xmrig | 81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/01/2025, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
Size

1.5MB
MD5

15af88f7417ae79fda6794cf5a4dd24e
SHA1

b5ac08ab3f54be838354d2d33d6db94938bfbbf2
SHA256

81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6
SHA512

d49ac137c205c82338a7596417c2312a20f6b66f3adba052c1f5e769603aa042c907044ef3ee890acd65c0704dd895515893909fa495f507087c203ecb760993
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BK4+3ZRjN/vaqjB:GezaTF8FcNkNdfE0pZ9ozttwIRakGKNN

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120ff-2.dat	xmrig
behavioral1/files/0x00070000000170b5-14.dat	xmrig
behavioral1/files/0x0007000000017546-19.dat	xmrig
behavioral1/files/0x00070000000175c6-24.dat	xmrig
behavioral1/files/0x0006000000019228-38.dat	xmrig
behavioral1/files/0x000500000001957c-53.dat	xmrig
behavioral1/files/0x0005000000019625-76.dat	xmrig
behavioral1/files/0x0005000000019c50-103.dat	xmrig
behavioral1/files/0x0005000000019d8b-123.dat	xmrig
behavioral1/files/0x0005000000019f4a-126.dat	xmrig
behavioral1/files/0x000500000001a325-152.dat	xmrig
behavioral1/files/0x000500000001a2e7-148.dat	xmrig
behavioral1/files/0x000500000001a08a-144.dat	xmrig
behavioral1/files/0x000500000001a061-140.dat	xmrig
behavioral1/files/0x000500000001a04e-136.dat	xmrig
behavioral1/files/0x0005000000019f4e-132.dat	xmrig
behavioral1/files/0x0005000000019cbf-118.dat	xmrig
behavioral1/files/0x0005000000019c68-113.dat	xmrig
behavioral1/files/0x0005000000019c66-108.dat	xmrig
behavioral1/files/0x0005000000019aee-98.dat	xmrig
behavioral1/files/0x0005000000019aec-94.dat	xmrig
behavioral1/files/0x0005000000019aea-88.dat	xmrig
behavioral1/files/0x00050000000197c1-83.dat	xmrig
behavioral1/files/0x0005000000019624-74.dat	xmrig
behavioral1/files/0x000500000001961f-68.dat	xmrig
behavioral1/files/0x000500000001961b-63.dat	xmrig
behavioral1/files/0x0005000000019589-59.dat	xmrig
behavioral1/files/0x000500000001953a-48.dat	xmrig
behavioral1/files/0x0005000000019515-43.dat	xmrig
behavioral1/files/0x0034000000018654-34.dat	xmrig
behavioral1/files/0x00070000000175cc-28.dat	xmrig
behavioral1/files/0x0008000000017051-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2812	TgdUJFC.exe
3040	LIhJwDV.exe
1720	NNWewDk.exe
2892	ChPXFna.exe
2948	PEItoRy.exe
2788	hZfjwED.exe
2768	TzoCblv.exe
2600	JOvWLoM.exe
2656	fPcHxoX.exe
1920	tCwUrCJ.exe
2540	zTyvTcZ.exe
2968	KXuOQNw.exe
1948	dWIAJjF.exe
2404	SUVtHTO.exe
1928	xrIkcyx.exe
1944	ilbMYSd.exe
2328	CoNaeoi.exe
2936	QnRBuHr.exe
2984	wbBwxhX.exe
2280	hHQxsoW.exe
2944	RJCMXWw.exe
2852	zhQUYto.exe
2636	CDqpEdt.exe
380	HvtBVIZ.exe
2872	CPYxQAJ.exe
2480	xGXwRZl.exe
2052	eEObHRB.exe
2176	EGzoAuZ.exe
2116	sdqJzvG.exe
2180	yavAXLd.exe
2580	wGNiNaE.exe
1208	RDRhpiM.exe
1956	yvsogRb.exe
1952	vfrFeze.exe
1936	wBJHvUG.exe
1448	QubehWH.exe
956	uKfXIlb.exe
668	BvEUhft.exe
2452	dfdTuxi.exe
2224	dbxCzDB.exe
1768	xSQyVCK.exe
1344	jDRkBio.exe
1572	dLfQvPn.exe
1668	bHyDUwa.exe
2396	dErrAKF.exe
1592	cpkyZCK.exe
752	jKpVrqJ.exe
640	CTXllNg.exe
2408	iPGwEje.exe
2360	QJeOAgJ.exe
2000	hzVDAkX.exe
2500	BVbLWPD.exe
1492	ckcmiZm.exe
1940	YPcXGvp.exe
2660	duaeoro.exe
2388	UPeOMor.exe
1636	bMmhQCj.exe
2400	avduqTf.exe
1036	jzVGhSf.exe
888	wWEECoQ.exe
1280	ISNmSbG.exe
1692	ZhMovfR.exe
2532	EpEYAdQ.exe
1684	kVsVZvj.exe

Loads dropped DLL 64 IoCs

pid	Process
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hhbnuLO.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\gIIDhcZ.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\WdGuisu.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\czMaOjS.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\mfzkZXu.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\WtjUmYw.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\Lvcpawt.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\KHDzxuK.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\fZyoQMH.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\PBOILgC.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\IoJfhoF.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\mbGaVke.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\PaYTygj.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\bxFFqFz.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\irKRaIM.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\HzBnWdN.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\ZmymjMo.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\Kdvehaf.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\ZnlxRnK.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\fEDpCnW.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\hhvrNBy.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\biiRtcY.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\NbXATDY.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\BoLZkpj.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\XaqSoTb.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\anjcnkj.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\yCdvBVt.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\yWkfJxz.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\AmSTMWd.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\HDMEDbU.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\QyncQdP.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\BARwLZb.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\sFSBAxN.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\jyIiCzR.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\YPHSauQ.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\ODNGtmp.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\IumJart.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\lvdIvmF.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\HMtYPHV.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\SdlELrm.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\mHuKbKi.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\TgdUJFC.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\LrHkHjE.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\gYiIlgV.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\IFkjRvY.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\LJInvCq.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\BzejHgA.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\eRDKsdg.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\eASgVCi.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\TgeadqA.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\IWScozy.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\xPVANEm.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\mxakuPV.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\xUDrrBi.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\abVaNts.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\cZBnXHF.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\JhmFyrP.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\vsxUizi.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\FOEnjbz.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\wZwzFQz.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\dOnZMJK.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\UtWlXot.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\AQcElKs.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
File created	C:\Windows\System\XqvuMTH.exe	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2812	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	31
PID 2708 wrote to memory of 2812	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	31
PID 2708 wrote to memory of 2812	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	31
PID 2708 wrote to memory of 3040	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	32
PID 2708 wrote to memory of 3040	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	32
PID 2708 wrote to memory of 3040	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	32
PID 2708 wrote to memory of 1720	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	33
PID 2708 wrote to memory of 1720	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	33
PID 2708 wrote to memory of 1720	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	33
PID 2708 wrote to memory of 2892	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	34
PID 2708 wrote to memory of 2892	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	34
PID 2708 wrote to memory of 2892	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	34
PID 2708 wrote to memory of 2948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	35
PID 2708 wrote to memory of 2948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	35
PID 2708 wrote to memory of 2948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	35
PID 2708 wrote to memory of 2788	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	36
PID 2708 wrote to memory of 2788	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	36
PID 2708 wrote to memory of 2788	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	36
PID 2708 wrote to memory of 2768	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	37
PID 2708 wrote to memory of 2768	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	37
PID 2708 wrote to memory of 2768	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	37
PID 2708 wrote to memory of 2600	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	38
PID 2708 wrote to memory of 2600	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	38
PID 2708 wrote to memory of 2600	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	38
PID 2708 wrote to memory of 2656	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	39
PID 2708 wrote to memory of 2656	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	39
PID 2708 wrote to memory of 2656	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	39
PID 2708 wrote to memory of 1920	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	40
PID 2708 wrote to memory of 1920	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	40
PID 2708 wrote to memory of 1920	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	40
PID 2708 wrote to memory of 2540	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	41
PID 2708 wrote to memory of 2540	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	41
PID 2708 wrote to memory of 2540	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	41
PID 2708 wrote to memory of 2968	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	42
PID 2708 wrote to memory of 2968	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	42
PID 2708 wrote to memory of 2968	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	42
PID 2708 wrote to memory of 1948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	43
PID 2708 wrote to memory of 1948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	43
PID 2708 wrote to memory of 1948	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	43
PID 2708 wrote to memory of 2404	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	44
PID 2708 wrote to memory of 2404	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	44
PID 2708 wrote to memory of 2404	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	44
PID 2708 wrote to memory of 1928	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	45
PID 2708 wrote to memory of 1928	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	45
PID 2708 wrote to memory of 1928	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	45
PID 2708 wrote to memory of 1944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	46
PID 2708 wrote to memory of 1944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	46
PID 2708 wrote to memory of 1944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	46
PID 2708 wrote to memory of 2328	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	47
PID 2708 wrote to memory of 2328	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	47
PID 2708 wrote to memory of 2328	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	47
PID 2708 wrote to memory of 2936	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	48
PID 2708 wrote to memory of 2936	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	48
PID 2708 wrote to memory of 2936	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	48
PID 2708 wrote to memory of 2984	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	49
PID 2708 wrote to memory of 2984	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	49
PID 2708 wrote to memory of 2984	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	49
PID 2708 wrote to memory of 2280	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	50
PID 2708 wrote to memory of 2280	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	50
PID 2708 wrote to memory of 2280	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	50
PID 2708 wrote to memory of 2944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	51
PID 2708 wrote to memory of 2944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	51
PID 2708 wrote to memory of 2944	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	51
PID 2708 wrote to memory of 2852	2708	81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe	52

C:\Users\Admin\AppData\Local\Temp\81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe
"C:\Users\Admin\AppData\Local\Temp\81d4aa78588ee1ed5ce29a0aa8152bf6486c99629da154a953c31a4462dbfce6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System\TgdUJFC.exe
  C:\Windows\System\TgdUJFC.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\LIhJwDV.exe
  C:\Windows\System\LIhJwDV.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\NNWewDk.exe
  C:\Windows\System\NNWewDk.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ChPXFna.exe
  C:\Windows\System\ChPXFna.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\PEItoRy.exe
  C:\Windows\System\PEItoRy.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\hZfjwED.exe
  C:\Windows\System\hZfjwED.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\TzoCblv.exe
  C:\Windows\System\TzoCblv.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JOvWLoM.exe
  C:\Windows\System\JOvWLoM.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\fPcHxoX.exe
  C:\Windows\System\fPcHxoX.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tCwUrCJ.exe
  C:\Windows\System\tCwUrCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\zTyvTcZ.exe
  C:\Windows\System\zTyvTcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\KXuOQNw.exe
  C:\Windows\System\KXuOQNw.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\dWIAJjF.exe
  C:\Windows\System\dWIAJjF.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SUVtHTO.exe
  C:\Windows\System\SUVtHTO.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\xrIkcyx.exe
  C:\Windows\System\xrIkcyx.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ilbMYSd.exe
  C:\Windows\System\ilbMYSd.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\CoNaeoi.exe
  C:\Windows\System\CoNaeoi.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\QnRBuHr.exe
  C:\Windows\System\QnRBuHr.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\wbBwxhX.exe
  C:\Windows\System\wbBwxhX.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\hHQxsoW.exe
  C:\Windows\System\hHQxsoW.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\RJCMXWw.exe
  C:\Windows\System\RJCMXWw.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\zhQUYto.exe
  C:\Windows\System\zhQUYto.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\CDqpEdt.exe
  C:\Windows\System\CDqpEdt.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\HvtBVIZ.exe
  C:\Windows\System\HvtBVIZ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\CPYxQAJ.exe
  C:\Windows\System\CPYxQAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xGXwRZl.exe
  C:\Windows\System\xGXwRZl.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\eEObHRB.exe
  C:\Windows\System\eEObHRB.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EGzoAuZ.exe
  C:\Windows\System\EGzoAuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\sdqJzvG.exe
  C:\Windows\System\sdqJzvG.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\yavAXLd.exe
  C:\Windows\System\yavAXLd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\wGNiNaE.exe
  C:\Windows\System\wGNiNaE.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\RDRhpiM.exe
  C:\Windows\System\RDRhpiM.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\yvsogRb.exe
  C:\Windows\System\yvsogRb.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\vfrFeze.exe
  C:\Windows\System\vfrFeze.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\wBJHvUG.exe
  C:\Windows\System\wBJHvUG.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QubehWH.exe
  C:\Windows\System\QubehWH.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\uKfXIlb.exe
  C:\Windows\System\uKfXIlb.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\BvEUhft.exe
  C:\Windows\System\BvEUhft.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\dfdTuxi.exe
  C:\Windows\System\dfdTuxi.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\dbxCzDB.exe
  C:\Windows\System\dbxCzDB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\xSQyVCK.exe
  C:\Windows\System\xSQyVCK.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\jDRkBio.exe
  C:\Windows\System\jDRkBio.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\dLfQvPn.exe
  C:\Windows\System\dLfQvPn.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\bHyDUwa.exe
  C:\Windows\System\bHyDUwa.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\dErrAKF.exe
  C:\Windows\System\dErrAKF.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\cpkyZCK.exe
  C:\Windows\System\cpkyZCK.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\jKpVrqJ.exe
  C:\Windows\System\jKpVrqJ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CTXllNg.exe
  C:\Windows\System\CTXllNg.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\iPGwEje.exe
  C:\Windows\System\iPGwEje.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\QJeOAgJ.exe
  C:\Windows\System\QJeOAgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\hzVDAkX.exe
  C:\Windows\System\hzVDAkX.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\BVbLWPD.exe
  C:\Windows\System\BVbLWPD.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\ckcmiZm.exe
  C:\Windows\System\ckcmiZm.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\YPcXGvp.exe
  C:\Windows\System\YPcXGvp.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\duaeoro.exe
  C:\Windows\System\duaeoro.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\UPeOMor.exe
  C:\Windows\System\UPeOMor.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\bMmhQCj.exe
  C:\Windows\System\bMmhQCj.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\avduqTf.exe
  C:\Windows\System\avduqTf.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\jzVGhSf.exe
  C:\Windows\System\jzVGhSf.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\wWEECoQ.exe
  C:\Windows\System\wWEECoQ.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ISNmSbG.exe
  C:\Windows\System\ISNmSbG.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\ZhMovfR.exe
  C:\Windows\System\ZhMovfR.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\EpEYAdQ.exe
  C:\Windows\System\EpEYAdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\kVsVZvj.exe
  C:\Windows\System\kVsVZvj.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\YspcUIc.exe
  C:\Windows\System\YspcUIc.exe
  2⤵
  PID:1556
- C:\Windows\System\chQkRlX.exe
  C:\Windows\System\chQkRlX.exe
  2⤵
  PID:2752
- C:\Windows\System\lUVNaYj.exe
  C:\Windows\System\lUVNaYj.exe
  2⤵
  PID:2760
- C:\Windows\System\YtgKrkz.exe
  C:\Windows\System\YtgKrkz.exe
  2⤵
  PID:3004
- C:\Windows\System\BCmVrPm.exe
  C:\Windows\System\BCmVrPm.exe
  2⤵
  PID:2772
- C:\Windows\System\YLmRQxv.exe
  C:\Windows\System\YLmRQxv.exe
  2⤵
  PID:2596
- C:\Windows\System\dYWuSTw.exe
  C:\Windows\System\dYWuSTw.exe
  2⤵
  PID:2676
- C:\Windows\System\xBdUIKL.exe
  C:\Windows\System\xBdUIKL.exe
  2⤵
  PID:2640
- C:\Windows\System\KUABkgn.exe
  C:\Windows\System\KUABkgn.exe
  2⤵
  PID:1476
- C:\Windows\System\HEiFkbX.exe
  C:\Windows\System\HEiFkbX.exe
  2⤵
  PID:2544
- C:\Windows\System\HofwRlT.exe
  C:\Windows\System\HofwRlT.exe
  2⤵
  PID:2560
- C:\Windows\System\iXjrkEX.exe
  C:\Windows\System\iXjrkEX.exe
  2⤵
  PID:760
- C:\Windows\System\bRveDBX.exe
  C:\Windows\System\bRveDBX.exe
  2⤵
  PID:2964
- C:\Windows\System\boRTnkf.exe
  C:\Windows\System\boRTnkf.exe
  2⤵
  PID:2952
- C:\Windows\System\jFhzGnj.exe
  C:\Windows\System\jFhzGnj.exe
  2⤵
  PID:3008
- C:\Windows\System\kYxHvXG.exe
  C:\Windows\System\kYxHvXG.exe
  2⤵
  PID:2828
- C:\Windows\System\zejwnLg.exe
  C:\Windows\System\zejwnLg.exe
  2⤵
  PID:2696
- C:\Windows\System\UEKFpdE.exe
  C:\Windows\System\UEKFpdE.exe
  2⤵
  PID:664
- C:\Windows\System\pfjJawH.exe
  C:\Windows\System\pfjJawH.exe
  2⤵
  PID:940
- C:\Windows\System\ubpHwTG.exe
  C:\Windows\System\ubpHwTG.exe
  2⤵
  PID:620
- C:\Windows\System\lWkdWcH.exe
  C:\Windows\System\lWkdWcH.exe
  2⤵
  PID:2092
- C:\Windows\System\HymvvOk.exe
  C:\Windows\System\HymvvOk.exe
  2⤵
  PID:2220
- C:\Windows\System\ZkwHOwo.exe
  C:\Windows\System\ZkwHOwo.exe
  2⤵
  PID:1108
- C:\Windows\System\uWksALU.exe
  C:\Windows\System\uWksALU.exe
  2⤵
  PID:2140
- C:\Windows\System\mtoYYlL.exe
  C:\Windows\System\mtoYYlL.exe
  2⤵
  PID:700
- C:\Windows\System\ztLvtPL.exe
  C:\Windows\System\ztLvtPL.exe
  2⤵
  PID:296
- C:\Windows\System\CGMCkLg.exe
  C:\Windows\System\CGMCkLg.exe
  2⤵
  PID:840
- C:\Windows\System\oSITLeJ.exe
  C:\Windows\System\oSITLeJ.exe
  2⤵
  PID:1532
- C:\Windows\System\FcOEetj.exe
  C:\Windows\System\FcOEetj.exe
  2⤵
  PID:1124
- C:\Windows\System\ziWfnsb.exe
  C:\Windows\System\ziWfnsb.exe
  2⤵
  PID:896
- C:\Windows\System\mrJaOnz.exe
  C:\Windows\System\mrJaOnz.exe
  2⤵
  PID:924
- C:\Windows\System\AJjElmL.exe
  C:\Windows\System\AJjElmL.exe
  2⤵
  PID:1960
- C:\Windows\System\lOKEqiV.exe
  C:\Windows\System\lOKEqiV.exe
  2⤵
  PID:2336
- C:\Windows\System\IeSMYPh.exe
  C:\Windows\System\IeSMYPh.exe
  2⤵
  PID:684
- C:\Windows\System\MmAhhTS.exe
  C:\Windows\System\MmAhhTS.exe
  2⤵
  PID:536
- C:\Windows\System\QyncQdP.exe
  C:\Windows\System\QyncQdP.exe
  2⤵
  PID:1988
- C:\Windows\System\KkfiJou.exe
  C:\Windows\System\KkfiJou.exe
  2⤵
  PID:876
- C:\Windows\System\riGJZiZ.exe
  C:\Windows\System\riGJZiZ.exe
  2⤵
  PID:2464
- C:\Windows\System\vecEyvB.exe
  C:\Windows\System\vecEyvB.exe
  2⤵
  PID:1312
- C:\Windows\System\ITYkIba.exe
  C:\Windows\System\ITYkIba.exe
  2⤵
  PID:2604
- C:\Windows\System\cBegupw.exe
  C:\Windows\System\cBegupw.exe
  2⤵
  PID:2816
- C:\Windows\System\HEkbNPQ.exe
  C:\Windows\System\HEkbNPQ.exe
  2⤵
  PID:2304
- C:\Windows\System\fjtLnZE.exe
  C:\Windows\System\fjtLnZE.exe
  2⤵
  PID:2192
- C:\Windows\System\DMJZpir.exe
  C:\Windows\System\DMJZpir.exe
  2⤵
  PID:352
- C:\Windows\System\zlyZafk.exe
  C:\Windows\System\zlyZafk.exe
  2⤵
  PID:2516
- C:\Windows\System\dDhlHGl.exe
  C:\Windows\System\dDhlHGl.exe
  2⤵
  PID:1976
- C:\Windows\System\AzxvVJO.exe
  C:\Windows\System\AzxvVJO.exe
  2⤵
  PID:2836
- C:\Windows\System\GVQiPCA.exe
  C:\Windows\System\GVQiPCA.exe
  2⤵
  PID:996
- C:\Windows\System\GCvsdsF.exe
  C:\Windows\System\GCvsdsF.exe
  2⤵
  PID:2848
- C:\Windows\System\sXzTDkn.exe
  C:\Windows\System\sXzTDkn.exe
  2⤵
  PID:2208
- C:\Windows\System\dljwmRM.exe
  C:\Windows\System\dljwmRM.exe
  2⤵
  PID:1972
- C:\Windows\System\EODTifH.exe
  C:\Windows\System\EODTifH.exe
  2⤵
  PID:1252
- C:\Windows\System\qkEBnYr.exe
  C:\Windows\System\qkEBnYr.exe
  2⤵
  PID:1612
- C:\Windows\System\fSJRAGS.exe
  C:\Windows\System\fSJRAGS.exe
  2⤵
  PID:1288
- C:\Windows\System\txwVYxJ.exe
  C:\Windows\System\txwVYxJ.exe
  2⤵
  PID:2496
- C:\Windows\System\xvqpfdr.exe
  C:\Windows\System\xvqpfdr.exe
  2⤵
  PID:2624
- C:\Windows\System\kQOZwWP.exe
  C:\Windows\System\kQOZwWP.exe
  2⤵
  PID:2124
- C:\Windows\System\iZHGwds.exe
  C:\Windows\System\iZHGwds.exe
  2⤵
  PID:2168
- C:\Windows\System\kdxLAsw.exe
  C:\Windows\System\kdxLAsw.exe
  2⤵
  PID:1256
- C:\Windows\System\tkiXjPr.exe
  C:\Windows\System\tkiXjPr.exe
  2⤵
  PID:1784
- C:\Windows\System\NnxBxME.exe
  C:\Windows\System\NnxBxME.exe
  2⤵
  PID:2212
- C:\Windows\System\cwcRFbR.exe
  C:\Windows\System\cwcRFbR.exe
  2⤵
  PID:2120
- C:\Windows\System\sajPFfe.exe
  C:\Windows\System\sajPFfe.exe
  2⤵
  PID:2376
- C:\Windows\System\OeAqnXV.exe
  C:\Windows\System\OeAqnXV.exe
  2⤵
  PID:2352
- C:\Windows\System\ivKXRfx.exe
  C:\Windows\System\ivKXRfx.exe
  2⤵
  PID:332
- C:\Windows\System\hNQcrES.exe
  C:\Windows\System\hNQcrES.exe
  2⤵
  PID:2884
- C:\Windows\System\AywSNBI.exe
  C:\Windows\System\AywSNBI.exe
  2⤵
  PID:2148
- C:\Windows\System\bpfyNwA.exe
  C:\Windows\System\bpfyNwA.exe
  2⤵
  PID:1588
- C:\Windows\System\jrgeyfY.exe
  C:\Windows\System\jrgeyfY.exe
  2⤵
  PID:2824
- C:\Windows\System\xiIdDxq.exe
  C:\Windows\System\xiIdDxq.exe
  2⤵
  PID:2584
- C:\Windows\System\EtmVgIK.exe
  C:\Windows\System\EtmVgIK.exe
  2⤵
  PID:2868
- C:\Windows\System\reUiOyh.exe
  C:\Windows\System\reUiOyh.exe
  2⤵
  PID:1688
- C:\Windows\System\qCOgzvb.exe
  C:\Windows\System\qCOgzvb.exe
  2⤵
  PID:2932
- C:\Windows\System\JkwVjMC.exe
  C:\Windows\System\JkwVjMC.exe
  2⤵
  PID:2712
- C:\Windows\System\fEPAQaH.exe
  C:\Windows\System\fEPAQaH.exe
  2⤵
  PID:2900
- C:\Windows\System\yXfyKit.exe
  C:\Windows\System\yXfyKit.exe
  2⤵
  PID:2724
- C:\Windows\System\ljyMpkP.exe
  C:\Windows\System\ljyMpkP.exe
  2⤵
  PID:1584
- C:\Windows\System\kNXfOgg.exe
  C:\Windows\System\kNXfOgg.exe
  2⤵
  PID:2436
- C:\Windows\System\Smccvfk.exe
  C:\Windows\System\Smccvfk.exe
  2⤵
  PID:2568
- C:\Windows\System\maftTFl.exe
  C:\Windows\System\maftTFl.exe
  2⤵
  PID:2296
- C:\Windows\System\mVbKDVn.exe
  C:\Windows\System\mVbKDVn.exe
  2⤵
  PID:2648
- C:\Windows\System\jnKNQoj.exe
  C:\Windows\System\jnKNQoj.exe
  2⤵
  PID:2748
- C:\Windows\System\EzRxYzh.exe
  C:\Windows\System\EzRxYzh.exe
  2⤵
  PID:2704
- C:\Windows\System\npVKfoC.exe
  C:\Windows\System\npVKfoC.exe
  2⤵
  PID:580
- C:\Windows\System\JhmFyrP.exe
  C:\Windows\System\JhmFyrP.exe
  2⤵
  PID:2088
- C:\Windows\System\MxHQVeN.exe
  C:\Windows\System\MxHQVeN.exe
  2⤵
  PID:3076
- C:\Windows\System\pZrHcug.exe
  C:\Windows\System\pZrHcug.exe
  2⤵
  PID:3096
- C:\Windows\System\TbYPfSB.exe
  C:\Windows\System\TbYPfSB.exe
  2⤵
  PID:3112
- C:\Windows\System\kLqQCtZ.exe
  C:\Windows\System\kLqQCtZ.exe
  2⤵
  PID:3128
- C:\Windows\System\hKblCCb.exe
  C:\Windows\System\hKblCCb.exe
  2⤵
  PID:3148
- C:\Windows\System\VTTpdBw.exe
  C:\Windows\System\VTTpdBw.exe
  2⤵
  PID:3164
- C:\Windows\System\WyDMqUm.exe
  C:\Windows\System\WyDMqUm.exe
  2⤵
  PID:3180
- C:\Windows\System\JaGrOYq.exe
  C:\Windows\System\JaGrOYq.exe
  2⤵
  PID:3196
- C:\Windows\System\OLfNfQm.exe
  C:\Windows\System\OLfNfQm.exe
  2⤵
  PID:3216
- C:\Windows\System\yEGjJmC.exe
  C:\Windows\System\yEGjJmC.exe
  2⤵
  PID:3232
- C:\Windows\System\UpRbVip.exe
  C:\Windows\System\UpRbVip.exe
  2⤵
  PID:3252
- C:\Windows\System\WKLpDKO.exe
  C:\Windows\System\WKLpDKO.exe
  2⤵
  PID:3268
- C:\Windows\System\YPyzPsS.exe
  C:\Windows\System\YPyzPsS.exe
  2⤵
  PID:3288
- C:\Windows\System\OVbTZrw.exe
  C:\Windows\System\OVbTZrw.exe
  2⤵
  PID:3308
- C:\Windows\System\metvhuQ.exe
  C:\Windows\System\metvhuQ.exe
  2⤵
  PID:3324
- C:\Windows\System\NQYEToH.exe
  C:\Windows\System\NQYEToH.exe
  2⤵
  PID:3344
- C:\Windows\System\iBLojTw.exe
  C:\Windows\System\iBLojTw.exe
  2⤵
  PID:3360
- C:\Windows\System\jRdrWzV.exe
  C:\Windows\System\jRdrWzV.exe
  2⤵
  PID:3380
- C:\Windows\System\OGGmjRB.exe
  C:\Windows\System\OGGmjRB.exe
  2⤵
  PID:3396
- C:\Windows\System\NKJwugK.exe
  C:\Windows\System\NKJwugK.exe
  2⤵
  PID:3424
- C:\Windows\System\icstWFD.exe
  C:\Windows\System\icstWFD.exe
  2⤵
  PID:3512
- C:\Windows\System\ESclhaL.exe
  C:\Windows\System\ESclhaL.exe
  2⤵
  PID:3528
- C:\Windows\System\ondJJjn.exe
  C:\Windows\System\ondJJjn.exe
  2⤵
  PID:3556
- C:\Windows\System\IoJfhoF.exe
  C:\Windows\System\IoJfhoF.exe
  2⤵
  PID:3572
- C:\Windows\System\AmHGINA.exe
  C:\Windows\System\AmHGINA.exe
  2⤵
  PID:3588
- C:\Windows\System\xyzHJKU.exe
  C:\Windows\System\xyzHJKU.exe
  2⤵
  PID:3608
- C:\Windows\System\FGYCVkG.exe
  C:\Windows\System\FGYCVkG.exe
  2⤵
  PID:3624
- C:\Windows\System\npaiJvT.exe
  C:\Windows\System\npaiJvT.exe
  2⤵
  PID:3644
- C:\Windows\System\jYvGcBf.exe
  C:\Windows\System\jYvGcBf.exe
  2⤵
  PID:3664
- C:\Windows\System\saJBRuf.exe
  C:\Windows\System\saJBRuf.exe
  2⤵
  PID:3680
- C:\Windows\System\YjWNsSz.exe
  C:\Windows\System\YjWNsSz.exe
  2⤵
  PID:3696
- C:\Windows\System\PPEbCLH.exe
  C:\Windows\System\PPEbCLH.exe
  2⤵
  PID:3712
- C:\Windows\System\qQgQFvn.exe
  C:\Windows\System\qQgQFvn.exe
  2⤵
  PID:3736
- C:\Windows\System\GRlBzGX.exe
  C:\Windows\System\GRlBzGX.exe
  2⤵
  PID:3760
- C:\Windows\System\KCFEXyG.exe
  C:\Windows\System\KCFEXyG.exe
  2⤵
  PID:3780
- C:\Windows\System\SchKwdj.exe
  C:\Windows\System\SchKwdj.exe
  2⤵
  PID:3796
- C:\Windows\System\JFRurAP.exe
  C:\Windows\System\JFRurAP.exe
  2⤵
  PID:3816
- C:\Windows\System\VNGrrLn.exe
  C:\Windows\System\VNGrrLn.exe
  2⤵
  PID:3832
- C:\Windows\System\DXKMPtS.exe
  C:\Windows\System\DXKMPtS.exe
  2⤵
  PID:3848
- C:\Windows\System\FFxvdNB.exe
  C:\Windows\System\FFxvdNB.exe
  2⤵
  PID:3864
- C:\Windows\System\TvTXVbG.exe
  C:\Windows\System\TvTXVbG.exe
  2⤵
  PID:3880
- C:\Windows\System\KLsLkAh.exe
  C:\Windows\System\KLsLkAh.exe
  2⤵
  PID:3896
- C:\Windows\System\KihCeIe.exe
  C:\Windows\System\KihCeIe.exe
  2⤵
  PID:3912
- C:\Windows\System\ZElvuoL.exe
  C:\Windows\System\ZElvuoL.exe
  2⤵
  PID:3928
- C:\Windows\System\AwHiXzY.exe
  C:\Windows\System\AwHiXzY.exe
  2⤵
  PID:3944
- C:\Windows\System\mfzkZXu.exe
  C:\Windows\System\mfzkZXu.exe
  2⤵
  PID:3960
- C:\Windows\System\EmcwvqN.exe
  C:\Windows\System\EmcwvqN.exe
  2⤵
  PID:3976
- C:\Windows\System\USSRzPk.exe
  C:\Windows\System\USSRzPk.exe
  2⤵
  PID:3992
- C:\Windows\System\PiALVMa.exe
  C:\Windows\System\PiALVMa.exe
  2⤵
  PID:4008
- C:\Windows\System\QPYcNAT.exe
  C:\Windows\System\QPYcNAT.exe
  2⤵
  PID:4024
- C:\Windows\System\tfPYiJK.exe
  C:\Windows\System\tfPYiJK.exe
  2⤵
  PID:4052
- C:\Windows\System\IxTxAgj.exe
  C:\Windows\System\IxTxAgj.exe
  2⤵
  PID:4084
- C:\Windows\System\GgatjeL.exe
  C:\Windows\System\GgatjeL.exe
  2⤵
  PID:1496
- C:\Windows\System\pjgRQJk.exe
  C:\Windows\System\pjgRQJk.exe
  2⤵
  PID:2292
- C:\Windows\System\kjwPkmI.exe
  C:\Windows\System\kjwPkmI.exe
  2⤵
  PID:3160
- C:\Windows\System\izdmxMx.exe
  C:\Windows\System\izdmxMx.exe
  2⤵
  PID:3224
- C:\Windows\System\funNNCF.exe
  C:\Windows\System\funNNCF.exe
  2⤵
  PID:1744
- C:\Windows\System\GNRXrtq.exe
  C:\Windows\System\GNRXrtq.exe
  2⤵
  PID:3024
- C:\Windows\System\eSuDIba.exe
  C:\Windows\System\eSuDIba.exe
  2⤵
  PID:3140
- C:\Windows\System\aBpTOyW.exe
  C:\Windows\System\aBpTOyW.exe
  2⤵
  PID:3204
- C:\Windows\System\SeXtNAY.exe
  C:\Windows\System\SeXtNAY.exe
  2⤵
  PID:3244
- C:\Windows\System\DZvqAPZ.exe
  C:\Windows\System\DZvqAPZ.exe
  2⤵
  PID:492
- C:\Windows\System\mbGaVke.exe
  C:\Windows\System\mbGaVke.exe
  2⤵
  PID:3408
- C:\Windows\System\czcVjya.exe
  C:\Windows\System\czcVjya.exe
  2⤵
  PID:3420
- C:\Windows\System\ywJyKoe.exe
  C:\Windows\System\ywJyKoe.exe
  2⤵
  PID:3440
- C:\Windows\System\fgRElSH.exe
  C:\Windows\System\fgRElSH.exe
  2⤵
  PID:1844
- C:\Windows\System\YPfprCB.exe
  C:\Windows\System\YPfprCB.exe
  2⤵
  PID:3472
- C:\Windows\System\ieKjDjn.exe
  C:\Windows\System\ieKjDjn.exe
  2⤵
  PID:3596
- C:\Windows\System\tymbkFl.exe
  C:\Windows\System\tymbkFl.exe
  2⤵
  PID:3640
- C:\Windows\System\YqWDbtC.exe
  C:\Windows\System\YqWDbtC.exe
  2⤵
  PID:3476
- C:\Windows\System\hHMyvNS.exe
  C:\Windows\System\hHMyvNS.exe
  2⤵
  PID:1808
- C:\Windows\System\ZmymjMo.exe
  C:\Windows\System\ZmymjMo.exe
  2⤵
  PID:3704
- C:\Windows\System\OAPEVrq.exe
  C:\Windows\System\OAPEVrq.exe
  2⤵
  PID:3788
- C:\Windows\System\uZyyoUx.exe
  C:\Windows\System\uZyyoUx.exe
  2⤵
  PID:3488
- C:\Windows\System\usMNuYx.exe
  C:\Windows\System\usMNuYx.exe
  2⤵
  PID:3856
- C:\Windows\System\gnJIHAE.exe
  C:\Windows\System\gnJIHAE.exe
  2⤵
  PID:3924
- C:\Windows\System\ffVxrRd.exe
  C:\Windows\System\ffVxrRd.exe
  2⤵
  PID:3956
- C:\Windows\System\sniUKXw.exe
  C:\Windows\System\sniUKXw.exe
  2⤵
  PID:2880
- C:\Windows\System\dTVAyJR.exe
  C:\Windows\System\dTVAyJR.exe
  2⤵
  PID:1248
- C:\Windows\System\AzYiXki.exe
  C:\Windows\System\AzYiXki.exe
  2⤵
  PID:3192
- C:\Windows\System\vFuhVTE.exe
  C:\Windows\System\vFuhVTE.exe
  2⤵
  PID:3296
- C:\Windows\System\QekQYiR.exe
  C:\Windows\System\QekQYiR.exe
  2⤵
  PID:3552
- C:\Windows\System\MstLPXK.exe
  C:\Windows\System\MstLPXK.exe
  2⤵
  PID:3776
- C:\Windows\System\zLPipwY.exe
  C:\Windows\System\zLPipwY.exe
  2⤵
  PID:3368
- C:\Windows\System\IHsyYjX.exe
  C:\Windows\System\IHsyYjX.exe
  2⤵
  PID:3620
- C:\Windows\System\kYfjDlg.exe
  C:\Windows\System\kYfjDlg.exe
  2⤵
  PID:2668
- C:\Windows\System\WFwbUHg.exe
  C:\Windows\System\WFwbUHg.exe
  2⤵
  PID:4032
- C:\Windows\System\FmMEhic.exe
  C:\Windows\System\FmMEhic.exe
  2⤵
  PID:2652
- C:\Windows\System\vZAckLj.exe
  C:\Windows\System\vZAckLj.exe
  2⤵
  PID:2332
- C:\Windows\System\MMnphVu.exe
  C:\Windows\System\MMnphVu.exe
  2⤵
  PID:3804
- C:\Windows\System\qmwetKO.exe
  C:\Windows\System\qmwetKO.exe
  2⤵
  PID:3904
- C:\Windows\System\JRfRDdW.exe
  C:\Windows\System\JRfRDdW.exe
  2⤵
  PID:4036
- C:\Windows\System\posmpPW.exe
  C:\Windows\System\posmpPW.exe
  2⤵
  PID:2256
- C:\Windows\System\OpvBVVU.exe
  C:\Windows\System\OpvBVVU.exe
  2⤵
  PID:3124
- C:\Windows\System\pmHFhPf.exe
  C:\Windows\System\pmHFhPf.exe
  2⤵
  PID:3276
- C:\Windows\System\DYlABKM.exe
  C:\Windows\System\DYlABKM.exe
  2⤵
  PID:3240
- C:\Windows\System\HIGJKmD.exe
  C:\Windows\System\HIGJKmD.exe
  2⤵
  PID:832
- C:\Windows\System\IBUfRGB.exe
  C:\Windows\System\IBUfRGB.exe
  2⤵
  PID:3404
- C:\Windows\System\qbxugYT.exe
  C:\Windows\System\qbxugYT.exe
  2⤵
  PID:1156
- C:\Windows\System\RNLVzHP.exe
  C:\Windows\System\RNLVzHP.exe
  2⤵
  PID:1048
- C:\Windows\System\rwjWEQM.exe
  C:\Windows\System\rwjWEQM.exe
  2⤵
  PID:2456
- C:\Windows\System\BDjjgzN.exe
  C:\Windows\System\BDjjgzN.exe
  2⤵
  PID:3828
- C:\Windows\System\TaMjKdo.exe
  C:\Windows\System\TaMjKdo.exe
  2⤵
  PID:3920
- C:\Windows\System\cbNubPo.exe
  C:\Windows\System\cbNubPo.exe
  2⤵
  PID:3188
- C:\Windows\System\cuHHRJk.exe
  C:\Windows\System\cuHHRJk.exe
  2⤵
  PID:1472
- C:\Windows\System\dxixyXo.exe
  C:\Windows\System\dxixyXo.exe
  2⤵
  PID:2916
- C:\Windows\System\acBymiR.exe
  C:\Windows\System\acBymiR.exe
  2⤵
  PID:3940
- C:\Windows\System\itfYJzB.exe
  C:\Windows\System\itfYJzB.exe
  2⤵
  PID:4092
- C:\Windows\System\rNLBbXw.exe
  C:\Windows\System\rNLBbXw.exe
  2⤵
  PID:3108
- C:\Windows\System\rmWpmOX.exe
  C:\Windows\System\rmWpmOX.exe
  2⤵
  PID:3752
- C:\Windows\System\xjvYzTa.exe
  C:\Windows\System\xjvYzTa.exe
  2⤵
  PID:4076
- C:\Windows\System\hoAVBMy.exe
  C:\Windows\System\hoAVBMy.exe
  2⤵
  PID:4080
- C:\Windows\System\WviiDBG.exe
  C:\Windows\System\WviiDBG.exe
  2⤵
  PID:4004
- C:\Windows\System\depepeN.exe
  C:\Windows\System\depepeN.exe
  2⤵
  PID:4100
- C:\Windows\System\qWRleOU.exe
  C:\Windows\System\qWRleOU.exe
  2⤵
  PID:4120
- C:\Windows\System\SkBstsv.exe
  C:\Windows\System\SkBstsv.exe
  2⤵
  PID:4216
- C:\Windows\System\ShYNsFj.exe
  C:\Windows\System\ShYNsFj.exe
  2⤵
  PID:4236
- C:\Windows\System\boJgGYQ.exe
  C:\Windows\System\boJgGYQ.exe
  2⤵
  PID:4252
- C:\Windows\System\LBwFBpH.exe
  C:\Windows\System\LBwFBpH.exe
  2⤵
  PID:4268
- C:\Windows\System\hTgHyUx.exe
  C:\Windows\System\hTgHyUx.exe
  2⤵
  PID:4288
- C:\Windows\System\vsxUizi.exe
  C:\Windows\System\vsxUizi.exe
  2⤵
  PID:4304
- C:\Windows\System\zQlgGOQ.exe
  C:\Windows\System\zQlgGOQ.exe
  2⤵
  PID:4324
- C:\Windows\System\aNcpbKO.exe
  C:\Windows\System\aNcpbKO.exe
  2⤵
  PID:4340
- C:\Windows\System\KZxNhFV.exe
  C:\Windows\System\KZxNhFV.exe
  2⤵
  PID:4356
- C:\Windows\System\LXvAvoQ.exe
  C:\Windows\System\LXvAvoQ.exe
  2⤵
  PID:4372
- C:\Windows\System\xahuRUA.exe
  C:\Windows\System\xahuRUA.exe
  2⤵
  PID:4388
- C:\Windows\System\FhKIeGC.exe
  C:\Windows\System\FhKIeGC.exe
  2⤵
  PID:4404
- C:\Windows\System\eASgVCi.exe
  C:\Windows\System\eASgVCi.exe
  2⤵
  PID:4420
- C:\Windows\System\JLaOyZD.exe
  C:\Windows\System\JLaOyZD.exe
  2⤵
  PID:4436
- C:\Windows\System\NaFzhRb.exe
  C:\Windows\System\NaFzhRb.exe
  2⤵
  PID:4452
- C:\Windows\System\PSfXxyH.exe
  C:\Windows\System\PSfXxyH.exe
  2⤵
  PID:4468
- C:\Windows\System\mZYDwUR.exe
  C:\Windows\System\mZYDwUR.exe
  2⤵
  PID:4484
- C:\Windows\System\FYewbBp.exe
  C:\Windows\System\FYewbBp.exe
  2⤵
  PID:4500
- C:\Windows\System\BARwLZb.exe
  C:\Windows\System\BARwLZb.exe
  2⤵
  PID:4516
- C:\Windows\System\dgbdsdD.exe
  C:\Windows\System\dgbdsdD.exe
  2⤵
  PID:4540
- C:\Windows\System\rVykZUI.exe
  C:\Windows\System\rVykZUI.exe
  2⤵
  PID:4560
- C:\Windows\System\DyAhaNN.exe
  C:\Windows\System\DyAhaNN.exe
  2⤵
  PID:4580
- C:\Windows\System\PfYXmNY.exe
  C:\Windows\System\PfYXmNY.exe
  2⤵
  PID:4596
- C:\Windows\System\XqeixaS.exe
  C:\Windows\System\XqeixaS.exe
  2⤵
  PID:4612
- C:\Windows\System\jwucOBO.exe
  C:\Windows\System\jwucOBO.exe
  2⤵
  PID:4652
- C:\Windows\System\dSZUwwK.exe
  C:\Windows\System\dSZUwwK.exe
  2⤵
  PID:4668
- C:\Windows\System\EPptLgK.exe
  C:\Windows\System\EPptLgK.exe
  2⤵
  PID:4692
- C:\Windows\System\hhbnuLO.exe
  C:\Windows\System\hhbnuLO.exe
  2⤵
  PID:4740
- C:\Windows\System\mUwfruj.exe
  C:\Windows\System\mUwfruj.exe
  2⤵
  PID:4764
- C:\Windows\System\oGbLeKI.exe
  C:\Windows\System\oGbLeKI.exe
  2⤵
  PID:4784
- C:\Windows\System\RfKCizw.exe
  C:\Windows\System\RfKCizw.exe
  2⤵
  PID:4800
- C:\Windows\System\MAgcbGi.exe
  C:\Windows\System\MAgcbGi.exe
  2⤵
  PID:4816
- C:\Windows\System\qgHFkci.exe
  C:\Windows\System\qgHFkci.exe
  2⤵
  PID:4836
- C:\Windows\System\icwkEKG.exe
  C:\Windows\System\icwkEKG.exe
  2⤵
  PID:4852
- C:\Windows\System\DNiFjgv.exe
  C:\Windows\System\DNiFjgv.exe
  2⤵
  PID:4872
- C:\Windows\System\ZxFOXNh.exe
  C:\Windows\System\ZxFOXNh.exe
  2⤵
  PID:4888
- C:\Windows\System\kWLJTkR.exe
  C:\Windows\System\kWLJTkR.exe
  2⤵
  PID:4908
- C:\Windows\System\DFcFvDm.exe
  C:\Windows\System\DFcFvDm.exe
  2⤵
  PID:4928
- C:\Windows\System\YgisEHk.exe
  C:\Windows\System\YgisEHk.exe
  2⤵
  PID:4944
- C:\Windows\System\oAdVKpp.exe
  C:\Windows\System\oAdVKpp.exe
  2⤵
  PID:4964
- C:\Windows\System\htLWNVR.exe
  C:\Windows\System\htLWNVR.exe
  2⤵
  PID:4980
- C:\Windows\System\uClNvdi.exe
  C:\Windows\System\uClNvdi.exe
  2⤵
  PID:5000
- C:\Windows\System\gLRlyso.exe
  C:\Windows\System\gLRlyso.exe
  2⤵
  PID:5016
- C:\Windows\System\DJhSSTX.exe
  C:\Windows\System\DJhSSTX.exe
  2⤵
  PID:5076
- C:\Windows\System\XYNuWOU.exe
  C:\Windows\System\XYNuWOU.exe
  2⤵
  PID:5096
- C:\Windows\System\dkFDuAI.exe
  C:\Windows\System\dkFDuAI.exe
  2⤵
  PID:5112
- C:\Windows\System\XPdrjAv.exe
  C:\Windows\System\XPdrjAv.exe
  2⤵
  PID:4128
- C:\Windows\System\KXpYuXG.exe
  C:\Windows\System\KXpYuXG.exe
  2⤵
  PID:4136
- C:\Windows\System\RDiWhLb.exe
  C:\Windows\System\RDiWhLb.exe
  2⤵
  PID:4160
- C:\Windows\System\YyRRCwf.exe
  C:\Windows\System\YyRRCwf.exe
  2⤵
  PID:4168
- C:\Windows\System\QUcSSPQ.exe
  C:\Windows\System\QUcSSPQ.exe
  2⤵
  PID:3300
- C:\Windows\System\zVFccET.exe
  C:\Windows\System\zVFccET.exe
  2⤵
  PID:2460
- C:\Windows\System\unhAdyA.exe
  C:\Windows\System\unhAdyA.exe
  2⤵
  PID:3604
- C:\Windows\System\ZXCpgKN.exe
  C:\Windows\System\ZXCpgKN.exe
  2⤵
  PID:3584
- C:\Windows\System\BoLZkpj.exe
  C:\Windows\System\BoLZkpj.exe
  2⤵
  PID:3500
- C:\Windows\System\hNmuHMK.exe
  C:\Windows\System\hNmuHMK.exe
  2⤵
  PID:2072
- C:\Windows\System\UGXgElH.exe
  C:\Windows\System\UGXgElH.exe
  2⤵
  PID:2976
- C:\Windows\System\ptrOBzi.exe
  C:\Windows\System\ptrOBzi.exe
  2⤵
  PID:3812
- C:\Windows\System\rHBqhti.exe
  C:\Windows\System\rHBqhti.exe
  2⤵
  PID:4048
- C:\Windows\System\Allpuez.exe
  C:\Windows\System\Allpuez.exe
  2⤵
  PID:3544
- C:\Windows\System\opzMsFa.exe
  C:\Windows\System\opzMsFa.exe
  2⤵
  PID:3724
- C:\Windows\System\SgKPrRG.exe
  C:\Windows\System\SgKPrRG.exe
  2⤵
  PID:3540
- C:\Windows\System\spDBETr.exe
  C:\Windows\System\spDBETr.exe
  2⤵
  PID:4224
- C:\Windows\System\SXIVHHo.exe
  C:\Windows\System\SXIVHHo.exe
  2⤵
  PID:4200
- C:\Windows\System\yEyUZbz.exe
  C:\Windows\System\yEyUZbz.exe
  2⤵
  PID:4208
- C:\Windows\System\pCSwmAM.exe
  C:\Windows\System\pCSwmAM.exe
  2⤵
  PID:4276
- C:\Windows\System\AgmwIPG.exe
  C:\Windows\System\AgmwIPG.exe
  2⤵
  PID:4316
- C:\Windows\System\CzChtve.exe
  C:\Windows\System\CzChtve.exe
  2⤵
  PID:4384
- C:\Windows\System\wEDQEAA.exe
  C:\Windows\System\wEDQEAA.exe
  2⤵
  PID:2324
- C:\Windows\System\EKxVzCz.exe
  C:\Windows\System\EKxVzCz.exe
  2⤵
  PID:4476
- C:\Windows\System\dwmqhtW.exe
  C:\Windows\System\dwmqhtW.exe
  2⤵
  PID:4552
- C:\Windows\System\QTrGOFH.exe
  C:\Windows\System\QTrGOFH.exe
  2⤵
  PID:4620
- C:\Windows\System\oKzwmbw.exe
  C:\Windows\System\oKzwmbw.exe
  2⤵
  PID:4636
- C:\Windows\System\cyonyIq.exe
  C:\Windows\System\cyonyIq.exe
  2⤵
  PID:4676
- C:\Windows\System\elMVSVI.exe
  C:\Windows\System\elMVSVI.exe
  2⤵
  PID:4684
- C:\Windows\System\CkQISDa.exe
  C:\Windows\System\CkQISDa.exe
  2⤵
  PID:4756
- C:\Windows\System\zoVTgbd.exe
  C:\Windows\System\zoVTgbd.exe
  2⤵
  PID:4796
- C:\Windows\System\CMcftcg.exe
  C:\Windows\System\CMcftcg.exe
  2⤵
  PID:4860
- C:\Windows\System\BmrToXP.exe
  C:\Windows\System\BmrToXP.exe
  2⤵
  PID:4900
- C:\Windows\System\ejXQMUj.exe
  C:\Windows\System\ejXQMUj.exe
  2⤵
  PID:4264
- C:\Windows\System\bqEUAjj.exe
  C:\Windows\System\bqEUAjj.exe
  2⤵
  PID:4364
- C:\Windows\System\ouLhYJf.exe
  C:\Windows\System\ouLhYJf.exe
  2⤵
  PID:4848
- C:\Windows\System\ygQeXhB.exe
  C:\Windows\System\ygQeXhB.exe
  2⤵
  PID:4952
- C:\Windows\System\yalWorw.exe
  C:\Windows\System\yalWorw.exe
  2⤵
  PID:4492
- C:\Windows\System\RWWyIVW.exe
  C:\Windows\System\RWWyIVW.exe
  2⤵
  PID:4528
- C:\Windows\System\CpUnzxY.exe
  C:\Windows\System\CpUnzxY.exe
  2⤵
  PID:4608
- C:\Windows\System\OCMmnED.exe
  C:\Windows\System\OCMmnED.exe
  2⤵
  PID:4700
- C:\Windows\System\LSJsckC.exe
  C:\Windows\System\LSJsckC.exe
  2⤵
  PID:4716
- C:\Windows\System\HWROEMw.exe
  C:\Windows\System\HWROEMw.exe
  2⤵
  PID:4736
- C:\Windows\System\LvdNWqJ.exe
  C:\Windows\System\LvdNWqJ.exe
  2⤵
  PID:4812
- C:\Windows\System\cWpOqlm.exe
  C:\Windows\System\cWpOqlm.exe
  2⤵
  PID:4996
- C:\Windows\System\iPQnMcI.exe
  C:\Windows\System\iPQnMcI.exe
  2⤵
  PID:5036
- C:\Windows\System\LotYpDn.exe
  C:\Windows\System\LotYpDn.exe
  2⤵
  PID:5048
- C:\Windows\System\PsfrWPw.exe
  C:\Windows\System\PsfrWPw.exe
  2⤵
  PID:5064
- C:\Windows\System\AZBOPAM.exe
  C:\Windows\System\AZBOPAM.exe
  2⤵
  PID:5092
- C:\Windows\System\YPzlKhb.exe
  C:\Windows\System\YPzlKhb.exe
  2⤵
  PID:5108
- C:\Windows\System\CXsOJyF.exe
  C:\Windows\System\CXsOJyF.exe
  2⤵
  PID:3392
- C:\Windows\System\iIoFROW.exe
  C:\Windows\System\iIoFROW.exe
  2⤵
  PID:3744
- C:\Windows\System\igZiYEs.exe
  C:\Windows\System\igZiYEs.exe
  2⤵
  PID:4040
- C:\Windows\System\GZcecGG.exe
  C:\Windows\System\GZcecGG.exe
  2⤵
  PID:3000
- C:\Windows\System\ShnCNfF.exe
  C:\Windows\System\ShnCNfF.exe
  2⤵
  PID:4116
- C:\Windows\System\RyNGVxu.exe
  C:\Windows\System\RyNGVxu.exe
  2⤵
  PID:4416
- C:\Windows\System\UwetVoG.exe
  C:\Windows\System\UwetVoG.exe
  2⤵
  PID:4624
- C:\Windows\System\sFSBAxN.exe
  C:\Windows\System\sFSBAxN.exe
  2⤵
  PID:4792
- C:\Windows\System\lyckPFo.exe
  C:\Windows\System\lyckPFo.exe
  2⤵
  PID:4156
- C:\Windows\System\mzubLwp.exe
  C:\Windows\System\mzubLwp.exe
  2⤵
  PID:4880
- C:\Windows\System\kEUYdDS.exe
  C:\Windows\System\kEUYdDS.exe
  2⤵
  PID:4660
- C:\Windows\System\esSsyFT.exe
  C:\Windows\System\esSsyFT.exe
  2⤵
  PID:4988
- C:\Windows\System\qvtqgLu.exe
  C:\Windows\System\qvtqgLu.exe
  2⤵
  PID:5044
- C:\Windows\System\UcvYllm.exe
  C:\Windows\System\UcvYllm.exe
  2⤵
  PID:4176
- C:\Windows\System\fwMkfNJ.exe
  C:\Windows\System\fwMkfNJ.exe
  2⤵
  PID:5072
- C:\Windows\System\kehtGrn.exe
  C:\Windows\System\kehtGrn.exe
  2⤵
  PID:4300
- C:\Windows\System\LJvpPyr.exe
  C:\Windows\System\LJvpPyr.exe
  2⤵
  PID:5040
- C:\Windows\System\YLPcJBg.exe
  C:\Windows\System\YLPcJBg.exe
  2⤵
  PID:5136
- C:\Windows\System\ewNetkm.exe
  C:\Windows\System\ewNetkm.exe
  2⤵
  PID:5156
- C:\Windows\System\RiXiSFe.exe
  C:\Windows\System\RiXiSFe.exe
  2⤵
  PID:5172
- C:\Windows\System\jaORBVP.exe
  C:\Windows\System\jaORBVP.exe
  2⤵
  PID:5192
- C:\Windows\System\kcnUalu.exe
  C:\Windows\System\kcnUalu.exe
  2⤵
  PID:5208
- C:\Windows\System\qrSapxH.exe
  C:\Windows\System\qrSapxH.exe
  2⤵
  PID:5228
- C:\Windows\System\HBDNNHR.exe
  C:\Windows\System\HBDNNHR.exe
  2⤵
  PID:5248
- C:\Windows\System\usZZOex.exe
  C:\Windows\System\usZZOex.exe
  2⤵
  PID:5264
- C:\Windows\System\OUPwoYC.exe
  C:\Windows\System\OUPwoYC.exe
  2⤵
  PID:5280
- C:\Windows\System\HIcOYZk.exe
  C:\Windows\System\HIcOYZk.exe
  2⤵
  PID:5296
- C:\Windows\System\noMolMQ.exe
  C:\Windows\System\noMolMQ.exe
  2⤵
  PID:5312
- C:\Windows\System\OIKnIzd.exe
  C:\Windows\System\OIKnIzd.exe
  2⤵
  PID:5328
- C:\Windows\System\nqhKTve.exe
  C:\Windows\System\nqhKTve.exe
  2⤵
  PID:5404
- C:\Windows\System\TRcGOCx.exe
  C:\Windows\System\TRcGOCx.exe
  2⤵
  PID:5456
- C:\Windows\System\pzbWKwf.exe
  C:\Windows\System\pzbWKwf.exe
  2⤵
  PID:5540
- C:\Windows\System\iAheoIP.exe
  C:\Windows\System\iAheoIP.exe
  2⤵
  PID:5560
- C:\Windows\System\XJISVkU.exe
  C:\Windows\System\XJISVkU.exe
  2⤵
  PID:5580
- C:\Windows\System\YGDzPzr.exe
  C:\Windows\System\YGDzPzr.exe
  2⤵
  PID:5608
- C:\Windows\System\PJKqYfB.exe
  C:\Windows\System\PJKqYfB.exe
  2⤵
  PID:5628
- C:\Windows\System\SJKEfqg.exe
  C:\Windows\System\SJKEfqg.exe
  2⤵
  PID:5648
- C:\Windows\System\CpDUHoJ.exe
  C:\Windows\System\CpDUHoJ.exe
  2⤵
  PID:5668
- C:\Windows\System\pQuZSTF.exe
  C:\Windows\System\pQuZSTF.exe
  2⤵
  PID:5684
- C:\Windows\System\ibSvbRP.exe
  C:\Windows\System\ibSvbRP.exe
  2⤵
  PID:5704
- C:\Windows\System\rHMuTDP.exe
  C:\Windows\System\rHMuTDP.exe
  2⤵
  PID:5724
- C:\Windows\System\gYZeKFd.exe
  C:\Windows\System\gYZeKFd.exe
  2⤵
  PID:5744
- C:\Windows\System\iLqxxvL.exe
  C:\Windows\System\iLqxxvL.exe
  2⤵
  PID:5760
- C:\Windows\System\sUcSFPO.exe
  C:\Windows\System\sUcSFPO.exe
  2⤵
  PID:5776
- C:\Windows\System\bdnOtEq.exe
  C:\Windows\System\bdnOtEq.exe
  2⤵
  PID:5804
- C:\Windows\System\PFtKMeN.exe
  C:\Windows\System\PFtKMeN.exe
  2⤵
  PID:5820
- C:\Windows\System\CmHWmjb.exe
  C:\Windows\System\CmHWmjb.exe
  2⤵
  PID:5848
- C:\Windows\System\YTfOoBx.exe
  C:\Windows\System\YTfOoBx.exe
  2⤵
  PID:5864
- C:\Windows\System\hqPsily.exe
  C:\Windows\System\hqPsily.exe
  2⤵
  PID:5888
- C:\Windows\System\Kdvehaf.exe
  C:\Windows\System\Kdvehaf.exe
  2⤵
  PID:5904
- C:\Windows\System\mDDDJzu.exe
  C:\Windows\System\mDDDJzu.exe
  2⤵
  PID:5920
- C:\Windows\System\cBotbUZ.exe
  C:\Windows\System\cBotbUZ.exe
  2⤵
  PID:5936
- C:\Windows\System\iejvMyJ.exe
  C:\Windows\System\iejvMyJ.exe
  2⤵
  PID:5960
- C:\Windows\System\BMmrSXo.exe
  C:\Windows\System\BMmrSXo.exe
  2⤵
  PID:5976
- C:\Windows\System\aKyWAyW.exe
  C:\Windows\System\aKyWAyW.exe
  2⤵
  PID:5992
- C:\Windows\System\PVgxJvc.exe
  C:\Windows\System\PVgxJvc.exe
  2⤵
  PID:6012
- C:\Windows\System\xBOCSau.exe
  C:\Windows\System\xBOCSau.exe
  2⤵
  PID:6028
- C:\Windows\System\zjBziuu.exe
  C:\Windows\System\zjBziuu.exe
  2⤵
  PID:6044
- C:\Windows\System\zcgeDrk.exe
  C:\Windows\System\zcgeDrk.exe
  2⤵
  PID:6064
- C:\Windows\System\IumJart.exe
  C:\Windows\System\IumJart.exe
  2⤵
  PID:6080
- C:\Windows\System\HDVFPag.exe
  C:\Windows\System\HDVFPag.exe
  2⤵
  PID:6104
- C:\Windows\System\fSMgSDU.exe
  C:\Windows\System\fSMgSDU.exe
  2⤵
  PID:6124
- C:\Windows\System\gjnUTmY.exe
  C:\Windows\System\gjnUTmY.exe
  2⤵
  PID:6140
- C:\Windows\System\qomtJBP.exe
  C:\Windows\System\qomtJBP.exe
  2⤵
  PID:4992
- C:\Windows\System\PxcFCfj.exe
  C:\Windows\System\PxcFCfj.exe
  2⤵
  PID:5188
- C:\Windows\System\OCdBGmp.exe
  C:\Windows\System\OCdBGmp.exe
  2⤵
  PID:5260
- C:\Windows\System\PaYTygj.exe
  C:\Windows\System\PaYTygj.exe
  2⤵
  PID:3632
- C:\Windows\System\fOxBVVr.exe
  C:\Windows\System\fOxBVVr.exe
  2⤵
  PID:2284
- C:\Windows\System\kzeaRne.exe
  C:\Windows\System\kzeaRne.exe
  2⤵
  PID:4348
- C:\Windows\System\MMUWzHl.exe
  C:\Windows\System\MMUWzHl.exe
  2⤵
  PID:4808
- C:\Windows\System\yoljuXV.exe
  C:\Windows\System\yoljuXV.exe
  2⤵
  PID:5028
- C:\Windows\System\jVrPbpU.exe
  C:\Windows\System\jVrPbpU.exe
  2⤵
  PID:4312
- C:\Windows\System\LwPArib.exe
  C:\Windows\System\LwPArib.exe
  2⤵
  PID:4884
- C:\Windows\System\ZqLaTgm.exe
  C:\Windows\System\ZqLaTgm.exe
  2⤵
  PID:4548
- C:\Windows\System\orGvogJ.exe
  C:\Windows\System\orGvogJ.exe
  2⤵
  PID:5164
- C:\Windows\System\TodIgas.exe
  C:\Windows\System\TodIgas.exe
  2⤵
  PID:3504
- C:\Windows\System\zoWrzpi.exe
  C:\Windows\System\zoWrzpi.exe
  2⤵
  PID:3888
- C:\Windows\System\cNPKLMj.exe
  C:\Windows\System\cNPKLMj.exe
  2⤵
  PID:3824
- C:\Windows\System\dvxvvoX.exe
  C:\Windows\System\dvxvvoX.exe
  2⤵
  PID:4192
- C:\Windows\System\VnhOmnS.exe
  C:\Windows\System\VnhOmnS.exe
  2⤵
  PID:4712
- C:\Windows\System\RsjVzbQ.exe
  C:\Windows\System\RsjVzbQ.exe
  2⤵
  PID:4644
- C:\Windows\System\oSSDhmz.exe
  C:\Windows\System\oSSDhmz.exe
  2⤵
  PID:4432
- C:\Windows\System\MCqYimt.exe
  C:\Windows\System\MCqYimt.exe
  2⤵
  PID:4204
- C:\Windows\System\QjIVWyh.exe
  C:\Windows\System\QjIVWyh.exe
  2⤵
  PID:5272
- C:\Windows\System\wPyCSRA.exe
  C:\Windows\System\wPyCSRA.exe
  2⤵
  PID:5344
- C:\Windows\System\MNtBbzg.exe
  C:\Windows\System\MNtBbzg.exe
  2⤵
  PID:5352
- C:\Windows\System\gDoVoEm.exe
  C:\Windows\System\gDoVoEm.exe
  2⤵
  PID:5368
- C:\Windows\System\gnMHBOq.exe
  C:\Windows\System\gnMHBOq.exe
  2⤵
  PID:4708
- C:\Windows\System\eztfPyv.exe
  C:\Windows\System\eztfPyv.exe
  2⤵
  PID:4428
- C:\Windows\System\mFjpYOJ.exe
  C:\Windows\System\mFjpYOJ.exe
  2⤵
  PID:5416
- C:\Windows\System\BncKxRH.exe
  C:\Windows\System\BncKxRH.exe
  2⤵
  PID:5444
- C:\Windows\System\gbKdaxW.exe
  C:\Windows\System\gbKdaxW.exe
  2⤵
  PID:5472
- C:\Windows\System\MasBWCB.exe
  C:\Windows\System\MasBWCB.exe
  2⤵
  PID:5488
- C:\Windows\System\OExeGgH.exe
  C:\Windows\System\OExeGgH.exe
  2⤵
  PID:5500
- C:\Windows\System\wyLEswT.exe
  C:\Windows\System\wyLEswT.exe
  2⤵
  PID:5520
- C:\Windows\System\ruDKibv.exe
  C:\Windows\System\ruDKibv.exe
  2⤵
  PID:5556
- C:\Windows\System\ASWlSoI.exe
  C:\Windows\System\ASWlSoI.exe
  2⤵
  PID:5572
- C:\Windows\System\IfuhBMm.exe
  C:\Windows\System\IfuhBMm.exe
  2⤵
  PID:5604
- C:\Windows\System\LDsRgQB.exe
  C:\Windows\System\LDsRgQB.exe
  2⤵
  PID:5636
- C:\Windows\System\CMMpauw.exe
  C:\Windows\System\CMMpauw.exe
  2⤵
  PID:5660
- C:\Windows\System\IcygXcL.exe
  C:\Windows\System\IcygXcL.exe
  2⤵
  PID:5700
- C:\Windows\System\WVAECxy.exe
  C:\Windows\System\WVAECxy.exe
  2⤵
  PID:5756
- C:\Windows\System\thAPvMX.exe
  C:\Windows\System\thAPvMX.exe
  2⤵
  PID:5800
- C:\Windows\System\TqlIEqk.exe
  C:\Windows\System\TqlIEqk.exe
  2⤵
  PID:5772
- C:\Windows\System\zRKpHuW.exe
  C:\Windows\System\zRKpHuW.exe
  2⤵
  PID:5832
- C:\Windows\System\XNGcDrj.exe
  C:\Windows\System\XNGcDrj.exe
  2⤵
  PID:5856
- C:\Windows\System\GUdrhmE.exe
  C:\Windows\System\GUdrhmE.exe
  2⤵
  PID:5880
- C:\Windows\System\LlOhXuH.exe
  C:\Windows\System\LlOhXuH.exe
  2⤵
  PID:5916
- C:\Windows\System\OGKsGql.exe
  C:\Windows\System\OGKsGql.exe
  2⤵
  PID:5952
- C:\Windows\System\mmczGzi.exe
  C:\Windows\System\mmczGzi.exe
  2⤵
  PID:6024
- C:\Windows\System\QnBZvaL.exe
  C:\Windows\System\QnBZvaL.exe
  2⤵
  PID:6088
- C:\Windows\System\BJnrdgx.exe
  C:\Windows\System\BJnrdgx.exe
  2⤵
  PID:5928
- C:\Windows\System\cADwAyY.exe
  C:\Windows\System\cADwAyY.exe
  2⤵
  PID:5152
- C:\Windows\System\fkniwMl.exe
  C:\Windows\System\fkniwMl.exe
  2⤵
  PID:6112
- C:\Windows\System\plmvspl.exe
  C:\Windows\System\plmvspl.exe
  2⤵
  PID:5220
- C:\Windows\System\wAKSNbr.exe
  C:\Windows\System\wAKSNbr.exe
  2⤵
  PID:2876
- C:\Windows\System\WtjUmYw.exe
  C:\Windows\System\WtjUmYw.exe
  2⤵
  PID:4780
- C:\Windows\System\KcWNRdH.exe
  C:\Windows\System\KcWNRdH.exe
  2⤵
  PID:3988
- C:\Windows\System\qSvILia.exe
  C:\Windows\System\qSvILia.exe
  2⤵
  PID:3636
- C:\Windows\System\aerpTjV.exe
  C:\Windows\System\aerpTjV.exe
  2⤵
  PID:4924
- C:\Windows\System\PINDSHw.exe
  C:\Windows\System\PINDSHw.exe
  2⤵
  PID:5240
- C:\Windows\System\LJJMKaC.exe
  C:\Windows\System\LJJMKaC.exe
  2⤵
  PID:3464
- C:\Windows\System\lcoGUSA.exe
  C:\Windows\System\lcoGUSA.exe
  2⤵
  PID:4148
- C:\Windows\System\jyvEUFr.exe
  C:\Windows\System\jyvEUFr.exe
  2⤵
  PID:4592
- C:\Windows\System\WEeFXVc.exe
  C:\Windows\System\WEeFXVc.exe
  2⤵
  PID:3436
- C:\Windows\System\IEbXYhF.exe
  C:\Windows\System\IEbXYhF.exe
  2⤵
  PID:5336
- C:\Windows\System\SyfHqoN.exe
  C:\Windows\System\SyfHqoN.exe
  2⤵
  PID:4832
- C:\Windows\System\IEJgxaw.exe
  C:\Windows\System\IEJgxaw.exe
  2⤵
  PID:5008
- C:\Windows\System\JputKuy.exe
  C:\Windows\System\JputKuy.exe
  2⤵
  PID:4460
- C:\Windows\System\ZnlxRnK.exe
  C:\Windows\System\ZnlxRnK.exe
  2⤵
  PID:5388
- C:\Windows\System\wqQPFZU.exe
  C:\Windows\System\wqQPFZU.exe
  2⤵
  PID:5440
- C:\Windows\System\qzgQFQE.exe
  C:\Windows\System\qzgQFQE.exe
  2⤵
  PID:5356
- C:\Windows\System\FHBCdXy.exe
  C:\Windows\System\FHBCdXy.exe
  2⤵
  PID:2524
- C:\Windows\System\UWGDPPd.exe
  C:\Windows\System\UWGDPPd.exe
  2⤵
  PID:5680
- C:\Windows\System\tlWbTFf.exe
  C:\Windows\System\tlWbTFf.exe
  2⤵
  PID:5380
- C:\Windows\System\CjsavmQ.exe
  C:\Windows\System\CjsavmQ.exe
  2⤵
  PID:5828
- C:\Windows\System\duluejz.exe
  C:\Windows\System\duluejz.exe
  2⤵
  PID:5948
- C:\Windows\System\cEkcJUl.exe
  C:\Windows\System\cEkcJUl.exe
  2⤵
  PID:5968
- C:\Windows\System\XRNOxJj.exe
  C:\Windows\System\XRNOxJj.exe
  2⤵
  PID:5324
- C:\Windows\System\ExLmKWU.exe
  C:\Windows\System\ExLmKWU.exe
  2⤵
  PID:5840
- C:\Windows\System\oYvTfrs.exe
  C:\Windows\System\oYvTfrs.exe
  2⤵
  PID:5024
- C:\Windows\System\xfRVcGI.exe
  C:\Windows\System\xfRVcGI.exe
  2⤵
  PID:5548
- C:\Windows\System\zuQAGvt.exe
  C:\Windows\System\zuQAGvt.exe
  2⤵
  PID:5124
- C:\Windows\System\ebqjYwH.exe
  C:\Windows\System\ebqjYwH.exe
  2⤵
  PID:3840
- C:\Windows\System\NEcWyjw.exe
  C:\Windows\System\NEcWyjw.exe
  2⤵
  PID:5656
- C:\Windows\System\Lvcpawt.exe
  C:\Windows\System\Lvcpawt.exe
  2⤵
  PID:5256
- C:\Windows\System\QrMXHon.exe
  C:\Windows\System\QrMXHon.exe
  2⤵
  PID:4380
- C:\Windows\System\AUefiMl.exe
  C:\Windows\System\AUefiMl.exe
  2⤵
  PID:4604
- C:\Windows\System\rnvrcRb.exe
  C:\Windows\System\rnvrcRb.exe
  2⤵
  PID:4536
- C:\Windows\System\RfeTjYF.exe
  C:\Windows\System\RfeTjYF.exe
  2⤵
  PID:6004
- C:\Windows\System\orDeLiR.exe
  C:\Windows\System\orDeLiR.exe
  2⤵
  PID:5512
- C:\Windows\System\AgxyVqZ.exe
  C:\Windows\System\AgxyVqZ.exe
  2⤵
  PID:3892
- C:\Windows\System\LPrvjUV.exe
  C:\Windows\System\LPrvjUV.exe
  2⤵
  PID:3728
- C:\Windows\System\BZvutpZ.exe
  C:\Windows\System\BZvutpZ.exe
  2⤵
  PID:5872
- C:\Windows\System\rUUhzSw.exe
  C:\Windows\System\rUUhzSw.exe
  2⤵
  PID:5988
- C:\Windows\System\GjdnLMn.exe
  C:\Windows\System\GjdnLMn.exe
  2⤵
  PID:5844
- C:\Windows\System\oLXXIFs.exe
  C:\Windows\System\oLXXIFs.exe
  2⤵
  PID:5568
- C:\Windows\System\ZHoMQEL.exe
  C:\Windows\System\ZHoMQEL.exe
  2⤵
  PID:5796
- C:\Windows\System\KDvskFN.exe
  C:\Windows\System\KDvskFN.exe
  2⤵
  PID:5308
- C:\Windows\System\ZLuRvaG.exe
  C:\Windows\System\ZLuRvaG.exe
  2⤵
  PID:6040
- C:\Windows\System\LnpWsbE.exe
  C:\Windows\System\LnpWsbE.exe
  2⤵
  PID:5432
- C:\Windows\System\kDRvPeS.exe
  C:\Windows\System\kDRvPeS.exe
  2⤵
  PID:5624
- C:\Windows\System\FDygudp.exe
  C:\Windows\System\FDygudp.exe
  2⤵
  PID:5184
- C:\Windows\System\ZEwOEnj.exe
  C:\Windows\System\ZEwOEnj.exe
  2⤵
  PID:5320
- C:\Windows\System\IhZkYaz.exe
  C:\Windows\System\IhZkYaz.exe
  2⤵
  PID:5292
- C:\Windows\System\CtieUoE.exe
  C:\Windows\System\CtieUoE.exe
  2⤵
  PID:3376
- C:\Windows\System\jyIiCzR.exe
  C:\Windows\System\jyIiCzR.exe
  2⤵
  PID:4108
- C:\Windows\System\nkUYXTc.exe
  C:\Windows\System\nkUYXTc.exe
  2⤵
  PID:4480
- C:\Windows\System\tcDtSoZ.exe
  C:\Windows\System\tcDtSoZ.exe
  2⤵
  PID:4732
- C:\Windows\System\VowFNyr.exe
  C:\Windows\System\VowFNyr.exe
  2⤵
  PID:4904
- C:\Windows\System\EHLaKFP.exe
  C:\Windows\System\EHLaKFP.exe
  2⤵
  PID:5876
- C:\Windows\System\PGHZZLv.exe
  C:\Windows\System\PGHZZLv.exe
  2⤵
  PID:5900
- C:\Windows\System\tRhShYC.exe
  C:\Windows\System\tRhShYC.exe
  2⤵
  PID:5492
- C:\Windows\System\CIlteLo.exe
  C:\Windows\System\CIlteLo.exe
  2⤵
  PID:4960
- C:\Windows\System\XMSHrPL.exe
  C:\Windows\System\XMSHrPL.exe
  2⤵
  PID:5792
- C:\Windows\System\FOEnjbz.exe
  C:\Windows\System\FOEnjbz.exe
  2⤵
  PID:6000
- C:\Windows\System\UVanNBn.exe
  C:\Windows\System\UVanNBn.exe
  2⤵
  PID:5912
- C:\Windows\System\vZsiEOC.exe
  C:\Windows\System\vZsiEOC.exe
  2⤵
  PID:5364
- C:\Windows\System\rpaLgbO.exe
  C:\Windows\System\rpaLgbO.exe
  2⤵
  PID:5200
- C:\Windows\System\YgqEKBI.exe
  C:\Windows\System\YgqEKBI.exe
  2⤵
  PID:5104
- C:\Windows\System\RiQtATo.exe
  C:\Windows\System\RiQtATo.exe
  2⤵
  PID:6120
- C:\Windows\System\zQccDpr.exe
  C:\Windows\System\zQccDpr.exe
  2⤵
  PID:6136
- C:\Windows\System\UnZDJxt.exe
  C:\Windows\System\UnZDJxt.exe
  2⤵
  PID:5768
- C:\Windows\System\fmqJeEz.exe
  C:\Windows\System\fmqJeEz.exe
  2⤵
  PID:5720
- C:\Windows\System\HMuqmDD.exe
  C:\Windows\System\HMuqmDD.exe
  2⤵
  PID:6100
- C:\Windows\System\eiKoYuf.exe
  C:\Windows\System\eiKoYuf.exe
  2⤵
  PID:6148
- C:\Windows\System\erzdKtv.exe
  C:\Windows\System\erzdKtv.exe
  2⤵
  PID:6168
- C:\Windows\System\QiSWsyo.exe
  C:\Windows\System\QiSWsyo.exe
  2⤵
  PID:6184
- C:\Windows\System\QMnxEEN.exe
  C:\Windows\System\QMnxEEN.exe
  2⤵
  PID:6204
- C:\Windows\System\KAVYyyh.exe
  C:\Windows\System\KAVYyyh.exe
  2⤵
  PID:6224
- C:\Windows\System\wJdwksl.exe
  C:\Windows\System\wJdwksl.exe
  2⤵
  PID:6240
- C:\Windows\System\Fvhwmrg.exe
  C:\Windows\System\Fvhwmrg.exe
  2⤵
  PID:6260
- C:\Windows\System\BBjfwAA.exe
  C:\Windows\System\BBjfwAA.exe
  2⤵
  PID:6284
- C:\Windows\System\HLCdRQp.exe
  C:\Windows\System\HLCdRQp.exe
  2⤵
  PID:6304
- C:\Windows\System\AJzXBTk.exe
  C:\Windows\System\AJzXBTk.exe
  2⤵
  PID:6320
- C:\Windows\System\mFpyAEK.exe
  C:\Windows\System\mFpyAEK.exe
  2⤵
  PID:6348
- C:\Windows\System\tidursT.exe
  C:\Windows\System\tidursT.exe
  2⤵
  PID:6368
- C:\Windows\System\NUNhvRE.exe
  C:\Windows\System\NUNhvRE.exe
  2⤵
  PID:6388
- C:\Windows\System\qDhhimC.exe
  C:\Windows\System\qDhhimC.exe
  2⤵
  PID:6404
- C:\Windows\System\DwhQMED.exe
  C:\Windows\System\DwhQMED.exe
  2⤵
  PID:6420
- C:\Windows\System\NpBdpym.exe
  C:\Windows\System\NpBdpym.exe
  2⤵
  PID:6444
- C:\Windows\System\FlxVUtm.exe
  C:\Windows\System\FlxVUtm.exe
  2⤵
  PID:6460
- C:\Windows\System\dugcWGb.exe
  C:\Windows\System\dugcWGb.exe
  2⤵
  PID:6480
- C:\Windows\System\vGWujgB.exe
  C:\Windows\System\vGWujgB.exe
  2⤵
  PID:6500
- C:\Windows\System\IesLAOw.exe
  C:\Windows\System\IesLAOw.exe
  2⤵
  PID:6516
- C:\Windows\System\gatysPm.exe
  C:\Windows\System\gatysPm.exe
  2⤵
  PID:6532
- C:\Windows\System\XaqSoTb.exe
  C:\Windows\System\XaqSoTb.exe
  2⤵
  PID:6552
- C:\Windows\System\iZyjOdC.exe
  C:\Windows\System\iZyjOdC.exe
  2⤵
  PID:6568
- C:\Windows\System\CswmRZp.exe
  C:\Windows\System\CswmRZp.exe
  2⤵
  PID:6584
- C:\Windows\System\ggHfsnM.exe
  C:\Windows\System\ggHfsnM.exe
  2⤵
  PID:6600
- C:\Windows\System\IbVhmDT.exe
  C:\Windows\System\IbVhmDT.exe
  2⤵
  PID:6620
- C:\Windows\System\RSXSluk.exe
  C:\Windows\System\RSXSluk.exe
  2⤵
  PID:6640
- C:\Windows\System\WuvYLmF.exe
  C:\Windows\System\WuvYLmF.exe
  2⤵
  PID:6656
- C:\Windows\System\ASmbXvP.exe
  C:\Windows\System\ASmbXvP.exe
  2⤵
  PID:6676
- C:\Windows\System\UwkcNat.exe
  C:\Windows\System\UwkcNat.exe
  2⤵
  PID:6696
- C:\Windows\System\nHmUTPe.exe
  C:\Windows\System\nHmUTPe.exe
  2⤵
  PID:6712
- C:\Windows\System\lHDVysY.exe
  C:\Windows\System\lHDVysY.exe
  2⤵
  PID:6732
- C:\Windows\System\UTsmXEs.exe
  C:\Windows\System\UTsmXEs.exe
  2⤵
  PID:6748
- C:\Windows\System\opLRKYY.exe
  C:\Windows\System\opLRKYY.exe
  2⤵
  PID:6764
- C:\Windows\System\Zkvzfix.exe
  C:\Windows\System\Zkvzfix.exe
  2⤵
  PID:6828
- C:\Windows\System\AquJbFp.exe
  C:\Windows\System\AquJbFp.exe
  2⤵
  PID:6848
- C:\Windows\System\qnkLZiE.exe
  C:\Windows\System\qnkLZiE.exe
  2⤵
  PID:6864
- C:\Windows\System\AFWaMtg.exe
  C:\Windows\System\AFWaMtg.exe
  2⤵
  PID:6880
- C:\Windows\System\xnRMtZz.exe
  C:\Windows\System\xnRMtZz.exe
  2⤵
  PID:6896
- C:\Windows\System\rejhkAx.exe
  C:\Windows\System\rejhkAx.exe
  2⤵
  PID:6916
- C:\Windows\System\cqTNVfw.exe
  C:\Windows\System\cqTNVfw.exe
  2⤵
  PID:6936
- C:\Windows\System\LtbtovE.exe
  C:\Windows\System\LtbtovE.exe
  2⤵
  PID:6956
- C:\Windows\System\NMPIUrX.exe
  C:\Windows\System\NMPIUrX.exe
  2⤵
  PID:6976
- C:\Windows\System\riVbfWS.exe
  C:\Windows\System\riVbfWS.exe
  2⤵
  PID:6996
- C:\Windows\System\fSjRBWu.exe
  C:\Windows\System\fSjRBWu.exe
  2⤵
  PID:7024
- C:\Windows\System\KsGutxc.exe
  C:\Windows\System\KsGutxc.exe
  2⤵
  PID:7040
- C:\Windows\System\SIrYHdS.exe
  C:\Windows\System\SIrYHdS.exe
  2⤵
  PID:7056
- C:\Windows\System\nbufYoV.exe
  C:\Windows\System\nbufYoV.exe
  2⤵
  PID:7076
- C:\Windows\System\yCdvBVt.exe
  C:\Windows\System\yCdvBVt.exe
  2⤵
  PID:7096
- C:\Windows\System\edCcEls.exe
  C:\Windows\System\edCcEls.exe
  2⤵
  PID:7112
- C:\Windows\System\YjhYyyc.exe
  C:\Windows\System\YjhYyyc.exe
  2⤵
  PID:7132
- C:\Windows\System\KrsMlnp.exe
  C:\Windows\System\KrsMlnp.exe
  2⤵
  PID:7148
- C:\Windows\System\fzFpSYu.exe
  C:\Windows\System\fzFpSYu.exe
  2⤵
  PID:5716
- C:\Windows\System\bqcmDbY.exe
  C:\Windows\System\bqcmDbY.exe
  2⤵
  PID:6164
- C:\Windows\System\wuMrqTo.exe
  C:\Windows\System\wuMrqTo.exe
  2⤵
  PID:6236
- C:\Windows\System\hYfXCXG.exe
  C:\Windows\System\hYfXCXG.exe
  2⤵
  PID:6312
- C:\Windows\System\GosicdE.exe
  C:\Windows\System\GosicdE.exe
  2⤵
  PID:6396
- C:\Windows\System\gEdLdaN.exe
  C:\Windows\System\gEdLdaN.exe
  2⤵
  PID:6436
- C:\Windows\System\aYfAaGF.exe
  C:\Windows\System\aYfAaGF.exe
  2⤵
  PID:6508
- C:\Windows\System\jeNxwju.exe
  C:\Windows\System\jeNxwju.exe
  2⤵
  PID:6548
- C:\Windows\System\ahEZAnP.exe
  C:\Windows\System\ahEZAnP.exe
  2⤵
  PID:6616
- C:\Windows\System\HMtYPHV.exe
  C:\Windows\System\HMtYPHV.exe
  2⤵
  PID:6692
- C:\Windows\System\AxRtuFb.exe
  C:\Windows\System\AxRtuFb.exe
  2⤵
  PID:6296
- C:\Windows\System\TgNPpRd.exe
  C:\Windows\System\TgNPpRd.exe
  2⤵
  PID:6212
- C:\Windows\System\AuGhaQL.exe
  C:\Windows\System\AuGhaQL.exe
  2⤵
  PID:6248
- C:\Windows\System\bJrEmRn.exe
  C:\Windows\System\bJrEmRn.exe
  2⤵
  PID:6592
- C:\Windows\System\NXrQfJG.exe
  C:\Windows\System\NXrQfJG.exe
  2⤵
  PID:6668
- C:\Windows\System\VWwkyMd.exe
  C:\Windows\System\VWwkyMd.exe
  2⤵
  PID:6760
- C:\Windows\System\pMlKeSK.exe
  C:\Windows\System\pMlKeSK.exe
  2⤵
  PID:6252
- C:\Windows\System\PNhKdjF.exe
  C:\Windows\System\PNhKdjF.exe
  2⤵
  PID:6344
- C:\Windows\System\RoczVJC.exe
  C:\Windows\System\RoczVJC.exe
  2⤵
  PID:6488
- C:\Windows\System\hSdTusL.exe
  C:\Windows\System\hSdTusL.exe
  2⤵
  PID:6844
- C:\Windows\System\QJeRmHS.exe
  C:\Windows\System\QJeRmHS.exe
  2⤵
  PID:6952
- C:\Windows\System\bvrXXJJ.exe
  C:\Windows\System\bvrXXJJ.exe
  2⤵
  PID:6772
- C:\Windows\System\LEZZKcH.exe
  C:\Windows\System\LEZZKcH.exe
  2⤵
  PID:6788
- C:\Windows\System\EshpGCz.exe
  C:\Windows\System\EshpGCz.exe
  2⤵
  PID:7072
- C:\Windows\System\nLvyyGE.exe
  C:\Windows\System\nLvyyGE.exe
  2⤵
  PID:7140
- C:\Windows\System\LuicUFU.exe
  C:\Windows\System\LuicUFU.exe
  2⤵
  PID:6272
- C:\Windows\System\cHemrWI.exe
  C:\Windows\System\cHemrWI.exe
  2⤵
  PID:6432
- C:\Windows\System\WdGuisu.exe
  C:\Windows\System\WdGuisu.exe
  2⤵
  PID:6544
- C:\Windows\System\SofaUyh.exe
  C:\Windows\System\SofaUyh.exe
  2⤵
  PID:6336
- C:\Windows\System\iRjyJkl.exe
  C:\Windows\System\iRjyJkl.exe
  2⤵
  PID:6792
- C:\Windows\System\LUzrYJy.exe
  C:\Windows\System\LUzrYJy.exe
  2⤵
  PID:5468
- C:\Windows\System\XgxmbBK.exe
  C:\Windows\System\XgxmbBK.exe
  2⤵
  PID:6340
- C:\Windows\System\DVPlEOf.exe
  C:\Windows\System\DVPlEOf.exe
  2⤵
  PID:6820
- C:\Windows\System\LOpSBnK.exe
  C:\Windows\System\LOpSBnK.exe
  2⤵
  PID:6808
- C:\Windows\System\BijDejs.exe
  C:\Windows\System\BijDejs.exe
  2⤵
  PID:6708
- C:\Windows\System\vpGTrLW.exe
  C:\Windows\System\vpGTrLW.exe
  2⤵
  PID:6596
- C:\Windows\System\ZzNwUmS.exe
  C:\Windows\System\ZzNwUmS.exe
  2⤵
  PID:6840
- C:\Windows\System\PBPyRyK.exe
  C:\Windows\System\PBPyRyK.exe
  2⤵
  PID:7120
- C:\Windows\System\DFqCGeg.exe
  C:\Windows\System\DFqCGeg.exe
  2⤵
  PID:6924
- C:\Windows\System\gDccXUY.exe
  C:\Windows\System\gDccXUY.exe
  2⤵
  PID:6416
- C:\Windows\System\vBLdFRR.exe
  C:\Windows\System\vBLdFRR.exe
  2⤵
  PID:6796
- C:\Windows\System\emMLbxp.exe
  C:\Windows\System\emMLbxp.exe
  2⤵
  PID:6948
- C:\Windows\System\qxrVVYK.exe
  C:\Windows\System\qxrVVYK.exe
  2⤵
  PID:6836
- C:\Windows\System\tThwxcG.exe
  C:\Windows\System\tThwxcG.exe
  2⤵
  PID:7124
- C:\Windows\System\lEITmbJ.exe
  C:\Windows\System\lEITmbJ.exe
  2⤵
  PID:4068
- C:\Windows\System\XwTHyON.exe
  C:\Windows\System\XwTHyON.exe
  2⤵
  PID:6356
- C:\Windows\System\pJLxOLH.exe
  C:\Windows\System\pJLxOLH.exe
  2⤵
  PID:6468
- C:\Windows\System\fYpKEin.exe
  C:\Windows\System\fYpKEin.exe
  2⤵
  PID:6580
- C:\Windows\System\YzfJhzY.exe
  C:\Windows\System\YzfJhzY.exe
  2⤵
  PID:6684
- C:\Windows\System\kzbZzza.exe
  C:\Windows\System\kzbZzza.exe
  2⤵
  PID:6176
- C:\Windows\System\NStPgBO.exe
  C:\Windows\System\NStPgBO.exe
  2⤵
  PID:6528
- C:\Windows\System\gdKBUQq.exe
  C:\Windows\System\gdKBUQq.exe
  2⤵
  PID:6908
- C:\Windows\System\TgeadqA.exe
  C:\Windows\System\TgeadqA.exe
  2⤵
  PID:6688
- C:\Windows\System\zGBncil.exe
  C:\Windows\System\zGBncil.exe
  2⤵
  PID:4260
- C:\Windows\System\HlXoUCW.exe
  C:\Windows\System\HlXoUCW.exe
  2⤵
  PID:6636
- C:\Windows\System\uolaaBD.exe
  C:\Windows\System\uolaaBD.exe
  2⤵
  PID:6428
- C:\Windows\System\OcuyVzA.exe
  C:\Windows\System\OcuyVzA.exe
  2⤵
  PID:6160
- C:\Windows\System\uDusLSb.exe
  C:\Windows\System\uDusLSb.exe
  2⤵
  PID:6280
- C:\Windows\System\IWScozy.exe
  C:\Windows\System\IWScozy.exe
  2⤵
  PID:6476
- C:\Windows\System\jrrHhPs.exe
  C:\Windows\System\jrrHhPs.exe
  2⤵
  PID:6804
- C:\Windows\System\GDDwhZG.exe
  C:\Windows\System\GDDwhZG.exe
  2⤵
  PID:6824
- C:\Windows\System\SedakRD.exe
  C:\Windows\System\SedakRD.exe
  2⤵
  PID:5204
- C:\Windows\System\XSxnZQN.exe
  C:\Windows\System\XSxnZQN.exe
  2⤵
  PID:6972
- C:\Windows\System\fYHZqLH.exe
  C:\Windows\System\fYHZqLH.exe
  2⤵
  PID:6744
- C:\Windows\System\tuCSFxr.exe
  C:\Windows\System\tuCSFxr.exe
  2⤵
  PID:6988
- C:\Windows\System\whNaJOU.exe
  C:\Windows\System\whNaJOU.exe
  2⤵
  PID:7008
- C:\Windows\System\nwhrfXG.exe
  C:\Windows\System\nwhrfXG.exe
  2⤵
  PID:6856
- C:\Windows\System\QryJdgx.exe
  C:\Windows\System\QryJdgx.exe
  2⤵
  PID:6456
- C:\Windows\System\FjhhSdB.exe
  C:\Windows\System\FjhhSdB.exe
  2⤵
  PID:7180
- C:\Windows\System\YyliPmC.exe
  C:\Windows\System\YyliPmC.exe
  2⤵
  PID:7204
- C:\Windows\System\VRAFNRn.exe
  C:\Windows\System\VRAFNRn.exe
  2⤵
  PID:7224
- C:\Windows\System\kxSldfO.exe
  C:\Windows\System\kxSldfO.exe
  2⤵
  PID:7240
- C:\Windows\System\yjCXMcj.exe
  C:\Windows\System\yjCXMcj.exe
  2⤵
  PID:7256
- C:\Windows\System\AmAaMzQ.exe
  C:\Windows\System\AmAaMzQ.exe
  2⤵
  PID:7272
- C:\Windows\System\QrdMYWO.exe
  C:\Windows\System\QrdMYWO.exe
  2⤵
  PID:7292
- C:\Windows\System\ZZzlbRI.exe
  C:\Windows\System\ZZzlbRI.exe
  2⤵
  PID:7316
- C:\Windows\System\xEmESip.exe
  C:\Windows\System\xEmESip.exe
  2⤵
  PID:7336
- C:\Windows\System\qJbnOiW.exe
  C:\Windows\System\qJbnOiW.exe
  2⤵
  PID:7352
- C:\Windows\System\oFmBCHI.exe
  C:\Windows\System\oFmBCHI.exe
  2⤵
  PID:7372
- C:\Windows\System\yrRvhFv.exe
  C:\Windows\System\yrRvhFv.exe
  2⤵
  PID:7388
- C:\Windows\System\xUzaWMX.exe
  C:\Windows\System\xUzaWMX.exe
  2⤵
  PID:7404
- C:\Windows\System\IuvuFUC.exe
  C:\Windows\System\IuvuFUC.exe
  2⤵
  PID:7420
- C:\Windows\System\QIoplfC.exe
  C:\Windows\System\QIoplfC.exe
  2⤵
  PID:7440
- C:\Windows\System\bXtwDkC.exe
  C:\Windows\System\bXtwDkC.exe
  2⤵
  PID:7460
- C:\Windows\System\ImDYtly.exe
  C:\Windows\System\ImDYtly.exe
  2⤵
  PID:7480
- C:\Windows\System\VfeyNAp.exe
  C:\Windows\System\VfeyNAp.exe
  2⤵
  PID:7500
- C:\Windows\System\xHuqfmV.exe
  C:\Windows\System\xHuqfmV.exe
  2⤵
  PID:7524
- C:\Windows\System\ukxoawx.exe
  C:\Windows\System\ukxoawx.exe
  2⤵
  PID:7544
- C:\Windows\System\WfbPEyA.exe
  C:\Windows\System\WfbPEyA.exe
  2⤵
  PID:7576
- C:\Windows\System\dZBBCnn.exe
  C:\Windows\System\dZBBCnn.exe
  2⤵
  PID:7592
- C:\Windows\System\ApwvGtP.exe
  C:\Windows\System\ApwvGtP.exe
  2⤵
  PID:7612
- C:\Windows\System\UtWlXot.exe
  C:\Windows\System\UtWlXot.exe
  2⤵
  PID:7640
- C:\Windows\System\ySIrlAC.exe
  C:\Windows\System\ySIrlAC.exe
  2⤵
  PID:7672
- C:\Windows\System\aLuTZHm.exe
  C:\Windows\System\aLuTZHm.exe
  2⤵
  PID:7688
- C:\Windows\System\kPfZTQS.exe
  C:\Windows\System\kPfZTQS.exe
  2⤵
  PID:7712
- C:\Windows\System\RnuJixb.exe
  C:\Windows\System\RnuJixb.exe
  2⤵
  PID:7728
- C:\Windows\System\wEcBWsF.exe
  C:\Windows\System\wEcBWsF.exe
  2⤵
  PID:7764
- C:\Windows\System\pjLDRxA.exe
  C:\Windows\System\pjLDRxA.exe
  2⤵
  PID:7784
- C:\Windows\System\zlXSTOX.exe
  C:\Windows\System\zlXSTOX.exe
  2⤵
  PID:7804
- C:\Windows\System\yzSZEje.exe
  C:\Windows\System\yzSZEje.exe
  2⤵
  PID:7824
- C:\Windows\System\NwgZomq.exe
  C:\Windows\System\NwgZomq.exe
  2⤵
  PID:7840
- C:\Windows\System\pWEXWOO.exe
  C:\Windows\System\pWEXWOO.exe
  2⤵
  PID:7856
- C:\Windows\System\rpLgPkD.exe
  C:\Windows\System\rpLgPkD.exe
  2⤵
  PID:7872
- C:\Windows\System\xDhYBKt.exe
  C:\Windows\System\xDhYBKt.exe
  2⤵
  PID:7888
- C:\Windows\System\AWKULZD.exe
  C:\Windows\System\AWKULZD.exe
  2⤵
  PID:7904
- C:\Windows\System\dkmtnbU.exe
  C:\Windows\System\dkmtnbU.exe
  2⤵
  PID:7924
- C:\Windows\System\IiZiByb.exe
  C:\Windows\System\IiZiByb.exe
  2⤵
  PID:7944
- C:\Windows\System\VByNGKV.exe
  C:\Windows\System\VByNGKV.exe
  2⤵
  PID:7964
- C:\Windows\System\uQRibnb.exe
  C:\Windows\System\uQRibnb.exe
  2⤵
  PID:7980
- C:\Windows\System\CZvijlh.exe
  C:\Windows\System\CZvijlh.exe
  2⤵
  PID:8004
- C:\Windows\System\yDNskax.exe
  C:\Windows\System\yDNskax.exe
  2⤵
  PID:8020
- C:\Windows\System\JAYXaPE.exe
  C:\Windows\System\JAYXaPE.exe
  2⤵
  PID:8036
- C:\Windows\System\mQUboHB.exe
  C:\Windows\System\mQUboHB.exe
  2⤵
  PID:8052
- C:\Windows\System\mCnmFXF.exe
  C:\Windows\System\mCnmFXF.exe
  2⤵
  PID:8068
- C:\Windows\System\PTJaoaf.exe
  C:\Windows\System\PTJaoaf.exe
  2⤵
  PID:8088
- C:\Windows\System\igXrujj.exe
  C:\Windows\System\igXrujj.exe
  2⤵
  PID:8104
- C:\Windows\System\EMhPeFD.exe
  C:\Windows\System\EMhPeFD.exe
  2⤵
  PID:8124
- C:\Windows\System\PqjAGhj.exe
  C:\Windows\System\PqjAGhj.exe
  2⤵
  PID:8140
- C:\Windows\System\lTOqzDS.exe
  C:\Windows\System\lTOqzDS.exe
  2⤵
  PID:8156
- C:\Windows\System\faVJjqK.exe
  C:\Windows\System\faVJjqK.exe
  2⤵
  PID:8180
- C:\Windows\System\ieTxBeW.exe
  C:\Windows\System\ieTxBeW.exe
  2⤵
  PID:7188
- C:\Windows\System\THcswJG.exe
  C:\Windows\System\THcswJG.exe
  2⤵
  PID:7236
- C:\Windows\System\mAyDWqo.exe
  C:\Windows\System\mAyDWqo.exe
  2⤵
  PID:7304
- C:\Windows\System\DzqkBBQ.exe
  C:\Windows\System\DzqkBBQ.exe
  2⤵
  PID:7368
- C:\Windows\System\NakwzpA.exe
  C:\Windows\System\NakwzpA.exe
  2⤵
  PID:6784
- C:\Windows\System\uhgrwaU.exe
  C:\Windows\System\uhgrwaU.exe
  2⤵
  PID:6612
- C:\Windows\System\uFQBUli.exe
  C:\Windows\System\uFQBUli.exe
  2⤵
  PID:7220
- C:\Windows\System\rHGuEHK.exe
  C:\Windows\System\rHGuEHK.exe
  2⤵
  PID:7328
- C:\Windows\System\IStBXMd.exe
  C:\Windows\System\IStBXMd.exe
  2⤵
  PID:7396
- C:\Windows\System\LYslrbt.exe
  C:\Windows\System\LYslrbt.exe
  2⤵
  PID:6992
- C:\Windows\System\gVyecIf.exe
  C:\Windows\System\gVyecIf.exe
  2⤵
  PID:6944
- C:\Windows\System\LrHkHjE.exe
  C:\Windows\System\LrHkHjE.exe
  2⤵
  PID:7068
- C:\Windows\System\WTqcVts.exe
  C:\Windows\System\WTqcVts.exe
  2⤵
  PID:6560
- C:\Windows\System\UmphrCp.exe
  C:\Windows\System\UmphrCp.exe
  2⤵
  PID:7496
- C:\Windows\System\tfWwsbd.exe
  C:\Windows\System\tfWwsbd.exe
  2⤵
  PID:7636
- C:\Windows\System\lGHUXDh.exe
  C:\Windows\System\lGHUXDh.exe
  2⤵
  PID:7552
- C:\Windows\System\DRTTjgL.exe
  C:\Windows\System\DRTTjgL.exe
  2⤵
  PID:7648
- C:\Windows\System\JMxLsaw.exe
  C:\Windows\System\JMxLsaw.exe
  2⤵
  PID:7472
- C:\Windows\System\wbYrSIG.exe
  C:\Windows\System\wbYrSIG.exe
  2⤵
  PID:7608
- C:\Windows\System\ErylEMz.exe
  C:\Windows\System\ErylEMz.exe
  2⤵
  PID:7720
- C:\Windows\System\xBvczsd.exe
  C:\Windows\System\xBvczsd.exe
  2⤵
  PID:7572
- C:\Windows\System\RwLBsHL.exe
  C:\Windows\System\RwLBsHL.exe
  2⤵
  PID:7780
- C:\Windows\System\orjWAMq.exe
  C:\Windows\System\orjWAMq.exe
  2⤵
  PID:7736
- C:\Windows\System\xraeuPD.exe
  C:\Windows\System\xraeuPD.exe
  2⤵
  PID:7884
- C:\Windows\System\bRHwtZQ.exe
  C:\Windows\System\bRHwtZQ.exe
  2⤵
  PID:7960
- C:\Windows\System\CUjgpcy.exe
  C:\Windows\System\CUjgpcy.exe
  2⤵
  PID:7992
- C:\Windows\System\ODYEhKQ.exe
  C:\Windows\System\ODYEhKQ.exe
  2⤵
  PID:8100
- C:\Windows\System\ShIzout.exe
  C:\Windows\System\ShIzout.exe
  2⤵
  PID:8168
- C:\Windows\System\jRQGwpr.exe
  C:\Windows\System\jRQGwpr.exe
  2⤵
  PID:7200
- C:\Windows\System\OeippwX.exe
  C:\Windows\System\OeippwX.exe
  2⤵
  PID:6724
- C:\Windows\System\QTmUraL.exe
  C:\Windows\System\QTmUraL.exe
  2⤵
  PID:6540
- C:\Windows\System\vfpiAbh.exe
  C:\Windows\System\vfpiAbh.exe
  2⤵
  PID:6872
- C:\Windows\System\yQFPlNc.exe
  C:\Windows\System\yQFPlNc.exe
  2⤵
  PID:7456
- C:\Windows\System\xxqIHYW.exe
  C:\Windows\System\xxqIHYW.exe
  2⤵
  PID:7232
- C:\Windows\System\DalEzQA.exe
  C:\Windows\System\DalEzQA.exe
  2⤵
  PID:7436
- C:\Windows\System\QeNxvrZ.exe
  C:\Windows\System\QeNxvrZ.exe
  2⤵
  PID:7384
- C:\Windows\System\JDKvjXe.exe
  C:\Windows\System\JDKvjXe.exe
  2⤵
  PID:7664
- C:\Windows\System\GTZdCag.exe
  C:\Windows\System\GTZdCag.exe
  2⤵
  PID:7852
- C:\Windows\System\eaBCpfr.exe
  C:\Windows\System\eaBCpfr.exe
  2⤵
  PID:7360
- C:\Windows\System\HynkXWC.exe
  C:\Windows\System\HynkXWC.exe
  2⤵
  PID:8000
- C:\Windows\System\htmXQVv.exe
  C:\Windows\System\htmXQVv.exe
  2⤵
  PID:7832
- C:\Windows\System\MgTegRb.exe
  C:\Windows\System\MgTegRb.exe
  2⤵
  PID:7708
- C:\Windows\System\QYAGlVJ.exe
  C:\Windows\System\QYAGlVJ.exe
  2⤵
  PID:7756
- C:\Windows\System\HhgNABs.exe
  C:\Windows\System\HhgNABs.exe
  2⤵
  PID:7488
- C:\Windows\System\gsHdqqg.exe
  C:\Windows\System\gsHdqqg.exe
  2⤵
  PID:7412
- C:\Windows\System\ySakkvk.exe
  C:\Windows\System\ySakkvk.exe
  2⤵
  PID:8196
- C:\Windows\System\LtXUfWf.exe
  C:\Windows\System\LtXUfWf.exe
  2⤵
  PID:8216
- C:\Windows\System\JJenrhF.exe
  C:\Windows\System\JJenrhF.exe
  2⤵
  PID:8232
- C:\Windows\System\tucFsEd.exe
  C:\Windows\System\tucFsEd.exe
  2⤵
  PID:8252
- C:\Windows\System\sDSMSTY.exe
  C:\Windows\System\sDSMSTY.exe
  2⤵
  PID:8272
- C:\Windows\System\UpWvuRT.exe
  C:\Windows\System\UpWvuRT.exe
  2⤵
  PID:8292
- C:\Windows\System\bjpkPCo.exe
  C:\Windows\System\bjpkPCo.exe
  2⤵
  PID:8308
- C:\Windows\System\OuGicAI.exe
  C:\Windows\System\OuGicAI.exe
  2⤵
  PID:8324
- C:\Windows\System\FBnYhNn.exe
  C:\Windows\System\FBnYhNn.exe
  2⤵
  PID:8344
- C:\Windows\System\ElCRZQv.exe
  C:\Windows\System\ElCRZQv.exe
  2⤵
  PID:8364
- C:\Windows\System\mzUktVM.exe
  C:\Windows\System\mzUktVM.exe
  2⤵
  PID:8384
- C:\Windows\System\apjobVy.exe
  C:\Windows\System\apjobVy.exe
  2⤵
  PID:8404
- C:\Windows\System\YCQkKCL.exe
  C:\Windows\System\YCQkKCL.exe
  2⤵
  PID:8432
- C:\Windows\System\xPVANEm.exe
  C:\Windows\System\xPVANEm.exe
  2⤵
  PID:8452
- C:\Windows\System\uRzrUwI.exe
  C:\Windows\System\uRzrUwI.exe
  2⤵
  PID:8472
- C:\Windows\System\RPcHshj.exe
  C:\Windows\System\RPcHshj.exe
  2⤵
  PID:8492
- C:\Windows\System\aMlxQtQ.exe
  C:\Windows\System\aMlxQtQ.exe
  2⤵
  PID:8512
- C:\Windows\System\hxfRwHW.exe
  C:\Windows\System\hxfRwHW.exe
  2⤵
  PID:8536
- C:\Windows\System\kyhHZfT.exe
  C:\Windows\System\kyhHZfT.exe
  2⤵
  PID:8556
- C:\Windows\System\jledvIk.exe
  C:\Windows\System\jledvIk.exe
  2⤵
  PID:8572
- C:\Windows\System\JbsdRjN.exe
  C:\Windows\System\JbsdRjN.exe
  2⤵
  PID:8588
- C:\Windows\System\esxKVmQ.exe
  C:\Windows\System\esxKVmQ.exe
  2⤵
  PID:8696
- C:\Windows\System\ZAbvRVY.exe
  C:\Windows\System\ZAbvRVY.exe
  2⤵
  PID:8712
- C:\Windows\System\IUmROio.exe
  C:\Windows\System\IUmROio.exe
  2⤵
  PID:8740
- C:\Windows\System\JbTYOAM.exe
  C:\Windows\System\JbTYOAM.exe
  2⤵
  PID:8756
- C:\Windows\System\vglEONz.exe
  C:\Windows\System\vglEONz.exe
  2⤵
  PID:8776
- C:\Windows\System\uoyizAs.exe
  C:\Windows\System\uoyizAs.exe
  2⤵
  PID:8792
- C:\Windows\System\UnfWIij.exe
  C:\Windows\System\UnfWIij.exe
  2⤵
  PID:8812
- C:\Windows\System\isUFoTy.exe
  C:\Windows\System\isUFoTy.exe
  2⤵
  PID:8828
- C:\Windows\System\pJehzFC.exe
  C:\Windows\System\pJehzFC.exe
  2⤵
  PID:8848
- C:\Windows\System\UnuZdpn.exe
  C:\Windows\System\UnuZdpn.exe
  2⤵
  PID:8868
- C:\Windows\System\fzjSKGh.exe
  C:\Windows\System\fzjSKGh.exe
  2⤵
  PID:8884
- C:\Windows\System\OZZYjfH.exe
  C:\Windows\System\OZZYjfH.exe
  2⤵
  PID:8908
- C:\Windows\System\WyadqQX.exe
  C:\Windows\System\WyadqQX.exe
  2⤵
  PID:8936
- C:\Windows\System\ouszSFy.exe
  C:\Windows\System\ouszSFy.exe
  2⤵
  PID:8952
- C:\Windows\System\hoRlJCr.exe
  C:\Windows\System\hoRlJCr.exe
  2⤵
  PID:8972
- C:\Windows\System\jMcMvHc.exe
  C:\Windows\System\jMcMvHc.exe
  2⤵
  PID:9000
- C:\Windows\System\yFMqWfB.exe
  C:\Windows\System\yFMqWfB.exe
  2⤵
  PID:9016
- C:\Windows\System\odMWQKN.exe
  C:\Windows\System\odMWQKN.exe
  2⤵
  PID:9036
- C:\Windows\System\MZYXZrv.exe
  C:\Windows\System\MZYXZrv.exe
  2⤵
  PID:9056
- C:\Windows\System\GdUTbNm.exe
  C:\Windows\System\GdUTbNm.exe
  2⤵
  PID:9076
- C:\Windows\System\tJmCUfU.exe
  C:\Windows\System\tJmCUfU.exe
  2⤵
  PID:9096
- C:\Windows\System\gRscfRC.exe
  C:\Windows\System\gRscfRC.exe
  2⤵
  PID:9112
- C:\Windows\System\FrRbfcw.exe
  C:\Windows\System\FrRbfcw.exe
  2⤵
  PID:9136
- C:\Windows\System\cOqbwPH.exe
  C:\Windows\System\cOqbwPH.exe
  2⤵
  PID:9152
- C:\Windows\System\cAXlbGN.exe
  C:\Windows\System\cAXlbGN.exe
  2⤵
  PID:9176
- C:\Windows\System\yUVDrWk.exe
  C:\Windows\System\yUVDrWk.exe
  2⤵
  PID:9192
- C:\Windows\System\yoxNJtz.exe
  C:\Windows\System\yoxNJtz.exe
  2⤵
  PID:9208
- C:\Windows\System\OzOImcr.exe
  C:\Windows\System\OzOImcr.exe
  2⤵
  PID:7848
- C:\Windows\System\AooEzVs.exe
  C:\Windows\System\AooEzVs.exe
  2⤵
  PID:8228
- C:\Windows\System\HIBwaCL.exe
  C:\Windows\System\HIBwaCL.exe
  2⤵
  PID:8300
- C:\Windows\System\kBtwdep.exe
  C:\Windows\System\kBtwdep.exe
  2⤵
  PID:8340
- C:\Windows\System\mxakuPV.exe
  C:\Windows\System\mxakuPV.exe
  2⤵
  PID:8376
- C:\Windows\System\VpvsBEc.exe
  C:\Windows\System\VpvsBEc.exe
  2⤵
  PID:7624
- C:\Windows\System\szpvOMt.exe
  C:\Windows\System\szpvOMt.exe
  2⤵
  PID:7268
- C:\Windows\System\PicgPen.exe
  C:\Windows\System\PicgPen.exe
  2⤵
  PID:8500
- C:\Windows\System\ATsJoeQ.exe
  C:\Windows\System\ATsJoeQ.exe
  2⤵
  PID:7864
- C:\Windows\System\NKZIzPV.exe
  C:\Windows\System\NKZIzPV.exe
  2⤵
  PID:7972
- C:\Windows\System\LjxeEDO.exe
  C:\Windows\System\LjxeEDO.exe
  2⤵
  PID:8044
- C:\Windows\System\YSXblEN.exe
  C:\Windows\System\YSXblEN.exe
  2⤵
  PID:8116
- C:\Windows\System\gXFrzUi.exe
  C:\Windows\System\gXFrzUi.exe
  2⤵
  PID:8152
- C:\Windows\System\IBVYRdh.exe
  C:\Windows\System\IBVYRdh.exe
  2⤵
  PID:8208
- C:\Windows\System\APsXnmh.exe
  C:\Windows\System\APsXnmh.exe
  2⤵
  PID:6384
- C:\Windows\System\SreWhrQ.exe
  C:\Windows\System\SreWhrQ.exe
  2⤵
  PID:7536
- C:\Windows\System\qMsdDwR.exe
  C:\Windows\System\qMsdDwR.exe
  2⤵
  PID:7512
- C:\Windows\System\VOkmHZz.exe
  C:\Windows\System\VOkmHZz.exe
  2⤵
  PID:7704
- C:\Windows\System\syfWvNn.exe
  C:\Windows\System\syfWvNn.exe
  2⤵
  PID:8164
- C:\Windows\System\ofPHIWA.exe
  C:\Windows\System\ofPHIWA.exe
  2⤵
  PID:7432
- C:\Windows\System\RqwMteE.exe
  C:\Windows\System\RqwMteE.exe
  2⤵
  PID:8280
- C:\Windows\System\MXEcIgp.exe
  C:\Windows\System\MXEcIgp.exe
  2⤵
  PID:8396
- C:\Windows\System\xFRETZL.exe
  C:\Windows\System\xFRETZL.exe
  2⤵
  PID:8520
- C:\Windows\System\pTeELmD.exe
  C:\Windows\System\pTeELmD.exe
  2⤵
  PID:8532
- C:\Windows\System\KMYplBj.exe
  C:\Windows\System\KMYplBj.exe
  2⤵
  PID:7696
- C:\Windows\System\gIIDhcZ.exe
  C:\Windows\System\gIIDhcZ.exe
  2⤵
  PID:8580
- C:\Windows\System\OdbYBfR.exe
  C:\Windows\System\OdbYBfR.exe
  2⤵
  PID:8596
- C:\Windows\System\kfQaEeT.exe
  C:\Windows\System\kfQaEeT.exe
  2⤵
  PID:8616
- C:\Windows\System\zykkmIW.exe
  C:\Windows\System\zykkmIW.exe
  2⤵
  PID:8632
- C:\Windows\System\qeMVMmA.exe
  C:\Windows\System\qeMVMmA.exe
  2⤵
  PID:8660
- C:\Windows\System\CKdABMx.exe
  C:\Windows\System\CKdABMx.exe
  2⤵
  PID:8676
- C:\Windows\System\xUDrrBi.exe
  C:\Windows\System\xUDrrBi.exe
  2⤵
  PID:8708
- C:\Windows\System\MljJjBL.exe
  C:\Windows\System\MljJjBL.exe
  2⤵
  PID:8692
- C:\Windows\System\CUyqBlu.exe
  C:\Windows\System\CUyqBlu.exe
  2⤵
  PID:8784
- C:\Windows\System\AdFlUZa.exe
  C:\Windows\System\AdFlUZa.exe
  2⤵
  PID:8824
- C:\Windows\System\lwjHhMW.exe
  C:\Windows\System\lwjHhMW.exe
  2⤵
  PID:8840
- C:\Windows\System\kfHtITU.exe
  C:\Windows\System\kfHtITU.exe
  2⤵
  PID:8896
- C:\Windows\System\yatEiar.exe
  C:\Windows\System\yatEiar.exe
  2⤵
  PID:8808
- C:\Windows\System\MimwboY.exe
  C:\Windows\System\MimwboY.exe
  2⤵
  PID:8836
- C:\Windows\System\GNwkOUr.exe
  C:\Windows\System\GNwkOUr.exe
  2⤵
  PID:8964
- C:\Windows\System\PjftNmh.exe
  C:\Windows\System\PjftNmh.exe
  2⤵
  PID:8920
- C:\Windows\System\lUEJHzk.exe
  C:\Windows\System\lUEJHzk.exe
  2⤵
  PID:9008
- C:\Windows\System\MFxSLuo.exe
  C:\Windows\System\MFxSLuo.exe
  2⤵
  PID:9104
- C:\Windows\System\qUPkJjl.exe
  C:\Windows\System\qUPkJjl.exe
  2⤵
  PID:9148
- C:\Windows\System\ncLmciH.exe
  C:\Windows\System\ncLmciH.exe
  2⤵
  PID:7004
- C:\Windows\System\lrvgPob.exe
  C:\Windows\System\lrvgPob.exe
  2⤵
  PID:9092
- C:\Windows\System\SdXcGlq.exe
  C:\Windows\System\SdXcGlq.exe
  2⤵
  PID:7216
- C:\Windows\System\PdocjPI.exe
  C:\Windows\System\PdocjPI.exe
  2⤵
  PID:9120
- C:\Windows\System\gjVKZpq.exe
  C:\Windows\System\gjVKZpq.exe
  2⤵
  PID:8508
- C:\Windows\System\IVUPuHN.exe
  C:\Windows\System\IVUPuHN.exe
  2⤵
  PID:7920
- C:\Windows\System\nkliqCx.exe
  C:\Windows\System\nkliqCx.exe
  2⤵
  PID:7796
- C:\Windows\System\ZYiUvcb.exe
  C:\Windows\System\ZYiUvcb.exe
  2⤵
  PID:8336
- C:\Windows\System\jDJYJfN.exe
  C:\Windows\System\jDJYJfN.exe
  2⤵
  PID:8016
- C:\Windows\System\jabgeXm.exe
  C:\Windows\System\jabgeXm.exe
  2⤵
  PID:7620
- C:\Windows\System\lgcFDjA.exe
  C:\Windows\System\lgcFDjA.exe
  2⤵
  PID:8096
- C:\Windows\System\HnVCJTH.exe
  C:\Windows\System\HnVCJTH.exe
  2⤵
  PID:7940
- C:\Windows\System\ztYwngD.exe
  C:\Windows\System\ztYwngD.exe
  2⤵
  PID:8060
- C:\Windows\System\rREDocq.exe
  C:\Windows\System\rREDocq.exe
  2⤵
  PID:8244
- C:\Windows\System\qqNmWoO.exe
  C:\Windows\System\qqNmWoO.exe
  2⤵
  PID:8440
- C:\Windows\System\RxFAEyC.exe
  C:\Windows\System\RxFAEyC.exe
  2⤵
  PID:7568
- C:\Windows\System\skqUtUY.exe
  C:\Windows\System\skqUtUY.exe
  2⤵
  PID:8288
- C:\Windows\System\AgPDCmL.exe
  C:\Windows\System\AgPDCmL.exe
  2⤵
  PID:8528
- C:\Windows\System\DnspWpn.exe
  C:\Windows\System\DnspWpn.exe
  2⤵
  PID:7448
- C:\Windows\System\XQOzetc.exe
  C:\Windows\System\XQOzetc.exe
  2⤵
  PID:7956
- C:\Windows\System\akWSQpx.exe
  C:\Windows\System\akWSQpx.exe
  2⤵
  PID:8636
- C:\Windows\System\yRkGRvm.exe
  C:\Windows\System\yRkGRvm.exe
  2⤵
  PID:8604
- C:\Windows\System\DcRSlWM.exe
  C:\Windows\System\DcRSlWM.exe
  2⤵
  PID:8736
- C:\Windows\System\mDPbAuR.exe
  C:\Windows\System\mDPbAuR.exe
  2⤵
  PID:8916
- C:\Windows\System\gOvWRtg.exe
  C:\Windows\System\gOvWRtg.exe
  2⤵
  PID:8704
- C:\Windows\System\unVNglN.exe
  C:\Windows\System\unVNglN.exe
  2⤵
  PID:8860
- C:\Windows\System\tlLXAsp.exe
  C:\Windows\System\tlLXAsp.exe
  2⤵
  PID:8804
- C:\Windows\System\AoirvWr.exe
  C:\Windows\System\AoirvWr.exe
  2⤵
  PID:8992
- C:\Windows\System\GUrmHXj.exe
  C:\Windows\System\GUrmHXj.exe
  2⤵
  PID:9048
- C:\Windows\System\pzfXAni.exe
  C:\Windows\System\pzfXAni.exe
  2⤵
  PID:7348
- C:\Windows\System\XOSQfJV.exe
  C:\Windows\System\XOSQfJV.exe
  2⤵
  PID:9128
- C:\Windows\System\gLWQpGn.exe
  C:\Windows\System\gLWQpGn.exe
  2⤵
  PID:9088
- C:\Windows\System\yBRlESN.exe
  C:\Windows\System\yBRlESN.exe
  2⤵
  PID:8464
- C:\Windows\System\HEunFlP.exe
  C:\Windows\System\HEunFlP.exe
  2⤵
  PID:7792
- C:\Windows\System\KHDzxuK.exe
  C:\Windows\System\KHDzxuK.exe
  2⤵
  PID:8224
- C:\Windows\System\wZRKxlK.exe
  C:\Windows\System\wZRKxlK.exe
  2⤵
  PID:8416
- C:\Windows\System\VBeZHiH.exe
  C:\Windows\System\VBeZHiH.exe
  2⤵
  PID:7744
- C:\Windows\System\rDXtxkX.exe
  C:\Windows\System\rDXtxkX.exe
  2⤵
  PID:8084
- C:\Windows\System\GSFoYVX.exe
  C:\Windows\System\GSFoYVX.exe
  2⤵
  PID:7584
- C:\Windows\System\UpxPzLi.exe
  C:\Windows\System\UpxPzLi.exe
  2⤵
  PID:7532
- C:\Windows\System\gvcTPHx.exe
  C:\Windows\System\gvcTPHx.exe
  2⤵
  PID:8480
- C:\Windows\System\PwmwLIN.exe
  C:\Windows\System\PwmwLIN.exe
  2⤵
  PID:8352
- C:\Windows\System\tUMayLC.exe
  C:\Windows\System\tUMayLC.exe
  2⤵
  PID:7816
- C:\Windows\System\XWHbvkV.exe
  C:\Windows\System\XWHbvkV.exe
  2⤵
  PID:8668
- C:\Windows\System\qRAzVaZ.exe
  C:\Windows\System\qRAzVaZ.exe
  2⤵
  PID:8620
- C:\Windows\System\ZMJXhDL.exe
  C:\Windows\System\ZMJXhDL.exe
  2⤵
  PID:8820
- C:\Windows\System\aBLYemA.exe
  C:\Windows\System\aBLYemA.exe
  2⤵
  PID:8948
- C:\Windows\System\Kijdthk.exe
  C:\Windows\System\Kijdthk.exe
  2⤵
  PID:8768
- C:\Windows\System\IXtCxdt.exe
  C:\Windows\System\IXtCxdt.exe
  2⤵
  PID:9032
- C:\Windows\System\OPVznsr.exe
  C:\Windows\System\OPVznsr.exe
  2⤵
  PID:8928
- C:\Windows\System\oblfRub.exe
  C:\Windows\System\oblfRub.exe
  2⤵
  PID:9028
- C:\Windows\System\AkqfTOa.exe
  C:\Windows\System\AkqfTOa.exe
  2⤵
  PID:9044
- C:\Windows\System\ZEtVAio.exe
  C:\Windows\System\ZEtVAio.exe
  2⤵
  PID:7092
- C:\Windows\System\MDLwePq.exe
  C:\Windows\System\MDLwePq.exe
  2⤵
  PID:9164
- C:\Windows\System\nCRqQno.exe
  C:\Windows\System\nCRqQno.exe
  2⤵
  PID:8544
- C:\Windows\System\YAmjCXp.exe
  C:\Windows\System\YAmjCXp.exe
  2⤵
  PID:8048
- C:\Windows\System\oVfVaLb.exe
  C:\Windows\System\oVfVaLb.exe
  2⤵
  PID:6220
- C:\Windows\System\VolaHXj.exe
  C:\Windows\System\VolaHXj.exe
  2⤵
  PID:9168
- C:\Windows\System\kUkGRBk.exe
  C:\Windows\System\kUkGRBk.exe
  2⤵
  PID:8420
- C:\Windows\System\SYqYrqs.exe
  C:\Windows\System\SYqYrqs.exe
  2⤵
  PID:2472
- C:\Windows\System\kOKhMZh.exe
  C:\Windows\System\kOKhMZh.exe
  2⤵
  PID:8968
- C:\Windows\System\bBVnYne.exe
  C:\Windows\System\bBVnYne.exe
  2⤵
  PID:8728
- C:\Windows\System\dYxqxka.exe
  C:\Windows\System\dYxqxka.exe
  2⤵
  PID:8764
- C:\Windows\System\wacIsyD.exe
  C:\Windows\System\wacIsyD.exe
  2⤵
  PID:9072
- C:\Windows\System\VqJNzzU.exe
  C:\Windows\System\VqJNzzU.exe
  2⤵
  PID:7588
- C:\Windows\System\YklqXae.exe
  C:\Windows\System\YklqXae.exe
  2⤵
  PID:8428
- C:\Windows\System\xWHENcl.exe
  C:\Windows\System\xWHENcl.exe
  2⤵
  PID:8984
- C:\Windows\System\eCKqOty.exe
  C:\Windows\System\eCKqOty.exe
  2⤵
  PID:8864
- C:\Windows\System\VnBsbXE.exe
  C:\Windows\System\VnBsbXE.exe
  2⤵
  PID:2096
- C:\Windows\System\fMljSFD.exe
  C:\Windows\System\fMljSFD.exe
  2⤵
  PID:7748
- C:\Windows\System\VxGlIlh.exe
  C:\Windows\System\VxGlIlh.exe
  2⤵
  PID:8548
- C:\Windows\System\JwltAPs.exe
  C:\Windows\System\JwltAPs.exe
  2⤵
  PID:8904
- C:\Windows\System\YcoVeSx.exe
  C:\Windows\System\YcoVeSx.exe
  2⤵
  PID:7428
- C:\Windows\System\omDCEvB.exe
  C:\Windows\System\omDCEvB.exe
  2⤵
  PID:9232
- C:\Windows\System\MbmiCuY.exe
  C:\Windows\System\MbmiCuY.exe
  2⤵
  PID:9248
- C:\Windows\System\gYiIlgV.exe
  C:\Windows\System\gYiIlgV.exe
  2⤵
  PID:9264
- C:\Windows\System\XssRkLW.exe
  C:\Windows\System\XssRkLW.exe
  2⤵
  PID:9280
- C:\Windows\System\ONfmvtg.exe
  C:\Windows\System\ONfmvtg.exe
  2⤵
  PID:9296
- C:\Windows\System\PyrwWLw.exe
  C:\Windows\System\PyrwWLw.exe
  2⤵
  PID:9312
- C:\Windows\System\mZTGgLj.exe
  C:\Windows\System\mZTGgLj.exe
  2⤵
  PID:9328
- C:\Windows\System\JotKmAV.exe
  C:\Windows\System\JotKmAV.exe
  2⤵
  PID:9344
- C:\Windows\System\sukobzY.exe
  C:\Windows\System\sukobzY.exe
  2⤵
  PID:9360
- C:\Windows\System\JzYRLXv.exe
  C:\Windows\System\JzYRLXv.exe
  2⤵
  PID:9376
- C:\Windows\System\AQcElKs.exe
  C:\Windows\System\AQcElKs.exe
  2⤵
  PID:9392
- C:\Windows\System\kqXozyx.exe
  C:\Windows\System\kqXozyx.exe
  2⤵
  PID:9408
- C:\Windows\System\cjqhTol.exe
  C:\Windows\System\cjqhTol.exe
  2⤵
  PID:9424
- C:\Windows\System\RPOrOzu.exe
  C:\Windows\System\RPOrOzu.exe
  2⤵
  PID:9440
- C:\Windows\System\SxcLuQm.exe
  C:\Windows\System\SxcLuQm.exe
  2⤵
  PID:9456
- C:\Windows\System\vgzqnxk.exe
  C:\Windows\System\vgzqnxk.exe
  2⤵
  PID:9472
- C:\Windows\System\KsqoUGF.exe
  C:\Windows\System\KsqoUGF.exe
  2⤵
  PID:9488
- C:\Windows\System\wkQgtrp.exe
  C:\Windows\System\wkQgtrp.exe
  2⤵
  PID:9504
- C:\Windows\System\klQOBHx.exe
  C:\Windows\System\klQOBHx.exe
  2⤵
  PID:9520
- C:\Windows\System\etneAck.exe
  C:\Windows\System\etneAck.exe
  2⤵
  PID:9536
- C:\Windows\System\PoPdDBz.exe
  C:\Windows\System\PoPdDBz.exe
  2⤵
  PID:9552
- C:\Windows\System\KlMFnzi.exe
  C:\Windows\System\KlMFnzi.exe
  2⤵
  PID:9568
- C:\Windows\System\FFHDYax.exe
  C:\Windows\System\FFHDYax.exe
  2⤵
  PID:9584
- C:\Windows\System\wNjlhLQ.exe
  C:\Windows\System\wNjlhLQ.exe
  2⤵
  PID:9600
- C:\Windows\System\GebBOHP.exe
  C:\Windows\System\GebBOHP.exe
  2⤵
  PID:9616
- C:\Windows\System\anjcnkj.exe
  C:\Windows\System\anjcnkj.exe
  2⤵
  PID:9632
- C:\Windows\System\IBpxisC.exe
  C:\Windows\System\IBpxisC.exe
  2⤵
  PID:9648
- C:\Windows\System\TkhthlQ.exe
  C:\Windows\System\TkhthlQ.exe
  2⤵
  PID:9832
- C:\Windows\System\bxFFqFz.exe
  C:\Windows\System\bxFFqFz.exe
  2⤵
  PID:9868
- C:\Windows\System\LhyfKeZ.exe
  C:\Windows\System\LhyfKeZ.exe
  2⤵
  PID:9892
- C:\Windows\System\dgRBFWR.exe
  C:\Windows\System\dgRBFWR.exe
  2⤵
  PID:9956
- C:\Windows\System\HHqTvzd.exe
  C:\Windows\System\HHqTvzd.exe
  2⤵
  PID:10024
- C:\Windows\System\xvYMowb.exe
  C:\Windows\System\xvYMowb.exe
  2⤵
  PID:10040
- C:\Windows\System\GUNWsbh.exe
  C:\Windows\System\GUNWsbh.exe
  2⤵
  PID:10056
- C:\Windows\System\wQgVEKg.exe
  C:\Windows\System\wQgVEKg.exe
  2⤵
  PID:10072
- C:\Windows\System\SdlELrm.exe
  C:\Windows\System\SdlELrm.exe
  2⤵
  PID:10088
- C:\Windows\System\qcjNIlO.exe
  C:\Windows\System\qcjNIlO.exe
  2⤵
  PID:10108
- C:\Windows\System\UgOzEKq.exe
  C:\Windows\System\UgOzEKq.exe
  2⤵
  PID:10128
- C:\Windows\System\dhNWNUh.exe
  C:\Windows\System\dhNWNUh.exe
  2⤵
  PID:10144
- C:\Windows\System\FBNtcQk.exe
  C:\Windows\System\FBNtcQk.exe
  2⤵
  PID:10160
- C:\Windows\System\qbNvMoN.exe
  C:\Windows\System\qbNvMoN.exe
  2⤵
  PID:10180
- C:\Windows\System\bxnbIzM.exe
  C:\Windows\System\bxnbIzM.exe
  2⤵
  PID:10196
- C:\Windows\System\PjKfkjx.exe
  C:\Windows\System\PjKfkjx.exe
  2⤵
  PID:10216
- C:\Windows\System\hCndNQM.exe
  C:\Windows\System\hCndNQM.exe
  2⤵
  PID:10236
- C:\Windows\System\LUWMtOO.exe
  C:\Windows\System\LUWMtOO.exe
  2⤵
  PID:9256
- C:\Windows\System\xeCAdev.exe
  C:\Windows\System\xeCAdev.exe
  2⤵
  PID:9240
- C:\Windows\System\wpkAyZX.exe
  C:\Windows\System\wpkAyZX.exe
  2⤵
  PID:9388
- C:\Windows\System\uHCgwcu.exe
  C:\Windows\System\uHCgwcu.exe
  2⤵
  PID:9452
- C:\Windows\System\iXBUaNi.exe
  C:\Windows\System\iXBUaNi.exe
  2⤵
  PID:9516
- C:\Windows\System\lfHOOeQ.exe
  C:\Windows\System\lfHOOeQ.exe
  2⤵
  PID:9272
- C:\Windows\System\yWkfJxz.exe
  C:\Windows\System\yWkfJxz.exe
  2⤵
  PID:9400
- C:\Windows\System\UgmxVtT.exe
  C:\Windows\System\UgmxVtT.exe
  2⤵
  PID:9576
- C:\Windows\System\HvAzvXf.exe
  C:\Windows\System\HvAzvXf.exe
  2⤵
  PID:9596
- C:\Windows\System\JZEJjfu.exe
  C:\Windows\System\JZEJjfu.exe
  2⤵
  PID:9580
- C:\Windows\System\wpUiLzS.exe
  C:\Windows\System\wpUiLzS.exe
  2⤵
  PID:9656
- C:\Windows\System\jvYONvF.exe
  C:\Windows\System\jvYONvF.exe
  2⤵
  PID:9676
- C:\Windows\System\SfKQlOP.exe
  C:\Windows\System\SfKQlOP.exe
  2⤵
  PID:9712
- C:\Windows\System\NFAmAyR.exe
  C:\Windows\System\NFAmAyR.exe
  2⤵
  PID:9692
- C:\Windows\System\otDnVst.exe
  C:\Windows\System\otDnVst.exe
  2⤵
  PID:9736
- C:\Windows\System\dtVKDyQ.exe
  C:\Windows\System\dtVKDyQ.exe
  2⤵
  PID:9752
- C:\Windows\System\cVIoplN.exe
  C:\Windows\System\cVIoplN.exe
  2⤵
  PID:9772
- C:\Windows\System\WlATmcx.exe
  C:\Windows\System\WlATmcx.exe
  2⤵
  PID:9796
- C:\Windows\System\rxygLek.exe
  C:\Windows\System\rxygLek.exe
  2⤵
  PID:9824
- C:\Windows\System\NdRoyfZ.exe
  C:\Windows\System\NdRoyfZ.exe
  2⤵
  PID:9852
- C:\Windows\System\PJjArYK.exe
  C:\Windows\System\PJjArYK.exe
  2⤵
  PID:9876
- C:\Windows\System\HreEfMP.exe
  C:\Windows\System\HreEfMP.exe
  2⤵
  PID:9888
- C:\Windows\System\xDHujRZ.exe
  C:\Windows\System\xDHujRZ.exe
  2⤵
  PID:9928
- C:\Windows\System\CppyWCr.exe
  C:\Windows\System\CppyWCr.exe
  2⤵
  PID:9940
- C:\Windows\System\iBZTJgn.exe
  C:\Windows\System\iBZTJgn.exe
  2⤵
  PID:9984
- C:\Windows\System\nchZWjt.exe
  C:\Windows\System\nchZWjt.exe
  2⤵
  PID:9972
- C:\Windows\System\kQgOQLY.exe
  C:\Windows\System\kQgOQLY.exe
  2⤵
  PID:9996
- C:\Windows\System\ogNzSmK.exe
  C:\Windows\System\ogNzSmK.exe
  2⤵
  PID:10020
- C:\Windows\System\jjINIRK.exe
  C:\Windows\System\jjINIRK.exe
  2⤵
  PID:10080
- C:\Windows\System\tvEuofC.exe
  C:\Windows\System\tvEuofC.exe
  2⤵
  PID:10156
- C:\Windows\System\AuNypoG.exe
  C:\Windows\System\AuNypoG.exe
  2⤵
  PID:10188
- C:\Windows\System\KEDFfsg.exe
  C:\Windows\System\KEDFfsg.exe
  2⤵
  PID:9420
- C:\Windows\System\sdqyUnb.exe
  C:\Windows\System\sdqyUnb.exe
  2⤵
  PID:9436
- C:\Windows\System\PISMcEf.exe
  C:\Windows\System\PISMcEf.exe
  2⤵
  PID:10068
- C:\Windows\System\fcydsha.exe
  C:\Windows\System\fcydsha.exe
  2⤵
  PID:9356
- C:\Windows\System\nWJXoAf.exe
  C:\Windows\System\nWJXoAf.exe
  2⤵
  PID:8752
- C:\Windows\System\CvgoNoG.exe
  C:\Windows\System\CvgoNoG.exe
  2⤵
  PID:9352
- C:\Windows\System\sPCCahZ.exe
  C:\Windows\System\sPCCahZ.exe
  2⤵
  PID:9340
- C:\Windows\System\AoetgcV.exe
  C:\Windows\System\AoetgcV.exe
  2⤵
  PID:9496
- C:\Windows\System\GsCJVSb.exe
  C:\Windows\System\GsCJVSb.exe
  2⤵
  PID:10004
- C:\Windows\System\ZqBHGBl.exe
  C:\Windows\System\ZqBHGBl.exe
  2⤵
  PID:9548
- C:\Windows\System\AmSTMWd.exe
  C:\Windows\System\AmSTMWd.exe
  2⤵
  PID:9608
- C:\Windows\System\EUOjSJc.exe
  C:\Windows\System\EUOjSJc.exe
  2⤵
  PID:9672
- C:\Windows\System\HtjfNCf.exe
  C:\Windows\System\HtjfNCf.exe
  2⤵
  PID:9716
- C:\Windows\System\TzUChMh.exe
  C:\Windows\System\TzUChMh.exe
  2⤵
  PID:9740
- C:\Windows\System\KnWaHlJ.exe
  C:\Windows\System\KnWaHlJ.exe
  2⤵
  PID:9784
- C:\Windows\System\AfUcErp.exe
  C:\Windows\System\AfUcErp.exe
  2⤵
  PID:9860
- C:\Windows\System\VeDsnkv.exe
  C:\Windows\System\VeDsnkv.exe
  2⤵
  PID:9900
- C:\Windows\System\gvZArdI.exe
  C:\Windows\System\gvZArdI.exe
  2⤵
  PID:9932
- C:\Windows\System\YSQwtfZ.exe
  C:\Windows\System\YSQwtfZ.exe
  2⤵
  PID:10152
- C:\Windows\System\nrbZeXf.exe
  C:\Windows\System\nrbZeXf.exe
  2⤵
  PID:10224
- C:\Windows\System\HRWUjyl.exe
  C:\Windows\System\HRWUjyl.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CDqpEdt.exe

Filesize
1.5MB

MD5
792b183583e3b716f83cd90ecb8f73c0

SHA1
b0d5a1e8a164e401e1a781cf8da62a2af819899e

SHA256
64a1747bc173b989706fad7bce97b47a6e68e1ceafe35a664e75d91e5699407c

SHA512
6bdf0b5458ee89ff8ca2c7a987086e03284085f0d62543f42ca1d960c8ae1479dc1ca478595780712d236573b418429569a15db5d378a9b49916fba50c40a1bc

Download Submit
C:\Windows\system\CPYxQAJ.exe

Filesize
1.5MB

MD5
246d46e15545ae5ee8d7b60f9f8700fd

SHA1
26bd7aced681ec164638a4f20f40853e3947cfe0

SHA256
398f017a9ab079806387747e1fe6e0d55b188fe5e9fe018407f47cfd17b2bd45

SHA512
5251dbc3d7f4ea97b264d840d5e058c0e5c7f0968607045cd0f4a27c38d4590ccbd197865745b3ff0ff2d1d14afea89062e892e4e7eb25c1b2c693674a89713c

Download Submit
C:\Windows\system\ChPXFna.exe

Filesize
1.5MB

MD5
8ee0e0efc22754037f1c60c167c42a11

SHA1
1f6991f389223154b6fbc608d1b7719a0e5aee53

SHA256
83ac145a600559d4d3eae7179fc0ac5edb41d09b5d720261a1380b032233465c

SHA512
413bff8391187ff329dbc1f29d4743de735d241240edfb9f3b8d5634bd1e44d7605fda6f6e86c82e884a4aa6a687462d44b37ece6fe2d896b2ab2f622ca95925

Download Submit
C:\Windows\system\CoNaeoi.exe

Filesize
1.5MB

MD5
603019bfefff7b4657bce3ab68d5ce89

SHA1
1ff88e24095c3faba84c862cae1432aef15bf57a

SHA256
b3cc8cd60b2c52878c4d74056fac5916dd147206024cf84ab2d2f14952d0a30b

SHA512
bdf522db7ff036e33719b0b9f62c85a0bbd10d9abaa118f4ee6774345b80b382b1901b3b0e078a997a69a19c8c2df05fe8640111ed3e47784fde8b1fd41babf8

Download Submit
C:\Windows\system\EGzoAuZ.exe

Filesize
1.5MB

MD5
d47c4c88d6559c949b45da4749b71302

SHA1
a513740b8cc2642e9dac3e2c04658bda7ace5852

SHA256
0f6f629aa85d5024fb8945050e71d57de55fbb26c2b78f9b33d5d32010a1d1e8

SHA512
591ce3d9d55ce9134d16f3022ff15682545f2f5bddc5e07157a02bdc509b705fe54a4f00482ad4ebd2cb1b40f7b36f82ce509cf3908d305d06cd3dc400b370a9

Download Submit
C:\Windows\system\HvtBVIZ.exe

Filesize
1.5MB

MD5
7388de44e9a5ce299350a9eabd289ca6

SHA1
abbfb05b66f1297546af61f5120b64f2cd6ad030

SHA256
9e82b73d171bebb67a38e9041853fb2e2cfab78f766379f422b191ed282b16d0

SHA512
4e59774a4e4d3b4cb427eaab92c68e977f1db27a8b99160d8d359dab6d46e1cd388feee3f2cd73dfee6c6e2f9cd1556fd38524ba558eed7e1bc986273426b748

Download Submit
C:\Windows\system\JOvWLoM.exe

Filesize
1.5MB

MD5
9a87a60573a8366cd5269ceca639c378

SHA1
a7c96d298780585c0b63eec3a3e0dbe853321cd7

SHA256
2d352bdb84489d20f6ed230097c00705c80ba056ce12d890080a5cebc444425d

SHA512
e7da7631ca4baf3ec92165e083212c8d5392be0cb4b36f57ab2457422ed4badd5f672cee56f5697dba5026992992989ebcf95fc6baa8c33b63fae438890aa1b8

Download Submit
C:\Windows\system\KXuOQNw.exe

Filesize
1.5MB

MD5
a380e8e062e46b34323d068618ac08fe

SHA1
56a7e67510cd16be0c92baf520fb49a2107adc16

SHA256
c7def4a04044ed76f01fcb32fa0d60e401f7bd9716db394128f421740e24cd0e

SHA512
cff046e7840f9416a1a1d5ca74266c96cdfbd4c34076c317e9744be96f7a3a994629796736571e48fc4d0526f5f8802cb6e045ce8b53019537e9cb336cc88c31

Download Submit
C:\Windows\system\LIhJwDV.exe

Filesize
1.5MB

MD5
98ef55904bd1cb8370d302323e2742cc

SHA1
598844c680cbd534b7612d0c4546c9a6a99af3d6

SHA256
4489980d337a7af0f9765441538abefb3cc446d9e008983fbe445b34c9f32d6c

SHA512
b6883768a3c865b5151c7de00f20a1ce237fc1706cf89abd74baa434c7f3398829d31ab768e39cc718078f8d3e8718e382241569da701cfc4d60ecaeafb79bdf

Download Submit
C:\Windows\system\NNWewDk.exe

Filesize
1.5MB

MD5
7b263cf32acee21c17b06e00f87a24b6

SHA1
17f94940b1d64d4d098d91dbb803116a79350a68

SHA256
df99e6f6c6665a1d5baf6447fe948eb8c61f004cbfee5cf4926d44cafe2e928d

SHA512
b3428cbfb9ca69a66216806c80febf445506e5534de62451488af86fa979702046d8d6915fb2a443dd3d17f4edfc9ecc2d68b282b9f5aa3706d9d76c8d985916

Download Submit
C:\Windows\system\PEItoRy.exe

Filesize
1.5MB

MD5
0483e79d8b7d1e8f05a1dfb7bfcd9068

SHA1
c9f40021da019c140678f4519459409c5577b99b

SHA256
d77376590702e99a46430ce4163cfd1c3d2f65776fbe3d8c32afdb809a42a3ac

SHA512
0b3acfbe934a958225b7c3b722b4e4de75cd6077cb043a105080d896a51bf2afc000f959c18ad68eb253e0c29346ffb8e8ee1c34df9c9e5f7ed831f1c8a254a6

Download Submit
C:\Windows\system\QnRBuHr.exe

Filesize
1.5MB

MD5
fa53cc1ce1be24e89afbef1df554687a

SHA1
b872513a68a70f9b12b06b45a19303188daf7cf2

SHA256
4c4a07955cb76194b6c2c68f88c15be8e05178b9d26bc2ed0fff7198896aa153

SHA512
c549fb1d7232a8aceae6058c7f0ffa154a2b8a37a5ac6b4b9d0b8d5ce3e7e8b30cdb3473859be4ba2057aa44a080f55b4a7ef8269b03e12957f8b108ea6a5112

Download Submit
C:\Windows\system\RDRhpiM.exe

Filesize
1.5MB

MD5
6c1648e78ca389f3508a5ce56ced638c

SHA1
96ee00c6d5c719ee288f2aebb3b5e701ed592349

SHA256
50f9cbf2db440cb0e77dbcdaad914a1ee99b289c5e036aa1b6681d20850fe6ef

SHA512
7b68f5b40e9c59d8dd1aff44ff98be3d5e9d56cd2bb0d28ff506d246640596ce33b7455607c6b5e297c8dd4e34f5f5f245ea2676748b79f259291210c794461e

Download Submit
C:\Windows\system\RJCMXWw.exe

Filesize
1.5MB

MD5
7d0c7c6c64133b9e06b5c7af88b56934

SHA1
0fc75570590a2da1901b323b623e280d18fc56e2

SHA256
cea6a09cc5dfab3b799303b8538b3fdca36745b56fb55dc5e4b51cce25d35deb

SHA512
2ac0806f810793c9401e8b97851c8c1390ccd12010badec42cda781e2a847340e3111744cb84e7876481a428207d49080fa24a6c160f66dbb6eeeac72cc60738

Download Submit
C:\Windows\system\SUVtHTO.exe

Filesize
1.5MB

MD5
158065e827e13da3a1c98a0c8b2c57d8

SHA1
dfcfda09a8415b6a0913874ff1706b9a14d690cd

SHA256
8ad6d02efeaa407229966d3bdfbf4b09c9b3dbf08e282d54bb5478f2e794eda2

SHA512
0f0dc92ed5785f37788a7592e2ca9602c8ad3a9a5ab276aa044da362d1c8dbf449e5ebf63d872e2ffca3ae48864e3b38acb681a8b2f20ece8d1f854525b512d2

Download Submit
C:\Windows\system\TzoCblv.exe

Filesize
1.5MB

MD5
b3a4707d1c62fda32b8559b6dca716f4

SHA1
f946f2bcd5b780cb46fee577961b25de694ad77e

SHA256
3aa1592c4f3b1cb80d0ba50f8b1c9c0bf2205ae7503e5f3cd0747f16207b6e6b

SHA512
ab9650b0bb58abdc03ed0c2a6d1fe0f042a32cdf2b039cc51408c9287a45f9f9ebc0d1e877c6bd317b2e49db4df52aad2ba23b05101bfd855568ef4c0ac5c001

Download Submit
C:\Windows\system\dWIAJjF.exe

Filesize
1.5MB

MD5
5895399f051a143733027a430c7c53e4

SHA1
d3e1073e374b567201fc0f554e5a3a36ca2f6309

SHA256
d8b7f52ea382bd41f0553aed02c5c1c50c69f9a02524cb2ac7baf19e6902e875

SHA512
31f322817e0e96e877c038db12798643b132767ad3677cfbc32c2c87a387cb7a83e83b8e93a3486e5a8eddd3aa686509815ebbba43bd808a10560db457e1df34

Download Submit
C:\Windows\system\eEObHRB.exe

Filesize
1.5MB

MD5
b2d49ebe408fde526b1e3b9b41ad53d6

SHA1
bffc2a43478ce2052dfffbc76f6908d0a9ceffe1

SHA256
61a8752c8340f6b0127b132b6a450faf59b25825629a0914dda353b1193d9b7f

SHA512
7aea120951663937c85d5ba53d1f6e47a644ebfb3317ae1ed84f2e749037340ef2eebdc2e01d86a7fa317ae72a713cda93952facdafd08c984fc98170fce96a8

Download Submit
C:\Windows\system\fPcHxoX.exe

Filesize
1.5MB

MD5
35db63ad7873b8727831618eb509880f

SHA1
8c081c0086c0581d450d401d54a18dd8a35f3508

SHA256
5890d61f9c3e4436a8128090303134a51363b95bba8795c28d61f9103127a219

SHA512
8ed48b6440024961043c29d2cc923cba036ace9b624b6269cf5dc9ce304b6bc0d2c609baf820f9ffd44ed1c1d6df4614a99952dcdd458a1c923f902503df1023

Download Submit
C:\Windows\system\hHQxsoW.exe

Filesize
1.5MB

MD5
2219d8d42681ec7a91227ddfaff05be8

SHA1
429fc14926246e442803c49f2443b659f38b5ceb

SHA256
7e6e9fd0b699f6d9b9284d98ab5d343cea5ef8f578eb02be125c02cb7f49a069

SHA512
2918e68375ea4867e2f39cc5f998cf7ae94ec4d3cbf9194ba3dbca26a3db9ba48425c71af1fbe4ab5bfe9fa536d11dd68c6a812734d37c43f624396bf5de542b

Download Submit
C:\Windows\system\hZfjwED.exe

Filesize
1.5MB

MD5
2213cbab39b8ec8d2d2f0c479fb82332

SHA1
38b0465413af463366386cb4aa4e94a8156743a9

SHA256
e895bc2d8fa4b0168af7b8d9daaa7ab5bfe7f7b88eaf1f544c482f46c7558f2f

SHA512
e66b7c186146ac382e64058217d5723b71303a15c7333213d228fb26922a5f569fdb1f28a6b9fab8d9be90593042195606a74116f3740e8b604cb844032b45b0

Download Submit
C:\Windows\system\sdqJzvG.exe

Filesize
1.5MB

MD5
442583abcb2533cebfca0ee1ea71bf64

SHA1
0e74cdd864362d7ee86c4fc65aa20218d09df6e2

SHA256
c4ead63fab79ffdefd421bf9810dc7cdf2091e8ddd37dd05bcc6867f7b03a608

SHA512
c1699cf8f753c2159c7b041cea5820d53b1cc55b89fca0094ee2a41cddf2e98809e81d33e8e2888d7b1ce0ee1182bd06d026d9e84b43ecc21d264e7c65643ef1

Download Submit
C:\Windows\system\tCwUrCJ.exe

Filesize
1.5MB

MD5
5e722cd7ee703513e17d3ae4f924c795

SHA1
58f4b90f2e95b39a0eee9ae987062ba49368177b

SHA256
74c690b249c08ee66f0a4feed0444fb3c524f20d3dcadb498b13c42e01e74b7e

SHA512
e7cff8f94be5e1c9965ccf2f5cb56f9e699a16dcc211abe82b98ea2a075f17c6b78e7dad3d9066ec7cc7e573fb30925612e8235172b789786f73c07bcb89d3b2

Download Submit
C:\Windows\system\wGNiNaE.exe

Filesize
1.5MB

MD5
6a7ecfd12271214c128adf132df6367d

SHA1
23a03156d2601702575aaed26953581d69861739

SHA256
26f5bf1f4f836d4a064c69754731175fd8b61b7c8c5300add6c5fe31797ee044

SHA512
dcf011e0541ce03d666af7283342adce00a0e1c52d38f7a6a7990d6bcb2a64c3b986e54172a29722b72e0f5983e5c4d94b8183e2487f42d7f1dc6ae6230e86d4

Download Submit
C:\Windows\system\wbBwxhX.exe

Filesize
1.5MB

MD5
3cddb978802a62fef6cfc55f3196fa3f

SHA1
48b15a934a627d1c03a0c347bd750210adbcff8d

SHA256
5e137c0d1898b9f164f51b684614a60f7f75299caf7fe0b1e0e77f835edb3528

SHA512
b183e4212a612dc6ff805d104dbf75bf268fec288eaded666b7cf9d8d2d36879feed9d6be022cb78bf6c9ae9594c66f7c7bef7465713cf5c1edd1d4f592c7061

Download Submit
C:\Windows\system\xrIkcyx.exe

Filesize
1.5MB

MD5
78fb1e34801994445f90fda8700664eb

SHA1
622f529aa0a8e18cdddb69d6720352c7361464ec

SHA256
a1d2e5b50ad2371c74bad600e09aaf0ab84f1a6141b97f9aac47f41d555985d4

SHA512
4c6c2b2b62f58538370bdc83e83525003a9ca9ee1b16e4bc91a5f8536b15f9182a096e00f8e2b9f61a2dfb7ef898795aea6a20a0a8a4444bcbe9b9f222ee8ee3

Download Submit
C:\Windows\system\yavAXLd.exe

Filesize
1.5MB

MD5
3d79cc6e17d57e9a980f939734f3b7bd

SHA1
9494140548e969491b7e9d834162dd71e1353d14

SHA256
019e434ed2536be773d3d17c798ca2f3ed059c812ca2343e9d758f84f213d171

SHA512
fbe2aeff3e86d4e5525b1ffa900f519725f49466a6d829c95c7063e7203698dbdc00126b7d4a717a439d43fc0682da3a452ec4262d50ec6bc6d3bd3e7ff2f545

Download Submit
C:\Windows\system\zTyvTcZ.exe

Filesize
1.5MB

MD5
84b2888642bfc09de3e7bfe4ae18f14c

SHA1
de4e19fa6a4a3ff25cb58bb52c4647a31a4f49c7

SHA256
d8f75c432108ee0a66d55f5f9d113d90267593bd708cf65f7397ada8fb2ece2b

SHA512
c891246810abc3e7540f53431f9eea26c17391884dded995fe06423217fb79afacac4391fc41b4d8929295ff8ed172680c9b0d3df949e664e1ce6092b556ed9d

Download Submit
C:\Windows\system\zhQUYto.exe

Filesize
1.5MB

MD5
7e9bc83c4a72aba0f025989964278d77

SHA1
cfe1a7155292185b17fcf33946212e0164c6a5ea

SHA256
b4908201b8ace2d28cb1ce773dbd9b8d0172f59d56d15cb102f63fbf0be0e4ec

SHA512
cb9e5baedce21e08f418d556893e101f13a32e9306072917ae6bbadcbd3221014c1961e1f116fa5234870a45912bdb23e14985cd454182d8411f79c879057d48

Download Submit
\Windows\system\TgdUJFC.exe

Filesize
1.5MB

MD5
107e4b389c6a73616f1c54b40a207a99

SHA1
10a3dd80d9a5e1a81636e0845abd1f4e191e6de3

SHA256
8c5cea626af5677ba4eb4922ba0788a9568fa8e68bc1c914e76890368a76db72

SHA512
2babb91fbaeabfb2a779a57f460397a50c2fa6c89b59389f53cd90a2e3e7fcc9437e552fcf61c3f448fe40b7b9720cd30b597094b28395442cb36fdca9f35b1b

Download Submit
\Windows\system\ilbMYSd.exe

Filesize
1.5MB

MD5
e5c80ca5e115fe0122f717bd0c8d24f5

SHA1
e0029d21a7999979e276605d020d752820ae0e79

SHA256
cff3f415e797d2c6a305ea38083058bcded49c4e76241b6a54e2ca4b661b400a

SHA512
ccbaca6f35b4cc00f5b3136f7bb8548201785cb781856e13a9a6ba568e0fec11c1570c0e9cba8662457544f11455efb606ebeec8431df43ae8f3f3e2a53767ce

Download Submit
\Windows\system\xGXwRZl.exe

Filesize
1.5MB

MD5
de23284e7e1d6c211d2169a8fed8969f

SHA1
dd08b197232775db4bc7fe3b5c25ac87397d4132

SHA256
dcb0d85842020a4247b2d6618346ce6d1dfd6aca909b24cb5b26457edc1fa3e0

SHA512
5e6eacf1fe14638206d8c75141bf6a6dd3dc34de2a97f0ce57d7645de6dc42a390eb63b95938b37645f5070ab4fddec0cc2fac9fd95d98c9a2c11315493a94cb

Download Submit
memory/2708-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download