xmrig | 05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
Size

1.3MB
MD5

061dd27093562efc7ae86b798adaf49e
SHA1

c80a73ec5ab999724402ae8fea65c117c6c12aa2
SHA256

05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0
SHA512

8612716fab72513eb4d8e23ac43085dfcff166d53dc3505c47b847af05966a029e7dc0f1c076b6af946ff38f0f39928a4e29967e155c0329e3f1657634c7c71f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPOdsAayCi7EG9LM:GezaTF8FcNkNdfE0pZ9ozttwIRRSAJsh

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001225c-5.dat	xmrig
behavioral1/files/0x0009000000016ace-6.dat	xmrig
behavioral1/files/0x00050000000195bd-129.dat	xmrig
behavioral1/files/0x00050000000195bb-125.dat	xmrig
behavioral1/files/0x00050000000195b7-121.dat	xmrig
behavioral1/files/0x00050000000195b5-118.dat	xmrig
behavioral1/files/0x00050000000195b3-113.dat	xmrig
behavioral1/files/0x00050000000195b1-110.dat	xmrig
behavioral1/files/0x00050000000195af-105.dat	xmrig
behavioral1/files/0x00050000000195ad-102.dat	xmrig
behavioral1/files/0x00050000000195ab-97.dat	xmrig
behavioral1/files/0x00050000000195a9-94.dat	xmrig
behavioral1/files/0x00050000000195a7-89.dat	xmrig
behavioral1/files/0x000500000001957c-85.dat	xmrig
behavioral1/files/0x0005000000019547-81.dat	xmrig
behavioral1/files/0x0005000000019515-77.dat	xmrig
behavioral1/files/0x000500000001950f-73.dat	xmrig
behavioral1/files/0x00050000000194ef-69.dat	xmrig
behavioral1/files/0x00050000000194eb-65.dat	xmrig
behavioral1/files/0x00050000000194a3-61.dat	xmrig
behavioral1/files/0x0005000000019490-57.dat	xmrig
behavioral1/files/0x000500000001948c-53.dat	xmrig
behavioral1/files/0x0005000000019489-50.dat	xmrig
behavioral1/files/0x0005000000019470-41.dat	xmrig
behavioral1/files/0x0005000000019480-45.dat	xmrig
behavioral1/files/0x00060000000193c7-37.dat	xmrig
behavioral1/files/0x000c000000016458-34.dat	xmrig
behavioral1/files/0x0002000000018334-30.dat	xmrig
behavioral1/files/0x0009000000016fc9-25.dat	xmrig
behavioral1/files/0x0007000000016c23-22.dat	xmrig
behavioral1/files/0x0007000000016c1a-18.dat	xmrig
behavioral1/files/0x0007000000016c10-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2180	uEbLaKI.exe
644	MmlWVyh.exe
3020	jCAiPZo.exe
2952	JOZnbfX.exe
2512	YfVaUmB.exe
2776	ZyZCOfp.exe
2824	OmShRmF.exe
2920	ueilVuK.exe
2820	vebFAHU.exe
2900	IxGWgcC.exe
1664	SEulckk.exe
2300	mpgfAKX.exe
2888	gFhIIHm.exe
2664	sWcHHsr.exe
2732	GIwyDVN.exe
2220	HXgQgWu.exe
772	kAnzIAP.exe
1080	BXuUEns.exe
1372	AgfXPrS.exe
2764	lvQiqkX.exe
2092	hDljDPL.exe
576	xuFZCSh.exe
544	WJaszRU.exe
2916	tZnHbPZ.exe
2076	dqvnPMA.exe
1904	llbtNHI.exe
2968	KGZPGEm.exe
3008	maszCXr.exe
776	ymwdwWC.exe
2108	tdRkUIG.exe
1676	vrzzzdA.exe
2252	AqUuBQh.exe
1708	DxgRazy.exe
2464	eFniQFy.exe
2100	vGNxqCC.exe
1376	JBDdwYo.exe
2548	fLbxNNI.exe
3044	qnksdsF.exe
2416	HYVYdKK.exe
2408	DlzjyLi.exe
460	qVblQug.exe
2568	crZlJER.exe
1712	gdhYPdI.exe
712	tolLftt.exe
2320	wdFBmsr.exe
2564	dAkizDa.exe
2064	zeNllKe.exe
604	CwLKTHp.exe
960	NqIZOUZ.exe
1084	ghgKDSe.exe
2224	TzFeneN.exe
1840	NgrVKpK.exe
2032	CdlMtOw.exe
1572	iILLLWJ.exe
1960	wJoTXEQ.exe
1816	cWMGxrB.exe
856	BRwQJgs.exe
2276	wXneHRF.exe
932	yUgQKvz.exe
2036	GNVqLTy.exe
1520	jMEiajR.exe
788	IQPbILE.exe
1936	cyUhCRl.exe
2268	OZFWtJh.exe

Loads dropped DLL 64 IoCs

pid	Process
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gvvqcrk.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\fCUwxez.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\cQozxso.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\qvXpxNW.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\FZazPwP.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\VlCVOLS.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\FfcjqCI.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\nNeovRe.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\rRYxDXm.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\xVuGWLe.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\DafsFLb.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\RqzdbpM.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\jTVkKkw.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\Jbjbmji.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\jtrXJpN.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\iiRBsKk.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\sfXcTPZ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\ZAsQCax.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\dsZzzim.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\FZtNlQR.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\PKSzdrp.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\vpPmTsF.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\oiiQhXB.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\tDCJgIG.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\MXCBaOb.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\yhSTYmT.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\AYriBtB.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\cGyIcee.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\AGnySJX.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\hGxbbup.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\KlebQSx.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\DiQdiUV.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\OwzYAIm.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\uUjIuAi.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\OzfxlSQ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\VruLJeZ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\kQsxncZ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\jRrtkYL.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\JBvpaFC.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\CwLKTHp.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\fHRERye.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\dCDFKKZ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\wMyhJeR.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\qPyPtnW.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\XkmtVMC.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\ZrpzGwZ.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\DTzLfvN.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\XCecRfq.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\YJNXzYu.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\fYOEKkT.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\gNKHbho.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\aoeOfdq.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\mqxiGhA.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\cWMGxrB.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\ygkWjTG.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\jIWdysp.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\lyIyuml.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\Yqagljl.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\QnbyAYp.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\FgdSrnf.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\ybVtGRg.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\AQpvEyP.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\IiVgEWq.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
File created	C:\Windows\System\SfVdBOj.exe	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2180	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	30
PID 2396 wrote to memory of 2180	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	30
PID 2396 wrote to memory of 2180	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	30
PID 2396 wrote to memory of 644	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	31
PID 2396 wrote to memory of 644	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	31
PID 2396 wrote to memory of 644	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	31
PID 2396 wrote to memory of 3020	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	32
PID 2396 wrote to memory of 3020	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	32
PID 2396 wrote to memory of 3020	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	32
PID 2396 wrote to memory of 2952	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	33
PID 2396 wrote to memory of 2952	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	33
PID 2396 wrote to memory of 2952	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	33
PID 2396 wrote to memory of 2512	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	34
PID 2396 wrote to memory of 2512	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	34
PID 2396 wrote to memory of 2512	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	34
PID 2396 wrote to memory of 2776	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	35
PID 2396 wrote to memory of 2776	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	35
PID 2396 wrote to memory of 2776	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	35
PID 2396 wrote to memory of 2824	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	36
PID 2396 wrote to memory of 2824	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	36
PID 2396 wrote to memory of 2824	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	36
PID 2396 wrote to memory of 2920	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	37
PID 2396 wrote to memory of 2920	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	37
PID 2396 wrote to memory of 2920	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	37
PID 2396 wrote to memory of 2820	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	38
PID 2396 wrote to memory of 2820	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	38
PID 2396 wrote to memory of 2820	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	38
PID 2396 wrote to memory of 2900	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	39
PID 2396 wrote to memory of 2900	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	39
PID 2396 wrote to memory of 2900	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	39
PID 2396 wrote to memory of 1664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	40
PID 2396 wrote to memory of 1664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	40
PID 2396 wrote to memory of 1664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	40
PID 2396 wrote to memory of 2300	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	41
PID 2396 wrote to memory of 2300	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	41
PID 2396 wrote to memory of 2300	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	41
PID 2396 wrote to memory of 2888	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	42
PID 2396 wrote to memory of 2888	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	42
PID 2396 wrote to memory of 2888	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	42
PID 2396 wrote to memory of 2664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	43
PID 2396 wrote to memory of 2664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	43
PID 2396 wrote to memory of 2664	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	43
PID 2396 wrote to memory of 2732	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	44
PID 2396 wrote to memory of 2732	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	44
PID 2396 wrote to memory of 2732	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	44
PID 2396 wrote to memory of 2220	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	45
PID 2396 wrote to memory of 2220	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	45
PID 2396 wrote to memory of 2220	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	45
PID 2396 wrote to memory of 772	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	46
PID 2396 wrote to memory of 772	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	46
PID 2396 wrote to memory of 772	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	46
PID 2396 wrote to memory of 1080	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	47
PID 2396 wrote to memory of 1080	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	47
PID 2396 wrote to memory of 1080	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	47
PID 2396 wrote to memory of 1372	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	48
PID 2396 wrote to memory of 1372	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	48
PID 2396 wrote to memory of 1372	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	48
PID 2396 wrote to memory of 2764	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	49
PID 2396 wrote to memory of 2764	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	49
PID 2396 wrote to memory of 2764	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	49
PID 2396 wrote to memory of 2092	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	50
PID 2396 wrote to memory of 2092	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	50
PID 2396 wrote to memory of 2092	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	50
PID 2396 wrote to memory of 576	2396	05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe	51

C:\Users\Admin\AppData\Local\Temp\05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe
"C:\Users\Admin\AppData\Local\Temp\05457c35c7f7f32ba8a2166bbd120393dbc3145ec01ba8cb66453544bac54aa0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System\uEbLaKI.exe
  C:\Windows\System\uEbLaKI.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\MmlWVyh.exe
  C:\Windows\System\MmlWVyh.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\jCAiPZo.exe
  C:\Windows\System\jCAiPZo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\JOZnbfX.exe
  C:\Windows\System\JOZnbfX.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\YfVaUmB.exe
  C:\Windows\System\YfVaUmB.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZyZCOfp.exe
  C:\Windows\System\ZyZCOfp.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\OmShRmF.exe
  C:\Windows\System\OmShRmF.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ueilVuK.exe
  C:\Windows\System\ueilVuK.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\vebFAHU.exe
  C:\Windows\System\vebFAHU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\IxGWgcC.exe
  C:\Windows\System\IxGWgcC.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\SEulckk.exe
  C:\Windows\System\SEulckk.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\mpgfAKX.exe
  C:\Windows\System\mpgfAKX.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\gFhIIHm.exe
  C:\Windows\System\gFhIIHm.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\sWcHHsr.exe
  C:\Windows\System\sWcHHsr.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\GIwyDVN.exe
  C:\Windows\System\GIwyDVN.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\HXgQgWu.exe
  C:\Windows\System\HXgQgWu.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\kAnzIAP.exe
  C:\Windows\System\kAnzIAP.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\BXuUEns.exe
  C:\Windows\System\BXuUEns.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\AgfXPrS.exe
  C:\Windows\System\AgfXPrS.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\lvQiqkX.exe
  C:\Windows\System\lvQiqkX.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\hDljDPL.exe
  C:\Windows\System\hDljDPL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\xuFZCSh.exe
  C:\Windows\System\xuFZCSh.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\WJaszRU.exe
  C:\Windows\System\WJaszRU.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\tZnHbPZ.exe
  C:\Windows\System\tZnHbPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\dqvnPMA.exe
  C:\Windows\System\dqvnPMA.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\llbtNHI.exe
  C:\Windows\System\llbtNHI.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\KGZPGEm.exe
  C:\Windows\System\KGZPGEm.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\maszCXr.exe
  C:\Windows\System\maszCXr.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ymwdwWC.exe
  C:\Windows\System\ymwdwWC.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\tdRkUIG.exe
  C:\Windows\System\tdRkUIG.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\vrzzzdA.exe
  C:\Windows\System\vrzzzdA.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\AqUuBQh.exe
  C:\Windows\System\AqUuBQh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\DxgRazy.exe
  C:\Windows\System\DxgRazy.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\eFniQFy.exe
  C:\Windows\System\eFniQFy.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vGNxqCC.exe
  C:\Windows\System\vGNxqCC.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\JBDdwYo.exe
  C:\Windows\System\JBDdwYo.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\fLbxNNI.exe
  C:\Windows\System\fLbxNNI.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\qnksdsF.exe
  C:\Windows\System\qnksdsF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\HYVYdKK.exe
  C:\Windows\System\HYVYdKK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\DlzjyLi.exe
  C:\Windows\System\DlzjyLi.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\qVblQug.exe
  C:\Windows\System\qVblQug.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\crZlJER.exe
  C:\Windows\System\crZlJER.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\gdhYPdI.exe
  C:\Windows\System\gdhYPdI.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\tolLftt.exe
  C:\Windows\System\tolLftt.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\wdFBmsr.exe
  C:\Windows\System\wdFBmsr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dAkizDa.exe
  C:\Windows\System\dAkizDa.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zeNllKe.exe
  C:\Windows\System\zeNllKe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\CwLKTHp.exe
  C:\Windows\System\CwLKTHp.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\NqIZOUZ.exe
  C:\Windows\System\NqIZOUZ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ghgKDSe.exe
  C:\Windows\System\ghgKDSe.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\TzFeneN.exe
  C:\Windows\System\TzFeneN.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\NgrVKpK.exe
  C:\Windows\System\NgrVKpK.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\CdlMtOw.exe
  C:\Windows\System\CdlMtOw.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\iILLLWJ.exe
  C:\Windows\System\iILLLWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\wJoTXEQ.exe
  C:\Windows\System\wJoTXEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\cWMGxrB.exe
  C:\Windows\System\cWMGxrB.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BRwQJgs.exe
  C:\Windows\System\BRwQJgs.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\wXneHRF.exe
  C:\Windows\System\wXneHRF.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\yUgQKvz.exe
  C:\Windows\System\yUgQKvz.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\GNVqLTy.exe
  C:\Windows\System\GNVqLTy.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\jMEiajR.exe
  C:\Windows\System\jMEiajR.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\IQPbILE.exe
  C:\Windows\System\IQPbILE.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\cyUhCRl.exe
  C:\Windows\System\cyUhCRl.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\OZFWtJh.exe
  C:\Windows\System\OZFWtJh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\VfaXnea.exe
  C:\Windows\System\VfaXnea.exe
  2⤵
  PID:1692
- C:\Windows\System\MbjdAOO.exe
  C:\Windows\System\MbjdAOO.exe
  2⤵
  PID:2640
- C:\Windows\System\oXEOXtu.exe
  C:\Windows\System\oXEOXtu.exe
  2⤵
  PID:2596
- C:\Windows\System\UkevqAf.exe
  C:\Windows\System\UkevqAf.exe
  2⤵
  PID:2428
- C:\Windows\System\IQJquwJ.exe
  C:\Windows\System\IQJquwJ.exe
  2⤵
  PID:1184
- C:\Windows\System\rzkiloq.exe
  C:\Windows\System\rzkiloq.exe
  2⤵
  PID:892
- C:\Windows\System\qVlOQMp.exe
  C:\Windows\System\qVlOQMp.exe
  2⤵
  PID:3064
- C:\Windows\System\HRIsvCG.exe
  C:\Windows\System\HRIsvCG.exe
  2⤵
  PID:804
- C:\Windows\System\nFeWFVG.exe
  C:\Windows\System\nFeWFVG.exe
  2⤵
  PID:2612
- C:\Windows\System\HbEAVCg.exe
  C:\Windows\System\HbEAVCg.exe
  2⤵
  PID:1624
- C:\Windows\System\duMBPSQ.exe
  C:\Windows\System\duMBPSQ.exe
  2⤵
  PID:1628
- C:\Windows\System\QSqXZJY.exe
  C:\Windows\System\QSqXZJY.exe
  2⤵
  PID:2176
- C:\Windows\System\waOOhuz.exe
  C:\Windows\System\waOOhuz.exe
  2⤵
  PID:2856
- C:\Windows\System\PWdOxhM.exe
  C:\Windows\System\PWdOxhM.exe
  2⤵
  PID:2520
- C:\Windows\System\KuVdgrq.exe
  C:\Windows\System\KuVdgrq.exe
  2⤵
  PID:2880
- C:\Windows\System\aFtncuS.exe
  C:\Windows\System\aFtncuS.exe
  2⤵
  PID:3032
- C:\Windows\System\FzEdzbz.exe
  C:\Windows\System\FzEdzbz.exe
  2⤵
  PID:2896
- C:\Windows\System\GrnNhEF.exe
  C:\Windows\System\GrnNhEF.exe
  2⤵
  PID:2804
- C:\Windows\System\BWkxLLx.exe
  C:\Windows\System\BWkxLLx.exe
  2⤵
  PID:1644
- C:\Windows\System\onZRBWI.exe
  C:\Windows\System\onZRBWI.exe
  2⤵
  PID:2740
- C:\Windows\System\dCDFKKZ.exe
  C:\Windows\System\dCDFKKZ.exe
  2⤵
  PID:1192
- C:\Windows\System\BLRCbyp.exe
  C:\Windows\System\BLRCbyp.exe
  2⤵
  PID:2912
- C:\Windows\System\YudvlPP.exe
  C:\Windows\System\YudvlPP.exe
  2⤵
  PID:2504
- C:\Windows\System\jKXQwJw.exe
  C:\Windows\System\jKXQwJw.exe
  2⤵
  PID:1776
- C:\Windows\System\wSZxzVx.exe
  C:\Windows\System\wSZxzVx.exe
  2⤵
  PID:3052
- C:\Windows\System\zrtXJMu.exe
  C:\Windows\System\zrtXJMu.exe
  2⤵
  PID:2932
- C:\Windows\System\DgyjYAi.exe
  C:\Windows\System\DgyjYAi.exe
  2⤵
  PID:1792
- C:\Windows\System\mwNGNaJ.exe
  C:\Windows\System\mwNGNaJ.exe
  2⤵
  PID:1764
- C:\Windows\System\biULXvn.exe
  C:\Windows\System\biULXvn.exe
  2⤵
  PID:904
- C:\Windows\System\SySSFqe.exe
  C:\Windows\System\SySSFqe.exe
  2⤵
  PID:2556
- C:\Windows\System\ElnrOCh.exe
  C:\Windows\System\ElnrOCh.exe
  2⤵
  PID:2348
- C:\Windows\System\MxbLSRv.exe
  C:\Windows\System\MxbLSRv.exe
  2⤵
  PID:2668
- C:\Windows\System\jzGtRQg.exe
  C:\Windows\System\jzGtRQg.exe
  2⤵
  PID:1660
- C:\Windows\System\CXJBFOp.exe
  C:\Windows\System\CXJBFOp.exe
  2⤵
  PID:2700
- C:\Windows\System\qjZyhIl.exe
  C:\Windows\System\qjZyhIl.exe
  2⤵
  PID:2788
- C:\Windows\System\siaRtac.exe
  C:\Windows\System\siaRtac.exe
  2⤵
  PID:2784
- C:\Windows\System\eutgrCj.exe
  C:\Windows\System\eutgrCj.exe
  2⤵
  PID:2688
- C:\Windows\System\sLhUiKa.exe
  C:\Windows\System\sLhUiKa.exe
  2⤵
  PID:1388
- C:\Windows\System\ZBmXrjf.exe
  C:\Windows\System\ZBmXrjf.exe
  2⤵
  PID:2992
- C:\Windows\System\poRZnsj.exe
  C:\Windows\System\poRZnsj.exe
  2⤵
  PID:1508
- C:\Windows\System\NVjrAyE.exe
  C:\Windows\System\NVjrAyE.exe
  2⤵
  PID:1416
- C:\Windows\System\zPVGqiW.exe
  C:\Windows\System\zPVGqiW.exe
  2⤵
  PID:2964
- C:\Windows\System\tQULjyy.exe
  C:\Windows\System\tQULjyy.exe
  2⤵
  PID:840
- C:\Windows\System\eCEhmGB.exe
  C:\Windows\System\eCEhmGB.exe
  2⤵
  PID:1280
- C:\Windows\System\ttdQAkh.exe
  C:\Windows\System\ttdQAkh.exe
  2⤵
  PID:2188
- C:\Windows\System\ytaLQfU.exe
  C:\Windows\System\ytaLQfU.exe
  2⤵
  PID:2236
- C:\Windows\System\rXxXHMr.exe
  C:\Windows\System\rXxXHMr.exe
  2⤵
  PID:2552
- C:\Windows\System\QYygHPv.exe
  C:\Windows\System\QYygHPv.exe
  2⤵
  PID:236
- C:\Windows\System\ygkWjTG.exe
  C:\Windows\System\ygkWjTG.exe
  2⤵
  PID:2184
- C:\Windows\System\TqBxWVo.exe
  C:\Windows\System\TqBxWVo.exe
  2⤵
  PID:1736
- C:\Windows\System\lFGJCue.exe
  C:\Windows\System\lFGJCue.exe
  2⤵
  PID:1832
- C:\Windows\System\sXfkyIL.exe
  C:\Windows\System\sXfkyIL.exe
  2⤵
  PID:2648
- C:\Windows\System\yullhMm.exe
  C:\Windows\System\yullhMm.exe
  2⤵
  PID:1836
- C:\Windows\System\OITYFut.exe
  C:\Windows\System\OITYFut.exe
  2⤵
  PID:560
- C:\Windows\System\VzMIIBR.exe
  C:\Windows\System\VzMIIBR.exe
  2⤵
  PID:2480
- C:\Windows\System\rkwZIfJ.exe
  C:\Windows\System\rkwZIfJ.exe
  2⤵
  PID:2296
- C:\Windows\System\GCOEMIT.exe
  C:\Windows\System\GCOEMIT.exe
  2⤵
  PID:2796
- C:\Windows\System\FYDyzGy.exe
  C:\Windows\System\FYDyzGy.exe
  2⤵
  PID:1044
- C:\Windows\System\mLbWxnC.exe
  C:\Windows\System\mLbWxnC.exe
  2⤵
  PID:1404
- C:\Windows\System\MQwulAm.exe
  C:\Windows\System\MQwulAm.exe
  2⤵
  PID:2196
- C:\Windows\System\eEbwjxi.exe
  C:\Windows\System\eEbwjxi.exe
  2⤵
  PID:2940
- C:\Windows\System\nHpPkmK.exe
  C:\Windows\System\nHpPkmK.exe
  2⤵
  PID:2292
- C:\Windows\System\ZvToiGq.exe
  C:\Windows\System\ZvToiGq.exe
  2⤵
  PID:1028
- C:\Windows\System\uiWmKRu.exe
  C:\Windows\System\uiWmKRu.exe
  2⤵
  PID:1548
- C:\Windows\System\ZrrnHvv.exe
  C:\Windows\System\ZrrnHvv.exe
  2⤵
  PID:2440
- C:\Windows\System\uQRcDgd.exe
  C:\Windows\System\uQRcDgd.exe
  2⤵
  PID:1540
- C:\Windows\System\cAkYULe.exe
  C:\Windows\System\cAkYULe.exe
  2⤵
  PID:2836
- C:\Windows\System\AnIHIeq.exe
  C:\Windows\System\AnIHIeq.exe
  2⤵
  PID:2044
- C:\Windows\System\blhvYUX.exe
  C:\Windows\System\blhvYUX.exe
  2⤵
  PID:2684
- C:\Windows\System\KezqXaf.exe
  C:\Windows\System\KezqXaf.exe
  2⤵
  PID:1920
- C:\Windows\System\HbDLSfr.exe
  C:\Windows\System\HbDLSfr.exe
  2⤵
  PID:1552
- C:\Windows\System\JzFvOJs.exe
  C:\Windows\System\JzFvOJs.exe
  2⤵
  PID:1040
- C:\Windows\System\UlSdVOk.exe
  C:\Windows\System\UlSdVOk.exe
  2⤵
  PID:2996
- C:\Windows\System\ISJTyPw.exe
  C:\Windows\System\ISJTyPw.exe
  2⤵
  PID:2852
- C:\Windows\System\WghOjOa.exe
  C:\Windows\System\WghOjOa.exe
  2⤵
  PID:1300
- C:\Windows\System\XJOyIoa.exe
  C:\Windows\System\XJOyIoa.exe
  2⤵
  PID:912
- C:\Windows\System\nvGFivi.exe
  C:\Windows\System\nvGFivi.exe
  2⤵
  PID:1072
- C:\Windows\System\igsBlHo.exe
  C:\Windows\System\igsBlHo.exe
  2⤵
  PID:1560
- C:\Windows\System\qKhvMxr.exe
  C:\Windows\System\qKhvMxr.exe
  2⤵
  PID:2316
- C:\Windows\System\AuqgYhM.exe
  C:\Windows\System\AuqgYhM.exe
  2⤵
  PID:648
- C:\Windows\System\OkHtlfo.exe
  C:\Windows\System\OkHtlfo.exe
  2⤵
  PID:1092
- C:\Windows\System\aQfImoP.exe
  C:\Windows\System\aQfImoP.exe
  2⤵
  PID:2088
- C:\Windows\System\ooIEApS.exe
  C:\Windows\System\ooIEApS.exe
  2⤵
  PID:2216
- C:\Windows\System\fNEIuNV.exe
  C:\Windows\System\fNEIuNV.exe
  2⤵
  PID:2448
- C:\Windows\System\VxttqfS.exe
  C:\Windows\System\VxttqfS.exe
  2⤵
  PID:2592
- C:\Windows\System\pfQXXXB.exe
  C:\Windows\System\pfQXXXB.exe
  2⤵
  PID:1496
- C:\Windows\System\bVuptyG.exe
  C:\Windows\System\bVuptyG.exe
  2⤵
  PID:2540
- C:\Windows\System\cwzXNJR.exe
  C:\Windows\System\cwzXNJR.exe
  2⤵
  PID:1516
- C:\Windows\System\vAsipbT.exe
  C:\Windows\System\vAsipbT.exe
  2⤵
  PID:1992
- C:\Windows\System\zquvJPW.exe
  C:\Windows\System\zquvJPW.exe
  2⤵
  PID:2744
- C:\Windows\System\WCPcUvV.exe
  C:\Windows\System\WCPcUvV.exe
  2⤵
  PID:2584
- C:\Windows\System\PdNXDZS.exe
  C:\Windows\System\PdNXDZS.exe
  2⤵
  PID:2116
- C:\Windows\System\YFblmGZ.exe
  C:\Windows\System\YFblmGZ.exe
  2⤵
  PID:2212
- C:\Windows\System\fKcKsYW.exe
  C:\Windows\System\fKcKsYW.exe
  2⤵
  PID:2192
- C:\Windows\System\ZFpOTDo.exe
  C:\Windows\System\ZFpOTDo.exe
  2⤵
  PID:2636
- C:\Windows\System\rhquTQH.exe
  C:\Windows\System\rhquTQH.exe
  2⤵
  PID:1804
- C:\Windows\System\HTVkikx.exe
  C:\Windows\System\HTVkikx.exe
  2⤵
  PID:936
- C:\Windows\System\iEmhaOl.exe
  C:\Windows\System\iEmhaOl.exe
  2⤵
  PID:2712
- C:\Windows\System\bIshwLh.exe
  C:\Windows\System\bIshwLh.exe
  2⤵
  PID:2012
- C:\Windows\System\RAwFEob.exe
  C:\Windows\System\RAwFEob.exe
  2⤵
  PID:860
- C:\Windows\System\gJmoGSU.exe
  C:\Windows\System\gJmoGSU.exe
  2⤵
  PID:1668
- C:\Windows\System\XdPQNAi.exe
  C:\Windows\System\XdPQNAi.exe
  2⤵
  PID:2412
- C:\Windows\System\JIYNpPA.exe
  C:\Windows\System\JIYNpPA.exe
  2⤵
  PID:1996
- C:\Windows\System\xjyKQMl.exe
  C:\Windows\System\xjyKQMl.exe
  2⤵
  PID:1984
- C:\Windows\System\xbAYjeb.exe
  C:\Windows\System\xbAYjeb.exe
  2⤵
  PID:280
- C:\Windows\System\IwAXbOh.exe
  C:\Windows\System\IwAXbOh.exe
  2⤵
  PID:1756
- C:\Windows\System\CsLinuP.exe
  C:\Windows\System\CsLinuP.exe
  2⤵
  PID:1144
- C:\Windows\System\DrpONmw.exe
  C:\Windows\System\DrpONmw.exe
  2⤵
  PID:2628
- C:\Windows\System\dihcgLp.exe
  C:\Windows\System\dihcgLp.exe
  2⤵
  PID:540
- C:\Windows\System\XYZgkHu.exe
  C:\Windows\System\XYZgkHu.exe
  2⤵
  PID:1412
- C:\Windows\System\HmUJQGI.exe
  C:\Windows\System\HmUJQGI.exe
  2⤵
  PID:1716
- C:\Windows\System\OXNvXso.exe
  C:\Windows\System\OXNvXso.exe
  2⤵
  PID:1292
- C:\Windows\System\AxOGmja.exe
  C:\Windows\System\AxOGmja.exe
  2⤵
  PID:1972
- C:\Windows\System\MuNMZFj.exe
  C:\Windows\System\MuNMZFj.exe
  2⤵
  PID:2452
- C:\Windows\System\ijGFppQ.exe
  C:\Windows\System\ijGFppQ.exe
  2⤵
  PID:2168
- C:\Windows\System\bVhqFrr.exe
  C:\Windows\System\bVhqFrr.exe
  2⤵
  PID:2304
- C:\Windows\System\VrYLVPJ.exe
  C:\Windows\System\VrYLVPJ.exe
  2⤵
  PID:320
- C:\Windows\System\ujoESHE.exe
  C:\Windows\System\ujoESHE.exe
  2⤵
  PID:2424
- C:\Windows\System\TIOLgZi.exe
  C:\Windows\System\TIOLgZi.exe
  2⤵
  PID:3076
- C:\Windows\System\lGwYjwj.exe
  C:\Windows\System\lGwYjwj.exe
  2⤵
  PID:3096
- C:\Windows\System\ExXfqDv.exe
  C:\Windows\System\ExXfqDv.exe
  2⤵
  PID:3112
- C:\Windows\System\dRGgbEJ.exe
  C:\Windows\System\dRGgbEJ.exe
  2⤵
  PID:3136
- C:\Windows\System\hPyeoVP.exe
  C:\Windows\System\hPyeoVP.exe
  2⤵
  PID:3152
- C:\Windows\System\veYlmtB.exe
  C:\Windows\System\veYlmtB.exe
  2⤵
  PID:3176
- C:\Windows\System\APCjsJF.exe
  C:\Windows\System\APCjsJF.exe
  2⤵
  PID:3192
- C:\Windows\System\eUwNvSf.exe
  C:\Windows\System\eUwNvSf.exe
  2⤵
  PID:3212
- C:\Windows\System\aKszJXZ.exe
  C:\Windows\System\aKszJXZ.exe
  2⤵
  PID:3228
- C:\Windows\System\YQbHczl.exe
  C:\Windows\System\YQbHczl.exe
  2⤵
  PID:3244
- C:\Windows\System\euYyOjw.exe
  C:\Windows\System\euYyOjw.exe
  2⤵
  PID:3260
- C:\Windows\System\SGapqgS.exe
  C:\Windows\System\SGapqgS.exe
  2⤵
  PID:3276
- C:\Windows\System\apXrdHH.exe
  C:\Windows\System\apXrdHH.exe
  2⤵
  PID:3296
- C:\Windows\System\hJFyccm.exe
  C:\Windows\System\hJFyccm.exe
  2⤵
  PID:3312
- C:\Windows\System\AGEKgvy.exe
  C:\Windows\System\AGEKgvy.exe
  2⤵
  PID:3332
- C:\Windows\System\ZAllPnD.exe
  C:\Windows\System\ZAllPnD.exe
  2⤵
  PID:3348
- C:\Windows\System\lraeXlO.exe
  C:\Windows\System\lraeXlO.exe
  2⤵
  PID:3372
- C:\Windows\System\nieMCGf.exe
  C:\Windows\System\nieMCGf.exe
  2⤵
  PID:3412
- C:\Windows\System\ykEsLUV.exe
  C:\Windows\System\ykEsLUV.exe
  2⤵
  PID:3432
- C:\Windows\System\wlKvHmZ.exe
  C:\Windows\System\wlKvHmZ.exe
  2⤵
  PID:3472
- C:\Windows\System\RmmrQcN.exe
  C:\Windows\System\RmmrQcN.exe
  2⤵
  PID:3488
- C:\Windows\System\CDcNJSr.exe
  C:\Windows\System\CDcNJSr.exe
  2⤵
  PID:3504
- C:\Windows\System\EMqFTbe.exe
  C:\Windows\System\EMqFTbe.exe
  2⤵
  PID:3524
- C:\Windows\System\pgpzJdD.exe
  C:\Windows\System\pgpzJdD.exe
  2⤵
  PID:3544
- C:\Windows\System\nImpGHU.exe
  C:\Windows\System\nImpGHU.exe
  2⤵
  PID:3560
- C:\Windows\System\hIHJxSL.exe
  C:\Windows\System\hIHJxSL.exe
  2⤵
  PID:3584
- C:\Windows\System\EXUkZSb.exe
  C:\Windows\System\EXUkZSb.exe
  2⤵
  PID:3600
- C:\Windows\System\YAXMsOk.exe
  C:\Windows\System\YAXMsOk.exe
  2⤵
  PID:3616
- C:\Windows\System\mGMJlYJ.exe
  C:\Windows\System\mGMJlYJ.exe
  2⤵
  PID:3640
- C:\Windows\System\mFhGfxd.exe
  C:\Windows\System\mFhGfxd.exe
  2⤵
  PID:3656
- C:\Windows\System\ycOlfaH.exe
  C:\Windows\System\ycOlfaH.exe
  2⤵
  PID:3672
- C:\Windows\System\ZRzDhjE.exe
  C:\Windows\System\ZRzDhjE.exe
  2⤵
  PID:3692
- C:\Windows\System\bLwWpMA.exe
  C:\Windows\System\bLwWpMA.exe
  2⤵
  PID:3708
- C:\Windows\System\DyXvDDI.exe
  C:\Windows\System\DyXvDDI.exe
  2⤵
  PID:3732
- C:\Windows\System\nxWTyBM.exe
  C:\Windows\System\nxWTyBM.exe
  2⤵
  PID:3772
- C:\Windows\System\edbHaUs.exe
  C:\Windows\System\edbHaUs.exe
  2⤵
  PID:3788
- C:\Windows\System\lQAvXIg.exe
  C:\Windows\System\lQAvXIg.exe
  2⤵
  PID:3804
- C:\Windows\System\VoKrTwf.exe
  C:\Windows\System\VoKrTwf.exe
  2⤵
  PID:3820
- C:\Windows\System\qtSpyPB.exe
  C:\Windows\System\qtSpyPB.exe
  2⤵
  PID:3844
- C:\Windows\System\FEoiiey.exe
  C:\Windows\System\FEoiiey.exe
  2⤵
  PID:3864
- C:\Windows\System\cnMMboM.exe
  C:\Windows\System\cnMMboM.exe
  2⤵
  PID:3880
- C:\Windows\System\AIMCNCt.exe
  C:\Windows\System\AIMCNCt.exe
  2⤵
  PID:3896
- C:\Windows\System\otaXiJy.exe
  C:\Windows\System\otaXiJy.exe
  2⤵
  PID:3920
- C:\Windows\System\AGnyYrO.exe
  C:\Windows\System\AGnyYrO.exe
  2⤵
  PID:3936
- C:\Windows\System\TtfQPcH.exe
  C:\Windows\System\TtfQPcH.exe
  2⤵
  PID:3956
- C:\Windows\System\RlzoGjG.exe
  C:\Windows\System\RlzoGjG.exe
  2⤵
  PID:3976
- C:\Windows\System\cYbxSvW.exe
  C:\Windows\System\cYbxSvW.exe
  2⤵
  PID:3992
- C:\Windows\System\DeYCjJT.exe
  C:\Windows\System\DeYCjJT.exe
  2⤵
  PID:4028
- C:\Windows\System\MNouFQg.exe
  C:\Windows\System\MNouFQg.exe
  2⤵
  PID:4056
- C:\Windows\System\AaXHmqV.exe
  C:\Windows\System\AaXHmqV.exe
  2⤵
  PID:4072
- C:\Windows\System\xvbZheO.exe
  C:\Windows\System\xvbZheO.exe
  2⤵
  PID:4092
- C:\Windows\System\DRfFpLZ.exe
  C:\Windows\System\DRfFpLZ.exe
  2⤵
  PID:3088
- C:\Windows\System\IgWWcnV.exe
  C:\Windows\System\IgWWcnV.exe
  2⤵
  PID:3124
- C:\Windows\System\hhHLVbG.exe
  C:\Windows\System\hhHLVbG.exe
  2⤵
  PID:3148
- C:\Windows\System\MzpBwfq.exe
  C:\Windows\System\MzpBwfq.exe
  2⤵
  PID:3184
- C:\Windows\System\tBPoDXj.exe
  C:\Windows\System\tBPoDXj.exe
  2⤵
  PID:3256
- C:\Windows\System\cDfuvso.exe
  C:\Windows\System\cDfuvso.exe
  2⤵
  PID:3340
- C:\Windows\System\lHfbYcK.exe
  C:\Windows\System\lHfbYcK.exe
  2⤵
  PID:3268
- C:\Windows\System\CnlNbSp.exe
  C:\Windows\System\CnlNbSp.exe
  2⤵
  PID:3356
- C:\Windows\System\XHYsBgo.exe
  C:\Windows\System\XHYsBgo.exe
  2⤵
  PID:3328
- C:\Windows\System\tNqNxaf.exe
  C:\Windows\System\tNqNxaf.exe
  2⤵
  PID:3368
- C:\Windows\System\sUAjPCD.exe
  C:\Windows\System\sUAjPCD.exe
  2⤵
  PID:3444
- C:\Windows\System\mwbGSJF.exe
  C:\Windows\System\mwbGSJF.exe
  2⤵
  PID:3404
- C:\Windows\System\zkzbqAI.exe
  C:\Windows\System\zkzbqAI.exe
  2⤵
  PID:3592
- C:\Windows\System\JuJKbOS.exe
  C:\Windows\System\JuJKbOS.exe
  2⤵
  PID:3636
- C:\Windows\System\VIIJvjL.exe
  C:\Windows\System\VIIJvjL.exe
  2⤵
  PID:3664
- C:\Windows\System\abNJWbF.exe
  C:\Windows\System\abNJWbF.exe
  2⤵
  PID:3608
- C:\Windows\System\PGdPEUN.exe
  C:\Windows\System\PGdPEUN.exe
  2⤵
  PID:3536
- C:\Windows\System\SjBvdRV.exe
  C:\Windows\System\SjBvdRV.exe
  2⤵
  PID:3760
- C:\Windows\System\rCKrKJf.exe
  C:\Windows\System\rCKrKJf.exe
  2⤵
  PID:3768
- C:\Windows\System\ETFHubp.exe
  C:\Windows\System\ETFHubp.exe
  2⤵
  PID:3572
- C:\Windows\System\CzNOAal.exe
  C:\Windows\System\CzNOAal.exe
  2⤵
  PID:3580
- C:\Windows\System\NQKlOUF.exe
  C:\Windows\System\NQKlOUF.exe
  2⤵
  PID:3828
- C:\Windows\System\wKfOGwp.exe
  C:\Windows\System\wKfOGwp.exe
  2⤵
  PID:3684
- C:\Windows\System\PvsfbMJ.exe
  C:\Windows\System\PvsfbMJ.exe
  2⤵
  PID:3840
- C:\Windows\System\KUeSvad.exe
  C:\Windows\System\KUeSvad.exe
  2⤵
  PID:3784
- C:\Windows\System\LSmEXWW.exe
  C:\Windows\System\LSmEXWW.exe
  2⤵
  PID:3908
- C:\Windows\System\qpucvvZ.exe
  C:\Windows\System\qpucvvZ.exe
  2⤵
  PID:3892
- C:\Windows\System\QzzhIvn.exe
  C:\Windows\System\QzzhIvn.exe
  2⤵
  PID:3972
- C:\Windows\System\dzATvds.exe
  C:\Windows\System\dzATvds.exe
  2⤵
  PID:4004
- C:\Windows\System\vBvUqUw.exe
  C:\Windows\System\vBvUqUw.exe
  2⤵
  PID:4020
- C:\Windows\System\vFPuGNM.exe
  C:\Windows\System\vFPuGNM.exe
  2⤵
  PID:3120
- C:\Windows\System\xpUqYqN.exe
  C:\Windows\System\xpUqYqN.exe
  2⤵
  PID:3172
- C:\Windows\System\HUzURvg.exe
  C:\Windows\System\HUzURvg.exe
  2⤵
  PID:3364
- C:\Windows\System\TAjnNBS.exe
  C:\Windows\System\TAjnNBS.exe
  2⤵
  PID:3400
- C:\Windows\System\qqjbZFj.exe
  C:\Windows\System\qqjbZFj.exe
  2⤵
  PID:3236
- C:\Windows\System\ocyyCUE.exe
  C:\Windows\System\ocyyCUE.exe
  2⤵
  PID:3424
- C:\Windows\System\qHHVebO.exe
  C:\Windows\System\qHHVebO.exe
  2⤵
  PID:3484
- C:\Windows\System\AjIVvps.exe
  C:\Windows\System\AjIVvps.exe
  2⤵
  PID:3520
- C:\Windows\System\wmXMmFY.exe
  C:\Windows\System\wmXMmFY.exe
  2⤵
  PID:3468
- C:\Windows\System\yhSTYmT.exe
  C:\Windows\System\yhSTYmT.exe
  2⤵
  PID:3700
- C:\Windows\System\tNuZetN.exe
  C:\Windows\System\tNuZetN.exe
  2⤵
  PID:3568
- C:\Windows\System\LwEKHzW.exe
  C:\Windows\System\LwEKHzW.exe
  2⤵
  PID:3796
- C:\Windows\System\DYfvtAl.exe
  C:\Windows\System\DYfvtAl.exe
  2⤵
  PID:3744
- C:\Windows\System\THLbknv.exe
  C:\Windows\System\THLbknv.exe
  2⤵
  PID:3648
- C:\Windows\System\GtVteYr.exe
  C:\Windows\System\GtVteYr.exe
  2⤵
  PID:3952
- C:\Windows\System\XOIOizq.exe
  C:\Windows\System\XOIOizq.exe
  2⤵
  PID:3984
- C:\Windows\System\xofslIA.exe
  C:\Windows\System\xofslIA.exe
  2⤵
  PID:3988
- C:\Windows\System\ITpDmno.exe
  C:\Windows\System\ITpDmno.exe
  2⤵
  PID:4012
- C:\Windows\System\TYoQHoX.exe
  C:\Windows\System\TYoQHoX.exe
  2⤵
  PID:3168
- C:\Windows\System\daomgfq.exe
  C:\Windows\System\daomgfq.exe
  2⤵
  PID:3224
- C:\Windows\System\jBsrGPj.exe
  C:\Windows\System\jBsrGPj.exe
  2⤵
  PID:3092
- C:\Windows\System\ENZJyCm.exe
  C:\Windows\System\ENZJyCm.exe
  2⤵
  PID:4088
- C:\Windows\System\jIWdysp.exe
  C:\Windows\System\jIWdysp.exe
  2⤵
  PID:3460
- C:\Windows\System\uUdxlJX.exe
  C:\Windows\System\uUdxlJX.exe
  2⤵
  PID:3680
- C:\Windows\System\UwPHkdY.exe
  C:\Windows\System\UwPHkdY.exe
  2⤵
  PID:4044
- C:\Windows\System\SBYspRS.exe
  C:\Windows\System\SBYspRS.exe
  2⤵
  PID:3860
- C:\Windows\System\IDvlvap.exe
  C:\Windows\System\IDvlvap.exe
  2⤵
  PID:3752
- C:\Windows\System\FeORwMH.exe
  C:\Windows\System\FeORwMH.exe
  2⤵
  PID:3716
- C:\Windows\System\nYvNqxx.exe
  C:\Windows\System\nYvNqxx.exe
  2⤵
  PID:3852
- C:\Windows\System\LPEXqLG.exe
  C:\Windows\System\LPEXqLG.exe
  2⤵
  PID:4048
- C:\Windows\System\vkakHDS.exe
  C:\Windows\System\vkakHDS.exe
  2⤵
  PID:3724
- C:\Windows\System\VoaqLBE.exe
  C:\Windows\System\VoaqLBE.exe
  2⤵
  PID:3480
- C:\Windows\System\htfxpub.exe
  C:\Windows\System\htfxpub.exe
  2⤵
  PID:3428
- C:\Windows\System\yRfUNus.exe
  C:\Windows\System\yRfUNus.exe
  2⤵
  PID:3916
- C:\Windows\System\NmeVMru.exe
  C:\Windows\System\NmeVMru.exe
  2⤵
  PID:4068
- C:\Windows\System\SUUsWjd.exe
  C:\Windows\System\SUUsWjd.exe
  2⤵
  PID:4112
- C:\Windows\System\nRriJIt.exe
  C:\Windows\System\nRriJIt.exe
  2⤵
  PID:4128
- C:\Windows\System\BwFiZSh.exe
  C:\Windows\System\BwFiZSh.exe
  2⤵
  PID:4148
- C:\Windows\System\wtFCMrs.exe
  C:\Windows\System\wtFCMrs.exe
  2⤵
  PID:4168
- C:\Windows\System\GuBmtWQ.exe
  C:\Windows\System\GuBmtWQ.exe
  2⤵
  PID:4192
- C:\Windows\System\gHNQuWZ.exe
  C:\Windows\System\gHNQuWZ.exe
  2⤵
  PID:4212
- C:\Windows\System\ssmTfaM.exe
  C:\Windows\System\ssmTfaM.exe
  2⤵
  PID:4228
- C:\Windows\System\ivEmKBf.exe
  C:\Windows\System\ivEmKBf.exe
  2⤵
  PID:4248
- C:\Windows\System\fTaHFtc.exe
  C:\Windows\System\fTaHFtc.exe
  2⤵
  PID:4264
- C:\Windows\System\ENJwTpm.exe
  C:\Windows\System\ENJwTpm.exe
  2⤵
  PID:4284
- C:\Windows\System\tVmfjJc.exe
  C:\Windows\System\tVmfjJc.exe
  2⤵
  PID:4300
- C:\Windows\System\wDfCkdC.exe
  C:\Windows\System\wDfCkdC.exe
  2⤵
  PID:4324
- C:\Windows\System\XjWIonB.exe
  C:\Windows\System\XjWIonB.exe
  2⤵
  PID:4340
- C:\Windows\System\dyHyoxo.exe
  C:\Windows\System\dyHyoxo.exe
  2⤵
  PID:4360
- C:\Windows\System\BeVrhXo.exe
  C:\Windows\System\BeVrhXo.exe
  2⤵
  PID:4376
- C:\Windows\System\oTgbObj.exe
  C:\Windows\System\oTgbObj.exe
  2⤵
  PID:4396
- C:\Windows\System\WDnoxvp.exe
  C:\Windows\System\WDnoxvp.exe
  2⤵
  PID:4412
- C:\Windows\System\cghogrO.exe
  C:\Windows\System\cghogrO.exe
  2⤵
  PID:4432
- C:\Windows\System\nvIQZjU.exe
  C:\Windows\System\nvIQZjU.exe
  2⤵
  PID:4452
- C:\Windows\System\zMHTQfC.exe
  C:\Windows\System\zMHTQfC.exe
  2⤵
  PID:4468
- C:\Windows\System\wfiOOVU.exe
  C:\Windows\System\wfiOOVU.exe
  2⤵
  PID:4484
- C:\Windows\System\vMbBNmz.exe
  C:\Windows\System\vMbBNmz.exe
  2⤵
  PID:4508
- C:\Windows\System\VyJUXpF.exe
  C:\Windows\System\VyJUXpF.exe
  2⤵
  PID:4528
- C:\Windows\System\UlOdcbt.exe
  C:\Windows\System\UlOdcbt.exe
  2⤵
  PID:4548
- C:\Windows\System\DcsVKOv.exe
  C:\Windows\System\DcsVKOv.exe
  2⤵
  PID:4564
- C:\Windows\System\EzSOJdP.exe
  C:\Windows\System\EzSOJdP.exe
  2⤵
  PID:4584
- C:\Windows\System\qgWCIum.exe
  C:\Windows\System\qgWCIum.exe
  2⤵
  PID:4600
- C:\Windows\System\uVlhFzr.exe
  C:\Windows\System\uVlhFzr.exe
  2⤵
  PID:4620
- C:\Windows\System\upxWQvh.exe
  C:\Windows\System\upxWQvh.exe
  2⤵
  PID:4636
- C:\Windows\System\OoTdjqe.exe
  C:\Windows\System\OoTdjqe.exe
  2⤵
  PID:4656
- C:\Windows\System\UMlrUIa.exe
  C:\Windows\System\UMlrUIa.exe
  2⤵
  PID:4740
- C:\Windows\System\ZXIOUSc.exe
  C:\Windows\System\ZXIOUSc.exe
  2⤵
  PID:4756
- C:\Windows\System\QaDHrsR.exe
  C:\Windows\System\QaDHrsR.exe
  2⤵
  PID:4772
- C:\Windows\System\XvskcEj.exe
  C:\Windows\System\XvskcEj.exe
  2⤵
  PID:4788
- C:\Windows\System\uxxJdco.exe
  C:\Windows\System\uxxJdco.exe
  2⤵
  PID:4804
- C:\Windows\System\vDqxbCB.exe
  C:\Windows\System\vDqxbCB.exe
  2⤵
  PID:4820
- C:\Windows\System\KaxZivk.exe
  C:\Windows\System\KaxZivk.exe
  2⤵
  PID:4836
- C:\Windows\System\SHTvIyW.exe
  C:\Windows\System\SHTvIyW.exe
  2⤵
  PID:4852
- C:\Windows\System\FkVYWKG.exe
  C:\Windows\System\FkVYWKG.exe
  2⤵
  PID:4868
- C:\Windows\System\NyZHFAp.exe
  C:\Windows\System\NyZHFAp.exe
  2⤵
  PID:4920
- C:\Windows\System\qXnxCrc.exe
  C:\Windows\System\qXnxCrc.exe
  2⤵
  PID:4940
- C:\Windows\System\skXDHLs.exe
  C:\Windows\System\skXDHLs.exe
  2⤵
  PID:4956
- C:\Windows\System\SCgudaE.exe
  C:\Windows\System\SCgudaE.exe
  2⤵
  PID:4972
- C:\Windows\System\YHkDZhm.exe
  C:\Windows\System\YHkDZhm.exe
  2⤵
  PID:4988
- C:\Windows\System\ckmCzuM.exe
  C:\Windows\System\ckmCzuM.exe
  2⤵
  PID:5012
- C:\Windows\System\dKeiceO.exe
  C:\Windows\System\dKeiceO.exe
  2⤵
  PID:5032
- C:\Windows\System\FYxtEJQ.exe
  C:\Windows\System\FYxtEJQ.exe
  2⤵
  PID:5052
- C:\Windows\System\UTczRFs.exe
  C:\Windows\System\UTczRFs.exe
  2⤵
  PID:5068
- C:\Windows\System\VgAGRUZ.exe
  C:\Windows\System\VgAGRUZ.exe
  2⤵
  PID:5084
- C:\Windows\System\CcVpHyX.exe
  C:\Windows\System\CcVpHyX.exe
  2⤵
  PID:5100
- C:\Windows\System\ElbnrHZ.exe
  C:\Windows\System\ElbnrHZ.exe
  2⤵
  PID:5116
- C:\Windows\System\SaVvhqE.exe
  C:\Windows\System\SaVvhqE.exe
  2⤵
  PID:4136
- C:\Windows\System\xSgODau.exe
  C:\Windows\System\xSgODau.exe
  2⤵
  PID:4180
- C:\Windows\System\HEktLLU.exe
  C:\Windows\System\HEktLLU.exe
  2⤵
  PID:4256
- C:\Windows\System\MPoEqKm.exe
  C:\Windows\System\MPoEqKm.exe
  2⤵
  PID:3556
- C:\Windows\System\gpboecS.exe
  C:\Windows\System\gpboecS.exe
  2⤵
  PID:4336
- C:\Windows\System\mMobNqZ.exe
  C:\Windows\System\mMobNqZ.exe
  2⤵
  PID:4404
- C:\Windows\System\FlKuRbP.exe
  C:\Windows\System\FlKuRbP.exe
  2⤵
  PID:4524
- C:\Windows\System\Vmdybcb.exe
  C:\Windows\System\Vmdybcb.exe
  2⤵
  PID:4560
- C:\Windows\System\IZJZqpO.exe
  C:\Windows\System\IZJZqpO.exe
  2⤵
  PID:4676
- C:\Windows\System\OJJxkOQ.exe
  C:\Windows\System\OJJxkOQ.exe
  2⤵
  PID:4680
- C:\Windows\System\NUnBAwW.exe
  C:\Windows\System\NUnBAwW.exe
  2⤵
  PID:4692
- C:\Windows\System\PZJvgKC.exe
  C:\Windows\System\PZJvgKC.exe
  2⤵
  PID:4236
- C:\Windows\System\WDgSPtV.exe
  C:\Windows\System\WDgSPtV.exe
  2⤵
  PID:3632
- C:\Windows\System\ikWHEsm.exe
  C:\Windows\System\ikWHEsm.exe
  2⤵
  PID:4388
- C:\Windows\System\aApcXOf.exe
  C:\Windows\System\aApcXOf.exe
  2⤵
  PID:4492
- C:\Windows\System\pVoaOad.exe
  C:\Windows\System\pVoaOad.exe
  2⤵
  PID:2872
- C:\Windows\System\PjeQHrp.exe
  C:\Windows\System\PjeQHrp.exe
  2⤵
  PID:4156
- C:\Windows\System\JncqmoA.exe
  C:\Windows\System\JncqmoA.exe
  2⤵
  PID:4244
- C:\Windows\System\VTLWZWe.exe
  C:\Windows\System\VTLWZWe.exe
  2⤵
  PID:4316
- C:\Windows\System\EuMsqun.exe
  C:\Windows\System\EuMsqun.exe
  2⤵
  PID:4428
- C:\Windows\System\PUDkYcn.exe
  C:\Windows\System\PUDkYcn.exe
  2⤵
  PID:4544
- C:\Windows\System\UilPKfX.exe
  C:\Windows\System\UilPKfX.exe
  2⤵
  PID:4612
- C:\Windows\System\NpsHpZi.exe
  C:\Windows\System\NpsHpZi.exe
  2⤵
  PID:4796
- C:\Windows\System\AjcsCsM.exe
  C:\Windows\System\AjcsCsM.exe
  2⤵
  PID:4816
- C:\Windows\System\SkdzdWF.exe
  C:\Windows\System\SkdzdWF.exe
  2⤵
  PID:4880
- C:\Windows\System\XhIhEQZ.exe
  C:\Windows\System\XhIhEQZ.exe
  2⤵
  PID:4896
- C:\Windows\System\GUepVwa.exe
  C:\Windows\System\GUepVwa.exe
  2⤵
  PID:4916
- C:\Windows\System\BYKbWrC.exe
  C:\Windows\System\BYKbWrC.exe
  2⤵
  PID:5000
- C:\Windows\System\rEmsUTr.exe
  C:\Windows\System\rEmsUTr.exe
  2⤵
  PID:5008
- C:\Windows\System\FHxHbTz.exe
  C:\Windows\System\FHxHbTz.exe
  2⤵
  PID:5076
- C:\Windows\System\BsfwdMc.exe
  C:\Windows\System\BsfwdMc.exe
  2⤵
  PID:4292
- C:\Windows\System\oLOfFJf.exe
  C:\Windows\System\oLOfFJf.exe
  2⤵
  PID:4164
- C:\Windows\System\Jbjbmji.exe
  C:\Windows\System\Jbjbmji.exe
  2⤵
  PID:4352
- C:\Windows\System\PJIecaS.exe
  C:\Windows\System\PJIecaS.exe
  2⤵
  PID:3904
- C:\Windows\System\FJzepDX.exe
  C:\Windows\System\FJzepDX.exe
  2⤵
  PID:4696
- C:\Windows\System\XLQcBqx.exe
  C:\Windows\System\XLQcBqx.exe
  2⤵
  PID:4476
- C:\Windows\System\gLKVRZm.exe
  C:\Windows\System\gLKVRZm.exe
  2⤵
  PID:4948
- C:\Windows\System\WpunFNZ.exe
  C:\Windows\System\WpunFNZ.exe
  2⤵
  PID:4480
- C:\Windows\System\OffqlDF.exe
  C:\Windows\System\OffqlDF.exe
  2⤵
  PID:4332
- C:\Windows\System\zaoTWyG.exe
  C:\Windows\System\zaoTWyG.exe
  2⤵
  PID:4052
- C:\Windows\System\PojFJRi.exe
  C:\Windows\System\PojFJRi.exe
  2⤵
  PID:3456
- C:\Windows\System\tvZnASH.exe
  C:\Windows\System\tvZnASH.exe
  2⤵
  PID:4420
- C:\Windows\System\TYzRMBG.exe
  C:\Windows\System\TYzRMBG.exe
  2⤵
  PID:4536
- C:\Windows\System\cCYniKe.exe
  C:\Windows\System\cCYniKe.exe
  2⤵
  PID:4648
- C:\Windows\System\ZWEpUDO.exe
  C:\Windows\System\ZWEpUDO.exe
  2⤵
  PID:4308
- C:\Windows\System\Mgewqgh.exe
  C:\Windows\System\Mgewqgh.exe
  2⤵
  PID:4752
- C:\Windows\System\EvDkKYH.exe
  C:\Windows\System\EvDkKYH.exe
  2⤵
  PID:4764
- C:\Windows\System\fTIxwZl.exe
  C:\Windows\System\fTIxwZl.exe
  2⤵
  PID:1588
- C:\Windows\System\AuYJOAI.exe
  C:\Windows\System\AuYJOAI.exe
  2⤵
  PID:5048
- C:\Windows\System\ByLAcRA.exe
  C:\Windows\System\ByLAcRA.exe
  2⤵
  PID:3756
- C:\Windows\System\KVqAvJu.exe
  C:\Windows\System\KVqAvJu.exe
  2⤵
  PID:4448
- C:\Windows\System\smKRWKA.exe
  C:\Windows\System\smKRWKA.exe
  2⤵
  PID:4904
- C:\Windows\System\PLkqlAW.exe
  C:\Windows\System\PLkqlAW.exe
  2⤵
  PID:4144
- C:\Windows\System\klyBKJD.exe
  C:\Windows\System\klyBKJD.exe
  2⤵
  PID:4276
- C:\Windows\System\dHcGfrr.exe
  C:\Windows\System\dHcGfrr.exe
  2⤵
  PID:4176
- C:\Windows\System\oeISQPH.exe
  C:\Windows\System\oeISQPH.exe
  2⤵
  PID:4736
- C:\Windows\System\TDdNjeg.exe
  C:\Windows\System\TDdNjeg.exe
  2⤵
  PID:4876
- C:\Windows\System\SLpEaVF.exe
  C:\Windows\System\SLpEaVF.exe
  2⤵
  PID:4980
- C:\Windows\System\kUxCkrZ.exe
  C:\Windows\System\kUxCkrZ.exe
  2⤵
  PID:5092
- C:\Windows\System\njHrJbA.exe
  C:\Windows\System\njHrJbA.exe
  2⤵
  PID:4108
- C:\Windows\System\OGUmQdD.exe
  C:\Windows\System\OGUmQdD.exe
  2⤵
  PID:4384
- C:\Windows\System\fiEcLIh.exe
  C:\Windows\System\fiEcLIh.exe
  2⤵
  PID:4932
- C:\Windows\System\lRbPPxf.exe
  C:\Windows\System\lRbPPxf.exe
  2⤵
  PID:4860
- C:\Windows\System\LllyJKW.exe
  C:\Windows\System\LllyJKW.exe
  2⤵
  PID:5044
- C:\Windows\System\iWVZHpy.exe
  C:\Windows\System\iWVZHpy.exe
  2⤵
  PID:5112
- C:\Windows\System\FXkKKUs.exe
  C:\Windows\System\FXkKKUs.exe
  2⤵
  PID:4704
- C:\Windows\System\gIekrmr.exe
  C:\Windows\System\gIekrmr.exe
  2⤵
  PID:4348
- C:\Windows\System\iLWYqLd.exe
  C:\Windows\System\iLWYqLd.exe
  2⤵
  PID:3628
- C:\Windows\System\FfbgWUx.exe
  C:\Windows\System\FfbgWUx.exe
  2⤵
  PID:4500
- C:\Windows\System\eRaeGxo.exe
  C:\Windows\System\eRaeGxo.exe
  2⤵
  PID:4596
- C:\Windows\System\kBZWPuV.exe
  C:\Windows\System\kBZWPuV.exe
  2⤵
  PID:3948
- C:\Windows\System\VCdadMu.exe
  C:\Windows\System\VCdadMu.exe
  2⤵
  PID:4220
- C:\Windows\System\ePPFgHd.exe
  C:\Windows\System\ePPFgHd.exe
  2⤵
  PID:4440
- C:\Windows\System\UkZbkHn.exe
  C:\Windows\System\UkZbkHn.exe
  2⤵
  PID:4368
- C:\Windows\System\ITbhvwj.exe
  C:\Windows\System\ITbhvwj.exe
  2⤵
  PID:4968
- C:\Windows\System\VzVEtyQ.exe
  C:\Windows\System\VzVEtyQ.exe
  2⤵
  PID:4224
- C:\Windows\System\qQqAPWq.exe
  C:\Windows\System\qQqAPWq.exe
  2⤵
  PID:4684
- C:\Windows\System\dxQTDAt.exe
  C:\Windows\System\dxQTDAt.exe
  2⤵
  PID:5132
- C:\Windows\System\WZYqwLs.exe
  C:\Windows\System\WZYqwLs.exe
  2⤵
  PID:5148
- C:\Windows\System\PCryIVf.exe
  C:\Windows\System\PCryIVf.exe
  2⤵
  PID:5164
- C:\Windows\System\DiQdiUV.exe
  C:\Windows\System\DiQdiUV.exe
  2⤵
  PID:5180
- C:\Windows\System\YuNAFTX.exe
  C:\Windows\System\YuNAFTX.exe
  2⤵
  PID:5196
- C:\Windows\System\pHxyspF.exe
  C:\Windows\System\pHxyspF.exe
  2⤵
  PID:5212
- C:\Windows\System\njUoYmK.exe
  C:\Windows\System\njUoYmK.exe
  2⤵
  PID:5228
- C:\Windows\System\OtJsieJ.exe
  C:\Windows\System\OtJsieJ.exe
  2⤵
  PID:5244
- C:\Windows\System\zMnvkyE.exe
  C:\Windows\System\zMnvkyE.exe
  2⤵
  PID:5260
- C:\Windows\System\fbMqLYF.exe
  C:\Windows\System\fbMqLYF.exe
  2⤵
  PID:5276
- C:\Windows\System\pgenkAp.exe
  C:\Windows\System\pgenkAp.exe
  2⤵
  PID:5292
- C:\Windows\System\BMowIvH.exe
  C:\Windows\System\BMowIvH.exe
  2⤵
  PID:5308
- C:\Windows\System\eCVZmFY.exe
  C:\Windows\System\eCVZmFY.exe
  2⤵
  PID:5324
- C:\Windows\System\bepBbuK.exe
  C:\Windows\System\bepBbuK.exe
  2⤵
  PID:5340
- C:\Windows\System\BchOOYo.exe
  C:\Windows\System\BchOOYo.exe
  2⤵
  PID:5360
- C:\Windows\System\ZNsevSA.exe
  C:\Windows\System\ZNsevSA.exe
  2⤵
  PID:5380
- C:\Windows\System\mMaAZVf.exe
  C:\Windows\System\mMaAZVf.exe
  2⤵
  PID:5396
- C:\Windows\System\DSJjIVZ.exe
  C:\Windows\System\DSJjIVZ.exe
  2⤵
  PID:5412
- C:\Windows\System\AYriBtB.exe
  C:\Windows\System\AYriBtB.exe
  2⤵
  PID:5428
- C:\Windows\System\PEwpPvb.exe
  C:\Windows\System\PEwpPvb.exe
  2⤵
  PID:5444
- C:\Windows\System\QZnBdnQ.exe
  C:\Windows\System\QZnBdnQ.exe
  2⤵
  PID:5460
- C:\Windows\System\eUWrpZo.exe
  C:\Windows\System\eUWrpZo.exe
  2⤵
  PID:5476
- C:\Windows\System\OHxHXvo.exe
  C:\Windows\System\OHxHXvo.exe
  2⤵
  PID:5492
- C:\Windows\System\PVKiwmt.exe
  C:\Windows\System\PVKiwmt.exe
  2⤵
  PID:5508
- C:\Windows\System\CfkrJSh.exe
  C:\Windows\System\CfkrJSh.exe
  2⤵
  PID:5524
- C:\Windows\System\JNBWcKD.exe
  C:\Windows\System\JNBWcKD.exe
  2⤵
  PID:5540
- C:\Windows\System\zPCGwZQ.exe
  C:\Windows\System\zPCGwZQ.exe
  2⤵
  PID:5556
- C:\Windows\System\xmnkknZ.exe
  C:\Windows\System\xmnkknZ.exe
  2⤵
  PID:5572
- C:\Windows\System\dTmmYpE.exe
  C:\Windows\System\dTmmYpE.exe
  2⤵
  PID:5588
- C:\Windows\System\nPKmuyo.exe
  C:\Windows\System\nPKmuyo.exe
  2⤵
  PID:5604
- C:\Windows\System\ENUaGNh.exe
  C:\Windows\System\ENUaGNh.exe
  2⤵
  PID:5620
- C:\Windows\System\UJLCcKm.exe
  C:\Windows\System\UJLCcKm.exe
  2⤵
  PID:5636
- C:\Windows\System\mSeuRzr.exe
  C:\Windows\System\mSeuRzr.exe
  2⤵
  PID:5652
- C:\Windows\System\SxDXqjX.exe
  C:\Windows\System\SxDXqjX.exe
  2⤵
  PID:5668
- C:\Windows\System\DEfVcpQ.exe
  C:\Windows\System\DEfVcpQ.exe
  2⤵
  PID:5684
- C:\Windows\System\SPjjnaq.exe
  C:\Windows\System\SPjjnaq.exe
  2⤵
  PID:5700
- C:\Windows\System\hsqGRIT.exe
  C:\Windows\System\hsqGRIT.exe
  2⤵
  PID:5720
- C:\Windows\System\tfSuviM.exe
  C:\Windows\System\tfSuviM.exe
  2⤵
  PID:5736
- C:\Windows\System\JmVFdeH.exe
  C:\Windows\System\JmVFdeH.exe
  2⤵
  PID:5752
- C:\Windows\System\UcCTWWY.exe
  C:\Windows\System\UcCTWWY.exe
  2⤵
  PID:5768
- C:\Windows\System\loRNupZ.exe
  C:\Windows\System\loRNupZ.exe
  2⤵
  PID:5784
- C:\Windows\System\YkjgVOe.exe
  C:\Windows\System\YkjgVOe.exe
  2⤵
  PID:5800
- C:\Windows\System\AecLzyX.exe
  C:\Windows\System\AecLzyX.exe
  2⤵
  PID:5816
- C:\Windows\System\OqbZMEa.exe
  C:\Windows\System\OqbZMEa.exe
  2⤵
  PID:5832
- C:\Windows\System\gtSWUly.exe
  C:\Windows\System\gtSWUly.exe
  2⤵
  PID:5848
- C:\Windows\System\STXKUeS.exe
  C:\Windows\System\STXKUeS.exe
  2⤵
  PID:5864
- C:\Windows\System\CHPYgFM.exe
  C:\Windows\System\CHPYgFM.exe
  2⤵
  PID:5880
- C:\Windows\System\MRwLPfj.exe
  C:\Windows\System\MRwLPfj.exe
  2⤵
  PID:5896
- C:\Windows\System\MoDzVpc.exe
  C:\Windows\System\MoDzVpc.exe
  2⤵
  PID:5912
- C:\Windows\System\VgyUuYu.exe
  C:\Windows\System\VgyUuYu.exe
  2⤵
  PID:5928
- C:\Windows\System\EGeCTzs.exe
  C:\Windows\System\EGeCTzs.exe
  2⤵
  PID:5944
- C:\Windows\System\WREtbDY.exe
  C:\Windows\System\WREtbDY.exe
  2⤵
  PID:5960
- C:\Windows\System\GiSIxhK.exe
  C:\Windows\System\GiSIxhK.exe
  2⤵
  PID:5976
- C:\Windows\System\vcXIkQj.exe
  C:\Windows\System\vcXIkQj.exe
  2⤵
  PID:5992
- C:\Windows\System\qyZWIoV.exe
  C:\Windows\System\qyZWIoV.exe
  2⤵
  PID:6008
- C:\Windows\System\GNKOetZ.exe
  C:\Windows\System\GNKOetZ.exe
  2⤵
  PID:6024
- C:\Windows\System\gvvqcrk.exe
  C:\Windows\System\gvvqcrk.exe
  2⤵
  PID:6040
- C:\Windows\System\HaLtnwb.exe
  C:\Windows\System\HaLtnwb.exe
  2⤵
  PID:6056
- C:\Windows\System\wOIQrOD.exe
  C:\Windows\System\wOIQrOD.exe
  2⤵
  PID:6072
- C:\Windows\System\IQVkNCk.exe
  C:\Windows\System\IQVkNCk.exe
  2⤵
  PID:6088
- C:\Windows\System\KNsMXwB.exe
  C:\Windows\System\KNsMXwB.exe
  2⤵
  PID:6104
- C:\Windows\System\JXinQnN.exe
  C:\Windows\System\JXinQnN.exe
  2⤵
  PID:6120
- C:\Windows\System\wMyhJeR.exe
  C:\Windows\System\wMyhJeR.exe
  2⤵
  PID:6136
- C:\Windows\System\wZzHLIJ.exe
  C:\Windows\System\wZzHLIJ.exe
  2⤵
  PID:4356
- C:\Windows\System\yNBkfOy.exe
  C:\Windows\System\yNBkfOy.exe
  2⤵
  PID:5128
- C:\Windows\System\CclvXIC.exe
  C:\Windows\System\CclvXIC.exe
  2⤵
  PID:5224
- C:\Windows\System\QYFvaib.exe
  C:\Windows\System\QYFvaib.exe
  2⤵
  PID:5288
- C:\Windows\System\LQwOvwp.exe
  C:\Windows\System\LQwOvwp.exe
  2⤵
  PID:4104
- C:\Windows\System\zQnuLBG.exe
  C:\Windows\System\zQnuLBG.exe
  2⤵
  PID:4540
- C:\Windows\System\PDmKUNm.exe
  C:\Windows\System\PDmKUNm.exe
  2⤵
  PID:4728
- C:\Windows\System\YOucIKE.exe
  C:\Windows\System\YOucIKE.exe
  2⤵
  PID:5204
- C:\Windows\System\oOYxFFI.exe
  C:\Windows\System\oOYxFFI.exe
  2⤵
  PID:5268
- C:\Windows\System\pTmouDW.exe
  C:\Windows\System\pTmouDW.exe
  2⤵
  PID:5300
- C:\Windows\System\CvyEjAD.exe
  C:\Windows\System\CvyEjAD.exe
  2⤵
  PID:5368
- C:\Windows\System\IaoLEKo.exe
  C:\Windows\System\IaoLEKo.exe
  2⤵
  PID:5352
- C:\Windows\System\URmIuEI.exe
  C:\Windows\System\URmIuEI.exe
  2⤵
  PID:5408
- C:\Windows\System\jZGkPPG.exe
  C:\Windows\System\jZGkPPG.exe
  2⤵
  PID:5440
- C:\Windows\System\aVTqSmw.exe
  C:\Windows\System\aVTqSmw.exe
  2⤵
  PID:5532
- C:\Windows\System\mqehxAt.exe
  C:\Windows\System\mqehxAt.exe
  2⤵
  PID:5516
- C:\Windows\System\eyxtjrH.exe
  C:\Windows\System\eyxtjrH.exe
  2⤵
  PID:5584
- C:\Windows\System\WEvBMKY.exe
  C:\Windows\System\WEvBMKY.exe
  2⤵
  PID:5612
- C:\Windows\System\NjOGCju.exe
  C:\Windows\System\NjOGCju.exe
  2⤵
  PID:5488
- C:\Windows\System\jwNfpsI.exe
  C:\Windows\System\jwNfpsI.exe
  2⤵
  PID:5708
- C:\Windows\System\pEAzXIq.exe
  C:\Windows\System\pEAzXIq.exe
  2⤵
  PID:5628
- C:\Windows\System\wLLzNxW.exe
  C:\Windows\System\wLLzNxW.exe
  2⤵
  PID:5676
- C:\Windows\System\pWhiCSL.exe
  C:\Windows\System\pWhiCSL.exe
  2⤵
  PID:5760
- C:\Windows\System\eczdeMD.exe
  C:\Windows\System\eczdeMD.exe
  2⤵
  PID:5744
- C:\Windows\System\pzdEfle.exe
  C:\Windows\System\pzdEfle.exe
  2⤵
  PID:5808
- C:\Windows\System\KJRzFtG.exe
  C:\Windows\System\KJRzFtG.exe
  2⤵
  PID:5828
- C:\Windows\System\NyugqRs.exe
  C:\Windows\System\NyugqRs.exe
  2⤵
  PID:5940
- C:\Windows\System\BRDGeWH.exe
  C:\Windows\System\BRDGeWH.exe
  2⤵
  PID:5936
- C:\Windows\System\TWZjyKg.exe
  C:\Windows\System\TWZjyKg.exe
  2⤵
  PID:6032
- C:\Windows\System\uuWNNVk.exe
  C:\Windows\System\uuWNNVk.exe
  2⤵
  PID:6096
- C:\Windows\System\emyUFWf.exe
  C:\Windows\System\emyUFWf.exe
  2⤵
  PID:6068
- C:\Windows\System\tDyhWDx.exe
  C:\Windows\System\tDyhWDx.exe
  2⤵
  PID:5188
- C:\Windows\System\lBrHwjn.exe
  C:\Windows\System\lBrHwjn.exe
  2⤵
  PID:5176
- C:\Windows\System\WldmlYK.exe
  C:\Windows\System\WldmlYK.exe
  2⤵
  PID:6080
- C:\Windows\System\JNQNcva.exe
  C:\Windows\System\JNQNcva.exe
  2⤵
  PID:5956
- C:\Windows\System\uBlbZrU.exe
  C:\Windows\System\uBlbZrU.exe
  2⤵
  PID:5236
- C:\Windows\System\FqvFANA.exe
  C:\Windows\System\FqvFANA.exe
  2⤵
  PID:6116
- C:\Windows\System\dRPfIyO.exe
  C:\Windows\System\dRPfIyO.exe
  2⤵
  PID:5984
- C:\Windows\System\PewafKz.exe
  C:\Windows\System\PewafKz.exe
  2⤵
  PID:6020
- C:\Windows\System\BgeoGGR.exe
  C:\Windows\System\BgeoGGR.exe
  2⤵
  PID:5320
- C:\Windows\System\DpcQLWp.exe
  C:\Windows\System\DpcQLWp.exe
  2⤵
  PID:5456
- C:\Windows\System\IfjveQz.exe
  C:\Windows\System\IfjveQz.exe
  2⤵
  PID:5568
- C:\Windows\System\eLIanqc.exe
  C:\Windows\System\eLIanqc.exe
  2⤵
  PID:5648
- C:\Windows\System\jBDtfwN.exe
  C:\Windows\System\jBDtfwN.exe
  2⤵
  PID:5792
- C:\Windows\System\BmPsHFL.exe
  C:\Windows\System\BmPsHFL.exe
  2⤵
  PID:5904
- C:\Windows\System\vtVacgu.exe
  C:\Windows\System\vtVacgu.exe
  2⤵
  PID:4504
- C:\Windows\System\mZVsdzJ.exe
  C:\Windows\System\mZVsdzJ.exe
  2⤵
  PID:5888
- C:\Windows\System\JSNoaAf.exe
  C:\Windows\System\JSNoaAf.exe
  2⤵
  PID:5952
- C:\Windows\System\wpjpbzM.exe
  C:\Windows\System\wpjpbzM.exe
  2⤵
  PID:5156
- C:\Windows\System\bDSiMkz.exe
  C:\Windows\System\bDSiMkz.exe
  2⤵
  PID:5580
- C:\Windows\System\GOLQjUZ.exe
  C:\Windows\System\GOLQjUZ.exe
  2⤵
  PID:5692
- C:\Windows\System\cKHPGbs.exe
  C:\Windows\System\cKHPGbs.exe
  2⤵
  PID:5712
- C:\Windows\System\vdYZOmW.exe
  C:\Windows\System\vdYZOmW.exe
  2⤵
  PID:6000
- C:\Windows\System\bTWyqbM.exe
  C:\Windows\System\bTWyqbM.exe
  2⤵
  PID:5924
- C:\Windows\System\CYYOtcJ.exe
  C:\Windows\System\CYYOtcJ.exe
  2⤵
  PID:5192
- C:\Windows\System\yWuktSH.exe
  C:\Windows\System\yWuktSH.exe
  2⤵
  PID:5696
- C:\Windows\System\pkZhkNi.exe
  C:\Windows\System\pkZhkNi.exe
  2⤵
  PID:5220
- C:\Windows\System\tFdTTvf.exe
  C:\Windows\System\tFdTTvf.exe
  2⤵
  PID:5824
- C:\Windows\System\TNqjybY.exe
  C:\Windows\System\TNqjybY.exe
  2⤵
  PID:4688
- C:\Windows\System\uJgSCqt.exe
  C:\Windows\System\uJgSCqt.exe
  2⤵
  PID:5504
- C:\Windows\System\bTKeYAq.exe
  C:\Windows\System\bTKeYAq.exe
  2⤵
  PID:5256
- C:\Windows\System\pJoxwqg.exe
  C:\Windows\System\pJoxwqg.exe
  2⤵
  PID:5600
- C:\Windows\System\ledStbZ.exe
  C:\Windows\System\ledStbZ.exe
  2⤵
  PID:5356
- C:\Windows\System\TihRsju.exe
  C:\Windows\System\TihRsju.exe
  2⤵
  PID:5564
- C:\Windows\System\svhfEwp.exe
  C:\Windows\System\svhfEwp.exe
  2⤵
  PID:5240
- C:\Windows\System\SGainyg.exe
  C:\Windows\System\SGainyg.exe
  2⤵
  PID:6156
- C:\Windows\System\jtYXRSn.exe
  C:\Windows\System\jtYXRSn.exe
  2⤵
  PID:6172
- C:\Windows\System\kFTipdw.exe
  C:\Windows\System\kFTipdw.exe
  2⤵
  PID:6188
- C:\Windows\System\MYdJeJt.exe
  C:\Windows\System\MYdJeJt.exe
  2⤵
  PID:6204
- C:\Windows\System\cHHeUkh.exe
  C:\Windows\System\cHHeUkh.exe
  2⤵
  PID:6220
- C:\Windows\System\FXiEYoQ.exe
  C:\Windows\System\FXiEYoQ.exe
  2⤵
  PID:6236
- C:\Windows\System\JXhCjSR.exe
  C:\Windows\System\JXhCjSR.exe
  2⤵
  PID:6252
- C:\Windows\System\FURHYei.exe
  C:\Windows\System\FURHYei.exe
  2⤵
  PID:6268
- C:\Windows\System\WOofNry.exe
  C:\Windows\System\WOofNry.exe
  2⤵
  PID:6284
- C:\Windows\System\FZtNlQR.exe
  C:\Windows\System\FZtNlQR.exe
  2⤵
  PID:6300
- C:\Windows\System\nwhvwzl.exe
  C:\Windows\System\nwhvwzl.exe
  2⤵
  PID:6316
- C:\Windows\System\MFBPTue.exe
  C:\Windows\System\MFBPTue.exe
  2⤵
  PID:6332
- C:\Windows\System\AGCKvoF.exe
  C:\Windows\System\AGCKvoF.exe
  2⤵
  PID:6348
- C:\Windows\System\vLFctUU.exe
  C:\Windows\System\vLFctUU.exe
  2⤵
  PID:6364
- C:\Windows\System\faQXaxi.exe
  C:\Windows\System\faQXaxi.exe
  2⤵
  PID:6380
- C:\Windows\System\ZAGyjyT.exe
  C:\Windows\System\ZAGyjyT.exe
  2⤵
  PID:6396
- C:\Windows\System\NZwHzRe.exe
  C:\Windows\System\NZwHzRe.exe
  2⤵
  PID:6412
- C:\Windows\System\sFoXHMP.exe
  C:\Windows\System\sFoXHMP.exe
  2⤵
  PID:6428
- C:\Windows\System\cRGoLoB.exe
  C:\Windows\System\cRGoLoB.exe
  2⤵
  PID:6444
- C:\Windows\System\NJgoJRK.exe
  C:\Windows\System\NJgoJRK.exe
  2⤵
  PID:6460
- C:\Windows\System\WPKhfLc.exe
  C:\Windows\System\WPKhfLc.exe
  2⤵
  PID:6476
- C:\Windows\System\vYjqMZr.exe
  C:\Windows\System\vYjqMZr.exe
  2⤵
  PID:6492
- C:\Windows\System\OECfVdS.exe
  C:\Windows\System\OECfVdS.exe
  2⤵
  PID:6508
- C:\Windows\System\aOjcySx.exe
  C:\Windows\System\aOjcySx.exe
  2⤵
  PID:6524
- C:\Windows\System\guaJCWF.exe
  C:\Windows\System\guaJCWF.exe
  2⤵
  PID:6540
- C:\Windows\System\lIISqoV.exe
  C:\Windows\System\lIISqoV.exe
  2⤵
  PID:6556
- C:\Windows\System\mHZjZpp.exe
  C:\Windows\System\mHZjZpp.exe
  2⤵
  PID:6572
- C:\Windows\System\WcEduUa.exe
  C:\Windows\System\WcEduUa.exe
  2⤵
  PID:6588
- C:\Windows\System\jKeXycU.exe
  C:\Windows\System\jKeXycU.exe
  2⤵
  PID:6604
- C:\Windows\System\HyocMfI.exe
  C:\Windows\System\HyocMfI.exe
  2⤵
  PID:6620
- C:\Windows\System\TueCAST.exe
  C:\Windows\System\TueCAST.exe
  2⤵
  PID:6636
- C:\Windows\System\NctGifO.exe
  C:\Windows\System\NctGifO.exe
  2⤵
  PID:6652
- C:\Windows\System\qYjrNPr.exe
  C:\Windows\System\qYjrNPr.exe
  2⤵
  PID:6668
- C:\Windows\System\orADCWY.exe
  C:\Windows\System\orADCWY.exe
  2⤵
  PID:6684
- C:\Windows\System\GTzWvry.exe
  C:\Windows\System\GTzWvry.exe
  2⤵
  PID:6700
- C:\Windows\System\hfaSvwV.exe
  C:\Windows\System\hfaSvwV.exe
  2⤵
  PID:6716
- C:\Windows\System\xfijaZI.exe
  C:\Windows\System\xfijaZI.exe
  2⤵
  PID:6732
- C:\Windows\System\oMXurTA.exe
  C:\Windows\System\oMXurTA.exe
  2⤵
  PID:6748
- C:\Windows\System\PEQaqDW.exe
  C:\Windows\System\PEQaqDW.exe
  2⤵
  PID:6764
- C:\Windows\System\VWOPwpj.exe
  C:\Windows\System\VWOPwpj.exe
  2⤵
  PID:6780
- C:\Windows\System\ehRWQNo.exe
  C:\Windows\System\ehRWQNo.exe
  2⤵
  PID:6796
- C:\Windows\System\yYiGKee.exe
  C:\Windows\System\yYiGKee.exe
  2⤵
  PID:6812
- C:\Windows\System\oxaZbcU.exe
  C:\Windows\System\oxaZbcU.exe
  2⤵
  PID:6828
- C:\Windows\System\ihVLRCI.exe
  C:\Windows\System\ihVLRCI.exe
  2⤵
  PID:6848
- C:\Windows\System\iHZGTne.exe
  C:\Windows\System\iHZGTne.exe
  2⤵
  PID:6864
- C:\Windows\System\xoTWuml.exe
  C:\Windows\System\xoTWuml.exe
  2⤵
  PID:6880
- C:\Windows\System\VskADKG.exe
  C:\Windows\System\VskADKG.exe
  2⤵
  PID:6896
- C:\Windows\System\msyknpM.exe
  C:\Windows\System\msyknpM.exe
  2⤵
  PID:6912
- C:\Windows\System\NmVDseF.exe
  C:\Windows\System\NmVDseF.exe
  2⤵
  PID:6928
- C:\Windows\System\PBqrffE.exe
  C:\Windows\System\PBqrffE.exe
  2⤵
  PID:6944
- C:\Windows\System\HrUymNi.exe
  C:\Windows\System\HrUymNi.exe
  2⤵
  PID:6960
- C:\Windows\System\pQZzQkj.exe
  C:\Windows\System\pQZzQkj.exe
  2⤵
  PID:6976
- C:\Windows\System\hSfrFFh.exe
  C:\Windows\System\hSfrFFh.exe
  2⤵
  PID:6992
- C:\Windows\System\bZocHGk.exe
  C:\Windows\System\bZocHGk.exe
  2⤵
  PID:7008
- C:\Windows\System\exgVNHW.exe
  C:\Windows\System\exgVNHW.exe
  2⤵
  PID:7024
- C:\Windows\System\XGEhBPW.exe
  C:\Windows\System\XGEhBPW.exe
  2⤵
  PID:7040
- C:\Windows\System\ASNqPyH.exe
  C:\Windows\System\ASNqPyH.exe
  2⤵
  PID:7056
- C:\Windows\System\oXXlvWN.exe
  C:\Windows\System\oXXlvWN.exe
  2⤵
  PID:7072
- C:\Windows\System\ulXWtkp.exe
  C:\Windows\System\ulXWtkp.exe
  2⤵
  PID:7088
- C:\Windows\System\StwjxfE.exe
  C:\Windows\System\StwjxfE.exe
  2⤵
  PID:7104
- C:\Windows\System\ZqRwLza.exe
  C:\Windows\System\ZqRwLza.exe
  2⤵
  PID:7120
- C:\Windows\System\MGDaPqH.exe
  C:\Windows\System\MGDaPqH.exe
  2⤵
  PID:7136
- C:\Windows\System\zbtUxIn.exe
  C:\Windows\System\zbtUxIn.exe
  2⤵
  PID:7152
- C:\Windows\System\kYdwCDD.exe
  C:\Windows\System\kYdwCDD.exe
  2⤵
  PID:6052
- C:\Windows\System\BGORwsU.exe
  C:\Windows\System\BGORwsU.exe
  2⤵
  PID:5796
- C:\Windows\System\goYCKvj.exe
  C:\Windows\System\goYCKvj.exe
  2⤵
  PID:5780
- C:\Windows\System\SfVdBOj.exe
  C:\Windows\System\SfVdBOj.exe
  2⤵
  PID:5844
- C:\Windows\System\ySkrBCU.exe
  C:\Windows\System\ySkrBCU.exe
  2⤵
  PID:6212
- C:\Windows\System\hRcOzHP.exe
  C:\Windows\System\hRcOzHP.exe
  2⤵
  PID:6276
- C:\Windows\System\QYOXVgr.exe
  C:\Windows\System\QYOXVgr.exe
  2⤵
  PID:6312
- C:\Windows\System\DPGMcDP.exe
  C:\Windows\System\DPGMcDP.exe
  2⤵
  PID:6372
- C:\Windows\System\cBTigig.exe
  C:\Windows\System\cBTigig.exe
  2⤵
  PID:6296
- C:\Windows\System\phhexhT.exe
  C:\Windows\System\phhexhT.exe
  2⤵
  PID:6360
- C:\Windows\System\xVTRCQj.exe
  C:\Windows\System\xVTRCQj.exe
  2⤵
  PID:6232
- C:\Windows\System\EhuZkeX.exe
  C:\Windows\System\EhuZkeX.exe
  2⤵
  PID:6436
- C:\Windows\System\NGxNqXK.exe
  C:\Windows\System\NGxNqXK.exe
  2⤵
  PID:6200
- C:\Windows\System\KRrfpaT.exe
  C:\Windows\System\KRrfpaT.exe
  2⤵
  PID:6472
- C:\Windows\System\guKLNYF.exe
  C:\Windows\System\guKLNYF.exe
  2⤵
  PID:6488
- C:\Windows\System\VgQwipG.exe
  C:\Windows\System\VgQwipG.exe
  2⤵
  PID:6628
- C:\Windows\System\vlDXELi.exe
  C:\Windows\System\vlDXELi.exe
  2⤵
  PID:6520
- C:\Windows\System\yqkjjlj.exe
  C:\Windows\System\yqkjjlj.exe
  2⤵
  PID:6696
- C:\Windows\System\UmzQamU.exe
  C:\Windows\System\UmzQamU.exe
  2⤵
  PID:6580
- C:\Windows\System\gpWHlfT.exe
  C:\Windows\System\gpWHlfT.exe
  2⤵
  PID:6648
- C:\Windows\System\FhnlqBV.exe
  C:\Windows\System\FhnlqBV.exe
  2⤵
  PID:5172
- C:\Windows\System\YZGVchZ.exe
  C:\Windows\System\YZGVchZ.exe
  2⤵
  PID:6760
- C:\Windows\System\rrxjmai.exe
  C:\Windows\System\rrxjmai.exe
  2⤵
  PID:6740
- C:\Windows\System\zGczOXc.exe
  C:\Windows\System\zGczOXc.exe
  2⤵
  PID:6804
- C:\Windows\System\ZkCEKtF.exe
  C:\Windows\System\ZkCEKtF.exe
  2⤵
  PID:6860
- C:\Windows\System\NYqMMFS.exe
  C:\Windows\System\NYqMMFS.exe
  2⤵
  PID:6836
- C:\Windows\System\GNbbhvu.exe
  C:\Windows\System\GNbbhvu.exe
  2⤵
  PID:6924
- C:\Windows\System\edJChPH.exe
  C:\Windows\System\edJChPH.exe
  2⤵
  PID:6972
- C:\Windows\System\SkNRhTA.exe
  C:\Windows\System\SkNRhTA.exe
  2⤵
  PID:6988
- C:\Windows\System\NhZwtYM.exe
  C:\Windows\System\NhZwtYM.exe
  2⤵
  PID:6844
- C:\Windows\System\byjgsrX.exe
  C:\Windows\System\byjgsrX.exe
  2⤵
  PID:7084
- C:\Windows\System\RYXrMsq.exe
  C:\Windows\System\RYXrMsq.exe
  2⤵
  PID:7144
- C:\Windows\System\MkYmgJb.exe
  C:\Windows\System\MkYmgJb.exe
  2⤵
  PID:7064
- C:\Windows\System\HSCpqxe.exe
  C:\Windows\System\HSCpqxe.exe
  2⤵
  PID:7096
- C:\Windows\System\AnBruqv.exe
  C:\Windows\System\AnBruqv.exe
  2⤵
  PID:7164
- C:\Windows\System\SlpuRKi.exe
  C:\Windows\System\SlpuRKi.exe
  2⤵
  PID:6248
- C:\Windows\System\pyVyQGm.exe
  C:\Windows\System\pyVyQGm.exe
  2⤵
  PID:6184
- C:\Windows\System\mgOmvES.exe
  C:\Windows\System\mgOmvES.exe
  2⤵
  PID:6292
- C:\Windows\System\rrpbtru.exe
  C:\Windows\System\rrpbtru.exe
  2⤵
  PID:6344
- C:\Windows\System\lmgAdzL.exe
  C:\Windows\System\lmgAdzL.exe
  2⤵
  PID:6392
- C:\Windows\System\qMTWPGa.exe
  C:\Windows\System\qMTWPGa.exe
  2⤵
  PID:6500
- C:\Windows\System\iAirZHm.exe
  C:\Windows\System\iAirZHm.exe
  2⤵
  PID:6536
- C:\Windows\System\WPGWtKo.exe
  C:\Windows\System\WPGWtKo.exe
  2⤵
  PID:6660
- C:\Windows\System\tdhxAJK.exe
  C:\Windows\System\tdhxAJK.exe
  2⤵
  PID:6548
- C:\Windows\System\iFwcSsB.exe
  C:\Windows\System\iFwcSsB.exe
  2⤵
  PID:6552
- C:\Windows\System\zkPZZfq.exe
  C:\Windows\System\zkPZZfq.exe
  2⤵
  PID:6776
- C:\Windows\System\zecaETv.exe
  C:\Windows\System\zecaETv.exe
  2⤵
  PID:6680
- C:\Windows\System\lDVqqZY.exe
  C:\Windows\System\lDVqqZY.exe
  2⤵
  PID:6820
- C:\Windows\System\UEsMolt.exe
  C:\Windows\System\UEsMolt.exe
  2⤵
  PID:6840
- C:\Windows\System\SAfSMWU.exe
  C:\Windows\System\SAfSMWU.exe
  2⤵
  PID:7116
- C:\Windows\System\lfrCCjW.exe
  C:\Windows\System\lfrCCjW.exe
  2⤵
  PID:7068
- C:\Windows\System\QkUBKQp.exe
  C:\Windows\System\QkUBKQp.exe
  2⤵
  PID:6356
- C:\Windows\System\rNZVgHo.exe
  C:\Windows\System\rNZVgHo.exe
  2⤵
  PID:6308
- C:\Windows\System\znOPTCO.exe
  C:\Windows\System\znOPTCO.exe
  2⤵
  PID:7132
- C:\Windows\System\XZscZad.exe
  C:\Windows\System\XZscZad.exe
  2⤵
  PID:5732
- C:\Windows\System\wOwFDAg.exe
  C:\Windows\System\wOwFDAg.exe
  2⤵
  PID:6644
- C:\Windows\System\DceqocH.exe
  C:\Windows\System\DceqocH.exe
  2⤵
  PID:6956
- C:\Windows\System\nxOtzaI.exe
  C:\Windows\System\nxOtzaI.exe
  2⤵
  PID:6564
- C:\Windows\System\tjJNQZh.exe
  C:\Windows\System\tjJNQZh.exe
  2⤵
  PID:6920
- C:\Windows\System\ZRFbpYv.exe
  C:\Windows\System\ZRFbpYv.exe
  2⤵
  PID:7036
- C:\Windows\System\GMwEuda.exe
  C:\Windows\System\GMwEuda.exe
  2⤵
  PID:7004
- C:\Windows\System\JOhPupz.exe
  C:\Windows\System\JOhPupz.exe
  2⤵
  PID:6876
- C:\Windows\System\BuCnRWW.exe
  C:\Windows\System\BuCnRWW.exe
  2⤵
  PID:6260
- C:\Windows\System\wyLmtIf.exe
  C:\Windows\System\wyLmtIf.exe
  2⤵
  PID:6452
- C:\Windows\System\RWGfoAq.exe
  C:\Windows\System\RWGfoAq.exe
  2⤵
  PID:7080
- C:\Windows\System\WbytdRm.exe
  C:\Windows\System\WbytdRm.exe
  2⤵
  PID:7172
- C:\Windows\System\qpWsNZL.exe
  C:\Windows\System\qpWsNZL.exe
  2⤵
  PID:7188
- C:\Windows\System\DxWGOGA.exe
  C:\Windows\System\DxWGOGA.exe
  2⤵
  PID:7204
- C:\Windows\System\dfZhOOj.exe
  C:\Windows\System\dfZhOOj.exe
  2⤵
  PID:7220
- C:\Windows\System\uYoVtRN.exe
  C:\Windows\System\uYoVtRN.exe
  2⤵
  PID:7236
- C:\Windows\System\LMGvKXp.exe
  C:\Windows\System\LMGvKXp.exe
  2⤵
  PID:7252
- C:\Windows\System\lgtdYDI.exe
  C:\Windows\System\lgtdYDI.exe
  2⤵
  PID:7268
- C:\Windows\System\GuAXNcd.exe
  C:\Windows\System\GuAXNcd.exe
  2⤵
  PID:7284
- C:\Windows\System\bgLbpQy.exe
  C:\Windows\System\bgLbpQy.exe
  2⤵
  PID:7300
- C:\Windows\System\dfJQGwg.exe
  C:\Windows\System\dfJQGwg.exe
  2⤵
  PID:7316
- C:\Windows\System\TXzQpKf.exe
  C:\Windows\System\TXzQpKf.exe
  2⤵
  PID:7332
- C:\Windows\System\SOjGURX.exe
  C:\Windows\System\SOjGURX.exe
  2⤵
  PID:7348
- C:\Windows\System\EuKYyHE.exe
  C:\Windows\System\EuKYyHE.exe
  2⤵
  PID:7364
- C:\Windows\System\DxjnNWU.exe
  C:\Windows\System\DxjnNWU.exe
  2⤵
  PID:7380
- C:\Windows\System\EoFgFuL.exe
  C:\Windows\System\EoFgFuL.exe
  2⤵
  PID:7396
- C:\Windows\System\MHTiNKZ.exe
  C:\Windows\System\MHTiNKZ.exe
  2⤵
  PID:7412
- C:\Windows\System\SukPLgl.exe
  C:\Windows\System\SukPLgl.exe
  2⤵
  PID:7428
- C:\Windows\System\IBgoAwY.exe
  C:\Windows\System\IBgoAwY.exe
  2⤵
  PID:7444
- C:\Windows\System\PmOvrcj.exe
  C:\Windows\System\PmOvrcj.exe
  2⤵
  PID:7460
- C:\Windows\System\FvrUmqw.exe
  C:\Windows\System\FvrUmqw.exe
  2⤵
  PID:7476
- C:\Windows\System\jRXpnOx.exe
  C:\Windows\System\jRXpnOx.exe
  2⤵
  PID:7492
- C:\Windows\System\iZXuYyh.exe
  C:\Windows\System\iZXuYyh.exe
  2⤵
  PID:7508
- C:\Windows\System\wpjjJYW.exe
  C:\Windows\System\wpjjJYW.exe
  2⤵
  PID:7524
- C:\Windows\System\iTkiPGH.exe
  C:\Windows\System\iTkiPGH.exe
  2⤵
  PID:7540
- C:\Windows\System\VDrASXV.exe
  C:\Windows\System\VDrASXV.exe
  2⤵
  PID:7556
- C:\Windows\System\QcMTjmy.exe
  C:\Windows\System\QcMTjmy.exe
  2⤵
  PID:7572
- C:\Windows\System\gHWZNes.exe
  C:\Windows\System\gHWZNes.exe
  2⤵
  PID:7588
- C:\Windows\System\HTwZzSx.exe
  C:\Windows\System\HTwZzSx.exe
  2⤵
  PID:7604
- C:\Windows\System\QCJZKHY.exe
  C:\Windows\System\QCJZKHY.exe
  2⤵
  PID:7620
- C:\Windows\System\impuFkv.exe
  C:\Windows\System\impuFkv.exe
  2⤵
  PID:7636
- C:\Windows\System\Icufczw.exe
  C:\Windows\System\Icufczw.exe
  2⤵
  PID:7652
- C:\Windows\System\dzWXOkF.exe
  C:\Windows\System\dzWXOkF.exe
  2⤵
  PID:7668
- C:\Windows\System\gxnnMUb.exe
  C:\Windows\System\gxnnMUb.exe
  2⤵
  PID:7684
- C:\Windows\System\slzvYSB.exe
  C:\Windows\System\slzvYSB.exe
  2⤵
  PID:7700
- C:\Windows\System\ouKYric.exe
  C:\Windows\System\ouKYric.exe
  2⤵
  PID:7716
- C:\Windows\System\aAHhktb.exe
  C:\Windows\System\aAHhktb.exe
  2⤵
  PID:7732
- C:\Windows\System\wbUhGTI.exe
  C:\Windows\System\wbUhGTI.exe
  2⤵
  PID:7748
- C:\Windows\System\cdeaqtG.exe
  C:\Windows\System\cdeaqtG.exe
  2⤵
  PID:7764
- C:\Windows\System\oPBwyAs.exe
  C:\Windows\System\oPBwyAs.exe
  2⤵
  PID:7780
- C:\Windows\System\txgHiwX.exe
  C:\Windows\System\txgHiwX.exe
  2⤵
  PID:7796
- C:\Windows\System\OwzYAIm.exe
  C:\Windows\System\OwzYAIm.exe
  2⤵
  PID:7816
- C:\Windows\System\nQARyql.exe
  C:\Windows\System\nQARyql.exe
  2⤵
  PID:7832
- C:\Windows\System\jtrXJpN.exe
  C:\Windows\System\jtrXJpN.exe
  2⤵
  PID:7848
- C:\Windows\System\wMFhpiJ.exe
  C:\Windows\System\wMFhpiJ.exe
  2⤵
  PID:7868
- C:\Windows\System\PKSzdrp.exe
  C:\Windows\System\PKSzdrp.exe
  2⤵
  PID:7892
- C:\Windows\System\TJxjveP.exe
  C:\Windows\System\TJxjveP.exe
  2⤵
  PID:7908
- C:\Windows\System\WEjYMkG.exe
  C:\Windows\System\WEjYMkG.exe
  2⤵
  PID:7928
- C:\Windows\System\EYiNanP.exe
  C:\Windows\System\EYiNanP.exe
  2⤵
  PID:7944
- C:\Windows\System\VLNtFAh.exe
  C:\Windows\System\VLNtFAh.exe
  2⤵
  PID:7968
- C:\Windows\System\YPlbHLA.exe
  C:\Windows\System\YPlbHLA.exe
  2⤵
  PID:7984
- C:\Windows\System\UQoWveW.exe
  C:\Windows\System\UQoWveW.exe
  2⤵
  PID:8004
- C:\Windows\System\mwSCHeM.exe
  C:\Windows\System\mwSCHeM.exe
  2⤵
  PID:8020
- C:\Windows\System\WPiSgwr.exe
  C:\Windows\System\WPiSgwr.exe
  2⤵
  PID:8036
- C:\Windows\System\NeDRIVn.exe
  C:\Windows\System\NeDRIVn.exe
  2⤵
  PID:8060
- C:\Windows\System\KFmgwKG.exe
  C:\Windows\System\KFmgwKG.exe
  2⤵
  PID:8120
- C:\Windows\System\qHssDyF.exe
  C:\Windows\System\qHssDyF.exe
  2⤵
  PID:8136
- C:\Windows\System\nDemjwD.exe
  C:\Windows\System\nDemjwD.exe
  2⤵
  PID:8152
- C:\Windows\System\rEFtCAF.exe
  C:\Windows\System\rEFtCAF.exe
  2⤵
  PID:8168
- C:\Windows\System\CZfxGry.exe
  C:\Windows\System\CZfxGry.exe
  2⤵
  PID:8184
- C:\Windows\System\LRJXpgv.exe
  C:\Windows\System\LRJXpgv.exe
  2⤵
  PID:7196
- C:\Windows\System\uAehijx.exe
  C:\Windows\System\uAehijx.exe
  2⤵
  PID:7260
- C:\Windows\System\JmLlAhn.exe
  C:\Windows\System\JmLlAhn.exe
  2⤵
  PID:7296
- C:\Windows\System\huvAIpT.exe
  C:\Windows\System\huvAIpT.exe
  2⤵
  PID:6164
- C:\Windows\System\eIaCrHz.exe
  C:\Windows\System\eIaCrHz.exe
  2⤵
  PID:7248
- C:\Windows\System\eAGPvnB.exe
  C:\Windows\System\eAGPvnB.exe
  2⤵
  PID:7212
- C:\Windows\System\hElJfvH.exe
  C:\Windows\System\hElJfvH.exe
  2⤵
  PID:7312
- C:\Windows\System\qWzEXnS.exe
  C:\Windows\System\qWzEXnS.exe
  2⤵
  PID:7360
- C:\Windows\System\cJneZXZ.exe
  C:\Windows\System\cJneZXZ.exe
  2⤵
  PID:7376
- C:\Windows\System\dWxTyUq.exe
  C:\Windows\System\dWxTyUq.exe
  2⤵
  PID:7404
- C:\Windows\System\bpiIpcT.exe
  C:\Windows\System\bpiIpcT.exe
  2⤵
  PID:7456
- C:\Windows\System\MjNFfMQ.exe
  C:\Windows\System\MjNFfMQ.exe
  2⤵
  PID:7520
- C:\Windows\System\rIZguYX.exe
  C:\Windows\System\rIZguYX.exe
  2⤵
  PID:7580
- C:\Windows\System\DbLNySO.exe
  C:\Windows\System\DbLNySO.exe
  2⤵
  PID:7500
- C:\Windows\System\uLKvFol.exe
  C:\Windows\System\uLKvFol.exe
  2⤵
  PID:7648
- C:\Windows\System\FiDlHpx.exe
  C:\Windows\System\FiDlHpx.exe
  2⤵
  PID:7532
- C:\Windows\System\EETeBPb.exe
  C:\Windows\System\EETeBPb.exe
  2⤵
  PID:7600
- C:\Windows\System\HGaYSFV.exe
  C:\Windows\System\HGaYSFV.exe
  2⤵
  PID:7680
- C:\Windows\System\sQUBiDA.exe
  C:\Windows\System\sQUBiDA.exe
  2⤵
  PID:7708
- C:\Windows\System\PzZnOHS.exe
  C:\Windows\System\PzZnOHS.exe
  2⤵
  PID:7692
- C:\Windows\System\rFXyLzb.exe
  C:\Windows\System\rFXyLzb.exe
  2⤵
  PID:7772
- C:\Windows\System\JvoNcdo.exe
  C:\Windows\System\JvoNcdo.exe
  2⤵
  PID:7808
- C:\Windows\System\BVvPQyj.exe
  C:\Windows\System\BVvPQyj.exe
  2⤵
  PID:7844
- C:\Windows\System\YrucabR.exe
  C:\Windows\System\YrucabR.exe
  2⤵
  PID:7916
- C:\Windows\System\ejJyUDS.exe
  C:\Windows\System\ejJyUDS.exe
  2⤵
  PID:7864
- C:\Windows\System\uUjIuAi.exe
  C:\Windows\System\uUjIuAi.exe
  2⤵
  PID:7924
- C:\Windows\System\EYZhIrX.exe
  C:\Windows\System\EYZhIrX.exe
  2⤵
  PID:7940
- C:\Windows\System\rbvOQCb.exe
  C:\Windows\System\rbvOQCb.exe
  2⤵
  PID:7980
- C:\Windows\System\zhREMGe.exe
  C:\Windows\System\zhREMGe.exe
  2⤵
  PID:8028
- C:\Windows\System\rNqFxOt.exe
  C:\Windows\System\rNqFxOt.exe
  2⤵
  PID:8044
- C:\Windows\System\eVXaXJu.exe
  C:\Windows\System\eVXaXJu.exe
  2⤵
  PID:8080
- C:\Windows\System\xVuGWLe.exe
  C:\Windows\System\xVuGWLe.exe
  2⤵
  PID:8088
- C:\Windows\System\ULIpnMS.exe
  C:\Windows\System\ULIpnMS.exe
  2⤵
  PID:8104
- C:\Windows\System\zJXYOfz.exe
  C:\Windows\System\zJXYOfz.exe
  2⤵
  PID:8148
- C:\Windows\System\bquQyss.exe
  C:\Windows\System\bquQyss.exe
  2⤵
  PID:7200
- C:\Windows\System\DamNlCa.exe
  C:\Windows\System\DamNlCa.exe
  2⤵
  PID:7280
- C:\Windows\System\lHcNNCV.exe
  C:\Windows\System\lHcNNCV.exe
  2⤵
  PID:8160
- C:\Windows\System\boZASWY.exe
  C:\Windows\System\boZASWY.exe
  2⤵
  PID:7420
- C:\Windows\System\pSwmZOy.exe
  C:\Windows\System\pSwmZOy.exe
  2⤵
  PID:7020
- C:\Windows\System\RMKevRi.exe
  C:\Windows\System\RMKevRi.exe
  2⤵
  PID:6908
- C:\Windows\System\fPSjnBH.exe
  C:\Windows\System\fPSjnBH.exe
  2⤵
  PID:7184
- C:\Windows\System\PIMiMKN.exe
  C:\Windows\System\PIMiMKN.exe
  2⤵
  PID:7424
- C:\Windows\System\MEcxBww.exe
  C:\Windows\System\MEcxBww.exe
  2⤵
  PID:7472
- C:\Windows\System\rBQreMJ.exe
  C:\Windows\System\rBQreMJ.exe
  2⤵
  PID:7632
- C:\Windows\System\jPlRtpe.exe
  C:\Windows\System\jPlRtpe.exe
  2⤵
  PID:7596
- C:\Windows\System\fvUGbfj.exe
  C:\Windows\System\fvUGbfj.exe
  2⤵
  PID:7724
- C:\Windows\System\cgzWauN.exe
  C:\Windows\System\cgzWauN.exe
  2⤵
  PID:7728
- C:\Windows\System\VxxWnfR.exe
  C:\Windows\System\VxxWnfR.exe
  2⤵
  PID:8116
- C:\Windows\System\qVIxTAt.exe
  C:\Windows\System\qVIxTAt.exe
  2⤵
  PID:8000
- C:\Windows\System\VOwhwLY.exe
  C:\Windows\System\VOwhwLY.exe
  2⤵
  PID:8072
- C:\Windows\System\CwlBawc.exe
  C:\Windows\System\CwlBawc.exe
  2⤵
  PID:6424
- C:\Windows\System\AEDIYPk.exe
  C:\Windows\System\AEDIYPk.exe
  2⤵
  PID:7536
- C:\Windows\System\CHIkMDg.exe
  C:\Windows\System\CHIkMDg.exe
  2⤵
  PID:6824
- C:\Windows\System\DSGdOoL.exe
  C:\Windows\System\DSGdOoL.exe
  2⤵
  PID:7440
- C:\Windows\System\DpIwnnh.exe
  C:\Windows\System\DpIwnnh.exe
  2⤵
  PID:7628
- C:\Windows\System\vdMjZCs.exe
  C:\Windows\System\vdMjZCs.exe
  2⤵
  PID:7776
- C:\Windows\System\yZMiUhY.exe
  C:\Windows\System\yZMiUhY.exe
  2⤵
  PID:7888
- C:\Windows\System\KkQJwrj.exe
  C:\Windows\System\KkQJwrj.exe
  2⤵
  PID:7824
- C:\Windows\System\SbjnwZD.exe
  C:\Windows\System\SbjnwZD.exe
  2⤵
  PID:8084
- C:\Windows\System\UuKbcUT.exe
  C:\Windows\System\UuKbcUT.exe
  2⤵
  PID:8052
- C:\Windows\System\UKBLfml.exe
  C:\Windows\System\UKBLfml.exe
  2⤵
  PID:8032
- C:\Windows\System\PVpvFVk.exe
  C:\Windows\System\PVpvFVk.exe
  2⤵
  PID:7956
- C:\Windows\System\OIvTgjR.exe
  C:\Windows\System\OIvTgjR.exe
  2⤵
  PID:7216
- C:\Windows\System\CpJMTPr.exe
  C:\Windows\System\CpJMTPr.exe
  2⤵
  PID:7792
- C:\Windows\System\otAiqXA.exe
  C:\Windows\System\otAiqXA.exe
  2⤵
  PID:8056
- C:\Windows\System\LcEyOlR.exe
  C:\Windows\System\LcEyOlR.exe
  2⤵
  PID:7884
- C:\Windows\System\oSVwzyy.exe
  C:\Windows\System\oSVwzyy.exe
  2⤵
  PID:7488
- C:\Windows\System\fCUwxez.exe
  C:\Windows\System\fCUwxez.exe
  2⤵
  PID:7568
- C:\Windows\System\JqtjmkO.exe
  C:\Windows\System\JqtjmkO.exe
  2⤵
  PID:7356
- C:\Windows\System\YFlZeIW.exe
  C:\Windows\System\YFlZeIW.exe
  2⤵
  PID:7804
- C:\Windows\System\guqBTFW.exe
  C:\Windows\System\guqBTFW.exe
  2⤵
  PID:2332
- C:\Windows\System\BwLfULC.exe
  C:\Windows\System\BwLfULC.exe
  2⤵
  PID:8196
- C:\Windows\System\DibxXxz.exe
  C:\Windows\System\DibxXxz.exe
  2⤵
  PID:8216
- C:\Windows\System\veLMxEr.exe
  C:\Windows\System\veLMxEr.exe
  2⤵
  PID:8236
- C:\Windows\System\PqBiDTc.exe
  C:\Windows\System\PqBiDTc.exe
  2⤵
  PID:8252
- C:\Windows\System\AJnAUJp.exe
  C:\Windows\System\AJnAUJp.exe
  2⤵
  PID:8268
- C:\Windows\System\KexfgVW.exe
  C:\Windows\System\KexfgVW.exe
  2⤵
  PID:8284
- C:\Windows\System\mPEYPLZ.exe
  C:\Windows\System\mPEYPLZ.exe
  2⤵
  PID:8300
- C:\Windows\System\sCEwSwO.exe
  C:\Windows\System\sCEwSwO.exe
  2⤵
  PID:8316
- C:\Windows\System\GkSCSfc.exe
  C:\Windows\System\GkSCSfc.exe
  2⤵
  PID:8332
- C:\Windows\System\nAAqkhr.exe
  C:\Windows\System\nAAqkhr.exe
  2⤵
  PID:8348
- C:\Windows\System\DTIWYPu.exe
  C:\Windows\System\DTIWYPu.exe
  2⤵
  PID:8364
- C:\Windows\System\UbooQZe.exe
  C:\Windows\System\UbooQZe.exe
  2⤵
  PID:8380
- C:\Windows\System\XTtVikm.exe
  C:\Windows\System\XTtVikm.exe
  2⤵
  PID:8396
- C:\Windows\System\pbuHKPO.exe
  C:\Windows\System\pbuHKPO.exe
  2⤵
  PID:8412
- C:\Windows\System\eITkOsl.exe
  C:\Windows\System\eITkOsl.exe
  2⤵
  PID:8428
- C:\Windows\System\KMIZDgf.exe
  C:\Windows\System\KMIZDgf.exe
  2⤵
  PID:8444
- C:\Windows\System\QgyHSIs.exe
  C:\Windows\System\QgyHSIs.exe
  2⤵
  PID:8460
- C:\Windows\System\gRUksVA.exe
  C:\Windows\System\gRUksVA.exe
  2⤵
  PID:8476
- C:\Windows\System\WEnuejy.exe
  C:\Windows\System\WEnuejy.exe
  2⤵
  PID:8496
- C:\Windows\System\YPSGQry.exe
  C:\Windows\System\YPSGQry.exe
  2⤵
  PID:8512
- C:\Windows\System\hHxEFQE.exe
  C:\Windows\System\hHxEFQE.exe
  2⤵
  PID:8528
- C:\Windows\System\RELgCHb.exe
  C:\Windows\System\RELgCHb.exe
  2⤵
  PID:8544
- C:\Windows\System\jzCsxoG.exe
  C:\Windows\System\jzCsxoG.exe
  2⤵
  PID:8560
- C:\Windows\System\dkIcFMG.exe
  C:\Windows\System\dkIcFMG.exe
  2⤵
  PID:8588
- C:\Windows\System\sfdnIft.exe
  C:\Windows\System\sfdnIft.exe
  2⤵
  PID:8604
- C:\Windows\System\pKJHeDv.exe
  C:\Windows\System\pKJHeDv.exe
  2⤵
  PID:8644
- C:\Windows\System\jiKflfV.exe
  C:\Windows\System\jiKflfV.exe
  2⤵
  PID:8660
- C:\Windows\System\TCDkcWk.exe
  C:\Windows\System\TCDkcWk.exe
  2⤵
  PID:8676
- C:\Windows\System\MSFPydj.exe
  C:\Windows\System\MSFPydj.exe
  2⤵
  PID:8692
- C:\Windows\System\fHRERye.exe
  C:\Windows\System\fHRERye.exe
  2⤵
  PID:8712
- C:\Windows\System\tHKdtVw.exe
  C:\Windows\System\tHKdtVw.exe
  2⤵
  PID:8728
- C:\Windows\System\fYBzhef.exe
  C:\Windows\System\fYBzhef.exe
  2⤵
  PID:8744
- C:\Windows\System\BeHyDpv.exe
  C:\Windows\System\BeHyDpv.exe
  2⤵
  PID:8972
- C:\Windows\System\lJnUZQr.exe
  C:\Windows\System\lJnUZQr.exe
  2⤵
  PID:9012
- C:\Windows\System\iHJPcxq.exe
  C:\Windows\System\iHJPcxq.exe
  2⤵
  PID:9028
- C:\Windows\System\fPBicCr.exe
  C:\Windows\System\fPBicCr.exe
  2⤵
  PID:9044
- C:\Windows\System\XShGwhF.exe
  C:\Windows\System\XShGwhF.exe
  2⤵
  PID:9060
- C:\Windows\System\spNIBcn.exe
  C:\Windows\System\spNIBcn.exe
  2⤵
  PID:9080
- C:\Windows\System\MycqDMy.exe
  C:\Windows\System\MycqDMy.exe
  2⤵
  PID:9100
- C:\Windows\System\KhITYPq.exe
  C:\Windows\System\KhITYPq.exe
  2⤵
  PID:9116
- C:\Windows\System\tKzuiLH.exe
  C:\Windows\System\tKzuiLH.exe
  2⤵
  PID:9132
- C:\Windows\System\toksMyR.exe
  C:\Windows\System\toksMyR.exe
  2⤵
  PID:9148
- C:\Windows\System\XVadaSf.exe
  C:\Windows\System\XVadaSf.exe
  2⤵
  PID:9164
- C:\Windows\System\XDhsePj.exe
  C:\Windows\System\XDhsePj.exe
  2⤵
  PID:9180
- C:\Windows\System\iFYkfyV.exe
  C:\Windows\System\iFYkfyV.exe
  2⤵
  PID:9208
- C:\Windows\System\TEJPXep.exe
  C:\Windows\System\TEJPXep.exe
  2⤵
  PID:8096
- C:\Windows\System\vSbHIGf.exe
  C:\Windows\System\vSbHIGf.exe
  2⤵
  PID:8232
- C:\Windows\System\bNVjiXH.exe
  C:\Windows\System\bNVjiXH.exe
  2⤵
  PID:8296
- C:\Windows\System\oaXmLMk.exe
  C:\Windows\System\oaXmLMk.exe
  2⤵
  PID:8388
- C:\Windows\System\mEgZIpk.exe
  C:\Windows\System\mEgZIpk.exe
  2⤵
  PID:8248
- C:\Windows\System\yYAaGdT.exe
  C:\Windows\System\yYAaGdT.exe
  2⤵
  PID:8652
- C:\Windows\System\FEROEYl.exe
  C:\Windows\System\FEROEYl.exe
  2⤵
  PID:8904
- C:\Windows\System\jZjImSM.exe
  C:\Windows\System\jZjImSM.exe
  2⤵
  PID:8924
- C:\Windows\System\QwiELZz.exe
  C:\Windows\System\QwiELZz.exe
  2⤵
  PID:8940
- C:\Windows\System\lzoSzMr.exe
  C:\Windows\System\lzoSzMr.exe
  2⤵
  PID:8956
- C:\Windows\System\xPWRcjc.exe
  C:\Windows\System\xPWRcjc.exe
  2⤵
  PID:8980
- C:\Windows\System\RWvAROR.exe
  C:\Windows\System\RWvAROR.exe
  2⤵
  PID:8996
- C:\Windows\System\uGEACqY.exe
  C:\Windows\System\uGEACqY.exe
  2⤵
  PID:9024
- C:\Windows\System\uGwiAju.exe
  C:\Windows\System\uGwiAju.exe
  2⤵
  PID:9092
- C:\Windows\System\ZOatLha.exe
  C:\Windows\System\ZOatLha.exe
  2⤵
  PID:9040
- C:\Windows\System\BPTAlXG.exe
  C:\Windows\System\BPTAlXG.exe
  2⤵
  PID:9200
- C:\Windows\System\fkRNCTO.exe
  C:\Windows\System\fkRNCTO.exe
  2⤵
  PID:9204
- C:\Windows\System\FXQxtqA.exe
  C:\Windows\System\FXQxtqA.exe
  2⤵
  PID:8228
- C:\Windows\System\oBBVWPZ.exe
  C:\Windows\System\oBBVWPZ.exe
  2⤵
  PID:9108
- C:\Windows\System\FPgfiQz.exe
  C:\Windows\System\FPgfiQz.exe
  2⤵
  PID:9172
- C:\Windows\System\MgZkISZ.exe
  C:\Windows\System\MgZkISZ.exe
  2⤵
  PID:7812
- C:\Windows\System\DVnAeTI.exe
  C:\Windows\System\DVnAeTI.exe
  2⤵
  PID:8356
- C:\Windows\System\lzPqnoO.exe
  C:\Windows\System\lzPqnoO.exe
  2⤵
  PID:8452
- C:\Windows\System\stCugyU.exe
  C:\Windows\System\stCugyU.exe
  2⤵
  PID:8484
- C:\Windows\System\EEhWGWL.exe
  C:\Windows\System\EEhWGWL.exe
  2⤵
  PID:8524
- C:\Windows\System\IyMoKpZ.exe
  C:\Windows\System\IyMoKpZ.exe
  2⤵
  PID:8312
- C:\Windows\System\qvXpxNW.exe
  C:\Windows\System\qvXpxNW.exe
  2⤵
  PID:8536
- C:\Windows\System\huGQxSx.exe
  C:\Windows\System\huGQxSx.exe
  2⤵
  PID:8408
- C:\Windows\System\mCfMKvW.exe
  C:\Windows\System\mCfMKvW.exe
  2⤵
  PID:8504
- C:\Windows\System\HvDINla.exe
  C:\Windows\System\HvDINla.exe
  2⤵
  PID:8684
- C:\Windows\System\fSYbOuq.exe
  C:\Windows\System\fSYbOuq.exe
  2⤵
  PID:8584
- C:\Windows\System\IqsaYhV.exe
  C:\Windows\System\IqsaYhV.exe
  2⤵
  PID:8572
- C:\Windows\System\BBxRdxK.exe
  C:\Windows\System\BBxRdxK.exe
  2⤵
  PID:8616
- C:\Windows\System\SmuolhY.exe
  C:\Windows\System\SmuolhY.exe
  2⤵
  PID:8672
- C:\Windows\System\QyaiBmi.exe
  C:\Windows\System\QyaiBmi.exe
  2⤵
  PID:8704
- C:\Windows\System\SZJivLF.exe
  C:\Windows\System\SZJivLF.exe
  2⤵
  PID:8740
- C:\Windows\System\fRhhAat.exe
  C:\Windows\System\fRhhAat.exe
  2⤵
  PID:8764
- C:\Windows\System\bfmzCtx.exe
  C:\Windows\System\bfmzCtx.exe
  2⤵
  PID:8784
- C:\Windows\System\vyGTsYO.exe
  C:\Windows\System\vyGTsYO.exe
  2⤵
  PID:8792
- C:\Windows\System\luRdoZl.exe
  C:\Windows\System\luRdoZl.exe
  2⤵
  PID:8812
- C:\Windows\System\LzrRNHa.exe
  C:\Windows\System\LzrRNHa.exe
  2⤵
  PID:8824
- C:\Windows\System\PapntUZ.exe
  C:\Windows\System\PapntUZ.exe
  2⤵
  PID:8840
- C:\Windows\System\IZOGzcJ.exe
  C:\Windows\System\IZOGzcJ.exe
  2⤵
  PID:8856
- C:\Windows\System\eyxKGFn.exe
  C:\Windows\System\eyxKGFn.exe
  2⤵
  PID:8872
- C:\Windows\System\sehUzKz.exe
  C:\Windows\System\sehUzKz.exe
  2⤵
  PID:8876
- C:\Windows\System\LJvsjvk.exe
  C:\Windows\System\LJvsjvk.exe
  2⤵
  PID:8912
- C:\Windows\System\NyUBenh.exe
  C:\Windows\System\NyUBenh.exe
  2⤵
  PID:8928
- C:\Windows\System\ggUJJUQ.exe
  C:\Windows\System\ggUJJUQ.exe
  2⤵
  PID:8992
- C:\Windows\System\coOdaMl.exe
  C:\Windows\System\coOdaMl.exe
  2⤵
  PID:9056
- C:\Windows\System\JLLPBfV.exe
  C:\Windows\System\JLLPBfV.exe
  2⤵
  PID:9160
- C:\Windows\System\ZNNlbaA.exe
  C:\Windows\System\ZNNlbaA.exe
  2⤵
  PID:9144
- C:\Windows\System\vpPmTsF.exe
  C:\Windows\System\vpPmTsF.exe
  2⤵
  PID:9128
- C:\Windows\System\LARBVvy.exe
  C:\Windows\System\LARBVvy.exe
  2⤵
  PID:9192
- C:\Windows\System\SwIXHVi.exe
  C:\Windows\System\SwIXHVi.exe
  2⤵
  PID:7744
- C:\Windows\System\lqJYAbc.exe
  C:\Windows\System\lqJYAbc.exe
  2⤵
  PID:8520
- C:\Windows\System\gFbQKKE.exe
  C:\Windows\System\gFbQKKE.exe
  2⤵
  PID:8344
- C:\Windows\System\zvhRKpt.exe
  C:\Windows\System\zvhRKpt.exe
  2⤵
  PID:8568
- C:\Windows\System\DWkDHQL.exe
  C:\Windows\System\DWkDHQL.exe
  2⤵
  PID:8580
- C:\Windows\System\NhGoRHq.exe
  C:\Windows\System\NhGoRHq.exe
  2⤵
  PID:8612
- C:\Windows\System\jyczauv.exe
  C:\Windows\System\jyczauv.exe
  2⤵
  PID:8636
- C:\Windows\System\AKqCfkY.exe
  C:\Windows\System\AKqCfkY.exe
  2⤵
  PID:8760
- C:\Windows\System\ByvcWzp.exe
  C:\Windows\System\ByvcWzp.exe
  2⤵
  PID:8756
- C:\Windows\System\zTZxDFX.exe
  C:\Windows\System\zTZxDFX.exe
  2⤵
  PID:8820
- C:\Windows\System\hJcPllS.exe
  C:\Windows\System\hJcPllS.exe
  2⤵
  PID:8884
- C:\Windows\System\HQSwfDZ.exe
  C:\Windows\System\HQSwfDZ.exe
  2⤵
  PID:8900
- C:\Windows\System\yxwdfmt.exe
  C:\Windows\System\yxwdfmt.exe
  2⤵
  PID:8988
- C:\Windows\System\HvEOfTD.exe
  C:\Windows\System\HvEOfTD.exe
  2⤵
  PID:9124
- C:\Windows\System\zkeyRJS.exe
  C:\Windows\System\zkeyRJS.exe
  2⤵
  PID:8340
- C:\Windows\System\bpavjcA.exe
  C:\Windows\System\bpavjcA.exe
  2⤵
  PID:8308
- C:\Windows\System\rFxfOzy.exe
  C:\Windows\System\rFxfOzy.exe
  2⤵
  PID:8952
- C:\Windows\System\rtUetsx.exe
  C:\Windows\System\rtUetsx.exe
  2⤵
  PID:8420
- C:\Windows\System\TuFpTfw.exe
  C:\Windows\System\TuFpTfw.exe
  2⤵
  PID:8508
- C:\Windows\System\XPnpoOP.exe
  C:\Windows\System\XPnpoOP.exe
  2⤵
  PID:8576
- C:\Windows\System\NeHSlIX.exe
  C:\Windows\System\NeHSlIX.exe
  2⤵
  PID:8864
- C:\Windows\System\ovPGSCL.exe
  C:\Windows\System\ovPGSCL.exe
  2⤵
  PID:8772
- C:\Windows\System\OaQRQrq.exe
  C:\Windows\System\OaQRQrq.exe
  2⤵
  PID:9220
- C:\Windows\System\lOXEZtk.exe
  C:\Windows\System\lOXEZtk.exe
  2⤵
  PID:9236
- C:\Windows\System\QKeRxlG.exe
  C:\Windows\System\QKeRxlG.exe
  2⤵
  PID:9256
- C:\Windows\System\QKaWsuk.exe
  C:\Windows\System\QKaWsuk.exe
  2⤵
  PID:9276
- C:\Windows\System\YCMaLwB.exe
  C:\Windows\System\YCMaLwB.exe
  2⤵
  PID:9296
- C:\Windows\System\PWrwzYk.exe
  C:\Windows\System\PWrwzYk.exe
  2⤵
  PID:9312
- C:\Windows\System\RYeidTo.exe
  C:\Windows\System\RYeidTo.exe
  2⤵
  PID:9328
- C:\Windows\System\VXVHUyE.exe
  C:\Windows\System\VXVHUyE.exe
  2⤵
  PID:9344
- C:\Windows\System\VZfgJQO.exe
  C:\Windows\System\VZfgJQO.exe
  2⤵
  PID:9360
- C:\Windows\System\JFImLbG.exe
  C:\Windows\System\JFImLbG.exe
  2⤵
  PID:9376
- C:\Windows\System\ztdsXqg.exe
  C:\Windows\System\ztdsXqg.exe
  2⤵
  PID:9392
- C:\Windows\System\CIumLnW.exe
  C:\Windows\System\CIumLnW.exe
  2⤵
  PID:9408
- C:\Windows\System\pWbviLU.exe
  C:\Windows\System\pWbviLU.exe
  2⤵
  PID:9424
- C:\Windows\System\BCMXJUq.exe
  C:\Windows\System\BCMXJUq.exe
  2⤵
  PID:9440
- C:\Windows\System\AOERQZG.exe
  C:\Windows\System\AOERQZG.exe
  2⤵
  PID:9456
- C:\Windows\System\hNhAope.exe
  C:\Windows\System\hNhAope.exe
  2⤵
  PID:9548
- C:\Windows\System\fFBYBbI.exe
  C:\Windows\System\fFBYBbI.exe
  2⤵
  PID:9740
- C:\Windows\System\RvkaSRF.exe
  C:\Windows\System\RvkaSRF.exe
  2⤵
  PID:9756
- C:\Windows\System\YlYVEni.exe
  C:\Windows\System\YlYVEni.exe
  2⤵
  PID:9772
- C:\Windows\System\wBAoZdD.exe
  C:\Windows\System\wBAoZdD.exe
  2⤵
  PID:9788
- C:\Windows\System\dPYzxaz.exe
  C:\Windows\System\dPYzxaz.exe
  2⤵
  PID:9828
- C:\Windows\System\gzgMlEV.exe
  C:\Windows\System\gzgMlEV.exe
  2⤵
  PID:9844
- C:\Windows\System\grgVYll.exe
  C:\Windows\System\grgVYll.exe
  2⤵
  PID:9860
- C:\Windows\System\LFtXGwI.exe
  C:\Windows\System\LFtXGwI.exe
  2⤵
  PID:9880
- C:\Windows\System\TaHScRj.exe
  C:\Windows\System\TaHScRj.exe
  2⤵
  PID:9900
- C:\Windows\System\ejvpuvH.exe
  C:\Windows\System\ejvpuvH.exe
  2⤵
  PID:9916
- C:\Windows\System\gAefYDJ.exe
  C:\Windows\System\gAefYDJ.exe
  2⤵
  PID:9932
- C:\Windows\System\MtSWyQE.exe
  C:\Windows\System\MtSWyQE.exe
  2⤵
  PID:9948
- C:\Windows\System\hOTBOgV.exe
  C:\Windows\System\hOTBOgV.exe
  2⤵
  PID:9964
- C:\Windows\System\LiADkJi.exe
  C:\Windows\System\LiADkJi.exe
  2⤵
  PID:9980
- C:\Windows\System\hYrEaSC.exe
  C:\Windows\System\hYrEaSC.exe
  2⤵
  PID:10000
- C:\Windows\System\FgdSrnf.exe
  C:\Windows\System\FgdSrnf.exe
  2⤵
  PID:10016
- C:\Windows\System\bcnGNpG.exe
  C:\Windows\System\bcnGNpG.exe
  2⤵
  PID:10032
- C:\Windows\System\KNOFPmH.exe
  C:\Windows\System\KNOFPmH.exe
  2⤵
  PID:10048
- C:\Windows\System\kqJlfvF.exe
  C:\Windows\System\kqJlfvF.exe
  2⤵
  PID:10064
- C:\Windows\System\SyBvFpk.exe
  C:\Windows\System\SyBvFpk.exe
  2⤵
  PID:10080
- C:\Windows\System\KAaRHoI.exe
  C:\Windows\System\KAaRHoI.exe
  2⤵
  PID:10096
- C:\Windows\System\sgniDdi.exe
  C:\Windows\System\sgniDdi.exe
  2⤵
  PID:10164
- C:\Windows\System\YCTuZzU.exe
  C:\Windows\System\YCTuZzU.exe
  2⤵
  PID:10180
- C:\Windows\System\sEedheh.exe
  C:\Windows\System\sEedheh.exe
  2⤵
  PID:10196
- C:\Windows\System\DbmAhFl.exe
  C:\Windows\System\DbmAhFl.exe
  2⤵
  PID:10216
- C:\Windows\System\nWZojjR.exe
  C:\Windows\System\nWZojjR.exe
  2⤵
  PID:10232
- C:\Windows\System\CTFiBsS.exe
  C:\Windows\System\CTFiBsS.exe
  2⤵
  PID:8776
- C:\Windows\System\RFZzUBT.exe
  C:\Windows\System\RFZzUBT.exe
  2⤵
  PID:9248
- C:\Windows\System\hivZhjr.exe
  C:\Windows\System\hivZhjr.exe
  2⤵
  PID:8880
- C:\Windows\System\lxQmnRY.exe
  C:\Windows\System\lxQmnRY.exe
  2⤵
  PID:8328
- C:\Windows\System\QRUYARx.exe
  C:\Windows\System\QRUYARx.exe
  2⤵
  PID:8788
- C:\Windows\System\kfevJsO.exe
  C:\Windows\System\kfevJsO.exe
  2⤵
  PID:8960
- C:\Windows\System\JDdVqmE.exe
  C:\Windows\System\JDdVqmE.exe
  2⤵
  PID:9284
- C:\Windows\System\wlFThCL.exe
  C:\Windows\System\wlFThCL.exe
  2⤵
  PID:9320
- C:\Windows\System\ARRbwPb.exe
  C:\Windows\System\ARRbwPb.exe
  2⤵
  PID:9340
- C:\Windows\System\uuoWEVh.exe
  C:\Windows\System\uuoWEVh.exe
  2⤵
  PID:9388
- C:\Windows\System\onglZFq.exe
  C:\Windows\System\onglZFq.exe
  2⤵
  PID:9432
- C:\Windows\System\xMbirJa.exe
  C:\Windows\System\xMbirJa.exe
  2⤵
  PID:9404
- C:\Windows\System\cAYZiZQ.exe
  C:\Windows\System\cAYZiZQ.exe
  2⤵
  PID:9476
- C:\Windows\System\cfJsysI.exe
  C:\Windows\System\cfJsysI.exe
  2⤵
  PID:9492
- C:\Windows\System\OJMrhvB.exe
  C:\Windows\System\OJMrhvB.exe
  2⤵
  PID:9508
- C:\Windows\System\UUtxcAf.exe
  C:\Windows\System\UUtxcAf.exe
  2⤵
  PID:9520
- C:\Windows\System\JlwjyCl.exe
  C:\Windows\System\JlwjyCl.exe
  2⤵
  PID:9556
- C:\Windows\System\caWrSLe.exe
  C:\Windows\System\caWrSLe.exe
  2⤵
  PID:9576
- C:\Windows\System\jhygCiF.exe
  C:\Windows\System\jhygCiF.exe
  2⤵
  PID:9580
- C:\Windows\System\IGbIhQI.exe
  C:\Windows\System\IGbIhQI.exe
  2⤵
  PID:9644
- C:\Windows\System\BpOfEXk.exe
  C:\Windows\System\BpOfEXk.exe
  2⤵
  PID:9692
- C:\Windows\System\pNhOwqK.exe
  C:\Windows\System\pNhOwqK.exe
  2⤵
  PID:9704
- C:\Windows\System\SDccrKr.exe
  C:\Windows\System\SDccrKr.exe
  2⤵
  PID:9636
- C:\Windows\System\ssOImAM.exe
  C:\Windows\System\ssOImAM.exe
  2⤵
  PID:9676
- C:\Windows\System\wZZYcTm.exe
  C:\Windows\System\wZZYcTm.exe
  2⤵
  PID:9712
- C:\Windows\System\nSHFlao.exe
  C:\Windows\System\nSHFlao.exe
  2⤵
  PID:9732
- C:\Windows\System\gDWwkSf.exe
  C:\Windows\System\gDWwkSf.exe
  2⤵
  PID:9752
- C:\Windows\System\mEKchfj.exe
  C:\Windows\System\mEKchfj.exe
  2⤵
  PID:9808
- C:\Windows\System\jNpspui.exe
  C:\Windows\System\jNpspui.exe
  2⤵
  PID:9824
- C:\Windows\System\WzDxJYa.exe
  C:\Windows\System\WzDxJYa.exe
  2⤵
  PID:9888
- C:\Windows\System\HvnWxun.exe
  C:\Windows\System\HvnWxun.exe
  2⤵
  PID:9956
- C:\Windows\System\SoVnBtv.exe
  C:\Windows\System\SoVnBtv.exe
  2⤵
  PID:10024
- C:\Windows\System\gbYCqKg.exe
  C:\Windows\System\gbYCqKg.exe
  2⤵
  PID:9868
- C:\Windows\System\FVAcMYX.exe
  C:\Windows\System\FVAcMYX.exe
  2⤵
  PID:9872
- C:\Windows\System\PCqMvAD.exe
  C:\Windows\System\PCqMvAD.exe
  2⤵
  PID:9912
- C:\Windows\System\UIcJJwX.exe
  C:\Windows\System\UIcJJwX.exe
  2⤵
  PID:10076
- C:\Windows\System\fJXkMAZ.exe
  C:\Windows\System\fJXkMAZ.exe
  2⤵
  PID:9976
- C:\Windows\System\hiHrpGR.exe
  C:\Windows\System\hiHrpGR.exe
  2⤵
  PID:9972
- C:\Windows\System\kXDZJDI.exe
  C:\Windows\System\kXDZJDI.exe
  2⤵
  PID:10128
- C:\Windows\System\SByjRLw.exe
  C:\Windows\System\SByjRLw.exe
  2⤵
  PID:10136
- C:\Windows\System\ShPFOJm.exe
  C:\Windows\System\ShPFOJm.exe
  2⤵
  PID:10148
- C:\Windows\System\MRnmhRi.exe
  C:\Windows\System\MRnmhRi.exe
  2⤵
  PID:10176
- C:\Windows\System\vKJeFEi.exe
  C:\Windows\System\vKJeFEi.exe
  2⤵
  PID:10208
- C:\Windows\System\KGzolSJ.exe
  C:\Windows\System\KGzolSJ.exe
  2⤵
  PID:8968
- C:\Windows\System\NtiUrOn.exe
  C:\Windows\System\NtiUrOn.exe
  2⤵
  PID:8948
- C:\Windows\System\fODiBfa.exe
  C:\Windows\System\fODiBfa.exe
  2⤵
  PID:8280
- C:\Windows\System\rwaodwv.exe
  C:\Windows\System\rwaodwv.exe
  2⤵
  PID:9896
- C:\Windows\System\xoUHLNw.exe
  C:\Windows\System\xoUHLNw.exe
  2⤵
  PID:9384
- C:\Windows\System\iKASIib.exe
  C:\Windows\System\iKASIib.exe
  2⤵
  PID:9500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AgfXPrS.exe

Filesize
1.3MB

MD5
5d0cc7df3796871822ddda2d28788f86

SHA1
8c5c9312dee9bc186dd26dcbff9e8007ba9cc474

SHA256
1a26f3c9cacf9203aaed00b4b8a7855ee8349f204e10b6788f31bfa5bfc59f27

SHA512
698a225e9c5c052c26ee7e1a12141ba0d1a5e0732aaf87a99c1bcf58450c0dc570f9f7782a39e61a1857219768e0bd43832b323071bf33d0d6148c626a779d1b

Download Submit
C:\Windows\system\AqUuBQh.exe

Filesize
1.3MB

MD5
47c55a0cea27205b49a6da4619685050

SHA1
d1e5fe3e47fb5d1af1bd651a68cd3ac6efa15488

SHA256
deb25aa151b671f88342099440a4b12224d7d42e19ee25ce2250665571ba6c3a

SHA512
e414b7499b475d718d98133e7669dd99cd131eb323ba33c0570fc4f0fef2b4993b57f47c0c431b63e14cd7223635d6fe7bd45f0742e785e8267213e312f987ac

Download Submit
C:\Windows\system\BXuUEns.exe

Filesize
1.3MB

MD5
b0dfdcf4c672a05693d114f2b1d25fad

SHA1
7c5ae7d5f0ba0daa953f16e0609290ecf76850f6

SHA256
908ee6769f5041bb011054389e084efa76bfb857e780dcb7ab397a85a63e7710

SHA512
89e35c28fb245c0e09aa2451f9856fad0e84761598b3165ed0d5e105588bda757d41aac6ea8bcad3d7c9a5af3dd72e48c64538cb05c5ffdf177caaab0abd7650

Download Submit
C:\Windows\system\GIwyDVN.exe

Filesize
1.3MB

MD5
22a08dbba9ffbd2547671d069b4a2054

SHA1
66006266058d4bfbf632f81fe9e3ce46f22e003e

SHA256
48ec58c8bc91a1d5ca96fe73bbc97f73f9db767ab300214303c917169505066e

SHA512
123f644d3cefb2d9c7eaa3af149ae86d9fd5018bc01851da23759aef75797610597117b5c36d69988f5b87b8171117b57d88f33a5e79be74e39eb5b2ffc8953d

Download Submit
C:\Windows\system\HXgQgWu.exe

Filesize
1.3MB

MD5
fb68fcf36b87d3ecb476cdf9c41ed362

SHA1
a8d64926002e37ea610a6c5e5ccead897beab76a

SHA256
1ce6ba31d75d5ffe01a1e9e72f5cf8b0d3e7e96d10b8d37257ecb0a3551ad7df

SHA512
de4d338a7c1319fdb3fb3782e97e4f8e34d8a35e01ec92d28564f3cbcfcfd12a86eff75c7c4d1790f26ea74eb0a262c3c9f369cbb4841017b66181380c0461ef

Download Submit
C:\Windows\system\IxGWgcC.exe

Filesize
1.3MB

MD5
859ca51ffeee340ea0408db0e9379201

SHA1
e04b14232f8edefea727e935a216d82e9d4eb741

SHA256
5a913776c4e8a283815de2a40e919eab5d527301393c6087ae88f5b2d0859f82

SHA512
8e729a2e9f3aa8ef99e52247f6da6fee2fbf91dc9bb047cdb534768196fd116769c9e2186148e7c183219beca32e7f677fb680e63c0c24aa9f97faf5e48cdb98

Download Submit
C:\Windows\system\JOZnbfX.exe

Filesize
1.3MB

MD5
f793678342fa539fbf1613fa49ed9280

SHA1
6b8c2e7b746cde2ecb8df6ff5d0cc3fda32ae155

SHA256
5157ef02aa6d843812a7602d3fbe265f8ef0f28999133cd60155650090e21429

SHA512
23e0e4d0c5bce6a5a250fd32fea61b0b457462f700ac3cd1ef4979c5eede57cafbeead45bd28a2549f665af82c30f084b075bbdb2506d66885668f09e326c4d0

Download Submit
C:\Windows\system\KGZPGEm.exe

Filesize
1.3MB

MD5
690a449e00fc87052e28aff82efe34b8

SHA1
5f7e690a3cf863098c5a81789cc9859189d71b73

SHA256
710064bdd369731d66e9b31a09a29597cea2e48cc366b9a89507448cc469787d

SHA512
e5396616fc0acb79ed0ea133086a6780d87b406bc2d2d11d1ac8b880c27f091048b1139ff4cb2f7ddba90154ad757a398129b45796f16428b83bbe4bb1fa5383

Download Submit
C:\Windows\system\OmShRmF.exe

Filesize
1.3MB

MD5
ca8500c275905779d02bc547c301afa1

SHA1
a28a0a7c33d003bbbd08418df8b2a8f294532653

SHA256
adc4ad52c421a66aed98a2b41060cb568e1d46fd8f0dea36b25602fe5976f450

SHA512
068382fedc6aec6a6c12084ee5f2148455bf88fa9238cd70013fe559044e7dca725fb3b7bb3d7b6b9057791f8f514e61a8509434783bbb74993a163b39695e52

Download Submit
C:\Windows\system\SEulckk.exe

Filesize
1.3MB

MD5
544ced46c0e3f022e6e540cc6543d83a

SHA1
22aeef0a2d0b9e27f3f70c1451cd43bf280aac4b

SHA256
1a45095214d27e3083f460f8cd1d42ee202ca6a1371826d7e4932fa5829fadb8

SHA512
4a7e8d681ddcbf43a27f6867489137cdbf6c0620f191b1e02863c391ce6c2515a1294375adfb6ca029b4df0e68faa5ab1fa026acef64d7c442c6bdb63980645a

Download Submit
C:\Windows\system\WJaszRU.exe

Filesize
1.3MB

MD5
6f6b4cd1a6fe891769a1ffb6ccc84a52

SHA1
bb6e85ab4a1baefaf497b113ae92ca59dedd764b

SHA256
0827440f115616e56562c966c1a6be7e32e3f8a26d623d58ca99b865408f8aa2

SHA512
a09ed3c3be3242621963ddec3ed1536740ef8bfebca8551c52126e5553d58a881d5d2d46aac112ae9bf9ab9a996c177489f3beec210ff069b81f38ea1d91ba4f

Download Submit
C:\Windows\system\YfVaUmB.exe

Filesize
1.3MB

MD5
035daefdbaff7b3618525237e576dcc2

SHA1
8307af3c1e7d7dbfc9b9b97d4db89b65783898c0

SHA256
c31d6e16ac5b4514e3dafed86f344ddcdc34def7fcd2b252dccdad3179b287be

SHA512
caa17a6412ca963cded17ac327effda0c368b96d683bf2dbd574767557622228311c6896c318f9744db62267e43f8caa1bc2db00dfbe302af8c4b6b82224e596

Download Submit
C:\Windows\system\ZyZCOfp.exe

Filesize
1.3MB

MD5
f68bcf452066d81e591d9c3929d3eaf8

SHA1
a83e2db69c2811a45f0f440a6d291eed0fed0819

SHA256
08e9322cb7886562954aec9b66001eedefe00858d072429ef13106d195062512

SHA512
f988b760a59b09712876d8524e71e0a77b0c2dc08ff0e75c8cca03baffa82a9620d7a3cdf0499e9a094dcbbe4af8a9b779945213be6bf8a2f842366425ef7763

Download Submit
C:\Windows\system\dqvnPMA.exe

Filesize
1.3MB

MD5
fa5d69cc8027e3ac367b4118113a672f

SHA1
b39fcbd10b677fe3c2c2fe5635835d4638d132a1

SHA256
341ad39ee3fd3dd2237896206e8b1817a7bca32ed8b56f4b745a7dc47f7ea887

SHA512
2fce119548bfce48928f5ca714a7fdf2f6c0457752e2fa9a258ae471dfe95bdb8243811dc2bb5f60310627d92f7a5d4af16724843a9d59aa4c31461f9970f284

Download Submit
C:\Windows\system\gFhIIHm.exe

Filesize
1.3MB

MD5
c7f150b522101c5050d08ba7bf1ed8b5

SHA1
224a87401a2deca3e62edee15cb918ffa20f5dd0

SHA256
662fee23d62c1d567d574ff1693b5392ff9f60cf2505fdfdf4d4d3699eb2c7be

SHA512
20b796781e8be35e4fc4535bb0e0270a49935ed98a6b94d6858b5fdf2d786c4169a0852a6240063e29baefb79e23b0062a5f7da99b9dc7f97fae56684f89b380

Download Submit
C:\Windows\system\hDljDPL.exe

Filesize
1.3MB

MD5
2a7e14cf602d4d062f38d5a4be71b5b2

SHA1
a764497f1a896d4436162f6906817c3abe866cdc

SHA256
a69bdcaf01dad02c234871a35a7635274f78a5c705e4cd8b205145803b0dc42f

SHA512
8b74b080cdca61afa67f695a13eb27d5f4a4e3a4822b53cc089f47f39c5c3935dd3829a7a849099c5d6048e936652675a6566b7dc51e0c0e6b91bbf5c9ded69c

Download Submit
C:\Windows\system\jCAiPZo.exe

Filesize
1.3MB

MD5
4f10014e8a5cd5f66edd411a24066cb4

SHA1
f5f70b3823b9a5ebd31fbb04173173decd5b06d2

SHA256
f30e1aab062798aa83e719501e7d792af02d1a48ecd4fff20ba2c2b78d108a4a

SHA512
9d45018e499764e563448204dec5b2a5a93d3f2ff368066292788509cb8ed7feb0d40311b4081c79eb4beceef578570edb4d0636d303d44c8659d11c4db9f34e

Download Submit
C:\Windows\system\kAnzIAP.exe

Filesize
1.3MB

MD5
4badca36348d62773f11971a1c1425ad

SHA1
eef34d1f3a826cf8e07562ee95cee7e6fdab598f

SHA256
177a0c605d962a4f8ea0184cd6a56f47b4a8d8deb527e1a4955762f2b20b3975

SHA512
7d991fe4a7c4f7986aa24e8c1d7bc23154dab8ae6e6d6464bd375099bb5bae8631927af1bc9f01493930871bba4c68b75d1e1cd2b86d11eaa0857db955a11901

Download Submit
C:\Windows\system\llbtNHI.exe

Filesize
1.3MB

MD5
31115ebeb680f4babd3e6215d526eb3d

SHA1
23cc5101fe32bc8fa6db32d173137e112766db3d

SHA256
91e6fb2e26bba0d102cab1378ca9ebba99f275fa749ef3d72c9979dae567987a

SHA512
7ae6fb8f51fdc96a4065b33b5e9e78d9cdd1185e390f6143f8ee133413fdc2f8c80f4088ac9f4e8e293ea9fcaa33f2c9c6916deccc33ddc4d5964ea7ef8bf197

Download Submit
C:\Windows\system\lvQiqkX.exe

Filesize
1.3MB

MD5
10aeee0cfe6311966c50ee8d4e48d5a0

SHA1
d28bbf46e96c66b2e4c58a39baa8ce282bbc1815

SHA256
f536ca77cc6336f14ea99384290d9cbb75f9a4ae3426521d2b1a6c8af15223b2

SHA512
54ab0e51da09dc05eb20c809a8409cfa5b3e236ddf796ef43b4abe4545d4a8fa9b11a4ee5bf4ad95faac3326e25276bd830f84fdad152d36a71d06144328a07a

Download Submit
C:\Windows\system\maszCXr.exe

Filesize
1.3MB

MD5
579ebf69c9c8ee842b2a529286804921

SHA1
2d38afd633d341ce1690e35cc64af562b9ec4e27

SHA256
e49a8d624feaa1104373eb60b110c6b04b91617f3ed3c2ecf2186d58c5704af3

SHA512
074c5f583704515d7bdea60e806042a91799484a3f865c8f41612824fbd61bfc87f7f6483177c8950f36fa19b1fcef0eea9e958d5dc026c0354dcaf22945a812

Download Submit
C:\Windows\system\mpgfAKX.exe

Filesize
1.3MB

MD5
5f1b6e367dd77f41b7d13b8c123381fd

SHA1
44ad59d2cc13a28c239d09245b52f2fa2958e901

SHA256
519ca7269773238099d8b0e683f978bf4605bb01cb5d864a76d9121a47696fae

SHA512
7d4443143b55110dad7ee7587a9f6eb84d704d7546f76809a063ef82f6f8b1e67ea59871e74600bd11ac53d798b2cbc505ee4a835f44c4c67c677ca5ba7d3136

Download Submit
C:\Windows\system\sWcHHsr.exe

Filesize
1.3MB

MD5
b06f1d310d8954fc74881aa1b7e55b71

SHA1
4b9d6e9d2e467592169cef06379578e773b210d3

SHA256
fb94bc4a8adf59b77fe391577fd587662c6d051776cb7c481fd83a06edd36445

SHA512
f987de1c4966643d5d3d564319fe85a945dae37213f81097a22c0990686f1934d34a0bcc8fb61a1fe8614d01276d9faa79a84c4db26be2d370d5af0d356a3ffe

Download Submit
C:\Windows\system\tZnHbPZ.exe

Filesize
1.3MB

MD5
8e88452a8c3c17cec5062edfe2f9edc9

SHA1
b554ee269cf576c5966fd50f3aef0698a0e81050

SHA256
f1b6d9a3abea91218ca4e54c2a592cac99f87987fe964d3cceb8b6ccf3b16283

SHA512
7a81bb7886bade0883c933fd97e970abb17d4550cf66fe9113f17edc0220275ad731a10c1d30b908941a46b3d3a42ecb502286e0af83458a993021f0f636a665

Download Submit
C:\Windows\system\tdRkUIG.exe

Filesize
1.3MB

MD5
fec37181bcdb488f4e2e09ec5032d5b3

SHA1
d5f479dc8358d4e310902a021e9dc7130b9988a1

SHA256
935570b38ceb729a427eeb71eaf4f54f0091bc73fef8a1822788bfdcd72de7ff

SHA512
6b8b6688a9dc0aead6360fa44be3535f4c00a35159fc7c8749280532cb9d5f8f26cd893265236ff3deea5084ddf44016835eb6d8c31759e147dbe99744f2f1ba

Download Submit
C:\Windows\system\uEbLaKI.exe

Filesize
1.3MB

MD5
e604424714afcd92e72633e1c5d85be9

SHA1
a1e71c8221dc66fc76d6b2c044c1c19cba1e6141

SHA256
afbdd1b4af1d8215a09b44a73023d81c7015a7d67c21c781849386900c052a47

SHA512
a3073c83a713766c55e04a1dde1e958ce2c777c65b5756ca8725f43d6aa06bcece875cdd74304204340618acc18b7b9e67a17ca884bc74700cfb229d74f9cd6b

Download Submit
C:\Windows\system\ueilVuK.exe

Filesize
1.3MB

MD5
1cfffb7feac05be1f3df61829fdedf77

SHA1
d5ef09d998052f000e93e9217de34778e06e0134

SHA256
f16cc8fe5247e35aa281914bf138fc751d9ad9fd5b27e40b154ee1a42893f635

SHA512
79a7fb89510c7a7894f7052828036d7b85ffd47fa3244a24663551a156e0a80f26f950afe5f72bc8562710f55f5ac4bdade0d057b7962e29f4399c40c6b8dad6

Download Submit
C:\Windows\system\vebFAHU.exe

Filesize
1.3MB

MD5
8e2e544ccb2356aa9d449d364e25efbc

SHA1
65f97f626f49d4edf897bc19d054d5bb7ac0d34b

SHA256
dcb65e7f02055948de319dca2f9c0d6d1adb11bec499062ed33a290d3fc36e30

SHA512
87db80c8c5737285f7cffc6b09253124c094e6676cce6e86bca77e0f1e0485f49a15c9c4bd0aec302a8ac32193150c455a3f4a88200944ee17dd2fd8106675ae

Download Submit
C:\Windows\system\vrzzzdA.exe

Filesize
1.3MB

MD5
8065d1ec45cf38a25baaaa97712b205b

SHA1
afa0ed4762b44203be47b5b38a8e56303e8e1909

SHA256
908e331ac31e359eac35944664219a1cc0c859713c4b9afd90e880903641a059

SHA512
6ebad405615be828dd75c610c9fcef86178dddf3b9ce922643c6155b550bd71bbba6968732ddda7f810cf916f15eaf241c75e327d7a4579f9203345b5b65a98f

Download Submit
C:\Windows\system\xuFZCSh.exe

Filesize
1.3MB

MD5
d3e9b5201f8d0bd4c724d142f14c3a55

SHA1
6dca3db44fd6e9fae11f193f3a14ba30975467ee

SHA256
de53bff7042fa65e06afbbd6b1a6d96267223e512df969aa093fc5aac05cf658

SHA512
dda89a59fba5a6bd9cea8d51a7e07949cd20f5b315316b3841cb6a36b05d1d87e46c7413633804f2a284b2fe59f00a322f4bff5a63d74682689ef609931d2b66

Download Submit
C:\Windows\system\ymwdwWC.exe

Filesize
1.3MB

MD5
1ff88ab1d23e54ce445902da037b3619

SHA1
590343095f8e96c5dcd236448eddd46fc6f347a4

SHA256
d192349428e2035f6eaad0c86888cad85f2bcc7618ae2df5f8c016b8d0d57992

SHA512
33b0c524c8b7ea4fda13ac5b97c68e5e9c25b0a723880ea579ded11dad7e9a64d0405e04486111a38668ca6cd2ae3df8c56e5aba2cf3f53ebc3e083d26be88df

Download Submit
\Windows\system\MmlWVyh.exe

Filesize
1.3MB

MD5
63fe4619b4e65ff533a2d19443884229

SHA1
f2ddff7367d3677dbf7c8a04162c79146d0a6947

SHA256
6ca254e4ad85c657ef79e383289d8c40759d35d1aa18e7e1a57b50af2f987ecc

SHA512
20091589a9108f8ff29ce00d55f7f6b5e74317572e7249019ba9b48115411ddead94f47c2425a5ba3d3183f98a935aa177f06eddb23cc9888881cc1c0c0e1d96

Download Submit
memory/2396-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download