\VUMMgnV.exe
  C:\Windows\System\VUMMgnV.exe
  2⤵
  PID:2988
- C:\Windows\System\pgyUJxM.exe
  C:\Windows\System\pgyUJxM.exe
  2⤵
  PID:2696
- C:\Windows\System\HXDiFUt.exe
  C:\Windows\System\HXDiFUt.exe
  2⤵
  PID:2084
- C:\Windows\System\hDYbfzg.exe
  C:\Windows\System\hDYbfzg.exe
  2⤵
  PID:2384
- C:\Windows\System\DUVQjpU.exe
  C:\Windows\System\DUVQjpU.exe
  2⤵
  PID:612
- C:\Windows\System\eTCOiws.exe
  C:\Windows\System\eTCOiws.exe
  2⤵
  PID:1804
- C:\Windows\System\YqPPCDE.exe
  C:\Windows\System\YqPPCDE.exe
  2⤵
  PID:2436
- C:\Windows\System\QZKLUeo.exe
  C:\Windows\System\QZKLUeo.exe
  2⤵
  PID:1668
- C:\Windows\System\tARHHPA.exe
  C:\Windows\System\tARHHPA.exe
  2⤵
  PID:2144
- C:\Windows\System\gOPqxQm.exe
  C:\Windows\System\gOPqxQm.exe
  2⤵
  PID:2556
- C:\Windows\System\CGMXDHu.exe
  C:\Windows\System\CGMXDHu.exe
  2⤵
  PID:2268
- C:\Windows\System\ccqFEzG.exe
  C:\Windows\System\ccqFEzG.exe
  2⤵
  PID:2416
- C:\Windows\System\rzokqng.exe
  C:\Windows\System\rzokqng.exe
  2⤵
  PID:952
- C:\Windows\System\JrDSKvr.exe
  C:\Windows\System\JrDSKvr.exe
  2⤵
  PID:2660
- C:\Windows\System\rqBPeVV.exe
  C:\Windows\System\rqBPeVV.exe
  2⤵
  PID:1660
- C:\Windows\System\YdpqJXg.exe
  C:\Windows\System\YdpqJXg.exe
  2⤵
  PID:1900
- C:\Windows\System\GooOzVE.exe
  C:\Windows\System\GooOzVE.exe
  2⤵
  PID:3088
- C:\Windows\System\YqdPNIn.exe
  C:\Windows\System\YqdPNIn.exe
  2⤵
  PID:3104
- C:\Windows\System\qtdBVrm.exe
  C:\Windows\System\qtdBVrm.exe
  2⤵
  PID:3128
- C:\Windows\System\OpDgQYs.exe
  C:\Windows\System\OpDgQYs.exe
  2⤵
  PID:3144
- C:\Windows\System\GhEqfqD.exe
  C:\Windows\System\GhEqfqD.exe
  2⤵
  PID:3168
- C:\Windows\System\MaTRLXe.exe
  C:\Windows\System\MaTRLXe.exe
  2⤵
  PID:3188
- C:\Windows\System\oMVPxKr.exe
  C:\Windows\System\oMVPxKr.exe
  2⤵
  PID:3204
- C:\Windows\System\xWZbXLg.exe
  C:\Windows\System\xWZbXLg.exe
  2⤵
  PID:3224
- C:\Windows\System\FpvmTEe.exe
  C:\Windows\System\FpvmTEe.exe
  2⤵
  PID:3248
- C:\Windows\System\VjlIHXc.exe
  C:\Windows\System\VjlIHXc.exe
  2⤵
  PID:3268
- C:\Windows\System\wjWwbwc.exe
  C:\Windows\System\wjWwbwc.exe
  2⤵
  PID:3284
- C:\Windows\System\RJBIwbH.exe
  C:\Windows\System\RJBIwbH.exe
  2⤵
  PID:3304
- C:\Windows\System\mguGJvf.exe
  C:\Windows\System\mguGJvf.exe
  2⤵
  PID:3328
- C:\Windows\System\WkyIvMY.exe
  C:\Windows\System\WkyIvMY.exe
  2⤵
  PID:3344
- C:\Windows\System\AHyMSoj.exe
  C:\Windows\System\AHyMSoj.exe
  2⤵
  PID:3364
- C:\Windows\System\CyPquzX.exe
  C:\Windows\System\CyPquzX.exe
  2⤵
  PID:3384
- C:\Windows\System\AjAxYTW.exe
  C:\Windows\System\AjAxYTW.exe
  2⤵
  PID:3408
- C:\Windows\System\FmKyRRS.exe
  C:\Windows\System\FmKyRRS.exe
  2⤵
  PID:3424
- C:\Windows\System\IUpIZfX.exe
  C:\Windows\System\IUpIZfX.exe
  2⤵
  PID:3448
- C:\Windows\System\sZUiBDT.exe
  C:\Windows\System\sZUiBDT.exe
  2⤵
  PID:3468
- C:\Windows\System\MCOoxzd.exe
  C:\Windows\System\MCOoxzd.exe
  2⤵
  PID:3488
- C:\Windows\System\ZnrnNEV.exe
  C:\Windows\System\ZnrnNEV.exe
  2⤵
  PID:3504
- C:\Windows\System\nxcjhrx.exe
  C:\Windows\System\nxcjhrx.exe
  2⤵
  PID:3528
- C:\Windows\System\gejuhrl.exe
  C:\Windows\System\gejuhrl.exe
  2⤵
  PID:3548
- C:\Windows\System\ntTiZjE.exe
  C:\Windows\System\ntTiZjE.exe
  2⤵
  PID:3564
- C:\Windows\System\gPIuTWQ.exe
  C:\Windows\System\gPIuTWQ.exe
  2⤵
  PID:3584
- C:\Windows\System\HUmROMn.exe
  C:\Windows\System\HUmROMn.exe
  2⤵
  PID:3608
- C:\Windows\System\luWJawg.exe
  C:\Windows\System\luWJawg.exe
  2⤵
  PID:3624
- C:\Windows\System\yzORsZV.exe
  C:\Windows\System\yzORsZV.exe
  2⤵
  PID:3648
- C:\Windows\System\gcFbgyO.exe
  C:\Windows\System\gcFbgyO.exe
  2⤵
  PID:3664
- C:\Windows\System\CVyQOQR.exe
  C:\Windows\System\CVyQOQR.exe
  2⤵
  PID:3684
- C:\Windows\System\tZlEbsA.exe
  C:\Windows\System\tZlEbsA.exe
  2⤵
  PID:3704
- C:\Windows\System\bUungcN.exe
  C:\Windows\System\bUungcN.exe
  2⤵
  PID:3720
- C:\Windows\System\mPCyqAo.exe
  C:\Windows\System\mPCyqAo.exe
  2⤵
  PID:3736
- C:\Windows\System\HiOHjQZ.exe
  C:\Windows\System\HiOHjQZ.exe
  2⤵
  PID:3752
- C:\Windows\System\FPVVZLf.exe
  C:\Windows\System\FPVVZLf.exe
  2⤵
  PID:3768
- C:\Windows\System\OuQyAsY.exe
  C:\Windows\System\OuQyAsY.exe
  2⤵
  PID:3800
- C:\Windows\System\BcjbfyU.exe
  C:\Windows\System\BcjbfyU.exe
  2⤵
  PID:3824
- C:\Windows\System\YKZQPLm.exe
  C:\Windows\System\YKZQPLm.exe
  2⤵
  PID:3844
- C:\Windows\System\gwTsPjv.exe
  C:\Windows\System\gwTsPjv.exe
  2⤵
  PID:3864
- C:\Windows\System\pvpRiOb.exe
  C:\Windows\System\pvpRiOb.exe
  2⤵
  PID:3884
- C:\Windows\System\wbwhciC.exe
  C:\Windows\System\wbwhciC.exe
  2⤵
  PID:3904
- C:\Windows\System\JgoZFuN.exe
  C:\Windows\System\JgoZFuN.exe
  2⤵
  PID:3920
- C:\Windows\System\HfNqiFe.exe
  C:\Windows\System\HfNqiFe.exe
  2⤵
  PID:3936
- C:\Windows\System\QfiNFHf.exe
  C:\Windows\System\QfiNFHf.exe
  2⤵
  PID:3956
- C:\Windows\System\qxLInUL.exe
  C:\Windows\System\qxLInUL.exe
  2⤵
  PID:3972
- C:\Windows\System\ZedXcVr.exe
  C:\Windows\System\ZedXcVr.exe
  2⤵
  PID:3992
- C:\Windows\System\hQWdGok.exe
  C:\Windows\System\hQWdGok.exe
  2⤵
  PID:4008
- C:\Windows\System\pSjDFUd.exe
  C:\Windows\System\pSjDFUd.exe
  2⤵
  PID:4040
- C:\Windows\System\vnYFvVB.exe
  C:\Windows\System\vnYFvVB.exe
  2⤵
  PID:4068
- C:\Windows\System\tvmTaPN.exe
  C:\Windows\System\tvmTaPN.exe
  2⤵
  PID:4084
- C:\Windows\System\wQubeGv.exe
  C:\Windows\System\wQubeGv.exe
  2⤵
  PID:3084
- C:\Windows\System\fzvMwBh.exe
  C:\Windows\System\fzvMwBh.exe
  2⤵
  PID:3120
- C:\Windows\System\jmZySCT.exe
  C:\Windows\System\jmZySCT.exe
  2⤵
  PID:3152
- C:\Windows\System\rfFifXB.exe
  C:\Windows\System\rfFifXB.exe
  2⤵
  PID:3184
- C:\Windows\System\DeudkkX.exe
  C:\Windows\System\DeudkkX.exe
  2⤵
  PID:3220
- C:\Windows\System\oqZNGKe.exe
  C:\Windows\System\oqZNGKe.exe
  2⤵
  PID:3240
- C:\Windows\System\BYBHJMh.exe
  C:\Windows\System\BYBHJMh.exe
  2⤵
  PID:3280
- C:\Windows\System\EFyCPjb.exe
  C:\Windows\System\EFyCPjb.exe
  2⤵
  PID:3320
- C:\Windows\System\sjDsJsJ.exe
  C:\Windows\System\sjDsJsJ.exe
  2⤵
  PID:3340
- C:\Windows\System\SMTNSqT.exe
  C:\Windows\System\SMTNSqT.exe
  2⤵
  PID:3392
- C:\Windows\System\dKveTFo.exe
  C:\Windows\System\dKveTFo.exe
  2⤵
  PID:3416
- C:\Windows\System\vIsKEEx.exe
  C:\Windows\System\vIsKEEx.exe
  2⤵
  PID:3440
- C:\Windows\System\nFMeUCn.exe
  C:\Windows\System\nFMeUCn.exe
  2⤵
  PID:3476
- C:\Windows\System\nRiFulN.exe
  C:\Windows\System\nRiFulN.exe
  2⤵
  PID:3520
- C:\Windows\System\otCZvvP.exe
  C:\Windows\System\otCZvvP.exe
  2⤵
  PID:3540
- C:\Windows\System\YLBdgRh.exe
  C:\Windows\System\YLBdgRh.exe
  2⤵
  PID:3580
- C:\Windows\System\nUFQHWG.exe
  C:\Windows\System\nUFQHWG.exe
  2⤵
  PID:3600
- C:\Windows\System\futFHMB.exe
  C:\Windows\System\futFHMB.exe
  2⤵
  PID:3644
- C:\Windows\System\byfXvrs.exe
  C:\Windows\System\byfXvrs.exe
  2⤵
  PID:3660
- C:\Windows\System\yFDHTac.exe
  C:\Windows\System\yFDHTac.exe
  2⤵
  PID:3696
- C:\Windows\System\hXJfXFE.exe
  C:\Windows\System\hXJfXFE.exe
  2⤵
  PID:3748
- C:\Windows\System\zahLneA.exe
  C:\Windows\System\zahLneA.exe
  2⤵
  PID:3728
- C:\Windows\System\vHxMzqA.exe
  C:\Windows\System\vHxMzqA.exe
  2⤵
  PID:3812
- C:\Windows\System\TSLjrEB.exe
  C:\Windows\System\TSLjrEB.exe
  2⤵
  PID:3840
- C:\Windows\System\QdjpmoC.exe
  C:\Windows\System\QdjpmoC.exe
  2⤵
  PID:3860
- C:\Windows\System\ZFDVHjD.exe
  C:\Windows\System\ZFDVHjD.exe
  2⤵
  PID:3944
- C:\Windows\System\ucrBgPn.exe
  C:\Windows\System\ucrBgPn.exe
  2⤵
  PID:3968
- C:\Windows\System\kSjBhEA.exe
  C:\Windows\System\kSjBhEA.exe
  2⤵
  PID:3928
- C:\Windows\System\nAbMHol.exe
  C:\Windows\System\nAbMHol.exe
  2⤵
  PID:4028
- C:\Windows\System\DFCiFhO.exe
  C:\Windows\System\DFCiFhO.exe
  2⤵
  PID:4060
- C:\Windows\System\MgqCaRn.exe
  C:\Windows\System\MgqCaRn.exe
  2⤵
  PID:4076
- C:\Windows\System\zfNRjVJ.exe
  C:\Windows\System\zfNRjVJ.exe
  2⤵
  PID:3096
- C:\Windows\System\kxgLPrt.exe
  C:\Windows\System\kxgLPrt.exe
  2⤵
  PID:3156
- C:\Windows\System\XHosTVP.exe
  C:\Windows\System\XHosTVP.exe
  2⤵
  PID:3196
- C:\Windows\System\xPZVwAo.exe
  C:\Windows\System\xPZVwAo.exe
  2⤵
  PID:3236
- C:\Windows\System\VvRJCCv.exe
  C:\Windows\System\VvRJCCv.exe
  2⤵
  PID:3296
- C:\Windows\System\LavhnUF.exe
  C:\Windows\System\LavhnUF.exe
  2⤵
  PID:3360
- C:\Windows\System\SvJtVxl.exe
  C:\Windows\System\SvJtVxl.exe
  2⤵
  PID:3372
- C:\Windows\System\RDVrIlU.exe
  C:\Windows\System\RDVrIlU.exe
  2⤵
  PID:3436
- C:\Windows\System\oYkKutL.exe
  C:\Windows\System\oYkKutL.exe
  2⤵
  PID:3496
- C:\Windows\System\xDzUnag.exe
  C:\Windows\System\xDzUnag.exe
  2⤵
  PID:3544
- C:\Windows\System\juTgrRj.exe
  C:\Windows\System\juTgrRj.exe
  2⤵
  PID:3596
- C:\Windows\System\EOjrPbG.exe
  C:\Windows\System\EOjrPbG.exe
  2⤵
  PID:3692
- C:\Windows\System\kenOKPF.exe
  C:\Windows\System\kenOKPF.exe
  2⤵
  PID:3744
- C:\Windows\System\jKPOaAn.exe
  C:\Windows\System\jKPOaAn.exe
  2⤵
  PID:3760
- C:\Windows\System\edGZrdy.exe
  C:\Windows\System\edGZrdy.exe
  2⤵
  PID:3820
- C:\Windows\System\zItqfTf.exe
  C:\Windows\System\zItqfTf.exe
  2⤵
  PID:3916
- C:\Windows\System\xnzQPZK.exe
  C:\Windows\System\xnzQPZK.exe
  2⤵
  PID:3984
- C:\Windows\System\DeZTHto.exe
  C:\Windows\System\DeZTHto.exe
  2⤵
  PID:4016
- C:\Windows\System\OkdhwpX.exe
  C:\Windows\System\OkdhwpX.exe
  2⤵
  PID:4036
- C:\Windows\System\yMGFzou.exe
  C:\Windows\System\yMGFzou.exe
  2⤵
  PID:656
- C:\Windows\System\FkTbVlz.exe
  C:\Windows\System\FkTbVlz.exe
  2⤵
  PID:3136
- C:\Windows\System\VsLVUBF.exe
  C:\Windows\System\VsLVUBF.exe
  2⤵
  PID:3164
- C:\Windows\System\LigoYHY.exe
  C:\Windows\System\LigoYHY.exe
  2⤵
  PID:3380
- C:\Windows\System\yghZoTz.exe
  C:\Windows\System\yghZoTz.exe
  2⤵
  PID:3620
- C:\Windows\System\aflXwbK.exe
  C:\Windows\System\aflXwbK.exe
  2⤵
  PID:3500
- C:\Windows\System\iPaGswu.exe
  C:\Windows\System\iPaGswu.exe
  2⤵
  PID:3656
- C:\Windows\System\ZjxmaPi.exe
  C:\Windows\System\ZjxmaPi.exe
  2⤵
  PID:3784
- C:\Windows\System\TnRGJWp.exe
  C:\Windows\System\TnRGJWp.exe
  2⤵
  PID:3856
- C:\Windows\System\zbRqqRH.exe
  C:\Windows\System\zbRqqRH.exe
  2⤵
  PID:4020
- C:\Windows\System\xuRvuuS.exe
  C:\Windows\System\xuRvuuS.exe
  2⤵
  PID:3352
- C:\Windows\System\OwETcrV.exe
  C:\Windows\System\OwETcrV.exe
  2⤵
  PID:3932
- C:\Windows\System\stNXSts.exe
  C:\Windows\System\stNXSts.exe
  2⤵
  PID:3480
- C:\Windows\System\cgUmGhI.exe
  C:\Windows\System\cgUmGhI.exe
  2⤵
  PID:4080
- C:\Windows\System\KvsnHeY.exe
  C:\Windows\System\KvsnHeY.exe
  2⤵
  PID:3400
- C:\Windows\System\itNjWBs.exe
  C:\Windows\System\itNjWBs.exe
  2⤵
  PID:4048
- C:\Windows\System\pVrkNMa.exe
  C:\Windows\System\pVrkNMa.exe
  2⤵
  PID:4108
- C:\Windows\System\iTucVDw.exe
  C:\Windows\System\iTucVDw.exe
  2⤵
  PID:4128
- C:\Windows\System\TIklHMF.exe
  C:\Windows\System\TIklHMF.exe
  2⤵
  PID:4148
- C:\Windows\System\MuHNvcx.exe
  C:\Windows\System\MuHNvcx.exe
  2⤵
  PID:4164
- C:\Windows\System\qoOXzdx.exe
  C:\Windows\System\qoOXzdx.exe
  2⤵
  PID:4180
- C:\Windows\System\UtzaTeX.exe
  C:\Windows\System\UtzaTeX.exe
  2⤵
  PID:4196
- C:\Windows\System\YKDYOQe.exe
  C:\Windows\System\YKDYOQe.exe
  2⤵
  PID:4220
- C:\Windows\System\xzeKnSA.exe
  C:\Windows\System\xzeKnSA.exe
  2⤵
  PID:4240
- C:\Windows\System\JzCDQKG.exe
  C:\Windows\System\JzCDQKG.exe
  2⤵
  PID:4264
- C:\Windows\System\DYUmijI.exe
  C:\Windows\System\DYUmijI.exe
  2⤵
  PID:4280
- C:\Windows\System\valUrrS.exe
  C:\Windows\System\valUrrS.exe
  2⤵
  PID:4304
- C:\Windows\System\cHRVNvi.exe
  C:\Windows\System\cHRVNvi.exe
  2⤵
  PID:4372
- C:\Windows\System\ndMiuup.exe
  C:\Windows\System\ndMiuup.exe
  2⤵
  PID:4392
- C:\Windows\System\mHMzadF.exe
  C:\Windows\System\mHMzadF.exe
  2⤵
  PID:4416
- C:\Windows\System\zWzDUQp.exe
  C:\Windows\System\zWzDUQp.exe
  2⤵
  PID:4436
- C:\Windows\System\mmDTsHm.exe
  C:\Windows\System\mmDTsHm.exe
  2⤵
  PID:4452
- C:\Windows\System\viVjHCm.exe
  C:\Windows\System\viVjHCm.exe
  2⤵
  PID:4472
- C:\Windows\System\rgySuuT.exe
  C:\Windows\System\rgySuuT.exe
  2⤵
  PID:4488
- C:\Windows\System\ehOVaTJ.exe
  C:\Windows\System\ehOVaTJ.exe
  2⤵
  PID:4504
- C:\Windows\System\uHwSWmP.exe
  C:\Windows\System\uHwSWmP.exe
  2⤵
  PID:4532
- C:\Windows\System\MROcsZj.exe
  C:\Windows\System\MROcsZj.exe
  2⤵
  PID:4548
- C:\Windows\System\LRSgOSK.exe
  C:\Windows\System\LRSgOSK.exe
  2⤵
  PID:4568
- C:\Windows\System\vDEFENS.exe
  C:\Windows\System\vDEFENS.exe
  2⤵
  PID:4588
- C:\Windows\System\fNAoawU.exe
  C:\Windows\System\fNAoawU.exe
  2⤵
  PID:4604
- C:\Windows\System\YtJgIED.exe
  C:\Windows\System\YtJgIED.exe
  2⤵
  PID:4628
- C:\Windows\System\XKdPmgQ.exe
  C:\Windows\System\XKdPmgQ.exe
  2⤵
  PID:4648
- C:\Windows\System\iiRAerv.exe
  C:\Windows\System\iiRAerv.exe
  2⤵
  PID:4668
- C:\Windows\System\XcRxIFu.exe
  C:\Windows\System\XcRxIFu.exe
  2⤵
  PID:4692
- C:\Windows\System\PydVUdJ.exe
  C:\Windows\System\PydVUdJ.exe
  2⤵
  PID:4716
- C:\Windows\System\zXfFJWK.exe
  C:\Windows\System\zXfFJWK.exe
  2⤵
  PID:4732
- C:\Windows\System\QDsdePF.exe
  C:\Windows\System\QDsdePF.exe
  2⤵
  PID:4760
- C:\Windows\System\SezXlwj.exe
  C:\Windows\System\SezXlwj.exe
  2⤵
  PID:4780
- C:\Windows\System\tyBCDPX.exe
  C:\Windows\System\tyBCDPX.exe
  2⤵
  PID:4800
- C:\Windows\System\jwnzRko.exe
  C:\Windows\System\jwnzRko.exe
  2⤵
  PID:4816
- C:\Windows\System\LOienYa.exe
  C:\Windows\System\LOienYa.exe
  2⤵
  PID:4836
- C:\Windows\System\GMAtATm.exe
  C:\Windows\System\GMAtATm.exe
  2⤵
  PID:4856
- C:\Windows\System\thvPagW.exe
  C:\Windows\System\thvPagW.exe
  2⤵
  PID:4876
- C:\Windows\System\yMkZWtv.exe
  C:\Windows\System\yMkZWtv.exe
  2⤵
  PID:4892
- C:\Windows\System\xHELpmW.exe
  C:\Windows\System\xHELpmW.exe
  2⤵
  PID:4912
- C:\Windows\System\HhoTqdH.exe
  C:\Windows\System\HhoTqdH.exe
  2⤵
  PID:4928
- C:\Windows\System\JgKFljR.exe
  C:\Windows\System\JgKFljR.exe
  2⤵
  PID:4948
- C:\Windows\System\pttfzDH.exe
  C:\Windows\System\pttfzDH.exe
  2⤵
  PID:4964
- C:\Windows\System\NrnDkXK.exe
  C:\Windows\System\NrnDkXK.exe
  2⤵
  PID:4984
- C:\Windows\System\SLhRFlL.exe
  C:\Windows\System\SLhRFlL.exe
  2⤵
  PID:5024
- C:\Windows\System\YAVZFXw.exe
  C:\Windows\System\YAVZFXw.exe
  2⤵
  PID:5040
- C:\Windows\System\EZPLzdE.exe
  C:\Windows\System\EZPLzdE.exe
  2⤵
  PID:5056
- C:\Windows\System\dLRQLEi.exe
  C:\Windows\System\dLRQLEi.exe
  2⤵
  PID:5072
- C:\Windows\System\eZqbumx.exe
  C:\Windows\System\eZqbumx.exe
  2⤵
  PID:5092
- C:\Windows\System\BBPLeVo.exe
  C:\Windows\System\BBPLeVo.exe
  2⤵
  PID:5116
- C:\Windows\System\GBSCVwX.exe
  C:\Windows\System\GBSCVwX.exe
  2⤵
  PID:3880
- C:\Windows\System\qAZnUNM.exe
  C:\Windows\System\qAZnUNM.exe
  2⤵
  PID:4120
- C:\Windows\System\DqtzBDt.exe
  C:\Windows\System\DqtzBDt.exe
  2⤵
  PID:3952
- C:\Windows\System\WPNUpQy.exe
  C:\Windows\System\WPNUpQy.exe
  2⤵
  PID:4276
- C:\Windows\System\RTfmbbE.exe
  C:\Windows\System\RTfmbbE.exe
  2⤵
  PID:4288
- C:\Windows\System\QPkeHzP.exe
  C:\Windows\System\QPkeHzP.exe
  2⤵
  PID:4172
- C:\Windows\System\pmcPUxG.exe
  C:\Windows\System\pmcPUxG.exe
  2⤵
  PID:4144
- C:\Windows\System\tWAJbui.exe
  C:\Windows\System\tWAJbui.exe
  2⤵
  PID:3536
- C:\Windows\System\UTtxdOq.exe
  C:\Windows\System\UTtxdOq.exe
  2⤵
  PID:3892
- C:\Windows\System\OIiNROI.exe
  C:\Windows\System\OIiNROI.exe
  2⤵
  PID:4300
- C:\Windows\System\JbHRXcN.exe
  C:\Windows\System\JbHRXcN.exe
  2⤵
  PID:4328
- C:\Windows\System\huucCRG.exe
  C:\Windows\System\huucCRG.exe
  2⤵
  PID:4348
- C:\Windows\System\YGvGtNE.exe
  C:\Windows\System\YGvGtNE.exe
  2⤵
  PID:4364
- C:\Windows\System\XJCitij.exe
  C:\Windows\System\XJCitij.exe
  2⤵
  PID:4408
- C:\Windows\System\sSUTlOZ.exe
  C:\Windows\System\sSUTlOZ.exe
  2⤵
  PID:4480
- C:\Windows\System\xVybuwN.exe
  C:\Windows\System\xVybuwN.exe
  2⤵
  PID:4388
- C:\Windows\System\TdMCksa.exe
  C:\Windows\System\TdMCksa.exe
  2⤵
  PID:4564
- C:\Windows\System\QzEPCnz.exe
  C:\Windows\System\QzEPCnz.exe
  2⤵
  PID:4468
- C:\Windows\System\tavyIxA.exe
  C:\Windows\System\tavyIxA.exe
  2⤵
  PID:4496
- C:\Windows\System\RDoMBuY.exe
  C:\Windows\System\RDoMBuY.exe
  2⤵
  PID:4624
- C:\Windows\System\gdmkKzz.exe
  C:\Windows\System\gdmkKzz.exe
  2⤵
  PID:4664
- C:\Windows\System\vXEzFWt.exe
  C:\Windows\System\vXEzFWt.exe
  2⤵
  PID:4616
- C:\Windows\System\iUtDlWP.exe
  C:\Windows\System\iUtDlWP.exe
  2⤵
  PID:4712
- C:\Windows\System\TLLtDlY.exe
  C:\Windows\System\TLLtDlY.exe
  2⤵
  PID:4752
- C:\Windows\System\RvcJFzR.exe
  C:\Windows\System\RvcJFzR.exe
  2⤵
  PID:4812
- C:\Windows\System\xbNfdPJ.exe
  C:\Windows\System\xbNfdPJ.exe
  2⤵
  PID:4796
- C:\Windows\System\LmGLXtH.exe
  C:\Windows\System\LmGLXtH.exe
  2⤵
  PID:4888
- C:\Windows\System\NhRTnGZ.exe
  C:\Windows\System\NhRTnGZ.exe
  2⤵
  PID:4956
- C:\Windows\System\SOJXXUI.exe
  C:\Windows\System\SOJXXUI.exe
  2⤵
  PID:4992
- C:\Windows\System\mLxaasv.exe
  C:\Windows\System\mLxaasv.exe
  2⤵
  PID:4908
- C:\Windows\System\RZItjKN.exe
  C:\Windows\System\RZItjKN.exe
  2⤵
  PID:4864
- C:\Windows\System\VTNFFIA.exe
  C:\Windows\System\VTNFFIA.exe
  2⤵
  PID:4980
- C:\Windows\System\AyQoHjU.exe
  C:\Windows\System\AyQoHjU.exe
  2⤵
  PID:5080
- C:\Windows\System\BUtkAaN.exe
  C:\Windows\System\BUtkAaN.exe
  2⤵
  PID:3432
- C:\Windows\System\CeWvJxW.exe
  C:\Windows\System\CeWvJxW.exe
  2⤵
  PID:5032
- C:\Windows\System\sqfTSMr.exe
  C:\Windows\System\sqfTSMr.exe
  2⤵
  PID:5100
- C:\Windows\System\gYnKnIb.exe
  C:\Windows\System\gYnKnIb.exe
  2⤵
  PID:4252
- C:\Windows\System\lbCpQWZ.exe
  C:\Windows\System\lbCpQWZ.exe
  2⤵
  PID:4188
- C:\Windows\System\VXpjDpw.exe
  C:\Windows\System\VXpjDpw.exe
  2⤵
  PID:3300
- C:\Windows\System\nyxYkMb.exe
  C:\Windows\System\nyxYkMb.exe
  2⤵
  PID:3212
- C:\Windows\System\lWnvQVR.exe
  C:\Windows\System\lWnvQVR.exe
  2⤵
  PID:4356
- C:\Windows\System\KQFmhEV.exe
  C:\Windows\System\KQFmhEV.exe
  2⤵
  PID:4448
- C:\Windows\System\sPXyDwC.exe
  C:\Windows\System\sPXyDwC.exe
  2⤵
  PID:4560
- C:\Windows\System\piVomqa.exe
  C:\Windows\System\piVomqa.exe
  2⤵
  PID:4512
- C:\Windows\System\sPUmmOk.exe
  C:\Windows\System\sPUmmOk.exe
  2⤵
  PID:4644
- C:\Windows\System\zMgumTD.exe
  C:\Windows\System\zMgumTD.exe
  2⤵
  PID:4576
- C:\Windows\System\XINqVUJ.exe
  C:\Windows\System\XINqVUJ.exe
  2⤵
  PID:4700
- C:\Windows\System\nHEYIMS.exe
  C:\Windows\System\nHEYIMS.exe
  2⤵
  PID:4600
- C:\Windows\System\oMoxUEC.exe
  C:\Windows\System\oMoxUEC.exe
  2⤵
  PID:4612
- C:\Windows\System\RTTkTaC.exe
  C:\Windows\System\RTTkTaC.exe
  2⤵
  PID:4768
- C:\Windows\System\HTRLWrX.exe
  C:\Windows\System\HTRLWrX.exe
  2⤵
  PID:4824
- C:\Windows\System\UFpkFwW.exe
  C:\Windows\System\UFpkFwW.exe
  2⤵
  PID:4844
- C:\Windows\System\VRuuAEv.exe
  C:\Windows\System\VRuuAEv.exe
  2⤵
  PID:4924
- C:\Windows\System\fhdepFe.exe
  C:\Windows\System\fhdepFe.exe
  2⤵
  PID:5048
- C:\Windows\System\WuNCful.exe
  C:\Windows\System\WuNCful.exe
  2⤵
  PID:4944
- C:\Windows\System\nMcgqtN.exe
  C:\Windows\System\nMcgqtN.exe
  2⤵
  PID:5088
- C:\Windows\System\lYvYtzn.exe
  C:\Windows\System\lYvYtzn.exe
  2⤵
  PID:5068
- C:\Windows\System\FwSlxgO.exe
  C:\Windows\System\FwSlxgO.exe
  2⤵
  PID:3632
- C:\Windows\System\vShqOHY.exe
  C:\Windows\System\vShqOHY.exe
  2⤵
  PID:4192
- C:\Windows\System\zbAMoPP.exe
  C:\Windows\System\zbAMoPP.exe
  2⤵
  PID:3312
- C:\Windows\System\ALFMCPe.exe
  C:\Windows\System\ALFMCPe.exe
  2⤵
  PID:3780
- C:\Windows\System\RmdpbYD.exe
  C:\Windows\System\RmdpbYD.exe
  2⤵
  PID:4556
- C:\Windows\System\stMdFnV.exe
  C:\Windows\System\stMdFnV.exe
  2⤵
  PID:4404
- C:\Windows\System\JqaIAwW.exe
  C:\Windows\System\JqaIAwW.exe
  2⤵
  PID:4584
- C:\Windows\System\tkVBmQl.exe
  C:\Windows\System\tkVBmQl.exe
  2⤵
  PID:4160
- C:\Windows\System\dZWDUIm.exe
  C:\Windows\System\dZWDUIm.exe
  2⤵
  PID:4660
- C:\Windows\System\QKARpaG.exe
  C:\Windows\System\QKARpaG.exe
  2⤵
  PID:4104
- C:\Windows\System\WCevoeA.exe
  C:\Windows\System\WCevoeA.exe
  2⤵
  PID:5000
- C:\Windows\System\wDnHIpV.exe
  C:\Windows\System\wDnHIpV.exe
  2⤵
  PID:3576
- C:\Windows\System\pACuYjD.exe
  C:\Windows\System\pACuYjD.exe
  2⤵
  PID:1516
- C:\Windows\System\ssTYXSx.exe
  C:\Windows\System\ssTYXSx.exe
  2⤵
  PID:3116
- C:\Windows\System\hpOibBc.exe
  C:\Windows\System\hpOibBc.exe
  2⤵
  PID:4728
- C:\Windows\System\IOQgyHu.exe
  C:\Windows\System\IOQgyHu.exe
  2⤵
  PID:4324
- C:\Windows\System\oXtOHlj.exe
  C:\Windows\System\oXtOHlj.exe
  2⤵
  PID:4832
- C:\Windows\System\kTYcisR.exe
  C:\Windows\System\kTYcisR.exe
  2⤵
  PID:4972
- C:\Windows\System\gBcxcTF.exe
  C:\Windows\System\gBcxcTF.exe
  2⤵
  PID:4920
- C:\Windows\System\lgNwIUz.exe
  C:\Windows\System\lgNwIUz.exe
  2⤵
  PID:4748
- C:\Windows\System\HlslsOt.exe
  C:\Windows\System\HlslsOt.exe
  2⤵
  PID:5008
- C:\Windows\System\NhOhBAc.exe
  C:\Windows\System\NhOhBAc.exe
  2⤵
  PID:4344
- C:\Windows\System\BacYvfA.exe
  C:\Windows\System\BacYvfA.exe
  2⤵
  PID:4828
- C:\Windows\System\fidXFmh.exe
  C:\Windows\System\fidXFmh.exe
  2⤵
  PID:5128
- C:\Windows\System\SKyafgi.exe
  C:\Windows\System\SKyafgi.exe
  2⤵
  PID:5148
- C:\Windows\System\SzuBcMO.exe
  C:\Windows\System\SzuBcMO.exe
  2⤵
  PID:5188
- C:\Windows\System\kFGfRIV.exe
  C:\Windows\System\kFGfRIV.exe
  2⤵
  PID:5204
- C:\Windows\System\qWvnArA.exe
  C:\Windows\System\qWvnArA.exe
  2⤵
  PID:5220
- C:\Windows\System\JGxpFwu.exe
  C:\Windows\System\JGxpFwu.exe
  2⤵
  PID:5240
- C:\Windows\System\LBdMUDh.exe
  C:\Windows\System\LBdMUDh.exe
  2⤵
  PID:5256
- C:\Windows\System\hVSmuLW.exe
  C:\Windows\System\hVSmuLW.exe
  2⤵
  PID:5276
- C:\Windows\System\zUYbevM.exe
  C:\Windows\System\zUYbevM.exe
  2⤵
  PID:5296
- C:\Windows\System\zZWAKeA.exe
  C:\Windows\System\zZWAKeA.exe
  2⤵
  PID:5312
- C:\Windows\System\jRabMUg.exe
  C:\Windows\System\jRabMUg.exe
  2⤵
  PID:5336
- C:\Windows\System\mvrUlGT.exe
  C:\Windows\System\mvrUlGT.exe
  2⤵
  PID:5356
- C:\Windows\System\WLclnCI.exe
  C:\Windows\System\WLclnCI.exe
  2⤵
  PID:5380
- C:\Windows\System\oqnhmEr.exe
  C:\Windows\System\oqnhmEr.exe
  2⤵
  PID:5400
- C:\Windows\System\HlGTquu.exe
  C:\Windows\System\HlGTquu.exe
  2⤵
  PID:5420
- C:\Windows\System\PxHMTpO.exe
  C:\Windows\System\PxHMTpO.exe
  2⤵
  PID:5444
- C:\Windows\System\vnfrchf.exe
  C:\Windows\System\vnfrchf.exe
  2⤵
  PID:5460
- C:\Windows\System\MHLBlMm.exe
  C:\Windows\System\MHLBlMm.exe
  2⤵
  PID:5480
- C:\Windows\System\DYeBWHt.exe
  C:\Windows\System\DYeBWHt.exe
  2⤵
  PID:5496
- C:\Windows\System\oykuRhS.exe
  C:\Windows\System\oykuRhS.exe
  2⤵
  PID:5512
- C:\Windows\System\aJfKInl.exe
  C:\Windows\System\aJfKInl.exe
  2⤵
  PID:5544
- C:\Windows\System\xWctiFK.exe
  C:\Windows\System\xWctiFK.exe
  2⤵
  PID:5560
- C:\Windows\System\VQvdkwS.exe
  C:\Windows\System\VQvdkwS.exe
  2⤵
  PID:5580
- C:\Windows\System\PjwpuuH.exe
  C:\Windows\System\PjwpuuH.exe
  2⤵
  PID:5600
- C:\Windows\System\XYhwfXp.exe
  C:\Windows\System\XYhwfXp.exe
  2⤵
  PID:5628
- C:\Windows\System\abTROJw.exe
  C:\Windows\System\abTROJw.exe
  2⤵
  PID:5644
- C:\Windows\System\ibvEMdG.exe
  C:\Windows\System\ibvEMdG.exe
  2⤵
  PID:5668
- C:\Windows\System\WUkiWAY.exe
  C:\Windows\System\WUkiWAY.exe
  2⤵
  PID:5684
- C:\Windows\System\BfmBiwq.exe
  C:\Windows\System\BfmBiwq.exe
  2⤵
  PID:5700
- C:\Windows\System\ZwkfEYr.exe
  C:\Windows\System\ZwkfEYr.exe
  2⤵
  PID:5720
- C:\Windows\System\EdkZOci.exe
  C:\Windows\System\EdkZOci.exe
  2⤵
  PID:5740
- C:\Windows\System\qgdUwAp.exe
  C:\Windows\System\qgdUwAp.exe
  2⤵
  PID:5760
- C:\Windows\System\USiyJEn.exe
  C:\Windows\System\USiyJEn.exe
  2⤵
  PID:5780
- C:\Windows\System\EMyFyHb.exe
  C:\Windows\System\EMyFyHb.exe
  2⤵
  PID:5800
- C:\Windows\System\SWlnclQ.exe
  C:\Windows\System\SWlnclQ.exe
  2⤵
  PID:5820
- C:\Windows\System\CQPnacQ.exe
  C:\Windows\System\CQPnacQ.exe
  2⤵
  PID:5844
- C:\Windows\System\uuyseNQ.exe
  C:\Windows\System\uuyseNQ.exe
  2⤵
  PID:5860
- C:\Windows\System\tCCsJGI.exe
  C:\Windows\System\tCCsJGI.exe
  2⤵
  PID:5880
- C:\Windows\System\UeboUXK.exe
  C:\Windows\System\UeboUXK.exe
  2⤵
  PID:5896
- C:\Windows\System\WDVRmzZ.exe
  C:\Windows\System\WDVRmzZ.exe
  2⤵
  PID:5916
- C:\Windows\System\ccNUMUh.exe
  C:\Windows\System\ccNUMUh.exe
  2⤵
  PID:5932
- C:\Windows\System\WDfAKAJ.exe
  C:\Windows\System\WDfAKAJ.exe
  2⤵
  PID:5948
- C:\Windows\System\KFsIncZ.exe
  C:\Windows\System\KFsIncZ.exe
  2⤵
  PID:5968
- C:\Windows\System\ukEaoAA.exe
  C:\Windows\System\ukEaoAA.exe
  2⤵
  PID:5988
- C:\Windows\System\dStKoMX.exe
  C:\Windows\System\dStKoMX.exe
  2⤵
  PID:6008
- C:\Windows\System\hhiKNMy.exe
  C:\Windows\System\hhiKNMy.exe
  2⤵
  PID:6024
- C:\Windows\System\NTiapBz.exe
  C:\Windows\System\NTiapBz.exe
  2⤵
  PID:6060
- C:\Windows\System\qcvWJKk.exe
  C:\Windows\System\qcvWJKk.exe
  2⤵
  PID:6080
- C:\Windows\System\oePnAoR.exe
  C:\Windows\System\oePnAoR.exe
  2⤵
  PID:6096
- C:\Windows\System\tLUdqmd.exe
  C:\Windows\System\tLUdqmd.exe
  2⤵
  PID:6116
- C:\Windows\System\ZcpIEPn.exe
  C:\Windows\System\ZcpIEPn.exe
  2⤵
  PID:6136
- C:\Windows\System\BnXaABY.exe
  C:\Windows\System\BnXaABY.exe
  2⤵
  PID:5112
- C:\Windows\System\lziWNir.exe
  C:\Windows\System\lziWNir.exe
  2⤵
  PID:5160
- C:\Windows\System\tNgdlgZ.exe
  C:\Windows\System\tNgdlgZ.exe
  2⤵
  PID:4620
- C:\Windows\System\SAnIPpW.exe
  C:\Windows\System\SAnIPpW.exe
  2⤵
  PID:4868
- C:\Windows\System\NNphDfe.exe
  C:\Windows\System\NNphDfe.exe
  2⤵
  PID:5184
- C:\Windows\System\vkBrXJd.exe
  C:\Windows\System\vkBrXJd.exe
  2⤵
  PID:5248
- C:\Windows\System\gKugUrN.exe
  C:\Windows\System\gKugUrN.exe
  2⤵
  PID:5264
- C:\Windows\System\NMrdbDt.exe
  C:\Windows\System\NMrdbDt.exe
  2⤵
  PID:5332
- C:\Windows\System\LzylCNf.exe
  C:\Windows\System\LzylCNf.exe
  2⤵
  PID:5372
- C:\Windows\System\APIAWyv.exe
  C:\Windows\System\APIAWyv.exe
  2⤵
  PID:5344
- C:\Windows\System\ncfnYoI.exe
  C:\Windows\System\ncfnYoI.exe
  2⤵
  PID:5388
- C:\Windows\System\xvpojKm.exe
  C:\Windows\System\xvpojKm.exe
  2⤵
  PID:5432
- C:\Windows\System\CPHjzYf.exe
  C:\Windows\System\CPHjzYf.exe
  2⤵
  PID:5456
- C:\Windows\System\bNfQiMv.exe
  C:\Windows\System\bNfQiMv.exe
  2⤵
  PID:5476
- C:\Windows\System\ZNeHndx.exe
  C:\Windows\System\ZNeHndx.exe
  2⤵
  PID:5468
- C:\Windows\System\WYnGfmS.exe
  C:\Windows\System\WYnGfmS.exe
  2⤵
  PID:5572
- C:\Windows\System\xSsPGPN.exe
  C:\Windows\System\xSsPGPN.exe
  2⤵
  PID:5596
- C:\Windows\System\JMiAeKg.exe
  C:\Windows\System\JMiAeKg.exe
  2⤵
  PID:5624
- C:\Windows\System\mIazCrx.exe
  C:\Windows\System\mIazCrx.exe
  2⤵
  PID:5656
- C:\Windows\System\XAQooRk.exe
  C:\Windows\System\XAQooRk.exe
  2⤵
  PID:5680
- C:\Windows\System\tDLQTsQ.exe
  C:\Windows\System\tDLQTsQ.exe
  2⤵
  PID:5712
- C:\Windows\System\wcECMsl.exe
  C:\Windows\System\wcECMsl.exe
  2⤵
  PID:5752
- C:\Windows\System\HkKqeHc.exe
  C:\Windows\System\HkKqeHc.exe
  2⤵
  PID:5756
- C:\Windows\System\UkTBgLm.exe
  C:\Windows\System\UkTBgLm.exe
  2⤵
  PID:5792
- C:\Windows\System\nTFIrrv.exe
  C:\Windows\System\nTFIrrv.exe
  2⤵
  PID:5836
- C:\Windows\System\wsJcjys.exe
  C:\Windows\System\wsJcjys.exe
  2⤵
  PID:5888
- C:\Windows\System\ZUNDWkQ.exe
  C:\Windows\System\ZUNDWkQ.exe
  2⤵
  PID:6004
- C:\Windows\System\chUoruh.exe
  C:\Windows\System\chUoruh.exe
  2⤵
  PID:6044
- C:\Windows\System\fgTZsYI.exe
  C:\Windows\System\fgTZsYI.exe
  2⤵
  PID:6036
- C:\Windows\System\tumpXkw.exe
  C:\Windows\System\tumpXkw.exe
  2⤵
  PID:5940
- C:\Windows\System\xzHPFhv.exe
  C:\Windows\System\xzHPFhv.exe
  2⤵
  PID:5984
- C:\Windows\System\OkhRnkU.exe
  C:\Windows\System\OkhRnkU.exe
  2⤵
  PID:6128
- C:\Windows\System\ygRQxiq.exe
  C:\Windows\System\ygRQxiq.exe
  2⤵
  PID:6068
- C:\Windows\System\lmJrEZv.exe
  C:\Windows\System\lmJrEZv.exe
  2⤵
  PID:6108
- C:\Windows\System\BQycIUR.exe
  C:\Windows\System\BQycIUR.exe
  2⤵
  PID:4228
- C:\Windows\System\JEYPzym.exe
  C:\Windows\System\JEYPzym.exe
  2⤵
  PID:5232
- C:\Windows\System\MGlpfQn.exe
  C:\Windows\System\MGlpfQn.exe
  2⤵
  PID:5144
- C:\Windows\System\fhTIjJO.exe
  C:\Windows\System\fhTIjJO.exe
  2⤵
  PID:5292
- C:\Windows\System\QjHyTkG.exe
  C:\Windows\System\QjHyTkG.exe
  2⤵
  PID:5376
- C:\Windows\System\hMmAdJS.exe
  C:\Windows\System\hMmAdJS.exe
  2⤵
  PID:5428
- C:\Windows\System\OmElDqZ.exe
  C:\Windows\System\OmElDqZ.exe
  2⤵
  PID:5528
- C:\Windows\System\ptvleZc.exe
  C:\Windows\System\ptvleZc.exe
  2⤵
  PID:5352
- C:\Windows\System\WScvDCC.exe
  C:\Windows\System\WScvDCC.exe
  2⤵
  PID:5452
- C:\Windows\System\kUPjQwA.exe
  C:\Windows\System\kUPjQwA.exe
  2⤵
  PID:5612
- C:\Windows\System\iZnFYbV.exe
  C:\Windows\System\iZnFYbV.exe
  2⤵
  PID:5732
- C:\Windows\System\gfMTXkF.exe
  C:\Windows\System\gfMTXkF.exe
  2⤵
  PID:5856
- C:\Windows\System\nmAXkSI.exe
  C:\Windows\System\nmAXkSI.exe
  2⤵
  PID:5960
- C:\Windows\System\eljcwGN.exe
  C:\Windows\System\eljcwGN.exe
  2⤵
  PID:5876
- C:\Windows\System\rONjTtg.exe
  C:\Windows\System\rONjTtg.exe
  2⤵
  PID:5828
- C:\Windows\System\nQoAHBl.exe
  C:\Windows\System\nQoAHBl.exe
  2⤵
  PID:5928
- C:\Windows\System\dNHyKjh.exe
  C:\Windows\System\dNHyKjh.exe
  2⤵
  PID:5904
- C:\Windows\System\KMomfxM.exe
  C:\Windows\System\KMomfxM.exe
  2⤵
  PID:6076
- C:\Windows\System\ecfAVCR.exe
  C:\Windows\System\ecfAVCR.exe
  2⤵
  PID:5216
- C:\Windows\System\KELQJBx.exe
  C:\Windows\System\KELQJBx.exe
  2⤵
  PID:4808
- C:\Windows\System\RWpiRXZ.exe
  C:\Windows\System\RWpiRXZ.exe
  2⤵
  PID:4776
- C:\Windows\System\thVxeYS.exe
  C:\Windows\System\thVxeYS.exe
  2⤵
  PID:5288
- C:\Windows\System\sAcQeVH.exe
  C:\Windows\System\sAcQeVH.exe
  2⤵
  PID:5180
- C:\Windows\System\MJUyBnJ.exe
  C:\Windows\System\MJUyBnJ.exe
  2⤵
  PID:5324
- C:\Windows\System\AeGOIdv.exe
  C:\Windows\System\AeGOIdv.exe
  2⤵
  PID:5540
- C:\Windows\System\eIAQjAT.exe
  C:\Windows\System\eIAQjAT.exe
  2⤵
  PID:5520
- C:\Windows\System\hLaKeuq.exe
  C:\Windows\System\hLaKeuq.exe
  2⤵
  PID:5576
- C:\Windows\System\CjWJUdX.exe
  C:\Windows\System\CjWJUdX.exe
  2⤵
  PID:5956
- C:\Windows\System\CZlEkWo.exe
  C:\Windows\System\CZlEkWo.exe
  2⤵
  PID:5852
- C:\Windows\System\UJYpyWo.exe
  C:\Windows\System\UJYpyWo.exe
  2⤵
  PID:6052
- C:\Windows\System\HSgQYYB.exe
  C:\Windows\System\HSgQYYB.exe
  2⤵
  PID:6040
- C:\Windows\System\GwXqgqM.exe
  C:\Windows\System\GwXqgqM.exe
  2⤵
  PID:5976
- C:\Windows\System\tIeQoRF.exe
  C:\Windows\System\tIeQoRF.exe
  2⤵
  PID:5616
- C:\Windows\System\zrCwMMd.exe
  C:\Windows\System\zrCwMMd.exe
  2⤵
  PID:5320
- C:\Windows\System\XtPtmog.exe
  C:\Windows\System\XtPtmog.exe
  2⤵
  PID:5776
- C:\Windows\System\FUpYKDC.exe
  C:\Windows\System\FUpYKDC.exe
  2⤵
  PID:5172
- C:\Windows\System\AmpwcTM.exe
  C:\Windows\System\AmpwcTM.exe
  2⤵
  PID:5492
- C:\Windows\System\zRYAbQd.exe
  C:\Windows\System\zRYAbQd.exe
  2⤵
  PID:5796
- C:\Windows\System\wgQBaDm.exe
  C:\Windows\System\wgQBaDm.exe
  2⤵
  PID:5536
- C:\Windows\System\EHyhKiz.exe
  C:\Windows\System\EHyhKiz.exe
  2⤵
  PID:6020
- C:\Windows\System\hOdNFmp.exe
  C:\Windows\System\hOdNFmp.exe
  2⤵
  PID:5660
- C:\Windows\System\oUkGhNp.exe
  C:\Windows\System\oUkGhNp.exe
  2⤵
  PID:5748
- C:\Windows\System\hhNfOYG.exe
  C:\Windows\System\hhNfOYG.exe
  2⤵
  PID:5156
- C:\Windows\System\eohBJDv.exe
  C:\Windows\System\eohBJDv.exe
  2⤵
  PID:6000
- C:\Windows\System\GKQGzgY.exe
  C:\Windows\System\GKQGzgY.exe
  2⤵
  PID:5964
- C:\Windows\System\SGJUxOR.exe
  C:\Windows\System\SGJUxOR.exe
  2⤵
  PID:6152
- C:\Windows\System\KJWmEHK.exe
  C:\Windows\System\KJWmEHK.exe
  2⤵
  PID:6172
- C:\Windows\System\dHTjyvV.exe
  C:\Windows\System\dHTjyvV.exe
  2⤵
  PID:6200
- C:\Windows\System\SFkZAWb.exe
  C:\Windows\System\SFkZAWb.exe
  2⤵
  PID:6216
- C:\Windows\System\qGMnyvy.exe
  C:\Windows\System\qGMnyvy.exe
  2⤵
  PID:6232
- C:\Windows\System\yWPnEnO.exe
  C:\Windows\System\yWPnEnO.exe
  2⤵
  PID:6256
- C:\Windows\System\MDwQTas.exe
  C:\Windows\System\MDwQTas.exe
  2⤵
  PID:6284
- C:\Windows\System\AngLFzQ.exe
  C:\Windows\System\AngLFzQ.exe
  2⤵
  PID:6304
- C:\Windows\System\uozczsr.exe
  C:\Windows\System\uozczsr.exe
  2⤵
  PID:6320
- C:\Windows\System\OyyMLdx.exe
  C:\Windows\System\OyyMLdx.exe
  2⤵
  PID:6344
- C:\Windows\System\rCgIJtc.exe
  C:\Windows\System\rCgIJtc.exe
  2⤵
  PID:6360
- C:\Windows\System\VckaXJk.exe
  C:\Windows\System\VckaXJk.exe
  2⤵
  PID:6376
- C:\Windows\System\crplVLe.exe
  C:\Windows\System\crplVLe.exe
  2⤵
  PID:6400
- C:\Windows\System\YHhQEdi.exe
  C:\Windows\System\YHhQEdi.exe
  2⤵
  PID:6420
- C:\Windows\System\LolizLv.exe
  C:\Windows\System\LolizLv.exe
  2⤵
  PID:6444
- C:\Windows\System\SMwnkxw.exe
  C:\Windows\System\SMwnkxw.exe
  2⤵
  PID:6464
- C:\Windows\System\BgpjDTT.exe
  C:\Windows\System\BgpjDTT.exe
  2⤵
  PID:6488
- C:\Windows\System\YNOWKXR.exe
  C:\Windows\System\YNOWKXR.exe
  2⤵
  PID:6504
- C:\Windows\System\tHwTEmg.exe
  C:\Windows\System\tHwTEmg.exe
  2⤵
  PID:6528
- C:\Windows\System\whVSrLe.exe
  C:\Windows\System\whVSrLe.exe
  2⤵
  PID:6544
- C:\Windows\System\UCmReOc.exe
  C:\Windows\System\UCmReOc.exe
  2⤵
  PID:6564
- C:\Windows\System\qkweMDL.exe
  C:\Windows\System\qkweMDL.exe
  2⤵
  PID:6584
- C:\Windows\System\zQtUgUS.exe
  C:\Windows\System\zQtUgUS.exe
  2⤵
  PID:6608
- C:\Windows\System\jrldPdR.exe
  C:\Windows\System\jrldPdR.exe
  2⤵
  PID:6624
- C:\Windows\System\qOSpdov.exe
  C:\Windows\System\qOSpdov.exe
  2⤵
  PID:6640
- C:\Windows\System\tNoeSxs.exe
  C:\Windows\System\tNoeSxs.exe
  2⤵
  PID:6660
- C:\Windows\System\NWucYse.exe
  C:\Windows\System\NWucYse.exe
  2⤵
  PID:6676
- C:\Windows\System\KblvOgq.exe
  C:\Windows\System\KblvOgq.exe
  2⤵
  PID:6700
- C:\Windows\System\uClhHKB.exe
  C:\Windows\System\uClhHKB.exe
  2⤵
  PID:6720
- C:\Windows\System\DTQknUY.exe
  C:\Windows\System\DTQknUY.exe
  2⤵
  PID:6740
- C:\Windows\System\qHGHyhy.exe
  C:\Windows\System\qHGHyhy.exe
  2⤵
  PID:6756
- C:\Windows\System\cRPathR.exe
  C:\Windows\System\cRPathR.exe
  2⤵
  PID:6780
- C:\Windows\System\CxTXUiq.exe
  C:\Windows\System\CxTXUiq.exe
  2⤵
  PID:6796
- C:\Windows\System\nPXGyvO.exe
  C:\Windows\System\nPXGyvO.exe
  2⤵
  PID:6824
- C:\Windows\System\iTAdHwB.exe
  C:\Windows\System\iTAdHwB.exe
  2⤵
  PID:6848
- C:\Windows\System\lnUspwr.exe
  C:\Windows\System\lnUspwr.exe
  2⤵
  PID:6864
- C:\Windows\System\WJywDcV.exe
  C:\Windows\System\WJywDcV.exe
  2⤵
  PID:6880
- C:\Windows\System\slTIslp.exe
  C:\Windows\System\slTIslp.exe
  2⤵
  PID:6904
- C:\Windows\System\YuCkebv.exe
  C:\Windows\System\YuCkebv.exe
  2⤵
  PID:6920
- C:\Windows\System\wVOVMUB.exe
  C:\Windows\System\wVOVMUB.exe
  2⤵
  PID:6944
- C:\Windows\System\aanmhWY.exe
  C:\Windows\System\aanmhWY.exe
  2⤵
  PID:6968
- C:\Windows\System\dSwCsLB.exe
  C:\Windows\System\dSwCsLB.exe
  2⤵
  PID:6984
- C:\Windows\System\TdMHNKL.exe
  C:\Windows\System\TdMHNKL.exe
  2⤵
  PID:7004
- C:\Windows\System\GtvWASi.exe
  C:\Windows\System\GtvWASi.exe
  2⤵
  PID:7020
- C:\Windows\System\WXtUtkR.exe
  C:\Windows\System\WXtUtkR.exe
  2⤵
  PID:7036
- C:\Windows\System\kvIXxpJ.exe
  C:\Windows\System\kvIXxpJ.exe
  2⤵
  PID:7052
- C:\Windows\System\DWVCsKQ.exe
  C:\Windows\System\DWVCsKQ.exe
  2⤵
  PID:7072
- C:\Windows\System\FEUlVVD.exe
  C:\Windows\System\FEUlVVD.exe
  2⤵
  PID:7104
- C:\Windows\System\AsuHExp.exe
  C:\Windows\System\AsuHExp.exe
  2⤵
  PID:7128
- C:\Windows\System\kMhemUZ.exe
  C:\Windows\System\kMhemUZ.exe
  2⤵
  PID:7144
- C:\Windows\System\FyOIbYW.exe
  C:\Windows\System\FyOIbYW.exe
  2⤵
  PID:7160
- C:\Windows\System\sSJTIrP.exe
  C:\Windows\System\sSJTIrP.exe
  2⤵
  PID:5284
- C:\Windows\System\fJaTaoO.exe
  C:\Windows\System\fJaTaoO.exe
  2⤵
  PID:6180
- C:\Windows\System\FjHDwnC.exe
  C:\Windows\System\FjHDwnC.exe
  2⤵
  PID:6196
- C:\Windows\System\mXpiurA.exe
  C:\Windows\System\mXpiurA.exe
  2⤵
  PID:6164
- C:\Windows\System\WLzdYqL.exe
  C:\Windows\System\WLzdYqL.exe
  2⤵
  PID:6276
- C:\Windows\System\mXnwrYe.exe
  C:\Windows\System\mXnwrYe.exe
  2⤵
  PID:6252
- C:\Windows\System\tjJdzeY.exe
  C:\Windows\System\tjJdzeY.exe
  2⤵
  PID:6296
- C:\Windows\System\YTWQaBD.exe
  C:\Windows\System\YTWQaBD.exe
  2⤵
  PID:6388
- C:\Windows\System\DWsDLIV.exe
  C:\Windows\System\DWsDLIV.exe
  2⤵
  PID:6368
- C:\Windows\System\fnPnltv.exe
  C:\Windows\System\fnPnltv.exe
  2⤵
  PID:6416
- C:\Windows\System\QoZIJvG.exe
  C:\Windows\System\QoZIJvG.exe
  2⤵
  PID:6452
- C:\Windows\System\wsXtEbJ.exe
  C:\Windows\System\wsXtEbJ.exe
  2⤵
  PID:6480
- C:\Windows\System\jHQuilb.exe
  C:\Windows\System\jHQuilb.exe
  2⤵
  PID:6500
- C:\Windows\System\PoaUWts.exe
  C:\Windows\System\PoaUWts.exe
  2⤵
  PID:6540
- C:\Windows\System\uPEVXbx.exe
  C:\Windows\System\uPEVXbx.exe
  2⤵
  PID:6592
- C:\Windows\System\uanjajK.exe
  C:\Windows\System\uanjajK.exe
  2⤵
  PID:6604
- C:\Windows\System\OcxDbWq.exe
  C:\Windows\System\OcxDbWq.exe
  2⤵
  PID:6652
- C:\Windows\System\oSPXsWW.exe
  C:\Windows\System\oSPXsWW.exe
  2⤵
  PID:6688
- C:\Windows\System\oFAkAJg.exe
  C:\Windows\System\oFAkAJg.exe
  2⤵
  PID:6752
- C:\Windows\System\TpEZjBC.exe
  C:\Windows\System\TpEZjBC.exe
  2⤵
  PID:6732
- C:\Windows\System\dbccbGX.exe
  C:\Windows\System\dbccbGX.exe
  2⤵
  PID:6776
- C:\Windows\System\FZBRVrp.exe
  C:\Windows\System\FZBRVrp.exe
  2⤵
  PID:6812
- C:\Windows\System\tgkbEsG.exe
  C:\Windows\System\tgkbEsG.exe
  2⤵
  PID:6820
- C:\Windows\System\DgGfLOU.exe
  C:\Windows\System\DgGfLOU.exe
  2⤵
  PID:6876
- C:\Windows\System\BXqDqLL.exe
  C:\Windows\System\BXqDqLL.exe
  2⤵
  PID:6916
- C:\Windows\System\zAXxANR.exe
  C:\Windows\System\zAXxANR.exe
  2⤵
  PID:6936
- C:\Windows\System\WiyIbeV.exe
  C:\Windows\System\WiyIbeV.exe
  2⤵
  PID:6940
- C:\Windows\System\wxojQKR.exe
  C:\Windows\System\wxojQKR.exe
  2⤵
  PID:6976
- C:\Windows\System\xhMlPLl.exe
  C:\Windows\System\xhMlPLl.exe
  2⤵
  PID:7068
- C:\Windows\System\OhLayxS.exe
  C:\Windows\System\OhLayxS.exe
  2⤵
  PID:7044
- C:\Windows\System\EQbMxZa.exe
  C:\Windows\System\EQbMxZa.exe
  2⤵
  PID:7096
- C:\Windows\System\bqeneOe.exe
  C:\Windows\System\bqeneOe.exe
  2⤵
  PID:7136
- C:\Windows\System\rYrlcPl.exe
  C:\Windows\System\rYrlcPl.exe
  2⤵
  PID:5504
- C:\Windows\System\RXHKzag.exe
  C:\Windows\System\RXHKzag.exe
  2⤵
  PID:6244
- C:\Windows\System\BIJwgin.exe
  C:\Windows\System\BIJwgin.exe
  2⤵
  PID:6312
- C:\Windows\System\eeILSXQ.exe
  C:\Windows\System\eeILSXQ.exe
  2⤵
  PID:6384
- C:\Windows\System\fUuxSyY.exe
  C:\Windows\System\fUuxSyY.exe
  2⤵
  PID:6268
- C:\Windows\System\bQMRkJn.exe
  C:\Windows\System\bQMRkJn.exe
  2⤵
  PID:6428
- C:\Windows\System\IIEkVsp.exe
  C:\Windows\System\IIEkVsp.exe
  2⤵
  PID:6412
- C:\Windows\System\iFfHpDE.exe
  C:\Windows\System\iFfHpDE.exe
  2⤵
  PID:6496
- C:\Windows\System\ZjGSXTd.exe
  C:\Windows\System\ZjGSXTd.exe
  2⤵
  PID:6560
- C:\Windows\System\EyEWbjU.exe
  C:\Windows\System\EyEWbjU.exe
  2⤵
  PID:6600
- C:\Windows\System\ZGTwFgQ.exe
  C:\Windows\System\ZGTwFgQ.exe
  2⤵
  PID:6672
- C:\Windows\System\vtsTKbF.exe
  C:\Windows\System\vtsTKbF.exe
  2⤵
  PID:6692
- C:\Windows\System\iksjlhu.exe
  C:\Windows\System\iksjlhu.exe
  2⤵
  PID:6808
- C:\Windows\System\cONUOUT.exe
  C:\Windows\System\cONUOUT.exe
  2⤵
  PID:6860
- C:\Windows\System\TGtkphT.exe
  C:\Windows\System\TGtkphT.exe
  2⤵
  PID:6956
- C:\Windows\System\iCLxeJu.exe
  C:\Windows\System\iCLxeJu.exe
  2⤵
  PID:6836
- C:\Windows\System\YQuFxHk.exe
  C:\Windows\System\YQuFxHk.exe
  2⤵
  PID:6844
- C:\Windows\System\mooRUPI.exe
  C:\Windows\System\mooRUPI.exe
  2⤵
  PID:7080
- C:\Windows\System\OfWbROK.exe
  C:\Windows\System\OfWbROK.exe
  2⤵
  PID:7124
- C:\Windows\System\wjALdOc.exe
  C:\Windows\System\wjALdOc.exe
  2⤵
  PID:6964
- C:\Windows\System\wpppOUw.exe
  C:\Windows\System\wpppOUw.exe
  2⤵
  PID:6228
- C:\Windows\System\AbkOfrp.exe
  C:\Windows\System\AbkOfrp.exe
  2⤵
  PID:6212
- C:\Windows\System\lkkXgCU.exe
  C:\Windows\System\lkkXgCU.exe
  2⤵
  PID:6292
- C:\Windows\System\QmmqkiV.exe
  C:\Windows\System\QmmqkiV.exe
  2⤵
  PID:6132
- C:\Windows\System\PofNRob.exe
  C:\Windows\System\PofNRob.exe
  2⤵
  PID:6520
- C:\Windows\System\QWzVskB.exe
  C:\Windows\System\QWzVskB.exe
  2⤵
  PID:6524
- C:\Windows\System\djjGYLr.exe
  C:\Windows\System\djjGYLr.exe
  2⤵
  PID:6636
- C:\Windows\System\owgTdku.exe
  C:\Windows\System\owgTdku.exe
  2⤵
  PID:6772
- C:\Windows\System\wXZPVjW.exe
  C:\Windows\System\wXZPVjW.exe
  2⤵
  PID:6980
- C:\Windows\System\KnBTsae.exe
  C:\Windows\System\KnBTsae.exe
  2⤵
  PID:7060
- C:\Windows\System\Ydrwxcj.exe
  C:\Windows\System\Ydrwxcj.exe
  2⤵
  PID:6272
- C:\Windows\System\ppzghFA.exe
  C:\Windows\System\ppzghFA.exe
  2⤵
  PID:6264
- C:\Windows\System\RqfxZhb.exe
  C:\Windows\System\RqfxZhb.exe
  2⤵
  PID:6912
- C:\Windows\System\zRWWRwK.exe
  C:\Windows\System\zRWWRwK.exe
  2⤵
  PID:7120
- C:\Windows\System\RItCOYV.exe
  C:\Windows\System\RItCOYV.exe
  2⤵
  PID:6620
- C:\Windows\System\WklLrmV.exe
  C:\Windows\System\WklLrmV.exe
  2⤵
  PID:6148
- C:\Windows\System\AgWkTYx.exe
  C:\Windows\System\AgWkTYx.exe
  2⤵
  PID:6352
- C:\Windows\System\WJtqhTT.exe
  C:\Windows\System\WJtqhTT.exe
  2⤵
  PID:6748
- C:\Windows\System\FhYUNKI.exe
  C:\Windows\System\FhYUNKI.exe
  2⤵
  PID:6712
- C:\Windows\System\qQkFdib.exe
  C:\Windows\System\qQkFdib.exe
  2⤵
  PID:7116
- C:\Windows\System\AhSJycH.exe
  C:\Windows\System\AhSJycH.exe
  2⤵
  PID:6576
- C:\Windows\System\sxGpxxf.exe
  C:\Windows\System\sxGpxxf.exe
  2⤵
  PID:5408
- C:\Windows\System\lPjoqQZ.exe
  C:\Windows\System\lPjoqQZ.exe
  2⤵
  PID:6960
- C:\Windows\System\VUhlBLd.exe
  C:\Windows\System\VUhlBLd.exe
  2⤵
  PID:6840
- C:\Windows\System\SpvEzFS.exe
  C:\Windows\System\SpvEzFS.exe
  2⤵
  PID:7092
- C:\Windows\System\iPJVuDr.exe
  C:\Windows\System\iPJVuDr.exe
  2⤵
  PID:7180
- C:\Windows\System\FTzrgDn.exe
  C:\Windows\System\FTzrgDn.exe
  2⤵
  PID:7200
- C:\Windows\System\kNItEyT.exe
  C:\Windows\System\kNItEyT.exe
  2⤵
  PID:7228
- C:\Windows\System\sCGYXPo.exe
  C:\Windows\System\sCGYXPo.exe
  2⤵
  PID:7244
- C:\Windows\System\lhbOseY.exe
  C:\Windows\System\lhbOseY.exe
  2⤵
  PID:7268
- C:\Windows\System\LpsDTlK.exe
  C:\Windows\System\LpsDTlK.exe
  2⤵
  PID:7288
- C:\Windows\System\xdpqIsl.exe
  C:\Windows\System\xdpqIsl.exe
  2⤵
  PID:7304
- C:\Windows\System\EAqclLP.exe
  C:\Windows\System\EAqclLP.exe
  2⤵
  PID:7324
- C:\Windows\System\pfZTDWW.exe
  C:\Windows\System\pfZTDWW.exe
  2⤵
  PID:7340
- C:\Windows\System\KdHivDg.exe
  C:\Windows\System\KdHivDg.exe
  2⤵
  PID:7360
- C:\Windows\System\ILJbgas.exe
  C:\Windows\System\ILJbgas.exe
  2⤵
  PID:7392
- C:\Windows\System\YUhgOyD.exe
  C:\Windows\System\YUhgOyD.exe
  2⤵
  PID:7408
- C:\Windows\System\hgqiMjm.exe
  C:\Windows\System\hgqiMjm.exe
  2⤵
  PID:7424
- C:\Windows\System\RXspVhL.exe
  C:\Windows\System\RXspVhL.exe
  2⤵
  PID:7444
- C:\Windows\System\zkPoOjk.exe
  C:\Windows\System\zkPoOjk.exe
  2⤵
  PID:7464
- C:\Windows\System\dTicYkS.exe
  C:\Windows\System\dTicYkS.exe
  2⤵
  PID:7488
- C:\Windows\System\QyoDAJa.exe
  C:\Windows\System\QyoDAJa.exe
  2⤵
  PID:7504
- C:\Windows\System\MCIFksN.exe
  C:\Windows\System\MCIFksN.exe
  2⤵
  PID:7524
- C:\Windows\System\FYGSjEY.exe
  C:\Windows\System\FYGSjEY.exe
  2⤵
  PID:7544
- C:\Windows\System\QNGjlEm.exe
  C:\Windows\System\QNGjlEm.exe
  2⤵
  PID:7564
- C:\Windows\System\yHJDhrL.exe
  C:\Windows\System\yHJDhrL.exe
  2⤵
  PID:7584
- C:\Windows\System\qAYpbXL.exe
  C:\Windows\System\qAYpbXL.exe
  2⤵
  PID:7608
- C:\Windows\System\UPqKqoU.exe
  C:\Windows\System\UPqKqoU.exe
  2⤵
  PID:7632
- C:\Windows\System\xycvVIX.exe
  C:\Windows\System\xycvVIX.exe
  2⤵
  PID:7648
- C:\Windows\System\eCpBONk.exe
  C:\Windows\System\eCpBONk.exe
  2⤵
  PID:7668
- C:\Windows\System\JhEFxAg.exe
  C:\Windows\System\JhEFxAg.exe
  2⤵
  PID:7688
- C:\Windows\System\dImcGfO.exe
  C:\Windows\System\dImcGfO.exe
  2⤵
  PID:7708
- C:\Windows\System\YRSCpLu.exe
  C:\Windows\System\YRSCpLu.exe
  2⤵
  PID:7724
- C:\Windows\System\yWczsWR.exe
  C:\Windows\System\yWczsWR.exe
  2⤵
  PID:7744
- C:\Windows\System\dyEbaPn.exe
  C:\Windows\System\dyEbaPn.exe
  2⤵
  PID:7764
- C:\Windows\System\ACKbgya.exe
  C:\Windows\System\ACKbgya.exe
  2⤵
  PID:7788
- C:\Windows\System\CkQmslH.exe
  C:\Windows\System\CkQmslH.exe
  2⤵
  PID:7808
- C:\Windows\System\DMxuAhN.exe
  C:\Windows\System\DMxuAhN.exe
  2⤵
  PID:7828
- C:\Windows\System\ZzkuqkZ.exe
  C:\Windows\System\ZzkuqkZ.exe
  2⤵
  PID:7848
- C:\Windows\System\uCfpoVf.exe
  C:\Windows\System\uCfpoVf.exe
  2⤵
  PID:7864
- C:\Windows\System\evLiaiz.exe
  C:\Windows\System\evLiaiz.exe
  2⤵
  PID:7888
- C:\Windows\System\hLCiCDp.exe
  C:\Windows\System\hLCiCDp.exe
  2⤵
  PID:7912
- C:\Windows\System\KlyKmiK.exe
  C:\Windows\System\KlyKmiK.exe
  2⤵
  PID:7928
- C:\Windows\System\EuuqlNC.exe
  C:\Windows\System\EuuqlNC.exe
  2⤵
  PID:7948
- C:\Windows\System\WaePTPI.exe
  C:\Windows\System\WaePTPI.exe
  2⤵
  PID:7968
- C:\Windows\System\LVYjcDj.exe
  C:\Windows\System\LVYjcDj.exe
  2⤵
  PID:7988
- C:\Windows\System\szEUdRO.exe
  C:\Windows\System\szEUdRO.exe
  2⤵
  PID:8004
- C:\Windows\System\FHvDqWM.exe
  C:\Windows\System\FHvDqWM.exe
  2⤵
  PID:8020
- C:\Windows\System\XFocrfC.exe
  C:\Windows\System\XFocrfC.exe
  2⤵
  PID:8040
- C:\Windows\System\GqmpVMI.exe
  C:\Windows\System\GqmpVMI.exe
  2⤵
  PID:8060
- C:\Windows\System\GTpOmzC.exe
  C:\Windows\System\GTpOmzC.exe
  2⤵
  PID:8076
- C:\Windows\System\DMEccTP.exe
  C:\Windows\System\DMEccTP.exe
  2⤵
  PID:8104
- C:\Windows\System\QvEHkDJ.exe
  C:\Windows\System\QvEHkDJ.exe
  2⤵
  PID:8124
- C:\Windows\System\kGDNUqM.exe
  C:\Windows\System\kGDNUqM.exe
  2⤵
  PID:8140
- C:\Windows\System\wQUpZJL.exe
  C:\Windows\System\wQUpZJL.exe
  2⤵
  PID:8160
- C:\Windows\System\yweRmUO.exe
  C:\Windows\System\yweRmUO.exe
  2⤵
  PID:6536
- C:\Windows\System\StKPLgh.exe
  C:\Windows\System\StKPLgh.exe
  2⤵
  PID:6240
- C:\Windows\System\tsaBmpP.exe
  C:\Windows\System\tsaBmpP.exe
  2⤵
  PID:7220
- C:\Windows\System\uHlHyFT.exe
  C:\Windows\System\uHlHyFT.exe
  2⤵
  PID:7256
- C:\Windows\System\msWkNnx.exe
  C:\Windows\System\msWkNnx.exe
  2⤵
  PID:7196
- C:\Windows\System\Iqgdsgk.exe
  C:\Windows\System\Iqgdsgk.exe
  2⤵
  PID:7300
- C:\Windows\System\bIxWvkj.exe
  C:\Windows\System\bIxWvkj.exe
  2⤵
  PID:7284
- C:\Windows\System\clWzEvX.exe
  C:\Windows\System\clWzEvX.exe
  2⤵
  PID:7384
- C:\Windows\System\RFELDCE.exe
  C:\Windows\System\RFELDCE.exe
  2⤵
  PID:7320
- C:\Windows\System\orFyPcS.exe
  C:\Windows\System\orFyPcS.exe
  2⤵
  PID:7404
- C:\Windows\System\ZRVpvCp.exe
  C:\Windows\System\ZRVpvCp.exe
  2⤵
  PID:7400
- C:\Windows\System\DDPFPwR.exe
  C:\Windows\System\DDPFPwR.exe
  2⤵
  PID:7440
- C:\Windows\System\BqkxHEf.exe
  C:\Windows\System\BqkxHEf.exe
  2⤵
  PID:7512
- C:\Windows\System\azksQcZ.exe
  C:\Windows\System\azksQcZ.exe
  2⤵
  PID:7552
- C:\Windows\System\BLWMpTT.exe
  C:\Windows\System\BLWMpTT.exe
  2⤵
  PID:7580
- C:\Windows\System\HCBFZNP.exe
  C:\Windows\System\HCBFZNP.exe
  2⤵
  PID:7596
- C:\Windows\System\weAVuLY.exe
  C:\Windows\System\weAVuLY.exe
  2⤵
  PID:7628
- C:\Windows\System\yfQYFEc.exe
  C:\Windows\System\yfQYFEc.exe
  2⤵
  PID:7664
- C:\Windows\System\lSzQFas.exe
  C:\Windows\System\lSzQFas.exe
  2⤵
  PID:7700
- C:\Windows\System\cuFUBcB.exe
  C:\Windows\System\cuFUBcB.exe
  2⤵
  PID:7772
- C:\Windows\System\mHZDavX.exe
  C:\Windows\System\mHZDavX.exe
  2⤵
  PID:7752
- C:\Windows\System\ZJmFJHn.exe
  C:\Windows\System\ZJmFJHn.exe
  2⤵
  PID:7804
- C:\Windows\System\jVjHXjM.exe
  C:\Windows\System\jVjHXjM.exe
  2⤵
  PID:7856
- C:\Windows\System\jglJmCh.exe
  C:\Windows\System\jglJmCh.exe
  2⤵
  PID:7872
- C:\Windows\System\vPDkslo.exe
  C:\Windows\System\vPDkslo.exe
  2⤵
  PID:7908
- C:\Windows\System\hNklexN.exe
  C:\Windows\System\hNklexN.exe
  2⤵
  PID:7940
- C:\Windows\System\HCkVJmC.exe
  C:\Windows\System\HCkVJmC.exe
  2⤵
  PID:7956
- C:\Windows\System\dMJZKyG.exe
  C:\Windows\System\dMJZKyG.exe
  2⤵
  PID:8016
- C:\Windows\System\WRKxdES.exe
  C:\Windows\System\WRKxdES.exe
  2⤵
  PID:8056
- C:\Windows\System\ednNpjb.exe
  C:\Windows\System\ednNpjb.exe
  2⤵
  PID:8100
- C:\Windows\System\isLxdcp.exe
  C:\Windows\System\isLxdcp.exe
  2⤵
  PID:8112
- C:\Windows\System\nreyBoe.exe
  C:\Windows\System\nreyBoe.exe
  2⤵
  PID:8188
- C:\Windows\System\tAdmsBa.exe
  C:\Windows\System\tAdmsBa.exe
  2⤵
  PID:8148
- C:\Windows\System\QiAQYFZ.exe
  C:\Windows\System\QiAQYFZ.exe
  2⤵
  PID:7208
- C:\Windows\System\LtvPYQv.exe
  C:\Windows\System\LtvPYQv.exe
  2⤵
  PID:7252
- C:\Windows\System\zlNqgKs.exe
  C:\Windows\System\zlNqgKs.exe
  2⤵
  PID:7276
- C:\Windows\System\dmlVfYe.exe
  C:\Windows\System\dmlVfYe.exe
  2⤵
  PID:7240
- C:\Windows\System\fgVyyai.exe
  C:\Windows\System\fgVyyai.exe
  2⤵
  PID:7352
- C:\Windows\System\GCUYccx.exe
  C:\Windows\System\GCUYccx.exe
  2⤵
  PID:7456
- C:\Windows\System\CFohjZF.exe
  C:\Windows\System\CFohjZF.exe
  2⤵
  PID:7480
- C:\Windows\System\IILbuXs.exe
  C:\Windows\System\IILbuXs.exe
  2⤵
  PID:7624
- C:\Windows\System\VWHkgHx.exe
  C:\Windows\System\VWHkgHx.exe
  2⤵
  PID:7472
- C:\Windows\System\KTDwjpo.exe
  C:\Windows\System\KTDwjpo.exe
  2⤵
  PID:7656
- C:\Windows\System\FinGGQz.exe
  C:\Windows\System\FinGGQz.exe
  2⤵
  PID:7732
- C:\Windows\System\sJNWSJa.exe
  C:\Windows\System\sJNWSJa.exe
  2⤵
  PID:7760
- C:\Windows\System\aJWeXTk.exe
  C:\Windows\System\aJWeXTk.exe
  2⤵
  PID:7800
- C:\Windows\System\PSjOtJm.exe
  C:\Windows\System\PSjOtJm.exe
  2⤵
  PID:7904
- C:\Windows\System\TQeUEAu.exe
  C:\Windows\System\TQeUEAu.exe
  2⤵
  PID:7920
- C:\Windows\System\gPWgyPo.exe
  C:\Windows\System\gPWgyPo.exe
  2⤵
  PID:8048
- C:\Windows\System\PBxrEVk.exe
  C:\Windows\System\PBxrEVk.exe
  2⤵
  PID:8072
- C:\Windows\System\rjEeOvk.exe
  C:\Windows\System\rjEeOvk.exe
  2⤵
  PID:7964
- C:\Windows\System\bQFjRwr.exe
  C:\Windows\System\bQFjRwr.exe
  2⤵
  PID:8096
- C:\Windows\System\jQdFxJr.exe
  C:\Windows\System\jQdFxJr.exe
  2⤵
  PID:8156
- C:\Windows\System\lnRPTwh.exe
  C:\Windows\System\lnRPTwh.exe
  2⤵
  PID:7212
- C:\Windows\System\jTlKYBd.exe
  C:\Windows\System\jTlKYBd.exe
  2⤵
  PID:7192
- C:\Windows\System\DqMdSRO.exe
  C:\Windows\System\DqMdSRO.exe
  2⤵
  PID:7420
- C:\Windows\System\oFKdcMa.exe
  C:\Windows\System\oFKdcMa.exe
  2⤵
  PID:7264
- C:\Windows\System\KwZDbSI.exe
  C:\Windows\System\KwZDbSI.exe
  2⤵
  PID:7520
- C:\Windows\System\backnqg.exe
  C:\Windows\System\backnqg.exe
  2⤵
  PID:7680
- C:\Windows\System\pktRWud.exe
  C:\Windows\System\pktRWud.exe
  2⤵
  PID:8180
- C:\Windows\System\lLzIIGK.exe
  C:\Windows\System\lLzIIGK.exe
  2⤵
  PID:7824
- C:\Windows\System\GYWFzNx.exe
  C:\Windows\System\GYWFzNx.exe
  2⤵
  PID:8088
- C:\Windows\System\rDvYmEO.exe
  C:\Windows\System\rDvYmEO.exe
  2⤵
  PID:7896
- C:\Windows\System\SOidnbS.exe
  C:\Windows\System\SOidnbS.exe
  2⤵
  PID:7312
- C:\Windows\System\RAvMSmc.exe
  C:\Windows\System\RAvMSmc.exe
  2⤵
  PID:7560
- C:\Windows\System\mvZIXku.exe
  C:\Windows\System\mvZIXku.exe
  2⤵
  PID:8012
- C:\Windows\System\TBynbfz.exe
  C:\Windows\System\TBynbfz.exe
  2⤵
  PID:7280
- C:\Windows\System\kKfiKQK.exe
  C:\Windows\System\kKfiKQK.exe
  2⤵
  PID:7000
- C:\Windows\System\pLHlIEC.exe
  C:\Windows\System\pLHlIEC.exe
  2⤵
  PID:7348
- C:\Windows\System\RpAHpXQ.exe
  C:\Windows\System\RpAHpXQ.exe
  2⤵
  PID:7600
- C:\Windows\System\JjmDoIo.exe
  C:\Windows\System\JjmDoIo.exe
  2⤵
  PID:7336
- C:\Windows\System\GggBMkr.exe
  C:\Windows\System\GggBMkr.exe
  2⤵
  PID:7756
- C:\Windows\System\ZAmbFVU.exe
  C:\Windows\System\ZAmbFVU.exe
  2⤵
  PID:7836
- C:\Windows\System\rXYOVYs.exe
  C:\Windows\System\rXYOVYs.exe
  2⤵
  PID:7676
- C:\Windows\System\VkheOvF.exe
  C:\Windows\System\VkheOvF.exe
  2⤵
  PID:6432
- C:\Windows\System\iXBzGnd.exe
  C:\Windows\System\iXBzGnd.exe
  2⤵
  PID:7644
- C:\Windows\System\YnesuRP.exe
  C:\Windows\System\YnesuRP.exe
  2⤵
  PID:7576
- C:\Windows\System\uOmpIhZ.exe
  C:\Windows\System\uOmpIhZ.exe
  2⤵
  PID:8068
- C:\Windows\System\uUSBYaP.exe
  C:\Windows\System\uUSBYaP.exe
  2⤵
  PID:8000
- C:\Windows\System\ZoETIOQ.exe
  C:\Windows\System\ZoETIOQ.exe
  2⤵
  PID:8212
- C:\Windows\System\oHaObqt.exe
  C:\Windows\System\oHaObqt.exe
  2⤵
  PID:8228
- C:\Windows\System\LWqNDyy.exe
  C:\Windows\System\LWqNDyy.exe
  2⤵
  PID:8248
- C:\Windows\System\FGHumve.exe
  C:\Windows\System\FGHumve.exe
  2⤵
  PID:8276
- C:\Windows\System\ZHhKDuf.exe
  C:\Windows\System\ZHhKDuf.exe
  2⤵
  PID:8292
- C:\Windows\System\vYebOfT.exe
  C:\Windows\System\vYebOfT.exe
  2⤵
  PID:8308
- C:\Windows\System\WmUDtdM.exe
  C:\Windows\System\WmUDtdM.exe
  2⤵
  PID:8324
- C:\Windows\System\yUkhjqG.exe
  C:\Windows\System\yUkhjqG.exe
  2⤵
  PID:8344
- C:\Windows\System\TFXPmGk.exe
  C:\Windows\System\TFXPmGk.exe
  2⤵
  PID:8364
- C:\Windows\System\abbnnGJ.exe
  C:\Windows\System\abbnnGJ.exe
  2⤵
  PID:8380
- C:\Windows\System\izfCAAi.exe
  C:\Windows\System\izfCAAi.exe
  2⤵
  PID:8408
- C:\Windows\System\reaNLyz.exe
  C:\Windows\System\reaNLyz.exe
  2⤵
  PID:8428
- C:\Windows\System\yZICrSN.exe
  C:\Windows\System\yZICrSN.exe
  2⤵
  PID:8448
- C:\Windows\System\oquVJhS.exe
  C:\Windows\System\oquVJhS.exe
  2⤵
  PID:8472
- C:\Windows\System\QkJoRVx.exe
  C:\Windows\System\QkJoRVx.exe
  2⤵
  PID:8492
- C:\Windows\System\OSXxFaJ.exe
  C:\Windows\System\OSXxFaJ.exe
  2⤵
  PID:8512
- C:\Windows\System\lakzfEW.exe
  C:\Windows\System\lakzfEW.exe
  2⤵
  PID:8532
- C:\Windows\System\OwNrskx.exe
  C:\Windows\System\OwNrskx.exe
  2⤵
  PID:8548
- C:\Windows\System\cozekrn.exe
  C:\Windows\System\cozekrn.exe
  2⤵
  PID:8568
- C:\Windows\System\WaWokym.exe
  C:\Windows\System\WaWokym.exe
  2⤵
  PID:8588
- C:\Windows\System\SGUemNl.exe
  C:\Windows\System\SGUemNl.exe
  2⤵
  PID:8604
- C:\Windows\System\pEIXQuz.exe
  C:\Windows\System\pEIXQuz.exe
  2⤵
  PID:8640
- C:\Windows\System\LzQXaGF.exe
  C:\Windows\System\LzQXaGF.exe
  2⤵
  PID:8656
- C:\Windows\System\qhsEcte.exe
  C:\Windows\System\qhsEcte.exe
  2⤵
  PID:8672
- C:\Windows\System\JDpmyjM.exe
  C:\Windows\System\JDpmyjM.exe
  2⤵
  PID:8688
- C:\Windows\System\lQGAQVL.exe
  C:\Windows\System\lQGAQVL.exe
  2⤵
  PID:8712
- C:\Windows\System\GikrMEO.exe
  C:\Windows\System\GikrMEO.exe
  2⤵
  PID:8736
- C:\Windows\System\VoeIypV.exe
  C:\Windows\System\VoeIypV.exe
  2⤵
  PID:8756
- C:\Windows\System\nKxMRsr.exe
  C:\Windows\System\nKxMRsr.exe
  2⤵
  PID:8788
- C:\Windows\System\LzXZmlf.exe
  C:\Windows\System\LzXZmlf.exe
  2⤵
  PID:8808
- C:\Windows\System\fiektXa.exe
  C:\Windows\System\fiektXa.exe
  2⤵
  PID:8828
- C:\Windows\System\tRzMBPo.exe
  C:\Windows\System\tRzMBPo.exe
  2⤵
  PID:8848
- C:\Windows\System\cDtOTwd.exe
  C:\Windows\System\cDtOTwd.exe
  2⤵
  PID:8868
- C:\Windows\System\bEDkmEW.exe
  C:\Windows\System\bEDkmEW.exe
  2⤵
  PID:8888
- C:\Windows\System\safLPxn.exe
  C:\Windows\System\safLPxn.exe
  2⤵
  PID:8924
- C:\Windows\System\AvSiGUh.exe
  C:\Windows\System\AvSiGUh.exe
  2⤵
  PID:8944
- C:\Windows\System\FTmCUxn.exe
  C:\Windows\System\FTmCUxn.exe
  2⤵
  PID:8960
- C:\Windows\System\lBonXay.exe
  C:\Windows\System\lBonXay.exe
  2⤵
  PID:8980
- C:\Windows\System\gmnhqbl.exe
  C:\Windows\System\gmnhqbl.exe
  2⤵
  PID:8996
- C:\Windows\System\YGYyLqb.exe
  C:\Windows\System\YGYyLqb.exe
  2⤵
  PID:9028
- C:\Windows\System\sfVddWE.exe
  C:\Windows\System\sfVddWE.exe
  2⤵
  PID:9044
- C:\Windows\System\McfRswF.exe
  C:\Windows\System\McfRswF.exe
  2⤵
  PID:9060
- C:\Windows\System\NOaVzqP.exe
  C:\Windows\System\NOaVzqP.exe
  2⤵
  PID:9080
- C:\Windows\System\HUWPegv.exe
  C:\Windows\System\HUWPegv.exe
  2⤵
  PID:9096
- C:\Windows\System\tWWFScQ.exe
  C:\Windows\System\tWWFScQ.exe
  2⤵
  PID:9112
- C:\Windows\System\TdLcVuT.exe
  C:\Windows\System\TdLcVuT.exe
  2⤵
  PID:9152
- C:\Windows\System\tFhZsHo.exe
  C:\Windows\System\tFhZsHo.exe
  2⤵
  PID:9172
- C:\Windows\System\QfhhEBb.exe
  C:\Windows\System\QfhhEBb.exe
  2⤵
  PID:9192
- C:\Windows\System\cTkCVti.exe
  C:\Windows\System\cTkCVti.exe
  2⤵
  PID:9208
- C:\Windows\System\YQKcxnP.exe
  C:\Windows\System\YQKcxnP.exe
  2⤵
  PID:7592
- C:\Windows\System\NbTpbcA.exe
  C:\Windows\System\NbTpbcA.exe
  2⤵
  PID:8224
- C:\Windows\System\YGOxaFc.exe
  C:\Windows\System\YGOxaFc.exe
  2⤵
  PID:8268
- C:\Windows\System\EmoykBp.exe
  C:\Windows\System\EmoykBp.exe
  2⤵
  PID:8284
- C:\Windows\System\WcsdwyF.exe
  C:\Windows\System\WcsdwyF.exe
  2⤵
  PID:8332
- C:\Windows\System\zEiLdwP.exe
  C:\Windows\System\zEiLdwP.exe
  2⤵
  PID:8376
- C:\Windows\System\RUSSgOJ.exe
  C:\Windows\System\RUSSgOJ.exe
  2⤵
  PID:8352
- C:\Windows\System\PCTnBRh.exe
  C:\Windows\System\PCTnBRh.exe
  2⤵
  PID:8316
- C:\Windows\System\LebARqV.exe
  C:\Windows\System\LebARqV.exe
  2⤵
  PID:8460
- C:\Windows\System\Nebirlw.exe
  C:\Windows\System\Nebirlw.exe
  2⤵
  PID:8436
- C:\Windows\System\QWYuTqv.exe
  C:\Windows\System\QWYuTqv.exe
  2⤵
  PID:8524
- C:\Windows\System\eECwVox.exe
  C:\Windows\System\eECwVox.exe
  2⤵
  PID:8576
- C:\Windows\System\XWFfGjN.exe
  C:\Windows\System\XWFfGjN.exe
  2⤵
  PID:8560
- C:\Windows\System\kZfYDJg.exe
  C:\Windows\System\kZfYDJg.exe
  2⤵
  PID:8624
- C:\Windows\System\gtnTWcW.exe
  C:\Windows\System\gtnTWcW.exe
  2⤵
  PID:8648
- C:\Windows\System\VoCYLlE.exe
  C:\Windows\System\VoCYLlE.exe
  2⤵
  PID:8696
- C:\Windows\System\mkmljti.exe
  C:\Windows\System\mkmljti.exe
  2⤵
  PID:8680
- C:\Windows\System\DsoVHIq.exe
  C:\Windows\System\DsoVHIq.exe
  2⤵
  PID:8724
- C:\Windows\System\jRkgNYS.exe
  C:\Windows\System\jRkgNYS.exe
  2⤵
  PID:8768
- C:\Windows\System\HNXhzqy.exe
  C:\Windows\System\HNXhzqy.exe
  2⤵
  PID:8796
- C:\Windows\System\mgDXyIl.exe
  C:\Windows\System\mgDXyIl.exe
  2⤵
  PID:8824
- C:\Windows\System\oNdvgmM.exe
  C:\Windows\System\oNdvgmM.exe
  2⤵
  PID:8880
- C:\Windows\System\FrOQuoQ.exe
  C:\Windows\System\FrOQuoQ.exe
  2⤵
  PID:8912
- C:\Windows\System\iKihkDZ.exe
  C:\Windows\System\iKihkDZ.exe
  2⤵
  PID:8952
- C:\Windows\System\fkpwZie.exe
  C:\Windows\System\fkpwZie.exe
  2⤵
  PID:8988
- C:\Windows\System\KJqGTNI.exe
  C:\Windows\System\KJqGTNI.exe
  2⤵
  PID:9040
- C:\Windows\System\XKBQCGn.exe
  C:\Windows\System\XKBQCGn.exe
  2⤵
  PID:9092
- C:\Windows\System\RXRROpA.exe
  C:\Windows\System\RXRROpA.exe
  2⤵
  PID:9072
- C:\Windows\System\eJiMjPI.exe
  C:\Windows\System\eJiMjPI.exe
  2⤵
  PID:9132
- C:\Windows\System\LQxEkCu.exe
  C:\Windows\System\LQxEkCu.exe
  2⤵
  PID:9160
- C:\Windows\System\fOuTQKl.exe
  C:\Windows\System\fOuTQKl.exe
  2⤵
  PID:8032
- C:\Windows\System\iEtrSgf.exe
  C:\Windows\System\iEtrSgf.exe
  2⤵
  PID:8220
- C:\Windows\System\EJvuiez.exe
  C:\Windows\System\EJvuiez.exe
  2⤵
  PID:8208
- C:\Windows\System\SWuKNSy.exe
  C:\Windows\System\SWuKNSy.exe
  2⤵
  PID:8304
- C:\Windows\System\QpsjRlv.exe
  C:\Windows\System\QpsjRlv.exe
  2⤵
  PID:8400
- C:\Windows\System\GoCTKOB.exe
  C:\Windows\System\GoCTKOB.exe
  2⤵
  PID:9144
- C:\Windows\System\oVaJPgd.exe
  C:\Windows\System\oVaJPgd.exe
  2⤵
  PID:8468
- C:\Windows\System\XjVuudo.exe
  C:\Windows\System\XjVuudo.exe
  2⤵
  PID:8480
- C:\Windows\System\YybNIRf.exe
  C:\Windows\System\YybNIRf.exe
  2⤵
  PID:8580
- C:\Windows\System\csFdaNq.exe
  C:\Windows\System\csFdaNq.exe
  2⤵
  PID:8612
- C:\Windows\System\HhUCeZe.exe
  C:\Windows\System\HhUCeZe.exe
  2⤵
  PID:8704
- C:\Windows\System\qQRtOlp.exe
  C:\Windows\System\qQRtOlp.exe
  2⤵
  PID:8748
- C:\Windows\System\UfeADBw.exe
  C:\Windows\System\UfeADBw.exe
  2⤵
  PID:8840
- C:\Windows\System\BAoHPzj.exe
  C:\Windows\System\BAoHPzj.exe
  2⤵
  PID:8720
- C:\Windows\System\UwuYnNO.exe
  C:\Windows\System\UwuYnNO.exe
  2⤵
  PID:8920
- C:\Windows\System\OcYAtTv.exe
  C:\Windows\System\OcYAtTv.exe
  2⤵
  PID:8992
- C:\Windows\System\LcmvVQW.exe
  C:\Windows\System\LcmvVQW.exe
  2⤵
  PID:9024
- C:\Windows\System\EUgjoBW.exe
  C:\Windows\System\EUgjoBW.exe
  2⤵
  PID:9108
- C:\Windows\System\cyWNukj.exe
  C:\Windows\System\cyWNukj.exe
  2⤵
  PID:9184
- C:\Windows\System\ThZrbuM.exe
  C:\Windows\System\ThZrbuM.exe
  2⤵
  PID:9200
- C:\Windows\System\oxUOoOg.exe
  C:\Windows\System\oxUOoOg.exe
  2⤵
  PID:8200
- C:\Windows\System\kfFTKUc.exe
  C:\Windows\System\kfFTKUc.exe
  2⤵
  PID:8260
- C:\Windows\System\aUDBrPr.exe
  C:\Windows\System\aUDBrPr.exe
  2⤵
  PID:8360
- C:\Windows\System\NQWkhqN.exe
  C:\Windows\System\NQWkhqN.exe
  2⤵
  PID:8520
- C:\Windows\System\memEmRx.exe
  C:\Windows\System\memEmRx.exe
  2⤵
  PID:8600
- C:\Windows\System\JGNtefA.exe
  C:\Windows\System\JGNtefA.exe
  2⤵
  PID:8764
- C:\Windows\System\RThjkEj.exe
  C:\Windows\System\RThjkEj.exe
  2⤵
  PID:8668
- C:\Windows\System\GnTfBDB.exe
  C:\Windows\System\GnTfBDB.exe
  2⤵
  PID:8632
- C:\Windows\System\vcheuqk.exe
  C:\Windows\System\vcheuqk.exe
  2⤵
  PID:8908
- C:\Windows\System\eteeWYn.exe
  C:\Windows\System\eteeWYn.exe
  2⤵
  PID:8932
- C:\Windows\System\gBiDbSK.exe
  C:\Windows\System\gBiDbSK.exe
  2⤵
  PID:9148
- C:\Windows\System\szmiYDM.exe
  C:\Windows\System\szmiYDM.exe
  2⤵
  PID:7432
- C:\Windows\System\JNxPxcZ.exe
  C:\Windows\System\JNxPxcZ.exe
  2⤵
  PID:8244
- C:\Windows\System\RyRacMF.exe
  C:\Windows\System\RyRacMF.exe
  2⤵
  PID:8488
- C:\Windows\System\FNYiwOJ.exe
  C:\Windows\System\FNYiwOJ.exe
  2⤵
  PID:8616
- C:\Windows\System\jiaaJxB.exe
  C:\Windows\System\jiaaJxB.exe
  2⤵
  PID:8784
- C:\Windows\System\jEODWUQ.exe
  C:\Windows\System\jEODWUQ.exe
  2⤵
  PID:8820
- C:\Windows\System\wyGQiWT.exe
  C:\Windows\System\wyGQiWT.exe
  2⤵
  PID:9088
- C:\Windows\System\DwQgxcX.exe
  C:\Windows\System\DwQgxcX.exe
  2⤵
  PID:9168
- C:\Windows\System\TEyoooe.exe
  C:\Windows\System\TEyoooe.exe
  2⤵
  PID:9016
- C:\Windows\System\lEAyTIC.exe
  C:\Windows\System\lEAyTIC.exe
  2⤵
  PID:8940
- C:\Windows\System\AWdpnoG.exe
  C:\Windows\System\AWdpnoG.exe
  2⤵
  PID:8728
- C:\Windows\System\RCNPNWZ.exe
  C:\Windows\System\RCNPNWZ.exe
  2⤵
  PID:8864
- C:\Windows\System\PvHSfHH.exe
  C:\Windows\System\PvHSfHH.exe
  2⤵
  PID:9128
- C:\Windows\System\CqAKgIQ.exe
  C:\Windows\System\CqAKgIQ.exe
  2⤵
  PID:8372
- C:\Windows\System\sOspjEN.exe
  C:\Windows\System\sOspjEN.exe
  2⤵
  PID:8236
- C:\Windows\System\YEfVHOa.exe
  C:\Windows\System\YEfVHOa.exe
  2⤵
  PID:9220
- C:\Windows\System\gdGgKgc.exe
  C:\Windows\System\gdGgKgc.exe
  2⤵
  PID:9236
- C:\Windows\System\zKrHekW.exe
  C:\Windows\System\zKrHekW.exe
  2⤵
  PID:9252
- C:\Windows\System\NXZRgMS.exe
  C:\Windows\System\NXZRgMS.exe
  2⤵
  PID:9272
- C:\Windows\System\BugZGao.exe
  C:\Windows\System\BugZGao.exe
  2⤵
  PID:9296
- C:\Windows\System\WZOoILk.exe
  C:\Windows\System\WZOoILk.exe
  2⤵
  PID:9332
- C:\Windows\System\FOAimmw.exe
  C:\Windows\System\FOAimmw.exe
  2⤵
  PID:9348
- C:\Windows\System\zvjLeJJ.exe
  C:\Windows\System\zvjLeJJ.exe
  2⤵
  PID:9368
- C:\Windows\System\NXIDsCZ.exe
  C:\Windows\System\NXIDsCZ.exe
  2⤵
  PID:9388
- C:\Windows\System\IMDJWCg.exe
  C:\Windows\System\IMDJWCg.exe
  2⤵
  PID:9404
- C:\Windows\System\GvPdDRC.exe
  C:\Windows\System\GvPdDRC.exe
  2⤵
  PID:9428
- C:\Windows\System\gFkvnhE.exe
  C:\Windows\System\gFkvnhE.exe
  2⤵
  PID:9448
- C:\Windows\System\EVZueRy.exe
  C:\Windows\System\EVZueRy.exe
  2⤵
  PID:9472
- C:\Windows\System\NxdukaN.exe
  C:\Windows\System\NxdukaN.exe
  2⤵
  PID:9488
- C:\Windows\System\qAveznd.exe
  C:\Windows\System\qAveznd.exe
  2⤵
  PID:9504
- C:\Windows\System\QSghZrD.exe
  C:\Windows\System\QSghZrD.exe
  2⤵
  PID:9524
- C:\Windows\System\ayBYFCU.exe
  C:\Windows\System\ayBYFCU.exe
  2⤵
  PID:9540
- C:\Windows\System\UkUqmRI.exe
  C:\Windows\System\UkUqmRI.exe
  2⤵
  PID:9576
- C:\Windows\System\SRDGnFx.exe
  C:\Windows\System\SRDGnFx.exe
  2⤵
  PID:9592
- C:\Windows\System\jJXHqCf.exe
  C:\Windows\System\jJXHqCf.exe
  2⤵
  PID:9608
- C:\Windows\System\PuEvELl.exe
  C:\Windows\System\PuEvELl.exe
  2⤵
  PID:9624
- C:\Windows\System\Eyhzzpk.exe
  C:\Windows\System\Eyhzzpk.exe
  2⤵
  PID:9652
- C:\Windows\System\SrePMMS.exe
  C:\Windows\System\SrePMMS.exe
  2⤵
  PID:9668
- C:\Windows\System\DXtqJRm.exe
  C:\Windows\System\DXtqJRm.exe
  2⤵
  PID:9684
- C:\Windows\System\LwFrruq.exe
  C:\Windows\System\LwFrruq.exe
  2⤵
  PID:9716
- C:\Windows\System\VHIWxGQ.exe
  C:\Windows\System\VHIWxGQ.exe
  2⤵
  PID:9732
- C:\Windows\System\UTBtSPA.exe
  C:\Windows\System\UTBtSPA.exe
  2⤵
  PID:9748
- C:\Windows\System\OoKBTTR.exe
  C:\Windows\System\OoKBTTR.exe
  2⤵
  PID:9764
- C:\Windows\System\qPvaoZA.exe
  C:\Windows\System\qPvaoZA.exe
  2⤵
  PID:9792
- C:\Windows\System\txLHEji.exe
  C:\Windows\System\txLHEji.exe
  2⤵
  PID:9808
- C:\Windows\System\tYBEtaq.exe
  C:\Windows\System\tYBEtaq.exe
  2⤵
  PID:9832
- C:\Windows\System\diqwFob.exe
  C:\Windows\System\diqwFob.exe
  2⤵
  PID:9852
- C:\Windows\System\KnVKMOY.exe
  C:\Windows\System\KnVKMOY.exe
  2⤵
  PID:9868
- C:\Windows\System\qKwZphh.exe
  C:\Windows\System\qKwZphh.exe
  2⤵
  PID:9896
- C:\Windows\System\eESLnUU.exe
  C:\Windows\System\eESLnUU.exe
  2⤵
  PID:9924
- C:\Windows\System\TEHglOZ.exe
  C:\Windows\System\TEHglOZ.exe
  2⤵
  PID:9944
- C:\Windows\System\JBPddql.exe
  C:\Windows\System\JBPddql.exe
  2⤵
  PID:9960
- C:\Windows\System\mzfyQHz.exe
  C:\Windows\System\mzfyQHz.exe
  2⤵
  PID:9980
- C:\Windows\System\vSrpLwa.exe
  C:\Windows\System\vSrpLwa.exe
  2⤵
  PID:10004
- C:\Windows\System\IUiZjvV.exe
  C:\Windows\System\IUiZjvV.exe
  2⤵
  PID:10028
- C:\Windows\System\KWKiLZu.exe
  C:\Windows\System\KWKiLZu.exe
  2⤵
  PID:10044
- C:\Windows\System\LAsIGzW.exe
  C:\Windows\System\LAsIGzW.exe
  2⤵
  PID:10060
- C:\Windows\System\BGdUXLT.exe
  C:\Windows\System\BGdUXLT.exe
  2⤵
  PID:10084
- C:\Windows\System\FRmsftW.exe
  C:\Windows\System\FRmsftW.exe
  2⤵
  PID:10100
- C:\Windows\System\cfTSnWq.exe
  C:\Windows\System\cfTSnWq.exe
  2⤵
  PID:10120
- C:\Windows\System\HvhFssd.exe
  C:\Windows\System\HvhFssd.exe
  2⤵
  PID:10136
- C:\Windows\System\lwwVrJD.exe
  C:\Windows\System\lwwVrJD.exe
  2⤵
  PID:10176
- C:\Windows\System\McllUCi.exe
  C:\Windows\System\McllUCi.exe
  2⤵
  PID:10192
- C:\Windows\System\oEKaCDH.exe
  C:\Windows\System\oEKaCDH.exe
  2⤵
  PID:10208
- C:\Windows\System\VyaYcVH.exe
  C:\Windows\System\VyaYcVH.exe
  2⤵
  PID:10224
- C:\Windows\System\wLToVun.exe
  C:\Windows\System\wLToVun.exe
  2⤵
  PID:8544
- C:\Windows\System\tgLZNMp.exe
  C:\Windows\System\tgLZNMp.exe
  2⤵
  PID:8392
- C:\Windows\System\anfmdcc.exe
  C:\Windows\System\anfmdcc.exe
  2⤵
  PID:9304
- C:\Windows\System\dflKjfI.exe
  C:\Windows\System\dflKjfI.exe
  2⤵
  PID:9308
- C:\Windows\System\jmLUjga.exe
  C:\Windows\System\jmLUjga.exe
  2⤵
  PID:9340
- C:\Windows\System\yDHMrQm.exe
  C:\Windows\System\yDHMrQm.exe
  2⤵
  PID:9356
- C:\Windows\System\bmFIQzO.exe
  C:\Windows\System\bmFIQzO.exe
  2⤵
  PID:9412
- C:\Windows\System\TQoPvza.exe
  C:\Windows\System\TQoPvza.exe
  2⤵
  PID:9436
- C:\Windows\System\TykkJPc.exe
  C:\Windows\System\TykkJPc.exe
  2⤵
  PID:9460
- C:\Windows\System\TVcynDE.exe
  C:\Windows\System\TVcynDE.exe
  2⤵
  PID:9496
- C:\Windows\System\EeiHLFe.exe
  C:\Windows\System\EeiHLFe.exe
  2⤵
  PID:9548
- C:\Windows\System\nbOWAFL.exe
  C:\Windows\System\nbOWAFL.exe
  2⤵
  PID:9564
- C:\Windows\System\vprpyEC.exe
  C:\Windows\System\vprpyEC.exe
  2⤵
  PID:9604
- C:\Windows\System\CUJlUGh.exe
  C:\Windows\System\CUJlUGh.exe
  2⤵
  PID:9640
- C:\Windows\System\pAeDalg.exe
  C:\Windows\System\pAeDalg.exe
  2⤵
  PID:9692
- C:\Windows\System\MKXabNA.exe
  C:\Windows\System\MKXabNA.exe
  2⤵
  PID:9704
- C:\Windows\System\XZAwOTm.exe
  C:\Windows\System\XZAwOTm.exe
  2⤵
  PID:9744
- C:\Windows\System\zosmyIK.exe
  C:\Windows\System\zosmyIK.exe
  2⤵
  PID:9788
- C:\Windows\System\ZNEPxlN.exe
  C:\Windows\System\ZNEPxlN.exe
  2⤵
  PID:9760
- C:\Windows\System\kIMrRDB.exe
  C:\Windows\System\kIMrRDB.exe
  2⤵
  PID:9828
- C:\Windows\System\WCkXbFh.exe
  C:\Windows\System\WCkXbFh.exe
  2⤵
  PID:9864
- C:\Windows\System\weliNiw.exe
  C:\Windows\System\weliNiw.exe
  2⤵
  PID:9892
- C:\Windows\System\folSPMX.exe
  C:\Windows\System\folSPMX.exe
  2⤵
  PID:9936
- C:\Windows\System\sDgRnst.exe
  C:\Windows\System\sDgRnst.exe
  2⤵
  PID:9940
- C:\Windows\System\UgdrIEh.exe
  C:\Windows\System\UgdrIEh.exe
  2⤵
  PID:9988
- C:\Windows\System\CmngKbJ.exe
  C:\Windows\System\CmngKbJ.exe
  2⤵
  PID:9996
- C:\Windows\System\HTbaDqf.exe
  C:\Windows\System\HTbaDqf.exe
  2⤵
  PID:10020
- C:\Windows\System\IUFBNjg.exe
  C:\Windows\System\IUFBNjg.exe
  2⤵
  PID:10056
- C:\Windows\System\UwupZJR.exe
  C:\Windows\System\UwupZJR.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BONxqvx.exe

Filesize
1.3MB

MD5
4fb6cddddddf4838e5fd2d4151018d28

SHA1
464e4cdfa0ee5c98842c457b1c1e129789453fb9

SHA256
31745a7b7d14248bf7cf85e28ad5a4c9d3671197155ffd9dc923c4ed72c7fc5b

SHA512
04d27155c006bd4e13f2f557e3e19ca72fdc6981f34625847e03132d846fa4424a6380847babac27159d20cf44db686cd3b9649fca5e284cdacc290365337ccd

Download Submit
C:\Windows\system\BdYdnWO.exe

Filesize
1.3MB

MD5
7d648bd04c101a43c30c19d15e46e576

SHA1
fd1c0b4b087ce40db6968748f050eada7fa9327b

SHA256
d33f626ea9f1f6d59944c6783cd9878ddccbdafc62418a30534c66b9d5ab7aca

SHA512
e27e7c9e0ca5d72d82ba69c0e9bfeff4790e6706c09bde59bdcc9ff381d6a7a3879b7d3ee43ede31856575ac0884c3a0e9e3926c5510d515964715000832265d

Download Submit
C:\Windows\system\FSQtjNj.exe

Filesize
1.3MB

MD5
00c125a537ac9f2627bd68c7db5f2615

SHA1
81f77ceaa3ff0590ec5ac0118cfef29da2b2eeb0

SHA256
b84628e039afda6d1b86e0b1a959341826873de40eccf2461545660cea426044

SHA512
ebde500b7a23c38ac6260a714e12ff0f7874f38d0cfa654f3e23eb8fdd3844400188f836d887846f59dfd5cc5b2cada470bfb3afbad2f7e546ace6f76b50b8b7

Download Submit
C:\Windows\system\IXJZQtl.exe

Filesize
1.3MB

MD5
314d58379cea52fde3ce9dc30a7998f9

SHA1
30f335dcb11abb68feb2656d020b76fed5f2bbb2

SHA256
bfa49fd4e4154bc416e1399f413b9eb955c3ef050a2e8e6f3f69abddd2a4037e

SHA512
ba1b9dde9bb76139c69249bac43b57eb2a9677c96e49a338f5d87b6bbd29a772a22375d5b943de2c7370ca533218f127ce37460218c8c1218d11c8a30b9fd01c

Download Submit
C:\Windows\system\JXawtIz.exe

Filesize
1.3MB

MD5
76269e4af681a1a6b3e9d87273241b4e

SHA1
30cd3287665cba7064c00047ef57e214660a8f04

SHA256
5490cbd28bca9c23dbedc9e4ca5f5043554da4a453de5f85668099aee1c7ab20

SHA512
03b892f2fd9a632d846ff521e1ff99925e9cd43157fbe84b1f2f4749d1861270c54bd941c062a3b74d8ab399ec92b357c5bc0da457adbd544f56367f55f1cf9f

Download Submit
C:\Windows\system\JxhCVqW.exe

Filesize
1.3MB

MD5
21413b3563a013242423fe273eb4face

SHA1
8d9753e02f4452e40969d20f1c21acc9feed7eaa

SHA256
c8be4b738e11910f2f9afb970fa6f6ef031dcaea811d6a7a3695491a3bf3f182

SHA512
52a76e97a523bbcfb3d5e18b9d0ffc8cb912cdae54eb23a3364244a2165efb9b2fddc6971cf3dfa1321c8df51de35d9e1a2daa3b48f6e41f512661c5852a722e

Download Submit
C:\Windows\system\NbxRPjR.exe

Filesize
1.3MB

MD5
b5f3f436f47fc2d92962a78b8d2fa048

SHA1
b378bcb3f04679fb33f454a8813e4a63e15484ff

SHA256
508fa5089c149ae0779b2117454a2073de96f594bd3f61858c34d05520ce953d

SHA512
e04f231e2b3cfa70a328567a130c51e9febee20347abfa09cc6337b220926742e19a68b9da0f2663ddbcfb4a452e82f5d933d00e75f419b5df58b499fef246cd

Download Submit
C:\Windows\system\OASUOQY.exe

Filesize
1.3MB

MD5
d6a0fe45546ed90107113e33a92b5ebb

SHA1
9770b628f5c5234a2edf70ce9c562f111df10b0c

SHA256
a439a47f9db8d2062c1a9c5b77a55aea3ca3959e5cf64f7c23f8bfba23ee26e4

SHA512
6e6cb4bcbc408ebf9cfdbf808887a4a029b94f8f36317e807a8c7e9e69cf4996c504e618cba966aaf21a4633ede4a19b700b89adc4fe1125c3d4328d033a5a79

Download Submit
C:\Windows\system\OSfPJxD.exe

Filesize
1.3MB

MD5
38a227839fc65f7d1ea298b55d0fce6d

SHA1
67a5ced19b8a41c00e2ee48a955a16088215d99b

SHA256
902085c6946cbf3ca9fd28b5a48816b966c7541f060ee19bc9c135491924bd56

SHA512
d5ee2a05953103844431e89e7c10b87dafa8b667563c127757c8b8893ee299b4de25122b77a3c2325cea1bd85af1c308c20450a7154d083fabd9069ef7c35120

Download Submit
C:\Windows\system\RhNdSJL.exe

Filesize
1.3MB

MD5
1642c9f1aa54855663e79a9b32ae7c77

SHA1
f65b166c46b765dd1dc665501bf9e52b9153d5e9

SHA256
a8925eb568da54b69e751fa73d449db9566390d1e2dcb756749ab173816db808

SHA512
a1b91e92ed551c441341e92f33359468cd2c5afa0f8e40ad26f80d232a5c879526992fa58c534fa5f4c4944d136711f6c5fa1ccc3bbca15847b409529dafdfd6

Download Submit
C:\Windows\system\SvcBIXA.exe

Filesize
1.3MB

MD5
bbda990822c952a2a28a21552cf3d9ba

SHA1
0a12590d7b97eaba4d0f1ea9f4ef0e34926b6fca

SHA256
f1949482da20d819d5285ece79742295a95a4d4c346bb14711c30c5525196f74

SHA512
7a2f27d5489a589c598a2361134550fc3a33f7edd73e651a516f00410bfbb0f7b3c78bc3ef33207710f2ac3b237c39c4ab1e018e416290aa11d310d7c174c170

Download Submit
C:\Windows\system\SwbNgPA.exe

Filesize
1.3MB

MD5
1bc659f53c5777de4f0032d8b936d652

SHA1
c346315e5a1be1293a0026dbff173fcdfdc8d505

SHA256
ee19e01f2cb4adabc095dca7f499f926224e59c59096d6a3e57310ffa0c95d4e

SHA512
1e3b7f2df59aea3e032541ed7b182b45bd4d1a3c86c882435a47550ce5b3cefb768a7ea5abf29b95dcb389af097c63bdc013f22608e56b2bf7b3cc9c56c05a8f

Download Submit
C:\Windows\system\TgkpCpB.exe

Filesize
1.3MB

MD5
cc0e7bab56da4df885cd3b21930c2079

SHA1
fc093e9f39fa9212f1125fc58da24edf7dc2306e

SHA256
4ba539c6fdb4cd4ecfe204adb3a8f37f6658e97f5b5e33588e19645411214731

SHA512
84a3e0efad3bc4c363bc3d96e1a61059ac9e6f7920c5c7d7cc7346d7edd70e59c14d752d6a4da2cec9da298615dd7c5707f2ac2775a44395accf63368d030e1a

Download Submit
C:\Windows\system\XjVAKgt.exe

Filesize
1.3MB

MD5
2a593ee2318b9632a3b938d50c0b82e9

SHA1
de6c19da2ea4a86050eca49983e627b0e93e2117

SHA256
c749b52116f5d69372054f0d4584a6fb0b21fed92d44d6b6c7eeb8f8f69d6544

SHA512
50d1a8fb01f1027e64b933a2fe84bc0ce52d36e3a39efd6f3cfeabeb5c0fef60a614a97556a5a2d295e543f4217c137cc69404c5e799be5c4fb95da34c15ddf9

Download Submit
C:\Windows\system\ZbumkDv.exe

Filesize
1.3MB

MD5
0bd56da050b94aaf1d9f6c0f462f0dc7

SHA1
8303b2e8f3460d64a83c87da1efbdbb252b05b68

SHA256
3e7e34eb2e1b1e2e150d9a2893f2155e15891f29ddefdc78b365c77c520ca364

SHA512
6d3d41815cba781f62cf1f11517cc13394c5243c721a89ff8c2b1a128f7960e5add2d37569ba803b14a05f2ba20e115fad1de400613d378353625f3ae89cf7d5

Download Submit
C:\Windows\system\bNOqkbT.exe

Filesize
1.3MB

MD5
021f5e56a528b3086be8635d7b4e74f4

SHA1
40e0a725de704b55810f058119605cc7416226d2

SHA256
88456a313fece34769178bf1e3afba68409a9c3feba020f1fcc3c94240f4b1b0

SHA512
36e9d9825a478e8a20ff76d57607490473cb8c36025fdf6ce91c4fa30d8feaee6237f660d47d427d48bdd9ebee92ab9914e670d92728c0d4563924f5dda6955a

Download Submit
C:\Windows\system\cuNtctF.exe

Filesize
1.3MB

MD5
348cc78e79a477b8af00efbeee95bb75

SHA1
b4023904d81220001ea8abf005ea481b38c3aace

SHA256
2e643916cf4157613cbaab28c53d02356e211892d44199c9ea0f0d5de82ab8bf

SHA512
42882c9efa13bd10ac611ac2fc3e6a66df7412360d8e4950fce15cedb7c7ae148e6704d069f723a4a58aeb6620b56c9e311ab564fc01e455bcbe8423c0db5724

Download Submit
C:\Windows\system\fquBxXH.exe

Filesize
1.3MB

MD5
3444d61c6919fcebb67a177a953d53e4

SHA1
9680ecdb508baff3ac96548cfc5dcbb97e509547

SHA256
d6831373d10b10d3bf359d978cb5860545886678a20803c5933bb7d2e84a74bd

SHA512
984752731c304cb58aca70251ceb7f3c8ca3594eca8e2930484d1cfe01d5c4c1cfcd99d1189209e0fc819784674435d07d63499cb64bc60d92ae829e60ffb876

Download Submit
C:\Windows\system\jIVEfzM.exe

Filesize
1.3MB

MD5
da414c591ec855015f5a4cd1720ff176

SHA1
6352b769a7a43d6a56573687d375572fa106db03

SHA256
80008a2368a123a1858b49c649dc4cf454afb1b63fdfbd431bcb64dcc867a047

SHA512
a93c54ffea2506f52b60b66e2885358f8f2c069da683d3a6ce18d0bda3d09912810b078e2c256546d9654e33ffdea88d3c0feaf2956d2c8bc36e045e2731d86b

Download Submit
C:\Windows\system\ngPSaur.exe

Filesize
1.3MB

MD5
2aa6b132192e94820794e7bb6dccf52d

SHA1
248538b7665a03d288daa58639a89b7a5e7b3e24

SHA256
9375111e3c2bfd0f5182c6016ff086932e4896463eba3e57f1c4c3f1c699320e

SHA512
5234b934c39168bb861233b18a6f0c542b92e83ec5645faf1554855f5fc0aeb27f59584658dc09f0cb42198f46a948c5e5c2acb82e724ab757f88c068b03e545

Download Submit
C:\Windows\system\nuYQfBQ.exe

Filesize
1.3MB

MD5
f616232bff1c2d2e988410238799bc32

SHA1
75df25b2eb1df271b610c034fea6f801ae14c643

SHA256
92fafb74d8048419d0691a4f9a4d453ed1a0bca857525c223b319ce3c7d63959

SHA512
d74156cf2fd5894ebd9686e49314afba357b57331b7d8d2a474a57912416ee76f29c76110ce4f58a3bc17bc474a2d9937b43a444a73503597cdf25f9aedfa279

Download Submit
C:\Windows\system\pMYzkdM.exe

Filesize
1.3MB

MD5
7c9d587d85339dd6e14d1576bcb1d9f9

SHA1
1f3a63dee48a1e5475ff1072f711ded843e4934a

SHA256
d7661fa066bf2eb7d3be4f80157e94e758c5cbebab292174e2d8e57456ec86fc

SHA512
55761a9715f67a8cc92d800b53f3899f0d2fe570ee1fe580a8949b748e77ffa30444603f7ecba7dab32b8c425efb786d50bdf06b0465c488179fc3e8d04430fb

Download Submit
C:\Windows\system\pWRUMPq.exe

Filesize
1.3MB

MD5
04b68fa24a682038af068803e4e588d6

SHA1
d3f3f4a9d8f33da0698edec6aaf57c89e5003b42

SHA256
3c9533077e24ffc01b83f61801f424f3031f60dd506ecbe52889b52561c348fe

SHA512
252406c787278cf63a9cc0181ac51a470fad876670b5120f28b0950ed07ce003fe0bda6024d48ee10505e8bb51ed58088795bcf7c0be9d49cfe8bbbae75b8107

Download Submit
C:\Windows\system\vVfrnkW.exe

Filesize
1.3MB

MD5
a67c149d303f071ea5167330888b1f0e

SHA1
7105b8383f243a29b2a07664f3db100520c0f6a3

SHA256
0d35012d697cafa1f600161502cf806141943b5ff48be73aa902c1c358bce0df

SHA512
78da401dac878f510e9e0bac619f695bc35ee42f7d70b158834ad98183da953c1c0146490f0b74f978d438c9cea1c91092f926f576c74357fb2b4bcd0a650f15

Download Submit
C:\Windows\system\wicLonT.exe

Filesize
1.3MB

MD5
3ea0e02be5448275a1487a5f49cb67ba

SHA1
d47b09c39ea84b601a2f77a9e4ac0dde9deba569

SHA256
ea65062d04962695fc32418758401e7104520efc77398fc31643c740e0e52d3f

SHA512
e8e7af62620803dde4c8af1628c9382e2e298a1ced31c78bf36c5fd8429e32f12477df3f0de22eac46969ac5bb3ac17e0f1d415f2ddcff7cff7b96c907053515

Download Submit
C:\Windows\system\yTgdqBr.exe

Filesize
1.3MB

MD5
e8733461948681cb3a3a4df4c0a26724

SHA1
43dad2bcace88d4bd84c2ed18b3afd12a9546541

SHA256
310a26174bc13c5776731ef37e5877ff4e8dc6925eff6d22978f3adfc13bc6f9

SHA512
27825da935d999e3a84766bada6018239ce0a8ba6dd2426706883c24ffbd0bfd67e50d9f4f0901297b8956a3838c5c189c75b946bbf5069f4929be71cee4daf9

Download Submit
C:\Windows\system\yitQLDu.exe

Filesize
1.3MB

MD5
64001eca1ebda15d37fc49825c9db944

SHA1
81e3dc8f4d80ef691e196b7bc15b15ffab9f040e

SHA256
b9979f0045e4a5238ebe9c8d4eddf30e76b6fb5101b422653a431891e3475560

SHA512
c61a21e815aaae065bc057dbf41c8978a14286f40d1f8c6b4354745e0b1373addbdb56eae356285b5335f527b7f1d081b82d7934ada3546a006075fb022cd078

Download Submit
\Windows\system\NCGPtey.exe

Filesize
1.3MB

MD5
68735ab3c9f36a3d8de2c952a7127e7e

SHA1
1c9c8cf2f6535b715f399ecb5a633fdb7115e739

SHA256
bc456d91746029eb15ec59b9eaa10096974e588f3bf119a3356bec41d0a93e8c

SHA512
a1d7d3c427ba7eba60a96e16fa5e7344d1508d5f71b2da655ac7f45dd1ac207f2b01196ae34dbff92a08169e692ae098337f11bd8686e95a1e2e9802ac4911cc

Download Submit
\Windows\system\SLRkKqd.exe

Filesize
1.3MB

MD5
f1a271cebaba92e0573f3ff74b5956d3

SHA1
c59a7bc5fb224510e97da3f0a08187e395dca4a7

SHA256
71bac62cc0c6ad4fce5986d7611f76c130bd22937139d2feb776a3ac03e28aeb

SHA512
9e1fc1ae67b614704563590ff49d73fe9a358e9f2954329cb0272fe9cff9c841ecf70b29e32c3883ce6d96a772792c92acf2c42c5977235dfa5fb1670c942f99

Download Submit
\Windows\system\mAkmPIs.exe

Filesize
1.3MB

MD5
df02f0b2152ca2b217818cfcac4d5945

SHA1
e253e1dd28818cd1a6c279e22b132d130ea9a00b

SHA256
755fc8e82292a0e2446bcc58490eada5194f3defbd47a07b115295f7c9954c85

SHA512
e7468dd60ae2875590904c8effbc0d86b4b02bf6b38b0ab2789bdc6e516d5dee95f92f11102a3b42242fe2440ead4a3e590277df3ed4211d44fc63bbcd9f2065

Download Submit
\Windows\system\wBhRLQA.exe

Filesize
1.3MB

MD5
9cfce7c4b8da090a6661cff23ce2c0bd

SHA1
b233fc6d66352de67675440f5a7b243fdd2c846b

SHA256
17cd4bf296a831212f76154a949224bc6aef9e613839e6e5da89e3f25e61de0e

SHA512
a5fb4aab19de8f9a310c46a4710571ac62fb5b357c25edeb6091a51ea45e5fba8f66ee9e87a6e234c58d7337ec7e79edb6b99222c97611f469e730f234272a13

Download Submit
\Windows\system\zUXtDRF.exe

Filesize
1.3MB

MD5
683b0612be914a80e94cfa73c9aa1425

SHA1
fb051fa26b050a1c5023807f2cfe24a6941877f3

SHA256
dca6acbb72adbad7314b073e4e5cebc41fd98ed969e08107c27005d2006a35bd

SHA512
13d1bdd6cb606095558265daf50d6cce2c3603724fa744126edf95b3ffc705adce546271d91082160c0b4cbf76af4cb4df44439e980a998d251dc8c05d00c13d

Download Submit
memory/2740-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download