xmrig | 0b16bdd0baaa95b063aa8b3ed16d4bac201ae9c20eadff6eaaefd1f1547a5834

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
Size

1.4MB
MD5

d7af9641a0ae4c9167a6c1e8dbdfa9e0
SHA1

03588685a6338ac7dc557696be212d65b3081e9d
SHA256

0b16bdd0baaa95b063aa8b3ed16d4bac201ae9c20eadff6eaaefd1f1547a5834
SHA512

0387109105c593d1a72204242bd411721d2f74407dbc11e0ac88c126389e1b01173c6a1a77ef40073785365a4609e5dbfb141e6f897dc0e1bac79e4be43df0fb
SSDEEP

24576:RVIl/WDGCi7/qkatuBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMaMYXzYCml3:ROdWCCi7/raU56uL3pgrCEd2hXkj+gsa

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/2724-74-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/2388-1072-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2572-1085-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	xmrig
behavioral1/memory/2540-400-0x000000013FF80000-0x00000001402D1000-memory.dmp	xmrig
behavioral1/memory/2540-110-0x0000000001E20000-0x0000000002171000-memory.dmp	xmrig
behavioral1/memory/332-109-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2540-97-0x0000000001E20000-0x0000000002171000-memory.dmp	xmrig
behavioral1/memory/2204-96-0x000000013FA10000-0x000000013FD61000-memory.dmp	xmrig
behavioral1/memory/2160-88-0x000000013FBC0000-0x000000013FF11000-memory.dmp	xmrig
behavioral1/memory/2632-86-0x000000013F630000-0x000000013F981000-memory.dmp	xmrig
behavioral1/memory/2788-68-0x000000013F9D0000-0x000000013FD21000-memory.dmp	xmrig
behavioral1/memory/2540-66-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/2452-64-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/2752-62-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2756-60-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig
behavioral1/memory/2572-28-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	xmrig
behavioral1/memory/2840-1790-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/1464-3737-0x000000013FF50000-0x00000001402A1000-memory.dmp	xmrig
behavioral1/memory/2452-3814-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/2756-3819-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig
behavioral1/memory/2388-3824-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2724-3823-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/2752-3826-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2788-3825-0x000000013F9D0000-0x000000013FD21000-memory.dmp	xmrig
behavioral1/memory/2160-3822-0x000000013FBC0000-0x000000013FF11000-memory.dmp	xmrig
behavioral1/memory/2840-3821-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/2204-3828-0x000000013FA10000-0x000000013FD61000-memory.dmp	xmrig
behavioral1/memory/2632-3829-0x000000013F630000-0x000000013F981000-memory.dmp	xmrig
behavioral1/memory/2824-3832-0x000000013FD50000-0x00000001400A1000-memory.dmp	xmrig
behavioral1/memory/2572-3831-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	xmrig
behavioral1/memory/332-3830-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
332	XrIUWlb.exe
2388	AzedPNC.exe
2572	vJDWwZS.exe
2452	APFqFdx.exe
2840	EMkdtEj.exe
2756	ccDirjX.exe
2752	oEqTSDZ.exe
2788	TKreFYc.exe
2824	amXXNgL.exe
2724	HYHABKa.exe
2632	DsIfpAe.exe
2160	YqdKXiq.exe
2204	NLwecvv.exe
1464	ShTnxIa.exe
1996	esidOyn.exe
1708	ryExork.exe
2008	hZxeLHS.exe
2040	POGczeR.exe
2032	ZWXTBjF.exe
1976	ZMaVRbz.exe
2344	vLzVjDV.exe
1520	PfVEmSu.exe
1668	fSgFDRM.exe
2668	ZfHxqaL.exe
1080	KvDUuRN.exe
2252	zfvKfjl.exe
2164	PXmDvON.exe
1636	afBLyWB.exe
1284	caeXkwk.exe
1824	kHrMBJN.exe
1180	HaxFlFu.exe
1588	iXmuYQN.exe
840	ADYfLLr.exe
944	xvNwLyT.exe
1480	ZUsssCZ.exe
1548	LQEJsGF.exe
3028	pCcsDEz.exe
3044	peYZJta.exe
2380	TiBcDbM.exe
2860	AZYqpFN.exe
1816	JCQsEdg.exe
2292	TAUQpoi.exe
1644	PCILdhb.exe
2264	mqLTcvp.exe
2124	YbOrZvM.exe
2236	rxRRpLE.exe
580	TADbxpU.exe
1612	WzyHWft.exe
1608	aKdPllU.exe
2132	maESlPL.exe
2820	ZifKkQy.exe
2112	rOfcnuq.exe
2856	LdVmPiW.exe
3008	hjWHbbo.exe
2140	PXhdllq.exe
2612	uYnZeox.exe
1884	RZcqnvq.exe
2072	NIMxNGA.exe
2116	RMZARiF.exe
1532	xCQQpyQ.exe
2352	QBKgTfi.exe
1204	EJIwMJI.exe
1224	VTKNVEF.exe
1568	bYhDSzQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x000000013FF80000-0x00000001402D1000-memory.dmp	upx
behavioral1/files/0x0007000000012118-3.dat	upx
behavioral1/files/0x0009000000016d46-6.dat	upx
behavioral1/memory/2540-10-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/files/0x0007000000016dc7-24.dat	upx
behavioral1/files/0x0006000000018c22-41.dat	upx
behavioral1/memory/2388-16-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/files/0x0006000000018f58-48.dat	upx
behavioral1/files/0x00060000000190d2-80.dat	upx
behavioral1/files/0x0006000000018c2c-70.dat	upx
behavioral1/memory/2724-74-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/memory/1464-98-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx
behavioral1/files/0x000500000001925a-120.dat	upx
behavioral1/files/0x0005000000019297-145.dat	upx
behavioral1/files/0x000500000001942a-180.dat	upx
behavioral1/memory/2388-1072-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2572-1085-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	upx
behavioral1/memory/2540-400-0x000000013FF80000-0x00000001402D1000-memory.dmp	upx
behavioral1/files/0x000500000001943e-190.dat	upx
behavioral1/files/0x000500000001942d-185.dat	upx
behavioral1/files/0x00050000000193ab-175.dat	upx
behavioral1/files/0x000500000001939d-170.dat	upx
behavioral1/files/0x0005000000019386-166.dat	upx
behavioral1/files/0x000500000001935b-155.dat	upx
behavioral1/files/0x0005000000019372-160.dat	upx
behavioral1/files/0x0005000000019358-151.dat	upx
behavioral1/files/0x000500000001928e-140.dat	upx
behavioral1/files/0x000500000001926a-135.dat	upx
behavioral1/files/0x0005000000019267-130.dat	upx
behavioral1/files/0x000500000001925d-125.dat	upx
behavioral1/files/0x0005000000019248-115.dat	upx
behavioral1/memory/332-109-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/files/0x0005000000019230-108.dat	upx
behavioral1/files/0x0005000000019207-103.dat	upx
behavioral1/memory/2204-96-0x000000013FA10000-0x000000013FD61000-memory.dmp	upx
behavioral1/files/0x00060000000190e5-91.dat	upx
behavioral1/memory/2160-88-0x000000013FBC0000-0x000000013FF11000-memory.dmp	upx
behavioral1/memory/2632-86-0x000000013F630000-0x000000013F981000-memory.dmp	upx
behavioral1/files/0x000600000001903f-76.dat	upx
behavioral1/files/0x00050000000191da-95.dat	upx
behavioral1/memory/2824-73-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/files/0x0007000000018798-69.dat	upx
behavioral1/memory/2788-68-0x000000013F9D0000-0x000000013FD21000-memory.dmp	upx
behavioral1/memory/2452-64-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/memory/2752-62-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2756-60-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2840-58-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/files/0x0007000000016ddb-40.dat	upx
behavioral1/files/0x0007000000016db0-39.dat	upx
behavioral1/memory/2572-28-0x000000013FAA0000-0x000000013FDF1000-memory.dmp	upx
behavioral1/memory/332-13-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/files/0x0008000000016d5a-8.dat	upx
behavioral1/memory/2840-1790-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/memory/1464-3737-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx
behavioral1/memory/2452-3814-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/memory/2756-3819-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2388-3824-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2724-3823-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/memory/2752-3826-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2788-3825-0x000000013F9D0000-0x000000013FD21000-memory.dmp	upx
behavioral1/memory/2160-3822-0x000000013FBC0000-0x000000013FF11000-memory.dmp	upx
behavioral1/memory/2840-3821-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/memory/2204-3828-0x000000013FA10000-0x000000013FD61000-memory.dmp	upx
behavioral1/memory/2632-3829-0x000000013F630000-0x000000013F981000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZqCODzc.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\pnPdjYA.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\mfmtUat.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\PXmDvON.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\AgPJrKu.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\upcbwlL.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\EiRMVRU.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\fjQhNzo.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\GhSlRCO.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\Ewsxkqa.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\dWCJlRO.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\JKfHbPa.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\oiiIFRO.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\KElYahc.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\SISndqf.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\gwTbWpc.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\XoLWHvF.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\ZwJzUex.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\iPbmMTY.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\xwfImzD.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\oxgEqnQ.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\ZxsVLKz.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\NWwuxCq.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\owQTyoE.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\tIzIlvt.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\diHwNGm.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\vgVDtKh.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\cMyRmmJ.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\nrWEGug.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\nrXBbML.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\gIkypDU.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\JycSjJJ.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\rATKYvy.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\LyIPYeN.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\FSiGYIh.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\DAvmEat.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\JzlSeAa.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\IdmfXhM.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\LdVmPiW.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\SwFLmJn.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\zatyqVm.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\wPfFfqu.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\QWCHfVM.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\ccDirjX.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\ycYGEyg.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\xYWeSag.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\qnYyOrT.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\TTOqzpZ.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\puMWFKr.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\nJDvfWx.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\TBulAyg.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\bHXsyit.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\lXOOupZ.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\PyGHxay.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\SkoxaYV.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\bolFwQC.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\jqAgiSU.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\rfpKZzh.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\CKoarXT.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\wXoxnIU.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\UbgrPsT.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\qYNYbyk.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\SpENfuT.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
File created	C:\Windows\System\BLJgRwd.exe	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 332	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	32
PID 2540 wrote to memory of 332	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	32
PID 2540 wrote to memory of 332	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	32
PID 2540 wrote to memory of 2388	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	33
PID 2540 wrote to memory of 2388	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	33
PID 2540 wrote to memory of 2388	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	33
PID 2540 wrote to memory of 2572	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	34
PID 2540 wrote to memory of 2572	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	34
PID 2540 wrote to memory of 2572	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	34
PID 2540 wrote to memory of 2452	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	35
PID 2540 wrote to memory of 2452	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	35
PID 2540 wrote to memory of 2452	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	35
PID 2540 wrote to memory of 2752	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	36
PID 2540 wrote to memory of 2752	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	36
PID 2540 wrote to memory of 2752	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	36
PID 2540 wrote to memory of 2840	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	37
PID 2540 wrote to memory of 2840	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	37
PID 2540 wrote to memory of 2840	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	37
PID 2540 wrote to memory of 2824	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	38
PID 2540 wrote to memory of 2824	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	38
PID 2540 wrote to memory of 2824	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	38
PID 2540 wrote to memory of 2756	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	39
PID 2540 wrote to memory of 2756	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	39
PID 2540 wrote to memory of 2756	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	39
PID 2540 wrote to memory of 2724	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	40
PID 2540 wrote to memory of 2724	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	40
PID 2540 wrote to memory of 2724	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	40
PID 2540 wrote to memory of 2788	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	41
PID 2540 wrote to memory of 2788	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	41
PID 2540 wrote to memory of 2788	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	41
PID 2540 wrote to memory of 2632	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	42
PID 2540 wrote to memory of 2632	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	42
PID 2540 wrote to memory of 2632	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	42
PID 2540 wrote to memory of 2160	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	43
PID 2540 wrote to memory of 2160	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	43
PID 2540 wrote to memory of 2160	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	43
PID 2540 wrote to memory of 2204	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	44
PID 2540 wrote to memory of 2204	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	44
PID 2540 wrote to memory of 2204	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	44
PID 2540 wrote to memory of 1464	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	45
PID 2540 wrote to memory of 1464	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	45
PID 2540 wrote to memory of 1464	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	45
PID 2540 wrote to memory of 1996	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	46
PID 2540 wrote to memory of 1996	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	46
PID 2540 wrote to memory of 1996	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	46
PID 2540 wrote to memory of 1708	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	47
PID 2540 wrote to memory of 1708	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	47
PID 2540 wrote to memory of 1708	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	47
PID 2540 wrote to memory of 2008	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	48
PID 2540 wrote to memory of 2008	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	48
PID 2540 wrote to memory of 2008	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	48
PID 2540 wrote to memory of 2040	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	49
PID 2540 wrote to memory of 2040	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	49
PID 2540 wrote to memory of 2040	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	49
PID 2540 wrote to memory of 2032	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	50
PID 2540 wrote to memory of 2032	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	50
PID 2540 wrote to memory of 2032	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	50
PID 2540 wrote to memory of 1976	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	51
PID 2540 wrote to memory of 1976	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	51
PID 2540 wrote to memory of 1976	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	51
PID 2540 wrote to memory of 2344	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	52
PID 2540 wrote to memory of 2344	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	52
PID 2540 wrote to memory of 2344	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	52
PID 2540 wrote to memory of 1520	2540	d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe	53

C:\Users\Admin\AppData\Local\Temp\d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe
"C:\Users\Admin\AppData\Local\Temp\d7af9641a0ae4c9167a6c1e8dbdfa9e0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System\XrIUWlb.exe
  C:\Windows\System\XrIUWlb.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\AzedPNC.exe
  C:\Windows\System\AzedPNC.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\vJDWwZS.exe
  C:\Windows\System\vJDWwZS.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\APFqFdx.exe
  C:\Windows\System\APFqFdx.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\oEqTSDZ.exe
  C:\Windows\System\oEqTSDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\EMkdtEj.exe
  C:\Windows\System\EMkdtEj.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\amXXNgL.exe
  C:\Windows\System\amXXNgL.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ccDirjX.exe
  C:\Windows\System\ccDirjX.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\HYHABKa.exe
  C:\Windows\System\HYHABKa.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\TKreFYc.exe
  C:\Windows\System\TKreFYc.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\DsIfpAe.exe
  C:\Windows\System\DsIfpAe.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\YqdKXiq.exe
  C:\Windows\System\YqdKXiq.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\NLwecvv.exe
  C:\Windows\System\NLwecvv.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ShTnxIa.exe
  C:\Windows\System\ShTnxIa.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\esidOyn.exe
  C:\Windows\System\esidOyn.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ryExork.exe
  C:\Windows\System\ryExork.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\hZxeLHS.exe
  C:\Windows\System\hZxeLHS.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\POGczeR.exe
  C:\Windows\System\POGczeR.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\ZWXTBjF.exe
  C:\Windows\System\ZWXTBjF.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ZMaVRbz.exe
  C:\Windows\System\ZMaVRbz.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\vLzVjDV.exe
  C:\Windows\System\vLzVjDV.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\PfVEmSu.exe
  C:\Windows\System\PfVEmSu.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fSgFDRM.exe
  C:\Windows\System\fSgFDRM.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ZfHxqaL.exe
  C:\Windows\System\ZfHxqaL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\KvDUuRN.exe
  C:\Windows\System\KvDUuRN.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\zfvKfjl.exe
  C:\Windows\System\zfvKfjl.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\PXmDvON.exe
  C:\Windows\System\PXmDvON.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\afBLyWB.exe
  C:\Windows\System\afBLyWB.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\caeXkwk.exe
  C:\Windows\System\caeXkwk.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\kHrMBJN.exe
  C:\Windows\System\kHrMBJN.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\HaxFlFu.exe
  C:\Windows\System\HaxFlFu.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\iXmuYQN.exe
  C:\Windows\System\iXmuYQN.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\ADYfLLr.exe
  C:\Windows\System\ADYfLLr.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\xvNwLyT.exe
  C:\Windows\System\xvNwLyT.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ZUsssCZ.exe
  C:\Windows\System\ZUsssCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\LQEJsGF.exe
  C:\Windows\System\LQEJsGF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\pCcsDEz.exe
  C:\Windows\System\pCcsDEz.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\peYZJta.exe
  C:\Windows\System\peYZJta.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\TiBcDbM.exe
  C:\Windows\System\TiBcDbM.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\AZYqpFN.exe
  C:\Windows\System\AZYqpFN.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\JCQsEdg.exe
  C:\Windows\System\JCQsEdg.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\TAUQpoi.exe
  C:\Windows\System\TAUQpoi.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\PCILdhb.exe
  C:\Windows\System\PCILdhb.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\mqLTcvp.exe
  C:\Windows\System\mqLTcvp.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\YbOrZvM.exe
  C:\Windows\System\YbOrZvM.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\rxRRpLE.exe
  C:\Windows\System\rxRRpLE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\TADbxpU.exe
  C:\Windows\System\TADbxpU.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\WzyHWft.exe
  C:\Windows\System\WzyHWft.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\aKdPllU.exe
  C:\Windows\System\aKdPllU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\maESlPL.exe
  C:\Windows\System\maESlPL.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\ZifKkQy.exe
  C:\Windows\System\ZifKkQy.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\rOfcnuq.exe
  C:\Windows\System\rOfcnuq.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\LdVmPiW.exe
  C:\Windows\System\LdVmPiW.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\hjWHbbo.exe
  C:\Windows\System\hjWHbbo.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\PXhdllq.exe
  C:\Windows\System\PXhdllq.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\uYnZeox.exe
  C:\Windows\System\uYnZeox.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\RZcqnvq.exe
  C:\Windows\System\RZcqnvq.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\NIMxNGA.exe
  C:\Windows\System\NIMxNGA.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\RMZARiF.exe
  C:\Windows\System\RMZARiF.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\xCQQpyQ.exe
  C:\Windows\System\xCQQpyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QBKgTfi.exe
  C:\Windows\System\QBKgTfi.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\EJIwMJI.exe
  C:\Windows\System\EJIwMJI.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\VTKNVEF.exe
  C:\Windows\System\VTKNVEF.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\bYhDSzQ.exe
  C:\Windows\System\bYhDSzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\vCWTbFt.exe
  C:\Windows\System\vCWTbFt.exe
  2⤵
  PID:1880
- C:\Windows\System\HFTrDeD.exe
  C:\Windows\System\HFTrDeD.exe
  2⤵
  PID:1088
- C:\Windows\System\XlrrBfc.exe
  C:\Windows\System\XlrrBfc.exe
  2⤵
  PID:3036
- C:\Windows\System\KfWDjyM.exe
  C:\Windows\System\KfWDjyM.exe
  2⤵
  PID:2456
- C:\Windows\System\wcHBbQL.exe
  C:\Windows\System\wcHBbQL.exe
  2⤵
  PID:2492
- C:\Windows\System\WUyfQsz.exe
  C:\Windows\System\WUyfQsz.exe
  2⤵
  PID:2000
- C:\Windows\System\GMcegzG.exe
  C:\Windows\System\GMcegzG.exe
  2⤵
  PID:2496
- C:\Windows\System\FCDlNKX.exe
  C:\Windows\System\FCDlNKX.exe
  2⤵
  PID:2268
- C:\Windows\System\LcLMfft.exe
  C:\Windows\System\LcLMfft.exe
  2⤵
  PID:3040
- C:\Windows\System\HFcCuSo.exe
  C:\Windows\System\HFcCuSo.exe
  2⤵
  PID:568
- C:\Windows\System\iUOmVFX.exe
  C:\Windows\System\iUOmVFX.exe
  2⤵
  PID:2284
- C:\Windows\System\BoqQYQW.exe
  C:\Windows\System\BoqQYQW.exe
  2⤵
  PID:1800
- C:\Windows\System\agKBLCE.exe
  C:\Windows\System\agKBLCE.exe
  2⤵
  PID:1504
- C:\Windows\System\nxihtoC.exe
  C:\Windows\System\nxihtoC.exe
  2⤵
  PID:1900
- C:\Windows\System\hhMgJPd.exe
  C:\Windows\System\hhMgJPd.exe
  2⤵
  PID:2764
- C:\Windows\System\IyQjiAK.exe
  C:\Windows\System\IyQjiAK.exe
  2⤵
  PID:2228
- C:\Windows\System\sYyLFOI.exe
  C:\Windows\System\sYyLFOI.exe
  2⤵
  PID:2836
- C:\Windows\System\DSHWRhy.exe
  C:\Windows\System\DSHWRhy.exe
  2⤵
  PID:1452
- C:\Windows\System\UaASlAU.exe
  C:\Windows\System\UaASlAU.exe
  2⤵
  PID:2460
- C:\Windows\System\mOcGixP.exe
  C:\Windows\System\mOcGixP.exe
  2⤵
  PID:2800
- C:\Windows\System\CKnfAPy.exe
  C:\Windows\System\CKnfAPy.exe
  2⤵
  PID:2512
- C:\Windows\System\MMCxuJy.exe
  C:\Windows\System\MMCxuJy.exe
  2⤵
  PID:2584
- C:\Windows\System\jlyMkrY.exe
  C:\Windows\System\jlyMkrY.exe
  2⤵
  PID:1328
- C:\Windows\System\CfTAxLX.exe
  C:\Windows\System\CfTAxLX.exe
  2⤵
  PID:2024
- C:\Windows\System\adjkeuw.exe
  C:\Windows\System\adjkeuw.exe
  2⤵
  PID:2940
- C:\Windows\System\hxlIzce.exe
  C:\Windows\System\hxlIzce.exe
  2⤵
  PID:2596
- C:\Windows\System\cnJLNuQ.exe
  C:\Windows\System\cnJLNuQ.exe
  2⤵
  PID:1820
- C:\Windows\System\ICCgkQO.exe
  C:\Windows\System\ICCgkQO.exe
  2⤵
  PID:2952
- C:\Windows\System\SZfPAMR.exe
  C:\Windows\System\SZfPAMR.exe
  2⤵
  PID:2564
- C:\Windows\System\StbNOJF.exe
  C:\Windows\System\StbNOJF.exe
  2⤵
  PID:3016
- C:\Windows\System\RrGiglL.exe
  C:\Windows\System\RrGiglL.exe
  2⤵
  PID:1008
- C:\Windows\System\KpBUuJy.exe
  C:\Windows\System\KpBUuJy.exe
  2⤵
  PID:588
- C:\Windows\System\pdatPaq.exe
  C:\Windows\System\pdatPaq.exe
  2⤵
  PID:2076
- C:\Windows\System\QojqYcn.exe
  C:\Windows\System\QojqYcn.exe
  2⤵
  PID:1576
- C:\Windows\System\MrpFxQF.exe
  C:\Windows\System\MrpFxQF.exe
  2⤵
  PID:2156
- C:\Windows\System\MeBmZXN.exe
  C:\Windows\System\MeBmZXN.exe
  2⤵
  PID:2892
- C:\Windows\System\qMEUiHp.exe
  C:\Windows\System\qMEUiHp.exe
  2⤵
  PID:2808
- C:\Windows\System\cpaKPxE.exe
  C:\Windows\System\cpaKPxE.exe
  2⤵
  PID:1752
- C:\Windows\System\OUtJPXa.exe
  C:\Windows\System\OUtJPXa.exe
  2⤵
  PID:3092
- C:\Windows\System\DWWRCdL.exe
  C:\Windows\System\DWWRCdL.exe
  2⤵
  PID:3112
- C:\Windows\System\lPCSLMq.exe
  C:\Windows\System\lPCSLMq.exe
  2⤵
  PID:3132
- C:\Windows\System\QhBahcP.exe
  C:\Windows\System\QhBahcP.exe
  2⤵
  PID:3152
- C:\Windows\System\HQGzPRR.exe
  C:\Windows\System\HQGzPRR.exe
  2⤵
  PID:3172
- C:\Windows\System\GAiNqOx.exe
  C:\Windows\System\GAiNqOx.exe
  2⤵
  PID:3192
- C:\Windows\System\ISxeQeT.exe
  C:\Windows\System\ISxeQeT.exe
  2⤵
  PID:3212
- C:\Windows\System\PWnstVP.exe
  C:\Windows\System\PWnstVP.exe
  2⤵
  PID:3232
- C:\Windows\System\fYlpmKL.exe
  C:\Windows\System\fYlpmKL.exe
  2⤵
  PID:3252
- C:\Windows\System\IdWcOfI.exe
  C:\Windows\System\IdWcOfI.exe
  2⤵
  PID:3272
- C:\Windows\System\HYqbOvA.exe
  C:\Windows\System\HYqbOvA.exe
  2⤵
  PID:3292
- C:\Windows\System\EuKhSWn.exe
  C:\Windows\System\EuKhSWn.exe
  2⤵
  PID:3312
- C:\Windows\System\vuutMqo.exe
  C:\Windows\System\vuutMqo.exe
  2⤵
  PID:3332
- C:\Windows\System\prRYefz.exe
  C:\Windows\System\prRYefz.exe
  2⤵
  PID:3352
- C:\Windows\System\XtwGWZz.exe
  C:\Windows\System\XtwGWZz.exe
  2⤵
  PID:3372
- C:\Windows\System\oOLiayt.exe
  C:\Windows\System\oOLiayt.exe
  2⤵
  PID:3392
- C:\Windows\System\nvtOjZh.exe
  C:\Windows\System\nvtOjZh.exe
  2⤵
  PID:3412
- C:\Windows\System\lcloUOf.exe
  C:\Windows\System\lcloUOf.exe
  2⤵
  PID:3432
- C:\Windows\System\mHbyUet.exe
  C:\Windows\System\mHbyUet.exe
  2⤵
  PID:3452
- C:\Windows\System\nUdhLRG.exe
  C:\Windows\System\nUdhLRG.exe
  2⤵
  PID:3472
- C:\Windows\System\etXvFkw.exe
  C:\Windows\System\etXvFkw.exe
  2⤵
  PID:3492
- C:\Windows\System\CqTjHBM.exe
  C:\Windows\System\CqTjHBM.exe
  2⤵
  PID:3512
- C:\Windows\System\dcdMHcJ.exe
  C:\Windows\System\dcdMHcJ.exe
  2⤵
  PID:3532
- C:\Windows\System\ZoOjSWY.exe
  C:\Windows\System\ZoOjSWY.exe
  2⤵
  PID:3552
- C:\Windows\System\ZznJmUU.exe
  C:\Windows\System\ZznJmUU.exe
  2⤵
  PID:3572
- C:\Windows\System\gfvoNHm.exe
  C:\Windows\System\gfvoNHm.exe
  2⤵
  PID:3588
- C:\Windows\System\heBIyFm.exe
  C:\Windows\System\heBIyFm.exe
  2⤵
  PID:3612
- C:\Windows\System\sFGNwtV.exe
  C:\Windows\System\sFGNwtV.exe
  2⤵
  PID:3632
- C:\Windows\System\JnufZti.exe
  C:\Windows\System\JnufZti.exe
  2⤵
  PID:3652
- C:\Windows\System\UZDevuo.exe
  C:\Windows\System\UZDevuo.exe
  2⤵
  PID:3672
- C:\Windows\System\aYPyAll.exe
  C:\Windows\System\aYPyAll.exe
  2⤵
  PID:3692
- C:\Windows\System\mBZrmfv.exe
  C:\Windows\System\mBZrmfv.exe
  2⤵
  PID:3712
- C:\Windows\System\ljuQRIA.exe
  C:\Windows\System\ljuQRIA.exe
  2⤵
  PID:3732
- C:\Windows\System\nrWEGug.exe
  C:\Windows\System\nrWEGug.exe
  2⤵
  PID:3752
- C:\Windows\System\nOUSbDf.exe
  C:\Windows\System\nOUSbDf.exe
  2⤵
  PID:3772
- C:\Windows\System\dPwaMkx.exe
  C:\Windows\System\dPwaMkx.exe
  2⤵
  PID:3792
- C:\Windows\System\eYPogQe.exe
  C:\Windows\System\eYPogQe.exe
  2⤵
  PID:3812
- C:\Windows\System\dDjPeRp.exe
  C:\Windows\System\dDjPeRp.exe
  2⤵
  PID:3832
- C:\Windows\System\hfXzNXu.exe
  C:\Windows\System\hfXzNXu.exe
  2⤵
  PID:3852
- C:\Windows\System\wHitawZ.exe
  C:\Windows\System\wHitawZ.exe
  2⤵
  PID:3868
- C:\Windows\System\mIzxVwB.exe
  C:\Windows\System\mIzxVwB.exe
  2⤵
  PID:3892
- C:\Windows\System\fqTmnLV.exe
  C:\Windows\System\fqTmnLV.exe
  2⤵
  PID:3912
- C:\Windows\System\XpjDccE.exe
  C:\Windows\System\XpjDccE.exe
  2⤵
  PID:3932
- C:\Windows\System\squReRE.exe
  C:\Windows\System\squReRE.exe
  2⤵
  PID:3952
- C:\Windows\System\QmhCYWs.exe
  C:\Windows\System\QmhCYWs.exe
  2⤵
  PID:3972
- C:\Windows\System\eCiyMqZ.exe
  C:\Windows\System\eCiyMqZ.exe
  2⤵
  PID:3992
- C:\Windows\System\bjhdVVY.exe
  C:\Windows\System\bjhdVVY.exe
  2⤵
  PID:4012
- C:\Windows\System\RtcLQnt.exe
  C:\Windows\System\RtcLQnt.exe
  2⤵
  PID:4028
- C:\Windows\System\HJomSdq.exe
  C:\Windows\System\HJomSdq.exe
  2⤵
  PID:4052
- C:\Windows\System\sPNgblP.exe
  C:\Windows\System\sPNgblP.exe
  2⤵
  PID:4072
- C:\Windows\System\PcANwmj.exe
  C:\Windows\System\PcANwmj.exe
  2⤵
  PID:4092
- C:\Windows\System\MneGKdQ.exe
  C:\Windows\System\MneGKdQ.exe
  2⤵
  PID:1960
- C:\Windows\System\hCebOfc.exe
  C:\Windows\System\hCebOfc.exe
  2⤵
  PID:1868
- C:\Windows\System\pmbbHhO.exe
  C:\Windows\System\pmbbHhO.exe
  2⤵
  PID:2976
- C:\Windows\System\tLgrYGC.exe
  C:\Windows\System\tLgrYGC.exe
  2⤵
  PID:1928
- C:\Windows\System\zoTBlcN.exe
  C:\Windows\System\zoTBlcN.exe
  2⤵
  PID:1756
- C:\Windows\System\zqPmYMX.exe
  C:\Windows\System\zqPmYMX.exe
  2⤵
  PID:1660
- C:\Windows\System\gmTvMgs.exe
  C:\Windows\System\gmTvMgs.exe
  2⤵
  PID:1476
- C:\Windows\System\hbBllJh.exe
  C:\Windows\System\hbBllJh.exe
  2⤵
  PID:2732
- C:\Windows\System\nQfDcbf.exe
  C:\Windows\System\nQfDcbf.exe
  2⤵
  PID:652
- C:\Windows\System\BVNWWDZ.exe
  C:\Windows\System\BVNWWDZ.exe
  2⤵
  PID:2828
- C:\Windows\System\zKjIsrH.exe
  C:\Windows\System\zKjIsrH.exe
  2⤵
  PID:3088
- C:\Windows\System\wtbMhDn.exe
  C:\Windows\System\wtbMhDn.exe
  2⤵
  PID:2980
- C:\Windows\System\zYlSwAU.exe
  C:\Windows\System\zYlSwAU.exe
  2⤵
  PID:3164
- C:\Windows\System\xMZAZaP.exe
  C:\Windows\System\xMZAZaP.exe
  2⤵
  PID:3180
- C:\Windows\System\YnCcLuK.exe
  C:\Windows\System\YnCcLuK.exe
  2⤵
  PID:3204
- C:\Windows\System\ACddEuv.exe
  C:\Windows\System\ACddEuv.exe
  2⤵
  PID:3248
- C:\Windows\System\TYgcMWU.exe
  C:\Windows\System\TYgcMWU.exe
  2⤵
  PID:3284
- C:\Windows\System\QoaksiA.exe
  C:\Windows\System\QoaksiA.exe
  2⤵
  PID:3300
- C:\Windows\System\ekSqNcn.exe
  C:\Windows\System\ekSqNcn.exe
  2⤵
  PID:3368
- C:\Windows\System\eFDELvv.exe
  C:\Windows\System\eFDELvv.exe
  2⤵
  PID:3400
- C:\Windows\System\YhhNvSZ.exe
  C:\Windows\System\YhhNvSZ.exe
  2⤵
  PID:3384
- C:\Windows\System\PNsBduc.exe
  C:\Windows\System\PNsBduc.exe
  2⤵
  PID:3424
- C:\Windows\System\HmgdScH.exe
  C:\Windows\System\HmgdScH.exe
  2⤵
  PID:3488
- C:\Windows\System\zfMyQAK.exe
  C:\Windows\System\zfMyQAK.exe
  2⤵
  PID:3508
- C:\Windows\System\dZeoPOz.exe
  C:\Windows\System\dZeoPOz.exe
  2⤵
  PID:3560
- C:\Windows\System\adclDNe.exe
  C:\Windows\System\adclDNe.exe
  2⤵
  PID:3544
- C:\Windows\System\fKcvvcv.exe
  C:\Windows\System\fKcvvcv.exe
  2⤵
  PID:3604
- C:\Windows\System\dYpaxms.exe
  C:\Windows\System\dYpaxms.exe
  2⤵
  PID:3680
- C:\Windows\System\OShomwx.exe
  C:\Windows\System\OShomwx.exe
  2⤵
  PID:3664
- C:\Windows\System\TEqkKnv.exe
  C:\Windows\System\TEqkKnv.exe
  2⤵
  PID:3724
- C:\Windows\System\nYoYScO.exe
  C:\Windows\System\nYoYScO.exe
  2⤵
  PID:3768
- C:\Windows\System\ajCxSLm.exe
  C:\Windows\System\ajCxSLm.exe
  2⤵
  PID:3800
- C:\Windows\System\zXtRYQs.exe
  C:\Windows\System\zXtRYQs.exe
  2⤵
  PID:608
- C:\Windows\System\FashMUM.exe
  C:\Windows\System\FashMUM.exe
  2⤵
  PID:3840
- C:\Windows\System\jzrzojb.exe
  C:\Windows\System\jzrzojb.exe
  2⤵
  PID:3884
- C:\Windows\System\nJDvfWx.exe
  C:\Windows\System\nJDvfWx.exe
  2⤵
  PID:3920
- C:\Windows\System\jjYgizn.exe
  C:\Windows\System\jjYgizn.exe
  2⤵
  PID:3900
- C:\Windows\System\ppJkRnt.exe
  C:\Windows\System\ppJkRnt.exe
  2⤵
  PID:3904
- C:\Windows\System\PmIJhIs.exe
  C:\Windows\System\PmIJhIs.exe
  2⤵
  PID:4004
- C:\Windows\System\oDUHrvW.exe
  C:\Windows\System\oDUHrvW.exe
  2⤵
  PID:3984
- C:\Windows\System\mJAGwBA.exe
  C:\Windows\System\mJAGwBA.exe
  2⤵
  PID:4080
- C:\Windows\System\phLcuNI.exe
  C:\Windows\System\phLcuNI.exe
  2⤵
  PID:2804
- C:\Windows\System\SHxPAxM.exe
  C:\Windows\System\SHxPAxM.exe
  2⤵
  PID:4060
- C:\Windows\System\xnFsdQA.exe
  C:\Windows\System\xnFsdQA.exe
  2⤵
  PID:4064
- C:\Windows\System\XzMRlSo.exe
  C:\Windows\System\XzMRlSo.exe
  2⤵
  PID:1592
- C:\Windows\System\MThIIBs.exe
  C:\Windows\System\MThIIBs.exe
  2⤵
  PID:1084
- C:\Windows\System\bHLWOwJ.exe
  C:\Windows\System\bHLWOwJ.exe
  2⤵
  PID:2852
- C:\Windows\System\eldOJvT.exe
  C:\Windows\System\eldOJvT.exe
  2⤵
  PID:1160
- C:\Windows\System\QAviddi.exe
  C:\Windows\System\QAviddi.exe
  2⤵
  PID:2868
- C:\Windows\System\xuajbkx.exe
  C:\Windows\System\xuajbkx.exe
  2⤵
  PID:1500
- C:\Windows\System\FPRVSxf.exe
  C:\Windows\System\FPRVSxf.exe
  2⤵
  PID:2888
- C:\Windows\System\ixGqUcY.exe
  C:\Windows\System\ixGqUcY.exe
  2⤵
  PID:3080
- C:\Windows\System\IiSbJDa.exe
  C:\Windows\System\IiSbJDa.exe
  2⤵
  PID:3124
- C:\Windows\System\greoysI.exe
  C:\Windows\System\greoysI.exe
  2⤵
  PID:3200
- C:\Windows\System\flJMhio.exe
  C:\Windows\System\flJMhio.exe
  2⤵
  PID:1888
- C:\Windows\System\dexBxFk.exe
  C:\Windows\System\dexBxFk.exe
  2⤵
  PID:3168
- C:\Windows\System\PtDcbaP.exe
  C:\Windows\System\PtDcbaP.exe
  2⤵
  PID:3288
- C:\Windows\System\acUGntt.exe
  C:\Windows\System\acUGntt.exe
  2⤵
  PID:3444
- C:\Windows\System\FfdQkWu.exe
  C:\Windows\System\FfdQkWu.exe
  2⤵
  PID:676
- C:\Windows\System\GgufZMi.exe
  C:\Windows\System\GgufZMi.exe
  2⤵
  PID:3408
- C:\Windows\System\xzKEXMS.exe
  C:\Windows\System\xzKEXMS.exe
  2⤵
  PID:1168
- C:\Windows\System\rerNONX.exe
  C:\Windows\System\rerNONX.exe
  2⤵
  PID:3460
- C:\Windows\System\VeyYEbQ.exe
  C:\Windows\System\VeyYEbQ.exe
  2⤵
  PID:3596
- C:\Windows\System\TlSZrxg.exe
  C:\Windows\System\TlSZrxg.exe
  2⤵
  PID:3620
- C:\Windows\System\VEdkZzS.exe
  C:\Windows\System\VEdkZzS.exe
  2⤵
  PID:3648
- C:\Windows\System\tAucDVE.exe
  C:\Windows\System\tAucDVE.exe
  2⤵
  PID:3728
- C:\Windows\System\eDuFtgI.exe
  C:\Windows\System\eDuFtgI.exe
  2⤵
  PID:3660
- C:\Windows\System\OkjunMZ.exe
  C:\Windows\System\OkjunMZ.exe
  2⤵
  PID:3708
- C:\Windows\System\kdXnNbr.exe
  C:\Windows\System\kdXnNbr.exe
  2⤵
  PID:3764
- C:\Windows\System\xaCvObW.exe
  C:\Windows\System\xaCvObW.exe
  2⤵
  PID:3804
- C:\Windows\System\cTfOJTb.exe
  C:\Windows\System\cTfOJTb.exe
  2⤵
  PID:3888
- C:\Windows\System\enYTNbO.exe
  C:\Windows\System\enYTNbO.exe
  2⤵
  PID:3788
- C:\Windows\System\REjVzPb.exe
  C:\Windows\System\REjVzPb.exe
  2⤵
  PID:3968
- C:\Windows\System\UrraWAG.exe
  C:\Windows\System\UrraWAG.exe
  2⤵
  PID:796
- C:\Windows\System\DnWoAyg.exe
  C:\Windows\System\DnWoAyg.exe
  2⤵
  PID:1100
- C:\Windows\System\gNMwroS.exe
  C:\Windows\System\gNMwroS.exe
  2⤵
  PID:3980
- C:\Windows\System\RhxbVuH.exe
  C:\Windows\System\RhxbVuH.exe
  2⤵
  PID:3948
- C:\Windows\System\UQSRkJH.exe
  C:\Windows\System\UQSRkJH.exe
  2⤵
  PID:1916
- C:\Windows\System\nihXXoh.exe
  C:\Windows\System\nihXXoh.exe
  2⤵
  PID:772
- C:\Windows\System\fFBuqTz.exe
  C:\Windows\System\fFBuqTz.exe
  2⤵
  PID:844
- C:\Windows\System\zTNGvxZ.exe
  C:\Windows\System\zTNGvxZ.exe
  2⤵
  PID:1988
- C:\Windows\System\nMwcBMv.exe
  C:\Windows\System\nMwcBMv.exe
  2⤵
  PID:1948
- C:\Windows\System\iUidZig.exe
  C:\Windows\System\iUidZig.exe
  2⤵
  PID:2628
- C:\Windows\System\ZbQTRts.exe
  C:\Windows\System\ZbQTRts.exe
  2⤵
  PID:1152
- C:\Windows\System\kUnsLiC.exe
  C:\Windows\System\kUnsLiC.exe
  2⤵
  PID:2660
- C:\Windows\System\yfcPZit.exe
  C:\Windows\System\yfcPZit.exe
  2⤵
  PID:3224
- C:\Windows\System\sOJNVOu.exe
  C:\Windows\System\sOJNVOu.exe
  2⤵
  PID:3344
- C:\Windows\System\AnrvgNC.exe
  C:\Windows\System\AnrvgNC.exe
  2⤵
  PID:3420
- C:\Windows\System\OERfYoM.exe
  C:\Windows\System\OERfYoM.exe
  2⤵
  PID:3480
- C:\Windows\System\vjEpqIJ.exe
  C:\Windows\System\vjEpqIJ.exe
  2⤵
  PID:724
- C:\Windows\System\wlvYCEO.exe
  C:\Windows\System\wlvYCEO.exe
  2⤵
  PID:3268
- C:\Windows\System\YiyezLH.exe
  C:\Windows\System\YiyezLH.exe
  2⤵
  PID:2816
- C:\Windows\System\tykohxc.exe
  C:\Windows\System\tykohxc.exe
  2⤵
  PID:4008
- C:\Windows\System\DBjtbSr.exe
  C:\Windows\System\DBjtbSr.exe
  2⤵
  PID:1068
- C:\Windows\System\ienEHLK.exe
  C:\Windows\System\ienEHLK.exe
  2⤵
  PID:3824
- C:\Windows\System\iIauaQm.exe
  C:\Windows\System\iIauaQm.exe
  2⤵
  PID:4040
- C:\Windows\System\ltTJBtK.exe
  C:\Windows\System\ltTJBtK.exe
  2⤵
  PID:2036
- C:\Windows\System\tmXEacE.exe
  C:\Windows\System\tmXEacE.exe
  2⤵
  PID:2428
- C:\Windows\System\kkHlyIJ.exe
  C:\Windows\System\kkHlyIJ.exe
  2⤵
  PID:1164
- C:\Windows\System\HeHLyhe.exe
  C:\Windows\System\HeHLyhe.exe
  2⤵
  PID:3280
- C:\Windows\System\DczWvbk.exe
  C:\Windows\System\DczWvbk.exe
  2⤵
  PID:3608
- C:\Windows\System\gPkoyVl.exe
  C:\Windows\System\gPkoyVl.exe
  2⤵
  PID:3600
- C:\Windows\System\nQDRUWT.exe
  C:\Windows\System\nQDRUWT.exe
  2⤵
  PID:3360
- C:\Windows\System\CqjNNQI.exe
  C:\Windows\System\CqjNNQI.exe
  2⤵
  PID:2028
- C:\Windows\System\SkkEfZn.exe
  C:\Windows\System\SkkEfZn.exe
  2⤵
  PID:3944
- C:\Windows\System\SWLthSk.exe
  C:\Windows\System\SWLthSk.exe
  2⤵
  PID:904
- C:\Windows\System\bLgvXYS.exe
  C:\Windows\System\bLgvXYS.exe
  2⤵
  PID:3228
- C:\Windows\System\CpqzNzP.exe
  C:\Windows\System\CpqzNzP.exe
  2⤵
  PID:1932
- C:\Windows\System\feQedkp.exe
  C:\Windows\System\feQedkp.exe
  2⤵
  PID:3924
- C:\Windows\System\uUlScJX.exe
  C:\Windows\System\uUlScJX.exe
  2⤵
  PID:792
- C:\Windows\System\RacyLiW.exe
  C:\Windows\System\RacyLiW.exe
  2⤵
  PID:3264
- C:\Windows\System\RiAtANe.exe
  C:\Windows\System\RiAtANe.exe
  2⤵
  PID:1904
- C:\Windows\System\ucwieGM.exe
  C:\Windows\System\ucwieGM.exe
  2⤵
  PID:1556
- C:\Windows\System\owMxNFc.exe
  C:\Windows\System\owMxNFc.exe
  2⤵
  PID:1760
- C:\Windows\System\dwMNPYL.exe
  C:\Windows\System\dwMNPYL.exe
  2⤵
  PID:1620
- C:\Windows\System\kfcJmnr.exe
  C:\Windows\System\kfcJmnr.exe
  2⤵
  PID:3148
- C:\Windows\System\EfHwSNS.exe
  C:\Windows\System\EfHwSNS.exe
  2⤵
  PID:1496
- C:\Windows\System\xMKtdbC.exe
  C:\Windows\System\xMKtdbC.exe
  2⤵
  PID:2896
- C:\Windows\System\ZqdLWak.exe
  C:\Windows\System\ZqdLWak.exe
  2⤵
  PID:3328
- C:\Windows\System\XlwhExO.exe
  C:\Windows\System\XlwhExO.exe
  2⤵
  PID:3784
- C:\Windows\System\TWjzrUm.exe
  C:\Windows\System\TWjzrUm.exe
  2⤵
  PID:3004
- C:\Windows\System\qqVCiqD.exe
  C:\Windows\System\qqVCiqD.exe
  2⤵
  PID:1036
- C:\Windows\System\QgNIlFe.exe
  C:\Windows\System\QgNIlFe.exe
  2⤵
  PID:4108
- C:\Windows\System\azFJScc.exe
  C:\Windows\System\azFJScc.exe
  2⤵
  PID:4192
- C:\Windows\System\FTdjgdO.exe
  C:\Windows\System\FTdjgdO.exe
  2⤵
  PID:4208
- C:\Windows\System\uFznUtH.exe
  C:\Windows\System\uFznUtH.exe
  2⤵
  PID:4224
- C:\Windows\System\XkCwSHO.exe
  C:\Windows\System\XkCwSHO.exe
  2⤵
  PID:4240
- C:\Windows\System\XCArnjf.exe
  C:\Windows\System\XCArnjf.exe
  2⤵
  PID:4256
- C:\Windows\System\TMfSkHR.exe
  C:\Windows\System\TMfSkHR.exe
  2⤵
  PID:4272
- C:\Windows\System\qmlNvtZ.exe
  C:\Windows\System\qmlNvtZ.exe
  2⤵
  PID:4288
- C:\Windows\System\ueYMfbx.exe
  C:\Windows\System\ueYMfbx.exe
  2⤵
  PID:4304
- C:\Windows\System\lAseeMg.exe
  C:\Windows\System\lAseeMg.exe
  2⤵
  PID:4320
- C:\Windows\System\BCYnjow.exe
  C:\Windows\System\BCYnjow.exe
  2⤵
  PID:4340
- C:\Windows\System\SwFLmJn.exe
  C:\Windows\System\SwFLmJn.exe
  2⤵
  PID:4356
- C:\Windows\System\hyOgmgW.exe
  C:\Windows\System\hyOgmgW.exe
  2⤵
  PID:4372
- C:\Windows\System\hcIsmEt.exe
  C:\Windows\System\hcIsmEt.exe
  2⤵
  PID:4388
- C:\Windows\System\oOgbzEZ.exe
  C:\Windows\System\oOgbzEZ.exe
  2⤵
  PID:4404
- C:\Windows\System\gfRzBRg.exe
  C:\Windows\System\gfRzBRg.exe
  2⤵
  PID:4420
- C:\Windows\System\aRgzyoT.exe
  C:\Windows\System\aRgzyoT.exe
  2⤵
  PID:4436
- C:\Windows\System\GZRcVKe.exe
  C:\Windows\System\GZRcVKe.exe
  2⤵
  PID:4452
- C:\Windows\System\rfpKZzh.exe
  C:\Windows\System\rfpKZzh.exe
  2⤵
  PID:4468
- C:\Windows\System\easQGuJ.exe
  C:\Windows\System\easQGuJ.exe
  2⤵
  PID:4484
- C:\Windows\System\fRPmwrB.exe
  C:\Windows\System\fRPmwrB.exe
  2⤵
  PID:4500
- C:\Windows\System\GStiijJ.exe
  C:\Windows\System\GStiijJ.exe
  2⤵
  PID:4516
- C:\Windows\System\FUOkmsr.exe
  C:\Windows\System\FUOkmsr.exe
  2⤵
  PID:4532
- C:\Windows\System\gUWxlgb.exe
  C:\Windows\System\gUWxlgb.exe
  2⤵
  PID:4548
- C:\Windows\System\FSXWMKc.exe
  C:\Windows\System\FSXWMKc.exe
  2⤵
  PID:4564
- C:\Windows\System\WYHOrEd.exe
  C:\Windows\System\WYHOrEd.exe
  2⤵
  PID:4580
- C:\Windows\System\TBrWEmN.exe
  C:\Windows\System\TBrWEmN.exe
  2⤵
  PID:4596
- C:\Windows\System\ZfgDHIk.exe
  C:\Windows\System\ZfgDHIk.exe
  2⤵
  PID:4612
- C:\Windows\System\DVhmcNX.exe
  C:\Windows\System\DVhmcNX.exe
  2⤵
  PID:4628
- C:\Windows\System\rgemhVq.exe
  C:\Windows\System\rgemhVq.exe
  2⤵
  PID:4644
- C:\Windows\System\aVuiAeF.exe
  C:\Windows\System\aVuiAeF.exe
  2⤵
  PID:4660
- C:\Windows\System\hFDpQhh.exe
  C:\Windows\System\hFDpQhh.exe
  2⤵
  PID:4676
- C:\Windows\System\thfTimL.exe
  C:\Windows\System\thfTimL.exe
  2⤵
  PID:4692
- C:\Windows\System\tbcOlJm.exe
  C:\Windows\System\tbcOlJm.exe
  2⤵
  PID:4708
- C:\Windows\System\KxPCVBh.exe
  C:\Windows\System\KxPCVBh.exe
  2⤵
  PID:4728
- C:\Windows\System\mspXNXK.exe
  C:\Windows\System\mspXNXK.exe
  2⤵
  PID:4744
- C:\Windows\System\XfwsgYa.exe
  C:\Windows\System\XfwsgYa.exe
  2⤵
  PID:4760
- C:\Windows\System\xSXVvQR.exe
  C:\Windows\System\xSXVvQR.exe
  2⤵
  PID:4776
- C:\Windows\System\YnAWePG.exe
  C:\Windows\System\YnAWePG.exe
  2⤵
  PID:4792
- C:\Windows\System\rVtSZGx.exe
  C:\Windows\System\rVtSZGx.exe
  2⤵
  PID:4812
- C:\Windows\System\QfEeFdp.exe
  C:\Windows\System\QfEeFdp.exe
  2⤵
  PID:4828
- C:\Windows\System\FGSbcKn.exe
  C:\Windows\System\FGSbcKn.exe
  2⤵
  PID:4844
- C:\Windows\System\sefTuuo.exe
  C:\Windows\System\sefTuuo.exe
  2⤵
  PID:4860
- C:\Windows\System\zTXfduH.exe
  C:\Windows\System\zTXfduH.exe
  2⤵
  PID:4876
- C:\Windows\System\WJeKnVT.exe
  C:\Windows\System\WJeKnVT.exe
  2⤵
  PID:4892
- C:\Windows\System\AVscFNZ.exe
  C:\Windows\System\AVscFNZ.exe
  2⤵
  PID:4908
- C:\Windows\System\IenSCHW.exe
  C:\Windows\System\IenSCHW.exe
  2⤵
  PID:4928
- C:\Windows\System\NSVyJtj.exe
  C:\Windows\System\NSVyJtj.exe
  2⤵
  PID:4944
- C:\Windows\System\ogfQMtL.exe
  C:\Windows\System\ogfQMtL.exe
  2⤵
  PID:4960
- C:\Windows\System\AKBRJgv.exe
  C:\Windows\System\AKBRJgv.exe
  2⤵
  PID:4976
- C:\Windows\System\PXAkosk.exe
  C:\Windows\System\PXAkosk.exe
  2⤵
  PID:4992
- C:\Windows\System\QOFaqUR.exe
  C:\Windows\System\QOFaqUR.exe
  2⤵
  PID:5008
- C:\Windows\System\McKJSyV.exe
  C:\Windows\System\McKJSyV.exe
  2⤵
  PID:5024
- C:\Windows\System\nrqlRrj.exe
  C:\Windows\System\nrqlRrj.exe
  2⤵
  PID:5040
- C:\Windows\System\gnormkz.exe
  C:\Windows\System\gnormkz.exe
  2⤵
  PID:5056
- C:\Windows\System\BIhQXvF.exe
  C:\Windows\System\BIhQXvF.exe
  2⤵
  PID:5072
- C:\Windows\System\kOPvWqy.exe
  C:\Windows\System\kOPvWqy.exe
  2⤵
  PID:5088
- C:\Windows\System\UIFMDKu.exe
  C:\Windows\System\UIFMDKu.exe
  2⤵
  PID:5108
- C:\Windows\System\jIBSItd.exe
  C:\Windows\System\jIBSItd.exe
  2⤵
  PID:3440
- C:\Windows\System\GeKMKlK.exe
  C:\Windows\System\GeKMKlK.exe
  2⤵
  PID:968
- C:\Windows\System\hvEaGsx.exe
  C:\Windows\System\hvEaGsx.exe
  2⤵
  PID:4104
- C:\Windows\System\tAwjwoO.exe
  C:\Windows\System\tAwjwoO.exe
  2⤵
  PID:4124
- C:\Windows\System\ebGmjfm.exe
  C:\Windows\System\ebGmjfm.exe
  2⤵
  PID:1716
- C:\Windows\System\PfRGYnh.exe
  C:\Windows\System\PfRGYnh.exe
  2⤵
  PID:4148
- C:\Windows\System\DDCGkQg.exe
  C:\Windows\System\DDCGkQg.exe
  2⤵
  PID:4160
- C:\Windows\System\MOPHZlc.exe
  C:\Windows\System\MOPHZlc.exe
  2⤵
  PID:4176
- C:\Windows\System\RcxEPhN.exe
  C:\Windows\System\RcxEPhN.exe
  2⤵
  PID:4200
- C:\Windows\System\BAbjXnB.exe
  C:\Windows\System\BAbjXnB.exe
  2⤵
  PID:4248
- C:\Windows\System\SFVFeYZ.exe
  C:\Windows\System\SFVFeYZ.exe
  2⤵
  PID:4284
- C:\Windows\System\yxvzelt.exe
  C:\Windows\System\yxvzelt.exe
  2⤵
  PID:4296
- C:\Windows\System\AfngOzV.exe
  C:\Windows\System\AfngOzV.exe
  2⤵
  PID:4236
- C:\Windows\System\Nqaxvlu.exe
  C:\Windows\System\Nqaxvlu.exe
  2⤵
  PID:4412
- C:\Windows\System\ipfGsdk.exe
  C:\Windows\System\ipfGsdk.exe
  2⤵
  PID:4364
- C:\Windows\System\yIQWEpr.exe
  C:\Windows\System\yIQWEpr.exe
  2⤵
  PID:4476
- C:\Windows\System\BtStfRj.exe
  C:\Windows\System\BtStfRj.exe
  2⤵
  PID:4396
- C:\Windows\System\TKAQrqz.exe
  C:\Windows\System\TKAQrqz.exe
  2⤵
  PID:4496
- C:\Windows\System\IxjzSqV.exe
  C:\Windows\System\IxjzSqV.exe
  2⤵
  PID:4528
- C:\Windows\System\hKZutsE.exe
  C:\Windows\System\hKZutsE.exe
  2⤵
  PID:4460
- C:\Windows\System\UUxuCbL.exe
  C:\Windows\System\UUxuCbL.exe
  2⤵
  PID:4576
- C:\Windows\System\xvAYwky.exe
  C:\Windows\System\xvAYwky.exe
  2⤵
  PID:4608
- C:\Windows\System\xVYodxB.exe
  C:\Windows\System\xVYodxB.exe
  2⤵
  PID:4668
- C:\Windows\System\pLvYHxb.exe
  C:\Windows\System\pLvYHxb.exe
  2⤵
  PID:4688
- C:\Windows\System\VOhoKol.exe
  C:\Windows\System\VOhoKol.exe
  2⤵
  PID:4736
- C:\Windows\System\UkPBAfK.exe
  C:\Windows\System\UkPBAfK.exe
  2⤵
  PID:4656
- C:\Windows\System\hzDNjnm.exe
  C:\Windows\System\hzDNjnm.exe
  2⤵
  PID:4624
- C:\Windows\System\kYSvUqq.exe
  C:\Windows\System\kYSvUqq.exe
  2⤵
  PID:4752
- C:\Windows\System\UBNDcZy.exe
  C:\Windows\System\UBNDcZy.exe
  2⤵
  PID:4800
- C:\Windows\System\ieyultg.exe
  C:\Windows\System\ieyultg.exe
  2⤵
  PID:4820
- C:\Windows\System\Ewsxkqa.exe
  C:\Windows\System\Ewsxkqa.exe
  2⤵
  PID:4868
- C:\Windows\System\NVlZodz.exe
  C:\Windows\System\NVlZodz.exe
  2⤵
  PID:4936
- C:\Windows\System\nrXBbML.exe
  C:\Windows\System\nrXBbML.exe
  2⤵
  PID:688
- C:\Windows\System\wDttHOJ.exe
  C:\Windows\System\wDttHOJ.exe
  2⤵
  PID:4852
- C:\Windows\System\HYvXWBQ.exe
  C:\Windows\System\HYvXWBQ.exe
  2⤵
  PID:4916
- C:\Windows\System\DCOPNMI.exe
  C:\Windows\System\DCOPNMI.exe
  2⤵
  PID:4968
- C:\Windows\System\TBulAyg.exe
  C:\Windows\System\TBulAyg.exe
  2⤵
  PID:5004
- C:\Windows\System\JNsFuzl.exe
  C:\Windows\System\JNsFuzl.exe
  2⤵
  PID:5032
- C:\Windows\System\WTUMUgK.exe
  C:\Windows\System\WTUMUgK.exe
  2⤵
  PID:5096
- C:\Windows\System\oUOyvpa.exe
  C:\Windows\System\oUOyvpa.exe
  2⤵
  PID:3348
- C:\Windows\System\AozaeQp.exe
  C:\Windows\System\AozaeQp.exe
  2⤵
  PID:5052
- C:\Windows\System\JMEsZnw.exe
  C:\Windows\System\JMEsZnw.exe
  2⤵
  PID:4172
- C:\Windows\System\dYktVBb.exe
  C:\Windows\System\dYktVBb.exe
  2⤵
  PID:2624
- C:\Windows\System\AlsiLbf.exe
  C:\Windows\System\AlsiLbf.exe
  2⤵
  PID:4316
- C:\Windows\System\BTsGyGG.exe
  C:\Windows\System\BTsGyGG.exe
  2⤵
  PID:2012
- C:\Windows\System\KXexmtn.exe
  C:\Windows\System\KXexmtn.exe
  2⤵
  PID:4432
- C:\Windows\System\IzmtfEH.exe
  C:\Windows\System\IzmtfEH.exe
  2⤵
  PID:4348
- C:\Windows\System\gNXvTzl.exe
  C:\Windows\System\gNXvTzl.exe
  2⤵
  PID:5064
- C:\Windows\System\IZveCFb.exe
  C:\Windows\System\IZveCFb.exe
  2⤵
  PID:4380
- C:\Windows\System\tgTwlLB.exe
  C:\Windows\System\tgTwlLB.exe
  2⤵
  PID:4636
- C:\Windows\System\FpWbFCP.exe
  C:\Windows\System\FpWbFCP.exe
  2⤵
  PID:4592
- C:\Windows\System\BCViPYF.exe
  C:\Windows\System\BCViPYF.exe
  2⤵
  PID:2748
- C:\Windows\System\MktJpub.exe
  C:\Windows\System\MktJpub.exe
  2⤵
  PID:4808
- C:\Windows\System\dNSjwQY.exe
  C:\Windows\System\dNSjwQY.exe
  2⤵
  PID:4280
- C:\Windows\System\ApTEWKa.exe
  C:\Windows\System\ApTEWKa.exe
  2⤵
  PID:4184
- C:\Windows\System\VSfLYyA.exe
  C:\Windows\System\VSfLYyA.exe
  2⤵
  PID:2776
- C:\Windows\System\mYxhXEa.exe
  C:\Windows\System\mYxhXEa.exe
  2⤵
  PID:4836
- C:\Windows\System\WlOhNux.exe
  C:\Windows\System\WlOhNux.exe
  2⤵
  PID:4884
- C:\Windows\System\oxgEqnQ.exe
  C:\Windows\System\oxgEqnQ.exe
  2⤵
  PID:5016
- C:\Windows\System\dBBcMor.exe
  C:\Windows\System\dBBcMor.exe
  2⤵
  PID:4144
- C:\Windows\System\tCeLeXS.exe
  C:\Windows\System\tCeLeXS.exe
  2⤵
  PID:5068
- C:\Windows\System\gokfFCN.exe
  C:\Windows\System\gokfFCN.exe
  2⤵
  PID:5080
- C:\Windows\System\ThuMnXP.exe
  C:\Windows\System\ThuMnXP.exe
  2⤵
  PID:4724
- C:\Windows\System\iTUTBXP.exe
  C:\Windows\System\iTUTBXP.exe
  2⤵
  PID:4904
- C:\Windows\System\GCnngym.exe
  C:\Windows\System\GCnngym.exe
  2⤵
  PID:5144
- C:\Windows\System\bKveNKd.exe
  C:\Windows\System\bKveNKd.exe
  2⤵
  PID:5164
- C:\Windows\System\OjJprTG.exe
  C:\Windows\System\OjJprTG.exe
  2⤵
  PID:5188
- C:\Windows\System\yRArmXq.exe
  C:\Windows\System\yRArmXq.exe
  2⤵
  PID:5212
- C:\Windows\System\VrvZnIO.exe
  C:\Windows\System\VrvZnIO.exe
  2⤵
  PID:5228
- C:\Windows\System\qbYmyqD.exe
  C:\Windows\System\qbYmyqD.exe
  2⤵
  PID:5244
- C:\Windows\System\GQbSNBt.exe
  C:\Windows\System\GQbSNBt.exe
  2⤵
  PID:5260
- C:\Windows\System\gIkypDU.exe
  C:\Windows\System\gIkypDU.exe
  2⤵
  PID:5276
- C:\Windows\System\ItVvXzG.exe
  C:\Windows\System\ItVvXzG.exe
  2⤵
  PID:5296
- C:\Windows\System\MNAkMhW.exe
  C:\Windows\System\MNAkMhW.exe
  2⤵
  PID:5328
- C:\Windows\System\bJKBXGQ.exe
  C:\Windows\System\bJKBXGQ.exe
  2⤵
  PID:5344
- C:\Windows\System\NMWpaBK.exe
  C:\Windows\System\NMWpaBK.exe
  2⤵
  PID:5364
- C:\Windows\System\Zdyfwpt.exe
  C:\Windows\System\Zdyfwpt.exe
  2⤵
  PID:5380
- C:\Windows\System\ZqCODzc.exe
  C:\Windows\System\ZqCODzc.exe
  2⤵
  PID:5400
- C:\Windows\System\SZfSOaK.exe
  C:\Windows\System\SZfSOaK.exe
  2⤵
  PID:5420
- C:\Windows\System\EmvSvDM.exe
  C:\Windows\System\EmvSvDM.exe
  2⤵
  PID:5436
- C:\Windows\System\pgpBghd.exe
  C:\Windows\System\pgpBghd.exe
  2⤵
  PID:5452
- C:\Windows\System\jpMsyid.exe
  C:\Windows\System\jpMsyid.exe
  2⤵
  PID:5468
- C:\Windows\System\NrPnzpW.exe
  C:\Windows\System\NrPnzpW.exe
  2⤵
  PID:5512
- C:\Windows\System\MBqbFbw.exe
  C:\Windows\System\MBqbFbw.exe
  2⤵
  PID:5564
- C:\Windows\System\SNMEsyC.exe
  C:\Windows\System\SNMEsyC.exe
  2⤵
  PID:5720
- C:\Windows\System\ElDCvEh.exe
  C:\Windows\System\ElDCvEh.exe
  2⤵
  PID:5764
- C:\Windows\System\DlESeFK.exe
  C:\Windows\System\DlESeFK.exe
  2⤵
  PID:5804
- C:\Windows\System\KNlhoqw.exe
  C:\Windows\System\KNlhoqw.exe
  2⤵
  PID:5876
- C:\Windows\System\GuzHgbU.exe
  C:\Windows\System\GuzHgbU.exe
  2⤵
  PID:5892
- C:\Windows\System\SkuxsqS.exe
  C:\Windows\System\SkuxsqS.exe
  2⤵
  PID:5956
- C:\Windows\System\ZYpdzlj.exe
  C:\Windows\System\ZYpdzlj.exe
  2⤵
  PID:5972
- C:\Windows\System\mrcbAgh.exe
  C:\Windows\System\mrcbAgh.exe
  2⤵
  PID:5988
- C:\Windows\System\ZNLFGTq.exe
  C:\Windows\System\ZNLFGTq.exe
  2⤵
  PID:6004
- C:\Windows\System\lfcbwWp.exe
  C:\Windows\System\lfcbwWp.exe
  2⤵
  PID:6020
- C:\Windows\System\PUSnBpe.exe
  C:\Windows\System\PUSnBpe.exe
  2⤵
  PID:6044
- C:\Windows\System\GIVkFmx.exe
  C:\Windows\System\GIVkFmx.exe
  2⤵
  PID:6060
- C:\Windows\System\lebbkCM.exe
  C:\Windows\System\lebbkCM.exe
  2⤵
  PID:6076
- C:\Windows\System\qRyxUXd.exe
  C:\Windows\System\qRyxUXd.exe
  2⤵
  PID:6092
- C:\Windows\System\hpgYoul.exe
  C:\Windows\System\hpgYoul.exe
  2⤵
  PID:6108
- C:\Windows\System\WtyaaSU.exe
  C:\Windows\System\WtyaaSU.exe
  2⤵
  PID:6124
- C:\Windows\System\hRhUsje.exe
  C:\Windows\System\hRhUsje.exe
  2⤵
  PID:6140
- C:\Windows\System\fgkREKC.exe
  C:\Windows\System\fgkREKC.exe
  2⤵
  PID:4604
- C:\Windows\System\OatQrqB.exe
  C:\Windows\System\OatQrqB.exe
  2⤵
  PID:4924
- C:\Windows\System\gHKWgiG.exe
  C:\Windows\System\gHKWgiG.exe
  2⤵
  PID:4772
- C:\Windows\System\RQTYNWs.exe
  C:\Windows\System\RQTYNWs.exe
  2⤵
  PID:4480
- C:\Windows\System\zZLLrGQ.exe
  C:\Windows\System\zZLLrGQ.exe
  2⤵
  PID:4416
- C:\Windows\System\hsORVIQ.exe
  C:\Windows\System\hsORVIQ.exe
  2⤵
  PID:4652
- C:\Windows\System\jBZNLNn.exe
  C:\Windows\System\jBZNLNn.exe
  2⤵
  PID:5236
- C:\Windows\System\oXSHNXP.exe
  C:\Windows\System\oXSHNXP.exe
  2⤵
  PID:5160
- C:\Windows\System\ogBgkRF.exe
  C:\Windows\System\ogBgkRF.exe
  2⤵
  PID:4120
- C:\Windows\System\DswiWbZ.exe
  C:\Windows\System\DswiWbZ.exe
  2⤵
  PID:5196
- C:\Windows\System\tDnXZuo.exe
  C:\Windows\System\tDnXZuo.exe
  2⤵
  PID:5172
- C:\Windows\System\ANcMImw.exe
  C:\Windows\System\ANcMImw.exe
  2⤵
  PID:5340
- C:\Windows\System\jaYTCqU.exe
  C:\Windows\System\jaYTCqU.exe
  2⤵
  PID:5408
- C:\Windows\System\zdCxnfz.exe
  C:\Windows\System\zdCxnfz.exe
  2⤵
  PID:5444
- C:\Windows\System\ureaWfP.exe
  C:\Windows\System\ureaWfP.exe
  2⤵
  PID:5320
- C:\Windows\System\BsObQLY.exe
  C:\Windows\System\BsObQLY.exe
  2⤵
  PID:5480
- C:\Windows\System\LHygrIt.exe
  C:\Windows\System\LHygrIt.exe
  2⤵
  PID:5432
- C:\Windows\System\BcMiyWE.exe
  C:\Windows\System\BcMiyWE.exe
  2⤵
  PID:5508
- C:\Windows\System\KNEZINy.exe
  C:\Windows\System\KNEZINy.exe
  2⤵
  PID:5536
- C:\Windows\System\lTOPhDG.exe
  C:\Windows\System\lTOPhDG.exe
  2⤵
  PID:5576
- C:\Windows\System\stnhCDc.exe
  C:\Windows\System\stnhCDc.exe
  2⤵
  PID:5592
- C:\Windows\System\rCsvxtf.exe
  C:\Windows\System\rCsvxtf.exe
  2⤵
  PID:5608
- C:\Windows\System\rVxYggO.exe
  C:\Windows\System\rVxYggO.exe
  2⤵
  PID:5624
- C:\Windows\System\jrjEGgK.exe
  C:\Windows\System\jrjEGgK.exe
  2⤵
  PID:5636
- C:\Windows\System\JzyejaX.exe
  C:\Windows\System\JzyejaX.exe
  2⤵
  PID:4900
- C:\Windows\System\hJfWZsH.exe
  C:\Windows\System\hJfWZsH.exe
  2⤵
  PID:5672
- C:\Windows\System\tWeONJj.exe
  C:\Windows\System\tWeONJj.exe
  2⤵
  PID:5688
- C:\Windows\System\dWCJlRO.exe
  C:\Windows\System\dWCJlRO.exe
  2⤵
  PID:5708
- C:\Windows\System\TuNZVri.exe
  C:\Windows\System\TuNZVri.exe
  2⤵
  PID:5744
- C:\Windows\System\NmJxPHY.exe
  C:\Windows\System\NmJxPHY.exe
  2⤵
  PID:5740
- C:\Windows\System\zLxFeYD.exe
  C:\Windows\System\zLxFeYD.exe
  2⤵
  PID:5788
- C:\Windows\System\byYxCVU.exe
  C:\Windows\System\byYxCVU.exe
  2⤵
  PID:5772
- C:\Windows\System\yeFyIdP.exe
  C:\Windows\System\yeFyIdP.exe
  2⤵
  PID:5828
- C:\Windows\System\wFEZLGR.exe
  C:\Windows\System\wFEZLGR.exe
  2⤵
  PID:5840
- C:\Windows\System\NFvQUGM.exe
  C:\Windows\System\NFvQUGM.exe
  2⤵
  PID:5856
- C:\Windows\System\jUpIVZS.exe
  C:\Windows\System\jUpIVZS.exe
  2⤵
  PID:5904
- C:\Windows\System\mKtwaqJ.exe
  C:\Windows\System\mKtwaqJ.exe
  2⤵
  PID:5908
- C:\Windows\System\GoNxzmr.exe
  C:\Windows\System\GoNxzmr.exe
  2⤵
  PID:5916
- C:\Windows\System\rRGiPxN.exe
  C:\Windows\System\rRGiPxN.exe
  2⤵
  PID:5968
- C:\Windows\System\lWAOOQm.exe
  C:\Windows\System\lWAOOQm.exe
  2⤵
  PID:6016
- C:\Windows\System\XUQPGJH.exe
  C:\Windows\System\XUQPGJH.exe
  2⤵
  PID:6056
- C:\Windows\System\RLMYqPH.exe
  C:\Windows\System\RLMYqPH.exe
  2⤵
  PID:6040
- C:\Windows\System\XoMeoWp.exe
  C:\Windows\System\XoMeoWp.exe
  2⤵
  PID:6100
- C:\Windows\System\VlwHDQl.exe
  C:\Windows\System\VlwHDQl.exe
  2⤵
  PID:4332
- C:\Windows\System\zatyqVm.exe
  C:\Windows\System\zatyqVm.exe
  2⤵
  PID:6120
- C:\Windows\System\TkamStL.exe
  C:\Windows\System\TkamStL.exe
  2⤵
  PID:5104
- C:\Windows\System\rBkCnZs.exe
  C:\Windows\System\rBkCnZs.exe
  2⤵
  PID:4952
- C:\Windows\System\qFqCbzd.exe
  C:\Windows\System\qFqCbzd.exe
  2⤵
  PID:5176
- C:\Windows\System\NXwDado.exe
  C:\Windows\System\NXwDado.exe
  2⤵
  PID:2608
- C:\Windows\System\FfFPRgx.exe
  C:\Windows\System\FfFPRgx.exe
  2⤵
  PID:5156
- C:\Windows\System\ZehplDq.exe
  C:\Windows\System\ZehplDq.exe
  2⤵
  PID:5184
- C:\Windows\System\nzBpBaC.exe
  C:\Windows\System\nzBpBaC.exe
  2⤵
  PID:5372
- C:\Windows\System\HtRKaNU.exe
  C:\Windows\System\HtRKaNU.exe
  2⤵
  PID:5256
- C:\Windows\System\CcDISDJ.exe
  C:\Windows\System\CcDISDJ.exe
  2⤵
  PID:5316
- C:\Windows\System\IHOVBif.exe
  C:\Windows\System\IHOVBif.exe
  2⤵
  PID:5376
- C:\Windows\System\MQnMHee.exe
  C:\Windows\System\MQnMHee.exe
  2⤵
  PID:5488
- C:\Windows\System\fYtgcZb.exe
  C:\Windows\System\fYtgcZb.exe
  2⤵
  PID:5356
- C:\Windows\System\hhtCcne.exe
  C:\Windows\System\hhtCcne.exe
  2⤵
  PID:5524
- C:\Windows\System\YuIQSIQ.exe
  C:\Windows\System\YuIQSIQ.exe
  2⤵
  PID:5500
- C:\Windows\System\MqdHWfv.exe
  C:\Windows\System\MqdHWfv.exe
  2⤵
  PID:5572
- C:\Windows\System\EkUwDGs.exe
  C:\Windows\System\EkUwDGs.exe
  2⤵
  PID:5644
- C:\Windows\System\VOfOuFr.exe
  C:\Windows\System\VOfOuFr.exe
  2⤵
  PID:5664
- C:\Windows\System\FaDckLj.exe
  C:\Windows\System\FaDckLj.exe
  2⤵
  PID:5716
- C:\Windows\System\SoXoftC.exe
  C:\Windows\System\SoXoftC.exe
  2⤵
  PID:4768
- C:\Windows\System\KvrqCTM.exe
  C:\Windows\System\KvrqCTM.exe
  2⤵
  PID:5660
- C:\Windows\System\aVfdcKu.exe
  C:\Windows\System\aVfdcKu.exe
  2⤵
  PID:5780
- C:\Windows\System\uqgnNgT.exe
  C:\Windows\System\uqgnNgT.exe
  2⤵
  PID:5872
- C:\Windows\System\dmAgKgl.exe
  C:\Windows\System\dmAgKgl.exe
  2⤵
  PID:5792
- C:\Windows\System\xnzUutP.exe
  C:\Windows\System\xnzUutP.exe
  2⤵
  PID:5852
- C:\Windows\System\uLrKdgS.exe
  C:\Windows\System\uLrKdgS.exe
  2⤵
  PID:5900
- C:\Windows\System\CfsmaiS.exe
  C:\Windows\System\CfsmaiS.exe
  2⤵
  PID:6156
- C:\Windows\System\sKfPZUc.exe
  C:\Windows\System\sKfPZUc.exe
  2⤵
  PID:6176
- C:\Windows\System\mobfZmA.exe
  C:\Windows\System\mobfZmA.exe
  2⤵
  PID:6192
- C:\Windows\System\eKbFWhZ.exe
  C:\Windows\System\eKbFWhZ.exe
  2⤵
  PID:6372
- C:\Windows\System\fsGUiiD.exe
  C:\Windows\System\fsGUiiD.exe
  2⤵
  PID:6392
- C:\Windows\System\TLxTMDc.exe
  C:\Windows\System\TLxTMDc.exe
  2⤵
  PID:6408
- C:\Windows\System\dNJouZr.exe
  C:\Windows\System\dNJouZr.exe
  2⤵
  PID:6424
- C:\Windows\System\qngKtCd.exe
  C:\Windows\System\qngKtCd.exe
  2⤵
  PID:6440
- C:\Windows\System\PqcTTFk.exe
  C:\Windows\System\PqcTTFk.exe
  2⤵
  PID:6456
- C:\Windows\System\PjRlyMt.exe
  C:\Windows\System\PjRlyMt.exe
  2⤵
  PID:6476
- C:\Windows\System\zhgOtOL.exe
  C:\Windows\System\zhgOtOL.exe
  2⤵
  PID:6496
- C:\Windows\System\YsNGjVM.exe
  C:\Windows\System\YsNGjVM.exe
  2⤵
  PID:6520
- C:\Windows\System\eAvAiNM.exe
  C:\Windows\System\eAvAiNM.exe
  2⤵
  PID:6536
- C:\Windows\System\zjRcgGx.exe
  C:\Windows\System\zjRcgGx.exe
  2⤵
  PID:6560
- C:\Windows\System\BLJgRwd.exe
  C:\Windows\System\BLJgRwd.exe
  2⤵
  PID:6576
- C:\Windows\System\jumLgEX.exe
  C:\Windows\System\jumLgEX.exe
  2⤵
  PID:6628
- C:\Windows\System\QlqDqDw.exe
  C:\Windows\System\QlqDqDw.exe
  2⤵
  PID:6676
- C:\Windows\System\CIKxdqi.exe
  C:\Windows\System\CIKxdqi.exe
  2⤵
  PID:6692
- C:\Windows\System\PdelksB.exe
  C:\Windows\System\PdelksB.exe
  2⤵
  PID:6708
- C:\Windows\System\fnkLNHW.exe
  C:\Windows\System\fnkLNHW.exe
  2⤵
  PID:6724
- C:\Windows\System\mwKRKgZ.exe
  C:\Windows\System\mwKRKgZ.exe
  2⤵
  PID:6744
- C:\Windows\System\bmqaQvo.exe
  C:\Windows\System\bmqaQvo.exe
  2⤵
  PID:6760
- C:\Windows\System\mvLHuGy.exe
  C:\Windows\System\mvLHuGy.exe
  2⤵
  PID:6776
- C:\Windows\System\tpYICkT.exe
  C:\Windows\System\tpYICkT.exe
  2⤵
  PID:6792
- C:\Windows\System\zCmCfFg.exe
  C:\Windows\System\zCmCfFg.exe
  2⤵
  PID:6812
- C:\Windows\System\iVykhAt.exe
  C:\Windows\System\iVykhAt.exe
  2⤵
  PID:6828
- C:\Windows\System\YANjhuX.exe
  C:\Windows\System\YANjhuX.exe
  2⤵
  PID:6848
- C:\Windows\System\BTHtHlP.exe
  C:\Windows\System\BTHtHlP.exe
  2⤵
  PID:6864
- C:\Windows\System\oJNvDnh.exe
  C:\Windows\System\oJNvDnh.exe
  2⤵
  PID:6880
- C:\Windows\System\NcTMsWB.exe
  C:\Windows\System\NcTMsWB.exe
  2⤵
  PID:6896
- C:\Windows\System\MNvHeeo.exe
  C:\Windows\System\MNvHeeo.exe
  2⤵
  PID:6912
- C:\Windows\System\OzkqXWM.exe
  C:\Windows\System\OzkqXWM.exe
  2⤵
  PID:6932
- C:\Windows\System\SfrcrYf.exe
  C:\Windows\System\SfrcrYf.exe
  2⤵
  PID:6952
- C:\Windows\System\OvIoTUs.exe
  C:\Windows\System\OvIoTUs.exe
  2⤵
  PID:6996
- C:\Windows\System\qmpdpNu.exe
  C:\Windows\System\qmpdpNu.exe
  2⤵
  PID:7020
- C:\Windows\System\kelMvqC.exe
  C:\Windows\System\kelMvqC.exe
  2⤵
  PID:7036
- C:\Windows\System\wVEDyDK.exe
  C:\Windows\System\wVEDyDK.exe
  2⤵
  PID:7056
- C:\Windows\System\gTQnLmY.exe
  C:\Windows\System\gTQnLmY.exe
  2⤵
  PID:7088
- C:\Windows\System\rATKYvy.exe
  C:\Windows\System\rATKYvy.exe
  2⤵
  PID:7108
- C:\Windows\System\PUDZaeZ.exe
  C:\Windows\System\PUDZaeZ.exe
  2⤵
  PID:7128
- C:\Windows\System\JKfHbPa.exe
  C:\Windows\System\JKfHbPa.exe
  2⤵
  PID:7144
- C:\Windows\System\ocqJtBF.exe
  C:\Windows\System\ocqJtBF.exe
  2⤵
  PID:7160
- C:\Windows\System\IkQkADF.exe
  C:\Windows\System\IkQkADF.exe
  2⤵
  PID:5924
- C:\Windows\System\bRvihzz.exe
  C:\Windows\System\bRvihzz.exe
  2⤵
  PID:6000
- C:\Windows\System\NSPuiaU.exe
  C:\Windows\System\NSPuiaU.exe
  2⤵
  PID:6068
- C:\Windows\System\DlnNzva.exe
  C:\Windows\System\DlnNzva.exe
  2⤵
  PID:5496
- C:\Windows\System\AnuCGvB.exe
  C:\Windows\System\AnuCGvB.exe
  2⤵
  PID:5540
- C:\Windows\System\tDvQgrn.exe
  C:\Windows\System\tDvQgrn.exe
  2⤵
  PID:6136
- C:\Windows\System\NglNLWE.exe
  C:\Windows\System\NglNLWE.exe
  2⤵
  PID:6084
- C:\Windows\System\xyefMfv.exe
  C:\Windows\System\xyefMfv.exe
  2⤵
  PID:2900
- C:\Windows\System\ajhFOpF.exe
  C:\Windows\System\ajhFOpF.exe
  2⤵
  PID:5820
- C:\Windows\System\nnYQRkA.exe
  C:\Windows\System\nnYQRkA.exe
  2⤵
  PID:6152
- C:\Windows\System\LAGrSIA.exe
  C:\Windows\System\LAGrSIA.exe
  2⤵
  PID:5312
- C:\Windows\System\CDngWaN.exe
  C:\Windows\System\CDngWaN.exe
  2⤵
  PID:5308
- C:\Windows\System\FMThfVp.exe
  C:\Windows\System\FMThfVp.exe
  2⤵
  PID:6220
- C:\Windows\System\CGpPbwK.exe
  C:\Windows\System\CGpPbwK.exe
  2⤵
  PID:1528
- C:\Windows\System\nHNrAPN.exe
  C:\Windows\System\nHNrAPN.exe
  2⤵
  PID:5224
- C:\Windows\System\wReLagq.exe
  C:\Windows\System\wReLagq.exe
  2⤵
  PID:5268
- C:\Windows\System\vtIeHoe.exe
  C:\Windows\System\vtIeHoe.exe
  2⤵
  PID:5604
- C:\Windows\System\mWGxndR.exe
  C:\Windows\System\mWGxndR.exe
  2⤵
  PID:5520
- C:\Windows\System\qsWcZHc.exe
  C:\Windows\System\qsWcZHc.exe
  2⤵
  PID:6260
- C:\Windows\System\GYCDYEF.exe
  C:\Windows\System\GYCDYEF.exe
  2⤵
  PID:6276
- C:\Windows\System\DrLfzvs.exe
  C:\Windows\System\DrLfzvs.exe
  2⤵
  PID:6300
- C:\Windows\System\CETScZx.exe
  C:\Windows\System\CETScZx.exe
  2⤵
  PID:6308
- C:\Windows\System\sdXWSfT.exe
  C:\Windows\System\sdXWSfT.exe
  2⤵
  PID:6324
- C:\Windows\System\aEmEUrq.exe
  C:\Windows\System\aEmEUrq.exe
  2⤵
  PID:6344
- C:\Windows\System\XPDnSlE.exe
  C:\Windows\System\XPDnSlE.exe
  2⤵
  PID:6380
- C:\Windows\System\JuyOsSH.exe
  C:\Windows\System\JuyOsSH.exe
  2⤵
  PID:6452
- C:\Windows\System\ndXIfij.exe
  C:\Windows\System\ndXIfij.exe
  2⤵
  PID:6368
- C:\Windows\System\qxHgtGD.exe
  C:\Windows\System\qxHgtGD.exe
  2⤵
  PID:6528
- C:\Windows\System\fVLTaHE.exe
  C:\Windows\System\fVLTaHE.exe
  2⤵
  PID:6512
- C:\Windows\System\SZpXCuf.exe
  C:\Windows\System\SZpXCuf.exe
  2⤵
  PID:6616
- C:\Windows\System\nqfDSOD.exe
  C:\Windows\System\nqfDSOD.exe
  2⤵
  PID:6464
- C:\Windows\System\EqyMvCn.exe
  C:\Windows\System\EqyMvCn.exe
  2⤵
  PID:6584
- C:\Windows\System\wRNbzJR.exe
  C:\Windows\System\wRNbzJR.exe
  2⤵
  PID:6548
- C:\Windows\System\gKTEGHg.exe
  C:\Windows\System\gKTEGHg.exe
  2⤵
  PID:6596
- C:\Windows\System\HtdXpKG.exe
  C:\Windows\System\HtdXpKG.exe
  2⤵
  PID:6636
- C:\Windows\System\Kbovpbm.exe
  C:\Windows\System\Kbovpbm.exe
  2⤵
  PID:6684
- C:\Windows\System\VivNxnG.exe
  C:\Windows\System\VivNxnG.exe
  2⤵
  PID:6784
- C:\Windows\System\owQTyoE.exe
  C:\Windows\System\owQTyoE.exe
  2⤵
  PID:6856
- C:\Windows\System\lrrItRY.exe
  C:\Windows\System\lrrItRY.exe
  2⤵
  PID:6800
- C:\Windows\System\EUJywJf.exe
  C:\Windows\System\EUJywJf.exe
  2⤵
  PID:6688
- C:\Windows\System\PqpkYGU.exe
  C:\Windows\System\PqpkYGU.exe
  2⤵
  PID:6872
- C:\Windows\System\xJhRvaz.exe
  C:\Windows\System\xJhRvaz.exe
  2⤵
  PID:6940
- C:\Windows\System\clJpGQP.exe
  C:\Windows\System\clJpGQP.exe
  2⤵
  PID:6948
- C:\Windows\System\BgWFxRR.exe
  C:\Windows\System\BgWFxRR.exe
  2⤵
  PID:6972
- C:\Windows\System\mueSOVt.exe
  C:\Windows\System\mueSOVt.exe
  2⤵
  PID:6984
- C:\Windows\System\PyGHxay.exe
  C:\Windows\System\PyGHxay.exe
  2⤵
  PID:7004
- C:\Windows\System\zSEoKtf.exe
  C:\Windows\System\zSEoKtf.exe
  2⤵
  PID:7052
- C:\Windows\System\XqbMkDg.exe
  C:\Windows\System\XqbMkDg.exe
  2⤵
  PID:7084
- C:\Windows\System\gVwHysz.exe
  C:\Windows\System\gVwHysz.exe
  2⤵
  PID:7064
- C:\Windows\System\rnaApMc.exe
  C:\Windows\System\rnaApMc.exe
  2⤵
  PID:7136
- C:\Windows\System\ctyelQj.exe
  C:\Windows\System\ctyelQj.exe
  2⤵
  PID:7152
- C:\Windows\System\zFZtpGe.exe
  C:\Windows\System\zFZtpGe.exe
  2⤵
  PID:6032
- C:\Windows\System\ydWrwKM.exe
  C:\Windows\System\ydWrwKM.exe
  2⤵
  PID:5704
- C:\Windows\System\oohDiAZ.exe
  C:\Windows\System\oohDiAZ.exe
  2⤵
  PID:5864
- C:\Windows\System\TGIMPms.exe
  C:\Windows\System\TGIMPms.exe
  2⤵
  PID:5836
- C:\Windows\System\sSLvcdK.exe
  C:\Windows\System\sSLvcdK.exe
  2⤵
  PID:6204
- C:\Windows\System\UHJmjSC.exe
  C:\Windows\System\UHJmjSC.exe
  2⤵
  PID:6212
- C:\Windows\System\uaXuOVM.exe
  C:\Windows\System\uaXuOVM.exe
  2⤵
  PID:5928
- C:\Windows\System\rRrLXAU.exe
  C:\Windows\System\rRrLXAU.exe
  2⤵
  PID:4336
- C:\Windows\System\LuMOVHK.exe
  C:\Windows\System\LuMOVHK.exe
  2⤵
  PID:5756
- C:\Windows\System\eaRhYYs.exe
  C:\Windows\System\eaRhYYs.exe
  2⤵
  PID:5240
- C:\Windows\System\wLHNxNX.exe
  C:\Windows\System\wLHNxNX.exe
  2⤵
  PID:5612
- C:\Windows\System\PVqyAHL.exe
  C:\Windows\System\PVqyAHL.exe
  2⤵
  PID:6072
- C:\Windows\System\nWVXiEh.exe
  C:\Windows\System\nWVXiEh.exe
  2⤵
  PID:6268
- C:\Windows\System\UQayyWd.exe
  C:\Windows\System\UQayyWd.exe
  2⤵
  PID:6296
- C:\Windows\System\QFlAfNr.exe
  C:\Windows\System\QFlAfNr.exe
  2⤵
  PID:6416
- C:\Windows\System\XFVTmif.exe
  C:\Windows\System\XFVTmif.exe
  2⤵
  PID:6516
- C:\Windows\System\TNOneQB.exe
  C:\Windows\System\TNOneQB.exe
  2⤵
  PID:6360
- C:\Windows\System\YqCETUk.exe
  C:\Windows\System\YqCETUk.exe
  2⤵
  PID:6668
- C:\Windows\System\phZMWwq.exe
  C:\Windows\System\phZMWwq.exe
  2⤵
  PID:6644
- C:\Windows\System\dSQrvaD.exe
  C:\Windows\System\dSQrvaD.exe
  2⤵
  PID:6672
- C:\Windows\System\zErCpws.exe
  C:\Windows\System\zErCpws.exe
  2⤵
  PID:6836
- C:\Windows\System\CubbJPk.exe
  C:\Windows\System\CubbJPk.exe
  2⤵
  PID:6756
- C:\Windows\System\ASAPzhU.exe
  C:\Windows\System\ASAPzhU.exe
  2⤵
  PID:6824
- C:\Windows\System\pZyaWxI.exe
  C:\Windows\System\pZyaWxI.exe
  2⤵
  PID:7048
- C:\Windows\System\oZhQcBu.exe
  C:\Windows\System\oZhQcBu.exe
  2⤵
  PID:6876
- C:\Windows\System\btSQJkV.exe
  C:\Windows\System\btSQJkV.exe
  2⤵
  PID:6988
- C:\Windows\System\BlytgBS.exe
  C:\Windows\System\BlytgBS.exe
  2⤵
  PID:7016
- C:\Windows\System\BajFauJ.exe
  C:\Windows\System\BajFauJ.exe
  2⤵
  PID:7104
- C:\Windows\System\LWFvABX.exe
  C:\Windows\System\LWFvABX.exe
  2⤵
  PID:6028
- C:\Windows\System\eGoDLfl.exe
  C:\Windows\System\eGoDLfl.exe
  2⤵
  PID:5984
- C:\Windows\System\RYdXfjT.exe
  C:\Windows\System\RYdXfjT.exe
  2⤵
  PID:5252
- C:\Windows\System\nFaMhnK.exe
  C:\Windows\System\nFaMhnK.exe
  2⤵
  PID:5548
- C:\Windows\System\eokDkkw.exe
  C:\Windows\System\eokDkkw.exe
  2⤵
  PID:6232
- C:\Windows\System\wLEZWzg.exe
  C:\Windows\System\wLEZWzg.exe
  2⤵
  PID:6216
- C:\Windows\System\eihHTLQ.exe
  C:\Windows\System\eihHTLQ.exe
  2⤵
  PID:6556
- C:\Windows\System\pFasECX.exe
  C:\Windows\System\pFasECX.exe
  2⤵
  PID:6240
- C:\Windows\System\txVVSis.exe
  C:\Windows\System\txVVSis.exe
  2⤵
  PID:5800
- C:\Windows\System\FiqmWMY.exe
  C:\Windows\System\FiqmWMY.exe
  2⤵
  PID:6148
- C:\Windows\System\IuutAqx.exe
  C:\Windows\System\IuutAqx.exe
  2⤵
  PID:5412
- C:\Windows\System\dALtIkL.exe
  C:\Windows\System\dALtIkL.exe
  2⤵
  PID:6488
- C:\Windows\System\JtuAohU.exe
  C:\Windows\System\JtuAohU.exe
  2⤵
  PID:6432
- C:\Windows\System\QjBoNYc.exe
  C:\Windows\System\QjBoNYc.exe
  2⤵
  PID:6352
- C:\Windows\System\tCcJjLx.exe
  C:\Windows\System\tCcJjLx.exe
  2⤵
  PID:6252
- C:\Windows\System\DjjOqOp.exe
  C:\Windows\System\DjjOqOp.exe
  2⤵
  PID:6648
- C:\Windows\System\GoezVWO.exe
  C:\Windows\System\GoezVWO.exe
  2⤵
  PID:6772
- C:\Windows\System\LhZFAgo.exe
  C:\Windows\System\LhZFAgo.exe
  2⤵
  PID:6740
- C:\Windows\System\LkdIDIN.exe
  C:\Windows\System\LkdIDIN.exe
  2⤵
  PID:6052
- C:\Windows\System\NaGaLNC.exe
  C:\Windows\System\NaGaLNC.exe
  2⤵
  PID:5528
- C:\Windows\System\gdDAHLf.exe
  C:\Windows\System\gdDAHLf.exe
  2⤵
  PID:6164
- C:\Windows\System\BVzLfSA.exe
  C:\Windows\System\BVzLfSA.exe
  2⤵
  PID:5152
- C:\Windows\System\LyIPYeN.exe
  C:\Windows\System\LyIPYeN.exe
  2⤵
  PID:5940
- C:\Windows\System\WKVICyK.exe
  C:\Windows\System\WKVICyK.exe
  2⤵
  PID:6320
- C:\Windows\System\OzVPzFd.exe
  C:\Windows\System\OzVPzFd.exe
  2⤵
  PID:5684
- C:\Windows\System\wGPoUaX.exe
  C:\Windows\System\wGPoUaX.exe
  2⤵
  PID:6332
- C:\Windows\System\KRwKyoj.exe
  C:\Windows\System\KRwKyoj.exe
  2⤵
  PID:6664
- C:\Windows\System\YWrAKCF.exe
  C:\Windows\System\YWrAKCF.exe
  2⤵
  PID:6336
- C:\Windows\System\efTCXxF.exe
  C:\Windows\System\efTCXxF.exe
  2⤵
  PID:6592
- C:\Windows\System\xZKwPWa.exe
  C:\Windows\System\xZKwPWa.exe
  2⤵
  PID:5812
- C:\Windows\System\vbGHIFN.exe
  C:\Windows\System\vbGHIFN.exe
  2⤵
  PID:7012
- C:\Windows\System\rLXVXsZ.exe
  C:\Windows\System\rLXVXsZ.exe
  2⤵
  PID:7100
- C:\Windows\System\ZzLoqAr.exe
  C:\Windows\System\ZzLoqAr.exe
  2⤵
  PID:5416
- C:\Windows\System\pypknDM.exe
  C:\Windows\System\pypknDM.exe
  2⤵
  PID:6600
- C:\Windows\System\YrRNIiH.exe
  C:\Windows\System\YrRNIiH.exe
  2⤵
  PID:5964
- C:\Windows\System\WLxsnTa.exe
  C:\Windows\System\WLxsnTa.exe
  2⤵
  PID:6624
- C:\Windows\System\pAEFoxG.exe
  C:\Windows\System\pAEFoxG.exe
  2⤵
  PID:6704
- C:\Windows\System\HWRdjcE.exe
  C:\Windows\System\HWRdjcE.exe
  2⤵
  PID:6172
- C:\Windows\System\shEYpqa.exe
  C:\Windows\System\shEYpqa.exe
  2⤵
  PID:6272
- C:\Windows\System\ZGmfqHH.exe
  C:\Windows\System\ZGmfqHH.exe
  2⤵
  PID:1572
- C:\Windows\System\pNQWsXR.exe
  C:\Windows\System\pNQWsXR.exe
  2⤵
  PID:6472
- C:\Windows\System\ijnzKQr.exe
  C:\Windows\System\ijnzKQr.exe
  2⤵
  PID:7072
- C:\Windows\System\hfVmXqR.exe
  C:\Windows\System\hfVmXqR.exe
  2⤵
  PID:6960
- C:\Windows\System\YkkIvzj.exe
  C:\Windows\System\YkkIvzj.exe
  2⤵
  PID:6568
- C:\Windows\System\ZOpWZcb.exe
  C:\Windows\System\ZOpWZcb.exe
  2⤵
  PID:7032
- C:\Windows\System\pKDVdtl.exe
  C:\Windows\System\pKDVdtl.exe
  2⤵
  PID:7184
- C:\Windows\System\HlWMPom.exe
  C:\Windows\System\HlWMPom.exe
  2⤵
  PID:7236
- C:\Windows\System\lAWDjHO.exe
  C:\Windows\System\lAWDjHO.exe
  2⤵
  PID:7308
- C:\Windows\System\EPXmHUS.exe
  C:\Windows\System\EPXmHUS.exe
  2⤵
  PID:7324
- C:\Windows\System\izDYTLv.exe
  C:\Windows\System\izDYTLv.exe
  2⤵
  PID:7340
- C:\Windows\System\tCbnjdy.exe
  C:\Windows\System\tCbnjdy.exe
  2⤵
  PID:7356
- C:\Windows\System\yHAAWfX.exe
  C:\Windows\System\yHAAWfX.exe
  2⤵
  PID:7372
- C:\Windows\System\PRWnPAH.exe
  C:\Windows\System\PRWnPAH.exe
  2⤵
  PID:7388
- C:\Windows\System\gDYoyYq.exe
  C:\Windows\System\gDYoyYq.exe
  2⤵
  PID:7404
- C:\Windows\System\zbaIESa.exe
  C:\Windows\System\zbaIESa.exe
  2⤵
  PID:7420
- C:\Windows\System\CWsTZpl.exe
  C:\Windows\System\CWsTZpl.exe
  2⤵
  PID:7436
- C:\Windows\System\SALRFqC.exe
  C:\Windows\System\SALRFqC.exe
  2⤵
  PID:7452
- C:\Windows\System\ZkgcjpQ.exe
  C:\Windows\System\ZkgcjpQ.exe
  2⤵
  PID:7472
- C:\Windows\System\pLRRjkL.exe
  C:\Windows\System\pLRRjkL.exe
  2⤵
  PID:7488
- C:\Windows\System\jVhOKrh.exe
  C:\Windows\System\jVhOKrh.exe
  2⤵
  PID:7504
- C:\Windows\System\BFYfzcR.exe
  C:\Windows\System\BFYfzcR.exe
  2⤵
  PID:7520
- C:\Windows\System\LfOcpxI.exe
  C:\Windows\System\LfOcpxI.exe
  2⤵
  PID:7536
- C:\Windows\System\dHxGVTO.exe
  C:\Windows\System\dHxGVTO.exe
  2⤵
  PID:7552
- C:\Windows\System\SaygptA.exe
  C:\Windows\System\SaygptA.exe
  2⤵
  PID:7568
- C:\Windows\System\UbyraKQ.exe
  C:\Windows\System\UbyraKQ.exe
  2⤵
  PID:7584
- C:\Windows\System\yKPnUCZ.exe
  C:\Windows\System\yKPnUCZ.exe
  2⤵
  PID:7600
- C:\Windows\System\sINiFBQ.exe
  C:\Windows\System\sINiFBQ.exe
  2⤵
  PID:7616
- C:\Windows\System\eBghJwN.exe
  C:\Windows\System\eBghJwN.exe
  2⤵
  PID:7632
- C:\Windows\System\JdHiafV.exe
  C:\Windows\System\JdHiafV.exe
  2⤵
  PID:7648
- C:\Windows\System\dBGsSjX.exe
  C:\Windows\System\dBGsSjX.exe
  2⤵
  PID:7664
- C:\Windows\System\JGOYKeM.exe
  C:\Windows\System\JGOYKeM.exe
  2⤵
  PID:7680
- C:\Windows\System\WaDzvtK.exe
  C:\Windows\System\WaDzvtK.exe
  2⤵
  PID:7696
- C:\Windows\System\eBlSRbP.exe
  C:\Windows\System\eBlSRbP.exe
  2⤵
  PID:7712
- C:\Windows\System\UrYKSlB.exe
  C:\Windows\System\UrYKSlB.exe
  2⤵
  PID:7740
- C:\Windows\System\toLaupR.exe
  C:\Windows\System\toLaupR.exe
  2⤵
  PID:7760
- C:\Windows\System\AzGpZkA.exe
  C:\Windows\System\AzGpZkA.exe
  2⤵
  PID:7780
- C:\Windows\System\rSdlNfb.exe
  C:\Windows\System\rSdlNfb.exe
  2⤵
  PID:7796
- C:\Windows\System\wRAIxYi.exe
  C:\Windows\System\wRAIxYi.exe
  2⤵
  PID:7812
- C:\Windows\System\ICybzNA.exe
  C:\Windows\System\ICybzNA.exe
  2⤵
  PID:7832
- C:\Windows\System\SxbuoWm.exe
  C:\Windows\System\SxbuoWm.exe
  2⤵
  PID:7848
- C:\Windows\System\FZpSWDW.exe
  C:\Windows\System\FZpSWDW.exe
  2⤵
  PID:7864
- C:\Windows\System\gwTbWpc.exe
  C:\Windows\System\gwTbWpc.exe
  2⤵
  PID:7884
- C:\Windows\System\GUkjaBm.exe
  C:\Windows\System\GUkjaBm.exe
  2⤵
  PID:7900
- C:\Windows\System\BWpVIYe.exe
  C:\Windows\System\BWpVIYe.exe
  2⤵
  PID:7916
- C:\Windows\System\llPzLfy.exe
  C:\Windows\System\llPzLfy.exe
  2⤵
  PID:7948
- C:\Windows\System\JKfIrXS.exe
  C:\Windows\System\JKfIrXS.exe
  2⤵
  PID:8072
- C:\Windows\System\UHmKCkI.exe
  C:\Windows\System\UHmKCkI.exe
  2⤵
  PID:8088
- C:\Windows\System\CarlhLH.exe
  C:\Windows\System\CarlhLH.exe
  2⤵
  PID:8108
- C:\Windows\System\XNhAVSL.exe
  C:\Windows\System\XNhAVSL.exe
  2⤵
  PID:8128
- C:\Windows\System\vOPvQrX.exe
  C:\Windows\System\vOPvQrX.exe
  2⤵
  PID:8144
- C:\Windows\System\PmDNvNy.exe
  C:\Windows\System\PmDNvNy.exe
  2⤵
  PID:8160
- C:\Windows\System\eVjwhQI.exe
  C:\Windows\System\eVjwhQI.exe
  2⤵
  PID:8176
- C:\Windows\System\gDkJvZI.exe
  C:\Windows\System\gDkJvZI.exe
  2⤵
  PID:7192
- C:\Windows\System\XWSIRHy.exe
  C:\Windows\System\XWSIRHy.exe
  2⤵
  PID:6448
- C:\Windows\System\guIDWpK.exe
  C:\Windows\System\guIDWpK.exe
  2⤵
  PID:7200
- C:\Windows\System\WmeghOB.exe
  C:\Windows\System\WmeghOB.exe
  2⤵
  PID:7220
- C:\Windows\System\pSqcsuK.exe
  C:\Windows\System\pSqcsuK.exe
  2⤵
  PID:7316
- C:\Windows\System\IBlNTcK.exe
  C:\Windows\System\IBlNTcK.exe
  2⤵
  PID:7256
- C:\Windows\System\ENVgxMp.exe
  C:\Windows\System\ENVgxMp.exe
  2⤵
  PID:7272
- C:\Windows\System\GxLHszh.exe
  C:\Windows\System\GxLHszh.exe
  2⤵
  PID:7288
- C:\Windows\System\evbWQsh.exe
  C:\Windows\System\evbWQsh.exe
  2⤵
  PID:7304
- C:\Windows\System\AYRqIRK.exe
  C:\Windows\System\AYRqIRK.exe
  2⤵
  PID:7368
- C:\Windows\System\tdOZHih.exe
  C:\Windows\System\tdOZHih.exe
  2⤵
  PID:7460
- C:\Windows\System\eUhMKrt.exe
  C:\Windows\System\eUhMKrt.exe
  2⤵
  PID:7500
- C:\Windows\System\nXotQSw.exe
  C:\Windows\System\nXotQSw.exe
  2⤵
  PID:7352
- C:\Windows\System\HWMFfDA.exe
  C:\Windows\System\HWMFfDA.exe
  2⤵
  PID:7380
- C:\Windows\System\GhwBdDM.exe
  C:\Windows\System\GhwBdDM.exe
  2⤵
  PID:7592
- C:\Windows\System\umQJsvu.exe
  C:\Windows\System\umQJsvu.exe
  2⤵
  PID:7640
- C:\Windows\System\DPzNWDS.exe
  C:\Windows\System\DPzNWDS.exe
  2⤵
  PID:7580
- C:\Windows\System\bjDMABJ.exe
  C:\Windows\System\bjDMABJ.exe
  2⤵
  PID:7724
- C:\Windows\System\YTrcuRZ.exe
  C:\Windows\System\YTrcuRZ.exe
  2⤵
  PID:7768
- C:\Windows\System\CBqOEao.exe
  C:\Windows\System\CBqOEao.exe
  2⤵
  PID:7748
- C:\Windows\System\ionpElE.exe
  C:\Windows\System\ionpElE.exe
  2⤵
  PID:7792
- C:\Windows\System\FSiGYIh.exe
  C:\Windows\System\FSiGYIh.exe
  2⤵
  PID:7840
- C:\Windows\System\pATQkts.exe
  C:\Windows\System\pATQkts.exe
  2⤵
  PID:7908
- C:\Windows\System\jdvxaVf.exe
  C:\Windows\System\jdvxaVf.exe
  2⤵
  PID:7860
- C:\Windows\System\GDqxmHn.exe
  C:\Windows\System\GDqxmHn.exe
  2⤵
  PID:7928
- C:\Windows\System\ckqKeTr.exe
  C:\Windows\System\ckqKeTr.exe
  2⤵
  PID:8004
- C:\Windows\System\vHuAGli.exe
  C:\Windows\System\vHuAGli.exe
  2⤵
  PID:8020
- C:\Windows\System\OvdRBra.exe
  C:\Windows\System\OvdRBra.exe
  2⤵
  PID:8032
- C:\Windows\System\QkeUNmp.exe
  C:\Windows\System\QkeUNmp.exe
  2⤵
  PID:8052
- C:\Windows\System\oJgSZsE.exe
  C:\Windows\System\oJgSZsE.exe
  2⤵
  PID:8068
- C:\Windows\System\WomBhfx.exe
  C:\Windows\System\WomBhfx.exe
  2⤵
  PID:8084
- C:\Windows\System\wnPSdWT.exe
  C:\Windows\System\wnPSdWT.exe
  2⤵
  PID:8116
- C:\Windows\System\WxoTItC.exe
  C:\Windows\System\WxoTItC.exe
  2⤵
  PID:8172
- C:\Windows\System\sGObWBd.exe
  C:\Windows\System\sGObWBd.exe
  2⤵
  PID:8184
- C:\Windows\System\LoHMtmG.exe
  C:\Windows\System\LoHMtmG.exe
  2⤵
  PID:7196
- C:\Windows\System\QLmqCam.exe
  C:\Windows\System\QLmqCam.exe
  2⤵
  PID:7484
- C:\Windows\System\rumfAdG.exe
  C:\Windows\System\rumfAdG.exe
  2⤵
  PID:7248
- C:\Windows\System\oJQkInB.exe
  C:\Windows\System\oJQkInB.exe
  2⤵
  PID:7280
- C:\Windows\System\eYGQZCn.exe
  C:\Windows\System\eYGQZCn.exe
  2⤵
  PID:7496
- C:\Windows\System\eARuJeI.exe
  C:\Windows\System\eARuJeI.exe
  2⤵
  PID:7656
- C:\Windows\System\crPmZNJ.exe
  C:\Windows\System\crPmZNJ.exe
  2⤵
  PID:7544
- C:\Windows\System\ycYGEyg.exe
  C:\Windows\System\ycYGEyg.exe
  2⤵
  PID:7612
- C:\Windows\System\NhNhhus.exe
  C:\Windows\System\NhNhhus.exe
  2⤵
  PID:7564
- C:\Windows\System\LQcFwWr.exe
  C:\Windows\System\LQcFwWr.exe
  2⤵
  PID:7912
- C:\Windows\System\pxBYKFf.exe
  C:\Windows\System\pxBYKFf.exe
  2⤵
  PID:7824
- C:\Windows\System\Wkktyem.exe
  C:\Windows\System\Wkktyem.exe
  2⤵
  PID:7956
- C:\Windows\System\zvoCdQr.exe
  C:\Windows\System\zvoCdQr.exe
  2⤵
  PID:7228
- C:\Windows\System\FtbeJMG.exe
  C:\Windows\System\FtbeJMG.exe
  2⤵
  PID:7732
- C:\Windows\System\JEhlzoy.exe
  C:\Windows\System\JEhlzoy.exe
  2⤵
  PID:7876
- C:\Windows\System\ttQdfzj.exe
  C:\Windows\System\ttQdfzj.exe
  2⤵
  PID:8048
- C:\Windows\System\WYiYzoU.exe
  C:\Windows\System\WYiYzoU.exe
  2⤵
  PID:8152
- C:\Windows\System\BIrQfcl.exe
  C:\Windows\System\BIrQfcl.exe
  2⤵
  PID:7212
- C:\Windows\System\aVTBugK.exe
  C:\Windows\System\aVTBugK.exe
  2⤵
  PID:8064
- C:\Windows\System\GacNmEs.exe
  C:\Windows\System\GacNmEs.exe
  2⤵
  PID:7252
- C:\Windows\System\swMLOwl.exe
  C:\Windows\System\swMLOwl.exe
  2⤵
  PID:7468
- C:\Windows\System\XcfkytC.exe
  C:\Windows\System\XcfkytC.exe
  2⤵
  PID:7364
- C:\Windows\System\yJwVNCv.exe
  C:\Windows\System\yJwVNCv.exe
  2⤵
  PID:7672
- C:\Windows\System\tIfLYwa.exe
  C:\Windows\System\tIfLYwa.exe
  2⤵
  PID:7560
- C:\Windows\System\zvfvDIG.exe
  C:\Windows\System\zvfvDIG.exe
  2⤵
  PID:7976
- C:\Windows\System\uvWgByD.exe
  C:\Windows\System\uvWgByD.exe
  2⤵
  PID:8036
- C:\Windows\System\FebtGMy.exe
  C:\Windows\System\FebtGMy.exe
  2⤵
  PID:7444
- C:\Windows\System\kkCfYtA.exe
  C:\Windows\System\kkCfYtA.exe
  2⤵
  PID:7432
- C:\Windows\System\LwWutJX.exe
  C:\Windows\System\LwWutJX.exe
  2⤵
  PID:7880
- C:\Windows\System\xAqgMgU.exe
  C:\Windows\System\xAqgMgU.exe
  2⤵
  PID:8060
- C:\Windows\System\YsmLBEJ.exe
  C:\Windows\System\YsmLBEJ.exe
  2⤵
  PID:7512
- C:\Windows\System\lsfmtfN.exe
  C:\Windows\System\lsfmtfN.exe
  2⤵
  PID:8120
- C:\Windows\System\PlRGUbb.exe
  C:\Windows\System\PlRGUbb.exe
  2⤵
  PID:7624
- C:\Windows\System\pxOIZvQ.exe
  C:\Windows\System\pxOIZvQ.exe
  2⤵
  PID:8000
- C:\Windows\System\OpvUWlz.exe
  C:\Windows\System\OpvUWlz.exe
  2⤵
  PID:7820
- C:\Windows\System\hcMCyhB.exe
  C:\Windows\System\hcMCyhB.exe
  2⤵
  PID:6656
- C:\Windows\System\oIaRnYK.exe
  C:\Windows\System\oIaRnYK.exe
  2⤵
  PID:7964
- C:\Windows\System\LxfiKjQ.exe
  C:\Windows\System\LxfiKjQ.exe
  2⤵
  PID:7992
- C:\Windows\System\zsHiypu.exe
  C:\Windows\System\zsHiypu.exe
  2⤵
  PID:7412
- C:\Windows\System\QDKcLuX.exe
  C:\Windows\System\QDKcLuX.exe
  2⤵
  PID:7628
- C:\Windows\System\cjbmynr.exe
  C:\Windows\System\cjbmynr.exe
  2⤵
  PID:7244
- C:\Windows\System\HycbADy.exe
  C:\Windows\System\HycbADy.exe
  2⤵
  PID:7720
- C:\Windows\System\eQfpcrM.exe
  C:\Windows\System\eQfpcrM.exe
  2⤵
  PID:7692
- C:\Windows\System\tFIjRvZ.exe
  C:\Windows\System\tFIjRvZ.exe
  2⤵
  PID:8204
- C:\Windows\System\AwolpnS.exe
  C:\Windows\System\AwolpnS.exe
  2⤵
  PID:8220
- C:\Windows\System\iXTeQXy.exe
  C:\Windows\System\iXTeQXy.exe
  2⤵
  PID:8240
- C:\Windows\System\NCdGFiz.exe
  C:\Windows\System\NCdGFiz.exe
  2⤵
  PID:8256
- C:\Windows\System\tWHIdXv.exe
  C:\Windows\System\tWHIdXv.exe
  2⤵
  PID:8276
- C:\Windows\System\STjUEjx.exe
  C:\Windows\System\STjUEjx.exe
  2⤵
  PID:8292
- C:\Windows\System\XbTkOAp.exe
  C:\Windows\System\XbTkOAp.exe
  2⤵
  PID:8308
- C:\Windows\System\arCUkwr.exe
  C:\Windows\System\arCUkwr.exe
  2⤵
  PID:8324
- C:\Windows\System\GTBYxfH.exe
  C:\Windows\System\GTBYxfH.exe
  2⤵
  PID:8340
- C:\Windows\System\NrzAvIk.exe
  C:\Windows\System\NrzAvIk.exe
  2⤵
  PID:8360
- C:\Windows\System\eZoaJck.exe
  C:\Windows\System\eZoaJck.exe
  2⤵
  PID:8376
- C:\Windows\System\tyzeLiW.exe
  C:\Windows\System\tyzeLiW.exe
  2⤵
  PID:8396
- C:\Windows\System\HjVeoqi.exe
  C:\Windows\System\HjVeoqi.exe
  2⤵
  PID:8412
- C:\Windows\System\YvxcftT.exe
  C:\Windows\System\YvxcftT.exe
  2⤵
  PID:8428
- C:\Windows\System\hUzGqUR.exe
  C:\Windows\System\hUzGqUR.exe
  2⤵
  PID:8444
- C:\Windows\System\rPIXVjk.exe
  C:\Windows\System\rPIXVjk.exe
  2⤵
  PID:8464
- C:\Windows\System\KlOTCxd.exe
  C:\Windows\System\KlOTCxd.exe
  2⤵
  PID:8480
- C:\Windows\System\ubQTgAS.exe
  C:\Windows\System\ubQTgAS.exe
  2⤵
  PID:8496
- C:\Windows\System\GCnaEup.exe
  C:\Windows\System\GCnaEup.exe
  2⤵
  PID:8560
- C:\Windows\System\rHIpeZP.exe
  C:\Windows\System\rHIpeZP.exe
  2⤵
  PID:8576
- C:\Windows\System\AvHRFlN.exe
  C:\Windows\System\AvHRFlN.exe
  2⤵
  PID:8592
- C:\Windows\System\rFPKJiA.exe
  C:\Windows\System\rFPKJiA.exe
  2⤵
  PID:8616
- C:\Windows\System\wVayZjq.exe
  C:\Windows\System\wVayZjq.exe
  2⤵
  PID:8636
- C:\Windows\System\rwNPlAE.exe
  C:\Windows\System\rwNPlAE.exe
  2⤵
  PID:8656
- C:\Windows\System\PrYZXdS.exe
  C:\Windows\System\PrYZXdS.exe
  2⤵
  PID:8672
- C:\Windows\System\cJDsKux.exe
  C:\Windows\System\cJDsKux.exe
  2⤵
  PID:8688
- C:\Windows\System\MSRQkCY.exe
  C:\Windows\System\MSRQkCY.exe
  2⤵
  PID:8708
- C:\Windows\System\PezFyeX.exe
  C:\Windows\System\PezFyeX.exe
  2⤵
  PID:8796
- C:\Windows\System\GnTtPBc.exe
  C:\Windows\System\GnTtPBc.exe
  2⤵
  PID:8812
- C:\Windows\System\uAbGDod.exe
  C:\Windows\System\uAbGDod.exe
  2⤵
  PID:8828
- C:\Windows\System\gbVJyPn.exe
  C:\Windows\System\gbVJyPn.exe
  2⤵
  PID:8844
- C:\Windows\System\FjHdgoE.exe
  C:\Windows\System\FjHdgoE.exe
  2⤵
  PID:8860
- C:\Windows\System\lcbdBBZ.exe
  C:\Windows\System\lcbdBBZ.exe
  2⤵
  PID:8876
- C:\Windows\System\EiGnppc.exe
  C:\Windows\System\EiGnppc.exe
  2⤵
  PID:8896
- C:\Windows\System\XVvbIxY.exe
  C:\Windows\System\XVvbIxY.exe
  2⤵
  PID:8912
- C:\Windows\System\fTarjoL.exe
  C:\Windows\System\fTarjoL.exe
  2⤵
  PID:8932
- C:\Windows\System\laAxCxe.exe
  C:\Windows\System\laAxCxe.exe
  2⤵
  PID:8948
- C:\Windows\System\prqCzlN.exe
  C:\Windows\System\prqCzlN.exe
  2⤵
  PID:8968
- C:\Windows\System\AlZBEZT.exe
  C:\Windows\System\AlZBEZT.exe
  2⤵
  PID:8984
- C:\Windows\System\tUvASvz.exe
  C:\Windows\System\tUvASvz.exe
  2⤵
  PID:9000
- C:\Windows\System\aTIXXLN.exe
  C:\Windows\System\aTIXXLN.exe
  2⤵
  PID:9020
- C:\Windows\System\CKoarXT.exe
  C:\Windows\System\CKoarXT.exe
  2⤵
  PID:9036
- C:\Windows\System\jODXnDH.exe
  C:\Windows\System\jODXnDH.exe
  2⤵
  PID:9052
- C:\Windows\System\LitIwjf.exe
  C:\Windows\System\LitIwjf.exe
  2⤵
  PID:9072
- C:\Windows\System\wXoxnIU.exe
  C:\Windows\System\wXoxnIU.exe
  2⤵
  PID:9088
- C:\Windows\System\PHHHwIx.exe
  C:\Windows\System\PHHHwIx.exe
  2⤵
  PID:9172
- C:\Windows\System\tyymPRS.exe
  C:\Windows\System\tyymPRS.exe
  2⤵
  PID:9188
- C:\Windows\System\dugmMHS.exe
  C:\Windows\System\dugmMHS.exe
  2⤵
  PID:9204
- C:\Windows\System\qygfbMJ.exe
  C:\Windows\System\qygfbMJ.exe
  2⤵
  PID:8236
- C:\Windows\System\jHCNOkS.exe
  C:\Windows\System\jHCNOkS.exe
  2⤵
  PID:8196
- C:\Windows\System\OVrkrIp.exe
  C:\Windows\System\OVrkrIp.exe
  2⤵
  PID:8016
- C:\Windows\System\VedKkuw.exe
  C:\Windows\System\VedKkuw.exe
  2⤵
  PID:8140
- C:\Windows\System\DbMvHqO.exe
  C:\Windows\System\DbMvHqO.exe
  2⤵
  PID:8188
- C:\Windows\System\wHxGeeo.exe
  C:\Windows\System\wHxGeeo.exe
  2⤵
  PID:8248
- C:\Windows\System\EqKwujC.exe
  C:\Windows\System\EqKwujC.exe
  2⤵
  PID:8316
- C:\Windows\System\SLXYvJT.exe
  C:\Windows\System\SLXYvJT.exe
  2⤵
  PID:8384
- C:\Windows\System\batnazc.exe
  C:\Windows\System\batnazc.exe
  2⤵
  PID:8460
- C:\Windows\System\AkIMDfp.exe
  C:\Windows\System\AkIMDfp.exe
  2⤵
  PID:8516
- C:\Windows\System\axviKyt.exe
  C:\Windows\System\axviKyt.exe
  2⤵
  PID:8512
- C:\Windows\System\ghHMyid.exe
  C:\Windows\System\ghHMyid.exe
  2⤵
  PID:8532
- C:\Windows\System\AgPJrKu.exe
  C:\Windows\System\AgPJrKu.exe
  2⤵
  PID:8548
- C:\Windows\System\QVrDAdL.exe
  C:\Windows\System\QVrDAdL.exe
  2⤵
  PID:8572
- C:\Windows\System\raIEzJd.exe
  C:\Windows\System\raIEzJd.exe
  2⤵
  PID:8628
- C:\Windows\System\jYoYbgp.exe
  C:\Windows\System\jYoYbgp.exe
  2⤵
  PID:8604
- C:\Windows\System\RaKMSkE.exe
  C:\Windows\System\RaKMSkE.exe
  2⤵
  PID:8648
- C:\Windows\System\ppcgSmC.exe
  C:\Windows\System\ppcgSmC.exe
  2⤵
  PID:8700
- C:\Windows\System\zwMrDxT.exe
  C:\Windows\System\zwMrDxT.exe
  2⤵
  PID:8720
- C:\Windows\System\KtchCEM.exe
  C:\Windows\System\KtchCEM.exe
  2⤵
  PID:8716
- C:\Windows\System\nxnjzBc.exe
  C:\Windows\System\nxnjzBc.exe
  2⤵
  PID:8756
- C:\Windows\System\OnqUFiu.exe
  C:\Windows\System\OnqUFiu.exe
  2⤵
  PID:8768
- C:\Windows\System\oKVPmdA.exe
  C:\Windows\System\oKVPmdA.exe
  2⤵
  PID:9008
- C:\Windows\System\kKrnIrG.exe
  C:\Windows\System\kKrnIrG.exe
  2⤵
  PID:9044
- C:\Windows\System\BwRKtvy.exe
  C:\Windows\System\BwRKtvy.exe
  2⤵
  PID:8820
- C:\Windows\System\ZMHCvvf.exe
  C:\Windows\System\ZMHCvvf.exe
  2⤵
  PID:9108
- C:\Windows\System\ylArHdJ.exe
  C:\Windows\System\ylArHdJ.exe
  2⤵
  PID:8888
- C:\Windows\System\rulMJnX.exe
  C:\Windows\System\rulMJnX.exe
  2⤵
  PID:8928
- C:\Windows\System\SiYogng.exe
  C:\Windows\System\SiYogng.exe
  2⤵
  PID:8996
- C:\Windows\System\LaickyV.exe
  C:\Windows\System\LaickyV.exe
  2⤵
  PID:9132
- C:\Windows\System\UbFUdcX.exe
  C:\Windows\System\UbFUdcX.exe
  2⤵
  PID:9148
- C:\Windows\System\jAoLQdE.exe
  C:\Windows\System\jAoLQdE.exe
  2⤵
  PID:9164
- C:\Windows\System\VQrdfKf.exe
  C:\Windows\System\VQrdfKf.exe
  2⤵
  PID:9196
- C:\Windows\System\OuqrxZp.exe
  C:\Windows\System\OuqrxZp.exe
  2⤵
  PID:8232
- C:\Windows\System\uLOSWro.exe
  C:\Windows\System\uLOSWro.exe
  2⤵
  PID:8268
- C:\Windows\System\jKBeClS.exe
  C:\Windows\System\jKBeClS.exe
  2⤵
  PID:8476
- C:\Windows\System\ztdIKoQ.exe
  C:\Windows\System\ztdIKoQ.exe
  2⤵
  PID:7384
- C:\Windows\System\VYHkYfZ.exe
  C:\Windows\System\VYHkYfZ.exe
  2⤵
  PID:8216
- C:\Windows\System\tIzIlvt.exe
  C:\Windows\System\tIzIlvt.exe
  2⤵
  PID:8352
- C:\Windows\System\RWCPSBA.exe
  C:\Windows\System\RWCPSBA.exe
  2⤵
  PID:8456
- C:\Windows\System\MsCCiQz.exe
  C:\Windows\System\MsCCiQz.exe
  2⤵
  PID:8544
- C:\Windows\System\yAFbNJO.exe
  C:\Windows\System\yAFbNJO.exe
  2⤵
  PID:8528
- C:\Windows\System\YzwtmTd.exe
  C:\Windows\System\YzwtmTd.exe
  2⤵
  PID:8668
- C:\Windows\System\CGsWEyc.exe
  C:\Windows\System\CGsWEyc.exe
  2⤵
  PID:8748
- C:\Windows\System\ugjPsOj.exe
  C:\Windows\System\ugjPsOj.exe
  2⤵
  PID:8776
- C:\Windows\System\aJAncuf.exe
  C:\Windows\System\aJAncuf.exe
  2⤵
  PID:8804
- C:\Windows\System\kjDrmzF.exe
  C:\Windows\System\kjDrmzF.exe
  2⤵
  PID:8868
- C:\Windows\System\nZMyZAJ.exe
  C:\Windows\System\nZMyZAJ.exe
  2⤵
  PID:8976
- C:\Windows\System\JrBFwdn.exe
  C:\Windows\System\JrBFwdn.exe
  2⤵
  PID:9016
- C:\Windows\System\VXlLgGg.exe
  C:\Windows\System\VXlLgGg.exe
  2⤵
  PID:8884
- C:\Windows\System\stOwAQL.exe
  C:\Windows\System\stOwAQL.exe
  2⤵
  PID:8920
- C:\Windows\System\AzPnAkm.exe
  C:\Windows\System\AzPnAkm.exe
  2⤵
  PID:9068
- C:\Windows\System\cPFPrXh.exe
  C:\Windows\System\cPFPrXh.exe
  2⤵
  PID:9100
- C:\Windows\System\aovwOay.exe
  C:\Windows\System\aovwOay.exe
  2⤵
  PID:9140
- C:\Windows\System\eqnTLyY.exe
  C:\Windows\System\eqnTLyY.exe
  2⤵
  PID:9180
- C:\Windows\System\RaKvmno.exe
  C:\Windows\System\RaKvmno.exe
  2⤵
  PID:8228
- C:\Windows\System\PXqRnjz.exe
  C:\Windows\System\PXqRnjz.exe
  2⤵
  PID:7480
- C:\Windows\System\rllPqgP.exe
  C:\Windows\System\rllPqgP.exe
  2⤵
  PID:8392
- C:\Windows\System\IoWmXup.exe
  C:\Windows\System\IoWmXup.exe
  2⤵
  PID:8540
- C:\Windows\System\XJreRAi.exe
  C:\Windows\System\XJreRAi.exe
  2⤵
  PID:8664
- C:\Windows\System\DsyMnfO.exe
  C:\Windows\System\DsyMnfO.exe
  2⤵
  PID:8452
- C:\Windows\System\YNZrpeN.exe
  C:\Windows\System\YNZrpeN.exe
  2⤵
  PID:8732
- C:\Windows\System\MJaZDDL.exe
  C:\Windows\System\MJaZDDL.exe
  2⤵
  PID:8836
- C:\Windows\System\uRPQJAW.exe
  C:\Windows\System\uRPQJAW.exe
  2⤵
  PID:8420
- C:\Windows\System\mHMjOoP.exe
  C:\Windows\System\mHMjOoP.exe
  2⤵
  PID:9104
- C:\Windows\System\XoLWHvF.exe
  C:\Windows\System\XoLWHvF.exe
  2⤵
  PID:9160
- C:\Windows\System\diHwNGm.exe
  C:\Windows\System\diHwNGm.exe
  2⤵
  PID:8288
- C:\Windows\System\ZesQJzP.exe
  C:\Windows\System\ZesQJzP.exe
  2⤵
  PID:8736
- C:\Windows\System\FLSFOpe.exe
  C:\Windows\System\FLSFOpe.exe
  2⤵
  PID:8908
- C:\Windows\System\ygsrjdj.exe
  C:\Windows\System\ygsrjdj.exe
  2⤵
  PID:8356
- C:\Windows\System\KoLRZLC.exe
  C:\Windows\System\KoLRZLC.exe
  2⤵
  PID:8588
- C:\Windows\System\eUdcnTZ.exe
  C:\Windows\System\eUdcnTZ.exe
  2⤵
  PID:9156
- C:\Windows\System\PflcFnP.exe
  C:\Windows\System\PflcFnP.exe
  2⤵
  PID:9012
- C:\Windows\System\wJCFVeD.exe
  C:\Windows\System\wJCFVeD.exe
  2⤵
  PID:8960
- C:\Windows\System\uUcJrRG.exe
  C:\Windows\System\uUcJrRG.exe
  2⤵
  PID:1012
- C:\Windows\System\wMAcbJQ.exe
  C:\Windows\System\wMAcbJQ.exe
  2⤵
  PID:8424
- C:\Windows\System\spNYdRM.exe
  C:\Windows\System\spNYdRM.exe
  2⤵
  PID:8788
- C:\Windows\System\bLdwNAT.exe
  C:\Windows\System\bLdwNAT.exe
  2⤵
  PID:9064
- C:\Windows\System\vWozgnT.exe
  C:\Windows\System\vWozgnT.exe
  2⤵
  PID:8944
- C:\Windows\System\CDIMmDi.exe
  C:\Windows\System\CDIMmDi.exe
  2⤵
  PID:9228
- C:\Windows\System\OPvafTL.exe
  C:\Windows\System\OPvafTL.exe
  2⤵
  PID:9248
- C:\Windows\System\BaFltAp.exe
  C:\Windows\System\BaFltAp.exe
  2⤵
  PID:9264
- C:\Windows\System\SjcEqwE.exe
  C:\Windows\System\SjcEqwE.exe
  2⤵
  PID:9284
- C:\Windows\System\DiDOosD.exe
  C:\Windows\System\DiDOosD.exe
  2⤵
  PID:9324
- C:\Windows\System\ERRYvug.exe
  C:\Windows\System\ERRYvug.exe
  2⤵
  PID:9340
- C:\Windows\System\YeHQquQ.exe
  C:\Windows\System\YeHQquQ.exe
  2⤵
  PID:9360
- C:\Windows\System\oqLlPhe.exe
  C:\Windows\System\oqLlPhe.exe
  2⤵
  PID:9376
- C:\Windows\System\XgjnUwR.exe
  C:\Windows\System\XgjnUwR.exe
  2⤵
  PID:9392
- C:\Windows\System\dfJQxIC.exe
  C:\Windows\System\dfJQxIC.exe
  2⤵
  PID:9412
- C:\Windows\System\clVFdwd.exe
  C:\Windows\System\clVFdwd.exe
  2⤵
  PID:9428
- C:\Windows\System\gDKEGGn.exe
  C:\Windows\System\gDKEGGn.exe
  2⤵
  PID:9444
- C:\Windows\System\mrLxYIL.exe
  C:\Windows\System\mrLxYIL.exe
  2⤵
  PID:9464
- C:\Windows\System\hjIYhcR.exe
  C:\Windows\System\hjIYhcR.exe
  2⤵
  PID:9480
- C:\Windows\System\bIygMlX.exe
  C:\Windows\System\bIygMlX.exe
  2⤵
  PID:9500
- C:\Windows\System\HDTdRor.exe
  C:\Windows\System\HDTdRor.exe
  2⤵
  PID:9516
- C:\Windows\System\dFaqzQo.exe
  C:\Windows\System\dFaqzQo.exe
  2⤵
  PID:9532
- C:\Windows\System\SiLPPRt.exe
  C:\Windows\System\SiLPPRt.exe
  2⤵
  PID:9560
- C:\Windows\System\SnFyIdq.exe
  C:\Windows\System\SnFyIdq.exe
  2⤵
  PID:9608
- C:\Windows\System\XfzqoxT.exe
  C:\Windows\System\XfzqoxT.exe
  2⤵
  PID:9624
- C:\Windows\System\zyrgwfH.exe
  C:\Windows\System\zyrgwfH.exe
  2⤵
  PID:9640
- C:\Windows\System\PvPtcVt.exe
  C:\Windows\System\PvPtcVt.exe
  2⤵
  PID:9656
- C:\Windows\System\sDYezFY.exe
  C:\Windows\System\sDYezFY.exe
  2⤵
  PID:9672
- C:\Windows\System\ZxsVLKz.exe
  C:\Windows\System\ZxsVLKz.exe
  2⤵
  PID:9688
- C:\Windows\System\ZaZPrHL.exe
  C:\Windows\System\ZaZPrHL.exe
  2⤵
  PID:9724
- C:\Windows\System\fZUQNQF.exe
  C:\Windows\System\fZUQNQF.exe
  2⤵
  PID:9744
- C:\Windows\System\XUffuXl.exe
  C:\Windows\System\XUffuXl.exe
  2⤵
  PID:9772
- C:\Windows\System\pwFmAEe.exe
  C:\Windows\System\pwFmAEe.exe
  2⤵
  PID:9788
- C:\Windows\System\MLdFAxM.exe
  C:\Windows\System\MLdFAxM.exe
  2⤵
  PID:9808
- C:\Windows\System\hDPnXiw.exe
  C:\Windows\System\hDPnXiw.exe
  2⤵
  PID:9824
- C:\Windows\System\vacBOCq.exe
  C:\Windows\System\vacBOCq.exe
  2⤵
  PID:9844
- C:\Windows\System\cQenQWC.exe
  C:\Windows\System\cQenQWC.exe
  2⤵
  PID:9860
- C:\Windows\System\bWjYypm.exe
  C:\Windows\System\bWjYypm.exe
  2⤵
  PID:9880
- C:\Windows\System\DxtRGyP.exe
  C:\Windows\System\DxtRGyP.exe
  2⤵
  PID:9896
- C:\Windows\System\CRANMFS.exe
  C:\Windows\System\CRANMFS.exe
  2⤵
  PID:9912
- C:\Windows\System\ZdjhDnn.exe
  C:\Windows\System\ZdjhDnn.exe
  2⤵
  PID:9932
- C:\Windows\System\YkxFTSp.exe
  C:\Windows\System\YkxFTSp.exe
  2⤵
  PID:9948
- C:\Windows\System\HGSHabR.exe
  C:\Windows\System\HGSHabR.exe
  2⤵
  PID:9996
- C:\Windows\System\QYYrNNY.exe
  C:\Windows\System\QYYrNNY.exe
  2⤵
  PID:10012
- C:\Windows\System\QlxUbaT.exe
  C:\Windows\System\QlxUbaT.exe
  2⤵
  PID:10028
- C:\Windows\System\ITTaOAi.exe
  C:\Windows\System\ITTaOAi.exe
  2⤵
  PID:10044
- C:\Windows\System\yijzrsF.exe
  C:\Windows\System\yijzrsF.exe
  2⤵
  PID:10068
- C:\Windows\System\oJXqvVW.exe
  C:\Windows\System\oJXqvVW.exe
  2⤵
  PID:10084
- C:\Windows\System\zUkaHqH.exe
  C:\Windows\System\zUkaHqH.exe
  2⤵
  PID:10100
- C:\Windows\System\rIuJTYv.exe
  C:\Windows\System\rIuJTYv.exe
  2⤵
  PID:10124
- C:\Windows\System\xlgdBde.exe
  C:\Windows\System\xlgdBde.exe
  2⤵
  PID:10140
- C:\Windows\System\oiiIFRO.exe
  C:\Windows\System\oiiIFRO.exe
  2⤵
  PID:10156
- C:\Windows\System\zVnPkwr.exe
  C:\Windows\System\zVnPkwr.exe
  2⤵
  PID:10176
- C:\Windows\System\lYhlaNP.exe
  C:\Windows\System\lYhlaNP.exe
  2⤵
  PID:10192
- C:\Windows\System\UbTjUVF.exe
  C:\Windows\System\UbTjUVF.exe
  2⤵
  PID:10208
- C:\Windows\System\ytkWbYS.exe
  C:\Windows\System\ytkWbYS.exe
  2⤵
  PID:10224
- C:\Windows\System\FqGorlQ.exe
  C:\Windows\System\FqGorlQ.exe
  2⤵
  PID:8272
- C:\Windows\System\hScLLPT.exe
  C:\Windows\System\hScLLPT.exe
  2⤵
  PID:9244
- C:\Windows\System\qRNtMyw.exe
  C:\Windows\System\qRNtMyw.exe
  2⤵
  PID:9220
- C:\Windows\System\KIxzkii.exe
  C:\Windows\System\KIxzkii.exe
  2⤵
  PID:9292
- C:\Windows\System\gfZgyFZ.exe
  C:\Windows\System\gfZgyFZ.exe
  2⤵
  PID:9300
- C:\Windows\System\VIuUEVT.exe
  C:\Windows\System\VIuUEVT.exe
  2⤵
  PID:9260
- C:\Windows\System\pnPdjYA.exe
  C:\Windows\System\pnPdjYA.exe
  2⤵
  PID:9440
- C:\Windows\System\vYQgsfM.exe
  C:\Windows\System\vYQgsfM.exe
  2⤵
  PID:9476
- C:\Windows\System\NyFJPxP.exe
  C:\Windows\System\NyFJPxP.exe
  2⤵
  PID:9540
- C:\Windows\System\McSimAh.exe
  C:\Windows\System\McSimAh.exe
  2⤵
  PID:9548
- C:\Windows\System\HwIdNLo.exe
  C:\Windows\System\HwIdNLo.exe
  2⤵
  PID:9496
- C:\Windows\System\SzRKeUY.exe
  C:\Windows\System\SzRKeUY.exe
  2⤵
  PID:9456
- C:\Windows\System\iUBUPrH.exe
  C:\Windows\System\iUBUPrH.exe
  2⤵
  PID:9568
- C:\Windows\System\OZfrdro.exe
  C:\Windows\System\OZfrdro.exe
  2⤵
  PID:9588
- C:\Windows\System\tmaQvri.exe
  C:\Windows\System\tmaQvri.exe
  2⤵
  PID:9684
- C:\Windows\System\SFHYadn.exe
  C:\Windows\System\SFHYadn.exe
  2⤵
  PID:9716
- C:\Windows\System\CiGJldC.exe
  C:\Windows\System\CiGJldC.exe
  2⤵
  PID:9720
- C:\Windows\System\scHNskE.exe
  C:\Windows\System\scHNskE.exe
  2⤵
  PID:9740
- C:\Windows\System\ZvGvgaG.exe
  C:\Windows\System\ZvGvgaG.exe
  2⤵
  PID:9764
- C:\Windows\System\PcPwTnu.exe
  C:\Windows\System\PcPwTnu.exe
  2⤵
  PID:9816
- C:\Windows\System\nnWZuAi.exe
  C:\Windows\System\nnWZuAi.exe
  2⤵
  PID:9832
- C:\Windows\System\sNyCbhK.exe
  C:\Windows\System\sNyCbhK.exe
  2⤵
  PID:9888
- C:\Windows\System\vuXOYan.exe
  C:\Windows\System\vuXOYan.exe
  2⤵
  PID:9944
- C:\Windows\System\XkPXVUV.exe
  C:\Windows\System\XkPXVUV.exe
  2⤵
  PID:9876
- C:\Windows\System\gRTykZK.exe
  C:\Windows\System\gRTykZK.exe
  2⤵
  PID:9960
- C:\Windows\System\bdavOTu.exe
  C:\Windows\System\bdavOTu.exe
  2⤵
  PID:9580
- C:\Windows\System\ftdvgow.exe
  C:\Windows\System\ftdvgow.exe
  2⤵
  PID:10020
- C:\Windows\System\mlYNQEu.exe
  C:\Windows\System\mlYNQEu.exe
  2⤵
  PID:10052
- C:\Windows\System\eYOQfGS.exe
  C:\Windows\System\eYOQfGS.exe
  2⤵
  PID:10096
- C:\Windows\System\FlXmBgN.exe
  C:\Windows\System\FlXmBgN.exe
  2⤵
  PID:10080
- C:\Windows\System\cIJNMxY.exe
  C:\Windows\System\cIJNMxY.exe
  2⤵
  PID:10112
- C:\Windows\System\xVlKsgn.exe
  C:\Windows\System\xVlKsgn.exe
  2⤵
  PID:7676
- C:\Windows\System\SnEKedL.exe
  C:\Windows\System\SnEKedL.exe
  2⤵
  PID:8612
- C:\Windows\System\mfhVrdj.exe
  C:\Windows\System\mfhVrdj.exe
  2⤵
  PID:9336
- C:\Windows\System\mfmtUat.exe
  C:\Windows\System\mfmtUat.exe
  2⤵
  PID:10220
- C:\Windows\System\oopUyBf.exe
  C:\Windows\System\oopUyBf.exe
  2⤵
  PID:10040
- C:\Windows\System\QKmPSgr.exe
  C:\Windows\System\QKmPSgr.exe
  2⤵
  PID:9544
- C:\Windows\System\mmsYjOk.exe
  C:\Windows\System\mmsYjOk.exe
  2⤵
  PID:9316
- C:\Windows\System\fYfFPuo.exe
  C:\Windows\System\fYfFPuo.exe
  2⤵
  PID:9420
- C:\Windows\System\ItSRsAH.exe
  C:\Windows\System\ItSRsAH.exe
  2⤵
  PID:9652
- C:\Windows\System\oLcoOHc.exe
  C:\Windows\System\oLcoOHc.exe
  2⤵
  PID:9576
- C:\Windows\System\BOPvmja.exe
  C:\Windows\System\BOPvmja.exe
  2⤵
  PID:9664
- C:\Windows\System\FWwJfmY.exe
  C:\Windows\System\FWwJfmY.exe
  2⤵
  PID:9704
- C:\Windows\System\NySeCXB.exe
  C:\Windows\System\NySeCXB.exe
  2⤵
  PID:9756
- C:\Windows\System\HyxmkBC.exe
  C:\Windows\System\HyxmkBC.exe
  2⤵
  PID:9920
- C:\Windows\System\YRhyycE.exe
  C:\Windows\System\YRhyycE.exe
  2⤵
  PID:9940
- C:\Windows\System\rqINAcP.exe
  C:\Windows\System\rqINAcP.exe
  2⤵
  PID:10092
- C:\Windows\System\ONwNVoD.exe
  C:\Windows\System\ONwNVoD.exe
  2⤵
  PID:9784
- C:\Windows\System\NTCzpIH.exe
  C:\Windows\System\NTCzpIH.exe
  2⤵
  PID:9836
- C:\Windows\System\FufKIga.exe
  C:\Windows\System\FufKIga.exe
  2⤵
  PID:10136
- C:\Windows\System\GHhVeLp.exe
  C:\Windows\System\GHhVeLp.exe
  2⤵
  PID:10232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APFqFdx.exe

Filesize
1.4MB

MD5
d632d78af52bed2f454ac72967e390ea

SHA1
ca647c3cf587af7ebedb15299087ee534b11d41e

SHA256
a9b13ba9446828e629edee4ad7a10a88f12d0cfd8d0d969b0d90dddd4ef7ce5a

SHA512
45a68decc777516bcc148555507976692a20f00e7c38baf9660c6477028ff73465a80a68492f1ae7ed22a6fb50726f26d5af15306ed2709b22bd59a09326a763

Download Submit
C:\Windows\system\DsIfpAe.exe

Filesize
1.4MB

MD5
6e81e0b82999e46c552c73ba7211ec41

SHA1
eb1e53cec835deb93b386c6493e29ef34bafecb3

SHA256
a6bd6745cd3f74483a5b66ef14119e8743e9122b63ede63d665d05a1a3ac09fb

SHA512
1ee65b4629084efd13067079e428e585d5ff8fd820ad6d31b2cb8bff702030880cc8cca1946a5c1629db718538661b45d1daba3a50c7ea42fb8f07562ee17769

Download Submit
C:\Windows\system\EMkdtEj.exe

Filesize
1.4MB

MD5
20847a3b76c774d099872e2b34dd2574

SHA1
83f94320bc00ef84bddf289ee389095e8d637082

SHA256
e3cb1fb81dd54e1f991f06f1778df9db2d55a90e641d4a548ea055059cc09823

SHA512
3936e020d8e1e71e18a1495d1d2c385066b99d29082e1f773e24f196bcb1ab8dd79680e89efff6ad530694ce53db8492e12ae989e56d5119bf90343020fdf79e

Download Submit
C:\Windows\system\HYHABKa.exe

Filesize
1.4MB

MD5
ea6d81de179135e0f6c625a8e5d96c50

SHA1
ffad085f99df1955303feb02bef514d0b18f005a

SHA256
e90ea1ce1bd3331db37cf816f1b0d36641d9a66634fda8e01faee1e0f414a5b8

SHA512
1ea713cdccb7368220b0f09130dadd21dfca52f459b0f8ba43b7c73abbf8ea0a85c38fd45e4517117c89f436820543a508c11c2e23e3adb3745b5b88d980e31a

Download Submit
C:\Windows\system\HaxFlFu.exe

Filesize
1.4MB

MD5
ecacc8646616e69286f7a81ecc9722d3

SHA1
8e40fba9b5057191c739c5c627c11005ad3e04df

SHA256
1f5698a875cda4bb16a9f02c19fd4c46abc59775830dd0437c19fc405757a851

SHA512
1aed62290964489eba08e8c24921d465178e26f45fa373a3ec2dc78460784b195a192bf84ef16f38a9ac29b903f5b127326b9a06a847b3cb4b1c4838509c4441

Download Submit
C:\Windows\system\KvDUuRN.exe

Filesize
1.4MB

MD5
4e350228e9113773a0bee521d9e9047c

SHA1
eeaff823e43c4e37ae9306a3c7efc9c25bab2eb8

SHA256
bbc461c7220c692274f611e55fcef0af6d1c030e770fcfeddcde456b367691d0

SHA512
1f1f3f01e32a3308fc0fe8c400ffc73be1f86e5ec12dca45c34a85f1f5af31a28067481f0867f4fda2fa4e84dcda4d25ca086e6c8f44d33324705d5908d1b13f

Download Submit
C:\Windows\system\NLwecvv.exe

Filesize
1.4MB

MD5
d2d31e9d7a8f0242a78ef6060c0111bc

SHA1
cf459980511040268861a6aa581f3939fff0c517

SHA256
a694b60be79ba7ccda651b7098d8aee86f9a4ff55b39c35e2a5be2f8b7957857

SHA512
9d30841eccacef5b118608e77fac2c9716da3df3ced84060f34e06c3ec5daad368868c83c4eea2ab3dcfd63596e8c1a06af7ea8e63af518f5a65f677d4dd3e24

Download Submit
C:\Windows\system\POGczeR.exe

Filesize
1.4MB

MD5
d6e9f5df7b86f8461f697ffacdecca2f

SHA1
c488b33570e987bd2ead0cb193783d68ffba9778

SHA256
5d9fc8bea1f11e9bd7336455b25fd648606cb9030c58a2a0d6aed35ed06bca9f

SHA512
50ecf3f596dbd8df263aed41d038d7fa10561b83b3ec1569e2a551e88a1799e1efcd58aa3a5605a977e680df4196e37435a63a26a14bd623283c4fe8f6e5c75c

Download Submit
C:\Windows\system\PXmDvON.exe

Filesize
1.4MB

MD5
ac5a4349e5c2ec08674ed7721bfc19fe

SHA1
3e8fb51ae713f91e52e3df57d9479c2567e0328c

SHA256
a1274832d6da4827af782b010b0ab220700a21716d8cfc49145ca3a7422f3a71

SHA512
b0f112de71ff9bf6e9f53bcca2d8e46e8602435dce2346f33b205cca220466129644b341fd0cc3ea9b0e6b3d121b4dcd0a1c9ab12dab9aabb088295d6f4958c4

Download Submit
C:\Windows\system\PfVEmSu.exe

Filesize
1.4MB

MD5
3beee7f67ce47c8f6c9b2a8fe95f44c8

SHA1
99bcf7bb1bd0e895e93b56c3ba2838fe4df57461

SHA256
7352de008026afe911be980d267c20565e60ddd4f8a836faa1ff99e0a837b73a

SHA512
34ab8e6ff0cac9101937712f1dbc06e0ff18580565755506e9a4ba5cbe9977ac0c4e1c2045a92fd2fc4615e26c106523dfea5cf7bb92300212493237e8d6950f

Download Submit
C:\Windows\system\ShTnxIa.exe

Filesize
1.4MB

MD5
24f9b94d7824c792dbb0d486c07a87ba

SHA1
c578e9bcb3b48f9b4868275b4cf643ce7a40558a

SHA256
8011c86728e039afaa08a62a6a90e9f9a75da02e20d6589c2e03b274a8eeafa4

SHA512
54101e1b139e01d52ff29601b6f44220219a490ba693affb5052aff12e2c4a09ceefba8aae436a998c47b5d8c20731fe7977f459bf9370d2a9d4c9d41c51c617

Download Submit
C:\Windows\system\YqdKXiq.exe

Filesize
1.4MB

MD5
5e409ee764abd01ece1fa248e9718830

SHA1
5b7d40e50299ecde6f9e1429fc04af92786254ea

SHA256
a2d5885838f3b5e19604b50a5a628fd3d3ea75a4d3f90649511f01ab05695da8

SHA512
ac8a7dd6726403eaf88a2e3020575a1c86114c4796b92cb00cd5ce674ed0dcecb7a3f289f4035bb53d9ed5c2e4188788c11cbdaa67fbb97ab9de0a7bd3087700

Download Submit
C:\Windows\system\ZMaVRbz.exe

Filesize
1.4MB

MD5
e656fad32d083d14f105dd4e8b23a204

SHA1
1dd238f680b38bed64493b4ed0c7012fa092f25b

SHA256
457d6ab2d0eae246dc38532f589080b4eeb097c4bbf449c734942872ad4308b5

SHA512
1009fadfbf4489c07d2d4a1b6e1b71e1df3035e0cdffc6d375262b1bc1cc145046e051281dadaee654cc00c61f55cf7b684542eb8af6ebce00f493df43221586

Download Submit
C:\Windows\system\ZWXTBjF.exe

Filesize
1.4MB

MD5
2d0e14ef751c036032b469a5d3514d52

SHA1
9b5a7b218f412531a3ff12806dcfd8426ea42a8e

SHA256
e54305daef78dcd4038494356cdb4bd5b6baebe92715d21f84e54d2f51edbf58

SHA512
58e8d8ead2210a5096b0384eacc217636ed3a2f11b35e095bbae09b1fdbf953bf21aff717ff6c030b4b5521e86063790861f1b733d06ba81f1a13b3fd593eba7

Download Submit
C:\Windows\system\ZfHxqaL.exe

Filesize
1.4MB

MD5
0c852817952c90598041417a5a3f0968

SHA1
659abfba28d2ab059ca6390a3acdccf8500e19e9

SHA256
4a9a60a2cef31d9a48cf8edb5f5bb6c0ed3541157a31896768fa68d6adb46893

SHA512
29342e34b879ae8c5bcfa0c92f3890283a945a541ff148ff88a530a8ae8182c2649c06098e3fc525b70e89203db819f0d83f95ce392b84e2387e88a66c324972

Download Submit
C:\Windows\system\afBLyWB.exe

Filesize
1.4MB

MD5
7518551c4f8dec21f68e33ff9cdcafc8

SHA1
24bfb0f212dd174df32e0fe51e593e18cac09b27

SHA256
6f0b6945881f0e5e9cd0a7d9258e07e26627b0cb4bf97f98831c6dbc986dbb7f

SHA512
2739430fe2e33da6ec05cd9d231701be025dc44826cd1c6d8565c969bbbfe89847377fcafdea0bd304ec45f63974de3bec46b67c0eef8cc9f0ecee52613d3f77

Download Submit
C:\Windows\system\amXXNgL.exe

Filesize
1.4MB

MD5
60f81b2134ac1fa637082f22c76d7425

SHA1
e5e7a9dfb3b136a2b32b780f73a93771a78bb597

SHA256
69de3dacbdb4833112efa52dde50d850ceb4ad34932bf6010131ccaec9305134

SHA512
de97c3713fd59a4be527b840007157b950840cd67858583355a83b408ae290d5cf752016c0e7b27080863f4984e983dbac9f090d636fef47feec3e76e7529a61

Download Submit
C:\Windows\system\caeXkwk.exe

Filesize
1.4MB

MD5
42a2c8b18d5938fc69e769904d1a30e9

SHA1
49a09402aabd6fb8b2891dc1f047028ca10a326c

SHA256
341e887e5532b9fa520d5421c46e8603b8eff046b348db496dd8e2a952e26454

SHA512
1b33aef57ee399845e96cbc8a7e2c8455963c6b8ebe68b98678affbbf026c1c9a80a39517fde9022d1f85b556ee3de5e8279c1837f9e276ded792e1999cb001a

Download Submit
C:\Windows\system\ccDirjX.exe

Filesize
1.4MB

MD5
42d94f8a52a48d5b52deafe34e7f9427

SHA1
c4b539c7f5f665524da9e094189a92015defc769

SHA256
60c8b656640d64249fdedd3847e2ae7038dc6b643b640570a7bf10c3ab8b34df

SHA512
5f06c440e865c86762826d579c5c2ff2e8a354c6cc3d6d301cdcbd5700a713ac1414367c8d9e12870e08eb32eb41cc9047b65032f8a2c2af7ac4f9eff7669cf9

Download Submit
C:\Windows\system\esidOyn.exe

Filesize
1.4MB

MD5
1fc1b01fe361292f24034a772999fbc2

SHA1
2f1852354675fdb28a10ae53b4fb394c05b0eed0

SHA256
1bba63ef8842bf178db5f0410083ab0ecc8d88799999c3d7a5904570c6bb7639

SHA512
6526cbd23049240e12e91761e4eb8ca665b6cd188d0d1ec5370b7fead56a31b75648c6e383f6b4548e487ce4e269ad13bf3c169303fe880e8ed1bded515d68d0

Download Submit
C:\Windows\system\fSgFDRM.exe

Filesize
1.4MB

MD5
65ea46fa108212fe345d9ad6798df216

SHA1
73093774c7c0acb44b5f8427570137616f6f5c30

SHA256
3309c4c6ef0a4c24e067f40edfb67ad48383ce37eaedc38aaf7dd69b08281d94

SHA512
7f62416e58e802d761a51668a2e6d11b8fdd2c2804ef47e6c1144801a4b6b4d4f589fed97fdbad64169ea9e1fe7392d2c9588bdaa1e8fdb6393ae72d52987d25

Download Submit
C:\Windows\system\hZxeLHS.exe

Filesize
1.4MB

MD5
129269cd158e06808cea4abc15400b2b

SHA1
30ffdd1242d2f99fb900009763ba0e69c1910b16

SHA256
e1c64affa3f869ecab4b14a76fe166e439e8b25dd8aa55c3197f45b59630057f

SHA512
509f0106a0fac878f1ff94a0dd4e285dcc3cc7f9d2f6ea9517e46ff5eecf0e9ffd2603a006e5d2e33d546edbc88ba6e4722678398930f4d4c455b2c9a9d330f9

Download Submit
C:\Windows\system\iXmuYQN.exe

Filesize
1.4MB

MD5
3198b48f6ceeae599f11ff3c192c62c0

SHA1
7e88f15a5976787dcc363ddf79527f06ff0c4811

SHA256
63ef69750a41b082f7ead0ac78cade4b7792d863f3ace665074b63398ea0ef9b

SHA512
d815bbf057b53de994ffbc1c65981c119c4b3b6687950202d771c94cdbe17ee0f06748f64af9157530248ca6acc2a8a0d1e218d69e746c72f537ca18b7d23baf

Download Submit
C:\Windows\system\kHrMBJN.exe

Filesize
1.4MB

MD5
d59e125dee413e5a179cb7050ded4d7f

SHA1
f5b44f902c7676062e26ad2e62d759a0c86f2bd1

SHA256
8f114a89a9ba75a65b79420e613e98cc3941eec9b961ace4b6dbe7d22108308d

SHA512
d3ca122a885310bf72bbfebe80fdb01e5426efc09fc860763f6d3025e90ea7b7e42fc3eb28ee045eabf70f742e4e5700356079bb2be4f950560471ff94f2d8e8

Download Submit
C:\Windows\system\ryExork.exe

Filesize
1.4MB

MD5
490db1e9545ae9a90ff916fce40948e3

SHA1
ced24b2d30e6b6676ebff3209bd66cc0df46ae99

SHA256
a126573a1900d8a58d3cb4ed5f5ada0ca26446ea089d12c70d032aef731f763f

SHA512
9e7b7ea375f0cf6dacc82217a771b9a570eea3b8f50c1490a42546dcec004b6b3e22db420a8793fc3eb132cf6d1623b0eb084c730b5482291ad78ea38d33b2ae

Download Submit
C:\Windows\system\vJDWwZS.exe

Filesize
1.4MB

MD5
783fc77971f315c1725031eaf0bb7fbb

SHA1
cfc6b913cf852bc1e1461b81e3946dde5e515404

SHA256
2150012aa1a4c50a76f702419b68eaeac4d10d98114abe4527ba579940c68155

SHA512
0ffa197cb4a481720bfdd2bb9c6c838873dd6003eab7d5d0cc68b34e5c3b7bf4e81975f5622f8dcbf91efc581e736f6ca8efe518ec6b7d0f23f508bdb93a16b4

Download Submit
C:\Windows\system\vLzVjDV.exe

Filesize
1.4MB

MD5
437353d811daf38826a8678db978dc3b

SHA1
a394daa398bf287cacbcbae2d791aeaa9d7bb011

SHA256
bf061e6d8aa2bdb7a578ca5788f2e9632cfabbf2e0b0e5d4d34462902a1233a2

SHA512
aab4f3b3c2b4143c7a296dd3fe5177003f48bd322454a58d144436f3aae0042b30f9582f689bd9862c9a6e8fc5282199f80e50fff342fb60a4cfe56154657000

Download Submit
C:\Windows\system\zfvKfjl.exe

Filesize
1.4MB

MD5
e10608039047520d29f76d8d7ce9e893

SHA1
a10fd84f26c4eeefd66ba6bf58f3ea5cc46c1ed7

SHA256
8af7ff50c8b1e226f7b8dda38bd02433ce5519dc782df8280a866da6cb0fc6ae

SHA512
70dc10244edbbf4bbbbb08cc41dd62eb41f40c7ab4abc552008f3c4156b40648333300becd558856c3eaaff96a5a7ff9df7e42074849149d97bc3e3a5c79e061

Download Submit
\Windows\system\AzedPNC.exe

Filesize
1.4MB

MD5
97d73bd32e524d4b0bab0b1f941bf15f

SHA1
cc4d60f95cfc72f853f9dd24ed22759f62fc02a7

SHA256
f099355304815d9a17d83d78a43c4f8d222a5e1db6bbd22d631f43194e22d29c

SHA512
7b6226bca7db814bf492223551eb646ead2b10066a8de23381012088e52e0c890237de3bc909134eba32e032d89ab058cd76762e46a75ed579c71e5253d1d25b

Download Submit
\Windows\system\TKreFYc.exe

Filesize
1.4MB

MD5
619ef52d01e9a6b45b8ef9a683fe8e4c

SHA1
936563fdcf597bff0cd8cf606c015da20b2f27e6

SHA256
efdc0be56173196397334ab78289af4ed398b5409ed72ae4e1448dcb72dedea3

SHA512
f65286f3547d1037add820f3c96f2b351c0084c594b5576b357ae359c40e456657c308faf37a3e2e1c2b879eb1a256ddd49125a76f26c3c6397dd9f560680a26

Download Submit
\Windows\system\XrIUWlb.exe

Filesize
1.4MB

MD5
31c8932ba5955a6759588bd5ce201864

SHA1
86aa8be15c41c5c6b56e6f605fad33f25052d680

SHA256
ad935869743927a8088defac4e314a4b46c680d266d01a3120a129a8be319fc4

SHA512
1b092d960905ee9dafe8ddf4bf4c1a94b65ec38ce7be8a47e9c5188c2238b2663eb9a5cdcd3e3a7e8c92be7008b5620433ca066a2be51bcfc025bbe9380f5ed6

Download Submit
\Windows\system\oEqTSDZ.exe

Filesize
1.4MB

MD5
a994ccc0426e0f746deb13a40ff51a4e

SHA1
a76ebdf347006f64daaef8d5275a80cb0c4c6f3c

SHA256
121383f6fa06dd2b70eeca337e1109f28fd6d96fc8b6b74523491d4124498028

SHA512
6e05392f49605fdb6de8e767f96ef9ba1e1b82e9c4ed5d66d595e29ffe5e350bfdee79bc21fdcae339508d1e1b72b0ab16cf1a3deca163e70ad7d03fd0c777d1

Download Submit
memory/332-13-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/332-3830-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/332-109-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/1464-98-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/1464-3737-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2160-3822-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2160-88-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2204-3828-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2204-96-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2388-3824-0x000000013F220000-0x000000013F571000-memory.dmp

Filesize
3.3MB

Download
memory/2388-16-0x000000013F220000-0x000000013F571000-memory.dmp

Filesize
3.3MB

Download
memory/2388-1072-0x000000013F220000-0x000000013F571000-memory.dmp

Filesize
3.3MB

Download
memory/2452-3814-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/2452-64-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-14-0x000000013F220000-0x000000013F571000-memory.dmp

Filesize
3.3MB

Download
memory/2540-87-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2540-7847-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-97-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-7627-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-67-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2540-66-0x000000013F650000-0x000000013F9A1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-89-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2540-63-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-110-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-61-0x000000013F9D0000-0x000000013FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2540-51-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-7312-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2540-42-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2540-400-0x000000013FF80000-0x00000001402D1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-10-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2540-2710-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-37-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-32-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2540-23-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-0-0x000000013FF80000-0x00000001402D1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2540-401-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2540-1787-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/2572-28-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2572-3831-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2572-1085-0x000000013FAA0000-0x000000013FDF1000-memory.dmp

Filesize
3.3MB

Download
memory/2632-86-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2632-3829-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2724-74-0x000000013F650000-0x000000013F9A1000-memory.dmp

Filesize
3.3MB

Download
memory/2724-3823-0x000000013F650000-0x000000013F9A1000-memory.dmp

Filesize
3.3MB

Download
memory/2752-62-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2752-3826-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2756-60-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2756-3819-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2788-3825-0x000000013F9D0000-0x000000013FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2788-68-0x000000013F9D0000-0x000000013FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2824-3832-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2824-73-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2840-3821-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2840-1790-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2840-58-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download