xmrig | 0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f

Analysis

max time kernel
74s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
Size

1.4MB
MD5

218b092e3922523da0b03fb881c5957f
SHA1

b3546ab8d51f9a08b8a6258a9c6cfbd730aa998c
SHA256

0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f
SHA512

227a79aa9c01de52c08971e847381e3f5662ec967e2a540d25d688682169c84317e5de4472a2a2e6821b906b5334829072fc08c56ade1187bc5e3e230ae2d43a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwyM9+:GezaTF8FcNkNdfE0pZ9ozttwIRx2VQ9+

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120fd-2.dat	xmrig
behavioral1/files/0x000700000001939b-6.dat	xmrig
behavioral1/files/0x00070000000193b3-10.dat	xmrig
behavioral1/files/0x00060000000193e8-17.dat	xmrig
behavioral1/files/0x00060000000193f7-21.dat	xmrig
behavioral1/files/0x000600000001949e-28.dat	xmrig
behavioral1/files/0x00080000000194cd-31.dat	xmrig
behavioral1/files/0x00060000000194d2-37.dat	xmrig
behavioral1/files/0x000600000001954e-43.dat	xmrig
behavioral1/files/0x000500000001a09e-49.dat	xmrig
behavioral1/files/0x000500000001a307-55.dat	xmrig
behavioral1/files/0x003200000001930d-53.dat	xmrig
behavioral1/files/0x000500000001a359-62.dat	xmrig
behavioral1/files/0x000500000001a41b-68.dat	xmrig
behavioral1/files/0x000500000001a41e-75.dat	xmrig
behavioral1/files/0x000500000001a41d-79.dat	xmrig
behavioral1/files/0x000500000001a427-81.dat	xmrig
behavioral1/files/0x000500000001a42d-85.dat	xmrig
behavioral1/files/0x000500000001a48b-97.dat	xmrig
behavioral1/files/0x000500000001a499-108.dat	xmrig
behavioral1/files/0x000500000001a4b3-133.dat	xmrig
behavioral1/files/0x000500000001a4bb-153.dat	xmrig
behavioral1/files/0x000500000001a4bd-159.dat	xmrig
behavioral1/files/0x000500000001a4b7-143.dat	xmrig
behavioral1/files/0x000500000001a4b9-148.dat	xmrig
behavioral1/files/0x000500000001a4b5-139.dat	xmrig
behavioral1/files/0x000500000001a4b1-129.dat	xmrig
behavioral1/files/0x000500000001a4af-123.dat	xmrig
behavioral1/files/0x000500000001a4a9-118.dat	xmrig
behavioral1/files/0x000500000001a49a-113.dat	xmrig
behavioral1/files/0x000500000001a48d-102.dat	xmrig
behavioral1/files/0x000500000001a46f-92.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2796	NhsbamT.exe
2744	ovWKlBt.exe
2188	KdvjKry.exe
2824	CLihttL.exe
2756	fvyThRu.exe
2728	HDztGtg.exe
2884	BRGwOVU.exe
2800	sTjddiu.exe
1628	zgMZUHL.exe
1616	BdBxesG.exe
2600	sLZJEEF.exe
2680	JeeAyws.exe
2088	RfPLFmu.exe
2272	fzqsCPd.exe
2520	PfZpPUJ.exe
2452	hQzUczs.exe
1692	hutbgXB.exe
2416	AgTLLje.exe
1148	qzrIyJv.exe
2908	bVpKrWB.exe
2700	kDqMESj.exe
1020	nWaCAmf.exe
956	naRLcMx.exe
1364	AyFlPvq.exe
1524	dSudmrp.exe
1332	kYOotTS.exe
1160	qWZzCcq.exe
876	qmuohXq.exe
2096	eWDkHba.exe
2392	rCKaPpb.exe
2208	iyDGkzC.exe
2240	wLSHzvl.exe
904	qDxVVZG.exe
1764	GRqVDBg.exe
1940	BkZsIdw.exe
1672	jJXCzTJ.exe
2500	tOKQKVl.exe
1808	FpKugnY.exe
1200	augLmGJ.exe
2020	dMnVVSx.exe
488	LtBzXvC.exe
2560	PQuOepd.exe
2952	ROsFCTA.exe
1344	sHXKiLg.exe
1400	QfqDJcw.exe
2472	gxwufnK.exe
1224	OCCcNCX.exe
1512	bGkpZaG.exe
1988	bMFKluK.exe
1540	cFQGPLp.exe
1736	ombhkDf.exe
2076	uvWZDUW.exe
2324	vDbWfAy.exe
2320	lkrhkDd.exe
1700	oNqBVqE.exe
276	iazQhXG.exe
896	kHnshDx.exe
2356	KLbRjdH.exe
2352	HOYrWfo.exe
1600	kfAUpmm.exe
2892	HqEYdpC.exe
2696	QeSUGXC.exe
2712	wcFeqOL.exe
2816	hvXQvue.exe

Loads dropped DLL 64 IoCs

pid	Process
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uvWZDUW.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\DNPygCx.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\ROFgXmy.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\KOLLYcs.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\GnsMvHC.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\pcIWEDv.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\CjaURbU.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\RGakvxZ.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\HlDzgxQ.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\xYEqspx.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\zAJBZHo.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\nsYwSqn.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\kMKOFQg.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\yfQSBJH.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\bHLYAND.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\sLZJEEF.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\sUnEszu.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\FTiuCfX.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\rGeURbf.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\tobKTNn.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\mOjhWnB.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\rexCzDu.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\tPpcJZE.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\gtQipCl.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\zQWgkBa.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\DasMtBU.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\PUdrryF.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\jAuDYvD.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\fzqsCPd.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\EUGSKAd.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\ugCCQGA.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\MbCySHh.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\KPAKhWp.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\iocbOMq.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\NSTVlNc.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\heDOXdo.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\peSXdZm.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\hkLvxnr.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\VmkSCxo.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\QjhnvUI.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\gZPqReh.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\mTdHvBO.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\tiiJWqE.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\IITAImm.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\JCRTfkO.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\fHYuVOv.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\tGsRfJl.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\LQaTesB.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\GirpHVJ.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\ircJXQx.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\czAYrbg.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\WocrQCi.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\NbIwlxe.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\gDpoDgw.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\cgBEAsw.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\yoESujV.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\qnkrqPD.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\YnFkEyG.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\XmPMHAb.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\DegBnsi.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\TsUOLMY.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\VGUHtdl.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\lEzXBsB.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
File created	C:\Windows\System\oDoPpXH.exe	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2796	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	30
PID 2544 wrote to memory of 2796	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	30
PID 2544 wrote to memory of 2796	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	30
PID 2544 wrote to memory of 2744	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	31
PID 2544 wrote to memory of 2744	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	31
PID 2544 wrote to memory of 2744	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	31
PID 2544 wrote to memory of 2188	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	32
PID 2544 wrote to memory of 2188	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	32
PID 2544 wrote to memory of 2188	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	32
PID 2544 wrote to memory of 2824	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	33
PID 2544 wrote to memory of 2824	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	33
PID 2544 wrote to memory of 2824	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	33
PID 2544 wrote to memory of 2756	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	34
PID 2544 wrote to memory of 2756	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	34
PID 2544 wrote to memory of 2756	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	34
PID 2544 wrote to memory of 2728	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	35
PID 2544 wrote to memory of 2728	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	35
PID 2544 wrote to memory of 2728	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	35
PID 2544 wrote to memory of 2884	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	36
PID 2544 wrote to memory of 2884	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	36
PID 2544 wrote to memory of 2884	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	36
PID 2544 wrote to memory of 2800	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	37
PID 2544 wrote to memory of 2800	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	37
PID 2544 wrote to memory of 2800	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	37
PID 2544 wrote to memory of 1628	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	38
PID 2544 wrote to memory of 1628	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	38
PID 2544 wrote to memory of 1628	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	38
PID 2544 wrote to memory of 1616	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	39
PID 2544 wrote to memory of 1616	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	39
PID 2544 wrote to memory of 1616	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	39
PID 2544 wrote to memory of 2600	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	40
PID 2544 wrote to memory of 2600	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	40
PID 2544 wrote to memory of 2600	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	40
PID 2544 wrote to memory of 2680	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	41
PID 2544 wrote to memory of 2680	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	41
PID 2544 wrote to memory of 2680	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	41
PID 2544 wrote to memory of 2088	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	42
PID 2544 wrote to memory of 2088	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	42
PID 2544 wrote to memory of 2088	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	42
PID 2544 wrote to memory of 2272	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	43
PID 2544 wrote to memory of 2272	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	43
PID 2544 wrote to memory of 2272	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	43
PID 2544 wrote to memory of 2452	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	44
PID 2544 wrote to memory of 2452	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	44
PID 2544 wrote to memory of 2452	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	44
PID 2544 wrote to memory of 2520	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	45
PID 2544 wrote to memory of 2520	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	45
PID 2544 wrote to memory of 2520	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	45
PID 2544 wrote to memory of 1692	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	46
PID 2544 wrote to memory of 1692	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	46
PID 2544 wrote to memory of 1692	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	46
PID 2544 wrote to memory of 2416	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	47
PID 2544 wrote to memory of 2416	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	47
PID 2544 wrote to memory of 2416	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	47
PID 2544 wrote to memory of 1148	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	48
PID 2544 wrote to memory of 1148	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	48
PID 2544 wrote to memory of 1148	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	48
PID 2544 wrote to memory of 2908	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	49
PID 2544 wrote to memory of 2908	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	49
PID 2544 wrote to memory of 2908	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	49
PID 2544 wrote to memory of 2700	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	50
PID 2544 wrote to memory of 2700	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	50
PID 2544 wrote to memory of 2700	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	50
PID 2544 wrote to memory of 1020	2544	0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe	51

C:\Users\Admin\AppData\Local\Temp\0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe
"C:\Users\Admin\AppData\Local\Temp\0440ce1dfba78602deac53c5d3749c3df241e515fc1ef17b4912c095ae6b002f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\System\NhsbamT.exe
  C:\Windows\System\NhsbamT.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ovWKlBt.exe
  C:\Windows\System\ovWKlBt.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\KdvjKry.exe
  C:\Windows\System\KdvjKry.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CLihttL.exe
  C:\Windows\System\CLihttL.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\fvyThRu.exe
  C:\Windows\System\fvyThRu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\HDztGtg.exe
  C:\Windows\System\HDztGtg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\BRGwOVU.exe
  C:\Windows\System\BRGwOVU.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\sTjddiu.exe
  C:\Windows\System\sTjddiu.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\zgMZUHL.exe
  C:\Windows\System\zgMZUHL.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\BdBxesG.exe
  C:\Windows\System\BdBxesG.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\sLZJEEF.exe
  C:\Windows\System\sLZJEEF.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\JeeAyws.exe
  C:\Windows\System\JeeAyws.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\RfPLFmu.exe
  C:\Windows\System\RfPLFmu.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\fzqsCPd.exe
  C:\Windows\System\fzqsCPd.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\hQzUczs.exe
  C:\Windows\System\hQzUczs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\PfZpPUJ.exe
  C:\Windows\System\PfZpPUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\hutbgXB.exe
  C:\Windows\System\hutbgXB.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\AgTLLje.exe
  C:\Windows\System\AgTLLje.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\qzrIyJv.exe
  C:\Windows\System\qzrIyJv.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\bVpKrWB.exe
  C:\Windows\System\bVpKrWB.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kDqMESj.exe
  C:\Windows\System\kDqMESj.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nWaCAmf.exe
  C:\Windows\System\nWaCAmf.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\naRLcMx.exe
  C:\Windows\System\naRLcMx.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\AyFlPvq.exe
  C:\Windows\System\AyFlPvq.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\dSudmrp.exe
  C:\Windows\System\dSudmrp.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\kYOotTS.exe
  C:\Windows\System\kYOotTS.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\qWZzCcq.exe
  C:\Windows\System\qWZzCcq.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\qmuohXq.exe
  C:\Windows\System\qmuohXq.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\eWDkHba.exe
  C:\Windows\System\eWDkHba.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\rCKaPpb.exe
  C:\Windows\System\rCKaPpb.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\iyDGkzC.exe
  C:\Windows\System\iyDGkzC.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\wLSHzvl.exe
  C:\Windows\System\wLSHzvl.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\qDxVVZG.exe
  C:\Windows\System\qDxVVZG.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\GRqVDBg.exe
  C:\Windows\System\GRqVDBg.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\BkZsIdw.exe
  C:\Windows\System\BkZsIdw.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\jJXCzTJ.exe
  C:\Windows\System\jJXCzTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\tOKQKVl.exe
  C:\Windows\System\tOKQKVl.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\FpKugnY.exe
  C:\Windows\System\FpKugnY.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\augLmGJ.exe
  C:\Windows\System\augLmGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\dMnVVSx.exe
  C:\Windows\System\dMnVVSx.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\LtBzXvC.exe
  C:\Windows\System\LtBzXvC.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\PQuOepd.exe
  C:\Windows\System\PQuOepd.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ROsFCTA.exe
  C:\Windows\System\ROsFCTA.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\sHXKiLg.exe
  C:\Windows\System\sHXKiLg.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\QfqDJcw.exe
  C:\Windows\System\QfqDJcw.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\gxwufnK.exe
  C:\Windows\System\gxwufnK.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\OCCcNCX.exe
  C:\Windows\System\OCCcNCX.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\bGkpZaG.exe
  C:\Windows\System\bGkpZaG.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bMFKluK.exe
  C:\Windows\System\bMFKluK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\cFQGPLp.exe
  C:\Windows\System\cFQGPLp.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ombhkDf.exe
  C:\Windows\System\ombhkDf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\uvWZDUW.exe
  C:\Windows\System\uvWZDUW.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\vDbWfAy.exe
  C:\Windows\System\vDbWfAy.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\lkrhkDd.exe
  C:\Windows\System\lkrhkDd.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\oNqBVqE.exe
  C:\Windows\System\oNqBVqE.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\iazQhXG.exe
  C:\Windows\System\iazQhXG.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\kHnshDx.exe
  C:\Windows\System\kHnshDx.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\KLbRjdH.exe
  C:\Windows\System\KLbRjdH.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\HOYrWfo.exe
  C:\Windows\System\HOYrWfo.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kfAUpmm.exe
  C:\Windows\System\kfAUpmm.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\HqEYdpC.exe
  C:\Windows\System\HqEYdpC.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\QeSUGXC.exe
  C:\Windows\System\QeSUGXC.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\wcFeqOL.exe
  C:\Windows\System\wcFeqOL.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\hvXQvue.exe
  C:\Windows\System\hvXQvue.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\sNFSRcl.exe
  C:\Windows\System\sNFSRcl.exe
  2⤵
  PID:2960
- C:\Windows\System\ALyAHxU.exe
  C:\Windows\System\ALyAHxU.exe
  2⤵
  PID:2948
- C:\Windows\System\HLHscPs.exe
  C:\Windows\System\HLHscPs.exe
  2⤵
  PID:2944
- C:\Windows\System\OrOWwws.exe
  C:\Windows\System\OrOWwws.exe
  2⤵
  PID:2108
- C:\Windows\System\KMxWnNS.exe
  C:\Windows\System\KMxWnNS.exe
  2⤵
  PID:2844
- C:\Windows\System\lXPTjEZ.exe
  C:\Windows\System\lXPTjEZ.exe
  2⤵
  PID:2716
- C:\Windows\System\DCPbUtN.exe
  C:\Windows\System\DCPbUtN.exe
  2⤵
  PID:2636
- C:\Windows\System\bvOdhVV.exe
  C:\Windows\System\bvOdhVV.exe
  2⤵
  PID:2624
- C:\Windows\System\abBrLgT.exe
  C:\Windows\System\abBrLgT.exe
  2⤵
  PID:1092
- C:\Windows\System\uMHTlcX.exe
  C:\Windows\System\uMHTlcX.exe
  2⤵
  PID:1040
- C:\Windows\System\axSQDRB.exe
  C:\Windows\System\axSQDRB.exe
  2⤵
  PID:2072
- C:\Windows\System\siVGdpf.exe
  C:\Windows\System\siVGdpf.exe
  2⤵
  PID:2456
- C:\Windows\System\DzOrPad.exe
  C:\Windows\System\DzOrPad.exe
  2⤵
  PID:2448
- C:\Windows\System\nAMgepU.exe
  C:\Windows\System\nAMgepU.exe
  2⤵
  PID:2588
- C:\Windows\System\cedoYYo.exe
  C:\Windows\System\cedoYYo.exe
  2⤵
  PID:2924
- C:\Windows\System\AiMieyv.exe
  C:\Windows\System\AiMieyv.exe
  2⤵
  PID:1484
- C:\Windows\System\QqVtIux.exe
  C:\Windows\System\QqVtIux.exe
  2⤵
  PID:2904
- C:\Windows\System\xYEqspx.exe
  C:\Windows\System\xYEqspx.exe
  2⤵
  PID:2964
- C:\Windows\System\HwqLWMT.exe
  C:\Windows\System\HwqLWMT.exe
  2⤵
  PID:2036
- C:\Windows\System\MXOJBMG.exe
  C:\Windows\System\MXOJBMG.exe
  2⤵
  PID:272
- C:\Windows\System\XLpjhjC.exe
  C:\Windows\System\XLpjhjC.exe
  2⤵
  PID:344
- C:\Windows\System\TPgAuGG.exe
  C:\Windows\System\TPgAuGG.exe
  2⤵
  PID:2332
- C:\Windows\System\AZuXEeQ.exe
  C:\Windows\System\AZuXEeQ.exe
  2⤵
  PID:2436
- C:\Windows\System\RDxNqvd.exe
  C:\Windows\System\RDxNqvd.exe
  2⤵
  PID:948
- C:\Windows\System\zqasXyI.exe
  C:\Windows\System\zqasXyI.exe
  2⤵
  PID:908
- C:\Windows\System\rZTkZVX.exe
  C:\Windows\System\rZTkZVX.exe
  2⤵
  PID:1964
- C:\Windows\System\luwwRfS.exe
  C:\Windows\System\luwwRfS.exe
  2⤵
  PID:1980
- C:\Windows\System\ZYNXSZH.exe
  C:\Windows\System\ZYNXSZH.exe
  2⤵
  PID:2264
- C:\Windows\System\JnPxMNy.exe
  C:\Windows\System\JnPxMNy.exe
  2⤵
  PID:2404
- C:\Windows\System\GxHjpAQ.exe
  C:\Windows\System\GxHjpAQ.exe
  2⤵
  PID:1436
- C:\Windows\System\XZApFdI.exe
  C:\Windows\System\XZApFdI.exe
  2⤵
  PID:1724
- C:\Windows\System\ZGGOgNu.exe
  C:\Windows\System\ZGGOgNu.exe
  2⤵
  PID:3036
- C:\Windows\System\VaKSEzh.exe
  C:\Windows\System\VaKSEzh.exe
  2⤵
  PID:1784
- C:\Windows\System\fBnKyWc.exe
  C:\Windows\System\fBnKyWc.exe
  2⤵
  PID:2508
- C:\Windows\System\SORfztj.exe
  C:\Windows\System\SORfztj.exe
  2⤵
  PID:3000
- C:\Windows\System\noOZuSP.exe
  C:\Windows\System\noOZuSP.exe
  2⤵
  PID:3012
- C:\Windows\System\rtTLHJU.exe
  C:\Windows\System\rtTLHJU.exe
  2⤵
  PID:396
- C:\Windows\System\CgCCxSS.exe
  C:\Windows\System\CgCCxSS.exe
  2⤵
  PID:1756
- C:\Windows\System\dcKRSME.exe
  C:\Windows\System\dcKRSME.exe
  2⤵
  PID:2116
- C:\Windows\System\ooDfCel.exe
  C:\Windows\System\ooDfCel.exe
  2⤵
  PID:2936
- C:\Windows\System\zdvYUSd.exe
  C:\Windows\System\zdvYUSd.exe
  2⤵
  PID:1596
- C:\Windows\System\yBqlsEt.exe
  C:\Windows\System\yBqlsEt.exe
  2⤵
  PID:3020
- C:\Windows\System\RvcINuH.exe
  C:\Windows\System\RvcINuH.exe
  2⤵
  PID:2100
- C:\Windows\System\YsTDbhd.exe
  C:\Windows\System\YsTDbhd.exe
  2⤵
  PID:2812
- C:\Windows\System\qnWbsZK.exe
  C:\Windows\System\qnWbsZK.exe
  2⤵
  PID:2720
- C:\Windows\System\owHJdPz.exe
  C:\Windows\System\owHJdPz.exe
  2⤵
  PID:1928
- C:\Windows\System\MbIdeDs.exe
  C:\Windows\System\MbIdeDs.exe
  2⤵
  PID:2860
- C:\Windows\System\SzlejvA.exe
  C:\Windows\System\SzlejvA.exe
  2⤵
  PID:2788
- C:\Windows\System\ULcihRy.exe
  C:\Windows\System\ULcihRy.exe
  2⤵
  PID:2604
- C:\Windows\System\NyWWqNe.exe
  C:\Windows\System\NyWWqNe.exe
  2⤵
  PID:2660
- C:\Windows\System\IfXeATU.exe
  C:\Windows\System\IfXeATU.exe
  2⤵
  PID:2772
- C:\Windows\System\CoCmmyo.exe
  C:\Windows\System\CoCmmyo.exe
  2⤵
  PID:1728
- C:\Windows\System\MNYAHLt.exe
  C:\Windows\System\MNYAHLt.exe
  2⤵
  PID:1992
- C:\Windows\System\RbZECDJ.exe
  C:\Windows\System\RbZECDJ.exe
  2⤵
  PID:2044
- C:\Windows\System\bZFBAqd.exe
  C:\Windows\System\bZFBAqd.exe
  2⤵
  PID:2692
- C:\Windows\System\nTEWZoH.exe
  C:\Windows\System\nTEWZoH.exe
  2⤵
  PID:2216
- C:\Windows\System\jctJswK.exe
  C:\Windows\System\jctJswK.exe
  2⤵
  PID:2556
- C:\Windows\System\fauFdKo.exe
  C:\Windows\System\fauFdKo.exe
  2⤵
  PID:988
- C:\Windows\System\QcWkVQT.exe
  C:\Windows\System\QcWkVQT.exe
  2⤵
  PID:316
- C:\Windows\System\gVUNUmO.exe
  C:\Windows\System\gVUNUmO.exe
  2⤵
  PID:2040
- C:\Windows\System\anZMAjb.exe
  C:\Windows\System\anZMAjb.exe
  2⤵
  PID:2172
- C:\Windows\System\hOBjqUp.exe
  C:\Windows\System\hOBjqUp.exe
  2⤵
  PID:880
- C:\Windows\System\AVRnoUC.exe
  C:\Windows\System\AVRnoUC.exe
  2⤵
  PID:1012
- C:\Windows\System\MgUvTnj.exe
  C:\Windows\System\MgUvTnj.exe
  2⤵
  PID:308
- C:\Windows\System\CCJcPmU.exe
  C:\Windows\System\CCJcPmU.exe
  2⤵
  PID:1340
- C:\Windows\System\NSnavDP.exe
  C:\Windows\System\NSnavDP.exe
  2⤵
  PID:1868
- C:\Windows\System\xYPpJQJ.exe
  C:\Windows\System\xYPpJQJ.exe
  2⤵
  PID:1536
- C:\Windows\System\RcpqMPr.exe
  C:\Windows\System\RcpqMPr.exe
  2⤵
  PID:2492
- C:\Windows\System\OQwrULF.exe
  C:\Windows\System\OQwrULF.exe
  2⤵
  PID:796
- C:\Windows\System\xoqEszs.exe
  C:\Windows\System\xoqEszs.exe
  2⤵
  PID:3052
- C:\Windows\System\nhfxTtG.exe
  C:\Windows\System\nhfxTtG.exe
  2⤵
  PID:3040
- C:\Windows\System\zPaeXJj.exe
  C:\Windows\System\zPaeXJj.exe
  2⤵
  PID:1704
- C:\Windows\System\rXsoKNM.exe
  C:\Windows\System\rXsoKNM.exe
  2⤵
  PID:2920
- C:\Windows\System\nnHjyxL.exe
  C:\Windows\System\nnHjyxL.exe
  2⤵
  PID:2880
- C:\Windows\System\TfZDQXf.exe
  C:\Windows\System\TfZDQXf.exe
  2⤵
  PID:2528
- C:\Windows\System\dQzeYQP.exe
  C:\Windows\System\dQzeYQP.exe
  2⤵
  PID:2312
- C:\Windows\System\lHrJTMw.exe
  C:\Windows\System\lHrJTMw.exe
  2⤵
  PID:2704
- C:\Windows\System\FApKmig.exe
  C:\Windows\System\FApKmig.exe
  2⤵
  PID:2724
- C:\Windows\System\peSXdZm.exe
  C:\Windows\System\peSXdZm.exe
  2⤵
  PID:1776
- C:\Windows\System\xEMmftg.exe
  C:\Windows\System\xEMmftg.exe
  2⤵
  PID:2256
- C:\Windows\System\AcgzMVF.exe
  C:\Windows\System\AcgzMVF.exe
  2⤵
  PID:2536
- C:\Windows\System\vROwjMj.exe
  C:\Windows\System\vROwjMj.exe
  2⤵
  PID:1804
- C:\Windows\System\cMSyYdy.exe
  C:\Windows\System\cMSyYdy.exe
  2⤵
  PID:2176
- C:\Windows\System\nvKjweA.exe
  C:\Windows\System\nvKjweA.exe
  2⤵
  PID:2184
- C:\Windows\System\CgpyYpb.exe
  C:\Windows\System\CgpyYpb.exe
  2⤵
  PID:2424
- C:\Windows\System\KNuhkOS.exe
  C:\Windows\System\KNuhkOS.exe
  2⤵
  PID:500
- C:\Windows\System\jZWecbo.exe
  C:\Windows\System\jZWecbo.exe
  2⤵
  PID:1788
- C:\Windows\System\hfbSflb.exe
  C:\Windows\System\hfbSflb.exe
  2⤵
  PID:2828
- C:\Windows\System\vEVlYtg.exe
  C:\Windows\System\vEVlYtg.exe
  2⤵
  PID:2220
- C:\Windows\System\iqpoHps.exe
  C:\Windows\System\iqpoHps.exe
  2⤵
  PID:2344
- C:\Windows\System\laVQHHd.exe
  C:\Windows\System\laVQHHd.exe
  2⤵
  PID:2104
- C:\Windows\System\KfWHfHC.exe
  C:\Windows\System\KfWHfHC.exe
  2⤵
  PID:2388
- C:\Windows\System\tQNPgsV.exe
  C:\Windows\System\tQNPgsV.exe
  2⤵
  PID:2552
- C:\Windows\System\QqoyTbe.exe
  C:\Windows\System\QqoyTbe.exe
  2⤵
  PID:2940
- C:\Windows\System\TRQoXTE.exe
  C:\Windows\System\TRQoXTE.exe
  2⤵
  PID:2284
- C:\Windows\System\SESHvdW.exe
  C:\Windows\System\SESHvdW.exe
  2⤵
  PID:2496
- C:\Windows\System\VquNLZQ.exe
  C:\Windows\System\VquNLZQ.exe
  2⤵
  PID:2280
- C:\Windows\System\TsUOLMY.exe
  C:\Windows\System\TsUOLMY.exe
  2⤵
  PID:2776
- C:\Windows\System\QTejlHm.exe
  C:\Windows\System\QTejlHm.exe
  2⤵
  PID:2228
- C:\Windows\System\QYliNxe.exe
  C:\Windows\System\QYliNxe.exe
  2⤵
  PID:1184
- C:\Windows\System\sLFcyFP.exe
  C:\Windows\System\sLFcyFP.exe
  2⤵
  PID:2428
- C:\Windows\System\JkocOsm.exe
  C:\Windows\System\JkocOsm.exe
  2⤵
  PID:2196
- C:\Windows\System\aAEnmBY.exe
  C:\Windows\System\aAEnmBY.exe
  2⤵
  PID:932
- C:\Windows\System\nwMeAnl.exe
  C:\Windows\System\nwMeAnl.exe
  2⤵
  PID:2652
- C:\Windows\System\VGUHtdl.exe
  C:\Windows\System\VGUHtdl.exe
  2⤵
  PID:2836
- C:\Windows\System\RdIxMcI.exe
  C:\Windows\System\RdIxMcI.exe
  2⤵
  PID:1780
- C:\Windows\System\kSxEZXZ.exe
  C:\Windows\System\kSxEZXZ.exe
  2⤵
  PID:936
- C:\Windows\System\uDriozc.exe
  C:\Windows\System\uDriozc.exe
  2⤵
  PID:2440
- C:\Windows\System\cTfSVIu.exe
  C:\Windows\System\cTfSVIu.exe
  2⤵
  PID:3080
- C:\Windows\System\UECPDSq.exe
  C:\Windows\System\UECPDSq.exe
  2⤵
  PID:3096
- C:\Windows\System\wqhJyEj.exe
  C:\Windows\System\wqhJyEj.exe
  2⤵
  PID:3112
- C:\Windows\System\VHcnixJ.exe
  C:\Windows\System\VHcnixJ.exe
  2⤵
  PID:3128
- C:\Windows\System\THPZNfe.exe
  C:\Windows\System\THPZNfe.exe
  2⤵
  PID:3144
- C:\Windows\System\fOVHiFF.exe
  C:\Windows\System\fOVHiFF.exe
  2⤵
  PID:3160
- C:\Windows\System\ZTvQQcF.exe
  C:\Windows\System\ZTvQQcF.exe
  2⤵
  PID:3176
- C:\Windows\System\ILKJUMK.exe
  C:\Windows\System\ILKJUMK.exe
  2⤵
  PID:3192
- C:\Windows\System\yLDMwQi.exe
  C:\Windows\System\yLDMwQi.exe
  2⤵
  PID:3212
- C:\Windows\System\CMeaQzp.exe
  C:\Windows\System\CMeaQzp.exe
  2⤵
  PID:3228
- C:\Windows\System\bWKzONs.exe
  C:\Windows\System\bWKzONs.exe
  2⤵
  PID:3276
- C:\Windows\System\HUWdYfe.exe
  C:\Windows\System\HUWdYfe.exe
  2⤵
  PID:3408
- C:\Windows\System\sDVWLRI.exe
  C:\Windows\System\sDVWLRI.exe
  2⤵
  PID:3428
- C:\Windows\System\EUGSKAd.exe
  C:\Windows\System\EUGSKAd.exe
  2⤵
  PID:3444
- C:\Windows\System\OZRpSLK.exe
  C:\Windows\System\OZRpSLK.exe
  2⤵
  PID:3460
- C:\Windows\System\KtzdLtz.exe
  C:\Windows\System\KtzdLtz.exe
  2⤵
  PID:3476
- C:\Windows\System\dAXXhPj.exe
  C:\Windows\System\dAXXhPj.exe
  2⤵
  PID:3492
- C:\Windows\System\TowuiBK.exe
  C:\Windows\System\TowuiBK.exe
  2⤵
  PID:3508
- C:\Windows\System\rIljSeS.exe
  C:\Windows\System\rIljSeS.exe
  2⤵
  PID:3540
- C:\Windows\System\TsvUlqe.exe
  C:\Windows\System\TsvUlqe.exe
  2⤵
  PID:3556
- C:\Windows\System\aucBOkA.exe
  C:\Windows\System\aucBOkA.exe
  2⤵
  PID:3580
- C:\Windows\System\qBtmxew.exe
  C:\Windows\System\qBtmxew.exe
  2⤵
  PID:3596
- C:\Windows\System\rNxbTzK.exe
  C:\Windows\System\rNxbTzK.exe
  2⤵
  PID:3612
- C:\Windows\System\OsXpzuu.exe
  C:\Windows\System\OsXpzuu.exe
  2⤵
  PID:3628
- C:\Windows\System\RYlvmbj.exe
  C:\Windows\System\RYlvmbj.exe
  2⤵
  PID:3644
- C:\Windows\System\bEgLNyg.exe
  C:\Windows\System\bEgLNyg.exe
  2⤵
  PID:3664
- C:\Windows\System\JBeKlIF.exe
  C:\Windows\System\JBeKlIF.exe
  2⤵
  PID:3680
- C:\Windows\System\OyoziPE.exe
  C:\Windows\System\OyoziPE.exe
  2⤵
  PID:3696
- C:\Windows\System\udeftyX.exe
  C:\Windows\System\udeftyX.exe
  2⤵
  PID:3712
- C:\Windows\System\QpjDKcy.exe
  C:\Windows\System\QpjDKcy.exe
  2⤵
  PID:3768
- C:\Windows\System\lhokISA.exe
  C:\Windows\System\lhokISA.exe
  2⤵
  PID:3788
- C:\Windows\System\sgkRsEh.exe
  C:\Windows\System\sgkRsEh.exe
  2⤵
  PID:3808
- C:\Windows\System\DXgLuAf.exe
  C:\Windows\System\DXgLuAf.exe
  2⤵
  PID:3824
- C:\Windows\System\RddPmnt.exe
  C:\Windows\System\RddPmnt.exe
  2⤵
  PID:3848
- C:\Windows\System\IXXkmFS.exe
  C:\Windows\System\IXXkmFS.exe
  2⤵
  PID:3868
- C:\Windows\System\aWqcNqd.exe
  C:\Windows\System\aWqcNqd.exe
  2⤵
  PID:3884
- C:\Windows\System\SMSzQEm.exe
  C:\Windows\System\SMSzQEm.exe
  2⤵
  PID:3904
- C:\Windows\System\tdiItxg.exe
  C:\Windows\System\tdiItxg.exe
  2⤵
  PID:3928
- C:\Windows\System\RQqeALI.exe
  C:\Windows\System\RQqeALI.exe
  2⤵
  PID:3944
- C:\Windows\System\ZoRLOQO.exe
  C:\Windows\System\ZoRLOQO.exe
  2⤵
  PID:3960
- C:\Windows\System\OkWOhNg.exe
  C:\Windows\System\OkWOhNg.exe
  2⤵
  PID:3980
- C:\Windows\System\fQbsyRn.exe
  C:\Windows\System\fQbsyRn.exe
  2⤵
  PID:4000
- C:\Windows\System\dvxnlAN.exe
  C:\Windows\System\dvxnlAN.exe
  2⤵
  PID:4020
- C:\Windows\System\dYObvdc.exe
  C:\Windows\System\dYObvdc.exe
  2⤵
  PID:4036
- C:\Windows\System\CIDpZAY.exe
  C:\Windows\System\CIDpZAY.exe
  2⤵
  PID:4052
- C:\Windows\System\RGfFrSX.exe
  C:\Windows\System\RGfFrSX.exe
  2⤵
  PID:4072
- C:\Windows\System\YuSWoNT.exe
  C:\Windows\System\YuSWoNT.exe
  2⤵
  PID:4092
- C:\Windows\System\lEzXBsB.exe
  C:\Windows\System\lEzXBsB.exe
  2⤵
  PID:3004
- C:\Windows\System\MRkJmhT.exe
  C:\Windows\System\MRkJmhT.exe
  2⤵
  PID:3076
- C:\Windows\System\LUEbRuW.exe
  C:\Windows\System\LUEbRuW.exe
  2⤵
  PID:3140
- C:\Windows\System\MzMskRM.exe
  C:\Windows\System\MzMskRM.exe
  2⤵
  PID:3204
- C:\Windows\System\fiULBep.exe
  C:\Windows\System\fiULBep.exe
  2⤵
  PID:2956
- C:\Windows\System\wUknqqp.exe
  C:\Windows\System\wUknqqp.exe
  2⤵
  PID:648
- C:\Windows\System\srHEeUf.exe
  C:\Windows\System\srHEeUf.exe
  2⤵
  PID:3188
- C:\Windows\System\CEcvoSc.exe
  C:\Windows\System\CEcvoSc.exe
  2⤵
  PID:3236
- C:\Windows\System\sGnaBzq.exe
  C:\Windows\System\sGnaBzq.exe
  2⤵
  PID:580
- C:\Windows\System\qlIdTcg.exe
  C:\Windows\System\qlIdTcg.exe
  2⤵
  PID:3268
- C:\Windows\System\vOmhzLi.exe
  C:\Windows\System\vOmhzLi.exe
  2⤵
  PID:3292
- C:\Windows\System\BRpHHSR.exe
  C:\Windows\System\BRpHHSR.exe
  2⤵
  PID:3312
- C:\Windows\System\vrSOFOo.exe
  C:\Windows\System\vrSOFOo.exe
  2⤵
  PID:3332
- C:\Windows\System\tRQazIK.exe
  C:\Windows\System\tRQazIK.exe
  2⤵
  PID:3356
- C:\Windows\System\EuzNzGv.exe
  C:\Windows\System\EuzNzGv.exe
  2⤵
  PID:3420
- C:\Windows\System\carZQtq.exe
  C:\Windows\System\carZQtq.exe
  2⤵
  PID:3348
- C:\Windows\System\HPtoOYY.exe
  C:\Windows\System\HPtoOYY.exe
  2⤵
  PID:3376
- C:\Windows\System\OOFXRcO.exe
  C:\Windows\System\OOFXRcO.exe
  2⤵
  PID:3396
- C:\Windows\System\teHPCcq.exe
  C:\Windows\System\teHPCcq.exe
  2⤵
  PID:3516
- C:\Windows\System\iipkrIr.exe
  C:\Windows\System\iipkrIr.exe
  2⤵
  PID:3472
- C:\Windows\System\AbMVEZF.exe
  C:\Windows\System\AbMVEZF.exe
  2⤵
  PID:3604
- C:\Windows\System\ReFiROI.exe
  C:\Windows\System\ReFiROI.exe
  2⤵
  PID:3588
- C:\Windows\System\FKNRRTg.exe
  C:\Windows\System\FKNRRTg.exe
  2⤵
  PID:3652
- C:\Windows\System\GDoOZbs.exe
  C:\Windows\System\GDoOZbs.exe
  2⤵
  PID:3720
- C:\Windows\System\RXkWHxt.exe
  C:\Windows\System\RXkWHxt.exe
  2⤵
  PID:3744
- C:\Windows\System\LZKQoXq.exe
  C:\Windows\System\LZKQoXq.exe
  2⤵
  PID:3760
- C:\Windows\System\iCXHOOv.exe
  C:\Windows\System\iCXHOOv.exe
  2⤵
  PID:3784
- C:\Windows\System\KYPDRkT.exe
  C:\Windows\System\KYPDRkT.exe
  2⤵
  PID:3844
- C:\Windows\System\gkuxcjV.exe
  C:\Windows\System\gkuxcjV.exe
  2⤵
  PID:3864
- C:\Windows\System\EPtRWVE.exe
  C:\Windows\System\EPtRWVE.exe
  2⤵
  PID:3936
- C:\Windows\System\VWsTqQk.exe
  C:\Windows\System\VWsTqQk.exe
  2⤵
  PID:4008
- C:\Windows\System\AztPhAg.exe
  C:\Windows\System\AztPhAg.exe
  2⤵
  PID:3952
- C:\Windows\System\ijScXIh.exe
  C:\Windows\System\ijScXIh.exe
  2⤵
  PID:2420
- C:\Windows\System\pwPIQBT.exe
  C:\Windows\System\pwPIQBT.exe
  2⤵
  PID:3208
- C:\Windows\System\QrJLjOk.exe
  C:\Windows\System\QrJLjOk.exe
  2⤵
  PID:3264
- C:\Windows\System\ntkZHPn.exe
  C:\Windows\System\ntkZHPn.exe
  2⤵
  PID:3328
- C:\Windows\System\SkYdqet.exe
  C:\Windows\System\SkYdqet.exe
  2⤵
  PID:3384
- C:\Windows\System\MyPEmlR.exe
  C:\Windows\System\MyPEmlR.exe
  2⤵
  PID:3992
- C:\Windows\System\zAJBZHo.exe
  C:\Windows\System\zAJBZHo.exe
  2⤵
  PID:3456
- C:\Windows\System\BWruoHB.exe
  C:\Windows\System\BWruoHB.exe
  2⤵
  PID:1592
- C:\Windows\System\NUdCvQb.exe
  C:\Windows\System\NUdCvQb.exe
  2⤵
  PID:3324
- C:\Windows\System\JgGpCQs.exe
  C:\Windows\System\JgGpCQs.exe
  2⤵
  PID:3372
- C:\Windows\System\soFhigJ.exe
  C:\Windows\System\soFhigJ.exe
  2⤵
  PID:3528
- C:\Windows\System\ZzpJcjt.exe
  C:\Windows\System\ZzpJcjt.exe
  2⤵
  PID:2968
- C:\Windows\System\hFaVILx.exe
  C:\Windows\System\hFaVILx.exe
  2⤵
  PID:3152
- C:\Windows\System\TFMwdSW.exe
  C:\Windows\System\TFMwdSW.exe
  2⤵
  PID:3672
- C:\Windows\System\NblDkFw.exe
  C:\Windows\System\NblDkFw.exe
  2⤵
  PID:3660
- C:\Windows\System\CGVVKMF.exe
  C:\Windows\System\CGVVKMF.exe
  2⤵
  PID:3624
- C:\Windows\System\atgyvjf.exe
  C:\Windows\System\atgyvjf.exe
  2⤵
  PID:3552
- C:\Windows\System\lKbiKJc.exe
  C:\Windows\System\lKbiKJc.exe
  2⤵
  PID:3816
- C:\Windows\System\rUkjOfk.exe
  C:\Windows\System\rUkjOfk.exe
  2⤵
  PID:3804
- C:\Windows\System\ZaSoXFO.exe
  C:\Windows\System\ZaSoXFO.exe
  2⤵
  PID:3900
- C:\Windows\System\DAgmShc.exe
  C:\Windows\System\DAgmShc.exe
  2⤵
  PID:3860
- C:\Windows\System\DNPygCx.exe
  C:\Windows\System\DNPygCx.exe
  2⤵
  PID:3172
- C:\Windows\System\fhObRnU.exe
  C:\Windows\System\fhObRnU.exe
  2⤵
  PID:3200
- C:\Windows\System\yfkjGaZ.exe
  C:\Windows\System\yfkjGaZ.exe
  2⤵
  PID:4088
- C:\Windows\System\kzHOppq.exe
  C:\Windows\System\kzHOppq.exe
  2⤵
  PID:3388
- C:\Windows\System\SbwfgSQ.exe
  C:\Windows\System\SbwfgSQ.exe
  2⤵
  PID:3576
- C:\Windows\System\RqLCwFF.exe
  C:\Windows\System\RqLCwFF.exe
  2⤵
  PID:3752
- C:\Windows\System\xGfTRpv.exe
  C:\Windows\System\xGfTRpv.exe
  2⤵
  PID:3896
- C:\Windows\System\ugCCQGA.exe
  C:\Windows\System\ugCCQGA.exe
  2⤵
  PID:3284
- C:\Windows\System\KNgHWKi.exe
  C:\Windows\System\KNgHWKi.exe
  2⤵
  PID:3120
- C:\Windows\System\YCHDClG.exe
  C:\Windows\System\YCHDClG.exe
  2⤵
  PID:3468
- C:\Windows\System\IdJIqZU.exe
  C:\Windows\System\IdJIqZU.exe
  2⤵
  PID:3184
- C:\Windows\System\GCnlaxO.exe
  C:\Windows\System\GCnlaxO.exe
  2⤵
  PID:3260
- C:\Windows\System\HJkQSEY.exe
  C:\Windows\System\HJkQSEY.exe
  2⤵
  PID:3108
- C:\Windows\System\pQjIvoS.exe
  C:\Windows\System\pQjIvoS.exe
  2⤵
  PID:3548
- C:\Windows\System\IOWIqWW.exe
  C:\Windows\System\IOWIqWW.exe
  2⤵
  PID:4068
- C:\Windows\System\pYPJERL.exe
  C:\Windows\System\pYPJERL.exe
  2⤵
  PID:4064
- C:\Windows\System\hkLvxnr.exe
  C:\Windows\System\hkLvxnr.exe
  2⤵
  PID:4048
- C:\Windows\System\lRnWnux.exe
  C:\Windows\System\lRnWnux.exe
  2⤵
  PID:3308
- C:\Windows\System\QAXAGUx.exe
  C:\Windows\System\QAXAGUx.exe
  2⤵
  PID:3968
- C:\Windows\System\KOwMxVX.exe
  C:\Windows\System\KOwMxVX.exe
  2⤵
  PID:3352
- C:\Windows\System\zaAjHvN.exe
  C:\Windows\System\zaAjHvN.exe
  2⤵
  PID:3800
- C:\Windows\System\GWSoIJT.exe
  C:\Windows\System\GWSoIJT.exe
  2⤵
  PID:3912
- C:\Windows\System\asJxHvn.exe
  C:\Windows\System\asJxHvn.exe
  2⤵
  PID:3344
- C:\Windows\System\yONGMjy.exe
  C:\Windows\System\yONGMjy.exe
  2⤵
  PID:4116
- C:\Windows\System\DJTHcWc.exe
  C:\Windows\System\DJTHcWc.exe
  2⤵
  PID:4132
- C:\Windows\System\bhwqgtE.exe
  C:\Windows\System\bhwqgtE.exe
  2⤵
  PID:4152
- C:\Windows\System\AxuCVqe.exe
  C:\Windows\System\AxuCVqe.exe
  2⤵
  PID:4168
- C:\Windows\System\NhXhXVx.exe
  C:\Windows\System\NhXhXVx.exe
  2⤵
  PID:4188
- C:\Windows\System\pZYkSeh.exe
  C:\Windows\System\pZYkSeh.exe
  2⤵
  PID:4216
- C:\Windows\System\UWYaIbP.exe
  C:\Windows\System\UWYaIbP.exe
  2⤵
  PID:4232
- C:\Windows\System\zYkNcEz.exe
  C:\Windows\System\zYkNcEz.exe
  2⤵
  PID:4268
- C:\Windows\System\giZscaY.exe
  C:\Windows\System\giZscaY.exe
  2⤵
  PID:4296
- C:\Windows\System\YttCdbD.exe
  C:\Windows\System\YttCdbD.exe
  2⤵
  PID:4316
- C:\Windows\System\XZqLlyu.exe
  C:\Windows\System\XZqLlyu.exe
  2⤵
  PID:4336
- C:\Windows\System\nmPZMkn.exe
  C:\Windows\System\nmPZMkn.exe
  2⤵
  PID:4356
- C:\Windows\System\LdqvGGG.exe
  C:\Windows\System\LdqvGGG.exe
  2⤵
  PID:4376
- C:\Windows\System\JKvtOnd.exe
  C:\Windows\System\JKvtOnd.exe
  2⤵
  PID:4392
- C:\Windows\System\YCqyYFe.exe
  C:\Windows\System\YCqyYFe.exe
  2⤵
  PID:4408
- C:\Windows\System\WtzXHHM.exe
  C:\Windows\System\WtzXHHM.exe
  2⤵
  PID:4424
- C:\Windows\System\gfiRPZr.exe
  C:\Windows\System\gfiRPZr.exe
  2⤵
  PID:4440
- C:\Windows\System\xxcPSlo.exe
  C:\Windows\System\xxcPSlo.exe
  2⤵
  PID:4460
- C:\Windows\System\mQCJLCy.exe
  C:\Windows\System\mQCJLCy.exe
  2⤵
  PID:4488
- C:\Windows\System\xEeJGrt.exe
  C:\Windows\System\xEeJGrt.exe
  2⤵
  PID:4516
- C:\Windows\System\UWztiXB.exe
  C:\Windows\System\UWztiXB.exe
  2⤵
  PID:4532
- C:\Windows\System\IEXBFUp.exe
  C:\Windows\System\IEXBFUp.exe
  2⤵
  PID:4548
- C:\Windows\System\HwWGvOn.exe
  C:\Windows\System\HwWGvOn.exe
  2⤵
  PID:4564
- C:\Windows\System\ufSCJIR.exe
  C:\Windows\System\ufSCJIR.exe
  2⤵
  PID:4580
- C:\Windows\System\irljEwf.exe
  C:\Windows\System\irljEwf.exe
  2⤵
  PID:4596
- C:\Windows\System\oZslthA.exe
  C:\Windows\System\oZslthA.exe
  2⤵
  PID:4612
- C:\Windows\System\kjRyoGA.exe
  C:\Windows\System\kjRyoGA.exe
  2⤵
  PID:4632
- C:\Windows\System\TWrVfdM.exe
  C:\Windows\System\TWrVfdM.exe
  2⤵
  PID:4648
- C:\Windows\System\KflKnOZ.exe
  C:\Windows\System\KflKnOZ.exe
  2⤵
  PID:4664
- C:\Windows\System\trZnNrA.exe
  C:\Windows\System\trZnNrA.exe
  2⤵
  PID:4684
- C:\Windows\System\avpGnuv.exe
  C:\Windows\System\avpGnuv.exe
  2⤵
  PID:4704
- C:\Windows\System\rHKvOuW.exe
  C:\Windows\System\rHKvOuW.exe
  2⤵
  PID:4720
- C:\Windows\System\BwysgsY.exe
  C:\Windows\System\BwysgsY.exe
  2⤵
  PID:4736
- C:\Windows\System\OyZVoGj.exe
  C:\Windows\System\OyZVoGj.exe
  2⤵
  PID:4760
- C:\Windows\System\uRcgLPd.exe
  C:\Windows\System\uRcgLPd.exe
  2⤵
  PID:4780
- C:\Windows\System\MbCySHh.exe
  C:\Windows\System\MbCySHh.exe
  2⤵
  PID:4796
- C:\Windows\System\tobKTNn.exe
  C:\Windows\System\tobKTNn.exe
  2⤵
  PID:4816
- C:\Windows\System\QVmVBYU.exe
  C:\Windows\System\QVmVBYU.exe
  2⤵
  PID:4848
- C:\Windows\System\MYTdTfD.exe
  C:\Windows\System\MYTdTfD.exe
  2⤵
  PID:4868
- C:\Windows\System\AfNyLVn.exe
  C:\Windows\System\AfNyLVn.exe
  2⤵
  PID:4892
- C:\Windows\System\lVsdRpz.exe
  C:\Windows\System\lVsdRpz.exe
  2⤵
  PID:4908
- C:\Windows\System\NLHHIro.exe
  C:\Windows\System\NLHHIro.exe
  2⤵
  PID:4924
- C:\Windows\System\tgQkPzQ.exe
  C:\Windows\System\tgQkPzQ.exe
  2⤵
  PID:4940
- C:\Windows\System\LrzwjUC.exe
  C:\Windows\System\LrzwjUC.exe
  2⤵
  PID:4956
- C:\Windows\System\iQVIgan.exe
  C:\Windows\System\iQVIgan.exe
  2⤵
  PID:4976
- C:\Windows\System\JCfItOT.exe
  C:\Windows\System\JCfItOT.exe
  2⤵
  PID:5000
- C:\Windows\System\GsSybbh.exe
  C:\Windows\System\GsSybbh.exe
  2⤵
  PID:5020
- C:\Windows\System\TLJWqaW.exe
  C:\Windows\System\TLJWqaW.exe
  2⤵
  PID:5036
- C:\Windows\System\CjHIgVo.exe
  C:\Windows\System\CjHIgVo.exe
  2⤵
  PID:5052
- C:\Windows\System\xjdIskR.exe
  C:\Windows\System\xjdIskR.exe
  2⤵
  PID:5068
- C:\Windows\System\jpgeieM.exe
  C:\Windows\System\jpgeieM.exe
  2⤵
  PID:3536
- C:\Windows\System\MkFfiuR.exe
  C:\Windows\System\MkFfiuR.exe
  2⤵
  PID:4212
- C:\Windows\System\dDixchA.exe
  C:\Windows\System\dDixchA.exe
  2⤵
  PID:4060
- C:\Windows\System\nBlDgow.exe
  C:\Windows\System\nBlDgow.exe
  2⤵
  PID:2804
- C:\Windows\System\puBbCOM.exe
  C:\Windows\System\puBbCOM.exe
  2⤵
  PID:4100
- C:\Windows\System\KTDakGA.exe
  C:\Windows\System\KTDakGA.exe
  2⤵
  PID:4176
- C:\Windows\System\yFujGSt.exe
  C:\Windows\System\yFujGSt.exe
  2⤵
  PID:4248
- C:\Windows\System\IJMOZMt.exe
  C:\Windows\System\IJMOZMt.exe
  2⤵
  PID:4184
- C:\Windows\System\yEUlHiS.exe
  C:\Windows\System\yEUlHiS.exe
  2⤵
  PID:4308
- C:\Windows\System\CoLhqCZ.exe
  C:\Windows\System\CoLhqCZ.exe
  2⤵
  PID:4280
- C:\Windows\System\ajYWxzy.exe
  C:\Windows\System\ajYWxzy.exe
  2⤵
  PID:3156
- C:\Windows\System\NneFQZx.exe
  C:\Windows\System\NneFQZx.exe
  2⤵
  PID:3524
- C:\Windows\System\XLeDWau.exe
  C:\Windows\System\XLeDWau.exe
  2⤵
  PID:4352
- C:\Windows\System\FZUXMTr.exe
  C:\Windows\System\FZUXMTr.exe
  2⤵
  PID:4448
- C:\Windows\System\KYlzlFj.exe
  C:\Windows\System\KYlzlFj.exe
  2⤵
  PID:4372
- C:\Windows\System\vLNGSwz.exe
  C:\Windows\System\vLNGSwz.exe
  2⤵
  PID:4364
- C:\Windows\System\qhFnHGh.exe
  C:\Windows\System\qhFnHGh.exe
  2⤵
  PID:4472
- C:\Windows\System\wMqoEfJ.exe
  C:\Windows\System\wMqoEfJ.exe
  2⤵
  PID:4504
- C:\Windows\System\GVYolpo.exe
  C:\Windows\System\GVYolpo.exe
  2⤵
  PID:4676
- C:\Windows\System\TgJBaBC.exe
  C:\Windows\System\TgJBaBC.exe
  2⤵
  PID:4604
- C:\Windows\System\BXgcbch.exe
  C:\Windows\System\BXgcbch.exe
  2⤵
  PID:4680
- C:\Windows\System\NzWBFgl.exe
  C:\Windows\System\NzWBFgl.exe
  2⤵
  PID:4752
- C:\Windows\System\vNDDqpW.exe
  C:\Windows\System\vNDDqpW.exe
  2⤵
  PID:4824
- C:\Windows\System\SbpNWdw.exe
  C:\Windows\System\SbpNWdw.exe
  2⤵
  PID:4840
- C:\Windows\System\pcIWEDv.exe
  C:\Windows\System\pcIWEDv.exe
  2⤵
  PID:4888
- C:\Windows\System\MNSFVSl.exe
  C:\Windows\System\MNSFVSl.exe
  2⤵
  PID:4952
- C:\Windows\System\QkLdFzf.exe
  C:\Windows\System\QkLdFzf.exe
  2⤵
  PID:4988
- C:\Windows\System\Trgmnto.exe
  C:\Windows\System\Trgmnto.exe
  2⤵
  PID:4656
- C:\Windows\System\QQpvPwS.exe
  C:\Windows\System\QQpvPwS.exe
  2⤵
  PID:4856
- C:\Windows\System\litFGxS.exe
  C:\Windows\System\litFGxS.exe
  2⤵
  PID:4972
- C:\Windows\System\hnnuTVI.exe
  C:\Windows\System\hnnuTVI.exe
  2⤵
  PID:4624
- C:\Windows\System\JcWrBJS.exe
  C:\Windows\System\JcWrBJS.exe
  2⤵
  PID:4936
- C:\Windows\System\YxGoGJU.exe
  C:\Windows\System\YxGoGJU.exe
  2⤵
  PID:4732
- C:\Windows\System\vZFYODV.exe
  C:\Windows\System\vZFYODV.exe
  2⤵
  PID:5084
- C:\Windows\System\AXrlexV.exe
  C:\Windows\System\AXrlexV.exe
  2⤵
  PID:5044
- C:\Windows\System\koxjklj.exe
  C:\Windows\System\koxjklj.exe
  2⤵
  PID:5100
- C:\Windows\System\wLWlsSo.exe
  C:\Windows\System\wLWlsSo.exe
  2⤵
  PID:3976
- C:\Windows\System\THvBbAY.exe
  C:\Windows\System\THvBbAY.exe
  2⤵
  PID:4900
- C:\Windows\System\FyPhNjQ.exe
  C:\Windows\System\FyPhNjQ.exe
  2⤵
  PID:4208
- C:\Windows\System\yctWAmP.exe
  C:\Windows\System\yctWAmP.exe
  2⤵
  PID:4112
- C:\Windows\System\JZHDEij.exe
  C:\Windows\System\JZHDEij.exe
  2⤵
  PID:4748
- C:\Windows\System\tqopwwB.exe
  C:\Windows\System\tqopwwB.exe
  2⤵
  PID:4948
- C:\Windows\System\xmVIDAL.exe
  C:\Windows\System\xmVIDAL.exe
  2⤵
  PID:4864
- C:\Windows\System\JaRZWHH.exe
  C:\Windows\System\JaRZWHH.exe
  2⤵
  PID:4628
- C:\Windows\System\aXJCQTq.exe
  C:\Windows\System\aXJCQTq.exe
  2⤵
  PID:5080
- C:\Windows\System\AEPspkE.exe
  C:\Windows\System\AEPspkE.exe
  2⤵
  PID:4108
- C:\Windows\System\ZifznXr.exe
  C:\Windows\System\ZifznXr.exe
  2⤵
  PID:4468
- C:\Windows\System\HRlUsiZ.exe
  C:\Windows\System\HRlUsiZ.exe
  2⤵
  PID:4644
- C:\Windows\System\sKkatCB.exe
  C:\Windows\System\sKkatCB.exe
  2⤵
  PID:3488
- C:\Windows\System\mgxgADw.exe
  C:\Windows\System\mgxgADw.exe
  2⤵
  PID:3776
- C:\Windows\System\HMBVPUg.exe
  C:\Windows\System\HMBVPUg.exe
  2⤵
  PID:2432
- C:\Windows\System\HrHZNAc.exe
  C:\Windows\System\HrHZNAc.exe
  2⤵
  PID:4792
- C:\Windows\System\iisegzk.exe
  C:\Windows\System\iisegzk.exe
  2⤵
  PID:4592
- C:\Windows\System\hdPwYgy.exe
  C:\Windows\System\hdPwYgy.exe
  2⤵
  PID:4572
- C:\Windows\System\aWcgbDN.exe
  C:\Windows\System\aWcgbDN.exe
  2⤵
  PID:3304
- C:\Windows\System\SgHLtkJ.exe
  C:\Windows\System\SgHLtkJ.exe
  2⤵
  PID:5112
- C:\Windows\System\DjftyJS.exe
  C:\Windows\System\DjftyJS.exe
  2⤵
  PID:4344
- C:\Windows\System\gpvahjx.exe
  C:\Windows\System\gpvahjx.exe
  2⤵
  PID:5012
- C:\Windows\System\ROFgXmy.exe
  C:\Windows\System\ROFgXmy.exe
  2⤵
  PID:4812
- C:\Windows\System\dFjNsCt.exe
  C:\Windows\System\dFjNsCt.exe
  2⤵
  PID:4716
- C:\Windows\System\ZRclNqB.exe
  C:\Windows\System\ZRclNqB.exe
  2⤵
  PID:4968
- C:\Windows\System\CGVrjeP.exe
  C:\Windows\System\CGVrjeP.exe
  2⤵
  PID:5088
- C:\Windows\System\TWFnNlW.exe
  C:\Windows\System\TWFnNlW.exe
  2⤵
  PID:4496
- C:\Windows\System\xwkAKxx.exe
  C:\Windows\System\xwkAKxx.exe
  2⤵
  PID:3832
- C:\Windows\System\TAfdwMd.exe
  C:\Windows\System\TAfdwMd.exe
  2⤵
  PID:5060
- C:\Windows\System\wqWadBN.exe
  C:\Windows\System\wqWadBN.exe
  2⤵
  PID:4276
- C:\Windows\System\GsMYKuD.exe
  C:\Windows\System\GsMYKuD.exe
  2⤵
  PID:4484
- C:\Windows\System\vszDAVD.exe
  C:\Windows\System\vszDAVD.exe
  2⤵
  PID:4260
- C:\Windows\System\DObEJoL.exe
  C:\Windows\System\DObEJoL.exe
  2⤵
  PID:4744
- C:\Windows\System\CyYbCWU.exe
  C:\Windows\System\CyYbCWU.exe
  2⤵
  PID:4528
- C:\Windows\System\waPNFMp.exe
  C:\Windows\System\waPNFMp.exe
  2⤵
  PID:5108
- C:\Windows\System\uMAUAoV.exe
  C:\Windows\System\uMAUAoV.exe
  2⤵
  PID:4932
- C:\Windows\System\wxeAALu.exe
  C:\Windows\System\wxeAALu.exe
  2⤵
  PID:4128
- C:\Windows\System\YkJLkfo.exe
  C:\Windows\System\YkJLkfo.exe
  2⤵
  PID:4124
- C:\Windows\System\JqDBBMF.exe
  C:\Windows\System\JqDBBMF.exe
  2⤵
  PID:4576
- C:\Windows\System\HMkIsok.exe
  C:\Windows\System\HMkIsok.exe
  2⤵
  PID:4808
- C:\Windows\System\PexfXAC.exe
  C:\Windows\System\PexfXAC.exe
  2⤵
  PID:4256
- C:\Windows\System\rbKehHw.exe
  C:\Windows\System\rbKehHw.exe
  2⤵
  PID:5136
- C:\Windows\System\SqPwZIb.exe
  C:\Windows\System\SqPwZIb.exe
  2⤵
  PID:5160
- C:\Windows\System\FTbtDdE.exe
  C:\Windows\System\FTbtDdE.exe
  2⤵
  PID:5176
- C:\Windows\System\uUnpkER.exe
  C:\Windows\System\uUnpkER.exe
  2⤵
  PID:5196
- C:\Windows\System\wivbxfk.exe
  C:\Windows\System\wivbxfk.exe
  2⤵
  PID:5216
- C:\Windows\System\ZebCTlT.exe
  C:\Windows\System\ZebCTlT.exe
  2⤵
  PID:5260
- C:\Windows\System\afmzEHU.exe
  C:\Windows\System\afmzEHU.exe
  2⤵
  PID:5276
- C:\Windows\System\tiDctqo.exe
  C:\Windows\System\tiDctqo.exe
  2⤵
  PID:5292
- C:\Windows\System\ZITbiTQ.exe
  C:\Windows\System\ZITbiTQ.exe
  2⤵
  PID:5308
- C:\Windows\System\DYiyvyT.exe
  C:\Windows\System\DYiyvyT.exe
  2⤵
  PID:5324
- C:\Windows\System\CKYCWCp.exe
  C:\Windows\System\CKYCWCp.exe
  2⤵
  PID:5344
- C:\Windows\System\fHYuVOv.exe
  C:\Windows\System\fHYuVOv.exe
  2⤵
  PID:5364
- C:\Windows\System\awrxBKe.exe
  C:\Windows\System\awrxBKe.exe
  2⤵
  PID:5384
- C:\Windows\System\WOHHwHK.exe
  C:\Windows\System\WOHHwHK.exe
  2⤵
  PID:5404
- C:\Windows\System\pATtZta.exe
  C:\Windows\System\pATtZta.exe
  2⤵
  PID:5424
- C:\Windows\System\GffsZef.exe
  C:\Windows\System\GffsZef.exe
  2⤵
  PID:5440
- C:\Windows\System\eiLBBrV.exe
  C:\Windows\System\eiLBBrV.exe
  2⤵
  PID:5456
- C:\Windows\System\yKyISGw.exe
  C:\Windows\System\yKyISGw.exe
  2⤵
  PID:5472
- C:\Windows\System\DlbGZwA.exe
  C:\Windows\System\DlbGZwA.exe
  2⤵
  PID:5488
- C:\Windows\System\pKjPIqY.exe
  C:\Windows\System\pKjPIqY.exe
  2⤵
  PID:5504
- C:\Windows\System\pxdAjVE.exe
  C:\Windows\System\pxdAjVE.exe
  2⤵
  PID:5520
- C:\Windows\System\CeXkiHf.exe
  C:\Windows\System\CeXkiHf.exe
  2⤵
  PID:5536
- C:\Windows\System\LPDdBQg.exe
  C:\Windows\System\LPDdBQg.exe
  2⤵
  PID:5552
- C:\Windows\System\fHsGgxp.exe
  C:\Windows\System\fHsGgxp.exe
  2⤵
  PID:5568
- C:\Windows\System\KcnHxIs.exe
  C:\Windows\System\KcnHxIs.exe
  2⤵
  PID:5584
- C:\Windows\System\lVPYIYI.exe
  C:\Windows\System\lVPYIYI.exe
  2⤵
  PID:5600
- C:\Windows\System\fGZNcWk.exe
  C:\Windows\System\fGZNcWk.exe
  2⤵
  PID:5616
- C:\Windows\System\yilMfAk.exe
  C:\Windows\System\yilMfAk.exe
  2⤵
  PID:5640
- C:\Windows\System\XCGFDue.exe
  C:\Windows\System\XCGFDue.exe
  2⤵
  PID:5664
- C:\Windows\System\OswtXFv.exe
  C:\Windows\System\OswtXFv.exe
  2⤵
  PID:5692
- C:\Windows\System\tpGEQxi.exe
  C:\Windows\System\tpGEQxi.exe
  2⤵
  PID:5708
- C:\Windows\System\NFbQOkK.exe
  C:\Windows\System\NFbQOkK.exe
  2⤵
  PID:5736
- C:\Windows\System\mHqrIFX.exe
  C:\Windows\System\mHqrIFX.exe
  2⤵
  PID:5812
- C:\Windows\System\hsBensp.exe
  C:\Windows\System\hsBensp.exe
  2⤵
  PID:5828
- C:\Windows\System\OVgdsdI.exe
  C:\Windows\System\OVgdsdI.exe
  2⤵
  PID:5844
- C:\Windows\System\BLNxRwM.exe
  C:\Windows\System\BLNxRwM.exe
  2⤵
  PID:5860
- C:\Windows\System\QMNrspi.exe
  C:\Windows\System\QMNrspi.exe
  2⤵
  PID:5880
- C:\Windows\System\juCCKpm.exe
  C:\Windows\System\juCCKpm.exe
  2⤵
  PID:5896
- C:\Windows\System\peZdYee.exe
  C:\Windows\System\peZdYee.exe
  2⤵
  PID:5920
- C:\Windows\System\jqNqQyZ.exe
  C:\Windows\System\jqNqQyZ.exe
  2⤵
  PID:5940
- C:\Windows\System\VNUnSLR.exe
  C:\Windows\System\VNUnSLR.exe
  2⤵
  PID:5964
- C:\Windows\System\MfuhSTO.exe
  C:\Windows\System\MfuhSTO.exe
  2⤵
  PID:5984
- C:\Windows\System\ZqqStpD.exe
  C:\Windows\System\ZqqStpD.exe
  2⤵
  PID:6004
- C:\Windows\System\BtLbdoQ.exe
  C:\Windows\System\BtLbdoQ.exe
  2⤵
  PID:6020
- C:\Windows\System\VwVVaHU.exe
  C:\Windows\System\VwVVaHU.exe
  2⤵
  PID:6036
- C:\Windows\System\bWlLGuN.exe
  C:\Windows\System\bWlLGuN.exe
  2⤵
  PID:6060
- C:\Windows\System\NbIwlxe.exe
  C:\Windows\System\NbIwlxe.exe
  2⤵
  PID:6076
- C:\Windows\System\CvNfbEH.exe
  C:\Windows\System\CvNfbEH.exe
  2⤵
  PID:6096
- C:\Windows\System\JmBPMhU.exe
  C:\Windows\System\JmBPMhU.exe
  2⤵
  PID:6112
- C:\Windows\System\IFMLlzs.exe
  C:\Windows\System\IFMLlzs.exe
  2⤵
  PID:6128
- C:\Windows\System\QuvikqT.exe
  C:\Windows\System\QuvikqT.exe
  2⤵
  PID:5128
- C:\Windows\System\DnCwFwN.exe
  C:\Windows\System\DnCwFwN.exe
  2⤵
  PID:5028
- C:\Windows\System\QgAiRSv.exe
  C:\Windows\System\QgAiRSv.exe
  2⤵
  PID:5208
- C:\Windows\System\hENuHpj.exe
  C:\Windows\System\hENuHpj.exe
  2⤵
  PID:5096
- C:\Windows\System\OXSATVp.exe
  C:\Windows\System\OXSATVp.exe
  2⤵
  PID:4416
- C:\Windows\System\rvbdjhD.exe
  C:\Windows\System\rvbdjhD.exe
  2⤵
  PID:5268
- C:\Windows\System\UCcmMal.exe
  C:\Windows\System\UCcmMal.exe
  2⤵
  PID:5416
- C:\Windows\System\lKKsfgt.exe
  C:\Windows\System\lKKsfgt.exe
  2⤵
  PID:4776
- C:\Windows\System\VwncMnX.exe
  C:\Windows\System\VwncMnX.exe
  2⤵
  PID:5148
- C:\Windows\System\RjVkAtl.exe
  C:\Windows\System\RjVkAtl.exe
  2⤵
  PID:5480
- C:\Windows\System\XLbyotz.exe
  C:\Windows\System\XLbyotz.exe
  2⤵
  PID:5548
- C:\Windows\System\RCqcNlm.exe
  C:\Windows\System\RCqcNlm.exe
  2⤵
  PID:5316
- C:\Windows\System\ZAAbSRq.exe
  C:\Windows\System\ZAAbSRq.exe
  2⤵
  PID:5464
- C:\Windows\System\BPrbRFn.exe
  C:\Windows\System\BPrbRFn.exe
  2⤵
  PID:5360
- C:\Windows\System\mOjhWnB.exe
  C:\Windows\System\mOjhWnB.exe
  2⤵
  PID:5184
- C:\Windows\System\CIdeaiv.exe
  C:\Windows\System\CIdeaiv.exe
  2⤵
  PID:5228
- C:\Windows\System\WgjKZaV.exe
  C:\Windows\System\WgjKZaV.exe
  2⤵
  PID:5256
- C:\Windows\System\ySjwDgA.exe
  C:\Windows\System\ySjwDgA.exe
  2⤵
  PID:5532
- C:\Windows\System\EoqGgAl.exe
  C:\Windows\System\EoqGgAl.exe
  2⤵
  PID:5564
- C:\Windows\System\tFOnZhE.exe
  C:\Windows\System\tFOnZhE.exe
  2⤵
  PID:5700
- C:\Windows\System\RZJOLtc.exe
  C:\Windows\System\RZJOLtc.exe
  2⤵
  PID:5756
- C:\Windows\System\vOBrMXc.exe
  C:\Windows\System\vOBrMXc.exe
  2⤵
  PID:5772
- C:\Windows\System\kfcwPqU.exe
  C:\Windows\System\kfcwPqU.exe
  2⤵
  PID:5672
- C:\Windows\System\unfbNcg.exe
  C:\Windows\System\unfbNcg.exe
  2⤵
  PID:5676
- C:\Windows\System\oPDqnDX.exe
  C:\Windows\System\oPDqnDX.exe
  2⤵
  PID:5684
- C:\Windows\System\qhkKkei.exe
  C:\Windows\System\qhkKkei.exe
  2⤵
  PID:5728
- C:\Windows\System\rexCzDu.exe
  C:\Windows\System\rexCzDu.exe
  2⤵
  PID:5840
- C:\Windows\System\fQqTLvm.exe
  C:\Windows\System\fQqTLvm.exe
  2⤵
  PID:5872
- C:\Windows\System\zEHHxGf.exe
  C:\Windows\System\zEHHxGf.exe
  2⤵
  PID:5892
- C:\Windows\System\KkDLwLh.exe
  C:\Windows\System\KkDLwLh.exe
  2⤵
  PID:5952
- C:\Windows\System\FnlgQtd.exe
  C:\Windows\System\FnlgQtd.exe
  2⤵
  PID:5960
- C:\Windows\System\vQyCfYz.exe
  C:\Windows\System\vQyCfYz.exe
  2⤵
  PID:5972
- C:\Windows\System\zYkXhjA.exe
  C:\Windows\System\zYkXhjA.exe
  2⤵
  PID:6136
- C:\Windows\System\fjkHvZs.exe
  C:\Windows\System\fjkHvZs.exe
  2⤵
  PID:5204
- C:\Windows\System\QlJQPEO.exe
  C:\Windows\System\QlJQPEO.exe
  2⤵
  PID:6048
- C:\Windows\System\zWmdGtl.exe
  C:\Windows\System\zWmdGtl.exe
  2⤵
  PID:5300
- C:\Windows\System\PebMRwI.exe
  C:\Windows\System\PebMRwI.exe
  2⤵
  PID:5372
- C:\Windows\System\AdGxZwk.exe
  C:\Windows\System\AdGxZwk.exe
  2⤵
  PID:6016
- C:\Windows\System\XPCwYYy.exe
  C:\Windows\System\XPCwYYy.exe
  2⤵
  PID:6092
- C:\Windows\System\JfzThTs.exe
  C:\Windows\System\JfzThTs.exe
  2⤵
  PID:4436
- C:\Windows\System\pFAWPlS.exe
  C:\Windows\System\pFAWPlS.exe
  2⤵
  PID:4772
- C:\Windows\System\ELFvnrF.exe
  C:\Windows\System\ELFvnrF.exe
  2⤵
  PID:5448
- C:\Windows\System\eRZCshC.exe
  C:\Windows\System\eRZCshC.exe
  2⤵
  PID:5152
- C:\Windows\System\mHNBHWl.exe
  C:\Windows\System\mHNBHWl.exe
  2⤵
  PID:5660
- C:\Windows\System\droAVFb.exe
  C:\Windows\System\droAVFb.exe
  2⤵
  PID:5352
- C:\Windows\System\ikpsHJA.exe
  C:\Windows\System\ikpsHJA.exe
  2⤵
  PID:5528
- C:\Windows\System\vgBJznf.exe
  C:\Windows\System\vgBJznf.exe
  2⤵
  PID:5752
- C:\Windows\System\NaczBCS.exe
  C:\Windows\System\NaczBCS.exe
  2⤵
  PID:5820
- C:\Windows\System\QYWqosc.exe
  C:\Windows\System\QYWqosc.exe
  2⤵
  PID:5888
- C:\Windows\System\HDrUITz.exe
  C:\Windows\System\HDrUITz.exe
  2⤵
  PID:6072
- C:\Windows\System\vIySClv.exe
  C:\Windows\System\vIySClv.exe
  2⤵
  PID:5804
- C:\Windows\System\ZevOmzJ.exe
  C:\Windows\System\ZevOmzJ.exe
  2⤵
  PID:5452
- C:\Windows\System\QPYnVpg.exe
  C:\Windows\System\QPYnVpg.exe
  2⤵
  PID:5628
- C:\Windows\System\tPpcJZE.exe
  C:\Windows\System\tPpcJZE.exe
  2⤵
  PID:6028
- C:\Windows\System\bTYyzqi.exe
  C:\Windows\System\bTYyzqi.exe
  2⤵
  PID:5980
- C:\Windows\System\qfhxzUW.exe
  C:\Windows\System\qfhxzUW.exe
  2⤵
  PID:6012
- C:\Windows\System\mlDzqGm.exe
  C:\Windows\System\mlDzqGm.exe
  2⤵
  PID:5144
- C:\Windows\System\YvoVRlo.exe
  C:\Windows\System\YvoVRlo.exe
  2⤵
  PID:6032
- C:\Windows\System\DCPIsSy.exe
  C:\Windows\System\DCPIsSy.exe
  2⤵
  PID:5856
- C:\Windows\System\LUTYCWJ.exe
  C:\Windows\System\LUTYCWJ.exe
  2⤵
  PID:5240
- C:\Windows\System\dpzTpRX.exe
  C:\Windows\System\dpzTpRX.exe
  2⤵
  PID:5744
- C:\Windows\System\yXVrOJF.exe
  C:\Windows\System\yXVrOJF.exe
  2⤵
  PID:4148
- C:\Windows\System\dkjlZlr.exe
  C:\Windows\System\dkjlZlr.exe
  2⤵
  PID:5608
- C:\Windows\System\VTYsPOY.exe
  C:\Windows\System\VTYsPOY.exe
  2⤵
  PID:5304
- C:\Windows\System\lZJfpzl.exe
  C:\Windows\System\lZJfpzl.exe
  2⤵
  PID:5808
- C:\Windows\System\mByZYxl.exe
  C:\Windows\System\mByZYxl.exe
  2⤵
  PID:5824
- C:\Windows\System\ESwiQEB.exe
  C:\Windows\System\ESwiQEB.exe
  2⤵
  PID:5224
- C:\Windows\System\vFFPSxF.exe
  C:\Windows\System\vFFPSxF.exe
  2⤵
  PID:4700
- C:\Windows\System\uCfezmX.exe
  C:\Windows\System\uCfezmX.exe
  2⤵
  PID:5320
- C:\Windows\System\thvEiac.exe
  C:\Windows\System\thvEiac.exe
  2⤵
  PID:5580
- C:\Windows\System\ksaZDKP.exe
  C:\Windows\System\ksaZDKP.exe
  2⤵
  PID:5936
- C:\Windows\System\HDJQfes.exe
  C:\Windows\System\HDJQfes.exe
  2⤵
  PID:5768
- C:\Windows\System\iOmLXrV.exe
  C:\Windows\System\iOmLXrV.exe
  2⤵
  PID:6084
- C:\Windows\System\WsJldas.exe
  C:\Windows\System\WsJldas.exe
  2⤵
  PID:4084
- C:\Windows\System\xSbOLxY.exe
  C:\Windows\System\xSbOLxY.exe
  2⤵
  PID:5500
- C:\Windows\System\oYfdRCA.exe
  C:\Windows\System\oYfdRCA.exe
  2⤵
  PID:5400
- C:\Windows\System\rgRXWYr.exe
  C:\Windows\System\rgRXWYr.exe
  2⤵
  PID:6056
- C:\Windows\System\oxURqxh.exe
  C:\Windows\System\oxURqxh.exe
  2⤵
  PID:5956
- C:\Windows\System\oMwWfOY.exe
  C:\Windows\System\oMwWfOY.exe
  2⤵
  PID:5412
- C:\Windows\System\uZhpNpx.exe
  C:\Windows\System\uZhpNpx.exe
  2⤵
  PID:5724
- C:\Windows\System\EjjNrXc.exe
  C:\Windows\System\EjjNrXc.exe
  2⤵
  PID:5788
- C:\Windows\System\dhIcIqK.exe
  C:\Windows\System\dhIcIqK.exe
  2⤵
  PID:4588
- C:\Windows\System\QmVxpyq.exe
  C:\Windows\System\QmVxpyq.exe
  2⤵
  PID:6160
- C:\Windows\System\wVJaLUB.exe
  C:\Windows\System\wVJaLUB.exe
  2⤵
  PID:6176
- C:\Windows\System\IykKxOL.exe
  C:\Windows\System\IykKxOL.exe
  2⤵
  PID:6196
- C:\Windows\System\jIvNjYF.exe
  C:\Windows\System\jIvNjYF.exe
  2⤵
  PID:6216
- C:\Windows\System\xvLgZUu.exe
  C:\Windows\System\xvLgZUu.exe
  2⤵
  PID:6232
- C:\Windows\System\GBUctMo.exe
  C:\Windows\System\GBUctMo.exe
  2⤵
  PID:6252
- C:\Windows\System\IdkFnLT.exe
  C:\Windows\System\IdkFnLT.exe
  2⤵
  PID:6272
- C:\Windows\System\YLGqOfY.exe
  C:\Windows\System\YLGqOfY.exe
  2⤵
  PID:6292
- C:\Windows\System\pcooDKW.exe
  C:\Windows\System\pcooDKW.exe
  2⤵
  PID:6308
- C:\Windows\System\KJIuSjv.exe
  C:\Windows\System\KJIuSjv.exe
  2⤵
  PID:6324
- C:\Windows\System\RYgPsZi.exe
  C:\Windows\System\RYgPsZi.exe
  2⤵
  PID:6340
- C:\Windows\System\dLTsGdE.exe
  C:\Windows\System\dLTsGdE.exe
  2⤵
  PID:6392
- C:\Windows\System\vmJCbOy.exe
  C:\Windows\System\vmJCbOy.exe
  2⤵
  PID:6408
- C:\Windows\System\YyTtKxN.exe
  C:\Windows\System\YyTtKxN.exe
  2⤵
  PID:6424
- C:\Windows\System\FQnolaF.exe
  C:\Windows\System\FQnolaF.exe
  2⤵
  PID:6444
- C:\Windows\System\tvvAhpr.exe
  C:\Windows\System\tvvAhpr.exe
  2⤵
  PID:6460
- C:\Windows\System\GUDxZpY.exe
  C:\Windows\System\GUDxZpY.exe
  2⤵
  PID:6476
- C:\Windows\System\tgYlOix.exe
  C:\Windows\System\tgYlOix.exe
  2⤵
  PID:6496
- C:\Windows\System\nsYwSqn.exe
  C:\Windows\System\nsYwSqn.exe
  2⤵
  PID:6516
- C:\Windows\System\TocLCHn.exe
  C:\Windows\System\TocLCHn.exe
  2⤵
  PID:6532
- C:\Windows\System\WAMQOnw.exe
  C:\Windows\System\WAMQOnw.exe
  2⤵
  PID:6552
- C:\Windows\System\JhRXEYa.exe
  C:\Windows\System\JhRXEYa.exe
  2⤵
  PID:6572
- C:\Windows\System\CKWzDsM.exe
  C:\Windows\System\CKWzDsM.exe
  2⤵
  PID:6608
- C:\Windows\System\pUuqyNV.exe
  C:\Windows\System\pUuqyNV.exe
  2⤵
  PID:6628
- C:\Windows\System\xkVMEhJ.exe
  C:\Windows\System\xkVMEhJ.exe
  2⤵
  PID:6644
- C:\Windows\System\fUfYYSn.exe
  C:\Windows\System\fUfYYSn.exe
  2⤵
  PID:6660
- C:\Windows\System\lEYxYKc.exe
  C:\Windows\System\lEYxYKc.exe
  2⤵
  PID:6680
- C:\Windows\System\dpJPRNG.exe
  C:\Windows\System\dpJPRNG.exe
  2⤵
  PID:6696
- C:\Windows\System\uaXVOoN.exe
  C:\Windows\System\uaXVOoN.exe
  2⤵
  PID:6712
- C:\Windows\System\xDokySG.exe
  C:\Windows\System\xDokySG.exe
  2⤵
  PID:6732
- C:\Windows\System\bfTkUmh.exe
  C:\Windows\System\bfTkUmh.exe
  2⤵
  PID:6752
- C:\Windows\System\djGYgfV.exe
  C:\Windows\System\djGYgfV.exe
  2⤵
  PID:6772
- C:\Windows\System\JvQbKfP.exe
  C:\Windows\System\JvQbKfP.exe
  2⤵
  PID:6792
- C:\Windows\System\RbDAXIR.exe
  C:\Windows\System\RbDAXIR.exe
  2⤵
  PID:6808
- C:\Windows\System\jVlQIDp.exe
  C:\Windows\System\jVlQIDp.exe
  2⤵
  PID:6828
- C:\Windows\System\eiIdOfs.exe
  C:\Windows\System\eiIdOfs.exe
  2⤵
  PID:6844
- C:\Windows\System\KOLLYcs.exe
  C:\Windows\System\KOLLYcs.exe
  2⤵
  PID:6860
- C:\Windows\System\sPhLXqZ.exe
  C:\Windows\System\sPhLXqZ.exe
  2⤵
  PID:6880
- C:\Windows\System\xrQfLuG.exe
  C:\Windows\System\xrQfLuG.exe
  2⤵
  PID:6896
- C:\Windows\System\ydqlnQY.exe
  C:\Windows\System\ydqlnQY.exe
  2⤵
  PID:6932
- C:\Windows\System\cvPYFCe.exe
  C:\Windows\System\cvPYFCe.exe
  2⤵
  PID:6964
- C:\Windows\System\BrxUtpX.exe
  C:\Windows\System\BrxUtpX.exe
  2⤵
  PID:6984
- C:\Windows\System\GjyaCTu.exe
  C:\Windows\System\GjyaCTu.exe
  2⤵
  PID:7008
- C:\Windows\System\nQNGRyt.exe
  C:\Windows\System\nQNGRyt.exe
  2⤵
  PID:7028
- C:\Windows\System\PwVjaEG.exe
  C:\Windows\System\PwVjaEG.exe
  2⤵
  PID:7048
- C:\Windows\System\WNGpzIs.exe
  C:\Windows\System\WNGpzIs.exe
  2⤵
  PID:7064
- C:\Windows\System\guKCYnJ.exe
  C:\Windows\System\guKCYnJ.exe
  2⤵
  PID:7080
- C:\Windows\System\mvYZQMr.exe
  C:\Windows\System\mvYZQMr.exe
  2⤵
  PID:7096
- C:\Windows\System\VbYAxky.exe
  C:\Windows\System\VbYAxky.exe
  2⤵
  PID:7112
- C:\Windows\System\eIVKgUT.exe
  C:\Windows\System\eIVKgUT.exe
  2⤵
  PID:7128
- C:\Windows\System\qksDWkg.exe
  C:\Windows\System\qksDWkg.exe
  2⤵
  PID:7148
- C:\Windows\System\CSxtdWC.exe
  C:\Windows\System\CSxtdWC.exe
  2⤵
  PID:5796
- C:\Windows\System\eMoVZRm.exe
  C:\Windows\System\eMoVZRm.exe
  2⤵
  PID:5612
- C:\Windows\System\ZCpJRZe.exe
  C:\Windows\System\ZCpJRZe.exe
  2⤵
  PID:6224
- C:\Windows\System\yFAJDyI.exe
  C:\Windows\System\yFAJDyI.exe
  2⤵
  PID:6268
- C:\Windows\System\olXGVwJ.exe
  C:\Windows\System\olXGVwJ.exe
  2⤵
  PID:6332
- C:\Windows\System\gdQKDSJ.exe
  C:\Windows\System\gdQKDSJ.exe
  2⤵
  PID:5908
- C:\Windows\System\gMkRuCC.exe
  C:\Windows\System\gMkRuCC.exe
  2⤵
  PID:6400
- C:\Windows\System\eoGckgD.exe
  C:\Windows\System\eoGckgD.exe
  2⤵
  PID:6440
- C:\Windows\System\WANpgBw.exe
  C:\Windows\System\WANpgBw.exe
  2⤵
  PID:6508
- C:\Windows\System\YDouAps.exe
  C:\Windows\System\YDouAps.exe
  2⤵
  PID:6548
- C:\Windows\System\imFonOD.exe
  C:\Windows\System\imFonOD.exe
  2⤵
  PID:6580
- C:\Windows\System\lYCjdfw.exe
  C:\Windows\System\lYCjdfw.exe
  2⤵
  PID:6240
- C:\Windows\System\ljOYbaT.exe
  C:\Windows\System\ljOYbaT.exe
  2⤵
  PID:6284
- C:\Windows\System\hPGWtOC.exe
  C:\Windows\System\hPGWtOC.exe
  2⤵
  PID:6320
- C:\Windows\System\CjaURbU.exe
  C:\Windows\System\CjaURbU.exe
  2⤵
  PID:6604
- C:\Windows\System\rDRCGot.exe
  C:\Windows\System\rDRCGot.exe
  2⤵
  PID:6640
- C:\Windows\System\xcbFOko.exe
  C:\Windows\System\xcbFOko.exe
  2⤵
  PID:6484
- C:\Windows\System\kdCWCGA.exe
  C:\Windows\System\kdCWCGA.exe
  2⤵
  PID:6708
- C:\Windows\System\OaLNwuy.exe
  C:\Windows\System\OaLNwuy.exe
  2⤵
  PID:6388
- C:\Windows\System\elUmQTA.exe
  C:\Windows\System\elUmQTA.exe
  2⤵
  PID:6456
- C:\Windows\System\PFAMBnl.exe
  C:\Windows\System\PFAMBnl.exe
  2⤵
  PID:6820
- C:\Windows\System\uBQigXQ.exe
  C:\Windows\System\uBQigXQ.exe
  2⤵
  PID:6892
- C:\Windows\System\MbODqSx.exe
  C:\Windows\System\MbODqSx.exe
  2⤵
  PID:6868
- C:\Windows\System\THqzZxW.exe
  C:\Windows\System\THqzZxW.exe
  2⤵
  PID:6916
- C:\Windows\System\NfGxtOd.exe
  C:\Windows\System\NfGxtOd.exe
  2⤵
  PID:6836
- C:\Windows\System\auELeOc.exe
  C:\Windows\System\auELeOc.exe
  2⤵
  PID:6956
- C:\Windows\System\hQdALzu.exe
  C:\Windows\System\hQdALzu.exe
  2⤵
  PID:6996
- C:\Windows\System\huOyhkT.exe
  C:\Windows\System\huOyhkT.exe
  2⤵
  PID:6688
- C:\Windows\System\bLEdtPx.exe
  C:\Windows\System\bLEdtPx.exe
  2⤵
  PID:6768
- C:\Windows\System\kMKOFQg.exe
  C:\Windows\System\kMKOFQg.exe
  2⤵
  PID:6804
- C:\Windows\System\usljSjW.exe
  C:\Windows\System\usljSjW.exe
  2⤵
  PID:7040
- C:\Windows\System\ziOouZh.exe
  C:\Windows\System\ziOouZh.exe
  2⤵
  PID:7136
- C:\Windows\System\ZRMUXlY.exe
  C:\Windows\System\ZRMUXlY.exe
  2⤵
  PID:6212
- C:\Windows\System\IyyOZes.exe
  C:\Windows\System\IyyOZes.exe
  2⤵
  PID:6316
- C:\Windows\System\UuYkJWM.exe
  C:\Windows\System\UuYkJWM.exe
  2⤵
  PID:6420
- C:\Windows\System\sovezfU.exe
  C:\Windows\System\sovezfU.exe
  2⤵
  PID:6876
- C:\Windows\System\vtkBfvU.exe
  C:\Windows\System\vtkBfvU.exe
  2⤵
  PID:6952
- C:\Windows\System\vSjKZzf.exe
  C:\Windows\System\vSjKZzf.exe
  2⤵
  PID:6728
- C:\Windows\System\PfnhYaC.exe
  C:\Windows\System\PfnhYaC.exe
  2⤵
  PID:7104
- C:\Windows\System\ZyMGqdk.exe
  C:\Windows\System\ZyMGqdk.exe
  2⤵
  PID:6248
- C:\Windows\System\ivNdPFy.exe
  C:\Windows\System\ivNdPFy.exe
  2⤵
  PID:6600
- C:\Windows\System\HGEcNAv.exe
  C:\Windows\System\HGEcNAv.exe
  2⤵
  PID:6568
- C:\Windows\System\tPNhRrp.exe
  C:\Windows\System\tPNhRrp.exe
  2⤵
  PID:7000
- C:\Windows\System\dVbmkAQ.exe
  C:\Windows\System\dVbmkAQ.exe
  2⤵
  PID:6304
- C:\Windows\System\ffKgaqm.exe
  C:\Windows\System\ffKgaqm.exe
  2⤵
  PID:6168
- C:\Windows\System\jGfvxiS.exe
  C:\Windows\System\jGfvxiS.exe
  2⤵
  PID:6560
- C:\Windows\System\LCqhflO.exe
  C:\Windows\System\LCqhflO.exe
  2⤵
  PID:6652
- C:\Windows\System\uSmzSJB.exe
  C:\Windows\System\uSmzSJB.exe
  2⤵
  PID:6544
- C:\Windows\System\RGakvxZ.exe
  C:\Windows\System\RGakvxZ.exe
  2⤵
  PID:7016
- C:\Windows\System\QSJGWef.exe
  C:\Windows\System\QSJGWef.exe
  2⤵
  PID:6972
- C:\Windows\System\iOiUlzT.exe
  C:\Windows\System\iOiUlzT.exe
  2⤵
  PID:7060
- C:\Windows\System\uhIecOb.exe
  C:\Windows\System\uhIecOb.exe
  2⤵
  PID:7160
- C:\Windows\System\RblAwQn.exe
  C:\Windows\System\RblAwQn.exe
  2⤵
  PID:5252
- C:\Windows\System\qVztgXy.exe
  C:\Windows\System\qVztgXy.exe
  2⤵
  PID:6348
- C:\Windows\System\RYWXdcW.exe
  C:\Windows\System\RYWXdcW.exe
  2⤵
  PID:6208
- C:\Windows\System\KEfDSKd.exe
  C:\Windows\System\KEfDSKd.exe
  2⤵
  PID:6856
- C:\Windows\System\LDocUrK.exe
  C:\Windows\System\LDocUrK.exe
  2⤵
  PID:6636
- C:\Windows\System\zdqWTuX.exe
  C:\Windows\System\zdqWTuX.exe
  2⤵
  PID:6356
- C:\Windows\System\oDoPpXH.exe
  C:\Windows\System\oDoPpXH.exe
  2⤵
  PID:6260
- C:\Windows\System\uRSUqXF.exe
  C:\Windows\System\uRSUqXF.exe
  2⤵
  PID:6704
- C:\Windows\System\qNyfzpp.exe
  C:\Windows\System\qNyfzpp.exe
  2⤵
  PID:6720
- C:\Windows\System\dMyFQFS.exe
  C:\Windows\System\dMyFQFS.exe
  2⤵
  PID:6740
- C:\Windows\System\QcvYOen.exe
  C:\Windows\System\QcvYOen.exe
  2⤵
  PID:6788
- C:\Windows\System\vWXyjVH.exe
  C:\Windows\System\vWXyjVH.exe
  2⤵
  PID:6888
- C:\Windows\System\sAXFEKV.exe
  C:\Windows\System\sAXFEKV.exe
  2⤵
  PID:6152
- C:\Windows\System\PNRUEQO.exe
  C:\Windows\System\PNRUEQO.exe
  2⤵
  PID:6724
- C:\Windows\System\biTSSKb.exe
  C:\Windows\System\biTSSKb.exe
  2⤵
  PID:6436
- C:\Windows\System\MbYpTdV.exe
  C:\Windows\System\MbYpTdV.exe
  2⤵
  PID:6148
- C:\Windows\System\ClVcvbi.exe
  C:\Windows\System\ClVcvbi.exe
  2⤵
  PID:5172
- C:\Windows\System\TLWaOtN.exe
  C:\Windows\System\TLWaOtN.exe
  2⤵
  PID:6156
- C:\Windows\System\bRjLWGm.exe
  C:\Windows\System\bRjLWGm.exe
  2⤵
  PID:6264
- C:\Windows\System\onZSZBv.exe
  C:\Windows\System\onZSZBv.exe
  2⤵
  PID:6364
- C:\Windows\System\aGsgGRg.exe
  C:\Windows\System\aGsgGRg.exe
  2⤵
  PID:7176
- C:\Windows\System\aDSUmbG.exe
  C:\Windows\System\aDSUmbG.exe
  2⤵
  PID:7196
- C:\Windows\System\KjnYzED.exe
  C:\Windows\System\KjnYzED.exe
  2⤵
  PID:7212
- C:\Windows\System\UOcUnPZ.exe
  C:\Windows\System\UOcUnPZ.exe
  2⤵
  PID:7228
- C:\Windows\System\dUMotzk.exe
  C:\Windows\System\dUMotzk.exe
  2⤵
  PID:7244
- C:\Windows\System\tooDywJ.exe
  C:\Windows\System\tooDywJ.exe
  2⤵
  PID:7264
- C:\Windows\System\JzWobhI.exe
  C:\Windows\System\JzWobhI.exe
  2⤵
  PID:7280
- C:\Windows\System\KMrLMHL.exe
  C:\Windows\System\KMrLMHL.exe
  2⤵
  PID:7300
- C:\Windows\System\BhLnlkY.exe
  C:\Windows\System\BhLnlkY.exe
  2⤵
  PID:7316
- C:\Windows\System\xlEPkQY.exe
  C:\Windows\System\xlEPkQY.exe
  2⤵
  PID:7332
- C:\Windows\System\mvHgxxA.exe
  C:\Windows\System\mvHgxxA.exe
  2⤵
  PID:7348
- C:\Windows\System\KPAKhWp.exe
  C:\Windows\System\KPAKhWp.exe
  2⤵
  PID:7364
- C:\Windows\System\OOUeDQS.exe
  C:\Windows\System\OOUeDQS.exe
  2⤵
  PID:7384
- C:\Windows\System\sSFdVdG.exe
  C:\Windows\System\sSFdVdG.exe
  2⤵
  PID:7400
- C:\Windows\System\nXmPxFM.exe
  C:\Windows\System\nXmPxFM.exe
  2⤵
  PID:7416
- C:\Windows\System\KeyjbIA.exe
  C:\Windows\System\KeyjbIA.exe
  2⤵
  PID:7572
- C:\Windows\System\wQFrIDe.exe
  C:\Windows\System\wQFrIDe.exe
  2⤵
  PID:7592
- C:\Windows\System\XsDOqrM.exe
  C:\Windows\System\XsDOqrM.exe
  2⤵
  PID:7616
- C:\Windows\System\yyAkmrb.exe
  C:\Windows\System\yyAkmrb.exe
  2⤵
  PID:7632
- C:\Windows\System\PSfopFO.exe
  C:\Windows\System\PSfopFO.exe
  2⤵
  PID:7648
- C:\Windows\System\JqRDPOy.exe
  C:\Windows\System\JqRDPOy.exe
  2⤵
  PID:7664
- C:\Windows\System\bSOlPsI.exe
  C:\Windows\System\bSOlPsI.exe
  2⤵
  PID:7684
- C:\Windows\System\pJpQTTJ.exe
  C:\Windows\System\pJpQTTJ.exe
  2⤵
  PID:7708
- C:\Windows\System\UAphAyG.exe
  C:\Windows\System\UAphAyG.exe
  2⤵
  PID:7724
- C:\Windows\System\YEPIxDu.exe
  C:\Windows\System\YEPIxDu.exe
  2⤵
  PID:7744
- C:\Windows\System\riPODpF.exe
  C:\Windows\System\riPODpF.exe
  2⤵
  PID:7760
- C:\Windows\System\FEIiINs.exe
  C:\Windows\System\FEIiINs.exe
  2⤵
  PID:7776
- C:\Windows\System\tgPrLyi.exe
  C:\Windows\System\tgPrLyi.exe
  2⤵
  PID:7792
- C:\Windows\System\RVDBKQT.exe
  C:\Windows\System\RVDBKQT.exe
  2⤵
  PID:7812
- C:\Windows\System\istVZjR.exe
  C:\Windows\System\istVZjR.exe
  2⤵
  PID:7828
- C:\Windows\System\FHeAJCP.exe
  C:\Windows\System\FHeAJCP.exe
  2⤵
  PID:7856
- C:\Windows\System\KbqIllX.exe
  C:\Windows\System\KbqIllX.exe
  2⤵
  PID:7872
- C:\Windows\System\tPAqJlb.exe
  C:\Windows\System\tPAqJlb.exe
  2⤵
  PID:7892
- C:\Windows\System\qHFqlpv.exe
  C:\Windows\System\qHFqlpv.exe
  2⤵
  PID:7908
- C:\Windows\System\ZYwIRXj.exe
  C:\Windows\System\ZYwIRXj.exe
  2⤵
  PID:7924
- C:\Windows\System\FwzGIqD.exe
  C:\Windows\System\FwzGIqD.exe
  2⤵
  PID:7944
- C:\Windows\System\tGsRfJl.exe
  C:\Windows\System\tGsRfJl.exe
  2⤵
  PID:7964
- C:\Windows\System\uJktpSh.exe
  C:\Windows\System\uJktpSh.exe
  2⤵
  PID:7984
- C:\Windows\System\vWHdXhh.exe
  C:\Windows\System\vWHdXhh.exe
  2⤵
  PID:8000
- C:\Windows\System\inUydCY.exe
  C:\Windows\System\inUydCY.exe
  2⤵
  PID:8052
- C:\Windows\System\uwHCwPr.exe
  C:\Windows\System\uwHCwPr.exe
  2⤵
  PID:8072
- C:\Windows\System\cBrpADf.exe
  C:\Windows\System\cBrpADf.exe
  2⤵
  PID:8092
- C:\Windows\System\ARFvZZV.exe
  C:\Windows\System\ARFvZZV.exe
  2⤵
  PID:8112
- C:\Windows\System\FWjfRdG.exe
  C:\Windows\System\FWjfRdG.exe
  2⤵
  PID:8128
- C:\Windows\System\wEGRKex.exe
  C:\Windows\System\wEGRKex.exe
  2⤵
  PID:8144
- C:\Windows\System\wytedmS.exe
  C:\Windows\System\wytedmS.exe
  2⤵
  PID:8164
- C:\Windows\System\oCaMoXJ.exe
  C:\Windows\System\oCaMoXJ.exe
  2⤵
  PID:8180
- C:\Windows\System\rlVcMnn.exe
  C:\Windows\System\rlVcMnn.exe
  2⤵
  PID:7188
- C:\Windows\System\gDpoDgw.exe
  C:\Windows\System\gDpoDgw.exe
  2⤵
  PID:7252
- C:\Windows\System\SMqdhkp.exe
  C:\Windows\System\SMqdhkp.exe
  2⤵
  PID:7296
- C:\Windows\System\VcYFCXl.exe
  C:\Windows\System\VcYFCXl.exe
  2⤵
  PID:7360
- C:\Windows\System\hBKBYfT.exe
  C:\Windows\System\hBKBYfT.exe
  2⤵
  PID:7452
- C:\Windows\System\CiaxATO.exe
  C:\Windows\System\CiaxATO.exe
  2⤵
  PID:7476
- C:\Windows\System\atIApQS.exe
  C:\Windows\System\atIApQS.exe
  2⤵
  PID:7204
- C:\Windows\System\QGFEAxz.exe
  C:\Windows\System\QGFEAxz.exe
  2⤵
  PID:7408
- C:\Windows\System\DUuZOfi.exe
  C:\Windows\System\DUuZOfi.exe
  2⤵
  PID:7024
- C:\Windows\System\FHIkIWq.exe
  C:\Windows\System\FHIkIWq.exe
  2⤵
  PID:6852
- C:\Windows\System\lXianqQ.exe
  C:\Windows\System\lXianqQ.exe
  2⤵
  PID:6000
- C:\Windows\System\dFNHksv.exe
  C:\Windows\System\dFNHksv.exe
  2⤵
  PID:7344
- C:\Windows\System\YqogXTO.exe
  C:\Windows\System\YqogXTO.exe
  2⤵
  PID:7272
- C:\Windows\System\sxVeDRy.exe
  C:\Windows\System\sxVeDRy.exe
  2⤵
  PID:7312
- C:\Windows\System\GpNISlM.exe
  C:\Windows\System\GpNISlM.exe
  2⤵
  PID:7600
- C:\Windows\System\IkSEfJo.exe
  C:\Windows\System\IkSEfJo.exe
  2⤵
  PID:7608
- C:\Windows\System\rKCUvhR.exe
  C:\Windows\System\rKCUvhR.exe
  2⤵
  PID:7676
- C:\Windows\System\JNnGwAV.exe
  C:\Windows\System\JNnGwAV.exe
  2⤵
  PID:7692
- C:\Windows\System\aqIlnNo.exe
  C:\Windows\System\aqIlnNo.exe
  2⤵
  PID:7784
- C:\Windows\System\HjmkFcv.exe
  C:\Windows\System\HjmkFcv.exe
  2⤵
  PID:7864
- C:\Windows\System\EyNfeSj.exe
  C:\Windows\System\EyNfeSj.exe
  2⤵
  PID:7932
- C:\Windows\System\BZFCQxr.exe
  C:\Windows\System\BZFCQxr.exe
  2⤵
  PID:7976
- C:\Windows\System\ShDwekn.exe
  C:\Windows\System\ShDwekn.exe
  2⤵
  PID:8020
- C:\Windows\System\mEybmoJ.exe
  C:\Windows\System\mEybmoJ.exe
  2⤵
  PID:8036
- C:\Windows\System\NNuYIhM.exe
  C:\Windows\System\NNuYIhM.exe
  2⤵
  PID:7844
- C:\Windows\System\fklNtPU.exe
  C:\Windows\System\fklNtPU.exe
  2⤵
  PID:7772
- C:\Windows\System\oqlDepU.exe
  C:\Windows\System\oqlDepU.exe
  2⤵
  PID:7840
- C:\Windows\System\CMAXESN.exe
  C:\Windows\System\CMAXESN.exe
  2⤵
  PID:8152
- C:\Windows\System\wuTUGSw.exe
  C:\Windows\System\wuTUGSw.exe
  2⤵
  PID:7184
- C:\Windows\System\srhIKia.exe
  C:\Windows\System\srhIKia.exe
  2⤵
  PID:7392
- C:\Windows\System\OPMMbdu.exe
  C:\Windows\System\OPMMbdu.exe
  2⤵
  PID:7920
- C:\Windows\System\gMampXB.exe
  C:\Windows\System\gMampXB.exe
  2⤵
  PID:7996
- C:\Windows\System\ANCckzx.exe
  C:\Windows\System\ANCckzx.exe
  2⤵
  PID:8140
- C:\Windows\System\McilbPd.exe
  C:\Windows\System\McilbPd.exe
  2⤵
  PID:8068
- C:\Windows\System\vwIbtrk.exe
  C:\Windows\System\vwIbtrk.exe
  2⤵
  PID:8176
- C:\Windows\System\YroNkAj.exe
  C:\Windows\System\YroNkAj.exe
  2⤵
  PID:7324
- C:\Windows\System\HTYAKjX.exe
  C:\Windows\System\HTYAKjX.exe
  2⤵
  PID:7464
- C:\Windows\System\DBLlTHb.exe
  C:\Windows\System\DBLlTHb.exe
  2⤵
  PID:6352
- C:\Windows\System\atMXjSj.exe
  C:\Windows\System\atMXjSj.exe
  2⤵
  PID:7556
- C:\Windows\System\eDgMDzs.exe
  C:\Windows\System\eDgMDzs.exe
  2⤵
  PID:6300
- C:\Windows\System\ASGnsdH.exe
  C:\Windows\System\ASGnsdH.exe
  2⤵
  PID:7376
- C:\Windows\System\mkyqeAF.exe
  C:\Windows\System\mkyqeAF.exe
  2⤵
  PID:7276
- C:\Windows\System\xMutWnL.exe
  C:\Windows\System\xMutWnL.exe
  2⤵
  PID:7644
- C:\Windows\System\pIxUFOQ.exe
  C:\Windows\System\pIxUFOQ.exe
  2⤵
  PID:7716
- C:\Windows\System\IuHjnYk.exe
  C:\Windows\System\IuHjnYk.exe
  2⤵
  PID:7904
- C:\Windows\System\nlTmLyA.exe
  C:\Windows\System\nlTmLyA.exe
  2⤵
  PID:8016
- C:\Windows\System\hOlxugd.exe
  C:\Windows\System\hOlxugd.exe
  2⤵
  PID:7940
- C:\Windows\System\xogiRRR.exe
  C:\Windows\System\xogiRRR.exe
  2⤵
  PID:8028
- C:\Windows\System\znxCSDZ.exe
  C:\Windows\System\znxCSDZ.exe
  2⤵
  PID:7768
- C:\Windows\System\SBCpLEx.exe
  C:\Windows\System\SBCpLEx.exe
  2⤵
  PID:8080
- C:\Windows\System\PWESoZs.exe
  C:\Windows\System\PWESoZs.exe
  2⤵
  PID:8120
- C:\Windows\System\ywrCgjI.exe
  C:\Windows\System\ywrCgjI.exe
  2⤵
  PID:8124
- C:\Windows\System\fgRVQbo.exe
  C:\Windows\System\fgRVQbo.exe
  2⤵
  PID:7956
- C:\Windows\System\zxmfWnl.exe
  C:\Windows\System\zxmfWnl.exe
  2⤵
  PID:7440
- C:\Windows\System\VLNCQpO.exe
  C:\Windows\System\VLNCQpO.exe
  2⤵
  PID:7380
- C:\Windows\System\ixNvIxY.exe
  C:\Windows\System\ixNvIxY.exe
  2⤵
  PID:7640
- C:\Windows\System\xTUlewm.exe
  C:\Windows\System\xTUlewm.exe
  2⤵
  PID:7328
- C:\Windows\System\uIrreNb.exe
  C:\Windows\System\uIrreNb.exe
  2⤵
  PID:8048
- C:\Windows\System\zRfaNsQ.exe
  C:\Windows\System\zRfaNsQ.exe
  2⤵
  PID:7808
- C:\Windows\System\ukciXNp.exe
  C:\Windows\System\ukciXNp.exe
  2⤵
  PID:6588
- C:\Windows\System\LQaTesB.exe
  C:\Windows\System\LQaTesB.exe
  2⤵
  PID:7604
- C:\Windows\System\zgzpXlL.exe
  C:\Windows\System\zgzpXlL.exe
  2⤵
  PID:7612
- C:\Windows\System\eGQspHQ.exe
  C:\Windows\System\eGQspHQ.exe
  2⤵
  PID:7852
- C:\Windows\System\cXtIIhy.exe
  C:\Windows\System\cXtIIhy.exe
  2⤵
  PID:7752
- C:\Windows\System\HWAtkxn.exe
  C:\Windows\System\HWAtkxn.exe
  2⤵
  PID:7740
- C:\Windows\System\cWyXicf.exe
  C:\Windows\System\cWyXicf.exe
  2⤵
  PID:7588
- C:\Windows\System\nEZCGaw.exe
  C:\Windows\System\nEZCGaw.exe
  2⤵
  PID:7292
- C:\Windows\System\vppEExX.exe
  C:\Windows\System\vppEExX.exe
  2⤵
  PID:7804
- C:\Windows\System\GAwMOia.exe
  C:\Windows\System\GAwMOia.exe
  2⤵
  PID:7756
- C:\Windows\System\yjPAgbR.exe
  C:\Windows\System\yjPAgbR.exe
  2⤵
  PID:8064
- C:\Windows\System\PtIrxVQ.exe
  C:\Windows\System\PtIrxVQ.exe
  2⤵
  PID:7236
- C:\Windows\System\uFmjrjt.exe
  C:\Windows\System\uFmjrjt.exe
  2⤵
  PID:6908
- C:\Windows\System\jBjdnyU.exe
  C:\Windows\System\jBjdnyU.exe
  2⤵
  PID:7220
- C:\Windows\System\wQoZbdb.exe
  C:\Windows\System\wQoZbdb.exe
  2⤵
  PID:7824
- C:\Windows\System\agRnRMq.exe
  C:\Windows\System\agRnRMq.exe
  2⤵
  PID:6368
- C:\Windows\System\oXZGoMD.exe
  C:\Windows\System\oXZGoMD.exe
  2⤵
  PID:7888
- C:\Windows\System\GirpHVJ.exe
  C:\Windows\System\GirpHVJ.exe
  2⤵
  PID:7172
- C:\Windows\System\acOJKLR.exe
  C:\Windows\System\acOJKLR.exe
  2⤵
  PID:8108
- C:\Windows\System\lKFuJbK.exe
  C:\Windows\System\lKFuJbK.exe
  2⤵
  PID:8208
- C:\Windows\System\HwQMgMq.exe
  C:\Windows\System\HwQMgMq.exe
  2⤵
  PID:8224
- C:\Windows\System\ZsrOHOP.exe
  C:\Windows\System\ZsrOHOP.exe
  2⤵
  PID:8244
- C:\Windows\System\dlQrKno.exe
  C:\Windows\System\dlQrKno.exe
  2⤵
  PID:8260
- C:\Windows\System\YNxNNnb.exe
  C:\Windows\System\YNxNNnb.exe
  2⤵
  PID:8280
- C:\Windows\System\XPyuZdO.exe
  C:\Windows\System\XPyuZdO.exe
  2⤵
  PID:8300
- C:\Windows\System\DPpJwtO.exe
  C:\Windows\System\DPpJwtO.exe
  2⤵
  PID:8316
- C:\Windows\System\CKiQauO.exe
  C:\Windows\System\CKiQauO.exe
  2⤵
  PID:8356
- C:\Windows\System\HlDzgxQ.exe
  C:\Windows\System\HlDzgxQ.exe
  2⤵
  PID:8376
- C:\Windows\System\mrMpQNP.exe
  C:\Windows\System\mrMpQNP.exe
  2⤵
  PID:8396
- C:\Windows\System\VJOyHEP.exe
  C:\Windows\System\VJOyHEP.exe
  2⤵
  PID:8416
- C:\Windows\System\fpjpQvG.exe
  C:\Windows\System\fpjpQvG.exe
  2⤵
  PID:8436
- C:\Windows\System\FtpRHWO.exe
  C:\Windows\System\FtpRHWO.exe
  2⤵
  PID:8456
- C:\Windows\System\PpuWdAZ.exe
  C:\Windows\System\PpuWdAZ.exe
  2⤵
  PID:8472
- C:\Windows\System\FzAFswc.exe
  C:\Windows\System\FzAFswc.exe
  2⤵
  PID:8488
- C:\Windows\System\jQLsQrs.exe
  C:\Windows\System\jQLsQrs.exe
  2⤵
  PID:8512
- C:\Windows\System\oHbMXfq.exe
  C:\Windows\System\oHbMXfq.exe
  2⤵
  PID:8532
- C:\Windows\System\gvBjNRS.exe
  C:\Windows\System\gvBjNRS.exe
  2⤵
  PID:8548
- C:\Windows\System\fLjyblW.exe
  C:\Windows\System\fLjyblW.exe
  2⤵
  PID:8564
- C:\Windows\System\nVahuTg.exe
  C:\Windows\System\nVahuTg.exe
  2⤵
  PID:8580
- C:\Windows\System\JVpIBma.exe
  C:\Windows\System\JVpIBma.exe
  2⤵
  PID:8596
- C:\Windows\System\hICabLx.exe
  C:\Windows\System\hICabLx.exe
  2⤵
  PID:8612
- C:\Windows\System\muoGSQY.exe
  C:\Windows\System\muoGSQY.exe
  2⤵
  PID:8632
- C:\Windows\System\Joroemy.exe
  C:\Windows\System\Joroemy.exe
  2⤵
  PID:8676
- C:\Windows\System\JXaPteZ.exe
  C:\Windows\System\JXaPteZ.exe
  2⤵
  PID:8696
- C:\Windows\System\BUTKIPI.exe
  C:\Windows\System\BUTKIPI.exe
  2⤵
  PID:8712
- C:\Windows\System\xPDduti.exe
  C:\Windows\System\xPDduti.exe
  2⤵
  PID:8732
- C:\Windows\System\KefeTpp.exe
  C:\Windows\System\KefeTpp.exe
  2⤵
  PID:8752
- C:\Windows\System\pbhTZlK.exe
  C:\Windows\System\pbhTZlK.exe
  2⤵
  PID:8768
- C:\Windows\System\VxYKNVP.exe
  C:\Windows\System\VxYKNVP.exe
  2⤵
  PID:8784
- C:\Windows\System\BxNCfmD.exe
  C:\Windows\System\BxNCfmD.exe
  2⤵
  PID:8800
- C:\Windows\System\lMwPGRF.exe
  C:\Windows\System\lMwPGRF.exe
  2⤵
  PID:8820
- C:\Windows\System\gHOVejF.exe
  C:\Windows\System\gHOVejF.exe
  2⤵
  PID:8840
- C:\Windows\System\rkWHiIT.exe
  C:\Windows\System\rkWHiIT.exe
  2⤵
  PID:8856
- C:\Windows\System\jkABCPG.exe
  C:\Windows\System\jkABCPG.exe
  2⤵
  PID:8876
- C:\Windows\System\pZsTJvs.exe
  C:\Windows\System\pZsTJvs.exe
  2⤵
  PID:8892
- C:\Windows\System\ajPhkwi.exe
  C:\Windows\System\ajPhkwi.exe
  2⤵
  PID:8920
- C:\Windows\System\PjYepmV.exe
  C:\Windows\System\PjYepmV.exe
  2⤵
  PID:8936
- C:\Windows\System\fDTOZMZ.exe
  C:\Windows\System\fDTOZMZ.exe
  2⤵
  PID:8964
- C:\Windows\System\REOtaGL.exe
  C:\Windows\System\REOtaGL.exe
  2⤵
  PID:9004
- C:\Windows\System\sJgxJpf.exe
  C:\Windows\System\sJgxJpf.exe
  2⤵
  PID:9020
- C:\Windows\System\CIpsYlV.exe
  C:\Windows\System\CIpsYlV.exe
  2⤵
  PID:9036
- C:\Windows\System\BfVGmwc.exe
  C:\Windows\System\BfVGmwc.exe
  2⤵
  PID:9056
- C:\Windows\System\juqiHGz.exe
  C:\Windows\System\juqiHGz.exe
  2⤵
  PID:9084
- C:\Windows\System\vSfRHhK.exe
  C:\Windows\System\vSfRHhK.exe
  2⤵
  PID:9104
- C:\Windows\System\YuxqHiV.exe
  C:\Windows\System\YuxqHiV.exe
  2⤵
  PID:9120
- C:\Windows\System\mYLJjne.exe
  C:\Windows\System\mYLJjne.exe
  2⤵
  PID:9136
- C:\Windows\System\iRmXiWn.exe
  C:\Windows\System\iRmXiWn.exe
  2⤵
  PID:9152
- C:\Windows\System\YSUCSZt.exe
  C:\Windows\System\YSUCSZt.exe
  2⤵
  PID:9176
- C:\Windows\System\rQwWEHA.exe
  C:\Windows\System\rQwWEHA.exe
  2⤵
  PID:9208
- C:\Windows\System\ASgDGRf.exe
  C:\Windows\System\ASgDGRf.exe
  2⤵
  PID:8204
- C:\Windows\System\CBKodsU.exe
  C:\Windows\System\CBKodsU.exe
  2⤵
  PID:8268
- C:\Windows\System\qGsxQIx.exe
  C:\Windows\System\qGsxQIx.exe
  2⤵
  PID:8308
- C:\Windows\System\oSzwhtL.exe
  C:\Windows\System\oSzwhtL.exe
  2⤵
  PID:8296
- C:\Windows\System\ivpStNm.exe
  C:\Windows\System\ivpStNm.exe
  2⤵
  PID:7660
- C:\Windows\System\XoxXZIQ.exe
  C:\Windows\System\XoxXZIQ.exe
  2⤵
  PID:8220
- C:\Windows\System\XZhfuvC.exe
  C:\Windows\System\XZhfuvC.exe
  2⤵
  PID:8328
- C:\Windows\System\OryROMA.exe
  C:\Windows\System\OryROMA.exe
  2⤵
  PID:8384
- C:\Windows\System\cOJSSTF.exe
  C:\Windows\System\cOJSSTF.exe
  2⤵
  PID:8392
- C:\Windows\System\lvjNDwa.exe
  C:\Windows\System\lvjNDwa.exe
  2⤵
  PID:8484
- C:\Windows\System\tqPCsiq.exe
  C:\Windows\System\tqPCsiq.exe
  2⤵
  PID:8496
- C:\Windows\System\OVyRbGR.exe
  C:\Windows\System\OVyRbGR.exe
  2⤵
  PID:8524
- C:\Windows\System\KQxpUSh.exe
  C:\Windows\System\KQxpUSh.exe
  2⤵
  PID:8560
- C:\Windows\System\MgURKET.exe
  C:\Windows\System\MgURKET.exe
  2⤵
  PID:8628
- C:\Windows\System\AnqQKLX.exe
  C:\Windows\System\AnqQKLX.exe
  2⤵
  PID:8688
- C:\Windows\System\cmJORjN.exe
  C:\Windows\System\cmJORjN.exe
  2⤵
  PID:8640
- C:\Windows\System\sWluKwg.exe
  C:\Windows\System\sWluKwg.exe
  2⤵
  PID:8724
- C:\Windows\System\DkVeIOo.exe
  C:\Windows\System\DkVeIOo.exe
  2⤵
  PID:8832
- C:\Windows\System\FzFHyYU.exe
  C:\Windows\System\FzFHyYU.exe
  2⤵
  PID:8660
- C:\Windows\System\IyIvzwE.exe
  C:\Windows\System\IyIvzwE.exe
  2⤵
  PID:8904
- C:\Windows\System\tCoyjYW.exe
  C:\Windows\System\tCoyjYW.exe
  2⤵
  PID:8780
- C:\Windows\System\yusiSsX.exe
  C:\Windows\System\yusiSsX.exe
  2⤵
  PID:8912
- C:\Windows\System\IgENAIY.exe
  C:\Windows\System\IgENAIY.exe
  2⤵
  PID:8808
- C:\Windows\System\noyBnDu.exe
  C:\Windows\System\noyBnDu.exe
  2⤵
  PID:8848
- C:\Windows\System\IVcNcIe.exe
  C:\Windows\System\IVcNcIe.exe
  2⤵
  PID:8948
- C:\Windows\System\SboEMmZ.exe
  C:\Windows\System\SboEMmZ.exe
  2⤵
  PID:8980
- C:\Windows\System\gtQipCl.exe
  C:\Windows\System\gtQipCl.exe
  2⤵
  PID:9000
- C:\Windows\System\bZRKMpw.exe
  C:\Windows\System\bZRKMpw.exe
  2⤵
  PID:9044
- C:\Windows\System\QiZBBfa.exe
  C:\Windows\System\QiZBBfa.exe
  2⤵
  PID:9064
- C:\Windows\System\zQWgkBa.exe
  C:\Windows\System\zQWgkBa.exe
  2⤵
  PID:9096
- C:\Windows\System\WLIZFSd.exe
  C:\Windows\System\WLIZFSd.exe
  2⤵
  PID:9164
- C:\Windows\System\FbnfZTR.exe
  C:\Windows\System\FbnfZTR.exe
  2⤵
  PID:9192
- C:\Windows\System\CBuBcAR.exe
  C:\Windows\System\CBuBcAR.exe
  2⤵
  PID:8196
- C:\Windows\System\EvaYeaF.exe
  C:\Windows\System\EvaYeaF.exe
  2⤵
  PID:8252
- C:\Windows\System\RApOlaN.exe
  C:\Windows\System\RApOlaN.exe
  2⤵
  PID:8292
- C:\Windows\System\nokUJnX.exe
  C:\Windows\System\nokUJnX.exe
  2⤵
  PID:8348
- C:\Windows\System\bLnYHUj.exe
  C:\Windows\System\bLnYHUj.exe
  2⤵
  PID:8372
- C:\Windows\System\LuPAyOd.exe
  C:\Windows\System\LuPAyOd.exe
  2⤵
  PID:8444
- C:\Windows\System\LAZPWHy.exe
  C:\Windows\System\LAZPWHy.exe
  2⤵
  PID:8468
- C:\Windows\System\iaQHUOq.exe
  C:\Windows\System\iaQHUOq.exe
  2⤵
  PID:8556
- C:\Windows\System\VvOwmHZ.exe
  C:\Windows\System\VvOwmHZ.exe
  2⤵
  PID:8684
- C:\Windows\System\sGMqBiG.exe
  C:\Windows\System\sGMqBiG.exe
  2⤵
  PID:8668
- C:\Windows\System\XkbIkui.exe
  C:\Windows\System\XkbIkui.exe
  2⤵
  PID:8764
- C:\Windows\System\CtLabed.exe
  C:\Windows\System\CtLabed.exe
  2⤵
  PID:8796
- C:\Windows\System\cmvnQLI.exe
  C:\Windows\System\cmvnQLI.exe
  2⤵
  PID:8744
- C:\Windows\System\jTnSkbw.exe
  C:\Windows\System\jTnSkbw.exe
  2⤵
  PID:8928
- C:\Windows\System\jwzGQYn.exe
  C:\Windows\System\jwzGQYn.exe
  2⤵
  PID:8960
- C:\Windows\System\jVbPvqP.exe
  C:\Windows\System\jVbPvqP.exe
  2⤵
  PID:9016
- C:\Windows\System\InZsQtf.exe
  C:\Windows\System\InZsQtf.exe
  2⤵
  PID:8992
- C:\Windows\System\PWozUtI.exe
  C:\Windows\System\PWozUtI.exe
  2⤵
  PID:9092
- C:\Windows\System\QNErMrd.exe
  C:\Windows\System\QNErMrd.exe
  2⤵
  PID:920
- C:\Windows\System\XDCuhlh.exe
  C:\Windows\System\XDCuhlh.exe
  2⤵
  PID:9184
- C:\Windows\System\VmkSCxo.exe
  C:\Windows\System\VmkSCxo.exe
  2⤵
  PID:8276
- C:\Windows\System\gmLkBHs.exe
  C:\Windows\System\gmLkBHs.exe
  2⤵
  PID:9188
- C:\Windows\System\vTwMIWr.exe
  C:\Windows\System\vTwMIWr.exe
  2⤵
  PID:8352
- C:\Windows\System\ZOoQVMn.exe
  C:\Windows\System\ZOoQVMn.exe
  2⤵
  PID:8412
- C:\Windows\System\cObTIxQ.exe
  C:\Windows\System\cObTIxQ.exe
  2⤵
  PID:8544
- C:\Windows\System\jlZEpKh.exe
  C:\Windows\System\jlZEpKh.exe
  2⤵
  PID:8720
- C:\Windows\System\tuKXpFS.exe
  C:\Windows\System\tuKXpFS.exe
  2⤵
  PID:8760
- C:\Windows\System\nwmeFVA.exe
  C:\Windows\System\nwmeFVA.exe
  2⤵
  PID:8452
- C:\Windows\System\kpzqZVQ.exe
  C:\Windows\System\kpzqZVQ.exe
  2⤵
  PID:8816
- C:\Windows\System\FdxFXJS.exe
  C:\Windows\System\FdxFXJS.exe
  2⤵
  PID:9032
- C:\Windows\System\mmVpJtW.exe
  C:\Windows\System\mmVpJtW.exe
  2⤵
  PID:9116
- C:\Windows\System\cgBEAsw.exe
  C:\Windows\System\cgBEAsw.exe
  2⤵
  PID:9144
- C:\Windows\System\VNNqmfX.exe
  C:\Windows\System\VNNqmfX.exe
  2⤵
  PID:7880
- C:\Windows\System\WHWcBnt.exe
  C:\Windows\System\WHWcBnt.exe
  2⤵
  PID:8692
- C:\Windows\System\aidPalK.exe
  C:\Windows\System\aidPalK.exe
  2⤵
  PID:8364
- C:\Windows\System\OKqUUWu.exe
  C:\Windows\System\OKqUUWu.exe
  2⤵
  PID:8528
- C:\Windows\System\AcuXonX.exe
  C:\Windows\System\AcuXonX.exe
  2⤵
  PID:8868
- C:\Windows\System\XYYfELu.exe
  C:\Windows\System\XYYfELu.exe
  2⤵
  PID:8984
- C:\Windows\System\IBHPNXi.exe
  C:\Windows\System\IBHPNXi.exe
  2⤵
  PID:9112
- C:\Windows\System\YdFFAZs.exe
  C:\Windows\System\YdFFAZs.exe
  2⤵
  PID:9132
- C:\Windows\System\sSUbfGm.exe
  C:\Windows\System\sSUbfGm.exe
  2⤵
  PID:8480
- C:\Windows\System\cPSUqzG.exe
  C:\Windows\System\cPSUqzG.exe
  2⤵
  PID:8620
- C:\Windows\System\KyNwvXu.exe
  C:\Windows\System\KyNwvXu.exe
  2⤵
  PID:9080
- C:\Windows\System\Mzswktn.exe
  C:\Windows\System\Mzswktn.exe
  2⤵
  PID:8232
- C:\Windows\System\sUnEszu.exe
  C:\Windows\System\sUnEszu.exe
  2⤵
  PID:9224
- C:\Windows\System\OiDZISU.exe
  C:\Windows\System\OiDZISU.exe
  2⤵
  PID:9240
- C:\Windows\System\XURntNb.exe
  C:\Windows\System\XURntNb.exe
  2⤵
  PID:9256
- C:\Windows\System\zSyHOla.exe
  C:\Windows\System\zSyHOla.exe
  2⤵
  PID:9272
- C:\Windows\System\bIZevMD.exe
  C:\Windows\System\bIZevMD.exe
  2⤵
  PID:9292
- C:\Windows\System\QjhnvUI.exe
  C:\Windows\System\QjhnvUI.exe
  2⤵
  PID:9312
- C:\Windows\System\rKQokBF.exe
  C:\Windows\System\rKQokBF.exe
  2⤵
  PID:9328
- C:\Windows\System\xtmqzZW.exe
  C:\Windows\System\xtmqzZW.exe
  2⤵
  PID:9348
- C:\Windows\System\cvqdOyY.exe
  C:\Windows\System\cvqdOyY.exe
  2⤵
  PID:9368
- C:\Windows\System\qCrtwPw.exe
  C:\Windows\System\qCrtwPw.exe
  2⤵
  PID:9384
- C:\Windows\System\xgzlWsD.exe
  C:\Windows\System\xgzlWsD.exe
  2⤵
  PID:9412
- C:\Windows\System\jarIGIa.exe
  C:\Windows\System\jarIGIa.exe
  2⤵
  PID:9432
- C:\Windows\System\wEiMmSs.exe
  C:\Windows\System\wEiMmSs.exe
  2⤵
  PID:9464
- C:\Windows\System\ircJXQx.exe
  C:\Windows\System\ircJXQx.exe
  2⤵
  PID:9480
- C:\Windows\System\CTvRzKF.exe
  C:\Windows\System\CTvRzKF.exe
  2⤵
  PID:9504
- C:\Windows\System\kNxDBSn.exe
  C:\Windows\System\kNxDBSn.exe
  2⤵
  PID:9548
- C:\Windows\System\EyJsOpw.exe
  C:\Windows\System\EyJsOpw.exe
  2⤵
  PID:9568
- C:\Windows\System\GjbIGon.exe
  C:\Windows\System\GjbIGon.exe
  2⤵
  PID:9584
- C:\Windows\System\ZblumHT.exe
  C:\Windows\System\ZblumHT.exe
  2⤵
  PID:9604
- C:\Windows\System\tlstxwl.exe
  C:\Windows\System\tlstxwl.exe
  2⤵
  PID:9624
- C:\Windows\System\xTysAks.exe
  C:\Windows\System\xTysAks.exe
  2⤵
  PID:9640
- C:\Windows\System\DwFFFpn.exe
  C:\Windows\System\DwFFFpn.exe
  2⤵
  PID:9656
- C:\Windows\System\HsgQgMV.exe
  C:\Windows\System\HsgQgMV.exe
  2⤵
  PID:9672
- C:\Windows\System\JcojpNo.exe
  C:\Windows\System\JcojpNo.exe
  2⤵
  PID:9692
- C:\Windows\System\JtSMQhK.exe
  C:\Windows\System\JtSMQhK.exe
  2⤵
  PID:9712
- C:\Windows\System\qIZgEYe.exe
  C:\Windows\System\qIZgEYe.exe
  2⤵
  PID:9732
- C:\Windows\System\rGWLApm.exe
  C:\Windows\System\rGWLApm.exe
  2⤵
  PID:9748
- C:\Windows\System\xtpeJpQ.exe
  C:\Windows\System\xtpeJpQ.exe
  2⤵
  PID:9768
- C:\Windows\System\unVLMnP.exe
  C:\Windows\System\unVLMnP.exe
  2⤵
  PID:9784
- C:\Windows\System\kTIUXGd.exe
  C:\Windows\System\kTIUXGd.exe
  2⤵
  PID:9832
- C:\Windows\System\jOgDfLD.exe
  C:\Windows\System\jOgDfLD.exe
  2⤵
  PID:9848
- C:\Windows\System\mYchiYS.exe
  C:\Windows\System\mYchiYS.exe
  2⤵
  PID:9868
- C:\Windows\System\WVYrsIR.exe
  C:\Windows\System\WVYrsIR.exe
  2⤵
  PID:9888
- C:\Windows\System\FOLAXab.exe
  C:\Windows\System\FOLAXab.exe
  2⤵
  PID:9904
- C:\Windows\System\bAuccax.exe
  C:\Windows\System\bAuccax.exe
  2⤵
  PID:9924
- C:\Windows\System\JryFgtA.exe
  C:\Windows\System\JryFgtA.exe
  2⤵
  PID:9944
- C:\Windows\System\FDvdAMK.exe
  C:\Windows\System\FDvdAMK.exe
  2⤵
  PID:9960
- C:\Windows\System\yoESujV.exe
  C:\Windows\System\yoESujV.exe
  2⤵
  PID:9980
- C:\Windows\System\blRDsWd.exe
  C:\Windows\System\blRDsWd.exe
  2⤵
  PID:9996
- C:\Windows\System\IhVHeXj.exe
  C:\Windows\System\IhVHeXj.exe
  2⤵
  PID:10016
- C:\Windows\System\xswwGRk.exe
  C:\Windows\System\xswwGRk.exe
  2⤵
  PID:10036
- C:\Windows\System\qodDWNE.exe
  C:\Windows\System\qodDWNE.exe
  2⤵
  PID:10064
- C:\Windows\System\OclotNW.exe
  C:\Windows\System\OclotNW.exe
  2⤵
  PID:10080
- C:\Windows\System\yhmKmbO.exe
  C:\Windows\System\yhmKmbO.exe
  2⤵
  PID:10096
- C:\Windows\System\gFWwIkQ.exe
  C:\Windows\System\gFWwIkQ.exe
  2⤵
  PID:10112
- C:\Windows\System\sVHFfbz.exe
  C:\Windows\System\sVHFfbz.exe
  2⤵
  PID:10148
- C:\Windows\System\GivQgFH.exe
  C:\Windows\System\GivQgFH.exe
  2⤵
  PID:10164
- C:\Windows\System\mGtLdhO.exe
  C:\Windows\System\mGtLdhO.exe
  2⤵
  PID:10184
- C:\Windows\System\YwfSmLS.exe
  C:\Windows\System\YwfSmLS.exe
  2⤵
  PID:10204
- C:\Windows\System\wsqQuJt.exe
  C:\Windows\System\wsqQuJt.exe
  2⤵
  PID:10220
- C:\Windows\System\ZVERjHl.exe
  C:\Windows\System\ZVERjHl.exe
  2⤵
  PID:10236
- C:\Windows\System\qZWTsFg.exe
  C:\Windows\System\qZWTsFg.exe
  2⤵
  PID:9280
- C:\Windows\System\uxAtFLx.exe
  C:\Windows\System\uxAtFLx.exe
  2⤵
  PID:8404
- C:\Windows\System\UKYjQKI.exe
  C:\Windows\System\UKYjQKI.exe
  2⤵
  PID:9440
- C:\Windows\System\OLGAMtk.exe
  C:\Windows\System\OLGAMtk.exe
  2⤵
  PID:9456
- C:\Windows\System\oSShkpN.exe
  C:\Windows\System\oSShkpN.exe
  2⤵
  PID:9376
- C:\Windows\System\IjGeHxt.exe
  C:\Windows\System\IjGeHxt.exe
  2⤵
  PID:9340
- C:\Windows\System\wfVAmYI.exe
  C:\Windows\System\wfVAmYI.exe
  2⤵
  PID:9428
- C:\Windows\System\ekWQjVm.exe
  C:\Windows\System\ekWQjVm.exe
  2⤵
  PID:9344
- C:\Windows\System\VWHAHau.exe
  C:\Windows\System\VWHAHau.exe
  2⤵
  PID:9476
- C:\Windows\System\NGNsOid.exe
  C:\Windows\System\NGNsOid.exe
  2⤵
  PID:9528
- C:\Windows\System\ldLhetn.exe
  C:\Windows\System\ldLhetn.exe
  2⤵
  PID:9544
- C:\Windows\System\prmAzcQ.exe
  C:\Windows\System\prmAzcQ.exe
  2⤵
  PID:9600
- C:\Windows\System\LpfxLCv.exe
  C:\Windows\System\LpfxLCv.exe
  2⤵
  PID:9668
- C:\Windows\System\glTBBYg.exe
  C:\Windows\System\glTBBYg.exe
  2⤵
  PID:9708
- C:\Windows\System\gZPqReh.exe
  C:\Windows\System\gZPqReh.exe
  2⤵
  PID:9776
- C:\Windows\System\iocbOMq.exe
  C:\Windows\System\iocbOMq.exe
  2⤵
  PID:9620
- C:\Windows\System\NUNKzLn.exe
  C:\Windows\System\NUNKzLn.exe
  2⤵
  PID:9764
- C:\Windows\System\OZNOyqS.exe
  C:\Windows\System\OZNOyqS.exe
  2⤵
  PID:9804
- C:\Windows\System\WlQMVSi.exe
  C:\Windows\System\WlQMVSi.exe
  2⤵
  PID:9812
- C:\Windows\System\QXPAOuY.exe
  C:\Windows\System\QXPAOuY.exe
  2⤵
  PID:9860
- C:\Windows\System\awVNBnC.exe
  C:\Windows\System\awVNBnC.exe
  2⤵
  PID:9912
- C:\Windows\System\RxUnkoS.exe
  C:\Windows\System\RxUnkoS.exe
  2⤵
  PID:9956
- C:\Windows\System\fSglMsg.exe
  C:\Windows\System\fSglMsg.exe
  2⤵
  PID:9936
- C:\Windows\System\SHapuCi.exe
  C:\Windows\System\SHapuCi.exe
  2⤵
  PID:9976
- C:\Windows\System\NSTVlNc.exe
  C:\Windows\System\NSTVlNc.exe
  2⤵
  PID:10052
- C:\Windows\System\wLSMjWG.exe
  C:\Windows\System\wLSMjWG.exe
  2⤵
  PID:10004
- C:\Windows\System\hQIpnWP.exe
  C:\Windows\System\hQIpnWP.exe
  2⤵
  PID:10092
- C:\Windows\System\xTgnKOy.exe
  C:\Windows\System\xTgnKOy.exe
  2⤵
  PID:10124
- C:\Windows\System\koOkhKQ.exe
  C:\Windows\System\koOkhKQ.exe
  2⤵
  PID:10160
- C:\Windows\System\TMQBszL.exe
  C:\Windows\System\TMQBszL.exe
  2⤵
  PID:10136
- C:\Windows\System\xfMJaJP.exe
  C:\Windows\System\xfMJaJP.exe
  2⤵
  PID:10212
- C:\Windows\System\DasMtBU.exe
  C:\Windows\System\DasMtBU.exe
  2⤵
  PID:9288
- C:\Windows\System\HZgmZVN.exe
  C:\Windows\System\HZgmZVN.exe
  2⤵
  PID:9364
- C:\Windows\System\EcfzFWe.exe
  C:\Windows\System\EcfzFWe.exe
  2⤵
  PID:9308
- C:\Windows\System\cGLFdAj.exe
  C:\Windows\System\cGLFdAj.exe
  2⤵
  PID:9492
- C:\Windows\System\frekAXu.exe
  C:\Windows\System\frekAXu.exe
  2⤵
  PID:9824
- C:\Windows\System\PDcCrhs.exe
  C:\Windows\System\PDcCrhs.exe
  2⤵
  PID:9236
- C:\Windows\System\uwXysRD.exe
  C:\Windows\System\uwXysRD.exe
  2⤵
  PID:9524
- C:\Windows\System\dWYFZEv.exe
  C:\Windows\System\dWYFZEv.exe
  2⤵
  PID:9536
- C:\Windows\System\WTolRmV.exe
  C:\Windows\System\WTolRmV.exe
  2⤵
  PID:9596
- C:\Windows\System\HbpdyYo.exe
  C:\Windows\System\HbpdyYo.exe
  2⤵
  PID:9700
- C:\Windows\System\XjyDlUc.exe
  C:\Windows\System\XjyDlUc.exe
  2⤵
  PID:9652
- C:\Windows\System\SePQwyk.exe
  C:\Windows\System\SePQwyk.exe
  2⤵
  PID:9800
- C:\Windows\System\pHVRGwq.exe
  C:\Windows\System\pHVRGwq.exe
  2⤵
  PID:9396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyFlPvq.exe

Filesize
1.5MB

MD5
5d0811efa84c6c3752f67dfc0402a235

SHA1
de8f0cc5cec1803bc95f8dbd581b3d4bb935a56c

SHA256
4bc2dc9375d0a865526eb1fdfa27ae6dbfc81d32fb72f3bbafd62fef3962b0b5

SHA512
daf800766a65824c5c20b7f17fd231719ae704514b667f5903cb5e8e8e7f8521ba687dc62625f4db31c7abf1d113091e23a80060e3371b9d7e6f963885a264e6

Download Submit
C:\Windows\system\BdBxesG.exe

Filesize
1.5MB

MD5
ade9d916a3d11d6b4543a1b22cbb6d8f

SHA1
08ec52c2ccf840044389ac5ae71d6daf205b8d0c

SHA256
3b2094b0c39eada4a05b85a69c5b60ce6fa9154575cc7f9e9ba147e90ed0ea0c

SHA512
c095680bfee27b18ca67492e3506b1251d72c6d44e4e22cd98c2025e048b374d721b5682b2babb414002a9ddbb344ec40e9c64cd63a57a80932e557e1567c2ef

Download Submit
C:\Windows\system\HDztGtg.exe

Filesize
1.5MB

MD5
94e2d3b455aa760d5635d7726f9f6eb6

SHA1
cce648440dae606e3bec8ef45307568d41d35faa

SHA256
67870b7e6ab409281a174a32d5b0e1493f7b299dc93f52ad284433adee7b01d6

SHA512
7ae9e42720cfe6d0d49ff43c566fbd264ec93936b3751258e30e707f375d5358ef6c0b55cb4ca2bba9c061392e1ad8c0536b595d38c3ea97907b8be68b73e16e

Download Submit
C:\Windows\system\KdvjKry.exe

Filesize
1.5MB

MD5
5599a65f2b63efd9ca5515f894051f02

SHA1
3e59de9dece47191963fc29103a25455f4ecb380

SHA256
a8d460dff66734bbfc6069ea06f6ce9ea5a44ccbc8939624ab07809dae1570b6

SHA512
c77552e9e055267a22a95d8808bc457194eb7cc025b081b2be660e7cd4b45e114db567071d8243edf27ea29a517699103df87cb295ccf8dacb0a39158f3b1a84

Download Submit
C:\Windows\system\bVpKrWB.exe

Filesize
1.5MB

MD5
35fdd1e60fdd1f07aea0f7100b179033

SHA1
dd16f1349352bc28eb34c2388770c009ebdecb30

SHA256
812f809cefc1a3a35e64293a55d1e26d30c1e530ad32708e9a5f6aa00d16910f

SHA512
0527954ae4a2366a15bdfcb400f1ca3f27cb5d678da8bd71e403bfaa06fae1570fa73b24301fa7c0123e0197bedff0a92b94cb063e38c12bc6e37d92c7aca17b

Download Submit
C:\Windows\system\dSudmrp.exe

Filesize
1.5MB

MD5
4c2b38888f2a456d21b7fd8174a2812c

SHA1
c5b2c54ec392d09b5c2c7a0bed80f2e5996487cc

SHA256
ed32262ef720e5e02c1ca8808e0219d6435b52e0657ef5fd406e49f0e5431c73

SHA512
d67b3959bcf252ed2c19eefead37248e24e6b73503027ae5d0046bab6c971c9fbb97da1736b609ac62f17dde42e542e5881e9e6f782ab8a39c0183bcef84ec7e

Download Submit
C:\Windows\system\eWDkHba.exe

Filesize
1.5MB

MD5
1c400e14d4c14e8fb9e5fd7b5908e714

SHA1
e0bd29281710ea025dd4d9c6f40528b086279d53

SHA256
5d1511f989ce3b641ae12492856ca4e0800a16bd7f258e345567fa4c4624419a

SHA512
edb30025d382dc4bdce56ee81d179bb69fc9973ac6a29e8bbfb160f2a6a5a0acfd3c0d3869c06f38a7eecb44e9529799619f2cd91d04c4f9dc02bf29156cd815

Download Submit
C:\Windows\system\fzqsCPd.exe

Filesize
1.5MB

MD5
0c68709be684a0cc9713883a145f914e

SHA1
ca3d6fa23e0a91a5eb655fcc5ee0b143f7a93c5b

SHA256
533a4056d31b49c0959511dd4f7ec58ebe1ee5bd35e04fe7039597ab922a011b

SHA512
84d9d6815ff1d407594499275b611ed970ad200034e3ba91ae5abd255fad53925738c460434675c7cb199f8e2be5dbea1671f58145f2f03fea6f1f48ff14aa9f

Download Submit
C:\Windows\system\hQzUczs.exe

Filesize
1.5MB

MD5
b9e511f47750353c55343de5b4a669dc

SHA1
2e6b3fd4a2f5cad87702367c6ab22411fa248e9a

SHA256
9a46a7f5275048f5205cfa5de13e74a4d9053645ddd7f83c601a1b506d3ae11f

SHA512
73fd0ca159006ba30c1f2c3387e006f5abc7c8a9d65c12f7c5f39b30970f2d67e1fc1dc29b56218fccfa1af3799e0233bd63a3c4d754eaf7e0847b1fcb1c6198

Download Submit
C:\Windows\system\iyDGkzC.exe

Filesize
1.5MB

MD5
53c482c3a6b3b5a6a48487db3e6bd304

SHA1
03b3e3cf07c939f341553c5fac29e0e3298785fb

SHA256
86dc0443df73921a6ad29ef3ee0cfb6eb79df8ee4ae13427f35c22e02f52ccb1

SHA512
4afd9b32126b114cedfb0a4ae2385386cde143a7df1f269483e26053fc0ca1864f85011975832eda7526af5fc70e4865be4db88d12e28ddb74c12a19a1a4ed48

Download Submit
C:\Windows\system\kDqMESj.exe

Filesize
1.5MB

MD5
3ffba4b50f485d017bfe99eaa3cce7e9

SHA1
5754412e5bbcd5967c192aa14a1193cfdb612bde

SHA256
c5ffe5f0ebd96535b44093b4e2f3f07a377acb15f23ba76bbf385d81fd47f59a

SHA512
cc627b59c1f32951d0545855ceffd66553608c9b7c8037c0d432be543a7ad259b58b49673cd1dfe2672a969aeced56a65a0c749a8ed6ed568a48604b9b163ae1

Download Submit
C:\Windows\system\kYOotTS.exe

Filesize
1.5MB

MD5
78f14a0afbe1e72071ff409653aec192

SHA1
63565550e719872f65fa20dc710e088c5db0b288

SHA256
7cfe8c64db669efc7531dce7f14b66b1e0e0698057905a02897417488b05b8a6

SHA512
4253c8cc62e4397f26dda3597d903edec5a6db9a154d74283fc3c2796a5406ae87945fe049753e712b04ad4a8510d0648a3d53ee25c8ab424083a24c9538e10b

Download Submit
C:\Windows\system\nWaCAmf.exe

Filesize
1.5MB

MD5
9563f2ac6cfaaad7aee8faafc491c543

SHA1
15f94610d513c1defb4b9218af9b73028a6508e9

SHA256
d68a9a091b5052934d9c3e3b28c9cedcf99fe492d292aabacc7d00c70b6b6849

SHA512
0200546cbb8a5a8bbfd4f5ad4cc20aa3965f324c5e603dd38a9d8322a714dfcfb2eaeea02e48a3373159e4b79d238d988a12dfda5f2a2b487a755dea2153e293

Download Submit
C:\Windows\system\naRLcMx.exe

Filesize
1.5MB

MD5
dcaf98670053cd0bdf0275d8392d1e61

SHA1
8f988ede63482622dd5c9184ee7f6df99617c190

SHA256
7fd897036ce9606dc386a0372dfe0b4a0611c0bdf7e8b175725cd77e4907e90a

SHA512
0444b1c861ab5fceceed9d48ce153314eb880190e156d3f129f70d6077a7546d72d6048a3a2bf553949cc285334b605655b16e9f87f68b1e3e69fd89bcce5158

Download Submit
C:\Windows\system\qWZzCcq.exe

Filesize
1.5MB

MD5
03a93975290959271568a2e00ddfe052

SHA1
2972f0a66a32a7654955c3fc9d60ddaa3cc10c4b

SHA256
1a5c4e1236bd9c22af67bc868bc0d2e17b32e18f65a35b4faf00e20cfd2b20b3

SHA512
3f4163c5b1a1f698b0ec05817b62314988a7eefbe28ed48a9b619f769cb0650a40d4134aaab1a0735e6491b9981db791f6fa578d42fbbc8a27c57f949939d890

Download Submit
C:\Windows\system\qmuohXq.exe

Filesize
1.5MB

MD5
b927273a84c7681aa96cbe9f673c28ae

SHA1
0c63808c17927d8bfe2d00d56be5ea1b5f7fc7c3

SHA256
51d652589be6dadc859d2dfac20d9d496be33c507f9943b2cdb638b51b58712f

SHA512
7c612fc4ff1629e5a4c9d42878e1967b10d20252949688970564d76d85cc1b6abe996aa46db7b40f659d53432b7156159c6f12d4e90aead9c84308fc0be81d93

Download Submit
C:\Windows\system\qzrIyJv.exe

Filesize
1.5MB

MD5
324054deb08069b872a9b44faa3c16d7

SHA1
f1b1fa34f44b5bb9ce180784845779f9ef24ad90

SHA256
f1c5e2c35f5ee9a4ad5d5904d78e49a007a8e42bcaee2371c0ddbbaaa46f1d27

SHA512
fb8ab71ce387f9dd1ce85f90451f85be597183a5f5a46f5116d01ca2ca2082e60b939e39ff8fdcd38dae61669f887d5ceb234998e37512c87b828e0c242f9d8e

Download Submit
C:\Windows\system\rCKaPpb.exe

Filesize
1.5MB

MD5
b8068bedffe13e7e8172b80ee574e726

SHA1
77754be79da9104aa8b634eacfe9eed8c3779523

SHA256
9699032242daa5527d53ab93f07187e5fd03be4bd4e95f5ec6e40a7562a61f24

SHA512
4c08aa538351a8cb35ffd25cdc3c6c3dc9ba3a57e3d9cfc418639c32a6ea4ae9a7e05435e631df15a9ca24a2d50d5299db1e5cf9a8b90e3de993c50c99c7b9fe

Download Submit
C:\Windows\system\sLZJEEF.exe

Filesize
1.5MB

MD5
3fdeb7ab43ad1ecd6c937220f6f0d3dd

SHA1
2b2755fe3e94c65bb3c1a110288fbdd24d099202

SHA256
b4076c7e56f03ce7546bbccb120846a6605e60df059e496718089b5a4d774781

SHA512
b75da51ee5b5bb4346e6153026b99ce7275cfad43826daafa20f36cdaea74bfdf3c5b8ed5b4f5854a6c9fe6a6c579034e75b976568a2f1cdfeb5c188fa42ba61

Download Submit
C:\Windows\system\wLSHzvl.exe

Filesize
1.5MB

MD5
366c6e2776b8aa97304dbaa1cf93ce55

SHA1
e88a8f8c1f9ea74a6c6b1b5bc74cf5105ba782ee

SHA256
63714a7ccf4f9564eeb82964b227b748c72ec69fd845318d47d578cbe89f12b0

SHA512
807e9cc716f7941da7420122d9638d2ffe2b623fd936db7718614a43a6720f2afe1873ae9c885a97dfe6c6d6784f47b78c71cce54c4b178fc1a7e6fe04bed44a

Download Submit
C:\Windows\system\zgMZUHL.exe

Filesize
1.5MB

MD5
6f2f1b6daab7185c1be870bff53d1a5d

SHA1
57a3f72cc4ddb7c41531476a4e6b2a7c815c9d38

SHA256
328d06df0f59c9e733cf44605672e09ec18b431adafd1984ad16f2e94db4d847

SHA512
4daa3804f24ae7e235489653836ebbef9ab399daf8eca8d582a67a9cdb2d5b2f713be631519f6b1d6dc3e7c7d5515872be6f9e75bc678ef1902d522bd5ba0432

Download Submit
\Windows\system\AgTLLje.exe

Filesize
1.5MB

MD5
3fb75868ed4b408d064733f4d7cb6977

SHA1
3cb00f96e71255493066d26f70d72b00014c0f6e

SHA256
d4ab51f25b71cccb15d760eebed1e6746904e4e3f8525e7e5821f7e2e6e96c7d

SHA512
dc02bb78076ec086651587446bcc86a40bd47466a0ebde6a2c5f0053e4a55372bada0f31c4c608611f5c79dc6cf97390277428032ef668983b0fee1a8ded262f

Download Submit
\Windows\system\BRGwOVU.exe

Filesize
1.5MB

MD5
b57558500ec5de5dcf68a01e43cf9255

SHA1
f2d95941eb1a0ac1878c9f024dba5488104b9680

SHA256
6c7115d657575a0c450efba5f570372d6268676f92b8eecef4965c3c02fbfc00

SHA512
bf1836aaaaf058f76bdbde9835fd7e91bdeb39c09931d232bc8bb09b8069c1af8225dc76ecb27d1be9cc8332fabeed9fe141bb6418eb35d4f92eb05f48465d0a

Download Submit
\Windows\system\CLihttL.exe

Filesize
1.5MB

MD5
abd9b2d66e9bb5a02b35b7a9a94617ef

SHA1
b65d681cdb799e5438bfda62c540be28b521bf51

SHA256
6aee6d3fee5153581b5a8c377c2bb6e8fb3c2f99e32d539451fdd9581e503251

SHA512
b6351bbf9f934fb77bfa640b57ca4a787753df81d5e396b35a589f77bc1ca28b26ba44e2e82326e658b88a36387e86833b7cf1cc119af1095d05d9dab211c00c

Download Submit
\Windows\system\JeeAyws.exe

Filesize
1.5MB

MD5
f478f5ee077f44a406b451733237c821

SHA1
846f15ac5bb919c3b5b70006d16e8bd849dc1884

SHA256
948d56b1a04dfe65cc8a5e54dc6b0f9c565bfa873b630a57a7433e80de23942f

SHA512
fcf423d2f4e60ef0651aace915763ff9139809c0724416f4a390846d1add5be5c0a86b9f5997f5feff3c1c69e2123ce3b671e08e7772ce512940d8d8a3bd5533

Download Submit
\Windows\system\NhsbamT.exe

Filesize
1.4MB

MD5
96f0225e19038a997b5bf0f8fa654d19

SHA1
1b86a4ba1532ecc26f9fa3926ca7bba2866448ba

SHA256
8b3160775e2dbe2e9c07ce2e65f35226fd2cdcbca42ef9268d956478546fdc1a

SHA512
d9f9bfb93c06cab75ddd95e202cb187d0e88f9f9401eb87eea1a7882020120fea7aec6bcf0c572390d8d9ca00d627f51e5fa11daa842fc995e50c5282a152651

Download Submit
\Windows\system\PfZpPUJ.exe

Filesize
1.5MB

MD5
160844ec4f757fd474ccb37d292259e5

SHA1
9658cbe28dbbf5cabc672f90c35632871e1b6290

SHA256
e241470497934c6fc999f2d2429413d1a9e4878899054011a256c55608b84971

SHA512
5c0c5de7920f189bbf256fa2d1eceddef001ba113cde2eda23f6ce1f1e8f614217d8116054824c523ae92e330222244a33409975d3cb398c46d48ebae5b4eb0d

Download Submit
\Windows\system\RfPLFmu.exe

Filesize
1.5MB

MD5
5dba4d7e981b08f3d5d77ea08616f21a

SHA1
bbfcfc89bfeec6516f4808d14d8a20b44ae39e87

SHA256
5ffff12498ffc21da2da93b24a62d7c0b142275a37f8fc0dc19b2f23d190f30e

SHA512
128f848227a2a29753320d25e7746a21d6e1f6193543f6f7d414b516fb3e5bc94477db6daa52463789224a5039e21c13bf9bea82596ab6a40b7ef0728cbd53e8

Download Submit
\Windows\system\fvyThRu.exe

Filesize
1.5MB

MD5
0a1f706f83c32ee245644657eb11fbc3

SHA1
2c8c890c9955796aed851009f6eeaafce19003e4

SHA256
d06e9af49108fc5a2a142862e04d5088fd87e31f6d48d6e138c66631cc16cf82

SHA512
25972c7025bebd886ea028f449bdf96941a20aedabf9504091d73df1d5827ffe6c7641a487576ed18fa3bc1e1a9c71d6494bfcb36f75d87bf880b96ff996498b

Download Submit
\Windows\system\hutbgXB.exe

Filesize
1.5MB

MD5
019766a2a63a2247f00328ba996b6db9

SHA1
ab2f2c924384cd9071d8815a70031561681117ab

SHA256
24227990700131c5ccd0e2ae0fe97737103da1ca27b86b043625e1f2f3aea71a

SHA512
99fbd0d5a29abbdce0d217ba21c4292a1d285479b97b6eacc17b7e32b1e3ea074f89e852b4a4186bfd52b06b664914b98b8058d50476881ceb67751b73558cad

Download Submit
\Windows\system\ovWKlBt.exe

Filesize
1.5MB

MD5
5e47ed97e4e9770d5a212a3cde60826f

SHA1
13b83b3651a71d7840d708d2a94511195b7ece0e

SHA256
1ee20a277f00ee4b833d5b3f4015aab82422554aed20e36562b541e080363a6a

SHA512
0206a6063c7b782f1771a641dbf17735b3e04745e04ee3db47a643acaa1d12c7b5e26fe160588591b22630ea334a5cb0f77d047933038550402b2c76ea140242

Download Submit
\Windows\system\sTjddiu.exe

Filesize
1.5MB

MD5
0eeef4968d3ab7be5e63b60be7e8f1f8

SHA1
8c7434a48f98f73ef5b880fb96acd047d4400c7b

SHA256
9b160559866b19bf1168c51e17968cf5fce829ecf35bf3f22b771cdb7415aa44

SHA512
5a48d8b0b01ba6f88fbab446f729f8377ec6844771f0168fa9829fd0b62216a86da2d9ed671f54e7137e7885feab926afc243a052e22ef2e277dc39789d22487

Download Submit
memory/2544-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download