xmrig | 5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02/02/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
Size

1.9MB
MD5

4dab504dc78d4904eefc8ffbf5fdddac
SHA1

678001d25dc1e47a902d6409334c6269aa11e150
SHA256

5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0
SHA512

56949860231e60d84012c1b4362d9606eace6a7330438ab2a9fe6020de18400614002758140e1a8e9a944da4a54730398cb64e1fd8e3349b4bfb66ea73557320
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFu4/qPXSYPO:GemTLkNdfE0pZyS

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001202c-4.dat	xmrig
behavioral1/files/0x0008000000016621-7.dat	xmrig
behavioral1/files/0x0007000000016c3a-17.dat	xmrig
behavioral1/files/0x0007000000016c53-21.dat	xmrig
behavioral1/files/0x0007000000016ca5-29.dat	xmrig
behavioral1/files/0x0005000000019429-48.dat	xmrig
behavioral1/files/0x000500000001949d-64.dat	xmrig
behavioral1/files/0x00050000000194e4-81.dat	xmrig
behavioral1/files/0x00050000000195c0-100.dat	xmrig
behavioral1/files/0x00050000000195f9-109.dat	xmrig
behavioral1/files/0x0005000000019601-129.dat	xmrig
behavioral1/files/0x00050000000195ff-124.dat	xmrig
behavioral1/files/0x00050000000195fe-121.dat	xmrig
behavioral1/files/0x00050000000195fd-117.dat	xmrig
behavioral1/files/0x00050000000195fb-112.dat	xmrig
behavioral1/files/0x00050000000195f7-105.dat	xmrig
behavioral1/files/0x0005000000019581-96.dat	xmrig
behavioral1/files/0x0005000000019551-88.dat	xmrig
behavioral1/files/0x000500000001955c-92.dat	xmrig
behavioral1/files/0x00050000000194e6-84.dat	xmrig
behavioral1/files/0x00050000000194da-76.dat	xmrig
behavioral1/files/0x00050000000194d0-72.dat	xmrig
behavioral1/files/0x00050000000194c6-68.dat	xmrig
behavioral1/files/0x0005000000019490-60.dat	xmrig
behavioral1/files/0x0005000000019481-56.dat	xmrig
behavioral1/files/0x000500000001946b-52.dat	xmrig
behavioral1/files/0x000500000001941b-44.dat	xmrig
behavioral1/files/0x000500000001939c-40.dat	xmrig
behavioral1/files/0x000500000001938e-36.dat	xmrig
behavioral1/files/0x0008000000016cfd-32.dat	xmrig
behavioral1/files/0x0007000000016c5c-24.dat	xmrig
behavioral1/files/0x0008000000016af7-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2596	xJOkEXA.exe
3016	qhbnJhy.exe
1840	vnhffbi.exe
1436	weiCXKm.exe
316	iZBvKuj.exe
2768	hWXtBAi.exe
2784	BUBQPso.exe
2940	hVzfYgO.exe
2968	yyVMvJw.exe
1816	cliyazi.exe
2684	zjgXcNj.exe
2096	JNiGBVE.exe
2904	VTlnsOX.exe
2924	FiLkzZh.exe
2812	DWOnUij.exe
2788	JDiuxaJ.exe
2672	SoTsrgL.exe
2740	oCLMxMY.exe
2536	kbQXxrw.exe
2164	sFSKxvL.exe
1604	EkOZfQU.exe
1312	TzMVMTj.exe
1644	YBmHXiC.exe
3052	VdZuXyH.exe
708	czdNFKW.exe
1260	wflWMWo.exe
1904	HaVBytd.exe
1140	QSdwjoF.exe
1752	CfruuzB.exe
1712	hdGPNlx.exe
2152	rSMFALB.exe
2352	IlZVYvJ.exe
2136	tozHbUo.exe
828	ZDlTBXF.exe
2140	IKJxRqX.exe
2364	CDpwziA.exe
980	XvTpZdu.exe
2468	esLGJpe.exe
876	FGwWjFK.exe
632	rEfUgTX.exe
2568	vzAgOBv.exe
2308	UemekHS.exe
2144	RafPJsp.exe
772	olGVfKo.exe
1380	lngpYtB.exe
848	WQRYWLr.exe
1860	dflQbQJ.exe
1744	BsxsMyH.exe
1660	LnXTIGn.exe
2872	AulEiFR.exe
3032	jcCawzr.exe
1668	gqtOvBK.exe
1788	FJIAisU.exe
1508	eJrFsaA.exe
952	ycJnVXA.exe
2116	cOOQvId.exe
1804	dAtxgoD.exe
2112	bygOVqB.exe
2420	RPluVFL.exe
2504	TaycUDY.exe
1728	bAScGpY.exe
2180	oVDtZTs.exe
1724	bOCyzuE.exe
976	kBcAbIU.exe

Loads dropped DLL 64 IoCs

pid	Process
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lgPPKMa.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\kfJmtQx.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\zNDPwOP.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\bksIXOR.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\tlMzfsK.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\uPwfvNO.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\dMDGqyb.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\SpEOZos.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\BUnaOQh.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\dIkjamc.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\UHtHmBt.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\RPvcIYB.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\kLKWrRa.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\hWKyCmT.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\gZgyrCu.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\olGVfKo.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\MqbQtNz.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\VpylxYU.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\TqVTqkD.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\sJTRQex.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\anflbfB.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\IOMwbHo.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\nSVIsHq.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\TEsplRl.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ZbeyqoE.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\TxauoID.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\SxIUAET.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\WhEScsB.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\yyVMvJw.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ELSHRrz.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\MMeimhj.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ESkRWUw.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\bqoHKrH.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ZovehYu.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\zBntkFy.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\JYnWedf.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\MWjgaGb.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ljhcLuv.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\rOegLha.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\BhzOhKh.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\wCGCjox.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\EvArSlT.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\onUoExO.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\jQSvOWw.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\yvRMvNB.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\LcBCOYm.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\nrSalmN.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\pcjsYyt.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\VVAYEkw.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\eWnAHwn.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\WblAAUt.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\qmGTOyO.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\ifbcjCw.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\smOJrlu.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\CMxYQxV.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\TTEKTqP.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\DEdJLVC.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\dSoAoMG.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\XSSscpb.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\UESgXCr.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\JGkUBVh.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\dpFEwqd.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\RoeytVi.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
File created	C:\Windows\System\zLzdKOo.exe	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2596	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	31
PID 1624 wrote to memory of 2596	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	31
PID 1624 wrote to memory of 2596	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	31
PID 1624 wrote to memory of 3016	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	32
PID 1624 wrote to memory of 3016	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	32
PID 1624 wrote to memory of 3016	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	32
PID 1624 wrote to memory of 1840	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	33
PID 1624 wrote to memory of 1840	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	33
PID 1624 wrote to memory of 1840	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	33
PID 1624 wrote to memory of 1436	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	34
PID 1624 wrote to memory of 1436	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	34
PID 1624 wrote to memory of 1436	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	34
PID 1624 wrote to memory of 316	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	35
PID 1624 wrote to memory of 316	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	35
PID 1624 wrote to memory of 316	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	35
PID 1624 wrote to memory of 2768	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	36
PID 1624 wrote to memory of 2768	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	36
PID 1624 wrote to memory of 2768	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	36
PID 1624 wrote to memory of 2784	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	37
PID 1624 wrote to memory of 2784	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	37
PID 1624 wrote to memory of 2784	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	37
PID 1624 wrote to memory of 2940	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	38
PID 1624 wrote to memory of 2940	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	38
PID 1624 wrote to memory of 2940	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	38
PID 1624 wrote to memory of 2968	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	39
PID 1624 wrote to memory of 2968	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	39
PID 1624 wrote to memory of 2968	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	39
PID 1624 wrote to memory of 1816	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	40
PID 1624 wrote to memory of 1816	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	40
PID 1624 wrote to memory of 1816	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	40
PID 1624 wrote to memory of 2684	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	41
PID 1624 wrote to memory of 2684	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	41
PID 1624 wrote to memory of 2684	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	41
PID 1624 wrote to memory of 2096	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	42
PID 1624 wrote to memory of 2096	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	42
PID 1624 wrote to memory of 2096	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	42
PID 1624 wrote to memory of 2904	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	43
PID 1624 wrote to memory of 2904	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	43
PID 1624 wrote to memory of 2904	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	43
PID 1624 wrote to memory of 2924	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	44
PID 1624 wrote to memory of 2924	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	44
PID 1624 wrote to memory of 2924	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	44
PID 1624 wrote to memory of 2812	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	45
PID 1624 wrote to memory of 2812	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	45
PID 1624 wrote to memory of 2812	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	45
PID 1624 wrote to memory of 2788	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	46
PID 1624 wrote to memory of 2788	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	46
PID 1624 wrote to memory of 2788	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	46
PID 1624 wrote to memory of 2672	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	47
PID 1624 wrote to memory of 2672	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	47
PID 1624 wrote to memory of 2672	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	47
PID 1624 wrote to memory of 2740	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	48
PID 1624 wrote to memory of 2740	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	48
PID 1624 wrote to memory of 2740	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	48
PID 1624 wrote to memory of 2536	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	49
PID 1624 wrote to memory of 2536	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	49
PID 1624 wrote to memory of 2536	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	49
PID 1624 wrote to memory of 2164	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	50
PID 1624 wrote to memory of 2164	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	50
PID 1624 wrote to memory of 2164	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	50
PID 1624 wrote to memory of 1604	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	51
PID 1624 wrote to memory of 1604	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	51
PID 1624 wrote to memory of 1604	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	51
PID 1624 wrote to memory of 1312	1624	5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe	52

C:\Users\Admin\AppData\Local\Temp\5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe
"C:\Users\Admin\AppData\Local\Temp\5bbba78b7efdb0bb8205a9e0a400c690cac4fe4c1b6dee3d8e7ae85819f718a0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System\xJOkEXA.exe
  C:\Windows\System\xJOkEXA.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\qhbnJhy.exe
  C:\Windows\System\qhbnJhy.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\vnhffbi.exe
  C:\Windows\System\vnhffbi.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\weiCXKm.exe
  C:\Windows\System\weiCXKm.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\iZBvKuj.exe
  C:\Windows\System\iZBvKuj.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\hWXtBAi.exe
  C:\Windows\System\hWXtBAi.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\BUBQPso.exe
  C:\Windows\System\BUBQPso.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\hVzfYgO.exe
  C:\Windows\System\hVzfYgO.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\yyVMvJw.exe
  C:\Windows\System\yyVMvJw.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\cliyazi.exe
  C:\Windows\System\cliyazi.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\zjgXcNj.exe
  C:\Windows\System\zjgXcNj.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\JNiGBVE.exe
  C:\Windows\System\JNiGBVE.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\VTlnsOX.exe
  C:\Windows\System\VTlnsOX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\FiLkzZh.exe
  C:\Windows\System\FiLkzZh.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\DWOnUij.exe
  C:\Windows\System\DWOnUij.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JDiuxaJ.exe
  C:\Windows\System\JDiuxaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\SoTsrgL.exe
  C:\Windows\System\SoTsrgL.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\oCLMxMY.exe
  C:\Windows\System\oCLMxMY.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\kbQXxrw.exe
  C:\Windows\System\kbQXxrw.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\sFSKxvL.exe
  C:\Windows\System\sFSKxvL.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\EkOZfQU.exe
  C:\Windows\System\EkOZfQU.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\TzMVMTj.exe
  C:\Windows\System\TzMVMTj.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\YBmHXiC.exe
  C:\Windows\System\YBmHXiC.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\VdZuXyH.exe
  C:\Windows\System\VdZuXyH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\czdNFKW.exe
  C:\Windows\System\czdNFKW.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\wflWMWo.exe
  C:\Windows\System\wflWMWo.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\HaVBytd.exe
  C:\Windows\System\HaVBytd.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\QSdwjoF.exe
  C:\Windows\System\QSdwjoF.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\CfruuzB.exe
  C:\Windows\System\CfruuzB.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\hdGPNlx.exe
  C:\Windows\System\hdGPNlx.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\rSMFALB.exe
  C:\Windows\System\rSMFALB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\IlZVYvJ.exe
  C:\Windows\System\IlZVYvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\tozHbUo.exe
  C:\Windows\System\tozHbUo.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ZDlTBXF.exe
  C:\Windows\System\ZDlTBXF.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\IKJxRqX.exe
  C:\Windows\System\IKJxRqX.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\CDpwziA.exe
  C:\Windows\System\CDpwziA.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\XvTpZdu.exe
  C:\Windows\System\XvTpZdu.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\esLGJpe.exe
  C:\Windows\System\esLGJpe.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\FGwWjFK.exe
  C:\Windows\System\FGwWjFK.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\rEfUgTX.exe
  C:\Windows\System\rEfUgTX.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\vzAgOBv.exe
  C:\Windows\System\vzAgOBv.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\UemekHS.exe
  C:\Windows\System\UemekHS.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\RafPJsp.exe
  C:\Windows\System\RafPJsp.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\olGVfKo.exe
  C:\Windows\System\olGVfKo.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\lngpYtB.exe
  C:\Windows\System\lngpYtB.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\WQRYWLr.exe
  C:\Windows\System\WQRYWLr.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\dflQbQJ.exe
  C:\Windows\System\dflQbQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\BsxsMyH.exe
  C:\Windows\System\BsxsMyH.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\LnXTIGn.exe
  C:\Windows\System\LnXTIGn.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\AulEiFR.exe
  C:\Windows\System\AulEiFR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jcCawzr.exe
  C:\Windows\System\jcCawzr.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\gqtOvBK.exe
  C:\Windows\System\gqtOvBK.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\FJIAisU.exe
  C:\Windows\System\FJIAisU.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\eJrFsaA.exe
  C:\Windows\System\eJrFsaA.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ycJnVXA.exe
  C:\Windows\System\ycJnVXA.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\cOOQvId.exe
  C:\Windows\System\cOOQvId.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\dAtxgoD.exe
  C:\Windows\System\dAtxgoD.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\bygOVqB.exe
  C:\Windows\System\bygOVqB.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\RPluVFL.exe
  C:\Windows\System\RPluVFL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\TaycUDY.exe
  C:\Windows\System\TaycUDY.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\bAScGpY.exe
  C:\Windows\System\bAScGpY.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\oVDtZTs.exe
  C:\Windows\System\oVDtZTs.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\bOCyzuE.exe
  C:\Windows\System\bOCyzuE.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\kBcAbIU.exe
  C:\Windows\System\kBcAbIU.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\BWvuOgR.exe
  C:\Windows\System\BWvuOgR.exe
  2⤵
  PID:236
- C:\Windows\System\DVvMvpo.exe
  C:\Windows\System\DVvMvpo.exe
  2⤵
  PID:1944
- C:\Windows\System\ksjDcGY.exe
  C:\Windows\System\ksjDcGY.exe
  2⤵
  PID:752
- C:\Windows\System\jQSvOWw.exe
  C:\Windows\System\jQSvOWw.exe
  2⤵
  PID:1044
- C:\Windows\System\xViWQOw.exe
  C:\Windows\System\xViWQOw.exe
  2⤵
  PID:1700
- C:\Windows\System\kKdHneU.exe
  C:\Windows\System\kKdHneU.exe
  2⤵
  PID:1052
- C:\Windows\System\YChQBMM.exe
  C:\Windows\System\YChQBMM.exe
  2⤵
  PID:1580
- C:\Windows\System\pRKlKQJ.exe
  C:\Windows\System\pRKlKQJ.exe
  2⤵
  PID:2312
- C:\Windows\System\BcbGamA.exe
  C:\Windows\System\BcbGamA.exe
  2⤵
  PID:1864
- C:\Windows\System\jYhLZIU.exe
  C:\Windows\System\jYhLZIU.exe
  2⤵
  PID:2444
- C:\Windows\System\JAdIWLx.exe
  C:\Windows\System\JAdIWLx.exe
  2⤵
  PID:2632
- C:\Windows\System\ykgcqNY.exe
  C:\Windows\System\ykgcqNY.exe
  2⤵
  PID:2804
- C:\Windows\System\wjnLSQL.exe
  C:\Windows\System\wjnLSQL.exe
  2⤵
  PID:2828
- C:\Windows\System\xKillNE.exe
  C:\Windows\System\xKillNE.exe
  2⤵
  PID:2836
- C:\Windows\System\mSpgKsr.exe
  C:\Windows\System\mSpgKsr.exe
  2⤵
  PID:2888
- C:\Windows\System\otuEljF.exe
  C:\Windows\System\otuEljF.exe
  2⤵
  PID:2724
- C:\Windows\System\LCfQliq.exe
  C:\Windows\System\LCfQliq.exe
  2⤵
  PID:2720
- C:\Windows\System\QfJnSAr.exe
  C:\Windows\System\QfJnSAr.exe
  2⤵
  PID:2256
- C:\Windows\System\WzPPmhg.exe
  C:\Windows\System\WzPPmhg.exe
  2⤵
  PID:1984
- C:\Windows\System\SNoDGZR.exe
  C:\Windows\System\SNoDGZR.exe
  2⤵
  PID:1732
- C:\Windows\System\hvstWMs.exe
  C:\Windows\System\hvstWMs.exe
  2⤵
  PID:2736
- C:\Windows\System\jYqgZaQ.exe
  C:\Windows\System\jYqgZaQ.exe
  2⤵
  PID:1180
- C:\Windows\System\pIrQuUo.exe
  C:\Windows\System\pIrQuUo.exe
  2⤵
  PID:2216
- C:\Windows\System\VqnqDfW.exe
  C:\Windows\System\VqnqDfW.exe
  2⤵
  PID:2196
- C:\Windows\System\lXHRxIU.exe
  C:\Windows\System\lXHRxIU.exe
  2⤵
  PID:2176
- C:\Windows\System\rjSHOtU.exe
  C:\Windows\System\rjSHOtU.exe
  2⤵
  PID:2624
- C:\Windows\System\yhAhypM.exe
  C:\Windows\System\yhAhypM.exe
  2⤵
  PID:1772
- C:\Windows\System\naCZkmQ.exe
  C:\Windows\System\naCZkmQ.exe
  2⤵
  PID:572
- C:\Windows\System\BrvcyGB.exe
  C:\Windows\System\BrvcyGB.exe
  2⤵
  PID:1120
- C:\Windows\System\nLpWfbz.exe
  C:\Windows\System\nLpWfbz.exe
  2⤵
  PID:2656
- C:\Windows\System\MqbQtNz.exe
  C:\Windows\System\MqbQtNz.exe
  2⤵
  PID:668
- C:\Windows\System\KHmPCwV.exe
  C:\Windows\System\KHmPCwV.exe
  2⤵
  PID:1476
- C:\Windows\System\qUcGDEz.exe
  C:\Windows\System\qUcGDEz.exe
  2⤵
  PID:1824
- C:\Windows\System\PyDLOWe.exe
  C:\Windows\System\PyDLOWe.exe
  2⤵
  PID:1980
- C:\Windows\System\iKRaZeE.exe
  C:\Windows\System\iKRaZeE.exe
  2⤵
  PID:896
- C:\Windows\System\ZHSbwFA.exe
  C:\Windows\System\ZHSbwFA.exe
  2⤵
  PID:560
- C:\Windows\System\QBEAzPc.exe
  C:\Windows\System\QBEAzPc.exe
  2⤵
  PID:1008
- C:\Windows\System\ynaxMaO.exe
  C:\Windows\System\ynaxMaO.exe
  2⤵
  PID:1316
- C:\Windows\System\DkbJJfZ.exe
  C:\Windows\System\DkbJJfZ.exe
  2⤵
  PID:2060
- C:\Windows\System\RPlYoch.exe
  C:\Windows\System\RPlYoch.exe
  2⤵
  PID:600
- C:\Windows\System\gehhVrm.exe
  C:\Windows\System\gehhVrm.exe
  2⤵
  PID:892
- C:\Windows\System\VOdHIeR.exe
  C:\Windows\System\VOdHIeR.exe
  2⤵
  PID:2760
- C:\Windows\System\exXIHVU.exe
  C:\Windows\System\exXIHVU.exe
  2⤵
  PID:2328
- C:\Windows\System\HpevbfU.exe
  C:\Windows\System\HpevbfU.exe
  2⤵
  PID:1572
- C:\Windows\System\ZSoKhrQ.exe
  C:\Windows\System\ZSoKhrQ.exe
  2⤵
  PID:2340
- C:\Windows\System\tsTjXIj.exe
  C:\Windows\System\tsTjXIj.exe
  2⤵
  PID:2252
- C:\Windows\System\tChuqBT.exe
  C:\Windows\System\tChuqBT.exe
  2⤵
  PID:2944
- C:\Windows\System\sjZNltF.exe
  C:\Windows\System\sjZNltF.exe
  2⤵
  PID:2704
- C:\Windows\System\NnALnPM.exe
  C:\Windows\System\NnALnPM.exe
  2⤵
  PID:2696
- C:\Windows\System\tKRZdyi.exe
  C:\Windows\System\tKRZdyi.exe
  2⤵
  PID:2540
- C:\Windows\System\rTiLger.exe
  C:\Windows\System\rTiLger.exe
  2⤵
  PID:3080
- C:\Windows\System\zEHvGqq.exe
  C:\Windows\System\zEHvGqq.exe
  2⤵
  PID:3096
- C:\Windows\System\xeWoaWN.exe
  C:\Windows\System\xeWoaWN.exe
  2⤵
  PID:3112
- C:\Windows\System\PAOGSke.exe
  C:\Windows\System\PAOGSke.exe
  2⤵
  PID:3128
- C:\Windows\System\uLoTzHq.exe
  C:\Windows\System\uLoTzHq.exe
  2⤵
  PID:3144
- C:\Windows\System\RBNFdKf.exe
  C:\Windows\System\RBNFdKf.exe
  2⤵
  PID:3160
- C:\Windows\System\AAagYEi.exe
  C:\Windows\System\AAagYEi.exe
  2⤵
  PID:3176
- C:\Windows\System\xMFbTfx.exe
  C:\Windows\System\xMFbTfx.exe
  2⤵
  PID:3192
- C:\Windows\System\PLlaGfz.exe
  C:\Windows\System\PLlaGfz.exe
  2⤵
  PID:3208
- C:\Windows\System\gzrTZiH.exe
  C:\Windows\System\gzrTZiH.exe
  2⤵
  PID:3224
- C:\Windows\System\vMIfdED.exe
  C:\Windows\System\vMIfdED.exe
  2⤵
  PID:3240
- C:\Windows\System\CraeTeH.exe
  C:\Windows\System\CraeTeH.exe
  2⤵
  PID:3256
- C:\Windows\System\wFWVOAU.exe
  C:\Windows\System\wFWVOAU.exe
  2⤵
  PID:3272
- C:\Windows\System\CcxWhMx.exe
  C:\Windows\System\CcxWhMx.exe
  2⤵
  PID:3288
- C:\Windows\System\TQtWKQK.exe
  C:\Windows\System\TQtWKQK.exe
  2⤵
  PID:3304
- C:\Windows\System\jPPeiYE.exe
  C:\Windows\System\jPPeiYE.exe
  2⤵
  PID:3320
- C:\Windows\System\vLhnamo.exe
  C:\Windows\System\vLhnamo.exe
  2⤵
  PID:3336
- C:\Windows\System\rRkSdbp.exe
  C:\Windows\System\rRkSdbp.exe
  2⤵
  PID:3352
- C:\Windows\System\iTvlvGb.exe
  C:\Windows\System\iTvlvGb.exe
  2⤵
  PID:3368
- C:\Windows\System\ULaPLuC.exe
  C:\Windows\System\ULaPLuC.exe
  2⤵
  PID:3384
- C:\Windows\System\QQTRqkn.exe
  C:\Windows\System\QQTRqkn.exe
  2⤵
  PID:3400
- C:\Windows\System\pXGGNRj.exe
  C:\Windows\System\pXGGNRj.exe
  2⤵
  PID:3416
- C:\Windows\System\VvzJgpz.exe
  C:\Windows\System\VvzJgpz.exe
  2⤵
  PID:3432
- C:\Windows\System\gSkMFZw.exe
  C:\Windows\System\gSkMFZw.exe
  2⤵
  PID:3448
- C:\Windows\System\CEBcQWN.exe
  C:\Windows\System\CEBcQWN.exe
  2⤵
  PID:3464
- C:\Windows\System\vIbomvc.exe
  C:\Windows\System\vIbomvc.exe
  2⤵
  PID:3480
- C:\Windows\System\lZyiJKl.exe
  C:\Windows\System\lZyiJKl.exe
  2⤵
  PID:3496
- C:\Windows\System\jvfXaQU.exe
  C:\Windows\System\jvfXaQU.exe
  2⤵
  PID:3512
- C:\Windows\System\uXyGTkv.exe
  C:\Windows\System\uXyGTkv.exe
  2⤵
  PID:3528
- C:\Windows\System\HebQzEU.exe
  C:\Windows\System\HebQzEU.exe
  2⤵
  PID:3544
- C:\Windows\System\qwNpCat.exe
  C:\Windows\System\qwNpCat.exe
  2⤵
  PID:3560
- C:\Windows\System\gSXXblf.exe
  C:\Windows\System\gSXXblf.exe
  2⤵
  PID:3576
- C:\Windows\System\wBhWIZP.exe
  C:\Windows\System\wBhWIZP.exe
  2⤵
  PID:3592
- C:\Windows\System\JpbWnZi.exe
  C:\Windows\System\JpbWnZi.exe
  2⤵
  PID:3608
- C:\Windows\System\dRWtbJD.exe
  C:\Windows\System\dRWtbJD.exe
  2⤵
  PID:3624
- C:\Windows\System\VtOBFvw.exe
  C:\Windows\System\VtOBFvw.exe
  2⤵
  PID:3640
- C:\Windows\System\gDRcEFK.exe
  C:\Windows\System\gDRcEFK.exe
  2⤵
  PID:3656
- C:\Windows\System\JFFGdlY.exe
  C:\Windows\System\JFFGdlY.exe
  2⤵
  PID:3672
- C:\Windows\System\PfrjoxP.exe
  C:\Windows\System\PfrjoxP.exe
  2⤵
  PID:3688
- C:\Windows\System\VLUbVcN.exe
  C:\Windows\System\VLUbVcN.exe
  2⤵
  PID:3704
- C:\Windows\System\DWwFQWK.exe
  C:\Windows\System\DWwFQWK.exe
  2⤵
  PID:3720
- C:\Windows\System\HDqvFOP.exe
  C:\Windows\System\HDqvFOP.exe
  2⤵
  PID:3736
- C:\Windows\System\WmIBfNr.exe
  C:\Windows\System\WmIBfNr.exe
  2⤵
  PID:3752
- C:\Windows\System\bxzqVfC.exe
  C:\Windows\System\bxzqVfC.exe
  2⤵
  PID:3768
- C:\Windows\System\RDUQyWy.exe
  C:\Windows\System\RDUQyWy.exe
  2⤵
  PID:3784
- C:\Windows\System\kMUMwaH.exe
  C:\Windows\System\kMUMwaH.exe
  2⤵
  PID:3800
- C:\Windows\System\ogwXVot.exe
  C:\Windows\System\ogwXVot.exe
  2⤵
  PID:3816
- C:\Windows\System\JkZWgHB.exe
  C:\Windows\System\JkZWgHB.exe
  2⤵
  PID:3832
- C:\Windows\System\DBSEVGQ.exe
  C:\Windows\System\DBSEVGQ.exe
  2⤵
  PID:3848
- C:\Windows\System\xztqgyk.exe
  C:\Windows\System\xztqgyk.exe
  2⤵
  PID:3864
- C:\Windows\System\ZMqzbVI.exe
  C:\Windows\System\ZMqzbVI.exe
  2⤵
  PID:3880
- C:\Windows\System\vagBpmz.exe
  C:\Windows\System\vagBpmz.exe
  2⤵
  PID:3896
- C:\Windows\System\hzEQdrl.exe
  C:\Windows\System\hzEQdrl.exe
  2⤵
  PID:3912
- C:\Windows\System\aBHLSdx.exe
  C:\Windows\System\aBHLSdx.exe
  2⤵
  PID:3928
- C:\Windows\System\ztczTjS.exe
  C:\Windows\System\ztczTjS.exe
  2⤵
  PID:3944
- C:\Windows\System\ClwIwtn.exe
  C:\Windows\System\ClwIwtn.exe
  2⤵
  PID:3960
- C:\Windows\System\zqsxuex.exe
  C:\Windows\System\zqsxuex.exe
  2⤵
  PID:3976
- C:\Windows\System\rSBNmXE.exe
  C:\Windows\System\rSBNmXE.exe
  2⤵
  PID:3992
- C:\Windows\System\UHtHmBt.exe
  C:\Windows\System\UHtHmBt.exe
  2⤵
  PID:4008
- C:\Windows\System\tFPUIEr.exe
  C:\Windows\System\tFPUIEr.exe
  2⤵
  PID:4024
- C:\Windows\System\yZodIFu.exe
  C:\Windows\System\yZodIFu.exe
  2⤵
  PID:4040
- C:\Windows\System\aiSdjxA.exe
  C:\Windows\System\aiSdjxA.exe
  2⤵
  PID:4056
- C:\Windows\System\lTuWFPk.exe
  C:\Windows\System\lTuWFPk.exe
  2⤵
  PID:4072
- C:\Windows\System\qUpHZbe.exe
  C:\Windows\System\qUpHZbe.exe
  2⤵
  PID:4088
- C:\Windows\System\OgDghJR.exe
  C:\Windows\System\OgDghJR.exe
  2⤵
  PID:3068
- C:\Windows\System\mWMmQyW.exe
  C:\Windows\System\mWMmQyW.exe
  2⤵
  PID:856
- C:\Windows\System\hxIonRt.exe
  C:\Windows\System\hxIonRt.exe
  2⤵
  PID:1852
- C:\Windows\System\RPvcIYB.exe
  C:\Windows\System\RPvcIYB.exe
  2⤵
  PID:2192
- C:\Windows\System\LHJKUpB.exe
  C:\Windows\System\LHJKUpB.exe
  2⤵
  PID:2348
- C:\Windows\System\acSXdYU.exe
  C:\Windows\System\acSXdYU.exe
  2⤵
  PID:692
- C:\Windows\System\NAddmOY.exe
  C:\Windows\System\NAddmOY.exe
  2⤵
  PID:288
- C:\Windows\System\bAjzHwk.exe
  C:\Windows\System\bAjzHwk.exe
  2⤵
  PID:1528
- C:\Windows\System\AGNZRzR.exe
  C:\Windows\System\AGNZRzR.exe
  2⤵
  PID:1808
- C:\Windows\System\bcZsFbi.exe
  C:\Windows\System\bcZsFbi.exe
  2⤵
  PID:2496
- C:\Windows\System\SmXicsh.exe
  C:\Windows\System\SmXicsh.exe
  2⤵
  PID:1672
- C:\Windows\System\QdqSNXe.exe
  C:\Windows\System\QdqSNXe.exe
  2⤵
  PID:872
- C:\Windows\System\jpcygoc.exe
  C:\Windows\System\jpcygoc.exe
  2⤵
  PID:2436
- C:\Windows\System\DqurAAQ.exe
  C:\Windows\System\DqurAAQ.exe
  2⤵
  PID:2324
- C:\Windows\System\dLVIKnC.exe
  C:\Windows\System\dLVIKnC.exe
  2⤵
  PID:2796
- C:\Windows\System\lgnjjBa.exe
  C:\Windows\System\lgnjjBa.exe
  2⤵
  PID:3088
- C:\Windows\System\aVkSGnn.exe
  C:\Windows\System\aVkSGnn.exe
  2⤵
  PID:3120
- C:\Windows\System\scgricb.exe
  C:\Windows\System\scgricb.exe
  2⤵
  PID:3152
- C:\Windows\System\SQcQIQo.exe
  C:\Windows\System\SQcQIQo.exe
  2⤵
  PID:3184
- C:\Windows\System\aJpcfhI.exe
  C:\Windows\System\aJpcfhI.exe
  2⤵
  PID:3216
- C:\Windows\System\SbPYaxr.exe
  C:\Windows\System\SbPYaxr.exe
  2⤵
  PID:3248
- C:\Windows\System\YhyfZqa.exe
  C:\Windows\System\YhyfZqa.exe
  2⤵
  PID:3268
- C:\Windows\System\mDgGCef.exe
  C:\Windows\System\mDgGCef.exe
  2⤵
  PID:3312
- C:\Windows\System\MyiBeTG.exe
  C:\Windows\System\MyiBeTG.exe
  2⤵
  PID:3344
- C:\Windows\System\uPCFcKH.exe
  C:\Windows\System\uPCFcKH.exe
  2⤵
  PID:3376
- C:\Windows\System\mxYGstU.exe
  C:\Windows\System\mxYGstU.exe
  2⤵
  PID:3392
- C:\Windows\System\uRgVJFx.exe
  C:\Windows\System\uRgVJFx.exe
  2⤵
  PID:3440
- C:\Windows\System\JcHbSZY.exe
  C:\Windows\System\JcHbSZY.exe
  2⤵
  PID:3472
- C:\Windows\System\YNiWjHH.exe
  C:\Windows\System\YNiWjHH.exe
  2⤵
  PID:3504
- C:\Windows\System\BqzZBzF.exe
  C:\Windows\System\BqzZBzF.exe
  2⤵
  PID:3536
- C:\Windows\System\KfBkFVr.exe
  C:\Windows\System\KfBkFVr.exe
  2⤵
  PID:3568
- C:\Windows\System\ScZxWPK.exe
  C:\Windows\System\ScZxWPK.exe
  2⤵
  PID:3600
- C:\Windows\System\ItcdMEw.exe
  C:\Windows\System\ItcdMEw.exe
  2⤵
  PID:3632
- C:\Windows\System\qpFmWBI.exe
  C:\Windows\System\qpFmWBI.exe
  2⤵
  PID:3652
- C:\Windows\System\wKUghyI.exe
  C:\Windows\System\wKUghyI.exe
  2⤵
  PID:3696
- C:\Windows\System\jrYoYfU.exe
  C:\Windows\System\jrYoYfU.exe
  2⤵
  PID:3728
- C:\Windows\System\XvhtVMV.exe
  C:\Windows\System\XvhtVMV.exe
  2⤵
  PID:3744
- C:\Windows\System\HHnBvrk.exe
  C:\Windows\System\HHnBvrk.exe
  2⤵
  PID:3776
- C:\Windows\System\eYZufYZ.exe
  C:\Windows\System\eYZufYZ.exe
  2⤵
  PID:3808
- C:\Windows\System\OYKiqwt.exe
  C:\Windows\System\OYKiqwt.exe
  2⤵
  PID:3840
- C:\Windows\System\UOcEPsh.exe
  C:\Windows\System\UOcEPsh.exe
  2⤵
  PID:3888
- C:\Windows\System\gZwPYFC.exe
  C:\Windows\System\gZwPYFC.exe
  2⤵
  PID:3904
- C:\Windows\System\qLQapFA.exe
  C:\Windows\System\qLQapFA.exe
  2⤵
  PID:2268
- C:\Windows\System\ArjRKmS.exe
  C:\Windows\System\ArjRKmS.exe
  2⤵
  PID:3956
- C:\Windows\System\gtzJdNI.exe
  C:\Windows\System\gtzJdNI.exe
  2⤵
  PID:3988
- C:\Windows\System\FvxScNo.exe
  C:\Windows\System\FvxScNo.exe
  2⤵
  PID:4020
- C:\Windows\System\jZdZalc.exe
  C:\Windows\System\jZdZalc.exe
  2⤵
  PID:4052
- C:\Windows\System\tofFvjC.exe
  C:\Windows\System\tofFvjC.exe
  2⤵
  PID:4068
- C:\Windows\System\IyOojbV.exe
  C:\Windows\System\IyOojbV.exe
  2⤵
  PID:1704
- C:\Windows\System\TQiATqc.exe
  C:\Windows\System\TQiATqc.exe
  2⤵
  PID:2644
- C:\Windows\System\JTjJMdn.exe
  C:\Windows\System\JTjJMdn.exe
  2⤵
  PID:548
- C:\Windows\System\JCgcOIH.exe
  C:\Windows\System\JCgcOIH.exe
  2⤵
  PID:796
- C:\Windows\System\BuzedyB.exe
  C:\Windows\System\BuzedyB.exe
  2⤵
  PID:2452
- C:\Windows\System\SepWkmE.exe
  C:\Windows\System\SepWkmE.exe
  2⤵
  PID:1272
- C:\Windows\System\KpJPFGd.exe
  C:\Windows\System\KpJPFGd.exe
  2⤵
  PID:112
- C:\Windows\System\erzQGJK.exe
  C:\Windows\System\erzQGJK.exe
  2⤵
  PID:2728
- C:\Windows\System\eShxGYc.exe
  C:\Windows\System\eShxGYc.exe
  2⤵
  PID:3124
- C:\Windows\System\hnpORZk.exe
  C:\Windows\System\hnpORZk.exe
  2⤵
  PID:3200
- C:\Windows\System\yzlwIto.exe
  C:\Windows\System\yzlwIto.exe
  2⤵
  PID:3264
- C:\Windows\System\nviLsuE.exe
  C:\Windows\System\nviLsuE.exe
  2⤵
  PID:3316
- C:\Windows\System\wtoWmDk.exe
  C:\Windows\System\wtoWmDk.exe
  2⤵
  PID:3408
- C:\Windows\System\gDSWmty.exe
  C:\Windows\System\gDSWmty.exe
  2⤵
  PID:3456
- C:\Windows\System\hwTtmFx.exe
  C:\Windows\System\hwTtmFx.exe
  2⤵
  PID:3508
- C:\Windows\System\LxJPOtg.exe
  C:\Windows\System\LxJPOtg.exe
  2⤵
  PID:3636
- C:\Windows\System\AYPVnOh.exe
  C:\Windows\System\AYPVnOh.exe
  2⤵
  PID:3712
- C:\Windows\System\TpHLlhW.exe
  C:\Windows\System\TpHLlhW.exe
  2⤵
  PID:3812
- C:\Windows\System\ALPjhAr.exe
  C:\Windows\System\ALPjhAr.exe
  2⤵
  PID:3616
- C:\Windows\System\QDmnlfP.exe
  C:\Windows\System\QDmnlfP.exe
  2⤵
  PID:3716
- C:\Windows\System\lvByJNv.exe
  C:\Windows\System\lvByJNv.exe
  2⤵
  PID:3844
- C:\Windows\System\jxScmjX.exe
  C:\Windows\System\jxScmjX.exe
  2⤵
  PID:3908
- C:\Windows\System\zNDPwOP.exe
  C:\Windows\System\zNDPwOP.exe
  2⤵
  PID:2016
- C:\Windows\System\gPtmEip.exe
  C:\Windows\System\gPtmEip.exe
  2⤵
  PID:3972
- C:\Windows\System\sglEILO.exe
  C:\Windows\System\sglEILO.exe
  2⤵
  PID:1548
- C:\Windows\System\HLKHIHV.exe
  C:\Windows\System\HLKHIHV.exe
  2⤵
  PID:2296
- C:\Windows\System\AihRpIo.exe
  C:\Windows\System\AihRpIo.exe
  2⤵
  PID:1784
- C:\Windows\System\nARPFXF.exe
  C:\Windows\System\nARPFXF.exe
  2⤵
  PID:3220
- C:\Windows\System\aJMpNal.exe
  C:\Windows\System\aJMpNal.exe
  2⤵
  PID:3348
- C:\Windows\System\wHAMYJC.exe
  C:\Windows\System\wHAMYJC.exe
  2⤵
  PID:2620
- C:\Windows\System\dHAHVYf.exe
  C:\Windows\System\dHAHVYf.exe
  2⤵
  PID:3044
- C:\Windows\System\rckUkmO.exe
  C:\Windows\System\rckUkmO.exe
  2⤵
  PID:3680
- C:\Windows\System\gaOgyEH.exe
  C:\Windows\System\gaOgyEH.exe
  2⤵
  PID:3424
- C:\Windows\System\anflbfB.exe
  C:\Windows\System\anflbfB.exe
  2⤵
  PID:3552
- C:\Windows\System\isSehZc.exe
  C:\Windows\System\isSehZc.exe
  2⤵
  PID:4100
- C:\Windows\System\ELSHRrz.exe
  C:\Windows\System\ELSHRrz.exe
  2⤵
  PID:4116
- C:\Windows\System\cDVUqRW.exe
  C:\Windows\System\cDVUqRW.exe
  2⤵
  PID:4132
- C:\Windows\System\qojEioP.exe
  C:\Windows\System\qojEioP.exe
  2⤵
  PID:4148
- C:\Windows\System\gPkJbrC.exe
  C:\Windows\System\gPkJbrC.exe
  2⤵
  PID:4164
- C:\Windows\System\gptitZS.exe
  C:\Windows\System\gptitZS.exe
  2⤵
  PID:4180
- C:\Windows\System\dkXZRKD.exe
  C:\Windows\System\dkXZRKD.exe
  2⤵
  PID:4200
- C:\Windows\System\OinFOAc.exe
  C:\Windows\System\OinFOAc.exe
  2⤵
  PID:4216
- C:\Windows\System\xBXoWcf.exe
  C:\Windows\System\xBXoWcf.exe
  2⤵
  PID:4232
- C:\Windows\System\JGkUBVh.exe
  C:\Windows\System\JGkUBVh.exe
  2⤵
  PID:4248
- C:\Windows\System\bnTkqAA.exe
  C:\Windows\System\bnTkqAA.exe
  2⤵
  PID:4264
- C:\Windows\System\uwvtxZI.exe
  C:\Windows\System\uwvtxZI.exe
  2⤵
  PID:4280
- C:\Windows\System\fjSZMni.exe
  C:\Windows\System\fjSZMni.exe
  2⤵
  PID:4296
- C:\Windows\System\QMgoiRX.exe
  C:\Windows\System\QMgoiRX.exe
  2⤵
  PID:4312
- C:\Windows\System\AZeAtFz.exe
  C:\Windows\System\AZeAtFz.exe
  2⤵
  PID:4328
- C:\Windows\System\DqJzRea.exe
  C:\Windows\System\DqJzRea.exe
  2⤵
  PID:4344
- C:\Windows\System\fNvEAkf.exe
  C:\Windows\System\fNvEAkf.exe
  2⤵
  PID:4360
- C:\Windows\System\XthAGpR.exe
  C:\Windows\System\XthAGpR.exe
  2⤵
  PID:4376
- C:\Windows\System\sgIwVKU.exe
  C:\Windows\System\sgIwVKU.exe
  2⤵
  PID:4392
- C:\Windows\System\NbVLKTm.exe
  C:\Windows\System\NbVLKTm.exe
  2⤵
  PID:4408
- C:\Windows\System\LZerkGQ.exe
  C:\Windows\System\LZerkGQ.exe
  2⤵
  PID:4424
- C:\Windows\System\HRoKbQH.exe
  C:\Windows\System\HRoKbQH.exe
  2⤵
  PID:4440
- C:\Windows\System\cZjbXqb.exe
  C:\Windows\System\cZjbXqb.exe
  2⤵
  PID:4456
- C:\Windows\System\vUENfqS.exe
  C:\Windows\System\vUENfqS.exe
  2⤵
  PID:4472
- C:\Windows\System\aDdSgOa.exe
  C:\Windows\System\aDdSgOa.exe
  2⤵
  PID:4488
- C:\Windows\System\uyFEyfh.exe
  C:\Windows\System\uyFEyfh.exe
  2⤵
  PID:4504
- C:\Windows\System\AQsQALK.exe
  C:\Windows\System\AQsQALK.exe
  2⤵
  PID:4520
- C:\Windows\System\oJPzdYG.exe
  C:\Windows\System\oJPzdYG.exe
  2⤵
  PID:4536
- C:\Windows\System\zrZZfWr.exe
  C:\Windows\System\zrZZfWr.exe
  2⤵
  PID:4552
- C:\Windows\System\lQljTlC.exe
  C:\Windows\System\lQljTlC.exe
  2⤵
  PID:4568
- C:\Windows\System\nKzdKth.exe
  C:\Windows\System\nKzdKth.exe
  2⤵
  PID:4584
- C:\Windows\System\SNmPSkw.exe
  C:\Windows\System\SNmPSkw.exe
  2⤵
  PID:4600
- C:\Windows\System\FUMbrlH.exe
  C:\Windows\System\FUMbrlH.exe
  2⤵
  PID:4616
- C:\Windows\System\QvGnTlX.exe
  C:\Windows\System\QvGnTlX.exe
  2⤵
  PID:4632
- C:\Windows\System\GyYBYAw.exe
  C:\Windows\System\GyYBYAw.exe
  2⤵
  PID:4648
- C:\Windows\System\SpnRAhk.exe
  C:\Windows\System\SpnRAhk.exe
  2⤵
  PID:4664
- C:\Windows\System\HlwwJAd.exe
  C:\Windows\System\HlwwJAd.exe
  2⤵
  PID:4680
- C:\Windows\System\JnCpRGf.exe
  C:\Windows\System\JnCpRGf.exe
  2⤵
  PID:4696
- C:\Windows\System\dpFEwqd.exe
  C:\Windows\System\dpFEwqd.exe
  2⤵
  PID:4712
- C:\Windows\System\HArUKio.exe
  C:\Windows\System\HArUKio.exe
  2⤵
  PID:4728
- C:\Windows\System\LeCIMkh.exe
  C:\Windows\System\LeCIMkh.exe
  2⤵
  PID:4744
- C:\Windows\System\xNyXywU.exe
  C:\Windows\System\xNyXywU.exe
  2⤵
  PID:4760
- C:\Windows\System\ImfdyDC.exe
  C:\Windows\System\ImfdyDC.exe
  2⤵
  PID:4776
- C:\Windows\System\cOnhmfe.exe
  C:\Windows\System\cOnhmfe.exe
  2⤵
  PID:4792
- C:\Windows\System\HSOvfzi.exe
  C:\Windows\System\HSOvfzi.exe
  2⤵
  PID:4808
- C:\Windows\System\atRwIXf.exe
  C:\Windows\System\atRwIXf.exe
  2⤵
  PID:4824
- C:\Windows\System\VvcRaOv.exe
  C:\Windows\System\VvcRaOv.exe
  2⤵
  PID:4840
- C:\Windows\System\lJYulWq.exe
  C:\Windows\System\lJYulWq.exe
  2⤵
  PID:4856
- C:\Windows\System\esViJQH.exe
  C:\Windows\System\esViJQH.exe
  2⤵
  PID:4872
- C:\Windows\System\QMUspZO.exe
  C:\Windows\System\QMUspZO.exe
  2⤵
  PID:4888
- C:\Windows\System\AoyPJAi.exe
  C:\Windows\System\AoyPJAi.exe
  2⤵
  PID:4904
- C:\Windows\System\ShScMOY.exe
  C:\Windows\System\ShScMOY.exe
  2⤵
  PID:4920
- C:\Windows\System\WHaHBhq.exe
  C:\Windows\System\WHaHBhq.exe
  2⤵
  PID:4936
- C:\Windows\System\ANzZPtU.exe
  C:\Windows\System\ANzZPtU.exe
  2⤵
  PID:4952
- C:\Windows\System\MYMXlPN.exe
  C:\Windows\System\MYMXlPN.exe
  2⤵
  PID:4968
- C:\Windows\System\EZVAGys.exe
  C:\Windows\System\EZVAGys.exe
  2⤵
  PID:4984
- C:\Windows\System\RxMrvZO.exe
  C:\Windows\System\RxMrvZO.exe
  2⤵
  PID:5000
- C:\Windows\System\IraVNqQ.exe
  C:\Windows\System\IraVNqQ.exe
  2⤵
  PID:5016
- C:\Windows\System\TKuJCsx.exe
  C:\Windows\System\TKuJCsx.exe
  2⤵
  PID:5032
- C:\Windows\System\DadNKKZ.exe
  C:\Windows\System\DadNKKZ.exe
  2⤵
  PID:5048
- C:\Windows\System\iTcIAQA.exe
  C:\Windows\System\iTcIAQA.exe
  2⤵
  PID:5072
- C:\Windows\System\ILwQXgh.exe
  C:\Windows\System\ILwQXgh.exe
  2⤵
  PID:4036
- C:\Windows\System\NdJrYqK.exe
  C:\Windows\System\NdJrYqK.exe
  2⤵
  PID:4128
- C:\Windows\System\VWbFThz.exe
  C:\Windows\System\VWbFThz.exe
  2⤵
  PID:4256
- C:\Windows\System\xavAUPR.exe
  C:\Windows\System\xavAUPR.exe
  2⤵
  PID:4288
- C:\Windows\System\AuZITjh.exe
  C:\Windows\System\AuZITjh.exe
  2⤵
  PID:4356
- C:\Windows\System\fDVCIgq.exe
  C:\Windows\System\fDVCIgq.exe
  2⤵
  PID:4468
- C:\Windows\System\LTzMZPb.exe
  C:\Windows\System\LTzMZPb.exe
  2⤵
  PID:4452
- C:\Windows\System\bUupjiK.exe
  C:\Windows\System\bUupjiK.exe
  2⤵
  PID:4480
- C:\Windows\System\TONGEwx.exe
  C:\Windows\System\TONGEwx.exe
  2⤵
  PID:4516
- C:\Windows\System\bksIXOR.exe
  C:\Windows\System\bksIXOR.exe
  2⤵
  PID:2844
- C:\Windows\System\UUJyDPh.exe
  C:\Windows\System\UUJyDPh.exe
  2⤵
  PID:4592
- C:\Windows\System\sSGSQJD.exe
  C:\Windows\System\sSGSQJD.exe
  2⤵
  PID:4596
- C:\Windows\System\KNzbIPd.exe
  C:\Windows\System\KNzbIPd.exe
  2⤵
  PID:4628
- C:\Windows\System\nSfMQoo.exe
  C:\Windows\System\nSfMQoo.exe
  2⤵
  PID:4644
- C:\Windows\System\ahEwtRZ.exe
  C:\Windows\System\ahEwtRZ.exe
  2⤵
  PID:4672
- C:\Windows\System\NnbPGsZ.exe
  C:\Windows\System\NnbPGsZ.exe
  2⤵
  PID:4704
- C:\Windows\System\pbeWuYC.exe
  C:\Windows\System\pbeWuYC.exe
  2⤵
  PID:4756
- C:\Windows\System\TDliriF.exe
  C:\Windows\System\TDliriF.exe
  2⤵
  PID:2692
- C:\Windows\System\OsfWODs.exe
  C:\Windows\System\OsfWODs.exe
  2⤵
  PID:4788
- C:\Windows\System\sjZXcGc.exe
  C:\Windows\System\sjZXcGc.exe
  2⤵
  PID:4804
- C:\Windows\System\oYjmMKB.exe
  C:\Windows\System\oYjmMKB.exe
  2⤵
  PID:4836
- C:\Windows\System\GBBgwzq.exe
  C:\Windows\System\GBBgwzq.exe
  2⤵
  PID:2988
- C:\Windows\System\aeQmzeS.exe
  C:\Windows\System\aeQmzeS.exe
  2⤵
  PID:4884
- C:\Windows\System\gfomVPT.exe
  C:\Windows\System\gfomVPT.exe
  2⤵
  PID:4916
- C:\Windows\System\igGBCKP.exe
  C:\Windows\System\igGBCKP.exe
  2⤵
  PID:852
- C:\Windows\System\DrUxBNj.exe
  C:\Windows\System\DrUxBNj.exe
  2⤵
  PID:4964
- C:\Windows\System\azKghCt.exe
  C:\Windows\System\azKghCt.exe
  2⤵
  PID:4992
- C:\Windows\System\syKixnn.exe
  C:\Windows\System\syKixnn.exe
  2⤵
  PID:3048
- C:\Windows\System\tGtqZHw.exe
  C:\Windows\System\tGtqZHw.exe
  2⤵
  PID:1856
- C:\Windows\System\lHLhKsx.exe
  C:\Windows\System\lHLhKsx.exe
  2⤵
  PID:2532
- C:\Windows\System\fmgjDrH.exe
  C:\Windows\System\fmgjDrH.exe
  2⤵
  PID:2920
- C:\Windows\System\RNyXfNa.exe
  C:\Windows\System\RNyXfNa.exe
  2⤵
  PID:1020
- C:\Windows\System\TJoNgvj.exe
  C:\Windows\System\TJoNgvj.exe
  2⤵
  PID:2064
- C:\Windows\System\OkIVWvL.exe
  C:\Windows\System\OkIVWvL.exe
  2⤵
  PID:2156
- C:\Windows\System\KXDIjpA.exe
  C:\Windows\System\KXDIjpA.exe
  2⤵
  PID:5028
- C:\Windows\System\XrKNGNC.exe
  C:\Windows\System\XrKNGNC.exe
  2⤵
  PID:5084
- C:\Windows\System\IsGVKxs.exe
  C:\Windows\System\IsGVKxs.exe
  2⤵
  PID:5100
- C:\Windows\System\AybCmok.exe
  C:\Windows\System\AybCmok.exe
  2⤵
  PID:5056
- C:\Windows\System\QWynJsL.exe
  C:\Windows\System\QWynJsL.exe
  2⤵
  PID:4004
- C:\Windows\System\lzFXUYl.exe
  C:\Windows\System\lzFXUYl.exe
  2⤵
  PID:2240
- C:\Windows\System\oGBMVkL.exe
  C:\Windows\System\oGBMVkL.exe
  2⤵
  PID:3796
- C:\Windows\System\fSDMeVc.exe
  C:\Windows\System\fSDMeVc.exe
  2⤵
  PID:3296
- C:\Windows\System\PzUPXSt.exe
  C:\Windows\System\PzUPXSt.exe
  2⤵
  PID:3604
- C:\Windows\System\UTrgJBw.exe
  C:\Windows\System\UTrgJBw.exe
  2⤵
  PID:4080
- C:\Windows\System\VUkdgfI.exe
  C:\Windows\System\VUkdgfI.exe
  2⤵
  PID:3060
- C:\Windows\System\gjcJGLt.exe
  C:\Windows\System\gjcJGLt.exe
  2⤵
  PID:2032
- C:\Windows\System\wFLpHkE.exe
  C:\Windows\System\wFLpHkE.exe
  2⤵
  PID:3412
- C:\Windows\System\NVLKWiH.exe
  C:\Windows\System\NVLKWiH.exe
  2⤵
  PID:4240
- C:\Windows\System\szOsQLB.exe
  C:\Windows\System\szOsQLB.exe
  2⤵
  PID:4124
- C:\Windows\System\ywhxGkU.exe
  C:\Windows\System\ywhxGkU.exe
  2⤵
  PID:4304
- C:\Windows\System\wlviwOa.exe
  C:\Windows\System\wlviwOa.exe
  2⤵
  PID:1748
- C:\Windows\System\TjsBNZF.exe
  C:\Windows\System\TjsBNZF.exe
  2⤵
  PID:4196
- C:\Windows\System\mpXfgdk.exe
  C:\Windows\System\mpXfgdk.exe
  2⤵
  PID:4340
- C:\Windows\System\QKGHMmR.exe
  C:\Windows\System\QKGHMmR.exe
  2⤵
  PID:4400
- C:\Windows\System\AjnYPnr.exe
  C:\Windows\System\AjnYPnr.exe
  2⤵
  PID:4324
- C:\Windows\System\GxgECDY.exe
  C:\Windows\System\GxgECDY.exe
  2⤵
  PID:4436
- C:\Windows\System\bmSkChp.exe
  C:\Windows\System\bmSkChp.exe
  2⤵
  PID:2896
- C:\Windows\System\ePBpDwJ.exe
  C:\Windows\System\ePBpDwJ.exe
  2⤵
  PID:4512
- C:\Windows\System\ylCSInE.exe
  C:\Windows\System\ylCSInE.exe
  2⤵
  PID:4612
- C:\Windows\System\hbLdGbV.exe
  C:\Windows\System\hbLdGbV.exe
  2⤵
  PID:4500
- C:\Windows\System\ePVWYbw.exe
  C:\Windows\System\ePVWYbw.exe
  2⤵
  PID:4880
- C:\Windows\System\wjGqpwm.exe
  C:\Windows\System\wjGqpwm.exe
  2⤵
  PID:4784
- C:\Windows\System\KALhUkn.exe
  C:\Windows\System\KALhUkn.exe
  2⤵
  PID:4932
- C:\Windows\System\YbLSheh.exe
  C:\Windows\System\YbLSheh.exe
  2⤵
  PID:2132
- C:\Windows\System\pQhQWyt.exe
  C:\Windows\System\pQhQWyt.exe
  2⤵
  PID:5092
- C:\Windows\System\BbgNylX.exe
  C:\Windows\System\BbgNylX.exe
  2⤵
  PID:4496
- C:\Windows\System\CvGOGlK.exe
  C:\Windows\System\CvGOGlK.exe
  2⤵
  PID:2956
- C:\Windows\System\Tjlmsmt.exe
  C:\Windows\System\Tjlmsmt.exe
  2⤵
  PID:4996
- C:\Windows\System\wtCSMaQ.exe
  C:\Windows\System\wtCSMaQ.exe
  2⤵
  PID:4912
- C:\Windows\System\AfLhSae.exe
  C:\Windows\System\AfLhSae.exe
  2⤵
  PID:5108
- C:\Windows\System\jEkhMyY.exe
  C:\Windows\System\jEkhMyY.exe
  2⤵
  PID:4740
- C:\Windows\System\gVHbGLa.exe
  C:\Windows\System\gVHbGLa.exe
  2⤵
  PID:2300
- C:\Windows\System\QmcJFwR.exe
  C:\Windows\System\QmcJFwR.exe
  2⤵
  PID:3012
- C:\Windows\System\cKRLuQC.exe
  C:\Windows\System\cKRLuQC.exe
  2⤵
  PID:3008
- C:\Windows\System\WblAAUt.exe
  C:\Windows\System\WblAAUt.exe
  2⤵
  PID:4852
- C:\Windows\System\yvRMvNB.exe
  C:\Windows\System\yvRMvNB.exe
  2⤵
  PID:3968
- C:\Windows\System\UglwFga.exe
  C:\Windows\System\UglwFga.exe
  2⤵
  PID:2952
- C:\Windows\System\IuRtZzt.exe
  C:\Windows\System\IuRtZzt.exe
  2⤵
  PID:4848
- C:\Windows\System\mFRvvls.exe
  C:\Windows\System\mFRvvls.exe
  2⤵
  PID:2576
- C:\Windows\System\wTxbvrN.exe
  C:\Windows\System\wTxbvrN.exe
  2⤵
  PID:2752
- C:\Windows\System\hRxwMXv.exe
  C:\Windows\System\hRxwMXv.exe
  2⤵
  PID:2548
- C:\Windows\System\dTIkpMY.exe
  C:\Windows\System\dTIkpMY.exe
  2⤵
  PID:2004
- C:\Windows\System\NLgrXev.exe
  C:\Windows\System\NLgrXev.exe
  2⤵
  PID:5128
- C:\Windows\System\VAUFRFP.exe
  C:\Windows\System\VAUFRFP.exe
  2⤵
  PID:5144
- C:\Windows\System\aAYqwlS.exe
  C:\Windows\System\aAYqwlS.exe
  2⤵
  PID:5160
- C:\Windows\System\MvLOXip.exe
  C:\Windows\System\MvLOXip.exe
  2⤵
  PID:5176
- C:\Windows\System\aAiAJTU.exe
  C:\Windows\System\aAiAJTU.exe
  2⤵
  PID:5192
- C:\Windows\System\zulacOG.exe
  C:\Windows\System\zulacOG.exe
  2⤵
  PID:5208
- C:\Windows\System\ZKRPabB.exe
  C:\Windows\System\ZKRPabB.exe
  2⤵
  PID:5224
- C:\Windows\System\RvMzXpx.exe
  C:\Windows\System\RvMzXpx.exe
  2⤵
  PID:5240
- C:\Windows\System\zbiZCBV.exe
  C:\Windows\System\zbiZCBV.exe
  2⤵
  PID:5256
- C:\Windows\System\SPLGqVN.exe
  C:\Windows\System\SPLGqVN.exe
  2⤵
  PID:5272
- C:\Windows\System\GbPJMeo.exe
  C:\Windows\System\GbPJMeo.exe
  2⤵
  PID:5288
- C:\Windows\System\IOMwbHo.exe
  C:\Windows\System\IOMwbHo.exe
  2⤵
  PID:5304
- C:\Windows\System\pJSvWAJ.exe
  C:\Windows\System\pJSvWAJ.exe
  2⤵
  PID:5320
- C:\Windows\System\HkmKePN.exe
  C:\Windows\System\HkmKePN.exe
  2⤵
  PID:5336
- C:\Windows\System\xZOriVH.exe
  C:\Windows\System\xZOriVH.exe
  2⤵
  PID:5352
- C:\Windows\System\QKdFDer.exe
  C:\Windows\System\QKdFDer.exe
  2⤵
  PID:5368
- C:\Windows\System\TaTmwds.exe
  C:\Windows\System\TaTmwds.exe
  2⤵
  PID:5384
- C:\Windows\System\gawDSHr.exe
  C:\Windows\System\gawDSHr.exe
  2⤵
  PID:5400
- C:\Windows\System\leIgEPN.exe
  C:\Windows\System\leIgEPN.exe
  2⤵
  PID:5416
- C:\Windows\System\LHBUPrI.exe
  C:\Windows\System\LHBUPrI.exe
  2⤵
  PID:5432
- C:\Windows\System\mHklLjA.exe
  C:\Windows\System\mHklLjA.exe
  2⤵
  PID:5448
- C:\Windows\System\gUoIvPt.exe
  C:\Windows\System\gUoIvPt.exe
  2⤵
  PID:5464
- C:\Windows\System\FvRkmBA.exe
  C:\Windows\System\FvRkmBA.exe
  2⤵
  PID:5480
- C:\Windows\System\gycHyBy.exe
  C:\Windows\System\gycHyBy.exe
  2⤵
  PID:5496
- C:\Windows\System\UWvFaEB.exe
  C:\Windows\System\UWvFaEB.exe
  2⤵
  PID:5512
- C:\Windows\System\PjIkqaN.exe
  C:\Windows\System\PjIkqaN.exe
  2⤵
  PID:5528
- C:\Windows\System\hQdtRGB.exe
  C:\Windows\System\hQdtRGB.exe
  2⤵
  PID:5544
- C:\Windows\System\SNGvNYI.exe
  C:\Windows\System\SNGvNYI.exe
  2⤵
  PID:5560
- C:\Windows\System\rysIano.exe
  C:\Windows\System\rysIano.exe
  2⤵
  PID:5576
- C:\Windows\System\xgDiRtx.exe
  C:\Windows\System\xgDiRtx.exe
  2⤵
  PID:5592
- C:\Windows\System\iYXjsOK.exe
  C:\Windows\System\iYXjsOK.exe
  2⤵
  PID:5608
- C:\Windows\System\xcKtcqO.exe
  C:\Windows\System\xcKtcqO.exe
  2⤵
  PID:5624
- C:\Windows\System\tlMzfsK.exe
  C:\Windows\System\tlMzfsK.exe
  2⤵
  PID:5640
- C:\Windows\System\HxSTXXe.exe
  C:\Windows\System\HxSTXXe.exe
  2⤵
  PID:5656
- C:\Windows\System\MbZomov.exe
  C:\Windows\System\MbZomov.exe
  2⤵
  PID:5672
- C:\Windows\System\SEwfyDs.exe
  C:\Windows\System\SEwfyDs.exe
  2⤵
  PID:5688
- C:\Windows\System\mUfETfh.exe
  C:\Windows\System\mUfETfh.exe
  2⤵
  PID:5704
- C:\Windows\System\HsQrFsb.exe
  C:\Windows\System\HsQrFsb.exe
  2⤵
  PID:5720
- C:\Windows\System\tNkumJw.exe
  C:\Windows\System\tNkumJw.exe
  2⤵
  PID:5736
- C:\Windows\System\gUxHRiQ.exe
  C:\Windows\System\gUxHRiQ.exe
  2⤵
  PID:5752
- C:\Windows\System\NpOlkDD.exe
  C:\Windows\System\NpOlkDD.exe
  2⤵
  PID:5768
- C:\Windows\System\MMeimhj.exe
  C:\Windows\System\MMeimhj.exe
  2⤵
  PID:5784
- C:\Windows\System\NwyARjr.exe
  C:\Windows\System\NwyARjr.exe
  2⤵
  PID:5800
- C:\Windows\System\nVFtQCT.exe
  C:\Windows\System\nVFtQCT.exe
  2⤵
  PID:5816
- C:\Windows\System\nVxxUCL.exe
  C:\Windows\System\nVxxUCL.exe
  2⤵
  PID:5832
- C:\Windows\System\XkoyJnT.exe
  C:\Windows\System\XkoyJnT.exe
  2⤵
  PID:5848
- C:\Windows\System\gzFTHZs.exe
  C:\Windows\System\gzFTHZs.exe
  2⤵
  PID:5864
- C:\Windows\System\lIPOqUm.exe
  C:\Windows\System\lIPOqUm.exe
  2⤵
  PID:5880
- C:\Windows\System\bkPGkUI.exe
  C:\Windows\System\bkPGkUI.exe
  2⤵
  PID:5896
- C:\Windows\System\QjTjdSj.exe
  C:\Windows\System\QjTjdSj.exe
  2⤵
  PID:5912
- C:\Windows\System\adxaYEv.exe
  C:\Windows\System\adxaYEv.exe
  2⤵
  PID:5928
- C:\Windows\System\KVQHPum.exe
  C:\Windows\System\KVQHPum.exe
  2⤵
  PID:5944
- C:\Windows\System\GzUkhiY.exe
  C:\Windows\System\GzUkhiY.exe
  2⤵
  PID:5960
- C:\Windows\System\JnhuIfq.exe
  C:\Windows\System\JnhuIfq.exe
  2⤵
  PID:5976
- C:\Windows\System\lRXcqUg.exe
  C:\Windows\System\lRXcqUg.exe
  2⤵
  PID:5992
- C:\Windows\System\BPyGKqM.exe
  C:\Windows\System\BPyGKqM.exe
  2⤵
  PID:6008
- C:\Windows\System\puzwjHe.exe
  C:\Windows\System\puzwjHe.exe
  2⤵
  PID:6024
- C:\Windows\System\negNPLl.exe
  C:\Windows\System\negNPLl.exe
  2⤵
  PID:6040
- C:\Windows\System\LcBCOYm.exe
  C:\Windows\System\LcBCOYm.exe
  2⤵
  PID:6056
- C:\Windows\System\KOFPqMC.exe
  C:\Windows\System\KOFPqMC.exe
  2⤵
  PID:6072
- C:\Windows\System\IXOKmGl.exe
  C:\Windows\System\IXOKmGl.exe
  2⤵
  PID:6088
- C:\Windows\System\NxdoQho.exe
  C:\Windows\System\NxdoQho.exe
  2⤵
  PID:6104
- C:\Windows\System\odvqYXa.exe
  C:\Windows\System\odvqYXa.exe
  2⤵
  PID:6120
- C:\Windows\System\OSnBKya.exe
  C:\Windows\System\OSnBKya.exe
  2⤵
  PID:6136
- C:\Windows\System\maKKTgx.exe
  C:\Windows\System\maKKTgx.exe
  2⤵
  PID:2276
- C:\Windows\System\lzPDbBV.exe
  C:\Windows\System\lzPDbBV.exe
  2⤵
  PID:5140
- C:\Windows\System\JYTDQEL.exe
  C:\Windows\System\JYTDQEL.exe
  2⤵
  PID:5236
- C:\Windows\System\YpAacMZ.exe
  C:\Windows\System\YpAacMZ.exe
  2⤵
  PID:5300
- C:\Windows\System\FkdxXMg.exe
  C:\Windows\System\FkdxXMg.exe
  2⤵
  PID:5200
- C:\Windows\System\fBYAHUt.exe
  C:\Windows\System\fBYAHUt.exe
  2⤵
  PID:5428
- C:\Windows\System\fmHpHSJ.exe
  C:\Windows\System\fmHpHSJ.exe
  2⤵
  PID:5460
- C:\Windows\System\iuABWlx.exe
  C:\Windows\System\iuABWlx.exe
  2⤵
  PID:5552
- C:\Windows\System\kzNfyOQ.exe
  C:\Windows\System\kzNfyOQ.exe
  2⤵
  PID:5112
- C:\Windows\System\nqoJprG.exe
  C:\Windows\System\nqoJprG.exe
  2⤵
  PID:4176
- C:\Windows\System\TInCdbn.exe
  C:\Windows\System\TInCdbn.exe
  2⤵
  PID:5620
- C:\Windows\System\fDgMbRz.exe
  C:\Windows\System\fDgMbRz.exe
  2⤵
  PID:5712
- C:\Windows\System\THUrWca.exe
  C:\Windows\System\THUrWca.exe
  2⤵
  PID:5776
- C:\Windows\System\XMozAjd.exe
  C:\Windows\System\XMozAjd.exe
  2⤵
  PID:5840
- C:\Windows\System\ukxRuNk.exe
  C:\Windows\System\ukxRuNk.exe
  2⤵
  PID:5876
- C:\Windows\System\JZqIKSh.exe
  C:\Windows\System\JZqIKSh.exe
  2⤵
  PID:5936
- C:\Windows\System\BxpeLPh.exe
  C:\Windows\System\BxpeLPh.exe
  2⤵
  PID:6032
- C:\Windows\System\ViioUgK.exe
  C:\Windows\System\ViioUgK.exe
  2⤵
  PID:5972
- C:\Windows\System\fUsoOIC.exe
  C:\Windows\System\fUsoOIC.exe
  2⤵
  PID:6132
- C:\Windows\System\fxsAcIY.exe
  C:\Windows\System\fxsAcIY.exe
  2⤵
  PID:5296
- C:\Windows\System\HmnSCkG.exe
  C:\Windows\System\HmnSCkG.exe
  2⤵
  PID:5504
- C:\Windows\System\ovFuQMV.exe
  C:\Windows\System\ovFuQMV.exe
  2⤵
  PID:1720
- C:\Windows\System\JfgTFIs.exe
  C:\Windows\System\JfgTFIs.exe
  2⤵
  PID:5424
- C:\Windows\System\MMxZGxx.exe
  C:\Windows\System\MMxZGxx.exe
  2⤵
  PID:5680
- C:\Windows\System\mNQLRJy.exe
  C:\Windows\System\mNQLRJy.exe
  2⤵
  PID:6156
- C:\Windows\System\uBBLNcZ.exe
  C:\Windows\System\uBBLNcZ.exe
  2⤵
  PID:6172
- C:\Windows\System\LwMCqeW.exe
  C:\Windows\System\LwMCqeW.exe
  2⤵
  PID:6188
- C:\Windows\System\wgnqLhX.exe
  C:\Windows\System\wgnqLhX.exe
  2⤵
  PID:6204
- C:\Windows\System\dVtTpyP.exe
  C:\Windows\System\dVtTpyP.exe
  2⤵
  PID:6220
- C:\Windows\System\irEwneC.exe
  C:\Windows\System\irEwneC.exe
  2⤵
  PID:6236
- C:\Windows\System\isfHuHQ.exe
  C:\Windows\System\isfHuHQ.exe
  2⤵
  PID:6252
- C:\Windows\System\gOHQOYP.exe
  C:\Windows\System\gOHQOYP.exe
  2⤵
  PID:6268
- C:\Windows\System\CPkXIdr.exe
  C:\Windows\System\CPkXIdr.exe
  2⤵
  PID:6284
- C:\Windows\System\uGFpqtk.exe
  C:\Windows\System\uGFpqtk.exe
  2⤵
  PID:6300
- C:\Windows\System\IytGPde.exe
  C:\Windows\System\IytGPde.exe
  2⤵
  PID:6316
- C:\Windows\System\MvUKXCv.exe
  C:\Windows\System\MvUKXCv.exe
  2⤵
  PID:6332
- C:\Windows\System\aQsXFpM.exe
  C:\Windows\System\aQsXFpM.exe
  2⤵
  PID:6348
- C:\Windows\System\doWknfP.exe
  C:\Windows\System\doWknfP.exe
  2⤵
  PID:6364
- C:\Windows\System\aaeUgWB.exe
  C:\Windows\System\aaeUgWB.exe
  2⤵
  PID:6380
- C:\Windows\System\lMhFpBC.exe
  C:\Windows\System\lMhFpBC.exe
  2⤵
  PID:6396
- C:\Windows\System\FiHroOn.exe
  C:\Windows\System\FiHroOn.exe
  2⤵
  PID:6412
- C:\Windows\System\rPRXrQT.exe
  C:\Windows\System\rPRXrQT.exe
  2⤵
  PID:6428
- C:\Windows\System\BKSjmyr.exe
  C:\Windows\System\BKSjmyr.exe
  2⤵
  PID:6444
- C:\Windows\System\zgBuCDo.exe
  C:\Windows\System\zgBuCDo.exe
  2⤵
  PID:6460
- C:\Windows\System\IUDdFSp.exe
  C:\Windows\System\IUDdFSp.exe
  2⤵
  PID:6476
- C:\Windows\System\XOvoZDU.exe
  C:\Windows\System\XOvoZDU.exe
  2⤵
  PID:6492
- C:\Windows\System\ipeLtAR.exe
  C:\Windows\System\ipeLtAR.exe
  2⤵
  PID:6508
- C:\Windows\System\rLKnjgL.exe
  C:\Windows\System\rLKnjgL.exe
  2⤵
  PID:6524
- C:\Windows\System\SBmStSK.exe
  C:\Windows\System\SBmStSK.exe
  2⤵
  PID:6540
- C:\Windows\System\ghtEzKz.exe
  C:\Windows\System\ghtEzKz.exe
  2⤵
  PID:6556
- C:\Windows\System\RaiTDMC.exe
  C:\Windows\System\RaiTDMC.exe
  2⤵
  PID:6572
- C:\Windows\System\kLKWrRa.exe
  C:\Windows\System\kLKWrRa.exe
  2⤵
  PID:6588
- C:\Windows\System\dmdDanq.exe
  C:\Windows\System\dmdDanq.exe
  2⤵
  PID:6612
- C:\Windows\System\UWJLFuO.exe
  C:\Windows\System\UWJLFuO.exe
  2⤵
  PID:6628
- C:\Windows\System\RKjrdNB.exe
  C:\Windows\System\RKjrdNB.exe
  2⤵
  PID:6644
- C:\Windows\System\JXYoHAx.exe
  C:\Windows\System\JXYoHAx.exe
  2⤵
  PID:6660
- C:\Windows\System\uSqytuH.exe
  C:\Windows\System\uSqytuH.exe
  2⤵
  PID:6680
- C:\Windows\System\QkTyxFU.exe
  C:\Windows\System\QkTyxFU.exe
  2⤵
  PID:6696
- C:\Windows\System\odLmxyP.exe
  C:\Windows\System\odLmxyP.exe
  2⤵
  PID:6712
- C:\Windows\System\ZLbUJYX.exe
  C:\Windows\System\ZLbUJYX.exe
  2⤵
  PID:6728
- C:\Windows\System\SwvROLt.exe
  C:\Windows\System\SwvROLt.exe
  2⤵
  PID:6744
- C:\Windows\System\OnMTrBj.exe
  C:\Windows\System\OnMTrBj.exe
  2⤵
  PID:6760
- C:\Windows\System\qkinMwL.exe
  C:\Windows\System\qkinMwL.exe
  2⤵
  PID:6776
- C:\Windows\System\uYaaftJ.exe
  C:\Windows\System\uYaaftJ.exe
  2⤵
  PID:6792
- C:\Windows\System\UhOCCUn.exe
  C:\Windows\System\UhOCCUn.exe
  2⤵
  PID:6808
- C:\Windows\System\sFGpbhI.exe
  C:\Windows\System\sFGpbhI.exe
  2⤵
  PID:6824
- C:\Windows\System\VNXCPlw.exe
  C:\Windows\System\VNXCPlw.exe
  2⤵
  PID:6840
- C:\Windows\System\mQjXRIk.exe
  C:\Windows\System\mQjXRIk.exe
  2⤵
  PID:6856
- C:\Windows\System\nzoizif.exe
  C:\Windows\System\nzoizif.exe
  2⤵
  PID:6872
- C:\Windows\System\PlRflUY.exe
  C:\Windows\System\PlRflUY.exe
  2⤵
  PID:6888
- C:\Windows\System\jpGTdZL.exe
  C:\Windows\System\jpGTdZL.exe
  2⤵
  PID:6904
- C:\Windows\System\TTEKTqP.exe
  C:\Windows\System\TTEKTqP.exe
  2⤵
  PID:6920
- C:\Windows\System\DktzVaE.exe
  C:\Windows\System\DktzVaE.exe
  2⤵
  PID:6936
- C:\Windows\System\TVVAZbt.exe
  C:\Windows\System\TVVAZbt.exe
  2⤵
  PID:6952
- C:\Windows\System\eWKgBLL.exe
  C:\Windows\System\eWKgBLL.exe
  2⤵
  PID:6968
- C:\Windows\System\DEdJLVC.exe
  C:\Windows\System\DEdJLVC.exe
  2⤵
  PID:6984
- C:\Windows\System\vAGaXCt.exe
  C:\Windows\System\vAGaXCt.exe
  2⤵
  PID:7000
- C:\Windows\System\ccgNheo.exe
  C:\Windows\System\ccgNheo.exe
  2⤵
  PID:7016
- C:\Windows\System\mmgNCoI.exe
  C:\Windows\System\mmgNCoI.exe
  2⤵
  PID:7032
- C:\Windows\System\FIHDNqp.exe
  C:\Windows\System\FIHDNqp.exe
  2⤵
  PID:7048
- C:\Windows\System\YRFPGMF.exe
  C:\Windows\System\YRFPGMF.exe
  2⤵
  PID:7064
- C:\Windows\System\QCoAHHL.exe
  C:\Windows\System\QCoAHHL.exe
  2⤵
  PID:7080
- C:\Windows\System\nTTfrAn.exe
  C:\Windows\System\nTTfrAn.exe
  2⤵
  PID:7096
- C:\Windows\System\hfSqzsV.exe
  C:\Windows\System\hfSqzsV.exe
  2⤵
  PID:7112
- C:\Windows\System\bPWnCEr.exe
  C:\Windows\System\bPWnCEr.exe
  2⤵
  PID:7128
- C:\Windows\System\FeBChAB.exe
  C:\Windows\System\FeBChAB.exe
  2⤵
  PID:7144
- C:\Windows\System\FCgGYnS.exe
  C:\Windows\System\FCgGYnS.exe
  2⤵
  PID:7160
- C:\Windows\System\rNGgkif.exe
  C:\Windows\System\rNGgkif.exe
  2⤵
  PID:3684
- C:\Windows\System\hlvULxP.exe
  C:\Windows\System\hlvULxP.exe
  2⤵
  PID:3284
- C:\Windows\System\kSKCReK.exe
  C:\Windows\System\kSKCReK.exe
  2⤵
  PID:4336
- C:\Windows\System\OxBURCe.exe
  C:\Windows\System\OxBURCe.exe
  2⤵
  PID:5156
- C:\Windows\System\YznLIUa.exe
  C:\Windows\System\YznLIUa.exe
  2⤵
  PID:5908
- C:\Windows\System\mTKReyL.exe
  C:\Windows\System\mTKReyL.exe
  2⤵
  PID:6064
- C:\Windows\System\IUAsgys.exe
  C:\Windows\System\IUAsgys.exe
  2⤵
  PID:664
- C:\Windows\System\uqAiBwo.exe
  C:\Windows\System\uqAiBwo.exe
  2⤵
  PID:6164
- C:\Windows\System\ujkfCsN.exe
  C:\Windows\System\ujkfCsN.exe
  2⤵
  PID:6228
- C:\Windows\System\RRdcVtv.exe
  C:\Windows\System\RRdcVtv.exe
  2⤵
  PID:5524
- C:\Windows\System\FJMyePJ.exe
  C:\Windows\System\FJMyePJ.exe
  2⤵
  PID:6016
- C:\Windows\System\hdnNYlx.exe
  C:\Windows\System\hdnNYlx.exe
  2⤵
  PID:5312
- C:\Windows\System\AGeSnIK.exe
  C:\Windows\System\AGeSnIK.exe
  2⤵
  PID:5376
- C:\Windows\System\eidiffl.exe
  C:\Windows\System\eidiffl.exe
  2⤵
  PID:6424
- C:\Windows\System\RoeytVi.exe
  C:\Windows\System\RoeytVi.exe
  2⤵
  PID:6516
- C:\Windows\System\vvNWzHY.exe
  C:\Windows\System\vvNWzHY.exe
  2⤵
  PID:4608
- C:\Windows\System\RzyaTMh.exe
  C:\Windows\System\RzyaTMh.exe
  2⤵
  PID:6580
- C:\Windows\System\zbDFKrz.exe
  C:\Windows\System\zbDFKrz.exe
  2⤵
  PID:5540
- C:\Windows\System\shIMmbh.exe
  C:\Windows\System\shIMmbh.exe
  2⤵
  PID:4800
- C:\Windows\System\KwvAKHX.exe
  C:\Windows\System\KwvAKHX.exe
  2⤵
  PID:5636
- C:\Windows\System\MnsVTPl.exe
  C:\Windows\System\MnsVTPl.exe
  2⤵
  PID:4388
- C:\Windows\System\ciVgSBV.exe
  C:\Windows\System\ciVgSBV.exe
  2⤵
  PID:4752
- C:\Windows\System\oFUDotO.exe
  C:\Windows\System\oFUDotO.exe
  2⤵
  PID:5984
- C:\Windows\System\QWzpsVT.exe
  C:\Windows\System\QWzpsVT.exe
  2⤵
  PID:6020
- C:\Windows\System\hJhopki.exe
  C:\Windows\System\hJhopki.exe
  2⤵
  PID:6340
- C:\Windows\System\KfvpGCl.exe
  C:\Windows\System\KfvpGCl.exe
  2⤵
  PID:5284
- C:\Windows\System\LibgKPR.exe
  C:\Windows\System\LibgKPR.exe
  2⤵
  PID:5380
- C:\Windows\System\RfKOhfl.exe
  C:\Windows\System\RfKOhfl.exe
  2⤵
  PID:5444
- C:\Windows\System\YtHGiyz.exe
  C:\Windows\System\YtHGiyz.exe
  2⤵
  PID:5536
- C:\Windows\System\eGaaFkK.exe
  C:\Windows\System\eGaaFkK.exe
  2⤵
  PID:5664
- C:\Windows\System\vdIaFnW.exe
  C:\Windows\System\vdIaFnW.exe
  2⤵
  PID:5728
- C:\Windows\System\BSbOBXD.exe
  C:\Windows\System\BSbOBXD.exe
  2⤵
  PID:5792
- C:\Windows\System\XepCKYI.exe
  C:\Windows\System\XepCKYI.exe
  2⤵
  PID:5828
- C:\Windows\System\nbkdvKL.exe
  C:\Windows\System\nbkdvKL.exe
  2⤵
  PID:5920
- C:\Windows\System\vYqrLLM.exe
  C:\Windows\System\vYqrLLM.exe
  2⤵
  PID:6276
- C:\Windows\System\FijAIDM.exe
  C:\Windows\System\FijAIDM.exe
  2⤵
  PID:6116
- C:\Windows\System\FQniAOg.exe
  C:\Windows\System\FQniAOg.exe
  2⤵
  PID:5204
- C:\Windows\System\uPwfvNO.exe
  C:\Windows\System\uPwfvNO.exe
  2⤵
  PID:5396
- C:\Windows\System\JyAcJsb.exe
  C:\Windows\System\JyAcJsb.exe
  2⤵
  PID:5616
- C:\Windows\System\PZhrxuf.exe
  C:\Windows\System\PZhrxuf.exe
  2⤵
  PID:5584
- C:\Windows\System\eRBfBxb.exe
  C:\Windows\System\eRBfBxb.exe
  2⤵
  PID:6128
- C:\Windows\System\nSVIsHq.exe
  C:\Windows\System\nSVIsHq.exe
  2⤵
  PID:6148
- C:\Windows\System\ylNmzyq.exe
  C:\Windows\System\ylNmzyq.exe
  2⤵
  PID:6212
- C:\Windows\System\qCePdIJ.exe
  C:\Windows\System\qCePdIJ.exe
  2⤵
  PID:6248
- C:\Windows\System\ckVWRHT.exe
  C:\Windows\System\ckVWRHT.exe
  2⤵
  PID:6408
- C:\Windows\System\scTjRYn.exe
  C:\Windows\System\scTjRYn.exe
  2⤵
  PID:6472
- C:\Windows\System\NdUNzTc.exe
  C:\Windows\System\NdUNzTc.exe
  2⤵
  PID:6564
- C:\Windows\System\bnwYEhE.exe
  C:\Windows\System\bnwYEhE.exe
  2⤵
  PID:6656
- C:\Windows\System\KDtndLL.exe
  C:\Windows\System\KDtndLL.exe
  2⤵
  PID:6720
- C:\Windows\System\HGAtMJo.exe
  C:\Windows\System\HGAtMJo.exe
  2⤵
  PID:6752
- C:\Windows\System\qmGTOyO.exe
  C:\Windows\System\qmGTOyO.exe
  2⤵
  PID:6736
- C:\Windows\System\GseYhir.exe
  C:\Windows\System\GseYhir.exe
  2⤵
  PID:6636
- C:\Windows\System\ZZdFtRt.exe
  C:\Windows\System\ZZdFtRt.exe
  2⤵
  PID:6880
- C:\Windows\System\GrYtycC.exe
  C:\Windows\System\GrYtycC.exe
  2⤵
  PID:6800
- C:\Windows\System\VpylxYU.exe
  C:\Windows\System\VpylxYU.exe
  2⤵
  PID:6916
- C:\Windows\System\tCDWYBm.exe
  C:\Windows\System\tCDWYBm.exe
  2⤵
  PID:6980
- C:\Windows\System\AlESWXb.exe
  C:\Windows\System\AlESWXb.exe
  2⤵
  PID:7044
- C:\Windows\System\khfKAwy.exe
  C:\Windows\System\khfKAwy.exe
  2⤵
  PID:7104
- C:\Windows\System\TUKUGeG.exe
  C:\Windows\System\TUKUGeG.exe
  2⤵
  PID:5116
- C:\Windows\System\THLfOms.exe
  C:\Windows\System\THLfOms.exe
  2⤵
  PID:5520
- C:\Windows\System\fyZNyfV.exe
  C:\Windows\System\fyZNyfV.exe
  2⤵
  PID:6960
- C:\Windows\System\GfBsHCn.exe
  C:\Windows\System\GfBsHCn.exe
  2⤵
  PID:6292
- C:\Windows\System\bZLMBza.exe
  C:\Windows\System\bZLMBza.exe
  2⤵
  PID:6452
- C:\Windows\System\ovvAFrO.exe
  C:\Windows\System\ovvAFrO.exe
  2⤵
  PID:6832
- C:\Windows\System\pRcBjYH.exe
  C:\Windows\System\pRcBjYH.exe
  2⤵
  PID:6552
- C:\Windows\System\FigGgPU.exe
  C:\Windows\System\FigGgPU.exe
  2⤵
  PID:6932
- C:\Windows\System\ZqLobpG.exe
  C:\Windows\System\ZqLobpG.exe
  2⤵
  PID:6996
- C:\Windows\System\GHUhTYf.exe
  C:\Windows\System\GHUhTYf.exe
  2⤵
  PID:7056
- C:\Windows\System\JawuUap.exe
  C:\Windows\System\JawuUap.exe
  2⤵
  PID:6280
- C:\Windows\System\iQnPbem.exe
  C:\Windows\System\iQnPbem.exe
  2⤵
  PID:5248
- C:\Windows\System\vlpSwoJ.exe
  C:\Windows\System\vlpSwoJ.exe
  2⤵
  PID:5508
- C:\Windows\System\tnBYNhP.exe
  C:\Windows\System\tnBYNhP.exe
  2⤵
  PID:7092
- C:\Windows\System\nPVqPwq.exe
  C:\Windows\System\nPVqPwq.exe
  2⤵
  PID:7156
- C:\Windows\System\wrxWpLo.exe
  C:\Windows\System\wrxWpLo.exe
  2⤵
  PID:4320
- C:\Windows\System\eTnoLjT.exe
  C:\Windows\System\eTnoLjT.exe
  2⤵
  PID:5188
- C:\Windows\System\vBPjzEQ.exe
  C:\Windows\System\vBPjzEQ.exe
  2⤵
  PID:6420
- C:\Windows\System\duXweIS.exe
  C:\Windows\System\duXweIS.exe
  2⤵
  PID:4580
- C:\Windows\System\pfSlbll.exe
  C:\Windows\System\pfSlbll.exe
  2⤵
  PID:6312
- C:\Windows\System\ZNIKyRx.exe
  C:\Windows\System\ZNIKyRx.exe
  2⤵
  PID:5440
- C:\Windows\System\WxAzjxe.exe
  C:\Windows\System\WxAzjxe.exe
  2⤵
  PID:5700
- C:\Windows\System\gYezZcG.exe
  C:\Windows\System\gYezZcG.exe
  2⤵
  PID:5956
- C:\Windows\System\lVweIDb.exe
  C:\Windows\System\lVweIDb.exe
  2⤵
  PID:5892
- C:\Windows\System\dNoUtjR.exe
  C:\Windows\System\dNoUtjR.exe
  2⤵
  PID:4736
- C:\Windows\System\MOvvmvL.exe
  C:\Windows\System\MOvvmvL.exe
  2⤵
  PID:6112
- C:\Windows\System\WTlFrya.exe
  C:\Windows\System\WTlFrya.exe
  2⤵
  PID:6376
- C:\Windows\System\zaznxij.exe
  C:\Windows\System\zaznxij.exe
  2⤵
  PID:6688
- C:\Windows\System\PQfMmuv.exe
  C:\Windows\System\PQfMmuv.exe
  2⤵
  PID:6852
- C:\Windows\System\hGQMBCM.exe
  C:\Windows\System\hGQMBCM.exe
  2⤵
  PID:6500
- C:\Windows\System\dZUBoFI.exe
  C:\Windows\System\dZUBoFI.exe
  2⤵
  PID:7040
- C:\Windows\System\LCCFtps.exe
  C:\Windows\System\LCCFtps.exe
  2⤵
  PID:4980
- C:\Windows\System\xhJAbYZ.exe
  C:\Windows\System\xhJAbYZ.exe
  2⤵
  PID:6440
- C:\Windows\System\KNXrqAI.exe
  C:\Windows\System\KNXrqAI.exe
  2⤵
  PID:6244
- C:\Windows\System\qleswKz.exe
  C:\Windows\System\qleswKz.exe
  2⤵
  PID:6868
- C:\Windows\System\fWbddqg.exe
  C:\Windows\System\fWbddqg.exe
  2⤵
  PID:6772
- C:\Windows\System\ghdPJvP.exe
  C:\Windows\System\ghdPJvP.exe
  2⤵
  PID:6724
- C:\Windows\System\XRWIOdw.exe
  C:\Windows\System\XRWIOdw.exe
  2⤵
  PID:6816
- C:\Windows\System\dGXslUJ.exe
  C:\Windows\System\dGXslUJ.exe
  2⤵
  PID:5184
- C:\Windows\System\iYteDKE.exe
  C:\Windows\System\iYteDKE.exe
  2⤵
  PID:5476
- C:\Windows\System\ZPuPzPD.exe
  C:\Windows\System\ZPuPzPD.exe
  2⤵
  PID:7028
- C:\Windows\System\wwtTyOJ.exe
  C:\Windows\System\wwtTyOJ.exe
  2⤵
  PID:4352
- C:\Windows\System\vGRhqPZ.exe
  C:\Windows\System\vGRhqPZ.exe
  2⤵
  PID:4420
- C:\Windows\System\CdZZGse.exe
  C:\Windows\System\CdZZGse.exe
  2⤵
  PID:5252
- C:\Windows\System\cRXSfpv.exe
  C:\Windows\System\cRXSfpv.exe
  2⤵
  PID:6324
- C:\Windows\System\oGgoMQg.exe
  C:\Windows\System\oGgoMQg.exe
  2⤵
  PID:5696
- C:\Windows\System\YMpAsBH.exe
  C:\Windows\System\YMpAsBH.exe
  2⤵
  PID:6308
- C:\Windows\System\LOSbKVl.exe
  C:\Windows\System\LOSbKVl.exe
  2⤵
  PID:6000
- C:\Windows\System\zwYztcS.exe
  C:\Windows\System\zwYztcS.exe
  2⤵
  PID:6788
- C:\Windows\System\RhQByWS.exe
  C:\Windows\System\RhQByWS.exe
  2⤵
  PID:5872
- C:\Windows\System\vFcXMxP.exe
  C:\Windows\System\vFcXMxP.exe
  2⤵
  PID:6708
- C:\Windows\System\thqAfTi.exe
  C:\Windows\System\thqAfTi.exe
  2⤵
  PID:5268
- C:\Windows\System\BuZvfBX.exe
  C:\Windows\System\BuZvfBX.exe
  2⤵
  PID:6652
- C:\Windows\System\Pznxxhi.exe
  C:\Windows\System\Pznxxhi.exe
  2⤵
  PID:7076
- C:\Windows\System\NOZkPFO.exe
  C:\Windows\System\NOZkPFO.exe
  2⤵
  PID:6928
- C:\Windows\System\kIsANmk.exe
  C:\Windows\System\kIsANmk.exe
  2⤵
  PID:5044
- C:\Windows\System\FWQpgHe.exe
  C:\Windows\System\FWQpgHe.exe
  2⤵
  PID:6200
- C:\Windows\System\ibphkDL.exe
  C:\Windows\System\ibphkDL.exe
  2⤵
  PID:6676
- C:\Windows\System\EwXePek.exe
  C:\Windows\System\EwXePek.exe
  2⤵
  PID:4544
- C:\Windows\System\hNuwlTy.exe
  C:\Windows\System\hNuwlTy.exe
  2⤵
  PID:628
- C:\Windows\System\pyufNMQ.exe
  C:\Windows\System\pyufNMQ.exe
  2⤵
  PID:5096
- C:\Windows\System\fpuSLKG.exe
  C:\Windows\System\fpuSLKG.exe
  2⤵
  PID:5856
- C:\Windows\System\KdiIgUo.exe
  C:\Windows\System\KdiIgUo.exe
  2⤵
  PID:5172
- C:\Windows\System\OSvbVCr.exe
  C:\Windows\System\OSvbVCr.exe
  2⤵
  PID:6900
- C:\Windows\System\NBAQHWz.exe
  C:\Windows\System\NBAQHWz.exe
  2⤵
  PID:5220
- C:\Windows\System\BPaApSR.exe
  C:\Windows\System\BPaApSR.exe
  2⤵
  PID:6536
- C:\Windows\System\vNTGYQZ.exe
  C:\Windows\System\vNTGYQZ.exe
  2⤵
  PID:7176
- C:\Windows\System\ESkRWUw.exe
  C:\Windows\System\ESkRWUw.exe
  2⤵
  PID:7192
- C:\Windows\System\rqOXgga.exe
  C:\Windows\System\rqOXgga.exe
  2⤵
  PID:7208
- C:\Windows\System\CLPmuoA.exe
  C:\Windows\System\CLPmuoA.exe
  2⤵
  PID:7224
- C:\Windows\System\nDSvPSx.exe
  C:\Windows\System\nDSvPSx.exe
  2⤵
  PID:7264
- C:\Windows\System\HvzmkYd.exe
  C:\Windows\System\HvzmkYd.exe
  2⤵
  PID:7300
- C:\Windows\System\hEJCZcM.exe
  C:\Windows\System\hEJCZcM.exe
  2⤵
  PID:7320
- C:\Windows\System\jtVXtFg.exe
  C:\Windows\System\jtVXtFg.exe
  2⤵
  PID:7340
- C:\Windows\System\fzTHsSk.exe
  C:\Windows\System\fzTHsSk.exe
  2⤵
  PID:7360
- C:\Windows\System\qvRweDz.exe
  C:\Windows\System\qvRweDz.exe
  2⤵
  PID:7376
- C:\Windows\System\MulJPFz.exe
  C:\Windows\System\MulJPFz.exe
  2⤵
  PID:7392
- C:\Windows\System\bCquqYH.exe
  C:\Windows\System\bCquqYH.exe
  2⤵
  PID:7412
- C:\Windows\System\DaXwJEl.exe
  C:\Windows\System\DaXwJEl.exe
  2⤵
  PID:7436
- C:\Windows\System\NbHznMp.exe
  C:\Windows\System\NbHznMp.exe
  2⤵
  PID:7452
- C:\Windows\System\bfjQFGI.exe
  C:\Windows\System\bfjQFGI.exe
  2⤵
  PID:7476
- C:\Windows\System\uJVSGWb.exe
  C:\Windows\System\uJVSGWb.exe
  2⤵
  PID:7492
- C:\Windows\System\HjhDxLZ.exe
  C:\Windows\System\HjhDxLZ.exe
  2⤵
  PID:7508
- C:\Windows\System\fOrfcNH.exe
  C:\Windows\System\fOrfcNH.exe
  2⤵
  PID:7524
- C:\Windows\System\bKoIWUp.exe
  C:\Windows\System\bKoIWUp.exe
  2⤵
  PID:7544
- C:\Windows\System\JnzAogJ.exe
  C:\Windows\System\JnzAogJ.exe
  2⤵
  PID:7560
- C:\Windows\System\iAjvsAW.exe
  C:\Windows\System\iAjvsAW.exe
  2⤵
  PID:7576
- C:\Windows\System\RPQgBdv.exe
  C:\Windows\System\RPQgBdv.exe
  2⤵
  PID:7592
- C:\Windows\System\FsjQOUY.exe
  C:\Windows\System\FsjQOUY.exe
  2⤵
  PID:7608
- C:\Windows\System\MaIvEdn.exe
  C:\Windows\System\MaIvEdn.exe
  2⤵
  PID:7624
- C:\Windows\System\qPILWTb.exe
  C:\Windows\System\qPILWTb.exe
  2⤵
  PID:7640
- C:\Windows\System\hVSVWfT.exe
  C:\Windows\System\hVSVWfT.exe
  2⤵
  PID:7656
- C:\Windows\System\ybAKfGt.exe
  C:\Windows\System\ybAKfGt.exe
  2⤵
  PID:7672
- C:\Windows\System\oUNaiPo.exe
  C:\Windows\System\oUNaiPo.exe
  2⤵
  PID:7688
- C:\Windows\System\hYUVYzn.exe
  C:\Windows\System\hYUVYzn.exe
  2⤵
  PID:7704
- C:\Windows\System\NZfiYzb.exe
  C:\Windows\System\NZfiYzb.exe
  2⤵
  PID:7720
- C:\Windows\System\XXzskic.exe
  C:\Windows\System\XXzskic.exe
  2⤵
  PID:7736
- C:\Windows\System\hMLRrYr.exe
  C:\Windows\System\hMLRrYr.exe
  2⤵
  PID:7752
- C:\Windows\System\cMKENRE.exe
  C:\Windows\System\cMKENRE.exe
  2⤵
  PID:7768
- C:\Windows\System\TMgnaQx.exe
  C:\Windows\System\TMgnaQx.exe
  2⤵
  PID:7784
- C:\Windows\System\SugAPqL.exe
  C:\Windows\System\SugAPqL.exe
  2⤵
  PID:7800
- C:\Windows\System\wGSuFwE.exe
  C:\Windows\System\wGSuFwE.exe
  2⤵
  PID:7816
- C:\Windows\System\uWBlqco.exe
  C:\Windows\System\uWBlqco.exe
  2⤵
  PID:7832
- C:\Windows\System\KFXVbMN.exe
  C:\Windows\System\KFXVbMN.exe
  2⤵
  PID:7848
- C:\Windows\System\DJxfYKo.exe
  C:\Windows\System\DJxfYKo.exe
  2⤵
  PID:7864
- C:\Windows\System\TaFkHkG.exe
  C:\Windows\System\TaFkHkG.exe
  2⤵
  PID:7880
- C:\Windows\System\VxKWfjS.exe
  C:\Windows\System\VxKWfjS.exe
  2⤵
  PID:7896
- C:\Windows\System\xyGuVHg.exe
  C:\Windows\System\xyGuVHg.exe
  2⤵
  PID:7912
- C:\Windows\System\dNIyQCu.exe
  C:\Windows\System\dNIyQCu.exe
  2⤵
  PID:7928
- C:\Windows\System\bIbQLKg.exe
  C:\Windows\System\bIbQLKg.exe
  2⤵
  PID:7944
- C:\Windows\System\ahQItiN.exe
  C:\Windows\System\ahQItiN.exe
  2⤵
  PID:7960
- C:\Windows\System\BggAWZI.exe
  C:\Windows\System\BggAWZI.exe
  2⤵
  PID:7976
- C:\Windows\System\DKjEzOr.exe
  C:\Windows\System\DKjEzOr.exe
  2⤵
  PID:7992
- C:\Windows\System\hzrZjDo.exe
  C:\Windows\System\hzrZjDo.exe
  2⤵
  PID:8008
- C:\Windows\System\IudRapy.exe
  C:\Windows\System\IudRapy.exe
  2⤵
  PID:8024
- C:\Windows\System\sjlwuyH.exe
  C:\Windows\System\sjlwuyH.exe
  2⤵
  PID:8040
- C:\Windows\System\NEdYaJT.exe
  C:\Windows\System\NEdYaJT.exe
  2⤵
  PID:8056
- C:\Windows\System\hWKyCmT.exe
  C:\Windows\System\hWKyCmT.exe
  2⤵
  PID:8072
- C:\Windows\System\bjOwbQO.exe
  C:\Windows\System\bjOwbQO.exe
  2⤵
  PID:8088
- C:\Windows\System\zLzdKOo.exe
  C:\Windows\System\zLzdKOo.exe
  2⤵
  PID:8104
- C:\Windows\System\aoZrfgL.exe
  C:\Windows\System\aoZrfgL.exe
  2⤵
  PID:8120
- C:\Windows\System\UGeVqHz.exe
  C:\Windows\System\UGeVqHz.exe
  2⤵
  PID:8136
- C:\Windows\System\wCXwkHT.exe
  C:\Windows\System\wCXwkHT.exe
  2⤵
  PID:8152
- C:\Windows\System\rhRSSav.exe
  C:\Windows\System\rhRSSav.exe
  2⤵
  PID:8168
- C:\Windows\System\hANajXb.exe
  C:\Windows\System\hANajXb.exe
  2⤵
  PID:8184
- C:\Windows\System\MeRajkA.exe
  C:\Windows\System\MeRajkA.exe
  2⤵
  PID:6100
- C:\Windows\System\LDreWyK.exe
  C:\Windows\System\LDreWyK.exe
  2⤵
  PID:7184
- C:\Windows\System\QEmidnE.exe
  C:\Windows\System\QEmidnE.exe
  2⤵
  PID:7172
- C:\Windows\System\iwqAVSn.exe
  C:\Windows\System\iwqAVSn.exe
  2⤵
  PID:7220
- C:\Windows\System\AADDbyn.exe
  C:\Windows\System\AADDbyn.exe
  2⤵
  PID:7276
- C:\Windows\System\gKflkUm.exe
  C:\Windows\System\gKflkUm.exe
  2⤵
  PID:7312
- C:\Windows\System\KEXARDz.exe
  C:\Windows\System\KEXARDz.exe
  2⤵
  PID:7288
- C:\Windows\System\faEEyMT.exe
  C:\Windows\System\faEEyMT.exe
  2⤵
  PID:7332
- C:\Windows\System\nZrfJFw.exe
  C:\Windows\System\nZrfJFw.exe
  2⤵
  PID:7404
- C:\Windows\System\LwvQIRR.exe
  C:\Windows\System\LwvQIRR.exe
  2⤵
  PID:7424
- C:\Windows\System\lNwLwHK.exe
  C:\Windows\System\lNwLwHK.exe
  2⤵
  PID:7464
- C:\Windows\System\YNjUkhc.exe
  C:\Windows\System\YNjUkhc.exe
  2⤵
  PID:7532
- C:\Windows\System\RfASCMZ.exe
  C:\Windows\System\RfASCMZ.exe
  2⤵
  PID:7572
- C:\Windows\System\uUtFuFH.exe
  C:\Windows\System\uUtFuFH.exe
  2⤵
  PID:7488
- C:\Windows\System\ANiemAy.exe
  C:\Windows\System\ANiemAy.exe
  2⤵
  PID:7616
- C:\Windows\System\NAvStIF.exe
  C:\Windows\System\NAvStIF.exe
  2⤵
  PID:7764
- C:\Windows\System\IwbIgDi.exe
  C:\Windows\System\IwbIgDi.exe
  2⤵
  PID:7856
- C:\Windows\System\eTweMRC.exe
  C:\Windows\System\eTweMRC.exe
  2⤵
  PID:7952
- C:\Windows\System\jrnkRfO.exe
  C:\Windows\System\jrnkRfO.exe
  2⤵
  PID:7956
- C:\Windows\System\XeiFMvf.exe
  C:\Windows\System\XeiFMvf.exe
  2⤵
  PID:8080
- C:\Windows\System\eWBmEWr.exe
  C:\Windows\System\eWBmEWr.exe
  2⤵
  PID:7648
- C:\Windows\System\GItgPFR.exe
  C:\Windows\System\GItgPFR.exe
  2⤵
  PID:8144
- C:\Windows\System\AYgpOon.exe
  C:\Windows\System\AYgpOon.exe
  2⤵
  PID:8176
- C:\Windows\System\CobHhWs.exe
  C:\Windows\System\CobHhWs.exe
  2⤵
  PID:7872
- C:\Windows\System\PTqYuPT.exe
  C:\Windows\System\PTqYuPT.exe
  2⤵
  PID:7940
- C:\Windows\System\bGkfFtX.exe
  C:\Windows\System\bGkfFtX.exe
  2⤵
  PID:8000
- C:\Windows\System\irSQimP.exe
  C:\Windows\System\irSQimP.exe
  2⤵
  PID:7904
- C:\Windows\System\cCPcjqc.exe
  C:\Windows\System\cCPcjqc.exe
  2⤵
  PID:8004
- C:\Windows\System\ElkpBbv.exe
  C:\Windows\System\ElkpBbv.exe
  2⤵
  PID:8096
- C:\Windows\System\CpNyQec.exe
  C:\Windows\System\CpNyQec.exe
  2⤵
  PID:8160
- C:\Windows\System\GfQzTBF.exe
  C:\Windows\System\GfQzTBF.exe
  2⤵
  PID:7152
- C:\Windows\System\LckXXQf.exe
  C:\Windows\System\LckXXQf.exe
  2⤵
  PID:4228
- C:\Windows\System\PZWTIdx.exe
  C:\Windows\System\PZWTIdx.exe
  2⤵
  PID:7308
- C:\Windows\System\wOPIWRh.exe
  C:\Windows\System\wOPIWRh.exe
  2⤵
  PID:7328
- C:\Windows\System\sKjyKbu.exe
  C:\Windows\System\sKjyKbu.exe
  2⤵
  PID:7420
- C:\Windows\System\LYZfvRM.exe
  C:\Windows\System\LYZfvRM.exe
  2⤵
  PID:7400
- C:\Windows\System\wfZhTjL.exe
  C:\Windows\System\wfZhTjL.exe
  2⤵
  PID:7536
- C:\Windows\System\XZeNmWI.exe
  C:\Windows\System\XZeNmWI.exe
  2⤵
  PID:7484
- C:\Windows\System\FlxFwHr.exe
  C:\Windows\System\FlxFwHr.exe
  2⤵
  PID:7552
- C:\Windows\System\ZTJABDo.exe
  C:\Windows\System\ZTJABDo.exe
  2⤵
  PID:7636
- C:\Windows\System\FGaPAPF.exe
  C:\Windows\System\FGaPAPF.exe
  2⤵
  PID:7796
- C:\Windows\System\uwCWoJJ.exe
  C:\Windows\System\uwCWoJJ.exe
  2⤵
  PID:7988
- C:\Windows\System\XQrhWBb.exe
  C:\Windows\System\XQrhWBb.exe
  2⤵
  PID:8148
- C:\Windows\System\MxhqaXH.exe
  C:\Windows\System\MxhqaXH.exe
  2⤵
  PID:8048
- C:\Windows\System\gJDKclP.exe
  C:\Windows\System\gJDKclP.exe
  2⤵
  PID:8064
- C:\Windows\System\xIYVrBw.exe
  C:\Windows\System\xIYVrBw.exe
  2⤵
  PID:7272
- C:\Windows\System\jlcvqLU.exe
  C:\Windows\System\jlcvqLU.exe
  2⤵
  PID:7620
- C:\Windows\System\bxjEURi.exe
  C:\Windows\System\bxjEURi.exe
  2⤵
  PID:7684
- C:\Windows\System\eavrIFK.exe
  C:\Windows\System\eavrIFK.exe
  2⤵
  PID:7604
- C:\Windows\System\meAPTbF.exe
  C:\Windows\System\meAPTbF.exe
  2⤵
  PID:7700
- C:\Windows\System\TqVTqkD.exe
  C:\Windows\System\TqVTqkD.exe
  2⤵
  PID:7712
- C:\Windows\System\iTjkjRz.exe
  C:\Windows\System\iTjkjRz.exe
  2⤵
  PID:7968
- C:\Windows\System\NXQCemV.exe
  C:\Windows\System\NXQCemV.exe
  2⤵
  PID:7844
- C:\Windows\System\BnhFXAq.exe
  C:\Windows\System\BnhFXAq.exe
  2⤵
  PID:8204
- C:\Windows\System\zVkvCXm.exe
  C:\Windows\System\zVkvCXm.exe
  2⤵
  PID:8224
- C:\Windows\System\aaOaVAi.exe
  C:\Windows\System\aaOaVAi.exe
  2⤵
  PID:8240
- C:\Windows\System\iHJmlXa.exe
  C:\Windows\System\iHJmlXa.exe
  2⤵
  PID:8288
- C:\Windows\System\MPHIQzd.exe
  C:\Windows\System\MPHIQzd.exe
  2⤵
  PID:8316
- C:\Windows\System\eGgEdIs.exe
  C:\Windows\System\eGgEdIs.exe
  2⤵
  PID:8336
- C:\Windows\System\fJDITFH.exe
  C:\Windows\System\fJDITFH.exe
  2⤵
  PID:8352
- C:\Windows\System\nzUhLpj.exe
  C:\Windows\System\nzUhLpj.exe
  2⤵
  PID:8368
- C:\Windows\System\JKRJXSX.exe
  C:\Windows\System\JKRJXSX.exe
  2⤵
  PID:8392
- C:\Windows\System\AcTgQKi.exe
  C:\Windows\System\AcTgQKi.exe
  2⤵
  PID:8512
- C:\Windows\System\azhXVZH.exe
  C:\Windows\System\azhXVZH.exe
  2⤵
  PID:8704
- C:\Windows\System\lOFqkut.exe
  C:\Windows\System\lOFqkut.exe
  2⤵
  PID:8724
- C:\Windows\System\sAdoKAj.exe
  C:\Windows\System\sAdoKAj.exe
  2⤵
  PID:8740
- C:\Windows\System\MKiWlbR.exe
  C:\Windows\System\MKiWlbR.exe
  2⤵
  PID:8976
- C:\Windows\System\iCdXUPA.exe
  C:\Windows\System\iCdXUPA.exe
  2⤵
  PID:8992
- C:\Windows\System\guuAVEc.exe
  C:\Windows\System\guuAVEc.exe
  2⤵
  PID:9008
- C:\Windows\System\matJYXf.exe
  C:\Windows\System\matJYXf.exe
  2⤵
  PID:9024
- C:\Windows\System\OUOMyid.exe
  C:\Windows\System\OUOMyid.exe
  2⤵
  PID:9040
- C:\Windows\System\REguovf.exe
  C:\Windows\System\REguovf.exe
  2⤵
  PID:9056
- C:\Windows\System\TPDZZKK.exe
  C:\Windows\System\TPDZZKK.exe
  2⤵
  PID:9072
- C:\Windows\System\vvRNXcf.exe
  C:\Windows\System\vvRNXcf.exe
  2⤵
  PID:9088
- C:\Windows\System\dIAqyBH.exe
  C:\Windows\System\dIAqyBH.exe
  2⤵
  PID:9104
- C:\Windows\System\KhoBNtO.exe
  C:\Windows\System\KhoBNtO.exe
  2⤵
  PID:9120
- C:\Windows\System\RnaolzH.exe
  C:\Windows\System\RnaolzH.exe
  2⤵
  PID:9136
- C:\Windows\System\iJUEwPn.exe
  C:\Windows\System\iJUEwPn.exe
  2⤵
  PID:9152
- C:\Windows\System\eyMSfer.exe
  C:\Windows\System\eyMSfer.exe
  2⤵
  PID:9168
- C:\Windows\System\QDzwjGr.exe
  C:\Windows\System\QDzwjGr.exe
  2⤵
  PID:9184
- C:\Windows\System\RhpxjGv.exe
  C:\Windows\System\RhpxjGv.exe
  2⤵
  PID:9200
- C:\Windows\System\YGynMvZ.exe
  C:\Windows\System\YGynMvZ.exe
  2⤵
  PID:8128
- C:\Windows\System\ybhEzeH.exe
  C:\Windows\System\ybhEzeH.exe
  2⤵
  PID:7472
- C:\Windows\System\aIWRtMM.exe
  C:\Windows\System\aIWRtMM.exe
  2⤵
  PID:7600
- C:\Windows\System\boAstUq.exe
  C:\Windows\System\boAstUq.exe
  2⤵
  PID:7760
- C:\Windows\System\KaYPThh.exe
  C:\Windows\System\KaYPThh.exe
  2⤵
  PID:6484
- C:\Windows\System\IxBTFtB.exe
  C:\Windows\System\IxBTFtB.exe
  2⤵
  PID:6196
- C:\Windows\System\ifbcjCw.exe
  C:\Windows\System\ifbcjCw.exe
  2⤵
  PID:8196
- C:\Windows\System\XmtAlfD.exe
  C:\Windows\System\XmtAlfD.exe
  2⤵
  PID:8116
- C:\Windows\System\EklPyfn.exe
  C:\Windows\System\EklPyfn.exe
  2⤵
  PID:8216
- C:\Windows\System\TuehVyT.exe
  C:\Windows\System\TuehVyT.exe
  2⤵
  PID:8256
- C:\Windows\System\mOzbSQf.exe
  C:\Windows\System\mOzbSQf.exe
  2⤵
  PID:8276
- C:\Windows\System\quWhyCE.exe
  C:\Windows\System\quWhyCE.exe
  2⤵
  PID:8328
- C:\Windows\System\IiAfNZm.exe
  C:\Windows\System\IiAfNZm.exe
  2⤵
  PID:8300
- C:\Windows\System\PzHtJDK.exe
  C:\Windows\System\PzHtJDK.exe
  2⤵
  PID:8260
- C:\Windows\System\tlxQSFR.exe
  C:\Windows\System\tlxQSFR.exe
  2⤵
  PID:8332
- C:\Windows\System\NIYdYEM.exe
  C:\Windows\System\NIYdYEM.exe
  2⤵
  PID:8400
- C:\Windows\System\SCrEwQg.exe
  C:\Windows\System\SCrEwQg.exe
  2⤵
  PID:8420
- C:\Windows\System\kKMyLed.exe
  C:\Windows\System\kKMyLed.exe
  2⤵
  PID:8436
- C:\Windows\System\nXUieAj.exe
  C:\Windows\System\nXUieAj.exe
  2⤵
  PID:8456
- C:\Windows\System\kjZDNoT.exe
  C:\Windows\System\kjZDNoT.exe
  2⤵
  PID:8472
- C:\Windows\System\gyzUdCd.exe
  C:\Windows\System\gyzUdCd.exe
  2⤵
  PID:8488
- C:\Windows\System\rECSHPc.exe
  C:\Windows\System\rECSHPc.exe
  2⤵
  PID:8444
- C:\Windows\System\exQZSvJ.exe
  C:\Windows\System\exQZSvJ.exe
  2⤵
  PID:8520
- C:\Windows\System\JkuYVjM.exe
  C:\Windows\System\JkuYVjM.exe
  2⤵
  PID:8536
- C:\Windows\System\VhgLOvE.exe
  C:\Windows\System\VhgLOvE.exe
  2⤵
  PID:8552
- C:\Windows\System\tDuPoAM.exe
  C:\Windows\System\tDuPoAM.exe
  2⤵
  PID:8632
- C:\Windows\System\kcdFdsg.exe
  C:\Windows\System\kcdFdsg.exe
  2⤵
  PID:8572
- C:\Windows\System\mZMejhg.exe
  C:\Windows\System\mZMejhg.exe
  2⤵
  PID:8584
- C:\Windows\System\OoBaOCN.exe
  C:\Windows\System\OoBaOCN.exe
  2⤵
  PID:8608
- C:\Windows\System\Mjycjru.exe
  C:\Windows\System\Mjycjru.exe
  2⤵
  PID:8628
- C:\Windows\System\WWQfDWe.exe
  C:\Windows\System\WWQfDWe.exe
  2⤵
  PID:8720
- C:\Windows\System\YWeqyBe.exe
  C:\Windows\System\YWeqyBe.exe
  2⤵
  PID:8760
- C:\Windows\System\mAsWltL.exe
  C:\Windows\System\mAsWltL.exe
  2⤵
  PID:8644
- C:\Windows\System\TxEDMpi.exe
  C:\Windows\System\TxEDMpi.exe
  2⤵
  PID:8780
- C:\Windows\System\ZKCIoUm.exe
  C:\Windows\System\ZKCIoUm.exe
  2⤵
  PID:8796
- C:\Windows\System\bbQZgcb.exe
  C:\Windows\System\bbQZgcb.exe
  2⤵
  PID:8900
- C:\Windows\System\QpPOHaW.exe
  C:\Windows\System\QpPOHaW.exe
  2⤵
  PID:8940
- C:\Windows\System\tRvTIHz.exe
  C:\Windows\System\tRvTIHz.exe
  2⤵
  PID:8960
- C:\Windows\System\JtGZKOC.exe
  C:\Windows\System\JtGZKOC.exe
  2⤵
  PID:8832
- C:\Windows\System\jLxWZCv.exe
  C:\Windows\System\jLxWZCv.exe
  2⤵
  PID:8820
- C:\Windows\System\QRsHbrm.exe
  C:\Windows\System\QRsHbrm.exe
  2⤵
  PID:8872
- C:\Windows\System\ODPQwFl.exe
  C:\Windows\System\ODPQwFl.exe
  2⤵
  PID:8856
- C:\Windows\System\ykNVtko.exe
  C:\Windows\System\ykNVtko.exe
  2⤵
  PID:8840
- C:\Windows\System\cnpIHeU.exe
  C:\Windows\System\cnpIHeU.exe
  2⤵
  PID:8888
- C:\Windows\System\zepWeTq.exe
  C:\Windows\System\zepWeTq.exe
  2⤵
  PID:8916
- C:\Windows\System\ENKannU.exe
  C:\Windows\System\ENKannU.exe
  2⤵
  PID:8932
- C:\Windows\System\wWgqWpr.exe
  C:\Windows\System\wWgqWpr.exe
  2⤵
  PID:9036
- C:\Windows\System\pJIlGlH.exe
  C:\Windows\System\pJIlGlH.exe
  2⤵
  PID:9128
- C:\Windows\System\kfvRzUa.exe
  C:\Windows\System\kfvRzUa.exe
  2⤵
  PID:9096
- C:\Windows\System\dFNjnVi.exe
  C:\Windows\System\dFNjnVi.exe
  2⤵
  PID:7356
- C:\Windows\System\OrryJls.exe
  C:\Windows\System\OrryJls.exe
  2⤵
  PID:8696
- C:\Windows\System\ZovehYu.exe
  C:\Windows\System\ZovehYu.exe
  2⤵
  PID:8020
- C:\Windows\System\NoejgsM.exe
  C:\Windows\System\NoejgsM.exe
  2⤵
  PID:8984
- C:\Windows\System\yOCXYCE.exe
  C:\Windows\System\yOCXYCE.exe
  2⤵
  PID:8680
- C:\Windows\System\QWXCAcc.exe
  C:\Windows\System\QWXCAcc.exe
  2⤵
  PID:9112
- C:\Windows\System\SqshWJz.exe
  C:\Windows\System\SqshWJz.exe
  2⤵
  PID:9020
- C:\Windows\System\yKXhSUT.exe
  C:\Windows\System\yKXhSUT.exe
  2⤵
  PID:9084
- C:\Windows\System\BzifkmZ.exe
  C:\Windows\System\BzifkmZ.exe
  2⤵
  PID:9212
- C:\Windows\System\sDOyfzW.exe
  C:\Windows\System\sDOyfzW.exe
  2⤵
  PID:5392
- C:\Windows\System\pPVCorA.exe
  C:\Windows\System\pPVCorA.exe
  2⤵
  PID:8112
- C:\Windows\System\cECxxnL.exe
  C:\Windows\System\cECxxnL.exe
  2⤵
  PID:8284
- C:\Windows\System\CtJTeJO.exe
  C:\Windows\System\CtJTeJO.exe
  2⤵
  PID:8324
- C:\Windows\System\LvFsjjt.exe
  C:\Windows\System\LvFsjjt.exe
  2⤵
  PID:8308
- C:\Windows\System\EwqSUSG.exe
  C:\Windows\System\EwqSUSG.exe
  2⤵
  PID:8428
- C:\Windows\System\lcYwaJn.exe
  C:\Windows\System\lcYwaJn.exe
  2⤵
  PID:8344
- C:\Windows\System\SclNTWU.exe
  C:\Windows\System\SclNTWU.exe
  2⤵
  PID:8416
- C:\Windows\System\gwhUiWH.exe
  C:\Windows\System\gwhUiWH.exe
  2⤵
  PID:8468
- C:\Windows\System\Zycchua.exe
  C:\Windows\System\Zycchua.exe
  2⤵
  PID:8528
- C:\Windows\System\rNBfPAl.exe
  C:\Windows\System\rNBfPAl.exe
  2⤵
  PID:8560
- C:\Windows\System\gcLUJmV.exe
  C:\Windows\System\gcLUJmV.exe
  2⤵
  PID:8452
- C:\Windows\System\bmmegBU.exe
  C:\Windows\System\bmmegBU.exe
  2⤵
  PID:8752
- C:\Windows\System\vvcApbp.exe
  C:\Windows\System\vvcApbp.exe
  2⤵
  PID:8544
- C:\Windows\System\rDyGBNR.exe
  C:\Windows\System\rDyGBNR.exe
  2⤵
  PID:8600
- C:\Windows\System\KnIIjUI.exe
  C:\Windows\System\KnIIjUI.exe
  2⤵
  PID:8712
- C:\Windows\System\nxiemqj.exe
  C:\Windows\System\nxiemqj.exe
  2⤵
  PID:8640
- C:\Windows\System\NzqKOFI.exe
  C:\Windows\System\NzqKOFI.exe
  2⤵
  PID:8952
- C:\Windows\System\WdNuSqo.exe
  C:\Windows\System\WdNuSqo.exe
  2⤵
  PID:8864
- C:\Windows\System\muRCByp.exe
  C:\Windows\System\muRCByp.exe
  2⤵
  PID:8892
- C:\Windows\System\ImlwEAT.exe
  C:\Windows\System\ImlwEAT.exe
  2⤵
  PID:8812
- C:\Windows\System\qqlaBnm.exe
  C:\Windows\System\qqlaBnm.exe
  2⤵
  PID:8924
- C:\Windows\System\oZXLYYS.exe
  C:\Windows\System\oZXLYYS.exe
  2⤵
  PID:8844
- C:\Windows\System\CbEFLzM.exe
  C:\Windows\System\CbEFLzM.exe
  2⤵
  PID:9164
- C:\Windows\System\OlLFfwH.exe
  C:\Windows\System\OlLFfwH.exe
  2⤵
  PID:7732
- C:\Windows\System\mjrOjcK.exe
  C:\Windows\System\mjrOjcK.exe
  2⤵
  PID:8684
- C:\Windows\System\xMWhoVy.exe
  C:\Windows\System\xMWhoVy.exe
  2⤵
  PID:9208
- C:\Windows\System\xOwPAXe.exe
  C:\Windows\System\xOwPAXe.exe
  2⤵
  PID:8388
- C:\Windows\System\znlUSei.exe
  C:\Windows\System\znlUSei.exe
  2⤵
  PID:8348
- C:\Windows\System\DNTFuMK.exe
  C:\Windows\System\DNTFuMK.exe
  2⤵
  PID:8484
- C:\Windows\System\AlvTeZR.exe
  C:\Windows\System\AlvTeZR.exe
  2⤵
  PID:8660
- C:\Windows\System\NibmVSu.exe
  C:\Windows\System\NibmVSu.exe
  2⤵
  PID:7468
- C:\Windows\System\DmpIZir.exe
  C:\Windows\System\DmpIZir.exe
  2⤵
  PID:7924
- C:\Windows\System\ZRKECzG.exe
  C:\Windows\System\ZRKECzG.exe
  2⤵
  PID:8564
- C:\Windows\System\QlowISj.exe
  C:\Windows\System\QlowISj.exe
  2⤵
  PID:8548
- C:\Windows\System\UUvYmIq.exe
  C:\Windows\System\UUvYmIq.exe
  2⤵
  PID:8716
- C:\Windows\System\HAHIFCL.exe
  C:\Windows\System\HAHIFCL.exe
  2⤵
  PID:8896
- C:\Windows\System\ZoChhCI.exe
  C:\Windows\System\ZoChhCI.exe
  2⤵
  PID:8824
- C:\Windows\System\JyHhtEw.exe
  C:\Windows\System\JyHhtEw.exe
  2⤵
  PID:8848
- C:\Windows\System\fMaZqJd.exe
  C:\Windows\System\fMaZqJd.exe
  2⤵
  PID:8688
- C:\Windows\System\HfGvONG.exe
  C:\Windows\System\HfGvONG.exe
  2⤵
  PID:8496
- C:\Windows\System\CbtmCRl.exe
  C:\Windows\System\CbtmCRl.exe
  2⤵
  PID:9052
- C:\Windows\System\kcPdrei.exe
  C:\Windows\System\kcPdrei.exe
  2⤵
  PID:8480
- C:\Windows\System\iobinJO.exe
  C:\Windows\System\iobinJO.exe
  2⤵
  PID:9144
- C:\Windows\System\gZgyrCu.exe
  C:\Windows\System\gZgyrCu.exe
  2⤵
  PID:8668
- C:\Windows\System\SOAOOcS.exe
  C:\Windows\System\SOAOOcS.exe
  2⤵
  PID:8532
- C:\Windows\System\nqNGack.exe
  C:\Windows\System\nqNGack.exe
  2⤵
  PID:7588
- C:\Windows\System\MHheKVt.exe
  C:\Windows\System\MHheKVt.exe
  2⤵
  PID:9080
- C:\Windows\System\djHSnzg.exe
  C:\Windows\System\djHSnzg.exe
  2⤵
  PID:8252
- C:\Windows\System\FhJkmGU.exe
  C:\Windows\System\FhJkmGU.exe
  2⤵
  PID:8968
- C:\Windows\System\yrTmUoy.exe
  C:\Windows\System\yrTmUoy.exe
  2⤵
  PID:8764
- C:\Windows\System\TqVvHIM.exe
  C:\Windows\System\TqVvHIM.exe
  2⤵
  PID:8972
- C:\Windows\System\QKhSWTU.exe
  C:\Windows\System\QKhSWTU.exe
  2⤵
  PID:9220
- C:\Windows\System\fqkABFM.exe
  C:\Windows\System\fqkABFM.exe
  2⤵
  PID:9236
- C:\Windows\System\WaFNewf.exe
  C:\Windows\System\WaFNewf.exe
  2⤵
  PID:9252
- C:\Windows\System\bhibhhD.exe
  C:\Windows\System\bhibhhD.exe
  2⤵
  PID:9268
- C:\Windows\System\wOyImfO.exe
  C:\Windows\System\wOyImfO.exe
  2⤵
  PID:9284
- C:\Windows\System\zyWmYcY.exe
  C:\Windows\System\zyWmYcY.exe
  2⤵
  PID:9300
- C:\Windows\System\pOYSGgl.exe
  C:\Windows\System\pOYSGgl.exe
  2⤵
  PID:9316
- C:\Windows\System\gQFunXm.exe
  C:\Windows\System\gQFunXm.exe
  2⤵
  PID:9332
- C:\Windows\System\AxjwgAN.exe
  C:\Windows\System\AxjwgAN.exe
  2⤵
  PID:9348
- C:\Windows\System\EZQCgMJ.exe
  C:\Windows\System\EZQCgMJ.exe
  2⤵
  PID:9364
- C:\Windows\System\smOJrlu.exe
  C:\Windows\System\smOJrlu.exe
  2⤵
  PID:9380
- C:\Windows\System\zPxNFtC.exe
  C:\Windows\System\zPxNFtC.exe
  2⤵
  PID:9396
- C:\Windows\System\YoYjhtE.exe
  C:\Windows\System\YoYjhtE.exe
  2⤵
  PID:9412
- C:\Windows\System\DPbXinq.exe
  C:\Windows\System\DPbXinq.exe
  2⤵
  PID:9428
- C:\Windows\System\mTmkMWW.exe
  C:\Windows\System\mTmkMWW.exe
  2⤵
  PID:9444
- C:\Windows\System\eDHjNVr.exe
  C:\Windows\System\eDHjNVr.exe
  2⤵
  PID:9460
- C:\Windows\System\sHeyfnb.exe
  C:\Windows\System\sHeyfnb.exe
  2⤵
  PID:9476
- C:\Windows\System\muAvpzr.exe
  C:\Windows\System\muAvpzr.exe
  2⤵
  PID:9492
- C:\Windows\System\OdGhUUO.exe
  C:\Windows\System\OdGhUUO.exe
  2⤵
  PID:9508
- C:\Windows\System\fmLQaap.exe
  C:\Windows\System\fmLQaap.exe
  2⤵
  PID:9524
- C:\Windows\System\pDlsVsN.exe
  C:\Windows\System\pDlsVsN.exe
  2⤵
  PID:9540
- C:\Windows\System\Ftfhsty.exe
  C:\Windows\System\Ftfhsty.exe
  2⤵
  PID:9556
- C:\Windows\System\icgNeBN.exe
  C:\Windows\System\icgNeBN.exe
  2⤵
  PID:9572
- C:\Windows\System\iaYUeID.exe
  C:\Windows\System\iaYUeID.exe
  2⤵
  PID:9588
- C:\Windows\System\xePeUec.exe
  C:\Windows\System\xePeUec.exe
  2⤵
  PID:9604
- C:\Windows\System\rTcLfEF.exe
  C:\Windows\System\rTcLfEF.exe
  2⤵
  PID:9620
- C:\Windows\System\myHtZIB.exe
  C:\Windows\System\myHtZIB.exe
  2⤵
  PID:9636
- C:\Windows\System\TEsplRl.exe
  C:\Windows\System\TEsplRl.exe
  2⤵
  PID:9652
- C:\Windows\System\rOegLha.exe
  C:\Windows\System\rOegLha.exe
  2⤵
  PID:9668
- C:\Windows\System\BhcNNiB.exe
  C:\Windows\System\BhcNNiB.exe
  2⤵
  PID:9684
- C:\Windows\System\yYEmyVV.exe
  C:\Windows\System\yYEmyVV.exe
  2⤵
  PID:9700
- C:\Windows\System\BkIrFJJ.exe
  C:\Windows\System\BkIrFJJ.exe
  2⤵
  PID:9716
- C:\Windows\System\YZjtmep.exe
  C:\Windows\System\YZjtmep.exe
  2⤵
  PID:9732
- C:\Windows\System\zvXuTbR.exe
  C:\Windows\System\zvXuTbR.exe
  2⤵
  PID:9748
- C:\Windows\System\kWXtFgm.exe
  C:\Windows\System\kWXtFgm.exe
  2⤵
  PID:9764
- C:\Windows\System\UJKxSLT.exe
  C:\Windows\System\UJKxSLT.exe
  2⤵
  PID:9780
- C:\Windows\System\wqRDVlG.exe
  C:\Windows\System\wqRDVlG.exe
  2⤵
  PID:9796
- C:\Windows\System\lZjHcPm.exe
  C:\Windows\System\lZjHcPm.exe
  2⤵
  PID:9812
- C:\Windows\System\YaXzKuH.exe
  C:\Windows\System\YaXzKuH.exe
  2⤵
  PID:9828
- C:\Windows\System\FPysZUL.exe
  C:\Windows\System\FPysZUL.exe
  2⤵
  PID:9844
- C:\Windows\System\hGkttDP.exe
  C:\Windows\System\hGkttDP.exe
  2⤵
  PID:9860
- C:\Windows\System\NBTpZFi.exe
  C:\Windows\System\NBTpZFi.exe
  2⤵
  PID:9876
- C:\Windows\System\FzJHIkF.exe
  C:\Windows\System\FzJHIkF.exe
  2⤵
  PID:9892
- C:\Windows\System\lnVnuHr.exe
  C:\Windows\System\lnVnuHr.exe
  2⤵
  PID:9908
- C:\Windows\System\dKRunQF.exe
  C:\Windows\System\dKRunQF.exe
  2⤵
  PID:9924
- C:\Windows\System\dqTXDfP.exe
  C:\Windows\System\dqTXDfP.exe
  2⤵
  PID:9940
- C:\Windows\System\PGJHBQB.exe
  C:\Windows\System\PGJHBQB.exe
  2⤵
  PID:9956
- C:\Windows\System\sDZIuek.exe
  C:\Windows\System\sDZIuek.exe
  2⤵
  PID:9972
- C:\Windows\System\YORGOdX.exe
  C:\Windows\System\YORGOdX.exe
  2⤵
  PID:9988
- C:\Windows\System\xOdYtzw.exe
  C:\Windows\System\xOdYtzw.exe
  2⤵
  PID:10004
- C:\Windows\System\byjEGTq.exe
  C:\Windows\System\byjEGTq.exe
  2⤵
  PID:10020
- C:\Windows\System\RVBJHUs.exe
  C:\Windows\System\RVBJHUs.exe
  2⤵
  PID:10036
- C:\Windows\System\zPaueRM.exe
  C:\Windows\System\zPaueRM.exe
  2⤵
  PID:10052
- C:\Windows\System\mlhUjky.exe
  C:\Windows\System\mlhUjky.exe
  2⤵
  PID:10068
- C:\Windows\System\togKRtC.exe
  C:\Windows\System\togKRtC.exe
  2⤵
  PID:10084
- C:\Windows\System\qljQXjk.exe
  C:\Windows\System\qljQXjk.exe
  2⤵
  PID:10100
- C:\Windows\System\ppEBLde.exe
  C:\Windows\System\ppEBLde.exe
  2⤵
  PID:10116
- C:\Windows\System\pDjxUwD.exe
  C:\Windows\System\pDjxUwD.exe
  2⤵
  PID:10132
- C:\Windows\System\ViDtKhJ.exe
  C:\Windows\System\ViDtKhJ.exe
  2⤵
  PID:10148
- C:\Windows\System\LZIWvTy.exe
  C:\Windows\System\LZIWvTy.exe
  2⤵
  PID:10164
- C:\Windows\System\jfhuzqy.exe
  C:\Windows\System\jfhuzqy.exe
  2⤵
  PID:10180
- C:\Windows\System\Ariutot.exe
  C:\Windows\System\Ariutot.exe
  2⤵
  PID:10196
- C:\Windows\System\DcsnKTG.exe
  C:\Windows\System\DcsnKTG.exe
  2⤵
  PID:10212
- C:\Windows\System\pVscIyS.exe
  C:\Windows\System\pVscIyS.exe
  2⤵
  PID:10228
- C:\Windows\System\leEwVZA.exe
  C:\Windows\System\leEwVZA.exe
  2⤵
  PID:9232
- C:\Windows\System\VKPadNT.exe
  C:\Windows\System\VKPadNT.exe
  2⤵
  PID:9016
- C:\Windows\System\AmzKNYu.exe
  C:\Windows\System\AmzKNYu.exe
  2⤵
  PID:9296
- C:\Windows\System\iFMMGFg.exe
  C:\Windows\System\iFMMGFg.exe
  2⤵
  PID:8672
- C:\Windows\System\aYFGRCJ.exe
  C:\Windows\System\aYFGRCJ.exe
  2⤵
  PID:7632
- C:\Windows\System\TKPEvlu.exe
  C:\Windows\System\TKPEvlu.exe
  2⤵
  PID:9324
- C:\Windows\System\GdcLzOq.exe
  C:\Windows\System\GdcLzOq.exe
  2⤵
  PID:9312
- C:\Windows\System\uURxjQq.exe
  C:\Windows\System\uURxjQq.exe
  2⤵
  PID:9420
- C:\Windows\System\NINfWHm.exe
  C:\Windows\System\NINfWHm.exe
  2⤵
  PID:9452
- C:\Windows\System\qSMGoHm.exe
  C:\Windows\System\qSMGoHm.exe
  2⤵
  PID:9484
- C:\Windows\System\hWMZJua.exe
  C:\Windows\System\hWMZJua.exe
  2⤵
  PID:9516
- C:\Windows\System\SwTRkbg.exe
  C:\Windows\System\SwTRkbg.exe
  2⤵
  PID:9440
- C:\Windows\System\ovqnNch.exe
  C:\Windows\System\ovqnNch.exe
  2⤵
  PID:9472
- C:\Windows\System\lhHBQNf.exe
  C:\Windows\System\lhHBQNf.exe
  2⤵
  PID:9564
- C:\Windows\System\qeQBnQC.exe
  C:\Windows\System\qeQBnQC.exe
  2⤵
  PID:9612
- C:\Windows\System\NQxqldC.exe
  C:\Windows\System\NQxqldC.exe
  2⤵
  PID:9644
- C:\Windows\System\CTwpWFK.exe
  C:\Windows\System\CTwpWFK.exe
  2⤵
  PID:9676
- C:\Windows\System\IHCLwdK.exe
  C:\Windows\System\IHCLwdK.exe
  2⤵
  PID:9664
- C:\Windows\System\WxYJAok.exe
  C:\Windows\System\WxYJAok.exe
  2⤵
  PID:9744
- C:\Windows\System\agnIFcL.exe
  C:\Windows\System\agnIFcL.exe
  2⤵
  PID:9772
- C:\Windows\System\xMlzxnY.exe
  C:\Windows\System\xMlzxnY.exe
  2⤵
  PID:9804
- C:\Windows\System\WxIBugG.exe
  C:\Windows\System\WxIBugG.exe
  2⤵
  PID:9808
- C:\Windows\System\VQZgEBR.exe
  C:\Windows\System\VQZgEBR.exe
  2⤵
  PID:9868
- C:\Windows\System\MfqdgyI.exe
  C:\Windows\System\MfqdgyI.exe
  2⤵
  PID:9856
- C:\Windows\System\EyqMwWo.exe
  C:\Windows\System\EyqMwWo.exe
  2⤵
  PID:9932
- C:\Windows\System\JuHmFWX.exe
  C:\Windows\System\JuHmFWX.exe
  2⤵
  PID:9996
- C:\Windows\System\EXMbqvn.exe
  C:\Windows\System\EXMbqvn.exe
  2⤵
  PID:10064
- C:\Windows\System\MurrdVB.exe
  C:\Windows\System\MurrdVB.exe
  2⤵
  PID:9920
- C:\Windows\System\vWjKxBP.exe
  C:\Windows\System\vWjKxBP.exe
  2⤵
  PID:10048
- C:\Windows\System\mblyDhZ.exe
  C:\Windows\System\mblyDhZ.exe
  2⤵
  PID:10044
- C:\Windows\System\jbywEnP.exe
  C:\Windows\System\jbywEnP.exe
  2⤵
  PID:10108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BUBQPso.exe

Filesize
1.9MB

MD5
d58298f78a2037b6879a07e3ba82b25a

SHA1
e1f1eb37de0594d721bbc1b463542284f06deee5

SHA256
dd6086025211e55b457d517dfb0689a53b8ddc010bfca5cc08efe4bef057f540

SHA512
fe8fad4df06342c0edb3e8d0f7c62c45fb081a2780a619b99c34a9dcc6e8331030f1ed62a42e256c9fce5d79ecf32372b8725045d8d0d5d287f5999ee87faf50

Download Submit
C:\Windows\system\CfruuzB.exe

Filesize
1.9MB

MD5
e517ca4b9d20f0806af0a3955b292874

SHA1
8999c3e0a3a9afa12bbc32d7f35c2bc62412d72b

SHA256
0408a452a4ab8fed4d9b84aa41e346488086383d9896fe19ebb6b066724c722d

SHA512
be89b4f1ddb604756b4fdf650c5973a3f4a6ffe01eb3fc1e7e5d47d44177306c4c354b2ad556d4dd2a79352a1ffc5e0996bd690097897f73670c5beb089fc48d

Download Submit
C:\Windows\system\DWOnUij.exe

Filesize
1.9MB

MD5
8be1057ba7ed3f1b8c93cdf4bdbbfc76

SHA1
d0e0e3709f769e8d9e7a8e2be9795e214ca973ed

SHA256
d549ced526df3541d78999e23f756155cfffc9d2da64bef0cf217f64d72a3da0

SHA512
6ef372839284b2f5848ec3506e982ce228ee0422203d640152a5f5e404082b09ac2fe9729a8969ac88dd7ffb785e05e7ed5b7a0068e4feb954536ee7f6ae9d15

Download Submit
C:\Windows\system\EkOZfQU.exe

Filesize
1.9MB

MD5
a3da564d35b7dc5da36eaa84fb6cd04f

SHA1
76bf42234886d83135d68bb12e832a2c85ebee48

SHA256
b49c204143d47fc7d7604b832bff3ca06c800aff67ef605c664022ed7b837d5f

SHA512
3b9ccd7becf5f16c584868cfd29804f3c63c1a764bb509e993baed9c79f54c383aa173db02bd8da2e9e7ebb4bb8be95d8431b72319308b6b537a9020370fab55

Download Submit
C:\Windows\system\FiLkzZh.exe

Filesize
1.9MB

MD5
ce7a92f859f1e26b2abfa6f87962b6a8

SHA1
3462f3a330a7ba981b6fd94953027bc4ce480558

SHA256
fb318d3f23806bdc7082ea114581d9608daf39756da86da0344532f880cae961

SHA512
fe11b29a7aae618e53ae7435b943f934a61fc2559255a1540195b2629a7531e21337bba4951a4dd48e43597393ab1d01f1586a5e034486da9ba7d7b8195d16ff

Download Submit
C:\Windows\system\HaVBytd.exe

Filesize
1.9MB

MD5
c384a1fc19001072adb79b17cc8dc3d0

SHA1
14092f0a4893609dd42b10d741fb36e37989389a

SHA256
a610de5101d096db88707b0c53b941ce82cf3bb3a5f1c34a5d6097e3094c6a9c

SHA512
31aa504397263341ee6d376ac2512a57e9e2d66be407bf95f665904b0620f2f1b3cc3e017c1ffeea5e76b1a3412b6e27f750ef487ae4c1479e92692fb5919b75

Download Submit
C:\Windows\system\IlZVYvJ.exe

Filesize
1.9MB

MD5
2b7df86ccfa010245b44cb2de3a11c1a

SHA1
49148f0f5eed2f82c3218163b19eb6c3e31d869c

SHA256
7ad276f254ec36541cb9df9aa6fb89bd98d6f29792281df20e55dd2b2df6264e

SHA512
5ea98f1ad0cf9b01fcbb5fff2ce34fa661f753edc7155acb1c101c65fd14b5bf010278026a7cf9e1377e4ec2c1063c6124c5b6f6f96c33ebed3808a8ffd472f8

Download Submit
C:\Windows\system\JDiuxaJ.exe

Filesize
1.9MB

MD5
08e6a540fca79a49b68a56c01fb57a95

SHA1
b13afd23f1119da664fb626e7532427e527231fe

SHA256
40b50379d1230786611308df5a2a7013cf786d47bf6fcbe2695ac80ad303127e

SHA512
211e176c11576953cf627219e4d50d8bee3be9339c6721d09a6fb8ba690058bca1be1dceeffcce66b69384d88d0a229ebd70e98eaa6aa20a0f3905f75f53e15e

Download Submit
C:\Windows\system\JNiGBVE.exe

Filesize
1.9MB

MD5
b883b0223966e63360dbcc16896330cf

SHA1
c6a1c1f69f0619bd1cf484d6d2f2b76d59e0de48

SHA256
71fe1b7259c668442c480891bfc7bbdd6f6f36fc9e0db8804573209a04d5e061

SHA512
3170db7ad4a6bde93f49c418d84f353ecf92f4363fb53382dc312235c410d65259fe3c4dd1b16a4cbf6239a612775ab1e16729e6b34bbb088150b154beabfe51

Download Submit
C:\Windows\system\QSdwjoF.exe

Filesize
1.9MB

MD5
e2b2f6e4fe5806a139137200dbcb9583

SHA1
13ec80f139c8b7a99c3f0921024774933b979c05

SHA256
18fc0cb1ab89b10c4f49463ed16401c0133e48ff80fdb7cbc999e744879db3db

SHA512
41e33ee7a4ced27591c4e71aba6bb678b5d95668371ea6ba96c3c0ef44052c24861341b17420aa8a95f5bfb7f73e2c9673e72f22f1cfad443ff973018277d8a8

Download Submit
C:\Windows\system\SoTsrgL.exe

Filesize
1.9MB

MD5
3e6eaeffb2e0eff50adf6ff388e7eb82

SHA1
e69ec128c85e929c09daf3ce72de82483c93a6ea

SHA256
a301dc4279074c20e420e3e8644f805e3d55fe82bc1be73e32faa30d5d7ea3e2

SHA512
7d5273fdcc134725c19f93587438e8d540c701355bfd48dc25d88a2aa09bdf8a3059a0fe47cf48fcbcca5356c8d8706e354250174dadce8c0463cbbf7af69901

Download Submit
C:\Windows\system\TzMVMTj.exe

Filesize
1.9MB

MD5
ddbae56382fb1047e2dc2dd0411998b4

SHA1
3670b81eff57e4679a9098d564bad162938fa1a2

SHA256
31221708640f30f5d36cdfadf4bf1bbb340b38dccf65f14597313a62e00671e3

SHA512
e15b03467f8c84961823e0380deb863d871e3e8afa0d960f9224f4ce952651973224ecfc9d140dcf74be1791d40502a34c5bb2bd6f5ece418cda4687011bd626

Download Submit
C:\Windows\system\VTlnsOX.exe

Filesize
1.9MB

MD5
ca764f471c3736dd0b26d4c74306b6ae

SHA1
3ad989e4a94f0e296e79ae65bbab2cb5d165528e

SHA256
04eb4ada70354107835c80eafe289d808ee4bb953f12f0f1aed1f1793b15563d

SHA512
6ee6232ab56daa7737e2ace3acc02f8a3d49f8c546017817254d9fe2e54092397b601d48ffe3fc646644d9f4a28d21e2c9be0c098bd34bb17b27ea8508e48cb2

Download Submit
C:\Windows\system\VdZuXyH.exe

Filesize
1.9MB

MD5
663199e352499c2e091e20c60404f586

SHA1
0c5fe5f5e1cc36565e64c51a19d8a6887567c8ed

SHA256
5ba8ac3fe8e2c4fd4b9c8aa9b0a48ef1e073a085a159c2b8d28c03c2e7f88d52

SHA512
0511706440a2da5a5bd9c6e58a28d999c3e1504b58239d12740bae795dde974f166c56e7f3ec9873f365da1eb0e221f7cdf044b87664df20d9e365c5a03463dc

Download Submit
C:\Windows\system\YBmHXiC.exe

Filesize
1.9MB

MD5
49247d2227ca0e30499f7716555d60af

SHA1
9d75170a6c0e4110f90dbea2a463754d1220a941

SHA256
383ceaf1a59b7125f6696314160a98afa28c78caf63e5183b963b08ab0af8891

SHA512
6cc5b9015289fcfbc82bb3beb6486c88b045d28377670d64889917c13d8a1c955fbb89bf941fb5037afb840286239f61eded26f6d276b0f58f7f5b15c836daea

Download Submit
C:\Windows\system\cliyazi.exe

Filesize
1.9MB

MD5
19f51cca541bb797e9da76b6540a24d1

SHA1
9ff7c5564aa3be079588af58914732e7777243f4

SHA256
10efbbd62ea166c382364aec873c8a036ece60c93e8bc34505805e1d6aaff360

SHA512
59edfdf86b688dbefb9ab80c00d0e15071f48cdcc7b730d39b6c5f12c2c87a3dc8cffb2e59d0601c0888a608fa4829044e2a3869ac743e2badb281cb98063e1d

Download Submit
C:\Windows\system\czdNFKW.exe

Filesize
1.9MB

MD5
ae73034b023af8400fd519f834d5bb74

SHA1
335a6c39ab5fad75d7c9e34662656ddcbe9f8f34

SHA256
6a4ef5ab531ac39a69cc439b0e93259ef17a889e3b0f947c7a913da445c55537

SHA512
d9e0e28eb5b757f9ac3bbbee5b81a8dead7cf851f6ffff7b61bbcfbbc23de0a831d55e9cbc037348ad31e5e17ceceb706a29f946139db8e8f09479820a24e380

Download Submit
C:\Windows\system\hVzfYgO.exe

Filesize
1.9MB

MD5
630a91fee0e6882d38dd102f8d608d19

SHA1
6908fc41260628593c6481e135a1479838410f5d

SHA256
cb29ac9914da2203e09e3bb739c10b63d554d5e50d6b47de56d90e9ba90128e1

SHA512
4e32f43b9221b567d26e231c61f65572c9abcd1fa6639e248346dc50a96e4c7084bffe018145ee3f0337cd22646d96d942178ad342eaa6834c88f089a051c875

Download Submit
C:\Windows\system\hWXtBAi.exe

Filesize
1.9MB

MD5
51bb10aa044647e5575c38c186060b30

SHA1
1b0e475156c10acee40e048fdabdb4534de01771

SHA256
db3843d26d7226af2bf7a34c46c588a011bbbde462f506fc527c063d3ecd079f

SHA512
ba3c51ed55d23d27097c3f7375d82ed7ded760e6fca1570150b9f1c44eba8bcf4473fcb7b3c3e6ab7b3d6bf8a4c151b49fc06cd4e8acdfc2cfb122a8dc09e63d

Download Submit
C:\Windows\system\hdGPNlx.exe

Filesize
1.9MB

MD5
3c30f69affd501a5a7bb8977e2427b9a

SHA1
b99ac1db3be0eb037432170f4fdbfbd3f229a5c0

SHA256
2053a81156c8853cedc04d808abbc8ab326695f4876e660d7fa1270bbc504665

SHA512
5af84b650427f6d8dddf71cdfcc9df790c80559e813217dce52241e08108bab73b4b86d4a714ab22be99215420320401e0664754f27ac916ac4ce4a3cb590fed

Download Submit
C:\Windows\system\iZBvKuj.exe

Filesize
1.9MB

MD5
a54e99e8d58d482dc0052a5e736d3966

SHA1
d37c540e8f5b3e67919d713fa7959adae94de6a9

SHA256
8a18d435812b5f5e9bd8aa623a854c909e3404c219fbdfa37de5605655a98f6e

SHA512
5c9ff3bd07c9796175675cb54772e76d752971f67192ca9660f2df3130a6cf0c885fb85d469333fcf506f0a43ee470a2a25cf9649c232b6569743f4092610250

Download Submit
C:\Windows\system\kbQXxrw.exe

Filesize
1.9MB

MD5
99d7a5ce51a5cb993a81d3ec3755d9df

SHA1
b7a13770778eb6c9c367859f048e01dfd2005f54

SHA256
3a9b237211c953711b3247659683b1ed0650e45d27e0478e3090a76089b7e551

SHA512
bc069e9b15f00d8efbde490a391cb7784c4452e82705e712589bff84820217045bf7f4a85525a18f1d3a8d7c07621e83b9b57e50f1269d96778dade3ad7c24d6

Download Submit
C:\Windows\system\oCLMxMY.exe

Filesize
1.9MB

MD5
ec22fce5fe06102e5ce414b4e0f3d78c

SHA1
e1e7b80243c69dd2fbd7188b4139c2adcc1d2cbc

SHA256
5621f178d6e839c0cc4c9d5608921718dec21da85968a572a4335d590061b082

SHA512
5513fa5842c7b16c427e5b111f685913ab6cbb90df71b740b07d6da3c07cb233b93bdf37f0532e48aa1215c4016be875d1c6f5133268cb3d78967f0518a6fce9

Download Submit
C:\Windows\system\qhbnJhy.exe

Filesize
1.9MB

MD5
0d7583bcf99e456684a47a50229640c1

SHA1
12caa5c2f25394eed2be5b9245ac07a513bb5a77

SHA256
c1f444e4636a7f369fb528308d508982cf0c95b1da91938385160b16fb233d54

SHA512
ca8b3670e373351dba630e13ae40cd010e52bbade6d666e1811d59b70e9fb84b8af08ad05c69405311ec01acf3a9272ce5383b5f1500071a2d6370bffa27d418

Download Submit
C:\Windows\system\rSMFALB.exe

Filesize
1.9MB

MD5
08e49c622202959b1f9d75aa42217086

SHA1
9a5b7d4b6728ee159174f66da6a7d2059a607193

SHA256
21bc27b6cae8bef913196f89ced027b35005ea6645c4632ccb048807336a91af

SHA512
ee7cddc870ee4e160fddb1b6318530ea6c8161ae67622972fdf967770e0cde4ab27d9914254aff15f4735a9bcea4139469657c04d7d1c68f0d734d2e9bad4a79

Download Submit
C:\Windows\system\sFSKxvL.exe

Filesize
1.9MB

MD5
8fd3b8112be35e3ea2d925abace20abc

SHA1
772f5ad044d9a8b21d6e7fc57c6b12adf63f3ffa

SHA256
1686be71c004ab167486c856f63cf531b15efdf8cb7cbbe62749b33ba61e26fb

SHA512
4b60ce723c5fed58735194df7d89a9bd13eaea589d502b170728899c3b4c3ba1a68dbfcf9f79cd64cdd2005a39b16074e293097cd639bf10687311c9eb490a24

Download Submit
C:\Windows\system\vnhffbi.exe

Filesize
1.9MB

MD5
69c5a67e0f4e4c727024b558907ca7ef

SHA1
47ddde385a8e1fdd468960d7b41d76071979f045

SHA256
abb040248c583a35150eb512a6e01d89fd2e6adec292d4854d4080217a315a68

SHA512
25cc2f80d1cb4729e9c65fcb6aa6ac9a97a8ac98b7cbf860a9abef68fb6e868120e464924933a4de57868244fb05736d8c2bb7847771721bd370d3d5cc19199d

Download Submit
C:\Windows\system\weiCXKm.exe

Filesize
1.9MB

MD5
fca78f09907377a6194604699d91c29d

SHA1
48d7d8bef229af996f90a2e87c1a6657aed35cbe

SHA256
e0b3447e58be4748a895e0274dae456c5ebcef3a886b1ffc88fb675b3270b942

SHA512
b51575e8dbc9777ae7089fecf12cf8442c7167b651244f6f29c1534b8c05f9ac10d31b10c3c1b29be746c41ce314cb1240cfe29e03e3413b9bb850677e6dfe21

Download Submit
C:\Windows\system\wflWMWo.exe

Filesize
1.9MB

MD5
36e18b2be50c3a9045cf759cc2679b85

SHA1
00323ff17159767d4f3190043dd92ec5393e4879

SHA256
707485dbe3920c50c437e3d347b527ddcba693b7f1855c92744996e567120501

SHA512
007db7e5e3d7a6e10bc62c8ae9fa7d6ee27ed6a63b10a76577a349ccd56d2c4601a7e7c8bca5938be14da78a68358423e840dcee8f6c4ee17dd7529a9e87173b

Download Submit
C:\Windows\system\xJOkEXA.exe

Filesize
1.9MB

MD5
c57f68d1208bf1fb1f2ea1754e234e30

SHA1
c878f14d37d853c94fad5cdd39b9980531652ba5

SHA256
3a8e462453fd2214514697a7bdad2ca1732c67cb769ef0cbc6a0ec5a286d4774

SHA512
398739c631f9270f75a5b8a7b69d65da48333a1c9ffcc8cd8dd0215cacd434b13d72be3bd81048310870c325d0d8aa8ebf3277fb7ce5ceca11b1ad7db1213529

Download Submit
C:\Windows\system\yyVMvJw.exe

Filesize
1.9MB

MD5
36fe4c46ba4bc57404cfd843c8c7e161

SHA1
fe7d630386eea0693ca2cc06183d28b54c50a115

SHA256
ec644453bb34c47e37d40d19f96055f0a3b5652481b4939b48f1ae587fd82047

SHA512
c3f7d54450d668aa7c6a7e75fcd1fded3e5fc97878d48990b0ddd7daed9186d8d84e2d986b5f6d41779a32e4c825aaa5942590e57dc6da77e7697f9dac2a6ae2

Download Submit
C:\Windows\system\zjgXcNj.exe

Filesize
1.9MB

MD5
e95c53b619988fdc529949564f77da17

SHA1
547ce11bd786e40043b19c15f0fbaf42c52a72cf

SHA256
2f6cf0b66fea425cf65726535ba866ebc5228f54b9211c0a4899d5ebd4aa3098

SHA512
cf103d9d05d25b5e94e9141ff0431c552aa10b2363bcd2675770109b2977d0c98cbed12ccd3a2cb3b36828ac25c4826055d2853d1794b0d67b7fac7cb773e8cf

Download Submit
memory/1624-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download