xmrig | 7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/01/2025, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
Size

1.4MB
MD5

2f79d4e3c7217745c56235112ad842ed
SHA1

7efbc997ddc3741a8faa6ecda18d9e7e6643f791
SHA256

7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1
SHA512

c1ab5dad10f96ede11ff3b2e7a261a6e51fc6a0e57529203b6d81d98b14ea1fbeb63cc45cd35671563fc5e19e1cf1c290efb8165a364747286744eb8b9eb70c9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nesd8AJ:GezaTF8FcNkNdfE0pZ9ozttwIRxA1sVJ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000016d29-12.dat	xmrig
behavioral1/files/0x0007000000016d3a-25.dat	xmrig
behavioral1/files/0x000a000000016d5e-48.dat	xmrig
behavioral1/files/0x000500000001873d-69.dat	xmrig
behavioral1/files/0x0005000000019261-99.dat	xmrig
behavioral1/files/0x00050000000193c2-124.dat	xmrig
behavioral1/files/0x00050000000193e1-130.dat	xmrig
behavioral1/files/0x000500000001944f-154.dat	xmrig
behavioral1/files/0x0005000000019461-160.dat	xmrig
behavioral1/files/0x0005000000019441-150.dat	xmrig
behavioral1/files/0x0005000000019427-139.dat	xmrig
behavioral1/files/0x0005000000019431-143.dat	xmrig
behavioral1/files/0x000500000001941e-134.dat	xmrig
behavioral1/files/0x00050000000193b4-119.dat	xmrig
behavioral1/files/0x0005000000019334-109.dat	xmrig
behavioral1/files/0x0005000000019350-114.dat	xmrig
behavioral1/files/0x0005000000019282-104.dat	xmrig
behavioral1/files/0x000500000001925e-94.dat	xmrig
behavioral1/files/0x0006000000019023-89.dat	xmrig
behavioral1/files/0x00050000000187a5-84.dat	xmrig
behavioral1/files/0x000500000001878f-79.dat	xmrig
behavioral1/files/0x0005000000018784-74.dat	xmrig
behavioral1/files/0x0005000000018728-64.dat	xmrig
behavioral1/files/0x00050000000186fd-60.dat	xmrig
behavioral1/files/0x00050000000186ea-43.dat	xmrig
behavioral1/files/0x00050000000186ee-52.dat	xmrig
behavioral1/files/0x00070000000186e4-40.dat	xmrig
behavioral1/files/0x0007000000016d42-31.dat	xmrig
behavioral1/files/0x0008000000016d21-16.dat	xmrig
behavioral1/files/0x0007000000012117-9.dat	xmrig
behavioral1/files/0x0008000000016d0e-8.dat	xmrig
behavioral1/files/0x0007000000016d31-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1764	AjvZVKV.exe
1652	dgCNUlT.exe
1960	eubGnvK.exe
2164	BApUATe.exe
1812	RkEKgVo.exe
2748	mlpmggT.exe
2860	kazVRsu.exe
2820	wFkIzOk.exe
2756	TlShvuM.exe
2624	zOXRXhz.exe
2852	deSXjNU.exe
2648	wyhLKVp.exe
2612	PxcqSSr.exe
2672	syDftTU.exe
2220	wfpEwrA.exe
2160	BjplCpA.exe
1832	uZtXFHj.exe
488	NaKigXG.exe
1396	TXGEYje.exe
1932	hGZhNMi.exe
2668	VELXHXS.exe
2848	TXYZHGW.exe
2932	trStYFU.exe
2700	rIophtx.exe
2184	lCVDCMe.exe
1568	nCzSqsw.exe
1048	xxsXFap.exe
1972	SfDbAei.exe
528	shVealy.exe
2196	EqBkUIW.exe
2024	rInOHkN.exe
444	aQHVuda.exe
2228	PzVHoTC.exe
2136	uFkNfzp.exe
1616	YfDnbql.exe
680	ArcddtS.exe
1284	QqhYHCP.exe
1940	XIHTZaU.exe
1448	fnfYivF.exe
1572	mdLaieT.exe
1472	SVAKZbF.exe
684	rQvlaff.exe
236	TKTJGNK.exe
2328	HUHNilh.exe
908	YWBMpjD.exe
1920	aMmRpdd.exe
744	VfgGhEz.exe
2212	AgMQnVx.exe
1656	sGdSUOU.exe
2528	zNawIDp.exe
2564	oQSJGIN.exe
900	kbuKIZK.exe
2440	dmHKWif.exe
2396	iuedHmg.exe
1772	AdGyVwK.exe
2364	koCkSqM.exe
1736	SnatBwX.exe
1628	VoSlxNa.exe
1496	syxiitT.exe
3028	NsbflhG.exe
2488	EUNcDsK.exe
2764	iJBzqaJ.exe
2832	GuTBOjl.exe
2072	ycKBVYI.exe

Loads dropped DLL 64 IoCs

pid	Process
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jjttoQh.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\pPVBFkI.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\VgjWHwt.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\VcuaFwd.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\lCVDCMe.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\FwaYgks.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\yliwynZ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\MkFUpwa.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\DylCpLS.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\wuGeiaS.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\uwWyLAY.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\nuNFoBn.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\CyOCQDX.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\udKofMx.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\THDfcFb.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\LgRBKTu.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\GUpsWmT.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\NXPjGlS.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\fzcpKDF.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\WdxWUwU.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\QaoCjva.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\tRbFrPj.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\vbGtJNV.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\JVMfAaM.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\yprQQuA.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\ZoLzquB.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\mlWPYfB.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\XUVPzNr.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\OpslKHB.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\wxXLymV.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\GMskrfZ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\oaGJvCJ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\IROMoVX.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\ZwRwYHW.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\novAUPE.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\NsbflhG.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\vNSPXqD.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\aQyhkKW.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\GWmNizI.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\vGCHwkx.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\qIzTsEp.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\cfxPMnI.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\hKzwJEt.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\cZDENiD.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\wFZDIQb.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\AdGyVwK.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\iCgKAcn.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\wSFGezV.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\eMthHqe.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\juWCSZT.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\xnlhpsQ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\JBjVLkt.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\jWgNdph.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\FcCwkaQ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\OZEIkHY.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\IPJDDLE.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\fKxWbGE.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\rhEMlcJ.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\WasMsof.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\itpQBvT.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\rRlCMTM.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\YgtyVLp.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\TOvafSw.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
File created	C:\Windows\System\mMrNOyu.exe	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1652	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	31
PID 2684 wrote to memory of 1652	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	31
PID 2684 wrote to memory of 1652	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	31
PID 2684 wrote to memory of 1764	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	32
PID 2684 wrote to memory of 1764	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	32
PID 2684 wrote to memory of 1764	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	32
PID 2684 wrote to memory of 1960	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	33
PID 2684 wrote to memory of 1960	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	33
PID 2684 wrote to memory of 1960	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	33
PID 2684 wrote to memory of 1812	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	34
PID 2684 wrote to memory of 1812	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	34
PID 2684 wrote to memory of 1812	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	34
PID 2684 wrote to memory of 2164	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	35
PID 2684 wrote to memory of 2164	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	35
PID 2684 wrote to memory of 2164	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	35
PID 2684 wrote to memory of 2748	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	36
PID 2684 wrote to memory of 2748	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	36
PID 2684 wrote to memory of 2748	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	36
PID 2684 wrote to memory of 2860	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	37
PID 2684 wrote to memory of 2860	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	37
PID 2684 wrote to memory of 2860	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	37
PID 2684 wrote to memory of 2756	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	38
PID 2684 wrote to memory of 2756	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	38
PID 2684 wrote to memory of 2756	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	38
PID 2684 wrote to memory of 2820	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	39
PID 2684 wrote to memory of 2820	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	39
PID 2684 wrote to memory of 2820	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	39
PID 2684 wrote to memory of 2852	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	40
PID 2684 wrote to memory of 2852	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	40
PID 2684 wrote to memory of 2852	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	40
PID 2684 wrote to memory of 2624	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	41
PID 2684 wrote to memory of 2624	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	41
PID 2684 wrote to memory of 2624	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	41
PID 2684 wrote to memory of 2648	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	42
PID 2684 wrote to memory of 2648	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	42
PID 2684 wrote to memory of 2648	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	42
PID 2684 wrote to memory of 2612	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	43
PID 2684 wrote to memory of 2612	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	43
PID 2684 wrote to memory of 2612	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	43
PID 2684 wrote to memory of 2672	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	44
PID 2684 wrote to memory of 2672	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	44
PID 2684 wrote to memory of 2672	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	44
PID 2684 wrote to memory of 2220	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	45
PID 2684 wrote to memory of 2220	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	45
PID 2684 wrote to memory of 2220	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	45
PID 2684 wrote to memory of 2160	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	46
PID 2684 wrote to memory of 2160	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	46
PID 2684 wrote to memory of 2160	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	46
PID 2684 wrote to memory of 1832	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	47
PID 2684 wrote to memory of 1832	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	47
PID 2684 wrote to memory of 1832	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	47
PID 2684 wrote to memory of 488	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	48
PID 2684 wrote to memory of 488	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	48
PID 2684 wrote to memory of 488	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	48
PID 2684 wrote to memory of 1396	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	49
PID 2684 wrote to memory of 1396	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	49
PID 2684 wrote to memory of 1396	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	49
PID 2684 wrote to memory of 1932	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	50
PID 2684 wrote to memory of 1932	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	50
PID 2684 wrote to memory of 1932	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	50
PID 2684 wrote to memory of 2668	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	51
PID 2684 wrote to memory of 2668	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	51
PID 2684 wrote to memory of 2668	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	51
PID 2684 wrote to memory of 2848	2684	7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe	52

C:\Users\Admin\AppData\Local\Temp\7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe
"C:\Users\Admin\AppData\Local\Temp\7cd75b53e73b696fa9dd50091db8dc36279e9fec768fe48425458e4333806ea1.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System\dgCNUlT.exe
  C:\Windows\System\dgCNUlT.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\AjvZVKV.exe
  C:\Windows\System\AjvZVKV.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\eubGnvK.exe
  C:\Windows\System\eubGnvK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\RkEKgVo.exe
  C:\Windows\System\RkEKgVo.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\BApUATe.exe
  C:\Windows\System\BApUATe.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\mlpmggT.exe
  C:\Windows\System\mlpmggT.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\kazVRsu.exe
  C:\Windows\System\kazVRsu.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\TlShvuM.exe
  C:\Windows\System\TlShvuM.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\wFkIzOk.exe
  C:\Windows\System\wFkIzOk.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\deSXjNU.exe
  C:\Windows\System\deSXjNU.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\zOXRXhz.exe
  C:\Windows\System\zOXRXhz.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wyhLKVp.exe
  C:\Windows\System\wyhLKVp.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PxcqSSr.exe
  C:\Windows\System\PxcqSSr.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\syDftTU.exe
  C:\Windows\System\syDftTU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\wfpEwrA.exe
  C:\Windows\System\wfpEwrA.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\BjplCpA.exe
  C:\Windows\System\BjplCpA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\uZtXFHj.exe
  C:\Windows\System\uZtXFHj.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\NaKigXG.exe
  C:\Windows\System\NaKigXG.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\TXGEYje.exe
  C:\Windows\System\TXGEYje.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\hGZhNMi.exe
  C:\Windows\System\hGZhNMi.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\VELXHXS.exe
  C:\Windows\System\VELXHXS.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\TXYZHGW.exe
  C:\Windows\System\TXYZHGW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\trStYFU.exe
  C:\Windows\System\trStYFU.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\rIophtx.exe
  C:\Windows\System\rIophtx.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\lCVDCMe.exe
  C:\Windows\System\lCVDCMe.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\nCzSqsw.exe
  C:\Windows\System\nCzSqsw.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\xxsXFap.exe
  C:\Windows\System\xxsXFap.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\SfDbAei.exe
  C:\Windows\System\SfDbAei.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\shVealy.exe
  C:\Windows\System\shVealy.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\EqBkUIW.exe
  C:\Windows\System\EqBkUIW.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\rInOHkN.exe
  C:\Windows\System\rInOHkN.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\aQHVuda.exe
  C:\Windows\System\aQHVuda.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\PzVHoTC.exe
  C:\Windows\System\PzVHoTC.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\uFkNfzp.exe
  C:\Windows\System\uFkNfzp.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\YfDnbql.exe
  C:\Windows\System\YfDnbql.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ArcddtS.exe
  C:\Windows\System\ArcddtS.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\QqhYHCP.exe
  C:\Windows\System\QqhYHCP.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\XIHTZaU.exe
  C:\Windows\System\XIHTZaU.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\fnfYivF.exe
  C:\Windows\System\fnfYivF.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\SVAKZbF.exe
  C:\Windows\System\SVAKZbF.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\mdLaieT.exe
  C:\Windows\System\mdLaieT.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TKTJGNK.exe
  C:\Windows\System\TKTJGNK.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\rQvlaff.exe
  C:\Windows\System\rQvlaff.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\YWBMpjD.exe
  C:\Windows\System\YWBMpjD.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\HUHNilh.exe
  C:\Windows\System\HUHNilh.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VfgGhEz.exe
  C:\Windows\System\VfgGhEz.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\aMmRpdd.exe
  C:\Windows\System\aMmRpdd.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\sGdSUOU.exe
  C:\Windows\System\sGdSUOU.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\AgMQnVx.exe
  C:\Windows\System\AgMQnVx.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\oQSJGIN.exe
  C:\Windows\System\oQSJGIN.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zNawIDp.exe
  C:\Windows\System\zNawIDp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\iuedHmg.exe
  C:\Windows\System\iuedHmg.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\kbuKIZK.exe
  C:\Windows\System\kbuKIZK.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\AdGyVwK.exe
  C:\Windows\System\AdGyVwK.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\dmHKWif.exe
  C:\Windows\System\dmHKWif.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\koCkSqM.exe
  C:\Windows\System\koCkSqM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SnatBwX.exe
  C:\Windows\System\SnatBwX.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\syxiitT.exe
  C:\Windows\System\syxiitT.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\VoSlxNa.exe
  C:\Windows\System\VoSlxNa.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EUNcDsK.exe
  C:\Windows\System\EUNcDsK.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\NsbflhG.exe
  C:\Windows\System\NsbflhG.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\GuTBOjl.exe
  C:\Windows\System\GuTBOjl.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\iJBzqaJ.exe
  C:\Windows\System\iJBzqaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ycKBVYI.exe
  C:\Windows\System\ycKBVYI.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KHFpLOF.exe
  C:\Windows\System\KHFpLOF.exe
  2⤵
  PID:2004
- C:\Windows\System\EsVykdo.exe
  C:\Windows\System\EsVykdo.exe
  2⤵
  PID:1608
- C:\Windows\System\hxrlZKm.exe
  C:\Windows\System\hxrlZKm.exe
  2⤵
  PID:2188
- C:\Windows\System\ZrAsJDU.exe
  C:\Windows\System\ZrAsJDU.exe
  2⤵
  PID:1140
- C:\Windows\System\tQUzMvR.exe
  C:\Windows\System\tQUzMvR.exe
  2⤵
  PID:1252
- C:\Windows\System\wwfMSxb.exe
  C:\Windows\System\wwfMSxb.exe
  2⤵
  PID:2976
- C:\Windows\System\HgXuwtw.exe
  C:\Windows\System\HgXuwtw.exe
  2⤵
  PID:2928
- C:\Windows\System\jpgKrDr.exe
  C:\Windows\System\jpgKrDr.exe
  2⤵
  PID:2784
- C:\Windows\System\zTEiyfe.exe
  C:\Windows\System\zTEiyfe.exe
  2⤵
  PID:2232
- C:\Windows\System\RDEEvUD.exe
  C:\Windows\System\RDEEvUD.exe
  2⤵
  PID:1404
- C:\Windows\System\GKqlKih.exe
  C:\Windows\System\GKqlKih.exe
  2⤵
  PID:1188
- C:\Windows\System\jmlAPNk.exe
  C:\Windows\System\jmlAPNk.exe
  2⤵
  PID:980
- C:\Windows\System\BtxVpXB.exe
  C:\Windows\System\BtxVpXB.exe
  2⤵
  PID:1836
- C:\Windows\System\cDwWyjX.exe
  C:\Windows\System\cDwWyjX.exe
  2⤵
  PID:2124
- C:\Windows\System\wXLAtSU.exe
  C:\Windows\System\wXLAtSU.exe
  2⤵
  PID:1948
- C:\Windows\System\LviNAXT.exe
  C:\Windows\System\LviNAXT.exe
  2⤵
  PID:1732
- C:\Windows\System\BWiQVuZ.exe
  C:\Windows\System\BWiQVuZ.exe
  2⤵
  PID:748
- C:\Windows\System\aWgxrwN.exe
  C:\Windows\System\aWgxrwN.exe
  2⤵
  PID:2068
- C:\Windows\System\BDATsLb.exe
  C:\Windows\System\BDATsLb.exe
  2⤵
  PID:840
- C:\Windows\System\yciyMPE.exe
  C:\Windows\System\yciyMPE.exe
  2⤵
  PID:1544
- C:\Windows\System\EoqGYpE.exe
  C:\Windows\System\EoqGYpE.exe
  2⤵
  PID:1916
- C:\Windows\System\bbzkBpn.exe
  C:\Windows\System\bbzkBpn.exe
  2⤵
  PID:1644
- C:\Windows\System\TbhMJhT.exe
  C:\Windows\System\TbhMJhT.exe
  2⤵
  PID:3008
- C:\Windows\System\syckMev.exe
  C:\Windows\System\syckMev.exe
  2⤵
  PID:1776
- C:\Windows\System\DYQTStG.exe
  C:\Windows\System\DYQTStG.exe
  2⤵
  PID:984
- C:\Windows\System\pneWTOT.exe
  C:\Windows\System\pneWTOT.exe
  2⤵
  PID:896
- C:\Windows\System\mFZeYfj.exe
  C:\Windows\System\mFZeYfj.exe
  2⤵
  PID:1636
- C:\Windows\System\smeuKqu.exe
  C:\Windows\System\smeuKqu.exe
  2⤵
  PID:2408
- C:\Windows\System\THDfcFb.exe
  C:\Windows\System\THDfcFb.exe
  2⤵
  PID:2520
- C:\Windows\System\LGRhifL.exe
  C:\Windows\System\LGRhifL.exe
  2⤵
  PID:1624
- C:\Windows\System\paQLIFt.exe
  C:\Windows\System\paQLIFt.exe
  2⤵
  PID:3012
- C:\Windows\System\kVHlmoE.exe
  C:\Windows\System\kVHlmoE.exe
  2⤵
  PID:2772
- C:\Windows\System\qAbISjH.exe
  C:\Windows\System\qAbISjH.exe
  2⤵
  PID:2600
- C:\Windows\System\lkZkflK.exe
  C:\Windows\System\lkZkflK.exe
  2⤵
  PID:2524
- C:\Windows\System\HEasORR.exe
  C:\Windows\System\HEasORR.exe
  2⤵
  PID:2972
- C:\Windows\System\AUyQdfN.exe
  C:\Windows\System\AUyQdfN.exe
  2⤵
  PID:2260
- C:\Windows\System\JiVKJUR.exe
  C:\Windows\System\JiVKJUR.exe
  2⤵
  PID:1584
- C:\Windows\System\rknZGeb.exe
  C:\Windows\System\rknZGeb.exe
  2⤵
  PID:2660
- C:\Windows\System\KYPDaox.exe
  C:\Windows\System\KYPDaox.exe
  2⤵
  PID:2156
- C:\Windows\System\JISBBEF.exe
  C:\Windows\System\JISBBEF.exe
  2⤵
  PID:1996
- C:\Windows\System\mAXOifH.exe
  C:\Windows\System\mAXOifH.exe
  2⤵
  PID:832
- C:\Windows\System\gjCBUSQ.exe
  C:\Windows\System\gjCBUSQ.exe
  2⤵
  PID:1708
- C:\Windows\System\YtsBnZE.exe
  C:\Windows\System\YtsBnZE.exe
  2⤵
  PID:1092
- C:\Windows\System\DShzPkQ.exe
  C:\Windows\System\DShzPkQ.exe
  2⤵
  PID:1248
- C:\Windows\System\cLzlVOD.exe
  C:\Windows\System\cLzlVOD.exe
  2⤵
  PID:2468
- C:\Windows\System\uwWyLAY.exe
  C:\Windows\System\uwWyLAY.exe
  2⤵
  PID:1268
- C:\Windows\System\IlbNuHM.exe
  C:\Windows\System\IlbNuHM.exe
  2⤵
  PID:2264
- C:\Windows\System\bybqYKW.exe
  C:\Windows\System\bybqYKW.exe
  2⤵
  PID:1020
- C:\Windows\System\ZDIuFzf.exe
  C:\Windows\System\ZDIuFzf.exe
  2⤵
  PID:2284
- C:\Windows\System\IWwZQNo.exe
  C:\Windows\System\IWwZQNo.exe
  2⤵
  PID:2036
- C:\Windows\System\lzQMjLy.exe
  C:\Windows\System\lzQMjLy.exe
  2⤵
  PID:2416
- C:\Windows\System\NWIGyoC.exe
  C:\Windows\System\NWIGyoC.exe
  2⤵
  PID:1720
- C:\Windows\System\RkCVoFC.exe
  C:\Windows\System\RkCVoFC.exe
  2⤵
  PID:1700
- C:\Windows\System\ePsJSWu.exe
  C:\Windows\System\ePsJSWu.exe
  2⤵
  PID:1520
- C:\Windows\System\zmybIvw.exe
  C:\Windows\System\zmybIvw.exe
  2⤵
  PID:2728
- C:\Windows\System\EWFgZfD.exe
  C:\Windows\System\EWFgZfD.exe
  2⤵
  PID:2640
- C:\Windows\System\RJuPnBk.exe
  C:\Windows\System\RJuPnBk.exe
  2⤵
  PID:2256
- C:\Windows\System\vbGtJNV.exe
  C:\Windows\System\vbGtJNV.exe
  2⤵
  PID:1992
- C:\Windows\System\zJVsOTT.exe
  C:\Windows\System\zJVsOTT.exe
  2⤵
  PID:2824
- C:\Windows\System\jupRuNw.exe
  C:\Windows\System\jupRuNw.exe
  2⤵
  PID:1988
- C:\Windows\System\HJxNTNc.exe
  C:\Windows\System\HJxNTNc.exe
  2⤵
  PID:2896
- C:\Windows\System\JSYElDg.exe
  C:\Windows\System\JSYElDg.exe
  2⤵
  PID:3040
- C:\Windows\System\qAwEqWh.exe
  C:\Windows\System\qAwEqWh.exe
  2⤵
  PID:2872
- C:\Windows\System\AWvtglx.exe
  C:\Windows\System\AWvtglx.exe
  2⤵
  PID:2484
- C:\Windows\System\veuWYpa.exe
  C:\Windows\System\veuWYpa.exe
  2⤵
  PID:2168
- C:\Windows\System\uupqkzt.exe
  C:\Windows\System\uupqkzt.exe
  2⤵
  PID:1556
- C:\Windows\System\TxKXkRm.exe
  C:\Windows\System\TxKXkRm.exe
  2⤵
  PID:2688
- C:\Windows\System\HtlDYoW.exe
  C:\Windows\System\HtlDYoW.exe
  2⤵
  PID:1196
- C:\Windows\System\bxGFXPe.exe
  C:\Windows\System\bxGFXPe.exe
  2⤵
  PID:2252
- C:\Windows\System\PlxuJwT.exe
  C:\Windows\System\PlxuJwT.exe
  2⤵
  PID:1788
- C:\Windows\System\WpfjmMU.exe
  C:\Windows\System\WpfjmMU.exe
  2⤵
  PID:2828
- C:\Windows\System\JfCCfhz.exe
  C:\Windows\System\JfCCfhz.exe
  2⤵
  PID:2736
- C:\Windows\System\nGVQXqI.exe
  C:\Windows\System\nGVQXqI.exe
  2⤵
  PID:2900
- C:\Windows\System\jxwIRXP.exe
  C:\Windows\System\jxwIRXP.exe
  2⤵
  PID:1336
- C:\Windows\System\YgZgZmo.exe
  C:\Windows\System\YgZgZmo.exe
  2⤵
  PID:2956
- C:\Windows\System\DFeCdfW.exe
  C:\Windows\System\DFeCdfW.exe
  2⤵
  PID:2924
- C:\Windows\System\GexTsXA.exe
  C:\Windows\System\GexTsXA.exe
  2⤵
  PID:3004
- C:\Windows\System\dLaVQNB.exe
  C:\Windows\System\dLaVQNB.exe
  2⤵
  PID:2876
- C:\Windows\System\HqbYAXr.exe
  C:\Windows\System\HqbYAXr.exe
  2⤵
  PID:2652
- C:\Windows\System\XYNYHTk.exe
  C:\Windows\System\XYNYHTk.exe
  2⤵
  PID:2604
- C:\Windows\System\ojpSXnn.exe
  C:\Windows\System\ojpSXnn.exe
  2⤵
  PID:2500
- C:\Windows\System\sehLymh.exe
  C:\Windows\System\sehLymh.exe
  2⤵
  PID:2172
- C:\Windows\System\qIytDjh.exe
  C:\Windows\System\qIytDjh.exe
  2⤵
  PID:1844
- C:\Windows\System\rzHcScx.exe
  C:\Windows\System\rzHcScx.exe
  2⤵
  PID:2236
- C:\Windows\System\afXxSDQ.exe
  C:\Windows\System\afXxSDQ.exe
  2⤵
  PID:2792
- C:\Windows\System\EDQARmH.exe
  C:\Windows\System\EDQARmH.exe
  2⤵
  PID:1340
- C:\Windows\System\VUBrkXa.exe
  C:\Windows\System\VUBrkXa.exe
  2⤵
  PID:1580
- C:\Windows\System\zmjZsyG.exe
  C:\Windows\System\zmjZsyG.exe
  2⤵
  PID:1728
- C:\Windows\System\zxlvdeB.exe
  C:\Windows\System\zxlvdeB.exe
  2⤵
  PID:2920
- C:\Windows\System\FgBcMJw.exe
  C:\Windows\System\FgBcMJw.exe
  2⤵
  PID:1696
- C:\Windows\System\luyrsHz.exe
  C:\Windows\System\luyrsHz.exe
  2⤵
  PID:1620
- C:\Windows\System\LgneGzC.exe
  C:\Windows\System\LgneGzC.exe
  2⤵
  PID:1232
- C:\Windows\System\wfUGqNB.exe
  C:\Windows\System\wfUGqNB.exe
  2⤵
  PID:2352
- C:\Windows\System\nhyuHYH.exe
  C:\Windows\System\nhyuHYH.exe
  2⤵
  PID:2452
- C:\Windows\System\jjttoQh.exe
  C:\Windows\System\jjttoQh.exe
  2⤵
  PID:1908
- C:\Windows\System\ETmVzXv.exe
  C:\Windows\System\ETmVzXv.exe
  2⤵
  PID:624
- C:\Windows\System\RoiFmUw.exe
  C:\Windows\System\RoiFmUw.exe
  2⤵
  PID:1692
- C:\Windows\System\TBtRDbX.exe
  C:\Windows\System\TBtRDbX.exe
  2⤵
  PID:324
- C:\Windows\System\wMdbofm.exe
  C:\Windows\System\wMdbofm.exe
  2⤵
  PID:2152
- C:\Windows\System\bUZXXGD.exe
  C:\Windows\System\bUZXXGD.exe
  2⤵
  PID:1344
- C:\Windows\System\IAoXySF.exe
  C:\Windows\System\IAoXySF.exe
  2⤵
  PID:296
- C:\Windows\System\QzEEsTK.exe
  C:\Windows\System\QzEEsTK.exe
  2⤵
  PID:2580
- C:\Windows\System\iCgKAcn.exe
  C:\Windows\System\iCgKAcn.exe
  2⤵
  PID:2428
- C:\Windows\System\DBEGpdd.exe
  C:\Windows\System\DBEGpdd.exe
  2⤵
  PID:836
- C:\Windows\System\bKNjxql.exe
  C:\Windows\System\bKNjxql.exe
  2⤵
  PID:3076
- C:\Windows\System\jGgAkuS.exe
  C:\Windows\System\jGgAkuS.exe
  2⤵
  PID:3096
- C:\Windows\System\uoILhvC.exe
  C:\Windows\System\uoILhvC.exe
  2⤵
  PID:3112
- C:\Windows\System\eBrTWmz.exe
  C:\Windows\System\eBrTWmz.exe
  2⤵
  PID:3128
- C:\Windows\System\rfTcNmS.exe
  C:\Windows\System\rfTcNmS.exe
  2⤵
  PID:3144
- C:\Windows\System\qIAgyXU.exe
  C:\Windows\System\qIAgyXU.exe
  2⤵
  PID:3160
- C:\Windows\System\umtlAKb.exe
  C:\Windows\System\umtlAKb.exe
  2⤵
  PID:3176
- C:\Windows\System\kgocREK.exe
  C:\Windows\System\kgocREK.exe
  2⤵
  PID:3192
- C:\Windows\System\fxJduip.exe
  C:\Windows\System\fxJduip.exe
  2⤵
  PID:3208
- C:\Windows\System\WGpIvKl.exe
  C:\Windows\System\WGpIvKl.exe
  2⤵
  PID:3224
- C:\Windows\System\IPJDDLE.exe
  C:\Windows\System\IPJDDLE.exe
  2⤵
  PID:3240
- C:\Windows\System\UCMcfsi.exe
  C:\Windows\System\UCMcfsi.exe
  2⤵
  PID:3256
- C:\Windows\System\jENyPkM.exe
  C:\Windows\System\jENyPkM.exe
  2⤵
  PID:3272
- C:\Windows\System\hdbdlqu.exe
  C:\Windows\System\hdbdlqu.exe
  2⤵
  PID:3288
- C:\Windows\System\hnmgkqs.exe
  C:\Windows\System\hnmgkqs.exe
  2⤵
  PID:3304
- C:\Windows\System\KdETEnH.exe
  C:\Windows\System\KdETEnH.exe
  2⤵
  PID:3320
- C:\Windows\System\waHmuwR.exe
  C:\Windows\System\waHmuwR.exe
  2⤵
  PID:3340
- C:\Windows\System\kWGaYJs.exe
  C:\Windows\System\kWGaYJs.exe
  2⤵
  PID:3356
- C:\Windows\System\HzDZQpm.exe
  C:\Windows\System\HzDZQpm.exe
  2⤵
  PID:3372
- C:\Windows\System\dIjwbbR.exe
  C:\Windows\System\dIjwbbR.exe
  2⤵
  PID:3388
- C:\Windows\System\DcNiyoC.exe
  C:\Windows\System\DcNiyoC.exe
  2⤵
  PID:3408
- C:\Windows\System\hFeryxZ.exe
  C:\Windows\System\hFeryxZ.exe
  2⤵
  PID:3424
- C:\Windows\System\tOEyVoJ.exe
  C:\Windows\System\tOEyVoJ.exe
  2⤵
  PID:3440
- C:\Windows\System\ddQwXWC.exe
  C:\Windows\System\ddQwXWC.exe
  2⤵
  PID:3460
- C:\Windows\System\lQrswhq.exe
  C:\Windows\System\lQrswhq.exe
  2⤵
  PID:3476
- C:\Windows\System\nuNFoBn.exe
  C:\Windows\System\nuNFoBn.exe
  2⤵
  PID:3492
- C:\Windows\System\jPnYTbQ.exe
  C:\Windows\System\jPnYTbQ.exe
  2⤵
  PID:3512
- C:\Windows\System\cPzbRqD.exe
  C:\Windows\System\cPzbRqD.exe
  2⤵
  PID:3528
- C:\Windows\System\bnalzKo.exe
  C:\Windows\System\bnalzKo.exe
  2⤵
  PID:3552
- C:\Windows\System\CPICDwx.exe
  C:\Windows\System\CPICDwx.exe
  2⤵
  PID:3572
- C:\Windows\System\ZylIFUg.exe
  C:\Windows\System\ZylIFUg.exe
  2⤵
  PID:3604
- C:\Windows\System\OeHQndA.exe
  C:\Windows\System\OeHQndA.exe
  2⤵
  PID:3624
- C:\Windows\System\okAHLiY.exe
  C:\Windows\System\okAHLiY.exe
  2⤵
  PID:3640
- C:\Windows\System\shUKmJR.exe
  C:\Windows\System\shUKmJR.exe
  2⤵
  PID:3656
- C:\Windows\System\PgumVOF.exe
  C:\Windows\System\PgumVOF.exe
  2⤵
  PID:3672
- C:\Windows\System\GUpsWmT.exe
  C:\Windows\System\GUpsWmT.exe
  2⤵
  PID:3688
- C:\Windows\System\wFdDYLD.exe
  C:\Windows\System\wFdDYLD.exe
  2⤵
  PID:3720
- C:\Windows\System\RnxohUP.exe
  C:\Windows\System\RnxohUP.exe
  2⤵
  PID:3740
- C:\Windows\System\XoHVSBl.exe
  C:\Windows\System\XoHVSBl.exe
  2⤵
  PID:3756
- C:\Windows\System\xXUhuMu.exe
  C:\Windows\System\xXUhuMu.exe
  2⤵
  PID:3772
- C:\Windows\System\kjVxLVw.exe
  C:\Windows\System\kjVxLVw.exe
  2⤵
  PID:3788
- C:\Windows\System\GNardCO.exe
  C:\Windows\System\GNardCO.exe
  2⤵
  PID:3804
- C:\Windows\System\sSHhvmA.exe
  C:\Windows\System\sSHhvmA.exe
  2⤵
  PID:3820
- C:\Windows\System\ZcRbVrV.exe
  C:\Windows\System\ZcRbVrV.exe
  2⤵
  PID:3836
- C:\Windows\System\hzjNoFo.exe
  C:\Windows\System\hzjNoFo.exe
  2⤵
  PID:3852
- C:\Windows\System\FGqRDZa.exe
  C:\Windows\System\FGqRDZa.exe
  2⤵
  PID:3868
- C:\Windows\System\TTiTNfs.exe
  C:\Windows\System\TTiTNfs.exe
  2⤵
  PID:3884
- C:\Windows\System\xgcVTVm.exe
  C:\Windows\System\xgcVTVm.exe
  2⤵
  PID:3900
- C:\Windows\System\CKyIKCz.exe
  C:\Windows\System\CKyIKCz.exe
  2⤵
  PID:3916
- C:\Windows\System\rcWdlHB.exe
  C:\Windows\System\rcWdlHB.exe
  2⤵
  PID:3932
- C:\Windows\System\eBJUvbg.exe
  C:\Windows\System\eBJUvbg.exe
  2⤵
  PID:3948
- C:\Windows\System\BCRSYGV.exe
  C:\Windows\System\BCRSYGV.exe
  2⤵
  PID:3964
- C:\Windows\System\vAEoRcs.exe
  C:\Windows\System\vAEoRcs.exe
  2⤵
  PID:3980
- C:\Windows\System\WEBghjz.exe
  C:\Windows\System\WEBghjz.exe
  2⤵
  PID:3996
- C:\Windows\System\lvMDupo.exe
  C:\Windows\System\lvMDupo.exe
  2⤵
  PID:4012
- C:\Windows\System\hwdzUSH.exe
  C:\Windows\System\hwdzUSH.exe
  2⤵
  PID:4028
- C:\Windows\System\ZEerNXU.exe
  C:\Windows\System\ZEerNXU.exe
  2⤵
  PID:4044
- C:\Windows\System\OcUhvdm.exe
  C:\Windows\System\OcUhvdm.exe
  2⤵
  PID:4060
- C:\Windows\System\nFKdrRo.exe
  C:\Windows\System\nFKdrRo.exe
  2⤵
  PID:4076
- C:\Windows\System\ivuTHXI.exe
  C:\Windows\System\ivuTHXI.exe
  2⤵
  PID:4092
- C:\Windows\System\xjTnobZ.exe
  C:\Windows\System\xjTnobZ.exe
  2⤵
  PID:864
- C:\Windows\System\lTuzBSE.exe
  C:\Windows\System\lTuzBSE.exe
  2⤵
  PID:3016
- C:\Windows\System\lWeGBxQ.exe
  C:\Windows\System\lWeGBxQ.exe
  2⤵
  PID:3108
- C:\Windows\System\PTkGBqb.exe
  C:\Windows\System\PTkGBqb.exe
  2⤵
  PID:3172
- C:\Windows\System\rwUIBfT.exe
  C:\Windows\System\rwUIBfT.exe
  2⤵
  PID:3236
- C:\Windows\System\lTlhzmi.exe
  C:\Windows\System\lTlhzmi.exe
  2⤵
  PID:3300
- C:\Windows\System\LULAChl.exe
  C:\Windows\System\LULAChl.exe
  2⤵
  PID:3364
- C:\Windows\System\iYuQEfy.exe
  C:\Windows\System\iYuQEfy.exe
  2⤵
  PID:3404
- C:\Windows\System\JheKoGb.exe
  C:\Windows\System\JheKoGb.exe
  2⤵
  PID:3216
- C:\Windows\System\jsYmsrT.exe
  C:\Windows\System\jsYmsrT.exe
  2⤵
  PID:3184
- C:\Windows\System\AmEjBDk.exe
  C:\Windows\System\AmEjBDk.exe
  2⤵
  PID:3252
- C:\Windows\System\LgRBKTu.exe
  C:\Windows\System\LgRBKTu.exe
  2⤵
  PID:3316
- C:\Windows\System\obYIpAe.exe
  C:\Windows\System\obYIpAe.exe
  2⤵
  PID:3384
- C:\Windows\System\qzJhyrz.exe
  C:\Windows\System\qzJhyrz.exe
  2⤵
  PID:3452
- C:\Windows\System\yAOVPmA.exe
  C:\Windows\System\yAOVPmA.exe
  2⤵
  PID:3152
- C:\Windows\System\oRBzVpu.exe
  C:\Windows\System\oRBzVpu.exe
  2⤵
  PID:3084
- C:\Windows\System\wMfqbMT.exe
  C:\Windows\System\wMfqbMT.exe
  2⤵
  PID:3488
- C:\Windows\System\QOcObkI.exe
  C:\Windows\System\QOcObkI.exe
  2⤵
  PID:3508
- C:\Windows\System\nabqWWo.exe
  C:\Windows\System\nabqWWo.exe
  2⤵
  PID:3536
- C:\Windows\System\SBRoviI.exe
  C:\Windows\System\SBRoviI.exe
  2⤵
  PID:3596
- C:\Windows\System\HHOSpkJ.exe
  C:\Windows\System\HHOSpkJ.exe
  2⤵
  PID:3664
- C:\Windows\System\POlXXRs.exe
  C:\Windows\System\POlXXRs.exe
  2⤵
  PID:3716
- C:\Windows\System\pTcYtfB.exe
  C:\Windows\System\pTcYtfB.exe
  2⤵
  PID:3700
- C:\Windows\System\wSFGezV.exe
  C:\Windows\System\wSFGezV.exe
  2⤵
  PID:3728
- C:\Windows\System\RghlQDm.exe
  C:\Windows\System\RghlQDm.exe
  2⤵
  PID:3620
- C:\Windows\System\woRniNW.exe
  C:\Windows\System\woRniNW.exe
  2⤵
  PID:3732
- C:\Windows\System\BxdkSDT.exe
  C:\Windows\System\BxdkSDT.exe
  2⤵
  PID:3796
- C:\Windows\System\ozMmOON.exe
  C:\Windows\System\ozMmOON.exe
  2⤵
  PID:3844
- C:\Windows\System\qmuKNmO.exe
  C:\Windows\System\qmuKNmO.exe
  2⤵
  PID:3912
- C:\Windows\System\GAIagGm.exe
  C:\Windows\System\GAIagGm.exe
  2⤵
  PID:3896
- C:\Windows\System\qPpfSZn.exe
  C:\Windows\System\qPpfSZn.exe
  2⤵
  PID:3860
- C:\Windows\System\VwenUSE.exe
  C:\Windows\System\VwenUSE.exe
  2⤵
  PID:3960
- C:\Windows\System\VPWwbhn.exe
  C:\Windows\System\VPWwbhn.exe
  2⤵
  PID:4004
- C:\Windows\System\pMZJzqK.exe
  C:\Windows\System\pMZJzqK.exe
  2⤵
  PID:4020
- C:\Windows\System\oDIvTqb.exe
  C:\Windows\System\oDIvTqb.exe
  2⤵
  PID:4068
- C:\Windows\System\tDvVbCm.exe
  C:\Windows\System\tDvVbCm.exe
  2⤵
  PID:2944
- C:\Windows\System\odjzMPw.exe
  C:\Windows\System\odjzMPw.exe
  2⤵
  PID:3332
- C:\Windows\System\nPzXXiH.exe
  C:\Windows\System\nPzXXiH.exe
  2⤵
  PID:2892
- C:\Windows\System\dBbmAlb.exe
  C:\Windows\System\dBbmAlb.exe
  2⤵
  PID:3248
- C:\Windows\System\SHsPtvT.exe
  C:\Windows\System\SHsPtvT.exe
  2⤵
  PID:1280
- C:\Windows\System\lujunDI.exe
  C:\Windows\System\lujunDI.exe
  2⤵
  PID:3396
- C:\Windows\System\mPJAIts.exe
  C:\Windows\System\mPJAIts.exe
  2⤵
  PID:3312
- C:\Windows\System\DTVfplm.exe
  C:\Windows\System\DTVfplm.exe
  2⤵
  PID:956
- C:\Windows\System\VTOqdoR.exe
  C:\Windows\System\VTOqdoR.exe
  2⤵
  PID:3564
- C:\Windows\System\bnyhpVs.exe
  C:\Windows\System\bnyhpVs.exe
  2⤵
  PID:3708
- C:\Windows\System\hlFCwLM.exe
  C:\Windows\System\hlFCwLM.exe
  2⤵
  PID:3764
- C:\Windows\System\NCKoXBg.exe
  C:\Windows\System\NCKoXBg.exe
  2⤵
  PID:3924
- C:\Windows\System\CqQKrLw.exe
  C:\Windows\System\CqQKrLw.exe
  2⤵
  PID:3448
- C:\Windows\System\bMHdtCV.exe
  C:\Windows\System\bMHdtCV.exe
  2⤵
  PID:3204
- C:\Windows\System\uJBCwmM.exe
  C:\Windows\System\uJBCwmM.exe
  2⤵
  PID:3220
- C:\Windows\System\uTAPskp.exe
  C:\Windows\System\uTAPskp.exe
  2⤵
  PID:4084
- C:\Windows\System\YUloepb.exe
  C:\Windows\System\YUloepb.exe
  2⤵
  PID:3092
- C:\Windows\System\pHtStTB.exe
  C:\Windows\System\pHtStTB.exe
  2⤵
  PID:3908
- C:\Windows\System\PcTIekU.exe
  C:\Windows\System\PcTIekU.exe
  2⤵
  PID:3944
- C:\Windows\System\tOIjLau.exe
  C:\Windows\System\tOIjLau.exe
  2⤵
  PID:4112
- C:\Windows\System\csPrYOz.exe
  C:\Windows\System\csPrYOz.exe
  2⤵
  PID:4128
- C:\Windows\System\cHnVUzA.exe
  C:\Windows\System\cHnVUzA.exe
  2⤵
  PID:4144
- C:\Windows\System\ejZWxXF.exe
  C:\Windows\System\ejZWxXF.exe
  2⤵
  PID:4160
- C:\Windows\System\PzYyqnW.exe
  C:\Windows\System\PzYyqnW.exe
  2⤵
  PID:4176
- C:\Windows\System\VaOAFEQ.exe
  C:\Windows\System\VaOAFEQ.exe
  2⤵
  PID:4192
- C:\Windows\System\gYgqNfr.exe
  C:\Windows\System\gYgqNfr.exe
  2⤵
  PID:4208
- C:\Windows\System\Mofonmx.exe
  C:\Windows\System\Mofonmx.exe
  2⤵
  PID:4224
- C:\Windows\System\IDDBajT.exe
  C:\Windows\System\IDDBajT.exe
  2⤵
  PID:4240
- C:\Windows\System\xfEDFeg.exe
  C:\Windows\System\xfEDFeg.exe
  2⤵
  PID:4256
- C:\Windows\System\YssRaQr.exe
  C:\Windows\System\YssRaQr.exe
  2⤵
  PID:4272
- C:\Windows\System\VFNAoHx.exe
  C:\Windows\System\VFNAoHx.exe
  2⤵
  PID:4288
- C:\Windows\System\MTxHvPd.exe
  C:\Windows\System\MTxHvPd.exe
  2⤵
  PID:4304
- C:\Windows\System\tDIYyOu.exe
  C:\Windows\System\tDIYyOu.exe
  2⤵
  PID:4320
- C:\Windows\System\rpxGEuI.exe
  C:\Windows\System\rpxGEuI.exe
  2⤵
  PID:4336
- C:\Windows\System\RBiBCiL.exe
  C:\Windows\System\RBiBCiL.exe
  2⤵
  PID:4352
- C:\Windows\System\mbpocbl.exe
  C:\Windows\System\mbpocbl.exe
  2⤵
  PID:4368
- C:\Windows\System\quytAFn.exe
  C:\Windows\System\quytAFn.exe
  2⤵
  PID:4384
- C:\Windows\System\sAQaYCs.exe
  C:\Windows\System\sAQaYCs.exe
  2⤵
  PID:4400
- C:\Windows\System\jcpEUZJ.exe
  C:\Windows\System\jcpEUZJ.exe
  2⤵
  PID:4416
- C:\Windows\System\aSwxLyt.exe
  C:\Windows\System\aSwxLyt.exe
  2⤵
  PID:4432
- C:\Windows\System\IRwYYJc.exe
  C:\Windows\System\IRwYYJc.exe
  2⤵
  PID:4448
- C:\Windows\System\ydrMrDB.exe
  C:\Windows\System\ydrMrDB.exe
  2⤵
  PID:4464
- C:\Windows\System\dKcNNfO.exe
  C:\Windows\System\dKcNNfO.exe
  2⤵
  PID:4480
- C:\Windows\System\CExNjQI.exe
  C:\Windows\System\CExNjQI.exe
  2⤵
  PID:4496
- C:\Windows\System\zpnvuMx.exe
  C:\Windows\System\zpnvuMx.exe
  2⤵
  PID:4512
- C:\Windows\System\ejoVbaP.exe
  C:\Windows\System\ejoVbaP.exe
  2⤵
  PID:4528
- C:\Windows\System\budMyTS.exe
  C:\Windows\System\budMyTS.exe
  2⤵
  PID:4544
- C:\Windows\System\iqSBecC.exe
  C:\Windows\System\iqSBecC.exe
  2⤵
  PID:4560
- C:\Windows\System\NkRxvZO.exe
  C:\Windows\System\NkRxvZO.exe
  2⤵
  PID:4576
- C:\Windows\System\DrVOZWX.exe
  C:\Windows\System\DrVOZWX.exe
  2⤵
  PID:4592
- C:\Windows\System\FYwRDwZ.exe
  C:\Windows\System\FYwRDwZ.exe
  2⤵
  PID:4608
- C:\Windows\System\ecozroO.exe
  C:\Windows\System\ecozroO.exe
  2⤵
  PID:4624
- C:\Windows\System\KIYOfwR.exe
  C:\Windows\System\KIYOfwR.exe
  2⤵
  PID:4640
- C:\Windows\System\xiQbfGH.exe
  C:\Windows\System\xiQbfGH.exe
  2⤵
  PID:4656
- C:\Windows\System\wahUHmq.exe
  C:\Windows\System\wahUHmq.exe
  2⤵
  PID:4672
- C:\Windows\System\OvoHiQJ.exe
  C:\Windows\System\OvoHiQJ.exe
  2⤵
  PID:4688
- C:\Windows\System\hxDSKeF.exe
  C:\Windows\System\hxDSKeF.exe
  2⤵
  PID:4704
- C:\Windows\System\oHKFxmg.exe
  C:\Windows\System\oHKFxmg.exe
  2⤵
  PID:4720
- C:\Windows\System\KXVOkcG.exe
  C:\Windows\System\KXVOkcG.exe
  2⤵
  PID:4736
- C:\Windows\System\WtttxHu.exe
  C:\Windows\System\WtttxHu.exe
  2⤵
  PID:4752
- C:\Windows\System\nmGvKXH.exe
  C:\Windows\System\nmGvKXH.exe
  2⤵
  PID:4768
- C:\Windows\System\NBNaCcs.exe
  C:\Windows\System\NBNaCcs.exe
  2⤵
  PID:4784
- C:\Windows\System\TcHKZqH.exe
  C:\Windows\System\TcHKZqH.exe
  2⤵
  PID:4800
- C:\Windows\System\szXaipJ.exe
  C:\Windows\System\szXaipJ.exe
  2⤵
  PID:4816
- C:\Windows\System\KOXdISZ.exe
  C:\Windows\System\KOXdISZ.exe
  2⤵
  PID:4832
- C:\Windows\System\kDYPYfW.exe
  C:\Windows\System\kDYPYfW.exe
  2⤵
  PID:4848
- C:\Windows\System\TyZyEEn.exe
  C:\Windows\System\TyZyEEn.exe
  2⤵
  PID:4864
- C:\Windows\System\BoXJARR.exe
  C:\Windows\System\BoXJARR.exe
  2⤵
  PID:4880
- C:\Windows\System\aFBzGCy.exe
  C:\Windows\System\aFBzGCy.exe
  2⤵
  PID:4896
- C:\Windows\System\UcJITnH.exe
  C:\Windows\System\UcJITnH.exe
  2⤵
  PID:4912
- C:\Windows\System\zyzJZjv.exe
  C:\Windows\System\zyzJZjv.exe
  2⤵
  PID:4928
- C:\Windows\System\gRTpjGC.exe
  C:\Windows\System\gRTpjGC.exe
  2⤵
  PID:4944
- C:\Windows\System\EOTIZEZ.exe
  C:\Windows\System\EOTIZEZ.exe
  2⤵
  PID:4960
- C:\Windows\System\rqAdtTk.exe
  C:\Windows\System\rqAdtTk.exe
  2⤵
  PID:4976
- C:\Windows\System\yawLvPg.exe
  C:\Windows\System\yawLvPg.exe
  2⤵
  PID:4992
- C:\Windows\System\MkNBLvR.exe
  C:\Windows\System\MkNBLvR.exe
  2⤵
  PID:5008
- C:\Windows\System\XzRSzgb.exe
  C:\Windows\System\XzRSzgb.exe
  2⤵
  PID:5024
- C:\Windows\System\jQCzLac.exe
  C:\Windows\System\jQCzLac.exe
  2⤵
  PID:5040
- C:\Windows\System\PPhXism.exe
  C:\Windows\System\PPhXism.exe
  2⤵
  PID:5056
- C:\Windows\System\MurAZjI.exe
  C:\Windows\System\MurAZjI.exe
  2⤵
  PID:5072
- C:\Windows\System\hNxWGwu.exe
  C:\Windows\System\hNxWGwu.exe
  2⤵
  PID:5088
- C:\Windows\System\ATRBPqZ.exe
  C:\Windows\System\ATRBPqZ.exe
  2⤵
  PID:5104
- C:\Windows\System\FDfuUCw.exe
  C:\Windows\System\FDfuUCw.exe
  2⤵
  PID:3296
- C:\Windows\System\vIxMCRR.exe
  C:\Windows\System\vIxMCRR.exe
  2⤵
  PID:4108
- C:\Windows\System\TFztjcw.exe
  C:\Windows\System\TFztjcw.exe
  2⤵
  PID:4172
- C:\Windows\System\DgyUitu.exe
  C:\Windows\System\DgyUitu.exe
  2⤵
  PID:4232
- C:\Windows\System\exChkNC.exe
  C:\Windows\System\exChkNC.exe
  2⤵
  PID:4296
- C:\Windows\System\dzNVcTX.exe
  C:\Windows\System\dzNVcTX.exe
  2⤵
  PID:4360
- C:\Windows\System\DNTvXJX.exe
  C:\Windows\System\DNTvXJX.exe
  2⤵
  PID:3592
- C:\Windows\System\wPKZQtp.exe
  C:\Windows\System\wPKZQtp.exe
  2⤵
  PID:4040
- C:\Windows\System\QawJXnu.exe
  C:\Windows\System\QawJXnu.exe
  2⤵
  PID:3812
- C:\Windows\System\IvnsZkA.exe
  C:\Windows\System\IvnsZkA.exe
  2⤵
  PID:4424
- C:\Windows\System\ZFSAGGj.exe
  C:\Windows\System\ZFSAGGj.exe
  2⤵
  PID:4248
- C:\Windows\System\NHlSgdm.exe
  C:\Windows\System\NHlSgdm.exe
  2⤵
  PID:1512
- C:\Windows\System\vUloBCd.exe
  C:\Windows\System\vUloBCd.exe
  2⤵
  PID:3380
- C:\Windows\System\wTiQAgt.exe
  C:\Windows\System\wTiQAgt.exe
  2⤵
  PID:3472
- C:\Windows\System\pMblieh.exe
  C:\Windows\System\pMblieh.exe
  2⤵
  PID:4376
- C:\Windows\System\IaaNRGJ.exe
  C:\Windows\System\IaaNRGJ.exe
  2⤵
  PID:4520
- C:\Windows\System\PRFEKBd.exe
  C:\Windows\System\PRFEKBd.exe
  2⤵
  PID:3752
- C:\Windows\System\XCLKiIv.exe
  C:\Windows\System\XCLKiIv.exe
  2⤵
  PID:4124
- C:\Windows\System\iwbXWEo.exe
  C:\Windows\System\iwbXWEo.exe
  2⤵
  PID:4188
- C:\Windows\System\eeVlYNf.exe
  C:\Windows\System\eeVlYNf.exe
  2⤵
  PID:4280
- C:\Windows\System\EXzLGsC.exe
  C:\Windows\System\EXzLGsC.exe
  2⤵
  PID:4344
- C:\Windows\System\YuizEmN.exe
  C:\Windows\System\YuizEmN.exe
  2⤵
  PID:4440
- C:\Windows\System\EMOGRiu.exe
  C:\Windows\System\EMOGRiu.exe
  2⤵
  PID:4584
- C:\Windows\System\HmQMSHw.exe
  C:\Windows\System\HmQMSHw.exe
  2⤵
  PID:4648
- C:\Windows\System\hSuARLO.exe
  C:\Windows\System\hSuARLO.exe
  2⤵
  PID:4568
- C:\Windows\System\EQsQzaK.exe
  C:\Windows\System\EQsQzaK.exe
  2⤵
  PID:4748
- C:\Windows\System\XvaLFYn.exe
  C:\Windows\System\XvaLFYn.exe
  2⤵
  PID:4812
- C:\Windows\System\LXcXvxg.exe
  C:\Windows\System\LXcXvxg.exe
  2⤵
  PID:4876
- C:\Windows\System\eLnNMYL.exe
  C:\Windows\System\eLnNMYL.exe
  2⤵
  PID:4940
- C:\Windows\System\AMuEhok.exe
  C:\Windows\System\AMuEhok.exe
  2⤵
  PID:4504
- C:\Windows\System\JsJHScV.exe
  C:\Windows\System\JsJHScV.exe
  2⤵
  PID:4572
- C:\Windows\System\ifGPzOB.exe
  C:\Windows\System\ifGPzOB.exe
  2⤵
  PID:4636
- C:\Windows\System\MzNnajk.exe
  C:\Windows\System\MzNnajk.exe
  2⤵
  PID:4700
- C:\Windows\System\IbnsZVz.exe
  C:\Windows\System\IbnsZVz.exe
  2⤵
  PID:4764
- C:\Windows\System\VZlqXfD.exe
  C:\Windows\System\VZlqXfD.exe
  2⤵
  PID:4828
- C:\Windows\System\DxyoaMt.exe
  C:\Windows\System\DxyoaMt.exe
  2⤵
  PID:4892
- C:\Windows\System\AgetjRh.exe
  C:\Windows\System\AgetjRh.exe
  2⤵
  PID:4956
- C:\Windows\System\SETLjvx.exe
  C:\Windows\System\SETLjvx.exe
  2⤵
  PID:5032
- C:\Windows\System\kGapdaS.exe
  C:\Windows\System\kGapdaS.exe
  2⤵
  PID:5096
- C:\Windows\System\ZkbJbzy.exe
  C:\Windows\System\ZkbJbzy.exe
  2⤵
  PID:4104
- C:\Windows\System\FwaYgks.exe
  C:\Windows\System\FwaYgks.exe
  2⤵
  PID:3612
- C:\Windows\System\VAYxEAs.exe
  C:\Windows\System\VAYxEAs.exe
  2⤵
  PID:4460
- C:\Windows\System\wWEZJmW.exe
  C:\Windows\System\wWEZJmW.exe
  2⤵
  PID:4984
- C:\Windows\System\QdrmPTN.exe
  C:\Windows\System\QdrmPTN.exe
  2⤵
  PID:4120
- C:\Windows\System\DcZXZXP.exe
  C:\Windows\System\DcZXZXP.exe
  2⤵
  PID:4252
- C:\Windows\System\vDwxESP.exe
  C:\Windows\System\vDwxESP.exe
  2⤵
  PID:4380
- C:\Windows\System\tWdvcmi.exe
  C:\Windows\System\tWdvcmi.exe
  2⤵
  PID:5048
- C:\Windows\System\BUusOYM.exe
  C:\Windows\System\BUusOYM.exe
  2⤵
  PID:5112
- C:\Windows\System\eTaseJv.exe
  C:\Windows\System\eTaseJv.exe
  2⤵
  PID:4268
- C:\Windows\System\LVuHMMF.exe
  C:\Windows\System\LVuHMMF.exe
  2⤵
  PID:4744
- C:\Windows\System\VnDTJPV.exe
  C:\Windows\System\VnDTJPV.exe
  2⤵
  PID:3928
- C:\Windows\System\AQiAnaC.exe
  C:\Windows\System\AQiAnaC.exe
  2⤵
  PID:1780
- C:\Windows\System\jVeHQIu.exe
  C:\Windows\System\jVeHQIu.exe
  2⤵
  PID:4632
- C:\Windows\System\gaXYHlG.exe
  C:\Windows\System\gaXYHlG.exe
  2⤵
  PID:4732
- C:\Windows\System\QVfSorn.exe
  C:\Windows\System\QVfSorn.exe
  2⤵
  PID:5000
- C:\Windows\System\DpjCMOy.exe
  C:\Windows\System\DpjCMOy.exe
  2⤵
  PID:4052
- C:\Windows\System\xZSPWOM.exe
  C:\Windows\System\xZSPWOM.exe
  2⤵
  PID:4492
- C:\Windows\System\RUwBDtn.exe
  C:\Windows\System\RUwBDtn.exe
  2⤵
  PID:4456
- C:\Windows\System\tLHChgI.exe
  C:\Windows\System\tLHChgI.exe
  2⤵
  PID:3784
- C:\Windows\System\gdcEZeD.exe
  C:\Windows\System\gdcEZeD.exe
  2⤵
  PID:4156
- C:\Windows\System\MpGqXDW.exe
  C:\Windows\System\MpGqXDW.exe
  2⤵
  PID:4316
- C:\Windows\System\jpbqEzI.exe
  C:\Windows\System\jpbqEzI.exe
  2⤵
  PID:4924
- C:\Windows\System\NYFdVee.exe
  C:\Windows\System\NYFdVee.exe
  2⤵
  PID:4780
- C:\Windows\System\EXHAeep.exe
  C:\Windows\System\EXHAeep.exe
  2⤵
  PID:4540
- C:\Windows\System\qHGPRSx.exe
  C:\Windows\System\qHGPRSx.exe
  2⤵
  PID:4888
- C:\Windows\System\GAixuoJ.exe
  C:\Windows\System\GAixuoJ.exe
  2⤵
  PID:4332
- C:\Windows\System\OmUzrgw.exe
  C:\Windows\System\OmUzrgw.exe
  2⤵
  PID:4616
- C:\Windows\System\FaPitrY.exe
  C:\Windows\System\FaPitrY.exe
  2⤵
  PID:4872
- C:\Windows\System\arYdcBz.exe
  C:\Windows\System\arYdcBz.exe
  2⤵
  PID:5016
- C:\Windows\System\cTXNBcn.exe
  C:\Windows\System\cTXNBcn.exe
  2⤵
  PID:3500
- C:\Windows\System\PXDdULe.exe
  C:\Windows\System\PXDdULe.exe
  2⤵
  PID:4684
- C:\Windows\System\oCpxhhO.exe
  C:\Windows\System\oCpxhhO.exe
  2⤵
  PID:4908
- C:\Windows\System\KqdkTbU.exe
  C:\Windows\System\KqdkTbU.exe
  2⤵
  PID:3284
- C:\Windows\System\dBGawlh.exe
  C:\Windows\System\dBGawlh.exe
  2⤵
  PID:4312
- C:\Windows\System\hcSqIbF.exe
  C:\Windows\System\hcSqIbF.exe
  2⤵
  PID:5080
- C:\Windows\System\xHYqCNC.exe
  C:\Windows\System\xHYqCNC.exe
  2⤵
  PID:4140
- C:\Windows\System\QKzicSs.exe
  C:\Windows\System\QKzicSs.exe
  2⤵
  PID:5132
- C:\Windows\System\TOvafSw.exe
  C:\Windows\System\TOvafSw.exe
  2⤵
  PID:5148
- C:\Windows\System\ncVxLxO.exe
  C:\Windows\System\ncVxLxO.exe
  2⤵
  PID:5164
- C:\Windows\System\YzAMEAI.exe
  C:\Windows\System\YzAMEAI.exe
  2⤵
  PID:5180
- C:\Windows\System\jvIBFPZ.exe
  C:\Windows\System\jvIBFPZ.exe
  2⤵
  PID:5196
- C:\Windows\System\qIzTsEp.exe
  C:\Windows\System\qIzTsEp.exe
  2⤵
  PID:5212
- C:\Windows\System\VWOJqRM.exe
  C:\Windows\System\VWOJqRM.exe
  2⤵
  PID:5228
- C:\Windows\System\igWPUAD.exe
  C:\Windows\System\igWPUAD.exe
  2⤵
  PID:5244
- C:\Windows\System\thiXSxj.exe
  C:\Windows\System\thiXSxj.exe
  2⤵
  PID:5260
- C:\Windows\System\rJgbzoU.exe
  C:\Windows\System\rJgbzoU.exe
  2⤵
  PID:5276
- C:\Windows\System\ChAzuni.exe
  C:\Windows\System\ChAzuni.exe
  2⤵
  PID:5292
- C:\Windows\System\VvmpTFu.exe
  C:\Windows\System\VvmpTFu.exe
  2⤵
  PID:5308
- C:\Windows\System\vsXBQyn.exe
  C:\Windows\System\vsXBQyn.exe
  2⤵
  PID:5324
- C:\Windows\System\YKNFHUh.exe
  C:\Windows\System\YKNFHUh.exe
  2⤵
  PID:5340
- C:\Windows\System\eyuQSaU.exe
  C:\Windows\System\eyuQSaU.exe
  2⤵
  PID:5356
- C:\Windows\System\iFozXrm.exe
  C:\Windows\System\iFozXrm.exe
  2⤵
  PID:5372
- C:\Windows\System\ZrPAfyH.exe
  C:\Windows\System\ZrPAfyH.exe
  2⤵
  PID:5388
- C:\Windows\System\DXngVlQ.exe
  C:\Windows\System\DXngVlQ.exe
  2⤵
  PID:5404
- C:\Windows\System\kxsUuOd.exe
  C:\Windows\System\kxsUuOd.exe
  2⤵
  PID:5420
- C:\Windows\System\CyMYwnH.exe
  C:\Windows\System\CyMYwnH.exe
  2⤵
  PID:5440
- C:\Windows\System\uwinyCX.exe
  C:\Windows\System\uwinyCX.exe
  2⤵
  PID:5456
- C:\Windows\System\FwmvnCi.exe
  C:\Windows\System\FwmvnCi.exe
  2⤵
  PID:5472
- C:\Windows\System\shKqYoJ.exe
  C:\Windows\System\shKqYoJ.exe
  2⤵
  PID:5488
- C:\Windows\System\UjrHBiQ.exe
  C:\Windows\System\UjrHBiQ.exe
  2⤵
  PID:5504
- C:\Windows\System\YWlfsZw.exe
  C:\Windows\System\YWlfsZw.exe
  2⤵
  PID:5520
- C:\Windows\System\CGUfaLd.exe
  C:\Windows\System\CGUfaLd.exe
  2⤵
  PID:5536
- C:\Windows\System\pkPuYNc.exe
  C:\Windows\System\pkPuYNc.exe
  2⤵
  PID:5552
- C:\Windows\System\bRtpHtm.exe
  C:\Windows\System\bRtpHtm.exe
  2⤵
  PID:5568
- C:\Windows\System\iSHJBli.exe
  C:\Windows\System\iSHJBli.exe
  2⤵
  PID:5584
- C:\Windows\System\JgjczkC.exe
  C:\Windows\System\JgjczkC.exe
  2⤵
  PID:5600
- C:\Windows\System\ynubnSE.exe
  C:\Windows\System\ynubnSE.exe
  2⤵
  PID:5616
- C:\Windows\System\YGEBnhY.exe
  C:\Windows\System\YGEBnhY.exe
  2⤵
  PID:5632
- C:\Windows\System\eMthHqe.exe
  C:\Windows\System\eMthHqe.exe
  2⤵
  PID:5648
- C:\Windows\System\fuKNMpb.exe
  C:\Windows\System\fuKNMpb.exe
  2⤵
  PID:5664
- C:\Windows\System\qMLQhFL.exe
  C:\Windows\System\qMLQhFL.exe
  2⤵
  PID:5680
- C:\Windows\System\qYplOSx.exe
  C:\Windows\System\qYplOSx.exe
  2⤵
  PID:5696
- C:\Windows\System\rVXlYFF.exe
  C:\Windows\System\rVXlYFF.exe
  2⤵
  PID:5712
- C:\Windows\System\zjAzASC.exe
  C:\Windows\System\zjAzASC.exe
  2⤵
  PID:5728
- C:\Windows\System\JpRbaRC.exe
  C:\Windows\System\JpRbaRC.exe
  2⤵
  PID:5744
- C:\Windows\System\jepbvUO.exe
  C:\Windows\System\jepbvUO.exe
  2⤵
  PID:5760
- C:\Windows\System\kYixRVQ.exe
  C:\Windows\System\kYixRVQ.exe
  2⤵
  PID:5776
- C:\Windows\System\oTILFGk.exe
  C:\Windows\System\oTILFGk.exe
  2⤵
  PID:5792
- C:\Windows\System\DXySYuF.exe
  C:\Windows\System\DXySYuF.exe
  2⤵
  PID:5808
- C:\Windows\System\XscHEjk.exe
  C:\Windows\System\XscHEjk.exe
  2⤵
  PID:5824
- C:\Windows\System\vufaWyi.exe
  C:\Windows\System\vufaWyi.exe
  2⤵
  PID:5840
- C:\Windows\System\cFlcHHb.exe
  C:\Windows\System\cFlcHHb.exe
  2⤵
  PID:5856
- C:\Windows\System\nTpsZBl.exe
  C:\Windows\System\nTpsZBl.exe
  2⤵
  PID:5872
- C:\Windows\System\wTdfciI.exe
  C:\Windows\System\wTdfciI.exe
  2⤵
  PID:5888
- C:\Windows\System\ZPwVxhq.exe
  C:\Windows\System\ZPwVxhq.exe
  2⤵
  PID:5904
- C:\Windows\System\NHgoWNK.exe
  C:\Windows\System\NHgoWNK.exe
  2⤵
  PID:5920
- C:\Windows\System\LAPcxdr.exe
  C:\Windows\System\LAPcxdr.exe
  2⤵
  PID:5936
- C:\Windows\System\QelXQkH.exe
  C:\Windows\System\QelXQkH.exe
  2⤵
  PID:5952
- C:\Windows\System\YtgmnzX.exe
  C:\Windows\System\YtgmnzX.exe
  2⤵
  PID:5968
- C:\Windows\System\gSynyfW.exe
  C:\Windows\System\gSynyfW.exe
  2⤵
  PID:5984
- C:\Windows\System\VejaSCr.exe
  C:\Windows\System\VejaSCr.exe
  2⤵
  PID:6000
- C:\Windows\System\cakLAwk.exe
  C:\Windows\System\cakLAwk.exe
  2⤵
  PID:6016
- C:\Windows\System\akLJfCD.exe
  C:\Windows\System\akLJfCD.exe
  2⤵
  PID:6032
- C:\Windows\System\ymKCzPz.exe
  C:\Windows\System\ymKCzPz.exe
  2⤵
  PID:6048
- C:\Windows\System\pyiaGIX.exe
  C:\Windows\System\pyiaGIX.exe
  2⤵
  PID:6064
- C:\Windows\System\sdmtorq.exe
  C:\Windows\System\sdmtorq.exe
  2⤵
  PID:6080
- C:\Windows\System\uzcTAYj.exe
  C:\Windows\System\uzcTAYj.exe
  2⤵
  PID:6096
- C:\Windows\System\JVMfAaM.exe
  C:\Windows\System\JVMfAaM.exe
  2⤵
  PID:6112
- C:\Windows\System\siLkBbr.exe
  C:\Windows\System\siLkBbr.exe
  2⤵
  PID:6128
- C:\Windows\System\uNXwElT.exe
  C:\Windows\System\uNXwElT.exe
  2⤵
  PID:4860
- C:\Windows\System\tkRIBTj.exe
  C:\Windows\System\tkRIBTj.exe
  2⤵
  PID:4328
- C:\Windows\System\vaWwoBm.exe
  C:\Windows\System\vaWwoBm.exe
  2⤵
  PID:4824
- C:\Windows\System\fkuPMho.exe
  C:\Windows\System\fkuPMho.exe
  2⤵
  PID:5172
- C:\Windows\System\VzwkFfC.exe
  C:\Windows\System\VzwkFfC.exe
  2⤵
  PID:5144
- C:\Windows\System\JiGZBmx.exe
  C:\Windows\System\JiGZBmx.exe
  2⤵
  PID:5272
- C:\Windows\System\LCDaWxJ.exe
  C:\Windows\System\LCDaWxJ.exe
  2⤵
  PID:5336
- C:\Windows\System\NnRxUIb.exe
  C:\Windows\System\NnRxUIb.exe
  2⤵
  PID:5400
- C:\Windows\System\ghJLErY.exe
  C:\Windows\System\ghJLErY.exe
  2⤵
  PID:5252
- C:\Windows\System\uMfYVgu.exe
  C:\Windows\System\uMfYVgu.exe
  2⤵
  PID:5468
- C:\Windows\System\NksisPe.exe
  C:\Windows\System\NksisPe.exe
  2⤵
  PID:5380
- C:\Windows\System\FPhCwkX.exe
  C:\Windows\System\FPhCwkX.exe
  2⤵
  PID:5496
- C:\Windows\System\Pbpzztr.exe
  C:\Windows\System\Pbpzztr.exe
  2⤵
  PID:5448
- C:\Windows\System\AIARDNl.exe
  C:\Windows\System\AIARDNl.exe
  2⤵
  PID:5596
- C:\Windows\System\qWeZrSV.exe
  C:\Windows\System\qWeZrSV.exe
  2⤵
  PID:5660
- C:\Windows\System\aEIteOg.exe
  C:\Windows\System\aEIteOg.exe
  2⤵
  PID:5724
- C:\Windows\System\zYeiPpG.exe
  C:\Windows\System\zYeiPpG.exe
  2⤵
  PID:5788
- C:\Windows\System\QCMzRKi.exe
  C:\Windows\System\QCMzRKi.exe
  2⤵
  PID:5284
- C:\Windows\System\WttZzkM.exe
  C:\Windows\System\WttZzkM.exe
  2⤵
  PID:5412
- C:\Windows\System\RNOoixi.exe
  C:\Windows\System\RNOoixi.exe
  2⤵
  PID:5452
- C:\Windows\System\emGKyqz.exe
  C:\Windows\System\emGKyqz.exe
  2⤵
  PID:5704
- C:\Windows\System\pPVBFkI.exe
  C:\Windows\System\pPVBFkI.exe
  2⤵
  PID:5548
- C:\Windows\System\bmndVOO.exe
  C:\Windows\System\bmndVOO.exe
  2⤵
  PID:5672
- C:\Windows\System\DJVkcWS.exe
  C:\Windows\System\DJVkcWS.exe
  2⤵
  PID:5740
- C:\Windows\System\utXVUHo.exe
  C:\Windows\System\utXVUHo.exe
  2⤵
  PID:5804
- C:\Windows\System\onJeUrN.exe
  C:\Windows\System\onJeUrN.exe
  2⤵
  PID:5880
- C:\Windows\System\vPWoYpI.exe
  C:\Windows\System\vPWoYpI.exe
  2⤵
  PID:5868
- C:\Windows\System\YwQesoj.exe
  C:\Windows\System\YwQesoj.exe
  2⤵
  PID:5944
- C:\Windows\System\RyUaJdu.exe
  C:\Windows\System\RyUaJdu.exe
  2⤵
  PID:6040
- C:\Windows\System\BOCJdVe.exe
  C:\Windows\System\BOCJdVe.exe
  2⤵
  PID:6008
- C:\Windows\System\cXUKKRR.exe
  C:\Windows\System\cXUKKRR.exe
  2⤵
  PID:6136
- C:\Windows\System\gveNDsZ.exe
  C:\Windows\System\gveNDsZ.exe
  2⤵
  PID:5896
- C:\Windows\System\bwlGrCD.exe
  C:\Windows\System\bwlGrCD.exe
  2⤵
  PID:5928
- C:\Windows\System\FQebHyQ.exe
  C:\Windows\System\FQebHyQ.exe
  2⤵
  PID:5996
- C:\Windows\System\fxuyWhT.exe
  C:\Windows\System\fxuyWhT.exe
  2⤵
  PID:5204
- C:\Windows\System\hAncKYO.exe
  C:\Windows\System\hAncKYO.exe
  2⤵
  PID:6088
- C:\Windows\System\mYdgAqR.exe
  C:\Windows\System\mYdgAqR.exe
  2⤵
  PID:4604
- C:\Windows\System\upigNZQ.exe
  C:\Windows\System\upigNZQ.exe
  2⤵
  PID:5240
- C:\Windows\System\ZrZyMcR.exe
  C:\Windows\System\ZrZyMcR.exe
  2⤵
  PID:5348
- C:\Windows\System\KGZBNEH.exe
  C:\Windows\System\KGZBNEH.exe
  2⤵
  PID:5656
- C:\Windows\System\lBEYzfY.exe
  C:\Windows\System\lBEYzfY.exe
  2⤵
  PID:5384
- C:\Windows\System\dGaPtZh.exe
  C:\Windows\System\dGaPtZh.exe
  2⤵
  PID:5612
- C:\Windows\System\lgavJYK.exe
  C:\Windows\System\lgavJYK.exe
  2⤵
  PID:5396
- C:\Windows\System\UWUUTlh.exe
  C:\Windows\System\UWUUTlh.exe
  2⤵
  PID:5864
- C:\Windows\System\PSNxDSM.exe
  C:\Windows\System\PSNxDSM.exe
  2⤵
  PID:6108
- C:\Windows\System\nVrfVBp.exe
  C:\Windows\System\nVrfVBp.exe
  2⤵
  PID:5224
- C:\Windows\System\KDBlUkP.exe
  C:\Windows\System\KDBlUkP.exe
  2⤵
  PID:5720
- C:\Windows\System\pTpVjXB.exe
  C:\Windows\System\pTpVjXB.exe
  2⤵
  PID:5708
- C:\Windows\System\rDNmWWW.exe
  C:\Windows\System\rDNmWWW.exe
  2⤵
  PID:5980
- C:\Windows\System\uFHQGoZ.exe
  C:\Windows\System\uFHQGoZ.exe
  2⤵
  PID:4696
- C:\Windows\System\ApHLKxD.exe
  C:\Windows\System\ApHLKxD.exe
  2⤵
  PID:5912
- C:\Windows\System\yCMRtuw.exe
  C:\Windows\System\yCMRtuw.exe
  2⤵
  PID:6028
- C:\Windows\System\oNUIPsx.exe
  C:\Windows\System\oNUIPsx.exe
  2⤵
  PID:5220
- C:\Windows\System\NkBYpbS.exe
  C:\Windows\System\NkBYpbS.exe
  2⤵
  PID:5268
- C:\Windows\System\QBlxLFF.exe
  C:\Windows\System\QBlxLFF.exe
  2⤵
  PID:5332
- C:\Windows\System\cCaurdK.exe
  C:\Windows\System\cCaurdK.exe
  2⤵
  PID:5608
- C:\Windows\System\CgoWPmF.exe
  C:\Windows\System\CgoWPmF.exe
  2⤵
  PID:5288
- C:\Windows\System\WRrqgpK.exe
  C:\Windows\System\WRrqgpK.exe
  2⤵
  PID:5800
- C:\Windows\System\pcXXQwh.exe
  C:\Windows\System\pcXXQwh.exe
  2⤵
  PID:5992
- C:\Windows\System\GiMZXYx.exe
  C:\Windows\System\GiMZXYx.exe
  2⤵
  PID:5304
- C:\Windows\System\UTkiZeG.exe
  C:\Windows\System\UTkiZeG.exe
  2⤵
  PID:5692
- C:\Windows\System\UGjAgzj.exe
  C:\Windows\System\UGjAgzj.exe
  2⤵
  PID:5512
- C:\Windows\System\veVeXCU.exe
  C:\Windows\System\veVeXCU.exe
  2⤵
  PID:4168
- C:\Windows\System\kYGvUQn.exe
  C:\Windows\System\kYGvUQn.exe
  2⤵
  PID:6156
- C:\Windows\System\eAdsTAN.exe
  C:\Windows\System\eAdsTAN.exe
  2⤵
  PID:6172
- C:\Windows\System\SdNPJrs.exe
  C:\Windows\System\SdNPJrs.exe
  2⤵
  PID:6188
- C:\Windows\System\vNSPXqD.exe
  C:\Windows\System\vNSPXqD.exe
  2⤵
  PID:6204
- C:\Windows\System\tPywonQ.exe
  C:\Windows\System\tPywonQ.exe
  2⤵
  PID:6220
- C:\Windows\System\CDdMUMQ.exe
  C:\Windows\System\CDdMUMQ.exe
  2⤵
  PID:6236
- C:\Windows\System\pnrMFgT.exe
  C:\Windows\System\pnrMFgT.exe
  2⤵
  PID:6252
- C:\Windows\System\mfmkIxu.exe
  C:\Windows\System\mfmkIxu.exe
  2⤵
  PID:6268
- C:\Windows\System\OseoZFm.exe
  C:\Windows\System\OseoZFm.exe
  2⤵
  PID:6284
- C:\Windows\System\IzYukBq.exe
  C:\Windows\System\IzYukBq.exe
  2⤵
  PID:6300
- C:\Windows\System\vGINRAJ.exe
  C:\Windows\System\vGINRAJ.exe
  2⤵
  PID:6316
- C:\Windows\System\QzQzzkz.exe
  C:\Windows\System\QzQzzkz.exe
  2⤵
  PID:6332
- C:\Windows\System\TfJMatp.exe
  C:\Windows\System\TfJMatp.exe
  2⤵
  PID:6348
- C:\Windows\System\VwtBBLL.exe
  C:\Windows\System\VwtBBLL.exe
  2⤵
  PID:6364
- C:\Windows\System\zpkgbMl.exe
  C:\Windows\System\zpkgbMl.exe
  2⤵
  PID:6380
- C:\Windows\System\OIecgzy.exe
  C:\Windows\System\OIecgzy.exe
  2⤵
  PID:6396
- C:\Windows\System\KOWvXED.exe
  C:\Windows\System\KOWvXED.exe
  2⤵
  PID:6412
- C:\Windows\System\etcPMey.exe
  C:\Windows\System\etcPMey.exe
  2⤵
  PID:6428
- C:\Windows\System\kKqjtAF.exe
  C:\Windows\System\kKqjtAF.exe
  2⤵
  PID:6444
- C:\Windows\System\pbIyARj.exe
  C:\Windows\System\pbIyARj.exe
  2⤵
  PID:6460
- C:\Windows\System\wxXLymV.exe
  C:\Windows\System\wxXLymV.exe
  2⤵
  PID:6476
- C:\Windows\System\CAKQDei.exe
  C:\Windows\System\CAKQDei.exe
  2⤵
  PID:6492
- C:\Windows\System\Lrwitym.exe
  C:\Windows\System\Lrwitym.exe
  2⤵
  PID:6508
- C:\Windows\System\wekaXyb.exe
  C:\Windows\System\wekaXyb.exe
  2⤵
  PID:6524
- C:\Windows\System\aZVxWGW.exe
  C:\Windows\System\aZVxWGW.exe
  2⤵
  PID:6540
- C:\Windows\System\zSOlPki.exe
  C:\Windows\System\zSOlPki.exe
  2⤵
  PID:6556
- C:\Windows\System\sgVdSbl.exe
  C:\Windows\System\sgVdSbl.exe
  2⤵
  PID:6572
- C:\Windows\System\QDNWnUC.exe
  C:\Windows\System\QDNWnUC.exe
  2⤵
  PID:6588
- C:\Windows\System\yprQQuA.exe
  C:\Windows\System\yprQQuA.exe
  2⤵
  PID:6604
- C:\Windows\System\IONPhLd.exe
  C:\Windows\System\IONPhLd.exe
  2⤵
  PID:6620
- C:\Windows\System\rQsLqAr.exe
  C:\Windows\System\rQsLqAr.exe
  2⤵
  PID:6636
- C:\Windows\System\lDxyWZF.exe
  C:\Windows\System\lDxyWZF.exe
  2⤵
  PID:6652
- C:\Windows\System\uifMQkh.exe
  C:\Windows\System\uifMQkh.exe
  2⤵
  PID:6668
- C:\Windows\System\LBISDPU.exe
  C:\Windows\System\LBISDPU.exe
  2⤵
  PID:6684
- C:\Windows\System\tfcymAl.exe
  C:\Windows\System\tfcymAl.exe
  2⤵
  PID:6700
- C:\Windows\System\PMSMmDd.exe
  C:\Windows\System\PMSMmDd.exe
  2⤵
  PID:6716
- C:\Windows\System\zBzSzby.exe
  C:\Windows\System\zBzSzby.exe
  2⤵
  PID:6732
- C:\Windows\System\vwWSgMA.exe
  C:\Windows\System\vwWSgMA.exe
  2⤵
  PID:6748
- C:\Windows\System\ArZKPtg.exe
  C:\Windows\System\ArZKPtg.exe
  2⤵
  PID:6764
- C:\Windows\System\SYFrsWE.exe
  C:\Windows\System\SYFrsWE.exe
  2⤵
  PID:6780
- C:\Windows\System\CLPbflP.exe
  C:\Windows\System\CLPbflP.exe
  2⤵
  PID:6796
- C:\Windows\System\sGnsrFG.exe
  C:\Windows\System\sGnsrFG.exe
  2⤵
  PID:6812
- C:\Windows\System\vEQzKuR.exe
  C:\Windows\System\vEQzKuR.exe
  2⤵
  PID:6828
- C:\Windows\System\ONOQTwz.exe
  C:\Windows\System\ONOQTwz.exe
  2⤵
  PID:6852
- C:\Windows\System\TnmWbvJ.exe
  C:\Windows\System\TnmWbvJ.exe
  2⤵
  PID:6868
- C:\Windows\System\TMUzUWI.exe
  C:\Windows\System\TMUzUWI.exe
  2⤵
  PID:6884
- C:\Windows\System\UxuLNLp.exe
  C:\Windows\System\UxuLNLp.exe
  2⤵
  PID:6900
- C:\Windows\System\BkJJchB.exe
  C:\Windows\System\BkJJchB.exe
  2⤵
  PID:6916
- C:\Windows\System\nruEovY.exe
  C:\Windows\System\nruEovY.exe
  2⤵
  PID:6932
- C:\Windows\System\jxUycBV.exe
  C:\Windows\System\jxUycBV.exe
  2⤵
  PID:6948
- C:\Windows\System\cSAEVEr.exe
  C:\Windows\System\cSAEVEr.exe
  2⤵
  PID:6964
- C:\Windows\System\nbTvfCQ.exe
  C:\Windows\System\nbTvfCQ.exe
  2⤵
  PID:6980
- C:\Windows\System\AKxRRgz.exe
  C:\Windows\System\AKxRRgz.exe
  2⤵
  PID:6996
- C:\Windows\System\YQxBpFG.exe
  C:\Windows\System\YQxBpFG.exe
  2⤵
  PID:7012
- C:\Windows\System\QCqULzX.exe
  C:\Windows\System\QCqULzX.exe
  2⤵
  PID:7028
- C:\Windows\System\JWjJXCU.exe
  C:\Windows\System\JWjJXCU.exe
  2⤵
  PID:7044
- C:\Windows\System\juWCSZT.exe
  C:\Windows\System\juWCSZT.exe
  2⤵
  PID:7060
- C:\Windows\System\SHPTWnf.exe
  C:\Windows\System\SHPTWnf.exe
  2⤵
  PID:7076
- C:\Windows\System\KacrHmg.exe
  C:\Windows\System\KacrHmg.exe
  2⤵
  PID:7092
- C:\Windows\System\jHwlTeP.exe
  C:\Windows\System\jHwlTeP.exe
  2⤵
  PID:7108
- C:\Windows\System\QUxLFwg.exe
  C:\Windows\System\QUxLFwg.exe
  2⤵
  PID:7124
- C:\Windows\System\wxzoJGc.exe
  C:\Windows\System\wxzoJGc.exe
  2⤵
  PID:7140
- C:\Windows\System\hLNXJbU.exe
  C:\Windows\System\hLNXJbU.exe
  2⤵
  PID:7156
- C:\Windows\System\GNxvTqF.exe
  C:\Windows\System\GNxvTqF.exe
  2⤵
  PID:5140
- C:\Windows\System\ItROdCL.exe
  C:\Windows\System\ItROdCL.exe
  2⤵
  PID:6164
- C:\Windows\System\oeywBLA.exe
  C:\Windows\System\oeywBLA.exe
  2⤵
  PID:6196
- C:\Windows\System\oaxOOkl.exe
  C:\Windows\System\oaxOOkl.exe
  2⤵
  PID:5848
- C:\Windows\System\ffHDYVb.exe
  C:\Windows\System\ffHDYVb.exe
  2⤵
  PID:6072
- C:\Windows\System\yzmfJKU.exe
  C:\Windows\System\yzmfJKU.exe
  2⤵
  PID:6184
- C:\Windows\System\rfSxVnl.exe
  C:\Windows\System\rfSxVnl.exe
  2⤵
  PID:6260
- C:\Windows\System\zNTtZBp.exe
  C:\Windows\System\zNTtZBp.exe
  2⤵
  PID:6276
- C:\Windows\System\MNslmEX.exe
  C:\Windows\System\MNslmEX.exe
  2⤵
  PID:6356
- C:\Windows\System\elURrLf.exe
  C:\Windows\System\elURrLf.exe
  2⤵
  PID:6420
- C:\Windows\System\zmNDEul.exe
  C:\Windows\System\zmNDEul.exe
  2⤵
  PID:6484
- C:\Windows\System\kDvuEqP.exe
  C:\Windows\System\kDvuEqP.exe
  2⤵
  PID:6340
- C:\Windows\System\eJGIwvU.exe
  C:\Windows\System\eJGIwvU.exe
  2⤵
  PID:6404
- C:\Windows\System\PFItLFA.exe
  C:\Windows\System\PFItLFA.exe
  2⤵
  PID:6552
- C:\Windows\System\YXaowiL.exe
  C:\Windows\System\YXaowiL.exe
  2⤵
  PID:6564
- C:\Windows\System\woudXqp.exe
  C:\Windows\System\woudXqp.exe
  2⤵
  PID:6472
- C:\Windows\System\xnlhpsQ.exe
  C:\Windows\System\xnlhpsQ.exe
  2⤵
  PID:6568
- C:\Windows\System\mfimunS.exe
  C:\Windows\System\mfimunS.exe
  2⤵
  PID:6612
- C:\Windows\System\cfxPMnI.exe
  C:\Windows\System\cfxPMnI.exe
  2⤵
  PID:6676
- C:\Windows\System\fUNgTTW.exe
  C:\Windows\System\fUNgTTW.exe
  2⤵
  PID:6740
- C:\Windows\System\ksQYPXJ.exe
  C:\Windows\System\ksQYPXJ.exe
  2⤵
  PID:6728
- C:\Windows\System\lwrMyrM.exe
  C:\Windows\System\lwrMyrM.exe
  2⤵
  PID:6776
- C:\Windows\System\yjrAOwN.exe
  C:\Windows\System\yjrAOwN.exe
  2⤵
  PID:6756
- C:\Windows\System\LNOWBER.exe
  C:\Windows\System\LNOWBER.exe
  2⤵
  PID:6804
- C:\Windows\System\vkLxOFB.exe
  C:\Windows\System\vkLxOFB.exe
  2⤵
  PID:6844
- C:\Windows\System\yliwynZ.exe
  C:\Windows\System\yliwynZ.exe
  2⤵
  PID:6896
- C:\Windows\System\SoJYyBo.exe
  C:\Windows\System\SoJYyBo.exe
  2⤵
  PID:6860
- C:\Windows\System\gcvVisd.exe
  C:\Windows\System\gcvVisd.exe
  2⤵
  PID:6972
- C:\Windows\System\knFspVH.exe
  C:\Windows\System\knFspVH.exe
  2⤵
  PID:6956
- C:\Windows\System\ZQWyfYp.exe
  C:\Windows\System\ZQWyfYp.exe
  2⤵
  PID:7072
- C:\Windows\System\OpGhQvL.exe
  C:\Windows\System\OpGhQvL.exe
  2⤵
  PID:7104
- C:\Windows\System\izGEnnY.exe
  C:\Windows\System\izGEnnY.exe
  2⤵
  PID:7132
- C:\Windows\System\EAtVNFr.exe
  C:\Windows\System\EAtVNFr.exe
  2⤵
  PID:6148
- C:\Windows\System\MtpYFSo.exe
  C:\Windows\System\MtpYFSo.exe
  2⤵
  PID:6988
- C:\Windows\System\KTHNUIK.exe
  C:\Windows\System\KTHNUIK.exe
  2⤵
  PID:6328
- C:\Windows\System\gicOucR.exe
  C:\Windows\System\gicOucR.exe
  2⤵
  PID:6376
- C:\Windows\System\HKYyNPv.exe
  C:\Windows\System\HKYyNPv.exe
  2⤵
  PID:6532
- C:\Windows\System\yUyXYtm.exe
  C:\Windows\System\yUyXYtm.exe
  2⤵
  PID:6648
- C:\Windows\System\AfxGTDW.exe
  C:\Windows\System\AfxGTDW.exe
  2⤵
  PID:7084
- C:\Windows\System\bumeBsa.exe
  C:\Windows\System\bumeBsa.exe
  2⤵
  PID:6292
- C:\Windows\System\QjhbVrE.exe
  C:\Windows\System\QjhbVrE.exe
  2⤵
  PID:5352
- C:\Windows\System\GvRSCMu.exe
  C:\Windows\System\GvRSCMu.exe
  2⤵
  PID:6708
- C:\Windows\System\lYwDPie.exe
  C:\Windows\System\lYwDPie.exe
  2⤵
  PID:6388
- C:\Windows\System\kZITmhR.exe
  C:\Windows\System\kZITmhR.exe
  2⤵
  PID:6548
- C:\Windows\System\GxuGDRL.exe
  C:\Windows\System\GxuGDRL.exe
  2⤵
  PID:6488
- C:\Windows\System\QNWdPdj.exe
  C:\Windows\System\QNWdPdj.exe
  2⤵
  PID:6792
- C:\Windows\System\zaIPLYb.exe
  C:\Windows\System\zaIPLYb.exe
  2⤵
  PID:6880
- C:\Windows\System\MvAGxxS.exe
  C:\Windows\System\MvAGxxS.exe
  2⤵
  PID:6924
- C:\Windows\System\OCPEJiQ.exe
  C:\Windows\System\OCPEJiQ.exe
  2⤵
  PID:7008
- C:\Windows\System\lWdfmxu.exe
  C:\Windows\System\lWdfmxu.exe
  2⤵
  PID:7036
- C:\Windows\System\VgjWHwt.exe
  C:\Windows\System\VgjWHwt.exe
  2⤵
  PID:7164
- C:\Windows\System\RKRhSiM.exe
  C:\Windows\System\RKRhSiM.exe
  2⤵
  PID:6324
- C:\Windows\System\OcLbXBP.exe
  C:\Windows\System\OcLbXBP.exe
  2⤵
  PID:6452
- C:\Windows\System\gTZQZNQ.exe
  C:\Windows\System\gTZQZNQ.exe
  2⤵
  PID:7148
- C:\Windows\System\QOKWhge.exe
  C:\Windows\System\QOKWhge.exe
  2⤵
  PID:5736
- C:\Windows\System\FsJgNGM.exe
  C:\Windows\System\FsJgNGM.exe
  2⤵
  PID:6692
- C:\Windows\System\GMskrfZ.exe
  C:\Windows\System\GMskrfZ.exe
  2⤵
  PID:6232
- C:\Windows\System\zNQLTDw.exe
  C:\Windows\System\zNQLTDw.exe
  2⤵
  PID:7004
- C:\Windows\System\vkNESPW.exe
  C:\Windows\System\vkNESPW.exe
  2⤵
  PID:6440
- C:\Windows\System\WyTdssd.exe
  C:\Windows\System\WyTdssd.exe
  2⤵
  PID:5192
- C:\Windows\System\upLMfOD.exe
  C:\Windows\System\upLMfOD.exe
  2⤵
  PID:6944
- C:\Windows\System\poOkfww.exe
  C:\Windows\System\poOkfww.exe
  2⤵
  PID:6724
- C:\Windows\System\NXPjGlS.exe
  C:\Windows\System\NXPjGlS.exe
  2⤵
  PID:7024
- C:\Windows\System\jJaGCKD.exe
  C:\Windows\System\jJaGCKD.exe
  2⤵
  PID:7116
- C:\Windows\System\VhoYOZf.exe
  C:\Windows\System\VhoYOZf.exe
  2⤵
  PID:6940
- C:\Windows\System\gydOEDi.exe
  C:\Windows\System\gydOEDi.exe
  2⤵
  PID:6120
- C:\Windows\System\vEmKECt.exe
  C:\Windows\System\vEmKECt.exe
  2⤵
  PID:6644
- C:\Windows\System\iujyqyB.exe
  C:\Windows\System\iujyqyB.exe
  2⤵
  PID:7184
- C:\Windows\System\HplocJS.exe
  C:\Windows\System\HplocJS.exe
  2⤵
  PID:7200
- C:\Windows\System\EZAFDsJ.exe
  C:\Windows\System\EZAFDsJ.exe
  2⤵
  PID:7216
- C:\Windows\System\ASZLJbd.exe
  C:\Windows\System\ASZLJbd.exe
  2⤵
  PID:7232
- C:\Windows\System\MtSdxjV.exe
  C:\Windows\System\MtSdxjV.exe
  2⤵
  PID:7248
- C:\Windows\System\rJRZVfy.exe
  C:\Windows\System\rJRZVfy.exe
  2⤵
  PID:7264
- C:\Windows\System\qlWGQyD.exe
  C:\Windows\System\qlWGQyD.exe
  2⤵
  PID:7280
- C:\Windows\System\HDCnwwC.exe
  C:\Windows\System\HDCnwwC.exe
  2⤵
  PID:7296
- C:\Windows\System\qlrVoeI.exe
  C:\Windows\System\qlrVoeI.exe
  2⤵
  PID:7312
- C:\Windows\System\NjleorH.exe
  C:\Windows\System\NjleorH.exe
  2⤵
  PID:7328
- C:\Windows\System\poWwllZ.exe
  C:\Windows\System\poWwllZ.exe
  2⤵
  PID:7344
- C:\Windows\System\eLEbemN.exe
  C:\Windows\System\eLEbemN.exe
  2⤵
  PID:7360
- C:\Windows\System\bJMlLsP.exe
  C:\Windows\System\bJMlLsP.exe
  2⤵
  PID:7376
- C:\Windows\System\JUbBxEM.exe
  C:\Windows\System\JUbBxEM.exe
  2⤵
  PID:7392
- C:\Windows\System\ykHNYbo.exe
  C:\Windows\System\ykHNYbo.exe
  2⤵
  PID:7408
- C:\Windows\System\votyRku.exe
  C:\Windows\System\votyRku.exe
  2⤵
  PID:7424
- C:\Windows\System\PjthTsn.exe
  C:\Windows\System\PjthTsn.exe
  2⤵
  PID:7440
- C:\Windows\System\nmJPUKe.exe
  C:\Windows\System\nmJPUKe.exe
  2⤵
  PID:7460
- C:\Windows\System\EYykSEl.exe
  C:\Windows\System\EYykSEl.exe
  2⤵
  PID:7476
- C:\Windows\System\aJysvoi.exe
  C:\Windows\System\aJysvoi.exe
  2⤵
  PID:7492
- C:\Windows\System\xAvdxRh.exe
  C:\Windows\System\xAvdxRh.exe
  2⤵
  PID:7508
- C:\Windows\System\AjWPYMM.exe
  C:\Windows\System\AjWPYMM.exe
  2⤵
  PID:7524
- C:\Windows\System\tsgvoaD.exe
  C:\Windows\System\tsgvoaD.exe
  2⤵
  PID:7540
- C:\Windows\System\LrGuhlU.exe
  C:\Windows\System\LrGuhlU.exe
  2⤵
  PID:7556
- C:\Windows\System\VVutIzY.exe
  C:\Windows\System\VVutIzY.exe
  2⤵
  PID:7572
- C:\Windows\System\FjiHdYr.exe
  C:\Windows\System\FjiHdYr.exe
  2⤵
  PID:7588
- C:\Windows\System\XUMVbqs.exe
  C:\Windows\System\XUMVbqs.exe
  2⤵
  PID:7604
- C:\Windows\System\wRtIIMJ.exe
  C:\Windows\System\wRtIIMJ.exe
  2⤵
  PID:7620
- C:\Windows\System\wQSMzmT.exe
  C:\Windows\System\wQSMzmT.exe
  2⤵
  PID:7636
- C:\Windows\System\hXEPBIi.exe
  C:\Windows\System\hXEPBIi.exe
  2⤵
  PID:7652
- C:\Windows\System\SEsVfBX.exe
  C:\Windows\System\SEsVfBX.exe
  2⤵
  PID:7668
- C:\Windows\System\DepmBFt.exe
  C:\Windows\System\DepmBFt.exe
  2⤵
  PID:7684
- C:\Windows\System\kAcyhaI.exe
  C:\Windows\System\kAcyhaI.exe
  2⤵
  PID:7700
- C:\Windows\System\XcuYxIw.exe
  C:\Windows\System\XcuYxIw.exe
  2⤵
  PID:7716
- C:\Windows\System\wJQCFPh.exe
  C:\Windows\System\wJQCFPh.exe
  2⤵
  PID:7732
- C:\Windows\System\RysiTIw.exe
  C:\Windows\System\RysiTIw.exe
  2⤵
  PID:7748
- C:\Windows\System\hXbdLkE.exe
  C:\Windows\System\hXbdLkE.exe
  2⤵
  PID:7764
- C:\Windows\System\pYYidMO.exe
  C:\Windows\System\pYYidMO.exe
  2⤵
  PID:7780
- C:\Windows\System\vPExEVM.exe
  C:\Windows\System\vPExEVM.exe
  2⤵
  PID:7796
- C:\Windows\System\ZsssMvn.exe
  C:\Windows\System\ZsssMvn.exe
  2⤵
  PID:7812
- C:\Windows\System\aWMvLFr.exe
  C:\Windows\System\aWMvLFr.exe
  2⤵
  PID:7832
- C:\Windows\System\vUoYCtC.exe
  C:\Windows\System\vUoYCtC.exe
  2⤵
  PID:7848
- C:\Windows\System\HxKELDi.exe
  C:\Windows\System\HxKELDi.exe
  2⤵
  PID:7864
- C:\Windows\System\gzpGgUt.exe
  C:\Windows\System\gzpGgUt.exe
  2⤵
  PID:7880
- C:\Windows\System\WuifFTM.exe
  C:\Windows\System\WuifFTM.exe
  2⤵
  PID:7896
- C:\Windows\System\KZpVyiA.exe
  C:\Windows\System\KZpVyiA.exe
  2⤵
  PID:7912
- C:\Windows\System\zdEmrZT.exe
  C:\Windows\System\zdEmrZT.exe
  2⤵
  PID:7928
- C:\Windows\System\yZcLGuD.exe
  C:\Windows\System\yZcLGuD.exe
  2⤵
  PID:7944
- C:\Windows\System\ziQrKyA.exe
  C:\Windows\System\ziQrKyA.exe
  2⤵
  PID:7960
- C:\Windows\System\txZAdWK.exe
  C:\Windows\System\txZAdWK.exe
  2⤵
  PID:7976
- C:\Windows\System\HGHxBeZ.exe
  C:\Windows\System\HGHxBeZ.exe
  2⤵
  PID:7992
- C:\Windows\System\QYREXEN.exe
  C:\Windows\System\QYREXEN.exe
  2⤵
  PID:8008
- C:\Windows\System\AFktHZX.exe
  C:\Windows\System\AFktHZX.exe
  2⤵
  PID:8024
- C:\Windows\System\UUFdkEj.exe
  C:\Windows\System\UUFdkEj.exe
  2⤵
  PID:8040
- C:\Windows\System\WkbEajE.exe
  C:\Windows\System\WkbEajE.exe
  2⤵
  PID:8056
- C:\Windows\System\nSWTVrS.exe
  C:\Windows\System\nSWTVrS.exe
  2⤵
  PID:8072
- C:\Windows\System\jKeEDPJ.exe
  C:\Windows\System\jKeEDPJ.exe
  2⤵
  PID:8088
- C:\Windows\System\BaHvKsP.exe
  C:\Windows\System\BaHvKsP.exe
  2⤵
  PID:8104
- C:\Windows\System\fVJLZkV.exe
  C:\Windows\System\fVJLZkV.exe
  2⤵
  PID:8120
- C:\Windows\System\lMIOmYf.exe
  C:\Windows\System\lMIOmYf.exe
  2⤵
  PID:8136
- C:\Windows\System\wVaanFm.exe
  C:\Windows\System\wVaanFm.exe
  2⤵
  PID:8152
- C:\Windows\System\tPjSKUi.exe
  C:\Windows\System\tPjSKUi.exe
  2⤵
  PID:8168
- C:\Windows\System\pfrLNEk.exe
  C:\Windows\System\pfrLNEk.exe
  2⤵
  PID:8184
- C:\Windows\System\hZWWqQy.exe
  C:\Windows\System\hZWWqQy.exe
  2⤵
  PID:6392
- C:\Windows\System\DXyXACc.exe
  C:\Windows\System\DXyXACc.exe
  2⤵
  PID:6864
- C:\Windows\System\LfAtdjV.exe
  C:\Windows\System\LfAtdjV.exe
  2⤵
  PID:7192
- C:\Windows\System\hkWGkZw.exe
  C:\Windows\System\hkWGkZw.exe
  2⤵
  PID:7212
- C:\Windows\System\NBxBqBz.exe
  C:\Windows\System\NBxBqBz.exe
  2⤵
  PID:7292
- C:\Windows\System\mThvdXu.exe
  C:\Windows\System\mThvdXu.exe
  2⤵
  PID:7356
- C:\Windows\System\BTheXSX.exe
  C:\Windows\System\BTheXSX.exe
  2⤵
  PID:7420
- C:\Windows\System\zxOzrEv.exe
  C:\Windows\System\zxOzrEv.exe
  2⤵
  PID:7244
- C:\Windows\System\KqSSphb.exe
  C:\Windows\System\KqSSphb.exe
  2⤵
  PID:7484
- C:\Windows\System\PqcbzrY.exe
  C:\Windows\System\PqcbzrY.exe
  2⤵
  PID:7500
- C:\Windows\System\sAxExVi.exe
  C:\Windows\System\sAxExVi.exe
  2⤵
  PID:7548
- C:\Windows\System\REvaXQu.exe
  C:\Windows\System\REvaXQu.exe
  2⤵
  PID:7372
- C:\Windows\System\BSUYWxT.exe
  C:\Windows\System\BSUYWxT.exe
  2⤵
  PID:7400
- C:\Windows\System\wzJYrWe.exe
  C:\Windows\System\wzJYrWe.exe
  2⤵
  PID:7504
- C:\Windows\System\cyxgCoY.exe
  C:\Windows\System\cyxgCoY.exe
  2⤵
  PID:7568
- C:\Windows\System\bMAloJo.exe
  C:\Windows\System\bMAloJo.exe
  2⤵
  PID:7468
- C:\Windows\System\ptQfqsu.exe
  C:\Windows\System\ptQfqsu.exe
  2⤵
  PID:7676
- C:\Windows\System\jBiHiPG.exe
  C:\Windows\System\jBiHiPG.exe
  2⤵
  PID:7740
- C:\Windows\System\qGMSngu.exe
  C:\Windows\System\qGMSngu.exe
  2⤵
  PID:7776
- C:\Windows\System\xuQuHNP.exe
  C:\Windows\System\xuQuHNP.exe
  2⤵
  PID:7844
- C:\Windows\System\KPpoadT.exe
  C:\Windows\System\KPpoadT.exe
  2⤵
  PID:7632
- C:\Windows\System\dZbaCaW.exe
  C:\Windows\System\dZbaCaW.exe
  2⤵
  PID:7876
- C:\Windows\System\goQoTTV.exe
  C:\Windows\System\goQoTTV.exe
  2⤵
  PID:7724
- C:\Windows\System\BHvzFDF.exe
  C:\Windows\System\BHvzFDF.exe
  2⤵
  PID:7760
- C:\Windows\System\yJjydNB.exe
  C:\Windows\System\yJjydNB.exe
  2⤵
  PID:7824
- C:\Windows\System\VcuaFwd.exe
  C:\Windows\System\VcuaFwd.exe
  2⤵
  PID:7860
- C:\Windows\System\uSgXDhj.exe
  C:\Windows\System\uSgXDhj.exe
  2⤵
  PID:8000
- C:\Windows\System\fihYDjz.exe
  C:\Windows\System\fihYDjz.exe
  2⤵
  PID:8064
- C:\Windows\System\jAJvrDV.exe
  C:\Windows\System\jAJvrDV.exe
  2⤵
  PID:7988
- C:\Windows\System\HbuyYRD.exe
  C:\Windows\System\HbuyYRD.exe
  2⤵
  PID:8052
- C:\Windows\System\cgCzFfh.exe
  C:\Windows\System\cgCzFfh.exe
  2⤵
  PID:8084
- C:\Windows\System\kvoqTxA.exe
  C:\Windows\System\kvoqTxA.exe
  2⤵
  PID:8164
- C:\Windows\System\ygSWtZR.exe
  C:\Windows\System\ygSWtZR.exe
  2⤵
  PID:8144
- C:\Windows\System\gKGTKZL.exe
  C:\Windows\System\gKGTKZL.exe
  2⤵
  PID:7180
- C:\Windows\System\PWOMUDg.exe
  C:\Windows\System\PWOMUDg.exe
  2⤵
  PID:6788
- C:\Windows\System\ADFgDkw.exe
  C:\Windows\System\ADFgDkw.exe
  2⤵
  PID:7196
- C:\Windows\System\fddCWng.exe
  C:\Windows\System\fddCWng.exe
  2⤵
  PID:7352
- C:\Windows\System\QenHWiP.exe
  C:\Windows\System\QenHWiP.exe
  2⤵
  PID:7584
- C:\Windows\System\fuxzilR.exe
  C:\Windows\System\fuxzilR.exe
  2⤵
  PID:7368
- C:\Windows\System\HzBNgzV.exe
  C:\Windows\System\HzBNgzV.exe
  2⤵
  PID:7516
- C:\Windows\System\WqcMsUx.exe
  C:\Windows\System\WqcMsUx.exe
  2⤵
  PID:7648
- C:\Windows\System\Lvptrjd.exe
  C:\Windows\System\Lvptrjd.exe
  2⤵
  PID:7708
- C:\Windows\System\oAOmGBc.exe
  C:\Windows\System\oAOmGBc.exe
  2⤵
  PID:7728
- C:\Windows\System\QeJBzUe.exe
  C:\Windows\System\QeJBzUe.exe
  2⤵
  PID:7792
- C:\Windows\System\MYbPPhG.exe
  C:\Windows\System\MYbPPhG.exe
  2⤵
  PID:7840
- C:\Windows\System\rPiPpAE.exe
  C:\Windows\System\rPiPpAE.exe
  2⤵
  PID:7856
- C:\Windows\System\oaGJvCJ.exe
  C:\Windows\System\oaGJvCJ.exe
  2⤵
  PID:7984
- C:\Windows\System\pjgCmqH.exe
  C:\Windows\System\pjgCmqH.exe
  2⤵
  PID:8100
- C:\Windows\System\MwVMdQV.exe
  C:\Windows\System\MwVMdQV.exe
  2⤵
  PID:8032
- C:\Windows\System\JWcpbfH.exe
  C:\Windows\System\JWcpbfH.exe
  2⤵
  PID:8020
- C:\Windows\System\dZAdZcQ.exe
  C:\Windows\System\dZAdZcQ.exe
  2⤵
  PID:8180
- C:\Windows\System\brVEiCL.exe
  C:\Windows\System\brVEiCL.exe
  2⤵
  PID:7324
- C:\Windows\System\oBRHvuf.exe
  C:\Windows\System\oBRHvuf.exe
  2⤵
  PID:7340
- C:\Windows\System\FmZGtTT.exe
  C:\Windows\System\FmZGtTT.exe
  2⤵
  PID:7272
- C:\Windows\System\EeQtpRu.exe
  C:\Windows\System\EeQtpRu.exe
  2⤵
  PID:7472
- C:\Windows\System\CPGivRf.exe
  C:\Windows\System\CPGivRf.exe
  2⤵
  PID:7892
- C:\Windows\System\KiaAdXH.exe
  C:\Windows\System\KiaAdXH.exe
  2⤵
  PID:7972
- C:\Windows\System\QqzLFph.exe
  C:\Windows\System\QqzLFph.exe
  2⤵
  PID:8068
- C:\Windows\System\MHkPkzC.exe
  C:\Windows\System\MHkPkzC.exe
  2⤵
  PID:8160
- C:\Windows\System\kUQVHLD.exe
  C:\Windows\System\kUQVHLD.exe
  2⤵
  PID:7536
- C:\Windows\System\yMOpzGb.exe
  C:\Windows\System\yMOpzGb.exe
  2⤵
  PID:7664
- C:\Windows\System\CyOCQDX.exe
  C:\Windows\System\CyOCQDX.exe
  2⤵
  PID:8176
- C:\Windows\System\HrpgyDP.exe
  C:\Windows\System\HrpgyDP.exe
  2⤵
  PID:7224
- C:\Windows\System\lPaJAEJ.exe
  C:\Windows\System\lPaJAEJ.exe
  2⤵
  PID:7436
- C:\Windows\System\OjohpaN.exe
  C:\Windows\System\OjohpaN.exe
  2⤵
  PID:7968
- C:\Windows\System\tKGUggG.exe
  C:\Windows\System\tKGUggG.exe
  2⤵
  PID:7288
- C:\Windows\System\owseVXa.exe
  C:\Windows\System\owseVXa.exe
  2⤵
  PID:8196
- C:\Windows\System\cFiBVbY.exe
  C:\Windows\System\cFiBVbY.exe
  2⤵
  PID:8212
- C:\Windows\System\qHfcmEK.exe
  C:\Windows\System\qHfcmEK.exe
  2⤵
  PID:8228
- C:\Windows\System\DWWEtEA.exe
  C:\Windows\System\DWWEtEA.exe
  2⤵
  PID:8244
- C:\Windows\System\digbCFc.exe
  C:\Windows\System\digbCFc.exe
  2⤵
  PID:8260
- C:\Windows\System\MdAxvne.exe
  C:\Windows\System\MdAxvne.exe
  2⤵
  PID:8276
- C:\Windows\System\KfhnZGW.exe
  C:\Windows\System\KfhnZGW.exe
  2⤵
  PID:8292
- C:\Windows\System\xaazQyv.exe
  C:\Windows\System\xaazQyv.exe
  2⤵
  PID:8308
- C:\Windows\System\PuKHJVw.exe
  C:\Windows\System\PuKHJVw.exe
  2⤵
  PID:8324
- C:\Windows\System\UbXKdzh.exe
  C:\Windows\System\UbXKdzh.exe
  2⤵
  PID:8340
- C:\Windows\System\DcwgdUj.exe
  C:\Windows\System\DcwgdUj.exe
  2⤵
  PID:8356
- C:\Windows\System\PrNJHvC.exe
  C:\Windows\System\PrNJHvC.exe
  2⤵
  PID:8372
- C:\Windows\System\JaVRXMC.exe
  C:\Windows\System\JaVRXMC.exe
  2⤵
  PID:8388
- C:\Windows\System\vpXauNc.exe
  C:\Windows\System\vpXauNc.exe
  2⤵
  PID:8404
- C:\Windows\System\YRCfKMv.exe
  C:\Windows\System\YRCfKMv.exe
  2⤵
  PID:8420
- C:\Windows\System\fzcpKDF.exe
  C:\Windows\System\fzcpKDF.exe
  2⤵
  PID:8436
- C:\Windows\System\Vnvqcbu.exe
  C:\Windows\System\Vnvqcbu.exe
  2⤵
  PID:8452
- C:\Windows\System\kFOHrNu.exe
  C:\Windows\System\kFOHrNu.exe
  2⤵
  PID:8468
- C:\Windows\System\ucOtnIP.exe
  C:\Windows\System\ucOtnIP.exe
  2⤵
  PID:8484
- C:\Windows\System\TIKJmmQ.exe
  C:\Windows\System\TIKJmmQ.exe
  2⤵
  PID:8500
- C:\Windows\System\tqdHJde.exe
  C:\Windows\System\tqdHJde.exe
  2⤵
  PID:8520
- C:\Windows\System\NJkDTZp.exe
  C:\Windows\System\NJkDTZp.exe
  2⤵
  PID:8536
- C:\Windows\System\bEjlZtW.exe
  C:\Windows\System\bEjlZtW.exe
  2⤵
  PID:8556
- C:\Windows\System\ecgoLSK.exe
  C:\Windows\System\ecgoLSK.exe
  2⤵
  PID:8572
- C:\Windows\System\jNgjTbp.exe
  C:\Windows\System\jNgjTbp.exe
  2⤵
  PID:8588
- C:\Windows\System\BaZxsIA.exe
  C:\Windows\System\BaZxsIA.exe
  2⤵
  PID:8604
- C:\Windows\System\lKVXrvw.exe
  C:\Windows\System\lKVXrvw.exe
  2⤵
  PID:8620
- C:\Windows\System\ZnlfGjZ.exe
  C:\Windows\System\ZnlfGjZ.exe
  2⤵
  PID:8636
- C:\Windows\System\VrPGlNu.exe
  C:\Windows\System\VrPGlNu.exe
  2⤵
  PID:8652
- C:\Windows\System\TZFvBQV.exe
  C:\Windows\System\TZFvBQV.exe
  2⤵
  PID:8668
- C:\Windows\System\Tiyluty.exe
  C:\Windows\System\Tiyluty.exe
  2⤵
  PID:8684
- C:\Windows\System\IIkllpM.exe
  C:\Windows\System\IIkllpM.exe
  2⤵
  PID:8700
- C:\Windows\System\gTLMYDz.exe
  C:\Windows\System\gTLMYDz.exe
  2⤵
  PID:8716
- C:\Windows\System\KCJJgxI.exe
  C:\Windows\System\KCJJgxI.exe
  2⤵
  PID:8732
- C:\Windows\System\EfbcLfk.exe
  C:\Windows\System\EfbcLfk.exe
  2⤵
  PID:8748
- C:\Windows\System\aOGXstM.exe
  C:\Windows\System\aOGXstM.exe
  2⤵
  PID:8764
- C:\Windows\System\giWrXtY.exe
  C:\Windows\System\giWrXtY.exe
  2⤵
  PID:8780
- C:\Windows\System\IyGhybd.exe
  C:\Windows\System\IyGhybd.exe
  2⤵
  PID:8796
- C:\Windows\System\eBeDtxE.exe
  C:\Windows\System\eBeDtxE.exe
  2⤵
  PID:8812
- C:\Windows\System\BrISNvi.exe
  C:\Windows\System\BrISNvi.exe
  2⤵
  PID:8828
- C:\Windows\System\OymOtcR.exe
  C:\Windows\System\OymOtcR.exe
  2⤵
  PID:8844
- C:\Windows\System\IyvlTdH.exe
  C:\Windows\System\IyvlTdH.exe
  2⤵
  PID:8860
- C:\Windows\System\JUGkIoK.exe
  C:\Windows\System\JUGkIoK.exe
  2⤵
  PID:8876
- C:\Windows\System\JWGBFlU.exe
  C:\Windows\System\JWGBFlU.exe
  2⤵
  PID:8892
- C:\Windows\System\IROMoVX.exe
  C:\Windows\System\IROMoVX.exe
  2⤵
  PID:8908
- C:\Windows\System\IxKLTQf.exe
  C:\Windows\System\IxKLTQf.exe
  2⤵
  PID:8924
- C:\Windows\System\BotbLmt.exe
  C:\Windows\System\BotbLmt.exe
  2⤵
  PID:8940
- C:\Windows\System\TShDvDd.exe
  C:\Windows\System\TShDvDd.exe
  2⤵
  PID:8956
- C:\Windows\System\EqYrrod.exe
  C:\Windows\System\EqYrrod.exe
  2⤵
  PID:8972
- C:\Windows\System\xhOLKCX.exe
  C:\Windows\System\xhOLKCX.exe
  2⤵
  PID:8988
- C:\Windows\System\dbCKZSV.exe
  C:\Windows\System\dbCKZSV.exe
  2⤵
  PID:9004
- C:\Windows\System\MWWhgKH.exe
  C:\Windows\System\MWWhgKH.exe
  2⤵
  PID:9024
- C:\Windows\System\GFrjRpC.exe
  C:\Windows\System\GFrjRpC.exe
  2⤵
  PID:9040
- C:\Windows\System\JBjVLkt.exe
  C:\Windows\System\JBjVLkt.exe
  2⤵
  PID:9056
- C:\Windows\System\aQyhkKW.exe
  C:\Windows\System\aQyhkKW.exe
  2⤵
  PID:9072
- C:\Windows\System\wFZDIQb.exe
  C:\Windows\System\wFZDIQb.exe
  2⤵
  PID:9088
- C:\Windows\System\wkajjUM.exe
  C:\Windows\System\wkajjUM.exe
  2⤵
  PID:9104
- C:\Windows\System\rNthppP.exe
  C:\Windows\System\rNthppP.exe
  2⤵
  PID:9120
- C:\Windows\System\uhKFzdu.exe
  C:\Windows\System\uhKFzdu.exe
  2⤵
  PID:9136
- C:\Windows\System\LxgoJBB.exe
  C:\Windows\System\LxgoJBB.exe
  2⤵
  PID:9152
- C:\Windows\System\jEREaZs.exe
  C:\Windows\System\jEREaZs.exe
  2⤵
  PID:9168
- C:\Windows\System\GzeTitd.exe
  C:\Windows\System\GzeTitd.exe
  2⤵
  PID:9184
- C:\Windows\System\gSKDAEt.exe
  C:\Windows\System\gSKDAEt.exe
  2⤵
  PID:9200
- C:\Windows\System\DWgOywH.exe
  C:\Windows\System\DWgOywH.exe
  2⤵
  PID:8132
- C:\Windows\System\cdGEDUz.exe
  C:\Windows\System\cdGEDUz.exe
  2⤵
  PID:8208
- C:\Windows\System\tvKXDfk.exe
  C:\Windows\System\tvKXDfk.exe
  2⤵
  PID:8256
- C:\Windows\System\ERVMUNP.exe
  C:\Windows\System\ERVMUNP.exe
  2⤵
  PID:8236
- C:\Windows\System\CLTwWIT.exe
  C:\Windows\System\CLTwWIT.exe
  2⤵
  PID:8300
- C:\Windows\System\rubmNbK.exe
  C:\Windows\System\rubmNbK.exe
  2⤵
  PID:8332
- C:\Windows\System\cwyYuPb.exe
  C:\Windows\System\cwyYuPb.exe
  2⤵
  PID:8384
- C:\Windows\System\NRPPyiJ.exe
  C:\Windows\System\NRPPyiJ.exe
  2⤵
  PID:8368
- C:\Windows\System\fOxbLKp.exe
  C:\Windows\System\fOxbLKp.exe
  2⤵
  PID:8444
- C:\Windows\System\fKxWbGE.exe
  C:\Windows\System\fKxWbGE.exe
  2⤵
  PID:8476
- C:\Windows\System\MPzBUFN.exe
  C:\Windows\System\MPzBUFN.exe
  2⤵
  PID:8528
- C:\Windows\System\avKWVKv.exe
  C:\Windows\System\avKWVKv.exe
  2⤵
  PID:8584
- C:\Windows\System\kkMxnoj.exe
  C:\Windows\System\kkMxnoj.exe
  2⤵
  PID:8512
- C:\Windows\System\UghpkLt.exe
  C:\Windows\System\UghpkLt.exe
  2⤵
  PID:8680
- C:\Windows\System\gognGXL.exe
  C:\Windows\System\gognGXL.exe
  2⤵
  PID:8744
- C:\Windows\System\CWEVbvZ.exe
  C:\Windows\System\CWEVbvZ.exe
  2⤵
  PID:8808
- C:\Windows\System\XUYcddb.exe
  C:\Windows\System\XUYcddb.exe
  2⤵
  PID:8532
- C:\Windows\System\ROQWPYQ.exe
  C:\Windows\System\ROQWPYQ.exe
  2⤵
  PID:8724
- C:\Windows\System\yizrQRq.exe
  C:\Windows\System\yizrQRq.exe
  2⤵
  PID:8900
- C:\Windows\System\bBzPugu.exe
  C:\Windows\System\bBzPugu.exe
  2⤵
  PID:8568
- C:\Windows\System\gwVEDik.exe
  C:\Windows\System\gwVEDik.exe
  2⤵
  PID:8692
- C:\Windows\System\oCVRQrN.exe
  C:\Windows\System\oCVRQrN.exe
  2⤵
  PID:9000
- C:\Windows\System\IrxszpF.exe
  C:\Windows\System\IrxszpF.exe
  2⤵
  PID:8696
- C:\Windows\System\GoKvQwR.exe
  C:\Windows\System\GoKvQwR.exe
  2⤵
  PID:8820
- C:\Windows\System\LXSucGW.exe
  C:\Windows\System\LXSucGW.exe
  2⤵
  PID:8980
- C:\Windows\System\hgNjyWT.exe
  C:\Windows\System\hgNjyWT.exe
  2⤵
  PID:8916
- C:\Windows\System\RosxAwO.exe
  C:\Windows\System\RosxAwO.exe
  2⤵
  PID:8852
- C:\Windows\System\gszgaVf.exe
  C:\Windows\System\gszgaVf.exe
  2⤵
  PID:9052
- C:\Windows\System\FxDWnRv.exe
  C:\Windows\System\FxDWnRv.exe
  2⤵
  PID:9100
- C:\Windows\System\RzDXdfU.exe
  C:\Windows\System\RzDXdfU.exe
  2⤵
  PID:7820
- C:\Windows\System\iSLyygt.exe
  C:\Windows\System\iSLyygt.exe
  2⤵
  PID:9144
- C:\Windows\System\Hflybop.exe
  C:\Windows\System\Hflybop.exe
  2⤵
  PID:9176
- C:\Windows\System\oNwraoJ.exe
  C:\Windows\System\oNwraoJ.exe
  2⤵
  PID:8204
- C:\Windows\System\UwFoTda.exe
  C:\Windows\System\UwFoTda.exe
  2⤵
  PID:8252
- C:\Windows\System\aYZMimh.exe
  C:\Windows\System\aYZMimh.exe
  2⤵
  PID:9208
- C:\Windows\System\mVpFZdG.exe
  C:\Windows\System\mVpFZdG.exe
  2⤵
  PID:8272
- C:\Windows\System\GPAazOm.exe
  C:\Windows\System\GPAazOm.exe
  2⤵
  PID:8464
- C:\Windows\System\PbCpchZ.exe
  C:\Windows\System\PbCpchZ.exe
  2⤵
  PID:8552
- C:\Windows\System\tZlqCUJ.exe
  C:\Windows\System\tZlqCUJ.exe
  2⤵
  PID:8564
- C:\Windows\System\wSswiNl.exe
  C:\Windows\System\wSswiNl.exe
  2⤵
  PID:8516
- C:\Windows\System\XfYZNsV.exe
  C:\Windows\System\XfYZNsV.exe
  2⤵
  PID:8676
- C:\Windows\System\XtzxKwO.exe
  C:\Windows\System\XtzxKwO.exe
  2⤵
  PID:8932
- C:\Windows\System\pPMbvJZ.exe
  C:\Windows\System\pPMbvJZ.exe
  2⤵
  PID:8600
- C:\Windows\System\yYiuvsu.exe
  C:\Windows\System\yYiuvsu.exe
  2⤵
  PID:8628
- C:\Windows\System\VSFPteO.exe
  C:\Windows\System\VSFPteO.exe
  2⤵
  PID:8788
- C:\Windows\System\GWxFRAr.exe
  C:\Windows\System\GWxFRAr.exe
  2⤵
  PID:9036
- C:\Windows\System\zfFNOVZ.exe
  C:\Windows\System\zfFNOVZ.exe
  2⤵
  PID:9080
- C:\Windows\System\gSjVnHV.exe
  C:\Windows\System\gSjVnHV.exe
  2⤵
  PID:9164
- C:\Windows\System\BxzzsfT.exe
  C:\Windows\System\BxzzsfT.exe
  2⤵
  PID:9096
- C:\Windows\System\MhCCwyB.exe
  C:\Windows\System\MhCCwyB.exe
  2⤵
  PID:9196
- C:\Windows\System\GQTYDqc.exe
  C:\Windows\System\GQTYDqc.exe
  2⤵
  PID:9212
- C:\Windows\System\xTQCmPx.exe
  C:\Windows\System\xTQCmPx.exe
  2⤵
  PID:8776
- C:\Windows\System\ejmCyTJ.exe
  C:\Windows\System\ejmCyTJ.exe
  2⤵
  PID:8840
- C:\Windows\System\DiZpClz.exe
  C:\Windows\System\DiZpClz.exe
  2⤵
  PID:8460
- C:\Windows\System\BfFENti.exe
  C:\Windows\System\BfFENti.exe
  2⤵
  PID:8664
- C:\Windows\System\MfQoopp.exe
  C:\Windows\System\MfQoopp.exe
  2⤵
  PID:8824
- C:\Windows\System\NMYICcx.exe
  C:\Windows\System\NMYICcx.exe
  2⤵
  PID:8336
- C:\Windows\System\rlZQYWe.exe
  C:\Windows\System\rlZQYWe.exe
  2⤵
  PID:8412
- C:\Windows\System\ozaAkMD.exe
  C:\Windows\System\ozaAkMD.exe
  2⤵
  PID:9148
- C:\Windows\System\HxGCdWg.exe
  C:\Windows\System\HxGCdWg.exe
  2⤵
  PID:8712
- C:\Windows\System\KqSpGaE.exe
  C:\Windows\System\KqSpGaE.exe
  2⤵
  PID:8920
- C:\Windows\System\CLNPenP.exe
  C:\Windows\System\CLNPenP.exe
  2⤵
  PID:8756
- C:\Windows\System\Wjzhpkc.exe
  C:\Windows\System\Wjzhpkc.exe
  2⤵
  PID:8380
- C:\Windows\System\AMOoHVO.exe
  C:\Windows\System\AMOoHVO.exe
  2⤵
  PID:9228
- C:\Windows\System\NRKYeZD.exe
  C:\Windows\System\NRKYeZD.exe
  2⤵
  PID:9244
- C:\Windows\System\FqEPGnf.exe
  C:\Windows\System\FqEPGnf.exe
  2⤵
  PID:9260
- C:\Windows\System\MkFUpwa.exe
  C:\Windows\System\MkFUpwa.exe
  2⤵
  PID:9276
- C:\Windows\System\GvwQcIH.exe
  C:\Windows\System\GvwQcIH.exe
  2⤵
  PID:9292
- C:\Windows\System\rOfeiwb.exe
  C:\Windows\System\rOfeiwb.exe
  2⤵
  PID:9308
- C:\Windows\System\bhocAUu.exe
  C:\Windows\System\bhocAUu.exe
  2⤵
  PID:9324
- C:\Windows\System\pWxgXtM.exe
  C:\Windows\System\pWxgXtM.exe
  2⤵
  PID:9340
- C:\Windows\System\GNBSnOC.exe
  C:\Windows\System\GNBSnOC.exe
  2⤵
  PID:9356
- C:\Windows\System\RGVcMov.exe
  C:\Windows\System\RGVcMov.exe
  2⤵
  PID:9372
- C:\Windows\System\WbQneRw.exe
  C:\Windows\System\WbQneRw.exe
  2⤵
  PID:9388
- C:\Windows\System\DxlDKUh.exe
  C:\Windows\System\DxlDKUh.exe
  2⤵
  PID:9404
- C:\Windows\System\RlNUvVC.exe
  C:\Windows\System\RlNUvVC.exe
  2⤵
  PID:9420
- C:\Windows\System\wvnrXkp.exe
  C:\Windows\System\wvnrXkp.exe
  2⤵
  PID:9436
- C:\Windows\System\xzjnxWt.exe
  C:\Windows\System\xzjnxWt.exe
  2⤵
  PID:9452
- C:\Windows\System\IUJhkKZ.exe
  C:\Windows\System\IUJhkKZ.exe
  2⤵
  PID:9468
- C:\Windows\System\qhkaJyM.exe
  C:\Windows\System\qhkaJyM.exe
  2⤵
  PID:9484
- C:\Windows\System\PhpDxBk.exe
  C:\Windows\System\PhpDxBk.exe
  2⤵
  PID:9500
- C:\Windows\System\lGyvhym.exe
  C:\Windows\System\lGyvhym.exe
  2⤵
  PID:9516
- C:\Windows\System\ioaBgAr.exe
  C:\Windows\System\ioaBgAr.exe
  2⤵
  PID:9532
- C:\Windows\System\DKmdYeQ.exe
  C:\Windows\System\DKmdYeQ.exe
  2⤵
  PID:9548
- C:\Windows\System\aGGZvqo.exe
  C:\Windows\System\aGGZvqo.exe
  2⤵
  PID:9564
- C:\Windows\System\WQRGPhF.exe
  C:\Windows\System\WQRGPhF.exe
  2⤵
  PID:9580
- C:\Windows\System\YRsaqHg.exe
  C:\Windows\System\YRsaqHg.exe
  2⤵
  PID:9596
- C:\Windows\System\UaEzsXJ.exe
  C:\Windows\System\UaEzsXJ.exe
  2⤵
  PID:9612
- C:\Windows\System\ARuBmnK.exe
  C:\Windows\System\ARuBmnK.exe
  2⤵
  PID:9628
- C:\Windows\System\GWmNizI.exe
  C:\Windows\System\GWmNizI.exe
  2⤵
  PID:9644
- C:\Windows\System\PPPTUcN.exe
  C:\Windows\System\PPPTUcN.exe
  2⤵
  PID:9660
- C:\Windows\System\zOPlTkF.exe
  C:\Windows\System\zOPlTkF.exe
  2⤵
  PID:9676
- C:\Windows\System\ngcIEGC.exe
  C:\Windows\System\ngcIEGC.exe
  2⤵
  PID:9692
- C:\Windows\System\jgrnFJk.exe
  C:\Windows\System\jgrnFJk.exe
  2⤵
  PID:9712
- C:\Windows\System\gQjNhxI.exe
  C:\Windows\System\gQjNhxI.exe
  2⤵
  PID:9728
- C:\Windows\System\UNPZlzQ.exe
  C:\Windows\System\UNPZlzQ.exe
  2⤵
  PID:9744
- C:\Windows\System\AOthhjd.exe
  C:\Windows\System\AOthhjd.exe
  2⤵
  PID:9760
- C:\Windows\System\JoIVEZL.exe
  C:\Windows\System\JoIVEZL.exe
  2⤵
  PID:9776
- C:\Windows\System\YvzGPaY.exe
  C:\Windows\System\YvzGPaY.exe
  2⤵
  PID:9792
- C:\Windows\System\zjtgyBg.exe
  C:\Windows\System\zjtgyBg.exe
  2⤵
  PID:9808
- C:\Windows\System\UjCQpsJ.exe
  C:\Windows\System\UjCQpsJ.exe
  2⤵
  PID:9824
- C:\Windows\System\cKtnZAb.exe
  C:\Windows\System\cKtnZAb.exe
  2⤵
  PID:9840
- C:\Windows\System\qIpoULb.exe
  C:\Windows\System\qIpoULb.exe
  2⤵
  PID:9856
- C:\Windows\System\QlpIHwe.exe
  C:\Windows\System\QlpIHwe.exe
  2⤵
  PID:9872
- C:\Windows\System\dPQEPXg.exe
  C:\Windows\System\dPQEPXg.exe
  2⤵
  PID:9888
- C:\Windows\System\gXFqVdB.exe
  C:\Windows\System\gXFqVdB.exe
  2⤵
  PID:9904
- C:\Windows\System\VVUkcRd.exe
  C:\Windows\System\VVUkcRd.exe
  2⤵
  PID:9920
- C:\Windows\System\nonkBaw.exe
  C:\Windows\System\nonkBaw.exe
  2⤵
  PID:9936
- C:\Windows\System\wEHuGWQ.exe
  C:\Windows\System\wEHuGWQ.exe
  2⤵
  PID:9952
- C:\Windows\System\WUvgiPj.exe
  C:\Windows\System\WUvgiPj.exe
  2⤵
  PID:9968
- C:\Windows\System\xMsnLLv.exe
  C:\Windows\System\xMsnLLv.exe
  2⤵
  PID:9984
- C:\Windows\System\pVRleAP.exe
  C:\Windows\System\pVRleAP.exe
  2⤵
  PID:10000
- C:\Windows\System\TgGfsdv.exe
  C:\Windows\System\TgGfsdv.exe
  2⤵
  PID:10020
- C:\Windows\System\bRYSyhE.exe
  C:\Windows\System\bRYSyhE.exe
  2⤵
  PID:10040
- C:\Windows\System\lSCjYRx.exe
  C:\Windows\System\lSCjYRx.exe
  2⤵
  PID:10056
- C:\Windows\System\KwUvoyd.exe
  C:\Windows\System\KwUvoyd.exe
  2⤵
  PID:10076
- C:\Windows\System\dOtrBdV.exe
  C:\Windows\System\dOtrBdV.exe
  2⤵
  PID:10092
- C:\Windows\System\udKofMx.exe
  C:\Windows\System\udKofMx.exe
  2⤵
  PID:10108
- C:\Windows\System\ZwRwYHW.exe
  C:\Windows\System\ZwRwYHW.exe
  2⤵
  PID:10124
- C:\Windows\System\dAmhMcW.exe
  C:\Windows\System\dAmhMcW.exe
  2⤵
  PID:10148
- C:\Windows\System\qDoVCnF.exe
  C:\Windows\System\qDoVCnF.exe
  2⤵
  PID:10164
- C:\Windows\System\yttagSC.exe
  C:\Windows\System\yttagSC.exe
  2⤵
  PID:10188
- C:\Windows\System\IvOieeB.exe
  C:\Windows\System\IvOieeB.exe
  2⤵
  PID:10204
- C:\Windows\System\QEQEZMJ.exe
  C:\Windows\System\QEQEZMJ.exe
  2⤵
  PID:10220
- C:\Windows\System\novAUPE.exe
  C:\Windows\System\novAUPE.exe
  2⤵
  PID:10236
- C:\Windows\System\ffcwnBn.exe
  C:\Windows\System\ffcwnBn.exe
  2⤵
  PID:8644
- C:\Windows\System\LuVAPYH.exe
  C:\Windows\System\LuVAPYH.exe
  2⤵
  PID:9284
- C:\Windows\System\PnGvfmI.exe
  C:\Windows\System\PnGvfmI.exe
  2⤵
  PID:9316
- C:\Windows\System\EcxfcDa.exe
  C:\Windows\System\EcxfcDa.exe
  2⤵
  PID:9272
- C:\Windows\System\hWcLMgW.exe
  C:\Windows\System\hWcLMgW.exe
  2⤵
  PID:9304
- C:\Windows\System\VdrLWwK.exe
  C:\Windows\System\VdrLWwK.exe
  2⤵
  PID:9336
- C:\Windows\System\zEtBaoe.exe
  C:\Windows\System\zEtBaoe.exe
  2⤵
  PID:9444
- C:\Windows\System\CmZnDrt.exe
  C:\Windows\System\CmZnDrt.exe
  2⤵
  PID:9508
- C:\Windows\System\RdVxrqO.exe
  C:\Windows\System\RdVxrqO.exe
  2⤵
  PID:9400
- C:\Windows\System\aFKQndl.exe
  C:\Windows\System\aFKQndl.exe
  2⤵
  PID:9512
- C:\Windows\System\tKRzwdQ.exe
  C:\Windows\System\tKRzwdQ.exe
  2⤵
  PID:9524
- C:\Windows\System\DJuJPgr.exe
  C:\Windows\System\DJuJPgr.exe
  2⤵
  PID:9576
- C:\Windows\System\ufdHUBU.exe
  C:\Windows\System\ufdHUBU.exe
  2⤵
  PID:9640
- C:\Windows\System\sQPDdxT.exe
  C:\Windows\System\sQPDdxT.exe
  2⤵
  PID:9700
- C:\Windows\System\QqlSMCY.exe
  C:\Windows\System\QqlSMCY.exe
  2⤵
  PID:9652
- C:\Windows\System\pAIwgsA.exe
  C:\Windows\System\pAIwgsA.exe
  2⤵
  PID:9592
- C:\Windows\System\EEJsjgC.exe
  C:\Windows\System\EEJsjgC.exe
  2⤵
  PID:9684
- C:\Windows\System\VzPnYjK.exe
  C:\Windows\System\VzPnYjK.exe
  2⤵
  PID:9800
- C:\Windows\System\MdgGixV.exe
  C:\Windows\System\MdgGixV.exe
  2⤵
  PID:9816
- C:\Windows\System\PWaAMiU.exe
  C:\Windows\System\PWaAMiU.exe
  2⤵
  PID:9916
- C:\Windows\System\ExlBsmr.exe
  C:\Windows\System\ExlBsmr.exe
  2⤵
  PID:9016
- C:\Windows\System\TpdeRfy.exe
  C:\Windows\System\TpdeRfy.exe
  2⤵
  PID:10064
- C:\Windows\System\QmygTCt.exe
  C:\Windows\System\QmygTCt.exe
  2⤵
  PID:10136
- C:\Windows\System\nifkkxK.exe
  C:\Windows\System\nifkkxK.exe
  2⤵
  PID:10088
- C:\Windows\System\mMrNOyu.exe
  C:\Windows\System\mMrNOyu.exe
  2⤵
  PID:10184
- C:\Windows\System\QeUAvWO.exe
  C:\Windows\System\QeUAvWO.exe
  2⤵
  PID:10160
- C:\Windows\System\LGNykdD.exe
  C:\Windows\System\LGNykdD.exe
  2⤵
  PID:10232
- C:\Windows\System\lYyNfqI.exe
  C:\Windows\System\lYyNfqI.exe
  2⤵
  PID:6840
- C:\Windows\System\EERvlac.exe
  C:\Windows\System\EERvlac.exe
  2⤵
  PID:9496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjvZVKV.exe

Filesize
1.4MB

MD5
ece86f1dc34de22d89407e00b062d098

SHA1
e3ad9fdf29b9e6938a0af455063fa1b852aaaf8d

SHA256
0479b9793819e8cefd8f742e812d6021b00d9b1f5e1e75acb9e91dc2a1c1d105

SHA512
c81bc4a3ffc4611db01c3edd69aad649337b028493f02ff27263a32e4b9a120bdec7281642d71688746424641b45167e974948a618f49ac2292980f23a9d257f

Download Submit
C:\Windows\system\BApUATe.exe

Filesize
1.4MB

MD5
67a80e0fa95499dfb035f3b2bc6fabf5

SHA1
6fa5c23fa76db037a2efecc205481e0fe8fdee55

SHA256
394402c6c88bec513ced9f43db0ff367eb291d0621b8691e074642fdcf1dc91e

SHA512
73d32e84a24534de6092dcc8a008bda2f46142191b7f57f5471ebe1a442c9afed02bdf1e2a0ce172a6646471fb3ef97e4b5dd7e911c5822e308515728e3868b5

Download Submit
C:\Windows\system\BjplCpA.exe

Filesize
1.4MB

MD5
bebc8f3c62dce3c02e7e2c3c3709eb33

SHA1
05d7b8b84891471ba8946d291ca6dff323e476c9

SHA256
e39525b6db26b246d65cb85b49de43a8f6cfc2a7465fa68d4f464346229e0ca3

SHA512
4243a7c8e9b0b1223816e6b3413a42e14b2727bf4ff3db12a2e16613bb9c24d76b1b65939db0205c77fe2467abaf169f097f5815488e988f474091edfde5e21c

Download Submit
C:\Windows\system\EqBkUIW.exe

Filesize
1.4MB

MD5
275ee61bb307bb5383954a16954fd0c5

SHA1
8876eac103541f8ce95615640c8a55f6e6f5cfd1

SHA256
aeac3e6d29dad1f5683698da46cee5ac6130bffc70a409fced29bc4c4e38f784

SHA512
4bc76d7dad61ff1872a911db028ae16a9071f8d49527159de2ba545c9654e411474cc4ea6ef8f2d41b58ae3e4a522e612d93cf00d65ca25978f68ca3777b725b

Download Submit
C:\Windows\system\NaKigXG.exe

Filesize
1.4MB

MD5
812dfd3e7b912386ff006a0af6f47834

SHA1
a8c9d398544ace2fce53c580ae3ca8fbc719de10

SHA256
263d328e3fc2512036cbb100d783e0319b3c56e5ee74decbab188a98e7b841bd

SHA512
d490282e8e72db89e5e2b44aee1bea0a0020dff0f609c401cc4958fc795fe0501edf2c97680592a33215dad131322af99cc1abeef17659de3f8eafe6fe9e8176

Download Submit
C:\Windows\system\PxcqSSr.exe

Filesize
1.4MB

MD5
ace18a38f3740778560ea5aa0a297596

SHA1
f99eb217036e4969a6966acb893ade0e54ed9739

SHA256
b933145f9a9ee6442619a891b09ccb6d0d05d7c5e464c429cd664046a2e92b8c

SHA512
0f8b27067667463cc6bb188552a20a704c0cf1dd7bf5f105810cd15471755d1dd4923a143d9f600f671ba5f1af0909f5f0172465cf68969d65a3903b819a2717

Download Submit
C:\Windows\system\RkEKgVo.exe

Filesize
1.4MB

MD5
13023578a1d4263e4c4107911c4e8518

SHA1
594c8aaaf1a860ce48e89f321481d6b83b22c5e8

SHA256
0a84e3449d2f97b238a5420e729455dc059701cf0f085b1754ed686ec6c2e465

SHA512
80f869970742323adbbefa95e5f2479fe00d7c837f692aa68d4b9a9a485454c12575067d3e3f49984727384a07aa92c5335e4e6ac33e4e4132067d274eb14cde

Download Submit
C:\Windows\system\SfDbAei.exe

Filesize
1.4MB

MD5
27ff9e25bd1ff5ebd8fd60b1e2feb873

SHA1
c0f72df316dd5282e251d6d53487f1e86e17f171

SHA256
9aff4053f68567178de1cbaf04deb06e1a8257a9739d2db4dc5e509e4ee6b39a

SHA512
3127f573620e0dd454d6088fd221943641987fc6f38b705df9bc14bf891cc436a37b202fc7ed21e3ea4533760339c2c5caf87e8c348e3d8489a2a512b6efe94f

Download Submit
C:\Windows\system\TXGEYje.exe

Filesize
1.4MB

MD5
33751d0c86abdad5c86806af5ddc3080

SHA1
680a05de9354d4ce97892b8ff93bab0abc7974f8

SHA256
3e3de6f6a6b389ea23333d3351371c87ad09f5dfcdd90b35e88b4138f16c9a5c

SHA512
acbabd18b8b83e0e5efd14fa25be7d2a3b5b095a22e5f80fa029085af3e9c6ce9d91e32da7047558a819ec8271f5f0479080b79647544478082108c4e6ac6bdb

Download Submit
C:\Windows\system\TXYZHGW.exe

Filesize
1.4MB

MD5
a80d3cdcadb81518ac97ed96a082fc61

SHA1
d49c8c0b0d4d5e46ac03657742374e7472ad71c6

SHA256
e21c82b4d9238238bc9df64f9a84ff61c135127911cddec3fc7e0e58487ce6d9

SHA512
15d57ddeb4a4eadaf64ce3ad6c6d677f763d6661d46cbfc82c054b32b57ec6065203eef580ff08a0b27aba6830bbba7dbe6951d50718d347cb33c520b076a619

Download Submit
C:\Windows\system\TlShvuM.exe

Filesize
1.4MB

MD5
0ed65683a203c4a92d6fdeac35f10159

SHA1
fd997379204a1362145dafac35f313006c6545cf

SHA256
f8d6291b0ea672cf578a37ab6d9ef004910d38680f1f8109bae9af5222d1024c

SHA512
21e54afa5f65352360df0035dbda2fa6b58a843c7a8192925699fa91401f301bb017b3f1e441c5493ac0101f4b877164aa7d9f14da89b38da91b58671fbae7d8

Download Submit
C:\Windows\system\VELXHXS.exe

Filesize
1.4MB

MD5
7d6d68c438b4178c48a486ca10961f3a

SHA1
b73efb7b3c6b61c822ec929ddb08878520055039

SHA256
f9bff7ea812d4312d51da4e8af1f8b2b7a583c48a1cf313d7713c0d6902856c4

SHA512
f67db4f46762391294cc128a6b8f45e28fa0940616f0ec2061c839b8cc83b5339a755b644213f6472b85564a125617dfed3940ccd8c615db5d7dbc10fdbd0bf6

Download Submit
C:\Windows\system\aQHVuda.exe

Filesize
1.4MB

MD5
3f8746a22879cf7fb0b81ace383e20a0

SHA1
b52f129217ee2f87c7d5e9b2f293732b6374962a

SHA256
0ea33024577b94af05ed17bb1f5bf5b1fa46bf4346f774fbf387693913099cc1

SHA512
8102fea3a6c4a538015cd16b2759e7065d90225c6f5cadc3927e8fd03fd1643ff42cc20092a66ed1462db838a8196af41eccd8fb6b9df2fbdaebb099abba1714

Download Submit
C:\Windows\system\dgCNUlT.exe

Filesize
1.4MB

MD5
4e3da9f41530353dee15f11806ab4798

SHA1
f9dbbe3b3b24f6a75aee67d59dceee4e76b2a8db

SHA256
81934799ef5e80aca22a70f3b0837f138aeaf9f16299015170dc4bc8e4af09ec

SHA512
191f9c01dbfe7527fb22bac8bdf341b8432cfe8a9760bea06a2f70b45f0ad7c084db2514f02aacb4c0ff8662d8a75e4518011030cbc3b0c268ab86a81f217323

Download Submit
C:\Windows\system\eubGnvK.exe

Filesize
1.4MB

MD5
e3fcd3b98b6265105bb6ce6db3dfb4ee

SHA1
9920cdc4be10c1567dbfe1c89ccf348d5bcd4870

SHA256
3f29e8e33bbf48de8f860d141907caaa8ffcda17b262278abd82f9386cf786f4

SHA512
618d51e6923cb9bf0a14dd86ce33075f3f8a701e59b6ee7b57cdb96580a68c91f4e3d96a43505382bd5a5d4cae36cf45b608225ba9ce39fa015aa471fdc0c3e4

Download Submit
C:\Windows\system\hGZhNMi.exe

Filesize
1.4MB

MD5
b2ca26f9bafbbb641d89e0d51c52318d

SHA1
cb3517b691107cdbe7ca716b69423a07e4ea062f

SHA256
322f71c4e7c90018e97173addea37d9e1499e1e8be7eb0c32e4639e37baf501a

SHA512
b0570583edc4221781ce6b0f93c35d7203287e5cc8ae680fa546ea553bcd9c117f7557a9a28abc321047f234592b4f78e3cefb8825662a4fa8e5dc9a3359d072

Download Submit
C:\Windows\system\kazVRsu.exe

Filesize
1.4MB

MD5
7efb81b63c11c95d2f3745c5ec9b17bc

SHA1
adff270537cd72e5fa895b9bed4e0b830e52e3b2

SHA256
3521b15c11aac9fd9558ba12391a3d98737c1acc02a8e78f337b74fc25a70b8a

SHA512
314fbc67d66c9266c1b0c4c0763256af301bae655ac9c840ad1fd9a5cf2ed021559c51eb247cb0a171a6628cc3297fbe373d86cb3dccc10708e0e3974829bf11

Download Submit
C:\Windows\system\lCVDCMe.exe

Filesize
1.4MB

MD5
d29fb364a799e6ea3b0a59cc7d2a3426

SHA1
181956669dc9fc8dfc01f93b08b6b171a2167229

SHA256
b314b365fda312f2e99427959a0f68fe01b9cee29e1f668768dcc46841e0bcd7

SHA512
302242cf5b09064c5b38dcf8bfbbff3c1bab6417b0db4925dd2508da059877d4529b98804b436d15c011de22275f23eba765668614e379c7433ce1a3cbe4efca

Download Submit
C:\Windows\system\mlpmggT.exe

Filesize
1.4MB

MD5
8182e7f302852d282aebe7327c26a569

SHA1
988b669f92e93c8a5c5dbc6d1f2178df840bae01

SHA256
24dcb431ae839bc6c8d2296f66559287d2bdc2dcd8c15f3c317078b0411e5d5d

SHA512
0573c5369ae4c8b6d0915995f70716c3a2342d5bb339a122bce79a5361e6a0e2b35a0f59ab32ae9542c366bf2277224a00b288c88f70b966e486d5d3b20e5871

Download Submit
C:\Windows\system\nCzSqsw.exe

Filesize
1.4MB

MD5
7e9cb4422e2d4735f54cae431fd73135

SHA1
c4384b17208a90c7d865be82774b15524a8d1185

SHA256
5b1e9aa7ca39dfdc7be9c8e1d9a4875ceb4d2a8c64df92b156161ea9652fa23e

SHA512
96f32ac3e8bfc1555e1326dc88a998dec86381d9a0da08a243843b5f09bbe352e18842e1ba553aea22c246141b1b477aaba2ef33fa21bf2dbbfb9c9ac9e22e19

Download Submit
C:\Windows\system\rInOHkN.exe

Filesize
1.4MB

MD5
95094d0e3b9a31decd643412ddeab50f

SHA1
c31099fa56eaf484c6c0a6021fb42e883d1a8ddc

SHA256
a1e04166339e989442c8c8a66920a6d777038239c9303908712de0f8bed57120

SHA512
4b10702d65ad88255d4801d4351068553031fc1f32dedb56a9d8ab479388ca868eb884408efa540f377757a291183eff6308ca7ede2f3fc5c69f4e7c16835d71

Download Submit
C:\Windows\system\rIophtx.exe

Filesize
1.4MB

MD5
26dbb6b0cb89cb6d8d5dd49458133e23

SHA1
5cdc5398109cc22bb40a545b8065e76ed5044c31

SHA256
65f93c5065c6de88e39e508ac75bc26ed187aa2d7b901ec4b6e1b0f4e54eb677

SHA512
fa97e97745f18d1677b6a6a10e3c311536b61b74efeae72c769caea78b42e0296e65dd59d949a5ef6b74d32169002363332e1cef710833a026a714c1c05327cd

Download Submit
C:\Windows\system\shVealy.exe

Filesize
1.4MB

MD5
e385b9a865774899f91bd68d1a5f0492

SHA1
ea88e22737ec7dbc70a310307cf61b32699a27f1

SHA256
401fa288843dcea70827fbe2bbe9e66a58f5cfbb439159b28baad33d6be52809

SHA512
7a3c7c4918b3c7f6513cf28d4a684446f497e1bc5fc15a43a3d976014ae62f375c2cea37ea259d855e3466d0e22f494356fbc959cce2ad0292fea8e5a28ecb06

Download Submit
C:\Windows\system\syDftTU.exe

Filesize
1.4MB

MD5
bb16aa151bcec1d61bd93de2dbbed8f9

SHA1
848f44f27757e1a217e8afe5897b253957d61373

SHA256
565bb5e9b43e6ab70fb562c356c7b415437cf5d6725c1bcd29b5cd3f6648cfb8

SHA512
2aa880f501c38f19fd0f6569e6350ab876a7e5d8dac29187c8e3ce667e17d1d7597d7b30f9c9846d6466fb1bf97153d5928313f6429923823cb080963363fe1d

Download Submit
C:\Windows\system\trStYFU.exe

Filesize
1.4MB

MD5
00c2501ef6fe035705d7547e1a95ca15

SHA1
b78336ee600addfb9061dc6fc65d15dcaa83a41c

SHA256
9cc21ab3f8fcb2371d9417023d79962f1de86fb2ee06490515e96dd23dbb24e8

SHA512
1bdd674275d83bd82b51af90268b07a91ad4d5d87638ae58fc8da4969bd11c673ca3de3ff1fb76b76f2a78c9111a1041388a6af8e0ed3c26072806c75af70f9f

Download Submit
C:\Windows\system\uZtXFHj.exe

Filesize
1.4MB

MD5
438f8abade39e5df08488eb4f4d5c710

SHA1
761257f272a50506309b515b08bdb46a44ae2760

SHA256
c1518cd4bb57656a234c9521400f103746e783bb453bf42ec968fa0b6345baa8

SHA512
2c192654c0a58ae9121211cf0ed537a2729fde37086da6d4a899b633f25fb348f5dc7e356e4222ff09b824987eee47862fb19bbc03c1d3c700b7a898139bc449

Download Submit
C:\Windows\system\wFkIzOk.exe

Filesize
1.4MB

MD5
ea2da4f0d780fb717d8fb60c806af6be

SHA1
186a8750bb31e8fa909d73ff42b9a959c96e9503

SHA256
b1d90494dba15313e0f49e9cee48f9cddd83421920696f1d8d34332381c4ad04

SHA512
6720d88c50fd7617e5c3e22517f49c997e0f81b4c23fa52cc273fda6319c6c88e3869ad08118febe8a3e8adfb4b068b388f597d05220098dd1e88116aeb4bb31

Download Submit
C:\Windows\system\wfpEwrA.exe

Filesize
1.4MB

MD5
955ddca217bf99705d45b6fb4e27807e

SHA1
29e4737f7980d46efd1fd74379b47ba7a7f4a0f1

SHA256
23ae289a2c0cc142d7acb861230f8b98f19f4c533d7bd87ffdda015798b0d337

SHA512
f0b75a8358f946a107457556378231d78a5365198bb259f019b3f5f1bbb1f87da835a0b0fa205abf3474217b3e8b934687af222f81048db09c957cceae0abdc5

Download Submit
C:\Windows\system\wyhLKVp.exe

Filesize
1.4MB

MD5
f3c8665ab0f8b330e8ac4936efd2222a

SHA1
d82096ccb86d6dac4df2081882ff8aa41aae29bf

SHA256
76c17fcf7d47b3a627856f705c351ba93bad10968e9397d7fd6580ad584ac267

SHA512
6280e74e97981858db1685c21b492dc8a5ed0990ef47909359fdb8013fc77b940087c2cb8c38751d99a59ca4124eb780687968bf8a0643914578d6cb65093cba

Download Submit
C:\Windows\system\xxsXFap.exe

Filesize
1.4MB

MD5
c55f7099f8e1b7b3a35a915b2d523227

SHA1
86d86571dbef1652fb4887bd8716aaa72ca994d8

SHA256
6b46b2febd371828722e06e33c6eaa1c7083e29ad95be89ae87e592fb9c335d8

SHA512
99a1fd69038d370c34136ff4bd19d92da586f03f62a64912ac1d7e3faa01969ed163159d1c1b9f823f95a7a8c963faf0beacf845c14a94f01c3d0e4a874d1a98

Download Submit
C:\Windows\system\zOXRXhz.exe

Filesize
1.4MB

MD5
bf7f8ca316bf25d31730e93dc1c7ee8f

SHA1
ad1238c70f4b2769a5c7301f215d56b942bf8a31

SHA256
779bb26299267d5f687ed0d931920da886d31c40eb6effc74ecb684e98d60b59

SHA512
76cb0c75dceb8bcc3bd8626cb500452251a93846b138c66f653ff783e60823f5c57c19cc21b73baf03017538a74fc1104fcbedf95fa59c93e5de892942fb8c65

Download Submit
\Windows\system\deSXjNU.exe

Filesize
1.4MB

MD5
ed7f0c47f5e770922dd7062787d95ada

SHA1
e27dcfb0318c01f6aae8b0fc609b01be35114a2a

SHA256
bfc120d9834d28ff21a41984f8bed3599f59eb65072acc32382c7ea371c3eacb

SHA512
45399f66cf23d3fe04e58891e49411a663cda6d250d1f66074155e4cedee24ff1adaf140d5ea3bf9dbad8f52ae72a9c6e082276659054391230a12696e0146c3

Download Submit
memory/2684-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download