xmrig | 2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
Size

1.3MB
MD5

039d273c0de26a6e79d33a4159cfc2f9
SHA1

0de7f0a7159bdc02845530115758b52589cf40cf
SHA256

2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c
SHA512

b5c328eb6837f1e07192d8d7826d5140dc5e4e3c00dea48e212ae77704ca3b679fcab6512bfe22e9e030db5b4468b51d61182c509cbbddf020a246a3fd4c32a6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7GW/034Y:GezaTF8FcNkNdfE0pZ9ozttwIRxoW/xQ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d00000001225f-2.dat	xmrig
behavioral1/files/0x0008000000017520-6.dat	xmrig
behavioral1/files/0x0007000000018634-13.dat	xmrig
behavioral1/files/0x0006000000018741-17.dat	xmrig
behavioral1/files/0x000700000001907c-21.dat	xmrig
behavioral1/files/0x0007000000019080-24.dat	xmrig
behavioral1/files/0x000700000001919c-29.dat	xmrig
behavioral1/files/0x00070000000191ad-33.dat	xmrig
behavioral1/files/0x0005000000019bf2-36.dat	xmrig
behavioral1/files/0x0005000000019c0b-40.dat	xmrig
behavioral1/files/0x0005000000019cd5-44.dat	xmrig
behavioral1/files/0x0005000000019d69-56.dat	xmrig
behavioral1/files/0x000500000001a033-70.dat	xmrig
behavioral1/files/0x0034000000017429-76.dat	xmrig
behavioral1/files/0x000500000001a2fc-88.dat	xmrig
behavioral1/files/0x000500000001a3ed-108.dat	xmrig
behavioral1/files/0x000500000001a452-124.dat	xmrig
behavioral1/files/0x000500000001a454-128.dat	xmrig
behavioral1/files/0x000500000001a447-120.dat	xmrig
behavioral1/files/0x000500000001a445-117.dat	xmrig
behavioral1/files/0x000500000001a423-112.dat	xmrig
behavioral1/files/0x000500000001a3ea-104.dat	xmrig
behavioral1/files/0x000500000001a3e8-101.dat	xmrig
behavioral1/files/0x000500000001a3e6-96.dat	xmrig
behavioral1/files/0x000500000001a3e4-93.dat	xmrig
behavioral1/files/0x000500000001a2b9-84.dat	xmrig
behavioral1/files/0x000500000001a05a-80.dat	xmrig
behavioral1/files/0x000500000001a020-68.dat	xmrig
behavioral1/files/0x0005000000019f71-64.dat	xmrig
behavioral1/files/0x0005000000019f57-60.dat	xmrig
behavioral1/files/0x0005000000019d5c-52.dat	xmrig
behavioral1/files/0x0005000000019cfc-48.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2804	SXVsKXN.exe
2688	nZSioeP.exe
2924	krzPRhU.exe
2800	DhbFNOB.exe
2848	PbiDMEc.exe
2812	UQevUUs.exe
2756	eoYKmAF.exe
2568	YKFMAVC.exe
2608	phcStmu.exe
1932	DkpXYUg.exe
2156	EgpiQYg.exe
3048	TxTqiVp.exe
736	xYQxomN.exe
1408	DDNQwrG.exe
1676	cNHbySz.exe
1928	AucAGpx.exe
2948	UcasfGM.exe
2164	LxYmtTJ.exe
1472	duBlyss.exe
2236	PqnyBGa.exe
1276	tLXCWrC.exe
2796	ckrNHYG.exe
1916	hGffxJD.exe
2908	YhRQEej.exe
2628	mxfUjFg.exe
2080	YdacVIK.exe
1488	ASBMBLC.exe
1612	NHeYJJw.exe
1844	PDTiYXe.exe
1588	yZqcbXb.exe
2356	UXkwGsU.exe
2180	DdYwDZT.exe
2920	iVHXmVl.exe
2244	hadDInP.exe
1856	bcpWQBI.exe
2968	WHpxyyt.exe
2108	BAjvDkq.exe
2516	UDeNngg.exe
1964	ZwNNJiH.exe
2120	MZoUxNR.exe
596	YiUYAVD.exe
1804	FupiGOk.exe
2452	lNRplCy.exe
888	cidTmJD.exe
1636	AuFhDUc.exe
1592	evgWVDW.exe
1032	XqZKDHv.exe
968	oKpQhrK.exe
996	YlGscfO.exe
1116	XeJWMEJ.exe
1436	CGyEtZj.exe
1516	DEUQceG.exe
1708	tpxGDRd.exe
1912	ViOXXUT.exe
1888	owzCPRy.exe
624	VIJgzGD.exe
2980	LCgoiIJ.exe
2988	XDiqUuZ.exe
2300	oTRaHJz.exe
1184	BrgqgBy.exe
2496	UoCNZpR.exe
2304	WOshbsW.exe
708	vDVtcwh.exe
336	nKbBIVV.exe

Loads dropped DLL 64 IoCs

pid	Process
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kXSrUDI.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\PmcnbQU.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\afIppBK.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\XvhQlfd.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\FgJdATC.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\ekHuwPG.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\AUkGKog.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\XFxmWjy.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\pWBvPhh.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\AucAGpx.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\bgwkGyo.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\bVoXElP.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\DABxbXr.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\ByXuQJl.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\zIDNhGY.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\xYnGtSS.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\NhweLSN.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\WzqImFP.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\kAhgQxd.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\mUrChVH.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\JvFjQdg.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\GnlhKyR.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\HdsXJUi.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\StNvZGq.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\ZYCEVLT.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\WHpxyyt.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\RVpJTXc.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\FtTlOEK.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\IqNLMFd.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\HTikEJN.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\MpMjvVj.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\avMzLje.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\fGSPsig.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\cCDxqnV.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\lBwsrua.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\YAEpHrU.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\GnuUPlz.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\jIeCVyf.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\NCQxVke.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\bErPMBw.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\PdUeiDt.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\dnzHRaG.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\WeEXJud.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\LVSHywb.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\bjXYWCi.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\juNxUWT.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\uNyrJSZ.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\EUboRAU.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\EiKqwhq.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\vgfDuqn.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\zxJoMrb.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\uwduYJv.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\ofzXfNU.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\vVduufQ.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\dUTZMEt.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\IXHIhxT.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\QEBieeZ.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\iFIbCKv.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\IbLPQvT.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\lqyCMln.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\RBHFGwa.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\vDVtcwh.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\cHGUytk.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
File created	C:\Windows\System\aHwnnKH.exe	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2804	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	31
PID 2664 wrote to memory of 2804	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	31
PID 2664 wrote to memory of 2804	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	31
PID 2664 wrote to memory of 2688	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	32
PID 2664 wrote to memory of 2688	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	32
PID 2664 wrote to memory of 2688	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	32
PID 2664 wrote to memory of 2924	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	33
PID 2664 wrote to memory of 2924	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	33
PID 2664 wrote to memory of 2924	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	33
PID 2664 wrote to memory of 2800	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	34
PID 2664 wrote to memory of 2800	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	34
PID 2664 wrote to memory of 2800	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	34
PID 2664 wrote to memory of 2848	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	35
PID 2664 wrote to memory of 2848	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	35
PID 2664 wrote to memory of 2848	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	35
PID 2664 wrote to memory of 2812	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	36
PID 2664 wrote to memory of 2812	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	36
PID 2664 wrote to memory of 2812	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	36
PID 2664 wrote to memory of 2756	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	37
PID 2664 wrote to memory of 2756	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	37
PID 2664 wrote to memory of 2756	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	37
PID 2664 wrote to memory of 2568	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	38
PID 2664 wrote to memory of 2568	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	38
PID 2664 wrote to memory of 2568	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	38
PID 2664 wrote to memory of 2608	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	39
PID 2664 wrote to memory of 2608	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	39
PID 2664 wrote to memory of 2608	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	39
PID 2664 wrote to memory of 1932	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	40
PID 2664 wrote to memory of 1932	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	40
PID 2664 wrote to memory of 1932	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	40
PID 2664 wrote to memory of 2156	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	41
PID 2664 wrote to memory of 2156	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	41
PID 2664 wrote to memory of 2156	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	41
PID 2664 wrote to memory of 3048	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	42
PID 2664 wrote to memory of 3048	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	42
PID 2664 wrote to memory of 3048	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	42
PID 2664 wrote to memory of 736	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	43
PID 2664 wrote to memory of 736	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	43
PID 2664 wrote to memory of 736	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	43
PID 2664 wrote to memory of 1408	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	44
PID 2664 wrote to memory of 1408	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	44
PID 2664 wrote to memory of 1408	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	44
PID 2664 wrote to memory of 1676	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	45
PID 2664 wrote to memory of 1676	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	45
PID 2664 wrote to memory of 1676	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	45
PID 2664 wrote to memory of 1928	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	46
PID 2664 wrote to memory of 1928	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	46
PID 2664 wrote to memory of 1928	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	46
PID 2664 wrote to memory of 2948	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	47
PID 2664 wrote to memory of 2948	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	47
PID 2664 wrote to memory of 2948	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	47
PID 2664 wrote to memory of 2164	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	48
PID 2664 wrote to memory of 2164	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	48
PID 2664 wrote to memory of 2164	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	48
PID 2664 wrote to memory of 1472	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	49
PID 2664 wrote to memory of 1472	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	49
PID 2664 wrote to memory of 1472	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	49
PID 2664 wrote to memory of 2236	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	50
PID 2664 wrote to memory of 2236	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	50
PID 2664 wrote to memory of 2236	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	50
PID 2664 wrote to memory of 1276	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	51
PID 2664 wrote to memory of 1276	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	51
PID 2664 wrote to memory of 1276	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	51
PID 2664 wrote to memory of 2796	2664	2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe	52

C:\Users\Admin\AppData\Local\Temp\2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe
"C:\Users\Admin\AppData\Local\Temp\2f6ed812e6c9cbef85ffa731010cb95f025d7e464dbb1ed82d2e4b94adb92f7c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System\SXVsKXN.exe
  C:\Windows\System\SXVsKXN.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\nZSioeP.exe
  C:\Windows\System\nZSioeP.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\krzPRhU.exe
  C:\Windows\System\krzPRhU.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\DhbFNOB.exe
  C:\Windows\System\DhbFNOB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\PbiDMEc.exe
  C:\Windows\System\PbiDMEc.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\UQevUUs.exe
  C:\Windows\System\UQevUUs.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\eoYKmAF.exe
  C:\Windows\System\eoYKmAF.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\YKFMAVC.exe
  C:\Windows\System\YKFMAVC.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\phcStmu.exe
  C:\Windows\System\phcStmu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\DkpXYUg.exe
  C:\Windows\System\DkpXYUg.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\EgpiQYg.exe
  C:\Windows\System\EgpiQYg.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TxTqiVp.exe
  C:\Windows\System\TxTqiVp.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\xYQxomN.exe
  C:\Windows\System\xYQxomN.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\DDNQwrG.exe
  C:\Windows\System\DDNQwrG.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\cNHbySz.exe
  C:\Windows\System\cNHbySz.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\AucAGpx.exe
  C:\Windows\System\AucAGpx.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\UcasfGM.exe
  C:\Windows\System\UcasfGM.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\LxYmtTJ.exe
  C:\Windows\System\LxYmtTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\duBlyss.exe
  C:\Windows\System\duBlyss.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\PqnyBGa.exe
  C:\Windows\System\PqnyBGa.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\tLXCWrC.exe
  C:\Windows\System\tLXCWrC.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ckrNHYG.exe
  C:\Windows\System\ckrNHYG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\hGffxJD.exe
  C:\Windows\System\hGffxJD.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\YhRQEej.exe
  C:\Windows\System\YhRQEej.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\mxfUjFg.exe
  C:\Windows\System\mxfUjFg.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\YdacVIK.exe
  C:\Windows\System\YdacVIK.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ASBMBLC.exe
  C:\Windows\System\ASBMBLC.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\NHeYJJw.exe
  C:\Windows\System\NHeYJJw.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\PDTiYXe.exe
  C:\Windows\System\PDTiYXe.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\yZqcbXb.exe
  C:\Windows\System\yZqcbXb.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\UXkwGsU.exe
  C:\Windows\System\UXkwGsU.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\DdYwDZT.exe
  C:\Windows\System\DdYwDZT.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\iVHXmVl.exe
  C:\Windows\System\iVHXmVl.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\hadDInP.exe
  C:\Windows\System\hadDInP.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\bcpWQBI.exe
  C:\Windows\System\bcpWQBI.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\WHpxyyt.exe
  C:\Windows\System\WHpxyyt.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\BAjvDkq.exe
  C:\Windows\System\BAjvDkq.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\UDeNngg.exe
  C:\Windows\System\UDeNngg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ZwNNJiH.exe
  C:\Windows\System\ZwNNJiH.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\MZoUxNR.exe
  C:\Windows\System\MZoUxNR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\YiUYAVD.exe
  C:\Windows\System\YiUYAVD.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\FupiGOk.exe
  C:\Windows\System\FupiGOk.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\lNRplCy.exe
  C:\Windows\System\lNRplCy.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\cidTmJD.exe
  C:\Windows\System\cidTmJD.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\AuFhDUc.exe
  C:\Windows\System\AuFhDUc.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\evgWVDW.exe
  C:\Windows\System\evgWVDW.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\XqZKDHv.exe
  C:\Windows\System\XqZKDHv.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\oKpQhrK.exe
  C:\Windows\System\oKpQhrK.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\YlGscfO.exe
  C:\Windows\System\YlGscfO.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\XeJWMEJ.exe
  C:\Windows\System\XeJWMEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\CGyEtZj.exe
  C:\Windows\System\CGyEtZj.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\DEUQceG.exe
  C:\Windows\System\DEUQceG.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\tpxGDRd.exe
  C:\Windows\System\tpxGDRd.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ViOXXUT.exe
  C:\Windows\System\ViOXXUT.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\owzCPRy.exe
  C:\Windows\System\owzCPRy.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VIJgzGD.exe
  C:\Windows\System\VIJgzGD.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\LCgoiIJ.exe
  C:\Windows\System\LCgoiIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\XDiqUuZ.exe
  C:\Windows\System\XDiqUuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\oTRaHJz.exe
  C:\Windows\System\oTRaHJz.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\BrgqgBy.exe
  C:\Windows\System\BrgqgBy.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\UoCNZpR.exe
  C:\Windows\System\UoCNZpR.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\WOshbsW.exe
  C:\Windows\System\WOshbsW.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\vDVtcwh.exe
  C:\Windows\System\vDVtcwh.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\nKbBIVV.exe
  C:\Windows\System\nKbBIVV.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\XfmJamu.exe
  C:\Windows\System\XfmJamu.exe
  2⤵
  PID:1272
- C:\Windows\System\EbAbzsd.exe
  C:\Windows\System\EbAbzsd.exe
  2⤵
  PID:2640
- C:\Windows\System\dHDEiuT.exe
  C:\Windows\System\dHDEiuT.exe
  2⤵
  PID:976
- C:\Windows\System\WEIIzFb.exe
  C:\Windows\System\WEIIzFb.exe
  2⤵
  PID:1132
- C:\Windows\System\rEfZjAb.exe
  C:\Windows\System\rEfZjAb.exe
  2⤵
  PID:376
- C:\Windows\System\iycxSJZ.exe
  C:\Windows\System\iycxSJZ.exe
  2⤵
  PID:868
- C:\Windows\System\rPfFDCP.exe
  C:\Windows\System\rPfFDCP.exe
  2⤵
  PID:2476
- C:\Windows\System\CaxKyYa.exe
  C:\Windows\System\CaxKyYa.exe
  2⤵
  PID:964
- C:\Windows\System\pgPSxAO.exe
  C:\Windows\System\pgPSxAO.exe
  2⤵
  PID:1568
- C:\Windows\System\ZBiaYmj.exe
  C:\Windows\System\ZBiaYmj.exe
  2⤵
  PID:2928
- C:\Windows\System\lhguHLF.exe
  C:\Windows\System\lhguHLF.exe
  2⤵
  PID:2820
- C:\Windows\System\FZnpgZN.exe
  C:\Windows\System\FZnpgZN.exe
  2⤵
  PID:2564
- C:\Windows\System\sFjsEut.exe
  C:\Windows\System\sFjsEut.exe
  2⤵
  PID:2832
- C:\Windows\System\kXSrUDI.exe
  C:\Windows\System\kXSrUDI.exe
  2⤵
  PID:2604
- C:\Windows\System\mhOneWp.exe
  C:\Windows\System\mhOneWp.exe
  2⤵
  PID:2588
- C:\Windows\System\UYDWEGg.exe
  C:\Windows\System\UYDWEGg.exe
  2⤵
  PID:2772
- C:\Windows\System\oAaBYJS.exe
  C:\Windows\System\oAaBYJS.exe
  2⤵
  PID:2728
- C:\Windows\System\ZEoovKD.exe
  C:\Windows\System\ZEoovKD.exe
  2⤵
  PID:2876
- C:\Windows\System\dFRoRVO.exe
  C:\Windows\System\dFRoRVO.exe
  2⤵
  PID:816
- C:\Windows\System\rkBXGwU.exe
  C:\Windows\System\rkBXGwU.exe
  2⤵
  PID:2776
- C:\Windows\System\WwcXsws.exe
  C:\Windows\System\WwcXsws.exe
  2⤵
  PID:2936
- C:\Windows\System\iWszqKz.exe
  C:\Windows\System\iWszqKz.exe
  2⤵
  PID:1944
- C:\Windows\System\BnRUphD.exe
  C:\Windows\System\BnRUphD.exe
  2⤵
  PID:2792
- C:\Windows\System\riCmuCO.exe
  C:\Windows\System\riCmuCO.exe
  2⤵
  PID:1616
- C:\Windows\System\tielVdS.exe
  C:\Windows\System\tielVdS.exe
  2⤵
  PID:2852
- C:\Windows\System\IslXpAq.exe
  C:\Windows\System\IslXpAq.exe
  2⤵
  PID:3012
- C:\Windows\System\uJWJwEz.exe
  C:\Windows\System\uJWJwEz.exe
  2⤵
  PID:2332
- C:\Windows\System\vohgJeC.exe
  C:\Windows\System\vohgJeC.exe
  2⤵
  PID:1160
- C:\Windows\System\zwPRzld.exe
  C:\Windows\System\zwPRzld.exe
  2⤵
  PID:2160
- C:\Windows\System\WmSopMT.exe
  C:\Windows\System\WmSopMT.exe
  2⤵
  PID:2724
- C:\Windows\System\kPrcucT.exe
  C:\Windows\System\kPrcucT.exe
  2⤵
  PID:1968
- C:\Windows\System\PLcFLXg.exe
  C:\Windows\System\PLcFLXg.exe
  2⤵
  PID:2432
- C:\Windows\System\eQfquTb.exe
  C:\Windows\System\eQfquTb.exe
  2⤵
  PID:2100
- C:\Windows\System\WrAToKm.exe
  C:\Windows\System\WrAToKm.exe
  2⤵
  PID:2376
- C:\Windows\System\cPOtfoh.exe
  C:\Windows\System\cPOtfoh.exe
  2⤵
  PID:2672
- C:\Windows\System\IFhqURs.exe
  C:\Windows\System\IFhqURs.exe
  2⤵
  PID:2132
- C:\Windows\System\YLHVZkh.exe
  C:\Windows\System\YLHVZkh.exe
  2⤵
  PID:1680
- C:\Windows\System\KAUchBl.exe
  C:\Windows\System\KAUchBl.exe
  2⤵
  PID:2596
- C:\Windows\System\jApUROX.exe
  C:\Windows\System\jApUROX.exe
  2⤵
  PID:2600
- C:\Windows\System\uAFwkpL.exe
  C:\Windows\System\uAFwkpL.exe
  2⤵
  PID:3020
- C:\Windows\System\FmZLbMp.exe
  C:\Windows\System\FmZLbMp.exe
  2⤵
  PID:2224
- C:\Windows\System\htoNRrL.exe
  C:\Windows\System\htoNRrL.exe
  2⤵
  PID:1072
- C:\Windows\System\YkaZPHq.exe
  C:\Windows\System\YkaZPHq.exe
  2⤵
  PID:2272
- C:\Windows\System\uDiWmTF.exe
  C:\Windows\System\uDiWmTF.exe
  2⤵
  PID:1580
- C:\Windows\System\UDMiLVM.exe
  C:\Windows\System\UDMiLVM.exe
  2⤵
  PID:2764
- C:\Windows\System\YTfxoEn.exe
  C:\Windows\System\YTfxoEn.exe
  2⤵
  PID:2740
- C:\Windows\System\YqYIPSh.exe
  C:\Windows\System\YqYIPSh.exe
  2⤵
  PID:3040
- C:\Windows\System\lDfTmXh.exe
  C:\Windows\System\lDfTmXh.exe
  2⤵
  PID:2676
- C:\Windows\System\LolKNWh.exe
  C:\Windows\System\LolKNWh.exe
  2⤵
  PID:2620
- C:\Windows\System\tUhjLYh.exe
  C:\Windows\System\tUhjLYh.exe
  2⤵
  PID:2460
- C:\Windows\System\WBuNFzZ.exe
  C:\Windows\System\WBuNFzZ.exe
  2⤵
  PID:672
- C:\Windows\System\ydVSaAA.exe
  C:\Windows\System\ydVSaAA.exe
  2⤵
  PID:1156
- C:\Windows\System\EMFzgkX.exe
  C:\Windows\System\EMFzgkX.exe
  2⤵
  PID:744
- C:\Windows\System\ZbDamWt.exe
  C:\Windows\System\ZbDamWt.exe
  2⤵
  PID:2384
- C:\Windows\System\xCfxUHJ.exe
  C:\Windows\System\xCfxUHJ.exe
  2⤵
  PID:2420
- C:\Windows\System\QYDAeTM.exe
  C:\Windows\System\QYDAeTM.exe
  2⤵
  PID:2292
- C:\Windows\System\cshcvxN.exe
  C:\Windows\System\cshcvxN.exe
  2⤵
  PID:1692
- C:\Windows\System\EDYCkpl.exe
  C:\Windows\System\EDYCkpl.exe
  2⤵
  PID:1336
- C:\Windows\System\RcYrBxk.exe
  C:\Windows\System\RcYrBxk.exe
  2⤵
  PID:656
- C:\Windows\System\DqJtuFb.exe
  C:\Windows\System\DqJtuFb.exe
  2⤵
  PID:3032
- C:\Windows\System\QWyLZHd.exe
  C:\Windows\System\QWyLZHd.exe
  2⤵
  PID:1576
- C:\Windows\System\vACxLTM.exe
  C:\Windows\System\vACxLTM.exe
  2⤵
  PID:2248
- C:\Windows\System\fTSiFQt.exe
  C:\Windows\System\fTSiFQt.exe
  2⤵
  PID:2716
- C:\Windows\System\ZjtzblW.exe
  C:\Windows\System\ZjtzblW.exe
  2⤵
  PID:1584
- C:\Windows\System\mIxtCMo.exe
  C:\Windows\System\mIxtCMo.exe
  2⤵
  PID:1796
- C:\Windows\System\RwImAca.exe
  C:\Windows\System\RwImAca.exe
  2⤵
  PID:1892
- C:\Windows\System\KfRVWqG.exe
  C:\Windows\System\KfRVWqG.exe
  2⤵
  PID:1192
- C:\Windows\System\wlEOloe.exe
  C:\Windows\System\wlEOloe.exe
  2⤵
  PID:2580
- C:\Windows\System\wpmPwCt.exe
  C:\Windows\System\wpmPwCt.exe
  2⤵
  PID:2932
- C:\Windows\System\XtSKvuS.exe
  C:\Windows\System\XtSKvuS.exe
  2⤵
  PID:1848
- C:\Windows\System\LIQgBsq.exe
  C:\Windows\System\LIQgBsq.exe
  2⤵
  PID:2256
- C:\Windows\System\oJGYOgZ.exe
  C:\Windows\System\oJGYOgZ.exe
  2⤵
  PID:2280
- C:\Windows\System\zFSldRG.exe
  C:\Windows\System\zFSldRG.exe
  2⤵
  PID:1372
- C:\Windows\System\WOgRatC.exe
  C:\Windows\System\WOgRatC.exe
  2⤵
  PID:2864
- C:\Windows\System\SyrGcfh.exe
  C:\Windows\System\SyrGcfh.exe
  2⤵
  PID:2904
- C:\Windows\System\RLRLigi.exe
  C:\Windows\System\RLRLigi.exe
  2⤵
  PID:1136
- C:\Windows\System\vZWTtsf.exe
  C:\Windows\System\vZWTtsf.exe
  2⤵
  PID:2324
- C:\Windows\System\jIeCVyf.exe
  C:\Windows\System\jIeCVyf.exe
  2⤵
  PID:2084
- C:\Windows\System\WXdSyRU.exe
  C:\Windows\System\WXdSyRU.exe
  2⤵
  PID:2972
- C:\Windows\System\MmQkTFi.exe
  C:\Windows\System\MmQkTFi.exe
  2⤵
  PID:2076
- C:\Windows\System\NCQxVke.exe
  C:\Windows\System\NCQxVke.exe
  2⤵
  PID:2312
- C:\Windows\System\XWdqvXL.exe
  C:\Windows\System\XWdqvXL.exe
  2⤵
  PID:2836
- C:\Windows\System\pbqQqgK.exe
  C:\Windows\System\pbqQqgK.exe
  2⤵
  PID:2952
- C:\Windows\System\lcBCvGq.exe
  C:\Windows\System\lcBCvGq.exe
  2⤵
  PID:2544
- C:\Windows\System\HtjUcSV.exe
  C:\Windows\System\HtjUcSV.exe
  2⤵
  PID:2392
- C:\Windows\System\hSZzUcK.exe
  C:\Windows\System\hSZzUcK.exe
  2⤵
  PID:1620
- C:\Windows\System\gNrLgRg.exe
  C:\Windows\System\gNrLgRg.exe
  2⤵
  PID:2892
- C:\Windows\System\umYVSgt.exe
  C:\Windows\System\umYVSgt.exe
  2⤵
  PID:1668
- C:\Windows\System\bIkwDks.exe
  C:\Windows\System\bIkwDks.exe
  2⤵
  PID:1660
- C:\Windows\System\AKGzEpi.exe
  C:\Windows\System\AKGzEpi.exe
  2⤵
  PID:2372
- C:\Windows\System\tjUyCbM.exe
  C:\Windows\System\tjUyCbM.exe
  2⤵
  PID:2484
- C:\Windows\System\WfLKBAF.exe
  C:\Windows\System\WfLKBAF.exe
  2⤵
  PID:1896
- C:\Windows\System\AxYxEYj.exe
  C:\Windows\System\AxYxEYj.exe
  2⤵
  PID:1728
- C:\Windows\System\hxWvgFc.exe
  C:\Windows\System\hxWvgFc.exe
  2⤵
  PID:812
- C:\Windows\System\PmcnbQU.exe
  C:\Windows\System\PmcnbQU.exe
  2⤵
  PID:1412
- C:\Windows\System\KRmzpXF.exe
  C:\Windows\System\KRmzpXF.exe
  2⤵
  PID:2488
- C:\Windows\System\wMOPydO.exe
  C:\Windows\System\wMOPydO.exe
  2⤵
  PID:2536
- C:\Windows\System\sVhzOql.exe
  C:\Windows\System\sVhzOql.exe
  2⤵
  PID:2872
- C:\Windows\System\dnItUst.exe
  C:\Windows\System\dnItUst.exe
  2⤵
  PID:1696
- C:\Windows\System\RVpJTXc.exe
  C:\Windows\System\RVpJTXc.exe
  2⤵
  PID:1552
- C:\Windows\System\XpsDxJW.exe
  C:\Windows\System\XpsDxJW.exe
  2⤵
  PID:1656
- C:\Windows\System\OudWSqX.exe
  C:\Windows\System\OudWSqX.exe
  2⤵
  PID:1876
- C:\Windows\System\rycZgWs.exe
  C:\Windows\System\rycZgWs.exe
  2⤵
  PID:3092
- C:\Windows\System\YseJJij.exe
  C:\Windows\System\YseJJij.exe
  2⤵
  PID:3108
- C:\Windows\System\QbpZhPp.exe
  C:\Windows\System\QbpZhPp.exe
  2⤵
  PID:3128
- C:\Windows\System\FPhNOsN.exe
  C:\Windows\System\FPhNOsN.exe
  2⤵
  PID:3144
- C:\Windows\System\rqABiyd.exe
  C:\Windows\System\rqABiyd.exe
  2⤵
  PID:3164
- C:\Windows\System\zBKvaQF.exe
  C:\Windows\System\zBKvaQF.exe
  2⤵
  PID:3180
- C:\Windows\System\vTBUeMM.exe
  C:\Windows\System\vTBUeMM.exe
  2⤵
  PID:3204
- C:\Windows\System\YywazIY.exe
  C:\Windows\System\YywazIY.exe
  2⤵
  PID:3220
- C:\Windows\System\AWKETRB.exe
  C:\Windows\System\AWKETRB.exe
  2⤵
  PID:3236
- C:\Windows\System\nPPucZK.exe
  C:\Windows\System\nPPucZK.exe
  2⤵
  PID:3252
- C:\Windows\System\bpHnXtV.exe
  C:\Windows\System\bpHnXtV.exe
  2⤵
  PID:3272
- C:\Windows\System\ImLzANz.exe
  C:\Windows\System\ImLzANz.exe
  2⤵
  PID:3288
- C:\Windows\System\aPInXTD.exe
  C:\Windows\System\aPInXTD.exe
  2⤵
  PID:3304
- C:\Windows\System\PHmbvev.exe
  C:\Windows\System\PHmbvev.exe
  2⤵
  PID:3320
- C:\Windows\System\GyXJzKj.exe
  C:\Windows\System\GyXJzKj.exe
  2⤵
  PID:3336
- C:\Windows\System\ouWkYYF.exe
  C:\Windows\System\ouWkYYF.exe
  2⤵
  PID:3356
- C:\Windows\System\hJNoKRN.exe
  C:\Windows\System\hJNoKRN.exe
  2⤵
  PID:3372
- C:\Windows\System\rQiNHBc.exe
  C:\Windows\System\rQiNHBc.exe
  2⤵
  PID:3388
- C:\Windows\System\WGRCPWP.exe
  C:\Windows\System\WGRCPWP.exe
  2⤵
  PID:3404
- C:\Windows\System\GIbvGlU.exe
  C:\Windows\System\GIbvGlU.exe
  2⤵
  PID:3420
- C:\Windows\System\OUUUuuc.exe
  C:\Windows\System\OUUUuuc.exe
  2⤵
  PID:3436
- C:\Windows\System\MppDIAF.exe
  C:\Windows\System\MppDIAF.exe
  2⤵
  PID:3452
- C:\Windows\System\ljclzTJ.exe
  C:\Windows\System\ljclzTJ.exe
  2⤵
  PID:3468
- C:\Windows\System\bErPMBw.exe
  C:\Windows\System\bErPMBw.exe
  2⤵
  PID:3484
- C:\Windows\System\hwHqiwO.exe
  C:\Windows\System\hwHqiwO.exe
  2⤵
  PID:3500
- C:\Windows\System\vzBxAMO.exe
  C:\Windows\System\vzBxAMO.exe
  2⤵
  PID:3516
- C:\Windows\System\bgwkGyo.exe
  C:\Windows\System\bgwkGyo.exe
  2⤵
  PID:3532
- C:\Windows\System\nhhJKxy.exe
  C:\Windows\System\nhhJKxy.exe
  2⤵
  PID:3548
- C:\Windows\System\fKEEsrX.exe
  C:\Windows\System\fKEEsrX.exe
  2⤵
  PID:3564
- C:\Windows\System\jgHKoXm.exe
  C:\Windows\System\jgHKoXm.exe
  2⤵
  PID:3580
- C:\Windows\System\llKOYGS.exe
  C:\Windows\System\llKOYGS.exe
  2⤵
  PID:3596
- C:\Windows\System\aOPhVaJ.exe
  C:\Windows\System\aOPhVaJ.exe
  2⤵
  PID:3612
- C:\Windows\System\cbxFTGq.exe
  C:\Windows\System\cbxFTGq.exe
  2⤵
  PID:3628
- C:\Windows\System\qQMLJOX.exe
  C:\Windows\System\qQMLJOX.exe
  2⤵
  PID:3644
- C:\Windows\System\LzPqauY.exe
  C:\Windows\System\LzPqauY.exe
  2⤵
  PID:3660
- C:\Windows\System\kCHNqdY.exe
  C:\Windows\System\kCHNqdY.exe
  2⤵
  PID:3676
- C:\Windows\System\PpYavhP.exe
  C:\Windows\System\PpYavhP.exe
  2⤵
  PID:3696
- C:\Windows\System\rOXoQHM.exe
  C:\Windows\System\rOXoQHM.exe
  2⤵
  PID:3724
- C:\Windows\System\zdvwxgY.exe
  C:\Windows\System\zdvwxgY.exe
  2⤵
  PID:3748
- C:\Windows\System\wfVSiAH.exe
  C:\Windows\System\wfVSiAH.exe
  2⤵
  PID:3772
- C:\Windows\System\InGjqLo.exe
  C:\Windows\System\InGjqLo.exe
  2⤵
  PID:3812
- C:\Windows\System\sgiEBKT.exe
  C:\Windows\System\sgiEBKT.exe
  2⤵
  PID:3844
- C:\Windows\System\dedzqbC.exe
  C:\Windows\System\dedzqbC.exe
  2⤵
  PID:3884
- C:\Windows\System\uoXRdyP.exe
  C:\Windows\System\uoXRdyP.exe
  2⤵
  PID:3936
- C:\Windows\System\RhYkFwB.exe
  C:\Windows\System\RhYkFwB.exe
  2⤵
  PID:3956
- C:\Windows\System\dphcNfm.exe
  C:\Windows\System\dphcNfm.exe
  2⤵
  PID:3992
- C:\Windows\System\PdUeiDt.exe
  C:\Windows\System\PdUeiDt.exe
  2⤵
  PID:4040
- C:\Windows\System\qbAGblq.exe
  C:\Windows\System\qbAGblq.exe
  2⤵
  PID:4064
- C:\Windows\System\NGjYYxu.exe
  C:\Windows\System\NGjYYxu.exe
  2⤵
  PID:4080
- C:\Windows\System\ZqQgQXz.exe
  C:\Windows\System\ZqQgQXz.exe
  2⤵
  PID:3116
- C:\Windows\System\GTKCGnc.exe
  C:\Windows\System\GTKCGnc.exe
  2⤵
  PID:3124
- C:\Windows\System\EUboRAU.exe
  C:\Windows\System\EUboRAU.exe
  2⤵
  PID:1792
- C:\Windows\System\sVOvdjX.exe
  C:\Windows\System\sVOvdjX.exe
  2⤵
  PID:540
- C:\Windows\System\UYxbxFu.exe
  C:\Windows\System\UYxbxFu.exe
  2⤵
  PID:3264
- C:\Windows\System\UOOCfxs.exe
  C:\Windows\System\UOOCfxs.exe
  2⤵
  PID:1144
- C:\Windows\System\hFElLhD.exe
  C:\Windows\System\hFElLhD.exe
  2⤵
  PID:2124
- C:\Windows\System\MiAgocp.exe
  C:\Windows\System\MiAgocp.exe
  2⤵
  PID:2520
- C:\Windows\System\GHcdJoB.exe
  C:\Windows\System\GHcdJoB.exe
  2⤵
  PID:3176
- C:\Windows\System\kygPveS.exe
  C:\Windows\System\kygPveS.exe
  2⤵
  PID:3332
- C:\Windows\System\KVCdioa.exe
  C:\Windows\System\KVCdioa.exe
  2⤵
  PID:3100
- C:\Windows\System\iCEJLGU.exe
  C:\Windows\System\iCEJLGU.exe
  2⤵
  PID:1044
- C:\Windows\System\YHPLJGp.exe
  C:\Windows\System\YHPLJGp.exe
  2⤵
  PID:2404
- C:\Windows\System\tTjzgbT.exe
  C:\Windows\System\tTjzgbT.exe
  2⤵
  PID:3352
- C:\Windows\System\cSuTMGq.exe
  C:\Windows\System\cSuTMGq.exe
  2⤵
  PID:3432
- C:\Windows\System\lqyCMln.exe
  C:\Windows\System\lqyCMln.exe
  2⤵
  PID:3496
- C:\Windows\System\yTdqNZj.exe
  C:\Windows\System\yTdqNZj.exe
  2⤵
  PID:3444
- C:\Windows\System\xvEacWZ.exe
  C:\Windows\System\xvEacWZ.exe
  2⤵
  PID:3512
- C:\Windows\System\FtTlOEK.exe
  C:\Windows\System\FtTlOEK.exe
  2⤵
  PID:3588
- C:\Windows\System\VUrSgzv.exe
  C:\Windows\System\VUrSgzv.exe
  2⤵
  PID:3624
- C:\Windows\System\DBJSyJe.exe
  C:\Windows\System\DBJSyJe.exe
  2⤵
  PID:3608
- C:\Windows\System\PXODbMP.exe
  C:\Windows\System\PXODbMP.exe
  2⤵
  PID:3672
- C:\Windows\System\GlEWmBi.exe
  C:\Windows\System\GlEWmBi.exe
  2⤵
  PID:3716
- C:\Windows\System\FtTrLMK.exe
  C:\Windows\System\FtTrLMK.exe
  2⤵
  PID:3744
- C:\Windows\System\xmjlFlf.exe
  C:\Windows\System\xmjlFlf.exe
  2⤵
  PID:3760
- C:\Windows\System\ikEHUre.exe
  C:\Windows\System\ikEHUre.exe
  2⤵
  PID:3792
- C:\Windows\System\ecGtzBs.exe
  C:\Windows\System\ecGtzBs.exe
  2⤵
  PID:3820
- C:\Windows\System\OBqioYg.exe
  C:\Windows\System\OBqioYg.exe
  2⤵
  PID:3824
- C:\Windows\System\ePNqEzv.exe
  C:\Windows\System\ePNqEzv.exe
  2⤵
  PID:3872
- C:\Windows\System\pYqsABj.exe
  C:\Windows\System\pYqsABj.exe
  2⤵
  PID:3904
- C:\Windows\System\ECaQLRt.exe
  C:\Windows\System\ECaQLRt.exe
  2⤵
  PID:3924
- C:\Windows\System\HyvNMil.exe
  C:\Windows\System\HyvNMil.exe
  2⤵
  PID:3948
- C:\Windows\System\jYCyXZc.exe
  C:\Windows\System\jYCyXZc.exe
  2⤵
  PID:3980
- C:\Windows\System\rfUYQrd.exe
  C:\Windows\System\rfUYQrd.exe
  2⤵
  PID:4000
- C:\Windows\System\YPTopDa.exe
  C:\Windows\System\YPTopDa.exe
  2⤵
  PID:4032
- C:\Windows\System\rzKWIJz.exe
  C:\Windows\System\rzKWIJz.exe
  2⤵
  PID:4048
- C:\Windows\System\SPMbbHk.exe
  C:\Windows\System\SPMbbHk.exe
  2⤵
  PID:1532
- C:\Windows\System\pzaIHhM.exe
  C:\Windows\System\pzaIHhM.exe
  2⤵
  PID:3156
- C:\Windows\System\gRXkJUB.exe
  C:\Windows\System\gRXkJUB.exe
  2⤵
  PID:3160
- C:\Windows\System\pnPAvXU.exe
  C:\Windows\System\pnPAvXU.exe
  2⤵
  PID:3268
- C:\Windows\System\FOisjUC.exe
  C:\Windows\System\FOisjUC.exe
  2⤵
  PID:1688
- C:\Windows\System\CFJFXXk.exe
  C:\Windows\System\CFJFXXk.exe
  2⤵
  PID:3248
- C:\Windows\System\cJjQLnx.exe
  C:\Windows\System\cJjQLnx.exe
  2⤵
  PID:3172
- C:\Windows\System\ElQqwdg.exe
  C:\Windows\System\ElQqwdg.exe
  2⤵
  PID:3140
- C:\Windows\System\xBtBeRj.exe
  C:\Windows\System\xBtBeRj.exe
  2⤵
  PID:3016
- C:\Windows\System\RBHFGwa.exe
  C:\Windows\System\RBHFGwa.exe
  2⤵
  PID:3400
- C:\Windows\System\zVSLDCU.exe
  C:\Windows\System\zVSLDCU.exe
  2⤵
  PID:3416
- C:\Windows\System\bvwUEzn.exe
  C:\Windows\System\bvwUEzn.exe
  2⤵
  PID:3480
- C:\Windows\System\gXsfOhg.exe
  C:\Windows\System\gXsfOhg.exe
  2⤵
  PID:3572
- C:\Windows\System\xnMKPvb.exe
  C:\Windows\System\xnMKPvb.exe
  2⤵
  PID:3668
- C:\Windows\System\CVwlRAw.exe
  C:\Windows\System\CVwlRAw.exe
  2⤵
  PID:3708
- C:\Windows\System\PZmvokd.exe
  C:\Windows\System\PZmvokd.exe
  2⤵
  PID:3764
- C:\Windows\System\zfEXPuf.exe
  C:\Windows\System\zfEXPuf.exe
  2⤵
  PID:3828
- C:\Windows\System\npJxfhF.exe
  C:\Windows\System\npJxfhF.exe
  2⤵
  PID:3876
- C:\Windows\System\fkXqTiM.exe
  C:\Windows\System\fkXqTiM.exe
  2⤵
  PID:3912
- C:\Windows\System\BoXMqyG.exe
  C:\Windows\System\BoXMqyG.exe
  2⤵
  PID:3932
- C:\Windows\System\kKmYcRj.exe
  C:\Windows\System\kKmYcRj.exe
  2⤵
  PID:3972
- C:\Windows\System\GDuIsJE.exe
  C:\Windows\System\GDuIsJE.exe
  2⤵
  PID:4016
- C:\Windows\System\hJXJOiG.exe
  C:\Windows\System\hJXJOiG.exe
  2⤵
  PID:4088
- C:\Windows\System\tHzJjOU.exe
  C:\Windows\System\tHzJjOU.exe
  2⤵
  PID:3084
- C:\Windows\System\PgcBmkS.exe
  C:\Windows\System\PgcBmkS.exe
  2⤵
  PID:684
- C:\Windows\System\wtFhmws.exe
  C:\Windows\System\wtFhmws.exe
  2⤵
  PID:3212
- C:\Windows\System\mSnHSOr.exe
  C:\Windows\System\mSnHSOr.exe
  2⤵
  PID:884
- C:\Windows\System\AXOQsQa.exe
  C:\Windows\System\AXOQsQa.exe
  2⤵
  PID:3316
- C:\Windows\System\QiIswQQ.exe
  C:\Windows\System\QiIswQQ.exe
  2⤵
  PID:3380
- C:\Windows\System\EpmvVZW.exe
  C:\Windows\System\EpmvVZW.exe
  2⤵
  PID:3544
- C:\Windows\System\EiKqwhq.exe
  C:\Windows\System\EiKqwhq.exe
  2⤵
  PID:3712
- C:\Windows\System\vynuDRS.exe
  C:\Windows\System\vynuDRS.exe
  2⤵
  PID:3756
- C:\Windows\System\EmFLNpP.exe
  C:\Windows\System\EmFLNpP.exe
  2⤵
  PID:3856
- C:\Windows\System\dTRLwcQ.exe
  C:\Windows\System\dTRLwcQ.exe
  2⤵
  PID:3896
- C:\Windows\System\QXeBuJS.exe
  C:\Windows\System\QXeBuJS.exe
  2⤵
  PID:3968
- C:\Windows\System\rQIIpnY.exe
  C:\Windows\System\rQIIpnY.exe
  2⤵
  PID:4056
- C:\Windows\System\KsrcPDk.exe
  C:\Windows\System\KsrcPDk.exe
  2⤵
  PID:268
- C:\Windows\System\SudqbYn.exe
  C:\Windows\System\SudqbYn.exe
  2⤵
  PID:3216
- C:\Windows\System\LCpjcrD.exe
  C:\Windows\System\LCpjcrD.exe
  2⤵
  PID:1760
- C:\Windows\System\bVoXElP.exe
  C:\Windows\System\bVoXElP.exe
  2⤵
  PID:3508
- C:\Windows\System\AuhvUXP.exe
  C:\Windows\System\AuhvUXP.exe
  2⤵
  PID:3604
- C:\Windows\System\sBGnhXL.exe
  C:\Windows\System\sBGnhXL.exe
  2⤵
  PID:3836
- C:\Windows\System\kTRuWiH.exe
  C:\Windows\System\kTRuWiH.exe
  2⤵
  PID:3892
- C:\Windows\System\SDrVIEr.exe
  C:\Windows\System\SDrVIEr.exe
  2⤵
  PID:4020
- C:\Windows\System\cVZkvlt.exe
  C:\Windows\System\cVZkvlt.exe
  2⤵
  PID:2660
- C:\Windows\System\MfHFyca.exe
  C:\Windows\System\MfHFyca.exe
  2⤵
  PID:3104
- C:\Windows\System\tbytnhy.exe
  C:\Windows\System\tbytnhy.exe
  2⤵
  PID:3492
- C:\Windows\System\lpgrgtV.exe
  C:\Windows\System\lpgrgtV.exe
  2⤵
  PID:3952
- C:\Windows\System\oLYFaKk.exe
  C:\Windows\System\oLYFaKk.exe
  2⤵
  PID:4108
- C:\Windows\System\CiYilyJ.exe
  C:\Windows\System\CiYilyJ.exe
  2⤵
  PID:4124
- C:\Windows\System\afIppBK.exe
  C:\Windows\System\afIppBK.exe
  2⤵
  PID:4144
- C:\Windows\System\UdbBjCg.exe
  C:\Windows\System\UdbBjCg.exe
  2⤵
  PID:4164
- C:\Windows\System\bCtOwCP.exe
  C:\Windows\System\bCtOwCP.exe
  2⤵
  PID:4180
- C:\Windows\System\XgUWNBR.exe
  C:\Windows\System\XgUWNBR.exe
  2⤵
  PID:4200
- C:\Windows\System\xRGzRmh.exe
  C:\Windows\System\xRGzRmh.exe
  2⤵
  PID:4216
- C:\Windows\System\avKJavA.exe
  C:\Windows\System\avKJavA.exe
  2⤵
  PID:4232
- C:\Windows\System\oBfcyAM.exe
  C:\Windows\System\oBfcyAM.exe
  2⤵
  PID:4252
- C:\Windows\System\IqNLMFd.exe
  C:\Windows\System\IqNLMFd.exe
  2⤵
  PID:4268
- C:\Windows\System\jIwHuND.exe
  C:\Windows\System\jIwHuND.exe
  2⤵
  PID:4288
- C:\Windows\System\fNEElnH.exe
  C:\Windows\System\fNEElnH.exe
  2⤵
  PID:4304
- C:\Windows\System\SYbkMnq.exe
  C:\Windows\System\SYbkMnq.exe
  2⤵
  PID:4324
- C:\Windows\System\WRuotnt.exe
  C:\Windows\System\WRuotnt.exe
  2⤵
  PID:4340
- C:\Windows\System\GnwmbqD.exe
  C:\Windows\System\GnwmbqD.exe
  2⤵
  PID:4360
- C:\Windows\System\EDAlpSJ.exe
  C:\Windows\System\EDAlpSJ.exe
  2⤵
  PID:4380
- C:\Windows\System\DGySZVs.exe
  C:\Windows\System\DGySZVs.exe
  2⤵
  PID:4396
- C:\Windows\System\asCzltu.exe
  C:\Windows\System\asCzltu.exe
  2⤵
  PID:4416
- C:\Windows\System\AzGrLiD.exe
  C:\Windows\System\AzGrLiD.exe
  2⤵
  PID:4436
- C:\Windows\System\nHqeYqM.exe
  C:\Windows\System\nHqeYqM.exe
  2⤵
  PID:4452
- C:\Windows\System\PBMzoxM.exe
  C:\Windows\System\PBMzoxM.exe
  2⤵
  PID:4468
- C:\Windows\System\gHmhPYG.exe
  C:\Windows\System\gHmhPYG.exe
  2⤵
  PID:4488
- C:\Windows\System\mKWoSQE.exe
  C:\Windows\System\mKWoSQE.exe
  2⤵
  PID:4508
- C:\Windows\System\ekpWSBU.exe
  C:\Windows\System\ekpWSBU.exe
  2⤵
  PID:4524
- C:\Windows\System\dnzHRaG.exe
  C:\Windows\System\dnzHRaG.exe
  2⤵
  PID:4540
- C:\Windows\System\qUdKCPq.exe
  C:\Windows\System\qUdKCPq.exe
  2⤵
  PID:4556
- C:\Windows\System\mZhoZRR.exe
  C:\Windows\System\mZhoZRR.exe
  2⤵
  PID:4572
- C:\Windows\System\xBjOmkl.exe
  C:\Windows\System\xBjOmkl.exe
  2⤵
  PID:4588
- C:\Windows\System\DdELQnQ.exe
  C:\Windows\System\DdELQnQ.exe
  2⤵
  PID:4604
- C:\Windows\System\WEwULfz.exe
  C:\Windows\System\WEwULfz.exe
  2⤵
  PID:4620
- C:\Windows\System\sthmJnI.exe
  C:\Windows\System\sthmJnI.exe
  2⤵
  PID:4640
- C:\Windows\System\BMVhHqe.exe
  C:\Windows\System\BMVhHqe.exe
  2⤵
  PID:4664
- C:\Windows\System\VNwlhoT.exe
  C:\Windows\System\VNwlhoT.exe
  2⤵
  PID:4684
- C:\Windows\System\esUOOcI.exe
  C:\Windows\System\esUOOcI.exe
  2⤵
  PID:4700
- C:\Windows\System\USEkBcq.exe
  C:\Windows\System\USEkBcq.exe
  2⤵
  PID:4716
- C:\Windows\System\PnnmWMI.exe
  C:\Windows\System\PnnmWMI.exe
  2⤵
  PID:4732
- C:\Windows\System\ozesiBm.exe
  C:\Windows\System\ozesiBm.exe
  2⤵
  PID:4748
- C:\Windows\System\aSBotHj.exe
  C:\Windows\System\aSBotHj.exe
  2⤵
  PID:4764
- C:\Windows\System\bqnZYww.exe
  C:\Windows\System\bqnZYww.exe
  2⤵
  PID:4780
- C:\Windows\System\FJPrGqN.exe
  C:\Windows\System\FJPrGqN.exe
  2⤵
  PID:4796
- C:\Windows\System\ckGAgFo.exe
  C:\Windows\System\ckGAgFo.exe
  2⤵
  PID:4812
- C:\Windows\System\BEDkJUm.exe
  C:\Windows\System\BEDkJUm.exe
  2⤵
  PID:4828
- C:\Windows\System\XvhQlfd.exe
  C:\Windows\System\XvhQlfd.exe
  2⤵
  PID:4844
- C:\Windows\System\hXRzUGi.exe
  C:\Windows\System\hXRzUGi.exe
  2⤵
  PID:4860
- C:\Windows\System\gFeQWHE.exe
  C:\Windows\System\gFeQWHE.exe
  2⤵
  PID:4876
- C:\Windows\System\UgOGjLU.exe
  C:\Windows\System\UgOGjLU.exe
  2⤵
  PID:4892
- C:\Windows\System\cvCElzS.exe
  C:\Windows\System\cvCElzS.exe
  2⤵
  PID:4908
- C:\Windows\System\eYoByJc.exe
  C:\Windows\System\eYoByJc.exe
  2⤵
  PID:4924
- C:\Windows\System\VmJJSmy.exe
  C:\Windows\System\VmJJSmy.exe
  2⤵
  PID:4940
- C:\Windows\System\WHlwXMU.exe
  C:\Windows\System\WHlwXMU.exe
  2⤵
  PID:4956
- C:\Windows\System\YivgaZK.exe
  C:\Windows\System\YivgaZK.exe
  2⤵
  PID:4972
- C:\Windows\System\YfnyOCc.exe
  C:\Windows\System\YfnyOCc.exe
  2⤵
  PID:4988
- C:\Windows\System\fBsALTS.exe
  C:\Windows\System\fBsALTS.exe
  2⤵
  PID:5004
- C:\Windows\System\nUlXosl.exe
  C:\Windows\System\nUlXosl.exe
  2⤵
  PID:5020
- C:\Windows\System\ttUpUtH.exe
  C:\Windows\System\ttUpUtH.exe
  2⤵
  PID:5036
- C:\Windows\System\JzyMHmk.exe
  C:\Windows\System\JzyMHmk.exe
  2⤵
  PID:5052
- C:\Windows\System\bTGCqtO.exe
  C:\Windows\System\bTGCqtO.exe
  2⤵
  PID:5068
- C:\Windows\System\Qqvjsxy.exe
  C:\Windows\System\Qqvjsxy.exe
  2⤵
  PID:5084
- C:\Windows\System\GyYsYNQ.exe
  C:\Windows\System\GyYsYNQ.exe
  2⤵
  PID:5100
- C:\Windows\System\ENTCQyT.exe
  C:\Windows\System\ENTCQyT.exe
  2⤵
  PID:5116
- C:\Windows\System\TzaPTfD.exe
  C:\Windows\System\TzaPTfD.exe
  2⤵
  PID:4116
- C:\Windows\System\tWcXxWR.exe
  C:\Windows\System\tWcXxWR.exe
  2⤵
  PID:4156
- C:\Windows\System\poCrjvm.exe
  C:\Windows\System\poCrjvm.exe
  2⤵
  PID:4196
- C:\Windows\System\EypFDFZ.exe
  C:\Windows\System\EypFDFZ.exe
  2⤵
  PID:4264
- C:\Windows\System\TyBefOj.exe
  C:\Windows\System\TyBefOj.exe
  2⤵
  PID:4336
- C:\Windows\System\mNIeWeK.exe
  C:\Windows\System\mNIeWeK.exe
  2⤵
  PID:3636
- C:\Windows\System\wZTPZcn.exe
  C:\Windows\System\wZTPZcn.exe
  2⤵
  PID:4444
- C:\Windows\System\KCzJPID.exe
  C:\Windows\System\KCzJPID.exe
  2⤵
  PID:4484
- C:\Windows\System\lhUfNRa.exe
  C:\Windows\System\lhUfNRa.exe
  2⤵
  PID:2060
- C:\Windows\System\iqPHDrY.exe
  C:\Windows\System\iqPHDrY.exe
  2⤵
  PID:3840
- C:\Windows\System\ICLZIQU.exe
  C:\Windows\System\ICLZIQU.exe
  2⤵
  PID:3300
- C:\Windows\System\XAjVXvL.exe
  C:\Windows\System\XAjVXvL.exe
  2⤵
  PID:4136
- C:\Windows\System\TUFZUEq.exe
  C:\Windows\System\TUFZUEq.exe
  2⤵
  PID:4208
- C:\Windows\System\HjaKBIf.exe
  C:\Windows\System\HjaKBIf.exe
  2⤵
  PID:4248
- C:\Windows\System\QDtZxSF.exe
  C:\Windows\System\QDtZxSF.exe
  2⤵
  PID:4284
- C:\Windows\System\FJgeHTG.exe
  C:\Windows\System\FJgeHTG.exe
  2⤵
  PID:4356
- C:\Windows\System\VjtrHqg.exe
  C:\Windows\System\VjtrHqg.exe
  2⤵
  PID:4464
- C:\Windows\System\rZvmNDS.exe
  C:\Windows\System\rZvmNDS.exe
  2⤵
  PID:4520
- C:\Windows\System\oKicMvr.exe
  C:\Windows\System\oKicMvr.exe
  2⤵
  PID:4584
- C:\Windows\System\BSkYPVi.exe
  C:\Windows\System\BSkYPVi.exe
  2⤵
  PID:4504
- C:\Windows\System\ubPYsjN.exe
  C:\Windows\System\ubPYsjN.exe
  2⤵
  PID:4568
- C:\Windows\System\vgfDuqn.exe
  C:\Windows\System\vgfDuqn.exe
  2⤵
  PID:4632
- C:\Windows\System\FgJdATC.exe
  C:\Windows\System\FgJdATC.exe
  2⤵
  PID:4696
- C:\Windows\System\LqlthlU.exe
  C:\Windows\System\LqlthlU.exe
  2⤵
  PID:4760
- C:\Windows\System\lAPDEta.exe
  C:\Windows\System\lAPDEta.exe
  2⤵
  PID:4672
- C:\Windows\System\HTikEJN.exe
  C:\Windows\System\HTikEJN.exe
  2⤵
  PID:4824
- C:\Windows\System\YtKtbix.exe
  C:\Windows\System\YtKtbix.exe
  2⤵
  PID:4884
- C:\Windows\System\HuHSmjn.exe
  C:\Windows\System\HuHSmjn.exe
  2⤵
  PID:4948
- C:\Windows\System\ParTQIW.exe
  C:\Windows\System\ParTQIW.exe
  2⤵
  PID:5012
- C:\Windows\System\knoPTTQ.exe
  C:\Windows\System\knoPTTQ.exe
  2⤵
  PID:5076
- C:\Windows\System\rXEnzxL.exe
  C:\Windows\System\rXEnzxL.exe
  2⤵
  PID:2940
- C:\Windows\System\gcVfwMF.exe
  C:\Windows\System\gcVfwMF.exe
  2⤵
  PID:4372
- C:\Windows\System\xrKAFBf.exe
  C:\Windows\System\xrKAFBf.exe
  2⤵
  PID:4712
- C:\Windows\System\MDjCcrw.exe
  C:\Windows\System\MDjCcrw.exe
  2⤵
  PID:4392
- C:\Windows\System\aYgHMtv.exe
  C:\Windows\System\aYgHMtv.exe
  2⤵
  PID:4240
- C:\Windows\System\yvZcQse.exe
  C:\Windows\System\yvZcQse.exe
  2⤵
  PID:4244
- C:\Windows\System\KFrBUWJ.exe
  C:\Windows\System\KFrBUWJ.exe
  2⤵
  PID:4628
- C:\Windows\System\KPYAQdH.exe
  C:\Windows\System\KPYAQdH.exe
  2⤵
  PID:4728
- C:\Windows\System\bacNmpp.exe
  C:\Windows\System\bacNmpp.exe
  2⤵
  PID:4920
- C:\Windows\System\cHGUytk.exe
  C:\Windows\System\cHGUytk.exe
  2⤵
  PID:4872
- C:\Windows\System\EzbpeyJ.exe
  C:\Windows\System\EzbpeyJ.exe
  2⤵
  PID:4932
- C:\Windows\System\sjYWfUj.exe
  C:\Windows\System\sjYWfUj.exe
  2⤵
  PID:4964
- C:\Windows\System\uDIqZDZ.exe
  C:\Windows\System\uDIqZDZ.exe
  2⤵
  PID:5028
- C:\Windows\System\KqdlUPu.exe
  C:\Windows\System\KqdlUPu.exe
  2⤵
  PID:5092
- C:\Windows\System\uioSalv.exe
  C:\Windows\System\uioSalv.exe
  2⤵
  PID:4744
- C:\Windows\System\XjPYZVY.exe
  C:\Windows\System\XjPYZVY.exe
  2⤵
  PID:4332
- C:\Windows\System\PxBuUfQ.exe
  C:\Windows\System\PxBuUfQ.exe
  2⤵
  PID:4388
- C:\Windows\System\ADjJUxo.exe
  C:\Windows\System\ADjJUxo.exe
  2⤵
  PID:4280
- C:\Windows\System\DABxbXr.exe
  C:\Windows\System\DABxbXr.exe
  2⤵
  PID:4532
- C:\Windows\System\yElYKhz.exe
  C:\Windows\System\yElYKhz.exe
  2⤵
  PID:4680
- C:\Windows\System\wEnfAfu.exe
  C:\Windows\System\wEnfAfu.exe
  2⤵
  PID:5108
- C:\Windows\System\BQeQgyR.exe
  C:\Windows\System\BQeQgyR.exe
  2⤵
  PID:4476
- C:\Windows\System\dYYaulK.exe
  C:\Windows\System\dYYaulK.exe
  2⤵
  PID:4132
- C:\Windows\System\uyeXdKe.exe
  C:\Windows\System\uyeXdKe.exe
  2⤵
  PID:4756
- C:\Windows\System\nrDBVUI.exe
  C:\Windows\System\nrDBVUI.exe
  2⤵
  PID:4820
- C:\Windows\System\jYYnAoh.exe
  C:\Windows\System\jYYnAoh.exe
  2⤵
  PID:5064
- C:\Windows\System\XqOMCps.exe
  C:\Windows\System\XqOMCps.exe
  2⤵
  PID:3528
- C:\Windows\System\JvFjQdg.exe
  C:\Windows\System\JvFjQdg.exe
  2⤵
  PID:4856
- C:\Windows\System\bFJEeYu.exe
  C:\Windows\System\bFJEeYu.exe
  2⤵
  PID:5000
- C:\Windows\System\mdsLAhY.exe
  C:\Windows\System\mdsLAhY.exe
  2⤵
  PID:4480
- C:\Windows\System\IpKbtOO.exe
  C:\Windows\System\IpKbtOO.exe
  2⤵
  PID:4600
- C:\Windows\System\zfxsNZM.exe
  C:\Windows\System\zfxsNZM.exe
  2⤵
  PID:4460
- C:\Windows\System\WztYygW.exe
  C:\Windows\System\WztYygW.exe
  2⤵
  PID:4408
- C:\Windows\System\ByXuQJl.exe
  C:\Windows\System\ByXuQJl.exe
  2⤵
  PID:5124
- C:\Windows\System\FdwmZig.exe
  C:\Windows\System\FdwmZig.exe
  2⤵
  PID:5140
- C:\Windows\System\hCFkEwE.exe
  C:\Windows\System\hCFkEwE.exe
  2⤵
  PID:5156
- C:\Windows\System\dUTZMEt.exe
  C:\Windows\System\dUTZMEt.exe
  2⤵
  PID:5172
- C:\Windows\System\vHMMXvR.exe
  C:\Windows\System\vHMMXvR.exe
  2⤵
  PID:5188
- C:\Windows\System\NDWmXmL.exe
  C:\Windows\System\NDWmXmL.exe
  2⤵
  PID:5204
- C:\Windows\System\mEpClMP.exe
  C:\Windows\System\mEpClMP.exe
  2⤵
  PID:5220
- C:\Windows\System\EKcrIsp.exe
  C:\Windows\System\EKcrIsp.exe
  2⤵
  PID:5236
- C:\Windows\System\maBnrVn.exe
  C:\Windows\System\maBnrVn.exe
  2⤵
  PID:5252
- C:\Windows\System\YvskwNs.exe
  C:\Windows\System\YvskwNs.exe
  2⤵
  PID:5268
- C:\Windows\System\HZROpIB.exe
  C:\Windows\System\HZROpIB.exe
  2⤵
  PID:5284
- C:\Windows\System\DCpFOpf.exe
  C:\Windows\System\DCpFOpf.exe
  2⤵
  PID:5300
- C:\Windows\System\XthWGFS.exe
  C:\Windows\System\XthWGFS.exe
  2⤵
  PID:5316
- C:\Windows\System\ttCcFEW.exe
  C:\Windows\System\ttCcFEW.exe
  2⤵
  PID:5332
- C:\Windows\System\bgsHpPY.exe
  C:\Windows\System\bgsHpPY.exe
  2⤵
  PID:5348
- C:\Windows\System\Goihhqh.exe
  C:\Windows\System\Goihhqh.exe
  2⤵
  PID:5364
- C:\Windows\System\dnsXKrG.exe
  C:\Windows\System\dnsXKrG.exe
  2⤵
  PID:5380
- C:\Windows\System\NNxihXN.exe
  C:\Windows\System\NNxihXN.exe
  2⤵
  PID:5396
- C:\Windows\System\WmcfWyI.exe
  C:\Windows\System\WmcfWyI.exe
  2⤵
  PID:5412
- C:\Windows\System\KUGXWSX.exe
  C:\Windows\System\KUGXWSX.exe
  2⤵
  PID:5428
- C:\Windows\System\akJQwVT.exe
  C:\Windows\System\akJQwVT.exe
  2⤵
  PID:5444
- C:\Windows\System\XNMUqpQ.exe
  C:\Windows\System\XNMUqpQ.exe
  2⤵
  PID:5460
- C:\Windows\System\wblgwBb.exe
  C:\Windows\System\wblgwBb.exe
  2⤵
  PID:5476
- C:\Windows\System\ZWuGZoW.exe
  C:\Windows\System\ZWuGZoW.exe
  2⤵
  PID:5492
- C:\Windows\System\pluoOna.exe
  C:\Windows\System\pluoOna.exe
  2⤵
  PID:5508
- C:\Windows\System\IXHIhxT.exe
  C:\Windows\System\IXHIhxT.exe
  2⤵
  PID:5524
- C:\Windows\System\hVZNxFg.exe
  C:\Windows\System\hVZNxFg.exe
  2⤵
  PID:5540
- C:\Windows\System\SdomPGO.exe
  C:\Windows\System\SdomPGO.exe
  2⤵
  PID:5556
- C:\Windows\System\RUSDBDF.exe
  C:\Windows\System\RUSDBDF.exe
  2⤵
  PID:5572
- C:\Windows\System\rMbmCgq.exe
  C:\Windows\System\rMbmCgq.exe
  2⤵
  PID:5588
- C:\Windows\System\xmAckqa.exe
  C:\Windows\System\xmAckqa.exe
  2⤵
  PID:5604
- C:\Windows\System\XuRsxjO.exe
  C:\Windows\System\XuRsxjO.exe
  2⤵
  PID:5620
- C:\Windows\System\WmqrykV.exe
  C:\Windows\System\WmqrykV.exe
  2⤵
  PID:5636
- C:\Windows\System\IBIZgGS.exe
  C:\Windows\System\IBIZgGS.exe
  2⤵
  PID:5652
- C:\Windows\System\JQFVdem.exe
  C:\Windows\System\JQFVdem.exe
  2⤵
  PID:5668
- C:\Windows\System\RCQqFga.exe
  C:\Windows\System\RCQqFga.exe
  2⤵
  PID:5684
- C:\Windows\System\zWSPDVR.exe
  C:\Windows\System\zWSPDVR.exe
  2⤵
  PID:5700
- C:\Windows\System\ojZgGkY.exe
  C:\Windows\System\ojZgGkY.exe
  2⤵
  PID:5716
- C:\Windows\System\qFNvBTd.exe
  C:\Windows\System\qFNvBTd.exe
  2⤵
  PID:5732
- C:\Windows\System\QnIwXem.exe
  C:\Windows\System\QnIwXem.exe
  2⤵
  PID:5748
- C:\Windows\System\HCcwrPN.exe
  C:\Windows\System\HCcwrPN.exe
  2⤵
  PID:5764
- C:\Windows\System\gciLkSr.exe
  C:\Windows\System\gciLkSr.exe
  2⤵
  PID:5780
- C:\Windows\System\UZSLFSE.exe
  C:\Windows\System\UZSLFSE.exe
  2⤵
  PID:5796
- C:\Windows\System\ZnrIMoy.exe
  C:\Windows\System\ZnrIMoy.exe
  2⤵
  PID:5812
- C:\Windows\System\DanYAeK.exe
  C:\Windows\System\DanYAeK.exe
  2⤵
  PID:5832
- C:\Windows\System\bykTPBb.exe
  C:\Windows\System\bykTPBb.exe
  2⤵
  PID:5848
- C:\Windows\System\kmztoHE.exe
  C:\Windows\System\kmztoHE.exe
  2⤵
  PID:5864
- C:\Windows\System\FVSYrSI.exe
  C:\Windows\System\FVSYrSI.exe
  2⤵
  PID:5880
- C:\Windows\System\pKvpEzb.exe
  C:\Windows\System\pKvpEzb.exe
  2⤵
  PID:5896
- C:\Windows\System\fTlnlwZ.exe
  C:\Windows\System\fTlnlwZ.exe
  2⤵
  PID:5912
- C:\Windows\System\qiXIdSQ.exe
  C:\Windows\System\qiXIdSQ.exe
  2⤵
  PID:5928
- C:\Windows\System\kgtKNoR.exe
  C:\Windows\System\kgtKNoR.exe
  2⤵
  PID:5944
- C:\Windows\System\NZFIgFF.exe
  C:\Windows\System\NZFIgFF.exe
  2⤵
  PID:5960
- C:\Windows\System\gPqKPtf.exe
  C:\Windows\System\gPqKPtf.exe
  2⤵
  PID:5976
- C:\Windows\System\oWByICw.exe
  C:\Windows\System\oWByICw.exe
  2⤵
  PID:5992
- C:\Windows\System\YCatVLX.exe
  C:\Windows\System\YCatVLX.exe
  2⤵
  PID:6008
- C:\Windows\System\ZatPVmr.exe
  C:\Windows\System\ZatPVmr.exe
  2⤵
  PID:6024
- C:\Windows\System\XiBFKBU.exe
  C:\Windows\System\XiBFKBU.exe
  2⤵
  PID:6040
- C:\Windows\System\KXYuxtB.exe
  C:\Windows\System\KXYuxtB.exe
  2⤵
  PID:6056
- C:\Windows\System\BIPkSIk.exe
  C:\Windows\System\BIPkSIk.exe
  2⤵
  PID:6072
- C:\Windows\System\QOwSgBk.exe
  C:\Windows\System\QOwSgBk.exe
  2⤵
  PID:6088
- C:\Windows\System\zxJoMrb.exe
  C:\Windows\System\zxJoMrb.exe
  2⤵
  PID:6104
- C:\Windows\System\aULCcym.exe
  C:\Windows\System\aULCcym.exe
  2⤵
  PID:6120
- C:\Windows\System\wNCnNHC.exe
  C:\Windows\System\wNCnNHC.exe
  2⤵
  PID:6136
- C:\Windows\System\IkmNAio.exe
  C:\Windows\System\IkmNAio.exe
  2⤵
  PID:5152
- C:\Windows\System\gvXmZnI.exe
  C:\Windows\System\gvXmZnI.exe
  2⤵
  PID:5212
- C:\Windows\System\LjpvvNp.exe
  C:\Windows\System\LjpvvNp.exe
  2⤵
  PID:5248
- C:\Windows\System\hhRXIKe.exe
  C:\Windows\System\hhRXIKe.exe
  2⤵
  PID:5308
- C:\Windows\System\CfzjhmI.exe
  C:\Windows\System\CfzjhmI.exe
  2⤵
  PID:5340
- C:\Windows\System\QiZwExc.exe
  C:\Windows\System\QiZwExc.exe
  2⤵
  PID:5168
- C:\Windows\System\WmeLqrO.exe
  C:\Windows\System\WmeLqrO.exe
  2⤵
  PID:5196
- C:\Windows\System\LYlFwyE.exe
  C:\Windows\System\LYlFwyE.exe
  2⤵
  PID:5440
- C:\Windows\System\gPvtYKV.exe
  C:\Windows\System\gPvtYKV.exe
  2⤵
  PID:4772
- C:\Windows\System\aNpOlHF.exe
  C:\Windows\System\aNpOlHF.exe
  2⤵
  PID:4840
- C:\Windows\System\aqnsHti.exe
  C:\Windows\System\aqnsHti.exe
  2⤵
  PID:4448
- C:\Windows\System\KqgIuvx.exe
  C:\Windows\System\KqgIuvx.exe
  2⤵
  PID:5500
- C:\Windows\System\MpMjvVj.exe
  C:\Windows\System\MpMjvVj.exe
  2⤵
  PID:5136
- C:\Windows\System\ggeWrwq.exe
  C:\Windows\System\ggeWrwq.exe
  2⤵
  PID:5200
- C:\Windows\System\moIkmBM.exe
  C:\Windows\System\moIkmBM.exe
  2⤵
  PID:5568
- C:\Windows\System\LzJnQVu.exe
  C:\Windows\System\LzJnQVu.exe
  2⤵
  PID:5600
- C:\Windows\System\AiCiUfw.exe
  C:\Windows\System\AiCiUfw.exe
  2⤵
  PID:5664
- C:\Windows\System\pkZKAex.exe
  C:\Windows\System\pkZKAex.exe
  2⤵
  PID:5456
- C:\Windows\System\bBbXwFX.exe
  C:\Windows\System\bBbXwFX.exe
  2⤵
  PID:5520
- C:\Windows\System\tLTDiml.exe
  C:\Windows\System\tLTDiml.exe
  2⤵
  PID:5552
- C:\Windows\System\YeDtzaO.exe
  C:\Windows\System\YeDtzaO.exe
  2⤵
  PID:5616
- C:\Windows\System\yBnzJaT.exe
  C:\Windows\System\yBnzJaT.exe
  2⤵
  PID:5680
- C:\Windows\System\BmIVlZi.exe
  C:\Windows\System\BmIVlZi.exe
  2⤵
  PID:5728
- C:\Windows\System\vRnJzxz.exe
  C:\Windows\System\vRnJzxz.exe
  2⤵
  PID:5772
- C:\Windows\System\hXHZIJo.exe
  C:\Windows\System\hXHZIJo.exe
  2⤵
  PID:5824
- C:\Windows\System\SBtlxoH.exe
  C:\Windows\System\SBtlxoH.exe
  2⤵
  PID:5744
- C:\Windows\System\sZYhqRZ.exe
  C:\Windows\System\sZYhqRZ.exe
  2⤵
  PID:5924
- C:\Windows\System\IQKcAfx.exe
  C:\Windows\System\IQKcAfx.exe
  2⤵
  PID:5988
- C:\Windows\System\HZakVoK.exe
  C:\Windows\System\HZakVoK.exe
  2⤵
  PID:6020
- C:\Windows\System\pDVAtBc.exe
  C:\Windows\System\pDVAtBc.exe
  2⤵
  PID:6112
- C:\Windows\System\GkeKihH.exe
  C:\Windows\System\GkeKihH.exe
  2⤵
  PID:5244
- C:\Windows\System\UfFNIiK.exe
  C:\Windows\System\UfFNIiK.exe
  2⤵
  PID:5044
- C:\Windows\System\GoShVgr.exe
  C:\Windows\System\GoShVgr.exe
  2⤵
  PID:5376
- C:\Windows\System\TKwDiDg.exe
  C:\Windows\System\TKwDiDg.exe
  2⤵
  PID:5452
- C:\Windows\System\jibwKZK.exe
  C:\Windows\System\jibwKZK.exe
  2⤵
  PID:5232
- C:\Windows\System\XkodUdn.exe
  C:\Windows\System\XkodUdn.exe
  2⤵
  PID:5840
- C:\Windows\System\xYoWhTk.exe
  C:\Windows\System\xYoWhTk.exe
  2⤵
  PID:5408
- C:\Windows\System\xnOtVpb.exe
  C:\Windows\System\xnOtVpb.exe
  2⤵
  PID:5908
- C:\Windows\System\avMzLje.exe
  C:\Windows\System\avMzLje.exe
  2⤵
  PID:5968
- C:\Windows\System\gmuqFDn.exe
  C:\Windows\System\gmuqFDn.exe
  2⤵
  PID:4192
- C:\Windows\System\MBuCnzb.exe
  C:\Windows\System\MBuCnzb.exe
  2⤵
  PID:6100
- C:\Windows\System\FUiWNWI.exe
  C:\Windows\System\FUiWNWI.exe
  2⤵
  PID:5164
- C:\Windows\System\zpriDuO.exe
  C:\Windows\System\zpriDuO.exe
  2⤵
  PID:5132
- C:\Windows\System\FjHuNvl.exe
  C:\Windows\System\FjHuNvl.exe
  2⤵
  PID:5260
- C:\Windows\System\fDzHqHJ.exe
  C:\Windows\System\fDzHqHJ.exe
  2⤵
  PID:5488
- C:\Windows\System\JHHqRsM.exe
  C:\Windows\System\JHHqRsM.exe
  2⤵
  PID:5612
- C:\Windows\System\JYBuVEE.exe
  C:\Windows\System\JYBuVEE.exe
  2⤵
  PID:5792
- C:\Windows\System\pCVsfqa.exe
  C:\Windows\System\pCVsfqa.exe
  2⤵
  PID:6052
- C:\Windows\System\ZirksoK.exe
  C:\Windows\System\ZirksoK.exe
  2⤵
  PID:5876
- C:\Windows\System\fpqdGgP.exe
  C:\Windows\System\fpqdGgP.exe
  2⤵
  PID:5696
- C:\Windows\System\kmowlzV.exe
  C:\Windows\System\kmowlzV.exe
  2⤵
  PID:5860
- C:\Windows\System\pQIeVgP.exe
  C:\Windows\System\pQIeVgP.exe
  2⤵
  PID:5804
- C:\Windows\System\AxiVatw.exe
  C:\Windows\System\AxiVatw.exe
  2⤵
  PID:4984
- C:\Windows\System\wsTEEwR.exe
  C:\Windows\System\wsTEEwR.exe
  2⤵
  PID:5940
- C:\Windows\System\hZlparJ.exe
  C:\Windows\System\hZlparJ.exe
  2⤵
  PID:6064
- C:\Windows\System\XbRMAyT.exe
  C:\Windows\System\XbRMAyT.exe
  2⤵
  PID:5904
- C:\Windows\System\kaVxLAS.exe
  C:\Windows\System\kaVxLAS.exe
  2⤵
  PID:5276
- C:\Windows\System\QKgjhSc.exe
  C:\Windows\System\QKgjhSc.exe
  2⤵
  PID:5724
- C:\Windows\System\xNhXuQi.exe
  C:\Windows\System\xNhXuQi.exe
  2⤵
  PID:5808
- C:\Windows\System\TvqwlWR.exe
  C:\Windows\System\TvqwlWR.exe
  2⤵
  PID:5584
- C:\Windows\System\hYJFhvz.exe
  C:\Windows\System\hYJFhvz.exe
  2⤵
  PID:4004
- C:\Windows\System\JjverTO.exe
  C:\Windows\System\JjverTO.exe
  2⤵
  PID:5388
- C:\Windows\System\RoEcVQm.exe
  C:\Windows\System\RoEcVQm.exe
  2⤵
  PID:5536
- C:\Windows\System\BZKZrJH.exe
  C:\Windows\System\BZKZrJH.exe
  2⤵
  PID:6156
- C:\Windows\System\JLjmoEw.exe
  C:\Windows\System\JLjmoEw.exe
  2⤵
  PID:6172
- C:\Windows\System\PMMKfCg.exe
  C:\Windows\System\PMMKfCg.exe
  2⤵
  PID:6188
- C:\Windows\System\uqMJDKn.exe
  C:\Windows\System\uqMJDKn.exe
  2⤵
  PID:6204
- C:\Windows\System\SpJiexL.exe
  C:\Windows\System\SpJiexL.exe
  2⤵
  PID:6220
- C:\Windows\System\GfULGTm.exe
  C:\Windows\System\GfULGTm.exe
  2⤵
  PID:6236
- C:\Windows\System\yGQltsC.exe
  C:\Windows\System\yGQltsC.exe
  2⤵
  PID:6252
- C:\Windows\System\fcVpiPp.exe
  C:\Windows\System\fcVpiPp.exe
  2⤵
  PID:6268
- C:\Windows\System\ngZmDBU.exe
  C:\Windows\System\ngZmDBU.exe
  2⤵
  PID:6284
- C:\Windows\System\IFkxkvj.exe
  C:\Windows\System\IFkxkvj.exe
  2⤵
  PID:6300
- C:\Windows\System\ZbTNAve.exe
  C:\Windows\System\ZbTNAve.exe
  2⤵
  PID:6316
- C:\Windows\System\zJnhFaF.exe
  C:\Windows\System\zJnhFaF.exe
  2⤵
  PID:6332
- C:\Windows\System\BeslMCi.exe
  C:\Windows\System\BeslMCi.exe
  2⤵
  PID:6348
- C:\Windows\System\FaIFyyw.exe
  C:\Windows\System\FaIFyyw.exe
  2⤵
  PID:6364
- C:\Windows\System\yktrCLg.exe
  C:\Windows\System\yktrCLg.exe
  2⤵
  PID:6380
- C:\Windows\System\VwUZywP.exe
  C:\Windows\System\VwUZywP.exe
  2⤵
  PID:6396
- C:\Windows\System\qLUBHMU.exe
  C:\Windows\System\qLUBHMU.exe
  2⤵
  PID:6412
- C:\Windows\System\onXYuqK.exe
  C:\Windows\System\onXYuqK.exe
  2⤵
  PID:6428
- C:\Windows\System\FuDjeWc.exe
  C:\Windows\System\FuDjeWc.exe
  2⤵
  PID:6444
- C:\Windows\System\SyiOZYL.exe
  C:\Windows\System\SyiOZYL.exe
  2⤵
  PID:6460
- C:\Windows\System\HxArNon.exe
  C:\Windows\System\HxArNon.exe
  2⤵
  PID:6476
- C:\Windows\System\RMKuoKN.exe
  C:\Windows\System\RMKuoKN.exe
  2⤵
  PID:6492
- C:\Windows\System\gbKdszc.exe
  C:\Windows\System\gbKdszc.exe
  2⤵
  PID:6508
- C:\Windows\System\GNsXMLs.exe
  C:\Windows\System\GNsXMLs.exe
  2⤵
  PID:6524
- C:\Windows\System\rOrjBZx.exe
  C:\Windows\System\rOrjBZx.exe
  2⤵
  PID:6540
- C:\Windows\System\Aiqsufo.exe
  C:\Windows\System\Aiqsufo.exe
  2⤵
  PID:6556
- C:\Windows\System\FmffnwC.exe
  C:\Windows\System\FmffnwC.exe
  2⤵
  PID:6572
- C:\Windows\System\iqhgjAf.exe
  C:\Windows\System\iqhgjAf.exe
  2⤵
  PID:6588
- C:\Windows\System\fGSPsig.exe
  C:\Windows\System\fGSPsig.exe
  2⤵
  PID:6604
- C:\Windows\System\kWUWIvK.exe
  C:\Windows\System\kWUWIvK.exe
  2⤵
  PID:6620
- C:\Windows\System\ljXwJhb.exe
  C:\Windows\System\ljXwJhb.exe
  2⤵
  PID:6636
- C:\Windows\System\gSUJqHT.exe
  C:\Windows\System\gSUJqHT.exe
  2⤵
  PID:6652
- C:\Windows\System\wadYuMI.exe
  C:\Windows\System\wadYuMI.exe
  2⤵
  PID:6668
- C:\Windows\System\AxRJHLx.exe
  C:\Windows\System\AxRJHLx.exe
  2⤵
  PID:6684
- C:\Windows\System\FfRKBHo.exe
  C:\Windows\System\FfRKBHo.exe
  2⤵
  PID:6700
- C:\Windows\System\MTLZQIa.exe
  C:\Windows\System\MTLZQIa.exe
  2⤵
  PID:6716
- C:\Windows\System\iyyEhHX.exe
  C:\Windows\System\iyyEhHX.exe
  2⤵
  PID:6732
- C:\Windows\System\OhwjUyR.exe
  C:\Windows\System\OhwjUyR.exe
  2⤵
  PID:6748
- C:\Windows\System\sgnqkSU.exe
  C:\Windows\System\sgnqkSU.exe
  2⤵
  PID:6764
- C:\Windows\System\TRDXnwO.exe
  C:\Windows\System\TRDXnwO.exe
  2⤵
  PID:6780
- C:\Windows\System\hvknbDm.exe
  C:\Windows\System\hvknbDm.exe
  2⤵
  PID:6796
- C:\Windows\System\zXmUMUq.exe
  C:\Windows\System\zXmUMUq.exe
  2⤵
  PID:6812
- C:\Windows\System\CfeFPJb.exe
  C:\Windows\System\CfeFPJb.exe
  2⤵
  PID:6828
- C:\Windows\System\jqLRFDq.exe
  C:\Windows\System\jqLRFDq.exe
  2⤵
  PID:6844
- C:\Windows\System\UbAdobc.exe
  C:\Windows\System\UbAdobc.exe
  2⤵
  PID:6860
- C:\Windows\System\MOULqpT.exe
  C:\Windows\System\MOULqpT.exe
  2⤵
  PID:6876
- C:\Windows\System\eOCYUHb.exe
  C:\Windows\System\eOCYUHb.exe
  2⤵
  PID:6892
- C:\Windows\System\nuIcPWT.exe
  C:\Windows\System\nuIcPWT.exe
  2⤵
  PID:6908
- C:\Windows\System\rJrGmts.exe
  C:\Windows\System\rJrGmts.exe
  2⤵
  PID:6924
- C:\Windows\System\KsSRdNP.exe
  C:\Windows\System\KsSRdNP.exe
  2⤵
  PID:6940
- C:\Windows\System\zjMIFVz.exe
  C:\Windows\System\zjMIFVz.exe
  2⤵
  PID:6956
- C:\Windows\System\JkgdwMM.exe
  C:\Windows\System\JkgdwMM.exe
  2⤵
  PID:6972
- C:\Windows\System\lgoPqMh.exe
  C:\Windows\System\lgoPqMh.exe
  2⤵
  PID:6988
- C:\Windows\System\cgQXijG.exe
  C:\Windows\System\cgQXijG.exe
  2⤵
  PID:7004
- C:\Windows\System\eGHptfc.exe
  C:\Windows\System\eGHptfc.exe
  2⤵
  PID:7020
- C:\Windows\System\GnlhKyR.exe
  C:\Windows\System\GnlhKyR.exe
  2⤵
  PID:7036
- C:\Windows\System\gJeVEYE.exe
  C:\Windows\System\gJeVEYE.exe
  2⤵
  PID:7052
- C:\Windows\System\uwduYJv.exe
  C:\Windows\System\uwduYJv.exe
  2⤵
  PID:7068
- C:\Windows\System\lpWNiFv.exe
  C:\Windows\System\lpWNiFv.exe
  2⤵
  PID:7084
- C:\Windows\System\ZpqTXsx.exe
  C:\Windows\System\ZpqTXsx.exe
  2⤵
  PID:7100
- C:\Windows\System\SRaZxaq.exe
  C:\Windows\System\SRaZxaq.exe
  2⤵
  PID:7116
- C:\Windows\System\XorihDt.exe
  C:\Windows\System\XorihDt.exe
  2⤵
  PID:7132
- C:\Windows\System\gLdsCjN.exe
  C:\Windows\System\gLdsCjN.exe
  2⤵
  PID:7148
- C:\Windows\System\xcBnFFy.exe
  C:\Windows\System\xcBnFFy.exe
  2⤵
  PID:7164
- C:\Windows\System\QKdRZzt.exe
  C:\Windows\System\QKdRZzt.exe
  2⤵
  PID:6168
- C:\Windows\System\IFMaxNm.exe
  C:\Windows\System\IFMaxNm.exe
  2⤵
  PID:6232
- C:\Windows\System\iMpXDOW.exe
  C:\Windows\System\iMpXDOW.exe
  2⤵
  PID:5984
- C:\Windows\System\MfWtefS.exe
  C:\Windows\System\MfWtefS.exe
  2⤵
  PID:6084
- C:\Windows\System\fFZWiOP.exe
  C:\Windows\System\fFZWiOP.exe
  2⤵
  PID:6152
- C:\Windows\System\WGeIYxT.exe
  C:\Windows\System\WGeIYxT.exe
  2⤵
  PID:6048
- C:\Windows\System\icWESni.exe
  C:\Windows\System\icWESni.exe
  2⤵
  PID:6148
- C:\Windows\System\flZjHKa.exe
  C:\Windows\System\flZjHKa.exe
  2⤵
  PID:6216
- C:\Windows\System\eFpGXfd.exe
  C:\Windows\System\eFpGXfd.exe
  2⤵
  PID:6360
- C:\Windows\System\CZEnZnL.exe
  C:\Windows\System\CZEnZnL.exe
  2⤵
  PID:6424
- C:\Windows\System\HIHElQt.exe
  C:\Windows\System\HIHElQt.exe
  2⤵
  PID:6308
- C:\Windows\System\CpHdnqd.exe
  C:\Windows\System\CpHdnqd.exe
  2⤵
  PID:6516
- C:\Windows\System\BZCiQzC.exe
  C:\Windows\System\BZCiQzC.exe
  2⤵
  PID:6468
- C:\Windows\System\aNyHPlX.exe
  C:\Windows\System\aNyHPlX.exe
  2⤵
  PID:6312
- C:\Windows\System\qCnuMiP.exe
  C:\Windows\System\qCnuMiP.exe
  2⤵
  PID:6372
- C:\Windows\System\lsxPUFW.exe
  C:\Windows\System\lsxPUFW.exe
  2⤵
  PID:6552
- C:\Windows\System\oJyxzvr.exe
  C:\Windows\System\oJyxzvr.exe
  2⤵
  PID:6580
- C:\Windows\System\jWQBBhi.exe
  C:\Windows\System\jWQBBhi.exe
  2⤵
  PID:6648
- C:\Windows\System\VvGkSsq.exe
  C:\Windows\System\VvGkSsq.exe
  2⤵
  PID:6568
- C:\Windows\System\wMkDqXR.exe
  C:\Windows\System\wMkDqXR.exe
  2⤵
  PID:6740
- C:\Windows\System\WynchEA.exe
  C:\Windows\System\WynchEA.exe
  2⤵
  PID:6808
- C:\Windows\System\bxacDOL.exe
  C:\Windows\System\bxacDOL.exe
  2⤵
  PID:6868
- C:\Windows\System\nSwlzEB.exe
  C:\Windows\System\nSwlzEB.exe
  2⤵
  PID:6904
- C:\Windows\System\UjNFZzG.exe
  C:\Windows\System\UjNFZzG.exe
  2⤵
  PID:6600
- C:\Windows\System\GZqIzht.exe
  C:\Windows\System\GZqIzht.exe
  2⤵
  PID:6628
- C:\Windows\System\FWpbzwJ.exe
  C:\Windows\System\FWpbzwJ.exe
  2⤵
  PID:6660
- C:\Windows\System\rnPubuN.exe
  C:\Windows\System\rnPubuN.exe
  2⤵
  PID:6788
- C:\Windows\System\ScxNIzL.exe
  C:\Windows\System\ScxNIzL.exe
  2⤵
  PID:6852
- C:\Windows\System\BxXqNSG.exe
  C:\Windows\System\BxXqNSG.exe
  2⤵
  PID:6948
- C:\Windows\System\yDrNcfa.exe
  C:\Windows\System\yDrNcfa.exe
  2⤵
  PID:6968
- C:\Windows\System\oJUvwJA.exe
  C:\Windows\System\oJUvwJA.exe
  2⤵
  PID:7032
- C:\Windows\System\hkYglGi.exe
  C:\Windows\System\hkYglGi.exe
  2⤵
  PID:7016
- C:\Windows\System\RefRtie.exe
  C:\Windows\System\RefRtie.exe
  2⤵
  PID:7096
- C:\Windows\System\oXstiON.exe
  C:\Windows\System\oXstiON.exe
  2⤵
  PID:7108
- C:\Windows\System\ovHBuYg.exe
  C:\Windows\System\ovHBuYg.exe
  2⤵
  PID:7156
- C:\Windows\System\zIDNhGY.exe
  C:\Windows\System\zIDNhGY.exe
  2⤵
  PID:5324
- C:\Windows\System\IYCYMXv.exe
  C:\Windows\System\IYCYMXv.exe
  2⤵
  PID:7144
- C:\Windows\System\wbYLKsu.exe
  C:\Windows\System\wbYLKsu.exe
  2⤵
  PID:6420
- C:\Windows\System\NqGcbTS.exe
  C:\Windows\System\NqGcbTS.exe
  2⤵
  PID:6408
- C:\Windows\System\XmMLafh.exe
  C:\Windows\System\XmMLafh.exe
  2⤵
  PID:7140
- C:\Windows\System\tVQqNPm.exe
  C:\Windows\System\tVQqNPm.exe
  2⤵
  PID:6164
- C:\Windows\System\QutYpMO.exe
  C:\Windows\System\QutYpMO.exe
  2⤵
  PID:6840
- C:\Windows\System\OWsIfpX.exe
  C:\Windows\System\OWsIfpX.exe
  2⤵
  PID:6404
- C:\Windows\System\JZKZfbS.exe
  C:\Windows\System\JZKZfbS.exe
  2⤵
  PID:6772
- C:\Windows\System\LCeUFpl.exe
  C:\Windows\System\LCeUFpl.exe
  2⤵
  PID:6456
- C:\Windows\System\hyGIgdk.exe
  C:\Windows\System\hyGIgdk.exe
  2⤵
  PID:6804
- C:\Windows\System\JbQsWqq.exe
  C:\Windows\System\JbQsWqq.exe
  2⤵
  PID:6536
- C:\Windows\System\QzwfMNx.exe
  C:\Windows\System\QzwfMNx.exe
  2⤵
  PID:6900
- C:\Windows\System\LWMIuzM.exe
  C:\Windows\System\LWMIuzM.exe
  2⤵
  PID:6760
- C:\Windows\System\igIFBal.exe
  C:\Windows\System\igIFBal.exe
  2⤵
  PID:6820
- C:\Windows\System\bwzzWnj.exe
  C:\Windows\System\bwzzWnj.exe
  2⤵
  PID:7044
- C:\Windows\System\rrgWHAU.exe
  C:\Windows\System\rrgWHAU.exe
  2⤵
  PID:6488
- C:\Windows\System\KrNkCfl.exe
  C:\Windows\System\KrNkCfl.exe
  2⤵
  PID:5436
- C:\Windows\System\EEOZMbD.exe
  C:\Windows\System\EEOZMbD.exe
  2⤵
  PID:7080
- C:\Windows\System\ribESVM.exe
  C:\Windows\System\ribESVM.exe
  2⤵
  PID:6392
- C:\Windows\System\btfeAHQ.exe
  C:\Windows\System\btfeAHQ.exe
  2⤵
  PID:6776
- C:\Windows\System\XozhEea.exe
  C:\Windows\System\XozhEea.exe
  2⤵
  PID:6884
- C:\Windows\System\JwLSiuo.exe
  C:\Windows\System\JwLSiuo.exe
  2⤵
  PID:6920
- C:\Windows\System\JkMAtKQ.exe
  C:\Windows\System\JkMAtKQ.exe
  2⤵
  PID:6356
- C:\Windows\System\sTqpADR.exe
  C:\Windows\System\sTqpADR.exe
  2⤵
  PID:6824
- C:\Windows\System\cIbLcbp.exe
  C:\Windows\System\cIbLcbp.exe
  2⤵
  PID:6756
- C:\Windows\System\VtijnAm.exe
  C:\Windows\System\VtijnAm.exe
  2⤵
  PID:5184
- C:\Windows\System\tYxIpTW.exe
  C:\Windows\System\tYxIpTW.exe
  2⤵
  PID:7000
- C:\Windows\System\hnjfOXE.exe
  C:\Windows\System\hnjfOXE.exe
  2⤵
  PID:5280
- C:\Windows\System\NhHwkgs.exe
  C:\Windows\System\NhHwkgs.exe
  2⤵
  PID:7124
- C:\Windows\System\NvItqKQ.exe
  C:\Windows\System\NvItqKQ.exe
  2⤵
  PID:6644
- C:\Windows\System\FxsBqUb.exe
  C:\Windows\System\FxsBqUb.exe
  2⤵
  PID:7028
- C:\Windows\System\MGTQpPm.exe
  C:\Windows\System\MGTQpPm.exe
  2⤵
  PID:6548
- C:\Windows\System\vUHKZlC.exe
  C:\Windows\System\vUHKZlC.exe
  2⤵
  PID:6004
- C:\Windows\System\BGZxhOP.exe
  C:\Windows\System\BGZxhOP.exe
  2⤵
  PID:7180
- C:\Windows\System\QDvafRW.exe
  C:\Windows\System\QDvafRW.exe
  2⤵
  PID:7196
- C:\Windows\System\LaiaDJn.exe
  C:\Windows\System\LaiaDJn.exe
  2⤵
  PID:7212
- C:\Windows\System\DEbVzpQ.exe
  C:\Windows\System\DEbVzpQ.exe
  2⤵
  PID:7228
- C:\Windows\System\mjDQOrQ.exe
  C:\Windows\System\mjDQOrQ.exe
  2⤵
  PID:7244
- C:\Windows\System\yhvQhns.exe
  C:\Windows\System\yhvQhns.exe
  2⤵
  PID:7260
- C:\Windows\System\wzGrxOe.exe
  C:\Windows\System\wzGrxOe.exe
  2⤵
  PID:7276
- C:\Windows\System\MgMUOyF.exe
  C:\Windows\System\MgMUOyF.exe
  2⤵
  PID:7292
- C:\Windows\System\bBoGyiu.exe
  C:\Windows\System\bBoGyiu.exe
  2⤵
  PID:7308
- C:\Windows\System\IhMLWYH.exe
  C:\Windows\System\IhMLWYH.exe
  2⤵
  PID:7324
- C:\Windows\System\FvAioLH.exe
  C:\Windows\System\FvAioLH.exe
  2⤵
  PID:7340
- C:\Windows\System\nwnzDtj.exe
  C:\Windows\System\nwnzDtj.exe
  2⤵
  PID:7356
- C:\Windows\System\AKQwzwO.exe
  C:\Windows\System\AKQwzwO.exe
  2⤵
  PID:7372
- C:\Windows\System\RJBWQzn.exe
  C:\Windows\System\RJBWQzn.exe
  2⤵
  PID:7388
- C:\Windows\System\PExWExX.exe
  C:\Windows\System\PExWExX.exe
  2⤵
  PID:7404
- C:\Windows\System\lfzSgdg.exe
  C:\Windows\System\lfzSgdg.exe
  2⤵
  PID:7420
- C:\Windows\System\dywGFVQ.exe
  C:\Windows\System\dywGFVQ.exe
  2⤵
  PID:7440
- C:\Windows\System\Fbocicg.exe
  C:\Windows\System\Fbocicg.exe
  2⤵
  PID:7456
- C:\Windows\System\VxQIAUi.exe
  C:\Windows\System\VxQIAUi.exe
  2⤵
  PID:7472
- C:\Windows\System\iOcLtte.exe
  C:\Windows\System\iOcLtte.exe
  2⤵
  PID:7488
- C:\Windows\System\vYLHtZf.exe
  C:\Windows\System\vYLHtZf.exe
  2⤵
  PID:7504
- C:\Windows\System\KAoJVda.exe
  C:\Windows\System\KAoJVda.exe
  2⤵
  PID:7520
- C:\Windows\System\YdRoFCD.exe
  C:\Windows\System\YdRoFCD.exe
  2⤵
  PID:7536
- C:\Windows\System\gWdqBMj.exe
  C:\Windows\System\gWdqBMj.exe
  2⤵
  PID:7552
- C:\Windows\System\cXSInFI.exe
  C:\Windows\System\cXSInFI.exe
  2⤵
  PID:7568
- C:\Windows\System\QtQgLcd.exe
  C:\Windows\System\QtQgLcd.exe
  2⤵
  PID:7584
- C:\Windows\System\fJdMdns.exe
  C:\Windows\System\fJdMdns.exe
  2⤵
  PID:7600
- C:\Windows\System\pYJGAHO.exe
  C:\Windows\System\pYJGAHO.exe
  2⤵
  PID:7616
- C:\Windows\System\bmxjQsO.exe
  C:\Windows\System\bmxjQsO.exe
  2⤵
  PID:7632
- C:\Windows\System\ggmpWvj.exe
  C:\Windows\System\ggmpWvj.exe
  2⤵
  PID:7648
- C:\Windows\System\cvSDnoa.exe
  C:\Windows\System\cvSDnoa.exe
  2⤵
  PID:7664
- C:\Windows\System\btaVJZO.exe
  C:\Windows\System\btaVJZO.exe
  2⤵
  PID:7680
- C:\Windows\System\OMKRSLq.exe
  C:\Windows\System\OMKRSLq.exe
  2⤵
  PID:7696
- C:\Windows\System\kXZmmDy.exe
  C:\Windows\System\kXZmmDy.exe
  2⤵
  PID:7712
- C:\Windows\System\UbpROwo.exe
  C:\Windows\System\UbpROwo.exe
  2⤵
  PID:7728
- C:\Windows\System\XlQcvfT.exe
  C:\Windows\System\XlQcvfT.exe
  2⤵
  PID:7744
- C:\Windows\System\rSceSwI.exe
  C:\Windows\System\rSceSwI.exe
  2⤵
  PID:7760
- C:\Windows\System\vBDFGrx.exe
  C:\Windows\System\vBDFGrx.exe
  2⤵
  PID:7776
- C:\Windows\System\OaphBCA.exe
  C:\Windows\System\OaphBCA.exe
  2⤵
  PID:7792
- C:\Windows\System\XZdocRq.exe
  C:\Windows\System\XZdocRq.exe
  2⤵
  PID:7808
- C:\Windows\System\qhVNJqR.exe
  C:\Windows\System\qhVNJqR.exe
  2⤵
  PID:7824
- C:\Windows\System\aBcjwUX.exe
  C:\Windows\System\aBcjwUX.exe
  2⤵
  PID:7840
- C:\Windows\System\OMFizOu.exe
  C:\Windows\System\OMFizOu.exe
  2⤵
  PID:7856
- C:\Windows\System\KwlcliN.exe
  C:\Windows\System\KwlcliN.exe
  2⤵
  PID:7872
- C:\Windows\System\YByQSft.exe
  C:\Windows\System\YByQSft.exe
  2⤵
  PID:7888
- C:\Windows\System\HdsXJUi.exe
  C:\Windows\System\HdsXJUi.exe
  2⤵
  PID:7908
- C:\Windows\System\EHCVLwZ.exe
  C:\Windows\System\EHCVLwZ.exe
  2⤵
  PID:7924
- C:\Windows\System\LycKUTs.exe
  C:\Windows\System\LycKUTs.exe
  2⤵
  PID:7940
- C:\Windows\System\fCmvVYI.exe
  C:\Windows\System\fCmvVYI.exe
  2⤵
  PID:7956
- C:\Windows\System\FMZDzHW.exe
  C:\Windows\System\FMZDzHW.exe
  2⤵
  PID:7972
- C:\Windows\System\RDiwsZS.exe
  C:\Windows\System\RDiwsZS.exe
  2⤵
  PID:7988
- C:\Windows\System\hqanIzV.exe
  C:\Windows\System\hqanIzV.exe
  2⤵
  PID:8004
- C:\Windows\System\fpoYgnH.exe
  C:\Windows\System\fpoYgnH.exe
  2⤵
  PID:8020
- C:\Windows\System\GLnzWkp.exe
  C:\Windows\System\GLnzWkp.exe
  2⤵
  PID:8036
- C:\Windows\System\GKZSehu.exe
  C:\Windows\System\GKZSehu.exe
  2⤵
  PID:8052
- C:\Windows\System\bROpdWM.exe
  C:\Windows\System\bROpdWM.exe
  2⤵
  PID:8068
- C:\Windows\System\spjIWSC.exe
  C:\Windows\System\spjIWSC.exe
  2⤵
  PID:8084
- C:\Windows\System\tWpXJyk.exe
  C:\Windows\System\tWpXJyk.exe
  2⤵
  PID:8100
- C:\Windows\System\VGyTuii.exe
  C:\Windows\System\VGyTuii.exe
  2⤵
  PID:8116
- C:\Windows\System\LKFaHKQ.exe
  C:\Windows\System\LKFaHKQ.exe
  2⤵
  PID:8132
- C:\Windows\System\RoPaeuA.exe
  C:\Windows\System\RoPaeuA.exe
  2⤵
  PID:8148
- C:\Windows\System\sYnzfgo.exe
  C:\Windows\System\sYnzfgo.exe
  2⤵
  PID:8164
- C:\Windows\System\OODapeY.exe
  C:\Windows\System\OODapeY.exe
  2⤵
  PID:8180
- C:\Windows\System\AvCQFux.exe
  C:\Windows\System\AvCQFux.exe
  2⤵
  PID:7176
- C:\Windows\System\ZUlfIzm.exe
  C:\Windows\System\ZUlfIzm.exe
  2⤵
  PID:7236
- C:\Windows\System\UUAnAjQ.exe
  C:\Windows\System\UUAnAjQ.exe
  2⤵
  PID:7300
- C:\Windows\System\EflGkvv.exe
  C:\Windows\System\EflGkvv.exe
  2⤵
  PID:7364
- C:\Windows\System\atcGHmf.exe
  C:\Windows\System\atcGHmf.exe
  2⤵
  PID:6344
- C:\Windows\System\sDFUXCS.exe
  C:\Windows\System\sDFUXCS.exe
  2⤵
  PID:7352
- C:\Windows\System\FupBiMN.exe
  C:\Windows\System\FupBiMN.exe
  2⤵
  PID:6680
- C:\Windows\System\ofzXfNU.exe
  C:\Windows\System\ofzXfNU.exe
  2⤵
  PID:7256
- C:\Windows\System\ErgOnWE.exe
  C:\Windows\System\ErgOnWE.exe
  2⤵
  PID:7396
- C:\Windows\System\cwgiEMw.exe
  C:\Windows\System\cwgiEMw.exe
  2⤵
  PID:7468
- C:\Windows\System\EukwBWQ.exe
  C:\Windows\System\EukwBWQ.exe
  2⤵
  PID:7496
- C:\Windows\System\dqQiCHY.exe
  C:\Windows\System\dqQiCHY.exe
  2⤵
  PID:7596
- C:\Windows\System\cCDxqnV.exe
  C:\Windows\System\cCDxqnV.exe
  2⤵
  PID:7660
- C:\Windows\System\OQXCeac.exe
  C:\Windows\System\OQXCeac.exe
  2⤵
  PID:7640
- C:\Windows\System\hxqwQAj.exe
  C:\Windows\System\hxqwQAj.exe
  2⤵
  PID:7704
- C:\Windows\System\JFlRpqH.exe
  C:\Windows\System\JFlRpqH.exe
  2⤵
  PID:7448
- C:\Windows\System\QEAcdAj.exe
  C:\Windows\System\QEAcdAj.exe
  2⤵
  PID:7576
- C:\Windows\System\nPGxMpc.exe
  C:\Windows\System\nPGxMpc.exe
  2⤵
  PID:7512
- C:\Windows\System\UlINlAU.exe
  C:\Windows\System\UlINlAU.exe
  2⤵
  PID:7720
- C:\Windows\System\LfHgRHi.exe
  C:\Windows\System\LfHgRHi.exe
  2⤵
  PID:7736
- C:\Windows\System\wctNrwb.exe
  C:\Windows\System\wctNrwb.exe
  2⤵
  PID:7788
- C:\Windows\System\IccLzBa.exe
  C:\Windows\System\IccLzBa.exe
  2⤵
  PID:7848
- C:\Windows\System\JdiQlSz.exe
  C:\Windows\System\JdiQlSz.exe
  2⤵
  PID:7800
- C:\Windows\System\QncTqwo.exe
  C:\Windows\System\QncTqwo.exe
  2⤵
  PID:7884
- C:\Windows\System\yMcHTgn.exe
  C:\Windows\System\yMcHTgn.exe
  2⤵
  PID:7904
- C:\Windows\System\PPXscMa.exe
  C:\Windows\System\PPXscMa.exe
  2⤵
  PID:7948
- C:\Windows\System\LnjEnTr.exe
  C:\Windows\System\LnjEnTr.exe
  2⤵
  PID:7964
- C:\Windows\System\VObpYRe.exe
  C:\Windows\System\VObpYRe.exe
  2⤵
  PID:7996
- C:\Windows\System\TPSZeQW.exe
  C:\Windows\System\TPSZeQW.exe
  2⤵
  PID:8048
- C:\Windows\System\Twibbuc.exe
  C:\Windows\System\Twibbuc.exe
  2⤵
  PID:8064
- C:\Windows\System\rzfWILG.exe
  C:\Windows\System\rzfWILG.exe
  2⤵
  PID:8140
- C:\Windows\System\HIfcMOO.exe
  C:\Windows\System\HIfcMOO.exe
  2⤵
  PID:8092
- C:\Windows\System\WKXywQP.exe
  C:\Windows\System\WKXywQP.exe
  2⤵
  PID:8156
- C:\Windows\System\cQUTYLY.exe
  C:\Windows\System\cQUTYLY.exe
  2⤵
  PID:7332
- C:\Windows\System\xYnGtSS.exe
  C:\Windows\System\xYnGtSS.exe
  2⤵
  PID:7320
- C:\Windows\System\ErMPRGR.exe
  C:\Windows\System\ErMPRGR.exe
  2⤵
  PID:7368
- C:\Windows\System\PibkxSR.exe
  C:\Windows\System\PibkxSR.exe
  2⤵
  PID:7464
- C:\Windows\System\lQWrTTS.exe
  C:\Windows\System\lQWrTTS.exe
  2⤵
  PID:7436
- C:\Windows\System\QModXWK.exe
  C:\Windows\System\QModXWK.exe
  2⤵
  PID:7564
- C:\Windows\System\Rcirfyr.exe
  C:\Windows\System\Rcirfyr.exe
  2⤵
  PID:7676
- C:\Windows\System\zXthuye.exe
  C:\Windows\System\zXthuye.exe
  2⤵
  PID:7624
- C:\Windows\System\jodrjlo.exe
  C:\Windows\System\jodrjlo.exe
  2⤵
  PID:7412
- C:\Windows\System\lVUNfOc.exe
  C:\Windows\System\lVUNfOc.exe
  2⤵
  PID:7708
- C:\Windows\System\cVvWZpm.exe
  C:\Windows\System\cVvWZpm.exe
  2⤵
  PID:7936
- C:\Windows\System\SApGZXj.exe
  C:\Windows\System\SApGZXj.exe
  2⤵
  PID:7608
- C:\Windows\System\EXSRzzN.exe
  C:\Windows\System\EXSRzzN.exe
  2⤵
  PID:7784
- C:\Windows\System\XmREGZs.exe
  C:\Windows\System\XmREGZs.exe
  2⤵
  PID:7980
- C:\Windows\System\CuEOnjP.exe
  C:\Windows\System\CuEOnjP.exe
  2⤵
  PID:7900
- C:\Windows\System\MZoAIIL.exe
  C:\Windows\System\MZoAIIL.exe
  2⤵
  PID:7984
- C:\Windows\System\HpLrnLb.exe
  C:\Windows\System\HpLrnLb.exe
  2⤵
  PID:7268
- C:\Windows\System\qrHLAZg.exe
  C:\Windows\System\qrHLAZg.exe
  2⤵
  PID:6244
- C:\Windows\System\TteiugL.exe
  C:\Windows\System\TteiugL.exe
  2⤵
  PID:7384
- C:\Windows\System\MBhUAwh.exe
  C:\Windows\System\MBhUAwh.exe
  2⤵
  PID:7224
- C:\Windows\System\brpJWLC.exe
  C:\Windows\System\brpJWLC.exe
  2⤵
  PID:7932
- C:\Windows\System\fSkARIB.exe
  C:\Windows\System\fSkARIB.exe
  2⤵
  PID:7916
- C:\Windows\System\hLUGDbE.exe
  C:\Windows\System\hLUGDbE.exe
  2⤵
  PID:8012
- C:\Windows\System\izhoUTV.exe
  C:\Windows\System\izhoUTV.exe
  2⤵
  PID:7048
- C:\Windows\System\atUipDx.exe
  C:\Windows\System\atUipDx.exe
  2⤵
  PID:7380
- C:\Windows\System\rjXwolb.exe
  C:\Windows\System\rjXwolb.exe
  2⤵
  PID:8176
- C:\Windows\System\NhTgHLb.exe
  C:\Windows\System\NhTgHLb.exe
  2⤵
  PID:2028
- C:\Windows\System\QEBieeZ.exe
  C:\Windows\System\QEBieeZ.exe
  2⤵
  PID:7804
- C:\Windows\System\OOJuDCU.exe
  C:\Windows\System\OOJuDCU.exe
  2⤵
  PID:7316
- C:\Windows\System\HgMqRxw.exe
  C:\Windows\System\HgMqRxw.exe
  2⤵
  PID:7816
- C:\Windows\System\DDDKVym.exe
  C:\Windows\System\DDDKVym.exe
  2⤵
  PID:7692
- C:\Windows\System\lROlwIi.exe
  C:\Windows\System\lROlwIi.exe
  2⤵
  PID:8044
- C:\Windows\System\ZffNtfk.exe
  C:\Windows\System\ZffNtfk.exe
  2⤵
  PID:8196
- C:\Windows\System\qXfCRNn.exe
  C:\Windows\System\qXfCRNn.exe
  2⤵
  PID:8212
- C:\Windows\System\pYAWsaO.exe
  C:\Windows\System\pYAWsaO.exe
  2⤵
  PID:8228
- C:\Windows\System\LPlqvTU.exe
  C:\Windows\System\LPlqvTU.exe
  2⤵
  PID:8244
- C:\Windows\System\xUzjMad.exe
  C:\Windows\System\xUzjMad.exe
  2⤵
  PID:8260
- C:\Windows\System\segyGmS.exe
  C:\Windows\System\segyGmS.exe
  2⤵
  PID:8276
- C:\Windows\System\RctPWsw.exe
  C:\Windows\System\RctPWsw.exe
  2⤵
  PID:8292
- C:\Windows\System\MtlFZId.exe
  C:\Windows\System\MtlFZId.exe
  2⤵
  PID:8308
- C:\Windows\System\FusmrAx.exe
  C:\Windows\System\FusmrAx.exe
  2⤵
  PID:8324
- C:\Windows\System\GdsLjMz.exe
  C:\Windows\System\GdsLjMz.exe
  2⤵
  PID:8340
- C:\Windows\System\NVAmbBn.exe
  C:\Windows\System\NVAmbBn.exe
  2⤵
  PID:8356
- C:\Windows\System\gUaMylD.exe
  C:\Windows\System\gUaMylD.exe
  2⤵
  PID:8372
- C:\Windows\System\XzRHpML.exe
  C:\Windows\System\XzRHpML.exe
  2⤵
  PID:8388
- C:\Windows\System\pOtPDHX.exe
  C:\Windows\System\pOtPDHX.exe
  2⤵
  PID:8404
- C:\Windows\System\RAYyzwv.exe
  C:\Windows\System\RAYyzwv.exe
  2⤵
  PID:8420
- C:\Windows\System\rNyPIAx.exe
  C:\Windows\System\rNyPIAx.exe
  2⤵
  PID:8436
- C:\Windows\System\Frativz.exe
  C:\Windows\System\Frativz.exe
  2⤵
  PID:8452
- C:\Windows\System\idotwHq.exe
  C:\Windows\System\idotwHq.exe
  2⤵
  PID:8468
- C:\Windows\System\xIUJAgB.exe
  C:\Windows\System\xIUJAgB.exe
  2⤵
  PID:8484
- C:\Windows\System\xgmdxzK.exe
  C:\Windows\System\xgmdxzK.exe
  2⤵
  PID:8504
- C:\Windows\System\nCcFBlz.exe
  C:\Windows\System\nCcFBlz.exe
  2⤵
  PID:8520
- C:\Windows\System\MphlfNG.exe
  C:\Windows\System\MphlfNG.exe
  2⤵
  PID:8540
- C:\Windows\System\HmtAsSz.exe
  C:\Windows\System\HmtAsSz.exe
  2⤵
  PID:8556
- C:\Windows\System\lBwsrua.exe
  C:\Windows\System\lBwsrua.exe
  2⤵
  PID:8572
- C:\Windows\System\lKdAziD.exe
  C:\Windows\System\lKdAziD.exe
  2⤵
  PID:8588
- C:\Windows\System\cmxfOaf.exe
  C:\Windows\System\cmxfOaf.exe
  2⤵
  PID:8604
- C:\Windows\System\Haimhxu.exe
  C:\Windows\System\Haimhxu.exe
  2⤵
  PID:8620
- C:\Windows\System\rFOSZFo.exe
  C:\Windows\System\rFOSZFo.exe
  2⤵
  PID:8636
- C:\Windows\System\aniXesv.exe
  C:\Windows\System\aniXesv.exe
  2⤵
  PID:8652
- C:\Windows\System\aHwnnKH.exe
  C:\Windows\System\aHwnnKH.exe
  2⤵
  PID:8668
- C:\Windows\System\djkgafT.exe
  C:\Windows\System\djkgafT.exe
  2⤵
  PID:8684
- C:\Windows\System\RyCMypo.exe
  C:\Windows\System\RyCMypo.exe
  2⤵
  PID:8700
- C:\Windows\System\CooyYpq.exe
  C:\Windows\System\CooyYpq.exe
  2⤵
  PID:8716
- C:\Windows\System\MwAVZWv.exe
  C:\Windows\System\MwAVZWv.exe
  2⤵
  PID:8732
- C:\Windows\System\tsYBKKy.exe
  C:\Windows\System\tsYBKKy.exe
  2⤵
  PID:8748
- C:\Windows\System\RVFjfFQ.exe
  C:\Windows\System\RVFjfFQ.exe
  2⤵
  PID:8764
- C:\Windows\System\AgTTUKu.exe
  C:\Windows\System\AgTTUKu.exe
  2⤵
  PID:8780
- C:\Windows\System\lyFrJvG.exe
  C:\Windows\System\lyFrJvG.exe
  2⤵
  PID:8796
- C:\Windows\System\iULPSwL.exe
  C:\Windows\System\iULPSwL.exe
  2⤵
  PID:8812
- C:\Windows\System\etzuRJh.exe
  C:\Windows\System\etzuRJh.exe
  2⤵
  PID:8828
- C:\Windows\System\lmeCASP.exe
  C:\Windows\System\lmeCASP.exe
  2⤵
  PID:8844
- C:\Windows\System\DeXtBMH.exe
  C:\Windows\System\DeXtBMH.exe
  2⤵
  PID:8860
- C:\Windows\System\CurGsGN.exe
  C:\Windows\System\CurGsGN.exe
  2⤵
  PID:8876
- C:\Windows\System\diHDhdm.exe
  C:\Windows\System\diHDhdm.exe
  2⤵
  PID:8892
- C:\Windows\System\KAiBYeD.exe
  C:\Windows\System\KAiBYeD.exe
  2⤵
  PID:8908
- C:\Windows\System\wewutVV.exe
  C:\Windows\System\wewutVV.exe
  2⤵
  PID:8924
- C:\Windows\System\zhRueaz.exe
  C:\Windows\System\zhRueaz.exe
  2⤵
  PID:8940
- C:\Windows\System\JvgEGsJ.exe
  C:\Windows\System\JvgEGsJ.exe
  2⤵
  PID:8956
- C:\Windows\System\QnqHkkK.exe
  C:\Windows\System\QnqHkkK.exe
  2⤵
  PID:8972
- C:\Windows\System\xQHneWc.exe
  C:\Windows\System\xQHneWc.exe
  2⤵
  PID:8988
- C:\Windows\System\xGUBfSH.exe
  C:\Windows\System\xGUBfSH.exe
  2⤵
  PID:9004
- C:\Windows\System\ClHkMxv.exe
  C:\Windows\System\ClHkMxv.exe
  2⤵
  PID:9020
- C:\Windows\System\lndItPn.exe
  C:\Windows\System\lndItPn.exe
  2⤵
  PID:9036
- C:\Windows\System\tAdkndt.exe
  C:\Windows\System\tAdkndt.exe
  2⤵
  PID:9052
- C:\Windows\System\SVJYZZb.exe
  C:\Windows\System\SVJYZZb.exe
  2⤵
  PID:9068
- C:\Windows\System\MDiblxu.exe
  C:\Windows\System\MDiblxu.exe
  2⤵
  PID:9084
- C:\Windows\System\AIXBttk.exe
  C:\Windows\System\AIXBttk.exe
  2⤵
  PID:9100
- C:\Windows\System\TopAcLT.exe
  C:\Windows\System\TopAcLT.exe
  2⤵
  PID:9116
- C:\Windows\System\JfhWHSX.exe
  C:\Windows\System\JfhWHSX.exe
  2⤵
  PID:9132
- C:\Windows\System\sElRpPD.exe
  C:\Windows\System\sElRpPD.exe
  2⤵
  PID:9148
- C:\Windows\System\uCPNURC.exe
  C:\Windows\System\uCPNURC.exe
  2⤵
  PID:9164
- C:\Windows\System\ffuSiMj.exe
  C:\Windows\System\ffuSiMj.exe
  2⤵
  PID:9180
- C:\Windows\System\hvRhdxO.exe
  C:\Windows\System\hvRhdxO.exe
  2⤵
  PID:9196
- C:\Windows\System\aPTnwje.exe
  C:\Windows\System\aPTnwje.exe
  2⤵
  PID:9212
- C:\Windows\System\JNJpoom.exe
  C:\Windows\System\JNJpoom.exe
  2⤵
  PID:7516
- C:\Windows\System\XrZxrmj.exe
  C:\Windows\System\XrZxrmj.exe
  2⤵
  PID:8252
- C:\Windows\System\FERLiLo.exe
  C:\Windows\System\FERLiLo.exe
  2⤵
  PID:8316
- C:\Windows\System\eTZscrN.exe
  C:\Windows\System\eTZscrN.exe
  2⤵
  PID:8348
- C:\Windows\System\vmvYFgx.exe
  C:\Windows\System\vmvYFgx.exe
  2⤵
  PID:8268
- C:\Windows\System\LOzcwCe.exe
  C:\Windows\System\LOzcwCe.exe
  2⤵
  PID:8444
- C:\Windows\System\hWtxsLU.exe
  C:\Windows\System\hWtxsLU.exe
  2⤵
  PID:8304
- C:\Windows\System\rfnpCQe.exe
  C:\Windows\System\rfnpCQe.exe
  2⤵
  PID:8368
- C:\Windows\System\LoyLVdl.exe
  C:\Windows\System\LoyLVdl.exe
  2⤵
  PID:8332
- C:\Windows\System\vxLoieG.exe
  C:\Windows\System\vxLoieG.exe
  2⤵
  PID:8428
- C:\Windows\System\lXemhoC.exe
  C:\Windows\System\lXemhoC.exe
  2⤵
  PID:8516
- C:\Windows\System\iFIbCKv.exe
  C:\Windows\System\iFIbCKv.exe
  2⤵
  PID:8584
- C:\Windows\System\jQmeAhr.exe
  C:\Windows\System\jQmeAhr.exe
  2⤵
  PID:8532
- C:\Windows\System\OusTLPC.exe
  C:\Windows\System\OusTLPC.exe
  2⤵
  PID:8600
- C:\Windows\System\PJSBlAB.exe
  C:\Windows\System\PJSBlAB.exe
  2⤵
  PID:8648
- C:\Windows\System\SJOmNue.exe
  C:\Windows\System\SJOmNue.exe
  2⤵
  PID:8708
- C:\Windows\System\bXjBRqp.exe
  C:\Windows\System\bXjBRqp.exe
  2⤵
  PID:8692
- C:\Windows\System\STiEACY.exe
  C:\Windows\System\STiEACY.exe
  2⤵
  PID:8740
- C:\Windows\System\exmmOGX.exe
  C:\Windows\System\exmmOGX.exe
  2⤵
  PID:8760
- C:\Windows\System\optEjZq.exe
  C:\Windows\System\optEjZq.exe
  2⤵
  PID:8804
- C:\Windows\System\IlnGUdc.exe
  C:\Windows\System\IlnGUdc.exe
  2⤵
  PID:8868
- C:\Windows\System\MdBywFh.exe
  C:\Windows\System\MdBywFh.exe
  2⤵
  PID:8888
- C:\Windows\System\nTOPRUz.exe
  C:\Windows\System\nTOPRUz.exe
  2⤵
  PID:8852
- C:\Windows\System\MypiNRR.exe
  C:\Windows\System\MypiNRR.exe
  2⤵
  PID:8936
- C:\Windows\System\zdwBRJv.exe
  C:\Windows\System\zdwBRJv.exe
  2⤵
  PID:9000
- C:\Windows\System\PWfMaAz.exe
  C:\Windows\System\PWfMaAz.exe
  2⤵
  PID:8980
- C:\Windows\System\dOigsjW.exe
  C:\Windows\System\dOigsjW.exe
  2⤵
  PID:9096
- C:\Windows\System\CrpOoNH.exe
  C:\Windows\System\CrpOoNH.exe
  2⤵
  PID:8984
- C:\Windows\System\qTkARak.exe
  C:\Windows\System\qTkARak.exe
  2⤵
  PID:9044
- C:\Windows\System\WyDRFRv.exe
  C:\Windows\System\WyDRFRv.exe
  2⤵
  PID:9012
- C:\Windows\System\AXJSsIp.exe
  C:\Windows\System\AXJSsIp.exe
  2⤵
  PID:9188
- C:\Windows\System\kSxPqTc.exe
  C:\Windows\System\kSxPqTc.exe
  2⤵
  PID:7820
- C:\Windows\System\wcVJuxP.exe
  C:\Windows\System\wcVJuxP.exe
  2⤵
  PID:9172
- C:\Windows\System\CtsGgZa.exe
  C:\Windows\System\CtsGgZa.exe
  2⤵
  PID:9204
- C:\Windows\System\SPRkNQB.exe
  C:\Windows\System\SPRkNQB.exe
  2⤵
  PID:8384
- C:\Windows\System\lajxpDQ.exe
  C:\Windows\System\lajxpDQ.exe
  2⤵
  PID:8364
- C:\Windows\System\ayrNhJX.exe
  C:\Windows\System\ayrNhJX.exe
  2⤵
  PID:8400
- C:\Windows\System\vrPZimW.exe
  C:\Windows\System\vrPZimW.exe
  2⤵
  PID:8612
- C:\Windows\System\pCGnZDg.exe
  C:\Windows\System\pCGnZDg.exe
  2⤵
  PID:8568
- C:\Windows\System\aDVYPRT.exe
  C:\Windows\System\aDVYPRT.exe
  2⤵
  PID:8660
- C:\Windows\System\WsJlzcA.exe
  C:\Windows\System\WsJlzcA.exe
  2⤵
  PID:8836
- C:\Windows\System\aWCgQND.exe
  C:\Windows\System\aWCgQND.exe
  2⤵
  PID:8788
- C:\Windows\System\kSnLmIr.exe
  C:\Windows\System\kSnLmIr.exe
  2⤵
  PID:8884
- C:\Windows\System\StNvZGq.exe
  C:\Windows\System\StNvZGq.exe
  2⤵
  PID:8968
- C:\Windows\System\WeEXJud.exe
  C:\Windows\System\WeEXJud.exe
  2⤵
  PID:8996
- C:\Windows\System\kaQAvep.exe
  C:\Windows\System\kaQAvep.exe
  2⤵
  PID:9032
- C:\Windows\System\mPZpuBz.exe
  C:\Windows\System\mPZpuBz.exe
  2⤵
  PID:8920
- C:\Windows\System\OVKPicZ.exe
  C:\Windows\System\OVKPicZ.exe
  2⤵
  PID:9048
- C:\Windows\System\AJFnfOE.exe
  C:\Windows\System\AJFnfOE.exe
  2⤵
  PID:8236
- C:\Windows\System\ePXpvPt.exe
  C:\Windows\System\ePXpvPt.exe
  2⤵
  PID:8460
- C:\Windows\System\uHWgVtX.exe
  C:\Windows\System\uHWgVtX.exe
  2⤵
  PID:8432
- C:\Windows\System\mLEyRNR.exe
  C:\Windows\System\mLEyRNR.exe
  2⤵
  PID:8500
- C:\Windows\System\BdMKfXh.exe
  C:\Windows\System\BdMKfXh.exe
  2⤵
  PID:8676
- C:\Windows\System\qxYqiUT.exe
  C:\Windows\System\qxYqiUT.exe
  2⤵
  PID:9108
- C:\Windows\System\aZOFODj.exe
  C:\Windows\System\aZOFODj.exe
  2⤵
  PID:8552
- C:\Windows\System\PUAPktm.exe
  C:\Windows\System\PUAPktm.exe
  2⤵
  PID:9144
- C:\Windows\System\DbGZTVt.exe
  C:\Windows\System\DbGZTVt.exe
  2⤵
  PID:8680
- C:\Windows\System\dUmygBs.exe
  C:\Windows\System\dUmygBs.exe
  2⤵
  PID:8284
- C:\Windows\System\BpfwhXG.exe
  C:\Windows\System\BpfwhXG.exe
  2⤵
  PID:9176
- C:\Windows\System\ZObqYLb.exe
  C:\Windows\System\ZObqYLb.exe
  2⤵
  PID:8856
- C:\Windows\System\rbDmxJB.exe
  C:\Windows\System\rbDmxJB.exe
  2⤵
  PID:8728
- C:\Windows\System\WqdaBNZ.exe
  C:\Windows\System\WqdaBNZ.exe
  2⤵
  PID:8220
- C:\Windows\System\ekHuwPG.exe
  C:\Windows\System\ekHuwPG.exe
  2⤵
  PID:9192
- C:\Windows\System\XRJOXlK.exe
  C:\Windows\System\XRJOXlK.exe
  2⤵
  PID:8628
- C:\Windows\System\KqNIqqL.exe
  C:\Windows\System\KqNIqqL.exe
  2⤵
  PID:8300
- C:\Windows\System\tFPNoTU.exe
  C:\Windows\System\tFPNoTU.exe
  2⤵
  PID:9236
- C:\Windows\System\CrmRWVW.exe
  C:\Windows\System\CrmRWVW.exe
  2⤵
  PID:9252
- C:\Windows\System\DpgxQIo.exe
  C:\Windows\System\DpgxQIo.exe
  2⤵
  PID:9268
- C:\Windows\System\UvPYnLa.exe
  C:\Windows\System\UvPYnLa.exe
  2⤵
  PID:9284
- C:\Windows\System\TGgPEnZ.exe
  C:\Windows\System\TGgPEnZ.exe
  2⤵
  PID:9304
- C:\Windows\System\PPgRPRW.exe
  C:\Windows\System\PPgRPRW.exe
  2⤵
  PID:9320
- C:\Windows\System\LQKNFpi.exe
  C:\Windows\System\LQKNFpi.exe
  2⤵
  PID:9336
- C:\Windows\System\gCFVpJM.exe
  C:\Windows\System\gCFVpJM.exe
  2⤵
  PID:9352
- C:\Windows\System\xXshhve.exe
  C:\Windows\System\xXshhve.exe
  2⤵
  PID:9368
- C:\Windows\System\pVdEuJM.exe
  C:\Windows\System\pVdEuJM.exe
  2⤵
  PID:9384
- C:\Windows\System\dvWobDw.exe
  C:\Windows\System\dvWobDw.exe
  2⤵
  PID:9400
- C:\Windows\System\wLmkXHw.exe
  C:\Windows\System\wLmkXHw.exe
  2⤵
  PID:9424
- C:\Windows\System\SuszJJz.exe
  C:\Windows\System\SuszJJz.exe
  2⤵
  PID:9476
- C:\Windows\System\TTEbrNk.exe
  C:\Windows\System\TTEbrNk.exe
  2⤵
  PID:9492
- C:\Windows\System\NcaWIWr.exe
  C:\Windows\System\NcaWIWr.exe
  2⤵
  PID:9508
- C:\Windows\System\FXxyvbP.exe
  C:\Windows\System\FXxyvbP.exe
  2⤵
  PID:9524
- C:\Windows\System\kzDpLRr.exe
  C:\Windows\System\kzDpLRr.exe
  2⤵
  PID:9540
- C:\Windows\System\AOFXRyk.exe
  C:\Windows\System\AOFXRyk.exe
  2⤵
  PID:9556
- C:\Windows\System\AUkGKog.exe
  C:\Windows\System\AUkGKog.exe
  2⤵
  PID:9572
- C:\Windows\System\wRWRqAn.exe
  C:\Windows\System\wRWRqAn.exe
  2⤵
  PID:9588
- C:\Windows\System\zQKMajz.exe
  C:\Windows\System\zQKMajz.exe
  2⤵
  PID:9604
- C:\Windows\System\WmmKjpM.exe
  C:\Windows\System\WmmKjpM.exe
  2⤵
  PID:9620
- C:\Windows\System\DOHgFBi.exe
  C:\Windows\System\DOHgFBi.exe
  2⤵
  PID:9636
- C:\Windows\System\ushfkFS.exe
  C:\Windows\System\ushfkFS.exe
  2⤵
  PID:9652
- C:\Windows\System\otDwuSh.exe
  C:\Windows\System\otDwuSh.exe
  2⤵
  PID:9668
- C:\Windows\System\POkiBKM.exe
  C:\Windows\System\POkiBKM.exe
  2⤵
  PID:9684
- C:\Windows\System\aUbloNz.exe
  C:\Windows\System\aUbloNz.exe
  2⤵
  PID:9700
- C:\Windows\System\pVWxsHh.exe
  C:\Windows\System\pVWxsHh.exe
  2⤵
  PID:9716
- C:\Windows\System\ZYCEVLT.exe
  C:\Windows\System\ZYCEVLT.exe
  2⤵
  PID:9732
- C:\Windows\System\aBUfKMB.exe
  C:\Windows\System\aBUfKMB.exe
  2⤵
  PID:9748
- C:\Windows\System\gxWucDs.exe
  C:\Windows\System\gxWucDs.exe
  2⤵
  PID:9764
- C:\Windows\System\qgoxPPY.exe
  C:\Windows\System\qgoxPPY.exe
  2⤵
  PID:9780
- C:\Windows\System\NgDOAXK.exe
  C:\Windows\System\NgDOAXK.exe
  2⤵
  PID:9796
- C:\Windows\System\jPgsenI.exe
  C:\Windows\System\jPgsenI.exe
  2⤵
  PID:9812
- C:\Windows\System\swrlARy.exe
  C:\Windows\System\swrlARy.exe
  2⤵
  PID:9828
- C:\Windows\System\aZWKmnY.exe
  C:\Windows\System\aZWKmnY.exe
  2⤵
  PID:9844
- C:\Windows\System\EVTMRWt.exe
  C:\Windows\System\EVTMRWt.exe
  2⤵
  PID:9860
- C:\Windows\System\mRZBjhO.exe
  C:\Windows\System\mRZBjhO.exe
  2⤵
  PID:9876
- C:\Windows\System\XwNznnB.exe
  C:\Windows\System\XwNznnB.exe
  2⤵
  PID:9892
- C:\Windows\System\UCgtMwx.exe
  C:\Windows\System\UCgtMwx.exe
  2⤵
  PID:9908
- C:\Windows\System\AqXefmI.exe
  C:\Windows\System\AqXefmI.exe
  2⤵
  PID:9924
- C:\Windows\System\HZldNzx.exe
  C:\Windows\System\HZldNzx.exe
  2⤵
  PID:9940
- C:\Windows\System\JSWqyHv.exe
  C:\Windows\System\JSWqyHv.exe
  2⤵
  PID:9956
- C:\Windows\System\cFCYWIl.exe
  C:\Windows\System\cFCYWIl.exe
  2⤵
  PID:9972
- C:\Windows\System\VNZarZs.exe
  C:\Windows\System\VNZarZs.exe
  2⤵
  PID:9988
- C:\Windows\System\TKcPSMY.exe
  C:\Windows\System\TKcPSMY.exe
  2⤵
  PID:10004
- C:\Windows\System\LbpoAbJ.exe
  C:\Windows\System\LbpoAbJ.exe
  2⤵
  PID:10020
- C:\Windows\System\gCZRHmx.exe
  C:\Windows\System\gCZRHmx.exe
  2⤵
  PID:10036
- C:\Windows\System\lLWFlkj.exe
  C:\Windows\System\lLWFlkj.exe
  2⤵
  PID:10052
- C:\Windows\System\wjWIKtK.exe
  C:\Windows\System\wjWIKtK.exe
  2⤵
  PID:10068
- C:\Windows\System\kjAfhFl.exe
  C:\Windows\System\kjAfhFl.exe
  2⤵
  PID:10084
- C:\Windows\System\AxlrRSt.exe
  C:\Windows\System\AxlrRSt.exe
  2⤵
  PID:10100
- C:\Windows\System\TmEwgFc.exe
  C:\Windows\System\TmEwgFc.exe
  2⤵
  PID:10116
- C:\Windows\System\jLBRQoc.exe
  C:\Windows\System\jLBRQoc.exe
  2⤵
  PID:10132
- C:\Windows\System\DgfYhed.exe
  C:\Windows\System\DgfYhed.exe
  2⤵
  PID:10148
- C:\Windows\System\JtzVHyq.exe
  C:\Windows\System\JtzVHyq.exe
  2⤵
  PID:10164
- C:\Windows\System\dlqIorq.exe
  C:\Windows\System\dlqIorq.exe
  2⤵
  PID:10180
- C:\Windows\System\JGDPWJQ.exe
  C:\Windows\System\JGDPWJQ.exe
  2⤵
  PID:10196
- C:\Windows\System\IdJCbiH.exe
  C:\Windows\System\IdJCbiH.exe
  2⤵
  PID:10212
- C:\Windows\System\LCnWyvZ.exe
  C:\Windows\System\LCnWyvZ.exe
  2⤵
  PID:10228
- C:\Windows\System\GweLmnm.exe
  C:\Windows\System\GweLmnm.exe
  2⤵
  PID:9244
- C:\Windows\System\geAGJac.exe
  C:\Windows\System\geAGJac.exe
  2⤵
  PID:9264
- C:\Windows\System\ZvAqEEZ.exe
  C:\Windows\System\ZvAqEEZ.exe
  2⤵
  PID:9232
- C:\Windows\System\OkqFVrO.exe
  C:\Windows\System\OkqFVrO.exe
  2⤵
  PID:9300
- C:\Windows\System\yZgIWnK.exe
  C:\Windows\System\yZgIWnK.exe
  2⤵
  PID:9380
- C:\Windows\System\MidHIhy.exe
  C:\Windows\System\MidHIhy.exe
  2⤵
  PID:9392
- C:\Windows\System\zMJddnY.exe
  C:\Windows\System\zMJddnY.exe
  2⤵
  PID:8492
- C:\Windows\System\vpFqUlB.exe
  C:\Windows\System\vpFqUlB.exe
  2⤵
  PID:9444
- C:\Windows\System\ydziuPo.exe
  C:\Windows\System\ydziuPo.exe
  2⤵
  PID:9484
- C:\Windows\System\zBGdKHw.exe
  C:\Windows\System\zBGdKHw.exe
  2⤵
  PID:9520
- C:\Windows\System\YdeqqQV.exe
  C:\Windows\System\YdeqqQV.exe
  2⤵
  PID:9500
- C:\Windows\System\qUprfxv.exe
  C:\Windows\System\qUprfxv.exe
  2⤵
  PID:9552
- C:\Windows\System\mPRTwTw.exe
  C:\Windows\System\mPRTwTw.exe
  2⤵
  PID:9536
- C:\Windows\System\RidKcfR.exe
  C:\Windows\System\RidKcfR.exe
  2⤵
  PID:9644
- C:\Windows\System\rmyYbYG.exe
  C:\Windows\System\rmyYbYG.exe
  2⤵
  PID:9628
- C:\Windows\System\HXJAyDL.exe
  C:\Windows\System\HXJAyDL.exe
  2⤵
  PID:9664
- C:\Windows\System\ThWoShI.exe
  C:\Windows\System\ThWoShI.exe
  2⤵
  PID:9712
- C:\Windows\System\FXgwNRA.exe
  C:\Windows\System\FXgwNRA.exe
  2⤵
  PID:9776
- C:\Windows\System\NAkLyPe.exe
  C:\Windows\System\NAkLyPe.exe
  2⤵
  PID:9696
- C:\Windows\System\UicbnOL.exe
  C:\Windows\System\UicbnOL.exe
  2⤵
  PID:9760
- C:\Windows\System\YAEpHrU.exe
  C:\Windows\System\YAEpHrU.exe
  2⤵
  PID:9788
- C:\Windows\System\nCVCHvI.exe
  C:\Windows\System\nCVCHvI.exe
  2⤵
  PID:9900
- C:\Windows\System\bUtOchW.exe
  C:\Windows\System\bUtOchW.exe
  2⤵
  PID:9852
- C:\Windows\System\VkrfJnm.exe
  C:\Windows\System\VkrfJnm.exe
  2⤵
  PID:9952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ASBMBLC.exe

Filesize
1.3MB

MD5
e55306686b7fc82ba92c8ee7bec9c690

SHA1
bf2a7c5edb812a1fd78cc9b33070f8ea960d6c87

SHA256
7bf569f379dbe56a00f365519ab591ed58e3625e5e8766f9849a9b5555ca8dc0

SHA512
bb479507c4a5c10575cfe8c733297fcbd87a24a1250b40ef4925662aa926e6a8b1989f874e086a06802a00b00e198acb4fe69c7c71798e2303ac75f46dac146c

Download Submit
C:\Windows\system\AucAGpx.exe

Filesize
1.3MB

MD5
0adc9e7d239a91ebf1ae6c69e9e198b7

SHA1
46290e9aa55219c6d529b156122eeacae3b3aca1

SHA256
ba62f9b3c85e1b136e8ed6d804ebb26dc6924917f427bb6c54bf40ce330e34a3

SHA512
2c4f25cc7c44dbc72fd910c2b32a75fd87f03ee613e29f41d71ccc123d4a5aa2ae857664dcc172bac5271caadc5468dc7d9c6460b707ace241a11b8301f301a2

Download Submit
C:\Windows\system\DDNQwrG.exe

Filesize
1.3MB

MD5
ccfc11eefaa2d6d54ebc7e9b6b86903f

SHA1
49691f89f483c985e5bd328d90815d50c31dfa8a

SHA256
2c1ae0088270f73acb2cdb4e4a73999f2296e6e26dce25e50e59da9e18bf1436

SHA512
ecde9103769b92301e6e54334f8933a7d76d268c1c0f5da9eac69d63877bcc5457d2e7522cf0a40093d960ba0a368cc75d4255ca6b619ae2fcb2ce12ffaa1220

Download Submit
C:\Windows\system\DdYwDZT.exe

Filesize
1.3MB

MD5
69fdc9e1ec3757947ada38fa129ce014

SHA1
5e346c09d6bc6f7a54ea06fcb0be8401f7269c1a

SHA256
8fbd879a76085e6919ef25039774076bb52d1e0441584108421ae6bd19f13bb1

SHA512
762aece068688026e49d5a03f4ea8fdd3428407f2c0d6929a086a59d8fad82a3c7ee3a6151f36858a7164052acb9bfaa522b8338470ae8c6133c3aab888a15b5

Download Submit
C:\Windows\system\DhbFNOB.exe

Filesize
1.3MB

MD5
222127c7a2119d27eef527b251baed6d

SHA1
fb4a898aa923ed24d352bd6f7d5e2c04fe920b2c

SHA256
99d49a2693a8c8776e8935c55bd7a8a6c9e6665a20190964fe3f79fa6be88c2e

SHA512
73ee3b16e1067e88924c456ad621e68f09377a86dfda7e20c8b2889e3dda3d0a59ac019e32e2662965160905c5a7693e8fe6bedc654203a9544e0c767cfda940

Download Submit
C:\Windows\system\DkpXYUg.exe

Filesize
1.3MB

MD5
23a4d1acbb74bbec734f59c2d818c4b8

SHA1
6df29acfc4d597dc609948b94a942dbbd1deab6d

SHA256
6f035c47e72e9381ae92abd335614b69c86614312921b7223bd6a9889ee258c0

SHA512
47c93087ffce0880a230e7f2be19e80148560d242aaaea69ab7d7d97979e2bc55256957dddb27af975c58a7fb5934a8d9d5003b5dcb43b6419eb975e9c5d6de7

Download Submit
C:\Windows\system\EgpiQYg.exe

Filesize
1.3MB

MD5
fca7721c702ffc2e437bd1e0a7c83ff7

SHA1
7b311a3a1a9b54a1fdbb08b7fb2e0cbf75c91885

SHA256
f3bbb391ae6752a183413d5c6a9d676202dd6dcf1bdaceb1be8787489b1aa4e9

SHA512
0cadf88d4468247e860f9c81ff76a766a1447bf14586bc344619bac486edafad44fca839782df2fa01bedc2662c0ab77571b4b68f727af1e2e85cac859c67287

Download Submit
C:\Windows\system\NHeYJJw.exe

Filesize
1.3MB

MD5
98d7ba2a8e61c4b47e84c164ea7b9b1a

SHA1
1b14342cf44c662c034013131b49eb1535f9592c

SHA256
0953896b14c5e6b6f4b3af855edec2bdea6ce9d67d8233a35a27f709e6ee4121

SHA512
99ef1c348e7235c60cf2bef147cf74fe1c0131a88d4ecb0e3aaf43d80ddfb2d879c83cbc4823b4a3067907bd092c6aa667acfc31142fbe9034c143ccc68ea761

Download Submit
C:\Windows\system\PDTiYXe.exe

Filesize
1.3MB

MD5
192d512265f511669230718602a401bd

SHA1
acaed30d4a1dfa74390d771215f5939be989d471

SHA256
b5082bbe9119ec7ee9071411a798f2b64700ab9be6c9dd6fcf85d99a283e37a4

SHA512
b17051b415bb2f77be49f024a5e83dd33c9112aa922e76d8b72b595d94f3195d632278f8f54493b8add7170d990044c1da9bdf549670022127131583ac7f51fa

Download Submit
C:\Windows\system\PbiDMEc.exe

Filesize
1.3MB

MD5
f54ec38db0b84a532349dd89dcb60b6c

SHA1
bfedb4bf22292e74708a6707e69ae4d7ead63d46

SHA256
93a76040d8241b84297bdc23ef029f1ba943a4bd980c4b4bf4f0a0b6c8198240

SHA512
14195d38b8a156761218543b2d4a602f6678e5dff41856c70809e3e110dba9cb75076a1b0c8465bc758a7fd11a9987c4a0d77f44873fbb0af674f614ac7f149c

Download Submit
C:\Windows\system\PqnyBGa.exe

Filesize
1.3MB

MD5
8e76f7cf36cb950e186bd32ed1da12d9

SHA1
700d9b4f78b062c3ff86c20ae47fcd68c47fe9f9

SHA256
7b48bef0c9e7707453148de9d59a29a02f006a3e8f37d8fe48cce14fb22aa8ac

SHA512
994f715d2a79a708e4a7daf17560bba46ab15722d72478f4a636254b092b196721c2224b7b3931e997ace9db1c4dbcf9016c5603104511e2951b5a81b0038ca6

Download Submit
C:\Windows\system\TxTqiVp.exe

Filesize
1.3MB

MD5
4b8c134fabe38a4edc19bc3be3324698

SHA1
f72d98ce7455a7402c72e60ded24b12a804c0076

SHA256
08b66ec8bd383f03820038bf6d5c3c6d717aa63b53c71e7299e4a8c1d9dde022

SHA512
4677bcade09caaf53300ab96eeb1eb55d6649925733002ed5dd9609f298996a8b8334c762f5c7716268b18bb5675b2f31fd3497590998738369b8c4f94620d20

Download Submit
C:\Windows\system\UQevUUs.exe

Filesize
1.3MB

MD5
1ee3787bdb042dbb7fa18c91b2f69837

SHA1
2b11f9a84f73f5aed0c3f1e157d1ad01bbad92ce

SHA256
815845773f0146fbe28bee4fe054010755b91287df1e8b4c7aa9ea5602e88679

SHA512
7e264fd1e5b993d16f3414cd8606fa0d2d8d40915b1337423e3440c713c65c28a1290fdede821a849ac6f331bd06eaa3607bfe1b9b51afb06e398ea00896b345

Download Submit
C:\Windows\system\UXkwGsU.exe

Filesize
1.3MB

MD5
72103fcc23cdd5491a7bbd37fd664ef3

SHA1
d8004d287344442e4bb236ab10fdbc73bf5d5378

SHA256
cc2a01caa0028b041acbc8b56009a1bfe0d8e20bb644d8c78cce8a3027f7dbd6

SHA512
71f4e9b5dee606606cc879358155902a47aa9318baed8d8b8e340e765b57df2d99504fc9a1418d10d66c308d212d4ca99e25daf8150ff25c95409d9911557011

Download Submit
C:\Windows\system\UcasfGM.exe

Filesize
1.3MB

MD5
94361d6f3dd5f6b9b82ab4464f4ed3d5

SHA1
fd4dd1f402aed6918f8c6b514e59aca2b861f593

SHA256
3a02ec1e71a3c1db1533b5d9d27d6bfed1f3fe99f62035b075d5122fe779896c

SHA512
3960d0b7a2bbe5437704723f8b4a90943bd0ca169b6f3a541ae5aa34fcbd9dd7bf82bc1b055a69a23a6a0e907b2d6a3f7dbbd2dd90d3c0380de552df6270bf29

Download Submit
C:\Windows\system\YKFMAVC.exe

Filesize
1.3MB

MD5
697905f89a51c247f05deee490a37348

SHA1
1518b60ffb9bbacc407a0ee5e328c0a2cc0e7a12

SHA256
035b3677e934c2ba53ea9506ca0a858c01edbd7defd86f60ce3f8f7632ff9c35

SHA512
b97a8ca0e0642f2515c1ab32f68fd13b431f0b2a9a1c410f534e4dfbc3308fc4ae9b4b2ada15d61e1a7f3ca0feb62aa78236611bbdbf31a95830ffeb9ad59e6d

Download Submit
C:\Windows\system\YdacVIK.exe

Filesize
1.3MB

MD5
617d168768592732f2cb8bbb5df42f7e

SHA1
2481e6a304769ddc7f7bf27daee765bf8f2ff8de

SHA256
9958b3abca52415849c6356f7071f560d7eb10491bf742e1a06b5bfe096f1abe

SHA512
6da7267540fb1deb0dd283be2faa28c2e641afbb6b9c9143fbc4f0ecf9542418b53d11bbecc7eac1447ffdc9e4aa49f052e681b49663ee5e3678656d6202d45f

Download Submit
C:\Windows\system\YhRQEej.exe

Filesize
1.3MB

MD5
10a5af80fc8b829b2fbc56c430ffabbd

SHA1
c615a6bb9d5562141366d1736a7d21740ce30c8e

SHA256
586cde246cbbb9b7114fe0b1152ddc16c56939988fec5b95a2aaec11bcf44a72

SHA512
b0be13ae9ee99d5b4a4ea7a1f4f13531c957d3fa20c73199874a97209e42d594ed784112266ed5c285962e945607e058b5bae2c757f9fb5af0f4af9ffc09c948

Download Submit
C:\Windows\system\cNHbySz.exe

Filesize
1.3MB

MD5
7a76a3f2313091f91e2fd90718a0aa18

SHA1
fbd3179b5c225cda2fea4b44aa5318cbcae4f2ab

SHA256
2182b6bf8d2de2dd8818e95bc4d366b5c3ae456ca94ae2897dd30473408f6a6f

SHA512
84f9db31b82cc74f54de778a695a0f99dba48aff23d528c83ec2846aa1ff40adffb86b2f414261a6c0efa200db07a88e13debf0cadee5c7447325aa3db1f078d

Download Submit
C:\Windows\system\ckrNHYG.exe

Filesize
1.3MB

MD5
f7ee593236a7f1b549e41d3df8100053

SHA1
362c47069515708c73c6679dde69bce68ee83438

SHA256
95f1934c874bff86341cbe22b711a2d7d0db1a8e1cdbdb20acae7a93b6f2e7f3

SHA512
f38dc883350d63f606d609f05774b86c1c07678f95e1ecaf106c8e9600a11837f009aeaf7b5e0d20c02eede31a10b59ddce37f33c082627d73c8cbdf2843d64e

Download Submit
C:\Windows\system\duBlyss.exe

Filesize
1.3MB

MD5
ed427af2dc9da1b95e1a4a831474b115

SHA1
90996d0876a8f43960df7961d92e2d7d10b11b53

SHA256
cd40d726eef3b4a83faab0be2b9cfe94c4f982e381d3c92ba3b024d9448b072f

SHA512
c0e669198a61af3271c8bfdd4afa426f0dc6c032ebabcc0d4e19394fed38eae596959058e0e7674ebff364d1059f84f8b1510cb6d4d6424dea77741f03eb7fde

Download Submit
C:\Windows\system\eoYKmAF.exe

Filesize
1.3MB

MD5
e9967356d99c6c868e9690e00e27afd1

SHA1
1214083b6f8a0687c809ab066b21d27acea04835

SHA256
edb2e0276047ec327a508a172369981eb8c00efe972a7768051a0aa1c72d4acc

SHA512
5ead1d23be9db1c50b0faafd91002f24e209c0622cacdc9c4987089b030b3abd74888c37098670607aab437fed8a5d111745cfaf3600a785797da5da3d0c95ef

Download Submit
C:\Windows\system\hGffxJD.exe

Filesize
1.3MB

MD5
20c148e4d19f03fa06de80e26b91fdbf

SHA1
c797aa8ff4b4232636b514de93fb3706638109c6

SHA256
c3429a5c09967839586c05fb70fa00668ddc0c5bd770ce6892a407ef367263fe

SHA512
f04b22651d599444590ee9747ca5e7af62e406a08060e1e7f8415425aa7d67ae84a1a5c6ef6bd868ac9bf59aaaa3b5ab272af5027f380f0354725ecd749f5750

Download Submit
C:\Windows\system\krzPRhU.exe

Filesize
1.3MB

MD5
42d112163fe05469fe422ee8ea6e8f98

SHA1
4cbb66708475d082ad4d096f11cad1618f0a0299

SHA256
4953272d0986cce11a838d0c757d00a69808c3bbe18d8ff65f568e4bed20f6fa

SHA512
f6dd22e90772a216bad1818d8bdcdc53a7e4cebb0d1667743adf959c76830785582fcc20aafba32f84c50ca29b366e5c033a89c27e00d7e82b09e80d480469ef

Download Submit
C:\Windows\system\mxfUjFg.exe

Filesize
1.3MB

MD5
f704be1ee90d2b5bfe9f38eda82d105b

SHA1
972a3ada629d5fb6a66c8d6932362a182ebc9b54

SHA256
ce762e7565a07a4022aa78ba03c3af1eb73fd620875add999d5ae44b6510ded5

SHA512
c7e25c5ce5452d27f69236eeb8acd9930ade227ef15f420bd70928af2de900984335161213b8a78e7ed087c4ab1f091b1f408a20c9ad44401a2078376540a326

Download Submit
C:\Windows\system\phcStmu.exe

Filesize
1.3MB

MD5
a1a0c4c6ae2e5413e6fd8b8172aeb704

SHA1
4a5587451cb715f5fba019adb7c4282f43816fb8

SHA256
948fbb9da3d20aaac3631f48353fb62360204d563aa79e63862adb7bd8335a15

SHA512
dddb1c5976d247eddfb3e8f3611577dff134607f662577b3bcee5cd76d7dc55a87fdf4397bf99a47267d87bdbe1a3c5b15ffa3bb355fdafe38aeed5aa99ecd32

Download Submit
C:\Windows\system\tLXCWrC.exe

Filesize
1.3MB

MD5
94fcadb56ce6598d4f9ec81c89e11f5e

SHA1
4e91b297844cadd42c33894a4d1cbd0fb21a554c

SHA256
0679d33862b1c50f26ebbb07d674e13a417b04fd591fea003ff89694f892a428

SHA512
228a7028c296f73ff52ac32afb8be186b0de38ff394b1bb0f1ac6c9fd2908c9d737cb3aeb6620d534aecd439f82f48a38892965ce223e6420573cb0bc81c9996

Download Submit
C:\Windows\system\xYQxomN.exe

Filesize
1.3MB

MD5
8566b62f080ff0e0fc67306e5f5841e7

SHA1
d6c8610313e181e84fc506a7055b4c14c0fa2e76

SHA256
db8a5a4b95ebc5a093befa6a85c1cfb65d075abce73bcf6d7a815cfab620a90e

SHA512
ee68a381074ac3c6987e3b4a27985458deb8460bfed93e761102fbef9b2800a804fc5fda722fc89e5c19c031e6946bbf6dcc4394b39c2b525e271dac79e7c8df

Download Submit
C:\Windows\system\yZqcbXb.exe

Filesize
1.3MB

MD5
6600178365acb9eb7e90325ac9e32305

SHA1
b27022d6359c5ce4b12f063013e2317d3fe8b660

SHA256
36e959d74453e405406c493bb89e90791cccde7a6bc527cc90ba4144522e4b78

SHA512
996b63290f4f3c0edb854051d6f900a6240bf4d37e16015d40474d35835afe11ab94f34f4287c9c45709af455594991e43fe3260bd6fdebe1e01b468af190e75

Download Submit
\Windows\system\LxYmtTJ.exe

Filesize
1.3MB

MD5
c0c40a8656fb2cc25b4ba3262a7c0e65

SHA1
1b51460dd2995870eb5853a31ffa22843c27a663

SHA256
88873c48d66bb3a8e1e49d0df340ff27fc4665a1f7851202ae42ff7d675a1448

SHA512
016d441952e91c3363b8188cb300167c6c408fb83038ef6aade12326d6982f249fc393741b72d77028d92c0d8c39d3c288048e70a1a8025dd7249853fcc5aedf

Download Submit
\Windows\system\SXVsKXN.exe

Filesize
1.3MB

MD5
324b3b2f43588ab744d600a19d74529a

SHA1
14e1447320645e5e3720a96ea978ebb08863e2a8

SHA256
e9139e3c568a2da28215f944cea4c8f0ce99c3bc993bfe4d9e960be5a3ca791a

SHA512
cc414cc2eeb25e203c4757110b85edfd3c923313bd641bdeff31839edb503af2198d0640231fca28d1480dd09ca9acb99cc858d14832f1b24fe8afe4f0c4a5b1

Download Submit
\Windows\system\nZSioeP.exe

Filesize
1.3MB

MD5
32e2c98ab63d18cb7aea9af69853773b

SHA1
205ef57815f4b17659ebfbfb7f046d291a710d5a

SHA256
750e2575b3fabbc8f1cda3cca3097ae59cb83683314eeaadacd9652983cd92af

SHA512
ec185407004b6e131611306ee041fd751bebc22272dc36daea397895e4e90590c7b0b347a9b15466f0f04707137c348d59bfdb2807a81b7f2b6af094272dc2b8

Download Submit
memory/2664-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download