xmrig | 8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
Size

1.4MB
MD5

b30f520b9d42a7686f5e5fb831f92fff
SHA1

f0b5cd1213bcc88c27f2273eb815ac40c69f8a92
SHA256

8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb
SHA512

f495b8ef45c4a3a746e4ef79f79a9ff1784065bed354a8347f03439b92871f7da4bf623297aa26db8211235a9e7191c339ffcb49f6de97abfc5b156ea02439c8
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcw:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5u

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012263-2.dat	xmrig
behavioral1/files/0x00080000000186bb-7.dat	xmrig
behavioral1/files/0x00080000000186c3-9.dat	xmrig
behavioral1/files/0x0008000000018b05-15.dat	xmrig
behavioral1/files/0x0007000000018b50-23.dat	xmrig
behavioral1/files/0x0007000000018b54-27.dat	xmrig
behavioral1/files/0x0007000000018b59-34.dat	xmrig
behavioral1/files/0x000600000001948c-39.dat	xmrig
behavioral1/files/0x000500000001975a-44.dat	xmrig
behavioral1/files/0x00050000000197fd-52.dat	xmrig
behavioral1/files/0x0005000000019820-59.dat	xmrig
behavioral1/files/0x000500000001998d-64.dat	xmrig
behavioral1/files/0x0005000000019bf5-70.dat	xmrig
behavioral1/files/0x0005000000019bf6-74.dat	xmrig
behavioral1/files/0x0005000000019bf9-79.dat	xmrig
behavioral1/files/0x0005000000019d62-94.dat	xmrig
behavioral1/files/0x0005000000019fd4-109.dat	xmrig
behavioral1/files/0x0005000000019fdd-114.dat	xmrig
behavioral1/files/0x000500000001a400-159.dat	xmrig
behavioral1/files/0x000500000001a3fd-154.dat	xmrig
behavioral1/files/0x000500000001a3f8-149.dat	xmrig
behavioral1/files/0x000500000001a3f6-144.dat	xmrig
behavioral1/files/0x000500000001a309-134.dat	xmrig
behavioral1/files/0x000500000001a3ab-138.dat	xmrig
behavioral1/files/0x000500000001a049-125.dat	xmrig
behavioral1/files/0x000500000001a0b6-129.dat	xmrig
behavioral1/files/0x000500000001a03c-119.dat	xmrig
behavioral1/files/0x0005000000019e92-104.dat	xmrig
behavioral1/files/0x0005000000019d6d-99.dat	xmrig
behavioral1/files/0x0005000000019d61-90.dat	xmrig
behavioral1/files/0x0005000000019c3c-84.dat	xmrig
behavioral1/files/0x0005000000019761-49.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2784	WPDVEXL.exe
2860	CNGwhgd.exe
2912	ISiOmwK.exe
3052	siUnINZ.exe
2800	WlUgMRJ.exe
2892	ALwlFvz.exe
2704	HoblCgB.exe
2696	usXIyCF.exe
2588	AQTKjWB.exe
2728	xxEOSBb.exe
1548	EkCCRwh.exe
948	xgwkqlo.exe
2200	NbJttcV.exe
432	ctPEabI.exe
2608	VLKFsdY.exe
2388	bxCiDOK.exe
2396	jtcVyjn.exe
2952	OUODmBj.exe
2996	BLHBvHv.exe
2364	lCEFUJe.exe
2988	ODCGHjV.exe
1564	xbzmjrc.exe
2416	dqXyJyv.exe
1688	phKWGKk.exe
780	SlVpSZV.exe
596	erEPknh.exe
2380	oGCMyPG.exe
2484	lyNAQZr.exe
2440	OqAAuKZ.exe
1840	mnUVFGc.exe
1476	aKGNCgl.exe
2392	VbvcXNa.exe
1920	LuoCXxH.exe
2104	esgSghu.exe
1432	dNyOkzX.exe
960	fjdWGdv.exe
920	ztfNsGS.exe
1224	Vlzqwho.exe
2136	bFcvwYG.exe
1924	XCmlvJb.exe
1732	vNxUFqs.exe
1464	EIanwww.exe
1744	upVoakF.exe
1948	wiBHxLF.exe
1880	LkkLFoK.exe
1480	QNMZWgD.exe
1068	RQqdUNO.exe
1708	WGOfJyx.exe
620	bmMUCpv.exe
2128	TzoyNsx.exe
1668	kbAWlgB.exe
880	xutZces.exe
1776	JrjTVNQ.exe
1340	hwdwkqZ.exe
2292	OLlGYym.exe
1580	csdfzSK.exe
884	tzPWNEd.exe
1932	zUyulpa.exe
1508	HFhxrCY.exe
2576	HVbDdJE.exe
2820	dfoeqwq.exe
3064	MqMHwbw.exe
2964	lnFTfdr.exe
2916	OccxyKW.exe

Loads dropped DLL 64 IoCs

pid	Process
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\szjPNFx.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\KwdqZzM.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\jfCMMKE.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\eEoeGqa.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\sPHRPNw.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\aXBLUew.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\egGKfzG.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\MzTSEMQ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\BpfEvPq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\tJyTseb.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\gNFBCat.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\XHkzOZf.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\CxWvuif.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\yWIpaYh.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\FJkDInY.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\DNPrfLq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\GoOTuts.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\DdJewPo.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\MpwkwQh.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\jLZpVOV.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\OwdCvwl.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\iDXxUnA.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\bfeclSv.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\EpvlEle.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\onKOfnb.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\AwOHXPU.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\kRyWxZc.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\GsZkAbj.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\hhFyAnN.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\XAiveMb.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\fjbnnVw.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\mClPDWk.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\gvuzpMI.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\RyprzgX.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\WHxbTrF.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\JlCTQqT.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\OHkHZYi.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\tLhnzLc.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\PjDbYzB.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\Vlgahyg.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\bllZJcC.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\RFYIgLg.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\vyzaaiU.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\WbNCoTd.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\enxHOin.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\SgHczOJ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\KvZNJPR.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\eoFAoUd.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\uteCkVq.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\WPNsdYk.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\gkPWsLE.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\DAgBPcH.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\jJPgDwX.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\aKtPUHs.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\YavrJjS.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\TiGQatG.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\COEKoHQ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\UvlFjLt.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\ZvAqrEG.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\eTEVZnU.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\obIBzlJ.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\FEUhwCB.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\NiisTll.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
File created	C:\Windows\System\PRWfylP.exe	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2784	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	31
PID 3032 wrote to memory of 2784	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	31
PID 3032 wrote to memory of 2784	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	31
PID 3032 wrote to memory of 2860	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	32
PID 3032 wrote to memory of 2860	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	32
PID 3032 wrote to memory of 2860	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	32
PID 3032 wrote to memory of 2912	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	33
PID 3032 wrote to memory of 2912	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	33
PID 3032 wrote to memory of 2912	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	33
PID 3032 wrote to memory of 3052	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	34
PID 3032 wrote to memory of 3052	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	34
PID 3032 wrote to memory of 3052	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	34
PID 3032 wrote to memory of 2800	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	35
PID 3032 wrote to memory of 2800	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	35
PID 3032 wrote to memory of 2800	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	35
PID 3032 wrote to memory of 2892	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	36
PID 3032 wrote to memory of 2892	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	36
PID 3032 wrote to memory of 2892	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	36
PID 3032 wrote to memory of 2704	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	37
PID 3032 wrote to memory of 2704	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	37
PID 3032 wrote to memory of 2704	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	37
PID 3032 wrote to memory of 2696	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	38
PID 3032 wrote to memory of 2696	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	38
PID 3032 wrote to memory of 2696	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	38
PID 3032 wrote to memory of 2588	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	39
PID 3032 wrote to memory of 2588	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	39
PID 3032 wrote to memory of 2588	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	39
PID 3032 wrote to memory of 2728	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	40
PID 3032 wrote to memory of 2728	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	40
PID 3032 wrote to memory of 2728	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	40
PID 3032 wrote to memory of 1548	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	41
PID 3032 wrote to memory of 1548	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	41
PID 3032 wrote to memory of 1548	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	41
PID 3032 wrote to memory of 948	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	42
PID 3032 wrote to memory of 948	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	42
PID 3032 wrote to memory of 948	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	42
PID 3032 wrote to memory of 2200	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	43
PID 3032 wrote to memory of 2200	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	43
PID 3032 wrote to memory of 2200	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	43
PID 3032 wrote to memory of 432	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	44
PID 3032 wrote to memory of 432	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	44
PID 3032 wrote to memory of 432	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	44
PID 3032 wrote to memory of 2608	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	45
PID 3032 wrote to memory of 2608	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	45
PID 3032 wrote to memory of 2608	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	45
PID 3032 wrote to memory of 2388	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	46
PID 3032 wrote to memory of 2388	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	46
PID 3032 wrote to memory of 2388	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	46
PID 3032 wrote to memory of 2396	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	47
PID 3032 wrote to memory of 2396	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	47
PID 3032 wrote to memory of 2396	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	47
PID 3032 wrote to memory of 2952	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	48
PID 3032 wrote to memory of 2952	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	48
PID 3032 wrote to memory of 2952	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	48
PID 3032 wrote to memory of 2996	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	49
PID 3032 wrote to memory of 2996	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	49
PID 3032 wrote to memory of 2996	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	49
PID 3032 wrote to memory of 2364	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	50
PID 3032 wrote to memory of 2364	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	50
PID 3032 wrote to memory of 2364	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	50
PID 3032 wrote to memory of 2988	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	51
PID 3032 wrote to memory of 2988	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	51
PID 3032 wrote to memory of 2988	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	51
PID 3032 wrote to memory of 1564	3032	8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe	52

C:\Users\Admin\AppData\Local\Temp\8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe
"C:\Users\Admin\AppData\Local\Temp\8ddaa6046aa7d8c10f21ad615a944f3be51dbeff9e8f4b15884a2d21770a8fdb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System\WPDVEXL.exe
  C:\Windows\System\WPDVEXL.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\CNGwhgd.exe
  C:\Windows\System\CNGwhgd.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ISiOmwK.exe
  C:\Windows\System\ISiOmwK.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\siUnINZ.exe
  C:\Windows\System\siUnINZ.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WlUgMRJ.exe
  C:\Windows\System\WlUgMRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ALwlFvz.exe
  C:\Windows\System\ALwlFvz.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\HoblCgB.exe
  C:\Windows\System\HoblCgB.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\usXIyCF.exe
  C:\Windows\System\usXIyCF.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AQTKjWB.exe
  C:\Windows\System\AQTKjWB.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\xxEOSBb.exe
  C:\Windows\System\xxEOSBb.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\EkCCRwh.exe
  C:\Windows\System\EkCCRwh.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\xgwkqlo.exe
  C:\Windows\System\xgwkqlo.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\NbJttcV.exe
  C:\Windows\System\NbJttcV.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\ctPEabI.exe
  C:\Windows\System\ctPEabI.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\VLKFsdY.exe
  C:\Windows\System\VLKFsdY.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\bxCiDOK.exe
  C:\Windows\System\bxCiDOK.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\jtcVyjn.exe
  C:\Windows\System\jtcVyjn.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OUODmBj.exe
  C:\Windows\System\OUODmBj.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\BLHBvHv.exe
  C:\Windows\System\BLHBvHv.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\lCEFUJe.exe
  C:\Windows\System\lCEFUJe.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ODCGHjV.exe
  C:\Windows\System\ODCGHjV.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xbzmjrc.exe
  C:\Windows\System\xbzmjrc.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\dqXyJyv.exe
  C:\Windows\System\dqXyJyv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\phKWGKk.exe
  C:\Windows\System\phKWGKk.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\SlVpSZV.exe
  C:\Windows\System\SlVpSZV.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\erEPknh.exe
  C:\Windows\System\erEPknh.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\oGCMyPG.exe
  C:\Windows\System\oGCMyPG.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\lyNAQZr.exe
  C:\Windows\System\lyNAQZr.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OqAAuKZ.exe
  C:\Windows\System\OqAAuKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\mnUVFGc.exe
  C:\Windows\System\mnUVFGc.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\aKGNCgl.exe
  C:\Windows\System\aKGNCgl.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\VbvcXNa.exe
  C:\Windows\System\VbvcXNa.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\LuoCXxH.exe
  C:\Windows\System\LuoCXxH.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\esgSghu.exe
  C:\Windows\System\esgSghu.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\dNyOkzX.exe
  C:\Windows\System\dNyOkzX.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\fjdWGdv.exe
  C:\Windows\System\fjdWGdv.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ztfNsGS.exe
  C:\Windows\System\ztfNsGS.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\Vlzqwho.exe
  C:\Windows\System\Vlzqwho.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\bFcvwYG.exe
  C:\Windows\System\bFcvwYG.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\XCmlvJb.exe
  C:\Windows\System\XCmlvJb.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\vNxUFqs.exe
  C:\Windows\System\vNxUFqs.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\EIanwww.exe
  C:\Windows\System\EIanwww.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\upVoakF.exe
  C:\Windows\System\upVoakF.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\wiBHxLF.exe
  C:\Windows\System\wiBHxLF.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\LkkLFoK.exe
  C:\Windows\System\LkkLFoK.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\QNMZWgD.exe
  C:\Windows\System\QNMZWgD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\RQqdUNO.exe
  C:\Windows\System\RQqdUNO.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\WGOfJyx.exe
  C:\Windows\System\WGOfJyx.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\bmMUCpv.exe
  C:\Windows\System\bmMUCpv.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\TzoyNsx.exe
  C:\Windows\System\TzoyNsx.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\kbAWlgB.exe
  C:\Windows\System\kbAWlgB.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\xutZces.exe
  C:\Windows\System\xutZces.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\JrjTVNQ.exe
  C:\Windows\System\JrjTVNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\hwdwkqZ.exe
  C:\Windows\System\hwdwkqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\OLlGYym.exe
  C:\Windows\System\OLlGYym.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\csdfzSK.exe
  C:\Windows\System\csdfzSK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\tzPWNEd.exe
  C:\Windows\System\tzPWNEd.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\zUyulpa.exe
  C:\Windows\System\zUyulpa.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\HFhxrCY.exe
  C:\Windows\System\HFhxrCY.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\HVbDdJE.exe
  C:\Windows\System\HVbDdJE.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\dfoeqwq.exe
  C:\Windows\System\dfoeqwq.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\MqMHwbw.exe
  C:\Windows\System\MqMHwbw.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\lnFTfdr.exe
  C:\Windows\System\lnFTfdr.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\OccxyKW.exe
  C:\Windows\System\OccxyKW.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\sLReyQA.exe
  C:\Windows\System\sLReyQA.exe
  2⤵
  PID:2848
- C:\Windows\System\edzOgWd.exe
  C:\Windows\System\edzOgWd.exe
  2⤵
  PID:2752
- C:\Windows\System\lIabxSm.exe
  C:\Windows\System\lIabxSm.exe
  2⤵
  PID:1456
- C:\Windows\System\tqSnLXC.exe
  C:\Windows\System\tqSnLXC.exe
  2⤵
  PID:2660
- C:\Windows\System\mibaQGU.exe
  C:\Windows\System\mibaQGU.exe
  2⤵
  PID:2876
- C:\Windows\System\ZSiOHZe.exe
  C:\Windows\System\ZSiOHZe.exe
  2⤵
  PID:1500
- C:\Windows\System\ZwfPCXi.exe
  C:\Windows\System\ZwfPCXi.exe
  2⤵
  PID:3016
- C:\Windows\System\SMxGWtx.exe
  C:\Windows\System\SMxGWtx.exe
  2⤵
  PID:2808
- C:\Windows\System\yutdgFh.exe
  C:\Windows\System\yutdgFh.exe
  2⤵
  PID:2828
- C:\Windows\System\IoypTfr.exe
  C:\Windows\System\IoypTfr.exe
  2⤵
  PID:2716
- C:\Windows\System\KdjDLCm.exe
  C:\Windows\System\KdjDLCm.exe
  2⤵
  PID:1300
- C:\Windows\System\FWOgSMK.exe
  C:\Windows\System\FWOgSMK.exe
  2⤵
  PID:2192
- C:\Windows\System\NaEWSct.exe
  C:\Windows\System\NaEWSct.exe
  2⤵
  PID:1028
- C:\Windows\System\govCubm.exe
  C:\Windows\System\govCubm.exe
  2⤵
  PID:2488
- C:\Windows\System\SSnfOFH.exe
  C:\Windows\System\SSnfOFH.exe
  2⤵
  PID:2600
- C:\Windows\System\qlvfMPO.exe
  C:\Windows\System\qlvfMPO.exe
  2⤵
  PID:1956
- C:\Windows\System\cIHXwee.exe
  C:\Windows\System\cIHXwee.exe
  2⤵
  PID:2512
- C:\Windows\System\ruRMKsa.exe
  C:\Windows\System\ruRMKsa.exe
  2⤵
  PID:1576
- C:\Windows\System\UhPKOsr.exe
  C:\Windows\System\UhPKOsr.exe
  2⤵
  PID:632
- C:\Windows\System\dnRiiHa.exe
  C:\Windows\System\dnRiiHa.exe
  2⤵
  PID:988
- C:\Windows\System\lJjRLoO.exe
  C:\Windows\System\lJjRLoO.exe
  2⤵
  PID:2056
- C:\Windows\System\dBmHSEB.exe
  C:\Windows\System\dBmHSEB.exe
  2⤵
  PID:1676
- C:\Windows\System\MuRxrUG.exe
  C:\Windows\System\MuRxrUG.exe
  2⤵
  PID:2740
- C:\Windows\System\qrZOTtq.exe
  C:\Windows\System\qrZOTtq.exe
  2⤵
  PID:1292
- C:\Windows\System\KDtNQLE.exe
  C:\Windows\System\KDtNQLE.exe
  2⤵
  PID:1872
- C:\Windows\System\nhwNKKw.exe
  C:\Windows\System\nhwNKKw.exe
  2⤵
  PID:2508
- C:\Windows\System\zpGFKiv.exe
  C:\Windows\System\zpGFKiv.exe
  2⤵
  PID:904
- C:\Windows\System\eYaCWQz.exe
  C:\Windows\System\eYaCWQz.exe
  2⤵
  PID:1308
- C:\Windows\System\mfOPZvD.exe
  C:\Windows\System\mfOPZvD.exe
  2⤵
  PID:2236
- C:\Windows\System\waDsGlt.exe
  C:\Windows\System\waDsGlt.exe
  2⤵
  PID:2772
- C:\Windows\System\XJMzUel.exe
  C:\Windows\System\XJMzUel.exe
  2⤵
  PID:2140
- C:\Windows\System\zUxmwRL.exe
  C:\Windows\System\zUxmwRL.exe
  2⤵
  PID:2568
- C:\Windows\System\jjDNMIe.exe
  C:\Windows\System\jjDNMIe.exe
  2⤵
  PID:1568
- C:\Windows\System\ROwfEGx.exe
  C:\Windows\System\ROwfEGx.exe
  2⤵
  PID:2008
- C:\Windows\System\VhzyzMW.exe
  C:\Windows\System\VhzyzMW.exe
  2⤵
  PID:2132
- C:\Windows\System\igfLYBu.exe
  C:\Windows\System\igfLYBu.exe
  2⤵
  PID:1988
- C:\Windows\System\wOXcHEm.exe
  C:\Windows\System\wOXcHEm.exe
  2⤵
  PID:2472
- C:\Windows\System\spqdRhN.exe
  C:\Windows\System\spqdRhN.exe
  2⤵
  PID:1076
- C:\Windows\System\dEitKbK.exe
  C:\Windows\System\dEitKbK.exe
  2⤵
  PID:2868
- C:\Windows\System\egGKfzG.exe
  C:\Windows\System\egGKfzG.exe
  2⤵
  PID:2896
- C:\Windows\System\qKCvfig.exe
  C:\Windows\System\qKCvfig.exe
  2⤵
  PID:2228
- C:\Windows\System\VKjmDjU.exe
  C:\Windows\System\VKjmDjU.exe
  2⤵
  PID:2692
- C:\Windows\System\EFuCjuT.exe
  C:\Windows\System\EFuCjuT.exe
  2⤵
  PID:2656
- C:\Windows\System\giCzKay.exe
  C:\Windows\System\giCzKay.exe
  2⤵
  PID:2940
- C:\Windows\System\uUhbPzB.exe
  C:\Windows\System\uUhbPzB.exe
  2⤵
  PID:2356
- C:\Windows\System\AfkTPMg.exe
  C:\Windows\System\AfkTPMg.exe
  2⤵
  PID:3048
- C:\Windows\System\YpfFNHe.exe
  C:\Windows\System\YpfFNHe.exe
  2⤵
  PID:3004
- C:\Windows\System\CWbEooe.exe
  C:\Windows\System\CWbEooe.exe
  2⤵
  PID:588
- C:\Windows\System\jPprUuI.exe
  C:\Windows\System\jPprUuI.exe
  2⤵
  PID:2972
- C:\Windows\System\nfZlOZq.exe
  C:\Windows\System\nfZlOZq.exe
  2⤵
  PID:2432
- C:\Windows\System\bDNegYg.exe
  C:\Windows\System\bDNegYg.exe
  2⤵
  PID:524
- C:\Windows\System\eVPgVKT.exe
  C:\Windows\System\eVPgVKT.exe
  2⤵
  PID:2980
- C:\Windows\System\GBcfrbK.exe
  C:\Windows\System\GBcfrbK.exe
  2⤵
  PID:2208
- C:\Windows\System\PvhXiYU.exe
  C:\Windows\System\PvhXiYU.exe
  2⤵
  PID:1680
- C:\Windows\System\NiisTll.exe
  C:\Windows\System\NiisTll.exe
  2⤵
  PID:976
- C:\Windows\System\PEjeUgA.exe
  C:\Windows\System\PEjeUgA.exe
  2⤵
  PID:2244
- C:\Windows\System\tMiatqI.exe
  C:\Windows\System\tMiatqI.exe
  2⤵
  PID:1428
- C:\Windows\System\ZVKxOSi.exe
  C:\Windows\System\ZVKxOSi.exe
  2⤵
  PID:332
- C:\Windows\System\XcdjSXt.exe
  C:\Windows\System\XcdjSXt.exe
  2⤵
  PID:2024
- C:\Windows\System\wWiggkR.exe
  C:\Windows\System\wWiggkR.exe
  2⤵
  PID:2116
- C:\Windows\System\wVTIKDv.exe
  C:\Windows\System\wVTIKDv.exe
  2⤵
  PID:2632
- C:\Windows\System\qIiWTet.exe
  C:\Windows\System\qIiWTet.exe
  2⤵
  PID:1700
- C:\Windows\System\seAKFRV.exe
  C:\Windows\System\seAKFRV.exe
  2⤵
  PID:592
- C:\Windows\System\OFOjKbF.exe
  C:\Windows\System\OFOjKbF.exe
  2⤵
  PID:2052
- C:\Windows\System\OBlnqZQ.exe
  C:\Windows\System\OBlnqZQ.exe
  2⤵
  PID:2280
- C:\Windows\System\kZlFcWK.exe
  C:\Windows\System\kZlFcWK.exe
  2⤵
  PID:2004
- C:\Windows\System\QjexmyL.exe
  C:\Windows\System\QjexmyL.exe
  2⤵
  PID:1408
- C:\Windows\System\nJpVZMa.exe
  C:\Windows\System\nJpVZMa.exe
  2⤵
  PID:1440
- C:\Windows\System\kzeBUFF.exe
  C:\Windows\System\kzeBUFF.exe
  2⤵
  PID:2604
- C:\Windows\System\mqKzTnZ.exe
  C:\Windows\System\mqKzTnZ.exe
  2⤵
  PID:2560
- C:\Windows\System\rCQINHS.exe
  C:\Windows\System\rCQINHS.exe
  2⤵
  PID:2804
- C:\Windows\System\gMedeyX.exe
  C:\Windows\System\gMedeyX.exe
  2⤵
  PID:1528
- C:\Windows\System\NSYkbRy.exe
  C:\Windows\System\NSYkbRy.exe
  2⤵
  PID:2188
- C:\Windows\System\yXXxwjw.exe
  C:\Windows\System\yXXxwjw.exe
  2⤵
  PID:2924
- C:\Windows\System\KukWumJ.exe
  C:\Windows\System\KukWumJ.exe
  2⤵
  PID:2736
- C:\Windows\System\plawBUD.exe
  C:\Windows\System\plawBUD.exe
  2⤵
  PID:2344
- C:\Windows\System\bcHZMym.exe
  C:\Windows\System\bcHZMym.exe
  2⤵
  PID:2992
- C:\Windows\System\VBRHArg.exe
  C:\Windows\System\VBRHArg.exe
  2⤵
  PID:1784
- C:\Windows\System\zsuTiRs.exe
  C:\Windows\System\zsuTiRs.exe
  2⤵
  PID:2404
- C:\Windows\System\fZsIRJw.exe
  C:\Windows\System\fZsIRJw.exe
  2⤵
  PID:2220
- C:\Windows\System\OmlPBld.exe
  C:\Windows\System\OmlPBld.exe
  2⤵
  PID:1400
- C:\Windows\System\uYVZroV.exe
  C:\Windows\System\uYVZroV.exe
  2⤵
  PID:2836
- C:\Windows\System\bEuQJKB.exe
  C:\Windows\System\bEuQJKB.exe
  2⤵
  PID:2368
- C:\Windows\System\JbrCywC.exe
  C:\Windows\System\JbrCywC.exe
  2⤵
  PID:2812
- C:\Windows\System\cvnqkGw.exe
  C:\Windows\System\cvnqkGw.exe
  2⤵
  PID:888
- C:\Windows\System\TxnPnwi.exe
  C:\Windows\System\TxnPnwi.exe
  2⤵
  PID:304
- C:\Windows\System\LxIDEHl.exe
  C:\Windows\System\LxIDEHl.exe
  2⤵
  PID:2112
- C:\Windows\System\RtBHZrD.exe
  C:\Windows\System\RtBHZrD.exe
  2⤵
  PID:896
- C:\Windows\System\yLboUZE.exe
  C:\Windows\System\yLboUZE.exe
  2⤵
  PID:2908
- C:\Windows\System\yWIpaYh.exe
  C:\Windows\System\yWIpaYh.exe
  2⤵
  PID:1600
- C:\Windows\System\gdlPjzB.exe
  C:\Windows\System\gdlPjzB.exe
  2⤵
  PID:1652
- C:\Windows\System\TDcieTE.exe
  C:\Windows\System\TDcieTE.exe
  2⤵
  PID:1120
- C:\Windows\System\BPLQYxr.exe
  C:\Windows\System\BPLQYxr.exe
  2⤵
  PID:2264
- C:\Windows\System\eQopvEl.exe
  C:\Windows\System\eQopvEl.exe
  2⤵
  PID:1844
- C:\Windows\System\cOMPJQN.exe
  C:\Windows\System\cOMPJQN.exe
  2⤵
  PID:688
- C:\Windows\System\sVDUKga.exe
  C:\Windows\System\sVDUKga.exe
  2⤵
  PID:2520
- C:\Windows\System\PinMPiA.exe
  C:\Windows\System\PinMPiA.exe
  2⤵
  PID:1020
- C:\Windows\System\jtXxoFZ.exe
  C:\Windows\System\jtXxoFZ.exe
  2⤵
  PID:2164
- C:\Windows\System\bRteQgu.exe
  C:\Windows\System\bRteQgu.exe
  2⤵
  PID:1692
- C:\Windows\System\CwXrups.exe
  C:\Windows\System\CwXrups.exe
  2⤵
  PID:1128
- C:\Windows\System\QXBzBtA.exe
  C:\Windows\System\QXBzBtA.exe
  2⤵
  PID:2884
- C:\Windows\System\bTindVW.exe
  C:\Windows\System\bTindVW.exe
  2⤵
  PID:2540
- C:\Windows\System\klOqbGm.exe
  C:\Windows\System\klOqbGm.exe
  2⤵
  PID:2324
- C:\Windows\System\kWJLcnj.exe
  C:\Windows\System\kWJLcnj.exe
  2⤵
  PID:2376
- C:\Windows\System\hxcRftV.exe
  C:\Windows\System\hxcRftV.exe
  2⤵
  PID:2712
- C:\Windows\System\wdILGUT.exe
  C:\Windows\System\wdILGUT.exe
  2⤵
  PID:1748
- C:\Windows\System\KWWVAnj.exe
  C:\Windows\System\KWWVAnj.exe
  2⤵
  PID:2316
- C:\Windows\System\QJlKSTY.exe
  C:\Windows\System\QJlKSTY.exe
  2⤵
  PID:3000
- C:\Windows\System\LhyFGYV.exe
  C:\Windows\System\LhyFGYV.exe
  2⤵
  PID:1144
- C:\Windows\System\FbVHXwu.exe
  C:\Windows\System\FbVHXwu.exe
  2⤵
  PID:1944
- C:\Windows\System\HHPnFFW.exe
  C:\Windows\System\HHPnFFW.exe
  2⤵
  PID:1288
- C:\Windows\System\MzTSEMQ.exe
  C:\Windows\System\MzTSEMQ.exe
  2⤵
  PID:2580
- C:\Windows\System\zCXVkms.exe
  C:\Windows\System\zCXVkms.exe
  2⤵
  PID:1172
- C:\Windows\System\ajfpjNU.exe
  C:\Windows\System\ajfpjNU.exe
  2⤵
  PID:2464
- C:\Windows\System\EruTwiF.exe
  C:\Windows\System\EruTwiF.exe
  2⤵
  PID:2936
- C:\Windows\System\cWyGFmF.exe
  C:\Windows\System\cWyGFmF.exe
  2⤵
  PID:580
- C:\Windows\System\KPnUyLR.exe
  C:\Windows\System\KPnUyLR.exe
  2⤵
  PID:1280
- C:\Windows\System\rELJqWP.exe
  C:\Windows\System\rELJqWP.exe
  2⤵
  PID:1952
- C:\Windows\System\tfcilXc.exe
  C:\Windows\System\tfcilXc.exe
  2⤵
  PID:3084
- C:\Windows\System\GQIKWJj.exe
  C:\Windows\System\GQIKWJj.exe
  2⤵
  PID:3100
- C:\Windows\System\VfbNjVD.exe
  C:\Windows\System\VfbNjVD.exe
  2⤵
  PID:3124
- C:\Windows\System\xziFENs.exe
  C:\Windows\System\xziFENs.exe
  2⤵
  PID:3140
- C:\Windows\System\KIktNxU.exe
  C:\Windows\System\KIktNxU.exe
  2⤵
  PID:3164
- C:\Windows\System\agTMVrl.exe
  C:\Windows\System\agTMVrl.exe
  2⤵
  PID:3180
- C:\Windows\System\KYqgdkq.exe
  C:\Windows\System\KYqgdkq.exe
  2⤵
  PID:3200
- C:\Windows\System\EpRLFlR.exe
  C:\Windows\System\EpRLFlR.exe
  2⤵
  PID:3220
- C:\Windows\System\vkpAtdu.exe
  C:\Windows\System\vkpAtdu.exe
  2⤵
  PID:3244
- C:\Windows\System\QikyiTg.exe
  C:\Windows\System\QikyiTg.exe
  2⤵
  PID:3260
- C:\Windows\System\MOKLsVI.exe
  C:\Windows\System\MOKLsVI.exe
  2⤵
  PID:3284
- C:\Windows\System\lNKakMR.exe
  C:\Windows\System\lNKakMR.exe
  2⤵
  PID:3300
- C:\Windows\System\CtdROxW.exe
  C:\Windows\System\CtdROxW.exe
  2⤵
  PID:3324
- C:\Windows\System\BxJzyaW.exe
  C:\Windows\System\BxJzyaW.exe
  2⤵
  PID:3340
- C:\Windows\System\yQhKJPH.exe
  C:\Windows\System\yQhKJPH.exe
  2⤵
  PID:3360
- C:\Windows\System\PRnaSNf.exe
  C:\Windows\System\PRnaSNf.exe
  2⤵
  PID:3380
- C:\Windows\System\imbtvGW.exe
  C:\Windows\System\imbtvGW.exe
  2⤵
  PID:3404
- C:\Windows\System\NoPRoGf.exe
  C:\Windows\System\NoPRoGf.exe
  2⤵
  PID:3420
- C:\Windows\System\lrBJhwZ.exe
  C:\Windows\System\lrBJhwZ.exe
  2⤵
  PID:3440
- C:\Windows\System\qikPeyT.exe
  C:\Windows\System\qikPeyT.exe
  2⤵
  PID:3464
- C:\Windows\System\wCANZku.exe
  C:\Windows\System\wCANZku.exe
  2⤵
  PID:3484
- C:\Windows\System\SmgjexM.exe
  C:\Windows\System\SmgjexM.exe
  2⤵
  PID:3504
- C:\Windows\System\HjSBjhh.exe
  C:\Windows\System\HjSBjhh.exe
  2⤵
  PID:3520
- C:\Windows\System\aVBjljB.exe
  C:\Windows\System\aVBjljB.exe
  2⤵
  PID:3540
- C:\Windows\System\kjujFJi.exe
  C:\Windows\System\kjujFJi.exe
  2⤵
  PID:3564
- C:\Windows\System\KucaHKv.exe
  C:\Windows\System\KucaHKv.exe
  2⤵
  PID:3588
- C:\Windows\System\RGgHYLf.exe
  C:\Windows\System\RGgHYLf.exe
  2⤵
  PID:3608
- C:\Windows\System\seQotLP.exe
  C:\Windows\System\seQotLP.exe
  2⤵
  PID:3624
- C:\Windows\System\vqRENTY.exe
  C:\Windows\System\vqRENTY.exe
  2⤵
  PID:3644
- C:\Windows\System\hxTeNau.exe
  C:\Windows\System\hxTeNau.exe
  2⤵
  PID:3664
- C:\Windows\System\UpeQVDQ.exe
  C:\Windows\System\UpeQVDQ.exe
  2⤵
  PID:3680
- C:\Windows\System\UQCHvUj.exe
  C:\Windows\System\UQCHvUj.exe
  2⤵
  PID:3700
- C:\Windows\System\bpJMLNE.exe
  C:\Windows\System\bpJMLNE.exe
  2⤵
  PID:3716
- C:\Windows\System\vrICQrd.exe
  C:\Windows\System\vrICQrd.exe
  2⤵
  PID:3732
- C:\Windows\System\GBybssS.exe
  C:\Windows\System\GBybssS.exe
  2⤵
  PID:3752
- C:\Windows\System\EgQduQL.exe
  C:\Windows\System\EgQduQL.exe
  2⤵
  PID:3772
- C:\Windows\System\RhAWRbB.exe
  C:\Windows\System\RhAWRbB.exe
  2⤵
  PID:3788
- C:\Windows\System\Vlgahyg.exe
  C:\Windows\System\Vlgahyg.exe
  2⤵
  PID:3804
- C:\Windows\System\ScIvcJU.exe
  C:\Windows\System\ScIvcJU.exe
  2⤵
  PID:3824
- C:\Windows\System\gQayBPx.exe
  C:\Windows\System\gQayBPx.exe
  2⤵
  PID:3864
- C:\Windows\System\exuDEDE.exe
  C:\Windows\System\exuDEDE.exe
  2⤵
  PID:3884
- C:\Windows\System\fHIERgv.exe
  C:\Windows\System\fHIERgv.exe
  2⤵
  PID:3904
- C:\Windows\System\owyRFdK.exe
  C:\Windows\System\owyRFdK.exe
  2⤵
  PID:3920
- C:\Windows\System\bfeclSv.exe
  C:\Windows\System\bfeclSv.exe
  2⤵
  PID:3936
- C:\Windows\System\VmucBds.exe
  C:\Windows\System\VmucBds.exe
  2⤵
  PID:3964
- C:\Windows\System\HZwmVRO.exe
  C:\Windows\System\HZwmVRO.exe
  2⤵
  PID:3988
- C:\Windows\System\uVswZPX.exe
  C:\Windows\System\uVswZPX.exe
  2⤵
  PID:4004
- C:\Windows\System\TaAEfGa.exe
  C:\Windows\System\TaAEfGa.exe
  2⤵
  PID:4028
- C:\Windows\System\rUvdKeG.exe
  C:\Windows\System\rUvdKeG.exe
  2⤵
  PID:4048
- C:\Windows\System\xEcKKKG.exe
  C:\Windows\System\xEcKKKG.exe
  2⤵
  PID:4068
- C:\Windows\System\hGouaRk.exe
  C:\Windows\System\hGouaRk.exe
  2⤵
  PID:4092
- C:\Windows\System\dEhVurr.exe
  C:\Windows\System\dEhVurr.exe
  2⤵
  PID:3092
- C:\Windows\System\VvKOWSE.exe
  C:\Windows\System\VvKOWSE.exe
  2⤵
  PID:3112
- C:\Windows\System\FBGtILp.exe
  C:\Windows\System\FBGtILp.exe
  2⤵
  PID:3160
- C:\Windows\System\DNPHFjn.exe
  C:\Windows\System\DNPHFjn.exe
  2⤵
  PID:3192
- C:\Windows\System\HlPrxQr.exe
  C:\Windows\System\HlPrxQr.exe
  2⤵
  PID:3216
- C:\Windows\System\HwMsPAx.exe
  C:\Windows\System\HwMsPAx.exe
  2⤵
  PID:3256
- C:\Windows\System\RHvBoVo.exe
  C:\Windows\System\RHvBoVo.exe
  2⤵
  PID:3292
- C:\Windows\System\ovXKezs.exe
  C:\Windows\System\ovXKezs.exe
  2⤵
  PID:3320
- C:\Windows\System\DYDCNzF.exe
  C:\Windows\System\DYDCNzF.exe
  2⤵
  PID:3368
- C:\Windows\System\sUvNEKz.exe
  C:\Windows\System\sUvNEKz.exe
  2⤵
  PID:3392
- C:\Windows\System\LpDDfGS.exe
  C:\Windows\System\LpDDfGS.exe
  2⤵
  PID:3428
- C:\Windows\System\gdnqNoR.exe
  C:\Windows\System\gdnqNoR.exe
  2⤵
  PID:3448
- C:\Windows\System\TsbtZJt.exe
  C:\Windows\System\TsbtZJt.exe
  2⤵
  PID:3476
- C:\Windows\System\ljQCKqa.exe
  C:\Windows\System\ljQCKqa.exe
  2⤵
  PID:3516
- C:\Windows\System\XwdrpsI.exe
  C:\Windows\System\XwdrpsI.exe
  2⤵
  PID:3548
- C:\Windows\System\WFxrnnO.exe
  C:\Windows\System\WFxrnnO.exe
  2⤵
  PID:3584
- C:\Windows\System\dFWeaRr.exe
  C:\Windows\System\dFWeaRr.exe
  2⤵
  PID:3616
- C:\Windows\System\AgXBdml.exe
  C:\Windows\System\AgXBdml.exe
  2⤵
  PID:3652
- C:\Windows\System\MliLVrN.exe
  C:\Windows\System\MliLVrN.exe
  2⤵
  PID:3708
- C:\Windows\System\DLtZmoC.exe
  C:\Windows\System\DLtZmoC.exe
  2⤵
  PID:3784
- C:\Windows\System\fgGDVdd.exe
  C:\Windows\System\fgGDVdd.exe
  2⤵
  PID:3688
- C:\Windows\System\TMDZneo.exe
  C:\Windows\System\TMDZneo.exe
  2⤵
  PID:3764
- C:\Windows\System\tINamMV.exe
  C:\Windows\System\tINamMV.exe
  2⤵
  PID:3848
- C:\Windows\System\gMtyiiU.exe
  C:\Windows\System\gMtyiiU.exe
  2⤵
  PID:3856
- C:\Windows\System\hNHnVwW.exe
  C:\Windows\System\hNHnVwW.exe
  2⤵
  PID:3880
- C:\Windows\System\HMDFjKD.exe
  C:\Windows\System\HMDFjKD.exe
  2⤵
  PID:3928
- C:\Windows\System\sPwcFAK.exe
  C:\Windows\System\sPwcFAK.exe
  2⤵
  PID:3952
- C:\Windows\System\NdbvTiP.exe
  C:\Windows\System\NdbvTiP.exe
  2⤵
  PID:3976
- C:\Windows\System\hympUEB.exe
  C:\Windows\System\hympUEB.exe
  2⤵
  PID:4016
- C:\Windows\System\SgHczOJ.exe
  C:\Windows\System\SgHczOJ.exe
  2⤵
  PID:4056
- C:\Windows\System\ZoAKqnM.exe
  C:\Windows\System\ZoAKqnM.exe
  2⤵
  PID:4088
- C:\Windows\System\pPgyhAR.exe
  C:\Windows\System\pPgyhAR.exe
  2⤵
  PID:3120
- C:\Windows\System\ZtolkGE.exe
  C:\Windows\System\ZtolkGE.exe
  2⤵
  PID:3172
- C:\Windows\System\JbAylUw.exe
  C:\Windows\System\JbAylUw.exe
  2⤵
  PID:3228
- C:\Windows\System\LpfphVh.exe
  C:\Windows\System\LpfphVh.exe
  2⤵
  PID:3280
- C:\Windows\System\udBqvfK.exe
  C:\Windows\System\udBqvfK.exe
  2⤵
  PID:3332
- C:\Windows\System\waPGZTm.exe
  C:\Windows\System\waPGZTm.exe
  2⤵
  PID:3376
- C:\Windows\System\jFouOmj.exe
  C:\Windows\System\jFouOmj.exe
  2⤵
  PID:3456
- C:\Windows\System\RSYCyNX.exe
  C:\Windows\System\RSYCyNX.exe
  2⤵
  PID:3496
- C:\Windows\System\JgYyGSZ.exe
  C:\Windows\System\JgYyGSZ.exe
  2⤵
  PID:3572
- C:\Windows\System\gMSTnsC.exe
  C:\Windows\System\gMSTnsC.exe
  2⤵
  PID:3600
- C:\Windows\System\iRwlxjN.exe
  C:\Windows\System\iRwlxjN.exe
  2⤵
  PID:3728
- C:\Windows\System\iNhcvcy.exe
  C:\Windows\System\iNhcvcy.exe
  2⤵
  PID:3816
- C:\Windows\System\wAFjfKR.exe
  C:\Windows\System\wAFjfKR.exe
  2⤵
  PID:3852
- C:\Windows\System\vYmhtFX.exe
  C:\Windows\System\vYmhtFX.exe
  2⤵
  PID:3900
- C:\Windows\System\EMkQZwm.exe
  C:\Windows\System\EMkQZwm.exe
  2⤵
  PID:3872
- C:\Windows\System\PeXBfRJ.exe
  C:\Windows\System\PeXBfRJ.exe
  2⤵
  PID:4044
- C:\Windows\System\syLwmXZ.exe
  C:\Windows\System\syLwmXZ.exe
  2⤵
  PID:3096
- C:\Windows\System\MKjrqRD.exe
  C:\Windows\System\MKjrqRD.exe
  2⤵
  PID:4000
- C:\Windows\System\IBXCvJv.exe
  C:\Windows\System\IBXCvJv.exe
  2⤵
  PID:3188
- C:\Windows\System\PNKAulY.exe
  C:\Windows\System\PNKAulY.exe
  2⤵
  PID:3252
- C:\Windows\System\agQWRQj.exe
  C:\Windows\System\agQWRQj.exe
  2⤵
  PID:3412
- C:\Windows\System\gmWSbOd.exe
  C:\Windows\System\gmWSbOd.exe
  2⤵
  PID:3560
- C:\Windows\System\oWtueNc.exe
  C:\Windows\System\oWtueNc.exe
  2⤵
  PID:3596
- C:\Windows\System\NEpRYup.exe
  C:\Windows\System\NEpRYup.exe
  2⤵
  PID:3532
- C:\Windows\System\WzCiGsY.exe
  C:\Windows\System\WzCiGsY.exe
  2⤵
  PID:3500
- C:\Windows\System\WxYYSOT.exe
  C:\Windows\System\WxYYSOT.exe
  2⤵
  PID:3916
- C:\Windows\System\lbyLCZr.exe
  C:\Windows\System\lbyLCZr.exe
  2⤵
  PID:3844
- C:\Windows\System\UsXEgJP.exe
  C:\Windows\System\UsXEgJP.exe
  2⤵
  PID:3948
- C:\Windows\System\ziinRMc.exe
  C:\Windows\System\ziinRMc.exe
  2⤵
  PID:3232
- C:\Windows\System\DsAMEmG.exe
  C:\Windows\System\DsAMEmG.exe
  2⤵
  PID:3352
- C:\Windows\System\rRiQDWl.exe
  C:\Windows\System\rRiQDWl.exe
  2⤵
  PID:3212
- C:\Windows\System\QrfNoiS.exe
  C:\Windows\System\QrfNoiS.exe
  2⤵
  PID:3452
- C:\Windows\System\JFVuIRQ.exe
  C:\Windows\System\JFVuIRQ.exe
  2⤵
  PID:3892
- C:\Windows\System\ZTdojxI.exe
  C:\Windows\System\ZTdojxI.exe
  2⤵
  PID:3760
- C:\Windows\System\Asyzswf.exe
  C:\Windows\System\Asyzswf.exe
  2⤵
  PID:3812
- C:\Windows\System\HjcKdrl.exe
  C:\Windows\System\HjcKdrl.exe
  2⤵
  PID:3480
- C:\Windows\System\GGnrZkK.exe
  C:\Windows\System\GGnrZkK.exe
  2⤵
  PID:1884
- C:\Windows\System\xWbSGUX.exe
  C:\Windows\System\xWbSGUX.exe
  2⤵
  PID:3148
- C:\Windows\System\ASatzKI.exe
  C:\Windows\System\ASatzKI.exe
  2⤵
  PID:3980
- C:\Windows\System\dYbpixR.exe
  C:\Windows\System\dYbpixR.exe
  2⤵
  PID:3944
- C:\Windows\System\auoXjQE.exe
  C:\Windows\System\auoXjQE.exe
  2⤵
  PID:3536
- C:\Windows\System\PgsUYTL.exe
  C:\Windows\System\PgsUYTL.exe
  2⤵
  PID:4104
- C:\Windows\System\jVDElcn.exe
  C:\Windows\System\jVDElcn.exe
  2⤵
  PID:4124
- C:\Windows\System\PWFbliI.exe
  C:\Windows\System\PWFbliI.exe
  2⤵
  PID:4144
- C:\Windows\System\sgiKdlo.exe
  C:\Windows\System\sgiKdlo.exe
  2⤵
  PID:4164
- C:\Windows\System\kVYRbDT.exe
  C:\Windows\System\kVYRbDT.exe
  2⤵
  PID:4180
- C:\Windows\System\KcmedYN.exe
  C:\Windows\System\KcmedYN.exe
  2⤵
  PID:4200
- C:\Windows\System\bQdNFJq.exe
  C:\Windows\System\bQdNFJq.exe
  2⤵
  PID:4216
- C:\Windows\System\oMVkjWA.exe
  C:\Windows\System\oMVkjWA.exe
  2⤵
  PID:4244
- C:\Windows\System\GfBYpgo.exe
  C:\Windows\System\GfBYpgo.exe
  2⤵
  PID:4260
- C:\Windows\System\ggyBGUP.exe
  C:\Windows\System\ggyBGUP.exe
  2⤵
  PID:4276
- C:\Windows\System\PAeRwGk.exe
  C:\Windows\System\PAeRwGk.exe
  2⤵
  PID:4292
- C:\Windows\System\CxfSXlD.exe
  C:\Windows\System\CxfSXlD.exe
  2⤵
  PID:4308
- C:\Windows\System\uZtXbsJ.exe
  C:\Windows\System\uZtXbsJ.exe
  2⤵
  PID:4352
- C:\Windows\System\sWbRBOg.exe
  C:\Windows\System\sWbRBOg.exe
  2⤵
  PID:4376
- C:\Windows\System\wtFYMTQ.exe
  C:\Windows\System\wtFYMTQ.exe
  2⤵
  PID:4392
- C:\Windows\System\stiQtTw.exe
  C:\Windows\System\stiQtTw.exe
  2⤵
  PID:4408
- C:\Windows\System\nKXKrLI.exe
  C:\Windows\System\nKXKrLI.exe
  2⤵
  PID:4436
- C:\Windows\System\ajartgd.exe
  C:\Windows\System\ajartgd.exe
  2⤵
  PID:4452
- C:\Windows\System\UQDQjuV.exe
  C:\Windows\System\UQDQjuV.exe
  2⤵
  PID:4468
- C:\Windows\System\ILNCdoB.exe
  C:\Windows\System\ILNCdoB.exe
  2⤵
  PID:4492
- C:\Windows\System\klvfcaT.exe
  C:\Windows\System\klvfcaT.exe
  2⤵
  PID:4512
- C:\Windows\System\uwdSWqE.exe
  C:\Windows\System\uwdSWqE.exe
  2⤵
  PID:4528
- C:\Windows\System\QANsxjz.exe
  C:\Windows\System\QANsxjz.exe
  2⤵
  PID:4548
- C:\Windows\System\ylciUUU.exe
  C:\Windows\System\ylciUUU.exe
  2⤵
  PID:4568
- C:\Windows\System\GscNjQO.exe
  C:\Windows\System\GscNjQO.exe
  2⤵
  PID:4592
- C:\Windows\System\hoQAeOo.exe
  C:\Windows\System\hoQAeOo.exe
  2⤵
  PID:4624
- C:\Windows\System\hjMiQdm.exe
  C:\Windows\System\hjMiQdm.exe
  2⤵
  PID:4644
- C:\Windows\System\wEnkjDw.exe
  C:\Windows\System\wEnkjDw.exe
  2⤵
  PID:4660
- C:\Windows\System\XJuNkXy.exe
  C:\Windows\System\XJuNkXy.exe
  2⤵
  PID:4676
- C:\Windows\System\ysrlqig.exe
  C:\Windows\System\ysrlqig.exe
  2⤵
  PID:4696
- C:\Windows\System\KjEuqWq.exe
  C:\Windows\System\KjEuqWq.exe
  2⤵
  PID:4720
- C:\Windows\System\dwGEiNm.exe
  C:\Windows\System\dwGEiNm.exe
  2⤵
  PID:4744
- C:\Windows\System\fjEIWrb.exe
  C:\Windows\System\fjEIWrb.exe
  2⤵
  PID:4764
- C:\Windows\System\skuqukE.exe
  C:\Windows\System\skuqukE.exe
  2⤵
  PID:4780
- C:\Windows\System\EnIiwat.exe
  C:\Windows\System\EnIiwat.exe
  2⤵
  PID:4796
- C:\Windows\System\GmMDlbM.exe
  C:\Windows\System\GmMDlbM.exe
  2⤵
  PID:4820
- C:\Windows\System\SLsiiJK.exe
  C:\Windows\System\SLsiiJK.exe
  2⤵
  PID:4840
- C:\Windows\System\lBpPBrg.exe
  C:\Windows\System\lBpPBrg.exe
  2⤵
  PID:4864
- C:\Windows\System\yIBqPxi.exe
  C:\Windows\System\yIBqPxi.exe
  2⤵
  PID:4880
- C:\Windows\System\usSBmCb.exe
  C:\Windows\System\usSBmCb.exe
  2⤵
  PID:4900
- C:\Windows\System\PZSKfFZ.exe
  C:\Windows\System\PZSKfFZ.exe
  2⤵
  PID:4924
- C:\Windows\System\VlCDagu.exe
  C:\Windows\System\VlCDagu.exe
  2⤵
  PID:4940
- C:\Windows\System\HHxyGZD.exe
  C:\Windows\System\HHxyGZD.exe
  2⤵
  PID:4956
- C:\Windows\System\IlwmGsD.exe
  C:\Windows\System\IlwmGsD.exe
  2⤵
  PID:4976
- C:\Windows\System\zKTdzuM.exe
  C:\Windows\System\zKTdzuM.exe
  2⤵
  PID:5000
- C:\Windows\System\nFqkLou.exe
  C:\Windows\System\nFqkLou.exe
  2⤵
  PID:5016
- C:\Windows\System\hyiDrjQ.exe
  C:\Windows\System\hyiDrjQ.exe
  2⤵
  PID:5040
- C:\Windows\System\cZPGVPZ.exe
  C:\Windows\System\cZPGVPZ.exe
  2⤵
  PID:5072
- C:\Windows\System\AIKRsbg.exe
  C:\Windows\System\AIKRsbg.exe
  2⤵
  PID:5096
- C:\Windows\System\njyfJPk.exe
  C:\Windows\System\njyfJPk.exe
  2⤵
  PID:5116
- C:\Windows\System\OKguZZA.exe
  C:\Windows\System\OKguZZA.exe
  2⤵
  PID:4120
- C:\Windows\System\rEkeFSa.exe
  C:\Windows\System\rEkeFSa.exe
  2⤵
  PID:4192
- C:\Windows\System\MUSUcTB.exe
  C:\Windows\System\MUSUcTB.exe
  2⤵
  PID:4232
- C:\Windows\System\rcniPeo.exe
  C:\Windows\System\rcniPeo.exe
  2⤵
  PID:3836
- C:\Windows\System\dNJaLlb.exe
  C:\Windows\System\dNJaLlb.exe
  2⤵
  PID:4300
- C:\Windows\System\OKkGAFS.exe
  C:\Windows\System\OKkGAFS.exe
  2⤵
  PID:4212
- C:\Windows\System\IaJIYED.exe
  C:\Windows\System\IaJIYED.exe
  2⤵
  PID:4172
- C:\Windows\System\BldlvXA.exe
  C:\Windows\System\BldlvXA.exe
  2⤵
  PID:4364
- C:\Windows\System\VkjrpTO.exe
  C:\Windows\System\VkjrpTO.exe
  2⤵
  PID:4324
- C:\Windows\System\rvfjlrD.exe
  C:\Windows\System\rvfjlrD.exe
  2⤵
  PID:4400
- C:\Windows\System\MMdgWdg.exe
  C:\Windows\System\MMdgWdg.exe
  2⤵
  PID:4416
- C:\Windows\System\ZXDtHZn.exe
  C:\Windows\System\ZXDtHZn.exe
  2⤵
  PID:4428
- C:\Windows\System\HYLGPwc.exe
  C:\Windows\System\HYLGPwc.exe
  2⤵
  PID:4464
- C:\Windows\System\dfXCLJX.exe
  C:\Windows\System\dfXCLJX.exe
  2⤵
  PID:4536
- C:\Windows\System\ZRwQLdy.exe
  C:\Windows\System\ZRwQLdy.exe
  2⤵
  PID:4504
- C:\Windows\System\UCEEGpg.exe
  C:\Windows\System\UCEEGpg.exe
  2⤵
  PID:4608
- C:\Windows\System\vtRmYGd.exe
  C:\Windows\System\vtRmYGd.exe
  2⤵
  PID:4580
- C:\Windows\System\omoOWjs.exe
  C:\Windows\System\omoOWjs.exe
  2⤵
  PID:4652
- C:\Windows\System\xxzovKs.exe
  C:\Windows\System\xxzovKs.exe
  2⤵
  PID:4668
- C:\Windows\System\gQVdTze.exe
  C:\Windows\System\gQVdTze.exe
  2⤵
  PID:4736
- C:\Windows\System\NlhUpUb.exe
  C:\Windows\System\NlhUpUb.exe
  2⤵
  PID:4756
- C:\Windows\System\OeCkEte.exe
  C:\Windows\System\OeCkEte.exe
  2⤵
  PID:4776
- C:\Windows\System\byvDRVH.exe
  C:\Windows\System\byvDRVH.exe
  2⤵
  PID:4812
- C:\Windows\System\boYzXdr.exe
  C:\Windows\System\boYzXdr.exe
  2⤵
  PID:4852
- C:\Windows\System\qVpnBpj.exe
  C:\Windows\System\qVpnBpj.exe
  2⤵
  PID:4872
- C:\Windows\System\YklZUJD.exe
  C:\Windows\System\YklZUJD.exe
  2⤵
  PID:4964
- C:\Windows\System\KwdqZzM.exe
  C:\Windows\System\KwdqZzM.exe
  2⤵
  PID:5012
- C:\Windows\System\KvZNJPR.exe
  C:\Windows\System\KvZNJPR.exe
  2⤵
  PID:4988
- C:\Windows\System\mPaKeJR.exe
  C:\Windows\System\mPaKeJR.exe
  2⤵
  PID:4912
- C:\Windows\System\UHNqAED.exe
  C:\Windows\System\UHNqAED.exe
  2⤵
  PID:5036
- C:\Windows\System\wKbtxvs.exe
  C:\Windows\System\wKbtxvs.exe
  2⤵
  PID:5092
- C:\Windows\System\UNIdgxZ.exe
  C:\Windows\System\UNIdgxZ.exe
  2⤵
  PID:3316
- C:\Windows\System\crxTfhE.exe
  C:\Windows\System\crxTfhE.exe
  2⤵
  PID:4208
- C:\Windows\System\ttXKwXk.exe
  C:\Windows\System\ttXKwXk.exe
  2⤵
  PID:4304
- C:\Windows\System\omJPrdM.exe
  C:\Windows\System\omJPrdM.exe
  2⤵
  PID:4224
- C:\Windows\System\KmtMDSH.exe
  C:\Windows\System\KmtMDSH.exe
  2⤵
  PID:4256
- C:\Windows\System\tdtwgAf.exe
  C:\Windows\System\tdtwgAf.exe
  2⤵
  PID:4448
- C:\Windows\System\neithrL.exe
  C:\Windows\System\neithrL.exe
  2⤵
  PID:4344
- C:\Windows\System\KbwlfBW.exe
  C:\Windows\System\KbwlfBW.exe
  2⤵
  PID:4640
- C:\Windows\System\wdzboGh.exe
  C:\Windows\System\wdzboGh.exe
  2⤵
  PID:4564
- C:\Windows\System\kTqmNaS.exe
  C:\Windows\System\kTqmNaS.exe
  2⤵
  PID:4500
- C:\Windows\System\hnFHYeE.exe
  C:\Windows\System\hnFHYeE.exe
  2⤵
  PID:4576
- C:\Windows\System\ejiOpQL.exe
  C:\Windows\System\ejiOpQL.exe
  2⤵
  PID:4460
- C:\Windows\System\lioWVbY.exe
  C:\Windows\System\lioWVbY.exe
  2⤵
  PID:4616
- C:\Windows\System\dAXsWJi.exe
  C:\Windows\System\dAXsWJi.exe
  2⤵
  PID:4836
- C:\Windows\System\uuGJlln.exe
  C:\Windows\System\uuGJlln.exe
  2⤵
  PID:4752
- C:\Windows\System\dxyaKYR.exe
  C:\Windows\System\dxyaKYR.exe
  2⤵
  PID:4876
- C:\Windows\System\FzEFMbk.exe
  C:\Windows\System\FzEFMbk.exe
  2⤵
  PID:5032
- C:\Windows\System\LbVLXpg.exe
  C:\Windows\System\LbVLXpg.exe
  2⤵
  PID:4156
- C:\Windows\System\ilrAwDt.exe
  C:\Windows\System\ilrAwDt.exe
  2⤵
  PID:5008
- C:\Windows\System\FLUjuaC.exe
  C:\Windows\System\FLUjuaC.exe
  2⤵
  PID:4136
- C:\Windows\System\TjvKxmG.exe
  C:\Windows\System\TjvKxmG.exe
  2⤵
  PID:5080
- C:\Windows\System\QzbHvrx.exe
  C:\Windows\System\QzbHvrx.exe
  2⤵
  PID:4360
- C:\Windows\System\otGhtoY.exe
  C:\Windows\System\otGhtoY.exe
  2⤵
  PID:4524
- C:\Windows\System\NDZZNzU.exe
  C:\Windows\System\NDZZNzU.exe
  2⤵
  PID:4728
- C:\Windows\System\tBENWCr.exe
  C:\Windows\System\tBENWCr.exe
  2⤵
  PID:4420
- C:\Windows\System\eTWLdAe.exe
  C:\Windows\System\eTWLdAe.exe
  2⤵
  PID:4544
- C:\Windows\System\mykgITO.exe
  C:\Windows\System\mykgITO.exe
  2⤵
  PID:4688
- C:\Windows\System\sIuMppz.exe
  C:\Windows\System\sIuMppz.exe
  2⤵
  PID:4892
- C:\Windows\System\XHwtqzR.exe
  C:\Windows\System\XHwtqzR.exe
  2⤵
  PID:4228
- C:\Windows\System\dkmyjCy.exe
  C:\Windows\System\dkmyjCy.exe
  2⤵
  PID:5052
- C:\Windows\System\vpGZjXa.exe
  C:\Windows\System\vpGZjXa.exe
  2⤵
  PID:4936
- C:\Windows\System\YWwPDPj.exe
  C:\Windows\System\YWwPDPj.exe
  2⤵
  PID:5112
- C:\Windows\System\UkqcXrL.exe
  C:\Windows\System\UkqcXrL.exe
  2⤵
  PID:4272
- C:\Windows\System\dKWqJJJ.exe
  C:\Windows\System\dKWqJJJ.exe
  2⤵
  PID:4636
- C:\Windows\System\RupanDf.exe
  C:\Windows\System\RupanDf.exe
  2⤵
  PID:4176
- C:\Windows\System\eiBquQs.exe
  C:\Windows\System\eiBquQs.exe
  2⤵
  PID:4932
- C:\Windows\System\ktOkOaC.exe
  C:\Windows\System\ktOkOaC.exe
  2⤵
  PID:4860
- C:\Windows\System\SIzgrdT.exe
  C:\Windows\System\SIzgrdT.exe
  2⤵
  PID:4996
- C:\Windows\System\EhNAjgd.exe
  C:\Windows\System\EhNAjgd.exe
  2⤵
  PID:4316
- C:\Windows\System\BWwFeyg.exe
  C:\Windows\System\BWwFeyg.exe
  2⤵
  PID:4828
- C:\Windows\System\duERToi.exe
  C:\Windows\System\duERToi.exe
  2⤵
  PID:4480
- C:\Windows\System\cDgjbgF.exe
  C:\Windows\System\cDgjbgF.exe
  2⤵
  PID:4100
- C:\Windows\System\TIvVicW.exe
  C:\Windows\System\TIvVicW.exe
  2⤵
  PID:5028
- C:\Windows\System\cBdBslr.exe
  C:\Windows\System\cBdBslr.exe
  2⤵
  PID:5132
- C:\Windows\System\zKpEAAN.exe
  C:\Windows\System\zKpEAAN.exe
  2⤵
  PID:5148
- C:\Windows\System\wVyVOwd.exe
  C:\Windows\System\wVyVOwd.exe
  2⤵
  PID:5164
- C:\Windows\System\QuMpdza.exe
  C:\Windows\System\QuMpdza.exe
  2⤵
  PID:5180
- C:\Windows\System\KlvorZT.exe
  C:\Windows\System\KlvorZT.exe
  2⤵
  PID:5204
- C:\Windows\System\ImDugzn.exe
  C:\Windows\System\ImDugzn.exe
  2⤵
  PID:5224
- C:\Windows\System\cmDRHSB.exe
  C:\Windows\System\cmDRHSB.exe
  2⤵
  PID:5244
- C:\Windows\System\VdvwIHt.exe
  C:\Windows\System\VdvwIHt.exe
  2⤵
  PID:5268
- C:\Windows\System\fGHnKte.exe
  C:\Windows\System\fGHnKte.exe
  2⤵
  PID:5284
- C:\Windows\System\KWqXDqk.exe
  C:\Windows\System\KWqXDqk.exe
  2⤵
  PID:5300
- C:\Windows\System\GJNcGtc.exe
  C:\Windows\System\GJNcGtc.exe
  2⤵
  PID:5316
- C:\Windows\System\daNrRQH.exe
  C:\Windows\System\daNrRQH.exe
  2⤵
  PID:5332
- C:\Windows\System\eUyotgX.exe
  C:\Windows\System\eUyotgX.exe
  2⤵
  PID:5352
- C:\Windows\System\QUiCVgh.exe
  C:\Windows\System\QUiCVgh.exe
  2⤵
  PID:5400
- C:\Windows\System\XFMnxBu.exe
  C:\Windows\System\XFMnxBu.exe
  2⤵
  PID:5416
- C:\Windows\System\ZfCSiPE.exe
  C:\Windows\System\ZfCSiPE.exe
  2⤵
  PID:5440
- C:\Windows\System\LlnUJTL.exe
  C:\Windows\System\LlnUJTL.exe
  2⤵
  PID:5460
- C:\Windows\System\IhgIzgR.exe
  C:\Windows\System\IhgIzgR.exe
  2⤵
  PID:5476
- C:\Windows\System\edimQtT.exe
  C:\Windows\System\edimQtT.exe
  2⤵
  PID:5496
- C:\Windows\System\SIZehah.exe
  C:\Windows\System\SIZehah.exe
  2⤵
  PID:5512
- C:\Windows\System\AnqewCm.exe
  C:\Windows\System\AnqewCm.exe
  2⤵
  PID:5532
- C:\Windows\System\UsNpjAX.exe
  C:\Windows\System\UsNpjAX.exe
  2⤵
  PID:5548
- C:\Windows\System\FfUJene.exe
  C:\Windows\System\FfUJene.exe
  2⤵
  PID:5568
- C:\Windows\System\IqknAxt.exe
  C:\Windows\System\IqknAxt.exe
  2⤵
  PID:5592
- C:\Windows\System\ohRfZQF.exe
  C:\Windows\System\ohRfZQF.exe
  2⤵
  PID:5612
- C:\Windows\System\QayNUCS.exe
  C:\Windows\System\QayNUCS.exe
  2⤵
  PID:5628
- C:\Windows\System\ElsQkEZ.exe
  C:\Windows\System\ElsQkEZ.exe
  2⤵
  PID:5644
- C:\Windows\System\NkJnBoJ.exe
  C:\Windows\System\NkJnBoJ.exe
  2⤵
  PID:5668
- C:\Windows\System\BWXvbPw.exe
  C:\Windows\System\BWXvbPw.exe
  2⤵
  PID:5688
- C:\Windows\System\FOKLyRk.exe
  C:\Windows\System\FOKLyRk.exe
  2⤵
  PID:5704
- C:\Windows\System\bhapQql.exe
  C:\Windows\System\bhapQql.exe
  2⤵
  PID:5728
- C:\Windows\System\wOGkhix.exe
  C:\Windows\System\wOGkhix.exe
  2⤵
  PID:5744
- C:\Windows\System\inFvAFC.exe
  C:\Windows\System\inFvAFC.exe
  2⤵
  PID:5780
- C:\Windows\System\lKfSSMY.exe
  C:\Windows\System\lKfSSMY.exe
  2⤵
  PID:5800
- C:\Windows\System\HgGvXPX.exe
  C:\Windows\System\HgGvXPX.exe
  2⤵
  PID:5820
- C:\Windows\System\jnMxvkz.exe
  C:\Windows\System\jnMxvkz.exe
  2⤵
  PID:5836
- C:\Windows\System\Ngoeabl.exe
  C:\Windows\System\Ngoeabl.exe
  2⤵
  PID:5856
- C:\Windows\System\YKVxGti.exe
  C:\Windows\System\YKVxGti.exe
  2⤵
  PID:5872
- C:\Windows\System\qdjnEjG.exe
  C:\Windows\System\qdjnEjG.exe
  2⤵
  PID:5888
- C:\Windows\System\RIdigwT.exe
  C:\Windows\System\RIdigwT.exe
  2⤵
  PID:5908
- C:\Windows\System\aKtPUHs.exe
  C:\Windows\System\aKtPUHs.exe
  2⤵
  PID:5924
- C:\Windows\System\dYaDCFz.exe
  C:\Windows\System\dYaDCFz.exe
  2⤵
  PID:5940
- C:\Windows\System\UxUeAXN.exe
  C:\Windows\System\UxUeAXN.exe
  2⤵
  PID:5956
- C:\Windows\System\nccwfYK.exe
  C:\Windows\System\nccwfYK.exe
  2⤵
  PID:6004
- C:\Windows\System\ZJjOwAx.exe
  C:\Windows\System\ZJjOwAx.exe
  2⤵
  PID:6024
- C:\Windows\System\sBxJWuh.exe
  C:\Windows\System\sBxJWuh.exe
  2⤵
  PID:6040
- C:\Windows\System\bGwLeck.exe
  C:\Windows\System\bGwLeck.exe
  2⤵
  PID:6060
- C:\Windows\System\pLnmjEN.exe
  C:\Windows\System\pLnmjEN.exe
  2⤵
  PID:6076
- C:\Windows\System\hkrlfZK.exe
  C:\Windows\System\hkrlfZK.exe
  2⤵
  PID:6092
- C:\Windows\System\HKlpwZy.exe
  C:\Windows\System\HKlpwZy.exe
  2⤵
  PID:6112
- C:\Windows\System\PiaiQTR.exe
  C:\Windows\System\PiaiQTR.exe
  2⤵
  PID:6132
- C:\Windows\System\DCvrnmi.exe
  C:\Windows\System\DCvrnmi.exe
  2⤵
  PID:4712
- C:\Windows\System\PRWfylP.exe
  C:\Windows\System\PRWfylP.exe
  2⤵
  PID:5216
- C:\Windows\System\IJtPLNT.exe
  C:\Windows\System\IJtPLNT.exe
  2⤵
  PID:5256
- C:\Windows\System\gsOCfex.exe
  C:\Windows\System\gsOCfex.exe
  2⤵
  PID:5328
- C:\Windows\System\qXqcECg.exe
  C:\Windows\System\qXqcECg.exe
  2⤵
  PID:4240
- C:\Windows\System\dPlgDln.exe
  C:\Windows\System\dPlgDln.exe
  2⤵
  PID:5312
- C:\Windows\System\eNyQsep.exe
  C:\Windows\System\eNyQsep.exe
  2⤵
  PID:5308
- C:\Windows\System\RyprzgX.exe
  C:\Windows\System\RyprzgX.exe
  2⤵
  PID:5372
- C:\Windows\System\SPnuwJr.exe
  C:\Windows\System\SPnuwJr.exe
  2⤵
  PID:5388
- C:\Windows\System\xxnDlmS.exe
  C:\Windows\System\xxnDlmS.exe
  2⤵
  PID:5280
- C:\Windows\System\TnnCjca.exe
  C:\Windows\System\TnnCjca.exe
  2⤵
  PID:5428
- C:\Windows\System\gQrREVt.exe
  C:\Windows\System\gQrREVt.exe
  2⤵
  PID:5448
- C:\Windows\System\dVaMcAK.exe
  C:\Windows\System\dVaMcAK.exe
  2⤵
  PID:5508
- C:\Windows\System\EIidtuj.exe
  C:\Windows\System\EIidtuj.exe
  2⤵
  PID:5492
- C:\Windows\System\hTQSFHb.exe
  C:\Windows\System\hTQSFHb.exe
  2⤵
  PID:5624
- C:\Windows\System\nSUExWc.exe
  C:\Windows\System\nSUExWc.exe
  2⤵
  PID:5520
- C:\Windows\System\XMmPDAo.exe
  C:\Windows\System\XMmPDAo.exe
  2⤵
  PID:5528
- C:\Windows\System\NCTufDK.exe
  C:\Windows\System\NCTufDK.exe
  2⤵
  PID:5608
- C:\Windows\System\ageQLAw.exe
  C:\Windows\System\ageQLAw.exe
  2⤵
  PID:5696
- C:\Windows\System\xVyCkPV.exe
  C:\Windows\System\xVyCkPV.exe
  2⤵
  PID:5712
- C:\Windows\System\WMNfCps.exe
  C:\Windows\System\WMNfCps.exe
  2⤵
  PID:5752
- C:\Windows\System\ZKNMTgy.exe
  C:\Windows\System\ZKNMTgy.exe
  2⤵
  PID:5788
- C:\Windows\System\pmMICyN.exe
  C:\Windows\System\pmMICyN.exe
  2⤵
  PID:5896
- C:\Windows\System\iyYpPlE.exe
  C:\Windows\System\iyYpPlE.exe
  2⤵
  PID:5936
- C:\Windows\System\EUiqsTw.exe
  C:\Windows\System\EUiqsTw.exe
  2⤵
  PID:5980
- C:\Windows\System\kjAxhSI.exe
  C:\Windows\System\kjAxhSI.exe
  2⤵
  PID:5816
- C:\Windows\System\IsfecFw.exe
  C:\Windows\System\IsfecFw.exe
  2⤵
  PID:5852
- C:\Windows\System\LyBbUlk.exe
  C:\Windows\System\LyBbUlk.exe
  2⤵
  PID:5884
- C:\Windows\System\YavrJjS.exe
  C:\Windows\System\YavrJjS.exe
  2⤵
  PID:6068
- C:\Windows\System\NBqUfPl.exe
  C:\Windows\System\NBqUfPl.exe
  2⤵
  PID:6016
- C:\Windows\System\yKhRAgZ.exe
  C:\Windows\System\yKhRAgZ.exe
  2⤵
  PID:6124
- C:\Windows\System\ijFPbTD.exe
  C:\Windows\System\ijFPbTD.exe
  2⤵
  PID:4620
- C:\Windows\System\DXqKlzo.exe
  C:\Windows\System\DXqKlzo.exe
  2⤵
  PID:5252
- C:\Windows\System\iweYQTx.exe
  C:\Windows\System\iweYQTx.exe
  2⤵
  PID:5172
- C:\Windows\System\IXqSjFK.exe
  C:\Windows\System\IXqSjFK.exe
  2⤵
  PID:5264
- C:\Windows\System\mKRqQll.exe
  C:\Windows\System\mKRqQll.exe
  2⤵
  PID:5160
- C:\Windows\System\ecVBcpU.exe
  C:\Windows\System\ecVBcpU.exe
  2⤵
  PID:5348
- C:\Windows\System\dLObJLW.exe
  C:\Windows\System\dLObJLW.exe
  2⤵
  PID:5232
- C:\Windows\System\ypppKGc.exe
  C:\Windows\System\ypppKGc.exe
  2⤵
  PID:5408
- C:\Windows\System\eyIqcCR.exe
  C:\Windows\System\eyIqcCR.exe
  2⤵
  PID:5504
- C:\Windows\System\QVmwogL.exe
  C:\Windows\System\QVmwogL.exe
  2⤵
  PID:5580
- C:\Windows\System\WWuWUUn.exe
  C:\Windows\System\WWuWUUn.exe
  2⤵
  PID:5652
- C:\Windows\System\wYQtMel.exe
  C:\Windows\System\wYQtMel.exe
  2⤵
  PID:5636
- C:\Windows\System\rAEYjPR.exe
  C:\Windows\System\rAEYjPR.exe
  2⤵
  PID:5768
- C:\Windows\System\qtzpHVk.exe
  C:\Windows\System\qtzpHVk.exe
  2⤵
  PID:5832
- C:\Windows\System\LNBzCpy.exe
  C:\Windows\System\LNBzCpy.exe
  2⤵
  PID:5756
- C:\Windows\System\iEzeupQ.exe
  C:\Windows\System\iEzeupQ.exe
  2⤵
  PID:5812
- C:\Windows\System\IVYjkCa.exe
  C:\Windows\System\IVYjkCa.exe
  2⤵
  PID:5992
- C:\Windows\System\xZXFQjg.exe
  C:\Windows\System\xZXFQjg.exe
  2⤵
  PID:6032
- C:\Windows\System\YrpiacX.exe
  C:\Windows\System\YrpiacX.exe
  2⤵
  PID:5916
- C:\Windows\System\WJuHlMW.exe
  C:\Windows\System\WJuHlMW.exe
  2⤵
  PID:6088
- C:\Windows\System\hqTOpFI.exe
  C:\Windows\System\hqTOpFI.exe
  2⤵
  PID:6056
- C:\Windows\System\fPCGUAT.exe
  C:\Windows\System\fPCGUAT.exe
  2⤵
  PID:5296
- C:\Windows\System\OvIuhMX.exe
  C:\Windows\System\OvIuhMX.exe
  2⤵
  PID:6140
- C:\Windows\System\gznkHoI.exe
  C:\Windows\System\gznkHoI.exe
  2⤵
  PID:5324
- C:\Windows\System\bABmCif.exe
  C:\Windows\System\bABmCif.exe
  2⤵
  PID:5604
- C:\Windows\System\rBHWknf.exe
  C:\Windows\System\rBHWknf.exe
  2⤵
  PID:5360
- C:\Windows\System\kwpJPmo.exe
  C:\Windows\System\kwpJPmo.exe
  2⤵
  PID:5396
- C:\Windows\System\ZFHJzpl.exe
  C:\Windows\System\ZFHJzpl.exe
  2⤵
  PID:5600
- C:\Windows\System\wmYzKbL.exe
  C:\Windows\System\wmYzKbL.exe
  2⤵
  PID:5740
- C:\Windows\System\cYmuqLb.exe
  C:\Windows\System\cYmuqLb.exe
  2⤵
  PID:5988
- C:\Windows\System\PmVefUM.exe
  C:\Windows\System\PmVefUM.exe
  2⤵
  PID:6036
- C:\Windows\System\okKYUQs.exe
  C:\Windows\System\okKYUQs.exe
  2⤵
  PID:6100
- C:\Windows\System\TwtjOWZ.exe
  C:\Windows\System\TwtjOWZ.exe
  2⤵
  PID:5976
- C:\Windows\System\TiGQatG.exe
  C:\Windows\System\TiGQatG.exe
  2⤵
  PID:5676
- C:\Windows\System\VITHGst.exe
  C:\Windows\System\VITHGst.exe
  2⤵
  PID:5576
- C:\Windows\System\nTwGLth.exe
  C:\Windows\System\nTwGLth.exe
  2⤵
  PID:5368
- C:\Windows\System\AUExcOl.exe
  C:\Windows\System\AUExcOl.exe
  2⤵
  PID:5868
- C:\Windows\System\pBTPHTY.exe
  C:\Windows\System\pBTPHTY.exe
  2⤵
  PID:6128
- C:\Windows\System\MVzAbaS.exe
  C:\Windows\System\MVzAbaS.exe
  2⤵
  PID:5720
- C:\Windows\System\kHnbMKm.exe
  C:\Windows\System\kHnbMKm.exe
  2⤵
  PID:5124
- C:\Windows\System\uBCUwpe.exe
  C:\Windows\System\uBCUwpe.exe
  2⤵
  PID:5488
- C:\Windows\System\JKfvRdh.exe
  C:\Windows\System\JKfvRdh.exe
  2⤵
  PID:5484
- C:\Windows\System\EFqTAjm.exe
  C:\Windows\System\EFqTAjm.exe
  2⤵
  PID:5844
- C:\Windows\System\MJRQIiX.exe
  C:\Windows\System\MJRQIiX.exe
  2⤵
  PID:6084
- C:\Windows\System\kPIPoBA.exe
  C:\Windows\System\kPIPoBA.exe
  2⤵
  PID:5384
- C:\Windows\System\CuVkyZw.exe
  C:\Windows\System\CuVkyZw.exe
  2⤵
  PID:5544
- C:\Windows\System\dFlMJni.exe
  C:\Windows\System\dFlMJni.exe
  2⤵
  PID:4716
- C:\Windows\System\smdjUqg.exe
  C:\Windows\System\smdjUqg.exe
  2⤵
  PID:5808
- C:\Windows\System\eTfNoDM.exe
  C:\Windows\System\eTfNoDM.exe
  2⤵
  PID:6164
- C:\Windows\System\QrqQaKm.exe
  C:\Windows\System\QrqQaKm.exe
  2⤵
  PID:6180
- C:\Windows\System\UDuNsbf.exe
  C:\Windows\System\UDuNsbf.exe
  2⤵
  PID:6204
- C:\Windows\System\zlpoCrP.exe
  C:\Windows\System\zlpoCrP.exe
  2⤵
  PID:6224
- C:\Windows\System\bTPjzHN.exe
  C:\Windows\System\bTPjzHN.exe
  2⤵
  PID:6240
- C:\Windows\System\xDKzYSl.exe
  C:\Windows\System\xDKzYSl.exe
  2⤵
  PID:6268
- C:\Windows\System\FoFcTrP.exe
  C:\Windows\System\FoFcTrP.exe
  2⤵
  PID:6284
- C:\Windows\System\YoIwYxV.exe
  C:\Windows\System\YoIwYxV.exe
  2⤵
  PID:6300
- C:\Windows\System\ErjsZGR.exe
  C:\Windows\System\ErjsZGR.exe
  2⤵
  PID:6316
- C:\Windows\System\EsUXuil.exe
  C:\Windows\System\EsUXuil.exe
  2⤵
  PID:6332
- C:\Windows\System\chloPVc.exe
  C:\Windows\System\chloPVc.exe
  2⤵
  PID:6348
- C:\Windows\System\TdsTnAt.exe
  C:\Windows\System\TdsTnAt.exe
  2⤵
  PID:6368
- C:\Windows\System\luEuZcm.exe
  C:\Windows\System\luEuZcm.exe
  2⤵
  PID:6396
- C:\Windows\System\KOoFZJf.exe
  C:\Windows\System\KOoFZJf.exe
  2⤵
  PID:6420
- C:\Windows\System\HSXlVmv.exe
  C:\Windows\System\HSXlVmv.exe
  2⤵
  PID:6436
- C:\Windows\System\WQMakxo.exe
  C:\Windows\System\WQMakxo.exe
  2⤵
  PID:6460
- C:\Windows\System\PxBdTXE.exe
  C:\Windows\System\PxBdTXE.exe
  2⤵
  PID:6480
- C:\Windows\System\egVBnxu.exe
  C:\Windows\System\egVBnxu.exe
  2⤵
  PID:6504
- C:\Windows\System\fpMnwqm.exe
  C:\Windows\System\fpMnwqm.exe
  2⤵
  PID:6524
- C:\Windows\System\NDnQvkL.exe
  C:\Windows\System\NDnQvkL.exe
  2⤵
  PID:6548
- C:\Windows\System\ILLnMoW.exe
  C:\Windows\System\ILLnMoW.exe
  2⤵
  PID:6568
- C:\Windows\System\jCxcBDc.exe
  C:\Windows\System\jCxcBDc.exe
  2⤵
  PID:6588
- C:\Windows\System\uGJZcOS.exe
  C:\Windows\System\uGJZcOS.exe
  2⤵
  PID:6608
- C:\Windows\System\sqxssad.exe
  C:\Windows\System\sqxssad.exe
  2⤵
  PID:6628
- C:\Windows\System\DnbBpuq.exe
  C:\Windows\System\DnbBpuq.exe
  2⤵
  PID:6644
- C:\Windows\System\TLRNeoB.exe
  C:\Windows\System\TLRNeoB.exe
  2⤵
  PID:6672
- C:\Windows\System\WaQyprA.exe
  C:\Windows\System\WaQyprA.exe
  2⤵
  PID:6688
- C:\Windows\System\LVufHAj.exe
  C:\Windows\System\LVufHAj.exe
  2⤵
  PID:6708
- C:\Windows\System\THHBMUz.exe
  C:\Windows\System\THHBMUz.exe
  2⤵
  PID:6728
- C:\Windows\System\GpAkOtN.exe
  C:\Windows\System\GpAkOtN.exe
  2⤵
  PID:6744
- C:\Windows\System\UlWxPiU.exe
  C:\Windows\System\UlWxPiU.exe
  2⤵
  PID:6768
- C:\Windows\System\QYZYIuT.exe
  C:\Windows\System\QYZYIuT.exe
  2⤵
  PID:6784
- C:\Windows\System\kbzsOEv.exe
  C:\Windows\System\kbzsOEv.exe
  2⤵
  PID:6804
- C:\Windows\System\ICPHXTr.exe
  C:\Windows\System\ICPHXTr.exe
  2⤵
  PID:6820
- C:\Windows\System\ZupjcwW.exe
  C:\Windows\System\ZupjcwW.exe
  2⤵
  PID:6836
- C:\Windows\System\eczZtOT.exe
  C:\Windows\System\eczZtOT.exe
  2⤵
  PID:6860
- C:\Windows\System\eoFAoUd.exe
  C:\Windows\System\eoFAoUd.exe
  2⤵
  PID:6880
- C:\Windows\System\kSgSNph.exe
  C:\Windows\System\kSgSNph.exe
  2⤵
  PID:6896
- C:\Windows\System\oSZsApl.exe
  C:\Windows\System\oSZsApl.exe
  2⤵
  PID:6912
- C:\Windows\System\ENyoubV.exe
  C:\Windows\System\ENyoubV.exe
  2⤵
  PID:6932
- C:\Windows\System\UvqrIer.exe
  C:\Windows\System\UvqrIer.exe
  2⤵
  PID:6956
- C:\Windows\System\YUkrLyz.exe
  C:\Windows\System\YUkrLyz.exe
  2⤵
  PID:6976
- C:\Windows\System\GPeICiA.exe
  C:\Windows\System\GPeICiA.exe
  2⤵
  PID:6996
- C:\Windows\System\xaUnMxr.exe
  C:\Windows\System\xaUnMxr.exe
  2⤵
  PID:7012
- C:\Windows\System\VleRdLM.exe
  C:\Windows\System\VleRdLM.exe
  2⤵
  PID:7036
- C:\Windows\System\RWNPGsy.exe
  C:\Windows\System\RWNPGsy.exe
  2⤵
  PID:7076
- C:\Windows\System\pfJhpwa.exe
  C:\Windows\System\pfJhpwa.exe
  2⤵
  PID:7092
- C:\Windows\System\Cnebssp.exe
  C:\Windows\System\Cnebssp.exe
  2⤵
  PID:7108
- C:\Windows\System\COEKoHQ.exe
  C:\Windows\System\COEKoHQ.exe
  2⤵
  PID:7124
- C:\Windows\System\spWksti.exe
  C:\Windows\System\spWksti.exe
  2⤵
  PID:7144
- C:\Windows\System\FTbpKyB.exe
  C:\Windows\System\FTbpKyB.exe
  2⤵
  PID:5468
- C:\Windows\System\swDLoXl.exe
  C:\Windows\System\swDLoXl.exe
  2⤵
  PID:5880
- C:\Windows\System\sazLkzM.exe
  C:\Windows\System\sazLkzM.exe
  2⤵
  PID:6248
- C:\Windows\System\UjveiGt.exe
  C:\Windows\System\UjveiGt.exe
  2⤵
  PID:6192
- C:\Windows\System\neTcZXY.exe
  C:\Windows\System\neTcZXY.exe
  2⤵
  PID:6200
- C:\Windows\System\LKPKGac.exe
  C:\Windows\System\LKPKGac.exe
  2⤵
  PID:6312
- C:\Windows\System\aoyJxAy.exe
  C:\Windows\System\aoyJxAy.exe
  2⤵
  PID:6340
- C:\Windows\System\xEVKbVi.exe
  C:\Windows\System\xEVKbVi.exe
  2⤵
  PID:6360
- C:\Windows\System\FJkDInY.exe
  C:\Windows\System\FJkDInY.exe
  2⤵
  PID:6416
- C:\Windows\System\gODHGJP.exe
  C:\Windows\System\gODHGJP.exe
  2⤵
  PID:5680
- C:\Windows\System\hwqBaSv.exe
  C:\Windows\System\hwqBaSv.exe
  2⤵
  PID:6432
- C:\Windows\System\GsLdxBf.exe
  C:\Windows\System\GsLdxBf.exe
  2⤵
  PID:6476
- C:\Windows\System\XQdbvwt.exe
  C:\Windows\System\XQdbvwt.exe
  2⤵
  PID:6496
- C:\Windows\System\grAbKJF.exe
  C:\Windows\System\grAbKJF.exe
  2⤵
  PID:6544
- C:\Windows\System\qUomppl.exe
  C:\Windows\System\qUomppl.exe
  2⤵
  PID:6580
- C:\Windows\System\RJbAsjc.exe
  C:\Windows\System\RJbAsjc.exe
  2⤵
  PID:6616
- C:\Windows\System\xgktWuJ.exe
  C:\Windows\System\xgktWuJ.exe
  2⤵
  PID:6660
- C:\Windows\System\HmwBqnX.exe
  C:\Windows\System\HmwBqnX.exe
  2⤵
  PID:6684
- C:\Windows\System\qTSiqkB.exe
  C:\Windows\System\qTSiqkB.exe
  2⤵
  PID:6736
- C:\Windows\System\vuXcDZb.exe
  C:\Windows\System\vuXcDZb.exe
  2⤵
  PID:6780
- C:\Windows\System\oUyYCiz.exe
  C:\Windows\System\oUyYCiz.exe
  2⤵
  PID:6848
- C:\Windows\System\EsWYMce.exe
  C:\Windows\System\EsWYMce.exe
  2⤵
  PID:6764
- C:\Windows\System\dUefcuT.exe
  C:\Windows\System\dUefcuT.exe
  2⤵
  PID:6872
- C:\Windows\System\FmsIiaZ.exe
  C:\Windows\System\FmsIiaZ.exe
  2⤵
  PID:6892
- C:\Windows\System\TIrEdat.exe
  C:\Windows\System\TIrEdat.exe
  2⤵
  PID:6964
- C:\Windows\System\wBBtmaT.exe
  C:\Windows\System\wBBtmaT.exe
  2⤵
  PID:6940
- C:\Windows\System\WPNsdYk.exe
  C:\Windows\System\WPNsdYk.exe
  2⤵
  PID:7052
- C:\Windows\System\aVAFNph.exe
  C:\Windows\System\aVAFNph.exe
  2⤵
  PID:6948
- C:\Windows\System\JauYwyN.exe
  C:\Windows\System\JauYwyN.exe
  2⤵
  PID:7028
- C:\Windows\System\dBwuPfn.exe
  C:\Windows\System\dBwuPfn.exe
  2⤵
  PID:7068
- C:\Windows\System\QvjQkBj.exe
  C:\Windows\System\QvjQkBj.exe
  2⤵
  PID:7140
- C:\Windows\System\tTymQWz.exe
  C:\Windows\System\tTymQWz.exe
  2⤵
  PID:7120
- C:\Windows\System\DKfcJvo.exe
  C:\Windows\System\DKfcJvo.exe
  2⤵
  PID:5344
- C:\Windows\System\KmwPACN.exe
  C:\Windows\System\KmwPACN.exe
  2⤵
  PID:6196
- C:\Windows\System\jDDOjLY.exe
  C:\Windows\System\jDDOjLY.exe
  2⤵
  PID:6276
- C:\Windows\System\vRhJqIG.exe
  C:\Windows\System\vRhJqIG.exe
  2⤵
  PID:6376
- C:\Windows\System\QYaOFlK.exe
  C:\Windows\System\QYaOFlK.exe
  2⤵
  PID:6456
- C:\Windows\System\QALecDy.exe
  C:\Windows\System\QALecDy.exe
  2⤵
  PID:6404
- C:\Windows\System\DMJMfYd.exe
  C:\Windows\System\DMJMfYd.exe
  2⤵
  PID:6408
- C:\Windows\System\vIJkGUO.exe
  C:\Windows\System\vIJkGUO.exe
  2⤵
  PID:6452
- C:\Windows\System\tVTXkga.exe
  C:\Windows\System\tVTXkga.exe
  2⤵
  PID:6624
- C:\Windows\System\MHAGvxL.exe
  C:\Windows\System\MHAGvxL.exe
  2⤵
  PID:6640
- C:\Windows\System\ELkGndO.exe
  C:\Windows\System\ELkGndO.exe
  2⤵
  PID:6700
- C:\Windows\System\hMYMlIT.exe
  C:\Windows\System\hMYMlIT.exe
  2⤵
  PID:6724
- C:\Windows\System\OftfHHb.exe
  C:\Windows\System\OftfHHb.exe
  2⤵
  PID:7072
- C:\Windows\System\KvhWVPu.exe
  C:\Windows\System\KvhWVPu.exe
  2⤵
  PID:6888
- C:\Windows\System\WoEvxbm.exe
  C:\Windows\System\WoEvxbm.exe
  2⤵
  PID:6904
- C:\Windows\System\DpeZADP.exe
  C:\Windows\System\DpeZADP.exe
  2⤵
  PID:6924
- C:\Windows\System\FdieeZz.exe
  C:\Windows\System\FdieeZz.exe
  2⤵
  PID:7116
- C:\Windows\System\NDUUVOa.exe
  C:\Windows\System\NDUUVOa.exe
  2⤵
  PID:6988
- C:\Windows\System\zNRZtHv.exe
  C:\Windows\System\zNRZtHv.exe
  2⤵
  PID:6176
- C:\Windows\System\zVZIvBU.exe
  C:\Windows\System\zVZIvBU.exe
  2⤵
  PID:5456
- C:\Windows\System\eLTJymH.exe
  C:\Windows\System\eLTJymH.exe
  2⤵
  PID:6264
- C:\Windows\System\NYHzgPJ.exe
  C:\Windows\System\NYHzgPJ.exe
  2⤵
  PID:6512
- C:\Windows\System\FevtfFV.exe
  C:\Windows\System\FevtfFV.exe
  2⤵
  PID:6532
- C:\Windows\System\NZLbsqT.exe
  C:\Windows\System\NZLbsqT.exe
  2⤵
  PID:6392
- C:\Windows\System\OVXoDJy.exe
  C:\Windows\System\OVXoDJy.exe
  2⤵
  PID:6576
- C:\Windows\System\MbIuSnS.exe
  C:\Windows\System\MbIuSnS.exe
  2⤵
  PID:6716
- C:\Windows\System\MpByWni.exe
  C:\Windows\System\MpByWni.exe
  2⤵
  PID:7060
- C:\Windows\System\xfjViwb.exe
  C:\Windows\System\xfjViwb.exe
  2⤵
  PID:6984
- C:\Windows\System\wyLUOIM.exe
  C:\Windows\System\wyLUOIM.exe
  2⤵
  PID:7032
- C:\Windows\System\sVXcVrS.exe
  C:\Windows\System\sVXcVrS.exe
  2⤵
  PID:6468
- C:\Windows\System\YgjVzGH.exe
  C:\Windows\System\YgjVzGH.exe
  2⤵
  PID:6536
- C:\Windows\System\pBDIcpJ.exe
  C:\Windows\System\pBDIcpJ.exe
  2⤵
  PID:6620
- C:\Windows\System\AePMnOy.exe
  C:\Windows\System\AePMnOy.exe
  2⤵
  PID:7104
- C:\Windows\System\bllZJcC.exe
  C:\Windows\System\bllZJcC.exe
  2⤵
  PID:7008
- C:\Windows\System\ZOUEeYk.exe
  C:\Windows\System\ZOUEeYk.exe
  2⤵
  PID:6564
- C:\Windows\System\kSrDqjf.exe
  C:\Windows\System\kSrDqjf.exe
  2⤵
  PID:6656
- C:\Windows\System\UkNLhUd.exe
  C:\Windows\System\UkNLhUd.exe
  2⤵
  PID:6472
- C:\Windows\System\nkAoYbh.exe
  C:\Windows\System\nkAoYbh.exe
  2⤵
  PID:7084
- C:\Windows\System\JTPXfKA.exe
  C:\Windows\System\JTPXfKA.exe
  2⤵
  PID:6236
- C:\Windows\System\RjIqlWA.exe
  C:\Windows\System\RjIqlWA.exe
  2⤵
  PID:6188
- C:\Windows\System\BwONcRr.exe
  C:\Windows\System\BwONcRr.exe
  2⤵
  PID:6844
- C:\Windows\System\OkEnkrn.exe
  C:\Windows\System\OkEnkrn.exe
  2⤵
  PID:7204
- C:\Windows\System\eLWpbTh.exe
  C:\Windows\System\eLWpbTh.exe
  2⤵
  PID:7224
- C:\Windows\System\YRVUtXU.exe
  C:\Windows\System\YRVUtXU.exe
  2⤵
  PID:7240
- C:\Windows\System\VtvYQBj.exe
  C:\Windows\System\VtvYQBj.exe
  2⤵
  PID:7256
- C:\Windows\System\sDoqSEC.exe
  C:\Windows\System\sDoqSEC.exe
  2⤵
  PID:7272
- C:\Windows\System\KCipuGc.exe
  C:\Windows\System\KCipuGc.exe
  2⤵
  PID:7288
- C:\Windows\System\eZSzJNl.exe
  C:\Windows\System\eZSzJNl.exe
  2⤵
  PID:7304
- C:\Windows\System\IVyOYGQ.exe
  C:\Windows\System\IVyOYGQ.exe
  2⤵
  PID:7320
- C:\Windows\System\JkqDKmE.exe
  C:\Windows\System\JkqDKmE.exe
  2⤵
  PID:7340
- C:\Windows\System\psORDBs.exe
  C:\Windows\System\psORDBs.exe
  2⤵
  PID:7368
- C:\Windows\System\LtgSHmc.exe
  C:\Windows\System\LtgSHmc.exe
  2⤵
  PID:7408
- C:\Windows\System\tWRDAFa.exe
  C:\Windows\System\tWRDAFa.exe
  2⤵
  PID:7424
- C:\Windows\System\FHJmbwO.exe
  C:\Windows\System\FHJmbwO.exe
  2⤵
  PID:7444
- C:\Windows\System\wVIoTgD.exe
  C:\Windows\System\wVIoTgD.exe
  2⤵
  PID:7460
- C:\Windows\System\zCGglhx.exe
  C:\Windows\System\zCGglhx.exe
  2⤵
  PID:7476
- C:\Windows\System\MjTxvyv.exe
  C:\Windows\System\MjTxvyv.exe
  2⤵
  PID:7492
- C:\Windows\System\kmhpPZP.exe
  C:\Windows\System\kmhpPZP.exe
  2⤵
  PID:7512
- C:\Windows\System\lnDFbkF.exe
  C:\Windows\System\lnDFbkF.exe
  2⤵
  PID:7532
- C:\Windows\System\NgkZybE.exe
  C:\Windows\System\NgkZybE.exe
  2⤵
  PID:7552
- C:\Windows\System\ZnLGHeu.exe
  C:\Windows\System\ZnLGHeu.exe
  2⤵
  PID:7572
- C:\Windows\System\eIyZMMW.exe
  C:\Windows\System\eIyZMMW.exe
  2⤵
  PID:7588
- C:\Windows\System\bduMllQ.exe
  C:\Windows\System\bduMllQ.exe
  2⤵
  PID:7612
- C:\Windows\System\dtNXjsI.exe
  C:\Windows\System\dtNXjsI.exe
  2⤵
  PID:7628
- C:\Windows\System\VzhpmKB.exe
  C:\Windows\System\VzhpmKB.exe
  2⤵
  PID:7644
- C:\Windows\System\NWEPqRJ.exe
  C:\Windows\System\NWEPqRJ.exe
  2⤵
  PID:7664
- C:\Windows\System\vsxBtql.exe
  C:\Windows\System\vsxBtql.exe
  2⤵
  PID:7684
- C:\Windows\System\dTZyAiB.exe
  C:\Windows\System\dTZyAiB.exe
  2⤵
  PID:7704
- C:\Windows\System\OHkHZYi.exe
  C:\Windows\System\OHkHZYi.exe
  2⤵
  PID:7720
- C:\Windows\System\sNnfWfH.exe
  C:\Windows\System\sNnfWfH.exe
  2⤵
  PID:7736
- C:\Windows\System\tdHVSZK.exe
  C:\Windows\System\tdHVSZK.exe
  2⤵
  PID:7788
- C:\Windows\System\AXvXklf.exe
  C:\Windows\System\AXvXklf.exe
  2⤵
  PID:7804
- C:\Windows\System\WFEZKbK.exe
  C:\Windows\System\WFEZKbK.exe
  2⤵
  PID:7820
- C:\Windows\System\flJLYIs.exe
  C:\Windows\System\flJLYIs.exe
  2⤵
  PID:7840
- C:\Windows\System\udzmpyY.exe
  C:\Windows\System\udzmpyY.exe
  2⤵
  PID:7856
- C:\Windows\System\rHghdtv.exe
  C:\Windows\System\rHghdtv.exe
  2⤵
  PID:7872
- C:\Windows\System\sTKBZUZ.exe
  C:\Windows\System\sTKBZUZ.exe
  2⤵
  PID:7892
- C:\Windows\System\YPafJYp.exe
  C:\Windows\System\YPafJYp.exe
  2⤵
  PID:7912
- C:\Windows\System\uteCkVq.exe
  C:\Windows\System\uteCkVq.exe
  2⤵
  PID:7928
- C:\Windows\System\vhlSYOO.exe
  C:\Windows\System\vhlSYOO.exe
  2⤵
  PID:7972
- C:\Windows\System\QwyJQlB.exe
  C:\Windows\System\QwyJQlB.exe
  2⤵
  PID:7988
- C:\Windows\System\nrMpuQC.exe
  C:\Windows\System\nrMpuQC.exe
  2⤵
  PID:8004
- C:\Windows\System\QoWGFSo.exe
  C:\Windows\System\QoWGFSo.exe
  2⤵
  PID:8020
- C:\Windows\System\pwJSFvZ.exe
  C:\Windows\System\pwJSFvZ.exe
  2⤵
  PID:8040
- C:\Windows\System\VWuBPkI.exe
  C:\Windows\System\VWuBPkI.exe
  2⤵
  PID:8056
- C:\Windows\System\uVFhsXx.exe
  C:\Windows\System\uVFhsXx.exe
  2⤵
  PID:8080
- C:\Windows\System\LRfNPmU.exe
  C:\Windows\System\LRfNPmU.exe
  2⤵
  PID:8096
- C:\Windows\System\HNUCRVj.exe
  C:\Windows\System\HNUCRVj.exe
  2⤵
  PID:8112
- C:\Windows\System\NosqsiB.exe
  C:\Windows\System\NosqsiB.exe
  2⤵
  PID:8136
- C:\Windows\System\RPEyRUf.exe
  C:\Windows\System\RPEyRUf.exe
  2⤵
  PID:8164
- C:\Windows\System\XAiveMb.exe
  C:\Windows\System\XAiveMb.exe
  2⤵
  PID:8188
- C:\Windows\System\jVdYvBB.exe
  C:\Windows\System\jVdYvBB.exe
  2⤵
  PID:6868
- C:\Windows\System\LemWuVR.exe
  C:\Windows\System\LemWuVR.exe
  2⤵
  PID:7196
- C:\Windows\System\ftFheeD.exe
  C:\Windows\System\ftFheeD.exe
  2⤵
  PID:6856
- C:\Windows\System\gnhSCrp.exe
  C:\Windows\System\gnhSCrp.exe
  2⤵
  PID:6556
- C:\Windows\System\HTrGzwc.exe
  C:\Windows\System\HTrGzwc.exe
  2⤵
  PID:7284
- C:\Windows\System\FRHbJpB.exe
  C:\Windows\System\FRHbJpB.exe
  2⤵
  PID:7312
- C:\Windows\System\KvzjPKl.exe
  C:\Windows\System\KvzjPKl.exe
  2⤵
  PID:7348
- C:\Windows\System\jMKwjFm.exe
  C:\Windows\System\jMKwjFm.exe
  2⤵
  PID:7300
- C:\Windows\System\goaxWjw.exe
  C:\Windows\System\goaxWjw.exe
  2⤵
  PID:7364
- C:\Windows\System\xxcRNuL.exe
  C:\Windows\System\xxcRNuL.exe
  2⤵
  PID:7396
- C:\Windows\System\fESJgPh.exe
  C:\Windows\System\fESJgPh.exe
  2⤵
  PID:7432
- C:\Windows\System\HijbGpr.exe
  C:\Windows\System\HijbGpr.exe
  2⤵
  PID:7472
- C:\Windows\System\aVUURKM.exe
  C:\Windows\System\aVUURKM.exe
  2⤵
  PID:7548
- C:\Windows\System\UgQwlqw.exe
  C:\Windows\System\UgQwlqw.exe
  2⤵
  PID:7560
- C:\Windows\System\LahwvnC.exe
  C:\Windows\System\LahwvnC.exe
  2⤵
  PID:7524
- C:\Windows\System\kgjYSZr.exe
  C:\Windows\System\kgjYSZr.exe
  2⤵
  PID:7600
- C:\Windows\System\BHbfZWL.exe
  C:\Windows\System\BHbfZWL.exe
  2⤵
  PID:7692
- C:\Windows\System\vsPRret.exe
  C:\Windows\System\vsPRret.exe
  2⤵
  PID:7660
- C:\Windows\System\NASptPS.exe
  C:\Windows\System\NASptPS.exe
  2⤵
  PID:7608
- C:\Windows\System\oDTxHtl.exe
  C:\Windows\System\oDTxHtl.exe
  2⤵
  PID:7752
- C:\Windows\System\YXXVlnm.exe
  C:\Windows\System\YXXVlnm.exe
  2⤵
  PID:7780
- C:\Windows\System\euwwrta.exe
  C:\Windows\System\euwwrta.exe
  2⤵
  PID:7832
- C:\Windows\System\atUeDzk.exe
  C:\Windows\System\atUeDzk.exe
  2⤵
  PID:7900
- C:\Windows\System\pgAziWy.exe
  C:\Windows\System\pgAziWy.exe
  2⤵
  PID:7768
- C:\Windows\System\ClAlMht.exe
  C:\Windows\System\ClAlMht.exe
  2⤵
  PID:7948
- C:\Windows\System\OjSkENR.exe
  C:\Windows\System\OjSkENR.exe
  2⤵
  PID:7848
- C:\Windows\System\CzOEFfB.exe
  C:\Windows\System\CzOEFfB.exe
  2⤵
  PID:7960
- C:\Windows\System\eSKifTN.exe
  C:\Windows\System\eSKifTN.exe
  2⤵
  PID:7996
- C:\Windows\System\BRRnThd.exe
  C:\Windows\System\BRRnThd.exe
  2⤵
  PID:8068
- C:\Windows\System\cyMzzkA.exe
  C:\Windows\System\cyMzzkA.exe
  2⤵
  PID:8108
- C:\Windows\System\jHBtYvN.exe
  C:\Windows\System\jHBtYvN.exe
  2⤵
  PID:8124
- C:\Windows\System\AlPJZte.exe
  C:\Windows\System\AlPJZte.exe
  2⤵
  PID:8144
- C:\Windows\System\DQAvvEV.exe
  C:\Windows\System\DQAvvEV.exe
  2⤵
  PID:8160
- C:\Windows\System\IzRgwfj.exe
  C:\Windows\System\IzRgwfj.exe
  2⤵
  PID:8132
- C:\Windows\System\bZdoHZA.exe
  C:\Windows\System\bZdoHZA.exe
  2⤵
  PID:6928
- C:\Windows\System\YQApnAG.exe
  C:\Windows\System\YQApnAG.exe
  2⤵
  PID:7192
- C:\Windows\System\dYlUSiJ.exe
  C:\Windows\System\dYlUSiJ.exe
  2⤵
  PID:7164
- C:\Windows\System\BgPLczy.exe
  C:\Windows\System\BgPLczy.exe
  2⤵
  PID:7220
- C:\Windows\System\WhndoPv.exe
  C:\Windows\System\WhndoPv.exe
  2⤵
  PID:7352
- C:\Windows\System\frgyBtJ.exe
  C:\Windows\System\frgyBtJ.exe
  2⤵
  PID:7376
- C:\Windows\System\tlMpDiq.exe
  C:\Windows\System\tlMpDiq.exe
  2⤵
  PID:7388
- C:\Windows\System\StwewMl.exe
  C:\Windows\System\StwewMl.exe
  2⤵
  PID:7500
- C:\Windows\System\ogJsoog.exe
  C:\Windows\System\ogJsoog.exe
  2⤵
  PID:7436
- C:\Windows\System\qeNwhnw.exe
  C:\Windows\System\qeNwhnw.exe
  2⤵
  PID:7520
- C:\Windows\System\lErIOeP.exe
  C:\Windows\System\lErIOeP.exe
  2⤵
  PID:7728
- C:\Windows\System\ixSwGBY.exe
  C:\Windows\System\ixSwGBY.exe
  2⤵
  PID:7884
- C:\Windows\System\aLuZtBL.exe
  C:\Windows\System\aLuZtBL.exe
  2⤵
  PID:7640
- C:\Windows\System\oFXsKvC.exe
  C:\Windows\System\oFXsKvC.exe
  2⤵
  PID:8028
- C:\Windows\System\LXrnFEU.exe
  C:\Windows\System\LXrnFEU.exe
  2⤵
  PID:8032
- C:\Windows\System\nNxduhH.exe
  C:\Windows\System\nNxduhH.exe
  2⤵
  PID:7800
- C:\Windows\System\UyZXbyH.exe
  C:\Windows\System\UyZXbyH.exe
  2⤵
  PID:8152
- C:\Windows\System\uLjfgtH.exe
  C:\Windows\System\uLjfgtH.exe
  2⤵
  PID:6828
- C:\Windows\System\vsXyXuJ.exe
  C:\Windows\System\vsXyXuJ.exe
  2⤵
  PID:7336
- C:\Windows\System\WbNCoTd.exe
  C:\Windows\System\WbNCoTd.exe
  2⤵
  PID:7888
- C:\Windows\System\LaDjzok.exe
  C:\Windows\System\LaDjzok.exe
  2⤵
  PID:6668
- C:\Windows\System\CZQxwZI.exe
  C:\Windows\System\CZQxwZI.exe
  2⤵
  PID:7624
- C:\Windows\System\pANWAHw.exe
  C:\Windows\System\pANWAHw.exe
  2⤵
  PID:8052
- C:\Windows\System\kQYRWZF.exe
  C:\Windows\System\kQYRWZF.exe
  2⤵
  PID:7404
- C:\Windows\System\HFtKnaI.exe
  C:\Windows\System\HFtKnaI.exe
  2⤵
  PID:8076
- C:\Windows\System\hoSpDRk.exe
  C:\Windows\System\hoSpDRk.exe
  2⤵
  PID:7956
- C:\Windows\System\hKGZwta.exe
  C:\Windows\System\hKGZwta.exe
  2⤵
  PID:7868
- C:\Windows\System\rPAcZEq.exe
  C:\Windows\System\rPAcZEq.exe
  2⤵
  PID:7748
- C:\Windows\System\posXIqi.exe
  C:\Windows\System\posXIqi.exe
  2⤵
  PID:8120
- C:\Windows\System\uVRTcQA.exe
  C:\Windows\System\uVRTcQA.exe
  2⤵
  PID:7796
- C:\Windows\System\wKmZdER.exe
  C:\Windows\System\wKmZdER.exe
  2⤵
  PID:7232
- C:\Windows\System\QpjrdJB.exe
  C:\Windows\System\QpjrdJB.exe
  2⤵
  PID:7540
- C:\Windows\System\unlRlKf.exe
  C:\Windows\System\unlRlKf.exe
  2⤵
  PID:7980
- C:\Windows\System\XxXEuDc.exe
  C:\Windows\System\XxXEuDc.exe
  2⤵
  PID:8072
- C:\Windows\System\qYcYsEr.exe
  C:\Windows\System\qYcYsEr.exe
  2⤵
  PID:7184
- C:\Windows\System\dsPdcFV.exe
  C:\Windows\System\dsPdcFV.exe
  2⤵
  PID:7264
- C:\Windows\System\nUtzevu.exe
  C:\Windows\System\nUtzevu.exe
  2⤵
  PID:7212
- C:\Windows\System\ZBmsOSR.exe
  C:\Windows\System\ZBmsOSR.exe
  2⤵
  PID:7568
- C:\Windows\System\SuxlfIS.exe
  C:\Windows\System\SuxlfIS.exe
  2⤵
  PID:7180
- C:\Windows\System\KIhyrbU.exe
  C:\Windows\System\KIhyrbU.exe
  2⤵
  PID:7356
- C:\Windows\System\DaiZCgm.exe
  C:\Windows\System\DaiZCgm.exe
  2⤵
  PID:8156
- C:\Windows\System\HiWYFmh.exe
  C:\Windows\System\HiWYFmh.exe
  2⤵
  PID:8212
- C:\Windows\System\ElfpPzx.exe
  C:\Windows\System\ElfpPzx.exe
  2⤵
  PID:8228
- C:\Windows\System\lhBoDQm.exe
  C:\Windows\System\lhBoDQm.exe
  2⤵
  PID:8244
- C:\Windows\System\nomaWGB.exe
  C:\Windows\System\nomaWGB.exe
  2⤵
  PID:8264
- C:\Windows\System\DsOTAit.exe
  C:\Windows\System\DsOTAit.exe
  2⤵
  PID:8280
- C:\Windows\System\VREgqBr.exe
  C:\Windows\System\VREgqBr.exe
  2⤵
  PID:8308
- C:\Windows\System\LOMpxbj.exe
  C:\Windows\System\LOMpxbj.exe
  2⤵
  PID:8328
- C:\Windows\System\fcuGHHO.exe
  C:\Windows\System\fcuGHHO.exe
  2⤵
  PID:8344
- C:\Windows\System\AxMyNCM.exe
  C:\Windows\System\AxMyNCM.exe
  2⤵
  PID:8364
- C:\Windows\System\bPBHXpu.exe
  C:\Windows\System\bPBHXpu.exe
  2⤵
  PID:8396
- C:\Windows\System\HrdzDuE.exe
  C:\Windows\System\HrdzDuE.exe
  2⤵
  PID:8412
- C:\Windows\System\uLJChvg.exe
  C:\Windows\System\uLJChvg.exe
  2⤵
  PID:8456
- C:\Windows\System\lSXggzR.exe
  C:\Windows\System\lSXggzR.exe
  2⤵
  PID:8472
- C:\Windows\System\owkmFGd.exe
  C:\Windows\System\owkmFGd.exe
  2⤵
  PID:8488
- C:\Windows\System\QpsNmkg.exe
  C:\Windows\System\QpsNmkg.exe
  2⤵
  PID:8504
- C:\Windows\System\kKVUZTw.exe
  C:\Windows\System\kKVUZTw.exe
  2⤵
  PID:8524
- C:\Windows\System\rkQhnSN.exe
  C:\Windows\System\rkQhnSN.exe
  2⤵
  PID:8556
- C:\Windows\System\rdCFDVo.exe
  C:\Windows\System\rdCFDVo.exe
  2⤵
  PID:8572
- C:\Windows\System\DxACvYe.exe
  C:\Windows\System\DxACvYe.exe
  2⤵
  PID:8592
- C:\Windows\System\UQVfJXM.exe
  C:\Windows\System\UQVfJXM.exe
  2⤵
  PID:8612
- C:\Windows\System\MdMgERP.exe
  C:\Windows\System\MdMgERP.exe
  2⤵
  PID:8628
- C:\Windows\System\LcfuRzs.exe
  C:\Windows\System\LcfuRzs.exe
  2⤵
  PID:8652
- C:\Windows\System\RFYIgLg.exe
  C:\Windows\System\RFYIgLg.exe
  2⤵
  PID:8668
- C:\Windows\System\NQqJSju.exe
  C:\Windows\System\NQqJSju.exe
  2⤵
  PID:8688
- C:\Windows\System\FqWLpYK.exe
  C:\Windows\System\FqWLpYK.exe
  2⤵
  PID:8708
- C:\Windows\System\GKnXKMu.exe
  C:\Windows\System\GKnXKMu.exe
  2⤵
  PID:8724
- C:\Windows\System\ttMfzeO.exe
  C:\Windows\System\ttMfzeO.exe
  2⤵
  PID:8740
- C:\Windows\System\DNPrfLq.exe
  C:\Windows\System\DNPrfLq.exe
  2⤵
  PID:8776
- C:\Windows\System\PJxPAsd.exe
  C:\Windows\System\PJxPAsd.exe
  2⤵
  PID:8792
- C:\Windows\System\hMHdqpR.exe
  C:\Windows\System\hMHdqpR.exe
  2⤵
  PID:8808
- C:\Windows\System\aBuhdbL.exe
  C:\Windows\System\aBuhdbL.exe
  2⤵
  PID:8856
- C:\Windows\System\JugrMtg.exe
  C:\Windows\System\JugrMtg.exe
  2⤵
  PID:8872
- C:\Windows\System\FQGjwjQ.exe
  C:\Windows\System\FQGjwjQ.exe
  2⤵
  PID:8888
- C:\Windows\System\DjIVleo.exe
  C:\Windows\System\DjIVleo.exe
  2⤵
  PID:8920
- C:\Windows\System\wSTJeQv.exe
  C:\Windows\System\wSTJeQv.exe
  2⤵
  PID:8936
- C:\Windows\System\CBqgvxc.exe
  C:\Windows\System\CBqgvxc.exe
  2⤵
  PID:8952
- C:\Windows\System\fQVixND.exe
  C:\Windows\System\fQVixND.exe
  2⤵
  PID:8976
- C:\Windows\System\KvrKTxQ.exe
  C:\Windows\System\KvrKTxQ.exe
  2⤵
  PID:9000
- C:\Windows\System\zSJMpjY.exe
  C:\Windows\System\zSJMpjY.exe
  2⤵
  PID:9016
- C:\Windows\System\UWhuszt.exe
  C:\Windows\System\UWhuszt.exe
  2⤵
  PID:9032
- C:\Windows\System\kYLogfL.exe
  C:\Windows\System\kYLogfL.exe
  2⤵
  PID:9048
- C:\Windows\System\MuSNlOn.exe
  C:\Windows\System\MuSNlOn.exe
  2⤵
  PID:9072
- C:\Windows\System\WLIEYbD.exe
  C:\Windows\System\WLIEYbD.exe
  2⤵
  PID:9100
- C:\Windows\System\iyulNSk.exe
  C:\Windows\System\iyulNSk.exe
  2⤵
  PID:9120
- C:\Windows\System\FgZMGEo.exe
  C:\Windows\System\FgZMGEo.exe
  2⤵
  PID:9140
- C:\Windows\System\wLJvPhs.exe
  C:\Windows\System\wLJvPhs.exe
  2⤵
  PID:9156
- C:\Windows\System\ITrjATO.exe
  C:\Windows\System\ITrjATO.exe
  2⤵
  PID:9172
- C:\Windows\System\xDGnkyz.exe
  C:\Windows\System\xDGnkyz.exe
  2⤵
  PID:9204
- C:\Windows\System\dMWPoGC.exe
  C:\Windows\System\dMWPoGC.exe
  2⤵
  PID:7744
- C:\Windows\System\gGlDdRm.exe
  C:\Windows\System\gGlDdRm.exe
  2⤵
  PID:8016
- C:\Windows\System\LTMcbZd.exe
  C:\Windows\System\LTMcbZd.exe
  2⤵
  PID:8260
- C:\Windows\System\YBUhkzi.exe
  C:\Windows\System\YBUhkzi.exe
  2⤵
  PID:8300
- C:\Windows\System\eUZtBow.exe
  C:\Windows\System\eUZtBow.exe
  2⤵
  PID:7880
- C:\Windows\System\nUrKjen.exe
  C:\Windows\System\nUrKjen.exe
  2⤵
  PID:8372
- C:\Windows\System\kepHylq.exe
  C:\Windows\System\kepHylq.exe
  2⤵
  PID:7620
- C:\Windows\System\HMHgOBC.exe
  C:\Windows\System\HMHgOBC.exe
  2⤵
  PID:7596
- C:\Windows\System\lksPHwZ.exe
  C:\Windows\System\lksPHwZ.exe
  2⤵
  PID:8208
- C:\Windows\System\ZqWRIFF.exe
  C:\Windows\System\ZqWRIFF.exe
  2⤵
  PID:8320
- C:\Windows\System\kQuHDbj.exe
  C:\Windows\System\kQuHDbj.exe
  2⤵
  PID:8428
- C:\Windows\System\WyGYlaw.exe
  C:\Windows\System\WyGYlaw.exe
  2⤵
  PID:8452
- C:\Windows\System\gHsuQPn.exe
  C:\Windows\System\gHsuQPn.exe
  2⤵
  PID:8272
- C:\Windows\System\CBYdpYB.exe
  C:\Windows\System\CBYdpYB.exe
  2⤵
  PID:8464
- C:\Windows\System\kNXuHZo.exe
  C:\Windows\System\kNXuHZo.exe
  2⤵
  PID:8520
- C:\Windows\System\BvwMPJC.exe
  C:\Windows\System\BvwMPJC.exe
  2⤵
  PID:8500
- C:\Windows\System\JRJdNKH.exe
  C:\Windows\System\JRJdNKH.exe
  2⤵
  PID:8568
- C:\Windows\System\yADdkEg.exe
  C:\Windows\System\yADdkEg.exe
  2⤵
  PID:8604
- C:\Windows\System\FpulyIa.exe
  C:\Windows\System\FpulyIa.exe
  2⤵
  PID:8716
- C:\Windows\System\BaHCOqP.exe
  C:\Windows\System\BaHCOqP.exe
  2⤵
  PID:8764
- C:\Windows\System\eKjQpry.exe
  C:\Windows\System\eKjQpry.exe
  2⤵
  PID:8756
- C:\Windows\System\HSpNTVp.exe
  C:\Windows\System\HSpNTVp.exe
  2⤵
  PID:8784
- C:\Windows\System\PhzAyRk.exe
  C:\Windows\System\PhzAyRk.exe
  2⤵
  PID:8788
- C:\Windows\System\dtLbHXO.exe
  C:\Windows\System\dtLbHXO.exe
  2⤵
  PID:8840
- C:\Windows\System\wGIVwZk.exe
  C:\Windows\System\wGIVwZk.exe
  2⤵
  PID:932
- C:\Windows\System\ndlPUff.exe
  C:\Windows\System\ndlPUff.exe
  2⤵
  PID:8868
- C:\Windows\System\uBaArlN.exe
  C:\Windows\System\uBaArlN.exe
  2⤵
  PID:8904
- C:\Windows\System\kpGEYQL.exe
  C:\Windows\System\kpGEYQL.exe
  2⤵
  PID:8928
- C:\Windows\System\aiYVpcD.exe
  C:\Windows\System\aiYVpcD.exe
  2⤵
  PID:8984
- C:\Windows\System\AMEDTdR.exe
  C:\Windows\System\AMEDTdR.exe
  2⤵
  PID:8968
- C:\Windows\System\eSAKEgj.exe
  C:\Windows\System\eSAKEgj.exe
  2⤵
  PID:9028
- C:\Windows\System\znNoYjT.exe
  C:\Windows\System\znNoYjT.exe
  2⤵
  PID:9108
- C:\Windows\System\idtRUGG.exe
  C:\Windows\System\idtRUGG.exe
  2⤵
  PID:9132
- C:\Windows\System\LkIWeJz.exe
  C:\Windows\System\LkIWeJz.exe
  2⤵
  PID:9180
- C:\Windows\System\lIUbzyh.exe
  C:\Windows\System\lIUbzyh.exe
  2⤵
  PID:9188
- C:\Windows\System\cJgqEgN.exe
  C:\Windows\System\cJgqEgN.exe
  2⤵
  PID:7940
- C:\Windows\System\pPHiTNf.exe
  C:\Windows\System\pPHiTNf.exe
  2⤵
  PID:8252
- C:\Windows\System\WcemIvE.exe
  C:\Windows\System\WcemIvE.exe
  2⤵
  PID:8376
- C:\Windows\System\yVGQObM.exe
  C:\Windows\System\yVGQObM.exe
  2⤵
  PID:7952
- C:\Windows\System\jRpyXRY.exe
  C:\Windows\System\jRpyXRY.exe
  2⤵
  PID:8448
- C:\Windows\System\cRHHwHg.exe
  C:\Windows\System\cRHHwHg.exe
  2⤵
  PID:8484
- C:\Windows\System\wGelauq.exe
  C:\Windows\System\wGelauq.exe
  2⤵
  PID:8600
- C:\Windows\System\rzpUGwP.exe
  C:\Windows\System\rzpUGwP.exe
  2⤵
  PID:8436
- C:\Windows\System\pVCzHkb.exe
  C:\Windows\System\pVCzHkb.exe
  2⤵
  PID:8608
- C:\Windows\System\dQHHpXx.exe
  C:\Windows\System\dQHHpXx.exe
  2⤵
  PID:8240
- C:\Windows\System\zWdhKqd.exe
  C:\Windows\System\zWdhKqd.exe
  2⤵
  PID:8660
- C:\Windows\System\qLtfhPm.exe
  C:\Windows\System\qLtfhPm.exe
  2⤵
  PID:8676
- C:\Windows\System\vBEGeWL.exe
  C:\Windows\System\vBEGeWL.exe
  2⤵
  PID:8696
- C:\Windows\System\bVbvZaC.exe
  C:\Windows\System\bVbvZaC.exe
  2⤵
  PID:8816
- C:\Windows\System\BUzlYnD.exe
  C:\Windows\System\BUzlYnD.exe
  2⤵
  PID:8852
- C:\Windows\System\hejbmyE.exe
  C:\Windows\System\hejbmyE.exe
  2⤵
  PID:8972
- C:\Windows\System\OHzcRmy.exe
  C:\Windows\System\OHzcRmy.exe
  2⤵
  PID:8996
- C:\Windows\System\jZEsjOg.exe
  C:\Windows\System\jZEsjOg.exe
  2⤵
  PID:8948
- C:\Windows\System\wzliUUw.exe
  C:\Windows\System\wzliUUw.exe
  2⤵
  PID:9064
- C:\Windows\System\zgWLPYC.exe
  C:\Windows\System\zgWLPYC.exe
  2⤵
  PID:8684
- C:\Windows\System\EpvlEle.exe
  C:\Windows\System\EpvlEle.exe
  2⤵
  PID:9196
- C:\Windows\System\kuDPlXo.exe
  C:\Windows\System\kuDPlXo.exe
  2⤵
  PID:6260
- C:\Windows\System\uxDzpHR.exe
  C:\Windows\System\uxDzpHR.exe
  2⤵
  PID:8288
- C:\Windows\System\QGfHwVa.exe
  C:\Windows\System\QGfHwVa.exe
  2⤵
  PID:7216
- C:\Windows\System\EixloDN.exe
  C:\Windows\System\EixloDN.exe
  2⤵
  PID:8444
- C:\Windows\System\lZWeCfM.exe
  C:\Windows\System\lZWeCfM.exe
  2⤵
  PID:8540
- C:\Windows\System\GvNGvZK.exe
  C:\Windows\System\GvNGvZK.exe
  2⤵
  PID:8352
- C:\Windows\System\FtvpBEa.exe
  C:\Windows\System\FtvpBEa.exe
  2⤵
  PID:8760
- C:\Windows\System\AuNaVqW.exe
  C:\Windows\System\AuNaVqW.exe
  2⤵
  PID:8536
- C:\Windows\System\XjBdJhW.exe
  C:\Windows\System\XjBdJhW.exe
  2⤵
  PID:8964
- C:\Windows\System\DUujBlc.exe
  C:\Windows\System\DUujBlc.exe
  2⤵
  PID:8820
- C:\Windows\System\BiHluoF.exe
  C:\Windows\System\BiHluoF.exe
  2⤵
  PID:8908
- C:\Windows\System\lWDwYic.exe
  C:\Windows\System\lWDwYic.exe
  2⤵
  PID:9148
- C:\Windows\System\HunjRZc.exe
  C:\Windows\System\HunjRZc.exe
  2⤵
  PID:9080
- C:\Windows\System\SuYpCyu.exe
  C:\Windows\System\SuYpCyu.exe
  2⤵
  PID:9200
- C:\Windows\System\mltCVam.exe
  C:\Windows\System\mltCVam.exe
  2⤵
  PID:9092
- C:\Windows\System\PSjabFq.exe
  C:\Windows\System\PSjabFq.exe
  2⤵
  PID:8588
- C:\Windows\System\FXhnogz.exe
  C:\Windows\System\FXhnogz.exe
  2⤵
  PID:8432
- C:\Windows\System\lvWcbVD.exe
  C:\Windows\System\lvWcbVD.exe
  2⤵
  PID:2544
- C:\Windows\System\BzlSqQL.exe
  C:\Windows\System\BzlSqQL.exe
  2⤵
  PID:8480
- C:\Windows\System\IInvVDU.exe
  C:\Windows\System\IInvVDU.exe
  2⤵
  PID:9060
- C:\Windows\System\woPAJEc.exe
  C:\Windows\System\woPAJEc.exe
  2⤵
  PID:8916
- C:\Windows\System\mobSraO.exe
  C:\Windows\System\mobSraO.exe
  2⤵
  PID:9008
- C:\Windows\System\LUfifPw.exe
  C:\Windows\System\LUfifPw.exe
  2⤵
  PID:8336
- C:\Windows\System\fJQWbat.exe
  C:\Windows\System\fJQWbat.exe
  2⤵
  PID:8896
- C:\Windows\System\rxIYqgP.exe
  C:\Windows\System\rxIYqgP.exe
  2⤵
  PID:8620
- C:\Windows\System\MURFcdo.exe
  C:\Windows\System\MURFcdo.exe
  2⤵
  PID:8732
- C:\Windows\System\LdGvJzw.exe
  C:\Windows\System\LdGvJzw.exe
  2⤵
  PID:7484
- C:\Windows\System\KciOzou.exe
  C:\Windows\System\KciOzou.exe
  2⤵
  PID:8408
- C:\Windows\System\GJBtYBf.exe
  C:\Windows\System\GJBtYBf.exe
  2⤵
  PID:9088
- C:\Windows\System\gsOoFzp.exe
  C:\Windows\System\gsOoFzp.exe
  2⤵
  PID:7864
- C:\Windows\System\LDnGZqd.exe
  C:\Windows\System\LDnGZqd.exe
  2⤵
  PID:9164
- C:\Windows\System\QxSXqWN.exe
  C:\Windows\System\QxSXqWN.exe
  2⤵
  PID:9228
- C:\Windows\System\moMcguK.exe
  C:\Windows\System\moMcguK.exe
  2⤵
  PID:9244
- C:\Windows\System\vBjfHxC.exe
  C:\Windows\System\vBjfHxC.exe
  2⤵
  PID:9260
- C:\Windows\System\gznlceL.exe
  C:\Windows\System\gznlceL.exe
  2⤵
  PID:9276
- C:\Windows\System\VHXunrT.exe
  C:\Windows\System\VHXunrT.exe
  2⤵
  PID:9292
- C:\Windows\System\cVXAgBc.exe
  C:\Windows\System\cVXAgBc.exe
  2⤵
  PID:9308
- C:\Windows\System\LIriNCA.exe
  C:\Windows\System\LIriNCA.exe
  2⤵
  PID:9328
- C:\Windows\System\xERpbEZ.exe
  C:\Windows\System\xERpbEZ.exe
  2⤵
  PID:9348
- C:\Windows\System\KKTfeLG.exe
  C:\Windows\System\KKTfeLG.exe
  2⤵
  PID:9364
- C:\Windows\System\QzWaqsw.exe
  C:\Windows\System\QzWaqsw.exe
  2⤵
  PID:9384
- C:\Windows\System\qlIqzVV.exe
  C:\Windows\System\qlIqzVV.exe
  2⤵
  PID:9420
- C:\Windows\System\NgrsMuS.exe
  C:\Windows\System\NgrsMuS.exe
  2⤵
  PID:9436
- C:\Windows\System\auvlmwI.exe
  C:\Windows\System\auvlmwI.exe
  2⤵
  PID:9456
- C:\Windows\System\SHMsQWX.exe
  C:\Windows\System\SHMsQWX.exe
  2⤵
  PID:9492
- C:\Windows\System\fcUrjGq.exe
  C:\Windows\System\fcUrjGq.exe
  2⤵
  PID:9508
- C:\Windows\System\UvITDMc.exe
  C:\Windows\System\UvITDMc.exe
  2⤵
  PID:9528
- C:\Windows\System\KZNZGSx.exe
  C:\Windows\System\KZNZGSx.exe
  2⤵
  PID:9544
- C:\Windows\System\ZEQPDID.exe
  C:\Windows\System\ZEQPDID.exe
  2⤵
  PID:9580
- C:\Windows\System\GDbzwcd.exe
  C:\Windows\System\GDbzwcd.exe
  2⤵
  PID:9604
- C:\Windows\System\rJhOmUR.exe
  C:\Windows\System\rJhOmUR.exe
  2⤵
  PID:9620
- C:\Windows\System\jtQkDMF.exe
  C:\Windows\System\jtQkDMF.exe
  2⤵
  PID:9640
- C:\Windows\System\aWHDBWp.exe
  C:\Windows\System\aWHDBWp.exe
  2⤵
  PID:9656
- C:\Windows\System\fdUjjIH.exe
  C:\Windows\System\fdUjjIH.exe
  2⤵
  PID:9672
- C:\Windows\System\fgOEsbg.exe
  C:\Windows\System\fgOEsbg.exe
  2⤵
  PID:9708
- C:\Windows\System\BGWAjjb.exe
  C:\Windows\System\BGWAjjb.exe
  2⤵
  PID:9724
- C:\Windows\System\UXkNRnV.exe
  C:\Windows\System\UXkNRnV.exe
  2⤵
  PID:9740
- C:\Windows\System\wbHgZUT.exe
  C:\Windows\System\wbHgZUT.exe
  2⤵
  PID:9756
- C:\Windows\System\BGENYxG.exe
  C:\Windows\System\BGENYxG.exe
  2⤵
  PID:9788
- C:\Windows\System\QBmBYBe.exe
  C:\Windows\System\QBmBYBe.exe
  2⤵
  PID:9804
- C:\Windows\System\voNEQEl.exe
  C:\Windows\System\voNEQEl.exe
  2⤵
  PID:9820
- C:\Windows\System\UPAfjVj.exe
  C:\Windows\System\UPAfjVj.exe
  2⤵
  PID:9844
- C:\Windows\System\IxiEsei.exe
  C:\Windows\System\IxiEsei.exe
  2⤵
  PID:9860
- C:\Windows\System\ZSDmGHD.exe
  C:\Windows\System\ZSDmGHD.exe
  2⤵
  PID:9880
- C:\Windows\System\AkjLXyu.exe
  C:\Windows\System\AkjLXyu.exe
  2⤵
  PID:9908
- C:\Windows\System\puVEMTX.exe
  C:\Windows\System\puVEMTX.exe
  2⤵
  PID:9924
- C:\Windows\System\quuvdJD.exe
  C:\Windows\System\quuvdJD.exe
  2⤵
  PID:9940
- C:\Windows\System\IKwynhQ.exe
  C:\Windows\System\IKwynhQ.exe
  2⤵
  PID:9956
- C:\Windows\System\dtWDNPr.exe
  C:\Windows\System\dtWDNPr.exe
  2⤵
  PID:9972
- C:\Windows\System\CTcNIwJ.exe
  C:\Windows\System\CTcNIwJ.exe
  2⤵
  PID:10008
- C:\Windows\System\WESREiG.exe
  C:\Windows\System\WESREiG.exe
  2⤵
  PID:10024
- C:\Windows\System\wwqJvWY.exe
  C:\Windows\System\wwqJvWY.exe
  2⤵
  PID:10040
- C:\Windows\System\RXPFXyI.exe
  C:\Windows\System\RXPFXyI.exe
  2⤵
  PID:10056
- C:\Windows\System\wIdPktm.exe
  C:\Windows\System\wIdPktm.exe
  2⤵
  PID:10096
- C:\Windows\System\DBDbamj.exe
  C:\Windows\System\DBDbamj.exe
  2⤵
  PID:10112
- C:\Windows\System\wAJFuTH.exe
  C:\Windows\System\wAJFuTH.exe
  2⤵
  PID:10132
- C:\Windows\System\IFSAflP.exe
  C:\Windows\System\IFSAflP.exe
  2⤵
  PID:10152
- C:\Windows\System\SocsScz.exe
  C:\Windows\System\SocsScz.exe
  2⤵
  PID:10168
- C:\Windows\System\YrjtQCx.exe
  C:\Windows\System\YrjtQCx.exe
  2⤵
  PID:10184
- C:\Windows\System\hukveFp.exe
  C:\Windows\System\hukveFp.exe
  2⤵
  PID:10200
- C:\Windows\System\ASaACOv.exe
  C:\Windows\System\ASaACOv.exe
  2⤵
  PID:10236
- C:\Windows\System\GGcjkdU.exe
  C:\Windows\System\GGcjkdU.exe
  2⤵
  PID:9284
- C:\Windows\System\djvSXzM.exe
  C:\Windows\System\djvSXzM.exe
  2⤵
  PID:9252
- C:\Windows\System\NqDmRSJ.exe
  C:\Windows\System\NqDmRSJ.exe
  2⤵
  PID:9344
- C:\Windows\System\cHkodqy.exe
  C:\Windows\System\cHkodqy.exe
  2⤵
  PID:9336
- C:\Windows\System\nPRRiWl.exe
  C:\Windows\System\nPRRiWl.exe
  2⤵
  PID:9356
- C:\Windows\System\ylBMZkM.exe
  C:\Windows\System\ylBMZkM.exe
  2⤵
  PID:9392
- C:\Windows\System\aJhTyDw.exe
  C:\Windows\System\aJhTyDw.exe
  2⤵
  PID:9408
- C:\Windows\System\rYnJTAp.exe
  C:\Windows\System\rYnJTAp.exe
  2⤵
  PID:9452
- C:\Windows\System\oqIobeb.exe
  C:\Windows\System\oqIobeb.exe
  2⤵
  PID:9464
- C:\Windows\System\sWnKosX.exe
  C:\Windows\System\sWnKosX.exe
  2⤵
  PID:9500
- C:\Windows\System\pSycElv.exe
  C:\Windows\System\pSycElv.exe
  2⤵
  PID:9524
- C:\Windows\System\bjlBGrf.exe
  C:\Windows\System\bjlBGrf.exe
  2⤵
  PID:9564
- C:\Windows\System\zOyQQHG.exe
  C:\Windows\System\zOyQQHG.exe
  2⤵
  PID:9588
- C:\Windows\System\BrZLvEB.exe
  C:\Windows\System\BrZLvEB.exe
  2⤵
  PID:9520
- C:\Windows\System\UvziIWc.exe
  C:\Windows\System\UvziIWc.exe
  2⤵
  PID:9664
- C:\Windows\System\uKIogix.exe
  C:\Windows\System\uKIogix.exe
  2⤵
  PID:9576
- C:\Windows\System\fMOupoO.exe
  C:\Windows\System\fMOupoO.exe
  2⤵
  PID:9716
- C:\Windows\System\FkfYdxb.exe
  C:\Windows\System\FkfYdxb.exe
  2⤵
  PID:9752
- C:\Windows\System\oxXmWpV.exe
  C:\Windows\System\oxXmWpV.exe
  2⤵
  PID:9772
- C:\Windows\System\ylPOmPt.exe
  C:\Windows\System\ylPOmPt.exe
  2⤵
  PID:9796
- C:\Windows\System\pgOCAKw.exe
  C:\Windows\System\pgOCAKw.exe
  2⤵
  PID:9832
- C:\Windows\System\ItsHKsC.exe
  C:\Windows\System\ItsHKsC.exe
  2⤵
  PID:9888
- C:\Windows\System\OXqtqnU.exe
  C:\Windows\System\OXqtqnU.exe
  2⤵
  PID:9980
- C:\Windows\System\dMyZBsF.exe
  C:\Windows\System\dMyZBsF.exe
  2⤵
  PID:9996
- C:\Windows\System\LUuCHJD.exe
  C:\Windows\System\LUuCHJD.exe
  2⤵
  PID:9936
- C:\Windows\System\zPeLacV.exe
  C:\Windows\System\zPeLacV.exe
  2⤵
  PID:10032
- C:\Windows\System\bHGaqqo.exe
  C:\Windows\System\bHGaqqo.exe
  2⤵
  PID:10068
- C:\Windows\System\fiaxzHq.exe
  C:\Windows\System\fiaxzHq.exe
  2⤵
  PID:10092
- C:\Windows\System\LQXRXzS.exe
  C:\Windows\System\LQXRXzS.exe
  2⤵
  PID:10108
- C:\Windows\System\ecxRfJn.exe
  C:\Windows\System\ecxRfJn.exe
  2⤵
  PID:10144
- C:\Windows\System\eSHgAMx.exe
  C:\Windows\System\eSHgAMx.exe
  2⤵
  PID:10220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ALwlFvz.exe

Filesize
1.4MB

MD5
2c39272b7875943694a1e801b28e00db

SHA1
567e184baa60722196ac09ba66d27c9bfa3d48b2

SHA256
dc782f34740cc54011b7669319b631976dc2f3534124bff086fcdb55e3fc524a

SHA512
f712850ff0d9bab1d64ab91d2020d5c21ee7ac45de21424032fbcec37516d502194f3693a1d0b8e782a7f35b5c81f97c3052c444c147e58e131949985f80db0a

Download Submit
C:\Windows\system\AQTKjWB.exe

Filesize
1.4MB

MD5
10eee3aa88c360762a3735f5177daf07

SHA1
6f95506d97609341cb5d81a293d9794d143a14bc

SHA256
fa81bbfb2769892edabcadb2cce13796ecebc6f26d149496211378b32214b0da

SHA512
ddc8de090dadd40f639ed837ea89d0ba6d81a4e32fff658fef3d1e7ef4f68447fbbab603398eb01e60a129358497be778c183edd095b01a2438fb70ba388e95f

Download Submit
C:\Windows\system\BLHBvHv.exe

Filesize
1.4MB

MD5
663c88edd0a35cffc3f64006db54eb6b

SHA1
e29a31ffaffbfd1c0e5d5065564aae46c11cea59

SHA256
f5adbd3b466ab9a1b54630a2c0dd0618e5f48974472dfe470db736fc7769b457

SHA512
f12fa41b4ae7ce5bc24eb38a8d7f2af041035b4024795e979747b591da799c7bbd02a75b9037486fd387507310a8364fee6fc964cdaeca349459e01a0386a168

Download Submit
C:\Windows\system\HoblCgB.exe

Filesize
1.4MB

MD5
3a728d7fd0b52fec81859271b55c59fe

SHA1
d19d6045376b3567904a2bb42ad007cc6e8d0bb9

SHA256
fe7208ae5b4232b6f25b77603735913ce0959f9f5b723cf05932e9d0a50862b2

SHA512
f5d602950e97fbb510ea2ab3a5fcfbd90f4310da45d82a754ebb5bb71b6fc0ebc628d646e76234e2fb9b01c8730c8807d61d6d536f6a2da7ba9210d53f296804

Download Submit
C:\Windows\system\ISiOmwK.exe

Filesize
1.4MB

MD5
42043740f509930e6654687d674db806

SHA1
1ec40be63d3d9fd7dba9e6717e942d59095ab8c7

SHA256
4dfff3ad64ca149e0ee3222221cbaff0c769cb2f0dbed6474aea519d94a3cff5

SHA512
b2eb86349663efaa0f1eb94c6247ca064f11ebb48a8c60c98b2086147c431f85fc202075c29b998ca41257e0d173ec67cecc0a82bda3e3e0367e67fff4c36711

Download Submit
C:\Windows\system\NbJttcV.exe

Filesize
1.4MB

MD5
ce7c659a3a3b460e198e89175e05b77f

SHA1
c7e353c1300901e29db19c7b56da2d2489ba5c33

SHA256
c406d1d133cd3d2f324d43d380c01248107d2bb1cad6b22cf70785e31756db52

SHA512
a499b1dfc79745c9c7c138edb06bc44727188e5aca38c450f96beb3cc539636bb0772118a46cc379c1976328c48737724e1c82f35798e9a6286208f70b149834

Download Submit
C:\Windows\system\ODCGHjV.exe

Filesize
1.4MB

MD5
fea89b2f74f7feea824c8659827e074a

SHA1
e73b96a27a7d05e5302c9e7621ad62f74850693a

SHA256
8bc1743a49bdd2c383718debf081d0388cf36f03d28f0d686b54bd186c0e5a14

SHA512
ca16a4fd06ec053031bf577ade5f2658444e42076f16aae91130d114c69720280c07f7aa50fdbd232321c81e6ea570d6477351bd1c2af47e6a6842ac87658622

Download Submit
C:\Windows\system\OUODmBj.exe

Filesize
1.4MB

MD5
067c5ba28c00f730bbb425d4d58ac9c7

SHA1
870f2d621ddf0488346751a4c2a90c0d3ccd0055

SHA256
7229db937237776520c761730402161e69ee9c15547c06edaf100edf30d46a7a

SHA512
baf4db5d3c1eafef540ca081ed48cfb89e236937a02d70cd64def17256ab2112b1516a3962c2fd6b0a292a9c94616d027341dda97e71772f883dcc92c564d87e

Download Submit
C:\Windows\system\OqAAuKZ.exe

Filesize
1.4MB

MD5
d4ccb1d2763f1d226044a4055c78f14e

SHA1
f0f27432771e46518a8921f6de1ce5e1d05b91b8

SHA256
de83f09fd7cca2f96dbbf47deb8b026617d04e93ad6dfb74b59f239215c68381

SHA512
5f9952077925e787a90e822373fd4fde547d6d723e35032e6a2db73cb29b6829b8f9c76f5a785275e50ea702c2b62e217923babb2e2ad7abdf08da23ec21d2c3

Download Submit
C:\Windows\system\SlVpSZV.exe

Filesize
1.4MB

MD5
b0da1a75066e90d108c35cf1ed5260f1

SHA1
26b566e165a9a013f8cbddb295ab7e17212e6bdd

SHA256
f871702be97fef1c3d35ee7d3a7b22dc7c363105fd68b4615b577c9356ad9f1a

SHA512
09ee712ee2299a0661e65c99703695b30011940b11294752e5b4c986d69ae935c39d4a9434e30e5e5231fa0d0933d9b083d44f4d3c10f780df152419f5ab86e0

Download Submit
C:\Windows\system\VLKFsdY.exe

Filesize
1.4MB

MD5
ce05bf3b9fa274f40631f26f773bf25c

SHA1
2ef633355ac529844e81ac52343147f9bf1fdf64

SHA256
ba85dec5a1afd3476ed43269da75b356b23545542a47d46804559330faf7fa52

SHA512
87781735b2824b48e40b1186a293d740dc6f3e17a60ccde5f567fcd7fa1c0456b989c22695d3dbe46e37ec777474b1e1f23b18b9ab93d6a75cf30bd57a94feba

Download Submit
C:\Windows\system\VbvcXNa.exe

Filesize
1.4MB

MD5
9b8702600d6fcef6d84fb8c2e907c207

SHA1
e50f39cc82d16ffeae2350fa65ee4ca6bbfb08cd

SHA256
7067a2d284490f57c2ff24ed9b188636aabca758739adb937f486de72ab58d4d

SHA512
8c8bf7bb32104f80c8bcb8c6f9d7ab1eb5c0707fe07ba91586c5a0bcf8f02b889c02157e74e78c4cf86dc2b873def4add22f5115274b4502d4d8027c8421b77c

Download Submit
C:\Windows\system\WlUgMRJ.exe

Filesize
1.4MB

MD5
41459b17618fcbe19ae49ce75747b153

SHA1
0ca064fa69452666088c5e4fbacbb7641ca8a998

SHA256
00130e45ae7d85ab4410c1e86fd5bfa41086d8115f2aff1eb0168aabeafe5409

SHA512
4d799c1ea9385aa67d7f2f8f593c8fb423d87a3cd38f7e9536fe1e4261d609bc87a1d8473e21ed3d78c8e9ee34a111aed555c3a261f2f2b09a853d30b565a765

Download Submit
C:\Windows\system\aKGNCgl.exe

Filesize
1.4MB

MD5
5b788363c6dff90d4c9be8a03a965908

SHA1
fe3eb5c49fc4b61b23721461a17f1069075673ed

SHA256
837b4af617efba41832f59bfdbb17aa82269011b1aecfecb0c9a4cbd741afc1a

SHA512
ff0885948fdadfd8c2081c122eec0c6da2971ce20e821b1b346f47bfa8adfdc20835c1690f5821939e40f921bab0acf29415cf27d60601edc1bf338e8e058d7a

Download Submit
C:\Windows\system\bxCiDOK.exe

Filesize
1.4MB

MD5
2fc0d433ce73378625b116795275be36

SHA1
5174215ef92bec35d846b79c3f4f7e449aafde91

SHA256
dba1ce1c677732d62774a2e117571c380446607cde5c6fe6bece988e624a0612

SHA512
396323395ba0654e7bc2870a004aff5f6b7514b4ed06cba1afaefd428a9994df8d4bf52a1515b1927b4452ec329c8824460d753db40685403326c7e4220c50ef

Download Submit
C:\Windows\system\ctPEabI.exe

Filesize
1.4MB

MD5
5e16e81982d7c62f04d82b072a02a329

SHA1
419f3bdaac8cfa8a87999ed599271dda27aedff7

SHA256
72f71200cdf62904e840f9b3942e4bc092ef541b31ce4ac45c0ced2ec1faab7f

SHA512
a1ed19dd782f77b58a3c9d2c23ba87a38a5bf64e94725a7dd0a45b6ba86a04230fbd8274f708827dbbc4807e9ecf6390366f8a5fb2e68ba051cdad70aa13b908

Download Submit
C:\Windows\system\dqXyJyv.exe

Filesize
1.4MB

MD5
37633c1e27bedcb4157ceefe92578735

SHA1
2a260369c8a166c61dd61f73d28a4417008d2b9e

SHA256
b9e3b4f7ab6a6b5c2069895af04b9da77c88be2ea9bde8328330e639f9806409

SHA512
be13c5c72ad95d0f3d9e777a897428f38176277721ff66e3e1075d68b6ed7cc29fbef12ecd05e0ab2d36291217105812a27491b88fe43464fbc6b9b9aa664c14

Download Submit
C:\Windows\system\erEPknh.exe

Filesize
1.4MB

MD5
aee98c4182daf03d691ee424409976e3

SHA1
5013efbba806f8cb355f405912a7f4e71d3faef9

SHA256
f449acb659b88bb34c2cded18fc00dbe478b85aeeeca474c01b593ecbe3d7068

SHA512
65a6b044cc780ca7eabab12d7b6e0b9ce11e2450d653938a62703dc0d95e71c1862d1e1c54f28f2f0057c59766d780e1ea574ada07d380ea42dbce2945a15948

Download Submit
C:\Windows\system\jtcVyjn.exe

Filesize
1.4MB

MD5
509ae6763cea8975e5468effee642c99

SHA1
39fa6e1cb3ce66c5afb7a3cad8b0566523c45637

SHA256
75794eefc96a7cfd12b9835df5fcda1e4e36cd9862ab579e63bedd38e73d9cc7

SHA512
0e055a196346b2f523cf9fc6302b762d4691d768f79e15c9fdb1abdeb34a24d4dfa8f3523111e89b80aa76df60d03f626bc716393123ea351006fbe8d4573dd5

Download Submit
C:\Windows\system\lCEFUJe.exe

Filesize
1.4MB

MD5
4b9cfb4af15cdb69a0dec65af536950e

SHA1
e92102a228fc1cb446ccffce7137d34e9e5a2b4a

SHA256
ab2c93f30ba494a44dacf2c83daa62688c9fc6a7557e64d3ede57f64d3c8b7a6

SHA512
3c9cb427a93fc4f613b44bd8de80ce1863a49f1e27f441302e6601d25bc1a7139b3d75da1ab411d7ca77d3098d89995f98836ead9f7a8b5d8612ac5f6ce307cd

Download Submit
C:\Windows\system\lyNAQZr.exe

Filesize
1.4MB

MD5
13b354bf2abe6420c11dad27640fd1e7

SHA1
e319eddf58e224eacc5d9562ecf7b86a8749bd4b

SHA256
2aef8048253c2604ca0001914ab0178c5305c441a32280e3d776cb4cf5f03e89

SHA512
b5ceddddbbc85ecbacb175130357c3c968b81333aafec0a5f74a1b692988b851d8ae68ec6146b27478d3459203463a8b708e4be9f07236b7c1faf7a2da01e1b3

Download Submit
C:\Windows\system\mnUVFGc.exe

Filesize
1.4MB

MD5
9066fc828828eade4f0c617eb438ebbd

SHA1
7c9a59ea9c0a21285a6f0e07236b9e21bae8ce56

SHA256
c44e3240deb4847ef2b54bca98ee0960c099af524dc7bda7337de6aef37630e9

SHA512
e2854123b1dbbef1cf69f8830780064cc229979ef6636bcb985493c444cf364791e803bdfbf194d3206fabc829a3e613c50826c2c72443acf41b7c4aef6f6e26

Download Submit
C:\Windows\system\oGCMyPG.exe

Filesize
1.4MB

MD5
4ada08247230611901c26e2be2c6ebbc

SHA1
48058e7828563422e649297540dc44941e3d9297

SHA256
0fa9a58e3e36cc7ba2669c99268b28a51e706322bdc04e96509f073b53b513cb

SHA512
05da8af9c5458a1bda55f064d8c126fe98f717fb58e3016daa2ff5073bf1b97caa58b7d522c5e854ac9407339e0d343bf73675d8c4dfb403e36888568c69fdea

Download Submit
C:\Windows\system\phKWGKk.exe

Filesize
1.4MB

MD5
988ca97099759a897e878651b1f192a7

SHA1
b4ed13bf9c788ae0b466f3538c74ddeca6c96076

SHA256
ab55f06b1151e9d5fb5af05502feb59508851396092b432e735c3e00429c0f49

SHA512
cea46844c8313caaf4d4f24b4f9b214fd13c0af3f532c8855eae27a062f8c4148bf47a9b39b64c1587048ab18229f6318e6ae673aa00ef90f76e6e0b696bf80c

Download Submit
C:\Windows\system\usXIyCF.exe

Filesize
1.4MB

MD5
2e6fc0757442f19693b3b5db2f864d35

SHA1
9c7a8b31b4776472e7f03d4882817f39c9956350

SHA256
053c685c497f0ec151045a3bca08c511418aaad2d22c5e81264c8273902f47c6

SHA512
ce16e1333b047e662fae2d07142dff3b667f44854e01643b04af36fe6af1a1f15e3f85747f4fb0f72a23c76ec3f80d3e61f97c192899c828be21f6c2f05685f3

Download Submit
C:\Windows\system\xbzmjrc.exe

Filesize
1.4MB

MD5
af0fb557e01c223cf3bcad0c2e38370e

SHA1
adbeb282b8499ce79a69f890c9f2e13ecc457386

SHA256
8585816b27cda9cc68d7c3ce09b67ff371b3edb83189caf226b45434d9ec0fa2

SHA512
dcb7adbc738cb52db1b256594a930f8b8daa82f2077ae9d3e0d894f6136c0947482806a321d562b73fee7966d7d1be835fd94e7a9f54ad719667e448d776c91f

Download Submit
C:\Windows\system\xgwkqlo.exe

Filesize
1.4MB

MD5
c520e6b0e039f60e422ee3ca97c0b672

SHA1
2e410ec123669364407f7b42be1ab8afa8be0147

SHA256
893ed23bc78ec589703cec77f77671635bbd5d00c45935a8107bab1d4d4afddf

SHA512
d473a48c9ceaa53513b94712813c996c4303a89a54ad8a06c0ca6b1977c5e2019530832bcf155fe75dc822877d4a0dbb6a20453fb44fa5c6cdd6cad77d693c32

Download Submit
C:\Windows\system\xxEOSBb.exe

Filesize
1.4MB

MD5
af02167b4ec34518a53a85fcacd5a050

SHA1
7ad5878c9bba166ca416b2dc30fb3d0e93b74c2e

SHA256
5c2720c32d8212cac300ee4e44d8e18e03c6d4236f3a9b9a7440937b61b01a68

SHA512
f99b2e93e4286ea37ec164dcb15a0537ca6754a60f9418761aee9428228f051fb927a238b747e99d04d4cdff6647e09e20a4dba5c5145701f5cc1c8096d28f15

Download Submit
\Windows\system\CNGwhgd.exe

Filesize
1.4MB

MD5
7e0bdc7c4e9aa2db8ea16dae79bfe8b9

SHA1
b2d2afe32ea76bed94e4ac220179227b70567ef8

SHA256
3f470c15b5dc4e689d08d7347e25ccf157cac58e719b72b7f0e4ad5aa374313e

SHA512
636e8f3b766758c0f7b44e466669c64c4b5fbbbb713267de776ac68d1b3822845e2057ea08a3f090ff3cbe18a890614322e1c79663a0d0d362a20b7e09d17f56

Download Submit
\Windows\system\EkCCRwh.exe

Filesize
1.4MB

MD5
48d252e070371c39d9280721fe27367d

SHA1
ed331662f19f5f623e2e4f0c91d620578a6db4df

SHA256
ca53cc2d20d18b828e330efae37977731b6a275d153a8b6e5d718ed017d657e2

SHA512
5341218a8a9f2d7de26c2b79448ae17c028f2ab7b353070aebae33cdd734d4f4702b5f821e62a30825543f8b32763d15907403e8397fb6006b50cd92760eb8e1

Download Submit
\Windows\system\WPDVEXL.exe

Filesize
1.4MB

MD5
3ba47abc72a8f71d996ea11cef9c75e7

SHA1
3dd585c37ce3069ed66eca89838c6642a354632f

SHA256
dfea42c0e36cbe821cca638b694442f80d49e2206bb44e955216e05a1030eb79

SHA512
a23b7ceaa8b3d30ae0bedbf56afa4234ead936f1500e5c17463192eea5958673ab3d6c4ac45dc6cd03d99225684ed53f7dc9707f25f66c7c138007af2e7f59a3

Download Submit
\Windows\system\siUnINZ.exe

Filesize
1.4MB

MD5
efa49616724a7509bb5424b389559240

SHA1
3a4c512b5ab9c9bb62d4ce15de49e0edba0d84cc

SHA256
975335332b29c0cd259cfea180009286157334cb27e5f9940c0230536af05a95

SHA512
be24b260d12474bddb3b096b71a46d57e9b2d629dfb75e91171d81572291c8007bf5c57c7ca9b536e670aa917cef664c9c806da33b0cc8bb6eee70f614c1976d

Download Submit
memory/3032-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download