xmrig | ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
Size

1.4MB
MD5

69879056876c61e297d1ad54975ef968
SHA1

20ec100251dec77f6e8000302515747b4e279d8d
SHA256

ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43
SHA512

834f897da63195f0a0cb0f0c808137145b48cac946517bdad545345f8d22386c64cd04f5f89d46d740c05b7683e5a958030dfb769ced160cabb1061dfd6fcf09
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwW4kj:GezaTF8FcNkNdfE0pZ9ozttwIRx2VDH9

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	xmrig
behavioral1/files/0x000900000001707f-7.dat	xmrig
behavioral1/files/0x00080000000174b4-14.dat	xmrig
behavioral1/files/0x0007000000017570-16.dat	xmrig
behavioral1/files/0x00070000000175f1-23.dat	xmrig
behavioral1/files/0x00070000000175f7-26.dat	xmrig
behavioral1/files/0x000f000000018683-31.dat	xmrig
behavioral1/files/0x0007000000018697-34.dat	xmrig
behavioral1/files/0x00050000000192a1-50.dat	xmrig
behavioral1/files/0x00050000000193cc-70.dat	xmrig
behavioral1/files/0x00050000000194d5-102.dat	xmrig
behavioral1/files/0x0005000000019510-118.dat	xmrig
behavioral1/files/0x000500000001952b-130.dat	xmrig
behavioral1/files/0x0005000000019520-126.dat	xmrig
behavioral1/files/0x0005000000019518-122.dat	xmrig
behavioral1/files/0x0005000000019508-114.dat	xmrig
behavioral1/files/0x00050000000194e1-107.dat	xmrig
behavioral1/files/0x0005000000019502-110.dat	xmrig
behavioral1/files/0x00050000000194c3-98.dat	xmrig
behavioral1/files/0x00050000000194ad-94.dat	xmrig
behavioral1/files/0x0005000000019428-90.dat	xmrig
behavioral1/files/0x0005000000019426-86.dat	xmrig
behavioral1/files/0x00050000000193f9-82.dat	xmrig
behavioral1/files/0x00050000000193dc-78.dat	xmrig
behavioral1/files/0x00050000000193d0-74.dat	xmrig
behavioral1/files/0x000500000001939f-66.dat	xmrig
behavioral1/files/0x000500000001938e-62.dat	xmrig
behavioral1/files/0x0005000000019358-58.dat	xmrig
behavioral1/files/0x0005000000019354-54.dat	xmrig
behavioral1/files/0x0005000000019299-46.dat	xmrig
behavioral1/files/0x000500000001927a-42.dat	xmrig
behavioral1/files/0x0005000000019274-38.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2708	GrdWNBe.exe
2304	xrJUehk.exe
2476	oRLIOun.exe
2284	lkmDQBC.exe
2292	iahVDEJ.exe
2296	QZZWERY.exe
2868	nazhKUL.exe
2856	EQLxJLC.exe
2732	HbBDLvs.exe
2168	dBqqjJb.exe
2628	tyCgjSD.exe
2740	TawwncY.exe
3048	kWyoxHy.exe
2796	zwDlNma.exe
2880	XOPyCyt.exe
2632	bZInFfl.exe
2696	DiXRCeo.exe
1860	auVQkhg.exe
2144	XiyofvN.exe
2892	fwBwfMc.exe
1440	ggtGGcY.exe
3032	CSBGknc.exe
3008	dUKfKUI.exe
764	wJYSZYc.exe
2952	kkoXFCe.exe
1856	IjaWJkh.exe
1844	xHfvSCW.exe
2592	cjvOwzn.exe
1420	piIPygK.exe
2084	lqVvWNZ.exe
2080	djXKrNE.exe
2072	QxGDDLQ.exe
2088	xJhLBxO.exe
1164	xXlQGDR.exe
2800	HoSYTRH.exe
2012	qvbFMtB.exe
1452	UVaWsGA.exe
740	xyfMdAR.exe
408	alnoeWd.exe
1072	XkYjYPx.exe
2244	YuWXXwB.exe
2600	GDTiwpO.exe
1924	DLzeZAr.exe
1296	GVjcqNh.exe
1796	cjjLBoz.exe
1896	yQCAWLc.exe
1104	WZeWhwP.exe
1608	HyrhVkw.exe
1484	pzmpphG.exe
1748	zivUZmW.exe
1720	TGldfCk.exe
316	ZeqmcBG.exe
688	aBURoHU.exe
948	HXWXVaD.exe
2576	bpVPPBx.exe
2460	UQgNiPF.exe
2564	fuXvIPt.exe
2096	cccISQU.exe
2236	vzNjAYu.exe
604	cVQIuQs.exe
1980	tnfLQVA.exe
2264	bTHbscR.exe
1120	OMppCWL.exe
1428	AXkPtgE.exe

Loads dropped DLL 64 IoCs

pid	Process
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MVgHixq.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\jhkFETp.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\sIvwrXN.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BXlxNmk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\SXwabNk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VWiEXrj.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\OwZwnUD.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\EvTdczH.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\zCTSJmy.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\oLYFUDf.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\gBwCBgf.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\ULXDfpu.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\AZasOkR.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\xkBLhqK.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\vEaAjTu.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\PETtqYH.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\yorbwqU.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\cmjdamG.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\LZyITIn.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\eDtswxz.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\bSLJpfW.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\TfidzEa.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\vOEZJDD.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\nVNSGNm.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\RhsVqmI.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\KDDOLpk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\DTmeNCQ.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\JkjkCCC.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\PonFdEd.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VnkXlQm.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\cZaCViE.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\XZVvbHo.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VcogyBv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\OVmmXaz.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\cAukhZQ.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\nIGrCjX.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\GvBNKPt.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\OGorzsP.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\jbNjvCk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\Ncjdzur.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\cakvnsO.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\zBrkVVk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\EBxhxxc.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\yVMMqYv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\YkrfMUL.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VpCGeEE.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\PVUdyNk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\dltFrmP.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\QRyyaOV.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VGYYqXK.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\yXMLJVP.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\UGVFLLE.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BxGlPEY.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\iwnorxw.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\ukBRVxo.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\ReDrxZH.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BmpQIhT.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\pbuoGsG.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BrTRhnO.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\tQoOLJw.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\djXKrNE.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\QzyrToM.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\qBYUJvz.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\fGHwAmk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2708	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	32
PID 2352 wrote to memory of 2708	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	32
PID 2352 wrote to memory of 2708	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	32
PID 2352 wrote to memory of 2304	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	33
PID 2352 wrote to memory of 2304	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	33
PID 2352 wrote to memory of 2304	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	33
PID 2352 wrote to memory of 2476	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	34
PID 2352 wrote to memory of 2476	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	34
PID 2352 wrote to memory of 2476	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	34
PID 2352 wrote to memory of 2284	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	35
PID 2352 wrote to memory of 2284	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	35
PID 2352 wrote to memory of 2284	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	35
PID 2352 wrote to memory of 2292	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	36
PID 2352 wrote to memory of 2292	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	36
PID 2352 wrote to memory of 2292	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	36
PID 2352 wrote to memory of 2296	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	37
PID 2352 wrote to memory of 2296	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	37
PID 2352 wrote to memory of 2296	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	37
PID 2352 wrote to memory of 2868	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	38
PID 2352 wrote to memory of 2868	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	38
PID 2352 wrote to memory of 2868	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	38
PID 2352 wrote to memory of 2856	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	39
PID 2352 wrote to memory of 2856	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	39
PID 2352 wrote to memory of 2856	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	39
PID 2352 wrote to memory of 2732	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	40
PID 2352 wrote to memory of 2732	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	40
PID 2352 wrote to memory of 2732	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	40
PID 2352 wrote to memory of 2168	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	41
PID 2352 wrote to memory of 2168	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	41
PID 2352 wrote to memory of 2168	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	41
PID 2352 wrote to memory of 2628	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	42
PID 2352 wrote to memory of 2628	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	42
PID 2352 wrote to memory of 2628	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	42
PID 2352 wrote to memory of 2740	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	43
PID 2352 wrote to memory of 2740	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	43
PID 2352 wrote to memory of 2740	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	43
PID 2352 wrote to memory of 3048	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	44
PID 2352 wrote to memory of 3048	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	44
PID 2352 wrote to memory of 3048	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	44
PID 2352 wrote to memory of 2796	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	45
PID 2352 wrote to memory of 2796	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	45
PID 2352 wrote to memory of 2796	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	45
PID 2352 wrote to memory of 2880	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	46
PID 2352 wrote to memory of 2880	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	46
PID 2352 wrote to memory of 2880	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	46
PID 2352 wrote to memory of 2632	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	47
PID 2352 wrote to memory of 2632	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	47
PID 2352 wrote to memory of 2632	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	47
PID 2352 wrote to memory of 2696	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	48
PID 2352 wrote to memory of 2696	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	48
PID 2352 wrote to memory of 2696	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	48
PID 2352 wrote to memory of 1860	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	49
PID 2352 wrote to memory of 1860	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	49
PID 2352 wrote to memory of 1860	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	49
PID 2352 wrote to memory of 2144	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	50
PID 2352 wrote to memory of 2144	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	50
PID 2352 wrote to memory of 2144	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	50
PID 2352 wrote to memory of 2892	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	51
PID 2352 wrote to memory of 2892	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	51
PID 2352 wrote to memory of 2892	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	51
PID 2352 wrote to memory of 1440	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	52
PID 2352 wrote to memory of 1440	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	52
PID 2352 wrote to memory of 1440	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	52
PID 2352 wrote to memory of 3032	2352	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	53

C:\Users\Admin\AppData\Local\Temp\ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
"C:\Users\Admin\AppData\Local\Temp\ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System\GrdWNBe.exe
  C:\Windows\System\GrdWNBe.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\xrJUehk.exe
  C:\Windows\System\xrJUehk.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\oRLIOun.exe
  C:\Windows\System\oRLIOun.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\lkmDQBC.exe
  C:\Windows\System\lkmDQBC.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\iahVDEJ.exe
  C:\Windows\System\iahVDEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QZZWERY.exe
  C:\Windows\System\QZZWERY.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\nazhKUL.exe
  C:\Windows\System\nazhKUL.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\EQLxJLC.exe
  C:\Windows\System\EQLxJLC.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\HbBDLvs.exe
  C:\Windows\System\HbBDLvs.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\dBqqjJb.exe
  C:\Windows\System\dBqqjJb.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\tyCgjSD.exe
  C:\Windows\System\tyCgjSD.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TawwncY.exe
  C:\Windows\System\TawwncY.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\kWyoxHy.exe
  C:\Windows\System\kWyoxHy.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\zwDlNma.exe
  C:\Windows\System\zwDlNma.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\XOPyCyt.exe
  C:\Windows\System\XOPyCyt.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\bZInFfl.exe
  C:\Windows\System\bZInFfl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DiXRCeo.exe
  C:\Windows\System\DiXRCeo.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\auVQkhg.exe
  C:\Windows\System\auVQkhg.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\XiyofvN.exe
  C:\Windows\System\XiyofvN.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\fwBwfMc.exe
  C:\Windows\System\fwBwfMc.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ggtGGcY.exe
  C:\Windows\System\ggtGGcY.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\CSBGknc.exe
  C:\Windows\System\CSBGknc.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\dUKfKUI.exe
  C:\Windows\System\dUKfKUI.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\wJYSZYc.exe
  C:\Windows\System\wJYSZYc.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\kkoXFCe.exe
  C:\Windows\System\kkoXFCe.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\IjaWJkh.exe
  C:\Windows\System\IjaWJkh.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\xHfvSCW.exe
  C:\Windows\System\xHfvSCW.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\cjvOwzn.exe
  C:\Windows\System\cjvOwzn.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\piIPygK.exe
  C:\Windows\System\piIPygK.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\lqVvWNZ.exe
  C:\Windows\System\lqVvWNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\djXKrNE.exe
  C:\Windows\System\djXKrNE.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\QxGDDLQ.exe
  C:\Windows\System\QxGDDLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\xJhLBxO.exe
  C:\Windows\System\xJhLBxO.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xXlQGDR.exe
  C:\Windows\System\xXlQGDR.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\HoSYTRH.exe
  C:\Windows\System\HoSYTRH.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\qvbFMtB.exe
  C:\Windows\System\qvbFMtB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\UVaWsGA.exe
  C:\Windows\System\UVaWsGA.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\xyfMdAR.exe
  C:\Windows\System\xyfMdAR.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\alnoeWd.exe
  C:\Windows\System\alnoeWd.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\XkYjYPx.exe
  C:\Windows\System\XkYjYPx.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\YuWXXwB.exe
  C:\Windows\System\YuWXXwB.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\GDTiwpO.exe
  C:\Windows\System\GDTiwpO.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\DLzeZAr.exe
  C:\Windows\System\DLzeZAr.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\GVjcqNh.exe
  C:\Windows\System\GVjcqNh.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\cjjLBoz.exe
  C:\Windows\System\cjjLBoz.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\yQCAWLc.exe
  C:\Windows\System\yQCAWLc.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\WZeWhwP.exe
  C:\Windows\System\WZeWhwP.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\HyrhVkw.exe
  C:\Windows\System\HyrhVkw.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\pzmpphG.exe
  C:\Windows\System\pzmpphG.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\zivUZmW.exe
  C:\Windows\System\zivUZmW.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\TGldfCk.exe
  C:\Windows\System\TGldfCk.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ZeqmcBG.exe
  C:\Windows\System\ZeqmcBG.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\aBURoHU.exe
  C:\Windows\System\aBURoHU.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\HXWXVaD.exe
  C:\Windows\System\HXWXVaD.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\bpVPPBx.exe
  C:\Windows\System\bpVPPBx.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\UQgNiPF.exe
  C:\Windows\System\UQgNiPF.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\fuXvIPt.exe
  C:\Windows\System\fuXvIPt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\cccISQU.exe
  C:\Windows\System\cccISQU.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\vzNjAYu.exe
  C:\Windows\System\vzNjAYu.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\cVQIuQs.exe
  C:\Windows\System\cVQIuQs.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\tnfLQVA.exe
  C:\Windows\System\tnfLQVA.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\bTHbscR.exe
  C:\Windows\System\bTHbscR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\OMppCWL.exe
  C:\Windows\System\OMppCWL.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\AXkPtgE.exe
  C:\Windows\System\AXkPtgE.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\HBTGdsI.exe
  C:\Windows\System\HBTGdsI.exe
  2⤵
  PID:2432
- C:\Windows\System\XPGfVhC.exe
  C:\Windows\System\XPGfVhC.exe
  2⤵
  PID:2160
- C:\Windows\System\LUXaJMs.exe
  C:\Windows\System\LUXaJMs.exe
  2⤵
  PID:1864
- C:\Windows\System\bQjaVBV.exe
  C:\Windows\System\bQjaVBV.exe
  2⤵
  PID:1588
- C:\Windows\System\aHskpHa.exe
  C:\Windows\System\aHskpHa.exe
  2⤵
  PID:2124
- C:\Windows\System\NnwJLCH.exe
  C:\Windows\System\NnwJLCH.exe
  2⤵
  PID:1496
- C:\Windows\System\bDNkXvo.exe
  C:\Windows\System\bDNkXvo.exe
  2⤵
  PID:2016
- C:\Windows\System\nVNSGNm.exe
  C:\Windows\System\nVNSGNm.exe
  2⤵
  PID:1884
- C:\Windows\System\FIHjpWd.exe
  C:\Windows\System\FIHjpWd.exe
  2⤵
  PID:3056
- C:\Windows\System\WpuXGTj.exe
  C:\Windows\System\WpuXGTj.exe
  2⤵
  PID:2812
- C:\Windows\System\KOtGiJy.exe
  C:\Windows\System\KOtGiJy.exe
  2⤵
  PID:2212
- C:\Windows\System\CxkUuRa.exe
  C:\Windows\System\CxkUuRa.exe
  2⤵
  PID:2872
- C:\Windows\System\ujmttBY.exe
  C:\Windows\System\ujmttBY.exe
  2⤵
  PID:2840
- C:\Windows\System\pnArOlo.exe
  C:\Windows\System\pnArOlo.exe
  2⤵
  PID:2936
- C:\Windows\System\aMGDADI.exe
  C:\Windows\System\aMGDADI.exe
  2⤵
  PID:1932
- C:\Windows\System\KgWuHRp.exe
  C:\Windows\System\KgWuHRp.exe
  2⤵
  PID:2616
- C:\Windows\System\rcWsMlZ.exe
  C:\Windows\System\rcWsMlZ.exe
  2⤵
  PID:2340
- C:\Windows\System\OngicxD.exe
  C:\Windows\System\OngicxD.exe
  2⤵
  PID:1752
- C:\Windows\System\CbDMZQC.exe
  C:\Windows\System\CbDMZQC.exe
  2⤵
  PID:2928
- C:\Windows\System\HxFzUPT.exe
  C:\Windows\System\HxFzUPT.exe
  2⤵
  PID:868
- C:\Windows\System\CqxDsKK.exe
  C:\Windows\System\CqxDsKK.exe
  2⤵
  PID:3036
- C:\Windows\System\owrVClW.exe
  C:\Windows\System\owrVClW.exe
  2⤵
  PID:2344
- C:\Windows\System\ZKAmbmU.exe
  C:\Windows\System\ZKAmbmU.exe
  2⤵
  PID:1308
- C:\Windows\System\lGBKbLK.exe
  C:\Windows\System\lGBKbLK.exe
  2⤵
  PID:2364
- C:\Windows\System\vuzkbub.exe
  C:\Windows\System\vuzkbub.exe
  2⤵
  PID:1788
- C:\Windows\System\sECQecb.exe
  C:\Windows\System\sECQecb.exe
  2⤵
  PID:2404
- C:\Windows\System\GgOmjTP.exe
  C:\Windows\System\GgOmjTP.exe
  2⤵
  PID:1312
- C:\Windows\System\gvNKGdd.exe
  C:\Windows\System\gvNKGdd.exe
  2⤵
  PID:900
- C:\Windows\System\FYrwXLZ.exe
  C:\Windows\System\FYrwXLZ.exe
  2⤵
  PID:1672
- C:\Windows\System\cmjdamG.exe
  C:\Windows\System\cmjdamG.exe
  2⤵
  PID:2152
- C:\Windows\System\nQaKTuB.exe
  C:\Windows\System\nQaKTuB.exe
  2⤵
  PID:1936
- C:\Windows\System\psmpKEk.exe
  C:\Windows\System\psmpKEk.exe
  2⤵
  PID:1540
- C:\Windows\System\XZVvbHo.exe
  C:\Windows\System\XZVvbHo.exe
  2⤵
  PID:1064
- C:\Windows\System\ebZAhGv.exe
  C:\Windows\System\ebZAhGv.exe
  2⤵
  PID:1240
- C:\Windows\System\FymzWLp.exe
  C:\Windows\System\FymzWLp.exe
  2⤵
  PID:2804
- C:\Windows\System\usrgrQL.exe
  C:\Windows\System\usrgrQL.exe
  2⤵
  PID:896
- C:\Windows\System\FcXjYuk.exe
  C:\Windows\System\FcXjYuk.exe
  2⤵
  PID:2360
- C:\Windows\System\sOknnUQ.exe
  C:\Windows\System\sOknnUQ.exe
  2⤵
  PID:1976
- C:\Windows\System\tqJxEHo.exe
  C:\Windows\System\tqJxEHo.exe
  2⤵
  PID:2112
- C:\Windows\System\ZvdFVJR.exe
  C:\Windows\System\ZvdFVJR.exe
  2⤵
  PID:976
- C:\Windows\System\iLgmfzg.exe
  C:\Windows\System\iLgmfzg.exe
  2⤵
  PID:872
- C:\Windows\System\gUQzWOZ.exe
  C:\Windows\System\gUQzWOZ.exe
  2⤵
  PID:2136
- C:\Windows\System\ezIcexl.exe
  C:\Windows\System\ezIcexl.exe
  2⤵
  PID:2140
- C:\Windows\System\RMkiSDc.exe
  C:\Windows\System\RMkiSDc.exe
  2⤵
  PID:1912
- C:\Windows\System\pjnyteu.exe
  C:\Windows\System\pjnyteu.exe
  2⤵
  PID:2704
- C:\Windows\System\EvTdczH.exe
  C:\Windows\System\EvTdczH.exe
  2⤵
  PID:2448
- C:\Windows\System\rIQMGoA.exe
  C:\Windows\System\rIQMGoA.exe
  2⤵
  PID:2312
- C:\Windows\System\giHLCLP.exe
  C:\Windows\System\giHLCLP.exe
  2⤵
  PID:2860
- C:\Windows\System\DWrIDrj.exe
  C:\Windows\System\DWrIDrj.exe
  2⤵
  PID:2808
- C:\Windows\System\aCykxWC.exe
  C:\Windows\System\aCykxWC.exe
  2⤵
  PID:2676
- C:\Windows\System\VGNOBbS.exe
  C:\Windows\System\VGNOBbS.exe
  2⤵
  PID:1956
- C:\Windows\System\jJAFoSZ.exe
  C:\Windows\System\jJAFoSZ.exe
  2⤵
  PID:2972
- C:\Windows\System\tjeZobw.exe
  C:\Windows\System\tjeZobw.exe
  2⤵
  PID:692
- C:\Windows\System\aGfmuKp.exe
  C:\Windows\System\aGfmuKp.exe
  2⤵
  PID:1984
- C:\Windows\System\PXUcpvD.exe
  C:\Windows\System\PXUcpvD.exe
  2⤵
  PID:2336
- C:\Windows\System\gngqNPD.exe
  C:\Windows\System\gngqNPD.exe
  2⤵
  PID:1684
- C:\Windows\System\NsmePAX.exe
  C:\Windows\System\NsmePAX.exe
  2⤵
  PID:1704
- C:\Windows\System\xapSSmN.exe
  C:\Windows\System\xapSSmN.exe
  2⤵
  PID:2188
- C:\Windows\System\AlthGXO.exe
  C:\Windows\System\AlthGXO.exe
  2⤵
  PID:2376
- C:\Windows\System\BBizxLv.exe
  C:\Windows\System\BBizxLv.exe
  2⤵
  PID:1508
- C:\Windows\System\IreJVrA.exe
  C:\Windows\System\IreJVrA.exe
  2⤵
  PID:656
- C:\Windows\System\TTiMdWg.exe
  C:\Windows\System\TTiMdWg.exe
  2⤵
  PID:1652
- C:\Windows\System\nzXOSWk.exe
  C:\Windows\System\nzXOSWk.exe
  2⤵
  PID:1536
- C:\Windows\System\DXpUuDP.exe
  C:\Windows\System\DXpUuDP.exe
  2⤵
  PID:268
- C:\Windows\System\TXrHvxS.exe
  C:\Windows\System\TXrHvxS.exe
  2⤵
  PID:2200
- C:\Windows\System\CqqwBQw.exe
  C:\Windows\System\CqqwBQw.exe
  2⤵
  PID:2076
- C:\Windows\System\cYOrfOH.exe
  C:\Windows\System\cYOrfOH.exe
  2⤵
  PID:1992
- C:\Windows\System\ZvBZjXH.exe
  C:\Windows\System\ZvBZjXH.exe
  2⤵
  PID:2780
- C:\Windows\System\kHaJmcR.exe
  C:\Windows\System\kHaJmcR.exe
  2⤵
  PID:2688
- C:\Windows\System\HYLQwRK.exe
  C:\Windows\System\HYLQwRK.exe
  2⤵
  PID:476
- C:\Windows\System\OznTSts.exe
  C:\Windows\System\OznTSts.exe
  2⤵
  PID:588
- C:\Windows\System\cvFlHnr.exe
  C:\Windows\System\cvFlHnr.exe
  2⤵
  PID:1408
- C:\Windows\System\jVqkWCm.exe
  C:\Windows\System\jVqkWCm.exe
  2⤵
  PID:3084
- C:\Windows\System\EnlLGVA.exe
  C:\Windows\System\EnlLGVA.exe
  2⤵
  PID:3100
- C:\Windows\System\RrDDQke.exe
  C:\Windows\System\RrDDQke.exe
  2⤵
  PID:3116
- C:\Windows\System\mBSZLTz.exe
  C:\Windows\System\mBSZLTz.exe
  2⤵
  PID:3132
- C:\Windows\System\lGGuhvQ.exe
  C:\Windows\System\lGGuhvQ.exe
  2⤵
  PID:3148
- C:\Windows\System\beuupOh.exe
  C:\Windows\System\beuupOh.exe
  2⤵
  PID:3164
- C:\Windows\System\dRCwApB.exe
  C:\Windows\System\dRCwApB.exe
  2⤵
  PID:3180
- C:\Windows\System\AlTkitG.exe
  C:\Windows\System\AlTkitG.exe
  2⤵
  PID:3196
- C:\Windows\System\MONFtHp.exe
  C:\Windows\System\MONFtHp.exe
  2⤵
  PID:3212
- C:\Windows\System\ReDrxZH.exe
  C:\Windows\System\ReDrxZH.exe
  2⤵
  PID:3228
- C:\Windows\System\cuHWapo.exe
  C:\Windows\System\cuHWapo.exe
  2⤵
  PID:3244
- C:\Windows\System\MeNgPTq.exe
  C:\Windows\System\MeNgPTq.exe
  2⤵
  PID:3260
- C:\Windows\System\yNBzBQw.exe
  C:\Windows\System\yNBzBQw.exe
  2⤵
  PID:3276
- C:\Windows\System\JxjHFIs.exe
  C:\Windows\System\JxjHFIs.exe
  2⤵
  PID:3292
- C:\Windows\System\SXYhBwd.exe
  C:\Windows\System\SXYhBwd.exe
  2⤵
  PID:3308
- C:\Windows\System\RhsVqmI.exe
  C:\Windows\System\RhsVqmI.exe
  2⤵
  PID:3324
- C:\Windows\System\ykAdkwE.exe
  C:\Windows\System\ykAdkwE.exe
  2⤵
  PID:3340
- C:\Windows\System\GTFxMsH.exe
  C:\Windows\System\GTFxMsH.exe
  2⤵
  PID:3356
- C:\Windows\System\NyAbTHC.exe
  C:\Windows\System\NyAbTHC.exe
  2⤵
  PID:3372
- C:\Windows\System\pgjPrph.exe
  C:\Windows\System\pgjPrph.exe
  2⤵
  PID:3388
- C:\Windows\System\ToJDQGO.exe
  C:\Windows\System\ToJDQGO.exe
  2⤵
  PID:3404
- C:\Windows\System\vCPsRYb.exe
  C:\Windows\System\vCPsRYb.exe
  2⤵
  PID:3420
- C:\Windows\System\vazjOBR.exe
  C:\Windows\System\vazjOBR.exe
  2⤵
  PID:3436
- C:\Windows\System\MgBpNdZ.exe
  C:\Windows\System\MgBpNdZ.exe
  2⤵
  PID:3452
- C:\Windows\System\KwjIonZ.exe
  C:\Windows\System\KwjIonZ.exe
  2⤵
  PID:3468
- C:\Windows\System\dIBPxFC.exe
  C:\Windows\System\dIBPxFC.exe
  2⤵
  PID:3484
- C:\Windows\System\EBxhxxc.exe
  C:\Windows\System\EBxhxxc.exe
  2⤵
  PID:3500
- C:\Windows\System\HtfHZpZ.exe
  C:\Windows\System\HtfHZpZ.exe
  2⤵
  PID:3516
- C:\Windows\System\kgywbeB.exe
  C:\Windows\System\kgywbeB.exe
  2⤵
  PID:3532
- C:\Windows\System\IRxnzZy.exe
  C:\Windows\System\IRxnzZy.exe
  2⤵
  PID:3548
- C:\Windows\System\YTMakRu.exe
  C:\Windows\System\YTMakRu.exe
  2⤵
  PID:3564
- C:\Windows\System\lMJSyHD.exe
  C:\Windows\System\lMJSyHD.exe
  2⤵
  PID:3580
- C:\Windows\System\wbkOIgm.exe
  C:\Windows\System\wbkOIgm.exe
  2⤵
  PID:3596
- C:\Windows\System\nmNusSF.exe
  C:\Windows\System\nmNusSF.exe
  2⤵
  PID:3612
- C:\Windows\System\axfgaWM.exe
  C:\Windows\System\axfgaWM.exe
  2⤵
  PID:3628
- C:\Windows\System\VbGJIOa.exe
  C:\Windows\System\VbGJIOa.exe
  2⤵
  PID:3644
- C:\Windows\System\MNispwW.exe
  C:\Windows\System\MNispwW.exe
  2⤵
  PID:3660
- C:\Windows\System\GGmuIFx.exe
  C:\Windows\System\GGmuIFx.exe
  2⤵
  PID:3676
- C:\Windows\System\YDmlVJl.exe
  C:\Windows\System\YDmlVJl.exe
  2⤵
  PID:3692
- C:\Windows\System\qkmsLFy.exe
  C:\Windows\System\qkmsLFy.exe
  2⤵
  PID:3708
- C:\Windows\System\VmJxKwX.exe
  C:\Windows\System\VmJxKwX.exe
  2⤵
  PID:3724
- C:\Windows\System\HnoeWuD.exe
  C:\Windows\System\HnoeWuD.exe
  2⤵
  PID:3740
- C:\Windows\System\KnViWkM.exe
  C:\Windows\System\KnViWkM.exe
  2⤵
  PID:3756
- C:\Windows\System\NgzCmFz.exe
  C:\Windows\System\NgzCmFz.exe
  2⤵
  PID:3772
- C:\Windows\System\SfjUjme.exe
  C:\Windows\System\SfjUjme.exe
  2⤵
  PID:3788
- C:\Windows\System\FNdNYAG.exe
  C:\Windows\System\FNdNYAG.exe
  2⤵
  PID:3804
- C:\Windows\System\AocSUbR.exe
  C:\Windows\System\AocSUbR.exe
  2⤵
  PID:3820
- C:\Windows\System\HtHnfRy.exe
  C:\Windows\System\HtHnfRy.exe
  2⤵
  PID:3836
- C:\Windows\System\RdPdNyZ.exe
  C:\Windows\System\RdPdNyZ.exe
  2⤵
  PID:3852
- C:\Windows\System\guWiaAv.exe
  C:\Windows\System\guWiaAv.exe
  2⤵
  PID:3868
- C:\Windows\System\sgxdxZP.exe
  C:\Windows\System\sgxdxZP.exe
  2⤵
  PID:3884
- C:\Windows\System\RVRuPLx.exe
  C:\Windows\System\RVRuPLx.exe
  2⤵
  PID:3900
- C:\Windows\System\KRkCWSW.exe
  C:\Windows\System\KRkCWSW.exe
  2⤵
  PID:3916
- C:\Windows\System\STmxhNz.exe
  C:\Windows\System\STmxhNz.exe
  2⤵
  PID:3932
- C:\Windows\System\FnCTrgc.exe
  C:\Windows\System\FnCTrgc.exe
  2⤵
  PID:3948
- C:\Windows\System\XTqInCv.exe
  C:\Windows\System\XTqInCv.exe
  2⤵
  PID:3964
- C:\Windows\System\zRnwLkm.exe
  C:\Windows\System\zRnwLkm.exe
  2⤵
  PID:3980
- C:\Windows\System\MOacFCk.exe
  C:\Windows\System\MOacFCk.exe
  2⤵
  PID:3996
- C:\Windows\System\TGhiGMe.exe
  C:\Windows\System\TGhiGMe.exe
  2⤵
  PID:4012
- C:\Windows\System\vmpEsmQ.exe
  C:\Windows\System\vmpEsmQ.exe
  2⤵
  PID:4028
- C:\Windows\System\VYbwUCx.exe
  C:\Windows\System\VYbwUCx.exe
  2⤵
  PID:4044
- C:\Windows\System\wFbcftg.exe
  C:\Windows\System\wFbcftg.exe
  2⤵
  PID:2844
- C:\Windows\System\FIzXfgQ.exe
  C:\Windows\System\FIzXfgQ.exe
  2⤵
  PID:2068
- C:\Windows\System\PDlLMRh.exe
  C:\Windows\System\PDlLMRh.exe
  2⤵
  PID:2668
- C:\Windows\System\ZxSCNzd.exe
  C:\Windows\System\ZxSCNzd.exe
  2⤵
  PID:3188
- C:\Windows\System\tuQZeLn.exe
  C:\Windows\System\tuQZeLn.exe
  2⤵
  PID:3204
- C:\Windows\System\bVEWTaQ.exe
  C:\Windows\System\bVEWTaQ.exe
  2⤵
  PID:3252
- C:\Windows\System\lENTuvO.exe
  C:\Windows\System\lENTuvO.exe
  2⤵
  PID:3240
- C:\Windows\System\PzIgdkw.exe
  C:\Windows\System\PzIgdkw.exe
  2⤵
  PID:3272
- C:\Windows\System\BFamSEZ.exe
  C:\Windows\System\BFamSEZ.exe
  2⤵
  PID:3304
- C:\Windows\System\lKUKOhK.exe
  C:\Windows\System\lKUKOhK.exe
  2⤵
  PID:2384
- C:\Windows\System\rrwcZWo.exe
  C:\Windows\System\rrwcZWo.exe
  2⤵
  PID:3380
- C:\Windows\System\UHiBnKE.exe
  C:\Windows\System\UHiBnKE.exe
  2⤵
  PID:3412
- C:\Windows\System\leZzVYw.exe
  C:\Windows\System\leZzVYw.exe
  2⤵
  PID:2468
- C:\Windows\System\LiPjIJH.exe
  C:\Windows\System\LiPjIJH.exe
  2⤵
  PID:3444
- C:\Windows\System\wPrIZpE.exe
  C:\Windows\System\wPrIZpE.exe
  2⤵
  PID:3476
- C:\Windows\System\QxQJXKc.exe
  C:\Windows\System\QxQJXKc.exe
  2⤵
  PID:3508
- C:\Windows\System\zCQTjpN.exe
  C:\Windows\System\zCQTjpN.exe
  2⤵
  PID:3524
- C:\Windows\System\yxFBylM.exe
  C:\Windows\System\yxFBylM.exe
  2⤵
  PID:3572
- C:\Windows\System\HpPDMhc.exe
  C:\Windows\System\HpPDMhc.exe
  2⤵
  PID:3604
- C:\Windows\System\lFRbKbn.exe
  C:\Windows\System\lFRbKbn.exe
  2⤵
  PID:3608
- C:\Windows\System\DsjASsn.exe
  C:\Windows\System\DsjASsn.exe
  2⤵
  PID:3640
- C:\Windows\System\aOFnEIO.exe
  C:\Windows\System\aOFnEIO.exe
  2⤵
  PID:3668
- C:\Windows\System\NXLYxuR.exe
  C:\Windows\System\NXLYxuR.exe
  2⤵
  PID:3700
- C:\Windows\System\shbaeEk.exe
  C:\Windows\System\shbaeEk.exe
  2⤵
  PID:3688
- C:\Windows\System\ySMwNob.exe
  C:\Windows\System\ySMwNob.exe
  2⤵
  PID:1716
- C:\Windows\System\CWxoyWs.exe
  C:\Windows\System\CWxoyWs.exe
  2⤵
  PID:3764
- C:\Windows\System\CaMsEFA.exe
  C:\Windows\System\CaMsEFA.exe
  2⤵
  PID:3800
- C:\Windows\System\gsWWvsp.exe
  C:\Windows\System\gsWWvsp.exe
  2⤵
  PID:2884
- C:\Windows\System\RjcExbb.exe
  C:\Windows\System\RjcExbb.exe
  2⤵
  PID:2832
- C:\Windows\System\SKXlkCl.exe
  C:\Windows\System\SKXlkCl.exe
  2⤵
  PID:3860
- C:\Windows\System\XBVfULG.exe
  C:\Windows\System\XBVfULG.exe
  2⤵
  PID:3892
- C:\Windows\System\KSNnPNg.exe
  C:\Windows\System\KSNnPNg.exe
  2⤵
  PID:3924
- C:\Windows\System\HgUIJFr.exe
  C:\Windows\System\HgUIJFr.exe
  2⤵
  PID:3956
- C:\Windows\System\EPYkDlC.exe
  C:\Windows\System\EPYkDlC.exe
  2⤵
  PID:1784
- C:\Windows\System\wHlBkFa.exe
  C:\Windows\System\wHlBkFa.exe
  2⤵
  PID:4020
- C:\Windows\System\WTtSoHn.exe
  C:\Windows\System\WTtSoHn.exe
  2⤵
  PID:4064
- C:\Windows\System\xmFoOJm.exe
  C:\Windows\System\xmFoOJm.exe
  2⤵
  PID:4080
- C:\Windows\System\QsCaPmI.exe
  C:\Windows\System\QsCaPmI.exe
  2⤵
  PID:2092
- C:\Windows\System\sSFJknT.exe
  C:\Windows\System\sSFJknT.exe
  2⤵
  PID:2308
- C:\Windows\System\VcogyBv.exe
  C:\Windows\System\VcogyBv.exe
  2⤵
  PID:1476
- C:\Windows\System\okOAeMD.exe
  C:\Windows\System\okOAeMD.exe
  2⤵
  PID:2328
- C:\Windows\System\aKigGAa.exe
  C:\Windows\System\aKigGAa.exe
  2⤵
  PID:2716
- C:\Windows\System\TPEPsgT.exe
  C:\Windows\System\TPEPsgT.exe
  2⤵
  PID:1532
- C:\Windows\System\QpAywWV.exe
  C:\Windows\System\QpAywWV.exe
  2⤵
  PID:1848
- C:\Windows\System\OHaPjZY.exe
  C:\Windows\System\OHaPjZY.exe
  2⤵
  PID:580
- C:\Windows\System\sLEEkJc.exe
  C:\Windows\System\sLEEkJc.exe
  2⤵
  PID:1236
- C:\Windows\System\ozvLzGh.exe
  C:\Windows\System\ozvLzGh.exe
  2⤵
  PID:1416
- C:\Windows\System\VErKTuE.exe
  C:\Windows\System\VErKTuE.exe
  2⤵
  PID:3976
- C:\Windows\System\NgUEpsn.exe
  C:\Windows\System\NgUEpsn.exe
  2⤵
  PID:2976
- C:\Windows\System\AZasOkR.exe
  C:\Windows\System\AZasOkR.exe
  2⤵
  PID:2896
- C:\Windows\System\UMZWxwe.exe
  C:\Windows\System\UMZWxwe.exe
  2⤵
  PID:1208
- C:\Windows\System\IuNmUCi.exe
  C:\Windows\System\IuNmUCi.exe
  2⤵
  PID:3096
- C:\Windows\System\CnKgqej.exe
  C:\Windows\System\CnKgqej.exe
  2⤵
  PID:3108
- C:\Windows\System\qcrVwvd.exe
  C:\Windows\System\qcrVwvd.exe
  2⤵
  PID:3300
- C:\Windows\System\OVmmXaz.exe
  C:\Windows\System\OVmmXaz.exe
  2⤵
  PID:3144
- C:\Windows\System\xNBuwkY.exe
  C:\Windows\System\xNBuwkY.exe
  2⤵
  PID:3176
- C:\Windows\System\xCPXuJE.exe
  C:\Windows\System\xCPXuJE.exe
  2⤵
  PID:3284
- C:\Windows\System\qdzMbbz.exe
  C:\Windows\System\qdzMbbz.exe
  2⤵
  PID:1916
- C:\Windows\System\VGSKwEI.exe
  C:\Windows\System\VGSKwEI.exe
  2⤵
  PID:3492
- C:\Windows\System\EeAGRUa.exe
  C:\Windows\System\EeAGRUa.exe
  2⤵
  PID:3592
- C:\Windows\System\gcgngAu.exe
  C:\Windows\System\gcgngAu.exe
  2⤵
  PID:3684
- C:\Windows\System\vGyMeVP.exe
  C:\Windows\System\vGyMeVP.exe
  2⤵
  PID:2912
- C:\Windows\System\KYRELTJ.exe
  C:\Windows\System\KYRELTJ.exe
  2⤵
  PID:3540
- C:\Windows\System\frnfave.exe
  C:\Windows\System\frnfave.exe
  2⤵
  PID:1360
- C:\Windows\System\mWZJITh.exe
  C:\Windows\System\mWZJITh.exe
  2⤵
  PID:3576
- C:\Windows\System\pMjXGVW.exe
  C:\Windows\System\pMjXGVW.exe
  2⤵
  PID:3672
- C:\Windows\System\MEIExmF.exe
  C:\Windows\System\MEIExmF.exe
  2⤵
  PID:3636
- C:\Windows\System\LJwtaaY.exe
  C:\Windows\System\LJwtaaY.exe
  2⤵
  PID:3720
- C:\Windows\System\EGZmmgK.exe
  C:\Windows\System\EGZmmgK.exe
  2⤵
  PID:3848
- C:\Windows\System\yVMMqYv.exe
  C:\Windows\System\yVMMqYv.exe
  2⤵
  PID:3992
- C:\Windows\System\xCoRztN.exe
  C:\Windows\System\xCoRztN.exe
  2⤵
  PID:4088
- C:\Windows\System\TpGaiFS.exe
  C:\Windows\System\TpGaiFS.exe
  2⤵
  PID:980
- C:\Windows\System\AAKalkE.exe
  C:\Windows\System\AAKalkE.exe
  2⤵
  PID:3944
- C:\Windows\System\czKhObp.exe
  C:\Windows\System\czKhObp.exe
  2⤵
  PID:2196
- C:\Windows\System\pLvDYCf.exe
  C:\Windows\System\pLvDYCf.exe
  2⤵
  PID:3076
- C:\Windows\System\wscHIre.exe
  C:\Windows\System\wscHIre.exe
  2⤵
  PID:2640
- C:\Windows\System\rZmFOXv.exe
  C:\Windows\System\rZmFOXv.exe
  2⤵
  PID:3384
- C:\Windows\System\sUNOTWL.exe
  C:\Windows\System\sUNOTWL.exe
  2⤵
  PID:836
- C:\Windows\System\MDpKcUV.exe
  C:\Windows\System\MDpKcUV.exe
  2⤵
  PID:2932
- C:\Windows\System\Mjqidzy.exe
  C:\Windows\System\Mjqidzy.exe
  2⤵
  PID:3112
- C:\Windows\System\wfqaugs.exe
  C:\Windows\System\wfqaugs.exe
  2⤵
  PID:2672
- C:\Windows\System\PdnaNvC.exe
  C:\Windows\System\PdnaNvC.exe
  2⤵
  PID:664
- C:\Windows\System\iPVPSLY.exe
  C:\Windows\System\iPVPSLY.exe
  2⤵
  PID:4052
- C:\Windows\System\wxwKnHm.exe
  C:\Windows\System\wxwKnHm.exe
  2⤵
  PID:1016
- C:\Windows\System\ZShuEjN.exe
  C:\Windows\System\ZShuEjN.exe
  2⤵
  PID:3896
- C:\Windows\System\RbduNjH.exe
  C:\Windows\System\RbduNjH.exe
  2⤵
  PID:1880
- C:\Windows\System\SrRXShX.exe
  C:\Windows\System\SrRXShX.exe
  2⤵
  PID:1596
- C:\Windows\System\OnbTfCj.exe
  C:\Windows\System\OnbTfCj.exe
  2⤵
  PID:3156
- C:\Windows\System\CVhsoZi.exe
  C:\Windows\System\CVhsoZi.exe
  2⤵
  PID:4108
- C:\Windows\System\ZfoKJUn.exe
  C:\Windows\System\ZfoKJUn.exe
  2⤵
  PID:4124
- C:\Windows\System\lxJpbhL.exe
  C:\Windows\System\lxJpbhL.exe
  2⤵
  PID:4140
- C:\Windows\System\XOShQfo.exe
  C:\Windows\System\XOShQfo.exe
  2⤵
  PID:4156
- C:\Windows\System\sQKgkBp.exe
  C:\Windows\System\sQKgkBp.exe
  2⤵
  PID:4172
- C:\Windows\System\yZEdvQW.exe
  C:\Windows\System\yZEdvQW.exe
  2⤵
  PID:4188
- C:\Windows\System\bewcWPF.exe
  C:\Windows\System\bewcWPF.exe
  2⤵
  PID:4204
- C:\Windows\System\tCqYXQz.exe
  C:\Windows\System\tCqYXQz.exe
  2⤵
  PID:4220
- C:\Windows\System\jnppxqw.exe
  C:\Windows\System\jnppxqw.exe
  2⤵
  PID:4236
- C:\Windows\System\QSJjbDX.exe
  C:\Windows\System\QSJjbDX.exe
  2⤵
  PID:4252
- C:\Windows\System\UDjfVGy.exe
  C:\Windows\System\UDjfVGy.exe
  2⤵
  PID:4268
- C:\Windows\System\MyTvHvD.exe
  C:\Windows\System\MyTvHvD.exe
  2⤵
  PID:4284
- C:\Windows\System\dHgEUIs.exe
  C:\Windows\System\dHgEUIs.exe
  2⤵
  PID:4300
- C:\Windows\System\pdwTUGN.exe
  C:\Windows\System\pdwTUGN.exe
  2⤵
  PID:4316
- C:\Windows\System\IYyRbBU.exe
  C:\Windows\System\IYyRbBU.exe
  2⤵
  PID:4332
- C:\Windows\System\QRyyaOV.exe
  C:\Windows\System\QRyyaOV.exe
  2⤵
  PID:4348
- C:\Windows\System\PzPaKpA.exe
  C:\Windows\System\PzPaKpA.exe
  2⤵
  PID:4364
- C:\Windows\System\zJATWol.exe
  C:\Windows\System\zJATWol.exe
  2⤵
  PID:4380
- C:\Windows\System\SINJmdh.exe
  C:\Windows\System\SINJmdh.exe
  2⤵
  PID:4396
- C:\Windows\System\qEczjhv.exe
  C:\Windows\System\qEczjhv.exe
  2⤵
  PID:4412
- C:\Windows\System\YkrfMUL.exe
  C:\Windows\System\YkrfMUL.exe
  2⤵
  PID:4428
- C:\Windows\System\YkexzZM.exe
  C:\Windows\System\YkexzZM.exe
  2⤵
  PID:4460
- C:\Windows\System\ythRhod.exe
  C:\Windows\System\ythRhod.exe
  2⤵
  PID:4476
- C:\Windows\System\KDDOLpk.exe
  C:\Windows\System\KDDOLpk.exe
  2⤵
  PID:4492
- C:\Windows\System\pGINjJq.exe
  C:\Windows\System\pGINjJq.exe
  2⤵
  PID:4508
- C:\Windows\System\FGQjizB.exe
  C:\Windows\System\FGQjizB.exe
  2⤵
  PID:4524
- C:\Windows\System\rZqEMiX.exe
  C:\Windows\System\rZqEMiX.exe
  2⤵
  PID:4540
- C:\Windows\System\vSpvCfy.exe
  C:\Windows\System\vSpvCfy.exe
  2⤵
  PID:4556
- C:\Windows\System\xGkROHv.exe
  C:\Windows\System\xGkROHv.exe
  2⤵
  PID:4572
- C:\Windows\System\mrtOzVh.exe
  C:\Windows\System\mrtOzVh.exe
  2⤵
  PID:4588
- C:\Windows\System\agvPUFr.exe
  C:\Windows\System\agvPUFr.exe
  2⤵
  PID:4604
- C:\Windows\System\XrNotNY.exe
  C:\Windows\System\XrNotNY.exe
  2⤵
  PID:4620
- C:\Windows\System\VpCGeEE.exe
  C:\Windows\System\VpCGeEE.exe
  2⤵
  PID:4636
- C:\Windows\System\PMgapcV.exe
  C:\Windows\System\PMgapcV.exe
  2⤵
  PID:4652
- C:\Windows\System\RqhuRaK.exe
  C:\Windows\System\RqhuRaK.exe
  2⤵
  PID:4668
- C:\Windows\System\QSHxtKg.exe
  C:\Windows\System\QSHxtKg.exe
  2⤵
  PID:4684
- C:\Windows\System\OvZEoGU.exe
  C:\Windows\System\OvZEoGU.exe
  2⤵
  PID:4744
- C:\Windows\System\nrbwdCB.exe
  C:\Windows\System\nrbwdCB.exe
  2⤵
  PID:4764
- C:\Windows\System\YyTRYCg.exe
  C:\Windows\System\YyTRYCg.exe
  2⤵
  PID:4784
- C:\Windows\System\QzyrToM.exe
  C:\Windows\System\QzyrToM.exe
  2⤵
  PID:4800
- C:\Windows\System\HesnfjR.exe
  C:\Windows\System\HesnfjR.exe
  2⤵
  PID:4816
- C:\Windows\System\oDFQEXk.exe
  C:\Windows\System\oDFQEXk.exe
  2⤵
  PID:4836
- C:\Windows\System\wzKTrbl.exe
  C:\Windows\System\wzKTrbl.exe
  2⤵
  PID:4852
- C:\Windows\System\SsKklni.exe
  C:\Windows\System\SsKklni.exe
  2⤵
  PID:4872
- C:\Windows\System\ZlSCWVT.exe
  C:\Windows\System\ZlSCWVT.exe
  2⤵
  PID:4888
- C:\Windows\System\ArgQVCi.exe
  C:\Windows\System\ArgQVCi.exe
  2⤵
  PID:4932
- C:\Windows\System\VUtrTcz.exe
  C:\Windows\System\VUtrTcz.exe
  2⤵
  PID:4956
- C:\Windows\System\mNXGLit.exe
  C:\Windows\System\mNXGLit.exe
  2⤵
  PID:4972
- C:\Windows\System\CqceCae.exe
  C:\Windows\System\CqceCae.exe
  2⤵
  PID:4992
- C:\Windows\System\DPuVluI.exe
  C:\Windows\System\DPuVluI.exe
  2⤵
  PID:5008
- C:\Windows\System\RlyUAaU.exe
  C:\Windows\System\RlyUAaU.exe
  2⤵
  PID:5028
- C:\Windows\System\lIysuZU.exe
  C:\Windows\System\lIysuZU.exe
  2⤵
  PID:5044
- C:\Windows\System\MYTCjKC.exe
  C:\Windows\System\MYTCjKC.exe
  2⤵
  PID:5060
- C:\Windows\System\cAukhZQ.exe
  C:\Windows\System\cAukhZQ.exe
  2⤵
  PID:5076
- C:\Windows\System\NXBsRxd.exe
  C:\Windows\System\NXBsRxd.exe
  2⤵
  PID:5092
- C:\Windows\System\SbXZjXs.exe
  C:\Windows\System\SbXZjXs.exe
  2⤵
  PID:5108
- C:\Windows\System\aLlPQAn.exe
  C:\Windows\System\aLlPQAn.exe
  2⤵
  PID:4076
- C:\Windows\System\vauzCDL.exe
  C:\Windows\System\vauzCDL.exe
  2⤵
  PID:4120
- C:\Windows\System\QyhyxlC.exe
  C:\Windows\System\QyhyxlC.exe
  2⤵
  PID:2128
- C:\Windows\System\QRkhOOb.exe
  C:\Windows\System\QRkhOOb.exe
  2⤵
  PID:4216
- C:\Windows\System\yBlimOc.exe
  C:\Windows\System\yBlimOc.exe
  2⤵
  PID:3912
- C:\Windows\System\yrgLGTJ.exe
  C:\Windows\System\yrgLGTJ.exe
  2⤵
  PID:3348
- C:\Windows\System\HSHeZKt.exe
  C:\Windows\System\HSHeZKt.exe
  2⤵
  PID:3448
- C:\Windows\System\PIvCNTv.exe
  C:\Windows\System\PIvCNTv.exe
  2⤵
  PID:2100
- C:\Windows\System\tcQhJoM.exe
  C:\Windows\System\tcQhJoM.exe
  2⤵
  PID:4100
- C:\Windows\System\EDgxOjg.exe
  C:\Windows\System\EDgxOjg.exe
  2⤵
  PID:4136
- C:\Windows\System\SyhZOFY.exe
  C:\Windows\System\SyhZOFY.exe
  2⤵
  PID:4200
- C:\Windows\System\pRrIIcS.exe
  C:\Windows\System\pRrIIcS.exe
  2⤵
  PID:4264
- C:\Windows\System\ZKraozj.exe
  C:\Windows\System\ZKraozj.exe
  2⤵
  PID:4324
- C:\Windows\System\oxEGqUo.exe
  C:\Windows\System\oxEGqUo.exe
  2⤵
  PID:4388
- C:\Windows\System\AZURicY.exe
  C:\Windows\System\AZURicY.exe
  2⤵
  PID:4404
- C:\Windows\System\HHjYbfn.exe
  C:\Windows\System\HHjYbfn.exe
  2⤵
  PID:4344
- C:\Windows\System\HtSPrMs.exe
  C:\Windows\System\HtSPrMs.exe
  2⤵
  PID:2748
- C:\Windows\System\zCTSJmy.exe
  C:\Windows\System\zCTSJmy.exe
  2⤵
  PID:3556
- C:\Windows\System\PNJQbvr.exe
  C:\Windows\System\PNJQbvr.exe
  2⤵
  PID:3480
- C:\Windows\System\LZyITIn.exe
  C:\Windows\System\LZyITIn.exe
  2⤵
  PID:4484
- C:\Windows\System\nWKgCXb.exe
  C:\Windows\System\nWKgCXb.exe
  2⤵
  PID:4520
- C:\Windows\System\zjUvNlL.exe
  C:\Windows\System\zjUvNlL.exe
  2⤵
  PID:4536
- C:\Windows\System\kmrSDJE.exe
  C:\Windows\System\kmrSDJE.exe
  2⤵
  PID:4600
- C:\Windows\System\ZsGXPqF.exe
  C:\Windows\System\ZsGXPqF.exe
  2⤵
  PID:4664
- C:\Windows\System\NkdWwXg.exe
  C:\Windows\System\NkdWwXg.exe
  2⤵
  PID:4548
- C:\Windows\System\UzerHCn.exe
  C:\Windows\System\UzerHCn.exe
  2⤵
  PID:4580
- C:\Windows\System\TGNKPfI.exe
  C:\Windows\System\TGNKPfI.exe
  2⤵
  PID:4700
- C:\Windows\System\Fqeituw.exe
  C:\Windows\System\Fqeituw.exe
  2⤵
  PID:4716
- C:\Windows\System\TeyNhiD.exe
  C:\Windows\System\TeyNhiD.exe
  2⤵
  PID:4752
- C:\Windows\System\PaXIBgO.exe
  C:\Windows\System\PaXIBgO.exe
  2⤵
  PID:4740
- C:\Windows\System\pWHrykh.exe
  C:\Windows\System\pWHrykh.exe
  2⤵
  PID:4792
- C:\Windows\System\RwRlXzV.exe
  C:\Windows\System\RwRlXzV.exe
  2⤵
  PID:4808
- C:\Windows\System\gkuqEgo.exe
  C:\Windows\System\gkuqEgo.exe
  2⤵
  PID:4828
- C:\Windows\System\WaUaoDw.exe
  C:\Windows\System\WaUaoDw.exe
  2⤵
  PID:4868
- C:\Windows\System\grWsaou.exe
  C:\Windows\System\grWsaou.exe
  2⤵
  PID:4896
- C:\Windows\System\rWlcymx.exe
  C:\Windows\System\rWlcymx.exe
  2⤵
  PID:4916
- C:\Windows\System\PnKJizN.exe
  C:\Windows\System\PnKJizN.exe
  2⤵
  PID:4940
- C:\Windows\System\ojJbSyu.exe
  C:\Windows\System\ojJbSyu.exe
  2⤵
  PID:4968
- C:\Windows\System\jjqYVza.exe
  C:\Windows\System\jjqYVza.exe
  2⤵
  PID:5036
- C:\Windows\System\vqAlTXp.exe
  C:\Windows\System\vqAlTXp.exe
  2⤵
  PID:5024
- C:\Windows\System\YIhdgwY.exe
  C:\Windows\System\YIhdgwY.exe
  2⤵
  PID:4984
- C:\Windows\System\lKXttSS.exe
  C:\Windows\System\lKXttSS.exe
  2⤵
  PID:5072
- C:\Windows\System\IMHqPPp.exe
  C:\Windows\System\IMHqPPp.exe
  2⤵
  PID:5068
- C:\Windows\System\xujpTaG.exe
  C:\Windows\System\xujpTaG.exe
  2⤵
  PID:3828
- C:\Windows\System\CMScQTz.exe
  C:\Windows\System\CMScQTz.exe
  2⤵
  PID:3908
- C:\Windows\System\keTrUqg.exe
  C:\Windows\System\keTrUqg.exe
  2⤵
  PID:4424
- C:\Windows\System\rsFjvif.exe
  C:\Windows\System\rsFjvif.exe
  2⤵
  PID:4196
- C:\Windows\System\vdcDZtr.exe
  C:\Windows\System\vdcDZtr.exe
  2⤵
  PID:4312
- C:\Windows\System\BCHFhBM.exe
  C:\Windows\System\BCHFhBM.exe
  2⤵
  PID:3588
- C:\Windows\System\ICgGPrB.exe
  C:\Windows\System\ICgGPrB.exe
  2⤵
  PID:4568
- C:\Windows\System\dEvFNcX.exe
  C:\Windows\System\dEvFNcX.exe
  2⤵
  PID:4184
- C:\Windows\System\EraQHGT.exe
  C:\Windows\System\EraQHGT.exe
  2⤵
  PID:4504
- C:\Windows\System\IdJtzOR.exe
  C:\Windows\System\IdJtzOR.exe
  2⤵
  PID:2940
- C:\Windows\System\gmOUgvz.exe
  C:\Windows\System\gmOUgvz.exe
  2⤵
  PID:4260
- C:\Windows\System\tqXHwZt.exe
  C:\Windows\System\tqXHwZt.exe
  2⤵
  PID:4724
- C:\Windows\System\yijYDiB.exe
  C:\Windows\System\yijYDiB.exe
  2⤵
  PID:4728
- C:\Windows\System\ZfLQBtk.exe
  C:\Windows\System\ZfLQBtk.exe
  2⤵
  PID:4832
- C:\Windows\System\TzHlxvK.exe
  C:\Windows\System\TzHlxvK.exe
  2⤵
  PID:4468
- C:\Windows\System\DYYMvJx.exe
  C:\Windows\System\DYYMvJx.exe
  2⤵
  PID:4696
- C:\Windows\System\CVKfnlN.exe
  C:\Windows\System\CVKfnlN.exe
  2⤵
  PID:4924
- C:\Windows\System\DyqZkUP.exe
  C:\Windows\System\DyqZkUP.exe
  2⤵
  PID:5000
- C:\Windows\System\qBXxjBe.exe
  C:\Windows\System\qBXxjBe.exe
  2⤵
  PID:5004
- C:\Windows\System\ZvamREh.exe
  C:\Windows\System\ZvamREh.exe
  2⤵
  PID:4168
- C:\Windows\System\jtDINsH.exe
  C:\Windows\System\jtDINsH.exe
  2⤵
  PID:4420
- C:\Windows\System\cjBskSp.exe
  C:\Windows\System\cjBskSp.exe
  2⤵
  PID:4964
- C:\Windows\System\ciipdkQ.exe
  C:\Windows\System\ciipdkQ.exe
  2⤵
  PID:4616
- C:\Windows\System\RHhAwKF.exe
  C:\Windows\System\RHhAwKF.exe
  2⤵
  PID:3844
- C:\Windows\System\PVUdyNk.exe
  C:\Windows\System\PVUdyNk.exe
  2⤵
  PID:4848
- C:\Windows\System\oPMdxYU.exe
  C:\Windows\System\oPMdxYU.exe
  2⤵
  PID:4712
- C:\Windows\System\prmDDCI.exe
  C:\Windows\System\prmDDCI.exe
  2⤵
  PID:4360
- C:\Windows\System\gJKRCoO.exe
  C:\Windows\System\gJKRCoO.exe
  2⤵
  PID:4280
- C:\Windows\System\ayBZnoA.exe
  C:\Windows\System\ayBZnoA.exe
  2⤵
  PID:5088
- C:\Windows\System\FCISjJJ.exe
  C:\Windows\System\FCISjJJ.exe
  2⤵
  PID:4532
- C:\Windows\System\EzpUdZV.exe
  C:\Windows\System\EzpUdZV.exe
  2⤵
  PID:5100
- C:\Windows\System\ChZUeQO.exe
  C:\Windows\System\ChZUeQO.exe
  2⤵
  PID:4928
- C:\Windows\System\MzWbZvY.exe
  C:\Windows\System\MzWbZvY.exe
  2⤵
  PID:4612
- C:\Windows\System\pOTkAkz.exe
  C:\Windows\System\pOTkAkz.exe
  2⤵
  PID:4912
- C:\Windows\System\pODneZk.exe
  C:\Windows\System\pODneZk.exe
  2⤵
  PID:4824
- C:\Windows\System\VRaPwXD.exe
  C:\Windows\System\VRaPwXD.exe
  2⤵
  PID:5132
- C:\Windows\System\rmvjXVZ.exe
  C:\Windows\System\rmvjXVZ.exe
  2⤵
  PID:5148
- C:\Windows\System\zGYZMdK.exe
  C:\Windows\System\zGYZMdK.exe
  2⤵
  PID:5164
- C:\Windows\System\LprmSik.exe
  C:\Windows\System\LprmSik.exe
  2⤵
  PID:5180
- C:\Windows\System\DNuDUPx.exe
  C:\Windows\System\DNuDUPx.exe
  2⤵
  PID:5196
- C:\Windows\System\xgWatwt.exe
  C:\Windows\System\xgWatwt.exe
  2⤵
  PID:5212
- C:\Windows\System\sTLxkFA.exe
  C:\Windows\System\sTLxkFA.exe
  2⤵
  PID:5228
- C:\Windows\System\gnsqyIP.exe
  C:\Windows\System\gnsqyIP.exe
  2⤵
  PID:5244
- C:\Windows\System\gcOkWTS.exe
  C:\Windows\System\gcOkWTS.exe
  2⤵
  PID:5260
- C:\Windows\System\YIGrQGd.exe
  C:\Windows\System\YIGrQGd.exe
  2⤵
  PID:5276
- C:\Windows\System\UuIRxIL.exe
  C:\Windows\System\UuIRxIL.exe
  2⤵
  PID:5292
- C:\Windows\System\CpFznux.exe
  C:\Windows\System\CpFznux.exe
  2⤵
  PID:5308
- C:\Windows\System\uaBdAsE.exe
  C:\Windows\System\uaBdAsE.exe
  2⤵
  PID:5324
- C:\Windows\System\EUQZhNR.exe
  C:\Windows\System\EUQZhNR.exe
  2⤵
  PID:5340
- C:\Windows\System\ZSNCmgt.exe
  C:\Windows\System\ZSNCmgt.exe
  2⤵
  PID:5356
- C:\Windows\System\AefyXHN.exe
  C:\Windows\System\AefyXHN.exe
  2⤵
  PID:5372
- C:\Windows\System\jEPagCc.exe
  C:\Windows\System\jEPagCc.exe
  2⤵
  PID:5388
- C:\Windows\System\juLifFf.exe
  C:\Windows\System\juLifFf.exe
  2⤵
  PID:5404
- C:\Windows\System\UydfnZe.exe
  C:\Windows\System\UydfnZe.exe
  2⤵
  PID:5420
- C:\Windows\System\jmdOQZW.exe
  C:\Windows\System\jmdOQZW.exe
  2⤵
  PID:5436
- C:\Windows\System\Lrmflxd.exe
  C:\Windows\System\Lrmflxd.exe
  2⤵
  PID:5452
- C:\Windows\System\eOuyQXA.exe
  C:\Windows\System\eOuyQXA.exe
  2⤵
  PID:5468
- C:\Windows\System\eJnDecP.exe
  C:\Windows\System\eJnDecP.exe
  2⤵
  PID:5484
- C:\Windows\System\dkBGdzv.exe
  C:\Windows\System\dkBGdzv.exe
  2⤵
  PID:5500
- C:\Windows\System\IGShPOV.exe
  C:\Windows\System\IGShPOV.exe
  2⤵
  PID:5516
- C:\Windows\System\BniVxcW.exe
  C:\Windows\System\BniVxcW.exe
  2⤵
  PID:5532
- C:\Windows\System\oKWBINr.exe
  C:\Windows\System\oKWBINr.exe
  2⤵
  PID:5552
- C:\Windows\System\CDmFnuy.exe
  C:\Windows\System\CDmFnuy.exe
  2⤵
  PID:5568
- C:\Windows\System\FHoMUcy.exe
  C:\Windows\System\FHoMUcy.exe
  2⤵
  PID:5584
- C:\Windows\System\aWAhYnr.exe
  C:\Windows\System\aWAhYnr.exe
  2⤵
  PID:5600
- C:\Windows\System\RryiZUE.exe
  C:\Windows\System\RryiZUE.exe
  2⤵
  PID:5616
- C:\Windows\System\DmytQzY.exe
  C:\Windows\System\DmytQzY.exe
  2⤵
  PID:5632
- C:\Windows\System\FdpFokA.exe
  C:\Windows\System\FdpFokA.exe
  2⤵
  PID:5648
- C:\Windows\System\MpOlAVT.exe
  C:\Windows\System\MpOlAVT.exe
  2⤵
  PID:5664
- C:\Windows\System\fioPsoj.exe
  C:\Windows\System\fioPsoj.exe
  2⤵
  PID:5684
- C:\Windows\System\AVEYdQg.exe
  C:\Windows\System\AVEYdQg.exe
  2⤵
  PID:5700
- C:\Windows\System\NzYqeoi.exe
  C:\Windows\System\NzYqeoi.exe
  2⤵
  PID:5716
- C:\Windows\System\fhKQyyT.exe
  C:\Windows\System\fhKQyyT.exe
  2⤵
  PID:5732
- C:\Windows\System\ymIijac.exe
  C:\Windows\System\ymIijac.exe
  2⤵
  PID:5748
- C:\Windows\System\lPEFrUp.exe
  C:\Windows\System\lPEFrUp.exe
  2⤵
  PID:5764
- C:\Windows\System\tEfnUfF.exe
  C:\Windows\System\tEfnUfF.exe
  2⤵
  PID:5780
- C:\Windows\System\UhyxwmG.exe
  C:\Windows\System\UhyxwmG.exe
  2⤵
  PID:5796
- C:\Windows\System\rwqOPCs.exe
  C:\Windows\System\rwqOPCs.exe
  2⤵
  PID:5812
- C:\Windows\System\KDpxYKP.exe
  C:\Windows\System\KDpxYKP.exe
  2⤵
  PID:5828
- C:\Windows\System\nxtLXMg.exe
  C:\Windows\System\nxtLXMg.exe
  2⤵
  PID:5844
- C:\Windows\System\fcseWnM.exe
  C:\Windows\System\fcseWnM.exe
  2⤵
  PID:5860
- C:\Windows\System\ntkzNad.exe
  C:\Windows\System\ntkzNad.exe
  2⤵
  PID:5876
- C:\Windows\System\SojsicG.exe
  C:\Windows\System\SojsicG.exe
  2⤵
  PID:5892
- C:\Windows\System\emwanRL.exe
  C:\Windows\System\emwanRL.exe
  2⤵
  PID:5908
- C:\Windows\System\RUWwXcE.exe
  C:\Windows\System\RUWwXcE.exe
  2⤵
  PID:5924
- C:\Windows\System\GWmmSBz.exe
  C:\Windows\System\GWmmSBz.exe
  2⤵
  PID:5940
- C:\Windows\System\lKXzuLI.exe
  C:\Windows\System\lKXzuLI.exe
  2⤵
  PID:5956
- C:\Windows\System\fmcACkV.exe
  C:\Windows\System\fmcACkV.exe
  2⤵
  PID:5972
- C:\Windows\System\XJypRng.exe
  C:\Windows\System\XJypRng.exe
  2⤵
  PID:5988
- C:\Windows\System\lynTDCh.exe
  C:\Windows\System\lynTDCh.exe
  2⤵
  PID:6004
- C:\Windows\System\iKDNwBU.exe
  C:\Windows\System\iKDNwBU.exe
  2⤵
  PID:6020
- C:\Windows\System\tTjJSQa.exe
  C:\Windows\System\tTjJSQa.exe
  2⤵
  PID:6036
- C:\Windows\System\LxnpZlj.exe
  C:\Windows\System\LxnpZlj.exe
  2⤵
  PID:6052
- C:\Windows\System\tMlVMcF.exe
  C:\Windows\System\tMlVMcF.exe
  2⤵
  PID:6068
- C:\Windows\System\wGfcCDZ.exe
  C:\Windows\System\wGfcCDZ.exe
  2⤵
  PID:6084
- C:\Windows\System\ktQFpzp.exe
  C:\Windows\System\ktQFpzp.exe
  2⤵
  PID:6100
- C:\Windows\System\nFZwszA.exe
  C:\Windows\System\nFZwszA.exe
  2⤵
  PID:6116
- C:\Windows\System\CTWXldQ.exe
  C:\Windows\System\CTWXldQ.exe
  2⤵
  PID:6132
- C:\Windows\System\PySORMJ.exe
  C:\Windows\System\PySORMJ.exe
  2⤵
  PID:4376
- C:\Windows\System\BAAtdQk.exe
  C:\Windows\System\BAAtdQk.exe
  2⤵
  PID:5128
- C:\Windows\System\ZLaVfTI.exe
  C:\Windows\System\ZLaVfTI.exe
  2⤵
  PID:5188
- C:\Windows\System\LkAcmSU.exe
  C:\Windows\System\LkAcmSU.exe
  2⤵
  PID:4356
- C:\Windows\System\fvoXlpC.exe
  C:\Windows\System\fvoXlpC.exe
  2⤵
  PID:4884
- C:\Windows\System\mWORGvl.exe
  C:\Windows\System\mWORGvl.exe
  2⤵
  PID:5016
- C:\Windows\System\QfbNiJL.exe
  C:\Windows\System\QfbNiJL.exe
  2⤵
  PID:5176
- C:\Windows\System\WiIerHN.exe
  C:\Windows\System\WiIerHN.exe
  2⤵
  PID:5268
- C:\Windows\System\LFMXvfL.exe
  C:\Windows\System\LFMXvfL.exe
  2⤵
  PID:5332
- C:\Windows\System\ApWinOQ.exe
  C:\Windows\System\ApWinOQ.exe
  2⤵
  PID:5368
- C:\Windows\System\qGkyNxr.exe
  C:\Windows\System\qGkyNxr.exe
  2⤵
  PID:5352
- C:\Windows\System\DjhSDFF.exe
  C:\Windows\System\DjhSDFF.exe
  2⤵
  PID:5316
- C:\Windows\System\AOuMsjV.exe
  C:\Windows\System\AOuMsjV.exe
  2⤵
  PID:5384
- C:\Windows\System\bMbvSlJ.exe
  C:\Windows\System\bMbvSlJ.exe
  2⤵
  PID:5448
- C:\Windows\System\vGUsvho.exe
  C:\Windows\System\vGUsvho.exe
  2⤵
  PID:5492
- C:\Windows\System\Ncjdzur.exe
  C:\Windows\System\Ncjdzur.exe
  2⤵
  PID:5364
- C:\Windows\System\noaHqmJ.exe
  C:\Windows\System\noaHqmJ.exe
  2⤵
  PID:5512
- C:\Windows\System\mdfNlJO.exe
  C:\Windows\System\mdfNlJO.exe
  2⤵
  PID:5548
- C:\Windows\System\KOciffO.exe
  C:\Windows\System\KOciffO.exe
  2⤵
  PID:5596
- C:\Windows\System\oLYFUDf.exe
  C:\Windows\System\oLYFUDf.exe
  2⤵
  PID:5580
- C:\Windows\System\YJyLORs.exe
  C:\Windows\System\YJyLORs.exe
  2⤵
  PID:5644
- C:\Windows\System\QZBMICS.exe
  C:\Windows\System\QZBMICS.exe
  2⤵
  PID:5708
- C:\Windows\System\OVtlsNZ.exe
  C:\Windows\System\OVtlsNZ.exe
  2⤵
  PID:5772
- C:\Windows\System\kJzoXoP.exe
  C:\Windows\System\kJzoXoP.exe
  2⤵
  PID:5724
- C:\Windows\System\zjAMgQm.exe
  C:\Windows\System\zjAMgQm.exe
  2⤵
  PID:5788
- C:\Windows\System\FIXUHKS.exe
  C:\Windows\System\FIXUHKS.exe
  2⤵
  PID:5824
- C:\Windows\System\JpsfjcR.exe
  C:\Windows\System\JpsfjcR.exe
  2⤵
  PID:5888
- C:\Windows\System\cIzhWod.exe
  C:\Windows\System\cIzhWod.exe
  2⤵
  PID:5952
- C:\Windows\System\cQPdzsB.exe
  C:\Windows\System\cQPdzsB.exe
  2⤵
  PID:6016
- C:\Windows\System\ExsIyBH.exe
  C:\Windows\System\ExsIyBH.exe
  2⤵
  PID:5804
- C:\Windows\System\XySZSWf.exe
  C:\Windows\System\XySZSWf.exe
  2⤵
  PID:6112
- C:\Windows\System\lvgzhll.exe
  C:\Windows\System\lvgzhll.exe
  2⤵
  PID:4776
- C:\Windows\System\ZQsxjCZ.exe
  C:\Windows\System\ZQsxjCZ.exe
  2⤵
  PID:5116
- C:\Windows\System\EiicvAR.exe
  C:\Windows\System\EiicvAR.exe
  2⤵
  PID:6128
- C:\Windows\System\rKLquMI.exe
  C:\Windows\System\rKLquMI.exe
  2⤵
  PID:5432
- C:\Windows\System\pVCbuIg.exe
  C:\Windows\System\pVCbuIg.exe
  2⤵
  PID:5564
- C:\Windows\System\gcxPZrT.exe
  C:\Windows\System\gcxPZrT.exe
  2⤵
  PID:5904
- C:\Windows\System\DXvdosy.exe
  C:\Windows\System\DXvdosy.exe
  2⤵
  PID:5744
- C:\Windows\System\FMAxAge.exe
  C:\Windows\System\FMAxAge.exe
  2⤵
  PID:5836
- C:\Windows\System\VlKtYiA.exe
  C:\Windows\System\VlKtYiA.exe
  2⤵
  PID:5856
- C:\Windows\System\FOsunkU.exe
  C:\Windows\System\FOsunkU.exe
  2⤵
  PID:5932
- C:\Windows\System\BxvLKTg.exe
  C:\Windows\System\BxvLKTg.exe
  2⤵
  PID:6000
- C:\Windows\System\ZyMRhhM.exe
  C:\Windows\System\ZyMRhhM.exe
  2⤵
  PID:6096
- C:\Windows\System\SdzoexI.exe
  C:\Windows\System\SdzoexI.exe
  2⤵
  PID:5204
- C:\Windows\System\mSYCNer.exe
  C:\Windows\System\mSYCNer.exe
  2⤵
  PID:5240
- C:\Windows\System\eTVgyaw.exe
  C:\Windows\System\eTVgyaw.exe
  2⤵
  PID:5288
- C:\Windows\System\UciiLur.exe
  C:\Windows\System\UciiLur.exe
  2⤵
  PID:6152
- C:\Windows\System\GlGMDok.exe
  C:\Windows\System\GlGMDok.exe
  2⤵
  PID:6168
- C:\Windows\System\gpeOIia.exe
  C:\Windows\System\gpeOIia.exe
  2⤵
  PID:6184
- C:\Windows\System\LJshLmF.exe
  C:\Windows\System\LJshLmF.exe
  2⤵
  PID:6200
- C:\Windows\System\KVwoNTN.exe
  C:\Windows\System\KVwoNTN.exe
  2⤵
  PID:6216
- C:\Windows\System\kFopqGv.exe
  C:\Windows\System\kFopqGv.exe
  2⤵
  PID:6232
- C:\Windows\System\eNaeRAC.exe
  C:\Windows\System\eNaeRAC.exe
  2⤵
  PID:6248
- C:\Windows\System\LbzTxQi.exe
  C:\Windows\System\LbzTxQi.exe
  2⤵
  PID:6264
- C:\Windows\System\vcuanSr.exe
  C:\Windows\System\vcuanSr.exe
  2⤵
  PID:6280
- C:\Windows\System\kOhzSUc.exe
  C:\Windows\System\kOhzSUc.exe
  2⤵
  PID:6296
- C:\Windows\System\WesymHe.exe
  C:\Windows\System\WesymHe.exe
  2⤵
  PID:6312
- C:\Windows\System\OBMunpp.exe
  C:\Windows\System\OBMunpp.exe
  2⤵
  PID:6328
- C:\Windows\System\mCslbRC.exe
  C:\Windows\System\mCslbRC.exe
  2⤵
  PID:6344
- C:\Windows\System\NysjsUl.exe
  C:\Windows\System\NysjsUl.exe
  2⤵
  PID:6360
- C:\Windows\System\YpeIGgU.exe
  C:\Windows\System\YpeIGgU.exe
  2⤵
  PID:6376
- C:\Windows\System\ULatZVx.exe
  C:\Windows\System\ULatZVx.exe
  2⤵
  PID:6392
- C:\Windows\System\WONpSgg.exe
  C:\Windows\System\WONpSgg.exe
  2⤵
  PID:6408
- C:\Windows\System\WOsWRVT.exe
  C:\Windows\System\WOsWRVT.exe
  2⤵
  PID:6424
- C:\Windows\System\UrzbdkW.exe
  C:\Windows\System\UrzbdkW.exe
  2⤵
  PID:6440
- C:\Windows\System\yzHkLbg.exe
  C:\Windows\System\yzHkLbg.exe
  2⤵
  PID:6456
- C:\Windows\System\ZNEZENA.exe
  C:\Windows\System\ZNEZENA.exe
  2⤵
  PID:6472
- C:\Windows\System\TdEILSp.exe
  C:\Windows\System\TdEILSp.exe
  2⤵
  PID:6488
- C:\Windows\System\zeVQRdy.exe
  C:\Windows\System\zeVQRdy.exe
  2⤵
  PID:6504
- C:\Windows\System\HVBiwDZ.exe
  C:\Windows\System\HVBiwDZ.exe
  2⤵
  PID:6520
- C:\Windows\System\ftmUgjk.exe
  C:\Windows\System\ftmUgjk.exe
  2⤵
  PID:6536
- C:\Windows\System\mSjpqJI.exe
  C:\Windows\System\mSjpqJI.exe
  2⤵
  PID:6552
- C:\Windows\System\ENiSxZl.exe
  C:\Windows\System\ENiSxZl.exe
  2⤵
  PID:6568
- C:\Windows\System\ASqZGrJ.exe
  C:\Windows\System\ASqZGrJ.exe
  2⤵
  PID:6584
- C:\Windows\System\eCyTyNK.exe
  C:\Windows\System\eCyTyNK.exe
  2⤵
  PID:6600
- C:\Windows\System\CLyCEVa.exe
  C:\Windows\System\CLyCEVa.exe
  2⤵
  PID:6616
- C:\Windows\System\CfbtsSF.exe
  C:\Windows\System\CfbtsSF.exe
  2⤵
  PID:6632
- C:\Windows\System\XLVEYdY.exe
  C:\Windows\System\XLVEYdY.exe
  2⤵
  PID:6648
- C:\Windows\System\CjVEzLy.exe
  C:\Windows\System\CjVEzLy.exe
  2⤵
  PID:6664
- C:\Windows\System\ncIzAXe.exe
  C:\Windows\System\ncIzAXe.exe
  2⤵
  PID:6680
- C:\Windows\System\srBWpZG.exe
  C:\Windows\System\srBWpZG.exe
  2⤵
  PID:6696
- C:\Windows\System\pBhaEuD.exe
  C:\Windows\System\pBhaEuD.exe
  2⤵
  PID:6712
- C:\Windows\System\EMcxcdC.exe
  C:\Windows\System\EMcxcdC.exe
  2⤵
  PID:6728
- C:\Windows\System\BEVIbTT.exe
  C:\Windows\System\BEVIbTT.exe
  2⤵
  PID:6744
- C:\Windows\System\NFOoPqY.exe
  C:\Windows\System\NFOoPqY.exe
  2⤵
  PID:6760
- C:\Windows\System\woacnTY.exe
  C:\Windows\System\woacnTY.exe
  2⤵
  PID:6776
- C:\Windows\System\eYBlOFq.exe
  C:\Windows\System\eYBlOFq.exe
  2⤵
  PID:6792
- C:\Windows\System\gGPUwfY.exe
  C:\Windows\System\gGPUwfY.exe
  2⤵
  PID:6808
- C:\Windows\System\ggGkIsW.exe
  C:\Windows\System\ggGkIsW.exe
  2⤵
  PID:6824
- C:\Windows\System\vGdHRBf.exe
  C:\Windows\System\vGdHRBf.exe
  2⤵
  PID:6840
- C:\Windows\System\fxYoxUR.exe
  C:\Windows\System\fxYoxUR.exe
  2⤵
  PID:6856
- C:\Windows\System\AGOaStK.exe
  C:\Windows\System\AGOaStK.exe
  2⤵
  PID:6872
- C:\Windows\System\iFZmqjI.exe
  C:\Windows\System\iFZmqjI.exe
  2⤵
  PID:6888
- C:\Windows\System\kHAsHNK.exe
  C:\Windows\System\kHAsHNK.exe
  2⤵
  PID:6904
- C:\Windows\System\YJpGDez.exe
  C:\Windows\System\YJpGDez.exe
  2⤵
  PID:6920
- C:\Windows\System\kpunZFs.exe
  C:\Windows\System\kpunZFs.exe
  2⤵
  PID:6936
- C:\Windows\System\sMFsTqc.exe
  C:\Windows\System\sMFsTqc.exe
  2⤵
  PID:6952
- C:\Windows\System\XCgvVhJ.exe
  C:\Windows\System\XCgvVhJ.exe
  2⤵
  PID:6968
- C:\Windows\System\wpilIUL.exe
  C:\Windows\System\wpilIUL.exe
  2⤵
  PID:6984
- C:\Windows\System\QXGLyPJ.exe
  C:\Windows\System\QXGLyPJ.exe
  2⤵
  PID:7000
- C:\Windows\System\cakvnsO.exe
  C:\Windows\System\cakvnsO.exe
  2⤵
  PID:7016
- C:\Windows\System\nIGrCjX.exe
  C:\Windows\System\nIGrCjX.exe
  2⤵
  PID:7032
- C:\Windows\System\QWXnofg.exe
  C:\Windows\System\QWXnofg.exe
  2⤵
  PID:7048
- C:\Windows\System\HeDkctF.exe
  C:\Windows\System\HeDkctF.exe
  2⤵
  PID:7064
- C:\Windows\System\fKExKtZ.exe
  C:\Windows\System\fKExKtZ.exe
  2⤵
  PID:7080
- C:\Windows\System\lxAAuJL.exe
  C:\Windows\System\lxAAuJL.exe
  2⤵
  PID:7096
- C:\Windows\System\cRionEc.exe
  C:\Windows\System\cRionEc.exe
  2⤵
  PID:7112
- C:\Windows\System\BmpQIhT.exe
  C:\Windows\System\BmpQIhT.exe
  2⤵
  PID:7128
- C:\Windows\System\KdEccDq.exe
  C:\Windows\System\KdEccDq.exe
  2⤵
  PID:7144
- C:\Windows\System\qjMIWxJ.exe
  C:\Windows\System\qjMIWxJ.exe
  2⤵
  PID:7160
- C:\Windows\System\xrVOrzp.exe
  C:\Windows\System\xrVOrzp.exe
  2⤵
  PID:6080
- C:\Windows\System\bcHPwZw.exe
  C:\Windows\System\bcHPwZw.exe
  2⤵
  PID:5380
- C:\Windows\System\wDkvrpg.exe
  C:\Windows\System\wDkvrpg.exe
  2⤵
  PID:5656
- C:\Windows\System\cPomhGd.exe
  C:\Windows\System\cPomhGd.exe
  2⤵
  PID:5348
- C:\Windows\System\MLCmjjo.exe
  C:\Windows\System\MLCmjjo.exe
  2⤵
  PID:5692
- C:\Windows\System\WAwEAtS.exe
  C:\Windows\System\WAwEAtS.exe
  2⤵
  PID:5920
- C:\Windows\System\XsZKXqY.exe
  C:\Windows\System\XsZKXqY.exe
  2⤵
  PID:4736
- C:\Windows\System\GRYhENZ.exe
  C:\Windows\System\GRYhENZ.exe
  2⤵
  PID:5160
- C:\Windows\System\vPeQKPN.exe
  C:\Windows\System\vPeQKPN.exe
  2⤵
  PID:5740
- C:\Windows\System\FECSoFj.exe
  C:\Windows\System\FECSoFj.exe
  2⤵
  PID:5508
- C:\Windows\System\APruLVo.exe
  C:\Windows\System\APruLVo.exe
  2⤵
  PID:5968
- C:\Windows\System\nzPrOwc.exe
  C:\Windows\System\nzPrOwc.exe
  2⤵
  PID:5284
- C:\Windows\System\bFsPptb.exe
  C:\Windows\System\bFsPptb.exe
  2⤵
  PID:6196
- C:\Windows\System\JbbXBFj.exe
  C:\Windows\System\JbbXBFj.exe
  2⤵
  PID:6228
- C:\Windows\System\wAjNTyO.exe
  C:\Windows\System\wAjNTyO.exe
  2⤵
  PID:6292
- C:\Windows\System\WiboVUK.exe
  C:\Windows\System\WiboVUK.exe
  2⤵
  PID:6212
- C:\Windows\System\FzbmSvv.exe
  C:\Windows\System\FzbmSvv.exe
  2⤵
  PID:5236
- C:\Windows\System\rbmnORa.exe
  C:\Windows\System\rbmnORa.exe
  2⤵
  PID:6304
- C:\Windows\System\OJwwRnV.exe
  C:\Windows\System\OJwwRnV.exe
  2⤵
  PID:6368
- C:\Windows\System\jpsIUzk.exe
  C:\Windows\System\jpsIUzk.exe
  2⤵
  PID:6432
- C:\Windows\System\LAZjYet.exe
  C:\Windows\System\LAZjYet.exe
  2⤵
  PID:6496
- C:\Windows\System\DVaQCzW.exe
  C:\Windows\System\DVaQCzW.exe
  2⤵
  PID:6448
- C:\Windows\System\vwoikma.exe
  C:\Windows\System\vwoikma.exe
  2⤵
  PID:6384
- C:\Windows\System\GhHpeGb.exe
  C:\Windows\System\GhHpeGb.exe
  2⤵
  PID:6452
- C:\Windows\System\SGZspLo.exe
  C:\Windows\System\SGZspLo.exe
  2⤵
  PID:6548
- C:\Windows\System\BjaekCP.exe
  C:\Windows\System\BjaekCP.exe
  2⤵
  PID:6560
- C:\Windows\System\HCjpKbY.exe
  C:\Windows\System\HCjpKbY.exe
  2⤵
  PID:6624
- C:\Windows\System\MnsdThd.exe
  C:\Windows\System\MnsdThd.exe
  2⤵
  PID:6612
- C:\Windows\System\zbjzbkS.exe
  C:\Windows\System\zbjzbkS.exe
  2⤵
  PID:6688
- C:\Windows\System\JcRkXyq.exe
  C:\Windows\System\JcRkXyq.exe
  2⤵
  PID:6752
- C:\Windows\System\YzybyyM.exe
  C:\Windows\System\YzybyyM.exe
  2⤵
  PID:6816
- C:\Windows\System\oIKXRxb.exe
  C:\Windows\System\oIKXRxb.exe
  2⤵
  PID:6880
- C:\Windows\System\JQzRRTY.exe
  C:\Windows\System\JQzRRTY.exe
  2⤵
  PID:6644
- C:\Windows\System\bBZwKwH.exe
  C:\Windows\System\bBZwKwH.exe
  2⤵
  PID:6736
- C:\Windows\System\DQKgTLs.exe
  C:\Windows\System\DQKgTLs.exe
  2⤵
  PID:6800
- C:\Windows\System\gBwCBgf.exe
  C:\Windows\System\gBwCBgf.exe
  2⤵
  PID:6864
- C:\Windows\System\ATDiAif.exe
  C:\Windows\System\ATDiAif.exe
  2⤵
  PID:6932
- C:\Windows\System\dsnDpVC.exe
  C:\Windows\System\dsnDpVC.exe
  2⤵
  PID:6996
- C:\Windows\System\mTSKxBT.exe
  C:\Windows\System\mTSKxBT.exe
  2⤵
  PID:6944
- C:\Windows\System\BZTDqjm.exe
  C:\Windows\System\BZTDqjm.exe
  2⤵
  PID:7008
- C:\Windows\System\GvBNKPt.exe
  C:\Windows\System\GvBNKPt.exe
  2⤵
  PID:7072
- C:\Windows\System\HJBSAKy.exe
  C:\Windows\System\HJBSAKy.exe
  2⤵
  PID:7108
- C:\Windows\System\yfnLfXn.exe
  C:\Windows\System\yfnLfXn.exe
  2⤵
  PID:7088
- C:\Windows\System\crRDicb.exe
  C:\Windows\System\crRDicb.exe
  2⤵
  PID:5460
- C:\Windows\System\TrsXTQL.exe
  C:\Windows\System\TrsXTQL.exe
  2⤵
  PID:5820
- C:\Windows\System\YrigMEe.exe
  C:\Windows\System\YrigMEe.exe
  2⤵
  PID:7156
- C:\Windows\System\UesbKoe.exe
  C:\Windows\System\UesbKoe.exe
  2⤵
  PID:6244
- C:\Windows\System\oEKuxNW.exe
  C:\Windows\System\oEKuxNW.exe
  2⤵
  PID:6464
- C:\Windows\System\lIdgiQR.exe
  C:\Windows\System\lIdgiQR.exe
  2⤵
  PID:6484
- C:\Windows\System\IUTZShA.exe
  C:\Windows\System\IUTZShA.exe
  2⤵
  PID:6656
- C:\Windows\System\eaZKThP.exe
  C:\Windows\System\eaZKThP.exe
  2⤵
  PID:6784
- C:\Windows\System\qSffMMA.exe
  C:\Windows\System\qSffMMA.exe
  2⤵
  PID:6064
- C:\Windows\System\nmlDjXi.exe
  C:\Windows\System\nmlDjXi.exe
  2⤵
  PID:5252
- C:\Windows\System\qSmTPDM.exe
  C:\Windows\System\qSmTPDM.exe
  2⤵
  PID:6324
- C:\Windows\System\sTbDXzf.exe
  C:\Windows\System\sTbDXzf.exe
  2⤵
  PID:6404
- C:\Windows\System\FkrzQiV.exe
  C:\Windows\System\FkrzQiV.exe
  2⤵
  PID:6528
- C:\Windows\System\PDvVNQG.exe
  C:\Windows\System\PDvVNQG.exe
  2⤵
  PID:6720
- C:\Windows\System\WRgUhMX.exe
  C:\Windows\System\WRgUhMX.exe
  2⤵
  PID:6640
- C:\Windows\System\gkTqawG.exe
  C:\Windows\System\gkTqawG.exe
  2⤵
  PID:6900
- C:\Windows\System\OSLWgUp.exe
  C:\Windows\System\OSLWgUp.exe
  2⤵
  PID:6916
- C:\Windows\System\VNqxgPo.exe
  C:\Windows\System\VNqxgPo.exe
  2⤵
  PID:6852
- C:\Windows\System\kShsUvQ.exe
  C:\Windows\System\kShsUvQ.exe
  2⤵
  PID:7060
- C:\Windows\System\ibenFrd.exe
  C:\Windows\System\ibenFrd.exe
  2⤵
  PID:6976
- C:\Windows\System\ZlOmuGP.exe
  C:\Windows\System\ZlOmuGP.exe
  2⤵
  PID:5984
- C:\Windows\System\GGOfMFW.exe
  C:\Windows\System\GGOfMFW.exe
  2⤵
  PID:5628
- C:\Windows\System\TzulSmB.exe
  C:\Windows\System\TzulSmB.exe
  2⤵
  PID:6164
- C:\Windows\System\irhWKDr.exe
  C:\Windows\System\irhWKDr.exe
  2⤵
  PID:6356
- C:\Windows\System\FFxfRHN.exe
  C:\Windows\System\FFxfRHN.exe
  2⤵
  PID:5224
- C:\Windows\System\BnHaWCw.exe
  C:\Windows\System\BnHaWCw.exe
  2⤵
  PID:6580
- C:\Windows\System\NOcfVtV.exe
  C:\Windows\System\NOcfVtV.exe
  2⤵
  PID:6340
- C:\Windows\System\dPeaGCh.exe
  C:\Windows\System\dPeaGCh.exe
  2⤵
  PID:6416
- C:\Windows\System\ukgFvlw.exe
  C:\Windows\System\ukgFvlw.exe
  2⤵
  PID:6596
- C:\Windows\System\XxTHfpy.exe
  C:\Windows\System\XxTHfpy.exe
  2⤵
  PID:5444
- C:\Windows\System\gAqobWM.exe
  C:\Windows\System\gAqobWM.exe
  2⤵
  PID:7044
- C:\Windows\System\rfKsJLI.exe
  C:\Windows\System\rfKsJLI.exe
  2⤵
  PID:6992
- C:\Windows\System\dEblAhF.exe
  C:\Windows\System\dEblAhF.exe
  2⤵
  PID:7104
- C:\Windows\System\XZckTdN.exe
  C:\Windows\System\XZckTdN.exe
  2⤵
  PID:5760
- C:\Windows\System\ZQTPkpB.exe
  C:\Windows\System\ZQTPkpB.exe
  2⤵
  PID:6400
- C:\Windows\System\EuAHrGf.exe
  C:\Windows\System\EuAHrGf.exe
  2⤵
  PID:5304
- C:\Windows\System\mTXFppA.exe
  C:\Windows\System\mTXFppA.exe
  2⤵
  PID:5792
- C:\Windows\System\cwiJYYB.exe
  C:\Windows\System\cwiJYYB.exe
  2⤵
  PID:6964
- C:\Windows\System\blrueBK.exe
  C:\Windows\System\blrueBK.exe
  2⤵
  PID:6912
- C:\Windows\System\LFQOBeV.exe
  C:\Windows\System\LFQOBeV.exe
  2⤵
  PID:6288
- C:\Windows\System\pbuoGsG.exe
  C:\Windows\System\pbuoGsG.exe
  2⤵
  PID:6848
- C:\Windows\System\oyChlvr.exe
  C:\Windows\System\oyChlvr.exe
  2⤵
  PID:6544
- C:\Windows\System\QxBNzyd.exe
  C:\Windows\System\QxBNzyd.exe
  2⤵
  PID:6896
- C:\Windows\System\shAtqhd.exe
  C:\Windows\System\shAtqhd.exe
  2⤵
  PID:5872
- C:\Windows\System\TnIbQZC.exe
  C:\Windows\System\TnIbQZC.exe
  2⤵
  PID:6608
- C:\Windows\System\lwOloZL.exe
  C:\Windows\System\lwOloZL.exe
  2⤵
  PID:7184
- C:\Windows\System\WOwOjDY.exe
  C:\Windows\System\WOwOjDY.exe
  2⤵
  PID:7200
- C:\Windows\System\BcMyAsw.exe
  C:\Windows\System\BcMyAsw.exe
  2⤵
  PID:7216
- C:\Windows\System\dDMdOFN.exe
  C:\Windows\System\dDMdOFN.exe
  2⤵
  PID:7232
- C:\Windows\System\PKDxgGf.exe
  C:\Windows\System\PKDxgGf.exe
  2⤵
  PID:7248
- C:\Windows\System\sIROsVm.exe
  C:\Windows\System\sIROsVm.exe
  2⤵
  PID:7264
- C:\Windows\System\iYeaSRK.exe
  C:\Windows\System\iYeaSRK.exe
  2⤵
  PID:7284
- C:\Windows\System\ceRpzBE.exe
  C:\Windows\System\ceRpzBE.exe
  2⤵
  PID:7304
- C:\Windows\System\oYmSyAh.exe
  C:\Windows\System\oYmSyAh.exe
  2⤵
  PID:7340
- C:\Windows\System\OgYLolJ.exe
  C:\Windows\System\OgYLolJ.exe
  2⤵
  PID:7356
- C:\Windows\System\gzTBuUb.exe
  C:\Windows\System\gzTBuUb.exe
  2⤵
  PID:7376
- C:\Windows\System\EZcEEgH.exe
  C:\Windows\System\EZcEEgH.exe
  2⤵
  PID:7392
- C:\Windows\System\SDliFOu.exe
  C:\Windows\System\SDliFOu.exe
  2⤵
  PID:7408
- C:\Windows\System\edvLAAo.exe
  C:\Windows\System\edvLAAo.exe
  2⤵
  PID:7424
- C:\Windows\System\ryPZiCa.exe
  C:\Windows\System\ryPZiCa.exe
  2⤵
  PID:7440
- C:\Windows\System\BrTRhnO.exe
  C:\Windows\System\BrTRhnO.exe
  2⤵
  PID:7456
- C:\Windows\System\OFzJtao.exe
  C:\Windows\System\OFzJtao.exe
  2⤵
  PID:7472
- C:\Windows\System\HebHJBZ.exe
  C:\Windows\System\HebHJBZ.exe
  2⤵
  PID:7492
- C:\Windows\System\DPshLfC.exe
  C:\Windows\System\DPshLfC.exe
  2⤵
  PID:7508
- C:\Windows\System\xkBLhqK.exe
  C:\Windows\System\xkBLhqK.exe
  2⤵
  PID:7524
- C:\Windows\System\divtCTR.exe
  C:\Windows\System\divtCTR.exe
  2⤵
  PID:7540
- C:\Windows\System\oEzmhgR.exe
  C:\Windows\System\oEzmhgR.exe
  2⤵
  PID:7556
- C:\Windows\System\GmUNRnG.exe
  C:\Windows\System\GmUNRnG.exe
  2⤵
  PID:7572
- C:\Windows\System\dCEOLID.exe
  C:\Windows\System\dCEOLID.exe
  2⤵
  PID:7588
- C:\Windows\System\fCODPoK.exe
  C:\Windows\System\fCODPoK.exe
  2⤵
  PID:7604
- C:\Windows\System\bdsOzpV.exe
  C:\Windows\System\bdsOzpV.exe
  2⤵
  PID:7620
- C:\Windows\System\iddOXzk.exe
  C:\Windows\System\iddOXzk.exe
  2⤵
  PID:7636
- C:\Windows\System\eyMYuYy.exe
  C:\Windows\System\eyMYuYy.exe
  2⤵
  PID:7652
- C:\Windows\System\VgTIFRv.exe
  C:\Windows\System\VgTIFRv.exe
  2⤵
  PID:7668
- C:\Windows\System\xgPQTUT.exe
  C:\Windows\System\xgPQTUT.exe
  2⤵
  PID:7684
- C:\Windows\System\lxcnRjH.exe
  C:\Windows\System\lxcnRjH.exe
  2⤵
  PID:7700
- C:\Windows\System\tQoOLJw.exe
  C:\Windows\System\tQoOLJw.exe
  2⤵
  PID:7716
- C:\Windows\System\eooclDj.exe
  C:\Windows\System\eooclDj.exe
  2⤵
  PID:7736
- C:\Windows\System\klLsefC.exe
  C:\Windows\System\klLsefC.exe
  2⤵
  PID:7752
- C:\Windows\System\eXFXVop.exe
  C:\Windows\System\eXFXVop.exe
  2⤵
  PID:7768
- C:\Windows\System\mmHloRx.exe
  C:\Windows\System\mmHloRx.exe
  2⤵
  PID:7784
- C:\Windows\System\UueYZly.exe
  C:\Windows\System\UueYZly.exe
  2⤵
  PID:7800
- C:\Windows\System\YlRcmTt.exe
  C:\Windows\System\YlRcmTt.exe
  2⤵
  PID:7816
- C:\Windows\System\yZgKEUy.exe
  C:\Windows\System\yZgKEUy.exe
  2⤵
  PID:7832
- C:\Windows\System\mYcsWge.exe
  C:\Windows\System\mYcsWge.exe
  2⤵
  PID:7848
- C:\Windows\System\swrtrBL.exe
  C:\Windows\System\swrtrBL.exe
  2⤵
  PID:7864
- C:\Windows\System\gpFOvaP.exe
  C:\Windows\System\gpFOvaP.exe
  2⤵
  PID:7880
- C:\Windows\System\molEhUv.exe
  C:\Windows\System\molEhUv.exe
  2⤵
  PID:7896
- C:\Windows\System\vXglnKI.exe
  C:\Windows\System\vXglnKI.exe
  2⤵
  PID:7912
- C:\Windows\System\McaqJcp.exe
  C:\Windows\System\McaqJcp.exe
  2⤵
  PID:7928
- C:\Windows\System\vEaAjTu.exe
  C:\Windows\System\vEaAjTu.exe
  2⤵
  PID:7944
- C:\Windows\System\aFMHsPy.exe
  C:\Windows\System\aFMHsPy.exe
  2⤵
  PID:7960
- C:\Windows\System\RykvfoZ.exe
  C:\Windows\System\RykvfoZ.exe
  2⤵
  PID:7976
- C:\Windows\System\fLeizJD.exe
  C:\Windows\System\fLeizJD.exe
  2⤵
  PID:7992
- C:\Windows\System\eeRsKbV.exe
  C:\Windows\System\eeRsKbV.exe
  2⤵
  PID:8008
- C:\Windows\System\hvQFzcl.exe
  C:\Windows\System\hvQFzcl.exe
  2⤵
  PID:8024
- C:\Windows\System\OxAcwLW.exe
  C:\Windows\System\OxAcwLW.exe
  2⤵
  PID:8040
- C:\Windows\System\QkGnCwP.exe
  C:\Windows\System\QkGnCwP.exe
  2⤵
  PID:8056
- C:\Windows\System\lRRPKxS.exe
  C:\Windows\System\lRRPKxS.exe
  2⤵
  PID:8072
- C:\Windows\System\ogXhBnH.exe
  C:\Windows\System\ogXhBnH.exe
  2⤵
  PID:8088
- C:\Windows\System\gGWlNDM.exe
  C:\Windows\System\gGWlNDM.exe
  2⤵
  PID:8104
- C:\Windows\System\YIGXEHe.exe
  C:\Windows\System\YIGXEHe.exe
  2⤵
  PID:8120
- C:\Windows\System\BxGlPEY.exe
  C:\Windows\System\BxGlPEY.exe
  2⤵
  PID:8136
- C:\Windows\System\SDbARwz.exe
  C:\Windows\System\SDbARwz.exe
  2⤵
  PID:8152
- C:\Windows\System\WgJdnsA.exe
  C:\Windows\System\WgJdnsA.exe
  2⤵
  PID:8172
- C:\Windows\System\CBNtdbe.exe
  C:\Windows\System\CBNtdbe.exe
  2⤵
  PID:8188
- C:\Windows\System\glJquyz.exe
  C:\Windows\System\glJquyz.exe
  2⤵
  PID:7180
- C:\Windows\System\wulUluv.exe
  C:\Windows\System\wulUluv.exe
  2⤵
  PID:7196
- C:\Windows\System\WXwLXzh.exe
  C:\Windows\System\WXwLXzh.exe
  2⤵
  PID:7224
- C:\Windows\System\wkEaFdJ.exe
  C:\Windows\System\wkEaFdJ.exe
  2⤵
  PID:7276
- C:\Windows\System\FTFlmwK.exe
  C:\Windows\System\FTFlmwK.exe
  2⤵
  PID:7312
- C:\Windows\System\UpnxeCN.exe
  C:\Windows\System\UpnxeCN.exe
  2⤵
  PID:7324
- C:\Windows\System\VPAaTnj.exe
  C:\Windows\System\VPAaTnj.exe
  2⤵
  PID:7364
- C:\Windows\System\xeGyakB.exe
  C:\Windows\System\xeGyakB.exe
  2⤵
  PID:7384
- C:\Windows\System\zvKlbRM.exe
  C:\Windows\System\zvKlbRM.exe
  2⤵
  PID:7404
- C:\Windows\System\UDTGBIz.exe
  C:\Windows\System\UDTGBIz.exe
  2⤵
  PID:7468
- C:\Windows\System\uzEqOUe.exe
  C:\Windows\System\uzEqOUe.exe
  2⤵
  PID:7488
- C:\Windows\System\MQaUQPk.exe
  C:\Windows\System\MQaUQPk.exe
  2⤵
  PID:7500
- C:\Windows\System\ysbJdVI.exe
  C:\Windows\System\ysbJdVI.exe
  2⤵
  PID:7564
- C:\Windows\System\EvbMdmU.exe
  C:\Windows\System\EvbMdmU.exe
  2⤵
  PID:7628
- C:\Windows\System\fltKtyl.exe
  C:\Windows\System\fltKtyl.exe
  2⤵
  PID:7520
- C:\Windows\System\yWKJGDx.exe
  C:\Windows\System\yWKJGDx.exe
  2⤵
  PID:7724
- C:\Windows\System\OIrguBh.exe
  C:\Windows\System\OIrguBh.exe
  2⤵
  PID:7760
- C:\Windows\System\BoFchYc.exe
  C:\Windows\System\BoFchYc.exe
  2⤵
  PID:7824
- C:\Windows\System\fwShcWg.exe
  C:\Windows\System\fwShcWg.exe
  2⤵
  PID:7584
- C:\Windows\System\aHGPtjW.exe
  C:\Windows\System\aHGPtjW.exe
  2⤵
  PID:7840
- C:\Windows\System\tQfKSEN.exe
  C:\Windows\System\tQfKSEN.exe
  2⤵
  PID:7780
- C:\Windows\System\iIbBTGR.exe
  C:\Windows\System\iIbBTGR.exe
  2⤵
  PID:7712
- C:\Windows\System\zBrkVVk.exe
  C:\Windows\System\zBrkVVk.exe
  2⤵
  PID:7872
- C:\Windows\System\ybRKcmQ.exe
  C:\Windows\System\ybRKcmQ.exe
  2⤵
  PID:7892
- C:\Windows\System\sYNVXOv.exe
  C:\Windows\System\sYNVXOv.exe
  2⤵
  PID:7920
- C:\Windows\System\gWNryDq.exe
  C:\Windows\System\gWNryDq.exe
  2⤵
  PID:7984
- C:\Windows\System\sxJdxoV.exe
  C:\Windows\System\sxJdxoV.exe
  2⤵
  PID:8048
- C:\Windows\System\wstWehj.exe
  C:\Windows\System\wstWehj.exe
  2⤵
  PID:8068
- C:\Windows\System\oEbCzgz.exe
  C:\Windows\System\oEbCzgz.exe
  2⤵
  PID:8000
- C:\Windows\System\wNblLym.exe
  C:\Windows\System\wNblLym.exe
  2⤵
  PID:7940
- C:\Windows\System\tNNZuCT.exe
  C:\Windows\System\tNNZuCT.exe
  2⤵
  PID:8116
- C:\Windows\System\EscTIQF.exe
  C:\Windows\System\EscTIQF.exe
  2⤵
  PID:8184
- C:\Windows\System\zyCeuvd.exe
  C:\Windows\System\zyCeuvd.exe
  2⤵
  PID:7192
- C:\Windows\System\FylhNEP.exe
  C:\Windows\System\FylhNEP.exe
  2⤵
  PID:7240
- C:\Windows\System\bTUIhUt.exe
  C:\Windows\System\bTUIhUt.exe
  2⤵
  PID:8160
- C:\Windows\System\yJrfPzW.exe
  C:\Windows\System\yJrfPzW.exe
  2⤵
  PID:7300
- C:\Windows\System\IuZuzJP.exe
  C:\Windows\System\IuZuzJP.exe
  2⤵
  PID:7352
- C:\Windows\System\zgSdBHI.exe
  C:\Windows\System\zgSdBHI.exe
  2⤵
  PID:7336
- C:\Windows\System\HxvwKzJ.exe
  C:\Windows\System\HxvwKzJ.exe
  2⤵
  PID:7484
- C:\Windows\System\BeVrnbk.exe
  C:\Windows\System\BeVrnbk.exe
  2⤵
  PID:7596
- C:\Windows\System\nxKxmoK.exe
  C:\Windows\System\nxKxmoK.exe
  2⤵
  PID:7532
- C:\Windows\System\rrEutOz.exe
  C:\Windows\System\rrEutOz.exe
  2⤵
  PID:7728
- C:\Windows\System\MVgHixq.exe
  C:\Windows\System\MVgHixq.exe
  2⤵
  PID:7796
- C:\Windows\System\xmWPZXG.exe
  C:\Windows\System\xmWPZXG.exe
  2⤵
  PID:7744
- C:\Windows\System\nQsRdey.exe
  C:\Windows\System\nQsRdey.exe
  2⤵
  PID:7644
- C:\Windows\System\JzgcQxs.exe
  C:\Windows\System\JzgcQxs.exe
  2⤵
  PID:7952
- C:\Windows\System\sMArLnW.exe
  C:\Windows\System\sMArLnW.exe
  2⤵
  PID:7936
- C:\Windows\System\NAxMXOD.exe
  C:\Windows\System\NAxMXOD.exe
  2⤵
  PID:8148
- C:\Windows\System\eNpFwjj.exe
  C:\Windows\System\eNpFwjj.exe
  2⤵
  PID:8032
- C:\Windows\System\gHThYSx.exe
  C:\Windows\System\gHThYSx.exe
  2⤵
  PID:8100
- C:\Windows\System\elzJOAT.exe
  C:\Windows\System\elzJOAT.exe
  2⤵
  PID:8168
- C:\Windows\System\vNJNMHO.exe
  C:\Windows\System\vNJNMHO.exe
  2⤵
  PID:7244
- C:\Windows\System\VdnvlfA.exe
  C:\Windows\System\VdnvlfA.exe
  2⤵
  PID:7452
- C:\Windows\System\pCFQQRb.exe
  C:\Windows\System\pCFQQRb.exe
  2⤵
  PID:7692
- C:\Windows\System\ABGniTd.exe
  C:\Windows\System\ABGniTd.exe
  2⤵
  PID:7792
- C:\Windows\System\IHElMHU.exe
  C:\Windows\System\IHElMHU.exe
  2⤵
  PID:7648
- C:\Windows\System\iFoZKUe.exe
  C:\Windows\System\iFoZKUe.exe
  2⤵
  PID:7808
- C:\Windows\System\cenEcWH.exe
  C:\Windows\System\cenEcWH.exe
  2⤵
  PID:7888
- C:\Windows\System\UiUblIh.exe
  C:\Windows\System\UiUblIh.exe
  2⤵
  PID:8128
- C:\Windows\System\PAjfKHW.exe
  C:\Windows\System\PAjfKHW.exe
  2⤵
  PID:7176
- C:\Windows\System\BbtKUTa.exe
  C:\Windows\System\BbtKUTa.exe
  2⤵
  PID:7828
- C:\Windows\System\HrhQNbt.exe
  C:\Windows\System\HrhQNbt.exe
  2⤵
  PID:8196
- C:\Windows\System\DFtrKkd.exe
  C:\Windows\System\DFtrKkd.exe
  2⤵
  PID:8212
- C:\Windows\System\PVYvKfn.exe
  C:\Windows\System\PVYvKfn.exe
  2⤵
  PID:8228
- C:\Windows\System\xFawXsh.exe
  C:\Windows\System\xFawXsh.exe
  2⤵
  PID:8244
- C:\Windows\System\lDkHCZw.exe
  C:\Windows\System\lDkHCZw.exe
  2⤵
  PID:8260
- C:\Windows\System\sMUWtqu.exe
  C:\Windows\System\sMUWtqu.exe
  2⤵
  PID:8276
- C:\Windows\System\rRuoUKy.exe
  C:\Windows\System\rRuoUKy.exe
  2⤵
  PID:8292
- C:\Windows\System\aONfZod.exe
  C:\Windows\System\aONfZod.exe
  2⤵
  PID:8308
- C:\Windows\System\qTqbsKH.exe
  C:\Windows\System\qTqbsKH.exe
  2⤵
  PID:8324
- C:\Windows\System\SOVHGuY.exe
  C:\Windows\System\SOVHGuY.exe
  2⤵
  PID:8340
- C:\Windows\System\JExqEKE.exe
  C:\Windows\System\JExqEKE.exe
  2⤵
  PID:8356
- C:\Windows\System\nSAswbq.exe
  C:\Windows\System\nSAswbq.exe
  2⤵
  PID:8372
- C:\Windows\System\yLBStGv.exe
  C:\Windows\System\yLBStGv.exe
  2⤵
  PID:8388
- C:\Windows\System\SwnRszV.exe
  C:\Windows\System\SwnRszV.exe
  2⤵
  PID:8404
- C:\Windows\System\rovrpEn.exe
  C:\Windows\System\rovrpEn.exe
  2⤵
  PID:8420
- C:\Windows\System\UKMiLFc.exe
  C:\Windows\System\UKMiLFc.exe
  2⤵
  PID:8436
- C:\Windows\System\NVuVJjJ.exe
  C:\Windows\System\NVuVJjJ.exe
  2⤵
  PID:8452
- C:\Windows\System\mMjRRpX.exe
  C:\Windows\System\mMjRRpX.exe
  2⤵
  PID:8468
- C:\Windows\System\EezaqHW.exe
  C:\Windows\System\EezaqHW.exe
  2⤵
  PID:8484
- C:\Windows\System\XkAZBHl.exe
  C:\Windows\System\XkAZBHl.exe
  2⤵
  PID:8500
- C:\Windows\System\GFhcKER.exe
  C:\Windows\System\GFhcKER.exe
  2⤵
  PID:8516
- C:\Windows\System\zlFHUFK.exe
  C:\Windows\System\zlFHUFK.exe
  2⤵
  PID:8532
- C:\Windows\System\vIbRQWf.exe
  C:\Windows\System\vIbRQWf.exe
  2⤵
  PID:8548
- C:\Windows\System\CYrBXae.exe
  C:\Windows\System\CYrBXae.exe
  2⤵
  PID:8564
- C:\Windows\System\LwSMLBl.exe
  C:\Windows\System\LwSMLBl.exe
  2⤵
  PID:8580
- C:\Windows\System\VxJBMyy.exe
  C:\Windows\System\VxJBMyy.exe
  2⤵
  PID:8600
- C:\Windows\System\ZVKdTdV.exe
  C:\Windows\System\ZVKdTdV.exe
  2⤵
  PID:8620
- C:\Windows\System\ZYxNIVV.exe
  C:\Windows\System\ZYxNIVV.exe
  2⤵
  PID:8636
- C:\Windows\System\nhUHthh.exe
  C:\Windows\System\nhUHthh.exe
  2⤵
  PID:8652
- C:\Windows\System\ZuxTkic.exe
  C:\Windows\System\ZuxTkic.exe
  2⤵
  PID:8668
- C:\Windows\System\qaweTkr.exe
  C:\Windows\System\qaweTkr.exe
  2⤵
  PID:8684
- C:\Windows\System\fohcwHW.exe
  C:\Windows\System\fohcwHW.exe
  2⤵
  PID:8700
- C:\Windows\System\AwJaLrN.exe
  C:\Windows\System\AwJaLrN.exe
  2⤵
  PID:8716
- C:\Windows\System\FsIPsGE.exe
  C:\Windows\System\FsIPsGE.exe
  2⤵
  PID:8732
- C:\Windows\System\OhoZvJQ.exe
  C:\Windows\System\OhoZvJQ.exe
  2⤵
  PID:8748
- C:\Windows\System\afOQuMq.exe
  C:\Windows\System\afOQuMq.exe
  2⤵
  PID:8764
- C:\Windows\System\GCMDQcd.exe
  C:\Windows\System\GCMDQcd.exe
  2⤵
  PID:8780
- C:\Windows\System\MfDRomy.exe
  C:\Windows\System\MfDRomy.exe
  2⤵
  PID:8796
- C:\Windows\System\hpObwJl.exe
  C:\Windows\System\hpObwJl.exe
  2⤵
  PID:8812
- C:\Windows\System\aCfTgTE.exe
  C:\Windows\System\aCfTgTE.exe
  2⤵
  PID:8828
- C:\Windows\System\dXnXtdR.exe
  C:\Windows\System\dXnXtdR.exe
  2⤵
  PID:8844
- C:\Windows\System\TUdvzPo.exe
  C:\Windows\System\TUdvzPo.exe
  2⤵
  PID:8860
- C:\Windows\System\ISqcQhU.exe
  C:\Windows\System\ISqcQhU.exe
  2⤵
  PID:8876
- C:\Windows\System\fIlTgWJ.exe
  C:\Windows\System\fIlTgWJ.exe
  2⤵
  PID:8892
- C:\Windows\System\PocuUTH.exe
  C:\Windows\System\PocuUTH.exe
  2⤵
  PID:8908
- C:\Windows\System\tQUmKOs.exe
  C:\Windows\System\tQUmKOs.exe
  2⤵
  PID:8924
- C:\Windows\System\DTmeNCQ.exe
  C:\Windows\System\DTmeNCQ.exe
  2⤵
  PID:8940
- C:\Windows\System\VNVTriz.exe
  C:\Windows\System\VNVTriz.exe
  2⤵
  PID:8956
- C:\Windows\System\xsznjiK.exe
  C:\Windows\System\xsznjiK.exe
  2⤵
  PID:8972
- C:\Windows\System\yhsuCpL.exe
  C:\Windows\System\yhsuCpL.exe
  2⤵
  PID:8988
- C:\Windows\System\REnMiMi.exe
  C:\Windows\System\REnMiMi.exe
  2⤵
  PID:9004
- C:\Windows\System\ZrBCncD.exe
  C:\Windows\System\ZrBCncD.exe
  2⤵
  PID:9020
- C:\Windows\System\NwDzurD.exe
  C:\Windows\System\NwDzurD.exe
  2⤵
  PID:9036
- C:\Windows\System\VldZGid.exe
  C:\Windows\System\VldZGid.exe
  2⤵
  PID:9052
- C:\Windows\System\IaKNguN.exe
  C:\Windows\System\IaKNguN.exe
  2⤵
  PID:9068
- C:\Windows\System\nCUEZjQ.exe
  C:\Windows\System\nCUEZjQ.exe
  2⤵
  PID:9084
- C:\Windows\System\XGtvSdu.exe
  C:\Windows\System\XGtvSdu.exe
  2⤵
  PID:9100
- C:\Windows\System\CtpHCBY.exe
  C:\Windows\System\CtpHCBY.exe
  2⤵
  PID:9116
- C:\Windows\System\hoYunZV.exe
  C:\Windows\System\hoYunZV.exe
  2⤵
  PID:9136
- C:\Windows\System\WtMLfAx.exe
  C:\Windows\System\WtMLfAx.exe
  2⤵
  PID:9152
- C:\Windows\System\Jvsjubx.exe
  C:\Windows\System\Jvsjubx.exe
  2⤵
  PID:9168
- C:\Windows\System\LkSIpEm.exe
  C:\Windows\System\LkSIpEm.exe
  2⤵
  PID:9184
- C:\Windows\System\XXxvSFt.exe
  C:\Windows\System\XXxvSFt.exe
  2⤵
  PID:9200
- C:\Windows\System\HijRRCG.exe
  C:\Windows\System\HijRRCG.exe
  2⤵
  PID:7260
- C:\Windows\System\CcyXVoU.exe
  C:\Windows\System\CcyXVoU.exe
  2⤵
  PID:8208
- C:\Windows\System\dumJPvl.exe
  C:\Windows\System\dumJPvl.exe
  2⤵
  PID:7812
- C:\Windows\System\GkmwTLs.exe
  C:\Windows\System\GkmwTLs.exe
  2⤵
  PID:8020
- C:\Windows\System\eYIPOIu.exe
  C:\Windows\System\eYIPOIu.exe
  2⤵
  PID:8224
- C:\Windows\System\prXQqVY.exe
  C:\Windows\System\prXQqVY.exe
  2⤵
  PID:8284
- C:\Windows\System\rPiQobh.exe
  C:\Windows\System\rPiQobh.exe
  2⤵
  PID:8448
- C:\Windows\System\bRuGuUv.exe
  C:\Windows\System\bRuGuUv.exe
  2⤵
  PID:8300
- C:\Windows\System\tuYnksJ.exe
  C:\Windows\System\tuYnksJ.exe
  2⤵
  PID:8464
- C:\Windows\System\VGYYqXK.exe
  C:\Windows\System\VGYYqXK.exe
  2⤵
  PID:8364
- C:\Windows\System\jhkFETp.exe
  C:\Windows\System\jhkFETp.exe
  2⤵
  PID:8480
- C:\Windows\System\YISwdbV.exe
  C:\Windows\System\YISwdbV.exe
  2⤵
  PID:8576
- C:\Windows\System\ilnhvyb.exe
  C:\Windows\System\ilnhvyb.exe
  2⤵
  PID:8648
- C:\Windows\System\xyZSjRW.exe
  C:\Windows\System\xyZSjRW.exe
  2⤵
  PID:8556
- C:\Windows\System\oUUqOBd.exe
  C:\Windows\System\oUUqOBd.exe
  2⤵
  PID:8628
- C:\Windows\System\jfiqsGt.exe
  C:\Windows\System\jfiqsGt.exe
  2⤵
  PID:8680
- C:\Windows\System\RBpRtxd.exe
  C:\Windows\System\RBpRtxd.exe
  2⤵
  PID:8708
- C:\Windows\System\ZkMecHE.exe
  C:\Windows\System\ZkMecHE.exe
  2⤵
  PID:8772
- C:\Windows\System\qPDceGU.exe
  C:\Windows\System\qPDceGU.exe
  2⤵
  PID:8804
- C:\Windows\System\wkWiLeU.exe
  C:\Windows\System\wkWiLeU.exe
  2⤵
  PID:8868
- C:\Windows\System\wrnrffV.exe
  C:\Windows\System\wrnrffV.exe
  2⤵
  PID:8936
- C:\Windows\System\MvKxRaZ.exe
  C:\Windows\System\MvKxRaZ.exe
  2⤵
  PID:8756
- C:\Windows\System\lVyNPUl.exe
  C:\Windows\System\lVyNPUl.exe
  2⤵
  PID:8888
- C:\Windows\System\fBwjJWn.exe
  C:\Windows\System\fBwjJWn.exe
  2⤵
  PID:8920
- C:\Windows\System\odaVBrZ.exe
  C:\Windows\System\odaVBrZ.exe
  2⤵
  PID:8824
- C:\Windows\System\OlDJfrb.exe
  C:\Windows\System\OlDJfrb.exe
  2⤵
  PID:8948
- C:\Windows\System\XlpLVIm.exe
  C:\Windows\System\XlpLVIm.exe
  2⤵
  PID:8980
- C:\Windows\System\eZunNXv.exe
  C:\Windows\System\eZunNXv.exe
  2⤵
  PID:9096
- C:\Windows\System\KkxxPaR.exe
  C:\Windows\System\KkxxPaR.exe
  2⤵
  PID:9076
- C:\Windows\System\Bgrmmgr.exe
  C:\Windows\System\Bgrmmgr.exe
  2⤵
  PID:9128
- C:\Windows\System\xdYzyVQ.exe
  C:\Windows\System\xdYzyVQ.exe
  2⤵
  PID:9148
- C:\Windows\System\MnxOydl.exe
  C:\Windows\System\MnxOydl.exe
  2⤵
  PID:7956
- C:\Windows\System\wGbtZFP.exe
  C:\Windows\System\wGbtZFP.exe
  2⤵
  PID:7612
- C:\Windows\System\ivKqzlJ.exe
  C:\Windows\System\ivKqzlJ.exe
  2⤵
  PID:8252
- C:\Windows\System\EPLpIHD.exe
  C:\Windows\System\EPLpIHD.exe
  2⤵
  PID:8316
- C:\Windows\System\CkspKjU.exe
  C:\Windows\System\CkspKjU.exe
  2⤵
  PID:8384
- C:\Windows\System\NoqoArv.exe
  C:\Windows\System\NoqoArv.exe
  2⤵
  PID:8444
- C:\Windows\System\LicqMtj.exe
  C:\Windows\System\LicqMtj.exe
  2⤵
  PID:8512
- C:\Windows\System\WdFHSrF.exe
  C:\Windows\System\WdFHSrF.exe
  2⤵
  PID:8428
- C:\Windows\System\xdvAOMb.exe
  C:\Windows\System\xdvAOMb.exe
  2⤵
  PID:8572
- C:\Windows\System\KzEqWxn.exe
  C:\Windows\System\KzEqWxn.exe
  2⤵
  PID:8660
- C:\Windows\System\Cvibhjv.exe
  C:\Windows\System\Cvibhjv.exe
  2⤵
  PID:8724
- C:\Windows\System\YrMcpBK.exe
  C:\Windows\System\YrMcpBK.exe
  2⤵
  PID:8932
- C:\Windows\System\RRHjGOh.exe
  C:\Windows\System\RRHjGOh.exe
  2⤵
  PID:9044
- C:\Windows\System\CqxtJjf.exe
  C:\Windows\System\CqxtJjf.exe
  2⤵
  PID:8856
- C:\Windows\System\cdSDitG.exe
  C:\Windows\System\cdSDitG.exe
  2⤵
  PID:9080
- C:\Windows\System\IUHDjCO.exe
  C:\Windows\System\IUHDjCO.exe
  2⤵
  PID:9180
- C:\Windows\System\tMLujHq.exe
  C:\Windows\System\tMLujHq.exe
  2⤵
  PID:9164
- C:\Windows\System\hLZXVZh.exe
  C:\Windows\System\hLZXVZh.exe
  2⤵
  PID:7972
- C:\Windows\System\cOMpTCt.exe
  C:\Windows\System\cOMpTCt.exe
  2⤵
  PID:8272
- C:\Windows\System\rZGmusM.exe
  C:\Windows\System\rZGmusM.exe
  2⤵
  PID:8416
- C:\Windows\System\yXMLJVP.exe
  C:\Windows\System\yXMLJVP.exe
  2⤵
  PID:8540
- C:\Windows\System\UPycrPq.exe
  C:\Windows\System\UPycrPq.exe
  2⤵
  PID:8612
- C:\Windows\System\LtIemRh.exe
  C:\Windows\System\LtIemRh.exe
  2⤵
  PID:8740
- C:\Windows\System\ijeHppl.exe
  C:\Windows\System\ijeHppl.exe
  2⤵
  PID:8676
- C:\Windows\System\ALYGunX.exe
  C:\Windows\System\ALYGunX.exe
  2⤵
  PID:8900
- C:\Windows\System\HQZcQTt.exe
  C:\Windows\System\HQZcQTt.exe
  2⤵
  PID:8996
- C:\Windows\System\wgAnNly.exe
  C:\Windows\System\wgAnNly.exe
  2⤵
  PID:9064
- C:\Windows\System\IdFfUge.exe
  C:\Windows\System\IdFfUge.exe
  2⤵
  PID:8036
- C:\Windows\System\JzQNuvv.exe
  C:\Windows\System\JzQNuvv.exe
  2⤵
  PID:8380
- C:\Windows\System\nJlBDmH.exe
  C:\Windows\System\nJlBDmH.exe
  2⤵
  PID:9192
- C:\Windows\System\hAqYOlv.exe
  C:\Windows\System\hAqYOlv.exe
  2⤵
  PID:8696
- C:\Windows\System\UouYyYl.exe
  C:\Windows\System\UouYyYl.exe
  2⤵
  PID:8728
- C:\Windows\System\TecsEQg.exe
  C:\Windows\System\TecsEQg.exe
  2⤵
  PID:8820
- C:\Windows\System\zKsjKgP.exe
  C:\Windows\System\zKsjKgP.exe
  2⤵
  PID:9144
- C:\Windows\System\PqDYlOV.exe
  C:\Windows\System\PqDYlOV.exe
  2⤵
  PID:8588
- C:\Windows\System\LfokyPM.exe
  C:\Windows\System\LfokyPM.exe
  2⤵
  PID:8840
- C:\Windows\System\HALEEeD.exe
  C:\Windows\System\HALEEeD.exe
  2⤵
  PID:8256
- C:\Windows\System\vCgisxt.exe
  C:\Windows\System\vCgisxt.exe
  2⤵
  PID:9232
- C:\Windows\System\inkhLzb.exe
  C:\Windows\System\inkhLzb.exe
  2⤵
  PID:9252
- C:\Windows\System\ZoEsnFU.exe
  C:\Windows\System\ZoEsnFU.exe
  2⤵
  PID:9268
- C:\Windows\System\iRgtBNq.exe
  C:\Windows\System\iRgtBNq.exe
  2⤵
  PID:9284
- C:\Windows\System\OUmlEHn.exe
  C:\Windows\System\OUmlEHn.exe
  2⤵
  PID:9300
- C:\Windows\System\jTRcIXf.exe
  C:\Windows\System\jTRcIXf.exe
  2⤵
  PID:9316
- C:\Windows\System\oIXwUeF.exe
  C:\Windows\System\oIXwUeF.exe
  2⤵
  PID:9332
- C:\Windows\System\MpGBnMy.exe
  C:\Windows\System\MpGBnMy.exe
  2⤵
  PID:9348
- C:\Windows\System\acXNlIX.exe
  C:\Windows\System\acXNlIX.exe
  2⤵
  PID:9364
- C:\Windows\System\bdRsIWx.exe
  C:\Windows\System\bdRsIWx.exe
  2⤵
  PID:9380
- C:\Windows\System\kdsnFEW.exe
  C:\Windows\System\kdsnFEW.exe
  2⤵
  PID:9396
- C:\Windows\System\nylSdCr.exe
  C:\Windows\System\nylSdCr.exe
  2⤵
  PID:9412
- C:\Windows\System\AbdDnIP.exe
  C:\Windows\System\AbdDnIP.exe
  2⤵
  PID:9428
- C:\Windows\System\bqNBbog.exe
  C:\Windows\System\bqNBbog.exe
  2⤵
  PID:9444
- C:\Windows\System\uBnsmsI.exe
  C:\Windows\System\uBnsmsI.exe
  2⤵
  PID:9464
- C:\Windows\System\eDtswxz.exe
  C:\Windows\System\eDtswxz.exe
  2⤵
  PID:9480
- C:\Windows\System\VNeWPxj.exe
  C:\Windows\System\VNeWPxj.exe
  2⤵
  PID:9496
- C:\Windows\System\yQzWOtY.exe
  C:\Windows\System\yQzWOtY.exe
  2⤵
  PID:9512
- C:\Windows\System\tOXdzWS.exe
  C:\Windows\System\tOXdzWS.exe
  2⤵
  PID:9528
- C:\Windows\System\kyGCcvT.exe
  C:\Windows\System\kyGCcvT.exe
  2⤵
  PID:9544
- C:\Windows\System\ddolKdA.exe
  C:\Windows\System\ddolKdA.exe
  2⤵
  PID:9564
- C:\Windows\System\LnIFXly.exe
  C:\Windows\System\LnIFXly.exe
  2⤵
  PID:9584
- C:\Windows\System\tFimlwp.exe
  C:\Windows\System\tFimlwp.exe
  2⤵
  PID:9600
- C:\Windows\System\kDtkcRt.exe
  C:\Windows\System\kDtkcRt.exe
  2⤵
  PID:9616
- C:\Windows\System\aHTSEgV.exe
  C:\Windows\System\aHTSEgV.exe
  2⤵
  PID:9632
- C:\Windows\System\ULAThRJ.exe
  C:\Windows\System\ULAThRJ.exe
  2⤵
  PID:9648
- C:\Windows\System\vqKqRrZ.exe
  C:\Windows\System\vqKqRrZ.exe
  2⤵
  PID:9664
- C:\Windows\System\hILHEfH.exe
  C:\Windows\System\hILHEfH.exe
  2⤵
  PID:9684
- C:\Windows\System\MSIQqbQ.exe
  C:\Windows\System\MSIQqbQ.exe
  2⤵
  PID:9704
- C:\Windows\System\WdOpkGq.exe
  C:\Windows\System\WdOpkGq.exe
  2⤵
  PID:9720
- C:\Windows\System\wxoEqSC.exe
  C:\Windows\System\wxoEqSC.exe
  2⤵
  PID:9736
- C:\Windows\System\sRyspMV.exe
  C:\Windows\System\sRyspMV.exe
  2⤵
  PID:9752
- C:\Windows\System\kcgvFzu.exe
  C:\Windows\System\kcgvFzu.exe
  2⤵
  PID:9768
- C:\Windows\System\UGVFLLE.exe
  C:\Windows\System\UGVFLLE.exe
  2⤵
  PID:9784
- C:\Windows\System\PonFdEd.exe
  C:\Windows\System\PonFdEd.exe
  2⤵
  PID:9800
- C:\Windows\System\EFZdyKs.exe
  C:\Windows\System\EFZdyKs.exe
  2⤵
  PID:9816
- C:\Windows\System\dBjovWb.exe
  C:\Windows\System\dBjovWb.exe
  2⤵
  PID:9832
- C:\Windows\System\pFhWalC.exe
  C:\Windows\System\pFhWalC.exe
  2⤵
  PID:9848
- C:\Windows\System\lyhdeJQ.exe
  C:\Windows\System\lyhdeJQ.exe
  2⤵
  PID:9864
- C:\Windows\System\FJfdEzb.exe
  C:\Windows\System\FJfdEzb.exe
  2⤵
  PID:9880
- C:\Windows\System\eNGYLhJ.exe
  C:\Windows\System\eNGYLhJ.exe
  2⤵
  PID:9896
- C:\Windows\System\ExlZasU.exe
  C:\Windows\System\ExlZasU.exe
  2⤵
  PID:9916
- C:\Windows\System\qCNGTKq.exe
  C:\Windows\System\qCNGTKq.exe
  2⤵
  PID:9968
- C:\Windows\System\bNNiiuP.exe
  C:\Windows\System\bNNiiuP.exe
  2⤵
  PID:10052
- C:\Windows\System\rLRufQP.exe
  C:\Windows\System\rLRufQP.exe
  2⤵
  PID:10068
- C:\Windows\System\taNlWnt.exe
  C:\Windows\System\taNlWnt.exe
  2⤵
  PID:10084
- C:\Windows\System\RtVmFeP.exe
  C:\Windows\System\RtVmFeP.exe
  2⤵
  PID:10108
- C:\Windows\System\xbcFNWU.exe
  C:\Windows\System\xbcFNWU.exe
  2⤵
  PID:10124
- C:\Windows\System\XUAneLA.exe
  C:\Windows\System\XUAneLA.exe
  2⤵
  PID:10140
- C:\Windows\System\pabNAJe.exe
  C:\Windows\System\pabNAJe.exe
  2⤵
  PID:10156
- C:\Windows\System\ZHiVBPq.exe
  C:\Windows\System\ZHiVBPq.exe
  2⤵
  PID:10172
- C:\Windows\System\hzboWeX.exe
  C:\Windows\System\hzboWeX.exe
  2⤵
  PID:10188
- C:\Windows\System\MgYXDSP.exe
  C:\Windows\System\MgYXDSP.exe
  2⤵
  PID:10204
- C:\Windows\System\GbnPDhr.exe
  C:\Windows\System\GbnPDhr.exe
  2⤵
  PID:10220
- C:\Windows\System\SUrAUJr.exe
  C:\Windows\System\SUrAUJr.exe
  2⤵
  PID:10236
- C:\Windows\System\PYbvxRa.exe
  C:\Windows\System\PYbvxRa.exe
  2⤵
  PID:9132
- C:\Windows\System\cMrkFBI.exe
  C:\Windows\System\cMrkFBI.exe
  2⤵
  PID:9248
- C:\Windows\System\iMRoxxA.exe
  C:\Windows\System\iMRoxxA.exe
  2⤵
  PID:9280
- C:\Windows\System\eBeSaMp.exe
  C:\Windows\System\eBeSaMp.exe
  2⤵
  PID:9340
- C:\Windows\System\ztZphth.exe
  C:\Windows\System\ztZphth.exe
  2⤵
  PID:9296
- C:\Windows\System\ZxxoLGV.exe
  C:\Windows\System\ZxxoLGV.exe
  2⤵
  PID:9404
- C:\Windows\System\HTqIOOr.exe
  C:\Windows\System\HTqIOOr.exe
  2⤵
  PID:9888
- C:\Windows\System\ULXDfpu.exe
  C:\Windows\System\ULXDfpu.exe
  2⤵
  PID:10080
- C:\Windows\System\yZbfhxv.exe
  C:\Windows\System\yZbfhxv.exe
  2⤵
  PID:10092
- C:\Windows\System\IpoOboY.exe
  C:\Windows\System\IpoOboY.exe
  2⤵
  PID:10104
- C:\Windows\System\bvVyLee.exe
  C:\Windows\System\bvVyLee.exe
  2⤵
  PID:10152
- C:\Windows\System\JmZXxCk.exe
  C:\Windows\System\JmZXxCk.exe
  2⤵
  PID:10184
- C:\Windows\System\mguxebl.exe
  C:\Windows\System\mguxebl.exe
  2⤵
  PID:10216
- C:\Windows\System\VbXvzeh.exe
  C:\Windows\System\VbXvzeh.exe
  2⤵
  PID:8968
- C:\Windows\System\jiFKiOI.exe
  C:\Windows\System\jiFKiOI.exe
  2⤵
  PID:9276
- C:\Windows\System\ZKgzFGE.exe
  C:\Windows\System\ZKgzFGE.exe
  2⤵
  PID:9324
- C:\Windows\System\zEGAVll.exe
  C:\Windows\System\zEGAVll.exe
  2⤵
  PID:9376
- C:\Windows\System\mmkTwSO.exe
  C:\Windows\System\mmkTwSO.exe
  2⤵
  PID:9408
- C:\Windows\System\mvzqjcS.exe
  C:\Windows\System\mvzqjcS.exe
  2⤵
  PID:9440
- C:\Windows\System\SXwabNk.exe
  C:\Windows\System\SXwabNk.exe
  2⤵
  PID:9508
- C:\Windows\System\rNGKMTb.exe
  C:\Windows\System\rNGKMTb.exe
  2⤵
  PID:9460
- C:\Windows\System\FlQLOeC.exe
  C:\Windows\System\FlQLOeC.exe
  2⤵
  PID:9492
- C:\Windows\System\PYZffPt.exe
  C:\Windows\System\PYZffPt.exe
  2⤵
  PID:9576
- C:\Windows\System\GXNNoZj.exe
  C:\Windows\System\GXNNoZj.exe
  2⤵
  PID:9592
- C:\Windows\System\PETtqYH.exe
  C:\Windows\System\PETtqYH.exe
  2⤵
  PID:9640
- C:\Windows\System\qbfpBUt.exe
  C:\Windows\System\qbfpBUt.exe
  2⤵
  PID:9692
- C:\Windows\System\AgqYRya.exe
  C:\Windows\System\AgqYRya.exe
  2⤵
  PID:9696
- C:\Windows\System\TUuLHYX.exe
  C:\Windows\System\TUuLHYX.exe
  2⤵
  PID:9728
- C:\Windows\System\AymWFTB.exe
  C:\Windows\System\AymWFTB.exe
  2⤵
  PID:9776
- C:\Windows\System\AptnAWp.exe
  C:\Windows\System\AptnAWp.exe
  2⤵
  PID:9760
- C:\Windows\System\DTIwjWG.exe
  C:\Windows\System\DTIwjWG.exe
  2⤵
  PID:9828
- C:\Windows\System\nEgSyCY.exe
  C:\Windows\System\nEgSyCY.exe
  2⤵
  PID:9872
- C:\Windows\System\RCkLDfJ.exe
  C:\Windows\System\RCkLDfJ.exe
  2⤵
  PID:9928
- C:\Windows\System\vGBArNE.exe
  C:\Windows\System\vGBArNE.exe
  2⤵
  PID:9944
- C:\Windows\System\zpuYiER.exe
  C:\Windows\System\zpuYiER.exe
  2⤵
  PID:9960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CSBGknc.exe

Filesize
1.4MB

MD5
b72f7b8a7f516416c904b225c0882c3a

SHA1
dbc2e6cf01be78d658a39d1f85532b43e247e816

SHA256
61bca81a74e7f9b2bc3d00d0f13fd9bfe21b5034a47de442daabb9cf789dd5b3

SHA512
f7b868d4a0c8af3493cbef67ea6adbd722fba405d5c99e06f17a9f4fdb05645ed55e5ab0ce413eec45346480dc5a6845973c422df3503fa06b63ba7a7d7e88f1

Download Submit
C:\Windows\system\DiXRCeo.exe

Filesize
1.4MB

MD5
1ad03e658e7297d0da1f9507c99ab5e2

SHA1
8d8b8247b015d4d50fc3503aa777136f60d39d81

SHA256
a8bfbfac4feeaae667c9b7c035cbbe39b13ccea9353da324b4fcf4563615d7ea

SHA512
8a205e8039bf55a36623087747384b33cb2387f2f92ba9b3c17fefacb2e4113f0a3d695f35589df572293225b4e638ee2c52b86b0815d7ba3c42f10fedc5a844

Download Submit
C:\Windows\system\EQLxJLC.exe

Filesize
1.4MB

MD5
c6e4ab33883b356328966e9ce05db96a

SHA1
ba9c3cc0e733c4992ee1ac64950ec49ecb4fb05d

SHA256
239a25345a7a0416101a53bfd366ce0d780971e9d8c537ab69c2455340f5bc1b

SHA512
9b74792ac1494b6d9c0206e715d04738bf5f395a5590e39e6602f5da55aa1638e7b18fd4322a33a5c10178719d8a00d9b8681f5d01db8cc49ef17276dc52072b

Download Submit
C:\Windows\system\HbBDLvs.exe

Filesize
1.4MB

MD5
9a076ba8824cf5edc3bf597cbc217283

SHA1
42c4387d23a527e844aeb2416f34266ddb03127e

SHA256
d9604c141fd581344285a013e6da677c786bb53548a6d06f4689e2c239ca251f

SHA512
1bf00f947cb26658669a2753c6d2a90451000f7b8ba0c11164f70ff636dad4dabca8ac92f79a9c032372c9b3860535e905d0716908695b300d8940a2aa9ed409

Download Submit
C:\Windows\system\IjaWJkh.exe

Filesize
1.4MB

MD5
4a70d46004a6586735abf44e193ea1e2

SHA1
1203f71bc82e4920d685ec456f82b07788b4da51

SHA256
6500d826858c274f3ecbeb1f6bfc5f4d242295fa8386beae7452c7c419fe963f

SHA512
f377e889f749fa55c1a676dc18aca09212c86cfe6ffc98cbfa6fcf2599b628701e66d7c02254f82405cb5967a11e6beae66e85db02c971f0f465ff7387f77004

Download Submit
C:\Windows\system\QZZWERY.exe

Filesize
1.4MB

MD5
888b3e0efad7b9af543995c4fb09dc10

SHA1
80c04346689bb15d0bb119c0e19a09bb724056fa

SHA256
4a287399fd09554c59e96049fab7332d972579d8b1e0f5481d3ac6c8543ad8d6

SHA512
fc7e86e9ab69f0bc2c53417ffd5c84d239448195fcbae21d9e19f325c3419471e2ced0f0d109c7e657e0da4684529139de5ac019766eb96f8d2d9448254d8a4d

Download Submit
C:\Windows\system\QxGDDLQ.exe

Filesize
1.4MB

MD5
5f1b5d47bdc77de9bbc6264585681ceb

SHA1
f46686eeca2c04a07724e6927da3835fff23b35d

SHA256
c3958fb38be52a3e4292ee18cae4a62f2398062cff893a32b2189bb4bbc2c996

SHA512
27d80e633e64a37126bc2412c7f5c6a1602ca95beaf66c8aed7475d9080c24cba718d058600ef853987afb5e416ee38425c178f42392f8b2560761736eac708f

Download Submit
C:\Windows\system\TawwncY.exe

Filesize
1.4MB

MD5
4a9546d590656dfa940f6e24e88868c6

SHA1
c1951bf8422f8eb470422505aca529be3234be88

SHA256
47c5a3a4cb9179c1d6230086cf0b9a718329030a3d5ad31146588962aa6c393a

SHA512
754c9b91f8a178db3ce62e05dd4681592c403a0ecb00249fe079ef52ab424af81a7344efd5c3e01756c9d5323fc8bd56b918301f17aa0d1bb36755a3fe5c3ec9

Download Submit
C:\Windows\system\XOPyCyt.exe

Filesize
1.4MB

MD5
e478dbed4649b3e99db3e4b629ee0549

SHA1
9bf8b6ee06c4b21bbb82abb9bdf20d3a3d2ac28f

SHA256
307b4014d353fd9c4fd02e4ff78e200c663f72ac594490104f0ebe28c1603479

SHA512
23d151224e105d6387cad4294a577a75f50318fc7e98ac1010d921dc48b964f5204fc18fab5e52b9b929591fb828f1a8532fee8d9e6f96bd9315bc67ac7ff903

Download Submit
C:\Windows\system\XiyofvN.exe

Filesize
1.4MB

MD5
58ffe335aa0d8ec57b0c68663f83349a

SHA1
ee5636913220fb6a5de2ff47601e7c46cfa49cc6

SHA256
ea87b69eeb8c573d0a9d61b3efe3c60929eb6451fc9b674022311ffd991925e2

SHA512
210824fb82c4f0f2c02e7cf3c1f1d5fd17af2dc130242c1febfa05f304baaf2007acbf1701aeaafa733b1dc2eb6091198efd866f10069dcfd520d4a062b997f4

Download Submit
C:\Windows\system\auVQkhg.exe

Filesize
1.4MB

MD5
0e1085105327d485bd119764fd694e9b

SHA1
3640e1166069b7d5a85dd5ff94801812c804d8e7

SHA256
00492c46bd21d0a24107c70c1168624e2b7fcc8f52a722aaab62722bf7290e77

SHA512
e63c196c462bab97d8cfea998e7d09bc62e70333d63f6c8217a2ceefa09c8441e9c4b3f3bbd2f07a02b70f22e2f6b808b244359a7bebc84433e91cdf5bbe6170

Download Submit
C:\Windows\system\bZInFfl.exe

Filesize
1.4MB

MD5
a7d1b32bea75cf28c46b70e549d51031

SHA1
0d71b437e7463f4fc9701f197190da02e91cc899

SHA256
8b3f533765de625541bdb53fb72a54af74427d3f4e5d707cd220fa440a5db177

SHA512
da841da023b0ac3942c94989f40d1a894c4c69a0719fd58eb397a292114e5687ed49c24519f7e8c7ded3bb559649b4b8ad09ec861f5780239c66899d8ac687bd

Download Submit
C:\Windows\system\cjvOwzn.exe

Filesize
1.4MB

MD5
1b675ab27765a29db7e1b8dcc29da94c

SHA1
e5735212f6635d907be2349fd19abe504f9a2ac9

SHA256
7f376424bb954bc6d5ef826ac0945e99b77d748f45d97b5fdebc21404c926552

SHA512
e5fb0fbb8848c252490e78a8123e294ef7bd0f760fdfef7710f370035ed2305ea1b00585d22ca5d78ce6cb92861337e36c5c1367d65ad2aab5f984f98ed06c8a

Download Submit
C:\Windows\system\dBqqjJb.exe

Filesize
1.4MB

MD5
b577330c90c5a04f94da7a641870d181

SHA1
107a4e2d173ee319f4cbc6b21423ed7c49fce369

SHA256
dbc83900028664884763fdf7b6f23d21b548622524cf7d828e1042204e2009f5

SHA512
15863b4745d79ebe60aca9520c9481efea24e1f03e9c6c11308f1abf59b5fa1fbcc3c710734832c589cb60419e0700df768d5a1c1f14340fb0cfae11736ed727

Download Submit
C:\Windows\system\dUKfKUI.exe

Filesize
1.4MB

MD5
b8ccd0cac38d698b28295c9b5591d04d

SHA1
c7dbf703585027b5d2a4cc667d75e0cb0fe894fb

SHA256
37f5569934593676354d4b81141d99c85fdbc48ca9c42c629f9b6ec3b3410279

SHA512
58211ff1be42bf595139ea35f92fbac0e8994688feee9c716ea0f09c82b7a41af102100e681ca0211d204b41f4ca0c46e66b10d3fb7d3f55adae567f899795f6

Download Submit
C:\Windows\system\djXKrNE.exe

Filesize
1.4MB

MD5
d8f4c4586469b375900ffc22000b370a

SHA1
5a080aeda8760a81c3c49b7117cb9426cd69e0ed

SHA256
025c192b26dd332cad4c480a38c3a9f5a40ad1ccf4e51bad2a2f55abd3ef55e7

SHA512
8d2d170b2dde43463c11e902b39291ce7dc0de7f243f4bed7729ff28fd8f6928f58c8d12225953453b6bdd2b09ee86ef2e713e3ca2c2c0dac4db9555483be42b

Download Submit
C:\Windows\system\fwBwfMc.exe

Filesize
1.4MB

MD5
56ea79989696b3395403badf8491c577

SHA1
5a1177a3c181c613c0afff58b7b16fa193b0c08a

SHA256
9ab10bb6056bef4f74737893dd51f6583344c1caeb66ca081509bc91880ca3f9

SHA512
e35fe798ab72ca980757c0191c04868f35b5363db62d1d4b216b4f7766be92c12ad3cd3bca18c9f4389ce87683f2739e227242a668d91e1926362718489e0f5b

Download Submit
C:\Windows\system\ggtGGcY.exe

Filesize
1.4MB

MD5
e222ef0ecc94cedb314824782d65e488

SHA1
8286876025d562c47033580e5a1bfed26eef268d

SHA256
f2742d8aa42dc88502bc6aa877de246679d09edc63dfa8eaa19c1b76e3526add

SHA512
d866e3446b7a1c0d3af0037458af20c344853f7e09f723847ae1a0d97406aba2a1f60b7960e1242d303f350968171e68b04c9ab645964ea9db4689a8930dbf48

Download Submit
C:\Windows\system\iahVDEJ.exe

Filesize
1.4MB

MD5
dd701da5504188b754501a885f05379d

SHA1
1cc2b926058bb9a6fd3c9661ed44e7f0f46ac81c

SHA256
0a9843cdce669e2107482fcf6c7c4199167c3ac6f6307fe75e6f422509d7cfee

SHA512
5063703b0dcd64e3fad0ee6039eac0625a80729668a888c077ac342c247d75ea8659d029a09d6a7cedfede7fe75f93d69a1314a3c4e6e9b3d7099311a2f868a4

Download Submit
C:\Windows\system\kWyoxHy.exe

Filesize
1.4MB

MD5
4d3118feaa071f96e8fda291f46dc2db

SHA1
62ab5446906313aea1ee76e7b37a350b199d201b

SHA256
3eaa61c303ae76efe2c51f0110283d150bd409eb32cea8683c98f9049d1d8db6

SHA512
687c7b995d18ea2848625962612d1127305e73d214bf7c44e945913151fcbc6a10ba2c4dca0a5e1e049a72e1c62dcd574ec5754992f9895c354fc963e3aedfa7

Download Submit
C:\Windows\system\kkoXFCe.exe

Filesize
1.4MB

MD5
3c56f0ce3e7684567faadc4c65ad145e

SHA1
ddcfffcbeb69535b997a93e567f86dd64f148533

SHA256
b4208f6555532b0f5bd899cb8a8f0e9a73b406e4db543dcdb235b1277c2c9be2

SHA512
1cb2a0324a0c43bfb940b4296061b60741406df7cf93d4d6aaa9eb817d2a76c30c3d64ef2c9a8a7dc1a99d7b08731268f769855b1880f431045a7790beecb7d9

Download Submit
C:\Windows\system\lqVvWNZ.exe

Filesize
1.4MB

MD5
987c0260b8d8c434398cb6153d4a0809

SHA1
dc6a50fef07d3934032ed913ac2c9f6d5a5e9ae4

SHA256
24b17a7157b99adc80233cd1cc20f7fc9005d3be6024bdb66f42be87ff09d6aa

SHA512
ff229f72764efe55926123fba8d6c9d92c398ea8c6b2fee2c76bd2ec8489e7aec15f93cd07b022f9cd13af0aa9806fc2a00d4b7b55c02f018af3fefaff00420d

Download Submit
C:\Windows\system\nazhKUL.exe

Filesize
1.4MB

MD5
d4e474d132fb9bd3b6c8955f8ba0e046

SHA1
f3debc677beccabdc1eb643b6f7ccb2a0998c951

SHA256
4ee5fdd612752cc7826a154fdef05c586599ea2607d410f1041570f56f77ac30

SHA512
4b62cfe24c4f87e7790ce64f9c8604c0f49fc36eeb3f2a5e797bf0e0b1816fb49c3b511050bc858d612189248f735f19599f67c184df12c1e5ef790d8e00b24a

Download Submit
C:\Windows\system\oRLIOun.exe

Filesize
1.4MB

MD5
0b131cfaec45ab3d782b39dd691ea36b

SHA1
a128f3d9045c42c413bf3933deeeb6f7079261f6

SHA256
856df945cf690315ce1e93bacc1f5391547e90aab64544174cd1b9d2b691824e

SHA512
6e872073b25ecb656e6421559e03a831cebe5fde9b8724cfad1d53f66e60f001966c559406eba41e6128be7cd5f19e0158582bb4388cca8806d25994878f4f0c

Download Submit
C:\Windows\system\piIPygK.exe

Filesize
1.4MB

MD5
5d87ff3af226009ffa7ca669cec5451c

SHA1
3e9a993b7030577fd4126f84f1c0b267ea5d28ae

SHA256
7458ed6c4aac4a1c94091c581ac42dbd25116944fc89bcca470703730f760ab7

SHA512
6eb186632b34296cbcd0d30a8e33f5ff3b0e9ec0fe1255662fc4f9e81d1ce69b854c97f348b238258506b639dfb0342ebb69a784dce3acf83c4d1ffc49dad081

Download Submit
C:\Windows\system\tyCgjSD.exe

Filesize
1.4MB

MD5
02bc08b2902a80f1e4c2805eb18fce5d

SHA1
4f0fac1f30456810e1597d62ae423f089f12ce6d

SHA256
ad4bc6c92ec253258646200ea57f24fc9cf14e5865b83aee031996968f0050c0

SHA512
e9ef138f2ec41ba56e53f5e72c6a92cf9fd99c67091e7f553b532f3ce837e837bb0c86939581bca127d9c89ff5ffaa31714f1d252d66585f8e62e82c2622158e

Download Submit
C:\Windows\system\wJYSZYc.exe

Filesize
1.4MB

MD5
b0e68847c6e9af588c1362f54a96f67f

SHA1
167ece8af2a0642f74d5f8802fd1032506da6762

SHA256
774181336ea9ac580c17e9bdd199e77cdf94f99bc46e231d4f774637841a65f1

SHA512
bb73d99f355220adddd9a9b7f0515312944e60765b09debf2c0541e6ec57d2d00ba9674cfe63811bc7f2b7dd9d7d40d69936762752a98fe2f755df7558948df2

Download Submit
C:\Windows\system\xHfvSCW.exe

Filesize
1.4MB

MD5
820e6961f00cb9b04ac90cf7c1ce9426

SHA1
2fb52c0307dbe022f9b9a3417fcf00e137945080

SHA256
cedf5f1ade2abf0b7c019461af60ee8b322bd72be3ef46571bb0c90e738a35c6

SHA512
492c636b8bdf92675125f458dd210587f3b3259cee6e32f824bdebd5eeb8b50b1b97ba5643a481951941aba0166bda1cf2f4a00ba1003e3860754c64fde16f83

Download Submit
C:\Windows\system\zwDlNma.exe

Filesize
1.4MB

MD5
699f1707a60f66d0b15d713bb4dd92b8

SHA1
8c3a1c1366a9ecc2bc5cdf499fd202a95fb682ad

SHA256
889f86698ad3644b570554ac465ebb8f88fee8bc6f2961d5ca2c8c48db52a5bb

SHA512
d4d1d37302057a9f8efe83320f55d237671c5ac21ce5da0f9818e7d5392313954e44f9373f4deec92ca057cbc1484976c196372288eea96261118d3dfa43ac18

Download Submit
\Windows\system\GrdWNBe.exe

Filesize
1.4MB

MD5
10e933a88514b2a4858c0bce48550d8e

SHA1
b49c63ca5f281d33c7537bacd63032dfb3acce50

SHA256
aa493e4d75b34ed0acbb43358d84b598f86657d59b6825996da5e0317502b9fd

SHA512
5b628748d473bf908fce6de0583b3aae739bc113f5571ea9cca1f76f3df047f0d96320d35cfb13ec961d620b0db18e2849e16338583f2a24ec9d50e3da7b70a8

Download Submit
\Windows\system\lkmDQBC.exe

Filesize
1.4MB

MD5
6fad7cff5d0589750a357a3d22f0ebd2

SHA1
9fc894a07537f6e2e1683e0c30e6272511d5e8b8

SHA256
4ae834e8953d02680c43c1a68fbad5a8cb843ab6dfc8067e4f3fc25bbb356373

SHA512
a80044b4ed1173b5479b5fb4c1f552f946d5d9d23f1962759dc8c007dca413c7e0e70f824689a0035681ed06d25851e521fbda90729dc8d2513738037f7c7bc4

Download Submit
\Windows\system\xrJUehk.exe

Filesize
1.4MB

MD5
0f560ec0c45ac4365f7faf98ddc4c2a2

SHA1
39f26704609cefcd97768b9ad9d76aaad1de04c0

SHA256
898e25f3004ff8bae31231e1d1e765109c1c8980dcd19287f148f247d79c463d

SHA512
9104fa499e56d27e26be5a6df0e813f22d287747a3f3d32ca1615683a136952d85d046c4e7b90a1266e0afff85a1c3d81d6aed22ac41514c37339ee6141d454a

Download Submit
memory/2352-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download