xmrig | 47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97a

Analysis

max time kernel
98s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
Size

1.8MB
MD5

e72ff38495fdb366aac0288f9d813fc0
SHA1

9eea886c342297499dc1ec3c28beb9f2b91b4c5f
SHA256

47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97a
SHA512

87f1c33673e9cf2966505a82ae73c7303c5690dd2fe7e761b4d81642d20959b3818a6ee7ae5922944e5aeff91877505dfc673f0cea450a6d98511f199d193809
SSDEEP

49152:ROdWCCi7/raU56uL3pgrCEdMeb7UDlwwoJ8Ow:RWWBib356utgC

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/2368-278-0x00007FF7BBEB0000-0x00007FF7BC201000-memory.dmp	xmrig
behavioral2/memory/3212-292-0x00007FF63EE50000-0x00007FF63F1A1000-memory.dmp	xmrig
behavioral2/memory/4360-325-0x00007FF7759E0000-0x00007FF775D31000-memory.dmp	xmrig
behavioral2/memory/3724-341-0x00007FF7576F0000-0x00007FF757A41000-memory.dmp	xmrig
behavioral2/memory/1372-366-0x00007FF6B61F0000-0x00007FF6B6541000-memory.dmp	xmrig
behavioral2/memory/1016-374-0x00007FF7C9C50000-0x00007FF7C9FA1000-memory.dmp	xmrig
behavioral2/memory/2256-381-0x00007FF61C150000-0x00007FF61C4A1000-memory.dmp	xmrig
behavioral2/memory/4904-373-0x00007FF622900000-0x00007FF622C51000-memory.dmp	xmrig
behavioral2/memory/3852-372-0x00007FF6A7A10000-0x00007FF6A7D61000-memory.dmp	xmrig
behavioral2/memory/2088-365-0x00007FF6EAA20000-0x00007FF6EAD71000-memory.dmp	xmrig
behavioral2/memory/2508-340-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	xmrig
behavioral2/memory/760-290-0x00007FF602670000-0x00007FF6029C1000-memory.dmp	xmrig
behavioral2/memory/1168-289-0x00007FF70CFB0000-0x00007FF70D301000-memory.dmp	xmrig
behavioral2/memory/228-284-0x00007FF70FE50000-0x00007FF7101A1000-memory.dmp	xmrig
behavioral2/memory/5072-243-0x00007FF6C77C0000-0x00007FF6C7B11000-memory.dmp	xmrig
behavioral2/memory/4880-237-0x00007FF7C0D60000-0x00007FF7C10B1000-memory.dmp	xmrig
behavioral2/memory/4764-217-0x00007FF620DA0000-0x00007FF6210F1000-memory.dmp	xmrig
behavioral2/memory/1976-208-0x00007FF61C130000-0x00007FF61C481000-memory.dmp	xmrig
behavioral2/memory/1156-169-0x00007FF780910000-0x00007FF780C61000-memory.dmp	xmrig
behavioral2/memory/3084-102-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp	xmrig
behavioral2/memory/452-46-0x00007FF768640000-0x00007FF768991000-memory.dmp	xmrig
behavioral2/memory/4024-1740-0x00007FF632F10000-0x00007FF633261000-memory.dmp	xmrig
behavioral2/memory/5104-1737-0x00007FF65FC20000-0x00007FF65FF71000-memory.dmp	xmrig
behavioral2/memory/712-2341-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp	xmrig
behavioral2/memory/452-2308-0x00007FF768640000-0x00007FF768991000-memory.dmp	xmrig
behavioral2/memory/2588-2302-0x00007FF65B990000-0x00007FF65BCE1000-memory.dmp	xmrig
behavioral2/memory/2344-2306-0x00007FF682190000-0x00007FF6824E1000-memory.dmp	xmrig
behavioral2/memory/656-2339-0x00007FF615EE0000-0x00007FF616231000-memory.dmp	xmrig
behavioral2/memory/3484-2337-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp	xmrig
behavioral2/memory/780-2370-0x00007FF7093D0000-0x00007FF709721000-memory.dmp	xmrig
behavioral2/memory/4024-2676-0x00007FF632F10000-0x00007FF633261000-memory.dmp	xmrig
behavioral2/memory/2588-2678-0x00007FF65B990000-0x00007FF65BCE1000-memory.dmp	xmrig
behavioral2/memory/3724-2682-0x00007FF7576F0000-0x00007FF757A41000-memory.dmp	xmrig
behavioral2/memory/452-2681-0x00007FF768640000-0x00007FF768991000-memory.dmp	xmrig
behavioral2/memory/656-2695-0x00007FF615EE0000-0x00007FF616231000-memory.dmp	xmrig
behavioral2/memory/3484-2693-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp	xmrig
behavioral2/memory/1156-2706-0x00007FF780910000-0x00007FF780C61000-memory.dmp	xmrig
behavioral2/memory/3176-2704-0x00007FF75CED0000-0x00007FF75D221000-memory.dmp	xmrig
behavioral2/memory/1976-2702-0x00007FF61C130000-0x00007FF61C481000-memory.dmp	xmrig
behavioral2/memory/3852-2700-0x00007FF6A7A10000-0x00007FF6A7D61000-memory.dmp	xmrig
behavioral2/memory/1016-2698-0x00007FF7C9C50000-0x00007FF7C9FA1000-memory.dmp	xmrig
behavioral2/memory/2344-2697-0x00007FF682190000-0x00007FF6824E1000-memory.dmp	xmrig
behavioral2/memory/1372-2690-0x00007FF6B61F0000-0x00007FF6B6541000-memory.dmp	xmrig
behavioral2/memory/712-2689-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp	xmrig
behavioral2/memory/3084-2687-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp	xmrig
behavioral2/memory/2088-2685-0x00007FF6EAA20000-0x00007FF6EAD71000-memory.dmp	xmrig
behavioral2/memory/4360-2746-0x00007FF7759E0000-0x00007FF775D31000-memory.dmp	xmrig
behavioral2/memory/5072-2739-0x00007FF6C77C0000-0x00007FF6C7B11000-memory.dmp	xmrig
behavioral2/memory/2368-2767-0x00007FF7BBEB0000-0x00007FF7BC201000-memory.dmp	xmrig
behavioral2/memory/4764-2754-0x00007FF620DA0000-0x00007FF6210F1000-memory.dmp	xmrig
behavioral2/memory/4904-2741-0x00007FF622900000-0x00007FF622C51000-memory.dmp	xmrig
behavioral2/memory/228-2737-0x00007FF70FE50000-0x00007FF7101A1000-memory.dmp	xmrig
behavioral2/memory/1168-2735-0x00007FF70CFB0000-0x00007FF70D301000-memory.dmp	xmrig
behavioral2/memory/760-2734-0x00007FF602670000-0x00007FF6029C1000-memory.dmp	xmrig
behavioral2/memory/2256-2765-0x00007FF61C150000-0x00007FF61C4A1000-memory.dmp	xmrig
behavioral2/memory/780-2731-0x00007FF7093D0000-0x00007FF709721000-memory.dmp	xmrig
behavioral2/memory/3212-2730-0x00007FF63EE50000-0x00007FF63F1A1000-memory.dmp	xmrig
behavioral2/memory/4880-2729-0x00007FF7C0D60000-0x00007FF7C10B1000-memory.dmp	xmrig
behavioral2/memory/2508-2728-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4024	pJtvMuu.exe
2588	NmPMIoe.exe
2344	ddXvDWv.exe
452	pbYTqHD.exe
3484	RGlauLI.exe
3724	nMdTSiw.exe
2088	egPqhtL.exe
656	FpXvmKd.exe
712	NnzJpyF.exe
1372	NGoRWlj.exe
3084	exlSnqa.exe
3852	JshKPWb.exe
3176	XpPSenD.exe
4904	wQRaYsT.exe
780	OXBnHeX.exe
1156	pNsoAmq.exe
1976	iFplsKu.exe
4764	bpDgamK.exe
4880	VqFECoA.exe
1016	gzaTIJB.exe
5072	vHBqSav.exe
2368	PdcrcXd.exe
228	wxqJAei.exe
1168	VqLJzBf.exe
760	BxbnNcA.exe
3212	qhWyTmS.exe
2256	yPcwSFJ.exe
4360	iKiMVwW.exe
2508	gflrDVc.exe
3756	pGQOgxE.exe
3716	DwCvpSA.exe
1424	pomhQEQ.exe
4912	cxBhYqY.exe
4752	xlBREPe.exe
4472	YZOtEHf.exe
2848	dWXoIxy.exe
2292	HkKPlUw.exe
4436	zSeEePB.exe
3076	sVJGTei.exe
4816	aGVtImF.exe
2492	zxsAVkh.exe
940	bLDsVqm.exe
1344	nsVXSKn.exe
3896	eMRMncL.exe
1628	FuTxsfV.exe
1616	DdIGkCv.exe
4240	TvAUhnS.exe
2268	QNuJOPh.exe
1504	eTjqKkI.exe
3572	luUCcQg.exe
4876	nKKrIyq.exe
1192	CguyBQN.exe
2904	rZiMOBe.exe
2996	ccPnWXN.exe
4040	GWKzWuD.exe
844	KytGzmw.exe
632	MKnTStC.exe
4368	ftvXeOy.exe
3104	pqoVgAV.exe
4920	GzQcoGG.exe
4404	IdmPqiY.exe
2776	EtAmpdC.exe
2672	HTKjZZi.exe
3696	giKqKtq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5104-0-0x00007FF65FC20000-0x00007FF65FF71000-memory.dmp	upx
behavioral2/files/0x0007000000023c8d-20.dat	upx
behavioral2/memory/2344-35-0x00007FF682190000-0x00007FF6824E1000-memory.dmp	upx
behavioral2/files/0x0007000000023c9c-107.dat	upx
behavioral2/files/0x0007000000023cac-170.dat	upx
behavioral2/memory/2368-278-0x00007FF7BBEB0000-0x00007FF7BC201000-memory.dmp	upx
behavioral2/memory/3212-292-0x00007FF63EE50000-0x00007FF63F1A1000-memory.dmp	upx
behavioral2/memory/4360-325-0x00007FF7759E0000-0x00007FF775D31000-memory.dmp	upx
behavioral2/memory/3724-341-0x00007FF7576F0000-0x00007FF757A41000-memory.dmp	upx
behavioral2/memory/1372-366-0x00007FF6B61F0000-0x00007FF6B6541000-memory.dmp	upx
behavioral2/memory/1016-374-0x00007FF7C9C50000-0x00007FF7C9FA1000-memory.dmp	upx
behavioral2/memory/2256-381-0x00007FF61C150000-0x00007FF61C4A1000-memory.dmp	upx
behavioral2/memory/4904-373-0x00007FF622900000-0x00007FF622C51000-memory.dmp	upx
behavioral2/memory/3852-372-0x00007FF6A7A10000-0x00007FF6A7D61000-memory.dmp	upx
behavioral2/memory/2088-365-0x00007FF6EAA20000-0x00007FF6EAD71000-memory.dmp	upx
behavioral2/memory/2508-340-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp	upx
behavioral2/memory/760-290-0x00007FF602670000-0x00007FF6029C1000-memory.dmp	upx
behavioral2/memory/1168-289-0x00007FF70CFB0000-0x00007FF70D301000-memory.dmp	upx
behavioral2/memory/228-284-0x00007FF70FE50000-0x00007FF7101A1000-memory.dmp	upx
behavioral2/memory/5072-243-0x00007FF6C77C0000-0x00007FF6C7B11000-memory.dmp	upx
behavioral2/memory/4880-237-0x00007FF7C0D60000-0x00007FF7C10B1000-memory.dmp	upx
behavioral2/memory/4764-217-0x00007FF620DA0000-0x00007FF6210F1000-memory.dmp	upx
behavioral2/memory/1976-208-0x00007FF61C130000-0x00007FF61C481000-memory.dmp	upx
behavioral2/files/0x0007000000023ca1-189.dat	upx
behavioral2/files/0x0007000000023cb0-188.dat	upx
behavioral2/files/0x0007000000023ca0-184.dat	upx
behavioral2/files/0x0007000000023c9f-182.dat	upx
behavioral2/files/0x0007000000023c9e-180.dat	upx
behavioral2/files/0x0007000000023caf-179.dat	upx
behavioral2/files/0x0007000000023cae-178.dat	upx
behavioral2/files/0x0007000000023c97-175.dat	upx
behavioral2/files/0x0007000000023c9d-173.dat	upx
behavioral2/files/0x0007000000023cad-172.dat	upx
behavioral2/memory/1156-169-0x00007FF780910000-0x00007FF780C61000-memory.dmp	upx
behavioral2/memory/780-166-0x00007FF7093D0000-0x00007FF709721000-memory.dmp	upx
behavioral2/files/0x0007000000023caa-162.dat	upx
behavioral2/files/0x0007000000023c9a-158.dat	upx
behavioral2/files/0x0007000000023ca9-155.dat	upx
behavioral2/files/0x0007000000023ca8-152.dat	upx
behavioral2/files/0x0007000000023ca6-146.dat	upx
behavioral2/files/0x0007000000023ca5-145.dat	upx
behavioral2/files/0x0007000000023c96-144.dat	upx
behavioral2/files/0x0007000000023ca4-141.dat	upx
behavioral2/memory/3176-137-0x00007FF75CED0000-0x00007FF75D221000-memory.dmp	upx
behavioral2/files/0x0007000000023ca2-134.dat	upx
behavioral2/files/0x0007000000023c98-126.dat	upx
behavioral2/files/0x0007000000023c95-118.dat	upx
behavioral2/files/0x0007000000023ca7-149.dat	upx
behavioral2/files/0x0007000000023c94-106.dat	upx
behavioral2/files/0x0007000000023ca3-140.dat	upx
behavioral2/memory/3084-102-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp	upx
behavioral2/files/0x0007000000023c9b-99.dat	upx
behavioral2/files/0x0007000000023c99-95.dat	upx
behavioral2/files/0x0007000000023c93-87.dat	upx
behavioral2/files/0x0007000000023c90-82.dat	upx
behavioral2/memory/712-73-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp	upx
behavioral2/memory/656-69-0x00007FF615EE0000-0x00007FF616231000-memory.dmp	upx
behavioral2/files/0x0007000000023c91-65.dat	upx
behavioral2/files/0x0007000000023c92-76.dat	upx
behavioral2/files/0x0007000000023c8c-72.dat	upx
behavioral2/memory/3484-52-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp	upx
behavioral2/memory/452-46-0x00007FF768640000-0x00007FF768991000-memory.dmp	upx
behavioral2/files/0x0007000000023c8f-40.dat	upx
behavioral2/files/0x0007000000023c8e-37.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QvccLTX.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KqXYUiM.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ixMBioo.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\GAjERbd.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KXhCFGn.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\SmiBYfB.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\CkxFmMl.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\eqUFlHD.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\gUHOySv.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\AiixDTZ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\suHllDv.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\wAqbycx.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KxFxMFH.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KxjfUMk.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\SEgFKAo.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\cKQBOrp.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KJFiDue.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\AQXvedt.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\QbMwaXM.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\vAFuRPe.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\QzZLwYS.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ukcDqfF.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\gucNmEb.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\kYXGLLU.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\dRkIWqn.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\uclegqQ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\BtMMcPg.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ggIKHXn.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\IoVrXxp.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\GPNrJQa.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\EeuCgNZ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ocJbJng.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\oJjnPNX.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\bpDgamK.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\QSzYCMI.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\uCtTIAG.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ajGGGsJ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\oDPIVoL.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\tbNZyGG.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ePAwuvL.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\KtaqcJA.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\IDRkIXe.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\UDwFKia.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\FYHOQsZ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\VIovCcg.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\Xkqlhfs.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\QXemleI.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\PZqLsBa.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\IzFKnIi.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\yYDvPjb.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\CkYIqal.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\GHHcYEB.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\RIyMyOQ.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\SPzuSdN.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ypYFNQe.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\WDtdJDM.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ohajHwT.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\vZREKMC.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\FuTxsfV.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\QJUYUOs.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\PPpSAXF.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\kkoTmZq.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\MZbxOgP.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
File created	C:\Windows\System\ovVHTwc.exe	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4024	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	85
PID 5104 wrote to memory of 4024	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	85
PID 5104 wrote to memory of 2588	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	86
PID 5104 wrote to memory of 2588	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	86
PID 5104 wrote to memory of 452	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	87
PID 5104 wrote to memory of 452	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	87
PID 5104 wrote to memory of 3484	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	88
PID 5104 wrote to memory of 3484	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	88
PID 5104 wrote to memory of 2344	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	89
PID 5104 wrote to memory of 2344	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	89
PID 5104 wrote to memory of 3724	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	90
PID 5104 wrote to memory of 3724	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	90
PID 5104 wrote to memory of 2088	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	91
PID 5104 wrote to memory of 2088	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	91
PID 5104 wrote to memory of 1372	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	92
PID 5104 wrote to memory of 1372	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	92
PID 5104 wrote to memory of 656	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	93
PID 5104 wrote to memory of 656	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	93
PID 5104 wrote to memory of 712	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	94
PID 5104 wrote to memory of 712	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	94
PID 5104 wrote to memory of 3084	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	95
PID 5104 wrote to memory of 3084	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	95
PID 5104 wrote to memory of 3852	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	96
PID 5104 wrote to memory of 3852	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	96
PID 5104 wrote to memory of 3176	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	97
PID 5104 wrote to memory of 3176	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	97
PID 5104 wrote to memory of 4904	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	98
PID 5104 wrote to memory of 4904	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	98
PID 5104 wrote to memory of 780	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	99
PID 5104 wrote to memory of 780	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	99
PID 5104 wrote to memory of 1156	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	100
PID 5104 wrote to memory of 1156	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	100
PID 5104 wrote to memory of 1976	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	101
PID 5104 wrote to memory of 1976	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	101
PID 5104 wrote to memory of 4764	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	102
PID 5104 wrote to memory of 4764	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	102
PID 5104 wrote to memory of 4880	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	103
PID 5104 wrote to memory of 4880	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	103
PID 5104 wrote to memory of 1016	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	104
PID 5104 wrote to memory of 1016	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	104
PID 5104 wrote to memory of 5072	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	105
PID 5104 wrote to memory of 5072	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	105
PID 5104 wrote to memory of 2368	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	106
PID 5104 wrote to memory of 2368	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	106
PID 5104 wrote to memory of 228	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	107
PID 5104 wrote to memory of 228	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	107
PID 5104 wrote to memory of 1168	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	108
PID 5104 wrote to memory of 1168	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	108
PID 5104 wrote to memory of 760	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	109
PID 5104 wrote to memory of 760	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	109
PID 5104 wrote to memory of 3212	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	110
PID 5104 wrote to memory of 3212	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	110
PID 5104 wrote to memory of 2256	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	111
PID 5104 wrote to memory of 2256	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	111
PID 5104 wrote to memory of 4360	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	112
PID 5104 wrote to memory of 4360	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	112
PID 5104 wrote to memory of 2508	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	113
PID 5104 wrote to memory of 2508	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	113
PID 5104 wrote to memory of 3756	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	114
PID 5104 wrote to memory of 3756	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	114
PID 5104 wrote to memory of 3716	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	115
PID 5104 wrote to memory of 3716	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	115
PID 5104 wrote to memory of 1424	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	116
PID 5104 wrote to memory of 1424	5104	47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe	116

C:\Users\Admin\AppData\Local\Temp\47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe
"C:\Users\Admin\AppData\Local\Temp\47cb4d290662b8a559986f56550c176b049fbbf5a908e02a8980d11972f4c97aN.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\System\pJtvMuu.exe
  C:\Windows\System\pJtvMuu.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\NmPMIoe.exe
  C:\Windows\System\NmPMIoe.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\pbYTqHD.exe
  C:\Windows\System\pbYTqHD.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\RGlauLI.exe
  C:\Windows\System\RGlauLI.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\ddXvDWv.exe
  C:\Windows\System\ddXvDWv.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\nMdTSiw.exe
  C:\Windows\System\nMdTSiw.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\egPqhtL.exe
  C:\Windows\System\egPqhtL.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\NGoRWlj.exe
  C:\Windows\System\NGoRWlj.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\FpXvmKd.exe
  C:\Windows\System\FpXvmKd.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\NnzJpyF.exe
  C:\Windows\System\NnzJpyF.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\exlSnqa.exe
  C:\Windows\System\exlSnqa.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\JshKPWb.exe
  C:\Windows\System\JshKPWb.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\XpPSenD.exe
  C:\Windows\System\XpPSenD.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\wQRaYsT.exe
  C:\Windows\System\wQRaYsT.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\OXBnHeX.exe
  C:\Windows\System\OXBnHeX.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\pNsoAmq.exe
  C:\Windows\System\pNsoAmq.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\iFplsKu.exe
  C:\Windows\System\iFplsKu.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\bpDgamK.exe
  C:\Windows\System\bpDgamK.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\VqFECoA.exe
  C:\Windows\System\VqFECoA.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\gzaTIJB.exe
  C:\Windows\System\gzaTIJB.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\vHBqSav.exe
  C:\Windows\System\vHBqSav.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\PdcrcXd.exe
  C:\Windows\System\PdcrcXd.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\wxqJAei.exe
  C:\Windows\System\wxqJAei.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\VqLJzBf.exe
  C:\Windows\System\VqLJzBf.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\BxbnNcA.exe
  C:\Windows\System\BxbnNcA.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\qhWyTmS.exe
  C:\Windows\System\qhWyTmS.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\yPcwSFJ.exe
  C:\Windows\System\yPcwSFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\iKiMVwW.exe
  C:\Windows\System\iKiMVwW.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\gflrDVc.exe
  C:\Windows\System\gflrDVc.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\pGQOgxE.exe
  C:\Windows\System\pGQOgxE.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\DwCvpSA.exe
  C:\Windows\System\DwCvpSA.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\pomhQEQ.exe
  C:\Windows\System\pomhQEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\cxBhYqY.exe
  C:\Windows\System\cxBhYqY.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\xlBREPe.exe
  C:\Windows\System\xlBREPe.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\zxsAVkh.exe
  C:\Windows\System\zxsAVkh.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\YZOtEHf.exe
  C:\Windows\System\YZOtEHf.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\dWXoIxy.exe
  C:\Windows\System\dWXoIxy.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\HkKPlUw.exe
  C:\Windows\System\HkKPlUw.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zSeEePB.exe
  C:\Windows\System\zSeEePB.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\sVJGTei.exe
  C:\Windows\System\sVJGTei.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\aGVtImF.exe
  C:\Windows\System\aGVtImF.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\bLDsVqm.exe
  C:\Windows\System\bLDsVqm.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\nsVXSKn.exe
  C:\Windows\System\nsVXSKn.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\eMRMncL.exe
  C:\Windows\System\eMRMncL.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\FuTxsfV.exe
  C:\Windows\System\FuTxsfV.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\DdIGkCv.exe
  C:\Windows\System\DdIGkCv.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\TvAUhnS.exe
  C:\Windows\System\TvAUhnS.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\QNuJOPh.exe
  C:\Windows\System\QNuJOPh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\eTjqKkI.exe
  C:\Windows\System\eTjqKkI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\luUCcQg.exe
  C:\Windows\System\luUCcQg.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\nKKrIyq.exe
  C:\Windows\System\nKKrIyq.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\CguyBQN.exe
  C:\Windows\System\CguyBQN.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\rZiMOBe.exe
  C:\Windows\System\rZiMOBe.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\ccPnWXN.exe
  C:\Windows\System\ccPnWXN.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\GWKzWuD.exe
  C:\Windows\System\GWKzWuD.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\KytGzmw.exe
  C:\Windows\System\KytGzmw.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\MKnTStC.exe
  C:\Windows\System\MKnTStC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\ftvXeOy.exe
  C:\Windows\System\ftvXeOy.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\pqoVgAV.exe
  C:\Windows\System\pqoVgAV.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\GzQcoGG.exe
  C:\Windows\System\GzQcoGG.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\IdmPqiY.exe
  C:\Windows\System\IdmPqiY.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\EtAmpdC.exe
  C:\Windows\System\EtAmpdC.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\HTKjZZi.exe
  C:\Windows\System\HTKjZZi.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\giKqKtq.exe
  C:\Windows\System\giKqKtq.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\gqVKVuH.exe
  C:\Windows\System\gqVKVuH.exe
  2⤵
  PID:2656
- C:\Windows\System\GQwhdDT.exe
  C:\Windows\System\GQwhdDT.exe
  2⤵
  PID:2840
- C:\Windows\System\Uqosmvg.exe
  C:\Windows\System\Uqosmvg.exe
  2⤵
  PID:3356
- C:\Windows\System\YpjnAAn.exe
  C:\Windows\System\YpjnAAn.exe
  2⤵
  PID:4636
- C:\Windows\System\xmfTdOE.exe
  C:\Windows\System\xmfTdOE.exe
  2⤵
  PID:3156
- C:\Windows\System\SSvfred.exe
  C:\Windows\System\SSvfred.exe
  2⤵
  PID:2772
- C:\Windows\System\ZIRgksX.exe
  C:\Windows\System\ZIRgksX.exe
  2⤵
  PID:4928
- C:\Windows\System\rpaiMTA.exe
  C:\Windows\System\rpaiMTA.exe
  2⤵
  PID:2692
- C:\Windows\System\lpnwdYM.exe
  C:\Windows\System\lpnwdYM.exe
  2⤵
  PID:3672
- C:\Windows\System\cHNNxiB.exe
  C:\Windows\System\cHNNxiB.exe
  2⤵
  PID:3476
- C:\Windows\System\cKQBOrp.exe
  C:\Windows\System\cKQBOrp.exe
  2⤵
  PID:2272
- C:\Windows\System\rpIVIES.exe
  C:\Windows\System\rpIVIES.exe
  2⤵
  PID:4868
- C:\Windows\System\JjtIvyZ.exe
  C:\Windows\System\JjtIvyZ.exe
  2⤵
  PID:512
- C:\Windows\System\UMhnmBo.exe
  C:\Windows\System\UMhnmBo.exe
  2⤵
  PID:4428
- C:\Windows\System\EsNKuyr.exe
  C:\Windows\System\EsNKuyr.exe
  2⤵
  PID:3124
- C:\Windows\System\oXXuMDG.exe
  C:\Windows\System\oXXuMDG.exe
  2⤵
  PID:4552
- C:\Windows\System\mgjRzLN.exe
  C:\Windows\System\mgjRzLN.exe
  2⤵
  PID:4792
- C:\Windows\System\CkxFmMl.exe
  C:\Windows\System\CkxFmMl.exe
  2⤵
  PID:208
- C:\Windows\System\ccRCXxe.exe
  C:\Windows\System\ccRCXxe.exe
  2⤵
  PID:1968
- C:\Windows\System\TpzfCtT.exe
  C:\Windows\System\TpzfCtT.exe
  2⤵
  PID:4440
- C:\Windows\System\dDWsBHW.exe
  C:\Windows\System\dDWsBHW.exe
  2⤵
  PID:5132
- C:\Windows\System\MmogslD.exe
  C:\Windows\System\MmogslD.exe
  2⤵
  PID:5152
- C:\Windows\System\aVmtbfZ.exe
  C:\Windows\System\aVmtbfZ.exe
  2⤵
  PID:5176
- C:\Windows\System\VmvBcJK.exe
  C:\Windows\System\VmvBcJK.exe
  2⤵
  PID:5196
- C:\Windows\System\IzFKnIi.exe
  C:\Windows\System\IzFKnIi.exe
  2⤵
  PID:5224
- C:\Windows\System\AbPubXu.exe
  C:\Windows\System\AbPubXu.exe
  2⤵
  PID:5356
- C:\Windows\System\gyWQyiP.exe
  C:\Windows\System\gyWQyiP.exe
  2⤵
  PID:5380
- C:\Windows\System\TKHVuon.exe
  C:\Windows\System\TKHVuon.exe
  2⤵
  PID:5404
- C:\Windows\System\shtQeDA.exe
  C:\Windows\System\shtQeDA.exe
  2⤵
  PID:5424
- C:\Windows\System\jhvhegw.exe
  C:\Windows\System\jhvhegw.exe
  2⤵
  PID:5448
- C:\Windows\System\DzDyafV.exe
  C:\Windows\System\DzDyafV.exe
  2⤵
  PID:5468
- C:\Windows\System\OORxyLt.exe
  C:\Windows\System\OORxyLt.exe
  2⤵
  PID:5504
- C:\Windows\System\cIOrQGL.exe
  C:\Windows\System\cIOrQGL.exe
  2⤵
  PID:5520
- C:\Windows\System\gWrblOh.exe
  C:\Windows\System\gWrblOh.exe
  2⤵
  PID:5740
- C:\Windows\System\pYNRBFR.exe
  C:\Windows\System\pYNRBFR.exe
  2⤵
  PID:5784
- C:\Windows\System\gucNmEb.exe
  C:\Windows\System\gucNmEb.exe
  2⤵
  PID:5812
- C:\Windows\System\yYDvPjb.exe
  C:\Windows\System\yYDvPjb.exe
  2⤵
  PID:5828
- C:\Windows\System\rlhflkq.exe
  C:\Windows\System\rlhflkq.exe
  2⤵
  PID:5844
- C:\Windows\System\yeajqww.exe
  C:\Windows\System\yeajqww.exe
  2⤵
  PID:5860
- C:\Windows\System\BvlHlcS.exe
  C:\Windows\System\BvlHlcS.exe
  2⤵
  PID:5876
- C:\Windows\System\uyHQwuM.exe
  C:\Windows\System\uyHQwuM.exe
  2⤵
  PID:5892
- C:\Windows\System\iAtOrtT.exe
  C:\Windows\System\iAtOrtT.exe
  2⤵
  PID:5908
- C:\Windows\System\yDzwcdj.exe
  C:\Windows\System\yDzwcdj.exe
  2⤵
  PID:5924
- C:\Windows\System\QSzYCMI.exe
  C:\Windows\System\QSzYCMI.exe
  2⤵
  PID:5940
- C:\Windows\System\XzLYIfd.exe
  C:\Windows\System\XzLYIfd.exe
  2⤵
  PID:5956
- C:\Windows\System\vqEgLtH.exe
  C:\Windows\System\vqEgLtH.exe
  2⤵
  PID:5972
- C:\Windows\System\UDwFKia.exe
  C:\Windows\System\UDwFKia.exe
  2⤵
  PID:5988
- C:\Windows\System\AdNdoey.exe
  C:\Windows\System\AdNdoey.exe
  2⤵
  PID:6004
- C:\Windows\System\dNVFJkl.exe
  C:\Windows\System\dNVFJkl.exe
  2⤵
  PID:6020
- C:\Windows\System\ezQfsbJ.exe
  C:\Windows\System\ezQfsbJ.exe
  2⤵
  PID:6060
- C:\Windows\System\RIvNxwm.exe
  C:\Windows\System\RIvNxwm.exe
  2⤵
  PID:6076
- C:\Windows\System\mCLtDDd.exe
  C:\Windows\System\mCLtDDd.exe
  2⤵
  PID:6104
- C:\Windows\System\pjLMcwI.exe
  C:\Windows\System\pjLMcwI.exe
  2⤵
  PID:6120
- C:\Windows\System\WrHeEsl.exe
  C:\Windows\System\WrHeEsl.exe
  2⤵
  PID:6136
- C:\Windows\System\Mykoaxt.exe
  C:\Windows\System\Mykoaxt.exe
  2⤵
  PID:3520
- C:\Windows\System\hFKCDPq.exe
  C:\Windows\System\hFKCDPq.exe
  2⤵
  PID:5168
- C:\Windows\System\zxHfNHf.exe
  C:\Windows\System\zxHfNHf.exe
  2⤵
  PID:4392
- C:\Windows\System\yojWIli.exe
  C:\Windows\System\yojWIli.exe
  2⤵
  PID:4740
- C:\Windows\System\cXdOecU.exe
  C:\Windows\System\cXdOecU.exe
  2⤵
  PID:4932
- C:\Windows\System\GEUxyrS.exe
  C:\Windows\System\GEUxyrS.exe
  2⤵
  PID:232
- C:\Windows\System\orjRigq.exe
  C:\Windows\System\orjRigq.exe
  2⤵
  PID:1244
- C:\Windows\System\KJFiDue.exe
  C:\Windows\System\KJFiDue.exe
  2⤵
  PID:2800
- C:\Windows\System\htLBlNJ.exe
  C:\Windows\System\htLBlNJ.exe
  2⤵
  PID:5140
- C:\Windows\System\llJoiyE.exe
  C:\Windows\System\llJoiyE.exe
  2⤵
  PID:5216
- C:\Windows\System\ajKbgyM.exe
  C:\Windows\System\ajKbgyM.exe
  2⤵
  PID:5244
- C:\Windows\System\kYXGLLU.exe
  C:\Windows\System\kYXGLLU.exe
  2⤵
  PID:5264
- C:\Windows\System\MZbxOgP.exe
  C:\Windows\System\MZbxOgP.exe
  2⤵
  PID:5308
- C:\Windows\System\eMyjkwh.exe
  C:\Windows\System\eMyjkwh.exe
  2⤵
  PID:5348
- C:\Windows\System\LpenTGu.exe
  C:\Windows\System\LpenTGu.exe
  2⤵
  PID:5396
- C:\Windows\System\NeChNWE.exe
  C:\Windows\System\NeChNWE.exe
  2⤵
  PID:5440
- C:\Windows\System\fJDZZDB.exe
  C:\Windows\System\fJDZZDB.exe
  2⤵
  PID:5476
- C:\Windows\System\SGPgKRm.exe
  C:\Windows\System\SGPgKRm.exe
  2⤵
  PID:5516
- C:\Windows\System\BuovaSp.exe
  C:\Windows\System\BuovaSp.exe
  2⤵
  PID:5624
- C:\Windows\System\kaKuovb.exe
  C:\Windows\System\kaKuovb.exe
  2⤵
  PID:640
- C:\Windows\System\MKKJSBN.exe
  C:\Windows\System\MKKJSBN.exe
  2⤵
  PID:4712
- C:\Windows\System\RTwlIyC.exe
  C:\Windows\System\RTwlIyC.exe
  2⤵
  PID:3876
- C:\Windows\System\Zfiibuj.exe
  C:\Windows\System\Zfiibuj.exe
  2⤵
  PID:2316
- C:\Windows\System\fWHWOKI.exe
  C:\Windows\System\fWHWOKI.exe
  2⤵
  PID:4064
- C:\Windows\System\WWhemIx.exe
  C:\Windows\System\WWhemIx.exe
  2⤵
  PID:2032
- C:\Windows\System\JEpIHco.exe
  C:\Windows\System\JEpIHco.exe
  2⤵
  PID:4320
- C:\Windows\System\OYVydXr.exe
  C:\Windows\System\OYVydXr.exe
  2⤵
  PID:3436
- C:\Windows\System\XxqpWPo.exe
  C:\Windows\System\XxqpWPo.exe
  2⤵
  PID:5020
- C:\Windows\System\ZarQfsB.exe
  C:\Windows\System\ZarQfsB.exe
  2⤵
  PID:1172
- C:\Windows\System\FtJVzUV.exe
  C:\Windows\System\FtJVzUV.exe
  2⤵
  PID:3196
- C:\Windows\System\Unxjdxh.exe
  C:\Windows\System\Unxjdxh.exe
  2⤵
  PID:2180
- C:\Windows\System\IIwqhxw.exe
  C:\Windows\System\IIwqhxw.exe
  2⤵
  PID:2836
- C:\Windows\System\zFDLbHC.exe
  C:\Windows\System\zFDLbHC.exe
  2⤵
  PID:1604
- C:\Windows\System\TEihNzG.exe
  C:\Windows\System\TEihNzG.exe
  2⤵
  PID:4296
- C:\Windows\System\zTwKEsD.exe
  C:\Windows\System\zTwKEsD.exe
  2⤵
  PID:4888
- C:\Windows\System\IHPzypH.exe
  C:\Windows\System\IHPzypH.exe
  2⤵
  PID:5572
- C:\Windows\System\jgSQpZa.exe
  C:\Windows\System\jgSQpZa.exe
  2⤵
  PID:1584
- C:\Windows\System\srtrYnW.exe
  C:\Windows\System\srtrYnW.exe
  2⤵
  PID:5820
- C:\Windows\System\LyzNViQ.exe
  C:\Windows\System\LyzNViQ.exe
  2⤵
  PID:5872
- C:\Windows\System\mamaNXz.exe
  C:\Windows\System\mamaNXz.exe
  2⤵
  PID:5920
- C:\Windows\System\vAYXhmp.exe
  C:\Windows\System\vAYXhmp.exe
  2⤵
  PID:5760
- C:\Windows\System\AjAJjin.exe
  C:\Windows\System\AjAJjin.exe
  2⤵
  PID:5980
- C:\Windows\System\AQXvedt.exe
  C:\Windows\System\AQXvedt.exe
  2⤵
  PID:5796
- C:\Windows\System\RykQajZ.exe
  C:\Windows\System\RykQajZ.exe
  2⤵
  PID:6028
- C:\Windows\System\padqkbW.exe
  C:\Windows\System\padqkbW.exe
  2⤵
  PID:6056
- C:\Windows\System\dIrrwTW.exe
  C:\Windows\System\dIrrwTW.exe
  2⤵
  PID:6116
- C:\Windows\System\siJlbeZ.exe
  C:\Windows\System\siJlbeZ.exe
  2⤵
  PID:6096
- C:\Windows\System\QvccLTX.exe
  C:\Windows\System\QvccLTX.exe
  2⤵
  PID:6132
- C:\Windows\System\cEnBUgu.exe
  C:\Windows\System\cEnBUgu.exe
  2⤵
  PID:1596
- C:\Windows\System\zQjETnW.exe
  C:\Windows\System\zQjETnW.exe
  2⤵
  PID:6092
- C:\Windows\System\ybqsyFZ.exe
  C:\Windows\System\ybqsyFZ.exe
  2⤵
  PID:4424
- C:\Windows\System\vkFhIlZ.exe
  C:\Windows\System\vkFhIlZ.exe
  2⤵
  PID:2700
- C:\Windows\System\DoYWlaL.exe
  C:\Windows\System\DoYWlaL.exe
  2⤵
  PID:3228
- C:\Windows\System\RMhByvU.exe
  C:\Windows\System\RMhByvU.exe
  2⤵
  PID:3740
- C:\Windows\System\RnluADK.exe
  C:\Windows\System\RnluADK.exe
  2⤵
  PID:4340
- C:\Windows\System\mMLcnna.exe
  C:\Windows\System\mMLcnna.exe
  2⤵
  PID:5060
- C:\Windows\System\IsopasG.exe
  C:\Windows\System\IsopasG.exe
  2⤵
  PID:5372
- C:\Windows\System\domVluH.exe
  C:\Windows\System\domVluH.exe
  2⤵
  PID:5460
- C:\Windows\System\LXvmREo.exe
  C:\Windows\System\LXvmREo.exe
  2⤵
  PID:1872
- C:\Windows\System\WlmPErH.exe
  C:\Windows\System\WlmPErH.exe
  2⤵
  PID:6000
- C:\Windows\System\BxKbSsf.exe
  C:\Windows\System\BxKbSsf.exe
  2⤵
  PID:6168
- C:\Windows\System\XYteCKj.exe
  C:\Windows\System\XYteCKj.exe
  2⤵
  PID:6196
- C:\Windows\System\ZcRNZZA.exe
  C:\Windows\System\ZcRNZZA.exe
  2⤵
  PID:6220
- C:\Windows\System\dXLsQTz.exe
  C:\Windows\System\dXLsQTz.exe
  2⤵
  PID:6236
- C:\Windows\System\lnzPKHh.exe
  C:\Windows\System\lnzPKHh.exe
  2⤵
  PID:6252
- C:\Windows\System\aLCXwqQ.exe
  C:\Windows\System\aLCXwqQ.exe
  2⤵
  PID:6276
- C:\Windows\System\OewgTgK.exe
  C:\Windows\System\OewgTgK.exe
  2⤵
  PID:6296
- C:\Windows\System\WWuVxdH.exe
  C:\Windows\System\WWuVxdH.exe
  2⤵
  PID:6316
- C:\Windows\System\oSdMvFb.exe
  C:\Windows\System\oSdMvFb.exe
  2⤵
  PID:6336
- C:\Windows\System\nBUZBkF.exe
  C:\Windows\System\nBUZBkF.exe
  2⤵
  PID:6364
- C:\Windows\System\FYHOQsZ.exe
  C:\Windows\System\FYHOQsZ.exe
  2⤵
  PID:6384
- C:\Windows\System\FbHgTKz.exe
  C:\Windows\System\FbHgTKz.exe
  2⤵
  PID:6404
- C:\Windows\System\zEBNjwm.exe
  C:\Windows\System\zEBNjwm.exe
  2⤵
  PID:6428
- C:\Windows\System\QsjutkX.exe
  C:\Windows\System\QsjutkX.exe
  2⤵
  PID:6452
- C:\Windows\System\ISoPNwG.exe
  C:\Windows\System\ISoPNwG.exe
  2⤵
  PID:6472
- C:\Windows\System\gAFAXwG.exe
  C:\Windows\System\gAFAXwG.exe
  2⤵
  PID:6492
- C:\Windows\System\uvAmxvO.exe
  C:\Windows\System\uvAmxvO.exe
  2⤵
  PID:6516
- C:\Windows\System\QhFYmjt.exe
  C:\Windows\System\QhFYmjt.exe
  2⤵
  PID:6540
- C:\Windows\System\iAfwoXF.exe
  C:\Windows\System\iAfwoXF.exe
  2⤵
  PID:6556
- C:\Windows\System\jCCiWgG.exe
  C:\Windows\System\jCCiWgG.exe
  2⤵
  PID:6580
- C:\Windows\System\NEaEjEz.exe
  C:\Windows\System\NEaEjEz.exe
  2⤵
  PID:6600
- C:\Windows\System\TjStbNU.exe
  C:\Windows\System\TjStbNU.exe
  2⤵
  PID:6620
- C:\Windows\System\pbJdQiG.exe
  C:\Windows\System\pbJdQiG.exe
  2⤵
  PID:6648
- C:\Windows\System\qMCrPOx.exe
  C:\Windows\System\qMCrPOx.exe
  2⤵
  PID:6668
- C:\Windows\System\SGSxhIN.exe
  C:\Windows\System\SGSxhIN.exe
  2⤵
  PID:6696
- C:\Windows\System\yKogVPO.exe
  C:\Windows\System\yKogVPO.exe
  2⤵
  PID:6724
- C:\Windows\System\XHpgDTy.exe
  C:\Windows\System\XHpgDTy.exe
  2⤵
  PID:6744
- C:\Windows\System\yANLPha.exe
  C:\Windows\System\yANLPha.exe
  2⤵
  PID:6768
- C:\Windows\System\AZxpkmK.exe
  C:\Windows\System\AZxpkmK.exe
  2⤵
  PID:6788
- C:\Windows\System\ggdCOXN.exe
  C:\Windows\System\ggdCOXN.exe
  2⤵
  PID:6804
- C:\Windows\System\uWoeobj.exe
  C:\Windows\System\uWoeobj.exe
  2⤵
  PID:6824
- C:\Windows\System\huKKqbV.exe
  C:\Windows\System\huKKqbV.exe
  2⤵
  PID:6848
- C:\Windows\System\AukmcYI.exe
  C:\Windows\System\AukmcYI.exe
  2⤵
  PID:6872
- C:\Windows\System\PiEBxdB.exe
  C:\Windows\System\PiEBxdB.exe
  2⤵
  PID:6892
- C:\Windows\System\YeXNsFF.exe
  C:\Windows\System\YeXNsFF.exe
  2⤵
  PID:6912
- C:\Windows\System\ovVHTwc.exe
  C:\Windows\System\ovVHTwc.exe
  2⤵
  PID:6944
- C:\Windows\System\obAYIXi.exe
  C:\Windows\System\obAYIXi.exe
  2⤵
  PID:6976
- C:\Windows\System\iGfOtmv.exe
  C:\Windows\System\iGfOtmv.exe
  2⤵
  PID:7004
- C:\Windows\System\lgvFqCi.exe
  C:\Windows\System\lgvFqCi.exe
  2⤵
  PID:7020
- C:\Windows\System\xHxABzk.exe
  C:\Windows\System\xHxABzk.exe
  2⤵
  PID:7044
- C:\Windows\System\YVpjssa.exe
  C:\Windows\System\YVpjssa.exe
  2⤵
  PID:7068
- C:\Windows\System\cyDnBGB.exe
  C:\Windows\System\cyDnBGB.exe
  2⤵
  PID:7088
- C:\Windows\System\PPpSAXF.exe
  C:\Windows\System\PPpSAXF.exe
  2⤵
  PID:7112
- C:\Windows\System\TgeNZIU.exe
  C:\Windows\System\TgeNZIU.exe
  2⤵
  PID:7132
- C:\Windows\System\vRKfSRc.exe
  C:\Windows\System\vRKfSRc.exe
  2⤵
  PID:7160
- C:\Windows\System\UvxNILO.exe
  C:\Windows\System\UvxNILO.exe
  2⤵
  PID:5416
- C:\Windows\System\wyFpBLx.exe
  C:\Windows\System\wyFpBLx.exe
  2⤵
  PID:5512
- C:\Windows\System\saXqfMl.exe
  C:\Windows\System\saXqfMl.exe
  2⤵
  PID:2824
- C:\Windows\System\CzIvjKr.exe
  C:\Windows\System\CzIvjKr.exe
  2⤵
  PID:4644
- C:\Windows\System\RXzcISY.exe
  C:\Windows\System\RXzcISY.exe
  2⤵
  PID:5916
- C:\Windows\System\kWNspWM.exe
  C:\Windows\System\kWNspWM.exe
  2⤵
  PID:5636
- C:\Windows\System\wfUzmNO.exe
  C:\Windows\System\wfUzmNO.exe
  2⤵
  PID:6068
- C:\Windows\System\qPhNjzP.exe
  C:\Windows\System\qPhNjzP.exe
  2⤵
  PID:5496
- C:\Windows\System\jYUqcja.exe
  C:\Windows\System\jYUqcja.exe
  2⤵
  PID:744
- C:\Windows\System\RSdyhct.exe
  C:\Windows\System\RSdyhct.exe
  2⤵
  PID:6380
- C:\Windows\System\yIckxCv.exe
  C:\Windows\System\yIckxCv.exe
  2⤵
  PID:5340
- C:\Windows\System\lxcMGoz.exe
  C:\Windows\System\lxcMGoz.exe
  2⤵
  PID:6552
- C:\Windows\System\bYDtQRz.exe
  C:\Windows\System\bYDtQRz.exe
  2⤵
  PID:5768
- C:\Windows\System\GayAQlP.exe
  C:\Windows\System\GayAQlP.exe
  2⤵
  PID:5780
- C:\Windows\System\tnMbVAU.exe
  C:\Windows\System\tnMbVAU.exe
  2⤵
  PID:3308
- C:\Windows\System\bCBznyk.exe
  C:\Windows\System\bCBznyk.exe
  2⤵
  PID:7184
- C:\Windows\System\QumlanJ.exe
  C:\Windows\System\QumlanJ.exe
  2⤵
  PID:7208
- C:\Windows\System\gfWVvTa.exe
  C:\Windows\System\gfWVvTa.exe
  2⤵
  PID:7244
- C:\Windows\System\ztrkooS.exe
  C:\Windows\System\ztrkooS.exe
  2⤵
  PID:7264
- C:\Windows\System\ixMBioo.exe
  C:\Windows\System\ixMBioo.exe
  2⤵
  PID:7284
- C:\Windows\System\TcAtHPx.exe
  C:\Windows\System\TcAtHPx.exe
  2⤵
  PID:7308
- C:\Windows\System\GcvtiQc.exe
  C:\Windows\System\GcvtiQc.exe
  2⤵
  PID:7324
- C:\Windows\System\fZYoauU.exe
  C:\Windows\System\fZYoauU.exe
  2⤵
  PID:7344
- C:\Windows\System\uRnVdAE.exe
  C:\Windows\System\uRnVdAE.exe
  2⤵
  PID:7372
- C:\Windows\System\cIYTApr.exe
  C:\Windows\System\cIYTApr.exe
  2⤵
  PID:7396
- C:\Windows\System\AjxEJwJ.exe
  C:\Windows\System\AjxEJwJ.exe
  2⤵
  PID:7412
- C:\Windows\System\QbMwaXM.exe
  C:\Windows\System\QbMwaXM.exe
  2⤵
  PID:7440
- C:\Windows\System\GRLKIbX.exe
  C:\Windows\System\GRLKIbX.exe
  2⤵
  PID:7464
- C:\Windows\System\XYgGnMC.exe
  C:\Windows\System\XYgGnMC.exe
  2⤵
  PID:7484
- C:\Windows\System\IoVrXxp.exe
  C:\Windows\System\IoVrXxp.exe
  2⤵
  PID:7500
- C:\Windows\System\qJZgcNA.exe
  C:\Windows\System\qJZgcNA.exe
  2⤵
  PID:7528
- C:\Windows\System\oELzOOe.exe
  C:\Windows\System\oELzOOe.exe
  2⤵
  PID:7552
- C:\Windows\System\YZnlgHS.exe
  C:\Windows\System\YZnlgHS.exe
  2⤵
  PID:7572
- C:\Windows\System\RCyEDaY.exe
  C:\Windows\System\RCyEDaY.exe
  2⤵
  PID:7600
- C:\Windows\System\BTOCgfd.exe
  C:\Windows\System\BTOCgfd.exe
  2⤵
  PID:7624
- C:\Windows\System\qUkXoHi.exe
  C:\Windows\System\qUkXoHi.exe
  2⤵
  PID:7648
- C:\Windows\System\izFHVpk.exe
  C:\Windows\System\izFHVpk.exe
  2⤵
  PID:7676
- C:\Windows\System\vDbcAhk.exe
  C:\Windows\System\vDbcAhk.exe
  2⤵
  PID:7692
- C:\Windows\System\dcuoQWO.exe
  C:\Windows\System\dcuoQWO.exe
  2⤵
  PID:7716
- C:\Windows\System\PLutHtL.exe
  C:\Windows\System\PLutHtL.exe
  2⤵
  PID:7740
- C:\Windows\System\mvozgGP.exe
  C:\Windows\System\mvozgGP.exe
  2⤵
  PID:7760
- C:\Windows\System\YqaYlmB.exe
  C:\Windows\System\YqaYlmB.exe
  2⤵
  PID:7788
- C:\Windows\System\dRkIWqn.exe
  C:\Windows\System\dRkIWqn.exe
  2⤵
  PID:7804
- C:\Windows\System\dQhpwda.exe
  C:\Windows\System\dQhpwda.exe
  2⤵
  PID:7832
- C:\Windows\System\nutZnzk.exe
  C:\Windows\System\nutZnzk.exe
  2⤵
  PID:7848
- C:\Windows\System\yCfCmCC.exe
  C:\Windows\System\yCfCmCC.exe
  2⤵
  PID:7872
- C:\Windows\System\VIovCcg.exe
  C:\Windows\System\VIovCcg.exe
  2⤵
  PID:7896
- C:\Windows\System\ZqXCgbd.exe
  C:\Windows\System\ZqXCgbd.exe
  2⤵
  PID:7916
- C:\Windows\System\kokQxGw.exe
  C:\Windows\System\kokQxGw.exe
  2⤵
  PID:7940
- C:\Windows\System\NMXkJRK.exe
  C:\Windows\System\NMXkJRK.exe
  2⤵
  PID:7964
- C:\Windows\System\FtsmlFG.exe
  C:\Windows\System\FtsmlFG.exe
  2⤵
  PID:7984
- C:\Windows\System\wqHoARc.exe
  C:\Windows\System\wqHoARc.exe
  2⤵
  PID:8004
- C:\Windows\System\xoPXYiv.exe
  C:\Windows\System\xoPXYiv.exe
  2⤵
  PID:8024
- C:\Windows\System\CkYIqal.exe
  C:\Windows\System\CkYIqal.exe
  2⤵
  PID:8040
- C:\Windows\System\YLaycmq.exe
  C:\Windows\System\YLaycmq.exe
  2⤵
  PID:8056
- C:\Windows\System\FWHagSN.exe
  C:\Windows\System\FWHagSN.exe
  2⤵
  PID:8072
- C:\Windows\System\XGmqZaY.exe
  C:\Windows\System\XGmqZaY.exe
  2⤵
  PID:8088
- C:\Windows\System\PnjWZMD.exe
  C:\Windows\System\PnjWZMD.exe
  2⤵
  PID:8108
- C:\Windows\System\AiixDTZ.exe
  C:\Windows\System\AiixDTZ.exe
  2⤵
  PID:8128
- C:\Windows\System\nOvjvRq.exe
  C:\Windows\System\nOvjvRq.exe
  2⤵
  PID:8156
- C:\Windows\System\oFiaTUR.exe
  C:\Windows\System\oFiaTUR.exe
  2⤵
  PID:8176
- C:\Windows\System\gCcYiUb.exe
  C:\Windows\System\gCcYiUb.exe
  2⤵
  PID:5232
- C:\Windows\System\pbHistM.exe
  C:\Windows\System\pbHistM.exe
  2⤵
  PID:6780
- C:\Windows\System\KEwYgbB.exe
  C:\Windows\System\KEwYgbB.exe
  2⤵
  PID:6816
- C:\Windows\System\hyhhsNy.exe
  C:\Windows\System\hyhhsNy.exe
  2⤵
  PID:2196
- C:\Windows\System\jIcaOlA.exe
  C:\Windows\System\jIcaOlA.exe
  2⤵
  PID:6412
- C:\Windows\System\MQVHXrS.exe
  C:\Windows\System\MQVHXrS.exe
  2⤵
  PID:6464
- C:\Windows\System\UMFomyx.exe
  C:\Windows\System\UMFomyx.exe
  2⤵
  PID:6484
- C:\Windows\System\lgXeWgM.exe
  C:\Windows\System\lgXeWgM.exe
  2⤵
  PID:6548
- C:\Windows\System\OKJCADU.exe
  C:\Windows\System\OKJCADU.exe
  2⤵
  PID:6684
- C:\Windows\System\orlpbac.exe
  C:\Windows\System\orlpbac.exe
  2⤵
  PID:7192
- C:\Windows\System\sHjfTWe.exe
  C:\Windows\System\sHjfTWe.exe
  2⤵
  PID:6752
- C:\Windows\System\APLcgVE.exe
  C:\Windows\System\APLcgVE.exe
  2⤵
  PID:7316
- C:\Windows\System\IVpPelr.exe
  C:\Windows\System\IVpPelr.exe
  2⤵
  PID:7388
- C:\Windows\System\GPNrJQa.exe
  C:\Windows\System\GPNrJQa.exe
  2⤵
  PID:7016
- C:\Windows\System\leKGmDR.exe
  C:\Windows\System\leKGmDR.exe
  2⤵
  PID:6312
- C:\Windows\System\UdqrbXQ.exe
  C:\Windows\System\UdqrbXQ.exe
  2⤵
  PID:6372
- C:\Windows\System\wJliXcN.exe
  C:\Windows\System\wJliXcN.exe
  2⤵
  PID:5936
- C:\Windows\System\nDZvVFp.exe
  C:\Windows\System\nDZvVFp.exe
  2⤵
  PID:6500
- C:\Windows\System\SdOnlSt.exe
  C:\Windows\System\SdOnlSt.exe
  2⤵
  PID:7908
- C:\Windows\System\RzAuuRQ.exe
  C:\Windows\System\RzAuuRQ.exe
  2⤵
  PID:7204
- C:\Windows\System\Foaiidq.exe
  C:\Windows\System\Foaiidq.exe
  2⤵
  PID:7228
- C:\Windows\System\qsnZTyh.exe
  C:\Windows\System\qsnZTyh.exe
  2⤵
  PID:8124
- C:\Windows\System\pZRzVdz.exe
  C:\Windows\System\pZRzVdz.exe
  2⤵
  PID:7364
- C:\Windows\System\GcUGFsF.exe
  C:\Windows\System\GcUGFsF.exe
  2⤵
  PID:7748
- C:\Windows\System\xkqCSnB.exe
  C:\Windows\System\xkqCSnB.exe
  2⤵
  PID:7492
- C:\Windows\System\MPWelcP.exe
  C:\Windows\System\MPWelcP.exe
  2⤵
  PID:7632
- C:\Windows\System\edrYlEi.exe
  C:\Windows\System\edrYlEi.exe
  2⤵
  PID:7796
- C:\Windows\System\sMhgbuq.exe
  C:\Windows\System\sMhgbuq.exe
  2⤵
  PID:8120
- C:\Windows\System\iKDyuTe.exe
  C:\Windows\System\iKDyuTe.exe
  2⤵
  PID:6884
- C:\Windows\System\kkoTmZq.exe
  C:\Windows\System\kkoTmZq.exe
  2⤵
  PID:6984
- C:\Windows\System\iLkUYuf.exe
  C:\Windows\System\iLkUYuf.exe
  2⤵
  PID:7156
- C:\Windows\System\vsWSdsa.exe
  C:\Windows\System\vsWSdsa.exe
  2⤵
  PID:7012
- C:\Windows\System\UTelpQV.exe
  C:\Windows\System\UTelpQV.exe
  2⤵
  PID:6040
- C:\Windows\System\ggIKHXn.exe
  C:\Windows\System\ggIKHXn.exe
  2⤵
  PID:8204
- C:\Windows\System\BVBAnjJ.exe
  C:\Windows\System\BVBAnjJ.exe
  2⤵
  PID:8228
- C:\Windows\System\vueveQG.exe
  C:\Windows\System\vueveQG.exe
  2⤵
  PID:8252
- C:\Windows\System\SAxHDjA.exe
  C:\Windows\System\SAxHDjA.exe
  2⤵
  PID:8276
- C:\Windows\System\kFlrwqI.exe
  C:\Windows\System\kFlrwqI.exe
  2⤵
  PID:8300
- C:\Windows\System\UEWgiLi.exe
  C:\Windows\System\UEWgiLi.exe
  2⤵
  PID:8320
- C:\Windows\System\sGeRNax.exe
  C:\Windows\System\sGeRNax.exe
  2⤵
  PID:8348
- C:\Windows\System\BAuJBlM.exe
  C:\Windows\System\BAuJBlM.exe
  2⤵
  PID:8364
- C:\Windows\System\zzbFTve.exe
  C:\Windows\System\zzbFTve.exe
  2⤵
  PID:8392
- C:\Windows\System\soDQUFV.exe
  C:\Windows\System\soDQUFV.exe
  2⤵
  PID:8416
- C:\Windows\System\mCUYBUf.exe
  C:\Windows\System\mCUYBUf.exe
  2⤵
  PID:8444
- C:\Windows\System\DKFKbxP.exe
  C:\Windows\System\DKFKbxP.exe
  2⤵
  PID:8464
- C:\Windows\System\CpxFIGm.exe
  C:\Windows\System\CpxFIGm.exe
  2⤵
  PID:8492
- C:\Windows\System\WemZWmU.exe
  C:\Windows\System\WemZWmU.exe
  2⤵
  PID:8512
- C:\Windows\System\gEzoHas.exe
  C:\Windows\System\gEzoHas.exe
  2⤵
  PID:8540
- C:\Windows\System\XsINxdq.exe
  C:\Windows\System\XsINxdq.exe
  2⤵
  PID:8560
- C:\Windows\System\Ppjxnyz.exe
  C:\Windows\System\Ppjxnyz.exe
  2⤵
  PID:8584
- C:\Windows\System\efsNiHz.exe
  C:\Windows\System\efsNiHz.exe
  2⤵
  PID:8604
- C:\Windows\System\pGqXXbD.exe
  C:\Windows\System\pGqXXbD.exe
  2⤵
  PID:8624
- C:\Windows\System\gzHonjk.exe
  C:\Windows\System\gzHonjk.exe
  2⤵
  PID:8648
- C:\Windows\System\mQBbwUX.exe
  C:\Windows\System\mQBbwUX.exe
  2⤵
  PID:8672
- C:\Windows\System\uVVKrLk.exe
  C:\Windows\System\uVVKrLk.exe
  2⤵
  PID:8708
- C:\Windows\System\zcDDRDo.exe
  C:\Windows\System\zcDDRDo.exe
  2⤵
  PID:8728
- C:\Windows\System\qJnvkPi.exe
  C:\Windows\System\qJnvkPi.exe
  2⤵
  PID:8756
- C:\Windows\System\woQgyoX.exe
  C:\Windows\System\woQgyoX.exe
  2⤵
  PID:8776
- C:\Windows\System\duRLtjy.exe
  C:\Windows\System\duRLtjy.exe
  2⤵
  PID:8800
- C:\Windows\System\uCtTIAG.exe
  C:\Windows\System\uCtTIAG.exe
  2⤵
  PID:8824
- C:\Windows\System\lGfRbsU.exe
  C:\Windows\System\lGfRbsU.exe
  2⤵
  PID:8840
- C:\Windows\System\kUGaygQ.exe
  C:\Windows\System\kUGaygQ.exe
  2⤵
  PID:8864
- C:\Windows\System\bFzcxjj.exe
  C:\Windows\System\bFzcxjj.exe
  2⤵
  PID:8888
- C:\Windows\System\waiqGos.exe
  C:\Windows\System\waiqGos.exe
  2⤵
  PID:8912
- C:\Windows\System\gJnNoXp.exe
  C:\Windows\System\gJnNoXp.exe
  2⤵
  PID:8932
- C:\Windows\System\GDJBsgC.exe
  C:\Windows\System\GDJBsgC.exe
  2⤵
  PID:8952
- C:\Windows\System\FMXnIoJ.exe
  C:\Windows\System\FMXnIoJ.exe
  2⤵
  PID:8972
- C:\Windows\System\YZfqEUW.exe
  C:\Windows\System\YZfqEUW.exe
  2⤵
  PID:8996
- C:\Windows\System\aQvhJhJ.exe
  C:\Windows\System\aQvhJhJ.exe
  2⤵
  PID:9020
- C:\Windows\System\qiVJnrc.exe
  C:\Windows\System\qiVJnrc.exe
  2⤵
  PID:9036
- C:\Windows\System\hvYaVrU.exe
  C:\Windows\System\hvYaVrU.exe
  2⤵
  PID:9060
- C:\Windows\System\sZUHqYz.exe
  C:\Windows\System\sZUHqYz.exe
  2⤵
  PID:9084
- C:\Windows\System\xVrpeFM.exe
  C:\Windows\System\xVrpeFM.exe
  2⤵
  PID:9108
- C:\Windows\System\Xkqlhfs.exe
  C:\Windows\System\Xkqlhfs.exe
  2⤵
  PID:9128
- C:\Windows\System\ltSHCXk.exe
  C:\Windows\System\ltSHCXk.exe
  2⤵
  PID:9152
- C:\Windows\System\TSxppDq.exe
  C:\Windows\System\TSxppDq.exe
  2⤵
  PID:9172
- C:\Windows\System\zymNxqs.exe
  C:\Windows\System\zymNxqs.exe
  2⤵
  PID:9196
- C:\Windows\System\YUJOlsx.exe
  C:\Windows\System\YUJOlsx.exe
  2⤵
  PID:6488
- C:\Windows\System\XRrsSXj.exe
  C:\Windows\System\XRrsSXj.exe
  2⤵
  PID:7924
- C:\Windows\System\kDecYzc.exe
  C:\Windows\System\kDecYzc.exe
  2⤵
  PID:7980
- C:\Windows\System\TCrJqok.exe
  C:\Windows\System\TCrJqok.exe
  2⤵
  PID:8068
- C:\Windows\System\NAWqjMw.exe
  C:\Windows\System\NAWqjMw.exe
  2⤵
  PID:7336
- C:\Windows\System\txldaes.exe
  C:\Windows\System\txldaes.exe
  2⤵
  PID:5236
- C:\Windows\System\ADlWulX.exe
  C:\Windows\System\ADlWulX.exe
  2⤵
  PID:7972
- C:\Windows\System\SWHRvSp.exe
  C:\Windows\System\SWHRvSp.exe
  2⤵
  PID:6616
- C:\Windows\System\SWJGylU.exe
  C:\Windows\System\SWJGylU.exe
  2⤵
  PID:6760
- C:\Windows\System\GzQmhEd.exe
  C:\Windows\System\GzQmhEd.exe
  2⤵
  PID:6304
- C:\Windows\System\eqUFlHD.exe
  C:\Windows\System\eqUFlHD.exe
  2⤵
  PID:7508
- C:\Windows\System\yOtDCPq.exe
  C:\Windows\System\yOtDCPq.exe
  2⤵
  PID:6444
- C:\Windows\System\enteKNd.exe
  C:\Windows\System\enteKNd.exe
  2⤵
  PID:6704
- C:\Windows\System\qlYOjrn.exe
  C:\Windows\System\qlYOjrn.exe
  2⤵
  PID:6800
- C:\Windows\System\xzdMDIW.exe
  C:\Windows\System\xzdMDIW.exe
  2⤵
  PID:7728
- C:\Windows\System\EeuCgNZ.exe
  C:\Windows\System\EeuCgNZ.exe
  2⤵
  PID:3432
- C:\Windows\System\NLvSuFN.exe
  C:\Windows\System\NLvSuFN.exe
  2⤵
  PID:7544
- C:\Windows\System\rEHKwzI.exe
  C:\Windows\System\rEHKwzI.exe
  2⤵
  PID:9436
- C:\Windows\System\Sasbuex.exe
  C:\Windows\System\Sasbuex.exe
  2⤵
  PID:9468
- C:\Windows\System\WFmenLN.exe
  C:\Windows\System\WFmenLN.exe
  2⤵
  PID:9484
- C:\Windows\System\dxUOkIh.exe
  C:\Windows\System\dxUOkIh.exe
  2⤵
  PID:9552
- C:\Windows\System\mERrmkW.exe
  C:\Windows\System\mERrmkW.exe
  2⤵
  PID:10108
- C:\Windows\System\XCcuIqO.exe
  C:\Windows\System\XCcuIqO.exe
  2⤵
  PID:10128
- C:\Windows\System\nWJZozz.exe
  C:\Windows\System\nWJZozz.exe
  2⤵
  PID:10148
- C:\Windows\System\RWbxDXg.exe
  C:\Windows\System\RWbxDXg.exe
  2⤵
  PID:10176
- C:\Windows\System\vLTWppD.exe
  C:\Windows\System\vLTWppD.exe
  2⤵
  PID:10204
- C:\Windows\System\xuPtMTy.exe
  C:\Windows\System\xuPtMTy.exe
  2⤵
  PID:10224
- C:\Windows\System\NUXShuQ.exe
  C:\Windows\System\NUXShuQ.exe
  2⤵
  PID:8632
- C:\Windows\System\AnpcgDv.exe
  C:\Windows\System\AnpcgDv.exe
  2⤵
  PID:6160
- C:\Windows\System\pKohbQK.exe
  C:\Windows\System\pKohbQK.exe
  2⤵
  PID:8100
- C:\Windows\System\sEMWJvj.exe
  C:\Windows\System\sEMWJvj.exe
  2⤵
  PID:6960
- C:\Windows\System\hIcJCXj.exe
  C:\Windows\System\hIcJCXj.exe
  2⤵
  PID:8308
- C:\Windows\System\hdsaywi.exe
  C:\Windows\System\hdsaywi.exe
  2⤵
  PID:8616
- C:\Windows\System\hDDVYZy.exe
  C:\Windows\System\hDDVYZy.exe
  2⤵
  PID:8136
- C:\Windows\System\QuldBwv.exe
  C:\Windows\System\QuldBwv.exe
  2⤵
  PID:8552
- C:\Windows\System\tJDTUee.exe
  C:\Windows\System\tJDTUee.exe
  2⤵
  PID:8480
- C:\Windows\System\dznsJrG.exe
  C:\Windows\System\dznsJrG.exe
  2⤵
  PID:6448
- C:\Windows\System\jWPORDQ.exe
  C:\Windows\System\jWPORDQ.exe
  2⤵
  PID:7236
- C:\Windows\System\QwuBlJu.exe
  C:\Windows\System\QwuBlJu.exe
  2⤵
  PID:7280
- C:\Windows\System\HAAKjzJ.exe
  C:\Windows\System\HAAKjzJ.exe
  2⤵
  PID:7384
- C:\Windows\System\NKQMXPF.exe
  C:\Windows\System\NKQMXPF.exe
  2⤵
  PID:8292
- C:\Windows\System\FjWxaeB.exe
  C:\Windows\System\FjWxaeB.exe
  2⤵
  PID:7432
- C:\Windows\System\QEXdAGw.exe
  C:\Windows\System\QEXdAGw.exe
  2⤵
  PID:7960
- C:\Windows\System\otZuSOw.exe
  C:\Windows\System\otZuSOw.exe
  2⤵
  PID:9096
- C:\Windows\System\TWrTxBu.exe
  C:\Windows\System\TWrTxBu.exe
  2⤵
  PID:8432
- C:\Windows\System\NPspnoO.exe
  C:\Windows\System\NPspnoO.exe
  2⤵
  PID:8920
- C:\Windows\System\udVcvyk.exe
  C:\Windows\System\udVcvyk.exe
  2⤵
  PID:8388
- C:\Windows\System\aHMuawP.exe
  C:\Windows\System\aHMuawP.exe
  2⤵
  PID:8472
- C:\Windows\System\iFMHnzm.exe
  C:\Windows\System\iFMHnzm.exe
  2⤵
  PID:8580
- C:\Windows\System\FgKMHKI.exe
  C:\Windows\System\FgKMHKI.exe
  2⤵
  PID:8752
- C:\Windows\System\DsulwUK.exe
  C:\Windows\System\DsulwUK.exe
  2⤵
  PID:8900
- C:\Windows\System\NPgPWPc.exe
  C:\Windows\System\NPgPWPc.exe
  2⤵
  PID:8992
- C:\Windows\System\DMveBXn.exe
  C:\Windows\System\DMveBXn.exe
  2⤵
  PID:9296
- C:\Windows\System\QxPBqkT.exe
  C:\Windows\System\QxPBqkT.exe
  2⤵
  PID:9136
- C:\Windows\System\BGUKwdP.exe
  C:\Windows\System\BGUKwdP.exe
  2⤵
  PID:9184
- C:\Windows\System\dZHthoh.exe
  C:\Windows\System\dZHthoh.exe
  2⤵
  PID:7776
- C:\Windows\System\qHJjisy.exe
  C:\Windows\System\qHJjisy.exe
  2⤵
  PID:9896
- C:\Windows\System\PGLPrtL.exe
  C:\Windows\System\PGLPrtL.exe
  2⤵
  PID:9424
- C:\Windows\System\HgKeDEh.exe
  C:\Windows\System\HgKeDEh.exe
  2⤵
  PID:10008
- C:\Windows\System\GHHcYEB.exe
  C:\Windows\System\GHHcYEB.exe
  2⤵
  PID:10252
- C:\Windows\System\CnEKJeP.exe
  C:\Windows\System\CnEKJeP.exe
  2⤵
  PID:10296
- C:\Windows\System\BrttuMo.exe
  C:\Windows\System\BrttuMo.exe
  2⤵
  PID:10336
- C:\Windows\System\ocJbJng.exe
  C:\Windows\System\ocJbJng.exe
  2⤵
  PID:10356
- C:\Windows\System\dkvaFRI.exe
  C:\Windows\System\dkvaFRI.exe
  2⤵
  PID:10376
- C:\Windows\System\IZoRNAh.exe
  C:\Windows\System\IZoRNAh.exe
  2⤵
  PID:10396
- C:\Windows\System\ajGGGsJ.exe
  C:\Windows\System\ajGGGsJ.exe
  2⤵
  PID:10412
- C:\Windows\System\wCaqLfr.exe
  C:\Windows\System\wCaqLfr.exe
  2⤵
  PID:10428
- C:\Windows\System\dvsckVX.exe
  C:\Windows\System\dvsckVX.exe
  2⤵
  PID:10444
- C:\Windows\System\LvQTNbh.exe
  C:\Windows\System\LvQTNbh.exe
  2⤵
  PID:10464
- C:\Windows\System\gevxURy.exe
  C:\Windows\System\gevxURy.exe
  2⤵
  PID:10488
- C:\Windows\System\ICVnStf.exe
  C:\Windows\System\ICVnStf.exe
  2⤵
  PID:10516
- C:\Windows\System\nJoCCGj.exe
  C:\Windows\System\nJoCCGj.exe
  2⤵
  PID:10536
- C:\Windows\System\sgyvAet.exe
  C:\Windows\System\sgyvAet.exe
  2⤵
  PID:10560
- C:\Windows\System\kUKUUoF.exe
  C:\Windows\System\kUKUUoF.exe
  2⤵
  PID:10584
- C:\Windows\System\phdCraU.exe
  C:\Windows\System\phdCraU.exe
  2⤵
  PID:10600
- C:\Windows\System\QkeMqJw.exe
  C:\Windows\System\QkeMqJw.exe
  2⤵
  PID:10644
- C:\Windows\System\HAAJsyG.exe
  C:\Windows\System\HAAJsyG.exe
  2⤵
  PID:10668
- C:\Windows\System\WfqpOui.exe
  C:\Windows\System\WfqpOui.exe
  2⤵
  PID:10692
- C:\Windows\System\suHllDv.exe
  C:\Windows\System\suHllDv.exe
  2⤵
  PID:10712
- C:\Windows\System\RHCdomo.exe
  C:\Windows\System\RHCdomo.exe
  2⤵
  PID:10748
- C:\Windows\System\wyAJWCM.exe
  C:\Windows\System\wyAJWCM.exe
  2⤵
  PID:10764
- C:\Windows\System\mslwkYW.exe
  C:\Windows\System\mslwkYW.exe
  2⤵
  PID:10780
- C:\Windows\System\esqHobO.exe
  C:\Windows\System\esqHobO.exe
  2⤵
  PID:10796
- C:\Windows\System\Sfsscvi.exe
  C:\Windows\System\Sfsscvi.exe
  2⤵
  PID:10812
- C:\Windows\System\VTIBeVp.exe
  C:\Windows\System\VTIBeVp.exe
  2⤵
  PID:10832
- C:\Windows\System\mbRbqPh.exe
  C:\Windows\System\mbRbqPh.exe
  2⤵
  PID:10920
- C:\Windows\System\URcAhZn.exe
  C:\Windows\System\URcAhZn.exe
  2⤵
  PID:10940
- C:\Windows\System\fNBZsqw.exe
  C:\Windows\System\fNBZsqw.exe
  2⤵
  PID:10960
- C:\Windows\System\TbHLzAp.exe
  C:\Windows\System\TbHLzAp.exe
  2⤵
  PID:10980
- C:\Windows\System\YlTHfcg.exe
  C:\Windows\System\YlTHfcg.exe
  2⤵
  PID:11000
- C:\Windows\System\qrJKQOI.exe
  C:\Windows\System\qrJKQOI.exe
  2⤵
  PID:11020
- C:\Windows\System\nAbXAAV.exe
  C:\Windows\System\nAbXAAV.exe
  2⤵
  PID:11044
- C:\Windows\System\FsHpDus.exe
  C:\Windows\System\FsHpDus.exe
  2⤵
  PID:11064
- C:\Windows\System\yNuEMzG.exe
  C:\Windows\System\yNuEMzG.exe
  2⤵
  PID:11084
- C:\Windows\System\HVuEVzI.exe
  C:\Windows\System\HVuEVzI.exe
  2⤵
  PID:11112
- C:\Windows\System\jyXrngW.exe
  C:\Windows\System\jyXrngW.exe
  2⤵
  PID:11132
- C:\Windows\System\pDmcrPq.exe
  C:\Windows\System\pDmcrPq.exe
  2⤵
  PID:11152
- C:\Windows\System\xHVFlNh.exe
  C:\Windows\System\xHVFlNh.exe
  2⤵
  PID:11172
- C:\Windows\System\kinJVVJ.exe
  C:\Windows\System\kinJVVJ.exe
  2⤵
  PID:11192
- C:\Windows\System\VFRGSfE.exe
  C:\Windows\System\VFRGSfE.exe
  2⤵
  PID:11212
- C:\Windows\System\zyjuNrT.exe
  C:\Windows\System\zyjuNrT.exe
  2⤵
  PID:11232
- C:\Windows\System\PWChahX.exe
  C:\Windows\System\PWChahX.exe
  2⤵
  PID:11248
- C:\Windows\System\FhtEqMS.exe
  C:\Windows\System\FhtEqMS.exe
  2⤵
  PID:7724
- C:\Windows\System\puqXsnc.exe
  C:\Windows\System\puqXsnc.exe
  2⤵
  PID:8456
- C:\Windows\System\ejqVdAI.exe
  C:\Windows\System\ejqVdAI.exe
  2⤵
  PID:6596
- C:\Windows\System\KUpsdif.exe
  C:\Windows\System\KUpsdif.exe
  2⤵
  PID:9736
- C:\Windows\System\glQlsoH.exe
  C:\Windows\System\glQlsoH.exe
  2⤵
  PID:6860
- C:\Windows\System\TsZZorG.exe
  C:\Windows\System\TsZZorG.exe
  2⤵
  PID:6436
- C:\Windows\System\BpzYLhN.exe
  C:\Windows\System\BpzYLhN.exe
  2⤵
  PID:8384
- C:\Windows\System\oZQKzkI.exe
  C:\Windows\System\oZQKzkI.exe
  2⤵
  PID:9976
- C:\Windows\System\UfVpmNH.exe
  C:\Windows\System\UfVpmNH.exe
  2⤵
  PID:10156
- C:\Windows\System\fYeWeXQ.exe
  C:\Windows\System\fYeWeXQ.exe
  2⤵
  PID:10212
- C:\Windows\System\qFEhRCy.exe
  C:\Windows\System\qFEhRCy.exe
  2⤵
  PID:8692
- C:\Windows\System\ZRLoQWi.exe
  C:\Windows\System\ZRLoQWi.exe
  2⤵
  PID:10328
- C:\Windows\System\aCjGOHP.exe
  C:\Windows\System\aCjGOHP.exe
  2⤵
  PID:10388
- C:\Windows\System\jIDxncw.exe
  C:\Windows\System\jIDxncw.exe
  2⤵
  PID:10420
- C:\Windows\System\fqxegZv.exe
  C:\Windows\System\fqxegZv.exe
  2⤵
  PID:7176
- C:\Windows\System\qjfBNrU.exe
  C:\Windows\System\qjfBNrU.exe
  2⤵
  PID:4620
- C:\Windows\System\vLYzYCo.exe
  C:\Windows\System\vLYzYCo.exe
  2⤵
  PID:8484
- C:\Windows\System\bfXkPPI.exe
  C:\Windows\System\bfXkPPI.exe
  2⤵
  PID:8968
- C:\Windows\System\vDqNtvh.exe
  C:\Windows\System\vDqNtvh.exe
  2⤵
  PID:9816
- C:\Windows\System\OAEdMNv.exe
  C:\Windows\System\OAEdMNv.exe
  2⤵
  PID:9092
- C:\Windows\System\SsofuoR.exe
  C:\Windows\System\SsofuoR.exe
  2⤵
  PID:7404
- C:\Windows\System\EMiXtQy.exe
  C:\Windows\System\EMiXtQy.exe
  2⤵
  PID:9928
- C:\Windows\System\JySqDlB.exe
  C:\Windows\System\JySqDlB.exe
  2⤵
  PID:10096
- C:\Windows\System\eSVhPEn.exe
  C:\Windows\System\eSVhPEn.exe
  2⤵
  PID:6228
- C:\Windows\System\CEINkQz.exe
  C:\Windows\System\CEINkQz.exe
  2⤵
  PID:10544
- C:\Windows\System\Tihlzky.exe
  C:\Windows\System\Tihlzky.exe
  2⤵
  PID:10736
- C:\Windows\System\FhqJIeG.exe
  C:\Windows\System\FhqJIeG.exe
  2⤵
  PID:10928
- C:\Windows\System\zxYRZHs.exe
  C:\Windows\System\zxYRZHs.exe
  2⤵
  PID:11280
- C:\Windows\System\YCDyLWo.exe
  C:\Windows\System\YCDyLWo.exe
  2⤵
  PID:11304
- C:\Windows\System\APLfOES.exe
  C:\Windows\System\APLfOES.exe
  2⤵
  PID:11328
- C:\Windows\System\gKHmiwm.exe
  C:\Windows\System\gKHmiwm.exe
  2⤵
  PID:11352
- C:\Windows\System\ywnPPDf.exe
  C:\Windows\System\ywnPPDf.exe
  2⤵
  PID:11368
- C:\Windows\System\hZHwlfA.exe
  C:\Windows\System\hZHwlfA.exe
  2⤵
  PID:11388
- C:\Windows\System\nRJpqOn.exe
  C:\Windows\System\nRJpqOn.exe
  2⤵
  PID:11412
- C:\Windows\System\ghpMWXe.exe
  C:\Windows\System\ghpMWXe.exe
  2⤵
  PID:11432
- C:\Windows\System\EpjfiVR.exe
  C:\Windows\System\EpjfiVR.exe
  2⤵
  PID:11452
- C:\Windows\System\rleGyow.exe
  C:\Windows\System\rleGyow.exe
  2⤵
  PID:11476
- C:\Windows\System\YNiltMK.exe
  C:\Windows\System\YNiltMK.exe
  2⤵
  PID:11496
- C:\Windows\System\ziPdgtq.exe
  C:\Windows\System\ziPdgtq.exe
  2⤵
  PID:11528
- C:\Windows\System\pGYXDzY.exe
  C:\Windows\System\pGYXDzY.exe
  2⤵
  PID:11552
- C:\Windows\System\drsqcbA.exe
  C:\Windows\System\drsqcbA.exe
  2⤵
  PID:11568
- C:\Windows\System\CBuNhjV.exe
  C:\Windows\System\CBuNhjV.exe
  2⤵
  PID:11588
- C:\Windows\System\dcsptnI.exe
  C:\Windows\System\dcsptnI.exe
  2⤵
  PID:11612
- C:\Windows\System\KUGnbvF.exe
  C:\Windows\System\KUGnbvF.exe
  2⤵
  PID:11640
- C:\Windows\System\MvBVbYe.exe
  C:\Windows\System\MvBVbYe.exe
  2⤵
  PID:11660
- C:\Windows\System\rDhCZVg.exe
  C:\Windows\System\rDhCZVg.exe
  2⤵
  PID:11680
- C:\Windows\System\ptFxugQ.exe
  C:\Windows\System\ptFxugQ.exe
  2⤵
  PID:11704
- C:\Windows\System\uclegqQ.exe
  C:\Windows\System\uclegqQ.exe
  2⤵
  PID:11732
- C:\Windows\System\jXvTbwB.exe
  C:\Windows\System\jXvTbwB.exe
  2⤵
  PID:11760
- C:\Windows\System\TeersUk.exe
  C:\Windows\System\TeersUk.exe
  2⤵
  PID:11780
- C:\Windows\System\MSiSiPi.exe
  C:\Windows\System\MSiSiPi.exe
  2⤵
  PID:11804
- C:\Windows\System\uXFtocH.exe
  C:\Windows\System\uXFtocH.exe
  2⤵
  PID:11828
- C:\Windows\System\GRnChRa.exe
  C:\Windows\System\GRnChRa.exe
  2⤵
  PID:11860
- C:\Windows\System\SLhUHqv.exe
  C:\Windows\System\SLhUHqv.exe
  2⤵
  PID:11880
- C:\Windows\System\BGWUUAj.exe
  C:\Windows\System\BGWUUAj.exe
  2⤵
  PID:11904
- C:\Windows\System\utAhPUQ.exe
  C:\Windows\System\utAhPUQ.exe
  2⤵
  PID:12168
- C:\Windows\System\sdqiosK.exe
  C:\Windows\System\sdqiosK.exe
  2⤵
  PID:12196
- C:\Windows\System\JFLHutD.exe
  C:\Windows\System\JFLHutD.exe
  2⤵
  PID:12224
- C:\Windows\System\LJLZwzj.exe
  C:\Windows\System\LJLZwzj.exe
  2⤵
  PID:12260
- C:\Windows\System\TuvOneI.exe
  C:\Windows\System\TuvOneI.exe
  2⤵
  PID:10592
- C:\Windows\System\AiTCSdm.exe
  C:\Windows\System\AiTCSdm.exe
  2⤵
  PID:9584
- C:\Windows\System\jEZhgqi.exe
  C:\Windows\System\jEZhgqi.exe
  2⤵
  PID:10288
- C:\Windows\System\YmwaerC.exe
  C:\Windows\System\YmwaerC.exe
  2⤵
  PID:11144
- C:\Windows\System\TfCHUyh.exe
  C:\Windows\System\TfCHUyh.exe
  2⤵
  PID:10500
- C:\Windows\System\oJjnPNX.exe
  C:\Windows\System\oJjnPNX.exe
  2⤵
  PID:11204
- C:\Windows\System\rpYdEWV.exe
  C:\Windows\System\rpYdEWV.exe
  2⤵
  PID:10776
- C:\Windows\System\NcjLrKz.exe
  C:\Windows\System\NcjLrKz.exe
  2⤵
  PID:10808
- C:\Windows\System\xAfePji.exe
  C:\Windows\System\xAfePji.exe
  2⤵
  PID:1008
- C:\Windows\System\RIyMyOQ.exe
  C:\Windows\System\RIyMyOQ.exe
  2⤵
  PID:10844
- C:\Windows\System\TbUodcB.exe
  C:\Windows\System\TbUodcB.exe
  2⤵
  PID:10028
- C:\Windows\System\ASXctLF.exe
  C:\Windows\System\ASXctLF.exe
  2⤵
  PID:1712
- C:\Windows\System\nxxdVLN.exe
  C:\Windows\System\nxxdVLN.exe
  2⤵
  PID:8476
- C:\Windows\System\vknuEKv.exe
  C:\Windows\System\vknuEKv.exe
  2⤵
  PID:10936
- C:\Windows\System\QvwTkdp.exe
  C:\Windows\System\QvwTkdp.exe
  2⤵
  PID:10956
- C:\Windows\System\XNwuOae.exe
  C:\Windows\System\XNwuOae.exe
  2⤵
  PID:9808
- C:\Windows\System\iuDpZXF.exe
  C:\Windows\System\iuDpZXF.exe
  2⤵
  PID:11036
- C:\Windows\System\gKFVHxq.exe
  C:\Windows\System\gKFVHxq.exe
  2⤵
  PID:10572
- C:\Windows\System\rodXnuY.exe
  C:\Windows\System\rodXnuY.exe
  2⤵
  PID:10608
- C:\Windows\System\XVVzlKx.exe
  C:\Windows\System\XVVzlKx.exe
  2⤵
  PID:10704
- C:\Windows\System\PSwvtVI.exe
  C:\Windows\System\PSwvtVI.exe
  2⤵
  PID:9624
- C:\Windows\System\DHqQbwO.exe
  C:\Windows\System\DHqQbwO.exe
  2⤵
  PID:11604
- C:\Windows\System\hWVZHpF.exe
  C:\Windows\System\hWVZHpF.exe
  2⤵
  PID:10888
- C:\Windows\System\KqXYUiM.exe
  C:\Windows\System\KqXYUiM.exe
  2⤵
  PID:11916
- C:\Windows\System\jdrfiGT.exe
  C:\Windows\System\jdrfiGT.exe
  2⤵
  PID:11940
- C:\Windows\System\gUHOySv.exe
  C:\Windows\System\gUHOySv.exe
  2⤵
  PID:11008
- C:\Windows\System\sowiaCE.exe
  C:\Windows\System\sowiaCE.exe
  2⤵
  PID:11100
- C:\Windows\System\PruoCbh.exe
  C:\Windows\System\PruoCbh.exe
  2⤵
  PID:11404
- C:\Windows\System\yPCMKfR.exe
  C:\Windows\System\yPCMKfR.exe
  2⤵
  PID:11512
- C:\Windows\System\GYOfYRn.exe
  C:\Windows\System\GYOfYRn.exe
  2⤵
  PID:12308
- C:\Windows\System\hGTafOP.exe
  C:\Windows\System\hGTafOP.exe
  2⤵
  PID:12328
- C:\Windows\System\IRecHAf.exe
  C:\Windows\System\IRecHAf.exe
  2⤵
  PID:12352
- C:\Windows\System\CpFvsik.exe
  C:\Windows\System\CpFvsik.exe
  2⤵
  PID:12384
- C:\Windows\System\cjJVZEY.exe
  C:\Windows\System\cjJVZEY.exe
  2⤵
  PID:12416
- C:\Windows\System\MNFBYnn.exe
  C:\Windows\System\MNFBYnn.exe
  2⤵
  PID:12436
- C:\Windows\System\tHrjoRB.exe
  C:\Windows\System\tHrjoRB.exe
  2⤵
  PID:12456
- C:\Windows\System\HYTwUUW.exe
  C:\Windows\System\HYTwUUW.exe
  2⤵
  PID:12480
- C:\Windows\System\FqMBomt.exe
  C:\Windows\System\FqMBomt.exe
  2⤵
  PID:12500
- C:\Windows\System\KbYvkIu.exe
  C:\Windows\System\KbYvkIu.exe
  2⤵
  PID:12520
- C:\Windows\System\llUBEag.exe
  C:\Windows\System\llUBEag.exe
  2⤵
  PID:12540
- C:\Windows\System\KBWeEKh.exe
  C:\Windows\System\KBWeEKh.exe
  2⤵
  PID:12564
- C:\Windows\System\VCwbfxq.exe
  C:\Windows\System\VCwbfxq.exe
  2⤵
  PID:12588
- C:\Windows\System\hBMqwrl.exe
  C:\Windows\System\hBMqwrl.exe
  2⤵
  PID:12612
- C:\Windows\System\DhsMOAM.exe
  C:\Windows\System\DhsMOAM.exe
  2⤵
  PID:12640
- C:\Windows\System\oqPzekI.exe
  C:\Windows\System\oqPzekI.exe
  2⤵
  PID:12664
- C:\Windows\System\zsjrWcC.exe
  C:\Windows\System\zsjrWcC.exe
  2⤵
  PID:12692
- C:\Windows\System\SlyUkLk.exe
  C:\Windows\System\SlyUkLk.exe
  2⤵
  PID:12708
- C:\Windows\System\PlTUEiN.exe
  C:\Windows\System\PlTUEiN.exe
  2⤵
  PID:12736
- C:\Windows\System\QKBVGDY.exe
  C:\Windows\System\QKBVGDY.exe
  2⤵
  PID:12760
- C:\Windows\System\vsZRBYc.exe
  C:\Windows\System\vsZRBYc.exe
  2⤵
  PID:12784
- C:\Windows\System\ePAwuvL.exe
  C:\Windows\System\ePAwuvL.exe
  2⤵
  PID:12804
- C:\Windows\System\hRvAsPC.exe
  C:\Windows\System\hRvAsPC.exe
  2⤵
  PID:12828
- C:\Windows\System\mCOzYQV.exe
  C:\Windows\System\mCOzYQV.exe
  2⤵
  PID:12852
- C:\Windows\System\EBIubWX.exe
  C:\Windows\System\EBIubWX.exe
  2⤵
  PID:12876
- C:\Windows\System\frbPDNn.exe
  C:\Windows\System\frbPDNn.exe
  2⤵
  PID:12896
- C:\Windows\System\BtMMcPg.exe
  C:\Windows\System\BtMMcPg.exe
  2⤵
  PID:12916
- C:\Windows\System\yvGTxFt.exe
  C:\Windows\System\yvGTxFt.exe
  2⤵
  PID:12936
- C:\Windows\System\axDVlXS.exe
  C:\Windows\System\axDVlXS.exe
  2⤵
  PID:12960
- C:\Windows\System\rYudGLl.exe
  C:\Windows\System\rYudGLl.exe
  2⤵
  PID:12984
- C:\Windows\System\NSxFWBE.exe
  C:\Windows\System\NSxFWBE.exe
  2⤵
  PID:13004
- C:\Windows\System\ymTJvZJ.exe
  C:\Windows\System\ymTJvZJ.exe
  2⤵
  PID:13024
- C:\Windows\System\zZlobjQ.exe
  C:\Windows\System\zZlobjQ.exe
  2⤵
  PID:13052
- C:\Windows\System\SekBicw.exe
  C:\Windows\System\SekBicw.exe
  2⤵
  PID:13084
- C:\Windows\System\vFefplV.exe
  C:\Windows\System\vFefplV.exe
  2⤵
  PID:13104
- C:\Windows\System\KQniDkY.exe
  C:\Windows\System\KQniDkY.exe
  2⤵
  PID:13120
- C:\Windows\System\zgzaYVh.exe
  C:\Windows\System\zgzaYVh.exe
  2⤵
  PID:13148
- C:\Windows\System\fDRQqWZ.exe
  C:\Windows\System\fDRQqWZ.exe
  2⤵
  PID:13164
- C:\Windows\System\QPmMpxN.exe
  C:\Windows\System\QPmMpxN.exe
  2⤵
  PID:13180
- C:\Windows\System\WtOKkLi.exe
  C:\Windows\System\WtOKkLi.exe
  2⤵
  PID:13204
- C:\Windows\System\gczSQSl.exe
  C:\Windows\System\gczSQSl.exe
  2⤵
  PID:13220
- C:\Windows\System\lQCWIAh.exe
  C:\Windows\System\lQCWIAh.exe
  2⤵
  PID:13236
- C:\Windows\System\tTrUkqb.exe
  C:\Windows\System\tTrUkqb.exe
  2⤵
  PID:13252
- C:\Windows\System\qbIRFyN.exe
  C:\Windows\System\qbIRFyN.exe
  2⤵
  PID:13268
- C:\Windows\System\RMctqSr.exe
  C:\Windows\System\RMctqSr.exe
  2⤵
  PID:13288
- C:\Windows\System\mgizayI.exe
  C:\Windows\System\mgizayI.exe
  2⤵
  PID:13304
- C:\Windows\System\SPzuSdN.exe
  C:\Windows\System\SPzuSdN.exe
  2⤵
  PID:11540
- C:\Windows\System\iFuONCp.exe
  C:\Windows\System\iFuONCp.exe
  2⤵
  PID:9728
- C:\Windows\System\IQwHuQr.exe
  C:\Windows\System\IQwHuQr.exe
  2⤵
  PID:11672
- C:\Windows\System\IrLvEzP.exe
  C:\Windows\System\IrLvEzP.exe
  2⤵
  PID:9840
- C:\Windows\System\iXSgGof.exe
  C:\Windows\System\iXSgGof.exe
  2⤵
  PID:11752
- C:\Windows\System\RWWRKmE.exe
  C:\Windows\System\RWWRKmE.exe
  2⤵
  PID:10144
- C:\Windows\System\jUDSNXg.exe
  C:\Windows\System\jUDSNXg.exe
  2⤵
  PID:8168
- C:\Windows\System\hDaBwZx.exe
  C:\Windows\System\hDaBwZx.exe
  2⤵
  PID:10440
- C:\Windows\System\HedbcSO.exe
  C:\Windows\System\HedbcSO.exe
  2⤵
  PID:2876
- C:\Windows\System\JKNTwfy.exe
  C:\Windows\System\JKNTwfy.exe
  2⤵
  PID:12208
- C:\Windows\System\dKjJFEp.exe
  C:\Windows\System\dKjJFEp.exe
  2⤵
  PID:7712
- C:\Windows\System\CeqUMGl.exe
  C:\Windows\System\CeqUMGl.exe
  2⤵
  PID:9100
- C:\Windows\System\KImqOeI.exe
  C:\Windows\System\KImqOeI.exe
  2⤵
  PID:11268
- C:\Windows\System\qBxVGTo.exe
  C:\Windows\System\qBxVGTo.exe
  2⤵
  PID:10304
- C:\Windows\System\iaOXgbB.exe
  C:\Windows\System\iaOXgbB.exe
  2⤵
  PID:10532
- C:\Windows\System\agcKvUD.exe
  C:\Windows\System\agcKvUD.exe
  2⤵
  PID:9048
- C:\Windows\System\BxRdvXY.exe
  C:\Windows\System\BxRdvXY.exe
  2⤵
  PID:10196
- C:\Windows\System\ZtXEbtN.exe
  C:\Windows\System\ZtXEbtN.exe
  2⤵
  PID:10684
- C:\Windows\System\ffbZqUI.exe
  C:\Windows\System\ffbZqUI.exe
  2⤵
  PID:11580
- C:\Windows\System\eQmdgfO.exe
  C:\Windows\System\eQmdgfO.exe
  2⤵
  PID:10348
- C:\Windows\System\ETUMGkR.exe
  C:\Windows\System\ETUMGkR.exe
  2⤵
  PID:11896
- C:\Windows\System\uBMSzDV.exe
  C:\Windows\System\uBMSzDV.exe
  2⤵
  PID:11488
- C:\Windows\System\PKDdMdO.exe
  C:\Windows\System\PKDdMdO.exe
  2⤵
  PID:12360
- C:\Windows\System\WDtdJDM.exe
  C:\Windows\System\WDtdJDM.exe
  2⤵
  PID:11584
- C:\Windows\System\ixLqwRq.exe
  C:\Windows\System\ixLqwRq.exe
  2⤵
  PID:5712
- C:\Windows\System\xxPqPUc.exe
  C:\Windows\System\xxPqPUc.exe
  2⤵
  PID:12516
- C:\Windows\System\OnDGflD.exe
  C:\Windows\System\OnDGflD.exe
  2⤵
  PID:12112
- C:\Windows\System\aVPCEms.exe
  C:\Windows\System\aVPCEms.exe
  2⤵
  PID:13340
- C:\Windows\System\sjwXlWm.exe
  C:\Windows\System\sjwXlWm.exe
  2⤵
  PID:13368
- C:\Windows\System\NoAlSWz.exe
  C:\Windows\System\NoAlSWz.exe
  2⤵
  PID:13388
- C:\Windows\System\vgLPttj.exe
  C:\Windows\System\vgLPttj.exe
  2⤵
  PID:13412
- C:\Windows\System\wAqbycx.exe
  C:\Windows\System\wAqbycx.exe
  2⤵
  PID:13432
- C:\Windows\System\XRxtNRw.exe
  C:\Windows\System\XRxtNRw.exe
  2⤵
  PID:13452
- C:\Windows\System\eTulScj.exe
  C:\Windows\System\eTulScj.exe
  2⤵
  PID:13472
- C:\Windows\System\LIlFQCV.exe
  C:\Windows\System\LIlFQCV.exe
  2⤵
  PID:13496
- C:\Windows\System\StAEBlW.exe
  C:\Windows\System\StAEBlW.exe
  2⤵
  PID:11964
- C:\Windows\System\ztgsyje.exe
  C:\Windows\System\ztgsyje.exe
  2⤵
  PID:10760
- C:\Windows\System\oDPIVoL.exe
  C:\Windows\System\oDPIVoL.exe
  2⤵
  PID:11060
- C:\Windows\System\ASirIyJ.exe
  C:\Windows\System\ASirIyJ.exe
  2⤵
  PID:12032
- C:\Windows\System\DKHCSrm.exe
  C:\Windows\System\DKHCSrm.exe
  2⤵
  PID:9708
- C:\Windows\System\NTJhThm.exe
  C:\Windows\System\NTJhThm.exe
  2⤵
  PID:12300
- C:\Windows\System\xcUypdc.exe
  C:\Windows\System\xcUypdc.exe
  2⤵
  PID:8856
- C:\Windows\System\OBdpwUO.exe
  C:\Windows\System\OBdpwUO.exe
  2⤵
  PID:12152
- C:\Windows\System\SqKljSs.exe
  C:\Windows\System\SqKljSs.exe
  2⤵
  PID:12180
- C:\Windows\System\IzQSCkK.exe
  C:\Windows\System\IzQSCkK.exe
  2⤵
  PID:12780
- C:\Windows\System\kvGZaUR.exe
  C:\Windows\System\kvGZaUR.exe
  2⤵
  PID:12888
- C:\Windows\System\elShVcM.exe
  C:\Windows\System\elShVcM.exe
  2⤵
  PID:11740
- C:\Windows\System\xlenBgQ.exe
  C:\Windows\System\xlenBgQ.exe
  2⤵
  PID:13508
- C:\Windows\System\NWpwuZF.exe
  C:\Windows\System\NWpwuZF.exe
  2⤵
  PID:10772
- C:\Windows\System\tkPeAot.exe
  C:\Windows\System\tkPeAot.exe
  2⤵
  PID:9012
- C:\Windows\System\brjTCiP.exe
  C:\Windows\System\brjTCiP.exe
  2⤵
  PID:10680
- C:\Windows\System\zUmpEvy.exe
  C:\Windows\System\zUmpEvy.exe
  2⤵
  PID:13092
- C:\Windows\System\ERIodzz.exe
  C:\Windows\System\ERIodzz.exe
  2⤵
  PID:11148
- C:\Windows\System\zNJnEnR.exe
  C:\Windows\System\zNJnEnR.exe
  2⤵
  PID:12324
- C:\Windows\System\ibvspTf.exe
  C:\Windows\System\ibvspTf.exe
  2⤵
  PID:12396
- C:\Windows\System\kAqrPXc.exe
  C:\Windows\System\kAqrPXc.exe
  2⤵
  PID:12408
- C:\Windows\System\JdlZKOp.exe
  C:\Windows\System\JdlZKOp.exe
  2⤵
  PID:13692
- C:\Windows\System\GAjERbd.exe
  C:\Windows\System\GAjERbd.exe
  2⤵
  PID:12496
- C:\Windows\System\mqaVAYD.exe
  C:\Windows\System\mqaVAYD.exe
  2⤵
  PID:10528
- C:\Windows\System\mKdFbiw.exe
  C:\Windows\System\mKdFbiw.exe
  2⤵
  PID:12580
- C:\Windows\System\iKVlVGs.exe
  C:\Windows\System\iKVlVGs.exe
  2⤵
  PID:12604
- C:\Windows\System\cuvArCA.exe
  C:\Windows\System\cuvArCA.exe
  2⤵
  PID:12656
- C:\Windows\System\gpHjDqe.exe
  C:\Windows\System\gpHjDqe.exe
  2⤵
  PID:12732
- C:\Windows\System\OVruyWo.exe
  C:\Windows\System\OVruyWo.exe
  2⤵
  PID:13796
- C:\Windows\System\jKAtQLq.exe
  C:\Windows\System\jKAtQLq.exe
  2⤵
  PID:13420
- C:\Windows\System\wvMNCHD.exe
  C:\Windows\System\wvMNCHD.exe
  2⤵
  PID:13484
- C:\Windows\System\QXemleI.exe
  C:\Windows\System\QXemleI.exe
  2⤵
  PID:11560
- C:\Windows\System\yjeXjvz.exe
  C:\Windows\System\yjeXjvz.exe
  2⤵
  PID:11800
- C:\Windows\System\YMoAsMD.exe
  C:\Windows\System\YMoAsMD.exe
  2⤵
  PID:12996
- C:\Windows\System\tIYbnen.exe
  C:\Windows\System\tIYbnen.exe
  2⤵
  PID:14216
- C:\Windows\System\ONUsTWU.exe
  C:\Windows\System\ONUsTWU.exe
  2⤵
  PID:13828
- C:\Windows\System\GtVTqCb.exe
  C:\Windows\System\GtVTqCb.exe
  2⤵
  PID:11492
- C:\Windows\System\ZfMNsvk.exe
  C:\Windows\System\ZfMNsvk.exe
  2⤵
  PID:12452
- C:\Windows\System\dSGxVAQ.exe
  C:\Windows\System\dSGxVAQ.exe
  2⤵
  PID:13864
- C:\Windows\System\kqLoDYX.exe
  C:\Windows\System\kqLoDYX.exe
  2⤵
  PID:11720
- C:\Windows\System\POGlEYz.exe
  C:\Windows\System\POGlEYz.exe
  2⤵
  PID:13376
- C:\Windows\System\ybJOikU.exe
  C:\Windows\System\ybJOikU.exe
  2⤵
  PID:14184
- C:\Windows\System\sXAHZzz.exe
  C:\Windows\System\sXAHZzz.exe
  2⤵
  PID:14252
- C:\Windows\System\tcStXXZ.exe
  C:\Windows\System\tcStXXZ.exe
  2⤵
  PID:12212
- C:\Windows\System\cormKNf.exe
  C:\Windows\System\cormKNf.exe
  2⤵
  PID:12776
- C:\Windows\System\lZoRdWp.exe
  C:\Windows\System\lZoRdWp.exe
  2⤵
  PID:10792
- C:\Windows\System\iQLYfVR.exe
  C:\Windows\System\iQLYfVR.exe
  2⤵
  PID:10840
- C:\Windows\System\QJVESmI.exe
  C:\Windows\System\QJVESmI.exe
  2⤵
  PID:14168
- C:\Windows\System\YAfKYNw.exe
  C:\Windows\System\YAfKYNw.exe
  2⤵
  PID:13576
- C:\Windows\System\DEsCKlX.exe
  C:\Windows\System\DEsCKlX.exe
  2⤵
  PID:13440
- C:\Windows\System\hdvKVaO.exe
  C:\Windows\System\hdvKVaO.exe
  2⤵
  PID:14204
- C:\Windows\System\XgoxTRW.exe
  C:\Windows\System\XgoxTRW.exe
  2⤵
  PID:11632
- C:\Windows\System\OSqLMEf.exe
  C:\Windows\System\OSqLMEf.exe
  2⤵
  PID:11516
- C:\Windows\System\QzZLwYS.exe
  C:\Windows\System\QzZLwYS.exe
  2⤵
  PID:13172
- C:\Windows\System\gDYUQAS.exe
  C:\Windows\System\gDYUQAS.exe
  2⤵
  PID:14300
- C:\Windows\System\MzNsqJZ.exe
  C:\Windows\System\MzNsqJZ.exe
  2⤵
  PID:5096
- C:\Windows\System\sDpVGEW.exe
  C:\Windows\System\sDpVGEW.exe
  2⤵
  PID:13276
- C:\Windows\System\segkYby.exe
  C:\Windows\System\segkYby.exe
  2⤵
  PID:12548
- C:\Windows\System\HBViAxs.exe
  C:\Windows\System\HBViAxs.exe
  2⤵
  PID:13480
- C:\Windows\System\rGgxyMd.exe
  C:\Windows\System\rGgxyMd.exe
  2⤵
  PID:14276
- C:\Windows\System\hUVyFkV.exe
  C:\Windows\System\hUVyFkV.exe
  2⤵
  PID:13992
- C:\Windows\System\CiPTrzW.exe
  C:\Windows\System\CiPTrzW.exe
  2⤵
  PID:10404
- C:\Windows\System\rmVgBKx.exe
  C:\Windows\System\rmVgBKx.exe
  2⤵
  PID:12188
- C:\Windows\System\hZLinmI.exe
  C:\Windows\System\hZLinmI.exe
  2⤵
  PID:4732
- C:\Windows\System\AgsvzcA.exe
  C:\Windows\System\AgsvzcA.exe
  2⤵
  PID:12796
- C:\Windows\System\jtkQnzD.exe
  C:\Windows\System\jtkQnzD.exe
  2⤵
  PID:11628
- C:\Windows\System\FrWjNom.exe
  C:\Windows\System\FrWjNom.exe
  2⤵
  PID:9212
- C:\Windows\System\FLmokmZ.exe
  C:\Windows\System\FLmokmZ.exe
  2⤵
  PID:11464
- C:\Windows\System\tdXFFUz.exe
  C:\Windows\System\tdXFFUz.exe
  2⤵
  PID:12932
- C:\Windows\System\ShhrFHe.exe
  C:\Windows\System\ShhrFHe.exe
  2⤵
  PID:12968
- C:\Windows\System\CwOhUQk.exe
  C:\Windows\System\CwOhUQk.exe
  2⤵
  PID:13096
- C:\Windows\System\GfCEqEQ.exe
  C:\Windows\System\GfCEqEQ.exe
  2⤵
  PID:12296
- C:\Windows\System\wLuCBOK.exe
  C:\Windows\System\wLuCBOK.exe
  2⤵
  PID:1076
- C:\Windows\System\uqWziAa.exe
  C:\Windows\System\uqWziAa.exe
  2⤵
  PID:14360
- C:\Windows\System\QJUYUOs.exe
  C:\Windows\System\QJUYUOs.exe
  2⤵
  PID:14388
- C:\Windows\System\JIlCwxe.exe
  C:\Windows\System\JIlCwxe.exe
  2⤵
  PID:14540
- C:\Windows\System\ypYFNQe.exe
  C:\Windows\System\ypYFNQe.exe
  2⤵
  PID:14684
- C:\Windows\System\nCTeAQy.exe
  C:\Windows\System\nCTeAQy.exe
  2⤵
  PID:14796
- C:\Windows\System\xOJnAGA.exe
  C:\Windows\System\xOJnAGA.exe
  2⤵
  PID:14976
- C:\Windows\System\HQtszBn.exe
  C:\Windows\System\HQtszBn.exe
  2⤵
  PID:14996
- C:\Windows\System\AzjMZQr.exe
  C:\Windows\System\AzjMZQr.exe
  2⤵
  PID:15056
- C:\Windows\System\KqwKsDw.exe
  C:\Windows\System\KqwKsDw.exe
  2⤵
  PID:15092
- C:\Windows\System\ooCyppt.exe
  C:\Windows\System\ooCyppt.exe
  2⤵
  PID:15132
- C:\Windows\System\KxjfUMk.exe
  C:\Windows\System\KxjfUMk.exe
  2⤵
  PID:15256
- C:\Windows\System\KCnMXlH.exe
  C:\Windows\System\KCnMXlH.exe
  2⤵
  PID:15272
- C:\Windows\System\XSPHKPf.exe
  C:\Windows\System\XSPHKPf.exe
  2⤵
  PID:15288
- C:\Windows\System\vbpSDqE.exe
  C:\Windows\System\vbpSDqE.exe
  2⤵
  PID:15348
- C:\Windows\System\SzwBWKW.exe
  C:\Windows\System\SzwBWKW.exe
  2⤵
  PID:12812
- C:\Windows\System\ZvlNMMq.exe
  C:\Windows\System\ZvlNMMq.exe
  2⤵
  PID:13792
- C:\Windows\System\LTfcimz.exe
  C:\Windows\System\LTfcimz.exe
  2⤵
  PID:14464
- C:\Windows\System\bNJDQoU.exe
  C:\Windows\System\bNJDQoU.exe
  2⤵
  PID:13872
- C:\Windows\System\ZrJnHux.exe
  C:\Windows\System\ZrJnHux.exe
  2⤵
  PID:14516
- C:\Windows\System\PZqLsBa.exe
  C:\Windows\System\PZqLsBa.exe
  2⤵
  PID:13260
- C:\Windows\System\xbOFRbl.exe
  C:\Windows\System\xbOFRbl.exe
  2⤵
  PID:14028
- C:\Windows\System\TOVYNop.exe
  C:\Windows\System\TOVYNop.exe
  2⤵
  PID:12912
- C:\Windows\System\QIVjHaJ.exe
  C:\Windows\System\QIVjHaJ.exe
  2⤵
  PID:14600
- C:\Windows\System\fHGAPeA.exe
  C:\Windows\System\fHGAPeA.exe
  2⤵
  PID:14548
- C:\Windows\System\kRmXqxA.exe
  C:\Windows\System\kRmXqxA.exe
  2⤵
  PID:14652
- C:\Windows\System\EudvQbx.exe
  C:\Windows\System\EudvQbx.exe
  2⤵
  PID:14604
- C:\Windows\System\mkVDcce.exe
  C:\Windows\System\mkVDcce.exe
  2⤵
  PID:14520
- C:\Windows\System\BvfSStv.exe
  C:\Windows\System\BvfSStv.exe
  2⤵
  PID:14724
- C:\Windows\System\EyMtdoY.exe
  C:\Windows\System\EyMtdoY.exe
  2⤵
  PID:14672
- C:\Windows\System\mypKLxp.exe
  C:\Windows\System\mypKLxp.exe
  2⤵
  PID:14864
- C:\Windows\System\WIOwfbd.exe
  C:\Windows\System\WIOwfbd.exe
  2⤵
  PID:14648
- C:\Windows\System\cbvQvSi.exe
  C:\Windows\System\cbvQvSi.exe
  2⤵
  PID:14832
- C:\Windows\System\wOiopDm.exe
  C:\Windows\System\wOiopDm.exe
  2⤵
  PID:14948
- C:\Windows\System\IDRkIXe.exe
  C:\Windows\System\IDRkIXe.exe
  2⤵
  PID:14760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BxbnNcA.exe

Filesize
1.8MB

MD5
34530fc4adad2759e832bf453a6a1f49

SHA1
691e81d0f4cfe50e6a53a851cf89ee07daeab73d

SHA256
7f617806a0f3231a8a25353c83535ddde6468e5ee4882d488acb1f7b46bfcb37

SHA512
5ae454ee347ba693892ee7a5986b747d062cf3a1eb4b3a75f48e087461532ec18e5ba8b4c3a887e0dbbd2ee4d27bbeb0946a0d2d0a5a88e9660c2733cdab017e

Download Submit
C:\Windows\System\DwCvpSA.exe

Filesize
1.8MB

MD5
ab07ea256ae632c22314ee34dc2daa16

SHA1
1c372d6c03dd92a8b70b9a9c9ed9603dc8be6c06

SHA256
72dedc41da379ad9004bfcca9dbdaaffbb37ce88ea96ee93c4fa969cd16e83f8

SHA512
a227cced33b496e1a348816f2fad96c43cce6297cb1bfa3fd7a57035a1b094a4e02fff649583a39cd0c58bfb1cd01c888c31ac3a6107304b0c47868e542ed5f0

Download Submit
C:\Windows\System\FpXvmKd.exe

Filesize
1.8MB

MD5
bdfb2239d825da429d6a61de0262c36b

SHA1
ecfd786405bbbf121d297723b8005f83bc631501

SHA256
41cf340e6fde2c06a7d7705ebc45487d7a816f1f1ace82ada4a17e0aadaa8eb3

SHA512
d83f882a2f215e9ea56517ac5e7c5af033b3aa5048979abe831b977f721724ee1515e8a2571240fc4cfe7abf0d8c2713f89e98c0b4397292d64bac7b4fc097f7

Download Submit
C:\Windows\System\HkKPlUw.exe

Filesize
1.8MB

MD5
f10fc7e0603f7d49c108087b589b42ec

SHA1
c9bb16fb802274d868c70a22eb2e8d455136a0e5

SHA256
32bfad8fa510b8cd69f1eddb6c86c0ee81eb670cf52b469f1e320a557309a8c0

SHA512
009579878db9d45241b1b7ca905ab53a2f616e2483f2546b35d41f85ec0da1029463f20540a99ffb22d49a2dc981a7b8ee40ef3a7cb23a4bde427b9afbe18ec9

Download Submit
C:\Windows\System\JshKPWb.exe

Filesize
1.8MB

MD5
697524e444a16fab1d44e55098c8e3ef

SHA1
ad1f0aed54935128b5bfc570fb04d45a70adb7b0

SHA256
e8ed76f2670e943daa4091f95dd4312755f4206fe6db709e70a843760a1a0771

SHA512
b3b91e3819731091eef7f9aff6a00279d047fa4eb3cbc5bd3e1104a01b5658a66c5c0fae2a0577d3c54628f4ff9b3f9db934ac820c970139e9cd480a5758fc6f

Download Submit
C:\Windows\System\NGoRWlj.exe

Filesize
1.8MB

MD5
2e2720f2759dc6168cb59e431ce0b3e5

SHA1
4a05bd802f2393ce73996203d266aabd6fdf5f06

SHA256
4abcd7a1fa8be29aabe124795ee89f1e84b29d826bf4551762cc2b7dc741fd4d

SHA512
db2bcc36a8fea3a1e233c0a5070d2ac9d1d480c4b58fb9195180f89a22e5d062f8ed153295bc9bd9c4348752e59595f146fbc2c997ca37ab7cf5c37512986c1c

Download Submit
C:\Windows\System\NmPMIoe.exe

Filesize
1.8MB

MD5
7632605d44dc282cd1e0fae5082b9940

SHA1
a2591b8a63b50b77b243208e4c44ca910b184fdb

SHA256
182390c26fbecee88668b097718bd3906480dc8aae7da0ebeb8c1eed83711a16

SHA512
e0511b5c523970c3a3b69025befa3612cdc8e3ea297c7bef3790f3bdb35c3f48343891b0eec885d952d9febe092b7873074252f5f4c9a449ff55b79ae57a6ef7

Download Submit
C:\Windows\System\NnzJpyF.exe

Filesize
1.8MB

MD5
f8eade71543e118c5580d2f13a3bdba7

SHA1
1af07837a199c6fe58563840139266686cabd81e

SHA256
3c110f544d14cb68ef5a48f0292522ced0bf3ba078c8e7305583a09aa7960db5

SHA512
7e0ef32f36751f12a51bb80e85d4720c4ab6212b8648dfd57a2851e581962d4018af896829980bfa5ee66e32f07da8798bfd84421da4dee578461571f9e1cbe5

Download Submit
C:\Windows\System\OXBnHeX.exe

Filesize
1.8MB

MD5
f8ed391afa3426c2b92fd140bbf85c43

SHA1
aaa52dc1253eabe36f2d87dae3cb7e1285129fe4

SHA256
402b71e57610602c4848ab18fc14a55670ecdbd42ff7e5ad63674359a6ee3cd8

SHA512
1061450053bd5212304a34f68bcab7c864681a93030f7475c86df2863edf9edcae401df49a5d49c58df21c0cddd187dbd2f6c1bbd32fafb0a13aea3198c38ac1

Download Submit
C:\Windows\System\PdcrcXd.exe

Filesize
1.8MB

MD5
2a46a157e6e9f93df3039712a9c97cf2

SHA1
3e959f1c47d541bdb4f99b0f72bae4e7898250d8

SHA256
181e92ec851e9a3bc235d8e036b90b6e41620f00fd887d83a0001d15247cbe59

SHA512
d69670747c507d852ddaf8da2a96f63f98e9235601f1cea3330a939848cb4a810ac2c3e991761a43ea9fd720c6f55f637e552ca8a748504fb6cfd2c10327afc2

Download Submit
C:\Windows\System\RGlauLI.exe

Filesize
1.8MB

MD5
15b3b3e2ffa1e06b82891f6edf1afcf9

SHA1
28e33201f13747936339ddcd360b9844cb48773e

SHA256
002bb56decf36323cec57b5d6ac862984269a6331e7d2766e8a6384bac72e876

SHA512
c1536525c50a695a13d20cf89b7d3ba4aaaff2fd56f1fe7ffe4c6213080c6e8d67b34dc735cc7b384d1049d6b18a146f3a0db0a22ebb1f9de45b93af46f04d73

Download Submit
C:\Windows\System\VqFECoA.exe

Filesize
1.8MB

MD5
b0bf7ea04e06fb82e2de513b7e0bc31e

SHA1
6c00da5f4d1afc9405ff523b787434978b097769

SHA256
b0543e783eedf89dd2d3a4b2a0af05115f104387f20c55356be42fd119be999a

SHA512
a89bcfb2780a42f30382e693d02b863f9547939d05561b8de67a7f07c443f6f4ba1038a2d3bbeef3ac2cffe63ad72f9d93b9fac49b270caf1c884f1d72345004

Download Submit
C:\Windows\System\VqLJzBf.exe

Filesize
1.8MB

MD5
1017b9ae94900a6c0539b2602a36e17b

SHA1
ceed0f4247f2a9a59d542bc66503f5caee0a4199

SHA256
0638142402c27318f11b3c475371f0a47fb659b4d676991e30451c4439a867d6

SHA512
80fd1eba4e4e35c1f559d8d387e8751480a8a868e90d6d754a1a35384620b3681eb217e76d2192a46ae61388d8f4bd5368ede8ce35a74187d631425aa0d22e18

Download Submit
C:\Windows\System\XpPSenD.exe

Filesize
1.8MB

MD5
157257c5d429b3fdc09981fec359756c

SHA1
213d9b6064626a333e8ef4c99015d3e414b7f15f

SHA256
13008d9e5079df239da3d1972365db5bb6c5b8d41c3e4a171807a7bd2b6af032

SHA512
46dd4fcb307824a4b028577468d722758c3117c97396dad39c2aad11bf17975889bdf2f3093a70ed19e98858a28bb694966a5cd5ce7cda36db1e7e94313ab82a

Download Submit
C:\Windows\System\YZOtEHf.exe

Filesize
1.8MB

MD5
cd5699874e29c6142126cace9264b195

SHA1
0f8301eb8b2197f5a3597a5e928fcff17ea9d1ca

SHA256
6de43cd1f6a398e85e5d31fc92cf39c7c1c1fbad68f7dde9fe4e72790b67eed5

SHA512
c826c5fbd301aa5a5dbb0789c36f4e5f6ef4de9bf42b1bf4454813599bb8d5135aab762a3ec7265e25ad4823ffe60501a79115c02b764f12d1a37eeacd85cede

Download Submit
C:\Windows\System\bpDgamK.exe

Filesize
1.8MB

MD5
76d6c034ae0cfa133bd411c24290407a

SHA1
e5ddf95b4fbd6372f3881c84a9aa293966ed6dda

SHA256
194cefc2a2758ebb550cae354a63bc0dcad1a095ddf97585b8039ddfb323930f

SHA512
74220b55fe354997fc8e9a82929d25df24e6dc37fbac51bb49ddd44b2ad3a9a58c9811e894c246d5c634864d9f3d7acd8c10eddd663ce5a0befc32a04bfc4adf

Download Submit
C:\Windows\System\cxBhYqY.exe

Filesize
1.8MB

MD5
3e3e08625b67eb527d18caa803e66bce

SHA1
3f5990c7d50385332af611f0cf1d931d15477a2a

SHA256
1c1e1a94ef63f27b61a66f754aef6c141e17e380f80b116cf0d1788f20d887b1

SHA512
49d248a8ed21e376068683506225d2f5fc1a9dc5c7c6f0baa2cf2486490640e85ef90d9b67ec5cc968a2244f6da3b0f8a977c0f654b29c0a9c69986951d39a59

Download Submit
C:\Windows\System\dWXoIxy.exe

Filesize
1.8MB

MD5
6327a51a516b9be7130aa7de4887fa23

SHA1
ab12d918f946d7b883d0bb902e570ff4533406ec

SHA256
a7bc9ff0b79c974c74d6cd00650f5f9433ba6b581129c87e3846b95689acfce0

SHA512
1395e6cf1b0b2c8eaabafac5d10debaa053d50c348b4ec08934f503e4cc93f9e9473fde83e18befb7e320ebdb23ec69eb56a64dfcdfd498f171050d10cda884b

Download Submit
C:\Windows\System\ddXvDWv.exe

Filesize
1.8MB

MD5
abe7c939295c931d9fb69d6a72bf003a

SHA1
ec694fad5e075086e74cba1f4ccbf8680aa3b4c7

SHA256
77721d57d4c49eab1c774494f65e864d6ac31326a17540364bf569a7413c0b06

SHA512
f6cd2513c9ab20569546f68dc8812418e1ef4b85222546fef32bd9edd4140e865f3627feb67999976f201a5e02bf75b8a8a949aa0fbca8310f09a7c40e11f6a9

Download Submit
C:\Windows\System\egPqhtL.exe

Filesize
1.8MB

MD5
404deee0f44e6695ac9aa050f6618ec5

SHA1
ccf509b612ce17f179486ada11f25981ada11c46

SHA256
dae042933a1b13bd5f3bbf6e5613e27df9be7e27d7a5a7ffa3799161bb8f798a

SHA512
f80e3f9587543f58fd85816e17553157fe1be2282d8e5e79da8555c196fd468eab5257b96979afada0a41d7c2d39ac26e60caa35a08af9309317cb56d488a0d7

Download Submit
C:\Windows\System\exlSnqa.exe

Filesize
1.8MB

MD5
a8fa8c20c89aeca5f470e6d558a1eec1

SHA1
14d27d2bc9a04f80bf688a4b768024d1efb939d8

SHA256
3976feb8f1d5fe0149264cfbe99e269808f728c0b6b32e750b414e9e342665e8

SHA512
243667e86ca3e9f10a88dbb9a03ac6dab0148470f50984f49f4a3a6234865a38154f5660c98f5b9f9f4331c26377ae82f00200145b1f2a922a24c0af9618e46c

Download Submit
C:\Windows\System\gflrDVc.exe

Filesize
1.8MB

MD5
81933dab25a3718e043640418b96722b

SHA1
fbda529577a23f9c2f55a13ba3587574741e299c

SHA256
bf6f78ed220df3afb7b63d004827373ce23b3e03e0923adf1a87af62947ca576

SHA512
d5fc68376ea87454066a765d7cf219a069423e668f20fa79ab25644d97849163c19f87dd082818296f8da42ff800a4f01fce162ea446cfe67a05c0ad5c803120

Download Submit
C:\Windows\System\gzaTIJB.exe

Filesize
1.8MB

MD5
1179ab5b9a3f12ffafcd5c50923cb9cd

SHA1
ac2f916b5babb79616a5d0154539101f468a5236

SHA256
7324e04c78ec28d0453571fb6343ec26a7019c41de3455600c699489f91b0a7b

SHA512
fc8596a27d0bafb164efe793209eab382516ef0509a31c25c2f9ad34ec03348d0edd776587e9408c935d465fdc1a5b07bfbb2f5e18ef6758e290b29d5c6f63ad

Download Submit
C:\Windows\System\iFplsKu.exe

Filesize
1.8MB

MD5
fc4ed9e46ad57291a2253aa630b02183

SHA1
cc8557fa7c34b3551efa1bcc4ac576c4b284a966

SHA256
d78a681ddc0706f427c47d9975d26abc3a01ab71d45e0c9155ef4467708bf52c

SHA512
5a73f0421a00613caf0a72b22ded0cf98169d4988f1fc7feecfe68f427b7581a32dd62aec1968edc372f83cdce248c6f548845b5f594b97962050c4c5ee2476a

Download Submit
C:\Windows\System\iKiMVwW.exe

Filesize
1.8MB

MD5
06b9aaeed534a3c078524db6ed4ec067

SHA1
89ee3613e4f3579d644a4edd6488e05da312b932

SHA256
8deb753966d4a309f08f57348b18876a7afd786e494368bc67931e3a9e6acbb0

SHA512
cb8a64d7897b5bf0ca915f30eec71d21ba90ede0a3e8bc893e9ceddbb2999d73e3d6f8c8ddc5524050f54f526d4858ef1f8ad376d989492c36e5af1a52103e78

Download Submit
C:\Windows\System\nMdTSiw.exe

Filesize
1.8MB

MD5
31dd5d71156b178cbf80b9262dd3727f

SHA1
22bb4fa33074c60e96421016ed61873ff7e08d13

SHA256
1d0f61c715a89b9fce550bbaf6ac9d26668b70d46780ef372fce9569f86da9e4

SHA512
c6aaa1b9c1ab969a1b93c9a4086ebd6022474cbe3294c00e085a7a8851a7881165f5bc796f22757128c770cde184266e001335b68a51bce64aa00628480a6e08

Download Submit
C:\Windows\System\pGQOgxE.exe

Filesize
1.8MB

MD5
3c2565c1451746f4c1d158f98e6277e8

SHA1
4623df0da3f20210b20dd7756fbf2e5c6cedd489

SHA256
b902b03059950c1362cf910140a9cd198639a22a69a9d23fdffa735931d8b6e4

SHA512
ecda7079d143e81a6eaedf172e6d43353d665151056ced074b82d945e6dccb64957603c049320bc55e035b0e5bf6757b1f4fa996d4c8d8850a900f5534296f51

Download Submit
C:\Windows\System\pJtvMuu.exe

Filesize
1.8MB

MD5
46dfd1fe9985b628aee83edf55c6c230

SHA1
0622b6a8bb44f13b916a5fc22b5a8e66b0f3e4fc

SHA256
f20c89cdf0fdf63829f3699411b3e901d247d22042edfb61949c5a50adfdce37

SHA512
10cf6e0a25d9cb688c5948aeb0c7a626f6fc5e51026aa2772516b6b2ee2df8f8b308b6535ca38cf6abe17985f28291e8f82e1e9964a528a1069642f3f9d43449

Download Submit
C:\Windows\System\pNsoAmq.exe

Filesize
1.8MB

MD5
38ce35a1d8f23359fcc422ee5c89a240

SHA1
34d9383fa3f723a7387a4b6df7b75e3276177436

SHA256
5021d27dca70d91bdffe7cfe2fbd0e73dfc865dbbcae143bbeee28597d96008f

SHA512
406059648c47808a1e614b9cbdb89fabafc5db9888d8c2bf11388c01ceacee0f67cac648183a0920d296861a2bf748029577cd3e33d8249e380fbaaa1ae9e7b6

Download Submit
C:\Windows\System\pbYTqHD.exe

Filesize
1.8MB

MD5
c8414ad98a8661a7b598e5ed869e13e1

SHA1
f6233bd716e828cfe57809e40e586a81fb96ea10

SHA256
5c64223b7af0949ca78bd31cdf4e8e96f8deca45c6021cc07c4291f25e979eb9

SHA512
8fdb85c8bbe3905557cbc3ed18b884a65114ca314f546a97020367a1bdb30d6de5b2bd74e466a96ad59f5d6b0c8aebc502cea8cf4b8dc8174b1f7ae34bd738b8

Download Submit
C:\Windows\System\pomhQEQ.exe

Filesize
1.8MB

MD5
3f44f32ae5b080fdc3ab690cbd36ce61

SHA1
58784dbe060e4393da7fb3a0284ada7de6d3e84d

SHA256
6463b4b79b33ab1e0654d68e2a143fecd7c841ae89d230edb601738e4308766b

SHA512
879c07ea8d6aa4075be500d5b27c8b03388490ab4f4d893a3c3f717c61025936ed76a1a20e0752781104b959da459e2639140fed16c2fa70cfaf27cee9814d54

Download Submit
C:\Windows\System\qhWyTmS.exe

Filesize
1.8MB

MD5
215d29d7c6c074e23251958db0bbba7d

SHA1
acfe12f456ae9780003037ff1d40e0970cd5041a

SHA256
45862ae8674002d0cffb3619e95666712b3be53425833a0cf88ce528ad67b15b

SHA512
6e06b5bc1ff790f0ea0f85fca27bea23a11bcf0e4e74e53ee7f3efce253c204798b46e0df5ee0c73e42a81f5c045a3913e18d1561e2b7cd344e896e793fd344c

Download Submit
C:\Windows\System\sVJGTei.exe

Filesize
1.8MB

MD5
81378a0ea4ed6d895a81a6c5e5aab975

SHA1
e082af7138de09575d0c947047c10ac38f72c40b

SHA256
e805b2a75a2fba8d91f5e9542b3e5f61720e986cf0f4df2a8b7e14af6bd92d20

SHA512
dd88e886a80f0796bb02ee9ecec81f964ea7db63ce6893267b21913d705779c9abfa398ebde80ea443e08f4b9daeef69252905bd66e51b505dec90762da3476f

Download Submit
C:\Windows\System\vHBqSav.exe

Filesize
1.8MB

MD5
c48da2f3df73e5c4f0db6191a5b43683

SHA1
080daa52eeb470ff524550fdc49116769958b04a

SHA256
677eabb1276b19c79c1debb5b0ed829dd15ffffae3edee54b5162570ac04de96

SHA512
465ede81a0c9a893386bf88d05be941ae73e05d4ff88a567f6a440a406c4acd92789b023f4720de3c4a7fc982ee3efe463e150269b5007eccd598b6f94ab5a3e

Download Submit
C:\Windows\System\wQRaYsT.exe

Filesize
1.8MB

MD5
54219e65894ee67da44a831da53fb2d4

SHA1
cac6b9aef2b5018fc69b6733935df02939a0d3ad

SHA256
a8e82d448437ae4f241d68b812c4f4b7734797921f35c24becf9dfe1fe032615

SHA512
763ed67f071bf289de8da366dcaff87796083504dfcc4a220d75f5cdfe993eb6b4f498315586de8eb04f1b5868f076ccbf3c79706168f3322388c5f37da5213d

Download Submit
C:\Windows\System\wxqJAei.exe

Filesize
1.8MB

MD5
8778085263407dc1365e1125c9ca6109

SHA1
4f05a2a83dc4bae2211c1093ffca411859866940

SHA256
197f33822b5974a446648f6128b401a822d93c12d30e22b6e834a2740ca8570e

SHA512
0a8be7b9b358611a6ecb92d54edbf955edfd3b119bf4644781ae7aa10a47ab9cf7ebe9628c8a8c2d6dad9eea0bd247bd51be711bf4d37eec00c5a70c9611d843

Download Submit
C:\Windows\System\xlBREPe.exe

Filesize
1.8MB

MD5
1881fea5ba88ffcf421efe99d1f15cc0

SHA1
486d86bec62f9db9a2c294d90863d9ffe26fb0ed

SHA256
83ff7b7540db0c092f9a43e5096ee8a448cfec7a89e26c1ea7945a1a2bfe7af0

SHA512
4ad6887b28089e3c7a9ba99244a64d1c7330977c8d081e1a68e243430a970f8a650c330574ca6814db2372664a060d0820037c918a6541e882d654e7a0a12a6a

Download Submit
C:\Windows\System\yPcwSFJ.exe

Filesize
1.8MB

MD5
30aae058b2d082f81f6697f38009b912

SHA1
32f884508bc5011efbcf939f829422cdb90edcf8

SHA256
e234c8163dd1911b95f26b4237dceb9977077423ff01416b3b09972ec8fdc81d

SHA512
16b5ec59b516eed14e5541dca60c8bd4857ba9f72afd12e9a1c7778d3f6bdad4342243be119425c824240a2f99a141269f992333ab30a2598816e616e3b90068

Download Submit
C:\Windows\System\zSeEePB.exe

Filesize
1.8MB

MD5
0af4566577a60ffc80fcc9714617ad7e

SHA1
5c426b62a60997f2e3862e00ca1109049bfdbc7f

SHA256
3c297be24d5ebc46af4eb71ede1ca2b2eafd3347779f65edc89e33a2ba9f67a1

SHA512
1455f8939834e154e1945292b3c5817cbc8a641e26b41b34bca0f5b41312d4f77e908166c0302c330864901cb61cdf0f3c08c4236326f485d8c8f8889861972b

Download Submit
memory/228-284-0x00007FF70FE50000-0x00007FF7101A1000-memory.dmp

Filesize
3.3MB

Download
memory/228-2737-0x00007FF70FE50000-0x00007FF7101A1000-memory.dmp

Filesize
3.3MB

Download
memory/452-46-0x00007FF768640000-0x00007FF768991000-memory.dmp

Filesize
3.3MB

Download
memory/452-2308-0x00007FF768640000-0x00007FF768991000-memory.dmp

Filesize
3.3MB

Download
memory/452-2681-0x00007FF768640000-0x00007FF768991000-memory.dmp

Filesize
3.3MB

Download
memory/656-2339-0x00007FF615EE0000-0x00007FF616231000-memory.dmp

Filesize
3.3MB

Download
memory/656-2695-0x00007FF615EE0000-0x00007FF616231000-memory.dmp

Filesize
3.3MB

Download
memory/656-69-0x00007FF615EE0000-0x00007FF616231000-memory.dmp

Filesize
3.3MB

Download
memory/712-2689-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp

Filesize
3.3MB

Download
memory/712-2341-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp

Filesize
3.3MB

Download
memory/712-73-0x00007FF6AC9C0000-0x00007FF6ACD11000-memory.dmp

Filesize
3.3MB

Download
memory/760-290-0x00007FF602670000-0x00007FF6029C1000-memory.dmp

Filesize
3.3MB

Download
memory/760-2734-0x00007FF602670000-0x00007FF6029C1000-memory.dmp

Filesize
3.3MB

Download
memory/780-2731-0x00007FF7093D0000-0x00007FF709721000-memory.dmp

Filesize
3.3MB

Download
memory/780-166-0x00007FF7093D0000-0x00007FF709721000-memory.dmp

Filesize
3.3MB

Download
memory/780-2370-0x00007FF7093D0000-0x00007FF709721000-memory.dmp

Filesize
3.3MB

Download
memory/1016-374-0x00007FF7C9C50000-0x00007FF7C9FA1000-memory.dmp

Filesize
3.3MB

Download
memory/1016-2698-0x00007FF7C9C50000-0x00007FF7C9FA1000-memory.dmp

Filesize
3.3MB

Download
memory/1156-2706-0x00007FF780910000-0x00007FF780C61000-memory.dmp

Filesize
3.3MB

Download
memory/1156-169-0x00007FF780910000-0x00007FF780C61000-memory.dmp

Filesize
3.3MB

Download
memory/1168-2735-0x00007FF70CFB0000-0x00007FF70D301000-memory.dmp

Filesize
3.3MB

Download
memory/1168-289-0x00007FF70CFB0000-0x00007FF70D301000-memory.dmp

Filesize
3.3MB

Download
memory/1372-2690-0x00007FF6B61F0000-0x00007FF6B6541000-memory.dmp

Filesize
3.3MB

Download
memory/1372-366-0x00007FF6B61F0000-0x00007FF6B6541000-memory.dmp

Filesize
3.3MB

Download
memory/1976-208-0x00007FF61C130000-0x00007FF61C481000-memory.dmp

Filesize
3.3MB

Download
memory/1976-2702-0x00007FF61C130000-0x00007FF61C481000-memory.dmp

Filesize
3.3MB

Download
memory/2088-365-0x00007FF6EAA20000-0x00007FF6EAD71000-memory.dmp

Filesize
3.3MB

Download
memory/2088-2685-0x00007FF6EAA20000-0x00007FF6EAD71000-memory.dmp

Filesize
3.3MB

Download
memory/2256-381-0x00007FF61C150000-0x00007FF61C4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2256-2765-0x00007FF61C150000-0x00007FF61C4A1000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2306-0x00007FF682190000-0x00007FF6824E1000-memory.dmp

Filesize
3.3MB

Download
memory/2344-35-0x00007FF682190000-0x00007FF6824E1000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2697-0x00007FF682190000-0x00007FF6824E1000-memory.dmp

Filesize
3.3MB

Download
memory/2368-278-0x00007FF7BBEB0000-0x00007FF7BC201000-memory.dmp

Filesize
3.3MB

Download
memory/2368-2767-0x00007FF7BBEB0000-0x00007FF7BC201000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2728-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp

Filesize
3.3MB

Download
memory/2508-340-0x00007FF72A0D0000-0x00007FF72A421000-memory.dmp

Filesize
3.3MB

Download
memory/2588-17-0x00007FF65B990000-0x00007FF65BCE1000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2302-0x00007FF65B990000-0x00007FF65BCE1000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2678-0x00007FF65B990000-0x00007FF65BCE1000-memory.dmp

Filesize
3.3MB

Download
memory/3084-2687-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/3084-102-0x00007FF65F860000-0x00007FF65FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/3176-137-0x00007FF75CED0000-0x00007FF75D221000-memory.dmp

Filesize
3.3MB

Download
memory/3176-2704-0x00007FF75CED0000-0x00007FF75D221000-memory.dmp

Filesize
3.3MB

Download
memory/3212-2730-0x00007FF63EE50000-0x00007FF63F1A1000-memory.dmp

Filesize
3.3MB

Download
memory/3212-292-0x00007FF63EE50000-0x00007FF63F1A1000-memory.dmp

Filesize
3.3MB

Download
memory/3484-2693-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp

Filesize
3.3MB

Download
memory/3484-52-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp

Filesize
3.3MB

Download
memory/3484-2337-0x00007FF66FD90000-0x00007FF6700E1000-memory.dmp

Filesize
3.3MB

Download
memory/3724-2682-0x00007FF7576F0000-0x00007FF757A41000-memory.dmp

Filesize
3.3MB

Download
memory/3724-341-0x00007FF7576F0000-0x00007FF757A41000-memory.dmp

Filesize
3.3MB

Download
memory/3852-2700-0x00007FF6A7A10000-0x00007FF6A7D61000-memory.dmp

Filesize
3.3MB

Download
memory/3852-372-0x00007FF6A7A10000-0x00007FF6A7D61000-memory.dmp

Filesize
3.3MB

Download
memory/4024-1740-0x00007FF632F10000-0x00007FF633261000-memory.dmp

Filesize
3.3MB

Download
memory/4024-12-0x00007FF632F10000-0x00007FF633261000-memory.dmp

Filesize
3.3MB

Download
memory/4024-2676-0x00007FF632F10000-0x00007FF633261000-memory.dmp

Filesize
3.3MB

Download
memory/4360-2746-0x00007FF7759E0000-0x00007FF775D31000-memory.dmp

Filesize
3.3MB

Download
memory/4360-325-0x00007FF7759E0000-0x00007FF775D31000-memory.dmp

Filesize
3.3MB

Download
memory/4764-2754-0x00007FF620DA0000-0x00007FF6210F1000-memory.dmp

Filesize
3.3MB

Download
memory/4764-217-0x00007FF620DA0000-0x00007FF6210F1000-memory.dmp

Filesize
3.3MB

Download
memory/4880-2729-0x00007FF7C0D60000-0x00007FF7C10B1000-memory.dmp

Filesize
3.3MB

Download
memory/4880-237-0x00007FF7C0D60000-0x00007FF7C10B1000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2741-0x00007FF622900000-0x00007FF622C51000-memory.dmp

Filesize
3.3MB

Download
memory/4904-373-0x00007FF622900000-0x00007FF622C51000-memory.dmp

Filesize
3.3MB

Download
memory/5072-243-0x00007FF6C77C0000-0x00007FF6C7B11000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2739-0x00007FF6C77C0000-0x00007FF6C7B11000-memory.dmp

Filesize
3.3MB

Download
memory/5104-1-0x00000251465B0000-0x00000251465C0000-memory.dmp

Filesize
64KB

Download
memory/5104-0-0x00007FF65FC20000-0x00007FF65FF71000-memory.dmp

Filesize
3.3MB

Download
memory/5104-1737-0x00007FF65FC20000-0x00007FF65FF71000-memory.dmp

Filesize
3.3MB

Download