xmrig | 0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
Size

1.2MB
MD5

3ff3df86b1362e67a353b5a60333c350
SHA1

27c7794a4c19daf9fee908b21a12d165d0ddca69
SHA256

0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139
SHA512

94cf613eafc6f718e1196a8b4ed504e2d5d28646119a8252bd912c356743ff4d1ea2be228ceca91656ba978fa21fccce2b621005d557ae5520d2a5eeb78ffb14
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrgdFGAy:GezaTF8FcNkNdfE0pZ9ozttwIRQUu

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000500000001a41c-135.dat	xmrig
behavioral1/files/0x000500000001a41a-130.dat	xmrig
behavioral1/files/0x000500000001a355-126.dat	xmrig
behavioral1/files/0x000500000001a303-122.dat	xmrig
behavioral1/files/0x000500000001a09a-118.dat	xmrig
behavioral1/files/0x000500000001a07a-114.dat	xmrig
behavioral1/files/0x000500000001a071-110.dat	xmrig
behavioral1/files/0x0005000000019fb8-106.dat	xmrig
behavioral1/files/0x0005000000019db5-98.dat	xmrig
behavioral1/files/0x0005000000019f9a-102.dat	xmrig
behavioral1/files/0x0005000000019da9-94.dat	xmrig
behavioral1/files/0x0005000000019d40-90.dat	xmrig
behavioral1/files/0x0005000000019d18-86.dat	xmrig
behavioral1/files/0x0005000000019c50-82.dat	xmrig
behavioral1/files/0x0005000000019c36-78.dat	xmrig
behavioral1/files/0x0005000000019c34-75.dat	xmrig
behavioral1/files/0x0005000000019c32-70.dat	xmrig
behavioral1/files/0x0005000000019999-66.dat	xmrig
behavioral1/files/0x00050000000196ed-62.dat	xmrig
behavioral1/files/0x000500000001969b-58.dat	xmrig
behavioral1/files/0x0005000000019659-54.dat	xmrig
behavioral1/files/0x0005000000019615-50.dat	xmrig
behavioral1/files/0x0005000000019605-46.dat	xmrig
behavioral1/files/0x0030000000017021-42.dat	xmrig
behavioral1/files/0x0005000000019603-38.dat	xmrig
behavioral1/files/0x000700000001925b-33.dat	xmrig
behavioral1/files/0x0008000000018703-27.dat	xmrig
behavioral1/files/0x00060000000186c9-25.dat	xmrig
behavioral1/files/0x00060000000186c5-18.dat	xmrig
behavioral1/files/0x00060000000186bf-13.dat	xmrig
behavioral1/files/0x0033000000018650-6.dat	xmrig
behavioral1/files/0x000d000000012257-4.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	OJCHOER.exe
2852	ihEhOYY.exe
2884	EakRWDf.exe
2828	DdvaOUB.exe
2968	szGkhpq.exe
2696	snkMYky.exe
2764	gpPGQnQ.exe
2468	IUGBDxK.exe
2564	RlwQKaM.exe
796	aNnZBfS.exe
872	bxNHCui.exe
1652	vdCoYlo.exe
3036	GInQbOu.exe
376	uTGnOmo.exe
2368	grTigEp.exe
2424	GuPswSh.exe
2388	DfXisFB.exe
2920	PuGTFPX.exe
3064	rcpSYjd.exe
2908	EsWLceo.exe
2088	xzzMJaH.exe
2016	uzObVGA.exe
2896	gAuddMY.exe
2928	KvrnizX.exe
2332	PHcGImX.exe
1268	EBINdmZ.exe
2180	AvHbQgw.exe
2268	QSLgzSZ.exe
1816	awpJeKi.exe
2320	vggZicS.exe
2260	XnFEoct.exe
2664	xFKVHCD.exe
1472	AdrSZXW.exe
2328	rgJmOKk.exe
2316	waqiEyQ.exe
1732	ctSJMfc.exe
920	DMALPVM.exe
1144	UaJrPoX.exe
1540	KrjcfJh.exe
1972	pliKbHK.exe
1080	FvRkqeZ.exe
1656	IBRWsoV.exe
956	sbGoOww.exe
2292	dfyHCym.exe
2284	RpdvtAy.exe
952	QXNSIDT.exe
1796	MBMXlBx.exe
1744	dCCinsI.exe
1696	IDrFHze.exe
1932	boMlUjW.exe
2208	DfJFSwl.exe
568	RAcPecd.exe
1048	gxAINkB.exe
564	JZqDrBG.exe
2612	HiOgxll.exe
1692	ujEZlKG.exe
2512	qbcyoMm.exe
2520	qunHQXQ.exe
2648	URGQAXG.exe
1056	xhiqlMI.exe
1924	VvTtfCl.exe
1804	ysPVFEQ.exe
1872	HzxMlUn.exe
1388	QDcBjdO.exe

Loads dropped DLL 64 IoCs

pid	Process
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IjnSwgI.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\UgmrWnd.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\FENkJAT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\cUpkedP.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\PLEucpv.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\aIFiaIH.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\MuIToie.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\tvKdSlJ.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\wnIXvcA.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\cNaldXz.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ExiMTxw.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\UvqOTLq.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\dxOyuyl.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\UaIzUyU.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\bHffYvr.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\CQuQgbG.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\rYoYYMo.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\xfIazun.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\lxLqMnU.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\NOgfErx.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\dADHHhI.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\xLXlOBz.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\bmSmnRh.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\fyVoDer.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\sRlXXEp.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\XqJLQJM.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\cMEqTdM.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\rMjCGZY.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\FMubmDp.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\RWXxtBx.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\yAfTQmT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\kSPCjXF.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\VRQYUNp.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\caZWlLn.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\vBzgsCm.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\XzBgiFq.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\KXBTEoE.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\GCOcLXv.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\NaGgCfa.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\hvjCfyy.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\yFwhOhE.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\QDcBjdO.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\wXbFnPC.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\voGzVOb.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\hYmnQgp.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\JoyRNSH.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\rXTxWKw.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\EvcLdXF.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\kWSixIP.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\wsDnmXe.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\xpTmYNl.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ClKOMLv.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\LqMalqe.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\EcRKUcf.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\UNKZtVz.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\IouLPFa.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\LCXHXPB.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\lhJIunN.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\vRsZvgT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\kAgOECT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\BtvWBst.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\CqIkGjC.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\rBQBmLr.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ObOhFGC.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2236	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	31
PID 2844 wrote to memory of 2236	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	31
PID 2844 wrote to memory of 2236	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	31
PID 2844 wrote to memory of 2852	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	32
PID 2844 wrote to memory of 2852	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	32
PID 2844 wrote to memory of 2852	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	32
PID 2844 wrote to memory of 2884	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	33
PID 2844 wrote to memory of 2884	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	33
PID 2844 wrote to memory of 2884	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	33
PID 2844 wrote to memory of 2828	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	34
PID 2844 wrote to memory of 2828	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	34
PID 2844 wrote to memory of 2828	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	34
PID 2844 wrote to memory of 2968	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	35
PID 2844 wrote to memory of 2968	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	35
PID 2844 wrote to memory of 2968	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	35
PID 2844 wrote to memory of 2696	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	36
PID 2844 wrote to memory of 2696	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	36
PID 2844 wrote to memory of 2696	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	36
PID 2844 wrote to memory of 2764	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	37
PID 2844 wrote to memory of 2764	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	37
PID 2844 wrote to memory of 2764	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	37
PID 2844 wrote to memory of 2468	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	38
PID 2844 wrote to memory of 2468	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	38
PID 2844 wrote to memory of 2468	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	38
PID 2844 wrote to memory of 2564	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	39
PID 2844 wrote to memory of 2564	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	39
PID 2844 wrote to memory of 2564	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	39
PID 2844 wrote to memory of 796	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	40
PID 2844 wrote to memory of 796	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	40
PID 2844 wrote to memory of 796	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	40
PID 2844 wrote to memory of 872	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	41
PID 2844 wrote to memory of 872	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	41
PID 2844 wrote to memory of 872	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	41
PID 2844 wrote to memory of 1652	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	42
PID 2844 wrote to memory of 1652	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	42
PID 2844 wrote to memory of 1652	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	42
PID 2844 wrote to memory of 3036	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	43
PID 2844 wrote to memory of 3036	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	43
PID 2844 wrote to memory of 3036	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	43
PID 2844 wrote to memory of 376	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	44
PID 2844 wrote to memory of 376	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	44
PID 2844 wrote to memory of 376	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	44
PID 2844 wrote to memory of 2368	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	45
PID 2844 wrote to memory of 2368	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	45
PID 2844 wrote to memory of 2368	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	45
PID 2844 wrote to memory of 2424	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	46
PID 2844 wrote to memory of 2424	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	46
PID 2844 wrote to memory of 2424	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	46
PID 2844 wrote to memory of 2388	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	47
PID 2844 wrote to memory of 2388	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	47
PID 2844 wrote to memory of 2388	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	47
PID 2844 wrote to memory of 2920	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	48
PID 2844 wrote to memory of 2920	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	48
PID 2844 wrote to memory of 2920	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	48
PID 2844 wrote to memory of 3064	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	49
PID 2844 wrote to memory of 3064	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	49
PID 2844 wrote to memory of 3064	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	49
PID 2844 wrote to memory of 2908	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	50
PID 2844 wrote to memory of 2908	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	50
PID 2844 wrote to memory of 2908	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	50
PID 2844 wrote to memory of 2088	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	51
PID 2844 wrote to memory of 2088	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	51
PID 2844 wrote to memory of 2088	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	51
PID 2844 wrote to memory of 2016	2844	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	52

C:\Users\Admin\AppData\Local\Temp\0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
"C:\Users\Admin\AppData\Local\Temp\0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System\OJCHOER.exe
  C:\Windows\System\OJCHOER.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ihEhOYY.exe
  C:\Windows\System\ihEhOYY.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\EakRWDf.exe
  C:\Windows\System\EakRWDf.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\DdvaOUB.exe
  C:\Windows\System\DdvaOUB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\szGkhpq.exe
  C:\Windows\System\szGkhpq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\snkMYky.exe
  C:\Windows\System\snkMYky.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\gpPGQnQ.exe
  C:\Windows\System\gpPGQnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\IUGBDxK.exe
  C:\Windows\System\IUGBDxK.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\RlwQKaM.exe
  C:\Windows\System\RlwQKaM.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\aNnZBfS.exe
  C:\Windows\System\aNnZBfS.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\bxNHCui.exe
  C:\Windows\System\bxNHCui.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\vdCoYlo.exe
  C:\Windows\System\vdCoYlo.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\GInQbOu.exe
  C:\Windows\System\GInQbOu.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\uTGnOmo.exe
  C:\Windows\System\uTGnOmo.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\grTigEp.exe
  C:\Windows\System\grTigEp.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\GuPswSh.exe
  C:\Windows\System\GuPswSh.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DfXisFB.exe
  C:\Windows\System\DfXisFB.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\PuGTFPX.exe
  C:\Windows\System\PuGTFPX.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\rcpSYjd.exe
  C:\Windows\System\rcpSYjd.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EsWLceo.exe
  C:\Windows\System\EsWLceo.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\xzzMJaH.exe
  C:\Windows\System\xzzMJaH.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\uzObVGA.exe
  C:\Windows\System\uzObVGA.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\gAuddMY.exe
  C:\Windows\System\gAuddMY.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KvrnizX.exe
  C:\Windows\System\KvrnizX.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\PHcGImX.exe
  C:\Windows\System\PHcGImX.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\EBINdmZ.exe
  C:\Windows\System\EBINdmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\AvHbQgw.exe
  C:\Windows\System\AvHbQgw.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\QSLgzSZ.exe
  C:\Windows\System\QSLgzSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\awpJeKi.exe
  C:\Windows\System\awpJeKi.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\vggZicS.exe
  C:\Windows\System\vggZicS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\XnFEoct.exe
  C:\Windows\System\XnFEoct.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\xFKVHCD.exe
  C:\Windows\System\xFKVHCD.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\AdrSZXW.exe
  C:\Windows\System\AdrSZXW.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\rgJmOKk.exe
  C:\Windows\System\rgJmOKk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\waqiEyQ.exe
  C:\Windows\System\waqiEyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ctSJMfc.exe
  C:\Windows\System\ctSJMfc.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DMALPVM.exe
  C:\Windows\System\DMALPVM.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\UaJrPoX.exe
  C:\Windows\System\UaJrPoX.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\KrjcfJh.exe
  C:\Windows\System\KrjcfJh.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\pliKbHK.exe
  C:\Windows\System\pliKbHK.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\FvRkqeZ.exe
  C:\Windows\System\FvRkqeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\IBRWsoV.exe
  C:\Windows\System\IBRWsoV.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\sbGoOww.exe
  C:\Windows\System\sbGoOww.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\dfyHCym.exe
  C:\Windows\System\dfyHCym.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\RpdvtAy.exe
  C:\Windows\System\RpdvtAy.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\QXNSIDT.exe
  C:\Windows\System\QXNSIDT.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\MBMXlBx.exe
  C:\Windows\System\MBMXlBx.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\dCCinsI.exe
  C:\Windows\System\dCCinsI.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\IDrFHze.exe
  C:\Windows\System\IDrFHze.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\boMlUjW.exe
  C:\Windows\System\boMlUjW.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\DfJFSwl.exe
  C:\Windows\System\DfJFSwl.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\RAcPecd.exe
  C:\Windows\System\RAcPecd.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\gxAINkB.exe
  C:\Windows\System\gxAINkB.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\JZqDrBG.exe
  C:\Windows\System\JZqDrBG.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\HiOgxll.exe
  C:\Windows\System\HiOgxll.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ujEZlKG.exe
  C:\Windows\System\ujEZlKG.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\qbcyoMm.exe
  C:\Windows\System\qbcyoMm.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\qunHQXQ.exe
  C:\Windows\System\qunHQXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\URGQAXG.exe
  C:\Windows\System\URGQAXG.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\xhiqlMI.exe
  C:\Windows\System\xhiqlMI.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\VvTtfCl.exe
  C:\Windows\System\VvTtfCl.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ysPVFEQ.exe
  C:\Windows\System\ysPVFEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HzxMlUn.exe
  C:\Windows\System\HzxMlUn.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\QDcBjdO.exe
  C:\Windows\System\QDcBjdO.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\FBqXnlB.exe
  C:\Windows\System\FBqXnlB.exe
  2⤵
  PID:1508
- C:\Windows\System\rlRuWhP.exe
  C:\Windows\System\rlRuWhP.exe
  2⤵
  PID:2940
- C:\Windows\System\TPwXJdj.exe
  C:\Windows\System\TPwXJdj.exe
  2⤵
  PID:2660
- C:\Windows\System\wcCNdUi.exe
  C:\Windows\System\wcCNdUi.exe
  2⤵
  PID:2324
- C:\Windows\System\kRIiRRg.exe
  C:\Windows\System\kRIiRRg.exe
  2⤵
  PID:1556
- C:\Windows\System\ScNotLH.exe
  C:\Windows\System\ScNotLH.exe
  2⤵
  PID:2436
- C:\Windows\System\tjrCMdl.exe
  C:\Windows\System\tjrCMdl.exe
  2⤵
  PID:2700
- C:\Windows\System\jmPdUGH.exe
  C:\Windows\System\jmPdUGH.exe
  2⤵
  PID:2716
- C:\Windows\System\EWhTuGe.exe
  C:\Windows\System\EWhTuGe.exe
  2⤵
  PID:2416
- C:\Windows\System\fYvBcft.exe
  C:\Windows\System\fYvBcft.exe
  2⤵
  PID:2864
- C:\Windows\System\WRdsFmE.exe
  C:\Windows\System\WRdsFmE.exe
  2⤵
  PID:2740
- C:\Windows\System\hXemKXV.exe
  C:\Windows\System\hXemKXV.exe
  2⤵
  PID:2760
- C:\Windows\System\RjVZSrV.exe
  C:\Windows\System\RjVZSrV.exe
  2⤵
  PID:2708
- C:\Windows\System\uUfZqLO.exe
  C:\Windows\System\uUfZqLO.exe
  2⤵
  PID:2552
- C:\Windows\System\GnRvcXa.exe
  C:\Windows\System\GnRvcXa.exe
  2⤵
  PID:2500
- C:\Windows\System\zBWeHbb.exe
  C:\Windows\System\zBWeHbb.exe
  2⤵
  PID:532
- C:\Windows\System\iBqpeJw.exe
  C:\Windows\System\iBqpeJw.exe
  2⤵
  PID:1488
- C:\Windows\System\FtOBxhi.exe
  C:\Windows\System\FtOBxhi.exe
  2⤵
  PID:3028
- C:\Windows\System\kWSixIP.exe
  C:\Windows\System\kWSixIP.exe
  2⤵
  PID:2012
- C:\Windows\System\vBiDlqr.exe
  C:\Windows\System\vBiDlqr.exe
  2⤵
  PID:2404
- C:\Windows\System\QeYilbU.exe
  C:\Windows\System\QeYilbU.exe
  2⤵
  PID:2348
- C:\Windows\System\ItSKLQd.exe
  C:\Windows\System\ItSKLQd.exe
  2⤵
  PID:2304
- C:\Windows\System\tvKdSlJ.exe
  C:\Windows\System\tvKdSlJ.exe
  2⤵
  PID:2308
- C:\Windows\System\VRQYUNp.exe
  C:\Windows\System\VRQYUNp.exe
  2⤵
  PID:2888
- C:\Windows\System\SFlJOWi.exe
  C:\Windows\System\SFlJOWi.exe
  2⤵
  PID:1768
- C:\Windows\System\yQAIKzu.exe
  C:\Windows\System\yQAIKzu.exe
  2⤵
  PID:2272
- C:\Windows\System\ACwLpGM.exe
  C:\Windows\System\ACwLpGM.exe
  2⤵
  PID:2144
- C:\Windows\System\LdgmLsD.exe
  C:\Windows\System\LdgmLsD.exe
  2⤵
  PID:2100
- C:\Windows\System\tNyPngl.exe
  C:\Windows\System\tNyPngl.exe
  2⤵
  PID:2480
- C:\Windows\System\byIeThJ.exe
  C:\Windows\System\byIeThJ.exe
  2⤵
  PID:1776
- C:\Windows\System\NHLnVmH.exe
  C:\Windows\System\NHLnVmH.exe
  2⤵
  PID:440
- C:\Windows\System\WqgPuQY.exe
  C:\Windows\System\WqgPuQY.exe
  2⤵
  PID:1620
- C:\Windows\System\mZLKlAv.exe
  C:\Windows\System\mZLKlAv.exe
  2⤵
  PID:984
- C:\Windows\System\nQPyloB.exe
  C:\Windows\System\nQPyloB.exe
  2⤵
  PID:1332
- C:\Windows\System\tqrTxZW.exe
  C:\Windows\System\tqrTxZW.exe
  2⤵
  PID:1948
- C:\Windows\System\EmVnVXu.exe
  C:\Windows\System\EmVnVXu.exe
  2⤵
  PID:1712
- C:\Windows\System\HfFPJwG.exe
  C:\Windows\System\HfFPJwG.exe
  2⤵
  PID:1664
- C:\Windows\System\fCDebPN.exe
  C:\Windows\System\fCDebPN.exe
  2⤵
  PID:1028
- C:\Windows\System\LdxBfZV.exe
  C:\Windows\System\LdxBfZV.exe
  2⤵
  PID:2444
- C:\Windows\System\jQwSrsC.exe
  C:\Windows\System\jQwSrsC.exe
  2⤵
  PID:1536
- C:\Windows\System\HFoVLYf.exe
  C:\Windows\System\HFoVLYf.exe
  2⤵
  PID:2516
- C:\Windows\System\FScNpap.exe
  C:\Windows\System\FScNpap.exe
  2⤵
  PID:1700
- C:\Windows\System\kIpXXHW.exe
  C:\Windows\System\kIpXXHW.exe
  2⤵
  PID:2036
- C:\Windows\System\fFISFiy.exe
  C:\Windows\System\fFISFiy.exe
  2⤵
  PID:1788
- C:\Windows\System\vgTkIKT.exe
  C:\Windows\System\vgTkIKT.exe
  2⤵
  PID:2576
- C:\Windows\System\jkEVQOp.exe
  C:\Windows\System\jkEVQOp.exe
  2⤵
  PID:2064
- C:\Windows\System\IjnSwgI.exe
  C:\Windows\System\IjnSwgI.exe
  2⤵
  PID:1192
- C:\Windows\System\HnJSEIu.exe
  C:\Windows\System\HnJSEIu.exe
  2⤵
  PID:2984
- C:\Windows\System\eTuvPWj.exe
  C:\Windows\System\eTuvPWj.exe
  2⤵
  PID:2880
- C:\Windows\System\gCanIuT.exe
  C:\Windows\System\gCanIuT.exe
  2⤵
  PID:2720
- C:\Windows\System\XgUpDKm.exe
  C:\Windows\System\XgUpDKm.exe
  2⤵
  PID:2860
- C:\Windows\System\nHseixp.exe
  C:\Windows\System\nHseixp.exe
  2⤵
  PID:2712
- C:\Windows\System\cGQJmHr.exe
  C:\Windows\System\cGQJmHr.exe
  2⤵
  PID:2548
- C:\Windows\System\siHEAug.exe
  C:\Windows\System\siHEAug.exe
  2⤵
  PID:1476
- C:\Windows\System\ESdwbcF.exe
  C:\Windows\System\ESdwbcF.exe
  2⤵
  PID:2376
- C:\Windows\System\IouLPFa.exe
  C:\Windows\System\IouLPFa.exe
  2⤵
  PID:3056
- C:\Windows\System\ZBvSydY.exe
  C:\Windows\System\ZBvSydY.exe
  2⤵
  PID:3060
- C:\Windows\System\YDfcnzR.exe
  C:\Windows\System\YDfcnzR.exe
  2⤵
  PID:2256
- C:\Windows\System\luaGTve.exe
  C:\Windows\System\luaGTve.exe
  2⤵
  PID:2312
- C:\Windows\System\wRxxaYN.exe
  C:\Windows\System\wRxxaYN.exe
  2⤵
  PID:1496
- C:\Windows\System\ToBPkpX.exe
  C:\Windows\System\ToBPkpX.exe
  2⤵
  PID:1976
- C:\Windows\System\GCOcLXv.exe
  C:\Windows\System\GCOcLXv.exe
  2⤵
  PID:2656
- C:\Windows\System\qqjXxut.exe
  C:\Windows\System\qqjXxut.exe
  2⤵
  PID:1756
- C:\Windows\System\eiZNcBY.exe
  C:\Windows\System\eiZNcBY.exe
  2⤵
  PID:1532
- C:\Windows\System\JvWieBH.exe
  C:\Windows\System\JvWieBH.exe
  2⤵
  PID:1032
- C:\Windows\System\yQgvBDW.exe
  C:\Windows\System\yQgvBDW.exe
  2⤵
  PID:2628
- C:\Windows\System\XDCwSoM.exe
  C:\Windows\System\XDCwSoM.exe
  2⤵
  PID:1248
- C:\Windows\System\GnNntri.exe
  C:\Windows\System\GnNntri.exe
  2⤵
  PID:1864
- C:\Windows\System\ZBhQduu.exe
  C:\Windows\System\ZBhQduu.exe
  2⤵
  PID:1316
- C:\Windows\System\oLTCNZa.exe
  C:\Windows\System\oLTCNZa.exe
  2⤵
  PID:2808
- C:\Windows\System\uKsMtGk.exe
  C:\Windows\System\uKsMtGk.exe
  2⤵
  PID:764
- C:\Windows\System\sMaWNxW.exe
  C:\Windows\System\sMaWNxW.exe
  2⤵
  PID:2164
- C:\Windows\System\yImJQJT.exe
  C:\Windows\System\yImJQJT.exe
  2⤵
  PID:2384
- C:\Windows\System\gXdrSbl.exe
  C:\Windows\System\gXdrSbl.exe
  2⤵
  PID:2024
- C:\Windows\System\DzbBrjH.exe
  C:\Windows\System\DzbBrjH.exe
  2⤵
  PID:2400
- C:\Windows\System\TmnaTdh.exe
  C:\Windows\System\TmnaTdh.exe
  2⤵
  PID:2004
- C:\Windows\System\JWNmSht.exe
  C:\Windows\System\JWNmSht.exe
  2⤵
  PID:2336
- C:\Windows\System\hBEhPbf.exe
  C:\Windows\System\hBEhPbf.exe
  2⤵
  PID:2280
- C:\Windows\System\PQkRGxC.exe
  C:\Windows\System\PQkRGxC.exe
  2⤵
  PID:2212
- C:\Windows\System\uowMGKR.exe
  C:\Windows\System\uowMGKR.exe
  2⤵
  PID:3032
- C:\Windows\System\eDeyhIW.exe
  C:\Windows\System\eDeyhIW.exe
  2⤵
  PID:2136
- C:\Windows\System\ETKHNVx.exe
  C:\Windows\System\ETKHNVx.exe
  2⤵
  PID:2812
- C:\Windows\System\bPGfyvi.exe
  C:\Windows\System\bPGfyvi.exe
  2⤵
  PID:3016
- C:\Windows\System\LWipsTU.exe
  C:\Windows\System\LWipsTU.exe
  2⤵
  PID:2140
- C:\Windows\System\YUUYVNe.exe
  C:\Windows\System\YUUYVNe.exe
  2⤵
  PID:1092
- C:\Windows\System\eEPCGlk.exe
  C:\Windows\System\eEPCGlk.exe
  2⤵
  PID:2792
- C:\Windows\System\vcvuFCl.exe
  C:\Windows\System\vcvuFCl.exe
  2⤵
  PID:2608
- C:\Windows\System\CCzJlJb.exe
  C:\Windows\System\CCzJlJb.exe
  2⤵
  PID:2788
- C:\Windows\System\tAinRxr.exe
  C:\Windows\System\tAinRxr.exe
  2⤵
  PID:936
- C:\Windows\System\RiPTCyf.exe
  C:\Windows\System\RiPTCyf.exe
  2⤵
  PID:2528
- C:\Windows\System\uwfqdiI.exe
  C:\Windows\System\uwfqdiI.exe
  2⤵
  PID:2484
- C:\Windows\System\xllmFST.exe
  C:\Windows\System\xllmFST.exe
  2⤵
  PID:916
- C:\Windows\System\XCBZnEN.exe
  C:\Windows\System\XCBZnEN.exe
  2⤵
  PID:860
- C:\Windows\System\jYhaFBe.exe
  C:\Windows\System\jYhaFBe.exe
  2⤵
  PID:2196
- C:\Windows\System\CQuQgbG.exe
  C:\Windows\System\CQuQgbG.exe
  2⤵
  PID:2428
- C:\Windows\System\gaEVFmS.exe
  C:\Windows\System\gaEVFmS.exe
  2⤵
  PID:1720
- C:\Windows\System\btAwvQG.exe
  C:\Windows\System\btAwvQG.exe
  2⤵
  PID:1584
- C:\Windows\System\oPMXYDa.exe
  C:\Windows\System\oPMXYDa.exe
  2⤵
  PID:2904
- C:\Windows\System\IWHprAR.exe
  C:\Windows\System\IWHprAR.exe
  2⤵
  PID:816
- C:\Windows\System\LAUoMGT.exe
  C:\Windows\System\LAUoMGT.exe
  2⤵
  PID:988
- C:\Windows\System\yxmofEV.exe
  C:\Windows\System\yxmofEV.exe
  2⤵
  PID:1640
- C:\Windows\System\bDlARQO.exe
  C:\Windows\System\bDlARQO.exe
  2⤵
  PID:2560
- C:\Windows\System\vBsoxHM.exe
  C:\Windows\System\vBsoxHM.exe
  2⤵
  PID:2192
- C:\Windows\System\WNZnkDb.exe
  C:\Windows\System\WNZnkDb.exe
  2⤵
  PID:1084
- C:\Windows\System\RbnzVhr.exe
  C:\Windows\System\RbnzVhr.exe
  2⤵
  PID:324
- C:\Windows\System\IWZRFBx.exe
  C:\Windows\System\IWZRFBx.exe
  2⤵
  PID:264
- C:\Windows\System\dsvPrnu.exe
  C:\Windows\System\dsvPrnu.exe
  2⤵
  PID:2836
- C:\Windows\System\AxIzPBh.exe
  C:\Windows\System\AxIzPBh.exe
  2⤵
  PID:1808
- C:\Windows\System\zZEFftt.exe
  C:\Windows\System\zZEFftt.exe
  2⤵
  PID:2220
- C:\Windows\System\CyLbGbZ.exe
  C:\Windows\System\CyLbGbZ.exe
  2⤵
  PID:3080
- C:\Windows\System\vPGYdOR.exe
  C:\Windows\System\vPGYdOR.exe
  2⤵
  PID:3096
- C:\Windows\System\iDeXxVl.exe
  C:\Windows\System\iDeXxVl.exe
  2⤵
  PID:3132
- C:\Windows\System\nISIJti.exe
  C:\Windows\System\nISIJti.exe
  2⤵
  PID:3168
- C:\Windows\System\WAKRECI.exe
  C:\Windows\System\WAKRECI.exe
  2⤵
  PID:3184
- C:\Windows\System\ghVafVL.exe
  C:\Windows\System\ghVafVL.exe
  2⤵
  PID:3200
- C:\Windows\System\UfRgPcc.exe
  C:\Windows\System\UfRgPcc.exe
  2⤵
  PID:3224
- C:\Windows\System\tlPZwHp.exe
  C:\Windows\System\tlPZwHp.exe
  2⤵
  PID:3240
- C:\Windows\System\QbMIijJ.exe
  C:\Windows\System\QbMIijJ.exe
  2⤵
  PID:3256
- C:\Windows\System\VrcSPjV.exe
  C:\Windows\System\VrcSPjV.exe
  2⤵
  PID:3276
- C:\Windows\System\gpHAAxn.exe
  C:\Windows\System\gpHAAxn.exe
  2⤵
  PID:3292
- C:\Windows\System\cFiMqKV.exe
  C:\Windows\System\cFiMqKV.exe
  2⤵
  PID:3312
- C:\Windows\System\wXtpNxT.exe
  C:\Windows\System\wXtpNxT.exe
  2⤵
  PID:3336
- C:\Windows\System\wGYbBBa.exe
  C:\Windows\System\wGYbBBa.exe
  2⤵
  PID:3356
- C:\Windows\System\mJFWxnh.exe
  C:\Windows\System\mJFWxnh.exe
  2⤵
  PID:3372
- C:\Windows\System\vROZspJ.exe
  C:\Windows\System\vROZspJ.exe
  2⤵
  PID:3388
- C:\Windows\System\uNSlaks.exe
  C:\Windows\System\uNSlaks.exe
  2⤵
  PID:3404
- C:\Windows\System\JiGviSu.exe
  C:\Windows\System\JiGviSu.exe
  2⤵
  PID:3420
- C:\Windows\System\BANlJiG.exe
  C:\Windows\System\BANlJiG.exe
  2⤵
  PID:3436
- C:\Windows\System\wnIXvcA.exe
  C:\Windows\System\wnIXvcA.exe
  2⤵
  PID:3452
- C:\Windows\System\uDuAbyS.exe
  C:\Windows\System\uDuAbyS.exe
  2⤵
  PID:3468
- C:\Windows\System\VSLGQph.exe
  C:\Windows\System\VSLGQph.exe
  2⤵
  PID:3484
- C:\Windows\System\fcNnSmE.exe
  C:\Windows\System\fcNnSmE.exe
  2⤵
  PID:3504
- C:\Windows\System\kFcSwtR.exe
  C:\Windows\System\kFcSwtR.exe
  2⤵
  PID:3520
- C:\Windows\System\xyRiRmQ.exe
  C:\Windows\System\xyRiRmQ.exe
  2⤵
  PID:3536
- C:\Windows\System\umCIsCy.exe
  C:\Windows\System\umCIsCy.exe
  2⤵
  PID:3552
- C:\Windows\System\qdlCtIh.exe
  C:\Windows\System\qdlCtIh.exe
  2⤵
  PID:3568
- C:\Windows\System\wXbFnPC.exe
  C:\Windows\System\wXbFnPC.exe
  2⤵
  PID:3584
- C:\Windows\System\UUBsQlC.exe
  C:\Windows\System\UUBsQlC.exe
  2⤵
  PID:3600
- C:\Windows\System\NZwHxRX.exe
  C:\Windows\System\NZwHxRX.exe
  2⤵
  PID:3616
- C:\Windows\System\keRBdaP.exe
  C:\Windows\System\keRBdaP.exe
  2⤵
  PID:3632
- C:\Windows\System\ALDXhct.exe
  C:\Windows\System\ALDXhct.exe
  2⤵
  PID:3648
- C:\Windows\System\oISbayD.exe
  C:\Windows\System\oISbayD.exe
  2⤵
  PID:3664
- C:\Windows\System\kTAqKud.exe
  C:\Windows\System\kTAqKud.exe
  2⤵
  PID:3680
- C:\Windows\System\rpUeNZU.exe
  C:\Windows\System\rpUeNZU.exe
  2⤵
  PID:3696
- C:\Windows\System\JKjlian.exe
  C:\Windows\System\JKjlian.exe
  2⤵
  PID:3712
- C:\Windows\System\VELZltB.exe
  C:\Windows\System\VELZltB.exe
  2⤵
  PID:3728
- C:\Windows\System\XGhcOia.exe
  C:\Windows\System\XGhcOia.exe
  2⤵
  PID:3752
- C:\Windows\System\ZZfCAic.exe
  C:\Windows\System\ZZfCAic.exe
  2⤵
  PID:3768
- C:\Windows\System\beyTAfY.exe
  C:\Windows\System\beyTAfY.exe
  2⤵
  PID:3784
- C:\Windows\System\PQtxDIq.exe
  C:\Windows\System\PQtxDIq.exe
  2⤵
  PID:3800
- C:\Windows\System\cahJdWo.exe
  C:\Windows\System\cahJdWo.exe
  2⤵
  PID:3816
- C:\Windows\System\VdtDCKC.exe
  C:\Windows\System\VdtDCKC.exe
  2⤵
  PID:3832
- C:\Windows\System\MswiqLn.exe
  C:\Windows\System\MswiqLn.exe
  2⤵
  PID:3848
- C:\Windows\System\BIpKOuR.exe
  C:\Windows\System\BIpKOuR.exe
  2⤵
  PID:3864
- C:\Windows\System\qydlpmh.exe
  C:\Windows\System\qydlpmh.exe
  2⤵
  PID:3880
- C:\Windows\System\zSbQFDu.exe
  C:\Windows\System\zSbQFDu.exe
  2⤵
  PID:3896
- C:\Windows\System\RzzTPZK.exe
  C:\Windows\System\RzzTPZK.exe
  2⤵
  PID:3912
- C:\Windows\System\DEPkVQv.exe
  C:\Windows\System\DEPkVQv.exe
  2⤵
  PID:3972
- C:\Windows\System\TfpQojU.exe
  C:\Windows\System\TfpQojU.exe
  2⤵
  PID:3988
- C:\Windows\System\AiPcAKg.exe
  C:\Windows\System\AiPcAKg.exe
  2⤵
  PID:4004
- C:\Windows\System\IjunuiQ.exe
  C:\Windows\System\IjunuiQ.exe
  2⤵
  PID:4020
- C:\Windows\System\ItAkrCA.exe
  C:\Windows\System\ItAkrCA.exe
  2⤵
  PID:4036
- C:\Windows\System\NBFnYNN.exe
  C:\Windows\System\NBFnYNN.exe
  2⤵
  PID:4052
- C:\Windows\System\WXQDUcP.exe
  C:\Windows\System\WXQDUcP.exe
  2⤵
  PID:4068
- C:\Windows\System\NicMkdI.exe
  C:\Windows\System\NicMkdI.exe
  2⤵
  PID:3092
- C:\Windows\System\GpQDlhR.exe
  C:\Windows\System\GpQDlhR.exe
  2⤵
  PID:3112
- C:\Windows\System\zakRFNS.exe
  C:\Windows\System\zakRFNS.exe
  2⤵
  PID:3128
- C:\Windows\System\XuJrDTM.exe
  C:\Windows\System\XuJrDTM.exe
  2⤵
  PID:3144
- C:\Windows\System\fLHAZdy.exe
  C:\Windows\System\fLHAZdy.exe
  2⤵
  PID:3156
- C:\Windows\System\sNJwJBa.exe
  C:\Windows\System\sNJwJBa.exe
  2⤵
  PID:3232
- C:\Windows\System\IvjKrEi.exe
  C:\Windows\System\IvjKrEi.exe
  2⤵
  PID:3300
- C:\Windows\System\xREXicL.exe
  C:\Windows\System\xREXicL.exe
  2⤵
  PID:3348
- C:\Windows\System\oeUaiEY.exe
  C:\Windows\System\oeUaiEY.exe
  2⤵
  PID:3212
- C:\Windows\System\FhfWuss.exe
  C:\Windows\System\FhfWuss.exe
  2⤵
  PID:3284
- C:\Windows\System\tsGYUjZ.exe
  C:\Windows\System\tsGYUjZ.exe
  2⤵
  PID:3328
- C:\Windows\System\QKOvqLw.exe
  C:\Windows\System\QKOvqLw.exe
  2⤵
  PID:3384
- C:\Windows\System\ceXWFSk.exe
  C:\Windows\System\ceXWFSk.exe
  2⤵
  PID:3416
- C:\Windows\System\hltXgvb.exe
  C:\Windows\System\hltXgvb.exe
  2⤵
  PID:3460
- C:\Windows\System\jYVzbGB.exe
  C:\Windows\System\jYVzbGB.exe
  2⤵
  PID:3396
- C:\Windows\System\UgmrWnd.exe
  C:\Windows\System\UgmrWnd.exe
  2⤵
  PID:3512
- C:\Windows\System\sZAtFNf.exe
  C:\Windows\System\sZAtFNf.exe
  2⤵
  PID:3576
- C:\Windows\System\TxWyayY.exe
  C:\Windows\System\TxWyayY.exe
  2⤵
  PID:3492
- C:\Windows\System\upQjYwb.exe
  C:\Windows\System\upQjYwb.exe
  2⤵
  PID:3644
- C:\Windows\System\hcmCcnY.exe
  C:\Windows\System\hcmCcnY.exe
  2⤵
  PID:3708
- C:\Windows\System\eGOoEJE.exe
  C:\Windows\System\eGOoEJE.exe
  2⤵
  PID:3628
- C:\Windows\System\RKmiKbJ.exe
  C:\Windows\System\RKmiKbJ.exe
  2⤵
  PID:3720
- C:\Windows\System\gRdFbtX.exe
  C:\Windows\System\gRdFbtX.exe
  2⤵
  PID:3744
- C:\Windows\System\cLRNFRT.exe
  C:\Windows\System\cLRNFRT.exe
  2⤵
  PID:3812
- C:\Windows\System\FUmbwSk.exe
  C:\Windows\System\FUmbwSk.exe
  2⤵
  PID:3872
- C:\Windows\System\uSmcDpH.exe
  C:\Windows\System\uSmcDpH.exe
  2⤵
  PID:3564
- C:\Windows\System\TjBuZGi.exe
  C:\Windows\System\TjBuZGi.exe
  2⤵
  PID:3904
- C:\Windows\System\mhLNKRY.exe
  C:\Windows\System\mhLNKRY.exe
  2⤵
  PID:3824
- C:\Windows\System\TXqlFan.exe
  C:\Windows\System\TXqlFan.exe
  2⤵
  PID:3892
- C:\Windows\System\cYbNCzu.exe
  C:\Windows\System\cYbNCzu.exe
  2⤵
  PID:3932
- C:\Windows\System\YVCENuH.exe
  C:\Windows\System\YVCENuH.exe
  2⤵
  PID:3980
- C:\Windows\System\PxSxGTR.exe
  C:\Windows\System\PxSxGTR.exe
  2⤵
  PID:4044
- C:\Windows\System\VQOZzNh.exe
  C:\Windows\System\VQOZzNh.exe
  2⤵
  PID:4000
- C:\Windows\System\WbsREGR.exe
  C:\Windows\System\WbsREGR.exe
  2⤵
  PID:4076
- C:\Windows\System\RQIyIVz.exe
  C:\Windows\System\RQIyIVz.exe
  2⤵
  PID:3996
- C:\Windows\System\CKSTkpw.exe
  C:\Windows\System\CKSTkpw.exe
  2⤵
  PID:2288
- C:\Windows\System\eLZGMhl.exe
  C:\Windows\System\eLZGMhl.exe
  2⤵
  PID:3104
- C:\Windows\System\kNBlSTT.exe
  C:\Windows\System\kNBlSTT.exe
  2⤵
  PID:3140
- C:\Windows\System\tCAUbVv.exe
  C:\Windows\System\tCAUbVv.exe
  2⤵
  PID:3344
- C:\Windows\System\ZXrlhDA.exe
  C:\Windows\System\ZXrlhDA.exe
  2⤵
  PID:3248
- C:\Windows\System\EbQlkRm.exe
  C:\Windows\System\EbQlkRm.exe
  2⤵
  PID:3364
- C:\Windows\System\KvoHSVt.exe
  C:\Windows\System\KvoHSVt.exe
  2⤵
  PID:3496
- C:\Windows\System\ceNBXja.exe
  C:\Windows\System\ceNBXja.exe
  2⤵
  PID:3676
- C:\Windows\System\NubNDKo.exe
  C:\Windows\System\NubNDKo.exe
  2⤵
  PID:3532
- C:\Windows\System\ongmhTG.exe
  C:\Windows\System\ongmhTG.exe
  2⤵
  PID:3860
- C:\Windows\System\HFAzMPN.exe
  C:\Windows\System\HFAzMPN.exe
  2⤵
  PID:3940
- C:\Windows\System\NaGgCfa.exe
  C:\Windows\System\NaGgCfa.exe
  2⤵
  PID:3152
- C:\Windows\System\sNVgxsr.exe
  C:\Windows\System\sNVgxsr.exe
  2⤵
  PID:3624
- C:\Windows\System\PKGlDfT.exe
  C:\Windows\System\PKGlDfT.exe
  2⤵
  PID:3924
- C:\Windows\System\IlfyqUu.exe
  C:\Windows\System\IlfyqUu.exe
  2⤵
  PID:3192
- C:\Windows\System\Qkvzjlp.exe
  C:\Windows\System\Qkvzjlp.exe
  2⤵
  PID:3944
- C:\Windows\System\xwKEDcq.exe
  C:\Windows\System\xwKEDcq.exe
  2⤵
  PID:3220
- C:\Windows\System\vySzUIO.exe
  C:\Windows\System\vySzUIO.exe
  2⤵
  PID:3352
- C:\Windows\System\cMZlxrv.exe
  C:\Windows\System\cMZlxrv.exe
  2⤵
  PID:3480
- C:\Windows\System\rDRhNwO.exe
  C:\Windows\System\rDRhNwO.exe
  2⤵
  PID:3780
- C:\Windows\System\xkZcmvs.exe
  C:\Windows\System\xkZcmvs.exe
  2⤵
  PID:4048
- C:\Windows\System\KColKiz.exe
  C:\Windows\System\KColKiz.exe
  2⤵
  PID:3308
- C:\Windows\System\DJycvGS.exe
  C:\Windows\System\DJycvGS.exe
  2⤵
  PID:3548
- C:\Windows\System\TWUZmON.exe
  C:\Windows\System\TWUZmON.exe
  2⤵
  PID:3324
- C:\Windows\System\isBGeHX.exe
  C:\Windows\System\isBGeHX.exe
  2⤵
  PID:3736
- C:\Windows\System\NicJDMt.exe
  C:\Windows\System\NicJDMt.exe
  2⤵
  PID:4060
- C:\Windows\System\IGmBhrr.exe
  C:\Windows\System\IGmBhrr.exe
  2⤵
  PID:4100
- C:\Windows\System\nKGVdHV.exe
  C:\Windows\System\nKGVdHV.exe
  2⤵
  PID:4116
- C:\Windows\System\cbZkiFN.exe
  C:\Windows\System\cbZkiFN.exe
  2⤵
  PID:4132
- C:\Windows\System\HCqJprU.exe
  C:\Windows\System\HCqJprU.exe
  2⤵
  PID:4148
- C:\Windows\System\ZEXIKZk.exe
  C:\Windows\System\ZEXIKZk.exe
  2⤵
  PID:4164
- C:\Windows\System\OMlASKW.exe
  C:\Windows\System\OMlASKW.exe
  2⤵
  PID:4180
- C:\Windows\System\OxDMHRB.exe
  C:\Windows\System\OxDMHRB.exe
  2⤵
  PID:4196
- C:\Windows\System\gHPDvML.exe
  C:\Windows\System\gHPDvML.exe
  2⤵
  PID:4212
- C:\Windows\System\KMITQXM.exe
  C:\Windows\System\KMITQXM.exe
  2⤵
  PID:4228
- C:\Windows\System\dmCWWae.exe
  C:\Windows\System\dmCWWae.exe
  2⤵
  PID:4244
- C:\Windows\System\OTMIqqH.exe
  C:\Windows\System\OTMIqqH.exe
  2⤵
  PID:4260
- C:\Windows\System\zyLzhBr.exe
  C:\Windows\System\zyLzhBr.exe
  2⤵
  PID:4276
- C:\Windows\System\MqMDTci.exe
  C:\Windows\System\MqMDTci.exe
  2⤵
  PID:4292
- C:\Windows\System\fBPmkPs.exe
  C:\Windows\System\fBPmkPs.exe
  2⤵
  PID:4312
- C:\Windows\System\rRoPuik.exe
  C:\Windows\System\rRoPuik.exe
  2⤵
  PID:4328
- C:\Windows\System\IxcGePc.exe
  C:\Windows\System\IxcGePc.exe
  2⤵
  PID:4344
- C:\Windows\System\uorFzhh.exe
  C:\Windows\System\uorFzhh.exe
  2⤵
  PID:4360
- C:\Windows\System\MTsgPvr.exe
  C:\Windows\System\MTsgPvr.exe
  2⤵
  PID:4376
- C:\Windows\System\ZXsRaZZ.exe
  C:\Windows\System\ZXsRaZZ.exe
  2⤵
  PID:4392
- C:\Windows\System\ZjwymfC.exe
  C:\Windows\System\ZjwymfC.exe
  2⤵
  PID:4412
- C:\Windows\System\JNhyEBN.exe
  C:\Windows\System\JNhyEBN.exe
  2⤵
  PID:4428
- C:\Windows\System\OMVaKBn.exe
  C:\Windows\System\OMVaKBn.exe
  2⤵
  PID:4444
- C:\Windows\System\MaMXhxG.exe
  C:\Windows\System\MaMXhxG.exe
  2⤵
  PID:4460
- C:\Windows\System\NArTTIK.exe
  C:\Windows\System\NArTTIK.exe
  2⤵
  PID:4476
- C:\Windows\System\YUhTUvL.exe
  C:\Windows\System\YUhTUvL.exe
  2⤵
  PID:4492
- C:\Windows\System\LDJaYhx.exe
  C:\Windows\System\LDJaYhx.exe
  2⤵
  PID:4508
- C:\Windows\System\imRyXzc.exe
  C:\Windows\System\imRyXzc.exe
  2⤵
  PID:4524
- C:\Windows\System\EfMlLtz.exe
  C:\Windows\System\EfMlLtz.exe
  2⤵
  PID:4540
- C:\Windows\System\VDTZGgO.exe
  C:\Windows\System\VDTZGgO.exe
  2⤵
  PID:4556
- C:\Windows\System\phNiKJM.exe
  C:\Windows\System\phNiKJM.exe
  2⤵
  PID:4572
- C:\Windows\System\oJIWSMQ.exe
  C:\Windows\System\oJIWSMQ.exe
  2⤵
  PID:4588
- C:\Windows\System\NgUKcAC.exe
  C:\Windows\System\NgUKcAC.exe
  2⤵
  PID:4604
- C:\Windows\System\YZzucEL.exe
  C:\Windows\System\YZzucEL.exe
  2⤵
  PID:4620
- C:\Windows\System\NGcKZRy.exe
  C:\Windows\System\NGcKZRy.exe
  2⤵
  PID:4636
- C:\Windows\System\kIHZnoc.exe
  C:\Windows\System\kIHZnoc.exe
  2⤵
  PID:4652
- C:\Windows\System\PavEOFV.exe
  C:\Windows\System\PavEOFV.exe
  2⤵
  PID:4668
- C:\Windows\System\WVwxopZ.exe
  C:\Windows\System\WVwxopZ.exe
  2⤵
  PID:4684
- C:\Windows\System\tmnmGvG.exe
  C:\Windows\System\tmnmGvG.exe
  2⤵
  PID:4700
- C:\Windows\System\PpVsvfI.exe
  C:\Windows\System\PpVsvfI.exe
  2⤵
  PID:4716
- C:\Windows\System\PcsCzil.exe
  C:\Windows\System\PcsCzil.exe
  2⤵
  PID:4732
- C:\Windows\System\LtTuHXV.exe
  C:\Windows\System\LtTuHXV.exe
  2⤵
  PID:4748
- C:\Windows\System\XyaKoFs.exe
  C:\Windows\System\XyaKoFs.exe
  2⤵
  PID:4764
- C:\Windows\System\NRiEiSk.exe
  C:\Windows\System\NRiEiSk.exe
  2⤵
  PID:4780
- C:\Windows\System\SDcWOaU.exe
  C:\Windows\System\SDcWOaU.exe
  2⤵
  PID:4796
- C:\Windows\System\FobWsuu.exe
  C:\Windows\System\FobWsuu.exe
  2⤵
  PID:4812
- C:\Windows\System\EOifWae.exe
  C:\Windows\System\EOifWae.exe
  2⤵
  PID:4828
- C:\Windows\System\peNHlPx.exe
  C:\Windows\System\peNHlPx.exe
  2⤵
  PID:4844
- C:\Windows\System\akFyhnM.exe
  C:\Windows\System\akFyhnM.exe
  2⤵
  PID:4860
- C:\Windows\System\rsnJruD.exe
  C:\Windows\System\rsnJruD.exe
  2⤵
  PID:4876
- C:\Windows\System\YYiRKFK.exe
  C:\Windows\System\YYiRKFK.exe
  2⤵
  PID:4892
- C:\Windows\System\eizRlhc.exe
  C:\Windows\System\eizRlhc.exe
  2⤵
  PID:4908
- C:\Windows\System\gGCEFsG.exe
  C:\Windows\System\gGCEFsG.exe
  2⤵
  PID:4924
- C:\Windows\System\AnydrqB.exe
  C:\Windows\System\AnydrqB.exe
  2⤵
  PID:4940
- C:\Windows\System\FMubmDp.exe
  C:\Windows\System\FMubmDp.exe
  2⤵
  PID:4128
- C:\Windows\System\nKdOXLq.exe
  C:\Windows\System\nKdOXLq.exe
  2⤵
  PID:3400
- C:\Windows\System\JIxzIdT.exe
  C:\Windows\System\JIxzIdT.exe
  2⤵
  PID:3596
- C:\Windows\System\EwrRFhu.exe
  C:\Windows\System\EwrRFhu.exe
  2⤵
  PID:4340
- C:\Windows\System\yTQVobU.exe
  C:\Windows\System\yTQVobU.exe
  2⤵
  PID:4372
- C:\Windows\System\SkVqNqY.exe
  C:\Windows\System\SkVqNqY.exe
  2⤵
  PID:3968
- C:\Windows\System\EgsIOlR.exe
  C:\Windows\System\EgsIOlR.exe
  2⤵
  PID:4252
- C:\Windows\System\CPBOrIT.exe
  C:\Windows\System\CPBOrIT.exe
  2⤵
  PID:4400
- C:\Windows\System\ffxJttN.exe
  C:\Windows\System\ffxJttN.exe
  2⤵
  PID:4404
- C:\Windows\System\pOBNkNL.exe
  C:\Windows\System\pOBNkNL.exe
  2⤵
  PID:4468
- C:\Windows\System\RWXxtBx.exe
  C:\Windows\System\RWXxtBx.exe
  2⤵
  PID:4532
- C:\Windows\System\vqGmLRy.exe
  C:\Windows\System\vqGmLRy.exe
  2⤵
  PID:4596
- C:\Windows\System\zXGDdzu.exe
  C:\Windows\System\zXGDdzu.exe
  2⤵
  PID:4660
- C:\Windows\System\ikjsSda.exe
  C:\Windows\System\ikjsSda.exe
  2⤵
  PID:4724
- C:\Windows\System\WKxtxfh.exe
  C:\Windows\System\WKxtxfh.exe
  2⤵
  PID:4788
- C:\Windows\System\HFHMJwc.exe
  C:\Windows\System\HFHMJwc.exe
  2⤵
  PID:4420
- C:\Windows\System\JXmplaU.exe
  C:\Windows\System\JXmplaU.exe
  2⤵
  PID:4884
- C:\Windows\System\CIgdSvI.exe
  C:\Windows\System\CIgdSvI.exe
  2⤵
  PID:4712
- C:\Windows\System\xRsMrGH.exe
  C:\Windows\System\xRsMrGH.exe
  2⤵
  PID:4872
- C:\Windows\System\VNVvntm.exe
  C:\Windows\System\VNVvntm.exe
  2⤵
  PID:4744
- C:\Windows\System\Hkgatpo.exe
  C:\Windows\System\Hkgatpo.exe
  2⤵
  PID:4808
- C:\Windows\System\mGmchza.exe
  C:\Windows\System\mGmchza.exe
  2⤵
  PID:4676
- C:\Windows\System\vRsZvgT.exe
  C:\Windows\System\vRsZvgT.exe
  2⤵
  PID:4584
- C:\Windows\System\qXlzujO.exe
  C:\Windows\System\qXlzujO.exe
  2⤵
  PID:4520
- C:\Windows\System\BpFXOmV.exe
  C:\Windows\System\BpFXOmV.exe
  2⤵
  PID:4456
- C:\Windows\System\AilQyCN.exe
  C:\Windows\System\AilQyCN.exe
  2⤵
  PID:4948
- C:\Windows\System\cNaldXz.exe
  C:\Windows\System\cNaldXz.exe
  2⤵
  PID:4972
- C:\Windows\System\FboDRgV.exe
  C:\Windows\System\FboDRgV.exe
  2⤵
  PID:4988
- C:\Windows\System\KFlpGFL.exe
  C:\Windows\System\KFlpGFL.exe
  2⤵
  PID:5004
- C:\Windows\System\drDVwqk.exe
  C:\Windows\System\drDVwqk.exe
  2⤵
  PID:5020
- C:\Windows\System\wsDnmXe.exe
  C:\Windows\System\wsDnmXe.exe
  2⤵
  PID:5040
- C:\Windows\System\QKsgvSq.exe
  C:\Windows\System\QKsgvSq.exe
  2⤵
  PID:5052
- C:\Windows\System\CgmaWUL.exe
  C:\Windows\System\CgmaWUL.exe
  2⤵
  PID:5068
- C:\Windows\System\VcJxVxF.exe
  C:\Windows\System\VcJxVxF.exe
  2⤵
  PID:5076
- C:\Windows\System\KjUrUev.exe
  C:\Windows\System\KjUrUev.exe
  2⤵
  PID:5088
- C:\Windows\System\JhfhBLH.exe
  C:\Windows\System\JhfhBLH.exe
  2⤵
  PID:5104
- C:\Windows\System\GNTEFKb.exe
  C:\Windows\System\GNTEFKb.exe
  2⤵
  PID:3856
- C:\Windows\System\PmHVbgr.exe
  C:\Windows\System\PmHVbgr.exe
  2⤵
  PID:3208
- C:\Windows\System\lhkcKYQ.exe
  C:\Windows\System\lhkcKYQ.exe
  2⤵
  PID:3124
- C:\Windows\System\ECYMOnD.exe
  C:\Windows\System\ECYMOnD.exe
  2⤵
  PID:4208
- C:\Windows\System\XgmVwXZ.exe
  C:\Windows\System\XgmVwXZ.exe
  2⤵
  PID:4160
- C:\Windows\System\ssUDRVw.exe
  C:\Windows\System\ssUDRVw.exe
  2⤵
  PID:4304
- C:\Windows\System\LnbJOEC.exe
  C:\Windows\System\LnbJOEC.exe
  2⤵
  PID:4336
- C:\Windows\System\NlRnpjJ.exe
  C:\Windows\System\NlRnpjJ.exe
  2⤵
  PID:3692
- C:\Windows\System\IDJAiZB.exe
  C:\Windows\System\IDJAiZB.exe
  2⤵
  PID:4288
- C:\Windows\System\vgMwVoC.exe
  C:\Windows\System\vgMwVoC.exe
  2⤵
  PID:4760
- C:\Windows\System\vzeaofy.exe
  C:\Windows\System\vzeaofy.exe
  2⤵
  PID:4696
- C:\Windows\System\KMwQJcD.exe
  C:\Windows\System\KMwQJcD.exe
  2⤵
  PID:4836
- C:\Windows\System\MqGUedc.exe
  C:\Windows\System\MqGUedc.exe
  2⤵
  PID:4612
- C:\Windows\System\yTrwOWN.exe
  C:\Windows\System\yTrwOWN.exe
  2⤵
  PID:4960
- C:\Windows\System\HSssfJp.exe
  C:\Windows\System\HSssfJp.exe
  2⤵
  PID:5000
- C:\Windows\System\PoXoQEb.exe
  C:\Windows\System\PoXoQEb.exe
  2⤵
  PID:5060
- C:\Windows\System\yqDUhnd.exe
  C:\Windows\System\yqDUhnd.exe
  2⤵
  PID:4548
- C:\Windows\System\REOVNkW.exe
  C:\Windows\System\REOVNkW.exe
  2⤵
  PID:3688
- C:\Windows\System\BqqjgVu.exe
  C:\Windows\System\BqqjgVu.exe
  2⤵
  PID:4240
- C:\Windows\System\DyjHYLu.exe
  C:\Windows\System\DyjHYLu.exe
  2⤵
  PID:4552
- C:\Windows\System\cMEqTdM.exe
  C:\Windows\System\cMEqTdM.exe
  2⤵
  PID:4868
- C:\Windows\System\jhRejGK.exe
  C:\Windows\System\jhRejGK.exe
  2⤵
  PID:4740
- C:\Windows\System\oDILeic.exe
  C:\Windows\System\oDILeic.exe
  2⤵
  PID:5036
- C:\Windows\System\dnxniZE.exe
  C:\Windows\System\dnxniZE.exe
  2⤵
  PID:3592
- C:\Windows\System\tJYGVEQ.exe
  C:\Windows\System\tJYGVEQ.exe
  2⤵
  PID:3412
- C:\Windows\System\MYukiKk.exe
  C:\Windows\System\MYukiKk.exe
  2⤵
  PID:4284
- C:\Windows\System\zVUrXKi.exe
  C:\Windows\System\zVUrXKi.exe
  2⤵
  PID:4628
- C:\Windows\System\caZWlLn.exe
  C:\Windows\System\caZWlLn.exe
  2⤵
  PID:4776
- C:\Windows\System\ExiMTxw.exe
  C:\Windows\System\ExiMTxw.exe
  2⤵
  PID:4756
- C:\Windows\System\CkHoyrf.exe
  C:\Windows\System\CkHoyrf.exe
  2⤵
  PID:4824
- C:\Windows\System\OQRUekL.exe
  C:\Windows\System\OQRUekL.exe
  2⤵
  PID:4984
- C:\Windows\System\xXlkXti.exe
  C:\Windows\System\xXlkXti.exe
  2⤵
  PID:4500
- C:\Windows\System\reVhHLX.exe
  C:\Windows\System\reVhHLX.exe
  2⤵
  PID:4644
- C:\Windows\System\HMQvxcn.exe
  C:\Windows\System\HMQvxcn.exe
  2⤵
  PID:5100
- C:\Windows\System\DeKqwBH.exe
  C:\Windows\System\DeKqwBH.exe
  2⤵
  PID:4616
- C:\Windows\System\lfJKogo.exe
  C:\Windows\System\lfJKogo.exe
  2⤵
  PID:4300
- C:\Windows\System\mZdvWWT.exe
  C:\Windows\System\mZdvWWT.exe
  2⤵
  PID:5084
- C:\Windows\System\OTAvFsr.exe
  C:\Windows\System\OTAvFsr.exe
  2⤵
  PID:3272
- C:\Windows\System\xHSThJb.exe
  C:\Windows\System\xHSThJb.exe
  2⤵
  PID:5048
- C:\Windows\System\TFuEwVq.exe
  C:\Windows\System\TFuEwVq.exe
  2⤵
  PID:4176
- C:\Windows\System\UQYpKPg.exe
  C:\Windows\System\UQYpKPg.exe
  2⤵
  PID:5012
- C:\Windows\System\UPpxYsd.exe
  C:\Windows\System\UPpxYsd.exe
  2⤵
  PID:5136
- C:\Windows\System\GNIqNHi.exe
  C:\Windows\System\GNIqNHi.exe
  2⤵
  PID:5156
- C:\Windows\System\JHkVJGs.exe
  C:\Windows\System\JHkVJGs.exe
  2⤵
  PID:5176
- C:\Windows\System\ErkMJhq.exe
  C:\Windows\System\ErkMJhq.exe
  2⤵
  PID:5208
- C:\Windows\System\MerGxLT.exe
  C:\Windows\System\MerGxLT.exe
  2⤵
  PID:5228
- C:\Windows\System\KoGrgDe.exe
  C:\Windows\System\KoGrgDe.exe
  2⤵
  PID:5244
- C:\Windows\System\SJJeaRJ.exe
  C:\Windows\System\SJJeaRJ.exe
  2⤵
  PID:5260
- C:\Windows\System\bMIeANt.exe
  C:\Windows\System\bMIeANt.exe
  2⤵
  PID:5276
- C:\Windows\System\yhfuQTr.exe
  C:\Windows\System\yhfuQTr.exe
  2⤵
  PID:5292
- C:\Windows\System\egzCdrE.exe
  C:\Windows\System\egzCdrE.exe
  2⤵
  PID:5308
- C:\Windows\System\LmfdeRB.exe
  C:\Windows\System\LmfdeRB.exe
  2⤵
  PID:5324
- C:\Windows\System\TdDlFEN.exe
  C:\Windows\System\TdDlFEN.exe
  2⤵
  PID:5340
- C:\Windows\System\KDdZJfS.exe
  C:\Windows\System\KDdZJfS.exe
  2⤵
  PID:5356
- C:\Windows\System\cSpOhud.exe
  C:\Windows\System\cSpOhud.exe
  2⤵
  PID:5372
- C:\Windows\System\uSLFwxd.exe
  C:\Windows\System\uSLFwxd.exe
  2⤵
  PID:5388
- C:\Windows\System\maBSBFa.exe
  C:\Windows\System\maBSBFa.exe
  2⤵
  PID:5404
- C:\Windows\System\EburESd.exe
  C:\Windows\System\EburESd.exe
  2⤵
  PID:5420
- C:\Windows\System\wIYsSDv.exe
  C:\Windows\System\wIYsSDv.exe
  2⤵
  PID:5436
- C:\Windows\System\VkzYUrV.exe
  C:\Windows\System\VkzYUrV.exe
  2⤵
  PID:5452
- C:\Windows\System\amsFYrd.exe
  C:\Windows\System\amsFYrd.exe
  2⤵
  PID:5468
- C:\Windows\System\fpYTYCo.exe
  C:\Windows\System\fpYTYCo.exe
  2⤵
  PID:5484
- C:\Windows\System\UvqOTLq.exe
  C:\Windows\System\UvqOTLq.exe
  2⤵
  PID:5500
- C:\Windows\System\MFozNdL.exe
  C:\Windows\System\MFozNdL.exe
  2⤵
  PID:5516
- C:\Windows\System\gBcWWNO.exe
  C:\Windows\System\gBcWWNO.exe
  2⤵
  PID:5532
- C:\Windows\System\MvBbcrW.exe
  C:\Windows\System\MvBbcrW.exe
  2⤵
  PID:5548
- C:\Windows\System\nGwWFVc.exe
  C:\Windows\System\nGwWFVc.exe
  2⤵
  PID:5564
- C:\Windows\System\DaaBYBy.exe
  C:\Windows\System\DaaBYBy.exe
  2⤵
  PID:5580
- C:\Windows\System\kJzCAIk.exe
  C:\Windows\System\kJzCAIk.exe
  2⤵
  PID:5596
- C:\Windows\System\ijGTtWk.exe
  C:\Windows\System\ijGTtWk.exe
  2⤵
  PID:5612
- C:\Windows\System\NyzbFUK.exe
  C:\Windows\System\NyzbFUK.exe
  2⤵
  PID:5628
- C:\Windows\System\IsKsjbP.exe
  C:\Windows\System\IsKsjbP.exe
  2⤵
  PID:5644
- C:\Windows\System\QmhitiN.exe
  C:\Windows\System\QmhitiN.exe
  2⤵
  PID:5660
- C:\Windows\System\vZDUZTP.exe
  C:\Windows\System\vZDUZTP.exe
  2⤵
  PID:5676
- C:\Windows\System\UXktySs.exe
  C:\Windows\System\UXktySs.exe
  2⤵
  PID:5692
- C:\Windows\System\yYtFZyH.exe
  C:\Windows\System\yYtFZyH.exe
  2⤵
  PID:5708
- C:\Windows\System\WPqhjSZ.exe
  C:\Windows\System\WPqhjSZ.exe
  2⤵
  PID:5728
- C:\Windows\System\fBUpBeS.exe
  C:\Windows\System\fBUpBeS.exe
  2⤵
  PID:5744
- C:\Windows\System\gWYBNMD.exe
  C:\Windows\System\gWYBNMD.exe
  2⤵
  PID:5760
- C:\Windows\System\dCHeUqG.exe
  C:\Windows\System\dCHeUqG.exe
  2⤵
  PID:5776
- C:\Windows\System\SwWGCic.exe
  C:\Windows\System\SwWGCic.exe
  2⤵
  PID:5792
- C:\Windows\System\JlqsWOn.exe
  C:\Windows\System\JlqsWOn.exe
  2⤵
  PID:5808
- C:\Windows\System\iQPVVNN.exe
  C:\Windows\System\iQPVVNN.exe
  2⤵
  PID:5824
- C:\Windows\System\EdbFZvs.exe
  C:\Windows\System\EdbFZvs.exe
  2⤵
  PID:5840
- C:\Windows\System\jjOLhjm.exe
  C:\Windows\System\jjOLhjm.exe
  2⤵
  PID:5856
- C:\Windows\System\ePYBcav.exe
  C:\Windows\System\ePYBcav.exe
  2⤵
  PID:5872
- C:\Windows\System\BjDPSxb.exe
  C:\Windows\System\BjDPSxb.exe
  2⤵
  PID:5888
- C:\Windows\System\sQJKcqH.exe
  C:\Windows\System\sQJKcqH.exe
  2⤵
  PID:5904
- C:\Windows\System\sShcIku.exe
  C:\Windows\System\sShcIku.exe
  2⤵
  PID:5924
- C:\Windows\System\RYGBUKS.exe
  C:\Windows\System\RYGBUKS.exe
  2⤵
  PID:5940
- C:\Windows\System\QXwulGX.exe
  C:\Windows\System\QXwulGX.exe
  2⤵
  PID:5956
- C:\Windows\System\YDaFYjP.exe
  C:\Windows\System\YDaFYjP.exe
  2⤵
  PID:5972
- C:\Windows\System\sbaACNd.exe
  C:\Windows\System\sbaACNd.exe
  2⤵
  PID:5988
- C:\Windows\System\jsIyGcZ.exe
  C:\Windows\System\jsIyGcZ.exe
  2⤵
  PID:6004
- C:\Windows\System\zFNYZDe.exe
  C:\Windows\System\zFNYZDe.exe
  2⤵
  PID:6024
- C:\Windows\System\MkVAmdW.exe
  C:\Windows\System\MkVAmdW.exe
  2⤵
  PID:6040
- C:\Windows\System\NgCFuke.exe
  C:\Windows\System\NgCFuke.exe
  2⤵
  PID:6056
- C:\Windows\System\wWxtjes.exe
  C:\Windows\System\wWxtjes.exe
  2⤵
  PID:6072
- C:\Windows\System\tyCJXKC.exe
  C:\Windows\System\tyCJXKC.exe
  2⤵
  PID:6088
- C:\Windows\System\rbBIarq.exe
  C:\Windows\System\rbBIarq.exe
  2⤵
  PID:6104
- C:\Windows\System\JwLXxPs.exe
  C:\Windows\System\JwLXxPs.exe
  2⤵
  PID:6120
- C:\Windows\System\MzKunIY.exe
  C:\Windows\System\MzKunIY.exe
  2⤵
  PID:6136
- C:\Windows\System\cVCMfFT.exe
  C:\Windows\System\cVCMfFT.exe
  2⤵
  PID:5148
- C:\Windows\System\Qccxplb.exe
  C:\Windows\System\Qccxplb.exe
  2⤵
  PID:4224
- C:\Windows\System\rrwjdQS.exe
  C:\Windows\System\rrwjdQS.exe
  2⤵
  PID:4632
- C:\Windows\System\dXblDnP.exe
  C:\Windows\System\dXblDnP.exe
  2⤵
  PID:5132
- C:\Windows\System\cyRHNso.exe
  C:\Windows\System\cyRHNso.exe
  2⤵
  PID:5164
- C:\Windows\System\iFpVXDp.exe
  C:\Windows\System\iFpVXDp.exe
  2⤵
  PID:5236
- C:\Windows\System\aVWyYnN.exe
  C:\Windows\System\aVWyYnN.exe
  2⤵
  PID:5252
- C:\Windows\System\fXyDzTr.exe
  C:\Windows\System\fXyDzTr.exe
  2⤵
  PID:5304
- C:\Windows\System\isRFmwH.exe
  C:\Windows\System\isRFmwH.exe
  2⤵
  PID:5396
- C:\Windows\System\xlIOQtA.exe
  C:\Windows\System\xlIOQtA.exe
  2⤵
  PID:5460
- C:\Windows\System\EwHGeWA.exe
  C:\Windows\System\EwHGeWA.exe
  2⤵
  PID:5556
- C:\Windows\System\SemWayk.exe
  C:\Windows\System\SemWayk.exe
  2⤵
  PID:5592
- C:\Windows\System\BRlIWPF.exe
  C:\Windows\System\BRlIWPF.exe
  2⤵
  PID:5620
- C:\Windows\System\lpScgTG.exe
  C:\Windows\System\lpScgTG.exe
  2⤵
  PID:5684
- C:\Windows\System\UCJpidn.exe
  C:\Windows\System\UCJpidn.exe
  2⤵
  PID:5704
- C:\Windows\System\WPjCEKI.exe
  C:\Windows\System\WPjCEKI.exe
  2⤵
  PID:5572
- C:\Windows\System\bFAoTMp.exe
  C:\Windows\System\bFAoTMp.exe
  2⤵
  PID:5540
- C:\Windows\System\AzkwWui.exe
  C:\Windows\System\AzkwWui.exe
  2⤵
  PID:5448
- C:\Windows\System\XynvMyH.exe
  C:\Windows\System\XynvMyH.exe
  2⤵
  PID:5380
- C:\Windows\System\vRifWtE.exe
  C:\Windows\System\vRifWtE.exe
  2⤵
  PID:5756
- C:\Windows\System\FsEFVNE.exe
  C:\Windows\System\FsEFVNE.exe
  2⤵
  PID:5820
- C:\Windows\System\LPgOmvO.exe
  C:\Windows\System\LPgOmvO.exe
  2⤵
  PID:5772
- C:\Windows\System\xpTmYNl.exe
  C:\Windows\System\xpTmYNl.exe
  2⤵
  PID:5836
- C:\Windows\System\nhylngQ.exe
  C:\Windows\System\nhylngQ.exe
  2⤵
  PID:5920
- C:\Windows\System\VYNTvLs.exe
  C:\Windows\System\VYNTvLs.exe
  2⤵
  PID:5896
- C:\Windows\System\AsHAZcv.exe
  C:\Windows\System\AsHAZcv.exe
  2⤵
  PID:6020
- C:\Windows\System\qNXYSse.exe
  C:\Windows\System\qNXYSse.exe
  2⤵
  PID:6112
- C:\Windows\System\QNgOzGW.exe
  C:\Windows\System\QNgOzGW.exe
  2⤵
  PID:5800
- C:\Windows\System\sGtVzSm.exe
  C:\Windows\System\sGtVzSm.exe
  2⤵
  PID:6128
- C:\Windows\System\ZPVIHeU.exe
  C:\Windows\System\ZPVIHeU.exe
  2⤵
  PID:6068
- C:\Windows\System\pGRRlkW.exe
  C:\Windows\System\pGRRlkW.exe
  2⤵
  PID:5996
- C:\Windows\System\psfgnRt.exe
  C:\Windows\System\psfgnRt.exe
  2⤵
  PID:5192
- C:\Windows\System\evHCFjI.exe
  C:\Windows\System\evHCFjI.exe
  2⤵
  PID:4356
- C:\Windows\System\gytiofW.exe
  C:\Windows\System\gytiofW.exe
  2⤵
  PID:5268
- C:\Windows\System\yxDYxUW.exe
  C:\Windows\System\yxDYxUW.exe
  2⤵
  PID:5336
- C:\Windows\System\WLOrnpi.exe
  C:\Windows\System\WLOrnpi.exe
  2⤵
  PID:5300
- C:\Windows\System\bKYMXCy.exe
  C:\Windows\System\bKYMXCy.exe
  2⤵
  PID:5528
- C:\Windows\System\iKbjquW.exe
  C:\Windows\System\iKbjquW.exe
  2⤵
  PID:5348
- C:\Windows\System\wVzzyRo.exe
  C:\Windows\System\wVzzyRo.exe
  2⤵
  PID:5672
- C:\Windows\System\JCwfbnY.exe
  C:\Windows\System\JCwfbnY.exe
  2⤵
  PID:5608
- C:\Windows\System\UKlDQiz.exe
  C:\Windows\System\UKlDQiz.exe
  2⤵
  PID:5416
- C:\Windows\System\EbZPsmW.exe
  C:\Windows\System\EbZPsmW.exe
  2⤵
  PID:5740
- C:\Windows\System\ZpwIemm.exe
  C:\Windows\System\ZpwIemm.exe
  2⤵
  PID:5832
- C:\Windows\System\suDVcLy.exe
  C:\Windows\System\suDVcLy.exe
  2⤵
  PID:5916
- C:\Windows\System\UNHDLSB.exe
  C:\Windows\System\UNHDLSB.exe
  2⤵
  PID:6084
- C:\Windows\System\ROsewpV.exe
  C:\Windows\System\ROsewpV.exe
  2⤵
  PID:4904
- C:\Windows\System\eiFvJoR.exe
  C:\Windows\System\eiFvJoR.exe
  2⤵
  PID:6132
- C:\Windows\System\KtBgtvm.exe
  C:\Windows\System\KtBgtvm.exe
  2⤵
  PID:6000
- C:\Windows\System\fMuVfPx.exe
  C:\Windows\System\fMuVfPx.exe
  2⤵
  PID:4484
- C:\Windows\System\BlMgaxe.exe
  C:\Windows\System\BlMgaxe.exe
  2⤵
  PID:6096
- C:\Windows\System\kBphGZY.exe
  C:\Windows\System\kBphGZY.exe
  2⤵
  PID:5368
- C:\Windows\System\uMikNJf.exe
  C:\Windows\System\uMikNJf.exe
  2⤵
  PID:5428
- C:\Windows\System\jsHZTqA.exe
  C:\Windows\System\jsHZTqA.exe
  2⤵
  PID:5700
- C:\Windows\System\HwmvWnm.exe
  C:\Windows\System\HwmvWnm.exe
  2⤵
  PID:5640
- C:\Windows\System\XeLCuMt.exe
  C:\Windows\System\XeLCuMt.exe
  2⤵
  PID:5320
- C:\Windows\System\ijjsFjn.exe
  C:\Windows\System\ijjsFjn.exe
  2⤵
  PID:5912
- C:\Windows\System\QKyiGFj.exe
  C:\Windows\System\QKyiGFj.exe
  2⤵
  PID:5736
- C:\Windows\System\xVfccDf.exe
  C:\Windows\System\xVfccDf.exe
  2⤵
  PID:5952
- C:\Windows\System\lxotYOy.exe
  C:\Windows\System\lxotYOy.exe
  2⤵
  PID:5936
- C:\Windows\System\ElGSbaM.exe
  C:\Windows\System\ElGSbaM.exe
  2⤵
  PID:5964
- C:\Windows\System\oitUZZm.exe
  C:\Windows\System\oitUZZm.exe
  2⤵
  PID:5720
- C:\Windows\System\plOFayA.exe
  C:\Windows\System\plOFayA.exe
  2⤵
  PID:5492
- C:\Windows\System\IgtFJKT.exe
  C:\Windows\System\IgtFJKT.exe
  2⤵
  PID:5480
- C:\Windows\System\RWKJrRp.exe
  C:\Windows\System\RWKJrRp.exe
  2⤵
  PID:5544
- C:\Windows\System\rMDKanX.exe
  C:\Windows\System\rMDKanX.exe
  2⤵
  PID:6100
- C:\Windows\System\YugDKuI.exe
  C:\Windows\System\YugDKuI.exe
  2⤵
  PID:5316
- C:\Windows\System\oRQNxTt.exe
  C:\Windows\System\oRQNxTt.exe
  2⤵
  PID:5188
- C:\Windows\System\mPfmPkk.exe
  C:\Windows\System\mPfmPkk.exe
  2⤵
  PID:5852
- C:\Windows\System\QTdkwfr.exe
  C:\Windows\System\QTdkwfr.exe
  2⤵
  PID:5144
- C:\Windows\System\UNnHLTm.exe
  C:\Windows\System\UNnHLTm.exe
  2⤵
  PID:5524
- C:\Windows\System\cnVxbwQ.exe
  C:\Windows\System\cnVxbwQ.exe
  2⤵
  PID:6160
- C:\Windows\System\McecRRf.exe
  C:\Windows\System\McecRRf.exe
  2⤵
  PID:6176
- C:\Windows\System\dFcATbH.exe
  C:\Windows\System\dFcATbH.exe
  2⤵
  PID:6192
- C:\Windows\System\lwdyKHM.exe
  C:\Windows\System\lwdyKHM.exe
  2⤵
  PID:6208
- C:\Windows\System\AHAeZVD.exe
  C:\Windows\System\AHAeZVD.exe
  2⤵
  PID:6224
- C:\Windows\System\VlxsRoS.exe
  C:\Windows\System\VlxsRoS.exe
  2⤵
  PID:6240
- C:\Windows\System\TOamjdb.exe
  C:\Windows\System\TOamjdb.exe
  2⤵
  PID:6256
- C:\Windows\System\KCRiIXf.exe
  C:\Windows\System\KCRiIXf.exe
  2⤵
  PID:6272
- C:\Windows\System\BYtQxCA.exe
  C:\Windows\System\BYtQxCA.exe
  2⤵
  PID:6296
- C:\Windows\System\bCALXmv.exe
  C:\Windows\System\bCALXmv.exe
  2⤵
  PID:6312
- C:\Windows\System\OQwRzFA.exe
  C:\Windows\System\OQwRzFA.exe
  2⤵
  PID:6332
- C:\Windows\System\XfxKfBX.exe
  C:\Windows\System\XfxKfBX.exe
  2⤵
  PID:6348
- C:\Windows\System\TNoFekH.exe
  C:\Windows\System\TNoFekH.exe
  2⤵
  PID:6372
- C:\Windows\System\GciZZAf.exe
  C:\Windows\System\GciZZAf.exe
  2⤵
  PID:6388
- C:\Windows\System\Bneapsl.exe
  C:\Windows\System\Bneapsl.exe
  2⤵
  PID:6408
- C:\Windows\System\wrRTLCX.exe
  C:\Windows\System\wrRTLCX.exe
  2⤵
  PID:6424
- C:\Windows\System\cQaNtCU.exe
  C:\Windows\System\cQaNtCU.exe
  2⤵
  PID:6440
- C:\Windows\System\MMKMabU.exe
  C:\Windows\System\MMKMabU.exe
  2⤵
  PID:6480
- C:\Windows\System\yjsCkDE.exe
  C:\Windows\System\yjsCkDE.exe
  2⤵
  PID:6504
- C:\Windows\System\FrNKdAE.exe
  C:\Windows\System\FrNKdAE.exe
  2⤵
  PID:6520
- C:\Windows\System\jkJmKJS.exe
  C:\Windows\System\jkJmKJS.exe
  2⤵
  PID:6536
- C:\Windows\System\MRzQbwi.exe
  C:\Windows\System\MRzQbwi.exe
  2⤵
  PID:6552
- C:\Windows\System\ROawtVc.exe
  C:\Windows\System\ROawtVc.exe
  2⤵
  PID:6568
- C:\Windows\System\TFZaovh.exe
  C:\Windows\System\TFZaovh.exe
  2⤵
  PID:6612
- C:\Windows\System\GhPGEvP.exe
  C:\Windows\System\GhPGEvP.exe
  2⤵
  PID:6628
- C:\Windows\System\mFyJiVX.exe
  C:\Windows\System\mFyJiVX.exe
  2⤵
  PID:6652
- C:\Windows\System\jdUPflU.exe
  C:\Windows\System\jdUPflU.exe
  2⤵
  PID:6668
- C:\Windows\System\vrzEgpx.exe
  C:\Windows\System\vrzEgpx.exe
  2⤵
  PID:6688
- C:\Windows\System\pjrLUDH.exe
  C:\Windows\System\pjrLUDH.exe
  2⤵
  PID:6712
- C:\Windows\System\hbtbLCM.exe
  C:\Windows\System\hbtbLCM.exe
  2⤵
  PID:6748
- C:\Windows\System\EZLjgXp.exe
  C:\Windows\System\EZLjgXp.exe
  2⤵
  PID:6768
- C:\Windows\System\BotkQmk.exe
  C:\Windows\System\BotkQmk.exe
  2⤵
  PID:6784
- C:\Windows\System\uAkMPIK.exe
  C:\Windows\System\uAkMPIK.exe
  2⤵
  PID:6800
- C:\Windows\System\BJyYxFb.exe
  C:\Windows\System\BJyYxFb.exe
  2⤵
  PID:6816
- C:\Windows\System\rQCfOPi.exe
  C:\Windows\System\rQCfOPi.exe
  2⤵
  PID:6832
- C:\Windows\System\CvtVgqa.exe
  C:\Windows\System\CvtVgqa.exe
  2⤵
  PID:6848
- C:\Windows\System\xWBOCvK.exe
  C:\Windows\System\xWBOCvK.exe
  2⤵
  PID:6868
- C:\Windows\System\XRcUEKE.exe
  C:\Windows\System\XRcUEKE.exe
  2⤵
  PID:6884
- C:\Windows\System\UBNNnop.exe
  C:\Windows\System\UBNNnop.exe
  2⤵
  PID:6900
- C:\Windows\System\yTRZovo.exe
  C:\Windows\System\yTRZovo.exe
  2⤵
  PID:6916
- C:\Windows\System\sTtBKgI.exe
  C:\Windows\System\sTtBKgI.exe
  2⤵
  PID:6940
- C:\Windows\System\BNajBNx.exe
  C:\Windows\System\BNajBNx.exe
  2⤵
  PID:6956
- C:\Windows\System\zWmJxLJ.exe
  C:\Windows\System\zWmJxLJ.exe
  2⤵
  PID:6972
- C:\Windows\System\nFGPDIS.exe
  C:\Windows\System\nFGPDIS.exe
  2⤵
  PID:6988
- C:\Windows\System\akknQUA.exe
  C:\Windows\System\akknQUA.exe
  2⤵
  PID:7004
- C:\Windows\System\DOWterz.exe
  C:\Windows\System\DOWterz.exe
  2⤵
  PID:7020
- C:\Windows\System\PIdcwnu.exe
  C:\Windows\System\PIdcwnu.exe
  2⤵
  PID:7036
- C:\Windows\System\qPcylyA.exe
  C:\Windows\System\qPcylyA.exe
  2⤵
  PID:7056
- C:\Windows\System\ynYPEnD.exe
  C:\Windows\System\ynYPEnD.exe
  2⤵
  PID:7072
- C:\Windows\System\OqkjPCp.exe
  C:\Windows\System\OqkjPCp.exe
  2⤵
  PID:7088
- C:\Windows\System\FtzuNpv.exe
  C:\Windows\System\FtzuNpv.exe
  2⤵
  PID:7104
- C:\Windows\System\AVsUVlE.exe
  C:\Windows\System\AVsUVlE.exe
  2⤵
  PID:7120
- C:\Windows\System\mFmpNxX.exe
  C:\Windows\System\mFmpNxX.exe
  2⤵
  PID:7140
- C:\Windows\System\IlzMEiz.exe
  C:\Windows\System\IlzMEiz.exe
  2⤵
  PID:7156
- C:\Windows\System\EFzPnQe.exe
  C:\Windows\System\EFzPnQe.exe
  2⤵
  PID:6236
- C:\Windows\System\LbcvMwQ.exe
  C:\Windows\System\LbcvMwQ.exe
  2⤵
  PID:6284
- C:\Windows\System\vRQlTFB.exe
  C:\Windows\System\vRQlTFB.exe
  2⤵
  PID:6324
- C:\Windows\System\OwBwEQv.exe
  C:\Windows\System\OwBwEQv.exe
  2⤵
  PID:6328
- C:\Windows\System\SwMCbdN.exe
  C:\Windows\System\SwMCbdN.exe
  2⤵
  PID:6364
- C:\Windows\System\VOclqNe.exe
  C:\Windows\System\VOclqNe.exe
  2⤵
  PID:6400
- C:\Windows\System\erKkPXg.exe
  C:\Windows\System\erKkPXg.exe
  2⤵
  PID:6436
- C:\Windows\System\alGORJj.exe
  C:\Windows\System\alGORJj.exe
  2⤵
  PID:6452
- C:\Windows\System\qnbSffe.exe
  C:\Windows\System\qnbSffe.exe
  2⤵
  PID:6472
- C:\Windows\System\UypnNHB.exe
  C:\Windows\System\UypnNHB.exe
  2⤵
  PID:6456
- C:\Windows\System\GjRvpNx.exe
  C:\Windows\System\GjRvpNx.exe
  2⤵
  PID:6516
- C:\Windows\System\rnmeygo.exe
  C:\Windows\System\rnmeygo.exe
  2⤵
  PID:6576
- C:\Windows\System\tLfJBmp.exe
  C:\Windows\System\tLfJBmp.exe
  2⤵
  PID:6592
- C:\Windows\System\XiZOnOB.exe
  C:\Windows\System\XiZOnOB.exe
  2⤵
  PID:6660
- C:\Windows\System\gZEayYH.exe
  C:\Windows\System\gZEayYH.exe
  2⤵
  PID:6696
- C:\Windows\System\IYdMChQ.exe
  C:\Windows\System\IYdMChQ.exe
  2⤵
  PID:6644
- C:\Windows\System\xZSEwUq.exe
  C:\Windows\System\xZSEwUq.exe
  2⤵
  PID:6648
- C:\Windows\System\eUlWtDJ.exe
  C:\Windows\System\eUlWtDJ.exe
  2⤵
  PID:6728
- C:\Windows\System\tIxNppM.exe
  C:\Windows\System\tIxNppM.exe
  2⤵
  PID:6792
- C:\Windows\System\ywrwlua.exe
  C:\Windows\System\ywrwlua.exe
  2⤵
  PID:6808
- C:\Windows\System\FFNwxNa.exe
  C:\Windows\System\FFNwxNa.exe
  2⤵
  PID:6924
- C:\Windows\System\JnrpJdB.exe
  C:\Windows\System\JnrpJdB.exe
  2⤵
  PID:6880
- C:\Windows\System\vTYqsHh.exe
  C:\Windows\System\vTYqsHh.exe
  2⤵
  PID:6968
- C:\Windows\System\JgbtZBs.exe
  C:\Windows\System\JgbtZBs.exe
  2⤵
  PID:6984
- C:\Windows\System\RwbDLok.exe
  C:\Windows\System\RwbDLok.exe
  2⤵
  PID:7032
- C:\Windows\System\pQiVcRh.exe
  C:\Windows\System\pQiVcRh.exe
  2⤵
  PID:7096
- C:\Windows\System\XJVKkTm.exe
  C:\Windows\System\XJVKkTm.exe
  2⤵
  PID:7164
- C:\Windows\System\fqxWdzW.exe
  C:\Windows\System\fqxWdzW.exe
  2⤵
  PID:5984
- C:\Windows\System\OykjQdU.exe
  C:\Windows\System\OykjQdU.exe
  2⤵
  PID:6200
- C:\Windows\System\hBpgURm.exe
  C:\Windows\System\hBpgURm.exe
  2⤵
  PID:6232
- C:\Windows\System\BGKxOvT.exe
  C:\Windows\System\BGKxOvT.exe
  2⤵
  PID:6360
- C:\Windows\System\ohrQueY.exe
  C:\Windows\System\ohrQueY.exe
  2⤵
  PID:6308
- C:\Windows\System\xQtjeFu.exe
  C:\Windows\System\xQtjeFu.exe
  2⤵
  PID:6404
- C:\Windows\System\cUZNrCx.exe
  C:\Windows\System\cUZNrCx.exe
  2⤵
  PID:6460
- C:\Windows\System\uRuFFFS.exe
  C:\Windows\System\uRuFFFS.exe
  2⤵
  PID:6500
- C:\Windows\System\dRpyYCN.exe
  C:\Windows\System\dRpyYCN.exe
  2⤵
  PID:6604
- C:\Windows\System\cwmPnyU.exe
  C:\Windows\System\cwmPnyU.exe
  2⤵
  PID:6620
- C:\Windows\System\qzjJUdO.exe
  C:\Windows\System\qzjJUdO.exe
  2⤵
  PID:6764
- C:\Windows\System\DYjFjzA.exe
  C:\Windows\System\DYjFjzA.exe
  2⤵
  PID:6776
- C:\Windows\System\fLKykKt.exe
  C:\Windows\System\fLKykKt.exe
  2⤵
  PID:6560
- C:\Windows\System\WOhrtqt.exe
  C:\Windows\System\WOhrtqt.exe
  2⤵
  PID:6676
- C:\Windows\System\zEUQAhh.exe
  C:\Windows\System\zEUQAhh.exe
  2⤵
  PID:6796
- C:\Windows\System\QoijBim.exe
  C:\Windows\System\QoijBim.exe
  2⤵
  PID:6864
- C:\Windows\System\DAqNWlG.exe
  C:\Windows\System\DAqNWlG.exe
  2⤵
  PID:6896
- C:\Windows\System\WvcmcbI.exe
  C:\Windows\System\WvcmcbI.exe
  2⤵
  PID:6964
- C:\Windows\System\gPcLzwP.exe
  C:\Windows\System\gPcLzwP.exe
  2⤵
  PID:6876
- C:\Windows\System\WmtBdJu.exe
  C:\Windows\System\WmtBdJu.exe
  2⤵
  PID:7052
- C:\Windows\System\qNatSFB.exe
  C:\Windows\System\qNatSFB.exe
  2⤵
  PID:7132
- C:\Windows\System\WAOfcTK.exe
  C:\Windows\System\WAOfcTK.exe
  2⤵
  PID:7152
- C:\Windows\System\aJfimBW.exe
  C:\Windows\System\aJfimBW.exe
  2⤵
  PID:6016
- C:\Windows\System\GqFUifJ.exe
  C:\Windows\System\GqFUifJ.exe
  2⤵
  PID:6292
- C:\Windows\System\hpsKBBw.exe
  C:\Windows\System\hpsKBBw.exe
  2⤵
  PID:6492
- C:\Windows\System\shHrlPE.exe
  C:\Windows\System\shHrlPE.exe
  2⤵
  PID:6248
- C:\Windows\System\EkOOMQC.exe
  C:\Windows\System\EkOOMQC.exe
  2⤵
  PID:6744
- C:\Windows\System\eCosOrU.exe
  C:\Windows\System\eCosOrU.exe
  2⤵
  PID:6684
- C:\Windows\System\vsMZSMJ.exe
  C:\Windows\System\vsMZSMJ.exe
  2⤵
  PID:6596
- C:\Windows\System\ZkVrwKV.exe
  C:\Windows\System\ZkVrwKV.exe
  2⤵
  PID:6860
- C:\Windows\System\AXqcJvA.exe
  C:\Windows\System\AXqcJvA.exe
  2⤵
  PID:6844
- C:\Windows\System\QMKNghs.exe
  C:\Windows\System\QMKNghs.exe
  2⤵
  PID:6996
- C:\Windows\System\gYhxujV.exe
  C:\Windows\System\gYhxujV.exe
  2⤵
  PID:7116
- C:\Windows\System\xiiIlRG.exe
  C:\Windows\System\xiiIlRG.exe
  2⤵
  PID:7080
- C:\Windows\System\wJAgbhq.exe
  C:\Windows\System\wJAgbhq.exe
  2⤵
  PID:7100
- C:\Windows\System\RRadXOA.exe
  C:\Windows\System\RRadXOA.exe
  2⤵
  PID:6396
- C:\Windows\System\XuRdTIQ.exe
  C:\Windows\System\XuRdTIQ.exe
  2⤵
  PID:6584
- C:\Windows\System\ezQCkpD.exe
  C:\Windows\System\ezQCkpD.exe
  2⤵
  PID:6828
- C:\Windows\System\QTCIsxT.exe
  C:\Windows\System\QTCIsxT.exe
  2⤵
  PID:6948
- C:\Windows\System\ZcLTObK.exe
  C:\Windows\System\ZcLTObK.exe
  2⤵
  PID:6168
- C:\Windows\System\SGuHYEy.exe
  C:\Windows\System\SGuHYEy.exe
  2⤵
  PID:6720
- C:\Windows\System\sKuBSBZ.exe
  C:\Windows\System\sKuBSBZ.exe
  2⤵
  PID:6936
- C:\Windows\System\jeSCWRs.exe
  C:\Windows\System\jeSCWRs.exe
  2⤵
  PID:6532
- C:\Windows\System\mTKPeYU.exe
  C:\Windows\System\mTKPeYU.exe
  2⤵
  PID:6528
- C:\Windows\System\nUnoFZB.exe
  C:\Windows\System\nUnoFZB.exe
  2⤵
  PID:7136
- C:\Windows\System\NypDCkS.exe
  C:\Windows\System\NypDCkS.exe
  2⤵
  PID:6708
- C:\Windows\System\JcwFoVj.exe
  C:\Windows\System\JcwFoVj.exe
  2⤵
  PID:7016
- C:\Windows\System\PUZXgUl.exe
  C:\Windows\System\PUZXgUl.exe
  2⤵
  PID:7180
- C:\Windows\System\LmwrbsR.exe
  C:\Windows\System\LmwrbsR.exe
  2⤵
  PID:7196
- C:\Windows\System\sXchgoj.exe
  C:\Windows\System\sXchgoj.exe
  2⤵
  PID:7212
- C:\Windows\System\avHiUSS.exe
  C:\Windows\System\avHiUSS.exe
  2⤵
  PID:7228
- C:\Windows\System\zrbGfRz.exe
  C:\Windows\System\zrbGfRz.exe
  2⤵
  PID:7248
- C:\Windows\System\uQZPcOg.exe
  C:\Windows\System\uQZPcOg.exe
  2⤵
  PID:7264
- C:\Windows\System\yQIiorp.exe
  C:\Windows\System\yQIiorp.exe
  2⤵
  PID:7284
- C:\Windows\System\ibdhoxD.exe
  C:\Windows\System\ibdhoxD.exe
  2⤵
  PID:7684
- C:\Windows\System\VNJILQC.exe
  C:\Windows\System\VNJILQC.exe
  2⤵
  PID:7776
- C:\Windows\System\jRtVHIO.exe
  C:\Windows\System\jRtVHIO.exe
  2⤵
  PID:7800
- C:\Windows\System\TPiBElS.exe
  C:\Windows\System\TPiBElS.exe
  2⤵
  PID:7816
- C:\Windows\System\kZxYliA.exe
  C:\Windows\System\kZxYliA.exe
  2⤵
  PID:7836
- C:\Windows\System\qAagtTb.exe
  C:\Windows\System\qAagtTb.exe
  2⤵
  PID:7856
- C:\Windows\System\LChbMOv.exe
  C:\Windows\System\LChbMOv.exe
  2⤵
  PID:7880
- C:\Windows\System\EpbYKVD.exe
  C:\Windows\System\EpbYKVD.exe
  2⤵
  PID:7900
- C:\Windows\System\BbxisGv.exe
  C:\Windows\System\BbxisGv.exe
  2⤵
  PID:7932
- C:\Windows\System\ZrSCoCf.exe
  C:\Windows\System\ZrSCoCf.exe
  2⤵
  PID:7964
- C:\Windows\System\ADjknkb.exe
  C:\Windows\System\ADjknkb.exe
  2⤵
  PID:7984
- C:\Windows\System\yjsmJvl.exe
  C:\Windows\System\yjsmJvl.exe
  2⤵
  PID:8004
- C:\Windows\System\uGhqsQB.exe
  C:\Windows\System\uGhqsQB.exe
  2⤵
  PID:8020
- C:\Windows\System\hDdDdOd.exe
  C:\Windows\System\hDdDdOd.exe
  2⤵
  PID:8036
- C:\Windows\System\DfrlJSw.exe
  C:\Windows\System\DfrlJSw.exe
  2⤵
  PID:8056
- C:\Windows\System\aOragCq.exe
  C:\Windows\System\aOragCq.exe
  2⤵
  PID:8072
- C:\Windows\System\tEVDXNH.exe
  C:\Windows\System\tEVDXNH.exe
  2⤵
  PID:8088
- C:\Windows\System\uGSfPvg.exe
  C:\Windows\System\uGSfPvg.exe
  2⤵
  PID:8104
- C:\Windows\System\xMFvOsU.exe
  C:\Windows\System\xMFvOsU.exe
  2⤵
  PID:8120
- C:\Windows\System\ksopheB.exe
  C:\Windows\System\ksopheB.exe
  2⤵
  PID:8136
- C:\Windows\System\QHHjgRW.exe
  C:\Windows\System\QHHjgRW.exe
  2⤵
  PID:8156
- C:\Windows\System\FENkJAT.exe
  C:\Windows\System\FENkJAT.exe
  2⤵
  PID:8176
- C:\Windows\System\NJHryaA.exe
  C:\Windows\System\NJHryaA.exe
  2⤵
  PID:7172
- C:\Windows\System\OjqeBVN.exe
  C:\Windows\System\OjqeBVN.exe
  2⤵
  PID:7204
- C:\Windows\System\CMfdmTs.exe
  C:\Windows\System\CMfdmTs.exe
  2⤵
  PID:7188
- C:\Windows\System\tZFkdTt.exe
  C:\Windows\System\tZFkdTt.exe
  2⤵
  PID:7244
- C:\Windows\System\SWyrXly.exe
  C:\Windows\System\SWyrXly.exe
  2⤵
  PID:7260
- C:\Windows\System\BfWndvB.exe
  C:\Windows\System\BfWndvB.exe
  2⤵
  PID:7304
- C:\Windows\System\dxOyuyl.exe
  C:\Windows\System\dxOyuyl.exe
  2⤵
  PID:7324
- C:\Windows\System\WgfvEoT.exe
  C:\Windows\System\WgfvEoT.exe
  2⤵
  PID:7344
- C:\Windows\System\oSxRlXk.exe
  C:\Windows\System\oSxRlXk.exe
  2⤵
  PID:7360
- C:\Windows\System\lOtNgEf.exe
  C:\Windows\System\lOtNgEf.exe
  2⤵
  PID:7368
- C:\Windows\System\yZSialn.exe
  C:\Windows\System\yZSialn.exe
  2⤵
  PID:7388
- C:\Windows\System\sdGyGVI.exe
  C:\Windows\System\sdGyGVI.exe
  2⤵
  PID:7404
- C:\Windows\System\GDiJJFg.exe
  C:\Windows\System\GDiJJFg.exe
  2⤵
  PID:7420
- C:\Windows\System\YVEbXeR.exe
  C:\Windows\System\YVEbXeR.exe
  2⤵
  PID:7440
- C:\Windows\System\JylVpKf.exe
  C:\Windows\System\JylVpKf.exe
  2⤵
  PID:7460
- C:\Windows\System\bXsezck.exe
  C:\Windows\System\bXsezck.exe
  2⤵
  PID:7476
- C:\Windows\System\LIOajoi.exe
  C:\Windows\System\LIOajoi.exe
  2⤵
  PID:7492
- C:\Windows\System\UaIzUyU.exe
  C:\Windows\System\UaIzUyU.exe
  2⤵
  PID:7512
- C:\Windows\System\TIEcjwT.exe
  C:\Windows\System\TIEcjwT.exe
  2⤵
  PID:7528
- C:\Windows\System\ePphRKQ.exe
  C:\Windows\System\ePphRKQ.exe
  2⤵
  PID:7540
- C:\Windows\System\wNkokNB.exe
  C:\Windows\System\wNkokNB.exe
  2⤵
  PID:7564
- C:\Windows\System\JfwcnlX.exe
  C:\Windows\System\JfwcnlX.exe
  2⤵
  PID:7576
- C:\Windows\System\azPwDWd.exe
  C:\Windows\System\azPwDWd.exe
  2⤵
  PID:7592
- C:\Windows\System\CDkaEzS.exe
  C:\Windows\System\CDkaEzS.exe
  2⤵
  PID:7608
- C:\Windows\System\qcMcgKw.exe
  C:\Windows\System\qcMcgKw.exe
  2⤵
  PID:7624
- C:\Windows\System\agvRxuR.exe
  C:\Windows\System\agvRxuR.exe
  2⤵
  PID:7640
- C:\Windows\System\VMFThNM.exe
  C:\Windows\System\VMFThNM.exe
  2⤵
  PID:7652
- C:\Windows\System\yXvMcIp.exe
  C:\Windows\System\yXvMcIp.exe
  2⤵
  PID:7668
- C:\Windows\System\DeerXUx.exe
  C:\Windows\System\DeerXUx.exe
  2⤵
  PID:7692
- C:\Windows\System\KtJmmNI.exe
  C:\Windows\System\KtJmmNI.exe
  2⤵
  PID:7716
- C:\Windows\System\fVGsuJE.exe
  C:\Windows\System\fVGsuJE.exe
  2⤵
  PID:7736
- C:\Windows\System\IPyhoJJ.exe
  C:\Windows\System\IPyhoJJ.exe
  2⤵
  PID:7752
- C:\Windows\System\GQUIbEG.exe
  C:\Windows\System\GQUIbEG.exe
  2⤵
  PID:7772
- C:\Windows\System\aJMUQSG.exe
  C:\Windows\System\aJMUQSG.exe
  2⤵
  PID:7828
- C:\Windows\System\ZIMWUvX.exe
  C:\Windows\System\ZIMWUvX.exe
  2⤵
  PID:7788
- C:\Windows\System\sVOtcTP.exe
  C:\Windows\System\sVOtcTP.exe
  2⤵
  PID:7864
- C:\Windows\System\tTgJolA.exe
  C:\Windows\System\tTgJolA.exe
  2⤵
  PID:7908
- C:\Windows\System\LjxjBBW.exe
  C:\Windows\System\LjxjBBW.exe
  2⤵
  PID:7928
- C:\Windows\System\DfYitXo.exe
  C:\Windows\System\DfYitXo.exe
  2⤵
  PID:7940
- C:\Windows\System\jbQfkLM.exe
  C:\Windows\System\jbQfkLM.exe
  2⤵
  PID:7992
- C:\Windows\System\ceqfsCS.exe
  C:\Windows\System\ceqfsCS.exe
  2⤵
  PID:8064
- C:\Windows\System\cGtggMI.exe
  C:\Windows\System\cGtggMI.exe
  2⤵
  PID:8100
- C:\Windows\System\CfuVNLj.exe
  C:\Windows\System\CfuVNLj.exe
  2⤵
  PID:7976
- C:\Windows\System\MaeZfSb.exe
  C:\Windows\System\MaeZfSb.exe
  2⤵
  PID:8164
- C:\Windows\System\ClKOMLv.exe
  C:\Windows\System\ClKOMLv.exe
  2⤵
  PID:8144
- C:\Windows\System\ByHJovh.exe
  C:\Windows\System\ByHJovh.exe
  2⤵
  PID:6756
- C:\Windows\System\gHBriQz.exe
  C:\Windows\System\gHBriQz.exe
  2⤵
  PID:7300
- C:\Windows\System\KFPSqke.exe
  C:\Windows\System\KFPSqke.exe
  2⤵
  PID:8188
- C:\Windows\System\QobccKJ.exe
  C:\Windows\System\QobccKJ.exe
  2⤵
  PID:7208
- C:\Windows\System\sVBOwMW.exe
  C:\Windows\System\sVBOwMW.exe
  2⤵
  PID:7468
- C:\Windows\System\lSMNdOr.exe
  C:\Windows\System\lSMNdOr.exe
  2⤵
  PID:7536
- C:\Windows\System\TnPvqBy.exe
  C:\Windows\System\TnPvqBy.exe
  2⤵
  PID:7276
- C:\Windows\System\mwnHkOC.exe
  C:\Windows\System\mwnHkOC.exe
  2⤵
  PID:7524
- C:\Windows\System\txtXXvW.exe
  C:\Windows\System\txtXXvW.exe
  2⤵
  PID:7588
- C:\Windows\System\wtiZaDQ.exe
  C:\Windows\System\wtiZaDQ.exe
  2⤵
  PID:7484
- C:\Windows\System\LnPmMej.exe
  C:\Windows\System\LnPmMej.exe
  2⤵
  PID:7412
- C:\Windows\System\qWQqfFU.exe
  C:\Windows\System\qWQqfFU.exe
  2⤵
  PID:7348
- C:\Windows\System\YKvNAgO.exe
  C:\Windows\System\YKvNAgO.exe
  2⤵
  PID:7620
- C:\Windows\System\uymvhaP.exe
  C:\Windows\System\uymvhaP.exe
  2⤵
  PID:7656
- C:\Windows\System\KUjCbTR.exe
  C:\Windows\System\KUjCbTR.exe
  2⤵
  PID:7700
- C:\Windows\System\fOdpnoQ.exe
  C:\Windows\System\fOdpnoQ.exe
  2⤵
  PID:7744
- C:\Windows\System\vBzgsCm.exe
  C:\Windows\System\vBzgsCm.exe
  2⤵
  PID:7808
- C:\Windows\System\LlQVPqs.exe
  C:\Windows\System\LlQVPqs.exe
  2⤵
  PID:7760
- C:\Windows\System\ekxzTba.exe
  C:\Windows\System\ekxzTba.exe
  2⤵
  PID:7764
- C:\Windows\System\nDoCLYy.exe
  C:\Windows\System\nDoCLYy.exe
  2⤵
  PID:7792
- C:\Windows\System\YbJeVaV.exe
  C:\Windows\System\YbJeVaV.exe
  2⤵
  PID:7956
- C:\Windows\System\nmHUCde.exe
  C:\Windows\System\nmHUCde.exe
  2⤵
  PID:8044
- C:\Windows\System\NgULWYz.exe
  C:\Windows\System\NgULWYz.exe
  2⤵
  PID:6932
- C:\Windows\System\GAgkUDW.exe
  C:\Windows\System\GAgkUDW.exe
  2⤵
  PID:8172
- C:\Windows\System\AEOeLpU.exe
  C:\Windows\System\AEOeLpU.exe
  2⤵
  PID:8028
- C:\Windows\System\WfzsRmT.exe
  C:\Windows\System\WfzsRmT.exe
  2⤵
  PID:7568
- C:\Windows\System\GGDGPhQ.exe
  C:\Windows\System\GGDGPhQ.exe
  2⤵
  PID:7280
- C:\Windows\System\GcQiGxi.exe
  C:\Windows\System\GcQiGxi.exe
  2⤵
  PID:7316
- C:\Windows\System\iMfTbNF.exe
  C:\Windows\System\iMfTbNF.exe
  2⤵
  PID:7648
- C:\Windows\System\uauLnkm.exe
  C:\Windows\System\uauLnkm.exe
  2⤵
  PID:7372
- C:\Windows\System\adHSVSz.exe
  C:\Windows\System\adHSVSz.exe
  2⤵
  PID:7768
- C:\Windows\System\uxaAETZ.exe
  C:\Windows\System\uxaAETZ.exe
  2⤵
  PID:8084
- C:\Windows\System\bjDKvYl.exe
  C:\Windows\System\bjDKvYl.exe
  2⤵
  PID:7504
- C:\Windows\System\FEWktcY.exe
  C:\Windows\System\FEWktcY.exe
  2⤵
  PID:7632
- C:\Windows\System\aTuAcmd.exe
  C:\Windows\System\aTuAcmd.exe
  2⤵
  PID:7296
- C:\Windows\System\jZkuWbC.exe
  C:\Windows\System\jZkuWbC.exe
  2⤵
  PID:7456
- C:\Windows\System\ZwSWozU.exe
  C:\Windows\System\ZwSWozU.exe
  2⤵
  PID:7712
- C:\Windows\System\MaHynEA.exe
  C:\Windows\System\MaHynEA.exe
  2⤵
  PID:7920
- C:\Windows\System\MDcEwSH.exe
  C:\Windows\System\MDcEwSH.exe
  2⤵
  PID:7824
- C:\Windows\System\dVtShgt.exe
  C:\Windows\System\dVtShgt.exe
  2⤵
  PID:7240
- C:\Windows\System\gxwfOfa.exe
  C:\Windows\System\gxwfOfa.exe
  2⤵
  PID:7892
- C:\Windows\System\FVUIUgN.exe
  C:\Windows\System\FVUIUgN.exe
  2⤵
  PID:8048
- C:\Windows\System\kJaLAGA.exe
  C:\Windows\System\kJaLAGA.exe
  2⤵
  PID:7996
- C:\Windows\System\pAEdOnr.exe
  C:\Windows\System\pAEdOnr.exe
  2⤵
  PID:7428
- C:\Windows\System\cUpkedP.exe
  C:\Windows\System\cUpkedP.exe
  2⤵
  PID:2948
- C:\Windows\System\VWpAgAk.exe
  C:\Windows\System\VWpAgAk.exe
  2⤵
  PID:7796
- C:\Windows\System\IoEOuYv.exe
  C:\Windows\System\IoEOuYv.exe
  2⤵
  PID:7384
- C:\Windows\System\liNSqqp.exe
  C:\Windows\System\liNSqqp.exe
  2⤵
  PID:8080
- C:\Windows\System\woQNsYC.exe
  C:\Windows\System\woQNsYC.exe
  2⤵
  PID:7508
- C:\Windows\System\VTpSprX.exe
  C:\Windows\System\VTpSprX.exe
  2⤵
  PID:8152
- C:\Windows\System\zmXASRW.exe
  C:\Windows\System\zmXASRW.exe
  2⤵
  PID:7352
- C:\Windows\System\OueeWip.exe
  C:\Windows\System\OueeWip.exe
  2⤵
  PID:7784
- C:\Windows\System\Iunmqlz.exe
  C:\Windows\System\Iunmqlz.exe
  2⤵
  PID:8200
- C:\Windows\System\ZcckmoT.exe
  C:\Windows\System\ZcckmoT.exe
  2⤵
  PID:8216
- C:\Windows\System\dobtiZo.exe
  C:\Windows\System\dobtiZo.exe
  2⤵
  PID:8236
- C:\Windows\System\NcIOpTi.exe
  C:\Windows\System\NcIOpTi.exe
  2⤵
  PID:8256
- C:\Windows\System\lRezEBN.exe
  C:\Windows\System\lRezEBN.exe
  2⤵
  PID:8272
- C:\Windows\System\iKEjGWG.exe
  C:\Windows\System\iKEjGWG.exe
  2⤵
  PID:8292
- C:\Windows\System\kTQwRei.exe
  C:\Windows\System\kTQwRei.exe
  2⤵
  PID:8308
- C:\Windows\System\uUEmagU.exe
  C:\Windows\System\uUEmagU.exe
  2⤵
  PID:8324
- C:\Windows\System\YfAGPiF.exe
  C:\Windows\System\YfAGPiF.exe
  2⤵
  PID:8340
- C:\Windows\System\ZogHrMV.exe
  C:\Windows\System\ZogHrMV.exe
  2⤵
  PID:8356
- C:\Windows\System\URYcwXr.exe
  C:\Windows\System\URYcwXr.exe
  2⤵
  PID:8372
- C:\Windows\System\OINYBTA.exe
  C:\Windows\System\OINYBTA.exe
  2⤵
  PID:8400
- C:\Windows\System\bSSGbBv.exe
  C:\Windows\System\bSSGbBv.exe
  2⤵
  PID:8424
- C:\Windows\System\aUIWOff.exe
  C:\Windows\System\aUIWOff.exe
  2⤵
  PID:8440
- C:\Windows\System\XhCITqd.exe
  C:\Windows\System\XhCITqd.exe
  2⤵
  PID:8460
- C:\Windows\System\OsCLhYi.exe
  C:\Windows\System\OsCLhYi.exe
  2⤵
  PID:8476
- C:\Windows\System\WBGrOfq.exe
  C:\Windows\System\WBGrOfq.exe
  2⤵
  PID:8492
- C:\Windows\System\hvjCfyy.exe
  C:\Windows\System\hvjCfyy.exe
  2⤵
  PID:8508
- C:\Windows\System\gzILiuv.exe
  C:\Windows\System\gzILiuv.exe
  2⤵
  PID:8524
- C:\Windows\System\eDOqCOt.exe
  C:\Windows\System\eDOqCOt.exe
  2⤵
  PID:8540
- C:\Windows\System\donPcPV.exe
  C:\Windows\System\donPcPV.exe
  2⤵
  PID:8556
- C:\Windows\System\gYfnpsf.exe
  C:\Windows\System\gYfnpsf.exe
  2⤵
  PID:8572
- C:\Windows\System\CqIkGjC.exe
  C:\Windows\System\CqIkGjC.exe
  2⤵
  PID:8588
- C:\Windows\System\oKmkakq.exe
  C:\Windows\System\oKmkakq.exe
  2⤵
  PID:8604
- C:\Windows\System\gimZtYu.exe
  C:\Windows\System\gimZtYu.exe
  2⤵
  PID:8620
- C:\Windows\System\ysAJdbz.exe
  C:\Windows\System\ysAJdbz.exe
  2⤵
  PID:8636
- C:\Windows\System\dzXkRnQ.exe
  C:\Windows\System\dzXkRnQ.exe
  2⤵
  PID:8652
- C:\Windows\System\arbSwwc.exe
  C:\Windows\System\arbSwwc.exe
  2⤵
  PID:8668
- C:\Windows\System\DPfeMIJ.exe
  C:\Windows\System\DPfeMIJ.exe
  2⤵
  PID:8684
- C:\Windows\System\znFsSxO.exe
  C:\Windows\System\znFsSxO.exe
  2⤵
  PID:8700
- C:\Windows\System\IykyBGd.exe
  C:\Windows\System\IykyBGd.exe
  2⤵
  PID:8720
- C:\Windows\System\gPajNmj.exe
  C:\Windows\System\gPajNmj.exe
  2⤵
  PID:8736
- C:\Windows\System\nOexpLL.exe
  C:\Windows\System\nOexpLL.exe
  2⤵
  PID:8756
- C:\Windows\System\ZZEGndG.exe
  C:\Windows\System\ZZEGndG.exe
  2⤵
  PID:8776
- C:\Windows\System\aTQcVbb.exe
  C:\Windows\System\aTQcVbb.exe
  2⤵
  PID:8792
- C:\Windows\System\lskWQez.exe
  C:\Windows\System\lskWQez.exe
  2⤵
  PID:8808
- C:\Windows\System\yiKKiPd.exe
  C:\Windows\System\yiKKiPd.exe
  2⤵
  PID:8824
- C:\Windows\System\OIemnfC.exe
  C:\Windows\System\OIemnfC.exe
  2⤵
  PID:8848
- C:\Windows\System\tYPFpCW.exe
  C:\Windows\System\tYPFpCW.exe
  2⤵
  PID:8864
- C:\Windows\System\PLEucpv.exe
  C:\Windows\System\PLEucpv.exe
  2⤵
  PID:8880
- C:\Windows\System\xQEyzkA.exe
  C:\Windows\System\xQEyzkA.exe
  2⤵
  PID:8896
- C:\Windows\System\hvWauLQ.exe
  C:\Windows\System\hvWauLQ.exe
  2⤵
  PID:8912
- C:\Windows\System\DDJUpfE.exe
  C:\Windows\System\DDJUpfE.exe
  2⤵
  PID:8928
- C:\Windows\System\eCdkzlv.exe
  C:\Windows\System\eCdkzlv.exe
  2⤵
  PID:8944
- C:\Windows\System\ziZqcBk.exe
  C:\Windows\System\ziZqcBk.exe
  2⤵
  PID:8964
- C:\Windows\System\eUWfxEH.exe
  C:\Windows\System\eUWfxEH.exe
  2⤵
  PID:8984
- C:\Windows\System\yiTiYdf.exe
  C:\Windows\System\yiTiYdf.exe
  2⤵
  PID:9012
- C:\Windows\System\qbMzaeU.exe
  C:\Windows\System\qbMzaeU.exe
  2⤵
  PID:9028
- C:\Windows\System\zcaqcFt.exe
  C:\Windows\System\zcaqcFt.exe
  2⤵
  PID:9048
- C:\Windows\System\OJbSFfw.exe
  C:\Windows\System\OJbSFfw.exe
  2⤵
  PID:9064
- C:\Windows\System\BbstMJg.exe
  C:\Windows\System\BbstMJg.exe
  2⤵
  PID:9080
- C:\Windows\System\cwChasD.exe
  C:\Windows\System\cwChasD.exe
  2⤵
  PID:9096
- C:\Windows\System\DZcLXkN.exe
  C:\Windows\System\DZcLXkN.exe
  2⤵
  PID:9120
- C:\Windows\System\KRDxEXJ.exe
  C:\Windows\System\KRDxEXJ.exe
  2⤵
  PID:9136
- C:\Windows\System\UuiDRKb.exe
  C:\Windows\System\UuiDRKb.exe
  2⤵
  PID:9152
- C:\Windows\System\jEkVqjg.exe
  C:\Windows\System\jEkVqjg.exe
  2⤵
  PID:9172
- C:\Windows\System\TYZsqRC.exe
  C:\Windows\System\TYZsqRC.exe
  2⤵
  PID:9188
- C:\Windows\System\ZdNLoKr.exe
  C:\Windows\System\ZdNLoKr.exe
  2⤵
  PID:9204
- C:\Windows\System\hRtfroA.exe
  C:\Windows\System\hRtfroA.exe
  2⤵
  PID:7312
- C:\Windows\System\aEOmhpG.exe
  C:\Windows\System\aEOmhpG.exe
  2⤵
  PID:8228
- C:\Windows\System\pZcmcun.exe
  C:\Windows\System\pZcmcun.exe
  2⤵
  PID:8280
- C:\Windows\System\FIXxMGw.exe
  C:\Windows\System\FIXxMGw.exe
  2⤵
  PID:8244
- C:\Windows\System\IoAnzdA.exe
  C:\Windows\System\IoAnzdA.exe
  2⤵
  PID:7336
- C:\Windows\System\hYkyDbL.exe
  C:\Windows\System\hYkyDbL.exe
  2⤵
  PID:8288
- C:\Windows\System\UHHgTpV.exe
  C:\Windows\System\UHHgTpV.exe
  2⤵
  PID:8316
- C:\Windows\System\gqZNOYA.exe
  C:\Windows\System\gqZNOYA.exe
  2⤵
  PID:8412
- C:\Windows\System\thZLCiA.exe
  C:\Windows\System\thZLCiA.exe
  2⤵
  PID:8436
- C:\Windows\System\eIuUVCS.exe
  C:\Windows\System\eIuUVCS.exe
  2⤵
  PID:8384
- C:\Windows\System\rIktlkm.exe
  C:\Windows\System\rIktlkm.exe
  2⤵
  PID:8432
- C:\Windows\System\GNvjWxy.exe
  C:\Windows\System\GNvjWxy.exe
  2⤵
  PID:8488
- C:\Windows\System\cJTAhyc.exe
  C:\Windows\System\cJTAhyc.exe
  2⤵
  PID:8548
- C:\Windows\System\voGzVOb.exe
  C:\Windows\System\voGzVOb.exe
  2⤵
  PID:8584
- C:\Windows\System\irORSGC.exe
  C:\Windows\System\irORSGC.exe
  2⤵
  PID:8644
- C:\Windows\System\IHOoDID.exe
  C:\Windows\System\IHOoDID.exe
  2⤵
  PID:8568
- C:\Windows\System\GxjtPzJ.exe
  C:\Windows\System\GxjtPzJ.exe
  2⤵
  PID:8596
- C:\Windows\System\rjvNidJ.exe
  C:\Windows\System\rjvNidJ.exe
  2⤵
  PID:8632
- C:\Windows\System\MbByOCP.exe
  C:\Windows\System\MbByOCP.exe
  2⤵
  PID:8716
- C:\Windows\System\aIFiaIH.exe
  C:\Windows\System\aIFiaIH.exe
  2⤵
  PID:8732
- C:\Windows\System\nPtiryy.exe
  C:\Windows\System\nPtiryy.exe
  2⤵
  PID:8788
- C:\Windows\System\DEinQOS.exe
  C:\Windows\System\DEinQOS.exe
  2⤵
  PID:8856
- C:\Windows\System\tvCtnsf.exe
  C:\Windows\System\tvCtnsf.exe
  2⤵
  PID:8920
- C:\Windows\System\kJLVQhf.exe
  C:\Windows\System\kJLVQhf.exe
  2⤵
  PID:8952
- C:\Windows\System\FETtrTg.exe
  C:\Windows\System\FETtrTg.exe
  2⤵
  PID:8876
- C:\Windows\System\gykpHWo.exe
  C:\Windows\System\gykpHWo.exe
  2⤵
  PID:8936
- C:\Windows\System\fApIRmm.exe
  C:\Windows\System\fApIRmm.exe
  2⤵
  PID:8972
- C:\Windows\System\mXSOGeA.exe
  C:\Windows\System\mXSOGeA.exe
  2⤵
  PID:8992
- C:\Windows\System\iFPTEqN.exe
  C:\Windows\System\iFPTEqN.exe
  2⤵
  PID:8980
- C:\Windows\System\XzBgiFq.exe
  C:\Windows\System\XzBgiFq.exe
  2⤵
  PID:9020
- C:\Windows\System\CVgktYX.exe
  C:\Windows\System\CVgktYX.exe
  2⤵
  PID:9076
- C:\Windows\System\qQrZCvF.exe
  C:\Windows\System\qQrZCvF.exe
  2⤵
  PID:9056
- C:\Windows\System\fnlgEuK.exe
  C:\Windows\System\fnlgEuK.exe
  2⤵
  PID:9116
- C:\Windows\System\fLTEFNZ.exe
  C:\Windows\System\fLTEFNZ.exe
  2⤵
  PID:9132
- C:\Windows\System\yvHKTGT.exe
  C:\Windows\System\yvHKTGT.exe
  2⤵
  PID:8264
- C:\Windows\System\ZoQWpIg.exe
  C:\Windows\System\ZoQWpIg.exe
  2⤵
  PID:8336
- C:\Windows\System\HsmlWjW.exe
  C:\Windows\System\HsmlWjW.exe
  2⤵
  PID:9128
- C:\Windows\System\ZMZTATa.exe
  C:\Windows\System\ZMZTATa.exe
  2⤵
  PID:8224
- C:\Windows\System\gwWRwSt.exe
  C:\Windows\System\gwWRwSt.exe
  2⤵
  PID:8448
- C:\Windows\System\atlxFwd.exe
  C:\Windows\System\atlxFwd.exe
  2⤵
  PID:8348
- C:\Windows\System\qQETmam.exe
  C:\Windows\System\qQETmam.exe
  2⤵
  PID:8304
- C:\Windows\System\xbMcEuh.exe
  C:\Windows\System\xbMcEuh.exe
  2⤵
  PID:8616
- C:\Windows\System\wKiWogS.exe
  C:\Windows\System\wKiWogS.exe
  2⤵
  PID:8408
- C:\Windows\System\TUThBFB.exe
  C:\Windows\System\TUThBFB.exe
  2⤵
  PID:8468
- C:\Windows\System\dUwnzNo.exe
  C:\Windows\System\dUwnzNo.exe
  2⤵
  PID:8676
- C:\Windows\System\kHZosMW.exe
  C:\Windows\System\kHZosMW.exe
  2⤵
  PID:8564
- C:\Windows\System\BwzQOoz.exe
  C:\Windows\System\BwzQOoz.exe
  2⤵
  PID:8800
- C:\Windows\System\geGMHkZ.exe
  C:\Windows\System\geGMHkZ.exe
  2⤵
  PID:9000
- C:\Windows\System\rBQBmLr.exe
  C:\Windows\System\rBQBmLr.exe
  2⤵
  PID:8660
- C:\Windows\System\duKgGlx.exe
  C:\Windows\System\duKgGlx.exe
  2⤵
  PID:9212
- C:\Windows\System\yVhJDKq.exe
  C:\Windows\System\yVhJDKq.exe
  2⤵
  PID:8300
- C:\Windows\System\gcNukJB.exe
  C:\Windows\System\gcNukJB.exe
  2⤵
  PID:8956
- C:\Windows\System\YkPEttN.exe
  C:\Windows\System\YkPEttN.exe
  2⤵
  PID:8712
- C:\Windows\System\NOgfErx.exe
  C:\Windows\System\NOgfErx.exe
  2⤵
  PID:8820
- C:\Windows\System\IUxWDwy.exe
  C:\Windows\System\IUxWDwy.exe
  2⤵
  PID:8924
- C:\Windows\System\LmUYEav.exe
  C:\Windows\System\LmUYEav.exe
  2⤵
  PID:8532
- C:\Windows\System\OZBLaLX.exe
  C:\Windows\System\OZBLaLX.exe
  2⤵
  PID:8836
- C:\Windows\System\QmMkrxt.exe
  C:\Windows\System\QmMkrxt.exe
  2⤵
  PID:9092
- C:\Windows\System\qNQaidK.exe
  C:\Windows\System\qNQaidK.exe
  2⤵
  PID:8500
- C:\Windows\System\AFmdIbx.exe
  C:\Windows\System\AFmdIbx.exe
  2⤵
  PID:8768
- C:\Windows\System\hqAIkPH.exe
  C:\Windows\System\hqAIkPH.exe
  2⤵
  PID:9148
- C:\Windows\System\pGwmPqw.exe
  C:\Windows\System\pGwmPqw.exe
  2⤵
  PID:8696
- C:\Windows\System\fuoziOe.exe
  C:\Windows\System\fuoziOe.exe
  2⤵
  PID:7888
- C:\Windows\System\FlyMioY.exe
  C:\Windows\System\FlyMioY.exe
  2⤵
  PID:9164
- C:\Windows\System\BQTqZyP.exe
  C:\Windows\System\BQTqZyP.exe
  2⤵
  PID:9112
- C:\Windows\System\PeWJgln.exe
  C:\Windows\System\PeWJgln.exe
  2⤵
  PID:8392
- C:\Windows\System\yLcNtHq.exe
  C:\Windows\System\yLcNtHq.exe
  2⤵
  PID:8664
- C:\Windows\System\mtTnyPF.exe
  C:\Windows\System\mtTnyPF.exe
  2⤵
  PID:8248
- C:\Windows\System\SRfuJKC.exe
  C:\Windows\System\SRfuJKC.exe
  2⤵
  PID:9228
- C:\Windows\System\gPDtRcj.exe
  C:\Windows\System\gPDtRcj.exe
  2⤵
  PID:9244
- C:\Windows\System\WyLFQHD.exe
  C:\Windows\System\WyLFQHD.exe
  2⤵
  PID:9260
- C:\Windows\System\LQnzgnF.exe
  C:\Windows\System\LQnzgnF.exe
  2⤵
  PID:9276
- C:\Windows\System\MuIToie.exe
  C:\Windows\System\MuIToie.exe
  2⤵
  PID:9292
- C:\Windows\System\NDCCQDC.exe
  C:\Windows\System\NDCCQDC.exe
  2⤵
  PID:9308
- C:\Windows\System\MwrVLOp.exe
  C:\Windows\System\MwrVLOp.exe
  2⤵
  PID:9324
- C:\Windows\System\UGTIBiZ.exe
  C:\Windows\System\UGTIBiZ.exe
  2⤵
  PID:9340
- C:\Windows\System\BbIplDD.exe
  C:\Windows\System\BbIplDD.exe
  2⤵
  PID:9356
- C:\Windows\System\AlFmuLW.exe
  C:\Windows\System\AlFmuLW.exe
  2⤵
  PID:9372
- C:\Windows\System\ZjPnliT.exe
  C:\Windows\System\ZjPnliT.exe
  2⤵
  PID:9388
- C:\Windows\System\behXAzr.exe
  C:\Windows\System\behXAzr.exe
  2⤵
  PID:9404
- C:\Windows\System\hSSULGW.exe
  C:\Windows\System\hSSULGW.exe
  2⤵
  PID:9420
- C:\Windows\System\fJMPeTI.exe
  C:\Windows\System\fJMPeTI.exe
  2⤵
  PID:9436
- C:\Windows\System\MNkzYiF.exe
  C:\Windows\System\MNkzYiF.exe
  2⤵
  PID:9500
- C:\Windows\System\kDZZhhF.exe
  C:\Windows\System\kDZZhhF.exe
  2⤵
  PID:9528
- C:\Windows\System\zJxoHmK.exe
  C:\Windows\System\zJxoHmK.exe
  2⤵
  PID:9544
- C:\Windows\System\vaqClQA.exe
  C:\Windows\System\vaqClQA.exe
  2⤵
  PID:9560
- C:\Windows\System\CgwPsBV.exe
  C:\Windows\System\CgwPsBV.exe
  2⤵
  PID:9576
- C:\Windows\System\TAkaFSz.exe
  C:\Windows\System\TAkaFSz.exe
  2⤵
  PID:9592
- C:\Windows\System\CvqBurq.exe
  C:\Windows\System\CvqBurq.exe
  2⤵
  PID:9608
- C:\Windows\System\bIcrTso.exe
  C:\Windows\System\bIcrTso.exe
  2⤵
  PID:9624
- C:\Windows\System\Chgwtgr.exe
  C:\Windows\System\Chgwtgr.exe
  2⤵
  PID:9644
- C:\Windows\System\xIzgwkR.exe
  C:\Windows\System\xIzgwkR.exe
  2⤵
  PID:9660
- C:\Windows\System\FqlOadZ.exe
  C:\Windows\System\FqlOadZ.exe
  2⤵
  PID:9676
- C:\Windows\System\YlseFuh.exe
  C:\Windows\System\YlseFuh.exe
  2⤵
  PID:9692
- C:\Windows\System\WjMAsiZ.exe
  C:\Windows\System\WjMAsiZ.exe
  2⤵
  PID:9708
- C:\Windows\System\ahOzheB.exe
  C:\Windows\System\ahOzheB.exe
  2⤵
  PID:9724
- C:\Windows\System\iZvqJwb.exe
  C:\Windows\System\iZvqJwb.exe
  2⤵
  PID:9740
- C:\Windows\System\ainWJon.exe
  C:\Windows\System\ainWJon.exe
  2⤵
  PID:9756
- C:\Windows\System\MbQpimn.exe
  C:\Windows\System\MbQpimn.exe
  2⤵
  PID:9772
- C:\Windows\System\BUakLBk.exe
  C:\Windows\System\BUakLBk.exe
  2⤵
  PID:9788
- C:\Windows\System\hgHATlK.exe
  C:\Windows\System\hgHATlK.exe
  2⤵
  PID:9804
- C:\Windows\System\xOkAxGA.exe
  C:\Windows\System\xOkAxGA.exe
  2⤵
  PID:9820
- C:\Windows\System\WhBlbur.exe
  C:\Windows\System\WhBlbur.exe
  2⤵
  PID:9836
- C:\Windows\System\jOzrijv.exe
  C:\Windows\System\jOzrijv.exe
  2⤵
  PID:9860
- C:\Windows\System\dWJoQno.exe
  C:\Windows\System\dWJoQno.exe
  2⤵
  PID:9876
- C:\Windows\System\euBOzbo.exe
  C:\Windows\System\euBOzbo.exe
  2⤵
  PID:9892
- C:\Windows\System\VKPnWjp.exe
  C:\Windows\System\VKPnWjp.exe
  2⤵
  PID:9908
- C:\Windows\System\GrPQeci.exe
  C:\Windows\System\GrPQeci.exe
  2⤵
  PID:9924
- C:\Windows\System\TLdKRZv.exe
  C:\Windows\System\TLdKRZv.exe
  2⤵
  PID:9940
- C:\Windows\System\lFCAibA.exe
  C:\Windows\System\lFCAibA.exe
  2⤵
  PID:9956
- C:\Windows\System\TLJrsoX.exe
  C:\Windows\System\TLJrsoX.exe
  2⤵
  PID:9972
- C:\Windows\System\KzDItJA.exe
  C:\Windows\System\KzDItJA.exe
  2⤵
  PID:9988
- C:\Windows\System\jJDHlVl.exe
  C:\Windows\System\jJDHlVl.exe
  2⤵
  PID:10004
- C:\Windows\System\NyaHYGL.exe
  C:\Windows\System\NyaHYGL.exe
  2⤵
  PID:10020
- C:\Windows\System\YespbdO.exe
  C:\Windows\System\YespbdO.exe
  2⤵
  PID:10040
- C:\Windows\System\dreqYPJ.exe
  C:\Windows\System\dreqYPJ.exe
  2⤵
  PID:10056
- C:\Windows\System\gOZWwKA.exe
  C:\Windows\System\gOZWwKA.exe
  2⤵
  PID:10072
- C:\Windows\System\HXYFIoc.exe
  C:\Windows\System\HXYFIoc.exe
  2⤵
  PID:10088
- C:\Windows\System\pDrNmAw.exe
  C:\Windows\System\pDrNmAw.exe
  2⤵
  PID:10104
- C:\Windows\System\cfNgxXg.exe
  C:\Windows\System\cfNgxXg.exe
  2⤵
  PID:10120
- C:\Windows\System\OtyMGRx.exe
  C:\Windows\System\OtyMGRx.exe
  2⤵
  PID:10136
- C:\Windows\System\izqHPcH.exe
  C:\Windows\System\izqHPcH.exe
  2⤵
  PID:10152
- C:\Windows\System\AnGKict.exe
  C:\Windows\System\AnGKict.exe
  2⤵
  PID:10168
- C:\Windows\System\dUXWTlm.exe
  C:\Windows\System\dUXWTlm.exe
  2⤵
  PID:10184
- C:\Windows\System\UplZYVL.exe
  C:\Windows\System\UplZYVL.exe
  2⤵
  PID:10200
- C:\Windows\System\TYmlqdG.exe
  C:\Windows\System\TYmlqdG.exe
  2⤵
  PID:10216
- C:\Windows\System\mcGjNYO.exe
  C:\Windows\System\mcGjNYO.exe
  2⤵
  PID:10232
- C:\Windows\System\VODHGYs.exe
  C:\Windows\System\VODHGYs.exe
  2⤵
  PID:8580
- C:\Windows\System\hYmnQgp.exe
  C:\Windows\System\hYmnQgp.exe
  2⤵
  PID:9284
- C:\Windows\System\DnBNeup.exe
  C:\Windows\System\DnBNeup.exe
  2⤵
  PID:9348
- C:\Windows\System\GaJaIPf.exe
  C:\Windows\System\GaJaIPf.exe
  2⤵
  PID:8396
- C:\Windows\System\Aoaywgu.exe
  C:\Windows\System\Aoaywgu.exe
  2⤵
  PID:9352
- C:\Windows\System\SFNWFVO.exe
  C:\Windows\System\SFNWFVO.exe
  2⤵
  PID:9416
- C:\Windows\System\yoHJFDG.exe
  C:\Windows\System\yoHJFDG.exe
  2⤵
  PID:9240
- C:\Windows\System\hFNnNJa.exe
  C:\Windows\System\hFNnNJa.exe
  2⤵
  PID:9396
- C:\Windows\System\yEpcntw.exe
  C:\Windows\System\yEpcntw.exe
  2⤵
  PID:9300
- C:\Windows\System\sgzKfJv.exe
  C:\Windows\System\sgzKfJv.exe
  2⤵
  PID:9452
- C:\Windows\System\xdZQAJi.exe
  C:\Windows\System\xdZQAJi.exe
  2⤵
  PID:9460
- C:\Windows\System\JVyDPUk.exe
  C:\Windows\System\JVyDPUk.exe
  2⤵
  PID:9480
- C:\Windows\System\YPzVhzy.exe
  C:\Windows\System\YPzVhzy.exe
  2⤵
  PID:9536
- C:\Windows\System\HQMawJi.exe
  C:\Windows\System\HQMawJi.exe
  2⤵
  PID:9600
- C:\Windows\System\gnorgbj.exe
  C:\Windows\System\gnorgbj.exe
  2⤵
  PID:9764
- C:\Windows\System\xVCejje.exe
  C:\Windows\System\xVCejje.exe
  2⤵
  PID:9752
- C:\Windows\System\ljxzvSl.exe
  C:\Windows\System\ljxzvSl.exe
  2⤵
  PID:9812
- C:\Windows\System\nllWxRB.exe
  C:\Windows\System\nllWxRB.exe
  2⤵
  PID:9904
- C:\Windows\System\ghjtKOr.exe
  C:\Windows\System\ghjtKOr.exe
  2⤵
  PID:9996
- C:\Windows\System\BYpHztz.exe
  C:\Windows\System\BYpHztz.exe
  2⤵
  PID:10036
- C:\Windows\System\bqoUQgO.exe
  C:\Windows\System\bqoUQgO.exe
  2⤵
  PID:10096
- C:\Windows\System\KeFufAo.exe
  C:\Windows\System\KeFufAo.exe
  2⤵
  PID:10132
- C:\Windows\System\vhfzEMV.exe
  C:\Windows\System\vhfzEMV.exe
  2⤵
  PID:10080
- C:\Windows\System\hBRRQAb.exe
  C:\Windows\System\hBRRQAb.exe
  2⤵
  PID:9856
- C:\Windows\System\VsliJLe.exe
  C:\Windows\System\VsliJLe.exe
  2⤵
  PID:9920
- C:\Windows\System\iWtLuWc.exe
  C:\Windows\System\iWtLuWc.exe
  2⤵
  PID:10048
- C:\Windows\System\IovfvrN.exe
  C:\Windows\System\IovfvrN.exe
  2⤵
  PID:10116
- C:\Windows\System\UDQaiRq.exe
  C:\Windows\System\UDQaiRq.exe
  2⤵
  PID:10180
- C:\Windows\System\ugYbJYa.exe
  C:\Windows\System\ugYbJYa.exe
  2⤵
  PID:10212
- C:\Windows\System\lnVNTqu.exe
  C:\Windows\System\lnVNTqu.exe
  2⤵
  PID:10208
- C:\Windows\System\yAfTQmT.exe
  C:\Windows\System\yAfTQmT.exe
  2⤵
  PID:8708
- C:\Windows\System\PELwIMT.exe
  C:\Windows\System\PELwIMT.exe
  2⤵
  PID:9400
- C:\Windows\System\FfpvJYE.exe
  C:\Windows\System\FfpvJYE.exe
  2⤵
  PID:9476
- C:\Windows\System\YnWGbRC.exe
  C:\Windows\System\YnWGbRC.exe
  2⤵
  PID:9236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AvHbQgw.exe

Filesize
1.2MB

MD5
6ee47558dc6a095239d12b1a86394e74

SHA1
348d6af252d4b1beaacbb7ae631b5b29a09fd90b

SHA256
e4ce01c7d15c3907941f8b16d81566037958f697a23bfc8c1c824170147bc147

SHA512
ef8f33674edf577cbcb9af26fb096d3aa4715c946645cdbd462ee570c717f608aa5a26915a6c1a9f1a1f389e570ce96dc6cbd06df6483dcfa7785ebb621bd606

Download Submit
C:\Windows\system\DdvaOUB.exe

Filesize
1.2MB

MD5
935a6f5e658dc901e40edb19a52370ef

SHA1
6299913e7ab685a3a61e195b4953e3425a907fa5

SHA256
f85154176b85d92c93d6eb12d1191d1c831c0dc655b7febcb49f0ac8b48b4aac

SHA512
aff4a36e9f2335aba845d0d623bd8b43fb489b01dd663f8486a15caff7180a08f25fc440b7e540b5dc946f25371d8eccbe68cfea38dca49f4595fd238da35ce7

Download Submit
C:\Windows\system\DfXisFB.exe

Filesize
1.2MB

MD5
cf9650baf18a846d454ad25e02dacaf1

SHA1
a8150810f27a1f6246d96557ad20f4bdf338d9bd

SHA256
2f59e31fc0ebc012a3f72d305ea9271122f35b4ca3055ad1d5e923650d306706

SHA512
9f72b62cc7941f9852dd883aee2c56ef4ef84e5f2b73175870a8bed4f7ecdef28c1e60fe03cdbac52c1905dd0918bb2dce74ce889ee3ccc188d901d36e80699e

Download Submit
C:\Windows\system\EBINdmZ.exe

Filesize
1.2MB

MD5
e78343b73a0f82632a8a8e8839b690c6

SHA1
01ad5ca3b990e2615276c1dbcea84f9d2a0a7c73

SHA256
7c88fd9dfa94ef5cbe62ce2e56ffa4305191857fdf9c3124174f949f543da78d

SHA512
93a51baa9a064e21647006e7dd65ce3860f1f4fff955f1feb277f666fce4e16e76dbdb0382d315b9b6c513cf9cc5764fab1797703a39963cce9421775b9260a4

Download Submit
C:\Windows\system\EakRWDf.exe

Filesize
1.2MB

MD5
439188262e1f41bd63728192b558f403

SHA1
1218955490755bdb8ede9c9c8da95113a9ad8c0f

SHA256
7791845345c01426cf15a86693364f4362ad5bfdbb6743484f3aa739b056a370

SHA512
9bff475dd3056da9bfb2adcb5f16169dc92e1bbab94ab26ad18c2db0b5df2df2b9bc05129bd3576134b7f4bb2f27f217209b40f050f9468e33f3f73bbcdddb29

Download Submit
C:\Windows\system\EsWLceo.exe

Filesize
1.2MB

MD5
7c1b6fd45762745a17035dc435591a69

SHA1
9e0dad07e8ed86f25772c0c00c926a31dd680d24

SHA256
12fc2e3bab95ce5d713624efeca68423835c49f2b564d880a86781239dcd6b28

SHA512
acacacaabd89d5e6d30daf34f19c47f4d6399f60521e0b19d7274bf481e4de32a2e8cb345a721d89a72ba0adc3e55963921f2c9e80c9835d1a042f997db58913

Download Submit
C:\Windows\system\GInQbOu.exe

Filesize
1.2MB

MD5
22751da281597e431f00871e7c05336f

SHA1
daf575e168019e9e8f67e90920a8cd420ed665a3

SHA256
0a8723908bc4d84f5f6b4a290173820a690e7013203ac7bfd796ed58745ab3d9

SHA512
3c50a98fc40d878cbdcac5595a41ea54fc5355240c0bae2e9b58f0cd0535c40e512412d69bd150f9007aacbe5a9a7914b398c1b474bce280e652b9e0a244e1c0

Download Submit
C:\Windows\system\GuPswSh.exe

Filesize
1.2MB

MD5
002e880db4f960fd3c7676bdd1f68bee

SHA1
2f7bf879b4dc3c173d13915b5e04fb10bcd03218

SHA256
ff0a46c564bda4b79744e90b3769b8c5beb1a98c27c2af5a9d658057ed3c0e5b

SHA512
20f8a80b4f9749bbc3f6690f23113db74657ff9b584e4ace07d501d8dee5a553edb9c88fcd357dc64e3bd33f78d7a2f7742975b234cc90b90df75fe2c540676d

Download Submit
C:\Windows\system\IUGBDxK.exe

Filesize
1.2MB

MD5
181a7c328737c032f99728b2df780aec

SHA1
b262e04783b5e8576bd7f7e08cfb518eb60a9f03

SHA256
915ae0cc82d4df0bdb3fa00aa57dcb350ff7f9ac91664f6f88a82b310bbf3e42

SHA512
2f698bcb2f0ce302735349e2b9e1ad11588933a7c49e5ce5559734270c7ca975b3bf1773d22de585d378d94d5a2d347e9011fcb0a12d3a279bd3cc3f8ebe91be

Download Submit
C:\Windows\system\KvrnizX.exe

Filesize
1.2MB

MD5
e5cad9a1838842ca979669a9f0331bdf

SHA1
5c16086368265b20442173deb7a0d87a9380d678

SHA256
47925d38a4df7a7873996c8d3ce5b737c40d1ba041363aea1004ca5279108ce2

SHA512
5999760dbd3b180ebdb11b1a2f78787e79de1dace9bb85668bc28104574a4114c4eb5eebb5f0a1a457fad4bd18679768c84faa86960faef3189f9410fc2fa627

Download Submit
C:\Windows\system\OJCHOER.exe

Filesize
1.2MB

MD5
1bbd7557147ff10f9a7261d5d9c6c4e9

SHA1
07a9ed3f37dffa15f4b333458141fae0ba55d471

SHA256
e6d1c6488d3aea13644d0abe0c0af52a88b321ca98d66c4bd8ae6b034093d6a5

SHA512
dc50473ff8dea2ffeb55b6c30473e502b0b864c3a2487f830bfc4078de15b839a1669af397a34d3491fdd85db3876d6ce78ffbc32a7b36fd3e423cca4e73957e

Download Submit
C:\Windows\system\PHcGImX.exe

Filesize
1.2MB

MD5
e87a4a1583847e231b5b7674b5424bc6

SHA1
0c140746eaeb44619f4a425997fcc8e8a3defa7c

SHA256
cd3c982cd11264aab6140cc2a5c2732b6cf7585b127bcfd1ca5e8ac1e1a7e7f6

SHA512
295c1072a0157e6a706c49ce3350977e6f4d302d5c64bfde67d606eda71c8fd1923966baadaf6825e4d652c6328bce7a1441d527da6002f5c8106250c781f192

Download Submit
C:\Windows\system\PuGTFPX.exe

Filesize
1.2MB

MD5
ef30ba310af100749894e2e7d569843d

SHA1
7ba66bd3da24a4aa1e944087b1afdd90a2667f76

SHA256
0eb232fa2f1137857f060ab4ff4c2d329b1ca079c17ad5219b7b27c5abb64902

SHA512
3f475b3e1e53dd91e5efd7a68b100704e0d432c86114965186c7465f79f5a1714995c96438ca38fcdd42b0578f5de0c3d904ee66915d114328c20c1b6549a596

Download Submit
C:\Windows\system\QSLgzSZ.exe

Filesize
1.2MB

MD5
24a0982eb7794ebc16efa2dd461b01eb

SHA1
7b4f68381bf90659cdda0d0184f71f453ce9425f

SHA256
1b8782f51eaea34d9f5310b57b7d4d7d25aa2b7e2501906a78aabe647e99740d

SHA512
10cff878e469037f134fa56c89f98babb484aa2d890f6ad9a1bea1cb75c1e686ba7f4ebd3c2f778f3662ce21c0d59307b257dcc3d7dea04117b0ef37b0af05c6

Download Submit
C:\Windows\system\RlwQKaM.exe

Filesize
1.2MB

MD5
85ae430c87ee27f68653f6b661a68359

SHA1
d14d79a5a63ba46c05be943ef6725a25c47a13af

SHA256
732cc304f63966c24ac546f6b407503a31859287b040d6ad7482a267483e48d5

SHA512
56377b7cd9d766f00c1e208236afaf5b2ef1d901410a3fe72480a64c46b200a750e9366fe20c315e1a1cbd3a09f50c3808a0f1f9b0cad7ae9df7e2befbe8e50f

Download Submit
C:\Windows\system\XnFEoct.exe

Filesize
1.2MB

MD5
a120c457a51e21b3a978706501876aca

SHA1
1eccf5e2008a0adbb2109f0fa3adf0f21e80b37a

SHA256
8aa159c39ba8b8cbb9a82d10eaa8b1723b8530e1bb034149a9608fd2a1747654

SHA512
5ecbb6c03e25140a66d0363a6ce7dbfbbe4a836d52ef7ce58b44b26b389dbf6752e213ffeaee102e44159f45a30bda9a8b82e3e062a9ebd43fc7164dc9ab9315

Download Submit
C:\Windows\system\aNnZBfS.exe

Filesize
1.2MB

MD5
fff71c023e3407978d00cf27afbb716d

SHA1
78d7906774f56fc6d8165492202c1faa841bac4b

SHA256
3ef23c4cdcee78972fab18fd653446ceacc89e80061ec4840130dc006e59f0da

SHA512
ded928d71538f93b697c275904196607409e1cfe6bfd8aeefa2e3b681dd77f5dfaedeb74063b496e30821b57171379076742333b1b6e5eeac73c4f8016297844

Download Submit
C:\Windows\system\awpJeKi.exe

Filesize
1.2MB

MD5
7bc832351aedd841e6229dfac5126555

SHA1
fe11105e6cfc1230e55ebcdc35a2b005e2e59f76

SHA256
fe01916827b21fa8f3c6531f5a7a7f9b65407685104633d91b67a0ec728b4c52

SHA512
bf18b1a207d03d3ab76b62d95b2d86519252c225ee6e84192ad0875d37e9c447213f91cb2a0bb895bb1a196433c59153853aeaf5d0ca53e827ec8f999ab26260

Download Submit
C:\Windows\system\bxNHCui.exe

Filesize
1.2MB

MD5
99de955db7991814bb7397060a87ccfb

SHA1
2c0645b8e986b8f1bd560d07d7844c6aa1652837

SHA256
583930c5f6ef763feab24eedc1a84deb5924e06a353183c6b798ee9be8de055a

SHA512
04cf987780585a5ea7293384fd5599fee58bb6b1fbd230a7199002e779f7d235567c9fb52a81a99eb61a21c473dee5a4e98668d03624994e59467deca5fe73a6

Download Submit
C:\Windows\system\gAuddMY.exe

Filesize
1.2MB

MD5
e5b1baf29d36706ceeec792a9f5a72e6

SHA1
da659e406eeda41d5d7aef07610bee0cf98f09ca

SHA256
b8115fe0052919eaba10e4863009ad067244cb9062520e5acf0950bc07f5b63d

SHA512
38c3ead806936ddb45e2d28c61d79352a3336005928ae7498828214d2274b166428c44a248b0e24f2527130571e4e7859a9d37ba288a1900704df1d40388f49d

Download Submit
C:\Windows\system\gpPGQnQ.exe

Filesize
1.2MB

MD5
4fff0858bc943177b7b15e7132deae0f

SHA1
50f76f7901877e07c1fd9ab49cf68c1448d83ed2

SHA256
9fec6a8abf45352efaf7694b041450c8ae280a6c9e23ef561de8fad15c19bcbc

SHA512
061ff0945382d294b90d5739b7fe6e2771624a37d3c4340ce85db2e5c22f01ec01489b5fb1af7aa9925498defc318700bcca87e865458734cb4d44b3db4be28a

Download Submit
C:\Windows\system\grTigEp.exe

Filesize
1.2MB

MD5
fbb5b84f1990d0e87e6efcc3087a66f8

SHA1
069eaf61fef97688656d9935ae1b48de66af2758

SHA256
01698bad9c3f9fc5db313811994bde6ea4a50e16d442c43c90be315d61a9afb1

SHA512
e0de0b0e7f2903447d5ce7bd3784dea5edc7ea3e8f99b057c02281cb086a1299be18ff90a10ccceb6e7c55e000192da02a67ff52e9aed915724e55135b17de63

Download Submit
C:\Windows\system\rcpSYjd.exe

Filesize
1.2MB

MD5
9f157fe130f8268cd30740b1391caa91

SHA1
7df2c9cb669387a1119e040a5a014a650c27954d

SHA256
51c228197c1d7859891381c83f3ec48903be9dcb1df0982240a4b1b1277069e3

SHA512
b25e459a16d5cdfdfd84404a81c7a8da67032831d0fc81cd0ecf469cb171c932dfa17fc2e3fdb7a1beab7596fd93954d34dec4cdcb252443b5c27610187850f8

Download Submit
C:\Windows\system\snkMYky.exe

Filesize
1.2MB

MD5
38bee9b7bc69bcbc3d6004759ea9bfc3

SHA1
afeaf0eba9da5dfd8a7a4e8bbcceeffcca2e589c

SHA256
741f8a8d0137eb31d0ea25f0b7c86bd3e3424f9a8c9f56116a1b09b650b4bc2b

SHA512
4fa3ff456def8efaa8c4856f233f132a06f5b87efb266bddb5b9cf6b34dc8d328eb399dc5809ca5bfb46e2df08a44348d36db37db62069ab2509f62420402f55

Download Submit
C:\Windows\system\szGkhpq.exe

Filesize
1.2MB

MD5
a78d1a625e60cf9d2e1f01cae2bdd123

SHA1
f0538a4c690431f5a87583238e13497680ca9778

SHA256
6cc39caa74fc1c29d9dfc6b49b927a7910177fe98046a1d5e088e1947c97f95b

SHA512
7dc264c459ea8d126788c6c585e44609c9575ae7a3092a9787985317335559a898f3aebb406181bebd0713e755b3d81473bfd2de608d4ece033b31f96b3889d6

Download Submit
C:\Windows\system\uTGnOmo.exe

Filesize
1.2MB

MD5
b9d43b183870e94a21717efd37663155

SHA1
9fe135918d319c9cdfcaac6f1d5fffbfaf45e329

SHA256
cd2d15cc137ee270901789194a17530c59169d1289504adafc3d3dfed6e3dd0a

SHA512
9f7d2645c5844c8e9ee21b7b714aab8869aba8cb2cd3158e2a30c59aa5394d664e2907955b60347597700e1e25a6dc4598858c0dd74cf47082b1871550798428

Download Submit
C:\Windows\system\uzObVGA.exe

Filesize
1.2MB

MD5
82c48751cb0e2471ef8f59bceb63a23e

SHA1
09c5a9a13c0c3155001d83a441fc1e4c09780b15

SHA256
618ea108dcdd6f6b012481b9e76b6f5ffd105c8764088bce944a71827d83c35b

SHA512
ce0af0a9465fe6e3fe14076371a581cc5f0b73c5494482feacbd34a59a47d4ed8aba3f66e269f0a626c19ea6306db0106cf224e8b4877e32b59e6eab01c2a7e7

Download Submit
C:\Windows\system\vdCoYlo.exe

Filesize
1.2MB

MD5
89a06cce7f0c53530c2a2ab732a3f6a8

SHA1
d0c9f449633d1050539c48dff549464aa8a888d9

SHA256
cc7fc2125cc85b1428db5e14d9ca14153cf49c95968ee53819ebb609b298172a

SHA512
36d96284c65df527655b55d1e027aae484c8954fcf2ef36b68e61e91368bd25d428eb83c172c8ba80791c22ad96c82951ee04aca637a1a7f829b3aaf028eaca4

Download Submit
C:\Windows\system\vggZicS.exe

Filesize
1.2MB

MD5
b651d2a3c9b61a8ee4c9ddfc36239559

SHA1
822f4e2e701028c3f67132e7cc63613981b5d0be

SHA256
8d9afdfae5022a428d6f61717f9e96e07c9d98273b7fc4f68b1e7860b3793062

SHA512
139e1d70a7d6b41da692362b9e543b0703ea992c74774d2cedf28ed89e390231e57799fa09308c062044f28516919118192c785b3a95a649ba8c5154727691c9

Download Submit
C:\Windows\system\xFKVHCD.exe

Filesize
1.2MB

MD5
0a9212db26a69b0b8c756eab23b4d876

SHA1
ba9bcc0570a244aad345532dd1fef5f1ec91ebc2

SHA256
8c390ae430d2c01a1012fe4ae8eddc2c4cd74c916076e2abf37b3a808d5368f2

SHA512
629c3cb2744df9cf06df829c273d3754e4264d3e9f3a9ea99d418e36e5a7779afa6d489a9390185da40a0a6529c90fda92fee299a19d35ace79d66bb33dbfc9b

Download Submit
C:\Windows\system\xzzMJaH.exe

Filesize
1.2MB

MD5
ad977a4dd2abfe76170cc01cba22ece4

SHA1
9b6cde0f21958ae555a0270d52fa788d41930896

SHA256
134b5b07cf8a7dc69ece20366e27666c7060078cdcddc908c71f888cf16f0c1e

SHA512
1a4df27e6fcc0f84f8724f790f1242505765a3f7641374f964b6adbb2585aa54900e1dbd7d10e051e2c35fb84ad85b552a978296210778953ed59594720eac2f

Download Submit
\Windows\system\ihEhOYY.exe

Filesize
1.2MB

MD5
3b54c47bc56d29ad9f74cf76af96ceae

SHA1
6451eb9d7ea4c3125e01d2a679c1df4bb1d560cc

SHA256
3b8c2ddc5073ba270223665a023e4bec571b3d060e1c87260f49ac8a10bdd7bf

SHA512
da82ca713c7c1175993f592d2c9bb527164229cc938a4fcd26ee4604502a1c68e263a9da17212067e2973f0be8f8b20b99ad4bd33add32204df2c7dec5e73b95

Download Submit
memory/2844-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download