xmrig | 2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
Size

1.4MB
MD5

5e2ab933ab9f8426e4c4cfd323da0808
SHA1

72941fcb321550dfc84f26661790d86b14945af3
SHA256

2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2
SHA512

aa4d73a2d2988c4ecf1bd07125d35f69cf4eab523ceaceae75908f0e3c77228e32ae5a9de65541d08f697875b325af8f4c9bedb92a8aed2d6d504bd7ebab23b6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbkqqaG:GezaTF8FcNkNdfE0pZ9ozttwIRx3/LwN

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	xmrig
behavioral1/files/0x0008000000017409-9.dat	xmrig
behavioral1/files/0x000800000001748f-10.dat	xmrig
behavioral1/files/0x000700000001752f-16.dat	xmrig
behavioral1/files/0x001600000001866d-24.dat	xmrig
behavioral1/files/0x000a000000018678-28.dat	xmrig
behavioral1/files/0x0008000000018690-33.dat	xmrig
behavioral1/files/0x000800000001879b-34.dat	xmrig
behavioral1/files/0x00070000000193be-40.dat	xmrig
behavioral1/files/0x00050000000193c4-44.dat	xmrig
behavioral1/files/0x00050000000193cc-48.dat	xmrig
behavioral1/files/0x00050000000193d9-52.dat	xmrig
behavioral1/files/0x00050000000193df-56.dat	xmrig
behavioral1/files/0x0005000000019401-61.dat	xmrig
behavioral1/files/0x000500000001942f-68.dat	xmrig
behavioral1/files/0x0005000000019441-72.dat	xmrig
behavioral1/files/0x000500000001947e-74.dat	xmrig
behavioral1/files/0x0005000000019539-88.dat	xmrig
behavioral1/files/0x000500000001961b-96.dat	xmrig
behavioral1/files/0x0005000000019629-145.dat	xmrig
behavioral1/files/0x0005000000019639-160.dat	xmrig
behavioral1/files/0x0005000000019627-158.dat	xmrig
behavioral1/files/0x0005000000019623-156.dat	xmrig
behavioral1/files/0x0005000000019620-154.dat	xmrig
behavioral1/files/0x0005000000019625-134.dat	xmrig
behavioral1/files/0x0005000000019621-118.dat	xmrig
behavioral1/files/0x000500000001961f-104.dat	xmrig
behavioral1/files/0x000500000001961d-101.dat	xmrig
behavioral1/files/0x00050000000195e4-92.dat	xmrig
behavioral1/files/0x00050000000194d8-84.dat	xmrig
behavioral1/files/0x00300000000173e4-80.dat	xmrig
behavioral1/files/0x0005000000019403-64.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2660	ceVMebt.exe
2816	laDKZDJ.exe
2832	RBtZcTg.exe
2784	pcBJUMh.exe
852	szUzWZt.exe
1808	fjKKCyd.exe
2580	IctICkM.exe
2728	zijAlru.exe
1760	QTKcduu.exe
2572	UogSKhv.exe
2628	JLQNbHV.exe
3068	PwYGpZy.exe
2124	NLsJeZh.exe
2620	kWNJOyS.exe
2964	xTHpWuQ.exe
2592	dDRPOaI.exe
776	lfnPses.exe
1800	sbhzNmJ.exe
1140	VIuMtwl.exe
2244	IyVhyRM.exe
2612	IZlRcKf.exe
2852	txFuMEl.exe
2764	ZUiMAvE.exe
1656	hJIiWOs.exe
1088	fcWRbtZ.exe
604	clrtUKe.exe
1848	QqhpOqX.exe
1156	UVlXleu.exe
2992	QctCnkU.exe
2412	UrTzlZH.exe
2132	tkZrqcs.exe
1648	pkBuXjZ.exe
1860	gOhbgtI.exe
2240	ZrLHyuD.exe
1272	fdqSoCx.exe
1256	kdnlxTi.exe
2252	CjSiufW.exe
2360	VjLuCoI.exe
1548	vsZQPSv.exe
2056	BpDXjPK.exe
1704	fUOHmJR.exe
1732	xVLprGp.exe
2308	DxLkGxV.exe
236	iDWGKaB.exe
468	PNbpVus.exe
3020	EpBVeSQ.exe
792	QaaHBap.exe
572	MJAtBdo.exe
2968	xEPdOId.exe
1000	goahuTS.exe
1312	MFVKJqN.exe
892	StUWcwL.exe
2020	iusGbfd.exe
1512	omJDgJd.exe
912	tgLGdfx.exe
2176	jApOHHe.exe
1612	IGlpjoL.exe
2972	zNIBSGn.exe
2788	tjWMiWO.exe
2700	flnBpaT.exe
2684	esNmkOz.exe
2588	umesytP.exe
2692	wybtkpE.exe
2568	QclRRtD.exe

Loads dropped DLL 64 IoCs

pid	Process
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GPOwzeK.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\aWNzHAP.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\wRBbjjA.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\noWQWiE.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\ACwPVEG.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\EpjgLpK.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\KbxbKxZ.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\aJhFFqe.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\PwOQfTt.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\LLdHiIK.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\swJMZKm.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\BNaVJFo.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\gutGUUU.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\sReIhSl.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\whvcmoo.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\Qwcszbo.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\niWdSAc.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\RxIJETC.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\wwcrgtr.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\ksPGguK.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\MwriXCy.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\LwppCXA.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\brGXrzo.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\jbqzJIr.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\cDZykQQ.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\MfawEiS.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\YtcWMRD.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\pYNCqEY.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\PwYGpZy.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\iFCyqTF.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\rHwlRWk.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\sbqLEPv.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\OyvdrKn.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\RkiVpFu.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\RSXHBOh.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\XXdNIMw.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\idPylyl.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\UfmMdRt.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\vOIZpuJ.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\SaVHMfP.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\MLsgrlN.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\QaaHBap.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\AEicvSa.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\nOLKyLl.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\odQyPdS.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\clrtUKe.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\vaqlYry.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\MrajYiU.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\XRiZXKg.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\sJtCwjb.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\NbJLhhN.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\gEbRdCg.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\mvgHEBy.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\hWhFlSr.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\OtovmEn.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\zijAlru.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\OnCmfpT.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\QZhaRUv.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\mkLhtsB.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\ksOhepJ.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\fnuiNcw.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\erDRDjn.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\uhqnsbD.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
File created	C:\Windows\System\sMoyMRD.exe	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2660	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	31
PID 2224 wrote to memory of 2660	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	31
PID 2224 wrote to memory of 2660	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	31
PID 2224 wrote to memory of 2816	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	32
PID 2224 wrote to memory of 2816	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	32
PID 2224 wrote to memory of 2816	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	32
PID 2224 wrote to memory of 2832	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	33
PID 2224 wrote to memory of 2832	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	33
PID 2224 wrote to memory of 2832	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	33
PID 2224 wrote to memory of 2784	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	34
PID 2224 wrote to memory of 2784	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	34
PID 2224 wrote to memory of 2784	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	34
PID 2224 wrote to memory of 852	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	35
PID 2224 wrote to memory of 852	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	35
PID 2224 wrote to memory of 852	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	35
PID 2224 wrote to memory of 1808	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	36
PID 2224 wrote to memory of 1808	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	36
PID 2224 wrote to memory of 1808	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	36
PID 2224 wrote to memory of 2580	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	37
PID 2224 wrote to memory of 2580	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	37
PID 2224 wrote to memory of 2580	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	37
PID 2224 wrote to memory of 2728	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	38
PID 2224 wrote to memory of 2728	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	38
PID 2224 wrote to memory of 2728	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	38
PID 2224 wrote to memory of 1760	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	39
PID 2224 wrote to memory of 1760	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	39
PID 2224 wrote to memory of 1760	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	39
PID 2224 wrote to memory of 2572	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	40
PID 2224 wrote to memory of 2572	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	40
PID 2224 wrote to memory of 2572	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	40
PID 2224 wrote to memory of 2628	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	41
PID 2224 wrote to memory of 2628	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	41
PID 2224 wrote to memory of 2628	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	41
PID 2224 wrote to memory of 3068	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	42
PID 2224 wrote to memory of 3068	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	42
PID 2224 wrote to memory of 3068	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	42
PID 2224 wrote to memory of 2124	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	43
PID 2224 wrote to memory of 2124	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	43
PID 2224 wrote to memory of 2124	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	43
PID 2224 wrote to memory of 2620	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	44
PID 2224 wrote to memory of 2620	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	44
PID 2224 wrote to memory of 2620	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	44
PID 2224 wrote to memory of 2964	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	45
PID 2224 wrote to memory of 2964	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	45
PID 2224 wrote to memory of 2964	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	45
PID 2224 wrote to memory of 2592	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	46
PID 2224 wrote to memory of 2592	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	46
PID 2224 wrote to memory of 2592	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	46
PID 2224 wrote to memory of 776	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	47
PID 2224 wrote to memory of 776	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	47
PID 2224 wrote to memory of 776	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	47
PID 2224 wrote to memory of 1800	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	48
PID 2224 wrote to memory of 1800	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	48
PID 2224 wrote to memory of 1800	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	48
PID 2224 wrote to memory of 1140	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	49
PID 2224 wrote to memory of 1140	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	49
PID 2224 wrote to memory of 1140	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	49
PID 2224 wrote to memory of 2244	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	50
PID 2224 wrote to memory of 2244	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	50
PID 2224 wrote to memory of 2244	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	50
PID 2224 wrote to memory of 2612	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	51
PID 2224 wrote to memory of 2612	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	51
PID 2224 wrote to memory of 2612	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	51
PID 2224 wrote to memory of 2852	2224	2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe	52

C:\Users\Admin\AppData\Local\Temp\2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe
"C:\Users\Admin\AppData\Local\Temp\2023693f73e63a5d88acf3f0fbfd92ebc2e64ebc5c6b4b4b6e7cbe73adbe0cd2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System\ceVMebt.exe
  C:\Windows\System\ceVMebt.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\laDKZDJ.exe
  C:\Windows\System\laDKZDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\RBtZcTg.exe
  C:\Windows\System\RBtZcTg.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\pcBJUMh.exe
  C:\Windows\System\pcBJUMh.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\szUzWZt.exe
  C:\Windows\System\szUzWZt.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\fjKKCyd.exe
  C:\Windows\System\fjKKCyd.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\IctICkM.exe
  C:\Windows\System\IctICkM.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\zijAlru.exe
  C:\Windows\System\zijAlru.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\QTKcduu.exe
  C:\Windows\System\QTKcduu.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\UogSKhv.exe
  C:\Windows\System\UogSKhv.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\JLQNbHV.exe
  C:\Windows\System\JLQNbHV.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PwYGpZy.exe
  C:\Windows\System\PwYGpZy.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NLsJeZh.exe
  C:\Windows\System\NLsJeZh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\kWNJOyS.exe
  C:\Windows\System\kWNJOyS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\xTHpWuQ.exe
  C:\Windows\System\xTHpWuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\dDRPOaI.exe
  C:\Windows\System\dDRPOaI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\lfnPses.exe
  C:\Windows\System\lfnPses.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\sbhzNmJ.exe
  C:\Windows\System\sbhzNmJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\VIuMtwl.exe
  C:\Windows\System\VIuMtwl.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\IyVhyRM.exe
  C:\Windows\System\IyVhyRM.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\IZlRcKf.exe
  C:\Windows\System\IZlRcKf.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\txFuMEl.exe
  C:\Windows\System\txFuMEl.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ZUiMAvE.exe
  C:\Windows\System\ZUiMAvE.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\hJIiWOs.exe
  C:\Windows\System\hJIiWOs.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\fcWRbtZ.exe
  C:\Windows\System\fcWRbtZ.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\QctCnkU.exe
  C:\Windows\System\QctCnkU.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\clrtUKe.exe
  C:\Windows\System\clrtUKe.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\UrTzlZH.exe
  C:\Windows\System\UrTzlZH.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\QqhpOqX.exe
  C:\Windows\System\QqhpOqX.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\tkZrqcs.exe
  C:\Windows\System\tkZrqcs.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\UVlXleu.exe
  C:\Windows\System\UVlXleu.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\pkBuXjZ.exe
  C:\Windows\System\pkBuXjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gOhbgtI.exe
  C:\Windows\System\gOhbgtI.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\ZrLHyuD.exe
  C:\Windows\System\ZrLHyuD.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\fdqSoCx.exe
  C:\Windows\System\fdqSoCx.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\kdnlxTi.exe
  C:\Windows\System\kdnlxTi.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\CjSiufW.exe
  C:\Windows\System\CjSiufW.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\VjLuCoI.exe
  C:\Windows\System\VjLuCoI.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\vsZQPSv.exe
  C:\Windows\System\vsZQPSv.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\BpDXjPK.exe
  C:\Windows\System\BpDXjPK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\fUOHmJR.exe
  C:\Windows\System\fUOHmJR.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\xVLprGp.exe
  C:\Windows\System\xVLprGp.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DxLkGxV.exe
  C:\Windows\System\DxLkGxV.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\iDWGKaB.exe
  C:\Windows\System\iDWGKaB.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\PNbpVus.exe
  C:\Windows\System\PNbpVus.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\EpBVeSQ.exe
  C:\Windows\System\EpBVeSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\QaaHBap.exe
  C:\Windows\System\QaaHBap.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\MJAtBdo.exe
  C:\Windows\System\MJAtBdo.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\xEPdOId.exe
  C:\Windows\System\xEPdOId.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\goahuTS.exe
  C:\Windows\System\goahuTS.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\MFVKJqN.exe
  C:\Windows\System\MFVKJqN.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\StUWcwL.exe
  C:\Windows\System\StUWcwL.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\iusGbfd.exe
  C:\Windows\System\iusGbfd.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\omJDgJd.exe
  C:\Windows\System\omJDgJd.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\tgLGdfx.exe
  C:\Windows\System\tgLGdfx.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\jApOHHe.exe
  C:\Windows\System\jApOHHe.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\IGlpjoL.exe
  C:\Windows\System\IGlpjoL.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zNIBSGn.exe
  C:\Windows\System\zNIBSGn.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\tjWMiWO.exe
  C:\Windows\System\tjWMiWO.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\flnBpaT.exe
  C:\Windows\System\flnBpaT.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\esNmkOz.exe
  C:\Windows\System\esNmkOz.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\umesytP.exe
  C:\Windows\System\umesytP.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\wybtkpE.exe
  C:\Windows\System\wybtkpE.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\QclRRtD.exe
  C:\Windows\System\QclRRtD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ChOWTDL.exe
  C:\Windows\System\ChOWTDL.exe
  2⤵
  PID:2108
- C:\Windows\System\fFyurak.exe
  C:\Windows\System\fFyurak.exe
  2⤵
  PID:1488
- C:\Windows\System\mdmYnJT.exe
  C:\Windows\System\mdmYnJT.exe
  2⤵
  PID:2220
- C:\Windows\System\TqfxzSO.exe
  C:\Windows\System\TqfxzSO.exe
  2⤵
  PID:1696
- C:\Windows\System\FyHJOMQ.exe
  C:\Windows\System\FyHJOMQ.exe
  2⤵
  PID:1948
- C:\Windows\System\unIoAaq.exe
  C:\Windows\System\unIoAaq.exe
  2⤵
  PID:2448
- C:\Windows\System\kOpmIac.exe
  C:\Windows\System\kOpmIac.exe
  2⤵
  PID:788
- C:\Windows\System\yvRerMW.exe
  C:\Windows\System\yvRerMW.exe
  2⤵
  PID:2532
- C:\Windows\System\FBxZuwI.exe
  C:\Windows\System\FBxZuwI.exe
  2⤵
  PID:2748
- C:\Windows\System\ngjSlwa.exe
  C:\Windows\System\ngjSlwa.exe
  2⤵
  PID:2036
- C:\Windows\System\qSIeNuG.exe
  C:\Windows\System\qSIeNuG.exe
  2⤵
  PID:3052
- C:\Windows\System\PesLAyr.exe
  C:\Windows\System\PesLAyr.exe
  2⤵
  PID:1964
- C:\Windows\System\mQhLwdo.exe
  C:\Windows\System\mQhLwdo.exe
  2⤵
  PID:2364
- C:\Windows\System\AssCUGm.exe
  C:\Windows\System\AssCUGm.exe
  2⤵
  PID:1232
- C:\Windows\System\EXkVsgH.exe
  C:\Windows\System\EXkVsgH.exe
  2⤵
  PID:1284
- C:\Windows\System\SogdVuP.exe
  C:\Windows\System\SogdVuP.exe
  2⤵
  PID:2516
- C:\Windows\System\bzWSPIr.exe
  C:\Windows\System\bzWSPIr.exe
  2⤵
  PID:900
- C:\Windows\System\QnVyIeS.exe
  C:\Windows\System\QnVyIeS.exe
  2⤵
  PID:928
- C:\Windows\System\GPOwzeK.exe
  C:\Windows\System\GPOwzeK.exe
  2⤵
  PID:1780
- C:\Windows\System\obPJRyk.exe
  C:\Windows\System\obPJRyk.exe
  2⤵
  PID:1680
- C:\Windows\System\KMQscaj.exe
  C:\Windows\System\KMQscaj.exe
  2⤵
  PID:2060
- C:\Windows\System\EBsmshO.exe
  C:\Windows\System\EBsmshO.exe
  2⤵
  PID:1728
- C:\Windows\System\RNuhGUe.exe
  C:\Windows\System\RNuhGUe.exe
  2⤵
  PID:1048
- C:\Windows\System\enSDsNz.exe
  C:\Windows\System\enSDsNz.exe
  2⤵
  PID:2340
- C:\Windows\System\IPsJcZJ.exe
  C:\Windows\System\IPsJcZJ.exe
  2⤵
  PID:1976
- C:\Windows\System\qmKCvJv.exe
  C:\Windows\System\qmKCvJv.exe
  2⤵
  PID:2820
- C:\Windows\System\tGNVsvW.exe
  C:\Windows\System\tGNVsvW.exe
  2⤵
  PID:2084
- C:\Windows\System\VYigcgO.exe
  C:\Windows\System\VYigcgO.exe
  2⤵
  PID:1576
- C:\Windows\System\HFnehso.exe
  C:\Windows\System\HFnehso.exe
  2⤵
  PID:2456
- C:\Windows\System\yfXCHmB.exe
  C:\Windows\System\yfXCHmB.exe
  2⤵
  PID:2584
- C:\Windows\System\ziXwhdZ.exe
  C:\Windows\System\ziXwhdZ.exe
  2⤵
  PID:1980
- C:\Windows\System\QajxaLO.exe
  C:\Windows\System\QajxaLO.exe
  2⤵
  PID:1716
- C:\Windows\System\MwriXCy.exe
  C:\Windows\System\MwriXCy.exe
  2⤵
  PID:1584
- C:\Windows\System\aypjniO.exe
  C:\Windows\System\aypjniO.exe
  2⤵
  PID:2792
- C:\Windows\System\WNuozhc.exe
  C:\Windows\System\WNuozhc.exe
  2⤵
  PID:2772
- C:\Windows\System\gGPPeRO.exe
  C:\Windows\System\gGPPeRO.exe
  2⤵
  PID:2548
- C:\Windows\System\MYKQsBf.exe
  C:\Windows\System\MYKQsBf.exe
  2⤵
  PID:2212
- C:\Windows\System\OeyiHIX.exe
  C:\Windows\System\OeyiHIX.exe
  2⤵
  PID:624
- C:\Windows\System\LwppCXA.exe
  C:\Windows\System\LwppCXA.exe
  2⤵
  PID:1636
- C:\Windows\System\TrjIohv.exe
  C:\Windows\System\TrjIohv.exe
  2⤵
  PID:2904
- C:\Windows\System\WXOAYZV.exe
  C:\Windows\System\WXOAYZV.exe
  2⤵
  PID:2924
- C:\Windows\System\AgcSHcL.exe
  C:\Windows\System\AgcSHcL.exe
  2⤵
  PID:3008
- C:\Windows\System\RestXnD.exe
  C:\Windows\System\RestXnD.exe
  2⤵
  PID:1596
- C:\Windows\System\dLaAxdf.exe
  C:\Windows\System\dLaAxdf.exe
  2⤵
  PID:2180
- C:\Windows\System\GnjqHvC.exe
  C:\Windows\System\GnjqHvC.exe
  2⤵
  PID:1252
- C:\Windows\System\XXdNIMw.exe
  C:\Windows\System\XXdNIMw.exe
  2⤵
  PID:2392
- C:\Windows\System\xKJtCsm.exe
  C:\Windows\System\xKJtCsm.exe
  2⤵
  PID:448
- C:\Windows\System\CpUPypy.exe
  C:\Windows\System\CpUPypy.exe
  2⤵
  PID:408
- C:\Windows\System\RPrmXKH.exe
  C:\Windows\System\RPrmXKH.exe
  2⤵
  PID:992
- C:\Windows\System\MYlvcdv.exe
  C:\Windows\System\MYlvcdv.exe
  2⤵
  PID:1044
- C:\Windows\System\sEERmcC.exe
  C:\Windows\System\sEERmcC.exe
  2⤵
  PID:1776
- C:\Windows\System\LBQgdhi.exe
  C:\Windows\System\LBQgdhi.exe
  2⤵
  PID:2736
- C:\Windows\System\ZvcmtWo.exe
  C:\Windows\System\ZvcmtWo.exe
  2⤵
  PID:1588
- C:\Windows\System\levwfXM.exe
  C:\Windows\System\levwfXM.exe
  2⤵
  PID:1824
- C:\Windows\System\tCmikaI.exe
  C:\Windows\System\tCmikaI.exe
  2⤵
  PID:1040
- C:\Windows\System\eiGRBPy.exe
  C:\Windows\System\eiGRBPy.exe
  2⤵
  PID:2228
- C:\Windows\System\pnbZpCU.exe
  C:\Windows\System\pnbZpCU.exe
  2⤵
  PID:2520
- C:\Windows\System\WuuKIrR.exe
  C:\Windows\System\WuuKIrR.exe
  2⤵
  PID:2032
- C:\Windows\System\qyZgIWF.exe
  C:\Windows\System\qyZgIWF.exe
  2⤵
  PID:1784
- C:\Windows\System\njiBEjq.exe
  C:\Windows\System\njiBEjq.exe
  2⤵
  PID:1724
- C:\Windows\System\sTOdbUV.exe
  C:\Windows\System\sTOdbUV.exe
  2⤵
  PID:2868
- C:\Windows\System\rmoYcyV.exe
  C:\Windows\System\rmoYcyV.exe
  2⤵
  PID:2876
- C:\Windows\System\daBhLNm.exe
  C:\Windows\System\daBhLNm.exe
  2⤵
  PID:2716
- C:\Windows\System\XUERxdL.exe
  C:\Windows\System\XUERxdL.exe
  2⤵
  PID:3064
- C:\Windows\System\oimPYdY.exe
  C:\Windows\System\oimPYdY.exe
  2⤵
  PID:1924
- C:\Windows\System\qEEgAga.exe
  C:\Windows\System\qEEgAga.exe
  2⤵
  PID:2740
- C:\Windows\System\MRmlFlT.exe
  C:\Windows\System\MRmlFlT.exe
  2⤵
  PID:2896
- C:\Windows\System\xKJtrsO.exe
  C:\Windows\System\xKJtrsO.exe
  2⤵
  PID:2732
- C:\Windows\System\fGcohaf.exe
  C:\Windows\System\fGcohaf.exe
  2⤵
  PID:1260
- C:\Windows\System\xBZVreQ.exe
  C:\Windows\System\xBZVreQ.exe
  2⤵
  PID:2848
- C:\Windows\System\jMSMEKn.exe
  C:\Windows\System\jMSMEKn.exe
  2⤵
  PID:2144
- C:\Windows\System\SwcBMMD.exe
  C:\Windows\System\SwcBMMD.exe
  2⤵
  PID:2128
- C:\Windows\System\YtwNtbN.exe
  C:\Windows\System\YtwNtbN.exe
  2⤵
  PID:1556
- C:\Windows\System\UIociZm.exe
  C:\Windows\System\UIociZm.exe
  2⤵
  PID:2120
- C:\Windows\System\UtDIbXK.exe
  C:\Windows\System\UtDIbXK.exe
  2⤵
  PID:2524
- C:\Windows\System\ZTggEDm.exe
  C:\Windows\System\ZTggEDm.exe
  2⤵
  PID:2744
- C:\Windows\System\TKtzemm.exe
  C:\Windows\System\TKtzemm.exe
  2⤵
  PID:1644
- C:\Windows\System\TsDOrfn.exe
  C:\Windows\System\TsDOrfn.exe
  2⤵
  PID:1632
- C:\Windows\System\vetkuSf.exe
  C:\Windows\System\vetkuSf.exe
  2⤵
  PID:1264
- C:\Windows\System\cqhYzRX.exe
  C:\Windows\System\cqhYzRX.exe
  2⤵
  PID:1484
- C:\Windows\System\cBsZnXE.exe
  C:\Windows\System\cBsZnXE.exe
  2⤵
  PID:2884
- C:\Windows\System\mQqvamA.exe
  C:\Windows\System\mQqvamA.exe
  2⤵
  PID:2576
- C:\Windows\System\VrXlgJL.exe
  C:\Windows\System\VrXlgJL.exe
  2⤵
  PID:2196
- C:\Windows\System\cKYFBry.exe
  C:\Windows\System\cKYFBry.exe
  2⤵
  PID:1916
- C:\Windows\System\uAQRiks.exe
  C:\Windows\System\uAQRiks.exe
  2⤵
  PID:1316
- C:\Windows\System\PAENNWF.exe
  C:\Windows\System\PAENNWF.exe
  2⤵
  PID:2632
- C:\Windows\System\hIlydlu.exe
  C:\Windows\System\hIlydlu.exe
  2⤵
  PID:2636
- C:\Windows\System\oRahGqj.exe
  C:\Windows\System\oRahGqj.exe
  2⤵
  PID:2872
- C:\Windows\System\sZyYaOr.exe
  C:\Windows\System\sZyYaOr.exe
  2⤵
  PID:2232
- C:\Windows\System\WRAjrdr.exe
  C:\Windows\System\WRAjrdr.exe
  2⤵
  PID:288
- C:\Windows\System\KYxiwLL.exe
  C:\Windows\System\KYxiwLL.exe
  2⤵
  PID:1756
- C:\Windows\System\ESxQHgn.exe
  C:\Windows\System\ESxQHgn.exe
  2⤵
  PID:2168
- C:\Windows\System\fbrsnvG.exe
  C:\Windows\System\fbrsnvG.exe
  2⤵
  PID:2260
- C:\Windows\System\uRFlFBo.exe
  C:\Windows\System\uRFlFBo.exe
  2⤵
  PID:1620
- C:\Windows\System\aNjaSxz.exe
  C:\Windows\System\aNjaSxz.exe
  2⤵
  PID:2200
- C:\Windows\System\ngcNsfg.exe
  C:\Windows\System\ngcNsfg.exe
  2⤵
  PID:348
- C:\Windows\System\PwOQfTt.exe
  C:\Windows\System\PwOQfTt.exe
  2⤵
  PID:948
- C:\Windows\System\ouKYgZw.exe
  C:\Windows\System\ouKYgZw.exe
  2⤵
  PID:688
- C:\Windows\System\jWInges.exe
  C:\Windows\System\jWInges.exe
  2⤵
  PID:1560
- C:\Windows\System\sGbBcst.exe
  C:\Windows\System\sGbBcst.exe
  2⤵
  PID:1868
- C:\Windows\System\PiUEAiw.exe
  C:\Windows\System\PiUEAiw.exe
  2⤵
  PID:2428
- C:\Windows\System\mndJowU.exe
  C:\Windows\System\mndJowU.exe
  2⤵
  PID:3000
- C:\Windows\System\VeKXqwE.exe
  C:\Windows\System\VeKXqwE.exe
  2⤵
  PID:2652
- C:\Windows\System\xISWlmc.exe
  C:\Windows\System\xISWlmc.exe
  2⤵
  PID:1792
- C:\Windows\System\hZFckum.exe
  C:\Windows\System\hZFckum.exe
  2⤵
  PID:2264
- C:\Windows\System\ZPiJmoh.exe
  C:\Windows\System\ZPiJmoh.exe
  2⤵
  PID:1804
- C:\Windows\System\sfYoqvS.exe
  C:\Windows\System\sfYoqvS.exe
  2⤵
  PID:1524
- C:\Windows\System\jumFaFA.exe
  C:\Windows\System\jumFaFA.exe
  2⤵
  PID:3080
- C:\Windows\System\qNSdgmp.exe
  C:\Windows\System\qNSdgmp.exe
  2⤵
  PID:3096
- C:\Windows\System\mdkBcfq.exe
  C:\Windows\System\mdkBcfq.exe
  2⤵
  PID:3116
- C:\Windows\System\efoWbri.exe
  C:\Windows\System\efoWbri.exe
  2⤵
  PID:3132
- C:\Windows\System\BJuPRPD.exe
  C:\Windows\System\BJuPRPD.exe
  2⤵
  PID:3148
- C:\Windows\System\cUIjidv.exe
  C:\Windows\System\cUIjidv.exe
  2⤵
  PID:3176
- C:\Windows\System\IpuGuxp.exe
  C:\Windows\System\IpuGuxp.exe
  2⤵
  PID:3212
- C:\Windows\System\dEpxPJH.exe
  C:\Windows\System\dEpxPJH.exe
  2⤵
  PID:3232
- C:\Windows\System\YsIlkrU.exe
  C:\Windows\System\YsIlkrU.exe
  2⤵
  PID:3260
- C:\Windows\System\RWlflwr.exe
  C:\Windows\System\RWlflwr.exe
  2⤵
  PID:3276
- C:\Windows\System\pEkxDUe.exe
  C:\Windows\System\pEkxDUe.exe
  2⤵
  PID:3292
- C:\Windows\System\RSKXPeh.exe
  C:\Windows\System\RSKXPeh.exe
  2⤵
  PID:3312
- C:\Windows\System\PFRuWWq.exe
  C:\Windows\System\PFRuWWq.exe
  2⤵
  PID:3332
- C:\Windows\System\hyhsvpo.exe
  C:\Windows\System\hyhsvpo.exe
  2⤵
  PID:3356
- C:\Windows\System\ivpkMCf.exe
  C:\Windows\System\ivpkMCf.exe
  2⤵
  PID:3372
- C:\Windows\System\ZOirZes.exe
  C:\Windows\System\ZOirZes.exe
  2⤵
  PID:3388
- C:\Windows\System\eTSVIpY.exe
  C:\Windows\System\eTSVIpY.exe
  2⤵
  PID:3408
- C:\Windows\System\WSpqBRC.exe
  C:\Windows\System\WSpqBRC.exe
  2⤵
  PID:3428
- C:\Windows\System\iFCyqTF.exe
  C:\Windows\System\iFCyqTF.exe
  2⤵
  PID:3444
- C:\Windows\System\lgmcShu.exe
  C:\Windows\System\lgmcShu.exe
  2⤵
  PID:3468
- C:\Windows\System\LUmeNke.exe
  C:\Windows\System\LUmeNke.exe
  2⤵
  PID:3492
- C:\Windows\System\pCLvnnW.exe
  C:\Windows\System\pCLvnnW.exe
  2⤵
  PID:3508
- C:\Windows\System\fcvkUsx.exe
  C:\Windows\System\fcvkUsx.exe
  2⤵
  PID:3540
- C:\Windows\System\rrrbzwL.exe
  C:\Windows\System\rrrbzwL.exe
  2⤵
  PID:3556
- C:\Windows\System\NNPRDUM.exe
  C:\Windows\System\NNPRDUM.exe
  2⤵
  PID:3572
- C:\Windows\System\rSDFrSh.exe
  C:\Windows\System\rSDFrSh.exe
  2⤵
  PID:3588
- C:\Windows\System\CiSavXo.exe
  C:\Windows\System\CiSavXo.exe
  2⤵
  PID:3604
- C:\Windows\System\JsSZpuH.exe
  C:\Windows\System\JsSZpuH.exe
  2⤵
  PID:3620
- C:\Windows\System\kmZXDmU.exe
  C:\Windows\System\kmZXDmU.exe
  2⤵
  PID:3652
- C:\Windows\System\OwoRdOI.exe
  C:\Windows\System\OwoRdOI.exe
  2⤵
  PID:3668
- C:\Windows\System\NWEMHxS.exe
  C:\Windows\System\NWEMHxS.exe
  2⤵
  PID:3688
- C:\Windows\System\QJMIsPT.exe
  C:\Windows\System\QJMIsPT.exe
  2⤵
  PID:3704
- C:\Windows\System\rHwlRWk.exe
  C:\Windows\System\rHwlRWk.exe
  2⤵
  PID:3720
- C:\Windows\System\aIzMfrx.exe
  C:\Windows\System\aIzMfrx.exe
  2⤵
  PID:3736
- C:\Windows\System\NvmezkS.exe
  C:\Windows\System\NvmezkS.exe
  2⤵
  PID:3752
- C:\Windows\System\dDWDiWa.exe
  C:\Windows\System\dDWDiWa.exe
  2⤵
  PID:3788
- C:\Windows\System\AhAtlCz.exe
  C:\Windows\System\AhAtlCz.exe
  2⤵
  PID:3820
- C:\Windows\System\dVzcQmT.exe
  C:\Windows\System\dVzcQmT.exe
  2⤵
  PID:3840
- C:\Windows\System\hBWdgYN.exe
  C:\Windows\System\hBWdgYN.exe
  2⤵
  PID:3856
- C:\Windows\System\oDrAsog.exe
  C:\Windows\System\oDrAsog.exe
  2⤵
  PID:3880
- C:\Windows\System\GgWZSSO.exe
  C:\Windows\System\GgWZSSO.exe
  2⤵
  PID:3900
- C:\Windows\System\GNTrcOt.exe
  C:\Windows\System\GNTrcOt.exe
  2⤵
  PID:3916
- C:\Windows\System\ARXYwJG.exe
  C:\Windows\System\ARXYwJG.exe
  2⤵
  PID:3936
- C:\Windows\System\AOYWNbA.exe
  C:\Windows\System\AOYWNbA.exe
  2⤵
  PID:3952
- C:\Windows\System\wAwgCyv.exe
  C:\Windows\System\wAwgCyv.exe
  2⤵
  PID:3976
- C:\Windows\System\vShjdnD.exe
  C:\Windows\System\vShjdnD.exe
  2⤵
  PID:3992
- C:\Windows\System\eVVmdPb.exe
  C:\Windows\System\eVVmdPb.exe
  2⤵
  PID:4008
- C:\Windows\System\xSUeOSc.exe
  C:\Windows\System\xSUeOSc.exe
  2⤵
  PID:4028
- C:\Windows\System\PggPDQy.exe
  C:\Windows\System\PggPDQy.exe
  2⤵
  PID:4044
- C:\Windows\System\YzRsktb.exe
  C:\Windows\System\YzRsktb.exe
  2⤵
  PID:4064
- C:\Windows\System\pxHQAYd.exe
  C:\Windows\System\pxHQAYd.exe
  2⤵
  PID:4084
- C:\Windows\System\fHqzkhi.exe
  C:\Windows\System\fHqzkhi.exe
  2⤵
  PID:2892
- C:\Windows\System\oLqfJlS.exe
  C:\Windows\System\oLqfJlS.exe
  2⤵
  PID:3156
- C:\Windows\System\hERDZqz.exe
  C:\Windows\System\hERDZqz.exe
  2⤵
  PID:3104
- C:\Windows\System\viwSYDv.exe
  C:\Windows\System\viwSYDv.exe
  2⤵
  PID:3172
- C:\Windows\System\cjZARCc.exe
  C:\Windows\System\cjZARCc.exe
  2⤵
  PID:3224
- C:\Windows\System\mQPCkbe.exe
  C:\Windows\System\mQPCkbe.exe
  2⤵
  PID:3204
- C:\Windows\System\HhcmEyM.exe
  C:\Windows\System\HhcmEyM.exe
  2⤵
  PID:3256
- C:\Windows\System\hTpAbuc.exe
  C:\Windows\System\hTpAbuc.exe
  2⤵
  PID:3284
- C:\Windows\System\nkascOt.exe
  C:\Windows\System\nkascOt.exe
  2⤵
  PID:3304
- C:\Windows\System\ljymwdN.exe
  C:\Windows\System\ljymwdN.exe
  2⤵
  PID:3328
- C:\Windows\System\vhhocEi.exe
  C:\Windows\System\vhhocEi.exe
  2⤵
  PID:3384
- C:\Windows\System\vaqlYry.exe
  C:\Windows\System\vaqlYry.exe
  2⤵
  PID:3452
- C:\Windows\System\kSStkTN.exe
  C:\Windows\System\kSStkTN.exe
  2⤵
  PID:3368
- C:\Windows\System\hDiBUNG.exe
  C:\Windows\System\hDiBUNG.exe
  2⤵
  PID:3504
- C:\Windows\System\TLfZNwg.exe
  C:\Windows\System\TLfZNwg.exe
  2⤵
  PID:3516
- C:\Windows\System\UxjRADj.exe
  C:\Windows\System\UxjRADj.exe
  2⤵
  PID:3524
- C:\Windows\System\tcjTBWI.exe
  C:\Windows\System\tcjTBWI.exe
  2⤵
  PID:3536
- C:\Windows\System\ZWGBEPl.exe
  C:\Windows\System\ZWGBEPl.exe
  2⤵
  PID:3580
- C:\Windows\System\PAJjylZ.exe
  C:\Windows\System\PAJjylZ.exe
  2⤵
  PID:3596
- C:\Windows\System\tPsPDpi.exe
  C:\Windows\System\tPsPDpi.exe
  2⤵
  PID:3612
- C:\Windows\System\LMLyChI.exe
  C:\Windows\System\LMLyChI.exe
  2⤵
  PID:3676
- C:\Windows\System\dtkXDej.exe
  C:\Windows\System\dtkXDej.exe
  2⤵
  PID:3716
- C:\Windows\System\uZhOMNW.exe
  C:\Windows\System\uZhOMNW.exe
  2⤵
  PID:3732
- C:\Windows\System\gARGQPq.exe
  C:\Windows\System\gARGQPq.exe
  2⤵
  PID:3700
- C:\Windows\System\rhVXsus.exe
  C:\Windows\System\rhVXsus.exe
  2⤵
  PID:3780
- C:\Windows\System\dEacqHy.exe
  C:\Windows\System\dEacqHy.exe
  2⤵
  PID:3812
- C:\Windows\System\fIILjFd.exe
  C:\Windows\System\fIILjFd.exe
  2⤵
  PID:3852
- C:\Windows\System\rBTEAkx.exe
  C:\Windows\System\rBTEAkx.exe
  2⤵
  PID:3828
- C:\Windows\System\cGqbpLW.exe
  C:\Windows\System\cGqbpLW.exe
  2⤵
  PID:3872
- C:\Windows\System\EZtEZoI.exe
  C:\Windows\System\EZtEZoI.exe
  2⤵
  PID:3896
- C:\Windows\System\SivgeNs.exe
  C:\Windows\System\SivgeNs.exe
  2⤵
  PID:3988
- C:\Windows\System\lnoFiRn.exe
  C:\Windows\System\lnoFiRn.exe
  2⤵
  PID:4052
- C:\Windows\System\sJfezNd.exe
  C:\Windows\System\sJfezNd.exe
  2⤵
  PID:4092
- C:\Windows\System\didtgla.exe
  C:\Windows\System\didtgla.exe
  2⤵
  PID:4072
- C:\Windows\System\dFUHfdv.exe
  C:\Windows\System\dFUHfdv.exe
  2⤵
  PID:4000
- C:\Windows\System\YFsJgjg.exe
  C:\Windows\System\YFsJgjg.exe
  2⤵
  PID:3164
- C:\Windows\System\joaHTtr.exe
  C:\Windows\System\joaHTtr.exe
  2⤵
  PID:3140
- C:\Windows\System\FjNwNTA.exe
  C:\Windows\System\FjNwNTA.exe
  2⤵
  PID:4036
- C:\Windows\System\zbAUwyV.exe
  C:\Windows\System\zbAUwyV.exe
  2⤵
  PID:3960
- C:\Windows\System\XVIXEdX.exe
  C:\Windows\System\XVIXEdX.exe
  2⤵
  PID:3300
- C:\Windows\System\eaLKXKG.exe
  C:\Windows\System\eaLKXKG.exe
  2⤵
  PID:3092
- C:\Windows\System\ylZaWbd.exe
  C:\Windows\System\ylZaWbd.exe
  2⤵
  PID:3124
- C:\Windows\System\QKzNCWp.exe
  C:\Windows\System\QKzNCWp.exe
  2⤵
  PID:3484
- C:\Windows\System\ncdZmYe.exe
  C:\Windows\System\ncdZmYe.exe
  2⤵
  PID:3568
- C:\Windows\System\YpLigKw.exe
  C:\Windows\System\YpLigKw.exe
  2⤵
  PID:3748
- C:\Windows\System\oJApLwL.exe
  C:\Windows\System\oJApLwL.exe
  2⤵
  PID:1372
- C:\Windows\System\SbzbiyE.exe
  C:\Windows\System\SbzbiyE.exe
  2⤵
  PID:3500
- C:\Windows\System\moaJUqU.exe
  C:\Windows\System\moaJUqU.exe
  2⤵
  PID:3344
- C:\Windows\System\GXjJbtr.exe
  C:\Windows\System\GXjJbtr.exe
  2⤵
  PID:3528
- C:\Windows\System\hxRblOX.exe
  C:\Windows\System\hxRblOX.exe
  2⤵
  PID:3628
- C:\Windows\System\RQSGCit.exe
  C:\Windows\System\RQSGCit.exe
  2⤵
  PID:3728
- C:\Windows\System\xrcIgwb.exe
  C:\Windows\System\xrcIgwb.exe
  2⤵
  PID:3696
- C:\Windows\System\VAVcXZd.exe
  C:\Windows\System\VAVcXZd.exe
  2⤵
  PID:3836
- C:\Windows\System\UsNEYVZ.exe
  C:\Windows\System\UsNEYVZ.exe
  2⤵
  PID:4060
- C:\Windows\System\Micvdlq.exe
  C:\Windows\System\Micvdlq.exe
  2⤵
  PID:4020
- C:\Windows\System\dtbTHPF.exe
  C:\Windows\System\dtbTHPF.exe
  2⤵
  PID:2916
- C:\Windows\System\qCspmaJ.exe
  C:\Windows\System\qCspmaJ.exe
  2⤵
  PID:3112
- C:\Windows\System\QcYmewL.exe
  C:\Windows\System\QcYmewL.exe
  2⤵
  PID:3380
- C:\Windows\System\idPylyl.exe
  C:\Windows\System\idPylyl.exe
  2⤵
  PID:3184
- C:\Windows\System\AlwTeIr.exe
  C:\Windows\System\AlwTeIr.exe
  2⤵
  PID:3248
- C:\Windows\System\hMQjkLA.exe
  C:\Windows\System\hMQjkLA.exe
  2⤵
  PID:3664
- C:\Windows\System\RMIbdlX.exe
  C:\Windows\System\RMIbdlX.exe
  2⤵
  PID:3796
- C:\Windows\System\ObFpJiF.exe
  C:\Windows\System\ObFpJiF.exe
  2⤵
  PID:3440
- C:\Windows\System\XwqWhMU.exe
  C:\Windows\System\XwqWhMU.exe
  2⤵
  PID:3712
- C:\Windows\System\AftbbCn.exe
  C:\Windows\System\AftbbCn.exe
  2⤵
  PID:3868
- C:\Windows\System\mzXTNtU.exe
  C:\Windows\System\mzXTNtU.exe
  2⤵
  PID:3984
- C:\Windows\System\jmfRvlX.exe
  C:\Windows\System\jmfRvlX.exe
  2⤵
  PID:3912
- C:\Windows\System\PvkqfXC.exe
  C:\Windows\System\PvkqfXC.exe
  2⤵
  PID:4080
- C:\Windows\System\ThfPFBE.exe
  C:\Windows\System\ThfPFBE.exe
  2⤵
  PID:3220
- C:\Windows\System\PpjfkYR.exe
  C:\Windows\System\PpjfkYR.exe
  2⤵
  PID:3636
- C:\Windows\System\gtjJyFW.exe
  C:\Windows\System\gtjJyFW.exe
  2⤵
  PID:3552
- C:\Windows\System\HqoLbka.exe
  C:\Windows\System\HqoLbka.exe
  2⤵
  PID:3532
- C:\Windows\System\wYbMCVd.exe
  C:\Windows\System\wYbMCVd.exe
  2⤵
  PID:3200
- C:\Windows\System\KyxsOTi.exe
  C:\Windows\System\KyxsOTi.exe
  2⤵
  PID:3964
- C:\Windows\System\AUgwlak.exe
  C:\Windows\System\AUgwlak.exe
  2⤵
  PID:4112
- C:\Windows\System\SDNrlBp.exe
  C:\Windows\System\SDNrlBp.exe
  2⤵
  PID:4176
- C:\Windows\System\ZcOjGcU.exe
  C:\Windows\System\ZcOjGcU.exe
  2⤵
  PID:4220
- C:\Windows\System\uSDGjmj.exe
  C:\Windows\System\uSDGjmj.exe
  2⤵
  PID:4236
- C:\Windows\System\eCivQNC.exe
  C:\Windows\System\eCivQNC.exe
  2⤵
  PID:4252
- C:\Windows\System\poyYaXO.exe
  C:\Windows\System\poyYaXO.exe
  2⤵
  PID:4268
- C:\Windows\System\sbqLEPv.exe
  C:\Windows\System\sbqLEPv.exe
  2⤵
  PID:4284
- C:\Windows\System\iIMcuWD.exe
  C:\Windows\System\iIMcuWD.exe
  2⤵
  PID:4300
- C:\Windows\System\MbKPedG.exe
  C:\Windows\System\MbKPedG.exe
  2⤵
  PID:4316
- C:\Windows\System\vBxJnWk.exe
  C:\Windows\System\vBxJnWk.exe
  2⤵
  PID:4332
- C:\Windows\System\SeNeRki.exe
  C:\Windows\System\SeNeRki.exe
  2⤵
  PID:4348
- C:\Windows\System\UdYAsVp.exe
  C:\Windows\System\UdYAsVp.exe
  2⤵
  PID:4364
- C:\Windows\System\gkDfDYl.exe
  C:\Windows\System\gkDfDYl.exe
  2⤵
  PID:4380
- C:\Windows\System\msrPyqo.exe
  C:\Windows\System\msrPyqo.exe
  2⤵
  PID:4396
- C:\Windows\System\pLxaiPy.exe
  C:\Windows\System\pLxaiPy.exe
  2⤵
  PID:4412
- C:\Windows\System\kwlEdXH.exe
  C:\Windows\System\kwlEdXH.exe
  2⤵
  PID:4428
- C:\Windows\System\JRLNPRw.exe
  C:\Windows\System\JRLNPRw.exe
  2⤵
  PID:4444
- C:\Windows\System\aEnirVb.exe
  C:\Windows\System\aEnirVb.exe
  2⤵
  PID:4460
- C:\Windows\System\ovfdoAx.exe
  C:\Windows\System\ovfdoAx.exe
  2⤵
  PID:4476
- C:\Windows\System\WDEjTrC.exe
  C:\Windows\System\WDEjTrC.exe
  2⤵
  PID:4492
- C:\Windows\System\aCqhSHm.exe
  C:\Windows\System\aCqhSHm.exe
  2⤵
  PID:4508
- C:\Windows\System\nbLDvXz.exe
  C:\Windows\System\nbLDvXz.exe
  2⤵
  PID:4524
- C:\Windows\System\aZcZdvh.exe
  C:\Windows\System\aZcZdvh.exe
  2⤵
  PID:4540
- C:\Windows\System\XYrdCZO.exe
  C:\Windows\System\XYrdCZO.exe
  2⤵
  PID:4556
- C:\Windows\System\kyIbckW.exe
  C:\Windows\System\kyIbckW.exe
  2⤵
  PID:4572
- C:\Windows\System\XawMTMC.exe
  C:\Windows\System\XawMTMC.exe
  2⤵
  PID:4588
- C:\Windows\System\kiEtGag.exe
  C:\Windows\System\kiEtGag.exe
  2⤵
  PID:4604
- C:\Windows\System\wvfrMMK.exe
  C:\Windows\System\wvfrMMK.exe
  2⤵
  PID:4620
- C:\Windows\System\ddkkMHo.exe
  C:\Windows\System\ddkkMHo.exe
  2⤵
  PID:4636
- C:\Windows\System\brGXrzo.exe
  C:\Windows\System\brGXrzo.exe
  2⤵
  PID:4652
- C:\Windows\System\nArbyHn.exe
  C:\Windows\System\nArbyHn.exe
  2⤵
  PID:4668
- C:\Windows\System\dYSSgWn.exe
  C:\Windows\System\dYSSgWn.exe
  2⤵
  PID:4684
- C:\Windows\System\FOnNMDs.exe
  C:\Windows\System\FOnNMDs.exe
  2⤵
  PID:4700
- C:\Windows\System\bDJQZJG.exe
  C:\Windows\System\bDJQZJG.exe
  2⤵
  PID:4716
- C:\Windows\System\KHQJHfZ.exe
  C:\Windows\System\KHQJHfZ.exe
  2⤵
  PID:4732
- C:\Windows\System\pOlBuzB.exe
  C:\Windows\System\pOlBuzB.exe
  2⤵
  PID:4748
- C:\Windows\System\TaJclsb.exe
  C:\Windows\System\TaJclsb.exe
  2⤵
  PID:4764
- C:\Windows\System\LgZgmxs.exe
  C:\Windows\System\LgZgmxs.exe
  2⤵
  PID:4780
- C:\Windows\System\qdJXZKy.exe
  C:\Windows\System\qdJXZKy.exe
  2⤵
  PID:4796
- C:\Windows\System\ixoLNsv.exe
  C:\Windows\System\ixoLNsv.exe
  2⤵
  PID:4812
- C:\Windows\System\ASdruWA.exe
  C:\Windows\System\ASdruWA.exe
  2⤵
  PID:4828
- C:\Windows\System\iFoCXnl.exe
  C:\Windows\System\iFoCXnl.exe
  2⤵
  PID:4844
- C:\Windows\System\mZRWVBS.exe
  C:\Windows\System\mZRWVBS.exe
  2⤵
  PID:4860
- C:\Windows\System\lrnmcIa.exe
  C:\Windows\System\lrnmcIa.exe
  2⤵
  PID:4876
- C:\Windows\System\HQfdBQf.exe
  C:\Windows\System\HQfdBQf.exe
  2⤵
  PID:4892
- C:\Windows\System\UoDRATm.exe
  C:\Windows\System\UoDRATm.exe
  2⤵
  PID:4908
- C:\Windows\System\PZwlAyP.exe
  C:\Windows\System\PZwlAyP.exe
  2⤵
  PID:4924
- C:\Windows\System\SxONViQ.exe
  C:\Windows\System\SxONViQ.exe
  2⤵
  PID:4940
- C:\Windows\System\zXidigG.exe
  C:\Windows\System\zXidigG.exe
  2⤵
  PID:4956
- C:\Windows\System\nKxtfwD.exe
  C:\Windows\System\nKxtfwD.exe
  2⤵
  PID:4972
- C:\Windows\System\uYzdhDt.exe
  C:\Windows\System\uYzdhDt.exe
  2⤵
  PID:4988
- C:\Windows\System\CinWsGO.exe
  C:\Windows\System\CinWsGO.exe
  2⤵
  PID:5004
- C:\Windows\System\iDgkhen.exe
  C:\Windows\System\iDgkhen.exe
  2⤵
  PID:5020
- C:\Windows\System\gScUmNx.exe
  C:\Windows\System\gScUmNx.exe
  2⤵
  PID:5036
- C:\Windows\System\YOdzfgD.exe
  C:\Windows\System\YOdzfgD.exe
  2⤵
  PID:5052
- C:\Windows\System\pzRoZQO.exe
  C:\Windows\System\pzRoZQO.exe
  2⤵
  PID:5068
- C:\Windows\System\EOKmHoR.exe
  C:\Windows\System\EOKmHoR.exe
  2⤵
  PID:5084
- C:\Windows\System\IVrUeCx.exe
  C:\Windows\System\IVrUeCx.exe
  2⤵
  PID:5100
- C:\Windows\System\HoIQYLx.exe
  C:\Windows\System\HoIQYLx.exe
  2⤵
  PID:5116
- C:\Windows\System\wxMgGsX.exe
  C:\Windows\System\wxMgGsX.exe
  2⤵
  PID:3464
- C:\Windows\System\SRLyMWX.exe
  C:\Windows\System\SRLyMWX.exe
  2⤵
  PID:3784
- C:\Windows\System\BLUBUyt.exe
  C:\Windows\System\BLUBUyt.exe
  2⤵
  PID:4108
- C:\Windows\System\EesxKpz.exe
  C:\Windows\System\EesxKpz.exe
  2⤵
  PID:4136
- C:\Windows\System\spCzMwf.exe
  C:\Windows\System\spCzMwf.exe
  2⤵
  PID:4152
- C:\Windows\System\RJMvMps.exe
  C:\Windows\System\RJMvMps.exe
  2⤵
  PID:4168
- C:\Windows\System\WkFzyan.exe
  C:\Windows\System\WkFzyan.exe
  2⤵
  PID:4192
- C:\Windows\System\EEoTzxT.exe
  C:\Windows\System\EEoTzxT.exe
  2⤵
  PID:4200
- C:\Windows\System\BdPBfYy.exe
  C:\Windows\System\BdPBfYy.exe
  2⤵
  PID:4216
- C:\Windows\System\xqfmKAh.exe
  C:\Windows\System\xqfmKAh.exe
  2⤵
  PID:4296
- C:\Windows\System\RdenpUu.exe
  C:\Windows\System\RdenpUu.exe
  2⤵
  PID:4276
- C:\Windows\System\xRaLBDB.exe
  C:\Windows\System\xRaLBDB.exe
  2⤵
  PID:4340
- C:\Windows\System\dTkZkUN.exe
  C:\Windows\System\dTkZkUN.exe
  2⤵
  PID:4328
- C:\Windows\System\ooPnIRE.exe
  C:\Windows\System\ooPnIRE.exe
  2⤵
  PID:4408
- C:\Windows\System\LMMamzS.exe
  C:\Windows\System\LMMamzS.exe
  2⤵
  PID:4392
- C:\Windows\System\WDQCjVP.exe
  C:\Windows\System\WDQCjVP.exe
  2⤵
  PID:4456
- C:\Windows\System\WLoQCJI.exe
  C:\Windows\System\WLoQCJI.exe
  2⤵
  PID:4520
- C:\Windows\System\wgXNIaN.exe
  C:\Windows\System\wgXNIaN.exe
  2⤵
  PID:4584
- C:\Windows\System\rClrNCJ.exe
  C:\Windows\System\rClrNCJ.exe
  2⤵
  PID:4472
- C:\Windows\System\CHdJxtZ.exe
  C:\Windows\System\CHdJxtZ.exe
  2⤵
  PID:4536
- C:\Windows\System\BRvmstr.exe
  C:\Windows\System\BRvmstr.exe
  2⤵
  PID:4600
- C:\Windows\System\GolMVui.exe
  C:\Windows\System\GolMVui.exe
  2⤵
  PID:4664
- C:\Windows\System\NnRZBgp.exe
  C:\Windows\System\NnRZBgp.exe
  2⤵
  PID:4728
- C:\Windows\System\albsTHZ.exe
  C:\Windows\System\albsTHZ.exe
  2⤵
  PID:4756
- C:\Windows\System\OjYSqab.exe
  C:\Windows\System\OjYSqab.exe
  2⤵
  PID:4820
- C:\Windows\System\ErYmFog.exe
  C:\Windows\System\ErYmFog.exe
  2⤵
  PID:4884
- C:\Windows\System\HuJNdqG.exe
  C:\Windows\System\HuJNdqG.exe
  2⤵
  PID:4676
- C:\Windows\System\EnmCjVg.exe
  C:\Windows\System\EnmCjVg.exe
  2⤵
  PID:4948
- C:\Windows\System\biHTPLK.exe
  C:\Windows\System\biHTPLK.exe
  2⤵
  PID:5012
- C:\Windows\System\aWNzHAP.exe
  C:\Windows\System\aWNzHAP.exe
  2⤵
  PID:4776
- C:\Windows\System\jUVpAsp.exe
  C:\Windows\System\jUVpAsp.exe
  2⤵
  PID:4840
- C:\Windows\System\jpgQRUc.exe
  C:\Windows\System\jpgQRUc.exe
  2⤵
  PID:4904
- C:\Windows\System\TPJlURD.exe
  C:\Windows\System\TPJlURD.exe
  2⤵
  PID:4968
- C:\Windows\System\fTNlbAb.exe
  C:\Windows\System\fTNlbAb.exe
  2⤵
  PID:5032
- C:\Windows\System\GjUfemf.exe
  C:\Windows\System\GjUfemf.exe
  2⤵
  PID:5096
- C:\Windows\System\GUMjeBS.exe
  C:\Windows\System\GUMjeBS.exe
  2⤵
  PID:4104
- C:\Windows\System\KAGIOsE.exe
  C:\Windows\System\KAGIOsE.exe
  2⤵
  PID:5080
- C:\Windows\System\dxPYnIF.exe
  C:\Windows\System\dxPYnIF.exe
  2⤵
  PID:3424
- C:\Windows\System\siyhfEy.exe
  C:\Windows\System\siyhfEy.exe
  2⤵
  PID:4232
- C:\Windows\System\tUriVjy.exe
  C:\Windows\System\tUriVjy.exe
  2⤵
  PID:4184
- C:\Windows\System\QKNhbHR.exe
  C:\Windows\System\QKNhbHR.exe
  2⤵
  PID:4356
- C:\Windows\System\hWVOfxi.exe
  C:\Windows\System\hWVOfxi.exe
  2⤵
  PID:4160
- C:\Windows\System\LLdHiIK.exe
  C:\Windows\System\LLdHiIK.exe
  2⤵
  PID:4196
- C:\Windows\System\ZiipIXr.exe
  C:\Windows\System\ZiipIXr.exe
  2⤵
  PID:4468
- C:\Windows\System\tOhRfin.exe
  C:\Windows\System\tOhRfin.exe
  2⤵
  PID:4660
- C:\Windows\System\SzANmXq.exe
  C:\Windows\System\SzANmXq.exe
  2⤵
  PID:4248
- C:\Windows\System\wpuFCpj.exe
  C:\Windows\System\wpuFCpj.exe
  2⤵
  PID:4836
- C:\Windows\System\BTEyODE.exe
  C:\Windows\System\BTEyODE.exe
  2⤵
  PID:5064
- C:\Windows\System\hlBtcRl.exe
  C:\Windows\System\hlBtcRl.exe
  2⤵
  PID:4124
- C:\Windows\System\jisoIRd.exe
  C:\Windows\System\jisoIRd.exe
  2⤵
  PID:4488
- C:\Windows\System\XVKLWbN.exe
  C:\Windows\System\XVKLWbN.exe
  2⤵
  PID:4148
- C:\Windows\System\QeQoENU.exe
  C:\Windows\System\QeQoENU.exe
  2⤵
  PID:5000
- C:\Windows\System\RWKRHVs.exe
  C:\Windows\System\RWKRHVs.exe
  2⤵
  PID:4740
- C:\Windows\System\UgBLNbp.exe
  C:\Windows\System\UgBLNbp.exe
  2⤵
  PID:4360
- C:\Windows\System\PPwNrDs.exe
  C:\Windows\System\PPwNrDs.exe
  2⤵
  PID:4648
- C:\Windows\System\UzghxRr.exe
  C:\Windows\System\UzghxRr.exe
  2⤵
  PID:4708
- C:\Windows\System\OMfUIQA.exe
  C:\Windows\System\OMfUIQA.exe
  2⤵
  PID:4808
- C:\Windows\System\qRVcXQN.exe
  C:\Windows\System\qRVcXQN.exe
  2⤵
  PID:4788
- C:\Windows\System\lKbKtCl.exe
  C:\Windows\System\lKbKtCl.exe
  2⤵
  PID:4964
- C:\Windows\System\XIQvtes.exe
  C:\Windows\System\XIQvtes.exe
  2⤵
  PID:4900
- C:\Windows\System\ZkyrHWw.exe
  C:\Windows\System\ZkyrHWw.exe
  2⤵
  PID:3948
- C:\Windows\System\LtOkkAR.exe
  C:\Windows\System\LtOkkAR.exe
  2⤵
  PID:4632
- C:\Windows\System\HXoTPoM.exe
  C:\Windows\System\HXoTPoM.exe
  2⤵
  PID:5136
- C:\Windows\System\wLTCuPJ.exe
  C:\Windows\System\wLTCuPJ.exe
  2⤵
  PID:5152
- C:\Windows\System\AgcMYWi.exe
  C:\Windows\System\AgcMYWi.exe
  2⤵
  PID:5168
- C:\Windows\System\tNCxtlk.exe
  C:\Windows\System\tNCxtlk.exe
  2⤵
  PID:5184
- C:\Windows\System\JbUjmNn.exe
  C:\Windows\System\JbUjmNn.exe
  2⤵
  PID:5200
- C:\Windows\System\TzRlPRv.exe
  C:\Windows\System\TzRlPRv.exe
  2⤵
  PID:5216
- C:\Windows\System\TdAstLx.exe
  C:\Windows\System\TdAstLx.exe
  2⤵
  PID:5232
- C:\Windows\System\oegmgcK.exe
  C:\Windows\System\oegmgcK.exe
  2⤵
  PID:5248
- C:\Windows\System\kBUMRFJ.exe
  C:\Windows\System\kBUMRFJ.exe
  2⤵
  PID:5264
- C:\Windows\System\rUNJCcW.exe
  C:\Windows\System\rUNJCcW.exe
  2⤵
  PID:5280
- C:\Windows\System\EukdMCS.exe
  C:\Windows\System\EukdMCS.exe
  2⤵
  PID:5296
- C:\Windows\System\GzKTweZ.exe
  C:\Windows\System\GzKTweZ.exe
  2⤵
  PID:5312
- C:\Windows\System\IZeRlFx.exe
  C:\Windows\System\IZeRlFx.exe
  2⤵
  PID:5328
- C:\Windows\System\OROeHNy.exe
  C:\Windows\System\OROeHNy.exe
  2⤵
  PID:5344
- C:\Windows\System\EGrrkdn.exe
  C:\Windows\System\EGrrkdn.exe
  2⤵
  PID:5360
- C:\Windows\System\IfAKnfZ.exe
  C:\Windows\System\IfAKnfZ.exe
  2⤵
  PID:5376
- C:\Windows\System\MrajYiU.exe
  C:\Windows\System\MrajYiU.exe
  2⤵
  PID:5392
- C:\Windows\System\oGZVYEE.exe
  C:\Windows\System\oGZVYEE.exe
  2⤵
  PID:5408
- C:\Windows\System\swJMZKm.exe
  C:\Windows\System\swJMZKm.exe
  2⤵
  PID:5424
- C:\Windows\System\wZVBBik.exe
  C:\Windows\System\wZVBBik.exe
  2⤵
  PID:5440
- C:\Windows\System\wWnfein.exe
  C:\Windows\System\wWnfein.exe
  2⤵
  PID:5456
- C:\Windows\System\OONINHv.exe
  C:\Windows\System\OONINHv.exe
  2⤵
  PID:5472
- C:\Windows\System\aaiRdSn.exe
  C:\Windows\System\aaiRdSn.exe
  2⤵
  PID:5488
- C:\Windows\System\nWcegMe.exe
  C:\Windows\System\nWcegMe.exe
  2⤵
  PID:5504
- C:\Windows\System\OnCmfpT.exe
  C:\Windows\System\OnCmfpT.exe
  2⤵
  PID:5520
- C:\Windows\System\VnRdIFs.exe
  C:\Windows\System\VnRdIFs.exe
  2⤵
  PID:5536
- C:\Windows\System\SpsQrrV.exe
  C:\Windows\System\SpsQrrV.exe
  2⤵
  PID:5552
- C:\Windows\System\jtnSrnG.exe
  C:\Windows\System\jtnSrnG.exe
  2⤵
  PID:5568
- C:\Windows\System\HUkeVua.exe
  C:\Windows\System\HUkeVua.exe
  2⤵
  PID:5584
- C:\Windows\System\cQUAfbQ.exe
  C:\Windows\System\cQUAfbQ.exe
  2⤵
  PID:5600
- C:\Windows\System\YJFXTsG.exe
  C:\Windows\System\YJFXTsG.exe
  2⤵
  PID:5616
- C:\Windows\System\XsXieYC.exe
  C:\Windows\System\XsXieYC.exe
  2⤵
  PID:5632
- C:\Windows\System\MvNTJTl.exe
  C:\Windows\System\MvNTJTl.exe
  2⤵
  PID:5648
- C:\Windows\System\XRiZXKg.exe
  C:\Windows\System\XRiZXKg.exe
  2⤵
  PID:5664
- C:\Windows\System\kAULyjJ.exe
  C:\Windows\System\kAULyjJ.exe
  2⤵
  PID:5680
- C:\Windows\System\zydhqzy.exe
  C:\Windows\System\zydhqzy.exe
  2⤵
  PID:5696
- C:\Windows\System\cLaHftQ.exe
  C:\Windows\System\cLaHftQ.exe
  2⤵
  PID:5712
- C:\Windows\System\BqpScUX.exe
  C:\Windows\System\BqpScUX.exe
  2⤵
  PID:5728
- C:\Windows\System\ndYkSVV.exe
  C:\Windows\System\ndYkSVV.exe
  2⤵
  PID:5744
- C:\Windows\System\YvnDLtE.exe
  C:\Windows\System\YvnDLtE.exe
  2⤵
  PID:5760
- C:\Windows\System\GuKPkvX.exe
  C:\Windows\System\GuKPkvX.exe
  2⤵
  PID:5776
- C:\Windows\System\dTdgaln.exe
  C:\Windows\System\dTdgaln.exe
  2⤵
  PID:5792
- C:\Windows\System\SYKEFkr.exe
  C:\Windows\System\SYKEFkr.exe
  2⤵
  PID:5808
- C:\Windows\System\AvTRoAd.exe
  C:\Windows\System\AvTRoAd.exe
  2⤵
  PID:5824
- C:\Windows\System\BEghuQK.exe
  C:\Windows\System\BEghuQK.exe
  2⤵
  PID:5840
- C:\Windows\System\rdgfsRe.exe
  C:\Windows\System\rdgfsRe.exe
  2⤵
  PID:5856
- C:\Windows\System\ZvFUllv.exe
  C:\Windows\System\ZvFUllv.exe
  2⤵
  PID:5872
- C:\Windows\System\buzWUUW.exe
  C:\Windows\System\buzWUUW.exe
  2⤵
  PID:5888
- C:\Windows\System\TgfhECV.exe
  C:\Windows\System\TgfhECV.exe
  2⤵
  PID:5904
- C:\Windows\System\BSADrQp.exe
  C:\Windows\System\BSADrQp.exe
  2⤵
  PID:5920
- C:\Windows\System\UJoDJht.exe
  C:\Windows\System\UJoDJht.exe
  2⤵
  PID:5936
- C:\Windows\System\YVnYyZe.exe
  C:\Windows\System\YVnYyZe.exe
  2⤵
  PID:5952
- C:\Windows\System\xxaVNsX.exe
  C:\Windows\System\xxaVNsX.exe
  2⤵
  PID:5968
- C:\Windows\System\HLkekWG.exe
  C:\Windows\System\HLkekWG.exe
  2⤵
  PID:5984
- C:\Windows\System\JvpLQYx.exe
  C:\Windows\System\JvpLQYx.exe
  2⤵
  PID:6000
- C:\Windows\System\zrwMADt.exe
  C:\Windows\System\zrwMADt.exe
  2⤵
  PID:6016
- C:\Windows\System\QhKrlkw.exe
  C:\Windows\System\QhKrlkw.exe
  2⤵
  PID:6032
- C:\Windows\System\cIbLcyc.exe
  C:\Windows\System\cIbLcyc.exe
  2⤵
  PID:6048
- C:\Windows\System\VIniMjD.exe
  C:\Windows\System\VIniMjD.exe
  2⤵
  PID:6064
- C:\Windows\System\wHfHxNL.exe
  C:\Windows\System\wHfHxNL.exe
  2⤵
  PID:6080
- C:\Windows\System\MVxHBMG.exe
  C:\Windows\System\MVxHBMG.exe
  2⤵
  PID:6096
- C:\Windows\System\JcQGbFk.exe
  C:\Windows\System\JcQGbFk.exe
  2⤵
  PID:6112
- C:\Windows\System\byxsZSW.exe
  C:\Windows\System\byxsZSW.exe
  2⤵
  PID:6128
- C:\Windows\System\KbBxalT.exe
  C:\Windows\System\KbBxalT.exe
  2⤵
  PID:4724
- C:\Windows\System\KaeALkz.exe
  C:\Windows\System\KaeALkz.exe
  2⤵
  PID:4532
- C:\Windows\System\iHwKrpC.exe
  C:\Windows\System\iHwKrpC.exe
  2⤵
  PID:5260
- C:\Windows\System\nxIAAQb.exe
  C:\Windows\System\nxIAAQb.exe
  2⤵
  PID:5180
- C:\Windows\System\iWzddIu.exe
  C:\Windows\System\iWzddIu.exe
  2⤵
  PID:5288
- C:\Windows\System\JeMoxtb.exe
  C:\Windows\System\JeMoxtb.exe
  2⤵
  PID:5352
- C:\Windows\System\BvKAFui.exe
  C:\Windows\System\BvKAFui.exe
  2⤵
  PID:5304
- C:\Windows\System\vihHhZq.exe
  C:\Windows\System\vihHhZq.exe
  2⤵
  PID:5372
- C:\Windows\System\HggxcYC.exe
  C:\Windows\System\HggxcYC.exe
  2⤵
  PID:5436
- C:\Windows\System\STlDEak.exe
  C:\Windows\System\STlDEak.exe
  2⤵
  PID:5500
- C:\Windows\System\UJrERyx.exe
  C:\Windows\System\UJrERyx.exe
  2⤵
  PID:5564
- C:\Windows\System\StZQalR.exe
  C:\Windows\System\StZQalR.exe
  2⤵
  PID:5628
- C:\Windows\System\gEbRdCg.exe
  C:\Windows\System\gEbRdCg.exe
  2⤵
  PID:5688
- C:\Windows\System\OntTGMq.exe
  C:\Windows\System\OntTGMq.exe
  2⤵
  PID:5756
- C:\Windows\System\mAJORLk.exe
  C:\Windows\System\mAJORLk.exe
  2⤵
  PID:5784
- C:\Windows\System\FJXzckG.exe
  C:\Windows\System\FJXzckG.exe
  2⤵
  PID:5848
- C:\Windows\System\naVZsgI.exe
  C:\Windows\System\naVZsgI.exe
  2⤵
  PID:5448
- C:\Windows\System\aXdPhML.exe
  C:\Windows\System\aXdPhML.exe
  2⤵
  PID:5484
- C:\Windows\System\mddFIbi.exe
  C:\Windows\System\mddFIbi.exe
  2⤵
  PID:5580
- C:\Windows\System\wopIBTi.exe
  C:\Windows\System\wopIBTi.exe
  2⤵
  PID:5644
- C:\Windows\System\KuWiRJf.exe
  C:\Windows\System\KuWiRJf.exe
  2⤵
  PID:5708
- C:\Windows\System\fhFqfzA.exe
  C:\Windows\System\fhFqfzA.exe
  2⤵
  PID:5772
- C:\Windows\System\FctjOur.exe
  C:\Windows\System\FctjOur.exe
  2⤵
  PID:5836
- C:\Windows\System\hgvuuKs.exe
  C:\Windows\System\hgvuuKs.exe
  2⤵
  PID:5880
- C:\Windows\System\SKfrcSY.exe
  C:\Windows\System\SKfrcSY.exe
  2⤵
  PID:5944
- C:\Windows\System\vPkInOi.exe
  C:\Windows\System\vPkInOi.exe
  2⤵
  PID:5964
- C:\Windows\System\VGxIBpT.exe
  C:\Windows\System\VGxIBpT.exe
  2⤵
  PID:5976
- C:\Windows\System\QzUKUMq.exe
  C:\Windows\System\QzUKUMq.exe
  2⤵
  PID:6040
- C:\Windows\System\rLRPJpt.exe
  C:\Windows\System\rLRPJpt.exe
  2⤵
  PID:6056
- C:\Windows\System\fITPZep.exe
  C:\Windows\System\fITPZep.exe
  2⤵
  PID:6120
- C:\Windows\System\MMdtkzH.exe
  C:\Windows\System\MMdtkzH.exe
  2⤵
  PID:6072
- C:\Windows\System\mhJNuML.exe
  C:\Windows\System\mhJNuML.exe
  2⤵
  PID:4696
- C:\Windows\System\cZwUyuc.exe
  C:\Windows\System\cZwUyuc.exe
  2⤵
  PID:5128
- C:\Windows\System\mibnBhE.exe
  C:\Windows\System\mibnBhE.exe
  2⤵
  PID:5192
- C:\Windows\System\LNmQQaZ.exe
  C:\Windows\System\LNmQQaZ.exe
  2⤵
  PID:5256
- C:\Windows\System\ERupQVZ.exe
  C:\Windows\System\ERupQVZ.exe
  2⤵
  PID:4264
- C:\Windows\System\oeXmjEu.exe
  C:\Windows\System\oeXmjEu.exe
  2⤵
  PID:5212
- C:\Windows\System\FskaNFT.exe
  C:\Windows\System\FskaNFT.exe
  2⤵
  PID:5336
- C:\Windows\System\rTeyGTz.exe
  C:\Windows\System\rTeyGTz.exe
  2⤵
  PID:5368
- C:\Windows\System\OSwBRMX.exe
  C:\Windows\System\OSwBRMX.exe
  2⤵
  PID:5624
- C:\Windows\System\mbDpEkF.exe
  C:\Windows\System\mbDpEkF.exe
  2⤵
  PID:4852
- C:\Windows\System\NOknMgX.exe
  C:\Windows\System\NOknMgX.exe
  2⤵
  PID:5432
- C:\Windows\System\mOkUTCV.exe
  C:\Windows\System\mOkUTCV.exe
  2⤵
  PID:5820
- C:\Windows\System\wxHrfpH.exe
  C:\Windows\System\wxHrfpH.exe
  2⤵
  PID:5480
- C:\Windows\System\VtDbhNY.exe
  C:\Windows\System\VtDbhNY.exe
  2⤵
  PID:5868
- C:\Windows\System\HAkLMQE.exe
  C:\Windows\System\HAkLMQE.exe
  2⤵
  PID:6008
- C:\Windows\System\hwmgqnv.exe
  C:\Windows\System\hwmgqnv.exe
  2⤵
  PID:5420
- C:\Windows\System\jFydWMH.exe
  C:\Windows\System\jFydWMH.exe
  2⤵
  PID:5676
- C:\Windows\System\bQuyPnc.exe
  C:\Windows\System\bQuyPnc.exe
  2⤵
  PID:5912
- C:\Windows\System\fdNQMRU.exe
  C:\Windows\System\fdNQMRU.exe
  2⤵
  PID:5948
- C:\Windows\System\uyDmKIT.exe
  C:\Windows\System\uyDmKIT.exe
  2⤵
  PID:6104
- C:\Windows\System\KAmgQDV.exe
  C:\Windows\System\KAmgQDV.exe
  2⤵
  PID:5196
- C:\Windows\System\KFxfUPA.exe
  C:\Windows\System\KFxfUPA.exe
  2⤵
  PID:5244
- C:\Windows\System\mXnORRy.exe
  C:\Windows\System\mXnORRy.exe
  2⤵
  PID:5164
- C:\Windows\System\ORYRqjH.exe
  C:\Windows\System\ORYRqjH.exe
  2⤵
  PID:5496
- C:\Windows\System\CetjEBF.exe
  C:\Windows\System\CetjEBF.exe
  2⤵
  PID:5404
- C:\Windows\System\ORLuZYg.exe
  C:\Windows\System\ORLuZYg.exe
  2⤵
  PID:5816
- C:\Windows\System\TchyXHt.exe
  C:\Windows\System\TchyXHt.exe
  2⤵
  PID:6148
- C:\Windows\System\EZkaDeh.exe
  C:\Windows\System\EZkaDeh.exe
  2⤵
  PID:6164
- C:\Windows\System\YqvcDWB.exe
  C:\Windows\System\YqvcDWB.exe
  2⤵
  PID:6180
- C:\Windows\System\KpgSScO.exe
  C:\Windows\System\KpgSScO.exe
  2⤵
  PID:6196
- C:\Windows\System\byQECbW.exe
  C:\Windows\System\byQECbW.exe
  2⤵
  PID:6212
- C:\Windows\System\KzUlPMa.exe
  C:\Windows\System\KzUlPMa.exe
  2⤵
  PID:6228
- C:\Windows\System\FsuOiil.exe
  C:\Windows\System\FsuOiil.exe
  2⤵
  PID:6244
- C:\Windows\System\EPAxpqA.exe
  C:\Windows\System\EPAxpqA.exe
  2⤵
  PID:6260
- C:\Windows\System\PmTXDev.exe
  C:\Windows\System\PmTXDev.exe
  2⤵
  PID:6276
- C:\Windows\System\CTbfkHS.exe
  C:\Windows\System\CTbfkHS.exe
  2⤵
  PID:6292
- C:\Windows\System\dcVzpqH.exe
  C:\Windows\System\dcVzpqH.exe
  2⤵
  PID:6308
- C:\Windows\System\DAKHQNL.exe
  C:\Windows\System\DAKHQNL.exe
  2⤵
  PID:6324
- C:\Windows\System\UXgdeCR.exe
  C:\Windows\System\UXgdeCR.exe
  2⤵
  PID:6340
- C:\Windows\System\qOnzkDC.exe
  C:\Windows\System\qOnzkDC.exe
  2⤵
  PID:6356
- C:\Windows\System\lMdPYao.exe
  C:\Windows\System\lMdPYao.exe
  2⤵
  PID:6372
- C:\Windows\System\IacPWFB.exe
  C:\Windows\System\IacPWFB.exe
  2⤵
  PID:6388
- C:\Windows\System\KKAUNfK.exe
  C:\Windows\System\KKAUNfK.exe
  2⤵
  PID:6404
- C:\Windows\System\tekBvuF.exe
  C:\Windows\System\tekBvuF.exe
  2⤵
  PID:6420
- C:\Windows\System\jbqzJIr.exe
  C:\Windows\System\jbqzJIr.exe
  2⤵
  PID:6436
- C:\Windows\System\fZnqElH.exe
  C:\Windows\System\fZnqElH.exe
  2⤵
  PID:6452
- C:\Windows\System\gVJdIqZ.exe
  C:\Windows\System\gVJdIqZ.exe
  2⤵
  PID:6468
- C:\Windows\System\JVVJJWg.exe
  C:\Windows\System\JVVJJWg.exe
  2⤵
  PID:6484
- C:\Windows\System\DeWdepQ.exe
  C:\Windows\System\DeWdepQ.exe
  2⤵
  PID:6500
- C:\Windows\System\YTCzBfB.exe
  C:\Windows\System\YTCzBfB.exe
  2⤵
  PID:6516
- C:\Windows\System\VAPgRgR.exe
  C:\Windows\System\VAPgRgR.exe
  2⤵
  PID:6532
- C:\Windows\System\GwSTXsg.exe
  C:\Windows\System\GwSTXsg.exe
  2⤵
  PID:6548
- C:\Windows\System\AWeASRc.exe
  C:\Windows\System\AWeASRc.exe
  2⤵
  PID:6564
- C:\Windows\System\NkYOEzT.exe
  C:\Windows\System\NkYOEzT.exe
  2⤵
  PID:6580
- C:\Windows\System\iLXtile.exe
  C:\Windows\System\iLXtile.exe
  2⤵
  PID:6596
- C:\Windows\System\HgBxJSZ.exe
  C:\Windows\System\HgBxJSZ.exe
  2⤵
  PID:6612
- C:\Windows\System\YrzdWoZ.exe
  C:\Windows\System\YrzdWoZ.exe
  2⤵
  PID:6628
- C:\Windows\System\EhOcaZk.exe
  C:\Windows\System\EhOcaZk.exe
  2⤵
  PID:6644
- C:\Windows\System\WwZozBA.exe
  C:\Windows\System\WwZozBA.exe
  2⤵
  PID:6660
- C:\Windows\System\qNDQtcL.exe
  C:\Windows\System\qNDQtcL.exe
  2⤵
  PID:6676
- C:\Windows\System\umYQLJc.exe
  C:\Windows\System\umYQLJc.exe
  2⤵
  PID:6692
- C:\Windows\System\QKFlyGX.exe
  C:\Windows\System\QKFlyGX.exe
  2⤵
  PID:6708
- C:\Windows\System\FfqIvnd.exe
  C:\Windows\System\FfqIvnd.exe
  2⤵
  PID:6724
- C:\Windows\System\nSPurvk.exe
  C:\Windows\System\nSPurvk.exe
  2⤵
  PID:6740
- C:\Windows\System\lurUNnH.exe
  C:\Windows\System\lurUNnH.exe
  2⤵
  PID:6756
- C:\Windows\System\oJBzMPz.exe
  C:\Windows\System\oJBzMPz.exe
  2⤵
  PID:6772
- C:\Windows\System\tifgohj.exe
  C:\Windows\System\tifgohj.exe
  2⤵
  PID:6788
- C:\Windows\System\xmIAAgC.exe
  C:\Windows\System\xmIAAgC.exe
  2⤵
  PID:6804
- C:\Windows\System\cDZykQQ.exe
  C:\Windows\System\cDZykQQ.exe
  2⤵
  PID:6820
- C:\Windows\System\aGvosNW.exe
  C:\Windows\System\aGvosNW.exe
  2⤵
  PID:6836
- C:\Windows\System\BtOpEuw.exe
  C:\Windows\System\BtOpEuw.exe
  2⤵
  PID:6852
- C:\Windows\System\YvndKak.exe
  C:\Windows\System\YvndKak.exe
  2⤵
  PID:6868
- C:\Windows\System\CMCsouB.exe
  C:\Windows\System\CMCsouB.exe
  2⤵
  PID:6884
- C:\Windows\System\rqDXzbd.exe
  C:\Windows\System\rqDXzbd.exe
  2⤵
  PID:6900
- C:\Windows\System\VvYkPnw.exe
  C:\Windows\System\VvYkPnw.exe
  2⤵
  PID:6916
- C:\Windows\System\xlqajSK.exe
  C:\Windows\System\xlqajSK.exe
  2⤵
  PID:6932
- C:\Windows\System\QpoyXbx.exe
  C:\Windows\System\QpoyXbx.exe
  2⤵
  PID:6948
- C:\Windows\System\aTCCgyI.exe
  C:\Windows\System\aTCCgyI.exe
  2⤵
  PID:6964
- C:\Windows\System\IKwpLmU.exe
  C:\Windows\System\IKwpLmU.exe
  2⤵
  PID:6980
- C:\Windows\System\ZdwwUWn.exe
  C:\Windows\System\ZdwwUWn.exe
  2⤵
  PID:6996
- C:\Windows\System\hoWPbBc.exe
  C:\Windows\System\hoWPbBc.exe
  2⤵
  PID:7012
- C:\Windows\System\acefDxQ.exe
  C:\Windows\System\acefDxQ.exe
  2⤵
  PID:7028
- C:\Windows\System\RKKvQiS.exe
  C:\Windows\System\RKKvQiS.exe
  2⤵
  PID:7048
- C:\Windows\System\IlLvFyp.exe
  C:\Windows\System\IlLvFyp.exe
  2⤵
  PID:7064
- C:\Windows\System\HqJyYZe.exe
  C:\Windows\System\HqJyYZe.exe
  2⤵
  PID:7080
- C:\Windows\System\SBUbUEF.exe
  C:\Windows\System\SBUbUEF.exe
  2⤵
  PID:7096
- C:\Windows\System\iwLvODU.exe
  C:\Windows\System\iwLvODU.exe
  2⤵
  PID:7112
- C:\Windows\System\nLwPxtC.exe
  C:\Windows\System\nLwPxtC.exe
  2⤵
  PID:7128
- C:\Windows\System\UpsczMO.exe
  C:\Windows\System\UpsczMO.exe
  2⤵
  PID:7144
- C:\Windows\System\UpyTnJB.exe
  C:\Windows\System\UpyTnJB.exe
  2⤵
  PID:7160
- C:\Windows\System\ePbrEeR.exe
  C:\Windows\System\ePbrEeR.exe
  2⤵
  PID:5340
- C:\Windows\System\CzncIQX.exe
  C:\Windows\System\CzncIQX.exe
  2⤵
  PID:5896
- C:\Windows\System\ZnrmKmA.exe
  C:\Windows\System\ZnrmKmA.exe
  2⤵
  PID:5804
- C:\Windows\System\SoPYqKk.exe
  C:\Windows\System\SoPYqKk.exe
  2⤵
  PID:5148
- C:\Windows\System\BDDskCb.exe
  C:\Windows\System\BDDskCb.exe
  2⤵
  PID:5928
- C:\Windows\System\SFAMAlW.exe
  C:\Windows\System\SFAMAlW.exe
  2⤵
  PID:6236
- C:\Windows\System\xzGSejT.exe
  C:\Windows\System\xzGSejT.exe
  2⤵
  PID:5276
- C:\Windows\System\GyYdhca.exe
  C:\Windows\System\GyYdhca.exe
  2⤵
  PID:6176
- C:\Windows\System\JGyfuMi.exe
  C:\Windows\System\JGyfuMi.exe
  2⤵
  PID:6268
- C:\Windows\System\eNgaLqP.exe
  C:\Windows\System\eNgaLqP.exe
  2⤵
  PID:6332
- C:\Windows\System\CKiSDCl.exe
  C:\Windows\System\CKiSDCl.exe
  2⤵
  PID:6188
- C:\Windows\System\GLvuLwN.exe
  C:\Windows\System\GLvuLwN.exe
  2⤵
  PID:6252
- C:\Windows\System\OSgSfnm.exe
  C:\Windows\System\OSgSfnm.exe
  2⤵
  PID:6316
- C:\Windows\System\fHIqQlB.exe
  C:\Windows\System\fHIqQlB.exe
  2⤵
  PID:6380
- C:\Windows\System\nWKFSda.exe
  C:\Windows\System\nWKFSda.exe
  2⤵
  PID:6492
- C:\Windows\System\ZSYFZmp.exe
  C:\Windows\System\ZSYFZmp.exe
  2⤵
  PID:6620
- C:\Windows\System\uipCmux.exe
  C:\Windows\System\uipCmux.exe
  2⤵
  PID:6396
- C:\Windows\System\cIujkRs.exe
  C:\Windows\System\cIujkRs.exe
  2⤵
  PID:6496
- C:\Windows\System\LQfhucq.exe
  C:\Windows\System\LQfhucq.exe
  2⤵
  PID:6624
- C:\Windows\System\XcwEHPz.exe
  C:\Windows\System\XcwEHPz.exe
  2⤵
  PID:6416
- C:\Windows\System\MBJvYuz.exe
  C:\Windows\System\MBJvYuz.exe
  2⤵
  PID:6476
- C:\Windows\System\PlxLuhD.exe
  C:\Windows\System\PlxLuhD.exe
  2⤵
  PID:6512
- C:\Windows\System\pjvssWD.exe
  C:\Windows\System\pjvssWD.exe
  2⤵
  PID:6876
- C:\Windows\System\NPMtnWg.exe
  C:\Windows\System\NPMtnWg.exe
  2⤵
  PID:6816
- C:\Windows\System\FxiutPn.exe
  C:\Windows\System\FxiutPn.exe
  2⤵
  PID:6908
- C:\Windows\System\SZealbJ.exe
  C:\Windows\System\SZealbJ.exe
  2⤵
  PID:6972
- C:\Windows\System\nDbnBvV.exe
  C:\Windows\System\nDbnBvV.exe
  2⤵
  PID:7036
- C:\Windows\System\ZHBiybD.exe
  C:\Windows\System\ZHBiybD.exe
  2⤵
  PID:6604
- C:\Windows\System\PPljSzP.exe
  C:\Windows\System\PPljSzP.exe
  2⤵
  PID:6668
- C:\Windows\System\gHJScGx.exe
  C:\Windows\System\gHJScGx.exe
  2⤵
  PID:5324
- C:\Windows\System\hCRVtJl.exe
  C:\Windows\System\hCRVtJl.exe
  2⤵
  PID:7104
- C:\Windows\System\GXCBwcC.exe
  C:\Windows\System\GXCBwcC.exe
  2⤵
  PID:6156
- C:\Windows\System\qerCVSX.exe
  C:\Windows\System\qerCVSX.exe
  2⤵
  PID:6764
- C:\Windows\System\YOTaQqe.exe
  C:\Windows\System\YOTaQqe.exe
  2⤵
  PID:6828
- C:\Windows\System\zpUlzEN.exe
  C:\Windows\System\zpUlzEN.exe
  2⤵
  PID:5320
- C:\Windows\System\LpLGRRC.exe
  C:\Windows\System\LpLGRRC.exe
  2⤵
  PID:6240
- C:\Windows\System\yltwhRE.exe
  C:\Windows\System\yltwhRE.exe
  2⤵
  PID:6892
- C:\Windows\System\JXNWGzj.exe
  C:\Windows\System\JXNWGzj.exe
  2⤵
  PID:6956
- C:\Windows\System\lHTUuIY.exe
  C:\Windows\System\lHTUuIY.exe
  2⤵
  PID:7020
- C:\Windows\System\ObHBXxV.exe
  C:\Windows\System\ObHBXxV.exe
  2⤵
  PID:6540
- C:\Windows\System\RuRQbnf.exe
  C:\Windows\System\RuRQbnf.exe
  2⤵
  PID:6288
- C:\Windows\System\QfcSXlb.exe
  C:\Windows\System\QfcSXlb.exe
  2⤵
  PID:7124
- C:\Windows\System\KVArsPV.exe
  C:\Windows\System\KVArsPV.exe
  2⤵
  PID:5724
- C:\Windows\System\yfJIgMl.exe
  C:\Windows\System\yfJIgMl.exe
  2⤵
  PID:5544
- C:\Windows\System\NMEYcET.exe
  C:\Windows\System\NMEYcET.exe
  2⤵
  PID:6300
- C:\Windows\System\wRBbjjA.exe
  C:\Windows\System\wRBbjjA.exe
  2⤵
  PID:6348
- C:\Windows\System\nmLBFzb.exe
  C:\Windows\System\nmLBFzb.exe
  2⤵
  PID:6368
- C:\Windows\System\bbTBmee.exe
  C:\Windows\System\bbTBmee.exe
  2⤵
  PID:6412
- C:\Windows\System\OBWPqmd.exe
  C:\Windows\System\OBWPqmd.exe
  2⤵
  PID:6784
- C:\Windows\System\UitFFgY.exe
  C:\Windows\System\UitFFgY.exe
  2⤵
  PID:6572
- C:\Windows\System\EPVUYpd.exe
  C:\Windows\System\EPVUYpd.exe
  2⤵
  PID:6700
- C:\Windows\System\Fdifzdb.exe
  C:\Windows\System\Fdifzdb.exe
  2⤵
  PID:6448
- C:\Windows\System\gHMGrHG.exe
  C:\Windows\System\gHMGrHG.exe
  2⤵
  PID:6848
- C:\Windows\System\ZEiJgyM.exe
  C:\Windows\System\ZEiJgyM.exe
  2⤵
  PID:7076
- C:\Windows\System\MnATiQU.exe
  C:\Windows\System\MnATiQU.exe
  2⤵
  PID:7136
- C:\Windows\System\JnxiApq.exe
  C:\Windows\System\JnxiApq.exe
  2⤵
  PID:4516
- C:\Windows\System\orkFHPl.exe
  C:\Windows\System\orkFHPl.exe
  2⤵
  PID:6864
- C:\Windows\System\omSFHrS.exe
  C:\Windows\System\omSFHrS.exe
  2⤵
  PID:6172
- C:\Windows\System\IykqJoZ.exe
  C:\Windows\System\IykqJoZ.exe
  2⤵
  PID:6556
- C:\Windows\System\GaGwQzv.exe
  C:\Windows\System\GaGwQzv.exe
  2⤵
  PID:6576
- C:\Windows\System\JsXbcdY.exe
  C:\Windows\System\JsXbcdY.exe
  2⤵
  PID:6924
- C:\Windows\System\srUgZgD.exe
  C:\Windows\System\srUgZgD.exe
  2⤵
  PID:7092
- C:\Windows\System\TYxrCib.exe
  C:\Windows\System\TYxrCib.exe
  2⤵
  PID:6220
- C:\Windows\System\CMRrSLs.exe
  C:\Windows\System\CMRrSLs.exe
  2⤵
  PID:6940
- C:\Windows\System\OvahVqa.exe
  C:\Windows\System\OvahVqa.exe
  2⤵
  PID:7180
- C:\Windows\System\ERwKMpR.exe
  C:\Windows\System\ERwKMpR.exe
  2⤵
  PID:7196
- C:\Windows\System\uPLfGnG.exe
  C:\Windows\System\uPLfGnG.exe
  2⤵
  PID:7212
- C:\Windows\System\Xgszyfr.exe
  C:\Windows\System\Xgszyfr.exe
  2⤵
  PID:7228
- C:\Windows\System\RhOAnKv.exe
  C:\Windows\System\RhOAnKv.exe
  2⤵
  PID:7244
- C:\Windows\System\qxgmWdQ.exe
  C:\Windows\System\qxgmWdQ.exe
  2⤵
  PID:7260
- C:\Windows\System\pSnPFvC.exe
  C:\Windows\System\pSnPFvC.exe
  2⤵
  PID:7276
- C:\Windows\System\mMfdaPf.exe
  C:\Windows\System\mMfdaPf.exe
  2⤵
  PID:7292
- C:\Windows\System\zzUJIMu.exe
  C:\Windows\System\zzUJIMu.exe
  2⤵
  PID:7308
- C:\Windows\System\EGznCpA.exe
  C:\Windows\System\EGznCpA.exe
  2⤵
  PID:7324
- C:\Windows\System\eXvxeud.exe
  C:\Windows\System\eXvxeud.exe
  2⤵
  PID:7340
- C:\Windows\System\KyyDEbn.exe
  C:\Windows\System\KyyDEbn.exe
  2⤵
  PID:7356
- C:\Windows\System\PFtmSNE.exe
  C:\Windows\System\PFtmSNE.exe
  2⤵
  PID:7372
- C:\Windows\System\DrhoFYR.exe
  C:\Windows\System\DrhoFYR.exe
  2⤵
  PID:7388
- C:\Windows\System\rQdQLDU.exe
  C:\Windows\System\rQdQLDU.exe
  2⤵
  PID:7404
- C:\Windows\System\VhsuycA.exe
  C:\Windows\System\VhsuycA.exe
  2⤵
  PID:7420
- C:\Windows\System\suoOKng.exe
  C:\Windows\System\suoOKng.exe
  2⤵
  PID:7436
- C:\Windows\System\IeLjdzI.exe
  C:\Windows\System\IeLjdzI.exe
  2⤵
  PID:7452
- C:\Windows\System\TskfLBD.exe
  C:\Windows\System\TskfLBD.exe
  2⤵
  PID:7468
- C:\Windows\System\sDEvNzm.exe
  C:\Windows\System\sDEvNzm.exe
  2⤵
  PID:7484
- C:\Windows\System\MfawEiS.exe
  C:\Windows\System\MfawEiS.exe
  2⤵
  PID:7500
- C:\Windows\System\ksdBhBP.exe
  C:\Windows\System\ksdBhBP.exe
  2⤵
  PID:7516
- C:\Windows\System\RMOFdJt.exe
  C:\Windows\System\RMOFdJt.exe
  2⤵
  PID:7532
- C:\Windows\System\BhZXLCt.exe
  C:\Windows\System\BhZXLCt.exe
  2⤵
  PID:7548
- C:\Windows\System\mvgHEBy.exe
  C:\Windows\System\mvgHEBy.exe
  2⤵
  PID:7564
- C:\Windows\System\kekfflD.exe
  C:\Windows\System\kekfflD.exe
  2⤵
  PID:7580
- C:\Windows\System\RqcFMij.exe
  C:\Windows\System\RqcFMij.exe
  2⤵
  PID:7596
- C:\Windows\System\OyvdrKn.exe
  C:\Windows\System\OyvdrKn.exe
  2⤵
  PID:7612
- C:\Windows\System\EOMaWCu.exe
  C:\Windows\System\EOMaWCu.exe
  2⤵
  PID:7628
- C:\Windows\System\wQBsJPj.exe
  C:\Windows\System\wQBsJPj.exe
  2⤵
  PID:7644
- C:\Windows\System\LCNbzka.exe
  C:\Windows\System\LCNbzka.exe
  2⤵
  PID:7664
- C:\Windows\System\PENVjEe.exe
  C:\Windows\System\PENVjEe.exe
  2⤵
  PID:7680
- C:\Windows\System\vYUhXqG.exe
  C:\Windows\System\vYUhXqG.exe
  2⤵
  PID:7696
- C:\Windows\System\feCNSme.exe
  C:\Windows\System\feCNSme.exe
  2⤵
  PID:7712
- C:\Windows\System\HeMiMHg.exe
  C:\Windows\System\HeMiMHg.exe
  2⤵
  PID:7728
- C:\Windows\System\GFPMAPE.exe
  C:\Windows\System\GFPMAPE.exe
  2⤵
  PID:7744
- C:\Windows\System\PdQUlrd.exe
  C:\Windows\System\PdQUlrd.exe
  2⤵
  PID:7760
- C:\Windows\System\KSTeSUo.exe
  C:\Windows\System\KSTeSUo.exe
  2⤵
  PID:7776
- C:\Windows\System\yApbLfB.exe
  C:\Windows\System\yApbLfB.exe
  2⤵
  PID:7792
- C:\Windows\System\gsMuDcV.exe
  C:\Windows\System\gsMuDcV.exe
  2⤵
  PID:7808
- C:\Windows\System\fbKsElK.exe
  C:\Windows\System\fbKsElK.exe
  2⤵
  PID:7824
- C:\Windows\System\BNaVJFo.exe
  C:\Windows\System\BNaVJFo.exe
  2⤵
  PID:7840
- C:\Windows\System\whvcmoo.exe
  C:\Windows\System\whvcmoo.exe
  2⤵
  PID:7856
- C:\Windows\System\icxWbJF.exe
  C:\Windows\System\icxWbJF.exe
  2⤵
  PID:7872
- C:\Windows\System\ouTGxyZ.exe
  C:\Windows\System\ouTGxyZ.exe
  2⤵
  PID:7888
- C:\Windows\System\TSOhgwN.exe
  C:\Windows\System\TSOhgwN.exe
  2⤵
  PID:7904
- C:\Windows\System\dxpbeqR.exe
  C:\Windows\System\dxpbeqR.exe
  2⤵
  PID:7920
- C:\Windows\System\zHkerfG.exe
  C:\Windows\System\zHkerfG.exe
  2⤵
  PID:7936
- C:\Windows\System\okKEDDC.exe
  C:\Windows\System\okKEDDC.exe
  2⤵
  PID:7952
- C:\Windows\System\lSLGPdF.exe
  C:\Windows\System\lSLGPdF.exe
  2⤵
  PID:7968
- C:\Windows\System\vjOOCQU.exe
  C:\Windows\System\vjOOCQU.exe
  2⤵
  PID:7984
- C:\Windows\System\UAJtceL.exe
  C:\Windows\System\UAJtceL.exe
  2⤵
  PID:8000
- C:\Windows\System\EnxbMqX.exe
  C:\Windows\System\EnxbMqX.exe
  2⤵
  PID:8016
- C:\Windows\System\IegxRmM.exe
  C:\Windows\System\IegxRmM.exe
  2⤵
  PID:8032
- C:\Windows\System\dfMlIXR.exe
  C:\Windows\System\dfMlIXR.exe
  2⤵
  PID:8048
- C:\Windows\System\TltiOxS.exe
  C:\Windows\System\TltiOxS.exe
  2⤵
  PID:8064
- C:\Windows\System\bNlUOuj.exe
  C:\Windows\System\bNlUOuj.exe
  2⤵
  PID:8080
- C:\Windows\System\ALLxwyk.exe
  C:\Windows\System\ALLxwyk.exe
  2⤵
  PID:8096
- C:\Windows\System\rBTbjvG.exe
  C:\Windows\System\rBTbjvG.exe
  2⤵
  PID:8112
- C:\Windows\System\sYOIHGd.exe
  C:\Windows\System\sYOIHGd.exe
  2⤵
  PID:8128
- C:\Windows\System\EKsDcYK.exe
  C:\Windows\System\EKsDcYK.exe
  2⤵
  PID:8144
- C:\Windows\System\UGxJuvX.exe
  C:\Windows\System\UGxJuvX.exe
  2⤵
  PID:8160
- C:\Windows\System\Qwcszbo.exe
  C:\Windows\System\Qwcszbo.exe
  2⤵
  PID:8176
- C:\Windows\System\SOxjKZq.exe
  C:\Windows\System\SOxjKZq.exe
  2⤵
  PID:6720
- C:\Windows\System\kcoNUuj.exe
  C:\Windows\System\kcoNUuj.exe
  2⤵
  PID:6284
- C:\Windows\System\kEgKoBa.exe
  C:\Windows\System\kEgKoBa.exe
  2⤵
  PID:5160
- C:\Windows\System\lubPfEi.exe
  C:\Windows\System\lubPfEi.exe
  2⤵
  PID:7172
- C:\Windows\System\BxkUoKq.exe
  C:\Windows\System\BxkUoKq.exe
  2⤵
  PID:7236
- C:\Windows\System\tvCUfHN.exe
  C:\Windows\System\tvCUfHN.exe
  2⤵
  PID:7300
- C:\Windows\System\QjwgBTE.exe
  C:\Windows\System\QjwgBTE.exe
  2⤵
  PID:6640
- C:\Windows\System\DCyqzuQ.exe
  C:\Windows\System\DCyqzuQ.exe
  2⤵
  PID:6992
- C:\Windows\System\BoDcZCO.exe
  C:\Windows\System\BoDcZCO.exe
  2⤵
  PID:7336
- C:\Windows\System\AAvFkmt.exe
  C:\Windows\System\AAvFkmt.exe
  2⤵
  PID:7368
- C:\Windows\System\TtlFcGl.exe
  C:\Windows\System\TtlFcGl.exe
  2⤵
  PID:7432
- C:\Windows\System\hjwkPKD.exe
  C:\Windows\System\hjwkPKD.exe
  2⤵
  PID:7496
- C:\Windows\System\qefSljF.exe
  C:\Windows\System\qefSljF.exe
  2⤵
  PID:7252
- C:\Windows\System\LuBSVDl.exe
  C:\Windows\System\LuBSVDl.exe
  2⤵
  PID:7380
- C:\Windows\System\hVHeETc.exe
  C:\Windows\System\hVHeETc.exe
  2⤵
  PID:7444
- C:\Windows\System\DcPZfvi.exe
  C:\Windows\System\DcPZfvi.exe
  2⤵
  PID:6684
- C:\Windows\System\MmRnnfJ.exe
  C:\Windows\System\MmRnnfJ.exe
  2⤵
  PID:7348
- C:\Windows\System\rvxQVXL.exe
  C:\Windows\System\rvxQVXL.exe
  2⤵
  PID:7524
- C:\Windows\System\BeSdIjo.exe
  C:\Windows\System\BeSdIjo.exe
  2⤵
  PID:7620
- C:\Windows\System\FKlBiaf.exe
  C:\Windows\System\FKlBiaf.exe
  2⤵
  PID:7512
- C:\Windows\System\uOicTyK.exe
  C:\Windows\System\uOicTyK.exe
  2⤵
  PID:7576
- C:\Windows\System\noWQWiE.exe
  C:\Windows\System\noWQWiE.exe
  2⤵
  PID:7640
- C:\Windows\System\AiCDsSe.exe
  C:\Windows\System\AiCDsSe.exe
  2⤵
  PID:7688
- C:\Windows\System\TWDTdSQ.exe
  C:\Windows\System\TWDTdSQ.exe
  2⤵
  PID:7720
- C:\Windows\System\dezgcGA.exe
  C:\Windows\System\dezgcGA.exe
  2⤵
  PID:7740
- C:\Windows\System\MCMNRFV.exe
  C:\Windows\System\MCMNRFV.exe
  2⤵
  PID:7800
- C:\Windows\System\LHIqvOy.exe
  C:\Windows\System\LHIqvOy.exe
  2⤵
  PID:7816
- C:\Windows\System\WhRsdun.exe
  C:\Windows\System\WhRsdun.exe
  2⤵
  PID:7832
- C:\Windows\System\cKAVnLj.exe
  C:\Windows\System\cKAVnLj.exe
  2⤵
  PID:7884
- C:\Windows\System\AQaDQJv.exe
  C:\Windows\System\AQaDQJv.exe
  2⤵
  PID:7900
- C:\Windows\System\MoSJWsD.exe
  C:\Windows\System\MoSJWsD.exe
  2⤵
  PID:7964
- C:\Windows\System\KjDPsLf.exe
  C:\Windows\System\KjDPsLf.exe
  2⤵
  PID:7916
- C:\Windows\System\PrVxwNg.exe
  C:\Windows\System\PrVxwNg.exe
  2⤵
  PID:7980
- C:\Windows\System\Zbbukdp.exe
  C:\Windows\System\Zbbukdp.exe
  2⤵
  PID:8044
- C:\Windows\System\ksieThm.exe
  C:\Windows\System\ksieThm.exe
  2⤵
  PID:8060
- C:\Windows\System\PukHKSF.exe
  C:\Windows\System\PukHKSF.exe
  2⤵
  PID:8076
- C:\Windows\System\rmafyMP.exe
  C:\Windows\System\rmafyMP.exe
  2⤵
  PID:8140
- C:\Windows\System\erDkeCI.exe
  C:\Windows\System\erDkeCI.exe
  2⤵
  PID:4568
- C:\Windows\System\KUqWQug.exe
  C:\Windows\System\KUqWQug.exe
  2⤵
  PID:8184
- C:\Windows\System\RbOvKpt.exe
  C:\Windows\System\RbOvKpt.exe
  2⤵
  PID:6732
- C:\Windows\System\hUWHIMq.exe
  C:\Windows\System\hUWHIMq.exe
  2⤵
  PID:6636
- C:\Windows\System\pFYnJta.exe
  C:\Windows\System\pFYnJta.exe
  2⤵
  PID:7268
- C:\Windows\System\qkXiuYZ.exe
  C:\Windows\System\qkXiuYZ.exe
  2⤵
  PID:7400
- C:\Windows\System\NkWENdt.exe
  C:\Windows\System\NkWENdt.exe
  2⤵
  PID:7476
- C:\Windows\System\vmgOdBN.exe
  C:\Windows\System\vmgOdBN.exe
  2⤵
  PID:7464
- C:\Windows\System\didvTwM.exe
  C:\Windows\System\didvTwM.exe
  2⤵
  PID:7556
- C:\Windows\System\xOArHpF.exe
  C:\Windows\System\xOArHpF.exe
  2⤵
  PID:7416
- C:\Windows\System\BBmHSwr.exe
  C:\Windows\System\BBmHSwr.exe
  2⤵
  PID:7544
- C:\Windows\System\hCIvFkQ.exe
  C:\Windows\System\hCIvFkQ.exe
  2⤵
  PID:7508
- C:\Windows\System\UjJugyr.exe
  C:\Windows\System\UjJugyr.exe
  2⤵
  PID:7656
- C:\Windows\System\WYXkMkT.exe
  C:\Windows\System\WYXkMkT.exe
  2⤵
  PID:7784
- C:\Windows\System\ZLkHeEc.exe
  C:\Windows\System\ZLkHeEc.exe
  2⤵
  PID:7932
- C:\Windows\System\BgyhVXr.exe
  C:\Windows\System\BgyhVXr.exe
  2⤵
  PID:8028
- C:\Windows\System\SaBnuBN.exe
  C:\Windows\System\SaBnuBN.exe
  2⤵
  PID:8124
- C:\Windows\System\abScXvq.exe
  C:\Windows\System\abScXvq.exe
  2⤵
  PID:6508
- C:\Windows\System\zTqImTq.exe
  C:\Windows\System\zTqImTq.exe
  2⤵
  PID:7768
- C:\Windows\System\vZFdBqU.exe
  C:\Windows\System\vZFdBqU.exe
  2⤵
  PID:7996
- C:\Windows\System\QYQFvjO.exe
  C:\Windows\System\QYQFvjO.exe
  2⤵
  PID:7868
- C:\Windows\System\WVeqAIL.exe
  C:\Windows\System\WVeqAIL.exe
  2⤵
  PID:6028
- C:\Windows\System\OqafKDe.exe
  C:\Windows\System\OqafKDe.exe
  2⤵
  PID:7224
- C:\Windows\System\nyjhBKD.exe
  C:\Windows\System\nyjhBKD.exe
  2⤵
  PID:7948
- C:\Windows\System\VPMHgYG.exe
  C:\Windows\System\VPMHgYG.exe
  2⤵
  PID:7880
- C:\Windows\System\LnZqRCY.exe
  C:\Windows\System\LnZqRCY.exe
  2⤵
  PID:8072
- C:\Windows\System\lllCIHh.exe
  C:\Windows\System\lllCIHh.exe
  2⤵
  PID:6092
- C:\Windows\System\BaYPLMp.exe
  C:\Windows\System\BaYPLMp.exe
  2⤵
  PID:7208
- C:\Windows\System\XBQneQw.exe
  C:\Windows\System\XBQneQw.exe
  2⤵
  PID:7704
- C:\Windows\System\RYRYvPs.exe
  C:\Windows\System\RYRYvPs.exe
  2⤵
  PID:8196
- C:\Windows\System\MPPIiqM.exe
  C:\Windows\System\MPPIiqM.exe
  2⤵
  PID:8212
- C:\Windows\System\kKBqCAo.exe
  C:\Windows\System\kKBqCAo.exe
  2⤵
  PID:8228
- C:\Windows\System\JDRLxgR.exe
  C:\Windows\System\JDRLxgR.exe
  2⤵
  PID:8244
- C:\Windows\System\qVARBdK.exe
  C:\Windows\System\qVARBdK.exe
  2⤵
  PID:8260
- C:\Windows\System\SzYToAb.exe
  C:\Windows\System\SzYToAb.exe
  2⤵
  PID:8276
- C:\Windows\System\YnbLsGv.exe
  C:\Windows\System\YnbLsGv.exe
  2⤵
  PID:8292
- C:\Windows\System\xmYupbl.exe
  C:\Windows\System\xmYupbl.exe
  2⤵
  PID:8308
- C:\Windows\System\OAANpma.exe
  C:\Windows\System\OAANpma.exe
  2⤵
  PID:8324
- C:\Windows\System\sJtCwjb.exe
  C:\Windows\System\sJtCwjb.exe
  2⤵
  PID:8340
- C:\Windows\System\FWTCobv.exe
  C:\Windows\System\FWTCobv.exe
  2⤵
  PID:8356
- C:\Windows\System\OBSSCGP.exe
  C:\Windows\System\OBSSCGP.exe
  2⤵
  PID:8372
- C:\Windows\System\zuQEznB.exe
  C:\Windows\System\zuQEznB.exe
  2⤵
  PID:8388
- C:\Windows\System\pMCgPPs.exe
  C:\Windows\System\pMCgPPs.exe
  2⤵
  PID:8404
- C:\Windows\System\WeBsFyg.exe
  C:\Windows\System\WeBsFyg.exe
  2⤵
  PID:8420
- C:\Windows\System\jcpDkSa.exe
  C:\Windows\System\jcpDkSa.exe
  2⤵
  PID:8436
- C:\Windows\System\sJHoPyM.exe
  C:\Windows\System\sJHoPyM.exe
  2⤵
  PID:8452
- C:\Windows\System\jmbySwA.exe
  C:\Windows\System\jmbySwA.exe
  2⤵
  PID:8468
- C:\Windows\System\eyijTcq.exe
  C:\Windows\System\eyijTcq.exe
  2⤵
  PID:8484
- C:\Windows\System\pwSIRkz.exe
  C:\Windows\System\pwSIRkz.exe
  2⤵
  PID:8500
- C:\Windows\System\QuKoQfr.exe
  C:\Windows\System\QuKoQfr.exe
  2⤵
  PID:8516
- C:\Windows\System\lpqjoaf.exe
  C:\Windows\System\lpqjoaf.exe
  2⤵
  PID:8532
- C:\Windows\System\HVxRCbS.exe
  C:\Windows\System\HVxRCbS.exe
  2⤵
  PID:8548
- C:\Windows\System\UZeMysg.exe
  C:\Windows\System\UZeMysg.exe
  2⤵
  PID:8564
- C:\Windows\System\bNSuTJg.exe
  C:\Windows\System\bNSuTJg.exe
  2⤵
  PID:8580
- C:\Windows\System\WlSNvCO.exe
  C:\Windows\System\WlSNvCO.exe
  2⤵
  PID:8596
- C:\Windows\System\jLHzfnX.exe
  C:\Windows\System\jLHzfnX.exe
  2⤵
  PID:8612
- C:\Windows\System\TIxRktm.exe
  C:\Windows\System\TIxRktm.exe
  2⤵
  PID:8628
- C:\Windows\System\iXnNJCZ.exe
  C:\Windows\System\iXnNJCZ.exe
  2⤵
  PID:8644
- C:\Windows\System\SIXcwnh.exe
  C:\Windows\System\SIXcwnh.exe
  2⤵
  PID:8660
- C:\Windows\System\GwMVqDF.exe
  C:\Windows\System\GwMVqDF.exe
  2⤵
  PID:8676
- C:\Windows\System\JagIIzc.exe
  C:\Windows\System\JagIIzc.exe
  2⤵
  PID:8692
- C:\Windows\System\VCRljTC.exe
  C:\Windows\System\VCRljTC.exe
  2⤵
  PID:8708
- C:\Windows\System\hgljNmE.exe
  C:\Windows\System\hgljNmE.exe
  2⤵
  PID:8724
- C:\Windows\System\hrqgXvy.exe
  C:\Windows\System\hrqgXvy.exe
  2⤵
  PID:8740
- C:\Windows\System\dJjfIJl.exe
  C:\Windows\System\dJjfIJl.exe
  2⤵
  PID:8756
- C:\Windows\System\pNclboR.exe
  C:\Windows\System\pNclboR.exe
  2⤵
  PID:8772
- C:\Windows\System\cKpkFSe.exe
  C:\Windows\System\cKpkFSe.exe
  2⤵
  PID:8788
- C:\Windows\System\lSMwmgG.exe
  C:\Windows\System\lSMwmgG.exe
  2⤵
  PID:8804
- C:\Windows\System\RPcukXi.exe
  C:\Windows\System\RPcukXi.exe
  2⤵
  PID:8820
- C:\Windows\System\kztBDxW.exe
  C:\Windows\System\kztBDxW.exe
  2⤵
  PID:8836
- C:\Windows\System\tpJcliU.exe
  C:\Windows\System\tpJcliU.exe
  2⤵
  PID:8852
- C:\Windows\System\ypUHyAK.exe
  C:\Windows\System\ypUHyAK.exe
  2⤵
  PID:8868
- C:\Windows\System\GJcRvsS.exe
  C:\Windows\System\GJcRvsS.exe
  2⤵
  PID:8884
- C:\Windows\System\vottLTL.exe
  C:\Windows\System\vottLTL.exe
  2⤵
  PID:8900
- C:\Windows\System\xhMxRMF.exe
  C:\Windows\System\xhMxRMF.exe
  2⤵
  PID:8916
- C:\Windows\System\jnZHUBo.exe
  C:\Windows\System\jnZHUBo.exe
  2⤵
  PID:8932
- C:\Windows\System\gutGUUU.exe
  C:\Windows\System\gutGUUU.exe
  2⤵
  PID:8948
- C:\Windows\System\xOhggXh.exe
  C:\Windows\System\xOhggXh.exe
  2⤵
  PID:8964
- C:\Windows\System\KNdEOUH.exe
  C:\Windows\System\KNdEOUH.exe
  2⤵
  PID:8980
- C:\Windows\System\DdFKdej.exe
  C:\Windows\System\DdFKdej.exe
  2⤵
  PID:8996
- C:\Windows\System\DzlzlIS.exe
  C:\Windows\System\DzlzlIS.exe
  2⤵
  PID:9012
- C:\Windows\System\zGBfmte.exe
  C:\Windows\System\zGBfmte.exe
  2⤵
  PID:9028
- C:\Windows\System\NwqdTLz.exe
  C:\Windows\System\NwqdTLz.exe
  2⤵
  PID:9044
- C:\Windows\System\DgBoVbF.exe
  C:\Windows\System\DgBoVbF.exe
  2⤵
  PID:9060
- C:\Windows\System\igJXvLx.exe
  C:\Windows\System\igJXvLx.exe
  2⤵
  PID:9076
- C:\Windows\System\EEbJfZN.exe
  C:\Windows\System\EEbJfZN.exe
  2⤵
  PID:9092
- C:\Windows\System\oiBHqIc.exe
  C:\Windows\System\oiBHqIc.exe
  2⤵
  PID:9108
- C:\Windows\System\bBnPKWF.exe
  C:\Windows\System\bBnPKWF.exe
  2⤵
  PID:9124
- C:\Windows\System\ujxqatI.exe
  C:\Windows\System\ujxqatI.exe
  2⤵
  PID:9140
- C:\Windows\System\xTCKAfz.exe
  C:\Windows\System\xTCKAfz.exe
  2⤵
  PID:9156
- C:\Windows\System\oDMysRu.exe
  C:\Windows\System\oDMysRu.exe
  2⤵
  PID:9172
- C:\Windows\System\YBUqRkD.exe
  C:\Windows\System\YBUqRkD.exe
  2⤵
  PID:9188
- C:\Windows\System\rDKioxR.exe
  C:\Windows\System\rDKioxR.exe
  2⤵
  PID:9204
- C:\Windows\System\TAdMtIa.exe
  C:\Windows\System\TAdMtIa.exe
  2⤵
  PID:6592
- C:\Windows\System\KuUEmYs.exe
  C:\Windows\System\KuUEmYs.exe
  2⤵
  PID:6464
- C:\Windows\System\ADpCyUX.exe
  C:\Windows\System\ADpCyUX.exe
  2⤵
  PID:8256
- C:\Windows\System\DVtunqo.exe
  C:\Windows\System\DVtunqo.exe
  2⤵
  PID:7592
- C:\Windows\System\jpBGykb.exe
  C:\Windows\System\jpBGykb.exe
  2⤵
  PID:8120
- C:\Windows\System\uIUGxAq.exe
  C:\Windows\System\uIUGxAq.exe
  2⤵
  PID:8348
- C:\Windows\System\RxrqNGC.exe
  C:\Windows\System\RxrqNGC.exe
  2⤵
  PID:7848
- C:\Windows\System\zJQBAXx.exe
  C:\Windows\System\zJQBAXx.exe
  2⤵
  PID:7256
- C:\Windows\System\fnuiNcw.exe
  C:\Windows\System\fnuiNcw.exe
  2⤵
  PID:8172
- C:\Windows\System\xGSrrxd.exe
  C:\Windows\System\xGSrrxd.exe
  2⤵
  PID:8268
- C:\Windows\System\kfIgvJx.exe
  C:\Windows\System\kfIgvJx.exe
  2⤵
  PID:8380
- C:\Windows\System\BgftoFM.exe
  C:\Windows\System\BgftoFM.exe
  2⤵
  PID:8332
- C:\Windows\System\IJuxYzU.exe
  C:\Windows\System\IJuxYzU.exe
  2⤵
  PID:8396
- C:\Windows\System\sYIkZAu.exe
  C:\Windows\System\sYIkZAu.exe
  2⤵
  PID:8460
- C:\Windows\System\sReIhSl.exe
  C:\Windows\System\sReIhSl.exe
  2⤵
  PID:8480
- C:\Windows\System\wSSntcx.exe
  C:\Windows\System\wSSntcx.exe
  2⤵
  PID:8512
- C:\Windows\System\DqudwDM.exe
  C:\Windows\System\DqudwDM.exe
  2⤵
  PID:8572
- C:\Windows\System\giEDXzc.exe
  C:\Windows\System\giEDXzc.exe
  2⤵
  PID:8636
- C:\Windows\System\SzUzuYu.exe
  C:\Windows\System\SzUzuYu.exe
  2⤵
  PID:8700
- C:\Windows\System\qSLIoWZ.exe
  C:\Windows\System\qSLIoWZ.exe
  2⤵
  PID:8764
- C:\Windows\System\HEOZyFC.exe
  C:\Windows\System\HEOZyFC.exe
  2⤵
  PID:8828
- C:\Windows\System\YMvtudG.exe
  C:\Windows\System\YMvtudG.exe
  2⤵
  PID:8864
- C:\Windows\System\UgLVUdF.exe
  C:\Windows\System\UgLVUdF.exe
  2⤵
  PID:8492
- C:\Windows\System\IdqVGVj.exe
  C:\Windows\System\IdqVGVj.exe
  2⤵
  PID:8992
- C:\Windows\System\BsScOQS.exe
  C:\Windows\System\BsScOQS.exe
  2⤵
  PID:9056
- C:\Windows\System\KZIDRLH.exe
  C:\Windows\System\KZIDRLH.exe
  2⤵
  PID:9088
- C:\Windows\System\IosKFiz.exe
  C:\Windows\System\IosKFiz.exe
  2⤵
  PID:9152
- C:\Windows\System\FrsmkWs.exe
  C:\Windows\System\FrsmkWs.exe
  2⤵
  PID:7676
- C:\Windows\System\kgDlNlG.exe
  C:\Windows\System\kgDlNlG.exe
  2⤵
  PID:8136
- C:\Windows\System\bWluXjS.exe
  C:\Windows\System\bWluXjS.exe
  2⤵
  PID:7156
- C:\Windows\System\AgoglVz.exe
  C:\Windows\System\AgoglVz.exe
  2⤵
  PID:8368
- C:\Windows\System\hKrgjnn.exe
  C:\Windows\System\hKrgjnn.exe
  2⤵
  PID:8544
- C:\Windows\System\QoVhnnG.exe
  C:\Windows\System\QoVhnnG.exe
  2⤵
  PID:8972
- C:\Windows\System\rRFTZLl.exe
  C:\Windows\System\rRFTZLl.exe
  2⤵
  PID:9052
- C:\Windows\System\PZdPPZx.exe
  C:\Windows\System\PZdPPZx.exe
  2⤵
  PID:8252
- C:\Windows\System\LVaGbdJ.exe
  C:\Windows\System\LVaGbdJ.exe
  2⤵
  PID:9220
- C:\Windows\System\HEjUjrQ.exe
  C:\Windows\System\HEjUjrQ.exe
  2⤵
  PID:9236
- C:\Windows\System\hZlrfmL.exe
  C:\Windows\System\hZlrfmL.exe
  2⤵
  PID:9252
- C:\Windows\System\UfmMdRt.exe
  C:\Windows\System\UfmMdRt.exe
  2⤵
  PID:9268
- C:\Windows\System\yqTIrcO.exe
  C:\Windows\System\yqTIrcO.exe
  2⤵
  PID:9284
- C:\Windows\System\cryhywD.exe
  C:\Windows\System\cryhywD.exe
  2⤵
  PID:9300
- C:\Windows\System\IhETusp.exe
  C:\Windows\System\IhETusp.exe
  2⤵
  PID:9316
- C:\Windows\System\qwTinqW.exe
  C:\Windows\System\qwTinqW.exe
  2⤵
  PID:9332
- C:\Windows\System\CGjSTDW.exe
  C:\Windows\System\CGjSTDW.exe
  2⤵
  PID:9348
- C:\Windows\System\XBzStuz.exe
  C:\Windows\System\XBzStuz.exe
  2⤵
  PID:9364
- C:\Windows\System\PuFQbLL.exe
  C:\Windows\System\PuFQbLL.exe
  2⤵
  PID:9380
- C:\Windows\System\wPibcjC.exe
  C:\Windows\System\wPibcjC.exe
  2⤵
  PID:9396
- C:\Windows\System\uHgPrdp.exe
  C:\Windows\System\uHgPrdp.exe
  2⤵
  PID:9412
- C:\Windows\System\txKeTXL.exe
  C:\Windows\System\txKeTXL.exe
  2⤵
  PID:9428
- C:\Windows\System\XFnFMtA.exe
  C:\Windows\System\XFnFMtA.exe
  2⤵
  PID:9444
- C:\Windows\System\iiaxYjL.exe
  C:\Windows\System\iiaxYjL.exe
  2⤵
  PID:9460
- C:\Windows\System\cCijOwV.exe
  C:\Windows\System\cCijOwV.exe
  2⤵
  PID:9476
- C:\Windows\System\vUnOWnw.exe
  C:\Windows\System\vUnOWnw.exe
  2⤵
  PID:9492
- C:\Windows\System\xyoEGlI.exe
  C:\Windows\System\xyoEGlI.exe
  2⤵
  PID:9508
- C:\Windows\System\KxFuzdv.exe
  C:\Windows\System\KxFuzdv.exe
  2⤵
  PID:9524
- C:\Windows\System\BkQfHGQ.exe
  C:\Windows\System\BkQfHGQ.exe
  2⤵
  PID:9540
- C:\Windows\System\QzmGudj.exe
  C:\Windows\System\QzmGudj.exe
  2⤵
  PID:9556
- C:\Windows\System\hRxOgNo.exe
  C:\Windows\System\hRxOgNo.exe
  2⤵
  PID:9572
- C:\Windows\System\MASLGIc.exe
  C:\Windows\System\MASLGIc.exe
  2⤵
  PID:9588
- C:\Windows\System\KhmVpuZ.exe
  C:\Windows\System\KhmVpuZ.exe
  2⤵
  PID:9604
- C:\Windows\System\bhzCskx.exe
  C:\Windows\System\bhzCskx.exe
  2⤵
  PID:9620
- C:\Windows\System\AxKkvRA.exe
  C:\Windows\System\AxKkvRA.exe
  2⤵
  PID:9636
- C:\Windows\System\ZTMFIAK.exe
  C:\Windows\System\ZTMFIAK.exe
  2⤵
  PID:9652
- C:\Windows\System\wJafxsX.exe
  C:\Windows\System\wJafxsX.exe
  2⤵
  PID:9668
- C:\Windows\System\uhfNWnM.exe
  C:\Windows\System\uhfNWnM.exe
  2⤵
  PID:9684
- C:\Windows\System\bURrjnz.exe
  C:\Windows\System\bURrjnz.exe
  2⤵
  PID:9700
- C:\Windows\System\OaCXKAi.exe
  C:\Windows\System\OaCXKAi.exe
  2⤵
  PID:9716
- C:\Windows\System\AvUZbIM.exe
  C:\Windows\System\AvUZbIM.exe
  2⤵
  PID:9732
- C:\Windows\System\ffqfsnO.exe
  C:\Windows\System\ffqfsnO.exe
  2⤵
  PID:9752
- C:\Windows\System\ryOFlfS.exe
  C:\Windows\System\ryOFlfS.exe
  2⤵
  PID:9768
- C:\Windows\System\OFbErQD.exe
  C:\Windows\System\OFbErQD.exe
  2⤵
  PID:9784
- C:\Windows\System\iUytSiN.exe
  C:\Windows\System\iUytSiN.exe
  2⤵
  PID:9804
- C:\Windows\System\RbitgJF.exe
  C:\Windows\System\RbitgJF.exe
  2⤵
  PID:9820
- C:\Windows\System\GdEReXR.exe
  C:\Windows\System\GdEReXR.exe
  2⤵
  PID:9836
- C:\Windows\System\wNEjRiH.exe
  C:\Windows\System\wNEjRiH.exe
  2⤵
  PID:9852
- C:\Windows\System\mpgEPKz.exe
  C:\Windows\System\mpgEPKz.exe
  2⤵
  PID:9868
- C:\Windows\System\csYuKwZ.exe
  C:\Windows\System\csYuKwZ.exe
  2⤵
  PID:9884
- C:\Windows\System\UCISjtc.exe
  C:\Windows\System\UCISjtc.exe
  2⤵
  PID:9900
- C:\Windows\System\gqrgyeQ.exe
  C:\Windows\System\gqrgyeQ.exe
  2⤵
  PID:9916
- C:\Windows\System\aIeulgw.exe
  C:\Windows\System\aIeulgw.exe
  2⤵
  PID:9932
- C:\Windows\System\XjwExTE.exe
  C:\Windows\System\XjwExTE.exe
  2⤵
  PID:9948
- C:\Windows\System\zwOPNSq.exe
  C:\Windows\System\zwOPNSq.exe
  2⤵
  PID:9964
- C:\Windows\System\olcptbm.exe
  C:\Windows\System\olcptbm.exe
  2⤵
  PID:9980
- C:\Windows\System\uXXMVQt.exe
  C:\Windows\System\uXXMVQt.exe
  2⤵
  PID:9996
- C:\Windows\System\QmnSZbv.exe
  C:\Windows\System\QmnSZbv.exe
  2⤵
  PID:10012
- C:\Windows\System\pFOkLrp.exe
  C:\Windows\System\pFOkLrp.exe
  2⤵
  PID:10028
- C:\Windows\System\ZUlVRjf.exe
  C:\Windows\System\ZUlVRjf.exe
  2⤵
  PID:10044
- C:\Windows\System\yFggBym.exe
  C:\Windows\System\yFggBym.exe
  2⤵
  PID:10060
- C:\Windows\System\vbAcEAN.exe
  C:\Windows\System\vbAcEAN.exe
  2⤵
  PID:10076
- C:\Windows\System\onBQpZi.exe
  C:\Windows\System\onBQpZi.exe
  2⤵
  PID:10092
- C:\Windows\System\JKrfzHn.exe
  C:\Windows\System\JKrfzHn.exe
  2⤵
  PID:10108
- C:\Windows\System\zFvvZQv.exe
  C:\Windows\System\zFvvZQv.exe
  2⤵
  PID:10124
- C:\Windows\System\dMMBGQp.exe
  C:\Windows\System\dMMBGQp.exe
  2⤵
  PID:10140
- C:\Windows\System\aQNrOxL.exe
  C:\Windows\System\aQNrOxL.exe
  2⤵
  PID:10156
- C:\Windows\System\hfEXRTM.exe
  C:\Windows\System\hfEXRTM.exe
  2⤵
  PID:10172
- C:\Windows\System\HDQKtGH.exe
  C:\Windows\System\HDQKtGH.exe
  2⤵
  PID:10188
- C:\Windows\System\rvQPhhW.exe
  C:\Windows\System\rvQPhhW.exe
  2⤵
  PID:10204
- C:\Windows\System\ftKaycx.exe
  C:\Windows\System\ftKaycx.exe
  2⤵
  PID:10220
- C:\Windows\System\bYNDfJg.exe
  C:\Windows\System\bYNDfJg.exe
  2⤵
  PID:10236
- C:\Windows\System\QzCUbeG.exe
  C:\Windows\System\QzCUbeG.exe
  2⤵
  PID:8796
- C:\Windows\System\ZGRvgna.exe
  C:\Windows\System\ZGRvgna.exe
  2⤵
  PID:9232
- C:\Windows\System\CeEMggt.exe
  C:\Windows\System\CeEMggt.exe
  2⤵
  PID:8560
- C:\Windows\System\vOIZpuJ.exe
  C:\Windows\System\vOIZpuJ.exe
  2⤵
  PID:8592
- C:\Windows\System\ACwPVEG.exe
  C:\Windows\System\ACwPVEG.exe
  2⤵
  PID:8624
- C:\Windows\System\EAJPtXx.exe
  C:\Windows\System\EAJPtXx.exe
  2⤵
  PID:8656
- C:\Windows\System\jMQPEnZ.exe
  C:\Windows\System\jMQPEnZ.exe
  2⤵
  PID:8720
- C:\Windows\System\jUXuiyi.exe
  C:\Windows\System\jUXuiyi.exe
  2⤵
  PID:9164
- C:\Windows\System\lymypQE.exe
  C:\Windows\System\lymypQE.exe
  2⤵
  PID:8288
- C:\Windows\System\rFxnrGB.exe
  C:\Windows\System\rFxnrGB.exe
  2⤵
  PID:8880
- C:\Windows\System\JLwgsdG.exe
  C:\Windows\System\JLwgsdG.exe
  2⤵
  PID:8912
- C:\Windows\System\UhfzxWu.exe
  C:\Windows\System\UhfzxWu.exe
  2⤵
  PID:8960
- C:\Windows\System\ZcdSZMX.exe
  C:\Windows\System\ZcdSZMX.exe
  2⤵
  PID:9040
- C:\Windows\System\KYwKijG.exe
  C:\Windows\System\KYwKijG.exe
  2⤵
  PID:9136
- C:\Windows\System\OFBJSfL.exe
  C:\Windows\System\OFBJSfL.exe
  2⤵
  PID:7588
- C:\Windows\System\nAFOqPf.exe
  C:\Windows\System\nAFOqPf.exe
  2⤵
  PID:8240
- C:\Windows\System\QQjivVy.exe
  C:\Windows\System\QQjivVy.exe
  2⤵
  PID:8508
- C:\Windows\System\axikTKc.exe
  C:\Windows\System\axikTKc.exe
  2⤵
  PID:8928
- C:\Windows\System\KkpYJuR.exe
  C:\Windows\System\KkpYJuR.exe
  2⤵
  PID:7364
- C:\Windows\System\kplEesU.exe
  C:\Windows\System\kplEesU.exe
  2⤵
  PID:9024
- C:\Windows\System\elChiwP.exe
  C:\Windows\System\elChiwP.exe
  2⤵
  PID:9248
- C:\Windows\System\FuMprrq.exe
  C:\Windows\System\FuMprrq.exe
  2⤵
  PID:9312
- C:\Windows\System\ZCstKvh.exe
  C:\Windows\System\ZCstKvh.exe
  2⤵
  PID:9376
- C:\Windows\System\WsqNtJe.exe
  C:\Windows\System\WsqNtJe.exe
  2⤵
  PID:9408
- C:\Windows\System\oOLbpjf.exe
  C:\Windows\System\oOLbpjf.exe
  2⤵
  PID:9440
- C:\Windows\System\rfUuedF.exe
  C:\Windows\System\rfUuedF.exe
  2⤵
  PID:9488
- C:\Windows\System\NbJLhhN.exe
  C:\Windows\System\NbJLhhN.exe
  2⤵
  PID:9520
- C:\Windows\System\KjIMZJQ.exe
  C:\Windows\System\KjIMZJQ.exe
  2⤵
  PID:9584
- C:\Windows\System\yEhGxmU.exe
  C:\Windows\System\yEhGxmU.exe
  2⤵
  PID:9596
- C:\Windows\System\LXSgmhr.exe
  C:\Windows\System\LXSgmhr.exe
  2⤵
  PID:9568
- C:\Windows\System\jhpWgrH.exe
  C:\Windows\System\jhpWgrH.exe
  2⤵
  PID:9648
- C:\Windows\System\coefFNG.exe
  C:\Windows\System\coefFNG.exe
  2⤵
  PID:9708
- C:\Windows\System\hbUTsTz.exe
  C:\Windows\System\hbUTsTz.exe
  2⤵
  PID:9748
- C:\Windows\System\udmLAHm.exe
  C:\Windows\System\udmLAHm.exe
  2⤵
  PID:9816
- C:\Windows\System\WIqXjIF.exe
  C:\Windows\System\WIqXjIF.exe
  2⤵
  PID:9908
- C:\Windows\System\WgPetlS.exe
  C:\Windows\System\WgPetlS.exe
  2⤵
  PID:9972
- C:\Windows\System\nEOfEHp.exe
  C:\Windows\System\nEOfEHp.exe
  2⤵
  PID:10036
- C:\Windows\System\ZUgCGFL.exe
  C:\Windows\System\ZUgCGFL.exe
  2⤵
  PID:8800
- C:\Windows\System\qXRxTOg.exe
  C:\Windows\System\qXRxTOg.exe
  2⤵
  PID:9728
- C:\Windows\System\hTJpSJi.exe
  C:\Windows\System\hTJpSJi.exe
  2⤵
  PID:10168
- C:\Windows\System\fQxqoCk.exe
  C:\Windows\System\fQxqoCk.exe
  2⤵
  PID:9896
- C:\Windows\System\rhaHlSk.exe
  C:\Windows\System\rhaHlSk.exe
  2⤵
  PID:9928
- C:\Windows\System\xLmaEYD.exe
  C:\Windows\System\xLmaEYD.exe
  2⤵
  PID:9992
- C:\Windows\System\YiwsjHZ.exe
  C:\Windows\System\YiwsjHZ.exe
  2⤵
  PID:10116
- C:\Windows\System\WMIilqs.exe
  C:\Windows\System\WMIilqs.exe
  2⤵
  PID:10148
- C:\Windows\System\NlfUFyE.exe
  C:\Windows\System\NlfUFyE.exe
  2⤵
  PID:9828
- C:\Windows\System\SAwDYau.exe
  C:\Windows\System\SAwDYau.exe
  2⤵
  PID:8672
- C:\Windows\System\PDylXcS.exe
  C:\Windows\System\PDylXcS.exe
  2⤵
  PID:8876
- C:\Windows\System\VTYPIfX.exe
  C:\Windows\System\VTYPIfX.exe
  2⤵
  PID:10184
- C:\Windows\System\tCgScKC.exe
  C:\Windows\System\tCgScKC.exe
  2⤵
  PID:9264
- C:\Windows\System\OtIpYzd.exe
  C:\Windows\System\OtIpYzd.exe
  2⤵
  PID:8716
- C:\Windows\System\tIPxiGX.exe
  C:\Windows\System\tIPxiGX.exe
  2⤵
  PID:8860
- C:\Windows\System\NqwJQIx.exe
  C:\Windows\System\NqwJQIx.exe
  2⤵
  PID:8320
- C:\Windows\System\aDhVJIz.exe
  C:\Windows\System\aDhVJIz.exe
  2⤵
  PID:8496
- C:\Windows\System\erDRDjn.exe
  C:\Windows\System\erDRDjn.exe
  2⤵
  PID:9004
- C:\Windows\System\wsZBkbM.exe
  C:\Windows\System\wsZBkbM.exe
  2⤵
  PID:8432
- C:\Windows\System\jRaPQBh.exe
  C:\Windows\System\jRaPQBh.exe
  2⤵
  PID:9308
- C:\Windows\System\hqBpckB.exe
  C:\Windows\System\hqBpckB.exe
  2⤵
  PID:9392
- C:\Windows\System\ZbENfxN.exe
  C:\Windows\System\ZbENfxN.exe
  2⤵
  PID:9372
- C:\Windows\System\FtsRaSb.exe
  C:\Windows\System\FtsRaSb.exe
  2⤵
  PID:9424
- C:\Windows\System\xcsBDfq.exe
  C:\Windows\System\xcsBDfq.exe
  2⤵
  PID:9536
- C:\Windows\System\IXZLPfK.exe
  C:\Windows\System\IXZLPfK.exe
  2⤵
  PID:9616
- C:\Windows\System\fLbpZGC.exe
  C:\Windows\System\fLbpZGC.exe
  2⤵
  PID:9680
- C:\Windows\System\Mvwltwz.exe
  C:\Windows\System\Mvwltwz.exe
  2⤵
  PID:9740
- C:\Windows\System\YBeeBDW.exe
  C:\Windows\System\YBeeBDW.exe
  2⤵
  PID:9880
- C:\Windows\System\KTktGzK.exe
  C:\Windows\System\KTktGzK.exe
  2⤵
  PID:10068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\IZlRcKf.exe

Filesize
1.4MB

MD5
1cbce70508cdb95cc3595d77b63cf9ba

SHA1
b6fa47f0f33a54620e50987c6a78e7658e199067

SHA256
f646f535c025b3b0dd9d48b29bffe4a633b34f54b25c972f2535d30cbbf56eeb

SHA512
12d47b93b47c15d0aea84330eedeeb323762dc937e08b5226c3911deb713234575d3a9143e11233bb593a667ddd3bb69e9fd04c664ebaecc07c463255b66faea

Download Submit
C:\Windows\system\IctICkM.exe

Filesize
1.4MB

MD5
9a56494e266f17dde4cf5ea8dbc67c15

SHA1
8f4543c088fd38ac696c1b4fe7e504ec34675950

SHA256
e2ea11873729d44b872b148c553e84e6ed9841c568eba8dfc81daf2b1b0ae4c7

SHA512
9ca9ed0e4aad9034d24006feb3defd7da42bda4f91c8d0c17676da535c38ca64b39bd201f1f29b45d78be3275ab2e21ba1870480531d844198cf42f87dd11d9e

Download Submit
C:\Windows\system\IyVhyRM.exe

Filesize
1.4MB

MD5
a5e959ed8567be00e4c9480e499a8961

SHA1
d1ca6ef58cfc1316d98c1602015e12f1d47e2886

SHA256
19ac97452ea70f2233ba2af84b9fc1ea37f16996af87f8cb34760851b382910f

SHA512
cd33809a50561dc5c971b827303a18d3643a05e2b54842bb3686f0ee42eda971dc5532a4e7910b8fcbdc093a413894f914afb2e0aad58c1a6f0487c1b3945678

Download Submit
C:\Windows\system\JLQNbHV.exe

Filesize
1.4MB

MD5
595756a1b9a61a0586b10b0bb4e3decf

SHA1
629d52d876359cd302d259702d5200368b02c4f0

SHA256
c3ca73ad2871821924e2bf17b12f6cb85e5a56fd31ecdc8025a6213631f6b7c8

SHA512
09e830c2fc0af80f4934877fdb5aeb846bc30c01342da410b1d2f6d700f09bef8293093ab92dea61360407ee5f34bd3854c6cb45b879d587c959e370a9173dad

Download Submit
C:\Windows\system\NLsJeZh.exe

Filesize
1.4MB

MD5
e6305a03c0e4ece258491d60ec2cfec0

SHA1
950d0f2519dc388e03b1295a03276e5cd2cf496a

SHA256
759011d181edc500121cdbc4bd569cf689320e51d951109580cb63ed1f13aae6

SHA512
ed88a4515efa59321b562892154e403758041c9fbd255bb9a7f732afa97406a8ec49eb1155ff94162ed8efa18174960e0dde76448adfa07882012d3cb0cba3c5

Download Submit
C:\Windows\system\PwYGpZy.exe

Filesize
1.4MB

MD5
fc1b83a73d4c91bcf562b6dc6127d786

SHA1
20a236aae6e4220a43dd22003a279d701c25ca0d

SHA256
e89442126f5feee8812e3fcd8fcb656c2bf7eac49a07718c6c4b8aea8d0de30e

SHA512
29e8096caa5b64915e96202eeea5c716869ba8e1bd708cd099cf85021beffa8289b0b00b109c4fbab1cd3da8fbe276525cc97db9448a5248f837d94123965f41

Download Submit
C:\Windows\system\QTKcduu.exe

Filesize
1.4MB

MD5
700dbe6f8b9c92d182884b869eaf98f6

SHA1
d5b3b408adc7626b85e4a60ef558cdf76275b4eb

SHA256
28d8838d3ebe26c54fdc131c707bca367139e9bf1e7e8198785baa2ea9b3b0e0

SHA512
39d9b7acfec793526711aafd5c7e365073a8ad2fc3497e7d3ea0c9fa0d88cd4b2279c591ea3b6ecd4de2741cf9a1bfebcb4fb1025fc84c8c83b2700f4e5a7f16

Download Submit
C:\Windows\system\QctCnkU.exe

Filesize
1.4MB

MD5
a07cebbd9b74ef828cf80ec2a17d169c

SHA1
3984593dbe3b270d7bf40b0f9f1d99d245c591fb

SHA256
b246fd943e6db214141d4b78417756f0288aba027825987de9db264fa38010d3

SHA512
9ef1725949703c71380705aa4464fed1690574494b7add5a6adf46fc8c1474013f408f641278b8c588e4bdbc86024a5f65aa54be614ebc5c4370c8d0cd7ca19e

Download Submit
C:\Windows\system\QqhpOqX.exe

Filesize
1.4MB

MD5
577a6a0f5a4b77de4314eed02a75e75c

SHA1
133f499fb97780469b8c5e1a42ded9e09b90a815

SHA256
c4f095ee127bac4de2265ddc25605c3b41dedffd31ab44d02c6f9de001a6a15a

SHA512
b8cc8f4cada63bae146eeb6d1a45b11b267d929dabb020d752c8ed4d42b672258b5654ce6bc3a6fb68c5114b2e63788795538d0f6aa8b50644e76928c85e13c3

Download Submit
C:\Windows\system\UVlXleu.exe

Filesize
1.4MB

MD5
c16c1a46ee0e42827d5dd8bfc1c7df67

SHA1
4438ed4c670b117dcc2c529dfe3b4eaf8b860948

SHA256
d3e1d08def13fe75549e1c90b3c1d9bbf5a2c914bf560c4025c9bebfb1d26f7f

SHA512
aa8975958d990dc4bf7577cb9643edf865916b3364df09040d74cd47e585f9d55ee01ae0c42e202e5b070122c59245c8efac83da56d5e92d5c5fd3e53f09aa5a

Download Submit
C:\Windows\system\UogSKhv.exe

Filesize
1.4MB

MD5
58a3794a4aaf17e2500d2f0cc16e51db

SHA1
8fe1fa1792d18a713062aa61ac14200be40a99ae

SHA256
a9f99c5146fbe1e73767f99a429c9cd995186ecceb3e0d6342cb4450651d3fc3

SHA512
14305636be8ef67ed4c987a17843dcf2d691da71e5b83fbb2324226811a219e7e962e921838aba0590d4af42291b20bdeaa9abe69f3881b3f02c59f53437bd64

Download Submit
C:\Windows\system\UrTzlZH.exe

Filesize
1.4MB

MD5
bdf107f0713e2503343edb71f1f3d90e

SHA1
04be3eae1d50dc1b9e159066ea0a218fb1e27d67

SHA256
13c8a1a13ef45a9ea7c224190146e01fef630746e42098bf8cc9e1a29b02609d

SHA512
98a646122c4d996e7e32d2995844844e218922bf43f8eb7b3c60a8db78b9cf401ee0f2cf23a41f9426aa9abc472122bdff99af2553368fd12277831a9c2928c9

Download Submit
C:\Windows\system\VIuMtwl.exe

Filesize
1.4MB

MD5
11621325d1df19e460fe81901c4da68c

SHA1
814583fcc4372f546606781170c2552175c13eab

SHA256
d8208702d611adf70769b3b15ef350c77f50af4995f3ea07b2f59ce6d5709a7d

SHA512
ba1ba6dca30d8f23301285fd4c735ea8a79d06e1f3df5286da599efcf9dda5a1ef0472a6907487c12ff4dbfd88257f4b26cccc4125037f8f1a57dae9f090c869

Download Submit
C:\Windows\system\ZUiMAvE.exe

Filesize
1.4MB

MD5
70d4bac459ef09145aece5dc235956a3

SHA1
30e23e7b29c42020ae53971eb6d46764e156f3f9

SHA256
c3f37432a6c90f2e21374648b6ba4a24ecb56579301fc7a01aaf78a5a3317748

SHA512
9102328af42093ed7d2ad26b39ac489881f58f6e5d75f79f11fc5fa32413f793e1ae2ef7c40b4086d255beb771d2a9cff73852b5197820f768b175abafeaa94e

Download Submit
C:\Windows\system\clrtUKe.exe

Filesize
1.4MB

MD5
a47f1b5529965beab3303ad46dd96a9e

SHA1
b4e7ec8a05012e3975ff3dbbfc3840a2a1b56eb7

SHA256
daee9bbd012c2b0a836641fdafaa28f53d817cec4eb9b66c8d8ec9b541bd8d0f

SHA512
248143dd81dc5a364fcb034499524a9730001147c5480fe793c6c46ebdaf83c53bccfc26518f1d297e971d070213812f6c70e7b502d4fddf03b8cb2d7d8ced04

Download Submit
C:\Windows\system\dDRPOaI.exe

Filesize
1.4MB

MD5
9f9e45278b61f8b57d13da0f49481fe0

SHA1
7d64d0be53b56ccf157f2e91424b5d9ac22f4f51

SHA256
58243803175116ce64611156872f2672662a5e4a58fc5d7ee15d37a3de21c524

SHA512
a5e772eec7af893f992a22e43df895a0af88eb3796f356608410ad1a1a891cdae3e56ecb07412d36666705c14e518c782ae3e6e570b98b1afe92c4d4429c87ca

Download Submit
C:\Windows\system\fcWRbtZ.exe

Filesize
1.4MB

MD5
aba2cf18d00e9cf5c9c71460c087d0cf

SHA1
8080e6bca9eeaa33f268ff1ad8e15225a33c35f8

SHA256
cbecb14d263869303bc913ee90c40a2eb70311dfe264455d8a446f561c56f11d

SHA512
8211cf9a615734d069d218deedacb6c04c82df4787c0f6f404454330cb1bc88077328b78247e81a190d4294dbc1853a569615e9c60e18861e7cc46ee9b9d2d8f

Download Submit
C:\Windows\system\fjKKCyd.exe

Filesize
1.4MB

MD5
9543f5adbe53f8cb00944fa9f5845bab

SHA1
3596a88517324ffec6323f94a65434606abe8282

SHA256
692f47f94e4b291985a70dd7664bb185881f176cccdb4dfd93c23af350078fbf

SHA512
f2a3315c70ea2f59812ec3102ce9a27c8f67012a706f89c4ed2f6f49cbc0f18f8f5d01d4254ccf0ba261f9275468dac43662f9578d8790ebb873e2e9732db8e0

Download Submit
C:\Windows\system\hJIiWOs.exe

Filesize
1.4MB

MD5
ad7efa9211a31c0128b77a73a2b293f4

SHA1
7789d7bae3dd30ea5fb2f86b6766e568f2ef38dd

SHA256
f3ac6f3f8d77b0ca7fd73b3b3431878cb508eb09c9b33c2c77afc201f69a0028

SHA512
8d7c1b7ee48013c794b0ef586e4e9a4fa36d652a091785dff2eb6399536bd1e500a5811c2455e686ed80a1826d868272fff6e1c7c24914c94f22aff274877f27

Download Submit
C:\Windows\system\kWNJOyS.exe

Filesize
1.4MB

MD5
bb9b11b4999c10e9cee038e1d18c098e

SHA1
bb26116c1238914ae567e0d27e6eb78c27dc9d2d

SHA256
e946ec9e938fa0f58859c26175a8aab774114c9f9734eb7143452869fc43b688

SHA512
025e9fa4ccf742753f2bf54d2bbb1b73c442d1d09280b466ecdb2c9a73c352d042c0f3a82ade288e1f9b04d76da14feecf0cd5c87f922929e4af63ab7bb29fb0

Download Submit
C:\Windows\system\laDKZDJ.exe

Filesize
1.4MB

MD5
3f622c45d39e60f4e417e85f02d23914

SHA1
ae55aab97ea7ba4c004de8f1daeb113e7419cca4

SHA256
151b78cf2970d24ad93b59fa2a44852a44d967c00d6120a47cac64e9d987cd45

SHA512
31f420f45c253fc1fbd7805dabf0cf5c856833cfa0fba9ea08907d2c80155869be5bd9dfc326f9aad734e8379fe7b5cc83a17767e94eb5ca1d8b0451d0aa5637

Download Submit
C:\Windows\system\lfnPses.exe

Filesize
1.4MB

MD5
8162a12fb55ea61772718f623ca785c6

SHA1
1f943282ec3a7560f4e12a6301dda6d40be675b7

SHA256
dbd52bd3584d112d04fc47ad09e4edd196fff4c5ce2b1fc8fc8f717556c7e6cd

SHA512
e7d389d1d9ddf084391c7b350cd1f0ddd3c0630db74b74b2df31d6132307f9e04f4957544edb4ab509288b8b159ce33e9eabbb712fea3df3b7548d1b9c5ffac7

Download Submit
C:\Windows\system\pkBuXjZ.exe

Filesize
1.4MB

MD5
e7c1caf3a75540a6fb7b2ec3663c7ce8

SHA1
545276ee8feeb3226cbc23b0b60d49ceba19f6fb

SHA256
e72d257320280d8de9fdd1a254c671fd16668fc84e5453ca28c7e46fcab59529

SHA512
793cb69095d6f2928dc0d7a2669c5afeed37c9e7fd4e8abab5ca7dcdd2b9c79fd139d980b2417443eb693a1407f1f0cb559e56533344a88532cc87a86cb0a4df

Download Submit
C:\Windows\system\szUzWZt.exe

Filesize
1.4MB

MD5
a120094713c1339967a13c85d1eb00a8

SHA1
6cc180369288e31a6c335510188e4e80bdb9bba6

SHA256
0e73962c1acc47b48116ce49154e0ba63c85d23679b11a2d6b50a69a796b48d8

SHA512
cc794ea4122fbf5158395b5a750d25bf93793cd66c889a57b9fb304a85fbb133fa300784b155859c8dec7dbbbe6d8e1f59489ac3793750284db5568cdde9d78c

Download Submit
C:\Windows\system\tkZrqcs.exe

Filesize
1.4MB

MD5
f8fdddebaab8023a72bb035ee75e568a

SHA1
78cae40ebb1546bccc6d88b0ffecb1ad739b27ce

SHA256
94997c2df454ddfc65de57f8df8473567663ccfa88a4149d54c247c244dbbdf4

SHA512
80b344e1ae6eff6ff3df94b6a07d780a3cf722af25b03eb52193a28f20c0441fda22fafbcdd4d47983e2fe276d431ed4763ab5a8e091c1b799917f4155b56bcd

Download Submit
C:\Windows\system\txFuMEl.exe

Filesize
1.4MB

MD5
c238d99d8cc5022cda0fac8f513c7ae5

SHA1
43ccfe33042402551b26c2dbf5faf841bb291d21

SHA256
44031cdb033800dae2ed076074435c308b04003d19c0f6da49b5f1a022cb38f0

SHA512
97a69d3dc5e68fb79f214cfd15cc46c728182b1c9531d4d2f33448c22d7ebf3aa799c3c213eb6f2f48f250cea7a7a45aacadfcc2d2dcb248c8d4baf6135b7016

Download Submit
C:\Windows\system\xTHpWuQ.exe

Filesize
1.4MB

MD5
c04ea10820e797e1d5618cdf47b08a19

SHA1
dee0d3d99371aee7aa3bbb8b62a60105f09f25dd

SHA256
4b86b0bce9c8677bbf662d9646d2ff94b7046799f979aca55257245deaf0ec1e

SHA512
b9f0a7ba91c279cde9a10a78db5d6215ca4b514560e49e94f18cb91845e7ec865d67f59353a8f4fd1c22fc390e678961d1a7ebfad08d276389448001b03aaa25

Download Submit
\Windows\system\RBtZcTg.exe

Filesize
1.4MB

MD5
46970bc7140bbcd6fe0e0fe287d0d952

SHA1
60d6c5ae95d2e4d45ab1fff630a20c7d688f8db9

SHA256
a1bba9c245b1b90df157354b9fa840d3a1ac94a5fdeb35a8308daaa8ea1905a3

SHA512
2603485dc20e7335b6398cfe45ae39c857f8e17682982c9a1ded3c25e0fe85ef0960db60393c974749713e63ca6790ca997ce5b5df81dd4192618d945055e90f

Download Submit
\Windows\system\ceVMebt.exe

Filesize
1.4MB

MD5
cef9d53ea42481fb94267d459d805e34

SHA1
62bc1031b1c055fdbeda6e413fb4c9c7b9295844

SHA256
4ba4711948028d52700d73ce19c14f8e07cb2095279f7c7f3b421bd2a3358106

SHA512
65851de7be129e2059df4c7eccbf1db4448cd4414e8cd68b4178ba2fd38bb8732417b22fd6176b12062268f658f245ed8861b90b7099e47cec129ff43c268bd9

Download Submit
\Windows\system\pcBJUMh.exe

Filesize
1.4MB

MD5
41cd875bafb29d5cb8f164c937d07970

SHA1
a8b53ac8884f904f0ad0466b75be2c54f8eed367

SHA256
4cce985cc0ec2326786edf874a0f5eab4b1ec6413486a27009f0e3e6d0ffface

SHA512
12ea17f7c0ac322bf54a9c29448f6cc41cf2b096d256a732dca7a898d7819beb643936e61cd6cfc0af1efc4f5760da0a064c37aa9ab7e52920213f82c019aba6

Download Submit
\Windows\system\sbhzNmJ.exe

Filesize
1.4MB

MD5
e2cf3df3ac1d36d8e5846d036474a0d4

SHA1
bd1b5afe91c22afa6afd5a49c8c9c3c5f239a321

SHA256
aa59dd27cc53a86ce32e853e28e1a8f85ae89cc229b919cc2f07c04f684c896e

SHA512
cb2c42730898a66a0f342d454303d113e06a53964528c3b5b2fa78706f762d824127d4f398236f725645f6d862592be6e79d61e599097a981a1f3c616990704e

Download Submit
\Windows\system\zijAlru.exe

Filesize
1.4MB

MD5
cbd1ddca38e54f5316b18d20547caeb1

SHA1
f98372546eaf801fbfc6edcd1154909f58774fc5

SHA256
4db19f5fe2a6a28adf4a6e58c2c9601844c8423a5f7c6b1a837af2f6acc13332

SHA512
b49343d42852139df6540add73cc378045bfe1a63d43c65166f57a943502d429926aa6ddcd6afc2f2f0356c659dbe2b0c2970ae3bdb5e0c48919408dbb1ceb04

Download Submit
memory/2224-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download