xmrig | 72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
Size

1.5MB
MD5

b64d683bc9483e2a68ffaa2487419cc3
SHA1

1e51c5a39572d2aa7a30853b7e8d68e7ec2d4bd7
SHA256

72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4
SHA512

0014ef5dffe5e01fb2a4fc6150aa1316843223cd4f9ca6832ccc356e5f4f5b8bbc197622ec315427d9a2a367dd429008bbbf4a95bfaca7a807241d2b95c76d80
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLEKAo:GezaTF8FcNkNdfE0pZ9ozttwIRxecdGv

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00090000000120f1-5.dat	xmrig
behavioral1/files/0x00080000000171a8-14.dat	xmrig
behavioral1/files/0x0008000000016fdf-9.dat	xmrig
behavioral1/files/0x00080000000173a9-18.dat	xmrig
behavioral1/files/0x0007000000017492-19.dat	xmrig
behavioral1/files/0x00070000000174cc-25.dat	xmrig
behavioral1/files/0x0005000000019431-61.dat	xmrig
behavioral1/files/0x000500000001950c-77.dat	xmrig
behavioral1/files/0x0005000000019609-90.dat	xmrig
behavioral1/files/0x000500000001961d-127.dat	xmrig
behavioral1/files/0x000500000001961b-125.dat	xmrig
behavioral1/files/0x0005000000019619-122.dat	xmrig
behavioral1/files/0x0005000000019617-117.dat	xmrig
behavioral1/files/0x0005000000019615-114.dat	xmrig
behavioral1/files/0x0005000000019611-103.dat	xmrig
behavioral1/files/0x0005000000019613-108.dat	xmrig
behavioral1/files/0x000500000001960d-98.dat	xmrig
behavioral1/files/0x000500000001960f-101.dat	xmrig
behavioral1/files/0x000500000001960b-93.dat	xmrig
behavioral1/files/0x00050000000195c5-85.dat	xmrig
behavioral1/files/0x0005000000019582-81.dat	xmrig
behavioral1/files/0x0005000000019461-73.dat	xmrig
behavioral1/files/0x000500000001944f-69.dat	xmrig
behavioral1/files/0x0005000000019441-65.dat	xmrig
behavioral1/files/0x0005000000019427-57.dat	xmrig
behavioral1/files/0x000500000001941e-53.dat	xmrig
behavioral1/files/0x00050000000193e1-49.dat	xmrig
behavioral1/files/0x00050000000193c2-45.dat	xmrig
behavioral1/files/0x00050000000193b4-41.dat	xmrig
behavioral1/files/0x0005000000019350-37.dat	xmrig
behavioral1/files/0x00080000000186e4-33.dat	xmrig
behavioral1/files/0x000e000000018676-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2372	cGPRqUl.exe
2420	QVVcYhL.exe
1792	OmaUXiZ.exe
2936	OkEkRrz.exe
2260	kFHiYBg.exe
2860	oxQGbgi.exe
2884	CJfBScT.exe
2768	DRyhwFy.exe
3044	jBAiXwI.exe
2940	OcKykRi.exe
2772	LbraeRv.exe
2956	fscxgTt.exe
2748	PfRmUaf.exe
2808	jyeuVqf.exe
2624	MbnVphJ.exe
2688	NwdNBkh.exe
2360	oIvEKql.exe
2144	wdPxjXo.exe
1848	lSRwZCC.exe
2928	oihWEqW.exe
1916	SKNBOIY.exe
2444	qPSsakA.exe
2924	DkYqorh.exe
2972	ZJUtiVT.exe
3000	XSfaAow.exe
2160	JIWyEjY.exe
1408	iDpEJzZ.exe
2316	OJBuubr.exe
2568	TBpCRMK.exe
264	eSKIrJp.exe
1624	cQgSrwI.exe
2564	nCftKxL.exe
1192	tJzVPfx.exe
704	YULxAMQ.exe
1484	kwguBiN.exe
1856	ZjfdGKY.exe
1496	pxkybBF.exe
3064	WKCrecx.exe
2176	gaaLZhU.exe
2072	XhBKtyD.exe
1132	AckCxvh.exe
1332	zciaxkq.exe
2028	FiFxVvv.exe
1340	ZTnkVbZ.exe
1860	BWXpVCh.exe
292	eZIJPWG.exe
1704	CxuUHxG.exe
2200	LHhsgAY.exe
2820	dKlWmir.exe
1568	PiYCGbu.exe
1184	DLnaLFs.exe
760	jxNJpnD.exe
1716	cSOaPeg.exe
908	rFleVNW.exe
2484	rYaZZbU.exe
2500	greFejF.exe
2480	PVQytEc.exe
840	fDUySqn.exe
3052	fUAOnUm.exe
1444	rNCNrjY.exe
2712	YqaHuJN.exe
2308	yIMRrbq.exe
2856	KZoixyg.exe
1632	tWrimVs.exe

Loads dropped DLL 64 IoCs

pid	Process
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oqBRVEZ.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\MnfOVRa.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\wELuMop.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\FtiVVTh.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\Nkwwfee.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ODVePVU.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\bOioyBC.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\hebwhLt.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\WezLzlP.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\tmWzqyL.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\feBGASf.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\PVQytEc.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\xCSDNUl.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\kASeHYX.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\rocFejv.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ofoaqHj.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\pAeKMks.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\SGACvqR.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\FPSipxb.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\mRENDSI.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\GmxcpwP.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\PWzVPER.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\btHHATb.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\gqdyZiG.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\pfgUrYW.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\BxSXHaL.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\gGKIcfU.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ggCrEmn.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ZizDLSZ.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\cQgSrwI.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\kwguBiN.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\RKlEpgo.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\qUfdbua.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ljeIOca.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\MwADYfF.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\ECgslVS.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\OmaUXiZ.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\KZoixyg.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\pONiRPz.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\VlUsFLZ.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\pgAOjqf.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\uCFjLqb.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\NihamiA.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\rqDGwLg.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\lSRwZCC.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\KGYikTN.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\pCHOIGI.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\NmWhQHM.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\BNpXSrE.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\FcZiDAy.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\UHJKxRR.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\Fdszsgn.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\hMiVgYO.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\WMbzTNt.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\WOVoEIV.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\wxStOYf.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\EztwBke.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\GwAxLjU.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\KTYznHB.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\WCUfqtM.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\YMShwrH.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\fdmhtbR.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\TexLuyU.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
File created	C:\Windows\System\VTybwCx.exe	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2372	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	31
PID 2408 wrote to memory of 2372	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	31
PID 2408 wrote to memory of 2372	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	31
PID 2408 wrote to memory of 2420	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	32
PID 2408 wrote to memory of 2420	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	32
PID 2408 wrote to memory of 2420	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	32
PID 2408 wrote to memory of 1792	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	33
PID 2408 wrote to memory of 1792	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	33
PID 2408 wrote to memory of 1792	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	33
PID 2408 wrote to memory of 2936	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	34
PID 2408 wrote to memory of 2936	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	34
PID 2408 wrote to memory of 2936	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	34
PID 2408 wrote to memory of 2260	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	35
PID 2408 wrote to memory of 2260	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	35
PID 2408 wrote to memory of 2260	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	35
PID 2408 wrote to memory of 2860	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	36
PID 2408 wrote to memory of 2860	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	36
PID 2408 wrote to memory of 2860	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	36
PID 2408 wrote to memory of 2884	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	37
PID 2408 wrote to memory of 2884	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	37
PID 2408 wrote to memory of 2884	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	37
PID 2408 wrote to memory of 2768	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	38
PID 2408 wrote to memory of 2768	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	38
PID 2408 wrote to memory of 2768	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	38
PID 2408 wrote to memory of 3044	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	39
PID 2408 wrote to memory of 3044	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	39
PID 2408 wrote to memory of 3044	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	39
PID 2408 wrote to memory of 2940	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	40
PID 2408 wrote to memory of 2940	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	40
PID 2408 wrote to memory of 2940	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	40
PID 2408 wrote to memory of 2772	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	41
PID 2408 wrote to memory of 2772	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	41
PID 2408 wrote to memory of 2772	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	41
PID 2408 wrote to memory of 2956	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	42
PID 2408 wrote to memory of 2956	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	42
PID 2408 wrote to memory of 2956	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	42
PID 2408 wrote to memory of 2748	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	43
PID 2408 wrote to memory of 2748	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	43
PID 2408 wrote to memory of 2748	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	43
PID 2408 wrote to memory of 2808	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	44
PID 2408 wrote to memory of 2808	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	44
PID 2408 wrote to memory of 2808	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	44
PID 2408 wrote to memory of 2624	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	45
PID 2408 wrote to memory of 2624	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	45
PID 2408 wrote to memory of 2624	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	45
PID 2408 wrote to memory of 2688	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	46
PID 2408 wrote to memory of 2688	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	46
PID 2408 wrote to memory of 2688	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	46
PID 2408 wrote to memory of 2360	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	47
PID 2408 wrote to memory of 2360	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	47
PID 2408 wrote to memory of 2360	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	47
PID 2408 wrote to memory of 2144	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	48
PID 2408 wrote to memory of 2144	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	48
PID 2408 wrote to memory of 2144	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	48
PID 2408 wrote to memory of 1848	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	49
PID 2408 wrote to memory of 1848	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	49
PID 2408 wrote to memory of 1848	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	49
PID 2408 wrote to memory of 2928	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	50
PID 2408 wrote to memory of 2928	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	50
PID 2408 wrote to memory of 2928	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	50
PID 2408 wrote to memory of 1916	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	51
PID 2408 wrote to memory of 1916	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	51
PID 2408 wrote to memory of 1916	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	51
PID 2408 wrote to memory of 2444	2408	72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe	52

C:\Users\Admin\AppData\Local\Temp\72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe
"C:\Users\Admin\AppData\Local\Temp\72be7ad74cd1c5a771e2202638c6dc3447a9c8ac9d6fea1afa1690ac4c3a6de4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\System\cGPRqUl.exe
  C:\Windows\System\cGPRqUl.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\QVVcYhL.exe
  C:\Windows\System\QVVcYhL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\OmaUXiZ.exe
  C:\Windows\System\OmaUXiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\OkEkRrz.exe
  C:\Windows\System\OkEkRrz.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\kFHiYBg.exe
  C:\Windows\System\kFHiYBg.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\oxQGbgi.exe
  C:\Windows\System\oxQGbgi.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\CJfBScT.exe
  C:\Windows\System\CJfBScT.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\DRyhwFy.exe
  C:\Windows\System\DRyhwFy.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\jBAiXwI.exe
  C:\Windows\System\jBAiXwI.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\OcKykRi.exe
  C:\Windows\System\OcKykRi.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\LbraeRv.exe
  C:\Windows\System\LbraeRv.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\fscxgTt.exe
  C:\Windows\System\fscxgTt.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\PfRmUaf.exe
  C:\Windows\System\PfRmUaf.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\jyeuVqf.exe
  C:\Windows\System\jyeuVqf.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\MbnVphJ.exe
  C:\Windows\System\MbnVphJ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NwdNBkh.exe
  C:\Windows\System\NwdNBkh.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\oIvEKql.exe
  C:\Windows\System\oIvEKql.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\wdPxjXo.exe
  C:\Windows\System\wdPxjXo.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\lSRwZCC.exe
  C:\Windows\System\lSRwZCC.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\oihWEqW.exe
  C:\Windows\System\oihWEqW.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\SKNBOIY.exe
  C:\Windows\System\SKNBOIY.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\qPSsakA.exe
  C:\Windows\System\qPSsakA.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\DkYqorh.exe
  C:\Windows\System\DkYqorh.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ZJUtiVT.exe
  C:\Windows\System\ZJUtiVT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\XSfaAow.exe
  C:\Windows\System\XSfaAow.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\iDpEJzZ.exe
  C:\Windows\System\iDpEJzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\JIWyEjY.exe
  C:\Windows\System\JIWyEjY.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\OJBuubr.exe
  C:\Windows\System\OJBuubr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\TBpCRMK.exe
  C:\Windows\System\TBpCRMK.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\eSKIrJp.exe
  C:\Windows\System\eSKIrJp.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\cQgSrwI.exe
  C:\Windows\System\cQgSrwI.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\nCftKxL.exe
  C:\Windows\System\nCftKxL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\tJzVPfx.exe
  C:\Windows\System\tJzVPfx.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\YULxAMQ.exe
  C:\Windows\System\YULxAMQ.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\kwguBiN.exe
  C:\Windows\System\kwguBiN.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ZjfdGKY.exe
  C:\Windows\System\ZjfdGKY.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\pxkybBF.exe
  C:\Windows\System\pxkybBF.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\WKCrecx.exe
  C:\Windows\System\WKCrecx.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\gaaLZhU.exe
  C:\Windows\System\gaaLZhU.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\XhBKtyD.exe
  C:\Windows\System\XhBKtyD.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\AckCxvh.exe
  C:\Windows\System\AckCxvh.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\zciaxkq.exe
  C:\Windows\System\zciaxkq.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\FiFxVvv.exe
  C:\Windows\System\FiFxVvv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ZTnkVbZ.exe
  C:\Windows\System\ZTnkVbZ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\BWXpVCh.exe
  C:\Windows\System\BWXpVCh.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\eZIJPWG.exe
  C:\Windows\System\eZIJPWG.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\CxuUHxG.exe
  C:\Windows\System\CxuUHxG.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\LHhsgAY.exe
  C:\Windows\System\LHhsgAY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\dKlWmir.exe
  C:\Windows\System\dKlWmir.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\PiYCGbu.exe
  C:\Windows\System\PiYCGbu.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\DLnaLFs.exe
  C:\Windows\System\DLnaLFs.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\jxNJpnD.exe
  C:\Windows\System\jxNJpnD.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\cSOaPeg.exe
  C:\Windows\System\cSOaPeg.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\rFleVNW.exe
  C:\Windows\System\rFleVNW.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\rYaZZbU.exe
  C:\Windows\System\rYaZZbU.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\greFejF.exe
  C:\Windows\System\greFejF.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\PVQytEc.exe
  C:\Windows\System\PVQytEc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\fDUySqn.exe
  C:\Windows\System\fDUySqn.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\fUAOnUm.exe
  C:\Windows\System\fUAOnUm.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\rNCNrjY.exe
  C:\Windows\System\rNCNrjY.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\YqaHuJN.exe
  C:\Windows\System\YqaHuJN.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\yIMRrbq.exe
  C:\Windows\System\yIMRrbq.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\KZoixyg.exe
  C:\Windows\System\KZoixyg.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\tWrimVs.exe
  C:\Windows\System\tWrimVs.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\CivhHOf.exe
  C:\Windows\System\CivhHOf.exe
  2⤵
  PID:2332
- C:\Windows\System\TPsScXA.exe
  C:\Windows\System\TPsScXA.exe
  2⤵
  PID:1740
- C:\Windows\System\VDhufuU.exe
  C:\Windows\System\VDhufuU.exe
  2⤵
  PID:2040
- C:\Windows\System\bwBqqdU.exe
  C:\Windows\System\bwBqqdU.exe
  2⤵
  PID:2548
- C:\Windows\System\wgnePwp.exe
  C:\Windows\System\wgnePwp.exe
  2⤵
  PID:2536
- C:\Windows\System\nnHTFIg.exe
  C:\Windows\System\nnHTFIg.exe
  2⤵
  PID:1272
- C:\Windows\System\MkxrLSP.exe
  C:\Windows\System\MkxrLSP.exe
  2⤵
  PID:1584
- C:\Windows\System\FUhzQcx.exe
  C:\Windows\System\FUhzQcx.exe
  2⤵
  PID:1552
- C:\Windows\System\AxnrHgn.exe
  C:\Windows\System\AxnrHgn.exe
  2⤵
  PID:1296
- C:\Windows\System\UMCyncD.exe
  C:\Windows\System\UMCyncD.exe
  2⤵
  PID:2460
- C:\Windows\System\aFlNPSm.exe
  C:\Windows\System\aFlNPSm.exe
  2⤵
  PID:2872
- C:\Windows\System\NPVTZys.exe
  C:\Windows\System\NPVTZys.exe
  2⤵
  PID:2736
- C:\Windows\System\GqzabKf.exe
  C:\Windows\System\GqzabKf.exe
  2⤵
  PID:3040
- C:\Windows\System\UiHKCnt.exe
  C:\Windows\System\UiHKCnt.exe
  2⤵
  PID:2636
- C:\Windows\System\SXKVzns.exe
  C:\Windows\System\SXKVzns.exe
  2⤵
  PID:2612
- C:\Windows\System\NsJusHn.exe
  C:\Windows\System\NsJusHn.exe
  2⤵
  PID:2116
- C:\Windows\System\fcLVIRb.exe
  C:\Windows\System\fcLVIRb.exe
  2⤵
  PID:2516
- C:\Windows\System\AQTDfgK.exe
  C:\Windows\System\AQTDfgK.exe
  2⤵
  PID:2156
- C:\Windows\System\zrXscAj.exe
  C:\Windows\System\zrXscAj.exe
  2⤵
  PID:2828
- C:\Windows\System\nMDOrnp.exe
  C:\Windows\System\nMDOrnp.exe
  2⤵
  PID:2816
- C:\Windows\System\CEIrCnc.exe
  C:\Windows\System\CEIrCnc.exe
  2⤵
  PID:1600
- C:\Windows\System\NjFGeJq.exe
  C:\Windows\System\NjFGeJq.exe
  2⤵
  PID:2136
- C:\Windows\System\fbXybUO.exe
  C:\Windows\System\fbXybUO.exe
  2⤵
  PID:592
- C:\Windows\System\XeXnDAz.exe
  C:\Windows\System\XeXnDAz.exe
  2⤵
  PID:2076
- C:\Windows\System\mJWRKnX.exe
  C:\Windows\System\mJWRKnX.exe
  2⤵
  PID:700
- C:\Windows\System\KuuISGI.exe
  C:\Windows\System\KuuISGI.exe
  2⤵
  PID:2060
- C:\Windows\System\WtxOcRB.exe
  C:\Windows\System\WtxOcRB.exe
  2⤵
  PID:2304
- C:\Windows\System\woixNZw.exe
  C:\Windows\System\woixNZw.exe
  2⤵
  PID:3056
- C:\Windows\System\vdTBVXu.exe
  C:\Windows\System\vdTBVXu.exe
  2⤵
  PID:1720
- C:\Windows\System\xSYWetM.exe
  C:\Windows\System\xSYWetM.exe
  2⤵
  PID:1540
- C:\Windows\System\fXXTyoH.exe
  C:\Windows\System\fXXTyoH.exe
  2⤵
  PID:1152
- C:\Windows\System\fdmhtbR.exe
  C:\Windows\System\fdmhtbR.exe
  2⤵
  PID:2068
- C:\Windows\System\Pylqotx.exe
  C:\Windows\System\Pylqotx.exe
  2⤵
  PID:1140
- C:\Windows\System\HHcxQbZ.exe
  C:\Windows\System\HHcxQbZ.exe
  2⤵
  PID:1356
- C:\Windows\System\GWWpWMT.exe
  C:\Windows\System\GWWpWMT.exe
  2⤵
  PID:1724
- C:\Windows\System\FfhGGsD.exe
  C:\Windows\System\FfhGGsD.exe
  2⤵
  PID:1784
- C:\Windows\System\GmxcpwP.exe
  C:\Windows\System\GmxcpwP.exe
  2⤵
  PID:1520
- C:\Windows\System\QbjsUFZ.exe
  C:\Windows\System\QbjsUFZ.exe
  2⤵
  PID:2148
- C:\Windows\System\SWnLouZ.exe
  C:\Windows\System\SWnLouZ.exe
  2⤵
  PID:2224
- C:\Windows\System\MdzdKXC.exe
  C:\Windows\System\MdzdKXC.exe
  2⤵
  PID:692
- C:\Windows\System\eKBVTaA.exe
  C:\Windows\System\eKBVTaA.exe
  2⤵
  PID:1984
- C:\Windows\System\DvXtzHE.exe
  C:\Windows\System\DvXtzHE.exe
  2⤵
  PID:884
- C:\Windows\System\msPXRfk.exe
  C:\Windows\System\msPXRfk.exe
  2⤵
  PID:2340
- C:\Windows\System\vgPYIFh.exe
  C:\Windows\System\vgPYIFh.exe
  2⤵
  PID:1672
- C:\Windows\System\EKDutkI.exe
  C:\Windows\System\EKDutkI.exe
  2⤵
  PID:2004
- C:\Windows\System\jWdIdCs.exe
  C:\Windows\System\jWdIdCs.exe
  2⤵
  PID:2752
- C:\Windows\System\UsGQxQr.exe
  C:\Windows\System\UsGQxQr.exe
  2⤵
  PID:2096
- C:\Windows\System\hBFwqyk.exe
  C:\Windows\System\hBFwqyk.exe
  2⤵
  PID:2724
- C:\Windows\System\vxujcaL.exe
  C:\Windows\System\vxujcaL.exe
  2⤵
  PID:2656
- C:\Windows\System\PaysfOD.exe
  C:\Windows\System\PaysfOD.exe
  2⤵
  PID:2208
- C:\Windows\System\wELuMop.exe
  C:\Windows\System\wELuMop.exe
  2⤵
  PID:2988
- C:\Windows\System\BupqwZQ.exe
  C:\Windows\System\BupqwZQ.exe
  2⤵
  PID:780
- C:\Windows\System\xruwVIt.exe
  C:\Windows\System\xruwVIt.exe
  2⤵
  PID:796
- C:\Windows\System\BlCoFrD.exe
  C:\Windows\System\BlCoFrD.exe
  2⤵
  PID:3080
- C:\Windows\System\HcYbdiN.exe
  C:\Windows\System\HcYbdiN.exe
  2⤵
  PID:3096
- C:\Windows\System\mIQTckV.exe
  C:\Windows\System\mIQTckV.exe
  2⤵
  PID:3112
- C:\Windows\System\fSKXJhU.exe
  C:\Windows\System\fSKXJhU.exe
  2⤵
  PID:3128
- C:\Windows\System\pAqxWJL.exe
  C:\Windows\System\pAqxWJL.exe
  2⤵
  PID:3144
- C:\Windows\System\SUPlSdN.exe
  C:\Windows\System\SUPlSdN.exe
  2⤵
  PID:3160
- C:\Windows\System\HeOKAfU.exe
  C:\Windows\System\HeOKAfU.exe
  2⤵
  PID:3176
- C:\Windows\System\QmuzbON.exe
  C:\Windows\System\QmuzbON.exe
  2⤵
  PID:3192
- C:\Windows\System\hFNeAZB.exe
  C:\Windows\System\hFNeAZB.exe
  2⤵
  PID:3208
- C:\Windows\System\QzIPUmJ.exe
  C:\Windows\System\QzIPUmJ.exe
  2⤵
  PID:3224
- C:\Windows\System\HIOJQms.exe
  C:\Windows\System\HIOJQms.exe
  2⤵
  PID:3240
- C:\Windows\System\zqNCkMi.exe
  C:\Windows\System\zqNCkMi.exe
  2⤵
  PID:3256
- C:\Windows\System\yaDKtDV.exe
  C:\Windows\System\yaDKtDV.exe
  2⤵
  PID:3272
- C:\Windows\System\jVhLdJK.exe
  C:\Windows\System\jVhLdJK.exe
  2⤵
  PID:3288
- C:\Windows\System\yzUDWcF.exe
  C:\Windows\System\yzUDWcF.exe
  2⤵
  PID:3304
- C:\Windows\System\fTUwTvH.exe
  C:\Windows\System\fTUwTvH.exe
  2⤵
  PID:3320
- C:\Windows\System\EJiQjlS.exe
  C:\Windows\System\EJiQjlS.exe
  2⤵
  PID:3336
- C:\Windows\System\LWmZzdM.exe
  C:\Windows\System\LWmZzdM.exe
  2⤵
  PID:3352
- C:\Windows\System\CJRfSLQ.exe
  C:\Windows\System\CJRfSLQ.exe
  2⤵
  PID:3368
- C:\Windows\System\kQEPfdK.exe
  C:\Windows\System\kQEPfdK.exe
  2⤵
  PID:3384
- C:\Windows\System\OijIzyO.exe
  C:\Windows\System\OijIzyO.exe
  2⤵
  PID:3400
- C:\Windows\System\VJvLiqQ.exe
  C:\Windows\System\VJvLiqQ.exe
  2⤵
  PID:3416
- C:\Windows\System\UlUEevM.exe
  C:\Windows\System\UlUEevM.exe
  2⤵
  PID:3432
- C:\Windows\System\xapEUUR.exe
  C:\Windows\System\xapEUUR.exe
  2⤵
  PID:3448
- C:\Windows\System\XqPqmWQ.exe
  C:\Windows\System\XqPqmWQ.exe
  2⤵
  PID:3464
- C:\Windows\System\fWvedDP.exe
  C:\Windows\System\fWvedDP.exe
  2⤵
  PID:3480
- C:\Windows\System\dIVFpwI.exe
  C:\Windows\System\dIVFpwI.exe
  2⤵
  PID:3496
- C:\Windows\System\UiBbORR.exe
  C:\Windows\System\UiBbORR.exe
  2⤵
  PID:3512
- C:\Windows\System\rxXCSoj.exe
  C:\Windows\System\rxXCSoj.exe
  2⤵
  PID:3528
- C:\Windows\System\ogpVmVM.exe
  C:\Windows\System\ogpVmVM.exe
  2⤵
  PID:3544
- C:\Windows\System\AkQPWVM.exe
  C:\Windows\System\AkQPWVM.exe
  2⤵
  PID:3560
- C:\Windows\System\pfgUrYW.exe
  C:\Windows\System\pfgUrYW.exe
  2⤵
  PID:3576
- C:\Windows\System\azHodHN.exe
  C:\Windows\System\azHodHN.exe
  2⤵
  PID:3592
- C:\Windows\System\DJZyxBQ.exe
  C:\Windows\System\DJZyxBQ.exe
  2⤵
  PID:3608
- C:\Windows\System\hbnqeuK.exe
  C:\Windows\System\hbnqeuK.exe
  2⤵
  PID:3624
- C:\Windows\System\SswEPag.exe
  C:\Windows\System\SswEPag.exe
  2⤵
  PID:3640
- C:\Windows\System\CBQjlFh.exe
  C:\Windows\System\CBQjlFh.exe
  2⤵
  PID:3656
- C:\Windows\System\HAVsJGt.exe
  C:\Windows\System\HAVsJGt.exe
  2⤵
  PID:3672
- C:\Windows\System\tGmdMDN.exe
  C:\Windows\System\tGmdMDN.exe
  2⤵
  PID:3688
- C:\Windows\System\DiheXth.exe
  C:\Windows\System\DiheXth.exe
  2⤵
  PID:3704
- C:\Windows\System\htEcYBs.exe
  C:\Windows\System\htEcYBs.exe
  2⤵
  PID:3720
- C:\Windows\System\MtMMBZX.exe
  C:\Windows\System\MtMMBZX.exe
  2⤵
  PID:3736
- C:\Windows\System\WaFayvl.exe
  C:\Windows\System\WaFayvl.exe
  2⤵
  PID:3752
- C:\Windows\System\yVcCUsx.exe
  C:\Windows\System\yVcCUsx.exe
  2⤵
  PID:3768
- C:\Windows\System\FGOOulY.exe
  C:\Windows\System\FGOOulY.exe
  2⤵
  PID:3784
- C:\Windows\System\IwsaEwM.exe
  C:\Windows\System\IwsaEwM.exe
  2⤵
  PID:3800
- C:\Windows\System\GeqIyXn.exe
  C:\Windows\System\GeqIyXn.exe
  2⤵
  PID:3816
- C:\Windows\System\DnmdpXr.exe
  C:\Windows\System\DnmdpXr.exe
  2⤵
  PID:3832
- C:\Windows\System\ggPduOj.exe
  C:\Windows\System\ggPduOj.exe
  2⤵
  PID:3848
- C:\Windows\System\TWXbqUx.exe
  C:\Windows\System\TWXbqUx.exe
  2⤵
  PID:3864
- C:\Windows\System\pONiRPz.exe
  C:\Windows\System\pONiRPz.exe
  2⤵
  PID:3880
- C:\Windows\System\qOCDoBc.exe
  C:\Windows\System\qOCDoBc.exe
  2⤵
  PID:3896
- C:\Windows\System\LjTSWEZ.exe
  C:\Windows\System\LjTSWEZ.exe
  2⤵
  PID:3912
- C:\Windows\System\XimYDrL.exe
  C:\Windows\System\XimYDrL.exe
  2⤵
  PID:3928
- C:\Windows\System\HzuXDoN.exe
  C:\Windows\System\HzuXDoN.exe
  2⤵
  PID:3944
- C:\Windows\System\PWzVPER.exe
  C:\Windows\System\PWzVPER.exe
  2⤵
  PID:3960
- C:\Windows\System\jzAisnH.exe
  C:\Windows\System\jzAisnH.exe
  2⤵
  PID:3976
- C:\Windows\System\zjRtHwg.exe
  C:\Windows\System\zjRtHwg.exe
  2⤵
  PID:3992
- C:\Windows\System\GclCxHu.exe
  C:\Windows\System\GclCxHu.exe
  2⤵
  PID:4008
- C:\Windows\System\qbxJdCI.exe
  C:\Windows\System\qbxJdCI.exe
  2⤵
  PID:4024
- C:\Windows\System\GnQRzrA.exe
  C:\Windows\System\GnQRzrA.exe
  2⤵
  PID:4040
- C:\Windows\System\liUBaCU.exe
  C:\Windows\System\liUBaCU.exe
  2⤵
  PID:4056
- C:\Windows\System\JZTfvfy.exe
  C:\Windows\System\JZTfvfy.exe
  2⤵
  PID:4072
- C:\Windows\System\WJuLVEM.exe
  C:\Windows\System\WJuLVEM.exe
  2⤵
  PID:4088
- C:\Windows\System\VlVGfZc.exe
  C:\Windows\System\VlVGfZc.exe
  2⤵
  PID:1920
- C:\Windows\System\ZAVBlWX.exe
  C:\Windows\System\ZAVBlWX.exe
  2⤵
  PID:1492
- C:\Windows\System\QzGwkDX.exe
  C:\Windows\System\QzGwkDX.exe
  2⤵
  PID:2652
- C:\Windows\System\AvUYhTV.exe
  C:\Windows\System\AvUYhTV.exe
  2⤵
  PID:268
- C:\Windows\System\KGYikTN.exe
  C:\Windows\System\KGYikTN.exe
  2⤵
  PID:2336
- C:\Windows\System\hxjWSia.exe
  C:\Windows\System\hxjWSia.exe
  2⤵
  PID:1244
- C:\Windows\System\QVmElRu.exe
  C:\Windows\System\QVmElRu.exe
  2⤵
  PID:2196
- C:\Windows\System\IkiqWmn.exe
  C:\Windows\System\IkiqWmn.exe
  2⤵
  PID:1980
- C:\Windows\System\OWdKgdB.exe
  C:\Windows\System\OWdKgdB.exe
  2⤵
  PID:1616
- C:\Windows\System\wxStOYf.exe
  C:\Windows\System\wxStOYf.exe
  2⤵
  PID:1276
- C:\Windows\System\dnKVMeR.exe
  C:\Windows\System\dnKVMeR.exe
  2⤵
  PID:2800
- C:\Windows\System\wGyzgYY.exe
  C:\Windows\System\wGyzgYY.exe
  2⤵
  PID:2640
- C:\Windows\System\kDcoviX.exe
  C:\Windows\System\kDcoviX.exe
  2⤵
  PID:2852
- C:\Windows\System\NEGdQLC.exe
  C:\Windows\System\NEGdQLC.exe
  2⤵
  PID:2328
- C:\Windows\System\GuyZufY.exe
  C:\Windows\System\GuyZufY.exe
  2⤵
  PID:3076
- C:\Windows\System\qbaIpkV.exe
  C:\Windows\System\qbaIpkV.exe
  2⤵
  PID:3108
- C:\Windows\System\HBiFNHC.exe
  C:\Windows\System\HBiFNHC.exe
  2⤵
  PID:3140
- C:\Windows\System\Bzmnbad.exe
  C:\Windows\System\Bzmnbad.exe
  2⤵
  PID:2016
- C:\Windows\System\yWSlxkw.exe
  C:\Windows\System\yWSlxkw.exe
  2⤵
  PID:3200
- C:\Windows\System\gDMBHXe.exe
  C:\Windows\System\gDMBHXe.exe
  2⤵
  PID:3232
- C:\Windows\System\UNUXajA.exe
  C:\Windows\System\UNUXajA.exe
  2⤵
  PID:3264
- C:\Windows\System\HveeHqp.exe
  C:\Windows\System\HveeHqp.exe
  2⤵
  PID:3284
- C:\Windows\System\JWKiTxE.exe
  C:\Windows\System\JWKiTxE.exe
  2⤵
  PID:3328
- C:\Windows\System\EjkUyqq.exe
  C:\Windows\System\EjkUyqq.exe
  2⤵
  PID:2704
- C:\Windows\System\DkxXeFn.exe
  C:\Windows\System\DkxXeFn.exe
  2⤵
  PID:3364
- C:\Windows\System\JoHmikj.exe
  C:\Windows\System\JoHmikj.exe
  2⤵
  PID:3396
- C:\Windows\System\UWiefdM.exe
  C:\Windows\System\UWiefdM.exe
  2⤵
  PID:3428
- C:\Windows\System\aQmZTGU.exe
  C:\Windows\System\aQmZTGU.exe
  2⤵
  PID:3460
- C:\Windows\System\LvbYCjq.exe
  C:\Windows\System\LvbYCjq.exe
  2⤵
  PID:3492
- C:\Windows\System\ADgxRZP.exe
  C:\Windows\System\ADgxRZP.exe
  2⤵
  PID:3524
- C:\Windows\System\XnPYxAV.exe
  C:\Windows\System\XnPYxAV.exe
  2⤵
  PID:3540
- C:\Windows\System\zQRKdtf.exe
  C:\Windows\System\zQRKdtf.exe
  2⤵
  PID:3588
- C:\Windows\System\pCHOIGI.exe
  C:\Windows\System\pCHOIGI.exe
  2⤵
  PID:3600
- C:\Windows\System\qlNiLwi.exe
  C:\Windows\System\qlNiLwi.exe
  2⤵
  PID:3632
- C:\Windows\System\bmwwLYX.exe
  C:\Windows\System\bmwwLYX.exe
  2⤵
  PID:3664
- C:\Windows\System\FuhjlvR.exe
  C:\Windows\System\FuhjlvR.exe
  2⤵
  PID:3712
- C:\Windows\System\qbKrmXI.exe
  C:\Windows\System\qbKrmXI.exe
  2⤵
  PID:3744
- C:\Windows\System\rfxvIKb.exe
  C:\Windows\System\rfxvIKb.exe
  2⤵
  PID:3776
- C:\Windows\System\nzlErDn.exe
  C:\Windows\System\nzlErDn.exe
  2⤵
  PID:3808
- C:\Windows\System\GBAObzn.exe
  C:\Windows\System\GBAObzn.exe
  2⤵
  PID:3840
- C:\Windows\System\jbHfOjI.exe
  C:\Windows\System\jbHfOjI.exe
  2⤵
  PID:3872
- C:\Windows\System\bWvmjXD.exe
  C:\Windows\System\bWvmjXD.exe
  2⤵
  PID:3904
- C:\Windows\System\CEleZKE.exe
  C:\Windows\System\CEleZKE.exe
  2⤵
  PID:3936
- C:\Windows\System\aQTDgUf.exe
  C:\Windows\System\aQTDgUf.exe
  2⤵
  PID:3968
- C:\Windows\System\XjRxdqm.exe
  C:\Windows\System\XjRxdqm.exe
  2⤵
  PID:4000
- C:\Windows\System\GkrmtIw.exe
  C:\Windows\System\GkrmtIw.exe
  2⤵
  PID:4032
- C:\Windows\System\pUpOOMz.exe
  C:\Windows\System\pUpOOMz.exe
  2⤵
  PID:4064
- C:\Windows\System\LSQhmct.exe
  C:\Windows\System\LSQhmct.exe
  2⤵
  PID:2592
- C:\Windows\System\ZcJeoFA.exe
  C:\Windows\System\ZcJeoFA.exe
  2⤵
  PID:2876
- C:\Windows\System\hpSXMbr.exe
  C:\Windows\System\hpSXMbr.exe
  2⤵
  PID:960
- C:\Windows\System\phsJlWP.exe
  C:\Windows\System\phsJlWP.exe
  2⤵
  PID:1528
- C:\Windows\System\TexLuyU.exe
  C:\Windows\System\TexLuyU.exe
  2⤵
  PID:2588
- C:\Windows\System\OItpbFc.exe
  C:\Windows\System\OItpbFc.exe
  2⤵
  PID:1944
- C:\Windows\System\jyhWKOG.exe
  C:\Windows\System\jyhWKOG.exe
  2⤵
  PID:2472
- C:\Windows\System\xqDHyMS.exe
  C:\Windows\System\xqDHyMS.exe
  2⤵
  PID:2620
- C:\Windows\System\VIkCujy.exe
  C:\Windows\System\VIkCujy.exe
  2⤵
  PID:808
- C:\Windows\System\wnyVZhP.exe
  C:\Windows\System\wnyVZhP.exe
  2⤵
  PID:3136
- C:\Windows\System\QxKZsiL.exe
  C:\Windows\System\QxKZsiL.exe
  2⤵
  PID:3184
- C:\Windows\System\jUjmqDG.exe
  C:\Windows\System\jUjmqDG.exe
  2⤵
  PID:3236
- C:\Windows\System\ThkXeYC.exe
  C:\Windows\System\ThkXeYC.exe
  2⤵
  PID:3300
- C:\Windows\System\tprsokm.exe
  C:\Windows\System\tprsokm.exe
  2⤵
  PID:3348
- C:\Windows\System\SBxCuse.exe
  C:\Windows\System\SBxCuse.exe
  2⤵
  PID:3424
- C:\Windows\System\mUsTOTR.exe
  C:\Windows\System\mUsTOTR.exe
  2⤵
  PID:3476
- C:\Windows\System\eMHVLxv.exe
  C:\Windows\System\eMHVLxv.exe
  2⤵
  PID:2716
- C:\Windows\System\HnzASxy.exe
  C:\Windows\System\HnzASxy.exe
  2⤵
  PID:2104
- C:\Windows\System\QmEctLS.exe
  C:\Windows\System\QmEctLS.exe
  2⤵
  PID:3620
- C:\Windows\System\NihamiA.exe
  C:\Windows\System\NihamiA.exe
  2⤵
  PID:3684
- C:\Windows\System\vezRQeu.exe
  C:\Windows\System\vezRQeu.exe
  2⤵
  PID:3728
- C:\Windows\System\IOXNblq.exe
  C:\Windows\System\IOXNblq.exe
  2⤵
  PID:3792
- C:\Windows\System\THcdjdC.exe
  C:\Windows\System\THcdjdC.exe
  2⤵
  PID:3824
- C:\Windows\System\zUbaZbM.exe
  C:\Windows\System\zUbaZbM.exe
  2⤵
  PID:3908
- C:\Windows\System\fnwbuhc.exe
  C:\Windows\System\fnwbuhc.exe
  2⤵
  PID:3972
- C:\Windows\System\NSnzEFy.exe
  C:\Windows\System\NSnzEFy.exe
  2⤵
  PID:4036
- C:\Windows\System\BtvCsqG.exe
  C:\Windows\System\BtvCsqG.exe
  2⤵
  PID:2904
- C:\Windows\System\GwiYptC.exe
  C:\Windows\System\GwiYptC.exe
  2⤵
  PID:1160
- C:\Windows\System\EUiIQRA.exe
  C:\Windows\System\EUiIQRA.exe
  2⤵
  PID:2012
- C:\Windows\System\WABVLxd.exe
  C:\Windows\System\WABVLxd.exe
  2⤵
  PID:2764
- C:\Windows\System\mFzppkN.exe
  C:\Windows\System\mFzppkN.exe
  2⤵
  PID:2804
- C:\Windows\System\gAqrmYi.exe
  C:\Windows\System\gAqrmYi.exe
  2⤵
  PID:1100
- C:\Windows\System\UdwGFlF.exe
  C:\Windows\System\UdwGFlF.exe
  2⤵
  PID:1776
- C:\Windows\System\zoGHjuK.exe
  C:\Windows\System\zoGHjuK.exe
  2⤵
  PID:3248
- C:\Windows\System\PjUirfX.exe
  C:\Windows\System\PjUirfX.exe
  2⤵
  PID:2344
- C:\Windows\System\edbpyNk.exe
  C:\Windows\System\edbpyNk.exe
  2⤵
  PID:1908
- C:\Windows\System\XEeCyyG.exe
  C:\Windows\System\XEeCyyG.exe
  2⤵
  PID:3520
- C:\Windows\System\FtiVVTh.exe
  C:\Windows\System\FtiVVTh.exe
  2⤵
  PID:3680
- C:\Windows\System\BhCLhMp.exe
  C:\Windows\System\BhCLhMp.exe
  2⤵
  PID:3876
- C:\Windows\System\rXbojHV.exe
  C:\Windows\System\rXbojHV.exe
  2⤵
  PID:2784
- C:\Windows\System\mlHeebt.exe
  C:\Windows\System\mlHeebt.exe
  2⤵
  PID:2664
- C:\Windows\System\RFiQmyH.exe
  C:\Windows\System\RFiQmyH.exe
  2⤵
  PID:3920
- C:\Windows\System\BxSXHaL.exe
  C:\Windows\System\BxSXHaL.exe
  2⤵
  PID:2912
- C:\Windows\System\bwzRLxe.exe
  C:\Windows\System\bwzRLxe.exe
  2⤵
  PID:2164
- C:\Windows\System\GNancsM.exe
  C:\Windows\System\GNancsM.exe
  2⤵
  PID:1928
- C:\Windows\System\CZgsACg.exe
  C:\Windows\System\CZgsACg.exe
  2⤵
  PID:3204
- C:\Windows\System\xiHXVsk.exe
  C:\Windows\System\xiHXVsk.exe
  2⤵
  PID:2660
- C:\Windows\System\LFGFcoW.exe
  C:\Windows\System\LFGFcoW.exe
  2⤵
  PID:3412
- C:\Windows\System\aqmHCsf.exe
  C:\Windows\System\aqmHCsf.exe
  2⤵
  PID:1796
- C:\Windows\System\SYnMezI.exe
  C:\Windows\System\SYnMezI.exe
  2⤵
  PID:3716
- C:\Windows\System\qNgeAIZ.exe
  C:\Windows\System\qNgeAIZ.exe
  2⤵
  PID:3748
- C:\Windows\System\gGVflsY.exe
  C:\Windows\System\gGVflsY.exe
  2⤵
  PID:3984
- C:\Windows\System\MjsqCQG.exe
  C:\Windows\System\MjsqCQG.exe
  2⤵
  PID:4068
- C:\Windows\System\RVtBEEq.exe
  C:\Windows\System\RVtBEEq.exe
  2⤵
  PID:2244
- C:\Windows\System\HYeKMpI.exe
  C:\Windows\System\HYeKMpI.exe
  2⤵
  PID:1808
- C:\Windows\System\rbCkpUV.exe
  C:\Windows\System\rbCkpUV.exe
  2⤵
  PID:2732
- C:\Windows\System\VoMoIIn.exe
  C:\Windows\System\VoMoIIn.exe
  2⤵
  PID:3124
- C:\Windows\System\OJJCgOh.exe
  C:\Windows\System\OJJCgOh.exe
  2⤵
  PID:3392
- C:\Windows\System\jKizJaA.exe
  C:\Windows\System\jKizJaA.exe
  2⤵
  PID:1968
- C:\Windows\System\wPGDJti.exe
  C:\Windows\System\wPGDJti.exe
  2⤵
  PID:992
- C:\Windows\System\ZOIsEuF.exe
  C:\Windows\System\ZOIsEuF.exe
  2⤵
  PID:2632
- C:\Windows\System\RpIPWLH.exe
  C:\Windows\System\RpIPWLH.exe
  2⤵
  PID:928
- C:\Windows\System\LBzPmzq.exe
  C:\Windows\System\LBzPmzq.exe
  2⤵
  PID:2100
- C:\Windows\System\eZvkJRA.exe
  C:\Windows\System\eZvkJRA.exe
  2⤵
  PID:3028
- C:\Windows\System\keOWYIS.exe
  C:\Windows\System\keOWYIS.exe
  2⤵
  PID:532
- C:\Windows\System\EztwBke.exe
  C:\Windows\System\EztwBke.exe
  2⤵
  PID:2832
- C:\Windows\System\cebzxzl.exe
  C:\Windows\System\cebzxzl.exe
  2⤵
  PID:1988
- C:\Windows\System\hkHqylu.exe
  C:\Windows\System\hkHqylu.exe
  2⤵
  PID:2672
- C:\Windows\System\TBfmvEt.exe
  C:\Windows\System\TBfmvEt.exe
  2⤵
  PID:2508
- C:\Windows\System\JDzqdpq.exe
  C:\Windows\System\JDzqdpq.exe
  2⤵
  PID:1592
- C:\Windows\System\HTxOPQS.exe
  C:\Windows\System\HTxOPQS.exe
  2⤵
  PID:1976
- C:\Windows\System\QgzLcSz.exe
  C:\Windows\System\QgzLcSz.exe
  2⤵
  PID:4104
- C:\Windows\System\bjiRCeZ.exe
  C:\Windows\System\bjiRCeZ.exe
  2⤵
  PID:4120
- C:\Windows\System\DaSPLUb.exe
  C:\Windows\System\DaSPLUb.exe
  2⤵
  PID:4136
- C:\Windows\System\TRKKoMJ.exe
  C:\Windows\System\TRKKoMJ.exe
  2⤵
  PID:4152
- C:\Windows\System\giYAhau.exe
  C:\Windows\System\giYAhau.exe
  2⤵
  PID:4168
- C:\Windows\System\WNIdPnc.exe
  C:\Windows\System\WNIdPnc.exe
  2⤵
  PID:4184
- C:\Windows\System\MUTViMU.exe
  C:\Windows\System\MUTViMU.exe
  2⤵
  PID:4200
- C:\Windows\System\qhjVzYf.exe
  C:\Windows\System\qhjVzYf.exe
  2⤵
  PID:4216
- C:\Windows\System\OucdosA.exe
  C:\Windows\System\OucdosA.exe
  2⤵
  PID:4232
- C:\Windows\System\SxJlukE.exe
  C:\Windows\System\SxJlukE.exe
  2⤵
  PID:4248
- C:\Windows\System\aFrLcaQ.exe
  C:\Windows\System\aFrLcaQ.exe
  2⤵
  PID:4264
- C:\Windows\System\ZPKOYmd.exe
  C:\Windows\System\ZPKOYmd.exe
  2⤵
  PID:4280
- C:\Windows\System\yLULRgr.exe
  C:\Windows\System\yLULRgr.exe
  2⤵
  PID:4296
- C:\Windows\System\cZKGjuY.exe
  C:\Windows\System\cZKGjuY.exe
  2⤵
  PID:4312
- C:\Windows\System\VTybwCx.exe
  C:\Windows\System\VTybwCx.exe
  2⤵
  PID:4328
- C:\Windows\System\NypSWYk.exe
  C:\Windows\System\NypSWYk.exe
  2⤵
  PID:4344
- C:\Windows\System\sxoYFLS.exe
  C:\Windows\System\sxoYFLS.exe
  2⤵
  PID:4360
- C:\Windows\System\OYWWcjD.exe
  C:\Windows\System\OYWWcjD.exe
  2⤵
  PID:4376
- C:\Windows\System\FNMLvqn.exe
  C:\Windows\System\FNMLvqn.exe
  2⤵
  PID:4392
- C:\Windows\System\oZPgZyN.exe
  C:\Windows\System\oZPgZyN.exe
  2⤵
  PID:4408
- C:\Windows\System\WVjdxzl.exe
  C:\Windows\System\WVjdxzl.exe
  2⤵
  PID:4424
- C:\Windows\System\xRtBUjY.exe
  C:\Windows\System\xRtBUjY.exe
  2⤵
  PID:4440
- C:\Windows\System\YjrbFrh.exe
  C:\Windows\System\YjrbFrh.exe
  2⤵
  PID:4456
- C:\Windows\System\jatwkoq.exe
  C:\Windows\System\jatwkoq.exe
  2⤵
  PID:4472
- C:\Windows\System\vsKxtiq.exe
  C:\Windows\System\vsKxtiq.exe
  2⤵
  PID:4488
- C:\Windows\System\iHLHzNH.exe
  C:\Windows\System\iHLHzNH.exe
  2⤵
  PID:4504
- C:\Windows\System\sLsswXq.exe
  C:\Windows\System\sLsswXq.exe
  2⤵
  PID:4520
- C:\Windows\System\guBkWqF.exe
  C:\Windows\System\guBkWqF.exe
  2⤵
  PID:4536
- C:\Windows\System\WlwwFJq.exe
  C:\Windows\System\WlwwFJq.exe
  2⤵
  PID:4552
- C:\Windows\System\btHHATb.exe
  C:\Windows\System\btHHATb.exe
  2⤵
  PID:4568
- C:\Windows\System\WCQdbvk.exe
  C:\Windows\System\WCQdbvk.exe
  2⤵
  PID:4584
- C:\Windows\System\HkOzIxH.exe
  C:\Windows\System\HkOzIxH.exe
  2⤵
  PID:4600
- C:\Windows\System\zWyhXrv.exe
  C:\Windows\System\zWyhXrv.exe
  2⤵
  PID:4616
- C:\Windows\System\zZHPzvf.exe
  C:\Windows\System\zZHPzvf.exe
  2⤵
  PID:4632
- C:\Windows\System\BWtsxvH.exe
  C:\Windows\System\BWtsxvH.exe
  2⤵
  PID:4648
- C:\Windows\System\KJXXkdV.exe
  C:\Windows\System\KJXXkdV.exe
  2⤵
  PID:4664
- C:\Windows\System\qwFeswb.exe
  C:\Windows\System\qwFeswb.exe
  2⤵
  PID:4680
- C:\Windows\System\MxYNccl.exe
  C:\Windows\System\MxYNccl.exe
  2⤵
  PID:4696
- C:\Windows\System\wpuiDTN.exe
  C:\Windows\System\wpuiDTN.exe
  2⤵
  PID:4712
- C:\Windows\System\tjojHao.exe
  C:\Windows\System\tjojHao.exe
  2⤵
  PID:4728
- C:\Windows\System\lPOmuxT.exe
  C:\Windows\System\lPOmuxT.exe
  2⤵
  PID:4744
- C:\Windows\System\gBQmoHp.exe
  C:\Windows\System\gBQmoHp.exe
  2⤵
  PID:4760
- C:\Windows\System\MKYLEsp.exe
  C:\Windows\System\MKYLEsp.exe
  2⤵
  PID:4776
- C:\Windows\System\cghTBZl.exe
  C:\Windows\System\cghTBZl.exe
  2⤵
  PID:4792
- C:\Windows\System\JwHtJkW.exe
  C:\Windows\System\JwHtJkW.exe
  2⤵
  PID:4808
- C:\Windows\System\aICFePk.exe
  C:\Windows\System\aICFePk.exe
  2⤵
  PID:4824
- C:\Windows\System\nYRycZb.exe
  C:\Windows\System\nYRycZb.exe
  2⤵
  PID:4840
- C:\Windows\System\HdPqOrI.exe
  C:\Windows\System\HdPqOrI.exe
  2⤵
  PID:4856
- C:\Windows\System\kSionbE.exe
  C:\Windows\System\kSionbE.exe
  2⤵
  PID:4872
- C:\Windows\System\sZgQTAW.exe
  C:\Windows\System\sZgQTAW.exe
  2⤵
  PID:4888
- C:\Windows\System\HJFkhmz.exe
  C:\Windows\System\HJFkhmz.exe
  2⤵
  PID:4904
- C:\Windows\System\hFDlCHx.exe
  C:\Windows\System\hFDlCHx.exe
  2⤵
  PID:4920
- C:\Windows\System\jbbLzHu.exe
  C:\Windows\System\jbbLzHu.exe
  2⤵
  PID:4936
- C:\Windows\System\FmMJrBr.exe
  C:\Windows\System\FmMJrBr.exe
  2⤵
  PID:4952
- C:\Windows\System\jUEKtaz.exe
  C:\Windows\System\jUEKtaz.exe
  2⤵
  PID:4968
- C:\Windows\System\YnvTGtr.exe
  C:\Windows\System\YnvTGtr.exe
  2⤵
  PID:4984
- C:\Windows\System\QanOMsS.exe
  C:\Windows\System\QanOMsS.exe
  2⤵
  PID:5000
- C:\Windows\System\jPhFtQm.exe
  C:\Windows\System\jPhFtQm.exe
  2⤵
  PID:5016
- C:\Windows\System\MxdxSJx.exe
  C:\Windows\System\MxdxSJx.exe
  2⤵
  PID:5032
- C:\Windows\System\ynXwmEP.exe
  C:\Windows\System\ynXwmEP.exe
  2⤵
  PID:5048
- C:\Windows\System\ZAveSmg.exe
  C:\Windows\System\ZAveSmg.exe
  2⤵
  PID:5064
- C:\Windows\System\LLrZPbC.exe
  C:\Windows\System\LLrZPbC.exe
  2⤵
  PID:5080
- C:\Windows\System\gWqZFgi.exe
  C:\Windows\System\gWqZFgi.exe
  2⤵
  PID:5096
- C:\Windows\System\eZeNpdG.exe
  C:\Windows\System\eZeNpdG.exe
  2⤵
  PID:5112
- C:\Windows\System\hdOHVgN.exe
  C:\Windows\System\hdOHVgN.exe
  2⤵
  PID:2080
- C:\Windows\System\IrULoom.exe
  C:\Windows\System\IrULoom.exe
  2⤵
  PID:4224
- C:\Windows\System\PxBSEAI.exe
  C:\Windows\System\PxBSEAI.exe
  2⤵
  PID:4240
- C:\Windows\System\rtJjhIV.exe
  C:\Windows\System\rtJjhIV.exe
  2⤵
  PID:4304
- C:\Windows\System\tsnwxdI.exe
  C:\Windows\System\tsnwxdI.exe
  2⤵
  PID:4368
- C:\Windows\System\iZEvTDr.exe
  C:\Windows\System\iZEvTDr.exe
  2⤵
  PID:4112
- C:\Windows\System\GdvgCjA.exe
  C:\Windows\System\GdvgCjA.exe
  2⤵
  PID:4372
- C:\Windows\System\tnxCKgT.exe
  C:\Windows\System\tnxCKgT.exe
  2⤵
  PID:4436
- C:\Windows\System\GnSiuxM.exe
  C:\Windows\System\GnSiuxM.exe
  2⤵
  PID:4560
- C:\Windows\System\OGvzXej.exe
  C:\Windows\System\OGvzXej.exe
  2⤵
  PID:4628
- C:\Windows\System\TCiJWIT.exe
  C:\Windows\System\TCiJWIT.exe
  2⤵
  PID:4320
- C:\Windows\System\QcDdXVR.exe
  C:\Windows\System\QcDdXVR.exe
  2⤵
  PID:4388
- C:\Windows\System\zlpKqix.exe
  C:\Windows\System\zlpKqix.exe
  2⤵
  PID:4384
- C:\Windows\System\ujnzlfT.exe
  C:\Windows\System\ujnzlfT.exe
  2⤵
  PID:4736
- C:\Windows\System\FlGazFg.exe
  C:\Windows\System\FlGazFg.exe
  2⤵
  PID:4544
- C:\Windows\System\SOKtfeB.exe
  C:\Windows\System\SOKtfeB.exe
  2⤵
  PID:4612
- C:\Windows\System\OOTWdoh.exe
  C:\Windows\System\OOTWdoh.exe
  2⤵
  PID:4676
- C:\Windows\System\MlsiYht.exe
  C:\Windows\System\MlsiYht.exe
  2⤵
  PID:4772
- C:\Windows\System\TPsYalN.exe
  C:\Windows\System\TPsYalN.exe
  2⤵
  PID:4804
- C:\Windows\System\tLVmXLM.exe
  C:\Windows\System\tLVmXLM.exe
  2⤵
  PID:4688
- C:\Windows\System\GYNXtAj.exe
  C:\Windows\System\GYNXtAj.exe
  2⤵
  PID:4752
- C:\Windows\System\QSqiPmd.exe
  C:\Windows\System\QSqiPmd.exe
  2⤵
  PID:4820
- C:\Windows\System\RKlEpgo.exe
  C:\Windows\System\RKlEpgo.exe
  2⤵
  PID:4884
- C:\Windows\System\spMdwwm.exe
  C:\Windows\System\spMdwwm.exe
  2⤵
  PID:4756
- C:\Windows\System\FIvQQme.exe
  C:\Windows\System\FIvQQme.exe
  2⤵
  PID:4980
- C:\Windows\System\Enqtmkc.exe
  C:\Windows\System\Enqtmkc.exe
  2⤵
  PID:5044
- C:\Windows\System\sUYecsQ.exe
  C:\Windows\System\sUYecsQ.exe
  2⤵
  PID:5104
- C:\Windows\System\qtobBic.exe
  C:\Windows\System\qtobBic.exe
  2⤵
  PID:4272
- C:\Windows\System\OGvMhUL.exe
  C:\Windows\System\OGvMhUL.exe
  2⤵
  PID:5060
- C:\Windows\System\UQDUfIx.exe
  C:\Windows\System\UQDUfIx.exe
  2⤵
  PID:4964
- C:\Windows\System\mMUMSJW.exe
  C:\Windows\System\mMUMSJW.exe
  2⤵
  PID:5028
- C:\Windows\System\YVrBqCH.exe
  C:\Windows\System\YVrBqCH.exe
  2⤵
  PID:2680
- C:\Windows\System\xVIzPoJ.exe
  C:\Windows\System\xVIzPoJ.exe
  2⤵
  PID:4336
- C:\Windows\System\lJwhWfY.exe
  C:\Windows\System\lJwhWfY.exe
  2⤵
  PID:4464
- C:\Windows\System\CKAFMCU.exe
  C:\Windows\System\CKAFMCU.exe
  2⤵
  PID:4528
- C:\Windows\System\pdXgIhq.exe
  C:\Windows\System\pdXgIhq.exe
  2⤵
  PID:4660
- C:\Windows\System\EtAubWm.exe
  C:\Windows\System\EtAubWm.exe
  2⤵
  PID:4356
- C:\Windows\System\vBVHUIy.exe
  C:\Windows\System\vBVHUIy.exe
  2⤵
  PID:4624
- C:\Windows\System\qmBCUIV.exe
  C:\Windows\System\qmBCUIV.exe
  2⤵
  PID:4740
- C:\Windows\System\IFMeHrL.exe
  C:\Windows\System\IFMeHrL.exe
  2⤵
  PID:4868
- C:\Windows\System\tkirvAZ.exe
  C:\Windows\System\tkirvAZ.exe
  2⤵
  PID:4916
- C:\Windows\System\FVWDnBi.exe
  C:\Windows\System\FVWDnBi.exe
  2⤵
  PID:4724
- C:\Windows\System\LOYqCTD.exe
  C:\Windows\System\LOYqCTD.exe
  2⤵
  PID:5012
- C:\Windows\System\kihPqPt.exe
  C:\Windows\System\kihPqPt.exe
  2⤵
  PID:4580
- C:\Windows\System\BeRFzyI.exe
  C:\Windows\System\BeRFzyI.exe
  2⤵
  PID:5092
- C:\Windows\System\hjqxDDL.exe
  C:\Windows\System\hjqxDDL.exe
  2⤵
  PID:5072
- C:\Windows\System\akVxJQv.exe
  C:\Windows\System\akVxJQv.exe
  2⤵
  PID:4116
- C:\Windows\System\WIGUuZv.exe
  C:\Windows\System\WIGUuZv.exe
  2⤵
  PID:4996
- C:\Windows\System\DZwQUCb.exe
  C:\Windows\System\DZwQUCb.exe
  2⤵
  PID:4352
- C:\Windows\System\yHlGHXL.exe
  C:\Windows\System\yHlGHXL.exe
  2⤵
  PID:4816
- C:\Windows\System\StYrqPJ.exe
  C:\Windows\System\StYrqPJ.exe
  2⤵
  PID:4592
- C:\Windows\System\QjyjLgv.exe
  C:\Windows\System\QjyjLgv.exe
  2⤵
  PID:5076
- C:\Windows\System\FQNZzrh.exe
  C:\Windows\System\FQNZzrh.exe
  2⤵
  PID:5132
- C:\Windows\System\ySaDyIa.exe
  C:\Windows\System\ySaDyIa.exe
  2⤵
  PID:5148
- C:\Windows\System\QNVgxcx.exe
  C:\Windows\System\QNVgxcx.exe
  2⤵
  PID:5164
- C:\Windows\System\wHMlHKm.exe
  C:\Windows\System\wHMlHKm.exe
  2⤵
  PID:5180
- C:\Windows\System\EdWdLQA.exe
  C:\Windows\System\EdWdLQA.exe
  2⤵
  PID:5196
- C:\Windows\System\vmpjTWt.exe
  C:\Windows\System\vmpjTWt.exe
  2⤵
  PID:5212
- C:\Windows\System\OWPfXXl.exe
  C:\Windows\System\OWPfXXl.exe
  2⤵
  PID:5228
- C:\Windows\System\UPSAnPD.exe
  C:\Windows\System\UPSAnPD.exe
  2⤵
  PID:5244
- C:\Windows\System\wSYbLCI.exe
  C:\Windows\System\wSYbLCI.exe
  2⤵
  PID:5260
- C:\Windows\System\qoGFLXA.exe
  C:\Windows\System\qoGFLXA.exe
  2⤵
  PID:5276
- C:\Windows\System\CXVuHyZ.exe
  C:\Windows\System\CXVuHyZ.exe
  2⤵
  PID:5292
- C:\Windows\System\NsXeNBc.exe
  C:\Windows\System\NsXeNBc.exe
  2⤵
  PID:5308
- C:\Windows\System\jJrzvgs.exe
  C:\Windows\System\jJrzvgs.exe
  2⤵
  PID:5324
- C:\Windows\System\JgbSkYy.exe
  C:\Windows\System\JgbSkYy.exe
  2⤵
  PID:5340
- C:\Windows\System\GeuNhqN.exe
  C:\Windows\System\GeuNhqN.exe
  2⤵
  PID:5356
- C:\Windows\System\tQOTFpt.exe
  C:\Windows\System\tQOTFpt.exe
  2⤵
  PID:5372
- C:\Windows\System\ZnyDnjJ.exe
  C:\Windows\System\ZnyDnjJ.exe
  2⤵
  PID:5388
- C:\Windows\System\kAypPEC.exe
  C:\Windows\System\kAypPEC.exe
  2⤵
  PID:5404
- C:\Windows\System\gaQpgKb.exe
  C:\Windows\System\gaQpgKb.exe
  2⤵
  PID:5420
- C:\Windows\System\NlcCibp.exe
  C:\Windows\System\NlcCibp.exe
  2⤵
  PID:5436
- C:\Windows\System\xAKfXYc.exe
  C:\Windows\System\xAKfXYc.exe
  2⤵
  PID:5452
- C:\Windows\System\JNSHdft.exe
  C:\Windows\System\JNSHdft.exe
  2⤵
  PID:5468
- C:\Windows\System\lCcYLsz.exe
  C:\Windows\System\lCcYLsz.exe
  2⤵
  PID:5484
- C:\Windows\System\ggSTGmp.exe
  C:\Windows\System\ggSTGmp.exe
  2⤵
  PID:5500
- C:\Windows\System\XkFLgme.exe
  C:\Windows\System\XkFLgme.exe
  2⤵
  PID:5516
- C:\Windows\System\qUfdbua.exe
  C:\Windows\System\qUfdbua.exe
  2⤵
  PID:5532
- C:\Windows\System\lAbYTkU.exe
  C:\Windows\System\lAbYTkU.exe
  2⤵
  PID:5548
- C:\Windows\System\DQtqerd.exe
  C:\Windows\System\DQtqerd.exe
  2⤵
  PID:5564
- C:\Windows\System\uiBwceh.exe
  C:\Windows\System\uiBwceh.exe
  2⤵
  PID:5580
- C:\Windows\System\uLfeBau.exe
  C:\Windows\System\uLfeBau.exe
  2⤵
  PID:5596
- C:\Windows\System\HgqZxEM.exe
  C:\Windows\System\HgqZxEM.exe
  2⤵
  PID:5612
- C:\Windows\System\XlmUnZR.exe
  C:\Windows\System\XlmUnZR.exe
  2⤵
  PID:5628
- C:\Windows\System\mUHNsBP.exe
  C:\Windows\System\mUHNsBP.exe
  2⤵
  PID:5644
- C:\Windows\System\QpiTdvX.exe
  C:\Windows\System\QpiTdvX.exe
  2⤵
  PID:5660
- C:\Windows\System\CbUfOIl.exe
  C:\Windows\System\CbUfOIl.exe
  2⤵
  PID:5676
- C:\Windows\System\QhbHmSd.exe
  C:\Windows\System\QhbHmSd.exe
  2⤵
  PID:5692
- C:\Windows\System\brQWmmO.exe
  C:\Windows\System\brQWmmO.exe
  2⤵
  PID:5708
- C:\Windows\System\VYCSzSA.exe
  C:\Windows\System\VYCSzSA.exe
  2⤵
  PID:5724
- C:\Windows\System\VlUsFLZ.exe
  C:\Windows\System\VlUsFLZ.exe
  2⤵
  PID:5740
- C:\Windows\System\xeGdzjc.exe
  C:\Windows\System\xeGdzjc.exe
  2⤵
  PID:5756
- C:\Windows\System\VwWbbCC.exe
  C:\Windows\System\VwWbbCC.exe
  2⤵
  PID:5772
- C:\Windows\System\MfpGNPr.exe
  C:\Windows\System\MfpGNPr.exe
  2⤵
  PID:5788
- C:\Windows\System\ufjkaLK.exe
  C:\Windows\System\ufjkaLK.exe
  2⤵
  PID:5804
- C:\Windows\System\xGtVNWb.exe
  C:\Windows\System\xGtVNWb.exe
  2⤵
  PID:5820
- C:\Windows\System\wuImCPs.exe
  C:\Windows\System\wuImCPs.exe
  2⤵
  PID:5836
- C:\Windows\System\uTxqfpQ.exe
  C:\Windows\System\uTxqfpQ.exe
  2⤵
  PID:5852
- C:\Windows\System\BFQOuuW.exe
  C:\Windows\System\BFQOuuW.exe
  2⤵
  PID:5868
- C:\Windows\System\WEOpnzh.exe
  C:\Windows\System\WEOpnzh.exe
  2⤵
  PID:5884
- C:\Windows\System\iTHXEHA.exe
  C:\Windows\System\iTHXEHA.exe
  2⤵
  PID:5900
- C:\Windows\System\vfMJgWn.exe
  C:\Windows\System\vfMJgWn.exe
  2⤵
  PID:5916
- C:\Windows\System\cQkFikD.exe
  C:\Windows\System\cQkFikD.exe
  2⤵
  PID:5932
- C:\Windows\System\zoSqUXs.exe
  C:\Windows\System\zoSqUXs.exe
  2⤵
  PID:5948
- C:\Windows\System\yMcZNzY.exe
  C:\Windows\System\yMcZNzY.exe
  2⤵
  PID:5964
- C:\Windows\System\muCiAut.exe
  C:\Windows\System\muCiAut.exe
  2⤵
  PID:5980
- C:\Windows\System\VOHoLPZ.exe
  C:\Windows\System\VOHoLPZ.exe
  2⤵
  PID:5996
- C:\Windows\System\Nkwwfee.exe
  C:\Windows\System\Nkwwfee.exe
  2⤵
  PID:6012
- C:\Windows\System\ZZBjqYY.exe
  C:\Windows\System\ZZBjqYY.exe
  2⤵
  PID:6028
- C:\Windows\System\NulgSkP.exe
  C:\Windows\System\NulgSkP.exe
  2⤵
  PID:6044
- C:\Windows\System\saGdoit.exe
  C:\Windows\System\saGdoit.exe
  2⤵
  PID:6060
- C:\Windows\System\hIUcXNE.exe
  C:\Windows\System\hIUcXNE.exe
  2⤵
  PID:6076
- C:\Windows\System\YSVEFOb.exe
  C:\Windows\System\YSVEFOb.exe
  2⤵
  PID:6092
- C:\Windows\System\IiXWOxr.exe
  C:\Windows\System\IiXWOxr.exe
  2⤵
  PID:6108
- C:\Windows\System\GrmKGhg.exe
  C:\Windows\System\GrmKGhg.exe
  2⤵
  PID:6124
- C:\Windows\System\RZkJgDF.exe
  C:\Windows\System\RZkJgDF.exe
  2⤵
  PID:6140
- C:\Windows\System\zXrFIvH.exe
  C:\Windows\System\zXrFIvH.exe
  2⤵
  PID:4852
- C:\Windows\System\xOwgpVm.exe
  C:\Windows\System\xOwgpVm.exe
  2⤵
  PID:4160
- C:\Windows\System\sKWMDCt.exe
  C:\Windows\System\sKWMDCt.exe
  2⤵
  PID:5160
- C:\Windows\System\QfxVmaQ.exe
  C:\Windows\System\QfxVmaQ.exe
  2⤵
  PID:5156
- C:\Windows\System\isAvdwz.exe
  C:\Windows\System\isAvdwz.exe
  2⤵
  PID:4896
- C:\Windows\System\SNhiuUy.exe
  C:\Windows\System\SNhiuUy.exe
  2⤵
  PID:4420
- C:\Windows\System\eavtjKN.exe
  C:\Windows\System\eavtjKN.exe
  2⤵
  PID:5348
- C:\Windows\System\xuLxfSD.exe
  C:\Windows\System\xuLxfSD.exe
  2⤵
  PID:4448
- C:\Windows\System\nxBTVyy.exe
  C:\Windows\System\nxBTVyy.exe
  2⤵
  PID:5236
- C:\Windows\System\SscEnQn.exe
  C:\Windows\System\SscEnQn.exe
  2⤵
  PID:4516
- C:\Windows\System\spNtnvL.exe
  C:\Windows\System\spNtnvL.exe
  2⤵
  PID:5144
- C:\Windows\System\gsRdjEI.exe
  C:\Windows\System\gsRdjEI.exe
  2⤵
  PID:5336
- C:\Windows\System\fIDDUdf.exe
  C:\Windows\System\fIDDUdf.exe
  2⤵
  PID:5444
- C:\Windows\System\uercOMZ.exe
  C:\Windows\System\uercOMZ.exe
  2⤵
  PID:5416
- C:\Windows\System\NeaEhUb.exe
  C:\Windows\System\NeaEhUb.exe
  2⤵
  PID:5508
- C:\Windows\System\AXuokjO.exe
  C:\Windows\System\AXuokjO.exe
  2⤵
  PID:5464
- C:\Windows\System\AohoDvc.exe
  C:\Windows\System\AohoDvc.exe
  2⤵
  PID:5560
- C:\Windows\System\IuPfCqW.exe
  C:\Windows\System\IuPfCqW.exe
  2⤵
  PID:5492
- C:\Windows\System\aJxRPnc.exe
  C:\Windows\System\aJxRPnc.exe
  2⤵
  PID:5624
- C:\Windows\System\UlMDxRS.exe
  C:\Windows\System\UlMDxRS.exe
  2⤵
  PID:5540
- C:\Windows\System\dDaFMRh.exe
  C:\Windows\System\dDaFMRh.exe
  2⤵
  PID:5636
- C:\Windows\System\EkZltUK.exe
  C:\Windows\System\EkZltUK.exe
  2⤵
  PID:5672
- C:\Windows\System\Fdszsgn.exe
  C:\Windows\System\Fdszsgn.exe
  2⤵
  PID:5704
- C:\Windows\System\GHEqooC.exe
  C:\Windows\System\GHEqooC.exe
  2⤵
  PID:5796
- C:\Windows\System\rMLWsFR.exe
  C:\Windows\System\rMLWsFR.exe
  2⤵
  PID:5768
- C:\Windows\System\LMxyBlC.exe
  C:\Windows\System\LMxyBlC.exe
  2⤵
  PID:5892
- C:\Windows\System\NQEMtSw.exe
  C:\Windows\System\NQEMtSw.exe
  2⤵
  PID:5780
- C:\Windows\System\IKEKCbT.exe
  C:\Windows\System\IKEKCbT.exe
  2⤵
  PID:5844
- C:\Windows\System\bFNOzJa.exe
  C:\Windows\System\bFNOzJa.exe
  2⤵
  PID:5924
- C:\Windows\System\UHHPMde.exe
  C:\Windows\System\UHHPMde.exe
  2⤵
  PID:5988
- C:\Windows\System\YAzuXBb.exe
  C:\Windows\System\YAzuXBb.exe
  2⤵
  PID:6052
- C:\Windows\System\vmJKUkO.exe
  C:\Windows\System\vmJKUkO.exe
  2⤵
  PID:6008
- C:\Windows\System\idFcsYq.exe
  C:\Windows\System\idFcsYq.exe
  2⤵
  PID:5940
- C:\Windows\System\qwkFAUV.exe
  C:\Windows\System\qwkFAUV.exe
  2⤵
  PID:6084
- C:\Windows\System\zlXPpbN.exe
  C:\Windows\System\zlXPpbN.exe
  2⤵
  PID:6036
- C:\Windows\System\UVDMekP.exe
  C:\Windows\System\UVDMekP.exe
  2⤵
  PID:6132
- C:\Windows\System\EOroMDE.exe
  C:\Windows\System\EOroMDE.exe
  2⤵
  PID:4596
- C:\Windows\System\CmHFpAH.exe
  C:\Windows\System\CmHFpAH.exe
  2⤵
  PID:5192
- C:\Windows\System\fRKVFaI.exe
  C:\Windows\System\fRKVFaI.exe
  2⤵
  PID:5224
- C:\Windows\System\XvWEetw.exe
  C:\Windows\System\XvWEetw.exe
  2⤵
  PID:5320
- C:\Windows\System\wvlvans.exe
  C:\Windows\System\wvlvans.exe
  2⤵
  PID:5240
- C:\Windows\System\JRmECzy.exe
  C:\Windows\System\JRmECzy.exe
  2⤵
  PID:5460
- C:\Windows\System\ijEmcsx.exe
  C:\Windows\System\ijEmcsx.exe
  2⤵
  PID:5172
- C:\Windows\System\OhvLFFF.exe
  C:\Windows\System\OhvLFFF.exe
  2⤵
  PID:5300
- C:\Windows\System\tPjEoqA.exe
  C:\Windows\System\tPjEoqA.exe
  2⤵
  PID:5428
- C:\Windows\System\yqbFJGS.exe
  C:\Windows\System\yqbFJGS.exe
  2⤵
  PID:5620
- C:\Windows\System\mXozwPU.exe
  C:\Windows\System\mXozwPU.exe
  2⤵
  PID:5716
- C:\Windows\System\kVXeTdQ.exe
  C:\Windows\System\kVXeTdQ.exe
  2⤵
  PID:5608
- C:\Windows\System\PmHjHbg.exe
  C:\Windows\System\PmHjHbg.exe
  2⤵
  PID:5764
- C:\Windows\System\ysaErBB.exe
  C:\Windows\System\ysaErBB.exe
  2⤵
  PID:5928
- C:\Windows\System\BwfJnTv.exe
  C:\Windows\System\BwfJnTv.exe
  2⤵
  PID:5956
- C:\Windows\System\GwAxLjU.exe
  C:\Windows\System\GwAxLjU.exe
  2⤵
  PID:5944
- C:\Windows\System\dXciecY.exe
  C:\Windows\System\dXciecY.exe
  2⤵
  PID:4720
- C:\Windows\System\vQVnHCA.exe
  C:\Windows\System\vQVnHCA.exe
  2⤵
  PID:6120
- C:\Windows\System\MQhTkAv.exe
  C:\Windows\System\MQhTkAv.exe
  2⤵
  PID:5592
- C:\Windows\System\DohJvbb.exe
  C:\Windows\System\DohJvbb.exe
  2⤵
  PID:5432
- C:\Windows\System\JisszVv.exe
  C:\Windows\System\JisszVv.exe
  2⤵
  PID:5832
- C:\Windows\System\wrHciGz.exe
  C:\Windows\System\wrHciGz.exe
  2⤵
  PID:6020
- C:\Windows\System\tpAgFIu.exe
  C:\Windows\System\tpAgFIu.exe
  2⤵
  PID:6148
- C:\Windows\System\ElAbOFn.exe
  C:\Windows\System\ElAbOFn.exe
  2⤵
  PID:6164
- C:\Windows\System\abVFacA.exe
  C:\Windows\System\abVFacA.exe
  2⤵
  PID:6180
- C:\Windows\System\eCFQpOK.exe
  C:\Windows\System\eCFQpOK.exe
  2⤵
  PID:6196
- C:\Windows\System\clOhehP.exe
  C:\Windows\System\clOhehP.exe
  2⤵
  PID:6212
- C:\Windows\System\YxpLQjd.exe
  C:\Windows\System\YxpLQjd.exe
  2⤵
  PID:6228
- C:\Windows\System\omiUTTP.exe
  C:\Windows\System\omiUTTP.exe
  2⤵
  PID:6244
- C:\Windows\System\OgzljHr.exe
  C:\Windows\System\OgzljHr.exe
  2⤵
  PID:6260
- C:\Windows\System\thIebfR.exe
  C:\Windows\System\thIebfR.exe
  2⤵
  PID:6276
- C:\Windows\System\UQcbepJ.exe
  C:\Windows\System\UQcbepJ.exe
  2⤵
  PID:6292
- C:\Windows\System\BpYerqL.exe
  C:\Windows\System\BpYerqL.exe
  2⤵
  PID:6308
- C:\Windows\System\oiCobZi.exe
  C:\Windows\System\oiCobZi.exe
  2⤵
  PID:6324
- C:\Windows\System\zyKWWPm.exe
  C:\Windows\System\zyKWWPm.exe
  2⤵
  PID:6340
- C:\Windows\System\zszGXjn.exe
  C:\Windows\System\zszGXjn.exe
  2⤵
  PID:6356
- C:\Windows\System\CdzIOlc.exe
  C:\Windows\System\CdzIOlc.exe
  2⤵
  PID:6372
- C:\Windows\System\QwAMary.exe
  C:\Windows\System\QwAMary.exe
  2⤵
  PID:6388
- C:\Windows\System\RsOPoow.exe
  C:\Windows\System\RsOPoow.exe
  2⤵
  PID:6404
- C:\Windows\System\nibKHbs.exe
  C:\Windows\System\nibKHbs.exe
  2⤵
  PID:6420
- C:\Windows\System\pnRQwqr.exe
  C:\Windows\System\pnRQwqr.exe
  2⤵
  PID:6436
- C:\Windows\System\uebsdrO.exe
  C:\Windows\System\uebsdrO.exe
  2⤵
  PID:6452
- C:\Windows\System\TWhzRAl.exe
  C:\Windows\System\TWhzRAl.exe
  2⤵
  PID:6468
- C:\Windows\System\pgAOjqf.exe
  C:\Windows\System\pgAOjqf.exe
  2⤵
  PID:6484
- C:\Windows\System\PSdqoHG.exe
  C:\Windows\System\PSdqoHG.exe
  2⤵
  PID:6500
- C:\Windows\System\VTiiZZm.exe
  C:\Windows\System\VTiiZZm.exe
  2⤵
  PID:6516
- C:\Windows\System\zljeQXk.exe
  C:\Windows\System\zljeQXk.exe
  2⤵
  PID:6532
- C:\Windows\System\imoHkCp.exe
  C:\Windows\System\imoHkCp.exe
  2⤵
  PID:6548
- C:\Windows\System\KyMeByr.exe
  C:\Windows\System\KyMeByr.exe
  2⤵
  PID:6564
- C:\Windows\System\nFxhzgm.exe
  C:\Windows\System\nFxhzgm.exe
  2⤵
  PID:6580
- C:\Windows\System\LzTSFuM.exe
  C:\Windows\System\LzTSFuM.exe
  2⤵
  PID:6596
- C:\Windows\System\pJZZevw.exe
  C:\Windows\System\pJZZevw.exe
  2⤵
  PID:6612
- C:\Windows\System\udhImgL.exe
  C:\Windows\System\udhImgL.exe
  2⤵
  PID:6628
- C:\Windows\System\fzykuWy.exe
  C:\Windows\System\fzykuWy.exe
  2⤵
  PID:6644
- C:\Windows\System\BNWqIPi.exe
  C:\Windows\System\BNWqIPi.exe
  2⤵
  PID:6660
- C:\Windows\System\kynXwKs.exe
  C:\Windows\System\kynXwKs.exe
  2⤵
  PID:6676
- C:\Windows\System\eXkstZb.exe
  C:\Windows\System\eXkstZb.exe
  2⤵
  PID:6692
- C:\Windows\System\lsfiFUY.exe
  C:\Windows\System\lsfiFUY.exe
  2⤵
  PID:6708
- C:\Windows\System\ObGEhXG.exe
  C:\Windows\System\ObGEhXG.exe
  2⤵
  PID:6724
- C:\Windows\System\wyYoEdX.exe
  C:\Windows\System\wyYoEdX.exe
  2⤵
  PID:6740
- C:\Windows\System\BrlpJfL.exe
  C:\Windows\System\BrlpJfL.exe
  2⤵
  PID:6756
- C:\Windows\System\VqdqCPL.exe
  C:\Windows\System\VqdqCPL.exe
  2⤵
  PID:6772
- C:\Windows\System\HQXitBs.exe
  C:\Windows\System\HQXitBs.exe
  2⤵
  PID:6788
- C:\Windows\System\XvzMzNH.exe
  C:\Windows\System\XvzMzNH.exe
  2⤵
  PID:6804
- C:\Windows\System\mTUXqiK.exe
  C:\Windows\System\mTUXqiK.exe
  2⤵
  PID:6820
- C:\Windows\System\aRIhVgc.exe
  C:\Windows\System\aRIhVgc.exe
  2⤵
  PID:6836
- C:\Windows\System\nMqfonz.exe
  C:\Windows\System\nMqfonz.exe
  2⤵
  PID:6852
- C:\Windows\System\afKPrAZ.exe
  C:\Windows\System\afKPrAZ.exe
  2⤵
  PID:6868
- C:\Windows\System\KwWmPTV.exe
  C:\Windows\System\KwWmPTV.exe
  2⤵
  PID:6884
- C:\Windows\System\XayNHAm.exe
  C:\Windows\System\XayNHAm.exe
  2⤵
  PID:6900
- C:\Windows\System\tFFvwAf.exe
  C:\Windows\System\tFFvwAf.exe
  2⤵
  PID:6916
- C:\Windows\System\uFKrvfd.exe
  C:\Windows\System\uFKrvfd.exe
  2⤵
  PID:6932
- C:\Windows\System\wHFqPSQ.exe
  C:\Windows\System\wHFqPSQ.exe
  2⤵
  PID:6948
- C:\Windows\System\mueBZTC.exe
  C:\Windows\System\mueBZTC.exe
  2⤵
  PID:6964
- C:\Windows\System\YIaNKdb.exe
  C:\Windows\System\YIaNKdb.exe
  2⤵
  PID:6980
- C:\Windows\System\ManPudk.exe
  C:\Windows\System\ManPudk.exe
  2⤵
  PID:6996
- C:\Windows\System\wXURXHQ.exe
  C:\Windows\System\wXURXHQ.exe
  2⤵
  PID:7012
- C:\Windows\System\WxveKYQ.exe
  C:\Windows\System\WxveKYQ.exe
  2⤵
  PID:7028
- C:\Windows\System\HgAssxS.exe
  C:\Windows\System\HgAssxS.exe
  2⤵
  PID:7044
- C:\Windows\System\VlqNgBL.exe
  C:\Windows\System\VlqNgBL.exe
  2⤵
  PID:7060
- C:\Windows\System\lFoQGOo.exe
  C:\Windows\System\lFoQGOo.exe
  2⤵
  PID:7076
- C:\Windows\System\XfOzLlQ.exe
  C:\Windows\System\XfOzLlQ.exe
  2⤵
  PID:7092
- C:\Windows\System\QmlGEKO.exe
  C:\Windows\System\QmlGEKO.exe
  2⤵
  PID:7108
- C:\Windows\System\kkFKiUt.exe
  C:\Windows\System\kkFKiUt.exe
  2⤵
  PID:7124
- C:\Windows\System\AIhyxdw.exe
  C:\Windows\System\AIhyxdw.exe
  2⤵
  PID:7140
- C:\Windows\System\kAvkpdT.exe
  C:\Windows\System\kAvkpdT.exe
  2⤵
  PID:7156
- C:\Windows\System\XUmhPZF.exe
  C:\Windows\System\XUmhPZF.exe
  2⤵
  PID:5140
- C:\Windows\System\KTYznHB.exe
  C:\Windows\System\KTYznHB.exe
  2⤵
  PID:5688
- C:\Windows\System\KGLFOzx.exe
  C:\Windows\System\KGLFOzx.exe
  2⤵
  PID:6024
- C:\Windows\System\jvbUzPn.exe
  C:\Windows\System\jvbUzPn.exe
  2⤵
  PID:5476
- C:\Windows\System\TuNlKdQ.exe
  C:\Windows\System\TuNlKdQ.exe
  2⤵
  PID:4432
- C:\Windows\System\AdllEXt.exe
  C:\Windows\System\AdllEXt.exe
  2⤵
  PID:6204
- C:\Windows\System\tbCELhy.exe
  C:\Windows\System\tbCELhy.exe
  2⤵
  PID:5816
- C:\Windows\System\cdmTtHA.exe
  C:\Windows\System\cdmTtHA.exe
  2⤵
  PID:5316
- C:\Windows\System\xIWOsbr.exe
  C:\Windows\System\xIWOsbr.exe
  2⤵
  PID:6172
- C:\Windows\System\bLyDgTo.exe
  C:\Windows\System\bLyDgTo.exe
  2⤵
  PID:6236
- C:\Windows\System\WGjEwJf.exe
  C:\Windows\System\WGjEwJf.exe
  2⤵
  PID:6220
- C:\Windows\System\jPkcyNw.exe
  C:\Windows\System\jPkcyNw.exe
  2⤵
  PID:6284
- C:\Windows\System\uIANyAb.exe
  C:\Windows\System\uIANyAb.exe
  2⤵
  PID:6348
- C:\Windows\System\fOSHPxE.exe
  C:\Windows\System\fOSHPxE.exe
  2⤵
  PID:6412
- C:\Windows\System\gGKIcfU.exe
  C:\Windows\System\gGKIcfU.exe
  2⤵
  PID:6476
- C:\Windows\System\jyDYpqO.exe
  C:\Windows\System\jyDYpqO.exe
  2⤵
  PID:6540
- C:\Windows\System\mwneqLT.exe
  C:\Windows\System\mwneqLT.exe
  2⤵
  PID:6572
- C:\Windows\System\hMiVgYO.exe
  C:\Windows\System\hMiVgYO.exe
  2⤵
  PID:6604
- C:\Windows\System\YYyckZQ.exe
  C:\Windows\System\YYyckZQ.exe
  2⤵
  PID:6400
- C:\Windows\System\GqAKOxm.exe
  C:\Windows\System\GqAKOxm.exe
  2⤵
  PID:6464
- C:\Windows\System\dBTjgsl.exe
  C:\Windows\System\dBTjgsl.exe
  2⤵
  PID:6528
- C:\Windows\System\oUBvWSx.exe
  C:\Windows\System\oUBvWSx.exe
  2⤵
  PID:6588
- C:\Windows\System\adSfreW.exe
  C:\Windows\System\adSfreW.exe
  2⤵
  PID:6636
- C:\Windows\System\cTstEqA.exe
  C:\Windows\System\cTstEqA.exe
  2⤵
  PID:6700
- C:\Windows\System\EqeOfff.exe
  C:\Windows\System\EqeOfff.exe
  2⤵
  PID:6716
- C:\Windows\System\djhcKmf.exe
  C:\Windows\System\djhcKmf.exe
  2⤵
  PID:6736
- C:\Windows\System\iTcQhsm.exe
  C:\Windows\System\iTcQhsm.exe
  2⤵
  PID:6800
- C:\Windows\System\xTCsGvo.exe
  C:\Windows\System\xTCsGvo.exe
  2⤵
  PID:6864
- C:\Windows\System\flQNlou.exe
  C:\Windows\System\flQNlou.exe
  2⤵
  PID:6748
- C:\Windows\System\uqkcsjK.exe
  C:\Windows\System\uqkcsjK.exe
  2⤵
  PID:6960
- C:\Windows\System\mXkbFRo.exe
  C:\Windows\System\mXkbFRo.exe
  2⤵
  PID:7024
- C:\Windows\System\nVhOrUf.exe
  C:\Windows\System\nVhOrUf.exe
  2⤵
  PID:7088
- C:\Windows\System\UTAqtIn.exe
  C:\Windows\System\UTAqtIn.exe
  2⤵
  PID:7152
- C:\Windows\System\QiwTvxE.exe
  C:\Windows\System\QiwTvxE.exe
  2⤵
  PID:6940
- C:\Windows\System\zcqjLuY.exe
  C:\Windows\System\zcqjLuY.exe
  2⤵
  PID:6780
- C:\Windows\System\aiUbLGw.exe
  C:\Windows\System\aiUbLGw.exe
  2⤵
  PID:6784
- C:\Windows\System\jeoNmuv.exe
  C:\Windows\System\jeoNmuv.exe
  2⤵
  PID:6880
- C:\Windows\System\vyYyouJ.exe
  C:\Windows\System\vyYyouJ.exe
  2⤵
  PID:6912
- C:\Windows\System\AOJgZdb.exe
  C:\Windows\System\AOJgZdb.exe
  2⤵
  PID:7004
- C:\Windows\System\nbZILbH.exe
  C:\Windows\System\nbZILbH.exe
  2⤵
  PID:7072
- C:\Windows\System\HBkAXrx.exe
  C:\Windows\System\HBkAXrx.exe
  2⤵
  PID:7136
- C:\Windows\System\LrJFqdp.exe
  C:\Windows\System\LrJFqdp.exe
  2⤵
  PID:5208
- C:\Windows\System\ODVePVU.exe
  C:\Windows\System\ODVePVU.exe
  2⤵
  PID:5876
- C:\Windows\System\ydycjIn.exe
  C:\Windows\System\ydycjIn.exe
  2⤵
  PID:6208
- C:\Windows\System\hKlqLNv.exe
  C:\Windows\System\hKlqLNv.exe
  2⤵
  PID:6380
- C:\Windows\System\KdfSJcW.exe
  C:\Windows\System\KdfSJcW.exe
  2⤵
  PID:6332
- C:\Windows\System\ElbzWbs.exe
  C:\Windows\System\ElbzWbs.exe
  2⤵
  PID:6444
- C:\Windows\System\jOQPcOa.exe
  C:\Windows\System\jOQPcOa.exe
  2⤵
  PID:6396
- C:\Windows\System\QAyWePv.exe
  C:\Windows\System\QAyWePv.exe
  2⤵
  PID:6620
- C:\Windows\System\audFHcZ.exe
  C:\Windows\System\audFHcZ.exe
  2⤵
  PID:6320
- C:\Windows\System\oqBRVEZ.exe
  C:\Windows\System\oqBRVEZ.exe
  2⤵
  PID:6832
- C:\Windows\System\eTJgPje.exe
  C:\Windows\System\eTJgPje.exe
  2⤵
  PID:6652
- C:\Windows\System\kIPekRH.exe
  C:\Windows\System\kIPekRH.exe
  2⤵
  PID:7056
- C:\Windows\System\RqdgkOM.exe
  C:\Windows\System\RqdgkOM.exe
  2⤵
  PID:6812
- C:\Windows\System\NQNZUVF.exe
  C:\Windows\System\NQNZUVF.exe
  2⤵
  PID:7020
- C:\Windows\System\vteNUJI.exe
  C:\Windows\System\vteNUJI.exe
  2⤵
  PID:6136
- C:\Windows\System\PWdwsWw.exe
  C:\Windows\System\PWdwsWw.exe
  2⤵
  PID:6688
- C:\Windows\System\nQGMWHk.exe
  C:\Windows\System\nQGMWHk.exe
  2⤵
  PID:6752
- C:\Windows\System\nGeeKRI.exe
  C:\Windows\System\nGeeKRI.exe
  2⤵
  PID:5912
- C:\Windows\System\TQjcioI.exe
  C:\Windows\System\TQjcioI.exe
  2⤵
  PID:6508
- C:\Windows\System\GHUJIBe.exe
  C:\Windows\System\GHUJIBe.exe
  2⤵
  PID:6672
- C:\Windows\System\aOrjyXs.exe
  C:\Windows\System\aOrjyXs.exe
  2⤵
  PID:6956
- C:\Windows\System\brqqaAs.exe
  C:\Windows\System\brqqaAs.exe
  2⤵
  PID:5368
- C:\Windows\System\JAiIsaR.exe
  C:\Windows\System\JAiIsaR.exe
  2⤵
  PID:7104
- C:\Windows\System\PJdJPBH.exe
  C:\Windows\System\PJdJPBH.exe
  2⤵
  PID:6844
- C:\Windows\System\HnsyBNy.exe
  C:\Windows\System\HnsyBNy.exe
  2⤵
  PID:6432
- C:\Windows\System\wtgSymD.exe
  C:\Windows\System\wtgSymD.exe
  2⤵
  PID:6496
- C:\Windows\System\DOrfamT.exe
  C:\Windows\System\DOrfamT.exe
  2⤵
  PID:6272
- C:\Windows\System\cKesZTA.exe
  C:\Windows\System\cKesZTA.exe
  2⤵
  PID:6368
- C:\Windows\System\WMbzTNt.exe
  C:\Windows\System\WMbzTNt.exe
  2⤵
  PID:6252
- C:\Windows\System\qQySZOU.exe
  C:\Windows\System\qQySZOU.exe
  2⤵
  PID:6992
- C:\Windows\System\EqOFiXR.exe
  C:\Windows\System\EqOFiXR.exe
  2⤵
  PID:6796
- C:\Windows\System\IxxgvCv.exe
  C:\Windows\System\IxxgvCv.exe
  2⤵
  PID:5700
- C:\Windows\System\STGBUBe.exe
  C:\Windows\System\STGBUBe.exe
  2⤵
  PID:6684
- C:\Windows\System\hiVvZac.exe
  C:\Windows\System\hiVvZac.exe
  2⤵
  PID:7184
- C:\Windows\System\dqaKvcB.exe
  C:\Windows\System\dqaKvcB.exe
  2⤵
  PID:7200
- C:\Windows\System\rOxXZqZ.exe
  C:\Windows\System\rOxXZqZ.exe
  2⤵
  PID:7216
- C:\Windows\System\kuDAWzK.exe
  C:\Windows\System\kuDAWzK.exe
  2⤵
  PID:7232
- C:\Windows\System\KoZOzcO.exe
  C:\Windows\System\KoZOzcO.exe
  2⤵
  PID:7248
- C:\Windows\System\sItEsPO.exe
  C:\Windows\System\sItEsPO.exe
  2⤵
  PID:7264
- C:\Windows\System\LtRknSY.exe
  C:\Windows\System\LtRknSY.exe
  2⤵
  PID:7280
- C:\Windows\System\SACyCZq.exe
  C:\Windows\System\SACyCZq.exe
  2⤵
  PID:7296
- C:\Windows\System\ZVGlUZF.exe
  C:\Windows\System\ZVGlUZF.exe
  2⤵
  PID:7312
- C:\Windows\System\GAdKEvR.exe
  C:\Windows\System\GAdKEvR.exe
  2⤵
  PID:7328
- C:\Windows\System\SWXaAyp.exe
  C:\Windows\System\SWXaAyp.exe
  2⤵
  PID:7344
- C:\Windows\System\QwZssLI.exe
  C:\Windows\System\QwZssLI.exe
  2⤵
  PID:7360
- C:\Windows\System\VVUefgF.exe
  C:\Windows\System\VVUefgF.exe
  2⤵
  PID:7376
- C:\Windows\System\sqVDOzt.exe
  C:\Windows\System\sqVDOzt.exe
  2⤵
  PID:7392
- C:\Windows\System\sEBrTSU.exe
  C:\Windows\System\sEBrTSU.exe
  2⤵
  PID:7408
- C:\Windows\System\ySPEFJE.exe
  C:\Windows\System\ySPEFJE.exe
  2⤵
  PID:7424
- C:\Windows\System\DYwmBYN.exe
  C:\Windows\System\DYwmBYN.exe
  2⤵
  PID:7440
- C:\Windows\System\DqvMrhs.exe
  C:\Windows\System\DqvMrhs.exe
  2⤵
  PID:7456
- C:\Windows\System\olAoJYo.exe
  C:\Windows\System\olAoJYo.exe
  2⤵
  PID:7472
- C:\Windows\System\xCSDNUl.exe
  C:\Windows\System\xCSDNUl.exe
  2⤵
  PID:7488
- C:\Windows\System\AyjUyqf.exe
  C:\Windows\System\AyjUyqf.exe
  2⤵
  PID:7504
- C:\Windows\System\qrYIPnB.exe
  C:\Windows\System\qrYIPnB.exe
  2⤵
  PID:7520
- C:\Windows\System\iDPJwnq.exe
  C:\Windows\System\iDPJwnq.exe
  2⤵
  PID:7536
- C:\Windows\System\wEJBYCq.exe
  C:\Windows\System\wEJBYCq.exe
  2⤵
  PID:7600
- C:\Windows\System\lxaphAn.exe
  C:\Windows\System\lxaphAn.exe
  2⤵
  PID:7616
- C:\Windows\System\joWXjzP.exe
  C:\Windows\System\joWXjzP.exe
  2⤵
  PID:7632
- C:\Windows\System\FHlmDas.exe
  C:\Windows\System\FHlmDas.exe
  2⤵
  PID:7648
- C:\Windows\System\EsolfJU.exe
  C:\Windows\System\EsolfJU.exe
  2⤵
  PID:7668
- C:\Windows\System\aeGKhNq.exe
  C:\Windows\System\aeGKhNq.exe
  2⤵
  PID:7684
- C:\Windows\System\Rjjxgrj.exe
  C:\Windows\System\Rjjxgrj.exe
  2⤵
  PID:7700
- C:\Windows\System\yeWDDrB.exe
  C:\Windows\System\yeWDDrB.exe
  2⤵
  PID:7716
- C:\Windows\System\ljeIOca.exe
  C:\Windows\System\ljeIOca.exe
  2⤵
  PID:7732
- C:\Windows\System\PHUFoWj.exe
  C:\Windows\System\PHUFoWj.exe
  2⤵
  PID:7748
- C:\Windows\System\muUBmzm.exe
  C:\Windows\System\muUBmzm.exe
  2⤵
  PID:7764
- C:\Windows\System\MHjMiEz.exe
  C:\Windows\System\MHjMiEz.exe
  2⤵
  PID:7780
- C:\Windows\System\IDkxKuU.exe
  C:\Windows\System\IDkxKuU.exe
  2⤵
  PID:7796
- C:\Windows\System\msMaKdK.exe
  C:\Windows\System\msMaKdK.exe
  2⤵
  PID:7812
- C:\Windows\System\lZpBJVX.exe
  C:\Windows\System\lZpBJVX.exe
  2⤵
  PID:7828
- C:\Windows\System\LDUehNi.exe
  C:\Windows\System\LDUehNi.exe
  2⤵
  PID:7844
- C:\Windows\System\VMpJtUK.exe
  C:\Windows\System\VMpJtUK.exe
  2⤵
  PID:7860
- C:\Windows\System\JEEXqqr.exe
  C:\Windows\System\JEEXqqr.exe
  2⤵
  PID:7880
- C:\Windows\System\uJRWayz.exe
  C:\Windows\System\uJRWayz.exe
  2⤵
  PID:7900
- C:\Windows\System\NsyfxZz.exe
  C:\Windows\System\NsyfxZz.exe
  2⤵
  PID:7916
- C:\Windows\System\ImKSufJ.exe
  C:\Windows\System\ImKSufJ.exe
  2⤵
  PID:7932
- C:\Windows\System\pznvTHa.exe
  C:\Windows\System\pznvTHa.exe
  2⤵
  PID:7948
- C:\Windows\System\mQIMKbA.exe
  C:\Windows\System\mQIMKbA.exe
  2⤵
  PID:7964
- C:\Windows\System\DACLhqt.exe
  C:\Windows\System\DACLhqt.exe
  2⤵
  PID:7980
- C:\Windows\System\cfRpSQU.exe
  C:\Windows\System\cfRpSQU.exe
  2⤵
  PID:7996
- C:\Windows\System\bOioyBC.exe
  C:\Windows\System\bOioyBC.exe
  2⤵
  PID:8012
- C:\Windows\System\HuoExNm.exe
  C:\Windows\System\HuoExNm.exe
  2⤵
  PID:8028
- C:\Windows\System\ynVdcpX.exe
  C:\Windows\System\ynVdcpX.exe
  2⤵
  PID:8044
- C:\Windows\System\tUIstmn.exe
  C:\Windows\System\tUIstmn.exe
  2⤵
  PID:8060
- C:\Windows\System\VeDZzvC.exe
  C:\Windows\System\VeDZzvC.exe
  2⤵
  PID:8076
- C:\Windows\System\MPzgGjr.exe
  C:\Windows\System\MPzgGjr.exe
  2⤵
  PID:8092
- C:\Windows\System\YnASwLr.exe
  C:\Windows\System\YnASwLr.exe
  2⤵
  PID:8108
- C:\Windows\System\NPlftSa.exe
  C:\Windows\System\NPlftSa.exe
  2⤵
  PID:8124
- C:\Windows\System\fPkWJTq.exe
  C:\Windows\System\fPkWJTq.exe
  2⤵
  PID:8140
- C:\Windows\System\INHcqRN.exe
  C:\Windows\System\INHcqRN.exe
  2⤵
  PID:8156
- C:\Windows\System\jReUYxa.exe
  C:\Windows\System\jReUYxa.exe
  2⤵
  PID:8172
- C:\Windows\System\tSLCqlC.exe
  C:\Windows\System\tSLCqlC.exe
  2⤵
  PID:8188
- C:\Windows\System\OPjbNng.exe
  C:\Windows\System\OPjbNng.exe
  2⤵
  PID:7196
- C:\Windows\System\yRWmnkj.exe
  C:\Windows\System\yRWmnkj.exe
  2⤵
  PID:7068
- C:\Windows\System\rTlsnUq.exe
  C:\Windows\System\rTlsnUq.exe
  2⤵
  PID:7292
- C:\Windows\System\FXyKRan.exe
  C:\Windows\System\FXyKRan.exe
  2⤵
  PID:7356
- C:\Windows\System\hFVWurm.exe
  C:\Windows\System\hFVWurm.exe
  2⤵
  PID:7420
- C:\Windows\System\iOhGpvl.exe
  C:\Windows\System\iOhGpvl.exe
  2⤵
  PID:7276
- C:\Windows\System\BPMtnGk.exe
  C:\Windows\System\BPMtnGk.exe
  2⤵
  PID:7404
- C:\Windows\System\DWbxdPd.exe
  C:\Windows\System\DWbxdPd.exe
  2⤵
  PID:6560
- C:\Windows\System\TfEWAUr.exe
  C:\Windows\System\TfEWAUr.exe
  2⤵
  PID:7432
- C:\Windows\System\WRdQWhL.exe
  C:\Windows\System\WRdQWhL.exe
  2⤵
  PID:7308
- C:\Windows\System\UDIkBgt.exe
  C:\Windows\System\UDIkBgt.exe
  2⤵
  PID:7340
- C:\Windows\System\XMqmyJt.exe
  C:\Windows\System\XMqmyJt.exe
  2⤵
  PID:7484
- C:\Windows\System\khsZMfX.exe
  C:\Windows\System\khsZMfX.exe
  2⤵
  PID:7512
- C:\Windows\System\VnwYYLK.exe
  C:\Windows\System\VnwYYLK.exe
  2⤵
  PID:7544
- C:\Windows\System\kThiDRZ.exe
  C:\Windows\System\kThiDRZ.exe
  2⤵
  PID:7564
- C:\Windows\System\SbPqCKH.exe
  C:\Windows\System\SbPqCKH.exe
  2⤵
  PID:7580
- C:\Windows\System\vGCrFCP.exe
  C:\Windows\System\vGCrFCP.exe
  2⤵
  PID:7596
- C:\Windows\System\KZIKYWs.exe
  C:\Windows\System\KZIKYWs.exe
  2⤵
  PID:7660
- C:\Windows\System\QzNfpoU.exe
  C:\Windows\System\QzNfpoU.exe
  2⤵
  PID:7664
- C:\Windows\System\EPBqKwT.exe
  C:\Windows\System\EPBqKwT.exe
  2⤵
  PID:7680
- C:\Windows\System\hgdwFow.exe
  C:\Windows\System\hgdwFow.exe
  2⤵
  PID:7756
- C:\Windows\System\gKJPFOM.exe
  C:\Windows\System\gKJPFOM.exe
  2⤵
  PID:7708
- C:\Windows\System\aRrTFVL.exe
  C:\Windows\System\aRrTFVL.exe
  2⤵
  PID:7744
- C:\Windows\System\RlWyxax.exe
  C:\Windows\System\RlWyxax.exe
  2⤵
  PID:7820
- C:\Windows\System\nfjgpqB.exe
  C:\Windows\System\nfjgpqB.exe
  2⤵
  PID:7868
- C:\Windows\System\SrQmnnX.exe
  C:\Windows\System\SrQmnnX.exe
  2⤵
  PID:7888
- C:\Windows\System\xvXxEak.exe
  C:\Windows\System\xvXxEak.exe
  2⤵
  PID:7908
- C:\Windows\System\bDaFzDz.exe
  C:\Windows\System\bDaFzDz.exe
  2⤵
  PID:7956
- C:\Windows\System\JYRwvwW.exe
  C:\Windows\System\JYRwvwW.exe
  2⤵
  PID:7960
- C:\Windows\System\fpcNczd.exe
  C:\Windows\System\fpcNczd.exe
  2⤵
  PID:7976
- C:\Windows\System\QUIccQB.exe
  C:\Windows\System\QUIccQB.exe
  2⤵
  PID:8056
- C:\Windows\System\iOqnalT.exe
  C:\Windows\System\iOqnalT.exe
  2⤵
  PID:8068
- C:\Windows\System\YkTqMdU.exe
  C:\Windows\System\YkTqMdU.exe
  2⤵
  PID:8088
- C:\Windows\System\eKIbttj.exe
  C:\Windows\System\eKIbttj.exe
  2⤵
  PID:8152
- C:\Windows\System\FtgwArL.exe
  C:\Windows\System\FtgwArL.exe
  2⤵
  PID:7120
- C:\Windows\System\cMxKNaS.exe
  C:\Windows\System\cMxKNaS.exe
  2⤵
  PID:7352
- C:\Windows\System\iKZAkAf.exe
  C:\Windows\System\iKZAkAf.exe
  2⤵
  PID:7272
- C:\Windows\System\dJLRvsD.exe
  C:\Windows\System\dJLRvsD.exe
  2⤵
  PID:7468
- C:\Windows\System\uYjCBQs.exe
  C:\Windows\System\uYjCBQs.exe
  2⤵
  PID:7532
- C:\Windows\System\YxjQykX.exe
  C:\Windows\System\YxjQykX.exe
  2⤵
  PID:6256
- C:\Windows\System\ngSHMjC.exe
  C:\Windows\System\ngSHMjC.exe
  2⤵
  PID:6448
- C:\Windows\System\EPIvhCk.exe
  C:\Windows\System\EPIvhCk.exe
  2⤵
  PID:7336
- C:\Windows\System\tMXdKyY.exe
  C:\Windows\System\tMXdKyY.exe
  2⤵
  PID:7644
- C:\Windows\System\sIOAUbH.exe
  C:\Windows\System\sIOAUbH.exe
  2⤵
  PID:7304
- C:\Windows\System\pSuesOx.exe
  C:\Windows\System\pSuesOx.exe
  2⤵
  PID:7560
- C:\Windows\System\hhdFjwM.exe
  C:\Windows\System\hhdFjwM.exe
  2⤵
  PID:7776
- C:\Windows\System\guIhRnw.exe
  C:\Windows\System\guIhRnw.exe
  2⤵
  PID:7876
- C:\Windows\System\BwuDEyy.exe
  C:\Windows\System\BwuDEyy.exe
  2⤵
  PID:7972
- C:\Windows\System\tatLcoJ.exe
  C:\Windows\System\tatLcoJ.exe
  2⤵
  PID:7640
- C:\Windows\System\HGcnwfB.exe
  C:\Windows\System\HGcnwfB.exe
  2⤵
  PID:7728
- C:\Windows\System\fYsIomM.exe
  C:\Windows\System\fYsIomM.exe
  2⤵
  PID:8104
- C:\Windows\System\VcqQMUD.exe
  C:\Windows\System\VcqQMUD.exe
  2⤵
  PID:7040
- C:\Windows\System\FKJmaqo.exe
  C:\Windows\System\FKJmaqo.exe
  2⤵
  PID:7656
- C:\Windows\System\qsnSOei.exe
  C:\Windows\System\qsnSOei.exe
  2⤵
  PID:7788
- C:\Windows\System\AqJQLXU.exe
  C:\Windows\System\AqJQLXU.exe
  2⤵
  PID:7612
- C:\Windows\System\KBQtrzL.exe
  C:\Windows\System\KBQtrzL.exe
  2⤵
  PID:7892
- C:\Windows\System\kASeHYX.exe
  C:\Windows\System\kASeHYX.exe
  2⤵
  PID:8052
- C:\Windows\System\FJzsoeR.exe
  C:\Windows\System\FJzsoeR.exe
  2⤵
  PID:6720
- C:\Windows\System\MeAZrOb.exe
  C:\Windows\System\MeAZrOb.exe
  2⤵
  PID:7452
- C:\Windows\System\ClriWCU.exe
  C:\Windows\System\ClriWCU.exe
  2⤵
  PID:7260
- C:\Windows\System\UwWnFux.exe
  C:\Windows\System\UwWnFux.exe
  2⤵
  PID:7192
- C:\Windows\System\QOniNTv.exe
  C:\Windows\System\QOniNTv.exe
  2⤵
  PID:7836
- C:\Windows\System\UwlzLBQ.exe
  C:\Windows\System\UwlzLBQ.exe
  2⤵
  PID:7940
- C:\Windows\System\bfnEtdM.exe
  C:\Windows\System\bfnEtdM.exe
  2⤵
  PID:8184
- C:\Windows\System\ubpuSOi.exe
  C:\Windows\System\ubpuSOi.exe
  2⤵
  PID:7928
- C:\Windows\System\FkEUMjK.exe
  C:\Windows\System\FkEUMjK.exe
  2⤵
  PID:7228
- C:\Windows\System\KSxDdtY.exe
  C:\Windows\System\KSxDdtY.exe
  2⤵
  PID:7556
- C:\Windows\System\DJLAkxO.exe
  C:\Windows\System\DJLAkxO.exe
  2⤵
  PID:8072
- C:\Windows\System\GIwFbhQ.exe
  C:\Windows\System\GIwFbhQ.exe
  2⤵
  PID:8120
- C:\Windows\System\PrgNMsP.exe
  C:\Windows\System\PrgNMsP.exe
  2⤵
  PID:7992
- C:\Windows\System\djRXCzj.exe
  C:\Windows\System\djRXCzj.exe
  2⤵
  PID:8024
- C:\Windows\System\gkZDLhI.exe
  C:\Windows\System\gkZDLhI.exe
  2⤵
  PID:8208
- C:\Windows\System\gXBVXDf.exe
  C:\Windows\System\gXBVXDf.exe
  2⤵
  PID:8228
- C:\Windows\System\fJvssUp.exe
  C:\Windows\System\fJvssUp.exe
  2⤵
  PID:8244
- C:\Windows\System\MzTGAsz.exe
  C:\Windows\System\MzTGAsz.exe
  2⤵
  PID:8260
- C:\Windows\System\sGzDIIb.exe
  C:\Windows\System\sGzDIIb.exe
  2⤵
  PID:8276
- C:\Windows\System\IMxSTlR.exe
  C:\Windows\System\IMxSTlR.exe
  2⤵
  PID:8292
- C:\Windows\System\YDWgeve.exe
  C:\Windows\System\YDWgeve.exe
  2⤵
  PID:8308
- C:\Windows\System\gzOFVtG.exe
  C:\Windows\System\gzOFVtG.exe
  2⤵
  PID:8324
- C:\Windows\System\OxArwxf.exe
  C:\Windows\System\OxArwxf.exe
  2⤵
  PID:8340
- C:\Windows\System\dchjRKk.exe
  C:\Windows\System\dchjRKk.exe
  2⤵
  PID:8356
- C:\Windows\System\ayyFuKb.exe
  C:\Windows\System\ayyFuKb.exe
  2⤵
  PID:8372
- C:\Windows\System\MLJpEZu.exe
  C:\Windows\System\MLJpEZu.exe
  2⤵
  PID:8388
- C:\Windows\System\pIAGshZ.exe
  C:\Windows\System\pIAGshZ.exe
  2⤵
  PID:8404
- C:\Windows\System\ZbWukGQ.exe
  C:\Windows\System\ZbWukGQ.exe
  2⤵
  PID:8420
- C:\Windows\System\xcgwxuS.exe
  C:\Windows\System\xcgwxuS.exe
  2⤵
  PID:8440
- C:\Windows\System\THgDgjy.exe
  C:\Windows\System\THgDgjy.exe
  2⤵
  PID:8460
- C:\Windows\System\PQVWSqF.exe
  C:\Windows\System\PQVWSqF.exe
  2⤵
  PID:8480
- C:\Windows\System\FFnKZll.exe
  C:\Windows\System\FFnKZll.exe
  2⤵
  PID:8496
- C:\Windows\System\LXYAXwe.exe
  C:\Windows\System\LXYAXwe.exe
  2⤵
  PID:8512
- C:\Windows\System\KxXzyzM.exe
  C:\Windows\System\KxXzyzM.exe
  2⤵
  PID:8532
- C:\Windows\System\KzEPnSS.exe
  C:\Windows\System\KzEPnSS.exe
  2⤵
  PID:8548
- C:\Windows\System\PLzHbMx.exe
  C:\Windows\System\PLzHbMx.exe
  2⤵
  PID:8572
- C:\Windows\System\GuXBrLq.exe
  C:\Windows\System\GuXBrLq.exe
  2⤵
  PID:8588
- C:\Windows\System\pgWeQKg.exe
  C:\Windows\System\pgWeQKg.exe
  2⤵
  PID:8604
- C:\Windows\System\eGGiYtn.exe
  C:\Windows\System\eGGiYtn.exe
  2⤵
  PID:8620
- C:\Windows\System\WqZfwNE.exe
  C:\Windows\System\WqZfwNE.exe
  2⤵
  PID:8636
- C:\Windows\System\YcDVich.exe
  C:\Windows\System\YcDVich.exe
  2⤵
  PID:8652
- C:\Windows\System\MkiQziV.exe
  C:\Windows\System\MkiQziV.exe
  2⤵
  PID:8668
- C:\Windows\System\ejEFYrd.exe
  C:\Windows\System\ejEFYrd.exe
  2⤵
  PID:8684
- C:\Windows\System\GrBvxvn.exe
  C:\Windows\System\GrBvxvn.exe
  2⤵
  PID:8700
- C:\Windows\System\kAvSNBW.exe
  C:\Windows\System\kAvSNBW.exe
  2⤵
  PID:8716
- C:\Windows\System\sraNvie.exe
  C:\Windows\System\sraNvie.exe
  2⤵
  PID:8732
- C:\Windows\System\dtFozku.exe
  C:\Windows\System\dtFozku.exe
  2⤵
  PID:8748
- C:\Windows\System\oVBnYUC.exe
  C:\Windows\System\oVBnYUC.exe
  2⤵
  PID:8764
- C:\Windows\System\lFCKgfC.exe
  C:\Windows\System\lFCKgfC.exe
  2⤵
  PID:8780
- C:\Windows\System\rqDGwLg.exe
  C:\Windows\System\rqDGwLg.exe
  2⤵
  PID:8796
- C:\Windows\System\rgDQouK.exe
  C:\Windows\System\rgDQouK.exe
  2⤵
  PID:8812
- C:\Windows\System\yKGdxPv.exe
  C:\Windows\System\yKGdxPv.exe
  2⤵
  PID:8828
- C:\Windows\System\HxiuZJX.exe
  C:\Windows\System\HxiuZJX.exe
  2⤵
  PID:8844
- C:\Windows\System\ZgNDeZd.exe
  C:\Windows\System\ZgNDeZd.exe
  2⤵
  PID:8864
- C:\Windows\System\wNgRSmd.exe
  C:\Windows\System\wNgRSmd.exe
  2⤵
  PID:8880
- C:\Windows\System\NbkCLEb.exe
  C:\Windows\System\NbkCLEb.exe
  2⤵
  PID:8896
- C:\Windows\System\ujIGGXO.exe
  C:\Windows\System\ujIGGXO.exe
  2⤵
  PID:8912
- C:\Windows\System\XxvzsgW.exe
  C:\Windows\System\XxvzsgW.exe
  2⤵
  PID:8928
- C:\Windows\System\eqjRHHw.exe
  C:\Windows\System\eqjRHHw.exe
  2⤵
  PID:8944
- C:\Windows\System\wQnglUK.exe
  C:\Windows\System\wQnglUK.exe
  2⤵
  PID:8960
- C:\Windows\System\hcZpFiV.exe
  C:\Windows\System\hcZpFiV.exe
  2⤵
  PID:8976
- C:\Windows\System\LQQwyBm.exe
  C:\Windows\System\LQQwyBm.exe
  2⤵
  PID:8992
- C:\Windows\System\dFOfpRb.exe
  C:\Windows\System\dFOfpRb.exe
  2⤵
  PID:9012
- C:\Windows\System\xaMBodD.exe
  C:\Windows\System\xaMBodD.exe
  2⤵
  PID:9076
- C:\Windows\System\MqCcdih.exe
  C:\Windows\System\MqCcdih.exe
  2⤵
  PID:9104
- C:\Windows\System\ITxjcbt.exe
  C:\Windows\System\ITxjcbt.exe
  2⤵
  PID:9120
- C:\Windows\System\ivWTJuF.exe
  C:\Windows\System\ivWTJuF.exe
  2⤵
  PID:9136
- C:\Windows\System\iATQDpd.exe
  C:\Windows\System\iATQDpd.exe
  2⤵
  PID:9152
- C:\Windows\System\bwYPcTO.exe
  C:\Windows\System\bwYPcTO.exe
  2⤵
  PID:9168
- C:\Windows\System\ydyHVOe.exe
  C:\Windows\System\ydyHVOe.exe
  2⤵
  PID:9184
- C:\Windows\System\RrFfcCO.exe
  C:\Windows\System\RrFfcCO.exe
  2⤵
  PID:9200
- C:\Windows\System\xAHXZJM.exe
  C:\Windows\System\xAHXZJM.exe
  2⤵
  PID:8200
- C:\Windows\System\iWhmkia.exe
  C:\Windows\System\iWhmkia.exe
  2⤵
  PID:8268
- C:\Windows\System\puKLptF.exe
  C:\Windows\System\puKLptF.exe
  2⤵
  PID:7416
- C:\Windows\System\RQMJxQY.exe
  C:\Windows\System\RQMJxQY.exe
  2⤵
  PID:7576
- C:\Windows\System\mJZAqdu.exe
  C:\Windows\System\mJZAqdu.exe
  2⤵
  PID:8252
- C:\Windows\System\gdchahA.exe
  C:\Windows\System\gdchahA.exe
  2⤵
  PID:8364
- C:\Windows\System\bSaigVT.exe
  C:\Windows\System\bSaigVT.exe
  2⤵
  PID:8352
- C:\Windows\System\iuuAVLX.exe
  C:\Windows\System\iuuAVLX.exe
  2⤵
  PID:8400
- C:\Windows\System\BxWpXFa.exe
  C:\Windows\System\BxWpXFa.exe
  2⤵
  PID:8436
- C:\Windows\System\scBohwj.exe
  C:\Windows\System\scBohwj.exe
  2⤵
  PID:8476
- C:\Windows\System\bnzqBQB.exe
  C:\Windows\System\bnzqBQB.exe
  2⤵
  PID:8544
- C:\Windows\System\FtlXsyH.exe
  C:\Windows\System\FtlXsyH.exe
  2⤵
  PID:8452
- C:\Windows\System\KqUbpJw.exe
  C:\Windows\System\KqUbpJw.exe
  2⤵
  PID:8520
- C:\Windows\System\WwWjpBU.exe
  C:\Windows\System\WwWjpBU.exe
  2⤵
  PID:8556
- C:\Windows\System\FXGFbLg.exe
  C:\Windows\System\FXGFbLg.exe
  2⤵
  PID:8568
- C:\Windows\System\rWUVxKH.exe
  C:\Windows\System\rWUVxKH.exe
  2⤵
  PID:8676
- C:\Windows\System\CHIsmln.exe
  C:\Windows\System\CHIsmln.exe
  2⤵
  PID:8744
- C:\Windows\System\bnOwbDz.exe
  C:\Windows\System\bnOwbDz.exe
  2⤵
  PID:8632
- C:\Windows\System\IleZGhf.exe
  C:\Windows\System\IleZGhf.exe
  2⤵
  PID:8788
- C:\Windows\System\qWLIkqd.exe
  C:\Windows\System\qWLIkqd.exe
  2⤵
  PID:8756
- C:\Windows\System\flZcDJl.exe
  C:\Windows\System\flZcDJl.exe
  2⤵
  PID:8804
- C:\Windows\System\KeDXHhm.exe
  C:\Windows\System\KeDXHhm.exe
  2⤵
  PID:8876
- C:\Windows\System\MNQCDiK.exe
  C:\Windows\System\MNQCDiK.exe
  2⤵
  PID:8968
- C:\Windows\System\ftrhOai.exe
  C:\Windows\System\ftrhOai.exe
  2⤵
  PID:8860
- C:\Windows\System\ifpSHrJ.exe
  C:\Windows\System\ifpSHrJ.exe
  2⤵
  PID:9000
- C:\Windows\System\yqmvXiF.exe
  C:\Windows\System\yqmvXiF.exe
  2⤵
  PID:8988
- C:\Windows\System\cMgQuMf.exe
  C:\Windows\System\cMgQuMf.exe
  2⤵
  PID:9028
- C:\Windows\System\gRfDBVM.exe
  C:\Windows\System\gRfDBVM.exe
  2⤵
  PID:9048
- C:\Windows\System\SlfiwWJ.exe
  C:\Windows\System\SlfiwWJ.exe
  2⤵
  PID:9068
- C:\Windows\System\WYDWURp.exe
  C:\Windows\System\WYDWURp.exe
  2⤵
  PID:9092
- C:\Windows\System\sLfnsGL.exe
  C:\Windows\System\sLfnsGL.exe
  2⤵
  PID:9116
- C:\Windows\System\wSmwrvk.exe
  C:\Windows\System\wSmwrvk.exe
  2⤵
  PID:9164
- C:\Windows\System\TmnXurG.exe
  C:\Windows\System\TmnXurG.exe
  2⤵
  PID:9208
- C:\Windows\System\QSBnCty.exe
  C:\Windows\System\QSBnCty.exe
  2⤵
  PID:8300
- C:\Windows\System\alqCsss.exe
  C:\Windows\System\alqCsss.exe
  2⤵
  PID:8288
- C:\Windows\System\LSTXiwm.exe
  C:\Windows\System\LSTXiwm.exe
  2⤵
  PID:8224
- C:\Windows\System\hUwacfw.exe
  C:\Windows\System\hUwacfw.exe
  2⤵
  PID:8348
- C:\Windows\System\jpHBuyw.exe
  C:\Windows\System\jpHBuyw.exe
  2⤵
  PID:8416
- C:\Windows\System\secnMwQ.exe
  C:\Windows\System\secnMwQ.exe
  2⤵
  PID:8448
- C:\Windows\System\FglHzZi.exe
  C:\Windows\System\FglHzZi.exe
  2⤵
  PID:8596
- C:\Windows\System\QTgkFcz.exe
  C:\Windows\System\QTgkFcz.exe
  2⤵
  PID:8628
- C:\Windows\System\QdjQcOl.exe
  C:\Windows\System\QdjQcOl.exe
  2⤵
  PID:8872
- C:\Windows\System\wRXJgqX.exe
  C:\Windows\System\wRXJgqX.exe
  2⤵
  PID:8924
- C:\Windows\System\dOpjnDg.exe
  C:\Windows\System\dOpjnDg.exe
  2⤵
  PID:9160
- C:\Windows\System\FWRQRNH.exe
  C:\Windows\System\FWRQRNH.exe
  2⤵
  PID:9212
- C:\Windows\System\CjwCFVl.exe
  C:\Windows\System\CjwCFVl.exe
  2⤵
  PID:8528
- C:\Windows\System\jgcxlBn.exe
  C:\Windows\System\jgcxlBn.exe
  2⤵
  PID:9044
- C:\Windows\System\kKhTPMv.exe
  C:\Windows\System\kKhTPMv.exe
  2⤵
  PID:8560
- C:\Windows\System\cxsqzvz.exe
  C:\Windows\System\cxsqzvz.exe
  2⤵
  PID:8236
- C:\Windows\System\ObZNHtA.exe
  C:\Windows\System\ObZNHtA.exe
  2⤵
  PID:8708
- C:\Windows\System\WPrUWCC.exe
  C:\Windows\System\WPrUWCC.exe
  2⤵
  PID:8692
- C:\Windows\System\TphAvBw.exe
  C:\Windows\System\TphAvBw.exe
  2⤵
  PID:8956
- C:\Windows\System\syHGXop.exe
  C:\Windows\System\syHGXop.exe
  2⤵
  PID:9056
- C:\Windows\System\AthfKAL.exe
  C:\Windows\System\AthfKAL.exe
  2⤵
  PID:9112
- C:\Windows\System\feRjZNI.exe
  C:\Windows\System\feRjZNI.exe
  2⤵
  PID:8540
- C:\Windows\System\CcHMLMA.exe
  C:\Windows\System\CcHMLMA.exe
  2⤵
  PID:9084
- C:\Windows\System\zZgGawu.exe
  C:\Windows\System\zZgGawu.exe
  2⤵
  PID:8724
- C:\Windows\System\oLHJXKw.exe
  C:\Windows\System\oLHJXKw.exe
  2⤵
  PID:8936
- C:\Windows\System\bserjft.exe
  C:\Windows\System\bserjft.exe
  2⤵
  PID:9180
- C:\Windows\System\bTNHqMM.exe
  C:\Windows\System\bTNHqMM.exe
  2⤵
  PID:8664
- C:\Windows\System\iorRCpu.exe
  C:\Windows\System\iorRCpu.exe
  2⤵
  PID:9100
- C:\Windows\System\yzKmGUZ.exe
  C:\Windows\System\yzKmGUZ.exe
  2⤵
  PID:8952
- C:\Windows\System\laqPHst.exe
  C:\Windows\System\laqPHst.exe
  2⤵
  PID:8856
- C:\Windows\System\KrlmOtl.exe
  C:\Windows\System\KrlmOtl.exe
  2⤵
  PID:8584
- C:\Windows\System\sjOuyLw.exe
  C:\Windows\System\sjOuyLw.exe
  2⤵
  PID:9040
- C:\Windows\System\IDwlAPC.exe
  C:\Windows\System\IDwlAPC.exe
  2⤵
  PID:8336
- C:\Windows\System\jssaPZY.exe
  C:\Windows\System\jssaPZY.exe
  2⤵
  PID:8776
- C:\Windows\System\eBmEzis.exe
  C:\Windows\System\eBmEzis.exe
  2⤵
  PID:9220
- C:\Windows\System\ndNIamW.exe
  C:\Windows\System\ndNIamW.exe
  2⤵
  PID:9236
- C:\Windows\System\UIBDpgn.exe
  C:\Windows\System\UIBDpgn.exe
  2⤵
  PID:9252
- C:\Windows\System\qsdRVUQ.exe
  C:\Windows\System\qsdRVUQ.exe
  2⤵
  PID:9268
- C:\Windows\System\yfCiTeA.exe
  C:\Windows\System\yfCiTeA.exe
  2⤵
  PID:9284
- C:\Windows\System\NvUwZzP.exe
  C:\Windows\System\NvUwZzP.exe
  2⤵
  PID:9300
- C:\Windows\System\kqFZfhK.exe
  C:\Windows\System\kqFZfhK.exe
  2⤵
  PID:9316
- C:\Windows\System\bhzEAgd.exe
  C:\Windows\System\bhzEAgd.exe
  2⤵
  PID:9332
- C:\Windows\System\ZVbRZbT.exe
  C:\Windows\System\ZVbRZbT.exe
  2⤵
  PID:9348
- C:\Windows\System\hPnYgts.exe
  C:\Windows\System\hPnYgts.exe
  2⤵
  PID:9364
- C:\Windows\System\NCCDKfp.exe
  C:\Windows\System\NCCDKfp.exe
  2⤵
  PID:9380
- C:\Windows\System\sRJFNtG.exe
  C:\Windows\System\sRJFNtG.exe
  2⤵
  PID:9396
- C:\Windows\System\yaiLCMB.exe
  C:\Windows\System\yaiLCMB.exe
  2⤵
  PID:9412
- C:\Windows\System\TgckVsM.exe
  C:\Windows\System\TgckVsM.exe
  2⤵
  PID:9428
- C:\Windows\System\yXJTcFf.exe
  C:\Windows\System\yXJTcFf.exe
  2⤵
  PID:9444
- C:\Windows\System\jvccwYb.exe
  C:\Windows\System\jvccwYb.exe
  2⤵
  PID:9468
- C:\Windows\System\uGrpxeY.exe
  C:\Windows\System\uGrpxeY.exe
  2⤵
  PID:9484
- C:\Windows\System\bOveGFX.exe
  C:\Windows\System\bOveGFX.exe
  2⤵
  PID:9500
- C:\Windows\System\OmfIeQx.exe
  C:\Windows\System\OmfIeQx.exe
  2⤵
  PID:9516
- C:\Windows\System\wCnGdKb.exe
  C:\Windows\System\wCnGdKb.exe
  2⤵
  PID:9532
- C:\Windows\System\YSHdxQr.exe
  C:\Windows\System\YSHdxQr.exe
  2⤵
  PID:9548
- C:\Windows\System\jDWoWcG.exe
  C:\Windows\System\jDWoWcG.exe
  2⤵
  PID:9564
- C:\Windows\System\vwyluKq.exe
  C:\Windows\System\vwyluKq.exe
  2⤵
  PID:9580
- C:\Windows\System\ZsiDfwR.exe
  C:\Windows\System\ZsiDfwR.exe
  2⤵
  PID:9612
- C:\Windows\System\OTCBxnV.exe
  C:\Windows\System\OTCBxnV.exe
  2⤵
  PID:9628
- C:\Windows\System\vCaNMFC.exe
  C:\Windows\System\vCaNMFC.exe
  2⤵
  PID:9644
- C:\Windows\System\hQbXizT.exe
  C:\Windows\System\hQbXizT.exe
  2⤵
  PID:9660
- C:\Windows\System\hNipQWq.exe
  C:\Windows\System\hNipQWq.exe
  2⤵
  PID:9680
- C:\Windows\System\XxzLciZ.exe
  C:\Windows\System\XxzLciZ.exe
  2⤵
  PID:9768
- C:\Windows\System\QbiJdgQ.exe
  C:\Windows\System\QbiJdgQ.exe
  2⤵
  PID:9784
- C:\Windows\System\BuyqqWx.exe
  C:\Windows\System\BuyqqWx.exe
  2⤵
  PID:9800
- C:\Windows\System\ITWdqBH.exe
  C:\Windows\System\ITWdqBH.exe
  2⤵
  PID:9816
- C:\Windows\System\hDLLNvG.exe
  C:\Windows\System\hDLLNvG.exe
  2⤵
  PID:9832
- C:\Windows\System\AINNANu.exe
  C:\Windows\System\AINNANu.exe
  2⤵
  PID:9848
- C:\Windows\System\RrsPXdJ.exe
  C:\Windows\System\RrsPXdJ.exe
  2⤵
  PID:9864
- C:\Windows\System\mAkuSYH.exe
  C:\Windows\System\mAkuSYH.exe
  2⤵
  PID:9884
- C:\Windows\System\RrUbGbn.exe
  C:\Windows\System\RrUbGbn.exe
  2⤵
  PID:9900
- C:\Windows\System\weEcsLk.exe
  C:\Windows\System\weEcsLk.exe
  2⤵
  PID:9920
- C:\Windows\System\sNCLySw.exe
  C:\Windows\System\sNCLySw.exe
  2⤵
  PID:9936
- C:\Windows\System\WCUfqtM.exe
  C:\Windows\System\WCUfqtM.exe
  2⤵
  PID:9952
- C:\Windows\System\fsUgLQQ.exe
  C:\Windows\System\fsUgLQQ.exe
  2⤵
  PID:9968
- C:\Windows\System\RwibxsH.exe
  C:\Windows\System\RwibxsH.exe
  2⤵
  PID:10000
- C:\Windows\System\cCCvHwN.exe
  C:\Windows\System\cCCvHwN.exe
  2⤵
  PID:10024
- C:\Windows\System\DkeXByi.exe
  C:\Windows\System\DkeXByi.exe
  2⤵
  PID:10048
- C:\Windows\System\BJYhUeH.exe
  C:\Windows\System\BJYhUeH.exe
  2⤵
  PID:10068
- C:\Windows\System\XwAtFtW.exe
  C:\Windows\System\XwAtFtW.exe
  2⤵
  PID:10088
- C:\Windows\System\sCeszvv.exe
  C:\Windows\System\sCeszvv.exe
  2⤵
  PID:10104
- C:\Windows\System\hebwhLt.exe
  C:\Windows\System\hebwhLt.exe
  2⤵
  PID:10120
- C:\Windows\System\rNriSnq.exe
  C:\Windows\System\rNriSnq.exe
  2⤵
  PID:10140
- C:\Windows\System\OXnEGoJ.exe
  C:\Windows\System\OXnEGoJ.exe
  2⤵
  PID:10156
- C:\Windows\System\uHBUoqI.exe
  C:\Windows\System\uHBUoqI.exe
  2⤵
  PID:10172
- C:\Windows\System\uCFjLqb.exe
  C:\Windows\System\uCFjLqb.exe
  2⤵
  PID:10188
- C:\Windows\System\MnfOVRa.exe
  C:\Windows\System\MnfOVRa.exe
  2⤵
  PID:10204
- C:\Windows\System\IWcRGPb.exe
  C:\Windows\System\IWcRGPb.exe
  2⤵
  PID:10220
- C:\Windows\System\xSXxEMp.exe
  C:\Windows\System\xSXxEMp.exe
  2⤵
  PID:10236
- C:\Windows\System\WbchHjw.exe
  C:\Windows\System\WbchHjw.exe
  2⤵
  PID:9248
- C:\Windows\System\mgwgoWG.exe
  C:\Windows\System\mgwgoWG.exe
  2⤵
  PID:9280
- C:\Windows\System\UelaIzD.exe
  C:\Windows\System\UelaIzD.exe
  2⤵
  PID:9228
- C:\Windows\System\VnhPhne.exe
  C:\Windows\System\VnhPhne.exe
  2⤵
  PID:9360
- C:\Windows\System\rNoHgbJ.exe
  C:\Windows\System\rNoHgbJ.exe
  2⤵
  PID:9196
- C:\Windows\System\oJIdvsd.exe
  C:\Windows\System\oJIdvsd.exe
  2⤵
  PID:9480
- C:\Windows\System\rSpDkcK.exe
  C:\Windows\System\rSpDkcK.exe
  2⤵
  PID:9544
- C:\Windows\System\VryjTdT.exe
  C:\Windows\System\VryjTdT.exe
  2⤵
  PID:9424
- C:\Windows\System\cqyLhXZ.exe
  C:\Windows\System\cqyLhXZ.exe
  2⤵
  PID:9456
- C:\Windows\System\niwkjzP.exe
  C:\Windows\System\niwkjzP.exe
  2⤵
  PID:9496
- C:\Windows\System\udUXFgG.exe
  C:\Windows\System\udUXFgG.exe
  2⤵
  PID:9596
- C:\Windows\System\cdWYpfu.exe
  C:\Windows\System\cdWYpfu.exe
  2⤵
  PID:9600
- C:\Windows\System\ClmTmch.exe
  C:\Windows\System\ClmTmch.exe
  2⤵
  PID:9668
- C:\Windows\System\bvAngXx.exe
  C:\Windows\System\bvAngXx.exe
  2⤵
  PID:9676
- C:\Windows\System\BbScRDa.exe
  C:\Windows\System\BbScRDa.exe
  2⤵
  PID:9700
- C:\Windows\System\lTItzPy.exe
  C:\Windows\System\lTItzPy.exe
  2⤵
  PID:9716
- C:\Windows\System\xUElMeY.exe
  C:\Windows\System\xUElMeY.exe
  2⤵
  PID:9732
- C:\Windows\System\NmWhQHM.exe
  C:\Windows\System\NmWhQHM.exe
  2⤵
  PID:9748
- C:\Windows\System\fHXNWrA.exe
  C:\Windows\System\fHXNWrA.exe
  2⤵
  PID:9764
- C:\Windows\System\WlaypcR.exe
  C:\Windows\System\WlaypcR.exe
  2⤵
  PID:9796
- C:\Windows\System\VCuNCdl.exe
  C:\Windows\System\VCuNCdl.exe
  2⤵
  PID:9824
- C:\Windows\System\OJzhbTa.exe
  C:\Windows\System\OJzhbTa.exe
  2⤵
  PID:9872
- C:\Windows\System\QelJeWM.exe
  C:\Windows\System\QelJeWM.exe
  2⤵
  PID:9892
- C:\Windows\System\KuvncwU.exe
  C:\Windows\System\KuvncwU.exe
  2⤵
  PID:9960
- C:\Windows\System\JjSENnR.exe
  C:\Windows\System\JjSENnR.exe
  2⤵
  PID:9912
- C:\Windows\System\WeMnxRe.exe
  C:\Windows\System\WeMnxRe.exe
  2⤵
  PID:9988
- C:\Windows\System\YXrhsOV.exe
  C:\Windows\System\YXrhsOV.exe
  2⤵
  PID:10032
- C:\Windows\System\WezLzlP.exe
  C:\Windows\System\WezLzlP.exe
  2⤵
  PID:10008
- C:\Windows\System\BKUyHQY.exe
  C:\Windows\System\BKUyHQY.exe
  2⤵
  PID:10056
- C:\Windows\System\bWeZxTh.exe
  C:\Windows\System\bWeZxTh.exe
  2⤵
  PID:10100
- C:\Windows\System\csZkLtz.exe
  C:\Windows\System\csZkLtz.exe
  2⤵
  PID:10168
- C:\Windows\System\SpiwYeG.exe
  C:\Windows\System\SpiwYeG.exe
  2⤵
  PID:9036
- C:\Windows\System\qZMAqby.exe
  C:\Windows\System\qZMAqby.exe
  2⤵
  PID:9244
- C:\Windows\System\sbyyOEA.exe
  C:\Windows\System\sbyyOEA.exe
  2⤵
  PID:10116
- C:\Windows\System\uGvIgVQ.exe
  C:\Windows\System\uGvIgVQ.exe
  2⤵
  PID:9024
- C:\Windows\System\rocFejv.exe
  C:\Windows\System\rocFejv.exe
  2⤵
  PID:9344
- C:\Windows\System\PWkwrAC.exe
  C:\Windows\System\PWkwrAC.exe
  2⤵
  PID:9296
- C:\Windows\System\ofoaqHj.exe
  C:\Windows\System\ofoaqHj.exe
  2⤵
  PID:9404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CJfBScT.exe

Filesize
1.5MB

MD5
56eec1d000f2abac96886f44f108bab0

SHA1
640ab7bafbdcb79f6987f9cbb31991917af353fd

SHA256
f137f3f923d859e533cb1a2c5231e268bff21950bc728eb3c755a80228ae29ef

SHA512
d79f587b076162f2edc19cbb6f8ffd43fb85adf6abfd3ebebcf1e656a42f95ddc25247e4ed880cb0a8f5eaed85fb2e0cbd4dbcf15ff8240af7f2d3c086a968db

Download Submit
C:\Windows\system\DRyhwFy.exe

Filesize
1.5MB

MD5
8bf4cf0381d28186cb9826f4c0c885ab

SHA1
1d846038019f811da311e5c7514dab017d128076

SHA256
0afdd40f454a9563ae044455f76b479fac5f47b6377b20b35bce44006a790a01

SHA512
5cd9e48aca11093e079cfc4d9fdd98deaad885462b7fce26a7bc5fce81eafc22800008b736ad9cc69ea0d1ccf71fca48339b9e81e9f26b54249575c7dfc50d4f

Download Submit
C:\Windows\system\DkYqorh.exe

Filesize
1.5MB

MD5
4b9bce68e51adb8aa2a477a3811daf33

SHA1
3c80259274f4389916700c92caa576493ca74b9d

SHA256
ae10e041b91f7f944229efeda7662ae2955a0f30a8ba45478b130341597d6dea

SHA512
fba97fdfa93b94c47a67443ac3d95c590ccb66edf179fe19f4bfb9c248c03643e709dee0f5d7a11b1ad2fc5bea1c9a126acf2146cd625a8e48ec7f44de82203f

Download Submit
C:\Windows\system\JIWyEjY.exe

Filesize
1.5MB

MD5
5fc2f2a74d6073faa172a920b156b069

SHA1
ced61a83c8e7f146f97a4d59697a962dee5cde1e

SHA256
4d46660782e5061d899ecdd8c06d92687956a86cfb046af277de050333b4a2e3

SHA512
e92d410c6431b35d61f1c1812e72fd5180fa6f074359ce27a136ff2225a39f360a15ce6299673a0354af072b13e3a8d2665cb5bf5ad3f8692fe9acd9801ee5ad

Download Submit
C:\Windows\system\LbraeRv.exe

Filesize
1.5MB

MD5
3ad68b673d623b48ceb659a7d83f9d69

SHA1
39b3fe0380cf74617af9755149bac441253849c5

SHA256
281126d5952b7a15a38db436cd9f1f7ac674abf34dba301d042c1c06b978f093

SHA512
eb0732b6635eef63ef09476302e87abad8a0d60ec7619f6c539cde71fccb838bb825e0b76953405ac25db7d34b73135c9a3abeb998026560c57a561dde51885c

Download Submit
C:\Windows\system\MbnVphJ.exe

Filesize
1.5MB

MD5
eb56f6df384f19a73b83f851fbf3f96a

SHA1
5ae8185e824d9f469dea20e078e690cf5111d406

SHA256
ea4b557c9044cbc0911b5bb741ed7c53e932d796fd586e29e108b2a2dcf8c411

SHA512
e42defa77bc2bec17c77cc7ec8b949e105e9f25386cda2f98501613d6211ee0b16d640b97a2cb7b304bc19c7dc6200d0367528e65ed55cf902e79c45fe809f2d

Download Submit
C:\Windows\system\NwdNBkh.exe

Filesize
1.5MB

MD5
4d90e7783fd60da06fb96b081ab9308e

SHA1
0973dca8ec7975261cb8a1ec306b375c338f56fe

SHA256
0031977eee509cd5d63f71edc95384ced36193ae3e44f2cd8411233141253f48

SHA512
fcb70f281325c6768d636d5ca547695e0321d20ef8c4ea5a055dcd0027b6fbc7b0f257a481034c0cc82fa4320003ca398f2e630d824963612c6c5d3c906278cd

Download Submit
C:\Windows\system\OJBuubr.exe

Filesize
1.5MB

MD5
fc7e866248fb5c5e954a7bf5bae0bf19

SHA1
52d1a9ec7a9f89739b6ab217972079a1f5e42baa

SHA256
bfed4b05d59e6fa3a5b70f5fae1b4b96722cffa487d94a3ff152020987d9463e

SHA512
5ea14b0769791af68c3072a0ddc973a4a7ebe368f6c5d30d5c9b458ca988f4b321fa03c3cd72beac1c9d44e56de8562770d33b5b23bcb3b48b3357e9a9d852cb

Download Submit
C:\Windows\system\OcKykRi.exe

Filesize
1.5MB

MD5
837cf91a9cc5eacc9650c88d7eefc02d

SHA1
5f2498c2ee487e8fa9802186143fb745dd6afce6

SHA256
5036759050ac4a9bcf410a5eb608a246cfeec935199cb18e189f72ac894ce973

SHA512
e557bc043246e728dfa07d4c2465fa73ccfc495f712fe2701fa0a96921063793a8383d7f3aa5193920a6a1fbb0974c4fd3fccd7d296011cd525b72c49d8c5d31

Download Submit
C:\Windows\system\OkEkRrz.exe

Filesize
1.5MB

MD5
031cb1a11e6d466741a7901e5c68061c

SHA1
0c720dbb299e221264afd4ee45e25785bb1b0d85

SHA256
9a400fc940253fd4e3ce043a43d123362e961438b8d54a02442e7f670f41a5d8

SHA512
0322dfb9ec8c2c13e31c7dc9726f2ed6283ab65871d1220c989569abb8a2a647f142bc38fb2704e0f19020f7481504e794f86a3e03bbb20d42ada0d4ddf478db

Download Submit
C:\Windows\system\OmaUXiZ.exe

Filesize
1.5MB

MD5
3b5a859d8854a6fd583506e6ad3993f3

SHA1
cfe36b2fb768e98d096cdc49fa53b66eb2cae312

SHA256
48ce95b654933f297a9052ed062e4a890ab0b4f213063b1f1fb27db11b5348a7

SHA512
92ea1fd3026d094ab8fa282c3f0c58dcb231187be253c212cef69b6c8c9afaae7b5c19740399050c1204b5ad2e9af56169b25db6fd9a9c811efdf9e7012d4951

Download Submit
C:\Windows\system\PfRmUaf.exe

Filesize
1.5MB

MD5
1c6ab448ce66f377155d41f6d1666179

SHA1
373f71fd857f6477fb24744d996b791bf8e95ab8

SHA256
da559712ec8f15d6a21426624c8c66b594b22e242045c8c5a1bd876251bdd9ee

SHA512
bcd5488e35c10378d0fc4b369c882d017ccd277bd724ad15968bdfb88f3e4b6162f40029c5841117260f88ada0a8a24527301be5791fb10255da467f14e5442f

Download Submit
C:\Windows\system\QVVcYhL.exe

Filesize
1.5MB

MD5
70083c5a58aca553e4998c37f9b06708

SHA1
c63ef12ef6ed8eca0afd7bda9fa6ee8167234004

SHA256
8cbf3d9f278faff8f3915b7ed1bde14897b18709d0e2f35a71d5106074c789b8

SHA512
601a7c11c52126375a3269ed06706692135c37b8df88998cd8b139e7a85b2b5a9051532e897f868ab0ff2c912be6959ddc92ff107251764de96f5cdeaca1b184

Download Submit
C:\Windows\system\SKNBOIY.exe

Filesize
1.5MB

MD5
504eec178dadc9755cce62b93fb2d9a8

SHA1
ad4e9cf630ac39a3e145d2a93764b0c8b1cd723a

SHA256
af09835680c596ca6551553eb8681a35980697934d711580d40090ce5bb813a8

SHA512
c6afe124b8647674d0c9528a9469b43903c52330477a64eaca2bbc69b909aea4c9cecae1a3666458120b39f1498b18b071fdd5793d0ec344bdc5840851331ece

Download Submit
C:\Windows\system\TBpCRMK.exe

Filesize
1.5MB

MD5
fae13b1f5f97149efcf4ba202b5d4237

SHA1
e2bd4b5c90eff8e64c1b93c466ebd9e737f14fbf

SHA256
2a0f1a3918c3bd6abec50a54366a5b423a7897a1bd7dc700a7bdab8fd1220deb

SHA512
da6abce279fc4993fa14309ff230d7ae5d4d1352d1acff39671dc0a82ccc4d26c12a918cd5b7ab0a7d6aa3f157c5ba2c4354ab73f85b11f362d4564d0570833e

Download Submit
C:\Windows\system\XSfaAow.exe

Filesize
1.5MB

MD5
30dbc3eedd7a2afa6177042ad871d092

SHA1
8b3353edbbbf8050c35ebfc0e57a1d6c2052146b

SHA256
18e6d74d65fa33c1ccad80dca4500b2a644d775189f112f6105944d9d55d6f59

SHA512
4f8acffff38d8ba8de79f411ac64694d3a44f562b2ee5e8983f1f286126dcebc7a67f86aa2de8cff5cc6a6dc3c297e1583726a82b2ffee2ca88ba9a9c7793f33

Download Submit
C:\Windows\system\ZJUtiVT.exe

Filesize
1.5MB

MD5
e7b64536f25b1d9bc603a9f463abb020

SHA1
9b1ffb7a7d7d8637aa43d511925ad0fd8c38de7e

SHA256
1b8a651c70e1722f7e186f0352e003b5d9cb1f2bb8af4a4a34bfad8988087118

SHA512
626c5cc23b6ce16d1388da50e4f84efd6ae15e78ac7c2d25ffc0cdbad0e6d3a906804cac8d1ddffee23fbf241c89a63e93bc6aced53648f6a27a567fb9f0defa

Download Submit
C:\Windows\system\cGPRqUl.exe

Filesize
1.5MB

MD5
4ad27ef40d894f0edcba587d52da60f8

SHA1
459eae00c36ed3075c32e8958400f7a6568fcfb7

SHA256
85a38ba097802a50212204844ae7170daa67af0cb6a48600a7958b50db5e7ef4

SHA512
4aa5916187df19549511367dd1bbafe6a82e42aa9c4404feea76739ddf4d121f046a0854f2c82ee87bce9686c3b12a468119ce3924750873b07ad76fc11a9125

Download Submit
C:\Windows\system\cQgSrwI.exe

Filesize
1.5MB

MD5
e8eef2f0be252088fb181e9b6285a982

SHA1
8c68b56bb998b862ed162bca057347e08199eac3

SHA256
348dbc88124842315a63c89bbd7939b79f97c6526990e7e0f1c192cd643432ac

SHA512
91f02cd4a99571791695e606560ebf76192b56b47762a997d0d5bbbec55fb927316fd33ebab0cc151dbf052e77fb5810352c32812147f77fce45d7a6d46b099d

Download Submit
C:\Windows\system\eSKIrJp.exe

Filesize
1.5MB

MD5
9fa89f2fb939973bff42bfad37e739cf

SHA1
bda72483fd1e0f51a3d24c3182afd900b2d29765

SHA256
b0851603a1f7f22926d92cdccc968a88e6d55d954172dc1b9099d3ba104474b2

SHA512
2b20e5e9720dafa88ed893b6164d49755fd5f27c227c6de7c0fe702669ec353ca2a7aca3c02b277dde7d2387254981f72b2b085066cd2ec9b269b4500258aa73

Download Submit
C:\Windows\system\fscxgTt.exe

Filesize
1.5MB

MD5
47fc43ed6eadf62707c5b69bea4b5fec

SHA1
25213f19ee1c2dba37b1815ac00bc70202c3c918

SHA256
d03f2d5ac5493709db4c0871280ee10892c4391ee4563b1ed063d2d830b3421b

SHA512
b789b06a9af2a2e53f3143daf504263c1d291ca57bc5296e93f275d16b8645f74d970fed77c09ab46b0aea267bea1c1ca91275dc03ba557779f83485671dd14d

Download Submit
C:\Windows\system\jBAiXwI.exe

Filesize
1.5MB

MD5
d44b4f208c6318cdb2f1abcf8277dcde

SHA1
b31efddba992f7bd813d0a93cac6a29ea68b5967

SHA256
80098e50505afc732e71bf5c49f99fb1fd3c273e8f2a711c176221d1581a378a

SHA512
7893a515ca25c7431d3abc80d57be8a5a73b1b43c3878b6f2c544a4e205b9cc2440b141d7cdce325318930730e3ec56dcdd947fb6eb94a8d4c17d276ab21ed48

Download Submit
C:\Windows\system\jyeuVqf.exe

Filesize
1.5MB

MD5
7178fb618ccb7b2a1f7f95430e0d6695

SHA1
a095d24d6f5e51e3ec6a811b63efd0eaddb14e4f

SHA256
58adb2edd0cbf5a3a5f814d987b03d4f19ed9afde5e24a762b13334a6d5b6656

SHA512
76683a929f47834278e9ea50147d564bb44dcbcc2ef978414438a0edb405aa1e70c23b388693c6cb3f4b9862ee4e23542706941b7b2e7c5a5057d1fbad0a48ef

Download Submit
C:\Windows\system\lSRwZCC.exe

Filesize
1.5MB

MD5
b97d420f17da5464d0617a996a35cee3

SHA1
ef9f93468411c941b75e8c89db89c0307fe7fb7a

SHA256
4df2fcf50f3a02e755f48af2d4d4b1598a6999e8fa49652116bb00db472a6c95

SHA512
78f927e9a37acf3460999e5d1bd3223a37aec8a263b56199d794d94bdaffc8fa685e0f4a0c35f9efa91ec7520079a3bc4f1b16d9d12ff6fffb8bff7cc967033d

Download Submit
C:\Windows\system\oIvEKql.exe

Filesize
1.5MB

MD5
ed8e32d7c4df1bffa941ca0a7a3f3721

SHA1
b07059f2459520e07add5f1fe0d48bee085f122f

SHA256
55aa0ba2afd0c0d530c50f270b8e79ab74a8d0707fe891055a16ab8368caa21a

SHA512
5b1332c9ae261731ee9304c83269332763f511ec3f79305b4cb1dad6c3e2bab52245d94ccfde3df26c0dbcf4009029482c7167c1df159bed074f87b2ce157197

Download Submit
C:\Windows\system\oihWEqW.exe

Filesize
1.5MB

MD5
548822b223f5e68f9140b7d4cb5a2d41

SHA1
d1c30919f9d44da886ea2a4d598171a4794e8d56

SHA256
7b003529bbeb855835139eae2de33e41a07424a7fb408205b4423c16efae647e

SHA512
904cb5e8071d01aa6c42e03ec39156d5d543be2cfe7de2888d49cda43ab906e8fa76b64f23a78bd3323e4530ef4e301771b716dcfb9d183adbeadc4a828849e4

Download Submit
C:\Windows\system\oxQGbgi.exe

Filesize
1.5MB

MD5
d6619bf9899ab2d7af2f722a42e3e11b

SHA1
14a7e5b686274e89da30014da574db9d8d2e4228

SHA256
29e0a2782f2db34c853458d358c0fdec63d82f0c216e3f7e29ab6b0c5621ef39

SHA512
d6cf4570e51e50cbba4d9c92f799b1f178885de877f85b258bc903828d2805525c65d348239af11c72d2ca09ec8a38bcdcc8b0cc42f091437d589067a8228c42

Download Submit
C:\Windows\system\qPSsakA.exe

Filesize
1.5MB

MD5
9779745597e984a4a95d8c49f84492f1

SHA1
d5fcd91382da5acb4f99a42f10c095d766f723e2

SHA256
463980c3ada2b8e8adde71e2cf681ef75fba1b31eb92b11948c40969793f92a5

SHA512
83b2399a0d7dea573ee4f0a660b376747011c0942d2b7eaadcc00eb47a02d773005162932a84ae6ddeb930a4d9822f7069579fb6ce78e10880a63a322c878c0a

Download Submit
C:\Windows\system\wdPxjXo.exe

Filesize
1.5MB

MD5
ec0e56dc94f785ca0450f6eb3dbf2804

SHA1
666accf88517767c747f5b9fc342504dcd233fd5

SHA256
396f7524cc232bac8dc735cdeb04bad80c4c02a1cefcdc1efc439bd3c1eb92db

SHA512
69748537cdfec00213d5e5746fb0860cc71c662b6a8291b078f60c86ba4abbfb99df0e7dac0b8524175b9038d28e5a5219e434500aa4b7eee2c8f3562f7a75d7

Download Submit
\Windows\system\iDpEJzZ.exe

Filesize
1.5MB

MD5
452e22f116726747a75fae5d713b7a06

SHA1
ddb0a2c1b36a9d8db25e281938f2e27acc447ec0

SHA256
3f8f7a380667aa93583cdb99b1774c21f718bff12b52094c98c3aee44f2ff7e0

SHA512
e16e3da65163d081973c412f7bf28d85508f62ef17607b7ac6c490df1a3a35fd44f1c3035954222146d75d1be7fd86bb90f4e703b0885a8c904f895090ade5e9

Download Submit
\Windows\system\kFHiYBg.exe

Filesize
1.5MB

MD5
687720ce7b80c1ca2409d8a29e4b9802

SHA1
1d7403d4f218489333d5a02a8142b0c725a673d2

SHA256
5ef94eeef1150e40f7e66aee67134a1ee9af64dcb1bc477a6414e1222c53e48a

SHA512
7a8681e8e23e1dfe4cf06b59a64920fd8c5b6941cd932f73162fbaf91d1032f1f973ee6877c89016a6fa0310886b32da5078a1f10bed714bdab991ef9ba53c36

Download Submit
\Windows\system\nCftKxL.exe

Filesize
1.5MB

MD5
41c583e121094ead3ec731f0b3240370

SHA1
269d930d9c2368b0c8707da5876a004e1e5378d3

SHA256
152a48ab8d71ff70a24b0bee8498e83909179c662b7368e04a04e7cd1a4e62de

SHA512
ff6d4fc3faa6cc0fae0fbcebdb0d573605b791e6fa19d3efc06e4c6616eef8b7737dd1329acbeca1fc6087ab185559065ac973b4a3ae787da5d2d569e614dd5b

Download Submit
memory/2408-0-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download