xmrig | ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
Size

1.7MB
MD5

6208557397a6e9dccf6fcfc3405835a3
SHA1

57e9ff8a809f3c4a63c759f053fd2ae97cb43add
SHA256

ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f
SHA512

573ecdc2fba7d0001e863ab3d7c6946e7fc31668941b1bcecb24d1786562ab6652eb2def7b90006b76f347ebef23d461aea11d91bcba429184f6253307d3a844
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLjAN:GemTLkNdfE0pZyL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000e000000012267-2.dat	xmrig
behavioral1/files/0x0009000000016d2c-6.dat	xmrig
behavioral1/files/0x0005000000019d62-154.dat	xmrig
behavioral1/files/0x0005000000019d6d-159.dat	xmrig
behavioral1/files/0x0005000000019c3c-144.dat	xmrig
behavioral1/files/0x0005000000019d61-150.dat	xmrig
behavioral1/files/0x0005000000019bf6-135.dat	xmrig
behavioral1/files/0x0005000000019bf9-138.dat	xmrig
behavioral1/files/0x000500000001998d-124.dat	xmrig
behavioral1/files/0x0005000000019bf5-129.dat	xmrig
behavioral1/files/0x00050000000197fd-114.dat	xmrig
behavioral1/files/0x0005000000019820-118.dat	xmrig
behavioral1/files/0x000500000001975a-104.dat	xmrig
behavioral1/files/0x0005000000019761-109.dat	xmrig
behavioral1/files/0x000500000001960c-94.dat	xmrig
behavioral1/files/0x0005000000019643-99.dat	xmrig
behavioral1/files/0x00050000000195c6-85.dat	xmrig
behavioral1/files/0x00050000000195c7-88.dat	xmrig
behavioral1/files/0x00050000000195c3-74.dat	xmrig
behavioral1/files/0x00050000000195c5-80.dat	xmrig
behavioral1/files/0x00050000000195c1-70.dat	xmrig
behavioral1/files/0x00050000000195bd-64.dat	xmrig
behavioral1/files/0x00050000000195b7-59.dat	xmrig
behavioral1/files/0x00050000000195b5-55.dat	xmrig
behavioral1/files/0x0009000000016d3f-45.dat	xmrig
behavioral1/files/0x00050000000195b3-49.dat	xmrig
behavioral1/files/0x000800000001756e-40.dat	xmrig
behavioral1/files/0x00070000000170f8-35.dat	xmrig
behavioral1/files/0x0007000000016fe5-29.dat	xmrig
behavioral1/files/0x0007000000016fc9-25.dat	xmrig
behavioral1/files/0x0008000000016d69-20.dat	xmrig
behavioral1/files/0x000a000000016d64-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2580	yVJVQSl.exe
1756	jIAYVLP.exe
2584	tdibcsH.exe
1384	YqvFOnh.exe
3040	PjEaYAU.exe
2360	UnuSRsj.exe
2220	NpwDJZM.exe
2880	AkaVSdN.exe
2904	lrRWyHf.exe
2784	TADJThR.exe
2796	bgNAPgs.exe
2716	szbJocy.exe
2792	CjCGGFU.exe
2696	ltysVxL.exe
1532	lOtRUhu.exe
2044	XhzJNub.exe
2660	OdKlYFG.exe
2736	RkZNGkL.exe
2980	qbWbmjT.exe
1456	mmDweNM.exe
1504	lhDlWbA.exe
1644	QNcaWPI.exe
1772	NBupdIU.exe
2020	bYQPkEQ.exe
1660	WoiZnhc.exe
2016	aiAhZIG.exe
1764	FJSxcRE.exe
2976	RLTDkYm.exe
612	bnMWxfa.exe
2264	hkqKXOC.exe
2132	vSsPrWe.exe
1868	DrKvvfq.exe
1652	brnVSTZ.exe
1492	ZHzbjgQ.exe
2440	oQuRUus.exe
1980	rljEKhQ.exe
1352	vknwTzB.exe
656	yNFXLtG.exe
1516	qGEapVR.exe
1324	joLULyc.exe
968	iBzgDjf.exe
1728	QVeWBuh.exe
1736	DMZyxsf.exe
1968	NpAwcQl.exe
1192	LUutHEw.exe
296	orKIsAI.exe
640	ApPVNRN.exe
2436	QsqptyJ.exe
772	aFqCrGk.exe
2564	oNFtYSP.exe
1944	MKJYLqk.exe
820	yVvaEIO.exe
3060	IsqoaKd.exe
2460	pdNaqnN.exe
264	wpnqygq.exe
288	nvgEBek.exe
900	jPfUCTP.exe
948	JdlCEDF.exe
1824	LCdWqgz.exe
1576	mtamrOM.exe
2136	anHDWHh.exe
2620	movVupn.exe
2632	CrItKZH.exe
2140	DBwkkbk.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VJaoLLI.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\IbNfqdd.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\vJZZhJf.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\JncdgOc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\vnIdPgq.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QcNPEqL.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\kLGhfEc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\IuHsjUA.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ohrfJtk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\xxItrSc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\najyWQr.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\HMaPGYq.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\TADJThR.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\gFmUBfU.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\BiJtgpc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\RcNxRFV.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\IHgrrsC.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\oREKjfE.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\yNajXdC.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\plrKxna.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\Ulbfcdc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\MOyWKDZ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ILtVaYt.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\gLXVFIv.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\yVJVQSl.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ocbByZk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\GdXmuQT.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\qWKcWin.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\AqSmIbF.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\Dxjjnfh.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\pwVtvKV.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\JBnAGTL.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\oDuCLfd.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\PwvBQkQ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\PoBpZUy.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QVeWBuh.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\tcwrNqi.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\TJBkMcD.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\PwTFdlh.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\cfirEpU.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\eLnxKfN.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\gshIkUQ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\cDcuxJq.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\NEVvbNI.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\fgbfmlQ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\GEJvcZG.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ndvFWfn.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QZnfFmH.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\pKXhSsY.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ZarMlZm.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QjxzUKX.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\XIVLNET.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ZpGIplY.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\wUOjblE.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\rmcChbt.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ZQApUSk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\fQhvjSq.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\uoNlzJF.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\elajdwn.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\dmpgfgZ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\mdqwPHk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\joLULyc.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\OuBHLcr.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\OQyVbOT.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2580	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	31
PID 2188 wrote to memory of 2580	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	31
PID 2188 wrote to memory of 2580	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	31
PID 2188 wrote to memory of 1756	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	32
PID 2188 wrote to memory of 1756	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	32
PID 2188 wrote to memory of 1756	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	32
PID 2188 wrote to memory of 2584	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	33
PID 2188 wrote to memory of 2584	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	33
PID 2188 wrote to memory of 2584	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	33
PID 2188 wrote to memory of 1384	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	34
PID 2188 wrote to memory of 1384	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	34
PID 2188 wrote to memory of 1384	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	34
PID 2188 wrote to memory of 3040	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	35
PID 2188 wrote to memory of 3040	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	35
PID 2188 wrote to memory of 3040	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	35
PID 2188 wrote to memory of 2360	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	36
PID 2188 wrote to memory of 2360	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	36
PID 2188 wrote to memory of 2360	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	36
PID 2188 wrote to memory of 2220	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	37
PID 2188 wrote to memory of 2220	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	37
PID 2188 wrote to memory of 2220	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	37
PID 2188 wrote to memory of 2880	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	38
PID 2188 wrote to memory of 2880	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	38
PID 2188 wrote to memory of 2880	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	38
PID 2188 wrote to memory of 2904	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	39
PID 2188 wrote to memory of 2904	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	39
PID 2188 wrote to memory of 2904	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	39
PID 2188 wrote to memory of 2784	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	40
PID 2188 wrote to memory of 2784	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	40
PID 2188 wrote to memory of 2784	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	40
PID 2188 wrote to memory of 2796	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	41
PID 2188 wrote to memory of 2796	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	41
PID 2188 wrote to memory of 2796	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	41
PID 2188 wrote to memory of 2716	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	42
PID 2188 wrote to memory of 2716	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	42
PID 2188 wrote to memory of 2716	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	42
PID 2188 wrote to memory of 2792	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	43
PID 2188 wrote to memory of 2792	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	43
PID 2188 wrote to memory of 2792	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	43
PID 2188 wrote to memory of 2696	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	44
PID 2188 wrote to memory of 2696	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	44
PID 2188 wrote to memory of 2696	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	44
PID 2188 wrote to memory of 1532	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	45
PID 2188 wrote to memory of 1532	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	45
PID 2188 wrote to memory of 1532	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	45
PID 2188 wrote to memory of 2044	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	46
PID 2188 wrote to memory of 2044	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	46
PID 2188 wrote to memory of 2044	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	46
PID 2188 wrote to memory of 2660	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	47
PID 2188 wrote to memory of 2660	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	47
PID 2188 wrote to memory of 2660	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	47
PID 2188 wrote to memory of 2736	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	48
PID 2188 wrote to memory of 2736	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	48
PID 2188 wrote to memory of 2736	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	48
PID 2188 wrote to memory of 2980	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	49
PID 2188 wrote to memory of 2980	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	49
PID 2188 wrote to memory of 2980	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	49
PID 2188 wrote to memory of 1456	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	50
PID 2188 wrote to memory of 1456	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	50
PID 2188 wrote to memory of 1456	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	50
PID 2188 wrote to memory of 1504	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	51
PID 2188 wrote to memory of 1504	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	51
PID 2188 wrote to memory of 1504	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	51
PID 2188 wrote to memory of 1644	2188	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	52

C:\Users\Admin\AppData\Local\Temp\ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
"C:\Users\Admin\AppData\Local\Temp\ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System\yVJVQSl.exe
  C:\Windows\System\yVJVQSl.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\jIAYVLP.exe
  C:\Windows\System\jIAYVLP.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\tdibcsH.exe
  C:\Windows\System\tdibcsH.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\YqvFOnh.exe
  C:\Windows\System\YqvFOnh.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\PjEaYAU.exe
  C:\Windows\System\PjEaYAU.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\UnuSRsj.exe
  C:\Windows\System\UnuSRsj.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\NpwDJZM.exe
  C:\Windows\System\NpwDJZM.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\AkaVSdN.exe
  C:\Windows\System\AkaVSdN.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lrRWyHf.exe
  C:\Windows\System\lrRWyHf.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\TADJThR.exe
  C:\Windows\System\TADJThR.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\bgNAPgs.exe
  C:\Windows\System\bgNAPgs.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\szbJocy.exe
  C:\Windows\System\szbJocy.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\CjCGGFU.exe
  C:\Windows\System\CjCGGFU.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ltysVxL.exe
  C:\Windows\System\ltysVxL.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\lOtRUhu.exe
  C:\Windows\System\lOtRUhu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XhzJNub.exe
  C:\Windows\System\XhzJNub.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\OdKlYFG.exe
  C:\Windows\System\OdKlYFG.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RkZNGkL.exe
  C:\Windows\System\RkZNGkL.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\qbWbmjT.exe
  C:\Windows\System\qbWbmjT.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\mmDweNM.exe
  C:\Windows\System\mmDweNM.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\lhDlWbA.exe
  C:\Windows\System\lhDlWbA.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\QNcaWPI.exe
  C:\Windows\System\QNcaWPI.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\NBupdIU.exe
  C:\Windows\System\NBupdIU.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\bYQPkEQ.exe
  C:\Windows\System\bYQPkEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\WoiZnhc.exe
  C:\Windows\System\WoiZnhc.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\aiAhZIG.exe
  C:\Windows\System\aiAhZIG.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\FJSxcRE.exe
  C:\Windows\System\FJSxcRE.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\RLTDkYm.exe
  C:\Windows\System\RLTDkYm.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\bnMWxfa.exe
  C:\Windows\System\bnMWxfa.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\hkqKXOC.exe
  C:\Windows\System\hkqKXOC.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\vSsPrWe.exe
  C:\Windows\System\vSsPrWe.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\DrKvvfq.exe
  C:\Windows\System\DrKvvfq.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\brnVSTZ.exe
  C:\Windows\System\brnVSTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\ZHzbjgQ.exe
  C:\Windows\System\ZHzbjgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\oQuRUus.exe
  C:\Windows\System\oQuRUus.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\rljEKhQ.exe
  C:\Windows\System\rljEKhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\vknwTzB.exe
  C:\Windows\System\vknwTzB.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\yNFXLtG.exe
  C:\Windows\System\yNFXLtG.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\qGEapVR.exe
  C:\Windows\System\qGEapVR.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\joLULyc.exe
  C:\Windows\System\joLULyc.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\iBzgDjf.exe
  C:\Windows\System\iBzgDjf.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\QVeWBuh.exe
  C:\Windows\System\QVeWBuh.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\DMZyxsf.exe
  C:\Windows\System\DMZyxsf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\NpAwcQl.exe
  C:\Windows\System\NpAwcQl.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\LUutHEw.exe
  C:\Windows\System\LUutHEw.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\orKIsAI.exe
  C:\Windows\System\orKIsAI.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\ApPVNRN.exe
  C:\Windows\System\ApPVNRN.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\QsqptyJ.exe
  C:\Windows\System\QsqptyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\aFqCrGk.exe
  C:\Windows\System\aFqCrGk.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\oNFtYSP.exe
  C:\Windows\System\oNFtYSP.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\MKJYLqk.exe
  C:\Windows\System\MKJYLqk.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\yVvaEIO.exe
  C:\Windows\System\yVvaEIO.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\IsqoaKd.exe
  C:\Windows\System\IsqoaKd.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\pdNaqnN.exe
  C:\Windows\System\pdNaqnN.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\wpnqygq.exe
  C:\Windows\System\wpnqygq.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\nvgEBek.exe
  C:\Windows\System\nvgEBek.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\jPfUCTP.exe
  C:\Windows\System\jPfUCTP.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\JdlCEDF.exe
  C:\Windows\System\JdlCEDF.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\LCdWqgz.exe
  C:\Windows\System\LCdWqgz.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\mtamrOM.exe
  C:\Windows\System\mtamrOM.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\anHDWHh.exe
  C:\Windows\System\anHDWHh.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\movVupn.exe
  C:\Windows\System\movVupn.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CrItKZH.exe
  C:\Windows\System\CrItKZH.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DBwkkbk.exe
  C:\Windows\System\DBwkkbk.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\YzxlvFG.exe
  C:\Windows\System\YzxlvFG.exe
  2⤵
  PID:2068
- C:\Windows\System\TUmyijY.exe
  C:\Windows\System\TUmyijY.exe
  2⤵
  PID:2080
- C:\Windows\System\sWQHEec.exe
  C:\Windows\System\sWQHEec.exe
  2⤵
  PID:2872
- C:\Windows\System\mqAQSoU.exe
  C:\Windows\System\mqAQSoU.exe
  2⤵
  PID:2928
- C:\Windows\System\xrvchDU.exe
  C:\Windows\System\xrvchDU.exe
  2⤵
  PID:2692
- C:\Windows\System\woUayhi.exe
  C:\Windows\System\woUayhi.exe
  2⤵
  PID:2688
- C:\Windows\System\avnyoHq.exe
  C:\Windows\System\avnyoHq.exe
  2⤵
  PID:1496
- C:\Windows\System\giUqHUe.exe
  C:\Windows\System\giUqHUe.exe
  2⤵
  PID:1664
- C:\Windows\System\EpTFhQG.exe
  C:\Windows\System\EpTFhQG.exe
  2⤵
  PID:2368
- C:\Windows\System\nSjVulA.exe
  C:\Windows\System\nSjVulA.exe
  2⤵
  PID:1656
- C:\Windows\System\WyiKyFY.exe
  C:\Windows\System\WyiKyFY.exe
  2⤵
  PID:1988
- C:\Windows\System\hrQjEiY.exe
  C:\Windows\System\hrQjEiY.exe
  2⤵
  PID:2000
- C:\Windows\System\sQwMIKa.exe
  C:\Windows\System\sQwMIKa.exe
  2⤵
  PID:2248
- C:\Windows\System\ACdSMjm.exe
  C:\Windows\System\ACdSMjm.exe
  2⤵
  PID:836
- C:\Windows\System\VfQwBHg.exe
  C:\Windows\System\VfQwBHg.exe
  2⤵
  PID:676
- C:\Windows\System\qrXejNG.exe
  C:\Windows\System\qrXejNG.exe
  2⤵
  PID:108
- C:\Windows\System\VtsXwEh.exe
  C:\Windows\System\VtsXwEh.exe
  2⤵
  PID:560
- C:\Windows\System\aExTUYT.exe
  C:\Windows\System\aExTUYT.exe
  2⤵
  PID:2588
- C:\Windows\System\AaIStiZ.exe
  C:\Windows\System\AaIStiZ.exe
  2⤵
  PID:744
- C:\Windows\System\zHZYFov.exe
  C:\Windows\System\zHZYFov.exe
  2⤵
  PID:1284
- C:\Windows\System\rQEbUEh.exe
  C:\Windows\System\rQEbUEh.exe
  2⤵
  PID:1412
- C:\Windows\System\gMwRQBJ.exe
  C:\Windows\System\gMwRQBJ.exe
  2⤵
  PID:864
- C:\Windows\System\zWhyzPF.exe
  C:\Windows\System\zWhyzPF.exe
  2⤵
  PID:908
- C:\Windows\System\EfsFjyX.exe
  C:\Windows\System\EfsFjyX.exe
  2⤵
  PID:1648
- C:\Windows\System\ryTbbob.exe
  C:\Windows\System\ryTbbob.exe
  2⤵
  PID:2640
- C:\Windows\System\PmnaObl.exe
  C:\Windows\System\PmnaObl.exe
  2⤵
  PID:2072
- C:\Windows\System\CYuMGuA.exe
  C:\Windows\System\CYuMGuA.exe
  2⤵
  PID:1672
- C:\Windows\System\IuHsjUA.exe
  C:\Windows\System\IuHsjUA.exe
  2⤵
  PID:1896
- C:\Windows\System\OcdJGzr.exe
  C:\Windows\System\OcdJGzr.exe
  2⤵
  PID:2480
- C:\Windows\System\SkoYEit.exe
  C:\Windows\System\SkoYEit.exe
  2⤵
  PID:2612
- C:\Windows\System\EdZApIC.exe
  C:\Windows\System\EdZApIC.exe
  2⤵
  PID:2168
- C:\Windows\System\ehrgChy.exe
  C:\Windows\System\ehrgChy.exe
  2⤵
  PID:1592
- C:\Windows\System\AHRrNip.exe
  C:\Windows\System\AHRrNip.exe
  2⤵
  PID:2092
- C:\Windows\System\NmMAFEx.exe
  C:\Windows\System\NmMAFEx.exe
  2⤵
  PID:2108
- C:\Windows\System\jLbMtsN.exe
  C:\Windows\System\jLbMtsN.exe
  2⤵
  PID:2964
- C:\Windows\System\NHKqKmt.exe
  C:\Windows\System\NHKqKmt.exe
  2⤵
  PID:2768
- C:\Windows\System\TdUXLDf.exe
  C:\Windows\System\TdUXLDf.exe
  2⤵
  PID:3056
- C:\Windows\System\RAZewxz.exe
  C:\Windows\System\RAZewxz.exe
  2⤵
  PID:1960
- C:\Windows\System\UEvFvbL.exe
  C:\Windows\System\UEvFvbL.exe
  2⤵
  PID:692
- C:\Windows\System\YKIBCtg.exe
  C:\Windows\System\YKIBCtg.exe
  2⤵
  PID:2276
- C:\Windows\System\jsJfsmv.exe
  C:\Windows\System\jsJfsmv.exe
  2⤵
  PID:2100
- C:\Windows\System\WgjzjbW.exe
  C:\Windows\System\WgjzjbW.exe
  2⤵
  PID:2940
- C:\Windows\System\FLTsbnO.exe
  C:\Windows\System\FLTsbnO.exe
  2⤵
  PID:880
- C:\Windows\System\ohMGnbE.exe
  C:\Windows\System\ohMGnbE.exe
  2⤵
  PID:2284
- C:\Windows\System\dLbjbFm.exe
  C:\Windows\System\dLbjbFm.exe
  2⤵
  PID:2684
- C:\Windows\System\RAZbuLs.exe
  C:\Windows\System\RAZbuLs.exe
  2⤵
  PID:2028
- C:\Windows\System\zgYunyC.exe
  C:\Windows\System\zgYunyC.exe
  2⤵
  PID:2824
- C:\Windows\System\OLiHnoh.exe
  C:\Windows\System\OLiHnoh.exe
  2⤵
  PID:2808
- C:\Windows\System\FviXIBC.exe
  C:\Windows\System\FviXIBC.exe
  2⤵
  PID:2232
- C:\Windows\System\aJUvwpW.exe
  C:\Windows\System\aJUvwpW.exe
  2⤵
  PID:2316
- C:\Windows\System\DYeiXRd.exe
  C:\Windows\System\DYeiXRd.exe
  2⤵
  PID:1104
- C:\Windows\System\ODCdDmU.exe
  C:\Windows\System\ODCdDmU.exe
  2⤵
  PID:2576
- C:\Windows\System\YkcLrUE.exe
  C:\Windows\System\YkcLrUE.exe
  2⤵
  PID:2008
- C:\Windows\System\oujPIwl.exe
  C:\Windows\System\oujPIwl.exe
  2⤵
  PID:3004
- C:\Windows\System\zGFMusI.exe
  C:\Windows\System\zGFMusI.exe
  2⤵
  PID:112
- C:\Windows\System\ZtDJaMj.exe
  C:\Windows\System\ZtDJaMj.exe
  2⤵
  PID:1344
- C:\Windows\System\plrKxna.exe
  C:\Windows\System\plrKxna.exe
  2⤵
  PID:432
- C:\Windows\System\pNdFMRu.exe
  C:\Windows\System\pNdFMRu.exe
  2⤵
  PID:776
- C:\Windows\System\HKmvTTl.exe
  C:\Windows\System\HKmvTTl.exe
  2⤵
  PID:1512
- C:\Windows\System\yNVkbTS.exe
  C:\Windows\System\yNVkbTS.exe
  2⤵
  PID:1732
- C:\Windows\System\EDGpQyu.exe
  C:\Windows\System\EDGpQyu.exe
  2⤵
  PID:2036
- C:\Windows\System\hglzlpf.exe
  C:\Windows\System\hglzlpf.exe
  2⤵
  PID:1432
- C:\Windows\System\ycblYSy.exe
  C:\Windows\System\ycblYSy.exe
  2⤵
  PID:2540
- C:\Windows\System\EseCfLu.exe
  C:\Windows\System\EseCfLu.exe
  2⤵
  PID:2516
- C:\Windows\System\gdRGrqR.exe
  C:\Windows\System\gdRGrqR.exe
  2⤵
  PID:2384
- C:\Windows\System\LeCSCjo.exe
  C:\Windows\System\LeCSCjo.exe
  2⤵
  PID:1708
- C:\Windows\System\LcHaSIc.exe
  C:\Windows\System\LcHaSIc.exe
  2⤵
  PID:2104
- C:\Windows\System\cedwmns.exe
  C:\Windows\System\cedwmns.exe
  2⤵
  PID:2820
- C:\Windows\System\jVBJIJL.exe
  C:\Windows\System\jVBJIJL.exe
  2⤵
  PID:2848
- C:\Windows\System\WdOLHoa.exe
  C:\Windows\System\WdOLHoa.exe
  2⤵
  PID:2052
- C:\Windows\System\ZRmFAmZ.exe
  C:\Windows\System\ZRmFAmZ.exe
  2⤵
  PID:1640
- C:\Windows\System\ZDcGXPW.exe
  C:\Windows\System\ZDcGXPW.exe
  2⤵
  PID:1208
- C:\Windows\System\isNYcHj.exe
  C:\Windows\System\isNYcHj.exe
  2⤵
  PID:2812
- C:\Windows\System\WiFXncH.exe
  C:\Windows\System\WiFXncH.exe
  2⤵
  PID:2728
- C:\Windows\System\KGQqHSI.exe
  C:\Windows\System\KGQqHSI.exe
  2⤵
  PID:1880
- C:\Windows\System\JsAudjY.exe
  C:\Windows\System\JsAudjY.exe
  2⤵
  PID:1948
- C:\Windows\System\yKnmmmE.exe
  C:\Windows\System\yKnmmmE.exe
  2⤵
  PID:1312
- C:\Windows\System\GzgWQvz.exe
  C:\Windows\System\GzgWQvz.exe
  2⤵
  PID:1184
- C:\Windows\System\rkTkqmD.exe
  C:\Windows\System\rkTkqmD.exe
  2⤵
  PID:1092
- C:\Windows\System\KQsiIdv.exe
  C:\Windows\System\KQsiIdv.exe
  2⤵
  PID:2752
- C:\Windows\System\yNCmZOu.exe
  C:\Windows\System\yNCmZOu.exe
  2⤵
  PID:2720
- C:\Windows\System\EXbASbO.exe
  C:\Windows\System\EXbASbO.exe
  2⤵
  PID:1164
- C:\Windows\System\rjTfzNq.exe
  C:\Windows\System\rjTfzNq.exe
  2⤵
  PID:1100
- C:\Windows\System\nDGBkqE.exe
  C:\Windows\System\nDGBkqE.exe
  2⤵
  PID:2468
- C:\Windows\System\qRmIkIe.exe
  C:\Windows\System\qRmIkIe.exe
  2⤵
  PID:2404
- C:\Windows\System\bLYVmIU.exe
  C:\Windows\System\bLYVmIU.exe
  2⤵
  PID:2280
- C:\Windows\System\ocbByZk.exe
  C:\Windows\System\ocbByZk.exe
  2⤵
  PID:2836
- C:\Windows\System\OobGdcW.exe
  C:\Windows\System\OobGdcW.exe
  2⤵
  PID:2388
- C:\Windows\System\CwbehAb.exe
  C:\Windows\System\CwbehAb.exe
  2⤵
  PID:1904
- C:\Windows\System\tbkXOrj.exe
  C:\Windows\System\tbkXOrj.exe
  2⤵
  PID:2332
- C:\Windows\System\NpMOmTU.exe
  C:\Windows\System\NpMOmTU.exe
  2⤵
  PID:2944
- C:\Windows\System\JGGeuaH.exe
  C:\Windows\System\JGGeuaH.exe
  2⤵
  PID:2840
- C:\Windows\System\lfDQpqg.exe
  C:\Windows\System\lfDQpqg.exe
  2⤵
  PID:1500
- C:\Windows\System\akuiaPd.exe
  C:\Windows\System\akuiaPd.exe
  2⤵
  PID:2452
- C:\Windows\System\nxdfIYw.exe
  C:\Windows\System\nxdfIYw.exe
  2⤵
  PID:2804
- C:\Windows\System\mJivkLq.exe
  C:\Windows\System\mJivkLq.exe
  2⤵
  PID:1036
- C:\Windows\System\wsbfFWu.exe
  C:\Windows\System\wsbfFWu.exe
  2⤵
  PID:1552
- C:\Windows\System\qLOIWJe.exe
  C:\Windows\System\qLOIWJe.exe
  2⤵
  PID:2676
- C:\Windows\System\XcRLoqh.exe
  C:\Windows\System\XcRLoqh.exe
  2⤵
  PID:1768
- C:\Windows\System\elJZmgM.exe
  C:\Windows\System\elJZmgM.exe
  2⤵
  PID:1888
- C:\Windows\System\bvmepoY.exe
  C:\Windows\System\bvmepoY.exe
  2⤵
  PID:2244
- C:\Windows\System\rLdyWry.exe
  C:\Windows\System\rLdyWry.exe
  2⤵
  PID:1556
- C:\Windows\System\ZreNNUA.exe
  C:\Windows\System\ZreNNUA.exe
  2⤵
  PID:2936
- C:\Windows\System\VSjtDVU.exe
  C:\Windows\System\VSjtDVU.exe
  2⤵
  PID:2124
- C:\Windows\System\qnGoVOB.exe
  C:\Windows\System\qnGoVOB.exe
  2⤵
  PID:2916
- C:\Windows\System\gFlkEtS.exe
  C:\Windows\System\gFlkEtS.exe
  2⤵
  PID:3084
- C:\Windows\System\PcCOHGb.exe
  C:\Windows\System\PcCOHGb.exe
  2⤵
  PID:3100
- C:\Windows\System\duoJGBc.exe
  C:\Windows\System\duoJGBc.exe
  2⤵
  PID:3116
- C:\Windows\System\LcpVCdv.exe
  C:\Windows\System\LcpVCdv.exe
  2⤵
  PID:3136
- C:\Windows\System\ApYzoIe.exe
  C:\Windows\System\ApYzoIe.exe
  2⤵
  PID:3152
- C:\Windows\System\lHpVgFg.exe
  C:\Windows\System\lHpVgFg.exe
  2⤵
  PID:3168
- C:\Windows\System\QAMlMCk.exe
  C:\Windows\System\QAMlMCk.exe
  2⤵
  PID:3184
- C:\Windows\System\dGlENia.exe
  C:\Windows\System\dGlENia.exe
  2⤵
  PID:3200
- C:\Windows\System\IyhUSZW.exe
  C:\Windows\System\IyhUSZW.exe
  2⤵
  PID:3220
- C:\Windows\System\BMcLKgm.exe
  C:\Windows\System\BMcLKgm.exe
  2⤵
  PID:3260
- C:\Windows\System\NNZkrTX.exe
  C:\Windows\System\NNZkrTX.exe
  2⤵
  PID:3292
- C:\Windows\System\xSHtarP.exe
  C:\Windows\System\xSHtarP.exe
  2⤵
  PID:3308
- C:\Windows\System\yDJtLHy.exe
  C:\Windows\System\yDJtLHy.exe
  2⤵
  PID:3328
- C:\Windows\System\uYSgLOz.exe
  C:\Windows\System\uYSgLOz.exe
  2⤵
  PID:3348
- C:\Windows\System\sikOhay.exe
  C:\Windows\System\sikOhay.exe
  2⤵
  PID:3368
- C:\Windows\System\enrGwBD.exe
  C:\Windows\System\enrGwBD.exe
  2⤵
  PID:3392
- C:\Windows\System\BwbDcSu.exe
  C:\Windows\System\BwbDcSu.exe
  2⤵
  PID:3416
- C:\Windows\System\MlduSqH.exe
  C:\Windows\System\MlduSqH.exe
  2⤵
  PID:3436
- C:\Windows\System\tcwrNqi.exe
  C:\Windows\System\tcwrNqi.exe
  2⤵
  PID:3452
- C:\Windows\System\QZXfoSq.exe
  C:\Windows\System\QZXfoSq.exe
  2⤵
  PID:3468
- C:\Windows\System\WQiOKUQ.exe
  C:\Windows\System\WQiOKUQ.exe
  2⤵
  PID:3492
- C:\Windows\System\MGhGzKr.exe
  C:\Windows\System\MGhGzKr.exe
  2⤵
  PID:3516
- C:\Windows\System\TUqcEfn.exe
  C:\Windows\System\TUqcEfn.exe
  2⤵
  PID:3532
- C:\Windows\System\QfNMrlN.exe
  C:\Windows\System\QfNMrlN.exe
  2⤵
  PID:3548
- C:\Windows\System\guDyQwJ.exe
  C:\Windows\System\guDyQwJ.exe
  2⤵
  PID:3564
- C:\Windows\System\fkIQHWA.exe
  C:\Windows\System\fkIQHWA.exe
  2⤵
  PID:3580
- C:\Windows\System\DeimXEG.exe
  C:\Windows\System\DeimXEG.exe
  2⤵
  PID:3644
- C:\Windows\System\SZLtSol.exe
  C:\Windows\System\SZLtSol.exe
  2⤵
  PID:3660
- C:\Windows\System\rmYCZOE.exe
  C:\Windows\System\rmYCZOE.exe
  2⤵
  PID:3676
- C:\Windows\System\nEhihIe.exe
  C:\Windows\System\nEhihIe.exe
  2⤵
  PID:3692
- C:\Windows\System\TuxSOGR.exe
  C:\Windows\System\TuxSOGR.exe
  2⤵
  PID:3708
- C:\Windows\System\GketotV.exe
  C:\Windows\System\GketotV.exe
  2⤵
  PID:3724
- C:\Windows\System\vIohfQF.exe
  C:\Windows\System\vIohfQF.exe
  2⤵
  PID:3740
- C:\Windows\System\TcFaPrw.exe
  C:\Windows\System\TcFaPrw.exe
  2⤵
  PID:3760
- C:\Windows\System\HEUlril.exe
  C:\Windows\System\HEUlril.exe
  2⤵
  PID:3776
- C:\Windows\System\UykrqmN.exe
  C:\Windows\System\UykrqmN.exe
  2⤵
  PID:3796
- C:\Windows\System\XUKmRBe.exe
  C:\Windows\System\XUKmRBe.exe
  2⤵
  PID:3816
- C:\Windows\System\ElZedMA.exe
  C:\Windows\System\ElZedMA.exe
  2⤵
  PID:3836
- C:\Windows\System\yKWRAtN.exe
  C:\Windows\System\yKWRAtN.exe
  2⤵
  PID:3852
- C:\Windows\System\GlXKfih.exe
  C:\Windows\System\GlXKfih.exe
  2⤵
  PID:3868
- C:\Windows\System\ujrtmCV.exe
  C:\Windows\System\ujrtmCV.exe
  2⤵
  PID:3892
- C:\Windows\System\OuJQoMz.exe
  C:\Windows\System\OuJQoMz.exe
  2⤵
  PID:3912
- C:\Windows\System\RferQSK.exe
  C:\Windows\System\RferQSK.exe
  2⤵
  PID:3928
- C:\Windows\System\hwjUetz.exe
  C:\Windows\System\hwjUetz.exe
  2⤵
  PID:3948
- C:\Windows\System\ALEBiOg.exe
  C:\Windows\System\ALEBiOg.exe
  2⤵
  PID:3968
- C:\Windows\System\MpUBJkE.exe
  C:\Windows\System\MpUBJkE.exe
  2⤵
  PID:3996
- C:\Windows\System\xPeKxaA.exe
  C:\Windows\System\xPeKxaA.exe
  2⤵
  PID:4048
- C:\Windows\System\ZmvuDTc.exe
  C:\Windows\System\ZmvuDTc.exe
  2⤵
  PID:4064
- C:\Windows\System\YTveVbC.exe
  C:\Windows\System\YTveVbC.exe
  2⤵
  PID:4080
- C:\Windows\System\kNkbAQk.exe
  C:\Windows\System\kNkbAQk.exe
  2⤵
  PID:2396
- C:\Windows\System\hJVFdjM.exe
  C:\Windows\System\hJVFdjM.exe
  2⤵
  PID:2432
- C:\Windows\System\psCdnRU.exe
  C:\Windows\System\psCdnRU.exe
  2⤵
  PID:3148
- C:\Windows\System\lAjWRjc.exe
  C:\Windows\System\lAjWRjc.exe
  2⤵
  PID:3092
- C:\Windows\System\xEmePDj.exe
  C:\Windows\System\xEmePDj.exe
  2⤵
  PID:1808
- C:\Windows\System\nCKacNp.exe
  C:\Windows\System\nCKacNp.exe
  2⤵
  PID:3164
- C:\Windows\System\TUkfiYl.exe
  C:\Windows\System\TUkfiYl.exe
  2⤵
  PID:1032
- C:\Windows\System\baGAKxV.exe
  C:\Windows\System\baGAKxV.exe
  2⤵
  PID:3280
- C:\Windows\System\TMAgqUJ.exe
  C:\Windows\System\TMAgqUJ.exe
  2⤵
  PID:3316
- C:\Windows\System\xoHVjMR.exe
  C:\Windows\System\xoHVjMR.exe
  2⤵
  PID:3360
- C:\Windows\System\AchzjMs.exe
  C:\Windows\System\AchzjMs.exe
  2⤵
  PID:3408
- C:\Windows\System\XzEfAbr.exe
  C:\Windows\System\XzEfAbr.exe
  2⤵
  PID:3236
- C:\Windows\System\ItouMnp.exe
  C:\Windows\System\ItouMnp.exe
  2⤵
  PID:3376
- C:\Windows\System\rHrULcb.exe
  C:\Windows\System\rHrULcb.exe
  2⤵
  PID:3528
- C:\Windows\System\DyzRDIs.exe
  C:\Windows\System\DyzRDIs.exe
  2⤵
  PID:3508
- C:\Windows\System\fQhvjSq.exe
  C:\Windows\System\fQhvjSq.exe
  2⤵
  PID:3464
- C:\Windows\System\aPcQetN.exe
  C:\Windows\System\aPcQetN.exe
  2⤵
  PID:3544
- C:\Windows\System\IrUWKRr.exe
  C:\Windows\System\IrUWKRr.exe
  2⤵
  PID:3596
- C:\Windows\System\uoNlzJF.exe
  C:\Windows\System\uoNlzJF.exe
  2⤵
  PID:3616
- C:\Windows\System\nmyYiTx.exe
  C:\Windows\System\nmyYiTx.exe
  2⤵
  PID:3636
- C:\Windows\System\lfBBLuj.exe
  C:\Windows\System\lfBBLuj.exe
  2⤵
  PID:3732
- C:\Windows\System\GcPOXUg.exe
  C:\Windows\System\GcPOXUg.exe
  2⤵
  PID:3812
- C:\Windows\System\tQgvvlI.exe
  C:\Windows\System\tQgvvlI.exe
  2⤵
  PID:3888
- C:\Windows\System\GmIkIIY.exe
  C:\Windows\System\GmIkIIY.exe
  2⤵
  PID:3960
- C:\Windows\System\JyAzUEP.exe
  C:\Windows\System\JyAzUEP.exe
  2⤵
  PID:3716
- C:\Windows\System\fMDAfeg.exe
  C:\Windows\System\fMDAfeg.exe
  2⤵
  PID:3756
- C:\Windows\System\uTELEyO.exe
  C:\Windows\System\uTELEyO.exe
  2⤵
  PID:3824
- C:\Windows\System\TJyBOnp.exe
  C:\Windows\System\TJyBOnp.exe
  2⤵
  PID:3864
- C:\Windows\System\DhAEorw.exe
  C:\Windows\System\DhAEorw.exe
  2⤵
  PID:3944
- C:\Windows\System\TYmiboh.exe
  C:\Windows\System\TYmiboh.exe
  2⤵
  PID:3988
- C:\Windows\System\SJTnEpm.exe
  C:\Windows\System\SJTnEpm.exe
  2⤵
  PID:4016
- C:\Windows\System\CEXABwC.exe
  C:\Windows\System\CEXABwC.exe
  2⤵
  PID:4040
- C:\Windows\System\VmNJcJM.exe
  C:\Windows\System\VmNJcJM.exe
  2⤵
  PID:4076
- C:\Windows\System\GQjKXDc.exe
  C:\Windows\System\GQjKXDc.exe
  2⤵
  PID:2444
- C:\Windows\System\ENpJTZO.exe
  C:\Windows\System\ENpJTZO.exe
  2⤵
  PID:3208
- C:\Windows\System\OMcivpX.exe
  C:\Windows\System\OMcivpX.exe
  2⤵
  PID:3268
- C:\Windows\System\RXPobjF.exe
  C:\Windows\System\RXPobjF.exe
  2⤵
  PID:2988
- C:\Windows\System\ePzEUAs.exe
  C:\Windows\System\ePzEUAs.exe
  2⤵
  PID:3356
- C:\Windows\System\ySQzYTT.exe
  C:\Windows\System\ySQzYTT.exe
  2⤵
  PID:3484
- C:\Windows\System\adihNcQ.exe
  C:\Windows\System\adihNcQ.exe
  2⤵
  PID:3400
- C:\Windows\System\QjWZKpb.exe
  C:\Windows\System\QjWZKpb.exe
  2⤵
  PID:3340
- C:\Windows\System\uCmJMLq.exe
  C:\Windows\System\uCmJMLq.exe
  2⤵
  PID:3388
- C:\Windows\System\ubkIfuM.exe
  C:\Windows\System\ubkIfuM.exe
  2⤵
  PID:3572
- C:\Windows\System\OAVVUhL.exe
  C:\Windows\System\OAVVUhL.exe
  2⤵
  PID:3460
- C:\Windows\System\PvLfLwV.exe
  C:\Windows\System\PvLfLwV.exe
  2⤵
  PID:3612
- C:\Windows\System\FzwVzKJ.exe
  C:\Windows\System\FzwVzKJ.exe
  2⤵
  PID:3848
- C:\Windows\System\NvLnMYl.exe
  C:\Windows\System\NvLnMYl.exe
  2⤵
  PID:3924
- C:\Windows\System\QUxitQj.exe
  C:\Windows\System\QUxitQj.exe
  2⤵
  PID:3748
- C:\Windows\System\BMvEmgz.exe
  C:\Windows\System\BMvEmgz.exe
  2⤵
  PID:3980
- C:\Windows\System\kVnXZec.exe
  C:\Windows\System\kVnXZec.exe
  2⤵
  PID:3656
- C:\Windows\System\MNTrpvq.exe
  C:\Windows\System\MNTrpvq.exe
  2⤵
  PID:4004
- C:\Windows\System\PRoImSO.exe
  C:\Windows\System\PRoImSO.exe
  2⤵
  PID:3792
- C:\Windows\System\QzzgjIm.exe
  C:\Windows\System\QzzgjIm.exe
  2⤵
  PID:3112
- C:\Windows\System\oyPnfVW.exe
  C:\Windows\System\oyPnfVW.exe
  2⤵
  PID:3096
- C:\Windows\System\RKYYZQh.exe
  C:\Windows\System\RKYYZQh.exe
  2⤵
  PID:3228
- C:\Windows\System\JKcIACY.exe
  C:\Windows\System\JKcIACY.exe
  2⤵
  PID:3160
- C:\Windows\System\KDAsLDD.exe
  C:\Windows\System\KDAsLDD.exe
  2⤵
  PID:3560
- C:\Windows\System\SXiisAW.exe
  C:\Windows\System\SXiisAW.exe
  2⤵
  PID:3632
- C:\Windows\System\wKQnIdP.exe
  C:\Windows\System\wKQnIdP.exe
  2⤵
  PID:3884
- C:\Windows\System\ACzHlie.exe
  C:\Windows\System\ACzHlie.exe
  2⤵
  PID:3908
- C:\Windows\System\ufhuwCC.exe
  C:\Windows\System\ufhuwCC.exe
  2⤵
  PID:3704
- C:\Windows\System\RscyAVv.exe
  C:\Windows\System\RscyAVv.exe
  2⤵
  PID:4012
- C:\Windows\System\FwrkFgz.exe
  C:\Windows\System\FwrkFgz.exe
  2⤵
  PID:3428
- C:\Windows\System\PcjZmzT.exe
  C:\Windows\System\PcjZmzT.exe
  2⤵
  PID:3288
- C:\Windows\System\rTxkBxz.exe
  C:\Windows\System\rTxkBxz.exe
  2⤵
  PID:3476
- C:\Windows\System\MBDuWZy.exe
  C:\Windows\System\MBDuWZy.exe
  2⤵
  PID:3500
- C:\Windows\System\FPIGHpY.exe
  C:\Windows\System\FPIGHpY.exe
  2⤵
  PID:896
- C:\Windows\System\isAjgdz.exe
  C:\Windows\System\isAjgdz.exe
  2⤵
  PID:3556
- C:\Windows\System\dkljTPw.exe
  C:\Windows\System\dkljTPw.exe
  2⤵
  PID:3628
- C:\Windows\System\wKYljPc.exe
  C:\Windows\System\wKYljPc.exe
  2⤵
  PID:4108
- C:\Windows\System\chFhXtq.exe
  C:\Windows\System\chFhXtq.exe
  2⤵
  PID:4128
- C:\Windows\System\BbcCESh.exe
  C:\Windows\System\BbcCESh.exe
  2⤵
  PID:4184
- C:\Windows\System\gaCVrTo.exe
  C:\Windows\System\gaCVrTo.exe
  2⤵
  PID:4200
- C:\Windows\System\WGiCFeX.exe
  C:\Windows\System\WGiCFeX.exe
  2⤵
  PID:4216
- C:\Windows\System\aofwbpY.exe
  C:\Windows\System\aofwbpY.exe
  2⤵
  PID:4236
- C:\Windows\System\RujxfyR.exe
  C:\Windows\System\RujxfyR.exe
  2⤵
  PID:4260
- C:\Windows\System\qAuVkQp.exe
  C:\Windows\System\qAuVkQp.exe
  2⤵
  PID:4280
- C:\Windows\System\VLJzSHS.exe
  C:\Windows\System\VLJzSHS.exe
  2⤵
  PID:4296
- C:\Windows\System\UZgcOJk.exe
  C:\Windows\System\UZgcOJk.exe
  2⤵
  PID:4316
- C:\Windows\System\OlHyFYa.exe
  C:\Windows\System\OlHyFYa.exe
  2⤵
  PID:4332
- C:\Windows\System\CACsAwC.exe
  C:\Windows\System\CACsAwC.exe
  2⤵
  PID:4352
- C:\Windows\System\vznsrnq.exe
  C:\Windows\System\vznsrnq.exe
  2⤵
  PID:4368
- C:\Windows\System\SWfcbGt.exe
  C:\Windows\System\SWfcbGt.exe
  2⤵
  PID:4384
- C:\Windows\System\Lfkeixu.exe
  C:\Windows\System\Lfkeixu.exe
  2⤵
  PID:4400
- C:\Windows\System\gmBWKBZ.exe
  C:\Windows\System\gmBWKBZ.exe
  2⤵
  PID:4416
- C:\Windows\System\OpdSYiK.exe
  C:\Windows\System\OpdSYiK.exe
  2⤵
  PID:4436
- C:\Windows\System\jnLnRyr.exe
  C:\Windows\System\jnLnRyr.exe
  2⤵
  PID:4452
- C:\Windows\System\xIsnAUP.exe
  C:\Windows\System\xIsnAUP.exe
  2⤵
  PID:4468
- C:\Windows\System\BWiLgHv.exe
  C:\Windows\System\BWiLgHv.exe
  2⤵
  PID:4488
- C:\Windows\System\PWdWgTf.exe
  C:\Windows\System\PWdWgTf.exe
  2⤵
  PID:4508
- C:\Windows\System\sSfPBgs.exe
  C:\Windows\System\sSfPBgs.exe
  2⤵
  PID:4528
- C:\Windows\System\TKHZPyx.exe
  C:\Windows\System\TKHZPyx.exe
  2⤵
  PID:4568
- C:\Windows\System\GnhGCtf.exe
  C:\Windows\System\GnhGCtf.exe
  2⤵
  PID:4592
- C:\Windows\System\OweVTnT.exe
  C:\Windows\System\OweVTnT.exe
  2⤵
  PID:4616
- C:\Windows\System\wTXNFPK.exe
  C:\Windows\System\wTXNFPK.exe
  2⤵
  PID:4640
- C:\Windows\System\AfgFqWq.exe
  C:\Windows\System\AfgFqWq.exe
  2⤵
  PID:4660
- C:\Windows\System\DIrLsQh.exe
  C:\Windows\System\DIrLsQh.exe
  2⤵
  PID:4680
- C:\Windows\System\OINDSDn.exe
  C:\Windows\System\OINDSDn.exe
  2⤵
  PID:4700
- C:\Windows\System\lvJhRpu.exe
  C:\Windows\System\lvJhRpu.exe
  2⤵
  PID:4720
- C:\Windows\System\EwwPkEE.exe
  C:\Windows\System\EwwPkEE.exe
  2⤵
  PID:4736
- C:\Windows\System\ZJFsvXI.exe
  C:\Windows\System\ZJFsvXI.exe
  2⤵
  PID:4752
- C:\Windows\System\hIVcGct.exe
  C:\Windows\System\hIVcGct.exe
  2⤵
  PID:4772
- C:\Windows\System\CoDYWzC.exe
  C:\Windows\System\CoDYWzC.exe
  2⤵
  PID:4796
- C:\Windows\System\ohrfJtk.exe
  C:\Windows\System\ohrfJtk.exe
  2⤵
  PID:4836
- C:\Windows\System\RsrZAjj.exe
  C:\Windows\System\RsrZAjj.exe
  2⤵
  PID:4852
- C:\Windows\System\HjiludD.exe
  C:\Windows\System\HjiludD.exe
  2⤵
  PID:4872
- C:\Windows\System\uzCTOxi.exe
  C:\Windows\System\uzCTOxi.exe
  2⤵
  PID:4892
- C:\Windows\System\kVeiPaY.exe
  C:\Windows\System\kVeiPaY.exe
  2⤵
  PID:4912
- C:\Windows\System\behOBap.exe
  C:\Windows\System\behOBap.exe
  2⤵
  PID:4936
- C:\Windows\System\MCNzDRL.exe
  C:\Windows\System\MCNzDRL.exe
  2⤵
  PID:4956
- C:\Windows\System\jSbzxKa.exe
  C:\Windows\System\jSbzxKa.exe
  2⤵
  PID:4972
- C:\Windows\System\iLMuDgw.exe
  C:\Windows\System\iLMuDgw.exe
  2⤵
  PID:4988
- C:\Windows\System\LPyinFS.exe
  C:\Windows\System\LPyinFS.exe
  2⤵
  PID:5012
- C:\Windows\System\AezNYNR.exe
  C:\Windows\System\AezNYNR.exe
  2⤵
  PID:5032
- C:\Windows\System\EKkyeDT.exe
  C:\Windows\System\EKkyeDT.exe
  2⤵
  PID:5052
- C:\Windows\System\lPOqvkk.exe
  C:\Windows\System\lPOqvkk.exe
  2⤵
  PID:5068
- C:\Windows\System\Odtsrmm.exe
  C:\Windows\System\Odtsrmm.exe
  2⤵
  PID:5088
- C:\Windows\System\FpFJAGi.exe
  C:\Windows\System\FpFJAGi.exe
  2⤵
  PID:5104
- C:\Windows\System\CalSEdv.exe
  C:\Windows\System\CalSEdv.exe
  2⤵
  PID:3832
- C:\Windows\System\gzHTyOe.exe
  C:\Windows\System\gzHTyOe.exe
  2⤵
  PID:4036
- C:\Windows\System\OzgzkXj.exe
  C:\Windows\System\OzgzkXj.exe
  2⤵
  PID:3108
- C:\Windows\System\uUmWuQQ.exe
  C:\Windows\System\uUmWuQQ.exe
  2⤵
  PID:3940
- C:\Windows\System\JuwBjCX.exe
  C:\Windows\System\JuwBjCX.exe
  2⤵
  PID:4120
- C:\Windows\System\niOaewx.exe
  C:\Windows\System\niOaewx.exe
  2⤵
  PID:3804
- C:\Windows\System\DdyYJxm.exe
  C:\Windows\System\DdyYJxm.exe
  2⤵
  PID:4104
- C:\Windows\System\ZAHoWXw.exe
  C:\Windows\System\ZAHoWXw.exe
  2⤵
  PID:4144
- C:\Windows\System\dezCcgQ.exe
  C:\Windows\System\dezCcgQ.exe
  2⤵
  PID:4168
- C:\Windows\System\HYxbKfd.exe
  C:\Windows\System\HYxbKfd.exe
  2⤵
  PID:4180
- C:\Windows\System\cHArVOe.exe
  C:\Windows\System\cHArVOe.exe
  2⤵
  PID:4272
- C:\Windows\System\pxpffZu.exe
  C:\Windows\System\pxpffZu.exe
  2⤵
  PID:4308
- C:\Windows\System\jkXeicY.exe
  C:\Windows\System\jkXeicY.exe
  2⤵
  PID:4328
- C:\Windows\System\hIVpkRl.exe
  C:\Windows\System\hIVpkRl.exe
  2⤵
  PID:4360
- C:\Windows\System\ArJRoay.exe
  C:\Windows\System\ArJRoay.exe
  2⤵
  PID:4432
- C:\Windows\System\OMXmNyG.exe
  C:\Windows\System\OMXmNyG.exe
  2⤵
  PID:4484
- C:\Windows\System\gtJgpMc.exe
  C:\Windows\System\gtJgpMc.exe
  2⤵
  PID:4480
- C:\Windows\System\cqbERKY.exe
  C:\Windows\System\cqbERKY.exe
  2⤵
  PID:4380
- C:\Windows\System\SuhdCVf.exe
  C:\Windows\System\SuhdCVf.exe
  2⤵
  PID:4544
- C:\Windows\System\HNrADHX.exe
  C:\Windows\System\HNrADHX.exe
  2⤵
  PID:4560
- C:\Windows\System\VRJwhGQ.exe
  C:\Windows\System\VRJwhGQ.exe
  2⤵
  PID:4588
- C:\Windows\System\DaqYvmF.exe
  C:\Windows\System\DaqYvmF.exe
  2⤵
  PID:4648
- C:\Windows\System\KbgQdfx.exe
  C:\Windows\System\KbgQdfx.exe
  2⤵
  PID:4632
- C:\Windows\System\cZcwrTJ.exe
  C:\Windows\System\cZcwrTJ.exe
  2⤵
  PID:4732
- C:\Windows\System\bdggpUr.exe
  C:\Windows\System\bdggpUr.exe
  2⤵
  PID:4716
- C:\Windows\System\elyrSeS.exe
  C:\Windows\System\elyrSeS.exe
  2⤵
  PID:4808
- C:\Windows\System\nsfXdrz.exe
  C:\Windows\System\nsfXdrz.exe
  2⤵
  PID:4780
- C:\Windows\System\UUeOIjc.exe
  C:\Windows\System\UUeOIjc.exe
  2⤵
  PID:4824
- C:\Windows\System\mdGzKfS.exe
  C:\Windows\System\mdGzKfS.exe
  2⤵
  PID:4848
- C:\Windows\System\DUJBWYd.exe
  C:\Windows\System\DUJBWYd.exe
  2⤵
  PID:4880
- C:\Windows\System\SOwJuGc.exe
  C:\Windows\System\SOwJuGc.exe
  2⤵
  PID:4920
- C:\Windows\System\KFrNNsZ.exe
  C:\Windows\System\KFrNNsZ.exe
  2⤵
  PID:4964
- C:\Windows\System\zlmxEhj.exe
  C:\Windows\System\zlmxEhj.exe
  2⤵
  PID:5000
- C:\Windows\System\tculOkx.exe
  C:\Windows\System\tculOkx.exe
  2⤵
  PID:5028
- C:\Windows\System\WBqRTqT.exe
  C:\Windows\System\WBqRTqT.exe
  2⤵
  PID:5064
- C:\Windows\System\Sxmddif.exe
  C:\Windows\System\Sxmddif.exe
  2⤵
  PID:3448
- C:\Windows\System\CKnrQzJ.exe
  C:\Windows\System\CKnrQzJ.exe
  2⤵
  PID:5112
- C:\Windows\System\wIYjjoM.exe
  C:\Windows\System\wIYjjoM.exe
  2⤵
  PID:4140
- C:\Windows\System\EVdYBqP.exe
  C:\Windows\System\EVdYBqP.exe
  2⤵
  PID:4100
- C:\Windows\System\vjULSiY.exe
  C:\Windows\System\vjULSiY.exe
  2⤵
  PID:4256
- C:\Windows\System\EKGQijP.exe
  C:\Windows\System\EKGQijP.exe
  2⤵
  PID:3672
- C:\Windows\System\mYeIRUF.exe
  C:\Windows\System\mYeIRUF.exe
  2⤵
  PID:4268
- C:\Windows\System\FxfsfTC.exe
  C:\Windows\System\FxfsfTC.exe
  2⤵
  PID:4244
- C:\Windows\System\hYLBBpY.exe
  C:\Windows\System\hYLBBpY.exe
  2⤵
  PID:4348
- C:\Windows\System\mjXUZYF.exe
  C:\Windows\System\mjXUZYF.exe
  2⤵
  PID:4500
- C:\Windows\System\llRqulG.exe
  C:\Windows\System\llRqulG.exe
  2⤵
  PID:4408
- C:\Windows\System\jHaggoW.exe
  C:\Windows\System\jHaggoW.exe
  2⤵
  PID:4344
- C:\Windows\System\JfVTPwx.exe
  C:\Windows\System\JfVTPwx.exe
  2⤵
  PID:4564
- C:\Windows\System\iHlxswT.exe
  C:\Windows\System\iHlxswT.exe
  2⤵
  PID:4628
- C:\Windows\System\LrpIjyH.exe
  C:\Windows\System\LrpIjyH.exe
  2⤵
  PID:4688
- C:\Windows\System\zLwQRWd.exe
  C:\Windows\System\zLwQRWd.exe
  2⤵
  PID:4676
- C:\Windows\System\ysxSZMV.exe
  C:\Windows\System\ysxSZMV.exe
  2⤵
  PID:4816
- C:\Windows\System\TJBkMcD.exe
  C:\Windows\System\TJBkMcD.exe
  2⤵
  PID:4864
- C:\Windows\System\FnXkXKj.exe
  C:\Windows\System\FnXkXKj.exe
  2⤵
  PID:4948
- C:\Windows\System\NxjugDv.exe
  C:\Windows\System\NxjugDv.exe
  2⤵
  PID:4844
- C:\Windows\System\bvHjqFO.exe
  C:\Windows\System\bvHjqFO.exe
  2⤵
  PID:4984
- C:\Windows\System\fKPjuuF.exe
  C:\Windows\System\fKPjuuF.exe
  2⤵
  PID:3276
- C:\Windows\System\wvUxOYS.exe
  C:\Windows\System\wvUxOYS.exe
  2⤵
  PID:4228
- C:\Windows\System\tnvzaqw.exe
  C:\Windows\System\tnvzaqw.exe
  2⤵
  PID:4092
- C:\Windows\System\GXpgHKH.exe
  C:\Windows\System\GXpgHKH.exe
  2⤵
  PID:5044
- C:\Windows\System\oMKwSgP.exe
  C:\Windows\System\oMKwSgP.exe
  2⤵
  PID:4288
- C:\Windows\System\tEzSJJI.exe
  C:\Windows\System\tEzSJJI.exe
  2⤵
  PID:3936
- C:\Windows\System\rSyNznI.exe
  C:\Windows\System\rSyNznI.exe
  2⤵
  PID:4208
- C:\Windows\System\rRANsCC.exe
  C:\Windows\System\rRANsCC.exe
  2⤵
  PID:4460
- C:\Windows\System\iPBCTzj.exe
  C:\Windows\System\iPBCTzj.exe
  2⤵
  PID:4604
- C:\Windows\System\ICARmKI.exe
  C:\Windows\System\ICARmKI.exe
  2⤵
  PID:4608
- C:\Windows\System\vISJhmX.exe
  C:\Windows\System\vISJhmX.exe
  2⤵
  PID:4944
- C:\Windows\System\QNunTmH.exe
  C:\Windows\System\QNunTmH.exe
  2⤵
  PID:4900
- C:\Windows\System\BEJeuTi.exe
  C:\Windows\System\BEJeuTi.exe
  2⤵
  PID:4760
- C:\Windows\System\QRcyvQW.exe
  C:\Windows\System\QRcyvQW.exe
  2⤵
  PID:4868
- C:\Windows\System\GzffCXn.exe
  C:\Windows\System\GzffCXn.exe
  2⤵
  PID:4152
- C:\Windows\System\VmfGyCO.exe
  C:\Windows\System\VmfGyCO.exe
  2⤵
  PID:5048
- C:\Windows\System\fNNmgxz.exe
  C:\Windows\System\fNNmgxz.exe
  2⤵
  PID:5116
- C:\Windows\System\wScsULe.exe
  C:\Windows\System\wScsULe.exe
  2⤵
  PID:5076
- C:\Windows\System\olNefnk.exe
  C:\Windows\System\olNefnk.exe
  2⤵
  PID:4624
- C:\Windows\System\pVzOsAo.exe
  C:\Windows\System\pVzOsAo.exe
  2⤵
  PID:4392
- C:\Windows\System\cwPxTUz.exe
  C:\Windows\System\cwPxTUz.exe
  2⤵
  PID:4656
- C:\Windows\System\oxNQQvv.exe
  C:\Windows\System\oxNQQvv.exe
  2⤵
  PID:4536
- C:\Windows\System\BzUIZjy.exe
  C:\Windows\System\BzUIZjy.exe
  2⤵
  PID:5024
- C:\Windows\System\sZwexIx.exe
  C:\Windows\System\sZwexIx.exe
  2⤵
  PID:5060
- C:\Windows\System\XqpAbRk.exe
  C:\Windows\System\XqpAbRk.exe
  2⤵
  PID:4136
- C:\Windows\System\TEMUhbf.exe
  C:\Windows\System\TEMUhbf.exe
  2⤵
  PID:4448
- C:\Windows\System\kUxfIEW.exe
  C:\Windows\System\kUxfIEW.exe
  2⤵
  PID:4820
- C:\Windows\System\dctIqmV.exe
  C:\Windows\System\dctIqmV.exe
  2⤵
  PID:4812
- C:\Windows\System\AMivKbb.exe
  C:\Windows\System\AMivKbb.exe
  2⤵
  PID:4520
- C:\Windows\System\vJodrVm.exe
  C:\Windows\System\vJodrVm.exe
  2⤵
  PID:3324
- C:\Windows\System\tqBwiNA.exe
  C:\Windows\System\tqBwiNA.exe
  2⤵
  PID:4412
- C:\Windows\System\UVVJXfv.exe
  C:\Windows\System\UVVJXfv.exe
  2⤵
  PID:5124
- C:\Windows\System\tsoRtde.exe
  C:\Windows\System\tsoRtde.exe
  2⤵
  PID:5140
- C:\Windows\System\Parotpt.exe
  C:\Windows\System\Parotpt.exe
  2⤵
  PID:5160
- C:\Windows\System\oFFqMej.exe
  C:\Windows\System\oFFqMej.exe
  2⤵
  PID:5176
- C:\Windows\System\bNYeGNr.exe
  C:\Windows\System\bNYeGNr.exe
  2⤵
  PID:5192
- C:\Windows\System\nfPpvPC.exe
  C:\Windows\System\nfPpvPC.exe
  2⤵
  PID:5236
- C:\Windows\System\hqqZmql.exe
  C:\Windows\System\hqqZmql.exe
  2⤵
  PID:5252
- C:\Windows\System\aunsaho.exe
  C:\Windows\System\aunsaho.exe
  2⤵
  PID:5268
- C:\Windows\System\CGQbgrL.exe
  C:\Windows\System\CGQbgrL.exe
  2⤵
  PID:5288
- C:\Windows\System\yYwfsKK.exe
  C:\Windows\System\yYwfsKK.exe
  2⤵
  PID:5308
- C:\Windows\System\OuBHLcr.exe
  C:\Windows\System\OuBHLcr.exe
  2⤵
  PID:5324
- C:\Windows\System\fxqLFSD.exe
  C:\Windows\System\fxqLFSD.exe
  2⤵
  PID:5340
- C:\Windows\System\cwAAPPp.exe
  C:\Windows\System\cwAAPPp.exe
  2⤵
  PID:5360
- C:\Windows\System\qBNCSuW.exe
  C:\Windows\System\qBNCSuW.exe
  2⤵
  PID:5380
- C:\Windows\System\RykFNLD.exe
  C:\Windows\System\RykFNLD.exe
  2⤵
  PID:5408
- C:\Windows\System\dXOUANR.exe
  C:\Windows\System\dXOUANR.exe
  2⤵
  PID:5436
- C:\Windows\System\MQgJsUx.exe
  C:\Windows\System\MQgJsUx.exe
  2⤵
  PID:5460
- C:\Windows\System\wIJMEJb.exe
  C:\Windows\System\wIJMEJb.exe
  2⤵
  PID:5476
- C:\Windows\System\FXjXbyg.exe
  C:\Windows\System\FXjXbyg.exe
  2⤵
  PID:5496
- C:\Windows\System\RodRljC.exe
  C:\Windows\System\RodRljC.exe
  2⤵
  PID:5516
- C:\Windows\System\qcgtJIu.exe
  C:\Windows\System\qcgtJIu.exe
  2⤵
  PID:5532
- C:\Windows\System\wqiXAII.exe
  C:\Windows\System\wqiXAII.exe
  2⤵
  PID:5552
- C:\Windows\System\pVRFJMS.exe
  C:\Windows\System\pVRFJMS.exe
  2⤵
  PID:5580
- C:\Windows\System\sMzCKUx.exe
  C:\Windows\System\sMzCKUx.exe
  2⤵
  PID:5596
- C:\Windows\System\CwvNPBB.exe
  C:\Windows\System\CwvNPBB.exe
  2⤵
  PID:5612
- C:\Windows\System\QyfwDAi.exe
  C:\Windows\System\QyfwDAi.exe
  2⤵
  PID:5632
- C:\Windows\System\fAdQovh.exe
  C:\Windows\System\fAdQovh.exe
  2⤵
  PID:5648
- C:\Windows\System\NgYKQMo.exe
  C:\Windows\System\NgYKQMo.exe
  2⤵
  PID:5668
- C:\Windows\System\IwxMAKS.exe
  C:\Windows\System\IwxMAKS.exe
  2⤵
  PID:5684
- C:\Windows\System\UeLRgnI.exe
  C:\Windows\System\UeLRgnI.exe
  2⤵
  PID:5704
- C:\Windows\System\wtHnIEL.exe
  C:\Windows\System\wtHnIEL.exe
  2⤵
  PID:5724
- C:\Windows\System\lMITzpO.exe
  C:\Windows\System\lMITzpO.exe
  2⤵
  PID:5740
- C:\Windows\System\HqrMfZE.exe
  C:\Windows\System\HqrMfZE.exe
  2⤵
  PID:5756
- C:\Windows\System\epbkNYK.exe
  C:\Windows\System\epbkNYK.exe
  2⤵
  PID:5776
- C:\Windows\System\jGlslUz.exe
  C:\Windows\System\jGlslUz.exe
  2⤵
  PID:5796
- C:\Windows\System\pKGDtwP.exe
  C:\Windows\System\pKGDtwP.exe
  2⤵
  PID:5812
- C:\Windows\System\zIsZjKX.exe
  C:\Windows\System\zIsZjKX.exe
  2⤵
  PID:5828
- C:\Windows\System\mNWhQFf.exe
  C:\Windows\System\mNWhQFf.exe
  2⤵
  PID:5848
- C:\Windows\System\tGMboUF.exe
  C:\Windows\System\tGMboUF.exe
  2⤵
  PID:5864
- C:\Windows\System\fEXzwBX.exe
  C:\Windows\System\fEXzwBX.exe
  2⤵
  PID:5888
- C:\Windows\System\Wgaxaje.exe
  C:\Windows\System\Wgaxaje.exe
  2⤵
  PID:5916
- C:\Windows\System\VEpjTfc.exe
  C:\Windows\System\VEpjTfc.exe
  2⤵
  PID:5936
- C:\Windows\System\JHWGgiS.exe
  C:\Windows\System\JHWGgiS.exe
  2⤵
  PID:5976
- C:\Windows\System\hQiicyq.exe
  C:\Windows\System\hQiicyq.exe
  2⤵
  PID:5992
- C:\Windows\System\pStVaab.exe
  C:\Windows\System\pStVaab.exe
  2⤵
  PID:6012
- C:\Windows\System\nLwfjYZ.exe
  C:\Windows\System\nLwfjYZ.exe
  2⤵
  PID:6032
- C:\Windows\System\gFmUBfU.exe
  C:\Windows\System\gFmUBfU.exe
  2⤵
  PID:6052
- C:\Windows\System\NdfnffO.exe
  C:\Windows\System\NdfnffO.exe
  2⤵
  PID:6072
- C:\Windows\System\iFZLxNb.exe
  C:\Windows\System\iFZLxNb.exe
  2⤵
  PID:6096
- C:\Windows\System\HkAycIL.exe
  C:\Windows\System\HkAycIL.exe
  2⤵
  PID:6112
- C:\Windows\System\duNQxHH.exe
  C:\Windows\System\duNQxHH.exe
  2⤵
  PID:6128
- C:\Windows\System\OtjgMBK.exe
  C:\Windows\System\OtjgMBK.exe
  2⤵
  PID:5156
- C:\Windows\System\zdcWzVv.exe
  C:\Windows\System\zdcWzVv.exe
  2⤵
  PID:4908
- C:\Windows\System\bNlTgUm.exe
  C:\Windows\System\bNlTgUm.exe
  2⤵
  PID:4224
- C:\Windows\System\hBEMZwE.exe
  C:\Windows\System\hBEMZwE.exe
  2⤵
  PID:4496
- C:\Windows\System\eHrMHJE.exe
  C:\Windows\System\eHrMHJE.exe
  2⤵
  PID:5244
- C:\Windows\System\HLzSIzi.exe
  C:\Windows\System\HLzSIzi.exe
  2⤵
  PID:5316
- C:\Windows\System\wfBNnQG.exe
  C:\Windows\System\wfBNnQG.exe
  2⤵
  PID:5172
- C:\Windows\System\ffbcDoG.exe
  C:\Windows\System\ffbcDoG.exe
  2⤵
  PID:5304
- C:\Windows\System\TQDhVTo.exe
  C:\Windows\System\TQDhVTo.exe
  2⤵
  PID:5336
- C:\Windows\System\fyGhKyo.exe
  C:\Windows\System\fyGhKyo.exe
  2⤵
  PID:5264
- C:\Windows\System\PqcGuUu.exe
  C:\Windows\System\PqcGuUu.exe
  2⤵
  PID:5444
- C:\Windows\System\pleWwSl.exe
  C:\Windows\System\pleWwSl.exe
  2⤵
  PID:5448
- C:\Windows\System\HpamXco.exe
  C:\Windows\System\HpamXco.exe
  2⤵
  PID:5484
- C:\Windows\System\xYUkKjh.exe
  C:\Windows\System\xYUkKjh.exe
  2⤵
  PID:5508
- C:\Windows\System\NIXXCgs.exe
  C:\Windows\System\NIXXCgs.exe
  2⤵
  PID:5528
- C:\Windows\System\QOCcbLr.exe
  C:\Windows\System\QOCcbLr.exe
  2⤵
  PID:5604
- C:\Windows\System\hdMLtSL.exe
  C:\Windows\System\hdMLtSL.exe
  2⤵
  PID:5664
- C:\Windows\System\leXXYNn.exe
  C:\Windows\System\leXXYNn.exe
  2⤵
  PID:5628
- C:\Windows\System\YPuKrYy.exe
  C:\Windows\System\YPuKrYy.exe
  2⤵
  PID:5748
- C:\Windows\System\VnzHIKT.exe
  C:\Windows\System\VnzHIKT.exe
  2⤵
  PID:5792
- C:\Windows\System\JCCxDHe.exe
  C:\Windows\System\JCCxDHe.exe
  2⤵
  PID:5900
- C:\Windows\System\MueIFGJ.exe
  C:\Windows\System\MueIFGJ.exe
  2⤵
  PID:5768
- C:\Windows\System\MriWwmG.exe
  C:\Windows\System\MriWwmG.exe
  2⤵
  PID:5844
- C:\Windows\System\vGqDLEc.exe
  C:\Windows\System\vGqDLEc.exe
  2⤵
  PID:5772
- C:\Windows\System\xUJvFqO.exe
  C:\Windows\System\xUJvFqO.exe
  2⤵
  PID:5732
- C:\Windows\System\oOldeCJ.exe
  C:\Windows\System\oOldeCJ.exe
  2⤵
  PID:5932
- C:\Windows\System\xGUguCb.exe
  C:\Windows\System\xGUguCb.exe
  2⤵
  PID:5952
- C:\Windows\System\EEYFrop.exe
  C:\Windows\System\EEYFrop.exe
  2⤵
  PID:6000
- C:\Windows\System\NFmNMCB.exe
  C:\Windows\System\NFmNMCB.exe
  2⤵
  PID:6040
- C:\Windows\System\JHBhEbC.exe
  C:\Windows\System\JHBhEbC.exe
  2⤵
  PID:6020
- C:\Windows\System\azvdXaQ.exe
  C:\Windows\System\azvdXaQ.exe
  2⤵
  PID:6088
- C:\Windows\System\gYFMrZX.exe
  C:\Windows\System\gYFMrZX.exe
  2⤵
  PID:6120
- C:\Windows\System\QJAwROC.exe
  C:\Windows\System\QJAwROC.exe
  2⤵
  PID:3512
- C:\Windows\System\eYFZNuO.exe
  C:\Windows\System\eYFZNuO.exe
  2⤵
  PID:5184
- C:\Windows\System\nCftaof.exe
  C:\Windows\System\nCftaof.exe
  2⤵
  PID:5136
- C:\Windows\System\HOwOkub.exe
  C:\Windows\System\HOwOkub.exe
  2⤵
  PID:5356
- C:\Windows\System\rWkQoKp.exe
  C:\Windows\System\rWkQoKp.exe
  2⤵
  PID:5132
- C:\Windows\System\XYHathl.exe
  C:\Windows\System\XYHathl.exe
  2⤵
  PID:5492
- C:\Windows\System\cJtHGWX.exe
  C:\Windows\System\cJtHGWX.exe
  2⤵
  PID:5404
- C:\Windows\System\TfCYnUo.exe
  C:\Windows\System\TfCYnUo.exe
  2⤵
  PID:5400
- C:\Windows\System\krlgODO.exe
  C:\Windows\System\krlgODO.exe
  2⤵
  PID:5456
- C:\Windows\System\xtnbQeQ.exe
  C:\Windows\System\xtnbQeQ.exe
  2⤵
  PID:5716
- C:\Windows\System\mIyBTCZ.exe
  C:\Windows\System\mIyBTCZ.exe
  2⤵
  PID:5592
- C:\Windows\System\uzrjZwR.exe
  C:\Windows\System\uzrjZwR.exe
  2⤵
  PID:5660
- C:\Windows\System\YvclTaf.exe
  C:\Windows\System\YvclTaf.exe
  2⤵
  PID:5856
- C:\Windows\System\oPYnLsS.exe
  C:\Windows\System\oPYnLsS.exe
  2⤵
  PID:5808
- C:\Windows\System\gZWvEQc.exe
  C:\Windows\System\gZWvEQc.exe
  2⤵
  PID:5696
- C:\Windows\System\vCthadj.exe
  C:\Windows\System\vCthadj.exe
  2⤵
  PID:6080
- C:\Windows\System\tenOqtI.exe
  C:\Windows\System\tenOqtI.exe
  2⤵
  PID:5908
- C:\Windows\System\OVyOEfo.exe
  C:\Windows\System\OVyOEfo.exe
  2⤵
  PID:6140
- C:\Windows\System\bMbiemy.exe
  C:\Windows\System\bMbiemy.exe
  2⤵
  PID:5988
- C:\Windows\System\DjItcRk.exe
  C:\Windows\System\DjItcRk.exe
  2⤵
  PID:5944
- C:\Windows\System\FWAOtqQ.exe
  C:\Windows\System\FWAOtqQ.exe
  2⤵
  PID:6084
- C:\Windows\System\CZBgLvy.exe
  C:\Windows\System\CZBgLvy.exe
  2⤵
  PID:5416
- C:\Windows\System\WZpFcCj.exe
  C:\Windows\System\WZpFcCj.exe
  2⤵
  PID:5396
- C:\Windows\System\fKiqhun.exe
  C:\Windows\System\fKiqhun.exe
  2⤵
  PID:5168
- C:\Windows\System\rNbiReN.exe
  C:\Windows\System\rNbiReN.exe
  2⤵
  PID:5720
- C:\Windows\System\JCTlloe.exe
  C:\Windows\System\JCTlloe.exe
  2⤵
  PID:5896
- C:\Windows\System\pOQWrqw.exe
  C:\Windows\System\pOQWrqw.exe
  2⤵
  PID:5972
- C:\Windows\System\OlImzLF.exe
  C:\Windows\System\OlImzLF.exe
  2⤵
  PID:6136
- C:\Windows\System\RMKlVBW.exe
  C:\Windows\System\RMKlVBW.exe
  2⤵
  PID:5692
- C:\Windows\System\ArpLLIo.exe
  C:\Windows\System\ArpLLIo.exe
  2⤵
  PID:4524
- C:\Windows\System\vyCEZex.exe
  C:\Windows\System\vyCEZex.exe
  2⤵
  PID:6068
- C:\Windows\System\TVYHRjL.exe
  C:\Windows\System\TVYHRjL.exe
  2⤵
  PID:5276
- C:\Windows\System\kbLJgzA.exe
  C:\Windows\System\kbLJgzA.exe
  2⤵
  PID:5220
- C:\Windows\System\hlZnRkk.exe
  C:\Windows\System\hlZnRkk.exe
  2⤵
  PID:5152
- C:\Windows\System\WVlUuQE.exe
  C:\Windows\System\WVlUuQE.exe
  2⤵
  PID:5840
- C:\Windows\System\kKsJzKG.exe
  C:\Windows\System\kKsJzKG.exe
  2⤵
  PID:5984
- C:\Windows\System\VbhytaQ.exe
  C:\Windows\System\VbhytaQ.exe
  2⤵
  PID:5564
- C:\Windows\System\HnrsCdY.exe
  C:\Windows\System\HnrsCdY.exe
  2⤵
  PID:5588
- C:\Windows\System\kQRbKFZ.exe
  C:\Windows\System\kQRbKFZ.exe
  2⤵
  PID:5784
- C:\Windows\System\Ulbfcdc.exe
  C:\Windows\System\Ulbfcdc.exe
  2⤵
  PID:4980
- C:\Windows\System\KOrisCO.exe
  C:\Windows\System\KOrisCO.exe
  2⤵
  PID:5392
- C:\Windows\System\jxCWixN.exe
  C:\Windows\System\jxCWixN.exe
  2⤵
  PID:5680
- C:\Windows\System\sBkzAmh.exe
  C:\Windows\System\sBkzAmh.exe
  2⤵
  PID:5824
- C:\Windows\System\CpUxiJC.exe
  C:\Windows\System\CpUxiJC.exe
  2⤵
  PID:5968
- C:\Windows\System\MxzRimq.exe
  C:\Windows\System\MxzRimq.exe
  2⤵
  PID:6008
- C:\Windows\System\WwUPvyv.exe
  C:\Windows\System\WwUPvyv.exe
  2⤵
  PID:6152
- C:\Windows\System\kIDmXln.exe
  C:\Windows\System\kIDmXln.exe
  2⤵
  PID:6168
- C:\Windows\System\OsqzXtS.exe
  C:\Windows\System\OsqzXtS.exe
  2⤵
  PID:6184
- C:\Windows\System\DOqIaCf.exe
  C:\Windows\System\DOqIaCf.exe
  2⤵
  PID:6204
- C:\Windows\System\qHANfka.exe
  C:\Windows\System\qHANfka.exe
  2⤵
  PID:6228
- C:\Windows\System\KtOCRZN.exe
  C:\Windows\System\KtOCRZN.exe
  2⤵
  PID:6252
- C:\Windows\System\hNfNNUj.exe
  C:\Windows\System\hNfNNUj.exe
  2⤵
  PID:6268
- C:\Windows\System\CCoSpqm.exe
  C:\Windows\System\CCoSpqm.exe
  2⤵
  PID:6288
- C:\Windows\System\RwmNakW.exe
  C:\Windows\System\RwmNakW.exe
  2⤵
  PID:6316
- C:\Windows\System\JefXFbH.exe
  C:\Windows\System\JefXFbH.exe
  2⤵
  PID:6336
- C:\Windows\System\BgBbCUZ.exe
  C:\Windows\System\BgBbCUZ.exe
  2⤵
  PID:6356
- C:\Windows\System\zYpLUel.exe
  C:\Windows\System\zYpLUel.exe
  2⤵
  PID:6380
- C:\Windows\System\nuZbuYy.exe
  C:\Windows\System\nuZbuYy.exe
  2⤵
  PID:6400
- C:\Windows\System\WFatNxs.exe
  C:\Windows\System\WFatNxs.exe
  2⤵
  PID:6420
- C:\Windows\System\GSbqBYc.exe
  C:\Windows\System\GSbqBYc.exe
  2⤵
  PID:6436
- C:\Windows\System\XIxLAdS.exe
  C:\Windows\System\XIxLAdS.exe
  2⤵
  PID:6452
- C:\Windows\System\jfbVLaj.exe
  C:\Windows\System\jfbVLaj.exe
  2⤵
  PID:6472
- C:\Windows\System\ieVASdu.exe
  C:\Windows\System\ieVASdu.exe
  2⤵
  PID:6496
- C:\Windows\System\Qgkdmrx.exe
  C:\Windows\System\Qgkdmrx.exe
  2⤵
  PID:6512
- C:\Windows\System\thQrgOJ.exe
  C:\Windows\System\thQrgOJ.exe
  2⤵
  PID:6528
- C:\Windows\System\YcSCXWY.exe
  C:\Windows\System\YcSCXWY.exe
  2⤵
  PID:6548
- C:\Windows\System\CRiZmMF.exe
  C:\Windows\System\CRiZmMF.exe
  2⤵
  PID:6588
- C:\Windows\System\wDPskFO.exe
  C:\Windows\System\wDPskFO.exe
  2⤵
  PID:6604
- C:\Windows\System\NcoIvaD.exe
  C:\Windows\System\NcoIvaD.exe
  2⤵
  PID:6624
- C:\Windows\System\JJYiKKk.exe
  C:\Windows\System\JJYiKKk.exe
  2⤵
  PID:6640
- C:\Windows\System\bIeYzjF.exe
  C:\Windows\System\bIeYzjF.exe
  2⤵
  PID:6656
- C:\Windows\System\ATFKhFa.exe
  C:\Windows\System\ATFKhFa.exe
  2⤵
  PID:6676
- C:\Windows\System\IgTdLuA.exe
  C:\Windows\System\IgTdLuA.exe
  2⤵
  PID:6696
- C:\Windows\System\dCiDkIb.exe
  C:\Windows\System\dCiDkIb.exe
  2⤵
  PID:6720
- C:\Windows\System\NpeopSi.exe
  C:\Windows\System\NpeopSi.exe
  2⤵
  PID:6736
- C:\Windows\System\OlaQHSM.exe
  C:\Windows\System\OlaQHSM.exe
  2⤵
  PID:6768
- C:\Windows\System\GGdpogW.exe
  C:\Windows\System\GGdpogW.exe
  2⤵
  PID:6784
- C:\Windows\System\BfLhppf.exe
  C:\Windows\System\BfLhppf.exe
  2⤵
  PID:6800
- C:\Windows\System\sJxjPKw.exe
  C:\Windows\System\sJxjPKw.exe
  2⤵
  PID:6824
- C:\Windows\System\jpqOKFb.exe
  C:\Windows\System\jpqOKFb.exe
  2⤵
  PID:6840
- C:\Windows\System\VNlVlfy.exe
  C:\Windows\System\VNlVlfy.exe
  2⤵
  PID:6860
- C:\Windows\System\sSDppfL.exe
  C:\Windows\System\sSDppfL.exe
  2⤵
  PID:6876
- C:\Windows\System\KKytdnC.exe
  C:\Windows\System\KKytdnC.exe
  2⤵
  PID:6896
- C:\Windows\System\bxEwUUE.exe
  C:\Windows\System\bxEwUUE.exe
  2⤵
  PID:6916
- C:\Windows\System\pIsCXAf.exe
  C:\Windows\System\pIsCXAf.exe
  2⤵
  PID:6952
- C:\Windows\System\uQFueMp.exe
  C:\Windows\System\uQFueMp.exe
  2⤵
  PID:6968
- C:\Windows\System\mWAshjX.exe
  C:\Windows\System\mWAshjX.exe
  2⤵
  PID:6988
- C:\Windows\System\RgTxpKc.exe
  C:\Windows\System\RgTxpKc.exe
  2⤵
  PID:7004
- C:\Windows\System\exOKVSg.exe
  C:\Windows\System\exOKVSg.exe
  2⤵
  PID:7024
- C:\Windows\System\LsaxMhS.exe
  C:\Windows\System\LsaxMhS.exe
  2⤵
  PID:7040
- C:\Windows\System\sKyFtzf.exe
  C:\Windows\System\sKyFtzf.exe
  2⤵
  PID:7064
- C:\Windows\System\UFdxGen.exe
  C:\Windows\System\UFdxGen.exe
  2⤵
  PID:7080
- C:\Windows\System\NWabMtM.exe
  C:\Windows\System\NWabMtM.exe
  2⤵
  PID:7100
- C:\Windows\System\nrzubTU.exe
  C:\Windows\System\nrzubTU.exe
  2⤵
  PID:7116
- C:\Windows\System\kdgrfWg.exe
  C:\Windows\System\kdgrfWg.exe
  2⤵
  PID:7136
- C:\Windows\System\NJxyzMD.exe
  C:\Windows\System\NJxyzMD.exe
  2⤵
  PID:7156
- C:\Windows\System\nDcBmIi.exe
  C:\Windows\System\nDcBmIi.exe
  2⤵
  PID:4888
- C:\Windows\System\wdZhRFK.exe
  C:\Windows\System\wdZhRFK.exe
  2⤵
  PID:6216
- C:\Windows\System\xSCYgoC.exe
  C:\Windows\System\xSCYgoC.exe
  2⤵
  PID:5676
- C:\Windows\System\PvfvJja.exe
  C:\Windows\System\PvfvJja.exe
  2⤵
  PID:6164
- C:\Windows\System\GnrIByZ.exe
  C:\Windows\System\GnrIByZ.exe
  2⤵
  PID:6284
- C:\Windows\System\LGRmekF.exe
  C:\Windows\System\LGRmekF.exe
  2⤵
  PID:6300
- C:\Windows\System\OxsOPMO.exe
  C:\Windows\System\OxsOPMO.exe
  2⤵
  PID:6344
- C:\Windows\System\JhZtzPZ.exe
  C:\Windows\System\JhZtzPZ.exe
  2⤵
  PID:6348
- C:\Windows\System\CaBbelX.exe
  C:\Windows\System\CaBbelX.exe
  2⤵
  PID:6396
- C:\Windows\System\OQyVbOT.exe
  C:\Windows\System\OQyVbOT.exe
  2⤵
  PID:6432
- C:\Windows\System\FnFvKnH.exe
  C:\Windows\System\FnFvKnH.exe
  2⤵
  PID:6412
- C:\Windows\System\WxJdMmI.exe
  C:\Windows\System\WxJdMmI.exe
  2⤵
  PID:6508
- C:\Windows\System\PwTFdlh.exe
  C:\Windows\System\PwTFdlh.exe
  2⤵
  PID:6444
- C:\Windows\System\XHGpLvA.exe
  C:\Windows\System\XHGpLvA.exe
  2⤵
  PID:6520
- C:\Windows\System\pQtiEwE.exe
  C:\Windows\System\pQtiEwE.exe
  2⤵
  PID:6556
- C:\Windows\System\RIgZSUA.exe
  C:\Windows\System\RIgZSUA.exe
  2⤵
  PID:6220
- C:\Windows\System\eiIshNm.exe
  C:\Windows\System\eiIshNm.exe
  2⤵
  PID:6600
- C:\Windows\System\hZOdbQB.exe
  C:\Windows\System\hZOdbQB.exe
  2⤵
  PID:6704
- C:\Windows\System\hpQdifk.exe
  C:\Windows\System\hpQdifk.exe
  2⤵
  PID:6716
- C:\Windows\System\WPDFIEg.exe
  C:\Windows\System\WPDFIEg.exe
  2⤵
  PID:6744
- C:\Windows\System\COKZTkH.exe
  C:\Windows\System\COKZTkH.exe
  2⤵
  PID:6684
- C:\Windows\System\coroFbr.exe
  C:\Windows\System\coroFbr.exe
  2⤵
  PID:6796
- C:\Windows\System\klMIHTL.exe
  C:\Windows\System\klMIHTL.exe
  2⤵
  PID:6872
- C:\Windows\System\TZtivky.exe
  C:\Windows\System\TZtivky.exe
  2⤵
  PID:6808
- C:\Windows\System\bzrOFqD.exe
  C:\Windows\System\bzrOFqD.exe
  2⤵
  PID:6932
- C:\Windows\System\sRBDdzh.exe
  C:\Windows\System\sRBDdzh.exe
  2⤵
  PID:6816
- C:\Windows\System\HXQqbIg.exe
  C:\Windows\System\HXQqbIg.exe
  2⤵
  PID:6944
- C:\Windows\System\zsCQdZZ.exe
  C:\Windows\System\zsCQdZZ.exe
  2⤵
  PID:7000
- C:\Windows\System\beEOdWR.exe
  C:\Windows\System\beEOdWR.exe
  2⤵
  PID:7036
- C:\Windows\System\WnHrMdb.exe
  C:\Windows\System\WnHrMdb.exe
  2⤵
  PID:7072
- C:\Windows\System\dpvDSBa.exe
  C:\Windows\System\dpvDSBa.exe
  2⤵
  PID:7148
- C:\Windows\System\FtdZMyn.exe
  C:\Windows\System\FtdZMyn.exe
  2⤵
  PID:7020
- C:\Windows\System\WejMuSl.exe
  C:\Windows\System\WejMuSl.exe
  2⤵
  PID:6212
- C:\Windows\System\tceRgYX.exe
  C:\Windows\System\tceRgYX.exe
  2⤵
  PID:6332
- C:\Windows\System\mdixVAz.exe
  C:\Windows\System\mdixVAz.exe
  2⤵
  PID:6428
- C:\Windows\System\sfeHRnD.exe
  C:\Windows\System\sfeHRnD.exe
  2⤵
  PID:6492
- C:\Windows\System\qjUVWJT.exe
  C:\Windows\System\qjUVWJT.exe
  2⤵
  PID:6580
- C:\Windows\System\wVvVyLa.exe
  C:\Windows\System\wVvVyLa.exe
  2⤵
  PID:6148
- C:\Windows\System\tTbKfpw.exe
  C:\Windows\System\tTbKfpw.exe
  2⤵
  PID:6616
- C:\Windows\System\qWKcWin.exe
  C:\Windows\System\qWKcWin.exe
  2⤵
  PID:6792
- C:\Windows\System\RUPUWVx.exe
  C:\Windows\System\RUPUWVx.exe
  2⤵
  PID:5964
- C:\Windows\System\PEcVygN.exe
  C:\Windows\System\PEcVygN.exe
  2⤵
  PID:6812
- C:\Windows\System\YYUKCpG.exe
  C:\Windows\System\YYUKCpG.exe
  2⤵
  PID:6996
- C:\Windows\System\hTJGBeJ.exe
  C:\Windows\System\hTJGBeJ.exe
  2⤵
  PID:6392
- C:\Windows\System\aWRtpVG.exe
  C:\Windows\System\aWRtpVG.exe
  2⤵
  PID:6536
- C:\Windows\System\bokLDJI.exe
  C:\Windows\System\bokLDJI.exe
  2⤵
  PID:6764
- C:\Windows\System\LBMjXSm.exe
  C:\Windows\System\LBMjXSm.exe
  2⤵
  PID:6848
- C:\Windows\System\saAewyD.exe
  C:\Windows\System\saAewyD.exe
  2⤵
  PID:7108
- C:\Windows\System\uqQegJH.exe
  C:\Windows\System\uqQegJH.exe
  2⤵
  PID:6924
- C:\Windows\System\BMwJvcM.exe
  C:\Windows\System\BMwJvcM.exe
  2⤵
  PID:6620
- C:\Windows\System\NhjccEk.exe
  C:\Windows\System\NhjccEk.exe
  2⤵
  PID:7092
- C:\Windows\System\qHAsJBy.exe
  C:\Windows\System\qHAsJBy.exe
  2⤵
  PID:6240
- C:\Windows\System\pXzrCZX.exe
  C:\Windows\System\pXzrCZX.exe
  2⤵
  PID:6296
- C:\Windows\System\LpHHZxA.exe
  C:\Windows\System\LpHHZxA.exe
  2⤵
  PID:6732
- C:\Windows\System\wbzovxh.exe
  C:\Windows\System\wbzovxh.exe
  2⤵
  PID:6376
- C:\Windows\System\HviMDCQ.exe
  C:\Windows\System\HviMDCQ.exe
  2⤵
  PID:6960
- C:\Windows\System\xrXEcai.exe
  C:\Windows\System\xrXEcai.exe
  2⤵
  PID:6264
- C:\Windows\System\jpIfJEI.exe
  C:\Windows\System\jpIfJEI.exe
  2⤵
  PID:6668
- C:\Windows\System\PgFTCZp.exe
  C:\Windows\System\PgFTCZp.exe
  2⤵
  PID:6464
- C:\Windows\System\nxyqSmW.exe
  C:\Windows\System\nxyqSmW.exe
  2⤵
  PID:6892
- C:\Windows\System\vkFfnbU.exe
  C:\Windows\System\vkFfnbU.exe
  2⤵
  PID:6976
- C:\Windows\System\eRaMayM.exe
  C:\Windows\System\eRaMayM.exe
  2⤵
  PID:6708
- C:\Windows\System\BkKjZAZ.exe
  C:\Windows\System\BkKjZAZ.exe
  2⤵
  PID:7124
- C:\Windows\System\MIvfwsb.exe
  C:\Windows\System\MIvfwsb.exe
  2⤵
  PID:6200
- C:\Windows\System\iSfsvWm.exe
  C:\Windows\System\iSfsvWm.exe
  2⤵
  PID:7088
- C:\Windows\System\vWRQNYe.exe
  C:\Windows\System\vWRQNYe.exe
  2⤵
  PID:6280
- C:\Windows\System\lqZcMNM.exe
  C:\Windows\System\lqZcMNM.exe
  2⤵
  PID:7076
- C:\Windows\System\HceTAxj.exe
  C:\Windows\System\HceTAxj.exe
  2⤵
  PID:6964
- C:\Windows\System\KrdsUvP.exe
  C:\Windows\System\KrdsUvP.exe
  2⤵
  PID:6856
- C:\Windows\System\AWobtjR.exe
  C:\Windows\System\AWobtjR.exe
  2⤵
  PID:6576
- C:\Windows\System\TWqTAho.exe
  C:\Windows\System\TWqTAho.exe
  2⤵
  PID:7164
- C:\Windows\System\HXUuZIT.exe
  C:\Windows\System\HXUuZIT.exe
  2⤵
  PID:6912
- C:\Windows\System\HNQOigh.exe
  C:\Windows\System\HNQOigh.exe
  2⤵
  PID:6884
- C:\Windows\System\fsGxslX.exe
  C:\Windows\System\fsGxslX.exe
  2⤵
  PID:6728
- C:\Windows\System\KzkDZtF.exe
  C:\Windows\System\KzkDZtF.exe
  2⤵
  PID:6868
- C:\Windows\System\ZxieHNo.exe
  C:\Windows\System\ZxieHNo.exe
  2⤵
  PID:6584
- C:\Windows\System\MkfWUrb.exe
  C:\Windows\System\MkfWUrb.exe
  2⤵
  PID:6756
- C:\Windows\System\uvNqVbx.exe
  C:\Windows\System\uvNqVbx.exe
  2⤵
  PID:7176
- C:\Windows\System\ZIojDFW.exe
  C:\Windows\System\ZIojDFW.exe
  2⤵
  PID:7196
- C:\Windows\System\Eybzwit.exe
  C:\Windows\System\Eybzwit.exe
  2⤵
  PID:7212
- C:\Windows\System\espLqtZ.exe
  C:\Windows\System\espLqtZ.exe
  2⤵
  PID:7228
- C:\Windows\System\zaDlvrP.exe
  C:\Windows\System\zaDlvrP.exe
  2⤵
  PID:7244
- C:\Windows\System\tArnGcD.exe
  C:\Windows\System\tArnGcD.exe
  2⤵
  PID:7264
- C:\Windows\System\vpzePqL.exe
  C:\Windows\System\vpzePqL.exe
  2⤵
  PID:7284
- C:\Windows\System\BasRmwW.exe
  C:\Windows\System\BasRmwW.exe
  2⤵
  PID:7308
- C:\Windows\System\jyubOWT.exe
  C:\Windows\System\jyubOWT.exe
  2⤵
  PID:7324
- C:\Windows\System\GlAHlFw.exe
  C:\Windows\System\GlAHlFw.exe
  2⤵
  PID:7364
- C:\Windows\System\erjEOUK.exe
  C:\Windows\System\erjEOUK.exe
  2⤵
  PID:7380
- C:\Windows\System\esDIGql.exe
  C:\Windows\System\esDIGql.exe
  2⤵
  PID:7404
- C:\Windows\System\cIlPCJJ.exe
  C:\Windows\System\cIlPCJJ.exe
  2⤵
  PID:7420
- C:\Windows\System\pWNVDMs.exe
  C:\Windows\System\pWNVDMs.exe
  2⤵
  PID:7436
- C:\Windows\System\GSRjlpn.exe
  C:\Windows\System\GSRjlpn.exe
  2⤵
  PID:7456
- C:\Windows\System\jpjanhh.exe
  C:\Windows\System\jpjanhh.exe
  2⤵
  PID:7480
- C:\Windows\System\qkNFwJX.exe
  C:\Windows\System\qkNFwJX.exe
  2⤵
  PID:7496
- C:\Windows\System\bEMAXcQ.exe
  C:\Windows\System\bEMAXcQ.exe
  2⤵
  PID:7512
- C:\Windows\System\iNUowkM.exe
  C:\Windows\System\iNUowkM.exe
  2⤵
  PID:7532
- C:\Windows\System\PyXpyaX.exe
  C:\Windows\System\PyXpyaX.exe
  2⤵
  PID:7564
- C:\Windows\System\NJOJDAA.exe
  C:\Windows\System\NJOJDAA.exe
  2⤵
  PID:7584
- C:\Windows\System\XMgwelt.exe
  C:\Windows\System\XMgwelt.exe
  2⤵
  PID:7604
- C:\Windows\System\eYhHKCR.exe
  C:\Windows\System\eYhHKCR.exe
  2⤵
  PID:7620
- C:\Windows\System\itLUWNZ.exe
  C:\Windows\System\itLUWNZ.exe
  2⤵
  PID:7636
- C:\Windows\System\TqvQowJ.exe
  C:\Windows\System\TqvQowJ.exe
  2⤵
  PID:7652
- C:\Windows\System\ZTTZlxq.exe
  C:\Windows\System\ZTTZlxq.exe
  2⤵
  PID:7672
- C:\Windows\System\oHIshkc.exe
  C:\Windows\System\oHIshkc.exe
  2⤵
  PID:7692
- C:\Windows\System\WZlnQUu.exe
  C:\Windows\System\WZlnQUu.exe
  2⤵
  PID:7712
- C:\Windows\System\sBdbXWX.exe
  C:\Windows\System\sBdbXWX.exe
  2⤵
  PID:7744
- C:\Windows\System\AkIzIlx.exe
  C:\Windows\System\AkIzIlx.exe
  2⤵
  PID:7760
- C:\Windows\System\zBMusAw.exe
  C:\Windows\System\zBMusAw.exe
  2⤵
  PID:7780
- C:\Windows\System\hFVnHwE.exe
  C:\Windows\System\hFVnHwE.exe
  2⤵
  PID:7800
- C:\Windows\System\iwqDudZ.exe
  C:\Windows\System\iwqDudZ.exe
  2⤵
  PID:7816
- C:\Windows\System\ghqJkVR.exe
  C:\Windows\System\ghqJkVR.exe
  2⤵
  PID:7832
- C:\Windows\System\ZBAUxSC.exe
  C:\Windows\System\ZBAUxSC.exe
  2⤵
  PID:7852
- C:\Windows\System\oZCSkPw.exe
  C:\Windows\System\oZCSkPw.exe
  2⤵
  PID:7872
- C:\Windows\System\MBdeiQq.exe
  C:\Windows\System\MBdeiQq.exe
  2⤵
  PID:7888
- C:\Windows\System\hOtGtyv.exe
  C:\Windows\System\hOtGtyv.exe
  2⤵
  PID:7908
- C:\Windows\System\EJYGaUS.exe
  C:\Windows\System\EJYGaUS.exe
  2⤵
  PID:7928
- C:\Windows\System\bhTqhoF.exe
  C:\Windows\System\bhTqhoF.exe
  2⤵
  PID:7944
- C:\Windows\System\AIHjxSq.exe
  C:\Windows\System\AIHjxSq.exe
  2⤵
  PID:7964
- C:\Windows\System\FdZFBGd.exe
  C:\Windows\System\FdZFBGd.exe
  2⤵
  PID:7992
- C:\Windows\System\jNLVADg.exe
  C:\Windows\System\jNLVADg.exe
  2⤵
  PID:8012
- C:\Windows\System\uPZWaOg.exe
  C:\Windows\System\uPZWaOg.exe
  2⤵
  PID:8028
- C:\Windows\System\PetSasb.exe
  C:\Windows\System\PetSasb.exe
  2⤵
  PID:8048
- C:\Windows\System\fszUyeu.exe
  C:\Windows\System\fszUyeu.exe
  2⤵
  PID:8068
- C:\Windows\System\iSzkaJv.exe
  C:\Windows\System\iSzkaJv.exe
  2⤵
  PID:8092
- C:\Windows\System\jHnoHgB.exe
  C:\Windows\System\jHnoHgB.exe
  2⤵
  PID:8108
- C:\Windows\System\eWeCzVH.exe
  C:\Windows\System\eWeCzVH.exe
  2⤵
  PID:8128
- C:\Windows\System\QLfFEDo.exe
  C:\Windows\System\QLfFEDo.exe
  2⤵
  PID:8144
- C:\Windows\System\okiQQNa.exe
  C:\Windows\System\okiQQNa.exe
  2⤵
  PID:8160
- C:\Windows\System\qaoTror.exe
  C:\Windows\System\qaoTror.exe
  2⤵
  PID:8180
- C:\Windows\System\saRIWdc.exe
  C:\Windows\System\saRIWdc.exe
  2⤵
  PID:7172
- C:\Windows\System\uIWuXJN.exe
  C:\Windows\System\uIWuXJN.exe
  2⤵
  PID:7236
- C:\Windows\System\jRMUUuq.exe
  C:\Windows\System\jRMUUuq.exe
  2⤵
  PID:6308
- C:\Windows\System\FQSZJyX.exe
  C:\Windows\System\FQSZJyX.exe
  2⤵
  PID:7192
- C:\Windows\System\aNSziie.exe
  C:\Windows\System\aNSziie.exe
  2⤵
  PID:7304
- C:\Windows\System\HgtpaVc.exe
  C:\Windows\System\HgtpaVc.exe
  2⤵
  PID:7348
- C:\Windows\System\drZCiKg.exe
  C:\Windows\System\drZCiKg.exe
  2⤵
  PID:7332
- C:\Windows\System\sZIEtXt.exe
  C:\Windows\System\sZIEtXt.exe
  2⤵
  PID:7372
- C:\Windows\System\DTWCufZ.exe
  C:\Windows\System\DTWCufZ.exe
  2⤵
  PID:7412
- C:\Windows\System\cNVSPWr.exe
  C:\Windows\System\cNVSPWr.exe
  2⤵
  PID:7452
- C:\Windows\System\GqjMOrJ.exe
  C:\Windows\System\GqjMOrJ.exe
  2⤵
  PID:7520
- C:\Windows\System\xrOYQfh.exe
  C:\Windows\System\xrOYQfh.exe
  2⤵
  PID:7472
- C:\Windows\System\MOyWKDZ.exe
  C:\Windows\System\MOyWKDZ.exe
  2⤵
  PID:7540
- C:\Windows\System\skGOOli.exe
  C:\Windows\System\skGOOli.exe
  2⤵
  PID:7572
- C:\Windows\System\ciMXkFy.exe
  C:\Windows\System\ciMXkFy.exe
  2⤵
  PID:7612
- C:\Windows\System\GAvNWNX.exe
  C:\Windows\System\GAvNWNX.exe
  2⤵
  PID:7648
- C:\Windows\System\QYTrkcC.exe
  C:\Windows\System\QYTrkcC.exe
  2⤵
  PID:7728
- C:\Windows\System\ZoIEENt.exe
  C:\Windows\System\ZoIEENt.exe
  2⤵
  PID:7632
- C:\Windows\System\evOcfbH.exe
  C:\Windows\System\evOcfbH.exe
  2⤵
  PID:7700
- C:\Windows\System\WLFmOWD.exe
  C:\Windows\System\WLFmOWD.exe
  2⤵
  PID:7772
- C:\Windows\System\TnCRyJT.exe
  C:\Windows\System\TnCRyJT.exe
  2⤵
  PID:7920
- C:\Windows\System\GEJvcZG.exe
  C:\Windows\System\GEJvcZG.exe
  2⤵
  PID:7828
- C:\Windows\System\OAqdFpC.exe
  C:\Windows\System\OAqdFpC.exe
  2⤵
  PID:8036
- C:\Windows\System\HgQqEKT.exe
  C:\Windows\System\HgQqEKT.exe
  2⤵
  PID:7900
- C:\Windows\System\zHQcXBA.exe
  C:\Windows\System\zHQcXBA.exe
  2⤵
  PID:7824
- C:\Windows\System\fErDmEz.exe
  C:\Windows\System\fErDmEz.exe
  2⤵
  PID:7868
- C:\Windows\System\nscQBDD.exe
  C:\Windows\System\nscQBDD.exe
  2⤵
  PID:7976
- C:\Windows\System\FUVkZvz.exe
  C:\Windows\System\FUVkZvz.exe
  2⤵
  PID:8024
- C:\Windows\System\ePZevom.exe
  C:\Windows\System\ePZevom.exe
  2⤵
  PID:8116
- C:\Windows\System\grFSoZs.exe
  C:\Windows\System\grFSoZs.exe
  2⤵
  PID:8188
- C:\Windows\System\wCFWTnl.exe
  C:\Windows\System\wCFWTnl.exe
  2⤵
  PID:8136
- C:\Windows\System\iPQhBCi.exe
  C:\Windows\System\iPQhBCi.exe
  2⤵
  PID:8100
- C:\Windows\System\nSmBOfW.exe
  C:\Windows\System\nSmBOfW.exe
  2⤵
  PID:7356
- C:\Windows\System\kxHCuRi.exe
  C:\Windows\System\kxHCuRi.exe
  2⤵
  PID:7052
- C:\Windows\System\jGzoYQF.exe
  C:\Windows\System\jGzoYQF.exe
  2⤵
  PID:6160
- C:\Windows\System\YIOrfLk.exe
  C:\Windows\System\YIOrfLk.exe
  2⤵
  PID:7504
- C:\Windows\System\HOFtNVX.exe
  C:\Windows\System\HOFtNVX.exe
  2⤵
  PID:7688
- C:\Windows\System\YOrtnwx.exe
  C:\Windows\System\YOrtnwx.exe
  2⤵
  PID:7664
- C:\Windows\System\LbAEzNZ.exe
  C:\Windows\System\LbAEzNZ.exe
  2⤵
  PID:7884
- C:\Windows\System\zFppAQT.exe
  C:\Windows\System\zFppAQT.exe
  2⤵
  PID:7336
- C:\Windows\System\PCzbWPA.exe
  C:\Windows\System\PCzbWPA.exe
  2⤵
  PID:7524
- C:\Windows\System\IbNfqdd.exe
  C:\Windows\System\IbNfqdd.exe
  2⤵
  PID:7556
- C:\Windows\System\cfirEpU.exe
  C:\Windows\System\cfirEpU.exe
  2⤵
  PID:7708
- C:\Windows\System\LpYpdZT.exe
  C:\Windows\System\LpYpdZT.exe
  2⤵
  PID:7544
- C:\Windows\System\hqybhtZ.exe
  C:\Windows\System\hqybhtZ.exe
  2⤵
  PID:8004
- C:\Windows\System\hloUBFC.exe
  C:\Windows\System\hloUBFC.exe
  2⤵
  PID:8064
- C:\Windows\System\jHWSEbl.exe
  C:\Windows\System\jHWSEbl.exe
  2⤵
  PID:6368
- C:\Windows\System\DStaUxQ.exe
  C:\Windows\System\DStaUxQ.exe
  2⤵
  PID:6760
- C:\Windows\System\ubCQlyu.exe
  C:\Windows\System\ubCQlyu.exe
  2⤵
  PID:8020
- C:\Windows\System\JixbsHZ.exe
  C:\Windows\System\JixbsHZ.exe
  2⤵
  PID:7988
- C:\Windows\System\lvXgECv.exe
  C:\Windows\System\lvXgECv.exe
  2⤵
  PID:7296
- C:\Windows\System\wAaFZpM.exe
  C:\Windows\System\wAaFZpM.exe
  2⤵
  PID:7396
- C:\Windows\System\qqEXpfY.exe
  C:\Windows\System\qqEXpfY.exe
  2⤵
  PID:7592
- C:\Windows\System\ZarMlZm.exe
  C:\Windows\System\ZarMlZm.exe
  2⤵
  PID:7848
- C:\Windows\System\TEhSYXE.exe
  C:\Windows\System\TEhSYXE.exe
  2⤵
  PID:7432
- C:\Windows\System\yBRjKiy.exe
  C:\Windows\System\yBRjKiy.exe
  2⤵
  PID:7488
- C:\Windows\System\VgSiLTc.exe
  C:\Windows\System\VgSiLTc.exe
  2⤵
  PID:7352
- C:\Windows\System\wfVYgQX.exe
  C:\Windows\System\wfVYgQX.exe
  2⤵
  PID:7552
- C:\Windows\System\fSPXbeG.exe
  C:\Windows\System\fSPXbeG.exe
  2⤵
  PID:7960
- C:\Windows\System\SSFSoWU.exe
  C:\Windows\System\SSFSoWU.exe
  2⤵
  PID:7280
- C:\Windows\System\ukpyvJm.exe
  C:\Windows\System\ukpyvJm.exe
  2⤵
  PID:7360
- C:\Windows\System\aLDvnqg.exe
  C:\Windows\System\aLDvnqg.exe
  2⤵
  PID:7752
- C:\Windows\System\sLPsGmd.exe
  C:\Windows\System\sLPsGmd.exe
  2⤵
  PID:7952
- C:\Windows\System\HBSAZGD.exe
  C:\Windows\System\HBSAZGD.exe
  2⤵
  PID:8156
- C:\Windows\System\TrINXxP.exe
  C:\Windows\System\TrINXxP.exe
  2⤵
  PID:7684
- C:\Windows\System\AwcIgta.exe
  C:\Windows\System\AwcIgta.exe
  2⤵
  PID:7864
- C:\Windows\System\ZmahoBD.exe
  C:\Windows\System\ZmahoBD.exe
  2⤵
  PID:8080
- C:\Windows\System\qoDOmYR.exe
  C:\Windows\System\qoDOmYR.exe
  2⤵
  PID:7812
- C:\Windows\System\MWEKqpR.exe
  C:\Windows\System\MWEKqpR.exe
  2⤵
  PID:8124
- C:\Windows\System\lFHbEOa.exe
  C:\Windows\System\lFHbEOa.exe
  2⤵
  PID:8168
- C:\Windows\System\QyYixrI.exe
  C:\Windows\System\QyYixrI.exe
  2⤵
  PID:7768
- C:\Windows\System\mUHyjKS.exe
  C:\Windows\System\mUHyjKS.exe
  2⤵
  PID:7792
- C:\Windows\System\ajJphiA.exe
  C:\Windows\System\ajJphiA.exe
  2⤵
  PID:7184
- C:\Windows\System\DFXogkw.exe
  C:\Windows\System\DFXogkw.exe
  2⤵
  PID:7292
- C:\Windows\System\lKffiGo.exe
  C:\Windows\System\lKffiGo.exe
  2⤵
  PID:8212
- C:\Windows\System\zDtbNxG.exe
  C:\Windows\System\zDtbNxG.exe
  2⤵
  PID:8232
- C:\Windows\System\ILtVaYt.exe
  C:\Windows\System\ILtVaYt.exe
  2⤵
  PID:8248
- C:\Windows\System\eQTNNms.exe
  C:\Windows\System\eQTNNms.exe
  2⤵
  PID:8264
- C:\Windows\System\AEjfLUL.exe
  C:\Windows\System\AEjfLUL.exe
  2⤵
  PID:8284
- C:\Windows\System\ffjqttR.exe
  C:\Windows\System\ffjqttR.exe
  2⤵
  PID:8304
- C:\Windows\System\HqspaqH.exe
  C:\Windows\System\HqspaqH.exe
  2⤵
  PID:8320
- C:\Windows\System\JfTdFbr.exe
  C:\Windows\System\JfTdFbr.exe
  2⤵
  PID:8340
- C:\Windows\System\cpdzDBF.exe
  C:\Windows\System\cpdzDBF.exe
  2⤵
  PID:8356
- C:\Windows\System\qvCQeqp.exe
  C:\Windows\System\qvCQeqp.exe
  2⤵
  PID:8372
- C:\Windows\System\vJZZhJf.exe
  C:\Windows\System\vJZZhJf.exe
  2⤵
  PID:8412
- C:\Windows\System\hAokfLK.exe
  C:\Windows\System\hAokfLK.exe
  2⤵
  PID:8436
- C:\Windows\System\ufHhiud.exe
  C:\Windows\System\ufHhiud.exe
  2⤵
  PID:8452
- C:\Windows\System\wxCKuDw.exe
  C:\Windows\System\wxCKuDw.exe
  2⤵
  PID:8472
- C:\Windows\System\ULjTxvb.exe
  C:\Windows\System\ULjTxvb.exe
  2⤵
  PID:8496
- C:\Windows\System\STupUDi.exe
  C:\Windows\System\STupUDi.exe
  2⤵
  PID:8512
- C:\Windows\System\UXqZSzM.exe
  C:\Windows\System\UXqZSzM.exe
  2⤵
  PID:8528
- C:\Windows\System\ZqrKYqD.exe
  C:\Windows\System\ZqrKYqD.exe
  2⤵
  PID:8548
- C:\Windows\System\mNWOIIB.exe
  C:\Windows\System\mNWOIIB.exe
  2⤵
  PID:8564
- C:\Windows\System\nieIiQR.exe
  C:\Windows\System\nieIiQR.exe
  2⤵
  PID:8584
- C:\Windows\System\zKvktWO.exe
  C:\Windows\System\zKvktWO.exe
  2⤵
  PID:8600
- C:\Windows\System\hzLAWus.exe
  C:\Windows\System\hzLAWus.exe
  2⤵
  PID:8640
- C:\Windows\System\QetnWLe.exe
  C:\Windows\System\QetnWLe.exe
  2⤵
  PID:8660
- C:\Windows\System\CtIURSn.exe
  C:\Windows\System\CtIURSn.exe
  2⤵
  PID:8684
- C:\Windows\System\yzZHfAi.exe
  C:\Windows\System\yzZHfAi.exe
  2⤵
  PID:8704
- C:\Windows\System\Emxzkwo.exe
  C:\Windows\System\Emxzkwo.exe
  2⤵
  PID:8728
- C:\Windows\System\MYcCgux.exe
  C:\Windows\System\MYcCgux.exe
  2⤵
  PID:8744
- C:\Windows\System\iCbTZcx.exe
  C:\Windows\System\iCbTZcx.exe
  2⤵
  PID:8760
- C:\Windows\System\ysVTAnW.exe
  C:\Windows\System\ysVTAnW.exe
  2⤵
  PID:8776
- C:\Windows\System\NjGvvjr.exe
  C:\Windows\System\NjGvvjr.exe
  2⤵
  PID:8812
- C:\Windows\System\VUAEBJy.exe
  C:\Windows\System\VUAEBJy.exe
  2⤵
  PID:8828
- C:\Windows\System\RBwPyJo.exe
  C:\Windows\System\RBwPyJo.exe
  2⤵
  PID:8848
- C:\Windows\System\zWkQMnS.exe
  C:\Windows\System\zWkQMnS.exe
  2⤵
  PID:8864
- C:\Windows\System\LlDNYYE.exe
  C:\Windows\System\LlDNYYE.exe
  2⤵
  PID:8884
- C:\Windows\System\pSrCyuN.exe
  C:\Windows\System\pSrCyuN.exe
  2⤵
  PID:8904
- C:\Windows\System\vBFdLgB.exe
  C:\Windows\System\vBFdLgB.exe
  2⤵
  PID:8920
- C:\Windows\System\ieKgXgk.exe
  C:\Windows\System\ieKgXgk.exe
  2⤵
  PID:8936
- C:\Windows\System\CeNRCPU.exe
  C:\Windows\System\CeNRCPU.exe
  2⤵
  PID:8960
- C:\Windows\System\DlyDVSU.exe
  C:\Windows\System\DlyDVSU.exe
  2⤵
  PID:8980
- C:\Windows\System\msKLDxG.exe
  C:\Windows\System\msKLDxG.exe
  2⤵
  PID:8996
- C:\Windows\System\AtZYvdK.exe
  C:\Windows\System\AtZYvdK.exe
  2⤵
  PID:9012
- C:\Windows\System\jaIaVkG.exe
  C:\Windows\System\jaIaVkG.exe
  2⤵
  PID:9032
- C:\Windows\System\lpDlzlN.exe
  C:\Windows\System\lpDlzlN.exe
  2⤵
  PID:9052
- C:\Windows\System\vIdbcrx.exe
  C:\Windows\System\vIdbcrx.exe
  2⤵
  PID:9080
- C:\Windows\System\jSZmiwv.exe
  C:\Windows\System\jSZmiwv.exe
  2⤵
  PID:9116
- C:\Windows\System\QuHbEHn.exe
  C:\Windows\System\QuHbEHn.exe
  2⤵
  PID:9132
- C:\Windows\System\KNLvpca.exe
  C:\Windows\System\KNLvpca.exe
  2⤵
  PID:9148
- C:\Windows\System\RIeXNyQ.exe
  C:\Windows\System\RIeXNyQ.exe
  2⤵
  PID:9164
- C:\Windows\System\ajDLwtq.exe
  C:\Windows\System\ajDLwtq.exe
  2⤵
  PID:9192
- C:\Windows\System\IJfFxLB.exe
  C:\Windows\System\IJfFxLB.exe
  2⤵
  PID:8196
- C:\Windows\System\bFxSusp.exe
  C:\Windows\System\bFxSusp.exe
  2⤵
  PID:8084
- C:\Windows\System\OSUebiC.exe
  C:\Windows\System\OSUebiC.exe
  2⤵
  PID:8240
- C:\Windows\System\ZAiTTnQ.exe
  C:\Windows\System\ZAiTTnQ.exe
  2⤵
  PID:8316
- C:\Windows\System\AquFWwz.exe
  C:\Windows\System\AquFWwz.exe
  2⤵
  PID:8388
- C:\Windows\System\VgnUtKA.exe
  C:\Windows\System\VgnUtKA.exe
  2⤵
  PID:8404
- C:\Windows\System\yasZUaL.exe
  C:\Windows\System\yasZUaL.exe
  2⤵
  PID:8228
- C:\Windows\System\GfzgNil.exe
  C:\Windows\System\GfzgNil.exe
  2⤵
  PID:8296
- C:\Windows\System\ydURLwR.exe
  C:\Windows\System\ydURLwR.exe
  2⤵
  PID:8300
- C:\Windows\System\rZVYdFh.exe
  C:\Windows\System\rZVYdFh.exe
  2⤵
  PID:8384
- C:\Windows\System\KXAzrKp.exe
  C:\Windows\System\KXAzrKp.exe
  2⤵
  PID:8484
- C:\Windows\System\MOwcrdJ.exe
  C:\Windows\System\MOwcrdJ.exe
  2⤵
  PID:8556
- C:\Windows\System\lVbrjKy.exe
  C:\Windows\System\lVbrjKy.exe
  2⤵
  PID:8468
- C:\Windows\System\vqncogh.exe
  C:\Windows\System\vqncogh.exe
  2⤵
  PID:8540
- C:\Windows\System\vvbFIWY.exe
  C:\Windows\System\vvbFIWY.exe
  2⤵
  PID:8536
- C:\Windows\System\gfqbLkV.exe
  C:\Windows\System\gfqbLkV.exe
  2⤵
  PID:8652
- C:\Windows\System\NfALTRs.exe
  C:\Windows\System\NfALTRs.exe
  2⤵
  PID:8628
- C:\Windows\System\oGlsogZ.exe
  C:\Windows\System\oGlsogZ.exe
  2⤵
  PID:8672
- C:\Windows\System\itdymaf.exe
  C:\Windows\System\itdymaf.exe
  2⤵
  PID:8700
- C:\Windows\System\ZMjJcTQ.exe
  C:\Windows\System\ZMjJcTQ.exe
  2⤵
  PID:8740
- C:\Windows\System\ojIjCCP.exe
  C:\Windows\System\ojIjCCP.exe
  2⤵
  PID:8784
- C:\Windows\System\BoMlkIh.exe
  C:\Windows\System\BoMlkIh.exe
  2⤵
  PID:8608
- C:\Windows\System\awTRRxE.exe
  C:\Windows\System\awTRRxE.exe
  2⤵
  PID:8844
- C:\Windows\System\IUXTYuR.exe
  C:\Windows\System\IUXTYuR.exe
  2⤵
  PID:8872
- C:\Windows\System\ZcmzKwh.exe
  C:\Windows\System\ZcmzKwh.exe
  2⤵
  PID:8952
- C:\Windows\System\AaUlyIP.exe
  C:\Windows\System\AaUlyIP.exe
  2⤵
  PID:8948
- C:\Windows\System\XzAWbfY.exe
  C:\Windows\System\XzAWbfY.exe
  2⤵
  PID:9004
- C:\Windows\System\ncusduZ.exe
  C:\Windows\System\ncusduZ.exe
  2⤵
  PID:9044
- C:\Windows\System\eIzCmvx.exe
  C:\Windows\System\eIzCmvx.exe
  2⤵
  PID:9024
- C:\Windows\System\AqSmIbF.exe
  C:\Windows\System\AqSmIbF.exe
  2⤵
  PID:9092
- C:\Windows\System\CJwqwzp.exe
  C:\Windows\System\CJwqwzp.exe
  2⤵
  PID:9128
- C:\Windows\System\DBrMEJr.exe
  C:\Windows\System\DBrMEJr.exe
  2⤵
  PID:9180
- C:\Windows\System\wZRCIcF.exe
  C:\Windows\System\wZRCIcF.exe
  2⤵
  PID:9200
- C:\Windows\System\sUtxoPc.exe
  C:\Windows\System\sUtxoPc.exe
  2⤵
  PID:8208
- C:\Windows\System\oiyUQyD.exe
  C:\Windows\System\oiyUQyD.exe
  2⤵
  PID:8272
- C:\Windows\System\CwOYphC.exe
  C:\Windows\System\CwOYphC.exe
  2⤵
  PID:7956
- C:\Windows\System\MZAqKyh.exe
  C:\Windows\System\MZAqKyh.exe
  2⤵
  PID:8400
- C:\Windows\System\ADgKiqk.exe
  C:\Windows\System\ADgKiqk.exe
  2⤵
  PID:8292
- C:\Windows\System\oenUGuz.exe
  C:\Windows\System\oenUGuz.exe
  2⤵
  PID:7392
- C:\Windows\System\MYieGCB.exe
  C:\Windows\System\MYieGCB.exe
  2⤵
  PID:8424
- C:\Windows\System\ndvFWfn.exe
  C:\Windows\System\ndvFWfn.exe
  2⤵
  PID:8428
- C:\Windows\System\RgqaOQC.exe
  C:\Windows\System\RgqaOQC.exe
  2⤵
  PID:8612
- C:\Windows\System\CpehBfj.exe
  C:\Windows\System\CpehBfj.exe
  2⤵
  PID:8620
- C:\Windows\System\mXMFLJi.exe
  C:\Windows\System\mXMFLJi.exe
  2⤵
  PID:8680
- C:\Windows\System\AjVzdnj.exe
  C:\Windows\System\AjVzdnj.exe
  2⤵
  PID:8792
- C:\Windows\System\etgOMia.exe
  C:\Windows\System\etgOMia.exe
  2⤵
  PID:8668
- C:\Windows\System\XkZRBce.exe
  C:\Windows\System\XkZRBce.exe
  2⤵
  PID:8900
- C:\Windows\System\UtmTRAO.exe
  C:\Windows\System\UtmTRAO.exe
  2⤵
  PID:8916
- C:\Windows\System\epdGANz.exe
  C:\Windows\System\epdGANz.exe
  2⤵
  PID:9048
- C:\Windows\System\xAvYxbp.exe
  C:\Windows\System\xAvYxbp.exe
  2⤵
  PID:8992
- C:\Windows\System\hqieSBR.exe
  C:\Windows\System\hqieSBR.exe
  2⤵
  PID:9020
- C:\Windows\System\JnfsThC.exe
  C:\Windows\System\JnfsThC.exe
  2⤵
  PID:9104
- C:\Windows\System\VHfbXFz.exe
  C:\Windows\System\VHfbXFz.exe
  2⤵
  PID:9172
- C:\Windows\System\mDhzlEz.exe
  C:\Windows\System\mDhzlEz.exe
  2⤵
  PID:9156
- C:\Windows\System\DThqAWY.exe
  C:\Windows\System\DThqAWY.exe
  2⤵
  PID:8244
- C:\Windows\System\tAzIiPn.exe
  C:\Windows\System\tAzIiPn.exe
  2⤵
  PID:8480
- C:\Windows\System\lBnwSBM.exe
  C:\Windows\System\lBnwSBM.exe
  2⤵
  PID:8224
- C:\Windows\System\AvsHwaT.exe
  C:\Windows\System\AvsHwaT.exe
  2⤵
  PID:8712
- C:\Windows\System\cKewBOq.exe
  C:\Windows\System\cKewBOq.exe
  2⤵
  PID:8676
- C:\Windows\System\wGCYHRO.exe
  C:\Windows\System\wGCYHRO.exe
  2⤵
  PID:8368
- C:\Windows\System\CIyKiHQ.exe
  C:\Windows\System\CIyKiHQ.exe
  2⤵
  PID:8928
- C:\Windows\System\FPgxIfG.exe
  C:\Windows\System\FPgxIfG.exe
  2⤵
  PID:8932
- C:\Windows\System\nLwhgMZ.exe
  C:\Windows\System\nLwhgMZ.exe
  2⤵
  PID:9068
- C:\Windows\System\hjGYKqY.exe
  C:\Windows\System\hjGYKqY.exe
  2⤵
  PID:9188
- C:\Windows\System\NklpfCX.exe
  C:\Windows\System\NklpfCX.exe
  2⤵
  PID:8220
- C:\Windows\System\VDCdvYs.exe
  C:\Windows\System\VDCdvYs.exe
  2⤵
  PID:8616
- C:\Windows\System\RWUrEYx.exe
  C:\Windows\System\RWUrEYx.exe
  2⤵
  PID:8692
- C:\Windows\System\iLjFWwO.exe
  C:\Windows\System\iLjFWwO.exe
  2⤵
  PID:8804
- C:\Windows\System\CNUsRvX.exe
  C:\Windows\System\CNUsRvX.exe
  2⤵
  PID:8432
- C:\Windows\System\adWXwmj.exe
  C:\Windows\System\adWXwmj.exe
  2⤵
  PID:9088
- C:\Windows\System\xzyJfDb.exe
  C:\Windows\System\xzyJfDb.exe
  2⤵
  PID:9100
- C:\Windows\System\dBswqFR.exe
  C:\Windows\System\dBswqFR.exe
  2⤵
  PID:8988
- C:\Windows\System\xCcRdNi.exe
  C:\Windows\System\xCcRdNi.exe
  2⤵
  PID:8396
- C:\Windows\System\myjuyUE.exe
  C:\Windows\System\myjuyUE.exe
  2⤵
  PID:8944
- C:\Windows\System\iFNAGgG.exe
  C:\Windows\System\iFNAGgG.exe
  2⤵
  PID:8632
- C:\Windows\System\AUmGoPk.exe
  C:\Windows\System\AUmGoPk.exe
  2⤵
  PID:7468
- C:\Windows\System\AoMXaBd.exe
  C:\Windows\System\AoMXaBd.exe
  2⤵
  PID:9124
- C:\Windows\System\vWGdELU.exe
  C:\Windows\System\vWGdELU.exe
  2⤵
  PID:9220
- C:\Windows\System\fDEBykd.exe
  C:\Windows\System\fDEBykd.exe
  2⤵
  PID:9236
- C:\Windows\System\IguAgXY.exe
  C:\Windows\System\IguAgXY.exe
  2⤵
  PID:9264
- C:\Windows\System\BDqhFQv.exe
  C:\Windows\System\BDqhFQv.exe
  2⤵
  PID:9280
- C:\Windows\System\hrDdtJI.exe
  C:\Windows\System\hrDdtJI.exe
  2⤵
  PID:9304
- C:\Windows\System\UNJUHMo.exe
  C:\Windows\System\UNJUHMo.exe
  2⤵
  PID:9320
- C:\Windows\System\bfdTEqI.exe
  C:\Windows\System\bfdTEqI.exe
  2⤵
  PID:9336
- C:\Windows\System\eaLGLiA.exe
  C:\Windows\System\eaLGLiA.exe
  2⤵
  PID:9356
- C:\Windows\System\qKvSqPR.exe
  C:\Windows\System\qKvSqPR.exe
  2⤵
  PID:9380
- C:\Windows\System\oftvfGF.exe
  C:\Windows\System\oftvfGF.exe
  2⤵
  PID:9404
- C:\Windows\System\DWNIiIi.exe
  C:\Windows\System\DWNIiIi.exe
  2⤵
  PID:9424
- C:\Windows\System\iVysAAv.exe
  C:\Windows\System\iVysAAv.exe
  2⤵
  PID:9456
- C:\Windows\System\egmJuDq.exe
  C:\Windows\System\egmJuDq.exe
  2⤵
  PID:9472
- C:\Windows\System\nDjZEuT.exe
  C:\Windows\System\nDjZEuT.exe
  2⤵
  PID:9492
- C:\Windows\System\ATWbIXT.exe
  C:\Windows\System\ATWbIXT.exe
  2⤵
  PID:9512
- C:\Windows\System\UeVwQYC.exe
  C:\Windows\System\UeVwQYC.exe
  2⤵
  PID:9532
- C:\Windows\System\TuwTPpv.exe
  C:\Windows\System\TuwTPpv.exe
  2⤵
  PID:9548
- C:\Windows\System\CZairnD.exe
  C:\Windows\System\CZairnD.exe
  2⤵
  PID:9576
- C:\Windows\System\gYgPDpU.exe
  C:\Windows\System\gYgPDpU.exe
  2⤵
  PID:9592
- C:\Windows\System\yYGLUoX.exe
  C:\Windows\System\yYGLUoX.exe
  2⤵
  PID:9612
- C:\Windows\System\aGZYTbi.exe
  C:\Windows\System\aGZYTbi.exe
  2⤵
  PID:9636
- C:\Windows\System\dpqyrlE.exe
  C:\Windows\System\dpqyrlE.exe
  2⤵
  PID:9656
- C:\Windows\System\egogQAi.exe
  C:\Windows\System\egogQAi.exe
  2⤵
  PID:9680
- C:\Windows\System\QxOLVyf.exe
  C:\Windows\System\QxOLVyf.exe
  2⤵
  PID:9696
- C:\Windows\System\aYGLnCw.exe
  C:\Windows\System\aYGLnCw.exe
  2⤵
  PID:9712
- C:\Windows\System\LpnAujL.exe
  C:\Windows\System\LpnAujL.exe
  2⤵
  PID:9728
- C:\Windows\System\JKnHhTm.exe
  C:\Windows\System\JKnHhTm.exe
  2⤵
  PID:9744
- C:\Windows\System\REVHNsu.exe
  C:\Windows\System\REVHNsu.exe
  2⤵
  PID:9768
- C:\Windows\System\LXVdbNH.exe
  C:\Windows\System\LXVdbNH.exe
  2⤵
  PID:9796
- C:\Windows\System\xJVxkgj.exe
  C:\Windows\System\xJVxkgj.exe
  2⤵
  PID:9816
- C:\Windows\System\LllLlbd.exe
  C:\Windows\System\LllLlbd.exe
  2⤵
  PID:9832
- C:\Windows\System\YhVSRaS.exe
  C:\Windows\System\YhVSRaS.exe
  2⤵
  PID:9848
- C:\Windows\System\ZPkJtcf.exe
  C:\Windows\System\ZPkJtcf.exe
  2⤵
  PID:9864
- C:\Windows\System\pxvrXdg.exe
  C:\Windows\System\pxvrXdg.exe
  2⤵
  PID:9888
- C:\Windows\System\YzPXnGn.exe
  C:\Windows\System\YzPXnGn.exe
  2⤵
  PID:9904
- C:\Windows\System\PJDklBz.exe
  C:\Windows\System\PJDklBz.exe
  2⤵
  PID:9920
- C:\Windows\System\TMHNvTw.exe
  C:\Windows\System\TMHNvTw.exe
  2⤵
  PID:9980
- C:\Windows\System\VTbUpAe.exe
  C:\Windows\System\VTbUpAe.exe
  2⤵
  PID:9996
- C:\Windows\System\BTmrHSw.exe
  C:\Windows\System\BTmrHSw.exe
  2⤵
  PID:10012
- C:\Windows\System\KjLAqgu.exe
  C:\Windows\System\KjLAqgu.exe
  2⤵
  PID:10032
- C:\Windows\System\EFZpvkw.exe
  C:\Windows\System\EFZpvkw.exe
  2⤵
  PID:10052
- C:\Windows\System\aJSIrgp.exe
  C:\Windows\System\aJSIrgp.exe
  2⤵
  PID:10068
- C:\Windows\System\aWZmKnp.exe
  C:\Windows\System\aWZmKnp.exe
  2⤵
  PID:10092
- C:\Windows\System\lYkvstd.exe
  C:\Windows\System\lYkvstd.exe
  2⤵
  PID:10112
- C:\Windows\System\UKybLsb.exe
  C:\Windows\System\UKybLsb.exe
  2⤵
  PID:10128
- C:\Windows\System\rUTaSXk.exe
  C:\Windows\System\rUTaSXk.exe
  2⤵
  PID:10144
- C:\Windows\System\GEmuHqV.exe
  C:\Windows\System\GEmuHqV.exe
  2⤵
  PID:10164
- C:\Windows\System\opbIKgc.exe
  C:\Windows\System\opbIKgc.exe
  2⤵
  PID:10188
- C:\Windows\System\DFwhcto.exe
  C:\Windows\System\DFwhcto.exe
  2⤵
  PID:10208
- C:\Windows\System\SQTPmyl.exe
  C:\Windows\System\SQTPmyl.exe
  2⤵
  PID:10224
- C:\Windows\System\WQJylyc.exe
  C:\Windows\System\WQJylyc.exe
  2⤵
  PID:9248
- C:\Windows\System\IjWqeLv.exe
  C:\Windows\System\IjWqeLv.exe
  2⤵
  PID:9072
- C:\Windows\System\HEuuLIO.exe
  C:\Windows\System\HEuuLIO.exe
  2⤵
  PID:9288
- C:\Windows\System\jpfpRlr.exe
  C:\Windows\System\jpfpRlr.exe
  2⤵
  PID:9296
- C:\Windows\System\EoJyIhw.exe
  C:\Windows\System\EoJyIhw.exe
  2⤵
  PID:9368
- C:\Windows\System\QuvbnVS.exe
  C:\Windows\System\QuvbnVS.exe
  2⤵
  PID:8460
- C:\Windows\System\KeIEfrT.exe
  C:\Windows\System\KeIEfrT.exe
  2⤵
  PID:9312
- C:\Windows\System\gVZwocf.exe
  C:\Windows\System\gVZwocf.exe
  2⤵
  PID:9412
- C:\Windows\System\TnlZUfD.exe
  C:\Windows\System\TnlZUfD.exe
  2⤵
  PID:9436
- C:\Windows\System\CzDPopV.exe
  C:\Windows\System\CzDPopV.exe
  2⤵
  PID:9452
- C:\Windows\System\SODWmcP.exe
  C:\Windows\System\SODWmcP.exe
  2⤵
  PID:9484
- C:\Windows\System\ozKqbIl.exe
  C:\Windows\System\ozKqbIl.exe
  2⤵
  PID:9540
- C:\Windows\System\RlCrvlY.exe
  C:\Windows\System\RlCrvlY.exe
  2⤵
  PID:9528
- C:\Windows\System\MVfiQxp.exe
  C:\Windows\System\MVfiQxp.exe
  2⤵
  PID:9588
- C:\Windows\System\emkuJto.exe
  C:\Windows\System\emkuJto.exe
  2⤵
  PID:9572
- C:\Windows\System\DiPAbOB.exe
  C:\Windows\System\DiPAbOB.exe
  2⤵
  PID:9624
- C:\Windows\System\cYlrSdg.exe
  C:\Windows\System\cYlrSdg.exe
  2⤵
  PID:9664
- C:\Windows\System\sHgPPEg.exe
  C:\Windows\System\sHgPPEg.exe
  2⤵
  PID:9688
- C:\Windows\System\SnXylmD.exe
  C:\Windows\System\SnXylmD.exe
  2⤵
  PID:9736
- C:\Windows\System\mKmDoMv.exe
  C:\Windows\System\mKmDoMv.exe
  2⤵
  PID:9780
- C:\Windows\System\FwIIvaH.exe
  C:\Windows\System\FwIIvaH.exe
  2⤵
  PID:9784
- C:\Windows\System\xKgtNHR.exe
  C:\Windows\System\xKgtNHR.exe
  2⤵
  PID:9812
- C:\Windows\System\xQGQucL.exe
  C:\Windows\System\xQGQucL.exe
  2⤵
  PID:9840
- C:\Windows\System\HvkhQUy.exe
  C:\Windows\System\HvkhQUy.exe
  2⤵
  PID:9896
- C:\Windows\System\hZPvMtt.exe
  C:\Windows\System\hZPvMtt.exe
  2⤵
  PID:9932
- C:\Windows\System\aSilSjm.exe
  C:\Windows\System\aSilSjm.exe
  2⤵
  PID:9940
- C:\Windows\System\MJJvlbI.exe
  C:\Windows\System\MJJvlbI.exe
  2⤵
  PID:9968
- C:\Windows\System\OPmihas.exe
  C:\Windows\System\OPmihas.exe
  2⤵
  PID:9992
- C:\Windows\System\qgsgcUy.exe
  C:\Windows\System\qgsgcUy.exe
  2⤵
  PID:10024
- C:\Windows\System\rNcSmBW.exe
  C:\Windows\System\rNcSmBW.exe
  2⤵
  PID:10080
- C:\Windows\System\QWuZfdw.exe
  C:\Windows\System\QWuZfdw.exe
  2⤵
  PID:10124
- C:\Windows\System\HrvVoQt.exe
  C:\Windows\System\HrvVoQt.exe
  2⤵
  PID:10160
- C:\Windows\System\sXdwCkH.exe
  C:\Windows\System\sXdwCkH.exe
  2⤵
  PID:10204
- C:\Windows\System\LgfQJWU.exe
  C:\Windows\System\LgfQJWU.exe
  2⤵
  PID:10232
- C:\Windows\System\IqzlwzM.exe
  C:\Windows\System\IqzlwzM.exe
  2⤵
  PID:8596
- C:\Windows\System\URRoDbO.exe
  C:\Windows\System\URRoDbO.exe
  2⤵
  PID:10184
- C:\Windows\System\aWLyZLG.exe
  C:\Windows\System\aWLyZLG.exe
  2⤵
  PID:8772
- C:\Windows\System\dXWguXH.exe
  C:\Windows\System\dXWguXH.exe
  2⤵
  PID:9076
- C:\Windows\System\qhgYoBV.exe
  C:\Windows\System\qhgYoBV.exe
  2⤵
  PID:9364
- C:\Windows\System\PrBSwsC.exe
  C:\Windows\System\PrBSwsC.exe
  2⤵
  PID:8800
- C:\Windows\System\UnHwWxw.exe
  C:\Windows\System\UnHwWxw.exe
  2⤵
  PID:9420
- C:\Windows\System\mbrXUrM.exe
  C:\Windows\System\mbrXUrM.exe
  2⤵
  PID:9040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkaVSdN.exe

Filesize
1.7MB

MD5
8ffa6078a9f4dfdbe1c2aecbc8aee10e

SHA1
a897459d0fd141ecc48a59bef271fedbeee13c50

SHA256
ab4e9b8db75779acf9b8e77a6d894c1dd971dc7f33a6013d0c53703352973ac6

SHA512
2766548064d57e885eec19b549b8e1b9883d5b58a023261a01aef62cdf02d17b08b6d991bb1ccb465e40458dcc9ae3787b39cd52a80a916eac90ea9cafe69ef9

Download Submit
C:\Windows\system\CjCGGFU.exe

Filesize
1.7MB

MD5
7a5e6d6c899dfddede815a7e8c5af8be

SHA1
a9896692fd1a3008b29c7336443a94f3883fbc12

SHA256
564d50d591cec7f7981a5b7713b390cf4dd1fd92f676eff553732705c0dd4480

SHA512
2f7f6bea198c9206eb095d339df6fb549679fb16d8e51b25b6eb80684f4d0a11337a8a7c99a90be3ef9f11994dbe55ebc9bd6c154babe8946c3bbb9373d484de

Download Submit
C:\Windows\system\DrKvvfq.exe

Filesize
1.7MB

MD5
b4fde388f104aa773222d62b6abcc082

SHA1
9865471f6ad7d02d717a5fbb4679b63760d333d3

SHA256
a11c8cf680205200c6e67db8a0f2a0a29443964ef5d9263f8c131dc49780c138

SHA512
b1784c2a7c2b5d57c2734e14e0a5d32b1aab0f7d49321582de41a014f7b9db2c47bea544ff7a688b6e7883e08170aba30f1948d368ab649da15b385e2498cdec

Download Submit
C:\Windows\system\FJSxcRE.exe

Filesize
1.7MB

MD5
284ac8243598536351cea8d6184fe70e

SHA1
5759f22a062f70a6a656763b4ca8d97a2d5788ca

SHA256
31db06ac5210825dccfa383b59ae5d5945bb684138e908610b7ef7c667df1562

SHA512
a6cf742578665d5e5ea0fa4b0ec64f7a69805ee42edd31c0c9ef948646f5e7ff91c513d4bcf43222f548788879e9bf4120d750e07894012681394c47c52a3e33

Download Submit
C:\Windows\system\NBupdIU.exe

Filesize
1.7MB

MD5
bb7a2307479bc1fdf75816aafe04dc6e

SHA1
f247d45fd2eca340b984702a1549a3586a81a2f8

SHA256
1b363dbfb787da8b8cc1acf5ab5c22bffd34dc64ba9e268ac007195e2cb7dfe2

SHA512
092ed99d3050cf7e5f02c44b245f125aef7e27042186954045d86a6cf13cbd49ba06597fae4dc410d28e74f3e682be3a7bf0114ee92315766e24f7ead16933a0

Download Submit
C:\Windows\system\NpwDJZM.exe

Filesize
1.7MB

MD5
f50bca2173761893ccc9d1dcea9ba52a

SHA1
6f15981515ffa14f7526ef96bfa289c501b1abd5

SHA256
04800c54df9ef09073c763698b286f4da221f0de01b9e5fc6189a97b2232f9d5

SHA512
e209b75f2add86b6fd777ab1a9d8605f6a359e69aea5498ac0dfc6972d2d62604f3804376423dd8f2db5d52294bca563f191227c111dc13c283bd34534437747

Download Submit
C:\Windows\system\OdKlYFG.exe

Filesize
1.7MB

MD5
85716eb038ab970805ae1873c64f882d

SHA1
6334b0c33cd354acf0db084e244005b1e0bbc9c0

SHA256
ad136b82b7a3b9a8a3e800530cf5f4340c94e6baab42e46a694954cf4a508bdf

SHA512
950a89cbb5f16a7027b80cae6d422cf4436b4f3f339a666764e79b0e3aa01273b6439440379b16ab45e7dc52b62c9379d0f522506075165a4d8193999e867fb4

Download Submit
C:\Windows\system\PjEaYAU.exe

Filesize
1.7MB

MD5
6743a80089ff536d8ab9ca6f33399012

SHA1
1edbc7a585a3b47bdd9b5008d2c7f0bfadccb4ef

SHA256
437c1890dc021eca3c70dc8e207c70bec2fd95680bb2e351784bdea21dc28a8f

SHA512
48670ccd72e7e3a8c2acc5963eede5dc89919b7dfb1707dd3c25d026e1524e0ff2780bd16b42a642cef003d24e20a30a04f8ee723aa7b00e5c51bee78cf7a6f7

Download Submit
C:\Windows\system\QNcaWPI.exe

Filesize
1.7MB

MD5
a0684b459e9c22d927d62c2d69323186

SHA1
360b6621af4968da4ec177cd99218d056969b8ec

SHA256
5115fe97eb40e238bc38b45e2bf815c69213836f833c9af655adaca3857d2979

SHA512
0367b6e22326863c18cf1e5f640486c710e92fd1e07159a35f3578829dcea1e0157732d4d6dd3d430c491ce797c2edfdc89b4cfb58591ff01c3ea0abe6955ccf

Download Submit
C:\Windows\system\RLTDkYm.exe

Filesize
1.7MB

MD5
5e83cbc2254aef6a2222ce2c8cafda17

SHA1
2ddb4e7e79237b1170e0f123ad051c8e48ddd259

SHA256
877a2d3e5c27993d3834006adb5cff2e6821fc15acb21c71f383ac16a0f68276

SHA512
342f4e5b15a572b91580c33ef90e9626a428e917584cf9bdefcac49c3a8bbd460a9d0fac48f409d9076b67b72489419874dcba84f9ba0af859b5a83c5526dddd

Download Submit
C:\Windows\system\RkZNGkL.exe

Filesize
1.7MB

MD5
d047024eca3aef38d168ed6ac3754ebc

SHA1
6477aeee30ed6fc344ebec042cb72c3d69a10f8a

SHA256
3f227400233916ae08bb9549463352e4003ef43cc58d2fe00b62094a4000e165

SHA512
0dbc979c42b963ac599c76aefd5d41a7649fb9a56adb3ecbe07b0a064ed66c5f7986bd5c4b55aad90142753f4166316ee4e034484a8ec4fd1804a2866c02b4d5

Download Submit
C:\Windows\system\TADJThR.exe

Filesize
1.7MB

MD5
319cc2360703a788ebda9340ab72da5b

SHA1
6e4877eb1c5f77cf75a1c904853ff5d6d403ac6e

SHA256
871df10ab22a04bc213c17a05b398d4e91c7c66ed9d070c065076a07c3bd822b

SHA512
aaadf5fc1cfad6e2e219debc81736739c71ec85b8b07f52895b474135b03a0946580579a2ae256a5aec11875d6ac965730ce5d12f24144148459b7e4bd978691

Download Submit
C:\Windows\system\UnuSRsj.exe

Filesize
1.7MB

MD5
7f72fcbaa5a3fc1c6e9a5e1c6180c30a

SHA1
c49889ec67a4cb00cd0c84cba2e6af9a46d00392

SHA256
119585395a730135543ecb96bdf7afc63d699673be6b0cc81f32b1811a73689f

SHA512
2398a53fc8ccece53fbf13a7f9febc2d38712c2e0dc874f8ba866ecabca08a7558cca637ffa0bd9b32105f385dfd191dde9967dfcfa924a35808ce9fe210dcfe

Download Submit
C:\Windows\system\WoiZnhc.exe

Filesize
1.7MB

MD5
25a1b2cdd044f1f668f6215a084e78ce

SHA1
382668a56e574d76e2e5bc8b937e1d69ad88208f

SHA256
159ade95f5ed85078c9f4ce3cf0c480595ad4ec9f02c2375f90430465548d29c

SHA512
099abae97e397a6adcad82db7742dd25f28a5637adba045d356fbe99738dd159a3621f676d85b951f456d23784eaac3abd50c7ae32088a01dc4c258ea33c4257

Download Submit
C:\Windows\system\XhzJNub.exe

Filesize
1.7MB

MD5
9d3a7310a14fa4c97f6fa067bdeeb204

SHA1
98e27a69e219193ba7e2f4f42e8f8805d955936f

SHA256
144b9f49ac7497af4a856b1c7839069fc1c05ac306678c72323ce957aa853212

SHA512
448a3bc507c6ccd39e63f2395d4be74442fc82728918919610351d001ae9ef763a73ac6c58087a696a557acfc25a5e59c698b7aafdbca5580300061af04143ef

Download Submit
C:\Windows\system\YqvFOnh.exe

Filesize
1.7MB

MD5
44b1ec2353a830204a09980b291b5612

SHA1
53693bfb43dda291703e0637348b5ce9e340a53d

SHA256
915cbba35fb2e8e59deb9fd654c51fca8ae061bc807b832495070d5e3d934d2b

SHA512
f70d4344572e451553cc5e7fc3d7c8ef02978bc1a602f3a39adff13ff0fd91f069842e6d258092723c792905a6daaaedd0a85f09a7e1c0d5459768903c9b1e8d

Download Submit
C:\Windows\system\aiAhZIG.exe

Filesize
1.7MB

MD5
c23420287b546be0fbcd38bcc6821ea2

SHA1
7141065d0fd42f7e6f849088a6933d02180aa922

SHA256
1e5e6e12716a4f9a191bbbfab3495116b45d336da50e970fe8d057fd29cea42d

SHA512
50a4956dbfad859d7694ba694028440b24506def11b788aa8d0d113f64d5fe81143ecd812fe19cd885b3db3869c9f5923e2097e7bb09b5c7d5fd50714d84904e

Download Submit
C:\Windows\system\bYQPkEQ.exe

Filesize
1.7MB

MD5
e538817c4659541ed253b9a4a72c948a

SHA1
ad0831f4310c0be434b0d28ed6bfa676ca19a789

SHA256
2724f8295034ebe8935a61e504bda2bb423c72d8aafc4a8f3f6e7507eac0818c

SHA512
3272e03aab18112aa05095bcd871c6da7edce61faade30898ed86c9ba57d6d804d5e2cdc350bb7714bc31d0f660919bb6f5068c7eb152ece6484e24a1441e753

Download Submit
C:\Windows\system\bgNAPgs.exe

Filesize
1.7MB

MD5
352670c57f5df3df7d5b455ead7608e1

SHA1
618f1a153857ee3e1c4b4264c78467d22944de5a

SHA256
ddfc865f0f4c52e5fd4aac59ff4cd770a3491c7c22784e464f50d0a6cd05dc83

SHA512
734920627367456bec8af3cc4035ee74ddad2764031a32a2466b6cf56616d2b149b17e58512c2791b89e40adcbfb0e6d3ff47264b939bc0e4418f3911110c21c

Download Submit
C:\Windows\system\bnMWxfa.exe

Filesize
1.7MB

MD5
bd15fd1788b51e36d0e885d28addd13d

SHA1
60a74db426c4ce9f1102e6ee52ff89df14753ca5

SHA256
d9c723d824266d05c04245bde552ef90085aae18ffa670daeddadadf9cbd93b1

SHA512
920ed90c2a2743b7e76877dea60c57c42c75c822a8e8e4b18fc8803d5a119cae56dff8b50f8e1996859497791c401f371cbbdebe86b124d09801e456f881c40b

Download Submit
C:\Windows\system\hkqKXOC.exe

Filesize
1.7MB

MD5
889412bf03b94f48ff618cb83053a0ad

SHA1
0daf05254d12e5785f515dc651fef375841ec709

SHA256
166d2cd6c21f3a37fbe8dbe2885159967484ae298449bac6498201514bf35ef2

SHA512
0b2253ba87bc2fa9c792bcd8abb1c0d71147d718bd13e8b3aad03c7aeee35b525b4579e461322b248df448c13759b6f3eacef62b4b9428cd4546698d3c655a7a

Download Submit
C:\Windows\system\lOtRUhu.exe

Filesize
1.7MB

MD5
9b8a064dc8a766f07e738b4330475430

SHA1
49db9372ebf4dd2f8dc4b4d36c16824ddde8f2d8

SHA256
be2a944cf8c0ec6ec21d4ed17842ae2ab31c5359b5b6213ff713ddf237d8ad39

SHA512
687673431a58d425b8d52039ee3fc87a59510ebc7f784dd753332f62f8593bc550353c4de56722f537fdbccdc8e2f0af70a69120b84bede2be0a030a7f48de98

Download Submit
C:\Windows\system\lhDlWbA.exe

Filesize
1.7MB

MD5
467dd63cfb8a8280cc3773a693ad8312

SHA1
9080d633a942811df91a48c3b7a443c54f2a0b73

SHA256
ae53b60561111f21a82c6f05788db90db18d9aca0e40d3089bed8d4f75168f44

SHA512
3e65e6b62f5b3e7b3ee2b4e8ca226163556d311305f0370ec6b82c09cd8e1c0b4b70d8ab2f38e4db79b6e09261bd680991eb52f4f576378fbb0d826e7b54567e

Download Submit
C:\Windows\system\lrRWyHf.exe

Filesize
1.7MB

MD5
c7ff73b9c8d6d3d03dc38dd114ede5c3

SHA1
feb4112dec7a69a20b98923be5474f1181072188

SHA256
82a4e3e5df41bfa6696e3ad11fab1b396ba85dd2a3103b267c27352c4bc6b130

SHA512
0c0195b5d53daf4dc394faf76c7964c960ffdc9e369bc538eeb4744ee60fde4dc46f7bcf6691141a8ca593cd38ffe77f65d20b382e590957efac59c11695504d

Download Submit
C:\Windows\system\ltysVxL.exe

Filesize
1.7MB

MD5
8e24eded0cb2e373eea2ae6eb42bbe49

SHA1
994eb994069869612d2ed08fc69b6a3a8a98d923

SHA256
9432c8b8d59b857e481e0d4d0415373b51f8e19c83576e45b0c3ba3a2289de76

SHA512
aeb90a0a00fe321b4b57ced14c4723620fab627e64acb3360561f422d4ec916a101a4035df8eda6d666783fa3d4b5d8dd229fe10a667c5ded23f4e3bced04489

Download Submit
C:\Windows\system\mmDweNM.exe

Filesize
1.7MB

MD5
d2da9f09cf11fd7e1b94c580ffa08584

SHA1
8ffde863e04df971c6f8db391242b7c64382cbc3

SHA256
aae4c20abf5c1886f052b0b54aedebc8f4d043cb276e816944878b2b5cdc2a37

SHA512
8303ea53235016fb054c0fe5824ddb73f7306adfff0430d6764d55b5bd344b995647eb4d95d77933270c9a4b5cdf35519a2f625ecd8647eb3a82726f2a04ab8f

Download Submit
C:\Windows\system\qbWbmjT.exe

Filesize
1.7MB

MD5
d5b250863ea4dda0f5fbaa4502c4b597

SHA1
15e4f6767834d554be9c051ab56f39077faee032

SHA256
1e3d796d7b3bc98ba0966dbbc5504f06397bb9bc3940dfe3fef0d2cceeda2d32

SHA512
4899cd72be3fabf629d2679bde9706273123e135bf97dabbbc22371f6257fdd0547cc02a969bde6ebbd94c19cede7380e8b260dbadeed9c19d25a376a0643359

Download Submit
C:\Windows\system\szbJocy.exe

Filesize
1.7MB

MD5
f983516dcc63a17f7c8b958221611572

SHA1
98a32e7cafb3cdfacf8a337ed742bf7199d6dbb6

SHA256
97c0086ff6930a3230e077fb106075fdcb27742edb67ab84608921a5426bc48c

SHA512
4a01ad47c36a3aa73e63f246c244c77010ea91399b72c7efc9d2518ae33365075fdf953049df7556f54cb86a5e3d57c40889a54b63ade4811e8e26db44b1e3c8

Download Submit
C:\Windows\system\tdibcsH.exe

Filesize
1.7MB

MD5
d77c60866c8a4217ab5d1d522ac797c8

SHA1
e3a216de08343f2b600a524f9adcedac8859e039

SHA256
0c5c1e5c6d131d6531c606f7481ba2af8876e79425839bf594b52b8b2af168b5

SHA512
1dbacb9438dbc274877a385c0640884dc11a6c15e1ebe15a5d798025f837b239ffba5c2613568cb603d91df0aaf91bdff0944d5359b648366206480d038ccbde

Download Submit
C:\Windows\system\vSsPrWe.exe

Filesize
1.7MB

MD5
4aa426bac5dff9983b735b1046b8bdde

SHA1
fc1e76627ddc8d255bb61d3a9f16df940d525f01

SHA256
30292a2e37faf0265c85fe125f02532c7adf377081a0d08dd7b2207849a35164

SHA512
286612fb73a75c2b4206090bca4b96b4eb85ea101ba5e87abf77d40efd982fc607baf9eea4ae633795f37d3b084d06e868ca1aa003193344ccd612a22ddd938b

Download Submit
\Windows\system\jIAYVLP.exe

Filesize
1.7MB

MD5
55fee3c17685a8af5d542c715b96534d

SHA1
df487fc5f9c7577640a7cd4df890c50582ebcc69

SHA256
1beecd387406c5297ae7da0ecb6faee7421d0c4d29a4a3432f8edcc7d88df791

SHA512
225fc42c3fcf534a08d1a8c91c527f8bf906ba26ce5bd22f1afd388fead08a3cb3d2d58a7c7a76b1219a91f0cd8255381cfb37fd63b6597835aa12a62d261fd8

Download Submit
\Windows\system\yVJVQSl.exe

Filesize
1.7MB

MD5
888fa273a1a0dad42b2db7104bc600b8

SHA1
a673e701c3da7780e7ad7beaf7393b57878e7d3d

SHA256
790ff9ffbd7955ef401bda1caed5c5a8e599ebb2df42a4361226b0a960511c4f

SHA512
28a90bce1af30cdb9814170bc4b538a31eb8f31580bfb7d1c22d782404beb04dba3e86f6be72da1173ece440328be0b812e8c42bfb9c6d09f33b563343db94b0

Download Submit
memory/2188-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download