xmrig | 9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12

Analysis

max time kernel
146s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
Size

1.6MB
MD5

9032342b278a5072b607913747bc77c1
SHA1

7523abaf6bf44aa91cd9bdf4edf426d5d6056239
SHA256

9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12
SHA512

c0018f0c58f996aa6a6706dc72aa0fd6efda7ced493a7cd76f91a42f2843b74f1d0893701988862509beb3602b70a6a92e8a6ea37ab91f24a53004c4b7fa8944
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZk6:GemTLkNdfE0pZyW

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral1/files/0x00080000000120fe-2.dat	xmrig
behavioral1/files/0x0008000000016e09-9.dat	xmrig
behavioral1/files/0x000800000001727e-8.dat	xmrig
behavioral1/files/0x0008000000017530-16.dat	xmrig
behavioral1/files/0x00080000000175ae-23.dat	xmrig
behavioral1/files/0x00060000000186ca-26.dat	xmrig
behavioral1/files/0x00060000000186cc-31.dat	xmrig
behavioral1/files/0x0008000000018710-38.dat	xmrig
behavioral1/files/0x0005000000019605-47.dat	xmrig
behavioral1/files/0x0005000000019606-50.dat	xmrig
behavioral1/files/0x000500000001960a-69.dat	xmrig
behavioral1/files/0x0005000000019926-99.dat	xmrig
behavioral1/files/0x0005000000019cca-129.dat	xmrig
behavioral1/files/0x0005000000019f94-150.dat	xmrig
behavioral1/files/0x000500000001a07e-159.dat	xmrig
behavioral1/files/0x000500000001a075-153.dat	xmrig
behavioral1/files/0x0005000000019dbf-139.dat	xmrig
behavioral1/files/0x0005000000019f8a-144.dat	xmrig
behavioral1/files/0x0005000000019d8e-134.dat	xmrig
behavioral1/files/0x0005000000019c57-119.dat	xmrig
behavioral1/files/0x0005000000019cba-123.dat	xmrig
behavioral1/files/0x0005000000019c3c-109.dat	xmrig
behavioral1/files/0x0005000000019c3e-114.dat	xmrig
behavioral1/files/0x0005000000019c34-104.dat	xmrig
behavioral1/files/0x00050000000196a1-94.dat	xmrig
behavioral1/files/0x0005000000019667-89.dat	xmrig
behavioral1/files/0x000500000001961e-84.dat	xmrig
behavioral1/files/0x000500000001961c-80.dat	xmrig
behavioral1/files/0x000500000001960c-74.dat	xmrig
behavioral1/files/0x0005000000019608-65.dat	xmrig
behavioral1/files/0x0005000000019604-43.dat	xmrig
behavioral1/files/0x00060000000186d9-35.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

tJvaZVw.exepHpRlum.exesyYTfgl.exeoEEPGfK.exemmecFws.exerYbvhdX.exedaQkvmK.exelJMuXvZ.exeDLhYPhd.exegyygLaa.exePnCzZig.exehzyorPN.exevBeFqkM.exewgYmYBv.exeiZBuyvI.exeTXiSYdH.exebqKgVaF.exeFaqAkHu.exemLmSvhL.exepGgOkUl.exeIKliCxm.exeLKBoEFj.exeUzTrNPt.exeFAbpjhd.exeHSwLKej.exePFUgzqt.exeOKkCqym.exeoGrcnNn.exeseLWOkR.exeujYwKEG.exeVTLqBXo.exeEYtskKq.exeyQWXJfL.exelaleQAp.exefAZLUZv.exeeAIQOac.execjZsGkf.exeTXqXxov.exeFTilcyZ.exeNoSkLhw.exezyhZDfK.exepRMTWPw.execAlqXyc.exefJzSRao.exeXEfZYQq.exeQHxSeYe.exeroEJpGT.exeNzfWuiU.exepzzWsYu.exeARMxEdz.exeVmGjWgD.exeVpHxobt.exemxrcucE.exewPdhzgw.exenDhZETh.exeQjaOYrJ.exegmNvpaO.exerukJKuV.exeqpBzRhQ.exeEdyqrNN.exeLIefhlA.exehowdNMx.exeCTAOPZB.exeeiVoFSP.exe

pid	Process
2432	tJvaZVw.exe
932	pHpRlum.exe
2260	syYTfgl.exe
2236	oEEPGfK.exe
1816	mmecFws.exe
2948	rYbvhdX.exe
444	daQkvmK.exe
3000	lJMuXvZ.exe
2596	DLhYPhd.exe
3032	gyygLaa.exe
2308	PnCzZig.exe
2728	hzyorPN.exe
2756	vBeFqkM.exe
2688	wgYmYBv.exe
2860	iZBuyvI.exe
2668	TXiSYdH.exe
2676	bqKgVaF.exe
2536	FaqAkHu.exe
2672	mLmSvhL.exe
1256	pGgOkUl.exe
1328	IKliCxm.exe
1072	LKBoEFj.exe
1336	UzTrNPt.exe
1752	FAbpjhd.exe
1720	HSwLKej.exe
2764	PFUgzqt.exe
948	OKkCqym.exe
1496	oGrcnNn.exe
648	seLWOkR.exe
1788	ujYwKEG.exe
2944	VTLqBXo.exe
2304	EYtskKq.exe
2124	yQWXJfL.exe
1592	laleQAp.exe
2600	fAZLUZv.exe
1748	eAIQOac.exe
996	cjZsGkf.exe
1840	TXqXxov.exe
1092	FTilcyZ.exe
604	NoSkLhw.exe
1884	zyhZDfK.exe
2196	pRMTWPw.exe
1848	cAlqXyc.exe
1948	fJzSRao.exe
1708	XEfZYQq.exe
2168	QHxSeYe.exe
1684	roEJpGT.exe
1696	NzfWuiU.exe
1648	pzzWsYu.exe
1616	ARMxEdz.exe
2052	VmGjWgD.exe
2140	VpHxobt.exe
2916	mxrcucE.exe
3060	wPdhzgw.exe
2292	nDhZETh.exe
2112	QjaOYrJ.exe
2380	gmNvpaO.exe
3044	rukJKuV.exe
1944	qpBzRhQ.exe
1588	EdyqrNN.exe
2324	LIefhlA.exe
1808	howdNMx.exe
2416	CTAOPZB.exe
1280	eiVoFSP.exe

Loads dropped DLL 64 IoCs

Processes:

9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe

pid	Process
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe

Drops file in Windows directory 64 IoCs

Processes:

9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe

description	ioc	Process
File created	C:\Windows\System\kSNMPEb.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\OLdcAON.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\lTczMqU.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\NoBoyXD.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\vewwBbN.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\xFNtDNC.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\TYyfMMs.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\UACLPOn.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\SEsbcCN.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\qmBvZdI.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\WUkJbig.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\InFQnDb.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\jabVopJ.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\GZnQdXX.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\xcjbkwc.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\KiDWIxC.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\hmAZKCl.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\SxjWRGj.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\PdVDhBg.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\MhoCdxj.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\rrjwsrb.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\uZzclmT.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\IvThepZ.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\DQmWKas.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\iaabdBS.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\OockJZx.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\LzvDmqU.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\MtiPJgl.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\FTGbTDE.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\EjbIrkW.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\EQmUGsI.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\sCnacap.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\hJnPJko.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\fuGjjyz.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\tDxLrkf.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\MqUamIN.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\aMdFqSA.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\nKwWnIq.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\uiQIjyj.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\MfxNdeQ.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\zSPiqpZ.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\Jdljlnb.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\QHCJrsn.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\HFMCNma.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\kKVmoyC.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\ZrgxFPl.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\dbSiTkR.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\IkewBSn.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\NVhxqwz.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\GeyWAPL.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\XHKMVVL.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\iLzDPwR.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\xHUoikP.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\JBxRKcP.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\spxtxCu.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\ATQKbvl.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\GtxGcrq.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\xVFcSmy.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\DLhYPhd.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\iepcjMC.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\zVfjbEy.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\dDwToAW.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\EOzLheh.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
File created	C:\Windows\System\MAUPasg.exe	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe

description	pid	Process	procid_target
PID 848 wrote to memory of 2432	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	29
PID 848 wrote to memory of 2432	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	29
PID 848 wrote to memory of 2432	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	29
PID 848 wrote to memory of 932	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	30
PID 848 wrote to memory of 932	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	30
PID 848 wrote to memory of 932	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	30
PID 848 wrote to memory of 2260	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	31
PID 848 wrote to memory of 2260	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	31
PID 848 wrote to memory of 2260	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	31
PID 848 wrote to memory of 2236	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	32
PID 848 wrote to memory of 2236	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	32
PID 848 wrote to memory of 2236	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	32
PID 848 wrote to memory of 1816	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	33
PID 848 wrote to memory of 1816	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	33
PID 848 wrote to memory of 1816	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	33
PID 848 wrote to memory of 2948	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	34
PID 848 wrote to memory of 2948	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	34
PID 848 wrote to memory of 2948	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	34
PID 848 wrote to memory of 444	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	35
PID 848 wrote to memory of 444	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	35
PID 848 wrote to memory of 444	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	35
PID 848 wrote to memory of 3000	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	36
PID 848 wrote to memory of 3000	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	36
PID 848 wrote to memory of 3000	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	36
PID 848 wrote to memory of 2596	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	37
PID 848 wrote to memory of 2596	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	37
PID 848 wrote to memory of 2596	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	37
PID 848 wrote to memory of 3032	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	38
PID 848 wrote to memory of 3032	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	38
PID 848 wrote to memory of 3032	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	38
PID 848 wrote to memory of 2308	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	39
PID 848 wrote to memory of 2308	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	39
PID 848 wrote to memory of 2308	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	39
PID 848 wrote to memory of 2728	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	40
PID 848 wrote to memory of 2728	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	40
PID 848 wrote to memory of 2728	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	40
PID 848 wrote to memory of 2756	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	41
PID 848 wrote to memory of 2756	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	41
PID 848 wrote to memory of 2756	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	41
PID 848 wrote to memory of 2688	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	42
PID 848 wrote to memory of 2688	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	42
PID 848 wrote to memory of 2688	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	42
PID 848 wrote to memory of 2860	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	43
PID 848 wrote to memory of 2860	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	43
PID 848 wrote to memory of 2860	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	43
PID 848 wrote to memory of 2668	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	44
PID 848 wrote to memory of 2668	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	44
PID 848 wrote to memory of 2668	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	44
PID 848 wrote to memory of 2676	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	45
PID 848 wrote to memory of 2676	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	45
PID 848 wrote to memory of 2676	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	45
PID 848 wrote to memory of 2536	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	46
PID 848 wrote to memory of 2536	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	46
PID 848 wrote to memory of 2536	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	46
PID 848 wrote to memory of 2672	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	47
PID 848 wrote to memory of 2672	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	47
PID 848 wrote to memory of 2672	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	47
PID 848 wrote to memory of 1256	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	48
PID 848 wrote to memory of 1256	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	48
PID 848 wrote to memory of 1256	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	48
PID 848 wrote to memory of 1328	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	49
PID 848 wrote to memory of 1328	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	49
PID 848 wrote to memory of 1328	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	49
PID 848 wrote to memory of 1072	848	9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe	50

C:\Users\Admin\AppData\Local\Temp\9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe
"C:\Users\Admin\AppData\Local\Temp\9d78025eb2700aa9106bd80a1a75210f5fbf5aed8d1d21cd7e9bcf68a6456d12.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\System\tJvaZVw.exe
  C:\Windows\System\tJvaZVw.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\pHpRlum.exe
  C:\Windows\System\pHpRlum.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\syYTfgl.exe
  C:\Windows\System\syYTfgl.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\oEEPGfK.exe
  C:\Windows\System\oEEPGfK.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\mmecFws.exe
  C:\Windows\System\mmecFws.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\rYbvhdX.exe
  C:\Windows\System\rYbvhdX.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\daQkvmK.exe
  C:\Windows\System\daQkvmK.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\lJMuXvZ.exe
  C:\Windows\System\lJMuXvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\DLhYPhd.exe
  C:\Windows\System\DLhYPhd.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\gyygLaa.exe
  C:\Windows\System\gyygLaa.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\PnCzZig.exe
  C:\Windows\System\PnCzZig.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\hzyorPN.exe
  C:\Windows\System\hzyorPN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\vBeFqkM.exe
  C:\Windows\System\vBeFqkM.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\wgYmYBv.exe
  C:\Windows\System\wgYmYBv.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\iZBuyvI.exe
  C:\Windows\System\iZBuyvI.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\TXiSYdH.exe
  C:\Windows\System\TXiSYdH.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\bqKgVaF.exe
  C:\Windows\System\bqKgVaF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\FaqAkHu.exe
  C:\Windows\System\FaqAkHu.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\mLmSvhL.exe
  C:\Windows\System\mLmSvhL.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\pGgOkUl.exe
  C:\Windows\System\pGgOkUl.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\IKliCxm.exe
  C:\Windows\System\IKliCxm.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\LKBoEFj.exe
  C:\Windows\System\LKBoEFj.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\UzTrNPt.exe
  C:\Windows\System\UzTrNPt.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\FAbpjhd.exe
  C:\Windows\System\FAbpjhd.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\HSwLKej.exe
  C:\Windows\System\HSwLKej.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\PFUgzqt.exe
  C:\Windows\System\PFUgzqt.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\OKkCqym.exe
  C:\Windows\System\OKkCqym.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\oGrcnNn.exe
  C:\Windows\System\oGrcnNn.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\seLWOkR.exe
  C:\Windows\System\seLWOkR.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\ujYwKEG.exe
  C:\Windows\System\ujYwKEG.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\VTLqBXo.exe
  C:\Windows\System\VTLqBXo.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\EYtskKq.exe
  C:\Windows\System\EYtskKq.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\yQWXJfL.exe
  C:\Windows\System\yQWXJfL.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\laleQAp.exe
  C:\Windows\System\laleQAp.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\fAZLUZv.exe
  C:\Windows\System\fAZLUZv.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\eAIQOac.exe
  C:\Windows\System\eAIQOac.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\cjZsGkf.exe
  C:\Windows\System\cjZsGkf.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\TXqXxov.exe
  C:\Windows\System\TXqXxov.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\FTilcyZ.exe
  C:\Windows\System\FTilcyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\NoSkLhw.exe
  C:\Windows\System\NoSkLhw.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\zyhZDfK.exe
  C:\Windows\System\zyhZDfK.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\pRMTWPw.exe
  C:\Windows\System\pRMTWPw.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\cAlqXyc.exe
  C:\Windows\System\cAlqXyc.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\fJzSRao.exe
  C:\Windows\System\fJzSRao.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\XEfZYQq.exe
  C:\Windows\System\XEfZYQq.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\QHxSeYe.exe
  C:\Windows\System\QHxSeYe.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\roEJpGT.exe
  C:\Windows\System\roEJpGT.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\NzfWuiU.exe
  C:\Windows\System\NzfWuiU.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\pzzWsYu.exe
  C:\Windows\System\pzzWsYu.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ARMxEdz.exe
  C:\Windows\System\ARMxEdz.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\VmGjWgD.exe
  C:\Windows\System\VmGjWgD.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\VpHxobt.exe
  C:\Windows\System\VpHxobt.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\mxrcucE.exe
  C:\Windows\System\mxrcucE.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wPdhzgw.exe
  C:\Windows\System\wPdhzgw.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\nDhZETh.exe
  C:\Windows\System\nDhZETh.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QjaOYrJ.exe
  C:\Windows\System\QjaOYrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\gmNvpaO.exe
  C:\Windows\System\gmNvpaO.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\rukJKuV.exe
  C:\Windows\System\rukJKuV.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\qpBzRhQ.exe
  C:\Windows\System\qpBzRhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\EdyqrNN.exe
  C:\Windows\System\EdyqrNN.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\LIefhlA.exe
  C:\Windows\System\LIefhlA.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\howdNMx.exe
  C:\Windows\System\howdNMx.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\CTAOPZB.exe
  C:\Windows\System\CTAOPZB.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\eiVoFSP.exe
  C:\Windows\System\eiVoFSP.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\dYWpcxq.exe
  C:\Windows\System\dYWpcxq.exe
  2⤵
  PID:1968
- C:\Windows\System\UodYqoZ.exe
  C:\Windows\System\UodYqoZ.exe
  2⤵
  PID:2716
- C:\Windows\System\SuWgEOx.exe
  C:\Windows\System\SuWgEOx.exe
  2⤵
  PID:2608
- C:\Windows\System\KpgYYtR.exe
  C:\Windows\System\KpgYYtR.exe
  2⤵
  PID:2780
- C:\Windows\System\rfbSZBu.exe
  C:\Windows\System\rfbSZBu.exe
  2⤵
  PID:2736
- C:\Windows\System\uclaAzT.exe
  C:\Windows\System\uclaAzT.exe
  2⤵
  PID:2796
- C:\Windows\System\qAGkTFD.exe
  C:\Windows\System\qAGkTFD.exe
  2⤵
  PID:2524
- C:\Windows\System\ZhiMwvd.exe
  C:\Windows\System\ZhiMwvd.exe
  2⤵
  PID:1772
- C:\Windows\System\pEJFHbp.exe
  C:\Windows\System\pEJFHbp.exe
  2⤵
  PID:2624
- C:\Windows\System\EGPfofn.exe
  C:\Windows\System\EGPfofn.exe
  2⤵
  PID:2976
- C:\Windows\System\yVaIPrr.exe
  C:\Windows\System\yVaIPrr.exe
  2⤵
  PID:1776
- C:\Windows\System\nEpuvnX.exe
  C:\Windows\System\nEpuvnX.exe
  2⤵
  PID:980
- C:\Windows\System\FOYyqbk.exe
  C:\Windows\System\FOYyqbk.exe
  2⤵
  PID:2396
- C:\Windows\System\DNqZDgf.exe
  C:\Windows\System\DNqZDgf.exe
  2⤵
  PID:900
- C:\Windows\System\LuZwlCV.exe
  C:\Windows\System\LuZwlCV.exe
  2⤵
  PID:2872
- C:\Windows\System\PvRhAyT.exe
  C:\Windows\System\PvRhAyT.exe
  2⤵
  PID:2172
- C:\Windows\System\WAVTAAs.exe
  C:\Windows\System\WAVTAAs.exe
  2⤵
  PID:2392
- C:\Windows\System\cVIAWUH.exe
  C:\Windows\System\cVIAWUH.exe
  2⤵
  PID:1692
- C:\Windows\System\JDbOWxS.exe
  C:\Windows\System\JDbOWxS.exe
  2⤵
  PID:2156
- C:\Windows\System\QnfQwdv.exe
  C:\Windows\System\QnfQwdv.exe
  2⤵
  PID:2484
- C:\Windows\System\EmOkCIM.exe
  C:\Windows\System\EmOkCIM.exe
  2⤵
  PID:1980
- C:\Windows\System\tEyyrEH.exe
  C:\Windows\System\tEyyrEH.exe
  2⤵
  PID:2900
- C:\Windows\System\hYCKGgF.exe
  C:\Windows\System\hYCKGgF.exe
  2⤵
  PID:2032
- C:\Windows\System\lNKHYQi.exe
  C:\Windows\System\lNKHYQi.exe
  2⤵
  PID:1344
- C:\Windows\System\GSFQSKY.exe
  C:\Windows\System\GSFQSKY.exe
  2⤵
  PID:2364
- C:\Windows\System\cXPtQgB.exe
  C:\Windows\System\cXPtQgB.exe
  2⤵
  PID:1760
- C:\Windows\System\GKOhgvj.exe
  C:\Windows\System\GKOhgvj.exe
  2⤵
  PID:1756
- C:\Windows\System\CiECvnX.exe
  C:\Windows\System\CiECvnX.exe
  2⤵
  PID:924
- C:\Windows\System\elqFCqt.exe
  C:\Windows\System\elqFCqt.exe
  2⤵
  PID:1164
- C:\Windows\System\SiOvFOo.exe
  C:\Windows\System\SiOvFOo.exe
  2⤵
  PID:1628
- C:\Windows\System\RyYHvTy.exe
  C:\Windows\System\RyYHvTy.exe
  2⤵
  PID:352
- C:\Windows\System\yrUbjBk.exe
  C:\Windows\System\yrUbjBk.exe
  2⤵
  PID:2116
- C:\Windows\System\PXweuPV.exe
  C:\Windows\System\PXweuPV.exe
  2⤵
  PID:1940
- C:\Windows\System\iDhZsrS.exe
  C:\Windows\System\iDhZsrS.exe
  2⤵
  PID:2468
- C:\Windows\System\CsOcXBs.exe
  C:\Windows\System\CsOcXBs.exe
  2⤵
  PID:1688
- C:\Windows\System\lPwJtwT.exe
  C:\Windows\System\lPwJtwT.exe
  2⤵
  PID:2436
- C:\Windows\System\ZqQUHbD.exe
  C:\Windows\System\ZqQUHbD.exe
  2⤵
  PID:2936
- C:\Windows\System\eSfieyC.exe
  C:\Windows\System\eSfieyC.exe
  2⤵
  PID:2788
- C:\Windows\System\YFZOYrE.exe
  C:\Windows\System\YFZOYrE.exe
  2⤵
  PID:2888
- C:\Windows\System\mYMKDFw.exe
  C:\Windows\System\mYMKDFw.exe
  2⤵
  PID:2620
- C:\Windows\System\zcxoWQA.exe
  C:\Windows\System\zcxoWQA.exe
  2⤵
  PID:2528
- C:\Windows\System\oPjgzLE.exe
  C:\Windows\System\oPjgzLE.exe
  2⤵
  PID:1700
- C:\Windows\System\ukSlEyq.exe
  C:\Windows\System\ukSlEyq.exe
  2⤵
  PID:1644
- C:\Windows\System\AnLyAUY.exe
  C:\Windows\System\AnLyAUY.exe
  2⤵
  PID:2192
- C:\Windows\System\HJxPCcu.exe
  C:\Windows\System\HJxPCcu.exe
  2⤵
  PID:1796
- C:\Windows\System\GgnjQeQ.exe
  C:\Windows\System\GgnjQeQ.exe
  2⤵
  PID:2492
- C:\Windows\System\wQwzVpM.exe
  C:\Windows\System\wQwzVpM.exe
  2⤵
  PID:2836
- C:\Windows\System\EUcAuJQ.exe
  C:\Windows\System\EUcAuJQ.exe
  2⤵
  PID:2488
- C:\Windows\System\EdhsoJR.exe
  C:\Windows\System\EdhsoJR.exe
  2⤵
  PID:2164
- C:\Windows\System\ZMdtwMN.exe
  C:\Windows\System\ZMdtwMN.exe
  2⤵
  PID:2076
- C:\Windows\System\uOGHTVz.exe
  C:\Windows\System\uOGHTVz.exe
  2⤵
  PID:1656
- C:\Windows\System\YopHoMr.exe
  C:\Windows\System\YopHoMr.exe
  2⤵
  PID:2868
- C:\Windows\System\dQiFJqp.exe
  C:\Windows\System\dQiFJqp.exe
  2⤵
  PID:2684
- C:\Windows\System\yFVWvnA.exe
  C:\Windows\System\yFVWvnA.exe
  2⤵
  PID:2720
- C:\Windows\System\yJQicqm.exe
  C:\Windows\System\yJQicqm.exe
  2⤵
  PID:1988
- C:\Windows\System\VMtJADz.exe
  C:\Windows\System\VMtJADz.exe
  2⤵
  PID:668
- C:\Windows\System\hfrZddN.exe
  C:\Windows\System\hfrZddN.exe
  2⤵
  PID:1396
- C:\Windows\System\vHtEBbE.exe
  C:\Windows\System\vHtEBbE.exe
  2⤵
  PID:3068
- C:\Windows\System\ZYgEMSc.exe
  C:\Windows\System\ZYgEMSc.exe
  2⤵
  PID:1452
- C:\Windows\System\kKfFDVj.exe
  C:\Windows\System\kKfFDVj.exe
  2⤵
  PID:1604
- C:\Windows\System\SPtdrwx.exe
  C:\Windows\System\SPtdrwx.exe
  2⤵
  PID:2892
- C:\Windows\System\UtbOHXB.exe
  C:\Windows\System\UtbOHXB.exe
  2⤵
  PID:2784
- C:\Windows\System\XCIGbxz.exe
  C:\Windows\System\XCIGbxz.exe
  2⤵
  PID:2652
- C:\Windows\System\QAdakML.exe
  C:\Windows\System\QAdakML.exe
  2⤵
  PID:2532
- C:\Windows\System\yCukaKQ.exe
  C:\Windows\System\yCukaKQ.exe
  2⤵
  PID:2884
- C:\Windows\System\uWlXxgy.exe
  C:\Windows\System\uWlXxgy.exe
  2⤵
  PID:3012
- C:\Windows\System\FHzlFGL.exe
  C:\Windows\System\FHzlFGL.exe
  2⤵
  PID:2508
- C:\Windows\System\NPjUAEQ.exe
  C:\Windows\System\NPjUAEQ.exe
  2⤵
  PID:2036
- C:\Windows\System\zUDGCzl.exe
  C:\Windows\System\zUDGCzl.exe
  2⤵
  PID:2560
- C:\Windows\System\NSoZyFa.exe
  C:\Windows\System\NSoZyFa.exe
  2⤵
  PID:2412
- C:\Windows\System\sABqCgZ.exe
  C:\Windows\System\sABqCgZ.exe
  2⤵
  PID:540
- C:\Windows\System\wJYiyYW.exe
  C:\Windows\System\wJYiyYW.exe
  2⤵
  PID:2200
- C:\Windows\System\hvKRJFY.exe
  C:\Windows\System\hvKRJFY.exe
  2⤵
  PID:2680
- C:\Windows\System\LmILxXy.exe
  C:\Windows\System\LmILxXy.exe
  2⤵
  PID:2352
- C:\Windows\System\gXupkiM.exe
  C:\Windows\System\gXupkiM.exe
  2⤵
  PID:572
- C:\Windows\System\CHSjGnc.exe
  C:\Windows\System\CHSjGnc.exe
  2⤵
  PID:2956
- C:\Windows\System\qoiUmzE.exe
  C:\Windows\System\qoiUmzE.exe
  2⤵
  PID:1956
- C:\Windows\System\cvgYcMK.exe
  C:\Windows\System\cvgYcMK.exe
  2⤵
  PID:844
- C:\Windows\System\BdACrKt.exe
  C:\Windows\System\BdACrKt.exe
  2⤵
  PID:1512
- C:\Windows\System\NfgNQEC.exe
  C:\Windows\System\NfgNQEC.exe
  2⤵
  PID:2924
- C:\Windows\System\uBaZBdP.exe
  C:\Windows\System\uBaZBdP.exe
  2⤵
  PID:1704
- C:\Windows\System\GQcZEUB.exe
  C:\Windows\System\GQcZEUB.exe
  2⤵
  PID:1996
- C:\Windows\System\vSKvOWj.exe
  C:\Windows\System\vSKvOWj.exe
  2⤵
  PID:2296
- C:\Windows\System\hmAZKCl.exe
  C:\Windows\System\hmAZKCl.exe
  2⤵
  PID:2476
- C:\Windows\System\XHKMVVL.exe
  C:\Windows\System\XHKMVVL.exe
  2⤵
  PID:1524
- C:\Windows\System\zVGjIzr.exe
  C:\Windows\System\zVGjIzr.exe
  2⤵
  PID:2480
- C:\Windows\System\vkHYCVQ.exe
  C:\Windows\System\vkHYCVQ.exe
  2⤵
  PID:2988
- C:\Windows\System\HeIfGxV.exe
  C:\Windows\System\HeIfGxV.exe
  2⤵
  PID:2996
- C:\Windows\System\hpcUxSV.exe
  C:\Windows\System\hpcUxSV.exe
  2⤵
  PID:2588
- C:\Windows\System\LxyXvce.exe
  C:\Windows\System\LxyXvce.exe
  2⤵
  PID:2012
- C:\Windows\System\huwMPHm.exe
  C:\Windows\System\huwMPHm.exe
  2⤵
  PID:468
- C:\Windows\System\hBuziRn.exe
  C:\Windows\System\hBuziRn.exe
  2⤵
  PID:1152
- C:\Windows\System\rnBUSew.exe
  C:\Windows\System\rnBUSew.exe
  2⤵
  PID:840
- C:\Windows\System\nwHCnTV.exe
  C:\Windows\System\nwHCnTV.exe
  2⤵
  PID:776
- C:\Windows\System\PfTPZAP.exe
  C:\Windows\System\PfTPZAP.exe
  2⤵
  PID:788
- C:\Windows\System\nTCcbWu.exe
  C:\Windows\System\nTCcbWu.exe
  2⤵
  PID:2664
- C:\Windows\System\cEfdQMj.exe
  C:\Windows\System\cEfdQMj.exe
  2⤵
  PID:2556
- C:\Windows\System\xBFWhcs.exe
  C:\Windows\System\xBFWhcs.exe
  2⤵
  PID:3008
- C:\Windows\System\XFnnqqm.exe
  C:\Windows\System\XFnnqqm.exe
  2⤵
  PID:2612
- C:\Windows\System\QkBtezi.exe
  C:\Windows\System\QkBtezi.exe
  2⤵
  PID:1804
- C:\Windows\System\cNGWsdl.exe
  C:\Windows\System\cNGWsdl.exe
  2⤵
  PID:2288
- C:\Windows\System\hYwhFAu.exe
  C:\Windows\System\hYwhFAu.exe
  2⤵
  PID:2144
- C:\Windows\System\ACBCywE.exe
  C:\Windows\System\ACBCywE.exe
  2⤵
  PID:2660
- C:\Windows\System\CciNrDK.exe
  C:\Windows\System\CciNrDK.exe
  2⤵
  PID:2220
- C:\Windows\System\RccVPch.exe
  C:\Windows\System\RccVPch.exe
  2⤵
  PID:2128
- C:\Windows\System\FtOXwSd.exe
  C:\Windows\System\FtOXwSd.exe
  2⤵
  PID:3080
- C:\Windows\System\khwJmMF.exe
  C:\Windows\System\khwJmMF.exe
  2⤵
  PID:3096
- C:\Windows\System\xnIYKmM.exe
  C:\Windows\System\xnIYKmM.exe
  2⤵
  PID:3116
- C:\Windows\System\NzvVwVj.exe
  C:\Windows\System\NzvVwVj.exe
  2⤵
  PID:3132
- C:\Windows\System\hUXrYfW.exe
  C:\Windows\System\hUXrYfW.exe
  2⤵
  PID:3148
- C:\Windows\System\mdRYFQc.exe
  C:\Windows\System\mdRYFQc.exe
  2⤵
  PID:3168
- C:\Windows\System\WygXTWd.exe
  C:\Windows\System\WygXTWd.exe
  2⤵
  PID:3184
- C:\Windows\System\hERdqiD.exe
  C:\Windows\System\hERdqiD.exe
  2⤵
  PID:3200
- C:\Windows\System\rHerJJg.exe
  C:\Windows\System\rHerJJg.exe
  2⤵
  PID:3220
- C:\Windows\System\dVltNcl.exe
  C:\Windows\System\dVltNcl.exe
  2⤵
  PID:3256
- C:\Windows\System\BSALYRk.exe
  C:\Windows\System\BSALYRk.exe
  2⤵
  PID:3272
- C:\Windows\System\LPooGmv.exe
  C:\Windows\System\LPooGmv.exe
  2⤵
  PID:3288
- C:\Windows\System\cJYDSCA.exe
  C:\Windows\System\cJYDSCA.exe
  2⤵
  PID:3304
- C:\Windows\System\XBqqDNL.exe
  C:\Windows\System\XBqqDNL.exe
  2⤵
  PID:3320
- C:\Windows\System\YJvxYNH.exe
  C:\Windows\System\YJvxYNH.exe
  2⤵
  PID:3336
- C:\Windows\System\PvvfnnE.exe
  C:\Windows\System\PvvfnnE.exe
  2⤵
  PID:3356
- C:\Windows\System\dLuNTWf.exe
  C:\Windows\System\dLuNTWf.exe
  2⤵
  PID:3384
- C:\Windows\System\nKwWnIq.exe
  C:\Windows\System\nKwWnIq.exe
  2⤵
  PID:3412
- C:\Windows\System\SiGjpJQ.exe
  C:\Windows\System\SiGjpJQ.exe
  2⤵
  PID:3428
- C:\Windows\System\oFIxSlc.exe
  C:\Windows\System\oFIxSlc.exe
  2⤵
  PID:3448
- C:\Windows\System\XwQOpiE.exe
  C:\Windows\System\XwQOpiE.exe
  2⤵
  PID:3476
- C:\Windows\System\cWxuNCM.exe
  C:\Windows\System\cWxuNCM.exe
  2⤵
  PID:3492
- C:\Windows\System\tNOZkIp.exe
  C:\Windows\System\tNOZkIp.exe
  2⤵
  PID:3512
- C:\Windows\System\bnsDeOS.exe
  C:\Windows\System\bnsDeOS.exe
  2⤵
  PID:3528
- C:\Windows\System\fkpUgid.exe
  C:\Windows\System\fkpUgid.exe
  2⤵
  PID:3544
- C:\Windows\System\EjbIrkW.exe
  C:\Windows\System\EjbIrkW.exe
  2⤵
  PID:3564
- C:\Windows\System\FvbEfqT.exe
  C:\Windows\System\FvbEfqT.exe
  2⤵
  PID:3580
- C:\Windows\System\SIXevoF.exe
  C:\Windows\System\SIXevoF.exe
  2⤵
  PID:3596
- C:\Windows\System\svgOTjl.exe
  C:\Windows\System\svgOTjl.exe
  2⤵
  PID:3616
- C:\Windows\System\atuYQzV.exe
  C:\Windows\System\atuYQzV.exe
  2⤵
  PID:3636
- C:\Windows\System\xRJmRvZ.exe
  C:\Windows\System\xRJmRvZ.exe
  2⤵
  PID:3652
- C:\Windows\System\MclwNcT.exe
  C:\Windows\System\MclwNcT.exe
  2⤵
  PID:3672
- C:\Windows\System\EOZwzhG.exe
  C:\Windows\System\EOZwzhG.exe
  2⤵
  PID:3688
- C:\Windows\System\Nipgzka.exe
  C:\Windows\System\Nipgzka.exe
  2⤵
  PID:3704
- C:\Windows\System\JEtnLrG.exe
  C:\Windows\System\JEtnLrG.exe
  2⤵
  PID:3720
- C:\Windows\System\yFgXiqr.exe
  C:\Windows\System\yFgXiqr.exe
  2⤵
  PID:3740
- C:\Windows\System\Fzlukfm.exe
  C:\Windows\System\Fzlukfm.exe
  2⤵
  PID:3756
- C:\Windows\System\YOEnrVt.exe
  C:\Windows\System\YOEnrVt.exe
  2⤵
  PID:3776
- C:\Windows\System\WDerVJm.exe
  C:\Windows\System\WDerVJm.exe
  2⤵
  PID:3792
- C:\Windows\System\TDJmpWB.exe
  C:\Windows\System\TDJmpWB.exe
  2⤵
  PID:3816
- C:\Windows\System\yHFvYKJ.exe
  C:\Windows\System\yHFvYKJ.exe
  2⤵
  PID:3832
- C:\Windows\System\DSqlKWW.exe
  C:\Windows\System\DSqlKWW.exe
  2⤵
  PID:3848
- C:\Windows\System\pzixSrO.exe
  C:\Windows\System\pzixSrO.exe
  2⤵
  PID:3864
- C:\Windows\System\EQmUGsI.exe
  C:\Windows\System\EQmUGsI.exe
  2⤵
  PID:3884
- C:\Windows\System\SUbsoSH.exe
  C:\Windows\System\SUbsoSH.exe
  2⤵
  PID:3900
- C:\Windows\System\RBNqkSb.exe
  C:\Windows\System\RBNqkSb.exe
  2⤵
  PID:3920
- C:\Windows\System\EvawlEV.exe
  C:\Windows\System\EvawlEV.exe
  2⤵
  PID:3936
- C:\Windows\System\hxxbWji.exe
  C:\Windows\System\hxxbWji.exe
  2⤵
  PID:3956
- C:\Windows\System\lLhvqqE.exe
  C:\Windows\System\lLhvqqE.exe
  2⤵
  PID:3972
- C:\Windows\System\GLlVLJX.exe
  C:\Windows\System\GLlVLJX.exe
  2⤵
  PID:3992
- C:\Windows\System\hVSPErW.exe
  C:\Windows\System\hVSPErW.exe
  2⤵
  PID:4008
- C:\Windows\System\OCkhPYM.exe
  C:\Windows\System\OCkhPYM.exe
  2⤵
  PID:4024
- C:\Windows\System\wAVkoMi.exe
  C:\Windows\System\wAVkoMi.exe
  2⤵
  PID:4040
- C:\Windows\System\gWPzpYI.exe
  C:\Windows\System\gWPzpYI.exe
  2⤵
  PID:4056
- C:\Windows\System\zfwCjBL.exe
  C:\Windows\System\zfwCjBL.exe
  2⤵
  PID:4072
- C:\Windows\System\ZfkqqIM.exe
  C:\Windows\System\ZfkqqIM.exe
  2⤵
  PID:4088
- C:\Windows\System\rrMzKPT.exe
  C:\Windows\System\rrMzKPT.exe
  2⤵
  PID:112
- C:\Windows\System\HWXSTti.exe
  C:\Windows\System\HWXSTti.exe
  2⤵
  PID:3092
- C:\Windows\System\gEggrVE.exe
  C:\Windows\System\gEggrVE.exe
  2⤵
  PID:832
- C:\Windows\System\ujUdJIZ.exe
  C:\Windows\System\ujUdJIZ.exe
  2⤵
  PID:1876
- C:\Windows\System\uPsKjWM.exe
  C:\Windows\System\uPsKjWM.exe
  2⤵
  PID:3160
- C:\Windows\System\dtHtrpS.exe
  C:\Windows\System\dtHtrpS.exe
  2⤵
  PID:3244
- C:\Windows\System\sUXxAoK.exe
  C:\Windows\System\sUXxAoK.exe
  2⤵
  PID:3252
- C:\Windows\System\fbrKztl.exe
  C:\Windows\System\fbrKztl.exe
  2⤵
  PID:3284
- C:\Windows\System\mkZiWjl.exe
  C:\Windows\System\mkZiWjl.exe
  2⤵
  PID:2644
- C:\Windows\System\oVVmtVO.exe
  C:\Windows\System\oVVmtVO.exe
  2⤵
  PID:1560
- C:\Windows\System\TVcSqYP.exe
  C:\Windows\System\TVcSqYP.exe
  2⤵
  PID:3264
- C:\Windows\System\SopRHdP.exe
  C:\Windows\System\SopRHdP.exe
  2⤵
  PID:3112
- C:\Windows\System\wdwDEAr.exe
  C:\Windows\System\wdwDEAr.exe
  2⤵
  PID:3300
- C:\Windows\System\dJoxqcg.exe
  C:\Windows\System\dJoxqcg.exe
  2⤵
  PID:3216
- C:\Windows\System\PYQPwqE.exe
  C:\Windows\System\PYQPwqE.exe
  2⤵
  PID:3144
- C:\Windows\System\taOWTAZ.exe
  C:\Windows\System\taOWTAZ.exe
  2⤵
  PID:3376
- C:\Windows\System\hSatvXF.exe
  C:\Windows\System\hSatvXF.exe
  2⤵
  PID:3404
- C:\Windows\System\apUvMJR.exe
  C:\Windows\System\apUvMJR.exe
  2⤵
  PID:3444
- C:\Windows\System\mbKPuzm.exe
  C:\Windows\System\mbKPuzm.exe
  2⤵
  PID:3524
- C:\Windows\System\MmhPihn.exe
  C:\Windows\System\MmhPihn.exe
  2⤵
  PID:3588
- C:\Windows\System\AzHTzZA.exe
  C:\Windows\System\AzHTzZA.exe
  2⤵
  PID:3660
- C:\Windows\System\ffdNtgz.exe
  C:\Windows\System\ffdNtgz.exe
  2⤵
  PID:3700
- C:\Windows\System\qmBvZdI.exe
  C:\Windows\System\qmBvZdI.exe
  2⤵
  PID:3764
- C:\Windows\System\VNgXXqX.exe
  C:\Windows\System\VNgXXqX.exe
  2⤵
  PID:3800
- C:\Windows\System\iLzDPwR.exe
  C:\Windows\System\iLzDPwR.exe
  2⤵
  PID:3840
- C:\Windows\System\ENTWbJy.exe
  C:\Windows\System\ENTWbJy.exe
  2⤵
  PID:3464
- C:\Windows\System\IvThepZ.exe
  C:\Windows\System\IvThepZ.exe
  2⤵
  PID:3916
- C:\Windows\System\pgefxgp.exe
  C:\Windows\System\pgefxgp.exe
  2⤵
  PID:3980
- C:\Windows\System\SxjWRGj.exe
  C:\Windows\System\SxjWRGj.exe
  2⤵
  PID:4020
- C:\Windows\System\WUkJbig.exe
  C:\Windows\System\WUkJbig.exe
  2⤵
  PID:2028
- C:\Windows\System\InZpIOg.exe
  C:\Windows\System\InZpIOg.exe
  2⤵
  PID:3196
- C:\Windows\System\aFwMgeD.exe
  C:\Windows\System\aFwMgeD.exe
  2⤵
  PID:3316
- C:\Windows\System\qGMaEDW.exe
  C:\Windows\System\qGMaEDW.exe
  2⤵
  PID:3368
- C:\Windows\System\ZYvEWtD.exe
  C:\Windows\System\ZYvEWtD.exe
  2⤵
  PID:3440
- C:\Windows\System\FCYSdAV.exe
  C:\Windows\System\FCYSdAV.exe
  2⤵
  PID:3696
- C:\Windows\System\ndTIxXX.exe
  C:\Windows\System\ndTIxXX.exe
  2⤵
  PID:2420
- C:\Windows\System\NxbHitk.exe
  C:\Windows\System\NxbHitk.exe
  2⤵
  PID:3948
- C:\Windows\System\xVBgYmC.exe
  C:\Windows\System\xVBgYmC.exe
  2⤵
  PID:4084
- C:\Windows\System\VZiTsNe.exe
  C:\Windows\System\VZiTsNe.exe
  2⤵
  PID:3280
- C:\Windows\System\hAiLtLx.exe
  C:\Windows\System\hAiLtLx.exe
  2⤵
  PID:3772
- C:\Windows\System\EKVOiVk.exe
  C:\Windows\System\EKVOiVk.exe
  2⤵
  PID:4112
- C:\Windows\System\cgwgivy.exe
  C:\Windows\System\cgwgivy.exe
  2⤵
  PID:4132
- C:\Windows\System\JnpOXPv.exe
  C:\Windows\System\JnpOXPv.exe
  2⤵
  PID:4148
- C:\Windows\System\InFQnDb.exe
  C:\Windows\System\InFQnDb.exe
  2⤵
  PID:4164
- C:\Windows\System\PtrPnfo.exe
  C:\Windows\System\PtrPnfo.exe
  2⤵
  PID:4180
- C:\Windows\System\TZFnSJd.exe
  C:\Windows\System\TZFnSJd.exe
  2⤵
  PID:4196
- C:\Windows\System\KzPJDHz.exe
  C:\Windows\System\KzPJDHz.exe
  2⤵
  PID:4212
- C:\Windows\System\IYpOfQD.exe
  C:\Windows\System\IYpOfQD.exe
  2⤵
  PID:4228
- C:\Windows\System\dGxynSz.exe
  C:\Windows\System\dGxynSz.exe
  2⤵
  PID:4244
- C:\Windows\System\iepcjMC.exe
  C:\Windows\System\iepcjMC.exe
  2⤵
  PID:4260
- C:\Windows\System\LCydmtP.exe
  C:\Windows\System\LCydmtP.exe
  2⤵
  PID:4276
- C:\Windows\System\wJmevxz.exe
  C:\Windows\System\wJmevxz.exe
  2⤵
  PID:4292
- C:\Windows\System\xRGjzyz.exe
  C:\Windows\System\xRGjzyz.exe
  2⤵
  PID:4308
- C:\Windows\System\QwJqlwt.exe
  C:\Windows\System\QwJqlwt.exe
  2⤵
  PID:4324
- C:\Windows\System\fIYWdRf.exe
  C:\Windows\System\fIYWdRf.exe
  2⤵
  PID:4340
- C:\Windows\System\mgLxecm.exe
  C:\Windows\System\mgLxecm.exe
  2⤵
  PID:4356
- C:\Windows\System\tifPGSt.exe
  C:\Windows\System\tifPGSt.exe
  2⤵
  PID:4372
- C:\Windows\System\ejSwfth.exe
  C:\Windows\System\ejSwfth.exe
  2⤵
  PID:4388
- C:\Windows\System\xYweItp.exe
  C:\Windows\System\xYweItp.exe
  2⤵
  PID:4404
- C:\Windows\System\QUOvooR.exe
  C:\Windows\System\QUOvooR.exe
  2⤵
  PID:4420
- C:\Windows\System\uiQIjyj.exe
  C:\Windows\System\uiQIjyj.exe
  2⤵
  PID:4436
- C:\Windows\System\bAhuPRd.exe
  C:\Windows\System\bAhuPRd.exe
  2⤵
  PID:4452
- C:\Windows\System\OLdcAON.exe
  C:\Windows\System\OLdcAON.exe
  2⤵
  PID:4468
- C:\Windows\System\UgrrWhJ.exe
  C:\Windows\System\UgrrWhJ.exe
  2⤵
  PID:4484
- C:\Windows\System\jabVopJ.exe
  C:\Windows\System\jabVopJ.exe
  2⤵
  PID:4500
- C:\Windows\System\yiziMDs.exe
  C:\Windows\System\yiziMDs.exe
  2⤵
  PID:4516
- C:\Windows\System\NKUCygK.exe
  C:\Windows\System\NKUCygK.exe
  2⤵
  PID:4532
- C:\Windows\System\mGdpQyC.exe
  C:\Windows\System\mGdpQyC.exe
  2⤵
  PID:4548
- C:\Windows\System\aQZyTtb.exe
  C:\Windows\System\aQZyTtb.exe
  2⤵
  PID:4564
- C:\Windows\System\KGqonSs.exe
  C:\Windows\System\KGqonSs.exe
  2⤵
  PID:4580
- C:\Windows\System\pcXeyzA.exe
  C:\Windows\System\pcXeyzA.exe
  2⤵
  PID:4596
- C:\Windows\System\mTteqCV.exe
  C:\Windows\System\mTteqCV.exe
  2⤵
  PID:4612
- C:\Windows\System\tSHjRSV.exe
  C:\Windows\System\tSHjRSV.exe
  2⤵
  PID:4628
- C:\Windows\System\qGuxoTF.exe
  C:\Windows\System\qGuxoTF.exe
  2⤵
  PID:4644
- C:\Windows\System\pBkfNOl.exe
  C:\Windows\System\pBkfNOl.exe
  2⤵
  PID:4660
- C:\Windows\System\xKqOHzM.exe
  C:\Windows\System\xKqOHzM.exe
  2⤵
  PID:4676
- C:\Windows\System\IBrRuCD.exe
  C:\Windows\System\IBrRuCD.exe
  2⤵
  PID:4692
- C:\Windows\System\xHUoikP.exe
  C:\Windows\System\xHUoikP.exe
  2⤵
  PID:4708
- C:\Windows\System\uSDcyoM.exe
  C:\Windows\System\uSDcyoM.exe
  2⤵
  PID:4724
- C:\Windows\System\PSVhfxL.exe
  C:\Windows\System\PSVhfxL.exe
  2⤵
  PID:4740
- C:\Windows\System\hRORdEY.exe
  C:\Windows\System\hRORdEY.exe
  2⤵
  PID:4756
- C:\Windows\System\jRTvvMi.exe
  C:\Windows\System\jRTvvMi.exe
  2⤵
  PID:4772
- C:\Windows\System\IRcGmcn.exe
  C:\Windows\System\IRcGmcn.exe
  2⤵
  PID:4788
- C:\Windows\System\LRnvwpk.exe
  C:\Windows\System\LRnvwpk.exe
  2⤵
  PID:4804
- C:\Windows\System\rjBznoM.exe
  C:\Windows\System\rjBznoM.exe
  2⤵
  PID:4820
- C:\Windows\System\JAKfhMA.exe
  C:\Windows\System\JAKfhMA.exe
  2⤵
  PID:4836
- C:\Windows\System\PbfNLzL.exe
  C:\Windows\System\PbfNLzL.exe
  2⤵
  PID:4852
- C:\Windows\System\IArrOpt.exe
  C:\Windows\System\IArrOpt.exe
  2⤵
  PID:4868
- C:\Windows\System\ecjHnPA.exe
  C:\Windows\System\ecjHnPA.exe
  2⤵
  PID:4884
- C:\Windows\System\XHBTrJf.exe
  C:\Windows\System\XHBTrJf.exe
  2⤵
  PID:4900
- C:\Windows\System\OvVVmOS.exe
  C:\Windows\System\OvVVmOS.exe
  2⤵
  PID:4916
- C:\Windows\System\sTgpwdQ.exe
  C:\Windows\System\sTgpwdQ.exe
  2⤵
  PID:4932
- C:\Windows\System\SgkIbBu.exe
  C:\Windows\System\SgkIbBu.exe
  2⤵
  PID:4948
- C:\Windows\System\RtlEnjd.exe
  C:\Windows\System\RtlEnjd.exe
  2⤵
  PID:4964
- C:\Windows\System\qxJztLx.exe
  C:\Windows\System\qxJztLx.exe
  2⤵
  PID:4980
- C:\Windows\System\wZlYKPA.exe
  C:\Windows\System\wZlYKPA.exe
  2⤵
  PID:4996
- C:\Windows\System\kFPxkNo.exe
  C:\Windows\System\kFPxkNo.exe
  2⤵
  PID:5012
- C:\Windows\System\VVvllEu.exe
  C:\Windows\System\VVvllEu.exe
  2⤵
  PID:5028
- C:\Windows\System\CrowhrP.exe
  C:\Windows\System\CrowhrP.exe
  2⤵
  PID:5044
- C:\Windows\System\PaaGEwP.exe
  C:\Windows\System\PaaGEwP.exe
  2⤵
  PID:5060
- C:\Windows\System\KquXbwy.exe
  C:\Windows\System\KquXbwy.exe
  2⤵
  PID:5076
- C:\Windows\System\sYxgXaK.exe
  C:\Windows\System\sYxgXaK.exe
  2⤵
  PID:5092
- C:\Windows\System\PKDxoZk.exe
  C:\Windows\System\PKDxoZk.exe
  2⤵
  PID:5108
- C:\Windows\System\qZgwPGn.exe
  C:\Windows\System\qZgwPGn.exe
  2⤵
  PID:3312
- C:\Windows\System\qfBSBzc.exe
  C:\Windows\System\qfBSBzc.exe
  2⤵
  PID:3332
- C:\Windows\System\CfWVFZA.exe
  C:\Windows\System\CfWVFZA.exe
  2⤵
  PID:3628
- C:\Windows\System\awPNZcb.exe
  C:\Windows\System\awPNZcb.exe
  2⤵
  PID:4220
- C:\Windows\System\dJKVdyZ.exe
  C:\Windows\System\dJKVdyZ.exe
  2⤵
  PID:4256
- C:\Windows\System\tuvbsOL.exe
  C:\Windows\System\tuvbsOL.exe
  2⤵
  PID:4320
- C:\Windows\System\beQRgpE.exe
  C:\Windows\System\beQRgpE.exe
  2⤵
  PID:3856
- C:\Windows\System\ZfEhdoK.exe
  C:\Windows\System\ZfEhdoK.exe
  2⤵
  PID:3932
- C:\Windows\System\SXzlsNp.exe
  C:\Windows\System\SXzlsNp.exe
  2⤵
  PID:4384
- C:\Windows\System\uxBeQkn.exe
  C:\Windows\System\uxBeQkn.exe
  2⤵
  PID:4032
- C:\Windows\System\sisYAxw.exe
  C:\Windows\System\sisYAxw.exe
  2⤵
  PID:4104
- C:\Windows\System\lTczMqU.exe
  C:\Windows\System\lTczMqU.exe
  2⤵
  PID:3576
- C:\Windows\System\WKtphAv.exe
  C:\Windows\System\WKtphAv.exe
  2⤵
  PID:3540
- C:\Windows\System\mwiusde.exe
  C:\Windows\System\mwiusde.exe
  2⤵
  PID:3624
- C:\Windows\System\sGvGJND.exe
  C:\Windows\System\sGvGJND.exe
  2⤵
  PID:3684
- C:\Windows\System\JyuVJwT.exe
  C:\Windows\System\JyuVJwT.exe
  2⤵
  PID:3752
- C:\Windows\System\XpqepNm.exe
  C:\Windows\System\XpqepNm.exe
  2⤵
  PID:3828
- C:\Windows\System\EgVNWtX.exe
  C:\Windows\System\EgVNWtX.exe
  2⤵
  PID:4000
- C:\Windows\System\JAOLAzN.exe
  C:\Windows\System\JAOLAzN.exe
  2⤵
  PID:2800
- C:\Windows\System\OlXoEjj.exe
  C:\Windows\System\OlXoEjj.exe
  2⤵
  PID:3156
- C:\Windows\System\tTMRabg.exe
  C:\Windows\System\tTMRabg.exe
  2⤵
  PID:3988
- C:\Windows\System\ASFExQX.exe
  C:\Windows\System\ASFExQX.exe
  2⤵
  PID:3240
- C:\Windows\System\uEhfpRt.exe
  C:\Windows\System\uEhfpRt.exe
  2⤵
  PID:3268
- C:\Windows\System\DXrUlRM.exe
  C:\Windows\System\DXrUlRM.exe
  2⤵
  PID:3400
- C:\Windows\System\nkjvEVi.exe
  C:\Windows\System\nkjvEVi.exe
  2⤵
  PID:3632
- C:\Windows\System\WwyxXoz.exe
  C:\Windows\System\WwyxXoz.exe
  2⤵
  PID:4444
- C:\Windows\System\vzPIxHD.exe
  C:\Windows\System\vzPIxHD.exe
  2⤵
  PID:4448
- C:\Windows\System\mlmErKw.exe
  C:\Windows\System\mlmErKw.exe
  2⤵
  PID:2852
- C:\Windows\System\JyCvSuw.exe
  C:\Windows\System\JyCvSuw.exe
  2⤵
  PID:3876
- C:\Windows\System\TsLOKfN.exe
  C:\Windows\System\TsLOKfN.exe
  2⤵
  PID:4176
- C:\Windows\System\gdvRREq.exe
  C:\Windows\System\gdvRREq.exe
  2⤵
  PID:4272
- C:\Windows\System\RFsxwoz.exe
  C:\Windows\System\RFsxwoz.exe
  2⤵
  PID:4476
- C:\Windows\System\dpctbnp.exe
  C:\Windows\System\dpctbnp.exe
  2⤵
  PID:4544
- C:\Windows\System\PFdNZHA.exe
  C:\Windows\System\PFdNZHA.exe
  2⤵
  PID:4608
- C:\Windows\System\czCMYsV.exe
  C:\Windows\System\czCMYsV.exe
  2⤵
  PID:4672
- C:\Windows\System\gsXjTwM.exe
  C:\Windows\System\gsXjTwM.exe
  2⤵
  PID:4736
- C:\Windows\System\cMvsrrK.exe
  C:\Windows\System\cMvsrrK.exe
  2⤵
  PID:4364
- C:\Windows\System\NiwbWwL.exe
  C:\Windows\System\NiwbWwL.exe
  2⤵
  PID:4796
- C:\Windows\System\BUaLJjv.exe
  C:\Windows\System\BUaLJjv.exe
  2⤵
  PID:4860
- C:\Windows\System\koyHsUm.exe
  C:\Windows\System\koyHsUm.exe
  2⤵
  PID:4428
- C:\Windows\System\NcKYhnV.exe
  C:\Windows\System\NcKYhnV.exe
  2⤵
  PID:4496
- C:\Windows\System\UsxKwDc.exe
  C:\Windows\System\UsxKwDc.exe
  2⤵
  PID:4956
- C:\Windows\System\FdasepJ.exe
  C:\Windows\System\FdasepJ.exe
  2⤵
  PID:4812
- C:\Windows\System\OZVQuCX.exe
  C:\Windows\System\OZVQuCX.exe
  2⤵
  PID:4880
- C:\Windows\System\Zoodabr.exe
  C:\Windows\System\Zoodabr.exe
  2⤵
  PID:4560
- C:\Windows\System\EhwZKAf.exe
  C:\Windows\System\EhwZKAf.exe
  2⤵
  PID:4652
- C:\Windows\System\erAwInH.exe
  C:\Windows\System\erAwInH.exe
  2⤵
  PID:4716
- C:\Windows\System\yQgJtMf.exe
  C:\Windows\System\yQgJtMf.exe
  2⤵
  PID:4780
- C:\Windows\System\HaYywUq.exe
  C:\Windows\System\HaYywUq.exe
  2⤵
  PID:5024
- C:\Windows\System\kAefPJJ.exe
  C:\Windows\System\kAefPJJ.exe
  2⤵
  PID:4052
- C:\Windows\System\BKwUkyF.exe
  C:\Windows\System\BKwUkyF.exe
  2⤵
  PID:3472
- C:\Windows\System\ZhthNKO.exe
  C:\Windows\System\ZhthNKO.exe
  2⤵
  PID:5008
- C:\Windows\System\KSCMBps.exe
  C:\Windows\System\KSCMBps.exe
  2⤵
  PID:5072
- C:\Windows\System\ztmFcdg.exe
  C:\Windows\System\ztmFcdg.exe
  2⤵
  PID:4160
- C:\Windows\System\soQNRwl.exe
  C:\Windows\System\soQNRwl.exe
  2⤵
  PID:3420
- C:\Windows\System\iQMxjFz.exe
  C:\Windows\System\iQMxjFz.exe
  2⤵
  PID:3104
- C:\Windows\System\sIYACQE.exe
  C:\Windows\System\sIYACQE.exe
  2⤵
  PID:3648
- C:\Windows\System\MfxNdeQ.exe
  C:\Windows\System\MfxNdeQ.exe
  2⤵
  PID:4068
- C:\Windows\System\oCazNwu.exe
  C:\Windows\System\oCazNwu.exe
  2⤵
  PID:4140
- C:\Windows\System\wSRZglU.exe
  C:\Windows\System\wSRZglU.exe
  2⤵
  PID:3668
- C:\Windows\System\VQJevjZ.exe
  C:\Windows\System\VQJevjZ.exe
  2⤵
  PID:4236
- C:\Windows\System\vYkSICw.exe
  C:\Windows\System\vYkSICw.exe
  2⤵
  PID:4512
- C:\Windows\System\MUrLdVm.exe
  C:\Windows\System\MUrLdVm.exe
  2⤵
  PID:4588
- C:\Windows\System\MKjwBXg.exe
  C:\Windows\System\MKjwBXg.exe
  2⤵
  PID:4492
- C:\Windows\System\sBgNvRc.exe
  C:\Windows\System\sBgNvRc.exe
  2⤵
  PID:4688
- C:\Windows\System\brRedTp.exe
  C:\Windows\System\brRedTp.exe
  2⤵
  PID:4992
- C:\Windows\System\PFkXFtX.exe
  C:\Windows\System\PFkXFtX.exe
  2⤵
  PID:3716
- C:\Windows\System\vIWqCMb.exe
  C:\Windows\System\vIWqCMb.exe
  2⤵
  PID:5052
- C:\Windows\System\xLHoIXg.exe
  C:\Windows\System\xLHoIXg.exe
  2⤵
  PID:3180
- C:\Windows\System\EtUCUeZ.exe
  C:\Windows\System\EtUCUeZ.exe
  2⤵
  PID:4016
- C:\Windows\System\fhpQwQP.exe
  C:\Windows\System\fhpQwQP.exe
  2⤵
  PID:4336
- C:\Windows\System\WHpuEjb.exe
  C:\Windows\System\WHpuEjb.exe
  2⤵
  PID:4748
- C:\Windows\System\RsWDvHy.exe
  C:\Windows\System\RsWDvHy.exe
  2⤵
  PID:4732
- C:\Windows\System\qpQctcc.exe
  C:\Windows\System\qpQctcc.exe
  2⤵
  PID:4876
- C:\Windows\System\YeWOSvw.exe
  C:\Windows\System\YeWOSvw.exe
  2⤵
  PID:5084
- C:\Windows\System\oDrxwAI.exe
  C:\Windows\System\oDrxwAI.exe
  2⤵
  PID:3468
- C:\Windows\System\XHgpTKh.exe
  C:\Windows\System\XHgpTKh.exe
  2⤵
  PID:5068
- C:\Windows\System\CVgQkVl.exe
  C:\Windows\System\CVgQkVl.exe
  2⤵
  PID:5004
- C:\Windows\System\kGuFTnF.exe
  C:\Windows\System\kGuFTnF.exe
  2⤵
  PID:4316
- C:\Windows\System\SDvtpiE.exe
  C:\Windows\System\SDvtpiE.exe
  2⤵
  PID:3248
- C:\Windows\System\hEQDeKy.exe
  C:\Windows\System\hEQDeKy.exe
  2⤵
  PID:4036
- C:\Windows\System\mHnQTKq.exe
  C:\Windows\System\mHnQTKq.exe
  2⤵
  PID:4848
- C:\Windows\System\mZKbRkX.exe
  C:\Windows\System\mZKbRkX.exe
  2⤵
  PID:3128
- C:\Windows\System\YQrBNmJ.exe
  C:\Windows\System\YQrBNmJ.exe
  2⤵
  PID:4144
- C:\Windows\System\wqqdBjV.exe
  C:\Windows\System\wqqdBjV.exe
  2⤵
  PID:4752
- C:\Windows\System\XgsDGGP.exe
  C:\Windows\System\XgsDGGP.exe
  2⤵
  PID:4208
- C:\Windows\System\lxaYUiR.exe
  C:\Windows\System\lxaYUiR.exe
  2⤵
  PID:5124
- C:\Windows\System\fbzifKu.exe
  C:\Windows\System\fbzifKu.exe
  2⤵
  PID:5140
- C:\Windows\System\XhpCRCK.exe
  C:\Windows\System\XhpCRCK.exe
  2⤵
  PID:5156
- C:\Windows\System\ASseWCU.exe
  C:\Windows\System\ASseWCU.exe
  2⤵
  PID:5172
- C:\Windows\System\rAyvclc.exe
  C:\Windows\System\rAyvclc.exe
  2⤵
  PID:5188
- C:\Windows\System\EzqAoVF.exe
  C:\Windows\System\EzqAoVF.exe
  2⤵
  PID:5204
- C:\Windows\System\LlvVGMQ.exe
  C:\Windows\System\LlvVGMQ.exe
  2⤵
  PID:5220
- C:\Windows\System\NGEQwKz.exe
  C:\Windows\System\NGEQwKz.exe
  2⤵
  PID:5236
- C:\Windows\System\WDOKiik.exe
  C:\Windows\System\WDOKiik.exe
  2⤵
  PID:5252
- C:\Windows\System\HFkILur.exe
  C:\Windows\System\HFkILur.exe
  2⤵
  PID:5268
- C:\Windows\System\hGpTTQZ.exe
  C:\Windows\System\hGpTTQZ.exe
  2⤵
  PID:5284
- C:\Windows\System\DfyUVyM.exe
  C:\Windows\System\DfyUVyM.exe
  2⤵
  PID:5300
- C:\Windows\System\AzihVTj.exe
  C:\Windows\System\AzihVTj.exe
  2⤵
  PID:5316
- C:\Windows\System\skfGXzS.exe
  C:\Windows\System\skfGXzS.exe
  2⤵
  PID:5332
- C:\Windows\System\wCvrIFD.exe
  C:\Windows\System\wCvrIFD.exe
  2⤵
  PID:5348
- C:\Windows\System\uWaUaqD.exe
  C:\Windows\System\uWaUaqD.exe
  2⤵
  PID:5364
- C:\Windows\System\uyOEHTx.exe
  C:\Windows\System\uyOEHTx.exe
  2⤵
  PID:5380
- C:\Windows\System\kKVmoyC.exe
  C:\Windows\System\kKVmoyC.exe
  2⤵
  PID:5396
- C:\Windows\System\QQAGqVW.exe
  C:\Windows\System\QQAGqVW.exe
  2⤵
  PID:5412
- C:\Windows\System\RIBUXtG.exe
  C:\Windows\System\RIBUXtG.exe
  2⤵
  PID:5428
- C:\Windows\System\PtkyXNl.exe
  C:\Windows\System\PtkyXNl.exe
  2⤵
  PID:5444
- C:\Windows\System\dwfiokv.exe
  C:\Windows\System\dwfiokv.exe
  2⤵
  PID:5460
- C:\Windows\System\NXoHcAA.exe
  C:\Windows\System\NXoHcAA.exe
  2⤵
  PID:5476
- C:\Windows\System\ppdOvgt.exe
  C:\Windows\System\ppdOvgt.exe
  2⤵
  PID:5496
- C:\Windows\System\NoBoyXD.exe
  C:\Windows\System\NoBoyXD.exe
  2⤵
  PID:5512
- C:\Windows\System\QmVCMGV.exe
  C:\Windows\System\QmVCMGV.exe
  2⤵
  PID:5528
- C:\Windows\System\PzqQxTQ.exe
  C:\Windows\System\PzqQxTQ.exe
  2⤵
  PID:5548
- C:\Windows\System\VhWspon.exe
  C:\Windows\System\VhWspon.exe
  2⤵
  PID:5564
- C:\Windows\System\aVxnWVq.exe
  C:\Windows\System\aVxnWVq.exe
  2⤵
  PID:5580
- C:\Windows\System\tlWoKnK.exe
  C:\Windows\System\tlWoKnK.exe
  2⤵
  PID:5596
- C:\Windows\System\fxLNOKZ.exe
  C:\Windows\System\fxLNOKZ.exe
  2⤵
  PID:5612
- C:\Windows\System\lIdSANG.exe
  C:\Windows\System\lIdSANG.exe
  2⤵
  PID:5628
- C:\Windows\System\UEQduBI.exe
  C:\Windows\System\UEQduBI.exe
  2⤵
  PID:5644
- C:\Windows\System\FiaNxxX.exe
  C:\Windows\System\FiaNxxX.exe
  2⤵
  PID:5660
- C:\Windows\System\MgNCYgg.exe
  C:\Windows\System\MgNCYgg.exe
  2⤵
  PID:5676
- C:\Windows\System\PxPbfMF.exe
  C:\Windows\System\PxPbfMF.exe
  2⤵
  PID:5692
- C:\Windows\System\BDKvBTz.exe
  C:\Windows\System\BDKvBTz.exe
  2⤵
  PID:5708
- C:\Windows\System\efHlKsp.exe
  C:\Windows\System\efHlKsp.exe
  2⤵
  PID:5724
- C:\Windows\System\ylIbHIg.exe
  C:\Windows\System\ylIbHIg.exe
  2⤵
  PID:5740
- C:\Windows\System\mtjkDFx.exe
  C:\Windows\System\mtjkDFx.exe
  2⤵
  PID:5756
- C:\Windows\System\JGLJNlR.exe
  C:\Windows\System\JGLJNlR.exe
  2⤵
  PID:5772
- C:\Windows\System\snfkmbF.exe
  C:\Windows\System\snfkmbF.exe
  2⤵
  PID:5788
- C:\Windows\System\SimRqsy.exe
  C:\Windows\System\SimRqsy.exe
  2⤵
  PID:5804
- C:\Windows\System\ioosBtI.exe
  C:\Windows\System\ioosBtI.exe
  2⤵
  PID:5820
- C:\Windows\System\iQmOuPj.exe
  C:\Windows\System\iQmOuPj.exe
  2⤵
  PID:5836
- C:\Windows\System\plzrmpH.exe
  C:\Windows\System\plzrmpH.exe
  2⤵
  PID:5852
- C:\Windows\System\TJnkreJ.exe
  C:\Windows\System\TJnkreJ.exe
  2⤵
  PID:5868
- C:\Windows\System\LugYDSz.exe
  C:\Windows\System\LugYDSz.exe
  2⤵
  PID:5884
- C:\Windows\System\EqYVLkB.exe
  C:\Windows\System\EqYVLkB.exe
  2⤵
  PID:5900
- C:\Windows\System\uzCETYG.exe
  C:\Windows\System\uzCETYG.exe
  2⤵
  PID:5916
- C:\Windows\System\gnjRaNv.exe
  C:\Windows\System\gnjRaNv.exe
  2⤵
  PID:5932
- C:\Windows\System\RwPanij.exe
  C:\Windows\System\RwPanij.exe
  2⤵
  PID:5948
- C:\Windows\System\vewwBbN.exe
  C:\Windows\System\vewwBbN.exe
  2⤵
  PID:5964
- C:\Windows\System\rUMyUOI.exe
  C:\Windows\System\rUMyUOI.exe
  2⤵
  PID:5980
- C:\Windows\System\DQmWKas.exe
  C:\Windows\System\DQmWKas.exe
  2⤵
  PID:5996
- C:\Windows\System\UwvVPkH.exe
  C:\Windows\System\UwvVPkH.exe
  2⤵
  PID:6012
- C:\Windows\System\tUPeUBS.exe
  C:\Windows\System\tUPeUBS.exe
  2⤵
  PID:6028
- C:\Windows\System\hxzPvxD.exe
  C:\Windows\System\hxzPvxD.exe
  2⤵
  PID:6044
- C:\Windows\System\PZvOqTx.exe
  C:\Windows\System\PZvOqTx.exe
  2⤵
  PID:6060
- C:\Windows\System\CqkktoE.exe
  C:\Windows\System\CqkktoE.exe
  2⤵
  PID:6076
- C:\Windows\System\WWGVbai.exe
  C:\Windows\System\WWGVbai.exe
  2⤵
  PID:6092
- C:\Windows\System\qRCqyEn.exe
  C:\Windows\System\qRCqyEn.exe
  2⤵
  PID:6108
- C:\Windows\System\CNLeoOk.exe
  C:\Windows\System\CNLeoOk.exe
  2⤵
  PID:6124
- C:\Windows\System\HdRhJwn.exe
  C:\Windows\System\HdRhJwn.exe
  2⤵
  PID:6140
- C:\Windows\System\hZBAvrY.exe
  C:\Windows\System\hZBAvrY.exe
  2⤵
  PID:4704
- C:\Windows\System\NcsQiKA.exe
  C:\Windows\System\NcsQiKA.exe
  2⤵
  PID:4064
- C:\Windows\System\ntgcBju.exe
  C:\Windows\System\ntgcBju.exe
  2⤵
  PID:4540
- C:\Windows\System\RJuQaqS.exe
  C:\Windows\System\RJuQaqS.exe
  2⤵
  PID:4108
- C:\Windows\System\VqpzaQP.exe
  C:\Windows\System\VqpzaQP.exe
  2⤵
  PID:4864
- C:\Windows\System\WjfYLUW.exe
  C:\Windows\System\WjfYLUW.exe
  2⤵
  PID:4620
- C:\Windows\System\TwPwSxy.exe
  C:\Windows\System\TwPwSxy.exe
  2⤵
  PID:4976
- C:\Windows\System\ACOiMco.exe
  C:\Windows\System\ACOiMco.exe
  2⤵
  PID:4768
- C:\Windows\System\JOGBaPF.exe
  C:\Windows\System\JOGBaPF.exe
  2⤵
  PID:5132
- C:\Windows\System\Ainlirm.exe
  C:\Windows\System\Ainlirm.exe
  2⤵
  PID:5184
- C:\Windows\System\GlHVBFg.exe
  C:\Windows\System\GlHVBFg.exe
  2⤵
  PID:5248
- C:\Windows\System\imjpqTx.exe
  C:\Windows\System\imjpqTx.exe
  2⤵
  PID:5168
- C:\Windows\System\mQFTGMX.exe
  C:\Windows\System\mQFTGMX.exe
  2⤵
  PID:5372
- C:\Windows\System\wbVwqdr.exe
  C:\Windows\System\wbVwqdr.exe
  2⤵
  PID:5440
- C:\Windows\System\cojMxhc.exe
  C:\Windows\System\cojMxhc.exe
  2⤵
  PID:5328
- C:\Windows\System\AkKTXcj.exe
  C:\Windows\System\AkKTXcj.exe
  2⤵
  PID:5392
- C:\Windows\System\jebVLHQ.exe
  C:\Windows\System\jebVLHQ.exe
  2⤵
  PID:5296
- C:\Windows\System\zZDXrOX.exe
  C:\Windows\System\zZDXrOX.exe
  2⤵
  PID:5424
- C:\Windows\System\PywbaHL.exe
  C:\Windows\System\PywbaHL.exe
  2⤵
  PID:5636
- C:\Windows\System\lvjjfMO.exe
  C:\Windows\System\lvjjfMO.exe
  2⤵
  PID:5732
- C:\Windows\System\PdqlYWX.exe
  C:\Windows\System\PdqlYWX.exe
  2⤵
  PID:5796
- C:\Windows\System\pIbOASP.exe
  C:\Windows\System\pIbOASP.exe
  2⤵
  PID:5860
- C:\Windows\System\gvxHQva.exe
  C:\Windows\System\gvxHQva.exe
  2⤵
  PID:5928
- C:\Windows\System\zHXfHHr.exe
  C:\Windows\System\zHXfHHr.exe
  2⤵
  PID:5892
- C:\Windows\System\QaSzqna.exe
  C:\Windows\System\QaSzqna.exe
  2⤵
  PID:5560
- C:\Windows\System\JwmcgTt.exe
  C:\Windows\System\JwmcgTt.exe
  2⤵
  PID:5556
- C:\Windows\System\sVuhoGt.exe
  C:\Windows\System\sVuhoGt.exe
  2⤵
  PID:5592
- C:\Windows\System\gCZjXqz.exe
  C:\Windows\System\gCZjXqz.exe
  2⤵
  PID:5652
- C:\Windows\System\lsrLkjo.exe
  C:\Windows\System\lsrLkjo.exe
  2⤵
  PID:5748
- C:\Windows\System\yjSyhLF.exe
  C:\Windows\System\yjSyhLF.exe
  2⤵
  PID:5816
- C:\Windows\System\Sskmrew.exe
  C:\Windows\System\Sskmrew.exe
  2⤵
  PID:5912
- C:\Windows\System\DCHNfZr.exe
  C:\Windows\System\DCHNfZr.exe
  2⤵
  PID:5976
- C:\Windows\System\xvlRiWQ.exe
  C:\Windows\System\xvlRiWQ.exe
  2⤵
  PID:6020
- C:\Windows\System\nYUKIoZ.exe
  C:\Windows\System\nYUKIoZ.exe
  2⤵
  PID:6084
- C:\Windows\System\UbbklBQ.exe
  C:\Windows\System\UbbklBQ.exe
  2⤵
  PID:6104
- C:\Windows\System\lwJBlhs.exe
  C:\Windows\System\lwJBlhs.exe
  2⤵
  PID:6068
- C:\Windows\System\xgYzPMf.exe
  C:\Windows\System\xgYzPMf.exe
  2⤵
  PID:4304
- C:\Windows\System\ZSDsCja.exe
  C:\Windows\System\ZSDsCja.exe
  2⤵
  PID:4524
- C:\Windows\System\KuKJzzQ.exe
  C:\Windows\System\KuKJzzQ.exe
  2⤵
  PID:3500
- C:\Windows\System\sgseMwG.exe
  C:\Windows\System\sgseMwG.exe
  2⤵
  PID:5344
- C:\Windows\System\arYKcRc.exe
  C:\Windows\System\arYKcRc.exe
  2⤵
  PID:5228
- C:\Windows\System\anCVIlk.exe
  C:\Windows\System\anCVIlk.exe
  2⤵
  PID:5456
- C:\Windows\System\tGdQkHj.exe
  C:\Windows\System\tGdQkHj.exe
  2⤵
  PID:5164
- C:\Windows\System\BVDLupY.exe
  C:\Windows\System\BVDLupY.exe
  2⤵
  PID:5152
- C:\Windows\System\MbgyUzO.exe
  C:\Windows\System\MbgyUzO.exe
  2⤵
  PID:4416
- C:\Windows\System\ctNGQlz.exe
  C:\Windows\System\ctNGQlz.exe
  2⤵
  PID:5180
- C:\Windows\System\snbcPHA.exe
  C:\Windows\System\snbcPHA.exe
  2⤵
  PID:5472
- C:\Windows\System\ckAuwyA.exe
  C:\Windows\System\ckAuwyA.exe
  2⤵
  PID:5536
- C:\Windows\System\ayUtgxs.exe
  C:\Windows\System\ayUtgxs.exe
  2⤵
  PID:5544
- C:\Windows\System\gEuXMXu.exe
  C:\Windows\System\gEuXMXu.exe
  2⤵
  PID:5700
- C:\Windows\System\btKpmPs.exe
  C:\Windows\System\btKpmPs.exe
  2⤵
  PID:5736
- C:\Windows\System\OIqeVyD.exe
  C:\Windows\System\OIqeVyD.exe
  2⤵
  PID:5844
- C:\Windows\System\AuikkGg.exe
  C:\Windows\System\AuikkGg.exe
  2⤵
  PID:5768
- C:\Windows\System\rQTGVgQ.exe
  C:\Windows\System\rQTGVgQ.exe
  2⤵
  PID:5620
- C:\Windows\System\BuQRpvt.exe
  C:\Windows\System\BuQRpvt.exe
  2⤵
  PID:6120
- C:\Windows\System\WqspgEZ.exe
  C:\Windows\System\WqspgEZ.exe
  2⤵
  PID:5988
- C:\Windows\System\zoyXESj.exe
  C:\Windows\System\zoyXESj.exe
  2⤵
  PID:5812
- C:\Windows\System\LDwtJfX.exe
  C:\Windows\System\LDwtJfX.exe
  2⤵
  PID:6056
- C:\Windows\System\CJDdwkw.exe
  C:\Windows\System\CJDdwkw.exe
  2⤵
  PID:3812
- C:\Windows\System\xFNtDNC.exe
  C:\Windows\System\xFNtDNC.exe
  2⤵
  PID:5292
- C:\Windows\System\YDVjajf.exe
  C:\Windows\System\YDVjajf.exe
  2⤵
  PID:3824
- C:\Windows\System\pEmNEnF.exe
  C:\Windows\System\pEmNEnF.exe
  2⤵
  PID:4928
- C:\Windows\System\yFQBwzc.exe
  C:\Windows\System\yFQBwzc.exe
  2⤵
  PID:4832
- C:\Windows\System\vXPKLSq.exe
  C:\Windows\System\vXPKLSq.exe
  2⤵
  PID:4224
- C:\Windows\System\anFPAFD.exe
  C:\Windows\System\anFPAFD.exe
  2⤵
  PID:5720
- C:\Windows\System\KkQPxAx.exe
  C:\Windows\System\KkQPxAx.exe
  2⤵
  PID:5624
- C:\Windows\System\YTRGYcK.exe
  C:\Windows\System\YTRGYcK.exe
  2⤵
  PID:6148
- C:\Windows\System\zTMDXgG.exe
  C:\Windows\System\zTMDXgG.exe
  2⤵
  PID:6164
- C:\Windows\System\CfvUObj.exe
  C:\Windows\System\CfvUObj.exe
  2⤵
  PID:6180
- C:\Windows\System\VqSmMDi.exe
  C:\Windows\System\VqSmMDi.exe
  2⤵
  PID:6196
- C:\Windows\System\esTtnrq.exe
  C:\Windows\System\esTtnrq.exe
  2⤵
  PID:6212
- C:\Windows\System\LwZznrt.exe
  C:\Windows\System\LwZznrt.exe
  2⤵
  PID:6228
- C:\Windows\System\JAQwgRi.exe
  C:\Windows\System\JAQwgRi.exe
  2⤵
  PID:6244
- C:\Windows\System\cbnXiLG.exe
  C:\Windows\System\cbnXiLG.exe
  2⤵
  PID:6260
- C:\Windows\System\vuPpKOm.exe
  C:\Windows\System\vuPpKOm.exe
  2⤵
  PID:6276
- C:\Windows\System\jpgCvDg.exe
  C:\Windows\System\jpgCvDg.exe
  2⤵
  PID:6292
- C:\Windows\System\rOBSgvA.exe
  C:\Windows\System\rOBSgvA.exe
  2⤵
  PID:6308
- C:\Windows\System\ZAEhUUB.exe
  C:\Windows\System\ZAEhUUB.exe
  2⤵
  PID:6324
- C:\Windows\System\OOjFnAY.exe
  C:\Windows\System\OOjFnAY.exe
  2⤵
  PID:6340
- C:\Windows\System\GIHDQKi.exe
  C:\Windows\System\GIHDQKi.exe
  2⤵
  PID:6356
- C:\Windows\System\JhGxWEq.exe
  C:\Windows\System\JhGxWEq.exe
  2⤵
  PID:6372
- C:\Windows\System\hfFgIYC.exe
  C:\Windows\System\hfFgIYC.exe
  2⤵
  PID:6388
- C:\Windows\System\UuVfwxD.exe
  C:\Windows\System\UuVfwxD.exe
  2⤵
  PID:6404
- C:\Windows\System\sHqnkVn.exe
  C:\Windows\System\sHqnkVn.exe
  2⤵
  PID:6420
- C:\Windows\System\OGfNpiv.exe
  C:\Windows\System\OGfNpiv.exe
  2⤵
  PID:6436
- C:\Windows\System\JrQhjgf.exe
  C:\Windows\System\JrQhjgf.exe
  2⤵
  PID:6452
- C:\Windows\System\uClgTMq.exe
  C:\Windows\System\uClgTMq.exe
  2⤵
  PID:6468
- C:\Windows\System\dUjWazF.exe
  C:\Windows\System\dUjWazF.exe
  2⤵
  PID:6484
- C:\Windows\System\sUCmxTo.exe
  C:\Windows\System\sUCmxTo.exe
  2⤵
  PID:6500
- C:\Windows\System\wZSXUKS.exe
  C:\Windows\System\wZSXUKS.exe
  2⤵
  PID:6516
- C:\Windows\System\htnVmNF.exe
  C:\Windows\System\htnVmNF.exe
  2⤵
  PID:6532
- C:\Windows\System\nPrbpqR.exe
  C:\Windows\System\nPrbpqR.exe
  2⤵
  PID:6548
- C:\Windows\System\TPQpLaH.exe
  C:\Windows\System\TPQpLaH.exe
  2⤵
  PID:6564
- C:\Windows\System\XzSjrQd.exe
  C:\Windows\System\XzSjrQd.exe
  2⤵
  PID:6580
- C:\Windows\System\zHRBmkB.exe
  C:\Windows\System\zHRBmkB.exe
  2⤵
  PID:6596
- C:\Windows\System\RlCswds.exe
  C:\Windows\System\RlCswds.exe
  2⤵
  PID:6612
- C:\Windows\System\uQVsZjL.exe
  C:\Windows\System\uQVsZjL.exe
  2⤵
  PID:6628
- C:\Windows\System\fPaQgVk.exe
  C:\Windows\System\fPaQgVk.exe
  2⤵
  PID:6644
- C:\Windows\System\dErVRKL.exe
  C:\Windows\System\dErVRKL.exe
  2⤵
  PID:6660
- C:\Windows\System\JfapcgA.exe
  C:\Windows\System\JfapcgA.exe
  2⤵
  PID:6676
- C:\Windows\System\HSrBcvY.exe
  C:\Windows\System\HSrBcvY.exe
  2⤵
  PID:6692
- C:\Windows\System\UXdGReD.exe
  C:\Windows\System\UXdGReD.exe
  2⤵
  PID:6708
- C:\Windows\System\kAAEwYj.exe
  C:\Windows\System\kAAEwYj.exe
  2⤵
  PID:6724
- C:\Windows\System\QlyeoXb.exe
  C:\Windows\System\QlyeoXb.exe
  2⤵
  PID:6740
- C:\Windows\System\Ityzudm.exe
  C:\Windows\System\Ityzudm.exe
  2⤵
  PID:6756
- C:\Windows\System\XAdrSNp.exe
  C:\Windows\System\XAdrSNp.exe
  2⤵
  PID:6772
- C:\Windows\System\MAOSAKf.exe
  C:\Windows\System\MAOSAKf.exe
  2⤵
  PID:6788
- C:\Windows\System\JSqPYUG.exe
  C:\Windows\System\JSqPYUG.exe
  2⤵
  PID:6804
- C:\Windows\System\MTBAKpO.exe
  C:\Windows\System\MTBAKpO.exe
  2⤵
  PID:6820
- C:\Windows\System\HDaNdye.exe
  C:\Windows\System\HDaNdye.exe
  2⤵
  PID:6836
- C:\Windows\System\XGmyvfw.exe
  C:\Windows\System\XGmyvfw.exe
  2⤵
  PID:6852
- C:\Windows\System\sCnacap.exe
  C:\Windows\System\sCnacap.exe
  2⤵
  PID:6868
- C:\Windows\System\IzRlwlV.exe
  C:\Windows\System\IzRlwlV.exe
  2⤵
  PID:6884
- C:\Windows\System\NAerQEn.exe
  C:\Windows\System\NAerQEn.exe
  2⤵
  PID:6900
- C:\Windows\System\UoGtWlA.exe
  C:\Windows\System\UoGtWlA.exe
  2⤵
  PID:6916
- C:\Windows\System\CkIjIlN.exe
  C:\Windows\System\CkIjIlN.exe
  2⤵
  PID:6932
- C:\Windows\System\QDbJczw.exe
  C:\Windows\System\QDbJczw.exe
  2⤵
  PID:6948
- C:\Windows\System\HyrFSWL.exe
  C:\Windows\System\HyrFSWL.exe
  2⤵
  PID:6964
- C:\Windows\System\KQuImzo.exe
  C:\Windows\System\KQuImzo.exe
  2⤵
  PID:6980
- C:\Windows\System\IxfcYMT.exe
  C:\Windows\System\IxfcYMT.exe
  2⤵
  PID:6996
- C:\Windows\System\VymzaQP.exe
  C:\Windows\System\VymzaQP.exe
  2⤵
  PID:7012
- C:\Windows\System\MUwxrnS.exe
  C:\Windows\System\MUwxrnS.exe
  2⤵
  PID:7028
- C:\Windows\System\iaabdBS.exe
  C:\Windows\System\iaabdBS.exe
  2⤵
  PID:7044
- C:\Windows\System\aMtrOkj.exe
  C:\Windows\System\aMtrOkj.exe
  2⤵
  PID:7060
- C:\Windows\System\lgEbBKt.exe
  C:\Windows\System\lgEbBKt.exe
  2⤵
  PID:7076
- C:\Windows\System\oJPkiqd.exe
  C:\Windows\System\oJPkiqd.exe
  2⤵
  PID:7092
- C:\Windows\System\JkUMASt.exe
  C:\Windows\System\JkUMASt.exe
  2⤵
  PID:7108
- C:\Windows\System\kQjDLkB.exe
  C:\Windows\System\kQjDLkB.exe
  2⤵
  PID:7124
- C:\Windows\System\ovTKQWa.exe
  C:\Windows\System\ovTKQWa.exe
  2⤵
  PID:7140
- C:\Windows\System\GZnQdXX.exe
  C:\Windows\System\GZnQdXX.exe
  2⤵
  PID:7156
- C:\Windows\System\ZDQeVph.exe
  C:\Windows\System\ZDQeVph.exe
  2⤵
  PID:4972
- C:\Windows\System\hGxHIgj.exe
  C:\Windows\System\hGxHIgj.exe
  2⤵
  PID:6208
- C:\Windows\System\WEyyCHl.exe
  C:\Windows\System\WEyyCHl.exe
  2⤵
  PID:5404
- C:\Windows\System\pejIMWH.exe
  C:\Windows\System\pejIMWH.exe
  2⤵
  PID:5672
- C:\Windows\System\IbfTkbv.exe
  C:\Windows\System\IbfTkbv.exe
  2⤵
  PID:5520
- C:\Windows\System\XIqPtuJ.exe
  C:\Windows\System\XIqPtuJ.exe
  2⤵
  PID:6052
- C:\Windows\System\pbvSJni.exe
  C:\Windows\System\pbvSJni.exe
  2⤵
  PID:5572
- C:\Windows\System\WYJiTYn.exe
  C:\Windows\System\WYJiTYn.exe
  2⤵
  PID:6160
- C:\Windows\System\pllVSvZ.exe
  C:\Windows\System\pllVSvZ.exe
  2⤵
  PID:6224
- C:\Windows\System\fUghFIp.exe
  C:\Windows\System\fUghFIp.exe
  2⤵
  PID:6272
- C:\Windows\System\LvYeegX.exe
  C:\Windows\System\LvYeegX.exe
  2⤵
  PID:6300
- C:\Windows\System\vuRGcHO.exe
  C:\Windows\System\vuRGcHO.exe
  2⤵
  PID:5436
- C:\Windows\System\rFqsSAt.exe
  C:\Windows\System\rFqsSAt.exe
  2⤵
  PID:6320
- C:\Windows\System\mGSxnMZ.exe
  C:\Windows\System\mGSxnMZ.exe
  2⤵
  PID:6428
- C:\Windows\System\EKmYXAb.exe
  C:\Windows\System\EKmYXAb.exe
  2⤵
  PID:6460
- C:\Windows\System\ReHnRsu.exe
  C:\Windows\System\ReHnRsu.exe
  2⤵
  PID:6524
- C:\Windows\System\QxAyhXL.exe
  C:\Windows\System\QxAyhXL.exe
  2⤵
  PID:6588
- C:\Windows\System\RPYBlFq.exe
  C:\Windows\System\RPYBlFq.exe
  2⤵
  PID:6592
- C:\Windows\System\jGQzscM.exe
  C:\Windows\System\jGQzscM.exe
  2⤵
  PID:6716
- C:\Windows\System\OsXERKm.exe
  C:\Windows\System\OsXERKm.exe
  2⤵
  PID:6780
- C:\Windows\System\eOUeErk.exe
  C:\Windows\System\eOUeErk.exe
  2⤵
  PID:6844
- C:\Windows\System\EPpNvXz.exe
  C:\Windows\System\EPpNvXz.exe
  2⤵
  PID:6908
- C:\Windows\System\ArngjbT.exe
  C:\Windows\System\ArngjbT.exe
  2⤵
  PID:6972
- C:\Windows\System\ufynZyt.exe
  C:\Windows\System\ufynZyt.exe
  2⤵
  PID:7036
- C:\Windows\System\jECpetS.exe
  C:\Windows\System\jECpetS.exe
  2⤵
  PID:6348
- C:\Windows\System\TYyfMMs.exe
  C:\Windows\System\TYyfMMs.exe
  2⤵
  PID:6540
- C:\Windows\System\reprzsk.exe
  C:\Windows\System\reprzsk.exe
  2⤵
  PID:6384
- C:\Windows\System\pKRfwJP.exe
  C:\Windows\System\pKRfwJP.exe
  2⤵
  PID:6448
- C:\Windows\System\QTdJAAM.exe
  C:\Windows\System\QTdJAAM.exe
  2⤵
  PID:6544
- C:\Windows\System\hjCOMSZ.exe
  C:\Windows\System\hjCOMSZ.exe
  2⤵
  PID:6608
- C:\Windows\System\EItZeth.exe
  C:\Windows\System\EItZeth.exe
  2⤵
  PID:6672
- C:\Windows\System\CGIfcUB.exe
  C:\Windows\System\CGIfcUB.exe
  2⤵
  PID:6704
- C:\Windows\System\bnVNIgq.exe
  C:\Windows\System\bnVNIgq.exe
  2⤵
  PID:6796
- C:\Windows\System\wabdrZH.exe
  C:\Windows\System\wabdrZH.exe
  2⤵
  PID:6860
- C:\Windows\System\gzQPDBz.exe
  C:\Windows\System\gzQPDBz.exe
  2⤵
  PID:6928
- C:\Windows\System\UKMwqta.exe
  C:\Windows\System\UKMwqta.exe
  2⤵
  PID:7020
- C:\Windows\System\ZKNIGoL.exe
  C:\Windows\System\ZKNIGoL.exe
  2⤵
  PID:7072
- C:\Windows\System\AMCOTyD.exe
  C:\Windows\System\AMCOTyD.exe
  2⤵
  PID:7132
- C:\Windows\System\zSPiqpZ.exe
  C:\Windows\System\zSPiqpZ.exe
  2⤵
  PID:6240
- C:\Windows\System\OFYPRTk.exe
  C:\Windows\System\OFYPRTk.exe
  2⤵
  PID:6176
- C:\Windows\System\gsMzDKT.exe
  C:\Windows\System\gsMzDKT.exe
  2⤵
  PID:7120
- C:\Windows\System\RTEwuAq.exe
  C:\Windows\System\RTEwuAq.exe
  2⤵
  PID:5576
- C:\Windows\System\futCxtD.exe
  C:\Windows\System\futCxtD.exe
  2⤵
  PID:6220
- C:\Windows\System\vLXfRDY.exe
  C:\Windows\System\vLXfRDY.exe
  2⤵
  PID:6316
- C:\Windows\System\NohmskW.exe
  C:\Windows\System\NohmskW.exe
  2⤵
  PID:5960
- C:\Windows\System\OVqSqjK.exe
  C:\Windows\System\OVqSqjK.exe
  2⤵
  PID:6284
- C:\Windows\System\PjpvrZz.exe
  C:\Windows\System\PjpvrZz.exe
  2⤵
  PID:6400
- C:\Windows\System\JBxRKcP.exe
  C:\Windows\System\JBxRKcP.exe
  2⤵
  PID:6688
- C:\Windows\System\xBAcIXc.exe
  C:\Windows\System\xBAcIXc.exe
  2⤵
  PID:6944
- C:\Windows\System\IEehstJ.exe
  C:\Windows\System\IEehstJ.exe
  2⤵
  PID:6352
- C:\Windows\System\vDcjNtm.exe
  C:\Windows\System\vDcjNtm.exe
  2⤵
  PID:6668
- C:\Windows\System\hxBbpkW.exe
  C:\Windows\System\hxBbpkW.exe
  2⤵
  PID:6768
- C:\Windows\System\qVPFmVQ.exe
  C:\Windows\System\qVPFmVQ.exe
  2⤵
  PID:7052
- C:\Windows\System\szXKKUE.exe
  C:\Windows\System\szXKKUE.exe
  2⤵
  PID:6416
- C:\Windows\System\fegHDrf.exe
  C:\Windows\System\fegHDrf.exe
  2⤵
  PID:6624
- C:\Windows\System\DOrmitZ.exe
  C:\Windows\System\DOrmitZ.exe
  2⤵
  PID:6880
- C:\Windows\System\SylQxPw.exe
  C:\Windows\System\SylQxPw.exe
  2⤵
  PID:5972
- C:\Windows\System\afVrhZh.exe
  C:\Windows\System\afVrhZh.exe
  2⤵
  PID:6988
- C:\Windows\System\dpLAdCd.exe
  C:\Windows\System\dpLAdCd.exe
  2⤵
  PID:7004
- C:\Windows\System\shLxiFi.exe
  C:\Windows\System\shLxiFi.exe
  2⤵
  PID:7104
- C:\Windows\System\DzosyvN.exe
  C:\Windows\System\DzosyvN.exe
  2⤵
  PID:6864
- C:\Windows\System\uCoSGSv.exe
  C:\Windows\System\uCoSGSv.exe
  2⤵
  PID:6512
- C:\Windows\System\qGnzCjU.exe
  C:\Windows\System\qGnzCjU.exe
  2⤵
  PID:6156
- C:\Windows\System\ExLqZNf.exe
  C:\Windows\System\ExLqZNf.exe
  2⤵
  PID:5908
- C:\Windows\System\LRQipSX.exe
  C:\Windows\System\LRQipSX.exe
  2⤵
  PID:6444
- C:\Windows\System\lJSkqGG.exe
  C:\Windows\System\lJSkqGG.exe
  2⤵
  PID:6764
- C:\Windows\System\genJTpB.exe
  C:\Windows\System\genJTpB.exe
  2⤵
  PID:1812
- C:\Windows\System\xAVlvVS.exe
  C:\Windows\System\xAVlvVS.exe
  2⤵
  PID:6700
- C:\Windows\System\ovCZiCG.exe
  C:\Windows\System\ovCZiCG.exe
  2⤵
  PID:7088
- C:\Windows\System\rqRatha.exe
  C:\Windows\System\rqRatha.exe
  2⤵
  PID:6368
- C:\Windows\System\CNRPMqW.exe
  C:\Windows\System\CNRPMqW.exe
  2⤵
  PID:6380
- C:\Windows\System\nFkmwfK.exe
  C:\Windows\System\nFkmwfK.exe
  2⤵
  PID:6652
- C:\Windows\System\zCcMMBz.exe
  C:\Windows\System\zCcMMBz.exe
  2⤵
  PID:5196
- C:\Windows\System\mngwgQE.exe
  C:\Windows\System\mngwgQE.exe
  2⤵
  PID:7184
- C:\Windows\System\xYufdPD.exe
  C:\Windows\System\xYufdPD.exe
  2⤵
  PID:7200
- C:\Windows\System\VXslzKi.exe
  C:\Windows\System\VXslzKi.exe
  2⤵
  PID:7216
- C:\Windows\System\CDtctvY.exe
  C:\Windows\System\CDtctvY.exe
  2⤵
  PID:7232
- C:\Windows\System\BmHCRSv.exe
  C:\Windows\System\BmHCRSv.exe
  2⤵
  PID:7248
- C:\Windows\System\HEEKPgA.exe
  C:\Windows\System\HEEKPgA.exe
  2⤵
  PID:7264
- C:\Windows\System\gpwLLft.exe
  C:\Windows\System\gpwLLft.exe
  2⤵
  PID:7280
- C:\Windows\System\JKFVwRD.exe
  C:\Windows\System\JKFVwRD.exe
  2⤵
  PID:7296
- C:\Windows\System\prJDrHO.exe
  C:\Windows\System\prJDrHO.exe
  2⤵
  PID:7312
- C:\Windows\System\zzlpfAb.exe
  C:\Windows\System\zzlpfAb.exe
  2⤵
  PID:7328
- C:\Windows\System\wzsOicI.exe
  C:\Windows\System\wzsOicI.exe
  2⤵
  PID:7344
- C:\Windows\System\haTphwb.exe
  C:\Windows\System\haTphwb.exe
  2⤵
  PID:7360
- C:\Windows\System\IPkbbbw.exe
  C:\Windows\System\IPkbbbw.exe
  2⤵
  PID:7376
- C:\Windows\System\WwRcDzN.exe
  C:\Windows\System\WwRcDzN.exe
  2⤵
  PID:7392
- C:\Windows\System\KFVpDFu.exe
  C:\Windows\System\KFVpDFu.exe
  2⤵
  PID:7408
- C:\Windows\System\OofTBMp.exe
  C:\Windows\System\OofTBMp.exe
  2⤵
  PID:7424
- C:\Windows\System\PNgRccB.exe
  C:\Windows\System\PNgRccB.exe
  2⤵
  PID:7440
- C:\Windows\System\iOtWLEX.exe
  C:\Windows\System\iOtWLEX.exe
  2⤵
  PID:7456
- C:\Windows\System\XGhvEKq.exe
  C:\Windows\System\XGhvEKq.exe
  2⤵
  PID:7472
- C:\Windows\System\nOJmQyI.exe
  C:\Windows\System\nOJmQyI.exe
  2⤵
  PID:7488
- C:\Windows\System\EfgzymJ.exe
  C:\Windows\System\EfgzymJ.exe
  2⤵
  PID:7504
- C:\Windows\System\OxsapOb.exe
  C:\Windows\System\OxsapOb.exe
  2⤵
  PID:7520
- C:\Windows\System\sgdHBdc.exe
  C:\Windows\System\sgdHBdc.exe
  2⤵
  PID:7536
- C:\Windows\System\OockJZx.exe
  C:\Windows\System\OockJZx.exe
  2⤵
  PID:7552
- C:\Windows\System\hJIPvda.exe
  C:\Windows\System\hJIPvda.exe
  2⤵
  PID:7568
- C:\Windows\System\AFGbukP.exe
  C:\Windows\System\AFGbukP.exe
  2⤵
  PID:7584
- C:\Windows\System\BIhAyFK.exe
  C:\Windows\System\BIhAyFK.exe
  2⤵
  PID:7600
- C:\Windows\System\pQyqomw.exe
  C:\Windows\System\pQyqomw.exe
  2⤵
  PID:7616
- C:\Windows\System\ppEYxRj.exe
  C:\Windows\System\ppEYxRj.exe
  2⤵
  PID:7632
- C:\Windows\System\OVRthFa.exe
  C:\Windows\System\OVRthFa.exe
  2⤵
  PID:7648
- C:\Windows\System\caubxQk.exe
  C:\Windows\System\caubxQk.exe
  2⤵
  PID:7664
- C:\Windows\System\ZOEDhpr.exe
  C:\Windows\System\ZOEDhpr.exe
  2⤵
  PID:7680
- C:\Windows\System\nkaaRLf.exe
  C:\Windows\System\nkaaRLf.exe
  2⤵
  PID:7696
- C:\Windows\System\NhmaMTX.exe
  C:\Windows\System\NhmaMTX.exe
  2⤵
  PID:7712
- C:\Windows\System\YJfsHQH.exe
  C:\Windows\System\YJfsHQH.exe
  2⤵
  PID:7728
- C:\Windows\System\GHIGGgW.exe
  C:\Windows\System\GHIGGgW.exe
  2⤵
  PID:7744
- C:\Windows\System\QOUdrXW.exe
  C:\Windows\System\QOUdrXW.exe
  2⤵
  PID:7760
- C:\Windows\System\vdZxEuw.exe
  C:\Windows\System\vdZxEuw.exe
  2⤵
  PID:7776
- C:\Windows\System\vWsfQpY.exe
  C:\Windows\System\vWsfQpY.exe
  2⤵
  PID:7792
- C:\Windows\System\WxfJRyz.exe
  C:\Windows\System\WxfJRyz.exe
  2⤵
  PID:7808
- C:\Windows\System\CQjkYgS.exe
  C:\Windows\System\CQjkYgS.exe
  2⤵
  PID:7824
- C:\Windows\System\AMoWKCi.exe
  C:\Windows\System\AMoWKCi.exe
  2⤵
  PID:7840
- C:\Windows\System\PzAorSR.exe
  C:\Windows\System\PzAorSR.exe
  2⤵
  PID:7856
- C:\Windows\System\gLsiAuC.exe
  C:\Windows\System\gLsiAuC.exe
  2⤵
  PID:7872
- C:\Windows\System\QDVggAF.exe
  C:\Windows\System\QDVggAF.exe
  2⤵
  PID:7888
- C:\Windows\System\zozxaBb.exe
  C:\Windows\System\zozxaBb.exe
  2⤵
  PID:7904
- C:\Windows\System\BsTMSFn.exe
  C:\Windows\System\BsTMSFn.exe
  2⤵
  PID:7920
- C:\Windows\System\zfLMXtu.exe
  C:\Windows\System\zfLMXtu.exe
  2⤵
  PID:7936
- C:\Windows\System\tKBXZZV.exe
  C:\Windows\System\tKBXZZV.exe
  2⤵
  PID:7952
- C:\Windows\System\TXhWdBP.exe
  C:\Windows\System\TXhWdBP.exe
  2⤵
  PID:7968
- C:\Windows\System\BuwuVMS.exe
  C:\Windows\System\BuwuVMS.exe
  2⤵
  PID:7984
- C:\Windows\System\jDcqnCi.exe
  C:\Windows\System\jDcqnCi.exe
  2⤵
  PID:8000
- C:\Windows\System\wPvtgFm.exe
  C:\Windows\System\wPvtgFm.exe
  2⤵
  PID:8016
- C:\Windows\System\oGcPbxi.exe
  C:\Windows\System\oGcPbxi.exe
  2⤵
  PID:8032
- C:\Windows\System\dmigGpg.exe
  C:\Windows\System\dmigGpg.exe
  2⤵
  PID:8048
- C:\Windows\System\iFatrEO.exe
  C:\Windows\System\iFatrEO.exe
  2⤵
  PID:8064
- C:\Windows\System\kYKaImH.exe
  C:\Windows\System\kYKaImH.exe
  2⤵
  PID:8084
- C:\Windows\System\tUpqsOW.exe
  C:\Windows\System\tUpqsOW.exe
  2⤵
  PID:8100
- C:\Windows\System\mtxVUUe.exe
  C:\Windows\System\mtxVUUe.exe
  2⤵
  PID:8116
- C:\Windows\System\TDxVpTW.exe
  C:\Windows\System\TDxVpTW.exe
  2⤵
  PID:8132
- C:\Windows\System\oKOUHcl.exe
  C:\Windows\System\oKOUHcl.exe
  2⤵
  PID:8148
- C:\Windows\System\zVfjbEy.exe
  C:\Windows\System\zVfjbEy.exe
  2⤵
  PID:8164
- C:\Windows\System\zuezWxr.exe
  C:\Windows\System\zuezWxr.exe
  2⤵
  PID:8180
- C:\Windows\System\apRphLw.exe
  C:\Windows\System\apRphLw.exe
  2⤵
  PID:6684
- C:\Windows\System\MXQJLWU.exe
  C:\Windows\System\MXQJLWU.exe
  2⤵
  PID:7196
- C:\Windows\System\qaEJFph.exe
  C:\Windows\System\qaEJFph.exe
  2⤵
  PID:7260
- C:\Windows\System\AWkccVS.exe
  C:\Windows\System\AWkccVS.exe
  2⤵
  PID:5604
- C:\Windows\System\cebNBLM.exe
  C:\Windows\System\cebNBLM.exe
  2⤵
  PID:7320
- C:\Windows\System\SNBiNxF.exe
  C:\Windows\System\SNBiNxF.exe
  2⤵
  PID:6816
- C:\Windows\System\nBUzutZ.exe
  C:\Windows\System\nBUzutZ.exe
  2⤵
  PID:7212
- C:\Windows\System\VMtQRbw.exe
  C:\Windows\System\VMtQRbw.exe
  2⤵
  PID:7272
- C:\Windows\System\DYzaOMm.exe
  C:\Windows\System\DYzaOMm.exe
  2⤵
  PID:7336
- C:\Windows\System\LzvDmqU.exe
  C:\Windows\System\LzvDmqU.exe
  2⤵
  PID:7388
- C:\Windows\System\BDtleWf.exe
  C:\Windows\System\BDtleWf.exe
  2⤵
  PID:7452
- C:\Windows\System\WsOaxLn.exe
  C:\Windows\System\WsOaxLn.exe
  2⤵
  PID:7400
- C:\Windows\System\biupHLs.exe
  C:\Windows\System\biupHLs.exe
  2⤵
  PID:7432
- C:\Windows\System\IyZQFgE.exe
  C:\Windows\System\IyZQFgE.exe
  2⤵
  PID:7512
- C:\Windows\System\DnJwFom.exe
  C:\Windows\System\DnJwFom.exe
  2⤵
  PID:7576
- C:\Windows\System\OIcLxiI.exe
  C:\Windows\System\OIcLxiI.exe
  2⤵
  PID:7640
- C:\Windows\System\ZbpBXYl.exe
  C:\Windows\System\ZbpBXYl.exe
  2⤵
  PID:7676
- C:\Windows\System\VqhcEzY.exe
  C:\Windows\System\VqhcEzY.exe
  2⤵
  PID:7596
- C:\Windows\System\wpZfYKA.exe
  C:\Windows\System\wpZfYKA.exe
  2⤵
  PID:7624
- C:\Windows\System\SRDFubo.exe
  C:\Windows\System\SRDFubo.exe
  2⤵
  PID:7688
- C:\Windows\System\sGEYQuu.exe
  C:\Windows\System\sGEYQuu.exe
  2⤵
  PID:7740
- C:\Windows\System\ZswvDiN.exe
  C:\Windows\System\ZswvDiN.exe
  2⤵
  PID:7804
- C:\Windows\System\JgkeooZ.exe
  C:\Windows\System\JgkeooZ.exe
  2⤵
  PID:7816
- C:\Windows\System\QTxxuIw.exe
  C:\Windows\System\QTxxuIw.exe
  2⤵
  PID:7820
- C:\Windows\System\hzMLAWj.exe
  C:\Windows\System\hzMLAWj.exe
  2⤵
  PID:7900
- C:\Windows\System\dMgSMuc.exe
  C:\Windows\System\dMgSMuc.exe
  2⤵
  PID:5608
- C:\Windows\System\ODXYNKh.exe
  C:\Windows\System\ODXYNKh.exe
  2⤵
  PID:7964
- C:\Windows\System\GnsYhwh.exe
  C:\Windows\System\GnsYhwh.exe
  2⤵
  PID:8028
- C:\Windows\System\bSnYbZr.exe
  C:\Windows\System\bSnYbZr.exe
  2⤵
  PID:8060
- C:\Windows\System\GdTCBgz.exe
  C:\Windows\System\GdTCBgz.exe
  2⤵
  PID:7884
- C:\Windows\System\muIaehM.exe
  C:\Windows\System\muIaehM.exe
  2⤵
  PID:7916
- C:\Windows\System\ZrgxFPl.exe
  C:\Windows\System\ZrgxFPl.exe
  2⤵
  PID:8188
- C:\Windows\System\nKGHFBK.exe
  C:\Windows\System\nKGHFBK.exe
  2⤵
  PID:7976
- C:\Windows\System\gKrhpQu.exe
  C:\Windows\System\gKrhpQu.exe
  2⤵
  PID:7228
- C:\Windows\System\hRBjUkf.exe
  C:\Windows\System\hRBjUkf.exe
  2⤵
  PID:7420
- C:\Windows\System\tBQFPFd.exe
  C:\Windows\System\tBQFPFd.exe
  2⤵
  PID:7180
- C:\Windows\System\ttPDEqz.exe
  C:\Windows\System\ttPDEqz.exe
  2⤵
  PID:7484
- C:\Windows\System\vxzXTYu.exe
  C:\Windows\System\vxzXTYu.exe
  2⤵
  PID:8076
- C:\Windows\System\vtYmoWZ.exe
  C:\Windows\System\vtYmoWZ.exe
  2⤵
  PID:7560
- C:\Windows\System\gjnPilO.exe
  C:\Windows\System\gjnPilO.exe
  2⤵
  PID:7836
- C:\Windows\System\dDwToAW.exe
  C:\Windows\System\dDwToAW.exe
  2⤵
  PID:7960
- C:\Windows\System\BkEgtNF.exe
  C:\Windows\System\BkEgtNF.exe
  2⤵
  PID:8124
- C:\Windows\System\shgaEtn.exe
  C:\Windows\System\shgaEtn.exe
  2⤵
  PID:7948
- C:\Windows\System\lkNgrNL.exe
  C:\Windows\System\lkNgrNL.exe
  2⤵
  PID:8108
- C:\Windows\System\pVBlCgq.exe
  C:\Windows\System\pVBlCgq.exe
  2⤵
  PID:7608
- C:\Windows\System\gNZwnNO.exe
  C:\Windows\System\gNZwnNO.exe
  2⤵
  PID:7656
- C:\Windows\System\jFUzMnO.exe
  C:\Windows\System\jFUzMnO.exe
  2⤵
  PID:7448
- C:\Windows\System\djFLPPq.exe
  C:\Windows\System\djFLPPq.exe
  2⤵
  PID:8176
- C:\Windows\System\NPyPwKz.exe
  C:\Windows\System\NPyPwKz.exe
  2⤵
  PID:7192
- C:\Windows\System\CCElayS.exe
  C:\Windows\System\CCElayS.exe
  2⤵
  PID:6336
- C:\Windows\System\MIqxbuq.exe
  C:\Windows\System\MIqxbuq.exe
  2⤵
  PID:7592
- C:\Windows\System\OaaSinu.exe
  C:\Windows\System\OaaSinu.exe
  2⤵
  PID:8024
- C:\Windows\System\SzvdGzM.exe
  C:\Windows\System\SzvdGzM.exe
  2⤵
  PID:8160
- C:\Windows\System\bCjzITz.exe
  C:\Windows\System\bCjzITz.exe
  2⤵
  PID:7480
- C:\Windows\System\EsvvHqw.exe
  C:\Windows\System\EsvvHqw.exe
  2⤵
  PID:7896
- C:\Windows\System\UzcwUgj.exe
  C:\Windows\System\UzcwUgj.exe
  2⤵
  PID:8112
- C:\Windows\System\qvOWcdo.exe
  C:\Windows\System\qvOWcdo.exe
  2⤵
  PID:7736
- C:\Windows\System\dbSiTkR.exe
  C:\Windows\System\dbSiTkR.exe
  2⤵
  PID:7496
- C:\Windows\System\NWeLuYU.exe
  C:\Windows\System\NWeLuYU.exe
  2⤵
  PID:7784
- C:\Windows\System\IICEIQx.exe
  C:\Windows\System\IICEIQx.exe
  2⤵
  PID:7356
- C:\Windows\System\VfAvgRQ.exe
  C:\Windows\System\VfAvgRQ.exe
  2⤵
  PID:7880
- C:\Windows\System\OBUKdgR.exe
  C:\Windows\System\OBUKdgR.exe
  2⤵
  PID:7772
- C:\Windows\System\iHcefmV.exe
  C:\Windows\System\iHcefmV.exe
  2⤵
  PID:8204
- C:\Windows\System\NHwZxZi.exe
  C:\Windows\System\NHwZxZi.exe
  2⤵
  PID:8220
- C:\Windows\System\KqkaNYF.exe
  C:\Windows\System\KqkaNYF.exe
  2⤵
  PID:8236
- C:\Windows\System\MqHjHmK.exe
  C:\Windows\System\MqHjHmK.exe
  2⤵
  PID:8252
- C:\Windows\System\OPCgNNJ.exe
  C:\Windows\System\OPCgNNJ.exe
  2⤵
  PID:8268
- C:\Windows\System\zgmGsMC.exe
  C:\Windows\System\zgmGsMC.exe
  2⤵
  PID:8284
- C:\Windows\System\ZBqXeKi.exe
  C:\Windows\System\ZBqXeKi.exe
  2⤵
  PID:8300
- C:\Windows\System\ndJeUgT.exe
  C:\Windows\System\ndJeUgT.exe
  2⤵
  PID:8316
- C:\Windows\System\LoBkDCK.exe
  C:\Windows\System\LoBkDCK.exe
  2⤵
  PID:8332
- C:\Windows\System\uzRzIie.exe
  C:\Windows\System\uzRzIie.exe
  2⤵
  PID:8348
- C:\Windows\System\GdbXXix.exe
  C:\Windows\System\GdbXXix.exe
  2⤵
  PID:8364
- C:\Windows\System\EXAMVws.exe
  C:\Windows\System\EXAMVws.exe
  2⤵
  PID:8380
- C:\Windows\System\HcpGCaO.exe
  C:\Windows\System\HcpGCaO.exe
  2⤵
  PID:8396
- C:\Windows\System\cnuSiRl.exe
  C:\Windows\System\cnuSiRl.exe
  2⤵
  PID:8412
- C:\Windows\System\DKoblwy.exe
  C:\Windows\System\DKoblwy.exe
  2⤵
  PID:8428
- C:\Windows\System\VTvAaAh.exe
  C:\Windows\System\VTvAaAh.exe
  2⤵
  PID:8444
- C:\Windows\System\WRrPvwj.exe
  C:\Windows\System\WRrPvwj.exe
  2⤵
  PID:8460
- C:\Windows\System\jePDweY.exe
  C:\Windows\System\jePDweY.exe
  2⤵
  PID:8476
- C:\Windows\System\NoNmrME.exe
  C:\Windows\System\NoNmrME.exe
  2⤵
  PID:8492
- C:\Windows\System\uYGUZvI.exe
  C:\Windows\System\uYGUZvI.exe
  2⤵
  PID:8508
- C:\Windows\System\spxtxCu.exe
  C:\Windows\System\spxtxCu.exe
  2⤵
  PID:8524
- C:\Windows\System\tRmLXwx.exe
  C:\Windows\System\tRmLXwx.exe
  2⤵
  PID:8540
- C:\Windows\System\tazLVxp.exe
  C:\Windows\System\tazLVxp.exe
  2⤵
  PID:8556
- C:\Windows\System\qEVfjrJ.exe
  C:\Windows\System\qEVfjrJ.exe
  2⤵
  PID:8572
- C:\Windows\System\daiuRdO.exe
  C:\Windows\System\daiuRdO.exe
  2⤵
  PID:8588
- C:\Windows\System\jeCvsdS.exe
  C:\Windows\System\jeCvsdS.exe
  2⤵
  PID:8604
- C:\Windows\System\EhfEnMZ.exe
  C:\Windows\System\EhfEnMZ.exe
  2⤵
  PID:8620
- C:\Windows\System\grwWFlD.exe
  C:\Windows\System\grwWFlD.exe
  2⤵
  PID:8636
- C:\Windows\System\PJAuqlI.exe
  C:\Windows\System\PJAuqlI.exe
  2⤵
  PID:8652
- C:\Windows\System\IFICCoE.exe
  C:\Windows\System\IFICCoE.exe
  2⤵
  PID:8672
- C:\Windows\System\cAbUjnc.exe
  C:\Windows\System\cAbUjnc.exe
  2⤵
  PID:8688
- C:\Windows\System\kuQnMQW.exe
  C:\Windows\System\kuQnMQW.exe
  2⤵
  PID:8704
- C:\Windows\System\adurqOd.exe
  C:\Windows\System\adurqOd.exe
  2⤵
  PID:8720
- C:\Windows\System\tNCQyDs.exe
  C:\Windows\System\tNCQyDs.exe
  2⤵
  PID:8736
- C:\Windows\System\pFllAFF.exe
  C:\Windows\System\pFllAFF.exe
  2⤵
  PID:8752
- C:\Windows\System\vbMaFXX.exe
  C:\Windows\System\vbMaFXX.exe
  2⤵
  PID:8768
- C:\Windows\System\kVJdlfm.exe
  C:\Windows\System\kVJdlfm.exe
  2⤵
  PID:8784
- C:\Windows\System\rzbUfvy.exe
  C:\Windows\System\rzbUfvy.exe
  2⤵
  PID:8800
- C:\Windows\System\PMtODVa.exe
  C:\Windows\System\PMtODVa.exe
  2⤵
  PID:8816
- C:\Windows\System\OjYMZAh.exe
  C:\Windows\System\OjYMZAh.exe
  2⤵
  PID:8832
- C:\Windows\System\ATQKbvl.exe
  C:\Windows\System\ATQKbvl.exe
  2⤵
  PID:8848
- C:\Windows\System\PclMqHb.exe
  C:\Windows\System\PclMqHb.exe
  2⤵
  PID:8864
- C:\Windows\System\HLrXSXZ.exe
  C:\Windows\System\HLrXSXZ.exe
  2⤵
  PID:8880
- C:\Windows\System\EsFduAp.exe
  C:\Windows\System\EsFduAp.exe
  2⤵
  PID:8896
- C:\Windows\System\SCswObi.exe
  C:\Windows\System\SCswObi.exe
  2⤵
  PID:8912
- C:\Windows\System\cOQsSHN.exe
  C:\Windows\System\cOQsSHN.exe
  2⤵
  PID:8928
- C:\Windows\System\krBhpsv.exe
  C:\Windows\System\krBhpsv.exe
  2⤵
  PID:8944
- C:\Windows\System\hhSoyJu.exe
  C:\Windows\System\hhSoyJu.exe
  2⤵
  PID:8960
- C:\Windows\System\fILDdqh.exe
  C:\Windows\System\fILDdqh.exe
  2⤵
  PID:8976
- C:\Windows\System\olsjMfH.exe
  C:\Windows\System\olsjMfH.exe
  2⤵
  PID:8992
- C:\Windows\System\fFLZjAw.exe
  C:\Windows\System\fFLZjAw.exe
  2⤵
  PID:9008
- C:\Windows\System\atvzjWp.exe
  C:\Windows\System\atvzjWp.exe
  2⤵
  PID:9024
- C:\Windows\System\MughcKP.exe
  C:\Windows\System\MughcKP.exe
  2⤵
  PID:9040
- C:\Windows\System\UwmmyzC.exe
  C:\Windows\System\UwmmyzC.exe
  2⤵
  PID:9056
- C:\Windows\System\wTWAxzo.exe
  C:\Windows\System\wTWAxzo.exe
  2⤵
  PID:9072
- C:\Windows\System\aTGvPeh.exe
  C:\Windows\System\aTGvPeh.exe
  2⤵
  PID:9088
- C:\Windows\System\cBQStsh.exe
  C:\Windows\System\cBQStsh.exe
  2⤵
  PID:9104
- C:\Windows\System\qQGFfoo.exe
  C:\Windows\System\qQGFfoo.exe
  2⤵
  PID:9120
- C:\Windows\System\OwjDwbR.exe
  C:\Windows\System\OwjDwbR.exe
  2⤵
  PID:9136
- C:\Windows\System\SveafdN.exe
  C:\Windows\System\SveafdN.exe
  2⤵
  PID:9152
- C:\Windows\System\jwOaxxp.exe
  C:\Windows\System\jwOaxxp.exe
  2⤵
  PID:9168
- C:\Windows\System\iYuWzEH.exe
  C:\Windows\System\iYuWzEH.exe
  2⤵
  PID:9184
- C:\Windows\System\dPapYic.exe
  C:\Windows\System\dPapYic.exe
  2⤵
  PID:9200
- C:\Windows\System\MJXmBfw.exe
  C:\Windows\System\MJXmBfw.exe
  2⤵
  PID:8144
- C:\Windows\System\gPKdDtY.exe
  C:\Windows\System\gPKdDtY.exe
  2⤵
  PID:8196
- C:\Windows\System\ZAxNICG.exe
  C:\Windows\System\ZAxNICG.exe
  2⤵
  PID:8232
- C:\Windows\System\ieEDnOy.exe
  C:\Windows\System\ieEDnOy.exe
  2⤵
  PID:8296
- C:\Windows\System\eaayzoN.exe
  C:\Windows\System\eaayzoN.exe
  2⤵
  PID:8388
- C:\Windows\System\MBjhWyG.exe
  C:\Windows\System\MBjhWyG.exe
  2⤵
  PID:8420
- C:\Windows\System\zXyLbkp.exe
  C:\Windows\System\zXyLbkp.exe
  2⤵
  PID:8244
- C:\Windows\System\cojarfK.exe
  C:\Windows\System\cojarfK.exe
  2⤵
  PID:7240
- C:\Windows\System\EkrkJSk.exe
  C:\Windows\System\EkrkJSk.exe
  2⤵
  PID:7532
- C:\Windows\System\whMnvqu.exe
  C:\Windows\System\whMnvqu.exe
  2⤵
  PID:8276
- C:\Windows\System\UehKzjV.exe
  C:\Windows\System\UehKzjV.exe
  2⤵
  PID:8452
- C:\Windows\System\JAFaqhv.exe
  C:\Windows\System\JAFaqhv.exe
  2⤵
  PID:8372
- C:\Windows\System\MnwiNcd.exe
  C:\Windows\System\MnwiNcd.exe
  2⤵
  PID:8436
- C:\Windows\System\zdtMTUR.exe
  C:\Windows\System\zdtMTUR.exe
  2⤵
  PID:8468
- C:\Windows\System\UYDhvAq.exe
  C:\Windows\System\UYDhvAq.exe
  2⤵
  PID:8532
- C:\Windows\System\KCKRwQu.exe
  C:\Windows\System\KCKRwQu.exe
  2⤵
  PID:8548
- C:\Windows\System\OyvYaAd.exe
  C:\Windows\System\OyvYaAd.exe
  2⤵
  PID:8612
- C:\Windows\System\sRTyzVE.exe
  C:\Windows\System\sRTyzVE.exe
  2⤵
  PID:6396
- C:\Windows\System\ooVrXXh.exe
  C:\Windows\System\ooVrXXh.exe
  2⤵
  PID:8628
- C:\Windows\System\GvraiYn.exe
  C:\Windows\System\GvraiYn.exe
  2⤵
  PID:8668
- C:\Windows\System\ZxXqbuB.exe
  C:\Windows\System\ZxXqbuB.exe
  2⤵
  PID:8596
- C:\Windows\System\TAYPvUe.exe
  C:\Windows\System\TAYPvUe.exe
  2⤵
  PID:8696
- C:\Windows\System\uMDfyer.exe
  C:\Windows\System\uMDfyer.exe
  2⤵
  PID:8796
- C:\Windows\System\DSeASNm.exe
  C:\Windows\System\DSeASNm.exe
  2⤵
  PID:8844
- C:\Windows\System\kzwdlgg.exe
  C:\Windows\System\kzwdlgg.exe
  2⤵
  PID:8828
- C:\Windows\System\hGpsgzL.exe
  C:\Windows\System\hGpsgzL.exe
  2⤵
  PID:8888
- C:\Windows\System\IyyXzIx.exe
  C:\Windows\System\IyyXzIx.exe
  2⤵
  PID:8956
- C:\Windows\System\FETpoKi.exe
  C:\Windows\System\FETpoKi.exe
  2⤵
  PID:9064
- C:\Windows\System\CSfzbnI.exe
  C:\Windows\System\CSfzbnI.exe
  2⤵
  PID:9080
- C:\Windows\System\CfcJXzZ.exe
  C:\Windows\System\CfcJXzZ.exe
  2⤵
  PID:9112
- C:\Windows\System\eRWMSHr.exe
  C:\Windows\System\eRWMSHr.exe
  2⤵
  PID:9192
- C:\Windows\System\bibBPLP.exe
  C:\Windows\System\bibBPLP.exe
  2⤵
  PID:9176
- C:\Windows\System\zWuTpDZ.exe
  C:\Windows\System\zWuTpDZ.exe
  2⤵
  PID:9212
- C:\Windows\System\rCwjVDG.exe
  C:\Windows\System\rCwjVDG.exe
  2⤵
  PID:8392
- C:\Windows\System\bCbsceZ.exe
  C:\Windows\System\bCbsceZ.exe
  2⤵
  PID:8248
- C:\Windows\System\HtyDaJc.exe
  C:\Windows\System\HtyDaJc.exe
  2⤵
  PID:8356
- C:\Windows\System\ZRZXqsp.exe
  C:\Windows\System\ZRZXqsp.exe
  2⤵
  PID:8340
- C:\Windows\System\mIYUKvK.exe
  C:\Windows\System\mIYUKvK.exe
  2⤵
  PID:8344
- C:\Windows\System\lzjqpYX.exe
  C:\Windows\System\lzjqpYX.exe
  2⤵
  PID:8500
- C:\Windows\System\jPaSSQG.exe
  C:\Windows\System\jPaSSQG.exe
  2⤵
  PID:8516
- C:\Windows\System\KTaIKpo.exe
  C:\Windows\System\KTaIKpo.exe
  2⤵
  PID:8080
- C:\Windows\System\FnCRcwV.exe
  C:\Windows\System\FnCRcwV.exe
  2⤵
  PID:8684
- C:\Windows\System\JBjVZuE.exe
  C:\Windows\System\JBjVZuE.exe
  2⤵
  PID:8812
- C:\Windows\System\bhESbBj.exe
  C:\Windows\System\bhESbBj.exe
  2⤵
  PID:8780
- C:\Windows\System\FkZExpf.exe
  C:\Windows\System\FkZExpf.exe
  2⤵
  PID:8764
- C:\Windows\System\PHzatGX.exe
  C:\Windows\System\PHzatGX.exe
  2⤵
  PID:8936
- C:\Windows\System\QScvsWa.exe
  C:\Windows\System\QScvsWa.exe
  2⤵
  PID:8660
- C:\Windows\System\GtxGcrq.exe
  C:\Windows\System\GtxGcrq.exe
  2⤵
  PID:8920
- C:\Windows\System\jLtDPmi.exe
  C:\Windows\System\jLtDPmi.exe
  2⤵
  PID:8988
- C:\Windows\System\xcjbkwc.exe
  C:\Windows\System\xcjbkwc.exe
  2⤵
  PID:9036
- C:\Windows\System\eUaEKlJ.exe
  C:\Windows\System\eUaEKlJ.exe
  2⤵
  PID:9132
- C:\Windows\System\qltbCyE.exe
  C:\Windows\System\qltbCyE.exe
  2⤵
  PID:9148
- C:\Windows\System\VheLdnx.exe
  C:\Windows\System\VheLdnx.exe
  2⤵
  PID:8292
- C:\Windows\System\OcRHzXh.exe
  C:\Windows\System\OcRHzXh.exe
  2⤵
  PID:7800
- C:\Windows\System\ycEcdWx.exe
  C:\Windows\System\ycEcdWx.exe
  2⤵
  PID:8504
- C:\Windows\System\YrUtcwC.exe
  C:\Windows\System\YrUtcwC.exe
  2⤵
  PID:8216
- C:\Windows\System\PDKjZxm.exe
  C:\Windows\System\PDKjZxm.exe
  2⤵
  PID:8648
- C:\Windows\System\MAuAiWG.exe
  C:\Windows\System\MAuAiWG.exe
  2⤵
  PID:8568
- C:\Windows\System\XCQHWia.exe
  C:\Windows\System\XCQHWia.exe
  2⤵
  PID:8908
- C:\Windows\System\yaCbeVe.exe
  C:\Windows\System\yaCbeVe.exe
  2⤵
  PID:9032
- C:\Windows\System\IuVwzIT.exe
  C:\Windows\System\IuVwzIT.exe
  2⤵
  PID:8360
- C:\Windows\System\EWPNEsX.exe
  C:\Windows\System\EWPNEsX.exe
  2⤵
  PID:8856
- C:\Windows\System\BDiAUXe.exe
  C:\Windows\System\BDiAUXe.exe
  2⤵
  PID:6192
- C:\Windows\System\LffcwtR.exe
  C:\Windows\System\LffcwtR.exe
  2⤵
  PID:9100
- C:\Windows\System\jYNCbPr.exe
  C:\Windows\System\jYNCbPr.exe
  2⤵
  PID:8404
- C:\Windows\System\gpJOQby.exe
  C:\Windows\System\gpJOQby.exe
  2⤵
  PID:9016
- C:\Windows\System\ZiSJYSr.exe
  C:\Windows\System\ZiSJYSr.exe
  2⤵
  PID:7176
- C:\Windows\System\bftSYsD.exe
  C:\Windows\System\bftSYsD.exe
  2⤵
  PID:8872
- C:\Windows\System\HxsWUse.exe
  C:\Windows\System\HxsWUse.exe
  2⤵
  PID:7992
- C:\Windows\System\lXcrkmR.exe
  C:\Windows\System\lXcrkmR.exe
  2⤵
  PID:8716
- C:\Windows\System\okPDoLE.exe
  C:\Windows\System\okPDoLE.exe
  2⤵
  PID:9232
- C:\Windows\System\qnFOhqD.exe
  C:\Windows\System\qnFOhqD.exe
  2⤵
  PID:9248
- C:\Windows\System\XIiuSNF.exe
  C:\Windows\System\XIiuSNF.exe
  2⤵
  PID:9268
- C:\Windows\System\uJFyqPa.exe
  C:\Windows\System\uJFyqPa.exe
  2⤵
  PID:9284
- C:\Windows\System\CFFCMOp.exe
  C:\Windows\System\CFFCMOp.exe
  2⤵
  PID:9300
- C:\Windows\System\tFQtokx.exe
  C:\Windows\System\tFQtokx.exe
  2⤵
  PID:9316
- C:\Windows\System\iUoJFLE.exe
  C:\Windows\System\iUoJFLE.exe
  2⤵
  PID:9332
- C:\Windows\System\VCoDocP.exe
  C:\Windows\System\VCoDocP.exe
  2⤵
  PID:9348
- C:\Windows\System\IkewBSn.exe
  C:\Windows\System\IkewBSn.exe
  2⤵
  PID:9364
- C:\Windows\System\jaoVsVk.exe
  C:\Windows\System\jaoVsVk.exe
  2⤵
  PID:9380
- C:\Windows\System\oYFigtU.exe
  C:\Windows\System\oYFigtU.exe
  2⤵
  PID:9396
- C:\Windows\System\sjQLxJR.exe
  C:\Windows\System\sjQLxJR.exe
  2⤵
  PID:9412
- C:\Windows\System\nnPdTSN.exe
  C:\Windows\System\nnPdTSN.exe
  2⤵
  PID:9428
- C:\Windows\System\LwKtjAZ.exe
  C:\Windows\System\LwKtjAZ.exe
  2⤵
  PID:9444
- C:\Windows\System\TbLEpCR.exe
  C:\Windows\System\TbLEpCR.exe
  2⤵
  PID:9460
- C:\Windows\System\VIfLOBH.exe
  C:\Windows\System\VIfLOBH.exe
  2⤵
  PID:9476
- C:\Windows\System\KlxbQDT.exe
  C:\Windows\System\KlxbQDT.exe
  2⤵
  PID:9492
- C:\Windows\System\RyIZskB.exe
  C:\Windows\System\RyIZskB.exe
  2⤵
  PID:9508
- C:\Windows\System\iLpzupn.exe
  C:\Windows\System\iLpzupn.exe
  2⤵
  PID:9524
- C:\Windows\System\uUSdSBo.exe
  C:\Windows\System\uUSdSBo.exe
  2⤵
  PID:9540
- C:\Windows\System\oNJXWmi.exe
  C:\Windows\System\oNJXWmi.exe
  2⤵
  PID:9556
- C:\Windows\System\uWUIXLH.exe
  C:\Windows\System\uWUIXLH.exe
  2⤵
  PID:9572
- C:\Windows\System\euSBaHq.exe
  C:\Windows\System\euSBaHq.exe
  2⤵
  PID:9588
- C:\Windows\System\MVheoHg.exe
  C:\Windows\System\MVheoHg.exe
  2⤵
  PID:9604
- C:\Windows\System\aLupJrl.exe
  C:\Windows\System\aLupJrl.exe
  2⤵
  PID:9620
- C:\Windows\System\NsPHYVP.exe
  C:\Windows\System\NsPHYVP.exe
  2⤵
  PID:9636
- C:\Windows\System\CYiGBXY.exe
  C:\Windows\System\CYiGBXY.exe
  2⤵
  PID:9656
- C:\Windows\System\lBFmuHi.exe
  C:\Windows\System\lBFmuHi.exe
  2⤵
  PID:9672
- C:\Windows\System\jwnJmXw.exe
  C:\Windows\System\jwnJmXw.exe
  2⤵
  PID:9688
- C:\Windows\System\rUBcmtm.exe
  C:\Windows\System\rUBcmtm.exe
  2⤵
  PID:9704
- C:\Windows\System\KTVOnXF.exe
  C:\Windows\System\KTVOnXF.exe
  2⤵
  PID:9720
- C:\Windows\System\CszwIqA.exe
  C:\Windows\System\CszwIqA.exe
  2⤵
  PID:9736
- C:\Windows\System\IWZQVys.exe
  C:\Windows\System\IWZQVys.exe
  2⤵
  PID:9752
- C:\Windows\System\eGzyCgA.exe
  C:\Windows\System\eGzyCgA.exe
  2⤵
  PID:9768
- C:\Windows\System\eBSnduL.exe
  C:\Windows\System\eBSnduL.exe
  2⤵
  PID:9784
- C:\Windows\System\XehrkJQ.exe
  C:\Windows\System\XehrkJQ.exe
  2⤵
  PID:9800
- C:\Windows\System\CGYUmUU.exe
  C:\Windows\System\CGYUmUU.exe
  2⤵
  PID:9816
- C:\Windows\System\XJyYCgF.exe
  C:\Windows\System\XJyYCgF.exe
  2⤵
  PID:9832
- C:\Windows\System\AxpvbYf.exe
  C:\Windows\System\AxpvbYf.exe
  2⤵
  PID:9848
- C:\Windows\System\XoKuFPp.exe
  C:\Windows\System\XoKuFPp.exe
  2⤵
  PID:9864
- C:\Windows\System\UlOUoln.exe
  C:\Windows\System\UlOUoln.exe
  2⤵
  PID:9880
- C:\Windows\System\LEgwsgX.exe
  C:\Windows\System\LEgwsgX.exe
  2⤵
  PID:9896
- C:\Windows\System\VMWJuuV.exe
  C:\Windows\System\VMWJuuV.exe
  2⤵
  PID:9912
- C:\Windows\System\PjByqbW.exe
  C:\Windows\System\PjByqbW.exe
  2⤵
  PID:9928
- C:\Windows\System\GagycSJ.exe
  C:\Windows\System\GagycSJ.exe
  2⤵
  PID:9944
- C:\Windows\System\FnxDSgU.exe
  C:\Windows\System\FnxDSgU.exe
  2⤵
  PID:9960
- C:\Windows\System\SkEUsLs.exe
  C:\Windows\System\SkEUsLs.exe
  2⤵
  PID:9976
- C:\Windows\System\HqSdSyW.exe
  C:\Windows\System\HqSdSyW.exe
  2⤵
  PID:9992
- C:\Windows\System\WSvRWGz.exe
  C:\Windows\System\WSvRWGz.exe
  2⤵
  PID:10008
- C:\Windows\System\XHGMpgd.exe
  C:\Windows\System\XHGMpgd.exe
  2⤵
  PID:10024
- C:\Windows\System\jEvfhgC.exe
  C:\Windows\System\jEvfhgC.exe
  2⤵
  PID:10040
- C:\Windows\System\lVaJJAq.exe
  C:\Windows\System\lVaJJAq.exe
  2⤵
  PID:10056
- C:\Windows\System\PzyzhDq.exe
  C:\Windows\System\PzyzhDq.exe
  2⤵
  PID:10072
- C:\Windows\System\HjuDPeT.exe
  C:\Windows\System\HjuDPeT.exe
  2⤵
  PID:10088
- C:\Windows\System\uGILUgu.exe
  C:\Windows\System\uGILUgu.exe
  2⤵
  PID:10104
- C:\Windows\System\nwWKYBu.exe
  C:\Windows\System\nwWKYBu.exe
  2⤵
  PID:10120
- C:\Windows\System\gchIgTc.exe
  C:\Windows\System\gchIgTc.exe
  2⤵
  PID:10136
- C:\Windows\System\tAVlFbM.exe
  C:\Windows\System\tAVlFbM.exe
  2⤵
  PID:10152
- C:\Windows\System\TVEUljR.exe
  C:\Windows\System\TVEUljR.exe
  2⤵
  PID:10172
- C:\Windows\System\EOzLheh.exe
  C:\Windows\System\EOzLheh.exe
  2⤵
  PID:10188
- C:\Windows\System\LMXrxED.exe
  C:\Windows\System\LMXrxED.exe
  2⤵
  PID:10204
- C:\Windows\System\RDJorqX.exe
  C:\Windows\System\RDJorqX.exe
  2⤵
  PID:10220
- C:\Windows\System\fFOTqOx.exe
  C:\Windows\System\fFOTqOx.exe
  2⤵
  PID:10236
- C:\Windows\System\JpVxqoG.exe
  C:\Windows\System\JpVxqoG.exe
  2⤵
  PID:7372
- C:\Windows\System\BcKGQLf.exe
  C:\Windows\System\BcKGQLf.exe
  2⤵
  PID:8952
- C:\Windows\System\WCizvYq.exe
  C:\Windows\System\WCizvYq.exe
  2⤵
  PID:9276
- C:\Windows\System\JvDjRMe.exe
  C:\Windows\System\JvDjRMe.exe
  2⤵
  PID:9308
- C:\Windows\System\QejcTop.exe
  C:\Windows\System\QejcTop.exe
  2⤵
  PID:9344
- C:\Windows\System\GpQwgjA.exe
  C:\Windows\System\GpQwgjA.exe
  2⤵
  PID:9328
- C:\Windows\System\FUJjYbv.exe
  C:\Windows\System\FUJjYbv.exe
  2⤵
  PID:9388
- C:\Windows\System\LwAZCft.exe
  C:\Windows\System\LwAZCft.exe
  2⤵
  PID:9420
- C:\Windows\System\GoXXSvi.exe
  C:\Windows\System\GoXXSvi.exe
  2⤵
  PID:9468
- C:\Windows\System\sJndfJE.exe
  C:\Windows\System\sJndfJE.exe
  2⤵
  PID:9500
- C:\Windows\System\LvVFoRP.exe
  C:\Windows\System\LvVFoRP.exe
  2⤵
  PID:9536
- C:\Windows\System\jLgUJaI.exe
  C:\Windows\System\jLgUJaI.exe
  2⤵
  PID:9600
- C:\Windows\System\giWzaiV.exe
  C:\Windows\System\giWzaiV.exe
  2⤵
  PID:9580
- C:\Windows\System\cdYAwod.exe
  C:\Windows\System\cdYAwod.exe
  2⤵
  PID:9668
- C:\Windows\System\tDHjHAv.exe
  C:\Windows\System\tDHjHAv.exe
  2⤵
  PID:9728
- C:\Windows\System\bljMwJq.exe
  C:\Windows\System\bljMwJq.exe
  2⤵
  PID:9764
- C:\Windows\System\loNIxPC.exe
  C:\Windows\System\loNIxPC.exe
  2⤵
  PID:9796
- C:\Windows\System\gUmihFU.exe
  C:\Windows\System\gUmihFU.exe
  2⤵
  PID:9856
- C:\Windows\System\lGSsmFx.exe
  C:\Windows\System\lGSsmFx.exe
  2⤵
  PID:9780
- C:\Windows\System\BNbHpSN.exe
  C:\Windows\System\BNbHpSN.exe
  2⤵
  PID:9840
- C:\Windows\System\boNyjvo.exe
  C:\Windows\System\boNyjvo.exe
  2⤵
  PID:9652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DLhYPhd.exe

Filesize
1.6MB

MD5
14454109f430013779010ebb72c33190

SHA1
a976daf990a708032a3e97394ae43b3ba861f8bc

SHA256
f82f0eae34968ed2bc869ee654d00ea633d02face69595d427da1e67e38fdc11

SHA512
00fa99b047b5df8de0aeb13d19c5d55ef7cfe33e94aeb66f07ad6c6bcf802615892d9c38bdcf20c35116d4751a9599bdbe208a8e4d9a465ba2661c8c55d899f7

Download Submit
C:\Windows\system\EYtskKq.exe

Filesize
1.6MB

MD5
7946d6dcdcf74cbd9c7596373480e7c7

SHA1
846144ace70f023e1e076dc6030c54cd5dbc2c1a

SHA256
3b2516fd9b88b8058c841773ebc1ad220ced1dffaf967f7f903b97e1bc5af1f3

SHA512
df148c1e5476a04f90eb9ce60dd51a631041f0cd32e6773e4efb3eac528b70cef549a468c001efc2602379d396cd6ebfa359a68f465ca76f25c1b29a06e969ae

Download Submit
C:\Windows\system\FAbpjhd.exe

Filesize
1.6MB

MD5
0fd2853a1f54a619ca17baf067852824

SHA1
b551f2537671d579c4080851910b732169823f2f

SHA256
8a1d6793f1de55f1d4e6b8243101312744830080d6ba78377549adbffdce6bf3

SHA512
5a31da308b8663bf98da066b659aa45c537212ad3ad15591895e02c7ce071d4a61cd9847e9f523b0a90cc7c80e4cff9bc22bd8d51d3380f3bce4ae47ccdc7302

Download Submit
C:\Windows\system\FaqAkHu.exe

Filesize
1.6MB

MD5
afb280f46181b81258f4116f698ca94b

SHA1
f6db4b139797aa6922fb76cb7b2b76f706935793

SHA256
031f51d0c1e350e465bff515c749ef72c73d87f162cf54d35aa1429be9322d87

SHA512
80bfa044bcb639f95b0c4c1711f0c3d4a71eaef881214a88a22b4a27eaf2b2413e9429d8cc1a61dbdf7e772c114fbac25c36c75bec65dac951dc30ae81f62be1

Download Submit
C:\Windows\system\HSwLKej.exe

Filesize
1.6MB

MD5
d942c1bc966a6eac9de3ef2aaf80f440

SHA1
bbd8c2ad3657f3e78c25d28bf2b52653789026f2

SHA256
61b6ec678087a25fc9c2ca6907c1eea7fa28db534d32e89fc657132e829d6d97

SHA512
be5b2857ca8d365453cdcc9d683d7cf6508bed0e5e3ccbc68103a3141c325dd263461f866465c298676a315d60acb126649385e14b4300f4c681b5c9111434a5

Download Submit
C:\Windows\system\IKliCxm.exe

Filesize
1.6MB

MD5
dbc6df6d5e34e343188253f448616b7e

SHA1
e947737548fab6b692669861e5fec8ff261f77d3

SHA256
be10d260413b8397606fdefe9cd47aa9b6abe7b25d2c7a3401d12f0c52d12b7a

SHA512
9f2e1c83726ef06bbafde2d2056fa0ce28c0f7d41cfd588011077ffa0bc20a6e43b5d2aeacc4604e7f20efb84fd260f9513066fb0ec5a319a03c9a2e70e9d859

Download Submit
C:\Windows\system\LKBoEFj.exe

Filesize
1.6MB

MD5
f917616b280d6eb205df5641c20ec3c7

SHA1
72cdffc1cd9e57477da5a662a74218787653822b

SHA256
d1599886d885f527e424fab2c10d92868fc8e8ebc291d23662ece8b301ba294c

SHA512
60c29368230ac5f1006e58db4b939e9172471f955cb16d02fb9eee54d08f7faa94c28a922bb1d739c28fa879b9c52f6f94c49906c1f24128a4577c538b52e1da

Download Submit
C:\Windows\system\OKkCqym.exe

Filesize
1.6MB

MD5
716df50b616f90658f07864e6d80f570

SHA1
5f7ce81277b955d0156712c96416b9c96a98d5f5

SHA256
8cc85c3486e7da1758bfef9c37b08e1a7ba8467aa744b9676aee4e871ea4893e

SHA512
ab204389a841d456089809a95a6e9d3276d6348be3c35ba93b7cacd775ea1f74231b9cb62eca4988ff3b712069d29bd6edc54e67ac7a25d07a9bc908747b1562

Download Submit
C:\Windows\system\PFUgzqt.exe

Filesize
1.6MB

MD5
5b8780b96b82963c39b7de48c3208c8d

SHA1
5a2271a790d0c52d895c50fffee06c3f6c83ee6a

SHA256
e4f8a32419c785a28b240260795cad43c750d0db7fe3b680af328637bf5b8252

SHA512
fe677173f484c8395bd1ea29ed678d8729779c5a2160439ec450d82d57a8d44496dfbca2c75f2f5946afed3eb5bdb1af03f9c3e3f645eb5806205c5d8f7b8dee

Download Submit
C:\Windows\system\PnCzZig.exe

Filesize
1.6MB

MD5
e962f620a0e162ea820941a1268de181

SHA1
d5f4f1cb458bca9a08a1f55698edef6d7c46969c

SHA256
e71e3a692aa5b095d47c43b7dc3f79997cc90bcbaae367c397a36244cce5e815

SHA512
36d8d0f668a0ac294f85fcc20082529e5ca8383e244369f9acd5da7693edc6c37a4d291772ece481c0e689b41d83a1b09754cb6c525c33c26e789156bedd9ab6

Download Submit
C:\Windows\system\TXiSYdH.exe

Filesize
1.6MB

MD5
7023b44120466a0376e1868de21d3464

SHA1
1d4f964297a65dd5afd6c11780ac597ab3b6cf13

SHA256
3753c413756f544e8334e5f12b6388a8fabe6197747bb1ca589efb769cea79d5

SHA512
9917396dc4c7cea57af834a3a73f9bcbe211920274373bf2044cf132c81a3e081e0cd5a344e734af83bf5d6d8db46c2c87f7f1e8a7d2fe912481bcebed03ffb8

Download Submit
C:\Windows\system\UzTrNPt.exe

Filesize
1.6MB

MD5
f24d0dea223927a5c3ee58aa8e485e20

SHA1
0283eee6562f175d96ebab73b10c2d49927c7725

SHA256
e10ebc4c76f664d3d17438129eb148776b6494b78bc300e8153af6c667fb6f6c

SHA512
d7b5bb025c1b14a6d4332125ae58a8bc139f854c872db0f6f360c39035cc7e8ff49aa4b63be878c6c55a175f0bd12cd81af169120b0c57bd8463d32c83d06bdb

Download Submit
C:\Windows\system\VTLqBXo.exe

Filesize
1.6MB

MD5
60000b9e3faca04da8e4ec14ec2859a9

SHA1
e7aefa3168ab9653003c350175524d1e88b15dc1

SHA256
f0f4c4eacb3513ba9043b2dcd615a907a3e2047d36ac668f6ae9bfaeeb3eef02

SHA512
d34f61a6d84e319843aec49b7516068446b9bf999b7d151a8a1e6d1d6aa7fb2c7715c3439d3467f05895d54fc66627de0ad14248a81af16ed2d318496acc3a45

Download Submit
C:\Windows\system\bqKgVaF.exe

Filesize
1.6MB

MD5
32631c2c062b8c9b9383812189acbce9

SHA1
7961a2111190d80f9d02cbe17f90e95a45be98ec

SHA256
e2f419202481ee408ba5eff0ec82b330ea3ed61517fd701a49d68daf1f38f55d

SHA512
b39cd70b9fc17a93c935f8aef5a27a166ba3347c3182edc034588f636988b45aab99a0be50e3d368c4e83480b9ad6bbad5d08f412575cd936baee23b8ffb02d6

Download Submit
C:\Windows\system\daQkvmK.exe

Filesize
1.6MB

MD5
1098bd2113259e40a0380ae1e21807f7

SHA1
815235e2d97fc3ae5cad182ea0b233f074024540

SHA256
8782681bc17281ffe1903212ad8a62014dae34ee9f536748d4690dd5be804299

SHA512
e1ec0cd4b25d97d48a376c57c931acb161bcd672035c720e71c260b7b1e99edd945ca1599ffbcb7c060a421504fbde3b0ef228bb5fb2bad5a54b87ebc2e844c8

Download Submit
C:\Windows\system\gyygLaa.exe

Filesize
1.6MB

MD5
42cd953352556619c566a91e8a6f7c45

SHA1
018ba3383251f5e755d72a2b47afc1fff9e8a671

SHA256
4a4f22f9ebe69edfa34fc8aa3545ab1945cbdbdae140bb17da6c71d9fd2a5b39

SHA512
707e864712b554800d0f13d95a6f020c4e7fe33c1a3f8bd1955c86a0a13eb803f4ca1b740760678e6a6ed27609137992356551559b79cb60aba6a9d2e4c86b4e

Download Submit
C:\Windows\system\hzyorPN.exe

Filesize
1.6MB

MD5
6b7bf6c70388fe042eae98a437c2e412

SHA1
baed78044a421fba44f45d79e2405ea73b2478d5

SHA256
984531313c2614b3f79eff5fc218fa9106e450527090778641dfed4a0cb99dd4

SHA512
80991ffe9ebc52495d08db85ebace71688320820c75f85718f2b29ae6ba94625b62ad499202e8d4da2b5aff80584c623d3cbd8f572478bd8220d06877e356fb7

Download Submit
C:\Windows\system\iZBuyvI.exe

Filesize
1.6MB

MD5
bdfd392510127fdbb48fa5bf25208509

SHA1
e06815be3387c1ae09de8daee4b0bca7d22df77d

SHA256
8e59c5d45bb99aec9bfd8c180243116429519f65828dbf02ea2a3031ec3e8390

SHA512
3c01700db61074099a65ec185b3e3bc6c912d5552d244d835e02a3d956010943aa353790f9a61286fd603d2fa8e9c14a8441bd9abde2c65b4cb74d8f8e334fbf

Download Submit
C:\Windows\system\lJMuXvZ.exe

Filesize
1.6MB

MD5
55f70b53ad8f5edd5e6481fb12ba8209

SHA1
f28010bff651a280496dd4913ada730ee182de00

SHA256
54de59a38c96a605ca1a432920d4614ae8edc36c7ec3dc63d9c586701e0b03ae

SHA512
c930eb03c8e3cfd1d637384d36ac05f3403414a0ac370af9a446a1353ea1e1e9d2727918d29cf748304f84d9d4dec12b29ad94ee5e8c61f45ac626eeb1e176c1

Download Submit
C:\Windows\system\mLmSvhL.exe

Filesize
1.6MB

MD5
4891505e6a1f71fa6435b5747ec721a3

SHA1
81a81e70f25c749ae8245a575458d406dc255e62

SHA256
e25cc1434ed63656059722293fb0d00354c44552cf26cc1d6ef47861beeaceb2

SHA512
6ed86b0f4a96a09b45112884f023bd2fd186e5de4fd6594eed50532371e9bfa00c65de1f05556d2f837951c432a96b17b75e0feccc0529a00c6261e9f29274dc

Download Submit
C:\Windows\system\mmecFws.exe

Filesize
1.6MB

MD5
edfce1bd70ad20ba57d10226af59fb47

SHA1
4274f29cb5b7b650ed938672a33892d75696394a

SHA256
6cf3627e1e6e1b1046e5e4f3c7170ad8c4cc8e67f56b9b1e29b5f5ad4fc41b7a

SHA512
7db0077c8d426cfccdf6715ab3a4093625920db148d1867e62c8aa986545bf67c0cc014f742641aa2d4b0924f536b019ffd23466501987a8cdd149890deb4161

Download Submit
C:\Windows\system\oGrcnNn.exe

Filesize
1.6MB

MD5
5f81195796c3ce9f10711f28896e643b

SHA1
78f9b097036f55bb8df3bbe33785f0a21f128229

SHA256
dff8b22b712c66e7ad85c4fd7ec25d2c54314ef1f0e4892fdc1604fa8bd67106

SHA512
640276617efc13365b66490dc7716d38cca8e87d7f2e885e3307d9f6e63d6f872be422bbe3ae0a311ba89b7ba4585f5272338910c7486f76459dfb630a769ca6

Download Submit
C:\Windows\system\pGgOkUl.exe

Filesize
1.6MB

MD5
f1432abda81d8a5891742811c0f05613

SHA1
544d011157b7b40544abeb916854ccdfb05222b9

SHA256
71f3279e2ff96a3052675d5dc1cd7836644141206f614bdbce8c03a138a07761

SHA512
f40eb529151299abef8207430368ef9465c2da1e5c84a55fb873bb067df8606bfa102280b21dacf5c292d710d5132c943ce40c87320ce38bb41df0dc2c7cce67

Download Submit
C:\Windows\system\pHpRlum.exe

Filesize
1.6MB

MD5
a20930916aee99ec7784f8669cf9523a

SHA1
d3010dc267abb4d5846b2f4d309672aa8eee3564

SHA256
b963441faf64c5951f200ab9ff8cdadec0918b61e3d71376bc52bf2250f75b88

SHA512
54e9bbfc481192ab7255e4c85a043f9a1d8896cc3742a2d9bde488f49aeccc9fb43d5f5c097e6f14ded3eda6cb67b07323771d4f1426986393f278ad0c666ca1

Download Submit
C:\Windows\system\rYbvhdX.exe

Filesize
1.6MB

MD5
ceaca3ea0b30e6986394f3a17d4f8d36

SHA1
2db09d2696fa4f458d52084a4d031d5703b871b0

SHA256
8c416a7f5f91632b5ab839b7a49a1b45f3f81d113063485ad1ec3ce5c331edb7

SHA512
c20823c7b256dc4fe5d6e9186e25934e6a115cbd05de8f0da7c1f7a3f5e3a7826720c28393eef0e220339353aad45206a2c7c592cc207804c41867935c70a5f7

Download Submit
C:\Windows\system\seLWOkR.exe

Filesize
1.6MB

MD5
8f509909a77bf70cb80657068714907e

SHA1
b3d120f8af3ffd194ec8dab96fdb1969a7aa885d

SHA256
c0d12eedb76751935601b057320dc0bc9a3034a65f260568a327440931057893

SHA512
82f95992b8c8165a1bd833f43aeaad26c7c57e3ee11f9dd296cb9b0b5c7dee437bb8e484c4e60a4bd7bf47ec421bfef507dc943a1bf067c6363d6190082441a0

Download Submit
C:\Windows\system\syYTfgl.exe

Filesize
1.6MB

MD5
0755a393e8a1f354db2a7e24c3f006ea

SHA1
c0d15a6ed5c58e5d174ecc047888210e7f70c143

SHA256
c180fdb8bd92b8bb2efe05506a5a89ee47cefa8ecbd59fc46835c503776cedcd

SHA512
20fee88ae601eb3ceff782293753c0291e5571628b254db4f3150be9456d4cc526949fa545404f7bc9618c205fdebdf43dc808947d59c34e0cc25bc2138fd05f

Download Submit
C:\Windows\system\ujYwKEG.exe

Filesize
1.6MB

MD5
4d71759683b1fc3c4bcb0ae4ed0b7bd4

SHA1
419e5076814aa67a0b09a8a8a41de5fc87c41330

SHA256
3efd800ca92e047a64b61268d6e8d0d02ff60908ebbc77abe11312a3a79020f4

SHA512
b38f27830c488fd5f100684af19d878e72e9ac6ebf4b662fcb4bc3001ec9482f76d83ff6101c91be407d8dd41d81ede7b2704f5dbf3a6289dddafd3fc77ec9b2

Download Submit
C:\Windows\system\vBeFqkM.exe

Filesize
1.6MB

MD5
fc5c109f90a3a96f586219c4c3615ff3

SHA1
602b7ecd91fff897e9f95eec082ab94f4d1f658d

SHA256
3ada7ec37f2bbec70e2b0e5f1fee70586de2138fe1a5cada406aa175770c2bf2

SHA512
89dfddb3b18a41f82af9146562559446bb819489b0e5ca32581ff8c4968f59318c6b6caa75cc8412293543526d30ef487b8df749fe3595561220550d56f14ad2

Download Submit
C:\Windows\system\wgYmYBv.exe

Filesize
1.6MB

MD5
2e13081b552502a28be293b2a2c2aa07

SHA1
078f1e5d45d71ad284e92614d2f2cb0bd1d2c55f

SHA256
91dab8a0d11e9b62fe758c9a036b93f4db900afd9edab561bb7985e95d2456a1

SHA512
d518a004c7926d9c60423fc79d51104159bc001ad481b382b876f1a919f81adbfa7e9694f9c3006fe091e6a6ee725fefc3012a3ec3ab58cb8fa9e3dff1d0184d

Download Submit
\Windows\system\oEEPGfK.exe

Filesize
1.6MB

MD5
7cf98014f8ccefb73baae4636281317f

SHA1
ff3aae861fa18923ccecb2899e4eaa0502295836

SHA256
e09696a5352d32e8d6114438b4be237fc523a8697ac68f10d3836b83a4416492

SHA512
b4ef47421a644d19f48bab5c3f9339cbe90667f4af0b2553b237ceff4f80d7516a57b012235f0fe45b0e093f535c8bbca2d9f7ec0126ea2dcdea6238c901ca99

Download Submit
\Windows\system\tJvaZVw.exe

Filesize
1.6MB

MD5
b10909c4d5fdb5a686b591a1db51c3b5

SHA1
d635eb328e980e2b7198bb549515c8602e96f760

SHA256
1b1e1376c91f06bb1bcb54a52ba6befa6f8d8586bb686b09bb0d9c341bfa9f6b

SHA512
6134d290503b743e1cd484754ccc24939e01f226a40f5beaa467d3eed4481c56fa9e5c2353cdbe39823d863e4003a5bcfcd3cf9c877ba51fb2bc202dbaedb801

Download Submit
memory/848-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download