xmrig | 4322307a70351ec25dbf7a9a80e510e8cc42528cb86bf9f0b35de50d07c812c7

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d457984afa7ac155f9d71aa3f41386a0N.exe
Size

1.2MB
MD5

d457984afa7ac155f9d71aa3f41386a0
SHA1

a0423ac2bc68b97086ef2d6f5236aaa8aab5e50f
SHA256

4322307a70351ec25dbf7a9a80e510e8cc42528cb86bf9f0b35de50d07c812c7
SHA512

47c6bb35c87c562939d2469f22cb5eefd9fcdacee9aba9d6f474c308665e7322c2d4b18fd188e350d179575c3c04f28f6b9ed9ab621cbb73e2eb248f9cc2d664
SSDEEP

24576:RVIl/WDGCi7/qkat6zqxG2Z9mIhQvq8wd7NjVb65GsL9QsPt+cmyBXKMT:ROdWCCi7/raWMmSdbbUGsVyyBX1

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/2284-14-0x000000013FE80000-0x00000001401D1000-memory.dmp	xmrig
behavioral1/memory/2704-180-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2284-276-0x000000013FE80000-0x00000001401D1000-memory.dmp	xmrig
behavioral1/memory/2576-525-0x000000013FD00000-0x0000000140051000-memory.dmp	xmrig
behavioral1/memory/2696-325-0x000000013F130000-0x000000013F481000-memory.dmp	xmrig
behavioral1/memory/1972-179-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/1892-92-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2916-90-0x000000013FF50000-0x00000001402A1000-memory.dmp	xmrig
behavioral1/memory/2928-61-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig
behavioral1/memory/2236-59-0x000000013FB10000-0x000000013FE61000-memory.dmp	xmrig
behavioral1/memory/2728-57-0x000000013FB40000-0x000000013FE91000-memory.dmp	xmrig
behavioral1/memory/1972-95-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/1952-94-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2096-69-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2840-67-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2772-51-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2284-1870-0x000000013FE80000-0x00000001401D1000-memory.dmp	xmrig
behavioral1/memory/2840-2128-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2096-2129-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2928-2130-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig
behavioral1/memory/2236-2131-0x000000013FB10000-0x000000013FE61000-memory.dmp	xmrig
behavioral1/memory/2728-2134-0x000000013FB40000-0x000000013FE91000-memory.dmp	xmrig
behavioral1/memory/2772-2133-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2704-2132-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2696-2171-0x000000013F130000-0x000000013F481000-memory.dmp	xmrig
behavioral1/memory/1952-2184-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2916-2187-0x000000013FF50000-0x00000001402A1000-memory.dmp	xmrig
behavioral1/memory/2576-2328-0x000000013FD00000-0x0000000140051000-memory.dmp	xmrig
behavioral1/memory/1892-2379-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2896-3342-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2704	BCWbsaL.exe
2284	fNLsibC.exe
2772	msRXVMD.exe
2896	VYPxvfM.exe
2728	rAlBmPo.exe
2236	MFIBAyn.exe
2928	qdQsWGt.exe
2840	iVggVKA.exe
2096	cAaEYqw.exe
2696	yTXBgzy.exe
2916	cxTuBWU.exe
1892	zpKIRyD.exe
1952	fSfYpJm.exe
2576	rKptjJm.exe
532	CmfoptV.exe
1960	RxqtySP.exe
2532	VlYeJuR.exe
2816	gQxNLIT.exe
3024	sakZwdK.exe
2852	sYTutRr.exe
2988	CeuZnGM.exe
1624	IXqIZwJ.exe
108	nPPZbIq.exe
1072	OVgSfCc.exe
1772	sRDqoxB.exe
1932	ITrdATD.exe
2552	BaTshYw.exe
2904	jQPtsMP.exe
2252	FHOpHXg.exe
2156	nCeHJuP.exe
1812	zZHJwlh.exe
1876	KajzXKd.exe
2036	WUCpqYA.exe
2516	lYfjVYW.exe
2168	FTzTnwy.exe
2196	oCFnKcZ.exe
1816	DUqrbIx.exe
336	YETLNsN.exe
1008	vntbJXx.exe
828	OxPuyuo.exe
1680	cVwUCkp.exe
792	PYpNPVB.exe
1744	hijQEwU.exe
1740	qAPQutw.exe
1956	WqDUOpz.exe
908	vflbTWF.exe
1720	RVbGcAZ.exe
1948	TVGnZUg.exe
1000	LvaDiJU.exe
1372	hFHqrHJ.exe
1172	MACwpSQ.exe
452	lDosEMD.exe
2276	WfCEois.exe
1032	GyqhxAl.exe
1572	kihfPAr.exe
1708	FPdZhpO.exe
2596	KanaVnc.exe
1360	ukwYzUl.exe
2216	ZmmvboC.exe
2784	QfxOVna.exe
2788	KfKXnDg.exe
2868	AElFJaQ.exe
2824	BtXakep.exe
2748	dLrnMuK.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe
1972	d457984afa7ac155f9d71aa3f41386a0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-0-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/files/0x0009000000012264-6.dat	upx
behavioral1/files/0x0008000000018f90-7.dat	upx
behavioral1/memory/2284-14-0x000000013FE80000-0x00000001401D1000-memory.dmp	upx
behavioral1/files/0x0007000000018f94-9.dat	upx
behavioral1/files/0x0007000000018f9a-21.dat	upx
behavioral1/files/0x0006000000018f9e-28.dat	upx
behavioral1/files/0x0029000000018f82-32.dat	upx
behavioral1/files/0x0006000000018fa0-38.dat	upx
behavioral1/files/0x0006000000018fa2-43.dat	upx
behavioral1/files/0x000500000001a2ac-107.dat	upx
behavioral1/files/0x000500000001a2ba-116.dat	upx
behavioral1/files/0x000500000001a2fc-154.dat	upx
behavioral1/files/0x000500000001a305-164.dat	upx
behavioral1/files/0x000500000001a320-176.dat	upx
behavioral1/memory/2704-180-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2284-276-0x000000013FE80000-0x00000001401D1000-memory.dmp	upx
behavioral1/memory/2576-525-0x000000013FD00000-0x0000000140051000-memory.dmp	upx
behavioral1/memory/2696-325-0x000000013F130000-0x000000013F481000-memory.dmp	upx
behavioral1/memory/2896-277-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/files/0x000500000001a32f-188.dat	upx
behavioral1/files/0x000500000001a324-183.dat	upx
behavioral1/memory/1972-179-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/files/0x000500000001a30b-170.dat	upx
behavioral1/files/0x000500000001a300-161.dat	upx
behavioral1/files/0x000500000001a2ef-147.dat	upx
behavioral1/files/0x000500000001a2f4-150.dat	upx
behavioral1/files/0x000500000001a2dd-136.dat	upx
behavioral1/files/0x000500000001a2eb-141.dat	upx
behavioral1/files/0x000500000001a2c7-126.dat	upx
behavioral1/files/0x000500000001a2ce-130.dat	upx
behavioral1/files/0x000500000001a2be-121.dat	upx
behavioral1/files/0x000500000001a2a1-105.dat	upx
behavioral1/files/0x000500000001a2b7-111.dat	upx
behavioral1/memory/1892-92-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2916-90-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx
behavioral1/files/0x0006000000019078-77.dat	upx
behavioral1/memory/2696-74-0x000000013F130000-0x000000013F481000-memory.dmp	upx
behavioral1/files/0x000500000001a298-73.dat	upx
behavioral1/memory/2928-61-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/memory/2236-59-0x000000013FB10000-0x000000013FE61000-memory.dmp	upx
behavioral1/memory/2728-57-0x000000013FB40000-0x000000013FE91000-memory.dmp	upx
behavioral1/memory/2896-53-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/memory/2576-100-0x000000013FD00000-0x0000000140051000-memory.dmp	upx
behavioral1/files/0x000500000001a2a3-98.dat	upx
behavioral1/memory/1952-94-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/files/0x000500000001a29f-81.dat	upx
behavioral1/memory/2096-69-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2840-67-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x000500000001a294-66.dat	upx
behavioral1/memory/2772-51-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/files/0x0008000000018fa6-48.dat	upx
behavioral1/memory/2704-12-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2284-1870-0x000000013FE80000-0x00000001401D1000-memory.dmp	upx
behavioral1/memory/2840-2128-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2096-2129-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2928-2130-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/memory/2236-2131-0x000000013FB10000-0x000000013FE61000-memory.dmp	upx
behavioral1/memory/2728-2134-0x000000013FB40000-0x000000013FE91000-memory.dmp	upx
behavioral1/memory/2772-2133-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/memory/2704-2132-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2696-2171-0x000000013F130000-0x000000013F481000-memory.dmp	upx
behavioral1/memory/1952-2184-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2916-2187-0x000000013FF50000-0x00000001402A1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qlHQoDS.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\RKotpuI.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\mQfYbUf.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\bhXbmoM.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\gBfCBob.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\iEGtHry.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\SyNkGRV.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\SmxgWWH.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\ZalIiYy.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\mjQgsXU.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\XZDYcjw.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\dKPYuYO.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\ZybPJHh.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\qBpXTTk.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\soeRiGL.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\LfvMepC.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\alsGikZ.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\VzUxKtR.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\hblCHIy.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\HbRvCnH.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\ZdcqfsR.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\vVSRqwi.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\WADZvRP.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\EMeTVXu.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\sFYganY.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\bNzZqTF.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\GTeuKNC.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\gZmCzNY.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\Vmmcgqs.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\vBacCIj.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\MIvuZQM.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\BSyozYm.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\SGWuasH.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\HqFNYJL.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\wvwvUoc.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\dPaowFF.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\WfAJpDR.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\eYqRPjd.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\LTIxxfl.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\rXZwLqi.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\sAkrDQt.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\YDVGVJY.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\gjFOfqC.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\hHIEquO.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\lUpQQDr.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\VohbFty.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\qsnPpSk.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\bBvyfCq.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\rbGRxSr.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\YVsoogh.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\BJTqKaK.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\NdweAwB.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\cWfkTyM.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\oCFnKcZ.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\ptbJIUy.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\YxCZBcy.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\cVPiBfG.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\MxDyOZF.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\GMzfZij.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\qVLmxrK.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\kbJFcPh.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\hphoCdl.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\hvzBKCK.exe	d457984afa7ac155f9d71aa3f41386a0N.exe
File created	C:\Windows\System\RVbGcAZ.exe	d457984afa7ac155f9d71aa3f41386a0N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2704	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	30
PID 1972 wrote to memory of 2704	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	30
PID 1972 wrote to memory of 2704	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	30
PID 1972 wrote to memory of 2284	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	31
PID 1972 wrote to memory of 2284	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	31
PID 1972 wrote to memory of 2284	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	31
PID 1972 wrote to memory of 2772	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	32
PID 1972 wrote to memory of 2772	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	32
PID 1972 wrote to memory of 2772	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	32
PID 1972 wrote to memory of 2896	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	33
PID 1972 wrote to memory of 2896	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	33
PID 1972 wrote to memory of 2896	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	33
PID 1972 wrote to memory of 2728	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	34
PID 1972 wrote to memory of 2728	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	34
PID 1972 wrote to memory of 2728	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	34
PID 1972 wrote to memory of 2236	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	35
PID 1972 wrote to memory of 2236	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	35
PID 1972 wrote to memory of 2236	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	35
PID 1972 wrote to memory of 2928	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	36
PID 1972 wrote to memory of 2928	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	36
PID 1972 wrote to memory of 2928	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	36
PID 1972 wrote to memory of 2840	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	37
PID 1972 wrote to memory of 2840	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	37
PID 1972 wrote to memory of 2840	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	37
PID 1972 wrote to memory of 2096	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	38
PID 1972 wrote to memory of 2096	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	38
PID 1972 wrote to memory of 2096	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	38
PID 1972 wrote to memory of 2916	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	39
PID 1972 wrote to memory of 2916	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	39
PID 1972 wrote to memory of 2916	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	39
PID 1972 wrote to memory of 2696	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	40
PID 1972 wrote to memory of 2696	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	40
PID 1972 wrote to memory of 2696	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	40
PID 1972 wrote to memory of 1952	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	41
PID 1972 wrote to memory of 1952	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	41
PID 1972 wrote to memory of 1952	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	41
PID 1972 wrote to memory of 1892	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	42
PID 1972 wrote to memory of 1892	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	42
PID 1972 wrote to memory of 1892	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	42
PID 1972 wrote to memory of 532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	43
PID 1972 wrote to memory of 532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	43
PID 1972 wrote to memory of 532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	43
PID 1972 wrote to memory of 2576	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	44
PID 1972 wrote to memory of 2576	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	44
PID 1972 wrote to memory of 2576	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	44
PID 1972 wrote to memory of 1960	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	45
PID 1972 wrote to memory of 1960	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	45
PID 1972 wrote to memory of 1960	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	45
PID 1972 wrote to memory of 2532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	46
PID 1972 wrote to memory of 2532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	46
PID 1972 wrote to memory of 2532	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	46
PID 1972 wrote to memory of 2816	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	47
PID 1972 wrote to memory of 2816	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	47
PID 1972 wrote to memory of 2816	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	47
PID 1972 wrote to memory of 3024	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	48
PID 1972 wrote to memory of 3024	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	48
PID 1972 wrote to memory of 3024	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	48
PID 1972 wrote to memory of 2852	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	49
PID 1972 wrote to memory of 2852	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	49
PID 1972 wrote to memory of 2852	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	49
PID 1972 wrote to memory of 2988	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	50
PID 1972 wrote to memory of 2988	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	50
PID 1972 wrote to memory of 2988	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	50
PID 1972 wrote to memory of 1624	1972	d457984afa7ac155f9d71aa3f41386a0N.exe	51

C:\Users\Admin\AppData\Local\Temp\d457984afa7ac155f9d71aa3f41386a0N.exe
"C:\Users\Admin\AppData\Local\Temp\d457984afa7ac155f9d71aa3f41386a0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System\BCWbsaL.exe
  C:\Windows\System\BCWbsaL.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\fNLsibC.exe
  C:\Windows\System\fNLsibC.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\msRXVMD.exe
  C:\Windows\System\msRXVMD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\VYPxvfM.exe
  C:\Windows\System\VYPxvfM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\rAlBmPo.exe
  C:\Windows\System\rAlBmPo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\MFIBAyn.exe
  C:\Windows\System\MFIBAyn.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\qdQsWGt.exe
  C:\Windows\System\qdQsWGt.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\iVggVKA.exe
  C:\Windows\System\iVggVKA.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\cAaEYqw.exe
  C:\Windows\System\cAaEYqw.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cxTuBWU.exe
  C:\Windows\System\cxTuBWU.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\yTXBgzy.exe
  C:\Windows\System\yTXBgzy.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\fSfYpJm.exe
  C:\Windows\System\fSfYpJm.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\zpKIRyD.exe
  C:\Windows\System\zpKIRyD.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\CmfoptV.exe
  C:\Windows\System\CmfoptV.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\rKptjJm.exe
  C:\Windows\System\rKptjJm.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\RxqtySP.exe
  C:\Windows\System\RxqtySP.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\VlYeJuR.exe
  C:\Windows\System\VlYeJuR.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\gQxNLIT.exe
  C:\Windows\System\gQxNLIT.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\sakZwdK.exe
  C:\Windows\System\sakZwdK.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\sYTutRr.exe
  C:\Windows\System\sYTutRr.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\CeuZnGM.exe
  C:\Windows\System\CeuZnGM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\IXqIZwJ.exe
  C:\Windows\System\IXqIZwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\nPPZbIq.exe
  C:\Windows\System\nPPZbIq.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\OVgSfCc.exe
  C:\Windows\System\OVgSfCc.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\sRDqoxB.exe
  C:\Windows\System\sRDqoxB.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ITrdATD.exe
  C:\Windows\System\ITrdATD.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\BaTshYw.exe
  C:\Windows\System\BaTshYw.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\jQPtsMP.exe
  C:\Windows\System\jQPtsMP.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\FHOpHXg.exe
  C:\Windows\System\FHOpHXg.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nCeHJuP.exe
  C:\Windows\System\nCeHJuP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\zZHJwlh.exe
  C:\Windows\System\zZHJwlh.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\KajzXKd.exe
  C:\Windows\System\KajzXKd.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\WUCpqYA.exe
  C:\Windows\System\WUCpqYA.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\lYfjVYW.exe
  C:\Windows\System\lYfjVYW.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\FTzTnwy.exe
  C:\Windows\System\FTzTnwy.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\oCFnKcZ.exe
  C:\Windows\System\oCFnKcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\DUqrbIx.exe
  C:\Windows\System\DUqrbIx.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\YETLNsN.exe
  C:\Windows\System\YETLNsN.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\vntbJXx.exe
  C:\Windows\System\vntbJXx.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\OxPuyuo.exe
  C:\Windows\System\OxPuyuo.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\cVwUCkp.exe
  C:\Windows\System\cVwUCkp.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\qAPQutw.exe
  C:\Windows\System\qAPQutw.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PYpNPVB.exe
  C:\Windows\System\PYpNPVB.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\WqDUOpz.exe
  C:\Windows\System\WqDUOpz.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\hijQEwU.exe
  C:\Windows\System\hijQEwU.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\vflbTWF.exe
  C:\Windows\System\vflbTWF.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\RVbGcAZ.exe
  C:\Windows\System\RVbGcAZ.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\TVGnZUg.exe
  C:\Windows\System\TVGnZUg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\LvaDiJU.exe
  C:\Windows\System\LvaDiJU.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\hFHqrHJ.exe
  C:\Windows\System\hFHqrHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\MACwpSQ.exe
  C:\Windows\System\MACwpSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\lDosEMD.exe
  C:\Windows\System\lDosEMD.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\WfCEois.exe
  C:\Windows\System\WfCEois.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\GyqhxAl.exe
  C:\Windows\System\GyqhxAl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\kihfPAr.exe
  C:\Windows\System\kihfPAr.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\FPdZhpO.exe
  C:\Windows\System\FPdZhpO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\KanaVnc.exe
  C:\Windows\System\KanaVnc.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\ZmmvboC.exe
  C:\Windows\System\ZmmvboC.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ukwYzUl.exe
  C:\Windows\System\ukwYzUl.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\QfxOVna.exe
  C:\Windows\System\QfxOVna.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\KfKXnDg.exe
  C:\Windows\System\KfKXnDg.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\AElFJaQ.exe
  C:\Windows\System\AElFJaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\BtXakep.exe
  C:\Windows\System\BtXakep.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\dLrnMuK.exe
  C:\Windows\System\dLrnMuK.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\TEWKrmy.exe
  C:\Windows\System\TEWKrmy.exe
  2⤵
  PID:1984
- C:\Windows\System\CIrrMXn.exe
  C:\Windows\System\CIrrMXn.exe
  2⤵
  PID:2272
- C:\Windows\System\gvyIKYq.exe
  C:\Windows\System\gvyIKYq.exe
  2⤵
  PID:996
- C:\Windows\System\uefIQxv.exe
  C:\Windows\System\uefIQxv.exe
  2⤵
  PID:740
- C:\Windows\System\ptbJIUy.exe
  C:\Windows\System\ptbJIUy.exe
  2⤵
  PID:2808
- C:\Windows\System\gQKQBLo.exe
  C:\Windows\System\gQKQBLo.exe
  2⤵
  PID:2828
- C:\Windows\System\qGmTmQV.exe
  C:\Windows\System\qGmTmQV.exe
  2⤵
  PID:3000
- C:\Windows\System\XQtyZbg.exe
  C:\Windows\System\XQtyZbg.exe
  2⤵
  PID:2660
- C:\Windows\System\sRnrofc.exe
  C:\Windows\System\sRnrofc.exe
  2⤵
  PID:1020
- C:\Windows\System\opNINob.exe
  C:\Windows\System\opNINob.exe
  2⤵
  PID:1268
- C:\Windows\System\HGHwyBA.exe
  C:\Windows\System\HGHwyBA.exe
  2⤵
  PID:2144
- C:\Windows\System\wrKGKIU.exe
  C:\Windows\System\wrKGKIU.exe
  2⤵
  PID:2744
- C:\Windows\System\igyVLcD.exe
  C:\Windows\System\igyVLcD.exe
  2⤵
  PID:2448
- C:\Windows\System\AvFJiSf.exe
  C:\Windows\System\AvFJiSf.exe
  2⤵
  PID:2208
- C:\Windows\System\UFnRuSa.exe
  C:\Windows\System\UFnRuSa.exe
  2⤵
  PID:1060
- C:\Windows\System\GWhoFun.exe
  C:\Windows\System\GWhoFun.exe
  2⤵
  PID:672
- C:\Windows\System\nvJooTS.exe
  C:\Windows\System\nvJooTS.exe
  2⤵
  PID:1692
- C:\Windows\System\PFfeNYS.exe
  C:\Windows\System\PFfeNYS.exe
  2⤵
  PID:1344
- C:\Windows\System\NRqSgQp.exe
  C:\Windows\System\NRqSgQp.exe
  2⤵
  PID:1604
- C:\Windows\System\bTfTJba.exe
  C:\Windows\System\bTfTJba.exe
  2⤵
  PID:948
- C:\Windows\System\bzRKxDL.exe
  C:\Windows\System\bzRKxDL.exe
  2⤵
  PID:592
- C:\Windows\System\MVhPWfY.exe
  C:\Windows\System\MVhPWfY.exe
  2⤵
  PID:524
- C:\Windows\System\YxAsQGF.exe
  C:\Windows\System\YxAsQGF.exe
  2⤵
  PID:2188
- C:\Windows\System\LRPWYDx.exe
  C:\Windows\System\LRPWYDx.exe
  2⤵
  PID:1904
- C:\Windows\System\eESNNVI.exe
  C:\Windows\System\eESNNVI.exe
  2⤵
  PID:1660
- C:\Windows\System\FBoKCrN.exe
  C:\Windows\System\FBoKCrN.exe
  2⤵
  PID:1116
- C:\Windows\System\bsbOSXJ.exe
  C:\Windows\System\bsbOSXJ.exe
  2⤵
  PID:1576
- C:\Windows\System\FtRbixf.exe
  C:\Windows\System\FtRbixf.exe
  2⤵
  PID:2100
- C:\Windows\System\lhIROhv.exe
  C:\Windows\System\lhIROhv.exe
  2⤵
  PID:1052
- C:\Windows\System\ifTVEeM.exe
  C:\Windows\System\ifTVEeM.exe
  2⤵
  PID:1264
- C:\Windows\System\TUWVMUr.exe
  C:\Windows\System\TUWVMUr.exe
  2⤵
  PID:2444
- C:\Windows\System\GMzfZij.exe
  C:\Windows\System\GMzfZij.exe
  2⤵
  PID:2900
- C:\Windows\System\SDuxkmc.exe
  C:\Windows\System\SDuxkmc.exe
  2⤵
  PID:2708
- C:\Windows\System\bexsmbm.exe
  C:\Windows\System\bexsmbm.exe
  2⤵
  PID:3032
- C:\Windows\System\DwOSZMv.exe
  C:\Windows\System\DwOSZMv.exe
  2⤵
  PID:2724
- C:\Windows\System\jZWTjkl.exe
  C:\Windows\System\jZWTjkl.exe
  2⤵
  PID:2400
- C:\Windows\System\VREncGg.exe
  C:\Windows\System\VREncGg.exe
  2⤵
  PID:2800
- C:\Windows\System\TXZEVfd.exe
  C:\Windows\System\TXZEVfd.exe
  2⤵
  PID:1616
- C:\Windows\System\vnmpWBJ.exe
  C:\Windows\System\vnmpWBJ.exe
  2⤵
  PID:3008
- C:\Windows\System\BJTqKaK.exe
  C:\Windows\System\BJTqKaK.exe
  2⤵
  PID:1516
- C:\Windows\System\lmHhbMG.exe
  C:\Windows\System\lmHhbMG.exe
  2⤵
  PID:2740
- C:\Windows\System\jIhWhoQ.exe
  C:\Windows\System\jIhWhoQ.exe
  2⤵
  PID:2376
- C:\Windows\System\lUpQQDr.exe
  C:\Windows\System\lUpQQDr.exe
  2⤵
  PID:804
- C:\Windows\System\EeNNsjB.exe
  C:\Windows\System\EeNNsjB.exe
  2⤵
  PID:112
- C:\Windows\System\brlAWFg.exe
  C:\Windows\System\brlAWFg.exe
  2⤵
  PID:2580
- C:\Windows\System\yTiwSkb.exe
  C:\Windows\System\yTiwSkb.exe
  2⤵
  PID:916
- C:\Windows\System\gdZkiHe.exe
  C:\Windows\System\gdZkiHe.exe
  2⤵
  PID:2384
- C:\Windows\System\VJdGqxd.exe
  C:\Windows\System\VJdGqxd.exe
  2⤵
  PID:2892
- C:\Windows\System\guXyFJz.exe
  C:\Windows\System\guXyFJz.exe
  2⤵
  PID:620
- C:\Windows\System\ncDWuvf.exe
  C:\Windows\System\ncDWuvf.exe
  2⤵
  PID:2240
- C:\Windows\System\zltraTO.exe
  C:\Windows\System\zltraTO.exe
  2⤵
  PID:3036
- C:\Windows\System\GroeYxn.exe
  C:\Windows\System\GroeYxn.exe
  2⤵
  PID:2332
- C:\Windows\System\wdBWAcN.exe
  C:\Windows\System\wdBWAcN.exe
  2⤵
  PID:1584
- C:\Windows\System\cJSZFem.exe
  C:\Windows\System\cJSZFem.exe
  2⤵
  PID:1224
- C:\Windows\System\VzUxKtR.exe
  C:\Windows\System\VzUxKtR.exe
  2⤵
  PID:2792
- C:\Windows\System\lJjUipO.exe
  C:\Windows\System\lJjUipO.exe
  2⤵
  PID:2932
- C:\Windows\System\AjthkGM.exe
  C:\Windows\System\AjthkGM.exe
  2⤵
  PID:656
- C:\Windows\System\QFCBcgl.exe
  C:\Windows\System\QFCBcgl.exe
  2⤵
  PID:2440
- C:\Windows\System\RPUKaAI.exe
  C:\Windows\System\RPUKaAI.exe
  2⤵
  PID:3028
- C:\Windows\System\uTOMURn.exe
  C:\Windows\System\uTOMURn.exe
  2⤵
  PID:2520
- C:\Windows\System\xGxtjlq.exe
  C:\Windows\System\xGxtjlq.exe
  2⤵
  PID:2524
- C:\Windows\System\TkcPFSV.exe
  C:\Windows\System\TkcPFSV.exe
  2⤵
  PID:2248
- C:\Windows\System\EBebPfJ.exe
  C:\Windows\System\EBebPfJ.exe
  2⤵
  PID:2600
- C:\Windows\System\DljnZfp.exe
  C:\Windows\System\DljnZfp.exe
  2⤵
  PID:1656
- C:\Windows\System\RNzAFWU.exe
  C:\Windows\System\RNzAFWU.exe
  2⤵
  PID:1900
- C:\Windows\System\jgnLdSe.exe
  C:\Windows\System\jgnLdSe.exe
  2⤵
  PID:820
- C:\Windows\System\huvdAGG.exe
  C:\Windows\System\huvdAGG.exe
  2⤵
  PID:2084
- C:\Windows\System\POJalUp.exe
  C:\Windows\System\POJalUp.exe
  2⤵
  PID:2476
- C:\Windows\System\JFUeTgy.exe
  C:\Windows\System\JFUeTgy.exe
  2⤵
  PID:3016
- C:\Windows\System\xppawJe.exe
  C:\Windows\System\xppawJe.exe
  2⤵
  PID:912
- C:\Windows\System\uGiQAqJ.exe
  C:\Windows\System\uGiQAqJ.exe
  2⤵
  PID:2820
- C:\Windows\System\OuvJheN.exe
  C:\Windows\System\OuvJheN.exe
  2⤵
  PID:2032
- C:\Windows\System\GBZkfQB.exe
  C:\Windows\System\GBZkfQB.exe
  2⤵
  PID:2668
- C:\Windows\System\bhXbmoM.exe
  C:\Windows\System\bhXbmoM.exe
  2⤵
  PID:2972
- C:\Windows\System\WZbElcb.exe
  C:\Windows\System\WZbElcb.exe
  2⤵
  PID:1120
- C:\Windows\System\ZaHDtye.exe
  C:\Windows\System\ZaHDtye.exe
  2⤵
  PID:1976
- C:\Windows\System\PwhoeEG.exe
  C:\Windows\System\PwhoeEG.exe
  2⤵
  PID:612
- C:\Windows\System\LexOCbZ.exe
  C:\Windows\System\LexOCbZ.exe
  2⤵
  PID:2392
- C:\Windows\System\VyGYfjG.exe
  C:\Windows\System\VyGYfjG.exe
  2⤵
  PID:1216
- C:\Windows\System\GfovYBm.exe
  C:\Windows\System\GfovYBm.exe
  2⤵
  PID:3056
- C:\Windows\System\qLfmjVD.exe
  C:\Windows\System\qLfmjVD.exe
  2⤵
  PID:1988
- C:\Windows\System\NudgcvE.exe
  C:\Windows\System\NudgcvE.exe
  2⤵
  PID:2496
- C:\Windows\System\sQHEaEJ.exe
  C:\Windows\System\sQHEaEJ.exe
  2⤵
  PID:1124
- C:\Windows\System\KkgeENw.exe
  C:\Windows\System\KkgeENw.exe
  2⤵
  PID:1348
- C:\Windows\System\CIbZtGV.exe
  C:\Windows\System\CIbZtGV.exe
  2⤵
  PID:2984
- C:\Windows\System\NlSoKXf.exe
  C:\Windows\System\NlSoKXf.exe
  2⤵
  PID:2620
- C:\Windows\System\yhqOUTQ.exe
  C:\Windows\System\yhqOUTQ.exe
  2⤵
  PID:2420
- C:\Windows\System\vqHjZSN.exe
  C:\Windows\System\vqHjZSN.exe
  2⤵
  PID:2328
- C:\Windows\System\hsvnOoz.exe
  C:\Windows\System\hsvnOoz.exe
  2⤵
  PID:2428
- C:\Windows\System\FklwuBi.exe
  C:\Windows\System\FklwuBi.exe
  2⤵
  PID:920
- C:\Windows\System\sDelXlM.exe
  C:\Windows\System\sDelXlM.exe
  2⤵
  PID:2104
- C:\Windows\System\zJolrns.exe
  C:\Windows\System\zJolrns.exe
  2⤵
  PID:2940
- C:\Windows\System\HHBFOCY.exe
  C:\Windows\System\HHBFOCY.exe
  2⤵
  PID:2296
- C:\Windows\System\CDtTNWV.exe
  C:\Windows\System\CDtTNWV.exe
  2⤵
  PID:1444
- C:\Windows\System\MlHwpjM.exe
  C:\Windows\System\MlHwpjM.exe
  2⤵
  PID:2360
- C:\Windows\System\OyXUEon.exe
  C:\Windows\System\OyXUEon.exe
  2⤵
  PID:2764
- C:\Windows\System\zNAZpAx.exe
  C:\Windows\System\zNAZpAx.exe
  2⤵
  PID:2652
- C:\Windows\System\QzybEUz.exe
  C:\Windows\System\QzybEUz.exe
  2⤵
  PID:928
- C:\Windows\System\eppSEpG.exe
  C:\Windows\System\eppSEpG.exe
  2⤵
  PID:2180
- C:\Windows\System\uORXule.exe
  C:\Windows\System\uORXule.exe
  2⤵
  PID:2648
- C:\Windows\System\fVYZNvt.exe
  C:\Windows\System\fVYZNvt.exe
  2⤵
  PID:432
- C:\Windows\System\qBpXTTk.exe
  C:\Windows\System\qBpXTTk.exe
  2⤵
  PID:2160
- C:\Windows\System\jKZGNod.exe
  C:\Windows\System\jKZGNod.exe
  2⤵
  PID:1668
- C:\Windows\System\ouGYykK.exe
  C:\Windows\System\ouGYykK.exe
  2⤵
  PID:1132
- C:\Windows\System\XxoCLJi.exe
  C:\Windows\System\XxoCLJi.exe
  2⤵
  PID:2324
- C:\Windows\System\bUmutVm.exe
  C:\Windows\System\bUmutVm.exe
  2⤵
  PID:3084
- C:\Windows\System\FPxkFAM.exe
  C:\Windows\System\FPxkFAM.exe
  2⤵
  PID:3108
- C:\Windows\System\dwpKYKq.exe
  C:\Windows\System\dwpKYKq.exe
  2⤵
  PID:3124
- C:\Windows\System\IpaRlot.exe
  C:\Windows\System\IpaRlot.exe
  2⤵
  PID:3140
- C:\Windows\System\RtJceNJ.exe
  C:\Windows\System\RtJceNJ.exe
  2⤵
  PID:3156
- C:\Windows\System\vPxpiCo.exe
  C:\Windows\System\vPxpiCo.exe
  2⤵
  PID:3172
- C:\Windows\System\WqwKzhc.exe
  C:\Windows\System\WqwKzhc.exe
  2⤵
  PID:3272
- C:\Windows\System\hgOVepl.exe
  C:\Windows\System\hgOVepl.exe
  2⤵
  PID:3288
- C:\Windows\System\FnSWBZT.exe
  C:\Windows\System\FnSWBZT.exe
  2⤵
  PID:3304
- C:\Windows\System\CfHrYPp.exe
  C:\Windows\System\CfHrYPp.exe
  2⤵
  PID:3320
- C:\Windows\System\QyWHelz.exe
  C:\Windows\System\QyWHelz.exe
  2⤵
  PID:3336
- C:\Windows\System\tiuZehb.exe
  C:\Windows\System\tiuZehb.exe
  2⤵
  PID:3360
- C:\Windows\System\EGkZJfH.exe
  C:\Windows\System\EGkZJfH.exe
  2⤵
  PID:3376
- C:\Windows\System\zCpjjeg.exe
  C:\Windows\System\zCpjjeg.exe
  2⤵
  PID:3392
- C:\Windows\System\MEgQMTZ.exe
  C:\Windows\System\MEgQMTZ.exe
  2⤵
  PID:3412
- C:\Windows\System\HjIrWKb.exe
  C:\Windows\System\HjIrWKb.exe
  2⤵
  PID:3428
- C:\Windows\System\NgzIqDy.exe
  C:\Windows\System\NgzIqDy.exe
  2⤵
  PID:3452
- C:\Windows\System\XRSutmv.exe
  C:\Windows\System\XRSutmv.exe
  2⤵
  PID:3476
- C:\Windows\System\pyIhmXT.exe
  C:\Windows\System\pyIhmXT.exe
  2⤵
  PID:3496
- C:\Windows\System\ziYhHlS.exe
  C:\Windows\System\ziYhHlS.exe
  2⤵
  PID:3512
- C:\Windows\System\rXZwLqi.exe
  C:\Windows\System\rXZwLqi.exe
  2⤵
  PID:3548
- C:\Windows\System\UHMsUIo.exe
  C:\Windows\System\UHMsUIo.exe
  2⤵
  PID:3568
- C:\Windows\System\DXKBPaO.exe
  C:\Windows\System\DXKBPaO.exe
  2⤵
  PID:3592
- C:\Windows\System\JTRAdyS.exe
  C:\Windows\System\JTRAdyS.exe
  2⤵
  PID:3608
- C:\Windows\System\jXvkImu.exe
  C:\Windows\System\jXvkImu.exe
  2⤵
  PID:3624
- C:\Windows\System\IBQkTvL.exe
  C:\Windows\System\IBQkTvL.exe
  2⤵
  PID:3644
- C:\Windows\System\pIhuUeL.exe
  C:\Windows\System\pIhuUeL.exe
  2⤵
  PID:3688
- C:\Windows\System\jaBUrpM.exe
  C:\Windows\System\jaBUrpM.exe
  2⤵
  PID:3704
- C:\Windows\System\boqnuKH.exe
  C:\Windows\System\boqnuKH.exe
  2⤵
  PID:3728
- C:\Windows\System\XYbdBFd.exe
  C:\Windows\System\XYbdBFd.exe
  2⤵
  PID:3744
- C:\Windows\System\ntkGmfz.exe
  C:\Windows\System\ntkGmfz.exe
  2⤵
  PID:3764
- C:\Windows\System\IQpkItJ.exe
  C:\Windows\System\IQpkItJ.exe
  2⤵
  PID:3784
- C:\Windows\System\odgPkne.exe
  C:\Windows\System\odgPkne.exe
  2⤵
  PID:3808
- C:\Windows\System\TdTlRao.exe
  C:\Windows\System\TdTlRao.exe
  2⤵
  PID:3824
- C:\Windows\System\EbCnWpX.exe
  C:\Windows\System\EbCnWpX.exe
  2⤵
  PID:3884
- C:\Windows\System\EUADJPG.exe
  C:\Windows\System\EUADJPG.exe
  2⤵
  PID:3900
- C:\Windows\System\LkqCUIv.exe
  C:\Windows\System\LkqCUIv.exe
  2⤵
  PID:3924
- C:\Windows\System\ihXSzsx.exe
  C:\Windows\System\ihXSzsx.exe
  2⤵
  PID:3940
- C:\Windows\System\skOMLxm.exe
  C:\Windows\System\skOMLxm.exe
  2⤵
  PID:3964
- C:\Windows\System\dVjSvEL.exe
  C:\Windows\System\dVjSvEL.exe
  2⤵
  PID:3980
- C:\Windows\System\WnCwsoT.exe
  C:\Windows\System\WnCwsoT.exe
  2⤵
  PID:4004
- C:\Windows\System\KsDWQrT.exe
  C:\Windows\System\KsDWQrT.exe
  2⤵
  PID:4024
- C:\Windows\System\WIvNGky.exe
  C:\Windows\System\WIvNGky.exe
  2⤵
  PID:4044
- C:\Windows\System\piUoMfY.exe
  C:\Windows\System\piUoMfY.exe
  2⤵
  PID:4064
- C:\Windows\System\vosVBSm.exe
  C:\Windows\System\vosVBSm.exe
  2⤵
  PID:4088
- C:\Windows\System\wLmYOIu.exe
  C:\Windows\System\wLmYOIu.exe
  2⤵
  PID:2636
- C:\Windows\System\prmWfAa.exe
  C:\Windows\System\prmWfAa.exe
  2⤵
  PID:1768
- C:\Windows\System\APBEUEa.exe
  C:\Windows\System\APBEUEa.exe
  2⤵
  PID:1552
- C:\Windows\System\IAdThIL.exe
  C:\Windows\System\IAdThIL.exe
  2⤵
  PID:2380
- C:\Windows\System\DVllRUh.exe
  C:\Windows\System\DVllRUh.exe
  2⤵
  PID:3132
- C:\Windows\System\jSRGitI.exe
  C:\Windows\System\jSRGitI.exe
  2⤵
  PID:3152
- C:\Windows\System\khOrPZq.exe
  C:\Windows\System\khOrPZq.exe
  2⤵
  PID:2344
- C:\Windows\System\PVkrcim.exe
  C:\Windows\System\PVkrcim.exe
  2⤵
  PID:1596
- C:\Windows\System\OLlCeyl.exe
  C:\Windows\System\OLlCeyl.exe
  2⤵
  PID:624
- C:\Windows\System\fcamkUU.exe
  C:\Windows\System\fcamkUU.exe
  2⤵
  PID:3188
- C:\Windows\System\tpvbcGF.exe
  C:\Windows\System\tpvbcGF.exe
  2⤵
  PID:3300
- C:\Windows\System\PYoWXXH.exe
  C:\Windows\System\PYoWXXH.exe
  2⤵
  PID:3224
- C:\Windows\System\ZWzHvYS.exe
  C:\Windows\System\ZWzHvYS.exe
  2⤵
  PID:3264
- C:\Windows\System\mlxZVFF.exe
  C:\Windows\System\mlxZVFF.exe
  2⤵
  PID:3384
- C:\Windows\System\zCNILmX.exe
  C:\Windows\System\zCNILmX.exe
  2⤵
  PID:3328
- C:\Windows\System\qVLmxrK.exe
  C:\Windows\System\qVLmxrK.exe
  2⤵
  PID:3468
- C:\Windows\System\FXlqTqk.exe
  C:\Windows\System\FXlqTqk.exe
  2⤵
  PID:3508
- C:\Windows\System\kfljjYE.exe
  C:\Windows\System\kfljjYE.exe
  2⤵
  PID:3372
- C:\Windows\System\hWrOayi.exe
  C:\Windows\System\hWrOayi.exe
  2⤵
  PID:3444
- C:\Windows\System\hYzaBlJ.exe
  C:\Windows\System\hYzaBlJ.exe
  2⤵
  PID:3576
- C:\Windows\System\kXtSLLV.exe
  C:\Windows\System\kXtSLLV.exe
  2⤵
  PID:3556
- C:\Windows\System\goKZvln.exe
  C:\Windows\System\goKZvln.exe
  2⤵
  PID:3632
- C:\Windows\System\fLzTddw.exe
  C:\Windows\System\fLzTddw.exe
  2⤵
  PID:3616
- C:\Windows\System\IqhLyOr.exe
  C:\Windows\System\IqhLyOr.exe
  2⤵
  PID:3676
- C:\Windows\System\THTsRtV.exe
  C:\Windows\System\THTsRtV.exe
  2⤵
  PID:3696
- C:\Windows\System\qgCopqB.exe
  C:\Windows\System\qgCopqB.exe
  2⤵
  PID:3736
- C:\Windows\System\PffMOVr.exe
  C:\Windows\System\PffMOVr.exe
  2⤵
  PID:3760
- C:\Windows\System\JmtQtBl.exe
  C:\Windows\System\JmtQtBl.exe
  2⤵
  PID:3800
- C:\Windows\System\jEuhGhW.exe
  C:\Windows\System\jEuhGhW.exe
  2⤵
  PID:3832
- C:\Windows\System\iaSHnmj.exe
  C:\Windows\System\iaSHnmj.exe
  2⤵
  PID:3856
- C:\Windows\System\hkAJADT.exe
  C:\Windows\System\hkAJADT.exe
  2⤵
  PID:3876
- C:\Windows\System\ICaPTxE.exe
  C:\Windows\System\ICaPTxE.exe
  2⤵
  PID:3916
- C:\Windows\System\VgAYqMS.exe
  C:\Windows\System\VgAYqMS.exe
  2⤵
  PID:3960
- C:\Windows\System\trRxOcs.exe
  C:\Windows\System\trRxOcs.exe
  2⤵
  PID:4036
- C:\Windows\System\rNlrKKF.exe
  C:\Windows\System\rNlrKKF.exe
  2⤵
  PID:4072
- C:\Windows\System\KvPfUcV.exe
  C:\Windows\System\KvPfUcV.exe
  2⤵
  PID:2624
- C:\Windows\System\ggVnFrQ.exe
  C:\Windows\System\ggVnFrQ.exe
  2⤵
  PID:2936
- C:\Windows\System\lyfSvJb.exe
  C:\Windows\System\lyfSvJb.exe
  2⤵
  PID:2860
- C:\Windows\System\vSHpAij.exe
  C:\Windows\System\vSHpAij.exe
  2⤵
  PID:1092
- C:\Windows\System\MgHswTe.exe
  C:\Windows\System\MgHswTe.exe
  2⤵
  PID:3148
- C:\Windows\System\sLfjUdX.exe
  C:\Windows\System\sLfjUdX.exe
  2⤵
  PID:2672
- C:\Windows\System\mJhDdHM.exe
  C:\Windows\System\mJhDdHM.exe
  2⤵
  PID:3040
- C:\Windows\System\lcuQQaM.exe
  C:\Windows\System\lcuQQaM.exe
  2⤵
  PID:3196
- C:\Windows\System\CiiqjYA.exe
  C:\Windows\System\CiiqjYA.exe
  2⤵
  PID:3228
- C:\Windows\System\BIwDihH.exe
  C:\Windows\System\BIwDihH.exe
  2⤵
  PID:3240
- C:\Windows\System\TYiaxNc.exe
  C:\Windows\System\TYiaxNc.exe
  2⤵
  PID:3312
- C:\Windows\System\ciBwjZX.exe
  C:\Windows\System\ciBwjZX.exe
  2⤵
  PID:3284
- C:\Windows\System\FBMLzMr.exe
  C:\Windows\System\FBMLzMr.exe
  2⤵
  PID:3472
- C:\Windows\System\MoOEkPU.exe
  C:\Windows\System\MoOEkPU.exe
  2⤵
  PID:3404
- C:\Windows\System\bQdrbKD.exe
  C:\Windows\System\bQdrbKD.exe
  2⤵
  PID:3540
- C:\Windows\System\HkfMAxg.exe
  C:\Windows\System\HkfMAxg.exe
  2⤵
  PID:3600
- C:\Windows\System\HZdAKPS.exe
  C:\Windows\System\HZdAKPS.exe
  2⤵
  PID:3668
- C:\Windows\System\ccjPxeH.exe
  C:\Windows\System\ccjPxeH.exe
  2⤵
  PID:3684
- C:\Windows\System\WemirMM.exe
  C:\Windows\System\WemirMM.exe
  2⤵
  PID:3752
- C:\Windows\System\TcygZbD.exe
  C:\Windows\System\TcygZbD.exe
  2⤵
  PID:3792
- C:\Windows\System\WLhhoWc.exe
  C:\Windows\System\WLhhoWc.exe
  2⤵
  PID:3848
- C:\Windows\System\dqNsFpT.exe
  C:\Windows\System\dqNsFpT.exe
  2⤵
  PID:3896
- C:\Windows\System\MRAyMwL.exe
  C:\Windows\System\MRAyMwL.exe
  2⤵
  PID:3948
- C:\Windows\System\BNBevSP.exe
  C:\Windows\System\BNBevSP.exe
  2⤵
  PID:3972
- C:\Windows\System\txTAgTr.exe
  C:\Windows\System\txTAgTr.exe
  2⤵
  PID:4040
- C:\Windows\System\inbCycn.exe
  C:\Windows\System\inbCycn.exe
  2⤵
  PID:4084
- C:\Windows\System\nRvuqnP.exe
  C:\Windows\System\nRvuqnP.exe
  2⤵
  PID:2976
- C:\Windows\System\OIpZxTE.exe
  C:\Windows\System\OIpZxTE.exe
  2⤵
  PID:3104
- C:\Windows\System\RwMdWOl.exe
  C:\Windows\System\RwMdWOl.exe
  2⤵
  PID:2980
- C:\Windows\System\Kwnwfqg.exe
  C:\Windows\System\Kwnwfqg.exe
  2⤵
  PID:1724
- C:\Windows\System\KwsCOww.exe
  C:\Windows\System\KwsCOww.exe
  2⤵
  PID:3216
- C:\Windows\System\cwVYuMp.exe
  C:\Windows\System\cwVYuMp.exe
  2⤵
  PID:3236
- C:\Windows\System\yLoUaqD.exe
  C:\Windows\System\yLoUaqD.exe
  2⤵
  PID:3316
- C:\Windows\System\FIjLvyr.exe
  C:\Windows\System\FIjLvyr.exe
  2⤵
  PID:3388
- C:\Windows\System\LqXloPL.exe
  C:\Windows\System\LqXloPL.exe
  2⤵
  PID:3524
- C:\Windows\System\PHeWARa.exe
  C:\Windows\System\PHeWARa.exe
  2⤵
  PID:3584
- C:\Windows\System\kVibXvy.exe
  C:\Windows\System\kVibXvy.exe
  2⤵
  PID:2540
- C:\Windows\System\VohbFty.exe
  C:\Windows\System\VohbFty.exe
  2⤵
  PID:3776
- C:\Windows\System\cypZVSj.exe
  C:\Windows\System\cypZVSj.exe
  2⤵
  PID:3868
- C:\Windows\System\ryEwGkt.exe
  C:\Windows\System\ryEwGkt.exe
  2⤵
  PID:3936
- C:\Windows\System\FOZfyJs.exe
  C:\Windows\System\FOZfyJs.exe
  2⤵
  PID:4012
- C:\Windows\System\mwxBKOs.exe
  C:\Windows\System\mwxBKOs.exe
  2⤵
  PID:816
- C:\Windows\System\bWHfuiZ.exe
  C:\Windows\System\bWHfuiZ.exe
  2⤵
  PID:468
- C:\Windows\System\ZvFsKXD.exe
  C:\Windows\System\ZvFsKXD.exe
  2⤵
  PID:2164
- C:\Windows\System\aTiQRih.exe
  C:\Windows\System\aTiQRih.exe
  2⤵
  PID:3184
- C:\Windows\System\KumJcRL.exe
  C:\Windows\System\KumJcRL.exe
  2⤵
  PID:3256
- C:\Windows\System\oMvnxaX.exe
  C:\Windows\System\oMvnxaX.exe
  2⤵
  PID:3436
- C:\Windows\System\kJsdfjB.exe
  C:\Windows\System\kJsdfjB.exe
  2⤵
  PID:3640
- C:\Windows\System\aockFqO.exe
  C:\Windows\System\aockFqO.exe
  2⤵
  PID:3852
- C:\Windows\System\SaQdeoV.exe
  C:\Windows\System\SaQdeoV.exe
  2⤵
  PID:3588
- C:\Windows\System\TGxYVcE.exe
  C:\Windows\System\TGxYVcE.exe
  2⤵
  PID:4032
- C:\Windows\System\dpTGxoU.exe
  C:\Windows\System\dpTGxoU.exe
  2⤵
  PID:3096
- C:\Windows\System\dwWWMoc.exe
  C:\Windows\System\dwWWMoc.exe
  2⤵
  PID:3208
- C:\Windows\System\gaCjDYd.exe
  C:\Windows\System\gaCjDYd.exe
  2⤵
  PID:3420
- C:\Windows\System\QFsybeI.exe
  C:\Windows\System\QFsybeI.exe
  2⤵
  PID:3660
- C:\Windows\System\BodFpSN.exe
  C:\Windows\System\BodFpSN.exe
  2⤵
  PID:3860
- C:\Windows\System\PGEntHZ.exe
  C:\Windows\System\PGEntHZ.exe
  2⤵
  PID:3996
- C:\Windows\System\bNIPdNw.exe
  C:\Windows\System\bNIPdNw.exe
  2⤵
  PID:4020
- C:\Windows\System\RpLuuia.exe
  C:\Windows\System\RpLuuia.exe
  2⤵
  PID:3664
- C:\Windows\System\nyNLfzw.exe
  C:\Windows\System\nyNLfzw.exe
  2⤵
  PID:3724
- C:\Windows\System\wsrtrzc.exe
  C:\Windows\System\wsrtrzc.exe
  2⤵
  PID:3464
- C:\Windows\System\IjsApiU.exe
  C:\Windows\System\IjsApiU.exe
  2⤵
  PID:4000
- C:\Windows\System\eylDhHK.exe
  C:\Windows\System\eylDhHK.exe
  2⤵
  PID:3400
- C:\Windows\System\PdsvVmE.exe
  C:\Windows\System\PdsvVmE.exe
  2⤵
  PID:3992
- C:\Windows\System\gfKoTrd.exe
  C:\Windows\System\gfKoTrd.exe
  2⤵
  PID:4112
- C:\Windows\System\nTzVaxz.exe
  C:\Windows\System\nTzVaxz.exe
  2⤵
  PID:4128
- C:\Windows\System\xxJBivW.exe
  C:\Windows\System\xxJBivW.exe
  2⤵
  PID:4152
- C:\Windows\System\mKxzaue.exe
  C:\Windows\System\mKxzaue.exe
  2⤵
  PID:4168
- C:\Windows\System\CMPwEPu.exe
  C:\Windows\System\CMPwEPu.exe
  2⤵
  PID:4184
- C:\Windows\System\hFTKODd.exe
  C:\Windows\System\hFTKODd.exe
  2⤵
  PID:4200
- C:\Windows\System\ArAjQbo.exe
  C:\Windows\System\ArAjQbo.exe
  2⤵
  PID:4216
- C:\Windows\System\xfvbRPy.exe
  C:\Windows\System\xfvbRPy.exe
  2⤵
  PID:4232
- C:\Windows\System\XmpJWtQ.exe
  C:\Windows\System\XmpJWtQ.exe
  2⤵
  PID:4248
- C:\Windows\System\KYIgyyf.exe
  C:\Windows\System\KYIgyyf.exe
  2⤵
  PID:4264
- C:\Windows\System\aippSou.exe
  C:\Windows\System\aippSou.exe
  2⤵
  PID:4280
- C:\Windows\System\MnRsgLk.exe
  C:\Windows\System\MnRsgLk.exe
  2⤵
  PID:4300
- C:\Windows\System\zkgjKWL.exe
  C:\Windows\System\zkgjKWL.exe
  2⤵
  PID:4316
- C:\Windows\System\TuKjayC.exe
  C:\Windows\System\TuKjayC.exe
  2⤵
  PID:4368
- C:\Windows\System\yPVRZXJ.exe
  C:\Windows\System\yPVRZXJ.exe
  2⤵
  PID:4384
- C:\Windows\System\SqKbyvz.exe
  C:\Windows\System\SqKbyvz.exe
  2⤵
  PID:4404
- C:\Windows\System\iyFeZKo.exe
  C:\Windows\System\iyFeZKo.exe
  2⤵
  PID:4420
- C:\Windows\System\PQuqWYT.exe
  C:\Windows\System\PQuqWYT.exe
  2⤵
  PID:4436
- C:\Windows\System\qbggdXU.exe
  C:\Windows\System\qbggdXU.exe
  2⤵
  PID:4460
- C:\Windows\System\owVOuJj.exe
  C:\Windows\System\owVOuJj.exe
  2⤵
  PID:4480
- C:\Windows\System\XJhjcjx.exe
  C:\Windows\System\XJhjcjx.exe
  2⤵
  PID:4496
- C:\Windows\System\cGpEiiS.exe
  C:\Windows\System\cGpEiiS.exe
  2⤵
  PID:4512
- C:\Windows\System\EPZcUJz.exe
  C:\Windows\System\EPZcUJz.exe
  2⤵
  PID:4532
- C:\Windows\System\yMIBZIi.exe
  C:\Windows\System\yMIBZIi.exe
  2⤵
  PID:4548
- C:\Windows\System\LqoCRgB.exe
  C:\Windows\System\LqoCRgB.exe
  2⤵
  PID:4568
- C:\Windows\System\ZTngFvY.exe
  C:\Windows\System\ZTngFvY.exe
  2⤵
  PID:4588
- C:\Windows\System\ghKnZxU.exe
  C:\Windows\System\ghKnZxU.exe
  2⤵
  PID:4604
- C:\Windows\System\VeWvScO.exe
  C:\Windows\System\VeWvScO.exe
  2⤵
  PID:4620
- C:\Windows\System\obxFCur.exe
  C:\Windows\System\obxFCur.exe
  2⤵
  PID:4636
- C:\Windows\System\CiCIfHq.exe
  C:\Windows\System\CiCIfHq.exe
  2⤵
  PID:4652
- C:\Windows\System\RpLSBll.exe
  C:\Windows\System\RpLSBll.exe
  2⤵
  PID:4668
- C:\Windows\System\Ivzcywf.exe
  C:\Windows\System\Ivzcywf.exe
  2⤵
  PID:4684
- C:\Windows\System\SesRXPY.exe
  C:\Windows\System\SesRXPY.exe
  2⤵
  PID:4700
- C:\Windows\System\CbZpWZK.exe
  C:\Windows\System\CbZpWZK.exe
  2⤵
  PID:4720
- C:\Windows\System\zMQMwFz.exe
  C:\Windows\System\zMQMwFz.exe
  2⤵
  PID:4736
- C:\Windows\System\txOfKkk.exe
  C:\Windows\System\txOfKkk.exe
  2⤵
  PID:4752
- C:\Windows\System\SbQWIje.exe
  C:\Windows\System\SbQWIje.exe
  2⤵
  PID:4768
- C:\Windows\System\IXKPzti.exe
  C:\Windows\System\IXKPzti.exe
  2⤵
  PID:4784
- C:\Windows\System\roDtGKk.exe
  C:\Windows\System\roDtGKk.exe
  2⤵
  PID:4800
- C:\Windows\System\CujVfOg.exe
  C:\Windows\System\CujVfOg.exe
  2⤵
  PID:4816
- C:\Windows\System\pLtVadC.exe
  C:\Windows\System\pLtVadC.exe
  2⤵
  PID:4832
- C:\Windows\System\pRHlDxw.exe
  C:\Windows\System\pRHlDxw.exe
  2⤵
  PID:4848
- C:\Windows\System\tFTXpvE.exe
  C:\Windows\System\tFTXpvE.exe
  2⤵
  PID:4864
- C:\Windows\System\eEtVZON.exe
  C:\Windows\System\eEtVZON.exe
  2⤵
  PID:4880
- C:\Windows\System\YXvJHqj.exe
  C:\Windows\System\YXvJHqj.exe
  2⤵
  PID:4896
- C:\Windows\System\lHSHXTl.exe
  C:\Windows\System\lHSHXTl.exe
  2⤵
  PID:4912
- C:\Windows\System\eBawDaL.exe
  C:\Windows\System\eBawDaL.exe
  2⤵
  PID:4932
- C:\Windows\System\IPmYyIY.exe
  C:\Windows\System\IPmYyIY.exe
  2⤵
  PID:5012
- C:\Windows\System\ytYKHeA.exe
  C:\Windows\System\ytYKHeA.exe
  2⤵
  PID:5076
- C:\Windows\System\OSvANPW.exe
  C:\Windows\System\OSvANPW.exe
  2⤵
  PID:5112
- C:\Windows\System\zWuOhvE.exe
  C:\Windows\System\zWuOhvE.exe
  2⤵
  PID:3200
- C:\Windows\System\unTjqua.exe
  C:\Windows\System\unTjqua.exe
  2⤵
  PID:4124
- C:\Windows\System\KdSMEhY.exe
  C:\Windows\System\KdSMEhY.exe
  2⤵
  PID:4160
- C:\Windows\System\pqXZHoR.exe
  C:\Windows\System\pqXZHoR.exe
  2⤵
  PID:4224
- C:\Windows\System\xyVVnIs.exe
  C:\Windows\System\xyVVnIs.exe
  2⤵
  PID:4324
- C:\Windows\System\oUWBCyW.exe
  C:\Windows\System\oUWBCyW.exe
  2⤵
  PID:4208
- C:\Windows\System\BarPSvu.exe
  C:\Windows\System\BarPSvu.exe
  2⤵
  PID:4272
- C:\Windows\System\dbhHMPk.exe
  C:\Windows\System\dbhHMPk.exe
  2⤵
  PID:4296
- C:\Windows\System\pWOlNjB.exe
  C:\Windows\System\pWOlNjB.exe
  2⤵
  PID:4340
- C:\Windows\System\soeRiGL.exe
  C:\Windows\System\soeRiGL.exe
  2⤵
  PID:4260
- C:\Windows\System\uTBNqYU.exe
  C:\Windows\System\uTBNqYU.exe
  2⤵
  PID:4396
- C:\Windows\System\wRRDKjh.exe
  C:\Windows\System\wRRDKjh.exe
  2⤵
  PID:4376
- C:\Windows\System\IBRLBjd.exe
  C:\Windows\System\IBRLBjd.exe
  2⤵
  PID:4428
- C:\Windows\System\cLNiene.exe
  C:\Windows\System\cLNiene.exe
  2⤵
  PID:4448
- C:\Windows\System\WKJCaID.exe
  C:\Windows\System\WKJCaID.exe
  2⤵
  PID:4508
- C:\Windows\System\ZFhsDWo.exe
  C:\Windows\System\ZFhsDWo.exe
  2⤵
  PID:4520
- C:\Windows\System\ySYUUFt.exe
  C:\Windows\System\ySYUUFt.exe
  2⤵
  PID:4576
- C:\Windows\System\jCLGMcW.exe
  C:\Windows\System\jCLGMcW.exe
  2⤵
  PID:4596
- C:\Windows\System\MRdmWAG.exe
  C:\Windows\System\MRdmWAG.exe
  2⤵
  PID:4632
- C:\Windows\System\GdakXcr.exe
  C:\Windows\System\GdakXcr.exe
  2⤵
  PID:4648
- C:\Windows\System\IuOLvsN.exe
  C:\Windows\System\IuOLvsN.exe
  2⤵
  PID:4712
- C:\Windows\System\SQPWJHT.exe
  C:\Windows\System\SQPWJHT.exe
  2⤵
  PID:4728
- C:\Windows\System\fuLqrUy.exe
  C:\Windows\System\fuLqrUy.exe
  2⤵
  PID:4708
- C:\Windows\System\tMvqTQS.exe
  C:\Windows\System\tMvqTQS.exe
  2⤵
  PID:4824
- C:\Windows\System\ejJExzS.exe
  C:\Windows\System\ejJExzS.exe
  2⤵
  PID:4744
- C:\Windows\System\fMBaVTG.exe
  C:\Windows\System\fMBaVTG.exe
  2⤵
  PID:4840
- C:\Windows\System\rJyBIQr.exe
  C:\Windows\System\rJyBIQr.exe
  2⤵
  PID:4904
- C:\Windows\System\NuhVTJw.exe
  C:\Windows\System\NuhVTJw.exe
  2⤵
  PID:4892
- C:\Windows\System\ImJFgbh.exe
  C:\Windows\System\ImJFgbh.exe
  2⤵
  PID:4944
- C:\Windows\System\mLHwvUi.exe
  C:\Windows\System\mLHwvUi.exe
  2⤵
  PID:5000
- C:\Windows\System\XalhRrj.exe
  C:\Windows\System\XalhRrj.exe
  2⤵
  PID:5036
- C:\Windows\System\sAkrDQt.exe
  C:\Windows\System\sAkrDQt.exe
  2⤵
  PID:5048
- C:\Windows\System\mvHFTuM.exe
  C:\Windows\System\mvHFTuM.exe
  2⤵
  PID:5064
- C:\Windows\System\wEyBHST.exe
  C:\Windows\System\wEyBHST.exe
  2⤵
  PID:5096
- C:\Windows\System\kRDEmli.exe
  C:\Windows\System\kRDEmli.exe
  2⤵
  PID:5108
- C:\Windows\System\rIXMmIw.exe
  C:\Windows\System\rIXMmIw.exe
  2⤵
  PID:4100
- C:\Windows\System\uALEuYn.exe
  C:\Windows\System\uALEuYn.exe
  2⤵
  PID:4144
- C:\Windows\System\fwJXavN.exe
  C:\Windows\System\fwJXavN.exe
  2⤵
  PID:4256
- C:\Windows\System\UkMQGfN.exe
  C:\Windows\System\UkMQGfN.exe
  2⤵
  PID:4308
- C:\Windows\System\uGDKJMP.exe
  C:\Windows\System\uGDKJMP.exe
  2⤵
  PID:4332
- C:\Windows\System\SThvWwN.exe
  C:\Windows\System\SThvWwN.exe
  2⤵
  PID:4392
- C:\Windows\System\bgfqDsi.exe
  C:\Windows\System\bgfqDsi.exe
  2⤵
  PID:4352
- C:\Windows\System\UMwHkuY.exe
  C:\Windows\System\UMwHkuY.exe
  2⤵
  PID:4584
- C:\Windows\System\eXOXldv.exe
  C:\Windows\System\eXOXldv.exe
  2⤵
  PID:4476
- C:\Windows\System\PqBgNJq.exe
  C:\Windows\System\PqBgNJq.exe
  2⤵
  PID:4544
- C:\Windows\System\hYKSZxw.exe
  C:\Windows\System\hYKSZxw.exe
  2⤵
  PID:4600
- C:\Windows\System\kanIZdD.exe
  C:\Windows\System\kanIZdD.exe
  2⤵
  PID:4796
- C:\Windows\System\ZSDtiLo.exe
  C:\Windows\System\ZSDtiLo.exe
  2⤵
  PID:4792
- C:\Windows\System\ckVvsHm.exe
  C:\Windows\System\ckVvsHm.exe
  2⤵
  PID:4860
- C:\Windows\System\OnawIxj.exe
  C:\Windows\System\OnawIxj.exe
  2⤵
  PID:4928
- C:\Windows\System\UwRYPMB.exe
  C:\Windows\System\UwRYPMB.exe
  2⤵
  PID:4972
- C:\Windows\System\sBdLDQK.exe
  C:\Windows\System\sBdLDQK.exe
  2⤵
  PID:5020
- C:\Windows\System\hblCHIy.exe
  C:\Windows\System\hblCHIy.exe
  2⤵
  PID:4472
- C:\Windows\System\WADZvRP.exe
  C:\Windows\System\WADZvRP.exe
  2⤵
  PID:2192
- C:\Windows\System\lRpgfqG.exe
  C:\Windows\System\lRpgfqG.exe
  2⤵
  PID:4412
- C:\Windows\System\kbJFcPh.exe
  C:\Windows\System\kbJFcPh.exe
  2⤵
  PID:4616
- C:\Windows\System\zLUrPAy.exe
  C:\Windows\System\zLUrPAy.exe
  2⤵
  PID:4696
- C:\Windows\System\aFIfZfQ.exe
  C:\Windows\System\aFIfZfQ.exe
  2⤵
  PID:4996
- C:\Windows\System\xmVRYOU.exe
  C:\Windows\System\xmVRYOU.exe
  2⤵
  PID:4104
- C:\Windows\System\cuThdWL.exe
  C:\Windows\System\cuThdWL.exe
  2⤵
  PID:4196
- C:\Windows\System\bubiOJp.exe
  C:\Windows\System\bubiOJp.exe
  2⤵
  PID:4776
- C:\Windows\System\AmhBhZb.exe
  C:\Windows\System\AmhBhZb.exe
  2⤵
  PID:5028
- C:\Windows\System\Qlomogl.exe
  C:\Windows\System\Qlomogl.exe
  2⤵
  PID:560
- C:\Windows\System\dOOpAQJ.exe
  C:\Windows\System\dOOpAQJ.exe
  2⤵
  PID:5044
- C:\Windows\System\bVUDPyQ.exe
  C:\Windows\System\bVUDPyQ.exe
  2⤵
  PID:5056
- C:\Windows\System\aaHlwtq.exe
  C:\Windows\System\aaHlwtq.exe
  2⤵
  PID:4888
- C:\Windows\System\zcWUsjF.exe
  C:\Windows\System\zcWUsjF.exe
  2⤵
  PID:4760
- C:\Windows\System\TFlrqDh.exe
  C:\Windows\System\TFlrqDh.exe
  2⤵
  PID:5104
- C:\Windows\System\UgGqjQa.exe
  C:\Windows\System\UgGqjQa.exe
  2⤵
  PID:5132
- C:\Windows\System\oBDVOWD.exe
  C:\Windows\System\oBDVOWD.exe
  2⤵
  PID:5148
- C:\Windows\System\lydNglY.exe
  C:\Windows\System\lydNglY.exe
  2⤵
  PID:5164
- C:\Windows\System\qlHQoDS.exe
  C:\Windows\System\qlHQoDS.exe
  2⤵
  PID:5180
- C:\Windows\System\ZVPmicA.exe
  C:\Windows\System\ZVPmicA.exe
  2⤵
  PID:5196
- C:\Windows\System\fWaFeOI.exe
  C:\Windows\System\fWaFeOI.exe
  2⤵
  PID:5212
- C:\Windows\System\TRFVQWQ.exe
  C:\Windows\System\TRFVQWQ.exe
  2⤵
  PID:5228
- C:\Windows\System\AgBOBxq.exe
  C:\Windows\System\AgBOBxq.exe
  2⤵
  PID:5244
- C:\Windows\System\icJjBmR.exe
  C:\Windows\System\icJjBmR.exe
  2⤵
  PID:5260
- C:\Windows\System\NvzsmTP.exe
  C:\Windows\System\NvzsmTP.exe
  2⤵
  PID:5276
- C:\Windows\System\yGQduwr.exe
  C:\Windows\System\yGQduwr.exe
  2⤵
  PID:5292
- C:\Windows\System\ekKYZUG.exe
  C:\Windows\System\ekKYZUG.exe
  2⤵
  PID:5308
- C:\Windows\System\jNwhgzs.exe
  C:\Windows\System\jNwhgzs.exe
  2⤵
  PID:5324
- C:\Windows\System\rvcSDwo.exe
  C:\Windows\System\rvcSDwo.exe
  2⤵
  PID:5340
- C:\Windows\System\GUEwjUh.exe
  C:\Windows\System\GUEwjUh.exe
  2⤵
  PID:5356
- C:\Windows\System\kvRhfSh.exe
  C:\Windows\System\kvRhfSh.exe
  2⤵
  PID:5376
- C:\Windows\System\LwMJXbk.exe
  C:\Windows\System\LwMJXbk.exe
  2⤵
  PID:5404
- C:\Windows\System\cTwPgsI.exe
  C:\Windows\System\cTwPgsI.exe
  2⤵
  PID:5420
- C:\Windows\System\KCVLrNt.exe
  C:\Windows\System\KCVLrNt.exe
  2⤵
  PID:5436
- C:\Windows\System\ObfJENy.exe
  C:\Windows\System\ObfJENy.exe
  2⤵
  PID:5452
- C:\Windows\System\ahPReab.exe
  C:\Windows\System\ahPReab.exe
  2⤵
  PID:5468
- C:\Windows\System\IFgFLBC.exe
  C:\Windows\System\IFgFLBC.exe
  2⤵
  PID:5484
- C:\Windows\System\XNhzsin.exe
  C:\Windows\System\XNhzsin.exe
  2⤵
  PID:5500
- C:\Windows\System\BckaOoO.exe
  C:\Windows\System\BckaOoO.exe
  2⤵
  PID:5516
- C:\Windows\System\cmVGzQu.exe
  C:\Windows\System\cmVGzQu.exe
  2⤵
  PID:5532
- C:\Windows\System\bKRlnlt.exe
  C:\Windows\System\bKRlnlt.exe
  2⤵
  PID:5548
- C:\Windows\System\afpehlQ.exe
  C:\Windows\System\afpehlQ.exe
  2⤵
  PID:5564
- C:\Windows\System\YMXoVfx.exe
  C:\Windows\System\YMXoVfx.exe
  2⤵
  PID:5580
- C:\Windows\System\TUgiTGH.exe
  C:\Windows\System\TUgiTGH.exe
  2⤵
  PID:5596
- C:\Windows\System\LwsNtVy.exe
  C:\Windows\System\LwsNtVy.exe
  2⤵
  PID:5612
- C:\Windows\System\OHTMKrC.exe
  C:\Windows\System\OHTMKrC.exe
  2⤵
  PID:5628
- C:\Windows\System\YXyCsRt.exe
  C:\Windows\System\YXyCsRt.exe
  2⤵
  PID:5644
- C:\Windows\System\vOflUtO.exe
  C:\Windows\System\vOflUtO.exe
  2⤵
  PID:5660
- C:\Windows\System\BbkQdRk.exe
  C:\Windows\System\BbkQdRk.exe
  2⤵
  PID:5676
- C:\Windows\System\becoIBv.exe
  C:\Windows\System\becoIBv.exe
  2⤵
  PID:5692
- C:\Windows\System\ryaVpgM.exe
  C:\Windows\System\ryaVpgM.exe
  2⤵
  PID:5708
- C:\Windows\System\JvfWWbl.exe
  C:\Windows\System\JvfWWbl.exe
  2⤵
  PID:5724
- C:\Windows\System\ACDiWFA.exe
  C:\Windows\System\ACDiWFA.exe
  2⤵
  PID:5740
- C:\Windows\System\wXZIWuq.exe
  C:\Windows\System\wXZIWuq.exe
  2⤵
  PID:5756
- C:\Windows\System\WiRBCjE.exe
  C:\Windows\System\WiRBCjE.exe
  2⤵
  PID:5772
- C:\Windows\System\EMeTVXu.exe
  C:\Windows\System\EMeTVXu.exe
  2⤵
  PID:5788
- C:\Windows\System\LfvMepC.exe
  C:\Windows\System\LfvMepC.exe
  2⤵
  PID:5804
- C:\Windows\System\epxbHlb.exe
  C:\Windows\System\epxbHlb.exe
  2⤵
  PID:5820
- C:\Windows\System\Lhoaajf.exe
  C:\Windows\System\Lhoaajf.exe
  2⤵
  PID:5840
- C:\Windows\System\SelcBJg.exe
  C:\Windows\System\SelcBJg.exe
  2⤵
  PID:5860
- C:\Windows\System\KFRyfJc.exe
  C:\Windows\System\KFRyfJc.exe
  2⤵
  PID:5876
- C:\Windows\System\narViRg.exe
  C:\Windows\System\narViRg.exe
  2⤵
  PID:5892
- C:\Windows\System\sQmxSAp.exe
  C:\Windows\System\sQmxSAp.exe
  2⤵
  PID:5908
- C:\Windows\System\hdnYupi.exe
  C:\Windows\System\hdnYupi.exe
  2⤵
  PID:5924
- C:\Windows\System\eVRkswJ.exe
  C:\Windows\System\eVRkswJ.exe
  2⤵
  PID:5940
- C:\Windows\System\fLlMEmk.exe
  C:\Windows\System\fLlMEmk.exe
  2⤵
  PID:5964
- C:\Windows\System\dRBbljQ.exe
  C:\Windows\System\dRBbljQ.exe
  2⤵
  PID:5980
- C:\Windows\System\VWXGgRY.exe
  C:\Windows\System\VWXGgRY.exe
  2⤵
  PID:5996
- C:\Windows\System\RmXWNid.exe
  C:\Windows\System\RmXWNid.exe
  2⤵
  PID:6012
- C:\Windows\System\Eypcguu.exe
  C:\Windows\System\Eypcguu.exe
  2⤵
  PID:6032
- C:\Windows\System\EbVSFZB.exe
  C:\Windows\System\EbVSFZB.exe
  2⤵
  PID:6048
- C:\Windows\System\yQBdatd.exe
  C:\Windows\System\yQBdatd.exe
  2⤵
  PID:6064
- C:\Windows\System\lIXZaLp.exe
  C:\Windows\System\lIXZaLp.exe
  2⤵
  PID:6080
- C:\Windows\System\NyUHvkC.exe
  C:\Windows\System\NyUHvkC.exe
  2⤵
  PID:6096
- C:\Windows\System\WCUThcl.exe
  C:\Windows\System\WCUThcl.exe
  2⤵
  PID:6112
- C:\Windows\System\MZMTJhH.exe
  C:\Windows\System\MZMTJhH.exe
  2⤵
  PID:6140
- C:\Windows\System\cMGzOnH.exe
  C:\Windows\System\cMGzOnH.exe
  2⤵
  PID:5144
- C:\Windows\System\hphoCdl.exe
  C:\Windows\System\hphoCdl.exe
  2⤵
  PID:5172
- C:\Windows\System\CmdrMLM.exe
  C:\Windows\System\CmdrMLM.exe
  2⤵
  PID:5240
- C:\Windows\System\WdrvXqZ.exe
  C:\Windows\System\WdrvXqZ.exe
  2⤵
  PID:4192
- C:\Windows\System\UxifJbv.exe
  C:\Windows\System\UxifJbv.exe
  2⤵
  PID:5272
- C:\Windows\System\LRSnqWI.exe
  C:\Windows\System\LRSnqWI.exe
  2⤵
  PID:4328
- C:\Windows\System\VzQuRqx.exe
  C:\Windows\System\VzQuRqx.exe
  2⤵
  PID:5188
- C:\Windows\System\iKNrxVm.exe
  C:\Windows\System\iKNrxVm.exe
  2⤵
  PID:5224
- C:\Windows\System\WoCpzJi.exe
  C:\Windows\System\WoCpzJi.exe
  2⤵
  PID:5372
- C:\Windows\System\KZzQFNH.exe
  C:\Windows\System\KZzQFNH.exe
  2⤵
  PID:5316
- C:\Windows\System\xemrXvr.exe
  C:\Windows\System\xemrXvr.exe
  2⤵
  PID:5352
- C:\Windows\System\agUtykM.exe
  C:\Windows\System\agUtykM.exe
  2⤵
  PID:5392
- C:\Windows\System\TFjyJjQ.exe
  C:\Windows\System\TFjyJjQ.exe
  2⤵
  PID:5412
- C:\Windows\System\gZmCzNY.exe
  C:\Windows\System\gZmCzNY.exe
  2⤵
  PID:5480
- C:\Windows\System\hYEJgFm.exe
  C:\Windows\System\hYEJgFm.exe
  2⤵
  PID:5560
- C:\Windows\System\JGrSLmu.exe
  C:\Windows\System\JGrSLmu.exe
  2⤵
  PID:5636
- C:\Windows\System\uHBXavg.exe
  C:\Windows\System\uHBXavg.exe
  2⤵
  PID:5576
- C:\Windows\System\GWRcfhc.exe
  C:\Windows\System\GWRcfhc.exe
  2⤵
  PID:5704
- C:\Windows\System\fjjVhrK.exe
  C:\Windows\System\fjjVhrK.exe
  2⤵
  PID:5464
- C:\Windows\System\dPaowFF.exe
  C:\Windows\System\dPaowFF.exe
  2⤵
  PID:5528
- C:\Windows\System\mFfvVME.exe
  C:\Windows\System\mFfvVME.exe
  2⤵
  PID:5736
- C:\Windows\System\fCOKlcB.exe
  C:\Windows\System\fCOKlcB.exe
  2⤵
  PID:5800
- C:\Windows\System\KPJqesA.exe
  C:\Windows\System\KPJqesA.exe
  2⤵
  PID:5656
- C:\Windows\System\HaDeGRX.exe
  C:\Windows\System\HaDeGRX.exe
  2⤵
  PID:5720
- C:\Windows\System\MSPxuNw.exe
  C:\Windows\System\MSPxuNw.exe
  2⤵
  PID:5784
- C:\Windows\System\YKuEYwC.exe
  C:\Windows\System\YKuEYwC.exe
  2⤵
  PID:5848
- C:\Windows\System\pkmjsnQ.exe
  C:\Windows\System\pkmjsnQ.exe
  2⤵
  PID:5936
- C:\Windows\System\qloUDAk.exe
  C:\Windows\System\qloUDAk.exe
  2⤵
  PID:5852
- C:\Windows\System\MqOpNzD.exe
  C:\Windows\System\MqOpNzD.exe
  2⤵
  PID:5884
- C:\Windows\System\djgnuCj.exe
  C:\Windows\System\djgnuCj.exe
  2⤵
  PID:5400
- C:\Windows\System\LoZzQbq.exe
  C:\Windows\System\LoZzQbq.exe
  2⤵
  PID:6020
- C:\Windows\System\IEHdSdn.exe
  C:\Windows\System\IEHdSdn.exe
  2⤵
  PID:6060
- C:\Windows\System\cBxHgFS.exe
  C:\Windows\System\cBxHgFS.exe
  2⤵
  PID:6044
- C:\Windows\System\RHostdS.exe
  C:\Windows\System\RHostdS.exe
  2⤵
  PID:6104
- C:\Windows\System\ZxXwZrz.exe
  C:\Windows\System\ZxXwZrz.exe
  2⤵
  PID:6120
- C:\Windows\System\mDwcPAK.exe
  C:\Windows\System\mDwcPAK.exe
  2⤵
  PID:6132
- C:\Windows\System\EgkEfsS.exe
  C:\Windows\System\EgkEfsS.exe
  2⤵
  PID:5204
- C:\Windows\System\VckRXkq.exe
  C:\Windows\System\VckRXkq.exe
  2⤵
  PID:5304
- C:\Windows\System\KWMGGpm.exe
  C:\Windows\System\KWMGGpm.exe
  2⤵
  PID:5268
- C:\Windows\System\ANeVtnN.exe
  C:\Windows\System\ANeVtnN.exe
  2⤵
  PID:5348
- C:\Windows\System\Ewvnplr.exe
  C:\Windows\System\Ewvnplr.exe
  2⤵
  PID:5364
- C:\Windows\System\NYDNtCL.exe
  C:\Windows\System\NYDNtCL.exe
  2⤵
  PID:5388
- C:\Windows\System\YDVGVJY.exe
  C:\Windows\System\YDVGVJY.exe
  2⤵
  PID:5320
- C:\Windows\System\bVLbSHz.exe
  C:\Windows\System\bVLbSHz.exe
  2⤵
  PID:5508
- C:\Windows\System\mUSxuyr.exe
  C:\Windows\System\mUSxuyr.exe
  2⤵
  PID:5700
- C:\Windows\System\BZHIGkZ.exe
  C:\Windows\System\BZHIGkZ.exe
  2⤵
  PID:5432
- C:\Windows\System\bsVPXBr.exe
  C:\Windows\System\bsVPXBr.exe
  2⤵
  PID:5688
- C:\Windows\System\dqKEqoW.exe
  C:\Windows\System\dqKEqoW.exe
  2⤵
  PID:5900
- C:\Windows\System\MsAuXOT.exe
  C:\Windows\System\MsAuXOT.exe
  2⤵
  PID:5780
- C:\Windows\System\HDHZaib.exe
  C:\Windows\System\HDHZaib.exe
  2⤵
  PID:5952
- C:\Windows\System\hlkrEMk.exe
  C:\Windows\System\hlkrEMk.exe
  2⤵
  PID:5972
- C:\Windows\System\YYAAVQM.exe
  C:\Windows\System\YYAAVQM.exe
  2⤵
  PID:5992
- C:\Windows\System\CngORSk.exe
  C:\Windows\System\CngORSk.exe
  2⤵
  PID:6092
- C:\Windows\System\fhRxKIA.exe
  C:\Windows\System\fhRxKIA.exe
  2⤵
  PID:5836
- C:\Windows\System\ETiqDpd.exe
  C:\Windows\System\ETiqDpd.exe
  2⤵
  PID:4528
- C:\Windows\System\BwowAmO.exe
  C:\Windows\System\BwowAmO.exe
  2⤵
  PID:5444
- C:\Windows\System\avODOLn.exe
  C:\Windows\System\avODOLn.exe
  2⤵
  PID:5572
- C:\Windows\System\HlLujWa.exe
  C:\Windows\System\HlLujWa.exe
  2⤵
  PID:5524
- C:\Windows\System\orKNUoH.exe
  C:\Windows\System\orKNUoH.exe
  2⤵
  PID:6128
- C:\Windows\System\ERixCsr.exe
  C:\Windows\System\ERixCsr.exe
  2⤵
  PID:5856
- C:\Windows\System\LUChiMX.exe
  C:\Windows\System\LUChiMX.exe
  2⤵
  PID:5624
- C:\Windows\System\hvzBKCK.exe
  C:\Windows\System\hvzBKCK.exe
  2⤵
  PID:6028
- C:\Windows\System\yvKPuFP.exe
  C:\Windows\System\yvKPuFP.exe
  2⤵
  PID:4492
- C:\Windows\System\SwVSdpC.exe
  C:\Windows\System\SwVSdpC.exe
  2⤵
  PID:5796
- C:\Windows\System\cDNvNji.exe
  C:\Windows\System\cDNvNji.exe
  2⤵
  PID:5332
- C:\Windows\System\YodDqjg.exe
  C:\Windows\System\YodDqjg.exe
  2⤵
  PID:5904
- C:\Windows\System\NZHqQHo.exe
  C:\Windows\System\NZHqQHo.exe
  2⤵
  PID:5988
- C:\Windows\System\KLriMey.exe
  C:\Windows\System\KLriMey.exe
  2⤵
  PID:5976
- C:\Windows\System\hHvBuMX.exe
  C:\Windows\System\hHvBuMX.exe
  2⤵
  PID:6164
- C:\Windows\System\oakDZAa.exe
  C:\Windows\System\oakDZAa.exe
  2⤵
  PID:6180
- C:\Windows\System\DhgRKea.exe
  C:\Windows\System\DhgRKea.exe
  2⤵
  PID:6200
- C:\Windows\System\zhdzfLX.exe
  C:\Windows\System\zhdzfLX.exe
  2⤵
  PID:6216
- C:\Windows\System\CqKjIKW.exe
  C:\Windows\System\CqKjIKW.exe
  2⤵
  PID:6232
- C:\Windows\System\FHSGsrO.exe
  C:\Windows\System\FHSGsrO.exe
  2⤵
  PID:6248
- C:\Windows\System\emtAQFn.exe
  C:\Windows\System\emtAQFn.exe
  2⤵
  PID:6264
- C:\Windows\System\ZPffTvU.exe
  C:\Windows\System\ZPffTvU.exe
  2⤵
  PID:6280
- C:\Windows\System\aRIWacF.exe
  C:\Windows\System\aRIWacF.exe
  2⤵
  PID:6296
- C:\Windows\System\ZZcrcZf.exe
  C:\Windows\System\ZZcrcZf.exe
  2⤵
  PID:6312
- C:\Windows\System\GPwsrQv.exe
  C:\Windows\System\GPwsrQv.exe
  2⤵
  PID:6328
- C:\Windows\System\YlKuZco.exe
  C:\Windows\System\YlKuZco.exe
  2⤵
  PID:6344
- C:\Windows\System\jQuNKXV.exe
  C:\Windows\System\jQuNKXV.exe
  2⤵
  PID:6360
- C:\Windows\System\ShYQVeK.exe
  C:\Windows\System\ShYQVeK.exe
  2⤵
  PID:6376
- C:\Windows\System\LGWUGFf.exe
  C:\Windows\System\LGWUGFf.exe
  2⤵
  PID:6392
- C:\Windows\System\RGfIJZL.exe
  C:\Windows\System\RGfIJZL.exe
  2⤵
  PID:6408
- C:\Windows\System\hAzHRpg.exe
  C:\Windows\System\hAzHRpg.exe
  2⤵
  PID:6424
- C:\Windows\System\LmsCPFM.exe
  C:\Windows\System\LmsCPFM.exe
  2⤵
  PID:6440
- C:\Windows\System\VbUHpVf.exe
  C:\Windows\System\VbUHpVf.exe
  2⤵
  PID:6456
- C:\Windows\System\hoMZRge.exe
  C:\Windows\System\hoMZRge.exe
  2⤵
  PID:6472
- C:\Windows\System\GIRiKQH.exe
  C:\Windows\System\GIRiKQH.exe
  2⤵
  PID:6488
- C:\Windows\System\VeMgpiw.exe
  C:\Windows\System\VeMgpiw.exe
  2⤵
  PID:6508
- C:\Windows\System\KndCwCx.exe
  C:\Windows\System\KndCwCx.exe
  2⤵
  PID:6524
- C:\Windows\System\EZnnktR.exe
  C:\Windows\System\EZnnktR.exe
  2⤵
  PID:6540
- C:\Windows\System\uVPFiQo.exe
  C:\Windows\System\uVPFiQo.exe
  2⤵
  PID:6556
- C:\Windows\System\OkXijGL.exe
  C:\Windows\System\OkXijGL.exe
  2⤵
  PID:6572
- C:\Windows\System\stqrPCh.exe
  C:\Windows\System\stqrPCh.exe
  2⤵
  PID:6588
- C:\Windows\System\eZfMvRR.exe
  C:\Windows\System\eZfMvRR.exe
  2⤵
  PID:6608
- C:\Windows\System\UxudPME.exe
  C:\Windows\System\UxudPME.exe
  2⤵
  PID:6624
- C:\Windows\System\otXKPrh.exe
  C:\Windows\System\otXKPrh.exe
  2⤵
  PID:6640
- C:\Windows\System\mFpVJBz.exe
  C:\Windows\System\mFpVJBz.exe
  2⤵
  PID:6656
- C:\Windows\System\MtUTuZk.exe
  C:\Windows\System\MtUTuZk.exe
  2⤵
  PID:6672
- C:\Windows\System\vfFnrng.exe
  C:\Windows\System\vfFnrng.exe
  2⤵
  PID:6692
- C:\Windows\System\JiPrqGK.exe
  C:\Windows\System\JiPrqGK.exe
  2⤵
  PID:6708
- C:\Windows\System\vuDbYRi.exe
  C:\Windows\System\vuDbYRi.exe
  2⤵
  PID:6728
- C:\Windows\System\sZzWPGR.exe
  C:\Windows\System\sZzWPGR.exe
  2⤵
  PID:6744
- C:\Windows\System\CSaNwTj.exe
  C:\Windows\System\CSaNwTj.exe
  2⤵
  PID:6760
- C:\Windows\System\GPrZwuL.exe
  C:\Windows\System\GPrZwuL.exe
  2⤵
  PID:6776
- C:\Windows\System\NqKOofw.exe
  C:\Windows\System\NqKOofw.exe
  2⤵
  PID:6792
- C:\Windows\System\VHAhQWK.exe
  C:\Windows\System\VHAhQWK.exe
  2⤵
  PID:6808
- C:\Windows\System\JkqhBaX.exe
  C:\Windows\System\JkqhBaX.exe
  2⤵
  PID:6824
- C:\Windows\System\QJhyyAh.exe
  C:\Windows\System\QJhyyAh.exe
  2⤵
  PID:6848
- C:\Windows\System\uEBGMdy.exe
  C:\Windows\System\uEBGMdy.exe
  2⤵
  PID:6864
- C:\Windows\System\EgsoZao.exe
  C:\Windows\System\EgsoZao.exe
  2⤵
  PID:6880
- C:\Windows\System\cKvvItj.exe
  C:\Windows\System\cKvvItj.exe
  2⤵
  PID:6896
- C:\Windows\System\PVUdqft.exe
  C:\Windows\System\PVUdqft.exe
  2⤵
  PID:6912
- C:\Windows\System\zBQYkkH.exe
  C:\Windows\System\zBQYkkH.exe
  2⤵
  PID:6928
- C:\Windows\System\dHxNsgP.exe
  C:\Windows\System\dHxNsgP.exe
  2⤵
  PID:6944
- C:\Windows\System\czSngll.exe
  C:\Windows\System\czSngll.exe
  2⤵
  PID:6960
- C:\Windows\System\SjoUYoR.exe
  C:\Windows\System\SjoUYoR.exe
  2⤵
  PID:6976
- C:\Windows\System\yVWuSpL.exe
  C:\Windows\System\yVWuSpL.exe
  2⤵
  PID:6992
- C:\Windows\System\MEqJyfQ.exe
  C:\Windows\System\MEqJyfQ.exe
  2⤵
  PID:7008
- C:\Windows\System\lksJwjX.exe
  C:\Windows\System\lksJwjX.exe
  2⤵
  PID:7024
- C:\Windows\System\miygIbD.exe
  C:\Windows\System\miygIbD.exe
  2⤵
  PID:7040
- C:\Windows\System\JgjcaLb.exe
  C:\Windows\System\JgjcaLb.exe
  2⤵
  PID:7056
- C:\Windows\System\tPKXXZC.exe
  C:\Windows\System\tPKXXZC.exe
  2⤵
  PID:7072
- C:\Windows\System\Vmmcgqs.exe
  C:\Windows\System\Vmmcgqs.exe
  2⤵
  PID:7088
- C:\Windows\System\rEJduST.exe
  C:\Windows\System\rEJduST.exe
  2⤵
  PID:7104
- C:\Windows\System\pDvvDRj.exe
  C:\Windows\System\pDvvDRj.exe
  2⤵
  PID:7120
- C:\Windows\System\ItYUrJd.exe
  C:\Windows\System\ItYUrJd.exe
  2⤵
  PID:7136
- C:\Windows\System\olXEhJX.exe
  C:\Windows\System\olXEhJX.exe
  2⤵
  PID:7152
- C:\Windows\System\IRjlNhr.exe
  C:\Windows\System\IRjlNhr.exe
  2⤵
  PID:6056
- C:\Windows\System\FKGNnPy.exe
  C:\Windows\System\FKGNnPy.exe
  2⤵
  PID:5816
- C:\Windows\System\eZXqqoM.exe
  C:\Windows\System\eZXqqoM.exe
  2⤵
  PID:6156
- C:\Windows\System\yreumRj.exe
  C:\Windows\System\yreumRj.exe
  2⤵
  PID:6192
- C:\Windows\System\gehvxFi.exe
  C:\Windows\System\gehvxFi.exe
  2⤵
  PID:6256
- C:\Windows\System\YfQpcNV.exe
  C:\Windows\System\YfQpcNV.exe
  2⤵
  PID:6212
- C:\Windows\System\BuruUQV.exe
  C:\Windows\System\BuruUQV.exe
  2⤵
  PID:6276
- C:\Windows\System\aNtCatH.exe
  C:\Windows\System\aNtCatH.exe
  2⤵
  PID:6356
- C:\Windows\System\dsPIJZE.exe
  C:\Windows\System\dsPIJZE.exe
  2⤵
  PID:6480
- C:\Windows\System\AApDgnb.exe
  C:\Windows\System\AApDgnb.exe
  2⤵
  PID:6340
- C:\Windows\System\qjmPRYd.exe
  C:\Windows\System\qjmPRYd.exe
  2⤵
  PID:6484
- C:\Windows\System\BgbeGli.exe
  C:\Windows\System\BgbeGli.exe
  2⤵
  PID:6548
- C:\Windows\System\ptWWuKb.exe
  C:\Windows\System\ptWWuKb.exe
  2⤵
  PID:6552
- C:\Windows\System\LytPzCm.exe
  C:\Windows\System\LytPzCm.exe
  2⤵
  PID:5620
- C:\Windows\System\ULcBBPq.exe
  C:\Windows\System\ULcBBPq.exe
  2⤵
  PID:6680
- C:\Windows\System\rEHUHOo.exe
  C:\Windows\System\rEHUHOo.exe
  2⤵
  PID:6536
- C:\Windows\System\KrYDezc.exe
  C:\Windows\System\KrYDezc.exe
  2⤵
  PID:6604
- C:\Windows\System\HiTGhPo.exe
  C:\Windows\System\HiTGhPo.exe
  2⤵
  PID:6668
- C:\Windows\System\scwVHnr.exe
  C:\Windows\System\scwVHnr.exe
  2⤵
  PID:6720
- C:\Windows\System\xNhdLCI.exe
  C:\Windows\System\xNhdLCI.exe
  2⤵
  PID:6756
- C:\Windows\System\NmtHaMH.exe
  C:\Windows\System\NmtHaMH.exe
  2⤵
  PID:6788
- C:\Windows\System\rouBIoQ.exe
  C:\Windows\System\rouBIoQ.exe
  2⤵
  PID:6820
- C:\Windows\System\PNPwyEa.exe
  C:\Windows\System\PNPwyEa.exe
  2⤵
  PID:6860
- C:\Windows\System\LtLUmww.exe
  C:\Windows\System\LtLUmww.exe
  2⤵
  PID:6844
- C:\Windows\System\XQhLCEv.exe
  C:\Windows\System\XQhLCEv.exe
  2⤵
  PID:6952
- C:\Windows\System\DPuEzpy.exe
  C:\Windows\System\DPuEzpy.exe
  2⤵
  PID:6968
- C:\Windows\System\wYhDVFX.exe
  C:\Windows\System\wYhDVFX.exe
  2⤵
  PID:7016
- C:\Windows\System\wurTyiW.exe
  C:\Windows\System\wurTyiW.exe
  2⤵
  PID:7080
- C:\Windows\System\RBOySrp.exe
  C:\Windows\System\RBOySrp.exe
  2⤵
  PID:6160
- C:\Windows\System\RRsDnGJ.exe
  C:\Windows\System\RRsDnGJ.exe
  2⤵
  PID:5540
- C:\Windows\System\sVJKXkg.exe
  C:\Windows\System\sVJKXkg.exe
  2⤵
  PID:6320
- C:\Windows\System\PqaVblH.exe
  C:\Windows\System\PqaVblH.exe
  2⤵
  PID:6416
- C:\Windows\System\QRQgMNs.exe
  C:\Windows\System\QRQgMNs.exe
  2⤵
  PID:6448
- C:\Windows\System\AfZBDXM.exe
  C:\Windows\System\AfZBDXM.exe
  2⤵
  PID:6336
- C:\Windows\System\ojrsuwL.exe
  C:\Windows\System\ojrsuwL.exe
  2⤵
  PID:6432
- C:\Windows\System\HMtqiOh.exe
  C:\Windows\System\HMtqiOh.exe
  2⤵
  PID:6620
- C:\Windows\System\AIuqOux.exe
  C:\Windows\System\AIuqOux.exe
  2⤵
  PID:6468
- C:\Windows\System\PaxeiKH.exe
  C:\Windows\System\PaxeiKH.exe
  2⤵
  PID:6596
- C:\Windows\System\cQxWThQ.exe
  C:\Windows\System\cQxWThQ.exe
  2⤵
  PID:6752
- C:\Windows\System\ehdZIHe.exe
  C:\Windows\System\ehdZIHe.exe
  2⤵
  PID:6784
- C:\Windows\System\MQpkpTD.exe
  C:\Windows\System\MQpkpTD.exe
  2⤵
  PID:6580
- C:\Windows\System\MnppElY.exe
  C:\Windows\System\MnppElY.exe
  2⤵
  PID:7144
- C:\Windows\System\KgkzuOa.exe
  C:\Windows\System\KgkzuOa.exe
  2⤵
  PID:6272
- C:\Windows\System\sFYganY.exe
  C:\Windows\System\sFYganY.exe
  2⤵
  PID:6652
- C:\Windows\System\ZpjxCjG.exe
  C:\Windows\System\ZpjxCjG.exe
  2⤵
  PID:6496
- C:\Windows\System\gTODCDp.exe
  C:\Windows\System\gTODCDp.exe
  2⤵
  PID:6892
- C:\Windows\System\IYRyypZ.exe
  C:\Windows\System\IYRyypZ.exe
  2⤵
  PID:6936
- C:\Windows\System\rlJRUvR.exe
  C:\Windows\System\rlJRUvR.exe
  2⤵
  PID:7048
- C:\Windows\System\oyXnwwj.exe
  C:\Windows\System\oyXnwwj.exe
  2⤵
  PID:6840
- C:\Windows\System\BSyozYm.exe
  C:\Windows\System\BSyozYm.exe
  2⤵
  PID:6804
- C:\Windows\System\iiieEjE.exe
  C:\Windows\System\iiieEjE.exe
  2⤵
  PID:7084
- C:\Windows\System\CqknSkn.exe
  C:\Windows\System\CqknSkn.exe
  2⤵
  PID:6568
- C:\Windows\System\cCWHIDn.exe
  C:\Windows\System\cCWHIDn.exe
  2⤵
  PID:6940
- C:\Windows\System\DTGbKHL.exe
  C:\Windows\System\DTGbKHL.exe
  2⤵
  PID:7176
- C:\Windows\System\VlNZiZJ.exe
  C:\Windows\System\VlNZiZJ.exe
  2⤵
  PID:7192
- C:\Windows\System\EmKDWQB.exe
  C:\Windows\System\EmKDWQB.exe
  2⤵
  PID:7208
- C:\Windows\System\mEDUHjH.exe
  C:\Windows\System\mEDUHjH.exe
  2⤵
  PID:7224
- C:\Windows\System\HQfyfjE.exe
  C:\Windows\System\HQfyfjE.exe
  2⤵
  PID:7240
- C:\Windows\System\cZzmpkr.exe
  C:\Windows\System\cZzmpkr.exe
  2⤵
  PID:7256
- C:\Windows\System\AuViVcF.exe
  C:\Windows\System\AuViVcF.exe
  2⤵
  PID:7272
- C:\Windows\System\ktcNSYl.exe
  C:\Windows\System\ktcNSYl.exe
  2⤵
  PID:7288
- C:\Windows\System\jbQsqXM.exe
  C:\Windows\System\jbQsqXM.exe
  2⤵
  PID:7304
- C:\Windows\System\jUJCVIT.exe
  C:\Windows\System\jUJCVIT.exe
  2⤵
  PID:7320
- C:\Windows\System\RIVeVxF.exe
  C:\Windows\System\RIVeVxF.exe
  2⤵
  PID:7336
- C:\Windows\System\klWLbXC.exe
  C:\Windows\System\klWLbXC.exe
  2⤵
  PID:7352
- C:\Windows\System\BdLbYrA.exe
  C:\Windows\System\BdLbYrA.exe
  2⤵
  PID:7368
- C:\Windows\System\PPuPoJF.exe
  C:\Windows\System\PPuPoJF.exe
  2⤵
  PID:7384
- C:\Windows\System\AtGOZSa.exe
  C:\Windows\System\AtGOZSa.exe
  2⤵
  PID:7400
- C:\Windows\System\qSJZdgP.exe
  C:\Windows\System\qSJZdgP.exe
  2⤵
  PID:7416
- C:\Windows\System\YNcSbiJ.exe
  C:\Windows\System\YNcSbiJ.exe
  2⤵
  PID:7432
- C:\Windows\System\ESKMTie.exe
  C:\Windows\System\ESKMTie.exe
  2⤵
  PID:7448
- C:\Windows\System\QDsqMOz.exe
  C:\Windows\System\QDsqMOz.exe
  2⤵
  PID:7464
- C:\Windows\System\ZalIiYy.exe
  C:\Windows\System\ZalIiYy.exe
  2⤵
  PID:7480
- C:\Windows\System\TdnumCu.exe
  C:\Windows\System\TdnumCu.exe
  2⤵
  PID:7496
- C:\Windows\System\mjQgsXU.exe
  C:\Windows\System\mjQgsXU.exe
  2⤵
  PID:7512
- C:\Windows\System\ZJckNdu.exe
  C:\Windows\System\ZJckNdu.exe
  2⤵
  PID:7528
- C:\Windows\System\YlzZRil.exe
  C:\Windows\System\YlzZRil.exe
  2⤵
  PID:7544
- C:\Windows\System\KCUAzxb.exe
  C:\Windows\System\KCUAzxb.exe
  2⤵
  PID:7560
- C:\Windows\System\MCLzElb.exe
  C:\Windows\System\MCLzElb.exe
  2⤵
  PID:7576
- C:\Windows\System\qVvMkuF.exe
  C:\Windows\System\qVvMkuF.exe
  2⤵
  PID:7592
- C:\Windows\System\TrKxRZS.exe
  C:\Windows\System\TrKxRZS.exe
  2⤵
  PID:7608
- C:\Windows\System\ftxEnVw.exe
  C:\Windows\System\ftxEnVw.exe
  2⤵
  PID:7624
- C:\Windows\System\SgwMFrR.exe
  C:\Windows\System\SgwMFrR.exe
  2⤵
  PID:7640
- C:\Windows\System\FFAvwPn.exe
  C:\Windows\System\FFAvwPn.exe
  2⤵
  PID:7656
- C:\Windows\System\iiBddNV.exe
  C:\Windows\System\iiBddNV.exe
  2⤵
  PID:7672
- C:\Windows\System\fofdHuz.exe
  C:\Windows\System\fofdHuz.exe
  2⤵
  PID:7688
- C:\Windows\System\CYQWGrd.exe
  C:\Windows\System\CYQWGrd.exe
  2⤵
  PID:7704
- C:\Windows\System\HbRvCnH.exe
  C:\Windows\System\HbRvCnH.exe
  2⤵
  PID:7720
- C:\Windows\System\xkOhVbJ.exe
  C:\Windows\System\xkOhVbJ.exe
  2⤵
  PID:7736
- C:\Windows\System\JikuVAG.exe
  C:\Windows\System\JikuVAG.exe
  2⤵
  PID:7752
- C:\Windows\System\Ksbkjju.exe
  C:\Windows\System\Ksbkjju.exe
  2⤵
  PID:7768
- C:\Windows\System\rxIMskX.exe
  C:\Windows\System\rxIMskX.exe
  2⤵
  PID:7784
- C:\Windows\System\zSADQGs.exe
  C:\Windows\System\zSADQGs.exe
  2⤵
  PID:7800
- C:\Windows\System\DCMJwpX.exe
  C:\Windows\System\DCMJwpX.exe
  2⤵
  PID:7816
- C:\Windows\System\jTMzhoK.exe
  C:\Windows\System\jTMzhoK.exe
  2⤵
  PID:7992
- C:\Windows\System\YTKVzBk.exe
  C:\Windows\System\YTKVzBk.exe
  2⤵
  PID:8080
- C:\Windows\System\AsatnLv.exe
  C:\Windows\System\AsatnLv.exe
  2⤵
  PID:8096
- C:\Windows\System\zkXdMdA.exe
  C:\Windows\System\zkXdMdA.exe
  2⤵
  PID:8116
- C:\Windows\System\HJPZjis.exe
  C:\Windows\System\HJPZjis.exe
  2⤵
  PID:8132
- C:\Windows\System\TfqDUNe.exe
  C:\Windows\System\TfqDUNe.exe
  2⤵
  PID:8148
- C:\Windows\System\CDgDKLg.exe
  C:\Windows\System\CDgDKLg.exe
  2⤵
  PID:8164
- C:\Windows\System\OvSylee.exe
  C:\Windows\System\OvSylee.exe
  2⤵
  PID:8180
- C:\Windows\System\dgRmtNX.exe
  C:\Windows\System\dgRmtNX.exe
  2⤵
  PID:7172
- C:\Windows\System\yrUFBNq.exe
  C:\Windows\System\yrUFBNq.exe
  2⤵
  PID:7232
- C:\Windows\System\nIMmIfz.exe
  C:\Windows\System\nIMmIfz.exe
  2⤵
  PID:7296
- C:\Windows\System\raezscf.exe
  C:\Windows\System\raezscf.exe
  2⤵
  PID:7332
- C:\Windows\System\laIHNtw.exe
  C:\Windows\System\laIHNtw.exe
  2⤵
  PID:7396
- C:\Windows\System\tBjuCoX.exe
  C:\Windows\System\tBjuCoX.exe
  2⤵
  PID:7460
- C:\Windows\System\ZdcqfsR.exe
  C:\Windows\System\ZdcqfsR.exe
  2⤵
  PID:6616
- C:\Windows\System\kXJcRfz.exe
  C:\Windows\System\kXJcRfz.exe
  2⤵
  PID:7100
- C:\Windows\System\YXLIigG.exe
  C:\Windows\System\YXLIigG.exe
  2⤵
  PID:7776
- C:\Windows\System\BYPoWro.exe
  C:\Windows\System\BYPoWro.exe
  2⤵
  PID:7808
- C:\Windows\System\BZINxZZ.exe
  C:\Windows\System\BZINxZZ.exe
  2⤵
  PID:6244
- C:\Windows\System\cGRPosk.exe
  C:\Windows\System\cGRPosk.exe
  2⤵
  PID:7700
- C:\Windows\System\YxCZBcy.exe
  C:\Windows\System\YxCZBcy.exe
  2⤵
  PID:6400
- C:\Windows\System\QjtinLQ.exe
  C:\Windows\System\QjtinLQ.exe
  2⤵
  PID:7220
- C:\Windows\System\gkZYPnI.exe
  C:\Windows\System\gkZYPnI.exe
  2⤵
  PID:7284
- C:\Windows\System\eGqVuXg.exe
  C:\Windows\System\eGqVuXg.exe
  2⤵
  PID:7348
- C:\Windows\System\mqTReGl.exe
  C:\Windows\System\mqTReGl.exe
  2⤵
  PID:7412
- C:\Windows\System\BYgrNMg.exe
  C:\Windows\System\BYgrNMg.exe
  2⤵
  PID:7888
- C:\Windows\System\vBacCIj.exe
  C:\Windows\System\vBacCIj.exe
  2⤵
  PID:7936
- C:\Windows\System\ByofOiY.exe
  C:\Windows\System\ByofOiY.exe
  2⤵
  PID:7920
- C:\Windows\System\WabVTNd.exe
  C:\Windows\System\WabVTNd.exe
  2⤵
  PID:7868
- C:\Windows\System\rAEnsaK.exe
  C:\Windows\System\rAEnsaK.exe
  2⤵
  PID:7884
- C:\Windows\System\PySKHlK.exe
  C:\Windows\System\PySKHlK.exe
  2⤵
  PID:7916
- C:\Windows\System\SYhrFSH.exe
  C:\Windows\System\SYhrFSH.exe
  2⤵
  PID:7952
- C:\Windows\System\qZjiFch.exe
  C:\Windows\System\qZjiFch.exe
  2⤵
  PID:7880
- C:\Windows\System\WHzmObR.exe
  C:\Windows\System\WHzmObR.exe
  2⤵
  PID:8000
- C:\Windows\System\YSPvThN.exe
  C:\Windows\System\YSPvThN.exe
  2⤵
  PID:8036
- C:\Windows\System\qSqHArS.exe
  C:\Windows\System\qSqHArS.exe
  2⤵
  PID:8056
- C:\Windows\System\stNFPve.exe
  C:\Windows\System\stNFPve.exe
  2⤵
  PID:8072
- C:\Windows\System\rBEFSvd.exe
  C:\Windows\System\rBEFSvd.exe
  2⤵
  PID:8108
- C:\Windows\System\PmyICpO.exe
  C:\Windows\System\PmyICpO.exe
  2⤵
  PID:7068
- C:\Windows\System\GPjFiNf.exe
  C:\Windows\System\GPjFiNf.exe
  2⤵
  PID:8160
- C:\Windows\System\DHTVFXq.exe
  C:\Windows\System\DHTVFXq.exe
  2⤵
  PID:8176
- C:\Windows\System\ESazTpb.exe
  C:\Windows\System\ESazTpb.exe
  2⤵
  PID:7456
- C:\Windows\System\mmlclGs.exe
  C:\Windows\System\mmlclGs.exe
  2⤵
  PID:7364
- C:\Windows\System\PvyUiwa.exe
  C:\Windows\System\PvyUiwa.exe
  2⤵
  PID:6504
- C:\Windows\System\kvuSDhF.exe
  C:\Windows\System\kvuSDhF.exe
  2⤵
  PID:6420
- C:\Windows\System\uzKimul.exe
  C:\Windows\System\uzKimul.exe
  2⤵
  PID:6040
- C:\Windows\System\NdweAwB.exe
  C:\Windows\System\NdweAwB.exe
  2⤵
  PID:7188
- C:\Windows\System\LRIeMaJ.exe
  C:\Windows\System\LRIeMaJ.exe
  2⤵
  PID:7732
- C:\Windows\System\EEQVBcs.exe
  C:\Windows\System\EEQVBcs.exe
  2⤵
  PID:7408
- C:\Windows\System\ziaWGBf.exe
  C:\Windows\System\ziaWGBf.exe
  2⤵
  PID:7004
- C:\Windows\System\pBhmjeb.exe
  C:\Windows\System\pBhmjeb.exe
  2⤵
  PID:7216
- C:\Windows\System\MOpkoMc.exe
  C:\Windows\System\MOpkoMc.exe
  2⤵
  PID:6308
- C:\Windows\System\ePgboRU.exe
  C:\Windows\System\ePgboRU.exe
  2⤵
  PID:6684
- C:\Windows\System\uLGQgpm.exe
  C:\Windows\System\uLGQgpm.exe
  2⤵
  PID:7712
- C:\Windows\System\anpYlxE.exe
  C:\Windows\System\anpYlxE.exe
  2⤵
  PID:7472
- C:\Windows\System\ZAlaMhj.exe
  C:\Windows\System\ZAlaMhj.exe
  2⤵
  PID:7508
- C:\Windows\System\FtKbhHD.exe
  C:\Windows\System\FtKbhHD.exe
  2⤵
  PID:7604
- C:\Windows\System\JQvnbUv.exe
  C:\Windows\System\JQvnbUv.exe
  2⤵
  PID:7696
- C:\Windows\System\wWqWuqu.exe
  C:\Windows\System\wWqWuqu.exe
  2⤵
  PID:7760
- C:\Windows\System\vLUTZoK.exe
  C:\Windows\System\vLUTZoK.exe
  2⤵
  PID:7844
- C:\Windows\System\HEpaZXX.exe
  C:\Windows\System\HEpaZXX.exe
  2⤵
  PID:7932
- C:\Windows\System\rbGRxSr.exe
  C:\Windows\System\rbGRxSr.exe
  2⤵
  PID:7876
- C:\Windows\System\gkSdosp.exe
  C:\Windows\System\gkSdosp.exe
  2⤵
  PID:7912
- C:\Windows\System\sWpkJKL.exe
  C:\Windows\System\sWpkJKL.exe
  2⤵
  PID:7968
- C:\Windows\System\nbuzbUc.exe
  C:\Windows\System\nbuzbUc.exe
  2⤵
  PID:7976
- C:\Windows\System\MEFPweL.exe
  C:\Windows\System\MEFPweL.exe
  2⤵
  PID:8020
- C:\Windows\System\FYSZYyV.exe
  C:\Windows\System\FYSZYyV.exe
  2⤵
  PID:8032
- C:\Windows\System\GyrPrMg.exe
  C:\Windows\System\GyrPrMg.exe
  2⤵
  PID:8048
- C:\Windows\System\JjSwkhj.exe
  C:\Windows\System\JjSwkhj.exe
  2⤵
  PID:8068
- C:\Windows\System\QAQUJob.exe
  C:\Windows\System\QAQUJob.exe
  2⤵
  PID:8172
- C:\Windows\System\GpCkQTy.exe
  C:\Windows\System\GpCkQTy.exe
  2⤵
  PID:7680
- C:\Windows\System\rjrLhwP.exe
  C:\Windows\System\rjrLhwP.exe
  2⤵
  PID:7204
- C:\Windows\System\jzbpHFt.exe
  C:\Windows\System\jzbpHFt.exe
  2⤵
  PID:7128
- C:\Windows\System\oGePeGH.exe
  C:\Windows\System\oGePeGH.exe
  2⤵
  PID:7648
- C:\Windows\System\KptLHQD.exe
  C:\Windows\System\KptLHQD.exe
  2⤵
  PID:7600
- C:\Windows\System\HbgpWeC.exe
  C:\Windows\System\HbgpWeC.exe
  2⤵
  PID:7328
- C:\Windows\System\nkMDhtv.exe
  C:\Windows\System\nkMDhtv.exe
  2⤵
  PID:7444
- C:\Windows\System\FLooYVD.exe
  C:\Windows\System\FLooYVD.exe
  2⤵
  PID:7380
- C:\Windows\System\DJBXsHN.exe
  C:\Windows\System\DJBXsHN.exe
  2⤵
  PID:6872
- C:\Windows\System\POZmMCu.exe
  C:\Windows\System\POZmMCu.exe
  2⤵
  PID:7584
- C:\Windows\System\lsCVFTz.exe
  C:\Windows\System\lsCVFTz.exe
  2⤵
  PID:7908
- C:\Windows\System\OjlMsFh.exe
  C:\Windows\System\OjlMsFh.exe
  2⤵
  PID:7860
- C:\Windows\System\XySFEzO.exe
  C:\Windows\System\XySFEzO.exe
  2⤵
  PID:7928
- C:\Windows\System\MMydskR.exe
  C:\Windows\System\MMydskR.exe
  2⤵
  PID:8052
- C:\Windows\System\iEGtHry.exe
  C:\Windows\System\iEGtHry.exe
  2⤵
  PID:6664
- C:\Windows\System\zGbNKzY.exe
  C:\Windows\System\zGbNKzY.exe
  2⤵
  PID:8004
- C:\Windows\System\Hqrlsqe.exe
  C:\Windows\System\Hqrlsqe.exe
  2⤵
  PID:7280
- C:\Windows\System\EYFwmOL.exe
  C:\Windows\System\EYFwmOL.exe
  2⤵
  PID:7556
- C:\Windows\System\gYePYUC.exe
  C:\Windows\System\gYePYUC.exe
  2⤵
  PID:8076
- C:\Windows\System\URlgFed.exe
  C:\Windows\System\URlgFed.exe
  2⤵
  PID:7112
- C:\Windows\System\hIObfMG.exe
  C:\Windows\System\hIObfMG.exe
  2⤵
  PID:7792
- C:\Windows\System\cWfkTyM.exe
  C:\Windows\System\cWfkTyM.exe
  2⤵
  PID:7964
- C:\Windows\System\iMKumUh.exe
  C:\Windows\System\iMKumUh.exe
  2⤵
  PID:7132
- C:\Windows\System\LROHCsq.exe
  C:\Windows\System\LROHCsq.exe
  2⤵
  PID:7796
- C:\Windows\System\BrsdtzY.exe
  C:\Windows\System\BrsdtzY.exe
  2⤵
  PID:8112
- C:\Windows\System\JRJKMwo.exe
  C:\Windows\System\JRJKMwo.exe
  2⤵
  PID:8024
- C:\Windows\System\iwjaDUq.exe
  C:\Windows\System\iwjaDUq.exe
  2⤵
  PID:7572
- C:\Windows\System\pGoejYi.exe
  C:\Windows\System\pGoejYi.exe
  2⤵
  PID:8204
- C:\Windows\System\SGWuasH.exe
  C:\Windows\System\SGWuasH.exe
  2⤵
  PID:8220
- C:\Windows\System\geOjjnI.exe
  C:\Windows\System\geOjjnI.exe
  2⤵
  PID:8236
- C:\Windows\System\DrUJPIG.exe
  C:\Windows\System\DrUJPIG.exe
  2⤵
  PID:8252
- C:\Windows\System\rkbHtMk.exe
  C:\Windows\System\rkbHtMk.exe
  2⤵
  PID:8268
- C:\Windows\System\HXpsnQy.exe
  C:\Windows\System\HXpsnQy.exe
  2⤵
  PID:8284
- C:\Windows\System\yeesqya.exe
  C:\Windows\System\yeesqya.exe
  2⤵
  PID:8300
- C:\Windows\System\XLxpeJL.exe
  C:\Windows\System\XLxpeJL.exe
  2⤵
  PID:8316
- C:\Windows\System\QxcJfTu.exe
  C:\Windows\System\QxcJfTu.exe
  2⤵
  PID:8332
- C:\Windows\System\MxDyOZF.exe
  C:\Windows\System\MxDyOZF.exe
  2⤵
  PID:8348
- C:\Windows\System\XPThSbo.exe
  C:\Windows\System\XPThSbo.exe
  2⤵
  PID:8364
- C:\Windows\System\VPnJfFj.exe
  C:\Windows\System\VPnJfFj.exe
  2⤵
  PID:8380
- C:\Windows\System\jAeXCnk.exe
  C:\Windows\System\jAeXCnk.exe
  2⤵
  PID:8396
- C:\Windows\System\xWtIEQC.exe
  C:\Windows\System\xWtIEQC.exe
  2⤵
  PID:8412
- C:\Windows\System\IBjdySd.exe
  C:\Windows\System\IBjdySd.exe
  2⤵
  PID:8436
- C:\Windows\System\tnWRmTE.exe
  C:\Windows\System\tnWRmTE.exe
  2⤵
  PID:8456
- C:\Windows\System\WnKJNmX.exe
  C:\Windows\System\WnKJNmX.exe
  2⤵
  PID:8516
- C:\Windows\System\QRSScUk.exe
  C:\Windows\System\QRSScUk.exe
  2⤵
  PID:8532
- C:\Windows\System\yBLEgaL.exe
  C:\Windows\System\yBLEgaL.exe
  2⤵
  PID:8548
- C:\Windows\System\UGEscJB.exe
  C:\Windows\System\UGEscJB.exe
  2⤵
  PID:8568
- C:\Windows\System\ErYYDaw.exe
  C:\Windows\System\ErYYDaw.exe
  2⤵
  PID:8584
- C:\Windows\System\Ubtseqp.exe
  C:\Windows\System\Ubtseqp.exe
  2⤵
  PID:8600
- C:\Windows\System\jlZcdWN.exe
  C:\Windows\System\jlZcdWN.exe
  2⤵
  PID:8616
- C:\Windows\System\CdWXazB.exe
  C:\Windows\System\CdWXazB.exe
  2⤵
  PID:8632
- C:\Windows\System\uiwVRfs.exe
  C:\Windows\System\uiwVRfs.exe
  2⤵
  PID:8648
- C:\Windows\System\QmPzWAr.exe
  C:\Windows\System\QmPzWAr.exe
  2⤵
  PID:8664
- C:\Windows\System\nmZTYbi.exe
  C:\Windows\System\nmZTYbi.exe
  2⤵
  PID:8680
- C:\Windows\System\TIGWcOW.exe
  C:\Windows\System\TIGWcOW.exe
  2⤵
  PID:8696
- C:\Windows\System\YOzxAAr.exe
  C:\Windows\System\YOzxAAr.exe
  2⤵
  PID:8712
- C:\Windows\System\XZDYcjw.exe
  C:\Windows\System\XZDYcjw.exe
  2⤵
  PID:8728
- C:\Windows\System\AXRVXdk.exe
  C:\Windows\System\AXRVXdk.exe
  2⤵
  PID:8744
- C:\Windows\System\MWMWaQZ.exe
  C:\Windows\System\MWMWaQZ.exe
  2⤵
  PID:8760
- C:\Windows\System\edBSyln.exe
  C:\Windows\System\edBSyln.exe
  2⤵
  PID:8776
- C:\Windows\System\KjAkZwH.exe
  C:\Windows\System\KjAkZwH.exe
  2⤵
  PID:8792
- C:\Windows\System\iyEYpqL.exe
  C:\Windows\System\iyEYpqL.exe
  2⤵
  PID:8808
- C:\Windows\System\WWoUGTb.exe
  C:\Windows\System\WWoUGTb.exe
  2⤵
  PID:8824
- C:\Windows\System\KcJYokE.exe
  C:\Windows\System\KcJYokE.exe
  2⤵
  PID:8840
- C:\Windows\System\xkQPxSd.exe
  C:\Windows\System\xkQPxSd.exe
  2⤵
  PID:8856
- C:\Windows\System\fMsFpYJ.exe
  C:\Windows\System\fMsFpYJ.exe
  2⤵
  PID:8872
- C:\Windows\System\FkyDagP.exe
  C:\Windows\System\FkyDagP.exe
  2⤵
  PID:8888
- C:\Windows\System\cxwOAQy.exe
  C:\Windows\System\cxwOAQy.exe
  2⤵
  PID:8904
- C:\Windows\System\ehTfMdK.exe
  C:\Windows\System\ehTfMdK.exe
  2⤵
  PID:8920
- C:\Windows\System\XjsVWZJ.exe
  C:\Windows\System\XjsVWZJ.exe
  2⤵
  PID:8936
- C:\Windows\System\DaLJxAN.exe
  C:\Windows\System\DaLJxAN.exe
  2⤵
  PID:8952
- C:\Windows\System\PvDoNWi.exe
  C:\Windows\System\PvDoNWi.exe
  2⤵
  PID:8968
- C:\Windows\System\sqNRfgs.exe
  C:\Windows\System\sqNRfgs.exe
  2⤵
  PID:8984
- C:\Windows\System\FKcCouj.exe
  C:\Windows\System\FKcCouj.exe
  2⤵
  PID:9004
- C:\Windows\System\iWLJPuL.exe
  C:\Windows\System\iWLJPuL.exe
  2⤵
  PID:9020
- C:\Windows\System\VOiRTBI.exe
  C:\Windows\System\VOiRTBI.exe
  2⤵
  PID:9036
- C:\Windows\System\CyedyIf.exe
  C:\Windows\System\CyedyIf.exe
  2⤵
  PID:9052
- C:\Windows\System\kAEunFe.exe
  C:\Windows\System\kAEunFe.exe
  2⤵
  PID:9068
- C:\Windows\System\CUVuNBM.exe
  C:\Windows\System\CUVuNBM.exe
  2⤵
  PID:9084
- C:\Windows\System\PWCGbOl.exe
  C:\Windows\System\PWCGbOl.exe
  2⤵
  PID:9100
- C:\Windows\System\FRQEkWd.exe
  C:\Windows\System\FRQEkWd.exe
  2⤵
  PID:9120
- C:\Windows\System\pfncorM.exe
  C:\Windows\System\pfncorM.exe
  2⤵
  PID:9136
- C:\Windows\System\uAmVcWe.exe
  C:\Windows\System\uAmVcWe.exe
  2⤵
  PID:8292
- C:\Windows\System\WrWKRGY.exe
  C:\Windows\System\WrWKRGY.exe
  2⤵
  PID:8324
- C:\Windows\System\byoNCxx.exe
  C:\Windows\System\byoNCxx.exe
  2⤵
  PID:8424
- C:\Windows\System\fMfLUtg.exe
  C:\Windows\System\fMfLUtg.exe
  2⤵
  PID:8064
- C:\Windows\System\irBQNVD.exe
  C:\Windows\System\irBQNVD.exe
  2⤵
  PID:7164
- C:\Windows\System\gjFOfqC.exe
  C:\Windows\System\gjFOfqC.exe
  2⤵
  PID:8216
- C:\Windows\System\GFBBnUX.exe
  C:\Windows\System\GFBBnUX.exe
  2⤵
  PID:8280
- C:\Windows\System\WStfMBq.exe
  C:\Windows\System\WStfMBq.exe
  2⤵
  PID:8344
- C:\Windows\System\XVFxwAs.exe
  C:\Windows\System\XVFxwAs.exe
  2⤵
  PID:8408
- C:\Windows\System\LVNzVqd.exe
  C:\Windows\System\LVNzVqd.exe
  2⤵
  PID:8452
- C:\Windows\System\McqRkTE.exe
  C:\Windows\System\McqRkTE.exe
  2⤵
  PID:8556
- C:\Windows\System\KDAWAoN.exe
  C:\Windows\System\KDAWAoN.exe
  2⤵
  PID:8496
- C:\Windows\System\tqWRbvb.exe
  C:\Windows\System\tqWRbvb.exe
  2⤵
  PID:8576
- C:\Windows\System\zoEJEiO.exe
  C:\Windows\System\zoEJEiO.exe
  2⤵
  PID:8644
- C:\Windows\System\pIRtGBE.exe
  C:\Windows\System\pIRtGBE.exe
  2⤵
  PID:8736
- C:\Windows\System\OdtJitT.exe
  C:\Windows\System\OdtJitT.exe
  2⤵
  PID:8504
- C:\Windows\System\ElVppvu.exe
  C:\Windows\System\ElVppvu.exe
  2⤵
  PID:8468
- C:\Windows\System\RwONzeO.exe
  C:\Windows\System\RwONzeO.exe
  2⤵
  PID:8472
- C:\Windows\System\KaSIaUS.exe
  C:\Windows\System\KaSIaUS.exe
  2⤵
  PID:8612
- C:\Windows\System\PCmloNT.exe
  C:\Windows\System\PCmloNT.exe
  2⤵
  PID:8772
- C:\Windows\System\FzMeMPr.exe
  C:\Windows\System\FzMeMPr.exe
  2⤵
  PID:8896
- C:\Windows\System\ZDnnQhT.exe
  C:\Windows\System\ZDnnQhT.exe
  2⤵
  PID:8964
- C:\Windows\System\HGlTcaB.exe
  C:\Windows\System\HGlTcaB.exe
  2⤵
  PID:8960
- C:\Windows\System\idOBEjX.exe
  C:\Windows\System\idOBEjX.exe
  2⤵
  PID:9092
- C:\Windows\System\HZOxIfw.exe
  C:\Windows\System\HZOxIfw.exe
  2⤵
  PID:1148
- C:\Windows\System\hoBYgdg.exe
  C:\Windows\System\hoBYgdg.exe
  2⤵
  PID:1240
- C:\Windows\System\TvlKvhJ.exe
  C:\Windows\System\TvlKvhJ.exe
  2⤵
  PID:8848
- C:\Windows\System\pOaPeom.exe
  C:\Windows\System\pOaPeom.exe
  2⤵
  PID:8944
- C:\Windows\System\ipLhdjz.exe
  C:\Windows\System\ipLhdjz.exe
  2⤵
  PID:8720
- C:\Windows\System\KZtvAbe.exe
  C:\Windows\System\KZtvAbe.exe
  2⤵
  PID:8816
- C:\Windows\System\VsUaLOX.exe
  C:\Windows\System\VsUaLOX.exe
  2⤵
  PID:8476
- C:\Windows\System\PNqCGyQ.exe
  C:\Windows\System\PNqCGyQ.exe
  2⤵
  PID:8976
- C:\Windows\System\qiLemWb.exe
  C:\Windows\System\qiLemWb.exe
  2⤵
  PID:9044
- C:\Windows\System\JEcMoMo.exe
  C:\Windows\System\JEcMoMo.exe
  2⤵
  PID:9108
- C:\Windows\System\FwJmBnQ.exe
  C:\Windows\System\FwJmBnQ.exe
  2⤵
  PID:9152
- C:\Windows\System\ubMmSHp.exe
  C:\Windows\System\ubMmSHp.exe
  2⤵
  PID:9192
- C:\Windows\System\uEbyYiD.exe
  C:\Windows\System\uEbyYiD.exe
  2⤵
  PID:9148
- C:\Windows\System\VUJbPOD.exe
  C:\Windows\System\VUJbPOD.exe
  2⤵
  PID:8232
- C:\Windows\System\disAgFQ.exe
  C:\Windows\System\disAgFQ.exe
  2⤵
  PID:8248
- C:\Windows\System\rAJupqr.exe
  C:\Windows\System\rAJupqr.exe
  2⤵
  PID:8392
- C:\Windows\System\BuBNVEi.exe
  C:\Windows\System\BuBNVEi.exe
  2⤵
  PID:8428
- C:\Windows\System\nObyovl.exe
  C:\Windows\System\nObyovl.exe
  2⤵
  PID:8488
- C:\Windows\System\dgXqoHU.exe
  C:\Windows\System\dgXqoHU.exe
  2⤵
  PID:8916
- C:\Windows\System\vVSRqwi.exe
  C:\Windows\System\vVSRqwi.exe
  2⤵
  PID:8376
- C:\Windows\System\hUGJJjV.exe
  C:\Windows\System\hUGJJjV.exe
  2⤵
  PID:1140
- C:\Windows\System\QJaHNfM.exe
  C:\Windows\System\QJaHNfM.exe
  2⤵
  PID:2556
- C:\Windows\System\TrRmEOi.exe
  C:\Windows\System\TrRmEOi.exe
  2⤵
  PID:8464
- C:\Windows\System\WwooCXV.exe
  C:\Windows\System\WwooCXV.exe
  2⤵
  PID:7764
- C:\Windows\System\cPbkNkF.exe
  C:\Windows\System\cPbkNkF.exe
  2⤵
  PID:9000
- C:\Windows\System\rgpKPpj.exe
  C:\Windows\System\rgpKPpj.exe
  2⤵
  PID:8932
- C:\Windows\System\PfPWvaZ.exe
  C:\Windows\System\PfPWvaZ.exe
  2⤵
  PID:1088
- C:\Windows\System\kkuNGsT.exe
  C:\Windows\System\kkuNGsT.exe
  2⤵
  PID:9160
- C:\Windows\System\bUmICxI.exe
  C:\Windows\System\bUmICxI.exe
  2⤵
  PID:8768
- C:\Windows\System\NFvoJbZ.exe
  C:\Windows\System\NFvoJbZ.exe
  2⤵
  PID:1296
- C:\Windows\System\QmlBlbD.exe
  C:\Windows\System\QmlBlbD.exe
  2⤵
  PID:8688
- C:\Windows\System\Fymuphl.exe
  C:\Windows\System\Fymuphl.exe
  2⤵
  PID:8524
- C:\Windows\System\hLuMbFL.exe
  C:\Windows\System\hLuMbFL.exe
  2⤵
  PID:8708
- C:\Windows\System\TCanTnc.exe
  C:\Windows\System\TCanTnc.exe
  2⤵
  PID:340
- C:\Windows\System\uLUArCj.exe
  C:\Windows\System\uLUArCj.exe
  2⤵
  PID:9144
- C:\Windows\System\ZyomMZf.exe
  C:\Windows\System\ZyomMZf.exe
  2⤵
  PID:9184
- C:\Windows\System\cXkhXcb.exe
  C:\Windows\System\cXkhXcb.exe
  2⤵
  PID:3068
- C:\Windows\System\Emgvwit.exe
  C:\Windows\System\Emgvwit.exe
  2⤵
  PID:1104
- C:\Windows\System\BItUapn.exe
  C:\Windows\System\BItUapn.exe
  2⤵
  PID:8312
- C:\Windows\System\gNyWFFi.exe
  C:\Windows\System\gNyWFFi.exe
  2⤵
  PID:9012
- C:\Windows\System\VONqLoZ.exe
  C:\Windows\System\VONqLoZ.exe
  2⤵
  PID:8200
- C:\Windows\System\nFOdOAc.exe
  C:\Windows\System\nFOdOAc.exe
  2⤵
  PID:1716
- C:\Windows\System\ilrqcSY.exe
  C:\Windows\System\ilrqcSY.exe
  2⤵
  PID:7344
- C:\Windows\System\DgtSypH.exe
  C:\Windows\System\DgtSypH.exe
  2⤵
  PID:9280
- C:\Windows\System\zFAENEG.exe
  C:\Windows\System\zFAENEG.exe
  2⤵
  PID:9304
- C:\Windows\System\VIiQLwK.exe
  C:\Windows\System\VIiQLwK.exe
  2⤵
  PID:9320
- C:\Windows\System\RiyimHc.exe
  C:\Windows\System\RiyimHc.exe
  2⤵
  PID:9336
- C:\Windows\System\WfAJpDR.exe
  C:\Windows\System\WfAJpDR.exe
  2⤵
  PID:9352
- C:\Windows\System\IVMfoYg.exe
  C:\Windows\System\IVMfoYg.exe
  2⤵
  PID:9368
- C:\Windows\System\TgamkrK.exe
  C:\Windows\System\TgamkrK.exe
  2⤵
  PID:9384
- C:\Windows\System\yLYDIda.exe
  C:\Windows\System\yLYDIda.exe
  2⤵
  PID:9400
- C:\Windows\System\NnDAIMq.exe
  C:\Windows\System\NnDAIMq.exe
  2⤵
  PID:9416
- C:\Windows\System\tMcTIQO.exe
  C:\Windows\System\tMcTIQO.exe
  2⤵
  PID:9432
- C:\Windows\System\PbPhFLE.exe
  C:\Windows\System\PbPhFLE.exe
  2⤵
  PID:9448
- C:\Windows\System\CsEfQcT.exe
  C:\Windows\System\CsEfQcT.exe
  2⤵
  PID:9464
- C:\Windows\System\wrbrnaO.exe
  C:\Windows\System\wrbrnaO.exe
  2⤵
  PID:9480
- C:\Windows\System\ZVHPjhu.exe
  C:\Windows\System\ZVHPjhu.exe
  2⤵
  PID:9496
- C:\Windows\System\ObzhAkT.exe
  C:\Windows\System\ObzhAkT.exe
  2⤵
  PID:9512
- C:\Windows\System\dlTdhnS.exe
  C:\Windows\System\dlTdhnS.exe
  2⤵
  PID:9532
- C:\Windows\System\VjrhUIN.exe
  C:\Windows\System\VjrhUIN.exe
  2⤵
  PID:9548
- C:\Windows\System\MXVDhjJ.exe
  C:\Windows\System\MXVDhjJ.exe
  2⤵
  PID:9568
- C:\Windows\System\bgmexWa.exe
  C:\Windows\System\bgmexWa.exe
  2⤵
  PID:9584
- C:\Windows\System\QfxfxXW.exe
  C:\Windows\System\QfxfxXW.exe
  2⤵
  PID:9600
- C:\Windows\System\gBAGLnS.exe
  C:\Windows\System\gBAGLnS.exe
  2⤵
  PID:9616
- C:\Windows\System\CdEHGaY.exe
  C:\Windows\System\CdEHGaY.exe
  2⤵
  PID:9632
- C:\Windows\System\OKrVYev.exe
  C:\Windows\System\OKrVYev.exe
  2⤵
  PID:9648
- C:\Windows\System\jQVwVvd.exe
  C:\Windows\System\jQVwVvd.exe
  2⤵
  PID:9684
- C:\Windows\System\oVjJefN.exe
  C:\Windows\System\oVjJefN.exe
  2⤵
  PID:9792
- C:\Windows\System\qtuYyIg.exe
  C:\Windows\System\qtuYyIg.exe
  2⤵
  PID:9824
- C:\Windows\System\FpPaHds.exe
  C:\Windows\System\FpPaHds.exe
  2⤵
  PID:9844
- C:\Windows\System\ttXANQL.exe
  C:\Windows\System\ttXANQL.exe
  2⤵
  PID:9860
- C:\Windows\System\Zayjxcm.exe
  C:\Windows\System\Zayjxcm.exe
  2⤵
  PID:9876
- C:\Windows\System\gNqkcDQ.exe
  C:\Windows\System\gNqkcDQ.exe
  2⤵
  PID:9892
- C:\Windows\System\MaUbnDJ.exe
  C:\Windows\System\MaUbnDJ.exe
  2⤵
  PID:9908
- C:\Windows\System\CsGlHug.exe
  C:\Windows\System\CsGlHug.exe
  2⤵
  PID:9924
- C:\Windows\System\bOBwuro.exe
  C:\Windows\System\bOBwuro.exe
  2⤵
  PID:9940
- C:\Windows\System\LcgEMAB.exe
  C:\Windows\System\LcgEMAB.exe
  2⤵
  PID:9956
- C:\Windows\System\qTsxPNj.exe
  C:\Windows\System\qTsxPNj.exe
  2⤵
  PID:9972
- C:\Windows\System\uQtGldy.exe
  C:\Windows\System\uQtGldy.exe
  2⤵
  PID:9988
- C:\Windows\System\YhAlsac.exe
  C:\Windows\System\YhAlsac.exe
  2⤵
  PID:10004
- C:\Windows\System\CBPSOZr.exe
  C:\Windows\System\CBPSOZr.exe
  2⤵
  PID:10020
- C:\Windows\System\DMCXvyo.exe
  C:\Windows\System\DMCXvyo.exe
  2⤵
  PID:10036
- C:\Windows\System\YrTzVah.exe
  C:\Windows\System\YrTzVah.exe
  2⤵
  PID:10052
- C:\Windows\System\EeilZnx.exe
  C:\Windows\System\EeilZnx.exe
  2⤵
  PID:10068
- C:\Windows\System\GjoTYNp.exe
  C:\Windows\System\GjoTYNp.exe
  2⤵
  PID:10084
- C:\Windows\System\rlmpKDL.exe
  C:\Windows\System\rlmpKDL.exe
  2⤵
  PID:10104
- C:\Windows\System\vdGLToc.exe
  C:\Windows\System\vdGLToc.exe
  2⤵
  PID:10120
- C:\Windows\System\XxghXTe.exe
  C:\Windows\System\XxghXTe.exe
  2⤵
  PID:10136
- C:\Windows\System\bEdkKoW.exe
  C:\Windows\System\bEdkKoW.exe
  2⤵
  PID:10156
- C:\Windows\System\NHvzSHy.exe
  C:\Windows\System\NHvzSHy.exe
  2⤵
  PID:10172
- C:\Windows\System\srRxdPL.exe
  C:\Windows\System\srRxdPL.exe
  2⤵
  PID:10188
- C:\Windows\System\dEZYXvt.exe
  C:\Windows\System\dEZYXvt.exe
  2⤵
  PID:10204
- C:\Windows\System\IrBooMQ.exe
  C:\Windows\System\IrBooMQ.exe
  2⤵
  PID:10220
- C:\Windows\System\YJxOYJj.exe
  C:\Windows\System\YJxOYJj.exe
  2⤵
  PID:10236
- C:\Windows\System\CnNeJtd.exe
  C:\Windows\System\CnNeJtd.exe
  2⤵
  PID:8640
- C:\Windows\System\kitYGut.exe
  C:\Windows\System\kitYGut.exe
  2⤵
  PID:9208
- C:\Windows\System\zqDmmkn.exe
  C:\Windows\System\zqDmmkn.exe
  2⤵
  PID:9244
- C:\Windows\System\flPzXXi.exe
  C:\Windows\System\flPzXXi.exe
  2⤵
  PID:8508
- C:\Windows\System\yCzeiYD.exe
  C:\Windows\System\yCzeiYD.exe
  2⤵
  PID:8560
- C:\Windows\System\mDGuUmA.exe
  C:\Windows\System\mDGuUmA.exe
  2⤵
  PID:9176
- C:\Windows\System\qvXobCo.exe
  C:\Windows\System\qvXobCo.exe
  2⤵
  PID:8212
- C:\Windows\System\BHDLrVI.exe
  C:\Windows\System\BHDLrVI.exe
  2⤵
  PID:8704
- C:\Windows\System\QzulAuZ.exe
  C:\Windows\System\QzulAuZ.exe
  2⤵
  PID:9180
- C:\Windows\System\qUgpgee.exe
  C:\Windows\System\qUgpgee.exe
  2⤵
  PID:8864
- C:\Windows\System\FXtqZeA.exe
  C:\Windows\System\FXtqZeA.exe
  2⤵
  PID:9232
- C:\Windows\System\LPySDUS.exe
  C:\Windows\System\LPySDUS.exe
  2⤵
  PID:2068
- C:\Windows\System\ZqsmZTq.exe
  C:\Windows\System\ZqsmZTq.exe
  2⤵
  PID:9292
- C:\Windows\System\UehbYpt.exe
  C:\Windows\System\UehbYpt.exe
  2⤵
  PID:9256
- C:\Windows\System\kDDImuf.exe
  C:\Windows\System\kDDImuf.exe
  2⤵
  PID:9272
- C:\Windows\System\jWcWVHp.exe
  C:\Windows\System\jWcWVHp.exe
  2⤵
  PID:9344
- C:\Windows\System\fEiwWLL.exe
  C:\Windows\System\fEiwWLL.exe
  2⤵
  PID:9424
- C:\Windows\System\RwUQmjD.exe
  C:\Windows\System\RwUQmjD.exe
  2⤵
  PID:9488
- C:\Windows\System\qWpkqhZ.exe
  C:\Windows\System\qWpkqhZ.exe
  2⤵
  PID:9412
- C:\Windows\System\iouafew.exe
  C:\Windows\System\iouafew.exe
  2⤵
  PID:9376
- C:\Windows\System\JJEkbcv.exe
  C:\Windows\System\JJEkbcv.exe
  2⤵
  PID:9476
- C:\Windows\System\NpUiLpa.exe
  C:\Windows\System\NpUiLpa.exe
  2⤵
  PID:9544
- C:\Windows\System\wfyZdDi.exe
  C:\Windows\System\wfyZdDi.exe
  2⤵
  PID:9564
- C:\Windows\System\UDbBcxp.exe
  C:\Windows\System\UDbBcxp.exe
  2⤵
  PID:9612
- C:\Windows\System\SRLHYat.exe
  C:\Windows\System\SRLHYat.exe
  2⤵
  PID:9708
- C:\Windows\System\IqJGJlq.exe
  C:\Windows\System\IqJGJlq.exe
  2⤵
  PID:9656
- C:\Windows\System\jjaVHfN.exe
  C:\Windows\System\jjaVHfN.exe
  2⤵
  PID:9672
- C:\Windows\System\VigfaAS.exe
  C:\Windows\System\VigfaAS.exe
  2⤵
  PID:9680
- C:\Windows\System\cWFxTSu.exe
  C:\Windows\System\cWFxTSu.exe
  2⤵
  PID:9720
- C:\Windows\System\ClVbvXu.exe
  C:\Windows\System\ClVbvXu.exe
  2⤵
  PID:9756
- C:\Windows\System\pHRiDlQ.exe
  C:\Windows\System\pHRiDlQ.exe
  2⤵
  PID:9724
- C:\Windows\System\TMvIBHE.exe
  C:\Windows\System\TMvIBHE.exe
  2⤵
  PID:9788
- C:\Windows\System\nngYPBI.exe
  C:\Windows\System\nngYPBI.exe
  2⤵
  PID:9816
- C:\Windows\System\chKkWln.exe
  C:\Windows\System\chKkWln.exe
  2⤵
  PID:9776
- C:\Windows\System\VLPFaRP.exe
  C:\Windows\System\VLPFaRP.exe
  2⤵
  PID:9856
- C:\Windows\System\WvRrEdM.exe
  C:\Windows\System\WvRrEdM.exe
  2⤵
  PID:9868
- C:\Windows\System\bObudlt.exe
  C:\Windows\System\bObudlt.exe
  2⤵
  PID:9948
- C:\Windows\System\XulmRGD.exe
  C:\Windows\System\XulmRGD.exe
  2⤵
  PID:9904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BCWbsaL.exe

Filesize
1.2MB

MD5
da63dd2d7f20a265f9865dad3962b8fd

SHA1
7ed2571dcd11c7b7c55fca1a7cdc404259150666

SHA256
9fa613f5589ab439fc6584e30186610ece84e72d1e491835ed51f8325bcb1ab0

SHA512
b76a6ce2936045a7cfa0d2092c398132e2f2a1734aeeecf56d0db061a06cd8627977ae75f2854484645f96db57aa132a9286ecf2689e649215409de4d671b81c

Download Submit
C:\Windows\system\BaTshYw.exe

Filesize
1.2MB

MD5
0684acfd19f64944d9f82fd7665935c5

SHA1
81f497f086052cd151b2943fca264e5180e90e53

SHA256
3829acd133d25494aa6a61d1e3c5c1d245d21cddbe43a8807c34b08f5feb52e1

SHA512
b786cee5e3c489e249408958727d83b8c2a6518166ee71f5c476e8e42fec9964aa69b325e5d25841017138718d9dab8a3b71a806d1a3e2ee42d936f4783493b2

Download Submit
C:\Windows\system\CeuZnGM.exe

Filesize
1.2MB

MD5
eff4d41f84ea44c440f9f986bc88d2e9

SHA1
972dee4a636e79b4dcb71a7b5e3c8d782c8b870f

SHA256
5e4482d2f83c690d269aed7642c0d0e5b6736e1310fa9fe1d3a6ecd47b57c595

SHA512
3ce5a4ad334e4707ee7bb4b879f1564350f9f48d05668295cdc18365850b50373582ac79e0b26332bed35642b2f53cc061f10008ce05b1b1fe40767b574a399a

Download Submit
C:\Windows\system\CmfoptV.exe

Filesize
1.2MB

MD5
e22453511e064ac69572a137a053c8d4

SHA1
ead810952ab638ab394a3da430cf8facbcf712d3

SHA256
f1ed0fbbcc5333b4196e5c14b098ddb14745152391e228c3ad3467dd23b8d1f7

SHA512
dae11eb158fdab5e9b01501943a524dd89d94009e89631cc6ecdf048c8003c2c40e40953f7f2ae8c983e32848a89bfa5303dc77d7a19c18d508c931ee4eabe43

Download Submit
C:\Windows\system\FHOpHXg.exe

Filesize
1.3MB

MD5
c20dea5e34f6cb706f62cf48bf3152a3

SHA1
48ac3748efa4c0a4661be6d950dc1f08841b10e2

SHA256
1fd4005a4076ff71f5fec771437115d8dfa08cc95656d6dd41b2d078bc4b99dc

SHA512
81c3b4ee624b4512b25f1cdee6cb79eec2fd11301ba9d42cff32b10f253dfd10442392124e279250497e31e0f21316a8b54f5d3df8f0d079cfce5fb3235f7006

Download Submit
C:\Windows\system\IXqIZwJ.exe

Filesize
1.2MB

MD5
5220637bb80d650d56ee613ca8474f3e

SHA1
a092f9dbf54e8c82cba3aebfb9831cfab82c2e1c

SHA256
006ec677de498a3cd2a42f9d7412813369a60814f424e0fc751df3970c3b0426

SHA512
1d42f46c3f7daf87010a13f60863230b645f2f897db6dfac5968346339afc6dad3344b17bc51b45815c62fa2156a0d47fcf12370ccaf5fad788037946a9da840

Download Submit
C:\Windows\system\KajzXKd.exe

Filesize
1.3MB

MD5
2a125fcd67f89aa72237249c30c2499c

SHA1
660ee9516582103baa5d46ec6769561514d48825

SHA256
11bb6d14340160e30f99a26b8b753275ab75b416da328de80418257767a14a3a

SHA512
6bceb452e8a405607cbc8b92cb8e0f38b37c6fa56c714a55afe4284ce6d0b9dcdfa4d5c30338843c82cff409ae6bb797560a1aa6730c83c14fdd08635fde24ce

Download Submit
C:\Windows\system\MFIBAyn.exe

Filesize
1.2MB

MD5
4554e61d688575542ab4283b4d1b9c52

SHA1
5dc9d1e4d030404e9877251a87f59bba9bb08c93

SHA256
eb2b7007098850761d1ffe911263ef441db9338ea137a88a23a78f5738f545bd

SHA512
32976121066b27e35d473cedfb4f8bd7d98245ff2e902a5700d6fdeec04afcc3d3c851b05f44aa3e5815c847d2407529b64af88645cf0e9273072a61c38c10a9

Download Submit
C:\Windows\system\OVgSfCc.exe

Filesize
1.2MB

MD5
f3ed08d5afa2c0f82030298d267ef42f

SHA1
e5b203f8c80f06b9a36b470c8d5ca5c12ab14e5b

SHA256
80df2e9b376d5750a063a3490716b4fca93070172e3bb70d0f70e27c468ed813

SHA512
bd495035bef70a8e7db102dbcbc7b7a52321735020200668525c3a99b6a4b5c39f71c9bf9da5eafe641cc36abfe5d60151133d8b2f5a2010195ecf0728ccd8de

Download Submit
C:\Windows\system\RxqtySP.exe

Filesize
1.2MB

MD5
7c0a85206be028e5c01f24cf685858c6

SHA1
c45fe39aef2fd61e7cdbfb0ccb01b7b09620fc67

SHA256
f539386ffc3f4cd0a4352f7c774bf7bbe4047f4a29c4dc96e21fdbd0d8114afa

SHA512
6e059571e1cf749083bf90ad9073ee3ae49e2b79e48796f2c47621616230d5b3c799d3edb1b80acda2aee2e51bad7d6b789436c5594c4be7bc8bfd690fc94847

Download Submit
C:\Windows\system\VlYeJuR.exe

Filesize
1.2MB

MD5
e42885ff1575be87ddd2a39317b7ff1e

SHA1
3a63fa0afc2f6085c61eec0050efb4eda953c522

SHA256
286cf17ff709a491bf5c0fce9ea0ae3734242f5d5db38200e35551c51296e8ed

SHA512
f8fcdeae1a97e8caafabae09a633fa5332dca832cb2dd311aa1d102efebd3c57c1798697e90276d0e9823346a24cdd4cddbdfbd584bb071d1447bee867ffd5b2

Download Submit
C:\Windows\system\cAaEYqw.exe

Filesize
1.2MB

MD5
77e178ba25f6e9c206cd8135fbb16954

SHA1
8f055d0632c8c8adaf7388b09b9956857e055b37

SHA256
b2ca7d57ecf78055cc79ec57c1f195e3e452f2ee12e5d4bab5eb7e49882c0bdd

SHA512
02ccb392bd20a30c484817cf2b6c44bc54ba397d4b69984b547821257209d9bdcc638323a0ca6b12a56d138878fee21a24076923e2d7fbe7b73fcf2fc4a45be2

Download Submit
C:\Windows\system\cxTuBWU.exe

Filesize
1.2MB

MD5
35cdba0c4d50cedb7caac1b998f0a6ca

SHA1
04eaad4366d7381b3903088a731e64001b0b64a0

SHA256
dc802f0da68f00f9d6a5fea26bce3de8ae9a5a47b2e32edeb59bdaf78ddeedc0

SHA512
4e4f20c2a16271a08734e1061fa5123cb45f3aea9c2b9e647348074367a056127d49ec400f90eddff9164d54b9559e689830cf3b54f8a2189508ba2bae5bfd95

Download Submit
C:\Windows\system\gQxNLIT.exe

Filesize
1.2MB

MD5
15b3e9ac1d9506f454da8ae966bd796c

SHA1
3701fac3d057731bd7894d65ccf075e13348a042

SHA256
8385dc93f86060b47d72beedc7af508dfd970321ce16a43c2f8347da151ebb8b

SHA512
8a66138baa2774eea0faae60d6a1c6b35861daec148aef6bf3d717f0037b542f45d538c1d7683ff5734b92241792d0f97d1e73f49ba9a03729ee6ce4f1c8ac3a

Download Submit
C:\Windows\system\iVggVKA.exe

Filesize
1.2MB

MD5
3973154243b4fda86619992934da6678

SHA1
c1b737d6077bb2033fc79b4121ced0bcafdac6ef

SHA256
c420fce2624e864c60bbbad7c1dbebe14c9a425a8406c152c8987a72a1a95155

SHA512
6a0138626624880f2106331e37e848e7fc431c3cc698fb4a27331c0f50276b705557c29ee88aeb22d8f01e964bc84b9fa2b957919d10b133d2543672b32ba9f1

Download Submit
C:\Windows\system\msRXVMD.exe

Filesize
1.2MB

MD5
a743c9442ce8489d4ae850c35a09facd

SHA1
5f74a2b8208b2d54446ebdaca45dba988b0e579e

SHA256
5706bb79c4883025cf9ed066535abc3c0c391ee366b85afe223008cdce48f04f

SHA512
69c34a3de3868647747d8b39caa29fbf6bec4e223f617b97ede7697e9d1d92f65d96a3616483f7bce364324877c7dcf7af9e86972dd45fe75f2f3dbce6c9f954

Download Submit
C:\Windows\system\nCeHJuP.exe

Filesize
1.3MB

MD5
a34804aa275fdffc84eaf0b2bc7472b1

SHA1
06dab599985718708d22aad7fc11ac1cbc9a1321

SHA256
09e1a7b7cde435ce4e73fad4af1eb68a5c8cc3fdf9862525e39a9c52f2a6cf5c

SHA512
31913e2eca220892ed12e1c050dbc41b4c5421f8803e2a2ddfa1487240b375eba6ef5afaab26bef860bc381513b0d2243e0102c2a6cdfd3555f911f4600a6669

Download Submit
C:\Windows\system\nPPZbIq.exe

Filesize
1.2MB

MD5
be15f3269c0519e068ed3d3f20036920

SHA1
d6f1cf99d9336b01e273b5b46f51d3dd99d7c350

SHA256
d522d05e9bddf956f016eb3edf21f5cdba1640a26fb73ca238f7fbbbfb41b828

SHA512
1a3b9ddfaceec808436e790f2076adf97c166678d2507ee6fa5c4335921bd1097d37e6360069528939e886caf0a54b1c49119628726b6f7e1853f0feb98ffc46

Download Submit
C:\Windows\system\qdQsWGt.exe

Filesize
1.2MB

MD5
191f676319a1022a2722d5cf7141d41c

SHA1
ebfc0e78b2e7100356994b3761c923dcf07fcdd5

SHA256
3f5fc4cf1bb2f5e5ccc2c3214ac5fca2f589fe5c193e134d2c77204fab7060eb

SHA512
36b44681753bc59deb1a89b91ba792fcbec56d7bb640b7653c34c1d587a186b604ac723b989649f548a9a83ee809ee3d05bd7a3b6a17bc1ecde0e4d7b545a9b8

Download Submit
C:\Windows\system\rAlBmPo.exe

Filesize
1.2MB

MD5
b0d9c17bda90a9f67ccd2f44d4b6fe20

SHA1
b89a0c5a4ffaf48721275c7bf8b461471c7f41ed

SHA256
baa47c77fd83a8b58179aaa9efbc113a5b6865bb521042c77e56d8dc3de14e34

SHA512
f24353e8e544e91dcb72dcb399dbcb9c7eeb1c43f3b828466f59560601968787e023f738e640ad2e9b3e5008d7e685373575ede9a893c9b396d506da9cab6ad3

Download Submit
C:\Windows\system\rKptjJm.exe

Filesize
1.2MB

MD5
db8d242cef95c559291020c24dc09c4e

SHA1
72a4256a2503b76506cd816f9e71e0edac8084dd

SHA256
1841762bf3b0fbc66932ac5b9c963e433db4ada1176132c01df14c8ae8e4db2d

SHA512
6072b57e7c936a15037fb357e2dfdfc194eca23ddc5583f62e670922c88c8c03048904ef6cc97fa23f9c30ad7706ecf8273f959c2578674b0d6134b2829f6334

Download Submit
C:\Windows\system\sRDqoxB.exe

Filesize
1.2MB

MD5
9f36a332742fd9bdbf3541945859bf74

SHA1
03ecd70798ce238587650ba6048d76284668c661

SHA256
c4813c043e35e820cbbfff55dd47abfcaa2838332361e5f47f6d7da92eb6c36a

SHA512
78284f98ec2a3b83ae28f502f5a9c7dd0aa9335d36203653f7776492b5fd1d1b5f89d665ed0e84d3206cd309e6ea41b56ff453045304dc12f5933a94cf9c3cda

Download Submit
C:\Windows\system\sYTutRr.exe

Filesize
1.2MB

MD5
762d03592ff14a4d037c39aaee0f4167

SHA1
5b809e613f34bb31008a5fd5901fa2c3b01de9a9

SHA256
a53f458c4aead24a23ab707c7c15fdca17ada6c0a28ca795ca1a74bf7564a2ae

SHA512
0680c0821e9384e881ed7e7c62e7ba91fcd5c28800d342d4f01138609be640d91a39690eb56832a8bd8729bad33dfcff00c1c471890f2c7e93aafbe107193469

Download Submit
C:\Windows\system\sakZwdK.exe

Filesize
1.2MB

MD5
4004dbc7c94c49b59bbb14b80881f629

SHA1
53aaff24386d1f72df0525d99b6bde41724328d8

SHA256
b53ed73f8a74f0299c0f4484bb5894a49d3ead8154a40f8d833358b4f291b523

SHA512
a5c53c462647badec7c34e7f7eabbca7e2fcd0ae6cf1905ef6424b53515d6af1ff372927f2a57ade5cb4a6cfc72d0c50e0fada1b960013e865cded24a5855d23

Download Submit
C:\Windows\system\yTXBgzy.exe

Filesize
1.2MB

MD5
15ad21c68a8b8dbf9f08750d77d63e19

SHA1
e8472bde2b5e1c30aee5e1903921f9ad8bfddcae

SHA256
73c35bc36a63762141a567ce0838d2a9289720a92e46b3df2e9686c76ac8df5f

SHA512
1b72abea9a7b71747074adc02a399e4780efdca7c54fb57139c217a437193201400d643786d5a0688ef5faed6ff48c926bfc5ae2a0c26a9a707c00796e0c2fc2

Download Submit
C:\Windows\system\zZHJwlh.exe

Filesize
1.3MB

MD5
b8a3017702ce6f7d888d188dd02b493d

SHA1
cdce736fdec47da8ef2bb0d9d772a605a50e9987

SHA256
c41cbf16674c6c1895897a6688438a74e0e91f0b5696f8f257cbdf0685bbbd01

SHA512
3c08dfe4ff2112dbab2901b20c5dfefc596247f26e42e08f4618515517c390a01cf0c91339989dec0ebe0896b9c8cc1d45b7d9deeb94ee054f8adf2e0069e49b

Download Submit
C:\Windows\system\zpKIRyD.exe

Filesize
1.2MB

MD5
4c83f02e9e226042a03b0fcac7d28bd0

SHA1
e4091a21bbf8f18c5a6d7dc7e0420b28582fe53d

SHA256
c8873dd6fa1853161123537d75e4ea43e91a45fed99af62070a77539295a7501

SHA512
8dd0bbd82e27134c1987f2a861a95fd98dc707ecf8d85a4a84cb38176dccfa6be1035ae5020a85cbc1e3586511dab1e8e7e5d08f1dae8c98d83c99cf0eb18592

Download Submit
\Windows\system\ITrdATD.exe

Filesize
1.2MB

MD5
53fc55c24a010ca364584a1858d2a55f

SHA1
78969168edb2ce3e2e3cb6328b3a821005e6f97a

SHA256
0fc1d218af845ed9ee66242f80a0c9ac9869d27f6f03705df1d77a16e36bc68e

SHA512
a14976c29c0394bad3ff34fc9e827532c086bac41701ffd60af2acaac9e4fa9b5c5915278d605ea483be4b1551a097430104d3a1746b0bbabfa5cd715577080e

Download Submit
\Windows\system\VYPxvfM.exe

Filesize
1.2MB

MD5
6db00616679b7d8b328d633063567017

SHA1
e3d8a9d1cd463858623bb0f176ece3de4d3e183b

SHA256
1ab91f1ffe280796910cc443e3c53c1c88b4195a1e740ff6f4deedc5a47d0442

SHA512
302ea6e43ea21b9b6ff86a9b0ab1e9be43c7f79415c28a865e35b4cba31830661400f1f9d372d302ad233f308493d5f83686d32d439a0caa6fbb4093e6a7604b

Download Submit
\Windows\system\fNLsibC.exe

Filesize
1.2MB

MD5
d44c2f29239a31edfd91284ad67efac8

SHA1
028e43a9ca5871dd7a3fabc18876c67a40c8dd64

SHA256
1989dcea4782915343e44a4e795ce8d3a5b774b908f84c56482b4ac725efed6a

SHA512
5ac03f5b947fa3b01d37883b7078851bc0649183cb99900de6c119273451f51d2b72c92d2af39a6cf7a6adcefda1c12a8098e570f510cc8daccf18f482a7ccd4

Download Submit
\Windows\system\fSfYpJm.exe

Filesize
1.2MB

MD5
bf68cad5f38ada4723e06e11e4a37168

SHA1
78a86bb5e62729cd41df0faf6c1dd95a9486d0ff

SHA256
4bafc1f56b7e271c8588359e7f63cb6d468b3afadee4036ff498b15073314a08

SHA512
4cee52386f9b832c36821c5b93199bd061e219c4546aa3ca2ec2fd27797c13addcc90dd876eb848512007471a4ee2269fe2cd7daa3d01cbb271d67f96be84f76

Download Submit
\Windows\system\jQPtsMP.exe

Filesize
1.3MB

MD5
75a11c3dda6716632d15dbf272317f7f

SHA1
a5d05f4df95460e99b2c387bf6666ac437392f0a

SHA256
6162f6ebc90c7a0bacaf7b64eae1870fa0965f427319eec8d68295c0ec5d59e3

SHA512
6a2638f6b093bc1f8e58bc62ef531f44986dc019feeaeb62ee659f2c19359dc8999d8e5c5187178e141d4f1c0fd861d09b03f069816dc4f77d0be4dfbf11eb01

Download Submit
memory/1892-92-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1892-2379-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1952-2184-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/1952-94-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/1972-68-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-70-0x000000013F1E0000-0x000000013F531000-memory.dmp

Filesize
3.3MB

Download
memory/1972-229-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1972-91-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1972-13-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-50-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-64-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1972-421-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-72-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/1972-60-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-0-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/1972-58-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-179-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/1972-56-0x0000000001D10000-0x0000000002061000-memory.dmp

Filesize
3.3MB

Download
memory/1972-71-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-95-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/1972-99-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/2096-2129-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2096-69-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2236-59-0x000000013FB10000-0x000000013FE61000-memory.dmp

Filesize
3.3MB

Download
memory/2236-2131-0x000000013FB10000-0x000000013FE61000-memory.dmp

Filesize
3.3MB

Download
memory/2284-276-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/2284-14-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/2284-1870-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/2576-100-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2328-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/2576-525-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/2696-2171-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2696-74-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2696-325-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2704-12-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2704-2132-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2704-180-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2728-57-0x000000013FB40000-0x000000013FE91000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2134-0x000000013FB40000-0x000000013FE91000-memory.dmp

Filesize
3.3MB

Download
memory/2772-2133-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2772-51-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2840-67-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2840-2128-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2896-53-0x000000013F1E0000-0x000000013F531000-memory.dmp

Filesize
3.3MB

Download
memory/2896-277-0x000000013F1E0000-0x000000013F531000-memory.dmp

Filesize
3.3MB

Download
memory/2896-3342-0x000000013F1E0000-0x000000013F531000-memory.dmp

Filesize
3.3MB

Download
memory/2916-90-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2916-2187-0x000000013FF50000-0x00000001402A1000-memory.dmp

Filesize
3.3MB

Download
memory/2928-61-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2928-2130-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download