xmrig | d9060f899491cd54e7f352c38dcadf8d871d41fff7332fafccc72fdd3bb675f1

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c14ff57520845a71ea834f8ae3ae5b0N.exe
Size

1.8MB
MD5

5c14ff57520845a71ea834f8ae3ae5b0
SHA1

08a3e008f443c1450d138eff9f7ffc2aa7d1f316
SHA256

d9060f899491cd54e7f352c38dcadf8d871d41fff7332fafccc72fdd3bb675f1
SHA512

fe4869aa3d506874484000fba5eaf95e31278a9da330c95d04425e4852f1b75c5472e62e8a6435fc2c9f6277b7a0800a03ed59f47efa1f99fe34b1990d194c4c
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727F15qbruh/lzapbFe6LmsD8JNHo4lup64Oh8Wnil5p:ROdWCCi7/rahlqOllgoJsT4gvmqGG4+

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-212-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/2796-260-0x000000013F500000-0x000000013F851000-memory.dmp	xmrig
behavioral1/memory/2348-258-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2712-256-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2744-254-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/2632-252-0x000000013FF70000-0x00000001402C1000-memory.dmp	xmrig
behavioral1/memory/3012-250-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2880-248-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2828-246-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2756-244-0x000000013FCB0000-0x0000000140001000-memory.dmp	xmrig
behavioral1/memory/2240-242-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/2808-240-0x000000013F6D0000-0x000000013FA21000-memory.dmp	xmrig
behavioral1/memory/2328-238-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/1748-237-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2344-236-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/1748-3819-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/3064-3982-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/2328-4233-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2828-4224-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2240-4221-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/3012-4220-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2744-4201-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/2808-4359-0x000000013F6D0000-0x000000013FA21000-memory.dmp	xmrig
behavioral1/memory/2348-4196-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2796-4366-0x000000013F500000-0x000000013F851000-memory.dmp	xmrig
behavioral1/memory/2880-4375-0x000000013FA80000-0x000000013FDD1000-memory.dmp	xmrig
behavioral1/memory/2712-4374-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2756-4410-0x000000013FCB0000-0x0000000140001000-memory.dmp	xmrig
behavioral1/memory/2632-4622-0x000000013FF70000-0x00000001402C1000-memory.dmp	xmrig
behavioral1/memory/2344-4624-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3064	JaKycSC.exe
2344	iQOwJKQ.exe
2328	KIkkDOU.exe
2808	HqtvraN.exe
2240	Yvjeqrp.exe
2756	wVWwSTu.exe
2828	TMjjjAz.exe
2880	BdiNUPE.exe
3012	Dypdmmh.exe
2632	yWOlcnb.exe
2744	uIepAlD.exe
2712	TdLOBHx.exe
2348	SpYdNvX.exe
2796	sFnIWud.exe
2624	EBKcihX.exe
2380	IopMfHk.exe
2696	GTVdeIr.exe
2888	AkuvVxr.exe
2132	iooeTSd.exe
644	WsjwHEg.exe
1788	QfNXOhU.exe
2960	nASKxHw.exe
2384	iYuZLwT.exe
1512	vkOMYLH.exe
2916	CqtQvOT.exe
1884	MilOIoo.exe
1916	bnfGblz.exe
2160	dPMyMyc.exe
2208	PEIRrZM.exe
1656	ldmLtXY.exe
804	eGavGOE.exe
2956	hNQijPv.exe
584	RCFhXcp.exe
568	GiCGolc.exe
3032	bqpmgNW.exe
1912	zGnJoPg.exe
496	xQlkWuU.exe
952	HfNAqUb.exe
448	rroIuNP.exe
2004	zDrTVCz.exe
3024	dxBrKaY.exe
1556	SYuCpQN.exe
1284	hiXnGAr.exe
1076	ljBBFsg.exe
1580	VxzGUZc.exe
668	TxNiZwk.exe
2728	oMuPvJJ.exe
1836	qfzgFbf.exe
1460	JwKrCzj.exe
1736	pmXXoeB.exe
2468	coUYhoC.exe
1852	lpnLmHS.exe
1684	fZeYOei.exe
936	JFbxjxH.exe
2052	HLYWhOj.exe
1708	yXtJYUt.exe
1096	fjSgdxI.exe
1192	lNqgXiL.exe
2532	hflWqcv.exe
2552	UEMJOSb.exe
2716	tlPCknN.exe
2360	HjTPyDF.exe
2896	xNnJojj.exe
2816	ykiYVsK.exe

Loads dropped DLL 64 IoCs

pid	Process
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe
1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1748-0-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x0007000000012117-6.dat	upx
behavioral1/files/0x00070000000194fa-10.dat	upx
behavioral1/files/0x0007000000019506-16.dat	upx
behavioral1/files/0x000600000001957d-23.dat	upx
behavioral1/files/0x00060000000195e6-31.dat	upx
behavioral1/files/0x0005000000019d5e-54.dat	upx
behavioral1/files/0x0005000000019dd3-62.dat	upx
behavioral1/files/0x000500000001a43a-98.dat	upx
behavioral1/files/0x000500000001a441-104.dat	upx
behavioral1/memory/3064-212-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/memory/2796-260-0x000000013F500000-0x000000013F851000-memory.dmp	upx
behavioral1/memory/2348-258-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/memory/2712-256-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2744-254-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/memory/2632-252-0x000000013FF70000-0x00000001402C1000-memory.dmp	upx
behavioral1/memory/3012-250-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2880-248-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/memory/2828-246-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/memory/2756-244-0x000000013FCB0000-0x0000000140001000-memory.dmp	upx
behavioral1/memory/2240-242-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/memory/2808-240-0x000000013F6D0000-0x000000013FA21000-memory.dmp	upx
behavioral1/memory/2328-238-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/2344-236-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/files/0x000500000001a4b3-130.dat	upx
behavioral1/files/0x000500000001a4b2-127.dat	upx
behavioral1/files/0x000500000001a4a7-122.dat	upx
behavioral1/files/0x000500000001a485-115.dat	upx
behavioral1/files/0x000500000001a4a5-119.dat	upx
behavioral1/files/0x000500000001a44b-110.dat	upx
behavioral1/files/0x000500000001a373-90.dat	upx
behavioral1/files/0x000500000001a43d-102.dat	upx
behavioral1/files/0x000500000001a438-95.dat	upx
behavioral1/files/0x000500000001a321-86.dat	upx
behavioral1/files/0x000500000001a0b8-82.dat	upx
behavioral1/files/0x000500000001a098-78.dat	upx
behavioral1/files/0x000500000001a08f-74.dat	upx
behavioral1/files/0x0005000000019fd6-70.dat	upx
behavioral1/files/0x0005000000019fb8-66.dat	upx
behavioral1/files/0x0005000000019dc7-58.dat	upx
behavioral1/files/0x0005000000019d36-50.dat	upx
behavioral1/files/0x0005000000019c6e-46.dat	upx
behavioral1/files/0x0005000000019c54-42.dat	upx
behavioral1/files/0x0005000000019c52-38.dat	upx
behavioral1/files/0x0008000000019619-35.dat	upx
behavioral1/files/0x00060000000195a1-26.dat	upx
behavioral1/files/0x00070000000194f0-11.dat	upx
behavioral1/memory/1748-3819-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/3064-3982-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/memory/2328-4233-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/2828-4224-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/memory/2240-4221-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/memory/3012-4220-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2744-4201-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/memory/2808-4359-0x000000013F6D0000-0x000000013FA21000-memory.dmp	upx
behavioral1/memory/2348-4196-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/memory/2796-4366-0x000000013F500000-0x000000013F851000-memory.dmp	upx
behavioral1/memory/2880-4375-0x000000013FA80000-0x000000013FDD1000-memory.dmp	upx
behavioral1/memory/2712-4374-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2756-4410-0x000000013FCB0000-0x0000000140001000-memory.dmp	upx
behavioral1/memory/2632-4622-0x000000013FF70000-0x00000001402C1000-memory.dmp	upx
behavioral1/memory/2344-4624-0x000000013FE40000-0x0000000140191000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eExukGH.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\nVOITah.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\fUwoGeC.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\ZAsIcdb.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\yHRXGlf.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\HpWmaWY.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\bPgFBFV.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\yTsFUQL.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\OxPjBFp.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\OxlnJQB.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\dEungls.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\NtbUoDQ.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\hFXwUZe.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\qZmCNwd.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\soCMFZW.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\SwnBBme.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\RBmihpB.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\CTPlLuK.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\oMuPvJJ.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\wzxaykO.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\eDVEQEw.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\AuzulSh.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\SLohZFp.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\jAtEFDX.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\UFjVoUG.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\fvdJcvq.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\EZFEdZP.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\GujBWAJ.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\fckAYiI.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\pkETSFR.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\DXhStjc.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\XKsZrFx.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\lfaEgdV.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\AvEbyiR.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\iuMhrYy.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\eStpXpl.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\XMqwgeA.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\imLTRja.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\uabRYGW.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\lWRwIpr.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\oZBtPyt.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\KiMRRvN.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\uBLkqhK.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\nFjYeOW.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\WzpmkLF.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\WeEuniE.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\xXbCeHB.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\fvmkUIH.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\eRcfyKf.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\rfnCZIU.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\MMRnnTm.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\lESWsbP.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\VJXmdNt.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\aOjBBoA.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\rWEJPDu.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\jokhCzf.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\gNcwTwg.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\fBwuNlC.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\YeRIGTn.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\xPbYBcP.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\FCzwFvl.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\rCoCSFd.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\jJmHmhC.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe
File created	C:\Windows\System\jMTCwJM.exe	5c14ff57520845a71ea834f8ae3ae5b0N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3064	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	31
PID 1748 wrote to memory of 3064	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	31
PID 1748 wrote to memory of 3064	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	31
PID 1748 wrote to memory of 2344	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	32
PID 1748 wrote to memory of 2344	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	32
PID 1748 wrote to memory of 2344	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	32
PID 1748 wrote to memory of 2328	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	33
PID 1748 wrote to memory of 2328	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	33
PID 1748 wrote to memory of 2328	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	33
PID 1748 wrote to memory of 2808	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	34
PID 1748 wrote to memory of 2808	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	34
PID 1748 wrote to memory of 2808	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	34
PID 1748 wrote to memory of 2240	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	35
PID 1748 wrote to memory of 2240	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	35
PID 1748 wrote to memory of 2240	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	35
PID 1748 wrote to memory of 2756	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	36
PID 1748 wrote to memory of 2756	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	36
PID 1748 wrote to memory of 2756	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	36
PID 1748 wrote to memory of 2828	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	37
PID 1748 wrote to memory of 2828	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	37
PID 1748 wrote to memory of 2828	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	37
PID 1748 wrote to memory of 2880	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	38
PID 1748 wrote to memory of 2880	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	38
PID 1748 wrote to memory of 2880	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	38
PID 1748 wrote to memory of 3012	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	39
PID 1748 wrote to memory of 3012	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	39
PID 1748 wrote to memory of 3012	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	39
PID 1748 wrote to memory of 2632	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	40
PID 1748 wrote to memory of 2632	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	40
PID 1748 wrote to memory of 2632	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	40
PID 1748 wrote to memory of 2744	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	41
PID 1748 wrote to memory of 2744	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	41
PID 1748 wrote to memory of 2744	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	41
PID 1748 wrote to memory of 2712	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	42
PID 1748 wrote to memory of 2712	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	42
PID 1748 wrote to memory of 2712	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	42
PID 1748 wrote to memory of 2348	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	43
PID 1748 wrote to memory of 2348	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	43
PID 1748 wrote to memory of 2348	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	43
PID 1748 wrote to memory of 2796	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	44
PID 1748 wrote to memory of 2796	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	44
PID 1748 wrote to memory of 2796	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	44
PID 1748 wrote to memory of 2624	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	45
PID 1748 wrote to memory of 2624	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	45
PID 1748 wrote to memory of 2624	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	45
PID 1748 wrote to memory of 2380	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	46
PID 1748 wrote to memory of 2380	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	46
PID 1748 wrote to memory of 2380	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	46
PID 1748 wrote to memory of 2696	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	47
PID 1748 wrote to memory of 2696	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	47
PID 1748 wrote to memory of 2696	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	47
PID 1748 wrote to memory of 2888	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	48
PID 1748 wrote to memory of 2888	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	48
PID 1748 wrote to memory of 2888	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	48
PID 1748 wrote to memory of 2132	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	49
PID 1748 wrote to memory of 2132	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	49
PID 1748 wrote to memory of 2132	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	49
PID 1748 wrote to memory of 644	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	50
PID 1748 wrote to memory of 644	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	50
PID 1748 wrote to memory of 644	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	50
PID 1748 wrote to memory of 1788	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	51
PID 1748 wrote to memory of 1788	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	51
PID 1748 wrote to memory of 1788	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	51
PID 1748 wrote to memory of 2960	1748	5c14ff57520845a71ea834f8ae3ae5b0N.exe	52

C:\Users\Admin\AppData\Local\Temp\5c14ff57520845a71ea834f8ae3ae5b0N.exe
"C:\Users\Admin\AppData\Local\Temp\5c14ff57520845a71ea834f8ae3ae5b0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\System\JaKycSC.exe
  C:\Windows\System\JaKycSC.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\iQOwJKQ.exe
  C:\Windows\System\iQOwJKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\KIkkDOU.exe
  C:\Windows\System\KIkkDOU.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\HqtvraN.exe
  C:\Windows\System\HqtvraN.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\Yvjeqrp.exe
  C:\Windows\System\Yvjeqrp.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\wVWwSTu.exe
  C:\Windows\System\wVWwSTu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\TMjjjAz.exe
  C:\Windows\System\TMjjjAz.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\BdiNUPE.exe
  C:\Windows\System\BdiNUPE.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\Dypdmmh.exe
  C:\Windows\System\Dypdmmh.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yWOlcnb.exe
  C:\Windows\System\yWOlcnb.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\uIepAlD.exe
  C:\Windows\System\uIepAlD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TdLOBHx.exe
  C:\Windows\System\TdLOBHx.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\SpYdNvX.exe
  C:\Windows\System\SpYdNvX.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\sFnIWud.exe
  C:\Windows\System\sFnIWud.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\EBKcihX.exe
  C:\Windows\System\EBKcihX.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\IopMfHk.exe
  C:\Windows\System\IopMfHk.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\GTVdeIr.exe
  C:\Windows\System\GTVdeIr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AkuvVxr.exe
  C:\Windows\System\AkuvVxr.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\iooeTSd.exe
  C:\Windows\System\iooeTSd.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\WsjwHEg.exe
  C:\Windows\System\WsjwHEg.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\QfNXOhU.exe
  C:\Windows\System\QfNXOhU.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\nASKxHw.exe
  C:\Windows\System\nASKxHw.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\iYuZLwT.exe
  C:\Windows\System\iYuZLwT.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\vkOMYLH.exe
  C:\Windows\System\vkOMYLH.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\CqtQvOT.exe
  C:\Windows\System\CqtQvOT.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\bnfGblz.exe
  C:\Windows\System\bnfGblz.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\MilOIoo.exe
  C:\Windows\System\MilOIoo.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\dPMyMyc.exe
  C:\Windows\System\dPMyMyc.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\PEIRrZM.exe
  C:\Windows\System\PEIRrZM.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ldmLtXY.exe
  C:\Windows\System\ldmLtXY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\eGavGOE.exe
  C:\Windows\System\eGavGOE.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\hNQijPv.exe
  C:\Windows\System\hNQijPv.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RCFhXcp.exe
  C:\Windows\System\RCFhXcp.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\GiCGolc.exe
  C:\Windows\System\GiCGolc.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\bqpmgNW.exe
  C:\Windows\System\bqpmgNW.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\zGnJoPg.exe
  C:\Windows\System\zGnJoPg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\xQlkWuU.exe
  C:\Windows\System\xQlkWuU.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\HfNAqUb.exe
  C:\Windows\System\HfNAqUb.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\rroIuNP.exe
  C:\Windows\System\rroIuNP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\zDrTVCz.exe
  C:\Windows\System\zDrTVCz.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\dxBrKaY.exe
  C:\Windows\System\dxBrKaY.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\SYuCpQN.exe
  C:\Windows\System\SYuCpQN.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\hiXnGAr.exe
  C:\Windows\System\hiXnGAr.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\ljBBFsg.exe
  C:\Windows\System\ljBBFsg.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\VxzGUZc.exe
  C:\Windows\System\VxzGUZc.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\TxNiZwk.exe
  C:\Windows\System\TxNiZwk.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\oMuPvJJ.exe
  C:\Windows\System\oMuPvJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qfzgFbf.exe
  C:\Windows\System\qfzgFbf.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\JwKrCzj.exe
  C:\Windows\System\JwKrCzj.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\pmXXoeB.exe
  C:\Windows\System\pmXXoeB.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\coUYhoC.exe
  C:\Windows\System\coUYhoC.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\lpnLmHS.exe
  C:\Windows\System\lpnLmHS.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\fZeYOei.exe
  C:\Windows\System\fZeYOei.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\JFbxjxH.exe
  C:\Windows\System\JFbxjxH.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\HLYWhOj.exe
  C:\Windows\System\HLYWhOj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\yXtJYUt.exe
  C:\Windows\System\yXtJYUt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\fjSgdxI.exe
  C:\Windows\System\fjSgdxI.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\lNqgXiL.exe
  C:\Windows\System\lNqgXiL.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\hflWqcv.exe
  C:\Windows\System\hflWqcv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\HjTPyDF.exe
  C:\Windows\System\HjTPyDF.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\UEMJOSb.exe
  C:\Windows\System\UEMJOSb.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\xNnJojj.exe
  C:\Windows\System\xNnJojj.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\tlPCknN.exe
  C:\Windows\System\tlPCknN.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ykiYVsK.exe
  C:\Windows\System\ykiYVsK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\oHYkJBj.exe
  C:\Windows\System\oHYkJBj.exe
  2⤵
  PID:2320
- C:\Windows\System\sGjeTBc.exe
  C:\Windows\System\sGjeTBc.exe
  2⤵
  PID:856
- C:\Windows\System\DCHAuJq.exe
  C:\Windows\System\DCHAuJq.exe
  2⤵
  PID:2064
- C:\Windows\System\kiNgVvQ.exe
  C:\Windows\System\kiNgVvQ.exe
  2⤵
  PID:1120
- C:\Windows\System\PnuNgqm.exe
  C:\Windows\System\PnuNgqm.exe
  2⤵
  PID:744
- C:\Windows\System\RAljKwt.exe
  C:\Windows\System\RAljKwt.exe
  2⤵
  PID:2288
- C:\Windows\System\VlFFOrv.exe
  C:\Windows\System\VlFFOrv.exe
  2⤵
  PID:1020
- C:\Windows\System\PVPnQfG.exe
  C:\Windows\System\PVPnQfG.exe
  2⤵
  PID:2276
- C:\Windows\System\fhtrexT.exe
  C:\Windows\System\fhtrexT.exe
  2⤵
  PID:1840
- C:\Windows\System\arEuvvJ.exe
  C:\Windows\System\arEuvvJ.exe
  2⤵
  PID:1292
- C:\Windows\System\ftIkWks.exe
  C:\Windows\System\ftIkWks.exe
  2⤵
  PID:2256
- C:\Windows\System\aLhrUiX.exe
  C:\Windows\System\aLhrUiX.exe
  2⤵
  PID:2284
- C:\Windows\System\ULOmMly.exe
  C:\Windows\System\ULOmMly.exe
  2⤵
  PID:2560
- C:\Windows\System\xanydKl.exe
  C:\Windows\System\xanydKl.exe
  2⤵
  PID:1908
- C:\Windows\System\VWokaCS.exe
  C:\Windows\System\VWokaCS.exe
  2⤵
  PID:1688
- C:\Windows\System\JNsnftb.exe
  C:\Windows\System\JNsnftb.exe
  2⤵
  PID:1860
- C:\Windows\System\BWgsPiV.exe
  C:\Windows\System\BWgsPiV.exe
  2⤵
  PID:2544
- C:\Windows\System\ixckwuB.exe
  C:\Windows\System\ixckwuB.exe
  2⤵
  PID:1504
- C:\Windows\System\woSPRpO.exe
  C:\Windows\System\woSPRpO.exe
  2⤵
  PID:2260
- C:\Windows\System\lztAvKv.exe
  C:\Windows\System\lztAvKv.exe
  2⤵
  PID:2732
- C:\Windows\System\eStpXpl.exe
  C:\Windows\System\eStpXpl.exe
  2⤵
  PID:2440
- C:\Windows\System\ooiuawF.exe
  C:\Windows\System\ooiuawF.exe
  2⤵
  PID:2152
- C:\Windows\System\djDJfQi.exe
  C:\Windows\System\djDJfQi.exe
  2⤵
  PID:2484
- C:\Windows\System\ZkNlgNn.exe
  C:\Windows\System\ZkNlgNn.exe
  2⤵
  PID:2512
- C:\Windows\System\XMqwgeA.exe
  C:\Windows\System\XMqwgeA.exe
  2⤵
  PID:700
- C:\Windows\System\JtIMPYQ.exe
  C:\Windows\System\JtIMPYQ.exe
  2⤵
  PID:1652
- C:\Windows\System\HUhBMPr.exe
  C:\Windows\System\HUhBMPr.exe
  2⤵
  PID:3060
- C:\Windows\System\tAYhkLY.exe
  C:\Windows\System\tAYhkLY.exe
  2⤵
  PID:2452
- C:\Windows\System\iFfirCd.exe
  C:\Windows\System\iFfirCd.exe
  2⤵
  PID:968
- C:\Windows\System\HQrPRHq.exe
  C:\Windows\System\HQrPRHq.exe
  2⤵
  PID:1956
- C:\Windows\System\XhMsSzm.exe
  C:\Windows\System\XhMsSzm.exe
  2⤵
  PID:1080
- C:\Windows\System\GgbULus.exe
  C:\Windows\System\GgbULus.exe
  2⤵
  PID:1468
- C:\Windows\System\CwLAWQK.exe
  C:\Windows\System\CwLAWQK.exe
  2⤵
  PID:1640
- C:\Windows\System\CUsEpOe.exe
  C:\Windows\System\CUsEpOe.exe
  2⤵
  PID:1892
- C:\Windows\System\CtNkTie.exe
  C:\Windows\System\CtNkTie.exe
  2⤵
  PID:2268
- C:\Windows\System\tjuPpNo.exe
  C:\Windows\System\tjuPpNo.exe
  2⤵
  PID:2116
- C:\Windows\System\ojHzBVQ.exe
  C:\Windows\System\ojHzBVQ.exe
  2⤵
  PID:1612
- C:\Windows\System\uycLqKP.exe
  C:\Windows\System\uycLqKP.exe
  2⤵
  PID:2980
- C:\Windows\System\JSVghTC.exe
  C:\Windows\System\JSVghTC.exe
  2⤵
  PID:2832
- C:\Windows\System\UQKDIjc.exe
  C:\Windows\System\UQKDIjc.exe
  2⤵
  PID:3080
- C:\Windows\System\RnuYtUZ.exe
  C:\Windows\System\RnuYtUZ.exe
  2⤵
  PID:3096
- C:\Windows\System\PxbqJMa.exe
  C:\Windows\System\PxbqJMa.exe
  2⤵
  PID:3112
- C:\Windows\System\WWoydQw.exe
  C:\Windows\System\WWoydQw.exe
  2⤵
  PID:3136
- C:\Windows\System\wzBkwHp.exe
  C:\Windows\System\wzBkwHp.exe
  2⤵
  PID:3156
- C:\Windows\System\mcRofGl.exe
  C:\Windows\System\mcRofGl.exe
  2⤵
  PID:3220
- C:\Windows\System\LcBLQWj.exe
  C:\Windows\System\LcBLQWj.exe
  2⤵
  PID:3240
- C:\Windows\System\imLTRja.exe
  C:\Windows\System\imLTRja.exe
  2⤵
  PID:3256
- C:\Windows\System\YjlizpW.exe
  C:\Windows\System\YjlizpW.exe
  2⤵
  PID:3276
- C:\Windows\System\yKBHtzZ.exe
  C:\Windows\System\yKBHtzZ.exe
  2⤵
  PID:3292
- C:\Windows\System\BMamdmM.exe
  C:\Windows\System\BMamdmM.exe
  2⤵
  PID:3316
- C:\Windows\System\OhbbSJq.exe
  C:\Windows\System\OhbbSJq.exe
  2⤵
  PID:3332
- C:\Windows\System\tAJgtCi.exe
  C:\Windows\System\tAJgtCi.exe
  2⤵
  PID:3348
- C:\Windows\System\xCBtlyL.exe
  C:\Windows\System\xCBtlyL.exe
  2⤵
  PID:3364
- C:\Windows\System\rJDhuPJ.exe
  C:\Windows\System\rJDhuPJ.exe
  2⤵
  PID:3384
- C:\Windows\System\ioisRRx.exe
  C:\Windows\System\ioisRRx.exe
  2⤵
  PID:3400
- C:\Windows\System\LXJcAUz.exe
  C:\Windows\System\LXJcAUz.exe
  2⤵
  PID:3420
- C:\Windows\System\cTBYxvP.exe
  C:\Windows\System\cTBYxvP.exe
  2⤵
  PID:3436
- C:\Windows\System\TuldhtU.exe
  C:\Windows\System\TuldhtU.exe
  2⤵
  PID:3460
- C:\Windows\System\MAMpmrq.exe
  C:\Windows\System\MAMpmrq.exe
  2⤵
  PID:3476
- C:\Windows\System\OBVNqmI.exe
  C:\Windows\System\OBVNqmI.exe
  2⤵
  PID:3520
- C:\Windows\System\VWInlMu.exe
  C:\Windows\System\VWInlMu.exe
  2⤵
  PID:3540
- C:\Windows\System\qKSUglo.exe
  C:\Windows\System\qKSUglo.exe
  2⤵
  PID:3556
- C:\Windows\System\bYxzvRH.exe
  C:\Windows\System\bYxzvRH.exe
  2⤵
  PID:3572
- C:\Windows\System\rWEJPDu.exe
  C:\Windows\System\rWEJPDu.exe
  2⤵
  PID:3588
- C:\Windows\System\nNVjqGR.exe
  C:\Windows\System\nNVjqGR.exe
  2⤵
  PID:3608
- C:\Windows\System\vZZSTNs.exe
  C:\Windows\System\vZZSTNs.exe
  2⤵
  PID:3628
- C:\Windows\System\UzDSkoD.exe
  C:\Windows\System\UzDSkoD.exe
  2⤵
  PID:3644
- C:\Windows\System\knQyUWZ.exe
  C:\Windows\System\knQyUWZ.exe
  2⤵
  PID:3664
- C:\Windows\System\XVvvwpn.exe
  C:\Windows\System\XVvvwpn.exe
  2⤵
  PID:3680
- C:\Windows\System\BcTvUXK.exe
  C:\Windows\System\BcTvUXK.exe
  2⤵
  PID:3700
- C:\Windows\System\mGHDSIF.exe
  C:\Windows\System\mGHDSIF.exe
  2⤵
  PID:3716
- C:\Windows\System\CLXkWzA.exe
  C:\Windows\System\CLXkWzA.exe
  2⤵
  PID:3736
- C:\Windows\System\eRcfyKf.exe
  C:\Windows\System\eRcfyKf.exe
  2⤵
  PID:3752
- C:\Windows\System\YOoOIAG.exe
  C:\Windows\System\YOoOIAG.exe
  2⤵
  PID:3768
- C:\Windows\System\EBvyufo.exe
  C:\Windows\System\EBvyufo.exe
  2⤵
  PID:3788
- C:\Windows\System\rSLprQv.exe
  C:\Windows\System\rSLprQv.exe
  2⤵
  PID:3812
- C:\Windows\System\LrUqekY.exe
  C:\Windows\System\LrUqekY.exe
  2⤵
  PID:3836
- C:\Windows\System\oHNNUjG.exe
  C:\Windows\System\oHNNUjG.exe
  2⤵
  PID:3852
- C:\Windows\System\EsFpSdU.exe
  C:\Windows\System\EsFpSdU.exe
  2⤵
  PID:3868
- C:\Windows\System\mIclvTD.exe
  C:\Windows\System\mIclvTD.exe
  2⤵
  PID:3884
- C:\Windows\System\jIbZcvJ.exe
  C:\Windows\System\jIbZcvJ.exe
  2⤵
  PID:3900
- C:\Windows\System\xMfBwIS.exe
  C:\Windows\System\xMfBwIS.exe
  2⤵
  PID:3916
- C:\Windows\System\QGaQdIE.exe
  C:\Windows\System\QGaQdIE.exe
  2⤵
  PID:3932
- C:\Windows\System\ynXNUzr.exe
  C:\Windows\System\ynXNUzr.exe
  2⤵
  PID:3948
- C:\Windows\System\RuaSHpP.exe
  C:\Windows\System\RuaSHpP.exe
  2⤵
  PID:3964
- C:\Windows\System\rtJzgKD.exe
  C:\Windows\System\rtJzgKD.exe
  2⤵
  PID:3980
- C:\Windows\System\uabRYGW.exe
  C:\Windows\System\uabRYGW.exe
  2⤵
  PID:3996
- C:\Windows\System\JNOybTb.exe
  C:\Windows\System\JNOybTb.exe
  2⤵
  PID:4012
- C:\Windows\System\eNLShTq.exe
  C:\Windows\System\eNLShTq.exe
  2⤵
  PID:4028
- C:\Windows\System\gRKdZDE.exe
  C:\Windows\System\gRKdZDE.exe
  2⤵
  PID:4044
- C:\Windows\System\NkbIatT.exe
  C:\Windows\System\NkbIatT.exe
  2⤵
  PID:4060
- C:\Windows\System\HMDdYRy.exe
  C:\Windows\System\HMDdYRy.exe
  2⤵
  PID:4076
- C:\Windows\System\hcbKRiB.exe
  C:\Windows\System\hcbKRiB.exe
  2⤵
  PID:4092
- C:\Windows\System\bPgFBFV.exe
  C:\Windows\System\bPgFBFV.exe
  2⤵
  PID:2496
- C:\Windows\System\KAyyLpZ.exe
  C:\Windows\System\KAyyLpZ.exe
  2⤵
  PID:2984
- C:\Windows\System\eGwVipQ.exe
  C:\Windows\System\eGwVipQ.exe
  2⤵
  PID:1664
- C:\Windows\System\OSYHljt.exe
  C:\Windows\System\OSYHljt.exe
  2⤵
  PID:2480
- C:\Windows\System\TJnqoIH.exe
  C:\Windows\System\TJnqoIH.exe
  2⤵
  PID:3000
- C:\Windows\System\SjOcIrF.exe
  C:\Windows\System\SjOcIrF.exe
  2⤵
  PID:776
- C:\Windows\System\GgBRSxG.exe
  C:\Windows\System\GgBRSxG.exe
  2⤵
  PID:108
- C:\Windows\System\sgiIqpB.exe
  C:\Windows\System\sgiIqpB.exe
  2⤵
  PID:1376
- C:\Windows\System\PmuEJGZ.exe
  C:\Windows\System\PmuEJGZ.exe
  2⤵
  PID:1692
- C:\Windows\System\pmEBdnH.exe
  C:\Windows\System\pmEBdnH.exe
  2⤵
  PID:2604
- C:\Windows\System\OHGlehc.exe
  C:\Windows\System\OHGlehc.exe
  2⤵
  PID:3056
- C:\Windows\System\zxTWasH.exe
  C:\Windows\System\zxTWasH.exe
  2⤵
  PID:3108
- C:\Windows\System\NPmOYJn.exe
  C:\Windows\System\NPmOYJn.exe
  2⤵
  PID:2788
- C:\Windows\System\MBSPiDU.exe
  C:\Windows\System\MBSPiDU.exe
  2⤵
  PID:1672
- C:\Windows\System\dYAVEEs.exe
  C:\Windows\System\dYAVEEs.exe
  2⤵
  PID:3068
- C:\Windows\System\zhAKcWB.exe
  C:\Windows\System\zhAKcWB.exe
  2⤵
  PID:1508
- C:\Windows\System\WPuFcfP.exe
  C:\Windows\System\WPuFcfP.exe
  2⤵
  PID:3088
- C:\Windows\System\bwZosbs.exe
  C:\Windows\System\bwZosbs.exe
  2⤵
  PID:3128
- C:\Windows\System\NtgIXnx.exe
  C:\Windows\System\NtgIXnx.exe
  2⤵
  PID:2996
- C:\Windows\System\hFXwUZe.exe
  C:\Windows\System\hFXwUZe.exe
  2⤵
  PID:3236
- C:\Windows\System\ilngBxD.exe
  C:\Windows\System\ilngBxD.exe
  2⤵
  PID:3192
- C:\Windows\System\DokGKCZ.exe
  C:\Windows\System\DokGKCZ.exe
  2⤵
  PID:3272
- C:\Windows\System\gkPaEca.exe
  C:\Windows\System\gkPaEca.exe
  2⤵
  PID:3312
- C:\Windows\System\MRRWuyY.exe
  C:\Windows\System\MRRWuyY.exe
  2⤵
  PID:3200
- C:\Windows\System\UqeDimw.exe
  C:\Windows\System\UqeDimw.exe
  2⤵
  PID:3216
- C:\Windows\System\bmQTOew.exe
  C:\Windows\System\bmQTOew.exe
  2⤵
  PID:3408
- C:\Windows\System\NWbrGbZ.exe
  C:\Windows\System\NWbrGbZ.exe
  2⤵
  PID:3448
- C:\Windows\System\qTIAvIg.exe
  C:\Windows\System\qTIAvIg.exe
  2⤵
  PID:3488
- C:\Windows\System\mNCCdVA.exe
  C:\Windows\System\mNCCdVA.exe
  2⤵
  PID:3504
- C:\Windows\System\rXYXqxm.exe
  C:\Windows\System\rXYXqxm.exe
  2⤵
  PID:3548
- C:\Windows\System\YEHXvwV.exe
  C:\Windows\System\YEHXvwV.exe
  2⤵
  PID:3616
- C:\Windows\System\CXFZHfY.exe
  C:\Windows\System\CXFZHfY.exe
  2⤵
  PID:3656
- C:\Windows\System\tPklZby.exe
  C:\Windows\System\tPklZby.exe
  2⤵
  PID:3692
- C:\Windows\System\rbjZCAv.exe
  C:\Windows\System\rbjZCAv.exe
  2⤵
  PID:3732
- C:\Windows\System\IPYajnK.exe
  C:\Windows\System\IPYajnK.exe
  2⤵
  PID:3764
- C:\Windows\System\guPgzOJ.exe
  C:\Windows\System\guPgzOJ.exe
  2⤵
  PID:3356
- C:\Windows\System\qXVCxQH.exe
  C:\Windows\System\qXVCxQH.exe
  2⤵
  PID:3428
- C:\Windows\System\euNQMzk.exe
  C:\Windows\System\euNQMzk.exe
  2⤵
  PID:3252
- C:\Windows\System\aoHRzvX.exe
  C:\Windows\System\aoHRzvX.exe
  2⤵
  PID:3288
- C:\Windows\System\HFhUDBn.exe
  C:\Windows\System\HFhUDBn.exe
  2⤵
  PID:2988
- C:\Windows\System\HMlsioQ.exe
  C:\Windows\System\HMlsioQ.exe
  2⤵
  PID:3808
- C:\Windows\System\GARiGYN.exe
  C:\Windows\System\GARiGYN.exe
  2⤵
  PID:2156
- C:\Windows\System\WzAIMvO.exe
  C:\Windows\System\WzAIMvO.exe
  2⤵
  PID:3568
- C:\Windows\System\XFKjmdR.exe
  C:\Windows\System\XFKjmdR.exe
  2⤵
  PID:3860
- C:\Windows\System\KrpxcMT.exe
  C:\Windows\System\KrpxcMT.exe
  2⤵
  PID:3892
- C:\Windows\System\fjobhTA.exe
  C:\Windows\System\fjobhTA.exe
  2⤵
  PID:3924
- C:\Windows\System\cBkoTNQ.exe
  C:\Windows\System\cBkoTNQ.exe
  2⤵
  PID:3972
- C:\Windows\System\mpBlCqL.exe
  C:\Windows\System\mpBlCqL.exe
  2⤵
  PID:3988
- C:\Windows\System\OwMyEuh.exe
  C:\Windows\System\OwMyEuh.exe
  2⤵
  PID:4020
- C:\Windows\System\CuKOLWn.exe
  C:\Windows\System\CuKOLWn.exe
  2⤵
  PID:4068
- C:\Windows\System\VFKLUxm.exe
  C:\Windows\System\VFKLUxm.exe
  2⤵
  PID:4084
- C:\Windows\System\APJuiyS.exe
  C:\Windows\System\APJuiyS.exe
  2⤵
  PID:1948
- C:\Windows\System\lWRwIpr.exe
  C:\Windows\System\lWRwIpr.exe
  2⤵
  PID:2412
- C:\Windows\System\wjIkITt.exe
  C:\Windows\System\wjIkITt.exe
  2⤵
  PID:2760
- C:\Windows\System\uzVQSak.exe
  C:\Windows\System\uzVQSak.exe
  2⤵
  PID:1320
- C:\Windows\System\EsFCiqo.exe
  C:\Windows\System\EsFCiqo.exe
  2⤵
  PID:1776
- C:\Windows\System\pGYFWHb.exe
  C:\Windows\System\pGYFWHb.exe
  2⤵
  PID:3152
- C:\Windows\System\DmODdCM.exe
  C:\Windows\System\DmODdCM.exe
  2⤵
  PID:1760
- C:\Windows\System\UtJqRhP.exe
  C:\Windows\System\UtJqRhP.exe
  2⤵
  PID:888
- C:\Windows\System\UHsFOnW.exe
  C:\Windows\System\UHsFOnW.exe
  2⤵
  PID:1476
- C:\Windows\System\jTmxvWH.exe
  C:\Windows\System\jTmxvWH.exe
  2⤵
  PID:3164
- C:\Windows\System\VKHaubK.exe
  C:\Windows\System\VKHaubK.exe
  2⤵
  PID:380
- C:\Windows\System\oFrLlCp.exe
  C:\Windows\System\oFrLlCp.exe
  2⤵
  PID:3264
- C:\Windows\System\ESRxzzq.exe
  C:\Windows\System\ESRxzzq.exe
  2⤵
  PID:3212
- C:\Windows\System\GakAypr.exe
  C:\Windows\System\GakAypr.exe
  2⤵
  PID:3500
- C:\Windows\System\gewVwmJ.exe
  C:\Windows\System\gewVwmJ.exe
  2⤵
  PID:3696
- C:\Windows\System\DmLBrUA.exe
  C:\Windows\System\DmLBrUA.exe
  2⤵
  PID:2928
- C:\Windows\System\oTtoJPa.exe
  C:\Windows\System\oTtoJPa.exe
  2⤵
  PID:4008
- C:\Windows\System\wIsIOlY.exe
  C:\Windows\System\wIsIOlY.exe
  2⤵
  PID:4072
- C:\Windows\System\intkIEA.exe
  C:\Windows\System\intkIEA.exe
  2⤵
  PID:536
- C:\Windows\System\RFslkvA.exe
  C:\Windows\System\RFslkvA.exe
  2⤵
  PID:1800
- C:\Windows\System\sTAprQJ.exe
  C:\Windows\System\sTAprQJ.exe
  2⤵
  PID:2736
- C:\Windows\System\HughyUY.exe
  C:\Windows\System\HughyUY.exe
  2⤵
  PID:2776
- C:\Windows\System\IJYLCSW.exe
  C:\Windows\System\IJYLCSW.exe
  2⤵
  PID:3268
- C:\Windows\System\gIwnvjj.exe
  C:\Windows\System\gIwnvjj.exe
  2⤵
  PID:2368
- C:\Windows\System\IbTimWT.exe
  C:\Windows\System\IbTimWT.exe
  2⤵
  PID:3396
- C:\Windows\System\PzGxlRs.exe
  C:\Windows\System\PzGxlRs.exe
  2⤵
  PID:3536
- C:\Windows\System\LWCQbnw.exe
  C:\Windows\System\LWCQbnw.exe
  2⤵
  PID:3516
- C:\Windows\System\ocvjgrT.exe
  C:\Windows\System\ocvjgrT.exe
  2⤵
  PID:2656
- C:\Windows\System\xItvInB.exe
  C:\Windows\System\xItvInB.exe
  2⤵
  PID:2408
- C:\Windows\System\XGqYYmM.exe
  C:\Windows\System\XGqYYmM.exe
  2⤵
  PID:1224
- C:\Windows\System\fKJzAxM.exe
  C:\Windows\System\fKJzAxM.exe
  2⤵
  PID:3600
- C:\Windows\System\wxRtmxs.exe
  C:\Windows\System\wxRtmxs.exe
  2⤵
  PID:3676
- C:\Windows\System\DQRyEhQ.exe
  C:\Windows\System\DQRyEhQ.exe
  2⤵
  PID:3748
- C:\Windows\System\UrZdgli.exe
  C:\Windows\System\UrZdgli.exe
  2⤵
  PID:3784
- C:\Windows\System\yuajAbo.exe
  C:\Windows\System\yuajAbo.exe
  2⤵
  PID:3824
- C:\Windows\System\VcNpYMh.exe
  C:\Windows\System\VcNpYMh.exe
  2⤵
  PID:2220
- C:\Windows\System\wHmBOrJ.exe
  C:\Windows\System\wHmBOrJ.exe
  2⤵
  PID:3864
- C:\Windows\System\IvpqjYI.exe
  C:\Windows\System\IvpqjYI.exe
  2⤵
  PID:3912
- C:\Windows\System\CrBQkCR.exe
  C:\Windows\System\CrBQkCR.exe
  2⤵
  PID:1984
- C:\Windows\System\bDOgwDy.exe
  C:\Windows\System\bDOgwDy.exe
  2⤵
  PID:2448
- C:\Windows\System\MPKSxTr.exe
  C:\Windows\System\MPKSxTr.exe
  2⤵
  PID:2784
- C:\Windows\System\GqNacIP.exe
  C:\Windows\System\GqNacIP.exe
  2⤵
  PID:1968
- C:\Windows\System\zVblowt.exe
  C:\Windows\System\zVblowt.exe
  2⤵
  PID:4104
- C:\Windows\System\EfsYIvb.exe
  C:\Windows\System\EfsYIvb.exe
  2⤵
  PID:4120
- C:\Windows\System\kqbiwuO.exe
  C:\Windows\System\kqbiwuO.exe
  2⤵
  PID:4136
- C:\Windows\System\fsamqyi.exe
  C:\Windows\System\fsamqyi.exe
  2⤵
  PID:4152
- C:\Windows\System\LKtRliQ.exe
  C:\Windows\System\LKtRliQ.exe
  2⤵
  PID:4168
- C:\Windows\System\VWFxiuu.exe
  C:\Windows\System\VWFxiuu.exe
  2⤵
  PID:4184
- C:\Windows\System\jokhCzf.exe
  C:\Windows\System\jokhCzf.exe
  2⤵
  PID:4200
- C:\Windows\System\GfTQfce.exe
  C:\Windows\System\GfTQfce.exe
  2⤵
  PID:4216
- C:\Windows\System\RPVGnul.exe
  C:\Windows\System\RPVGnul.exe
  2⤵
  PID:4232
- C:\Windows\System\HRlOwWn.exe
  C:\Windows\System\HRlOwWn.exe
  2⤵
  PID:4296
- C:\Windows\System\MbNYlUS.exe
  C:\Windows\System\MbNYlUS.exe
  2⤵
  PID:4312
- C:\Windows\System\psLvVzk.exe
  C:\Windows\System\psLvVzk.exe
  2⤵
  PID:4328
- C:\Windows\System\UGSzfuq.exe
  C:\Windows\System\UGSzfuq.exe
  2⤵
  PID:4344
- C:\Windows\System\qyLHbXn.exe
  C:\Windows\System\qyLHbXn.exe
  2⤵
  PID:4360
- C:\Windows\System\khxFbSo.exe
  C:\Windows\System\khxFbSo.exe
  2⤵
  PID:4376
- C:\Windows\System\FTUMiIf.exe
  C:\Windows\System\FTUMiIf.exe
  2⤵
  PID:4392
- C:\Windows\System\tLfjnew.exe
  C:\Windows\System\tLfjnew.exe
  2⤵
  PID:4408
- C:\Windows\System\SDlVHDL.exe
  C:\Windows\System\SDlVHDL.exe
  2⤵
  PID:4428
- C:\Windows\System\upngSNB.exe
  C:\Windows\System\upngSNB.exe
  2⤵
  PID:4444
- C:\Windows\System\PZOEBYp.exe
  C:\Windows\System\PZOEBYp.exe
  2⤵
  PID:4460
- C:\Windows\System\fsmVBlU.exe
  C:\Windows\System\fsmVBlU.exe
  2⤵
  PID:4476
- C:\Windows\System\PdWDdLg.exe
  C:\Windows\System\PdWDdLg.exe
  2⤵
  PID:4492
- C:\Windows\System\DGTlcUt.exe
  C:\Windows\System\DGTlcUt.exe
  2⤵
  PID:4508
- C:\Windows\System\tRMPqbM.exe
  C:\Windows\System\tRMPqbM.exe
  2⤵
  PID:4524
- C:\Windows\System\ZNHnCix.exe
  C:\Windows\System\ZNHnCix.exe
  2⤵
  PID:4540
- C:\Windows\System\RjSUIKM.exe
  C:\Windows\System\RjSUIKM.exe
  2⤵
  PID:4556
- C:\Windows\System\oZBtPyt.exe
  C:\Windows\System\oZBtPyt.exe
  2⤵
  PID:4572
- C:\Windows\System\WTLRVVs.exe
  C:\Windows\System\WTLRVVs.exe
  2⤵
  PID:4588
- C:\Windows\System\mSWenco.exe
  C:\Windows\System\mSWenco.exe
  2⤵
  PID:4604
- C:\Windows\System\JHVBuXq.exe
  C:\Windows\System\JHVBuXq.exe
  2⤵
  PID:4620
- C:\Windows\System\NusRBcz.exe
  C:\Windows\System\NusRBcz.exe
  2⤵
  PID:4636
- C:\Windows\System\frjoTiz.exe
  C:\Windows\System\frjoTiz.exe
  2⤵
  PID:4652
- C:\Windows\System\ZnsPeCp.exe
  C:\Windows\System\ZnsPeCp.exe
  2⤵
  PID:4668
- C:\Windows\System\AuOCnpH.exe
  C:\Windows\System\AuOCnpH.exe
  2⤵
  PID:4684
- C:\Windows\System\xGsTPoC.exe
  C:\Windows\System\xGsTPoC.exe
  2⤵
  PID:4700
- C:\Windows\System\vxAbwgO.exe
  C:\Windows\System\vxAbwgO.exe
  2⤵
  PID:4716
- C:\Windows\System\cZSpytr.exe
  C:\Windows\System\cZSpytr.exe
  2⤵
  PID:4732
- C:\Windows\System\xPrIbEn.exe
  C:\Windows\System\xPrIbEn.exe
  2⤵
  PID:4748
- C:\Windows\System\pZiCGOQ.exe
  C:\Windows\System\pZiCGOQ.exe
  2⤵
  PID:4764
- C:\Windows\System\XNGwrjY.exe
  C:\Windows\System\XNGwrjY.exe
  2⤵
  PID:4780
- C:\Windows\System\rhOuCeu.exe
  C:\Windows\System\rhOuCeu.exe
  2⤵
  PID:4796
- C:\Windows\System\XKyqqIl.exe
  C:\Windows\System\XKyqqIl.exe
  2⤵
  PID:4812
- C:\Windows\System\NQztWcw.exe
  C:\Windows\System\NQztWcw.exe
  2⤵
  PID:4828
- C:\Windows\System\xauwLFZ.exe
  C:\Windows\System\xauwLFZ.exe
  2⤵
  PID:4844
- C:\Windows\System\StPyjLC.exe
  C:\Windows\System\StPyjLC.exe
  2⤵
  PID:4860
- C:\Windows\System\aIwwedG.exe
  C:\Windows\System\aIwwedG.exe
  2⤵
  PID:4876
- C:\Windows\System\DtTWQut.exe
  C:\Windows\System\DtTWQut.exe
  2⤵
  PID:4892
- C:\Windows\System\WacvkdU.exe
  C:\Windows\System\WacvkdU.exe
  2⤵
  PID:4908
- C:\Windows\System\KFzMSeY.exe
  C:\Windows\System\KFzMSeY.exe
  2⤵
  PID:4924
- C:\Windows\System\qZmCNwd.exe
  C:\Windows\System\qZmCNwd.exe
  2⤵
  PID:4940
- C:\Windows\System\DtYbToV.exe
  C:\Windows\System\DtYbToV.exe
  2⤵
  PID:4956
- C:\Windows\System\btaUFCU.exe
  C:\Windows\System\btaUFCU.exe
  2⤵
  PID:4972
- C:\Windows\System\ZQCaMma.exe
  C:\Windows\System\ZQCaMma.exe
  2⤵
  PID:4988
- C:\Windows\System\rEYlsYW.exe
  C:\Windows\System\rEYlsYW.exe
  2⤵
  PID:5004
- C:\Windows\System\suvWBrA.exe
  C:\Windows\System\suvWBrA.exe
  2⤵
  PID:5020
- C:\Windows\System\GoNdZwd.exe
  C:\Windows\System\GoNdZwd.exe
  2⤵
  PID:5036
- C:\Windows\System\xNKUpUy.exe
  C:\Windows\System\xNKUpUy.exe
  2⤵
  PID:5052
- C:\Windows\System\hgKVNRd.exe
  C:\Windows\System\hgKVNRd.exe
  2⤵
  PID:5068
- C:\Windows\System\cbqoNQm.exe
  C:\Windows\System\cbqoNQm.exe
  2⤵
  PID:5084
- C:\Windows\System\agLWETD.exe
  C:\Windows\System\agLWETD.exe
  2⤵
  PID:5100
- C:\Windows\System\ppWNuDc.exe
  C:\Windows\System\ppWNuDc.exe
  2⤵
  PID:5116
- C:\Windows\System\OurBbMn.exe
  C:\Windows\System\OurBbMn.exe
  2⤵
  PID:3324
- C:\Windows\System\gbkEvjb.exe
  C:\Windows\System\gbkEvjb.exe
  2⤵
  PID:3468
- C:\Windows\System\iZlwlbG.exe
  C:\Windows\System\iZlwlbG.exe
  2⤵
  PID:3672
- C:\Windows\System\rQTVgSv.exe
  C:\Windows\System\rQTVgSv.exe
  2⤵
  PID:3844
- C:\Windows\System\TGNhWZX.exe
  C:\Windows\System\TGNhWZX.exe
  2⤵
  PID:2692
- C:\Windows\System\GScRbBo.exe
  C:\Windows\System\GScRbBo.exe
  2⤵
  PID:4116
- C:\Windows\System\sOgMsbo.exe
  C:\Windows\System\sOgMsbo.exe
  2⤵
  PID:3688
- C:\Windows\System\gROqyCX.exe
  C:\Windows\System\gROqyCX.exe
  2⤵
  PID:4208
- C:\Windows\System\wLQArFR.exe
  C:\Windows\System\wLQArFR.exe
  2⤵
  PID:4248
- C:\Windows\System\NaxgVXq.exe
  C:\Windows\System\NaxgVXq.exe
  2⤵
  PID:4268
- C:\Windows\System\ydmefHE.exe
  C:\Windows\System\ydmefHE.exe
  2⤵
  PID:4284
- C:\Windows\System\AuzulSh.exe
  C:\Windows\System\AuzulSh.exe
  2⤵
  PID:2976
- C:\Windows\System\eqnHIkI.exe
  C:\Windows\System\eqnHIkI.exe
  2⤵
  PID:2184
- C:\Windows\System\VnfkhsG.exe
  C:\Windows\System\VnfkhsG.exe
  2⤵
  PID:2680
- C:\Windows\System\EEcCcsa.exe
  C:\Windows\System\EEcCcsa.exe
  2⤵
  PID:3484
- C:\Windows\System\Bofslqp.exe
  C:\Windows\System\Bofslqp.exe
  2⤵
  PID:2212
- C:\Windows\System\AivtWDg.exe
  C:\Windows\System\AivtWDg.exe
  2⤵
  PID:3016
- C:\Windows\System\adWUVZc.exe
  C:\Windows\System\adWUVZc.exe
  2⤵
  PID:3744
- C:\Windows\System\scdpPhr.exe
  C:\Windows\System\scdpPhr.exe
  2⤵
  PID:2720
- C:\Windows\System\dJPHzik.exe
  C:\Windows\System\dJPHzik.exe
  2⤵
  PID:2792
- C:\Windows\System\UGGGEfT.exe
  C:\Windows\System\UGGGEfT.exe
  2⤵
  PID:4128
- C:\Windows\System\rciVAIm.exe
  C:\Windows\System\rciVAIm.exe
  2⤵
  PID:4192
- C:\Windows\System\nSPOCcX.exe
  C:\Windows\System\nSPOCcX.exe
  2⤵
  PID:4304
- C:\Windows\System\TyzVfDu.exe
  C:\Windows\System\TyzVfDu.exe
  2⤵
  PID:4056
- C:\Windows\System\fqPnkKO.exe
  C:\Windows\System\fqPnkKO.exe
  2⤵
  PID:4324
- C:\Windows\System\VJpFHvB.exe
  C:\Windows\System\VJpFHvB.exe
  2⤵
  PID:4340
- C:\Windows\System\pXcwOpM.exe
  C:\Windows\System\pXcwOpM.exe
  2⤵
  PID:4372
- C:\Windows\System\ySMRqux.exe
  C:\Windows\System\ySMRqux.exe
  2⤵
  PID:4404
- C:\Windows\System\eEDFTtY.exe
  C:\Windows\System\eEDFTtY.exe
  2⤵
  PID:4456
- C:\Windows\System\AczvPrR.exe
  C:\Windows\System\AczvPrR.exe
  2⤵
  PID:4516
- C:\Windows\System\eExukGH.exe
  C:\Windows\System\eExukGH.exe
  2⤵
  PID:4504
- C:\Windows\System\rCoCSFd.exe
  C:\Windows\System\rCoCSFd.exe
  2⤵
  PID:4552
- C:\Windows\System\ebfPxtd.exe
  C:\Windows\System\ebfPxtd.exe
  2⤵
  PID:4584
- C:\Windows\System\kEgeEcK.exe
  C:\Windows\System\kEgeEcK.exe
  2⤵
  PID:4644
- C:\Windows\System\nluSKVq.exe
  C:\Windows\System\nluSKVq.exe
  2⤵
  PID:4648
- C:\Windows\System\NJXHIJT.exe
  C:\Windows\System\NJXHIJT.exe
  2⤵
  PID:4680
- C:\Windows\System\SLohZFp.exe
  C:\Windows\System\SLohZFp.exe
  2⤵
  PID:4712
- C:\Windows\System\hXNYhZJ.exe
  C:\Windows\System\hXNYhZJ.exe
  2⤵
  PID:4728
- C:\Windows\System\rdHtWYi.exe
  C:\Windows\System\rdHtWYi.exe
  2⤵
  PID:4760
- C:\Windows\System\XJzLENP.exe
  C:\Windows\System\XJzLENP.exe
  2⤵
  PID:4808
- C:\Windows\System\AjdqCvS.exe
  C:\Windows\System\AjdqCvS.exe
  2⤵
  PID:4824
- C:\Windows\System\tXnZXPE.exe
  C:\Windows\System\tXnZXPE.exe
  2⤵
  PID:4872
- C:\Windows\System\dMyvaZM.exe
  C:\Windows\System\dMyvaZM.exe
  2⤵
  PID:4888
- C:\Windows\System\ERYAjLZ.exe
  C:\Windows\System\ERYAjLZ.exe
  2⤵
  PID:4920
- C:\Windows\System\AvktBKb.exe
  C:\Windows\System\AvktBKb.exe
  2⤵
  PID:4996
- C:\Windows\System\jsvgTgn.exe
  C:\Windows\System\jsvgTgn.exe
  2⤵
  PID:4980
- C:\Windows\System\CajgFTD.exe
  C:\Windows\System\CajgFTD.exe
  2⤵
  PID:5032
- C:\Windows\System\KxeudCs.exe
  C:\Windows\System\KxeudCs.exe
  2⤵
  PID:5048
- C:\Windows\System\WNJYYoR.exe
  C:\Windows\System\WNJYYoR.exe
  2⤵
  PID:5080
- C:\Windows\System\hzLrKgR.exe
  C:\Windows\System\hzLrKgR.exe
  2⤵
  PID:5112
- C:\Windows\System\GLPovKM.exe
  C:\Windows\System\GLPovKM.exe
  2⤵
  PID:3640
- C:\Windows\System\mOXTnyb.exe
  C:\Windows\System\mOXTnyb.exe
  2⤵
  PID:2068
- C:\Windows\System\fWRuico.exe
  C:\Windows\System\fWRuico.exe
  2⤵
  PID:2312
- C:\Windows\System\SNNGApQ.exe
  C:\Windows\System\SNNGApQ.exe
  2⤵
  PID:4256
- C:\Windows\System\qUZqXhF.exe
  C:\Windows\System\qUZqXhF.exe
  2⤵
  PID:4260
- C:\Windows\System\NeWfgkR.exe
  C:\Windows\System\NeWfgkR.exe
  2⤵
  PID:3196
- C:\Windows\System\fckAYiI.exe
  C:\Windows\System\fckAYiI.exe
  2⤵
  PID:2172
- C:\Windows\System\fmpWWnp.exe
  C:\Windows\System\fmpWWnp.exe
  2⤵
  PID:2876
- C:\Windows\System\NOKsFAf.exe
  C:\Windows\System\NOKsFAf.exe
  2⤵
  PID:3712
- C:\Windows\System\kbwvFOg.exe
  C:\Windows\System\kbwvFOg.exe
  2⤵
  PID:4224
- C:\Windows\System\jJmHmhC.exe
  C:\Windows\System\jJmHmhC.exe
  2⤵
  PID:4164
- C:\Windows\System\ZFbGKJi.exe
  C:\Windows\System\ZFbGKJi.exe
  2⤵
  PID:1668
- C:\Windows\System\WRVPyVm.exe
  C:\Windows\System\WRVPyVm.exe
  2⤵
  PID:4336
- C:\Windows\System\BjjQimM.exe
  C:\Windows\System\BjjQimM.exe
  2⤵
  PID:4400
- C:\Windows\System\eySJywE.exe
  C:\Windows\System\eySJywE.exe
  2⤵
  PID:4564
- C:\Windows\System\jUCsGiJ.exe
  C:\Windows\System\jUCsGiJ.exe
  2⤵
  PID:4536
- C:\Windows\System\zafedLV.exe
  C:\Windows\System\zafedLV.exe
  2⤵
  PID:4692
- C:\Windows\System\wOEpIhp.exe
  C:\Windows\System\wOEpIhp.exe
  2⤵
  PID:4676
- C:\Windows\System\ZhpbkxR.exe
  C:\Windows\System\ZhpbkxR.exe
  2⤵
  PID:4776
- C:\Windows\System\aZBcZAd.exe
  C:\Windows\System\aZBcZAd.exe
  2⤵
  PID:4820
- C:\Windows\System\oHdYvmb.exe
  C:\Windows\System\oHdYvmb.exe
  2⤵
  PID:4964
- C:\Windows\System\BkHYuow.exe
  C:\Windows\System\BkHYuow.exe
  2⤵
  PID:4936
- C:\Windows\System\mqBCLNw.exe
  C:\Windows\System\mqBCLNw.exe
  2⤵
  PID:5000
- C:\Windows\System\OgNLABr.exe
  C:\Windows\System\OgNLABr.exe
  2⤵
  PID:2644
- C:\Windows\System\fezHxba.exe
  C:\Windows\System\fezHxba.exe
  2⤵
  PID:4040
- C:\Windows\System\kzShJRR.exe
  C:\Windows\System\kzShJRR.exe
  2⤵
  PID:2812
- C:\Windows\System\QkBCSPj.exe
  C:\Windows\System\QkBCSPj.exe
  2⤵
  PID:4264
- C:\Windows\System\fCGigId.exe
  C:\Windows\System\fCGigId.exe
  2⤵
  PID:4532
- C:\Windows\System\rYtOAMJ.exe
  C:\Windows\System\rYtOAMJ.exe
  2⤵
  PID:4388
- C:\Windows\System\lSYXPkm.exe
  C:\Windows\System\lSYXPkm.exe
  2⤵
  PID:4628
- C:\Windows\System\VZNDTLZ.exe
  C:\Windows\System\VZNDTLZ.exe
  2⤵
  PID:4840
- C:\Windows\System\gOUMnPy.exe
  C:\Windows\System\gOUMnPy.exe
  2⤵
  PID:4788
- C:\Windows\System\MALuvFz.exe
  C:\Windows\System\MALuvFz.exe
  2⤵
  PID:2868
- C:\Windows\System\dtNxWOT.exe
  C:\Windows\System\dtNxWOT.exe
  2⤵
  PID:2356
- C:\Windows\System\ItOFOip.exe
  C:\Windows\System\ItOFOip.exe
  2⤵
  PID:2724
- C:\Windows\System\EUIqgTr.exe
  C:\Windows\System\EUIqgTr.exe
  2⤵
  PID:4856
- C:\Windows\System\BvgKwiH.exe
  C:\Windows\System\BvgKwiH.exe
  2⤵
  PID:2676
- C:\Windows\System\BYezmyK.exe
  C:\Windows\System\BYezmyK.exe
  2⤵
  PID:2800
- C:\Windows\System\TuSFtsM.exe
  C:\Windows\System\TuSFtsM.exe
  2⤵
  PID:2764
- C:\Windows\System\BoqKzwU.exe
  C:\Windows\System\BoqKzwU.exe
  2⤵
  PID:4160
- C:\Windows\System\eSjhpmY.exe
  C:\Windows\System\eSjhpmY.exe
  2⤵
  PID:2488
- C:\Windows\System\MsOaNBt.exe
  C:\Windows\System\MsOaNBt.exe
  2⤵
  PID:5012
- C:\Windows\System\FQEDGSv.exe
  C:\Windows\System\FQEDGSv.exe
  2⤵
  PID:2824
- C:\Windows\System\aZzkeMx.exe
  C:\Windows\System\aZzkeMx.exe
  2⤵
  PID:2028
- C:\Windows\System\sdLvZFY.exe
  C:\Windows\System\sdLvZFY.exe
  2⤵
  PID:5060
- C:\Windows\System\DmPPBLc.exe
  C:\Windows\System\DmPPBLc.exe
  2⤵
  PID:3780
- C:\Windows\System\EJGVzsw.exe
  C:\Windows\System\EJGVzsw.exe
  2⤵
  PID:2688
- C:\Windows\System\LevNrmz.exe
  C:\Windows\System\LevNrmz.exe
  2⤵
  PID:3392
- C:\Windows\System\UZrAbNE.exe
  C:\Windows\System\UZrAbNE.exe
  2⤵
  PID:4904
- C:\Windows\System\LSznoHV.exe
  C:\Windows\System\LSznoHV.exe
  2⤵
  PID:4100
- C:\Windows\System\rEySIQe.exe
  C:\Windows\System\rEySIQe.exe
  2⤵
  PID:5128
- C:\Windows\System\LzsVaOY.exe
  C:\Windows\System\LzsVaOY.exe
  2⤵
  PID:5144
- C:\Windows\System\mEWnNqE.exe
  C:\Windows\System\mEWnNqE.exe
  2⤵
  PID:5160
- C:\Windows\System\lInlgwE.exe
  C:\Windows\System\lInlgwE.exe
  2⤵
  PID:5176
- C:\Windows\System\LdYfvHV.exe
  C:\Windows\System\LdYfvHV.exe
  2⤵
  PID:5192
- C:\Windows\System\PdPpFOi.exe
  C:\Windows\System\PdPpFOi.exe
  2⤵
  PID:5208
- C:\Windows\System\thwWcfM.exe
  C:\Windows\System\thwWcfM.exe
  2⤵
  PID:5288
- C:\Windows\System\aHMlfNK.exe
  C:\Windows\System\aHMlfNK.exe
  2⤵
  PID:5340
- C:\Windows\System\jAtEFDX.exe
  C:\Windows\System\jAtEFDX.exe
  2⤵
  PID:5424
- C:\Windows\System\htdCbMe.exe
  C:\Windows\System\htdCbMe.exe
  2⤵
  PID:5444
- C:\Windows\System\GmsJDvz.exe
  C:\Windows\System\GmsJDvz.exe
  2⤵
  PID:5644
- C:\Windows\System\xhwUzTb.exe
  C:\Windows\System\xhwUzTb.exe
  2⤵
  PID:5728
- C:\Windows\System\Spojoen.exe
  C:\Windows\System\Spojoen.exe
  2⤵
  PID:5744
- C:\Windows\System\upqCBNK.exe
  C:\Windows\System\upqCBNK.exe
  2⤵
  PID:5760
- C:\Windows\System\ShwMwTk.exe
  C:\Windows\System\ShwMwTk.exe
  2⤵
  PID:5776
- C:\Windows\System\aBbNbue.exe
  C:\Windows\System\aBbNbue.exe
  2⤵
  PID:5792
- C:\Windows\System\HPPPQdF.exe
  C:\Windows\System\HPPPQdF.exe
  2⤵
  PID:5812
- C:\Windows\System\CmjIYST.exe
  C:\Windows\System\CmjIYST.exe
  2⤵
  PID:5828
- C:\Windows\System\TQYcBSD.exe
  C:\Windows\System\TQYcBSD.exe
  2⤵
  PID:5844
- C:\Windows\System\NcldqdW.exe
  C:\Windows\System\NcldqdW.exe
  2⤵
  PID:5860
- C:\Windows\System\vbWibRG.exe
  C:\Windows\System\vbWibRG.exe
  2⤵
  PID:5876
- C:\Windows\System\VVyPIio.exe
  C:\Windows\System\VVyPIio.exe
  2⤵
  PID:5892
- C:\Windows\System\lPVvXYt.exe
  C:\Windows\System\lPVvXYt.exe
  2⤵
  PID:5908
- C:\Windows\System\FenmfUl.exe
  C:\Windows\System\FenmfUl.exe
  2⤵
  PID:5924
- C:\Windows\System\UFjVoUG.exe
  C:\Windows\System\UFjVoUG.exe
  2⤵
  PID:5948
- C:\Windows\System\CRtPWRx.exe
  C:\Windows\System\CRtPWRx.exe
  2⤵
  PID:5964
- C:\Windows\System\CrfeQNM.exe
  C:\Windows\System\CrfeQNM.exe
  2⤵
  PID:5980
- C:\Windows\System\lNDjFES.exe
  C:\Windows\System\lNDjFES.exe
  2⤵
  PID:5996
- C:\Windows\System\muyHrwI.exe
  C:\Windows\System\muyHrwI.exe
  2⤵
  PID:6016
- C:\Windows\System\kEjFKPR.exe
  C:\Windows\System\kEjFKPR.exe
  2⤵
  PID:6032
- C:\Windows\System\wWyDgTj.exe
  C:\Windows\System\wWyDgTj.exe
  2⤵
  PID:6052
- C:\Windows\System\iqTgRsT.exe
  C:\Windows\System\iqTgRsT.exe
  2⤵
  PID:6072
- C:\Windows\System\dkFDYfs.exe
  C:\Windows\System\dkFDYfs.exe
  2⤵
  PID:6088
- C:\Windows\System\JmJSZXK.exe
  C:\Windows\System\JmJSZXK.exe
  2⤵
  PID:6104
- C:\Windows\System\mpmNmck.exe
  C:\Windows\System\mpmNmck.exe
  2⤵
  PID:6120
- C:\Windows\System\coDrMcS.exe
  C:\Windows\System\coDrMcS.exe
  2⤵
  PID:6136
- C:\Windows\System\yffTCQy.exe
  C:\Windows\System\yffTCQy.exe
  2⤵
  PID:3208
- C:\Windows\System\yfdsMtR.exe
  C:\Windows\System\yfdsMtR.exe
  2⤵
  PID:4500
- C:\Windows\System\lQhPGTY.exe
  C:\Windows\System\lQhPGTY.exe
  2⤵
  PID:5152
- C:\Windows\System\oCiQQBk.exe
  C:\Windows\System\oCiQQBk.exe
  2⤵
  PID:5216
- C:\Windows\System\dJyCEps.exe
  C:\Windows\System\dJyCEps.exe
  2⤵
  PID:4664
- C:\Windows\System\OWvoSwz.exe
  C:\Windows\System\OWvoSwz.exe
  2⤵
  PID:5220
- C:\Windows\System\soCMFZW.exe
  C:\Windows\System\soCMFZW.exe
  2⤵
  PID:5168
- C:\Windows\System\nwADisY.exe
  C:\Windows\System\nwADisY.exe
  2⤵
  PID:2140
- C:\Windows\System\XZNQLEN.exe
  C:\Windows\System\XZNQLEN.exe
  2⤵
  PID:4468
- C:\Windows\System\kSltGSO.exe
  C:\Windows\System\kSltGSO.exe
  2⤵
  PID:5240
- C:\Windows\System\gKLGxCK.exe
  C:\Windows\System\gKLGxCK.exe
  2⤵
  PID:5252
- C:\Windows\System\KnNfcOp.exe
  C:\Windows\System\KnNfcOp.exe
  2⤵
  PID:5268
- C:\Windows\System\jpigMeB.exe
  C:\Windows\System\jpigMeB.exe
  2⤵
  PID:5284
- C:\Windows\System\WvvebXw.exe
  C:\Windows\System\WvvebXw.exe
  2⤵
  PID:5300
- C:\Windows\System\dZlXSmx.exe
  C:\Windows\System\dZlXSmx.exe
  2⤵
  PID:5316
- C:\Windows\System\KTiVOko.exe
  C:\Windows\System\KTiVOko.exe
  2⤵
  PID:5332
- C:\Windows\System\bvXPmbi.exe
  C:\Windows\System\bvXPmbi.exe
  2⤵
  PID:5368
- C:\Windows\System\ErDILgA.exe
  C:\Windows\System\ErDILgA.exe
  2⤵
  PID:5364
- C:\Windows\System\IYTtPYA.exe
  C:\Windows\System\IYTtPYA.exe
  2⤵
  PID:5392
- C:\Windows\System\qlWmrVJ.exe
  C:\Windows\System\qlWmrVJ.exe
  2⤵
  PID:5224
- C:\Windows\System\IQgCuVT.exe
  C:\Windows\System\IQgCuVT.exe
  2⤵
  PID:5420
- C:\Windows\System\PohBzBo.exe
  C:\Windows\System\PohBzBo.exe
  2⤵
  PID:5452
- C:\Windows\System\hixONaC.exe
  C:\Windows\System\hixONaC.exe
  2⤵
  PID:5468
- C:\Windows\System\CWJxNkN.exe
  C:\Windows\System\CWJxNkN.exe
  2⤵
  PID:5508
- C:\Windows\System\rNTVjyW.exe
  C:\Windows\System\rNTVjyW.exe
  2⤵
  PID:5540
- C:\Windows\System\nJCAPOZ.exe
  C:\Windows\System\nJCAPOZ.exe
  2⤵
  PID:5544
- C:\Windows\System\ewZoDxv.exe
  C:\Windows\System\ewZoDxv.exe
  2⤵
  PID:5532
- C:\Windows\System\pJxZnar.exe
  C:\Windows\System\pJxZnar.exe
  2⤵
  PID:5548
- C:\Windows\System\KNcAPqE.exe
  C:\Windows\System\KNcAPqE.exe
  2⤵
  PID:5576
- C:\Windows\System\ltclufr.exe
  C:\Windows\System\ltclufr.exe
  2⤵
  PID:5588
- C:\Windows\System\bEhipTY.exe
  C:\Windows\System\bEhipTY.exe
  2⤵
  PID:5604
- C:\Windows\System\hjoRHWv.exe
  C:\Windows\System\hjoRHWv.exe
  2⤵
  PID:5652
- C:\Windows\System\PSxULSP.exe
  C:\Windows\System\PSxULSP.exe
  2⤵
  PID:5640
- C:\Windows\System\LYjTXfN.exe
  C:\Windows\System\LYjTXfN.exe
  2⤵
  PID:5676
- C:\Windows\System\ttDIsxU.exe
  C:\Windows\System\ttDIsxU.exe
  2⤵
  PID:5696
- C:\Windows\System\JzVpZCY.exe
  C:\Windows\System\JzVpZCY.exe
  2⤵
  PID:5712
- C:\Windows\System\ZCOUpZN.exe
  C:\Windows\System\ZCOUpZN.exe
  2⤵
  PID:5768
- C:\Windows\System\EhBnmop.exe
  C:\Windows\System\EhBnmop.exe
  2⤵
  PID:5784
- C:\Windows\System\AvEbyiR.exe
  C:\Windows\System\AvEbyiR.exe
  2⤵
  PID:5824
- C:\Windows\System\GVKGDyw.exe
  C:\Windows\System\GVKGDyw.exe
  2⤵
  PID:5888
- C:\Windows\System\iuMhrYy.exe
  C:\Windows\System\iuMhrYy.exe
  2⤵
  PID:5960
- C:\Windows\System\hAFiszw.exe
  C:\Windows\System\hAFiszw.exe
  2⤵
  PID:5992
- C:\Windows\System\PqnTvPz.exe
  C:\Windows\System\PqnTvPz.exe
  2⤵
  PID:5808
- C:\Windows\System\nDCOGaB.exe
  C:\Windows\System\nDCOGaB.exe
  2⤵
  PID:5868
- C:\Windows\System\NNNhrJT.exe
  C:\Windows\System\NNNhrJT.exe
  2⤵
  PID:5904
- C:\Windows\System\OqjmiIa.exe
  C:\Windows\System\OqjmiIa.exe
  2⤵
  PID:5932
- C:\Windows\System\LnbYstb.exe
  C:\Windows\System\LnbYstb.exe
  2⤵
  PID:6008
- C:\Windows\System\TzILUDQ.exe
  C:\Windows\System\TzILUDQ.exe
  2⤵
  PID:5388
- C:\Windows\System\YzpbZTT.exe
  C:\Windows\System\YzpbZTT.exe
  2⤵
  PID:6112
- C:\Windows\System\hgaCDCt.exe
  C:\Windows\System\hgaCDCt.exe
  2⤵
  PID:6064
- C:\Windows\System\VCCsdYK.exe
  C:\Windows\System\VCCsdYK.exe
  2⤵
  PID:4900
- C:\Windows\System\ZAsIcdb.exe
  C:\Windows\System\ZAsIcdb.exe
  2⤵
  PID:4280
- C:\Windows\System\warlGcX.exe
  C:\Windows\System\warlGcX.exe
  2⤵
  PID:4616
- C:\Windows\System\FjhPoPx.exe
  C:\Windows\System\FjhPoPx.exe
  2⤵
  PID:5188
- C:\Windows\System\QkJdEXj.exe
  C:\Windows\System\QkJdEXj.exe
  2⤵
  PID:5076
- C:\Windows\System\zbfMBEF.exe
  C:\Windows\System\zbfMBEF.exe
  2⤵
  PID:5308
- C:\Windows\System\GbghnRs.exe
  C:\Windows\System\GbghnRs.exe
  2⤵
  PID:5352
- C:\Windows\System\YhQHLaC.exe
  C:\Windows\System\YhQHLaC.exe
  2⤵
  PID:5384
- C:\Windows\System\qLAjtPm.exe
  C:\Windows\System\qLAjtPm.exe
  2⤵
  PID:2780
- C:\Windows\System\cYsmKHF.exe
  C:\Windows\System\cYsmKHF.exe
  2⤵
  PID:5504
- C:\Windows\System\EXlfPXN.exe
  C:\Windows\System\EXlfPXN.exe
  2⤵
  PID:5404
- C:\Windows\System\WRqXkSn.exe
  C:\Windows\System\WRqXkSn.exe
  2⤵
  PID:5328
- C:\Windows\System\mubXKTL.exe
  C:\Windows\System\mubXKTL.exe
  2⤵
  PID:5264
- C:\Windows\System\aTsXGeK.exe
  C:\Windows\System\aTsXGeK.exe
  2⤵
  PID:5596
- C:\Windows\System\mGfvLQw.exe
  C:\Windows\System\mGfvLQw.exe
  2⤵
  PID:5632
- C:\Windows\System\khsKpvd.exe
  C:\Windows\System\khsKpvd.exe
  2⤵
  PID:5688
- C:\Windows\System\jguHirh.exe
  C:\Windows\System\jguHirh.exe
  2⤵
  PID:5704
- C:\Windows\System\JHZZuJo.exe
  C:\Windows\System\JHZZuJo.exe
  2⤵
  PID:5884
- C:\Windows\System\UPHDuYW.exe
  C:\Windows\System\UPHDuYW.exe
  2⤵
  PID:5840
- C:\Windows\System\xlCRmoe.exe
  C:\Windows\System\xlCRmoe.exe
  2⤵
  PID:6044
- C:\Windows\System\gBezKNN.exe
  C:\Windows\System\gBezKNN.exe
  2⤵
  PID:5804
- C:\Windows\System\EqQghqc.exe
  C:\Windows\System\EqQghqc.exe
  2⤵
  PID:5628
- C:\Windows\System\KwGPRMR.exe
  C:\Windows\System\KwGPRMR.exe
  2⤵
  PID:6156
- C:\Windows\System\CvekqcU.exe
  C:\Windows\System\CvekqcU.exe
  2⤵
  PID:6172
- C:\Windows\System\yaJRurF.exe
  C:\Windows\System\yaJRurF.exe
  2⤵
  PID:6188
- C:\Windows\System\nnawoOw.exe
  C:\Windows\System\nnawoOw.exe
  2⤵
  PID:6204
- C:\Windows\System\oEGlrlG.exe
  C:\Windows\System\oEGlrlG.exe
  2⤵
  PID:6220
- C:\Windows\System\BPTxpSN.exe
  C:\Windows\System\BPTxpSN.exe
  2⤵
  PID:6236
- C:\Windows\System\FDuNFwU.exe
  C:\Windows\System\FDuNFwU.exe
  2⤵
  PID:6252
- C:\Windows\System\VJdASrL.exe
  C:\Windows\System\VJdASrL.exe
  2⤵
  PID:6268
- C:\Windows\System\xvBsdeH.exe
  C:\Windows\System\xvBsdeH.exe
  2⤵
  PID:6284
- C:\Windows\System\STjjkaR.exe
  C:\Windows\System\STjjkaR.exe
  2⤵
  PID:6300
- C:\Windows\System\PIsIsLX.exe
  C:\Windows\System\PIsIsLX.exe
  2⤵
  PID:6316
- C:\Windows\System\OgMCrFk.exe
  C:\Windows\System\OgMCrFk.exe
  2⤵
  PID:6332
- C:\Windows\System\xxIKPnx.exe
  C:\Windows\System\xxIKPnx.exe
  2⤵
  PID:6348
- C:\Windows\System\KBcMLOT.exe
  C:\Windows\System\KBcMLOT.exe
  2⤵
  PID:6364
- C:\Windows\System\Msimbxa.exe
  C:\Windows\System\Msimbxa.exe
  2⤵
  PID:6380
- C:\Windows\System\IGjEyzf.exe
  C:\Windows\System\IGjEyzf.exe
  2⤵
  PID:6396
- C:\Windows\System\CvSwGRv.exe
  C:\Windows\System\CvSwGRv.exe
  2⤵
  PID:6412
- C:\Windows\System\fDVpQAd.exe
  C:\Windows\System\fDVpQAd.exe
  2⤵
  PID:6428
- C:\Windows\System\EEtgpoE.exe
  C:\Windows\System\EEtgpoE.exe
  2⤵
  PID:6444
- C:\Windows\System\fWNzpOo.exe
  C:\Windows\System\fWNzpOo.exe
  2⤵
  PID:6460
- C:\Windows\System\EyKnDVk.exe
  C:\Windows\System\EyKnDVk.exe
  2⤵
  PID:6476
- C:\Windows\System\omujARV.exe
  C:\Windows\System\omujARV.exe
  2⤵
  PID:6492
- C:\Windows\System\XEgGJSV.exe
  C:\Windows\System\XEgGJSV.exe
  2⤵
  PID:6508
- C:\Windows\System\gvQBUZI.exe
  C:\Windows\System\gvQBUZI.exe
  2⤵
  PID:6524
- C:\Windows\System\rckgVil.exe
  C:\Windows\System\rckgVil.exe
  2⤵
  PID:6540
- C:\Windows\System\Xqitieq.exe
  C:\Windows\System\Xqitieq.exe
  2⤵
  PID:6556
- C:\Windows\System\paoAUDr.exe
  C:\Windows\System\paoAUDr.exe
  2⤵
  PID:6572
- C:\Windows\System\IyYUWgd.exe
  C:\Windows\System\IyYUWgd.exe
  2⤵
  PID:6588
- C:\Windows\System\ugTmias.exe
  C:\Windows\System\ugTmias.exe
  2⤵
  PID:6604
- C:\Windows\System\YmagYgv.exe
  C:\Windows\System\YmagYgv.exe
  2⤵
  PID:6620
- C:\Windows\System\xXwnOLs.exe
  C:\Windows\System\xXwnOLs.exe
  2⤵
  PID:6636
- C:\Windows\System\aWcGmzX.exe
  C:\Windows\System\aWcGmzX.exe
  2⤵
  PID:6652
- C:\Windows\System\smuaxfH.exe
  C:\Windows\System\smuaxfH.exe
  2⤵
  PID:6668
- C:\Windows\System\TjfroAp.exe
  C:\Windows\System\TjfroAp.exe
  2⤵
  PID:6684
- C:\Windows\System\wlkGZEm.exe
  C:\Windows\System\wlkGZEm.exe
  2⤵
  PID:6700
- C:\Windows\System\BSqvQOz.exe
  C:\Windows\System\BSqvQOz.exe
  2⤵
  PID:6720
- C:\Windows\System\NmelWrQ.exe
  C:\Windows\System\NmelWrQ.exe
  2⤵
  PID:6736
- C:\Windows\System\TfoafBM.exe
  C:\Windows\System\TfoafBM.exe
  2⤵
  PID:6752
- C:\Windows\System\GXBszOd.exe
  C:\Windows\System\GXBszOd.exe
  2⤵
  PID:6768
- C:\Windows\System\YRzracU.exe
  C:\Windows\System\YRzracU.exe
  2⤵
  PID:6784
- C:\Windows\System\liOUJmw.exe
  C:\Windows\System\liOUJmw.exe
  2⤵
  PID:6804
- C:\Windows\System\QbaKmdv.exe
  C:\Windows\System\QbaKmdv.exe
  2⤵
  PID:6824
- C:\Windows\System\yTsFUQL.exe
  C:\Windows\System\yTsFUQL.exe
  2⤵
  PID:6840
- C:\Windows\System\XQrlgjA.exe
  C:\Windows\System\XQrlgjA.exe
  2⤵
  PID:6856
- C:\Windows\System\uiGalKp.exe
  C:\Windows\System\uiGalKp.exe
  2⤵
  PID:6872
- C:\Windows\System\rfnCZIU.exe
  C:\Windows\System\rfnCZIU.exe
  2⤵
  PID:6888
- C:\Windows\System\BRBCvog.exe
  C:\Windows\System\BRBCvog.exe
  2⤵
  PID:6904
- C:\Windows\System\omPyyRW.exe
  C:\Windows\System\omPyyRW.exe
  2⤵
  PID:6920
- C:\Windows\System\AqMedVA.exe
  C:\Windows\System\AqMedVA.exe
  2⤵
  PID:6936
- C:\Windows\System\vpYOUYQ.exe
  C:\Windows\System\vpYOUYQ.exe
  2⤵
  PID:6952
- C:\Windows\System\JbOiJCn.exe
  C:\Windows\System\JbOiJCn.exe
  2⤵
  PID:6968
- C:\Windows\System\zUTbdSS.exe
  C:\Windows\System\zUTbdSS.exe
  2⤵
  PID:6984
- C:\Windows\System\Njkpgqr.exe
  C:\Windows\System\Njkpgqr.exe
  2⤵
  PID:7000
- C:\Windows\System\LbNgemb.exe
  C:\Windows\System\LbNgemb.exe
  2⤵
  PID:7016
- C:\Windows\System\BEziDFb.exe
  C:\Windows\System\BEziDFb.exe
  2⤵
  PID:7032
- C:\Windows\System\unDwpSn.exe
  C:\Windows\System\unDwpSn.exe
  2⤵
  PID:7048
- C:\Windows\System\ffIqnoW.exe
  C:\Windows\System\ffIqnoW.exe
  2⤵
  PID:7064
- C:\Windows\System\YnzZbzj.exe
  C:\Windows\System\YnzZbzj.exe
  2⤵
  PID:7080
- C:\Windows\System\ernVlbS.exe
  C:\Windows\System\ernVlbS.exe
  2⤵
  PID:7096
- C:\Windows\System\rbYKuBy.exe
  C:\Windows\System\rbYKuBy.exe
  2⤵
  PID:7112
- C:\Windows\System\SwnBBme.exe
  C:\Windows\System\SwnBBme.exe
  2⤵
  PID:7128
- C:\Windows\System\lyKdkAT.exe
  C:\Windows\System\lyKdkAT.exe
  2⤵
  PID:7144
- C:\Windows\System\qlCnsbZ.exe
  C:\Windows\System\qlCnsbZ.exe
  2⤵
  PID:7160
- C:\Windows\System\HcPSVKh.exe
  C:\Windows\System\HcPSVKh.exe
  2⤵
  PID:5184
- C:\Windows\System\GlpaSdU.exe
  C:\Windows\System\GlpaSdU.exe
  2⤵
  PID:5380
- C:\Windows\System\IEavGQX.exe
  C:\Windows\System\IEavGQX.exe
  2⤵
  PID:5356
- C:\Windows\System\zIwntkc.exe
  C:\Windows\System\zIwntkc.exe
  2⤵
  PID:5524
- C:\Windows\System\lyRzmuW.exe
  C:\Windows\System\lyRzmuW.exe
  2⤵
  PID:6040
- C:\Windows\System\MDRLTOF.exe
  C:\Windows\System\MDRLTOF.exe
  2⤵
  PID:6168
- C:\Windows\System\kqljZJR.exe
  C:\Windows\System\kqljZJR.exe
  2⤵
  PID:6232
- C:\Windows\System\etOBVoc.exe
  C:\Windows\System\etOBVoc.exe
  2⤵
  PID:6296
- C:\Windows\System\zILtbFc.exe
  C:\Windows\System\zILtbFc.exe
  2⤵
  PID:6360
- C:\Windows\System\ydNoWBX.exe
  C:\Windows\System\ydNoWBX.exe
  2⤵
  PID:5920
- C:\Windows\System\vOvnSdw.exe
  C:\Windows\System\vOvnSdw.exe
  2⤵
  PID:5944
- C:\Windows\System\uOfmDRu.exe
  C:\Windows\System\uOfmDRu.exe
  2⤵
  PID:5956
- C:\Windows\System\pdrQuJe.exe
  C:\Windows\System\pdrQuJe.exe
  2⤵
  PID:5900
- C:\Windows\System\YqrrkaU.exe
  C:\Windows\System\YqrrkaU.exe
  2⤵
  PID:6060
- C:\Windows\System\lUErJjm.exe
  C:\Windows\System\lUErJjm.exe
  2⤵
  PID:6536
- C:\Windows\System\CtHLZLg.exe
  C:\Windows\System\CtHLZLg.exe
  2⤵
  PID:5312
- C:\Windows\System\kmUpXgb.exe
  C:\Windows\System\kmUpXgb.exe
  2⤵
  PID:5440
- C:\Windows\System\RsKvnDt.exe
  C:\Windows\System\RsKvnDt.exe
  2⤵
  PID:5672
- C:\Windows\System\omLqhxz.exe
  C:\Windows\System\omLqhxz.exe
  2⤵
  PID:6152
- C:\Windows\System\zrTjOsu.exe
  C:\Windows\System\zrTjOsu.exe
  2⤵
  PID:6216
- C:\Windows\System\ihCTutJ.exe
  C:\Windows\System\ihCTutJ.exe
  2⤵
  PID:6276
- C:\Windows\System\dALYgKp.exe
  C:\Windows\System\dALYgKp.exe
  2⤵
  PID:6340
- C:\Windows\System\TUGFZeL.exe
  C:\Windows\System\TUGFZeL.exe
  2⤵
  PID:6404
- C:\Windows\System\Obhcquk.exe
  C:\Windows\System\Obhcquk.exe
  2⤵
  PID:6468
- C:\Windows\System\SyzPxOC.exe
  C:\Windows\System\SyzPxOC.exe
  2⤵
  PID:6388
- C:\Windows\System\QUIaTiT.exe
  C:\Windows\System\QUIaTiT.exe
  2⤵
  PID:6424
- C:\Windows\System\RVtVunJ.exe
  C:\Windows\System\RVtVunJ.exe
  2⤵
  PID:6488
- C:\Windows\System\nezgBRZ.exe
  C:\Windows\System\nezgBRZ.exe
  2⤵
  PID:6552
- C:\Windows\System\UWxLpOl.exe
  C:\Windows\System\UWxLpOl.exe
  2⤵
  PID:6568
- C:\Windows\System\xNrkUtx.exe
  C:\Windows\System\xNrkUtx.exe
  2⤵
  PID:6616
- C:\Windows\System\YyBTIYE.exe
  C:\Windows\System\YyBTIYE.exe
  2⤵
  PID:6648
- C:\Windows\System\pkETSFR.exe
  C:\Windows\System\pkETSFR.exe
  2⤵
  PID:6692
- C:\Windows\System\pChirzf.exe
  C:\Windows\System\pChirzf.exe
  2⤵
  PID:6744
- C:\Windows\System\BsuDJqQ.exe
  C:\Windows\System\BsuDJqQ.exe
  2⤵
  PID:6716
- C:\Windows\System\ABudYLr.exe
  C:\Windows\System\ABudYLr.exe
  2⤵
  PID:6760
- C:\Windows\System\rPCHaNc.exe
  C:\Windows\System\rPCHaNc.exe
  2⤵
  PID:6812
- C:\Windows\System\bknyUOl.exe
  C:\Windows\System\bknyUOl.exe
  2⤵
  PID:6836
- C:\Windows\System\NobVSbx.exe
  C:\Windows\System\NobVSbx.exe
  2⤵
  PID:6916
- C:\Windows\System\dHbWrDy.exe
  C:\Windows\System\dHbWrDy.exe
  2⤵
  PID:6944
- C:\Windows\System\nXDSPmV.exe
  C:\Windows\System\nXDSPmV.exe
  2⤵
  PID:7008
- C:\Windows\System\fIyBFTu.exe
  C:\Windows\System\fIyBFTu.exe
  2⤵
  PID:880
- C:\Windows\System\AbZvUtp.exe
  C:\Windows\System\AbZvUtp.exe
  2⤵
  PID:7108
- C:\Windows\System\mjynyuf.exe
  C:\Windows\System\mjynyuf.exe
  2⤵
  PID:5200
- C:\Windows\System\POcUbEf.exe
  C:\Windows\System\POcUbEf.exe
  2⤵
  PID:5656
- C:\Windows\System\JaLRmRo.exe
  C:\Windows\System\JaLRmRo.exe
  2⤵
  PID:6356
- C:\Windows\System\DrhwFSZ.exe
  C:\Windows\System\DrhwFSZ.exe
  2⤵
  PID:5560
- C:\Windows\System\vFvcBdS.exe
  C:\Windows\System\vFvcBdS.exe
  2⤵
  PID:7124
- C:\Windows\System\krGDgCC.exe
  C:\Windows\System\krGDgCC.exe
  2⤵
  PID:5416
- C:\Windows\System\fgGZcZV.exe
  C:\Windows\System\fgGZcZV.exe
  2⤵
  PID:6164
- C:\Windows\System\isRbSqb.exe
  C:\Windows\System\isRbSqb.exe
  2⤵
  PID:7120
- C:\Windows\System\UehaVfR.exe
  C:\Windows\System\UehaVfR.exe
  2⤵
  PID:6932
- C:\Windows\System\swrpvnM.exe
  C:\Windows\System\swrpvnM.exe
  2⤵
  PID:6992
- C:\Windows\System\uSvnfNe.exe
  C:\Windows\System\uSvnfNe.exe
  2⤵
  PID:5972
- C:\Windows\System\RaLkpKQ.exe
  C:\Windows\System\RaLkpKQ.exe
  2⤵
  PID:5432
- C:\Windows\System\NSdLCdi.exe
  C:\Windows\System\NSdLCdi.exe
  2⤵
  PID:7088
- C:\Windows\System\PyTiIpV.exe
  C:\Windows\System\PyTiIpV.exe
  2⤵
  PID:6244
- C:\Windows\System\JCDuEta.exe
  C:\Windows\System\JCDuEta.exe
  2⤵
  PID:6376
- C:\Windows\System\QPPktck.exe
  C:\Windows\System\QPPktck.exe
  2⤵
  PID:6484
- C:\Windows\System\oSmptCb.exe
  C:\Windows\System\oSmptCb.exe
  2⤵
  PID:6660
- C:\Windows\System\icHWqMy.exe
  C:\Windows\System\icHWqMy.exe
  2⤵
  PID:6712
- C:\Windows\System\RBmihpB.exe
  C:\Windows\System\RBmihpB.exe
  2⤵
  PID:6832
- C:\Windows\System\vOPUheI.exe
  C:\Windows\System\vOPUheI.exe
  2⤵
  PID:6880
- C:\Windows\System\BoUQqwh.exe
  C:\Windows\System\BoUQqwh.exe
  2⤵
  PID:6212
- C:\Windows\System\nqqUPzi.exe
  C:\Windows\System\nqqUPzi.exe
  2⤵
  PID:6548
- C:\Windows\System\tbmqaRs.exe
  C:\Windows\System\tbmqaRs.exe
  2⤵
  PID:6420
- C:\Windows\System\mYFINCX.exe
  C:\Windows\System\mYFINCX.exe
  2⤵
  PID:6676
- C:\Windows\System\TEWYzKI.exe
  C:\Windows\System\TEWYzKI.exe
  2⤵
  PID:6792
- C:\Windows\System\aIhAohq.exe
  C:\Windows\System\aIhAohq.exe
  2⤵
  PID:6976
- C:\Windows\System\EDxeYSf.exe
  C:\Windows\System\EDxeYSf.exe
  2⤵
  PID:6228
- C:\Windows\System\HroyXVh.exe
  C:\Windows\System\HroyXVh.exe
  2⤵
  PID:5856
- C:\Windows\System\MTJkwhB.exe
  C:\Windows\System\MTJkwhB.exe
  2⤵
  PID:6964
- C:\Windows\System\HittdTa.exe
  C:\Windows\System\HittdTa.exe
  2⤵
  PID:6868
- C:\Windows\System\HWmDFtK.exe
  C:\Windows\System\HWmDFtK.exe
  2⤵
  PID:5172
- C:\Windows\System\VdaPWUA.exe
  C:\Windows\System\VdaPWUA.exe
  2⤵
  PID:5136
- C:\Windows\System\yObxMft.exe
  C:\Windows\System\yObxMft.exe
  2⤵
  PID:5460
- C:\Windows\System\OHkDkzI.exe
  C:\Windows\System\OHkDkzI.exe
  2⤵
  PID:7024
- C:\Windows\System\icgijBN.exe
  C:\Windows\System\icgijBN.exe
  2⤵
  PID:7040
- C:\Windows\System\fWmOicV.exe
  C:\Windows\System\fWmOicV.exe
  2⤵
  PID:6504
- C:\Windows\System\dCqtCRA.exe
  C:\Windows\System\dCqtCRA.exe
  2⤵
  PID:5940
- C:\Windows\System\LHXyAqH.exe
  C:\Windows\System\LHXyAqH.exe
  2⤵
  PID:5636
- C:\Windows\System\unNChzw.exe
  C:\Windows\System\unNChzw.exe
  2⤵
  PID:6440
- C:\Windows\System\uKkZYym.exe
  C:\Windows\System\uKkZYym.exe
  2⤵
  PID:5620
- C:\Windows\System\tVZRLXa.exe
  C:\Windows\System\tVZRLXa.exe
  2⤵
  PID:6628
- C:\Windows\System\nrORulj.exe
  C:\Windows\System\nrORulj.exe
  2⤵
  PID:6328
- C:\Windows\System\ySFDtEt.exe
  C:\Windows\System\ySFDtEt.exe
  2⤵
  PID:6584
- C:\Windows\System\YVExdus.exe
  C:\Windows\System\YVExdus.exe
  2⤵
  PID:6776
- C:\Windows\System\vsbOZEd.exe
  C:\Windows\System\vsbOZEd.exe
  2⤵
  PID:6928
- C:\Windows\System\DXnDcBZ.exe
  C:\Windows\System\DXnDcBZ.exe
  2⤵
  PID:2136
- C:\Windows\System\CGGuaiq.exe
  C:\Windows\System\CGGuaiq.exe
  2⤵
  PID:6372
- C:\Windows\System\Ozqkyqk.exe
  C:\Windows\System\Ozqkyqk.exe
  2⤵
  PID:6708
- C:\Windows\System\xXbCeHB.exe
  C:\Windows\System\xXbCeHB.exe
  2⤵
  PID:6132
- C:\Windows\System\xQfbODw.exe
  C:\Windows\System\xQfbODw.exe
  2⤵
  PID:7184
- C:\Windows\System\RVPIkgh.exe
  C:\Windows\System\RVPIkgh.exe
  2⤵
  PID:7200
- C:\Windows\System\fzvwOqn.exe
  C:\Windows\System\fzvwOqn.exe
  2⤵
  PID:7216
- C:\Windows\System\RwmOSNa.exe
  C:\Windows\System\RwmOSNa.exe
  2⤵
  PID:7232
- C:\Windows\System\XQnUjWU.exe
  C:\Windows\System\XQnUjWU.exe
  2⤵
  PID:7248
- C:\Windows\System\GvaksAZ.exe
  C:\Windows\System\GvaksAZ.exe
  2⤵
  PID:7264
- C:\Windows\System\gEzGQFp.exe
  C:\Windows\System\gEzGQFp.exe
  2⤵
  PID:7280
- C:\Windows\System\fcbAygK.exe
  C:\Windows\System\fcbAygK.exe
  2⤵
  PID:7296
- C:\Windows\System\peVsyyu.exe
  C:\Windows\System\peVsyyu.exe
  2⤵
  PID:7312
- C:\Windows\System\CTPlLuK.exe
  C:\Windows\System\CTPlLuK.exe
  2⤵
  PID:7328
- C:\Windows\System\HZUTWlh.exe
  C:\Windows\System\HZUTWlh.exe
  2⤵
  PID:7344
- C:\Windows\System\XdDQVos.exe
  C:\Windows\System\XdDQVos.exe
  2⤵
  PID:7360
- C:\Windows\System\fvdJcvq.exe
  C:\Windows\System\fvdJcvq.exe
  2⤵
  PID:7376
- C:\Windows\System\BbIPdYt.exe
  C:\Windows\System\BbIPdYt.exe
  2⤵
  PID:7392
- C:\Windows\System\aqheBdN.exe
  C:\Windows\System\aqheBdN.exe
  2⤵
  PID:7408
- C:\Windows\System\SDGNrZV.exe
  C:\Windows\System\SDGNrZV.exe
  2⤵
  PID:7424
- C:\Windows\System\dEungls.exe
  C:\Windows\System\dEungls.exe
  2⤵
  PID:7440
- C:\Windows\System\wTwQHzA.exe
  C:\Windows\System\wTwQHzA.exe
  2⤵
  PID:7456
- C:\Windows\System\HAwzhpv.exe
  C:\Windows\System\HAwzhpv.exe
  2⤵
  PID:7472
- C:\Windows\System\PaYFUad.exe
  C:\Windows\System\PaYFUad.exe
  2⤵
  PID:7488
- C:\Windows\System\GZSCVHK.exe
  C:\Windows\System\GZSCVHK.exe
  2⤵
  PID:7504
- C:\Windows\System\VLZdGLZ.exe
  C:\Windows\System\VLZdGLZ.exe
  2⤵
  PID:7520
- C:\Windows\System\pDfudru.exe
  C:\Windows\System\pDfudru.exe
  2⤵
  PID:7536
- C:\Windows\System\oXwkggz.exe
  C:\Windows\System\oXwkggz.exe
  2⤵
  PID:7552
- C:\Windows\System\ccFSgvV.exe
  C:\Windows\System\ccFSgvV.exe
  2⤵
  PID:7568
- C:\Windows\System\aGIPjhv.exe
  C:\Windows\System\aGIPjhv.exe
  2⤵
  PID:7584
- C:\Windows\System\HWVwixB.exe
  C:\Windows\System\HWVwixB.exe
  2⤵
  PID:7600
- C:\Windows\System\XnzuJdi.exe
  C:\Windows\System\XnzuJdi.exe
  2⤵
  PID:7616
- C:\Windows\System\gMWbiDI.exe
  C:\Windows\System\gMWbiDI.exe
  2⤵
  PID:7632
- C:\Windows\System\eeOOwZP.exe
  C:\Windows\System\eeOOwZP.exe
  2⤵
  PID:7648
- C:\Windows\System\SMMeqAF.exe
  C:\Windows\System\SMMeqAF.exe
  2⤵
  PID:7664
- C:\Windows\System\KxVKvWP.exe
  C:\Windows\System\KxVKvWP.exe
  2⤵
  PID:7680
- C:\Windows\System\qrwXZQi.exe
  C:\Windows\System\qrwXZQi.exe
  2⤵
  PID:7696
- C:\Windows\System\gYFROhT.exe
  C:\Windows\System\gYFROhT.exe
  2⤵
  PID:7712
- C:\Windows\System\CgPxCMn.exe
  C:\Windows\System\CgPxCMn.exe
  2⤵
  PID:7728
- C:\Windows\System\nZviedm.exe
  C:\Windows\System\nZviedm.exe
  2⤵
  PID:7744
- C:\Windows\System\qPVuCNa.exe
  C:\Windows\System\qPVuCNa.exe
  2⤵
  PID:7760
- C:\Windows\System\yldqflV.exe
  C:\Windows\System\yldqflV.exe
  2⤵
  PID:7776
- C:\Windows\System\HxgdYTG.exe
  C:\Windows\System\HxgdYTG.exe
  2⤵
  PID:7792
- C:\Windows\System\iZyVYaW.exe
  C:\Windows\System\iZyVYaW.exe
  2⤵
  PID:7808
- C:\Windows\System\FbrMciY.exe
  C:\Windows\System\FbrMciY.exe
  2⤵
  PID:7824
- C:\Windows\System\zJUVULJ.exe
  C:\Windows\System\zJUVULJ.exe
  2⤵
  PID:7840
- C:\Windows\System\sLmjIKz.exe
  C:\Windows\System\sLmjIKz.exe
  2⤵
  PID:7856
- C:\Windows\System\FuqQSpY.exe
  C:\Windows\System\FuqQSpY.exe
  2⤵
  PID:7872
- C:\Windows\System\mZlqGHu.exe
  C:\Windows\System\mZlqGHu.exe
  2⤵
  PID:7888
- C:\Windows\System\vlcNznD.exe
  C:\Windows\System\vlcNznD.exe
  2⤵
  PID:7904
- C:\Windows\System\UftNlDY.exe
  C:\Windows\System\UftNlDY.exe
  2⤵
  PID:7920
- C:\Windows\System\bGqnfXv.exe
  C:\Windows\System\bGqnfXv.exe
  2⤵
  PID:7936
- C:\Windows\System\uZOkNiS.exe
  C:\Windows\System\uZOkNiS.exe
  2⤵
  PID:7952
- C:\Windows\System\LiPfbxj.exe
  C:\Windows\System\LiPfbxj.exe
  2⤵
  PID:7968
- C:\Windows\System\DXhStjc.exe
  C:\Windows\System\DXhStjc.exe
  2⤵
  PID:7984
- C:\Windows\System\JxmqaWH.exe
  C:\Windows\System\JxmqaWH.exe
  2⤵
  PID:8004
- C:\Windows\System\StDhHIc.exe
  C:\Windows\System\StDhHIc.exe
  2⤵
  PID:8020
- C:\Windows\System\osCdbEP.exe
  C:\Windows\System\osCdbEP.exe
  2⤵
  PID:8036
- C:\Windows\System\LTnmeJm.exe
  C:\Windows\System\LTnmeJm.exe
  2⤵
  PID:8052
- C:\Windows\System\sMKFWUj.exe
  C:\Windows\System\sMKFWUj.exe
  2⤵
  PID:8068
- C:\Windows\System\zebSRJU.exe
  C:\Windows\System\zebSRJU.exe
  2⤵
  PID:8084
- C:\Windows\System\ilNqOsK.exe
  C:\Windows\System\ilNqOsK.exe
  2⤵
  PID:8108
- C:\Windows\System\abAoPbk.exe
  C:\Windows\System\abAoPbk.exe
  2⤵
  PID:8124
- C:\Windows\System\sHWqbqS.exe
  C:\Windows\System\sHWqbqS.exe
  2⤵
  PID:8140
- C:\Windows\System\OToqWGT.exe
  C:\Windows\System\OToqWGT.exe
  2⤵
  PID:8156
- C:\Windows\System\ViJCFTU.exe
  C:\Windows\System\ViJCFTU.exe
  2⤵
  PID:8172
- C:\Windows\System\gTVFteh.exe
  C:\Windows\System\gTVFteh.exe
  2⤵
  PID:8188
- C:\Windows\System\hemrroH.exe
  C:\Windows\System\hemrroH.exe
  2⤵
  PID:6748
- C:\Windows\System\HoNFdem.exe
  C:\Windows\System\HoNFdem.exe
  2⤵
  PID:7224
- C:\Windows\System\eKXdInV.exe
  C:\Windows\System\eKXdInV.exe
  2⤵
  PID:7176
- C:\Windows\System\sRDBhFD.exe
  C:\Windows\System\sRDBhFD.exe
  2⤵
  PID:7260
- C:\Windows\System\aMEfIBC.exe
  C:\Windows\System\aMEfIBC.exe
  2⤵
  PID:7288
- C:\Windows\System\YxKrIyY.exe
  C:\Windows\System\YxKrIyY.exe
  2⤵
  PID:7304
- C:\Windows\System\uPbHlEY.exe
  C:\Windows\System\uPbHlEY.exe
  2⤵
  PID:7356
- C:\Windows\System\TOORZYK.exe
  C:\Windows\System\TOORZYK.exe
  2⤵
  PID:7388
- C:\Windows\System\tndAjzg.exe
  C:\Windows\System\tndAjzg.exe
  2⤵
  PID:7400
- C:\Windows\System\VjiAAkU.exe
  C:\Windows\System\VjiAAkU.exe
  2⤵
  PID:7432
- C:\Windows\System\qFAuUjD.exe
  C:\Windows\System\qFAuUjD.exe
  2⤵
  PID:7464
- C:\Windows\System\ffASzxC.exe
  C:\Windows\System\ffASzxC.exe
  2⤵
  PID:7512
- C:\Windows\System\ClCqSWR.exe
  C:\Windows\System\ClCqSWR.exe
  2⤵
  PID:7500
- C:\Windows\System\BbWlVvk.exe
  C:\Windows\System\BbWlVvk.exe
  2⤵
  PID:7576
- C:\Windows\System\hCJiiXW.exe
  C:\Windows\System\hCJiiXW.exe
  2⤵
  PID:7640
- C:\Windows\System\KTXohwM.exe
  C:\Windows\System\KTXohwM.exe
  2⤵
  PID:7704
- C:\Windows\System\FuJEIOo.exe
  C:\Windows\System\FuJEIOo.exe
  2⤵
  PID:7624
- C:\Windows\System\czNtDlP.exe
  C:\Windows\System\czNtDlP.exe
  2⤵
  PID:7656
- C:\Windows\System\fhMaeus.exe
  C:\Windows\System\fhMaeus.exe
  2⤵
  PID:7596
- C:\Windows\System\ZxbryKW.exe
  C:\Windows\System\ZxbryKW.exe
  2⤵
  PID:7836
- C:\Windows\System\TguepIa.exe
  C:\Windows\System\TguepIa.exe
  2⤵
  PID:7896
- C:\Windows\System\aHaGCZg.exe
  C:\Windows\System\aHaGCZg.exe
  2⤵
  PID:7564
- C:\Windows\System\WJTWBgf.exe
  C:\Windows\System\WJTWBgf.exe
  2⤵
  PID:7724
- C:\Windows\System\gNcwTwg.exe
  C:\Windows\System\gNcwTwg.exe
  2⤵
  PID:7752
- C:\Windows\System\KEgyPIm.exe
  C:\Windows\System\KEgyPIm.exe
  2⤵
  PID:8064
- C:\Windows\System\ougnsjO.exe
  C:\Windows\System\ougnsjO.exe
  2⤵
  PID:7788
- C:\Windows\System\fwAxiAf.exe
  C:\Windows\System\fwAxiAf.exe
  2⤵
  PID:7944
- C:\Windows\System\lGDFlyZ.exe
  C:\Windows\System\lGDFlyZ.exe
  2⤵
  PID:8012
- C:\Windows\System\WjnjzVt.exe
  C:\Windows\System\WjnjzVt.exe
  2⤵
  PID:8100
- C:\Windows\System\LiNpEfG.exe
  C:\Windows\System\LiNpEfG.exe
  2⤵
  PID:7784
- C:\Windows\System\OWsfRkN.exe
  C:\Windows\System\OWsfRkN.exe
  2⤵
  PID:7848
- C:\Windows\System\VUuueVx.exe
  C:\Windows\System\VUuueVx.exe
  2⤵
  PID:7980
- C:\Windows\System\yPjpXha.exe
  C:\Windows\System\yPjpXha.exe
  2⤵
  PID:8168
- C:\Windows\System\zEyTQZa.exe
  C:\Windows\System\zEyTQZa.exe
  2⤵
  PID:7156
- C:\Windows\System\ASCbadU.exe
  C:\Windows\System\ASCbadU.exe
  2⤵
  PID:7320
- C:\Windows\System\syOyrNI.exe
  C:\Windows\System\syOyrNI.exe
  2⤵
  PID:7404
- C:\Windows\System\EldPgBr.exe
  C:\Windows\System\EldPgBr.exe
  2⤵
  PID:6600
- C:\Windows\System\tAwtepD.exe
  C:\Windows\System\tAwtepD.exe
  2⤵
  PID:7212
- C:\Windows\System\JQvANgj.exe
  C:\Windows\System\JQvANgj.exe
  2⤵
  PID:7416
- C:\Windows\System\EwvpckJ.exe
  C:\Windows\System\EwvpckJ.exe
  2⤵
  PID:7548
- C:\Windows\System\zKhcXgW.exe
  C:\Windows\System\zKhcXgW.exe
  2⤵
  PID:7672
- C:\Windows\System\FHjjMTx.exe
  C:\Windows\System\FHjjMTx.exe
  2⤵
  PID:7804
- C:\Windows\System\zaTyTPN.exe
  C:\Windows\System\zaTyTPN.exe
  2⤵
  PID:6312
- C:\Windows\System\oOgsdZX.exe
  C:\Windows\System\oOgsdZX.exe
  2⤵
  PID:8116
- C:\Windows\System\yHRXGlf.exe
  C:\Windows\System\yHRXGlf.exe
  2⤵
  PID:7932
- C:\Windows\System\Yjghoqo.exe
  C:\Windows\System\Yjghoqo.exe
  2⤵
  PID:7740
- C:\Windows\System\QUdZRwM.exe
  C:\Windows\System\QUdZRwM.exe
  2⤵
  PID:7868
- C:\Windows\System\gnKWqWj.exe
  C:\Windows\System\gnKWqWj.exe
  2⤵
  PID:8048
- C:\Windows\System\fJJfGCn.exe
  C:\Windows\System\fJJfGCn.exe
  2⤵
  PID:7368
- C:\Windows\System\TOWHQwQ.exe
  C:\Windows\System\TOWHQwQ.exe
  2⤵
  PID:8132
- C:\Windows\System\FhvrOFE.exe
  C:\Windows\System\FhvrOFE.exe
  2⤵
  PID:7256
- C:\Windows\System\jMTCwJM.exe
  C:\Windows\System\jMTCwJM.exe
  2⤵
  PID:7772
- C:\Windows\System\ezIOYoA.exe
  C:\Windows\System\ezIOYoA.exe
  2⤵
  PID:7884
- C:\Windows\System\ojDOfbG.exe
  C:\Windows\System\ojDOfbG.exe
  2⤵
  PID:8060
- C:\Windows\System\TECpeDM.exe
  C:\Windows\System\TECpeDM.exe
  2⤵
  PID:7544
- C:\Windows\System\EupKgsP.exe
  C:\Windows\System\EupKgsP.exe
  2⤵
  PID:7864
- C:\Windows\System\CzQupyl.exe
  C:\Windows\System\CzQupyl.exe
  2⤵
  PID:7692
- C:\Windows\System\IrFKqNU.exe
  C:\Windows\System\IrFKqNU.exe
  2⤵
  PID:8204
- C:\Windows\System\fLsojrx.exe
  C:\Windows\System\fLsojrx.exe
  2⤵
  PID:8220
- C:\Windows\System\zVofKTW.exe
  C:\Windows\System\zVofKTW.exe
  2⤵
  PID:8236
- C:\Windows\System\ZwWlMzz.exe
  C:\Windows\System\ZwWlMzz.exe
  2⤵
  PID:8252
- C:\Windows\System\lwlvRaj.exe
  C:\Windows\System\lwlvRaj.exe
  2⤵
  PID:8268
- C:\Windows\System\DeHfEvr.exe
  C:\Windows\System\DeHfEvr.exe
  2⤵
  PID:8284
- C:\Windows\System\zSatCPF.exe
  C:\Windows\System\zSatCPF.exe
  2⤵
  PID:8300
- C:\Windows\System\blEmtsi.exe
  C:\Windows\System\blEmtsi.exe
  2⤵
  PID:8316
- C:\Windows\System\GiAraxn.exe
  C:\Windows\System\GiAraxn.exe
  2⤵
  PID:8336
- C:\Windows\System\oVlEABt.exe
  C:\Windows\System\oVlEABt.exe
  2⤵
  PID:8352
- C:\Windows\System\TzGPUyB.exe
  C:\Windows\System\TzGPUyB.exe
  2⤵
  PID:8376
- C:\Windows\System\sKAokur.exe
  C:\Windows\System\sKAokur.exe
  2⤵
  PID:8396
- C:\Windows\System\gKhfGbu.exe
  C:\Windows\System\gKhfGbu.exe
  2⤵
  PID:8412
- C:\Windows\System\NgLjjuR.exe
  C:\Windows\System\NgLjjuR.exe
  2⤵
  PID:8432
- C:\Windows\System\XrXTxHW.exe
  C:\Windows\System\XrXTxHW.exe
  2⤵
  PID:8448
- C:\Windows\System\hiaNWAy.exe
  C:\Windows\System\hiaNWAy.exe
  2⤵
  PID:8504
- C:\Windows\System\tnVnAtl.exe
  C:\Windows\System\tnVnAtl.exe
  2⤵
  PID:8520
- C:\Windows\System\WxGTYoY.exe
  C:\Windows\System\WxGTYoY.exe
  2⤵
  PID:8540
- C:\Windows\System\aFgqhLE.exe
  C:\Windows\System\aFgqhLE.exe
  2⤵
  PID:8556
- C:\Windows\System\lzCzioS.exe
  C:\Windows\System\lzCzioS.exe
  2⤵
  PID:8572
- C:\Windows\System\ajWqbJt.exe
  C:\Windows\System\ajWqbJt.exe
  2⤵
  PID:8592
- C:\Windows\System\cNbPnlZ.exe
  C:\Windows\System\cNbPnlZ.exe
  2⤵
  PID:8608
- C:\Windows\System\SXepgPA.exe
  C:\Windows\System\SXepgPA.exe
  2⤵
  PID:8632
- C:\Windows\System\auAgqlN.exe
  C:\Windows\System\auAgqlN.exe
  2⤵
  PID:8648
- C:\Windows\System\LpGaWOH.exe
  C:\Windows\System\LpGaWOH.exe
  2⤵
  PID:8664
- C:\Windows\System\PWVkIcz.exe
  C:\Windows\System\PWVkIcz.exe
  2⤵
  PID:8684
- C:\Windows\System\OiBIEBL.exe
  C:\Windows\System\OiBIEBL.exe
  2⤵
  PID:8700
- C:\Windows\System\pRjVIKs.exe
  C:\Windows\System\pRjVIKs.exe
  2⤵
  PID:8716
- C:\Windows\System\KBCXZmb.exe
  C:\Windows\System\KBCXZmb.exe
  2⤵
  PID:8736
- C:\Windows\System\NQthYOu.exe
  C:\Windows\System\NQthYOu.exe
  2⤵
  PID:8752
- C:\Windows\System\gleGsxO.exe
  C:\Windows\System\gleGsxO.exe
  2⤵
  PID:8768
- C:\Windows\System\HpWmaWY.exe
  C:\Windows\System\HpWmaWY.exe
  2⤵
  PID:8784
- C:\Windows\System\pqmKaUu.exe
  C:\Windows\System\pqmKaUu.exe
  2⤵
  PID:8800
- C:\Windows\System\wZhbgwW.exe
  C:\Windows\System\wZhbgwW.exe
  2⤵
  PID:8816
- C:\Windows\System\hRxbbUa.exe
  C:\Windows\System\hRxbbUa.exe
  2⤵
  PID:8832
- C:\Windows\System\udIwrhU.exe
  C:\Windows\System\udIwrhU.exe
  2⤵
  PID:8848
- C:\Windows\System\tsQZnGM.exe
  C:\Windows\System\tsQZnGM.exe
  2⤵
  PID:8864
- C:\Windows\System\hKrUmpF.exe
  C:\Windows\System\hKrUmpF.exe
  2⤵
  PID:8880
- C:\Windows\System\ciiCkFF.exe
  C:\Windows\System\ciiCkFF.exe
  2⤵
  PID:8896
- C:\Windows\System\JWgQOSG.exe
  C:\Windows\System\JWgQOSG.exe
  2⤵
  PID:8912
- C:\Windows\System\pHeahVR.exe
  C:\Windows\System\pHeahVR.exe
  2⤵
  PID:8928
- C:\Windows\System\omEZRSy.exe
  C:\Windows\System\omEZRSy.exe
  2⤵
  PID:8944
- C:\Windows\System\UgdxMjm.exe
  C:\Windows\System\UgdxMjm.exe
  2⤵
  PID:8964
- C:\Windows\System\beTryKD.exe
  C:\Windows\System\beTryKD.exe
  2⤵
  PID:8984
- C:\Windows\System\FtOxmrC.exe
  C:\Windows\System\FtOxmrC.exe
  2⤵
  PID:9000
- C:\Windows\System\LTdiABH.exe
  C:\Windows\System\LTdiABH.exe
  2⤵
  PID:9016
- C:\Windows\System\GeZlAFy.exe
  C:\Windows\System\GeZlAFy.exe
  2⤵
  PID:9044
- C:\Windows\System\bokYdcI.exe
  C:\Windows\System\bokYdcI.exe
  2⤵
  PID:9060
- C:\Windows\System\FqFGSlK.exe
  C:\Windows\System\FqFGSlK.exe
  2⤵
  PID:9076
- C:\Windows\System\LppCUoG.exe
  C:\Windows\System\LppCUoG.exe
  2⤵
  PID:9096
- C:\Windows\System\TWSvjDk.exe
  C:\Windows\System\TWSvjDk.exe
  2⤵
  PID:9116
- C:\Windows\System\DmuGNhB.exe
  C:\Windows\System\DmuGNhB.exe
  2⤵
  PID:9132
- C:\Windows\System\styNmXf.exe
  C:\Windows\System\styNmXf.exe
  2⤵
  PID:9152
- C:\Windows\System\NnOKxWg.exe
  C:\Windows\System\NnOKxWg.exe
  2⤵
  PID:9172
- C:\Windows\System\kmgjimy.exe
  C:\Windows\System\kmgjimy.exe
  2⤵
  PID:9188
- C:\Windows\System\ypkAGup.exe
  C:\Windows\System\ypkAGup.exe
  2⤵
  PID:9204
- C:\Windows\System\dAcmBvZ.exe
  C:\Windows\System\dAcmBvZ.exe
  2⤵
  PID:8200
- C:\Windows\System\TvJygGR.exe
  C:\Windows\System\TvJygGR.exe
  2⤵
  PID:8228
- C:\Windows\System\hiZEIti.exe
  C:\Windows\System\hiZEIti.exe
  2⤵
  PID:8292
- C:\Windows\System\PzjVVWB.exe
  C:\Windows\System\PzjVVWB.exe
  2⤵
  PID:8360
- C:\Windows\System\oxeXPFK.exe
  C:\Windows\System\oxeXPFK.exe
  2⤵
  PID:8372
- C:\Windows\System\eFmqiAS.exe
  C:\Windows\System\eFmqiAS.exe
  2⤵
  PID:7976
- C:\Windows\System\aGnhcHL.exe
  C:\Windows\System\aGnhcHL.exe
  2⤵
  PID:7960
- C:\Windows\System\KiMRRvN.exe
  C:\Windows\System\KiMRRvN.exe
  2⤵
  PID:8212
- C:\Windows\System\dSpVNWI.exe
  C:\Windows\System\dSpVNWI.exe
  2⤵
  PID:8244
- C:\Windows\System\ZejZWvZ.exe
  C:\Windows\System\ZejZWvZ.exe
  2⤵
  PID:8384
- C:\Windows\System\qnrcxBq.exe
  C:\Windows\System\qnrcxBq.exe
  2⤵
  PID:8248
- C:\Windows\System\LuwYoRj.exe
  C:\Windows\System\LuwYoRj.exe
  2⤵
  PID:8312
- C:\Windows\System\iEqFsPF.exe
  C:\Windows\System\iEqFsPF.exe
  2⤵
  PID:8444
- C:\Windows\System\jWuOfFw.exe
  C:\Windows\System\jWuOfFw.exe
  2⤵
  PID:8476
- C:\Windows\System\nrppeDZ.exe
  C:\Windows\System\nrppeDZ.exe
  2⤵
  PID:8620
- C:\Windows\System\DAFSjqP.exe
  C:\Windows\System\DAFSjqP.exe
  2⤵
  PID:8660
- C:\Windows\System\qqlbHDA.exe
  C:\Windows\System\qqlbHDA.exe
  2⤵
  PID:8724
- C:\Windows\System\LyAzyHQ.exe
  C:\Windows\System\LyAzyHQ.exe
  2⤵
  PID:8536
- C:\Windows\System\ZKRCwes.exe
  C:\Windows\System\ZKRCwes.exe
  2⤵
  PID:8824
- C:\Windows\System\fzuwqfb.exe
  C:\Windows\System\fzuwqfb.exe
  2⤵
  PID:8892
- C:\Windows\System\GfzYJKq.exe
  C:\Windows\System\GfzYJKq.exe
  2⤵
  PID:8952
- C:\Windows\System\WpHQCiI.exe
  C:\Windows\System\WpHQCiI.exe
  2⤵
  PID:8996
- C:\Windows\System\bxJMoGK.exe
  C:\Windows\System\bxJMoGK.exe
  2⤵
  PID:8604
- C:\Windows\System\MazQVPn.exe
  C:\Windows\System\MazQVPn.exe
  2⤵
  PID:8872
- C:\Windows\System\dgSRsDi.exe
  C:\Windows\System\dgSRsDi.exe
  2⤵
  PID:9012
- C:\Windows\System\rLqbWoc.exe
  C:\Windows\System\rLqbWoc.exe
  2⤵
  PID:8672
- C:\Windows\System\AbbDHEc.exe
  C:\Windows\System\AbbDHEc.exe
  2⤵
  PID:8744
- C:\Windows\System\dUXfwCy.exe
  C:\Windows\System\dUXfwCy.exe
  2⤵
  PID:8808
- C:\Windows\System\GcDhyde.exe
  C:\Windows\System\GcDhyde.exe
  2⤵
  PID:8904
- C:\Windows\System\KUwYIYp.exe
  C:\Windows\System\KUwYIYp.exe
  2⤵
  PID:9008
- C:\Windows\System\TMcldrv.exe
  C:\Windows\System\TMcldrv.exe
  2⤵
  PID:9072
- C:\Windows\System\PGONEnn.exe
  C:\Windows\System\PGONEnn.exe
  2⤵
  PID:9144
- C:\Windows\System\nQkqvTO.exe
  C:\Windows\System\nQkqvTO.exe
  2⤵
  PID:9212
- C:\Windows\System\gUjZZqm.exe
  C:\Windows\System\gUjZZqm.exe
  2⤵
  PID:8328
- C:\Windows\System\FXmjCqG.exe
  C:\Windows\System\FXmjCqG.exe
  2⤵
  PID:8000
- C:\Windows\System\iQckSot.exe
  C:\Windows\System\iQckSot.exe
  2⤵
  PID:8456
- C:\Windows\System\LXVazNQ.exe
  C:\Windows\System\LXVazNQ.exe
  2⤵
  PID:9124
- C:\Windows\System\HfbQYuI.exe
  C:\Windows\System\HfbQYuI.exe
  2⤵
  PID:9056
- C:\Windows\System\ovhbwLk.exe
  C:\Windows\System\ovhbwLk.exe
  2⤵
  PID:7592
- C:\Windows\System\bqljaub.exe
  C:\Windows\System\bqljaub.exe
  2⤵
  PID:8280
- C:\Windows\System\rggdroq.exe
  C:\Windows\System\rggdroq.exe
  2⤵
  PID:7420
- C:\Windows\System\WwvAMUF.exe
  C:\Windows\System\WwvAMUF.exe
  2⤵
  PID:8408
- C:\Windows\System\rCniLRY.exe
  C:\Windows\System\rCniLRY.exe
  2⤵
  PID:8428
- C:\Windows\System\uBLkqhK.exe
  C:\Windows\System\uBLkqhK.exe
  2⤵
  PID:8472
- C:\Windows\System\xjKtnmt.exe
  C:\Windows\System\xjKtnmt.exe
  2⤵
  PID:8516
- C:\Windows\System\TuQHkAj.exe
  C:\Windows\System\TuQHkAj.exe
  2⤵
  PID:8580
- C:\Windows\System\EqkZNSh.exe
  C:\Windows\System\EqkZNSh.exe
  2⤵
  PID:8888
- C:\Windows\System\zZmdPVU.exe
  C:\Windows\System\zZmdPVU.exe
  2⤵
  PID:8564
- C:\Windows\System\zQYUcuE.exe
  C:\Windows\System\zQYUcuE.exe
  2⤵
  PID:8708
- C:\Windows\System\ccsFOuf.exe
  C:\Windows\System\ccsFOuf.exe
  2⤵
  PID:8656
- C:\Windows\System\LzIkbDe.exe
  C:\Windows\System\LzIkbDe.exe
  2⤵
  PID:8992
- C:\Windows\System\CVwryvL.exe
  C:\Windows\System\CVwryvL.exe
  2⤵
  PID:8776
- C:\Windows\System\VKcTbgK.exe
  C:\Windows\System\VKcTbgK.exe
  2⤵
  PID:9036
- C:\Windows\System\bajSfwI.exe
  C:\Windows\System\bajSfwI.exe
  2⤵
  PID:8016
- C:\Windows\System\hRcLCWo.exe
  C:\Windows\System\hRcLCWo.exe
  2⤵
  PID:8440
- C:\Windows\System\dxWpZKT.exe
  C:\Windows\System\dxWpZKT.exe
  2⤵
  PID:9112
- C:\Windows\System\GDMreCL.exe
  C:\Windows\System\GDMreCL.exe
  2⤵
  PID:9092
- C:\Windows\System\EPMSIdu.exe
  C:\Windows\System\EPMSIdu.exe
  2⤵
  PID:9104
- C:\Windows\System\oevCiOr.exe
  C:\Windows\System\oevCiOr.exe
  2⤵
  PID:8552
- C:\Windows\System\uYwEeJY.exe
  C:\Windows\System\uYwEeJY.exe
  2⤵
  PID:8764
- C:\Windows\System\bbgKlas.exe
  C:\Windows\System\bbgKlas.exe
  2⤵
  PID:8616
- C:\Windows\System\IjzAhTl.exe
  C:\Windows\System\IjzAhTl.exe
  2⤵
  PID:8860
- C:\Windows\System\NWYXVtN.exe
  C:\Windows\System\NWYXVtN.exe
  2⤵
  PID:8940
- C:\Windows\System\UJSuDQY.exe
  C:\Windows\System\UJSuDQY.exe
  2⤵
  PID:9180
- C:\Windows\System\nFjYeOW.exe
  C:\Windows\System\nFjYeOW.exe
  2⤵
  PID:9140
- C:\Windows\System\qOkIMCK.exe
  C:\Windows\System\qOkIMCK.exe
  2⤵
  PID:8484
- C:\Windows\System\iDmHxrR.exe
  C:\Windows\System\iDmHxrR.exe
  2⤵
  PID:9068
- C:\Windows\System\yZbjAzC.exe
  C:\Windows\System\yZbjAzC.exe
  2⤵
  PID:8840
- C:\Windows\System\LTNyhFg.exe
  C:\Windows\System\LTNyhFg.exe
  2⤵
  PID:7852
- C:\Windows\System\rCVcCcq.exe
  C:\Windows\System\rCVcCcq.exe
  2⤵
  PID:6900
- C:\Windows\System\Ricfnvi.exe
  C:\Windows\System\Ricfnvi.exe
  2⤵
  PID:9224
- C:\Windows\System\VCBsqqH.exe
  C:\Windows\System\VCBsqqH.exe
  2⤵
  PID:9240
- C:\Windows\System\TsHvwuw.exe
  C:\Windows\System\TsHvwuw.exe
  2⤵
  PID:9256
- C:\Windows\System\rMxCnLA.exe
  C:\Windows\System\rMxCnLA.exe
  2⤵
  PID:9276
- C:\Windows\System\whfGtlk.exe
  C:\Windows\System\whfGtlk.exe
  2⤵
  PID:9292
- C:\Windows\System\yPIVqEv.exe
  C:\Windows\System\yPIVqEv.exe
  2⤵
  PID:9308
- C:\Windows\System\mcmwUmE.exe
  C:\Windows\System\mcmwUmE.exe
  2⤵
  PID:9324
- C:\Windows\System\ljjRXtO.exe
  C:\Windows\System\ljjRXtO.exe
  2⤵
  PID:9340
- C:\Windows\System\PWNjUEx.exe
  C:\Windows\System\PWNjUEx.exe
  2⤵
  PID:9356
- C:\Windows\System\SbuYGiy.exe
  C:\Windows\System\SbuYGiy.exe
  2⤵
  PID:9372
- C:\Windows\System\Ssgftqt.exe
  C:\Windows\System\Ssgftqt.exe
  2⤵
  PID:9388
- C:\Windows\System\uNJdiee.exe
  C:\Windows\System\uNJdiee.exe
  2⤵
  PID:9404
- C:\Windows\System\NYXXxzR.exe
  C:\Windows\System\NYXXxzR.exe
  2⤵
  PID:9420
- C:\Windows\System\blVjgvr.exe
  C:\Windows\System\blVjgvr.exe
  2⤵
  PID:9436
- C:\Windows\System\fFBGQoT.exe
  C:\Windows\System\fFBGQoT.exe
  2⤵
  PID:9452
- C:\Windows\System\yGSvKkc.exe
  C:\Windows\System\yGSvKkc.exe
  2⤵
  PID:9468
- C:\Windows\System\UKhYyZt.exe
  C:\Windows\System\UKhYyZt.exe
  2⤵
  PID:9484
- C:\Windows\System\OxPjBFp.exe
  C:\Windows\System\OxPjBFp.exe
  2⤵
  PID:9500
- C:\Windows\System\mEgquQW.exe
  C:\Windows\System\mEgquQW.exe
  2⤵
  PID:9516
- C:\Windows\System\QEIOIRI.exe
  C:\Windows\System\QEIOIRI.exe
  2⤵
  PID:9532
- C:\Windows\System\BdCNuKq.exe
  C:\Windows\System\BdCNuKq.exe
  2⤵
  PID:9572
- C:\Windows\System\eGqfoAu.exe
  C:\Windows\System\eGqfoAu.exe
  2⤵
  PID:9588
- C:\Windows\System\AwnoZHi.exe
  C:\Windows\System\AwnoZHi.exe
  2⤵
  PID:9604
- C:\Windows\System\rDcXHSr.exe
  C:\Windows\System\rDcXHSr.exe
  2⤵
  PID:9620
- C:\Windows\System\QAuUZiF.exe
  C:\Windows\System\QAuUZiF.exe
  2⤵
  PID:9636
- C:\Windows\System\VHMofKX.exe
  C:\Windows\System\VHMofKX.exe
  2⤵
  PID:9652
- C:\Windows\System\QeAiOEB.exe
  C:\Windows\System\QeAiOEB.exe
  2⤵
  PID:9668
- C:\Windows\System\ZdEkAJR.exe
  C:\Windows\System\ZdEkAJR.exe
  2⤵
  PID:9688
- C:\Windows\System\fBwuNlC.exe
  C:\Windows\System\fBwuNlC.exe
  2⤵
  PID:9704
- C:\Windows\System\dFwuvNi.exe
  C:\Windows\System\dFwuvNi.exe
  2⤵
  PID:9720
- C:\Windows\System\wdDZbyu.exe
  C:\Windows\System\wdDZbyu.exe
  2⤵
  PID:9736
- C:\Windows\System\DucpptK.exe
  C:\Windows\System\DucpptK.exe
  2⤵
  PID:9752
- C:\Windows\System\JHzyOUZ.exe
  C:\Windows\System\JHzyOUZ.exe
  2⤵
  PID:9768
- C:\Windows\System\lgrQjYT.exe
  C:\Windows\System\lgrQjYT.exe
  2⤵
  PID:9784
- C:\Windows\System\OxRznpF.exe
  C:\Windows\System\OxRznpF.exe
  2⤵
  PID:9800
- C:\Windows\System\NUoDPsk.exe
  C:\Windows\System\NUoDPsk.exe
  2⤵
  PID:9816
- C:\Windows\System\UqAjzRA.exe
  C:\Windows\System\UqAjzRA.exe
  2⤵
  PID:9832
- C:\Windows\System\DjrrvpY.exe
  C:\Windows\System\DjrrvpY.exe
  2⤵
  PID:9848
- C:\Windows\System\oRMXvwj.exe
  C:\Windows\System\oRMXvwj.exe
  2⤵
  PID:9864
- C:\Windows\System\jDuPqFi.exe
  C:\Windows\System\jDuPqFi.exe
  2⤵
  PID:9880
- C:\Windows\System\AIzPVmJ.exe
  C:\Windows\System\AIzPVmJ.exe
  2⤵
  PID:9896
- C:\Windows\System\cBrzgKn.exe
  C:\Windows\System\cBrzgKn.exe
  2⤵
  PID:9912
- C:\Windows\System\BDwFGbP.exe
  C:\Windows\System\BDwFGbP.exe
  2⤵
  PID:9928
- C:\Windows\System\CZWUCXr.exe
  C:\Windows\System\CZWUCXr.exe
  2⤵
  PID:9944
- C:\Windows\System\RJWlquY.exe
  C:\Windows\System\RJWlquY.exe
  2⤵
  PID:9960
- C:\Windows\System\BTJmUkb.exe
  C:\Windows\System\BTJmUkb.exe
  2⤵
  PID:9976
- C:\Windows\System\TrSxROo.exe
  C:\Windows\System\TrSxROo.exe
  2⤵
  PID:9992
- C:\Windows\System\aVcHnNE.exe
  C:\Windows\System\aVcHnNE.exe
  2⤵
  PID:10008
- C:\Windows\System\MTYBfwt.exe
  C:\Windows\System\MTYBfwt.exe
  2⤵
  PID:10024
- C:\Windows\System\KqszhXk.exe
  C:\Windows\System\KqszhXk.exe
  2⤵
  PID:10040
- C:\Windows\System\PNlUKEL.exe
  C:\Windows\System\PNlUKEL.exe
  2⤵
  PID:10056
- C:\Windows\System\GSUkSeK.exe
  C:\Windows\System\GSUkSeK.exe
  2⤵
  PID:10072
- C:\Windows\System\LzQbpwY.exe
  C:\Windows\System\LzQbpwY.exe
  2⤵
  PID:10088
- C:\Windows\System\FXwtKNV.exe
  C:\Windows\System\FXwtKNV.exe
  2⤵
  PID:10104
- C:\Windows\System\BuqAhzy.exe
  C:\Windows\System\BuqAhzy.exe
  2⤵
  PID:10120
- C:\Windows\System\CSQIBlL.exe
  C:\Windows\System\CSQIBlL.exe
  2⤵
  PID:10136
- C:\Windows\System\bFqNCxn.exe
  C:\Windows\System\bFqNCxn.exe
  2⤵
  PID:10152
- C:\Windows\System\EiIJktx.exe
  C:\Windows\System\EiIJktx.exe
  2⤵
  PID:10168
- C:\Windows\System\qIMsElm.exe
  C:\Windows\System\qIMsElm.exe
  2⤵
  PID:10188
- C:\Windows\System\tEBxifS.exe
  C:\Windows\System\tEBxifS.exe
  2⤵
  PID:10204
- C:\Windows\System\tQXninC.exe
  C:\Windows\System\tQXninC.exe
  2⤵
  PID:10220
- C:\Windows\System\sJyFbFT.exe
  C:\Windows\System\sJyFbFT.exe
  2⤵
  PID:10236
- C:\Windows\System\dFMuCHj.exe
  C:\Windows\System\dFMuCHj.exe
  2⤵
  PID:9252
- C:\Windows\System\zjMjHaw.exe
  C:\Windows\System\zjMjHaw.exe
  2⤵
  PID:9348
- C:\Windows\System\RLucsyF.exe
  C:\Windows\System\RLucsyF.exe
  2⤵
  PID:9384
- C:\Windows\System\LhVEjTe.exe
  C:\Windows\System\LhVEjTe.exe
  2⤵
  PID:9444
- C:\Windows\System\mHuJdfr.exe
  C:\Windows\System\mHuJdfr.exe
  2⤵
  PID:9480
- C:\Windows\System\KcAVvTi.exe
  C:\Windows\System\KcAVvTi.exe
  2⤵
  PID:9088
- C:\Windows\System\knFVlvn.exe
  C:\Windows\System\knFVlvn.exe
  2⤵
  PID:6096
- C:\Windows\System\tqFCOWj.exe
  C:\Windows\System\tqFCOWj.exe
  2⤵
  PID:9052
- C:\Windows\System\oFCVdgB.exe
  C:\Windows\System\oFCVdgB.exe
  2⤵
  PID:9232
- C:\Windows\System\PfxugjS.exe
  C:\Windows\System\PfxugjS.exe
  2⤵
  PID:9332
- C:\Windows\System\wXTRRBZ.exe
  C:\Windows\System\wXTRRBZ.exe
  2⤵
  PID:9400
- C:\Windows\System\wyLaxky.exe
  C:\Windows\System\wyLaxky.exe
  2⤵
  PID:9496
- C:\Windows\System\bNMhXta.exe
  C:\Windows\System\bNMhXta.exe
  2⤵
  PID:9552
- C:\Windows\System\FHAiWht.exe
  C:\Windows\System\FHAiWht.exe
  2⤵
  PID:9568
- C:\Windows\System\YeRIGTn.exe
  C:\Windows\System\YeRIGTn.exe
  2⤵
  PID:9628
- C:\Windows\System\XWeSbIK.exe
  C:\Windows\System\XWeSbIK.exe
  2⤵
  PID:9744
- C:\Windows\System\yOiNILV.exe
  C:\Windows\System\yOiNILV.exe
  2⤵
  PID:9776
- C:\Windows\System\wzxaykO.exe
  C:\Windows\System\wzxaykO.exe
  2⤵
  PID:9808
- C:\Windows\System\aQmLKZE.exe
  C:\Windows\System\aQmLKZE.exe
  2⤵
  PID:9716
- C:\Windows\System\yFrwNtJ.exe
  C:\Windows\System\yFrwNtJ.exe
  2⤵
  PID:9764
- C:\Windows\System\ICgKiqi.exe
  C:\Windows\System\ICgKiqi.exe
  2⤵
  PID:9856
- C:\Windows\System\aGIgHqX.exe
  C:\Windows\System\aGIgHqX.exe
  2⤵
  PID:9892
- C:\Windows\System\QHNcere.exe
  C:\Windows\System\QHNcere.exe
  2⤵
  PID:9984
- C:\Windows\System\HfPFEHq.exe
  C:\Windows\System\HfPFEHq.exe
  2⤵
  PID:9952
- C:\Windows\System\FVzJkbL.exe
  C:\Windows\System\FVzJkbL.exe
  2⤵
  PID:9940
- C:\Windows\System\GPdXatS.exe
  C:\Windows\System\GPdXatS.exe
  2⤵
  PID:10080
- C:\Windows\System\iZnCgaw.exe
  C:\Windows\System\iZnCgaw.exe
  2⤵
  PID:10148
- C:\Windows\System\TbucfAJ.exe
  C:\Windows\System\TbucfAJ.exe
  2⤵
  PID:10096
- C:\Windows\System\lmGwwBr.exe
  C:\Windows\System\lmGwwBr.exe
  2⤵
  PID:10132
- C:\Windows\System\LMiXSwv.exe
  C:\Windows\System\LMiXSwv.exe
  2⤵
  PID:10184
- C:\Windows\System\IqhbEyo.exe
  C:\Windows\System\IqhbEyo.exe
  2⤵
  PID:9248
- C:\Windows\System\MMRnnTm.exe
  C:\Windows\System\MMRnnTm.exe
  2⤵
  PID:10200
- C:\Windows\System\DPKhvZK.exe
  C:\Windows\System\DPKhvZK.exe
  2⤵
  PID:10228
- C:\Windows\System\GGtqWyT.exe
  C:\Windows\System\GGtqWyT.exe
  2⤵
  PID:9316
- C:\Windows\System\fNddWJO.exe
  C:\Windows\System\fNddWJO.exe
  2⤵
  PID:9540
- C:\Windows\System\OxlnJQB.exe
  C:\Windows\System\OxlnJQB.exe
  2⤵
  PID:9492
- C:\Windows\System\trDMByA.exe
  C:\Windows\System\trDMByA.exe
  2⤵
  PID:9664
- C:\Windows\System\IrlyQMW.exe
  C:\Windows\System\IrlyQMW.exe
  2⤵
  PID:8364
- C:\Windows\System\IWAckGO.exe
  C:\Windows\System\IWAckGO.exe
  2⤵
  PID:9336
- C:\Windows\System\MjxFzBh.exe
  C:\Windows\System\MjxFzBh.exe
  2⤵
  PID:9396
- C:\Windows\System\WICeIxi.exe
  C:\Windows\System\WICeIxi.exe
  2⤵
  PID:9748
- C:\Windows\System\xPbYBcP.exe
  C:\Windows\System\xPbYBcP.exe
  2⤵
  PID:9580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkuvVxr.exe

Filesize
1.8MB

MD5
90e3f1ffe5069815469daa26101541c2

SHA1
79470376250eae34cddec92beec00176234d885d

SHA256
f96d4cf93449512388373c14a364caecf583f4056020dbd60aa83ac8ce62765e

SHA512
dcc59753b0823b51b6eef262d3201ddc8375039230013c1739ab324e2d34853322e68e9171c9f61de356d312d0263c0ba674144ec53f1dbd7befde9418a3ff49

Download Submit
C:\Windows\system\BdiNUPE.exe

Filesize
1.8MB

MD5
b4004bd8982cdf94b5601dc2e6601546

SHA1
d65efb8ad7c0f229c79abbdfd0fd7b48f81949d9

SHA256
58c50ce79d863186e629d3a5fc7773665d588ffb96b6f44fe40d3a6d1667d18b

SHA512
5fd63f69fefd8f1a0702d03bf2be1f5b311d5f3ff8b4f9d068b438ac18895059f2e8892d2b81beb3895270e5fb58aad8b4632ad1f20c83ae9b90946a4a778a65

Download Submit
C:\Windows\system\CqtQvOT.exe

Filesize
1.8MB

MD5
0f31ba2f65234209e579b6817d6b9338

SHA1
8c5513b3143ae826b170212a55617548b1dc0563

SHA256
f0f9ed7810f43ca4daaf34faed9989245876a11dec014a0ebb0810abf4d32391

SHA512
b526f6b3c3adfb11ebf4ed2c97ea00b266486dd957459a7c008688290bdce65be32ab521930c6c9f953e15fbe66af5d1bbb1463cdc20c5164f62856e37208f54

Download Submit
C:\Windows\system\Dypdmmh.exe

Filesize
1.8MB

MD5
2654f10e9b3db3d121b5ba1ef6501ed7

SHA1
08f64ae7722eeacfd06d6833fc19c71aeb86406f

SHA256
7965f9c422982d8e3fcefed898bc66f6a68d0577b5095e668610a4c74667c516

SHA512
c2716011d233d282e8c0410dbfd631d39db150762d5f2fa155bb3235c8de945e666063899e577e6df0eac7dd52b4f9de63f8eeae41377bacf9c2f20e5857cedc

Download Submit
C:\Windows\system\EBKcihX.exe

Filesize
1.8MB

MD5
c99ef0913f82b2d0a4b20da9daa30391

SHA1
e46af66bc7306c9f58d91d0e7c298556c50ad3b4

SHA256
b47b97dcd0de8dd6df0085c51ea2fc80b6747278aa9cb8f088538a2475b22b1b

SHA512
f29d5e46fe4b4f9316bd8ff13807f497cd080f71fd150365dd97575289d4cc9d465c65ee258cf6b162df509515a265c733ab999d57b7a0927ebe7cdb7b2088dd

Download Submit
C:\Windows\system\GTVdeIr.exe

Filesize
1.8MB

MD5
d0a2901706e88d5d9c288d9ae20eee10

SHA1
75eb65bb73952bfc3d441f43afcb57067c6051f6

SHA256
491488a0686263a63f5132de8817359050d55bf20899c56df7c2a4f47ccf527b

SHA512
1439baa57a0a6b196da549b50f92d0dc3e4c71440bbc340b12552ae5e94fbb4123388c59d1ec0de4430cca4d0970c6d9064f6d27cced2149190bb17fc6868cbd

Download Submit
C:\Windows\system\IopMfHk.exe

Filesize
1.8MB

MD5
4077410bb750c81ea00d45af202980f2

SHA1
f38fea9c964b1ce1b6a3a84a8bec17ae52a91126

SHA256
752721e5630d27c3798f45c739e2b5ee2a5ac21bd4841c5978903d6e223849e6

SHA512
849c8656a9d79b6587902be22116b489a7d007436b2604fd830115978bcbdf9f52b0a36daae1882a4c1ebec3a81a0efe30a49496a8a407917204c97c8876b66a

Download Submit
C:\Windows\system\JaKycSC.exe

Filesize
1.8MB

MD5
7f9db98af335f9a9cd60270f380f4b5f

SHA1
202eb45ec779b4073b7dfaaa243ed261161d03a1

SHA256
98cd8e4aa22221cb3225bf25d8463b6d50c343425517cdd839025afa7a30a247

SHA512
39bb09c8dac899d076ec8865a51bc5e0ca9adb9981438f6c7067575378a0aed8ce3007f639996442ef40aa59ac2ebce2dd59ef48f39dc4ffce2ae2c942c5f4fa

Download Submit
C:\Windows\system\KIkkDOU.exe

Filesize
1.8MB

MD5
648aa292209a255012f9301b0e5d5097

SHA1
a03a5c0ffc6c925a130cfeb237c97c4fb2c539ca

SHA256
5ca84a87273fd2e58664ea0e746f572c2e11af2dc198ffa70fe531df15174b54

SHA512
6ca7f73a07028a08bd0108c884f3c149773a5e3efd92df7736195b6eaccba864b1beb2c63b4cd48e8b4a33b8cae7ecb4e4dad9fb143f9300a75449089d76792a

Download Submit
C:\Windows\system\MilOIoo.exe

Filesize
1.8MB

MD5
84eefb62b3997febde59beb1412d6d86

SHA1
de09908b2f6cbb59c0616173de3611b931040a27

SHA256
2b1b2716dda9c093dd19ff912d8e2c3f249f245a9c0d802ef4d7349f5ea6ef18

SHA512
a9c9d66e46368c86f1bf044dd3b1217c5cb10ca1fd96f73af715c98c2b0161e9a0c80f8df832d216b4baae381db2a5209b8c549557f16adacd2f69a52c11a528

Download Submit
C:\Windows\system\PEIRrZM.exe

Filesize
1.8MB

MD5
d754a851e38a143a15dcdbff31ec1c9a

SHA1
cf18f3c6725f91823c0ff93ec8ff2cb0efd849af

SHA256
bbcfb6b36239e06513633c88f2c72e4683aae17fca3ee562d23fb6e8dd8a4bc2

SHA512
e0ce69575489742cae5bc242271cf04fd802e69bdf4bee96896b50ed4ea31b4f254a14638801b75aa0759d044934858c06b339660d66af49a2d5d705d280e96e

Download Submit
C:\Windows\system\QfNXOhU.exe

Filesize
1.8MB

MD5
e713b09081d4a1f78a335424cbc82d55

SHA1
1691040e174b0ce9e54a4ae5d508f383986a1a58

SHA256
d9ff943d1da6c9103866a502f3ce6d7931ece5c3540a73ef9d09e65599171e8c

SHA512
c8abdbfde296cfe463249b86b3ae62b3e89a69bff6b9bb648b71d5803f79179888e095853552cef872d8ebbe5b01d4bd5244361e159abb5a77a8643347bbb5ec

Download Submit
C:\Windows\system\SpYdNvX.exe

Filesize
1.8MB

MD5
d85827106741ffad0ea8321983d27952

SHA1
0c450f60f6b8062d3ddaebccf8a8e2d8b9b1b17a

SHA256
953e7cefadf118ac4cf3c9594a7def6fad7dff8647b261439dde0728d5d3f3cf

SHA512
7bcb6dc4761290881f10bf58116aefaed5c9548a2cb661b88e9eac940be069953a011e925f5e022c4f21ddb8c512cf591241dd018ca4b7d86714247a9ae34123

Download Submit
C:\Windows\system\TMjjjAz.exe

Filesize
1.8MB

MD5
b6f2c7f76fee01d93a7ef41b2b072996

SHA1
e83aac98c2da8967fc7e42b67112968895636197

SHA256
8c25f25a49bbd934dea49d48e9f8c9364e0a3afb35725738ce0335b41748466b

SHA512
5f95b9f04e4f545990637cfbaedf7f4c01912a242867188fd69ac0fd3ef7462cb50cc5208cd10a6f02d418d84524a89630a3bd576fe942dd6cd15d8374f6ef86

Download Submit
C:\Windows\system\TdLOBHx.exe

Filesize
1.8MB

MD5
65d55dd45b73d1092a32553a043e79bc

SHA1
8edc564f7ca2c865f537912613c838331bd14494

SHA256
2aaefce11c0f7c005fc029572a87c6741f265c6616f12c79bbbf7f86efe7e51b

SHA512
adedefc971fedde72941a8935bc9212640aedaf2a64adf8cff135219bd4bb56d6d4c908da1d6f56abebed56432d9becc8e96d0572d868771515a7d3a155f758e

Download Submit
C:\Windows\system\WsjwHEg.exe

Filesize
1.8MB

MD5
2f97d234267aff6668cfc21dfd59a49d

SHA1
ffef4c2596a25baed823da237d2b49c385278f71

SHA256
6544da7a15184049d03a81c0b0f595b5ec6a40fc81056a7088451c4f1d2fba48

SHA512
d476021fc280ea344e38f60c8416bf9a347e6963245dde55e941581dbe21ab7c2ba66b405536796ed8207a84adf3e936a9b61c37593a878b2083ca5670836335

Download Submit
C:\Windows\system\Yvjeqrp.exe

Filesize
1.8MB

MD5
99198ab2502ad88130c58476e6bc1be7

SHA1
1a139743fdc154f152247e8a9d07f8fc2020f30b

SHA256
7c5faf56413d4ce590682fa8b8ff3e54a71012179442a70d504b556a1d3163d4

SHA512
6aa8c3b37f4b5b305901a5125e1bc8c71af1d43798bd58bbd59befe384b25b39e639378f87aaf281f439147970fe6ab7b3de2391f2eab3de6725c313e10e7c43

Download Submit
C:\Windows\system\dPMyMyc.exe

Filesize
1.8MB

MD5
28ccfc794101fc4068c185af888ac8ea

SHA1
5bf2894d974d8ff6fe7929a2bc53a7388cb59bf7

SHA256
46cf98162d9b0e285c98171f75acba206667e0db8b90090c4a81723543840d18

SHA512
7ea6d51024bc8be6e603b2f86e817208b24a5b73fd8eedf33fb59e04f98780140742dc5738d8acd43cc591053c2138d4a369ba256fc4279b3ab56e235639c5a0

Download Submit
C:\Windows\system\eGavGOE.exe

Filesize
1.8MB

MD5
40d40c73b81da5cdb136b823f182f12e

SHA1
35ad5ef619d8126d0ab94e981edf33593a9d71c5

SHA256
12114f1f6ab911d9989f260c51588ae217653efc60ae47849d41f42ff88a605f

SHA512
98a3916addc551cf42f43044ff08d9c53a6d7b57ce8a423db36e4a6f90466689216e795ee441ae6ffffdbe1e47b69ed09d31785f95e1fbfdc79f58664abffe40

Download Submit
C:\Windows\system\hNQijPv.exe

Filesize
1.8MB

MD5
c0f819ac00b4ce52a975634ecad4de70

SHA1
34f8250a19673d4e48996803c46e16cfa6287b5d

SHA256
164432965d84cf1c9cc1cca00330a4509305f802eee0811bdb69c2ca40b85ceb

SHA512
8c5e4006518a7c0e9fa38ab62c4bb8d94a63012b9a4e97d89a144c7b9b51c6be6c5ce71e741b775b40b07226701e36b65fd028d6cf121f25013df1d328c0a5e1

Download Submit
C:\Windows\system\iQOwJKQ.exe

Filesize
1.8MB

MD5
9eb446564e02c7497b92863ebd773aee

SHA1
08f60d3ad81a67690cae5a7e62cfaa87a031a7b0

SHA256
da197afacddcddc324ea63522f3667a4be897dcef56dab6f6f21c0cb96b366d5

SHA512
ea9ecc196084195224b9feabb0c3ff2ac3727fcd826afc2fd730f65fae77fba82f072748ad4cc89b47358ac030c0b062b9d3cb4eacfb2165e72505cb814db74a

Download Submit
C:\Windows\system\iYuZLwT.exe

Filesize
1.8MB

MD5
3b137739d16698a157d3ac975bc6559c

SHA1
d156a05b9c0ba7fadc25d2e1b7d7699f47b7c212

SHA256
1de4067da0ce3f05842617ceceb5e06482b8d6128f99ba3e4b06b858e3d3c2ba

SHA512
e6186475e4699065b7b64d721069665cc67d8e82b7ec0e531033896439d86c8dd027ab21187178cecabc836e311ca8e16f87cde39115a0ca6033aefc35ec0a81

Download Submit
C:\Windows\system\iooeTSd.exe

Filesize
1.8MB

MD5
369d640135ee604acff7b0217407f1a0

SHA1
e755869db845a816c1dd5378f5fb8add54ad9f0c

SHA256
594340dcd91778589e2b702716a57e8217f7667dac4f040d825d614b408631ee

SHA512
e73d77b74428cfae2900c88b33294808c6cc7869a2ab107c9bf0003837e315697fb11e3c49c345bf61a86d9984e720787ac4d3ae2fda6a5591fecb4e5213a0d3

Download Submit
C:\Windows\system\ldmLtXY.exe

Filesize
1.8MB

MD5
40af7a8a381db05543a44bb6675da75e

SHA1
344414ee1b3a7600d6645858c70c23f43479ad31

SHA256
98a76a06a0796c01428d329b66e960a2a45656bece06e47d2679940420d53030

SHA512
5652f29397a9526de583b6d961e68bfae8ae081a63aab942da049aac740dccb5e4a9362607578a96c88ec15e1acf39c6edf2823916fa30a19e8f83891790b1a8

Download Submit
C:\Windows\system\nASKxHw.exe

Filesize
1.8MB

MD5
f8a61f8a0ce28dbaf1528db51ca7d31e

SHA1
0197175b50128eff9b19eb426c8ecd7c7f90f6af

SHA256
001224f069250a4dfcbeb8a58797d1b0a39f550af2bfb4768bdb12be16353272

SHA512
d7e0101ddda31ac5de710339e83ed679e1308fd710d467cf2293c21976cd9afea9996e416cff7be095d768f51652083b27cb8eb5bb71fed5b57efaeb7cc89103

Download Submit
C:\Windows\system\sFnIWud.exe

Filesize
1.8MB

MD5
f71f2204d27f4cf81b7182eb597195e5

SHA1
665187f038f908b1e02a10c1a833515824e12912

SHA256
b769357a08d802554054d705d016de5c8fd849a716b642b93bc0bd93fabbb3a7

SHA512
5b2e9e621fd57e6708875caa5c8c37c6c3f308e8ee8f58d1ad6b4010ab1c5a75602059282c142518068b45394f92f38a33257bb74c309c0ed64980e573763f11

Download Submit
C:\Windows\system\uIepAlD.exe

Filesize
1.8MB

MD5
7114a1188b248a4913a6e3b5c75360da

SHA1
e760318889ccaf6175bae1d1472261fd252cfac1

SHA256
62b6be2c37b70399d42cc5d0f2e8f6b1554ba9271ad55e3a8ac6f5a7e2fa27e9

SHA512
5041d01c5d984ac03a6cf44f1d408ab016f41ccb638785e1b3f7c668a810092ac73433622de90b952e14c5f51bb51c13308f07456f6690177da69f2dcee4e640

Download Submit
C:\Windows\system\vkOMYLH.exe

Filesize
1.8MB

MD5
a6c4e004251207abe5c151f66f746504

SHA1
5f252775a676e4ee125dd15076e9631b8a324f3e

SHA256
12800b2761abb3b873f6115ac5a3608b50c749b29682e06d1009087d4f1f26a3

SHA512
c0ab79f244f853d275f01b600c759ad65b4c942fd11b477d76be51540c61f4baa5a9b886df2c9ff8f8a085ac0588fd90ac72a9cf24a1ee07a1cbbfd038096750

Download Submit
C:\Windows\system\wVWwSTu.exe

Filesize
1.8MB

MD5
c068f752e1f582a830f90b377ffbac28

SHA1
e830a88b016d67b4fe52f60adf3446ebec64f98d

SHA256
11243ec780a27b2745648ef05c31b258ed102207c05d367fe6c0e5701648ce57

SHA512
6a774a110d4e6659fe5552fd7f2d29791a22cd5e65e6ba02cf6e0b11c6f831cbea240224db0e41ea193fa4c897fd3ba66322a1924b068502574cbda3a87a5a5b

Download Submit
C:\Windows\system\yWOlcnb.exe

Filesize
1.8MB

MD5
ec94be3f6a2ca3506070eab2a2e9c3dc

SHA1
7ac3cda280a1d4af5f72c9c3fff0de62b197e4e8

SHA256
7f7826957c84ca4011f5f20b07ac2183fd134d6bd0fc110d6ca922c569c8e061

SHA512
5cc013d901bf5337432388d3f9c394a6c7fa58ac39b73b6f9ae33bdfb5f590f616e797576f3a9b8533608340e59036cbd6f602473341f8ad24b8b4d48931a5ba

Download Submit
\Windows\system\HqtvraN.exe

Filesize
1.8MB

MD5
e7df3e840dea7b7cc3ccd52ade32fe9e

SHA1
8e7fa87185263276a595aa951be1af6967dfc852

SHA256
47291396e794d725273dc978b9ebfa983454e93477f089f8a758e9e4367bba59

SHA512
14b0da5f65ded15b08d67975dde2db892befa2565b390b533b092134caa06d19d0e85cac9fb40badd9cce2963b0f6a8c676640eb4f11cfad6c1abb7fae78898b

Download Submit
\Windows\system\bnfGblz.exe

Filesize
1.8MB

MD5
20f7659c9ae1ca360acd4be82f076989

SHA1
3c5c5a66f28b4e03d0f4b12d06c622333541ad81

SHA256
d59fa1bf94f61f31e8945918011142227205196e55638e6832d472298838f56c

SHA512
d3efabfa1cedcfce52a349ebee7f20f3fc8a53ec6e3a3e281fd946a2f74755f526b5e14fc60c3eb8ad405e8f1b39590956aea7e23c4d1fb137d8c5df36c9c392

Download Submit
memory/1748-255-0x0000000001F40000-0x0000000002291000-memory.dmp

Filesize
3.3MB

Download
memory/1748-253-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/1748-241-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-3819-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1748-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1748-237-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-239-0x000000013F6D0000-0x000000013FA21000-memory.dmp

Filesize
3.3MB

Download
memory/1748-243-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/1748-262-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/1748-245-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/1748-261-0x000000013FD60000-0x00000001400B1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-247-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-259-0x0000000001F40000-0x0000000002291000-memory.dmp

Filesize
3.3MB

Download
memory/1748-249-0x0000000001F40000-0x0000000002291000-memory.dmp

Filesize
3.3MB

Download
memory/1748-257-0x0000000001F40000-0x0000000002291000-memory.dmp

Filesize
3.3MB

Download
memory/1748-251-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-0-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2240-4221-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-242-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/2328-4233-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2328-238-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/2344-236-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2344-4624-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2348-258-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2348-4196-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4622-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/2632-252-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/2712-4374-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2712-256-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2744-254-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/2744-4201-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/2756-4410-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/2756-244-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/2796-260-0x000000013F500000-0x000000013F851000-memory.dmp

Filesize
3.3MB

Download
memory/2796-4366-0x000000013F500000-0x000000013F851000-memory.dmp

Filesize
3.3MB

Download
memory/2808-4359-0x000000013F6D0000-0x000000013FA21000-memory.dmp

Filesize
3.3MB

Download
memory/2808-240-0x000000013F6D0000-0x000000013FA21000-memory.dmp

Filesize
3.3MB

Download
memory/2828-4224-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2828-246-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2880-4375-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2880-248-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-4220-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-250-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/3064-3982-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/3064-212-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download