xmrig | 8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
Size

1.0MB
MD5

d9626fc4e4471f45e78ef54fd2736e0d
SHA1

0a06c659f6cd46b86e4ae3cad0747c875d268418
SHA256

8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8
SHA512

6e2852fd59a78f8591824df32c86f71b505a45246c75a778e2e2b455241cf217afdb02a4cb0db864329fd2f3f2afb0594ed6145576e9d1d3210c681626b8e2ef
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPViB+:GezaTF8FcNkNdfE0pZ9ozttwIRRl+

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral1/files/0x0009000000012281-4.dat	xmrig
behavioral1/files/0x0008000000016dd0-9.dat	xmrig
behavioral1/files/0x0007000000016de8-13.dat	xmrig
behavioral1/files/0x0007000000016eb8-14.dat	xmrig
behavioral1/files/0x0007000000016edb-21.dat	xmrig
behavioral1/files/0x00080000000173f3-29.dat	xmrig
behavioral1/files/0x0006000000018f65-36.dat	xmrig
behavioral1/files/0x000600000001904c-40.dat	xmrig
behavioral1/files/0x00050000000191f6-52.dat	xmrig
behavioral1/files/0x000500000001926c-72.dat	xmrig
behavioral1/files/0x0005000000019278-80.dat	xmrig
behavioral1/files/0x0005000000019365-92.dat	xmrig
behavioral1/files/0x00050000000193c1-116.dat	xmrig
behavioral1/files/0x0005000000019450-128.dat	xmrig
behavioral1/files/0x0005000000019446-124.dat	xmrig
behavioral1/files/0x0005000000019433-120.dat	xmrig
behavioral1/files/0x00050000000193b3-112.dat	xmrig
behavioral1/files/0x00050000000193a4-108.dat	xmrig
behavioral1/files/0x0005000000019387-104.dat	xmrig
behavioral1/files/0x0009000000016d4f-100.dat	xmrig
behavioral1/files/0x0005000000019377-97.dat	xmrig
behavioral1/files/0x0005000000019319-88.dat	xmrig
behavioral1/files/0x000500000001929a-84.dat	xmrig
behavioral1/files/0x0005000000019275-76.dat	xmrig
behavioral1/files/0x0005000000019268-68.dat	xmrig
behavioral1/files/0x0005000000019259-64.dat	xmrig
behavioral1/files/0x0005000000019240-60.dat	xmrig
behavioral1/files/0x0005000000019217-56.dat	xmrig
behavioral1/files/0x00050000000191d2-48.dat	xmrig
behavioral1/files/0x00060000000190e1-44.dat	xmrig
behavioral1/files/0x0007000000017400-32.dat	xmrig
behavioral1/files/0x000700000001707c-24.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

kZHwjTg.exeXPBIlfM.exeEUiakxE.exeYoSHORA.exeQxxsbxH.exenmDGCwv.exehIekTsO.exedCZFwGs.execSNCRwU.exeuFIpXyC.exexJGcodv.exeSuxPKNI.exeLATEEPC.exeJyWWQWi.exeSPGdHXQ.exehcsWnqs.exeFqoGtGj.exexCGEoND.exehgaPpRK.exeofPrPhd.exeIqKxFCc.exeYCgwxyQ.exetboJFeq.exexeeZBgX.exerTcrDHx.exeUkhDZdS.exePmiSLWz.exezHFNIfw.exeiXLqfCi.exeCiSNUXl.exewKUgcSc.exeqFpuqPB.exeivDHgRE.exekmohDFh.exeiPqhNDT.exedJtGlFm.exedkffMTR.exeHAKYvxC.exeXeRoSBB.exeGUJMLlR.exeuidwtHG.exeHQXpcXL.exeDdCurOI.exePkSrguB.exewzGoXzW.exeaomyqrI.exeagzSHGH.exeuYoXAtA.exeswQBCSO.exeWjmRPtU.exelqRUgRL.exeeoCDksu.exefOFcNAz.exeJmWxRFp.exefZZqLdO.exeOtAFlsM.exeWYRTwjq.exeKIMrKpo.exeOnozbrt.exegaevvkk.exeznkXqXz.exeSwUBZTs.exeBeNltwB.exelTBMOii.exe

pid	Process
2996	kZHwjTg.exe
1980	XPBIlfM.exe
1860	EUiakxE.exe
2436	YoSHORA.exe
2936	QxxsbxH.exe
1984	nmDGCwv.exe
2748	hIekTsO.exe
2860	dCZFwGs.exe
2912	cSNCRwU.exe
2732	uFIpXyC.exe
2888	xJGcodv.exe
2796	SuxPKNI.exe
2224	LATEEPC.exe
2872	JyWWQWi.exe
2776	SPGdHXQ.exe
2604	hcsWnqs.exe
1988	FqoGtGj.exe
2728	xCGEoND.exe
2656	hgaPpRK.exe
2180	ofPrPhd.exe
676	IqKxFCc.exe
1472	YCgwxyQ.exe
2884	tboJFeq.exe
2828	xeeZBgX.exe
332	rTcrDHx.exe
1432	UkhDZdS.exe
2836	PmiSLWz.exe
236	zHFNIfw.exe
2972	iXLqfCi.exe
2960	CiSNUXl.exe
2084	wKUgcSc.exe
2136	qFpuqPB.exe
2544	ivDHgRE.exe
2160	kmohDFh.exe
2576	iPqhNDT.exe
1844	dJtGlFm.exe
2496	dkffMTR.exe
3028	HAKYvxC.exe
3016	XeRoSBB.exe
3008	GUJMLlR.exe
444	uidwtHG.exe
356	HQXpcXL.exe
1996	DdCurOI.exe
1572	PkSrguB.exe
1600	wzGoXzW.exe
924	aomyqrI.exe
2464	agzSHGH.exe
1740	uYoXAtA.exe
284	swQBCSO.exe
1788	WjmRPtU.exe
800	lqRUgRL.exe
1372	eoCDksu.exe
760	fOFcNAz.exe
1364	JmWxRFp.exe
2204	fZZqLdO.exe
1532	OtAFlsM.exe
1268	WYRTwjq.exe
2184	KIMrKpo.exe
2172	Onozbrt.exe
2252	gaevvkk.exe
1784	znkXqXz.exe
2120	SwUBZTs.exe
2428	BeNltwB.exe
1036	lTBMOii.exe

Loads dropped DLL 64 IoCs

Processes:

8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe

pid	Process
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe

Drops file in Windows directory 64 IoCs

Processes:

8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe

description	ioc	Process
File created	C:\Windows\System\SWhKRXM.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\VuOWryJ.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\OYInNxk.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\KWbfCTW.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\YCgwxyQ.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\CpfucKA.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ebPDkEe.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\RAhgDhz.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\lJjQneC.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ycpLgQw.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\TWMOAGv.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\swQBCSO.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\DMjGCqU.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\jRLLUGP.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\NNHFbUQ.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\BYOAxnB.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\omHfJxO.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\aphUbVr.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\qyizhDL.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\laZssgW.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\nnghuUp.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\HrvIGJv.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\wesHqvj.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\WTNHsvb.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\TAkfenE.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ExIZOvm.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\DPPCKxP.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\qfcLUtP.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ugnQPhg.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\MKQdpHl.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\VaWkJHA.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\saPguRY.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ozFBKXQ.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\NhoqFCI.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\PfpgZWj.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\idRjcYS.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\KIMrKpo.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\kFjgcpY.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\UnzDkxf.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\OKAXCCT.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\tnXETou.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\lpSbPsj.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ynLaXhf.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\myIjGfF.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\uQOBUGe.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\PoFVRfS.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\uYsupQG.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\VVpeamZ.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\eKLDNyk.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\VuCkVrs.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\ecoqTVy.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\DPrNpzX.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\aEfRmyd.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\YwghAlT.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\lwSSWNp.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\uYoXAtA.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\VBmePiL.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\bFHBhrX.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\TvAcxYC.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\uyAJsDS.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\AQIVNBu.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\vVzsgxa.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\BMdIpzs.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
File created	C:\Windows\System\aoBzNOb.exe	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe

description	pid	Process	procid_target
PID 2012 wrote to memory of 2996	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	31
PID 2012 wrote to memory of 2996	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	31
PID 2012 wrote to memory of 2996	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	31
PID 2012 wrote to memory of 1980	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	32
PID 2012 wrote to memory of 1980	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	32
PID 2012 wrote to memory of 1980	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	32
PID 2012 wrote to memory of 1860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	33
PID 2012 wrote to memory of 1860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	33
PID 2012 wrote to memory of 1860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	33
PID 2012 wrote to memory of 2436	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	34
PID 2012 wrote to memory of 2436	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	34
PID 2012 wrote to memory of 2436	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	34
PID 2012 wrote to memory of 2936	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	35
PID 2012 wrote to memory of 2936	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	35
PID 2012 wrote to memory of 2936	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	35
PID 2012 wrote to memory of 1984	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	36
PID 2012 wrote to memory of 1984	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	36
PID 2012 wrote to memory of 1984	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	36
PID 2012 wrote to memory of 2748	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	37
PID 2012 wrote to memory of 2748	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	37
PID 2012 wrote to memory of 2748	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	37
PID 2012 wrote to memory of 2860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	38
PID 2012 wrote to memory of 2860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	38
PID 2012 wrote to memory of 2860	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	38
PID 2012 wrote to memory of 2912	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	39
PID 2012 wrote to memory of 2912	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	39
PID 2012 wrote to memory of 2912	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	39
PID 2012 wrote to memory of 2732	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	40
PID 2012 wrote to memory of 2732	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	40
PID 2012 wrote to memory of 2732	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	40
PID 2012 wrote to memory of 2888	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	41
PID 2012 wrote to memory of 2888	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	41
PID 2012 wrote to memory of 2888	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	41
PID 2012 wrote to memory of 2796	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	42
PID 2012 wrote to memory of 2796	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	42
PID 2012 wrote to memory of 2796	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	42
PID 2012 wrote to memory of 2224	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	43
PID 2012 wrote to memory of 2224	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	43
PID 2012 wrote to memory of 2224	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	43
PID 2012 wrote to memory of 2872	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	44
PID 2012 wrote to memory of 2872	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	44
PID 2012 wrote to memory of 2872	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	44
PID 2012 wrote to memory of 2776	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	45
PID 2012 wrote to memory of 2776	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	45
PID 2012 wrote to memory of 2776	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	45
PID 2012 wrote to memory of 2604	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	46
PID 2012 wrote to memory of 2604	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	46
PID 2012 wrote to memory of 2604	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	46
PID 2012 wrote to memory of 1988	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	47
PID 2012 wrote to memory of 1988	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	47
PID 2012 wrote to memory of 1988	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	47
PID 2012 wrote to memory of 2728	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	48
PID 2012 wrote to memory of 2728	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	48
PID 2012 wrote to memory of 2728	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	48
PID 2012 wrote to memory of 2656	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	49
PID 2012 wrote to memory of 2656	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	49
PID 2012 wrote to memory of 2656	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	49
PID 2012 wrote to memory of 2180	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	50
PID 2012 wrote to memory of 2180	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	50
PID 2012 wrote to memory of 2180	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	50
PID 2012 wrote to memory of 676	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	51
PID 2012 wrote to memory of 676	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	51
PID 2012 wrote to memory of 676	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	51
PID 2012 wrote to memory of 1472	2012	8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe	52

C:\Users\Admin\AppData\Local\Temp\8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe
"C:\Users\Admin\AppData\Local\Temp\8c340b9c5119bdc67c3006efc0b3e1e9a288b61862aaf078bb63ca5110f0c1c8.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System\kZHwjTg.exe
  C:\Windows\System\kZHwjTg.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\XPBIlfM.exe
  C:\Windows\System\XPBIlfM.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\EUiakxE.exe
  C:\Windows\System\EUiakxE.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\YoSHORA.exe
  C:\Windows\System\YoSHORA.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\QxxsbxH.exe
  C:\Windows\System\QxxsbxH.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\nmDGCwv.exe
  C:\Windows\System\nmDGCwv.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\hIekTsO.exe
  C:\Windows\System\hIekTsO.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\dCZFwGs.exe
  C:\Windows\System\dCZFwGs.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\cSNCRwU.exe
  C:\Windows\System\cSNCRwU.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\uFIpXyC.exe
  C:\Windows\System\uFIpXyC.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xJGcodv.exe
  C:\Windows\System\xJGcodv.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\SuxPKNI.exe
  C:\Windows\System\SuxPKNI.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\LATEEPC.exe
  C:\Windows\System\LATEEPC.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JyWWQWi.exe
  C:\Windows\System\JyWWQWi.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\SPGdHXQ.exe
  C:\Windows\System\SPGdHXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\hcsWnqs.exe
  C:\Windows\System\hcsWnqs.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\FqoGtGj.exe
  C:\Windows\System\FqoGtGj.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\xCGEoND.exe
  C:\Windows\System\xCGEoND.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\hgaPpRK.exe
  C:\Windows\System\hgaPpRK.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ofPrPhd.exe
  C:\Windows\System\ofPrPhd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\IqKxFCc.exe
  C:\Windows\System\IqKxFCc.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\YCgwxyQ.exe
  C:\Windows\System\YCgwxyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\tboJFeq.exe
  C:\Windows\System\tboJFeq.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\xeeZBgX.exe
  C:\Windows\System\xeeZBgX.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\rTcrDHx.exe
  C:\Windows\System\rTcrDHx.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\UkhDZdS.exe
  C:\Windows\System\UkhDZdS.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\PmiSLWz.exe
  C:\Windows\System\PmiSLWz.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zHFNIfw.exe
  C:\Windows\System\zHFNIfw.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\iXLqfCi.exe
  C:\Windows\System\iXLqfCi.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\CiSNUXl.exe
  C:\Windows\System\CiSNUXl.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\wKUgcSc.exe
  C:\Windows\System\wKUgcSc.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qFpuqPB.exe
  C:\Windows\System\qFpuqPB.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ivDHgRE.exe
  C:\Windows\System\ivDHgRE.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\kmohDFh.exe
  C:\Windows\System\kmohDFh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\iPqhNDT.exe
  C:\Windows\System\iPqhNDT.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\dJtGlFm.exe
  C:\Windows\System\dJtGlFm.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\dkffMTR.exe
  C:\Windows\System\dkffMTR.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\HAKYvxC.exe
  C:\Windows\System\HAKYvxC.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\XeRoSBB.exe
  C:\Windows\System\XeRoSBB.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\GUJMLlR.exe
  C:\Windows\System\GUJMLlR.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\uidwtHG.exe
  C:\Windows\System\uidwtHG.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\HQXpcXL.exe
  C:\Windows\System\HQXpcXL.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\DdCurOI.exe
  C:\Windows\System\DdCurOI.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\PkSrguB.exe
  C:\Windows\System\PkSrguB.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\wzGoXzW.exe
  C:\Windows\System\wzGoXzW.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\aomyqrI.exe
  C:\Windows\System\aomyqrI.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\agzSHGH.exe
  C:\Windows\System\agzSHGH.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\uYoXAtA.exe
  C:\Windows\System\uYoXAtA.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\swQBCSO.exe
  C:\Windows\System\swQBCSO.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\WjmRPtU.exe
  C:\Windows\System\WjmRPtU.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\lqRUgRL.exe
  C:\Windows\System\lqRUgRL.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\eoCDksu.exe
  C:\Windows\System\eoCDksu.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\fOFcNAz.exe
  C:\Windows\System\fOFcNAz.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\JmWxRFp.exe
  C:\Windows\System\JmWxRFp.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\fZZqLdO.exe
  C:\Windows\System\fZZqLdO.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OtAFlsM.exe
  C:\Windows\System\OtAFlsM.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\WYRTwjq.exe
  C:\Windows\System\WYRTwjq.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\KIMrKpo.exe
  C:\Windows\System\KIMrKpo.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\Onozbrt.exe
  C:\Windows\System\Onozbrt.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\gaevvkk.exe
  C:\Windows\System\gaevvkk.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\znkXqXz.exe
  C:\Windows\System\znkXqXz.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\SwUBZTs.exe
  C:\Windows\System\SwUBZTs.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\BeNltwB.exe
  C:\Windows\System\BeNltwB.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\lTBMOii.exe
  C:\Windows\System\lTBMOii.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\SgwbHof.exe
  C:\Windows\System\SgwbHof.exe
  2⤵
  PID:292
- C:\Windows\System\HWAZJuL.exe
  C:\Windows\System\HWAZJuL.exe
  2⤵
  PID:876
- C:\Windows\System\DfIcShz.exe
  C:\Windows\System\DfIcShz.exe
  2⤵
  PID:1680
- C:\Windows\System\QkkxSxy.exe
  C:\Windows\System\QkkxSxy.exe
  2⤵
  PID:1212
- C:\Windows\System\Drisbwn.exe
  C:\Windows\System\Drisbwn.exe
  2⤵
  PID:2392
- C:\Windows\System\ZYdWxPj.exe
  C:\Windows\System\ZYdWxPj.exe
  2⤵
  PID:1580
- C:\Windows\System\TREcbVZ.exe
  C:\Windows\System\TREcbVZ.exe
  2⤵
  PID:2408
- C:\Windows\System\TAEYvZZ.exe
  C:\Windows\System\TAEYvZZ.exe
  2⤵
  PID:1220
- C:\Windows\System\ehfThvb.exe
  C:\Windows\System\ehfThvb.exe
  2⤵
  PID:2336
- C:\Windows\System\DCyxwzX.exe
  C:\Windows\System\DCyxwzX.exe
  2⤵
  PID:2440
- C:\Windows\System\GNmRoye.exe
  C:\Windows\System\GNmRoye.exe
  2⤵
  PID:2320
- C:\Windows\System\oMuLkvX.exe
  C:\Windows\System\oMuLkvX.exe
  2⤵
  PID:2880
- C:\Windows\System\yrBKVSl.exe
  C:\Windows\System\yrBKVSl.exe
  2⤵
  PID:2740
- C:\Windows\System\myIjGfF.exe
  C:\Windows\System\myIjGfF.exe
  2⤵
  PID:2928
- C:\Windows\System\TiPmddt.exe
  C:\Windows\System\TiPmddt.exe
  2⤵
  PID:2640
- C:\Windows\System\eLLtaYn.exe
  C:\Windows\System\eLLtaYn.exe
  2⤵
  PID:2720
- C:\Windows\System\WBvmURt.exe
  C:\Windows\System\WBvmURt.exe
  2⤵
  PID:2668
- C:\Windows\System\JTDQDNB.exe
  C:\Windows\System\JTDQDNB.exe
  2⤵
  PID:2248
- C:\Windows\System\WTNHsvb.exe
  C:\Windows\System\WTNHsvb.exe
  2⤵
  PID:588
- C:\Windows\System\hIlRNFL.exe
  C:\Windows\System\hIlRNFL.exe
  2⤵
  PID:2284
- C:\Windows\System\lQBUQjO.exe
  C:\Windows\System\lQBUQjO.exe
  2⤵
  PID:2816
- C:\Windows\System\xHLhHTP.exe
  C:\Windows\System\xHLhHTP.exe
  2⤵
  PID:1488
- C:\Windows\System\XJBThiZ.exe
  C:\Windows\System\XJBThiZ.exe
  2⤵
  PID:2016
- C:\Windows\System\SmwjMPv.exe
  C:\Windows\System\SmwjMPv.exe
  2⤵
  PID:2952
- C:\Windows\System\xuCWLmw.exe
  C:\Windows\System\xuCWLmw.exe
  2⤵
  PID:2276
- C:\Windows\System\hcToOTT.exe
  C:\Windows\System\hcToOTT.exe
  2⤵
  PID:2700
- C:\Windows\System\oZFkPBW.exe
  C:\Windows\System\oZFkPBW.exe
  2⤵
  PID:2104
- C:\Windows\System\sudLKUH.exe
  C:\Windows\System\sudLKUH.exe
  2⤵
  PID:1416
- C:\Windows\System\BXscDZI.exe
  C:\Windows\System\BXscDZI.exe
  2⤵
  PID:612
- C:\Windows\System\TavljKo.exe
  C:\Windows\System\TavljKo.exe
  2⤵
  PID:2116
- C:\Windows\System\rdQSNSH.exe
  C:\Windows\System\rdQSNSH.exe
  2⤵
  PID:1152
- C:\Windows\System\qIJcwkd.exe
  C:\Windows\System\qIJcwkd.exe
  2⤵
  PID:856
- C:\Windows\System\bvqSsEb.exe
  C:\Windows\System\bvqSsEb.exe
  2⤵
  PID:1492
- C:\Windows\System\JChIFTI.exe
  C:\Windows\System\JChIFTI.exe
  2⤵
  PID:1312
- C:\Windows\System\qAkJVGC.exe
  C:\Windows\System\qAkJVGC.exe
  2⤵
  PID:3000
- C:\Windows\System\NZNtBCz.exe
  C:\Windows\System\NZNtBCz.exe
  2⤵
  PID:1692
- C:\Windows\System\WtuDcuD.exe
  C:\Windows\System\WtuDcuD.exe
  2⤵
  PID:1652
- C:\Windows\System\pGhsaCF.exe
  C:\Windows\System\pGhsaCF.exe
  2⤵
  PID:3012
- C:\Windows\System\omHfJxO.exe
  C:\Windows\System\omHfJxO.exe
  2⤵
  PID:2788
- C:\Windows\System\YvfsEeG.exe
  C:\Windows\System\YvfsEeG.exe
  2⤵
  PID:3040
- C:\Windows\System\VjMIwqb.exe
  C:\Windows\System\VjMIwqb.exe
  2⤵
  PID:2192
- C:\Windows\System\fhXxERD.exe
  C:\Windows\System\fhXxERD.exe
  2⤵
  PID:2088
- C:\Windows\System\PhffToy.exe
  C:\Windows\System\PhffToy.exe
  2⤵
  PID:1048
- C:\Windows\System\CabONwG.exe
  C:\Windows\System\CabONwG.exe
  2⤵
  PID:2072
- C:\Windows\System\crbIScO.exe
  C:\Windows\System\crbIScO.exe
  2⤵
  PID:1972
- C:\Windows\System\NHFuvQl.exe
  C:\Windows\System\NHFuvQl.exe
  2⤵
  PID:1708
- C:\Windows\System\bEvLWef.exe
  C:\Windows\System\bEvLWef.exe
  2⤵
  PID:2684
- C:\Windows\System\CeEzXUR.exe
  C:\Windows\System\CeEzXUR.exe
  2⤵
  PID:2716
- C:\Windows\System\IDxhiuH.exe
  C:\Windows\System\IDxhiuH.exe
  2⤵
  PID:2356
- C:\Windows\System\fVzQBrb.exe
  C:\Windows\System\fVzQBrb.exe
  2⤵
  PID:2900
- C:\Windows\System\jqIaZuj.exe
  C:\Windows\System\jqIaZuj.exe
  2⤵
  PID:2772
- C:\Windows\System\fNaxKVY.exe
  C:\Windows\System\fNaxKVY.exe
  2⤵
  PID:3064
- C:\Windows\System\eUdPfmg.exe
  C:\Windows\System\eUdPfmg.exe
  2⤵
  PID:1916
- C:\Windows\System\uXAjgUY.exe
  C:\Windows\System\uXAjgUY.exe
  2⤵
  PID:348
- C:\Windows\System\fZmjKFS.exe
  C:\Windows\System\fZmjKFS.exe
  2⤵
  PID:1752
- C:\Windows\System\RnBFCet.exe
  C:\Windows\System\RnBFCet.exe
  2⤵
  PID:2388
- C:\Windows\System\llDVQpW.exe
  C:\Windows\System\llDVQpW.exe
  2⤵
  PID:2364
- C:\Windows\System\GgEYosg.exe
  C:\Windows\System\GgEYosg.exe
  2⤵
  PID:2300
- C:\Windows\System\qyhRTKy.exe
  C:\Windows\System\qyhRTKy.exe
  2⤵
  PID:1628
- C:\Windows\System\zcWVANg.exe
  C:\Windows\System\zcWVANg.exe
  2⤵
  PID:704
- C:\Windows\System\HGAvJAp.exe
  C:\Windows\System\HGAvJAp.exe
  2⤵
  PID:1608
- C:\Windows\System\lSWAayU.exe
  C:\Windows\System\lSWAayU.exe
  2⤵
  PID:896
- C:\Windows\System\kFjgcpY.exe
  C:\Windows\System\kFjgcpY.exe
  2⤵
  PID:3024
- C:\Windows\System\waaeUsa.exe
  C:\Windows\System\waaeUsa.exe
  2⤵
  PID:2240
- C:\Windows\System\nEaTMUw.exe
  C:\Windows\System\nEaTMUw.exe
  2⤵
  PID:2196
- C:\Windows\System\dbBllDD.exe
  C:\Windows\System\dbBllDD.exe
  2⤵
  PID:296
- C:\Windows\System\QVRZvOc.exe
  C:\Windows\System\QVRZvOc.exe
  2⤵
  PID:1284
- C:\Windows\System\sJzdnsq.exe
  C:\Windows\System\sJzdnsq.exe
  2⤵
  PID:2896
- C:\Windows\System\jArcmbE.exe
  C:\Windows\System\jArcmbE.exe
  2⤵
  PID:3080
- C:\Windows\System\PSTgKNe.exe
  C:\Windows\System\PSTgKNe.exe
  2⤵
  PID:3096
- C:\Windows\System\twGBExv.exe
  C:\Windows\System\twGBExv.exe
  2⤵
  PID:3112
- C:\Windows\System\uZyqVBX.exe
  C:\Windows\System\uZyqVBX.exe
  2⤵
  PID:3128
- C:\Windows\System\otfKXKF.exe
  C:\Windows\System\otfKXKF.exe
  2⤵
  PID:3144
- C:\Windows\System\yKPFIWi.exe
  C:\Windows\System\yKPFIWi.exe
  2⤵
  PID:3160
- C:\Windows\System\hNVqzoi.exe
  C:\Windows\System\hNVqzoi.exe
  2⤵
  PID:3176
- C:\Windows\System\tUExHNh.exe
  C:\Windows\System\tUExHNh.exe
  2⤵
  PID:3192
- C:\Windows\System\TpigFxQ.exe
  C:\Windows\System\TpigFxQ.exe
  2⤵
  PID:3208
- C:\Windows\System\HbzeGTP.exe
  C:\Windows\System\HbzeGTP.exe
  2⤵
  PID:3224
- C:\Windows\System\veFQlCR.exe
  C:\Windows\System\veFQlCR.exe
  2⤵
  PID:3240
- C:\Windows\System\aAMZUoy.exe
  C:\Windows\System\aAMZUoy.exe
  2⤵
  PID:3256
- C:\Windows\System\GpScZLR.exe
  C:\Windows\System\GpScZLR.exe
  2⤵
  PID:3272
- C:\Windows\System\KiCtTes.exe
  C:\Windows\System\KiCtTes.exe
  2⤵
  PID:3288
- C:\Windows\System\wEOibuc.exe
  C:\Windows\System\wEOibuc.exe
  2⤵
  PID:3304
- C:\Windows\System\lzrggUw.exe
  C:\Windows\System\lzrggUw.exe
  2⤵
  PID:3320
- C:\Windows\System\vizfeWt.exe
  C:\Windows\System\vizfeWt.exe
  2⤵
  PID:3336
- C:\Windows\System\OIvIHzc.exe
  C:\Windows\System\OIvIHzc.exe
  2⤵
  PID:3352
- C:\Windows\System\NoaUrRC.exe
  C:\Windows\System\NoaUrRC.exe
  2⤵
  PID:3368
- C:\Windows\System\NNQKKUM.exe
  C:\Windows\System\NNQKKUM.exe
  2⤵
  PID:3384
- C:\Windows\System\juNzpDZ.exe
  C:\Windows\System\juNzpDZ.exe
  2⤵
  PID:3400
- C:\Windows\System\ULsqcHe.exe
  C:\Windows\System\ULsqcHe.exe
  2⤵
  PID:3416
- C:\Windows\System\AgQWEQi.exe
  C:\Windows\System\AgQWEQi.exe
  2⤵
  PID:3432
- C:\Windows\System\FyWISAw.exe
  C:\Windows\System\FyWISAw.exe
  2⤵
  PID:3448
- C:\Windows\System\tXPObVP.exe
  C:\Windows\System\tXPObVP.exe
  2⤵
  PID:3464
- C:\Windows\System\IfBnTdt.exe
  C:\Windows\System\IfBnTdt.exe
  2⤵
  PID:3480
- C:\Windows\System\KgsaxpG.exe
  C:\Windows\System\KgsaxpG.exe
  2⤵
  PID:3496
- C:\Windows\System\rzAXVzv.exe
  C:\Windows\System\rzAXVzv.exe
  2⤵
  PID:3512
- C:\Windows\System\ZMqwWOs.exe
  C:\Windows\System\ZMqwWOs.exe
  2⤵
  PID:3528
- C:\Windows\System\cRqSjiI.exe
  C:\Windows\System\cRqSjiI.exe
  2⤵
  PID:3544
- C:\Windows\System\knElIhj.exe
  C:\Windows\System\knElIhj.exe
  2⤵
  PID:3560
- C:\Windows\System\MDOGsXP.exe
  C:\Windows\System\MDOGsXP.exe
  2⤵
  PID:3576
- C:\Windows\System\BSIHeSK.exe
  C:\Windows\System\BSIHeSK.exe
  2⤵
  PID:3592
- C:\Windows\System\PJtbUlA.exe
  C:\Windows\System\PJtbUlA.exe
  2⤵
  PID:3608
- C:\Windows\System\rLqfpRk.exe
  C:\Windows\System\rLqfpRk.exe
  2⤵
  PID:3624
- C:\Windows\System\JCsxkRE.exe
  C:\Windows\System\JCsxkRE.exe
  2⤵
  PID:3640
- C:\Windows\System\xVAGtwq.exe
  C:\Windows\System\xVAGtwq.exe
  2⤵
  PID:3656
- C:\Windows\System\MpaikMD.exe
  C:\Windows\System\MpaikMD.exe
  2⤵
  PID:3672
- C:\Windows\System\ERLUqOo.exe
  C:\Windows\System\ERLUqOo.exe
  2⤵
  PID:3688
- C:\Windows\System\VshHHJl.exe
  C:\Windows\System\VshHHJl.exe
  2⤵
  PID:3704
- C:\Windows\System\pDXUUul.exe
  C:\Windows\System\pDXUUul.exe
  2⤵
  PID:3720
- C:\Windows\System\MGMwRfA.exe
  C:\Windows\System\MGMwRfA.exe
  2⤵
  PID:3736
- C:\Windows\System\nRDnzEa.exe
  C:\Windows\System\nRDnzEa.exe
  2⤵
  PID:3752
- C:\Windows\System\dHLOycv.exe
  C:\Windows\System\dHLOycv.exe
  2⤵
  PID:3768
- C:\Windows\System\knPEMSf.exe
  C:\Windows\System\knPEMSf.exe
  2⤵
  PID:3784
- C:\Windows\System\BadXyiy.exe
  C:\Windows\System\BadXyiy.exe
  2⤵
  PID:3800
- C:\Windows\System\WFhESTR.exe
  C:\Windows\System\WFhESTR.exe
  2⤵
  PID:3816
- C:\Windows\System\DMjGCqU.exe
  C:\Windows\System\DMjGCqU.exe
  2⤵
  PID:3832
- C:\Windows\System\DVAuVud.exe
  C:\Windows\System\DVAuVud.exe
  2⤵
  PID:3848
- C:\Windows\System\iOGHtpR.exe
  C:\Windows\System\iOGHtpR.exe
  2⤵
  PID:3864
- C:\Windows\System\OzIGnbd.exe
  C:\Windows\System\OzIGnbd.exe
  2⤵
  PID:3880
- C:\Windows\System\YDFpKlR.exe
  C:\Windows\System\YDFpKlR.exe
  2⤵
  PID:3896
- C:\Windows\System\BkehduN.exe
  C:\Windows\System\BkehduN.exe
  2⤵
  PID:3912
- C:\Windows\System\gWWVlwt.exe
  C:\Windows\System\gWWVlwt.exe
  2⤵
  PID:3928
- C:\Windows\System\gsJDAyJ.exe
  C:\Windows\System\gsJDAyJ.exe
  2⤵
  PID:3944
- C:\Windows\System\mzkFPUT.exe
  C:\Windows\System\mzkFPUT.exe
  2⤵
  PID:3960
- C:\Windows\System\gbqjbnM.exe
  C:\Windows\System\gbqjbnM.exe
  2⤵
  PID:3976
- C:\Windows\System\TeshRMT.exe
  C:\Windows\System\TeshRMT.exe
  2⤵
  PID:3992
- C:\Windows\System\jxicoJl.exe
  C:\Windows\System\jxicoJl.exe
  2⤵
  PID:4008
- C:\Windows\System\AnLphwJ.exe
  C:\Windows\System\AnLphwJ.exe
  2⤵
  PID:4028
- C:\Windows\System\syAVbQR.exe
  C:\Windows\System\syAVbQR.exe
  2⤵
  PID:4044
- C:\Windows\System\xYICEor.exe
  C:\Windows\System\xYICEor.exe
  2⤵
  PID:4060
- C:\Windows\System\KOhHEQA.exe
  C:\Windows\System\KOhHEQA.exe
  2⤵
  PID:4076
- C:\Windows\System\PjqzizR.exe
  C:\Windows\System\PjqzizR.exe
  2⤵
  PID:2208
- C:\Windows\System\kHFYxfN.exe
  C:\Windows\System\kHFYxfN.exe
  2⤵
  PID:2944
- C:\Windows\System\oCBrcGP.exe
  C:\Windows\System\oCBrcGP.exe
  2⤵
  PID:2584
- C:\Windows\System\mMZxzVb.exe
  C:\Windows\System\mMZxzVb.exe
  2⤵
  PID:1668
- C:\Windows\System\rymEwqZ.exe
  C:\Windows\System\rymEwqZ.exe
  2⤵
  PID:2232
- C:\Windows\System\FBuPTEK.exe
  C:\Windows\System\FBuPTEK.exe
  2⤵
  PID:2168
- C:\Windows\System\CpfucKA.exe
  C:\Windows\System\CpfucKA.exe
  2⤵
  PID:2920
- C:\Windows\System\xxqTyfX.exe
  C:\Windows\System\xxqTyfX.exe
  2⤵
  PID:2040
- C:\Windows\System\GpzFoxJ.exe
  C:\Windows\System\GpzFoxJ.exe
  2⤵
  PID:2288
- C:\Windows\System\ieSSpSN.exe
  C:\Windows\System\ieSSpSN.exe
  2⤵
  PID:3104
- C:\Windows\System\jRLLUGP.exe
  C:\Windows\System\jRLLUGP.exe
  2⤵
  PID:3136
- C:\Windows\System\brQcayP.exe
  C:\Windows\System\brQcayP.exe
  2⤵
  PID:3168
- C:\Windows\System\TIMovAO.exe
  C:\Windows\System\TIMovAO.exe
  2⤵
  PID:3200
- C:\Windows\System\GpCYLMU.exe
  C:\Windows\System\GpCYLMU.exe
  2⤵
  PID:3232
- C:\Windows\System\hwMOSow.exe
  C:\Windows\System\hwMOSow.exe
  2⤵
  PID:3264
- C:\Windows\System\khvqiiy.exe
  C:\Windows\System\khvqiiy.exe
  2⤵
  PID:2780
- C:\Windows\System\BKHikCj.exe
  C:\Windows\System\BKHikCj.exe
  2⤵
  PID:3300
- C:\Windows\System\rXYSfmo.exe
  C:\Windows\System\rXYSfmo.exe
  2⤵
  PID:3332
- C:\Windows\System\efgVYms.exe
  C:\Windows\System\efgVYms.exe
  2⤵
  PID:3364
- C:\Windows\System\XpQCWfm.exe
  C:\Windows\System\XpQCWfm.exe
  2⤵
  PID:3396
- C:\Windows\System\WbDcsht.exe
  C:\Windows\System\WbDcsht.exe
  2⤵
  PID:3428
- C:\Windows\System\cLIbJkO.exe
  C:\Windows\System\cLIbJkO.exe
  2⤵
  PID:3460
- C:\Windows\System\EBvrEwF.exe
  C:\Windows\System\EBvrEwF.exe
  2⤵
  PID:3504
- C:\Windows\System\MSIoYdf.exe
  C:\Windows\System\MSIoYdf.exe
  2⤵
  PID:3520
- C:\Windows\System\ejIbXjo.exe
  C:\Windows\System\ejIbXjo.exe
  2⤵
  PID:2620
- C:\Windows\System\ruhRfmi.exe
  C:\Windows\System\ruhRfmi.exe
  2⤵
  PID:3568
- C:\Windows\System\cicCFzS.exe
  C:\Windows\System\cicCFzS.exe
  2⤵
  PID:3584
- C:\Windows\System\plZYFPz.exe
  C:\Windows\System\plZYFPz.exe
  2⤵
  PID:3616
- C:\Windows\System\nAWKbbZ.exe
  C:\Windows\System\nAWKbbZ.exe
  2⤵
  PID:3648
- C:\Windows\System\BGqHCfX.exe
  C:\Windows\System\BGqHCfX.exe
  2⤵
  PID:2144
- C:\Windows\System\srdxsGl.exe
  C:\Windows\System\srdxsGl.exe
  2⤵
  PID:664
- C:\Windows\System\vebFiuc.exe
  C:\Windows\System\vebFiuc.exe
  2⤵
  PID:3712
- C:\Windows\System\vJrxIPp.exe
  C:\Windows\System\vJrxIPp.exe
  2⤵
  PID:3744
- C:\Windows\System\tBIfVDG.exe
  C:\Windows\System\tBIfVDG.exe
  2⤵
  PID:3776
- C:\Windows\System\EFGQSEJ.exe
  C:\Windows\System\EFGQSEJ.exe
  2⤵
  PID:3780
- C:\Windows\System\TWdqXwu.exe
  C:\Windows\System\TWdqXwu.exe
  2⤵
  PID:3824
- C:\Windows\System\GAIdUMO.exe
  C:\Windows\System\GAIdUMO.exe
  2⤵
  PID:3844
- C:\Windows\System\YpEuLiU.exe
  C:\Windows\System\YpEuLiU.exe
  2⤵
  PID:3888
- C:\Windows\System\fHSqsgk.exe
  C:\Windows\System\fHSqsgk.exe
  2⤵
  PID:1632
- C:\Windows\System\DIxNlWT.exe
  C:\Windows\System\DIxNlWT.exe
  2⤵
  PID:3952
- C:\Windows\System\MAwqXBm.exe
  C:\Windows\System\MAwqXBm.exe
  2⤵
  PID:3956
- C:\Windows\System\BpyQBZu.exe
  C:\Windows\System\BpyQBZu.exe
  2⤵
  PID:3968
- C:\Windows\System\Sbnguqq.exe
  C:\Windows\System\Sbnguqq.exe
  2⤵
  PID:4000
- C:\Windows\System\uugcxGE.exe
  C:\Windows\System\uugcxGE.exe
  2⤵
  PID:2940
- C:\Windows\System\snIGUVh.exe
  C:\Windows\System\snIGUVh.exe
  2⤵
  PID:4004
- C:\Windows\System\sUVhLlJ.exe
  C:\Windows\System\sUVhLlJ.exe
  2⤵
  PID:3048
- C:\Windows\System\lyfiPbG.exe
  C:\Windows\System\lyfiPbG.exe
  2⤵
  PID:4036
- C:\Windows\System\eUIyDyj.exe
  C:\Windows\System\eUIyDyj.exe
  2⤵
  PID:4052
- C:\Windows\System\ncRJTFD.exe
  C:\Windows\System\ncRJTFD.exe
  2⤵
  PID:2260
- C:\Windows\System\WKiJuCn.exe
  C:\Windows\System\WKiJuCn.exe
  2⤵
  PID:2980
- C:\Windows\System\KhlqbSA.exe
  C:\Windows\System\KhlqbSA.exe
  2⤵
  PID:2200
- C:\Windows\System\CSqfJZS.exe
  C:\Windows\System\CSqfJZS.exe
  2⤵
  PID:2932
- C:\Windows\System\tbHmyBH.exe
  C:\Windows\System\tbHmyBH.exe
  2⤵
  PID:2876
- C:\Windows\System\UQxsHqj.exe
  C:\Windows\System\UQxsHqj.exe
  2⤵
  PID:2744
- C:\Windows\System\nUWbCqC.exe
  C:\Windows\System\nUWbCqC.exe
  2⤵
  PID:2924
- C:\Windows\System\IKXdzoQ.exe
  C:\Windows\System\IKXdzoQ.exe
  2⤵
  PID:3156
- C:\Windows\System\NDCmzTE.exe
  C:\Windows\System\NDCmzTE.exe
  2⤵
  PID:2148
- C:\Windows\System\PvkDUzg.exe
  C:\Windows\System\PvkDUzg.exe
  2⤵
  PID:2152
- C:\Windows\System\OrzkOFZ.exe
  C:\Windows\System\OrzkOFZ.exe
  2⤵
  PID:3108
- C:\Windows\System\BClnRhi.exe
  C:\Windows\System\BClnRhi.exe
  2⤵
  PID:3188
- C:\Windows\System\HIGkyki.exe
  C:\Windows\System\HIGkyki.exe
  2⤵
  PID:3328
- C:\Windows\System\xYSKUic.exe
  C:\Windows\System\xYSKUic.exe
  2⤵
  PID:3392
- C:\Windows\System\mIibPjp.exe
  C:\Windows\System\mIibPjp.exe
  2⤵
  PID:2648
- C:\Windows\System\nKLdgfu.exe
  C:\Windows\System\nKLdgfu.exe
  2⤵
  PID:1956
- C:\Windows\System\GaOkvES.exe
  C:\Windows\System\GaOkvES.exe
  2⤵
  PID:3700
- C:\Windows\System\zerQLxP.exe
  C:\Windows\System\zerQLxP.exe
  2⤵
  PID:3808
- C:\Windows\System\FngNPDv.exe
  C:\Windows\System\FngNPDv.exe
  2⤵
  PID:2600
- C:\Windows\System\QJBnQzy.exe
  C:\Windows\System\QJBnQzy.exe
  2⤵
  PID:3360
- C:\Windows\System\SxpjtcU.exe
  C:\Windows\System\SxpjtcU.exe
  2⤵
  PID:3488
- C:\Windows\System\qHjuEeZ.exe
  C:\Windows\System\qHjuEeZ.exe
  2⤵
  PID:3652
- C:\Windows\System\XPZugWo.exe
  C:\Windows\System\XPZugWo.exe
  2⤵
  PID:1792
- C:\Windows\System\XPSdRQE.exe
  C:\Windows\System\XPSdRQE.exe
  2⤵
  PID:3840
- C:\Windows\System\SLSjTlA.exe
  C:\Windows\System\SLSjTlA.exe
  2⤵
  PID:3924
- C:\Windows\System\qqoFFMF.exe
  C:\Windows\System\qqoFFMF.exe
  2⤵
  PID:3936
- C:\Windows\System\wcLDrwz.exe
  C:\Windows\System\wcLDrwz.exe
  2⤵
  PID:628
- C:\Windows\System\uGvnltI.exe
  C:\Windows\System\uGvnltI.exe
  2⤵
  PID:2268
- C:\Windows\System\FAewxeb.exe
  C:\Windows\System\FAewxeb.exe
  2⤵
  PID:536
- C:\Windows\System\WfTSTsa.exe
  C:\Windows\System\WfTSTsa.exe
  2⤵
  PID:4092
- C:\Windows\System\SWhKRXM.exe
  C:\Windows\System\SWhKRXM.exe
  2⤵
  PID:1196
- C:\Windows\System\tNNqczQ.exe
  C:\Windows\System\tNNqczQ.exe
  2⤵
  PID:3044
- C:\Windows\System\xaDWqLN.exe
  C:\Windows\System\xaDWqLN.exe
  2⤵
  PID:3152
- C:\Windows\System\tSrFdGM.exe
  C:\Windows\System\tSrFdGM.exe
  2⤵
  PID:1684
- C:\Windows\System\eDZVjZX.exe
  C:\Windows\System\eDZVjZX.exe
  2⤵
  PID:3408
- C:\Windows\System\oqrmnNM.exe
  C:\Windows\System\oqrmnNM.exe
  2⤵
  PID:3760
- C:\Windows\System\UcdfWUT.exe
  C:\Windows\System\UcdfWUT.exe
  2⤵
  PID:2992
- C:\Windows\System\ItnFXYg.exe
  C:\Windows\System\ItnFXYg.exe
  2⤵
  PID:3728
- C:\Windows\System\PKdRRSU.exe
  C:\Windows\System\PKdRRSU.exe
  2⤵
  PID:3508
- C:\Windows\System\PDgyfnQ.exe
  C:\Windows\System\PDgyfnQ.exe
  2⤵
  PID:3312
- C:\Windows\System\KhqjShr.exe
  C:\Windows\System\KhqjShr.exe
  2⤵
  PID:3440
- C:\Windows\System\bAOPrgm.exe
  C:\Windows\System\bAOPrgm.exe
  2⤵
  PID:3892
- C:\Windows\System\UNTsJTU.exe
  C:\Windows\System\UNTsJTU.exe
  2⤵
  PID:2844
- C:\Windows\System\zKykwIe.exe
  C:\Windows\System\zKykwIe.exe
  2⤵
  PID:880
- C:\Windows\System\soOsbQs.exe
  C:\Windows\System\soOsbQs.exe
  2⤵
  PID:3636
- C:\Windows\System\OhnxYXm.exe
  C:\Windows\System\OhnxYXm.exe
  2⤵
  PID:3972
- C:\Windows\System\iRmgpXC.exe
  C:\Windows\System\iRmgpXC.exe
  2⤵
  PID:1068
- C:\Windows\System\kHFhJXZ.exe
  C:\Windows\System\kHFhJXZ.exe
  2⤵
  PID:4084
- C:\Windows\System\yRRqRGV.exe
  C:\Windows\System\yRRqRGV.exe
  2⤵
  PID:3424
- C:\Windows\System\zojvPFG.exe
  C:\Windows\System\zojvPFG.exe
  2⤵
  PID:3068
- C:\Windows\System\Jycnzqk.exe
  C:\Windows\System\Jycnzqk.exe
  2⤵
  PID:4108
- C:\Windows\System\WZtzvOi.exe
  C:\Windows\System\WZtzvOi.exe
  2⤵
  PID:4124
- C:\Windows\System\eZayLld.exe
  C:\Windows\System\eZayLld.exe
  2⤵
  PID:4140
- C:\Windows\System\utkAfHE.exe
  C:\Windows\System\utkAfHE.exe
  2⤵
  PID:4156
- C:\Windows\System\zVSDvRG.exe
  C:\Windows\System\zVSDvRG.exe
  2⤵
  PID:4172
- C:\Windows\System\MCimvny.exe
  C:\Windows\System\MCimvny.exe
  2⤵
  PID:4188
- C:\Windows\System\SQTfkYG.exe
  C:\Windows\System\SQTfkYG.exe
  2⤵
  PID:4204
- C:\Windows\System\WHzhTWT.exe
  C:\Windows\System\WHzhTWT.exe
  2⤵
  PID:4220
- C:\Windows\System\cBcDgPS.exe
  C:\Windows\System\cBcDgPS.exe
  2⤵
  PID:4236
- C:\Windows\System\ZBygtHA.exe
  C:\Windows\System\ZBygtHA.exe
  2⤵
  PID:4252
- C:\Windows\System\mPkymbY.exe
  C:\Windows\System\mPkymbY.exe
  2⤵
  PID:4272
- C:\Windows\System\jbIlEuO.exe
  C:\Windows\System\jbIlEuO.exe
  2⤵
  PID:4288
- C:\Windows\System\vVzsgxa.exe
  C:\Windows\System\vVzsgxa.exe
  2⤵
  PID:4304
- C:\Windows\System\tdqgbuW.exe
  C:\Windows\System\tdqgbuW.exe
  2⤵
  PID:4320
- C:\Windows\System\qdLhuoA.exe
  C:\Windows\System\qdLhuoA.exe
  2⤵
  PID:4336
- C:\Windows\System\TxfUPbh.exe
  C:\Windows\System\TxfUPbh.exe
  2⤵
  PID:4352
- C:\Windows\System\Silivqq.exe
  C:\Windows\System\Silivqq.exe
  2⤵
  PID:4368
- C:\Windows\System\NlBPFCy.exe
  C:\Windows\System\NlBPFCy.exe
  2⤵
  PID:4384
- C:\Windows\System\AuAWtuZ.exe
  C:\Windows\System\AuAWtuZ.exe
  2⤵
  PID:4400
- C:\Windows\System\GIldIGf.exe
  C:\Windows\System\GIldIGf.exe
  2⤵
  PID:4416
- C:\Windows\System\cRpNCwM.exe
  C:\Windows\System\cRpNCwM.exe
  2⤵
  PID:4432
- C:\Windows\System\xKDMneb.exe
  C:\Windows\System\xKDMneb.exe
  2⤵
  PID:4448
- C:\Windows\System\fQYSNxU.exe
  C:\Windows\System\fQYSNxU.exe
  2⤵
  PID:4464
- C:\Windows\System\HHwEKLw.exe
  C:\Windows\System\HHwEKLw.exe
  2⤵
  PID:4480
- C:\Windows\System\IhSlpiJ.exe
  C:\Windows\System\IhSlpiJ.exe
  2⤵
  PID:4496
- C:\Windows\System\rRZUtjs.exe
  C:\Windows\System\rRZUtjs.exe
  2⤵
  PID:4512
- C:\Windows\System\fgXrXRb.exe
  C:\Windows\System\fgXrXRb.exe
  2⤵
  PID:4528
- C:\Windows\System\lUxRGEJ.exe
  C:\Windows\System\lUxRGEJ.exe
  2⤵
  PID:4544
- C:\Windows\System\JnXwhTy.exe
  C:\Windows\System\JnXwhTy.exe
  2⤵
  PID:4560
- C:\Windows\System\kVUPwjs.exe
  C:\Windows\System\kVUPwjs.exe
  2⤵
  PID:4576
- C:\Windows\System\Iiuiexe.exe
  C:\Windows\System\Iiuiexe.exe
  2⤵
  PID:4592
- C:\Windows\System\slfgFLG.exe
  C:\Windows\System\slfgFLG.exe
  2⤵
  PID:4608
- C:\Windows\System\WkcxFOi.exe
  C:\Windows\System\WkcxFOi.exe
  2⤵
  PID:4624
- C:\Windows\System\sjpHqpf.exe
  C:\Windows\System\sjpHqpf.exe
  2⤵
  PID:4644
- C:\Windows\System\uoLSbzj.exe
  C:\Windows\System\uoLSbzj.exe
  2⤵
  PID:4660
- C:\Windows\System\ivkHOiq.exe
  C:\Windows\System\ivkHOiq.exe
  2⤵
  PID:4676
- C:\Windows\System\rdyDPkI.exe
  C:\Windows\System\rdyDPkI.exe
  2⤵
  PID:4692
- C:\Windows\System\PIEqvNO.exe
  C:\Windows\System\PIEqvNO.exe
  2⤵
  PID:4708
- C:\Windows\System\ibVHLLa.exe
  C:\Windows\System\ibVHLLa.exe
  2⤵
  PID:4724
- C:\Windows\System\ABgbwDT.exe
  C:\Windows\System\ABgbwDT.exe
  2⤵
  PID:4740
- C:\Windows\System\zwzoMZN.exe
  C:\Windows\System\zwzoMZN.exe
  2⤵
  PID:4760
- C:\Windows\System\NFbXGnD.exe
  C:\Windows\System\NFbXGnD.exe
  2⤵
  PID:4776
- C:\Windows\System\SXwImgE.exe
  C:\Windows\System\SXwImgE.exe
  2⤵
  PID:4792
- C:\Windows\System\tmJyhUe.exe
  C:\Windows\System\tmJyhUe.exe
  2⤵
  PID:4808
- C:\Windows\System\QvNHjvB.exe
  C:\Windows\System\QvNHjvB.exe
  2⤵
  PID:4824
- C:\Windows\System\lUjDWCg.exe
  C:\Windows\System\lUjDWCg.exe
  2⤵
  PID:4840
- C:\Windows\System\MgrsSXW.exe
  C:\Windows\System\MgrsSXW.exe
  2⤵
  PID:4868
- C:\Windows\System\AtVgBEh.exe
  C:\Windows\System\AtVgBEh.exe
  2⤵
  PID:4884
- C:\Windows\System\xZHiAuh.exe
  C:\Windows\System\xZHiAuh.exe
  2⤵
  PID:4900
- C:\Windows\System\UMixGZS.exe
  C:\Windows\System\UMixGZS.exe
  2⤵
  PID:4916
- C:\Windows\System\jlddfjy.exe
  C:\Windows\System\jlddfjy.exe
  2⤵
  PID:5072
- C:\Windows\System\llzkWvy.exe
  C:\Windows\System\llzkWvy.exe
  2⤵
  PID:5088
- C:\Windows\System\ebanNNY.exe
  C:\Windows\System\ebanNNY.exe
  2⤵
  PID:5108
- C:\Windows\System\HDWtGlm.exe
  C:\Windows\System\HDWtGlm.exe
  2⤵
  PID:3036
- C:\Windows\System\uJRGHyI.exe
  C:\Windows\System\uJRGHyI.exe
  2⤵
  PID:2512
- C:\Windows\System\QNtuucv.exe
  C:\Windows\System\QNtuucv.exe
  2⤵
  PID:3988
- C:\Windows\System\cCaxuHC.exe
  C:\Windows\System\cCaxuHC.exe
  2⤵
  PID:4116
- C:\Windows\System\VBRaggA.exe
  C:\Windows\System\VBRaggA.exe
  2⤵
  PID:4244
- C:\Windows\System\nghfgGT.exe
  C:\Windows\System\nghfgGT.exe
  2⤵
  PID:4284
- C:\Windows\System\aeBRjKj.exe
  C:\Windows\System\aeBRjKj.exe
  2⤵
  PID:4380
- C:\Windows\System\upazdmM.exe
  C:\Windows\System\upazdmM.exe
  2⤵
  PID:4472
- C:\Windows\System\jUBFjSs.exe
  C:\Windows\System\jUBFjSs.exe
  2⤵
  PID:4508
- C:\Windows\System\saQiIwF.exe
  C:\Windows\System\saQiIwF.exe
  2⤵
  PID:4536
- C:\Windows\System\rRMjtwL.exe
  C:\Windows\System\rRMjtwL.exe
  2⤵
  PID:4100
- C:\Windows\System\tpSwRne.exe
  C:\Windows\System\tpSwRne.exe
  2⤵
  PID:4164
- C:\Windows\System\UeFewwF.exe
  C:\Windows\System\UeFewwF.exe
  2⤵
  PID:4232
- C:\Windows\System\TOvvPvZ.exe
  C:\Windows\System\TOvvPvZ.exe
  2⤵
  PID:4296
- C:\Windows\System\dHeUtLv.exe
  C:\Windows\System\dHeUtLv.exe
  2⤵
  PID:4392
- C:\Windows\System\ZmoounY.exe
  C:\Windows\System\ZmoounY.exe
  2⤵
  PID:4456
- C:\Windows\System\DzOYhSa.exe
  C:\Windows\System\DzOYhSa.exe
  2⤵
  PID:4520
- C:\Windows\System\cCXXjmV.exe
  C:\Windows\System\cCXXjmV.exe
  2⤵
  PID:4588
- C:\Windows\System\EEjlgjt.exe
  C:\Windows\System\EEjlgjt.exe
  2⤵
  PID:4636
- C:\Windows\System\eXtszUx.exe
  C:\Windows\System\eXtszUx.exe
  2⤵
  PID:4684
- C:\Windows\System\ouchfjD.exe
  C:\Windows\System\ouchfjD.exe
  2⤵
  PID:4704
- C:\Windows\System\VBmePiL.exe
  C:\Windows\System\VBmePiL.exe
  2⤵
  PID:4932
- C:\Windows\System\CaMeKfK.exe
  C:\Windows\System\CaMeKfK.exe
  2⤵
  PID:4948
- C:\Windows\System\WXqQobr.exe
  C:\Windows\System\WXqQobr.exe
  2⤵
  PID:4964
- C:\Windows\System\tyjqfLF.exe
  C:\Windows\System\tyjqfLF.exe
  2⤵
  PID:4984
- C:\Windows\System\hPWcqmc.exe
  C:\Windows\System\hPWcqmc.exe
  2⤵
  PID:5052
- C:\Windows\System\trqTQqo.exe
  C:\Windows\System\trqTQqo.exe
  2⤵
  PID:3632
- C:\Windows\System\ZMlxRdD.exe
  C:\Windows\System\ZMlxRdD.exe
  2⤵
  PID:4216
- C:\Windows\System\HWVFiGs.exe
  C:\Windows\System\HWVFiGs.exe
  2⤵
  PID:5004
- C:\Windows\System\hUcPEgI.exe
  C:\Windows\System\hUcPEgI.exe
  2⤵
  PID:5024
- C:\Windows\System\ESuMqAB.exe
  C:\Windows\System\ESuMqAB.exe
  2⤵
  PID:5040
- C:\Windows\System\uhbbOsS.exe
  C:\Windows\System\uhbbOsS.exe
  2⤵
  PID:5060
- C:\Windows\System\QOrCOpk.exe
  C:\Windows\System\QOrCOpk.exe
  2⤵
  PID:4504
- C:\Windows\System\xiPkpSj.exe
  C:\Windows\System\xiPkpSj.exe
  2⤵
  PID:5096
- C:\Windows\System\hxrAvhN.exe
  C:\Windows\System\hxrAvhN.exe
  2⤵
  PID:2908
- C:\Windows\System\xAHMBVI.exe
  C:\Windows\System\xAHMBVI.exe
  2⤵
  PID:3172
- C:\Windows\System\BYJYGhm.exe
  C:\Windows\System\BYJYGhm.exe
  2⤵
  PID:4316
- C:\Windows\System\IrPeXch.exe
  C:\Windows\System\IrPeXch.exe
  2⤵
  PID:4572
- C:\Windows\System\NhBuelS.exe
  C:\Windows\System\NhBuelS.exe
  2⤵
  PID:4228
- C:\Windows\System\NNHFbUQ.exe
  C:\Windows\System\NNHFbUQ.exe
  2⤵
  PID:4364
- C:\Windows\System\EczCYAK.exe
  C:\Windows\System\EczCYAK.exe
  2⤵
  PID:4640
- C:\Windows\System\yYTKxIJ.exe
  C:\Windows\System\yYTKxIJ.exe
  2⤵
  PID:4268
- C:\Windows\System\nSqgPnR.exe
  C:\Windows\System\nSqgPnR.exe
  2⤵
  PID:4556
- C:\Windows\System\uwVUEdI.exe
  C:\Windows\System\uwVUEdI.exe
  2⤵
  PID:4800
- C:\Windows\System\lGBJOyv.exe
  C:\Windows\System\lGBJOyv.exe
  2⤵
  PID:4856
- C:\Windows\System\kiXBMsn.exe
  C:\Windows\System\kiXBMsn.exe
  2⤵
  PID:4972
- C:\Windows\System\qHmHPZb.exe
  C:\Windows\System\qHmHPZb.exe
  2⤵
  PID:4908
- C:\Windows\System\sqZoOLE.exe
  C:\Windows\System\sqZoOLE.exe
  2⤵
  PID:5116
- C:\Windows\System\MZdYBMA.exe
  C:\Windows\System\MZdYBMA.exe
  2⤵
  PID:5036
- C:\Windows\System\yHWCltS.exe
  C:\Windows\System\yHWCltS.exe
  2⤵
  PID:5068
- C:\Windows\System\bjsuPTN.exe
  C:\Windows\System\bjsuPTN.exe
  2⤵
  PID:4924
- C:\Windows\System\XegQCFh.exe
  C:\Windows\System\XegQCFh.exe
  2⤵
  PID:4196
- C:\Windows\System\IqsKIxO.exe
  C:\Windows\System\IqsKIxO.exe
  2⤵
  PID:4848
- C:\Windows\System\fhjAHUm.exe
  C:\Windows\System\fhjAHUm.exe
  2⤵
  PID:4864
- C:\Windows\System\wPXsEOd.exe
  C:\Windows\System\wPXsEOd.exe
  2⤵
  PID:4912
- C:\Windows\System\MSfddly.exe
  C:\Windows\System\MSfddly.exe
  2⤵
  PID:4136
- C:\Windows\System\JKHjYRn.exe
  C:\Windows\System\JKHjYRn.exe
  2⤵
  PID:4040
- C:\Windows\System\DDkYLPl.exe
  C:\Windows\System\DDkYLPl.exe
  2⤵
  PID:5016
- C:\Windows\System\NLRDyby.exe
  C:\Windows\System\NLRDyby.exe
  2⤵
  PID:3092
- C:\Windows\System\ETOOqWh.exe
  C:\Windows\System\ETOOqWh.exe
  2⤵
  PID:4552
- C:\Windows\System\Zguaill.exe
  C:\Windows\System\Zguaill.exe
  2⤵
  PID:4620
- C:\Windows\System\JccAUwN.exe
  C:\Windows\System\JccAUwN.exe
  2⤵
  PID:4632
- C:\Windows\System\lFoOrFG.exe
  C:\Windows\System\lFoOrFG.exe
  2⤵
  PID:4944
- C:\Windows\System\MyVZhJR.exe
  C:\Windows\System\MyVZhJR.exe
  2⤵
  PID:4816
- C:\Windows\System\dKCXlVh.exe
  C:\Windows\System\dKCXlVh.exe
  2⤵
  PID:5000
- C:\Windows\System\aGUDxXA.exe
  C:\Windows\System\aGUDxXA.exe
  2⤵
  PID:4756
- C:\Windows\System\vdDEwYw.exe
  C:\Windows\System\vdDEwYw.exe
  2⤵
  PID:4788
- C:\Windows\System\TDXzNzK.exe
  C:\Windows\System\TDXzNzK.exe
  2⤵
  PID:4992
- C:\Windows\System\zJfOKDF.exe
  C:\Windows\System\zJfOKDF.exe
  2⤵
  PID:4056
- C:\Windows\System\LfODcxb.exe
  C:\Windows\System\LfODcxb.exe
  2⤵
  PID:5056
- C:\Windows\System\ebPDkEe.exe
  C:\Windows\System\ebPDkEe.exe
  2⤵
  PID:4656
- C:\Windows\System\vpNiBGn.exe
  C:\Windows\System\vpNiBGn.exe
  2⤵
  PID:868
- C:\Windows\System\ngLVwyP.exe
  C:\Windows\System\ngLVwyP.exe
  2⤵
  PID:4896
- C:\Windows\System\WcfgxpD.exe
  C:\Windows\System\WcfgxpD.exe
  2⤵
  PID:4960
- C:\Windows\System\QOULCAQ.exe
  C:\Windows\System\QOULCAQ.exe
  2⤵
  PID:5132
- C:\Windows\System\RMNzhcf.exe
  C:\Windows\System\RMNzhcf.exe
  2⤵
  PID:5148
- C:\Windows\System\SQyYGAu.exe
  C:\Windows\System\SQyYGAu.exe
  2⤵
  PID:5164
- C:\Windows\System\qBPIVmx.exe
  C:\Windows\System\qBPIVmx.exe
  2⤵
  PID:5180
- C:\Windows\System\PSAXcuZ.exe
  C:\Windows\System\PSAXcuZ.exe
  2⤵
  PID:5200
- C:\Windows\System\FXhZJjf.exe
  C:\Windows\System\FXhZJjf.exe
  2⤵
  PID:5216
- C:\Windows\System\vrABfZf.exe
  C:\Windows\System\vrABfZf.exe
  2⤵
  PID:5236
- C:\Windows\System\FNgQcLX.exe
  C:\Windows\System\FNgQcLX.exe
  2⤵
  PID:5252
- C:\Windows\System\AceGYSn.exe
  C:\Windows\System\AceGYSn.exe
  2⤵
  PID:5268
- C:\Windows\System\DrOioEj.exe
  C:\Windows\System\DrOioEj.exe
  2⤵
  PID:5284
- C:\Windows\System\PnzVaqg.exe
  C:\Windows\System\PnzVaqg.exe
  2⤵
  PID:5300
- C:\Windows\System\WSrOATY.exe
  C:\Windows\System\WSrOATY.exe
  2⤵
  PID:5316
- C:\Windows\System\pfEtjvE.exe
  C:\Windows\System\pfEtjvE.exe
  2⤵
  PID:5332
- C:\Windows\System\uwbHUnR.exe
  C:\Windows\System\uwbHUnR.exe
  2⤵
  PID:5348
- C:\Windows\System\GNqhexx.exe
  C:\Windows\System\GNqhexx.exe
  2⤵
  PID:5364
- C:\Windows\System\IrqNpHH.exe
  C:\Windows\System\IrqNpHH.exe
  2⤵
  PID:5380
- C:\Windows\System\URrDMtE.exe
  C:\Windows\System\URrDMtE.exe
  2⤵
  PID:5396
- C:\Windows\System\ILaGEje.exe
  C:\Windows\System\ILaGEje.exe
  2⤵
  PID:5416
- C:\Windows\System\hExwCdp.exe
  C:\Windows\System\hExwCdp.exe
  2⤵
  PID:5436
- C:\Windows\System\zhacXXg.exe
  C:\Windows\System\zhacXXg.exe
  2⤵
  PID:5456
- C:\Windows\System\SRXpxKr.exe
  C:\Windows\System\SRXpxKr.exe
  2⤵
  PID:5472
- C:\Windows\System\aUsdChh.exe
  C:\Windows\System\aUsdChh.exe
  2⤵
  PID:5488
- C:\Windows\System\ZtJRoCR.exe
  C:\Windows\System\ZtJRoCR.exe
  2⤵
  PID:5504
- C:\Windows\System\qZXYiSQ.exe
  C:\Windows\System\qZXYiSQ.exe
  2⤵
  PID:5520
- C:\Windows\System\dfYVjYT.exe
  C:\Windows\System\dfYVjYT.exe
  2⤵
  PID:5536
- C:\Windows\System\ywTtqEd.exe
  C:\Windows\System\ywTtqEd.exe
  2⤵
  PID:5552
- C:\Windows\System\uQOBUGe.exe
  C:\Windows\System\uQOBUGe.exe
  2⤵
  PID:5568
- C:\Windows\System\DWyZPQD.exe
  C:\Windows\System\DWyZPQD.exe
  2⤵
  PID:5584
- C:\Windows\System\srmZYsc.exe
  C:\Windows\System\srmZYsc.exe
  2⤵
  PID:5600
- C:\Windows\System\EehuVqf.exe
  C:\Windows\System\EehuVqf.exe
  2⤵
  PID:5616
- C:\Windows\System\RlJEnnZ.exe
  C:\Windows\System\RlJEnnZ.exe
  2⤵
  PID:5632
- C:\Windows\System\IeBlDDu.exe
  C:\Windows\System\IeBlDDu.exe
  2⤵
  PID:5648
- C:\Windows\System\vuLtEMp.exe
  C:\Windows\System\vuLtEMp.exe
  2⤵
  PID:5672
- C:\Windows\System\KcWkUnY.exe
  C:\Windows\System\KcWkUnY.exe
  2⤵
  PID:5688
- C:\Windows\System\tbbSIqW.exe
  C:\Windows\System\tbbSIqW.exe
  2⤵
  PID:5708
- C:\Windows\System\AnSQAew.exe
  C:\Windows\System\AnSQAew.exe
  2⤵
  PID:5724
- C:\Windows\System\qMQAdYS.exe
  C:\Windows\System\qMQAdYS.exe
  2⤵
  PID:5740
- C:\Windows\System\ipEJAPi.exe
  C:\Windows\System\ipEJAPi.exe
  2⤵
  PID:5756
- C:\Windows\System\PUdVvMr.exe
  C:\Windows\System\PUdVvMr.exe
  2⤵
  PID:5772
- C:\Windows\System\FxTrguV.exe
  C:\Windows\System\FxTrguV.exe
  2⤵
  PID:5788
- C:\Windows\System\gBWtdYz.exe
  C:\Windows\System\gBWtdYz.exe
  2⤵
  PID:5804
- C:\Windows\System\qsiWCNw.exe
  C:\Windows\System\qsiWCNw.exe
  2⤵
  PID:5820
- C:\Windows\System\akRHYtm.exe
  C:\Windows\System\akRHYtm.exe
  2⤵
  PID:5836
- C:\Windows\System\fCOkstY.exe
  C:\Windows\System\fCOkstY.exe
  2⤵
  PID:5884
- C:\Windows\System\KYpZhcO.exe
  C:\Windows\System\KYpZhcO.exe
  2⤵
  PID:5972
- C:\Windows\System\xJkaDXI.exe
  C:\Windows\System\xJkaDXI.exe
  2⤵
  PID:5988
- C:\Windows\System\wvazdiY.exe
  C:\Windows\System\wvazdiY.exe
  2⤵
  PID:6008
- C:\Windows\System\FDiCWNj.exe
  C:\Windows\System\FDiCWNj.exe
  2⤵
  PID:6024
- C:\Windows\System\TAkfenE.exe
  C:\Windows\System\TAkfenE.exe
  2⤵
  PID:6040
- C:\Windows\System\TehUSef.exe
  C:\Windows\System\TehUSef.exe
  2⤵
  PID:6056
- C:\Windows\System\BoHpcgA.exe
  C:\Windows\System\BoHpcgA.exe
  2⤵
  PID:6076
- C:\Windows\System\gHujVSx.exe
  C:\Windows\System\gHujVSx.exe
  2⤵
  PID:6092
- C:\Windows\System\ovaSdfc.exe
  C:\Windows\System\ovaSdfc.exe
  2⤵
  PID:6108
- C:\Windows\System\TNrfYnr.exe
  C:\Windows\System\TNrfYnr.exe
  2⤵
  PID:6124
- C:\Windows\System\EdGSAeg.exe
  C:\Windows\System\EdGSAeg.exe
  2⤵
  PID:6140
- C:\Windows\System\NfIbpzv.exe
  C:\Windows\System\NfIbpzv.exe
  2⤵
  PID:5124
- C:\Windows\System\PwsvXCG.exe
  C:\Windows\System\PwsvXCG.exe
  2⤵
  PID:5188
- C:\Windows\System\WukTNtV.exe
  C:\Windows\System\WukTNtV.exe
  2⤵
  PID:4428
- C:\Windows\System\QibwlBg.exe
  C:\Windows\System\QibwlBg.exe
  2⤵
  PID:4492
- C:\Windows\System\hsuaUNQ.exe
  C:\Windows\System\hsuaUNQ.exe
  2⤵
  PID:4652
- C:\Windows\System\dWezGKU.exe
  C:\Windows\System\dWezGKU.exe
  2⤵
  PID:5144
- C:\Windows\System\KwqmoWi.exe
  C:\Windows\System\KwqmoWi.exe
  2⤵
  PID:5244
- C:\Windows\System\VjZGxDq.exe
  C:\Windows\System\VjZGxDq.exe
  2⤵
  PID:5172
- C:\Windows\System\TfzHDdX.exe
  C:\Windows\System\TfzHDdX.exe
  2⤵
  PID:5260
- C:\Windows\System\bKfcTaD.exe
  C:\Windows\System\bKfcTaD.exe
  2⤵
  PID:5328
- C:\Windows\System\ExIZOvm.exe
  C:\Windows\System\ExIZOvm.exe
  2⤵
  PID:5428
- C:\Windows\System\UfkjHsG.exe
  C:\Windows\System\UfkjHsG.exe
  2⤵
  PID:5464
- C:\Windows\System\CLFZgSG.exe
  C:\Windows\System\CLFZgSG.exe
  2⤵
  PID:5312
- C:\Windows\System\YyWfVkd.exe
  C:\Windows\System\YyWfVkd.exe
  2⤵
  PID:5412
- C:\Windows\System\neFKfEb.exe
  C:\Windows\System\neFKfEb.exe
  2⤵
  PID:5480
- C:\Windows\System\NahbcJA.exe
  C:\Windows\System\NahbcJA.exe
  2⤵
  PID:5544
- C:\Windows\System\vBNAyQT.exe
  C:\Windows\System\vBNAyQT.exe
  2⤵
  PID:5576
- C:\Windows\System\KDXCFGa.exe
  C:\Windows\System\KDXCFGa.exe
  2⤵
  PID:5564
- C:\Windows\System\QxxnPzk.exe
  C:\Windows\System\QxxnPzk.exe
  2⤵
  PID:5624
- C:\Windows\System\hNfvzcY.exe
  C:\Windows\System\hNfvzcY.exe
  2⤵
  PID:5684
- C:\Windows\System\ofTLNwo.exe
  C:\Windows\System\ofTLNwo.exe
  2⤵
  PID:5752
- C:\Windows\System\jtZvgvt.exe
  C:\Windows\System\jtZvgvt.exe
  2⤵
  PID:5580
- C:\Windows\System\BhDSrIL.exe
  C:\Windows\System\BhDSrIL.exe
  2⤵
  PID:5644
- C:\Windows\System\qUAnJoa.exe
  C:\Windows\System\qUAnJoa.exe
  2⤵
  PID:5732
- C:\Windows\System\irKxYfk.exe
  C:\Windows\System\irKxYfk.exe
  2⤵
  PID:5796
- C:\Windows\System\eOoqUuI.exe
  C:\Windows\System\eOoqUuI.exe
  2⤵
  PID:5784
- C:\Windows\System\mXTRBQs.exe
  C:\Windows\System\mXTRBQs.exe
  2⤵
  PID:5892
- C:\Windows\System\zEOiKUp.exe
  C:\Windows\System\zEOiKUp.exe
  2⤵
  PID:5908
- C:\Windows\System\nlLVtsE.exe
  C:\Windows\System\nlLVtsE.exe
  2⤵
  PID:5920
- C:\Windows\System\cWJkfXe.exe
  C:\Windows\System\cWJkfXe.exe
  2⤵
  PID:5936
- C:\Windows\System\AeXDdfl.exe
  C:\Windows\System\AeXDdfl.exe
  2⤵
  PID:5952
- C:\Windows\System\PrtjHfG.exe
  C:\Windows\System\PrtjHfG.exe
  2⤵
  PID:5984
- C:\Windows\System\XdzHRts.exe
  C:\Windows\System\XdzHRts.exe
  2⤵
  PID:6052
- C:\Windows\System\OkoOHkx.exe
  C:\Windows\System\OkoOHkx.exe
  2⤵
  PID:6084
- C:\Windows\System\rSFhJOp.exe
  C:\Windows\System\rSFhJOp.exe
  2⤵
  PID:6032
- C:\Windows\System\TSkcIuh.exe
  C:\Windows\System\TSkcIuh.exe
  2⤵
  PID:6068
- C:\Windows\System\knjoqBm.exe
  C:\Windows\System\knjoqBm.exe
  2⤵
  PID:4768
- C:\Windows\System\bmDCvUq.exe
  C:\Windows\System\bmDCvUq.exe
  2⤵
  PID:5212
- C:\Windows\System\PKWQTOf.exe
  C:\Windows\System\PKWQTOf.exe
  2⤵
  PID:5224
- C:\Windows\System\HKiLqWl.exe
  C:\Windows\System\HKiLqWl.exe
  2⤵
  PID:6072
- C:\Windows\System\lKXiGFi.exe
  C:\Windows\System\lKXiGFi.exe
  2⤵
  PID:4360
- C:\Windows\System\UKPNFil.exe
  C:\Windows\System\UKPNFil.exe
  2⤵
  PID:5376
- C:\Windows\System\ZRvyKcK.exe
  C:\Windows\System\ZRvyKcK.exe
  2⤵
  PID:5392
- C:\Windows\System\RAhgDhz.exe
  C:\Windows\System\RAhgDhz.exe
  2⤵
  PID:5344
- C:\Windows\System\RrjztcR.exe
  C:\Windows\System\RrjztcR.exe
  2⤵
  PID:5276
- C:\Windows\System\VnHcQlL.exe
  C:\Windows\System\VnHcQlL.exe
  2⤵
  PID:5404
- C:\Windows\System\qccOCYX.exe
  C:\Windows\System\qccOCYX.exe
  2⤵
  PID:5516
- C:\Windows\System\UnzDkxf.exe
  C:\Windows\System\UnzDkxf.exe
  2⤵
  PID:5532
- C:\Windows\System\YDcdeiG.exe
  C:\Windows\System\YDcdeiG.exe
  2⤵
  PID:5768
- C:\Windows\System\LCCbTnn.exe
  C:\Windows\System\LCCbTnn.exe
  2⤵
  PID:5656
- C:\Windows\System\QQBqUjS.exe
  C:\Windows\System\QQBqUjS.exe
  2⤵
  PID:5916
- C:\Windows\System\crTWKhW.exe
  C:\Windows\System\crTWKhW.exe
  2⤵
  PID:6048
- C:\Windows\System\YifpZrj.exe
  C:\Windows\System\YifpZrj.exe
  2⤵
  PID:6004
- C:\Windows\System\MSJEIIn.exe
  C:\Windows\System\MSJEIIn.exe
  2⤵
  PID:5296
- C:\Windows\System\sHvTsvj.exe
  C:\Windows\System\sHvTsvj.exe
  2⤵
  PID:5324
- C:\Windows\System\EYXYCYh.exe
  C:\Windows\System\EYXYCYh.exe
  2⤵
  PID:5020
- C:\Windows\System\IAsyjfY.exe
  C:\Windows\System\IAsyjfY.exe
  2⤵
  PID:5280
- C:\Windows\System\HBGamlL.exe
  C:\Windows\System\HBGamlL.exe
  2⤵
  PID:5424
- C:\Windows\System\JPhkMVJ.exe
  C:\Windows\System\JPhkMVJ.exe
  2⤵
  PID:5156
- C:\Windows\System\ACIWghV.exe
  C:\Windows\System\ACIWghV.exe
  2⤵
  PID:5560
- C:\Windows\System\QBiGNJN.exe
  C:\Windows\System\QBiGNJN.exe
  2⤵
  PID:5996
- C:\Windows\System\MKQdpHl.exe
  C:\Windows\System\MKQdpHl.exe
  2⤵
  PID:6116
- C:\Windows\System\vyPxDpp.exe
  C:\Windows\System\vyPxDpp.exe
  2⤵
  PID:5980
- C:\Windows\System\JeERCpY.exe
  C:\Windows\System\JeERCpY.exe
  2⤵
  PID:4312
- C:\Windows\System\EihUXJA.exe
  C:\Windows\System\EihUXJA.exe
  2⤵
  PID:6064
- C:\Windows\System\pPfCBYQ.exe
  C:\Windows\System\pPfCBYQ.exe
  2⤵
  PID:5944
- C:\Windows\System\USuCnWm.exe
  C:\Windows\System\USuCnWm.exe
  2⤵
  PID:5928
- C:\Windows\System\twTperP.exe
  C:\Windows\System\twTperP.exe
  2⤵
  PID:5048
- C:\Windows\System\kJtxjux.exe
  C:\Windows\System\kJtxjux.exe
  2⤵
  PID:5848
- C:\Windows\System\wdZVWWt.exe
  C:\Windows\System\wdZVWWt.exe
  2⤵
  PID:5196
- C:\Windows\System\rRmlkwe.exe
  C:\Windows\System\rRmlkwe.exe
  2⤵
  PID:5828
- C:\Windows\System\MhlCChq.exe
  C:\Windows\System\MhlCChq.exe
  2⤵
  PID:5812
- C:\Windows\System\IMwNXJP.exe
  C:\Windows\System\IMwNXJP.exe
  2⤵
  PID:5960
- C:\Windows\System\HJkwUtd.exe
  C:\Windows\System\HJkwUtd.exe
  2⤵
  PID:5496
- C:\Windows\System\AjogthY.exe
  C:\Windows\System\AjogthY.exe
  2⤵
  PID:6164
- C:\Windows\System\OzytVKJ.exe
  C:\Windows\System\OzytVKJ.exe
  2⤵
  PID:6184
- C:\Windows\System\INCSCcc.exe
  C:\Windows\System\INCSCcc.exe
  2⤵
  PID:6204
- C:\Windows\System\NXiGfJU.exe
  C:\Windows\System\NXiGfJU.exe
  2⤵
  PID:6224
- C:\Windows\System\OErbFJn.exe
  C:\Windows\System\OErbFJn.exe
  2⤵
  PID:6248
- C:\Windows\System\IYNRJTC.exe
  C:\Windows\System\IYNRJTC.exe
  2⤵
  PID:6264
- C:\Windows\System\jyXKuLq.exe
  C:\Windows\System\jyXKuLq.exe
  2⤵
  PID:6288
- C:\Windows\System\GFnvwfO.exe
  C:\Windows\System\GFnvwfO.exe
  2⤵
  PID:6304
- C:\Windows\System\ojDesRX.exe
  C:\Windows\System\ojDesRX.exe
  2⤵
  PID:6320
- C:\Windows\System\KgzrNBr.exe
  C:\Windows\System\KgzrNBr.exe
  2⤵
  PID:6336
- C:\Windows\System\YzxjNva.exe
  C:\Windows\System\YzxjNva.exe
  2⤵
  PID:6404
- C:\Windows\System\RMTHoZo.exe
  C:\Windows\System\RMTHoZo.exe
  2⤵
  PID:6424
- C:\Windows\System\VReeWaX.exe
  C:\Windows\System\VReeWaX.exe
  2⤵
  PID:6448
- C:\Windows\System\GGtukhT.exe
  C:\Windows\System\GGtukhT.exe
  2⤵
  PID:6464
- C:\Windows\System\cVuKOOY.exe
  C:\Windows\System\cVuKOOY.exe
  2⤵
  PID:6480
- C:\Windows\System\gOvejUd.exe
  C:\Windows\System\gOvejUd.exe
  2⤵
  PID:6496
- C:\Windows\System\QcNqPgF.exe
  C:\Windows\System\QcNqPgF.exe
  2⤵
  PID:6512
- C:\Windows\System\ogwattn.exe
  C:\Windows\System\ogwattn.exe
  2⤵
  PID:6528
- C:\Windows\System\opSqPdo.exe
  C:\Windows\System\opSqPdo.exe
  2⤵
  PID:6548
- C:\Windows\System\ZDHlRzN.exe
  C:\Windows\System\ZDHlRzN.exe
  2⤵
  PID:6564
- C:\Windows\System\wnllAeJ.exe
  C:\Windows\System\wnllAeJ.exe
  2⤵
  PID:6584
- C:\Windows\System\rMwSNCg.exe
  C:\Windows\System\rMwSNCg.exe
  2⤵
  PID:6600
- C:\Windows\System\AjZDZLe.exe
  C:\Windows\System\AjZDZLe.exe
  2⤵
  PID:6616
- C:\Windows\System\BYuPbOk.exe
  C:\Windows\System\BYuPbOk.exe
  2⤵
  PID:6632
- C:\Windows\System\rQTCyPk.exe
  C:\Windows\System\rQTCyPk.exe
  2⤵
  PID:6680
- C:\Windows\System\oteKmZm.exe
  C:\Windows\System\oteKmZm.exe
  2⤵
  PID:6696
- C:\Windows\System\CPjUGbR.exe
  C:\Windows\System\CPjUGbR.exe
  2⤵
  PID:6712
- C:\Windows\System\KaFVLOO.exe
  C:\Windows\System\KaFVLOO.exe
  2⤵
  PID:6728
- C:\Windows\System\tFFVcOf.exe
  C:\Windows\System\tFFVcOf.exe
  2⤵
  PID:6744
- C:\Windows\System\smFBljG.exe
  C:\Windows\System\smFBljG.exe
  2⤵
  PID:6760
- C:\Windows\System\Cbepnet.exe
  C:\Windows\System\Cbepnet.exe
  2⤵
  PID:6776
- C:\Windows\System\EsmuFFm.exe
  C:\Windows\System\EsmuFFm.exe
  2⤵
  PID:6792
- C:\Windows\System\QvyHKcA.exe
  C:\Windows\System\QvyHKcA.exe
  2⤵
  PID:6808
- C:\Windows\System\gDcFYjr.exe
  C:\Windows\System\gDcFYjr.exe
  2⤵
  PID:6824
- C:\Windows\System\kmUScwD.exe
  C:\Windows\System\kmUScwD.exe
  2⤵
  PID:6840
- C:\Windows\System\ouDWaSj.exe
  C:\Windows\System\ouDWaSj.exe
  2⤵
  PID:6856
- C:\Windows\System\YWockHO.exe
  C:\Windows\System\YWockHO.exe
  2⤵
  PID:6872
- C:\Windows\System\uZgxZHT.exe
  C:\Windows\System\uZgxZHT.exe
  2⤵
  PID:6888
- C:\Windows\System\jDeeoFW.exe
  C:\Windows\System\jDeeoFW.exe
  2⤵
  PID:6904
- C:\Windows\System\PxZGBKD.exe
  C:\Windows\System\PxZGBKD.exe
  2⤵
  PID:6920
- C:\Windows\System\aNMsbhS.exe
  C:\Windows\System\aNMsbhS.exe
  2⤵
  PID:6936
- C:\Windows\System\JPNHhwI.exe
  C:\Windows\System\JPNHhwI.exe
  2⤵
  PID:6952
- C:\Windows\System\bFHBhrX.exe
  C:\Windows\System\bFHBhrX.exe
  2⤵
  PID:6968
- C:\Windows\System\GmhEIIN.exe
  C:\Windows\System\GmhEIIN.exe
  2⤵
  PID:6984
- C:\Windows\System\hlhttPe.exe
  C:\Windows\System\hlhttPe.exe
  2⤵
  PID:7000
- C:\Windows\System\pzjYLXa.exe
  C:\Windows\System\pzjYLXa.exe
  2⤵
  PID:7016
- C:\Windows\System\ZGnttUT.exe
  C:\Windows\System\ZGnttUT.exe
  2⤵
  PID:7032
- C:\Windows\System\FceiNLi.exe
  C:\Windows\System\FceiNLi.exe
  2⤵
  PID:7048
- C:\Windows\System\nFVObXZ.exe
  C:\Windows\System\nFVObXZ.exe
  2⤵
  PID:7064
- C:\Windows\System\zJGdlGE.exe
  C:\Windows\System\zJGdlGE.exe
  2⤵
  PID:7080
- C:\Windows\System\qqJyJtG.exe
  C:\Windows\System\qqJyJtG.exe
  2⤵
  PID:7096
- C:\Windows\System\faDNbHt.exe
  C:\Windows\System\faDNbHt.exe
  2⤵
  PID:7112
- C:\Windows\System\tfvrGJn.exe
  C:\Windows\System\tfvrGJn.exe
  2⤵
  PID:7128
- C:\Windows\System\UPEoXUQ.exe
  C:\Windows\System\UPEoXUQ.exe
  2⤵
  PID:7144
- C:\Windows\System\iyujijX.exe
  C:\Windows\System\iyujijX.exe
  2⤵
  PID:7160
- C:\Windows\System\JYFJKEX.exe
  C:\Windows\System\JYFJKEX.exe
  2⤵
  PID:6156
- C:\Windows\System\LnMyfXO.exe
  C:\Windows\System\LnMyfXO.exe
  2⤵
  PID:6200
- C:\Windows\System\xwrLBvb.exe
  C:\Windows\System\xwrLBvb.exe
  2⤵
  PID:6244
- C:\Windows\System\VVilOJL.exe
  C:\Windows\System\VVilOJL.exe
  2⤵
  PID:6280
- C:\Windows\System\aOxtXmd.exe
  C:\Windows\System\aOxtXmd.exe
  2⤵
  PID:6172
- C:\Windows\System\NmVRCDq.exe
  C:\Windows\System\NmVRCDq.exe
  2⤵
  PID:6216
- C:\Windows\System\VrbDvUz.exe
  C:\Windows\System\VrbDvUz.exe
  2⤵
  PID:6296
- C:\Windows\System\FFhNVHA.exe
  C:\Windows\System\FFhNVHA.exe
  2⤵
  PID:6328
- C:\Windows\System\tjMVcoF.exe
  C:\Windows\System\tjMVcoF.exe
  2⤵
  PID:6352
- C:\Windows\System\nSVmafJ.exe
  C:\Windows\System\nSVmafJ.exe
  2⤵
  PID:6372
- C:\Windows\System\nQdAEYa.exe
  C:\Windows\System\nQdAEYa.exe
  2⤵
  PID:6384
- C:\Windows\System\UeZLwqW.exe
  C:\Windows\System\UeZLwqW.exe
  2⤵
  PID:6388
- C:\Windows\System\ypSPbBp.exe
  C:\Windows\System\ypSPbBp.exe
  2⤵
  PID:6432
- C:\Windows\System\GqjwTEA.exe
  C:\Windows\System\GqjwTEA.exe
  2⤵
  PID:6472
- C:\Windows\System\pWXXypJ.exe
  C:\Windows\System\pWXXypJ.exe
  2⤵
  PID:6460
- C:\Windows\System\EJSSgmr.exe
  C:\Windows\System\EJSSgmr.exe
  2⤵
  PID:6536
- C:\Windows\System\baBggZW.exe
  C:\Windows\System\baBggZW.exe
  2⤵
  PID:6544
- C:\Windows\System\oOjHmaE.exe
  C:\Windows\System\oOjHmaE.exe
  2⤵
  PID:6580
- C:\Windows\System\oxrNdBk.exe
  C:\Windows\System\oxrNdBk.exe
  2⤵
  PID:6624
- C:\Windows\System\VaWkJHA.exe
  C:\Windows\System\VaWkJHA.exe
  2⤵
  PID:6640
- C:\Windows\System\PoFVRfS.exe
  C:\Windows\System\PoFVRfS.exe
  2⤵
  PID:6656
- C:\Windows\System\GrbldeC.exe
  C:\Windows\System\GrbldeC.exe
  2⤵
  PID:6672
- C:\Windows\System\FrIQSyF.exe
  C:\Windows\System\FrIQSyF.exe
  2⤵
  PID:6736
- C:\Windows\System\uYsupQG.exe
  C:\Windows\System\uYsupQG.exe
  2⤵
  PID:6800
- C:\Windows\System\FcwWTrr.exe
  C:\Windows\System\FcwWTrr.exe
  2⤵
  PID:6752
- C:\Windows\System\OycRnEg.exe
  C:\Windows\System\OycRnEg.exe
  2⤵
  PID:6756
- C:\Windows\System\plKdByU.exe
  C:\Windows\System\plKdByU.exe
  2⤵
  PID:6832
- C:\Windows\System\TvAcxYC.exe
  C:\Windows\System\TvAcxYC.exe
  2⤵
  PID:6864
- C:\Windows\System\VWeAqmu.exe
  C:\Windows\System\VWeAqmu.exe
  2⤵
  PID:6928
- C:\Windows\System\dzlHGiq.exe
  C:\Windows\System\dzlHGiq.exe
  2⤵
  PID:6880
- C:\Windows\System\osalqGL.exe
  C:\Windows\System\osalqGL.exe
  2⤵
  PID:6976
- C:\Windows\System\YludTBP.exe
  C:\Windows\System\YludTBP.exe
  2⤵
  PID:6996
- C:\Windows\System\xLLAKkv.exe
  C:\Windows\System\xLLAKkv.exe
  2⤵
  PID:7028
- C:\Windows\System\zEdetLR.exe
  C:\Windows\System\zEdetLR.exe
  2⤵
  PID:7124
- C:\Windows\System\UNBKGfy.exe
  C:\Windows\System\UNBKGfy.exe
  2⤵
  PID:7040
- C:\Windows\System\OHOTomd.exe
  C:\Windows\System\OHOTomd.exe
  2⤵
  PID:6196
- C:\Windows\System\pgXiqbd.exe
  C:\Windows\System\pgXiqbd.exe
  2⤵
  PID:6300
- C:\Windows\System\IcrrsMU.exe
  C:\Windows\System\IcrrsMU.exe
  2⤵
  PID:6416
- C:\Windows\System\pgDMXpb.exe
  C:\Windows\System\pgDMXpb.exe
  2⤵
  PID:7008
- C:\Windows\System\CdhWqSK.exe
  C:\Windows\System\CdhWqSK.exe
  2⤵
  PID:7076
- C:\Windows\System\MmPjhlA.exe
  C:\Windows\System\MmPjhlA.exe
  2⤵
  PID:6152
- C:\Windows\System\DzVKMLH.exe
  C:\Windows\System\DzVKMLH.exe
  2⤵
  PID:6488
- C:\Windows\System\nvXLKJq.exe
  C:\Windows\System\nvXLKJq.exe
  2⤵
  PID:6420
- C:\Windows\System\sUGBAxl.exe
  C:\Windows\System\sUGBAxl.exe
  2⤵
  PID:6348
- C:\Windows\System\nvrOFue.exe
  C:\Windows\System\nvrOFue.exe
  2⤵
  PID:6520
- C:\Windows\System\kLWBCed.exe
  C:\Windows\System\kLWBCed.exe
  2⤵
  PID:6576
- C:\Windows\System\eKLDNyk.exe
  C:\Windows\System\eKLDNyk.exe
  2⤵
  PID:6628
- C:\Windows\System\todhhHN.exe
  C:\Windows\System\todhhHN.exe
  2⤵
  PID:6652
- C:\Windows\System\lgTVunP.exe
  C:\Windows\System\lgTVunP.exe
  2⤵
  PID:6768
- C:\Windows\System\YPoAYiB.exe
  C:\Windows\System\YPoAYiB.exe
  2⤵
  PID:6788
- C:\Windows\System\CwFCqGU.exe
  C:\Windows\System\CwFCqGU.exe
  2⤵
  PID:6848
- C:\Windows\System\rYVSdno.exe
  C:\Windows\System\rYVSdno.exe
  2⤵
  PID:6900
- C:\Windows\System\HiBXGLX.exe
  C:\Windows\System\HiBXGLX.exe
  2⤵
  PID:6916
- C:\Windows\System\MNOGqtq.exe
  C:\Windows\System\MNOGqtq.exe
  2⤵
  PID:7120
- C:\Windows\System\FmlNDTt.exe
  C:\Windows\System\FmlNDTt.exe
  2⤵
  PID:5232
- C:\Windows\System\jRHZRsZ.exe
  C:\Windows\System\jRHZRsZ.exe
  2⤵
  PID:6364
- C:\Windows\System\oLZCoDW.exe
  C:\Windows\System\oLZCoDW.exe
  2⤵
  PID:7136
- C:\Windows\System\tvKeIUr.exe
  C:\Windows\System\tvKeIUr.exe
  2⤵
  PID:6504
- C:\Windows\System\yFomUOe.exe
  C:\Windows\System\yFomUOe.exe
  2⤵
  PID:6540
- C:\Windows\System\auGFsyU.exe
  C:\Windows\System\auGFsyU.exe
  2⤵
  PID:6256
- C:\Windows\System\xnSnaJM.exe
  C:\Windows\System\xnSnaJM.exe
  2⤵
  PID:6688
- C:\Windows\System\JjkuEZX.exe
  C:\Windows\System\JjkuEZX.exe
  2⤵
  PID:6612
- C:\Windows\System\kDHDBlZ.exe
  C:\Windows\System\kDHDBlZ.exe
  2⤵
  PID:6960
- C:\Windows\System\tEsBHoK.exe
  C:\Windows\System\tEsBHoK.exe
  2⤵
  PID:6948
- C:\Windows\System\aphUbVr.exe
  C:\Windows\System\aphUbVr.exe
  2⤵
  PID:6944
- C:\Windows\System\EdvdIGp.exe
  C:\Windows\System\EdvdIGp.exe
  2⤵
  PID:6180
- C:\Windows\System\tkNYFLe.exe
  C:\Windows\System\tkNYFLe.exe
  2⤵
  PID:6720
- C:\Windows\System\cJeYRZF.exe
  C:\Windows\System\cJeYRZF.exe
  2⤵
  PID:6644
- C:\Windows\System\dICkztX.exe
  C:\Windows\System\dICkztX.exe
  2⤵
  PID:7072
- C:\Windows\System\VuCkVrs.exe
  C:\Windows\System\VuCkVrs.exe
  2⤵
  PID:7176
- C:\Windows\System\UDNEzxc.exe
  C:\Windows\System\UDNEzxc.exe
  2⤵
  PID:7192
- C:\Windows\System\dojzgFl.exe
  C:\Windows\System\dojzgFl.exe
  2⤵
  PID:7208
- C:\Windows\System\JpzaIdN.exe
  C:\Windows\System\JpzaIdN.exe
  2⤵
  PID:7224
- C:\Windows\System\lqmSgYg.exe
  C:\Windows\System\lqmSgYg.exe
  2⤵
  PID:7240
- C:\Windows\System\getKRBa.exe
  C:\Windows\System\getKRBa.exe
  2⤵
  PID:7256
- C:\Windows\System\NFDMBix.exe
  C:\Windows\System\NFDMBix.exe
  2⤵
  PID:7272
- C:\Windows\System\aZmuFRZ.exe
  C:\Windows\System\aZmuFRZ.exe
  2⤵
  PID:7288
- C:\Windows\System\sXTiAoh.exe
  C:\Windows\System\sXTiAoh.exe
  2⤵
  PID:7304
- C:\Windows\System\EesBOJs.exe
  C:\Windows\System\EesBOJs.exe
  2⤵
  PID:7320
- C:\Windows\System\oEpIrwr.exe
  C:\Windows\System\oEpIrwr.exe
  2⤵
  PID:7336
- C:\Windows\System\pPLFbEf.exe
  C:\Windows\System\pPLFbEf.exe
  2⤵
  PID:7352
- C:\Windows\System\IfrrxTF.exe
  C:\Windows\System\IfrrxTF.exe
  2⤵
  PID:7368
- C:\Windows\System\xTxRrRY.exe
  C:\Windows\System\xTxRrRY.exe
  2⤵
  PID:7384
- C:\Windows\System\knaEIsS.exe
  C:\Windows\System\knaEIsS.exe
  2⤵
  PID:7400
- C:\Windows\System\gxsAfjP.exe
  C:\Windows\System\gxsAfjP.exe
  2⤵
  PID:7416
- C:\Windows\System\pVTtMeq.exe
  C:\Windows\System\pVTtMeq.exe
  2⤵
  PID:7432
- C:\Windows\System\pDKjIRA.exe
  C:\Windows\System\pDKjIRA.exe
  2⤵
  PID:7448
- C:\Windows\System\HLyvtej.exe
  C:\Windows\System\HLyvtej.exe
  2⤵
  PID:7464
- C:\Windows\System\rnoyFHF.exe
  C:\Windows\System\rnoyFHF.exe
  2⤵
  PID:7480
- C:\Windows\System\MFQCpma.exe
  C:\Windows\System\MFQCpma.exe
  2⤵
  PID:7496
- C:\Windows\System\icYhCdP.exe
  C:\Windows\System\icYhCdP.exe
  2⤵
  PID:7512
- C:\Windows\System\QpZZiYU.exe
  C:\Windows\System\QpZZiYU.exe
  2⤵
  PID:7528
- C:\Windows\System\qhSCcgK.exe
  C:\Windows\System\qhSCcgK.exe
  2⤵
  PID:7544
- C:\Windows\System\HPcywXw.exe
  C:\Windows\System\HPcywXw.exe
  2⤵
  PID:7560
- C:\Windows\System\vjvQXHq.exe
  C:\Windows\System\vjvQXHq.exe
  2⤵
  PID:7576
- C:\Windows\System\wBUmXen.exe
  C:\Windows\System\wBUmXen.exe
  2⤵
  PID:7592
- C:\Windows\System\TtjhlvD.exe
  C:\Windows\System\TtjhlvD.exe
  2⤵
  PID:7612
- C:\Windows\System\fZhkVed.exe
  C:\Windows\System\fZhkVed.exe
  2⤵
  PID:7628
- C:\Windows\System\cmVzPER.exe
  C:\Windows\System\cmVzPER.exe
  2⤵
  PID:7648
- C:\Windows\System\AWzrjKu.exe
  C:\Windows\System\AWzrjKu.exe
  2⤵
  PID:7664
- C:\Windows\System\rSyiWbm.exe
  C:\Windows\System\rSyiWbm.exe
  2⤵
  PID:7680
- C:\Windows\System\gqnNAex.exe
  C:\Windows\System\gqnNAex.exe
  2⤵
  PID:7696
- C:\Windows\System\BWwbhIA.exe
  C:\Windows\System\BWwbhIA.exe
  2⤵
  PID:7712
- C:\Windows\System\CURRiVq.exe
  C:\Windows\System\CURRiVq.exe
  2⤵
  PID:7728
- C:\Windows\System\LHnTNXm.exe
  C:\Windows\System\LHnTNXm.exe
  2⤵
  PID:7744
- C:\Windows\System\VDQizhO.exe
  C:\Windows\System\VDQizhO.exe
  2⤵
  PID:7760
- C:\Windows\System\FXLQmxj.exe
  C:\Windows\System\FXLQmxj.exe
  2⤵
  PID:7776
- C:\Windows\System\OJItXXg.exe
  C:\Windows\System\OJItXXg.exe
  2⤵
  PID:7792
- C:\Windows\System\xtMgxdE.exe
  C:\Windows\System\xtMgxdE.exe
  2⤵
  PID:7808
- C:\Windows\System\REKGKjp.exe
  C:\Windows\System\REKGKjp.exe
  2⤵
  PID:7824
- C:\Windows\System\jmNtpyp.exe
  C:\Windows\System\jmNtpyp.exe
  2⤵
  PID:7840
- C:\Windows\System\felmPtO.exe
  C:\Windows\System\felmPtO.exe
  2⤵
  PID:7856
- C:\Windows\System\wiUhDVg.exe
  C:\Windows\System\wiUhDVg.exe
  2⤵
  PID:7872
- C:\Windows\System\OKAXCCT.exe
  C:\Windows\System\OKAXCCT.exe
  2⤵
  PID:7900
- C:\Windows\System\vWsHsbs.exe
  C:\Windows\System\vWsHsbs.exe
  2⤵
  PID:7916
- C:\Windows\System\ZRaroBQ.exe
  C:\Windows\System\ZRaroBQ.exe
  2⤵
  PID:7932
- C:\Windows\System\IgSIRuj.exe
  C:\Windows\System\IgSIRuj.exe
  2⤵
  PID:7948
- C:\Windows\System\QstgyEH.exe
  C:\Windows\System\QstgyEH.exe
  2⤵
  PID:7964
- C:\Windows\System\ygzqvkX.exe
  C:\Windows\System\ygzqvkX.exe
  2⤵
  PID:7980
- C:\Windows\System\wWjQmnt.exe
  C:\Windows\System\wWjQmnt.exe
  2⤵
  PID:7996
- C:\Windows\System\RsmKDff.exe
  C:\Windows\System\RsmKDff.exe
  2⤵
  PID:8012
- C:\Windows\System\erQRWUw.exe
  C:\Windows\System\erQRWUw.exe
  2⤵
  PID:8028
- C:\Windows\System\JKzdYKX.exe
  C:\Windows\System\JKzdYKX.exe
  2⤵
  PID:8044
- C:\Windows\System\UdmQzhO.exe
  C:\Windows\System\UdmQzhO.exe
  2⤵
  PID:8060
- C:\Windows\System\XJGYDLh.exe
  C:\Windows\System\XJGYDLh.exe
  2⤵
  PID:8076
- C:\Windows\System\TGFkCDu.exe
  C:\Windows\System\TGFkCDu.exe
  2⤵
  PID:8092
- C:\Windows\System\SadaKCP.exe
  C:\Windows\System\SadaKCP.exe
  2⤵
  PID:8108
- C:\Windows\System\WavxNpX.exe
  C:\Windows\System\WavxNpX.exe
  2⤵
  PID:8124
- C:\Windows\System\ZxpbsHP.exe
  C:\Windows\System\ZxpbsHP.exe
  2⤵
  PID:8140
- C:\Windows\System\GtymHtK.exe
  C:\Windows\System\GtymHtK.exe
  2⤵
  PID:8156
- C:\Windows\System\xyirfqo.exe
  C:\Windows\System\xyirfqo.exe
  2⤵
  PID:8172
- C:\Windows\System\dztMfpI.exe
  C:\Windows\System\dztMfpI.exe
  2⤵
  PID:8188
- C:\Windows\System\qvfwoPb.exe
  C:\Windows\System\qvfwoPb.exe
  2⤵
  PID:6284
- C:\Windows\System\yOmovJp.exe
  C:\Windows\System\yOmovJp.exe
  2⤵
  PID:6436
- C:\Windows\System\snQlSmu.exe
  C:\Windows\System\snQlSmu.exe
  2⤵
  PID:7024
- C:\Windows\System\ZXBPJGg.exe
  C:\Windows\System\ZXBPJGg.exe
  2⤵
  PID:7268
- C:\Windows\System\iJoDInB.exe
  C:\Windows\System\iJoDInB.exe
  2⤵
  PID:7216
- C:\Windows\System\PnwAAce.exe
  C:\Windows\System\PnwAAce.exe
  2⤵
  PID:7360
- C:\Windows\System\IOhCItQ.exe
  C:\Windows\System\IOhCItQ.exe
  2⤵
  PID:7392
- C:\Windows\System\oAYmumw.exe
  C:\Windows\System\oAYmumw.exe
  2⤵
  PID:7284
- C:\Windows\System\yJzLgfE.exe
  C:\Windows\System\yJzLgfE.exe
  2⤵
  PID:7344
- C:\Windows\System\EfNDdxL.exe
  C:\Windows\System\EfNDdxL.exe
  2⤵
  PID:7412
- C:\Windows\System\kWvjGuo.exe
  C:\Windows\System\kWvjGuo.exe
  2⤵
  PID:7488
- C:\Windows\System\zBlggVK.exe
  C:\Windows\System\zBlggVK.exe
  2⤵
  PID:7440
- C:\Windows\System\aiuPKho.exe
  C:\Windows\System\aiuPKho.exe
  2⤵
  PID:7508
- C:\Windows\System\LgwMTus.exe
  C:\Windows\System\LgwMTus.exe
  2⤵
  PID:7556
- C:\Windows\System\RCTwGXz.exe
  C:\Windows\System\RCTwGXz.exe
  2⤵
  PID:7620
- C:\Windows\System\VpgdHue.exe
  C:\Windows\System\VpgdHue.exe
  2⤵
  PID:7644
- C:\Windows\System\obYjYbK.exe
  C:\Windows\System\obYjYbK.exe
  2⤵
  PID:7656
- C:\Windows\System\KiqBKEb.exe
  C:\Windows\System\KiqBKEb.exe
  2⤵
  PID:7724
- C:\Windows\System\DPPCKxP.exe
  C:\Windows\System\DPPCKxP.exe
  2⤵
  PID:7784
- C:\Windows\System\sYwjEKX.exe
  C:\Windows\System\sYwjEKX.exe
  2⤵
  PID:7848
- C:\Windows\System\HoDywQb.exe
  C:\Windows\System\HoDywQb.exe
  2⤵
  PID:7736
- C:\Windows\System\FKgaEsm.exe
  C:\Windows\System\FKgaEsm.exe
  2⤵
  PID:7676
- C:\Windows\System\isEXiUu.exe
  C:\Windows\System\isEXiUu.exe
  2⤵
  PID:7804
- C:\Windows\System\iKgPfNu.exe
  C:\Windows\System\iKgPfNu.exe
  2⤵
  PID:7868
- C:\Windows\System\GmWZwGA.exe
  C:\Windows\System\GmWZwGA.exe
  2⤵
  PID:7956
- C:\Windows\System\khOUuyq.exe
  C:\Windows\System\khOUuyq.exe
  2⤵
  PID:8020
- C:\Windows\System\oyyochy.exe
  C:\Windows\System\oyyochy.exe
  2⤵
  PID:8084
- C:\Windows\System\kKnlsRJ.exe
  C:\Windows\System\kKnlsRJ.exe
  2⤵
  PID:7940
- C:\Windows\System\DXWecQU.exe
  C:\Windows\System\DXWecQU.exe
  2⤵
  PID:8148
- C:\Windows\System\aiwgrEA.exe
  C:\Windows\System\aiwgrEA.exe
  2⤵
  PID:8184
- C:\Windows\System\MApvydG.exe
  C:\Windows\System\MApvydG.exe
  2⤵
  PID:6380
- C:\Windows\System\PMLDJzY.exe
  C:\Windows\System\PMLDJzY.exe
  2⤵
  PID:7328
- C:\Windows\System\AeKjMrK.exe
  C:\Windows\System\AeKjMrK.exe
  2⤵
  PID:8040
- C:\Windows\System\rKLLoaf.exe
  C:\Windows\System\rKLLoaf.exe
  2⤵
  PID:7408
- C:\Windows\System\ewDmPsr.exe
  C:\Windows\System\ewDmPsr.exe
  2⤵
  PID:7200
- C:\Windows\System\OdySLvI.exe
  C:\Windows\System\OdySLvI.exe
  2⤵
  PID:7248
- C:\Windows\System\nfhZMpl.exe
  C:\Windows\System\nfhZMpl.exe
  2⤵
  PID:8168
- C:\Windows\System\XJMJrLD.exe
  C:\Windows\System\XJMJrLD.exe
  2⤵
  PID:7376
- C:\Windows\System\LlvPoJH.exe
  C:\Windows\System\LlvPoJH.exe
  2⤵
  PID:7472
- C:\Windows\System\KeEImTI.exe
  C:\Windows\System\KeEImTI.exe
  2⤵
  PID:7552
- C:\Windows\System\HcRgrng.exe
  C:\Windows\System\HcRgrng.exe
  2⤵
  PID:7636
- C:\Windows\System\XbSUroF.exe
  C:\Windows\System\XbSUroF.exe
  2⤵
  PID:7604
- C:\Windows\System\aBKPhUg.exe
  C:\Windows\System\aBKPhUg.exe
  2⤵
  PID:7820
- C:\Windows\System\oBlieda.exe
  C:\Windows\System\oBlieda.exe
  2⤵
  PID:7800
- C:\Windows\System\tnXETou.exe
  C:\Windows\System\tnXETou.exe
  2⤵
  PID:7740
- C:\Windows\System\jKFbfpX.exe
  C:\Windows\System\jKFbfpX.exe
  2⤵
  PID:7928
- C:\Windows\System\TVRjIvx.exe
  C:\Windows\System\TVRjIvx.exe
  2⤵
  PID:8056
- C:\Windows\System\JqtDznC.exe
  C:\Windows\System\JqtDznC.exe
  2⤵
  PID:7976
- C:\Windows\System\NDozSjB.exe
  C:\Windows\System\NDozSjB.exe
  2⤵
  PID:7912
- C:\Windows\System\ZjbGCgI.exe
  C:\Windows\System\ZjbGCgI.exe
  2⤵
  PID:7108
- C:\Windows\System\wFqHOWL.exe
  C:\Windows\System\wFqHOWL.exe
  2⤵
  PID:7476
- C:\Windows\System\kXoNCBE.exe
  C:\Windows\System\kXoNCBE.exe
  2⤵
  PID:7536
- C:\Windows\System\MxLqJhw.exe
  C:\Windows\System\MxLqJhw.exe
  2⤵
  PID:8136
- C:\Windows\System\jsSlyvM.exe
  C:\Windows\System\jsSlyvM.exe
  2⤵
  PID:7852
- C:\Windows\System\zYTLKcv.exe
  C:\Windows\System\zYTLKcv.exe
  2⤵
  PID:8052
- C:\Windows\System\XDZECot.exe
  C:\Windows\System\XDZECot.exe
  2⤵
  PID:7588
- C:\Windows\System\pcvSScF.exe
  C:\Windows\System\pcvSScF.exe
  2⤵
  PID:7816
- C:\Windows\System\uUkjPWb.exe
  C:\Windows\System\uUkjPWb.exe
  2⤵
  PID:7300
- C:\Windows\System\JgBFeRd.exe
  C:\Windows\System\JgBFeRd.exe
  2⤵
  PID:7264
- C:\Windows\System\UhCuasW.exe
  C:\Windows\System\UhCuasW.exe
  2⤵
  PID:8104
- C:\Windows\System\pLOSZSw.exe
  C:\Windows\System\pLOSZSw.exe
  2⤵
  PID:7924
- C:\Windows\System\DBPhgry.exe
  C:\Windows\System\DBPhgry.exe
  2⤵
  PID:7756
- C:\Windows\System\skVAOcZ.exe
  C:\Windows\System\skVAOcZ.exe
  2⤵
  PID:7720
- C:\Windows\System\jYOctbA.exe
  C:\Windows\System\jYOctbA.exe
  2⤵
  PID:2372
- C:\Windows\System\QrJnigf.exe
  C:\Windows\System\QrJnigf.exe
  2⤵
  PID:8116
- C:\Windows\System\BMdIpzs.exe
  C:\Windows\System\BMdIpzs.exe
  2⤵
  PID:8204
- C:\Windows\System\ORDaKRF.exe
  C:\Windows\System\ORDaKRF.exe
  2⤵
  PID:8220
- C:\Windows\System\JckmUyW.exe
  C:\Windows\System\JckmUyW.exe
  2⤵
  PID:8236
- C:\Windows\System\VFQovSz.exe
  C:\Windows\System\VFQovSz.exe
  2⤵
  PID:8252
- C:\Windows\System\tiCsFfi.exe
  C:\Windows\System\tiCsFfi.exe
  2⤵
  PID:8268
- C:\Windows\System\sWysdIR.exe
  C:\Windows\System\sWysdIR.exe
  2⤵
  PID:8284
- C:\Windows\System\UCLkiMQ.exe
  C:\Windows\System\UCLkiMQ.exe
  2⤵
  PID:8300
- C:\Windows\System\CvdmhhK.exe
  C:\Windows\System\CvdmhhK.exe
  2⤵
  PID:8316
- C:\Windows\System\mmlRRUi.exe
  C:\Windows\System\mmlRRUi.exe
  2⤵
  PID:8332
- C:\Windows\System\mpFRukU.exe
  C:\Windows\System\mpFRukU.exe
  2⤵
  PID:8348
- C:\Windows\System\TflHWpT.exe
  C:\Windows\System\TflHWpT.exe
  2⤵
  PID:8364
- C:\Windows\System\XxhogWq.exe
  C:\Windows\System\XxhogWq.exe
  2⤵
  PID:8380
- C:\Windows\System\ajtMylp.exe
  C:\Windows\System\ajtMylp.exe
  2⤵
  PID:8396
- C:\Windows\System\dWeEvxI.exe
  C:\Windows\System\dWeEvxI.exe
  2⤵
  PID:8412
- C:\Windows\System\sBxqCBa.exe
  C:\Windows\System\sBxqCBa.exe
  2⤵
  PID:8428
- C:\Windows\System\prsTxec.exe
  C:\Windows\System\prsTxec.exe
  2⤵
  PID:8444
- C:\Windows\System\hmHJfKp.exe
  C:\Windows\System\hmHJfKp.exe
  2⤵
  PID:8460
- C:\Windows\System\SJmhPOP.exe
  C:\Windows\System\SJmhPOP.exe
  2⤵
  PID:8476
- C:\Windows\System\FiXZAmR.exe
  C:\Windows\System\FiXZAmR.exe
  2⤵
  PID:8492
- C:\Windows\System\goZuyfT.exe
  C:\Windows\System\goZuyfT.exe
  2⤵
  PID:8508
- C:\Windows\System\pTMPJNO.exe
  C:\Windows\System\pTMPJNO.exe
  2⤵
  PID:8524
- C:\Windows\System\eVooCOO.exe
  C:\Windows\System\eVooCOO.exe
  2⤵
  PID:8540
- C:\Windows\System\yxiULHK.exe
  C:\Windows\System\yxiULHK.exe
  2⤵
  PID:8556
- C:\Windows\System\NUXHFqh.exe
  C:\Windows\System\NUXHFqh.exe
  2⤵
  PID:8572
- C:\Windows\System\WzijrFp.exe
  C:\Windows\System\WzijrFp.exe
  2⤵
  PID:8588
- C:\Windows\System\qfcLUtP.exe
  C:\Windows\System\qfcLUtP.exe
  2⤵
  PID:8604
- C:\Windows\System\vcvWjAW.exe
  C:\Windows\System\vcvWjAW.exe
  2⤵
  PID:8620
- C:\Windows\System\wbzwGKp.exe
  C:\Windows\System\wbzwGKp.exe
  2⤵
  PID:8636
- C:\Windows\System\VVpeamZ.exe
  C:\Windows\System\VVpeamZ.exe
  2⤵
  PID:8652
- C:\Windows\System\PTORGoK.exe
  C:\Windows\System\PTORGoK.exe
  2⤵
  PID:8668
- C:\Windows\System\cNGznKq.exe
  C:\Windows\System\cNGznKq.exe
  2⤵
  PID:8684
- C:\Windows\System\pXOPfxh.exe
  C:\Windows\System\pXOPfxh.exe
  2⤵
  PID:8700
- C:\Windows\System\uyAJsDS.exe
  C:\Windows\System\uyAJsDS.exe
  2⤵
  PID:8716
- C:\Windows\System\ZUdZsRC.exe
  C:\Windows\System\ZUdZsRC.exe
  2⤵
  PID:8732
- C:\Windows\System\xGjyLNB.exe
  C:\Windows\System\xGjyLNB.exe
  2⤵
  PID:8748
- C:\Windows\System\NWKmvdN.exe
  C:\Windows\System\NWKmvdN.exe
  2⤵
  PID:8764
- C:\Windows\System\dExKavP.exe
  C:\Windows\System\dExKavP.exe
  2⤵
  PID:8780
- C:\Windows\System\RlMUHHh.exe
  C:\Windows\System\RlMUHHh.exe
  2⤵
  PID:8796
- C:\Windows\System\PyCwkbw.exe
  C:\Windows\System\PyCwkbw.exe
  2⤵
  PID:8812
- C:\Windows\System\ssrqLMO.exe
  C:\Windows\System\ssrqLMO.exe
  2⤵
  PID:8828
- C:\Windows\System\gSMyLbq.exe
  C:\Windows\System\gSMyLbq.exe
  2⤵
  PID:8844
- C:\Windows\System\HsROcSC.exe
  C:\Windows\System\HsROcSC.exe
  2⤵
  PID:8860
- C:\Windows\System\eZtDoJF.exe
  C:\Windows\System\eZtDoJF.exe
  2⤵
  PID:8876
- C:\Windows\System\YcArAcZ.exe
  C:\Windows\System\YcArAcZ.exe
  2⤵
  PID:8892
- C:\Windows\System\grHuYjy.exe
  C:\Windows\System\grHuYjy.exe
  2⤵
  PID:8908
- C:\Windows\System\fiSkuuq.exe
  C:\Windows\System\fiSkuuq.exe
  2⤵
  PID:8924
- C:\Windows\System\uCTchTM.exe
  C:\Windows\System\uCTchTM.exe
  2⤵
  PID:8940
- C:\Windows\System\BfShxHr.exe
  C:\Windows\System\BfShxHr.exe
  2⤵
  PID:8956
- C:\Windows\System\BUPAReS.exe
  C:\Windows\System\BUPAReS.exe
  2⤵
  PID:8972
- C:\Windows\System\slJsZaX.exe
  C:\Windows\System\slJsZaX.exe
  2⤵
  PID:8988
- C:\Windows\System\VCWHyWG.exe
  C:\Windows\System\VCWHyWG.exe
  2⤵
  PID:9004
- C:\Windows\System\URdejMF.exe
  C:\Windows\System\URdejMF.exe
  2⤵
  PID:9020
- C:\Windows\System\nzZUEtz.exe
  C:\Windows\System\nzZUEtz.exe
  2⤵
  PID:9036
- C:\Windows\System\xEHaqpZ.exe
  C:\Windows\System\xEHaqpZ.exe
  2⤵
  PID:9052
- C:\Windows\System\fMKsoVA.exe
  C:\Windows\System\fMKsoVA.exe
  2⤵
  PID:9068
- C:\Windows\System\ShMLWwb.exe
  C:\Windows\System\ShMLWwb.exe
  2⤵
  PID:9084
- C:\Windows\System\XKNapaU.exe
  C:\Windows\System\XKNapaU.exe
  2⤵
  PID:9100
- C:\Windows\System\OxMxDhQ.exe
  C:\Windows\System\OxMxDhQ.exe
  2⤵
  PID:9116
- C:\Windows\System\VuOWryJ.exe
  C:\Windows\System\VuOWryJ.exe
  2⤵
  PID:9132
- C:\Windows\System\nufORDK.exe
  C:\Windows\System\nufORDK.exe
  2⤵
  PID:9148
- C:\Windows\System\jnnqGIs.exe
  C:\Windows\System\jnnqGIs.exe
  2⤵
  PID:9164
- C:\Windows\System\nEMDENM.exe
  C:\Windows\System\nEMDENM.exe
  2⤵
  PID:9180
- C:\Windows\System\mdyEaKw.exe
  C:\Windows\System\mdyEaKw.exe
  2⤵
  PID:9196
- C:\Windows\System\NpkMmIU.exe
  C:\Windows\System\NpkMmIU.exe
  2⤵
  PID:9212
- C:\Windows\System\GJWMmGz.exe
  C:\Windows\System\GJWMmGz.exe
  2⤵
  PID:5340
- C:\Windows\System\KrYrVgU.exe
  C:\Windows\System\KrYrVgU.exe
  2⤵
  PID:8216
- C:\Windows\System\IGgOwVG.exe
  C:\Windows\System\IGgOwVG.exe
  2⤵
  PID:8244
- C:\Windows\System\yvKtxWB.exe
  C:\Windows\System\yvKtxWB.exe
  2⤵
  PID:8276
- C:\Windows\System\axVCMNZ.exe
  C:\Windows\System\axVCMNZ.exe
  2⤵
  PID:8356
- C:\Windows\System\sIHkTiN.exe
  C:\Windows\System\sIHkTiN.exe
  2⤵
  PID:8420
- C:\Windows\System\mExxbTl.exe
  C:\Windows\System\mExxbTl.exe
  2⤵
  PID:8312
- C:\Windows\System\NRTHUau.exe
  C:\Windows\System\NRTHUau.exe
  2⤵
  PID:8488
- C:\Windows\System\NMJfVbR.exe
  C:\Windows\System\NMJfVbR.exe
  2⤵
  PID:8404
- C:\Windows\System\WvWMdXN.exe
  C:\Windows\System\WvWMdXN.exe
  2⤵
  PID:8436
- C:\Windows\System\lpSbPsj.exe
  C:\Windows\System\lpSbPsj.exe
  2⤵
  PID:8552
- C:\Windows\System\PnqCqdJ.exe
  C:\Windows\System\PnqCqdJ.exe
  2⤵
  PID:8564
- C:\Windows\System\ArLhWvJ.exe
  C:\Windows\System\ArLhWvJ.exe
  2⤵
  PID:8584
- C:\Windows\System\xXpHGyU.exe
  C:\Windows\System\xXpHGyU.exe
  2⤵
  PID:8600
- C:\Windows\System\kIBTVpK.exe
  C:\Windows\System\kIBTVpK.exe
  2⤵
  PID:8628
- C:\Windows\System\dQgZtAV.exe
  C:\Windows\System\dQgZtAV.exe
  2⤵
  PID:8680
- C:\Windows\System\llLZEyv.exe
  C:\Windows\System\llLZEyv.exe
  2⤵
  PID:8712
- C:\Windows\System\bPcZEAf.exe
  C:\Windows\System\bPcZEAf.exe
  2⤵
  PID:8744
- C:\Windows\System\ZmjlxlW.exe
  C:\Windows\System\ZmjlxlW.exe
  2⤵
  PID:8760
- C:\Windows\System\TkVSISL.exe
  C:\Windows\System\TkVSISL.exe
  2⤵
  PID:8792
- C:\Windows\System\hiGvQxf.exe
  C:\Windows\System\hiGvQxf.exe
  2⤵
  PID:8840
- C:\Windows\System\GfcvZbC.exe
  C:\Windows\System\GfcvZbC.exe
  2⤵
  PID:8872
- C:\Windows\System\DMvGYax.exe
  C:\Windows\System\DMvGYax.exe
  2⤵
  PID:8932
- C:\Windows\System\QPJDMKB.exe
  C:\Windows\System\QPJDMKB.exe
  2⤵
  PID:8996
- C:\Windows\System\toZyMyk.exe
  C:\Windows\System\toZyMyk.exe
  2⤵
  PID:8916
- C:\Windows\System\OYInNxk.exe
  C:\Windows\System\OYInNxk.exe
  2⤵
  PID:8952
- C:\Windows\System\qLTVjua.exe
  C:\Windows\System\qLTVjua.exe
  2⤵
  PID:9064
- C:\Windows\System\TzmtUxX.exe
  C:\Windows\System\TzmtUxX.exe
  2⤵
  PID:9128
- C:\Windows\System\PSemrOJ.exe
  C:\Windows\System\PSemrOJ.exe
  2⤵
  PID:9188
- C:\Windows\System\lXfuQrk.exe
  C:\Windows\System\lXfuQrk.exe
  2⤵
  PID:8228
- C:\Windows\System\eNjDsVA.exe
  C:\Windows\System\eNjDsVA.exe
  2⤵
  PID:8260
- C:\Windows\System\SZrFgHS.exe
  C:\Windows\System\SZrFgHS.exe
  2⤵
  PID:8328
- C:\Windows\System\wltPTBJ.exe
  C:\Windows\System\wltPTBJ.exe
  2⤵
  PID:8280
- C:\Windows\System\Zbhskzl.exe
  C:\Windows\System\Zbhskzl.exe
  2⤵
  PID:9140
- C:\Windows\System\MIdrYyx.exe
  C:\Windows\System\MIdrYyx.exe
  2⤵
  PID:8344
- C:\Windows\System\UkuXCOd.exe
  C:\Windows\System\UkuXCOd.exe
  2⤵
  PID:8388
- C:\Windows\System\aMrGuvB.exe
  C:\Windows\System\aMrGuvB.exe
  2⤵
  PID:8548
- C:\Windows\System\bBiPspu.exe
  C:\Windows\System\bBiPspu.exe
  2⤵
  PID:8516
- C:\Windows\System\egPsGUF.exe
  C:\Windows\System\egPsGUF.exe
  2⤵
  PID:8644
- C:\Windows\System\JemugxQ.exe
  C:\Windows\System\JemugxQ.exe
  2⤵
  PID:8772
- C:\Windows\System\WzEIbnw.exe
  C:\Windows\System\WzEIbnw.exe
  2⤵
  PID:8660
- C:\Windows\System\lJjQneC.exe
  C:\Windows\System\lJjQneC.exe
  2⤵
  PID:8616
- C:\Windows\System\avjHHri.exe
  C:\Windows\System\avjHHri.exe
  2⤵
  PID:8904
- C:\Windows\System\MLxDbJk.exe
  C:\Windows\System\MLxDbJk.exe
  2⤵
  PID:9060
- C:\Windows\System\kWxiUwb.exe
  C:\Windows\System\kWxiUwb.exe
  2⤵
  PID:9112
- C:\Windows\System\LEbEWld.exe
  C:\Windows\System\LEbEWld.exe
  2⤵
  PID:9048
- C:\Windows\System\xwEuUAf.exe
  C:\Windows\System\xwEuUAf.exe
  2⤵
  PID:8308
- C:\Windows\System\YUCsNTv.exe
  C:\Windows\System\YUCsNTv.exe
  2⤵
  PID:9076
- C:\Windows\System\SFiygkI.exe
  C:\Windows\System\SFiygkI.exe
  2⤵
  PID:9204
- C:\Windows\System\yUOCYbg.exe
  C:\Windows\System\yUOCYbg.exe
  2⤵
  PID:8212
- C:\Windows\System\laMhFOO.exe
  C:\Windows\System\laMhFOO.exe
  2⤵
  PID:9080
- C:\Windows\System\uInWcks.exe
  C:\Windows\System\uInWcks.exe
  2⤵
  PID:8728
- C:\Windows\System\PaJADjQ.exe
  C:\Windows\System\PaJADjQ.exe
  2⤵
  PID:8836
- C:\Windows\System\GQwEjyx.exe
  C:\Windows\System\GQwEjyx.exe
  2⤵
  PID:8984
- C:\Windows\System\qRywyfV.exe
  C:\Windows\System\qRywyfV.exe
  2⤵
  PID:8856
- C:\Windows\System\HKyCfjU.exe
  C:\Windows\System\HKyCfjU.exe
  2⤵
  PID:8852
- C:\Windows\System\BelQZge.exe
  C:\Windows\System\BelQZge.exe
  2⤵
  PID:8500
- C:\Windows\System\RxuwCqU.exe
  C:\Windows\System\RxuwCqU.exe
  2⤵
  PID:8484
- C:\Windows\System\dQacrQy.exe
  C:\Windows\System\dQacrQy.exe
  2⤵
  PID:8696
- C:\Windows\System\zDWBYkM.exe
  C:\Windows\System\zDWBYkM.exe
  2⤵
  PID:8968
- C:\Windows\System\oKFZdou.exe
  C:\Windows\System\oKFZdou.exe
  2⤵
  PID:9124
- C:\Windows\System\SJIYOVO.exe
  C:\Windows\System\SJIYOVO.exe
  2⤵
  PID:8936
- C:\Windows\System\YdYEbvZ.exe
  C:\Windows\System\YdYEbvZ.exe
  2⤵
  PID:9232
- C:\Windows\System\WPPvgLJ.exe
  C:\Windows\System\WPPvgLJ.exe
  2⤵
  PID:9248
- C:\Windows\System\kGyszHK.exe
  C:\Windows\System\kGyszHK.exe
  2⤵
  PID:9264
- C:\Windows\System\XgcAHFU.exe
  C:\Windows\System\XgcAHFU.exe
  2⤵
  PID:9284
- C:\Windows\System\bFctKnJ.exe
  C:\Windows\System\bFctKnJ.exe
  2⤵
  PID:9300
- C:\Windows\System\sVDvQAP.exe
  C:\Windows\System\sVDvQAP.exe
  2⤵
  PID:9316
- C:\Windows\System\zmhidSL.exe
  C:\Windows\System\zmhidSL.exe
  2⤵
  PID:9332
- C:\Windows\System\XHFiygA.exe
  C:\Windows\System\XHFiygA.exe
  2⤵
  PID:9352
- C:\Windows\System\CshLCHy.exe
  C:\Windows\System\CshLCHy.exe
  2⤵
  PID:9368
- C:\Windows\System\cBKDIys.exe
  C:\Windows\System\cBKDIys.exe
  2⤵
  PID:9388
- C:\Windows\System\WBaRNwB.exe
  C:\Windows\System\WBaRNwB.exe
  2⤵
  PID:9404
- C:\Windows\System\TUBLojL.exe
  C:\Windows\System\TUBLojL.exe
  2⤵
  PID:9420
- C:\Windows\System\QpQCEfC.exe
  C:\Windows\System\QpQCEfC.exe
  2⤵
  PID:9436
- C:\Windows\System\YMljssY.exe
  C:\Windows\System\YMljssY.exe
  2⤵
  PID:9452
- C:\Windows\System\HINFJcI.exe
  C:\Windows\System\HINFJcI.exe
  2⤵
  PID:9468
- C:\Windows\System\ZRJECym.exe
  C:\Windows\System\ZRJECym.exe
  2⤵
  PID:9484
- C:\Windows\System\lTnoDHz.exe
  C:\Windows\System\lTnoDHz.exe
  2⤵
  PID:9500
- C:\Windows\System\ANSuCFI.exe
  C:\Windows\System\ANSuCFI.exe
  2⤵
  PID:9516
- C:\Windows\System\PkdBJfS.exe
  C:\Windows\System\PkdBJfS.exe
  2⤵
  PID:9532
- C:\Windows\System\mUkcMbc.exe
  C:\Windows\System\mUkcMbc.exe
  2⤵
  PID:9548
- C:\Windows\System\sycbIrG.exe
  C:\Windows\System\sycbIrG.exe
  2⤵
  PID:9564
- C:\Windows\System\oSHTlbE.exe
  C:\Windows\System\oSHTlbE.exe
  2⤵
  PID:9580
- C:\Windows\System\NqktccU.exe
  C:\Windows\System\NqktccU.exe
  2⤵
  PID:9596
- C:\Windows\System\lWSbJnA.exe
  C:\Windows\System\lWSbJnA.exe
  2⤵
  PID:9612
- C:\Windows\System\yeioTrW.exe
  C:\Windows\System\yeioTrW.exe
  2⤵
  PID:9628
- C:\Windows\System\PPzdUdL.exe
  C:\Windows\System\PPzdUdL.exe
  2⤵
  PID:9644
- C:\Windows\System\GkSFJEl.exe
  C:\Windows\System\GkSFJEl.exe
  2⤵
  PID:9660
- C:\Windows\System\QEbuMny.exe
  C:\Windows\System\QEbuMny.exe
  2⤵
  PID:9680
- C:\Windows\System\ALseBrs.exe
  C:\Windows\System\ALseBrs.exe
  2⤵
  PID:9696
- C:\Windows\System\cVdDWlt.exe
  C:\Windows\System\cVdDWlt.exe
  2⤵
  PID:9712
- C:\Windows\System\VzIgVSf.exe
  C:\Windows\System\VzIgVSf.exe
  2⤵
  PID:9728
- C:\Windows\System\EBBAvVR.exe
  C:\Windows\System\EBBAvVR.exe
  2⤵
  PID:9744
- C:\Windows\System\WwHfVuw.exe
  C:\Windows\System\WwHfVuw.exe
  2⤵
  PID:9760
- C:\Windows\System\vkoJegi.exe
  C:\Windows\System\vkoJegi.exe
  2⤵
  PID:9776
- C:\Windows\System\nnghuUp.exe
  C:\Windows\System\nnghuUp.exe
  2⤵
  PID:9792
- C:\Windows\System\POwoJvZ.exe
  C:\Windows\System\POwoJvZ.exe
  2⤵
  PID:9808
- C:\Windows\System\zgsPetH.exe
  C:\Windows\System\zgsPetH.exe
  2⤵
  PID:9824
- C:\Windows\System\BetoAEm.exe
  C:\Windows\System\BetoAEm.exe
  2⤵
  PID:9844
- C:\Windows\System\bJBrTiC.exe
  C:\Windows\System\bJBrTiC.exe
  2⤵
  PID:9860
- C:\Windows\System\IGAdGSu.exe
  C:\Windows\System\IGAdGSu.exe
  2⤵
  PID:9876
- C:\Windows\System\LSfwobT.exe
  C:\Windows\System\LSfwobT.exe
  2⤵
  PID:9892
- C:\Windows\System\eIRNPgU.exe
  C:\Windows\System\eIRNPgU.exe
  2⤵
  PID:9908
- C:\Windows\System\NArCfsO.exe
  C:\Windows\System\NArCfsO.exe
  2⤵
  PID:9924
- C:\Windows\System\JOUfmPK.exe
  C:\Windows\System\JOUfmPK.exe
  2⤵
  PID:9940
- C:\Windows\System\jRtkjJO.exe
  C:\Windows\System\jRtkjJO.exe
  2⤵
  PID:9956
- C:\Windows\System\SOgTfDb.exe
  C:\Windows\System\SOgTfDb.exe
  2⤵
  PID:9988
- C:\Windows\System\UFgVBFr.exe
  C:\Windows\System\UFgVBFr.exe
  2⤵
  PID:10004
- C:\Windows\System\KSVaySX.exe
  C:\Windows\System\KSVaySX.exe
  2⤵
  PID:10020
- C:\Windows\System\xKgLFWa.exe
  C:\Windows\System\xKgLFWa.exe
  2⤵
  PID:10052
- C:\Windows\System\kfZuHeJ.exe
  C:\Windows\System\kfZuHeJ.exe
  2⤵
  PID:10132
- C:\Windows\System\kVclLrv.exe
  C:\Windows\System\kVclLrv.exe
  2⤵
  PID:10232
- C:\Windows\System\xWmvaQB.exe
  C:\Windows\System\xWmvaQB.exe
  2⤵
  PID:9296
- C:\Windows\System\oPzMhSR.exe
  C:\Windows\System\oPzMhSR.exe
  2⤵
  PID:9308
- C:\Windows\System\VivDNFf.exe
  C:\Windows\System\VivDNFf.exe
  2⤵
  PID:9364
- C:\Windows\System\nSxHErP.exe
  C:\Windows\System\nSxHErP.exe
  2⤵
  PID:9380
- C:\Windows\System\POxcmGt.exe
  C:\Windows\System\POxcmGt.exe
  2⤵
  PID:9460
- C:\Windows\System\WtcYPmp.exe
  C:\Windows\System\WtcYPmp.exe
  2⤵
  PID:9524
- C:\Windows\System\QdsXvyL.exe
  C:\Windows\System\QdsXvyL.exe
  2⤵
  PID:9620
- C:\Windows\System\BKMXCeA.exe
  C:\Windows\System\BKMXCeA.exe
  2⤵
  PID:9756
- C:\Windows\System\yNagWUQ.exe
  C:\Windows\System\yNagWUQ.exe
  2⤵
  PID:9980
- C:\Windows\System\BqcRvUN.exe
  C:\Windows\System\BqcRvUN.exe
  2⤵
  PID:10032
- C:\Windows\System\ljjlIHH.exe
  C:\Windows\System\ljjlIHH.exe
  2⤵
  PID:10044
- C:\Windows\System\ohfjvfx.exe
  C:\Windows\System\ohfjvfx.exe
  2⤵
  PID:10084
- C:\Windows\System\QnoMThG.exe
  C:\Windows\System\QnoMThG.exe
  2⤵
  PID:10096
- C:\Windows\System\OjlwgQf.exe
  C:\Windows\System\OjlwgQf.exe
  2⤵
  PID:10140
- C:\Windows\System\yTbcHiw.exe
  C:\Windows\System\yTbcHiw.exe
  2⤵
  PID:10144
- C:\Windows\System\QKEJEhu.exe
  C:\Windows\System\QKEJEhu.exe
  2⤵
  PID:10164
- C:\Windows\System\WQGStXB.exe
  C:\Windows\System\WQGStXB.exe
  2⤵
  PID:10176
- C:\Windows\System\dVBJhgS.exe
  C:\Windows\System\dVBJhgS.exe
  2⤵
  PID:10200
- C:\Windows\System\cyHwWiK.exe
  C:\Windows\System\cyHwWiK.exe
  2⤵
  PID:10216
- C:\Windows\System\UTeQEPP.exe
  C:\Windows\System\UTeQEPP.exe
  2⤵
  PID:9224
- C:\Windows\System\SbAvEEN.exe
  C:\Windows\System\SbAvEEN.exe
  2⤵
  PID:9240
- C:\Windows\System\rfBZKYI.exe
  C:\Windows\System\rfBZKYI.exe
  2⤵
  PID:9260
- C:\Windows\System\viusaxp.exe
  C:\Windows\System\viusaxp.exe
  2⤵
  PID:9292
- C:\Windows\System\MlrnYpi.exe
  C:\Windows\System\MlrnYpi.exe
  2⤵
  PID:9324
- C:\Windows\System\pcDVaRG.exe
  C:\Windows\System\pcDVaRG.exe
  2⤵
  PID:9376
- C:\Windows\System\umWKYgb.exe
  C:\Windows\System\umWKYgb.exe
  2⤵
  PID:9432
- C:\Windows\System\LsUthFE.exe
  C:\Windows\System\LsUthFE.exe
  2⤵
  PID:9444
- C:\Windows\System\UKNfkQp.exe
  C:\Windows\System\UKNfkQp.exe
  2⤵
  PID:9476
- C:\Windows\System\gERzAtP.exe
  C:\Windows\System\gERzAtP.exe
  2⤵
  PID:9576
- C:\Windows\System\tAXxAFl.exe
  C:\Windows\System\tAXxAFl.exe
  2⤵
  PID:9604
- C:\Windows\System\zccYltq.exe
  C:\Windows\System\zccYltq.exe
  2⤵
  PID:9752
- C:\Windows\System\GZutSlF.exe
  C:\Windows\System\GZutSlF.exe
  2⤵
  PID:9656
- C:\Windows\System\aPLXMPW.exe
  C:\Windows\System\aPLXMPW.exe
  2⤵
  PID:9720
- C:\Windows\System\QjpztYc.exe
  C:\Windows\System\QjpztYc.exe
  2⤵
  PID:9676
- C:\Windows\System\ictTuYZ.exe
  C:\Windows\System\ictTuYZ.exe
  2⤵
  PID:9704
- C:\Windows\System\xveFFiH.exe
  C:\Windows\System\xveFFiH.exe
  2⤵
  PID:9816
- C:\Windows\System\EmjWLuE.exe
  C:\Windows\System\EmjWLuE.exe
  2⤵
  PID:9836
- C:\Windows\System\XQsarID.exe
  C:\Windows\System\XQsarID.exe
  2⤵
  PID:9884
- C:\Windows\System\dgWBDCY.exe
  C:\Windows\System\dgWBDCY.exe
  2⤵
  PID:9920
- C:\Windows\System\dHeAxPZ.exe
  C:\Windows\System\dHeAxPZ.exe
  2⤵
  PID:9872
- C:\Windows\System\zTACPZl.exe
  C:\Windows\System\zTACPZl.exe
  2⤵
  PID:9952
- C:\Windows\System\SlZRxLV.exe
  C:\Windows\System\SlZRxLV.exe
  2⤵
  PID:9984
- C:\Windows\System\ODddDWI.exe
  C:\Windows\System\ODddDWI.exe
  2⤵
  PID:9012
- C:\Windows\System\XtmYaZo.exe
  C:\Windows\System\XtmYaZo.exe
  2⤵
  PID:10048
- C:\Windows\System\CPcwRax.exe
  C:\Windows\System\CPcwRax.exe
  2⤵
  PID:10076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CiSNUXl.exe

Filesize
1.0MB

MD5
5e8abf9dc0cd9a4e2608d2bfa4194dd3

SHA1
2ab4e8fc6ad0cbf21c118d4ea57ebdb553ad1c42

SHA256
4443dd58dedece4d1468ab0f4db016d1d428ac290fc0eff991250d8dddd93f61

SHA512
f364fa2df55d90c14332152fd01ec3ab51e2958ff2c7e7cea31c03e31faccfddf76bf640c8ca4187402dcc80efda48fbff702e3f34ec2964c3247e82d48bc9a6

Download Submit
C:\Windows\system\EUiakxE.exe

Filesize
1.0MB

MD5
57410e2954eb36cf09956c7005d71970

SHA1
d69ba2ffb425c2122908681de3027b458b6260f9

SHA256
30a9c1619bbbf109247d2ac98e17c89b318ee343d4c600fd549dd82f46288136

SHA512
002edf023f499895a26704b2b33f512d7564e04c5e3ac22d83af2d81d40b88033dd82269ee89272672d958f2b7bbbf2eda4e70b6053dd03d1c6b5633c296afd7

Download Submit
C:\Windows\system\FqoGtGj.exe

Filesize
1.0MB

MD5
6d9fb617b4a81020faaa9ec3ab144d51

SHA1
fad3b15ffc80134c9c6613d23381399417ad0537

SHA256
041a34c2cb30971ab36c8b2abbf610b4f9d923199b57c819b9add61b927d05c5

SHA512
0f0e709e0623fe4d973a0c71becc921439edc60cca11b3d2107f6d56bc3ce885a25a609371278718642a7b53c263e008b6bde66d12828ee5d8c10535e94b08b2

Download Submit
C:\Windows\system\IqKxFCc.exe

Filesize
1.0MB

MD5
46235eba22a2fbdb327dee336ad6dd21

SHA1
cbcb49fa6afebf6f302d46a42d785d4387af5b0a

SHA256
258a237390d717af50ff682fab7aca073566ac15bee8f323695c848dd1b9451e

SHA512
69e1e493c60a9f6a8b1393d9acb895fe94d9b37136ae535effc82d12008a9dd7f1715def03ca88a79fcc134fcd340a50177b48ff5af65139dd59c04f96bfd963

Download Submit
C:\Windows\system\JyWWQWi.exe

Filesize
1.0MB

MD5
553ec05590db1459d8a8cfa5d584894e

SHA1
5e7a0dc65996756811ce1d890f53cd2fd6697394

SHA256
46e31ddb8757da97bbd1ea43eb0cd35fff64818a28013309456ad431f47baac1

SHA512
58832659028d30ec34556cc46eb2f9b9e23a5557ace475683ff88c56637447ab8c3159a071d4bcfc362783e5c1cf62bd41383471cd9a5f550fbea5606fd0c57f

Download Submit
C:\Windows\system\LATEEPC.exe

Filesize
1.0MB

MD5
4b69f8f24fbd3c6c774c03925fcbd549

SHA1
61fbd33641f19a338851f94e3dcdf9c5f0c6afc9

SHA256
57f07fec0d941e66354e49756a6257de28a4edd0e587856839dddb0c4776765c

SHA512
a0731447330198f337e1ce54554f004f43ec3993dd5763a431aecdc59769fa1827cb74132bc4c9ecb6ab1add158dae046c969501b7ee037f8dfe3e986eed993e

Download Submit
C:\Windows\system\PmiSLWz.exe

Filesize
1.0MB

MD5
adbdaea3e15e5fab21bd1151224658c3

SHA1
ed7ca87df3e091bf01a09b12aaf17468f0eca1a4

SHA256
3092725d79e3cce8148f0e4ddf5d459cbb8bd24deac39275d544e02f9402fbbe

SHA512
e46f769bbbffd0574f27865e828e87a1ee14b606d664dcef4f45a1a2e7ff722079a7e9280d8806faec98fa079143e3a488ca518d6e7c09565ee48061f2c5a202

Download Submit
C:\Windows\system\QxxsbxH.exe

Filesize
1.0MB

MD5
c7efc4f4857e578381290bfd36ff5664

SHA1
2e9d76e3bde4112f47c650c6fcd79671d6159e41

SHA256
d8c71b7be0b75574847d393150c2b7a43c5da8d356df432277f15e6a44c0b3a3

SHA512
0e3336928d9cd8964c4ebc503c2e92ee1d4495caa4905001c5654e08cd8d4fef4dd2950bc7cab9a993e7340cbf371ba8c2ad5ce3b55394e039477fb3e6c6dbd7

Download Submit
C:\Windows\system\SPGdHXQ.exe

Filesize
1.0MB

MD5
7972ec88b9eedbcd438a4c04181473ea

SHA1
51f7158f3d8587154aa0e4eeedf08d71f5300993

SHA256
bda24121f81ce1e0c4c8306982e5926422c8409ce996403404b7770aa2d38de0

SHA512
02c7922c22fb99140d8706624d27225403a30914f0cbf931e8a9df9f47fa6c5e547e7844f45c02a8d0dbbaeef2a2b0cacca476b4610eb01f4f65383718eaa160

Download Submit
C:\Windows\system\SuxPKNI.exe

Filesize
1.0MB

MD5
f94efa587721fe5457ad6491945f7d3e

SHA1
e030c5896882267caf22ce84b346fc0e544f8399

SHA256
2cd6bd5fd9bdbd405ee6041e8a289e6ffa1de2ac25571bf635110d1562e0d248

SHA512
40cd4d9c0fdc8ce3f5a2f8ea38892b9cbdfb306788a86566ea937dd3ad62f463e0675aa6465c7b1a6cadff50dd1b925182fecfbce0217c56b4f82c4ddf5adc51

Download Submit
C:\Windows\system\UkhDZdS.exe

Filesize
1.0MB

MD5
ad7a3ca15cc806bf3b01828109d70e01

SHA1
fe5a9c03e1cf9456f88a5dcd77c0dad2769b065f

SHA256
a409c7568fc08b567aa51bf9cd0466fa002226b60b2a477065614c03942a23d6

SHA512
93d1d50ecb608d7cad4f84c029b93d7a4b659ee80ef6693ec03f58c6bc716db51beb46802285d331d2cfb75ed088ff214b32473498f9cf8b872968a43f77e988

Download Submit
C:\Windows\system\XPBIlfM.exe

Filesize
1.0MB

MD5
8b1eb65eecf8d86d8d6c66a39a7bd075

SHA1
f41e9d4aecd67e93d6e5711fdc191b56a580beb8

SHA256
b42a07bd7da07afa4570211066f62ca14e09ded67f7a071caba3211dbc8f9d6a

SHA512
8b687b36221d6cd99b72c1f08d574bcbabede07890dde7d5aee453eb7ad8eb9fcf42630a3a0f59b1ffc132861d650b8ad470ef1c2c8d0c165f36861e10b4d665

Download Submit
C:\Windows\system\YCgwxyQ.exe

Filesize
1.0MB

MD5
c8b423ec5d3d24b03e04a2c7104cd448

SHA1
55952e41be2abe917dce7c38580d3c388decd12d

SHA256
fc066e93113e30f022fc8e2a1b384adaeb82efb05fa06c33d124ab9d221aafd6

SHA512
4034cd7079a010bc8bd6f369deb58dbaab03b47e295568be2be28178c6ccb533419960b95b3c3ecb7abfa4dda34d42bfa086e16dcbf075900741d5062e4b59ef

Download Submit
C:\Windows\system\cSNCRwU.exe

Filesize
1.0MB

MD5
ad6fc7b6dc50d2e57d10bfad3ca068ad

SHA1
66c9ab9999a236061d4de52f9c515502f600956d

SHA256
123c1d8ed5590c574e63392a06099767f3d0df934d897490f4551de6859a67ad

SHA512
b1590370c77b1400620da00a26430f92401b4600fcbaf78556e352af6232b028055eac179ee1277b492d0c63aafa3aacd9748a719448719337cf34d7d07a3716

Download Submit
C:\Windows\system\dCZFwGs.exe

Filesize
1.0MB

MD5
fe25aa5cb7f287d3faa7061b05144d4f

SHA1
41e58723ce431fb0929dcf59ac387ff05122be07

SHA256
def094738dfc63b0b39698d4f63f918c07893f77b16c45872831e586e8fde395

SHA512
650322d028dd40500afb2b69935ce60d10b2bf122994bce8c48d0e4024451f53f9d039981b67fb45fb1c6035eecdb5468f70c264a5e1f76d9fd0a454e03ea980

Download Submit
C:\Windows\system\hIekTsO.exe

Filesize
1.0MB

MD5
70bbb98e309cbb985d2dd54ca78d2c6a

SHA1
4a8b326ab79a46548086e68450f702f0747455d8

SHA256
33fb676be59fa7b600bea57dc31821c6cfcc54c36193ed6ae17a3dc8cebf2e31

SHA512
faa79ca3a519008952bac1514e3debb8444429b9098bf9fda5112615548e7d3f2fd5d917f53811981e4973b9c33c7299bcce9cee0f41e38032fcb784ebb537f8

Download Submit
C:\Windows\system\hcsWnqs.exe

Filesize
1.0MB

MD5
6c4b8d25c7a6a5b3b5f31dbd3f73eb1b

SHA1
3b2c53e7af5917580dee7b1584615b50cd8f15cd

SHA256
89969c8e67592fd30aa2be1c1963687443a21f011ce9c39fed0544bde1490502

SHA512
4d17362a688b3d1447af3f7e82e664b335f9243423068d98ce2b4f2cf8492132bbcf4e8e01fafa7246da385ee5dbb33d826e6a314f558282fdbae7576eb605ea

Download Submit
C:\Windows\system\hgaPpRK.exe

Filesize
1.0MB

MD5
c0c8456750d189c74f0ba52b939dad46

SHA1
be768cd0d36c7c546e4e36b5c8ee9d9502b168fb

SHA256
4ca619b6b6ace2bfc03cdc7348a025b63a9b88e4c83814402f2b4169fa34a63c

SHA512
22affa345454040e2bf5365a0e85c1b6849d7635b2e8d23a2b5d03f5287445ce48c1b08b53b63d421546592f7575bc35d3c7889310d1623600db9fa51e06f7e6

Download Submit
C:\Windows\system\iXLqfCi.exe

Filesize
1.0MB

MD5
01d73cbfec1a890b0f49f22ad2565e1d

SHA1
068d602214b8fd50288745643d3e9e4fbf67eafd

SHA256
a81a92d8a5071588ae7f8e227d15176891a705b6655d978823b8698463be17bb

SHA512
913c572231bf74a681a0a31fbff93e484ea0daa1fdf8fec12710a6b7b96076479a018b23ec885ef6e79aa90f3d95e478d6d0f18047e08d68947c37412597e0a3

Download Submit
C:\Windows\system\kZHwjTg.exe

Filesize
1.0MB

MD5
c9d58d01ade6da5337298e8ab4ec1698

SHA1
843b3ee30dc02bf207c0958bde1fb9c6944eda05

SHA256
92524186fa53c5ddc8b4d20513a1ddeb07addd5ee477384cb856e840b41dd239

SHA512
17919c089a0c2249167106634b42ce3651f6a4f08b767ae81a9666c5dbe61debdfaaf53019504e96a47d89b6412cda33284692803c3a21695e5b37d03107aa0d

Download Submit
C:\Windows\system\nmDGCwv.exe

Filesize
1.0MB

MD5
ec7da6d38d7681f4eceb5751311e26a4

SHA1
e5a5048215ea28aea8e066c379e6bb8f7253afff

SHA256
db3e7612ceb2278aceadc97c4571431c412f607367f3eb1bc4723e04e360c147

SHA512
43a8c4a1fafd170e4e89dafb8abc061212a5a909989f2a96cf195ca8ab3380d53e966fafbdfb2b86e875053657d4e18a7a404dc2b6552cbccd16bf41bed53820

Download Submit
C:\Windows\system\ofPrPhd.exe

Filesize
1.0MB

MD5
5b55ed2b855b42b9e4948f6e186fd7d5

SHA1
7dfc35b898bd5cf69a3120505d47753b4842aae1

SHA256
db46a078a333bf50761a8c201c37bd153a00b0972be9d77dab708def71c2ff8f

SHA512
c41f996978c2c74e7e60571905861b8b8bca2f02e19c1a3bd7c84d5e5a4e95bb6d6e7075aeb32f8b987eed10df3e5b1c56a83ad686e847cf939e93646fee2f3c

Download Submit
C:\Windows\system\qFpuqPB.exe

Filesize
1.0MB

MD5
581b7d8c98bf960c292411c09f4d8308

SHA1
730f2d95631956ccd711c4d6d334fa5fba82bdf9

SHA256
c19e2bb1c654877f502ed323e0a96d78445a16ca81f989a1fb5063165f851787

SHA512
baed67fc628f534954725847274156648f0d4c289d5933e09c6e50a5fc3e78391111d00e575a835799ae057be2265dfb9f312047ebbc4003166e8f4d075d7f1f

Download Submit
C:\Windows\system\rTcrDHx.exe

Filesize
1.0MB

MD5
595e4eb549d4320a91bcd14a887b7459

SHA1
9f4bab7a6c457a0a9b4bd9b042c54114e0b80378

SHA256
1a99e2faa08b82ee01af6a620ebbc875e7e05ec94028a970ae8f8cd74c5c3e27

SHA512
17f3ad3b0694b5ac8ca06a574e0fc81386e42dd4a24b910a0b2bb00e8a263b4c1c0b0f68328ca2dd15b7d7248e2b9edb7c75fa859e276fffb6f28cbf3f88d318

Download Submit
C:\Windows\system\tboJFeq.exe

Filesize
1.0MB

MD5
0c3c6259bd1efd4bd218698c84c29082

SHA1
6e4432da6d71047097e0bf3b21801d0b66f0ffa4

SHA256
a338c56ea64671f8ab8ece372ae2b65f84c668954a5a15f786d8bb0893171751

SHA512
f35e7a1df5888c4c1a04b511d09fbd08c6dc1eb7a66d95f5eba419833be1a633745e1861e424bd2c12882f987f5dd1979a33754000bb2af2818ccbd254dfb2b6

Download Submit
C:\Windows\system\uFIpXyC.exe

Filesize
1.0MB

MD5
90d475a536895e8feaa4e231ec2f8fee

SHA1
78b998debae225d7ff19f2625361c5197a1ebe4f

SHA256
7dbb6541347cc20ba54c7cb71797fc5008eb07ae9e39592927662fe2329192cb

SHA512
e7dfacc711488a1ac8360066b2fce90dcefb802c07d77f376a3a43e02e27b229d96083d9ad97dcab0943f952a8ee4dca7fc68d29c4e752985e506ab534b66f1b

Download Submit
C:\Windows\system\wKUgcSc.exe

Filesize
1.0MB

MD5
e6119ec98ed4c90dfeafafba70d82fba

SHA1
b2c793333261bdc55c6daa6b7d902123e0eb1155

SHA256
e2d99244ab18983500d2c8972f2cf84bcad2bbbe728f8412ea43655185234edf

SHA512
8fc6851b4c43db884c7c3cc6fa4a960232afb872a0fcc7cbf673af5bbafa5174279b44ecab804c6a4efd85345e08eca81ccd5ab0026cdc7f1ac61f51ba969198

Download Submit
C:\Windows\system\xCGEoND.exe

Filesize
1.0MB

MD5
05e34a03019dcb9248243b58f2f3b2d8

SHA1
e4a1ca5c7db3e0686abd835f274e4c1fd2c95510

SHA256
a3fdce405a501d53a5de235d1aa6b37ea6bc97e3274506305f0dc78a3c80abce

SHA512
6384eba25d65533d9813fb2b2d4ce2f98a208330757362c921af0e75d4dcc6b6fc72497af05261d2a06635e562c5311a4a91f681b46dc29798c8dac715ba26a3

Download Submit
C:\Windows\system\xJGcodv.exe

Filesize
1.0MB

MD5
ea714e307cdf67c245eecc0bada05e6e

SHA1
020f287d0c0635e4767877ba2f459a162fbdcc07

SHA256
31efdc46689f42ebc729794af7cf7c7966d0a74425439670df0376ddc5da23d9

SHA512
cf8418db79edcdc90549710af4a3fbe74e4434a96fc699a40f6e009b681f4d069ae70ea3b458822156bd27ab207491eee55f6fdf859e7222c4448fbff78d0eda

Download Submit
C:\Windows\system\xeeZBgX.exe

Filesize
1.0MB

MD5
632817e63d7ae1352173d5a8ee73ffa0

SHA1
c2fcc1d89c1286618c1e6bd00e0c6cb9239b2d1c

SHA256
1208b2e2b706e61ed8fd54ce9a6a91ba09624a1cb75800c3a77190bf3aa0bfb8

SHA512
66788d1a7d4f53fce36f31cd3774039054f75c2b5742c7bc03837dd95ed9f12db619cb6b209c3a991dec806f5cf7db283b122b8c1c29ba5fe32ca962ed08cea6

Download Submit
C:\Windows\system\zHFNIfw.exe

Filesize
1.0MB

MD5
767d104ffaba86429c49e2f42ab26c37

SHA1
30653735ead8f5880aa9ab7cb9557479bf1cfcc6

SHA256
6ba16c40e5c8c6c5bd82d6fa229099463b5ade062081aac45b7272f18a562ce7

SHA512
aa3120b77416c2993d1ab49d11085de76e64cb2692b95976dc0540be9cfbc34b3de2cf7759faf3366e21407f772289d3b44623531849c6726f1ce912b9f9293a

Download Submit
\Windows\system\YoSHORA.exe

Filesize
1.0MB

MD5
0878e3fda1817e7f928b2e3593b9b830

SHA1
2ae398ad0353634901bedba363cd2592fa11819e

SHA256
3638c80196ce8cbd58ae07141a8f73b1a0b46bcdf9ccfb74389e4b8cdd0295bf

SHA512
af0c052320195aec4f139e6552566ddfda19aa2c0db26770a33697e6323d0a7a9f8cad9f3e34b6d69a4159a01a1a91aee190d6f227d308237d39c24025be017d

Download Submit
memory/2012-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download