xmrig | ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
Size

1.0MB
MD5

b8a8dca19b9dbc8658bee2b2e9580eb4
SHA1

9385c0074c2cae722dfbd4927f850ca4114d8f18
SHA256

ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06
SHA512

be8cd227ef8369e49aaec207dd92365f173797596ba838d3ba32b63613f9b929e59ea7f10422c50951519516b6ac4e99546303ce21916c02b7727a13c5229c25
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMr2KwX:GezaTF8FcNkNdfE0pZ9ozttwIRQCH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
\Windows\system\jDnsWBE.exe	xmrig
\Windows\system\SpTvLAe.exe	xmrig
C:\Windows\system\tEZDYhc.exe	xmrig
\Windows\system\dMAxXyz.exe	xmrig
C:\Windows\system\eWRdWAA.exe	xmrig
C:\Windows\system\jbllXWU.exe	xmrig
C:\Windows\system\MwXEZtX.exe	xmrig
C:\Windows\system\odAXlHK.exe	xmrig
C:\Windows\system\XFhCxgR.exe	xmrig
C:\Windows\system\ZPLRFCo.exe	xmrig
C:\Windows\system\ayatYIJ.exe	xmrig
C:\Windows\system\TfXDAyh.exe	xmrig
C:\Windows\system\lofnbVD.exe	xmrig
C:\Windows\system\THSexVa.exe	xmrig
\Windows\system\HfJoXEd.exe	xmrig
C:\Windows\system\EAhNOLW.exe	xmrig
C:\Windows\system\uvGOCrM.exe	xmrig
C:\Windows\system\lNYEbLA.exe	xmrig
C:\Windows\system\uuyjimX.exe	xmrig
C:\Windows\system\FgUBnxX.exe	xmrig
C:\Windows\system\XODSduU.exe	xmrig
C:\Windows\system\pOWybBQ.exe	xmrig
C:\Windows\system\LdaCBZD.exe	xmrig
C:\Windows\system\nuRaMbW.exe	xmrig
C:\Windows\system\USBfhtq.exe	xmrig
C:\Windows\system\hMzElgL.exe	xmrig
C:\Windows\system\vnjBdoe.exe	xmrig
C:\Windows\system\yLmZBnh.exe	xmrig
C:\Windows\system\xuyqVHP.exe	xmrig
C:\Windows\system\GyFJMfq.exe	xmrig
C:\Windows\system\LHNgPmm.exe	xmrig
C:\Windows\system\QiqrwSQ.exe	xmrig

Executes dropped EXE 64 IoCs

Processes:

jDnsWBE.exeSpTvLAe.exetEZDYhc.exedMAxXyz.exeeWRdWAA.exejbllXWU.exeMwXEZtX.exeQiqrwSQ.exeodAXlHK.exeXFhCxgR.exeLHNgPmm.exeZPLRFCo.exeGyFJMfq.exeayatYIJ.exeTfXDAyh.exexuyqVHP.exeyLmZBnh.exevnjBdoe.exelofnbVD.exehMzElgL.exeUSBfhtq.exenuRaMbW.exeLdaCBZD.exeTHSexVa.exepOWybBQ.exeXODSduU.exeHfJoXEd.exeFgUBnxX.exeuuyjimX.exelNYEbLA.exeuvGOCrM.exeEAhNOLW.exePnXMwQj.exenDYMXGe.exeXIfbQvH.exeEQrHxxC.exesVTYHJH.exeaOtNrSu.exeSPWEalF.exeldFjQjA.exeycicVgF.exeeaCIlqc.exenXYcjld.exeWLBCAlJ.exeOrsLlcO.exeIkymszg.exeMHjSQnd.exeFezsWDF.exenxyZUUX.exetTTHyvP.exedSYlBeM.exeBXbagGt.exeojmLVXj.exeShBOJxe.exejyjONHG.exelwbAiHr.exeTKoVgCi.exenfWsycM.exeQXqkAnC.exeyAQVbAe.exeyeMCAws.exeyqjRaYQ.exeohBULWC.exeHNOXaPO.exe

pid	process
1776	jDnsWBE.exe
2352	SpTvLAe.exe
2288	tEZDYhc.exe
864	dMAxXyz.exe
1968	eWRdWAA.exe
2268	jbllXWU.exe
2736	MwXEZtX.exe
2700	QiqrwSQ.exe
2812	odAXlHK.exe
3012	XFhCxgR.exe
2728	LHNgPmm.exe
2712	ZPLRFCo.exe
2828	GyFJMfq.exe
2936	ayatYIJ.exe
2732	TfXDAyh.exe
2708	xuyqVHP.exe
2592	yLmZBnh.exe
2660	vnjBdoe.exe
2120	lofnbVD.exe
2460	hMzElgL.exe
1068	USBfhtq.exe
1624	nuRaMbW.exe
480	LdaCBZD.exe
588	THSexVa.exe
2900	pOWybBQ.exe
1948	XODSduU.exe
1028	HfJoXEd.exe
2316	FgUBnxX.exe
1996	uuyjimX.exe
2348	lNYEbLA.exe
576	uvGOCrM.exe
2108	EAhNOLW.exe
1864	PnXMwQj.exe
2896	nDYMXGe.exe
920	XIfbQvH.exe
2488	EQrHxxC.exe
1084	sVTYHJH.exe
2576	aOtNrSu.exe
3016	SPWEalF.exe
2556	ldFjQjA.exe
2916	ycicVgF.exe
1320	eaCIlqc.exe
336	nXYcjld.exe
952	WLBCAlJ.exe
1840	OrsLlcO.exe
1356	Ikymszg.exe
1772	MHjSQnd.exe
1548	FezsWDF.exe
2528	nxyZUUX.exe
2948	tTTHyvP.exe
908	dSYlBeM.exe
2052	BXbagGt.exe
1692	ojmLVXj.exe
2572	ShBOJxe.exe
2412	jyjONHG.exe
3032	lwbAiHr.exe
2228	TKoVgCi.exe
1648	nfWsycM.exe
2044	QXqkAnC.exe
1280	yAQVbAe.exe
1656	yeMCAws.exe
2360	yqjRaYQ.exe
1668	ohBULWC.exe
2284	HNOXaPO.exe

Loads dropped DLL 64 IoCs

Processes:

ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe

pid	process
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe

Drops file in Windows directory 64 IoCs

Processes:

ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe

description	ioc	process
File created	C:\Windows\System\ZcfhQck.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\VVMBbCn.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\xUWhBtp.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\tBUoduP.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\xwWTaLa.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\LVxDsSy.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\rvsZoaS.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\EFdLeJo.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\IhSkRbb.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\uzJsYzZ.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\PbjvqBy.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\ylDKsuK.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\xGRuJLG.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\kxlqaUk.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\yfQadmd.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\uuyjimX.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\ghhbNMI.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\HUyORym.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\oJVWlYg.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\bBiNTvj.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\klZxGYI.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\vmWwoQv.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\TuoSReB.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\jZwWpHi.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\jyjONHG.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\iFyKJDE.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\ZBjwDYb.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\BDlLQks.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\eWRdWAA.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\jBqivgE.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\AHumFbS.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\mMdzBoy.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\UhoNLTK.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\dXDzDnd.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\oeExncb.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\WPxQsYL.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\eULNaNE.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\sybyvFS.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\qaQQlhp.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\MRhzdRg.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\qhLxtbz.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\byBTcHb.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\LHNgPmm.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\pkhuEhi.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\DLGtFBR.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\oOIDziI.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\wpiMuMS.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\MUrBsFV.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\QubFwwi.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\zTovzgr.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\WeQrXyu.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\SIPIRvR.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\YKtvFwP.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\OWHbFtD.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\vDnyWjO.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\LzkthCb.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\haxRpIl.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\XOaiorl.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\MtppaJC.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\LfPqpvL.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\MHNxwpf.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\jZKbzCK.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\VwaSJbK.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
File created	C:\Windows\System\MbNYPwm.exe	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe

description	pid	process	target process
PID 2172 wrote to memory of 1776	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jDnsWBE.exe
PID 2172 wrote to memory of 1776	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jDnsWBE.exe
PID 2172 wrote to memory of 1776	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jDnsWBE.exe
PID 2172 wrote to memory of 2352	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	SpTvLAe.exe
PID 2172 wrote to memory of 2352	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	SpTvLAe.exe
PID 2172 wrote to memory of 2352	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	SpTvLAe.exe
PID 2172 wrote to memory of 2288	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	tEZDYhc.exe
PID 2172 wrote to memory of 2288	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	tEZDYhc.exe
PID 2172 wrote to memory of 2288	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	tEZDYhc.exe
PID 2172 wrote to memory of 864	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	dMAxXyz.exe
PID 2172 wrote to memory of 864	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	dMAxXyz.exe
PID 2172 wrote to memory of 864	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	dMAxXyz.exe
PID 2172 wrote to memory of 1968	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	eWRdWAA.exe
PID 2172 wrote to memory of 1968	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	eWRdWAA.exe
PID 2172 wrote to memory of 1968	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	eWRdWAA.exe
PID 2172 wrote to memory of 2268	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jbllXWU.exe
PID 2172 wrote to memory of 2268	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jbllXWU.exe
PID 2172 wrote to memory of 2268	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	jbllXWU.exe
PID 2172 wrote to memory of 2736	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	MwXEZtX.exe
PID 2172 wrote to memory of 2736	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	MwXEZtX.exe
PID 2172 wrote to memory of 2736	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	MwXEZtX.exe
PID 2172 wrote to memory of 2700	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	QiqrwSQ.exe
PID 2172 wrote to memory of 2700	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	QiqrwSQ.exe
PID 2172 wrote to memory of 2700	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	QiqrwSQ.exe
PID 2172 wrote to memory of 2812	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	odAXlHK.exe
PID 2172 wrote to memory of 2812	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	odAXlHK.exe
PID 2172 wrote to memory of 2812	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	odAXlHK.exe
PID 2172 wrote to memory of 3012	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	XFhCxgR.exe
PID 2172 wrote to memory of 3012	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	XFhCxgR.exe
PID 2172 wrote to memory of 3012	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	XFhCxgR.exe
PID 2172 wrote to memory of 2728	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	LHNgPmm.exe
PID 2172 wrote to memory of 2728	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	LHNgPmm.exe
PID 2172 wrote to memory of 2728	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	LHNgPmm.exe
PID 2172 wrote to memory of 2712	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ZPLRFCo.exe
PID 2172 wrote to memory of 2712	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ZPLRFCo.exe
PID 2172 wrote to memory of 2712	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ZPLRFCo.exe
PID 2172 wrote to memory of 2828	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	GyFJMfq.exe
PID 2172 wrote to memory of 2828	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	GyFJMfq.exe
PID 2172 wrote to memory of 2828	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	GyFJMfq.exe
PID 2172 wrote to memory of 2936	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ayatYIJ.exe
PID 2172 wrote to memory of 2936	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ayatYIJ.exe
PID 2172 wrote to memory of 2936	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	ayatYIJ.exe
PID 2172 wrote to memory of 2732	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	TfXDAyh.exe
PID 2172 wrote to memory of 2732	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	TfXDAyh.exe
PID 2172 wrote to memory of 2732	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	TfXDAyh.exe
PID 2172 wrote to memory of 2708	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	xuyqVHP.exe
PID 2172 wrote to memory of 2708	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	xuyqVHP.exe
PID 2172 wrote to memory of 2708	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	xuyqVHP.exe
PID 2172 wrote to memory of 2592	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	yLmZBnh.exe
PID 2172 wrote to memory of 2592	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	yLmZBnh.exe
PID 2172 wrote to memory of 2592	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	yLmZBnh.exe
PID 2172 wrote to memory of 2660	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	vnjBdoe.exe
PID 2172 wrote to memory of 2660	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	vnjBdoe.exe
PID 2172 wrote to memory of 2660	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	vnjBdoe.exe
PID 2172 wrote to memory of 2120	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	lofnbVD.exe
PID 2172 wrote to memory of 2120	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	lofnbVD.exe
PID 2172 wrote to memory of 2120	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	lofnbVD.exe
PID 2172 wrote to memory of 2460	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	hMzElgL.exe
PID 2172 wrote to memory of 2460	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	hMzElgL.exe
PID 2172 wrote to memory of 2460	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	hMzElgL.exe
PID 2172 wrote to memory of 1068	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	USBfhtq.exe
PID 2172 wrote to memory of 1068	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	USBfhtq.exe
PID 2172 wrote to memory of 1068	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	USBfhtq.exe
PID 2172 wrote to memory of 1624	2172	ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe	nuRaMbW.exe

C:\Users\Admin\AppData\Local\Temp\ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe
"C:\Users\Admin\AppData\Local\Temp\ba64eaec591f968d5afe276ecce90f0062e1e5c1a93e51677c7451158cba9a06.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System\jDnsWBE.exe
  C:\Windows\System\jDnsWBE.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\SpTvLAe.exe
  C:\Windows\System\SpTvLAe.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\tEZDYhc.exe
  C:\Windows\System\tEZDYhc.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\dMAxXyz.exe
  C:\Windows\System\dMAxXyz.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\eWRdWAA.exe
  C:\Windows\System\eWRdWAA.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\jbllXWU.exe
  C:\Windows\System\jbllXWU.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\MwXEZtX.exe
  C:\Windows\System\MwXEZtX.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\QiqrwSQ.exe
  C:\Windows\System\QiqrwSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\odAXlHK.exe
  C:\Windows\System\odAXlHK.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\XFhCxgR.exe
  C:\Windows\System\XFhCxgR.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\LHNgPmm.exe
  C:\Windows\System\LHNgPmm.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ZPLRFCo.exe
  C:\Windows\System\ZPLRFCo.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GyFJMfq.exe
  C:\Windows\System\GyFJMfq.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ayatYIJ.exe
  C:\Windows\System\ayatYIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\TfXDAyh.exe
  C:\Windows\System\TfXDAyh.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xuyqVHP.exe
  C:\Windows\System\xuyqVHP.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\yLmZBnh.exe
  C:\Windows\System\yLmZBnh.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\vnjBdoe.exe
  C:\Windows\System\vnjBdoe.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\lofnbVD.exe
  C:\Windows\System\lofnbVD.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\hMzElgL.exe
  C:\Windows\System\hMzElgL.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\USBfhtq.exe
  C:\Windows\System\USBfhtq.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\nuRaMbW.exe
  C:\Windows\System\nuRaMbW.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\LdaCBZD.exe
  C:\Windows\System\LdaCBZD.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\THSexVa.exe
  C:\Windows\System\THSexVa.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\pOWybBQ.exe
  C:\Windows\System\pOWybBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\XODSduU.exe
  C:\Windows\System\XODSduU.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\HfJoXEd.exe
  C:\Windows\System\HfJoXEd.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\FgUBnxX.exe
  C:\Windows\System\FgUBnxX.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\uuyjimX.exe
  C:\Windows\System\uuyjimX.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\lNYEbLA.exe
  C:\Windows\System\lNYEbLA.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\uvGOCrM.exe
  C:\Windows\System\uvGOCrM.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\EAhNOLW.exe
  C:\Windows\System\EAhNOLW.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\PnXMwQj.exe
  C:\Windows\System\PnXMwQj.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\nDYMXGe.exe
  C:\Windows\System\nDYMXGe.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\XIfbQvH.exe
  C:\Windows\System\XIfbQvH.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\EQrHxxC.exe
  C:\Windows\System\EQrHxxC.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\sVTYHJH.exe
  C:\Windows\System\sVTYHJH.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\aOtNrSu.exe
  C:\Windows\System\aOtNrSu.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\SPWEalF.exe
  C:\Windows\System\SPWEalF.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ldFjQjA.exe
  C:\Windows\System\ldFjQjA.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ycicVgF.exe
  C:\Windows\System\ycicVgF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\eaCIlqc.exe
  C:\Windows\System\eaCIlqc.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\nXYcjld.exe
  C:\Windows\System\nXYcjld.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\WLBCAlJ.exe
  C:\Windows\System\WLBCAlJ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\OrsLlcO.exe
  C:\Windows\System\OrsLlcO.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\Ikymszg.exe
  C:\Windows\System\Ikymszg.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\MHjSQnd.exe
  C:\Windows\System\MHjSQnd.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\FezsWDF.exe
  C:\Windows\System\FezsWDF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\nxyZUUX.exe
  C:\Windows\System\nxyZUUX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\tTTHyvP.exe
  C:\Windows\System\tTTHyvP.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\dSYlBeM.exe
  C:\Windows\System\dSYlBeM.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\BXbagGt.exe
  C:\Windows\System\BXbagGt.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ojmLVXj.exe
  C:\Windows\System\ojmLVXj.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ShBOJxe.exe
  C:\Windows\System\ShBOJxe.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\jyjONHG.exe
  C:\Windows\System\jyjONHG.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\lwbAiHr.exe
  C:\Windows\System\lwbAiHr.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\TKoVgCi.exe
  C:\Windows\System\TKoVgCi.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\nfWsycM.exe
  C:\Windows\System\nfWsycM.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\QXqkAnC.exe
  C:\Windows\System\QXqkAnC.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\yAQVbAe.exe
  C:\Windows\System\yAQVbAe.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\yeMCAws.exe
  C:\Windows\System\yeMCAws.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\yqjRaYQ.exe
  C:\Windows\System\yqjRaYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ohBULWC.exe
  C:\Windows\System\ohBULWC.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\HNOXaPO.exe
  C:\Windows\System\HNOXaPO.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\NRzIkXI.exe
  C:\Windows\System\NRzIkXI.exe
  2⤵
  PID:880
- C:\Windows\System\nmnHZoN.exe
  C:\Windows\System\nmnHZoN.exe
  2⤵
  PID:1392
- C:\Windows\System\jBqivgE.exe
  C:\Windows\System\jBqivgE.exe
  2⤵
  PID:1088
- C:\Windows\System\RBPlYRH.exe
  C:\Windows\System\RBPlYRH.exe
  2⤵
  PID:1612
- C:\Windows\System\zAEdyhL.exe
  C:\Windows\System\zAEdyhL.exe
  2⤵
  PID:2104
- C:\Windows\System\EwOhSHe.exe
  C:\Windows\System\EwOhSHe.exe
  2⤵
  PID:2112
- C:\Windows\System\YiZzQEM.exe
  C:\Windows\System\YiZzQEM.exe
  2⤵
  PID:2516
- C:\Windows\System\HncpWmV.exe
  C:\Windows\System\HncpWmV.exe
  2⤵
  PID:2880
- C:\Windows\System\DWCaIYG.exe
  C:\Windows\System\DWCaIYG.exe
  2⤵
  PID:2216
- C:\Windows\System\pkhuEhi.exe
  C:\Windows\System\pkhuEhi.exe
  2⤵
  PID:2800
- C:\Windows\System\gSrOYvh.exe
  C:\Windows\System\gSrOYvh.exe
  2⤵
  PID:2752
- C:\Windows\System\rvUDZfC.exe
  C:\Windows\System\rvUDZfC.exe
  2⤵
  PID:2996
- C:\Windows\System\ghhbNMI.exe
  C:\Windows\System\ghhbNMI.exe
  2⤵
  PID:2624
- C:\Windows\System\OigYnLu.exe
  C:\Windows\System\OigYnLu.exe
  2⤵
  PID:2644
- C:\Windows\System\VGRKJmw.exe
  C:\Windows\System\VGRKJmw.exe
  2⤵
  PID:2396
- C:\Windows\System\IrPlXnL.exe
  C:\Windows\System\IrPlXnL.exe
  2⤵
  PID:2332
- C:\Windows\System\HcNzLPF.exe
  C:\Windows\System\HcNzLPF.exe
  2⤵
  PID:1108
- C:\Windows\System\DRWZwsc.exe
  C:\Windows\System\DRWZwsc.exe
  2⤵
  PID:536
- C:\Windows\System\lsMUsfk.exe
  C:\Windows\System\lsMUsfk.exe
  2⤵
  PID:604
- C:\Windows\System\tKSHkvs.exe
  C:\Windows\System\tKSHkvs.exe
  2⤵
  PID:564
- C:\Windows\System\LZuikJo.exe
  C:\Windows\System\LZuikJo.exe
  2⤵
  PID:1424
- C:\Windows\System\mPocrKG.exe
  C:\Windows\System\mPocrKG.exe
  2⤵
  PID:1492
- C:\Windows\System\PLTbkHs.exe
  C:\Windows\System\PLTbkHs.exe
  2⤵
  PID:2232
- C:\Windows\System\GGiQDRO.exe
  C:\Windows\System\GGiQDRO.exe
  2⤵
  PID:1768
- C:\Windows\System\DwnnKos.exe
  C:\Windows\System\DwnnKos.exe
  2⤵
  PID:1012
- C:\Windows\System\pIODRBq.exe
  C:\Windows\System\pIODRBq.exe
  2⤵
  PID:1824
- C:\Windows\System\QMDjZmp.exe
  C:\Windows\System\QMDjZmp.exe
  2⤵
  PID:2212
- C:\Windows\System\WYRCnBM.exe
  C:\Windows\System\WYRCnBM.exe
  2⤵
  PID:1964
- C:\Windows\System\bowdTLA.exe
  C:\Windows\System\bowdTLA.exe
  2⤵
  PID:1072
- C:\Windows\System\YdVNCQc.exe
  C:\Windows\System\YdVNCQc.exe
  2⤵
  PID:2496
- C:\Windows\System\HFWSPFe.exe
  C:\Windows\System\HFWSPFe.exe
  2⤵
  PID:3004
- C:\Windows\System\yKocUmX.exe
  C:\Windows\System\yKocUmX.exe
  2⤵
  PID:1560
- C:\Windows\System\Natdvfb.exe
  C:\Windows\System\Natdvfb.exe
  2⤵
  PID:2480
- C:\Windows\System\dNfBTBF.exe
  C:\Windows\System\dNfBTBF.exe
  2⤵
  PID:1716
- C:\Windows\System\OWHbFtD.exe
  C:\Windows\System\OWHbFtD.exe
  2⤵
  PID:2456
- C:\Windows\System\DtUoThx.exe
  C:\Windows\System\DtUoThx.exe
  2⤵
  PID:1312
- C:\Windows\System\cvnYzeV.exe
  C:\Windows\System\cvnYzeV.exe
  2⤵
  PID:2508
- C:\Windows\System\jIcucpf.exe
  C:\Windows\System\jIcucpf.exe
  2⤵
  PID:708
- C:\Windows\System\PPwdgvb.exe
  C:\Windows\System\PPwdgvb.exe
  2⤵
  PID:2428
- C:\Windows\System\BkSEtSC.exe
  C:\Windows\System\BkSEtSC.exe
  2⤵
  PID:2436
- C:\Windows\System\SEAeWxy.exe
  C:\Windows\System\SEAeWxy.exe
  2⤵
  PID:1516
- C:\Windows\System\OArwEwr.exe
  C:\Windows\System\OArwEwr.exe
  2⤵
  PID:2552
- C:\Windows\System\mFbeYDH.exe
  C:\Windows\System\mFbeYDH.exe
  2⤵
  PID:2256
- C:\Windows\System\FRYjqSk.exe
  C:\Windows\System\FRYjqSk.exe
  2⤵
  PID:1580
- C:\Windows\System\wkvToEd.exe
  C:\Windows\System\wkvToEd.exe
  2⤵
  PID:2988
- C:\Windows\System\qnwHqBL.exe
  C:\Windows\System\qnwHqBL.exe
  2⤵
  PID:2468
- C:\Windows\System\OanGTYc.exe
  C:\Windows\System\OanGTYc.exe
  2⤵
  PID:2868
- C:\Windows\System\TfyjMrD.exe
  C:\Windows\System\TfyjMrD.exe
  2⤵
  PID:2208
- C:\Windows\System\YrvAKli.exe
  C:\Windows\System\YrvAKli.exe
  2⤵
  PID:2716
- C:\Windows\System\ubBMCWl.exe
  C:\Windows\System\ubBMCWl.exe
  2⤵
  PID:2320
- C:\Windows\System\JEQEzed.exe
  C:\Windows\System\JEQEzed.exe
  2⤵
  PID:2940
- C:\Windows\System\JiULEjJ.exe
  C:\Windows\System\JiULEjJ.exe
  2⤵
  PID:2544
- C:\Windows\System\aaUBrYX.exe
  C:\Windows\System\aaUBrYX.exe
  2⤵
  PID:1132
- C:\Windows\System\KuqdZmS.exe
  C:\Windows\System\KuqdZmS.exe
  2⤵
  PID:652
- C:\Windows\System\VbBqHJZ.exe
  C:\Windows\System\VbBqHJZ.exe
  2⤵
  PID:844
- C:\Windows\System\xJbgvuw.exe
  C:\Windows\System\xJbgvuw.exe
  2⤵
  PID:556
- C:\Windows\System\XHaZeRf.exe
  C:\Windows\System\XHaZeRf.exe
  2⤵
  PID:1740
- C:\Windows\System\gJXcCYI.exe
  C:\Windows\System\gJXcCYI.exe
  2⤵
  PID:352
- C:\Windows\System\IYGKKyA.exe
  C:\Windows\System\IYGKKyA.exe
  2⤵
  PID:1736
- C:\Windows\System\FXJUysR.exe
  C:\Windows\System\FXJUysR.exe
  2⤵
  PID:888
- C:\Windows\System\gttevoF.exe
  C:\Windows\System\gttevoF.exe
  2⤵
  PID:2992
- C:\Windows\System\chcNIhm.exe
  C:\Windows\System\chcNIhm.exe
  2⤵
  PID:2040
- C:\Windows\System\IYcqlNs.exe
  C:\Windows\System\IYcqlNs.exe
  2⤵
  PID:2956
- C:\Windows\System\nrOisTC.exe
  C:\Windows\System\nrOisTC.exe
  2⤵
  PID:3048
- C:\Windows\System\fVEjQUz.exe
  C:\Windows\System\fVEjQUz.exe
  2⤵
  PID:2604
- C:\Windows\System\htZDUwA.exe
  C:\Windows\System\htZDUwA.exe
  2⤵
  PID:1856
- C:\Windows\System\olJIdtc.exe
  C:\Windows\System\olJIdtc.exe
  2⤵
  PID:1956
- C:\Windows\System\kniHgvJ.exe
  C:\Windows\System\kniHgvJ.exe
  2⤵
  PID:2976
- C:\Windows\System\lyiFmDM.exe
  C:\Windows\System\lyiFmDM.exe
  2⤵
  PID:2600
- C:\Windows\System\cDUIvzm.exe
  C:\Windows\System\cDUIvzm.exe
  2⤵
  PID:596
- C:\Windows\System\jpELtCY.exe
  C:\Windows\System\jpELtCY.exe
  2⤵
  PID:2892
- C:\Windows\System\IrobkLT.exe
  C:\Windows\System\IrobkLT.exe
  2⤵
  PID:268
- C:\Windows\System\ZVNHszV.exe
  C:\Windows\System\ZVNHszV.exe
  2⤵
  PID:2764
- C:\Windows\System\oeExncb.exe
  C:\Windows\System\oeExncb.exe
  2⤵
  PID:1676
- C:\Windows\System\iMAglhK.exe
  C:\Windows\System\iMAglhK.exe
  2⤵
  PID:1328
- C:\Windows\System\LIHXGoe.exe
  C:\Windows\System\LIHXGoe.exe
  2⤵
  PID:2504
- C:\Windows\System\XUbpyzP.exe
  C:\Windows\System\XUbpyzP.exe
  2⤵
  PID:1748
- C:\Windows\System\ZTGUwdu.exe
  C:\Windows\System\ZTGUwdu.exe
  2⤵
  PID:3100
- C:\Windows\System\qKsHFdm.exe
  C:\Windows\System\qKsHFdm.exe
  2⤵
  PID:3128
- C:\Windows\System\RQfBSfX.exe
  C:\Windows\System\RQfBSfX.exe
  2⤵
  PID:3144
- C:\Windows\System\QvkTeiu.exe
  C:\Windows\System\QvkTeiu.exe
  2⤵
  PID:3168
- C:\Windows\System\lPLVWFG.exe
  C:\Windows\System\lPLVWFG.exe
  2⤵
  PID:3184
- C:\Windows\System\rvsZoaS.exe
  C:\Windows\System\rvsZoaS.exe
  2⤵
  PID:3204
- C:\Windows\System\RitZExH.exe
  C:\Windows\System\RitZExH.exe
  2⤵
  PID:3220
- C:\Windows\System\MAFJnaq.exe
  C:\Windows\System\MAFJnaq.exe
  2⤵
  PID:3236
- C:\Windows\System\xhAxXwx.exe
  C:\Windows\System\xhAxXwx.exe
  2⤵
  PID:3256
- C:\Windows\System\iGVCaYs.exe
  C:\Windows\System\iGVCaYs.exe
  2⤵
  PID:3276
- C:\Windows\System\qEBrlWU.exe
  C:\Windows\System\qEBrlWU.exe
  2⤵
  PID:3324
- C:\Windows\System\hHwXnXT.exe
  C:\Windows\System\hHwXnXT.exe
  2⤵
  PID:3340
- C:\Windows\System\MRhzdRg.exe
  C:\Windows\System\MRhzdRg.exe
  2⤵
  PID:3356
- C:\Windows\System\zxHGTRG.exe
  C:\Windows\System\zxHGTRG.exe
  2⤵
  PID:3372
- C:\Windows\System\qNDkQhc.exe
  C:\Windows\System\qNDkQhc.exe
  2⤵
  PID:3388
- C:\Windows\System\aEJrEOG.exe
  C:\Windows\System\aEJrEOG.exe
  2⤵
  PID:3404
- C:\Windows\System\YWzIjFw.exe
  C:\Windows\System\YWzIjFw.exe
  2⤵
  PID:3420
- C:\Windows\System\fMTdFRn.exe
  C:\Windows\System\fMTdFRn.exe
  2⤵
  PID:3436
- C:\Windows\System\GvRmJGF.exe
  C:\Windows\System\GvRmJGF.exe
  2⤵
  PID:3452
- C:\Windows\System\aSAJXyB.exe
  C:\Windows\System\aSAJXyB.exe
  2⤵
  PID:3468
- C:\Windows\System\UqlfPod.exe
  C:\Windows\System\UqlfPod.exe
  2⤵
  PID:3484
- C:\Windows\System\XYaMdok.exe
  C:\Windows\System\XYaMdok.exe
  2⤵
  PID:3500
- C:\Windows\System\mghXzlr.exe
  C:\Windows\System\mghXzlr.exe
  2⤵
  PID:3516
- C:\Windows\System\VtiQmZf.exe
  C:\Windows\System\VtiQmZf.exe
  2⤵
  PID:3532
- C:\Windows\System\HgcuxeP.exe
  C:\Windows\System\HgcuxeP.exe
  2⤵
  PID:3548
- C:\Windows\System\MUrBsFV.exe
  C:\Windows\System\MUrBsFV.exe
  2⤵
  PID:3564
- C:\Windows\System\rqSgxNw.exe
  C:\Windows\System\rqSgxNw.exe
  2⤵
  PID:3580
- C:\Windows\System\GpTVpEv.exe
  C:\Windows\System\GpTVpEv.exe
  2⤵
  PID:3596
- C:\Windows\System\YWzvLjX.exe
  C:\Windows\System\YWzvLjX.exe
  2⤵
  PID:3612
- C:\Windows\System\LzhkEmV.exe
  C:\Windows\System\LzhkEmV.exe
  2⤵
  PID:3628
- C:\Windows\System\TlefGit.exe
  C:\Windows\System\TlefGit.exe
  2⤵
  PID:3644
- C:\Windows\System\EFdLeJo.exe
  C:\Windows\System\EFdLeJo.exe
  2⤵
  PID:3660
- C:\Windows\System\XyzOpTM.exe
  C:\Windows\System\XyzOpTM.exe
  2⤵
  PID:3676
- C:\Windows\System\LfEkjAN.exe
  C:\Windows\System\LfEkjAN.exe
  2⤵
  PID:3692
- C:\Windows\System\HvvXjgp.exe
  C:\Windows\System\HvvXjgp.exe
  2⤵
  PID:3708
- C:\Windows\System\EuUJqmv.exe
  C:\Windows\System\EuUJqmv.exe
  2⤵
  PID:3728
- C:\Windows\System\FeVymhQ.exe
  C:\Windows\System\FeVymhQ.exe
  2⤵
  PID:3744
- C:\Windows\System\gFXSWcH.exe
  C:\Windows\System\gFXSWcH.exe
  2⤵
  PID:3760
- C:\Windows\System\tGSapqM.exe
  C:\Windows\System\tGSapqM.exe
  2⤵
  PID:3776
- C:\Windows\System\lkdoOCM.exe
  C:\Windows\System\lkdoOCM.exe
  2⤵
  PID:3792
- C:\Windows\System\hhsjGlQ.exe
  C:\Windows\System\hhsjGlQ.exe
  2⤵
  PID:3808
- C:\Windows\System\mgHwXFy.exe
  C:\Windows\System\mgHwXFy.exe
  2⤵
  PID:3824
- C:\Windows\System\WVVBXmR.exe
  C:\Windows\System\WVVBXmR.exe
  2⤵
  PID:3840
- C:\Windows\System\PQcQNMr.exe
  C:\Windows\System\PQcQNMr.exe
  2⤵
  PID:3856
- C:\Windows\System\CeDpKEU.exe
  C:\Windows\System\CeDpKEU.exe
  2⤵
  PID:3872
- C:\Windows\System\xsfxMRH.exe
  C:\Windows\System\xsfxMRH.exe
  2⤵
  PID:3888
- C:\Windows\System\vDnyWjO.exe
  C:\Windows\System\vDnyWjO.exe
  2⤵
  PID:3904
- C:\Windows\System\wvpCmxM.exe
  C:\Windows\System\wvpCmxM.exe
  2⤵
  PID:3920
- C:\Windows\System\RpSKXFS.exe
  C:\Windows\System\RpSKXFS.exe
  2⤵
  PID:3936
- C:\Windows\System\gnPlUXw.exe
  C:\Windows\System\gnPlUXw.exe
  2⤵
  PID:3952
- C:\Windows\System\RwJRpDK.exe
  C:\Windows\System\RwJRpDK.exe
  2⤵
  PID:3968
- C:\Windows\System\EhpPdNt.exe
  C:\Windows\System\EhpPdNt.exe
  2⤵
  PID:3984
- C:\Windows\System\CcWfFiM.exe
  C:\Windows\System\CcWfFiM.exe
  2⤵
  PID:4000
- C:\Windows\System\uQXfkrh.exe
  C:\Windows\System\uQXfkrh.exe
  2⤵
  PID:4016
- C:\Windows\System\WPxQsYL.exe
  C:\Windows\System\WPxQsYL.exe
  2⤵
  PID:4032
- C:\Windows\System\pHuQxuo.exe
  C:\Windows\System\pHuQxuo.exe
  2⤵
  PID:4048
- C:\Windows\System\QHSZKnt.exe
  C:\Windows\System\QHSZKnt.exe
  2⤵
  PID:4064
- C:\Windows\System\KIbOgbq.exe
  C:\Windows\System\KIbOgbq.exe
  2⤵
  PID:4080
- C:\Windows\System\nfTqOFy.exe
  C:\Windows\System\nfTqOFy.exe
  2⤵
  PID:2824
- C:\Windows\System\axweCin.exe
  C:\Windows\System\axweCin.exe
  2⤵
  PID:3028
- C:\Windows\System\YQBRSjq.exe
  C:\Windows\System\YQBRSjq.exe
  2⤵
  PID:3112
- C:\Windows\System\aFjWGMC.exe
  C:\Windows\System\aFjWGMC.exe
  2⤵
  PID:2864
- C:\Windows\System\cayqonN.exe
  C:\Windows\System\cayqonN.exe
  2⤵
  PID:2628
- C:\Windows\System\QSsXGSD.exe
  C:\Windows\System\QSsXGSD.exe
  2⤵
  PID:3164
- C:\Windows\System\oVpCSmc.exe
  C:\Windows\System\oVpCSmc.exe
  2⤵
  PID:288
- C:\Windows\System\zHfbJLv.exe
  C:\Windows\System\zHfbJLv.exe
  2⤵
  PID:3108
- C:\Windows\System\QveFMlH.exe
  C:\Windows\System\QveFMlH.exe
  2⤵
  PID:3120
- C:\Windows\System\kWnZrEj.exe
  C:\Windows\System\kWnZrEj.exe
  2⤵
  PID:2152
- C:\Windows\System\pvjZMTZ.exe
  C:\Windows\System\pvjZMTZ.exe
  2⤵
  PID:2616
- C:\Windows\System\qKXZUKc.exe
  C:\Windows\System\qKXZUKc.exe
  2⤵
  PID:2024
- C:\Windows\System\BOdlSGp.exe
  C:\Windows\System\BOdlSGp.exe
  2⤵
  PID:2672
- C:\Windows\System\qxzLFpl.exe
  C:\Windows\System\qxzLFpl.exe
  2⤵
  PID:3092
- C:\Windows\System\sIEDNlz.exe
  C:\Windows\System\sIEDNlz.exe
  2⤵
  PID:3176
- C:\Windows\System\RWDAMYa.exe
  C:\Windows\System\RWDAMYa.exe
  2⤵
  PID:3244
- C:\Windows\System\oGHCbZp.exe
  C:\Windows\System\oGHCbZp.exe
  2⤵
  PID:1756
- C:\Windows\System\ajXoZIN.exe
  C:\Windows\System\ajXoZIN.exe
  2⤵
  PID:3264
- C:\Windows\System\tymwtqm.exe
  C:\Windows\System\tymwtqm.exe
  2⤵
  PID:3284
- C:\Windows\System\zhSdkaH.exe
  C:\Windows\System\zhSdkaH.exe
  2⤵
  PID:2536
- C:\Windows\System\jQltPjv.exe
  C:\Windows\System\jQltPjv.exe
  2⤵
  PID:3296
- C:\Windows\System\mExFYGR.exe
  C:\Windows\System\mExFYGR.exe
  2⤵
  PID:2584
- C:\Windows\System\HBxxZhm.exe
  C:\Windows\System\HBxxZhm.exe
  2⤵
  PID:1644
- C:\Windows\System\nZwauFa.exe
  C:\Windows\System\nZwauFa.exe
  2⤵
  PID:2080
- C:\Windows\System\nIJRCPE.exe
  C:\Windows\System\nIJRCPE.exe
  2⤵
  PID:2692
- C:\Windows\System\EjwqlMm.exe
  C:\Windows\System\EjwqlMm.exe
  2⤵
  PID:3320
- C:\Windows\System\pfVFLAa.exe
  C:\Windows\System\pfVFLAa.exe
  2⤵
  PID:2196
- C:\Windows\System\GEXtlVt.exe
  C:\Windows\System\GEXtlVt.exe
  2⤵
  PID:3384
- C:\Windows\System\ZcfhQck.exe
  C:\Windows\System\ZcfhQck.exe
  2⤵
  PID:3448
- C:\Windows\System\npfTBpO.exe
  C:\Windows\System\npfTBpO.exe
  2⤵
  PID:3428
- C:\Windows\System\jIlkVHW.exe
  C:\Windows\System\jIlkVHW.exe
  2⤵
  PID:3396
- C:\Windows\System\xaTbhuR.exe
  C:\Windows\System\xaTbhuR.exe
  2⤵
  PID:3492
- C:\Windows\System\nvUFUez.exe
  C:\Windows\System\nvUFUez.exe
  2⤵
  PID:3508
- C:\Windows\System\dDPvSiu.exe
  C:\Windows\System\dDPvSiu.exe
  2⤵
  PID:3572
- C:\Windows\System\IDeDBII.exe
  C:\Windows\System\IDeDBII.exe
  2⤵
  PID:3608
- C:\Windows\System\qHmyJNt.exe
  C:\Windows\System\qHmyJNt.exe
  2⤵
  PID:3624
- C:\Windows\System\pFCUglC.exe
  C:\Windows\System\pFCUglC.exe
  2⤵
  PID:3656
- C:\Windows\System\ioxDxfQ.exe
  C:\Windows\System\ioxDxfQ.exe
  2⤵
  PID:3704
- C:\Windows\System\gTSQKAv.exe
  C:\Windows\System\gTSQKAv.exe
  2⤵
  PID:3724
- C:\Windows\System\gsZEYwR.exe
  C:\Windows\System\gsZEYwR.exe
  2⤵
  PID:3784
- C:\Windows\System\NqvXouE.exe
  C:\Windows\System\NqvXouE.exe
  2⤵
  PID:3848
- C:\Windows\System\gOWLIVu.exe
  C:\Windows\System\gOWLIVu.exe
  2⤵
  PID:3820
- C:\Windows\System\xAwUiSL.exe
  C:\Windows\System\xAwUiSL.exe
  2⤵
  PID:3768
- C:\Windows\System\ISZxsOZ.exe
  C:\Windows\System\ISZxsOZ.exe
  2⤵
  PID:3804
- C:\Windows\System\MLUjgBp.exe
  C:\Windows\System\MLUjgBp.exe
  2⤵
  PID:3896
- C:\Windows\System\GJMXDVN.exe
  C:\Windows\System\GJMXDVN.exe
  2⤵
  PID:3960
- C:\Windows\System\robSRsl.exe
  C:\Windows\System\robSRsl.exe
  2⤵
  PID:4024
- C:\Windows\System\eLqpRFV.exe
  C:\Windows\System\eLqpRFV.exe
  2⤵
  PID:3944
- C:\Windows\System\tjKNuHw.exe
  C:\Windows\System\tjKNuHw.exe
  2⤵
  PID:4076
- C:\Windows\System\mzWwWlm.exe
  C:\Windows\System\mzWwWlm.exe
  2⤵
  PID:3152
- C:\Windows\System\etVRVyR.exe
  C:\Windows\System\etVRVyR.exe
  2⤵
  PID:2612
- C:\Windows\System\UPgUFKy.exe
  C:\Windows\System\UPgUFKy.exe
  2⤵
  PID:544
- C:\Windows\System\hQpWENO.exe
  C:\Windows\System\hQpWENO.exe
  2⤵
  PID:3084
- C:\Windows\System\lUkusUH.exe
  C:\Windows\System\lUkusUH.exe
  2⤵
  PID:3160
- C:\Windows\System\eqsWRpa.exe
  C:\Windows\System\eqsWRpa.exe
  2⤵
  PID:2852
- C:\Windows\System\gkaflEC.exe
  C:\Windows\System\gkaflEC.exe
  2⤵
  PID:2224
- C:\Windows\System\NEbkhoL.exe
  C:\Windows\System\NEbkhoL.exe
  2⤵
  PID:1620
- C:\Windows\System\RmbaIot.exe
  C:\Windows\System\RmbaIot.exe
  2⤵
  PID:2384
- C:\Windows\System\sGyrHRx.exe
  C:\Windows\System\sGyrHRx.exe
  2⤵
  PID:3216
- C:\Windows\System\dCYedmD.exe
  C:\Windows\System\dCYedmD.exe
  2⤵
  PID:2772
- C:\Windows\System\NXGqPJr.exe
  C:\Windows\System\NXGqPJr.exe
  2⤵
  PID:1500
- C:\Windows\System\TXRkASK.exe
  C:\Windows\System\TXRkASK.exe
  2⤵
  PID:3368
- C:\Windows\System\HcdoGJL.exe
  C:\Windows\System\HcdoGJL.exe
  2⤵
  PID:3540
- C:\Windows\System\lFTHQkH.exe
  C:\Windows\System\lFTHQkH.exe
  2⤵
  PID:3672
- C:\Windows\System\XNMNfhB.exe
  C:\Windows\System\XNMNfhB.exe
  2⤵
  PID:3288
- C:\Windows\System\rasTRwI.exe
  C:\Windows\System\rasTRwI.exe
  2⤵
  PID:2952
- C:\Windows\System\bEVxQkR.exe
  C:\Windows\System\bEVxQkR.exe
  2⤵
  PID:3336
- C:\Windows\System\nphMyFo.exe
  C:\Windows\System\nphMyFo.exe
  2⤵
  PID:3464
- C:\Windows\System\ISSKpij.exe
  C:\Windows\System\ISSKpij.exe
  2⤵
  PID:3560
- C:\Windows\System\qvLpGTr.exe
  C:\Windows\System\qvLpGTr.exe
  2⤵
  PID:3716
- C:\Windows\System\PkRTWfZ.exe
  C:\Windows\System\PkRTWfZ.exe
  2⤵
  PID:3772
- C:\Windows\System\sCzAwoa.exe
  C:\Windows\System\sCzAwoa.exe
  2⤵
  PID:3800
- C:\Windows\System\MSzJVsk.exe
  C:\Windows\System\MSzJVsk.exe
  2⤵
  PID:3884
- C:\Windows\System\EPzJlRi.exe
  C:\Windows\System\EPzJlRi.exe
  2⤵
  PID:3864
- C:\Windows\System\WLVJNuh.exe
  C:\Windows\System\WLVJNuh.exe
  2⤵
  PID:3996
- C:\Windows\System\joUuczT.exe
  C:\Windows\System\joUuczT.exe
  2⤵
  PID:4072
- C:\Windows\System\cAODujy.exe
  C:\Windows\System\cAODujy.exe
  2⤵
  PID:4092
- C:\Windows\System\GaDKSBo.exe
  C:\Windows\System\GaDKSBo.exe
  2⤵
  PID:2328
- C:\Windows\System\nopcFWD.exe
  C:\Windows\System\nopcFWD.exe
  2⤵
  PID:3252
- C:\Windows\System\PHWPxAT.exe
  C:\Windows\System\PHWPxAT.exe
  2⤵
  PID:3212
- C:\Windows\System\oenIEIw.exe
  C:\Windows\System\oenIEIw.exe
  2⤵
  PID:3528
- C:\Windows\System\nkCYZFR.exe
  C:\Windows\System\nkCYZFR.exe
  2⤵
  PID:3332
- C:\Windows\System\cJthEUp.exe
  C:\Windows\System\cJthEUp.exe
  2⤵
  PID:3832
- C:\Windows\System\ZwcoBnY.exe
  C:\Windows\System\ZwcoBnY.exe
  2⤵
  PID:1640
- C:\Windows\System\fXgowgQ.exe
  C:\Windows\System\fXgowgQ.exe
  2⤵
  PID:3592
- C:\Windows\System\gXbYUTx.exe
  C:\Windows\System\gXbYUTx.exe
  2⤵
  PID:3460
- C:\Windows\System\hMUQWQi.exe
  C:\Windows\System\hMUQWQi.exe
  2⤵
  PID:3124
- C:\Windows\System\bGehPcc.exe
  C:\Windows\System\bGehPcc.exe
  2⤵
  PID:4044
- C:\Windows\System\ljcYLpv.exe
  C:\Windows\System\ljcYLpv.exe
  2⤵
  PID:784
- C:\Windows\System\QJICpdy.exe
  C:\Windows\System\QJICpdy.exe
  2⤵
  PID:4108
- C:\Windows\System\wyRrmCe.exe
  C:\Windows\System\wyRrmCe.exe
  2⤵
  PID:4124
- C:\Windows\System\KcnOBeP.exe
  C:\Windows\System\KcnOBeP.exe
  2⤵
  PID:4140
- C:\Windows\System\LZSQHar.exe
  C:\Windows\System\LZSQHar.exe
  2⤵
  PID:4156
- C:\Windows\System\EsTnQCa.exe
  C:\Windows\System\EsTnQCa.exe
  2⤵
  PID:4172
- C:\Windows\System\Chiguwz.exe
  C:\Windows\System\Chiguwz.exe
  2⤵
  PID:4188
- C:\Windows\System\ZCLrQCH.exe
  C:\Windows\System\ZCLrQCH.exe
  2⤵
  PID:4204
- C:\Windows\System\crZyron.exe
  C:\Windows\System\crZyron.exe
  2⤵
  PID:4220
- C:\Windows\System\wPnDAIE.exe
  C:\Windows\System\wPnDAIE.exe
  2⤵
  PID:4236
- C:\Windows\System\xfjnbZV.exe
  C:\Windows\System\xfjnbZV.exe
  2⤵
  PID:4252
- C:\Windows\System\WvmoNKV.exe
  C:\Windows\System\WvmoNKV.exe
  2⤵
  PID:4268
- C:\Windows\System\fPioDDg.exe
  C:\Windows\System\fPioDDg.exe
  2⤵
  PID:4284
- C:\Windows\System\RXHDSuM.exe
  C:\Windows\System\RXHDSuM.exe
  2⤵
  PID:4300
- C:\Windows\System\VZSEVnF.exe
  C:\Windows\System\VZSEVnF.exe
  2⤵
  PID:4316
- C:\Windows\System\EjfrIiH.exe
  C:\Windows\System\EjfrIiH.exe
  2⤵
  PID:4332
- C:\Windows\System\AkejWBE.exe
  C:\Windows\System\AkejWBE.exe
  2⤵
  PID:4348
- C:\Windows\System\Ykstzop.exe
  C:\Windows\System\Ykstzop.exe
  2⤵
  PID:4364
- C:\Windows\System\ABGutcX.exe
  C:\Windows\System\ABGutcX.exe
  2⤵
  PID:4380
- C:\Windows\System\mVKklmV.exe
  C:\Windows\System\mVKklmV.exe
  2⤵
  PID:4396
- C:\Windows\System\HJrSofV.exe
  C:\Windows\System\HJrSofV.exe
  2⤵
  PID:4412
- C:\Windows\System\lRqCxBP.exe
  C:\Windows\System\lRqCxBP.exe
  2⤵
  PID:4428
- C:\Windows\System\GtSwmaB.exe
  C:\Windows\System\GtSwmaB.exe
  2⤵
  PID:4444
- C:\Windows\System\nydfggn.exe
  C:\Windows\System\nydfggn.exe
  2⤵
  PID:4460
- C:\Windows\System\GRdORBe.exe
  C:\Windows\System\GRdORBe.exe
  2⤵
  PID:4476
- C:\Windows\System\NbSTFpA.exe
  C:\Windows\System\NbSTFpA.exe
  2⤵
  PID:4492
- C:\Windows\System\ccOGokz.exe
  C:\Windows\System\ccOGokz.exe
  2⤵
  PID:4508
- C:\Windows\System\dKfwlFK.exe
  C:\Windows\System\dKfwlFK.exe
  2⤵
  PID:4524
- C:\Windows\System\XWJYvCR.exe
  C:\Windows\System\XWJYvCR.exe
  2⤵
  PID:4540
- C:\Windows\System\vZZudEO.exe
  C:\Windows\System\vZZudEO.exe
  2⤵
  PID:4556
- C:\Windows\System\qsMNcjD.exe
  C:\Windows\System\qsMNcjD.exe
  2⤵
  PID:4572
- C:\Windows\System\gCKfcVk.exe
  C:\Windows\System\gCKfcVk.exe
  2⤵
  PID:4588
- C:\Windows\System\TnTruLN.exe
  C:\Windows\System\TnTruLN.exe
  2⤵
  PID:4604
- C:\Windows\System\iFyKJDE.exe
  C:\Windows\System\iFyKJDE.exe
  2⤵
  PID:4620
- C:\Windows\System\fbhnEli.exe
  C:\Windows\System\fbhnEli.exe
  2⤵
  PID:4636
- C:\Windows\System\GrvRXSZ.exe
  C:\Windows\System\GrvRXSZ.exe
  2⤵
  PID:4652
- C:\Windows\System\zwDXTYe.exe
  C:\Windows\System\zwDXTYe.exe
  2⤵
  PID:4668
- C:\Windows\System\SuXwKQA.exe
  C:\Windows\System\SuXwKQA.exe
  2⤵
  PID:4684
- C:\Windows\System\iWAlgbE.exe
  C:\Windows\System\iWAlgbE.exe
  2⤵
  PID:4700
- C:\Windows\System\DDfCxnj.exe
  C:\Windows\System\DDfCxnj.exe
  2⤵
  PID:4716
- C:\Windows\System\VjBQANx.exe
  C:\Windows\System\VjBQANx.exe
  2⤵
  PID:4732
- C:\Windows\System\AUEWWVD.exe
  C:\Windows\System\AUEWWVD.exe
  2⤵
  PID:4748
- C:\Windows\System\rEAZuuY.exe
  C:\Windows\System\rEAZuuY.exe
  2⤵
  PID:4764
- C:\Windows\System\HUyORym.exe
  C:\Windows\System\HUyORym.exe
  2⤵
  PID:4780
- C:\Windows\System\AyuFqkX.exe
  C:\Windows\System\AyuFqkX.exe
  2⤵
  PID:4796
- C:\Windows\System\XvhkhVM.exe
  C:\Windows\System\XvhkhVM.exe
  2⤵
  PID:4812
- C:\Windows\System\aJJSbOo.exe
  C:\Windows\System\aJJSbOo.exe
  2⤵
  PID:4828
- C:\Windows\System\ZxzIIgE.exe
  C:\Windows\System\ZxzIIgE.exe
  2⤵
  PID:4844
- C:\Windows\System\eMPRqjK.exe
  C:\Windows\System\eMPRqjK.exe
  2⤵
  PID:4860
- C:\Windows\System\QJAztZn.exe
  C:\Windows\System\QJAztZn.exe
  2⤵
  PID:4876
- C:\Windows\System\lGnVCPm.exe
  C:\Windows\System\lGnVCPm.exe
  2⤵
  PID:4892
- C:\Windows\System\tZkvzeu.exe
  C:\Windows\System\tZkvzeu.exe
  2⤵
  PID:4908
- C:\Windows\System\LSvPfyF.exe
  C:\Windows\System\LSvPfyF.exe
  2⤵
  PID:4924
- C:\Windows\System\XmXunFF.exe
  C:\Windows\System\XmXunFF.exe
  2⤵
  PID:4940
- C:\Windows\System\hKTbHRP.exe
  C:\Windows\System\hKTbHRP.exe
  2⤵
  PID:4956
- C:\Windows\System\NBShXqW.exe
  C:\Windows\System\NBShXqW.exe
  2⤵
  PID:4972
- C:\Windows\System\JOaPxpT.exe
  C:\Windows\System\JOaPxpT.exe
  2⤵
  PID:4988
- C:\Windows\System\ASFhSNP.exe
  C:\Windows\System\ASFhSNP.exe
  2⤵
  PID:5004
- C:\Windows\System\YLTCTjd.exe
  C:\Windows\System\YLTCTjd.exe
  2⤵
  PID:5020
- C:\Windows\System\IqZzaaf.exe
  C:\Windows\System\IqZzaaf.exe
  2⤵
  PID:5036
- C:\Windows\System\eULNaNE.exe
  C:\Windows\System\eULNaNE.exe
  2⤵
  PID:5052
- C:\Windows\System\zpgKrVM.exe
  C:\Windows\System\zpgKrVM.exe
  2⤵
  PID:5068
- C:\Windows\System\gZvZvyJ.exe
  C:\Windows\System\gZvZvyJ.exe
  2⤵
  PID:5084
- C:\Windows\System\mFkaHOR.exe
  C:\Windows\System\mFkaHOR.exe
  2⤵
  PID:5100
- C:\Windows\System\uSKzjoL.exe
  C:\Windows\System\uSKzjoL.exe
  2⤵
  PID:5116
- C:\Windows\System\RwdPfpA.exe
  C:\Windows\System\RwdPfpA.exe
  2⤵
  PID:3736
- C:\Windows\System\IFutFMU.exe
  C:\Windows\System\IFutFMU.exe
  2⤵
  PID:3916
- C:\Windows\System\UytnAtS.exe
  C:\Windows\System\UytnAtS.exe
  2⤵
  PID:3312
- C:\Windows\System\pzxqwjd.exe
  C:\Windows\System\pzxqwjd.exe
  2⤵
  PID:3140
- C:\Windows\System\WXWEysW.exe
  C:\Windows\System\WXWEysW.exe
  2⤵
  PID:3992
- C:\Windows\System\BMvnFLG.exe
  C:\Windows\System\BMvnFLG.exe
  2⤵
  PID:4008
- C:\Windows\System\ZqIhQhA.exe
  C:\Windows\System\ZqIhQhA.exe
  2⤵
  PID:4152
- C:\Windows\System\eekaCjH.exe
  C:\Windows\System\eekaCjH.exe
  2⤵
  PID:4200
- C:\Windows\System\XjwGcBM.exe
  C:\Windows\System\XjwGcBM.exe
  2⤵
  PID:4196
- C:\Windows\System\kPfrZAP.exe
  C:\Windows\System\kPfrZAP.exe
  2⤵
  PID:4264
- C:\Windows\System\UGMzwst.exe
  C:\Windows\System\UGMzwst.exe
  2⤵
  PID:4328
- C:\Windows\System\FKGZoQe.exe
  C:\Windows\System\FKGZoQe.exe
  2⤵
  PID:4392
- C:\Windows\System\qMxLkrt.exe
  C:\Windows\System\qMxLkrt.exe
  2⤵
  PID:4248
- C:\Windows\System\RwvJhOW.exe
  C:\Windows\System\RwvJhOW.exe
  2⤵
  PID:4216
- C:\Windows\System\dPGzxkl.exe
  C:\Windows\System\dPGzxkl.exe
  2⤵
  PID:4280
- C:\Windows\System\sODPXCQ.exe
  C:\Windows\System\sODPXCQ.exe
  2⤵
  PID:4376
- C:\Windows\System\TGPcgiC.exe
  C:\Windows\System\TGPcgiC.exe
  2⤵
  PID:4440
- C:\Windows\System\jlThsfI.exe
  C:\Windows\System\jlThsfI.exe
  2⤵
  PID:4504
- C:\Windows\System\hrJDGLE.exe
  C:\Windows\System\hrJDGLE.exe
  2⤵
  PID:4548
- C:\Windows\System\SMWTvkg.exe
  C:\Windows\System\SMWTvkg.exe
  2⤵
  PID:4616
- C:\Windows\System\FoulSOZ.exe
  C:\Windows\System\FoulSOZ.exe
  2⤵
  PID:4680
- C:\Windows\System\YnWMUvY.exe
  C:\Windows\System\YnWMUvY.exe
  2⤵
  PID:4712
- C:\Windows\System\GflIBOk.exe
  C:\Windows\System\GflIBOk.exe
  2⤵
  PID:4740
- C:\Windows\System\gGoHAEa.exe
  C:\Windows\System\gGoHAEa.exe
  2⤵
  PID:4596
- C:\Windows\System\QPlbhhE.exe
  C:\Windows\System\QPlbhhE.exe
  2⤵
  PID:4692
- C:\Windows\System\fmZbPgt.exe
  C:\Windows\System\fmZbPgt.exe
  2⤵
  PID:4756
- C:\Windows\System\XIdfigv.exe
  C:\Windows\System\XIdfigv.exe
  2⤵
  PID:4792
- C:\Windows\System\JlkMAqS.exe
  C:\Windows\System\JlkMAqS.exe
  2⤵
  PID:4856
- C:\Windows\System\IUxjSoT.exe
  C:\Windows\System\IUxjSoT.exe
  2⤵
  PID:4836
- C:\Windows\System\GTvJkZM.exe
  C:\Windows\System\GTvJkZM.exe
  2⤵
  PID:4888
- C:\Windows\System\DmPpQwf.exe
  C:\Windows\System\DmPpQwf.exe
  2⤵
  PID:4952
- C:\Windows\System\GttiuXj.exe
  C:\Windows\System\GttiuXj.exe
  2⤵
  PID:4936
- C:\Windows\System\mFFFDsS.exe
  C:\Windows\System\mFFFDsS.exe
  2⤵
  PID:5000
- C:\Windows\System\wviDNPg.exe
  C:\Windows\System\wviDNPg.exe
  2⤵
  PID:5092
- C:\Windows\System\xrRoszQ.exe
  C:\Windows\System\xrRoszQ.exe
  2⤵
  PID:4984
- C:\Windows\System\EHAZULP.exe
  C:\Windows\System\EHAZULP.exe
  2⤵
  PID:5048
- C:\Windows\System\rwLBcGO.exe
  C:\Windows\System\rwLBcGO.exe
  2⤵
  PID:5112
- C:\Windows\System\RxgVggL.exe
  C:\Windows\System\RxgVggL.exe
  2⤵
  PID:3380
- C:\Windows\System\FGpXtyO.exe
  C:\Windows\System\FGpXtyO.exe
  2⤵
  PID:5064
- C:\Windows\System\EYbOtvS.exe
  C:\Windows\System\EYbOtvS.exe
  2⤵
  PID:3816
- C:\Windows\System\JnJPVWU.exe
  C:\Windows\System\JnJPVWU.exe
  2⤵
  PID:4164
- C:\Windows\System\sHVpLZF.exe
  C:\Windows\System\sHVpLZF.exe
  2⤵
  PID:4388
- C:\Windows\System\DLGtFBR.exe
  C:\Windows\System\DLGtFBR.exe
  2⤵
  PID:4420
- C:\Windows\System\vgbFypy.exe
  C:\Windows\System\vgbFypy.exe
  2⤵
  PID:4324
- C:\Windows\System\EGaWlIV.exe
  C:\Windows\System\EGaWlIV.exe
  2⤵
  PID:4552
- C:\Windows\System\caCyWUv.exe
  C:\Windows\System\caCyWUv.exe
  2⤵
  PID:4536
- C:\Windows\System\RWIVSXd.exe
  C:\Windows\System\RWIVSXd.exe
  2⤵
  PID:4788
- C:\Windows\System\GxBhLsh.exe
  C:\Windows\System\GxBhLsh.exe
  2⤵
  PID:4948
- C:\Windows\System\vwNvzJI.exe
  C:\Windows\System\vwNvzJI.exe
  2⤵
  PID:5108
- C:\Windows\System\SUyxbsf.exe
  C:\Windows\System\SUyxbsf.exe
  2⤵
  PID:4644
- C:\Windows\System\xtmEelD.exe
  C:\Windows\System\xtmEelD.exe
  2⤵
  PID:4340
- C:\Windows\System\lyFJyFz.exe
  C:\Windows\System\lyFJyFz.exe
  2⤵
  PID:4708
- C:\Windows\System\XZcJkvt.exe
  C:\Windows\System\XZcJkvt.exe
  2⤵
  PID:4868
- C:\Windows\System\iExLlcs.exe
  C:\Windows\System\iExLlcs.exe
  2⤵
  PID:4872
- C:\Windows\System\vJukWrw.exe
  C:\Windows\System\vJukWrw.exe
  2⤵
  PID:4104
- C:\Windows\System\MUvuSnz.exe
  C:\Windows\System\MUvuSnz.exe
  2⤵
  PID:4372
- C:\Windows\System\MGCBWYp.exe
  C:\Windows\System\MGCBWYp.exe
  2⤵
  PID:4648
- C:\Windows\System\KdczdTZ.exe
  C:\Windows\System\KdczdTZ.exe
  2⤵
  PID:4436
- C:\Windows\System\CbsvSKa.exe
  C:\Windows\System\CbsvSKa.exe
  2⤵
  PID:4920
- C:\Windows\System\KivousH.exe
  C:\Windows\System\KivousH.exe
  2⤵
  PID:2140
- C:\Windows\System\tqXweVh.exe
  C:\Windows\System\tqXweVh.exe
  2⤵
  PID:4500
- C:\Windows\System\uPfwnvr.exe
  C:\Windows\System\uPfwnvr.exe
  2⤵
  PID:5060
- C:\Windows\System\JhvJYDE.exe
  C:\Windows\System\JhvJYDE.exe
  2⤵
  PID:4628
- C:\Windows\System\roqDnwI.exe
  C:\Windows\System\roqDnwI.exe
  2⤵
  PID:4260
- C:\Windows\System\VgPrGYh.exe
  C:\Windows\System\VgPrGYh.exe
  2⤵
  PID:3688
- C:\Windows\System\SPHQwcG.exe
  C:\Windows\System\SPHQwcG.exe
  2⤵
  PID:2724
- C:\Windows\System\gcegzRd.exe
  C:\Windows\System\gcegzRd.exe
  2⤵
  PID:4344
- C:\Windows\System\uexpLIq.exe
  C:\Windows\System\uexpLIq.exe
  2⤵
  PID:4664
- C:\Windows\System\ldYcUnD.exe
  C:\Windows\System\ldYcUnD.exe
  2⤵
  PID:4408
- C:\Windows\System\vUGzlpV.exe
  C:\Windows\System\vUGzlpV.exe
  2⤵
  PID:3524
- C:\Windows\System\dIdRaLg.exe
  C:\Windows\System\dIdRaLg.exe
  2⤵
  PID:5044
- C:\Windows\System\PViLxvg.exe
  C:\Windows\System\PViLxvg.exe
  2⤵
  PID:5136
- C:\Windows\System\NRVKZcP.exe
  C:\Windows\System\NRVKZcP.exe
  2⤵
  PID:5152
- C:\Windows\System\sVVPOPq.exe
  C:\Windows\System\sVVPOPq.exe
  2⤵
  PID:5168
- C:\Windows\System\YkstfLC.exe
  C:\Windows\System\YkstfLC.exe
  2⤵
  PID:5184
- C:\Windows\System\yWYpedW.exe
  C:\Windows\System\yWYpedW.exe
  2⤵
  PID:5200
- C:\Windows\System\VdJcFZD.exe
  C:\Windows\System\VdJcFZD.exe
  2⤵
  PID:5216
- C:\Windows\System\RQsNzIm.exe
  C:\Windows\System\RQsNzIm.exe
  2⤵
  PID:5232
- C:\Windows\System\ocxCfFE.exe
  C:\Windows\System\ocxCfFE.exe
  2⤵
  PID:5252
- C:\Windows\System\DenIHzl.exe
  C:\Windows\System\DenIHzl.exe
  2⤵
  PID:5268
- C:\Windows\System\KWTFGfl.exe
  C:\Windows\System\KWTFGfl.exe
  2⤵
  PID:5288
- C:\Windows\System\FVuvaHt.exe
  C:\Windows\System\FVuvaHt.exe
  2⤵
  PID:5304
- C:\Windows\System\qJvbLdJ.exe
  C:\Windows\System\qJvbLdJ.exe
  2⤵
  PID:5324
- C:\Windows\System\IBWaGIN.exe
  C:\Windows\System\IBWaGIN.exe
  2⤵
  PID:5344
- C:\Windows\System\LnhIvRc.exe
  C:\Windows\System\LnhIvRc.exe
  2⤵
  PID:5360
- C:\Windows\System\tOHKoLJ.exe
  C:\Windows\System\tOHKoLJ.exe
  2⤵
  PID:5376
- C:\Windows\System\CVqeDPk.exe
  C:\Windows\System\CVqeDPk.exe
  2⤵
  PID:5392
- C:\Windows\System\HDwYmNa.exe
  C:\Windows\System\HDwYmNa.exe
  2⤵
  PID:5408
- C:\Windows\System\eNuGjvW.exe
  C:\Windows\System\eNuGjvW.exe
  2⤵
  PID:5424
- C:\Windows\System\gbMEtFL.exe
  C:\Windows\System\gbMEtFL.exe
  2⤵
  PID:5444
- C:\Windows\System\TIhXiMY.exe
  C:\Windows\System\TIhXiMY.exe
  2⤵
  PID:5460
- C:\Windows\System\KFlqrdy.exe
  C:\Windows\System\KFlqrdy.exe
  2⤵
  PID:5476
- C:\Windows\System\yzojjCY.exe
  C:\Windows\System\yzojjCY.exe
  2⤵
  PID:5492
- C:\Windows\System\eIonXqn.exe
  C:\Windows\System\eIonXqn.exe
  2⤵
  PID:5592
- C:\Windows\System\GGZFuzi.exe
  C:\Windows\System\GGZFuzi.exe
  2⤵
  PID:5624
- C:\Windows\System\ruvxtQy.exe
  C:\Windows\System\ruvxtQy.exe
  2⤵
  PID:5640
- C:\Windows\System\KqVGbpa.exe
  C:\Windows\System\KqVGbpa.exe
  2⤵
  PID:5656
- C:\Windows\System\TrWLNNL.exe
  C:\Windows\System\TrWLNNL.exe
  2⤵
  PID:5672
- C:\Windows\System\JWFDBBo.exe
  C:\Windows\System\JWFDBBo.exe
  2⤵
  PID:5696
- C:\Windows\System\CfjmXVr.exe
  C:\Windows\System\CfjmXVr.exe
  2⤵
  PID:5712
- C:\Windows\System\RFJppSZ.exe
  C:\Windows\System\RFJppSZ.exe
  2⤵
  PID:5728
- C:\Windows\System\oJVWlYg.exe
  C:\Windows\System\oJVWlYg.exe
  2⤵
  PID:5744
- C:\Windows\System\KTeSJIj.exe
  C:\Windows\System\KTeSJIj.exe
  2⤵
  PID:5760
- C:\Windows\System\GIJaFlD.exe
  C:\Windows\System\GIJaFlD.exe
  2⤵
  PID:5776
- C:\Windows\System\pnrWBVF.exe
  C:\Windows\System\pnrWBVF.exe
  2⤵
  PID:5796
- C:\Windows\System\LZNRVde.exe
  C:\Windows\System\LZNRVde.exe
  2⤵
  PID:5812
- C:\Windows\System\GwcXAMg.exe
  C:\Windows\System\GwcXAMg.exe
  2⤵
  PID:5828
- C:\Windows\System\WGgUblX.exe
  C:\Windows\System\WGgUblX.exe
  2⤵
  PID:5844
- C:\Windows\System\YdNlXkn.exe
  C:\Windows\System\YdNlXkn.exe
  2⤵
  PID:5860
- C:\Windows\System\VVMBbCn.exe
  C:\Windows\System\VVMBbCn.exe
  2⤵
  PID:5876
- C:\Windows\System\YnBpJWQ.exe
  C:\Windows\System\YnBpJWQ.exe
  2⤵
  PID:5892
- C:\Windows\System\LxWmYvk.exe
  C:\Windows\System\LxWmYvk.exe
  2⤵
  PID:5908
- C:\Windows\System\qMkuGHi.exe
  C:\Windows\System\qMkuGHi.exe
  2⤵
  PID:5924
- C:\Windows\System\wBViDjE.exe
  C:\Windows\System\wBViDjE.exe
  2⤵
  PID:5940
- C:\Windows\System\TAvyhCf.exe
  C:\Windows\System\TAvyhCf.exe
  2⤵
  PID:5956
- C:\Windows\System\IDTJTir.exe
  C:\Windows\System\IDTJTir.exe
  2⤵
  PID:5972
- C:\Windows\System\PTxstmH.exe
  C:\Windows\System\PTxstmH.exe
  2⤵
  PID:5988
- C:\Windows\System\kEgWupd.exe
  C:\Windows\System\kEgWupd.exe
  2⤵
  PID:6004
- C:\Windows\System\gFfOYYB.exe
  C:\Windows\System\gFfOYYB.exe
  2⤵
  PID:6020
- C:\Windows\System\FeDtOSP.exe
  C:\Windows\System\FeDtOSP.exe
  2⤵
  PID:6036
- C:\Windows\System\cyjXmWd.exe
  C:\Windows\System\cyjXmWd.exe
  2⤵
  PID:6052
- C:\Windows\System\iKUIblC.exe
  C:\Windows\System\iKUIblC.exe
  2⤵
  PID:6068
- C:\Windows\System\Qrxaezh.exe
  C:\Windows\System\Qrxaezh.exe
  2⤵
  PID:6084
- C:\Windows\System\QwEKYnU.exe
  C:\Windows\System\QwEKYnU.exe
  2⤵
  PID:6100
- C:\Windows\System\rGprdVe.exe
  C:\Windows\System\rGprdVe.exe
  2⤵
  PID:6116
- C:\Windows\System\fiYSMgn.exe
  C:\Windows\System\fiYSMgn.exe
  2⤵
  PID:6132
- C:\Windows\System\cOHqbPG.exe
  C:\Windows\System\cOHqbPG.exe
  2⤵
  PID:5012
- C:\Windows\System\bhNSmGx.exe
  C:\Windows\System\bhNSmGx.exe
  2⤵
  PID:5180
- C:\Windows\System\pCFpDWN.exe
  C:\Windows\System\pCFpDWN.exe
  2⤵
  PID:5240
- C:\Windows\System\WXSqONB.exe
  C:\Windows\System\WXSqONB.exe
  2⤵
  PID:5280
- C:\Windows\System\VJuxRGB.exe
  C:\Windows\System\VJuxRGB.exe
  2⤵
  PID:5320
- C:\Windows\System\PaCXDrx.exe
  C:\Windows\System\PaCXDrx.exe
  2⤵
  PID:5388
- C:\Windows\System\zFkodwB.exe
  C:\Windows\System\zFkodwB.exe
  2⤵
  PID:4728
- C:\Windows\System\KBRRXLG.exe
  C:\Windows\System\KBRRXLG.exe
  2⤵
  PID:5128
- C:\Windows\System\QLLbKpy.exe
  C:\Windows\System\QLLbKpy.exe
  2⤵
  PID:5440
- C:\Windows\System\pWTNLlu.exe
  C:\Windows\System\pWTNLlu.exe
  2⤵
  PID:5504
- C:\Windows\System\DQXEdLZ.exe
  C:\Windows\System\DQXEdLZ.exe
  2⤵
  PID:5520
- C:\Windows\System\qqXnjYd.exe
  C:\Windows\System\qqXnjYd.exe
  2⤵
  PID:5536
- C:\Windows\System\hNEwWcg.exe
  C:\Windows\System\hNEwWcg.exe
  2⤵
  PID:5540
- C:\Windows\System\fQdzect.exe
  C:\Windows\System\fQdzect.exe
  2⤵
  PID:5548
- C:\Windows\System\ltTBJXt.exe
  C:\Windows\System\ltTBJXt.exe
  2⤵
  PID:5572
- C:\Windows\System\QlGjShQ.exe
  C:\Windows\System\QlGjShQ.exe
  2⤵
  PID:5436
- C:\Windows\System\cnJSTNf.exe
  C:\Windows\System\cnJSTNf.exe
  2⤵
  PID:5368
- C:\Windows\System\GSFwImW.exe
  C:\Windows\System\GSFwImW.exe
  2⤵
  PID:5296
- C:\Windows\System\hzXlnXD.exe
  C:\Windows\System\hzXlnXD.exe
  2⤵
  PID:5224
- C:\Windows\System\cXnJsQg.exe
  C:\Windows\System\cXnJsQg.exe
  2⤵
  PID:5484
- C:\Windows\System\xmjOwce.exe
  C:\Windows\System\xmjOwce.exe
  2⤵
  PID:5604
- C:\Windows\System\emDPczx.exe
  C:\Windows\System\emDPczx.exe
  2⤵
  PID:5620
- C:\Windows\System\PUPwbEM.exe
  C:\Windows\System\PUPwbEM.exe
  2⤵
  PID:5692
- C:\Windows\System\KCweZmE.exe
  C:\Windows\System\KCweZmE.exe
  2⤵
  PID:5752
- C:\Windows\System\NAjfgLO.exe
  C:\Windows\System\NAjfgLO.exe
  2⤵
  PID:5784
- C:\Windows\System\ZuEBkLb.exe
  C:\Windows\System\ZuEBkLb.exe
  2⤵
  PID:5856
- C:\Windows\System\IZbvTJI.exe
  C:\Windows\System\IZbvTJI.exe
  2⤵
  PID:5920
- C:\Windows\System\ykgGvLf.exe
  C:\Windows\System\ykgGvLf.exe
  2⤵
  PID:5984
- C:\Windows\System\JYseyiy.exe
  C:\Windows\System\JYseyiy.exe
  2⤵
  PID:6044
- C:\Windows\System\inqTbnc.exe
  C:\Windows\System\inqTbnc.exe
  2⤵
  PID:6108
- C:\Windows\System\BYJwwRt.exe
  C:\Windows\System\BYJwwRt.exe
  2⤵
  PID:5636
- C:\Windows\System\NNFIKWJ.exe
  C:\Windows\System\NNFIKWJ.exe
  2⤵
  PID:5736
- C:\Windows\System\oMbMGBX.exe
  C:\Windows\System\oMbMGBX.exe
  2⤵
  PID:6140
- C:\Windows\System\lXbpcGe.exe
  C:\Windows\System\lXbpcGe.exe
  2⤵
  PID:5312
- C:\Windows\System\hYaphRB.exe
  C:\Windows\System\hYaphRB.exe
  2⤵
  PID:5132
- C:\Windows\System\LRsAxka.exe
  C:\Windows\System\LRsAxka.exe
  2⤵
  PID:5164
- C:\Windows\System\vdYDRdU.exe
  C:\Windows\System\vdYDRdU.exe
  2⤵
  PID:5372
- C:\Windows\System\TkKtYup.exe
  C:\Windows\System\TkKtYup.exe
  2⤵
  PID:5588
- C:\Windows\System\luzpLDR.exe
  C:\Windows\System\luzpLDR.exe
  2⤵
  PID:5788
- C:\Windows\System\GuqSMbh.exe
  C:\Windows\System\GuqSMbh.exe
  2⤵
  PID:6012
- C:\Windows\System\voxHwRe.exe
  C:\Windows\System\voxHwRe.exe
  2⤵
  PID:5768
- C:\Windows\System\sLVxlRp.exe
  C:\Windows\System\sLVxlRp.exe
  2⤵
  PID:5564
- C:\Windows\System\oERMPcA.exe
  C:\Windows\System\oERMPcA.exe
  2⤵
  PID:5840
- C:\Windows\System\wWHlVPz.exe
  C:\Windows\System\wWHlVPz.exe
  2⤵
  PID:5932
- C:\Windows\System\WFsamFs.exe
  C:\Windows\System\WFsamFs.exe
  2⤵
  PID:5952
- C:\Windows\System\YuvlKEv.exe
  C:\Windows\System\YuvlKEv.exe
  2⤵
  PID:5512
- C:\Windows\System\NiTLymu.exe
  C:\Windows\System\NiTLymu.exe
  2⤵
  PID:5332
- C:\Windows\System\GRizdfD.exe
  C:\Windows\System\GRizdfD.exe
  2⤵
  PID:5532
- C:\Windows\System\DGsjaPq.exe
  C:\Windows\System\DGsjaPq.exe
  2⤵
  PID:4904
- C:\Windows\System\ORqSUyP.exe
  C:\Windows\System\ORqSUyP.exe
  2⤵
  PID:5456
- C:\Windows\System\spymntw.exe
  C:\Windows\System\spymntw.exe
  2⤵
  PID:5384
- C:\Windows\System\QFuCHqn.exe
  C:\Windows\System\QFuCHqn.exe
  2⤵
  PID:5836
- C:\Windows\System\LmfrjMR.exe
  C:\Windows\System\LmfrjMR.exe
  2⤵
  PID:5968
- C:\Windows\System\pGGMRnT.exe
  C:\Windows\System\pGGMRnT.exe
  2⤵
  PID:5420
- C:\Windows\System\OMAcVPd.exe
  C:\Windows\System\OMAcVPd.exe
  2⤵
  PID:5964
- C:\Windows\System\doTfkyn.exe
  C:\Windows\System\doTfkyn.exe
  2⤵
  PID:5668
- C:\Windows\System\FTNavUZ.exe
  C:\Windows\System\FTNavUZ.exe
  2⤵
  PID:5260
- C:\Windows\System\nfesBaE.exe
  C:\Windows\System\nfesBaE.exe
  2⤵
  PID:5148
- C:\Windows\System\AYgzVsj.exe
  C:\Windows\System\AYgzVsj.exe
  2⤵
  PID:6064
- C:\Windows\System\LhethYM.exe
  C:\Windows\System\LhethYM.exe
  2⤵
  PID:5176
- C:\Windows\System\tfaGxxB.exe
  C:\Windows\System\tfaGxxB.exe
  2⤵
  PID:5500
- C:\Windows\System\zZeprFc.exe
  C:\Windows\System\zZeprFc.exe
  2⤵
  PID:5808
- C:\Windows\System\kxJSHPk.exe
  C:\Windows\System\kxJSHPk.exe
  2⤵
  PID:5688
- C:\Windows\System\gmVFyzK.exe
  C:\Windows\System\gmVFyzK.exe
  2⤵
  PID:6080
- C:\Windows\System\GAbFfbq.exe
  C:\Windows\System\GAbFfbq.exe
  2⤵
  PID:5900
- C:\Windows\System\sNyetkT.exe
  C:\Windows\System\sNyetkT.exe
  2⤵
  PID:5872
- C:\Windows\System\sUoVtED.exe
  C:\Windows\System\sUoVtED.exe
  2⤵
  PID:6076
- C:\Windows\System\LbTFgvR.exe
  C:\Windows\System\LbTFgvR.exe
  2⤵
  PID:5616
- C:\Windows\System\MhUHEoF.exe
  C:\Windows\System\MhUHEoF.exe
  2⤵
  PID:5904
- C:\Windows\System\YIrHoSr.exe
  C:\Windows\System\YIrHoSr.exe
  2⤵
  PID:5852
- C:\Windows\System\JFeNqdD.exe
  C:\Windows\System\JFeNqdD.exe
  2⤵
  PID:6160
- C:\Windows\System\sTkajrR.exe
  C:\Windows\System\sTkajrR.exe
  2⤵
  PID:6176
- C:\Windows\System\DLCLLZP.exe
  C:\Windows\System\DLCLLZP.exe
  2⤵
  PID:6192
- C:\Windows\System\UPDWsbA.exe
  C:\Windows\System\UPDWsbA.exe
  2⤵
  PID:6208
- C:\Windows\System\xUWhBtp.exe
  C:\Windows\System\xUWhBtp.exe
  2⤵
  PID:6224
- C:\Windows\System\mnyzoCl.exe
  C:\Windows\System\mnyzoCl.exe
  2⤵
  PID:6240
- C:\Windows\System\cpJKgdu.exe
  C:\Windows\System\cpJKgdu.exe
  2⤵
  PID:6256
- C:\Windows\System\XWEXDnu.exe
  C:\Windows\System\XWEXDnu.exe
  2⤵
  PID:6272
- C:\Windows\System\jERttrw.exe
  C:\Windows\System\jERttrw.exe
  2⤵
  PID:6288
- C:\Windows\System\LcMjbOc.exe
  C:\Windows\System\LcMjbOc.exe
  2⤵
  PID:6304
- C:\Windows\System\HKGRdkk.exe
  C:\Windows\System\HKGRdkk.exe
  2⤵
  PID:6320
- C:\Windows\System\gJeQkSI.exe
  C:\Windows\System\gJeQkSI.exe
  2⤵
  PID:6336
- C:\Windows\System\XYwmIWg.exe
  C:\Windows\System\XYwmIWg.exe
  2⤵
  PID:6352
- C:\Windows\System\wFEciam.exe
  C:\Windows\System\wFEciam.exe
  2⤵
  PID:6368
- C:\Windows\System\pZiVEww.exe
  C:\Windows\System\pZiVEww.exe
  2⤵
  PID:6384
- C:\Windows\System\UtYLLmY.exe
  C:\Windows\System\UtYLLmY.exe
  2⤵
  PID:6400
- C:\Windows\System\ApvjXls.exe
  C:\Windows\System\ApvjXls.exe
  2⤵
  PID:6416
- C:\Windows\System\HHaEINu.exe
  C:\Windows\System\HHaEINu.exe
  2⤵
  PID:6432
- C:\Windows\System\wZdidum.exe
  C:\Windows\System\wZdidum.exe
  2⤵
  PID:6448
- C:\Windows\System\YJGPSVI.exe
  C:\Windows\System\YJGPSVI.exe
  2⤵
  PID:6464
- C:\Windows\System\JllOMOY.exe
  C:\Windows\System\JllOMOY.exe
  2⤵
  PID:6480
- C:\Windows\System\aLUDQGD.exe
  C:\Windows\System\aLUDQGD.exe
  2⤵
  PID:6496
- C:\Windows\System\ArCaJpQ.exe
  C:\Windows\System\ArCaJpQ.exe
  2⤵
  PID:6512
- C:\Windows\System\nNDhJVp.exe
  C:\Windows\System\nNDhJVp.exe
  2⤵
  PID:6528
- C:\Windows\System\TVxtgRX.exe
  C:\Windows\System\TVxtgRX.exe
  2⤵
  PID:6544
- C:\Windows\System\oUWjQNN.exe
  C:\Windows\System\oUWjQNN.exe
  2⤵
  PID:6560
- C:\Windows\System\CupArib.exe
  C:\Windows\System\CupArib.exe
  2⤵
  PID:6576
- C:\Windows\System\JiKgLdu.exe
  C:\Windows\System\JiKgLdu.exe
  2⤵
  PID:6592
- C:\Windows\System\gzveAEi.exe
  C:\Windows\System\gzveAEi.exe
  2⤵
  PID:6608
- C:\Windows\System\tetphxm.exe
  C:\Windows\System\tetphxm.exe
  2⤵
  PID:6624
- C:\Windows\System\riqSdtp.exe
  C:\Windows\System\riqSdtp.exe
  2⤵
  PID:6640
- C:\Windows\System\rStiPaG.exe
  C:\Windows\System\rStiPaG.exe
  2⤵
  PID:6656
- C:\Windows\System\HZvWzZu.exe
  C:\Windows\System\HZvWzZu.exe
  2⤵
  PID:6672
- C:\Windows\System\bhkjodL.exe
  C:\Windows\System\bhkjodL.exe
  2⤵
  PID:6688
- C:\Windows\System\YSkXoFZ.exe
  C:\Windows\System\YSkXoFZ.exe
  2⤵
  PID:6704
- C:\Windows\System\tBUoduP.exe
  C:\Windows\System\tBUoduP.exe
  2⤵
  PID:6720
- C:\Windows\System\MnQsPZx.exe
  C:\Windows\System\MnQsPZx.exe
  2⤵
  PID:6736
- C:\Windows\System\fGMtCRd.exe
  C:\Windows\System\fGMtCRd.exe
  2⤵
  PID:6752
- C:\Windows\System\DJLdwTp.exe
  C:\Windows\System\DJLdwTp.exe
  2⤵
  PID:6768
- C:\Windows\System\TzhYSiq.exe
  C:\Windows\System\TzhYSiq.exe
  2⤵
  PID:6784
- C:\Windows\System\XHwqAkN.exe
  C:\Windows\System\XHwqAkN.exe
  2⤵
  PID:6800
- C:\Windows\System\TuoSReB.exe
  C:\Windows\System\TuoSReB.exe
  2⤵
  PID:6816
- C:\Windows\System\uOHzJkO.exe
  C:\Windows\System\uOHzJkO.exe
  2⤵
  PID:6832
- C:\Windows\System\eLsHHeo.exe
  C:\Windows\System\eLsHHeo.exe
  2⤵
  PID:6848
- C:\Windows\System\mshFuik.exe
  C:\Windows\System\mshFuik.exe
  2⤵
  PID:6864
- C:\Windows\System\ZcVnGHG.exe
  C:\Windows\System\ZcVnGHG.exe
  2⤵
  PID:6880
- C:\Windows\System\oElZtSj.exe
  C:\Windows\System\oElZtSj.exe
  2⤵
  PID:6896
- C:\Windows\System\jBqAtzM.exe
  C:\Windows\System\jBqAtzM.exe
  2⤵
  PID:6912
- C:\Windows\System\ScBbxkL.exe
  C:\Windows\System\ScBbxkL.exe
  2⤵
  PID:6928
- C:\Windows\System\pGzzsup.exe
  C:\Windows\System\pGzzsup.exe
  2⤵
  PID:6944
- C:\Windows\System\OWDwzfG.exe
  C:\Windows\System\OWDwzfG.exe
  2⤵
  PID:6960
- C:\Windows\System\HvPAVMS.exe
  C:\Windows\System\HvPAVMS.exe
  2⤵
  PID:6976
- C:\Windows\System\PnSxdEs.exe
  C:\Windows\System\PnSxdEs.exe
  2⤵
  PID:6992
- C:\Windows\System\KcyvuPS.exe
  C:\Windows\System\KcyvuPS.exe
  2⤵
  PID:7008
- C:\Windows\System\fRQaYsS.exe
  C:\Windows\System\fRQaYsS.exe
  2⤵
  PID:7024
- C:\Windows\System\takHsuO.exe
  C:\Windows\System\takHsuO.exe
  2⤵
  PID:7040
- C:\Windows\System\igRRJxC.exe
  C:\Windows\System\igRRJxC.exe
  2⤵
  PID:7056
- C:\Windows\System\hfPrHWA.exe
  C:\Windows\System\hfPrHWA.exe
  2⤵
  PID:7072
- C:\Windows\System\oHIfpdl.exe
  C:\Windows\System\oHIfpdl.exe
  2⤵
  PID:7088
- C:\Windows\System\bsONbUu.exe
  C:\Windows\System\bsONbUu.exe
  2⤵
  PID:7104
- C:\Windows\System\nYjbBgc.exe
  C:\Windows\System\nYjbBgc.exe
  2⤵
  PID:7120
- C:\Windows\System\KaUnVex.exe
  C:\Windows\System\KaUnVex.exe
  2⤵
  PID:7136
- C:\Windows\System\YwxcVTf.exe
  C:\Windows\System\YwxcVTf.exe
  2⤵
  PID:7152
- C:\Windows\System\oegdTfH.exe
  C:\Windows\System\oegdTfH.exe
  2⤵
  PID:6152
- C:\Windows\System\qIsVfsC.exe
  C:\Windows\System\qIsVfsC.exe
  2⤵
  PID:6216
- C:\Windows\System\ROZNorD.exe
  C:\Windows\System\ROZNorD.exe
  2⤵
  PID:5300
- C:\Windows\System\FMayGNX.exe
  C:\Windows\System\FMayGNX.exe
  2⤵
  PID:5804
- C:\Windows\System\CrRvufX.exe
  C:\Windows\System\CrRvufX.exe
  2⤵
  PID:6200
- C:\Windows\System\KRtYwbE.exe
  C:\Windows\System\KRtYwbE.exe
  2⤵
  PID:6032
- C:\Windows\System\rjRUAVN.exe
  C:\Windows\System\rjRUAVN.exe
  2⤵
  PID:5208
- C:\Windows\System\scixCId.exe
  C:\Windows\System\scixCId.exe
  2⤵
  PID:6280
- C:\Windows\System\bhTtDxy.exe
  C:\Windows\System\bhTtDxy.exe
  2⤵
  PID:6328
- C:\Windows\System\iCJGdoo.exe
  C:\Windows\System\iCJGdoo.exe
  2⤵
  PID:6332
- C:\Windows\System\yfjmGBo.exe
  C:\Windows\System\yfjmGBo.exe
  2⤵
  PID:6364
- C:\Windows\System\uGHGNfM.exe
  C:\Windows\System\uGHGNfM.exe
  2⤵
  PID:6412
- C:\Windows\System\rXWtzLz.exe
  C:\Windows\System\rXWtzLz.exe
  2⤵
  PID:6476
- C:\Windows\System\xHyKUok.exe
  C:\Windows\System\xHyKUok.exe
  2⤵
  PID:6540
- C:\Windows\System\Ganjwqx.exe
  C:\Windows\System\Ganjwqx.exe
  2⤵
  PID:6604
- C:\Windows\System\DsApXWi.exe
  C:\Windows\System\DsApXWi.exe
  2⤵
  PID:6696
- C:\Windows\System\JtiQALl.exe
  C:\Windows\System\JtiQALl.exe
  2⤵
  PID:6728
- C:\Windows\System\TpizijN.exe
  C:\Windows\System\TpizijN.exe
  2⤵
  PID:6732
- C:\Windows\System\Taswpqj.exe
  C:\Windows\System\Taswpqj.exe
  2⤵
  PID:6428
- C:\Windows\System\SCPTZZR.exe
  C:\Windows\System\SCPTZZR.exe
  2⤵
  PID:6520
- C:\Windows\System\gKzUfFG.exe
  C:\Windows\System\gKzUfFG.exe
  2⤵
  PID:6828
- C:\Windows\System\amXcDWC.exe
  C:\Windows\System\amXcDWC.exe
  2⤵
  PID:6556
- C:\Windows\System\IhSkRbb.exe
  C:\Windows\System\IhSkRbb.exe
  2⤵
  PID:6648
- C:\Windows\System\VVmWMwX.exe
  C:\Windows\System\VVmWMwX.exe
  2⤵
  PID:6712
- C:\Windows\System\ahmadhB.exe
  C:\Windows\System\ahmadhB.exe
  2⤵
  PID:6748
- C:\Windows\System\NloSgvm.exe
  C:\Windows\System\NloSgvm.exe
  2⤵
  PID:6776
- C:\Windows\System\DUwLnzM.exe
  C:\Windows\System\DUwLnzM.exe
  2⤵
  PID:6872
- C:\Windows\System\gCxvWGZ.exe
  C:\Windows\System\gCxvWGZ.exe
  2⤵
  PID:6988
- C:\Windows\System\uBnoSxj.exe
  C:\Windows\System\uBnoSxj.exe
  2⤵
  PID:6780
- C:\Windows\System\LzkthCb.exe
  C:\Windows\System\LzkthCb.exe
  2⤵
  PID:6876
- C:\Windows\System\JnUpAri.exe
  C:\Windows\System\JnUpAri.exe
  2⤵
  PID:7032
- C:\Windows\System\AHumFbS.exe
  C:\Windows\System\AHumFbS.exe
  2⤵
  PID:7080
- C:\Windows\System\vxpZfhu.exe
  C:\Windows\System\vxpZfhu.exe
  2⤵
  PID:7144
- C:\Windows\System\KEZTQcf.exe
  C:\Windows\System\KEZTQcf.exe
  2⤵
  PID:7096
- C:\Windows\System\RNbnaqd.exe
  C:\Windows\System\RNbnaqd.exe
  2⤵
  PID:7132
- C:\Windows\System\EeXceMu.exe
  C:\Windows\System\EeXceMu.exe
  2⤵
  PID:6184
- C:\Windows\System\znZcMcX.exe
  C:\Windows\System\znZcMcX.exe
  2⤵
  PID:6168
- C:\Windows\System\HXkZoWF.exe
  C:\Windows\System\HXkZoWF.exe
  2⤵
  PID:6344
- C:\Windows\System\vpkiqhU.exe
  C:\Windows\System\vpkiqhU.exe
  2⤵
  PID:6252
- C:\Windows\System\KAxkyeS.exe
  C:\Windows\System\KAxkyeS.exe
  2⤵
  PID:5916
- C:\Windows\System\ZpRNInf.exe
  C:\Windows\System\ZpRNInf.exe
  2⤵
  PID:6376
- C:\Windows\System\sHzlVPN.exe
  C:\Windows\System\sHzlVPN.exe
  2⤵
  PID:6636
- C:\Windows\System\ksUbORB.exe
  C:\Windows\System\ksUbORB.exe
  2⤵
  PID:6572
- C:\Windows\System\xXiddAt.exe
  C:\Windows\System\xXiddAt.exe
  2⤵
  PID:6860
- C:\Windows\System\IUxjTgp.exe
  C:\Windows\System\IUxjTgp.exe
  2⤵
  PID:6808
- C:\Windows\System\UftqeqL.exe
  C:\Windows\System\UftqeqL.exe
  2⤵
  PID:6444
- C:\Windows\System\ISAwuZV.exe
  C:\Windows\System\ISAwuZV.exe
  2⤵
  PID:6764
- C:\Windows\System\yoaifKF.exe
  C:\Windows\System\yoaifKF.exe
  2⤵
  PID:6716
- C:\Windows\System\kNWPzyF.exe
  C:\Windows\System\kNWPzyF.exe
  2⤵
  PID:6908
- C:\Windows\System\sTuXcSG.exe
  C:\Windows\System\sTuXcSG.exe
  2⤵
  PID:6936
- C:\Windows\System\xhIoWlt.exe
  C:\Windows\System\xhIoWlt.exe
  2⤵
  PID:7000
- C:\Windows\System\adigFdX.exe
  C:\Windows\System\adigFdX.exe
  2⤵
  PID:7164
- C:\Windows\System\AGPvYWg.exe
  C:\Windows\System\AGPvYWg.exe
  2⤵
  PID:6204
- C:\Windows\System\OTxpWko.exe
  C:\Windows\System\OTxpWko.exe
  2⤵
  PID:6124
- C:\Windows\System\HuWIDgV.exe
  C:\Windows\System\HuWIDgV.exe
  2⤵
  PID:7112
- C:\Windows\System\SrGmXBg.exe
  C:\Windows\System\SrGmXBg.exe
  2⤵
  PID:6460
- C:\Windows\System\DUmCuyD.exe
  C:\Windows\System\DUmCuyD.exe
  2⤵
  PID:6472
- C:\Windows\System\dBjwbFu.exe
  C:\Windows\System\dBjwbFu.exe
  2⤵
  PID:6488
- C:\Windows\System\RBuLloM.exe
  C:\Windows\System\RBuLloM.exe
  2⤵
  PID:6700
- C:\Windows\System\JXmPdDD.exe
  C:\Windows\System\JXmPdDD.exe
  2⤵
  PID:6924
- C:\Windows\System\bmcpOFt.exe
  C:\Windows\System\bmcpOFt.exe
  2⤵
  PID:7048
- C:\Windows\System\ZBjwDYb.exe
  C:\Windows\System\ZBjwDYb.exe
  2⤵
  PID:6968
- C:\Windows\System\KhDWGei.exe
  C:\Windows\System\KhDWGei.exe
  2⤵
  PID:7160
- C:\Windows\System\GPlSvLc.exe
  C:\Windows\System\GPlSvLc.exe
  2⤵
  PID:6360
- C:\Windows\System\QubFwwi.exe
  C:\Windows\System\QubFwwi.exe
  2⤵
  PID:7064
- C:\Windows\System\YrkeHjt.exe
  C:\Windows\System\YrkeHjt.exe
  2⤵
  PID:7172
- C:\Windows\System\aWSuzaE.exe
  C:\Windows\System\aWSuzaE.exe
  2⤵
  PID:7188
- C:\Windows\System\PyhbvrZ.exe
  C:\Windows\System\PyhbvrZ.exe
  2⤵
  PID:7204
- C:\Windows\System\YqZNLnK.exe
  C:\Windows\System\YqZNLnK.exe
  2⤵
  PID:7220
- C:\Windows\System\rnNEwzF.exe
  C:\Windows\System\rnNEwzF.exe
  2⤵
  PID:7236
- C:\Windows\System\GtaYPZS.exe
  C:\Windows\System\GtaYPZS.exe
  2⤵
  PID:7252
- C:\Windows\System\uzJsYzZ.exe
  C:\Windows\System\uzJsYzZ.exe
  2⤵
  PID:7268
- C:\Windows\System\vWPhgWB.exe
  C:\Windows\System\vWPhgWB.exe
  2⤵
  PID:7284
- C:\Windows\System\TkPzxuw.exe
  C:\Windows\System\TkPzxuw.exe
  2⤵
  PID:7300
- C:\Windows\System\sMzauEt.exe
  C:\Windows\System\sMzauEt.exe
  2⤵
  PID:7316
- C:\Windows\System\EgEuecq.exe
  C:\Windows\System\EgEuecq.exe
  2⤵
  PID:7332
- C:\Windows\System\MokGCpS.exe
  C:\Windows\System\MokGCpS.exe
  2⤵
  PID:7348
- C:\Windows\System\aLsQJCW.exe
  C:\Windows\System\aLsQJCW.exe
  2⤵
  PID:7364
- C:\Windows\System\uiMOxKJ.exe
  C:\Windows\System\uiMOxKJ.exe
  2⤵
  PID:7380
- C:\Windows\System\uOklfMF.exe
  C:\Windows\System\uOklfMF.exe
  2⤵
  PID:7400
- C:\Windows\System\qiNwWAV.exe
  C:\Windows\System\qiNwWAV.exe
  2⤵
  PID:7416
- C:\Windows\System\kYwnJqD.exe
  C:\Windows\System\kYwnJqD.exe
  2⤵
  PID:7432
- C:\Windows\System\HpLnrrj.exe
  C:\Windows\System\HpLnrrj.exe
  2⤵
  PID:7448
- C:\Windows\System\UUiOWmD.exe
  C:\Windows\System\UUiOWmD.exe
  2⤵
  PID:7464
- C:\Windows\System\XjKqcmp.exe
  C:\Windows\System\XjKqcmp.exe
  2⤵
  PID:7484
- C:\Windows\System\TBCDHBD.exe
  C:\Windows\System\TBCDHBD.exe
  2⤵
  PID:7500
- C:\Windows\System\fnuOOQM.exe
  C:\Windows\System\fnuOOQM.exe
  2⤵
  PID:7516
- C:\Windows\System\TehOWxz.exe
  C:\Windows\System\TehOWxz.exe
  2⤵
  PID:7532
- C:\Windows\System\mCpkqBL.exe
  C:\Windows\System\mCpkqBL.exe
  2⤵
  PID:7556
- C:\Windows\System\qgRLDVt.exe
  C:\Windows\System\qgRLDVt.exe
  2⤵
  PID:7572
- C:\Windows\System\VdjecYt.exe
  C:\Windows\System\VdjecYt.exe
  2⤵
  PID:7588
- C:\Windows\System\ZHBLWFW.exe
  C:\Windows\System\ZHBLWFW.exe
  2⤵
  PID:7604
- C:\Windows\System\KTPkAiU.exe
  C:\Windows\System\KTPkAiU.exe
  2⤵
  PID:7624
- C:\Windows\System\uULqfjF.exe
  C:\Windows\System\uULqfjF.exe
  2⤵
  PID:7640
- C:\Windows\System\CXLCLNL.exe
  C:\Windows\System\CXLCLNL.exe
  2⤵
  PID:7656
- C:\Windows\System\zLxWEmk.exe
  C:\Windows\System\zLxWEmk.exe
  2⤵
  PID:7672
- C:\Windows\System\PVCqIsw.exe
  C:\Windows\System\PVCqIsw.exe
  2⤵
  PID:7688
- C:\Windows\System\zljjIRg.exe
  C:\Windows\System\zljjIRg.exe
  2⤵
  PID:7704
- C:\Windows\System\KtadejB.exe
  C:\Windows\System\KtadejB.exe
  2⤵
  PID:7720
- C:\Windows\System\sDgktyx.exe
  C:\Windows\System\sDgktyx.exe
  2⤵
  PID:7780
- C:\Windows\System\afRDjIK.exe
  C:\Windows\System\afRDjIK.exe
  2⤵
  PID:7800
- C:\Windows\System\tbkJDKU.exe
  C:\Windows\System\tbkJDKU.exe
  2⤵
  PID:7816
- C:\Windows\System\IwaXRiT.exe
  C:\Windows\System\IwaXRiT.exe
  2⤵
  PID:7832
- C:\Windows\System\fqmLIqQ.exe
  C:\Windows\System\fqmLIqQ.exe
  2⤵
  PID:7848
- C:\Windows\System\CMlYwkT.exe
  C:\Windows\System\CMlYwkT.exe
  2⤵
  PID:7864
- C:\Windows\System\BCtgvkx.exe
  C:\Windows\System\BCtgvkx.exe
  2⤵
  PID:7880
- C:\Windows\System\wvIzCIk.exe
  C:\Windows\System\wvIzCIk.exe
  2⤵
  PID:7896
- C:\Windows\System\bBiNTvj.exe
  C:\Windows\System\bBiNTvj.exe
  2⤵
  PID:7912
- C:\Windows\System\otlAGye.exe
  C:\Windows\System\otlAGye.exe
  2⤵
  PID:7928
- C:\Windows\System\xYGAgZI.exe
  C:\Windows\System\xYGAgZI.exe
  2⤵
  PID:7944
- C:\Windows\System\JoswogJ.exe
  C:\Windows\System\JoswogJ.exe
  2⤵
  PID:7960
- C:\Windows\System\jQmgkXx.exe
  C:\Windows\System\jQmgkXx.exe
  2⤵
  PID:7976
- C:\Windows\System\YPDouAU.exe
  C:\Windows\System\YPDouAU.exe
  2⤵
  PID:7996
- C:\Windows\System\DSwPPOO.exe
  C:\Windows\System\DSwPPOO.exe
  2⤵
  PID:8012
- C:\Windows\System\VJZAhMs.exe
  C:\Windows\System\VJZAhMs.exe
  2⤵
  PID:8028
- C:\Windows\System\uvFmRKy.exe
  C:\Windows\System\uvFmRKy.exe
  2⤵
  PID:8044
- C:\Windows\System\vESnXhr.exe
  C:\Windows\System\vESnXhr.exe
  2⤵
  PID:8060
- C:\Windows\System\UkwMWmn.exe
  C:\Windows\System\UkwMWmn.exe
  2⤵
  PID:8076
- C:\Windows\System\JUQKzKN.exe
  C:\Windows\System\JUQKzKN.exe
  2⤵
  PID:8092
- C:\Windows\System\nMOSlaS.exe
  C:\Windows\System\nMOSlaS.exe
  2⤵
  PID:8108
- C:\Windows\System\cvxwmaT.exe
  C:\Windows\System\cvxwmaT.exe
  2⤵
  PID:8124
- C:\Windows\System\XSTzoKJ.exe
  C:\Windows\System\XSTzoKJ.exe
  2⤵
  PID:8140
- C:\Windows\System\Fldpckf.exe
  C:\Windows\System\Fldpckf.exe
  2⤵
  PID:8156
- C:\Windows\System\uJIQKnb.exe
  C:\Windows\System\uJIQKnb.exe
  2⤵
  PID:8172
- C:\Windows\System\JsmdUaM.exe
  C:\Windows\System\JsmdUaM.exe
  2⤵
  PID:8188
- C:\Windows\System\sjwGujx.exe
  C:\Windows\System\sjwGujx.exe
  2⤵
  PID:7228
- C:\Windows\System\cqoBDgT.exe
  C:\Windows\System\cqoBDgT.exe
  2⤵
  PID:7184
- C:\Windows\System\eQbIYIf.exe
  C:\Windows\System\eQbIYIf.exe
  2⤵
  PID:6268
- C:\Windows\System\UrKYvgs.exe
  C:\Windows\System\UrKYvgs.exe
  2⤵
  PID:7052
- C:\Windows\System\ckuDjoR.exe
  C:\Windows\System\ckuDjoR.exe
  2⤵
  PID:7260
- C:\Windows\System\LfLFTYU.exe
  C:\Windows\System\LfLFTYU.exe
  2⤵
  PID:7296
- C:\Windows\System\xVatxxq.exe
  C:\Windows\System\xVatxxq.exe
  2⤵
  PID:7360
- C:\Windows\System\dgxOnxS.exe
  C:\Windows\System\dgxOnxS.exe
  2⤵
  PID:7372
- C:\Windows\System\nHlzaGi.exe
  C:\Windows\System\nHlzaGi.exe
  2⤵
  PID:7388
- C:\Windows\System\SPpVjyk.exe
  C:\Windows\System\SPpVjyk.exe
  2⤵
  PID:7408
- C:\Windows\System\uMDLtcJ.exe
  C:\Windows\System\uMDLtcJ.exe
  2⤵
  PID:7440
- C:\Windows\System\agjHSKG.exe
  C:\Windows\System\agjHSKG.exe
  2⤵
  PID:7492
- C:\Windows\System\qkosAJt.exe
  C:\Windows\System\qkosAJt.exe
  2⤵
  PID:7480
- C:\Windows\System\SBXNIJK.exe
  C:\Windows\System\SBXNIJK.exe
  2⤵
  PID:7528
- C:\Windows\System\mbLbIIz.exe
  C:\Windows\System\mbLbIIz.exe
  2⤵
  PID:7568
- C:\Windows\System\mMdzBoy.exe
  C:\Windows\System\mMdzBoy.exe
  2⤵
  PID:7632
- C:\Windows\System\UpLwjym.exe
  C:\Windows\System\UpLwjym.exe
  2⤵
  PID:7664
- C:\Windows\System\whQQNUy.exe
  C:\Windows\System\whQQNUy.exe
  2⤵
  PID:7616
- C:\Windows\System\rEXhGAc.exe
  C:\Windows\System\rEXhGAc.exe
  2⤵
  PID:7620
- C:\Windows\System\TEQGmHT.exe
  C:\Windows\System\TEQGmHT.exe
  2⤵
  PID:7712
- C:\Windows\System\uKobYeB.exe
  C:\Windows\System\uKobYeB.exe
  2⤵
  PID:7736
- C:\Windows\System\zKfbHPh.exe
  C:\Windows\System\zKfbHPh.exe
  2⤵
  PID:7752
- C:\Windows\System\SkSPQns.exe
  C:\Windows\System\SkSPQns.exe
  2⤵
  PID:7772
- C:\Windows\System\LnIjscY.exe
  C:\Windows\System\LnIjscY.exe
  2⤵
  PID:7812
- C:\Windows\System\LAyAJHH.exe
  C:\Windows\System\LAyAJHH.exe
  2⤵
  PID:7792
- C:\Windows\System\gkeQazy.exe
  C:\Windows\System\gkeQazy.exe
  2⤵
  PID:7824
- C:\Windows\System\HPGucvb.exe
  C:\Windows\System\HPGucvb.exe
  2⤵
  PID:7860
- C:\Windows\System\VQMhJcg.exe
  C:\Windows\System\VQMhJcg.exe
  2⤵
  PID:7936
- C:\Windows\System\EvNYCsB.exe
  C:\Windows\System\EvNYCsB.exe
  2⤵
  PID:7924
- C:\Windows\System\PbjvqBy.exe
  C:\Windows\System\PbjvqBy.exe
  2⤵
  PID:7984
- C:\Windows\System\utJaUXi.exe
  C:\Windows\System\utJaUXi.exe
  2⤵
  PID:8040
- C:\Windows\System\KsdsNlW.exe
  C:\Windows\System\KsdsNlW.exe
  2⤵
  PID:8072
- C:\Windows\System\YjeqjsX.exe
  C:\Windows\System\YjeqjsX.exe
  2⤵
  PID:8132
- C:\Windows\System\hWnridt.exe
  C:\Windows\System\hWnridt.exe
  2⤵
  PID:8164
- C:\Windows\System\MKfFvyf.exe
  C:\Windows\System\MKfFvyf.exe
  2⤵
  PID:8024
- C:\Windows\System\uKzCQZG.exe
  C:\Windows\System\uKzCQZG.exe
  2⤵
  PID:8152
- C:\Windows\System\uOegIGv.exe
  C:\Windows\System\uOegIGv.exe
  2⤵
  PID:8084
- C:\Windows\System\yPyhHWw.exe
  C:\Windows\System\yPyhHWw.exe
  2⤵
  PID:5684
- C:\Windows\System\jJpyKAD.exe
  C:\Windows\System\jJpyKAD.exe
  2⤵
  PID:8180
- C:\Windows\System\MXELxsL.exe
  C:\Windows\System\MXELxsL.exe
  2⤵
  PID:7308
- C:\Windows\System\TlRbUJm.exe
  C:\Windows\System\TlRbUJm.exe
  2⤵
  PID:6684
- C:\Windows\System\ohrjIvH.exe
  C:\Windows\System\ohrjIvH.exe
  2⤵
  PID:7344
- C:\Windows\System\OjtOlkz.exe
  C:\Windows\System\OjtOlkz.exe
  2⤵
  PID:7460
- C:\Windows\System\TMKOdoi.exe
  C:\Windows\System\TMKOdoi.exe
  2⤵
  PID:7564
- C:\Windows\System\lIpXoWb.exe
  C:\Windows\System\lIpXoWb.exe
  2⤵
  PID:7600
- C:\Windows\System\QnIcKFW.exe
  C:\Windows\System\QnIcKFW.exe
  2⤵
  PID:7696
- C:\Windows\System\hAnriVb.exe
  C:\Windows\System\hAnriVb.exe
  2⤵
  PID:7756
- C:\Windows\System\pFrdoih.exe
  C:\Windows\System\pFrdoih.exe
  2⤵
  PID:7840
- C:\Windows\System\OKXNrjc.exe
  C:\Windows\System\OKXNrjc.exe
  2⤵
  PID:7892
- C:\Windows\System\vBACbta.exe
  C:\Windows\System\vBACbta.exe
  2⤵
  PID:7940
- C:\Windows\System\hSIKFaQ.exe
  C:\Windows\System\hSIKFaQ.exe
  2⤵
  PID:8008
- C:\Windows\System\tFpvKVS.exe
  C:\Windows\System\tFpvKVS.exe
  2⤵
  PID:8104
- C:\Windows\System\MUyTCav.exe
  C:\Windows\System\MUyTCav.exe
  2⤵
  PID:7968
- C:\Windows\System\dmLRNRp.exe
  C:\Windows\System\dmLRNRp.exe
  2⤵
  PID:7280
- C:\Windows\System\BhdyXeQ.exe
  C:\Windows\System\BhdyXeQ.exe
  2⤵
  PID:7992
- C:\Windows\System\kePTRiP.exe
  C:\Windows\System\kePTRiP.exe
  2⤵
  PID:7988
- C:\Windows\System\HOAITYk.exe
  C:\Windows\System\HOAITYk.exe
  2⤵
  PID:7216
- C:\Windows\System\EwAkPJd.exe
  C:\Windows\System\EwAkPJd.exe
  2⤵
  PID:7740
- C:\Windows\System\CMJSXVE.exe
  C:\Windows\System\CMJSXVE.exe
  2⤵
  PID:7904
- C:\Windows\System\RIlockN.exe
  C:\Windows\System\RIlockN.exe
  2⤵
  PID:7428
- C:\Windows\System\OaiClwq.exe
  C:\Windows\System\OaiClwq.exe
  2⤵
  PID:7700
- C:\Windows\System\haxRpIl.exe
  C:\Windows\System\haxRpIl.exe
  2⤵
  PID:8148
- C:\Windows\System\fbroBfe.exe
  C:\Windows\System\fbroBfe.exe
  2⤵
  PID:7496
- C:\Windows\System\NANhBOZ.exe
  C:\Windows\System\NANhBOZ.exe
  2⤵
  PID:7232
- C:\Windows\System\dutCzBu.exe
  C:\Windows\System\dutCzBu.exe
  2⤵
  PID:7684
- C:\Windows\System\QSUUvCd.exe
  C:\Windows\System\QSUUvCd.exe
  2⤵
  PID:8100
- C:\Windows\System\jZwWpHi.exe
  C:\Windows\System\jZwWpHi.exe
  2⤵
  PID:7732
- C:\Windows\System\rBCEHPN.exe
  C:\Windows\System\rBCEHPN.exe
  2⤵
  PID:7512
- C:\Windows\System\VAPsCmW.exe
  C:\Windows\System\VAPsCmW.exe
  2⤵
  PID:8120
- C:\Windows\System\POpqmFO.exe
  C:\Windows\System\POpqmFO.exe
  2⤵
  PID:7328
- C:\Windows\System\vubmZOS.exe
  C:\Windows\System\vubmZOS.exe
  2⤵
  PID:8204
- C:\Windows\System\rtOUnIb.exe
  C:\Windows\System\rtOUnIb.exe
  2⤵
  PID:8220
- C:\Windows\System\fvbcxRo.exe
  C:\Windows\System\fvbcxRo.exe
  2⤵
  PID:8236
- C:\Windows\System\dtnSKdy.exe
  C:\Windows\System\dtnSKdy.exe
  2⤵
  PID:8252
- C:\Windows\System\PlHSmOS.exe
  C:\Windows\System\PlHSmOS.exe
  2⤵
  PID:8268
- C:\Windows\System\JuIQOlG.exe
  C:\Windows\System\JuIQOlG.exe
  2⤵
  PID:8284
- C:\Windows\System\mkoqCOe.exe
  C:\Windows\System\mkoqCOe.exe
  2⤵
  PID:8300
- C:\Windows\System\EoAdMWR.exe
  C:\Windows\System\EoAdMWR.exe
  2⤵
  PID:8316
- C:\Windows\System\HquqQsu.exe
  C:\Windows\System\HquqQsu.exe
  2⤵
  PID:8332
- C:\Windows\System\nzcsbIu.exe
  C:\Windows\System\nzcsbIu.exe
  2⤵
  PID:8348
- C:\Windows\System\knyiwiu.exe
  C:\Windows\System\knyiwiu.exe
  2⤵
  PID:8364
- C:\Windows\System\jnXYJPL.exe
  C:\Windows\System\jnXYJPL.exe
  2⤵
  PID:8380
- C:\Windows\System\CYEJMlJ.exe
  C:\Windows\System\CYEJMlJ.exe
  2⤵
  PID:8396
- C:\Windows\System\nfUufKw.exe
  C:\Windows\System\nfUufKw.exe
  2⤵
  PID:8412
- C:\Windows\System\CnTDPTA.exe
  C:\Windows\System\CnTDPTA.exe
  2⤵
  PID:8428
- C:\Windows\System\yznikSq.exe
  C:\Windows\System\yznikSq.exe
  2⤵
  PID:8444
- C:\Windows\System\vdyvwvj.exe
  C:\Windows\System\vdyvwvj.exe
  2⤵
  PID:8460
- C:\Windows\System\ISotcTQ.exe
  C:\Windows\System\ISotcTQ.exe
  2⤵
  PID:8476
- C:\Windows\System\vJWQxtl.exe
  C:\Windows\System\vJWQxtl.exe
  2⤵
  PID:8492
- C:\Windows\System\WAvyCSJ.exe
  C:\Windows\System\WAvyCSJ.exe
  2⤵
  PID:8508
- C:\Windows\System\dqWWeWc.exe
  C:\Windows\System\dqWWeWc.exe
  2⤵
  PID:8524
- C:\Windows\System\wPsgemI.exe
  C:\Windows\System\wPsgemI.exe
  2⤵
  PID:8540
- C:\Windows\System\oYbhJJe.exe
  C:\Windows\System\oYbhJJe.exe
  2⤵
  PID:8556
- C:\Windows\System\QarXOEo.exe
  C:\Windows\System\QarXOEo.exe
  2⤵
  PID:8572
- C:\Windows\System\SgijUYE.exe
  C:\Windows\System\SgijUYE.exe
  2⤵
  PID:8588
- C:\Windows\System\JIWwzIt.exe
  C:\Windows\System\JIWwzIt.exe
  2⤵
  PID:8604
- C:\Windows\System\BPVktbj.exe
  C:\Windows\System\BPVktbj.exe
  2⤵
  PID:8620
- C:\Windows\System\ecbgAuT.exe
  C:\Windows\System\ecbgAuT.exe
  2⤵
  PID:8636
- C:\Windows\System\GwXhdna.exe
  C:\Windows\System\GwXhdna.exe
  2⤵
  PID:8652
- C:\Windows\System\RNxzVql.exe
  C:\Windows\System\RNxzVql.exe
  2⤵
  PID:8672
- C:\Windows\System\eaFFLAK.exe
  C:\Windows\System\eaFFLAK.exe
  2⤵
  PID:8688
- C:\Windows\System\SWqXuxJ.exe
  C:\Windows\System\SWqXuxJ.exe
  2⤵
  PID:8704
- C:\Windows\System\LgCSpQE.exe
  C:\Windows\System\LgCSpQE.exe
  2⤵
  PID:8720
- C:\Windows\System\DCVDfuo.exe
  C:\Windows\System\DCVDfuo.exe
  2⤵
  PID:8736
- C:\Windows\System\xwWTaLa.exe
  C:\Windows\System\xwWTaLa.exe
  2⤵
  PID:8752
- C:\Windows\System\taTsXig.exe
  C:\Windows\System\taTsXig.exe
  2⤵
  PID:8768
- C:\Windows\System\aPvZZuG.exe
  C:\Windows\System\aPvZZuG.exe
  2⤵
  PID:8784
- C:\Windows\System\IeHtsyz.exe
  C:\Windows\System\IeHtsyz.exe
  2⤵
  PID:8800
- C:\Windows\System\OFAXgJg.exe
  C:\Windows\System\OFAXgJg.exe
  2⤵
  PID:8820
- C:\Windows\System\DdiQhNj.exe
  C:\Windows\System\DdiQhNj.exe
  2⤵
  PID:8836
- C:\Windows\System\OVIgjyK.exe
  C:\Windows\System\OVIgjyK.exe
  2⤵
  PID:8852
- C:\Windows\System\YwkSCXX.exe
  C:\Windows\System\YwkSCXX.exe
  2⤵
  PID:8872
- C:\Windows\System\PBFlwMj.exe
  C:\Windows\System\PBFlwMj.exe
  2⤵
  PID:8888
- C:\Windows\System\LwavtuQ.exe
  C:\Windows\System\LwavtuQ.exe
  2⤵
  PID:8904
- C:\Windows\System\UIdchxN.exe
  C:\Windows\System\UIdchxN.exe
  2⤵
  PID:8920
- C:\Windows\System\NJHwhaS.exe
  C:\Windows\System\NJHwhaS.exe
  2⤵
  PID:8940
- C:\Windows\System\fgibgoA.exe
  C:\Windows\System\fgibgoA.exe
  2⤵
  PID:8956
- C:\Windows\System\YFGBcdV.exe
  C:\Windows\System\YFGBcdV.exe
  2⤵
  PID:8972
- C:\Windows\System\AgydKdV.exe
  C:\Windows\System\AgydKdV.exe
  2⤵
  PID:8988
- C:\Windows\System\SGjvPkj.exe
  C:\Windows\System\SGjvPkj.exe
  2⤵
  PID:9008
- C:\Windows\System\sRRjNpM.exe
  C:\Windows\System\sRRjNpM.exe
  2⤵
  PID:9024
- C:\Windows\System\KbvqbxC.exe
  C:\Windows\System\KbvqbxC.exe
  2⤵
  PID:9040
- C:\Windows\System\rXCmJsU.exe
  C:\Windows\System\rXCmJsU.exe
  2⤵
  PID:9056
- C:\Windows\System\ameKrOG.exe
  C:\Windows\System\ameKrOG.exe
  2⤵
  PID:9076
- C:\Windows\System\OBgxlXq.exe
  C:\Windows\System\OBgxlXq.exe
  2⤵
  PID:9092
- C:\Windows\System\sjFrAgN.exe
  C:\Windows\System\sjFrAgN.exe
  2⤵
  PID:9108
- C:\Windows\System\jTLWKOn.exe
  C:\Windows\System\jTLWKOn.exe
  2⤵
  PID:9124
- C:\Windows\System\iIkFWmy.exe
  C:\Windows\System\iIkFWmy.exe
  2⤵
  PID:9140
- C:\Windows\System\TGHpBmt.exe
  C:\Windows\System\TGHpBmt.exe
  2⤵
  PID:9156
- C:\Windows\System\paHvPKj.exe
  C:\Windows\System\paHvPKj.exe
  2⤵
  PID:9172
- C:\Windows\System\SsncRut.exe
  C:\Windows\System\SsncRut.exe
  2⤵
  PID:9188
- C:\Windows\System\uUSrJpD.exe
  C:\Windows\System\uUSrJpD.exe
  2⤵
  PID:9208
- C:\Windows\System\EwPxWVL.exe
  C:\Windows\System\EwPxWVL.exe
  2⤵
  PID:7524
- C:\Windows\System\HpUZFif.exe
  C:\Windows\System\HpUZFif.exe
  2⤵
  PID:7680
- C:\Windows\System\kPttCqQ.exe
  C:\Windows\System\kPttCqQ.exe
  2⤵
  PID:8244
- C:\Windows\System\vZzGTsk.exe
  C:\Windows\System\vZzGTsk.exe
  2⤵
  PID:8292
- C:\Windows\System\TVsoizS.exe
  C:\Windows\System\TVsoizS.exe
  2⤵
  PID:8296
- C:\Windows\System\QlULVAt.exe
  C:\Windows\System\QlULVAt.exe
  2⤵
  PID:8360
- C:\Windows\System\KJrKfdL.exe
  C:\Windows\System\KJrKfdL.exe
  2⤵
  PID:8372
- C:\Windows\System\XOaiorl.exe
  C:\Windows\System\XOaiorl.exe
  2⤵
  PID:8424
- C:\Windows\System\gLyvJrh.exe
  C:\Windows\System\gLyvJrh.exe
  2⤵
  PID:8408
- C:\Windows\System\BkqQVKH.exe
  C:\Windows\System\BkqQVKH.exe
  2⤵
  PID:8520
- C:\Windows\System\lzKguHx.exe
  C:\Windows\System\lzKguHx.exe
  2⤵
  PID:8536
- C:\Windows\System\wGmhZSw.exe
  C:\Windows\System\wGmhZSw.exe
  2⤵
  PID:8580
- C:\Windows\System\JLyKhtU.exe
  C:\Windows\System\JLyKhtU.exe
  2⤵
  PID:8816
- C:\Windows\System\TJxvFTB.exe
  C:\Windows\System\TJxvFTB.exe
  2⤵
  PID:8732
- C:\Windows\System\WTBBGfh.exe
  C:\Windows\System\WTBBGfh.exe
  2⤵
  PID:8880
- C:\Windows\System\iUtkLEj.exe
  C:\Windows\System\iUtkLEj.exe
  2⤵
  PID:8792
- C:\Windows\System\jbkfJan.exe
  C:\Windows\System\jbkfJan.exe
  2⤵
  PID:8896
- C:\Windows\System\JqcvTYR.exe
  C:\Windows\System\JqcvTYR.exe
  2⤵
  PID:8928
- C:\Windows\System\gfvoKmB.exe
  C:\Windows\System\gfvoKmB.exe
  2⤵
  PID:8980
- C:\Windows\System\bgoTEAc.exe
  C:\Windows\System\bgoTEAc.exe
  2⤵
  PID:8968
- C:\Windows\System\rjjyuNS.exe
  C:\Windows\System\rjjyuNS.exe
  2⤵
  PID:9004
- C:\Windows\System\bfsUqbY.exe
  C:\Windows\System\bfsUqbY.exe
  2⤵
  PID:9052
- C:\Windows\System\UlxLATa.exe
  C:\Windows\System\UlxLATa.exe
  2⤵
  PID:9068
- C:\Windows\System\urNJIza.exe
  C:\Windows\System\urNJIza.exe
  2⤵
  PID:8312
- C:\Windows\System\dosOHDP.exe
  C:\Windows\System\dosOHDP.exe
  2⤵
  PID:8420
- C:\Windows\System\ResEYvO.exe
  C:\Windows\System\ResEYvO.exe
  2⤵
  PID:8488
- C:\Windows\System\WcIChpt.exe
  C:\Windows\System\WcIChpt.exe
  2⤵
  PID:8564
- C:\Windows\System\BPOUItA.exe
  C:\Windows\System\BPOUItA.exe
  2⤵
  PID:8596
- C:\Windows\System\KbqDkeV.exe
  C:\Windows\System\KbqDkeV.exe
  2⤵
  PID:8668
- C:\Windows\System\MtppaJC.exe
  C:\Windows\System\MtppaJC.exe
  2⤵
  PID:8632
- C:\Windows\System\GROazZu.exe
  C:\Windows\System\GROazZu.exe
  2⤵
  PID:8696
- C:\Windows\System\QJEnbub.exe
  C:\Windows\System\QJEnbub.exe
  2⤵
  PID:8780
- C:\Windows\System\MNGDmIZ.exe
  C:\Windows\System\MNGDmIZ.exe
  2⤵
  PID:8864
- C:\Windows\System\uaTArPp.exe
  C:\Windows\System\uaTArPp.exe
  2⤵
  PID:9064
- C:\Windows\System\RMkklMw.exe
  C:\Windows\System\RMkklMw.exe
  2⤵
  PID:8984
- C:\Windows\System\bEFHhUl.exe
  C:\Windows\System\bEFHhUl.exe
  2⤵
  PID:7424
- C:\Windows\System\HkgStUk.exe
  C:\Windows\System\HkgStUk.exe
  2⤵
  PID:9152
- C:\Windows\System\jyhtWaF.exe
  C:\Windows\System\jyhtWaF.exe
  2⤵
  PID:8196
- C:\Windows\System\HKboeqm.exe
  C:\Windows\System\HKboeqm.exe
  2⤵
  PID:9168
- C:\Windows\System\YItPxQj.exe
  C:\Windows\System\YItPxQj.exe
  2⤵
  PID:8276
- C:\Windows\System\lJiqcJT.exe
  C:\Windows\System\lJiqcJT.exe
  2⤵
  PID:8264
- C:\Windows\System\WfMKhJa.exe
  C:\Windows\System\WfMKhJa.exe
  2⤵
  PID:8232
- C:\Windows\System\HOCGiSL.exe
  C:\Windows\System\HOCGiSL.exe
  2⤵
  PID:8376
- C:\Windows\System\oaDMEtf.exe
  C:\Windows\System\oaDMEtf.exe
  2⤵
  PID:8548
- C:\Windows\System\PVfWLBI.exe
  C:\Windows\System\PVfWLBI.exe
  2⤵
  PID:8532
- C:\Windows\System\kLvkbga.exe
  C:\Windows\System\kLvkbga.exe
  2⤵
  PID:8568
- C:\Windows\System\lBUqxhm.exe
  C:\Windows\System\lBUqxhm.exe
  2⤵
  PID:8712
- C:\Windows\System\MSFPlFV.exe
  C:\Windows\System\MSFPlFV.exe
  2⤵
  PID:8760
- C:\Windows\System\jkdfqru.exe
  C:\Windows\System\jkdfqru.exe
  2⤵
  PID:8828
- C:\Windows\System\KAxbohQ.exe
  C:\Windows\System\KAxbohQ.exe
  2⤵
  PID:9048
- C:\Windows\System\PcHhSkk.exe
  C:\Windows\System\PcHhSkk.exe
  2⤵
  PID:9020
- C:\Windows\System\iCyDoLo.exe
  C:\Windows\System\iCyDoLo.exe
  2⤵
  PID:9072
- C:\Windows\System\qyiMBhC.exe
  C:\Windows\System\qyiMBhC.exe
  2⤵
  PID:9100
- C:\Windows\System\xuFAzPL.exe
  C:\Windows\System\xuFAzPL.exe
  2⤵
  PID:9200
- C:\Windows\System\RRGPmNQ.exe
  C:\Windows\System\RRGPmNQ.exe
  2⤵
  PID:8340
- C:\Windows\System\SMjCMmh.exe
  C:\Windows\System\SMjCMmh.exe
  2⤵
  PID:8600
- C:\Windows\System\MbMxJAU.exe
  C:\Windows\System\MbMxJAU.exe
  2⤵
  PID:8776
- C:\Windows\System\HeSstOU.exe
  C:\Windows\System\HeSstOU.exe
  2⤵
  PID:8616
- C:\Windows\System\LIjOkYc.exe
  C:\Windows\System\LIjOkYc.exe
  2⤵
  PID:8744
- C:\Windows\System\pzxBjDD.exe
  C:\Windows\System\pzxBjDD.exe
  2⤵
  PID:9032
- C:\Windows\System\gjOixGX.exe
  C:\Windows\System\gjOixGX.exe
  2⤵
  PID:9196
- C:\Windows\System\wRVDfvL.exe
  C:\Windows\System\wRVDfvL.exe
  2⤵
  PID:9148
- C:\Windows\System\HTOCZHu.exe
  C:\Windows\System\HTOCZHu.exe
  2⤵
  PID:9220
- C:\Windows\System\sMnzQPZ.exe
  C:\Windows\System\sMnzQPZ.exe
  2⤵
  PID:9240
- C:\Windows\System\BjhKMxh.exe
  C:\Windows\System\BjhKMxh.exe
  2⤵
  PID:9260
- C:\Windows\System\XmjqHNi.exe
  C:\Windows\System\XmjqHNi.exe
  2⤵
  PID:9280
- C:\Windows\System\AukmlSQ.exe
  C:\Windows\System\AukmlSQ.exe
  2⤵
  PID:9296
- C:\Windows\System\ExWkPlO.exe
  C:\Windows\System\ExWkPlO.exe
  2⤵
  PID:9328
- C:\Windows\System\WXPlkoS.exe
  C:\Windows\System\WXPlkoS.exe
  2⤵
  PID:9344
- C:\Windows\System\uMMEvRw.exe
  C:\Windows\System\uMMEvRw.exe
  2⤵
  PID:9368
- C:\Windows\System\OoEhnZB.exe
  C:\Windows\System\OoEhnZB.exe
  2⤵
  PID:9384
- C:\Windows\System\GPwbXda.exe
  C:\Windows\System\GPwbXda.exe
  2⤵
  PID:9404
- C:\Windows\System\AMXNXCX.exe
  C:\Windows\System\AMXNXCX.exe
  2⤵
  PID:9420
- C:\Windows\System\SxotcJL.exe
  C:\Windows\System\SxotcJL.exe
  2⤵
  PID:9436
- C:\Windows\System\dpaPCBF.exe
  C:\Windows\System\dpaPCBF.exe
  2⤵
  PID:9452
- C:\Windows\System\HPXWHQl.exe
  C:\Windows\System\HPXWHQl.exe
  2⤵
  PID:9468
- C:\Windows\System\BfnIRLw.exe
  C:\Windows\System\BfnIRLw.exe
  2⤵
  PID:9484
- C:\Windows\System\axNWBIH.exe
  C:\Windows\System\axNWBIH.exe
  2⤵
  PID:9500
- C:\Windows\System\AGvVsWP.exe
  C:\Windows\System\AGvVsWP.exe
  2⤵
  PID:9516
- C:\Windows\System\aNCUHte.exe
  C:\Windows\System\aNCUHte.exe
  2⤵
  PID:9532
- C:\Windows\System\irkfSJL.exe
  C:\Windows\System\irkfSJL.exe
  2⤵
  PID:9548
- C:\Windows\System\sCmFslP.exe
  C:\Windows\System\sCmFslP.exe
  2⤵
  PID:9564
- C:\Windows\System\ZRZAmkd.exe
  C:\Windows\System\ZRZAmkd.exe
  2⤵
  PID:9580
- C:\Windows\System\ARptDdx.exe
  C:\Windows\System\ARptDdx.exe
  2⤵
  PID:9596
- C:\Windows\System\WaVelxe.exe
  C:\Windows\System\WaVelxe.exe
  2⤵
  PID:9612
- C:\Windows\System\EpnahxY.exe
  C:\Windows\System\EpnahxY.exe
  2⤵
  PID:9628
- C:\Windows\System\Jvezhwc.exe
  C:\Windows\System\Jvezhwc.exe
  2⤵
  PID:9644
- C:\Windows\System\oRzJQjb.exe
  C:\Windows\System\oRzJQjb.exe
  2⤵
  PID:9660
- C:\Windows\System\woAoZGB.exe
  C:\Windows\System\woAoZGB.exe
  2⤵
  PID:9676
- C:\Windows\System\ivZrDtG.exe
  C:\Windows\System\ivZrDtG.exe
  2⤵
  PID:9692
- C:\Windows\System\CFfHopo.exe
  C:\Windows\System\CFfHopo.exe
  2⤵
  PID:9708
- C:\Windows\System\natgEXk.exe
  C:\Windows\System\natgEXk.exe
  2⤵
  PID:9724
- C:\Windows\System\zlHFpbm.exe
  C:\Windows\System\zlHFpbm.exe
  2⤵
  PID:9740
- C:\Windows\System\LBuXzAS.exe
  C:\Windows\System\LBuXzAS.exe
  2⤵
  PID:9756
- C:\Windows\System\PSLWBoT.exe
  C:\Windows\System\PSLWBoT.exe
  2⤵
  PID:9772
- C:\Windows\System\CNHZIho.exe
  C:\Windows\System\CNHZIho.exe
  2⤵
  PID:9788
- C:\Windows\System\HsyMVRK.exe
  C:\Windows\System\HsyMVRK.exe
  2⤵
  PID:9808
- C:\Windows\System\xMNGRUk.exe
  C:\Windows\System\xMNGRUk.exe
  2⤵
  PID:9824
- C:\Windows\System\cJbgTTe.exe
  C:\Windows\System\cJbgTTe.exe
  2⤵
  PID:9840
- C:\Windows\System\ZRXraYs.exe
  C:\Windows\System\ZRXraYs.exe
  2⤵
  PID:9856
- C:\Windows\System\sybyvFS.exe
  C:\Windows\System\sybyvFS.exe
  2⤵
  PID:9872
- C:\Windows\System\DQaGMAL.exe
  C:\Windows\System\DQaGMAL.exe
  2⤵
  PID:9888
- C:\Windows\System\TRWsquO.exe
  C:\Windows\System\TRWsquO.exe
  2⤵
  PID:9904
- C:\Windows\System\oIcPvhR.exe
  C:\Windows\System\oIcPvhR.exe
  2⤵
  PID:9920
- C:\Windows\System\hAmCoOC.exe
  C:\Windows\System\hAmCoOC.exe
  2⤵
  PID:9936
- C:\Windows\System\ZzOuSzw.exe
  C:\Windows\System\ZzOuSzw.exe
  2⤵
  PID:9952
- C:\Windows\System\wFJXSiT.exe
  C:\Windows\System\wFJXSiT.exe
  2⤵
  PID:9968
- C:\Windows\System\mTxJaMb.exe
  C:\Windows\System\mTxJaMb.exe
  2⤵
  PID:9984
- C:\Windows\System\OOqNHcM.exe
  C:\Windows\System\OOqNHcM.exe
  2⤵
  PID:10000
- C:\Windows\System\UpOtEct.exe
  C:\Windows\System\UpOtEct.exe
  2⤵
  PID:10016
- C:\Windows\System\kyqNdPY.exe
  C:\Windows\System\kyqNdPY.exe
  2⤵
  PID:10032
- C:\Windows\System\zYtwuca.exe
  C:\Windows\System\zYtwuca.exe
  2⤵
  PID:10048
- C:\Windows\System\pfWXDTg.exe
  C:\Windows\System\pfWXDTg.exe
  2⤵
  PID:10064
- C:\Windows\System\dBtTBkR.exe
  C:\Windows\System\dBtTBkR.exe
  2⤵
  PID:10080
- C:\Windows\System\hCBUdlx.exe
  C:\Windows\System\hCBUdlx.exe
  2⤵
  PID:10096
- C:\Windows\System\ElfjtXJ.exe
  C:\Windows\System\ElfjtXJ.exe
  2⤵
  PID:10112
- C:\Windows\System\zTovzgr.exe
  C:\Windows\System\zTovzgr.exe
  2⤵
  PID:10128
- C:\Windows\System\BEaaCZR.exe
  C:\Windows\System\BEaaCZR.exe
  2⤵
  PID:10144
- C:\Windows\System\deRDLrM.exe
  C:\Windows\System\deRDLrM.exe
  2⤵
  PID:10160
- C:\Windows\System\mQZpTSz.exe
  C:\Windows\System\mQZpTSz.exe
  2⤵
  PID:10176
- C:\Windows\System\skLUNlS.exe
  C:\Windows\System\skLUNlS.exe
  2⤵
  PID:10192
- C:\Windows\System\OWoGvzZ.exe
  C:\Windows\System\OWoGvzZ.exe
  2⤵
  PID:10208
- C:\Windows\System\XRcVjaG.exe
  C:\Windows\System\XRcVjaG.exe
  2⤵
  PID:10224
- C:\Windows\System\qpZCPhy.exe
  C:\Windows\System\qpZCPhy.exe
  2⤵
  PID:9132
- C:\Windows\System\xmhJTGE.exe
  C:\Windows\System\xmhJTGE.exe
  2⤵
  PID:9288
- C:\Windows\System\tGFWGkP.exe
  C:\Windows\System\tGFWGkP.exe
  2⤵
  PID:9376
- C:\Windows\System\pRGoUFq.exe
  C:\Windows\System\pRGoUFq.exe
  2⤵
  PID:9268
- C:\Windows\System\mtsytnh.exe
  C:\Windows\System\mtsytnh.exe
  2⤵
  PID:8552
- C:\Windows\System\bMTQXvj.exe
  C:\Windows\System\bMTQXvj.exe
  2⤵
  PID:9228
- C:\Windows\System\eoruWvc.exe
  C:\Windows\System\eoruWvc.exe
  2⤵
  PID:9304
- C:\Windows\System\UuruWoQ.exe
  C:\Windows\System\UuruWoQ.exe
  2⤵
  PID:9324
- C:\Windows\System\XzkSWMB.exe
  C:\Windows\System\XzkSWMB.exe
  2⤵
  PID:8324
- C:\Windows\System\NLyMNgE.exe
  C:\Windows\System\NLyMNgE.exe
  2⤵
  PID:9416
- C:\Windows\System\tLiRNLN.exe
  C:\Windows\System\tLiRNLN.exe
  2⤵
  PID:9448
- C:\Windows\System\gmJlWCs.exe
  C:\Windows\System\gmJlWCs.exe
  2⤵
  PID:9396
- C:\Windows\System\XKrWQdy.exe
  C:\Windows\System\XKrWQdy.exe
  2⤵
  PID:9572
- C:\Windows\System\VRbeUVT.exe
  C:\Windows\System\VRbeUVT.exe
  2⤵
  PID:9576
- C:\Windows\System\CDfswjy.exe
  C:\Windows\System\CDfswjy.exe
  2⤵
  PID:9556
- C:\Windows\System\yZHhnyR.exe
  C:\Windows\System\yZHhnyR.exe
  2⤵
  PID:9432
- C:\Windows\System\sgikQsc.exe
  C:\Windows\System\sgikQsc.exe
  2⤵
  PID:9608
- C:\Windows\System\klZxGYI.exe
  C:\Windows\System\klZxGYI.exe
  2⤵
  PID:9672
- C:\Windows\System\ylDKsuK.exe
  C:\Windows\System\ylDKsuK.exe
  2⤵
  PID:9700
- C:\Windows\System\swtheKZ.exe
  C:\Windows\System\swtheKZ.exe
  2⤵
  PID:9684
- C:\Windows\System\BETnCRH.exe
  C:\Windows\System\BETnCRH.exe
  2⤵
  PID:9748
- C:\Windows\System\PmjrIOE.exe
  C:\Windows\System\PmjrIOE.exe
  2⤵
  PID:9780
- C:\Windows\System\WvcGbZs.exe
  C:\Windows\System\WvcGbZs.exe
  2⤵
  PID:9832
- C:\Windows\System\VKnKzFo.exe
  C:\Windows\System\VKnKzFo.exe
  2⤵
  PID:9896
- C:\Windows\System\mRaDmMb.exe
  C:\Windows\System\mRaDmMb.exe
  2⤵
  PID:9848
- C:\Windows\System\tqvkijU.exe
  C:\Windows\System\tqvkijU.exe
  2⤵
  PID:9884
- C:\Windows\System\QOVMIgQ.exe
  C:\Windows\System\QOVMIgQ.exe
  2⤵
  PID:9996
- C:\Windows\System\kjOIpnr.exe
  C:\Windows\System\kjOIpnr.exe
  2⤵
  PID:9948
- C:\Windows\System\qPVqNDa.exe
  C:\Windows\System\qPVqNDa.exe
  2⤵
  PID:10088
- C:\Windows\System\YXGSauQ.exe
  C:\Windows\System\YXGSauQ.exe
  2⤵
  PID:10072
- C:\Windows\System\GSzVQZV.exe
  C:\Windows\System\GSzVQZV.exe
  2⤵
  PID:10104
- C:\Windows\System\VwaSJbK.exe
  C:\Windows\System\VwaSJbK.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EAhNOLW.exe

Filesize
1.0MB

MD5
539445da1979f1a783b2c4465c8494b7

SHA1
78953dbd1354e50b43789a2ede9c4c15a0720ca1

SHA256
ee5ca78a88cea4ec3452911d6292265ec03e0359919fd821b918c4d9561b8cc3

SHA512
b0bff10b9dde124db3be3e365f6f97dbc8b9b48ac9ca6cd2e7d64eada0b4f8d1a193d1a16defe384a2b1c261d5e4b2f69d34bab1b9ea40e69370026eea5931b4

Download Submit
C:\Windows\system\FgUBnxX.exe

Filesize
1.0MB

MD5
c5c1a1e8476588381743a5b86c13a16a

SHA1
810ef1a9b44d37e2b2edd6d40f05e3e48316f5a9

SHA256
878443dd7cfa86a6afc14ff10cf1622589a4c4430288cfa1baa1131ab86b923d

SHA512
e24a08683f66eabaf6d5d83d7f2b1446e971c592a9b7981692749732e04d2cad1f74d417a7205617befc4c1e926ea534b11cdc9715ec762fda66da41d6738e63

Download Submit
C:\Windows\system\GyFJMfq.exe

Filesize
1.0MB

MD5
6bd30c8c0a2ebccdfaa7441269cc8a0e

SHA1
33e503297ffea44efd296ab323af7627a3b448a7

SHA256
39e2df66da357d22a110fc41052ae0ea9d48960131ac93b14619688873451607

SHA512
4fba4f84bebf957660413383a3236382ac66e5f04aed1ee7767062418b98ab0d812bdafa75845f8eb89865ceac5899cdc58a0ae83f350ae02a48cf2a2839d005

Download Submit
C:\Windows\system\LHNgPmm.exe

Filesize
1.0MB

MD5
295fe9971d4ce29cfc7ddaef3b00e170

SHA1
fa88a32023b2bef9f774a36a780e220894f6aa70

SHA256
79642c79432ae156b502691b420f63a2b9fb991eb4f448de19344f3574ddbebf

SHA512
4b784a804815e0c2c6c8b96fd527e38c22fd3fa1de64c4ec57f52fa9c0d258c77a7e29be264c7097e0f846cbc4fc787624db29dfb719738d11aa00a4d726e11e

Download Submit
C:\Windows\system\LdaCBZD.exe

Filesize
1.0MB

MD5
654fc56e03a587d75e0e92486c6b46c2

SHA1
6c8bac41f720d2a9292d7bcac74d03c4ac522b92

SHA256
19851c5cfe5f616d001907aaa873896e9d8f69c3d3e977799b56b45fe4ced761

SHA512
90d10eade33036d8244628120dd24f2170b0957205c6457b4b65904dee23ee0990550622e584b88b28f93b03bc47ccf8f1eae2bf95b5d21c1fdabeb4014ae286

Download Submit
C:\Windows\system\MwXEZtX.exe

Filesize
1.0MB

MD5
94402efaafba4153b022d14ac5bb6837

SHA1
5862d586f7239d03b9c88ff794ab45d27b4f59f9

SHA256
6f7d438119eb475d3b819db0d1ef4c88fb3e2aea2e2ed0dc0e6ad507a9a3386d

SHA512
7d93e43dd74b08808c26940d881b1c91890a343665e8b1a972c574b03d3b18f5c53a2284fae4e9f9de053c56700460d4d0a04ce32134ecf53e0e83ea5134b84c

Download Submit
C:\Windows\system\QiqrwSQ.exe

Filesize
1.0MB

MD5
153f229015cc8df90b052e0f9c0b9fa7

SHA1
5caef9d823fa6189839fc4cd1e94844462320ccd

SHA256
d7d189a47141a1c250246aaac2f3bde1aec033fa95c9769587ce30c05e561894

SHA512
5a7e21b1e3a3055270ded054899f4d0bdddd946c7557b05f90f89a0468805dd29d31f8086ad9c5d988a63dd8cbed3308b7e0edb3cdbe18ddf3aa0df7be635e6d

Download Submit
C:\Windows\system\THSexVa.exe

Filesize
1.0MB

MD5
be699f5a9286fe1713898c136d903669

SHA1
890fc7b64d7f0675a28a41d8072a9b7113bcf991

SHA256
84c79878056dabee45f4285ec260e1fcb473e9f8b3e8ece22b94f7b374ac4f6c

SHA512
4951895feaa024313afe3b6f49095830e899b3add91727c082d75b1782d69812813d5514343bee1affa262807568005c15221d8451532f4b037bd731d242cf69

Download Submit
C:\Windows\system\TfXDAyh.exe

Filesize
1.0MB

MD5
c3a5989b6f5bf39e35def7dd9a8362ed

SHA1
c498fbe5b139f83d158e9e1f6c3c8d56fc4f38e5

SHA256
be4f81d9ad13b641647ee8dfb830cc60f5304928a6df4de0c42550c92c85660f

SHA512
cf07e10a5a9f3a67ac4c819a3c42f467e43942cddd96c34d9b419c52486bf44f06a025ff414f869ec00883766b63ac196ac4e101ae746ef4eb400fa8cfef8b65

Download Submit
C:\Windows\system\USBfhtq.exe

Filesize
1.0MB

MD5
9bd5319f075aabed5c96058f639df59d

SHA1
cbdfd1b1f3e73de62ddddb332112dc2a0f9b0629

SHA256
b479f8b2bf330872f161915bfba5a5b90a3d41800d9f9e80f53268cf81146489

SHA512
744d5b06d22b971e70c3166459a00ecac3a9fdb2691a0544bb0bb33f7f2445026022062195f658ea7f66f8fa5bfc9dfc27a8789dcb11cc16f90cd9d9b7eceb71

Download Submit
C:\Windows\system\XFhCxgR.exe

Filesize
1.0MB

MD5
6287ef7e6ee8dd9c4172249ac104be85

SHA1
3fc7b2a1c04f54de33f2d98dc98de8ede5fe249a

SHA256
24cb9e9d63deadddd8fcf072f2b0a9b0be16e58442bd8c2d7edba135be2efcf5

SHA512
56936eb29f0c336a2fcf770c11441d17c510f0950c89d9d8d35fb978240f71d8d39e2659a602f80b798ceb5dc3e9f847253e79745d48de8920a2a7903b8e0dbb

Download Submit
C:\Windows\system\XODSduU.exe

Filesize
1.0MB

MD5
ae2171b3a93741b9755a972ed8ad6af4

SHA1
57d16515ea90ea08ca8c75b185b74cc431e78f60

SHA256
fd98ef0777e162c2ecc8f9e5b04bec5713e096e5f7c268dd389491f031a649ec

SHA512
e1b0d872d8a64a349a9f4043014320bd66bde6c85f597f2a5a050278474512e22941d12f41bf7a1e414f806cdb33f9b88f1d344d6bac178b519e9eb747cc31bd

Download Submit
C:\Windows\system\ZPLRFCo.exe

Filesize
1.0MB

MD5
e91c775f63ef3c572a56ed30aacb9ddc

SHA1
498baa6a533e67c1efc4c52fc12e58707291668b

SHA256
f67e62575e389730721725faaee17f73cc09c547f339a7d9097b071c88ddf7fa

SHA512
d43739884366e5875a4b1a02d699592882333250fe246d68979476f8b5e08b78fc1ce234ab2a93db7db85c75a03fb3c58a9faff8e10b5965cf07202f599d3300

Download Submit
C:\Windows\system\ayatYIJ.exe

Filesize
1.0MB

MD5
d6bcf4349edb86faebd53f627fe49081

SHA1
267976013f4b85ee17d99d401fdef29a448d238f

SHA256
dbb0a4fb0b94da56be090a474a6023022d3547201f675ca58f1dbd3c96e18cdb

SHA512
002434a10df2f47952cbc9dfa3b14f86b4e41c703676e3bfc7366f2d4e3aa60d4e3874351de0ba65416a0b5bff8ee278bf00da8fa6d7baaea73b0a48481f9e0c

Download Submit
C:\Windows\system\eWRdWAA.exe

Filesize
1.0MB

MD5
594567163220cce3e1968a37a70dc644

SHA1
a35d2e215bd33ef146a5cfce03130e836ac07967

SHA256
95febd4421c77bff4df8759137ef245216c562c5332bcea956c91b82df32f8eb

SHA512
9990b3e5db885937b7a358da38595fafd762860c30ec57b320d08e3dd801473b4e9ac058593b910eec7cc9efb99e3e78f2335d470862813d525e4ca37f0a9576

Download Submit
C:\Windows\system\hMzElgL.exe

Filesize
1.0MB

MD5
9b8bc9a2183250964006494dffbf6fd9

SHA1
52f2a2581874603da2f75ab9bdeaeebe1ca34caa

SHA256
1ef130994bca228a02d8c4bf187ea1cb6847f3dbc76fc577805d5b5617d19851

SHA512
edb8987c6df8d3fa131efdd0880de822ebf2b724ff4979dfeb10634a536f1da2c4858c1e64d4050be876803183a5398b70059fa8265461ec31b0afbdc1fd0354

Download Submit
C:\Windows\system\jbllXWU.exe

Filesize
1.0MB

MD5
ce7e01c2d118b8a45a38b59fa87e579f

SHA1
6fdf9f909055494ecb43eb3227b91a8f7a901d91

SHA256
32b648ffea5f384f4e5dfb30360335f06dac05a7f80aab5ce5869f21298de662

SHA512
0c59fd585a05f3111a0c0612227c831f33fe79c199228d78848b5f3ceef706361bd02602eaf819dd6cae5445691b860f82dbf92520e97fac868693938d4cbeb5

Download Submit
C:\Windows\system\lNYEbLA.exe

Filesize
1.0MB

MD5
04d7ca8dddc162d2ba8b3ead19e42047

SHA1
63a015d5b0ce26531809d0b8423eb71a924e82eb

SHA256
ea6a9692884febb8fdfaef3a7c77d44501b8b91834e1f7a008c7a4e59affcbdc

SHA512
308bde7cbeff114fe8c1444b617acd317078fb76df0978fd54cb10ef6c767dd71bdf73fb152c8a8607164089c49ff9c35d4437bedb26dfc1224cb0c81fc485a8

Download Submit
C:\Windows\system\lofnbVD.exe

Filesize
1.0MB

MD5
1db618d317b1828fce3880fe2c15bb48

SHA1
44cfb3056d2844e7e64b9501071471c5c6d87e46

SHA256
12807c8efc18296f28e413cd4783beee8d0d49ecdc736b7ff3eb1c7240d4d0d2

SHA512
4da9d00e5891cd22b3a4be4535df235ebc61091c4c4ec50d69cdd3b7c60a162418cf5164cf7ccb26dd64ee1303b7d0501e5b43a68655b7ce5b933c702d617182

Download Submit
C:\Windows\system\nuRaMbW.exe

Filesize
1.0MB

MD5
1149d1e9948ca23b7f776593ef3ea202

SHA1
9db8842730582e2f6d3a49b38c5aae02e8da7628

SHA256
fa70ac6d86b74073c9502524639e8adeb2fbe3720ab4c4ae18aae54e8701fc05

SHA512
f23940ba6c4d5c6b132b00418db2af2f5658d29cc074e99164b3c4a18b214c8f5128c5447feb46c7eee8bd992de0a4bb3c48f941b84927165ff7e257db7fb66a

Download Submit
C:\Windows\system\odAXlHK.exe

Filesize
1.0MB

MD5
62ded8578bab3910ff9634484d3a4ffa

SHA1
003fd26e324bcd0fd1cac1ba47b25fa3949d87fb

SHA256
b49aeb9eea25f5f3444c1951466a0f5fd158551c4f3b198f681a69a4e18c5fe5

SHA512
1441801cf7c61c59ff2b249a539e1411b10b4d269154a6414e46495ec6ed30c7066fcee097eb9a1e75d432a2e02f091f70759f8f44887472f90bd0648aecfcdb

Download Submit
C:\Windows\system\pOWybBQ.exe

Filesize
1.0MB

MD5
f732e06b9a1a6d27208184000e1bd5b2

SHA1
c0ab747fc1aa7367d27becfd1cbe0d40e5936e92

SHA256
013ed49b7ce776db880ba88e198d9b2ca7b078f88da465a5247d9cd9bc32dc4c

SHA512
bf488bdbd2ae1b8d03f2ff4d5ad4b1d50e91b1d76a0106ca606bd2ca6e2a43dd2e9c956bfa776a06c8ef3d4a408178c827eb194c3b30f9131091459bcf9bb680

Download Submit
C:\Windows\system\tEZDYhc.exe

Filesize
1.0MB

MD5
c599523723e07176922a594dfda5c746

SHA1
29e84a8a6d658d2fbce17ab85fd8f2137bccb9a1

SHA256
f7a7eee68ec26a3b6574b3b56ba22105339e8234ea353e5f82f3c30ec2cf71b4

SHA512
980f358d027fd5abbb58bed6008319d4ea69df4beda7b6868b8a972bbf8c78c0468712893cc729d93136f9f993ef21a332902ea63e724b29aa410991567567ae

Download Submit
C:\Windows\system\uuyjimX.exe

Filesize
1.0MB

MD5
98fdde3a8ea2f12acfa8fd38cf8b9108

SHA1
eae1644b18e4ba39c34f4be7292cbbe4e52d14f6

SHA256
1bdd0642e3c50df3d2c1d0d40e4033abd69bf77519674fda55ef0ec1981c1b27

SHA512
e0ebcff7205fabc3885c5744ee2efd9df63b3a85c735b3aa7881e09788f913665c902efd0ee36398cdc5f2a3cfa941f0d4ff2e475cc0b7097bcbe35b11a1af38

Download Submit
C:\Windows\system\uvGOCrM.exe

Filesize
1.0MB

MD5
113c1be40ac93dd26c4b02a90b610d98

SHA1
bd6656f0f0f124aa2e4e1e772b5301992fc292af

SHA256
8f2095253e6439619c5619d0f44150c4c6b29b6354269c986848cc4bcf3ab6f7

SHA512
5cbbb2a169fc4b251784c616974b3eb40e0ccc6f76bef962f4f98f0f8467f6b36b29ee905076add0725752d9d983bdb2f40f3fe98e9b656b9769a76093d876bc

Download Submit
C:\Windows\system\vnjBdoe.exe

Filesize
1.0MB

MD5
775dece96fc8d3a66be83c6cf416f885

SHA1
f659a26bfa79ada2e8bef3373393729fb94d0a46

SHA256
b847ddcfbc3506e89013bd882654464aa06d847cb6f015fd4e56b7bc7a8a0b78

SHA512
e96677a04f17921445078627b07c13e89ab5fb42b53072e66d56d79c6015411f54abd87bce9b39e1f9170dd44e3f4a4c5d7bd81d846ce680ebb16b094c3099dd

Download Submit
C:\Windows\system\xuyqVHP.exe

Filesize
1.0MB

MD5
da3b726b7b23a763c2b77f5259e0596f

SHA1
2d773accd384578532a3af66e50fdb412d2c6edd

SHA256
ea7bf5af4e9188d7746dc685f9aad4fa7d72c238dec45bc2f2346acf7cce6d41

SHA512
2ae10e25a93b8cf1a5769285d48550c8f7e6785b5b07c6b7d36bef548fa80654eaa5171ea6eeb402a74d8a8ee6ede44791d7b07954d61f32811c4e70632d890c

Download Submit
C:\Windows\system\yLmZBnh.exe

Filesize
1.0MB

MD5
b2abc3eac0dd63fef61cae01a534e3ed

SHA1
269b8d6459a78f54f0f47637541764c6a84174dc

SHA256
16303d5b4ce776ab4534c001c95088719303d0c3152155a27c89eb3397791448

SHA512
19788b7d081c8d8cbcfa69f68db547bfe3cb79de0011320e4f071d474366af78e8ccaefe7cf02424f9af3dffc14451446058980a41603a2b313d0eb4e028e380

Download Submit
\Windows\system\HfJoXEd.exe

Filesize
1.0MB

MD5
3cf3bd99b530893a1943f60c327d5081

SHA1
eb4f85b9509787912accdfea5611dfca01bdafda

SHA256
45dea0958e2e217a4a2f9de44e7d8a66c41b45974c56eac11467870a1876b689

SHA512
a804b48c3136ef86e89978e90cbca0a40caaf5668350a7d91671c37c89e4050dbec07368d163d9526ff5a6983f3563a9efed2ec4e5070a1a0baf137aaab7db7d

Download Submit
\Windows\system\SpTvLAe.exe

Filesize
1.0MB

MD5
ebe1c46f033cd205b1533ca57087957b

SHA1
b1e88c0bf51bcc9a098b136a2375c9242e831e14

SHA256
40f85b3b67812b97c9ac2163b198bb548bda17d8a546eb5c98f0bc960a7e38db

SHA512
d5861f07bad4e60f44f29d91a83df5b865ea9b05e050c211f269e913d8e0592e71143ce635cc3176f4ca32747b1daa7d8607abebd694dcf5926949aa7934cb32

Download Submit
\Windows\system\dMAxXyz.exe

Filesize
1.0MB

MD5
52531bc313c71d9437fc135279963524

SHA1
c23c07257860a5c337d005eca9f78b9ea885de16

SHA256
08666515e9e8fde98497addf75b32522ec1bb900c6ae6ad19b258512652bd40f

SHA512
a2297caa1a0f8c476cdba5bd1c8cbe65eda9730bb2a494489a4310ccb7349730d3ef08608d4acc6fcc93f7f28bec3d6763ef6bbe22bbb1b99504509a9ae1911b

Download Submit
\Windows\system\jDnsWBE.exe

Filesize
1.0MB

MD5
beefa192363f36bcca46d36aabe4319b

SHA1
15b486639a7b2bedec20bd4b439637e308dd605f

SHA256
724b9622a5496908de7105649beeebe040ac792edefe148ed8e4a0ef98602e19

SHA512
6231e2c1c60aaf60cf53fab44cfe4369634a6824364426c41fbde50e90e84e70f1ca4db0213ae20d60a41335807af31a7fb3264c6dca4c2f34895862bf6886b6

Download Submit
memory/2172-0-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download