xmrig | f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
Size

1.5MB
MD5

36b8ee56812f731be4de17d907f197f5
SHA1

909170ac51578ad1033f646b38e6933767ce04ce
SHA256

f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf
SHA512

e8e7dae087667834c6b81a4d038cd3e9b3464aa632bb5ab47ca7741fbee5e3a3ebcc429a7f2bff1af6fc1127e6572dfc71c16c3602cb60c4733c6fe980839e86
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcR:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5T

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral1/files/0x0003000000018334-6.dat	xmrig
behavioral1/files/0x00070000000120fc-5.dat	xmrig
behavioral1/files/0x0008000000019326-8.dat	xmrig
behavioral1/files/0x0007000000019394-17.dat	xmrig
behavioral1/files/0x00060000000193a0-21.dat	xmrig
behavioral1/files/0x00060000000193b8-24.dat	xmrig
behavioral1/files/0x00060000000193c7-29.dat	xmrig
behavioral1/files/0x0006000000019470-33.dat	xmrig
behavioral1/files/0x0007000000019489-49.dat	xmrig
behavioral1/files/0x0008000000019480-37.dat	xmrig
behavioral1/files/0x0026000000018b89-54.dat	xmrig
behavioral1/files/0x000500000001a03c-64.dat	xmrig
behavioral1/files/0x000500000001a309-78.dat	xmrig
behavioral1/files/0x000500000001a3ab-90.dat	xmrig
behavioral1/files/0x000500000001a400-104.dat	xmrig
behavioral1/files/0x000500000001a44f-122.dat	xmrig
behavioral1/files/0x000500000001a457-129.dat	xmrig
behavioral1/files/0x000500000001a469-142.dat	xmrig
behavioral1/files/0x000500000001a46d-155.dat	xmrig
behavioral1/files/0x000500000001a46f-159.dat	xmrig
behavioral1/files/0x000500000001a46b-149.dat	xmrig
behavioral1/files/0x000500000001a463-139.dat	xmrig
behavioral1/files/0x000500000001a459-134.dat	xmrig
behavioral1/files/0x000500000001a44d-120.dat	xmrig
behavioral1/files/0x000500000001a438-114.dat	xmrig
behavioral1/files/0x000500000001a404-109.dat	xmrig
behavioral1/files/0x000500000001a3fd-99.dat	xmrig
behavioral1/files/0x000500000001a3f8-94.dat	xmrig
behavioral1/files/0x000500000001a3f6-87.dat	xmrig
behavioral1/files/0x000500000001a0b6-74.dat	xmrig
behavioral1/files/0x000500000001a049-69.dat	xmrig
behavioral1/files/0x0005000000019fdd-59.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

lwEHNov.exeZfOoMZx.exeKPHdQBf.exesdIAFvD.exexVKGFtc.exehPieYGU.exeJZzbnhm.exeUPyYQtx.exeyevKiqy.exeNAcMCCj.exepcwiOth.exeOezsQnM.exebfbHtCG.exehjHmVuh.exejNHUHrK.exeqNIBeyV.exeGUUeHtM.exeshuxQHN.exeZSkAcCp.exeSfSDWHX.exeSOOfuqp.exeXdGODGH.exegUyeutZ.exeIlLlJQU.exewPbiASh.exeJnnhUnQ.exeTsDoqlT.exedUyzUcf.exeYBXfxuq.exeGxCHaau.exeqbWLgjQ.exeQUnhsHh.exewNPHxjW.exeJCBMfru.exeecInSit.exeVSPkBkD.exeQVLabKz.exeXvwVEPJ.execUVqhTs.exexmEcbfO.exeBRhaEML.exeDqMsbrn.exeAmhZuyk.exeTWCYXxg.exeFqoXSNG.exeFBlolON.exeQTFxmLA.exerRPsQFU.exeRfSIqsi.exeRiMPNdW.exeVfZPCbF.exeupngjxz.exeNszGlJn.exeURQgrqS.exeETyViLQ.exeEmMtcFi.exeGBWfpit.exezbeESBO.exeljCGSDj.exeyuSobgN.exeBzDDmIz.exeLbKFMNv.exeCxRLfNp.exeKaqzbpK.exe

pid	Process
2148	lwEHNov.exe
2924	ZfOoMZx.exe
2540	KPHdQBf.exe
2900	sdIAFvD.exe
2936	xVKGFtc.exe
2812	hPieYGU.exe
2880	JZzbnhm.exe
2060	UPyYQtx.exe
2876	yevKiqy.exe
2680	NAcMCCj.exe
2264	pcwiOth.exe
2036	OezsQnM.exe
2648	bfbHtCG.exe
580	hjHmVuh.exe
1048	jNHUHrK.exe
1260	qNIBeyV.exe
3056	GUUeHtM.exe
1744	shuxQHN.exe
2032	ZSkAcCp.exe
2972	SfSDWHX.exe
3008	SOOfuqp.exe
2468	XdGODGH.exe
2976	gUyeutZ.exe
2020	IlLlJQU.exe
1312	wPbiASh.exe
2544	JnnhUnQ.exe
1212	TsDoqlT.exe
316	dUyzUcf.exe
2376	YBXfxuq.exe
2236	GxCHaau.exe
676	qbWLgjQ.exe
2200	QUnhsHh.exe
2520	wNPHxjW.exe
2412	JCBMfru.exe
1952	ecInSit.exe
1308	VSPkBkD.exe
2460	QVLabKz.exe
2096	XvwVEPJ.exe
2528	cUVqhTs.exe
700	xmEcbfO.exe
2456	BRhaEML.exe
560	DqMsbrn.exe
864	AmhZuyk.exe
1380	TWCYXxg.exe
1484	FqoXSNG.exe
1400	FBlolON.exe
1620	QTFxmLA.exe
1712	rRPsQFU.exe
916	RfSIqsi.exe
2000	RiMPNdW.exe
2516	VfZPCbF.exe
1568	upngjxz.exe
1152	NszGlJn.exe
1168	URQgrqS.exe
1816	ETyViLQ.exe
1844	EmMtcFi.exe
1108	GBWfpit.exe
880	zbeESBO.exe
2408	ljCGSDj.exe
696	yuSobgN.exe
1608	BzDDmIz.exe
1584	LbKFMNv.exe
2808	CxRLfNp.exe
2816	KaqzbpK.exe

Loads dropped DLL 64 IoCs

Processes:

f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe

pid	Process
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe

Drops file in Windows directory 64 IoCs

Processes:

f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe

description	ioc	Process
File created	C:\Windows\System\PgYPEHK.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\XHfYAmq.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\vSIFVRB.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\iVgpGRz.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\GYucYMm.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\ZlmHjjD.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\vsMTFLC.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\TEQujqK.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\xTrbKRH.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\QsgqlPu.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\kiPJeVf.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\wzFdraZ.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\KcqcIVS.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\zovHcBL.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\oAZccZo.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\drWHgSW.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\OCwtSDK.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\LNynnTd.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\SJDWgtj.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\MNURCFc.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\WNaZVif.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\JXIDPnI.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\RJiYiYR.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\EDEuPTk.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\sWfLCyW.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\CtswIEB.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\KtnxPou.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\xzQYfAa.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\EqPLFml.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\VyQLwpN.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\eDctNUl.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\TnSeuOw.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\ZcoOvbT.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\yULVFzO.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\xmEcbfO.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\tzVPWGJ.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\qUeTiDC.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\tezhCOb.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\LebVork.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\LHrMeNg.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\IhVglwC.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\MtaXCyV.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\tpRILvd.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\nuJuDex.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\YxXHuFX.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\qEnSQeV.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\dgIujMF.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\JiQfRKW.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\VlgTlCP.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\CKwRznx.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\kGNIvNx.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\hVRBnjR.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\irtMQIz.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\PVYGFau.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\lOOeWIl.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\TpPRUyP.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\BxgsOXN.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\eoDOxnJ.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\keVGnKJ.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\RHzpxjn.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\qegNClM.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\JzWnMjm.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\UpXYeOd.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
File created	C:\Windows\System\anTmDNx.exe	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe

description	pid	Process	procid_target
PID 1656 wrote to memory of 2148	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	30
PID 1656 wrote to memory of 2148	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	30
PID 1656 wrote to memory of 2148	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	30
PID 1656 wrote to memory of 2924	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	31
PID 1656 wrote to memory of 2924	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	31
PID 1656 wrote to memory of 2924	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	31
PID 1656 wrote to memory of 2540	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	32
PID 1656 wrote to memory of 2540	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	32
PID 1656 wrote to memory of 2540	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	32
PID 1656 wrote to memory of 2900	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	33
PID 1656 wrote to memory of 2900	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	33
PID 1656 wrote to memory of 2900	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	33
PID 1656 wrote to memory of 2936	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	34
PID 1656 wrote to memory of 2936	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	34
PID 1656 wrote to memory of 2936	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	34
PID 1656 wrote to memory of 2812	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	35
PID 1656 wrote to memory of 2812	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	35
PID 1656 wrote to memory of 2812	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	35
PID 1656 wrote to memory of 2880	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	36
PID 1656 wrote to memory of 2880	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	36
PID 1656 wrote to memory of 2880	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	36
PID 1656 wrote to memory of 2060	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	37
PID 1656 wrote to memory of 2060	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	37
PID 1656 wrote to memory of 2060	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	37
PID 1656 wrote to memory of 2876	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	38
PID 1656 wrote to memory of 2876	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	38
PID 1656 wrote to memory of 2876	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	38
PID 1656 wrote to memory of 2680	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	39
PID 1656 wrote to memory of 2680	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	39
PID 1656 wrote to memory of 2680	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	39
PID 1656 wrote to memory of 2264	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	40
PID 1656 wrote to memory of 2264	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	40
PID 1656 wrote to memory of 2264	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	40
PID 1656 wrote to memory of 2036	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	41
PID 1656 wrote to memory of 2036	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	41
PID 1656 wrote to memory of 2036	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	41
PID 1656 wrote to memory of 2648	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	42
PID 1656 wrote to memory of 2648	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	42
PID 1656 wrote to memory of 2648	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	42
PID 1656 wrote to memory of 580	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	43
PID 1656 wrote to memory of 580	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	43
PID 1656 wrote to memory of 580	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	43
PID 1656 wrote to memory of 1048	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	44
PID 1656 wrote to memory of 1048	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	44
PID 1656 wrote to memory of 1048	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	44
PID 1656 wrote to memory of 1260	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	45
PID 1656 wrote to memory of 1260	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	45
PID 1656 wrote to memory of 1260	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	45
PID 1656 wrote to memory of 1744	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	46
PID 1656 wrote to memory of 1744	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	46
PID 1656 wrote to memory of 1744	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	46
PID 1656 wrote to memory of 3056	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	47
PID 1656 wrote to memory of 3056	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	47
PID 1656 wrote to memory of 3056	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	47
PID 1656 wrote to memory of 2032	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	48
PID 1656 wrote to memory of 2032	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	48
PID 1656 wrote to memory of 2032	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	48
PID 1656 wrote to memory of 2972	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	49
PID 1656 wrote to memory of 2972	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	49
PID 1656 wrote to memory of 2972	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	49
PID 1656 wrote to memory of 3008	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	50
PID 1656 wrote to memory of 3008	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	50
PID 1656 wrote to memory of 3008	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	50
PID 1656 wrote to memory of 2468	1656	f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe	51

C:\Users\Admin\AppData\Local\Temp\f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe
"C:\Users\Admin\AppData\Local\Temp\f82ea56c0709ee059d8ff8876c731890c9c1ab052d1b7f834b90124c5644a1cf.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System\lwEHNov.exe
  C:\Windows\System\lwEHNov.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\ZfOoMZx.exe
  C:\Windows\System\ZfOoMZx.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\KPHdQBf.exe
  C:\Windows\System\KPHdQBf.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\sdIAFvD.exe
  C:\Windows\System\sdIAFvD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xVKGFtc.exe
  C:\Windows\System\xVKGFtc.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\hPieYGU.exe
  C:\Windows\System\hPieYGU.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JZzbnhm.exe
  C:\Windows\System\JZzbnhm.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\UPyYQtx.exe
  C:\Windows\System\UPyYQtx.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\yevKiqy.exe
  C:\Windows\System\yevKiqy.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NAcMCCj.exe
  C:\Windows\System\NAcMCCj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\pcwiOth.exe
  C:\Windows\System\pcwiOth.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\OezsQnM.exe
  C:\Windows\System\OezsQnM.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\bfbHtCG.exe
  C:\Windows\System\bfbHtCG.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\hjHmVuh.exe
  C:\Windows\System\hjHmVuh.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\jNHUHrK.exe
  C:\Windows\System\jNHUHrK.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\qNIBeyV.exe
  C:\Windows\System\qNIBeyV.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\shuxQHN.exe
  C:\Windows\System\shuxQHN.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\GUUeHtM.exe
  C:\Windows\System\GUUeHtM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\ZSkAcCp.exe
  C:\Windows\System\ZSkAcCp.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\SfSDWHX.exe
  C:\Windows\System\SfSDWHX.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\SOOfuqp.exe
  C:\Windows\System\SOOfuqp.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XdGODGH.exe
  C:\Windows\System\XdGODGH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\gUyeutZ.exe
  C:\Windows\System\gUyeutZ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IlLlJQU.exe
  C:\Windows\System\IlLlJQU.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wPbiASh.exe
  C:\Windows\System\wPbiASh.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\JnnhUnQ.exe
  C:\Windows\System\JnnhUnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\TsDoqlT.exe
  C:\Windows\System\TsDoqlT.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\dUyzUcf.exe
  C:\Windows\System\dUyzUcf.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\YBXfxuq.exe
  C:\Windows\System\YBXfxuq.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\GxCHaau.exe
  C:\Windows\System\GxCHaau.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\qbWLgjQ.exe
  C:\Windows\System\qbWLgjQ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\QUnhsHh.exe
  C:\Windows\System\QUnhsHh.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\wNPHxjW.exe
  C:\Windows\System\wNPHxjW.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\JCBMfru.exe
  C:\Windows\System\JCBMfru.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ecInSit.exe
  C:\Windows\System\ecInSit.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\VSPkBkD.exe
  C:\Windows\System\VSPkBkD.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\QVLabKz.exe
  C:\Windows\System\QVLabKz.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\XvwVEPJ.exe
  C:\Windows\System\XvwVEPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cUVqhTs.exe
  C:\Windows\System\cUVqhTs.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\xmEcbfO.exe
  C:\Windows\System\xmEcbfO.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\BRhaEML.exe
  C:\Windows\System\BRhaEML.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\DqMsbrn.exe
  C:\Windows\System\DqMsbrn.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\AmhZuyk.exe
  C:\Windows\System\AmhZuyk.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\TWCYXxg.exe
  C:\Windows\System\TWCYXxg.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\FqoXSNG.exe
  C:\Windows\System\FqoXSNG.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\FBlolON.exe
  C:\Windows\System\FBlolON.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\QTFxmLA.exe
  C:\Windows\System\QTFxmLA.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\rRPsQFU.exe
  C:\Windows\System\rRPsQFU.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\RfSIqsi.exe
  C:\Windows\System\RfSIqsi.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\RiMPNdW.exe
  C:\Windows\System\RiMPNdW.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\VfZPCbF.exe
  C:\Windows\System\VfZPCbF.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\upngjxz.exe
  C:\Windows\System\upngjxz.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\NszGlJn.exe
  C:\Windows\System\NszGlJn.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\URQgrqS.exe
  C:\Windows\System\URQgrqS.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\ETyViLQ.exe
  C:\Windows\System\ETyViLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EmMtcFi.exe
  C:\Windows\System\EmMtcFi.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\GBWfpit.exe
  C:\Windows\System\GBWfpit.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\zbeESBO.exe
  C:\Windows\System\zbeESBO.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ljCGSDj.exe
  C:\Windows\System\ljCGSDj.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\yuSobgN.exe
  C:\Windows\System\yuSobgN.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\BzDDmIz.exe
  C:\Windows\System\BzDDmIz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\LbKFMNv.exe
  C:\Windows\System\LbKFMNv.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\CxRLfNp.exe
  C:\Windows\System\CxRLfNp.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\KaqzbpK.exe
  C:\Windows\System\KaqzbpK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ZXhdnFT.exe
  C:\Windows\System\ZXhdnFT.exe
  2⤵
  PID:2868
- C:\Windows\System\YcRzxrL.exe
  C:\Windows\System\YcRzxrL.exe
  2⤵
  PID:2824
- C:\Windows\System\ltfGrZu.exe
  C:\Windows\System\ltfGrZu.exe
  2⤵
  PID:2740
- C:\Windows\System\cjvgtRt.exe
  C:\Windows\System\cjvgtRt.exe
  2⤵
  PID:2132
- C:\Windows\System\VqxOQgo.exe
  C:\Windows\System\VqxOQgo.exe
  2⤵
  PID:2668
- C:\Windows\System\XADXfbo.exe
  C:\Windows\System\XADXfbo.exe
  2⤵
  PID:2156
- C:\Windows\System\kuXneIE.exe
  C:\Windows\System\kuXneIE.exe
  2⤵
  PID:1628
- C:\Windows\System\oJqPvCE.exe
  C:\Windows\System\oJqPvCE.exe
  2⤵
  PID:2628
- C:\Windows\System\XGiaOqP.exe
  C:\Windows\System\XGiaOqP.exe
  2⤵
  PID:2244
- C:\Windows\System\aFXKGyD.exe
  C:\Windows\System\aFXKGyD.exe
  2⤵
  PID:2248
- C:\Windows\System\dOuhxjk.exe
  C:\Windows\System\dOuhxjk.exe
  2⤵
  PID:972
- C:\Windows\System\OoaaElY.exe
  C:\Windows\System\OoaaElY.exe
  2⤵
  PID:2652
- C:\Windows\System\qjPprLF.exe
  C:\Windows\System\qjPprLF.exe
  2⤵
  PID:1976
- C:\Windows\System\EUZDqeA.exe
  C:\Windows\System\EUZDqeA.exe
  2⤵
  PID:896
- C:\Windows\System\ykHPywy.exe
  C:\Windows\System\ykHPywy.exe
  2⤵
  PID:976
- C:\Windows\System\slAxEHe.exe
  C:\Windows\System\slAxEHe.exe
  2⤵
  PID:2892
- C:\Windows\System\mCuDFgg.exe
  C:\Windows\System\mCuDFgg.exe
  2⤵
  PID:2788
- C:\Windows\System\ElmPMdp.exe
  C:\Windows\System\ElmPMdp.exe
  2⤵
  PID:2152
- C:\Windows\System\SCBadXi.exe
  C:\Windows\System\SCBadXi.exe
  2⤵
  PID:2840
- C:\Windows\System\UFLZxIL.exe
  C:\Windows\System\UFLZxIL.exe
  2⤵
  PID:2372
- C:\Windows\System\warAMvs.exe
  C:\Windows\System\warAMvs.exe
  2⤵
  PID:2848
- C:\Windows\System\pUSDTvW.exe
  C:\Windows\System\pUSDTvW.exe
  2⤵
  PID:2164
- C:\Windows\System\TrWDGBv.exe
  C:\Windows\System\TrWDGBv.exe
  2⤵
  PID:1368
- C:\Windows\System\Uzrvhsz.exe
  C:\Windows\System\Uzrvhsz.exe
  2⤵
  PID:2496
- C:\Windows\System\WOGaVYq.exe
  C:\Windows\System\WOGaVYq.exe
  2⤵
  PID:1288
- C:\Windows\System\WhyDRkN.exe
  C:\Windows\System\WhyDRkN.exe
  2⤵
  PID:3064
- C:\Windows\System\DTpnuzP.exe
  C:\Windows\System\DTpnuzP.exe
  2⤵
  PID:1812
- C:\Windows\System\OlFhhTj.exe
  C:\Windows\System\OlFhhTj.exe
  2⤵
  PID:1724
- C:\Windows\System\nJGXwxt.exe
  C:\Windows\System\nJGXwxt.exe
  2⤵
  PID:1064
- C:\Windows\System\BZvNouB.exe
  C:\Windows\System\BZvNouB.exe
  2⤵
  PID:860
- C:\Windows\System\ogtnsIn.exe
  C:\Windows\System\ogtnsIn.exe
  2⤵
  PID:2008
- C:\Windows\System\yOBaNPE.exe
  C:\Windows\System\yOBaNPE.exe
  2⤵
  PID:2316
- C:\Windows\System\MeYLQCf.exe
  C:\Windows\System\MeYLQCf.exe
  2⤵
  PID:1468
- C:\Windows\System\FaUaKsZ.exe
  C:\Windows\System\FaUaKsZ.exe
  2⤵
  PID:2144
- C:\Windows\System\fNwjsFa.exe
  C:\Windows\System\fNwjsFa.exe
  2⤵
  PID:548
- C:\Windows\System\ONmjHdp.exe
  C:\Windows\System\ONmjHdp.exe
  2⤵
  PID:332
- C:\Windows\System\gXEXrjP.exe
  C:\Windows\System\gXEXrjP.exe
  2⤵
  PID:2284
- C:\Windows\System\WKwkeih.exe
  C:\Windows\System\WKwkeih.exe
  2⤵
  PID:1576
- C:\Windows\System\JguKQms.exe
  C:\Windows\System\JguKQms.exe
  2⤵
  PID:1548
- C:\Windows\System\QmgWNwG.exe
  C:\Windows\System\QmgWNwG.exe
  2⤵
  PID:1720
- C:\Windows\System\BRVKIxi.exe
  C:\Windows\System\BRVKIxi.exe
  2⤵
  PID:2596
- C:\Windows\System\goOLotP.exe
  C:\Windows\System\goOLotP.exe
  2⤵
  PID:2420
- C:\Windows\System\TEQujqK.exe
  C:\Windows\System\TEQujqK.exe
  2⤵
  PID:1508
- C:\Windows\System\iPfaHPW.exe
  C:\Windows\System\iPfaHPW.exe
  2⤵
  PID:2720
- C:\Windows\System\ywgkQqX.exe
  C:\Windows\System\ywgkQqX.exe
  2⤵
  PID:2688
- C:\Windows\System\PhYSmCf.exe
  C:\Windows\System\PhYSmCf.exe
  2⤵
  PID:2948
- C:\Windows\System\AQFXsqE.exe
  C:\Windows\System\AQFXsqE.exe
  2⤵
  PID:952
- C:\Windows\System\SJpNvwc.exe
  C:\Windows\System\SJpNvwc.exe
  2⤵
  PID:1640
- C:\Windows\System\IhVglwC.exe
  C:\Windows\System\IhVglwC.exe
  2⤵
  PID:2588
- C:\Windows\System\NKfQRFB.exe
  C:\Windows\System\NKfQRFB.exe
  2⤵
  PID:1732
- C:\Windows\System\sqCUyjv.exe
  C:\Windows\System\sqCUyjv.exe
  2⤵
  PID:2764
- C:\Windows\System\VIOsvAT.exe
  C:\Windows\System\VIOsvAT.exe
  2⤵
  PID:2944
- C:\Windows\System\PRStYLN.exe
  C:\Windows\System\PRStYLN.exe
  2⤵
  PID:2996
- C:\Windows\System\aGPbQGG.exe
  C:\Windows\System\aGPbQGG.exe
  2⤵
  PID:3032
- C:\Windows\System\tiYVuAs.exe
  C:\Windows\System\tiYVuAs.exe
  2⤵
  PID:2232
- C:\Windows\System\nbDKKoO.exe
  C:\Windows\System\nbDKKoO.exe
  2⤵
  PID:2224
- C:\Windows\System\LLaICVg.exe
  C:\Windows\System\LLaICVg.exe
  2⤵
  PID:2464
- C:\Windows\System\ACkOknC.exe
  C:\Windows\System\ACkOknC.exe
  2⤵
  PID:2344
- C:\Windows\System\iOSOfPi.exe
  C:\Windows\System\iOSOfPi.exe
  2⤵
  PID:2204
- C:\Windows\System\lKaXUbI.exe
  C:\Windows\System\lKaXUbI.exe
  2⤵
  PID:2548
- C:\Windows\System\qZeGTHg.exe
  C:\Windows\System\qZeGTHg.exe
  2⤵
  PID:2220
- C:\Windows\System\tzVPWGJ.exe
  C:\Windows\System\tzVPWGJ.exe
  2⤵
  PID:2564
- C:\Windows\System\dIDxkFQ.exe
  C:\Windows\System\dIDxkFQ.exe
  2⤵
  PID:2624
- C:\Windows\System\bZiypuU.exe
  C:\Windows\System\bZiypuU.exe
  2⤵
  PID:1780
- C:\Windows\System\ZFAroeU.exe
  C:\Windows\System\ZFAroeU.exe
  2⤵
  PID:2524
- C:\Windows\System\qStgTrH.exe
  C:\Windows\System\qStgTrH.exe
  2⤵
  PID:2004
- C:\Windows\System\oBLpIbY.exe
  C:\Windows\System\oBLpIbY.exe
  2⤵
  PID:1072
- C:\Windows\System\qQKxtxM.exe
  C:\Windows\System\qQKxtxM.exe
  2⤵
  PID:940
- C:\Windows\System\clhYMvX.exe
  C:\Windows\System\clhYMvX.exe
  2⤵
  PID:1080
- C:\Windows\System\LlrrHJU.exe
  C:\Windows\System\LlrrHJU.exe
  2⤵
  PID:2600
- C:\Windows\System\UKuHJoq.exe
  C:\Windows\System\UKuHJoq.exe
  2⤵
  PID:2696
- C:\Windows\System\kArlkSN.exe
  C:\Windows\System\kArlkSN.exe
  2⤵
  PID:2440
- C:\Windows\System\WBDxmUk.exe
  C:\Windows\System\WBDxmUk.exe
  2⤵
  PID:1604
- C:\Windows\System\KnzuPum.exe
  C:\Windows\System\KnzuPum.exe
  2⤵
  PID:2484
- C:\Windows\System\cVgrOpG.exe
  C:\Windows\System\cVgrOpG.exe
  2⤵
  PID:3020
- C:\Windows\System\oSoglUF.exe
  C:\Windows\System\oSoglUF.exe
  2⤵
  PID:1704
- C:\Windows\System\doQgrXj.exe
  C:\Windows\System\doQgrXj.exe
  2⤵
  PID:2272
- C:\Windows\System\VsiEHmk.exe
  C:\Windows\System\VsiEHmk.exe
  2⤵
  PID:640
- C:\Windows\System\uDarWWr.exe
  C:\Windows\System\uDarWWr.exe
  2⤵
  PID:1820
- C:\Windows\System\zFRjHAF.exe
  C:\Windows\System\zFRjHAF.exe
  2⤵
  PID:1164
- C:\Windows\System\OHYpmOk.exe
  C:\Windows\System\OHYpmOk.exe
  2⤵
  PID:2956
- C:\Windows\System\urYzzsR.exe
  C:\Windows\System\urYzzsR.exe
  2⤵
  PID:936
- C:\Windows\System\nEvmsLp.exe
  C:\Windows\System\nEvmsLp.exe
  2⤵
  PID:2352
- C:\Windows\System\rCOgWeX.exe
  C:\Windows\System\rCOgWeX.exe
  2⤵
  PID:2064
- C:\Windows\System\qoEcAne.exe
  C:\Windows\System\qoEcAne.exe
  2⤵
  PID:2088
- C:\Windows\System\YukgOFa.exe
  C:\Windows\System\YukgOFa.exe
  2⤵
  PID:2208
- C:\Windows\System\Lmcwlnh.exe
  C:\Windows\System\Lmcwlnh.exe
  2⤵
  PID:2552
- C:\Windows\System\waWTzuv.exe
  C:\Windows\System\waWTzuv.exe
  2⤵
  PID:1764
- C:\Windows\System\KAvvNvz.exe
  C:\Windows\System\KAvvNvz.exe
  2⤵
  PID:2012
- C:\Windows\System\IoKesvx.exe
  C:\Windows\System\IoKesvx.exe
  2⤵
  PID:1564
- C:\Windows\System\InDoBtN.exe
  C:\Windows\System\InDoBtN.exe
  2⤵
  PID:2672
- C:\Windows\System\wheMrPk.exe
  C:\Windows\System\wheMrPk.exe
  2⤵
  PID:1580
- C:\Windows\System\WWChkoT.exe
  C:\Windows\System\WWChkoT.exe
  2⤵
  PID:1624
- C:\Windows\System\TwEsaMV.exe
  C:\Windows\System\TwEsaMV.exe
  2⤵
  PID:2896
- C:\Windows\System\chrCsab.exe
  C:\Windows\System\chrCsab.exe
  2⤵
  PID:2752
- C:\Windows\System\jOoWoVC.exe
  C:\Windows\System\jOoWoVC.exe
  2⤵
  PID:2724
- C:\Windows\System\JGWnqaE.exe
  C:\Windows\System\JGWnqaE.exe
  2⤵
  PID:2508
- C:\Windows\System\FqYCoIv.exe
  C:\Windows\System\FqYCoIv.exe
  2⤵
  PID:2780
- C:\Windows\System\gDdFPQl.exe
  C:\Windows\System\gDdFPQl.exe
  2⤵
  PID:1864
- C:\Windows\System\ZQrdlfB.exe
  C:\Windows\System\ZQrdlfB.exe
  2⤵
  PID:2992
- C:\Windows\System\vpeiobN.exe
  C:\Windows\System\vpeiobN.exe
  2⤵
  PID:2160
- C:\Windows\System\SkrSTOu.exe
  C:\Windows\System\SkrSTOu.exe
  2⤵
  PID:2260
- C:\Windows\System\UgWGLvV.exe
  C:\Windows\System\UgWGLvV.exe
  2⤵
  PID:2836
- C:\Windows\System\OwtPFUF.exe
  C:\Windows\System\OwtPFUF.exe
  2⤵
  PID:3028
- C:\Windows\System\TvsNHfl.exe
  C:\Windows\System\TvsNHfl.exe
  2⤵
  PID:2432
- C:\Windows\System\MqkEiKV.exe
  C:\Windows\System\MqkEiKV.exe
  2⤵
  PID:820
- C:\Windows\System\qsdpsND.exe
  C:\Windows\System\qsdpsND.exe
  2⤵
  PID:968
- C:\Windows\System\vsywzyV.exe
  C:\Windows\System\vsywzyV.exe
  2⤵
  PID:2056
- C:\Windows\System\uXZuXSS.exe
  C:\Windows\System\uXZuXSS.exe
  2⤵
  PID:1540
- C:\Windows\System\LNynnTd.exe
  C:\Windows\System\LNynnTd.exe
  2⤵
  PID:540
- C:\Windows\System\NYPwlnd.exe
  C:\Windows\System\NYPwlnd.exe
  2⤵
  PID:868
- C:\Windows\System\wekUcLj.exe
  C:\Windows\System\wekUcLj.exe
  2⤵
  PID:2560
- C:\Windows\System\xDqwQBT.exe
  C:\Windows\System\xDqwQBT.exe
  2⤵
  PID:2192
- C:\Windows\System\YDymzTK.exe
  C:\Windows\System\YDymzTK.exe
  2⤵
  PID:2216
- C:\Windows\System\TCIzfSE.exe
  C:\Windows\System\TCIzfSE.exe
  2⤵
  PID:1636
- C:\Windows\System\uWABbNj.exe
  C:\Windows\System\uWABbNj.exe
  2⤵
  PID:1588
- C:\Windows\System\FbmBdpi.exe
  C:\Windows\System\FbmBdpi.exe
  2⤵
  PID:1684
- C:\Windows\System\uesuBWu.exe
  C:\Windows\System\uesuBWu.exe
  2⤵
  PID:1868
- C:\Windows\System\dsDqFCd.exe
  C:\Windows\System\dsDqFCd.exe
  2⤵
  PID:2760
- C:\Windows\System\hlQdDTA.exe
  C:\Windows\System\hlQdDTA.exe
  2⤵
  PID:3084
- C:\Windows\System\RgFkukE.exe
  C:\Windows\System\RgFkukE.exe
  2⤵
  PID:3100
- C:\Windows\System\BhmvHcp.exe
  C:\Windows\System\BhmvHcp.exe
  2⤵
  PID:3120
- C:\Windows\System\mTzhbtQ.exe
  C:\Windows\System\mTzhbtQ.exe
  2⤵
  PID:3140
- C:\Windows\System\byVCxgv.exe
  C:\Windows\System\byVCxgv.exe
  2⤵
  PID:3156
- C:\Windows\System\GVGzbJj.exe
  C:\Windows\System\GVGzbJj.exe
  2⤵
  PID:3184
- C:\Windows\System\SJDWgtj.exe
  C:\Windows\System\SJDWgtj.exe
  2⤵
  PID:3204
- C:\Windows\System\uioLGqk.exe
  C:\Windows\System\uioLGqk.exe
  2⤵
  PID:3236
- C:\Windows\System\xJLShau.exe
  C:\Windows\System\xJLShau.exe
  2⤵
  PID:3252
- C:\Windows\System\MbqZwxa.exe
  C:\Windows\System\MbqZwxa.exe
  2⤵
  PID:3268
- C:\Windows\System\LNJLzzO.exe
  C:\Windows\System\LNJLzzO.exe
  2⤵
  PID:3288
- C:\Windows\System\XJcjWeQ.exe
  C:\Windows\System\XJcjWeQ.exe
  2⤵
  PID:3304
- C:\Windows\System\CsnBYtb.exe
  C:\Windows\System\CsnBYtb.exe
  2⤵
  PID:3328
- C:\Windows\System\jAFUjsB.exe
  C:\Windows\System\jAFUjsB.exe
  2⤵
  PID:3348
- C:\Windows\System\UJpAunR.exe
  C:\Windows\System\UJpAunR.exe
  2⤵
  PID:3368
- C:\Windows\System\SNPTrNR.exe
  C:\Windows\System\SNPTrNR.exe
  2⤵
  PID:3388
- C:\Windows\System\oUcAvBF.exe
  C:\Windows\System\oUcAvBF.exe
  2⤵
  PID:3408
- C:\Windows\System\zXXtVTi.exe
  C:\Windows\System\zXXtVTi.exe
  2⤵
  PID:3424
- C:\Windows\System\KCQQGRH.exe
  C:\Windows\System\KCQQGRH.exe
  2⤵
  PID:3440
- C:\Windows\System\HdTLBOi.exe
  C:\Windows\System\HdTLBOi.exe
  2⤵
  PID:3460
- C:\Windows\System\cOJaQYu.exe
  C:\Windows\System\cOJaQYu.exe
  2⤵
  PID:3480
- C:\Windows\System\nWxyxeM.exe
  C:\Windows\System\nWxyxeM.exe
  2⤵
  PID:3504
- C:\Windows\System\cwdiQkg.exe
  C:\Windows\System\cwdiQkg.exe
  2⤵
  PID:3540
- C:\Windows\System\toATddc.exe
  C:\Windows\System\toATddc.exe
  2⤵
  PID:3556
- C:\Windows\System\xqSnIMr.exe
  C:\Windows\System\xqSnIMr.exe
  2⤵
  PID:3572
- C:\Windows\System\ISNrCtt.exe
  C:\Windows\System\ISNrCtt.exe
  2⤵
  PID:3588
- C:\Windows\System\THvpsuU.exe
  C:\Windows\System\THvpsuU.exe
  2⤵
  PID:3604
- C:\Windows\System\IPxIoRr.exe
  C:\Windows\System\IPxIoRr.exe
  2⤵
  PID:3624
- C:\Windows\System\MmvPkBH.exe
  C:\Windows\System\MmvPkBH.exe
  2⤵
  PID:3660
- C:\Windows\System\cXvZKGa.exe
  C:\Windows\System\cXvZKGa.exe
  2⤵
  PID:3676
- C:\Windows\System\soZJNke.exe
  C:\Windows\System\soZJNke.exe
  2⤵
  PID:3692
- C:\Windows\System\qgtJFBs.exe
  C:\Windows\System\qgtJFBs.exe
  2⤵
  PID:3716
- C:\Windows\System\ADjNecX.exe
  C:\Windows\System\ADjNecX.exe
  2⤵
  PID:3736
- C:\Windows\System\DBPcmfS.exe
  C:\Windows\System\DBPcmfS.exe
  2⤵
  PID:3756
- C:\Windows\System\VxrkEpf.exe
  C:\Windows\System\VxrkEpf.exe
  2⤵
  PID:3780
- C:\Windows\System\vESodNa.exe
  C:\Windows\System\vESodNa.exe
  2⤵
  PID:3800
- C:\Windows\System\MkqXTdR.exe
  C:\Windows\System\MkqXTdR.exe
  2⤵
  PID:3816
- C:\Windows\System\owapuSX.exe
  C:\Windows\System\owapuSX.exe
  2⤵
  PID:3840
- C:\Windows\System\myTmzne.exe
  C:\Windows\System\myTmzne.exe
  2⤵
  PID:3864
- C:\Windows\System\WMjSzdU.exe
  C:\Windows\System\WMjSzdU.exe
  2⤵
  PID:3884
- C:\Windows\System\YjfMNvD.exe
  C:\Windows\System\YjfMNvD.exe
  2⤵
  PID:3900
- C:\Windows\System\oNEvtIm.exe
  C:\Windows\System\oNEvtIm.exe
  2⤵
  PID:3924
- C:\Windows\System\QsElObP.exe
  C:\Windows\System\QsElObP.exe
  2⤵
  PID:3944
- C:\Windows\System\QaeWUZW.exe
  C:\Windows\System\QaeWUZW.exe
  2⤵
  PID:3960
- C:\Windows\System\WSAwXPg.exe
  C:\Windows\System\WSAwXPg.exe
  2⤵
  PID:3976
- C:\Windows\System\uVprYOL.exe
  C:\Windows\System\uVprYOL.exe
  2⤵
  PID:3996
- C:\Windows\System\gOEVfsj.exe
  C:\Windows\System\gOEVfsj.exe
  2⤵
  PID:4024
- C:\Windows\System\lilOdtC.exe
  C:\Windows\System\lilOdtC.exe
  2⤵
  PID:4040
- C:\Windows\System\vOXJjam.exe
  C:\Windows\System\vOXJjam.exe
  2⤵
  PID:4056
- C:\Windows\System\LxOdOjO.exe
  C:\Windows\System\LxOdOjO.exe
  2⤵
  PID:4072
- C:\Windows\System\sWfLCyW.exe
  C:\Windows\System\sWfLCyW.exe
  2⤵
  PID:4092
- C:\Windows\System\hQqysPf.exe
  C:\Windows\System\hQqysPf.exe
  2⤵
  PID:3136
- C:\Windows\System\CcYebnl.exe
  C:\Windows\System\CcYebnl.exe
  2⤵
  PID:3116
- C:\Windows\System\CXOfnIt.exe
  C:\Windows\System\CXOfnIt.exe
  2⤵
  PID:3164
- C:\Windows\System\osrxMhj.exe
  C:\Windows\System\osrxMhj.exe
  2⤵
  PID:3180
- C:\Windows\System\cbgCGkX.exe
  C:\Windows\System\cbgCGkX.exe
  2⤵
  PID:3216
- C:\Windows\System\mcbhKIQ.exe
  C:\Windows\System\mcbhKIQ.exe
  2⤵
  PID:3284
- C:\Windows\System\TEPouuA.exe
  C:\Windows\System\TEPouuA.exe
  2⤵
  PID:3232
- C:\Windows\System\fwxTKFW.exe
  C:\Windows\System\fwxTKFW.exe
  2⤵
  PID:3336
- C:\Windows\System\aoWAnpf.exe
  C:\Windows\System\aoWAnpf.exe
  2⤵
  PID:3312
- C:\Windows\System\csVVuWE.exe
  C:\Windows\System\csVVuWE.exe
  2⤵
  PID:3488
- C:\Windows\System\XHfYAmq.exe
  C:\Windows\System\XHfYAmq.exe
  2⤵
  PID:3476
- C:\Windows\System\jppNewW.exe
  C:\Windows\System\jppNewW.exe
  2⤵
  PID:3436
- C:\Windows\System\CROgYVD.exe
  C:\Windows\System\CROgYVD.exe
  2⤵
  PID:3552
- C:\Windows\System\OIMDJER.exe
  C:\Windows\System\OIMDJER.exe
  2⤵
  PID:3616
- C:\Windows\System\NZmRuFY.exe
  C:\Windows\System\NZmRuFY.exe
  2⤵
  PID:3512
- C:\Windows\System\iOlGAUG.exe
  C:\Windows\System\iOlGAUG.exe
  2⤵
  PID:3712
- C:\Windows\System\ptoJLbc.exe
  C:\Windows\System\ptoJLbc.exe
  2⤵
  PID:3536
- C:\Windows\System\icvpBOf.exe
  C:\Windows\System\icvpBOf.exe
  2⤵
  PID:3656
- C:\Windows\System\mpqCsfE.exe
  C:\Windows\System\mpqCsfE.exe
  2⤵
  PID:3688
- C:\Windows\System\ojbJlwm.exe
  C:\Windows\System\ojbJlwm.exe
  2⤵
  PID:3788
- C:\Windows\System\EbXYbEV.exe
  C:\Windows\System\EbXYbEV.exe
  2⤵
  PID:3828
- C:\Windows\System\pKtJTde.exe
  C:\Windows\System\pKtJTde.exe
  2⤵
  PID:3836
- C:\Windows\System\crPHUFA.exe
  C:\Windows\System\crPHUFA.exe
  2⤵
  PID:3880
- C:\Windows\System\IKGMtlz.exe
  C:\Windows\System\IKGMtlz.exe
  2⤵
  PID:3852
- C:\Windows\System\lryOeLP.exe
  C:\Windows\System\lryOeLP.exe
  2⤵
  PID:3956
- C:\Windows\System\QEueQXX.exe
  C:\Windows\System\QEueQXX.exe
  2⤵
  PID:3940
- C:\Windows\System\mpCWXBa.exe
  C:\Windows\System\mpCWXBa.exe
  2⤵
  PID:4068
- C:\Windows\System\PgGdQXX.exe
  C:\Windows\System\PgGdQXX.exe
  2⤵
  PID:3128
- C:\Windows\System\FjnjBrh.exe
  C:\Windows\System\FjnjBrh.exe
  2⤵
  PID:4008
- C:\Windows\System\wNeCsDo.exe
  C:\Windows\System\wNeCsDo.exe
  2⤵
  PID:3192
- C:\Windows\System\CMiJEXd.exe
  C:\Windows\System\CMiJEXd.exe
  2⤵
  PID:3228
- C:\Windows\System\yidIern.exe
  C:\Windows\System\yidIern.exe
  2⤵
  PID:4052
- C:\Windows\System\JCbpBlh.exe
  C:\Windows\System\JCbpBlh.exe
  2⤵
  PID:3324
- C:\Windows\System\dlQsQxQ.exe
  C:\Windows\System\dlQsQxQ.exe
  2⤵
  PID:2716
- C:\Windows\System\JxiNgtU.exe
  C:\Windows\System\JxiNgtU.exe
  2⤵
  PID:3176
- C:\Windows\System\wWnkkTp.exe
  C:\Windows\System\wWnkkTp.exe
  2⤵
  PID:3244
- C:\Windows\System\xZIzQlG.exe
  C:\Windows\System\xZIzQlG.exe
  2⤵
  PID:3448
- C:\Windows\System\yhEdPzI.exe
  C:\Windows\System\yhEdPzI.exe
  2⤵
  PID:3404
- C:\Windows\System\fIoJGtq.exe
  C:\Windows\System\fIoJGtq.exe
  2⤵
  PID:3564
- C:\Windows\System\EnbhSwh.exe
  C:\Windows\System\EnbhSwh.exe
  2⤵
  PID:3492
- C:\Windows\System\cmcYjfs.exe
  C:\Windows\System\cmcYjfs.exe
  2⤵
  PID:2120
- C:\Windows\System\PJHpJNZ.exe
  C:\Windows\System\PJHpJNZ.exe
  2⤵
  PID:3824
- C:\Windows\System\yzidhdR.exe
  C:\Windows\System\yzidhdR.exe
  2⤵
  PID:3632
- C:\Windows\System\DYoSnhj.exe
  C:\Windows\System\DYoSnhj.exe
  2⤵
  PID:3524
- C:\Windows\System\uhFigRQ.exe
  C:\Windows\System\uhFigRQ.exe
  2⤵
  PID:3872
- C:\Windows\System\zkcVfSZ.exe
  C:\Windows\System\zkcVfSZ.exe
  2⤵
  PID:3912
- C:\Windows\System\utNldBs.exe
  C:\Windows\System\utNldBs.exe
  2⤵
  PID:3992
- C:\Windows\System\Ceggyvj.exe
  C:\Windows\System\Ceggyvj.exe
  2⤵
  PID:4032
- C:\Windows\System\XyyhWhy.exe
  C:\Windows\System\XyyhWhy.exe
  2⤵
  PID:3972
- C:\Windows\System\iWJKAfX.exe
  C:\Windows\System\iWJKAfX.exe
  2⤵
  PID:3212
- C:\Windows\System\KATvmPq.exe
  C:\Windows\System\KATvmPq.exe
  2⤵
  PID:3108
- C:\Windows\System\HIkRUHH.exe
  C:\Windows\System\HIkRUHH.exe
  2⤵
  PID:3340
- C:\Windows\System\dHmepSh.exe
  C:\Windows\System\dHmepSh.exe
  2⤵
  PID:4084
- C:\Windows\System\ZlrffcW.exe
  C:\Windows\System\ZlrffcW.exe
  2⤵
  PID:3684
- C:\Windows\System\tDknbSB.exe
  C:\Windows\System\tDknbSB.exe
  2⤵
  PID:3640
- C:\Windows\System\TPVxTpW.exe
  C:\Windows\System\TPVxTpW.exe
  2⤵
  PID:3456
- C:\Windows\System\tSUhXyW.exe
  C:\Windows\System\tSUhXyW.exe
  2⤵
  PID:3672
- C:\Windows\System\UaSvkfx.exe
  C:\Windows\System\UaSvkfx.exe
  2⤵
  PID:3876
- C:\Windows\System\cPcSAIq.exe
  C:\Windows\System\cPcSAIq.exe
  2⤵
  PID:3952
- C:\Windows\System\QKJEIax.exe
  C:\Windows\System\QKJEIax.exe
  2⤵
  PID:3092
- C:\Windows\System\LUCOnwc.exe
  C:\Windows\System\LUCOnwc.exe
  2⤵
  PID:3468
- C:\Windows\System\JOFCKwS.exe
  C:\Windows\System\JOFCKwS.exe
  2⤵
  PID:3708
- C:\Windows\System\oGqNJvf.exe
  C:\Windows\System\oGqNJvf.exe
  2⤵
  PID:4036
- C:\Windows\System\wHKcrSp.exe
  C:\Windows\System\wHKcrSp.exe
  2⤵
  PID:3420
- C:\Windows\System\bichxBd.exe
  C:\Windows\System\bichxBd.exe
  2⤵
  PID:3832
- C:\Windows\System\GvwcyVB.exe
  C:\Windows\System\GvwcyVB.exe
  2⤵
  PID:3472
- C:\Windows\System\CpIJFOR.exe
  C:\Windows\System\CpIJFOR.exe
  2⤵
  PID:3296
- C:\Windows\System\YmyzItP.exe
  C:\Windows\System\YmyzItP.exe
  2⤵
  PID:3344
- C:\Windows\System\dacQHvx.exe
  C:\Windows\System\dacQHvx.exe
  2⤵
  PID:3196
- C:\Windows\System\DPLMtJM.exe
  C:\Windows\System\DPLMtJM.exe
  2⤵
  PID:3796
- C:\Windows\System\UndMIJN.exe
  C:\Windows\System\UndMIJN.exe
  2⤵
  PID:3896
- C:\Windows\System\CMmGnaQ.exe
  C:\Windows\System\CMmGnaQ.exe
  2⤵
  PID:3520
- C:\Windows\System\EiFzwmB.exe
  C:\Windows\System\EiFzwmB.exe
  2⤵
  PID:3732
- C:\Windows\System\nIdiVBt.exe
  C:\Windows\System\nIdiVBt.exe
  2⤵
  PID:4112
- C:\Windows\System\VDwBwyY.exe
  C:\Windows\System\VDwBwyY.exe
  2⤵
  PID:4128
- C:\Windows\System\KPvsOrH.exe
  C:\Windows\System\KPvsOrH.exe
  2⤵
  PID:4148
- C:\Windows\System\penJHpl.exe
  C:\Windows\System\penJHpl.exe
  2⤵
  PID:4164
- C:\Windows\System\TYWegVY.exe
  C:\Windows\System\TYWegVY.exe
  2⤵
  PID:4216
- C:\Windows\System\PIWWqXJ.exe
  C:\Windows\System\PIWWqXJ.exe
  2⤵
  PID:4232
- C:\Windows\System\HgpmzPy.exe
  C:\Windows\System\HgpmzPy.exe
  2⤵
  PID:4252
- C:\Windows\System\IwaMiRX.exe
  C:\Windows\System\IwaMiRX.exe
  2⤵
  PID:4268
- C:\Windows\System\SSjAaZz.exe
  C:\Windows\System\SSjAaZz.exe
  2⤵
  PID:4284
- C:\Windows\System\CrLbioB.exe
  C:\Windows\System\CrLbioB.exe
  2⤵
  PID:4300
- C:\Windows\System\PQGfyNV.exe
  C:\Windows\System\PQGfyNV.exe
  2⤵
  PID:4320
- C:\Windows\System\MTBOHLy.exe
  C:\Windows\System\MTBOHLy.exe
  2⤵
  PID:4336
- C:\Windows\System\alLyenw.exe
  C:\Windows\System\alLyenw.exe
  2⤵
  PID:4356
- C:\Windows\System\pTjRAXj.exe
  C:\Windows\System\pTjRAXj.exe
  2⤵
  PID:4380
- C:\Windows\System\lzTPQXr.exe
  C:\Windows\System\lzTPQXr.exe
  2⤵
  PID:4412
- C:\Windows\System\bRsonfF.exe
  C:\Windows\System\bRsonfF.exe
  2⤵
  PID:4428
- C:\Windows\System\vSALbaA.exe
  C:\Windows\System\vSALbaA.exe
  2⤵
  PID:4452
- C:\Windows\System\wjLzUdV.exe
  C:\Windows\System\wjLzUdV.exe
  2⤵
  PID:4468
- C:\Windows\System\vmRaqkR.exe
  C:\Windows\System\vmRaqkR.exe
  2⤵
  PID:4484
- C:\Windows\System\Wwyrnbp.exe
  C:\Windows\System\Wwyrnbp.exe
  2⤵
  PID:4504
- C:\Windows\System\bYxqiNR.exe
  C:\Windows\System\bYxqiNR.exe
  2⤵
  PID:4520
- C:\Windows\System\eFgBmIo.exe
  C:\Windows\System\eFgBmIo.exe
  2⤵
  PID:4544
- C:\Windows\System\JzWnMjm.exe
  C:\Windows\System\JzWnMjm.exe
  2⤵
  PID:4576
- C:\Windows\System\PkPuLIj.exe
  C:\Windows\System\PkPuLIj.exe
  2⤵
  PID:4596
- C:\Windows\System\MMSOfLn.exe
  C:\Windows\System\MMSOfLn.exe
  2⤵
  PID:4612
- C:\Windows\System\WBQbeWO.exe
  C:\Windows\System\WBQbeWO.exe
  2⤵
  PID:4628
- C:\Windows\System\KIAaMrz.exe
  C:\Windows\System\KIAaMrz.exe
  2⤵
  PID:4644
- C:\Windows\System\KVfPOns.exe
  C:\Windows\System\KVfPOns.exe
  2⤵
  PID:4672
- C:\Windows\System\QFCacJb.exe
  C:\Windows\System\QFCacJb.exe
  2⤵
  PID:4688
- C:\Windows\System\UWeMOTB.exe
  C:\Windows\System\UWeMOTB.exe
  2⤵
  PID:4704
- C:\Windows\System\ttovpJZ.exe
  C:\Windows\System\ttovpJZ.exe
  2⤵
  PID:4720
- C:\Windows\System\UfHumgX.exe
  C:\Windows\System\UfHumgX.exe
  2⤵
  PID:4736
- C:\Windows\System\gbycCeK.exe
  C:\Windows\System\gbycCeK.exe
  2⤵
  PID:4756
- C:\Windows\System\bIpvOaT.exe
  C:\Windows\System\bIpvOaT.exe
  2⤵
  PID:4772
- C:\Windows\System\PgmzFqs.exe
  C:\Windows\System\PgmzFqs.exe
  2⤵
  PID:4792
- C:\Windows\System\LxoIKGs.exe
  C:\Windows\System\LxoIKGs.exe
  2⤵
  PID:4808
- C:\Windows\System\uvOshCK.exe
  C:\Windows\System\uvOshCK.exe
  2⤵
  PID:4828
- C:\Windows\System\OgHSlnQ.exe
  C:\Windows\System\OgHSlnQ.exe
  2⤵
  PID:4844
- C:\Windows\System\qVaWKMH.exe
  C:\Windows\System\qVaWKMH.exe
  2⤵
  PID:4864
- C:\Windows\System\mWCFmjU.exe
  C:\Windows\System\mWCFmjU.exe
  2⤵
  PID:4880
- C:\Windows\System\qEPtgvS.exe
  C:\Windows\System\qEPtgvS.exe
  2⤵
  PID:4896
- C:\Windows\System\DYIXYYc.exe
  C:\Windows\System\DYIXYYc.exe
  2⤵
  PID:4912
- C:\Windows\System\VgEMdBZ.exe
  C:\Windows\System\VgEMdBZ.exe
  2⤵
  PID:4932
- C:\Windows\System\igTKMPe.exe
  C:\Windows\System\igTKMPe.exe
  2⤵
  PID:4976
- C:\Windows\System\ZskVPTQ.exe
  C:\Windows\System\ZskVPTQ.exe
  2⤵
  PID:4992
- C:\Windows\System\MoLHEKs.exe
  C:\Windows\System\MoLHEKs.exe
  2⤵
  PID:5036
- C:\Windows\System\NfzklDf.exe
  C:\Windows\System\NfzklDf.exe
  2⤵
  PID:5052
- C:\Windows\System\YETlHWR.exe
  C:\Windows\System\YETlHWR.exe
  2⤵
  PID:5068
- C:\Windows\System\kiwmMMy.exe
  C:\Windows\System\kiwmMMy.exe
  2⤵
  PID:5096
- C:\Windows\System\SRbYHWJ.exe
  C:\Windows\System\SRbYHWJ.exe
  2⤵
  PID:3152
- C:\Windows\System\ZWDQsCQ.exe
  C:\Windows\System\ZWDQsCQ.exe
  2⤵
  PID:3768
- C:\Windows\System\zVbnlIP.exe
  C:\Windows\System\zVbnlIP.exe
  2⤵
  PID:4120
- C:\Windows\System\mXUpTlM.exe
  C:\Windows\System\mXUpTlM.exe
  2⤵
  PID:4192
- C:\Windows\System\zWltThY.exe
  C:\Windows\System\zWltThY.exe
  2⤵
  PID:4100
- C:\Windows\System\LIGoWcj.exe
  C:\Windows\System\LIGoWcj.exe
  2⤵
  PID:4172
- C:\Windows\System\hweaLBy.exe
  C:\Windows\System\hweaLBy.exe
  2⤵
  PID:4224
- C:\Windows\System\spfipci.exe
  C:\Windows\System\spfipci.exe
  2⤵
  PID:4296
- C:\Windows\System\FUreNjt.exe
  C:\Windows\System\FUreNjt.exe
  2⤵
  PID:4368
- C:\Windows\System\kjUlLBf.exe
  C:\Windows\System\kjUlLBf.exe
  2⤵
  PID:4276
- C:\Windows\System\QbaqLTE.exe
  C:\Windows\System\QbaqLTE.exe
  2⤵
  PID:4280
- C:\Windows\System\UjwWLsm.exe
  C:\Windows\System\UjwWLsm.exe
  2⤵
  PID:4388
- C:\Windows\System\NTHkZZQ.exe
  C:\Windows\System\NTHkZZQ.exe
  2⤵
  PID:4404
- C:\Windows\System\dUWbpSB.exe
  C:\Windows\System\dUWbpSB.exe
  2⤵
  PID:4460
- C:\Windows\System\JqhpCTJ.exe
  C:\Windows\System\JqhpCTJ.exe
  2⤵
  PID:4528
- C:\Windows\System\sYrncZs.exe
  C:\Windows\System\sYrncZs.exe
  2⤵
  PID:4444
- C:\Windows\System\adWkVhN.exe
  C:\Windows\System\adWkVhN.exe
  2⤵
  PID:4480
- C:\Windows\System\fENXWvh.exe
  C:\Windows\System\fENXWvh.exe
  2⤵
  PID:4620
- C:\Windows\System\VtzyFKb.exe
  C:\Windows\System\VtzyFKb.exe
  2⤵
  PID:4652
- C:\Windows\System\EZMvFFT.exe
  C:\Windows\System\EZMvFFT.exe
  2⤵
  PID:4696
- C:\Windows\System\yvgnpqv.exe
  C:\Windows\System\yvgnpqv.exe
  2⤵
  PID:4764
- C:\Windows\System\nLhdLJx.exe
  C:\Windows\System\nLhdLJx.exe
  2⤵
  PID:4840
- C:\Windows\System\bMdVqdp.exe
  C:\Windows\System\bMdVqdp.exe
  2⤵
  PID:4940
- C:\Windows\System\AnJfxho.exe
  C:\Windows\System\AnJfxho.exe
  2⤵
  PID:4952
- C:\Windows\System\leNjekQ.exe
  C:\Windows\System\leNjekQ.exe
  2⤵
  PID:4780
- C:\Windows\System\gUDuGLd.exe
  C:\Windows\System\gUDuGLd.exe
  2⤵
  PID:4824
- C:\Windows\System\OCuVvrM.exe
  C:\Windows\System\OCuVvrM.exe
  2⤵
  PID:4888
- C:\Windows\System\esWdSJS.exe
  C:\Windows\System\esWdSJS.exe
  2⤵
  PID:4744
- C:\Windows\System\gyFUjlP.exe
  C:\Windows\System\gyFUjlP.exe
  2⤵
  PID:5000
- C:\Windows\System\RJhRNEC.exe
  C:\Windows\System\RJhRNEC.exe
  2⤵
  PID:5024
- C:\Windows\System\UpXYeOd.exe
  C:\Windows\System\UpXYeOd.exe
  2⤵
  PID:5048
- C:\Windows\System\bIZYJKS.exe
  C:\Windows\System\bIZYJKS.exe
  2⤵
  PID:5092
- C:\Windows\System\qBFNrcK.exe
  C:\Windows\System\qBFNrcK.exe
  2⤵
  PID:5112
- C:\Windows\System\NDXMUzA.exe
  C:\Windows\System\NDXMUzA.exe
  2⤵
  PID:3856
- C:\Windows\System\dVkkAzq.exe
  C:\Windows\System\dVkkAzq.exe
  2⤵
  PID:4176
- C:\Windows\System\FLIsNVd.exe
  C:\Windows\System\FLIsNVd.exe
  2⤵
  PID:4196
- C:\Windows\System\HsUtMeY.exe
  C:\Windows\System\HsUtMeY.exe
  2⤵
  PID:4208
- C:\Windows\System\IqprgEL.exe
  C:\Windows\System\IqprgEL.exe
  2⤵
  PID:4400
- C:\Windows\System\JHvUqbn.exe
  C:\Windows\System\JHvUqbn.exe
  2⤵
  PID:4500
- C:\Windows\System\RqakKrm.exe
  C:\Windows\System\RqakKrm.exe
  2⤵
  PID:4348
- C:\Windows\System\vqXDYnW.exe
  C:\Windows\System\vqXDYnW.exe
  2⤵
  PID:4240
- C:\Windows\System\ilbgjQl.exe
  C:\Windows\System\ilbgjQl.exe
  2⤵
  PID:4556
- C:\Windows\System\NMczMhP.exe
  C:\Windows\System\NMczMhP.exe
  2⤵
  PID:4592
- C:\Windows\System\FSRYqGF.exe
  C:\Windows\System\FSRYqGF.exe
  2⤵
  PID:4624
- C:\Windows\System\TObyZRv.exe
  C:\Windows\System\TObyZRv.exe
  2⤵
  PID:4732
- C:\Windows\System\hsZHfgr.exe
  C:\Windows\System\hsZHfgr.exe
  2⤵
  PID:4748
- C:\Windows\System\vujfAxN.exe
  C:\Windows\System\vujfAxN.exe
  2⤵
  PID:4820
- C:\Windows\System\KQArSYF.exe
  C:\Windows\System\KQArSYF.exe
  2⤵
  PID:4800
- C:\Windows\System\sOpvdLv.exe
  C:\Windows\System\sOpvdLv.exe
  2⤵
  PID:4788
- C:\Windows\System\QPPIXgG.exe
  C:\Windows\System\QPPIXgG.exe
  2⤵
  PID:5088
- C:\Windows\System\yINFxoF.exe
  C:\Windows\System\yINFxoF.exe
  2⤵
  PID:4160
- C:\Windows\System\BfoERBG.exe
  C:\Windows\System\BfoERBG.exe
  2⤵
  PID:5044
- C:\Windows\System\sSSfkqo.exe
  C:\Windows\System\sSSfkqo.exe
  2⤵
  PID:4640
- C:\Windows\System\OQVOrgd.exe
  C:\Windows\System\OQVOrgd.exe
  2⤵
  PID:4184
- C:\Windows\System\sifHuZV.exe
  C:\Windows\System\sifHuZV.exe
  2⤵
  PID:4364
- C:\Windows\System\LkPFHMh.exe
  C:\Windows\System\LkPFHMh.exe
  2⤵
  PID:4536
- C:\Windows\System\UqSODPw.exe
  C:\Windows\System\UqSODPw.exe
  2⤵
  PID:4588
- C:\Windows\System\VkrfKTT.exe
  C:\Windows\System\VkrfKTT.exe
  2⤵
  PID:4856
- C:\Windows\System\lZXmSCN.exe
  C:\Windows\System\lZXmSCN.exe
  2⤵
  PID:4344
- C:\Windows\System\FsxRkup.exe
  C:\Windows\System\FsxRkup.exe
  2⤵
  PID:4876
- C:\Windows\System\QYcrNfY.exe
  C:\Windows\System\QYcrNfY.exe
  2⤵
  PID:4904
- C:\Windows\System\gMRAgvr.exe
  C:\Windows\System\gMRAgvr.exe
  2⤵
  PID:5060
- C:\Windows\System\YCeYZFn.exe
  C:\Windows\System\YCeYZFn.exe
  2⤵
  PID:4108
- C:\Windows\System\ligVFTP.exe
  C:\Windows\System\ligVFTP.exe
  2⤵
  PID:4212
- C:\Windows\System\MEsbfql.exe
  C:\Windows\System\MEsbfql.exe
  2⤵
  PID:4396
- C:\Windows\System\UAdLTLj.exe
  C:\Windows\System\UAdLTLj.exe
  2⤵
  PID:4264
- C:\Windows\System\wNVLape.exe
  C:\Windows\System\wNVLape.exe
  2⤵
  PID:4424
- C:\Windows\System\OpMCtJh.exe
  C:\Windows\System\OpMCtJh.exe
  2⤵
  PID:4816
- C:\Windows\System\jNClVAG.exe
  C:\Windows\System\jNClVAG.exe
  2⤵
  PID:4984
- C:\Windows\System\ejHdPKL.exe
  C:\Windows\System\ejHdPKL.exe
  2⤵
  PID:4552
- C:\Windows\System\vwxekJy.exe
  C:\Windows\System\vwxekJy.exe
  2⤵
  PID:5064
- C:\Windows\System\DuNksQj.exe
  C:\Windows\System\DuNksQj.exe
  2⤵
  PID:4144
- C:\Windows\System\gvKBHoP.exe
  C:\Windows\System\gvKBHoP.exe
  2⤵
  PID:4244
- C:\Windows\System\jYsTXDf.exe
  C:\Windows\System\jYsTXDf.exe
  2⤵
  PID:4136
- C:\Windows\System\fcqIrsf.exe
  C:\Windows\System\fcqIrsf.exe
  2⤵
  PID:5012
- C:\Windows\System\pYZFyvs.exe
  C:\Windows\System\pYZFyvs.exe
  2⤵
  PID:4668
- C:\Windows\System\dhLhKHv.exe
  C:\Windows\System\dhLhKHv.exe
  2⤵
  PID:5136
- C:\Windows\System\TVUOhKl.exe
  C:\Windows\System\TVUOhKl.exe
  2⤵
  PID:5152
- C:\Windows\System\ajxUTLZ.exe
  C:\Windows\System\ajxUTLZ.exe
  2⤵
  PID:5176
- C:\Windows\System\bbMQOFK.exe
  C:\Windows\System\bbMQOFK.exe
  2⤵
  PID:5192
- C:\Windows\System\eDctNUl.exe
  C:\Windows\System\eDctNUl.exe
  2⤵
  PID:5212
- C:\Windows\System\dJhmJAz.exe
  C:\Windows\System\dJhmJAz.exe
  2⤵
  PID:5228
- C:\Windows\System\LIRIUpu.exe
  C:\Windows\System\LIRIUpu.exe
  2⤵
  PID:5248
- C:\Windows\System\lbyrgHP.exe
  C:\Windows\System\lbyrgHP.exe
  2⤵
  PID:5268
- C:\Windows\System\TpVtUex.exe
  C:\Windows\System\TpVtUex.exe
  2⤵
  PID:5288
- C:\Windows\System\Xzqbpri.exe
  C:\Windows\System\Xzqbpri.exe
  2⤵
  PID:5308
- C:\Windows\System\CtswIEB.exe
  C:\Windows\System\CtswIEB.exe
  2⤵
  PID:5328
- C:\Windows\System\YjLedya.exe
  C:\Windows\System\YjLedya.exe
  2⤵
  PID:5348
- C:\Windows\System\oCTckWC.exe
  C:\Windows\System\oCTckWC.exe
  2⤵
  PID:5368
- C:\Windows\System\fbTuHiy.exe
  C:\Windows\System\fbTuHiy.exe
  2⤵
  PID:5388
- C:\Windows\System\hFqPvsf.exe
  C:\Windows\System\hFqPvsf.exe
  2⤵
  PID:5404
- C:\Windows\System\ZZJKNJt.exe
  C:\Windows\System\ZZJKNJt.exe
  2⤵
  PID:5420
- C:\Windows\System\BYtSuAT.exe
  C:\Windows\System\BYtSuAT.exe
  2⤵
  PID:5452
- C:\Windows\System\xlodrEj.exe
  C:\Windows\System\xlodrEj.exe
  2⤵
  PID:5472
- C:\Windows\System\ySjGDtw.exe
  C:\Windows\System\ySjGDtw.exe
  2⤵
  PID:5492
- C:\Windows\System\VURpLvk.exe
  C:\Windows\System\VURpLvk.exe
  2⤵
  PID:5512
- C:\Windows\System\clEaUGC.exe
  C:\Windows\System\clEaUGC.exe
  2⤵
  PID:5528
- C:\Windows\System\RTkpdqw.exe
  C:\Windows\System\RTkpdqw.exe
  2⤵
  PID:5560
- C:\Windows\System\FQQohlf.exe
  C:\Windows\System\FQQohlf.exe
  2⤵
  PID:5576
- C:\Windows\System\AwkAmRf.exe
  C:\Windows\System\AwkAmRf.exe
  2⤵
  PID:5592
- C:\Windows\System\TvTlSNg.exe
  C:\Windows\System\TvTlSNg.exe
  2⤵
  PID:5612
- C:\Windows\System\PVYKGLT.exe
  C:\Windows\System\PVYKGLT.exe
  2⤵
  PID:5632
- C:\Windows\System\erBUXkC.exe
  C:\Windows\System\erBUXkC.exe
  2⤵
  PID:5648
- C:\Windows\System\zjlWozG.exe
  C:\Windows\System\zjlWozG.exe
  2⤵
  PID:5664
- C:\Windows\System\QMblQqq.exe
  C:\Windows\System\QMblQqq.exe
  2⤵
  PID:5692
- C:\Windows\System\fZpWqqY.exe
  C:\Windows\System\fZpWqqY.exe
  2⤵
  PID:5708
- C:\Windows\System\maYPaRf.exe
  C:\Windows\System\maYPaRf.exe
  2⤵
  PID:5728
- C:\Windows\System\ZnFduXy.exe
  C:\Windows\System\ZnFduXy.exe
  2⤵
  PID:5744
- C:\Windows\System\DWCRsVX.exe
  C:\Windows\System\DWCRsVX.exe
  2⤵
  PID:5764
- C:\Windows\System\NArJlHE.exe
  C:\Windows\System\NArJlHE.exe
  2⤵
  PID:5780
- C:\Windows\System\ehYBTEl.exe
  C:\Windows\System\ehYBTEl.exe
  2⤵
  PID:5796
- C:\Windows\System\VNQueEc.exe
  C:\Windows\System\VNQueEc.exe
  2⤵
  PID:5816
- C:\Windows\System\sxCNBzS.exe
  C:\Windows\System\sxCNBzS.exe
  2⤵
  PID:5836
- C:\Windows\System\TlOqwoF.exe
  C:\Windows\System\TlOqwoF.exe
  2⤵
  PID:5852
- C:\Windows\System\figCWif.exe
  C:\Windows\System\figCWif.exe
  2⤵
  PID:5868
- C:\Windows\System\HfTrDoI.exe
  C:\Windows\System\HfTrDoI.exe
  2⤵
  PID:5888
- C:\Windows\System\AHJUCrQ.exe
  C:\Windows\System\AHJUCrQ.exe
  2⤵
  PID:5904
- C:\Windows\System\BxgsOXN.exe
  C:\Windows\System\BxgsOXN.exe
  2⤵
  PID:5924
- C:\Windows\System\bYYnJSp.exe
  C:\Windows\System\bYYnJSp.exe
  2⤵
  PID:5948
- C:\Windows\System\hUFMGlN.exe
  C:\Windows\System\hUFMGlN.exe
  2⤵
  PID:6004
- C:\Windows\System\JMxajCr.exe
  C:\Windows\System\JMxajCr.exe
  2⤵
  PID:6020
- C:\Windows\System\zWpqOee.exe
  C:\Windows\System\zWpqOee.exe
  2⤵
  PID:6036
- C:\Windows\System\VhSPLyD.exe
  C:\Windows\System\VhSPLyD.exe
  2⤵
  PID:6056
- C:\Windows\System\AtDfkBw.exe
  C:\Windows\System\AtDfkBw.exe
  2⤵
  PID:6076
- C:\Windows\System\poEcyRE.exe
  C:\Windows\System\poEcyRE.exe
  2⤵
  PID:6092
- C:\Windows\System\hWAXibW.exe
  C:\Windows\System\hWAXibW.exe
  2⤵
  PID:6108
- C:\Windows\System\nayhsfH.exe
  C:\Windows\System\nayhsfH.exe
  2⤵
  PID:6128
- C:\Windows\System\MALchbC.exe
  C:\Windows\System\MALchbC.exe
  2⤵
  PID:3384
- C:\Windows\System\xJhRQmJ.exe
  C:\Windows\System\xJhRQmJ.exe
  2⤵
  PID:4292
- C:\Windows\System\ZSlCWcD.exe
  C:\Windows\System\ZSlCWcD.exe
  2⤵
  PID:5144
- C:\Windows\System\jYjonDx.exe
  C:\Windows\System\jYjonDx.exe
  2⤵
  PID:5172
- C:\Windows\System\WkcNJdR.exe
  C:\Windows\System\WkcNJdR.exe
  2⤵
  PID:5188
- C:\Windows\System\lzSCvXp.exe
  C:\Windows\System\lzSCvXp.exe
  2⤵
  PID:5208
- C:\Windows\System\ojsNpPH.exe
  C:\Windows\System\ojsNpPH.exe
  2⤵
  PID:5300
- C:\Windows\System\YhpHGAs.exe
  C:\Windows\System\YhpHGAs.exe
  2⤵
  PID:5320
- C:\Windows\System\MnWLSBC.exe
  C:\Windows\System\MnWLSBC.exe
  2⤵
  PID:5256
- C:\Windows\System\XkmHqjX.exe
  C:\Windows\System\XkmHqjX.exe
  2⤵
  PID:5400
- C:\Windows\System\rnUBalU.exe
  C:\Windows\System\rnUBalU.exe
  2⤵
  PID:5440
- C:\Windows\System\tfyLeiT.exe
  C:\Windows\System\tfyLeiT.exe
  2⤵
  PID:5384
- C:\Windows\System\xTrbKRH.exe
  C:\Windows\System\xTrbKRH.exe
  2⤵
  PID:5460
- C:\Windows\System\aiZdHVO.exe
  C:\Windows\System\aiZdHVO.exe
  2⤵
  PID:5488
- C:\Windows\System\gcOTzkb.exe
  C:\Windows\System\gcOTzkb.exe
  2⤵
  PID:5536
- C:\Windows\System\zEKWYBW.exe
  C:\Windows\System\zEKWYBW.exe
  2⤵
  PID:5552
- C:\Windows\System\spfCkva.exe
  C:\Windows\System\spfCkva.exe
  2⤵
  PID:5600
- C:\Windows\System\qznEylL.exe
  C:\Windows\System\qznEylL.exe
  2⤵
  PID:5584
- C:\Windows\System\xIwOkyi.exe
  C:\Windows\System\xIwOkyi.exe
  2⤵
  PID:5624
- C:\Windows\System\SqyFhIa.exe
  C:\Windows\System\SqyFhIa.exe
  2⤵
  PID:5672
- C:\Windows\System\RHShpZj.exe
  C:\Windows\System\RHShpZj.exe
  2⤵
  PID:5684
- C:\Windows\System\qetCqrw.exe
  C:\Windows\System\qetCqrw.exe
  2⤵
  PID:5900
- C:\Windows\System\SpzqtnO.exe
  C:\Windows\System\SpzqtnO.exe
  2⤵
  PID:5944
- C:\Windows\System\EHIBbHo.exe
  C:\Windows\System\EHIBbHo.exe
  2⤵
  PID:5772
- C:\Windows\System\mKbmIto.exe
  C:\Windows\System\mKbmIto.exe
  2⤵
  PID:5700
- C:\Windows\System\ijGoMla.exe
  C:\Windows\System\ijGoMla.exe
  2⤵
  PID:5968
- C:\Windows\System\wpOpOeX.exe
  C:\Windows\System\wpOpOeX.exe
  2⤵
  PID:5980
- C:\Windows\System\yqQpKjC.exe
  C:\Windows\System\yqQpKjC.exe
  2⤵
  PID:5880
- C:\Windows\System\cvFdxdI.exe
  C:\Windows\System\cvFdxdI.exe
  2⤵
  PID:6012
- C:\Windows\System\UBZlJFY.exe
  C:\Windows\System\UBZlJFY.exe
  2⤵
  PID:6052
- C:\Windows\System\Vejzcrz.exe
  C:\Windows\System\Vejzcrz.exe
  2⤵
  PID:6124
- C:\Windows\System\msfqhrd.exe
  C:\Windows\System\msfqhrd.exe
  2⤵
  PID:6104
- C:\Windows\System\tkbWpSi.exe
  C:\Windows\System\tkbWpSi.exe
  2⤵
  PID:5132
- C:\Windows\System\FqTYHnZ.exe
  C:\Windows\System\FqTYHnZ.exe
  2⤵
  PID:4156
- C:\Windows\System\qGnDuWQ.exe
  C:\Windows\System\qGnDuWQ.exe
  2⤵
  PID:5108
- C:\Windows\System\rjOlaYl.exe
  C:\Windows\System\rjOlaYl.exe
  2⤵
  PID:5220
- C:\Windows\System\iJIqRMs.exe
  C:\Windows\System\iJIqRMs.exe
  2⤵
  PID:5304
- C:\Windows\System\chUCLOB.exe
  C:\Windows\System\chUCLOB.exe
  2⤵
  PID:5436
- C:\Windows\System\tCjbFtm.exe
  C:\Windows\System\tCjbFtm.exe
  2⤵
  PID:5540
- C:\Windows\System\nhbXicj.exe
  C:\Windows\System\nhbXicj.exe
  2⤵
  PID:5608
- C:\Windows\System\nazVGNa.exe
  C:\Windows\System\nazVGNa.exe
  2⤵
  PID:5716
- C:\Windows\System\YYjZeFs.exe
  C:\Windows\System\YYjZeFs.exe
  2⤵
  PID:5792
- C:\Windows\System\KAtMNZw.exe
  C:\Windows\System\KAtMNZw.exe
  2⤵
  PID:5280
- C:\Windows\System\drXjbdI.exe
  C:\Windows\System\drXjbdI.exe
  2⤵
  PID:5432
- C:\Windows\System\FbRcXyJ.exe
  C:\Windows\System\FbRcXyJ.exe
  2⤵
  PID:5524
- C:\Windows\System\FBozHmy.exe
  C:\Windows\System\FBozHmy.exe
  2⤵
  PID:5572
- C:\Windows\System\JphROZH.exe
  C:\Windows\System\JphROZH.exe
  2⤵
  PID:5680
- C:\Windows\System\ZRFikbA.exe
  C:\Windows\System\ZRFikbA.exe
  2⤵
  PID:5848
- C:\Windows\System\DIHemcU.exe
  C:\Windows\System\DIHemcU.exe
  2⤵
  PID:5912
- C:\Windows\System\MtQZTug.exe
  C:\Windows\System\MtQZTug.exe
  2⤵
  PID:6032
- C:\Windows\System\wmAfVNQ.exe
  C:\Windows\System\wmAfVNQ.exe
  2⤵
  PID:6072
- C:\Windows\System\NkWUojx.exe
  C:\Windows\System\NkWUojx.exe
  2⤵
  PID:6120
- C:\Windows\System\RBHYSRh.exe
  C:\Windows\System\RBHYSRh.exe
  2⤵
  PID:5032
- C:\Windows\System\xwyWNZG.exe
  C:\Windows\System\xwyWNZG.exe
  2⤵
  PID:5244
- C:\Windows\System\ZHvEzJk.exe
  C:\Windows\System\ZHvEzJk.exe
  2⤵
  PID:5448
- C:\Windows\System\JrjldWj.exe
  C:\Windows\System\JrjldWj.exe
  2⤵
  PID:5184
- C:\Windows\System\lLHgFku.exe
  C:\Windows\System\lLHgFku.exe
  2⤵
  PID:5760
- C:\Windows\System\BwYlqPB.exe
  C:\Windows\System\BwYlqPB.exe
  2⤵
  PID:5860
- C:\Windows\System\qoNpBfe.exe
  C:\Windows\System\qoNpBfe.exe
  2⤵
  PID:5344
- C:\Windows\System\zQfHoPX.exe
  C:\Windows\System\zQfHoPX.exe
  2⤵
  PID:5876
- C:\Windows\System\njNgwmW.exe
  C:\Windows\System\njNgwmW.exe
  2⤵
  PID:6048
- C:\Windows\System\hejlrIt.exe
  C:\Windows\System\hejlrIt.exe
  2⤵
  PID:5380
- C:\Windows\System\zFUApyL.exe
  C:\Windows\System\zFUApyL.exe
  2⤵
  PID:4892
- C:\Windows\System\JeWgNgi.exe
  C:\Windows\System\JeWgNgi.exe
  2⤵
  PID:5720
- C:\Windows\System\VVUHoEN.exe
  C:\Windows\System\VVUHoEN.exe
  2⤵
  PID:5812
- C:\Windows\System\SGexLZf.exe
  C:\Windows\System\SGexLZf.exe
  2⤵
  PID:5224
- C:\Windows\System\bXPuFnT.exe
  C:\Windows\System\bXPuFnT.exe
  2⤵
  PID:5568
- C:\Windows\System\sSysLPO.exe
  C:\Windows\System\sSysLPO.exe
  2⤵
  PID:6140
- C:\Windows\System\aIlDDbg.exe
  C:\Windows\System\aIlDDbg.exe
  2⤵
  PID:5484
- C:\Windows\System\tQxacsY.exe
  C:\Windows\System\tQxacsY.exe
  2⤵
  PID:6100
- C:\Windows\System\SVmXNSM.exe
  C:\Windows\System\SVmXNSM.exe
  2⤵
  PID:5940
- C:\Windows\System\FXZzhFR.exe
  C:\Windows\System\FXZzhFR.exe
  2⤵
  PID:5976
- C:\Windows\System\zmxhwHE.exe
  C:\Windows\System\zmxhwHE.exe
  2⤵
  PID:5468
- C:\Windows\System\tOGyGZP.exe
  C:\Windows\System\tOGyGZP.exe
  2⤵
  PID:5128
- C:\Windows\System\IONjgli.exe
  C:\Windows\System\IONjgli.exe
  2⤵
  PID:5756
- C:\Windows\System\wGgJpKA.exe
  C:\Windows\System\wGgJpKA.exe
  2⤵
  PID:4728
- C:\Windows\System\drWHgSW.exe
  C:\Windows\System\drWHgSW.exe
  2⤵
  PID:5548
- C:\Windows\System\durirgH.exe
  C:\Windows\System\durirgH.exe
  2⤵
  PID:5828
- C:\Windows\System\WrNfWSQ.exe
  C:\Windows\System\WrNfWSQ.exe
  2⤵
  PID:6160
- C:\Windows\System\IPAhYHH.exe
  C:\Windows\System\IPAhYHH.exe
  2⤵
  PID:6176
- C:\Windows\System\OmVTlDm.exe
  C:\Windows\System\OmVTlDm.exe
  2⤵
  PID:6208
- C:\Windows\System\qYPldOw.exe
  C:\Windows\System\qYPldOw.exe
  2⤵
  PID:6232
- C:\Windows\System\fHZhbxe.exe
  C:\Windows\System\fHZhbxe.exe
  2⤵
  PID:6248
- C:\Windows\System\ITqfmdX.exe
  C:\Windows\System\ITqfmdX.exe
  2⤵
  PID:6264
- C:\Windows\System\AfeoDjl.exe
  C:\Windows\System\AfeoDjl.exe
  2⤵
  PID:6280
- C:\Windows\System\GKbbEpg.exe
  C:\Windows\System\GKbbEpg.exe
  2⤵
  PID:6300
- C:\Windows\System\FPlPSTU.exe
  C:\Windows\System\FPlPSTU.exe
  2⤵
  PID:6320
- C:\Windows\System\huUsURK.exe
  C:\Windows\System\huUsURK.exe
  2⤵
  PID:6348
- C:\Windows\System\lFplScD.exe
  C:\Windows\System\lFplScD.exe
  2⤵
  PID:6364
- C:\Windows\System\ISmWBWV.exe
  C:\Windows\System\ISmWBWV.exe
  2⤵
  PID:6384
- C:\Windows\System\GXQwSfR.exe
  C:\Windows\System\GXQwSfR.exe
  2⤵
  PID:6400
- C:\Windows\System\BjUkNqC.exe
  C:\Windows\System\BjUkNqC.exe
  2⤵
  PID:6420
- C:\Windows\System\rSiumcl.exe
  C:\Windows\System\rSiumcl.exe
  2⤵
  PID:6440
- C:\Windows\System\gtywffl.exe
  C:\Windows\System\gtywffl.exe
  2⤵
  PID:6456
- C:\Windows\System\gYDeJee.exe
  C:\Windows\System\gYDeJee.exe
  2⤵
  PID:6492
- C:\Windows\System\nMIMtkt.exe
  C:\Windows\System\nMIMtkt.exe
  2⤵
  PID:6512
- C:\Windows\System\nTrkOJN.exe
  C:\Windows\System\nTrkOJN.exe
  2⤵
  PID:6528
- C:\Windows\System\dRHNXXX.exe
  C:\Windows\System\dRHNXXX.exe
  2⤵
  PID:6544
- C:\Windows\System\dNtkfsZ.exe
  C:\Windows\System\dNtkfsZ.exe
  2⤵
  PID:6568
- C:\Windows\System\bhziyYw.exe
  C:\Windows\System\bhziyYw.exe
  2⤵
  PID:6584
- C:\Windows\System\rspSSuE.exe
  C:\Windows\System\rspSSuE.exe
  2⤵
  PID:6608
- C:\Windows\System\SNgSsTn.exe
  C:\Windows\System\SNgSsTn.exe
  2⤵
  PID:6624
- C:\Windows\System\bgzaRLX.exe
  C:\Windows\System\bgzaRLX.exe
  2⤵
  PID:6640
- C:\Windows\System\AgJkPgM.exe
  C:\Windows\System\AgJkPgM.exe
  2⤵
  PID:6660
- C:\Windows\System\UeHojUL.exe
  C:\Windows\System\UeHojUL.exe
  2⤵
  PID:6676
- C:\Windows\System\sUPoKHo.exe
  C:\Windows\System\sUPoKHo.exe
  2⤵
  PID:6696
- C:\Windows\System\WOomXqE.exe
  C:\Windows\System\WOomXqE.exe
  2⤵
  PID:6712
- C:\Windows\System\tsgIgfx.exe
  C:\Windows\System\tsgIgfx.exe
  2⤵
  PID:6732
- C:\Windows\System\BTyIKZn.exe
  C:\Windows\System\BTyIKZn.exe
  2⤵
  PID:6776
- C:\Windows\System\pPFuJYD.exe
  C:\Windows\System\pPFuJYD.exe
  2⤵
  PID:6792
- C:\Windows\System\MPgUEOy.exe
  C:\Windows\System\MPgUEOy.exe
  2⤵
  PID:6808
- C:\Windows\System\ornkmwm.exe
  C:\Windows\System\ornkmwm.exe
  2⤵
  PID:6828
- C:\Windows\System\eHIxJmo.exe
  C:\Windows\System\eHIxJmo.exe
  2⤵
  PID:6844
- C:\Windows\System\crmsOgk.exe
  C:\Windows\System\crmsOgk.exe
  2⤵
  PID:6860
- C:\Windows\System\mjZNCrc.exe
  C:\Windows\System\mjZNCrc.exe
  2⤵
  PID:6880
- C:\Windows\System\xEPWFwE.exe
  C:\Windows\System\xEPWFwE.exe
  2⤵
  PID:6904
- C:\Windows\System\qUPbLuE.exe
  C:\Windows\System\qUPbLuE.exe
  2⤵
  PID:6920
- C:\Windows\System\APNXOEs.exe
  C:\Windows\System\APNXOEs.exe
  2⤵
  PID:6960
- C:\Windows\System\oygfZiK.exe
  C:\Windows\System\oygfZiK.exe
  2⤵
  PID:6980
- C:\Windows\System\aWlNzqc.exe
  C:\Windows\System\aWlNzqc.exe
  2⤵
  PID:6996
- C:\Windows\System\zovHcBL.exe
  C:\Windows\System\zovHcBL.exe
  2⤵
  PID:7016
- C:\Windows\System\BxkuaAV.exe
  C:\Windows\System\BxkuaAV.exe
  2⤵
  PID:7032
- C:\Windows\System\HdPVIVG.exe
  C:\Windows\System\HdPVIVG.exe
  2⤵
  PID:7048
- C:\Windows\System\GaHIZJb.exe
  C:\Windows\System\GaHIZJb.exe
  2⤵
  PID:7068
- C:\Windows\System\izgeDqy.exe
  C:\Windows\System\izgeDqy.exe
  2⤵
  PID:7088
- C:\Windows\System\WUgubcH.exe
  C:\Windows\System\WUgubcH.exe
  2⤵
  PID:7116
- C:\Windows\System\sekzNID.exe
  C:\Windows\System\sekzNID.exe
  2⤵
  PID:7136
- C:\Windows\System\bAnGYln.exe
  C:\Windows\System\bAnGYln.exe
  2⤵
  PID:7152
- C:\Windows\System\nGsbjmg.exe
  C:\Windows\System\nGsbjmg.exe
  2⤵
  PID:6068
- C:\Windows\System\PFoHIHo.exe
  C:\Windows\System\PFoHIHo.exe
  2⤵
  PID:5620
- C:\Windows\System\XXVtwsI.exe
  C:\Windows\System\XXVtwsI.exe
  2⤵
  PID:6148
- C:\Windows\System\LvNRbnn.exe
  C:\Windows\System\LvNRbnn.exe
  2⤵
  PID:6200
- C:\Windows\System\lOOeWIl.exe
  C:\Windows\System\lOOeWIl.exe
  2⤵
  PID:6228
- C:\Windows\System\OAqTBTQ.exe
  C:\Windows\System\OAqTBTQ.exe
  2⤵
  PID:6292
- C:\Windows\System\EHEDWtV.exe
  C:\Windows\System\EHEDWtV.exe
  2⤵
  PID:5956
- C:\Windows\System\hOCReaE.exe
  C:\Windows\System\hOCReaE.exe
  2⤵
  PID:6372
- C:\Windows\System\TxGMlaA.exe
  C:\Windows\System\TxGMlaA.exe
  2⤵
  PID:6408
- C:\Windows\System\LyXHFvE.exe
  C:\Windows\System\LyXHFvE.exe
  2⤵
  PID:6312
- C:\Windows\System\cIKuaeR.exe
  C:\Windows\System\cIKuaeR.exe
  2⤵
  PID:6392
- C:\Windows\System\twEkYyt.exe
  C:\Windows\System\twEkYyt.exe
  2⤵
  PID:6436
- C:\Windows\System\xTFlUOT.exe
  C:\Windows\System\xTFlUOT.exe
  2⤵
  PID:6488
- C:\Windows\System\NybzvhA.exe
  C:\Windows\System\NybzvhA.exe
  2⤵
  PID:6520
- C:\Windows\System\vIkcDOw.exe
  C:\Windows\System\vIkcDOw.exe
  2⤵
  PID:6620
- C:\Windows\System\QvSnhFq.exe
  C:\Windows\System\QvSnhFq.exe
  2⤵
  PID:6592
- C:\Windows\System\yyuUKbD.exe
  C:\Windows\System\yyuUKbD.exe
  2⤵
  PID:6560
- C:\Windows\System\iWTRBNA.exe
  C:\Windows\System\iWTRBNA.exe
  2⤵
  PID:6688
- C:\Windows\System\uRJtptm.exe
  C:\Windows\System\uRJtptm.exe
  2⤵
  PID:6740
- C:\Windows\System\ezApvLU.exe
  C:\Windows\System\ezApvLU.exe
  2⤵
  PID:6756
- C:\Windows\System\YtWejHm.exe
  C:\Windows\System\YtWejHm.exe
  2⤵
  PID:6820
- C:\Windows\System\MNURCFc.exe
  C:\Windows\System\MNURCFc.exe
  2⤵
  PID:6856
- C:\Windows\System\cXErxWC.exe
  C:\Windows\System\cXErxWC.exe
  2⤵
  PID:6744
- C:\Windows\System\jDtdyRu.exe
  C:\Windows\System\jDtdyRu.exe
  2⤵
  PID:6936
- C:\Windows\System\tOvJppH.exe
  C:\Windows\System\tOvJppH.exe
  2⤵
  PID:6836
- C:\Windows\System\ShiqMGO.exe
  C:\Windows\System\ShiqMGO.exe
  2⤵
  PID:6876
- C:\Windows\System\lXMYhRQ.exe
  C:\Windows\System\lXMYhRQ.exe
  2⤵
  PID:6956
- C:\Windows\System\xnYmAnm.exe
  C:\Windows\System\xnYmAnm.exe
  2⤵
  PID:7056
- C:\Windows\System\eqLGFep.exe
  C:\Windows\System\eqLGFep.exe
  2⤵
  PID:7060
- C:\Windows\System\usnOxqn.exe
  C:\Windows\System\usnOxqn.exe
  2⤵
  PID:7100
- C:\Windows\System\XHzkNfL.exe
  C:\Windows\System\XHzkNfL.exe
  2⤵
  PID:7104
- C:\Windows\System\bwpNvUw.exe
  C:\Windows\System\bwpNvUw.exe
  2⤵
  PID:6168
- C:\Windows\System\WlLhfiB.exe
  C:\Windows\System\WlLhfiB.exe
  2⤵
  PID:7128
- C:\Windows\System\msLQIjv.exe
  C:\Windows\System\msLQIjv.exe
  2⤵
  PID:6260
- C:\Windows\System\qWOiLTq.exe
  C:\Windows\System\qWOiLTq.exe
  2⤵
  PID:6344
- C:\Windows\System\YxXHuFX.exe
  C:\Windows\System\YxXHuFX.exe
  2⤵
  PID:6220
- C:\Windows\System\gwbJgLe.exe
  C:\Windows\System\gwbJgLe.exe
  2⤵
  PID:6188
- C:\Windows\System\eJjrBqJ.exe
  C:\Windows\System\eJjrBqJ.exe
  2⤵
  PID:6332
- C:\Windows\System\lXgPUXn.exe
  C:\Windows\System\lXgPUXn.exe
  2⤵
  PID:6308
- C:\Windows\System\kLgGcaa.exe
  C:\Windows\System\kLgGcaa.exe
  2⤵
  PID:6508
- C:\Windows\System\TEiyJgZ.exe
  C:\Windows\System\TEiyJgZ.exe
  2⤵
  PID:6652
- C:\Windows\System\EWJcTEz.exe
  C:\Windows\System\EWJcTEz.exe
  2⤵
  PID:6576
- C:\Windows\System\IfeZlrJ.exe
  C:\Windows\System\IfeZlrJ.exe
  2⤵
  PID:6720
- C:\Windows\System\GPgxgGm.exe
  C:\Windows\System\GPgxgGm.exe
  2⤵
  PID:6824
- C:\Windows\System\gQXDPKD.exe
  C:\Windows\System\gQXDPKD.exe
  2⤵
  PID:6668
- C:\Windows\System\SwEVTfA.exe
  C:\Windows\System\SwEVTfA.exe
  2⤵
  PID:6748
- C:\Windows\System\WWgcwCH.exe
  C:\Windows\System\WWgcwCH.exe
  2⤵
  PID:6896
- C:\Windows\System\Bhmlute.exe
  C:\Windows\System\Bhmlute.exe
  2⤵
  PID:7024
- C:\Windows\System\SlclsZB.exe
  C:\Windows\System\SlclsZB.exe
  2⤵
  PID:6804
- C:\Windows\System\DJIccNP.exe
  C:\Windows\System\DJIccNP.exe
  2⤵
  PID:7096
- C:\Windows\System\GqsSCGB.exe
  C:\Windows\System\GqsSCGB.exe
  2⤵
  PID:7044
- C:\Windows\System\jAPAKKf.exe
  C:\Windows\System\jAPAKKf.exe
  2⤵
  PID:7124
- C:\Windows\System\gZADyam.exe
  C:\Windows\System\gZADyam.exe
  2⤵
  PID:1544
- C:\Windows\System\BCcBkQW.exe
  C:\Windows\System\BCcBkQW.exe
  2⤵
  PID:6328
- C:\Windows\System\GKtfoOn.exe
  C:\Windows\System\GKtfoOn.exe
  2⤵
  PID:6504
- C:\Windows\System\znBYOEj.exe
  C:\Windows\System\znBYOEj.exe
  2⤵
  PID:5544
- C:\Windows\System\jlVHWqN.exe
  C:\Windows\System\jlVHWqN.exe
  2⤵
  PID:6788
- C:\Windows\System\cPYVHYc.exe
  C:\Windows\System\cPYVHYc.exe
  2⤵
  PID:6752
- C:\Windows\System\ZZNgnsD.exe
  C:\Windows\System\ZZNgnsD.exe
  2⤵
  PID:6600
- C:\Windows\System\DEaUxwc.exe
  C:\Windows\System\DEaUxwc.exe
  2⤵
  PID:6932
- C:\Windows\System\sLYejOZ.exe
  C:\Windows\System\sLYejOZ.exe
  2⤵
  PID:7040
- C:\Windows\System\IhcKPyZ.exe
  C:\Windows\System\IhcKPyZ.exe
  2⤵
  PID:6900
- C:\Windows\System\UTJADNh.exe
  C:\Windows\System\UTJADNh.exe
  2⤵
  PID:6156
- C:\Windows\System\ZHlNYQH.exe
  C:\Windows\System\ZHlNYQH.exe
  2⤵
  PID:7144
- C:\Windows\System\DZnamdg.exe
  C:\Windows\System\DZnamdg.exe
  2⤵
  PID:6616
- C:\Windows\System\vRrjHkT.exe
  C:\Windows\System\vRrjHkT.exe
  2⤵
  PID:6764
- C:\Windows\System\MGJdGNK.exe
  C:\Windows\System\MGJdGNK.exe
  2⤵
  PID:6708
- C:\Windows\System\DUCOzxM.exe
  C:\Windows\System\DUCOzxM.exe
  2⤵
  PID:6356
- C:\Windows\System\QccHjBk.exe
  C:\Windows\System\QccHjBk.exe
  2⤵
  PID:7076
- C:\Windows\System\hYuzpax.exe
  C:\Windows\System\hYuzpax.exe
  2⤵
  PID:6484
- C:\Windows\System\BCLRiQI.exe
  C:\Windows\System\BCLRiQI.exe
  2⤵
  PID:6636
- C:\Windows\System\dPkdZfG.exe
  C:\Windows\System\dPkdZfG.exe
  2⤵
  PID:6340
- C:\Windows\System\pnWPqzo.exe
  C:\Windows\System\pnWPqzo.exe
  2⤵
  PID:6288
- C:\Windows\System\cyJzJrd.exe
  C:\Windows\System\cyJzJrd.exe
  2⤵
  PID:6728
- C:\Windows\System\oAZccZo.exe
  C:\Windows\System\oAZccZo.exe
  2⤵
  PID:6976
- C:\Windows\System\MRwnmkX.exe
  C:\Windows\System\MRwnmkX.exe
  2⤵
  PID:6360
- C:\Windows\System\UJpthtD.exe
  C:\Windows\System\UJpthtD.exe
  2⤵
  PID:6468
- C:\Windows\System\HJRcLXR.exe
  C:\Windows\System\HJRcLXR.exe
  2⤵
  PID:7176
- C:\Windows\System\juQoKCu.exe
  C:\Windows\System\juQoKCu.exe
  2⤵
  PID:7196
- C:\Windows\System\Ipdzoxj.exe
  C:\Windows\System\Ipdzoxj.exe
  2⤵
  PID:7220
- C:\Windows\System\raFejsM.exe
  C:\Windows\System\raFejsM.exe
  2⤵
  PID:7236
- C:\Windows\System\ltAizIi.exe
  C:\Windows\System\ltAizIi.exe
  2⤵
  PID:7256
- C:\Windows\System\LWnhDrv.exe
  C:\Windows\System\LWnhDrv.exe
  2⤵
  PID:7280
- C:\Windows\System\TqRTsGq.exe
  C:\Windows\System\TqRTsGq.exe
  2⤵
  PID:7296
- C:\Windows\System\qEnSQeV.exe
  C:\Windows\System\qEnSQeV.exe
  2⤵
  PID:7312
- C:\Windows\System\fTwbnpF.exe
  C:\Windows\System\fTwbnpF.exe
  2⤵
  PID:7352
- C:\Windows\System\GUXJegB.exe
  C:\Windows\System\GUXJegB.exe
  2⤵
  PID:7368
- C:\Windows\System\AULZndk.exe
  C:\Windows\System\AULZndk.exe
  2⤵
  PID:7384
- C:\Windows\System\EDjZrjb.exe
  C:\Windows\System\EDjZrjb.exe
  2⤵
  PID:7400
- C:\Windows\System\vifcQGX.exe
  C:\Windows\System\vifcQGX.exe
  2⤵
  PID:7424
- C:\Windows\System\rrmPQJT.exe
  C:\Windows\System\rrmPQJT.exe
  2⤵
  PID:7444
- C:\Windows\System\vVahmhY.exe
  C:\Windows\System\vVahmhY.exe
  2⤵
  PID:7460
- C:\Windows\System\QbtXGfz.exe
  C:\Windows\System\QbtXGfz.exe
  2⤵
  PID:7488
- C:\Windows\System\dTiFDSS.exe
  C:\Windows\System\dTiFDSS.exe
  2⤵
  PID:7504
- C:\Windows\System\JLMdGgr.exe
  C:\Windows\System\JLMdGgr.exe
  2⤵
  PID:7520
- C:\Windows\System\DqPrGDZ.exe
  C:\Windows\System\DqPrGDZ.exe
  2⤵
  PID:7540
- C:\Windows\System\TKBzMHW.exe
  C:\Windows\System\TKBzMHW.exe
  2⤵
  PID:7564
- C:\Windows\System\GwkdgFm.exe
  C:\Windows\System\GwkdgFm.exe
  2⤵
  PID:7580
- C:\Windows\System\MbtEbeI.exe
  C:\Windows\System\MbtEbeI.exe
  2⤵
  PID:7596
- C:\Windows\System\zduwRTn.exe
  C:\Windows\System\zduwRTn.exe
  2⤵
  PID:7632
- C:\Windows\System\tppREbn.exe
  C:\Windows\System\tppREbn.exe
  2⤵
  PID:7648
- C:\Windows\System\kIYkJuA.exe
  C:\Windows\System\kIYkJuA.exe
  2⤵
  PID:7664
- C:\Windows\System\mDyacjZ.exe
  C:\Windows\System\mDyacjZ.exe
  2⤵
  PID:7680
- C:\Windows\System\kIIjgUM.exe
  C:\Windows\System\kIIjgUM.exe
  2⤵
  PID:7700
- C:\Windows\System\EFXBRlj.exe
  C:\Windows\System\EFXBRlj.exe
  2⤵
  PID:7720
- C:\Windows\System\bZfDiIp.exe
  C:\Windows\System\bZfDiIp.exe
  2⤵
  PID:7744
- C:\Windows\System\EnywLyS.exe
  C:\Windows\System\EnywLyS.exe
  2⤵
  PID:7760
- C:\Windows\System\ZuXhtWk.exe
  C:\Windows\System\ZuXhtWk.exe
  2⤵
  PID:7784
- C:\Windows\System\fHpsJnC.exe
  C:\Windows\System\fHpsJnC.exe
  2⤵
  PID:7808
- C:\Windows\System\tQCAYrG.exe
  C:\Windows\System\tQCAYrG.exe
  2⤵
  PID:7824
- C:\Windows\System\ZTADRCG.exe
  C:\Windows\System\ZTADRCG.exe
  2⤵
  PID:7840
- C:\Windows\System\XNBcnxd.exe
  C:\Windows\System\XNBcnxd.exe
  2⤵
  PID:7868
- C:\Windows\System\QGfQfZL.exe
  C:\Windows\System\QGfQfZL.exe
  2⤵
  PID:7888
- C:\Windows\System\OFUjmSQ.exe
  C:\Windows\System\OFUjmSQ.exe
  2⤵
  PID:7904
- C:\Windows\System\cNSEWiC.exe
  C:\Windows\System\cNSEWiC.exe
  2⤵
  PID:7920
- C:\Windows\System\OLBSSWH.exe
  C:\Windows\System\OLBSSWH.exe
  2⤵
  PID:7940
- C:\Windows\System\kSxLKBv.exe
  C:\Windows\System\kSxLKBv.exe
  2⤵
  PID:7960
- C:\Windows\System\DQNfFlR.exe
  C:\Windows\System\DQNfFlR.exe
  2⤵
  PID:7976
- C:\Windows\System\cjqyGqK.exe
  C:\Windows\System\cjqyGqK.exe
  2⤵
  PID:7996
- C:\Windows\System\kGNIvNx.exe
  C:\Windows\System\kGNIvNx.exe
  2⤵
  PID:8016
- C:\Windows\System\MqGDPof.exe
  C:\Windows\System\MqGDPof.exe
  2⤵
  PID:8036
- C:\Windows\System\PuhiGPy.exe
  C:\Windows\System\PuhiGPy.exe
  2⤵
  PID:8052
- C:\Windows\System\xAJESUY.exe
  C:\Windows\System\xAJESUY.exe
  2⤵
  PID:8068
- C:\Windows\System\CoPRpBh.exe
  C:\Windows\System\CoPRpBh.exe
  2⤵
  PID:8092
- C:\Windows\System\exYlIUz.exe
  C:\Windows\System\exYlIUz.exe
  2⤵
  PID:8116
- C:\Windows\System\opKoess.exe
  C:\Windows\System\opKoess.exe
  2⤵
  PID:8136
- C:\Windows\System\VmeHrZb.exe
  C:\Windows\System\VmeHrZb.exe
  2⤵
  PID:8152
- C:\Windows\System\bXfbmXy.exe
  C:\Windows\System\bXfbmXy.exe
  2⤵
  PID:8168
- C:\Windows\System\pokGQxN.exe
  C:\Windows\System\pokGQxN.exe
  2⤵
  PID:8184
- C:\Windows\System\rqPtXEq.exe
  C:\Windows\System\rqPtXEq.exe
  2⤵
  PID:7208
- C:\Windows\System\jNjBgns.exe
  C:\Windows\System\jNjBgns.exe
  2⤵
  PID:6684
- C:\Windows\System\kjqPCDT.exe
  C:\Windows\System\kjqPCDT.exe
  2⤵
  PID:7288
- C:\Windows\System\Porviln.exe
  C:\Windows\System\Porviln.exe
  2⤵
  PID:7228
- C:\Windows\System\CXNQJyO.exe
  C:\Windows\System\CXNQJyO.exe
  2⤵
  PID:7272
- C:\Windows\System\SbHNaBu.exe
  C:\Windows\System\SbHNaBu.exe
  2⤵
  PID:7332
- C:\Windows\System\dAqTxWj.exe
  C:\Windows\System\dAqTxWj.exe
  2⤵
  PID:7276
- C:\Windows\System\dvxCHdI.exe
  C:\Windows\System\dvxCHdI.exe
  2⤵
  PID:7308
- C:\Windows\System\NPPEyzo.exe
  C:\Windows\System\NPPEyzo.exe
  2⤵
  PID:7364
- C:\Windows\System\fgarZsX.exe
  C:\Windows\System\fgarZsX.exe
  2⤵
  PID:7416
- C:\Windows\System\wxOdQiy.exe
  C:\Windows\System\wxOdQiy.exe
  2⤵
  PID:7456
- C:\Windows\System\HYFDQsN.exe
  C:\Windows\System\HYFDQsN.exe
  2⤵
  PID:7472
- C:\Windows\System\bGCFOln.exe
  C:\Windows\System\bGCFOln.exe
  2⤵
  PID:7480
- C:\Windows\System\fFYquND.exe
  C:\Windows\System\fFYquND.exe
  2⤵
  PID:7536
- C:\Windows\System\bPhhAAM.exe
  C:\Windows\System\bPhhAAM.exe
  2⤵
  PID:7516
- C:\Windows\System\iYfsnnS.exe
  C:\Windows\System\iYfsnnS.exe
  2⤵
  PID:7604
- C:\Windows\System\kdCySuS.exe
  C:\Windows\System\kdCySuS.exe
  2⤵
  PID:7620
- C:\Windows\System\GmxdlCp.exe
  C:\Windows\System\GmxdlCp.exe
  2⤵
  PID:7592
- C:\Windows\System\RpYxYOU.exe
  C:\Windows\System\RpYxYOU.exe
  2⤵
  PID:7692
- C:\Windows\System\FIpwrJj.exe
  C:\Windows\System\FIpwrJj.exe
  2⤵
  PID:7740
- C:\Windows\System\UtmxkLe.exe
  C:\Windows\System\UtmxkLe.exe
  2⤵
  PID:7708
- C:\Windows\System\UyvoYZk.exe
  C:\Windows\System\UyvoYZk.exe
  2⤵
  PID:7820
- C:\Windows\System\Mflqggq.exe
  C:\Windows\System\Mflqggq.exe
  2⤵
  PID:7856
- C:\Windows\System\MCJxsyv.exe
  C:\Windows\System\MCJxsyv.exe
  2⤵
  PID:7792
- C:\Windows\System\crwwKEl.exe
  C:\Windows\System\crwwKEl.exe
  2⤵
  PID:7800
- C:\Windows\System\iuQLipv.exe
  C:\Windows\System\iuQLipv.exe
  2⤵
  PID:7928
- C:\Windows\System\LDeYwcl.exe
  C:\Windows\System\LDeYwcl.exe
  2⤵
  PID:7880
- C:\Windows\System\SJEjBvA.exe
  C:\Windows\System\SJEjBvA.exe
  2⤵
  PID:8004
- C:\Windows\System\eYkNATl.exe
  C:\Windows\System\eYkNATl.exe
  2⤵
  PID:7984
- C:\Windows\System\LEKDEHl.exe
  C:\Windows\System\LEKDEHl.exe
  2⤵
  PID:7916
- C:\Windows\System\GEGwilp.exe
  C:\Windows\System\GEGwilp.exe
  2⤵
  PID:7948
- C:\Windows\System\djFZUev.exe
  C:\Windows\System\djFZUev.exe
  2⤵
  PID:8024
- C:\Windows\System\lSSINnr.exe
  C:\Windows\System\lSSINnr.exe
  2⤵
  PID:8124
- C:\Windows\System\oTvyffX.exe
  C:\Windows\System\oTvyffX.exe
  2⤵
  PID:8108
- C:\Windows\System\TlzZkWv.exe
  C:\Windows\System\TlzZkWv.exe
  2⤵
  PID:8104
- C:\Windows\System\OfIoZmr.exe
  C:\Windows\System\OfIoZmr.exe
  2⤵
  PID:6552
- C:\Windows\System\MHEFRbU.exe
  C:\Windows\System\MHEFRbU.exe
  2⤵
  PID:5844
- C:\Windows\System\fUonJum.exe
  C:\Windows\System\fUonJum.exe
  2⤵
  PID:7268
- C:\Windows\System\oqFPxpo.exe
  C:\Windows\System\oqFPxpo.exe
  2⤵
  PID:7324
- C:\Windows\System\neQEyPq.exe
  C:\Windows\System\neQEyPq.exe
  2⤵
  PID:7328
- C:\Windows\System\eFxjCku.exe
  C:\Windows\System\eFxjCku.exe
  2⤵
  PID:7496
- C:\Windows\System\tzluMmU.exe
  C:\Windows\System\tzluMmU.exe
  2⤵
  PID:7612
- C:\Windows\System\yYkWsbH.exe
  C:\Windows\System\yYkWsbH.exe
  2⤵
  PID:7588
- C:\Windows\System\yKwkxLI.exe
  C:\Windows\System\yKwkxLI.exe
  2⤵
  PID:7660
- C:\Windows\System\ZjqvRtQ.exe
  C:\Windows\System\ZjqvRtQ.exe
  2⤵
  PID:7796
- C:\Windows\System\TgJwwss.exe
  C:\Windows\System\TgJwwss.exe
  2⤵
  PID:7716
- C:\Windows\System\YiYRmQr.exe
  C:\Windows\System\YiYRmQr.exe
  2⤵
  PID:7756
- C:\Windows\System\wGUYxeV.exe
  C:\Windows\System\wGUYxeV.exe
  2⤵
  PID:7956
- C:\Windows\System\NGkHHZE.exe
  C:\Windows\System\NGkHHZE.exe
  2⤵
  PID:7900
- C:\Windows\System\PKPydrk.exe
  C:\Windows\System\PKPydrk.exe
  2⤵
  PID:7912
- C:\Windows\System\PgWwmys.exe
  C:\Windows\System\PgWwmys.exe
  2⤵
  PID:8080
- C:\Windows\System\toDAIDO.exe
  C:\Windows\System\toDAIDO.exe
  2⤵
  PID:6476
- C:\Windows\System\vtAVqHN.exe
  C:\Windows\System\vtAVqHN.exe
  2⤵
  PID:8176
- C:\Windows\System\yiZbZEb.exe
  C:\Windows\System\yiZbZEb.exe
  2⤵
  PID:7340
- C:\Windows\System\oRZjmea.exe
  C:\Windows\System\oRZjmea.exe
  2⤵
  PID:7420
- C:\Windows\System\bJivxgT.exe
  C:\Windows\System\bJivxgT.exe
  2⤵
  PID:7192
- C:\Windows\System\OOHJvZy.exe
  C:\Windows\System\OOHJvZy.exe
  2⤵
  PID:7500
- C:\Windows\System\fvvMkpf.exe
  C:\Windows\System\fvvMkpf.exe
  2⤵
  PID:7560
- C:\Windows\System\qMnyJif.exe
  C:\Windows\System\qMnyJif.exe
  2⤵
  PID:7576
- C:\Windows\System\nYdeomH.exe
  C:\Windows\System\nYdeomH.exe
  2⤵
  PID:7772
- C:\Windows\System\CAztdMo.exe
  C:\Windows\System\CAztdMo.exe
  2⤵
  PID:7860
- C:\Windows\System\BqsodwK.exe
  C:\Windows\System\BqsodwK.exe
  2⤵
  PID:6948
- C:\Windows\System\AgCayhD.exe
  C:\Windows\System\AgCayhD.exe
  2⤵
  PID:7836
- C:\Windows\System\YmguPyn.exe
  C:\Windows\System\YmguPyn.exe
  2⤵
  PID:7876
- C:\Windows\System\OgjRlHq.exe
  C:\Windows\System\OgjRlHq.exe
  2⤵
  PID:8160
- C:\Windows\System\gSolZnX.exe
  C:\Windows\System\gSolZnX.exe
  2⤵
  PID:7252
- C:\Windows\System\ISwUlbx.exe
  C:\Windows\System\ISwUlbx.exe
  2⤵
  PID:7688
- C:\Windows\System\hYSdiob.exe
  C:\Windows\System\hYSdiob.exe
  2⤵
  PID:7672
- C:\Windows\System\wsetdgk.exe
  C:\Windows\System\wsetdgk.exe
  2⤵
  PID:7992
- C:\Windows\System\Xtsklxy.exe
  C:\Windows\System\Xtsklxy.exe
  2⤵
  PID:8148
- C:\Windows\System\oDxTwAO.exe
  C:\Windows\System\oDxTwAO.exe
  2⤵
  PID:7736
- C:\Windows\System\CbDJjfO.exe
  C:\Windows\System\CbDJjfO.exe
  2⤵
  PID:7188
- C:\Windows\System\umColiK.exe
  C:\Windows\System\umColiK.exe
  2⤵
  PID:7320
- C:\Windows\System\bTGemow.exe
  C:\Windows\System\bTGemow.exe
  2⤵
  PID:7676
- C:\Windows\System\BdCwSiV.exe
  C:\Windows\System\BdCwSiV.exe
  2⤵
  PID:8164
- C:\Windows\System\NMuXJFi.exe
  C:\Windows\System\NMuXJFi.exe
  2⤵
  PID:8088
- C:\Windows\System\czSilRK.exe
  C:\Windows\System\czSilRK.exe
  2⤵
  PID:7780
- C:\Windows\System\PxmpALa.exe
  C:\Windows\System\PxmpALa.exe
  2⤵
  PID:8208
- C:\Windows\System\iSNtqHb.exe
  C:\Windows\System\iSNtqHb.exe
  2⤵
  PID:8224
- C:\Windows\System\fCcKnup.exe
  C:\Windows\System\fCcKnup.exe
  2⤵
  PID:8240
- C:\Windows\System\mDcIjfO.exe
  C:\Windows\System\mDcIjfO.exe
  2⤵
  PID:8260
- C:\Windows\System\iVgpGRz.exe
  C:\Windows\System\iVgpGRz.exe
  2⤵
  PID:8276
- C:\Windows\System\BGuzQPP.exe
  C:\Windows\System\BGuzQPP.exe
  2⤵
  PID:8296
- C:\Windows\System\TpPRUyP.exe
  C:\Windows\System\TpPRUyP.exe
  2⤵
  PID:8312
- C:\Windows\System\bJnLlOR.exe
  C:\Windows\System\bJnLlOR.exe
  2⤵
  PID:8332
- C:\Windows\System\hxDCMpV.exe
  C:\Windows\System\hxDCMpV.exe
  2⤵
  PID:8348
- C:\Windows\System\NDkygru.exe
  C:\Windows\System\NDkygru.exe
  2⤵
  PID:8372
- C:\Windows\System\FluhRGR.exe
  C:\Windows\System\FluhRGR.exe
  2⤵
  PID:8388
- C:\Windows\System\lWOWGuj.exe
  C:\Windows\System\lWOWGuj.exe
  2⤵
  PID:8404
- C:\Windows\System\OAHLcDD.exe
  C:\Windows\System\OAHLcDD.exe
  2⤵
  PID:8440
- C:\Windows\System\kANztcA.exe
  C:\Windows\System\kANztcA.exe
  2⤵
  PID:8460
- C:\Windows\System\zdjdZOM.exe
  C:\Windows\System\zdjdZOM.exe
  2⤵
  PID:8476
- C:\Windows\System\NdYAVtd.exe
  C:\Windows\System\NdYAVtd.exe
  2⤵
  PID:8496
- C:\Windows\System\JGQDUSK.exe
  C:\Windows\System\JGQDUSK.exe
  2⤵
  PID:8512
- C:\Windows\System\lMVWRWI.exe
  C:\Windows\System\lMVWRWI.exe
  2⤵
  PID:8528
- C:\Windows\System\VGRGYul.exe
  C:\Windows\System\VGRGYul.exe
  2⤵
  PID:8544
- C:\Windows\System\dRlmrIT.exe
  C:\Windows\System\dRlmrIT.exe
  2⤵
  PID:8560
- C:\Windows\System\qurEapa.exe
  C:\Windows\System\qurEapa.exe
  2⤵
  PID:8580
- C:\Windows\System\hLrSDDF.exe
  C:\Windows\System\hLrSDDF.exe
  2⤵
  PID:8608
- C:\Windows\System\WHkVUtp.exe
  C:\Windows\System\WHkVUtp.exe
  2⤵
  PID:8624
- C:\Windows\System\dAayVJw.exe
  C:\Windows\System\dAayVJw.exe
  2⤵
  PID:8640
- C:\Windows\System\fCynQoC.exe
  C:\Windows\System\fCynQoC.exe
  2⤵
  PID:8656
- C:\Windows\System\DxmYcha.exe
  C:\Windows\System\DxmYcha.exe
  2⤵
  PID:8676
- C:\Windows\System\iNKrmGu.exe
  C:\Windows\System\iNKrmGu.exe
  2⤵
  PID:8692
- C:\Windows\System\MORaAOR.exe
  C:\Windows\System\MORaAOR.exe
  2⤵
  PID:8708
- C:\Windows\System\MaTxhPz.exe
  C:\Windows\System\MaTxhPz.exe
  2⤵
  PID:8724
- C:\Windows\System\ltwrYin.exe
  C:\Windows\System\ltwrYin.exe
  2⤵
  PID:8740
- C:\Windows\System\gzfBqug.exe
  C:\Windows\System\gzfBqug.exe
  2⤵
  PID:8756
- C:\Windows\System\nGJWqbj.exe
  C:\Windows\System\nGJWqbj.exe
  2⤵
  PID:8772
- C:\Windows\System\sHaHFKJ.exe
  C:\Windows\System\sHaHFKJ.exe
  2⤵
  PID:8788
- C:\Windows\System\hUxljKf.exe
  C:\Windows\System\hUxljKf.exe
  2⤵
  PID:8804
- C:\Windows\System\dpAYisI.exe
  C:\Windows\System\dpAYisI.exe
  2⤵
  PID:8824
- C:\Windows\System\LEEuxMP.exe
  C:\Windows\System\LEEuxMP.exe
  2⤵
  PID:8852
- C:\Windows\System\cLmpchy.exe
  C:\Windows\System\cLmpchy.exe
  2⤵
  PID:8896
- C:\Windows\System\NRhCacZ.exe
  C:\Windows\System\NRhCacZ.exe
  2⤵
  PID:8912
- C:\Windows\System\tkiLLYM.exe
  C:\Windows\System\tkiLLYM.exe
  2⤵
  PID:8928
- C:\Windows\System\MtaXCyV.exe
  C:\Windows\System\MtaXCyV.exe
  2⤵
  PID:8944
- C:\Windows\System\LBrmhiY.exe
  C:\Windows\System\LBrmhiY.exe
  2⤵
  PID:8960
- C:\Windows\System\ZBzYuyB.exe
  C:\Windows\System\ZBzYuyB.exe
  2⤵
  PID:8976
- C:\Windows\System\nPNPSAe.exe
  C:\Windows\System\nPNPSAe.exe
  2⤵
  PID:8992
- C:\Windows\System\FLyvhik.exe
  C:\Windows\System\FLyvhik.exe
  2⤵
  PID:9008
- C:\Windows\System\iEMouHB.exe
  C:\Windows\System\iEMouHB.exe
  2⤵
  PID:9024
- C:\Windows\System\gyJjUFG.exe
  C:\Windows\System\gyJjUFG.exe
  2⤵
  PID:9040
- C:\Windows\System\FATxQfC.exe
  C:\Windows\System\FATxQfC.exe
  2⤵
  PID:9060
- C:\Windows\System\pXfyPVM.exe
  C:\Windows\System\pXfyPVM.exe
  2⤵
  PID:9076
- C:\Windows\System\sXfokmF.exe
  C:\Windows\System\sXfokmF.exe
  2⤵
  PID:9092
- C:\Windows\System\FvCgXZr.exe
  C:\Windows\System\FvCgXZr.exe
  2⤵
  PID:9108
- C:\Windows\System\RXfigNB.exe
  C:\Windows\System\RXfigNB.exe
  2⤵
  PID:9148
- C:\Windows\System\ZXITIaO.exe
  C:\Windows\System\ZXITIaO.exe
  2⤵
  PID:9176
- C:\Windows\System\KHEBSvT.exe
  C:\Windows\System\KHEBSvT.exe
  2⤵
  PID:9204
- C:\Windows\System\cUdyPQR.exe
  C:\Windows\System\cUdyPQR.exe
  2⤵
  PID:7988
- C:\Windows\System\rGuxISz.exe
  C:\Windows\System\rGuxISz.exe
  2⤵
  PID:8220
- C:\Windows\System\sZWqkav.exe
  C:\Windows\System\sZWqkav.exe
  2⤵
  PID:8252
- C:\Windows\System\HUBUtVR.exe
  C:\Windows\System\HUBUtVR.exe
  2⤵
  PID:8292
- C:\Windows\System\XKstruI.exe
  C:\Windows\System\XKstruI.exe
  2⤵
  PID:8664
- C:\Windows\System\hTPgHzH.exe
  C:\Windows\System\hTPgHzH.exe
  2⤵
  PID:8832
- C:\Windows\System\eNtCGci.exe
  C:\Windows\System\eNtCGci.exe
  2⤵
  PID:8844
- C:\Windows\System\NydlDaJ.exe
  C:\Windows\System\NydlDaJ.exe
  2⤵
  PID:8868
- C:\Windows\System\RjVHTXB.exe
  C:\Windows\System\RjVHTXB.exe
  2⤵
  PID:8880
- C:\Windows\System\nWkRDCq.exe
  C:\Windows\System\nWkRDCq.exe
  2⤵
  PID:8892
- C:\Windows\System\PfojAiJ.exe
  C:\Windows\System\PfojAiJ.exe
  2⤵
  PID:8936
- C:\Windows\System\HyHvXYo.exe
  C:\Windows\System\HyHvXYo.exe
  2⤵
  PID:9020
- C:\Windows\System\ljNoCMI.exe
  C:\Windows\System\ljNoCMI.exe
  2⤵
  PID:8952
- C:\Windows\System\lvTULjM.exe
  C:\Windows\System\lvTULjM.exe
  2⤵
  PID:9072
- C:\Windows\System\QxjraDo.exe
  C:\Windows\System\QxjraDo.exe
  2⤵
  PID:8452
- C:\Windows\System\ncDBrCu.exe
  C:\Windows\System\ncDBrCu.exe
  2⤵
  PID:9084
- C:\Windows\System\GDPCHFn.exe
  C:\Windows\System\GDPCHFn.exe
  2⤵
  PID:9164
- C:\Windows\System\lnOTmHz.exe
  C:\Windows\System\lnOTmHz.exe
  2⤵
  PID:7436
- C:\Windows\System\nZqJtyL.exe
  C:\Windows\System\nZqJtyL.exe
  2⤵
  PID:8204
- C:\Windows\System\HxJaFkA.exe
  C:\Windows\System\HxJaFkA.exe
  2⤵
  PID:8248
- C:\Windows\System\IUIQhMw.exe
  C:\Windows\System\IUIQhMw.exe
  2⤵
  PID:8288
- C:\Windows\System\kDStqnb.exe
  C:\Windows\System\kDStqnb.exe
  2⤵
  PID:8356
- C:\Windows\System\BORvfDv.exe
  C:\Windows\System\BORvfDv.exe
  2⤵
  PID:8412
- C:\Windows\System\gxWjxOZ.exe
  C:\Windows\System\gxWjxOZ.exe
  2⤵
  PID:8364
- C:\Windows\System\LdPCeJS.exe
  C:\Windows\System\LdPCeJS.exe
  2⤵
  PID:8448
- C:\Windows\System\sRXtjUW.exe
  C:\Windows\System\sRXtjUW.exe
  2⤵
  PID:8484
- C:\Windows\System\NdnvdIl.exe
  C:\Windows\System\NdnvdIl.exe
  2⤵
  PID:8504
- C:\Windows\System\yaTWuMm.exe
  C:\Windows\System\yaTWuMm.exe
  2⤵
  PID:8556
- C:\Windows\System\XNZnFTh.exe
  C:\Windows\System\XNZnFTh.exe
  2⤵
  PID:8576
- C:\Windows\System\bdWEXPL.exe
  C:\Windows\System\bdWEXPL.exe
  2⤵
  PID:8604
- C:\Windows\System\UAIVvIS.exe
  C:\Windows\System\UAIVvIS.exe
  2⤵
  PID:8652
- C:\Windows\System\Vsumtty.exe
  C:\Windows\System\Vsumtty.exe
  2⤵
  PID:8736
- C:\Windows\System\xMxXRQS.exe
  C:\Windows\System\xMxXRQS.exe
  2⤵
  PID:8720
- C:\Windows\System\pbssZii.exe
  C:\Windows\System\pbssZii.exe
  2⤵
  PID:8784
- C:\Windows\System\jMnHAAd.exe
  C:\Windows\System\jMnHAAd.exe
  2⤵
  PID:8820
- C:\Windows\System\XlasJNQ.exe
  C:\Windows\System\XlasJNQ.exe
  2⤵
  PID:8864
- C:\Windows\System\KGwvlEc.exe
  C:\Windows\System\KGwvlEc.exe
  2⤵
  PID:8940
- C:\Windows\System\kEkPmbS.exe
  C:\Windows\System\kEkPmbS.exe
  2⤵
  PID:8988
- C:\Windows\System\acsvAEu.exe
  C:\Windows\System\acsvAEu.exe
  2⤵
  PID:8984
- C:\Windows\System\NXLcVNu.exe
  C:\Windows\System\NXLcVNu.exe
  2⤵
  PID:9160
- C:\Windows\System\NlWZTtz.exe
  C:\Windows\System\NlWZTtz.exe
  2⤵
  PID:8284
- C:\Windows\System\CJkkRkr.exe
  C:\Windows\System\CJkkRkr.exe
  2⤵
  PID:8320
- C:\Windows\System\vkLiSLv.exe
  C:\Windows\System\vkLiSLv.exe
  2⤵
  PID:8268
- C:\Windows\System\ODxYzOk.exe
  C:\Windows\System\ODxYzOk.exe
  2⤵
  PID:8344
- C:\Windows\System\OLGmybu.exe
  C:\Windows\System\OLGmybu.exe
  2⤵
  PID:8380
- C:\Windows\System\hDqcEAg.exe
  C:\Windows\System\hDqcEAg.exe
  2⤵
  PID:8520
- C:\Windows\System\tDRTYeA.exe
  C:\Windows\System\tDRTYeA.exe
  2⤵
  PID:8596
- C:\Windows\System\HXUzndp.exe
  C:\Windows\System\HXUzndp.exe
  2⤵
  PID:8700
- C:\Windows\System\uSXpRHn.exe
  C:\Windows\System\uSXpRHn.exe
  2⤵
  PID:8812
- C:\Windows\System\wNlhUUM.exe
  C:\Windows\System\wNlhUUM.exe
  2⤵
  PID:8908
- C:\Windows\System\fIHxCXy.exe
  C:\Windows\System\fIHxCXy.exe
  2⤵
  PID:8568
- C:\Windows\System\oqXLfPT.exe
  C:\Windows\System\oqXLfPT.exe
  2⤵
  PID:9104
- C:\Windows\System\QbgXwVL.exe
  C:\Windows\System\QbgXwVL.exe
  2⤵
  PID:8616
- C:\Windows\System\dROnCSr.exe
  C:\Windows\System\dROnCSr.exe
  2⤵
  PID:8780
- C:\Windows\System\TypCNTW.exe
  C:\Windows\System\TypCNTW.exe
  2⤵
  PID:9032
- C:\Windows\System\nxkgjOR.exe
  C:\Windows\System\nxkgjOR.exe
  2⤵
  PID:7468
- C:\Windows\System\EUioXJx.exe
  C:\Windows\System\EUioXJx.exe
  2⤵
  PID:8340
- C:\Windows\System\lddWXTk.exe
  C:\Windows\System\lddWXTk.exe
  2⤵
  PID:2268
- C:\Windows\System\WwRLmDx.exe
  C:\Windows\System\WwRLmDx.exe
  2⤵
  PID:8552
- C:\Windows\System\XtmOgYG.exe
  C:\Windows\System\XtmOgYG.exe
  2⤵
  PID:8764
- C:\Windows\System\BCCMWRF.exe
  C:\Windows\System\BCCMWRF.exe
  2⤵
  PID:9052
- C:\Windows\System\bjgaGAn.exe
  C:\Windows\System\bjgaGAn.exe
  2⤵
  PID:9144
- C:\Windows\System\QMBAZjb.exe
  C:\Windows\System\QMBAZjb.exe
  2⤵
  PID:8876
- C:\Windows\System\enWayxf.exe
  C:\Windows\System\enWayxf.exe
  2⤵
  PID:9136
- C:\Windows\System\nNxXRWB.exe
  C:\Windows\System\nNxXRWB.exe
  2⤵
  PID:8472
- C:\Windows\System\xFODDrl.exe
  C:\Windows\System\xFODDrl.exe
  2⤵
  PID:9036
- C:\Windows\System\KpMbDKC.exe
  C:\Windows\System\KpMbDKC.exe
  2⤵
  PID:8132
- C:\Windows\System\TfirSvT.exe
  C:\Windows\System\TfirSvT.exe
  2⤵
  PID:8368
- C:\Windows\System\ujoGgGV.exe
  C:\Windows\System\ujoGgGV.exe
  2⤵
  PID:8768
- C:\Windows\System\ZtpLGwq.exe
  C:\Windows\System\ZtpLGwq.exe
  2⤵
  PID:8328
- C:\Windows\System\qiquBhV.exe
  C:\Windows\System\qiquBhV.exe
  2⤵
  PID:9056
- C:\Windows\System\kbbkLUO.exe
  C:\Windows\System\kbbkLUO.exe
  2⤵
  PID:8888
- C:\Windows\System\utHXodZ.exe
  C:\Windows\System\utHXodZ.exe
  2⤵
  PID:9232
- C:\Windows\System\RkqejOQ.exe
  C:\Windows\System\RkqejOQ.exe
  2⤵
  PID:9248
- C:\Windows\System\bGplSMN.exe
  C:\Windows\System\bGplSMN.exe
  2⤵
  PID:9264
- C:\Windows\System\WEiwoFp.exe
  C:\Windows\System\WEiwoFp.exe
  2⤵
  PID:9280
- C:\Windows\System\PFTUHFg.exe
  C:\Windows\System\PFTUHFg.exe
  2⤵
  PID:9300
- C:\Windows\System\xvlOuJI.exe
  C:\Windows\System\xvlOuJI.exe
  2⤵
  PID:9316
- C:\Windows\System\KpXhrzg.exe
  C:\Windows\System\KpXhrzg.exe
  2⤵
  PID:9344
- C:\Windows\System\bRcRogp.exe
  C:\Windows\System\bRcRogp.exe
  2⤵
  PID:9360
- C:\Windows\System\lmiQuFD.exe
  C:\Windows\System\lmiQuFD.exe
  2⤵
  PID:9376
- C:\Windows\System\aWOgqfE.exe
  C:\Windows\System\aWOgqfE.exe
  2⤵
  PID:9416
- C:\Windows\System\xoRzpnT.exe
  C:\Windows\System\xoRzpnT.exe
  2⤵
  PID:9436
- C:\Windows\System\raiIMXD.exe
  C:\Windows\System\raiIMXD.exe
  2⤵
  PID:9456
- C:\Windows\System\cWEQUoS.exe
  C:\Windows\System\cWEQUoS.exe
  2⤵
  PID:9472
- C:\Windows\System\FcMOrRy.exe
  C:\Windows\System\FcMOrRy.exe
  2⤵
  PID:9492
- C:\Windows\System\dPghqHN.exe
  C:\Windows\System\dPghqHN.exe
  2⤵
  PID:9508
- C:\Windows\System\YdbTfRO.exe
  C:\Windows\System\YdbTfRO.exe
  2⤵
  PID:9524
- C:\Windows\System\XgUBLXq.exe
  C:\Windows\System\XgUBLXq.exe
  2⤵
  PID:9544
- C:\Windows\System\RzIDuCX.exe
  C:\Windows\System\RzIDuCX.exe
  2⤵
  PID:9568
- C:\Windows\System\bcxrVxb.exe
  C:\Windows\System\bcxrVxb.exe
  2⤵
  PID:9600
- C:\Windows\System\nLrfiRQ.exe
  C:\Windows\System\nLrfiRQ.exe
  2⤵
  PID:9624
- C:\Windows\System\tLZmmiM.exe
  C:\Windows\System\tLZmmiM.exe
  2⤵
  PID:9656
- C:\Windows\System\CaDDbFy.exe
  C:\Windows\System\CaDDbFy.exe
  2⤵
  PID:9672
- C:\Windows\System\ypXTtrb.exe
  C:\Windows\System\ypXTtrb.exe
  2⤵
  PID:9688
- C:\Windows\System\SawEHNb.exe
  C:\Windows\System\SawEHNb.exe
  2⤵
  PID:9708
- C:\Windows\System\qFqFfPN.exe
  C:\Windows\System\qFqFfPN.exe
  2⤵
  PID:9724
- C:\Windows\System\hVRBnjR.exe
  C:\Windows\System\hVRBnjR.exe
  2⤵
  PID:9752
- C:\Windows\System\wYHEGZa.exe
  C:\Windows\System\wYHEGZa.exe
  2⤵
  PID:9768
- C:\Windows\System\HSqUQpZ.exe
  C:\Windows\System\HSqUQpZ.exe
  2⤵
  PID:9788
- C:\Windows\System\UzyxPqD.exe
  C:\Windows\System\UzyxPqD.exe
  2⤵
  PID:9804
- C:\Windows\System\nSMqdwX.exe
  C:\Windows\System\nSMqdwX.exe
  2⤵
  PID:9820
- C:\Windows\System\IvViVdP.exe
  C:\Windows\System\IvViVdP.exe
  2⤵
  PID:9836
- C:\Windows\System\PshHxEa.exe
  C:\Windows\System\PshHxEa.exe
  2⤵
  PID:9852
- C:\Windows\System\XEfaxeE.exe
  C:\Windows\System\XEfaxeE.exe
  2⤵
  PID:9868
- C:\Windows\System\ogkuiSp.exe
  C:\Windows\System\ogkuiSp.exe
  2⤵
  PID:9884
- C:\Windows\System\EQzNWPr.exe
  C:\Windows\System\EQzNWPr.exe
  2⤵
  PID:9904
- C:\Windows\System\LUjrjCW.exe
  C:\Windows\System\LUjrjCW.exe
  2⤵
  PID:9932
- C:\Windows\System\uAchOfv.exe
  C:\Windows\System\uAchOfv.exe
  2⤵
  PID:9948
- C:\Windows\System\VdHAtwM.exe
  C:\Windows\System\VdHAtwM.exe
  2⤵
  PID:9964
- C:\Windows\System\KvDalDk.exe
  C:\Windows\System\KvDalDk.exe
  2⤵
  PID:9980
- C:\Windows\System\vSIFVRB.exe
  C:\Windows\System\vSIFVRB.exe
  2⤵
  PID:9996
- C:\Windows\System\LhcvcbG.exe
  C:\Windows\System\LhcvcbG.exe
  2⤵
  PID:10012
- C:\Windows\System\DTJkbcH.exe
  C:\Windows\System\DTJkbcH.exe
  2⤵
  PID:10028
- C:\Windows\System\QDDnqpM.exe
  C:\Windows\System\QDDnqpM.exe
  2⤵
  PID:10088
- C:\Windows\System\JUHSbPE.exe
  C:\Windows\System\JUHSbPE.exe
  2⤵
  PID:10120
- C:\Windows\System\bqbksXg.exe
  C:\Windows\System\bqbksXg.exe
  2⤵
  PID:10136
- C:\Windows\System\xNlYzBc.exe
  C:\Windows\System\xNlYzBc.exe
  2⤵
  PID:10152
- C:\Windows\System\gysUrCC.exe
  C:\Windows\System\gysUrCC.exe
  2⤵
  PID:10168
- C:\Windows\System\igvUsnZ.exe
  C:\Windows\System\igvUsnZ.exe
  2⤵
  PID:10184
- C:\Windows\System\xhKeSJh.exe
  C:\Windows\System\xhKeSJh.exe
  2⤵
  PID:10200
- C:\Windows\System\ivchXKM.exe
  C:\Windows\System\ivchXKM.exe
  2⤵
  PID:10216
- C:\Windows\System\tgKFjCq.exe
  C:\Windows\System\tgKFjCq.exe
  2⤵
  PID:10232
- C:\Windows\System\WUetzIZ.exe
  C:\Windows\System\WUetzIZ.exe
  2⤵
  PID:9224
- C:\Windows\System\hDviKlG.exe
  C:\Windows\System\hDviKlG.exe
  2⤵
  PID:8860
- C:\Windows\System\DKcWadz.exe
  C:\Windows\System\DKcWadz.exe
  2⤵
  PID:9292
- C:\Windows\System\mJTSMIk.exe
  C:\Windows\System\mJTSMIk.exe
  2⤵
  PID:9340
- C:\Windows\System\ghHOrQE.exe
  C:\Windows\System\ghHOrQE.exe
  2⤵
  PID:9480
- C:\Windows\System\XNvJziC.exe
  C:\Windows\System\XNvJziC.exe
  2⤵
  PID:9468
- C:\Windows\System\KdTHgTO.exe
  C:\Windows\System\KdTHgTO.exe
  2⤵
  PID:9488
- C:\Windows\System\NUhBCnW.exe
  C:\Windows\System\NUhBCnW.exe
  2⤵
  PID:9536
- C:\Windows\System\jBQcqdr.exe
  C:\Windows\System\jBQcqdr.exe
  2⤵
  PID:9596
- C:\Windows\System\AtRQHCM.exe
  C:\Windows\System\AtRQHCM.exe
  2⤵
  PID:9632
- C:\Windows\System\niLfxiV.exe
  C:\Windows\System\niLfxiV.exe
  2⤵
  PID:9616
- C:\Windows\System\ZISYVCD.exe
  C:\Windows\System\ZISYVCD.exe
  2⤵
  PID:9648
- C:\Windows\System\VLnTzoU.exe
  C:\Windows\System\VLnTzoU.exe
  2⤵
  PID:9720
- C:\Windows\System\AVDuEkm.exe
  C:\Windows\System\AVDuEkm.exe
  2⤵
  PID:9744
- C:\Windows\System\msdZJAB.exe
  C:\Windows\System\msdZJAB.exe
  2⤵
  PID:9796
- C:\Windows\System\VFlDrQu.exe
  C:\Windows\System\VFlDrQu.exe
  2⤵
  PID:9748
- C:\Windows\System\coZKfEo.exe
  C:\Windows\System\coZKfEo.exe
  2⤵
  PID:9812
- C:\Windows\System\FEpPSVT.exe
  C:\Windows\System\FEpPSVT.exe
  2⤵
  PID:9892
- C:\Windows\System\WmpQFgk.exe
  C:\Windows\System\WmpQFgk.exe
  2⤵
  PID:9880
- C:\Windows\System\neDKVFr.exe
  C:\Windows\System\neDKVFr.exe
  2⤵
  PID:9924
- C:\Windows\System\cKQmAHx.exe
  C:\Windows\System\cKQmAHx.exe
  2⤵
  PID:10004
- C:\Windows\System\RZcHZpA.exe
  C:\Windows\System\RZcHZpA.exe
  2⤵
  PID:9992
- C:\Windows\System\fOKWHCx.exe
  C:\Windows\System\fOKWHCx.exe
  2⤵
  PID:10072
- C:\Windows\System\gutRYpO.exe
  C:\Windows\System\gutRYpO.exe
  2⤵
  PID:10128
- C:\Windows\System\sABRtEv.exe
  C:\Windows\System\sABRtEv.exe
  2⤵
  PID:10112
- C:\Windows\System\btROYgp.exe
  C:\Windows\System\btROYgp.exe
  2⤵
  PID:10164
- C:\Windows\System\EklqjBB.exe
  C:\Windows\System\EklqjBB.exe
  2⤵
  PID:10176
- C:\Windows\System\cJoKCSX.exe
  C:\Windows\System\cJoKCSX.exe
  2⤵
  PID:10228
- C:\Windows\System\VAHXITx.exe
  C:\Windows\System\VAHXITx.exe
  2⤵
  PID:10208
- C:\Windows\System\NXzlgzW.exe
  C:\Windows\System\NXzlgzW.exe
  2⤵
  PID:9332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GUUeHtM.exe

Filesize
1.5MB

MD5
d0f5edba05cb1aab37a07a50edf856df

SHA1
561217e037a2e13f32358b084e9af7d1d36c532e

SHA256
680d722f306773348199d32c3b4cd5507e0af8c904397e86826054a5d3eb535b

SHA512
9457a413be88d31f3e7ef29387e8b5f4b9be11a582e14ae1aae49919f5e61ee8711f847b0e0c97f99c0db1b5e3be895311513ad2b03ab2a78c1bdda117d8f1e1

Download Submit
C:\Windows\system\GxCHaau.exe

Filesize
1.5MB

MD5
c1decfb61de9b6f8dc66f5cc06b8db16

SHA1
d67c1bda22b3de2f2ca4805641b6c4fca17fa747

SHA256
851c35ab08f3b12fe12ff95207204d7aa3e4790214c5244c0258badc8d63992a

SHA512
1d0295dc0e07db9a216e17a695ea729b6aa1a01a22627958dea960432ad9f95c2ccc0c2993080556d53c8822f25777c46b5b49634cabf413fa35e2c90de3025b

Download Submit
C:\Windows\system\IlLlJQU.exe

Filesize
1.5MB

MD5
0bd18f07a2712e3457150af4d0620f6d

SHA1
2e8283d8864a0a4545c2b543bb4471da07292f11

SHA256
f299d0ae5921b70360476b70d38004077f5c7fa447b699cea6f45416abfa145d

SHA512
12f9bffe6ad04e7d91e9f8f741d6a71a9fb12a124c54a5a96c0030bdcb3cedfe32e9b27d1110a0516f806a318e665557783247a13774e2e70965c4f9208bd695

Download Submit
C:\Windows\system\JZzbnhm.exe

Filesize
1.5MB

MD5
66f8b43feffa9754cc477e26d55b8077

SHA1
3b02fc419bd0c6248ebe64eec07c9e613ffbc780

SHA256
bde6ee5a0d1cbac1ffe7ec91c8056007190151994311c02414aa248608003469

SHA512
2d797798abe6291f44670f81d342ed3ec353804ea7109dafd0527819e2fd3ff134ed24b4c19594a94f5e0ccc95359349107cf83195bb5d82a27a113fdbfa7816

Download Submit
C:\Windows\system\JnnhUnQ.exe

Filesize
1.5MB

MD5
55554f1eb328999e363c1931a11370b8

SHA1
8166ee2e978d4c4212419a83d276c7a492e51241

SHA256
c846a24a1689a3c306a44a4784a18546ef977fddadd703d1abc5dc801922ff22

SHA512
3d2cfecada7ad6347a1a5bc32ed920a919a30a13ce05c4da74e5eb9ba7576c0e97baa71546b1ccd49043a1176e05ba40e1b845ba5bda015c45cc32c0e8e0bb27

Download Submit
C:\Windows\system\KPHdQBf.exe

Filesize
1.5MB

MD5
5c5e5ec6257841a9449bfcad3dbd4718

SHA1
55005de1cf8e89d334d5a7095904912c0329d484

SHA256
3edc983cee04d6bc099cadbbbfb88d7c8589121a19d9a543e67ac55ff18cf6be

SHA512
a7ea6abf392eb22c07f510e16e9cdba679e193f7fd31eed138afed14fd1e5e9005bd3316e5562be43fbfa9df54893ea1dff33b2aef754735eceea46f909f8d78

Download Submit
C:\Windows\system\NAcMCCj.exe

Filesize
1.5MB

MD5
ab34b96bd43c31cd7fdfcb020995d7c7

SHA1
a71c60f8398ede53887ba54f1307f828428b020d

SHA256
e321e2d59764fc5579b4971617131db1e5357189fd1ad4a9543c93302c14c482

SHA512
e7cc12cfbefaa7d1ace4e6d6e7dbf2a8887a6dd862a2e7e205b7e9750f7204b4436bb0e1a6172a950dcd581d925dcf9a8353bbd9a788139488229816bc069357

Download Submit
C:\Windows\system\OezsQnM.exe

Filesize
1.5MB

MD5
0d8f8726b120886712bc40f7557114cf

SHA1
1c196042bda9b1a8ac77eb73a6e2d11e43c52865

SHA256
dabf6a0ae8bcd7235282871316db33941dd46f3bdf6adee3965ec48df05ef0b8

SHA512
7011e2262c7a0e7f51640d168e8d113d29dc7443976c2c13e5ee765099258ae99b515f68926869cbf46aa5e74b26bcda71bc0e80162fa5ac3972f800bd49593b

Download Submit
C:\Windows\system\QUnhsHh.exe

Filesize
1.5MB

MD5
da4675819a418e095433ee4f6f232ec5

SHA1
85b7c84d8e6d9a83a3afd6d7b632afca2a83d957

SHA256
4f2c64f3786b9c67f467c553ceee4680c0c0137f101225f47c98251cfb311a06

SHA512
efe8174facf133a62129b77288c9378ff1913c933e940d3b73ca2071f1bbe1f7d5eb386637e3532d1d7594c31a4359bef1a3869696d85a177c2be5a5bf91f23f

Download Submit
C:\Windows\system\SOOfuqp.exe

Filesize
1.5MB

MD5
63c702d2f28879da4516b51ce8428a69

SHA1
8c5142ec3b2152f6cf9c1de265b8c4e38146e18f

SHA256
9328c5cbfaea0226f15bdddfca934344822d5f67cc5fefd6b03725df7b61126b

SHA512
268327b9411c976883d0159afcae8c876fa214af8d7c3802a2aa0c6b2a1b9615813809a84f9386e0fdc7f339979e46c44be05c64aef92997297b5f4044fde293

Download Submit
C:\Windows\system\SfSDWHX.exe

Filesize
1.5MB

MD5
6d957e3c0d84609d6b8bc8a44790fe01

SHA1
9ca0f969ba57e1594446e02f61de3733994e5b36

SHA256
4607eaed45864b87aaacd4e63e0082e82b72e078ea5a9937ebb9ca96bf0f6297

SHA512
51a195a6144e9c7bde313904a14c0b81b90f01b80339fed3fb637a3c00efe3224e0666865372b687faa6a6f99309533113d85d22b65532a62bc63dda9c72eca8

Download Submit
C:\Windows\system\TsDoqlT.exe

Filesize
1.5MB

MD5
f4945f3e19bb284191b9b4ae44f09670

SHA1
bf48eeefaaa5ed3eb77ae9dbfc1888f6a698b5f6

SHA256
decd78146a84c0578cea352d9d2bc6204ea686985bf41e7d054100801d783a18

SHA512
241e64d2642cf9b9196f76399cb3a3286bec2341d48612e7e0be92278ce5b0ce4237a8d0898c75b01ce1de192f28ed4120cb8bf98e4167b4b916f424b0370efc

Download Submit
C:\Windows\system\UPyYQtx.exe

Filesize
1.5MB

MD5
88614f12fd97d3b747685bbdd6ec4d18

SHA1
b3d4d984ce3ba20e5881c081f11a6b0a50dabcd4

SHA256
b61ea54092cd924bc500957f30b23c829be0bc89953802f8513183aa4c574c83

SHA512
937b63cb3ab72d0ccef0083e4b0858273938a2a81a6d8eb8ea7836557b2a2826f8800789e4684f9998400fe129738e84a7c9b1341c12d6c667eb97b3a6a294ab

Download Submit
C:\Windows\system\XdGODGH.exe

Filesize
1.5MB

MD5
1fed1cf1ff30c70c9339bc5b4df8287d

SHA1
13ec18e15dadd1db4cb9ba000094f53f84350527

SHA256
3a93d5a54ddc228b147849553caa38ef874556da16b9b398ab201b39a1563966

SHA512
ec9e16a4d9b7a39477c7ae76df8c0cbb51388d8b95e469290bef6e5c4d0b87e65590dadc645d2866a7a7f9695fb5b3a9c700327ef1eb3d7ad61c36f668021f4f

Download Submit
C:\Windows\system\ZSkAcCp.exe

Filesize
1.5MB

MD5
19caa7c125cb09e5f80f3fdce611cde6

SHA1
53fd27b5ef518b4fd711753c0f6e4a872a3926d3

SHA256
92617644d22dd33d5fdee3e55d9522462ef812b596ad8ff8d28bc102cc69035b

SHA512
e17b77951d35f4e98807b34a44e54a1babe093462b1dfd079197df102e74bb30abac4f7813719daadd328714c8aaf616d53cd8130b0af4abc29ec9099ba47a05

Download Submit
C:\Windows\system\bfbHtCG.exe

Filesize
1.5MB

MD5
c0b1f70182f920bc0109369a570b8fd6

SHA1
11f806cfb594bae7d617cb8543ccb017c5cb4bc7

SHA256
61e9bcb98170db16107811470655ead059b34d2ae416434db42180e15e8b1fd0

SHA512
fa2decc9d06856a69ac481d54fb57d84ffbdacae108a4054d07e6bfc5db496905bdbd46beda679e842b3d658b6f28cc110607290e25b3bcd3c18ff3ec334940a

Download Submit
C:\Windows\system\dUyzUcf.exe

Filesize
1.5MB

MD5
a6261659f6b35055bbd4fa61b02a16b8

SHA1
e3d6923e98cc11253e7c16b868244f2fa9bb6299

SHA256
7485aae49a2034516c283cfb6744833630e4ee63b402575916c1fe3f15b20a04

SHA512
953ee48896ea226afe775dc4d95a9f100dfe988c3deb0c19c156c54c29370da4192e23fe2388139db1c58296b330c0b0b108bde92887652d30a5506a4bcc833b

Download Submit
C:\Windows\system\gUyeutZ.exe

Filesize
1.5MB

MD5
8090f2ade9ccf1c51670a67539fb85e4

SHA1
acf89882019d65cc89e6ee359a1654654bd41a5d

SHA256
8ef6354d8782aa492c301ec858d63efedf021cc7798a7050253a39bead4bc453

SHA512
150f0913ac11759d559b8688bbefa57e2e8e5eeca139062bdb68a965cb61eb490980e6fe0d8e22fee217698b0007536123e392b88c4a34fc30f7b0c5dbf32227

Download Submit
C:\Windows\system\hPieYGU.exe

Filesize
1.5MB

MD5
f08e729a9659cfadeedbc6b191e4e6a8

SHA1
049055b7b0ac74c82e724c3eb13524021ca11da9

SHA256
4fcdafbae493efc5ab222e87348b036a060a4090f3afc6897d076ba70efe50f3

SHA512
fe23be0903299b6e234d65f70a8102f9934d6c50518facbe2d77b261075aa2a52b8f53eec3d35fd20b9583d9079094617c7bb8fb4dd0b1722ba02efc808758eb

Download Submit
C:\Windows\system\hjHmVuh.exe

Filesize
1.5MB

MD5
a61ce83a86768209a7a75fb68bacde06

SHA1
8dbe3a6febf2477061edc6f90fea079a0215ca62

SHA256
0b6cb321a2a6a070bda3b1e76fb1494da49eb4166f5612d8adf9d92494a25b1d

SHA512
4c4923e90c497a4a794407aba12600548201c19b662a63125d6070e2a36a07b28f5d5a1aea3883d94589e43d257e1079cf44c13ef128a757d325174e9181b6f5

Download Submit
C:\Windows\system\jNHUHrK.exe

Filesize
1.5MB

MD5
226959f015ff040bb39ae2975821afba

SHA1
9304c267082bd6699983e6fc80ee934a60c496ae

SHA256
9db9e1440fac63f952eb87985ab2c02ab12effa7aa59dcf2fa5b8b15ac9033c1

SHA512
9ac7fcbbd6f399d923a5db5228c54277eacd9dc48ca2e9d0f1673a0ce5902ff0ec481c52e692a0025c29411fbdd44b6e16d76c2580755fbde9f22c939e86c20f

Download Submit
C:\Windows\system\lwEHNov.exe

Filesize
1.5MB

MD5
ae0f2ffb7d6141cd38ef60ce53e2773b

SHA1
808effc44bab8ae28b74d955b85c54373d6c721f

SHA256
473bf456bb24131a2f462e98b3664b955977bfadac8a0b24b6650d0d0102a24a

SHA512
c846c7fe4c55be9ffcf02324a3c314e621295781eb7a89f1727d77a044fa55acff5ceff11274c201583279d2d6668201fc99e548d84447083b9875dff9bb83ad

Download Submit
C:\Windows\system\pcwiOth.exe

Filesize
1.5MB

MD5
51a44788fb1c8cea7783f615acd29fe7

SHA1
825e8a0a47f9913a44d6cb86ecb5ddeda6c651f3

SHA256
b99cf1219146df828b320113c3d590c7b21abfb6d7610029489683682287e338

SHA512
690ba84386114aeb33da3fc1fb427dee14b9b81f4d23f2ab85eab3e02cc16ea081058ad6be9dea075e9de5b5ff152ec73320de376296b3d2a2a07b6ea1130532

Download Submit
C:\Windows\system\qNIBeyV.exe

Filesize
1.5MB

MD5
efcf6a217131512be66d65c81189fc19

SHA1
3434547eb750df60df6a16d9ea1a795277055d8b

SHA256
ab929c551bfe2551bd32490823cec5773b2878a29bd1c43d03875063d6dcf19a

SHA512
2fc81f97c6c65d833ac9a54f5cc888cbbc37f92656bf904901d950de9f1c2218db3854ac5b6a2ffe1b998dcf4f5edb432fe968b0cf49bebfad35125f58622dc6

Download Submit
C:\Windows\system\qbWLgjQ.exe

Filesize
1.5MB

MD5
8d43189d347b1252d0cfb335aab45e47

SHA1
9b16e26fcc8ac2d5331edca5dfbd428ac11ebd34

SHA256
b9c9e9d7c7cb7e44a26ef937eda747dba4d83351682f31c57bc2a9ccba326e17

SHA512
b21aaa4d3ab9d34a3f09d3608f6028a5dcebb9ecf2b31db1c21056d840e9ec3b06c6e4aa0e4ca59eb0ed438bdbbe55349431ed4dabe864a803d435223bc4f687

Download Submit
C:\Windows\system\sdIAFvD.exe

Filesize
1.5MB

MD5
b85ccc004babbcde3c82ee462f523c14

SHA1
1e896bd821ddb62967b630687a919ce3fde7df0a

SHA256
25521af4d7bf0a2f83c7c058c731c5939d7726bd7adc5538ebc8722726ae220a

SHA512
882755fc6459ea300fd70cb146b47e904686ea0785da3d40a402c65edd32099fbfb324989dce88ef10be4b6c1afdf02cc6f396eb2188f23a4a13755db1e06e95

Download Submit
C:\Windows\system\shuxQHN.exe

Filesize
1.5MB

MD5
ba61f9dc4eb9e04f5c0fbd30229333e1

SHA1
aecb6bfbf8ef9532441bfc161ffa2f38ed1f66a5

SHA256
cc0c61d376105109b7cff1470958d7f280e8a4f62455462ea6f8813094f67e95

SHA512
e322e3635683f2607d4380caed0c2c10aeb283056291a340f2852a534df14ac36acbc58c8003b18261619d3dd80b6a014b5175bd25e6be349649f3987a49f3f0

Download Submit
C:\Windows\system\xVKGFtc.exe

Filesize
1.5MB

MD5
6fa28ceb826f4d08cc89aafb28b6ad51

SHA1
800ffc340d5e40c9fafa2e3fca546d101951c96c

SHA256
49948b93cad55a8d03c9bbfbbfc6d5a5d37b586b3411b41b457291f27e87de06

SHA512
ffce3b4371d2f9d1650c56012eeae395d8eede2cf023c1f7b3f3d694792dec11e76f1c097cb15c9997bf5ed1bc4453b07c1ddb504faccc6d23e11e1a7d2fb25a

Download Submit
C:\Windows\system\yevKiqy.exe

Filesize
1.5MB

MD5
29a72626dec7a61cfa419c846003089e

SHA1
79c36e19377e97deaf6a80bee4a8a82a4a0b9b5a

SHA256
1585b5e3d45837aaf118d9a1553bd15935bea6df57a873ab0dc954bf8a2f504c

SHA512
c8e35e978c7243e471d2a0c56a0919a95ad611072a123a489ed64e18f406db20d011d6522e30d5b2686b3e852ca9a1849624d8aa45e1847243123ab0227762af

Download Submit
\Windows\system\YBXfxuq.exe

Filesize
1.5MB

MD5
480ccc0a7cfeda913dcf560912779bbc

SHA1
1d4aa2cdc63bbfc403d356f3664baf82960e33de

SHA256
05f5e9eb13876e06edf7129a925bcd73395fdd5f37e8756e8aef6d495645171f

SHA512
6df084b1ddd7cfa3d6e2a7b84c924da61339971455d3628b8e11342d507b674db944ce61407a1c7720a84430efa9e8d075d82a3c71ecf706c6a568501fc5a519

Download Submit
\Windows\system\ZfOoMZx.exe

Filesize
1.5MB

MD5
f6154ad0863d24574203d32a121b0fcf

SHA1
b663aed1339efcc5d21dc1fe904c5b98a1db0a87

SHA256
f28b0098607df111d0022e08a7b80bf13933fc120e0138db25d83bf948fb0913

SHA512
bf014febfbda07be67192a49e00a8dad680647abba18c55b81539b4d34680bce646556b034f21a9cc04e1699a42e5ccd14801a143ca880785b368a0b37f40eca

Download Submit
\Windows\system\wPbiASh.exe

Filesize
1.5MB

MD5
f950ef26d684dce8d4e31ea7ed09cf05

SHA1
d553b3ab0c4ee0e2cfca7345c8aeb29279bc3208

SHA256
f2dcded3e9c851f5718ffe5104bc9d56153335f2eb38693a2582070e312c4640

SHA512
33288dbec4e7630ec68d414e905e37203b6fb50d923c705ff4ce5f645e42e1106a40afded0c98fd5dad704a18fed1f68caf5b099f4856a3ea897ce76b9c91c20

Download Submit
memory/1656-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download