xmrig | 2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
Size

1.7MB
MD5

193fdfccc3b9e9b81ddd31422a238d72
SHA1

0fd10667ee98ce90662fa940baa8db8f1e16330b
SHA256

2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35
SHA512

612637393981c264f56edbd0f0cf64d5bb96e2b7d3115bf9006eb506b0c3464214a0d47fcf059fded304717dd279814227d3c27ee5ecf7fb99579b3083bd79b6
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxTzkx7kvxIWx3JXI:GemTLkNdfE0pZyW

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012263-2.dat	xmrig
behavioral1/files/0x0008000000016cfe-8.dat	xmrig
behavioral1/files/0x0007000000016d0b-9.dat	xmrig
behavioral1/files/0x0008000000016d13-17.dat	xmrig
behavioral1/files/0x0007000000016d24-21.dat	xmrig
behavioral1/files/0x0007000000016d2e-27.dat	xmrig
behavioral1/files/0x0008000000016d3f-37.dat	xmrig
behavioral1/files/0x000600000001752f-48.dat	xmrig
behavioral1/files/0x001500000001866d-52.dat	xmrig
behavioral1/files/0x00060000000190d6-72.dat	xmrig
behavioral1/files/0x000500000001926b-100.dat	xmrig
behavioral1/files/0x0005000000019382-117.dat	xmrig
behavioral1/files/0x00050000000193c4-132.dat	xmrig
behavioral1/files/0x00050000000193be-128.dat	xmrig
behavioral1/files/0x0005000000019389-124.dat	xmrig
behavioral1/files/0x0009000000016c58-120.dat	xmrig
behavioral1/files/0x0005000000019277-112.dat	xmrig
behavioral1/files/0x0005000000019273-108.dat	xmrig
behavioral1/files/0x0005000000019271-105.dat	xmrig
behavioral1/files/0x000500000001924c-96.dat	xmrig
behavioral1/files/0x0005000000019234-92.dat	xmrig
behavioral1/files/0x0005000000019229-88.dat	xmrig
behavioral1/files/0x0005000000019218-84.dat	xmrig
behavioral1/files/0x00050000000191f7-80.dat	xmrig
behavioral1/files/0x00050000000191f3-76.dat	xmrig
behavioral1/files/0x00060000000190cd-68.dat	xmrig
behavioral1/files/0x000500000001879b-64.dat	xmrig
behavioral1/files/0x0005000000018690-60.dat	xmrig
behavioral1/files/0x0009000000018678-56.dat	xmrig
behavioral1/files/0x00060000000174ac-44.dat	xmrig
behavioral1/files/0x0008000000016d47-40.dat	xmrig
behavioral1/files/0x0007000000016d36-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2940	pdhpjxd.exe
3000	LZEglxp.exe
2864	fcfJGSp.exe
2668	nZhexcl.exe
1488	fYKGpix.exe
2780	roPNOVa.exe
2856	VkHOlPn.exe
2720	TCXNOsS.exe
2840	pYjTbUm.exe
3044	djpiPwu.exe
2844	YveWAeC.exe
2600	zDnVLkf.exe
2748	wpOkrYo.exe
2824	dtPFvfb.exe
2596	JzjTLlR.exe
2652	VrjVNym.exe
2628	RqDMujt.exe
2536	JKWoCGA.exe
1536	nxRmsCJ.exe
848	XDFMDgd.exe
1240	cQDuOJT.exe
348	mhHKtjT.exe
2792	LAdZOei.exe
1716	AXurpTa.exe
2396	cMVvXct.exe
1044	fTygTCO.exe
1040	jUAbuCp.exe
840	FvCIYjQ.exe
2224	JTbmolR.exe
2172	GHwwpjR.exe
2388	AFtNHWR.exe
772	zUmnEpo.exe
2456	HlOCkYu.exe
712	GKKxBWp.exe
1828	bTsjLpd.exe
1944	xJcFfyD.exe
2916	nDffyDX.exe
2444	RydBdIZ.exe
916	wDjQoec.exe
1092	uzlwHCk.exe
2392	qOTYycB.exe
2804	RKxppiu.exe
988	gcNgyJX.exe
1336	gxqqhHI.exe
1304	XBMcUpM.exe
1776	uLPnASA.exe
1108	FyzPFcu.exe
2212	ezEsPpN.exe
1208	UzBpybx.exe
1468	WhMgBxE.exe
1664	OyXMqcq.exe
1896	HRmQwgp.exe
1660	iVcHuQn.exe
920	NtiXiEr.exe
936	LzqyMoc.exe
1400	FuUZFLb.exe
328	EDsJOra.exe
2008	kIdWbZY.exe
2096	QSCAPnE.exe
732	hnMiAAc.exe
2280	etadBPp.exe
1920	ZsxdpmT.exe
1604	BKmeAau.exe
2072	hQPXNeG.exe

Loads dropped DLL 64 IoCs

pid	Process
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SBTtnLk.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\xqJzWoM.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\MZgCLPM.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\sSneUhI.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\AuhegmJ.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\DdEJGZa.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\moVJDCo.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\FyzPFcu.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\BsIkgqN.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\WPUZLZI.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\tDDSfjK.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\koOtIBM.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\XdRPnSQ.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\nUiSSpj.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\woNrXCU.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\EzaDDkb.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\RPlhJRZ.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\sTEIbZH.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\HaQpQKz.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\RydBdIZ.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\kjyahrz.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\HTlXzsd.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\OmxpUkF.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\jAEWIWe.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\CCkLVFR.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\HqdgDwX.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\AUVcyFm.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\FBECRXu.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\eiZNvnz.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\gpgaYQF.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\qkLITyY.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\uYroUDc.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\iwuUTDa.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\qazXvMk.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\fITTHyn.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\XBfusDB.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\KVPkkAh.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\AbsuiPb.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\OwUuouv.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\iAoLJuC.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\gjPAkyH.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\GHLhkyf.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\vTrfDoQ.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\wpoJoOt.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\fLdYvyv.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\vXOcpIG.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\QHtdGRh.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\dAakXcY.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\RCtSQEA.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\xlcGDUt.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\gzWnOAI.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\EjgdmEA.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\jXTHSPb.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\wiPXCRt.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\scVuPcO.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\tkorsBv.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\fAneZhC.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\opTwwQo.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\umwHQCn.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\iFynCcl.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\vGHavXx.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\ZtWXcLW.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\pTvDlud.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
File created	C:\Windows\System\jIoRIlz.exe	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2940	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	32
PID 2500 wrote to memory of 2940	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	32
PID 2500 wrote to memory of 2940	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	32
PID 2500 wrote to memory of 3000	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	33
PID 2500 wrote to memory of 3000	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	33
PID 2500 wrote to memory of 3000	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	33
PID 2500 wrote to memory of 2864	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	34
PID 2500 wrote to memory of 2864	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	34
PID 2500 wrote to memory of 2864	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	34
PID 2500 wrote to memory of 2668	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	35
PID 2500 wrote to memory of 2668	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	35
PID 2500 wrote to memory of 2668	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	35
PID 2500 wrote to memory of 1488	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	36
PID 2500 wrote to memory of 1488	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	36
PID 2500 wrote to memory of 1488	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	36
PID 2500 wrote to memory of 2780	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	37
PID 2500 wrote to memory of 2780	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	37
PID 2500 wrote to memory of 2780	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	37
PID 2500 wrote to memory of 2856	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	38
PID 2500 wrote to memory of 2856	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	38
PID 2500 wrote to memory of 2856	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	38
PID 2500 wrote to memory of 2720	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	39
PID 2500 wrote to memory of 2720	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	39
PID 2500 wrote to memory of 2720	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	39
PID 2500 wrote to memory of 2840	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	40
PID 2500 wrote to memory of 2840	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	40
PID 2500 wrote to memory of 2840	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	40
PID 2500 wrote to memory of 3044	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	41
PID 2500 wrote to memory of 3044	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	41
PID 2500 wrote to memory of 3044	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	41
PID 2500 wrote to memory of 2844	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	42
PID 2500 wrote to memory of 2844	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	42
PID 2500 wrote to memory of 2844	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	42
PID 2500 wrote to memory of 2600	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	43
PID 2500 wrote to memory of 2600	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	43
PID 2500 wrote to memory of 2600	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	43
PID 2500 wrote to memory of 2748	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	44
PID 2500 wrote to memory of 2748	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	44
PID 2500 wrote to memory of 2748	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	44
PID 2500 wrote to memory of 2824	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	45
PID 2500 wrote to memory of 2824	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	45
PID 2500 wrote to memory of 2824	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	45
PID 2500 wrote to memory of 2596	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	46
PID 2500 wrote to memory of 2596	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	46
PID 2500 wrote to memory of 2596	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	46
PID 2500 wrote to memory of 2652	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	47
PID 2500 wrote to memory of 2652	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	47
PID 2500 wrote to memory of 2652	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	47
PID 2500 wrote to memory of 2628	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	48
PID 2500 wrote to memory of 2628	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	48
PID 2500 wrote to memory of 2628	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	48
PID 2500 wrote to memory of 2536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	49
PID 2500 wrote to memory of 2536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	49
PID 2500 wrote to memory of 2536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	49
PID 2500 wrote to memory of 1536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	50
PID 2500 wrote to memory of 1536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	50
PID 2500 wrote to memory of 1536	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	50
PID 2500 wrote to memory of 848	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	51
PID 2500 wrote to memory of 848	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	51
PID 2500 wrote to memory of 848	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	51
PID 2500 wrote to memory of 1240	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	52
PID 2500 wrote to memory of 1240	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	52
PID 2500 wrote to memory of 1240	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	52
PID 2500 wrote to memory of 348	2500	2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe	53

C:\Users\Admin\AppData\Local\Temp\2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe
"C:\Users\Admin\AppData\Local\Temp\2b4bcf9bac4f4b064dbde7efcc417b7e43585ec7ffc76f4a7d301f7d74731c35.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System\pdhpjxd.exe
  C:\Windows\System\pdhpjxd.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\LZEglxp.exe
  C:\Windows\System\LZEglxp.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\fcfJGSp.exe
  C:\Windows\System\fcfJGSp.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\nZhexcl.exe
  C:\Windows\System\nZhexcl.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fYKGpix.exe
  C:\Windows\System\fYKGpix.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\roPNOVa.exe
  C:\Windows\System\roPNOVa.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\VkHOlPn.exe
  C:\Windows\System\VkHOlPn.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\TCXNOsS.exe
  C:\Windows\System\TCXNOsS.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\pYjTbUm.exe
  C:\Windows\System\pYjTbUm.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\djpiPwu.exe
  C:\Windows\System\djpiPwu.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\YveWAeC.exe
  C:\Windows\System\YveWAeC.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\zDnVLkf.exe
  C:\Windows\System\zDnVLkf.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\wpOkrYo.exe
  C:\Windows\System\wpOkrYo.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\dtPFvfb.exe
  C:\Windows\System\dtPFvfb.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\JzjTLlR.exe
  C:\Windows\System\JzjTLlR.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VrjVNym.exe
  C:\Windows\System\VrjVNym.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\RqDMujt.exe
  C:\Windows\System\RqDMujt.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\JKWoCGA.exe
  C:\Windows\System\JKWoCGA.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\nxRmsCJ.exe
  C:\Windows\System\nxRmsCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\XDFMDgd.exe
  C:\Windows\System\XDFMDgd.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\cQDuOJT.exe
  C:\Windows\System\cQDuOJT.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\mhHKtjT.exe
  C:\Windows\System\mhHKtjT.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\LAdZOei.exe
  C:\Windows\System\LAdZOei.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\AXurpTa.exe
  C:\Windows\System\AXurpTa.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\cMVvXct.exe
  C:\Windows\System\cMVvXct.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\fTygTCO.exe
  C:\Windows\System\fTygTCO.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jUAbuCp.exe
  C:\Windows\System\jUAbuCp.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\FvCIYjQ.exe
  C:\Windows\System\FvCIYjQ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\JTbmolR.exe
  C:\Windows\System\JTbmolR.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GHwwpjR.exe
  C:\Windows\System\GHwwpjR.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\AFtNHWR.exe
  C:\Windows\System\AFtNHWR.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\zUmnEpo.exe
  C:\Windows\System\zUmnEpo.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\HlOCkYu.exe
  C:\Windows\System\HlOCkYu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GKKxBWp.exe
  C:\Windows\System\GKKxBWp.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\bTsjLpd.exe
  C:\Windows\System\bTsjLpd.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\xJcFfyD.exe
  C:\Windows\System\xJcFfyD.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\nDffyDX.exe
  C:\Windows\System\nDffyDX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RydBdIZ.exe
  C:\Windows\System\RydBdIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\wDjQoec.exe
  C:\Windows\System\wDjQoec.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\uzlwHCk.exe
  C:\Windows\System\uzlwHCk.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\qOTYycB.exe
  C:\Windows\System\qOTYycB.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\RKxppiu.exe
  C:\Windows\System\RKxppiu.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\gcNgyJX.exe
  C:\Windows\System\gcNgyJX.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\gxqqhHI.exe
  C:\Windows\System\gxqqhHI.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\XBMcUpM.exe
  C:\Windows\System\XBMcUpM.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\uLPnASA.exe
  C:\Windows\System\uLPnASA.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\FyzPFcu.exe
  C:\Windows\System\FyzPFcu.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ezEsPpN.exe
  C:\Windows\System\ezEsPpN.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\UzBpybx.exe
  C:\Windows\System\UzBpybx.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\WhMgBxE.exe
  C:\Windows\System\WhMgBxE.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\OyXMqcq.exe
  C:\Windows\System\OyXMqcq.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\HRmQwgp.exe
  C:\Windows\System\HRmQwgp.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\iVcHuQn.exe
  C:\Windows\System\iVcHuQn.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\NtiXiEr.exe
  C:\Windows\System\NtiXiEr.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\LzqyMoc.exe
  C:\Windows\System\LzqyMoc.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\FuUZFLb.exe
  C:\Windows\System\FuUZFLb.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\EDsJOra.exe
  C:\Windows\System\EDsJOra.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\kIdWbZY.exe
  C:\Windows\System\kIdWbZY.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\QSCAPnE.exe
  C:\Windows\System\QSCAPnE.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\hnMiAAc.exe
  C:\Windows\System\hnMiAAc.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\etadBPp.exe
  C:\Windows\System\etadBPp.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ZsxdpmT.exe
  C:\Windows\System\ZsxdpmT.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\BKmeAau.exe
  C:\Windows\System\BKmeAau.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hQPXNeG.exe
  C:\Windows\System\hQPXNeG.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\gvukvWM.exe
  C:\Windows\System\gvukvWM.exe
  2⤵
  PID:2888
- C:\Windows\System\CbSlYwW.exe
  C:\Windows\System\CbSlYwW.exe
  2⤵
  PID:1416
- C:\Windows\System\BKWwpwL.exe
  C:\Windows\System\BKWwpwL.exe
  2⤵
  PID:112
- C:\Windows\System\ukPFyfP.exe
  C:\Windows\System\ukPFyfP.exe
  2⤵
  PID:2056
- C:\Windows\System\znZITaH.exe
  C:\Windows\System\znZITaH.exe
  2⤵
  PID:1848
- C:\Windows\System\WYjfCvy.exe
  C:\Windows\System\WYjfCvy.exe
  2⤵
  PID:1504
- C:\Windows\System\plZvPcS.exe
  C:\Windows\System\plZvPcS.exe
  2⤵
  PID:1628
- C:\Windows\System\EXGwZCv.exe
  C:\Windows\System\EXGwZCv.exe
  2⤵
  PID:2288
- C:\Windows\System\fvaoYKG.exe
  C:\Windows\System\fvaoYKG.exe
  2⤵
  PID:2992
- C:\Windows\System\QuXUlNT.exe
  C:\Windows\System\QuXUlNT.exe
  2⤵
  PID:2960
- C:\Windows\System\GcCLkjA.exe
  C:\Windows\System\GcCLkjA.exe
  2⤵
  PID:2756
- C:\Windows\System\CpPsEtu.exe
  C:\Windows\System\CpPsEtu.exe
  2⤵
  PID:2984
- C:\Windows\System\fdUHRvR.exe
  C:\Windows\System\fdUHRvR.exe
  2⤵
  PID:2704
- C:\Windows\System\TIwVXyD.exe
  C:\Windows\System\TIwVXyD.exe
  2⤵
  PID:2724
- C:\Windows\System\qfdQzED.exe
  C:\Windows\System\qfdQzED.exe
  2⤵
  PID:2732
- C:\Windows\System\JUpETJt.exe
  C:\Windows\System\JUpETJt.exe
  2⤵
  PID:2808
- C:\Windows\System\sRlyYoS.exe
  C:\Windows\System\sRlyYoS.exe
  2⤵
  PID:2832
- C:\Windows\System\mNOJfWP.exe
  C:\Windows\System\mNOJfWP.exe
  2⤵
  PID:2572
- C:\Windows\System\hZJqevi.exe
  C:\Windows\System\hZJqevi.exe
  2⤵
  PID:2972
- C:\Windows\System\ZoBNgVV.exe
  C:\Windows\System\ZoBNgVV.exe
  2⤵
  PID:560
- C:\Windows\System\ZjcLnNt.exe
  C:\Windows\System\ZjcLnNt.exe
  2⤵
  PID:1948
- C:\Windows\System\tJTcDmm.exe
  C:\Windows\System\tJTcDmm.exe
  2⤵
  PID:1868
- C:\Windows\System\flIqEQF.exe
  C:\Windows\System\flIqEQF.exe
  2⤵
  PID:2372
- C:\Windows\System\oNMCgLA.exe
  C:\Windows\System\oNMCgLA.exe
  2⤵
  PID:1888
- C:\Windows\System\vIZYqjE.exe
  C:\Windows\System\vIZYqjE.exe
  2⤵
  PID:2812
- C:\Windows\System\yXkGmkJ.exe
  C:\Windows\System\yXkGmkJ.exe
  2⤵
  PID:2472
- C:\Windows\System\YlEttkx.exe
  C:\Windows\System\YlEttkx.exe
  2⤵
  PID:812
- C:\Windows\System\ouysRmn.exe
  C:\Windows\System\ouysRmn.exe
  2⤵
  PID:964
- C:\Windows\System\bwxlgEn.exe
  C:\Windows\System\bwxlgEn.exe
  2⤵
  PID:1832
- C:\Windows\System\RXdclHl.exe
  C:\Windows\System\RXdclHl.exe
  2⤵
  PID:1768
- C:\Windows\System\pZbtimS.exe
  C:\Windows\System\pZbtimS.exe
  2⤵
  PID:408
- C:\Windows\System\whmxOjD.exe
  C:\Windows\System\whmxOjD.exe
  2⤵
  PID:3052
- C:\Windows\System\MVShPvQ.exe
  C:\Windows\System\MVShPvQ.exe
  2⤵
  PID:1200
- C:\Windows\System\jbzcYSH.exe
  C:\Windows\System\jbzcYSH.exe
  2⤵
  PID:2636
- C:\Windows\System\cAzAmjM.exe
  C:\Windows\System\cAzAmjM.exe
  2⤵
  PID:2560
- C:\Windows\System\iCpsDvK.exe
  C:\Windows\System\iCpsDvK.exe
  2⤵
  PID:1224
- C:\Windows\System\gTPEuxY.exe
  C:\Windows\System\gTPEuxY.exe
  2⤵
  PID:1932
- C:\Windows\System\acEEoZJ.exe
  C:\Windows\System\acEEoZJ.exe
  2⤵
  PID:872
- C:\Windows\System\zUNvHYE.exe
  C:\Windows\System\zUNvHYE.exe
  2⤵
  PID:2424
- C:\Windows\System\ycksBUd.exe
  C:\Windows\System\ycksBUd.exe
  2⤵
  PID:2464
- C:\Windows\System\YNWvIny.exe
  C:\Windows\System\YNWvIny.exe
  2⤵
  PID:2776
- C:\Windows\System\KWRfhZu.exe
  C:\Windows\System\KWRfhZu.exe
  2⤵
  PID:344
- C:\Windows\System\IpPdNUf.exe
  C:\Windows\System\IpPdNUf.exe
  2⤵
  PID:2432
- C:\Windows\System\nyazTxB.exe
  C:\Windows\System\nyazTxB.exe
  2⤵
  PID:760
- C:\Windows\System\RNWkPYa.exe
  C:\Windows\System\RNWkPYa.exe
  2⤵
  PID:3048
- C:\Windows\System\IatOsuy.exe
  C:\Windows\System\IatOsuy.exe
  2⤵
  PID:1432
- C:\Windows\System\gEnBFyM.exe
  C:\Windows\System\gEnBFyM.exe
  2⤵
  PID:1508
- C:\Windows\System\ryonvWq.exe
  C:\Windows\System\ryonvWq.exe
  2⤵
  PID:2380
- C:\Windows\System\RXZHOrK.exe
  C:\Windows\System\RXZHOrK.exe
  2⤵
  PID:2352
- C:\Windows\System\emIGGVn.exe
  C:\Windows\System\emIGGVn.exe
  2⤵
  PID:2820
- C:\Windows\System\vNzyIRk.exe
  C:\Windows\System\vNzyIRk.exe
  2⤵
  PID:2584
- C:\Windows\System\nUhRwMU.exe
  C:\Windows\System\nUhRwMU.exe
  2⤵
  PID:2624
- C:\Windows\System\QwWHSPl.exe
  C:\Windows\System\QwWHSPl.exe
  2⤵
  PID:2292
- C:\Windows\System\aqABXCN.exe
  C:\Windows\System\aqABXCN.exe
  2⤵
  PID:2024
- C:\Windows\System\jESiinA.exe
  C:\Windows\System\jESiinA.exe
  2⤵
  PID:2020
- C:\Windows\System\UvKpIut.exe
  C:\Windows\System\UvKpIut.exe
  2⤵
  PID:2716
- C:\Windows\System\IXZtLLv.exe
  C:\Windows\System\IXZtLLv.exe
  2⤵
  PID:2764
- C:\Windows\System\QdxshqG.exe
  C:\Windows\System\QdxshqG.exe
  2⤵
  PID:2216
- C:\Windows\System\bZUpoTT.exe
  C:\Windows\System\bZUpoTT.exe
  2⤵
  PID:1696
- C:\Windows\System\YBRkegF.exe
  C:\Windows\System\YBRkegF.exe
  2⤵
  PID:1876
- C:\Windows\System\TdLxxaY.exe
  C:\Windows\System\TdLxxaY.exe
  2⤵
  PID:3084
- C:\Windows\System\ctkvpuQ.exe
  C:\Windows\System\ctkvpuQ.exe
  2⤵
  PID:3100
- C:\Windows\System\EbbmeZf.exe
  C:\Windows\System\EbbmeZf.exe
  2⤵
  PID:3116
- C:\Windows\System\QKtgBjw.exe
  C:\Windows\System\QKtgBjw.exe
  2⤵
  PID:3132
- C:\Windows\System\fRccMIt.exe
  C:\Windows\System\fRccMIt.exe
  2⤵
  PID:3148
- C:\Windows\System\avCxUrg.exe
  C:\Windows\System\avCxUrg.exe
  2⤵
  PID:3164
- C:\Windows\System\RpJyAmW.exe
  C:\Windows\System\RpJyAmW.exe
  2⤵
  PID:3180
- C:\Windows\System\eruWlLx.exe
  C:\Windows\System\eruWlLx.exe
  2⤵
  PID:3196
- C:\Windows\System\ZYLJFff.exe
  C:\Windows\System\ZYLJFff.exe
  2⤵
  PID:3212
- C:\Windows\System\WfQvrjB.exe
  C:\Windows\System\WfQvrjB.exe
  2⤵
  PID:3228
- C:\Windows\System\QtQVPGn.exe
  C:\Windows\System\QtQVPGn.exe
  2⤵
  PID:3244
- C:\Windows\System\DSJlbQx.exe
  C:\Windows\System\DSJlbQx.exe
  2⤵
  PID:3260
- C:\Windows\System\CmqiGFc.exe
  C:\Windows\System\CmqiGFc.exe
  2⤵
  PID:3276
- C:\Windows\System\iaNlapW.exe
  C:\Windows\System\iaNlapW.exe
  2⤵
  PID:3292
- C:\Windows\System\SZuvJQf.exe
  C:\Windows\System\SZuvJQf.exe
  2⤵
  PID:3308
- C:\Windows\System\RizcjId.exe
  C:\Windows\System\RizcjId.exe
  2⤵
  PID:3324
- C:\Windows\System\koOtIBM.exe
  C:\Windows\System\koOtIBM.exe
  2⤵
  PID:3340
- C:\Windows\System\twmexmn.exe
  C:\Windows\System\twmexmn.exe
  2⤵
  PID:3356
- C:\Windows\System\bureHNM.exe
  C:\Windows\System\bureHNM.exe
  2⤵
  PID:3372
- C:\Windows\System\XUyJdrZ.exe
  C:\Windows\System\XUyJdrZ.exe
  2⤵
  PID:3388
- C:\Windows\System\HCfpUPK.exe
  C:\Windows\System\HCfpUPK.exe
  2⤵
  PID:3404
- C:\Windows\System\FlmwrGi.exe
  C:\Windows\System\FlmwrGi.exe
  2⤵
  PID:3420
- C:\Windows\System\RCtSQEA.exe
  C:\Windows\System\RCtSQEA.exe
  2⤵
  PID:3436
- C:\Windows\System\mVuCEgE.exe
  C:\Windows\System\mVuCEgE.exe
  2⤵
  PID:3452
- C:\Windows\System\ZDPbalV.exe
  C:\Windows\System\ZDPbalV.exe
  2⤵
  PID:3468
- C:\Windows\System\oAIWHvU.exe
  C:\Windows\System\oAIWHvU.exe
  2⤵
  PID:3484
- C:\Windows\System\nHokXLr.exe
  C:\Windows\System\nHokXLr.exe
  2⤵
  PID:3500
- C:\Windows\System\uIujENj.exe
  C:\Windows\System\uIujENj.exe
  2⤵
  PID:3516
- C:\Windows\System\fwHussG.exe
  C:\Windows\System\fwHussG.exe
  2⤵
  PID:3532
- C:\Windows\System\DRWEayC.exe
  C:\Windows\System\DRWEayC.exe
  2⤵
  PID:3548
- C:\Windows\System\IAXdsLm.exe
  C:\Windows\System\IAXdsLm.exe
  2⤵
  PID:3564
- C:\Windows\System\AEAssep.exe
  C:\Windows\System\AEAssep.exe
  2⤵
  PID:3580
- C:\Windows\System\nXdrcvf.exe
  C:\Windows\System\nXdrcvf.exe
  2⤵
  PID:3596
- C:\Windows\System\IQYguQI.exe
  C:\Windows\System\IQYguQI.exe
  2⤵
  PID:3612
- C:\Windows\System\OEmGInR.exe
  C:\Windows\System\OEmGInR.exe
  2⤵
  PID:3628
- C:\Windows\System\oMphYCY.exe
  C:\Windows\System\oMphYCY.exe
  2⤵
  PID:3644
- C:\Windows\System\NhjtfJs.exe
  C:\Windows\System\NhjtfJs.exe
  2⤵
  PID:3660
- C:\Windows\System\vOTtAZu.exe
  C:\Windows\System\vOTtAZu.exe
  2⤵
  PID:3676
- C:\Windows\System\zCNPhVY.exe
  C:\Windows\System\zCNPhVY.exe
  2⤵
  PID:3692
- C:\Windows\System\IDmdRHT.exe
  C:\Windows\System\IDmdRHT.exe
  2⤵
  PID:3708
- C:\Windows\System\fIzATjO.exe
  C:\Windows\System\fIzATjO.exe
  2⤵
  PID:3724
- C:\Windows\System\kiLrhQQ.exe
  C:\Windows\System\kiLrhQQ.exe
  2⤵
  PID:3740
- C:\Windows\System\nwVTIDL.exe
  C:\Windows\System\nwVTIDL.exe
  2⤵
  PID:3756
- C:\Windows\System\lVeroeM.exe
  C:\Windows\System\lVeroeM.exe
  2⤵
  PID:3772
- C:\Windows\System\DPvEXHq.exe
  C:\Windows\System\DPvEXHq.exe
  2⤵
  PID:3788
- C:\Windows\System\QTQrNPX.exe
  C:\Windows\System\QTQrNPX.exe
  2⤵
  PID:3804
- C:\Windows\System\BsIkgqN.exe
  C:\Windows\System\BsIkgqN.exe
  2⤵
  PID:3820
- C:\Windows\System\xbriwlN.exe
  C:\Windows\System\xbriwlN.exe
  2⤵
  PID:3836
- C:\Windows\System\FqvQyJB.exe
  C:\Windows\System\FqvQyJB.exe
  2⤵
  PID:3852
- C:\Windows\System\SBPNDer.exe
  C:\Windows\System\SBPNDer.exe
  2⤵
  PID:3868
- C:\Windows\System\XdRPnSQ.exe
  C:\Windows\System\XdRPnSQ.exe
  2⤵
  PID:3884
- C:\Windows\System\uynYcyN.exe
  C:\Windows\System\uynYcyN.exe
  2⤵
  PID:3900
- C:\Windows\System\yTHXZkG.exe
  C:\Windows\System\yTHXZkG.exe
  2⤵
  PID:3916
- C:\Windows\System\YBnLOJz.exe
  C:\Windows\System\YBnLOJz.exe
  2⤵
  PID:3932
- C:\Windows\System\OROvexv.exe
  C:\Windows\System\OROvexv.exe
  2⤵
  PID:3948
- C:\Windows\System\buRzbOL.exe
  C:\Windows\System\buRzbOL.exe
  2⤵
  PID:3964
- C:\Windows\System\oWnCyFP.exe
  C:\Windows\System\oWnCyFP.exe
  2⤵
  PID:3980
- C:\Windows\System\TsMXrhP.exe
  C:\Windows\System\TsMXrhP.exe
  2⤵
  PID:3996
- C:\Windows\System\kFPWTMk.exe
  C:\Windows\System\kFPWTMk.exe
  2⤵
  PID:4012
- C:\Windows\System\VVDgAEt.exe
  C:\Windows\System\VVDgAEt.exe
  2⤵
  PID:4028
- C:\Windows\System\EPDhKAv.exe
  C:\Windows\System\EPDhKAv.exe
  2⤵
  PID:4044
- C:\Windows\System\SoERLGm.exe
  C:\Windows\System\SoERLGm.exe
  2⤵
  PID:4060
- C:\Windows\System\sshJkHP.exe
  C:\Windows\System\sshJkHP.exe
  2⤵
  PID:4076
- C:\Windows\System\wiPXCRt.exe
  C:\Windows\System\wiPXCRt.exe
  2⤵
  PID:4092
- C:\Windows\System\KyLQlhQ.exe
  C:\Windows\System\KyLQlhQ.exe
  2⤵
  PID:952
- C:\Windows\System\LlTuDRp.exe
  C:\Windows\System\LlTuDRp.exe
  2⤵
  PID:1592
- C:\Windows\System\HwJsbFC.exe
  C:\Windows\System\HwJsbFC.exe
  2⤵
  PID:1548
- C:\Windows\System\glBsOLn.exe
  C:\Windows\System\glBsOLn.exe
  2⤵
  PID:2336
- C:\Windows\System\mXIkIAa.exe
  C:\Windows\System\mXIkIAa.exe
  2⤵
  PID:1676
- C:\Windows\System\pYyMsaM.exe
  C:\Windows\System\pYyMsaM.exe
  2⤵
  PID:548
- C:\Windows\System\XOvLPTO.exe
  C:\Windows\System\XOvLPTO.exe
  2⤵
  PID:1996
- C:\Windows\System\VlGiCeu.exe
  C:\Windows\System\VlGiCeu.exe
  2⤵
  PID:3004
- C:\Windows\System\tHUxLnU.exe
  C:\Windows\System\tHUxLnU.exe
  2⤵
  PID:2684
- C:\Windows\System\VbxizVE.exe
  C:\Windows\System\VbxizVE.exe
  2⤵
  PID:2648
- C:\Windows\System\PBQHZuo.exe
  C:\Windows\System\PBQHZuo.exe
  2⤵
  PID:2112
- C:\Windows\System\xGnxadl.exe
  C:\Windows\System\xGnxadl.exe
  2⤵
  PID:804
- C:\Windows\System\cVIBTWq.exe
  C:\Windows\System\cVIBTWq.exe
  2⤵
  PID:1732
- C:\Windows\System\WJKgQFq.exe
  C:\Windows\System\WJKgQFq.exe
  2⤵
  PID:2924
- C:\Windows\System\MoICWoL.exe
  C:\Windows\System\MoICWoL.exe
  2⤵
  PID:3112
- C:\Windows\System\IWNcpRf.exe
  C:\Windows\System\IWNcpRf.exe
  2⤵
  PID:3144
- C:\Windows\System\oIGtLWj.exe
  C:\Windows\System\oIGtLWj.exe
  2⤵
  PID:3172
- C:\Windows\System\krczVXF.exe
  C:\Windows\System\krczVXF.exe
  2⤵
  PID:3188
- C:\Windows\System\opTwwQo.exe
  C:\Windows\System\opTwwQo.exe
  2⤵
  PID:3236
- C:\Windows\System\kBSGMVm.exe
  C:\Windows\System\kBSGMVm.exe
  2⤵
  PID:3252
- C:\Windows\System\eojYSLZ.exe
  C:\Windows\System\eojYSLZ.exe
  2⤵
  PID:3300
- C:\Windows\System\umwHQCn.exe
  C:\Windows\System\umwHQCn.exe
  2⤵
  PID:3332
- C:\Windows\System\nygAipM.exe
  C:\Windows\System\nygAipM.exe
  2⤵
  PID:3364
- C:\Windows\System\QpJcWoG.exe
  C:\Windows\System\QpJcWoG.exe
  2⤵
  PID:3396
- C:\Windows\System\uZSFsle.exe
  C:\Windows\System\uZSFsle.exe
  2⤵
  PID:3428
- C:\Windows\System\ogmdaBl.exe
  C:\Windows\System\ogmdaBl.exe
  2⤵
  PID:3460
- C:\Windows\System\wIaqJhj.exe
  C:\Windows\System\wIaqJhj.exe
  2⤵
  PID:3476
- C:\Windows\System\OlKPoAI.exe
  C:\Windows\System\OlKPoAI.exe
  2⤵
  PID:3508
- C:\Windows\System\OnNVILs.exe
  C:\Windows\System\OnNVILs.exe
  2⤵
  PID:3544
- C:\Windows\System\iFynCcl.exe
  C:\Windows\System\iFynCcl.exe
  2⤵
  PID:3588
- C:\Windows\System\atmgelM.exe
  C:\Windows\System\atmgelM.exe
  2⤵
  PID:3604
- C:\Windows\System\olvZWAn.exe
  C:\Windows\System\olvZWAn.exe
  2⤵
  PID:3652
- C:\Windows\System\lzYLIRY.exe
  C:\Windows\System\lzYLIRY.exe
  2⤵
  PID:3672
- C:\Windows\System\jrcChDa.exe
  C:\Windows\System\jrcChDa.exe
  2⤵
  PID:3716
- C:\Windows\System\PzHXImc.exe
  C:\Windows\System\PzHXImc.exe
  2⤵
  PID:3748
- C:\Windows\System\FBDwnYx.exe
  C:\Windows\System\FBDwnYx.exe
  2⤵
  PID:3780
- C:\Windows\System\qYoyanx.exe
  C:\Windows\System\qYoyanx.exe
  2⤵
  PID:3812
- C:\Windows\System\FSqxDPa.exe
  C:\Windows\System\FSqxDPa.exe
  2⤵
  PID:3844
- C:\Windows\System\wFPVICA.exe
  C:\Windows\System\wFPVICA.exe
  2⤵
  PID:3876
- C:\Windows\System\izdShQo.exe
  C:\Windows\System\izdShQo.exe
  2⤵
  PID:3908
- C:\Windows\System\YItrzBN.exe
  C:\Windows\System\YItrzBN.exe
  2⤵
  PID:3940
- C:\Windows\System\FfnMAxR.exe
  C:\Windows\System\FfnMAxR.exe
  2⤵
  PID:3972
- C:\Windows\System\iwuUTDa.exe
  C:\Windows\System\iwuUTDa.exe
  2⤵
  PID:3988
- C:\Windows\System\NNjxfrQ.exe
  C:\Windows\System\NNjxfrQ.exe
  2⤵
  PID:4036
- C:\Windows\System\eutBBhp.exe
  C:\Windows\System\eutBBhp.exe
  2⤵
  PID:4068
- C:\Windows\System\ZySRVZC.exe
  C:\Windows\System\ZySRVZC.exe
  2⤵
  PID:4084
- C:\Windows\System\scFWTIY.exe
  C:\Windows\System\scFWTIY.exe
  2⤵
  PID:680
- C:\Windows\System\NMVFTat.exe
  C:\Windows\System\NMVFTat.exe
  2⤵
  PID:2492
- C:\Windows\System\kBTxZvd.exe
  C:\Windows\System\kBTxZvd.exe
  2⤵
  PID:2276
- C:\Windows\System\NwKcctf.exe
  C:\Windows\System\NwKcctf.exe
  2⤵
  PID:1772
- C:\Windows\System\SZjpwAA.exe
  C:\Windows\System\SZjpwAA.exe
  2⤵
  PID:2868
- C:\Windows\System\vUlTIGR.exe
  C:\Windows\System\vUlTIGR.exe
  2⤵
  PID:1936
- C:\Windows\System\nWJeqzk.exe
  C:\Windows\System\nWJeqzk.exe
  2⤵
  PID:2836
- C:\Windows\System\klJnHMh.exe
  C:\Windows\System\klJnHMh.exe
  2⤵
  PID:3092
- C:\Windows\System\IDFSwGn.exe
  C:\Windows\System\IDFSwGn.exe
  2⤵
  PID:3128
- C:\Windows\System\OpGJMhA.exe
  C:\Windows\System\OpGJMhA.exe
  2⤵
  PID:3208
- C:\Windows\System\HIwbCaf.exe
  C:\Windows\System\HIwbCaf.exe
  2⤵
  PID:3272
- C:\Windows\System\xkdzIiT.exe
  C:\Windows\System\xkdzIiT.exe
  2⤵
  PID:3336
- C:\Windows\System\kCJemue.exe
  C:\Windows\System\kCJemue.exe
  2⤵
  PID:3368
- C:\Windows\System\kJrpUXa.exe
  C:\Windows\System\kJrpUXa.exe
  2⤵
  PID:3448
- C:\Windows\System\naGGrrS.exe
  C:\Windows\System\naGGrrS.exe
  2⤵
  PID:3528
- C:\Windows\System\rYmApxG.exe
  C:\Windows\System\rYmApxG.exe
  2⤵
  PID:3620
- C:\Windows\System\rOBUlXY.exe
  C:\Windows\System\rOBUlXY.exe
  2⤵
  PID:3624
- C:\Windows\System\MgbWwMQ.exe
  C:\Windows\System\MgbWwMQ.exe
  2⤵
  PID:3688
- C:\Windows\System\rFuCxfq.exe
  C:\Windows\System\rFuCxfq.exe
  2⤵
  PID:3784
- C:\Windows\System\WwkGElF.exe
  C:\Windows\System\WwkGElF.exe
  2⤵
  PID:3816
- C:\Windows\System\yIIBCTc.exe
  C:\Windows\System\yIIBCTc.exe
  2⤵
  PID:2436
- C:\Windows\System\TCpuqvv.exe
  C:\Windows\System\TCpuqvv.exe
  2⤵
  PID:3924
- C:\Windows\System\hQUVZaN.exe
  C:\Windows\System\hQUVZaN.exe
  2⤵
  PID:4004
- C:\Windows\System\SblRbAg.exe
  C:\Windows\System\SblRbAg.exe
  2⤵
  PID:4040
- C:\Windows\System\nYEGyNP.exe
  C:\Windows\System\nYEGyNP.exe
  2⤵
  PID:1280
- C:\Windows\System\NnHQlJr.exe
  C:\Windows\System\NnHQlJr.exe
  2⤵
  PID:1608
- C:\Windows\System\vXIfVyS.exe
  C:\Windows\System\vXIfVyS.exe
  2⤵
  PID:2384
- C:\Windows\System\FSkvlQh.exe
  C:\Windows\System\FSkvlQh.exe
  2⤵
  PID:2680
- C:\Windows\System\nRRqKDE.exe
  C:\Windows\System\nRRqKDE.exe
  2⤵
  PID:3108
- C:\Windows\System\hZYIZCJ.exe
  C:\Windows\System\hZYIZCJ.exe
  2⤵
  PID:3204
- C:\Windows\System\bLaQpsX.exe
  C:\Windows\System\bLaQpsX.exe
  2⤵
  PID:4104
- C:\Windows\System\nUiSSpj.exe
  C:\Windows\System\nUiSSpj.exe
  2⤵
  PID:4120
- C:\Windows\System\xlCrWsE.exe
  C:\Windows\System\xlCrWsE.exe
  2⤵
  PID:4136
- C:\Windows\System\DPweRTj.exe
  C:\Windows\System\DPweRTj.exe
  2⤵
  PID:4152
- C:\Windows\System\ixOwWTY.exe
  C:\Windows\System\ixOwWTY.exe
  2⤵
  PID:4168
- C:\Windows\System\OFExjTP.exe
  C:\Windows\System\OFExjTP.exe
  2⤵
  PID:4184
- C:\Windows\System\VfZfLJL.exe
  C:\Windows\System\VfZfLJL.exe
  2⤵
  PID:4200
- C:\Windows\System\mAKFOHs.exe
  C:\Windows\System\mAKFOHs.exe
  2⤵
  PID:4216
- C:\Windows\System\xFAMOVA.exe
  C:\Windows\System\xFAMOVA.exe
  2⤵
  PID:4232
- C:\Windows\System\KymLlxl.exe
  C:\Windows\System\KymLlxl.exe
  2⤵
  PID:4248
- C:\Windows\System\cOZJARc.exe
  C:\Windows\System\cOZJARc.exe
  2⤵
  PID:4264
- C:\Windows\System\aRJbBrv.exe
  C:\Windows\System\aRJbBrv.exe
  2⤵
  PID:4280
- C:\Windows\System\yMYaCNx.exe
  C:\Windows\System\yMYaCNx.exe
  2⤵
  PID:4296
- C:\Windows\System\bCFFKQN.exe
  C:\Windows\System\bCFFKQN.exe
  2⤵
  PID:4312
- C:\Windows\System\MsEhFbj.exe
  C:\Windows\System\MsEhFbj.exe
  2⤵
  PID:4328
- C:\Windows\System\soqKIRx.exe
  C:\Windows\System\soqKIRx.exe
  2⤵
  PID:4344
- C:\Windows\System\Oyhdzzo.exe
  C:\Windows\System\Oyhdzzo.exe
  2⤵
  PID:4360
- C:\Windows\System\QKmKuZs.exe
  C:\Windows\System\QKmKuZs.exe
  2⤵
  PID:4376
- C:\Windows\System\WbvWtXg.exe
  C:\Windows\System\WbvWtXg.exe
  2⤵
  PID:4392
- C:\Windows\System\MGzatsv.exe
  C:\Windows\System\MGzatsv.exe
  2⤵
  PID:4408
- C:\Windows\System\xhzuwfC.exe
  C:\Windows\System\xhzuwfC.exe
  2⤵
  PID:4424
- C:\Windows\System\TjmkvMk.exe
  C:\Windows\System\TjmkvMk.exe
  2⤵
  PID:4440
- C:\Windows\System\ldIelPS.exe
  C:\Windows\System\ldIelPS.exe
  2⤵
  PID:4456
- C:\Windows\System\VHoyRBX.exe
  C:\Windows\System\VHoyRBX.exe
  2⤵
  PID:4472
- C:\Windows\System\rnMXCwA.exe
  C:\Windows\System\rnMXCwA.exe
  2⤵
  PID:4488
- C:\Windows\System\BwhQfBH.exe
  C:\Windows\System\BwhQfBH.exe
  2⤵
  PID:4504
- C:\Windows\System\vPUdTXC.exe
  C:\Windows\System\vPUdTXC.exe
  2⤵
  PID:4520
- C:\Windows\System\IjxcXqI.exe
  C:\Windows\System\IjxcXqI.exe
  2⤵
  PID:4536
- C:\Windows\System\jZrcfKu.exe
  C:\Windows\System\jZrcfKu.exe
  2⤵
  PID:4552
- C:\Windows\System\LbdoFzK.exe
  C:\Windows\System\LbdoFzK.exe
  2⤵
  PID:4568
- C:\Windows\System\WQDNdmI.exe
  C:\Windows\System\WQDNdmI.exe
  2⤵
  PID:4584
- C:\Windows\System\AGMRFcR.exe
  C:\Windows\System\AGMRFcR.exe
  2⤵
  PID:4600
- C:\Windows\System\xrwWMcr.exe
  C:\Windows\System\xrwWMcr.exe
  2⤵
  PID:4616
- C:\Windows\System\MLoahuR.exe
  C:\Windows\System\MLoahuR.exe
  2⤵
  PID:4632
- C:\Windows\System\mNYipmP.exe
  C:\Windows\System\mNYipmP.exe
  2⤵
  PID:4648
- C:\Windows\System\wwcMTVL.exe
  C:\Windows\System\wwcMTVL.exe
  2⤵
  PID:4664
- C:\Windows\System\VJnSgAz.exe
  C:\Windows\System\VJnSgAz.exe
  2⤵
  PID:4680
- C:\Windows\System\barYfxG.exe
  C:\Windows\System\barYfxG.exe
  2⤵
  PID:4696
- C:\Windows\System\GSHhGfL.exe
  C:\Windows\System\GSHhGfL.exe
  2⤵
  PID:4712
- C:\Windows\System\vLyqFJd.exe
  C:\Windows\System\vLyqFJd.exe
  2⤵
  PID:4728
- C:\Windows\System\QlUrWMi.exe
  C:\Windows\System\QlUrWMi.exe
  2⤵
  PID:4744
- C:\Windows\System\rHqVwrP.exe
  C:\Windows\System\rHqVwrP.exe
  2⤵
  PID:4760
- C:\Windows\System\onKEzVU.exe
  C:\Windows\System\onKEzVU.exe
  2⤵
  PID:4776
- C:\Windows\System\imIAjyx.exe
  C:\Windows\System\imIAjyx.exe
  2⤵
  PID:4792
- C:\Windows\System\ohDrvwo.exe
  C:\Windows\System\ohDrvwo.exe
  2⤵
  PID:4808
- C:\Windows\System\rtPHEUf.exe
  C:\Windows\System\rtPHEUf.exe
  2⤵
  PID:4824
- C:\Windows\System\BvoTTBb.exe
  C:\Windows\System\BvoTTBb.exe
  2⤵
  PID:4844
- C:\Windows\System\OOWdYsd.exe
  C:\Windows\System\OOWdYsd.exe
  2⤵
  PID:4860
- C:\Windows\System\TxqgXIg.exe
  C:\Windows\System\TxqgXIg.exe
  2⤵
  PID:4880
- C:\Windows\System\BWfuThc.exe
  C:\Windows\System\BWfuThc.exe
  2⤵
  PID:4896
- C:\Windows\System\gVgVCTK.exe
  C:\Windows\System\gVgVCTK.exe
  2⤵
  PID:4912
- C:\Windows\System\EtTZUwW.exe
  C:\Windows\System\EtTZUwW.exe
  2⤵
  PID:4928
- C:\Windows\System\nWAWxBt.exe
  C:\Windows\System\nWAWxBt.exe
  2⤵
  PID:4944
- C:\Windows\System\RXGyPmI.exe
  C:\Windows\System\RXGyPmI.exe
  2⤵
  PID:5076
- C:\Windows\System\CRUcDru.exe
  C:\Windows\System\CRUcDru.exe
  2⤵
  PID:3268
- C:\Windows\System\shonrLw.exe
  C:\Windows\System\shonrLw.exe
  2⤵
  PID:3412
- C:\Windows\System\ItabdFs.exe
  C:\Windows\System\ItabdFs.exe
  2⤵
  PID:3524
- C:\Windows\System\FgGlXue.exe
  C:\Windows\System\FgGlXue.exe
  2⤵
  PID:3668
- C:\Windows\System\FAdPZhO.exe
  C:\Windows\System\FAdPZhO.exe
  2⤵
  PID:3732
- C:\Windows\System\NtaqXzq.exe
  C:\Windows\System\NtaqXzq.exe
  2⤵
  PID:3764
- C:\Windows\System\LdLrYdd.exe
  C:\Windows\System\LdLrYdd.exe
  2⤵
  PID:3892
- C:\Windows\System\AUVcyFm.exe
  C:\Windows\System\AUVcyFm.exe
  2⤵
  PID:2860
- C:\Windows\System\TYIJoKc.exe
  C:\Windows\System\TYIJoKc.exe
  2⤵
  PID:4008
- C:\Windows\System\nkIeEPn.exe
  C:\Windows\System\nkIeEPn.exe
  2⤵
  PID:1412
- C:\Windows\System\OMmIWRD.exe
  C:\Windows\System\OMmIWRD.exe
  2⤵
  PID:3224
- C:\Windows\System\zilmQUl.exe
  C:\Windows\System\zilmQUl.exe
  2⤵
  PID:2580
- C:\Windows\System\YsDLIba.exe
  C:\Windows\System\YsDLIba.exe
  2⤵
  PID:4128
- C:\Windows\System\unDYnrb.exe
  C:\Windows\System\unDYnrb.exe
  2⤵
  PID:4164
- C:\Windows\System\dsxStka.exe
  C:\Windows\System\dsxStka.exe
  2⤵
  PID:4192
- C:\Windows\System\IzxLbco.exe
  C:\Windows\System\IzxLbco.exe
  2⤵
  PID:4176
- C:\Windows\System\bFXDpfG.exe
  C:\Windows\System\bFXDpfG.exe
  2⤵
  PID:4212
- C:\Windows\System\uQIWhxk.exe
  C:\Windows\System\uQIWhxk.exe
  2⤵
  PID:4260
- C:\Windows\System\geiJlFh.exe
  C:\Windows\System\geiJlFh.exe
  2⤵
  PID:4292
- C:\Windows\System\jDCzREU.exe
  C:\Windows\System\jDCzREU.exe
  2⤵
  PID:4324
- C:\Windows\System\TtTkDom.exe
  C:\Windows\System\TtTkDom.exe
  2⤵
  PID:1764
- C:\Windows\System\kRJSXmj.exe
  C:\Windows\System\kRJSXmj.exe
  2⤵
  PID:4340
- C:\Windows\System\gVJhJgE.exe
  C:\Windows\System\gVJhJgE.exe
  2⤵
  PID:1568
- C:\Windows\System\HhVNNKR.exe
  C:\Windows\System\HhVNNKR.exe
  2⤵
  PID:4400
- C:\Windows\System\dBUBfgO.exe
  C:\Windows\System\dBUBfgO.exe
  2⤵
  PID:4432
- C:\Windows\System\pYFLMbE.exe
  C:\Windows\System\pYFLMbE.exe
  2⤵
  PID:4480
- C:\Windows\System\OVKJDMI.exe
  C:\Windows\System\OVKJDMI.exe
  2⤵
  PID:4464
- C:\Windows\System\LVRbSTU.exe
  C:\Windows\System\LVRbSTU.exe
  2⤵
  PID:4516
- C:\Windows\System\AzcjMcl.exe
  C:\Windows\System\AzcjMcl.exe
  2⤵
  PID:4528
- C:\Windows\System\pXksGZP.exe
  C:\Windows\System\pXksGZP.exe
  2⤵
  PID:4576
- C:\Windows\System\sNlLAZp.exe
  C:\Windows\System\sNlLAZp.exe
  2⤵
  PID:1384
- C:\Windows\System\SiUOvSg.exe
  C:\Windows\System\SiUOvSg.exe
  2⤵
  PID:4592
- C:\Windows\System\eXLNSKf.exe
  C:\Windows\System\eXLNSKf.exe
  2⤵
  PID:4596
- C:\Windows\System\XaFmszj.exe
  C:\Windows\System\XaFmszj.exe
  2⤵
  PID:4628
- C:\Windows\System\gaEhNyO.exe
  C:\Windows\System\gaEhNyO.exe
  2⤵
  PID:4676
- C:\Windows\System\nvChrzJ.exe
  C:\Windows\System\nvChrzJ.exe
  2⤵
  PID:764
- C:\Windows\System\wuvYHbF.exe
  C:\Windows\System\wuvYHbF.exe
  2⤵
  PID:1176
- C:\Windows\System\OqWSkHS.exe
  C:\Windows\System\OqWSkHS.exe
  2⤵
  PID:536
- C:\Windows\System\AXwUkDL.exe
  C:\Windows\System\AXwUkDL.exe
  2⤵
  PID:4772
- C:\Windows\System\RoAqcXz.exe
  C:\Windows\System\RoAqcXz.exe
  2⤵
  PID:4840
- C:\Windows\System\GjKCAWQ.exe
  C:\Windows\System\GjKCAWQ.exe
  2⤵
  PID:4904
- C:\Windows\System\pETAEkv.exe
  C:\Windows\System\pETAEkv.exe
  2⤵
  PID:4688
- C:\Windows\System\cxsJGVB.exe
  C:\Windows\System\cxsJGVB.exe
  2⤵
  PID:1192
- C:\Windows\System\FBECRXu.exe
  C:\Windows\System\FBECRXu.exe
  2⤵
  PID:4960
- C:\Windows\System\mtOptvg.exe
  C:\Windows\System\mtOptvg.exe
  2⤵
  PID:4724
- C:\Windows\System\zrdIeOJ.exe
  C:\Windows\System\zrdIeOJ.exe
  2⤵
  PID:4892
- C:\Windows\System\kvdNHJB.exe
  C:\Windows\System\kvdNHJB.exe
  2⤵
  PID:4856
- C:\Windows\System\mEkthvQ.exe
  C:\Windows\System\mEkthvQ.exe
  2⤵
  PID:4784
- C:\Windows\System\VWgRHsd.exe
  C:\Windows\System\VWgRHsd.exe
  2⤵
  PID:2196
- C:\Windows\System\shCLmhX.exe
  C:\Windows\System\shCLmhX.exe
  2⤵
  PID:5004
- C:\Windows\System\xclsbDA.exe
  C:\Windows\System\xclsbDA.exe
  2⤵
  PID:5020
- C:\Windows\System\TDWmtqX.exe
  C:\Windows\System\TDWmtqX.exe
  2⤵
  PID:5040
- C:\Windows\System\RgHNRda.exe
  C:\Windows\System\RgHNRda.exe
  2⤵
  PID:5052
- C:\Windows\System\SIoAEMB.exe
  C:\Windows\System\SIoAEMB.exe
  2⤵
  PID:5072
- C:\Windows\System\enWebst.exe
  C:\Windows\System\enWebst.exe
  2⤵
  PID:5084
- C:\Windows\System\kNmrFBK.exe
  C:\Windows\System\kNmrFBK.exe
  2⤵
  PID:5100
- C:\Windows\System\uTUhOTY.exe
  C:\Windows\System\uTUhOTY.exe
  2⤵
  PID:5116
- C:\Windows\System\JxdkUuA.exe
  C:\Windows\System\JxdkUuA.exe
  2⤵
  PID:2752
- C:\Windows\System\bPcaYLN.exe
  C:\Windows\System\bPcaYLN.exe
  2⤵
  PID:3572
- C:\Windows\System\uuLGFLX.exe
  C:\Windows\System\uuLGFLX.exe
  2⤵
  PID:2772
- C:\Windows\System\juWgwOl.exe
  C:\Windows\System\juWgwOl.exe
  2⤵
  PID:3828
- C:\Windows\System\NNFqznL.exe
  C:\Windows\System\NNFqznL.exe
  2⤵
  PID:2632
- C:\Windows\System\MAhhtXY.exe
  C:\Windows\System\MAhhtXY.exe
  2⤵
  PID:4180
- C:\Windows\System\piMPvFK.exe
  C:\Windows\System\piMPvFK.exe
  2⤵
  PID:4272
- C:\Windows\System\BQVTWIr.exe
  C:\Windows\System\BQVTWIr.exe
  2⤵
  PID:4100
- C:\Windows\System\bOarseq.exe
  C:\Windows\System\bOarseq.exe
  2⤵
  PID:1104
- C:\Windows\System\netRnGy.exe
  C:\Windows\System\netRnGy.exe
  2⤵
  PID:4160
- C:\Windows\System\OCHILwV.exe
  C:\Windows\System\OCHILwV.exe
  2⤵
  PID:4256
- C:\Windows\System\hecEpGp.exe
  C:\Windows\System\hecEpGp.exe
  2⤵
  PID:4452
- C:\Windows\System\huucyOF.exe
  C:\Windows\System\huucyOF.exe
  2⤵
  PID:4352
- C:\Windows\System\WEBnmIV.exe
  C:\Windows\System\WEBnmIV.exe
  2⤵
  PID:1708
- C:\Windows\System\oSKmIkp.exe
  C:\Windows\System\oSKmIkp.exe
  2⤵
  PID:1840
- C:\Windows\System\ffDNJjy.exe
  C:\Windows\System\ffDNJjy.exe
  2⤵
  PID:2128
- C:\Windows\System\vGHavXx.exe
  C:\Windows\System\vGHavXx.exe
  2⤵
  PID:4660
- C:\Windows\System\lWSglOe.exe
  C:\Windows\System\lWSglOe.exe
  2⤵
  PID:4708
- C:\Windows\System\SBTtnLk.exe
  C:\Windows\System\SBTtnLk.exe
  2⤵
  PID:4876
- C:\Windows\System\MgXVhWS.exe
  C:\Windows\System\MgXVhWS.exe
  2⤵
  PID:4936
- C:\Windows\System\uuwazYj.exe
  C:\Windows\System\uuwazYj.exe
  2⤵
  PID:4888
- C:\Windows\System\vdPHtxV.exe
  C:\Windows\System\vdPHtxV.exe
  2⤵
  PID:4752
- C:\Windows\System\HVnqNSH.exe
  C:\Windows\System\HVnqNSH.exe
  2⤵
  PID:1392
- C:\Windows\System\kfSbUKX.exe
  C:\Windows\System\kfSbUKX.exe
  2⤵
  PID:4852
- C:\Windows\System\leCzEyQ.exe
  C:\Windows\System\leCzEyQ.exe
  2⤵
  PID:5048
- C:\Windows\System\vXxXNWK.exe
  C:\Windows\System\vXxXNWK.exe
  2⤵
  PID:5108
- C:\Windows\System\DRilqmk.exe
  C:\Windows\System\DRilqmk.exe
  2⤵
  PID:3560
- C:\Windows\System\nZDapzx.exe
  C:\Windows\System\nZDapzx.exe
  2⤵
  PID:2988
- C:\Windows\System\ewLufca.exe
  C:\Windows\System\ewLufca.exe
  2⤵
  PID:2208
- C:\Windows\System\woNrXCU.exe
  C:\Windows\System\woNrXCU.exe
  2⤵
  PID:3896
- C:\Windows\System\LrXaatD.exe
  C:\Windows\System\LrXaatD.exe
  2⤵
  PID:2320
- C:\Windows\System\yVxNfuw.exe
  C:\Windows\System\yVxNfuw.exe
  2⤵
  PID:4368
- C:\Windows\System\zOLvQEw.exe
  C:\Windows\System\zOLvQEw.exe
  2⤵
  PID:4420
- C:\Windows\System\WHMVZHT.exe
  C:\Windows\System\WHMVZHT.exe
  2⤵
  PID:1940
- C:\Windows\System\lJDPvna.exe
  C:\Windows\System\lJDPvna.exe
  2⤵
  PID:4372
- C:\Windows\System\xhcuExe.exe
  C:\Windows\System\xhcuExe.exe
  2⤵
  PID:4548
- C:\Windows\System\tnCDuUu.exe
  C:\Windows\System\tnCDuUu.exe
  2⤵
  PID:4720
- C:\Windows\System\gqhjcjG.exe
  C:\Windows\System\gqhjcjG.exe
  2⤵
  PID:4640
- C:\Windows\System\mFLWhGs.exe
  C:\Windows\System\mFLWhGs.exe
  2⤵
  PID:5044
- C:\Windows\System\MdqckKY.exe
  C:\Windows\System\MdqckKY.exe
  2⤵
  PID:2952
- C:\Windows\System\LwEJLQM.exe
  C:\Windows\System\LwEJLQM.exe
  2⤵
  PID:5068
- C:\Windows\System\WRtjedE.exe
  C:\Windows\System\WRtjedE.exe
  2⤵
  PID:4996
- C:\Windows\System\bsHZXMk.exe
  C:\Windows\System\bsHZXMk.exe
  2⤵
  PID:4288
- C:\Windows\System\QyqSmAx.exe
  C:\Windows\System\QyqSmAx.exe
  2⤵
  PID:4144
- C:\Windows\System\sBsJSUc.exe
  C:\Windows\System\sBsJSUc.exe
  2⤵
  PID:4072
- C:\Windows\System\obsHMIe.exe
  C:\Windows\System\obsHMIe.exe
  2⤵
  PID:4820
- C:\Windows\System\bzjAJoK.exe
  C:\Windows\System\bzjAJoK.exe
  2⤵
  PID:4612
- C:\Windows\System\KyeFObY.exe
  C:\Windows\System\KyeFObY.exe
  2⤵
  PID:1352
- C:\Windows\System\AtmtIQW.exe
  C:\Windows\System\AtmtIQW.exe
  2⤵
  PID:5012
- C:\Windows\System\rGNjmgx.exe
  C:\Windows\System\rGNjmgx.exe
  2⤵
  PID:4240
- C:\Windows\System\UxMJpzI.exe
  C:\Windows\System\UxMJpzI.exe
  2⤵
  PID:4624
- C:\Windows\System\sqUXwky.exe
  C:\Windows\System\sqUXwky.exe
  2⤵
  PID:1852
- C:\Windows\System\mXuVcwF.exe
  C:\Windows\System\mXuVcwF.exe
  2⤵
  PID:4644
- C:\Windows\System\sfXXiVd.exe
  C:\Windows\System\sfXXiVd.exe
  2⤵
  PID:3928
- C:\Windows\System\YirmkqF.exe
  C:\Windows\System\YirmkqF.exe
  2⤵
  PID:4116
- C:\Windows\System\hBKhFGW.exe
  C:\Windows\System\hBKhFGW.exe
  2⤵
  PID:5136
- C:\Windows\System\QDxqLTa.exe
  C:\Windows\System\QDxqLTa.exe
  2⤵
  PID:5152
- C:\Windows\System\zmehzfE.exe
  C:\Windows\System\zmehzfE.exe
  2⤵
  PID:5168
- C:\Windows\System\KpKxiwf.exe
  C:\Windows\System\KpKxiwf.exe
  2⤵
  PID:5184
- C:\Windows\System\JPeQLsW.exe
  C:\Windows\System\JPeQLsW.exe
  2⤵
  PID:5200
- C:\Windows\System\bZwQntj.exe
  C:\Windows\System\bZwQntj.exe
  2⤵
  PID:5216
- C:\Windows\System\TCjvwho.exe
  C:\Windows\System\TCjvwho.exe
  2⤵
  PID:5232
- C:\Windows\System\qtqZxis.exe
  C:\Windows\System\qtqZxis.exe
  2⤵
  PID:5248
- C:\Windows\System\LyOQzeH.exe
  C:\Windows\System\LyOQzeH.exe
  2⤵
  PID:5264
- C:\Windows\System\PCGtQTA.exe
  C:\Windows\System\PCGtQTA.exe
  2⤵
  PID:5280
- C:\Windows\System\LRqJvDR.exe
  C:\Windows\System\LRqJvDR.exe
  2⤵
  PID:5296
- C:\Windows\System\pfTNnez.exe
  C:\Windows\System\pfTNnez.exe
  2⤵
  PID:5312
- C:\Windows\System\pMAXZZx.exe
  C:\Windows\System\pMAXZZx.exe
  2⤵
  PID:5328
- C:\Windows\System\ldwzzek.exe
  C:\Windows\System\ldwzzek.exe
  2⤵
  PID:5344
- C:\Windows\System\XwOmukV.exe
  C:\Windows\System\XwOmukV.exe
  2⤵
  PID:5360
- C:\Windows\System\dhsRmSf.exe
  C:\Windows\System\dhsRmSf.exe
  2⤵
  PID:5376
- C:\Windows\System\tEnHrDu.exe
  C:\Windows\System\tEnHrDu.exe
  2⤵
  PID:5392
- C:\Windows\System\kAXBtEh.exe
  C:\Windows\System\kAXBtEh.exe
  2⤵
  PID:5408
- C:\Windows\System\HqdgDwX.exe
  C:\Windows\System\HqdgDwX.exe
  2⤵
  PID:5424
- C:\Windows\System\VmbpXZR.exe
  C:\Windows\System\VmbpXZR.exe
  2⤵
  PID:5440
- C:\Windows\System\sqqfUZG.exe
  C:\Windows\System\sqqfUZG.exe
  2⤵
  PID:5456
- C:\Windows\System\tbqwcee.exe
  C:\Windows\System\tbqwcee.exe
  2⤵
  PID:5472
- C:\Windows\System\ixbZJGi.exe
  C:\Windows\System\ixbZJGi.exe
  2⤵
  PID:5488
- C:\Windows\System\cUMEsQY.exe
  C:\Windows\System\cUMEsQY.exe
  2⤵
  PID:5504
- C:\Windows\System\fqgRbVH.exe
  C:\Windows\System\fqgRbVH.exe
  2⤵
  PID:5520
- C:\Windows\System\Fpppmzt.exe
  C:\Windows\System\Fpppmzt.exe
  2⤵
  PID:5536
- C:\Windows\System\lCweuew.exe
  C:\Windows\System\lCweuew.exe
  2⤵
  PID:5552
- C:\Windows\System\CyIPxZx.exe
  C:\Windows\System\CyIPxZx.exe
  2⤵
  PID:5568
- C:\Windows\System\TGSDWFi.exe
  C:\Windows\System\TGSDWFi.exe
  2⤵
  PID:5584
- C:\Windows\System\ttfZtXZ.exe
  C:\Windows\System\ttfZtXZ.exe
  2⤵
  PID:5600
- C:\Windows\System\DsMSQlp.exe
  C:\Windows\System\DsMSQlp.exe
  2⤵
  PID:5616
- C:\Windows\System\imXimWq.exe
  C:\Windows\System\imXimWq.exe
  2⤵
  PID:5632
- C:\Windows\System\qMfsuYA.exe
  C:\Windows\System\qMfsuYA.exe
  2⤵
  PID:5648
- C:\Windows\System\BVbZDuW.exe
  C:\Windows\System\BVbZDuW.exe
  2⤵
  PID:5664
- C:\Windows\System\vzpJQNG.exe
  C:\Windows\System\vzpJQNG.exe
  2⤵
  PID:5680
- C:\Windows\System\ZRNCoQp.exe
  C:\Windows\System\ZRNCoQp.exe
  2⤵
  PID:5696
- C:\Windows\System\uHazcud.exe
  C:\Windows\System\uHazcud.exe
  2⤵
  PID:5712
- C:\Windows\System\MbOGJrY.exe
  C:\Windows\System\MbOGJrY.exe
  2⤵
  PID:5728
- C:\Windows\System\iJxvqRK.exe
  C:\Windows\System\iJxvqRK.exe
  2⤵
  PID:5744
- C:\Windows\System\nMGXlOl.exe
  C:\Windows\System\nMGXlOl.exe
  2⤵
  PID:5760
- C:\Windows\System\nYLeFmJ.exe
  C:\Windows\System\nYLeFmJ.exe
  2⤵
  PID:5776
- C:\Windows\System\YVMlUJZ.exe
  C:\Windows\System\YVMlUJZ.exe
  2⤵
  PID:5792
- C:\Windows\System\zhTDOUp.exe
  C:\Windows\System\zhTDOUp.exe
  2⤵
  PID:5808
- C:\Windows\System\xAARPLs.exe
  C:\Windows\System\xAARPLs.exe
  2⤵
  PID:5824
- C:\Windows\System\TIDQbZt.exe
  C:\Windows\System\TIDQbZt.exe
  2⤵
  PID:5840
- C:\Windows\System\dzSqDlc.exe
  C:\Windows\System\dzSqDlc.exe
  2⤵
  PID:5856
- C:\Windows\System\ipVWdIX.exe
  C:\Windows\System\ipVWdIX.exe
  2⤵
  PID:5872
- C:\Windows\System\OrkhZwn.exe
  C:\Windows\System\OrkhZwn.exe
  2⤵
  PID:5888
- C:\Windows\System\RijEIoT.exe
  C:\Windows\System\RijEIoT.exe
  2⤵
  PID:5904
- C:\Windows\System\JnPnuAi.exe
  C:\Windows\System\JnPnuAi.exe
  2⤵
  PID:5920
- C:\Windows\System\nbcatzI.exe
  C:\Windows\System\nbcatzI.exe
  2⤵
  PID:5936
- C:\Windows\System\JTCvXhd.exe
  C:\Windows\System\JTCvXhd.exe
  2⤵
  PID:5952
- C:\Windows\System\pMcWSPL.exe
  C:\Windows\System\pMcWSPL.exe
  2⤵
  PID:5968
- C:\Windows\System\agYVjsu.exe
  C:\Windows\System\agYVjsu.exe
  2⤵
  PID:5984
- C:\Windows\System\NNLgxEu.exe
  C:\Windows\System\NNLgxEu.exe
  2⤵
  PID:6000
- C:\Windows\System\lDETVjs.exe
  C:\Windows\System\lDETVjs.exe
  2⤵
  PID:6016
- C:\Windows\System\SYUXGGT.exe
  C:\Windows\System\SYUXGGT.exe
  2⤵
  PID:6032
- C:\Windows\System\lnYlvAu.exe
  C:\Windows\System\lnYlvAu.exe
  2⤵
  PID:6048
- C:\Windows\System\avfnwYV.exe
  C:\Windows\System\avfnwYV.exe
  2⤵
  PID:6064
- C:\Windows\System\efTqSQH.exe
  C:\Windows\System\efTqSQH.exe
  2⤵
  PID:6080
- C:\Windows\System\MEtcbQN.exe
  C:\Windows\System\MEtcbQN.exe
  2⤵
  PID:6096
- C:\Windows\System\WuFjbIN.exe
  C:\Windows\System\WuFjbIN.exe
  2⤵
  PID:6112
- C:\Windows\System\woffihm.exe
  C:\Windows\System\woffihm.exe
  2⤵
  PID:6128
- C:\Windows\System\fDTYWfm.exe
  C:\Windows\System\fDTYWfm.exe
  2⤵
  PID:5128
- C:\Windows\System\NQNzWGa.exe
  C:\Windows\System\NQNzWGa.exe
  2⤵
  PID:5160
- C:\Windows\System\OowUoan.exe
  C:\Windows\System\OowUoan.exe
  2⤵
  PID:5192
- C:\Windows\System\MUpcsUf.exe
  C:\Windows\System\MUpcsUf.exe
  2⤵
  PID:5224
- C:\Windows\System\DwofXmB.exe
  C:\Windows\System\DwofXmB.exe
  2⤵
  PID:5244
- C:\Windows\System\XklOSae.exe
  C:\Windows\System\XklOSae.exe
  2⤵
  PID:5288
- C:\Windows\System\rBixoPZ.exe
  C:\Windows\System\rBixoPZ.exe
  2⤵
  PID:5304
- C:\Windows\System\vDMLFVF.exe
  C:\Windows\System\vDMLFVF.exe
  2⤵
  PID:5324
- C:\Windows\System\oIfaDSV.exe
  C:\Windows\System\oIfaDSV.exe
  2⤵
  PID:5368
- C:\Windows\System\sWoLWKy.exe
  C:\Windows\System\sWoLWKy.exe
  2⤵
  PID:5416
- C:\Windows\System\jsbgMPW.exe
  C:\Windows\System\jsbgMPW.exe
  2⤵
  PID:5400
- C:\Windows\System\oDCJNAx.exe
  C:\Windows\System\oDCJNAx.exe
  2⤵
  PID:5436
- C:\Windows\System\xqJzWoM.exe
  C:\Windows\System\xqJzWoM.exe
  2⤵
  PID:5512
- C:\Windows\System\QwMEmLD.exe
  C:\Windows\System\QwMEmLD.exe
  2⤵
  PID:5544
- C:\Windows\System\iNwwSTj.exe
  C:\Windows\System\iNwwSTj.exe
  2⤵
  PID:5560
- C:\Windows\System\tCpaqhb.exe
  C:\Windows\System\tCpaqhb.exe
  2⤵
  PID:5608
- C:\Windows\System\EzaDDkb.exe
  C:\Windows\System\EzaDDkb.exe
  2⤵
  PID:5624
- C:\Windows\System\RvejKvp.exe
  C:\Windows\System\RvejKvp.exe
  2⤵
  PID:5656
- C:\Windows\System\jkjKOze.exe
  C:\Windows\System\jkjKOze.exe
  2⤵
  PID:5688
- C:\Windows\System\eqaHlRb.exe
  C:\Windows\System\eqaHlRb.exe
  2⤵
  PID:5736
- C:\Windows\System\bHHFbCW.exe
  C:\Windows\System\bHHFbCW.exe
  2⤵
  PID:5752
- C:\Windows\System\YmwIctQ.exe
  C:\Windows\System\YmwIctQ.exe
  2⤵
  PID:5800
- C:\Windows\System\mkkwYBT.exe
  C:\Windows\System\mkkwYBT.exe
  2⤵
  PID:5832
- C:\Windows\System\NcAtcAl.exe
  C:\Windows\System\NcAtcAl.exe
  2⤵
  PID:5868
- C:\Windows\System\UJQPzuy.exe
  C:\Windows\System\UJQPzuy.exe
  2⤵
  PID:5820
- C:\Windows\System\DECzshA.exe
  C:\Windows\System\DECzshA.exe
  2⤵
  PID:5912
- C:\Windows\System\xiWilbC.exe
  C:\Windows\System\xiWilbC.exe
  2⤵
  PID:5944
- C:\Windows\System\IjjjNHV.exe
  C:\Windows\System\IjjjNHV.exe
  2⤵
  PID:5996
- C:\Windows\System\gMQwrTO.exe
  C:\Windows\System\gMQwrTO.exe
  2⤵
  PID:6012
- C:\Windows\System\MZgCLPM.exe
  C:\Windows\System\MZgCLPM.exe
  2⤵
  PID:6056
- C:\Windows\System\hUORZgK.exe
  C:\Windows\System\hUORZgK.exe
  2⤵
  PID:6120
- C:\Windows\System\xAZfUhq.exe
  C:\Windows\System\xAZfUhq.exe
  2⤵
  PID:5132
- C:\Windows\System\cXbGkkI.exe
  C:\Windows\System\cXbGkkI.exe
  2⤵
  PID:6108
- C:\Windows\System\MBsGKqT.exe
  C:\Windows\System\MBsGKqT.exe
  2⤵
  PID:6140
- C:\Windows\System\cuvvKap.exe
  C:\Windows\System\cuvvKap.exe
  2⤵
  PID:5148
- C:\Windows\System\uLijAxt.exe
  C:\Windows\System\uLijAxt.exe
  2⤵
  PID:5272
- C:\Windows\System\dTTFtqj.exe
  C:\Windows\System\dTTFtqj.exe
  2⤵
  PID:5384
- C:\Windows\System\DykSKJS.exe
  C:\Windows\System\DykSKJS.exe
  2⤵
  PID:5340
- C:\Windows\System\bdKbqMS.exe
  C:\Windows\System\bdKbqMS.exe
  2⤵
  PID:5480
- C:\Windows\System\WPjjtXl.exe
  C:\Windows\System\WPjjtXl.exe
  2⤵
  PID:5580
- C:\Windows\System\rlpNaYJ.exe
  C:\Windows\System\rlpNaYJ.exe
  2⤵
  PID:5528
- C:\Windows\System\EriPijO.exe
  C:\Windows\System\EriPijO.exe
  2⤵
  PID:5676
- C:\Windows\System\jHQqIGb.exe
  C:\Windows\System\jHQqIGb.exe
  2⤵
  PID:5772
- C:\Windows\System\vunthnK.exe
  C:\Windows\System\vunthnK.exe
  2⤵
  PID:5788
- C:\Windows\System\rjESnvc.exe
  C:\Windows\System\rjESnvc.exe
  2⤵
  PID:5884
- C:\Windows\System\gZxICpd.exe
  C:\Windows\System\gZxICpd.exe
  2⤵
  PID:5964
- C:\Windows\System\erWGvrx.exe
  C:\Windows\System\erWGvrx.exe
  2⤵
  PID:6024
- C:\Windows\System\vFcjJwe.exe
  C:\Windows\System\vFcjJwe.exe
  2⤵
  PID:6072
- C:\Windows\System\xtOObrw.exe
  C:\Windows\System\xtOObrw.exe
  2⤵
  PID:6088
- C:\Windows\System\HLVhCDe.exe
  C:\Windows\System\HLVhCDe.exe
  2⤵
  PID:5180
- C:\Windows\System\KzpPZkV.exe
  C:\Windows\System\KzpPZkV.exe
  2⤵
  PID:5320
- C:\Windows\System\dErKeqs.exe
  C:\Windows\System\dErKeqs.exe
  2⤵
  PID:5516
- C:\Windows\System\CrRQIyf.exe
  C:\Windows\System\CrRQIyf.exe
  2⤵
  PID:5596
- C:\Windows\System\RgShuzN.exe
  C:\Windows\System\RgShuzN.exe
  2⤵
  PID:5756
- C:\Windows\System\oygRCNC.exe
  C:\Windows\System\oygRCNC.exe
  2⤵
  PID:5836
- C:\Windows\System\htlUqgr.exe
  C:\Windows\System\htlUqgr.exe
  2⤵
  PID:5948
- C:\Windows\System\vaGyqQO.exe
  C:\Windows\System\vaGyqQO.exe
  2⤵
  PID:6076
- C:\Windows\System\yqSrPzp.exe
  C:\Windows\System\yqSrPzp.exe
  2⤵
  PID:5260
- C:\Windows\System\RuJMarc.exe
  C:\Windows\System\RuJMarc.exe
  2⤵
  PID:5644
- C:\Windows\System\ejvPIik.exe
  C:\Windows\System\ejvPIik.exe
  2⤵
  PID:5452
- C:\Windows\System\NiRRuvL.exe
  C:\Windows\System\NiRRuvL.exe
  2⤵
  PID:6044
- C:\Windows\System\KtJjrgi.exe
  C:\Windows\System\KtJjrgi.exe
  2⤵
  PID:5928
- C:\Windows\System\RUZNoys.exe
  C:\Windows\System\RUZNoys.exe
  2⤵
  PID:6104
- C:\Windows\System\JHbymQw.exe
  C:\Windows\System\JHbymQw.exe
  2⤵
  PID:5532
- C:\Windows\System\iAoLJuC.exe
  C:\Windows\System\iAoLJuC.exe
  2⤵
  PID:6152
- C:\Windows\System\UXpxJMp.exe
  C:\Windows\System\UXpxJMp.exe
  2⤵
  PID:6168
- C:\Windows\System\xqhNxsU.exe
  C:\Windows\System\xqhNxsU.exe
  2⤵
  PID:6184
- C:\Windows\System\KGZXcUy.exe
  C:\Windows\System\KGZXcUy.exe
  2⤵
  PID:6204
- C:\Windows\System\WQGosss.exe
  C:\Windows\System\WQGosss.exe
  2⤵
  PID:6220
- C:\Windows\System\nqrPVtc.exe
  C:\Windows\System\nqrPVtc.exe
  2⤵
  PID:6236
- C:\Windows\System\PCYiHqW.exe
  C:\Windows\System\PCYiHqW.exe
  2⤵
  PID:6252
- C:\Windows\System\wGQyexa.exe
  C:\Windows\System\wGQyexa.exe
  2⤵
  PID:6268
- C:\Windows\System\WPpZYDZ.exe
  C:\Windows\System\WPpZYDZ.exe
  2⤵
  PID:6284
- C:\Windows\System\hFoiYho.exe
  C:\Windows\System\hFoiYho.exe
  2⤵
  PID:6300
- C:\Windows\System\UkKflgN.exe
  C:\Windows\System\UkKflgN.exe
  2⤵
  PID:6316
- C:\Windows\System\AQfxtoI.exe
  C:\Windows\System\AQfxtoI.exe
  2⤵
  PID:6332
- C:\Windows\System\cbvrQaH.exe
  C:\Windows\System\cbvrQaH.exe
  2⤵
  PID:6348
- C:\Windows\System\iCYggpl.exe
  C:\Windows\System\iCYggpl.exe
  2⤵
  PID:6364
- C:\Windows\System\utlLLWu.exe
  C:\Windows\System\utlLLWu.exe
  2⤵
  PID:6380
- C:\Windows\System\BBUFjtG.exe
  C:\Windows\System\BBUFjtG.exe
  2⤵
  PID:6396
- C:\Windows\System\MhsOeUH.exe
  C:\Windows\System\MhsOeUH.exe
  2⤵
  PID:6412
- C:\Windows\System\xebgcGj.exe
  C:\Windows\System\xebgcGj.exe
  2⤵
  PID:6428
- C:\Windows\System\JJbBPFD.exe
  C:\Windows\System\JJbBPFD.exe
  2⤵
  PID:6448
- C:\Windows\System\CloPVme.exe
  C:\Windows\System\CloPVme.exe
  2⤵
  PID:6464
- C:\Windows\System\CmJLAqk.exe
  C:\Windows\System\CmJLAqk.exe
  2⤵
  PID:6480
- C:\Windows\System\DldhjMr.exe
  C:\Windows\System\DldhjMr.exe
  2⤵
  PID:6496
- C:\Windows\System\KcnkGJD.exe
  C:\Windows\System\KcnkGJD.exe
  2⤵
  PID:6516
- C:\Windows\System\RcTAXak.exe
  C:\Windows\System\RcTAXak.exe
  2⤵
  PID:6532
- C:\Windows\System\UOoHIRj.exe
  C:\Windows\System\UOoHIRj.exe
  2⤵
  PID:6556
- C:\Windows\System\fSZhvHw.exe
  C:\Windows\System\fSZhvHw.exe
  2⤵
  PID:6572
- C:\Windows\System\YcPuJGE.exe
  C:\Windows\System\YcPuJGE.exe
  2⤵
  PID:6588
- C:\Windows\System\vDzWKeZ.exe
  C:\Windows\System\vDzWKeZ.exe
  2⤵
  PID:6604
- C:\Windows\System\FkAqKxZ.exe
  C:\Windows\System\FkAqKxZ.exe
  2⤵
  PID:6620
- C:\Windows\System\UaalRNf.exe
  C:\Windows\System\UaalRNf.exe
  2⤵
  PID:6636
- C:\Windows\System\kaedMen.exe
  C:\Windows\System\kaedMen.exe
  2⤵
  PID:6652
- C:\Windows\System\iVwfjoF.exe
  C:\Windows\System\iVwfjoF.exe
  2⤵
  PID:6668
- C:\Windows\System\nYtzpwK.exe
  C:\Windows\System\nYtzpwK.exe
  2⤵
  PID:6684
- C:\Windows\System\eGHIEXq.exe
  C:\Windows\System\eGHIEXq.exe
  2⤵
  PID:6700
- C:\Windows\System\ptuvxOw.exe
  C:\Windows\System\ptuvxOw.exe
  2⤵
  PID:6716
- C:\Windows\System\aKlSfAn.exe
  C:\Windows\System\aKlSfAn.exe
  2⤵
  PID:6732
- C:\Windows\System\LTIvaPP.exe
  C:\Windows\System\LTIvaPP.exe
  2⤵
  PID:6748
- C:\Windows\System\brqUlXo.exe
  C:\Windows\System\brqUlXo.exe
  2⤵
  PID:6800
- C:\Windows\System\lbkJsWD.exe
  C:\Windows\System\lbkJsWD.exe
  2⤵
  PID:6860
- C:\Windows\System\AWlsUMo.exe
  C:\Windows\System\AWlsUMo.exe
  2⤵
  PID:6880
- C:\Windows\System\LeKcNER.exe
  C:\Windows\System\LeKcNER.exe
  2⤵
  PID:6896
- C:\Windows\System\tqSJAGR.exe
  C:\Windows\System\tqSJAGR.exe
  2⤵
  PID:6920
- C:\Windows\System\gFLehau.exe
  C:\Windows\System\gFLehau.exe
  2⤵
  PID:6940
- C:\Windows\System\zzAbVri.exe
  C:\Windows\System\zzAbVri.exe
  2⤵
  PID:6956
- C:\Windows\System\XBfusDB.exe
  C:\Windows\System\XBfusDB.exe
  2⤵
  PID:6972
- C:\Windows\System\WHqbede.exe
  C:\Windows\System\WHqbede.exe
  2⤵
  PID:6992
- C:\Windows\System\HqAuBjy.exe
  C:\Windows\System\HqAuBjy.exe
  2⤵
  PID:7008
- C:\Windows\System\WrbDyEx.exe
  C:\Windows\System\WrbDyEx.exe
  2⤵
  PID:7024
- C:\Windows\System\ZekbDUd.exe
  C:\Windows\System\ZekbDUd.exe
  2⤵
  PID:7040
- C:\Windows\System\NrYabUz.exe
  C:\Windows\System\NrYabUz.exe
  2⤵
  PID:7060
- C:\Windows\System\UZGuQQd.exe
  C:\Windows\System\UZGuQQd.exe
  2⤵
  PID:7076
- C:\Windows\System\aisXymf.exe
  C:\Windows\System\aisXymf.exe
  2⤵
  PID:7096
- C:\Windows\System\ctDoYud.exe
  C:\Windows\System\ctDoYud.exe
  2⤵
  PID:7112
- C:\Windows\System\WpmvlSZ.exe
  C:\Windows\System\WpmvlSZ.exe
  2⤵
  PID:7128
- C:\Windows\System\zQWWLgl.exe
  C:\Windows\System\zQWWLgl.exe
  2⤵
  PID:7144
- C:\Windows\System\DSiKLbZ.exe
  C:\Windows\System\DSiKLbZ.exe
  2⤵
  PID:7160
- C:\Windows\System\hJCqmSC.exe
  C:\Windows\System\hJCqmSC.exe
  2⤵
  PID:6192
- C:\Windows\System\SQVzEBf.exe
  C:\Windows\System\SQVzEBf.exe
  2⤵
  PID:5144
- C:\Windows\System\uTdhOKa.exe
  C:\Windows\System\uTdhOKa.exe
  2⤵
  PID:6180
- C:\Windows\System\NDnsXeW.exe
  C:\Windows\System\NDnsXeW.exe
  2⤵
  PID:6296
- C:\Windows\System\zHujjzI.exe
  C:\Windows\System\zHujjzI.exe
  2⤵
  PID:6276
- C:\Windows\System\iyAYGUr.exe
  C:\Windows\System\iyAYGUr.exe
  2⤵
  PID:6356
- C:\Windows\System\dumvgZG.exe
  C:\Windows\System\dumvgZG.exe
  2⤵
  PID:6392
- C:\Windows\System\QHGItze.exe
  C:\Windows\System\QHGItze.exe
  2⤵
  PID:6436
- C:\Windows\System\VQWmTWA.exe
  C:\Windows\System\VQWmTWA.exe
  2⤵
  PID:6476
- C:\Windows\System\QNHXaTf.exe
  C:\Windows\System\QNHXaTf.exe
  2⤵
  PID:6540
- C:\Windows\System\LJCpGOO.exe
  C:\Windows\System\LJCpGOO.exe
  2⤵
  PID:6616
- C:\Windows\System\MnGOqdL.exe
  C:\Windows\System\MnGOqdL.exe
  2⤵
  PID:6660
- C:\Windows\System\bOSbapE.exe
  C:\Windows\System\bOSbapE.exe
  2⤵
  PID:6696
- C:\Windows\System\JeIKArv.exe
  C:\Windows\System\JeIKArv.exe
  2⤵
  PID:6728
- C:\Windows\System\AWMkZrD.exe
  C:\Windows\System\AWMkZrD.exe
  2⤵
  PID:6760
- C:\Windows\System\vTrfDoQ.exe
  C:\Windows\System\vTrfDoQ.exe
  2⤵
  PID:6776
- C:\Windows\System\RGNMiKl.exe
  C:\Windows\System\RGNMiKl.exe
  2⤵
  PID:6784
- C:\Windows\System\SLMTDMN.exe
  C:\Windows\System\SLMTDMN.exe
  2⤵
  PID:6816
- C:\Windows\System\kadwloA.exe
  C:\Windows\System\kadwloA.exe
  2⤵
  PID:6828
- C:\Windows\System\xlcGDUt.exe
  C:\Windows\System\xlcGDUt.exe
  2⤵
  PID:6872
- C:\Windows\System\txoSXbq.exe
  C:\Windows\System\txoSXbq.exe
  2⤵
  PID:6876
- C:\Windows\System\ylLGlGl.exe
  C:\Windows\System\ylLGlGl.exe
  2⤵
  PID:6908
- C:\Windows\System\XgLRKzk.exe
  C:\Windows\System\XgLRKzk.exe
  2⤵
  PID:6952
- C:\Windows\System\LapmARD.exe
  C:\Windows\System\LapmARD.exe
  2⤵
  PID:7000
- C:\Windows\System\wKvZMaJ.exe
  C:\Windows\System\wKvZMaJ.exe
  2⤵
  PID:7092
- C:\Windows\System\FUIabVB.exe
  C:\Windows\System\FUIabVB.exe
  2⤵
  PID:7152
- C:\Windows\System\IgBXgWG.exe
  C:\Windows\System\IgBXgWG.exe
  2⤵
  PID:6164
- C:\Windows\System\qVroMWB.exe
  C:\Windows\System\qVroMWB.exe
  2⤵
  PID:6176
- C:\Windows\System\gjPAkyH.exe
  C:\Windows\System\gjPAkyH.exe
  2⤵
  PID:6212
- C:\Windows\System\zxRkrLT.exe
  C:\Windows\System\zxRkrLT.exe
  2⤵
  PID:6312
- C:\Windows\System\DgvBaWW.exe
  C:\Windows\System\DgvBaWW.exe
  2⤵
  PID:6388
- C:\Windows\System\oqaSaDB.exe
  C:\Windows\System\oqaSaDB.exe
  2⤵
  PID:6456
- C:\Windows\System\lDCjuHf.exe
  C:\Windows\System\lDCjuHf.exe
  2⤵
  PID:6524
- C:\Windows\System\jIxLIqO.exe
  C:\Windows\System\jIxLIqO.exe
  2⤵
  PID:6528
- C:\Windows\System\gYSBUhT.exe
  C:\Windows\System\gYSBUhT.exe
  2⤵
  PID:6580
- C:\Windows\System\PbwFeuh.exe
  C:\Windows\System\PbwFeuh.exe
  2⤵
  PID:6680
- C:\Windows\System\DOuwVmQ.exe
  C:\Windows\System\DOuwVmQ.exe
  2⤵
  PID:6724
- C:\Windows\System\pJWqTGX.exe
  C:\Windows\System\pJWqTGX.exe
  2⤵
  PID:6812
- C:\Windows\System\scQKsqa.exe
  C:\Windows\System\scQKsqa.exe
  2⤵
  PID:6788
- C:\Windows\System\EZGeDjg.exe
  C:\Windows\System\EZGeDjg.exe
  2⤵
  PID:6868
- C:\Windows\System\mMnRslC.exe
  C:\Windows\System\mMnRslC.exe
  2⤵
  PID:6916
- C:\Windows\System\sSneUhI.exe
  C:\Windows\System\sSneUhI.exe
  2⤵
  PID:6964
- C:\Windows\System\AuhegmJ.exe
  C:\Windows\System\AuhegmJ.exe
  2⤵
  PID:7048
- C:\Windows\System\mdMGELE.exe
  C:\Windows\System\mdMGELE.exe
  2⤵
  PID:7108
- C:\Windows\System\zYEYsYL.exe
  C:\Windows\System\zYEYsYL.exe
  2⤵
  PID:6568
- C:\Windows\System\ImXtgME.exe
  C:\Windows\System\ImXtgME.exe
  2⤵
  PID:6824
- C:\Windows\System\khOzZiu.exe
  C:\Windows\System\khOzZiu.exe
  2⤵
  PID:6980
- C:\Windows\System\tLtBzBZ.exe
  C:\Windows\System\tLtBzBZ.exe
  2⤵
  PID:7020
- C:\Windows\System\vrYASBs.exe
  C:\Windows\System\vrYASBs.exe
  2⤵
  PID:7032
- C:\Windows\System\vkjcZPU.exe
  C:\Windows\System\vkjcZPU.exe
  2⤵
  PID:7084
- C:\Windows\System\PShoRlL.exe
  C:\Windows\System\PShoRlL.exe
  2⤵
  PID:6200
- C:\Windows\System\UkreMJF.exe
  C:\Windows\System\UkreMJF.exe
  2⤵
  PID:6340
- C:\Windows\System\RMyslyr.exe
  C:\Windows\System\RMyslyr.exe
  2⤵
  PID:6376
- C:\Windows\System\DnGJKNt.exe
  C:\Windows\System\DnGJKNt.exe
  2⤵
  PID:6508
- C:\Windows\System\olvghUh.exe
  C:\Windows\System\olvghUh.exe
  2⤵
  PID:6512
- C:\Windows\System\rbcBfMK.exe
  C:\Windows\System\rbcBfMK.exe
  2⤵
  PID:6584
- C:\Windows\System\RsUlhLd.exe
  C:\Windows\System\RsUlhLd.exe
  2⤵
  PID:6772
- C:\Windows\System\Tjoghug.exe
  C:\Windows\System\Tjoghug.exe
  2⤵
  PID:6756
- C:\Windows\System\ZtWXcLW.exe
  C:\Windows\System\ZtWXcLW.exe
  2⤵
  PID:6408
- C:\Windows\System\MyCEPQN.exe
  C:\Windows\System\MyCEPQN.exe
  2⤵
  PID:6612
- C:\Windows\System\pcUCZKp.exe
  C:\Windows\System\pcUCZKp.exe
  2⤵
  PID:6984
- C:\Windows\System\yMlHVgB.exe
  C:\Windows\System\yMlHVgB.exe
  2⤵
  PID:6892
- C:\Windows\System\KqEfmYg.exe
  C:\Windows\System\KqEfmYg.exe
  2⤵
  PID:6712
- C:\Windows\System\TsXMsaM.exe
  C:\Windows\System\TsXMsaM.exe
  2⤵
  PID:7056
- C:\Windows\System\jXqqUSO.exe
  C:\Windows\System\jXqqUSO.exe
  2⤵
  PID:5960
- C:\Windows\System\ixOoyCf.exe
  C:\Windows\System\ixOoyCf.exe
  2⤵
  PID:6160
- C:\Windows\System\SGolJZe.exe
  C:\Windows\System\SGolJZe.exe
  2⤵
  PID:6460
- C:\Windows\System\dvtVvrv.exe
  C:\Windows\System\dvtVvrv.exe
  2⤵
  PID:6504
- C:\Windows\System\GViYEKy.exe
  C:\Windows\System\GViYEKy.exe
  2⤵
  PID:6552
- C:\Windows\System\AOeMSXe.exe
  C:\Windows\System\AOeMSXe.exe
  2⤵
  PID:7072
- C:\Windows\System\FUcfhKr.exe
  C:\Windows\System\FUcfhKr.exe
  2⤵
  PID:6216
- C:\Windows\System\KVcANKj.exe
  C:\Windows\System\KVcANKj.exe
  2⤵
  PID:7216
- C:\Windows\System\scVuPcO.exe
  C:\Windows\System\scVuPcO.exe
  2⤵
  PID:7244
- C:\Windows\System\hXlqxoB.exe
  C:\Windows\System\hXlqxoB.exe
  2⤵
  PID:7260
- C:\Windows\System\ruyDUTS.exe
  C:\Windows\System\ruyDUTS.exe
  2⤵
  PID:7280
- C:\Windows\System\ZksmCvo.exe
  C:\Windows\System\ZksmCvo.exe
  2⤵
  PID:7308
- C:\Windows\System\CSShvmp.exe
  C:\Windows\System\CSShvmp.exe
  2⤵
  PID:7332
- C:\Windows\System\GjhsfUP.exe
  C:\Windows\System\GjhsfUP.exe
  2⤵
  PID:7348
- C:\Windows\System\wJRPwyK.exe
  C:\Windows\System\wJRPwyK.exe
  2⤵
  PID:7364
- C:\Windows\System\RtSbwHE.exe
  C:\Windows\System\RtSbwHE.exe
  2⤵
  PID:7380
- C:\Windows\System\noNIWmX.exe
  C:\Windows\System\noNIWmX.exe
  2⤵
  PID:7396
- C:\Windows\System\YCygtGR.exe
  C:\Windows\System\YCygtGR.exe
  2⤵
  PID:7412
- C:\Windows\System\ThfPqXd.exe
  C:\Windows\System\ThfPqXd.exe
  2⤵
  PID:7428
- C:\Windows\System\xBzQLDm.exe
  C:\Windows\System\xBzQLDm.exe
  2⤵
  PID:7444
- C:\Windows\System\dpggqMb.exe
  C:\Windows\System\dpggqMb.exe
  2⤵
  PID:7460
- C:\Windows\System\busbnEa.exe
  C:\Windows\System\busbnEa.exe
  2⤵
  PID:7480
- C:\Windows\System\kzDRHxh.exe
  C:\Windows\System\kzDRHxh.exe
  2⤵
  PID:7500
- C:\Windows\System\rNmSgFQ.exe
  C:\Windows\System\rNmSgFQ.exe
  2⤵
  PID:7520
- C:\Windows\System\pHQRPNv.exe
  C:\Windows\System\pHQRPNv.exe
  2⤵
  PID:7536
- C:\Windows\System\VivYNTl.exe
  C:\Windows\System\VivYNTl.exe
  2⤵
  PID:7564
- C:\Windows\System\axvoKYK.exe
  C:\Windows\System\axvoKYK.exe
  2⤵
  PID:7580
- C:\Windows\System\yDftkfm.exe
  C:\Windows\System\yDftkfm.exe
  2⤵
  PID:7596
- C:\Windows\System\PVfQNWc.exe
  C:\Windows\System\PVfQNWc.exe
  2⤵
  PID:7612
- C:\Windows\System\WPUZLZI.exe
  C:\Windows\System\WPUZLZI.exe
  2⤵
  PID:7628
- C:\Windows\System\zHVrcRo.exe
  C:\Windows\System\zHVrcRo.exe
  2⤵
  PID:7644
- C:\Windows\System\dpIfRQj.exe
  C:\Windows\System\dpIfRQj.exe
  2⤵
  PID:7664
- C:\Windows\System\tLxMXBv.exe
  C:\Windows\System\tLxMXBv.exe
  2⤵
  PID:7688
- C:\Windows\System\sdSuYHc.exe
  C:\Windows\System\sdSuYHc.exe
  2⤵
  PID:7708
- C:\Windows\System\PmdmUnL.exe
  C:\Windows\System\PmdmUnL.exe
  2⤵
  PID:7736
- C:\Windows\System\zuWFXII.exe
  C:\Windows\System\zuWFXII.exe
  2⤵
  PID:7752
- C:\Windows\System\IZEsIrR.exe
  C:\Windows\System\IZEsIrR.exe
  2⤵
  PID:7772
- C:\Windows\System\ENOZEHM.exe
  C:\Windows\System\ENOZEHM.exe
  2⤵
  PID:7796
- C:\Windows\System\QaKEnAF.exe
  C:\Windows\System\QaKEnAF.exe
  2⤵
  PID:7816
- C:\Windows\System\lCMYjud.exe
  C:\Windows\System\lCMYjud.exe
  2⤵
  PID:7832
- C:\Windows\System\SUbnFLh.exe
  C:\Windows\System\SUbnFLh.exe
  2⤵
  PID:7852
- C:\Windows\System\eOgqiNx.exe
  C:\Windows\System\eOgqiNx.exe
  2⤵
  PID:7868
- C:\Windows\System\NcCrMNo.exe
  C:\Windows\System\NcCrMNo.exe
  2⤵
  PID:7884
- C:\Windows\System\CPVzTBk.exe
  C:\Windows\System\CPVzTBk.exe
  2⤵
  PID:7900
- C:\Windows\System\NWMnJFB.exe
  C:\Windows\System\NWMnJFB.exe
  2⤵
  PID:7920
- C:\Windows\System\buKcvug.exe
  C:\Windows\System\buKcvug.exe
  2⤵
  PID:7936
- C:\Windows\System\eiayvLh.exe
  C:\Windows\System\eiayvLh.exe
  2⤵
  PID:7952
- C:\Windows\System\HuVcymb.exe
  C:\Windows\System\HuVcymb.exe
  2⤵
  PID:7972
- C:\Windows\System\IHMEGgK.exe
  C:\Windows\System\IHMEGgK.exe
  2⤵
  PID:7988
- C:\Windows\System\ATSrvVK.exe
  C:\Windows\System\ATSrvVK.exe
  2⤵
  PID:8004
- C:\Windows\System\UYTdqBs.exe
  C:\Windows\System\UYTdqBs.exe
  2⤵
  PID:8024
- C:\Windows\System\NISCpAs.exe
  C:\Windows\System\NISCpAs.exe
  2⤵
  PID:8044
- C:\Windows\System\RoDxaNS.exe
  C:\Windows\System\RoDxaNS.exe
  2⤵
  PID:8064
- C:\Windows\System\ullJNEM.exe
  C:\Windows\System\ullJNEM.exe
  2⤵
  PID:8080
- C:\Windows\System\NcjxnTj.exe
  C:\Windows\System\NcjxnTj.exe
  2⤵
  PID:8096
- C:\Windows\System\uIojgMA.exe
  C:\Windows\System\uIojgMA.exe
  2⤵
  PID:8116
- C:\Windows\System\ystfKbR.exe
  C:\Windows\System\ystfKbR.exe
  2⤵
  PID:8132
- C:\Windows\System\uDtbKfY.exe
  C:\Windows\System\uDtbKfY.exe
  2⤵
  PID:8148
- C:\Windows\System\HDVjXzp.exe
  C:\Windows\System\HDVjXzp.exe
  2⤵
  PID:8172
- C:\Windows\System\qnJVrAy.exe
  C:\Windows\System\qnJVrAy.exe
  2⤵
  PID:7140
- C:\Windows\System\stQLtGG.exe
  C:\Windows\System\stQLtGG.exe
  2⤵
  PID:7180
- C:\Windows\System\EZQyxrn.exe
  C:\Windows\System\EZQyxrn.exe
  2⤵
  PID:7196
- C:\Windows\System\sHcpvmy.exe
  C:\Windows\System\sHcpvmy.exe
  2⤵
  PID:7212
- C:\Windows\System\VtCzFVk.exe
  C:\Windows\System\VtCzFVk.exe
  2⤵
  PID:7236
- C:\Windows\System\KVPkkAh.exe
  C:\Windows\System\KVPkkAh.exe
  2⤵
  PID:7268
- C:\Windows\System\HCghOfr.exe
  C:\Windows\System\HCghOfr.exe
  2⤵
  PID:7292
- C:\Windows\System\XqaYVHP.exe
  C:\Windows\System\XqaYVHP.exe
  2⤵
  PID:7316
- C:\Windows\System\MeMzGFH.exe
  C:\Windows\System\MeMzGFH.exe
  2⤵
  PID:7372
- C:\Windows\System\kZRYFNJ.exe
  C:\Windows\System\kZRYFNJ.exe
  2⤵
  PID:7388
- C:\Windows\System\pHbHWGh.exe
  C:\Windows\System\pHbHWGh.exe
  2⤵
  PID:7408
- C:\Windows\System\lOPaBso.exe
  C:\Windows\System\lOPaBso.exe
  2⤵
  PID:7468
- C:\Windows\System\ZJmDBpQ.exe
  C:\Windows\System\ZJmDBpQ.exe
  2⤵
  PID:7472
- C:\Windows\System\rwdfFzn.exe
  C:\Windows\System\rwdfFzn.exe
  2⤵
  PID:7512
- C:\Windows\System\ptZynLq.exe
  C:\Windows\System\ptZynLq.exe
  2⤵
  PID:7492
- C:\Windows\System\aVtTFgP.exe
  C:\Windows\System\aVtTFgP.exe
  2⤵
  PID:7556
- C:\Windows\System\LUjbcMU.exe
  C:\Windows\System\LUjbcMU.exe
  2⤵
  PID:7588
- C:\Windows\System\jAJKZmX.exe
  C:\Windows\System\jAJKZmX.exe
  2⤵
  PID:7620
- C:\Windows\System\UmEgWJE.exe
  C:\Windows\System\UmEgWJE.exe
  2⤵
  PID:7636
- C:\Windows\System\BAHGqiE.exe
  C:\Windows\System\BAHGqiE.exe
  2⤵
  PID:7696
- C:\Windows\System\QczZtCo.exe
  C:\Windows\System\QczZtCo.exe
  2⤵
  PID:7720
- C:\Windows\System\KyfExwx.exe
  C:\Windows\System\KyfExwx.exe
  2⤵
  PID:7728
- C:\Windows\System\RPlhJRZ.exe
  C:\Windows\System\RPlhJRZ.exe
  2⤵
  PID:7768
- C:\Windows\System\HicKLKs.exe
  C:\Windows\System\HicKLKs.exe
  2⤵
  PID:7792
- C:\Windows\System\ChsCJva.exe
  C:\Windows\System\ChsCJva.exe
  2⤵
  PID:7840
- C:\Windows\System\iGXABxI.exe
  C:\Windows\System\iGXABxI.exe
  2⤵
  PID:7848
- C:\Windows\System\zddWVdg.exe
  C:\Windows\System\zddWVdg.exe
  2⤵
  PID:7880
- C:\Windows\System\ZhrxaZp.exe
  C:\Windows\System\ZhrxaZp.exe
  2⤵
  PID:7932
- C:\Windows\System\lJqMqkH.exe
  C:\Windows\System\lJqMqkH.exe
  2⤵
  PID:7912
- C:\Windows\System\hwxaZGc.exe
  C:\Windows\System\hwxaZGc.exe
  2⤵
  PID:7968
- C:\Windows\System\dTHnBeA.exe
  C:\Windows\System\dTHnBeA.exe
  2⤵
  PID:8040
- C:\Windows\System\mDLbDEr.exe
  C:\Windows\System\mDLbDEr.exe
  2⤵
  PID:8052
- C:\Windows\System\CCVvXdr.exe
  C:\Windows\System\CCVvXdr.exe
  2⤵
  PID:8060
- C:\Windows\System\pRbGyBJ.exe
  C:\Windows\System\pRbGyBJ.exe
  2⤵
  PID:8112
- C:\Windows\System\bjyNoca.exe
  C:\Windows\System\bjyNoca.exe
  2⤵
  PID:8092
- C:\Windows\System\gOHaEKt.exe
  C:\Windows\System\gOHaEKt.exe
  2⤵
  PID:8180
- C:\Windows\System\UWlOFJe.exe
  C:\Windows\System\UWlOFJe.exe
  2⤵
  PID:7188
- C:\Windows\System\ijxJOaJ.exe
  C:\Windows\System\ijxJOaJ.exe
  2⤵
  PID:7172
- C:\Windows\System\AaYutmm.exe
  C:\Windows\System\AaYutmm.exe
  2⤵
  PID:7240
- C:\Windows\System\PFXaAps.exe
  C:\Windows\System\PFXaAps.exe
  2⤵
  PID:7304
- C:\Windows\System\yxehTHt.exe
  C:\Windows\System\yxehTHt.exe
  2⤵
  PID:7360
- C:\Windows\System\fqJTnnn.exe
  C:\Windows\System\fqJTnnn.exe
  2⤵
  PID:7456
- C:\Windows\System\CHFLKIy.exe
  C:\Windows\System\CHFLKIy.exe
  2⤵
  PID:7660
- C:\Windows\System\UXeqDTX.exe
  C:\Windows\System\UXeqDTX.exe
  2⤵
  PID:7440
- C:\Windows\System\HUxEjsf.exe
  C:\Windows\System\HUxEjsf.exe
  2⤵
  PID:7672
- C:\Windows\System\xMUSsEw.exe
  C:\Windows\System\xMUSsEw.exe
  2⤵
  PID:7576
- C:\Windows\System\llGeTOy.exe
  C:\Windows\System\llGeTOy.exe
  2⤵
  PID:7788
- C:\Windows\System\FPWTvsz.exe
  C:\Windows\System\FPWTvsz.exe
  2⤵
  PID:7812
- C:\Windows\System\OqLoIIn.exe
  C:\Windows\System\OqLoIIn.exe
  2⤵
  PID:7928
- C:\Windows\System\ZHaRftU.exe
  C:\Windows\System\ZHaRftU.exe
  2⤵
  PID:7948
- C:\Windows\System\xYxKufW.exe
  C:\Windows\System\xYxKufW.exe
  2⤵
  PID:8016
- C:\Windows\System\pDeiQGf.exe
  C:\Windows\System\pDeiQGf.exe
  2⤵
  PID:8108
- C:\Windows\System\AbsuiPb.exe
  C:\Windows\System\AbsuiPb.exe
  2⤵
  PID:8188
- C:\Windows\System\sTEIbZH.exe
  C:\Windows\System\sTEIbZH.exe
  2⤵
  PID:7228
- C:\Windows\System\ewRnwVr.exe
  C:\Windows\System\ewRnwVr.exe
  2⤵
  PID:8032
- C:\Windows\System\nLgZPUX.exe
  C:\Windows\System\nLgZPUX.exe
  2⤵
  PID:7508
- C:\Windows\System\eYPjlpp.exe
  C:\Windows\System\eYPjlpp.exe
  2⤵
  PID:8160
- C:\Windows\System\fvUEzDC.exe
  C:\Windows\System\fvUEzDC.exe
  2⤵
  PID:7764
- C:\Windows\System\DYkAFKM.exe
  C:\Windows\System\DYkAFKM.exe
  2⤵
  PID:7844
- C:\Windows\System\yGkQgjJ.exe
  C:\Windows\System\yGkQgjJ.exe
  2⤵
  PID:7896
- C:\Windows\System\LDQKdXH.exe
  C:\Windows\System\LDQKdXH.exe
  2⤵
  PID:7828
- C:\Windows\System\mBXCYwb.exe
  C:\Windows\System\mBXCYwb.exe
  2⤵
  PID:7208
- C:\Windows\System\UygyRQr.exe
  C:\Windows\System\UygyRQr.exe
  2⤵
  PID:7340
- C:\Windows\System\MOLyndo.exe
  C:\Windows\System\MOLyndo.exe
  2⤵
  PID:7452
- C:\Windows\System\sLdLUqu.exe
  C:\Windows\System\sLdLUqu.exe
  2⤵
  PID:7488
- C:\Windows\System\UwonKxY.exe
  C:\Windows\System\UwonKxY.exe
  2⤵
  PID:8076
- C:\Windows\System\UjWzakC.exe
  C:\Windows\System\UjWzakC.exe
  2⤵
  PID:7684
- C:\Windows\System\fUNkGdW.exe
  C:\Windows\System\fUNkGdW.exe
  2⤵
  PID:8124
- C:\Windows\System\lndWLTO.exe
  C:\Windows\System\lndWLTO.exe
  2⤵
  PID:7392
- C:\Windows\System\APGBqjb.exe
  C:\Windows\System\APGBqjb.exe
  2⤵
  PID:7716
- C:\Windows\System\cPejkCt.exe
  C:\Windows\System\cPejkCt.exe
  2⤵
  PID:8088
- C:\Windows\System\zRgFhZd.exe
  C:\Windows\System\zRgFhZd.exe
  2⤵
  PID:7528
- C:\Windows\System\QBsKKGH.exe
  C:\Windows\System\QBsKKGH.exe
  2⤵
  PID:7908
- C:\Windows\System\IPAOKjm.exe
  C:\Windows\System\IPAOKjm.exe
  2⤵
  PID:7548
- C:\Windows\System\rWrhuFO.exe
  C:\Windows\System\rWrhuFO.exe
  2⤵
  PID:7680
- C:\Windows\System\NfbjbIr.exe
  C:\Windows\System\NfbjbIr.exe
  2⤵
  PID:7744
- C:\Windows\System\fbSwtTG.exe
  C:\Windows\System\fbSwtTG.exe
  2⤵
  PID:8208
- C:\Windows\System\zzDMlhT.exe
  C:\Windows\System\zzDMlhT.exe
  2⤵
  PID:8224
- C:\Windows\System\BCFuKvp.exe
  C:\Windows\System\BCFuKvp.exe
  2⤵
  PID:8240
- C:\Windows\System\qazXvMk.exe
  C:\Windows\System\qazXvMk.exe
  2⤵
  PID:8256
- C:\Windows\System\OAfNcpH.exe
  C:\Windows\System\OAfNcpH.exe
  2⤵
  PID:8272
- C:\Windows\System\fHPhLyL.exe
  C:\Windows\System\fHPhLyL.exe
  2⤵
  PID:8288
- C:\Windows\System\JPKTtua.exe
  C:\Windows\System\JPKTtua.exe
  2⤵
  PID:8308
- C:\Windows\System\ijDiiQy.exe
  C:\Windows\System\ijDiiQy.exe
  2⤵
  PID:8324
- C:\Windows\System\CWIyjoi.exe
  C:\Windows\System\CWIyjoi.exe
  2⤵
  PID:8340
- C:\Windows\System\AMKhlIK.exe
  C:\Windows\System\AMKhlIK.exe
  2⤵
  PID:8356
- C:\Windows\System\DNBfryD.exe
  C:\Windows\System\DNBfryD.exe
  2⤵
  PID:8372
- C:\Windows\System\xkFCPBr.exe
  C:\Windows\System\xkFCPBr.exe
  2⤵
  PID:8388
- C:\Windows\System\PhlBttZ.exe
  C:\Windows\System\PhlBttZ.exe
  2⤵
  PID:8404
- C:\Windows\System\dZBPABv.exe
  C:\Windows\System\dZBPABv.exe
  2⤵
  PID:8420
- C:\Windows\System\WRBhjFP.exe
  C:\Windows\System\WRBhjFP.exe
  2⤵
  PID:8436
- C:\Windows\System\urtyAWk.exe
  C:\Windows\System\urtyAWk.exe
  2⤵
  PID:8452
- C:\Windows\System\VzdhvPq.exe
  C:\Windows\System\VzdhvPq.exe
  2⤵
  PID:8472
- C:\Windows\System\tkorsBv.exe
  C:\Windows\System\tkorsBv.exe
  2⤵
  PID:8564
- C:\Windows\System\GkIbbyX.exe
  C:\Windows\System\GkIbbyX.exe
  2⤵
  PID:8580
- C:\Windows\System\bbTxJdB.exe
  C:\Windows\System\bbTxJdB.exe
  2⤵
  PID:8600
- C:\Windows\System\yQsqsCD.exe
  C:\Windows\System\yQsqsCD.exe
  2⤵
  PID:8616
- C:\Windows\System\xCqzKkE.exe
  C:\Windows\System\xCqzKkE.exe
  2⤵
  PID:8640
- C:\Windows\System\SgHkslW.exe
  C:\Windows\System\SgHkslW.exe
  2⤵
  PID:8676
- C:\Windows\System\RBeBmAl.exe
  C:\Windows\System\RBeBmAl.exe
  2⤵
  PID:8756
- C:\Windows\System\yxqrwBe.exe
  C:\Windows\System\yxqrwBe.exe
  2⤵
  PID:8776
- C:\Windows\System\aiibLkb.exe
  C:\Windows\System\aiibLkb.exe
  2⤵
  PID:8792
- C:\Windows\System\pureAuu.exe
  C:\Windows\System\pureAuu.exe
  2⤵
  PID:8808
- C:\Windows\System\KiwhEbP.exe
  C:\Windows\System\KiwhEbP.exe
  2⤵
  PID:8824
- C:\Windows\System\qQqeFtq.exe
  C:\Windows\System\qQqeFtq.exe
  2⤵
  PID:8840
- C:\Windows\System\wotpisK.exe
  C:\Windows\System\wotpisK.exe
  2⤵
  PID:8860
- C:\Windows\System\lXykwMJ.exe
  C:\Windows\System\lXykwMJ.exe
  2⤵
  PID:8880
- C:\Windows\System\IsnhKMI.exe
  C:\Windows\System\IsnhKMI.exe
  2⤵
  PID:8896
- C:\Windows\System\IAVzguu.exe
  C:\Windows\System\IAVzguu.exe
  2⤵
  PID:8912
- C:\Windows\System\AvexNWO.exe
  C:\Windows\System\AvexNWO.exe
  2⤵
  PID:8928
- C:\Windows\System\DEazhVh.exe
  C:\Windows\System\DEazhVh.exe
  2⤵
  PID:8944
- C:\Windows\System\GVWuTin.exe
  C:\Windows\System\GVWuTin.exe
  2⤵
  PID:8960
- C:\Windows\System\msSGLYy.exe
  C:\Windows\System\msSGLYy.exe
  2⤵
  PID:8976
- C:\Windows\System\sBECJFY.exe
  C:\Windows\System\sBECJFY.exe
  2⤵
  PID:8992
- C:\Windows\System\UTvyCTI.exe
  C:\Windows\System\UTvyCTI.exe
  2⤵
  PID:9008
- C:\Windows\System\YUwqfXE.exe
  C:\Windows\System\YUwqfXE.exe
  2⤵
  PID:9024
- C:\Windows\System\nFyCRLz.exe
  C:\Windows\System\nFyCRLz.exe
  2⤵
  PID:9040
- C:\Windows\System\Budejvg.exe
  C:\Windows\System\Budejvg.exe
  2⤵
  PID:9056
- C:\Windows\System\cFODPCb.exe
  C:\Windows\System\cFODPCb.exe
  2⤵
  PID:9072
- C:\Windows\System\FszfIyL.exe
  C:\Windows\System\FszfIyL.exe
  2⤵
  PID:9088
- C:\Windows\System\bkZUKTO.exe
  C:\Windows\System\bkZUKTO.exe
  2⤵
  PID:9104
- C:\Windows\System\EngCUtf.exe
  C:\Windows\System\EngCUtf.exe
  2⤵
  PID:9120
- C:\Windows\System\WxSNlBa.exe
  C:\Windows\System\WxSNlBa.exe
  2⤵
  PID:9136
- C:\Windows\System\LESruiS.exe
  C:\Windows\System\LESruiS.exe
  2⤵
  PID:9156
- C:\Windows\System\OAHpaKH.exe
  C:\Windows\System\OAHpaKH.exe
  2⤵
  PID:9180
- C:\Windows\System\mlXytMB.exe
  C:\Windows\System\mlXytMB.exe
  2⤵
  PID:9196
- C:\Windows\System\DVHiWop.exe
  C:\Windows\System\DVHiWop.exe
  2⤵
  PID:9212
- C:\Windows\System\rKoLeft.exe
  C:\Windows\System\rKoLeft.exe
  2⤵
  PID:8204
- C:\Windows\System\PriOwVV.exe
  C:\Windows\System\PriOwVV.exe
  2⤵
  PID:8220
- C:\Windows\System\oUKdDwP.exe
  C:\Windows\System\oUKdDwP.exe
  2⤵
  PID:8268
- C:\Windows\System\ivqbGWK.exe
  C:\Windows\System\ivqbGWK.exe
  2⤵
  PID:8320
- C:\Windows\System\WBXPUTy.exe
  C:\Windows\System\WBXPUTy.exe
  2⤵
  PID:8284
- C:\Windows\System\zWrrMtF.exe
  C:\Windows\System\zWrrMtF.exe
  2⤵
  PID:8364
- C:\Windows\System\DQCMOYU.exe
  C:\Windows\System\DQCMOYU.exe
  2⤵
  PID:8396
- C:\Windows\System\kjyahrz.exe
  C:\Windows\System\kjyahrz.exe
  2⤵
  PID:8428
- C:\Windows\System\VEYddXg.exe
  C:\Windows\System\VEYddXg.exe
  2⤵
  PID:8464
- C:\Windows\System\MDFFVIt.exe
  C:\Windows\System\MDFFVIt.exe
  2⤵
  PID:8484
- C:\Windows\System\GiFLrBo.exe
  C:\Windows\System\GiFLrBo.exe
  2⤵
  PID:8496
- C:\Windows\System\oKvduTA.exe
  C:\Windows\System\oKvduTA.exe
  2⤵
  PID:8512
- C:\Windows\System\KbZMbSa.exe
  C:\Windows\System\KbZMbSa.exe
  2⤵
  PID:8528
- C:\Windows\System\DOBgacy.exe
  C:\Windows\System\DOBgacy.exe
  2⤵
  PID:8608
- C:\Windows\System\eiZNvnz.exe
  C:\Windows\System\eiZNvnz.exe
  2⤵
  PID:8548
- C:\Windows\System\GLHDIJk.exe
  C:\Windows\System\GLHDIJk.exe
  2⤵
  PID:8592
- C:\Windows\System\AcwIspH.exe
  C:\Windows\System\AcwIspH.exe
  2⤵
  PID:8692
- C:\Windows\System\kERLSZh.exe
  C:\Windows\System\kERLSZh.exe
  2⤵
  PID:8708
- C:\Windows\System\kwUXdSz.exe
  C:\Windows\System\kwUXdSz.exe
  2⤵
  PID:8728
- C:\Windows\System\wpoJoOt.exe
  C:\Windows\System\wpoJoOt.exe
  2⤵
  PID:8744
- C:\Windows\System\nZPKwAD.exe
  C:\Windows\System\nZPKwAD.exe
  2⤵
  PID:8800
- C:\Windows\System\aBrSkGl.exe
  C:\Windows\System\aBrSkGl.exe
  2⤵
  PID:8868
- C:\Windows\System\rNeqsxi.exe
  C:\Windows\System\rNeqsxi.exe
  2⤵
  PID:8904
- C:\Windows\System\NaHOvoh.exe
  C:\Windows\System\NaHOvoh.exe
  2⤵
  PID:8892
- C:\Windows\System\yEIeYTH.exe
  C:\Windows\System\yEIeYTH.exe
  2⤵
  PID:8956
- C:\Windows\System\cgLMXcI.exe
  C:\Windows\System\cgLMXcI.exe
  2⤵
  PID:9064
- C:\Windows\System\PSjcrhf.exe
  C:\Windows\System\PSjcrhf.exe
  2⤵
  PID:9048
- C:\Windows\System\SuhVBJz.exe
  C:\Windows\System\SuhVBJz.exe
  2⤵
  PID:9100
- C:\Windows\System\gQPPfdy.exe
  C:\Windows\System\gQPPfdy.exe
  2⤵
  PID:9116
- C:\Windows\System\HaQpQKz.exe
  C:\Windows\System\HaQpQKz.exe
  2⤵
  PID:9144
- C:\Windows\System\ygotudS.exe
  C:\Windows\System\ygotudS.exe
  2⤵
  PID:9208
- C:\Windows\System\qZyrzBJ.exe
  C:\Windows\System\qZyrzBJ.exe
  2⤵
  PID:7328
- C:\Windows\System\HAGCPdQ.exe
  C:\Windows\System\HAGCPdQ.exe
  2⤵
  PID:2512
- C:\Windows\System\GxnpKDS.exe
  C:\Windows\System\GxnpKDS.exe
  2⤵
  PID:8412
- C:\Windows\System\nygObzI.exe
  C:\Windows\System\nygObzI.exe
  2⤵
  PID:8468
- C:\Windows\System\sCDBoLG.exe
  C:\Windows\System\sCDBoLG.exe
  2⤵
  PID:2084
- C:\Windows\System\OHbMLAZ.exe
  C:\Windows\System\OHbMLAZ.exe
  2⤵
  PID:7892
- C:\Windows\System\ZlpIIlP.exe
  C:\Windows\System\ZlpIIlP.exe
  2⤵
  PID:8572
- C:\Windows\System\zFsCrDP.exe
  C:\Windows\System\zFsCrDP.exe
  2⤵
  PID:8536
- C:\Windows\System\maADmDx.exe
  C:\Windows\System\maADmDx.exe
  2⤵
  PID:8560
- C:\Windows\System\TwUKIkP.exe
  C:\Windows\System\TwUKIkP.exe
  2⤵
  PID:8624
- C:\Windows\System\SqoDQjy.exe
  C:\Windows\System\SqoDQjy.exe
  2⤵
  PID:8664
- C:\Windows\System\zlUlpXa.exe
  C:\Windows\System\zlUlpXa.exe
  2⤵
  PID:8688
- C:\Windows\System\jUYMmwi.exe
  C:\Windows\System\jUYMmwi.exe
  2⤵
  PID:8740
- C:\Windows\System\ptBhHWc.exe
  C:\Windows\System\ptBhHWc.exe
  2⤵
  PID:8836
- C:\Windows\System\nqUoQLq.exe
  C:\Windows\System\nqUoQLq.exe
  2⤵
  PID:8720
- C:\Windows\System\cehZcFS.exe
  C:\Windows\System\cehZcFS.exe
  2⤵
  PID:8772
- C:\Windows\System\SnuQKKL.exe
  C:\Windows\System\SnuQKKL.exe
  2⤵
  PID:8888
- C:\Windows\System\VEtrfoF.exe
  C:\Windows\System\VEtrfoF.exe
  2⤵
  PID:8952
- C:\Windows\System\jNigFjI.exe
  C:\Windows\System\jNigFjI.exe
  2⤵
  PID:9032
- C:\Windows\System\NoRFPJV.exe
  C:\Windows\System\NoRFPJV.exe
  2⤵
  PID:9132
- C:\Windows\System\yYUZVQM.exe
  C:\Windows\System\yYUZVQM.exe
  2⤵
  PID:9080
- C:\Windows\System\TUXvQGF.exe
  C:\Windows\System\TUXvQGF.exe
  2⤵
  PID:9168
- C:\Windows\System\LpXVtac.exe
  C:\Windows\System\LpXVtac.exe
  2⤵
  PID:8348
- C:\Windows\System\SNETRvP.exe
  C:\Windows\System\SNETRvP.exe
  2⤵
  PID:8380
- C:\Windows\System\mmEAUOG.exe
  C:\Windows\System\mmEAUOG.exe
  2⤵
  PID:8444
- C:\Windows\System\ovewZcQ.exe
  C:\Windows\System\ovewZcQ.exe
  2⤵
  PID:8264
- C:\Windows\System\YjYFdAW.exe
  C:\Windows\System\YjYFdAW.exe
  2⤵
  PID:8252
- C:\Windows\System\TMbvFLe.exe
  C:\Windows\System\TMbvFLe.exe
  2⤵
  PID:8544
- C:\Windows\System\EQqduDR.exe
  C:\Windows\System\EQqduDR.exe
  2⤵
  PID:8660
- C:\Windows\System\cltqbqy.exe
  C:\Windows\System\cltqbqy.exe
  2⤵
  PID:8788
- C:\Windows\System\MusqsEZ.exe
  C:\Windows\System\MusqsEZ.exe
  2⤵
  PID:8876
- C:\Windows\System\HlfuoBV.exe
  C:\Windows\System\HlfuoBV.exe
  2⤵
  PID:8920
- C:\Windows\System\xEomFZO.exe
  C:\Windows\System\xEomFZO.exe
  2⤵
  PID:9020
- C:\Windows\System\YlNHalD.exe
  C:\Windows\System\YlNHalD.exe
  2⤵
  PID:8384
- C:\Windows\System\NeYOGNc.exe
  C:\Windows\System\NeYOGNc.exe
  2⤵
  PID:9204
- C:\Windows\System\FKYioKg.exe
  C:\Windows\System\FKYioKg.exe
  2⤵
  PID:8652
- C:\Windows\System\XRSueXL.exe
  C:\Windows\System\XRSueXL.exe
  2⤵
  PID:8596
- C:\Windows\System\FlGvvZp.exe
  C:\Windows\System\FlGvvZp.exe
  2⤵
  PID:8852
- C:\Windows\System\gDomOHU.exe
  C:\Windows\System\gDomOHU.exe
  2⤵
  PID:8832
- C:\Windows\System\iVOnJek.exe
  C:\Windows\System\iVOnJek.exe
  2⤵
  PID:9036
- C:\Windows\System\RncJkGU.exe
  C:\Windows\System\RncJkGU.exe
  2⤵
  PID:8332
- C:\Windows\System\JdorBEw.exe
  C:\Windows\System\JdorBEw.exe
  2⤵
  PID:8576
- C:\Windows\System\UVrxWbD.exe
  C:\Windows\System\UVrxWbD.exe
  2⤵
  PID:8752
- C:\Windows\System\ibqmMTy.exe
  C:\Windows\System\ibqmMTy.exe
  2⤵
  PID:8460
- C:\Windows\System\DIJwWRz.exe
  C:\Windows\System\DIJwWRz.exe
  2⤵
  PID:9232
- C:\Windows\System\ugTSpdD.exe
  C:\Windows\System\ugTSpdD.exe
  2⤵
  PID:9248
- C:\Windows\System\NuIjmeW.exe
  C:\Windows\System\NuIjmeW.exe
  2⤵
  PID:9264
- C:\Windows\System\aJhEkUd.exe
  C:\Windows\System\aJhEkUd.exe
  2⤵
  PID:9288
- C:\Windows\System\jomRbpy.exe
  C:\Windows\System\jomRbpy.exe
  2⤵
  PID:9392
- C:\Windows\System\tEoJeMv.exe
  C:\Windows\System\tEoJeMv.exe
  2⤵
  PID:9460
- C:\Windows\System\CDUZfaa.exe
  C:\Windows\System\CDUZfaa.exe
  2⤵
  PID:9476
- C:\Windows\System\EWlUHdl.exe
  C:\Windows\System\EWlUHdl.exe
  2⤵
  PID:9492
- C:\Windows\System\kRxeIXu.exe
  C:\Windows\System\kRxeIXu.exe
  2⤵
  PID:9508
- C:\Windows\System\UHozkte.exe
  C:\Windows\System\UHozkte.exe
  2⤵
  PID:9532
- C:\Windows\System\cxOACHl.exe
  C:\Windows\System\cxOACHl.exe
  2⤵
  PID:9548
- C:\Windows\System\GOXFREp.exe
  C:\Windows\System\GOXFREp.exe
  2⤵
  PID:9564
- C:\Windows\System\ejZqlMJ.exe
  C:\Windows\System\ejZqlMJ.exe
  2⤵
  PID:9580
- C:\Windows\System\oeecaBR.exe
  C:\Windows\System\oeecaBR.exe
  2⤵
  PID:9600
- C:\Windows\System\VXHIMxp.exe
  C:\Windows\System\VXHIMxp.exe
  2⤵
  PID:9616
- C:\Windows\System\zMLcass.exe
  C:\Windows\System\zMLcass.exe
  2⤵
  PID:9632
- C:\Windows\System\gezVbJU.exe
  C:\Windows\System\gezVbJU.exe
  2⤵
  PID:9648
- C:\Windows\System\dqXxtSs.exe
  C:\Windows\System\dqXxtSs.exe
  2⤵
  PID:9668
- C:\Windows\System\IDNrxIp.exe
  C:\Windows\System\IDNrxIp.exe
  2⤵
  PID:9688
- C:\Windows\System\ujhYeLZ.exe
  C:\Windows\System\ujhYeLZ.exe
  2⤵
  PID:9704
- C:\Windows\System\bWZUtZZ.exe
  C:\Windows\System\bWZUtZZ.exe
  2⤵
  PID:9720
- C:\Windows\System\yssxJpc.exe
  C:\Windows\System\yssxJpc.exe
  2⤵
  PID:9736
- C:\Windows\System\PuoVfzA.exe
  C:\Windows\System\PuoVfzA.exe
  2⤵
  PID:9756
- C:\Windows\System\IuZcZJI.exe
  C:\Windows\System\IuZcZJI.exe
  2⤵
  PID:9776
- C:\Windows\System\jDPhdTE.exe
  C:\Windows\System\jDPhdTE.exe
  2⤵
  PID:9796
- C:\Windows\System\sddhpyP.exe
  C:\Windows\System\sddhpyP.exe
  2⤵
  PID:9816
- C:\Windows\System\bnsnfcN.exe
  C:\Windows\System\bnsnfcN.exe
  2⤵
  PID:9860
- C:\Windows\System\IEMeUgL.exe
  C:\Windows\System\IEMeUgL.exe
  2⤵
  PID:9952
- C:\Windows\System\vqVdOPo.exe
  C:\Windows\System\vqVdOPo.exe
  2⤵
  PID:9968
- C:\Windows\System\boHVotz.exe
  C:\Windows\System\boHVotz.exe
  2⤵
  PID:9984
- C:\Windows\System\jULVKUC.exe
  C:\Windows\System\jULVKUC.exe
  2⤵
  PID:10000
- C:\Windows\System\MaTHMDE.exe
  C:\Windows\System\MaTHMDE.exe
  2⤵
  PID:10016
- C:\Windows\System\DHMaFsT.exe
  C:\Windows\System\DHMaFsT.exe
  2⤵
  PID:10032
- C:\Windows\System\BVcZqCL.exe
  C:\Windows\System\BVcZqCL.exe
  2⤵
  PID:10048
- C:\Windows\System\UaKgIED.exe
  C:\Windows\System\UaKgIED.exe
  2⤵
  PID:10064
- C:\Windows\System\wUtySOi.exe
  C:\Windows\System\wUtySOi.exe
  2⤵
  PID:10080
- C:\Windows\System\gpgaYQF.exe
  C:\Windows\System\gpgaYQF.exe
  2⤵
  PID:10096
- C:\Windows\System\fITTHyn.exe
  C:\Windows\System\fITTHyn.exe
  2⤵
  PID:10112
- C:\Windows\System\TmjrETl.exe
  C:\Windows\System\TmjrETl.exe
  2⤵
  PID:10128
- C:\Windows\System\vlJDxUn.exe
  C:\Windows\System\vlJDxUn.exe
  2⤵
  PID:10144
- C:\Windows\System\WTdnVLx.exe
  C:\Windows\System\WTdnVLx.exe
  2⤵
  PID:10160
- C:\Windows\System\qkLITyY.exe
  C:\Windows\System\qkLITyY.exe
  2⤵
  PID:10180
- C:\Windows\System\HuXXMKH.exe
  C:\Windows\System\HuXXMKH.exe
  2⤵
  PID:10196
- C:\Windows\System\fAneZhC.exe
  C:\Windows\System\fAneZhC.exe
  2⤵
  PID:10212
- C:\Windows\System\kTrugiw.exe
  C:\Windows\System\kTrugiw.exe
  2⤵
  PID:10228
- C:\Windows\System\CUcPKua.exe
  C:\Windows\System\CUcPKua.exe
  2⤵
  PID:9224
- C:\Windows\System\dGgcvOl.exe
  C:\Windows\System\dGgcvOl.exe
  2⤵
  PID:8984
- C:\Windows\System\HTlXzsd.exe
  C:\Windows\System\HTlXzsd.exe
  2⤵
  PID:8988
- C:\Windows\System\ngCEicx.exe
  C:\Windows\System\ngCEicx.exe
  2⤵
  PID:9272
- C:\Windows\System\imSLJTF.exe
  C:\Windows\System\imSLJTF.exe
  2⤵
  PID:9296
- C:\Windows\System\TWRaRCL.exe
  C:\Windows\System\TWRaRCL.exe
  2⤵
  PID:9316
- C:\Windows\System\gEBPhXJ.exe
  C:\Windows\System\gEBPhXJ.exe
  2⤵
  PID:9332
- C:\Windows\System\IymfjAr.exe
  C:\Windows\System\IymfjAr.exe
  2⤵
  PID:9344
- C:\Windows\System\TNVdKHa.exe
  C:\Windows\System\TNVdKHa.exe
  2⤵
  PID:9368
- C:\Windows\System\clImekh.exe
  C:\Windows\System\clImekh.exe
  2⤵
  PID:9380
- C:\Windows\System\QuwhlcR.exe
  C:\Windows\System\QuwhlcR.exe
  2⤵
  PID:9404
- C:\Windows\System\VANLfYZ.exe
  C:\Windows\System\VANLfYZ.exe
  2⤵
  PID:9424
- C:\Windows\System\JsLQNyr.exe
  C:\Windows\System\JsLQNyr.exe
  2⤵
  PID:9440
- C:\Windows\System\iawVMMB.exe
  C:\Windows\System\iawVMMB.exe
  2⤵
  PID:9500
- C:\Windows\System\ZKcqpOU.exe
  C:\Windows\System\ZKcqpOU.exe
  2⤵
  PID:9484
- C:\Windows\System\KKidkKw.exe
  C:\Windows\System\KKidkKw.exe
  2⤵
  PID:9540
- C:\Windows\System\fAfgFEl.exe
  C:\Windows\System\fAfgFEl.exe
  2⤵
  PID:9556
- C:\Windows\System\VrPVRhT.exe
  C:\Windows\System\VrPVRhT.exe
  2⤵
  PID:9644
- C:\Windows\System\ZGSAyMW.exe
  C:\Windows\System\ZGSAyMW.exe
  2⤵
  PID:9628
- C:\Windows\System\EwrVOyL.exe
  C:\Windows\System\EwrVOyL.exe
  2⤵
  PID:9744
- C:\Windows\System\zoPMdGI.exe
  C:\Windows\System\zoPMdGI.exe
  2⤵
  PID:9664
- C:\Windows\System\FcaAzrE.exe
  C:\Windows\System\FcaAzrE.exe
  2⤵
  PID:9784
- C:\Windows\System\iPmzWSP.exe
  C:\Windows\System\iPmzWSP.exe
  2⤵
  PID:9792
- C:\Windows\System\vwSPxCL.exe
  C:\Windows\System\vwSPxCL.exe
  2⤵
  PID:9812
- C:\Windows\System\sFkAcoF.exe
  C:\Windows\System\sFkAcoF.exe
  2⤵
  PID:9832
- C:\Windows\System\xWfhNJT.exe
  C:\Windows\System\xWfhNJT.exe
  2⤵
  PID:9848
- C:\Windows\System\qSsXRUc.exe
  C:\Windows\System\qSsXRUc.exe
  2⤵
  PID:9872
- C:\Windows\System\fLdYvyv.exe
  C:\Windows\System\fLdYvyv.exe
  2⤵
  PID:9324
- C:\Windows\System\SlPxGoR.exe
  C:\Windows\System\SlPxGoR.exe
  2⤵
  PID:9416
- C:\Windows\System\IsIxQFa.exe
  C:\Windows\System\IsIxQFa.exe
  2⤵
  PID:9684
- C:\Windows\System\NaFrAgj.exe
  C:\Windows\System\NaFrAgj.exe
  2⤵
  PID:9660
- C:\Windows\System\JTUiNNt.exe
  C:\Windows\System\JTUiNNt.exe
  2⤵
  PID:9844
- C:\Windows\System\dVkVXTz.exe
  C:\Windows\System\dVkVXTz.exe
  2⤵
  PID:9948
- C:\Windows\System\nCnlCQN.exe
  C:\Windows\System\nCnlCQN.exe
  2⤵
  PID:9976
- C:\Windows\System\FQvnuTG.exe
  C:\Windows\System\FQvnuTG.exe
  2⤵
  PID:10060
- C:\Windows\System\VDhnGcn.exe
  C:\Windows\System\VDhnGcn.exe
  2⤵
  PID:10040
- C:\Windows\System\zrIgoYF.exe
  C:\Windows\System\zrIgoYF.exe
  2⤵
  PID:9772
- C:\Windows\System\iGmYnGk.exe
  C:\Windows\System\iGmYnGk.exe
  2⤵
  PID:9764
- C:\Windows\System\DvrjAOC.exe
  C:\Windows\System\DvrjAOC.exe
  2⤵
  PID:9884
- C:\Windows\System\wKqptqJ.exe
  C:\Windows\System\wKqptqJ.exe
  2⤵
  PID:9148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AFtNHWR.exe

Filesize
1.7MB

MD5
60a60c34b55c08eb588e5441f3d79b04

SHA1
d0070176f3faf1bacccb3244bb860020eb6cdda2

SHA256
615d9ae37c3b6698b6da46835112b43faca8a80a74f6cf2fcefa70ad543f0289

SHA512
3244acb0df2b9ceccadb04eb0077f5f839f2388f3a2c9a26cc47d562141ef1836a90954fcbc5decc867da3d29727e9de72e7f4ddf5cea85ff709825e74d5faa2

Download Submit
C:\Windows\system\AXurpTa.exe

Filesize
1.7MB

MD5
44efcb6c21f90b17824f43b093067684

SHA1
d6d90b48ecc7e44863a0724247ce5a06aebfd943

SHA256
0a0b7f41c0e5942316e55c7bead1d66291e655ac6739e38d3420909c49aa8781

SHA512
bf3d3fedeeb2e42f6c9d540e2b71cff66d25198ca4ad35aac3b78ab43446e3e72f016a602f31e5362e22dd8c12f3df99d83bc8a244123bbdc65aaaeffdc8df04

Download Submit
C:\Windows\system\FvCIYjQ.exe

Filesize
1.7MB

MD5
d5efc41aafded8c731479915d380210b

SHA1
9c12a57c3f1128f5df126362758b5b4857998c76

SHA256
f4bd1b5106d99ce14339d7baa30dfeea2eaafff93ae6379cde9863377e5a936b

SHA512
a29dfb475209cfeda84dd823b1ce9bc911ed3511e1f6c536a00f721fdc3d215da17b29e918fc465140f451ec33fcbe4e68935d7b136a3d31242ee6909a62b8d9

Download Submit
C:\Windows\system\GHwwpjR.exe

Filesize
1.7MB

MD5
71365e477f62ad80d5215a7447a3ea1a

SHA1
90b5c206c7bcccdc332f21f872c02b8f3adf1669

SHA256
a9213ef2ecd6e51dab3403c6243cd91d6e4b327cdf885d49cb49a9200de903d4

SHA512
39daa8013d7d31dcddce7f14e1acc11a8a98000f25ae65f0ce6eb849f84bb21f6c7bde0b62cafea73dbc5d65bfbbbdabc87e1de48d5a3ca2dcc80b41698276e9

Download Submit
C:\Windows\system\JKWoCGA.exe

Filesize
1.7MB

MD5
6286b1a7d6529b703836b125418aa8a7

SHA1
c7e33579c24c06ebee09303f481da23f0472b034

SHA256
c5cfbb3b90160c04366ee5268ca083040267097689a99d2785b9585f15259204

SHA512
124cac48b7a8dea9fd694f526df3dbd578c52a8a7d712e1531f96c31c0d899e7c2b33723951acfd966be55101ed01e2648a696f2bc1f6c70f66d1b7a83f38536

Download Submit
C:\Windows\system\JTbmolR.exe

Filesize
1.7MB

MD5
7eca3468cc6897438cfcce99a20a69e4

SHA1
ca988fbad1abaf47bb0c2b3151641f0070c201db

SHA256
1d019ba5682a2b9ec87d2699165e702aad6a389067d2b445c84ea2ce823e1892

SHA512
0148c1d1aa2c64a29913990fbe428382ad0503734de20ddc19da0c4b9b5c1d0b32c3476459544c0347326a87468aac0388de4007d95b0af51017ae8aa57a3615

Download Submit
C:\Windows\system\JzjTLlR.exe

Filesize
1.7MB

MD5
95f989802f629fe4d4bc0238838ccb51

SHA1
8a18868770f41fcef755e87e74f95b01594a0a72

SHA256
753739981a09c7b9b0b8c2eb3b4dd77caa42e3f108c31da26ff4be1050da30b8

SHA512
d426868f86787904bebb13ea9130c0209d31298258a677dc18b57231168d5c4d9461ee5ef4aa085ce7b7d09d92e6eb9cf36ac50842492a72a7431a808ebc3437

Download Submit
C:\Windows\system\LAdZOei.exe

Filesize
1.7MB

MD5
dfe9bab00421277d26fbde61d30b1384

SHA1
564f068c97a1a7b7e44c054e5324a28e84c336ba

SHA256
704692f81877af7d33819fc2bcac9ab3a108794c5ce3a668c028faa8b01b24d0

SHA512
f0db36ae33888450d1086294d8e46b4091bad56dd27df61ecd33f950982944cc66517940a4d049769d077ae610d6abfd0c26c936199e859c61cbf8ec8888b43f

Download Submit
C:\Windows\system\LZEglxp.exe

Filesize
1.7MB

MD5
be7bf4955adf5a5c04fdad16d8bb5392

SHA1
17d453b0ac4a0ce7fa3d12877c896e628016a042

SHA256
a6d15a61b6fcc0a7885af3f718656a31f4d2b28fbc2ad866f77a8cc1950d7668

SHA512
248466ec62524923af1f27f306295241880b46dcf568215f244ec84696ebfbada37164c9b9daabd1180a49b5cf675af54fcc1cad7aa58440a9e81e026f141f68

Download Submit
C:\Windows\system\RqDMujt.exe

Filesize
1.7MB

MD5
08fa89ac67107de74a48d6af2274f1dd

SHA1
c61d4782d104a7c5d37b03f65ddce330b7f78826

SHA256
5089541ec27f718196f51a1729427003c0e0c1fa4998d108d769f401763e95b2

SHA512
14262aa7b3814f8fadeaff2faad8e2a9608cc99f7932cfec178df604a472cb5ec50bee78b0bff6e22d07ed6805d85b29dee6c50add682ed77684e4df0209122f

Download Submit
C:\Windows\system\TCXNOsS.exe

Filesize
1.7MB

MD5
fae650a3cac5c8ab0d9a6d28ec3cb7b5

SHA1
fc9d18e2835fd43f874a2037adb6b435300e2dac

SHA256
f922a367c23491e405c7e77b1b2da4fd4e28ee34fca379db92876bd97c438698

SHA512
c7297118edded8d67eb35d4a44ae0be136b579d05181da703b62c52a7e6f8353b8ad950c74acb3de8e4c5b622c937ca7595c89e25210c1d12ff6909d462a4507

Download Submit
C:\Windows\system\VkHOlPn.exe

Filesize
1.7MB

MD5
f5cb5f39088b205556bf3083d8f26f88

SHA1
51daf3ed4dec0bfc26309a86fb94fbec4b66a52c

SHA256
7c3eca8b011cfb3e3bcabb011ee20453d9ef4aa18263ad6a26431425e527b0df

SHA512
b578fb26d65055c7aad9dede111a40bd384fe38253fcdf3711d2953976ee8778531e73fdb7b5f0cb21fd9af1531f4b40576ffb91e3806c4b8cd914a06049d3a7

Download Submit
C:\Windows\system\VrjVNym.exe

Filesize
1.7MB

MD5
02e65f1eb8a2829f75b4bc966d3833b1

SHA1
c1372aec27edfb79261db30168b7fcd7b3037275

SHA256
a29592107c6224ac4c4c4239171ce0444756d74fe6233a617bfc528b03f0f792

SHA512
f2ee807100c2995ae0a96491916c4aaecbb5f26ddf024004383737edcb78783f6e52ef9e3066e9a7a7fa8fd430b6fefa7f31777104ee3b35ab13831420e2c95b

Download Submit
C:\Windows\system\XDFMDgd.exe

Filesize
1.7MB

MD5
b32283f2527587e017ab79af20bc5aba

SHA1
d7ad315ba36c06f31926852515588eb41e9ca2fc

SHA256
e0d194f78eadb19ac06ed7d90cfce55aa54502fb9c5517c1779697a753f18e98

SHA512
4825aeff01b6d61ba98e43ce12477b17f4f8363f977f42c0a60baa537146fed362151722c9564341d7ba35c0d57c7066f39270bd3a0ad7f6c608a3a0042b7b77

Download Submit
C:\Windows\system\YveWAeC.exe

Filesize
1.7MB

MD5
c1e611441923f3f48f1b6c3066d20219

SHA1
1a6e8ea8f44ea757366bd572d124bf44ca104efa

SHA256
153b304ea8819711bfc5577aa417b1da52d37eeb9c37c24eb89e8a46c450f6aa

SHA512
1273df83daa6a173748b9914b48b9af888fe3394b3239d910d9c87f07590d46d6fd57313beb7f9a1be77c727ffb84ac096a444ea2c824fb2e7311042efaadf53

Download Submit
C:\Windows\system\cMVvXct.exe

Filesize
1.7MB

MD5
d73ef2e5068cfb16ebfef31b79efd0ab

SHA1
1215d6a19f2776655e158d1482da2653bb4f8211

SHA256
ce819054f8f55d3a927d8da1ff46f1072cd482b754c70e30cfa5bcb892bdecac

SHA512
6b4bdd7f96b40b61ef652caacfbc967d5fb7302013a33feefafe94d8bbfd1233ab6258210011c12f2cfb018c6f018d3e67a5a9ce7b30d8d3718319ce08ca373a

Download Submit
C:\Windows\system\cQDuOJT.exe

Filesize
1.7MB

MD5
06aafa1c5ca20295a1832a5da4cb1072

SHA1
15d1a1856c3f28f227f13c061042957765348608

SHA256
b3fc1e92ed03f47c577eeb83c18868fb9263182ca68e6f26c92d5007b4f5d571

SHA512
94fe2a59ce4c786e8f8f9574bc4130d380c5c17326bc35c30078c09e98acaa7c538cd48a337ccb465a9ba9e9b2f26288388981cd2240a35614e093cef77be43b

Download Submit
C:\Windows\system\djpiPwu.exe

Filesize
1.7MB

MD5
3e9f29e84f8bc4ee9e7bdeff369ed140

SHA1
c746ff035db6ff564ea69920fe517650a9cffc42

SHA256
265b638a1b9868712c2c2c106ef2d575e5f18fef41f2a132170741d8a3147a74

SHA512
f2603af1540a654faa7723d2c7e3290772e8cc046dd7fb82ebb156022fa780a7ccab8a698683586c50ef2e85029c4f961ab5ce3ae2de969d86dc774e0ebb08e1

Download Submit
C:\Windows\system\dtPFvfb.exe

Filesize
1.7MB

MD5
39b0388abbd194bdc93e57884155b0c8

SHA1
d7df4c648ea36693997466101eccdd541f737e9f

SHA256
ce494023955fd5d7fb8d2b1c7d9223fe9120302662e6b801c169a89646e90bd1

SHA512
8c003343ef8890abb13d60c65741ed4c784a3a89c8778a1effeb6264d8a6ae3b35932c65f886bbf623f11e3f64eeaa9829287d8f7e8f70c745a1cb8b9af72b41

Download Submit
C:\Windows\system\fTygTCO.exe

Filesize
1.7MB

MD5
f62612e89dbb8331c8e898383fbcca81

SHA1
7d3ede56dbcd547d4901f644dbf5f72213861fb0

SHA256
7b9e9f3cfdbe8787fd84559ad7b52d585543abb8e82c977e39cb2292baa1a7f3

SHA512
53360384e1e23725c0025411642186e9d43c30ba523f68fee397c60dd4ed14f35d3a99c68d56184786ffc1651eaaac9f1a13344260f00f856f162a5c5c283212

Download Submit
C:\Windows\system\fcfJGSp.exe

Filesize
1.7MB

MD5
cde77553670d448cdd0c10fb62f41f62

SHA1
2368abdb4410d58a5bb9dfab0c1f74f03e12bed8

SHA256
7cb4444441a7f57bc1abeaa0805526700f2db4f25acaca2a236825b3ca7ac4c9

SHA512
11aaeb3c7fa6c6f1faa602052256b701ec40ba353fa2e90824676cc6c4e10573a3150058437a45273a3004a05c27b186213d75f515fa0bcb16d9a8a63be50eb9

Download Submit
C:\Windows\system\jUAbuCp.exe

Filesize
1.7MB

MD5
30daf50d4963a41a887b88d3d2a1c6ce

SHA1
9745355444ee41515aa0d7854cf8add0101ccc31

SHA256
1fbad7064bc44afd2dee9af9a8bc465c2211eb13087ded7b37da2b3cb58c570a

SHA512
debae16ae508ccf03bce4af2f4a9694fe4c44adee6d57143b4130b4d551c58b5de927a7ba62087bf279f8f4ff20270a6be80861d57a1c4698fbda424d3466dbe

Download Submit
C:\Windows\system\mhHKtjT.exe

Filesize
1.7MB

MD5
4363d6dc28bfe462db94a01644815efb

SHA1
c5cc66afe60c4ee90358a55214af9395e7984517

SHA256
83a9aaae00878c0a1e5e53e5ed241449d45beab3d4d0d258d3c6b612ee83696f

SHA512
bf6c691310932a96437cebd2bf9b9fd6793d8393a6e030c34ca1f2f749eeb29609d32c1c448711e2835a96a9805dcd2e06cfbda7ab100e25c47506d43cfee8b8

Download Submit
C:\Windows\system\nxRmsCJ.exe

Filesize
1.7MB

MD5
f04e174a0d964d13cb58fb42c14540e5

SHA1
d1ed38edcfa2c5fba31017e5848b28454f8b144a

SHA256
b0da35e3ef8e2e96b742b0b04a26499c6daefda327ba72050f1cf89fd3cb3d7a

SHA512
136011670484cea0395b3493899127c4c88f7e726740f198d71b5fe32d7428a10c1e692a8686628cddcc8b3450b9ceff5a9360e53d74bdd32ebd2e3b3e9b7a15

Download Submit
C:\Windows\system\pYjTbUm.exe

Filesize
1.7MB

MD5
cca42676546724407b650200a823a4aa

SHA1
bae8074e10d00c8f6132bdf7737ed310231cdca0

SHA256
67c34fad2e3f10b8703e15be6f8d41d48ee204344167ed1385fb576e32400605

SHA512
07ec7379378024b862f7bb431ac12ce555f7e6f129c6f6f2cf0426792c7af3460e09fa0584f1b8614ee81ae5f89b9b2449bb2d6371e9164b11ec093481e56574

Download Submit
C:\Windows\system\roPNOVa.exe

Filesize
1.7MB

MD5
c63ca75fe70863b66fefdbec99ffba83

SHA1
fc017a5396ae9187ea95ab338f9e0c90ac4d97f5

SHA256
0e6141a0b61eb2750453e239534051d0bdbf8d9ae21503c566f4c47f44228237

SHA512
354db9831d516237deed8f31e792881611cb16d0aa292afb16f0f828fd68da07732f6aba53340b72d2e2a4687c7831cbb06d6ccda0d43903ed2e5b5f56ab5611

Download Submit
C:\Windows\system\wpOkrYo.exe

Filesize
1.7MB

MD5
857acee79d177c0fe00bc55df20ee3fa

SHA1
30f77678060805c7a8c054279157f591529949aa

SHA256
993fd83f2229115d80472527c0b63a0fb3cfb1e2717666d7be3e57c9ef9292d8

SHA512
cd300e9b0c0ecf46619e0511a4ac9de34c1ed61e9de572a397223f880927d93a82e3e8dc5ce3e75e8dce87e7e242ee6690ea87d4240020dc41f1de88715d6da0

Download Submit
C:\Windows\system\zDnVLkf.exe

Filesize
1.7MB

MD5
72c5b0ca5c431c8941ea4a61c922ecce

SHA1
ed7a5cb77875410fd2d10fa35c973257472b91c8

SHA256
dbaf288229f108fd52d87f45e5f4e6714a85e8f295da23962aeeee65ec0fa3a3

SHA512
5f675dd40a3c35dcaffb087bbe763a17ccc186823ee177fc8acc23d6a81678c40f5344ca8c8be69b82656a0c9fbc39c66b0418a84c7e79409c6651f6079293d7

Download Submit
C:\Windows\system\zUmnEpo.exe

Filesize
1.7MB

MD5
9d5d07d364e1fdd1c94f9bc7cb52cb65

SHA1
334f77792950a597b0ec6171eea93f5ae872d0c8

SHA256
a7513d6fad0fb8c0423b0d8bda47f5ad2af5318d424e1e9d94ce98b21bb215df

SHA512
81730f5ccb19f6f7fc6d7fcbddea90a3f2048c290da35c4d24a78269170a2bb28338db9f4535159cd104ae3684de8ecbcbe4ec09426e44bf4ccb71ad61c21dd2

Download Submit
\Windows\system\fYKGpix.exe

Filesize
1.7MB

MD5
f5d3c3cae4399fa4ad8bf8ba02322dae

SHA1
6a152d1d8fb9fd2a49d6df6a413b2ce082b45deb

SHA256
b30e8c4ffd7e01f594a0463f154b4ad81a96ca7f7d05b7f767c21d5b58fa8d19

SHA512
fe5868ae91dd2d0f20dcafe3c745c8d2ce6a6b9ced303dcb6ba617ff6c6855d8dc7833a99f1f0517f289228fd147660e3afe626cf6fed3dfa7a198660bc8a644

Download Submit
\Windows\system\nZhexcl.exe

Filesize
1.7MB

MD5
f6d31460a4d9ffae61bcbc80b313d19d

SHA1
aabc5b878f87fbfe07e1e8224a34d674bd22c49f

SHA256
625ae3531f5d1802e1fb21202e6351dcdc8a62d644d89a5ae9095ddb3f06bc94

SHA512
bc147cb10c3f20c4952190ff20f041b8c3e5229bee61700c4db11018f44edde065d55b9bb16b62d4dc6ebdcddb5ff138af7a56bc2092d89dc62e06892e85716d

Download Submit
\Windows\system\pdhpjxd.exe

Filesize
1.7MB

MD5
858da6edee3de20d9a3fc5d0702b4c57

SHA1
f51f2cfa15a4bfb0aaf3517a49b0e5ab7c17d798

SHA256
c047ffa20f9822c0972e539f61e5b3edc172e4c5fb23c89209ea27473860a2ce

SHA512
7b0f0d6b749b5fbab7697a749edc320266e16a6d2ef2090b322c634c2bb23973578dbe740205f558f3720ca458b67ec7c9d9c543f74a12dbdca5e2007445fcc8

Download Submit
memory/2500-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download