xmrig | 42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/01/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
Size

1.4MB
MD5

1868083ab5c4181b431d0bb59c970d19
SHA1

55bd2ccb1c6c902ede1204af22e2adca3af20cc4
SHA256

42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2
SHA512

30a053c55010965a4612b0961d33077b02bba14ead33f0a4c28c9170debf16d4d141ad1c8acb79aeee341c3a3dd46af4b79c6df61007f873c25ff2f2d6465bab
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWJfxm:GezaTF8FcNkNdfE0pZ9ozttwIRx3QEYm

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000700000001211a-5.dat	xmrig
behavioral1/files/0x0009000000015d6e-9.dat	xmrig
behavioral1/files/0x0008000000015d87-14.dat	xmrig
behavioral1/files/0x0007000000015db1-29.dat	xmrig
behavioral1/files/0x0009000000015e18-33.dat	xmrig
behavioral1/files/0x0008000000016c84-36.dat	xmrig
behavioral1/files/0x0006000000016d25-48.dat	xmrig
behavioral1/files/0x0006000000016dbe-72.dat	xmrig
behavioral1/files/0x0006000000016ea4-84.dat	xmrig
behavioral1/files/0x00060000000174a2-120.dat	xmrig
behavioral1/files/0x0014000000018663-128.dat	xmrig
behavioral1/files/0x0006000000017525-124.dat	xmrig
behavioral1/files/0x0006000000017487-116.dat	xmrig
behavioral1/files/0x0006000000017472-112.dat	xmrig
behavioral1/files/0x00060000000173fc-108.dat	xmrig
behavioral1/files/0x00060000000173f4-105.dat	xmrig
behavioral1/files/0x00060000000173f1-100.dat	xmrig
behavioral1/files/0x00060000000173da-96.dat	xmrig
behavioral1/files/0x000600000001706d-92.dat	xmrig
behavioral1/files/0x0006000000016eca-88.dat	xmrig
behavioral1/files/0x0006000000016dd7-80.dat	xmrig
behavioral1/files/0x0006000000016dd1-76.dat	xmrig
behavioral1/files/0x0006000000016d9a-68.dat	xmrig
behavioral1/files/0x0006000000016d96-64.dat	xmrig
behavioral1/files/0x0006000000016d46-60.dat	xmrig
behavioral1/files/0x0006000000016d3e-56.dat	xmrig
behavioral1/files/0x0006000000016d36-52.dat	xmrig
behavioral1/files/0x0006000000016cfc-44.dat	xmrig
behavioral1/files/0x0006000000016cd1-40.dat	xmrig
behavioral1/files/0x0007000000015da7-24.dat	xmrig
behavioral1/files/0x0007000000015d9a-21.dat	xmrig
behavioral1/files/0x0008000000015d76-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2564	LlcxvFL.exe
1224	jsVbIrd.exe
2088	zfgtzCE.exe
2196	VrEiHDI.exe
2280	eXMWBuG.exe
1984	RlkunLN.exe
2392	gyRLave.exe
2396	Aneyzeg.exe
2084	HCqQHKG.exe
2044	xXodwnD.exe
2292	WZvrgOD.exe
1248	RnXiKJC.exe
3052	EQcOvPl.exe
2620	qvldHsT.exe
2676	UgvWwCp.exe
2856	PJosjII.exe
2604	aDnCnwn.exe
2332	JpwujoH.exe
2760	IxYykqf.exe
2504	ascqaXG.exe
2120	URnLsYF.exe
2648	NgrFrfS.exe
2476	VcqQKDD.exe
2508	mNXVIfZ.exe
2248	YxkoMQP.exe
1660	ArbLPNW.exe
1548	AQiQgng.exe
1684	QfCvrrz.exe
392	hudququ.exe
2240	rGVvrFF.exe
1088	SfsDfIz.exe
1608	fBwTonn.exe
1420	PxowxYd.exe
836	leUOloM.exe
2936	qWQTnQm.exe
1356	xPQJMws.exe
924	lZYVofg.exe
2904	WLbiLMv.exe
1532	aeDmwyK.exe
2996	iXrItyf.exe
1908	FaMKMLc.exe
1092	lkeJNWY.exe
544	MKzwJJC.exe
1716	pZNCUGO.exe
1888	MNFQngj.exe
2812	IyaOYYP.exe
1140	aBtazdK.exe
748	UTjSSXz.exe
2820	rbDLIAp.exe
1652	KZWvflT.exe
2204	FpsAOKW.exe
2348	dvxguky.exe
856	PutWtNC.exe
3048	nXuXRhz.exe
2096	JHoAnNa.exe
2832	TNDeuIS.exe
2316	GSogFJa.exe
2844	NxSLqlI.exe
2456	XqPNXIQ.exe
3068	QGfVRdA.exe
1584	jnGAOfe.exe
3028	izqYjVd.exe
2228	hZgSFcv.exe
2180	CJdDigY.exe

Loads dropped DLL 64 IoCs

pid	Process
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RtbIuzB.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jfGBTxj.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\hENGqlC.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\styJXZY.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\MLSTphf.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\WOTRvxd.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\ascqaXG.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\bKLOaFb.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\ERsviGU.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\HSZgOwC.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\UgvWwCp.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\ZsNtyQD.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\GYOhYtI.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\fOMqssk.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jAKTNfx.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\oxdSIBn.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jeWTKJx.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\QGfVRdA.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\nCTRUKq.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\yzsQOFx.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\dsRdDPC.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\InRezxT.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\WZhZnrH.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\zrECvIA.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\NyDxnKN.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\HEeJeqc.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\hCuqtqM.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\pkcTYeH.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\iyrwJWn.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\hHAZRCm.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\vIcvsbB.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\WnVmzIv.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\sKUjCGY.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\kTgdXhV.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\YQNNSwK.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\zszDwbU.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\yABGeyr.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\EBtuLUc.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\NNuGxaj.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\RvzGkjR.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\aTuTFej.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\FvRCrVK.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\nsNGSSs.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\hlsMsld.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\MCYcjGe.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\TNvaoUi.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\clYVodQ.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\XEsGaLM.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\pQdgoOo.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\TZdAhQw.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\qaXTSkg.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\sKtMkpl.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jUZkKbI.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jeUkYsM.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\AwtxFEW.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\dCawHKD.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\KuIZNeP.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\qasQYUf.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\WDpWGsf.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\EonKOYz.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\MRaRlNC.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\nwZkhpH.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\SinCyve.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
File created	C:\Windows\System\jNjfPvh.exe	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2564	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	29
PID 2896 wrote to memory of 2564	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	29
PID 2896 wrote to memory of 2564	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	29
PID 2896 wrote to memory of 1224	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	30
PID 2896 wrote to memory of 1224	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	30
PID 2896 wrote to memory of 1224	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	30
PID 2896 wrote to memory of 2088	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	31
PID 2896 wrote to memory of 2088	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	31
PID 2896 wrote to memory of 2088	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	31
PID 2896 wrote to memory of 2196	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	32
PID 2896 wrote to memory of 2196	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	32
PID 2896 wrote to memory of 2196	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	32
PID 2896 wrote to memory of 2280	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	33
PID 2896 wrote to memory of 2280	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	33
PID 2896 wrote to memory of 2280	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	33
PID 2896 wrote to memory of 1984	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	34
PID 2896 wrote to memory of 1984	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	34
PID 2896 wrote to memory of 1984	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	34
PID 2896 wrote to memory of 2392	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	35
PID 2896 wrote to memory of 2392	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	35
PID 2896 wrote to memory of 2392	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	35
PID 2896 wrote to memory of 2396	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	36
PID 2896 wrote to memory of 2396	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	36
PID 2896 wrote to memory of 2396	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	36
PID 2896 wrote to memory of 2084	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	37
PID 2896 wrote to memory of 2084	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	37
PID 2896 wrote to memory of 2084	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	37
PID 2896 wrote to memory of 2044	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	38
PID 2896 wrote to memory of 2044	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	38
PID 2896 wrote to memory of 2044	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	38
PID 2896 wrote to memory of 2292	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	39
PID 2896 wrote to memory of 2292	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	39
PID 2896 wrote to memory of 2292	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	39
PID 2896 wrote to memory of 1248	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	40
PID 2896 wrote to memory of 1248	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	40
PID 2896 wrote to memory of 1248	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	40
PID 2896 wrote to memory of 3052	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	41
PID 2896 wrote to memory of 3052	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	41
PID 2896 wrote to memory of 3052	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	41
PID 2896 wrote to memory of 2620	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	42
PID 2896 wrote to memory of 2620	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	42
PID 2896 wrote to memory of 2620	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	42
PID 2896 wrote to memory of 2676	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	43
PID 2896 wrote to memory of 2676	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	43
PID 2896 wrote to memory of 2676	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	43
PID 2896 wrote to memory of 2856	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	44
PID 2896 wrote to memory of 2856	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	44
PID 2896 wrote to memory of 2856	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	44
PID 2896 wrote to memory of 2604	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	45
PID 2896 wrote to memory of 2604	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	45
PID 2896 wrote to memory of 2604	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	45
PID 2896 wrote to memory of 2332	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	46
PID 2896 wrote to memory of 2332	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	46
PID 2896 wrote to memory of 2332	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	46
PID 2896 wrote to memory of 2760	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	47
PID 2896 wrote to memory of 2760	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	47
PID 2896 wrote to memory of 2760	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	47
PID 2896 wrote to memory of 2504	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	48
PID 2896 wrote to memory of 2504	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	48
PID 2896 wrote to memory of 2504	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	48
PID 2896 wrote to memory of 2120	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	49
PID 2896 wrote to memory of 2120	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	49
PID 2896 wrote to memory of 2120	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	49
PID 2896 wrote to memory of 2648	2896	42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe	50

C:\Users\Admin\AppData\Local\Temp\42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe
"C:\Users\Admin\AppData\Local\Temp\42c81d9a685bff8caba77a79692223b150886eb1a6307e77fa95c7d230cda3b2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System\LlcxvFL.exe
  C:\Windows\System\LlcxvFL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\jsVbIrd.exe
  C:\Windows\System\jsVbIrd.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\zfgtzCE.exe
  C:\Windows\System\zfgtzCE.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\VrEiHDI.exe
  C:\Windows\System\VrEiHDI.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\eXMWBuG.exe
  C:\Windows\System\eXMWBuG.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\RlkunLN.exe
  C:\Windows\System\RlkunLN.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\gyRLave.exe
  C:\Windows\System\gyRLave.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\Aneyzeg.exe
  C:\Windows\System\Aneyzeg.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\HCqQHKG.exe
  C:\Windows\System\HCqQHKG.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\xXodwnD.exe
  C:\Windows\System\xXodwnD.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\WZvrgOD.exe
  C:\Windows\System\WZvrgOD.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\RnXiKJC.exe
  C:\Windows\System\RnXiKJC.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\EQcOvPl.exe
  C:\Windows\System\EQcOvPl.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\qvldHsT.exe
  C:\Windows\System\qvldHsT.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UgvWwCp.exe
  C:\Windows\System\UgvWwCp.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PJosjII.exe
  C:\Windows\System\PJosjII.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\aDnCnwn.exe
  C:\Windows\System\aDnCnwn.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\JpwujoH.exe
  C:\Windows\System\JpwujoH.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\IxYykqf.exe
  C:\Windows\System\IxYykqf.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ascqaXG.exe
  C:\Windows\System\ascqaXG.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\URnLsYF.exe
  C:\Windows\System\URnLsYF.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\NgrFrfS.exe
  C:\Windows\System\NgrFrfS.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\VcqQKDD.exe
  C:\Windows\System\VcqQKDD.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\mNXVIfZ.exe
  C:\Windows\System\mNXVIfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YxkoMQP.exe
  C:\Windows\System\YxkoMQP.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ArbLPNW.exe
  C:\Windows\System\ArbLPNW.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\AQiQgng.exe
  C:\Windows\System\AQiQgng.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\QfCvrrz.exe
  C:\Windows\System\QfCvrrz.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\hudququ.exe
  C:\Windows\System\hudququ.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\rGVvrFF.exe
  C:\Windows\System\rGVvrFF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\SfsDfIz.exe
  C:\Windows\System\SfsDfIz.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\fBwTonn.exe
  C:\Windows\System\fBwTonn.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\PxowxYd.exe
  C:\Windows\System\PxowxYd.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\xPQJMws.exe
  C:\Windows\System\xPQJMws.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\leUOloM.exe
  C:\Windows\System\leUOloM.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\lZYVofg.exe
  C:\Windows\System\lZYVofg.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\qWQTnQm.exe
  C:\Windows\System\qWQTnQm.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WLbiLMv.exe
  C:\Windows\System\WLbiLMv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\aeDmwyK.exe
  C:\Windows\System\aeDmwyK.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\iXrItyf.exe
  C:\Windows\System\iXrItyf.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\FaMKMLc.exe
  C:\Windows\System\FaMKMLc.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\lkeJNWY.exe
  C:\Windows\System\lkeJNWY.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\MKzwJJC.exe
  C:\Windows\System\MKzwJJC.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\pZNCUGO.exe
  C:\Windows\System\pZNCUGO.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\MNFQngj.exe
  C:\Windows\System\MNFQngj.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\IyaOYYP.exe
  C:\Windows\System\IyaOYYP.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\aBtazdK.exe
  C:\Windows\System\aBtazdK.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\UTjSSXz.exe
  C:\Windows\System\UTjSSXz.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\rbDLIAp.exe
  C:\Windows\System\rbDLIAp.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\KZWvflT.exe
  C:\Windows\System\KZWvflT.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FpsAOKW.exe
  C:\Windows\System\FpsAOKW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\dvxguky.exe
  C:\Windows\System\dvxguky.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\PutWtNC.exe
  C:\Windows\System\PutWtNC.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\nXuXRhz.exe
  C:\Windows\System\nXuXRhz.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\JHoAnNa.exe
  C:\Windows\System\JHoAnNa.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\TNDeuIS.exe
  C:\Windows\System\TNDeuIS.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\GSogFJa.exe
  C:\Windows\System\GSogFJa.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\NxSLqlI.exe
  C:\Windows\System\NxSLqlI.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XqPNXIQ.exe
  C:\Windows\System\XqPNXIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\QGfVRdA.exe
  C:\Windows\System\QGfVRdA.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\jnGAOfe.exe
  C:\Windows\System\jnGAOfe.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\izqYjVd.exe
  C:\Windows\System\izqYjVd.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\hZgSFcv.exe
  C:\Windows\System\hZgSFcv.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\CJdDigY.exe
  C:\Windows\System\CJdDigY.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\LvsvxlW.exe
  C:\Windows\System\LvsvxlW.exe
  2⤵
  PID:2764
- C:\Windows\System\wRBLdrn.exe
  C:\Windows\System\wRBLdrn.exe
  2⤵
  PID:1992
- C:\Windows\System\cfDIXAQ.exe
  C:\Windows\System\cfDIXAQ.exe
  2⤵
  PID:2268
- C:\Windows\System\txFYLlP.exe
  C:\Windows\System\txFYLlP.exe
  2⤵
  PID:2680
- C:\Windows\System\kWAhNVi.exe
  C:\Windows\System\kWAhNVi.exe
  2⤵
  PID:2612
- C:\Windows\System\TzerZbM.exe
  C:\Windows\System\TzerZbM.exe
  2⤵
  PID:2512
- C:\Windows\System\fjslMTb.exe
  C:\Windows\System\fjslMTb.exe
  2⤵
  PID:3016
- C:\Windows\System\taYEhPA.exe
  C:\Windows\System\taYEhPA.exe
  2⤵
  PID:2556
- C:\Windows\System\XcyFrGh.exe
  C:\Windows\System\XcyFrGh.exe
  2⤵
  PID:1536
- C:\Windows\System\sIoqbIK.exe
  C:\Windows\System\sIoqbIK.exe
  2⤵
  PID:1448
- C:\Windows\System\vHxlOCd.exe
  C:\Windows\System\vHxlOCd.exe
  2⤵
  PID:620
- C:\Windows\System\QvbqrsU.exe
  C:\Windows\System\QvbqrsU.exe
  2⤵
  PID:796
- C:\Windows\System\GYZLMzi.exe
  C:\Windows\System\GYZLMzi.exe
  2⤵
  PID:1276
- C:\Windows\System\KrDYdnL.exe
  C:\Windows\System\KrDYdnL.exe
  2⤵
  PID:972
- C:\Windows\System\ZiQteMP.exe
  C:\Windows\System\ZiQteMP.exe
  2⤵
  PID:784
- C:\Windows\System\fsIrKlU.exe
  C:\Windows\System\fsIrKlU.exe
  2⤵
  PID:2540
- C:\Windows\System\zTgOgLW.exe
  C:\Windows\System\zTgOgLW.exe
  2⤵
  PID:2744
- C:\Windows\System\KFwYpEW.exe
  C:\Windows\System\KFwYpEW.exe
  2⤵
  PID:2124
- C:\Windows\System\OGEBLWH.exe
  C:\Windows\System\OGEBLWH.exe
  2⤵
  PID:2568
- C:\Windows\System\xynMnJH.exe
  C:\Windows\System\xynMnJH.exe
  2⤵
  PID:2984
- C:\Windows\System\VlJzwdF.exe
  C:\Windows\System\VlJzwdF.exe
  2⤵
  PID:2344
- C:\Windows\System\zszDwbU.exe
  C:\Windows\System\zszDwbU.exe
  2⤵
  PID:2924
- C:\Windows\System\qIyJIzJ.exe
  C:\Windows\System\qIyJIzJ.exe
  2⤵
  PID:1392
- C:\Windows\System\KuVhkXH.exe
  C:\Windows\System\KuVhkXH.exe
  2⤵
  PID:988
- C:\Windows\System\KuPgwkq.exe
  C:\Windows\System\KuPgwkq.exe
  2⤵
  PID:1864
- C:\Windows\System\fMjcwTN.exe
  C:\Windows\System\fMjcwTN.exe
  2⤵
  PID:1756
- C:\Windows\System\GXYpglx.exe
  C:\Windows\System\GXYpglx.exe
  2⤵
  PID:2040
- C:\Windows\System\IKZZTaq.exe
  C:\Windows\System\IKZZTaq.exe
  2⤵
  PID:936
- C:\Windows\System\WwuRAxQ.exe
  C:\Windows\System\WwuRAxQ.exe
  2⤵
  PID:692
- C:\Windows\System\FhRYVdW.exe
  C:\Windows\System\FhRYVdW.exe
  2⤵
  PID:2172
- C:\Windows\System\IUBtMVl.exe
  C:\Windows\System\IUBtMVl.exe
  2⤵
  PID:948
- C:\Windows\System\ZFiPHyg.exe
  C:\Windows\System\ZFiPHyg.exe
  2⤵
  PID:1736
- C:\Windows\System\bFcjnQl.exe
  C:\Windows\System\bFcjnQl.exe
  2⤵
  PID:2168
- C:\Windows\System\aMZzllq.exe
  C:\Windows\System\aMZzllq.exe
  2⤵
  PID:1588
- C:\Windows\System\VvvXaLB.exe
  C:\Windows\System\VvvXaLB.exe
  2⤵
  PID:2884
- C:\Windows\System\geRdcwV.exe
  C:\Windows\System\geRdcwV.exe
  2⤵
  PID:1724
- C:\Windows\System\fPimaaS.exe
  C:\Windows\System\fPimaaS.exe
  2⤵
  PID:2272
- C:\Windows\System\bcOYccy.exe
  C:\Windows\System\bcOYccy.exe
  2⤵
  PID:1932
- C:\Windows\System\ecAIZcF.exe
  C:\Windows\System\ecAIZcF.exe
  2⤵
  PID:3056
- C:\Windows\System\bFmwJoQ.exe
  C:\Windows\System\bFmwJoQ.exe
  2⤵
  PID:2608
- C:\Windows\System\iMuHNNd.exe
  C:\Windows\System\iMuHNNd.exe
  2⤵
  PID:2848
- C:\Windows\System\unFSrmf.exe
  C:\Windows\System\unFSrmf.exe
  2⤵
  PID:1664
- C:\Windows\System\bKLOaFb.exe
  C:\Windows\System\bKLOaFb.exe
  2⤵
  PID:1616
- C:\Windows\System\NZcBrHY.exe
  C:\Windows\System\NZcBrHY.exe
  2⤵
  PID:308
- C:\Windows\System\GZkUllN.exe
  C:\Windows\System\GZkUllN.exe
  2⤵
  PID:2920
- C:\Windows\System\BzZMIFD.exe
  C:\Windows\System\BzZMIFD.exe
  2⤵
  PID:776
- C:\Windows\System\CrNLNHF.exe
  C:\Windows\System\CrNLNHF.exe
  2⤵
  PID:2132
- C:\Windows\System\xwdGQnT.exe
  C:\Windows\System\xwdGQnT.exe
  2⤵
  PID:2780
- C:\Windows\System\HKbIRbo.exe
  C:\Windows\System\HKbIRbo.exe
  2⤵
  PID:444
- C:\Windows\System\ulqrqGE.exe
  C:\Windows\System\ulqrqGE.exe
  2⤵
  PID:2716
- C:\Windows\System\TbQBvnT.exe
  C:\Windows\System\TbQBvnT.exe
  2⤵
  PID:1600
- C:\Windows\System\utEjbOE.exe
  C:\Windows\System\utEjbOE.exe
  2⤵
  PID:900
- C:\Windows\System\NUprtBm.exe
  C:\Windows\System\NUprtBm.exe
  2⤵
  PID:2988
- C:\Windows\System\UtROSsR.exe
  C:\Windows\System\UtROSsR.exe
  2⤵
  PID:1656
- C:\Windows\System\LUWIQve.exe
  C:\Windows\System\LUWIQve.exe
  2⤵
  PID:3088
- C:\Windows\System\TulkfZp.exe
  C:\Windows\System\TulkfZp.exe
  2⤵
  PID:3108
- C:\Windows\System\tzowvQc.exe
  C:\Windows\System\tzowvQc.exe
  2⤵
  PID:3128
- C:\Windows\System\aYBMGyG.exe
  C:\Windows\System\aYBMGyG.exe
  2⤵
  PID:3152
- C:\Windows\System\TqXHLUA.exe
  C:\Windows\System\TqXHLUA.exe
  2⤵
  PID:3176
- C:\Windows\System\Stfvwya.exe
  C:\Windows\System\Stfvwya.exe
  2⤵
  PID:3196
- C:\Windows\System\tFPaNPi.exe
  C:\Windows\System\tFPaNPi.exe
  2⤵
  PID:3212
- C:\Windows\System\RUzdDGA.exe
  C:\Windows\System\RUzdDGA.exe
  2⤵
  PID:3232
- C:\Windows\System\Clygdxp.exe
  C:\Windows\System\Clygdxp.exe
  2⤵
  PID:3256
- C:\Windows\System\tbNrgup.exe
  C:\Windows\System\tbNrgup.exe
  2⤵
  PID:3272
- C:\Windows\System\qmrAnZq.exe
  C:\Windows\System\qmrAnZq.exe
  2⤵
  PID:3292
- C:\Windows\System\uePYXyH.exe
  C:\Windows\System\uePYXyH.exe
  2⤵
  PID:3316
- C:\Windows\System\pMyXZBX.exe
  C:\Windows\System\pMyXZBX.exe
  2⤵
  PID:3332
- C:\Windows\System\HlhSHJo.exe
  C:\Windows\System\HlhSHJo.exe
  2⤵
  PID:3352
- C:\Windows\System\HBFwXhl.exe
  C:\Windows\System\HBFwXhl.exe
  2⤵
  PID:3372
- C:\Windows\System\OONquzH.exe
  C:\Windows\System\OONquzH.exe
  2⤵
  PID:3388
- C:\Windows\System\MpmCWyd.exe
  C:\Windows\System\MpmCWyd.exe
  2⤵
  PID:3412
- C:\Windows\System\qBkaKqz.exe
  C:\Windows\System\qBkaKqz.exe
  2⤵
  PID:3432
- C:\Windows\System\OHaOSDd.exe
  C:\Windows\System\OHaOSDd.exe
  2⤵
  PID:3448
- C:\Windows\System\LBFFAzW.exe
  C:\Windows\System\LBFFAzW.exe
  2⤵
  PID:3468
- C:\Windows\System\cZPMmtC.exe
  C:\Windows\System\cZPMmtC.exe
  2⤵
  PID:3492
- C:\Windows\System\hYLMIfM.exe
  C:\Windows\System\hYLMIfM.exe
  2⤵
  PID:3512
- C:\Windows\System\EXYhzNO.exe
  C:\Windows\System\EXYhzNO.exe
  2⤵
  PID:3528
- C:\Windows\System\chAezvR.exe
  C:\Windows\System\chAezvR.exe
  2⤵
  PID:3556
- C:\Windows\System\MCYcjGe.exe
  C:\Windows\System\MCYcjGe.exe
  2⤵
  PID:3572
- C:\Windows\System\vqFafkf.exe
  C:\Windows\System\vqFafkf.exe
  2⤵
  PID:3596
- C:\Windows\System\SwAxtmO.exe
  C:\Windows\System\SwAxtmO.exe
  2⤵
  PID:3612
- C:\Windows\System\HdBCJBk.exe
  C:\Windows\System\HdBCJBk.exe
  2⤵
  PID:3636
- C:\Windows\System\XbxENwm.exe
  C:\Windows\System\XbxENwm.exe
  2⤵
  PID:3656
- C:\Windows\System\lnWNYPd.exe
  C:\Windows\System\lnWNYPd.exe
  2⤵
  PID:3672
- C:\Windows\System\xaVkXkR.exe
  C:\Windows\System\xaVkXkR.exe
  2⤵
  PID:3692
- C:\Windows\System\PCWcESP.exe
  C:\Windows\System\PCWcESP.exe
  2⤵
  PID:3716
- C:\Windows\System\tCGwyWj.exe
  C:\Windows\System\tCGwyWj.exe
  2⤵
  PID:3732
- C:\Windows\System\GcQhDqI.exe
  C:\Windows\System\GcQhDqI.exe
  2⤵
  PID:3752
- C:\Windows\System\elEHDEO.exe
  C:\Windows\System\elEHDEO.exe
  2⤵
  PID:3772
- C:\Windows\System\WlUVASv.exe
  C:\Windows\System\WlUVASv.exe
  2⤵
  PID:3792
- C:\Windows\System\vFifHcl.exe
  C:\Windows\System\vFifHcl.exe
  2⤵
  PID:3812
- C:\Windows\System\zXuagci.exe
  C:\Windows\System\zXuagci.exe
  2⤵
  PID:3828
- C:\Windows\System\MWhVNOa.exe
  C:\Windows\System\MWhVNOa.exe
  2⤵
  PID:3848
- C:\Windows\System\dPApLwU.exe
  C:\Windows\System\dPApLwU.exe
  2⤵
  PID:3864
- C:\Windows\System\QvWZxWv.exe
  C:\Windows\System\QvWZxWv.exe
  2⤵
  PID:3880
- C:\Windows\System\bhhXlHg.exe
  C:\Windows\System\bhhXlHg.exe
  2⤵
  PID:3896
- C:\Windows\System\UHrlpUu.exe
  C:\Windows\System\UHrlpUu.exe
  2⤵
  PID:3928
- C:\Windows\System\UlPxpks.exe
  C:\Windows\System\UlPxpks.exe
  2⤵
  PID:3948
- C:\Windows\System\yzcBxFS.exe
  C:\Windows\System\yzcBxFS.exe
  2⤵
  PID:3968
- C:\Windows\System\ZhZjZpa.exe
  C:\Windows\System\ZhZjZpa.exe
  2⤵
  PID:3984
- C:\Windows\System\cvKGTqM.exe
  C:\Windows\System\cvKGTqM.exe
  2⤵
  PID:4000
- C:\Windows\System\FyDBygS.exe
  C:\Windows\System\FyDBygS.exe
  2⤵
  PID:4020
- C:\Windows\System\BvLcpmN.exe
  C:\Windows\System\BvLcpmN.exe
  2⤵
  PID:4040
- C:\Windows\System\gEGYSAF.exe
  C:\Windows\System\gEGYSAF.exe
  2⤵
  PID:4056
- C:\Windows\System\KImiSvg.exe
  C:\Windows\System\KImiSvg.exe
  2⤵
  PID:4092
- C:\Windows\System\vOcRLAG.exe
  C:\Windows\System\vOcRLAG.exe
  2⤵
  PID:800
- C:\Windows\System\DmxmdSA.exe
  C:\Windows\System\DmxmdSA.exe
  2⤵
  PID:1944
- C:\Windows\System\sjZrOLu.exe
  C:\Windows\System\sjZrOLu.exe
  2⤵
  PID:1772
- C:\Windows\System\BMPApvT.exe
  C:\Windows\System\BMPApvT.exe
  2⤵
  PID:2788
- C:\Windows\System\sGExpLL.exe
  C:\Windows\System\sGExpLL.exe
  2⤵
  PID:3024
- C:\Windows\System\YatTicU.exe
  C:\Windows\System\YatTicU.exe
  2⤵
  PID:2420
- C:\Windows\System\bQshAgG.exe
  C:\Windows\System\bQshAgG.exe
  2⤵
  PID:2264
- C:\Windows\System\duHgOuo.exe
  C:\Windows\System\duHgOuo.exe
  2⤵
  PID:1792
- C:\Windows\System\jcIkndI.exe
  C:\Windows\System\jcIkndI.exe
  2⤵
  PID:2548
- C:\Windows\System\AYyDxZf.exe
  C:\Windows\System\AYyDxZf.exe
  2⤵
  PID:2640
- C:\Windows\System\WsvdNcr.exe
  C:\Windows\System\WsvdNcr.exe
  2⤵
  PID:2464
- C:\Windows\System\oSzIaaR.exe
  C:\Windows\System\oSzIaaR.exe
  2⤵
  PID:712
- C:\Windows\System\beEszvo.exe
  C:\Windows\System\beEszvo.exe
  2⤵
  PID:908
- C:\Windows\System\zmfLwsb.exe
  C:\Windows\System\zmfLwsb.exe
  2⤵
  PID:1976
- C:\Windows\System\bcljHUo.exe
  C:\Windows\System\bcljHUo.exe
  2⤵
  PID:1636
- C:\Windows\System\qqSCEWW.exe
  C:\Windows\System\qqSCEWW.exe
  2⤵
  PID:1856
- C:\Windows\System\XfNmdwH.exe
  C:\Windows\System\XfNmdwH.exe
  2⤵
  PID:3136
- C:\Windows\System\zeNVkWD.exe
  C:\Windows\System\zeNVkWD.exe
  2⤵
  PID:3076
- C:\Windows\System\uPSzMyN.exe
  C:\Windows\System\uPSzMyN.exe
  2⤵
  PID:3148
- C:\Windows\System\SnyUDBR.exe
  C:\Windows\System\SnyUDBR.exe
  2⤵
  PID:2192
- C:\Windows\System\micZjHd.exe
  C:\Windows\System\micZjHd.exe
  2⤵
  PID:3228
- C:\Windows\System\JeaaadQ.exe
  C:\Windows\System\JeaaadQ.exe
  2⤵
  PID:3248
- C:\Windows\System\JpaklWs.exe
  C:\Windows\System\JpaklWs.exe
  2⤵
  PID:3312
- C:\Windows\System\qWeDhtI.exe
  C:\Windows\System\qWeDhtI.exe
  2⤵
  PID:3348
- C:\Windows\System\YaydbOG.exe
  C:\Windows\System\YaydbOG.exe
  2⤵
  PID:3384
- C:\Windows\System\uADQhnV.exe
  C:\Windows\System\uADQhnV.exe
  2⤵
  PID:3404
- C:\Windows\System\TSgZMSi.exe
  C:\Windows\System\TSgZMSi.exe
  2⤵
  PID:3396
- C:\Windows\System\mPbsXTL.exe
  C:\Windows\System\mPbsXTL.exe
  2⤵
  PID:1064
- C:\Windows\System\cziYEns.exe
  C:\Windows\System\cziYEns.exe
  2⤵
  PID:3504
- C:\Windows\System\MVvddqg.exe
  C:\Windows\System\MVvddqg.exe
  2⤵
  PID:3552
- C:\Windows\System\bPJlFyi.exe
  C:\Windows\System\bPJlFyi.exe
  2⤵
  PID:3488
- C:\Windows\System\LXIJOSm.exe
  C:\Windows\System\LXIJOSm.exe
  2⤵
  PID:3584
- C:\Windows\System\WJLPnkg.exe
  C:\Windows\System\WJLPnkg.exe
  2⤵
  PID:3568
- C:\Windows\System\ejzLghe.exe
  C:\Windows\System\ejzLghe.exe
  2⤵
  PID:3632
- C:\Windows\System\ZTqBZRp.exe
  C:\Windows\System\ZTqBZRp.exe
  2⤵
  PID:3704
- C:\Windows\System\PiIPMkp.exe
  C:\Windows\System\PiIPMkp.exe
  2⤵
  PID:3748
- C:\Windows\System\FpdblpU.exe
  C:\Windows\System\FpdblpU.exe
  2⤵
  PID:3680
- C:\Windows\System\yIvBBrL.exe
  C:\Windows\System\yIvBBrL.exe
  2⤵
  PID:3760
- C:\Windows\System\PsabSIS.exe
  C:\Windows\System\PsabSIS.exe
  2⤵
  PID:3768
- C:\Windows\System\rPnqvpr.exe
  C:\Windows\System\rPnqvpr.exe
  2⤵
  PID:3856
- C:\Windows\System\LUfJvFi.exe
  C:\Windows\System\LUfJvFi.exe
  2⤵
  PID:3936
- C:\Windows\System\xYntYXI.exe
  C:\Windows\System\xYntYXI.exe
  2⤵
  PID:3836
- C:\Windows\System\IgowRxs.exe
  C:\Windows\System\IgowRxs.exe
  2⤵
  PID:3912
- C:\Windows\System\OSNZfgE.exe
  C:\Windows\System\OSNZfgE.exe
  2⤵
  PID:3940
- C:\Windows\System\lxYHhgK.exe
  C:\Windows\System\lxYHhgK.exe
  2⤵
  PID:3876
- C:\Windows\System\OtZOBhS.exe
  C:\Windows\System\OtZOBhS.exe
  2⤵
  PID:4048
- C:\Windows\System\KlYSfBw.exe
  C:\Windows\System\KlYSfBw.exe
  2⤵
  PID:4064
- C:\Windows\System\IdIZLME.exe
  C:\Windows\System\IdIZLME.exe
  2⤵
  PID:892
- C:\Windows\System\pNrPRLw.exe
  C:\Windows\System\pNrPRLw.exe
  2⤵
  PID:2872
- C:\Windows\System\VmaWXIw.exe
  C:\Windows\System\VmaWXIw.exe
  2⤵
  PID:1880
- C:\Windows\System\VhDaKGf.exe
  C:\Windows\System\VhDaKGf.exe
  2⤵
  PID:4084
- C:\Windows\System\dYkWXof.exe
  C:\Windows\System\dYkWXof.exe
  2⤵
  PID:2864
- C:\Windows\System\fiugNPb.exe
  C:\Windows\System\fiugNPb.exe
  2⤵
  PID:2736
- C:\Windows\System\aTuTFej.exe
  C:\Windows\System\aTuTFej.exe
  2⤵
  PID:2164
- C:\Windows\System\plhxgek.exe
  C:\Windows\System\plhxgek.exe
  2⤵
  PID:2496
- C:\Windows\System\ozJGzgk.exe
  C:\Windows\System\ozJGzgk.exe
  2⤵
  PID:1920
- C:\Windows\System\uVPNmRd.exe
  C:\Windows\System\uVPNmRd.exe
  2⤵
  PID:2776
- C:\Windows\System\DqVDmYq.exe
  C:\Windows\System\DqVDmYq.exe
  2⤵
  PID:2284
- C:\Windows\System\IVnEZpJ.exe
  C:\Windows\System\IVnEZpJ.exe
  2⤵
  PID:904
- C:\Windows\System\xvaHmGe.exe
  C:\Windows\System\xvaHmGe.exe
  2⤵
  PID:2412
- C:\Windows\System\aZQUQHT.exe
  C:\Windows\System\aZQUQHT.exe
  2⤵
  PID:2728
- C:\Windows\System\xXqqtTr.exe
  C:\Windows\System\xXqqtTr.exe
  2⤵
  PID:3224
- C:\Windows\System\xigprJR.exe
  C:\Windows\System\xigprJR.exe
  2⤵
  PID:3100
- C:\Windows\System\EZnRolP.exe
  C:\Windows\System\EZnRolP.exe
  2⤵
  PID:3120
- C:\Windows\System\oYVoZPD.exe
  C:\Windows\System\oYVoZPD.exe
  2⤵
  PID:2328
- C:\Windows\System\SBzRKRI.exe
  C:\Windows\System\SBzRKRI.exe
  2⤵
  PID:3304
- C:\Windows\System\IXVrdHl.exe
  C:\Windows\System\IXVrdHl.exe
  2⤵
  PID:3380
- C:\Windows\System\LKAgzTr.exe
  C:\Windows\System\LKAgzTr.exe
  2⤵
  PID:3500
- C:\Windows\System\aSONtDU.exe
  C:\Windows\System\aSONtDU.exe
  2⤵
  PID:3480
- C:\Windows\System\hKgtgyx.exe
  C:\Windows\System\hKgtgyx.exe
  2⤵
  PID:3288
- C:\Windows\System\pkUSmjQ.exe
  C:\Windows\System\pkUSmjQ.exe
  2⤵
  PID:3540
- C:\Windows\System\Csaerkm.exe
  C:\Windows\System\Csaerkm.exe
  2⤵
  PID:3668
- C:\Windows\System\ATueydq.exe
  C:\Windows\System\ATueydq.exe
  2⤵
  PID:2944
- C:\Windows\System\SMExWqr.exe
  C:\Windows\System\SMExWqr.exe
  2⤵
  PID:3544
- C:\Windows\System\zkUmita.exe
  C:\Windows\System\zkUmita.exe
  2⤵
  PID:3456
- C:\Windows\System\HEeJeqc.exe
  C:\Windows\System\HEeJeqc.exe
  2⤵
  PID:3764
- C:\Windows\System\UcZFABt.exe
  C:\Windows\System\UcZFABt.exe
  2⤵
  PID:1668
- C:\Windows\System\xfrEsNY.exe
  C:\Windows\System\xfrEsNY.exe
  2⤵
  PID:3904
- C:\Windows\System\bsmyoZV.exe
  C:\Windows\System\bsmyoZV.exe
  2⤵
  PID:4008
- C:\Windows\System\pnwzmzq.exe
  C:\Windows\System\pnwzmzq.exe
  2⤵
  PID:752
- C:\Windows\System\UBmUJTE.exe
  C:\Windows\System\UBmUJTE.exe
  2⤵
  PID:1788
- C:\Windows\System\GpnAwJG.exe
  C:\Windows\System\GpnAwJG.exe
  2⤵
  PID:2800
- C:\Windows\System\QepqLeU.exe
  C:\Windows\System\QepqLeU.exe
  2⤵
  PID:3524
- C:\Windows\System\sNefXsE.exe
  C:\Windows\System\sNefXsE.exe
  2⤵
  PID:2632
- C:\Windows\System\meDTwnr.exe
  C:\Windows\System\meDTwnr.exe
  2⤵
  PID:2688
- C:\Windows\System\WVqWThc.exe
  C:\Windows\System\WVqWThc.exe
  2⤵
  PID:3744
- C:\Windows\System\pzdqETH.exe
  C:\Windows\System\pzdqETH.exe
  2⤵
  PID:2592
- C:\Windows\System\xZTNrcD.exe
  C:\Windows\System\xZTNrcD.exe
  2⤵
  PID:3960
- C:\Windows\System\KOmKyXt.exe
  C:\Windows\System\KOmKyXt.exe
  2⤵
  PID:3920
- C:\Windows\System\XTxwYjb.exe
  C:\Windows\System\XTxwYjb.exe
  2⤵
  PID:3824
- C:\Windows\System\xZqgMWl.exe
  C:\Windows\System\xZqgMWl.exe
  2⤵
  PID:1916
- C:\Windows\System\AxTRpzA.exe
  C:\Windows\System\AxTRpzA.exe
  2⤵
  PID:4028
- C:\Windows\System\bJCYyaF.exe
  C:\Windows\System\bJCYyaF.exe
  2⤵
  PID:1396
- C:\Windows\System\aGfPXww.exe
  C:\Windows\System\aGfPXww.exe
  2⤵
  PID:4088
- C:\Windows\System\kFLkysz.exe
  C:\Windows\System\kFLkysz.exe
  2⤵
  PID:2188
- C:\Windows\System\hCuqtqM.exe
  C:\Windows\System\hCuqtqM.exe
  2⤵
  PID:2064
- C:\Windows\System\BGqDUiZ.exe
  C:\Windows\System\BGqDUiZ.exe
  2⤵
  PID:3996
- C:\Windows\System\kYkTkLG.exe
  C:\Windows\System\kYkTkLG.exe
  2⤵
  PID:2356
- C:\Windows\System\OQQsCjj.exe
  C:\Windows\System\OQQsCjj.exe
  2⤵
  PID:1804
- C:\Windows\System\mwBjnsL.exe
  C:\Windows\System\mwBjnsL.exe
  2⤵
  PID:3084
- C:\Windows\System\YqkqQsE.exe
  C:\Windows\System\YqkqQsE.exe
  2⤵
  PID:3116
- C:\Windows\System\KMGkXcA.exe
  C:\Windows\System\KMGkXcA.exe
  2⤵
  PID:3144
- C:\Windows\System\raljvCT.exe
  C:\Windows\System\raljvCT.exe
  2⤵
  PID:3300
- C:\Windows\System\uMOVcvt.exe
  C:\Windows\System\uMOVcvt.exe
  2⤵
  PID:2472
- C:\Windows\System\kyWFjCu.exe
  C:\Windows\System\kyWFjCu.exe
  2⤵
  PID:3624
- C:\Windows\System\PsySqgp.exe
  C:\Windows\System\PsySqgp.exe
  2⤵
  PID:1844
- C:\Windows\System\wQGGzOR.exe
  C:\Windows\System\wQGGzOR.exe
  2⤵
  PID:2500
- C:\Windows\System\DhiLSPO.exe
  C:\Windows\System\DhiLSPO.exe
  2⤵
  PID:3844
- C:\Windows\System\RGBWyez.exe
  C:\Windows\System\RGBWyez.exe
  2⤵
  PID:2768
- C:\Windows\System\puvbTUe.exe
  C:\Windows\System\puvbTUe.exe
  2⤵
  PID:1692
- C:\Windows\System\aCNEmHT.exe
  C:\Windows\System\aCNEmHT.exe
  2⤵
  PID:2004
- C:\Windows\System\FyvxGXe.exe
  C:\Windows\System\FyvxGXe.exe
  2⤵
  PID:3240
- C:\Windows\System\kpvqNJM.exe
  C:\Windows\System\kpvqNJM.exe
  2⤵
  PID:3268
- C:\Windows\System\nHwFiyG.exe
  C:\Windows\System\nHwFiyG.exe
  2⤵
  PID:3340
- C:\Windows\System\wpfEXUd.exe
  C:\Windows\System\wpfEXUd.exe
  2⤵
  PID:3980
- C:\Windows\System\HWwPYwL.exe
  C:\Windows\System\HWwPYwL.exe
  2⤵
  PID:3520
- C:\Windows\System\jLfarZb.exe
  C:\Windows\System\jLfarZb.exe
  2⤵
  PID:2704
- C:\Windows\System\iJtYiec.exe
  C:\Windows\System\iJtYiec.exe
  2⤵
  PID:2400
- C:\Windows\System\DtijWKq.exe
  C:\Windows\System\DtijWKq.exe
  2⤵
  PID:2416
- C:\Windows\System\NYONKno.exe
  C:\Windows\System\NYONKno.exe
  2⤵
  PID:2184
- C:\Windows\System\YgDlWAO.exe
  C:\Windows\System\YgDlWAO.exe
  2⤵
  PID:2596
- C:\Windows\System\EKDOBYc.exe
  C:\Windows\System\EKDOBYc.exe
  2⤵
  PID:3104
- C:\Windows\System\Nvtsphk.exe
  C:\Windows\System\Nvtsphk.exe
  2⤵
  PID:3788
- C:\Windows\System\VDAsPJu.exe
  C:\Windows\System\VDAsPJu.exe
  2⤵
  PID:3804
- C:\Windows\System\hOICXHx.exe
  C:\Windows\System\hOICXHx.exe
  2⤵
  PID:2616
- C:\Windows\System\UOQcWPy.exe
  C:\Windows\System\UOQcWPy.exe
  2⤵
  PID:1268
- C:\Windows\System\TfeXNQg.exe
  C:\Windows\System\TfeXNQg.exe
  2⤵
  PID:2908
- C:\Windows\System\rUSGSqw.exe
  C:\Windows\System\rUSGSqw.exe
  2⤵
  PID:3464
- C:\Windows\System\JSDMtQc.exe
  C:\Windows\System\JSDMtQc.exe
  2⤵
  PID:3728
- C:\Windows\System\GUOmGSr.exe
  C:\Windows\System\GUOmGSr.exe
  2⤵
  PID:1056
- C:\Windows\System\HMRmIvq.exe
  C:\Windows\System\HMRmIvq.exe
  2⤵
  PID:2140
- C:\Windows\System\eFpWQUP.exe
  C:\Windows\System\eFpWQUP.exe
  2⤵
  PID:2492
- C:\Windows\System\SdTMpAT.exe
  C:\Windows\System\SdTMpAT.exe
  2⤵
  PID:4104
- C:\Windows\System\oECWmKn.exe
  C:\Windows\System\oECWmKn.exe
  2⤵
  PID:4120
- C:\Windows\System\vjSjqYN.exe
  C:\Windows\System\vjSjqYN.exe
  2⤵
  PID:4136
- C:\Windows\System\UbMrZes.exe
  C:\Windows\System\UbMrZes.exe
  2⤵
  PID:4152
- C:\Windows\System\ZKWQHnU.exe
  C:\Windows\System\ZKWQHnU.exe
  2⤵
  PID:4168
- C:\Windows\System\YdENNcd.exe
  C:\Windows\System\YdENNcd.exe
  2⤵
  PID:4184
- C:\Windows\System\jHNNUuX.exe
  C:\Windows\System\jHNNUuX.exe
  2⤵
  PID:4200
- C:\Windows\System\qiqjQrx.exe
  C:\Windows\System\qiqjQrx.exe
  2⤵
  PID:4216
- C:\Windows\System\gnmBlXS.exe
  C:\Windows\System\gnmBlXS.exe
  2⤵
  PID:4232
- C:\Windows\System\RQXgtqD.exe
  C:\Windows\System\RQXgtqD.exe
  2⤵
  PID:4248
- C:\Windows\System\PRTeITq.exe
  C:\Windows\System\PRTeITq.exe
  2⤵
  PID:4264
- C:\Windows\System\PGlTAsj.exe
  C:\Windows\System\PGlTAsj.exe
  2⤵
  PID:4280
- C:\Windows\System\puUncVn.exe
  C:\Windows\System\puUncVn.exe
  2⤵
  PID:4296
- C:\Windows\System\WMPceqY.exe
  C:\Windows\System\WMPceqY.exe
  2⤵
  PID:4312
- C:\Windows\System\ADSriRh.exe
  C:\Windows\System\ADSriRh.exe
  2⤵
  PID:4328
- C:\Windows\System\eyTnQJV.exe
  C:\Windows\System\eyTnQJV.exe
  2⤵
  PID:4344
- C:\Windows\System\bIaIwQl.exe
  C:\Windows\System\bIaIwQl.exe
  2⤵
  PID:4360
- C:\Windows\System\NCwwclJ.exe
  C:\Windows\System\NCwwclJ.exe
  2⤵
  PID:4376
- C:\Windows\System\lklcEzB.exe
  C:\Windows\System\lklcEzB.exe
  2⤵
  PID:4392
- C:\Windows\System\ulkSyfj.exe
  C:\Windows\System\ulkSyfj.exe
  2⤵
  PID:4408
- C:\Windows\System\gZPcDPj.exe
  C:\Windows\System\gZPcDPj.exe
  2⤵
  PID:4424
- C:\Windows\System\MWwmUIv.exe
  C:\Windows\System\MWwmUIv.exe
  2⤵
  PID:4440
- C:\Windows\System\laABBem.exe
  C:\Windows\System\laABBem.exe
  2⤵
  PID:4456
- C:\Windows\System\EGfTBQA.exe
  C:\Windows\System\EGfTBQA.exe
  2⤵
  PID:4472
- C:\Windows\System\RpCndpA.exe
  C:\Windows\System\RpCndpA.exe
  2⤵
  PID:4488
- C:\Windows\System\RtbIuzB.exe
  C:\Windows\System\RtbIuzB.exe
  2⤵
  PID:4504
- C:\Windows\System\RSedyUo.exe
  C:\Windows\System\RSedyUo.exe
  2⤵
  PID:4520
- C:\Windows\System\myzTllf.exe
  C:\Windows\System\myzTllf.exe
  2⤵
  PID:4536
- C:\Windows\System\YhPrTJl.exe
  C:\Windows\System\YhPrTJl.exe
  2⤵
  PID:4552
- C:\Windows\System\KdCUnKo.exe
  C:\Windows\System\KdCUnKo.exe
  2⤵
  PID:4568
- C:\Windows\System\mqterAq.exe
  C:\Windows\System\mqterAq.exe
  2⤵
  PID:4584
- C:\Windows\System\UXoWZPg.exe
  C:\Windows\System\UXoWZPg.exe
  2⤵
  PID:4600
- C:\Windows\System\ptDnaWd.exe
  C:\Windows\System\ptDnaWd.exe
  2⤵
  PID:4616
- C:\Windows\System\sZjmRFP.exe
  C:\Windows\System\sZjmRFP.exe
  2⤵
  PID:4632
- C:\Windows\System\HXhNOuU.exe
  C:\Windows\System\HXhNOuU.exe
  2⤵
  PID:4648
- C:\Windows\System\vuDQuJY.exe
  C:\Windows\System\vuDQuJY.exe
  2⤵
  PID:4664
- C:\Windows\System\VxyZiBe.exe
  C:\Windows\System\VxyZiBe.exe
  2⤵
  PID:4680
- C:\Windows\System\hlfTeHB.exe
  C:\Windows\System\hlfTeHB.exe
  2⤵
  PID:4696
- C:\Windows\System\LtSzMaG.exe
  C:\Windows\System\LtSzMaG.exe
  2⤵
  PID:4712
- C:\Windows\System\UlJyXuv.exe
  C:\Windows\System\UlJyXuv.exe
  2⤵
  PID:4728
- C:\Windows\System\YIZSQQd.exe
  C:\Windows\System\YIZSQQd.exe
  2⤵
  PID:4744
- C:\Windows\System\mRAmSWw.exe
  C:\Windows\System\mRAmSWw.exe
  2⤵
  PID:4760
- C:\Windows\System\PqcKzGC.exe
  C:\Windows\System\PqcKzGC.exe
  2⤵
  PID:4776
- C:\Windows\System\zCGYKGJ.exe
  C:\Windows\System\zCGYKGJ.exe
  2⤵
  PID:4792
- C:\Windows\System\DJLdjxr.exe
  C:\Windows\System\DJLdjxr.exe
  2⤵
  PID:4808
- C:\Windows\System\dYuRjWT.exe
  C:\Windows\System\dYuRjWT.exe
  2⤵
  PID:4824
- C:\Windows\System\drGUkxY.exe
  C:\Windows\System\drGUkxY.exe
  2⤵
  PID:4840
- C:\Windows\System\JHqlPSS.exe
  C:\Windows\System\JHqlPSS.exe
  2⤵
  PID:4856
- C:\Windows\System\hNUKmXd.exe
  C:\Windows\System\hNUKmXd.exe
  2⤵
  PID:4872
- C:\Windows\System\EMHonqR.exe
  C:\Windows\System\EMHonqR.exe
  2⤵
  PID:4888
- C:\Windows\System\NoBpyon.exe
  C:\Windows\System\NoBpyon.exe
  2⤵
  PID:4904
- C:\Windows\System\NXSjIRU.exe
  C:\Windows\System\NXSjIRU.exe
  2⤵
  PID:4920
- C:\Windows\System\CghBosZ.exe
  C:\Windows\System\CghBosZ.exe
  2⤵
  PID:4936
- C:\Windows\System\Zxfmzmy.exe
  C:\Windows\System\Zxfmzmy.exe
  2⤵
  PID:4952
- C:\Windows\System\IiSCmVt.exe
  C:\Windows\System\IiSCmVt.exe
  2⤵
  PID:4968
- C:\Windows\System\HePRHxS.exe
  C:\Windows\System\HePRHxS.exe
  2⤵
  PID:4984
- C:\Windows\System\dJfuhxJ.exe
  C:\Windows\System\dJfuhxJ.exe
  2⤵
  PID:5000
- C:\Windows\System\FFUrvTm.exe
  C:\Windows\System\FFUrvTm.exe
  2⤵
  PID:5016
- C:\Windows\System\MRaRlNC.exe
  C:\Windows\System\MRaRlNC.exe
  2⤵
  PID:5032
- C:\Windows\System\NtQpcLa.exe
  C:\Windows\System\NtQpcLa.exe
  2⤵
  PID:5048
- C:\Windows\System\WPOwTqU.exe
  C:\Windows\System\WPOwTqU.exe
  2⤵
  PID:5064
- C:\Windows\System\yLPbfQR.exe
  C:\Windows\System\yLPbfQR.exe
  2⤵
  PID:5080
- C:\Windows\System\wLEjouk.exe
  C:\Windows\System\wLEjouk.exe
  2⤵
  PID:5096
- C:\Windows\System\NiggOwy.exe
  C:\Windows\System\NiggOwy.exe
  2⤵
  PID:4128
- C:\Windows\System\QcHlCPb.exe
  C:\Windows\System\QcHlCPb.exe
  2⤵
  PID:568
- C:\Windows\System\pgzxAPP.exe
  C:\Windows\System\pgzxAPP.exe
  2⤵
  PID:4164
- C:\Windows\System\NKMZMbB.exe
  C:\Windows\System\NKMZMbB.exe
  2⤵
  PID:3648
- C:\Windows\System\MxoHmMo.exe
  C:\Windows\System\MxoHmMo.exe
  2⤵
  PID:2928
- C:\Windows\System\uEbqfTB.exe
  C:\Windows\System\uEbqfTB.exe
  2⤵
  PID:4144
- C:\Windows\System\XclxKvf.exe
  C:\Windows\System\XclxKvf.exe
  2⤵
  PID:4176
- C:\Windows\System\BntbtOq.exe
  C:\Windows\System\BntbtOq.exe
  2⤵
  PID:4208
- C:\Windows\System\xfzuYNy.exe
  C:\Windows\System\xfzuYNy.exe
  2⤵
  PID:4272
- C:\Windows\System\RFWLqFt.exe
  C:\Windows\System\RFWLqFt.exe
  2⤵
  PID:4292
- C:\Windows\System\UzmOOSw.exe
  C:\Windows\System\UzmOOSw.exe
  2⤵
  PID:4352
- C:\Windows\System\wBSvGnG.exe
  C:\Windows\System\wBSvGnG.exe
  2⤵
  PID:4512
- C:\Windows\System\yehdqVZ.exe
  C:\Windows\System\yehdqVZ.exe
  2⤵
  PID:4420
- C:\Windows\System\egEDZny.exe
  C:\Windows\System\egEDZny.exe
  2⤵
  PID:4372
- C:\Windows\System\yzsQOFx.exe
  C:\Windows\System\yzsQOFx.exe
  2⤵
  PID:4436
- C:\Windows\System\DlajVlr.exe
  C:\Windows\System\DlajVlr.exe
  2⤵
  PID:4500
- C:\Windows\System\wvJTYIK.exe
  C:\Windows\System\wvJTYIK.exe
  2⤵
  PID:4564
- C:\Windows\System\mrMQJLx.exe
  C:\Windows\System\mrMQJLx.exe
  2⤵
  PID:4628
- C:\Windows\System\rwCZpAU.exe
  C:\Windows\System\rwCZpAU.exe
  2⤵
  PID:4692
- C:\Windows\System\RBujfQi.exe
  C:\Windows\System\RBujfQi.exe
  2⤵
  PID:4756
- C:\Windows\System\lKIFFyg.exe
  C:\Windows\System\lKIFFyg.exe
  2⤵
  PID:4820
- C:\Windows\System\uIFHeXQ.exe
  C:\Windows\System\uIFHeXQ.exe
  2⤵
  PID:4452
- C:\Windows\System\pZkoubS.exe
  C:\Windows\System\pZkoubS.exe
  2⤵
  PID:4548
- C:\Windows\System\nwZkhpH.exe
  C:\Windows\System\nwZkhpH.exe
  2⤵
  PID:4836
- C:\Windows\System\HHAhMUw.exe
  C:\Windows\System\HHAhMUw.exe
  2⤵
  PID:4640
- C:\Windows\System\VnYdLPo.exe
  C:\Windows\System\VnYdLPo.exe
  2⤵
  PID:4708
- C:\Windows\System\vWhHhlv.exe
  C:\Windows\System\vWhHhlv.exe
  2⤵
  PID:4800
- C:\Windows\System\jfGBTxj.exe
  C:\Windows\System\jfGBTxj.exe
  2⤵
  PID:4944
- C:\Windows\System\lzCVZow.exe
  C:\Windows\System\lzCVZow.exe
  2⤵
  PID:4880
- C:\Windows\System\EEFohLx.exe
  C:\Windows\System\EEFohLx.exe
  2⤵
  PID:5012
- C:\Windows\System\MlBifzi.exe
  C:\Windows\System\MlBifzi.exe
  2⤵
  PID:4900
- C:\Windows\System\IRJrFly.exe
  C:\Windows\System\IRJrFly.exe
  2⤵
  PID:4964
- C:\Windows\System\zwTjsHt.exe
  C:\Windows\System\zwTjsHt.exe
  2⤵
  PID:5044
- C:\Windows\System\YalgpoI.exe
  C:\Windows\System\YalgpoI.exe
  2⤵
  PID:5092
- C:\Windows\System\MrULfRb.exe
  C:\Windows\System\MrULfRb.exe
  2⤵
  PID:2152
- C:\Windows\System\rcqzYbc.exe
  C:\Windows\System\rcqzYbc.exe
  2⤵
  PID:3892
- C:\Windows\System\vycZnKU.exe
  C:\Windows\System\vycZnKU.exe
  2⤵
  PID:2300
- C:\Windows\System\izgOyhc.exe
  C:\Windows\System\izgOyhc.exe
  2⤵
  PID:4256
- C:\Windows\System\QwQRQQQ.exe
  C:\Windows\System\QwQRQQQ.exe
  2⤵
  PID:4132
- C:\Windows\System\EwxGWWF.exe
  C:\Windows\System\EwxGWWF.exe
  2⤵
  PID:4320
- C:\Windows\System\ZsNtyQD.exe
  C:\Windows\System\ZsNtyQD.exe
  2⤵
  PID:4416
- C:\Windows\System\osEihuV.exe
  C:\Windows\System\osEihuV.exe
  2⤵
  PID:4560
- C:\Windows\System\iVEwFcb.exe
  C:\Windows\System\iVEwFcb.exe
  2⤵
  PID:4660
- C:\Windows\System\XOjpGfT.exe
  C:\Windows\System\XOjpGfT.exe
  2⤵
  PID:4468
- C:\Windows\System\IvANuRy.exe
  C:\Windows\System\IvANuRy.exe
  2⤵
  PID:4752
- C:\Windows\System\zIhdTXV.exe
  C:\Windows\System\zIhdTXV.exe
  2⤵
  PID:4448
- C:\Windows\System\LYFJSfA.exe
  C:\Windows\System\LYFJSfA.exe
  2⤵
  PID:4736
- C:\Windows\System\dagkKeh.exe
  C:\Windows\System\dagkKeh.exe
  2⤵
  PID:4772
- C:\Windows\System\DnBcIOZ.exe
  C:\Windows\System\DnBcIOZ.exe
  2⤵
  PID:5136
- C:\Windows\System\mpnFIVb.exe
  C:\Windows\System\mpnFIVb.exe
  2⤵
  PID:5152
- C:\Windows\System\RZZDEZM.exe
  C:\Windows\System\RZZDEZM.exe
  2⤵
  PID:5168
- C:\Windows\System\jeUkYsM.exe
  C:\Windows\System\jeUkYsM.exe
  2⤵
  PID:5184
- C:\Windows\System\DbpsXwu.exe
  C:\Windows\System\DbpsXwu.exe
  2⤵
  PID:5200
- C:\Windows\System\krkKcpH.exe
  C:\Windows\System\krkKcpH.exe
  2⤵
  PID:5216
- C:\Windows\System\XTISaOr.exe
  C:\Windows\System\XTISaOr.exe
  2⤵
  PID:5232
- C:\Windows\System\affLTkP.exe
  C:\Windows\System\affLTkP.exe
  2⤵
  PID:5248
- C:\Windows\System\MBfognB.exe
  C:\Windows\System\MBfognB.exe
  2⤵
  PID:5264
- C:\Windows\System\AClFTQd.exe
  C:\Windows\System\AClFTQd.exe
  2⤵
  PID:5280
- C:\Windows\System\sHcOYHC.exe
  C:\Windows\System\sHcOYHC.exe
  2⤵
  PID:5296
- C:\Windows\System\GSfwQDv.exe
  C:\Windows\System\GSfwQDv.exe
  2⤵
  PID:5312
- C:\Windows\System\JzprKXZ.exe
  C:\Windows\System\JzprKXZ.exe
  2⤵
  PID:5328
- C:\Windows\System\QtSVADH.exe
  C:\Windows\System\QtSVADH.exe
  2⤵
  PID:5344
- C:\Windows\System\SRAAXMG.exe
  C:\Windows\System\SRAAXMG.exe
  2⤵
  PID:5360
- C:\Windows\System\HoiXjBu.exe
  C:\Windows\System\HoiXjBu.exe
  2⤵
  PID:5376
- C:\Windows\System\gUIXfQQ.exe
  C:\Windows\System\gUIXfQQ.exe
  2⤵
  PID:5392
- C:\Windows\System\UmbQmzk.exe
  C:\Windows\System\UmbQmzk.exe
  2⤵
  PID:5408
- C:\Windows\System\USfkqnP.exe
  C:\Windows\System\USfkqnP.exe
  2⤵
  PID:5424
- C:\Windows\System\kQMPBzQ.exe
  C:\Windows\System\kQMPBzQ.exe
  2⤵
  PID:5440
- C:\Windows\System\XHJdolV.exe
  C:\Windows\System\XHJdolV.exe
  2⤵
  PID:5456
- C:\Windows\System\nCpSwkq.exe
  C:\Windows\System\nCpSwkq.exe
  2⤵
  PID:5472
- C:\Windows\System\pgzVhEM.exe
  C:\Windows\System\pgzVhEM.exe
  2⤵
  PID:5488
- C:\Windows\System\psgEnmV.exe
  C:\Windows\System\psgEnmV.exe
  2⤵
  PID:5504
- C:\Windows\System\dHmKiqB.exe
  C:\Windows\System\dHmKiqB.exe
  2⤵
  PID:5520
- C:\Windows\System\pLBjMCR.exe
  C:\Windows\System\pLBjMCR.exe
  2⤵
  PID:5536
- C:\Windows\System\UsfgPWd.exe
  C:\Windows\System\UsfgPWd.exe
  2⤵
  PID:5552
- C:\Windows\System\gtOMGJx.exe
  C:\Windows\System\gtOMGJx.exe
  2⤵
  PID:5568
- C:\Windows\System\AMRisGM.exe
  C:\Windows\System\AMRisGM.exe
  2⤵
  PID:5584
- C:\Windows\System\IRorIcI.exe
  C:\Windows\System\IRorIcI.exe
  2⤵
  PID:5600
- C:\Windows\System\iZiFgVJ.exe
  C:\Windows\System\iZiFgVJ.exe
  2⤵
  PID:5616
- C:\Windows\System\rhOWxHS.exe
  C:\Windows\System\rhOWxHS.exe
  2⤵
  PID:5632
- C:\Windows\System\OjEkaEi.exe
  C:\Windows\System\OjEkaEi.exe
  2⤵
  PID:5648
- C:\Windows\System\MgxOVLD.exe
  C:\Windows\System\MgxOVLD.exe
  2⤵
  PID:5664
- C:\Windows\System\KoXJWDX.exe
  C:\Windows\System\KoXJWDX.exe
  2⤵
  PID:5680
- C:\Windows\System\aJMSsuO.exe
  C:\Windows\System\aJMSsuO.exe
  2⤵
  PID:5696
- C:\Windows\System\GumvvQu.exe
  C:\Windows\System\GumvvQu.exe
  2⤵
  PID:5712
- C:\Windows\System\QnYrnWk.exe
  C:\Windows\System\QnYrnWk.exe
  2⤵
  PID:5728
- C:\Windows\System\iYKyvAZ.exe
  C:\Windows\System\iYKyvAZ.exe
  2⤵
  PID:5744
- C:\Windows\System\oEkmSQV.exe
  C:\Windows\System\oEkmSQV.exe
  2⤵
  PID:5760
- C:\Windows\System\WoPDgoC.exe
  C:\Windows\System\WoPDgoC.exe
  2⤵
  PID:5776
- C:\Windows\System\faKRJeF.exe
  C:\Windows\System\faKRJeF.exe
  2⤵
  PID:5792
- C:\Windows\System\zEftMfn.exe
  C:\Windows\System\zEftMfn.exe
  2⤵
  PID:5808
- C:\Windows\System\FkYrLUS.exe
  C:\Windows\System\FkYrLUS.exe
  2⤵
  PID:5824
- C:\Windows\System\mqVDduN.exe
  C:\Windows\System\mqVDduN.exe
  2⤵
  PID:5840
- C:\Windows\System\nrLJcmI.exe
  C:\Windows\System\nrLJcmI.exe
  2⤵
  PID:5856
- C:\Windows\System\uSZjGCq.exe
  C:\Windows\System\uSZjGCq.exe
  2⤵
  PID:5872
- C:\Windows\System\wLFCLGg.exe
  C:\Windows\System\wLFCLGg.exe
  2⤵
  PID:5888
- C:\Windows\System\SCMIict.exe
  C:\Windows\System\SCMIict.exe
  2⤵
  PID:5904
- C:\Windows\System\VElibhD.exe
  C:\Windows\System\VElibhD.exe
  2⤵
  PID:5920
- C:\Windows\System\KEfHFpn.exe
  C:\Windows\System\KEfHFpn.exe
  2⤵
  PID:5936
- C:\Windows\System\bUJtXGT.exe
  C:\Windows\System\bUJtXGT.exe
  2⤵
  PID:5952
- C:\Windows\System\EMnUFTG.exe
  C:\Windows\System\EMnUFTG.exe
  2⤵
  PID:5968
- C:\Windows\System\ENWclne.exe
  C:\Windows\System\ENWclne.exe
  2⤵
  PID:5984
- C:\Windows\System\CMvoMiS.exe
  C:\Windows\System\CMvoMiS.exe
  2⤵
  PID:6000
- C:\Windows\System\jIMQomV.exe
  C:\Windows\System\jIMQomV.exe
  2⤵
  PID:6016
- C:\Windows\System\XGexLTW.exe
  C:\Windows\System\XGexLTW.exe
  2⤵
  PID:6032
- C:\Windows\System\bGHAzLR.exe
  C:\Windows\System\bGHAzLR.exe
  2⤵
  PID:6048
- C:\Windows\System\nCTRUKq.exe
  C:\Windows\System\nCTRUKq.exe
  2⤵
  PID:6064
- C:\Windows\System\wqMQbRY.exe
  C:\Windows\System\wqMQbRY.exe
  2⤵
  PID:6080
- C:\Windows\System\CdICObA.exe
  C:\Windows\System\CdICObA.exe
  2⤵
  PID:6096
- C:\Windows\System\yHUVBKD.exe
  C:\Windows\System\yHUVBKD.exe
  2⤵
  PID:6112
- C:\Windows\System\hAKSbiT.exe
  C:\Windows\System\hAKSbiT.exe
  2⤵
  PID:6128
- C:\Windows\System\ujdCDrj.exe
  C:\Windows\System\ujdCDrj.exe
  2⤵
  PID:4532
- C:\Windows\System\tvATvLy.exe
  C:\Windows\System\tvATvLy.exe
  2⤵
  PID:4932
- C:\Windows\System\sHWTTOD.exe
  C:\Windows\System\sHWTTOD.exe
  2⤵
  PID:4116
- C:\Windows\System\XAdAOjt.exe
  C:\Windows\System\XAdAOjt.exe
  2⤵
  PID:4916
- C:\Windows\System\ypFYgVk.exe
  C:\Windows\System\ypFYgVk.exe
  2⤵
  PID:5060
- C:\Windows\System\ERsviGU.exe
  C:\Windows\System\ERsviGU.exe
  2⤵
  PID:4868
- C:\Windows\System\WJkQOlV.exe
  C:\Windows\System\WJkQOlV.exe
  2⤵
  PID:4596
- C:\Windows\System\sCWTkcY.exe
  C:\Windows\System\sCWTkcY.exe
  2⤵
  PID:4612
- C:\Windows\System\SmGaALO.exe
  C:\Windows\System\SmGaALO.exe
  2⤵
  PID:5176
- C:\Windows\System\lTozALn.exe
  C:\Windows\System\lTozALn.exe
  2⤵
  PID:5244
- C:\Windows\System\qUOHKWz.exe
  C:\Windows\System\qUOHKWz.exe
  2⤵
  PID:4340
- C:\Windows\System\ROMzhHZ.exe
  C:\Windows\System\ROMzhHZ.exe
  2⤵
  PID:5128
- C:\Windows\System\TiBoEaA.exe
  C:\Windows\System\TiBoEaA.exe
  2⤵
  PID:5196
- C:\Windows\System\obOgYrl.exe
  C:\Windows\System\obOgYrl.exe
  2⤵
  PID:5076
- C:\Windows\System\tFAfSom.exe
  C:\Windows\System\tFAfSom.exe
  2⤵
  PID:4196
- C:\Windows\System\SjjjkBe.exe
  C:\Windows\System\SjjjkBe.exe
  2⤵
  PID:4704
- C:\Windows\System\gifiHYO.exe
  C:\Windows\System\gifiHYO.exe
  2⤵
  PID:5320
- C:\Windows\System\bZBepzW.exe
  C:\Windows\System\bZBepzW.exe
  2⤵
  PID:5384
- C:\Windows\System\yxRmPKu.exe
  C:\Windows\System\yxRmPKu.exe
  2⤵
  PID:5448
- C:\Windows\System\FFSEEXA.exe
  C:\Windows\System\FFSEEXA.exe
  2⤵
  PID:5512
- C:\Windows\System\WnVmzIv.exe
  C:\Windows\System\WnVmzIv.exe
  2⤵
  PID:5576
- C:\Windows\System\QosqySL.exe
  C:\Windows\System\QosqySL.exe
  2⤵
  PID:5640
- C:\Windows\System\wjgyEyR.exe
  C:\Windows\System\wjgyEyR.exe
  2⤵
  PID:5276
- C:\Windows\System\TveCWbA.exe
  C:\Windows\System\TveCWbA.exe
  2⤵
  PID:5340
- C:\Windows\System\LzCDBmx.exe
  C:\Windows\System\LzCDBmx.exe
  2⤵
  PID:5404
- C:\Windows\System\ogJCawE.exe
  C:\Windows\System\ogJCawE.exe
  2⤵
  PID:5496
- C:\Windows\System\CsnfVDd.exe
  C:\Windows\System\CsnfVDd.exe
  2⤵
  PID:5564
- C:\Windows\System\vrQDkVb.exe
  C:\Windows\System\vrQDkVb.exe
  2⤵
  PID:5628
- C:\Windows\System\tcMusoP.exe
  C:\Windows\System\tcMusoP.exe
  2⤵
  PID:5692
- C:\Windows\System\XTrhmOF.exe
  C:\Windows\System\XTrhmOF.exe
  2⤵
  PID:5292
- C:\Windows\System\JFGsZul.exe
  C:\Windows\System\JFGsZul.exe
  2⤵
  PID:5756
- C:\Windows\System\KjBmAjo.exe
  C:\Windows\System\KjBmAjo.exe
  2⤵
  PID:5816
- C:\Windows\System\yfFfxCu.exe
  C:\Windows\System\yfFfxCu.exe
  2⤵
  PID:5740
- C:\Windows\System\cfxRfeh.exe
  C:\Windows\System\cfxRfeh.exe
  2⤵
  PID:5800
- C:\Windows\System\cahDueR.exe
  C:\Windows\System\cahDueR.exe
  2⤵
  PID:5912
- C:\Windows\System\YNXHHaI.exe
  C:\Windows\System\YNXHHaI.exe
  2⤵
  PID:5916
- C:\Windows\System\WBTOTCl.exe
  C:\Windows\System\WBTOTCl.exe
  2⤵
  PID:6008
- C:\Windows\System\tOgYqth.exe
  C:\Windows\System\tOgYqth.exe
  2⤵
  PID:6012
- C:\Windows\System\zxxrGWj.exe
  C:\Windows\System\zxxrGWj.exe
  2⤵
  PID:6104
- C:\Windows\System\sKseyWP.exe
  C:\Windows\System\sKseyWP.exe
  2⤵
  PID:4976
- C:\Windows\System\jpzLnXt.exe
  C:\Windows\System\jpzLnXt.exe
  2⤵
  PID:5928
- C:\Windows\System\tEDqXGw.exe
  C:\Windows\System\tEDqXGw.exe
  2⤵
  PID:6056
- C:\Windows\System\rzTYQjz.exe
  C:\Windows\System\rzTYQjz.exe
  2⤵
  PID:5900
- C:\Windows\System\SYzBvMX.exe
  C:\Windows\System\SYzBvMX.exe
  2⤵
  PID:5992
- C:\Windows\System\GYOhYtI.exe
  C:\Windows\System\GYOhYtI.exe
  2⤵
  PID:4896
- C:\Windows\System\erMjhcc.exe
  C:\Windows\System\erMjhcc.exe
  2⤵
  PID:4112
- C:\Windows\System\nKvLqaJ.exe
  C:\Windows\System\nKvLqaJ.exe
  2⤵
  PID:5240
- C:\Windows\System\UlKmPme.exe
  C:\Windows\System\UlKmPme.exe
  2⤵
  PID:5024
- C:\Windows\System\CqPYUKK.exe
  C:\Windows\System\CqPYUKK.exe
  2⤵
  PID:5356
- C:\Windows\System\uPRVKgz.exe
  C:\Windows\System\uPRVKgz.exe
  2⤵
  PID:4160
- C:\Windows\System\oYpcyOT.exe
  C:\Windows\System\oYpcyOT.exe
  2⤵
  PID:4240
- C:\Windows\System\iNKNUIe.exe
  C:\Windows\System\iNKNUIe.exe
  2⤵
  PID:5192
- C:\Windows\System\UowJFOB.exe
  C:\Windows\System\UowJFOB.exe
  2⤵
  PID:5288
- C:\Windows\System\IHyqPMU.exe
  C:\Windows\System\IHyqPMU.exe
  2⤵
  PID:5548
- C:\Windows\System\Nyuapqr.exe
  C:\Windows\System\Nyuapqr.exe
  2⤵
  PID:5336
- C:\Windows\System\xKSDbZk.exe
  C:\Windows\System\xKSDbZk.exe
  2⤵
  PID:5624
- C:\Windows\System\wGSxeOe.exe
  C:\Windows\System\wGSxeOe.exe
  2⤵
  PID:5788
- C:\Windows\System\IoANysg.exe
  C:\Windows\System\IoANysg.exe
  2⤵
  PID:5772
- C:\Windows\System\zNpgEDe.exe
  C:\Windows\System\zNpgEDe.exe
  2⤵
  PID:6136
- C:\Windows\System\LKGYzrf.exe
  C:\Windows\System\LKGYzrf.exe
  2⤵
  PID:5272
- C:\Windows\System\YxOIydn.exe
  C:\Windows\System\YxOIydn.exe
  2⤵
  PID:5964
- C:\Windows\System\TxUYTFD.exe
  C:\Windows\System\TxUYTFD.exe
  2⤵
  PID:5532
- C:\Windows\System\elMjRzD.exe
  C:\Windows\System\elMjRzD.exe
  2⤵
  PID:5672
- C:\Windows\System\HUfEjbm.exe
  C:\Windows\System\HUfEjbm.exe
  2⤵
  PID:5736
- C:\Windows\System\ilFOFLB.exe
  C:\Windows\System\ilFOFLB.exe
  2⤵
  PID:5948
- C:\Windows\System\jTlbptX.exe
  C:\Windows\System\jTlbptX.exe
  2⤵
  PID:5148
- C:\Windows\System\lyAbiHs.exe
  C:\Windows\System\lyAbiHs.exe
  2⤵
  PID:6140
- C:\Windows\System\wUFEDaO.exe
  C:\Windows\System\wUFEDaO.exe
  2⤵
  PID:5884
- C:\Windows\System\cXSFaYa.exe
  C:\Windows\System\cXSFaYa.exe
  2⤵
  PID:5372
- C:\Windows\System\OFVFlng.exe
  C:\Windows\System\OFVFlng.exe
  2⤵
  PID:4544
- C:\Windows\System\FTxLaiG.exe
  C:\Windows\System\FTxLaiG.exe
  2⤵
  PID:5144
- C:\Windows\System\GLhVEnb.exe
  C:\Windows\System\GLhVEnb.exe
  2⤵
  PID:6092
- C:\Windows\System\rmANVRy.exe
  C:\Windows\System\rmANVRy.exe
  2⤵
  PID:5212
- C:\Windows\System\XxLmKMg.exe
  C:\Windows\System\XxLmKMg.exe
  2⤵
  PID:4960
- C:\Windows\System\Vfrzsju.exe
  C:\Windows\System\Vfrzsju.exe
  2⤵
  PID:6076
- C:\Windows\System\ojSDSeA.exe
  C:\Windows\System\ojSDSeA.exe
  2⤵
  PID:5528
- C:\Windows\System\NecozsX.exe
  C:\Windows\System\NecozsX.exe
  2⤵
  PID:5836
- C:\Windows\System\cRucmjK.exe
  C:\Windows\System\cRucmjK.exe
  2⤵
  PID:5896
- C:\Windows\System\beGlTwH.exe
  C:\Windows\System\beGlTwH.exe
  2⤵
  PID:5768
- C:\Windows\System\TNvaoUi.exe
  C:\Windows\System\TNvaoUi.exe
  2⤵
  PID:6072
- C:\Windows\System\HufrXmv.exe
  C:\Windows\System\HufrXmv.exe
  2⤵
  PID:5752
- C:\Windows\System\SinCyve.exe
  C:\Windows\System\SinCyve.exe
  2⤵
  PID:6160
- C:\Windows\System\GVHHIhV.exe
  C:\Windows\System\GVHHIhV.exe
  2⤵
  PID:6176
- C:\Windows\System\kuAczez.exe
  C:\Windows\System\kuAczez.exe
  2⤵
  PID:6192
- C:\Windows\System\BhnyAsg.exe
  C:\Windows\System\BhnyAsg.exe
  2⤵
  PID:6208
- C:\Windows\System\CGaBIGq.exe
  C:\Windows\System\CGaBIGq.exe
  2⤵
  PID:6224
- C:\Windows\System\OsEeNDg.exe
  C:\Windows\System\OsEeNDg.exe
  2⤵
  PID:6240
- C:\Windows\System\qiPMeMj.exe
  C:\Windows\System\qiPMeMj.exe
  2⤵
  PID:6256
- C:\Windows\System\vETxzeX.exe
  C:\Windows\System\vETxzeX.exe
  2⤵
  PID:6272
- C:\Windows\System\XYqPQLW.exe
  C:\Windows\System\XYqPQLW.exe
  2⤵
  PID:6288
- C:\Windows\System\GaIZDwP.exe
  C:\Windows\System\GaIZDwP.exe
  2⤵
  PID:6304
- C:\Windows\System\AbUuFsb.exe
  C:\Windows\System\AbUuFsb.exe
  2⤵
  PID:6320
- C:\Windows\System\WvSwQBY.exe
  C:\Windows\System\WvSwQBY.exe
  2⤵
  PID:6336
- C:\Windows\System\hsgbIxW.exe
  C:\Windows\System\hsgbIxW.exe
  2⤵
  PID:6352
- C:\Windows\System\bikREmt.exe
  C:\Windows\System\bikREmt.exe
  2⤵
  PID:6368
- C:\Windows\System\nsFsjGO.exe
  C:\Windows\System\nsFsjGO.exe
  2⤵
  PID:6384
- C:\Windows\System\aWzLlIc.exe
  C:\Windows\System\aWzLlIc.exe
  2⤵
  PID:6400
- C:\Windows\System\qDazJtD.exe
  C:\Windows\System\qDazJtD.exe
  2⤵
  PID:6416
- C:\Windows\System\NSpOHtM.exe
  C:\Windows\System\NSpOHtM.exe
  2⤵
  PID:6432
- C:\Windows\System\YVOYBkm.exe
  C:\Windows\System\YVOYBkm.exe
  2⤵
  PID:6448
- C:\Windows\System\TdHTNEo.exe
  C:\Windows\System\TdHTNEo.exe
  2⤵
  PID:6464
- C:\Windows\System\iFqnJft.exe
  C:\Windows\System\iFqnJft.exe
  2⤵
  PID:6480
- C:\Windows\System\xvOcjoh.exe
  C:\Windows\System\xvOcjoh.exe
  2⤵
  PID:6496
- C:\Windows\System\pfUBXCA.exe
  C:\Windows\System\pfUBXCA.exe
  2⤵
  PID:6512
- C:\Windows\System\rhZjERi.exe
  C:\Windows\System\rhZjERi.exe
  2⤵
  PID:6528
- C:\Windows\System\NocuQyt.exe
  C:\Windows\System\NocuQyt.exe
  2⤵
  PID:6544
- C:\Windows\System\eRfqPtK.exe
  C:\Windows\System\eRfqPtK.exe
  2⤵
  PID:6560
- C:\Windows\System\qmDEWhF.exe
  C:\Windows\System\qmDEWhF.exe
  2⤵
  PID:6576
- C:\Windows\System\ssmvsrd.exe
  C:\Windows\System\ssmvsrd.exe
  2⤵
  PID:6592
- C:\Windows\System\DZhqiNk.exe
  C:\Windows\System\DZhqiNk.exe
  2⤵
  PID:6608
- C:\Windows\System\uMoueVi.exe
  C:\Windows\System\uMoueVi.exe
  2⤵
  PID:6624
- C:\Windows\System\HNZttEJ.exe
  C:\Windows\System\HNZttEJ.exe
  2⤵
  PID:6640
- C:\Windows\System\vuJZuCC.exe
  C:\Windows\System\vuJZuCC.exe
  2⤵
  PID:6656
- C:\Windows\System\FTYrnVJ.exe
  C:\Windows\System\FTYrnVJ.exe
  2⤵
  PID:6672
- C:\Windows\System\xdFcdHh.exe
  C:\Windows\System\xdFcdHh.exe
  2⤵
  PID:6688
- C:\Windows\System\ElINarZ.exe
  C:\Windows\System\ElINarZ.exe
  2⤵
  PID:6704
- C:\Windows\System\AwtxFEW.exe
  C:\Windows\System\AwtxFEW.exe
  2⤵
  PID:6720
- C:\Windows\System\uUozxwU.exe
  C:\Windows\System\uUozxwU.exe
  2⤵
  PID:6736
- C:\Windows\System\nXThoTP.exe
  C:\Windows\System\nXThoTP.exe
  2⤵
  PID:6752
- C:\Windows\System\jNjfPvh.exe
  C:\Windows\System\jNjfPvh.exe
  2⤵
  PID:6768
- C:\Windows\System\cGecwZY.exe
  C:\Windows\System\cGecwZY.exe
  2⤵
  PID:6784
- C:\Windows\System\eKDWUaC.exe
  C:\Windows\System\eKDWUaC.exe
  2⤵
  PID:6800
- C:\Windows\System\KupMmwZ.exe
  C:\Windows\System\KupMmwZ.exe
  2⤵
  PID:6816
- C:\Windows\System\tXzGeYx.exe
  C:\Windows\System\tXzGeYx.exe
  2⤵
  PID:6832
- C:\Windows\System\dsRdDPC.exe
  C:\Windows\System\dsRdDPC.exe
  2⤵
  PID:6848
- C:\Windows\System\mjHCbOD.exe
  C:\Windows\System\mjHCbOD.exe
  2⤵
  PID:6864
- C:\Windows\System\WHKofCP.exe
  C:\Windows\System\WHKofCP.exe
  2⤵
  PID:6880
- C:\Windows\System\ePCGMRc.exe
  C:\Windows\System\ePCGMRc.exe
  2⤵
  PID:6896
- C:\Windows\System\cFFezDB.exe
  C:\Windows\System\cFFezDB.exe
  2⤵
  PID:6916
- C:\Windows\System\VTfTAey.exe
  C:\Windows\System\VTfTAey.exe
  2⤵
  PID:6932
- C:\Windows\System\AzxelfW.exe
  C:\Windows\System\AzxelfW.exe
  2⤵
  PID:6948
- C:\Windows\System\fOMqssk.exe
  C:\Windows\System\fOMqssk.exe
  2⤵
  PID:6964
- C:\Windows\System\foROapI.exe
  C:\Windows\System\foROapI.exe
  2⤵
  PID:6980
- C:\Windows\System\uKOZMMt.exe
  C:\Windows\System\uKOZMMt.exe
  2⤵
  PID:6996
- C:\Windows\System\zhHycsJ.exe
  C:\Windows\System\zhHycsJ.exe
  2⤵
  PID:7012
- C:\Windows\System\nRxLajp.exe
  C:\Windows\System\nRxLajp.exe
  2⤵
  PID:7028
- C:\Windows\System\DkSJOjc.exe
  C:\Windows\System\DkSJOjc.exe
  2⤵
  PID:7044
- C:\Windows\System\MbWaqaJ.exe
  C:\Windows\System\MbWaqaJ.exe
  2⤵
  PID:7060
- C:\Windows\System\OVKGrAl.exe
  C:\Windows\System\OVKGrAl.exe
  2⤵
  PID:7076
- C:\Windows\System\qhXJnto.exe
  C:\Windows\System\qhXJnto.exe
  2⤵
  PID:7092
- C:\Windows\System\jmIdgDu.exe
  C:\Windows\System\jmIdgDu.exe
  2⤵
  PID:7108
- C:\Windows\System\ioRmYTQ.exe
  C:\Windows\System\ioRmYTQ.exe
  2⤵
  PID:7124
- C:\Windows\System\NuBkOpD.exe
  C:\Windows\System\NuBkOpD.exe
  2⤵
  PID:7140
- C:\Windows\System\DaUpapY.exe
  C:\Windows\System\DaUpapY.exe
  2⤵
  PID:7156
- C:\Windows\System\xHCbbgC.exe
  C:\Windows\System\xHCbbgC.exe
  2⤵
  PID:5960
- C:\Windows\System\aWbOhdl.exe
  C:\Windows\System\aWbOhdl.exe
  2⤵
  PID:6188
- C:\Windows\System\tULDZzR.exe
  C:\Windows\System\tULDZzR.exe
  2⤵
  PID:6252
- C:\Windows\System\KEGCtlL.exe
  C:\Windows\System\KEGCtlL.exe
  2⤵
  PID:5352
- C:\Windows\System\bOKSfMh.exe
  C:\Windows\System\bOKSfMh.exe
  2⤵
  PID:5260
- C:\Windows\System\zOIUOGS.exe
  C:\Windows\System\zOIUOGS.exe
  2⤵
  PID:5180
- C:\Windows\System\ctqsJtJ.exe
  C:\Windows\System\ctqsJtJ.exe
  2⤵
  PID:6312
- C:\Windows\System\dUUCbad.exe
  C:\Windows\System\dUUCbad.exe
  2⤵
  PID:6232
- C:\Windows\System\xWLZZZN.exe
  C:\Windows\System\xWLZZZN.exe
  2⤵
  PID:6300
- C:\Windows\System\PXXAlgj.exe
  C:\Windows\System\PXXAlgj.exe
  2⤵
  PID:6348
- C:\Windows\System\cWMpNMj.exe
  C:\Windows\System\cWMpNMj.exe
  2⤵
  PID:6412
- C:\Windows\System\HtjLmrP.exe
  C:\Windows\System\HtjLmrP.exe
  2⤵
  PID:6476
- C:\Windows\System\DWCXLjJ.exe
  C:\Windows\System\DWCXLjJ.exe
  2⤵
  PID:6540
- C:\Windows\System\RvRofFV.exe
  C:\Windows\System\RvRofFV.exe
  2⤵
  PID:6364
- C:\Windows\System\huEvqvE.exe
  C:\Windows\System\huEvqvE.exe
  2⤵
  PID:6636
- C:\Windows\System\fpOHnvv.exe
  C:\Windows\System\fpOHnvv.exe
  2⤵
  PID:6700
- C:\Windows\System\xjoWQxa.exe
  C:\Windows\System\xjoWQxa.exe
  2⤵
  PID:6396
- C:\Windows\System\BWJKdKY.exe
  C:\Windows\System\BWJKdKY.exe
  2⤵
  PID:6460
- C:\Windows\System\VAPYAnt.exe
  C:\Windows\System\VAPYAnt.exe
  2⤵
  PID:6760
- C:\Windows\System\uVJASGl.exe
  C:\Windows\System\uVJASGl.exe
  2⤵
  PID:6680
- C:\Windows\System\sMAocfV.exe
  C:\Windows\System\sMAocfV.exe
  2⤵
  PID:6524
- C:\Windows\System\ixGUpQP.exe
  C:\Windows\System\ixGUpQP.exe
  2⤵
  PID:6588
- C:\Windows\System\oBpJebL.exe
  C:\Windows\System\oBpJebL.exe
  2⤵
  PID:6684
- C:\Windows\System\XEsGaLM.exe
  C:\Windows\System\XEsGaLM.exe
  2⤵
  PID:6776
- C:\Windows\System\mBKFqTo.exe
  C:\Windows\System\mBKFqTo.exe
  2⤵
  PID:6812
- C:\Windows\System\JjSLPsx.exe
  C:\Windows\System\JjSLPsx.exe
  2⤵
  PID:6892
- C:\Windows\System\GCqmRKT.exe
  C:\Windows\System\GCqmRKT.exe
  2⤵
  PID:6960
- C:\Windows\System\gtSOZVw.exe
  C:\Windows\System\gtSOZVw.exe
  2⤵
  PID:6940
- C:\Windows\System\KQbqKbh.exe
  C:\Windows\System\KQbqKbh.exe
  2⤵
  PID:6840
- C:\Windows\System\qxhnyPJ.exe
  C:\Windows\System\qxhnyPJ.exe
  2⤵
  PID:6872
- C:\Windows\System\myqtPsC.exe
  C:\Windows\System\myqtPsC.exe
  2⤵
  PID:7036
- C:\Windows\System\NoAByHr.exe
  C:\Windows\System\NoAByHr.exe
  2⤵
  PID:7088
- C:\Windows\System\JpOwIOH.exe
  C:\Windows\System\JpOwIOH.exe
  2⤵
  PID:7040
- C:\Windows\System\UPgubPS.exe
  C:\Windows\System\UPgubPS.exe
  2⤵
  PID:6156
- C:\Windows\System\BwDHAHI.exe
  C:\Windows\System\BwDHAHI.exe
  2⤵
  PID:7072
- C:\Windows\System\ZKxpRup.exe
  C:\Windows\System\ZKxpRup.exe
  2⤵
  PID:6284
- C:\Windows\System\VTuBzom.exe
  C:\Windows\System\VTuBzom.exe
  2⤵
  PID:7132
- C:\Windows\System\GvVXPgl.exe
  C:\Windows\System\GvVXPgl.exe
  2⤵
  PID:6220
- C:\Windows\System\EPNtZmm.exe
  C:\Windows\System\EPNtZmm.exe
  2⤵
  PID:6204
- C:\Windows\System\GjZQSmQ.exe
  C:\Windows\System\GjZQSmQ.exe
  2⤵
  PID:6268
- C:\Windows\System\VXqNqcX.exe
  C:\Windows\System\VXqNqcX.exe
  2⤵
  PID:6508
- C:\Windows\System\zkfIvWH.exe
  C:\Windows\System\zkfIvWH.exe
  2⤵
  PID:6536
- C:\Windows\System\TRNlgcQ.exe
  C:\Windows\System\TRNlgcQ.exe
  2⤵
  PID:6392
- C:\Windows\System\pdYymkU.exe
  C:\Windows\System\pdYymkU.exe
  2⤵
  PID:6456
- C:\Windows\System\yGlqvCY.exe
  C:\Windows\System\yGlqvCY.exe
  2⤵
  PID:6652
- C:\Windows\System\bXBiHkg.exe
  C:\Windows\System\bXBiHkg.exe
  2⤵
  PID:6620
- C:\Windows\System\qtgHQqi.exe
  C:\Windows\System\qtgHQqi.exe
  2⤵
  PID:6828
- C:\Windows\System\kuOtYVZ.exe
  C:\Windows\System\kuOtYVZ.exe
  2⤵
  PID:6888
- C:\Windows\System\IzTLpbi.exe
  C:\Windows\System\IzTLpbi.exe
  2⤵
  PID:6928
- C:\Windows\System\kmXIhLd.exe
  C:\Windows\System\kmXIhLd.exe
  2⤵
  PID:7024
- C:\Windows\System\JJJPoQF.exe
  C:\Windows\System\JJJPoQF.exe
  2⤵
  PID:5544
- C:\Windows\System\kGlbuas.exe
  C:\Windows\System\kGlbuas.exe
  2⤵
  PID:6344
- C:\Windows\System\NRFDNHd.exe
  C:\Windows\System\NRFDNHd.exe
  2⤵
  PID:6520
- C:\Windows\System\ZxioHRj.exe
  C:\Windows\System\ZxioHRj.exe
  2⤵
  PID:6912
- C:\Windows\System\CSKhtME.exe
  C:\Windows\System\CSKhtME.exe
  2⤵
  PID:6860
- C:\Windows\System\pCSWOOn.exe
  C:\Windows\System\pCSWOOn.exe
  2⤵
  PID:6976
- C:\Windows\System\toLVLFG.exe
  C:\Windows\System\toLVLFG.exe
  2⤵
  PID:7104
- C:\Windows\System\qILzwfA.exe
  C:\Windows\System\qILzwfA.exe
  2⤵
  PID:6152
- C:\Windows\System\qAdvaRm.exe
  C:\Windows\System\qAdvaRm.exe
  2⤵
  PID:6408
- C:\Windows\System\VBMOkLV.exe
  C:\Windows\System\VBMOkLV.exe
  2⤵
  PID:6584
- C:\Windows\System\tJhznPz.exe
  C:\Windows\System\tJhznPz.exe
  2⤵
  PID:6172
- C:\Windows\System\LZvaXaE.exe
  C:\Windows\System\LZvaXaE.exe
  2⤵
  PID:6712
- C:\Windows\System\vVWAnXf.exe
  C:\Windows\System\vVWAnXf.exe
  2⤵
  PID:6428
- C:\Windows\System\oyqNCnm.exe
  C:\Windows\System\oyqNCnm.exe
  2⤵
  PID:6572
- C:\Windows\System\gKQdLdt.exe
  C:\Windows\System\gKQdLdt.exe
  2⤵
  PID:4816
- C:\Windows\System\ROrDecU.exe
  C:\Windows\System\ROrDecU.exe
  2⤵
  PID:7180
- C:\Windows\System\BELZyxe.exe
  C:\Windows\System\BELZyxe.exe
  2⤵
  PID:7196
- C:\Windows\System\VEKqADr.exe
  C:\Windows\System\VEKqADr.exe
  2⤵
  PID:7212
- C:\Windows\System\CPOrIvh.exe
  C:\Windows\System\CPOrIvh.exe
  2⤵
  PID:7228
- C:\Windows\System\SzYgRGH.exe
  C:\Windows\System\SzYgRGH.exe
  2⤵
  PID:7244
- C:\Windows\System\RVQRHMa.exe
  C:\Windows\System\RVQRHMa.exe
  2⤵
  PID:7260
- C:\Windows\System\sKmlLCi.exe
  C:\Windows\System\sKmlLCi.exe
  2⤵
  PID:7276
- C:\Windows\System\imzEkbF.exe
  C:\Windows\System\imzEkbF.exe
  2⤵
  PID:7292
- C:\Windows\System\zjWyjjA.exe
  C:\Windows\System\zjWyjjA.exe
  2⤵
  PID:7308
- C:\Windows\System\MzQgnXX.exe
  C:\Windows\System\MzQgnXX.exe
  2⤵
  PID:7324
- C:\Windows\System\IIizkNZ.exe
  C:\Windows\System\IIizkNZ.exe
  2⤵
  PID:7340
- C:\Windows\System\wcyXDHk.exe
  C:\Windows\System\wcyXDHk.exe
  2⤵
  PID:7356
- C:\Windows\System\TzFXxrV.exe
  C:\Windows\System\TzFXxrV.exe
  2⤵
  PID:7372
- C:\Windows\System\PRRitKD.exe
  C:\Windows\System\PRRitKD.exe
  2⤵
  PID:7388
- C:\Windows\System\cKBeWeQ.exe
  C:\Windows\System\cKBeWeQ.exe
  2⤵
  PID:7404
- C:\Windows\System\SxQrFzC.exe
  C:\Windows\System\SxQrFzC.exe
  2⤵
  PID:7420
- C:\Windows\System\fldVgVR.exe
  C:\Windows\System\fldVgVR.exe
  2⤵
  PID:7436
- C:\Windows\System\brVFFFO.exe
  C:\Windows\System\brVFFFO.exe
  2⤵
  PID:7452
- C:\Windows\System\asGaAjx.exe
  C:\Windows\System\asGaAjx.exe
  2⤵
  PID:7468
- C:\Windows\System\YzTKRky.exe
  C:\Windows\System\YzTKRky.exe
  2⤵
  PID:7484
- C:\Windows\System\TjNBIce.exe
  C:\Windows\System\TjNBIce.exe
  2⤵
  PID:7500
- C:\Windows\System\eWJHgcb.exe
  C:\Windows\System\eWJHgcb.exe
  2⤵
  PID:7516
- C:\Windows\System\dFmPvDz.exe
  C:\Windows\System\dFmPvDz.exe
  2⤵
  PID:7532
- C:\Windows\System\nIHizAT.exe
  C:\Windows\System\nIHizAT.exe
  2⤵
  PID:7548
- C:\Windows\System\UGdEsfQ.exe
  C:\Windows\System\UGdEsfQ.exe
  2⤵
  PID:7564
- C:\Windows\System\NTkpYnk.exe
  C:\Windows\System\NTkpYnk.exe
  2⤵
  PID:7580
- C:\Windows\System\dSsuhNw.exe
  C:\Windows\System\dSsuhNw.exe
  2⤵
  PID:7596
- C:\Windows\System\MbZCuAk.exe
  C:\Windows\System\MbZCuAk.exe
  2⤵
  PID:7612
- C:\Windows\System\cnxHTwn.exe
  C:\Windows\System\cnxHTwn.exe
  2⤵
  PID:7628
- C:\Windows\System\KHlJnOB.exe
  C:\Windows\System\KHlJnOB.exe
  2⤵
  PID:7644
- C:\Windows\System\witGqot.exe
  C:\Windows\System\witGqot.exe
  2⤵
  PID:7660
- C:\Windows\System\qAqGmJh.exe
  C:\Windows\System\qAqGmJh.exe
  2⤵
  PID:7676
- C:\Windows\System\sbNuSXy.exe
  C:\Windows\System\sbNuSXy.exe
  2⤵
  PID:7692
- C:\Windows\System\WRQATnw.exe
  C:\Windows\System\WRQATnw.exe
  2⤵
  PID:7708
- C:\Windows\System\nthbrtq.exe
  C:\Windows\System\nthbrtq.exe
  2⤵
  PID:7724
- C:\Windows\System\eGZyzJl.exe
  C:\Windows\System\eGZyzJl.exe
  2⤵
  PID:7740
- C:\Windows\System\IHRBqkS.exe
  C:\Windows\System\IHRBqkS.exe
  2⤵
  PID:7756
- C:\Windows\System\WjAhUrw.exe
  C:\Windows\System\WjAhUrw.exe
  2⤵
  PID:7772
- C:\Windows\System\NtEVmCH.exe
  C:\Windows\System\NtEVmCH.exe
  2⤵
  PID:7788
- C:\Windows\System\pSBOtOD.exe
  C:\Windows\System\pSBOtOD.exe
  2⤵
  PID:7804
- C:\Windows\System\RVdGlIy.exe
  C:\Windows\System\RVdGlIy.exe
  2⤵
  PID:7820
- C:\Windows\System\ydkayDB.exe
  C:\Windows\System\ydkayDB.exe
  2⤵
  PID:7836
- C:\Windows\System\XCsZtEF.exe
  C:\Windows\System\XCsZtEF.exe
  2⤵
  PID:7852
- C:\Windows\System\rkGEYfp.exe
  C:\Windows\System\rkGEYfp.exe
  2⤵
  PID:7868
- C:\Windows\System\ugDEQsK.exe
  C:\Windows\System\ugDEQsK.exe
  2⤵
  PID:7884
- C:\Windows\System\yaIeSUw.exe
  C:\Windows\System\yaIeSUw.exe
  2⤵
  PID:7900
- C:\Windows\System\Pdnxtmp.exe
  C:\Windows\System\Pdnxtmp.exe
  2⤵
  PID:7916
- C:\Windows\System\uuhAniF.exe
  C:\Windows\System\uuhAniF.exe
  2⤵
  PID:7932
- C:\Windows\System\WZTBxXP.exe
  C:\Windows\System\WZTBxXP.exe
  2⤵
  PID:7948
- C:\Windows\System\kqEjPjB.exe
  C:\Windows\System\kqEjPjB.exe
  2⤵
  PID:7964
- C:\Windows\System\bLKWgvB.exe
  C:\Windows\System\bLKWgvB.exe
  2⤵
  PID:7980
- C:\Windows\System\UWaqynu.exe
  C:\Windows\System\UWaqynu.exe
  2⤵
  PID:7996
- C:\Windows\System\xCtyXKm.exe
  C:\Windows\System\xCtyXKm.exe
  2⤵
  PID:8012
- C:\Windows\System\RPWiMCa.exe
  C:\Windows\System\RPWiMCa.exe
  2⤵
  PID:8028
- C:\Windows\System\TfERAqv.exe
  C:\Windows\System\TfERAqv.exe
  2⤵
  PID:8044
- C:\Windows\System\txSXFOW.exe
  C:\Windows\System\txSXFOW.exe
  2⤵
  PID:8060
- C:\Windows\System\cFUdspj.exe
  C:\Windows\System\cFUdspj.exe
  2⤵
  PID:8076
- C:\Windows\System\DQbkNuI.exe
  C:\Windows\System\DQbkNuI.exe
  2⤵
  PID:8092
- C:\Windows\System\rzjCqVI.exe
  C:\Windows\System\rzjCqVI.exe
  2⤵
  PID:8108
- C:\Windows\System\fgkxklM.exe
  C:\Windows\System\fgkxklM.exe
  2⤵
  PID:8124
- C:\Windows\System\SgQShcl.exe
  C:\Windows\System\SgQShcl.exe
  2⤵
  PID:8140
- C:\Windows\System\NYkkqgu.exe
  C:\Windows\System\NYkkqgu.exe
  2⤵
  PID:8156
- C:\Windows\System\xPpusfb.exe
  C:\Windows\System\xPpusfb.exe
  2⤵
  PID:8172
- C:\Windows\System\ObamXOR.exe
  C:\Windows\System\ObamXOR.exe
  2⤵
  PID:8188
- C:\Windows\System\xqdpBFi.exe
  C:\Windows\System\xqdpBFi.exe
  2⤵
  PID:7204
- C:\Windows\System\kNKiMDB.exe
  C:\Windows\System\kNKiMDB.exe
  2⤵
  PID:6632
- C:\Windows\System\zVOmTep.exe
  C:\Windows\System\zVOmTep.exe
  2⤵
  PID:6844
- C:\Windows\System\ZEncLrg.exe
  C:\Windows\System\ZEncLrg.exe
  2⤵
  PID:7192
- C:\Windows\System\sWQsvxS.exe
  C:\Windows\System\sWQsvxS.exe
  2⤵
  PID:7268
- C:\Windows\System\LZssXhC.exe
  C:\Windows\System\LZssXhC.exe
  2⤵
  PID:7304
- C:\Windows\System\CgGBkrn.exe
  C:\Windows\System\CgGBkrn.exe
  2⤵
  PID:7316
- C:\Windows\System\hENGqlC.exe
  C:\Windows\System\hENGqlC.exe
  2⤵
  PID:7348
- C:\Windows\System\nhGIUDz.exe
  C:\Windows\System\nhGIUDz.exe
  2⤵
  PID:7400
- C:\Windows\System\aGqqNvk.exe
  C:\Windows\System\aGqqNvk.exe
  2⤵
  PID:7460
- C:\Windows\System\PBvJNbA.exe
  C:\Windows\System\PBvJNbA.exe
  2⤵
  PID:7380
- C:\Windows\System\haMPWpX.exe
  C:\Windows\System\haMPWpX.exe
  2⤵
  PID:7528
- C:\Windows\System\bFUxsex.exe
  C:\Windows\System\bFUxsex.exe
  2⤵
  PID:7592
- C:\Windows\System\tgDBvHA.exe
  C:\Windows\System\tgDBvHA.exe
  2⤵
  PID:7480
- C:\Windows\System\ZqgCOqz.exe
  C:\Windows\System\ZqgCOqz.exe
  2⤵
  PID:7544
- C:\Windows\System\VNHbFYD.exe
  C:\Windows\System\VNHbFYD.exe
  2⤵
  PID:7688
- C:\Windows\System\KothZpI.exe
  C:\Windows\System\KothZpI.exe
  2⤵
  PID:7752
- C:\Windows\System\cUZNnHJ.exe
  C:\Windows\System\cUZNnHJ.exe
  2⤵
  PID:7780
- C:\Windows\System\YwybCsm.exe
  C:\Windows\System\YwybCsm.exe
  2⤵
  PID:7640
- C:\Windows\System\RCjtVLF.exe
  C:\Windows\System\RCjtVLF.exe
  2⤵
  PID:7540
- C:\Windows\System\rGoInNV.exe
  C:\Windows\System\rGoInNV.exe
  2⤵
  PID:7764
- C:\Windows\System\dvSCsvH.exe
  C:\Windows\System\dvSCsvH.exe
  2⤵
  PID:7736
- C:\Windows\System\HSBBynh.exe
  C:\Windows\System\HSBBynh.exe
  2⤵
  PID:7828
- C:\Windows\System\KMyNQWz.exe
  C:\Windows\System\KMyNQWz.exe
  2⤵
  PID:7876
- C:\Windows\System\MdJafkm.exe
  C:\Windows\System\MdJafkm.exe
  2⤵
  PID:7940
- C:\Windows\System\uThDjHv.exe
  C:\Windows\System\uThDjHv.exe
  2⤵
  PID:8004
- C:\Windows\System\YclJQJV.exe
  C:\Windows\System\YclJQJV.exe
  2⤵
  PID:8068
- C:\Windows\System\WmsLgzT.exe
  C:\Windows\System\WmsLgzT.exe
  2⤵
  PID:7864
- C:\Windows\System\USTevQe.exe
  C:\Windows\System\USTevQe.exe
  2⤵
  PID:7956
- C:\Windows\System\fYGBSFU.exe
  C:\Windows\System\fYGBSFU.exe
  2⤵
  PID:7928
- C:\Windows\System\uYTvDvp.exe
  C:\Windows\System\uYTvDvp.exe
  2⤵
  PID:8024
- C:\Windows\System\QaliokU.exe
  C:\Windows\System\QaliokU.exe
  2⤵
  PID:8136
- C:\Windows\System\UrDuStO.exe
  C:\Windows\System\UrDuStO.exe
  2⤵
  PID:8168
- C:\Windows\System\erFhPWB.exe
  C:\Windows\System\erFhPWB.exe
  2⤵
  PID:7116
- C:\Windows\System\sJBXqbh.exe
  C:\Windows\System\sJBXqbh.exe
  2⤵
  PID:8148
- C:\Windows\System\TZdAhQw.exe
  C:\Windows\System\TZdAhQw.exe
  2⤵
  PID:6444
- C:\Windows\System\cwABUXR.exe
  C:\Windows\System\cwABUXR.exe
  2⤵
  PID:7396
- C:\Windows\System\MDQeFFW.exe
  C:\Windows\System\MDQeFFW.exe
  2⤵
  PID:7208
- C:\Windows\System\AqYTlct.exe
  C:\Windows\System\AqYTlct.exe
  2⤵
  PID:7300
- C:\Windows\System\GWvhDIV.exe
  C:\Windows\System\GWvhDIV.exe
  2⤵
  PID:7496
- C:\Windows\System\nFnZhrB.exe
  C:\Windows\System\nFnZhrB.exe
  2⤵
  PID:7508
- C:\Windows\System\InqJMGr.exe
  C:\Windows\System\InqJMGr.exe
  2⤵
  PID:7748
- C:\Windows\System\rHDnBwK.exe
  C:\Windows\System\rHDnBwK.exe
  2⤵
  PID:7816
- C:\Windows\System\ZisPkdd.exe
  C:\Windows\System\ZisPkdd.exe
  2⤵
  PID:7768
- C:\Windows\System\DijCVJO.exe
  C:\Windows\System\DijCVJO.exe
  2⤵
  PID:7912
- C:\Windows\System\GbEpzgh.exe
  C:\Windows\System\GbEpzgh.exe
  2⤵
  PID:7672
- C:\Windows\System\uHZxRaw.exe
  C:\Windows\System\uHZxRaw.exe
  2⤵
  PID:7976
- C:\Windows\System\SXmHRcA.exe
  C:\Windows\System\SXmHRcA.exe
  2⤵
  PID:7924
- C:\Windows\System\xDAsboI.exe
  C:\Windows\System\xDAsboI.exe
  2⤵
  PID:8132
- C:\Windows\System\yTiSzTO.exe
  C:\Windows\System\yTiSzTO.exe
  2⤵
  PID:8164
- C:\Windows\System\MuSdukS.exe
  C:\Windows\System\MuSdukS.exe
  2⤵
  PID:8180
- C:\Windows\System\HLQJMgB.exe
  C:\Windows\System\HLQJMgB.exe
  2⤵
  PID:6992
- C:\Windows\System\skTauSX.exe
  C:\Windows\System\skTauSX.exe
  2⤵
  PID:7336
- C:\Windows\System\UkUfAWs.exe
  C:\Windows\System\UkUfAWs.exe
  2⤵
  PID:6908
- C:\Windows\System\VrYdgDj.exe
  C:\Windows\System\VrYdgDj.exe
  2⤵
  PID:7588
- C:\Windows\System\DAdAKjG.exe
  C:\Windows\System\DAdAKjG.exe
  2⤵
  PID:7572
- C:\Windows\System\qaXTSkg.exe
  C:\Windows\System\qaXTSkg.exe
  2⤵
  PID:7512
- C:\Windows\System\TfsqUGs.exe
  C:\Windows\System\TfsqUGs.exe
  2⤵
  PID:7992
- C:\Windows\System\rSWwsSE.exe
  C:\Windows\System\rSWwsSE.exe
  2⤵
  PID:7412
- C:\Windows\System\affEDdI.exe
  C:\Windows\System\affEDdI.exe
  2⤵
  PID:6120
- C:\Windows\System\icwYAvm.exe
  C:\Windows\System\icwYAvm.exe
  2⤵
  PID:6648
- C:\Windows\System\THzwvKn.exe
  C:\Windows\System\THzwvKn.exe
  2⤵
  PID:8100
- C:\Windows\System\ZbaTBcP.exe
  C:\Windows\System\ZbaTBcP.exe
  2⤵
  PID:8184
- C:\Windows\System\JZqinjL.exe
  C:\Windows\System\JZqinjL.exe
  2⤵
  PID:7524
- C:\Windows\System\NxocnXm.exe
  C:\Windows\System\NxocnXm.exe
  2⤵
  PID:7832
- C:\Windows\System\tIcNdcY.exe
  C:\Windows\System\tIcNdcY.exe
  2⤵
  PID:8040
- C:\Windows\System\KBpTqPA.exe
  C:\Windows\System\KBpTqPA.exe
  2⤵
  PID:7560
- C:\Windows\System\oACCABy.exe
  C:\Windows\System\oACCABy.exe
  2⤵
  PID:8208
- C:\Windows\System\TGveVAp.exe
  C:\Windows\System\TGveVAp.exe
  2⤵
  PID:8224
- C:\Windows\System\VZBbtgJ.exe
  C:\Windows\System\VZBbtgJ.exe
  2⤵
  PID:8240
- C:\Windows\System\uFzlsWO.exe
  C:\Windows\System\uFzlsWO.exe
  2⤵
  PID:8256
- C:\Windows\System\BvreJvQ.exe
  C:\Windows\System\BvreJvQ.exe
  2⤵
  PID:8272
- C:\Windows\System\PcjkrpB.exe
  C:\Windows\System\PcjkrpB.exe
  2⤵
  PID:8288
- C:\Windows\System\DDsXzmj.exe
  C:\Windows\System\DDsXzmj.exe
  2⤵
  PID:8304
- C:\Windows\System\AocWPEU.exe
  C:\Windows\System\AocWPEU.exe
  2⤵
  PID:8320
- C:\Windows\System\CcLMjgM.exe
  C:\Windows\System\CcLMjgM.exe
  2⤵
  PID:8336
- C:\Windows\System\SYCaDUP.exe
  C:\Windows\System\SYCaDUP.exe
  2⤵
  PID:8352
- C:\Windows\System\nHyhCRd.exe
  C:\Windows\System\nHyhCRd.exe
  2⤵
  PID:8368
- C:\Windows\System\FCRLVsS.exe
  C:\Windows\System\FCRLVsS.exe
  2⤵
  PID:8384
- C:\Windows\System\TPFtBUI.exe
  C:\Windows\System\TPFtBUI.exe
  2⤵
  PID:8400
- C:\Windows\System\ciPWkrX.exe
  C:\Windows\System\ciPWkrX.exe
  2⤵
  PID:8420
- C:\Windows\System\eDlDIMt.exe
  C:\Windows\System\eDlDIMt.exe
  2⤵
  PID:8436
- C:\Windows\System\YBSbwFt.exe
  C:\Windows\System\YBSbwFt.exe
  2⤵
  PID:8452
- C:\Windows\System\SEzETjA.exe
  C:\Windows\System\SEzETjA.exe
  2⤵
  PID:8468
- C:\Windows\System\FvRCrVK.exe
  C:\Windows\System\FvRCrVK.exe
  2⤵
  PID:8484
- C:\Windows\System\Qfoxpzx.exe
  C:\Windows\System\Qfoxpzx.exe
  2⤵
  PID:8500
- C:\Windows\System\tqxXLqO.exe
  C:\Windows\System\tqxXLqO.exe
  2⤵
  PID:8516
- C:\Windows\System\sKUjCGY.exe
  C:\Windows\System\sKUjCGY.exe
  2⤵
  PID:8532
- C:\Windows\System\AEGcBuD.exe
  C:\Windows\System\AEGcBuD.exe
  2⤵
  PID:8548
- C:\Windows\System\AsynvHj.exe
  C:\Windows\System\AsynvHj.exe
  2⤵
  PID:8564
- C:\Windows\System\sglrsJj.exe
  C:\Windows\System\sglrsJj.exe
  2⤵
  PID:8580
- C:\Windows\System\tUYgYgg.exe
  C:\Windows\System\tUYgYgg.exe
  2⤵
  PID:8596
- C:\Windows\System\uvRXEcO.exe
  C:\Windows\System\uvRXEcO.exe
  2⤵
  PID:8612
- C:\Windows\System\PlHGeel.exe
  C:\Windows\System\PlHGeel.exe
  2⤵
  PID:8628
- C:\Windows\System\VySICvt.exe
  C:\Windows\System\VySICvt.exe
  2⤵
  PID:8644
- C:\Windows\System\ZdTRLuU.exe
  C:\Windows\System\ZdTRLuU.exe
  2⤵
  PID:8660
- C:\Windows\System\LWaiMYM.exe
  C:\Windows\System\LWaiMYM.exe
  2⤵
  PID:8676
- C:\Windows\System\cTwTeRb.exe
  C:\Windows\System\cTwTeRb.exe
  2⤵
  PID:8692
- C:\Windows\System\XHDylwQ.exe
  C:\Windows\System\XHDylwQ.exe
  2⤵
  PID:8708
- C:\Windows\System\gDyHBhy.exe
  C:\Windows\System\gDyHBhy.exe
  2⤵
  PID:8724
- C:\Windows\System\fcLNLKi.exe
  C:\Windows\System\fcLNLKi.exe
  2⤵
  PID:8740
- C:\Windows\System\OGercIe.exe
  C:\Windows\System\OGercIe.exe
  2⤵
  PID:8756
- C:\Windows\System\PgeOGsS.exe
  C:\Windows\System\PgeOGsS.exe
  2⤵
  PID:8772
- C:\Windows\System\yABGeyr.exe
  C:\Windows\System\yABGeyr.exe
  2⤵
  PID:8788
- C:\Windows\System\lurljgD.exe
  C:\Windows\System\lurljgD.exe
  2⤵
  PID:8804
- C:\Windows\System\HmEHWdG.exe
  C:\Windows\System\HmEHWdG.exe
  2⤵
  PID:8820
- C:\Windows\System\JLZLsnR.exe
  C:\Windows\System\JLZLsnR.exe
  2⤵
  PID:8836
- C:\Windows\System\CjkCeJU.exe
  C:\Windows\System\CjkCeJU.exe
  2⤵
  PID:8852
- C:\Windows\System\vnvKtNy.exe
  C:\Windows\System\vnvKtNy.exe
  2⤵
  PID:8868
- C:\Windows\System\qMyBKlJ.exe
  C:\Windows\System\qMyBKlJ.exe
  2⤵
  PID:8884
- C:\Windows\System\stMirSu.exe
  C:\Windows\System\stMirSu.exe
  2⤵
  PID:8900
- C:\Windows\System\oxCJwvU.exe
  C:\Windows\System\oxCJwvU.exe
  2⤵
  PID:8916
- C:\Windows\System\sFvbHDo.exe
  C:\Windows\System\sFvbHDo.exe
  2⤵
  PID:8932
- C:\Windows\System\tPvzSSF.exe
  C:\Windows\System\tPvzSSF.exe
  2⤵
  PID:8948
- C:\Windows\System\EGehoQF.exe
  C:\Windows\System\EGehoQF.exe
  2⤵
  PID:8964
- C:\Windows\System\vfEUtfr.exe
  C:\Windows\System\vfEUtfr.exe
  2⤵
  PID:8980
- C:\Windows\System\pcwBKdY.exe
  C:\Windows\System\pcwBKdY.exe
  2⤵
  PID:8996
- C:\Windows\System\DAPMfvU.exe
  C:\Windows\System\DAPMfvU.exe
  2⤵
  PID:9012
- C:\Windows\System\zLgGjCK.exe
  C:\Windows\System\zLgGjCK.exe
  2⤵
  PID:9028
- C:\Windows\System\gkPbgYE.exe
  C:\Windows\System\gkPbgYE.exe
  2⤵
  PID:9044
- C:\Windows\System\ASXdfOp.exe
  C:\Windows\System\ASXdfOp.exe
  2⤵
  PID:9060
- C:\Windows\System\VewInio.exe
  C:\Windows\System\VewInio.exe
  2⤵
  PID:9080
- C:\Windows\System\drMZRAQ.exe
  C:\Windows\System\drMZRAQ.exe
  2⤵
  PID:9096
- C:\Windows\System\IdoTAvn.exe
  C:\Windows\System\IdoTAvn.exe
  2⤵
  PID:9112
- C:\Windows\System\BBXEDQN.exe
  C:\Windows\System\BBXEDQN.exe
  2⤵
  PID:9132
- C:\Windows\System\SeXSylI.exe
  C:\Windows\System\SeXSylI.exe
  2⤵
  PID:9148
- C:\Windows\System\iHPNnfW.exe
  C:\Windows\System\iHPNnfW.exe
  2⤵
  PID:9168
- C:\Windows\System\HRKUgTW.exe
  C:\Windows\System\HRKUgTW.exe
  2⤵
  PID:9184
- C:\Windows\System\AMXnaoW.exe
  C:\Windows\System\AMXnaoW.exe
  2⤵
  PID:9200
- C:\Windows\System\kNpTahF.exe
  C:\Windows\System\kNpTahF.exe
  2⤵
  PID:7848
- C:\Windows\System\oFbYVJt.exe
  C:\Windows\System\oFbYVJt.exe
  2⤵
  PID:8200
- C:\Windows\System\jweNYcb.exe
  C:\Windows\System\jweNYcb.exe
  2⤵
  PID:8280
- C:\Windows\System\gBpiQDa.exe
  C:\Windows\System\gBpiQDa.exe
  2⤵
  PID:8316
- C:\Windows\System\LEjjqZj.exe
  C:\Windows\System\LEjjqZj.exe
  2⤵
  PID:8380
- C:\Windows\System\hKJeabF.exe
  C:\Windows\System\hKJeabF.exe
  2⤵
  PID:8416
- C:\Windows\System\YwIxjlP.exe
  C:\Windows\System\YwIxjlP.exe
  2⤵
  PID:8448
- C:\Windows\System\baSgkhn.exe
  C:\Windows\System\baSgkhn.exe
  2⤵
  PID:8236
- C:\Windows\System\xdxSlEC.exe
  C:\Windows\System\xdxSlEC.exe
  2⤵
  PID:8296
- C:\Windows\System\XULellp.exe
  C:\Windows\System\XULellp.exe
  2⤵
  PID:8540
- C:\Windows\System\YhjFuxJ.exe
  C:\Windows\System\YhjFuxJ.exe
  2⤵
  PID:8492
- C:\Windows\System\OmTddOj.exe
  C:\Windows\System\OmTddOj.exe
  2⤵
  PID:8428
- C:\Windows\System\qBPiUBl.exe
  C:\Windows\System\qBPiUBl.exe
  2⤵
  PID:8460
- C:\Windows\System\OSKYKMs.exe
  C:\Windows\System\OSKYKMs.exe
  2⤵
  PID:8636
- C:\Windows\System\eyHWiwP.exe
  C:\Windows\System\eyHWiwP.exe
  2⤵
  PID:8556
- C:\Windows\System\jAKTNfx.exe
  C:\Windows\System\jAKTNfx.exe
  2⤵
  PID:8620
- C:\Windows\System\KLUnlZa.exe
  C:\Windows\System\KLUnlZa.exe
  2⤵
  PID:8732
- C:\Windows\System\XpJBitE.exe
  C:\Windows\System\XpJBitE.exe
  2⤵
  PID:8764
- C:\Windows\System\IyZkzdu.exe
  C:\Windows\System\IyZkzdu.exe
  2⤵
  PID:8684
- C:\Windows\System\JRCiScQ.exe
  C:\Windows\System\JRCiScQ.exe
  2⤵
  PID:8748
- C:\Windows\System\LHzZBlz.exe
  C:\Windows\System\LHzZBlz.exe
  2⤵
  PID:8784
- C:\Windows\System\vmymLef.exe
  C:\Windows\System\vmymLef.exe
  2⤵
  PID:8812
- C:\Windows\System\zJqfcna.exe
  C:\Windows\System\zJqfcna.exe
  2⤵
  PID:8928
- C:\Windows\System\BKFzUOv.exe
  C:\Windows\System\BKFzUOv.exe
  2⤵
  PID:8940
- C:\Windows\System\BqFpmKo.exe
  C:\Windows\System\BqFpmKo.exe
  2⤵
  PID:8912
- C:\Windows\System\jGxDYoz.exe
  C:\Windows\System\jGxDYoz.exe
  2⤵
  PID:8992
- C:\Windows\System\riFpjSN.exe
  C:\Windows\System\riFpjSN.exe
  2⤵
  PID:9008
- C:\Windows\System\COiPFMr.exe
  C:\Windows\System\COiPFMr.exe
  2⤵
  PID:9036
- C:\Windows\System\rVakQke.exe
  C:\Windows\System\rVakQke.exe
  2⤵
  PID:9088
- C:\Windows\System\sAuLMdT.exe
  C:\Windows\System\sAuLMdT.exe
  2⤵
  PID:9124
- C:\Windows\System\cuMjJgB.exe
  C:\Windows\System\cuMjJgB.exe
  2⤵
  PID:9192
- C:\Windows\System\HsjcdJi.exe
  C:\Windows\System\HsjcdJi.exe
  2⤵
  PID:9140
- C:\Windows\System\EdrUigy.exe
  C:\Windows\System\EdrUigy.exe
  2⤵
  PID:9208
- C:\Windows\System\wvhEMld.exe
  C:\Windows\System\wvhEMld.exe
  2⤵
  PID:8312
- C:\Windows\System\tEYuMDa.exe
  C:\Windows\System\tEYuMDa.exe
  2⤵
  PID:8204
- C:\Windows\System\LdwfBQz.exe
  C:\Windows\System\LdwfBQz.exe
  2⤵
  PID:8392
- C:\Windows\System\gZUlGCu.exe
  C:\Windows\System\gZUlGCu.exe
  2⤵
  PID:8508
- C:\Windows\System\awAdNZX.exe
  C:\Windows\System\awAdNZX.exe
  2⤵
  PID:8544
- C:\Windows\System\QgtfNvH.exe
  C:\Windows\System\QgtfNvH.exe
  2⤵
  PID:8604
- C:\Windows\System\TNQBbWF.exe
  C:\Windows\System\TNQBbWF.exe
  2⤵
  PID:8704
- C:\Windows\System\kboTwcu.exe
  C:\Windows\System\kboTwcu.exe
  2⤵
  PID:8652
- C:\Windows\System\GMaqsOc.exe
  C:\Windows\System\GMaqsOc.exe
  2⤵
  PID:8796
- C:\Windows\System\cgwKOrr.exe
  C:\Windows\System\cgwKOrr.exe
  2⤵
  PID:8860
- C:\Windows\System\YFVsOoY.exe
  C:\Windows\System\YFVsOoY.exe
  2⤵
  PID:8956
- C:\Windows\System\aodirTI.exe
  C:\Windows\System\aodirTI.exe
  2⤵
  PID:8896
- C:\Windows\System\TWwkHRv.exe
  C:\Windows\System\TWwkHRv.exe
  2⤵
  PID:8876
- C:\Windows\System\RqhNiVi.exe
  C:\Windows\System\RqhNiVi.exe
  2⤵
  PID:9052
- C:\Windows\System\HriidPk.exe
  C:\Windows\System\HriidPk.exe
  2⤵
  PID:9120
- C:\Windows\System\mgIDuwA.exe
  C:\Windows\System\mgIDuwA.exe
  2⤵
  PID:9160
- C:\Windows\System\hEIluwB.exe
  C:\Windows\System\hEIluwB.exe
  2⤵
  PID:9212
- C:\Windows\System\aiMwIQp.exe
  C:\Windows\System\aiMwIQp.exe
  2⤵
  PID:8364
- C:\Windows\System\ANcfFJf.exe
  C:\Windows\System\ANcfFJf.exe
  2⤵
  PID:8444
- C:\Windows\System\iYeaQBH.exe
  C:\Windows\System\iYeaQBH.exe
  2⤵
  PID:8432
- C:\Windows\System\iXqzrTg.exe
  C:\Windows\System\iXqzrTg.exe
  2⤵
  PID:8668
- C:\Windows\System\CfJZiQb.exe
  C:\Windows\System\CfJZiQb.exe
  2⤵
  PID:8848
- C:\Windows\System\CWAVtkR.exe
  C:\Windows\System\CWAVtkR.exe
  2⤵
  PID:8832
- C:\Windows\System\NMfoPFl.exe
  C:\Windows\System\NMfoPFl.exe
  2⤵
  PID:9068
- C:\Windows\System\dyZtbhe.exe
  C:\Windows\System\dyZtbhe.exe
  2⤵
  PID:9108
- C:\Windows\System\KzaDkOd.exe
  C:\Windows\System\KzaDkOd.exe
  2⤵
  PID:8332
- C:\Windows\System\udWTeWZ.exe
  C:\Windows\System\udWTeWZ.exe
  2⤵
  PID:8656
- C:\Windows\System\AkIMwqd.exe
  C:\Windows\System\AkIMwqd.exe
  2⤵
  PID:8720
- C:\Windows\System\zuGoosY.exe
  C:\Windows\System\zuGoosY.exe
  2⤵
  PID:9004
- C:\Windows\System\HLNZkvO.exe
  C:\Windows\System\HLNZkvO.exe
  2⤵
  PID:8412
- C:\Windows\System\ILEOoBp.exe
  C:\Windows\System\ILEOoBp.exe
  2⤵
  PID:8828
- C:\Windows\System\FHFcAer.exe
  C:\Windows\System\FHFcAer.exe
  2⤵
  PID:8924
- C:\Windows\System\ggkfYyK.exe
  C:\Windows\System\ggkfYyK.exe
  2⤵
  PID:9232
- C:\Windows\System\bAOopKD.exe
  C:\Windows\System\bAOopKD.exe
  2⤵
  PID:9248
- C:\Windows\System\UMKVHFI.exe
  C:\Windows\System\UMKVHFI.exe
  2⤵
  PID:9264
- C:\Windows\System\pbKXonA.exe
  C:\Windows\System\pbKXonA.exe
  2⤵
  PID:9284
- C:\Windows\System\wKoLyRP.exe
  C:\Windows\System\wKoLyRP.exe
  2⤵
  PID:9300
- C:\Windows\System\hTkjSuf.exe
  C:\Windows\System\hTkjSuf.exe
  2⤵
  PID:9316
- C:\Windows\System\jIxojSU.exe
  C:\Windows\System\jIxojSU.exe
  2⤵
  PID:9332
- C:\Windows\System\aNpHYrz.exe
  C:\Windows\System\aNpHYrz.exe
  2⤵
  PID:9348
- C:\Windows\System\dCawHKD.exe
  C:\Windows\System\dCawHKD.exe
  2⤵
  PID:9364
- C:\Windows\System\tyIoPjN.exe
  C:\Windows\System\tyIoPjN.exe
  2⤵
  PID:9380
- C:\Windows\System\dAvPILH.exe
  C:\Windows\System\dAvPILH.exe
  2⤵
  PID:9396
- C:\Windows\System\QbgbIbb.exe
  C:\Windows\System\QbgbIbb.exe
  2⤵
  PID:9412
- C:\Windows\System\IFFSZtp.exe
  C:\Windows\System\IFFSZtp.exe
  2⤵
  PID:9428
- C:\Windows\System\sHDiasw.exe
  C:\Windows\System\sHDiasw.exe
  2⤵
  PID:9448
- C:\Windows\System\CJHpUIG.exe
  C:\Windows\System\CJHpUIG.exe
  2⤵
  PID:9468
- C:\Windows\System\ZhyLXFA.exe
  C:\Windows\System\ZhyLXFA.exe
  2⤵
  PID:9492
- C:\Windows\System\rdrKYJx.exe
  C:\Windows\System\rdrKYJx.exe
  2⤵
  PID:9508
- C:\Windows\System\JAExVQD.exe
  C:\Windows\System\JAExVQD.exe
  2⤵
  PID:9524
- C:\Windows\System\ryWZenr.exe
  C:\Windows\System\ryWZenr.exe
  2⤵
  PID:9540
- C:\Windows\System\bDUNrYw.exe
  C:\Windows\System\bDUNrYw.exe
  2⤵
  PID:9560
- C:\Windows\System\KFMCpDW.exe
  C:\Windows\System\KFMCpDW.exe
  2⤵
  PID:9576
- C:\Windows\System\FmnflnK.exe
  C:\Windows\System\FmnflnK.exe
  2⤵
  PID:9596
- C:\Windows\System\NfJbmUj.exe
  C:\Windows\System\NfJbmUj.exe
  2⤵
  PID:9612
- C:\Windows\System\crsPBpi.exe
  C:\Windows\System\crsPBpi.exe
  2⤵
  PID:9628
- C:\Windows\System\odnOwST.exe
  C:\Windows\System\odnOwST.exe
  2⤵
  PID:9648
- C:\Windows\System\iQXsXqp.exe
  C:\Windows\System\iQXsXqp.exe
  2⤵
  PID:9664
- C:\Windows\System\wuOFiLO.exe
  C:\Windows\System\wuOFiLO.exe
  2⤵
  PID:9680
- C:\Windows\System\wlyyJUR.exe
  C:\Windows\System\wlyyJUR.exe
  2⤵
  PID:9700
- C:\Windows\System\DlfaTFJ.exe
  C:\Windows\System\DlfaTFJ.exe
  2⤵
  PID:9716
- C:\Windows\System\pkcTYeH.exe
  C:\Windows\System\pkcTYeH.exe
  2⤵
  PID:9832
- C:\Windows\System\fPsuzcK.exe
  C:\Windows\System\fPsuzcK.exe
  2⤵
  PID:9868
- C:\Windows\System\msFEFXD.exe
  C:\Windows\System\msFEFXD.exe
  2⤵
  PID:9884
- C:\Windows\System\DIBtfqT.exe
  C:\Windows\System\DIBtfqT.exe
  2⤵
  PID:9900
- C:\Windows\System\rywhAzW.exe
  C:\Windows\System\rywhAzW.exe
  2⤵
  PID:9916
- C:\Windows\System\ejhfcWB.exe
  C:\Windows\System\ejhfcWB.exe
  2⤵
  PID:9936
- C:\Windows\System\zMYUZQJ.exe
  C:\Windows\System\zMYUZQJ.exe
  2⤵
  PID:9952
- C:\Windows\System\SdQtWou.exe
  C:\Windows\System\SdQtWou.exe
  2⤵
  PID:9968
- C:\Windows\System\EBtuLUc.exe
  C:\Windows\System\EBtuLUc.exe
  2⤵
  PID:9984
- C:\Windows\System\mNaJtKl.exe
  C:\Windows\System\mNaJtKl.exe
  2⤵
  PID:10000
- C:\Windows\System\AizOTuY.exe
  C:\Windows\System\AizOTuY.exe
  2⤵
  PID:10060
- C:\Windows\System\YTPbQBV.exe
  C:\Windows\System\YTPbQBV.exe
  2⤵
  PID:10076
- C:\Windows\System\xFSWoas.exe
  C:\Windows\System\xFSWoas.exe
  2⤵
  PID:10092
- C:\Windows\System\QYThgXv.exe
  C:\Windows\System\QYThgXv.exe
  2⤵
  PID:10112
- C:\Windows\System\TYRwSMn.exe
  C:\Windows\System\TYRwSMn.exe
  2⤵
  PID:10128
- C:\Windows\System\DXyCJZg.exe
  C:\Windows\System\DXyCJZg.exe
  2⤵
  PID:10144
- C:\Windows\System\vDDUhqR.exe
  C:\Windows\System\vDDUhqR.exe
  2⤵
  PID:10212
- C:\Windows\System\OoryNFS.exe
  C:\Windows\System\OoryNFS.exe
  2⤵
  PID:10232
- C:\Windows\System\GOgieHB.exe
  C:\Windows\System\GOgieHB.exe
  2⤵
  PID:9256
- C:\Windows\System\FgNbMkG.exe
  C:\Windows\System\FgNbMkG.exe
  2⤵
  PID:9244
- C:\Windows\System\RGShlSe.exe
  C:\Windows\System\RGShlSe.exe
  2⤵
  PID:9308
- C:\Windows\System\pMbDtsS.exe
  C:\Windows\System\pMbDtsS.exe
  2⤵
  PID:9340
- C:\Windows\System\xwztHCS.exe
  C:\Windows\System\xwztHCS.exe
  2⤵
  PID:9436
- C:\Windows\System\EypRGet.exe
  C:\Windows\System\EypRGet.exe
  2⤵
  PID:9484
- C:\Windows\System\jKRxTAH.exe
  C:\Windows\System\jKRxTAH.exe
  2⤵
  PID:9572
- C:\Windows\System\JZCRKdQ.exe
  C:\Windows\System\JZCRKdQ.exe
  2⤵
  PID:9712
- C:\Windows\System\TzlamoY.exe
  C:\Windows\System\TzlamoY.exe
  2⤵
  PID:9744
- C:\Windows\System\fOdPtBp.exe
  C:\Windows\System\fOdPtBp.exe
  2⤵
  PID:9764
- C:\Windows\System\pxtoxrH.exe
  C:\Windows\System\pxtoxrH.exe
  2⤵
  PID:9780
- C:\Windows\System\ySvRpfa.exe
  C:\Windows\System\ySvRpfa.exe
  2⤵
  PID:9828
- C:\Windows\System\TKmePtE.exe
  C:\Windows\System\TKmePtE.exe
  2⤵
  PID:9976
- C:\Windows\System\ppFfCzl.exe
  C:\Windows\System\ppFfCzl.exe
  2⤵
  PID:10068
- C:\Windows\System\pGvxtib.exe
  C:\Windows\System\pGvxtib.exe
  2⤵
  PID:10176
- C:\Windows\System\YJSSztI.exe
  C:\Windows\System\YJSSztI.exe
  2⤵
  PID:9392
- C:\Windows\System\cfFLiGm.exe
  C:\Windows\System\cfFLiGm.exe
  2⤵
  PID:9672
- C:\Windows\System\TQkJjHQ.exe
  C:\Windows\System\TQkJjHQ.exe
  2⤵
  PID:9772
- C:\Windows\System\CHgAhQf.exe
  C:\Windows\System\CHgAhQf.exe
  2⤵
  PID:9876
- C:\Windows\System\uaSPubP.exe
  C:\Windows\System\uaSPubP.exe
  2⤵
  PID:9944
- C:\Windows\System\EhKAhPc.exe
  C:\Windows\System\EhKAhPc.exe
  2⤵
  PID:9992
- C:\Windows\System\kLUpAlg.exe
  C:\Windows\System\kLUpAlg.exe
  2⤵
  PID:9840
- C:\Windows\System\szfHhqQ.exe
  C:\Windows\System\szfHhqQ.exe
  2⤵
  PID:9796
- C:\Windows\System\rlNlYJM.exe
  C:\Windows\System\rlNlYJM.exe
  2⤵
  PID:9816
- C:\Windows\System\cucMexF.exe
  C:\Windows\System\cucMexF.exe
  2⤵
  PID:9856
- C:\Windows\System\VukBVyG.exe
  C:\Windows\System\VukBVyG.exe
  2⤵
  PID:9896
- C:\Windows\System\rGqOqnw.exe
  C:\Windows\System\rGqOqnw.exe
  2⤵
  PID:10020
- C:\Windows\System\ZtqfUso.exe
  C:\Windows\System\ZtqfUso.exe
  2⤵
  PID:9924
- C:\Windows\System\DZrFuCp.exe
  C:\Windows\System\DZrFuCp.exe
  2⤵
  PID:10052
- C:\Windows\System\RQBEPAN.exe
  C:\Windows\System\RQBEPAN.exe
  2⤵
  PID:10084
- C:\Windows\System\bqjkTEZ.exe
  C:\Windows\System\bqjkTEZ.exe
  2⤵
  PID:10156
- C:\Windows\System\iKIDpbd.exe
  C:\Windows\System\iKIDpbd.exe
  2⤵
  PID:10172
- C:\Windows\System\ecjAJBX.exe
  C:\Windows\System\ecjAJBX.exe
  2⤵
  PID:10200
- C:\Windows\System\SscFyJW.exe
  C:\Windows\System\SscFyJW.exe
  2⤵
  PID:10228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQiQgng.exe

Filesize
1.4MB

MD5
2fa137af77b5f7df0bf1d3a9b8438076

SHA1
cbb680bb59deaaac3ee5869a6d328436821378cf

SHA256
8bb8051c2c11ea7f01e41137e37077227d8a23774b8582e552987bbd09c8ca62

SHA512
62739270d92cefda02bd985fdf0d4f06a72a3f3eda0e714110a815107177805f44e0f9f6ab9470cafb6ef98947456c6f2ee85cafef6cb318014d5b20bff5209a

Download Submit
C:\Windows\system\Aneyzeg.exe

Filesize
1.4MB

MD5
6a9623fb725edad78d2a19908a6dd8ec

SHA1
73a4451c1f229a29e27e10b6926d3a5244f04c7e

SHA256
b4ae8e803c5e9a3a13b896877497bb5b5c0f8c7cc81ee056bae216c5e7f5a98b

SHA512
c41d5e31ff7098d2adbe9d73afd5601dba6f7c9558b0676b344fe2d169eb6cbf1ff95e14253eb1ca0ae4b2600d2a1a6729e24e836aa86e1bde20f7300fcb55c8

Download Submit
C:\Windows\system\ArbLPNW.exe

Filesize
1.4MB

MD5
90a5eda8b614f449e7c18886ab0020e1

SHA1
808c9adb71f228780e2ff0729940c05c8663e3a0

SHA256
aa0e21f6d9a2f5d87b720db82f96aa6f36d5e18d0cf5912ba6cec58c9aba48a9

SHA512
79017699e12872fcea111f2884cf2839b4e19f0fbf6c472baf1477ded123117fb8602622795382a015b41ec98cc4e4e0e43e04df610ccd88375b79fa14ef04bc

Download Submit
C:\Windows\system\EQcOvPl.exe

Filesize
1.4MB

MD5
21b688e243a8e5abe64ae3a77fa3b454

SHA1
86ddf6abf1bdc31d3416ec6c3c68303e0677a3ad

SHA256
895f0793f661abef663f03200e0a754317dd1615958df9900fb69090b704c2c6

SHA512
ac45bf99f2dc66906ff7b9821221d03453d8152455ae34be2bb3395f3f0e68a4c5cff9143ef8fe61315bf36f2d7d6b2ee3456a68744cc0ddc1a7cdca1b368bd0

Download Submit
C:\Windows\system\HCqQHKG.exe

Filesize
1.4MB

MD5
623c15e0e8b2894dee5925a86a8cc681

SHA1
1a09df9ac0724309e6fb670c26180f34cca9b025

SHA256
dcdb9551d69e25531e9ba5243876e9d48af7aaf3d5a88178d0d08975bae95a6e

SHA512
098dbb1acb4d2fbfb73a18874235bd1e41612e649ad6bb1f0ae6b13497ac2276a42c912847a5fc17b3b32f8d0064552a5e73efdd76e649c8942e349b48b07c00

Download Submit
C:\Windows\system\IxYykqf.exe

Filesize
1.4MB

MD5
2b54efcb81e9de5104db40d43def14b8

SHA1
c195872d5a1cf3e4d53faefda792a952740b1c3e

SHA256
7e9cca57c2e97d6d7705d1d8feb21e70fdf8d5f43226dc66986b2cb82e8cdf60

SHA512
900a42b36c0af3ad757a8b8d0db15d8cfd3b3f166ae0ef7e9bcb41204f6d58cfde861e2a81a8e99541395fa8d3b642004b25743ff88dd25aaaa51dd68a295457

Download Submit
C:\Windows\system\JpwujoH.exe

Filesize
1.4MB

MD5
8dbb7bf0ca2296bf1591dcc98e8a6f4a

SHA1
8862416bf39db66bd1386d9d778d3c29e1c4b828

SHA256
f8221bbdb117fc6d6efda4e70d860954f76846a10161de6917c433ce40962aae

SHA512
2a0ad17b2a9bcb9516accca7cf96fc5448d55795ef6e293a2cd734b4f23fc3ea939f2fdee707c4786b06e36934c35a13c49c891149c6747a61548bb2e12b04c2

Download Submit
C:\Windows\system\LlcxvFL.exe

Filesize
1.4MB

MD5
8a04b6403a5225ed2d177954c2c35b2c

SHA1
f0b154faa2ddb524d098506a5887005b75745027

SHA256
c742969feb5b6280a8e52fb897dc879cc86326db46487617e99e347742746043

SHA512
842a28dc1d72c0b056e8130c85ab83a98a3e1e5bc279f1ebc54e7c1824061182ed03ef9a7803cce40611e3d22d30431190f8b1d928c2af3fc3573b944d95d04e

Download Submit
C:\Windows\system\NgrFrfS.exe

Filesize
1.4MB

MD5
5d3d62c5f2aff645b8f9d8e4f2bb689f

SHA1
9422713acc8961411eafa7fa0c1fd465a41efcd6

SHA256
03ac55a863ffbe59aded3494eb768c1ef94f8e05ec06f17c8d64cd4484a6e200

SHA512
55b4ffb1660b97ff4c61124b37f3740067091a41029908dd60f01e0484cf8f04942aef0c5d36c32ee9b9d1acc0f35f0350bc03679a0a3b7b23e078ab03c31fcc

Download Submit
C:\Windows\system\PJosjII.exe

Filesize
1.4MB

MD5
ee6882a1f8ef9ecf0ce1dd1cf17162e3

SHA1
4f71139aa1860306c991a7a99065830027011194

SHA256
93140495bb4f743538c8c6c480ab034bf22a1ee8392e60ad82814a23843800a6

SHA512
f5fab58313c2f5adf06783fc0e996bed365011f9d281f97b1298fa605e6914c91d8e1d4c2fc6be2e4accdb7e9f4c8835b9e4dc22243c4238584d9af5a46ca7b0

Download Submit
C:\Windows\system\QfCvrrz.exe

Filesize
1.4MB

MD5
41550c1742ac34ed5c45ab7e4853d19a

SHA1
08d98fb7ae3dc32550b8dcaffb6dba912b23b9bc

SHA256
c3bde77169efca9e6b27e48004ee79ccb3a560a2e44083c5392dd621e5322a6e

SHA512
43bedff86091e0f004e3a01fd8bfe60ced4881723ae32de5c00ccc9d90d71ab3c42f7d998b025d0e0ba7971a697aaba8f86f16af26813c794d007d793afe42c4

Download Submit
C:\Windows\system\RlkunLN.exe

Filesize
1.4MB

MD5
1f112ed10f197845a3347000c4670d0d

SHA1
c0320f3d10e5994f572990cfd3232b2161b13475

SHA256
3b8c98ce8e28bba6ade8f10389e12c89133f1eed943a083c3d9198ec526b447f

SHA512
ff8edbea82519a69aba824073e4c857e51c8ead6a5968db99006c9344158244909f62a4e4a211f99b3b90059b9e254554a21d6248e46f751c6d07bd7bd6087b5

Download Submit
C:\Windows\system\RnXiKJC.exe

Filesize
1.4MB

MD5
d29e52d29a4d261a3017170121d0e861

SHA1
2f2d9c2dc75233409b039737b69e7fbd48103a53

SHA256
b5ff90b35bc74f91c9274d74997a05a5bd9f7d86d3e268e09f464a00028b5922

SHA512
1b0494664adbf50609d4a7fe972d27b3643c401faea7c7ee14eede84d51fabb96696247e4f012ee7a2dd8d854665b6a3e0116ad153106647d2f112ebfe366318

Download Submit
C:\Windows\system\SfsDfIz.exe

Filesize
1.4MB

MD5
268d1eb8cbf0cc43f04c1c91ef2d498d

SHA1
9c805a5262478b58d5c8902251ad272ba5eab68f

SHA256
b247fdb1181d12f5841cced18b6add7abd6231e21c419a74b751673549d5e2b5

SHA512
8f03339274d570ad3c3251ab82bab73445481e7f028acb4e1a95db87ae0a903fbd3387962fc899f8204fcaab2a34ec73f71ab6ab08587148b7bbae33698086a4

Download Submit
C:\Windows\system\URnLsYF.exe

Filesize
1.4MB

MD5
570f7d72699b08e28c5518af9db3a5b7

SHA1
64d2c635c9be5c4addc34a2d35f8e973d8db182b

SHA256
8c2ac7de49c3ff911ca60249e186eb296bdfdb103d354c9be79d38245f03da1a

SHA512
29b0bbc1624a7eb029df4ed14d0986ee37f37e513e00e6a41f3d982614cdf73a4c2b3365c2b75e93f3c83f2d7bdcb7795cd410ce1dea2cabf96ff972168c3f7b

Download Submit
C:\Windows\system\UgvWwCp.exe

Filesize
1.4MB

MD5
98e74f392b5e5bcb6bb83da320b0b08e

SHA1
c57dcf14e7b34d20cf3d3842edde17b2ea894160

SHA256
348c683ce01648a3277543e4a3fe587b0e502acb872faa5f818e89c727706614

SHA512
e7bbf5313cdba7251101fa045598268ff56da582d9dffd334e7a31eb895108300b3fbed22e4c24f9086457845293e5872071118a24b83f42ffdacfccfec32ac2

Download Submit
C:\Windows\system\VcqQKDD.exe

Filesize
1.4MB

MD5
ecbc8332099f3a56eb5a13a5a52ad07f

SHA1
d25918689d50438154ec64fcd81404cc44dc1e30

SHA256
de4f92c0f8b1e2e14a329cf96aa981763aecc6b2a7a610ae4fc1d063c08b2310

SHA512
0e2d886509a253831f10a0549604d7ccd845a00ebdea087fb757cc570355d587e55f7298b07a8c679a3dcb865d99e5b1ac277e48f4cabd205e98efe7d6d9a73c

Download Submit
C:\Windows\system\WZvrgOD.exe

Filesize
1.4MB

MD5
b9cea753736ec11ec3408f9d4aa411d7

SHA1
90378aa06d68886f63e03d272d61d6426b323f4d

SHA256
cb270ce42dff70e27db10bf8c8af82781ae93a447196d15abf9b00b8f7149dfd

SHA512
b4a4a1414eb5a3b2e9313ae87d96b7190e6bc980590c7dc86a82d06e1786845dd2770bd7f7789599f96a619c30641d2db6a694883537d1890a02d19cc2c02a73

Download Submit
C:\Windows\system\YxkoMQP.exe

Filesize
1.4MB

MD5
5de4f4f029e0693c2c92298ce9814021

SHA1
61180b6a13e7a16c6909be39c24c8c293408e19d

SHA256
342fea43b63c488f2e01d59299cf5a8f4d8da372b4528f2df5fc29ad39b9557e

SHA512
388a0f69be0dc8de8ce3cdc2bc9f14400dea7f1e2c2e7a233abaaa78011adc1d5ab2f339f02e6e9e03d766baaf3cd51e83ee297b6218863ebe019c570fd1c679

Download Submit
C:\Windows\system\aDnCnwn.exe

Filesize
1.4MB

MD5
60db86675c8d0d136f1199897842b145

SHA1
d978ff58ba1db7cdb34ca007917dec069a76dec8

SHA256
9a6a7f7f25166d7dfd89d5e15098b34e5130bf6fd0ede6498741b4499b9efef2

SHA512
2bc9b7524bab5d9b96edb873e4cf26a92f435716b2aa48baa0fe2ec5a965ec5d86c0e5f4db1bbb5cf5ef1517966cfb8cc9acc680097a62dcada30b2640710dbe

Download Submit
C:\Windows\system\ascqaXG.exe

Filesize
1.4MB

MD5
c972da0f205fc8ffcea24da158a590c8

SHA1
96f6cb9f5b413c15525f755ca9353891a4b69a13

SHA256
373797ee29790d1577afc1c9d98ce9ed1d0071dc11e3952051ab6324afda59ac

SHA512
837b51a0c1418d67b6641012557031a489771e1f51bbdade1f50065637f53973d6b78fdccb76a1ad6a425c824f1d57732952688b62b85a7061f8aea9d90f2219

Download Submit
C:\Windows\system\eXMWBuG.exe

Filesize
1.4MB

MD5
4dfe2e4d9bcdedb4afb9dc423b5d6754

SHA1
574b997edf152a687b060fb6b2d7172e70146f88

SHA256
355144851d06eda2bf0867cca47f6d5ead544d143de1ce8a9879cdea9bc7f9a8

SHA512
fa9c17ddeadf8900d0008a9dd7fd6ad4833b5f50830a18acc8c9634333fb6fe46ac17d08dceffb147445784864b94040f88b6f2c73f4ecff357970ac5baccecd

Download Submit
C:\Windows\system\fBwTonn.exe

Filesize
1.4MB

MD5
a86d85f87ff33449ccc87a92d5514b66

SHA1
85b035cd37d11ea83e133261d50a4d9cad8ac448

SHA256
e443eca3a06697100b0f2d295bdc0660a0fa4f38cc27ccc5267c0be8646dff81

SHA512
f200d8194f51086e75933eb0cc16a618973852969ee70217a931288e31eedd5e6a7b6dc208b2eba1f22e6fb7d71c346d1ea8fd136a75cc3b588e58eea63009ec

Download Submit
C:\Windows\system\gyRLave.exe

Filesize
1.4MB

MD5
18a1157cfaa5ff4b96f19d3776137726

SHA1
be9e591fdf5b5271cc60ca6e6af7d58d4e75cd79

SHA256
8a9fbf2e75129d8a877d5affb6901df8f249d62c62550e8d077fe4a867f0ae94

SHA512
b1c288121a3a7630ffa291265be43c9ccc707c9ed8aa4a3e4d17d1024bb7a283e710728be74f183fb702c6a7f6f72e26485a41d071e89f5d392b0b878243307a

Download Submit
C:\Windows\system\hudququ.exe

Filesize
1.4MB

MD5
2e5d5b6a6d226640dd5e4fff9a13aad1

SHA1
46190a3a1772e7d161f21ec43d9bd3cbcd62cb16

SHA256
ec2e8a19fb00959e4d7a74e815c218780abda6509c1517fdc12cccc6df4cb33c

SHA512
97bb4bc3f836b5ae5f0a2095c231026e6a4e552f4848276da52f56e463d9ff916088ee80b33bd8017802046573b3e4d7496c5a84173797759c8e1686bc058567

Download Submit
C:\Windows\system\jsVbIrd.exe

Filesize
1.4MB

MD5
ccb098818ac020090394b44761161d84

SHA1
212349c21ce957abc0c82005904d1d0ed2a2bd30

SHA256
354067fdb68ecc349f5b816469206fca3e5f6ce3c9654ea874dd0866a996d2f1

SHA512
787e44bf8df48936bfbb1b38ceadf2fc1cbf6a69bf471c0fcae9f877fd045c6199b3ad021131a0fc134478c7f98c4e8379f8896950977cc035bc002f079e3a37

Download Submit
C:\Windows\system\mNXVIfZ.exe

Filesize
1.4MB

MD5
4b45ce920fab556c0f04fb9aeced7482

SHA1
bd37eb7f36799367248ab94d7e08c479556e5072

SHA256
fbf72926c9773e47e4faddd78961dbcd7e691656d428b4b617204d75d7a4dc30

SHA512
b99123e1ea5f59f93e6480c80df9da296da27ca2028633de7eaa2a9c524b787b9ddac8bffb09c01cf2512b10fdd0618affdd27e2b6b831cd96c02b5a44adeec4

Download Submit
C:\Windows\system\qvldHsT.exe

Filesize
1.4MB

MD5
b468746cc5385b1674e70e0205a4dba2

SHA1
ae7a040675579ba66d9e1d1df66afdae73bd09fd

SHA256
3ad51de4f4250709d30f5000fa188112802e15e6b9ce69e2b31925b371c70bed

SHA512
a5d8aa886db831729f547e00b33ea63d33f907e7364df319d8578cadcf6e8421729dd0e13e19aefdd2bf5228716b638e8dd51a30f902d72862a8a966abd6c0a7

Download Submit
C:\Windows\system\rGVvrFF.exe

Filesize
1.4MB

MD5
8653eb19e15ffb035195fe11038df42c

SHA1
2dba6b2a3cd472921d67b4ff5e019642f985478d

SHA256
56d0ff43eca99506114ae54f94da476b6f9756e73e62bb45ee963aac45d1caac

SHA512
1867726e8a8809fc47e77a8d8ca8a52e80034a4073e07580ee0689f849c3aba6e80c1f7c3ffc7ae2c907b34a600123db7379240975633c08612a5b66cd3af738

Download Submit
C:\Windows\system\xXodwnD.exe

Filesize
1.4MB

MD5
36f07c46ed6f1bb335bcf7b7e12d14c1

SHA1
62ddae4e3fe42a9e14673d3ff24956dae3a0e4e9

SHA256
a71be12c1106a487193c0e782bc070d2fe79ac30853d8abfa694bafc650f2627

SHA512
18e690a03eea93d61e47243fbf6d7de12fbc0e45a30182a4d33b1a22440d8ce1430eed0c3eb186ce4ab1a283c89ed125f64c58250f2527578324b0dfe026dee7

Download Submit
C:\Windows\system\zfgtzCE.exe

Filesize
1.4MB

MD5
9a31c38bdf1cbf8402d9afc1959c1dba

SHA1
1391f17b5fb8de1c67e3798de308843e33b5fc6b

SHA256
7ac0e9ecd5286398538c64b9fde4f27f56312a47e61b48ba4cef22b4b2979d62

SHA512
6c8b7cfe2ab0a4d38e52b81e1c7dadbc4ce6bfca22e2786eb4ce55dc79bd83cad8916cd5acacbad9f6a91cf86e52f4a2f1e73687178659cdfd05eba93a21e458

Download Submit
\Windows\system\VrEiHDI.exe

Filesize
1.4MB

MD5
51359d9d8aea9cff0a285aeff00a8c5e

SHA1
9e1815949236a5b7ad5425d00038171c515a6a3c

SHA256
78dd80cade4d22378026f8bb5f17feec0baf6120700544ed25cfb6f654ad5cb4

SHA512
34419225628e907d4610038e6ff6134bc6fb23badffb0617a71a19871503f83b8bf1145947f0b7006fd358194c08a80fa3c1a68a22147dbe0d833556752e0e13

Download Submit
memory/2896-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download