xmrig | 0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
Size

1.2MB
MD5

227ce6f7e8196f7996eb5516fbc9ffb8
SHA1

4b4ee189a781126a522ea2c85f2263ce4c33581a
SHA256

0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c
SHA512

22ec598fedfc46919b101ea77cae81b308b59a36ffbeb4a1ab84cece3626afcc14cf1b93950d84082256e85993521d073b83d97db8a147fdbb79e3f5d2eb4118
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPOpoQ34g52Oi5:GezaTF8FcNkNdfE0pZ9ozttwIRR+Qog4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001225b-2.dat	xmrig
behavioral1/files/0x0008000000016d9f-9.dat	xmrig
behavioral1/files/0x0007000000016f9c-14.dat	xmrig
behavioral1/files/0x0007000000016e74-13.dat	xmrig
behavioral1/files/0x000700000001739a-21.dat	xmrig
behavioral1/files/0x000700000001739c-24.dat	xmrig
behavioral1/files/0x00080000000173e4-28.dat	xmrig
behavioral1/files/0x000500000001926b-56.dat	xmrig
behavioral1/files/0x0005000000019271-61.dat	xmrig
behavioral1/files/0x00050000000195e4-128.dat	xmrig
behavioral1/files/0x0005000000019539-124.dat	xmrig
behavioral1/files/0x00050000000194d8-120.dat	xmrig
behavioral1/files/0x000500000001947e-116.dat	xmrig
behavioral1/files/0x0005000000019441-112.dat	xmrig
behavioral1/files/0x000500000001942f-108.dat	xmrig
behavioral1/files/0x0005000000019403-104.dat	xmrig
behavioral1/files/0x0005000000019401-101.dat	xmrig
behavioral1/files/0x00050000000193df-96.dat	xmrig
behavioral1/files/0x00050000000193d9-92.dat	xmrig
behavioral1/files/0x00050000000193cc-88.dat	xmrig
behavioral1/files/0x00050000000193c4-84.dat	xmrig
behavioral1/files/0x00050000000193be-80.dat	xmrig
behavioral1/files/0x0005000000019389-76.dat	xmrig
behavioral1/files/0x0005000000019382-72.dat	xmrig
behavioral1/files/0x0005000000019277-68.dat	xmrig
behavioral1/files/0x0005000000019273-64.dat	xmrig
behavioral1/files/0x000500000001924c-52.dat	xmrig
behavioral1/files/0x0005000000019234-48.dat	xmrig
behavioral1/files/0x0005000000019229-44.dat	xmrig
behavioral1/files/0x0005000000019218-40.dat	xmrig
behavioral1/files/0x00050000000191f7-36.dat	xmrig
behavioral1/files/0x00050000000191f3-32.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2544	cFlelgh.exe
768	PwBPADu.exe
2504	oJXqrfG.exe
1932	DkUdYZr.exe
2320	ohjDiiP.exe
2720	qksRXFu.exe
2804	JFLUDNK.exe
2988	Ouaqdmd.exe
2700	zrjxxcp.exe
2692	MWKyWPe.exe
2792	Qpcyopm.exe
2604	EFjxZBJ.exe
2712	FjtLYmz.exe
2632	wdTadMt.exe
2588	LvxAKTg.exe
2652	dWQGRcE.exe
3052	kMONSik.exe
3068	uXCzrda.exe
1916	vlVlKqf.exe
2036	ZloqKfs.exe
2564	qFPWgpp.exe
1668	OUcVqul.exe
1440	lEacJWb.exe
1632	YtCCSSl.exe
1968	tmLHSkT.exe
1152	srjdFie.exe
2940	AZnfOdD.exe
2664	raCqEXL.exe
2928	idDeJJV.exe
2672	QvInayy.exe
2260	uyawdYH.exe
2960	QkJkbao.exe
1588	GCDMTOx.exe
1608	qNKIPiJ.exe
284	iiNBIHW.exe
660	VZHagyH.exe
2820	OFdWrVw.exe
1040	IJSogHt.exe
1272	DeWMvao.exe
1276	QUFHNlW.exe
1804	OBMSssA.exe
1716	wErBTve.exe
1096	IWRWJrr.exe
2016	IowJbdk.exe
1592	QLgLIoP.exe
2176	fzLaHBr.exe
624	nahjZMf.exe
1524	CInmATP.exe
1868	YZkstTh.exe
1796	zaZRzhz.exe
2460	MmSeqou.exe
352	eXsZlfD.exe
2432	yZOveyE.exe
3024	fwNEdCs.exe
1468	anxkLET.exe
1748	gdKcDpR.exe
2160	tEiSJzh.exe
1948	coTJBPf.exe
3044	plUpqVt.exe
940	oZJMnNB.exe
3048	aoHrWoA.exe
884	OEVyfcN.exe
1728	dhOHmOz.exe
1740	XqkfYix.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nKRYzjQ.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\jSgPTvo.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\zZPTgYq.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\MGvWonf.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\uXdXMED.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\lEacJWb.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\GVLImew.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\cTdmjMV.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\ISuBdgC.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\nDWcAir.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\QeFBZKh.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\DXwvkzp.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\hGFlExn.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\qMNUIKN.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\YehmaKE.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\XIJgcdo.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\EKugcNw.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\yTuNyjO.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\upXCPYL.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\vRyYNOq.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\KKVGrWX.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\uhhguGF.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\FWJnTDh.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\YIHOLdH.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\DHgPkWj.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\fKKjutG.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\qfpwPVO.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\CbbMuZf.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\XNNdvUu.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\PwBPADu.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\WLapnQQ.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\wFVdZtR.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\gsWvkCr.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\hIZgRYu.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\RyJJJlC.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\WIbpxkK.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\GJZxLOU.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\UtcpCjQ.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\zaZRzhz.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\yZOveyE.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\ZuteWsR.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\VJpaZid.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\QpXQryN.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\quGWAnN.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\vmfJYeT.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\SCfdhEI.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\juBCPng.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\xaOXdXV.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\WolpCeX.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\QwnsuiU.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\sEvDgml.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\sBJNRts.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\isiZmpX.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\pLOPYkG.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\tArrCZD.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\NaVyynw.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\aJQvimX.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\ImVwFQX.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\TaaLddq.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\MOvevJp.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\dBClpTJ.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\vybKpEm.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\MtykIJG.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
File created	C:\Windows\System\gKmYJXe.exe	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2544	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	32
PID 2348 wrote to memory of 2544	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	32
PID 2348 wrote to memory of 2544	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	32
PID 2348 wrote to memory of 768	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	33
PID 2348 wrote to memory of 768	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	33
PID 2348 wrote to memory of 768	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	33
PID 2348 wrote to memory of 2504	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	34
PID 2348 wrote to memory of 2504	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	34
PID 2348 wrote to memory of 2504	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	34
PID 2348 wrote to memory of 1932	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	35
PID 2348 wrote to memory of 1932	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	35
PID 2348 wrote to memory of 1932	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	35
PID 2348 wrote to memory of 2320	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	36
PID 2348 wrote to memory of 2320	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	36
PID 2348 wrote to memory of 2320	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	36
PID 2348 wrote to memory of 2720	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	37
PID 2348 wrote to memory of 2720	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	37
PID 2348 wrote to memory of 2720	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	37
PID 2348 wrote to memory of 2804	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	38
PID 2348 wrote to memory of 2804	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	38
PID 2348 wrote to memory of 2804	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	38
PID 2348 wrote to memory of 2988	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	39
PID 2348 wrote to memory of 2988	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	39
PID 2348 wrote to memory of 2988	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	39
PID 2348 wrote to memory of 2700	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	40
PID 2348 wrote to memory of 2700	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	40
PID 2348 wrote to memory of 2700	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	40
PID 2348 wrote to memory of 2692	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	41
PID 2348 wrote to memory of 2692	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	41
PID 2348 wrote to memory of 2692	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	41
PID 2348 wrote to memory of 2792	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	42
PID 2348 wrote to memory of 2792	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	42
PID 2348 wrote to memory of 2792	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	42
PID 2348 wrote to memory of 2604	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	43
PID 2348 wrote to memory of 2604	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	43
PID 2348 wrote to memory of 2604	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	43
PID 2348 wrote to memory of 2712	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	44
PID 2348 wrote to memory of 2712	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	44
PID 2348 wrote to memory of 2712	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	44
PID 2348 wrote to memory of 2632	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	45
PID 2348 wrote to memory of 2632	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	45
PID 2348 wrote to memory of 2632	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	45
PID 2348 wrote to memory of 2588	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	46
PID 2348 wrote to memory of 2588	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	46
PID 2348 wrote to memory of 2588	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	46
PID 2348 wrote to memory of 2652	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	47
PID 2348 wrote to memory of 2652	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	47
PID 2348 wrote to memory of 2652	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	47
PID 2348 wrote to memory of 3052	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	48
PID 2348 wrote to memory of 3052	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	48
PID 2348 wrote to memory of 3052	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	48
PID 2348 wrote to memory of 3068	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	49
PID 2348 wrote to memory of 3068	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	49
PID 2348 wrote to memory of 3068	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	49
PID 2348 wrote to memory of 1916	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	50
PID 2348 wrote to memory of 1916	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	50
PID 2348 wrote to memory of 1916	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	50
PID 2348 wrote to memory of 2036	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	51
PID 2348 wrote to memory of 2036	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	51
PID 2348 wrote to memory of 2036	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	51
PID 2348 wrote to memory of 2564	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	52
PID 2348 wrote to memory of 2564	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	52
PID 2348 wrote to memory of 2564	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	52
PID 2348 wrote to memory of 1668	2348	0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe	53

C:\Users\Admin\AppData\Local\Temp\0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe
"C:\Users\Admin\AppData\Local\Temp\0bc0f2c648d6d5b040bb04582b2e5cfc3672bd9339ee5314523b2abb6e20ab0c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System\cFlelgh.exe
  C:\Windows\System\cFlelgh.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\PwBPADu.exe
  C:\Windows\System\PwBPADu.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\oJXqrfG.exe
  C:\Windows\System\oJXqrfG.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\DkUdYZr.exe
  C:\Windows\System\DkUdYZr.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ohjDiiP.exe
  C:\Windows\System\ohjDiiP.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\qksRXFu.exe
  C:\Windows\System\qksRXFu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\JFLUDNK.exe
  C:\Windows\System\JFLUDNK.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\Ouaqdmd.exe
  C:\Windows\System\Ouaqdmd.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\zrjxxcp.exe
  C:\Windows\System\zrjxxcp.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MWKyWPe.exe
  C:\Windows\System\MWKyWPe.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\Qpcyopm.exe
  C:\Windows\System\Qpcyopm.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\EFjxZBJ.exe
  C:\Windows\System\EFjxZBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\FjtLYmz.exe
  C:\Windows\System\FjtLYmz.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\wdTadMt.exe
  C:\Windows\System\wdTadMt.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\LvxAKTg.exe
  C:\Windows\System\LvxAKTg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\dWQGRcE.exe
  C:\Windows\System\dWQGRcE.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\kMONSik.exe
  C:\Windows\System\kMONSik.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\uXCzrda.exe
  C:\Windows\System\uXCzrda.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\vlVlKqf.exe
  C:\Windows\System\vlVlKqf.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\ZloqKfs.exe
  C:\Windows\System\ZloqKfs.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\qFPWgpp.exe
  C:\Windows\System\qFPWgpp.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\OUcVqul.exe
  C:\Windows\System\OUcVqul.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\lEacJWb.exe
  C:\Windows\System\lEacJWb.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\YtCCSSl.exe
  C:\Windows\System\YtCCSSl.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\tmLHSkT.exe
  C:\Windows\System\tmLHSkT.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\srjdFie.exe
  C:\Windows\System\srjdFie.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\AZnfOdD.exe
  C:\Windows\System\AZnfOdD.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\raCqEXL.exe
  C:\Windows\System\raCqEXL.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\idDeJJV.exe
  C:\Windows\System\idDeJJV.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\QvInayy.exe
  C:\Windows\System\QvInayy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\uyawdYH.exe
  C:\Windows\System\uyawdYH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\QkJkbao.exe
  C:\Windows\System\QkJkbao.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\GCDMTOx.exe
  C:\Windows\System\GCDMTOx.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\qNKIPiJ.exe
  C:\Windows\System\qNKIPiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\iiNBIHW.exe
  C:\Windows\System\iiNBIHW.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\VZHagyH.exe
  C:\Windows\System\VZHagyH.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\OFdWrVw.exe
  C:\Windows\System\OFdWrVw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\IJSogHt.exe
  C:\Windows\System\IJSogHt.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\DeWMvao.exe
  C:\Windows\System\DeWMvao.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\QUFHNlW.exe
  C:\Windows\System\QUFHNlW.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\OBMSssA.exe
  C:\Windows\System\OBMSssA.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\wErBTve.exe
  C:\Windows\System\wErBTve.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\IWRWJrr.exe
  C:\Windows\System\IWRWJrr.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\IowJbdk.exe
  C:\Windows\System\IowJbdk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\QLgLIoP.exe
  C:\Windows\System\QLgLIoP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\fzLaHBr.exe
  C:\Windows\System\fzLaHBr.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\nahjZMf.exe
  C:\Windows\System\nahjZMf.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\CInmATP.exe
  C:\Windows\System\CInmATP.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\YZkstTh.exe
  C:\Windows\System\YZkstTh.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\zaZRzhz.exe
  C:\Windows\System\zaZRzhz.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\MmSeqou.exe
  C:\Windows\System\MmSeqou.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\eXsZlfD.exe
  C:\Windows\System\eXsZlfD.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\yZOveyE.exe
  C:\Windows\System\yZOveyE.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\fwNEdCs.exe
  C:\Windows\System\fwNEdCs.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\anxkLET.exe
  C:\Windows\System\anxkLET.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\gdKcDpR.exe
  C:\Windows\System\gdKcDpR.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\tEiSJzh.exe
  C:\Windows\System\tEiSJzh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\coTJBPf.exe
  C:\Windows\System\coTJBPf.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\plUpqVt.exe
  C:\Windows\System\plUpqVt.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\oZJMnNB.exe
  C:\Windows\System\oZJMnNB.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\aoHrWoA.exe
  C:\Windows\System\aoHrWoA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\OEVyfcN.exe
  C:\Windows\System\OEVyfcN.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\dhOHmOz.exe
  C:\Windows\System\dhOHmOz.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\XqkfYix.exe
  C:\Windows\System\XqkfYix.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\XgalSOk.exe
  C:\Windows\System\XgalSOk.exe
  2⤵
  PID:2992
- C:\Windows\System\WTyMZYt.exe
  C:\Windows\System\WTyMZYt.exe
  2⤵
  PID:1192
- C:\Windows\System\lerHZqL.exe
  C:\Windows\System\lerHZqL.exe
  2⤵
  PID:1564
- C:\Windows\System\wbmqhAL.exe
  C:\Windows\System\wbmqhAL.exe
  2⤵
  PID:532
- C:\Windows\System\cORmPFq.exe
  C:\Windows\System\cORmPFq.exe
  2⤵
  PID:744
- C:\Windows\System\QvBxnWS.exe
  C:\Windows\System\QvBxnWS.exe
  2⤵
  PID:480
- C:\Windows\System\eiRizbU.exe
  C:\Windows\System\eiRizbU.exe
  2⤵
  PID:3056
- C:\Windows\System\JmORNcr.exe
  C:\Windows\System\JmORNcr.exe
  2⤵
  PID:2680
- C:\Windows\System\wluksuX.exe
  C:\Windows\System\wluksuX.exe
  2⤵
  PID:2732
- C:\Windows\System\qRQkspu.exe
  C:\Windows\System\qRQkspu.exe
  2⤵
  PID:2396
- C:\Windows\System\fwkEgjg.exe
  C:\Windows\System\fwkEgjg.exe
  2⤵
  PID:2836
- C:\Windows\System\ULQPMlY.exe
  C:\Windows\System\ULQPMlY.exe
  2⤵
  PID:2576
- C:\Windows\System\nomiqEV.exe
  C:\Windows\System\nomiqEV.exe
  2⤵
  PID:2696
- C:\Windows\System\Ncdpbcg.exe
  C:\Windows\System\Ncdpbcg.exe
  2⤵
  PID:1444
- C:\Windows\System\ZgsJyTE.exe
  C:\Windows\System\ZgsJyTE.exe
  2⤵
  PID:2884
- C:\Windows\System\UZpmUMB.exe
  C:\Windows\System\UZpmUMB.exe
  2⤵
  PID:2020
- C:\Windows\System\leBLIXO.exe
  C:\Windows\System\leBLIXO.exe
  2⤵
  PID:2764
- C:\Windows\System\XpIgsNL.exe
  C:\Windows\System\XpIgsNL.exe
  2⤵
  PID:1884
- C:\Windows\System\VHgATeZ.exe
  C:\Windows\System\VHgATeZ.exe
  2⤵
  PID:2916
- C:\Windows\System\rYikDee.exe
  C:\Windows\System\rYikDee.exe
  2⤵
  PID:2964
- C:\Windows\System\IUVrgyl.exe
  C:\Windows\System\IUVrgyl.exe
  2⤵
  PID:2416
- C:\Windows\System\QwGYQGR.exe
  C:\Windows\System\QwGYQGR.exe
  2⤵
  PID:2096
- C:\Windows\System\WkXLYMm.exe
  C:\Windows\System\WkXLYMm.exe
  2⤵
  PID:1128
- C:\Windows\System\BvVamzh.exe
  C:\Windows\System\BvVamzh.exe
  2⤵
  PID:1864
- C:\Windows\System\DTZmUyu.exe
  C:\Windows\System\DTZmUyu.exe
  2⤵
  PID:836
- C:\Windows\System\tmVzwVx.exe
  C:\Windows\System\tmVzwVx.exe
  2⤵
  PID:684
- C:\Windows\System\PAkSDXZ.exe
  C:\Windows\System\PAkSDXZ.exe
  2⤵
  PID:1080
- C:\Windows\System\sLxByWs.exe
  C:\Windows\System\sLxByWs.exe
  2⤵
  PID:1712
- C:\Windows\System\ZhkVzmq.exe
  C:\Windows\System\ZhkVzmq.exe
  2⤵
  PID:2236
- C:\Windows\System\dmdDXaG.exe
  C:\Windows\System\dmdDXaG.exe
  2⤵
  PID:1048
- C:\Windows\System\vNetkrb.exe
  C:\Windows\System\vNetkrb.exe
  2⤵
  PID:3000
- C:\Windows\System\wpYjiUC.exe
  C:\Windows\System\wpYjiUC.exe
  2⤵
  PID:760
- C:\Windows\System\hUpMpYJ.exe
  C:\Windows\System\hUpMpYJ.exe
  2⤵
  PID:1624
- C:\Windows\System\XjGDmnz.exe
  C:\Windows\System\XjGDmnz.exe
  2⤵
  PID:3036
- C:\Windows\System\ZXAzGSi.exe
  C:\Windows\System\ZXAzGSi.exe
  2⤵
  PID:344
- C:\Windows\System\KGjISnh.exe
  C:\Windows\System\KGjISnh.exe
  2⤵
  PID:336
- C:\Windows\System\WTEghiQ.exe
  C:\Windows\System\WTEghiQ.exe
  2⤵
  PID:988
- C:\Windows\System\fFsNKoa.exe
  C:\Windows\System\fFsNKoa.exe
  2⤵
  PID:764
- C:\Windows\System\mDUCLhb.exe
  C:\Windows\System\mDUCLhb.exe
  2⤵
  PID:2140
- C:\Windows\System\hkXRzLb.exe
  C:\Windows\System\hkXRzLb.exe
  2⤵
  PID:2196
- C:\Windows\System\yTuNyjO.exe
  C:\Windows\System\yTuNyjO.exe
  2⤵
  PID:1688
- C:\Windows\System\WNwaCPf.exe
  C:\Windows\System\WNwaCPf.exe
  2⤵
  PID:2684
- C:\Windows\System\fTtFiwK.exe
  C:\Windows\System\fTtFiwK.exe
  2⤵
  PID:1472
- C:\Windows\System\avEThmH.exe
  C:\Windows\System\avEThmH.exe
  2⤵
  PID:2448
- C:\Windows\System\DTfcESR.exe
  C:\Windows\System\DTfcESR.exe
  2⤵
  PID:2688
- C:\Windows\System\yvYgEiZ.exe
  C:\Windows\System\yvYgEiZ.exe
  2⤵
  PID:2620
- C:\Windows\System\ORxJXfy.exe
  C:\Windows\System\ORxJXfy.exe
  2⤵
  PID:2004
- C:\Windows\System\tdXeIFY.exe
  C:\Windows\System\tdXeIFY.exe
  2⤵
  PID:1372
- C:\Windows\System\rZMvhTt.exe
  C:\Windows\System\rZMvhTt.exe
  2⤵
  PID:2104
- C:\Windows\System\ekkUWNc.exe
  C:\Windows\System\ekkUWNc.exe
  2⤵
  PID:2132
- C:\Windows\System\YnTjVYf.exe
  C:\Windows\System\YnTjVYf.exe
  2⤵
  PID:2956
- C:\Windows\System\VkngXBf.exe
  C:\Windows\System\VkngXBf.exe
  2⤵
  PID:2472
- C:\Windows\System\fhsADaR.exe
  C:\Windows\System\fhsADaR.exe
  2⤵
  PID:2060
- C:\Windows\System\VrVAxlO.exe
  C:\Windows\System\VrVAxlO.exe
  2⤵
  PID:1708
- C:\Windows\System\VbOSSje.exe
  C:\Windows\System\VbOSSje.exe
  2⤵
  PID:568
- C:\Windows\System\GXLWVjI.exe
  C:\Windows\System\GXLWVjI.exe
  2⤵
  PID:1508
- C:\Windows\System\GVLImew.exe
  C:\Windows\System\GVLImew.exe
  2⤵
  PID:1072
- C:\Windows\System\RQhTpos.exe
  C:\Windows\System\RQhTpos.exe
  2⤵
  PID:676
- C:\Windows\System\vBhsoVH.exe
  C:\Windows\System\vBhsoVH.exe
  2⤵
  PID:2660
- C:\Windows\System\CnzuESe.exe
  C:\Windows\System\CnzuESe.exe
  2⤵
  PID:2552
- C:\Windows\System\bHGQmRY.exe
  C:\Windows\System\bHGQmRY.exe
  2⤵
  PID:2872
- C:\Windows\System\eHYJLVx.exe
  C:\Windows\System\eHYJLVx.exe
  2⤵
  PID:2668
- C:\Windows\System\XSnRGYG.exe
  C:\Windows\System\XSnRGYG.exe
  2⤵
  PID:2936
- C:\Windows\System\CpThzqQ.exe
  C:\Windows\System\CpThzqQ.exe
  2⤵
  PID:3088
- C:\Windows\System\ylFlJTa.exe
  C:\Windows\System\ylFlJTa.exe
  2⤵
  PID:3104
- C:\Windows\System\NpYxmoy.exe
  C:\Windows\System\NpYxmoy.exe
  2⤵
  PID:3120
- C:\Windows\System\ymEvBBb.exe
  C:\Windows\System\ymEvBBb.exe
  2⤵
  PID:3136
- C:\Windows\System\iuXppZn.exe
  C:\Windows\System\iuXppZn.exe
  2⤵
  PID:3152
- C:\Windows\System\sFkAttT.exe
  C:\Windows\System\sFkAttT.exe
  2⤵
  PID:3168
- C:\Windows\System\IJPfSyu.exe
  C:\Windows\System\IJPfSyu.exe
  2⤵
  PID:3184
- C:\Windows\System\EvCHGoz.exe
  C:\Windows\System\EvCHGoz.exe
  2⤵
  PID:3200
- C:\Windows\System\DJlJGqH.exe
  C:\Windows\System\DJlJGqH.exe
  2⤵
  PID:3216
- C:\Windows\System\vfopKTl.exe
  C:\Windows\System\vfopKTl.exe
  2⤵
  PID:3232
- C:\Windows\System\fHphMoY.exe
  C:\Windows\System\fHphMoY.exe
  2⤵
  PID:3248
- C:\Windows\System\uukbBCs.exe
  C:\Windows\System\uukbBCs.exe
  2⤵
  PID:3264
- C:\Windows\System\ZCjMeok.exe
  C:\Windows\System\ZCjMeok.exe
  2⤵
  PID:3280
- C:\Windows\System\wMjRpfa.exe
  C:\Windows\System\wMjRpfa.exe
  2⤵
  PID:3296
- C:\Windows\System\nAVOUPn.exe
  C:\Windows\System\nAVOUPn.exe
  2⤵
  PID:3312
- C:\Windows\System\khpUeWt.exe
  C:\Windows\System\khpUeWt.exe
  2⤵
  PID:3328
- C:\Windows\System\bwaiYUL.exe
  C:\Windows\System\bwaiYUL.exe
  2⤵
  PID:3344
- C:\Windows\System\sweTFit.exe
  C:\Windows\System\sweTFit.exe
  2⤵
  PID:3360
- C:\Windows\System\XSOIKFT.exe
  C:\Windows\System\XSOIKFT.exe
  2⤵
  PID:3376
- C:\Windows\System\RkbqpSB.exe
  C:\Windows\System\RkbqpSB.exe
  2⤵
  PID:3392
- C:\Windows\System\GwjILgU.exe
  C:\Windows\System\GwjILgU.exe
  2⤵
  PID:3408
- C:\Windows\System\YBbYOAM.exe
  C:\Windows\System\YBbYOAM.exe
  2⤵
  PID:3424
- C:\Windows\System\idyhZEk.exe
  C:\Windows\System\idyhZEk.exe
  2⤵
  PID:3440
- C:\Windows\System\swScKgy.exe
  C:\Windows\System\swScKgy.exe
  2⤵
  PID:3456
- C:\Windows\System\hNtNQtM.exe
  C:\Windows\System\hNtNQtM.exe
  2⤵
  PID:3472
- C:\Windows\System\eshsVWJ.exe
  C:\Windows\System\eshsVWJ.exe
  2⤵
  PID:3488
- C:\Windows\System\xkYqJED.exe
  C:\Windows\System\xkYqJED.exe
  2⤵
  PID:3504
- C:\Windows\System\xxVGFrU.exe
  C:\Windows\System\xxVGFrU.exe
  2⤵
  PID:3520
- C:\Windows\System\FdjSrtE.exe
  C:\Windows\System\FdjSrtE.exe
  2⤵
  PID:3536
- C:\Windows\System\wsRkyMy.exe
  C:\Windows\System\wsRkyMy.exe
  2⤵
  PID:3552
- C:\Windows\System\wdgsulR.exe
  C:\Windows\System\wdgsulR.exe
  2⤵
  PID:3568
- C:\Windows\System\xwZHxoE.exe
  C:\Windows\System\xwZHxoE.exe
  2⤵
  PID:3584
- C:\Windows\System\MhIyGqS.exe
  C:\Windows\System\MhIyGqS.exe
  2⤵
  PID:3600
- C:\Windows\System\pDWFSgK.exe
  C:\Windows\System\pDWFSgK.exe
  2⤵
  PID:3616
- C:\Windows\System\nZZBycj.exe
  C:\Windows\System\nZZBycj.exe
  2⤵
  PID:3632
- C:\Windows\System\wqjNYmV.exe
  C:\Windows\System\wqjNYmV.exe
  2⤵
  PID:3648
- C:\Windows\System\tHNjMsn.exe
  C:\Windows\System\tHNjMsn.exe
  2⤵
  PID:3664
- C:\Windows\System\GwbqsUj.exe
  C:\Windows\System\GwbqsUj.exe
  2⤵
  PID:3680
- C:\Windows\System\XnzjnXo.exe
  C:\Windows\System\XnzjnXo.exe
  2⤵
  PID:3696
- C:\Windows\System\fcnlKfW.exe
  C:\Windows\System\fcnlKfW.exe
  2⤵
  PID:3712
- C:\Windows\System\QyECPaW.exe
  C:\Windows\System\QyECPaW.exe
  2⤵
  PID:3728
- C:\Windows\System\PKXIjFU.exe
  C:\Windows\System\PKXIjFU.exe
  2⤵
  PID:3744
- C:\Windows\System\mIGMylT.exe
  C:\Windows\System\mIGMylT.exe
  2⤵
  PID:3760
- C:\Windows\System\mpxDfhD.exe
  C:\Windows\System\mpxDfhD.exe
  2⤵
  PID:3776
- C:\Windows\System\FGmuvCG.exe
  C:\Windows\System\FGmuvCG.exe
  2⤵
  PID:3792
- C:\Windows\System\CyKtlxd.exe
  C:\Windows\System\CyKtlxd.exe
  2⤵
  PID:3808
- C:\Windows\System\nrrvtvQ.exe
  C:\Windows\System\nrrvtvQ.exe
  2⤵
  PID:3824
- C:\Windows\System\GEckFdZ.exe
  C:\Windows\System\GEckFdZ.exe
  2⤵
  PID:3840
- C:\Windows\System\PZApZnA.exe
  C:\Windows\System\PZApZnA.exe
  2⤵
  PID:3856
- C:\Windows\System\qKKDEGN.exe
  C:\Windows\System\qKKDEGN.exe
  2⤵
  PID:3872
- C:\Windows\System\YMwWfRa.exe
  C:\Windows\System\YMwWfRa.exe
  2⤵
  PID:3888
- C:\Windows\System\uPUTqZy.exe
  C:\Windows\System\uPUTqZy.exe
  2⤵
  PID:3904
- C:\Windows\System\oadchqT.exe
  C:\Windows\System\oadchqT.exe
  2⤵
  PID:3920
- C:\Windows\System\zHatBKt.exe
  C:\Windows\System\zHatBKt.exe
  2⤵
  PID:3936
- C:\Windows\System\kWCKffc.exe
  C:\Windows\System\kWCKffc.exe
  2⤵
  PID:3952
- C:\Windows\System\mrAVkoS.exe
  C:\Windows\System\mrAVkoS.exe
  2⤵
  PID:3968
- C:\Windows\System\wQljFxy.exe
  C:\Windows\System\wQljFxy.exe
  2⤵
  PID:3984
- C:\Windows\System\DrLFjHY.exe
  C:\Windows\System\DrLFjHY.exe
  2⤵
  PID:4000
- C:\Windows\System\czMKvdf.exe
  C:\Windows\System\czMKvdf.exe
  2⤵
  PID:4016
- C:\Windows\System\AcaHTLD.exe
  C:\Windows\System\AcaHTLD.exe
  2⤵
  PID:4032
- C:\Windows\System\ihAuBie.exe
  C:\Windows\System\ihAuBie.exe
  2⤵
  PID:4048
- C:\Windows\System\LJFdDjv.exe
  C:\Windows\System\LJFdDjv.exe
  2⤵
  PID:4064
- C:\Windows\System\jmOxuJw.exe
  C:\Windows\System\jmOxuJw.exe
  2⤵
  PID:4080
- C:\Windows\System\GUjQllx.exe
  C:\Windows\System\GUjQllx.exe
  2⤵
  PID:2608
- C:\Windows\System\JeLwrXV.exe
  C:\Windows\System\JeLwrXV.exe
  2⤵
  PID:1060
- C:\Windows\System\KiXfjmE.exe
  C:\Windows\System\KiXfjmE.exe
  2⤵
  PID:1064
- C:\Windows\System\emyJRWJ.exe
  C:\Windows\System\emyJRWJ.exe
  2⤵
  PID:904
- C:\Windows\System\yEpzuVw.exe
  C:\Windows\System\yEpzuVw.exe
  2⤵
  PID:976
- C:\Windows\System\teTpktL.exe
  C:\Windows\System\teTpktL.exe
  2⤵
  PID:1744
- C:\Windows\System\LbfSdVD.exe
  C:\Windows\System\LbfSdVD.exe
  2⤵
  PID:1800
- C:\Windows\System\VVYecdy.exe
  C:\Windows\System\VVYecdy.exe
  2⤵
  PID:556
- C:\Windows\System\XxNBNje.exe
  C:\Windows\System\XxNBNje.exe
  2⤵
  PID:1732
- C:\Windows\System\tSwYwxN.exe
  C:\Windows\System\tSwYwxN.exe
  2⤵
  PID:2612
- C:\Windows\System\fCozHvv.exe
  C:\Windows\System\fCozHvv.exe
  2⤵
  PID:2776
- C:\Windows\System\HgzeQwA.exe
  C:\Windows\System\HgzeQwA.exe
  2⤵
  PID:3084
- C:\Windows\System\FCwxwlG.exe
  C:\Windows\System\FCwxwlG.exe
  2⤵
  PID:3128
- C:\Windows\System\jtkWcpr.exe
  C:\Windows\System\jtkWcpr.exe
  2⤵
  PID:3144
- C:\Windows\System\oakcYix.exe
  C:\Windows\System\oakcYix.exe
  2⤵
  PID:3176
- C:\Windows\System\OUzAMVR.exe
  C:\Windows\System\OUzAMVR.exe
  2⤵
  PID:3180
- C:\Windows\System\ovllWrN.exe
  C:\Windows\System\ovllWrN.exe
  2⤵
  PID:3212
- C:\Windows\System\AtWRuJs.exe
  C:\Windows\System\AtWRuJs.exe
  2⤵
  PID:3260
- C:\Windows\System\gTtghgz.exe
  C:\Windows\System\gTtghgz.exe
  2⤵
  PID:2624
- C:\Windows\System\LxDBFhB.exe
  C:\Windows\System\LxDBFhB.exe
  2⤵
  PID:2748
- C:\Windows\System\lzmkAzz.exe
  C:\Windows\System\lzmkAzz.exe
  2⤵
  PID:3416
- C:\Windows\System\DMBFasz.exe
  C:\Windows\System\DMBFasz.exe
  2⤵
  PID:3432
- C:\Windows\System\UAVJlDt.exe
  C:\Windows\System\UAVJlDt.exe
  2⤵
  PID:3464
- C:\Windows\System\ivAnlxY.exe
  C:\Windows\System\ivAnlxY.exe
  2⤵
  PID:3496
- C:\Windows\System\XlDOrby.exe
  C:\Windows\System\XlDOrby.exe
  2⤵
  PID:3928
- C:\Windows\System\ktEUGHd.exe
  C:\Windows\System\ktEUGHd.exe
  2⤵
  PID:3948
- C:\Windows\System\OKkjolw.exe
  C:\Windows\System\OKkjolw.exe
  2⤵
  PID:2204
- C:\Windows\System\UAyPfAj.exe
  C:\Windows\System\UAyPfAj.exe
  2⤵
  PID:3996
- C:\Windows\System\SFypRmV.exe
  C:\Windows\System\SFypRmV.exe
  2⤵
  PID:4008
- C:\Windows\System\DQqgweY.exe
  C:\Windows\System\DQqgweY.exe
  2⤵
  PID:2044
- C:\Windows\System\OhybSWj.exe
  C:\Windows\System\OhybSWj.exe
  2⤵
  PID:4044
- C:\Windows\System\TwAfhud.exe
  C:\Windows\System\TwAfhud.exe
  2⤵
  PID:4088
- C:\Windows\System\hQeXycF.exe
  C:\Windows\System\hQeXycF.exe
  2⤵
  PID:4076
- C:\Windows\System\GsIUyNJ.exe
  C:\Windows\System\GsIUyNJ.exe
  2⤵
  PID:2880
- C:\Windows\System\qSEUmHO.exe
  C:\Windows\System\qSEUmHO.exe
  2⤵
  PID:2224
- C:\Windows\System\yoBXPGl.exe
  C:\Windows\System\yoBXPGl.exe
  2⤵
  PID:2392
- C:\Windows\System\NQqHYmJ.exe
  C:\Windows\System\NQqHYmJ.exe
  2⤵
  PID:2796
- C:\Windows\System\cixMNLO.exe
  C:\Windows\System\cixMNLO.exe
  2⤵
  PID:2580
- C:\Windows\System\wzizobD.exe
  C:\Windows\System\wzizobD.exe
  2⤵
  PID:3388
- C:\Windows\System\YRxfrRC.exe
  C:\Windows\System\YRxfrRC.exe
  2⤵
  PID:3528
- C:\Windows\System\QmNSgnx.exe
  C:\Windows\System\QmNSgnx.exe
  2⤵
  PID:2840
- C:\Windows\System\HPGXnJj.exe
  C:\Windows\System\HPGXnJj.exe
  2⤵
  PID:2248
- C:\Windows\System\KdiKISb.exe
  C:\Windows\System\KdiKISb.exe
  2⤵
  PID:2240
- C:\Windows\System\mergvfw.exe
  C:\Windows\System\mergvfw.exe
  2⤵
  PID:3292
- C:\Windows\System\DPFViLu.exe
  C:\Windows\System\DPFViLu.exe
  2⤵
  PID:3404
- C:\Windows\System\aFGnIVi.exe
  C:\Windows\System\aFGnIVi.exe
  2⤵
  PID:3468
- C:\Windows\System\DMNaTZv.exe
  C:\Windows\System\DMNaTZv.exe
  2⤵
  PID:2596
- C:\Windows\System\IbBZsKf.exe
  C:\Windows\System\IbBZsKf.exe
  2⤵
  PID:3640
- C:\Windows\System\iEkqlJb.exe
  C:\Windows\System\iEkqlJb.exe
  2⤵
  PID:3656
- C:\Windows\System\wfZEffu.exe
  C:\Windows\System\wfZEffu.exe
  2⤵
  PID:3688
- C:\Windows\System\WcuNlzq.exe
  C:\Windows\System\WcuNlzq.exe
  2⤵
  PID:3720
- C:\Windows\System\BSwYgej.exe
  C:\Windows\System\BSwYgej.exe
  2⤵
  PID:3724
- C:\Windows\System\nCliIif.exe
  C:\Windows\System\nCliIif.exe
  2⤵
  PID:3768
- C:\Windows\System\thlPRST.exe
  C:\Windows\System\thlPRST.exe
  2⤵
  PID:3788
- C:\Windows\System\ekEdkHw.exe
  C:\Windows\System\ekEdkHw.exe
  2⤵
  PID:3832
- C:\Windows\System\xCRFZfu.exe
  C:\Windows\System\xCRFZfu.exe
  2⤵
  PID:3864
- C:\Windows\System\rpEbcIy.exe
  C:\Windows\System\rpEbcIy.exe
  2⤵
  PID:3852
- C:\Windows\System\dLKMmfd.exe
  C:\Windows\System\dLKMmfd.exe
  2⤵
  PID:3912
- C:\Windows\System\SdEyagP.exe
  C:\Windows\System\SdEyagP.exe
  2⤵
  PID:2028
- C:\Windows\System\zxXXNws.exe
  C:\Windows\System\zxXXNws.exe
  2⤵
  PID:4092
- C:\Windows\System\VRLybpS.exe
  C:\Windows\System\VRLybpS.exe
  2⤵
  PID:3944
- C:\Windows\System\rAyPooP.exe
  C:\Windows\System\rAyPooP.exe
  2⤵
  PID:2584
- C:\Windows\System\bFUyuWD.exe
  C:\Windows\System\bFUyuWD.exe
  2⤵
  PID:4012
- C:\Windows\System\gaODMks.exe
  C:\Windows\System\gaODMks.exe
  2⤵
  PID:4072
- C:\Windows\System\KONAokT.exe
  C:\Windows\System\KONAokT.exe
  2⤵
  PID:2524
- C:\Windows\System\buvakpt.exe
  C:\Windows\System\buvakpt.exe
  2⤵
  PID:3112
- C:\Windows\System\cTCPRsL.exe
  C:\Windows\System\cTCPRsL.exe
  2⤵
  PID:2356
- C:\Windows\System\LpMpBgz.exe
  C:\Windows\System\LpMpBgz.exe
  2⤵
  PID:3164
- C:\Windows\System\diuywdA.exe
  C:\Windows\System\diuywdA.exe
  2⤵
  PID:3096
- C:\Windows\System\urMaPjP.exe
  C:\Windows\System\urMaPjP.exe
  2⤵
  PID:3340
- C:\Windows\System\xHuHheY.exe
  C:\Windows\System\xHuHheY.exe
  2⤵
  PID:3356
- C:\Windows\System\qJLaaqm.exe
  C:\Windows\System\qJLaaqm.exe
  2⤵
  PID:2264
- C:\Windows\System\HYWMetJ.exe
  C:\Windows\System\HYWMetJ.exe
  2⤵
  PID:3420
- C:\Windows\System\hyIHkxx.exe
  C:\Windows\System\hyIHkxx.exe
  2⤵
  PID:3644
- C:\Windows\System\ISWzrJm.exe
  C:\Windows\System\ISWzrJm.exe
  2⤵
  PID:3660
- C:\Windows\System\fLgbGRi.exe
  C:\Windows\System\fLgbGRi.exe
  2⤵
  PID:3612
- C:\Windows\System\KoMHHCG.exe
  C:\Windows\System\KoMHHCG.exe
  2⤵
  PID:3772
- C:\Windows\System\mavhgtP.exe
  C:\Windows\System\mavhgtP.exe
  2⤵
  PID:3880
- C:\Windows\System\fwRDNKX.exe
  C:\Windows\System\fwRDNKX.exe
  2⤵
  PID:3932
- C:\Windows\System\WhopPtc.exe
  C:\Windows\System\WhopPtc.exe
  2⤵
  PID:3884
- C:\Windows\System\FVKvAPO.exe
  C:\Windows\System\FVKvAPO.exe
  2⤵
  PID:2616
- C:\Windows\System\RkPsAvu.exe
  C:\Windows\System\RkPsAvu.exe
  2⤵
  PID:3980
- C:\Windows\System\VPefcZG.exe
  C:\Windows\System\VPefcZG.exe
  2⤵
  PID:3848
- C:\Windows\System\hvNgZmx.exe
  C:\Windows\System\hvNgZmx.exe
  2⤵
  PID:4060
- C:\Windows\System\oJZxhtP.exe
  C:\Windows\System\oJZxhtP.exe
  2⤵
  PID:3080
- C:\Windows\System\YBedwvR.exe
  C:\Windows\System\YBedwvR.exe
  2⤵
  PID:3240
- C:\Windows\System\fWrxoic.exe
  C:\Windows\System\fWrxoic.exe
  2⤵
  PID:3516
- C:\Windows\System\LNNDUNI.exe
  C:\Windows\System\LNNDUNI.exe
  2⤵
  PID:3272
- C:\Windows\System\PfjeHwK.exe
  C:\Windows\System\PfjeHwK.exe
  2⤵
  PID:2172
- C:\Windows\System\KPgHRqD.exe
  C:\Windows\System\KPgHRqD.exe
  2⤵
  PID:2676
- C:\Windows\System\QtBPbvY.exe
  C:\Windows\System\QtBPbvY.exe
  2⤵
  PID:108
- C:\Windows\System\GTFlOYR.exe
  C:\Windows\System\GTFlOYR.exe
  2⤵
  PID:3820
- C:\Windows\System\uTgLCXZ.exe
  C:\Windows\System\uTgLCXZ.exe
  2⤵
  PID:3304
- C:\Windows\System\CDwlXRp.exe
  C:\Windows\System\CDwlXRp.exe
  2⤵
  PID:4028
- C:\Windows\System\LJDGHZT.exe
  C:\Windows\System\LJDGHZT.exe
  2⤵
  PID:1888
- C:\Windows\System\vEzoXGV.exe
  C:\Windows\System\vEzoXGV.exe
  2⤵
  PID:1876
- C:\Windows\System\uhhguGF.exe
  C:\Windows\System\uhhguGF.exe
  2⤵
  PID:3384
- C:\Windows\System\zFMicVF.exe
  C:\Windows\System\zFMicVF.exe
  2⤵
  PID:3452
- C:\Windows\System\oaBsJUj.exe
  C:\Windows\System\oaBsJUj.exe
  2⤵
  PID:1392
- C:\Windows\System\sndRVAm.exe
  C:\Windows\System\sndRVAm.exe
  2⤵
  PID:4108
- C:\Windows\System\uBBckKM.exe
  C:\Windows\System\uBBckKM.exe
  2⤵
  PID:4124
- C:\Windows\System\VtDLphg.exe
  C:\Windows\System\VtDLphg.exe
  2⤵
  PID:4140
- C:\Windows\System\KtxQZiy.exe
  C:\Windows\System\KtxQZiy.exe
  2⤵
  PID:4156
- C:\Windows\System\vzxcqhw.exe
  C:\Windows\System\vzxcqhw.exe
  2⤵
  PID:4172
- C:\Windows\System\fhhklHg.exe
  C:\Windows\System\fhhklHg.exe
  2⤵
  PID:4188
- C:\Windows\System\NqXnpNG.exe
  C:\Windows\System\NqXnpNG.exe
  2⤵
  PID:4204
- C:\Windows\System\dtUUUWN.exe
  C:\Windows\System\dtUUUWN.exe
  2⤵
  PID:4220
- C:\Windows\System\ZbBFdyj.exe
  C:\Windows\System\ZbBFdyj.exe
  2⤵
  PID:4236
- C:\Windows\System\cDRWKdn.exe
  C:\Windows\System\cDRWKdn.exe
  2⤵
  PID:4252
- C:\Windows\System\oWcZweC.exe
  C:\Windows\System\oWcZweC.exe
  2⤵
  PID:4268
- C:\Windows\System\UNRbXlj.exe
  C:\Windows\System\UNRbXlj.exe
  2⤵
  PID:4284
- C:\Windows\System\PtEEPnJ.exe
  C:\Windows\System\PtEEPnJ.exe
  2⤵
  PID:4300
- C:\Windows\System\ItvZNRe.exe
  C:\Windows\System\ItvZNRe.exe
  2⤵
  PID:4316
- C:\Windows\System\YIKXaLW.exe
  C:\Windows\System\YIKXaLW.exe
  2⤵
  PID:4332
- C:\Windows\System\oKcpGbf.exe
  C:\Windows\System\oKcpGbf.exe
  2⤵
  PID:4348
- C:\Windows\System\RrgODbe.exe
  C:\Windows\System\RrgODbe.exe
  2⤵
  PID:4364
- C:\Windows\System\QviZrce.exe
  C:\Windows\System\QviZrce.exe
  2⤵
  PID:4380
- C:\Windows\System\UserBYM.exe
  C:\Windows\System\UserBYM.exe
  2⤵
  PID:4396
- C:\Windows\System\JnyRxYk.exe
  C:\Windows\System\JnyRxYk.exe
  2⤵
  PID:4412
- C:\Windows\System\CDPSmXY.exe
  C:\Windows\System\CDPSmXY.exe
  2⤵
  PID:4432
- C:\Windows\System\mbDyAvv.exe
  C:\Windows\System\mbDyAvv.exe
  2⤵
  PID:4448
- C:\Windows\System\YJUosKb.exe
  C:\Windows\System\YJUosKb.exe
  2⤵
  PID:4472
- C:\Windows\System\KAcSoTO.exe
  C:\Windows\System\KAcSoTO.exe
  2⤵
  PID:4492
- C:\Windows\System\hBdhJKD.exe
  C:\Windows\System\hBdhJKD.exe
  2⤵
  PID:4508
- C:\Windows\System\wIYdwPq.exe
  C:\Windows\System\wIYdwPq.exe
  2⤵
  PID:4528
- C:\Windows\System\xsvGfBj.exe
  C:\Windows\System\xsvGfBj.exe
  2⤵
  PID:4544
- C:\Windows\System\NkICWVG.exe
  C:\Windows\System\NkICWVG.exe
  2⤵
  PID:4568
- C:\Windows\System\zrYaSdA.exe
  C:\Windows\System\zrYaSdA.exe
  2⤵
  PID:4588
- C:\Windows\System\DhFTNue.exe
  C:\Windows\System\DhFTNue.exe
  2⤵
  PID:4640
- C:\Windows\System\AUzYvPG.exe
  C:\Windows\System\AUzYvPG.exe
  2⤵
  PID:4660
- C:\Windows\System\nyUUdZm.exe
  C:\Windows\System\nyUUdZm.exe
  2⤵
  PID:4676
- C:\Windows\System\XTSUWXO.exe
  C:\Windows\System\XTSUWXO.exe
  2⤵
  PID:4704
- C:\Windows\System\IBDlbKN.exe
  C:\Windows\System\IBDlbKN.exe
  2⤵
  PID:4724
- C:\Windows\System\bIfCIwI.exe
  C:\Windows\System\bIfCIwI.exe
  2⤵
  PID:4840
- C:\Windows\System\WHhYPYM.exe
  C:\Windows\System\WHhYPYM.exe
  2⤵
  PID:4856
- C:\Windows\System\xCotOWW.exe
  C:\Windows\System\xCotOWW.exe
  2⤵
  PID:4872
- C:\Windows\System\MTFeTtI.exe
  C:\Windows\System\MTFeTtI.exe
  2⤵
  PID:4888
- C:\Windows\System\BFQFApr.exe
  C:\Windows\System\BFQFApr.exe
  2⤵
  PID:4908
- C:\Windows\System\OOnRWBA.exe
  C:\Windows\System\OOnRWBA.exe
  2⤵
  PID:4924
- C:\Windows\System\xxqThCD.exe
  C:\Windows\System\xxqThCD.exe
  2⤵
  PID:4940
- C:\Windows\System\uiogEqA.exe
  C:\Windows\System\uiogEqA.exe
  2⤵
  PID:4956
- C:\Windows\System\iyFvkwS.exe
  C:\Windows\System\iyFvkwS.exe
  2⤵
  PID:4972
- C:\Windows\System\NjXFDSS.exe
  C:\Windows\System\NjXFDSS.exe
  2⤵
  PID:4988
- C:\Windows\System\bDWaVYv.exe
  C:\Windows\System\bDWaVYv.exe
  2⤵
  PID:5004
- C:\Windows\System\coqnByz.exe
  C:\Windows\System\coqnByz.exe
  2⤵
  PID:5024
- C:\Windows\System\dSYWApb.exe
  C:\Windows\System\dSYWApb.exe
  2⤵
  PID:5040
- C:\Windows\System\vcZIHQg.exe
  C:\Windows\System\vcZIHQg.exe
  2⤵
  PID:5056
- C:\Windows\System\jLHMSgr.exe
  C:\Windows\System\jLHMSgr.exe
  2⤵
  PID:5072
- C:\Windows\System\GVQyqrR.exe
  C:\Windows\System\GVQyqrR.exe
  2⤵
  PID:5096
- C:\Windows\System\DbNlBls.exe
  C:\Windows\System\DbNlBls.exe
  2⤵
  PID:1664
- C:\Windows\System\UfxVhmS.exe
  C:\Windows\System\UfxVhmS.exe
  2⤵
  PID:2744
- C:\Windows\System\GMbxaQB.exe
  C:\Windows\System\GMbxaQB.exe
  2⤵
  PID:4136
- C:\Windows\System\JJowvYT.exe
  C:\Windows\System\JJowvYT.exe
  2⤵
  PID:4164
- C:\Windows\System\UZrJmpc.exe
  C:\Windows\System\UZrJmpc.exe
  2⤵
  PID:4196
- C:\Windows\System\KQPdBrX.exe
  C:\Windows\System\KQPdBrX.exe
  2⤵
  PID:4292
- C:\Windows\System\LggumaV.exe
  C:\Windows\System\LggumaV.exe
  2⤵
  PID:4264
- C:\Windows\System\tcJSwbz.exe
  C:\Windows\System\tcJSwbz.exe
  2⤵
  PID:4324
- C:\Windows\System\TDIiZoG.exe
  C:\Windows\System\TDIiZoG.exe
  2⤵
  PID:4356
- C:\Windows\System\njpQyxl.exe
  C:\Windows\System\njpQyxl.exe
  2⤵
  PID:4404
- C:\Windows\System\ptBSsct.exe
  C:\Windows\System\ptBSsct.exe
  2⤵
  PID:4428
- C:\Windows\System\DmiUFnS.exe
  C:\Windows\System\DmiUFnS.exe
  2⤵
  PID:4480
- C:\Windows\System\sRkTXZn.exe
  C:\Windows\System\sRkTXZn.exe
  2⤵
  PID:4648
- C:\Windows\System\gfwrDUk.exe
  C:\Windows\System\gfwrDUk.exe
  2⤵
  PID:4732
- C:\Windows\System\OEdeFro.exe
  C:\Windows\System\OEdeFro.exe
  2⤵
  PID:4756
- C:\Windows\System\mIwpKIk.exe
  C:\Windows\System\mIwpKIk.exe
  2⤵
  PID:4776
- C:\Windows\System\nRsLARP.exe
  C:\Windows\System\nRsLARP.exe
  2⤵
  PID:4792
- C:\Windows\System\SlAdHiz.exe
  C:\Windows\System\SlAdHiz.exe
  2⤵
  PID:4812
- C:\Windows\System\eiLnkcP.exe
  C:\Windows\System\eiLnkcP.exe
  2⤵
  PID:4836
- C:\Windows\System\mhkcZor.exe
  C:\Windows\System\mhkcZor.exe
  2⤵
  PID:4884
- C:\Windows\System\XUJEMOQ.exe
  C:\Windows\System\XUJEMOQ.exe
  2⤵
  PID:4896
- C:\Windows\System\KpLRaAI.exe
  C:\Windows\System\KpLRaAI.exe
  2⤵
  PID:4868
- C:\Windows\System\fevxRFB.exe
  C:\Windows\System\fevxRFB.exe
  2⤵
  PID:4984
- C:\Windows\System\YRyLPYC.exe
  C:\Windows\System\YRyLPYC.exe
  2⤵
  PID:5064
- C:\Windows\System\ejNCnOF.exe
  C:\Windows\System\ejNCnOF.exe
  2⤵
  PID:4200
- C:\Windows\System\AAEGfRS.exe
  C:\Windows\System\AAEGfRS.exe
  2⤵
  PID:4340
- C:\Windows\System\PzSIRvo.exe
  C:\Windows\System\PzSIRvo.exe
  2⤵
  PID:4444
- C:\Windows\System\nebVofR.exe
  C:\Windows\System\nebVofR.exe
  2⤵
  PID:4424
- C:\Windows\System\TXvSqnQ.exe
  C:\Windows\System\TXvSqnQ.exe
  2⤵
  PID:4504
- C:\Windows\System\aJQvimX.exe
  C:\Windows\System\aJQvimX.exe
  2⤵
  PID:4576
- C:\Windows\System\Avcbrdf.exe
  C:\Windows\System\Avcbrdf.exe
  2⤵
  PID:4520
- C:\Windows\System\jPjcnin.exe
  C:\Windows\System\jPjcnin.exe
  2⤵
  PID:4580
- C:\Windows\System\jMiMgBY.exe
  C:\Windows\System\jMiMgBY.exe
  2⤵
  PID:4604
- C:\Windows\System\uxsBamG.exe
  C:\Windows\System\uxsBamG.exe
  2⤵
  PID:4628
- C:\Windows\System\NoGNuIO.exe
  C:\Windows\System\NoGNuIO.exe
  2⤵
  PID:4712
- C:\Windows\System\upXCPYL.exe
  C:\Windows\System\upXCPYL.exe
  2⤵
  PID:4688
- C:\Windows\System\buSJnaT.exe
  C:\Windows\System\buSJnaT.exe
  2⤵
  PID:4744
- C:\Windows\System\vAmPuFa.exe
  C:\Windows\System\vAmPuFa.exe
  2⤵
  PID:4768
- C:\Windows\System\uoUNRSs.exe
  C:\Windows\System\uoUNRSs.exe
  2⤵
  PID:4796
- C:\Windows\System\bbOLHXN.exe
  C:\Windows\System\bbOLHXN.exe
  2⤵
  PID:4804
- C:\Windows\System\MQmKNpU.exe
  C:\Windows\System\MQmKNpU.exe
  2⤵
  PID:4852
- C:\Windows\System\DyTaHtj.exe
  C:\Windows\System\DyTaHtj.exe
  2⤵
  PID:4948
- C:\Windows\System\osEXmBw.exe
  C:\Windows\System\osEXmBw.exe
  2⤵
  PID:4968
- C:\Windows\System\OsfjSyd.exe
  C:\Windows\System\OsfjSyd.exe
  2⤵
  PID:4996
- C:\Windows\System\QCHRypp.exe
  C:\Windows\System\QCHRypp.exe
  2⤵
  PID:5020
- C:\Windows\System\fxsntkE.exe
  C:\Windows\System\fxsntkE.exe
  2⤵
  PID:5088
- C:\Windows\System\OvsMEqI.exe
  C:\Windows\System\OvsMEqI.exe
  2⤵
  PID:5104
- C:\Windows\System\RwIUQXJ.exe
  C:\Windows\System\RwIUQXJ.exe
  2⤵
  PID:4180
- C:\Windows\System\NGNzFYQ.exe
  C:\Windows\System\NGNzFYQ.exe
  2⤵
  PID:4276
- C:\Windows\System\qIdYaaq.exe
  C:\Windows\System\qIdYaaq.exe
  2⤵
  PID:4280
- C:\Windows\System\pnfxqsa.exe
  C:\Windows\System\pnfxqsa.exe
  2⤵
  PID:4440
- C:\Windows\System\WLapnQQ.exe
  C:\Windows\System\WLapnQQ.exe
  2⤵
  PID:4564
- C:\Windows\System\DKHvleU.exe
  C:\Windows\System\DKHvleU.exe
  2⤵
  PID:4620
- C:\Windows\System\hWpgpxz.exe
  C:\Windows\System\hWpgpxz.exe
  2⤵
  PID:4692
- C:\Windows\System\XVEjhPx.exe
  C:\Windows\System\XVEjhPx.exe
  2⤵
  PID:4820
- C:\Windows\System\GWBlREM.exe
  C:\Windows\System\GWBlREM.exe
  2⤵
  PID:4980
- C:\Windows\System\gAouzxy.exe
  C:\Windows\System\gAouzxy.exe
  2⤵
  PID:3324
- C:\Windows\System\nuUDObD.exe
  C:\Windows\System\nuUDObD.exe
  2⤵
  PID:4624
- C:\Windows\System\idvimla.exe
  C:\Windows\System\idvimla.exe
  2⤵
  PID:4612
- C:\Windows\System\Ljnsyvs.exe
  C:\Windows\System\Ljnsyvs.exe
  2⤵
  PID:5016
- C:\Windows\System\crhZNYW.exe
  C:\Windows\System\crhZNYW.exe
  2⤵
  PID:4700
- C:\Windows\System\SxGikSz.exe
  C:\Windows\System\SxGikSz.exe
  2⤵
  PID:4932
- C:\Windows\System\YPSHcrT.exe
  C:\Windows\System\YPSHcrT.exe
  2⤵
  PID:5052
- C:\Windows\System\nkLvNNp.exe
  C:\Windows\System\nkLvNNp.exe
  2⤵
  PID:4120
- C:\Windows\System\TxukShK.exe
  C:\Windows\System\TxukShK.exe
  2⤵
  PID:4296
- C:\Windows\System\aiUhbuZ.exe
  C:\Windows\System\aiUhbuZ.exe
  2⤵
  PID:4328
- C:\Windows\System\tkYwMJZ.exe
  C:\Windows\System\tkYwMJZ.exe
  2⤵
  PID:4540
- C:\Windows\System\DcMXqrT.exe
  C:\Windows\System\DcMXqrT.exe
  2⤵
  PID:4552
- C:\Windows\System\wdHjItX.exe
  C:\Windows\System\wdHjItX.exe
  2⤵
  PID:4904
- C:\Windows\System\hoYRbKD.exe
  C:\Windows\System\hoYRbKD.exe
  2⤵
  PID:4784
- C:\Windows\System\kZXnbLD.exe
  C:\Windows\System\kZXnbLD.exe
  2⤵
  PID:4104
- C:\Windows\System\zMrjDxO.exe
  C:\Windows\System\zMrjDxO.exe
  2⤵
  PID:4260
- C:\Windows\System\JzCarVn.exe
  C:\Windows\System\JzCarVn.exe
  2⤵
  PID:5084
- C:\Windows\System\ygyFhlp.exe
  C:\Windows\System\ygyFhlp.exe
  2⤵
  PID:4828
- C:\Windows\System\onEhcGR.exe
  C:\Windows\System\onEhcGR.exe
  2⤵
  PID:5108
- C:\Windows\System\mURMszA.exe
  C:\Windows\System\mURMszA.exe
  2⤵
  PID:4468
- C:\Windows\System\EXAAsGQ.exe
  C:\Windows\System\EXAAsGQ.exe
  2⤵
  PID:4556
- C:\Windows\System\woliwWE.exe
  C:\Windows\System\woliwWE.exe
  2⤵
  PID:5124
- C:\Windows\System\moZTGbN.exe
  C:\Windows\System\moZTGbN.exe
  2⤵
  PID:5144
- C:\Windows\System\VhXaJln.exe
  C:\Windows\System\VhXaJln.exe
  2⤵
  PID:5160
- C:\Windows\System\eJylyUF.exe
  C:\Windows\System\eJylyUF.exe
  2⤵
  PID:5176
- C:\Windows\System\yYriifW.exe
  C:\Windows\System\yYriifW.exe
  2⤵
  PID:5192
- C:\Windows\System\TSwYFaZ.exe
  C:\Windows\System\TSwYFaZ.exe
  2⤵
  PID:5208
- C:\Windows\System\btwahdm.exe
  C:\Windows\System\btwahdm.exe
  2⤵
  PID:5224
- C:\Windows\System\LEDDYPn.exe
  C:\Windows\System\LEDDYPn.exe
  2⤵
  PID:5240
- C:\Windows\System\casjMAy.exe
  C:\Windows\System\casjMAy.exe
  2⤵
  PID:5272
- C:\Windows\System\wgBEpBV.exe
  C:\Windows\System\wgBEpBV.exe
  2⤵
  PID:5296
- C:\Windows\System\LTmQWAP.exe
  C:\Windows\System\LTmQWAP.exe
  2⤵
  PID:5316
- C:\Windows\System\eYnTCRZ.exe
  C:\Windows\System\eYnTCRZ.exe
  2⤵
  PID:5336
- C:\Windows\System\jtoKFfK.exe
  C:\Windows\System\jtoKFfK.exe
  2⤵
  PID:5396
- C:\Windows\System\QdajGuk.exe
  C:\Windows\System\QdajGuk.exe
  2⤵
  PID:5452
- C:\Windows\System\oIKrabI.exe
  C:\Windows\System\oIKrabI.exe
  2⤵
  PID:5500
- C:\Windows\System\KhEcEQc.exe
  C:\Windows\System\KhEcEQc.exe
  2⤵
  PID:5540
- C:\Windows\System\eoXyVLA.exe
  C:\Windows\System\eoXyVLA.exe
  2⤵
  PID:5624
- C:\Windows\System\WucAoEC.exe
  C:\Windows\System\WucAoEC.exe
  2⤵
  PID:5664
- C:\Windows\System\epQPwVr.exe
  C:\Windows\System\epQPwVr.exe
  2⤵
  PID:5684
- C:\Windows\System\XZBzWpd.exe
  C:\Windows\System\XZBzWpd.exe
  2⤵
  PID:5700
- C:\Windows\System\bajoxRP.exe
  C:\Windows\System\bajoxRP.exe
  2⤵
  PID:5716
- C:\Windows\System\NOYhJBl.exe
  C:\Windows\System\NOYhJBl.exe
  2⤵
  PID:5736
- C:\Windows\System\DhmoGor.exe
  C:\Windows\System\DhmoGor.exe
  2⤵
  PID:5752
- C:\Windows\System\mxgcsrh.exe
  C:\Windows\System\mxgcsrh.exe
  2⤵
  PID:5772
- C:\Windows\System\NACpLxa.exe
  C:\Windows\System\NACpLxa.exe
  2⤵
  PID:5788
- C:\Windows\System\iuPirOn.exe
  C:\Windows\System\iuPirOn.exe
  2⤵
  PID:5804
- C:\Windows\System\pQfIuDW.exe
  C:\Windows\System\pQfIuDW.exe
  2⤵
  PID:5824
- C:\Windows\System\oZrgiPF.exe
  C:\Windows\System\oZrgiPF.exe
  2⤵
  PID:5840
- C:\Windows\System\YGDyFNm.exe
  C:\Windows\System\YGDyFNm.exe
  2⤵
  PID:5860
- C:\Windows\System\FpnJOjs.exe
  C:\Windows\System\FpnJOjs.exe
  2⤵
  PID:5880
- C:\Windows\System\ZMQkayF.exe
  C:\Windows\System\ZMQkayF.exe
  2⤵
  PID:5896
- C:\Windows\System\LpfqDlD.exe
  C:\Windows\System\LpfqDlD.exe
  2⤵
  PID:5920
- C:\Windows\System\sQmoMKj.exe
  C:\Windows\System\sQmoMKj.exe
  2⤵
  PID:5940
- C:\Windows\System\YSmmDSY.exe
  C:\Windows\System\YSmmDSY.exe
  2⤵
  PID:5960
- C:\Windows\System\FZKTVCv.exe
  C:\Windows\System\FZKTVCv.exe
  2⤵
  PID:5976
- C:\Windows\System\pBctUSp.exe
  C:\Windows\System\pBctUSp.exe
  2⤵
  PID:5996
- C:\Windows\System\KJsRxli.exe
  C:\Windows\System\KJsRxli.exe
  2⤵
  PID:6064
- C:\Windows\System\aWlupRH.exe
  C:\Windows\System\aWlupRH.exe
  2⤵
  PID:6084
- C:\Windows\System\NnFhmOn.exe
  C:\Windows\System\NnFhmOn.exe
  2⤵
  PID:6104
- C:\Windows\System\pqXVIwL.exe
  C:\Windows\System\pqXVIwL.exe
  2⤵
  PID:6124
- C:\Windows\System\yclteTi.exe
  C:\Windows\System\yclteTi.exe
  2⤵
  PID:6140
- C:\Windows\System\ARyCete.exe
  C:\Windows\System\ARyCete.exe
  2⤵
  PID:5152
- C:\Windows\System\AYuxEKv.exe
  C:\Windows\System\AYuxEKv.exe
  2⤵
  PID:5132
- C:\Windows\System\mFOKspy.exe
  C:\Windows\System\mFOKspy.exe
  2⤵
  PID:5172
- C:\Windows\System\faewLpr.exe
  C:\Windows\System\faewLpr.exe
  2⤵
  PID:5216
- C:\Windows\System\RAyrfVZ.exe
  C:\Windows\System\RAyrfVZ.exe
  2⤵
  PID:5248
- C:\Windows\System\YgbTVPC.exe
  C:\Windows\System\YgbTVPC.exe
  2⤵
  PID:5268
- C:\Windows\System\uiCOXDg.exe
  C:\Windows\System\uiCOXDg.exe
  2⤵
  PID:5284
- C:\Windows\System\qWGWNPW.exe
  C:\Windows\System\qWGWNPW.exe
  2⤵
  PID:5324
- C:\Windows\System\MMwOkmt.exe
  C:\Windows\System\MMwOkmt.exe
  2⤵
  PID:5352
- C:\Windows\System\vujjcVk.exe
  C:\Windows\System\vujjcVk.exe
  2⤵
  PID:5368
- C:\Windows\System\gPpgVMh.exe
  C:\Windows\System\gPpgVMh.exe
  2⤵
  PID:5384
- C:\Windows\System\usOkfbf.exe
  C:\Windows\System\usOkfbf.exe
  2⤵
  PID:5412
- C:\Windows\System\RETpQAV.exe
  C:\Windows\System\RETpQAV.exe
  2⤵
  PID:5428
- C:\Windows\System\bzWIjoA.exe
  C:\Windows\System\bzWIjoA.exe
  2⤵
  PID:5444
- C:\Windows\System\oDnwbmF.exe
  C:\Windows\System\oDnwbmF.exe
  2⤵
  PID:5472
- C:\Windows\System\SgLKLQS.exe
  C:\Windows\System\SgLKLQS.exe
  2⤵
  PID:5488
- C:\Windows\System\vXGPVan.exe
  C:\Windows\System\vXGPVan.exe
  2⤵
  PID:5516
- C:\Windows\System\hCAtnPk.exe
  C:\Windows\System\hCAtnPk.exe
  2⤵
  PID:5532
- C:\Windows\System\PsOKLgw.exe
  C:\Windows\System\PsOKLgw.exe
  2⤵
  PID:5556
- C:\Windows\System\AXYziyr.exe
  C:\Windows\System\AXYziyr.exe
  2⤵
  PID:5576
- C:\Windows\System\TVlbTRV.exe
  C:\Windows\System\TVlbTRV.exe
  2⤵
  PID:5592
- C:\Windows\System\KWOfxut.exe
  C:\Windows\System\KWOfxut.exe
  2⤵
  PID:5608
- C:\Windows\System\iIoxRIv.exe
  C:\Windows\System\iIoxRIv.exe
  2⤵
  PID:5636
- C:\Windows\System\amMgVXt.exe
  C:\Windows\System\amMgVXt.exe
  2⤵
  PID:5648
- C:\Windows\System\KSeIrrI.exe
  C:\Windows\System\KSeIrrI.exe
  2⤵
  PID:5660
- C:\Windows\System\XWzadgI.exe
  C:\Windows\System\XWzadgI.exe
  2⤵
  PID:5748
- C:\Windows\System\eeboTpk.exe
  C:\Windows\System\eeboTpk.exe
  2⤵
  PID:5732
- C:\Windows\System\puDyvwn.exe
  C:\Windows\System\puDyvwn.exe
  2⤵
  PID:5796
- C:\Windows\System\kymnaiH.exe
  C:\Windows\System\kymnaiH.exe
  2⤵
  PID:5728
- C:\Windows\System\lFWRnES.exe
  C:\Windows\System\lFWRnES.exe
  2⤵
  PID:5848
- C:\Windows\System\CLlvJRd.exe
  C:\Windows\System\CLlvJRd.exe
  2⤵
  PID:5904
- C:\Windows\System\LggDODp.exe
  C:\Windows\System\LggDODp.exe
  2⤵
  PID:5908
- C:\Windows\System\JobkPNG.exe
  C:\Windows\System\JobkPNG.exe
  2⤵
  PID:5968
- C:\Windows\System\JvfoVYz.exe
  C:\Windows\System\JvfoVYz.exe
  2⤵
  PID:5956
- C:\Windows\System\HvQDzuF.exe
  C:\Windows\System\HvQDzuF.exe
  2⤵
  PID:6004
- C:\Windows\System\FxEdYFV.exe
  C:\Windows\System\FxEdYFV.exe
  2⤵
  PID:6012
- C:\Windows\System\qgDuWbv.exe
  C:\Windows\System\qgDuWbv.exe
  2⤵
  PID:6036
- C:\Windows\System\pXTXfmc.exe
  C:\Windows\System\pXTXfmc.exe
  2⤵
  PID:6052
- C:\Windows\System\DqlNmGi.exe
  C:\Windows\System\DqlNmGi.exe
  2⤵
  PID:6096
- C:\Windows\System\TYYrXfx.exe
  C:\Windows\System\TYYrXfx.exe
  2⤵
  PID:6072
- C:\Windows\System\AjgwCQw.exe
  C:\Windows\System\AjgwCQw.exe
  2⤵
  PID:6120
- C:\Windows\System\EaqNKBE.exe
  C:\Windows\System\EaqNKBE.exe
  2⤵
  PID:4964
- C:\Windows\System\xepEnju.exe
  C:\Windows\System\xepEnju.exe
  2⤵
  PID:5260
- C:\Windows\System\mZpvBMp.exe
  C:\Windows\System\mZpvBMp.exe
  2⤵
  PID:5264
- C:\Windows\System\CdQyfov.exe
  C:\Windows\System\CdQyfov.exe
  2⤵
  PID:5220
- C:\Windows\System\JYvIXjE.exe
  C:\Windows\System\JYvIXjE.exe
  2⤵
  PID:5332
- C:\Windows\System\XzGkFkW.exe
  C:\Windows\System\XzGkFkW.exe
  2⤵
  PID:5380
- C:\Windows\System\sRgVzMt.exe
  C:\Windows\System\sRgVzMt.exe
  2⤵
  PID:5436
- C:\Windows\System\xmqCqvA.exe
  C:\Windows\System\xmqCqvA.exe
  2⤵
  PID:5464
- C:\Windows\System\erdGTjV.exe
  C:\Windows\System\erdGTjV.exe
  2⤵
  PID:5564
- C:\Windows\System\SWrkecW.exe
  C:\Windows\System\SWrkecW.exe
  2⤵
  PID:5620
- C:\Windows\System\ExDtQmn.exe
  C:\Windows\System\ExDtQmn.exe
  2⤵
  PID:5744
- C:\Windows\System\ncnWNgo.exe
  C:\Windows\System\ncnWNgo.exe
  2⤵
  PID:5780
- C:\Windows\System\CtafhLo.exe
  C:\Windows\System\CtafhLo.exe
  2⤵
  PID:6060
- C:\Windows\System\xUnaVZv.exe
  C:\Windows\System\xUnaVZv.exe
  2⤵
  PID:6112
- C:\Windows\System\GUGCibG.exe
  C:\Windows\System\GUGCibG.exe
  2⤵
  PID:5140
- C:\Windows\System\pIQJjqB.exe
  C:\Windows\System\pIQJjqB.exe
  2⤵
  PID:5360
- C:\Windows\System\BUDoUob.exe
  C:\Windows\System\BUDoUob.exe
  2⤵
  PID:5280
- C:\Windows\System\yYSNTLi.exe
  C:\Windows\System\yYSNTLi.exe
  2⤵
  PID:5420
- C:\Windows\System\UQgYqIo.exe
  C:\Windows\System\UQgYqIo.exe
  2⤵
  PID:5484
- C:\Windows\System\dYYdLJr.exe
  C:\Windows\System\dYYdLJr.exe
  2⤵
  PID:5588
- C:\Windows\System\CwfPwCv.exe
  C:\Windows\System\CwfPwCv.exe
  2⤵
  PID:5712
- C:\Windows\System\WIrmciH.exe
  C:\Windows\System\WIrmciH.exe
  2⤵
  PID:5876
- C:\Windows\System\XGQobjg.exe
  C:\Windows\System\XGQobjg.exe
  2⤵
  PID:5548
- C:\Windows\System\QyotAkp.exe
  C:\Windows\System\QyotAkp.exe
  2⤵
  PID:5508
- C:\Windows\System\eeWKsAT.exe
  C:\Windows\System\eeWKsAT.exe
  2⤵
  PID:5764
- C:\Windows\System\CwyYVDG.exe
  C:\Windows\System\CwyYVDG.exe
  2⤵
  PID:5692
- C:\Windows\System\zOUlEPk.exe
  C:\Windows\System\zOUlEPk.exe
  2⤵
  PID:5852
- C:\Windows\System\OzXRuwl.exe
  C:\Windows\System\OzXRuwl.exe
  2⤵
  PID:5988
- C:\Windows\System\KxFEQBf.exe
  C:\Windows\System\KxFEQBf.exe
  2⤵
  PID:6048
- C:\Windows\System\nxoIaAX.exe
  C:\Windows\System\nxoIaAX.exe
  2⤵
  PID:5912
- C:\Windows\System\Mhkgpqp.exe
  C:\Windows\System\Mhkgpqp.exe
  2⤵
  PID:5916
- C:\Windows\System\vRyYNOq.exe
  C:\Windows\System\vRyYNOq.exe
  2⤵
  PID:5184
- C:\Windows\System\byyHJRo.exe
  C:\Windows\System\byyHJRo.exe
  2⤵
  PID:5424
- C:\Windows\System\KfjtYqk.exe
  C:\Windows\System\KfjtYqk.exe
  2⤵
  PID:5552
- C:\Windows\System\pZpWfAW.exe
  C:\Windows\System\pZpWfAW.exe
  2⤵
  PID:5680
- C:\Windows\System\jpMgsfS.exe
  C:\Windows\System\jpMgsfS.exe
  2⤵
  PID:6020
- C:\Windows\System\AoGDkMo.exe
  C:\Windows\System\AoGDkMo.exe
  2⤵
  PID:6044
- C:\Windows\System\nEnmTgg.exe
  C:\Windows\System\nEnmTgg.exe
  2⤵
  PID:4672
- C:\Windows\System\cdIqSwa.exe
  C:\Windows\System\cdIqSwa.exe
  2⤵
  PID:5936
- C:\Windows\System\ypRrNty.exe
  C:\Windows\System\ypRrNty.exe
  2⤵
  PID:5404
- C:\Windows\System\FHiGASc.exe
  C:\Windows\System\FHiGASc.exe
  2⤵
  PID:5868
- C:\Windows\System\vyFtfeh.exe
  C:\Windows\System\vyFtfeh.exe
  2⤵
  PID:5524
- C:\Windows\System\iOysbbv.exe
  C:\Windows\System\iOysbbv.exe
  2⤵
  PID:5696
- C:\Windows\System\gHdqyIG.exe
  C:\Windows\System\gHdqyIG.exe
  2⤵
  PID:5888
- C:\Windows\System\vRyrVrC.exe
  C:\Windows\System\vRyrVrC.exe
  2⤵
  PID:5892
- C:\Windows\System\ckkVPqr.exe
  C:\Windows\System\ckkVPqr.exe
  2⤵
  PID:5408
- C:\Windows\System\oMpzALr.exe
  C:\Windows\System\oMpzALr.exe
  2⤵
  PID:5480
- C:\Windows\System\ZTSoiUR.exe
  C:\Windows\System\ZTSoiUR.exe
  2⤵
  PID:6156
- C:\Windows\System\wFaWSTH.exe
  C:\Windows\System\wFaWSTH.exe
  2⤵
  PID:6172
- C:\Windows\System\gfupYuf.exe
  C:\Windows\System\gfupYuf.exe
  2⤵
  PID:6188
- C:\Windows\System\nyTZQqG.exe
  C:\Windows\System\nyTZQqG.exe
  2⤵
  PID:6204
- C:\Windows\System\bvXbNhm.exe
  C:\Windows\System\bvXbNhm.exe
  2⤵
  PID:6224
- C:\Windows\System\ALzKpBe.exe
  C:\Windows\System\ALzKpBe.exe
  2⤵
  PID:6268
- C:\Windows\System\RhnmQwN.exe
  C:\Windows\System\RhnmQwN.exe
  2⤵
  PID:6288
- C:\Windows\System\jumoOdE.exe
  C:\Windows\System\jumoOdE.exe
  2⤵
  PID:6304
- C:\Windows\System\ovlburG.exe
  C:\Windows\System\ovlburG.exe
  2⤵
  PID:6320
- C:\Windows\System\TBMAahU.exe
  C:\Windows\System\TBMAahU.exe
  2⤵
  PID:6336
- C:\Windows\System\uaPQsed.exe
  C:\Windows\System\uaPQsed.exe
  2⤵
  PID:6352
- C:\Windows\System\mUnsgzx.exe
  C:\Windows\System\mUnsgzx.exe
  2⤵
  PID:6368
- C:\Windows\System\tkbIRfG.exe
  C:\Windows\System\tkbIRfG.exe
  2⤵
  PID:6384
- C:\Windows\System\vaWQDYn.exe
  C:\Windows\System\vaWQDYn.exe
  2⤵
  PID:6404
- C:\Windows\System\EWGKusS.exe
  C:\Windows\System\EWGKusS.exe
  2⤵
  PID:6420
- C:\Windows\System\hhOZlNm.exe
  C:\Windows\System\hhOZlNm.exe
  2⤵
  PID:6436
- C:\Windows\System\ImVwFQX.exe
  C:\Windows\System\ImVwFQX.exe
  2⤵
  PID:6452
- C:\Windows\System\hCIuaVQ.exe
  C:\Windows\System\hCIuaVQ.exe
  2⤵
  PID:6468
- C:\Windows\System\LzffDof.exe
  C:\Windows\System\LzffDof.exe
  2⤵
  PID:6484
- C:\Windows\System\JLQaxYO.exe
  C:\Windows\System\JLQaxYO.exe
  2⤵
  PID:6500
- C:\Windows\System\wcuyIhK.exe
  C:\Windows\System\wcuyIhK.exe
  2⤵
  PID:6516
- C:\Windows\System\xtSJfMI.exe
  C:\Windows\System\xtSJfMI.exe
  2⤵
  PID:6532
- C:\Windows\System\rTwToCE.exe
  C:\Windows\System\rTwToCE.exe
  2⤵
  PID:6552
- C:\Windows\System\lKUbGBR.exe
  C:\Windows\System\lKUbGBR.exe
  2⤵
  PID:6576
- C:\Windows\System\XlxWOso.exe
  C:\Windows\System\XlxWOso.exe
  2⤵
  PID:6596
- C:\Windows\System\yOvyFsu.exe
  C:\Windows\System\yOvyFsu.exe
  2⤵
  PID:6612
- C:\Windows\System\AcMNijv.exe
  C:\Windows\System\AcMNijv.exe
  2⤵
  PID:6628
- C:\Windows\System\zenPkUW.exe
  C:\Windows\System\zenPkUW.exe
  2⤵
  PID:6644
- C:\Windows\System\rzKAXst.exe
  C:\Windows\System\rzKAXst.exe
  2⤵
  PID:6660
- C:\Windows\System\smLkPwX.exe
  C:\Windows\System\smLkPwX.exe
  2⤵
  PID:6688
- C:\Windows\System\HtcCAFh.exe
  C:\Windows\System\HtcCAFh.exe
  2⤵
  PID:6704
- C:\Windows\System\lpAezWS.exe
  C:\Windows\System\lpAezWS.exe
  2⤵
  PID:6720
- C:\Windows\System\qovTFzR.exe
  C:\Windows\System\qovTFzR.exe
  2⤵
  PID:6736
- C:\Windows\System\cTdmjMV.exe
  C:\Windows\System\cTdmjMV.exe
  2⤵
  PID:6752
- C:\Windows\System\YcKfZmv.exe
  C:\Windows\System\YcKfZmv.exe
  2⤵
  PID:6772
- C:\Windows\System\CNvAJYg.exe
  C:\Windows\System\CNvAJYg.exe
  2⤵
  PID:6796
- C:\Windows\System\AsiyUHU.exe
  C:\Windows\System\AsiyUHU.exe
  2⤵
  PID:6812
- C:\Windows\System\TaaLddq.exe
  C:\Windows\System\TaaLddq.exe
  2⤵
  PID:6828
- C:\Windows\System\SmojZJq.exe
  C:\Windows\System\SmojZJq.exe
  2⤵
  PID:6844
- C:\Windows\System\SQVwGyn.exe
  C:\Windows\System\SQVwGyn.exe
  2⤵
  PID:6860
- C:\Windows\System\nnGQPMe.exe
  C:\Windows\System\nnGQPMe.exe
  2⤵
  PID:6876
- C:\Windows\System\najhVoK.exe
  C:\Windows\System\najhVoK.exe
  2⤵
  PID:6892
- C:\Windows\System\LvkECMO.exe
  C:\Windows\System\LvkECMO.exe
  2⤵
  PID:6908
- C:\Windows\System\iEmSDCg.exe
  C:\Windows\System\iEmSDCg.exe
  2⤵
  PID:6924
- C:\Windows\System\YLWitdM.exe
  C:\Windows\System\YLWitdM.exe
  2⤵
  PID:6940
- C:\Windows\System\pqliSiQ.exe
  C:\Windows\System\pqliSiQ.exe
  2⤵
  PID:6956
- C:\Windows\System\PpBtGQY.exe
  C:\Windows\System\PpBtGQY.exe
  2⤵
  PID:6972
- C:\Windows\System\qwznQcJ.exe
  C:\Windows\System\qwznQcJ.exe
  2⤵
  PID:6988
- C:\Windows\System\pEZiuiM.exe
  C:\Windows\System\pEZiuiM.exe
  2⤵
  PID:7004
- C:\Windows\System\lRiTrNj.exe
  C:\Windows\System\lRiTrNj.exe
  2⤵
  PID:7020
- C:\Windows\System\RXqdliH.exe
  C:\Windows\System\RXqdliH.exe
  2⤵
  PID:7036
- C:\Windows\System\LsntkjY.exe
  C:\Windows\System\LsntkjY.exe
  2⤵
  PID:7052
- C:\Windows\System\SOjYDwf.exe
  C:\Windows\System\SOjYDwf.exe
  2⤵
  PID:7072
- C:\Windows\System\FkQrYrF.exe
  C:\Windows\System\FkQrYrF.exe
  2⤵
  PID:7088
- C:\Windows\System\AwwWsGJ.exe
  C:\Windows\System\AwwWsGJ.exe
  2⤵
  PID:7108
- C:\Windows\System\fvcaBrW.exe
  C:\Windows\System\fvcaBrW.exe
  2⤵
  PID:7124
- C:\Windows\System\sBMvmIC.exe
  C:\Windows\System\sBMvmIC.exe
  2⤵
  PID:7140
- C:\Windows\System\VrknuFX.exe
  C:\Windows\System\VrknuFX.exe
  2⤵
  PID:7156
- C:\Windows\System\cERxGfi.exe
  C:\Windows\System\cERxGfi.exe
  2⤵
  PID:6164
- C:\Windows\System\erAweRF.exe
  C:\Windows\System\erAweRF.exe
  2⤵
  PID:6196
- C:\Windows\System\aTeTLxy.exe
  C:\Windows\System\aTeTLxy.exe
  2⤵
  PID:6212
- C:\Windows\System\ipoAlWQ.exe
  C:\Windows\System\ipoAlWQ.exe
  2⤵
  PID:6240
- C:\Windows\System\VqNNTBy.exe
  C:\Windows\System\VqNNTBy.exe
  2⤵
  PID:6256
- C:\Windows\System\EvoPDOg.exe
  C:\Windows\System\EvoPDOg.exe
  2⤵
  PID:6280
- C:\Windows\System\XDbkCpc.exe
  C:\Windows\System\XDbkCpc.exe
  2⤵
  PID:6332
- C:\Windows\System\QWCpEjw.exe
  C:\Windows\System\QWCpEjw.exe
  2⤵
  PID:6312
- C:\Windows\System\KKzoHwG.exe
  C:\Windows\System\KKzoHwG.exe
  2⤵
  PID:6376
- C:\Windows\System\QxCFngb.exe
  C:\Windows\System\QxCFngb.exe
  2⤵
  PID:6416
- C:\Windows\System\nphkgjZ.exe
  C:\Windows\System\nphkgjZ.exe
  2⤵
  PID:6460
- C:\Windows\System\wFVdZtR.exe
  C:\Windows\System\wFVdZtR.exe
  2⤵
  PID:6496
- C:\Windows\System\beZZTPX.exe
  C:\Windows\System\beZZTPX.exe
  2⤵
  PID:6568
- C:\Windows\System\wtZLhCv.exe
  C:\Windows\System\wtZLhCv.exe
  2⤵
  PID:6544
- C:\Windows\System\ndLNhMg.exe
  C:\Windows\System\ndLNhMg.exe
  2⤵
  PID:6512
- C:\Windows\System\nKRYzjQ.exe
  C:\Windows\System\nKRYzjQ.exe
  2⤵
  PID:6624
- C:\Windows\System\dpQObYi.exe
  C:\Windows\System\dpQObYi.exe
  2⤵
  PID:6672
- C:\Windows\System\OuLrxbk.exe
  C:\Windows\System\OuLrxbk.exe
  2⤵
  PID:6548
- C:\Windows\System\lZefDGy.exe
  C:\Windows\System\lZefDGy.exe
  2⤵
  PID:6696
- C:\Windows\System\btXjjAn.exe
  C:\Windows\System\btXjjAn.exe
  2⤵
  PID:6728
- C:\Windows\System\UoQDzTt.exe
  C:\Windows\System\UoQDzTt.exe
  2⤵
  PID:6784
- C:\Windows\System\QifBFWo.exe
  C:\Windows\System\QifBFWo.exe
  2⤵
  PID:6820
- C:\Windows\System\gNywdsV.exe
  C:\Windows\System\gNywdsV.exe
  2⤵
  PID:6804
- C:\Windows\System\FAhQyqV.exe
  C:\Windows\System\FAhQyqV.exe
  2⤵
  PID:6916
- C:\Windows\System\jSgPTvo.exe
  C:\Windows\System\jSgPTvo.exe
  2⤵
  PID:6760
- C:\Windows\System\DUHoDNR.exe
  C:\Windows\System\DUHoDNR.exe
  2⤵
  PID:6984
- C:\Windows\System\bEGXphp.exe
  C:\Windows\System\bEGXphp.exe
  2⤵
  PID:7048
- C:\Windows\System\BOrcTsJ.exe
  C:\Windows\System\BOrcTsJ.exe
  2⤵
  PID:6904
- C:\Windows\System\rayFTIU.exe
  C:\Windows\System\rayFTIU.exe
  2⤵
  PID:6968
- C:\Windows\System\OATzcNB.exe
  C:\Windows\System\OATzcNB.exe
  2⤵
  PID:7032
- C:\Windows\System\wKJlPmJ.exe
  C:\Windows\System\wKJlPmJ.exe
  2⤵
  PID:7120
- C:\Windows\System\lCBfkit.exe
  C:\Windows\System\lCBfkit.exe
  2⤵
  PID:7132
- C:\Windows\System\UzEcIBl.exe
  C:\Windows\System\UzEcIBl.exe
  2⤵
  PID:6152
- C:\Windows\System\ReriFyw.exe
  C:\Windows\System\ReriFyw.exe
  2⤵
  PID:7164
- C:\Windows\System\bqqfgWB.exe
  C:\Windows\System\bqqfgWB.exe
  2⤵
  PID:6184
- C:\Windows\System\iwhzsjT.exe
  C:\Windows\System\iwhzsjT.exe
  2⤵
  PID:6284
- C:\Windows\System\kUASgGp.exe
  C:\Windows\System\kUASgGp.exe
  2⤵
  PID:6344
- C:\Windows\System\FWJnTDh.exe
  C:\Windows\System\FWJnTDh.exe
  2⤵
  PID:6316
- C:\Windows\System\BjuUDtH.exe
  C:\Windows\System\BjuUDtH.exe
  2⤵
  PID:6396
- C:\Windows\System\yoDToox.exe
  C:\Windows\System\yoDToox.exe
  2⤵
  PID:6444
- C:\Windows\System\zQEveQI.exe
  C:\Windows\System\zQEveQI.exe
  2⤵
  PID:6608
- C:\Windows\System\HFbHAxv.exe
  C:\Windows\System\HFbHAxv.exe
  2⤵
  PID:6684
- C:\Windows\System\NbFxocp.exe
  C:\Windows\System\NbFxocp.exe
  2⤵
  PID:6480
- C:\Windows\System\KMAkmra.exe
  C:\Windows\System\KMAkmra.exe
  2⤵
  PID:6476
- C:\Windows\System\iZkrnNn.exe
  C:\Windows\System\iZkrnNn.exe
  2⤵
  PID:6888
- C:\Windows\System\KfQapUa.exe
  C:\Windows\System\KfQapUa.exe
  2⤵
  PID:6716
- C:\Windows\System\ViFmoEV.exe
  C:\Windows\System\ViFmoEV.exe
  2⤵
  PID:6952
- C:\Windows\System\zAgRDsT.exe
  C:\Windows\System\zAgRDsT.exe
  2⤵
  PID:6748
- C:\Windows\System\xzcGRkn.exe
  C:\Windows\System\xzcGRkn.exe
  2⤵
  PID:7016
- C:\Windows\System\oVkmCpa.exe
  C:\Windows\System\oVkmCpa.exe
  2⤵
  PID:7152
- C:\Windows\System\bAjgDVc.exe
  C:\Windows\System\bAjgDVc.exe
  2⤵
  PID:7068
- C:\Windows\System\xgzevGK.exe
  C:\Windows\System\xgzevGK.exe
  2⤵
  PID:6276
- C:\Windows\System\CFnawCw.exe
  C:\Windows\System\CFnawCw.exe
  2⤵
  PID:6296
- C:\Windows\System\CrNYSEM.exe
  C:\Windows\System\CrNYSEM.exe
  2⤵
  PID:6400
- C:\Windows\System\GlXTVbd.exe
  C:\Windows\System\GlXTVbd.exe
  2⤵
  PID:6560
- C:\Windows\System\vjquOHg.exe
  C:\Windows\System\vjquOHg.exe
  2⤵
  PID:6584
- C:\Windows\System\FoYxOlS.exe
  C:\Windows\System\FoYxOlS.exe
  2⤵
  PID:6836
- C:\Windows\System\xSKXTSQ.exe
  C:\Windows\System\xSKXTSQ.exe
  2⤵
  PID:6768
- C:\Windows\System\dgYqpXQ.exe
  C:\Windows\System\dgYqpXQ.exe
  2⤵
  PID:7000
- C:\Windows\System\EuURngm.exe
  C:\Windows\System\EuURngm.exe
  2⤵
  PID:6264
- C:\Windows\System\WWIXiUx.exe
  C:\Windows\System\WWIXiUx.exe
  2⤵
  PID:6744
- C:\Windows\System\XFxcqky.exe
  C:\Windows\System\XFxcqky.exe
  2⤵
  PID:6564
- C:\Windows\System\VMYOfxV.exe
  C:\Windows\System\VMYOfxV.exe
  2⤵
  PID:7060
- C:\Windows\System\oNOHKKn.exe
  C:\Windows\System\oNOHKKn.exe
  2⤵
  PID:6592
- C:\Windows\System\DHgPkWj.exe
  C:\Windows\System\DHgPkWj.exe
  2⤵
  PID:6964
- C:\Windows\System\eeOoCku.exe
  C:\Windows\System\eeOoCku.exe
  2⤵
  PID:6248
- C:\Windows\System\ySSdEAn.exe
  C:\Windows\System\ySSdEAn.exe
  2⤵
  PID:7084
- C:\Windows\System\hpvMwFJ.exe
  C:\Windows\System\hpvMwFJ.exe
  2⤵
  PID:7180
- C:\Windows\System\CbGxopz.exe
  C:\Windows\System\CbGxopz.exe
  2⤵
  PID:7196
- C:\Windows\System\lHqphfl.exe
  C:\Windows\System\lHqphfl.exe
  2⤵
  PID:7212
- C:\Windows\System\sxTIrLt.exe
  C:\Windows\System\sxTIrLt.exe
  2⤵
  PID:7228
- C:\Windows\System\gnKwkfU.exe
  C:\Windows\System\gnKwkfU.exe
  2⤵
  PID:7248
- C:\Windows\System\CsuUquZ.exe
  C:\Windows\System\CsuUquZ.exe
  2⤵
  PID:7264
- C:\Windows\System\lfiTbrr.exe
  C:\Windows\System\lfiTbrr.exe
  2⤵
  PID:7280
- C:\Windows\System\EPCDmLI.exe
  C:\Windows\System\EPCDmLI.exe
  2⤵
  PID:7296
- C:\Windows\System\pzyVtAR.exe
  C:\Windows\System\pzyVtAR.exe
  2⤵
  PID:7312
- C:\Windows\System\khMTIfb.exe
  C:\Windows\System\khMTIfb.exe
  2⤵
  PID:7328
- C:\Windows\System\GwjIoZW.exe
  C:\Windows\System\GwjIoZW.exe
  2⤵
  PID:7344
- C:\Windows\System\plWjevB.exe
  C:\Windows\System\plWjevB.exe
  2⤵
  PID:7360
- C:\Windows\System\fKKjutG.exe
  C:\Windows\System\fKKjutG.exe
  2⤵
  PID:7376
- C:\Windows\System\pNniyha.exe
  C:\Windows\System\pNniyha.exe
  2⤵
  PID:7392
- C:\Windows\System\uaMdvOh.exe
  C:\Windows\System\uaMdvOh.exe
  2⤵
  PID:7408
- C:\Windows\System\DumUhbd.exe
  C:\Windows\System\DumUhbd.exe
  2⤵
  PID:7428
- C:\Windows\System\gKmYJXe.exe
  C:\Windows\System\gKmYJXe.exe
  2⤵
  PID:7444
- C:\Windows\System\fEGYpXd.exe
  C:\Windows\System\fEGYpXd.exe
  2⤵
  PID:7460
- C:\Windows\System\IUCfNOR.exe
  C:\Windows\System\IUCfNOR.exe
  2⤵
  PID:7476
- C:\Windows\System\vaSLGCY.exe
  C:\Windows\System\vaSLGCY.exe
  2⤵
  PID:7492
- C:\Windows\System\UlnhYzp.exe
  C:\Windows\System\UlnhYzp.exe
  2⤵
  PID:7508
- C:\Windows\System\ElOIhyV.exe
  C:\Windows\System\ElOIhyV.exe
  2⤵
  PID:7524
- C:\Windows\System\sDuGXCO.exe
  C:\Windows\System\sDuGXCO.exe
  2⤵
  PID:7540
- C:\Windows\System\MgJGwQQ.exe
  C:\Windows\System\MgJGwQQ.exe
  2⤵
  PID:7556
- C:\Windows\System\vMbpxPW.exe
  C:\Windows\System\vMbpxPW.exe
  2⤵
  PID:7572
- C:\Windows\System\NUtfInX.exe
  C:\Windows\System\NUtfInX.exe
  2⤵
  PID:7588
- C:\Windows\System\lPHwJoB.exe
  C:\Windows\System\lPHwJoB.exe
  2⤵
  PID:7604
- C:\Windows\System\BGwxKtJ.exe
  C:\Windows\System\BGwxKtJ.exe
  2⤵
  PID:7620
- C:\Windows\System\kCvPogj.exe
  C:\Windows\System\kCvPogj.exe
  2⤵
  PID:7636
- C:\Windows\System\FutJmqC.exe
  C:\Windows\System\FutJmqC.exe
  2⤵
  PID:7652
- C:\Windows\System\SlroApn.exe
  C:\Windows\System\SlroApn.exe
  2⤵
  PID:7668
- C:\Windows\System\trFoYLm.exe
  C:\Windows\System\trFoYLm.exe
  2⤵
  PID:7684
- C:\Windows\System\uzmfgQz.exe
  C:\Windows\System\uzmfgQz.exe
  2⤵
  PID:7700
- C:\Windows\System\vrxqFAb.exe
  C:\Windows\System\vrxqFAb.exe
  2⤵
  PID:7716
- C:\Windows\System\PsXaDko.exe
  C:\Windows\System\PsXaDko.exe
  2⤵
  PID:7732
- C:\Windows\System\wBgGbEU.exe
  C:\Windows\System\wBgGbEU.exe
  2⤵
  PID:7752
- C:\Windows\System\zXMQKpI.exe
  C:\Windows\System\zXMQKpI.exe
  2⤵
  PID:7776
- C:\Windows\System\figcjVN.exe
  C:\Windows\System\figcjVN.exe
  2⤵
  PID:7796
- C:\Windows\System\qQTeMiX.exe
  C:\Windows\System\qQTeMiX.exe
  2⤵
  PID:7812
- C:\Windows\System\qQbBoAe.exe
  C:\Windows\System\qQbBoAe.exe
  2⤵
  PID:7828
- C:\Windows\System\uPUnVfq.exe
  C:\Windows\System\uPUnVfq.exe
  2⤵
  PID:7844
- C:\Windows\System\scgvadG.exe
  C:\Windows\System\scgvadG.exe
  2⤵
  PID:7860
- C:\Windows\System\nnlSnpe.exe
  C:\Windows\System\nnlSnpe.exe
  2⤵
  PID:7876
- C:\Windows\System\OEnIVlu.exe
  C:\Windows\System\OEnIVlu.exe
  2⤵
  PID:7892
- C:\Windows\System\GVOAbYZ.exe
  C:\Windows\System\GVOAbYZ.exe
  2⤵
  PID:7912
- C:\Windows\System\gcatLrv.exe
  C:\Windows\System\gcatLrv.exe
  2⤵
  PID:7928
- C:\Windows\System\xgKGvCG.exe
  C:\Windows\System\xgKGvCG.exe
  2⤵
  PID:7944
- C:\Windows\System\TuKTgYX.exe
  C:\Windows\System\TuKTgYX.exe
  2⤵
  PID:7960
- C:\Windows\System\TDwjXoo.exe
  C:\Windows\System\TDwjXoo.exe
  2⤵
  PID:7980
- C:\Windows\System\ZuteWsR.exe
  C:\Windows\System\ZuteWsR.exe
  2⤵
  PID:8000
- C:\Windows\System\qbRmvbn.exe
  C:\Windows\System\qbRmvbn.exe
  2⤵
  PID:8016
- C:\Windows\System\HSaFdwP.exe
  C:\Windows\System\HSaFdwP.exe
  2⤵
  PID:8032
- C:\Windows\System\sLWAOcO.exe
  C:\Windows\System\sLWAOcO.exe
  2⤵
  PID:8048
- C:\Windows\System\HxnouKh.exe
  C:\Windows\System\HxnouKh.exe
  2⤵
  PID:8064
- C:\Windows\System\qfpwPVO.exe
  C:\Windows\System\qfpwPVO.exe
  2⤵
  PID:8080
- C:\Windows\System\WzIVKtt.exe
  C:\Windows\System\WzIVKtt.exe
  2⤵
  PID:8096
- C:\Windows\System\JkPENYL.exe
  C:\Windows\System\JkPENYL.exe
  2⤵
  PID:8112
- C:\Windows\System\yjNnqsX.exe
  C:\Windows\System\yjNnqsX.exe
  2⤵
  PID:8128
- C:\Windows\System\YMRUjFf.exe
  C:\Windows\System\YMRUjFf.exe
  2⤵
  PID:8144
- C:\Windows\System\dRnlCWu.exe
  C:\Windows\System\dRnlCWu.exe
  2⤵
  PID:8160
- C:\Windows\System\xewzmet.exe
  C:\Windows\System\xewzmet.exe
  2⤵
  PID:8176
- C:\Windows\System\ijYPJQZ.exe
  C:\Windows\System\ijYPJQZ.exe
  2⤵
  PID:7044
- C:\Windows\System\tEAUDXQ.exe
  C:\Windows\System\tEAUDXQ.exe
  2⤵
  PID:6540
- C:\Windows\System\eDgNUnf.exe
  C:\Windows\System\eDgNUnf.exe
  2⤵
  PID:7204
- C:\Windows\System\eulUGyL.exe
  C:\Windows\System\eulUGyL.exe
  2⤵
  PID:7244
- C:\Windows\System\pLGEhRv.exe
  C:\Windows\System\pLGEhRv.exe
  2⤵
  PID:7240
- C:\Windows\System\rfpxKKj.exe
  C:\Windows\System\rfpxKKj.exe
  2⤵
  PID:7276
- C:\Windows\System\sqUXOyM.exe
  C:\Windows\System\sqUXOyM.exe
  2⤵
  PID:7320
- C:\Windows\System\mZuLQkp.exe
  C:\Windows\System\mZuLQkp.exe
  2⤵
  PID:7368
- C:\Windows\System\SgTuEOk.exe
  C:\Windows\System\SgTuEOk.exe
  2⤵
  PID:7436
- C:\Windows\System\gDCOAfA.exe
  C:\Windows\System\gDCOAfA.exe
  2⤵
  PID:7500
- C:\Windows\System\KOtweqL.exe
  C:\Windows\System\KOtweqL.exe
  2⤵
  PID:7384
- C:\Windows\System\wiVvYex.exe
  C:\Windows\System\wiVvYex.exe
  2⤵
  PID:7356
- C:\Windows\System\jqGhtbx.exe
  C:\Windows\System\jqGhtbx.exe
  2⤵
  PID:7488
- C:\Windows\System\eEgKlTF.exe
  C:\Windows\System\eEgKlTF.exe
  2⤵
  PID:7580
- C:\Windows\System\ZgkJVKf.exe
  C:\Windows\System\ZgkJVKf.exe
  2⤵
  PID:7612
- C:\Windows\System\BZXyeUa.exe
  C:\Windows\System\BZXyeUa.exe
  2⤵
  PID:7644
- C:\Windows\System\LSEkwFD.exe
  C:\Windows\System\LSEkwFD.exe
  2⤵
  PID:7692
- C:\Windows\System\odcumfI.exe
  C:\Windows\System\odcumfI.exe
  2⤵
  PID:7708
- C:\Windows\System\CwgaBTR.exe
  C:\Windows\System\CwgaBTR.exe
  2⤵
  PID:7748
- C:\Windows\System\SrseHpO.exe
  C:\Windows\System\SrseHpO.exe
  2⤵
  PID:7768
- C:\Windows\System\lHTAQTc.exe
  C:\Windows\System\lHTAQTc.exe
  2⤵
  PID:7788
- C:\Windows\System\hqrKoET.exe
  C:\Windows\System\hqrKoET.exe
  2⤵
  PID:7840
- C:\Windows\System\hhXetXi.exe
  C:\Windows\System\hhXetXi.exe
  2⤵
  PID:7904
- C:\Windows\System\WolpCeX.exe
  C:\Windows\System\WolpCeX.exe
  2⤵
  PID:7908
- C:\Windows\System\KoHYnSO.exe
  C:\Windows\System\KoHYnSO.exe
  2⤵
  PID:7976
- C:\Windows\System\hdRjLkd.exe
  C:\Windows\System\hdRjLkd.exe
  2⤵
  PID:7924
- C:\Windows\System\VlNaXSv.exe
  C:\Windows\System\VlNaXSv.exe
  2⤵
  PID:7996
- C:\Windows\System\ueofnEX.exe
  C:\Windows\System\ueofnEX.exe
  2⤵
  PID:8072
- C:\Windows\System\vITBSuI.exe
  C:\Windows\System\vITBSuI.exe
  2⤵
  PID:8168
- C:\Windows\System\lSWOhWq.exe
  C:\Windows\System\lSWOhWq.exe
  2⤵
  PID:8092
- C:\Windows\System\EVYbNkj.exe
  C:\Windows\System\EVYbNkj.exe
  2⤵
  PID:7236
- C:\Windows\System\VMlnlru.exe
  C:\Windows\System\VMlnlru.exe
  2⤵
  PID:7172
- C:\Windows\System\WuRjbNw.exe
  C:\Windows\System\WuRjbNw.exe
  2⤵
  PID:8120
- C:\Windows\System\uPrhwFh.exe
  C:\Windows\System\uPrhwFh.exe
  2⤵
  PID:7224
- C:\Windows\System\AUOvTrr.exe
  C:\Windows\System\AUOvTrr.exe
  2⤵
  PID:7340
- C:\Windows\System\bqRMEoO.exe
  C:\Windows\System\bqRMEoO.exe
  2⤵
  PID:7400
- C:\Windows\System\eEONwLD.exe
  C:\Windows\System\eEONwLD.exe
  2⤵
  PID:7416
- C:\Windows\System\evQrtjg.exe
  C:\Windows\System\evQrtjg.exe
  2⤵
  PID:7352
- C:\Windows\System\ShbHQfe.exe
  C:\Windows\System\ShbHQfe.exe
  2⤵
  PID:7548
- C:\Windows\System\TJWFlag.exe
  C:\Windows\System\TJWFlag.exe
  2⤵
  PID:7616
- C:\Windows\System\AjqHeJi.exe
  C:\Windows\System\AjqHeJi.exe
  2⤵
  PID:7680
- C:\Windows\System\qeDgecG.exe
  C:\Windows\System\qeDgecG.exe
  2⤵
  PID:7676
- C:\Windows\System\BJbmWSz.exe
  C:\Windows\System\BJbmWSz.exe
  2⤵
  PID:7744
- C:\Windows\System\HWCMYei.exe
  C:\Windows\System\HWCMYei.exe
  2⤵
  PID:7804
- C:\Windows\System\OplXipo.exe
  C:\Windows\System\OplXipo.exe
  2⤵
  PID:7856
- C:\Windows\System\FAwDVwx.exe
  C:\Windows\System\FAwDVwx.exe
  2⤵
  PID:7988
- C:\Windows\System\mkqaQOO.exe
  C:\Windows\System\mkqaQOO.exe
  2⤵
  PID:7968
- C:\Windows\System\MRrLTdL.exe
  C:\Windows\System\MRrLTdL.exe
  2⤵
  PID:8056
- C:\Windows\System\wdSRZoM.exe
  C:\Windows\System\wdSRZoM.exe
  2⤵
  PID:8136
- C:\Windows\System\tHsadeo.exe
  C:\Windows\System\tHsadeo.exe
  2⤵
  PID:8188
- C:\Windows\System\MsMospT.exe
  C:\Windows\System\MsMospT.exe
  2⤵
  PID:8028
- C:\Windows\System\hCuqWxi.exe
  C:\Windows\System\hCuqWxi.exe
  2⤵
  PID:7288
- C:\Windows\System\jbyqyah.exe
  C:\Windows\System\jbyqyah.exe
  2⤵
  PID:7424
- C:\Windows\System\YIHOLdH.exe
  C:\Windows\System\YIHOLdH.exe
  2⤵
  PID:7568
- C:\Windows\System\GQVZmLY.exe
  C:\Windows\System\GQVZmLY.exe
  2⤵
  PID:7552
- C:\Windows\System\ASiXUPc.exe
  C:\Windows\System\ASiXUPc.exe
  2⤵
  PID:7664
- C:\Windows\System\Rbhwiac.exe
  C:\Windows\System\Rbhwiac.exe
  2⤵
  PID:7872
- C:\Windows\System\VuEWvRS.exe
  C:\Windows\System\VuEWvRS.exe
  2⤵
  PID:6492
- C:\Windows\System\gOFnuaK.exe
  C:\Windows\System\gOFnuaK.exe
  2⤵
  PID:7292
- C:\Windows\System\KDHZTOM.exe
  C:\Windows\System\KDHZTOM.exe
  2⤵
  PID:8104
- C:\Windows\System\BzhjaEa.exe
  C:\Windows\System\BzhjaEa.exe
  2⤵
  PID:7952
- C:\Windows\System\GkyeLPr.exe
  C:\Windows\System\GkyeLPr.exe
  2⤵
  PID:8040
- C:\Windows\System\YNjjmrx.exe
  C:\Windows\System\YNjjmrx.exe
  2⤵
  PID:7536
- C:\Windows\System\zZPTgYq.exe
  C:\Windows\System\zZPTgYq.exe
  2⤵
  PID:7712
- C:\Windows\System\CbbMuZf.exe
  C:\Windows\System\CbbMuZf.exe
  2⤵
  PID:8184
- C:\Windows\System\vxPEVjt.exe
  C:\Windows\System\vxPEVjt.exe
  2⤵
  PID:7836
- C:\Windows\System\vQkSqPM.exe
  C:\Windows\System\vQkSqPM.exe
  2⤵
  PID:8200
- C:\Windows\System\PDlPHFt.exe
  C:\Windows\System\PDlPHFt.exe
  2⤵
  PID:8216
- C:\Windows\System\PZzPMdw.exe
  C:\Windows\System\PZzPMdw.exe
  2⤵
  PID:8232
- C:\Windows\System\WAvfStY.exe
  C:\Windows\System\WAvfStY.exe
  2⤵
  PID:8248
- C:\Windows\System\QCphxBa.exe
  C:\Windows\System\QCphxBa.exe
  2⤵
  PID:8268
- C:\Windows\System\YzShaCp.exe
  C:\Windows\System\YzShaCp.exe
  2⤵
  PID:8284
- C:\Windows\System\UoKOthA.exe
  C:\Windows\System\UoKOthA.exe
  2⤵
  PID:8300
- C:\Windows\System\zduIKPY.exe
  C:\Windows\System\zduIKPY.exe
  2⤵
  PID:8316
- C:\Windows\System\mOWDqHK.exe
  C:\Windows\System\mOWDqHK.exe
  2⤵
  PID:8332
- C:\Windows\System\TKenuqp.exe
  C:\Windows\System\TKenuqp.exe
  2⤵
  PID:8352
- C:\Windows\System\fTJeAYi.exe
  C:\Windows\System\fTJeAYi.exe
  2⤵
  PID:8368
- C:\Windows\System\iFmemXF.exe
  C:\Windows\System\iFmemXF.exe
  2⤵
  PID:8384
- C:\Windows\System\RqDDsab.exe
  C:\Windows\System\RqDDsab.exe
  2⤵
  PID:8400
- C:\Windows\System\LSsFjMI.exe
  C:\Windows\System\LSsFjMI.exe
  2⤵
  PID:8416
- C:\Windows\System\yrUktjj.exe
  C:\Windows\System\yrUktjj.exe
  2⤵
  PID:8432
- C:\Windows\System\yuEcnAy.exe
  C:\Windows\System\yuEcnAy.exe
  2⤵
  PID:8448
- C:\Windows\System\xCVatyZ.exe
  C:\Windows\System\xCVatyZ.exe
  2⤵
  PID:8464
- C:\Windows\System\JFHiEhS.exe
  C:\Windows\System\JFHiEhS.exe
  2⤵
  PID:8480
- C:\Windows\System\KxhgQsB.exe
  C:\Windows\System\KxhgQsB.exe
  2⤵
  PID:8496
- C:\Windows\System\UlODxZI.exe
  C:\Windows\System\UlODxZI.exe
  2⤵
  PID:8512
- C:\Windows\System\arMJNmy.exe
  C:\Windows\System\arMJNmy.exe
  2⤵
  PID:8532
- C:\Windows\System\oDfpCYT.exe
  C:\Windows\System\oDfpCYT.exe
  2⤵
  PID:8548
- C:\Windows\System\xEixTuw.exe
  C:\Windows\System\xEixTuw.exe
  2⤵
  PID:8564
- C:\Windows\System\kBEoQeu.exe
  C:\Windows\System\kBEoQeu.exe
  2⤵
  PID:8580
- C:\Windows\System\wrQItiy.exe
  C:\Windows\System\wrQItiy.exe
  2⤵
  PID:8600
- C:\Windows\System\JVkDoUY.exe
  C:\Windows\System\JVkDoUY.exe
  2⤵
  PID:8616
- C:\Windows\System\YnyrdDr.exe
  C:\Windows\System\YnyrdDr.exe
  2⤵
  PID:8632
- C:\Windows\System\FaqbdiG.exe
  C:\Windows\System\FaqbdiG.exe
  2⤵
  PID:8648
- C:\Windows\System\LyQSWUL.exe
  C:\Windows\System\LyQSWUL.exe
  2⤵
  PID:8664
- C:\Windows\System\aZEOfDo.exe
  C:\Windows\System\aZEOfDo.exe
  2⤵
  PID:8680
- C:\Windows\System\lDTvaDN.exe
  C:\Windows\System\lDTvaDN.exe
  2⤵
  PID:8696
- C:\Windows\System\mzDDQpF.exe
  C:\Windows\System\mzDDQpF.exe
  2⤵
  PID:8712
- C:\Windows\System\UpVLqpk.exe
  C:\Windows\System\UpVLqpk.exe
  2⤵
  PID:8728
- C:\Windows\System\eiqoqfi.exe
  C:\Windows\System\eiqoqfi.exe
  2⤵
  PID:8744
- C:\Windows\System\snPzvqN.exe
  C:\Windows\System\snPzvqN.exe
  2⤵
  PID:8760
- C:\Windows\System\hmeNDsE.exe
  C:\Windows\System\hmeNDsE.exe
  2⤵
  PID:8776
- C:\Windows\System\qsKzien.exe
  C:\Windows\System\qsKzien.exe
  2⤵
  PID:8796
- C:\Windows\System\OiphpAz.exe
  C:\Windows\System\OiphpAz.exe
  2⤵
  PID:8812
- C:\Windows\System\OmHjIjw.exe
  C:\Windows\System\OmHjIjw.exe
  2⤵
  PID:8828
- C:\Windows\System\MGvWonf.exe
  C:\Windows\System\MGvWonf.exe
  2⤵
  PID:8844
- C:\Windows\System\JXVawvA.exe
  C:\Windows\System\JXVawvA.exe
  2⤵
  PID:8864
- C:\Windows\System\xiWOZLb.exe
  C:\Windows\System\xiWOZLb.exe
  2⤵
  PID:8880
- C:\Windows\System\OwyXnfv.exe
  C:\Windows\System\OwyXnfv.exe
  2⤵
  PID:8896
- C:\Windows\System\sBJNRts.exe
  C:\Windows\System\sBJNRts.exe
  2⤵
  PID:8916
- C:\Windows\System\uXdXMED.exe
  C:\Windows\System\uXdXMED.exe
  2⤵
  PID:8932
- C:\Windows\System\yvMdVTu.exe
  C:\Windows\System\yvMdVTu.exe
  2⤵
  PID:8948
- C:\Windows\System\xuYglbp.exe
  C:\Windows\System\xuYglbp.exe
  2⤵
  PID:8968
- C:\Windows\System\ATXlUcM.exe
  C:\Windows\System\ATXlUcM.exe
  2⤵
  PID:8988
- C:\Windows\System\qGjjTNX.exe
  C:\Windows\System\qGjjTNX.exe
  2⤵
  PID:9004
- C:\Windows\System\UejboIQ.exe
  C:\Windows\System\UejboIQ.exe
  2⤵
  PID:9028
- C:\Windows\System\ficqnhv.exe
  C:\Windows\System\ficqnhv.exe
  2⤵
  PID:9060
- C:\Windows\System\fpUsjlH.exe
  C:\Windows\System\fpUsjlH.exe
  2⤵
  PID:9080
- C:\Windows\System\hOUeYFr.exe
  C:\Windows\System\hOUeYFr.exe
  2⤵
  PID:9096
- C:\Windows\System\nPGRiyz.exe
  C:\Windows\System\nPGRiyz.exe
  2⤵
  PID:9120
- C:\Windows\System\ZZpKApE.exe
  C:\Windows\System\ZZpKApE.exe
  2⤵
  PID:9136
- C:\Windows\System\QYfehGA.exe
  C:\Windows\System\QYfehGA.exe
  2⤵
  PID:9152
- C:\Windows\System\IShFidH.exe
  C:\Windows\System\IShFidH.exe
  2⤵
  PID:9168
- C:\Windows\System\QKaoLEd.exe
  C:\Windows\System\QKaoLEd.exe
  2⤵
  PID:9184
- C:\Windows\System\XRiqgUs.exe
  C:\Windows\System\XRiqgUs.exe
  2⤵
  PID:9200
- C:\Windows\System\isiZmpX.exe
  C:\Windows\System\isiZmpX.exe
  2⤵
  PID:8044
- C:\Windows\System\OnfGXVC.exe
  C:\Windows\System\OnfGXVC.exe
  2⤵
  PID:8196
- C:\Windows\System\TjxyvZl.exe
  C:\Windows\System\TjxyvZl.exe
  2⤵
  PID:8212
- C:\Windows\System\QIsOpEI.exe
  C:\Windows\System\QIsOpEI.exe
  2⤵
  PID:8244
- C:\Windows\System\EoRnxIk.exe
  C:\Windows\System\EoRnxIk.exe
  2⤵
  PID:8312
- C:\Windows\System\quGWAnN.exe
  C:\Windows\System\quGWAnN.exe
  2⤵
  PID:8324
- C:\Windows\System\GFHbjjP.exe
  C:\Windows\System\GFHbjjP.exe
  2⤵
  PID:8376
- C:\Windows\System\hqMOUjn.exe
  C:\Windows\System\hqMOUjn.exe
  2⤵
  PID:8408
- C:\Windows\System\TGvqNSa.exe
  C:\Windows\System\TGvqNSa.exe
  2⤵
  PID:8428
- C:\Windows\System\OUawtdp.exe
  C:\Windows\System\OUawtdp.exe
  2⤵
  PID:8460
- C:\Windows\System\pLOPYkG.exe
  C:\Windows\System\pLOPYkG.exe
  2⤵
  PID:8508
- C:\Windows\System\Lpkrpyv.exe
  C:\Windows\System\Lpkrpyv.exe
  2⤵
  PID:8576
- C:\Windows\System\YTPeZsC.exe
  C:\Windows\System\YTPeZsC.exe
  2⤵
  PID:8736
- C:\Windows\System\GGtfifB.exe
  C:\Windows\System\GGtfifB.exe
  2⤵
  PID:8740
- C:\Windows\System\UvBwgdK.exe
  C:\Windows\System\UvBwgdK.exe
  2⤵
  PID:8808
- C:\Windows\System\FtUMgeE.exe
  C:\Windows\System\FtUMgeE.exe
  2⤵
  PID:8872
- C:\Windows\System\cXukmiA.exe
  C:\Windows\System\cXukmiA.exe
  2⤵
  PID:8908
- C:\Windows\System\cSacUeW.exe
  C:\Windows\System\cSacUeW.exe
  2⤵
  PID:8488
- C:\Windows\System\UxqTJMs.exe
  C:\Windows\System\UxqTJMs.exe
  2⤵
  PID:8492
- C:\Windows\System\SVpZdIQ.exe
  C:\Windows\System\SVpZdIQ.exe
  2⤵
  PID:8556
- C:\Windows\System\jeJpsGV.exe
  C:\Windows\System\jeJpsGV.exe
  2⤵
  PID:8660
- C:\Windows\System\upPLMjB.exe
  C:\Windows\System\upPLMjB.exe
  2⤵
  PID:8784
- C:\Windows\System\BDxgIse.exe
  C:\Windows\System\BDxgIse.exe
  2⤵
  PID:8824
- C:\Windows\System\eKXjaqw.exe
  C:\Windows\System\eKXjaqw.exe
  2⤵
  PID:8928
- C:\Windows\System\jBYhOVS.exe
  C:\Windows\System\jBYhOVS.exe
  2⤵
  PID:8984
- C:\Windows\System\KgBPNJQ.exe
  C:\Windows\System\KgBPNJQ.exe
  2⤵
  PID:9000
- C:\Windows\System\EzdNfsC.exe
  C:\Windows\System\EzdNfsC.exe
  2⤵
  PID:9024
- C:\Windows\System\pNDvLoN.exe
  C:\Windows\System\pNDvLoN.exe
  2⤵
  PID:9104
- C:\Windows\System\qUXRXRl.exe
  C:\Windows\System\qUXRXRl.exe
  2⤵
  PID:9044
- C:\Windows\System\wJgHCxV.exe
  C:\Windows\System\wJgHCxV.exe
  2⤵
  PID:9048
- C:\Windows\System\ClVkQWi.exe
  C:\Windows\System\ClVkQWi.exe
  2⤵
  PID:9180
- C:\Windows\System\UpxwSEU.exe
  C:\Windows\System\UpxwSEU.exe
  2⤵
  PID:9128
- C:\Windows\System\vzdZLwz.exe
  C:\Windows\System\vzdZLwz.exe
  2⤵
  PID:9160
- C:\Windows\System\tWHjfoR.exe
  C:\Windows\System\tWHjfoR.exe
  2⤵
  PID:7884
- C:\Windows\System\xYexDLc.exe
  C:\Windows\System\xYexDLc.exe
  2⤵
  PID:8224
- C:\Windows\System\WozBlMD.exe
  C:\Windows\System\WozBlMD.exe
  2⤵
  PID:8504
- C:\Windows\System\UdYoeCS.exe
  C:\Windows\System\UdYoeCS.exe
  2⤵
  PID:8444
- C:\Windows\System\xXqxLmx.exe
  C:\Windows\System\xXqxLmx.exe
  2⤵
  PID:9076
- C:\Windows\System\hGFlExn.exe
  C:\Windows\System\hGFlExn.exe
  2⤵
  PID:8296
- C:\Windows\System\JlwSEBS.exe
  C:\Windows\System\JlwSEBS.exe
  2⤵
  PID:8396
- C:\Windows\System\iqPlANb.exe
  C:\Windows\System\iqPlANb.exe
  2⤵
  PID:8708
- C:\Windows\System\GJxHRvB.exe
  C:\Windows\System\GJxHRvB.exe
  2⤵
  PID:9092
- C:\Windows\System\cabIzLQ.exe
  C:\Windows\System\cabIzLQ.exe
  2⤵
  PID:8308
- C:\Windows\System\SlNBqHJ.exe
  C:\Windows\System\SlNBqHJ.exe
  2⤵
  PID:8544
- C:\Windows\System\RVcEMaO.exe
  C:\Windows\System\RVcEMaO.exe
  2⤵
  PID:8892
- C:\Windows\System\KptjMSZ.exe
  C:\Windows\System\KptjMSZ.exe
  2⤵
  PID:8940
- C:\Windows\System\oPsOWDv.exe
  C:\Windows\System\oPsOWDv.exe
  2⤵
  PID:8624
- C:\Windows\System\KiTaeVU.exe
  C:\Windows\System\KiTaeVU.exe
  2⤵
  PID:8980
- C:\Windows\System\wjYaoeg.exe
  C:\Windows\System\wjYaoeg.exe
  2⤵
  PID:9020
- C:\Windows\System\tsHwBzP.exe
  C:\Windows\System\tsHwBzP.exe
  2⤵
  PID:8392
- C:\Windows\System\WYCfIZv.exe
  C:\Windows\System\WYCfIZv.exe
  2⤵
  PID:8996
- C:\Windows\System\vJZzNBd.exe
  C:\Windows\System\vJZzNBd.exe
  2⤵
  PID:8456
- C:\Windows\System\nDWcAir.exe
  C:\Windows\System\nDWcAir.exe
  2⤵
  PID:8904
- C:\Windows\System\FldfWYH.exe
  C:\Windows\System\FldfWYH.exe
  2⤵
  PID:8820
- C:\Windows\System\tzeZeWy.exe
  C:\Windows\System\tzeZeWy.exe
  2⤵
  PID:8772
- C:\Windows\System\TkKBppn.exe
  C:\Windows\System\TkKBppn.exe
  2⤵
  PID:9088
- C:\Windows\System\UTSfhgr.exe
  C:\Windows\System\UTSfhgr.exe
  2⤵
  PID:8228
- C:\Windows\System\vGHeMxB.exe
  C:\Windows\System\vGHeMxB.exe
  2⤵
  PID:9012
- C:\Windows\System\RrmuuuE.exe
  C:\Windows\System\RrmuuuE.exe
  2⤵
  PID:8528
- C:\Windows\System\uYPxdKH.exe
  C:\Windows\System\uYPxdKH.exe
  2⤵
  PID:8524
- C:\Windows\System\qUnXgzp.exe
  C:\Windows\System\qUnXgzp.exe
  2⤵
  PID:8644
- C:\Windows\System\gruqsUM.exe
  C:\Windows\System\gruqsUM.exe
  2⤵
  PID:8572
- C:\Windows\System\IeGIPHu.exe
  C:\Windows\System\IeGIPHu.exe
  2⤵
  PID:8088
- C:\Windows\System\JqvNvJk.exe
  C:\Windows\System\JqvNvJk.exe
  2⤵
  PID:9292
- C:\Windows\System\StMesZM.exe
  C:\Windows\System\StMesZM.exe
  2⤵
  PID:9308
- C:\Windows\System\gpqriEN.exe
  C:\Windows\System\gpqriEN.exe
  2⤵
  PID:9344
- C:\Windows\System\mAAVXkJ.exe
  C:\Windows\System\mAAVXkJ.exe
  2⤵
  PID:9364
- C:\Windows\System\bmDzEOe.exe
  C:\Windows\System\bmDzEOe.exe
  2⤵
  PID:9384
- C:\Windows\System\UyMJVVd.exe
  C:\Windows\System\UyMJVVd.exe
  2⤵
  PID:9416
- C:\Windows\System\OoySWpO.exe
  C:\Windows\System\OoySWpO.exe
  2⤵
  PID:9432
- C:\Windows\System\qAglSYt.exe
  C:\Windows\System\qAglSYt.exe
  2⤵
  PID:9448
- C:\Windows\System\yVVcmRp.exe
  C:\Windows\System\yVVcmRp.exe
  2⤵
  PID:9464
- C:\Windows\System\YMpTLBo.exe
  C:\Windows\System\YMpTLBo.exe
  2⤵
  PID:9480
- C:\Windows\System\EZjKXWf.exe
  C:\Windows\System\EZjKXWf.exe
  2⤵
  PID:9496
- C:\Windows\System\FSjBcXK.exe
  C:\Windows\System\FSjBcXK.exe
  2⤵
  PID:9512
- C:\Windows\System\vmfJYeT.exe
  C:\Windows\System\vmfJYeT.exe
  2⤵
  PID:9528
- C:\Windows\System\lXvTVVq.exe
  C:\Windows\System\lXvTVVq.exe
  2⤵
  PID:9560
- C:\Windows\System\QmGtQuA.exe
  C:\Windows\System\QmGtQuA.exe
  2⤵
  PID:9576
- C:\Windows\System\ikSykmK.exe
  C:\Windows\System\ikSykmK.exe
  2⤵
  PID:9924
- C:\Windows\System\qbfIlAl.exe
  C:\Windows\System\qbfIlAl.exe
  2⤵
  PID:10012
- C:\Windows\System\fRcjZcE.exe
  C:\Windows\System\fRcjZcE.exe
  2⤵
  PID:10040
- C:\Windows\System\TZpoebj.exe
  C:\Windows\System\TZpoebj.exe
  2⤵
  PID:10068
- C:\Windows\System\AgIVgMC.exe
  C:\Windows\System\AgIVgMC.exe
  2⤵
  PID:10088
- C:\Windows\System\TYFQRHJ.exe
  C:\Windows\System\TYFQRHJ.exe
  2⤵
  PID:10104
- C:\Windows\System\XNNdvUu.exe
  C:\Windows\System\XNNdvUu.exe
  2⤵
  PID:10120
- C:\Windows\System\oYMTJbp.exe
  C:\Windows\System\oYMTJbp.exe
  2⤵
  PID:10136
- C:\Windows\System\GCxnzBG.exe
  C:\Windows\System\GCxnzBG.exe
  2⤵
  PID:10152
- C:\Windows\System\aZSSYkt.exe
  C:\Windows\System\aZSSYkt.exe
  2⤵
  PID:10172
- C:\Windows\System\kxbyuTg.exe
  C:\Windows\System\kxbyuTg.exe
  2⤵
  PID:10192
- C:\Windows\System\SsuxrNY.exe
  C:\Windows\System\SsuxrNY.exe
  2⤵
  PID:10216
- C:\Windows\System\sHYliIi.exe
  C:\Windows\System\sHYliIi.exe
  2⤵
  PID:10236
- C:\Windows\System\KfinqMT.exe
  C:\Windows\System\KfinqMT.exe
  2⤵
  PID:9068
- C:\Windows\System\kOvNSxn.exe
  C:\Windows\System\kOvNSxn.exe
  2⤵
  PID:8888
- C:\Windows\System\QwnsuiU.exe
  C:\Windows\System\QwnsuiU.exe
  2⤵
  PID:9300
- C:\Windows\System\QNhYzLz.exe
  C:\Windows\System\QNhYzLz.exe
  2⤵
  PID:9360
- C:\Windows\System\vNoVzBr.exe
  C:\Windows\System\vNoVzBr.exe
  2⤵
  PID:8924
- C:\Windows\System\TkqUFir.exe
  C:\Windows\System\TkqUFir.exe
  2⤵
  PID:9408
- C:\Windows\System\CcPpiJh.exe
  C:\Windows\System\CcPpiJh.exe
  2⤵
  PID:9236
- C:\Windows\System\YmxwXES.exe
  C:\Windows\System\YmxwXES.exe
  2⤵
  PID:9892
- C:\Windows\System\LuhYILx.exe
  C:\Windows\System\LuhYILx.exe
  2⤵
  PID:9908
- C:\Windows\System\ibFIdcq.exe
  C:\Windows\System\ibFIdcq.exe
  2⤵
  PID:9936
- C:\Windows\System\DSuBMBW.exe
  C:\Windows\System\DSuBMBW.exe
  2⤵
  PID:9948
- C:\Windows\System\iXTXVRj.exe
  C:\Windows\System\iXTXVRj.exe
  2⤵
  PID:9976
- C:\Windows\System\OKJUyCl.exe
  C:\Windows\System\OKJUyCl.exe
  2⤵
  PID:9996
- C:\Windows\System\ALiboXX.exe
  C:\Windows\System\ALiboXX.exe
  2⤵
  PID:10032
- C:\Windows\System\GZdzRUC.exe
  C:\Windows\System\GZdzRUC.exe
  2⤵
  PID:10076
- C:\Windows\System\GodAZuO.exe
  C:\Windows\System\GodAZuO.exe
  2⤵
  PID:10080
- C:\Windows\System\HkSgDGb.exe
  C:\Windows\System\HkSgDGb.exe
  2⤵
  PID:10128
- C:\Windows\System\FWMhNCb.exe
  C:\Windows\System\FWMhNCb.exe
  2⤵
  PID:10188
- C:\Windows\System\IVkJsAT.exe
  C:\Windows\System\IVkJsAT.exe
  2⤵
  PID:10232
- C:\Windows\System\dJcESOD.exe
  C:\Windows\System\dJcESOD.exe
  2⤵
  PID:8628
- C:\Windows\System\xXYcaXY.exe
  C:\Windows\System\xXYcaXY.exe
  2⤵
  PID:8860
- C:\Windows\System\hVCsTAA.exe
  C:\Windows\System\hVCsTAA.exe
  2⤵
  PID:10200
- C:\Windows\System\SkiADyF.exe
  C:\Windows\System\SkiADyF.exe
  2⤵
  PID:9400
- C:\Windows\System\msLYjcO.exe
  C:\Windows\System\msLYjcO.exe
  2⤵
  PID:9472
- C:\Windows\System\nQohUCa.exe
  C:\Windows\System\nQohUCa.exe
  2⤵
  PID:9056
- C:\Windows\System\cMEmhob.exe
  C:\Windows\System\cMEmhob.exe
  2⤵
  PID:8856
- C:\Windows\System\WVVxTpT.exe
  C:\Windows\System\WVVxTpT.exe
  2⤵
  PID:9220
- C:\Windows\System\foyNqjk.exe
  C:\Windows\System\foyNqjk.exe
  2⤵
  PID:9380
- C:\Windows\System\qMNUIKN.exe
  C:\Windows\System\qMNUIKN.exe
  2⤵
  PID:9268
- C:\Windows\System\xWvULVK.exe
  C:\Windows\System\xWvULVK.exe
  2⤵
  PID:9324
- C:\Windows\System\MZaZkBU.exe
  C:\Windows\System\MZaZkBU.exe
  2⤵
  PID:9428
- C:\Windows\System\CCuInaD.exe
  C:\Windows\System\CCuInaD.exe
  2⤵
  PID:9524
- C:\Windows\System\HMbmiin.exe
  C:\Windows\System\HMbmiin.exe
  2⤵
  PID:9568
- C:\Windows\System\zzeHwBj.exe
  C:\Windows\System\zzeHwBj.exe
  2⤵
  PID:9596
- C:\Windows\System\pMyACsm.exe
  C:\Windows\System\pMyACsm.exe
  2⤵
  PID:9632
- C:\Windows\System\YehmaKE.exe
  C:\Windows\System\YehmaKE.exe
  2⤵
  PID:9648
- C:\Windows\System\KKUbLTm.exe
  C:\Windows\System\KKUbLTm.exe
  2⤵
  PID:9656
- C:\Windows\System\sTYsenp.exe
  C:\Windows\System\sTYsenp.exe
  2⤵
  PID:9684
- C:\Windows\System\UYapBoq.exe
  C:\Windows\System\UYapBoq.exe
  2⤵
  PID:9700
- C:\Windows\System\MzGTofY.exe
  C:\Windows\System\MzGTofY.exe
  2⤵
  PID:9724
- C:\Windows\System\ugwpNbs.exe
  C:\Windows\System\ugwpNbs.exe
  2⤵
  PID:9744
- C:\Windows\System\nvfEbzI.exe
  C:\Windows\System\nvfEbzI.exe
  2⤵
  PID:9772
- C:\Windows\System\ePdNOaA.exe
  C:\Windows\System\ePdNOaA.exe
  2⤵
  PID:9788
- C:\Windows\System\fbiQoPT.exe
  C:\Windows\System\fbiQoPT.exe
  2⤵
  PID:9804
- C:\Windows\System\hTfVMPx.exe
  C:\Windows\System\hTfVMPx.exe
  2⤵
  PID:9820
- C:\Windows\System\PnJNVfC.exe
  C:\Windows\System\PnJNVfC.exe
  2⤵
  PID:9836
- C:\Windows\System\UEBreHb.exe
  C:\Windows\System\UEBreHb.exe
  2⤵
  PID:9860
- C:\Windows\System\svzWVDk.exe
  C:\Windows\System\svzWVDk.exe
  2⤵
  PID:9888
- C:\Windows\System\UAFWCdu.exe
  C:\Windows\System\UAFWCdu.exe
  2⤵
  PID:9932
- C:\Windows\System\VarQDjY.exe
  C:\Windows\System\VarQDjY.exe
  2⤵
  PID:9972
- C:\Windows\System\rsOshnI.exe
  C:\Windows\System\rsOshnI.exe
  2⤵
  PID:10028
- C:\Windows\System\BuCfkuv.exe
  C:\Windows\System\BuCfkuv.exe
  2⤵
  PID:10112
- C:\Windows\System\PrKhLjr.exe
  C:\Windows\System\PrKhLjr.exe
  2⤵
  PID:9852
- C:\Windows\System\TPFUnMv.exe
  C:\Windows\System\TPFUnMv.exe
  2⤵
  PID:10184
- C:\Windows\System\EPAsgMh.exe
  C:\Windows\System\EPAsgMh.exe
  2⤵
  PID:10204
- C:\Windows\System\TBtChqz.exe
  C:\Windows\System\TBtChqz.exe
  2⤵
  PID:9252
- C:\Windows\System\JHOoPum.exe
  C:\Windows\System\JHOoPum.exe
  2⤵
  PID:9444
- C:\Windows\System\CeiizTS.exe
  C:\Windows\System\CeiizTS.exe
  2⤵
  PID:9340
- C:\Windows\System\XhbPWVd.exe
  C:\Windows\System\XhbPWVd.exe
  2⤵
  PID:9544
- C:\Windows\System\YpbcRlr.exe
  C:\Windows\System\YpbcRlr.exe
  2⤵
  PID:9552
- C:\Windows\System\sPUhYTo.exe
  C:\Windows\System\sPUhYTo.exe
  2⤵
  PID:9336
- C:\Windows\System\eSVLyMu.exe
  C:\Windows\System\eSVLyMu.exe
  2⤵
  PID:9588
- C:\Windows\System\EKoPmFz.exe
  C:\Windows\System\EKoPmFz.exe
  2⤵
  PID:9572
- C:\Windows\System\DpugxlI.exe
  C:\Windows\System\DpugxlI.exe
  2⤵
  PID:9624
- C:\Windows\System\hJTVcgt.exe
  C:\Windows\System\hJTVcgt.exe
  2⤵
  PID:9660
- C:\Windows\System\FaWFXxq.exe
  C:\Windows\System\FaWFXxq.exe
  2⤵
  PID:9692
- C:\Windows\System\uAoLtiY.exe
  C:\Windows\System\uAoLtiY.exe
  2⤵
  PID:9708
- C:\Windows\System\AmHUmrV.exe
  C:\Windows\System\AmHUmrV.exe
  2⤵
  PID:9756
- C:\Windows\System\JUPFVjo.exe
  C:\Windows\System\JUPFVjo.exe
  2⤵
  PID:9800
- C:\Windows\System\PSFBCBU.exe
  C:\Windows\System\PSFBCBU.exe
  2⤵
  PID:9832
- C:\Windows\System\ipcGyHP.exe
  C:\Windows\System\ipcGyHP.exe
  2⤵
  PID:9848
- C:\Windows\System\irkGBOK.exe
  C:\Windows\System\irkGBOK.exe
  2⤵
  PID:9904
- C:\Windows\System\VctZRxP.exe
  C:\Windows\System\VctZRxP.exe
  2⤵
  PID:9956
- C:\Windows\System\vidoZKd.exe
  C:\Windows\System\vidoZKd.exe
  2⤵
  PID:10000
- C:\Windows\System\PVziUjj.exe
  C:\Windows\System\PVziUjj.exe
  2⤵
  PID:10168
- C:\Windows\System\rpyjxwz.exe
  C:\Windows\System\rpyjxwz.exe
  2⤵
  PID:9356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZnfOdD.exe

Filesize
1.2MB

MD5
02df504e3d3956f2767f604dff24e955

SHA1
f8e41a995cf8805ddf86e32521a73ef75d11420d

SHA256
5e0695129287584b355f9c2777bb82ab033d28054b489384c56f0b85893d0efd

SHA512
6cd7a417e3871ae6c09806d1ec65e2c5daec7cdc5d30739fca738e2275aa82b4658195a7c56de154a3b492875ba9bc8badc6e0f68da531c9cee500de480d17d5

Download Submit
C:\Windows\system\EFjxZBJ.exe

Filesize
1.2MB

MD5
504cd8a9bc6acca736eed91484a12aea

SHA1
a32f8071596c20ce72fb838313b27b0784f0ad01

SHA256
e6a3e8b832ddd72d0b2596f95a425ead054e7b63262fa425c5131d647dfc4e7e

SHA512
dba51e363bf95897b96673f814b2812e67fa8c14b7660761f3cff5c44c89a89832b285403588cc88646bc8cac114eb36d38a36f14105f97e8c088c43f6be0f5c

Download Submit
C:\Windows\system\FjtLYmz.exe

Filesize
1.2MB

MD5
04d296383a2b16d62785bfe32d177ffd

SHA1
7e43f62091c76919f637f8141fa89ad94a9a5351

SHA256
1307d270b5a9eb0d444b86a80e2b3af33db2a18199e3e4304b1a349eba12b835

SHA512
6f5ea4c27d3538dcd4043f66ee89bca10d09884b74c861a5a66c7e9f6c1c97fde5caf43fb8fd1c214f88b9f13fd25b1696a12c0afedf4e72c8ae80a64f9b9ef4

Download Submit
C:\Windows\system\JFLUDNK.exe

Filesize
1.2MB

MD5
a8e95cbb90129bad260e3527e454db0f

SHA1
708eb184fa576a4f49b178b47b56e2833ca3ff03

SHA256
d0fa869880948c01627d348e51c6ef60d42d12074f34e06b4a8aace0234c9a16

SHA512
a10caf79e81ae64f65f3f8fde9115e1c1c85dd815c7f7f8a6c0eff8216391f9ac04fe1500faf3d641a42c44e4e2e8e63f22ba36d466067b70b1a55349753a776

Download Submit
C:\Windows\system\LvxAKTg.exe

Filesize
1.2MB

MD5
4c167c06fc6e3bc56dfc2dbe7a88faac

SHA1
d62ca7c962c4ac81a50a4529195aa39b701fd0af

SHA256
e52425ed82b6f92b5ef55c64cc619deaddfcaadda10983bafbed9c752cb96422

SHA512
a521eed1637c3efb39761af2ad6a3ac7d838991540c5a745b707b057766ed260d0721492d30bfe0de4736d3bc125b91abf35139d29ab1d2ad4341ec9508c2bc4

Download Submit
C:\Windows\system\MWKyWPe.exe

Filesize
1.2MB

MD5
fc6597992e8fa6468e0b4d0f07afbb12

SHA1
7ca97ba819da131a8864aee42fe07c9fc6e60558

SHA256
8047ce08299d407144fbbc5b5beb20d61439c2d804647c5b39ae8a480707d932

SHA512
a136435cdc67661cecf149cb0ee5b709556476e0a2c8de2a524c4ea22a152bf02d68e54666e6a64e88dd72bb672f61ae8f3462e1da69956059b11d22471fc7b8

Download Submit
C:\Windows\system\OUcVqul.exe

Filesize
1.2MB

MD5
c6f82f94949cedfb2c2d85eb948f3bb1

SHA1
997c566d556220be60b4f924835ef5c906a4effa

SHA256
ab836d100d8a1f7fc7b6a95e032f920d59cdd4b7a67fbdbadc5a7151ed096c6b

SHA512
85f4c6412fcac51fa06fc9680ef0b6c6322c2a125ac592daca5e9f6578d6dd11cb01ed85887d49380946876cf75c9d15f422efed18af102d590c3e80d621429e

Download Submit
C:\Windows\system\Ouaqdmd.exe

Filesize
1.2MB

MD5
de249cb05322f287c8de1a9b2a82dd4f

SHA1
178fc64128d4dfde3eb5aff1a4ce75c92925fca4

SHA256
5cd9abc1d6f731f6b9909f0ed260428a0d34ca1d834f3e3364947d980e25051d

SHA512
421f29f355a5c3079bd5c0901a3305c099880ea528e1160382f3b5e7552a8dd96779a8438ed4b2a67d9897b0d5fb00bbd8f6efc5c9ef555b9ef8c533eae4ca37

Download Submit
C:\Windows\system\PwBPADu.exe

Filesize
1.2MB

MD5
30ee37191d91ede53e3d8d73f8f345d0

SHA1
2944634ac4bdf0d9fb32461d9e0dd8a8694ec891

SHA256
58255b8789405b85744c7a2f97594f685dda4d7fbc738c1111e4b58e6da69b64

SHA512
f1d480c9679e01274b2b7151111cf0e06a3f61aefc06d5fec0cab1acca434973a16df0d5091c23fd4b8660ea527dd4e4dcaac4f8ded86da0dd53c94d934b451d

Download Submit
C:\Windows\system\QkJkbao.exe

Filesize
1.2MB

MD5
20073e37a78cc705ac0a360ee425d595

SHA1
92cd109708b0b6ddfbdb8e99acc300105b50b743

SHA256
868135916260c688e0c36d58965719706dc4b547725ff66f2204905ca14d9381

SHA512
8bb8c4b15dc9d644c3590202d3a8818a1620f240303173889c30ac85e74ab0f812f1966ba3f1151196e407926a00a50f6628f1f660a8cf0f6923ee222a5dd0af

Download Submit
C:\Windows\system\Qpcyopm.exe

Filesize
1.2MB

MD5
64685dd32037557a1a495ea4fd92468a

SHA1
57ee5aca093e93a2c945365c2949f7f14b89af61

SHA256
6ff39469557441b887807a1ff4f7db4fba4e838da5bce6eb51693597eeebcc77

SHA512
c703b31eb922dd4bcbb8498e6dbcf44b8151df2352303ca2991010f48b17095b3267fd8ca2ca40088306cc948a93d763f6b4fb18aa90954f498d75ecdf0bdb26

Download Submit
C:\Windows\system\QvInayy.exe

Filesize
1.2MB

MD5
786db2585ba3c0c5cef6b037f42fbab3

SHA1
d94dd5035185759a5e81f27f14f82011e7f43fa0

SHA256
6e4df76091f89b0b2845e3fc062ffd0187c2babc8141885effde2151988ae14c

SHA512
83b6b9158ddf151d1b44881e82592368b9894ca852f2b8725168e257eb00e6572315ec4d68fb6589ae958abf8afa69c0e9b0cac603ab5406d293b024e2bbbb7b

Download Submit
C:\Windows\system\YtCCSSl.exe

Filesize
1.2MB

MD5
c4293a3d19cddf5dcdc59b1a7ad1953e

SHA1
2277d240d8108d94049d45498750c40e0d4c54f4

SHA256
1178dc3d6b407cebd88cac7d29a35271d48081c79b1630bfcdc9fdf8323b34eb

SHA512
f7c8452f5d4ed6ca1eb3e43bccd0dc0fab020c5f90dbb9c0f2cd9e5a79a86afd6d5ceb7e8f987a71f4e8c3f235aa6a75e81e58907e9b78bd9cc7f7b48e90198a

Download Submit
C:\Windows\system\ZloqKfs.exe

Filesize
1.2MB

MD5
cc91d1a1034f043a470932e423184b6f

SHA1
a79aa5356084823ae3db86ec8edbb6cbc1fe6a4e

SHA256
84558dd7de6e4b0146be059d0672ceac1da1950c9aa9a00f81a9392912571cf9

SHA512
948885e7d734f83feee60c5ae24f7bcc3f0b8fda07779d8d8143ce92f6c007883d9b73f2bce2135d933410fae44753b016e00d173e7071c02e1fefad67b2f56a

Download Submit
C:\Windows\system\dWQGRcE.exe

Filesize
1.2MB

MD5
3835d9368132eab6374a54c23e5755d8

SHA1
44197f1b6838bf43d3f04a1b889b487127d390ce

SHA256
56a14dc8525676830c0497d8313b31e287c0d979c4e4d9617fd941491da78885

SHA512
37241a1f6a8c8a7a1944ab9d8c0628bc380a0d50124d69b9273894419ff6e0b5c46c4479bb0d71c20ad233619a61f623411db141be7a72edf6769576247bf399

Download Submit
C:\Windows\system\idDeJJV.exe

Filesize
1.2MB

MD5
85d050b3b0c8ca99b5eddb49ab2808a7

SHA1
75751bcb120a6e677c6b6c83fa984f44707b4b3b

SHA256
3701aaf138dbf894e704da3ec3261de0b981b63b335784c02cc7a48b3347377c

SHA512
84702e534c1089abd2d97ca2a67e04c46900af58394e5116a37662ca2259807bce259d5fe82fd18c944e98060c20e31e277cc8291110d51964f4e1d1b3d32bfd

Download Submit
C:\Windows\system\kMONSik.exe

Filesize
1.2MB

MD5
9c295d12fa3a7956ea7723343bceda49

SHA1
a1bf956ecb767446c489f1ea5be74e385688d6b3

SHA256
aca4cc73c7fe2ddea6bbfb84e586f19170bf35a35edac6caa136dfc5ae7b0ddb

SHA512
f117dbea3462c436af152df3ee829866e930b1ce062ed0abea94454539455636a8bbe91e9a86e9a87efb26466f7afc7be29a939fdd9d4ef45abbce4677e12506

Download Submit
C:\Windows\system\lEacJWb.exe

Filesize
1.2MB

MD5
b8253caaad920dad418bf0620d0e8035

SHA1
c5924d753bf97857d9885ba638349c04355e1521

SHA256
e0f3ae71274f1699c7ffeeea3054419cbecabb053a36db330afc413ac4d388a1

SHA512
d4f3884d02dec5dd79371001229d0e868546d078323cabf2b3e148728282edde7c939830dc99ab153fe8a5541331e09314fb4069c64828053af5d37b3682900f

Download Submit
C:\Windows\system\oJXqrfG.exe

Filesize
1.2MB

MD5
ec6e6cf0daa7679a0747e733c2c4f75a

SHA1
fcc91d9d70da27d91a9171d0dba9484319baa132

SHA256
d87f8ec1d1b6cff5153c59b8ab720a572bd4ad508a21458341cf041385fdd0b8

SHA512
15cc77e774084cea196fc79107e7ff5223341b8d26e8116d3ee8e5746881ae073b2d784efdbe25873956fda290ac312742bd5cfadea47dd524af5a8cce18a331

Download Submit
C:\Windows\system\ohjDiiP.exe

Filesize
1.2MB

MD5
b2514ee642113e354fb7b973f739a8c3

SHA1
5173bcaa44af9d8cec6b902f92ca5bdf4b27db9d

SHA256
6fdf6982c5692cab0256bc20f5bed3fcc253a5d8e27543dae40b54029bdb1e2c

SHA512
62a4caa330227fbb6a652c4d96cf68b4a974faf5a4f1fb81ef4956393b56dc5c0dec2f63a4a7684424ac917529a5b504b9a5b274007fbce78f5f4197f8f14340

Download Submit
C:\Windows\system\qFPWgpp.exe

Filesize
1.2MB

MD5
f77acc91d3f85fc87ce958557cc466ed

SHA1
9dfefa9a9cfea6d15e1c60ce31e24dd47d3956d0

SHA256
34ec3eba4b4c4797a9ce5c6763260ab2f351d48bd7c343cad29ccdf7c4cdbe61

SHA512
edeab477138b64d31573ab1746402de9c81e1788dfb9a684f6013499f7f89c22d4405a1b1c12ab086b1a40771c1405be37644d42326830d0b989d5e610e440c5

Download Submit
C:\Windows\system\qksRXFu.exe

Filesize
1.2MB

MD5
ddc8c8817599d4fc6412cd148ab1721c

SHA1
d03e33bfe1b33f06f7df61b115ace8509a81c0b9

SHA256
4f9140034f6fcd93077d6617f6722f22dda0dcf54f610b418dfe21b31d4571ad

SHA512
a5cb291636488619e421ff1049270e10810f58485ebc602683313149064d498e95ee6f85f18f4e83e4d187b2185fbbe98defbba768963eaf1ad45a93abc15b9e

Download Submit
C:\Windows\system\raCqEXL.exe

Filesize
1.2MB

MD5
130a26750077173d495b9c03f1d366e8

SHA1
6de8c3feb7f1627274d1bd827d85ff9a1b726598

SHA256
b58e1e029cbefdf2fd7ef81b6e07882d2a052cf03f7e30be995b5310c7d64b2a

SHA512
cb7a098248947d1b4e8b51e17dcf31b75b8c9fefc29f31c6c0c09dc3694b7be84a8a7c65024b929f570a8cbc8666c189685003eb66a655766f6480cbc9071211

Download Submit
C:\Windows\system\srjdFie.exe

Filesize
1.2MB

MD5
b9ddf70a192f1a09ebee06c6226ecff4

SHA1
35a8b81a2d4d6f96befb6f2274abe13b2dee9846

SHA256
25802f6439cf4ca46581c2b9aa557ec1987102741b50f676cca604d7d99c51da

SHA512
4872378db8c256793e4a85cb0099e9b3228cea02a3937a5a500d1415ec28f29e52e90e8b2b32693125369161fc32fa2a7aa1296e432174d886538e37384f5737

Download Submit
C:\Windows\system\tmLHSkT.exe

Filesize
1.2MB

MD5
f86ecf1aae77505723a8b03d316fe81e

SHA1
d344bc19faefe099e0baf223f83d3154333d3711

SHA256
057bb2ab05aa309e2a2325f6a19ee6d5593867cefd5e6d6e88e835924fa9cfb9

SHA512
ecc343b7e985b4fb8511cd20ef213e7d9781c2f9710d0767c7619178ab496bc93e3a9166bd086218044628ae1e587dafb62a74e60469035e69f858094c9de547

Download Submit
C:\Windows\system\uXCzrda.exe

Filesize
1.2MB

MD5
edd1ffb6dfb63091ff4fa31b6e8c1e7b

SHA1
7663edb6b09afad409ea6fb4a93ed91bd9cf4608

SHA256
6be4bc76397defba93724ebfe4b43bc1a90ce2603fba1b503a91f2fe8e5a9a36

SHA512
3b5425673d27893a661c77746e7f72629c928fb36b2f4f2694162d363eabe42c5cf5293853102818c20ef98e4f08b9fea67c6a480d65949fa7348058b149c783

Download Submit
C:\Windows\system\uyawdYH.exe

Filesize
1.2MB

MD5
70aa309c2dec010887a76f72543408b3

SHA1
2f72ffe4a78458fb26e6df182ecc228239b7696f

SHA256
070a56ec0a3d0866571a9c9ef1ba297583e7e87a42b6342bf56df180cdd733fb

SHA512
e344a8fd28d281ba94d0c769cef1f893be71d3e3a4c111c0e8c09d70830c85697415873ac77eda26472d93c160400251be1ca46b2eb69a94f1c7d85b7a7f1d35

Download Submit
C:\Windows\system\vlVlKqf.exe

Filesize
1.2MB

MD5
2d6908c8eabd3bd6965639dd271f80c3

SHA1
73ea851850c7fcaabedeb80abcc0d03996b2e699

SHA256
4a291ae304f93e2d39073da1d97e2956b7ea9555179fe54720518321bf1b9a33

SHA512
09903199a5f8a3bc7d7e9a8e4c56b8fa2f33d0d48e568bbcb9d79571519edfc7ce086a4feca9316b8fff7a4a4abc05ebb1e10c2fca14ba4f989e1f36894eb315

Download Submit
C:\Windows\system\wdTadMt.exe

Filesize
1.2MB

MD5
10b82a2f315a166ad92ea5d0e22d5d17

SHA1
555e92aad8cf80b73e8158b2f4562421fe3f112d

SHA256
6577e4ed2e54002c253dcc931f44d9ed1e717699d8b424494d7b34d461bf6de7

SHA512
0091fac0c1ee449c740ff4878d56274dc56d8988c30cb8ceeb45fe99c9da54fe286515207d3074b61c846e93c99e426c73dad2a5a191f3e5877421a147b37375

Download Submit
C:\Windows\system\zrjxxcp.exe

Filesize
1.2MB

MD5
d7387ab6282d9eaa4bccd424d62de29b

SHA1
919375cf6208ffba17aa2d1eb2e7772c7d910473

SHA256
24f783d8d2a81f8b1357ed02bf506ef183846b768d35bf53a96b8ba85ddbcd1d

SHA512
8467a6687e45642e2b5f826931cc87d4f2bc6061e84e22b582154021b12e5c82bf8fd09290671f58c7b834b0556cd62178c6b8c940efa02c9f434669ab9c1855

Download Submit
\Windows\system\DkUdYZr.exe

Filesize
1.2MB

MD5
28679de762987798419c6270c7b00c45

SHA1
630f4217b45d1b3de5ef9aa7e68ee9f873d94c59

SHA256
9304537dec626b94f7fd81896d444633bd3fe47bda98aec25ab60984eb4c9f3d

SHA512
1a29a8e04d0ea4945377dd70be16e59b942d2ddb4cf1e412c78524a20a9dea1cf9b4bb0906307625bc2f40c54981d32dd329b35a7c639d4857ad816e04eeb6ea

Download Submit
\Windows\system\cFlelgh.exe

Filesize
1.2MB

MD5
fb311f41c4f176332b78cc39d49d3dc4

SHA1
3beaf69964ecc453a919eea50930911645d9e256

SHA256
fdb86e72852da1f9749577de9e223d07c9173f05d329435575186bede296ebb4

SHA512
ebde30092a804084e57808771a269757de5c476a9e498ca5bcab4978d19aefcabb09bc26ecc1cc9fef4ed68e16a0c7dfb2f8bab8f3943a122c5ebbdae53457e1

Download Submit
memory/2348-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download