xmrig | efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
Size

1.3MB
MD5

d183910b2c16bd8e22af5c576328dfd3
SHA1

143a20ffb420cb49e0c856ec8f8afc29475556a7
SHA256

efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102
SHA512

354cbeffb8b36a3f7c7b6a4b16cb80d331acc71beb8a1f3597b26b2fede7507926c19f9672d9219068f3f86bd0ce95fe397e3114326ebd9cfe276db69d5efe92
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nesD7H8:GezaTF8FcNkNdfE0pZ9ozttwIRxA1sH8

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012264-2.dat	xmrig
behavioral1/files/0x000900000001756e-6.dat	xmrig
behavioral1/files/0x0002000000018334-8.dat	xmrig
behavioral1/files/0x00060000000186bb-19.dat	xmrig
behavioral1/files/0x00060000000186c3-25.dat	xmrig
behavioral1/files/0x0007000000018b05-29.dat	xmrig
behavioral1/files/0x0008000000018b28-35.dat	xmrig
behavioral1/files/0x0008000000018b50-37.dat	xmrig
behavioral1/files/0x0014000000016fc9-47.dat	xmrig
behavioral1/files/0x00050000000195c7-59.dat	xmrig
behavioral1/files/0x0005000000019643-69.dat	xmrig
behavioral1/files/0x0005000000019820-87.dat	xmrig
behavioral1/files/0x000500000001998d-94.dat	xmrig
behavioral1/files/0x0005000000019bf5-100.dat	xmrig
behavioral1/files/0x0005000000019bf6-104.dat	xmrig
behavioral1/files/0x000500000001a049-154.dat	xmrig
behavioral1/files/0x000500000001a0b6-159.dat	xmrig
behavioral1/files/0x000500000001a03c-149.dat	xmrig
behavioral1/files/0x0005000000019fdd-144.dat	xmrig
behavioral1/files/0x0005000000019fd4-139.dat	xmrig
behavioral1/files/0x0005000000019e92-134.dat	xmrig
behavioral1/files/0x0005000000019d6d-129.dat	xmrig
behavioral1/files/0x0005000000019d62-124.dat	xmrig
behavioral1/files/0x0005000000019d61-120.dat	xmrig
behavioral1/files/0x0005000000019c3c-114.dat	xmrig
behavioral1/files/0x0005000000019bf9-109.dat	xmrig
behavioral1/files/0x00050000000197fd-84.dat	xmrig
behavioral1/files/0x0005000000019761-79.dat	xmrig
behavioral1/files/0x000500000001975a-74.dat	xmrig
behavioral1/files/0x000500000001960c-64.dat	xmrig
behavioral1/files/0x00050000000195c6-55.dat	xmrig
behavioral1/files/0x00070000000193b8-45.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	CLqswtD.exe
2860	TuSxDod.exe
2980	bYIQzyD.exe
2872	aXVOnGA.exe
2072	nWKOVAe.exe
2832	EETfmpU.exe
2804	ziduwnn.exe
2716	WlQxzYx.exe
2760	FAvcGpD.exe
2552	gcebLkj.exe
2268	ZRayMvl.exe
328	muTLcoV.exe
1576	nnLtmCJ.exe
700	SWGZjXt.exe
1740	PVZsrcw.exe
828	zWutjjf.exe
2816	lgMpAIK.exe
2924	FioUAly.exe
3052	AlENahR.exe
2932	zZxxvOL.exe
3064	kCDyWDe.exe
1360	EsZWQlB.exe
892	zBBvfDk.exe
2504	xWqXdyS.exe
1636	MEsFiCX.exe
632	bzgbFcw.exe
1820	gpigVBF.exe
2480	vwWoixc.exe
468	fjMbSzz.exe
2452	BPbisPQ.exe
2328	amIIFvT.exe
572	VZFsWkB.exe
316	TMuqRGY.exe
1944	JbMpeVv.exe
580	NCyqvRX.exe
1688	iRfrDBf.exe
2616	pfcJQrE.exe
604	ZTeGuTc.exe
2168	zOrVcmI.exe
2204	TySriRR.exe
932	AYjWhbS.exe
2384	tyVzeCS.exe
2540	UVLyAPg.exe
1512	unteRHf.exe
1916	FxplMmI.exe
964	klQqIkR.exe
1364	jKRCfCt.exe
1660	rioKKti.exe
540	lAszncK.exe
1288	vOxDyiK.exe
916	lYqnsAZ.exe
264	ibvjfRW.exe
2340	pDjABnf.exe
1760	WpYBTCA.exe
2392	hWzcurV.exe
2260	OfrYfRI.exe
1696	AfWlaXH.exe
1716	GAJaHmY.exe
1092	ATsvHtp.exe
1876	Esectkv.exe
1536	AsBmIul.exe
1744	mTamxxk.exe
2424	PizNwfH.exe
2972	nJxFFba.exe

Loads dropped DLL 64 IoCs

pid	Process
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\USgTrJF.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\PEjrVwn.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\iZGisGz.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\vHnPwFA.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\GkRLuvu.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\FpAxWdn.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\sUoloyz.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\FZvQteJ.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\shwbIHh.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\zXuDduU.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\Wcmzjha.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\cPmHNgj.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\fZYNObS.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\eTlFOpt.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\yzXQZZC.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\HzGjOrt.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\NUvicaH.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\pUeleQx.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\Fmuuwaa.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\HtJcRZv.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\OCDZbLN.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\FMamgtE.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\gwBiBzl.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\fBudvBF.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\VDLoOHH.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\QNfkIrl.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\fIYNDEr.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\aIEDSLP.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\kxQFELc.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\KMZhRAF.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\XWqmPUA.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\KRYzABE.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\PGpzPNR.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\EbnCeLn.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\BGRYXuV.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\YkZiKfi.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\kwrbpMC.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\GaQxPUy.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\PpyFNfd.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\TdwNgEN.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\gWpyIyQ.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\IxzmVMi.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\togVDei.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\hUTbItz.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\LrARQdi.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\JGGZRqW.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\ZJSQkaW.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\dTaIWWe.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\pdRvwQG.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\FRZUbmG.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\IZiLauI.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\zIAmVcb.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\kPWgOBT.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\LuJStlq.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\nCUFeLu.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\RlDfQam.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\jEIikRW.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\pMWSeLK.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\WpYBTCA.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\vXXWTid.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\fZuPGdc.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\GXhYvxW.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\FNvyRuZ.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
File created	C:\Windows\System\lOaAtIf.exe	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2236	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	30
PID 2536 wrote to memory of 2236	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	30
PID 2536 wrote to memory of 2236	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	30
PID 2536 wrote to memory of 2860	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	31
PID 2536 wrote to memory of 2860	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	31
PID 2536 wrote to memory of 2860	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	31
PID 2536 wrote to memory of 2980	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	32
PID 2536 wrote to memory of 2980	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	32
PID 2536 wrote to memory of 2980	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	32
PID 2536 wrote to memory of 2872	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	33
PID 2536 wrote to memory of 2872	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	33
PID 2536 wrote to memory of 2872	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	33
PID 2536 wrote to memory of 2072	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	34
PID 2536 wrote to memory of 2072	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	34
PID 2536 wrote to memory of 2072	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	34
PID 2536 wrote to memory of 2832	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	35
PID 2536 wrote to memory of 2832	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	35
PID 2536 wrote to memory of 2832	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	35
PID 2536 wrote to memory of 2804	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	36
PID 2536 wrote to memory of 2804	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	36
PID 2536 wrote to memory of 2804	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	36
PID 2536 wrote to memory of 2716	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	37
PID 2536 wrote to memory of 2716	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	37
PID 2536 wrote to memory of 2716	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	37
PID 2536 wrote to memory of 2760	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	38
PID 2536 wrote to memory of 2760	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	38
PID 2536 wrote to memory of 2760	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	38
PID 2536 wrote to memory of 2552	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	39
PID 2536 wrote to memory of 2552	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	39
PID 2536 wrote to memory of 2552	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	39
PID 2536 wrote to memory of 2268	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	40
PID 2536 wrote to memory of 2268	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	40
PID 2536 wrote to memory of 2268	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	40
PID 2536 wrote to memory of 328	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	41
PID 2536 wrote to memory of 328	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	41
PID 2536 wrote to memory of 328	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	41
PID 2536 wrote to memory of 1576	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	42
PID 2536 wrote to memory of 1576	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	42
PID 2536 wrote to memory of 1576	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	42
PID 2536 wrote to memory of 700	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	43
PID 2536 wrote to memory of 700	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	43
PID 2536 wrote to memory of 700	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	43
PID 2536 wrote to memory of 1740	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	44
PID 2536 wrote to memory of 1740	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	44
PID 2536 wrote to memory of 1740	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	44
PID 2536 wrote to memory of 828	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	45
PID 2536 wrote to memory of 828	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	45
PID 2536 wrote to memory of 828	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	45
PID 2536 wrote to memory of 2816	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	46
PID 2536 wrote to memory of 2816	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	46
PID 2536 wrote to memory of 2816	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	46
PID 2536 wrote to memory of 2924	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	47
PID 2536 wrote to memory of 2924	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	47
PID 2536 wrote to memory of 2924	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	47
PID 2536 wrote to memory of 3052	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	48
PID 2536 wrote to memory of 3052	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	48
PID 2536 wrote to memory of 3052	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	48
PID 2536 wrote to memory of 2932	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	49
PID 2536 wrote to memory of 2932	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	49
PID 2536 wrote to memory of 2932	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	49
PID 2536 wrote to memory of 3064	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	50
PID 2536 wrote to memory of 3064	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	50
PID 2536 wrote to memory of 3064	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	50
PID 2536 wrote to memory of 1360	2536	efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe	51

C:\Users\Admin\AppData\Local\Temp\efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe
"C:\Users\Admin\AppData\Local\Temp\efd5cddf95557bb723b0400eaec58cd5c36acbb61124d0a1fea90cceb8b6f102.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System\CLqswtD.exe
  C:\Windows\System\CLqswtD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\TuSxDod.exe
  C:\Windows\System\TuSxDod.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\bYIQzyD.exe
  C:\Windows\System\bYIQzyD.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\aXVOnGA.exe
  C:\Windows\System\aXVOnGA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\nWKOVAe.exe
  C:\Windows\System\nWKOVAe.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\EETfmpU.exe
  C:\Windows\System\EETfmpU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ziduwnn.exe
  C:\Windows\System\ziduwnn.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\WlQxzYx.exe
  C:\Windows\System\WlQxzYx.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\FAvcGpD.exe
  C:\Windows\System\FAvcGpD.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\gcebLkj.exe
  C:\Windows\System\gcebLkj.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ZRayMvl.exe
  C:\Windows\System\ZRayMvl.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\muTLcoV.exe
  C:\Windows\System\muTLcoV.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\nnLtmCJ.exe
  C:\Windows\System\nnLtmCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\SWGZjXt.exe
  C:\Windows\System\SWGZjXt.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\PVZsrcw.exe
  C:\Windows\System\PVZsrcw.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\zWutjjf.exe
  C:\Windows\System\zWutjjf.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\lgMpAIK.exe
  C:\Windows\System\lgMpAIK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\FioUAly.exe
  C:\Windows\System\FioUAly.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\AlENahR.exe
  C:\Windows\System\AlENahR.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\zZxxvOL.exe
  C:\Windows\System\zZxxvOL.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\kCDyWDe.exe
  C:\Windows\System\kCDyWDe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EsZWQlB.exe
  C:\Windows\System\EsZWQlB.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\zBBvfDk.exe
  C:\Windows\System\zBBvfDk.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\xWqXdyS.exe
  C:\Windows\System\xWqXdyS.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\MEsFiCX.exe
  C:\Windows\System\MEsFiCX.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\bzgbFcw.exe
  C:\Windows\System\bzgbFcw.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\gpigVBF.exe
  C:\Windows\System\gpigVBF.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\vwWoixc.exe
  C:\Windows\System\vwWoixc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\fjMbSzz.exe
  C:\Windows\System\fjMbSzz.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\BPbisPQ.exe
  C:\Windows\System\BPbisPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\amIIFvT.exe
  C:\Windows\System\amIIFvT.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VZFsWkB.exe
  C:\Windows\System\VZFsWkB.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\TMuqRGY.exe
  C:\Windows\System\TMuqRGY.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\JbMpeVv.exe
  C:\Windows\System\JbMpeVv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\NCyqvRX.exe
  C:\Windows\System\NCyqvRX.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\iRfrDBf.exe
  C:\Windows\System\iRfrDBf.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pfcJQrE.exe
  C:\Windows\System\pfcJQrE.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ZTeGuTc.exe
  C:\Windows\System\ZTeGuTc.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\zOrVcmI.exe
  C:\Windows\System\zOrVcmI.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\TySriRR.exe
  C:\Windows\System\TySriRR.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\AYjWhbS.exe
  C:\Windows\System\AYjWhbS.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\tyVzeCS.exe
  C:\Windows\System\tyVzeCS.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\UVLyAPg.exe
  C:\Windows\System\UVLyAPg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\unteRHf.exe
  C:\Windows\System\unteRHf.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\FxplMmI.exe
  C:\Windows\System\FxplMmI.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\klQqIkR.exe
  C:\Windows\System\klQqIkR.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\jKRCfCt.exe
  C:\Windows\System\jKRCfCt.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\rioKKti.exe
  C:\Windows\System\rioKKti.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\lAszncK.exe
  C:\Windows\System\lAszncK.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\vOxDyiK.exe
  C:\Windows\System\vOxDyiK.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\lYqnsAZ.exe
  C:\Windows\System\lYqnsAZ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\ibvjfRW.exe
  C:\Windows\System\ibvjfRW.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\pDjABnf.exe
  C:\Windows\System\pDjABnf.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\WpYBTCA.exe
  C:\Windows\System\WpYBTCA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\hWzcurV.exe
  C:\Windows\System\hWzcurV.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\OfrYfRI.exe
  C:\Windows\System\OfrYfRI.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\AfWlaXH.exe
  C:\Windows\System\AfWlaXH.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\GAJaHmY.exe
  C:\Windows\System\GAJaHmY.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\ATsvHtp.exe
  C:\Windows\System\ATsvHtp.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\Esectkv.exe
  C:\Windows\System\Esectkv.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\AsBmIul.exe
  C:\Windows\System\AsBmIul.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\mTamxxk.exe
  C:\Windows\System\mTamxxk.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\PizNwfH.exe
  C:\Windows\System\PizNwfH.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\nJxFFba.exe
  C:\Windows\System\nJxFFba.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\JgfuoSs.exe
  C:\Windows\System\JgfuoSs.exe
  2⤵
  PID:2840
- C:\Windows\System\XTaIuCr.exe
  C:\Windows\System\XTaIuCr.exe
  2⤵
  PID:2284
- C:\Windows\System\lAvfosW.exe
  C:\Windows\System\lAvfosW.exe
  2⤵
  PID:2988
- C:\Windows\System\zadhWTG.exe
  C:\Windows\System\zadhWTG.exe
  2⤵
  PID:2728
- C:\Windows\System\qNgYwtM.exe
  C:\Windows\System\qNgYwtM.exe
  2⤵
  PID:2560
- C:\Windows\System\ycmKlAr.exe
  C:\Windows\System\ycmKlAr.exe
  2⤵
  PID:1128
- C:\Windows\System\qnNICbo.exe
  C:\Windows\System\qnNICbo.exe
  2⤵
  PID:2564
- C:\Windows\System\CxRazaE.exe
  C:\Windows\System\CxRazaE.exe
  2⤵
  PID:1396
- C:\Windows\System\QTJHbVk.exe
  C:\Windows\System\QTJHbVk.exe
  2⤵
  PID:1736
- C:\Windows\System\CwtaERc.exe
  C:\Windows\System\CwtaERc.exe
  2⤵
  PID:2180
- C:\Windows\System\sGBzoZz.exe
  C:\Windows\System\sGBzoZz.exe
  2⤵
  PID:2900
- C:\Windows\System\ftXBEBT.exe
  C:\Windows\System\ftXBEBT.exe
  2⤵
  PID:2912
- C:\Windows\System\mCDPLaM.exe
  C:\Windows\System\mCDPLaM.exe
  2⤵
  PID:3036
- C:\Windows\System\YzwRSQL.exe
  C:\Windows\System\YzwRSQL.exe
  2⤵
  PID:2940
- C:\Windows\System\NTkGlBm.exe
  C:\Windows\System\NTkGlBm.exe
  2⤵
  PID:2676
- C:\Windows\System\rpdCDIj.exe
  C:\Windows\System\rpdCDIj.exe
  2⤵
  PID:2224
- C:\Windows\System\iEgJvFP.exe
  C:\Windows\System\iEgJvFP.exe
  2⤵
  PID:836
- C:\Windows\System\pXbyRIX.exe
  C:\Windows\System\pXbyRIX.exe
  2⤵
  PID:2464
- C:\Windows\System\IEipMJZ.exe
  C:\Windows\System\IEipMJZ.exe
  2⤵
  PID:2052
- C:\Windows\System\IBIgYZP.exe
  C:\Windows\System\IBIgYZP.exe
  2⤵
  PID:2712
- C:\Windows\System\HZAivXe.exe
  C:\Windows\System\HZAivXe.exe
  2⤵
  PID:2736
- C:\Windows\System\vXBUeDE.exe
  C:\Windows\System\vXBUeDE.exe
  2⤵
  PID:268
- C:\Windows\System\UqbgSUa.exe
  C:\Windows\System\UqbgSUa.exe
  2⤵
  PID:1036
- C:\Windows\System\WeQAHQn.exe
  C:\Windows\System\WeQAHQn.exe
  2⤵
  PID:2692
- C:\Windows\System\iHVFETV.exe
  C:\Windows\System\iHVFETV.exe
  2⤵
  PID:2788
- C:\Windows\System\WAhWuWV.exe
  C:\Windows\System\WAhWuWV.exe
  2⤵
  PID:1600
- C:\Windows\System\AqKRYJz.exe
  C:\Windows\System\AqKRYJz.exe
  2⤵
  PID:2548
- C:\Windows\System\CDsyjnu.exe
  C:\Windows\System\CDsyjnu.exe
  2⤵
  PID:1332
- C:\Windows\System\PCUZxHG.exe
  C:\Windows\System\PCUZxHG.exe
  2⤵
  PID:1516
- C:\Windows\System\ewwmcpn.exe
  C:\Windows\System\ewwmcpn.exe
  2⤵
  PID:2588
- C:\Windows\System\RcAdGTG.exe
  C:\Windows\System\RcAdGTG.exe
  2⤵
  PID:1008
- C:\Windows\System\IPHHYMa.exe
  C:\Windows\System\IPHHYMa.exe
  2⤵
  PID:2164
- C:\Windows\System\ICBgqNo.exe
  C:\Windows\System\ICBgqNo.exe
  2⤵
  PID:1056
- C:\Windows\System\LGeAwOd.exe
  C:\Windows\System\LGeAwOd.exe
  2⤵
  PID:1864
- C:\Windows\System\dMoWbWm.exe
  C:\Windows\System\dMoWbWm.exe
  2⤵
  PID:1384
- C:\Windows\System\kxQFELc.exe
  C:\Windows\System\kxQFELc.exe
  2⤵
  PID:2352
- C:\Windows\System\NyWJpVk.exe
  C:\Windows\System\NyWJpVk.exe
  2⤵
  PID:2652
- C:\Windows\System\ILKwuEO.exe
  C:\Windows\System\ILKwuEO.exe
  2⤵
  PID:272
- C:\Windows\System\NibQLOZ.exe
  C:\Windows\System\NibQLOZ.exe
  2⤵
  PID:1276
- C:\Windows\System\aVeNhBf.exe
  C:\Windows\System\aVeNhBf.exe
  2⤵
  PID:1724
- C:\Windows\System\yqFLmfn.exe
  C:\Windows\System\yqFLmfn.exe
  2⤵
  PID:1704
- C:\Windows\System\DmdJhgg.exe
  C:\Windows\System\DmdJhgg.exe
  2⤵
  PID:2488
- C:\Windows\System\DNeGlSb.exe
  C:\Windows\System\DNeGlSb.exe
  2⤵
  PID:1564
- C:\Windows\System\KMZhRAF.exe
  C:\Windows\System\KMZhRAF.exe
  2⤵
  PID:2856
- C:\Windows\System\bOEsMKz.exe
  C:\Windows\System\bOEsMKz.exe
  2⤵
  PID:2096
- C:\Windows\System\hkZPPEg.exe
  C:\Windows\System\hkZPPEg.exe
  2⤵
  PID:3024
- C:\Windows\System\JESzbZi.exe
  C:\Windows\System\JESzbZi.exe
  2⤵
  PID:2908
- C:\Windows\System\zhfZvOm.exe
  C:\Windows\System\zhfZvOm.exe
  2⤵
  PID:2304
- C:\Windows\System\qtBzwDe.exe
  C:\Windows\System\qtBzwDe.exe
  2⤵
  PID:2792
- C:\Windows\System\BBzJfTj.exe
  C:\Windows\System\BBzJfTj.exe
  2⤵
  PID:2984
- C:\Windows\System\koTgBPN.exe
  C:\Windows\System\koTgBPN.exe
  2⤵
  PID:1732
- C:\Windows\System\wTcxWNh.exe
  C:\Windows\System\wTcxWNh.exe
  2⤵
  PID:1032
- C:\Windows\System\AWNWHAc.exe
  C:\Windows\System\AWNWHAc.exe
  2⤵
  PID:2848
- C:\Windows\System\LAtmrWK.exe
  C:\Windows\System\LAtmrWK.exe
  2⤵
  PID:2496
- C:\Windows\System\hLaDywL.exe
  C:\Windows\System\hLaDywL.exe
  2⤵
  PID:2952
- C:\Windows\System\IJENxOh.exe
  C:\Windows\System\IJENxOh.exe
  2⤵
  PID:2416
- C:\Windows\System\FhjuIwS.exe
  C:\Windows\System\FhjuIwS.exe
  2⤵
  PID:3044
- C:\Windows\System\ptLIhtz.exe
  C:\Windows\System\ptLIhtz.exe
  2⤵
  PID:1788
- C:\Windows\System\sMtzsZQ.exe
  C:\Windows\System\sMtzsZQ.exe
  2⤵
  PID:2124
- C:\Windows\System\OCMPmhq.exe
  C:\Windows\System\OCMPmhq.exe
  2⤵
  PID:2108
- C:\Windows\System\KVMAauC.exe
  C:\Windows\System\KVMAauC.exe
  2⤵
  PID:2200
- C:\Windows\System\pjeTVCc.exe
  C:\Windows\System\pjeTVCc.exe
  2⤵
  PID:2556
- C:\Windows\System\fouFQiw.exe
  C:\Windows\System\fouFQiw.exe
  2⤵
  PID:976
- C:\Windows\System\KmXCovA.exe
  C:\Windows\System\KmXCovA.exe
  2⤵
  PID:996
- C:\Windows\System\jzQXDLX.exe
  C:\Windows\System\jzQXDLX.exe
  2⤵
  PID:2576
- C:\Windows\System\HAmPbdA.exe
  C:\Windows\System\HAmPbdA.exe
  2⤵
  PID:1548
- C:\Windows\System\UEMIIzk.exe
  C:\Windows\System\UEMIIzk.exe
  2⤵
  PID:796
- C:\Windows\System\mmDfhDZ.exe
  C:\Windows\System\mmDfhDZ.exe
  2⤵
  PID:1700
- C:\Windows\System\qpbTCzB.exe
  C:\Windows\System\qpbTCzB.exe
  2⤵
  PID:1680
- C:\Windows\System\DsHUzrI.exe
  C:\Windows\System\DsHUzrI.exe
  2⤵
  PID:1048
- C:\Windows\System\frxBpTd.exe
  C:\Windows\System\frxBpTd.exe
  2⤵
  PID:2088
- C:\Windows\System\SqUodFO.exe
  C:\Windows\System\SqUodFO.exe
  2⤵
  PID:2316
- C:\Windows\System\OMrCUFS.exe
  C:\Windows\System\OMrCUFS.exe
  2⤵
  PID:1572
- C:\Windows\System\oAauwzY.exe
  C:\Windows\System\oAauwzY.exe
  2⤵
  PID:3060
- C:\Windows\System\YOhWKVI.exe
  C:\Windows\System\YOhWKVI.exe
  2⤵
  PID:2280
- C:\Windows\System\iNGucVl.exe
  C:\Windows\System\iNGucVl.exe
  2⤵
  PID:2968
- C:\Windows\System\uUwzKkT.exe
  C:\Windows\System\uUwzKkT.exe
  2⤵
  PID:2976
- C:\Windows\System\cJpMZYy.exe
  C:\Windows\System\cJpMZYy.exe
  2⤵
  PID:2756
- C:\Windows\System\AeeHvme.exe
  C:\Windows\System\AeeHvme.exe
  2⤵
  PID:2256
- C:\Windows\System\zoVDmNR.exe
  C:\Windows\System\zoVDmNR.exe
  2⤵
  PID:1980
- C:\Windows\System\NyKAuxa.exe
  C:\Windows\System\NyKAuxa.exe
  2⤵
  PID:2128
- C:\Windows\System\OEwFUsa.exe
  C:\Windows\System\OEwFUsa.exe
  2⤵
  PID:1252
- C:\Windows\System\AdNrZLA.exe
  C:\Windows\System\AdNrZLA.exe
  2⤵
  PID:2300
- C:\Windows\System\iTCOBTU.exe
  C:\Windows\System\iTCOBTU.exe
  2⤵
  PID:2460
- C:\Windows\System\dnmWChI.exe
  C:\Windows\System\dnmWChI.exe
  2⤵
  PID:2356
- C:\Windows\System\trUQliF.exe
  C:\Windows\System\trUQliF.exe
  2⤵
  PID:904
- C:\Windows\System\ouVxBod.exe
  C:\Windows\System\ouVxBod.exe
  2⤵
  PID:1596
- C:\Windows\System\uaHEwPY.exe
  C:\Windows\System\uaHEwPY.exe
  2⤵
  PID:2308
- C:\Windows\System\zZFrGrl.exe
  C:\Windows\System\zZFrGrl.exe
  2⤵
  PID:1556
- C:\Windows\System\VsnaRiF.exe
  C:\Windows\System\VsnaRiF.exe
  2⤵
  PID:1656
- C:\Windows\System\VTgQauc.exe
  C:\Windows\System\VTgQauc.exe
  2⤵
  PID:2008
- C:\Windows\System\Uwenhgi.exe
  C:\Windows\System\Uwenhgi.exe
  2⤵
  PID:2812
- C:\Windows\System\PsFDWqP.exe
  C:\Windows\System\PsFDWqP.exe
  2⤵
  PID:2660
- C:\Windows\System\QTssVSw.exe
  C:\Windows\System\QTssVSw.exe
  2⤵
  PID:2376
- C:\Windows\System\yvoMRUx.exe
  C:\Windows\System\yvoMRUx.exe
  2⤵
  PID:2724
- C:\Windows\System\eIWbcFa.exe
  C:\Windows\System\eIWbcFa.exe
  2⤵
  PID:2896
- C:\Windows\System\SaUTfkd.exe
  C:\Windows\System\SaUTfkd.exe
  2⤵
  PID:2928
- C:\Windows\System\yJWUHwN.exe
  C:\Windows\System\yJWUHwN.exe
  2⤵
  PID:2688
- C:\Windows\System\NGfzuoA.exe
  C:\Windows\System\NGfzuoA.exe
  2⤵
  PID:2264
- C:\Windows\System\cSYShhq.exe
  C:\Windows\System\cSYShhq.exe
  2⤵
  PID:1796
- C:\Windows\System\ZlhxLUW.exe
  C:\Windows\System\ZlhxLUW.exe
  2⤵
  PID:2520
- C:\Windows\System\BQFFbkB.exe
  C:\Windows\System\BQFFbkB.exe
  2⤵
  PID:772
- C:\Windows\System\pQCidxz.exe
  C:\Windows\System\pQCidxz.exe
  2⤵
  PID:2920
- C:\Windows\System\UXnLeHg.exe
  C:\Windows\System\UXnLeHg.exe
  2⤵
  PID:1776
- C:\Windows\System\ryKnvGa.exe
  C:\Windows\System\ryKnvGa.exe
  2⤵
  PID:1992
- C:\Windows\System\JxaPavq.exe
  C:\Windows\System\JxaPavq.exe
  2⤵
  PID:1248
- C:\Windows\System\fJjWwSW.exe
  C:\Windows\System\fJjWwSW.exe
  2⤵
  PID:1084
- C:\Windows\System\NHvsysM.exe
  C:\Windows\System\NHvsysM.exe
  2⤵
  PID:2272
- C:\Windows\System\BaLLyWF.exe
  C:\Windows\System\BaLLyWF.exe
  2⤵
  PID:3040
- C:\Windows\System\kFWzLUk.exe
  C:\Windows\System\kFWzLUk.exe
  2⤵
  PID:2232
- C:\Windows\System\ixJzHvv.exe
  C:\Windows\System\ixJzHvv.exe
  2⤵
  PID:2404
- C:\Windows\System\XrLJTlu.exe
  C:\Windows\System\XrLJTlu.exe
  2⤵
  PID:1772
- C:\Windows\System\SotJZZH.exe
  C:\Windows\System\SotJZZH.exe
  2⤵
  PID:972
- C:\Windows\System\DUXwNeG.exe
  C:\Windows\System\DUXwNeG.exe
  2⤵
  PID:1392
- C:\Windows\System\qocqMUz.exe
  C:\Windows\System\qocqMUz.exe
  2⤵
  PID:3084
- C:\Windows\System\QWwnxxV.exe
  C:\Windows\System\QWwnxxV.exe
  2⤵
  PID:3108
- C:\Windows\System\vYfRTCA.exe
  C:\Windows\System\vYfRTCA.exe
  2⤵
  PID:3128
- C:\Windows\System\iROOsKV.exe
  C:\Windows\System\iROOsKV.exe
  2⤵
  PID:3144
- C:\Windows\System\kFbFhBa.exe
  C:\Windows\System\kFbFhBa.exe
  2⤵
  PID:3164
- C:\Windows\System\vTBCxEZ.exe
  C:\Windows\System\vTBCxEZ.exe
  2⤵
  PID:3192
- C:\Windows\System\kKnVGcS.exe
  C:\Windows\System\kKnVGcS.exe
  2⤵
  PID:3208
- C:\Windows\System\gVtKiRc.exe
  C:\Windows\System\gVtKiRc.exe
  2⤵
  PID:3240
- C:\Windows\System\hFHDHHK.exe
  C:\Windows\System\hFHDHHK.exe
  2⤵
  PID:3256
- C:\Windows\System\jthBPyj.exe
  C:\Windows\System\jthBPyj.exe
  2⤵
  PID:3276
- C:\Windows\System\UFAvSXD.exe
  C:\Windows\System\UFAvSXD.exe
  2⤵
  PID:3296
- C:\Windows\System\iMBOybR.exe
  C:\Windows\System\iMBOybR.exe
  2⤵
  PID:3316
- C:\Windows\System\mEvgoki.exe
  C:\Windows\System\mEvgoki.exe
  2⤵
  PID:3336
- C:\Windows\System\JQjFtJG.exe
  C:\Windows\System\JQjFtJG.exe
  2⤵
  PID:3352
- C:\Windows\System\WTAeGcS.exe
  C:\Windows\System\WTAeGcS.exe
  2⤵
  PID:3372
- C:\Windows\System\LEwsNGI.exe
  C:\Windows\System\LEwsNGI.exe
  2⤵
  PID:3392
- C:\Windows\System\iPmIeEq.exe
  C:\Windows\System\iPmIeEq.exe
  2⤵
  PID:3412
- C:\Windows\System\HMdzcjO.exe
  C:\Windows\System\HMdzcjO.exe
  2⤵
  PID:3440
- C:\Windows\System\yEiedMk.exe
  C:\Windows\System\yEiedMk.exe
  2⤵
  PID:3456
- C:\Windows\System\JHrAWdh.exe
  C:\Windows\System\JHrAWdh.exe
  2⤵
  PID:3476
- C:\Windows\System\KfPsbyY.exe
  C:\Windows\System\KfPsbyY.exe
  2⤵
  PID:3492
- C:\Windows\System\bOHSeaG.exe
  C:\Windows\System\bOHSeaG.exe
  2⤵
  PID:3516
- C:\Windows\System\eXHzZcS.exe
  C:\Windows\System\eXHzZcS.exe
  2⤵
  PID:3540
- C:\Windows\System\OvLnubL.exe
  C:\Windows\System\OvLnubL.exe
  2⤵
  PID:3556
- C:\Windows\System\LebQmGA.exe
  C:\Windows\System\LebQmGA.exe
  2⤵
  PID:3580
- C:\Windows\System\TbwKxRl.exe
  C:\Windows\System\TbwKxRl.exe
  2⤵
  PID:3596
- C:\Windows\System\XWqmPUA.exe
  C:\Windows\System\XWqmPUA.exe
  2⤵
  PID:3616
- C:\Windows\System\uFBOUEu.exe
  C:\Windows\System\uFBOUEu.exe
  2⤵
  PID:3636
- C:\Windows\System\ybzLhOu.exe
  C:\Windows\System\ybzLhOu.exe
  2⤵
  PID:3656
- C:\Windows\System\uayWXFK.exe
  C:\Windows\System\uayWXFK.exe
  2⤵
  PID:3672
- C:\Windows\System\mmoiquu.exe
  C:\Windows\System\mmoiquu.exe
  2⤵
  PID:3696
- C:\Windows\System\SBqsVth.exe
  C:\Windows\System\SBqsVth.exe
  2⤵
  PID:3716
- C:\Windows\System\BbFpbyq.exe
  C:\Windows\System\BbFpbyq.exe
  2⤵
  PID:3732
- C:\Windows\System\fKQjSUr.exe
  C:\Windows\System\fKQjSUr.exe
  2⤵
  PID:3756
- C:\Windows\System\AJVnfEm.exe
  C:\Windows\System\AJVnfEm.exe
  2⤵
  PID:3776
- C:\Windows\System\FAnrbcr.exe
  C:\Windows\System\FAnrbcr.exe
  2⤵
  PID:3796
- C:\Windows\System\mrDgBtF.exe
  C:\Windows\System\mrDgBtF.exe
  2⤵
  PID:3816
- C:\Windows\System\jqzCfRv.exe
  C:\Windows\System\jqzCfRv.exe
  2⤵
  PID:3836
- C:\Windows\System\psEQgXd.exe
  C:\Windows\System\psEQgXd.exe
  2⤵
  PID:3860
- C:\Windows\System\EEKXrPI.exe
  C:\Windows\System\EEKXrPI.exe
  2⤵
  PID:3876
- C:\Windows\System\dAiaiNM.exe
  C:\Windows\System\dAiaiNM.exe
  2⤵
  PID:3896
- C:\Windows\System\UmbumFH.exe
  C:\Windows\System\UmbumFH.exe
  2⤵
  PID:3916
- C:\Windows\System\zaUSWaj.exe
  C:\Windows\System\zaUSWaj.exe
  2⤵
  PID:3932
- C:\Windows\System\ITHZBWp.exe
  C:\Windows\System\ITHZBWp.exe
  2⤵
  PID:3948
- C:\Windows\System\NrDGnzW.exe
  C:\Windows\System\NrDGnzW.exe
  2⤵
  PID:3968
- C:\Windows\System\xJOPKHG.exe
  C:\Windows\System\xJOPKHG.exe
  2⤵
  PID:3984
- C:\Windows\System\PLpOgWr.exe
  C:\Windows\System\PLpOgWr.exe
  2⤵
  PID:4004
- C:\Windows\System\UzCNlkx.exe
  C:\Windows\System\UzCNlkx.exe
  2⤵
  PID:4024
- C:\Windows\System\uokMvYl.exe
  C:\Windows\System\uokMvYl.exe
  2⤵
  PID:4044
- C:\Windows\System\HRnxiLF.exe
  C:\Windows\System\HRnxiLF.exe
  2⤵
  PID:4060
- C:\Windows\System\RAennpw.exe
  C:\Windows\System\RAennpw.exe
  2⤵
  PID:4076
- C:\Windows\System\ZLnNTcx.exe
  C:\Windows\System\ZLnNTcx.exe
  2⤵
  PID:4092
- C:\Windows\System\vQwTHcS.exe
  C:\Windows\System\vQwTHcS.exe
  2⤵
  PID:1272
- C:\Windows\System\vNFSpzh.exe
  C:\Windows\System\vNFSpzh.exe
  2⤵
  PID:2396
- C:\Windows\System\qLOSAhy.exe
  C:\Windows\System\qLOSAhy.exe
  2⤵
  PID:2800
- C:\Windows\System\zIAmVcb.exe
  C:\Windows\System\zIAmVcb.exe
  2⤵
  PID:3120
- C:\Windows\System\uAhDFNA.exe
  C:\Windows\System\uAhDFNA.exe
  2⤵
  PID:3204
- C:\Windows\System\NMlluwo.exe
  C:\Windows\System\NMlluwo.exe
  2⤵
  PID:3176
- C:\Windows\System\zWYMype.exe
  C:\Windows\System\zWYMype.exe
  2⤵
  PID:3188
- C:\Windows\System\ZgNqmjF.exe
  C:\Windows\System\ZgNqmjF.exe
  2⤵
  PID:3264
- C:\Windows\System\pHMyHpe.exe
  C:\Windows\System\pHMyHpe.exe
  2⤵
  PID:3284
- C:\Windows\System\exZRZVN.exe
  C:\Windows\System\exZRZVN.exe
  2⤵
  PID:3308
- C:\Windows\System\wsdSnnx.exe
  C:\Windows\System\wsdSnnx.exe
  2⤵
  PID:3364
- C:\Windows\System\qOnMlml.exe
  C:\Windows\System\qOnMlml.exe
  2⤵
  PID:3388
- C:\Windows\System\oLvYxWR.exe
  C:\Windows\System\oLvYxWR.exe
  2⤵
  PID:3428
- C:\Windows\System\xujLAgK.exe
  C:\Windows\System\xujLAgK.exe
  2⤵
  PID:3464
- C:\Windows\System\mdDNJjX.exe
  C:\Windows\System\mdDNJjX.exe
  2⤵
  PID:3468
- C:\Windows\System\fcaUsON.exe
  C:\Windows\System\fcaUsON.exe
  2⤵
  PID:3528
- C:\Windows\System\RNQxYFL.exe
  C:\Windows\System\RNQxYFL.exe
  2⤵
  PID:3568
- C:\Windows\System\ppUMSUg.exe
  C:\Windows\System\ppUMSUg.exe
  2⤵
  PID:3588
- C:\Windows\System\eYRXoYH.exe
  C:\Windows\System\eYRXoYH.exe
  2⤵
  PID:3628
- C:\Windows\System\TdwNgEN.exe
  C:\Windows\System\TdwNgEN.exe
  2⤵
  PID:3648
- C:\Windows\System\GCGNcbU.exe
  C:\Windows\System\GCGNcbU.exe
  2⤵
  PID:3684
- C:\Windows\System\KueqJLk.exe
  C:\Windows\System\KueqJLk.exe
  2⤵
  PID:3744
- C:\Windows\System\OJRSdCT.exe
  C:\Windows\System\OJRSdCT.exe
  2⤵
  PID:3728
- C:\Windows\System\KbAZuEP.exe
  C:\Windows\System\KbAZuEP.exe
  2⤵
  PID:3788
- C:\Windows\System\SZvCIqV.exe
  C:\Windows\System\SZvCIqV.exe
  2⤵
  PID:3848
- C:\Windows\System\QQEHgsP.exe
  C:\Windows\System\QQEHgsP.exe
  2⤵
  PID:3884
- C:\Windows\System\QFPHmMW.exe
  C:\Windows\System\QFPHmMW.exe
  2⤵
  PID:3908
- C:\Windows\System\olPEulM.exe
  C:\Windows\System\olPEulM.exe
  2⤵
  PID:3960
- C:\Windows\System\ovpOOfu.exe
  C:\Windows\System\ovpOOfu.exe
  2⤵
  PID:4000
- C:\Windows\System\zYipkSr.exe
  C:\Windows\System\zYipkSr.exe
  2⤵
  PID:2076
- C:\Windows\System\uSLxrNY.exe
  C:\Windows\System\uSLxrNY.exe
  2⤵
  PID:4056
- C:\Windows\System\VHbPMyY.exe
  C:\Windows\System\VHbPMyY.exe
  2⤵
  PID:3944
- C:\Windows\System\cKAGCBT.exe
  C:\Windows\System\cKAGCBT.exe
  2⤵
  PID:1952
- C:\Windows\System\UxUdcNS.exe
  C:\Windows\System\UxUdcNS.exe
  2⤵
  PID:2348
- C:\Windows\System\wDfPLOi.exe
  C:\Windows\System\wDfPLOi.exe
  2⤵
  PID:3184
- C:\Windows\System\YCiMOlC.exe
  C:\Windows\System\YCiMOlC.exe
  2⤵
  PID:3096
- C:\Windows\System\rVhghlc.exe
  C:\Windows\System\rVhghlc.exe
  2⤵
  PID:3248
- C:\Windows\System\WuVQikm.exe
  C:\Windows\System\WuVQikm.exe
  2⤵
  PID:3344
- C:\Windows\System\HMpTWNt.exe
  C:\Windows\System\HMpTWNt.exe
  2⤵
  PID:3304
- C:\Windows\System\CyEuYbM.exe
  C:\Windows\System\CyEuYbM.exe
  2⤵
  PID:3408
- C:\Windows\System\iGbNLpg.exe
  C:\Windows\System\iGbNLpg.exe
  2⤵
  PID:3532
- C:\Windows\System\CgMoOCP.exe
  C:\Windows\System\CgMoOCP.exe
  2⤵
  PID:3604
- C:\Windows\System\xvMqdeq.exe
  C:\Windows\System\xvMqdeq.exe
  2⤵
  PID:3680
- C:\Windows\System\CNFIhMz.exe
  C:\Windows\System\CNFIhMz.exe
  2⤵
  PID:3768
- C:\Windows\System\NIiPHIc.exe
  C:\Windows\System\NIiPHIc.exe
  2⤵
  PID:3448
- C:\Windows\System\azZCodf.exe
  C:\Windows\System\azZCodf.exe
  2⤵
  PID:3504
- C:\Windows\System\XChZCOP.exe
  C:\Windows\System\XChZCOP.exe
  2⤵
  PID:3644
- C:\Windows\System\jsAZqpS.exe
  C:\Windows\System\jsAZqpS.exe
  2⤵
  PID:3688
- C:\Windows\System\NajJkdO.exe
  C:\Windows\System\NajJkdO.exe
  2⤵
  PID:3400
- C:\Windows\System\LewMkwa.exe
  C:\Windows\System\LewMkwa.exe
  2⤵
  PID:3980
- C:\Windows\System\CFKHTDL.exe
  C:\Windows\System\CFKHTDL.exe
  2⤵
  PID:3996
- C:\Windows\System\osKoWWy.exe
  C:\Windows\System\osKoWWy.exe
  2⤵
  PID:3992
- C:\Windows\System\WYKqkVv.exe
  C:\Windows\System\WYKqkVv.exe
  2⤵
  PID:824
- C:\Windows\System\yimwIdZ.exe
  C:\Windows\System\yimwIdZ.exe
  2⤵
  PID:3232
- C:\Windows\System\vMfiAnj.exe
  C:\Windows\System\vMfiAnj.exe
  2⤵
  PID:3272
- C:\Windows\System\XVEtFrs.exe
  C:\Windows\System\XVEtFrs.exe
  2⤵
  PID:3360
- C:\Windows\System\vdlDBzo.exe
  C:\Windows\System\vdlDBzo.exe
  2⤵
  PID:3608
- C:\Windows\System\EaYsjUA.exe
  C:\Windows\System\EaYsjUA.exe
  2⤵
  PID:3652
- C:\Windows\System\ZJyLOAG.exe
  C:\Windows\System\ZJyLOAG.exe
  2⤵
  PID:3724
- C:\Windows\System\ixXKlyw.exe
  C:\Windows\System\ixXKlyw.exe
  2⤵
  PID:3500
- C:\Windows\System\WsROyhl.exe
  C:\Windows\System\WsROyhl.exe
  2⤵
  PID:3552
- C:\Windows\System\PBezkIF.exe
  C:\Windows\System\PBezkIF.exe
  2⤵
  PID:4032
- C:\Windows\System\xerZWwM.exe
  C:\Windows\System\xerZWwM.exe
  2⤵
  PID:3928
- C:\Windows\System\OEEnALq.exe
  C:\Windows\System\OEEnALq.exe
  2⤵
  PID:3912
- C:\Windows\System\QNJOyrX.exe
  C:\Windows\System\QNJOyrX.exe
  2⤵
  PID:4072
- C:\Windows\System\JeoRuQQ.exe
  C:\Windows\System\JeoRuQQ.exe
  2⤵
  PID:2704
- C:\Windows\System\weZDNcu.exe
  C:\Windows\System\weZDNcu.exe
  2⤵
  PID:3252
- C:\Windows\System\lPMtuej.exe
  C:\Windows\System\lPMtuej.exe
  2⤵
  PID:3812
- C:\Windows\System\ycsVBdk.exe
  C:\Windows\System\ycsVBdk.exe
  2⤵
  PID:3712
- C:\Windows\System\LqNEXbW.exe
  C:\Windows\System\LqNEXbW.exe
  2⤵
  PID:2056
- C:\Windows\System\CNWYMtO.exe
  C:\Windows\System\CNWYMtO.exe
  2⤵
  PID:3100
- C:\Windows\System\YswIpPf.exe
  C:\Windows\System\YswIpPf.exe
  2⤵
  PID:3348
- C:\Windows\System\SSdXEOv.exe
  C:\Windows\System\SSdXEOv.exe
  2⤵
  PID:3940
- C:\Windows\System\GikPtLL.exe
  C:\Windows\System\GikPtLL.exe
  2⤵
  PID:2512
- C:\Windows\System\wifOFtV.exe
  C:\Windows\System\wifOFtV.exe
  2⤵
  PID:3488
- C:\Windows\System\oARtsMO.exe
  C:\Windows\System\oARtsMO.exe
  2⤵
  PID:2796
- C:\Windows\System\nqzTNye.exe
  C:\Windows\System\nqzTNye.exe
  2⤵
  PID:3436
- C:\Windows\System\FEVxonk.exe
  C:\Windows\System\FEVxonk.exe
  2⤵
  PID:3404
- C:\Windows\System\FPkRBhW.exe
  C:\Windows\System\FPkRBhW.exe
  2⤵
  PID:3904
- C:\Windows\System\yUVdVdH.exe
  C:\Windows\System\yUVdVdH.exe
  2⤵
  PID:3872
- C:\Windows\System\sicsUkE.exe
  C:\Windows\System\sicsUkE.exe
  2⤵
  PID:4104
- C:\Windows\System\sqHTayu.exe
  C:\Windows\System\sqHTayu.exe
  2⤵
  PID:4124
- C:\Windows\System\lTfgzvB.exe
  C:\Windows\System\lTfgzvB.exe
  2⤵
  PID:4144
- C:\Windows\System\aJBZtDx.exe
  C:\Windows\System\aJBZtDx.exe
  2⤵
  PID:4160
- C:\Windows\System\iCayDwg.exe
  C:\Windows\System\iCayDwg.exe
  2⤵
  PID:4176
- C:\Windows\System\TRNBTXr.exe
  C:\Windows\System\TRNBTXr.exe
  2⤵
  PID:4192
- C:\Windows\System\xYjSyGy.exe
  C:\Windows\System\xYjSyGy.exe
  2⤵
  PID:4212
- C:\Windows\System\fQpuXUj.exe
  C:\Windows\System\fQpuXUj.exe
  2⤵
  PID:4228
- C:\Windows\System\sIjqdnC.exe
  C:\Windows\System\sIjqdnC.exe
  2⤵
  PID:4248
- C:\Windows\System\vduTWWu.exe
  C:\Windows\System\vduTWWu.exe
  2⤵
  PID:4268
- C:\Windows\System\vAxIJXc.exe
  C:\Windows\System\vAxIJXc.exe
  2⤵
  PID:4288
- C:\Windows\System\IUPSRxC.exe
  C:\Windows\System\IUPSRxC.exe
  2⤵
  PID:4304
- C:\Windows\System\jZhkoTa.exe
  C:\Windows\System\jZhkoTa.exe
  2⤵
  PID:4352
- C:\Windows\System\YNqjLpm.exe
  C:\Windows\System\YNqjLpm.exe
  2⤵
  PID:4368
- C:\Windows\System\iYFJatm.exe
  C:\Windows\System\iYFJatm.exe
  2⤵
  PID:4384
- C:\Windows\System\EQJpvMr.exe
  C:\Windows\System\EQJpvMr.exe
  2⤵
  PID:4400
- C:\Windows\System\DmNDYLU.exe
  C:\Windows\System\DmNDYLU.exe
  2⤵
  PID:4424
- C:\Windows\System\YYaxkJN.exe
  C:\Windows\System\YYaxkJN.exe
  2⤵
  PID:4444
- C:\Windows\System\glhZIxP.exe
  C:\Windows\System\glhZIxP.exe
  2⤵
  PID:4464
- C:\Windows\System\vMqGAUX.exe
  C:\Windows\System\vMqGAUX.exe
  2⤵
  PID:4488
- C:\Windows\System\HwowBiO.exe
  C:\Windows\System\HwowBiO.exe
  2⤵
  PID:4504
- C:\Windows\System\IPhdSAs.exe
  C:\Windows\System\IPhdSAs.exe
  2⤵
  PID:4524
- C:\Windows\System\DJmYbId.exe
  C:\Windows\System\DJmYbId.exe
  2⤵
  PID:4544
- C:\Windows\System\ElusXKi.exe
  C:\Windows\System\ElusXKi.exe
  2⤵
  PID:4564
- C:\Windows\System\Ubaeqpz.exe
  C:\Windows\System\Ubaeqpz.exe
  2⤵
  PID:4580
- C:\Windows\System\uJIErov.exe
  C:\Windows\System\uJIErov.exe
  2⤵
  PID:4616
- C:\Windows\System\GmwZlxU.exe
  C:\Windows\System\GmwZlxU.exe
  2⤵
  PID:4632
- C:\Windows\System\rwOhmth.exe
  C:\Windows\System\rwOhmth.exe
  2⤵
  PID:4648
- C:\Windows\System\qZFTOSI.exe
  C:\Windows\System\qZFTOSI.exe
  2⤵
  PID:4668
- C:\Windows\System\zJFUBGj.exe
  C:\Windows\System\zJFUBGj.exe
  2⤵
  PID:4684
- C:\Windows\System\mHzjbVf.exe
  C:\Windows\System\mHzjbVf.exe
  2⤵
  PID:4704
- C:\Windows\System\rdMBJCS.exe
  C:\Windows\System\rdMBJCS.exe
  2⤵
  PID:4724
- C:\Windows\System\gCGOUQE.exe
  C:\Windows\System\gCGOUQE.exe
  2⤵
  PID:4740
- C:\Windows\System\kJafPEM.exe
  C:\Windows\System\kJafPEM.exe
  2⤵
  PID:4756
- C:\Windows\System\RnIFJme.exe
  C:\Windows\System\RnIFJme.exe
  2⤵
  PID:4776
- C:\Windows\System\TknmYjo.exe
  C:\Windows\System\TknmYjo.exe
  2⤵
  PID:4792
- C:\Windows\System\rIDuUIx.exe
  C:\Windows\System\rIDuUIx.exe
  2⤵
  PID:4808
- C:\Windows\System\eTlFOpt.exe
  C:\Windows\System\eTlFOpt.exe
  2⤵
  PID:4824
- C:\Windows\System\XRoqnXV.exe
  C:\Windows\System\XRoqnXV.exe
  2⤵
  PID:4844
- C:\Windows\System\QMKPCjU.exe
  C:\Windows\System\QMKPCjU.exe
  2⤵
  PID:4864
- C:\Windows\System\iZGisGz.exe
  C:\Windows\System\iZGisGz.exe
  2⤵
  PID:4884
- C:\Windows\System\DySORGO.exe
  C:\Windows\System\DySORGO.exe
  2⤵
  PID:4904
- C:\Windows\System\qGVeABy.exe
  C:\Windows\System\qGVeABy.exe
  2⤵
  PID:4924
- C:\Windows\System\NLuMTlK.exe
  C:\Windows\System\NLuMTlK.exe
  2⤵
  PID:4940
- C:\Windows\System\bRMsnEU.exe
  C:\Windows\System\bRMsnEU.exe
  2⤵
  PID:4956
- C:\Windows\System\yzXQZZC.exe
  C:\Windows\System\yzXQZZC.exe
  2⤵
  PID:4976
- C:\Windows\System\lwaznUk.exe
  C:\Windows\System\lwaznUk.exe
  2⤵
  PID:4992
- C:\Windows\System\WzYgxvk.exe
  C:\Windows\System\WzYgxvk.exe
  2⤵
  PID:5008
- C:\Windows\System\KYVABGU.exe
  C:\Windows\System\KYVABGU.exe
  2⤵
  PID:5028
- C:\Windows\System\YbldKDv.exe
  C:\Windows\System\YbldKDv.exe
  2⤵
  PID:5048
- C:\Windows\System\vXXWTid.exe
  C:\Windows\System\vXXWTid.exe
  2⤵
  PID:5068
- C:\Windows\System\odkFxKa.exe
  C:\Windows\System\odkFxKa.exe
  2⤵
  PID:5084
- C:\Windows\System\qewXvKk.exe
  C:\Windows\System\qewXvKk.exe
  2⤵
  PID:5100
- C:\Windows\System\gWpyIyQ.exe
  C:\Windows\System\gWpyIyQ.exe
  2⤵
  PID:5116
- C:\Windows\System\MUROYnO.exe
  C:\Windows\System\MUROYnO.exe
  2⤵
  PID:4136
- C:\Windows\System\RCioBpq.exe
  C:\Windows\System\RCioBpq.exe
  2⤵
  PID:4236
- C:\Windows\System\ZrKvUrM.exe
  C:\Windows\System\ZrKvUrM.exe
  2⤵
  PID:4244
- C:\Windows\System\GQUsfqp.exe
  C:\Windows\System\GQUsfqp.exe
  2⤵
  PID:4120
- C:\Windows\System\rycIaqd.exe
  C:\Windows\System\rycIaqd.exe
  2⤵
  PID:4220
- C:\Windows\System\TSklQbn.exe
  C:\Windows\System\TSklQbn.exe
  2⤵
  PID:3432
- C:\Windows\System\KsMTTIe.exe
  C:\Windows\System\KsMTTIe.exe
  2⤵
  PID:4316
- C:\Windows\System\fzPfniE.exe
  C:\Windows\System\fzPfniE.exe
  2⤵
  PID:4412
- C:\Windows\System\gYilwtT.exe
  C:\Windows\System\gYilwtT.exe
  2⤵
  PID:4460
- C:\Windows\System\TSPVmst.exe
  C:\Windows\System\TSPVmst.exe
  2⤵
  PID:4536
- C:\Windows\System\dhLSMUr.exe
  C:\Windows\System\dhLSMUr.exe
  2⤵
  PID:4396
- C:\Windows\System\bHUukuf.exe
  C:\Windows\System\bHUukuf.exe
  2⤵
  PID:4484
- C:\Windows\System\XwErFbk.exe
  C:\Windows\System\XwErFbk.exe
  2⤵
  PID:4520
- C:\Windows\System\GAHRnFg.exe
  C:\Windows\System\GAHRnFg.exe
  2⤵
  PID:4572
- C:\Windows\System\zSbtkvo.exe
  C:\Windows\System\zSbtkvo.exe
  2⤵
  PID:4656
- C:\Windows\System\qZIbJrP.exe
  C:\Windows\System\qZIbJrP.exe
  2⤵
  PID:4700
- C:\Windows\System\vHnPwFA.exe
  C:\Windows\System\vHnPwFA.exe
  2⤵
  PID:4680
- C:\Windows\System\bCKBbjX.exe
  C:\Windows\System\bCKBbjX.exe
  2⤵
  PID:4800
- C:\Windows\System\llxANAj.exe
  C:\Windows\System\llxANAj.exe
  2⤵
  PID:4836
- C:\Windows\System\OdVPRQd.exe
  C:\Windows\System\OdVPRQd.exe
  2⤵
  PID:4644
- C:\Windows\System\xRWuFfv.exe
  C:\Windows\System\xRWuFfv.exe
  2⤵
  PID:4952
- C:\Windows\System\xwEwPLI.exe
  C:\Windows\System\xwEwPLI.exe
  2⤵
  PID:5024
- C:\Windows\System\KAenENl.exe
  C:\Windows\System\KAenENl.exe
  2⤵
  PID:5092
- C:\Windows\System\wAZrDgR.exe
  C:\Windows\System\wAZrDgR.exe
  2⤵
  PID:4240
- C:\Windows\System\mOBmQaL.exe
  C:\Windows\System\mOBmQaL.exe
  2⤵
  PID:4156
- C:\Windows\System\BQPNOgA.exe
  C:\Windows\System\BQPNOgA.exe
  2⤵
  PID:4856
- C:\Windows\System\pzxqLyu.exe
  C:\Windows\System\pzxqLyu.exe
  2⤵
  PID:4932
- C:\Windows\System\hLxVPXw.exe
  C:\Windows\System\hLxVPXw.exe
  2⤵
  PID:5000
- C:\Windows\System\LVHGdbO.exe
  C:\Windows\System\LVHGdbO.exe
  2⤵
  PID:4172
- C:\Windows\System\xWnUQtY.exe
  C:\Windows\System\xWnUQtY.exe
  2⤵
  PID:4788
- C:\Windows\System\XTlkUAj.exe
  C:\Windows\System\XTlkUAj.exe
  2⤵
  PID:4336
- C:\Windows\System\fCtNjmz.exe
  C:\Windows\System\fCtNjmz.exe
  2⤵
  PID:5044
- C:\Windows\System\AyTuDFI.exe
  C:\Windows\System\AyTuDFI.exe
  2⤵
  PID:4280
- C:\Windows\System\QOHajZC.exe
  C:\Windows\System\QOHajZC.exe
  2⤵
  PID:4348
- C:\Windows\System\IRJpgDy.exe
  C:\Windows\System\IRJpgDy.exe
  2⤵
  PID:4392
- C:\Windows\System\fmUwugt.exe
  C:\Windows\System\fmUwugt.exe
  2⤵
  PID:4516
- C:\Windows\System\yqnPBYb.exe
  C:\Windows\System\yqnPBYb.exe
  2⤵
  PID:4300
- C:\Windows\System\gozCuXh.exe
  C:\Windows\System\gozCuXh.exe
  2⤵
  PID:4624
- C:\Windows\System\iVQPfOw.exe
  C:\Windows\System\iVQPfOw.exe
  2⤵
  PID:4532
- C:\Windows\System\mSTdzrx.exe
  C:\Windows\System\mSTdzrx.exe
  2⤵
  PID:4600
- C:\Windows\System\GkBPTdi.exe
  C:\Windows\System\GkBPTdi.exe
  2⤵
  PID:4916
- C:\Windows\System\WAAkQLb.exe
  C:\Windows\System\WAAkQLb.exe
  2⤵
  PID:5020
- C:\Windows\System\cYtNEXP.exe
  C:\Windows\System\cYtNEXP.exe
  2⤵
  PID:4892
- C:\Windows\System\NQZXoyB.exe
  C:\Windows\System\NQZXoyB.exe
  2⤵
  PID:4664
- C:\Windows\System\VngGUZO.exe
  C:\Windows\System\VngGUZO.exe
  2⤵
  PID:4188
- C:\Windows\System\GfdlvFs.exe
  C:\Windows\System\GfdlvFs.exe
  2⤵
  PID:4772
- C:\Windows\System\QjkHWfi.exe
  C:\Windows\System\QjkHWfi.exe
  2⤵
  PID:5108
- C:\Windows\System\AGTkwhN.exe
  C:\Windows\System\AGTkwhN.exe
  2⤵
  PID:4204
- C:\Windows\System\syqDJsH.exe
  C:\Windows\System\syqDJsH.exe
  2⤵
  PID:4332
- C:\Windows\System\qBSAOWh.exe
  C:\Windows\System\qBSAOWh.exe
  2⤵
  PID:4968
- C:\Windows\System\kPWgOBT.exe
  C:\Windows\System\kPWgOBT.exe
  2⤵
  PID:4312
- C:\Windows\System\GCukyOe.exe
  C:\Windows\System\GCukyOe.exe
  2⤵
  PID:4320
- C:\Windows\System\Zfsgtjv.exe
  C:\Windows\System\Zfsgtjv.exe
  2⤵
  PID:4440
- C:\Windows\System\MAGaTCb.exe
  C:\Windows\System\MAGaTCb.exe
  2⤵
  PID:4608
- C:\Windows\System\nlYYOpT.exe
  C:\Windows\System\nlYYOpT.exe
  2⤵
  PID:4556
- C:\Windows\System\qPgLflQ.exe
  C:\Windows\System\qPgLflQ.exe
  2⤵
  PID:4736
- C:\Windows\System\ZeCrmyL.exe
  C:\Windows\System\ZeCrmyL.exe
  2⤵
  PID:4100
- C:\Windows\System\gvPTatH.exe
  C:\Windows\System\gvPTatH.exe
  2⤵
  PID:4676
- C:\Windows\System\LcUVbAP.exe
  C:\Windows\System\LcUVbAP.exe
  2⤵
  PID:4452
- C:\Windows\System\fQeasog.exe
  C:\Windows\System\fQeasog.exe
  2⤵
  PID:4132
- C:\Windows\System\wGBBUIc.exe
  C:\Windows\System\wGBBUIc.exe
  2⤵
  PID:5040
- C:\Windows\System\GXaiuIc.exe
  C:\Windows\System\GXaiuIc.exe
  2⤵
  PID:1076
- C:\Windows\System\uhJWyVT.exe
  C:\Windows\System\uhJWyVT.exe
  2⤵
  PID:3236
- C:\Windows\System\WAUPBZg.exe
  C:\Windows\System\WAUPBZg.exe
  2⤵
  PID:3784
- C:\Windows\System\LzRsDyM.exe
  C:\Windows\System\LzRsDyM.exe
  2⤵
  PID:4752
- C:\Windows\System\IxzmVMi.exe
  C:\Windows\System\IxzmVMi.exe
  2⤵
  PID:4480
- C:\Windows\System\uGWmFQW.exe
  C:\Windows\System\uGWmFQW.exe
  2⤵
  PID:4732
- C:\Windows\System\rQtHrrB.exe
  C:\Windows\System\rQtHrrB.exe
  2⤵
  PID:4948
- C:\Windows\System\zvxtEbL.exe
  C:\Windows\System\zvxtEbL.exe
  2⤵
  PID:4328
- C:\Windows\System\CPsHXlf.exe
  C:\Windows\System\CPsHXlf.exe
  2⤵
  PID:4408
- C:\Windows\System\AuavGfF.exe
  C:\Windows\System\AuavGfF.exe
  2⤵
  PID:4168
- C:\Windows\System\jkvjzks.exe
  C:\Windows\System\jkvjzks.exe
  2⤵
  PID:4768
- C:\Windows\System\DclbYSU.exe
  C:\Windows\System\DclbYSU.exe
  2⤵
  PID:3828
- C:\Windows\System\qmoLHnZ.exe
  C:\Windows\System\qmoLHnZ.exe
  2⤵
  PID:5080
- C:\Windows\System\cmhisbH.exe
  C:\Windows\System\cmhisbH.exe
  2⤵
  PID:4896
- C:\Windows\System\afWiEjI.exe
  C:\Windows\System\afWiEjI.exe
  2⤵
  PID:5124
- C:\Windows\System\fbIRINB.exe
  C:\Windows\System\fbIRINB.exe
  2⤵
  PID:5140
- C:\Windows\System\tXaykkC.exe
  C:\Windows\System\tXaykkC.exe
  2⤵
  PID:5164
- C:\Windows\System\EZicTYL.exe
  C:\Windows\System\EZicTYL.exe
  2⤵
  PID:5188
- C:\Windows\System\vLtYHLr.exe
  C:\Windows\System\vLtYHLr.exe
  2⤵
  PID:5204
- C:\Windows\System\OijEJQa.exe
  C:\Windows\System\OijEJQa.exe
  2⤵
  PID:5224
- C:\Windows\System\hmVcYTp.exe
  C:\Windows\System\hmVcYTp.exe
  2⤵
  PID:5240
- C:\Windows\System\oHPiGRq.exe
  C:\Windows\System\oHPiGRq.exe
  2⤵
  PID:5260
- C:\Windows\System\VlVrPZE.exe
  C:\Windows\System\VlVrPZE.exe
  2⤵
  PID:5280
- C:\Windows\System\BcSARdC.exe
  C:\Windows\System\BcSARdC.exe
  2⤵
  PID:5296
- C:\Windows\System\erureHI.exe
  C:\Windows\System\erureHI.exe
  2⤵
  PID:5312
- C:\Windows\System\QmZSSxj.exe
  C:\Windows\System\QmZSSxj.exe
  2⤵
  PID:5328
- C:\Windows\System\dAkZCOu.exe
  C:\Windows\System\dAkZCOu.exe
  2⤵
  PID:5344
- C:\Windows\System\eTlowlU.exe
  C:\Windows\System\eTlowlU.exe
  2⤵
  PID:5376
- C:\Windows\System\YcoMtRa.exe
  C:\Windows\System\YcoMtRa.exe
  2⤵
  PID:5392
- C:\Windows\System\pGkgSnB.exe
  C:\Windows\System\pGkgSnB.exe
  2⤵
  PID:5412
- C:\Windows\System\OmpOkqp.exe
  C:\Windows\System\OmpOkqp.exe
  2⤵
  PID:5428
- C:\Windows\System\zaUCfUG.exe
  C:\Windows\System\zaUCfUG.exe
  2⤵
  PID:5452
- C:\Windows\System\oYFLWcM.exe
  C:\Windows\System\oYFLWcM.exe
  2⤵
  PID:5472
- C:\Windows\System\LlzVBgM.exe
  C:\Windows\System\LlzVBgM.exe
  2⤵
  PID:5488
- C:\Windows\System\FrXzgBD.exe
  C:\Windows\System\FrXzgBD.exe
  2⤵
  PID:5508
- C:\Windows\System\UfOsQzq.exe
  C:\Windows\System\UfOsQzq.exe
  2⤵
  PID:5532
- C:\Windows\System\WUMNrnr.exe
  C:\Windows\System\WUMNrnr.exe
  2⤵
  PID:5564
- C:\Windows\System\DUuvPqP.exe
  C:\Windows\System\DUuvPqP.exe
  2⤵
  PID:5592
- C:\Windows\System\PjCJnCT.exe
  C:\Windows\System\PjCJnCT.exe
  2⤵
  PID:5608
- C:\Windows\System\LktHdjz.exe
  C:\Windows\System\LktHdjz.exe
  2⤵
  PID:5628
- C:\Windows\System\pvascXA.exe
  C:\Windows\System\pvascXA.exe
  2⤵
  PID:5648
- C:\Windows\System\jpVDqMW.exe
  C:\Windows\System\jpVDqMW.exe
  2⤵
  PID:5664
- C:\Windows\System\nTWINzF.exe
  C:\Windows\System\nTWINzF.exe
  2⤵
  PID:5684
- C:\Windows\System\VUBqkvw.exe
  C:\Windows\System\VUBqkvw.exe
  2⤵
  PID:5700
- C:\Windows\System\yUWqPwR.exe
  C:\Windows\System\yUWqPwR.exe
  2⤵
  PID:5720
- C:\Windows\System\CgDWAmr.exe
  C:\Windows\System\CgDWAmr.exe
  2⤵
  PID:5744
- C:\Windows\System\eWGPLSt.exe
  C:\Windows\System\eWGPLSt.exe
  2⤵
  PID:5764
- C:\Windows\System\YFItifT.exe
  C:\Windows\System\YFItifT.exe
  2⤵
  PID:5784
- C:\Windows\System\uhUoVtg.exe
  C:\Windows\System\uhUoVtg.exe
  2⤵
  PID:5800
- C:\Windows\System\RyfwbFS.exe
  C:\Windows\System\RyfwbFS.exe
  2⤵
  PID:5816
- C:\Windows\System\wbJCCga.exe
  C:\Windows\System\wbJCCga.exe
  2⤵
  PID:5836
- C:\Windows\System\Jvlltec.exe
  C:\Windows\System\Jvlltec.exe
  2⤵
  PID:5856
- C:\Windows\System\fEFAjVz.exe
  C:\Windows\System\fEFAjVz.exe
  2⤵
  PID:5880
- C:\Windows\System\smVdpzk.exe
  C:\Windows\System\smVdpzk.exe
  2⤵
  PID:5896
- C:\Windows\System\KiHzpfe.exe
  C:\Windows\System\KiHzpfe.exe
  2⤵
  PID:5916
- C:\Windows\System\azSZLnJ.exe
  C:\Windows\System\azSZLnJ.exe
  2⤵
  PID:5932
- C:\Windows\System\rZyJmYj.exe
  C:\Windows\System\rZyJmYj.exe
  2⤵
  PID:5952
- C:\Windows\System\UhhrAEg.exe
  C:\Windows\System\UhhrAEg.exe
  2⤵
  PID:5968
- C:\Windows\System\RwIRJxH.exe
  C:\Windows\System\RwIRJxH.exe
  2⤵
  PID:5992
- C:\Windows\System\aLSufKh.exe
  C:\Windows\System\aLSufKh.exe
  2⤵
  PID:6008
- C:\Windows\System\goumzIA.exe
  C:\Windows\System\goumzIA.exe
  2⤵
  PID:6028
- C:\Windows\System\KiLoGpu.exe
  C:\Windows\System\KiLoGpu.exe
  2⤵
  PID:6044
- C:\Windows\System\qoJPzOV.exe
  C:\Windows\System\qoJPzOV.exe
  2⤵
  PID:6064
- C:\Windows\System\QuByexY.exe
  C:\Windows\System\QuByexY.exe
  2⤵
  PID:6092
- C:\Windows\System\xJpgZQG.exe
  C:\Windows\System\xJpgZQG.exe
  2⤵
  PID:6124
- C:\Windows\System\GTPmMqp.exe
  C:\Windows\System\GTPmMqp.exe
  2⤵
  PID:6140
- C:\Windows\System\HzGjOrt.exe
  C:\Windows\System\HzGjOrt.exe
  2⤵
  PID:5180
- C:\Windows\System\VSaObDy.exe
  C:\Windows\System\VSaObDy.exe
  2⤵
  PID:5148
- C:\Windows\System\OKfTJmA.exe
  C:\Windows\System\OKfTJmA.exe
  2⤵
  PID:5184
- C:\Windows\System\RzlvWdq.exe
  C:\Windows\System\RzlvWdq.exe
  2⤵
  PID:5248
- C:\Windows\System\HhLmBmZ.exe
  C:\Windows\System\HhLmBmZ.exe
  2⤵
  PID:5292
- C:\Windows\System\WCBNiQF.exe
  C:\Windows\System\WCBNiQF.exe
  2⤵
  PID:5360
- C:\Windows\System\ogFlAva.exe
  C:\Windows\System\ogFlAva.exe
  2⤵
  PID:5436
- C:\Windows\System\fwRsMff.exe
  C:\Windows\System\fwRsMff.exe
  2⤵
  PID:5232
- C:\Windows\System\uHzdjau.exe
  C:\Windows\System\uHzdjau.exe
  2⤵
  PID:5276
- C:\Windows\System\nYtZLpo.exe
  C:\Windows\System\nYtZLpo.exe
  2⤵
  PID:5420
- C:\Windows\System\MHMQYtO.exe
  C:\Windows\System\MHMQYtO.exe
  2⤵
  PID:5516
- C:\Windows\System\lxmJsZA.exe
  C:\Windows\System\lxmJsZA.exe
  2⤵
  PID:5572
- C:\Windows\System\xjBKjJA.exe
  C:\Windows\System\xjBKjJA.exe
  2⤵
  PID:5552
- C:\Windows\System\ZLcyvAi.exe
  C:\Windows\System\ZLcyvAi.exe
  2⤵
  PID:5540
- C:\Windows\System\ZOucTZj.exe
  C:\Windows\System\ZOucTZj.exe
  2⤵
  PID:5600
- C:\Windows\System\WUtIlGN.exe
  C:\Windows\System\WUtIlGN.exe
  2⤵
  PID:5692
- C:\Windows\System\qnCfViO.exe
  C:\Windows\System\qnCfViO.exe
  2⤵
  PID:5736
- C:\Windows\System\FEtuEqW.exe
  C:\Windows\System\FEtuEqW.exe
  2⤵
  PID:5776
- C:\Windows\System\JssxxSX.exe
  C:\Windows\System\JssxxSX.exe
  2⤵
  PID:5852
- C:\Windows\System\VfMqbtK.exe
  C:\Windows\System\VfMqbtK.exe
  2⤵
  PID:5924
- C:\Windows\System\YQvoTPd.exe
  C:\Windows\System\YQvoTPd.exe
  2⤵
  PID:6004
- C:\Windows\System\bQmsRcD.exe
  C:\Windows\System\bQmsRcD.exe
  2⤵
  PID:5676
- C:\Windows\System\beSuToU.exe
  C:\Windows\System\beSuToU.exe
  2⤵
  PID:5756
- C:\Windows\System\DXcqDGM.exe
  C:\Windows\System\DXcqDGM.exe
  2⤵
  PID:6076
- C:\Windows\System\NWlSOQg.exe
  C:\Windows\System\NWlSOQg.exe
  2⤵
  PID:5912
- C:\Windows\System\rkWymlf.exe
  C:\Windows\System\rkWymlf.exe
  2⤵
  PID:5864
- C:\Windows\System\tLkRIRZ.exe
  C:\Windows\System\tLkRIRZ.exe
  2⤵
  PID:5940
- C:\Windows\System\rfKJBtp.exe
  C:\Windows\System\rfKJBtp.exe
  2⤵
  PID:6136
- C:\Windows\System\nALEjDh.exe
  C:\Windows\System\nALEjDh.exe
  2⤵
  PID:6024
- C:\Windows\System\mhEcZSj.exe
  C:\Windows\System\mhEcZSj.exe
  2⤵
  PID:6100
- C:\Windows\System\yGsvbkz.exe
  C:\Windows\System\yGsvbkz.exe
  2⤵
  PID:5212
- C:\Windows\System\rLGbQWI.exe
  C:\Windows\System\rLGbQWI.exe
  2⤵
  PID:6120
- C:\Windows\System\dltHRHk.exe
  C:\Windows\System\dltHRHk.exe
  2⤵
  PID:5176
- C:\Windows\System\lrujwfv.exe
  C:\Windows\System\lrujwfv.exe
  2⤵
  PID:5304
- C:\Windows\System\rkYsiFZ.exe
  C:\Windows\System\rkYsiFZ.exe
  2⤵
  PID:5272
- C:\Windows\System\zKTTqsl.exe
  C:\Windows\System\zKTTqsl.exe
  2⤵
  PID:5368
- C:\Windows\System\jXYumGo.exe
  C:\Windows\System\jXYumGo.exe
  2⤵
  PID:5484
- C:\Windows\System\XEXGxqk.exe
  C:\Windows\System\XEXGxqk.exe
  2⤵
  PID:5336
- C:\Windows\System\lVNbYlP.exe
  C:\Windows\System\lVNbYlP.exe
  2⤵
  PID:5584
- C:\Windows\System\QEukLgA.exe
  C:\Windows\System\QEukLgA.exe
  2⤵
  PID:5576
- C:\Windows\System\fXXqKrh.exe
  C:\Windows\System\fXXqKrh.exe
  2⤵
  PID:5620
- C:\Windows\System\lwFHMPO.exe
  C:\Windows\System\lwFHMPO.exe
  2⤵
  PID:5728
- C:\Windows\System\kycemQE.exe
  C:\Windows\System\kycemQE.exe
  2⤵
  PID:5772
- C:\Windows\System\iBDugsF.exe
  C:\Windows\System\iBDugsF.exe
  2⤵
  PID:5888
- C:\Windows\System\jsrLkYU.exe
  C:\Windows\System\jsrLkYU.exe
  2⤵
  PID:6000
- C:\Windows\System\GQzLBmJ.exe
  C:\Windows\System\GQzLBmJ.exe
  2⤵
  PID:5712
- C:\Windows\System\iktAJvO.exe
  C:\Windows\System\iktAJvO.exe
  2⤵
  PID:5832
- C:\Windows\System\SZAqpQO.exe
  C:\Windows\System\SZAqpQO.exe
  2⤵
  PID:6088
- C:\Windows\System\WGdmITJ.exe
  C:\Windows\System\WGdmITJ.exe
  2⤵
  PID:5980
- C:\Windows\System\RTFnzCc.exe
  C:\Windows\System\RTFnzCc.exe
  2⤵
  PID:6020
- C:\Windows\System\aVzKgYW.exe
  C:\Windows\System\aVzKgYW.exe
  2⤵
  PID:4576
- C:\Windows\System\uCjkUZn.exe
  C:\Windows\System\uCjkUZn.exe
  2⤵
  PID:5448
- C:\Windows\System\RBlDdyp.exe
  C:\Windows\System\RBlDdyp.exe
  2⤵
  PID:5528
- C:\Windows\System\hwXZFwJ.exe
  C:\Windows\System\hwXZFwJ.exe
  2⤵
  PID:5636
- C:\Windows\System\uNkxuEL.exe
  C:\Windows\System\uNkxuEL.exe
  2⤵
  PID:5680
- C:\Windows\System\pZXIrnd.exe
  C:\Windows\System\pZXIrnd.exe
  2⤵
  PID:6112
- C:\Windows\System\CnPNfRg.exe
  C:\Windows\System\CnPNfRg.exe
  2⤵
  PID:5644
- C:\Windows\System\GkRLuvu.exe
  C:\Windows\System\GkRLuvu.exe
  2⤵
  PID:6084
- C:\Windows\System\uALeYeW.exe
  C:\Windows\System\uALeYeW.exe
  2⤵
  PID:6040
- C:\Windows\System\byUaain.exe
  C:\Windows\System\byUaain.exe
  2⤵
  PID:5352
- C:\Windows\System\aEtJReh.exe
  C:\Windows\System\aEtJReh.exe
  2⤵
  PID:5356
- C:\Windows\System\lzZtkaF.exe
  C:\Windows\System\lzZtkaF.exe
  2⤵
  PID:5160
- C:\Windows\System\AmMCrdK.exe
  C:\Windows\System\AmMCrdK.exe
  2⤵
  PID:1532
- C:\Windows\System\eFvuAYr.exe
  C:\Windows\System\eFvuAYr.exe
  2⤵
  PID:5812
- C:\Windows\System\OwvpnJn.exe
  C:\Windows\System\OwvpnJn.exe
  2⤵
  PID:6016
- C:\Windows\System\QwlmGSj.exe
  C:\Windows\System\QwlmGSj.exe
  2⤵
  PID:5560
- C:\Windows\System\aNGvwoi.exe
  C:\Windows\System\aNGvwoi.exe
  2⤵
  PID:5828
- C:\Windows\System\XhPrWcG.exe
  C:\Windows\System\XhPrWcG.exe
  2⤵
  PID:5216
- C:\Windows\System\zheiqmD.exe
  C:\Windows\System\zheiqmD.exe
  2⤵
  PID:5288
- C:\Windows\System\SPzvsIB.exe
  C:\Windows\System\SPzvsIB.exe
  2⤵
  PID:5588
- C:\Windows\System\kkTgvwA.exe
  C:\Windows\System\kkTgvwA.exe
  2⤵
  PID:5796
- C:\Windows\System\aKRBQip.exe
  C:\Windows\System\aKRBQip.exe
  2⤵
  PID:6060
- C:\Windows\System\yHqerUd.exe
  C:\Windows\System\yHqerUd.exe
  2⤵
  PID:6148
- C:\Windows\System\qAWnPZX.exe
  C:\Windows\System\qAWnPZX.exe
  2⤵
  PID:6180
- C:\Windows\System\UVvTFbI.exe
  C:\Windows\System\UVvTFbI.exe
  2⤵
  PID:6196
- C:\Windows\System\FpeikTK.exe
  C:\Windows\System\FpeikTK.exe
  2⤵
  PID:6212
- C:\Windows\System\UztzXtS.exe
  C:\Windows\System\UztzXtS.exe
  2⤵
  PID:6236
- C:\Windows\System\JBWtBJB.exe
  C:\Windows\System\JBWtBJB.exe
  2⤵
  PID:6252
- C:\Windows\System\FczuMHL.exe
  C:\Windows\System\FczuMHL.exe
  2⤵
  PID:6272
- C:\Windows\System\nWOIMWS.exe
  C:\Windows\System\nWOIMWS.exe
  2⤵
  PID:6288
- C:\Windows\System\ocydThJ.exe
  C:\Windows\System\ocydThJ.exe
  2⤵
  PID:6312
- C:\Windows\System\HiXMmlC.exe
  C:\Windows\System\HiXMmlC.exe
  2⤵
  PID:6328
- C:\Windows\System\DLScukL.exe
  C:\Windows\System\DLScukL.exe
  2⤵
  PID:6344
- C:\Windows\System\MEwQwxD.exe
  C:\Windows\System\MEwQwxD.exe
  2⤵
  PID:6372
- C:\Windows\System\IjhSJXF.exe
  C:\Windows\System\IjhSJXF.exe
  2⤵
  PID:6396
- C:\Windows\System\XSszhSS.exe
  C:\Windows\System\XSszhSS.exe
  2⤵
  PID:6412
- C:\Windows\System\cceyPPb.exe
  C:\Windows\System\cceyPPb.exe
  2⤵
  PID:6432
- C:\Windows\System\aBNPdJY.exe
  C:\Windows\System\aBNPdJY.exe
  2⤵
  PID:6448
- C:\Windows\System\viOeGhP.exe
  C:\Windows\System\viOeGhP.exe
  2⤵
  PID:6464
- C:\Windows\System\YJhFGjC.exe
  C:\Windows\System\YJhFGjC.exe
  2⤵
  PID:6480
- C:\Windows\System\UXfhXZN.exe
  C:\Windows\System\UXfhXZN.exe
  2⤵
  PID:6504
- C:\Windows\System\nOzcoSz.exe
  C:\Windows\System\nOzcoSz.exe
  2⤵
  PID:6520
- C:\Windows\System\JJFuHuh.exe
  C:\Windows\System\JJFuHuh.exe
  2⤵
  PID:6536
- C:\Windows\System\epDNviQ.exe
  C:\Windows\System\epDNviQ.exe
  2⤵
  PID:6576
- C:\Windows\System\RndHtWB.exe
  C:\Windows\System\RndHtWB.exe
  2⤵
  PID:6596
- C:\Windows\System\UMeCZxS.exe
  C:\Windows\System\UMeCZxS.exe
  2⤵
  PID:6620
- C:\Windows\System\zsRPbFb.exe
  C:\Windows\System\zsRPbFb.exe
  2⤵
  PID:6636
- C:\Windows\System\eXnTBYI.exe
  C:\Windows\System\eXnTBYI.exe
  2⤵
  PID:6656
- C:\Windows\System\iiGBiOM.exe
  C:\Windows\System\iiGBiOM.exe
  2⤵
  PID:6676
- C:\Windows\System\pNnvsul.exe
  C:\Windows\System\pNnvsul.exe
  2⤵
  PID:6696
- C:\Windows\System\wbIsQnF.exe
  C:\Windows\System\wbIsQnF.exe
  2⤵
  PID:6712
- C:\Windows\System\EOnvNIP.exe
  C:\Windows\System\EOnvNIP.exe
  2⤵
  PID:6736
- C:\Windows\System\fYWKuUN.exe
  C:\Windows\System\fYWKuUN.exe
  2⤵
  PID:6756
- C:\Windows\System\hAZCWdt.exe
  C:\Windows\System\hAZCWdt.exe
  2⤵
  PID:6780
- C:\Windows\System\MULuQOG.exe
  C:\Windows\System\MULuQOG.exe
  2⤵
  PID:6796
- C:\Windows\System\UoTbxYy.exe
  C:\Windows\System\UoTbxYy.exe
  2⤵
  PID:6820
- C:\Windows\System\hpxBRzJ.exe
  C:\Windows\System\hpxBRzJ.exe
  2⤵
  PID:6840
- C:\Windows\System\BMrZwWn.exe
  C:\Windows\System\BMrZwWn.exe
  2⤵
  PID:6856
- C:\Windows\System\MimlAbG.exe
  C:\Windows\System\MimlAbG.exe
  2⤵
  PID:6872
- C:\Windows\System\JRRgsnI.exe
  C:\Windows\System\JRRgsnI.exe
  2⤵
  PID:6888
- C:\Windows\System\miTJXKI.exe
  C:\Windows\System\miTJXKI.exe
  2⤵
  PID:6908
- C:\Windows\System\gANlmkI.exe
  C:\Windows\System\gANlmkI.exe
  2⤵
  PID:6940
- C:\Windows\System\nWtBKKp.exe
  C:\Windows\System\nWtBKKp.exe
  2⤵
  PID:6956
- C:\Windows\System\OnaWjQj.exe
  C:\Windows\System\OnaWjQj.exe
  2⤵
  PID:6976
- C:\Windows\System\DGBPtmq.exe
  C:\Windows\System\DGBPtmq.exe
  2⤵
  PID:7000
- C:\Windows\System\OBhSPbC.exe
  C:\Windows\System\OBhSPbC.exe
  2⤵
  PID:7028
- C:\Windows\System\RssTwCL.exe
  C:\Windows\System\RssTwCL.exe
  2⤵
  PID:7044
- C:\Windows\System\WTvTMnh.exe
  C:\Windows\System\WTvTMnh.exe
  2⤵
  PID:7060
- C:\Windows\System\dKTZhOh.exe
  C:\Windows\System\dKTZhOh.exe
  2⤵
  PID:7080
- C:\Windows\System\PMOtBJx.exe
  C:\Windows\System\PMOtBJx.exe
  2⤵
  PID:7096
- C:\Windows\System\Vjhdtch.exe
  C:\Windows\System\Vjhdtch.exe
  2⤵
  PID:7112
- C:\Windows\System\fYAYzxa.exe
  C:\Windows\System\fYAYzxa.exe
  2⤵
  PID:7128
- C:\Windows\System\qhUqtHA.exe
  C:\Windows\System\qhUqtHA.exe
  2⤵
  PID:7164
- C:\Windows\System\ifFuJnt.exe
  C:\Windows\System\ifFuJnt.exe
  2⤵
  PID:6156
- C:\Windows\System\ljWntPg.exe
  C:\Windows\System\ljWntPg.exe
  2⤵
  PID:5324
- C:\Windows\System\ZSMbyjo.exe
  C:\Windows\System\ZSMbyjo.exe
  2⤵
  PID:6132
- C:\Windows\System\DLxkWPC.exe
  C:\Windows\System\DLxkWPC.exe
  2⤵
  PID:5656
- C:\Windows\System\rCXjusH.exe
  C:\Windows\System\rCXjusH.exe
  2⤵
  PID:6192
- C:\Windows\System\rCbKUuy.exe
  C:\Windows\System\rCbKUuy.exe
  2⤵
  PID:6224
- C:\Windows\System\TFsuuOz.exe
  C:\Windows\System\TFsuuOz.exe
  2⤵
  PID:6284
- C:\Windows\System\LuJStlq.exe
  C:\Windows\System\LuJStlq.exe
  2⤵
  PID:6352
- C:\Windows\System\fBFSrsI.exe
  C:\Windows\System\fBFSrsI.exe
  2⤵
  PID:6260
- C:\Windows\System\IJnqAUJ.exe
  C:\Windows\System\IJnqAUJ.exe
  2⤵
  PID:6268
- C:\Windows\System\RFxgase.exe
  C:\Windows\System\RFxgase.exe
  2⤵
  PID:6408
- C:\Windows\System\rIOQUmV.exe
  C:\Windows\System\rIOQUmV.exe
  2⤵
  PID:6476
- C:\Windows\System\dbbHHel.exe
  C:\Windows\System\dbbHHel.exe
  2⤵
  PID:6548
- C:\Windows\System\ZFDuDlV.exe
  C:\Windows\System\ZFDuDlV.exe
  2⤵
  PID:6572
- C:\Windows\System\mzNnWTN.exe
  C:\Windows\System\mzNnWTN.exe
  2⤵
  PID:6496
- C:\Windows\System\VuiJaBL.exe
  C:\Windows\System\VuiJaBL.exe
  2⤵
  PID:6492
- C:\Windows\System\TimaEFh.exe
  C:\Windows\System\TimaEFh.exe
  2⤵
  PID:6552
- C:\Windows\System\cnmRGLE.exe
  C:\Windows\System\cnmRGLE.exe
  2⤵
  PID:6608
- C:\Windows\System\shwbIHh.exe
  C:\Windows\System\shwbIHh.exe
  2⤵
  PID:6648
- C:\Windows\System\ZdZtfbu.exe
  C:\Windows\System\ZdZtfbu.exe
  2⤵
  PID:6684
- C:\Windows\System\QNYVaXm.exe
  C:\Windows\System\QNYVaXm.exe
  2⤵
  PID:6720
- C:\Windows\System\vfptBrJ.exe
  C:\Windows\System\vfptBrJ.exe
  2⤵
  PID:6776
- C:\Windows\System\SwbLRhg.exe
  C:\Windows\System\SwbLRhg.exe
  2⤵
  PID:6792
- C:\Windows\System\HsTenag.exe
  C:\Windows\System\HsTenag.exe
  2⤵
  PID:6884
- C:\Windows\System\NgrhJsF.exe
  C:\Windows\System\NgrhJsF.exe
  2⤵
  PID:6832
- C:\Windows\System\QeJFZwN.exe
  C:\Windows\System\QeJFZwN.exe
  2⤵
  PID:6932
- C:\Windows\System\BymEdop.exe
  C:\Windows\System\BymEdop.exe
  2⤵
  PID:6948
- C:\Windows\System\tuAfcwJ.exe
  C:\Windows\System\tuAfcwJ.exe
  2⤵
  PID:7016
- C:\Windows\System\eKfUyZr.exe
  C:\Windows\System\eKfUyZr.exe
  2⤵
  PID:7040
- C:\Windows\System\LPZhSuz.exe
  C:\Windows\System\LPZhSuz.exe
  2⤵
  PID:7144
- C:\Windows\System\ohlQZuo.exe
  C:\Windows\System\ohlQZuo.exe
  2⤵
  PID:7052
- C:\Windows\System\VVZgrgf.exe
  C:\Windows\System\VVZgrgf.exe
  2⤵
  PID:6172
- C:\Windows\System\pGLxjHh.exe
  C:\Windows\System\pGLxjHh.exe
  2⤵
  PID:6368
- C:\Windows\System\eLhJDiM.exe
  C:\Windows\System\eLhJDiM.exe
  2⤵
  PID:7120
- C:\Windows\System\ZbCUxvQ.exe
  C:\Windows\System\ZbCUxvQ.exe
  2⤵
  PID:6460
- C:\Windows\System\wrqgyBa.exe
  C:\Windows\System\wrqgyBa.exe
  2⤵
  PID:6560
- C:\Windows\System\klTNUyQ.exe
  C:\Windows\System\klTNUyQ.exe
  2⤵
  PID:6392
- C:\Windows\System\zNZNQyG.exe
  C:\Windows\System\zNZNQyG.exe
  2⤵
  PID:6204
- C:\Windows\System\zitPhzf.exe
  C:\Windows\System\zitPhzf.exe
  2⤵
  PID:6232
- C:\Windows\System\ClQJTTg.exe
  C:\Windows\System\ClQJTTg.exe
  2⤵
  PID:6380
- C:\Windows\System\ulqovXp.exe
  C:\Windows\System\ulqovXp.exe
  2⤵
  PID:6456
- C:\Windows\System\caZvXyc.exe
  C:\Windows\System\caZvXyc.exe
  2⤵
  PID:6644
- C:\Windows\System\UNqUZlC.exe
  C:\Windows\System\UNqUZlC.exe
  2⤵
  PID:6804
- C:\Windows\System\cyEBSlS.exe
  C:\Windows\System\cyEBSlS.exe
  2⤵
  PID:6664
- C:\Windows\System\fqxhTIx.exe
  C:\Windows\System\fqxhTIx.exe
  2⤵
  PID:6924
- C:\Windows\System\YOjyrhp.exe
  C:\Windows\System\YOjyrhp.exe
  2⤵
  PID:6968
- C:\Windows\System\kbyRlDW.exe
  C:\Windows\System\kbyRlDW.exe
  2⤵
  PID:6852
- C:\Windows\System\gytChza.exe
  C:\Windows\System\gytChza.exe
  2⤵
  PID:7024
- C:\Windows\System\ewSOIAz.exe
  C:\Windows\System\ewSOIAz.exe
  2⤵
  PID:6984
- C:\Windows\System\iDGXljs.exe
  C:\Windows\System\iDGXljs.exe
  2⤵
  PID:7012
- C:\Windows\System\GfWTzVo.exe
  C:\Windows\System\GfWTzVo.exe
  2⤵
  PID:6592
- C:\Windows\System\unOKwTN.exe
  C:\Windows\System\unOKwTN.exe
  2⤵
  PID:7136
- C:\Windows\System\JiTkNbC.exe
  C:\Windows\System\JiTkNbC.exe
  2⤵
  PID:6280
- C:\Windows\System\ZnDfVYu.exe
  C:\Windows\System\ZnDfVYu.exe
  2⤵
  PID:6404
- C:\Windows\System\nmNZOUl.exe
  C:\Windows\System\nmNZOUl.exe
  2⤵
  PID:6688
- C:\Windows\System\vqqCWww.exe
  C:\Windows\System\vqqCWww.exe
  2⤵
  PID:6424
- C:\Windows\System\kdqeGUf.exe
  C:\Windows\System\kdqeGUf.exe
  2⤵
  PID:6828
- C:\Windows\System\oyMoaQc.exe
  C:\Windows\System\oyMoaQc.exe
  2⤵
  PID:6848
- C:\Windows\System\hXyEajr.exe
  C:\Windows\System\hXyEajr.exe
  2⤵
  PID:6628
- C:\Windows\System\AtAaSZX.exe
  C:\Windows\System\AtAaSZX.exe
  2⤵
  PID:6444
- C:\Windows\System\kPmyxcD.exe
  C:\Windows\System\kPmyxcD.exe
  2⤵
  PID:7156
- C:\Windows\System\SJOuDrs.exe
  C:\Windows\System\SJOuDrs.exe
  2⤵
  PID:6880
- C:\Windows\System\AQoWzGG.exe
  C:\Windows\System\AQoWzGG.exe
  2⤵
  PID:6744
- C:\Windows\System\gfQsLMk.exe
  C:\Windows\System\gfQsLMk.exe
  2⤵
  PID:7076
- C:\Windows\System\fWRBooM.exe
  C:\Windows\System\fWRBooM.exe
  2⤵
  PID:6116
- C:\Windows\System\cboSPaf.exe
  C:\Windows\System\cboSPaf.exe
  2⤵
  PID:7108
- C:\Windows\System\HzaQkro.exe
  C:\Windows\System\HzaQkro.exe
  2⤵
  PID:6324
- C:\Windows\System\qfTTIzN.exe
  C:\Windows\System\qfTTIzN.exe
  2⤵
  PID:6516
- C:\Windows\System\zLZQrer.exe
  C:\Windows\System\zLZQrer.exe
  2⤵
  PID:6208
- C:\Windows\System\Kiftunu.exe
  C:\Windows\System\Kiftunu.exe
  2⤵
  PID:7192
- C:\Windows\System\eHZixoy.exe
  C:\Windows\System\eHZixoy.exe
  2⤵
  PID:7224
- C:\Windows\System\nMaXJmD.exe
  C:\Windows\System\nMaXJmD.exe
  2⤵
  PID:7244
- C:\Windows\System\AmFLZzP.exe
  C:\Windows\System\AmFLZzP.exe
  2⤵
  PID:7268
- C:\Windows\System\NwcPpUW.exe
  C:\Windows\System\NwcPpUW.exe
  2⤵
  PID:7284
- C:\Windows\System\WBqXxQw.exe
  C:\Windows\System\WBqXxQw.exe
  2⤵
  PID:7300
- C:\Windows\System\mUzggym.exe
  C:\Windows\System\mUzggym.exe
  2⤵
  PID:7324
- C:\Windows\System\VzdmvjB.exe
  C:\Windows\System\VzdmvjB.exe
  2⤵
  PID:7340
- C:\Windows\System\togVDei.exe
  C:\Windows\System\togVDei.exe
  2⤵
  PID:7364
- C:\Windows\System\KyguPTy.exe
  C:\Windows\System\KyguPTy.exe
  2⤵
  PID:7380
- C:\Windows\System\NUvicaH.exe
  C:\Windows\System\NUvicaH.exe
  2⤵
  PID:7404
- C:\Windows\System\GGsBomd.exe
  C:\Windows\System\GGsBomd.exe
  2⤵
  PID:7428
- C:\Windows\System\DaBPKXN.exe
  C:\Windows\System\DaBPKXN.exe
  2⤵
  PID:7444
- C:\Windows\System\kGEjsUe.exe
  C:\Windows\System\kGEjsUe.exe
  2⤵
  PID:7460
- C:\Windows\System\dXAAUJB.exe
  C:\Windows\System\dXAAUJB.exe
  2⤵
  PID:7476
- C:\Windows\System\iDfCquJ.exe
  C:\Windows\System\iDfCquJ.exe
  2⤵
  PID:7496
- C:\Windows\System\BHjMQZe.exe
  C:\Windows\System\BHjMQZe.exe
  2⤵
  PID:7512
- C:\Windows\System\SBoHyjG.exe
  C:\Windows\System\SBoHyjG.exe
  2⤵
  PID:7536
- C:\Windows\System\yWUDEUS.exe
  C:\Windows\System\yWUDEUS.exe
  2⤵
  PID:7556
- C:\Windows\System\AkdhqPI.exe
  C:\Windows\System\AkdhqPI.exe
  2⤵
  PID:7572
- C:\Windows\System\XMGQnLo.exe
  C:\Windows\System\XMGQnLo.exe
  2⤵
  PID:7608
- C:\Windows\System\OPTYSVJ.exe
  C:\Windows\System\OPTYSVJ.exe
  2⤵
  PID:7624
- C:\Windows\System\ScTgEai.exe
  C:\Windows\System\ScTgEai.exe
  2⤵
  PID:7644
- C:\Windows\System\xSyqFHK.exe
  C:\Windows\System\xSyqFHK.exe
  2⤵
  PID:7668
- C:\Windows\System\FaoWLfQ.exe
  C:\Windows\System\FaoWLfQ.exe
  2⤵
  PID:7684
- C:\Windows\System\pFhYlsx.exe
  C:\Windows\System\pFhYlsx.exe
  2⤵
  PID:7704
- C:\Windows\System\UobJKHl.exe
  C:\Windows\System\UobJKHl.exe
  2⤵
  PID:7724
- C:\Windows\System\tzSSLHB.exe
  C:\Windows\System\tzSSLHB.exe
  2⤵
  PID:7744
- C:\Windows\System\MIFokkF.exe
  C:\Windows\System\MIFokkF.exe
  2⤵
  PID:7764
- C:\Windows\System\GfTLzjA.exe
  C:\Windows\System\GfTLzjA.exe
  2⤵
  PID:7784
- C:\Windows\System\PohKByi.exe
  C:\Windows\System\PohKByi.exe
  2⤵
  PID:7804
- C:\Windows\System\FKttSlV.exe
  C:\Windows\System\FKttSlV.exe
  2⤵
  PID:7820
- C:\Windows\System\FsoKyTr.exe
  C:\Windows\System\FsoKyTr.exe
  2⤵
  PID:7840
- C:\Windows\System\MKYEfgi.exe
  C:\Windows\System\MKYEfgi.exe
  2⤵
  PID:7860
- C:\Windows\System\FCFXHAJ.exe
  C:\Windows\System\FCFXHAJ.exe
  2⤵
  PID:7880
- C:\Windows\System\BHINXMS.exe
  C:\Windows\System\BHINXMS.exe
  2⤵
  PID:7896
- C:\Windows\System\FGnWJmi.exe
  C:\Windows\System\FGnWJmi.exe
  2⤵
  PID:7920
- C:\Windows\System\qdZGlnP.exe
  C:\Windows\System\qdZGlnP.exe
  2⤵
  PID:7936
- C:\Windows\System\hfrKssy.exe
  C:\Windows\System\hfrKssy.exe
  2⤵
  PID:7968
- C:\Windows\System\kxXAWUN.exe
  C:\Windows\System\kxXAWUN.exe
  2⤵
  PID:7988
- C:\Windows\System\VXVrtQA.exe
  C:\Windows\System\VXVrtQA.exe
  2⤵
  PID:8004
- C:\Windows\System\MOivngh.exe
  C:\Windows\System\MOivngh.exe
  2⤵
  PID:8028
- C:\Windows\System\dVkSweN.exe
  C:\Windows\System\dVkSweN.exe
  2⤵
  PID:8044
- C:\Windows\System\cKgGVdM.exe
  C:\Windows\System\cKgGVdM.exe
  2⤵
  PID:8068
- C:\Windows\System\fonRZyh.exe
  C:\Windows\System\fonRZyh.exe
  2⤵
  PID:8084
- C:\Windows\System\ajKtauK.exe
  C:\Windows\System\ajKtauK.exe
  2⤵
  PID:8104
- C:\Windows\System\awlTmFh.exe
  C:\Windows\System\awlTmFh.exe
  2⤵
  PID:8128
- C:\Windows\System\vvLkeCP.exe
  C:\Windows\System\vvLkeCP.exe
  2⤵
  PID:8144
- C:\Windows\System\CXRzTGz.exe
  C:\Windows\System\CXRzTGz.exe
  2⤵
  PID:8168
- C:\Windows\System\FpAxWdn.exe
  C:\Windows\System\FpAxWdn.exe
  2⤵
  PID:8184
- C:\Windows\System\AXFskub.exe
  C:\Windows\System\AXFskub.exe
  2⤵
  PID:7208
- C:\Windows\System\MWKdtpE.exe
  C:\Windows\System\MWKdtpE.exe
  2⤵
  PID:7072
- C:\Windows\System\QkOZlMY.exe
  C:\Windows\System\QkOZlMY.exe
  2⤵
  PID:7220
- C:\Windows\System\bJVzgCa.exe
  C:\Windows\System\bJVzgCa.exe
  2⤵
  PID:6752
- C:\Windows\System\HtFcMOY.exe
  C:\Windows\System\HtFcMOY.exe
  2⤵
  PID:6500
- C:\Windows\System\xZsYfJJ.exe
  C:\Windows\System\xZsYfJJ.exe
  2⤵
  PID:7180
- C:\Windows\System\JFjPtaI.exe
  C:\Windows\System\JFjPtaI.exe
  2⤵
  PID:7252
- C:\Windows\System\NYNkEAE.exe
  C:\Windows\System\NYNkEAE.exe
  2⤵
  PID:7292
- C:\Windows\System\hjjcAlt.exe
  C:\Windows\System\hjjcAlt.exe
  2⤵
  PID:7312
- C:\Windows\System\CGsnQkY.exe
  C:\Windows\System\CGsnQkY.exe
  2⤵
  PID:7360
- C:\Windows\System\oFLaIPc.exe
  C:\Windows\System\oFLaIPc.exe
  2⤵
  PID:7400
- C:\Windows\System\bWzgGPM.exe
  C:\Windows\System\bWzgGPM.exe
  2⤵
  PID:7348
- C:\Windows\System\hUTbItz.exe
  C:\Windows\System\hUTbItz.exe
  2⤵
  PID:7456
- C:\Windows\System\UjMeJpB.exe
  C:\Windows\System\UjMeJpB.exe
  2⤵
  PID:7520
- C:\Windows\System\coVfrUf.exe
  C:\Windows\System\coVfrUf.exe
  2⤵
  PID:7508
- C:\Windows\System\FrLTKLE.exe
  C:\Windows\System\FrLTKLE.exe
  2⤵
  PID:7596
- C:\Windows\System\NXzDhSQ.exe
  C:\Windows\System\NXzDhSQ.exe
  2⤵
  PID:7588
- C:\Windows\System\IVZHyST.exe
  C:\Windows\System\IVZHyST.exe
  2⤵
  PID:7636
- C:\Windows\System\ujnpAJC.exe
  C:\Windows\System\ujnpAJC.exe
  2⤵
  PID:7656
- C:\Windows\System\JGaxbLb.exe
  C:\Windows\System\JGaxbLb.exe
  2⤵
  PID:7700
- C:\Windows\System\VbkkVHJ.exe
  C:\Windows\System\VbkkVHJ.exe
  2⤵
  PID:7720
- C:\Windows\System\oAFhBTc.exe
  C:\Windows\System\oAFhBTc.exe
  2⤵
  PID:7772
- C:\Windows\System\UKJKoGU.exe
  C:\Windows\System\UKJKoGU.exe
  2⤵
  PID:7816
- C:\Windows\System\adhrOBO.exe
  C:\Windows\System\adhrOBO.exe
  2⤵
  PID:7856
- C:\Windows\System\HfANdyw.exe
  C:\Windows\System\HfANdyw.exe
  2⤵
  PID:7796
- C:\Windows\System\ALeWdvb.exe
  C:\Windows\System\ALeWdvb.exe
  2⤵
  PID:7932
- C:\Windows\System\DwIGdgl.exe
  C:\Windows\System\DwIGdgl.exe
  2⤵
  PID:7976
- C:\Windows\System\XpsWTBM.exe
  C:\Windows\System\XpsWTBM.exe
  2⤵
  PID:7980
- C:\Windows\System\lAlIIwX.exe
  C:\Windows\System\lAlIIwX.exe
  2⤵
  PID:8016
- C:\Windows\System\gIDxYTs.exe
  C:\Windows\System\gIDxYTs.exe
  2⤵
  PID:8052
- C:\Windows\System\pxgaCTl.exe
  C:\Windows\System\pxgaCTl.exe
  2⤵
  PID:8036
- C:\Windows\System\dWGbWLT.exe
  C:\Windows\System\dWGbWLT.exe
  2⤵
  PID:8096
- C:\Windows\System\GqXCNyV.exe
  C:\Windows\System\GqXCNyV.exe
  2⤵
  PID:8116
- C:\Windows\System\NDbYXek.exe
  C:\Windows\System\NDbYXek.exe
  2⤵
  PID:7216
- C:\Windows\System\HCssPMJ.exe
  C:\Windows\System\HCssPMJ.exe
  2⤵
  PID:6972
- C:\Windows\System\EmfvGiO.exe
  C:\Windows\System\EmfvGiO.exe
  2⤵
  PID:6564
- C:\Windows\System\AhyOChr.exe
  C:\Windows\System\AhyOChr.exe
  2⤵
  PID:6340
- C:\Windows\System\IGqlGjf.exe
  C:\Windows\System\IGqlGjf.exe
  2⤵
  PID:6836
- C:\Windows\System\qiyJzzv.exe
  C:\Windows\System\qiyJzzv.exe
  2⤵
  PID:7264
- C:\Windows\System\SdbZwmJ.exe
  C:\Windows\System\SdbZwmJ.exe
  2⤵
  PID:7280
- C:\Windows\System\adnJueJ.exe
  C:\Windows\System\adnJueJ.exe
  2⤵
  PID:7356
- C:\Windows\System\zfRFCHG.exe
  C:\Windows\System\zfRFCHG.exe
  2⤵
  PID:7412
- C:\Windows\System\lMborgC.exe
  C:\Windows\System\lMborgC.exe
  2⤵
  PID:7440
- C:\Windows\System\xQgrxnh.exe
  C:\Windows\System\xQgrxnh.exe
  2⤵
  PID:7564
- C:\Windows\System\WblMONW.exe
  C:\Windows\System\WblMONW.exe
  2⤵
  PID:7504
- C:\Windows\System\tzllppu.exe
  C:\Windows\System\tzllppu.exe
  2⤵
  PID:7616
- C:\Windows\System\xViBXHp.exe
  C:\Windows\System\xViBXHp.exe
  2⤵
  PID:7652
- C:\Windows\System\RAdtDiE.exe
  C:\Windows\System\RAdtDiE.exe
  2⤵
  PID:7680
- C:\Windows\System\WwKEPoc.exe
  C:\Windows\System\WwKEPoc.exe
  2⤵
  PID:7852
- C:\Windows\System\aDJgqRN.exe
  C:\Windows\System\aDJgqRN.exe
  2⤵
  PID:7828
- C:\Windows\System\GcuCRUU.exe
  C:\Windows\System\GcuCRUU.exe
  2⤵
  PID:7904
- C:\Windows\System\OsXgikZ.exe
  C:\Windows\System\OsXgikZ.exe
  2⤵
  PID:7952
- C:\Windows\System\jIrTtsR.exe
  C:\Windows\System\jIrTtsR.exe
  2⤵
  PID:7996
- C:\Windows\System\FTRrYCX.exe
  C:\Windows\System\FTRrYCX.exe
  2⤵
  PID:8092
- C:\Windows\System\ttLIbSl.exe
  C:\Windows\System\ttLIbSl.exe
  2⤵
  PID:8140
- C:\Windows\System\MUAKnar.exe
  C:\Windows\System\MUAKnar.exe
  2⤵
  PID:6336
- C:\Windows\System\wmHtkgN.exe
  C:\Windows\System\wmHtkgN.exe
  2⤵
  PID:7204
- C:\Windows\System\JGGZRqW.exe
  C:\Windows\System\JGGZRqW.exe
  2⤵
  PID:7240
- C:\Windows\System\RoZQvqw.exe
  C:\Windows\System\RoZQvqw.exe
  2⤵
  PID:7492
- C:\Windows\System\fZeJxqc.exe
  C:\Windows\System\fZeJxqc.exe
  2⤵
  PID:7692
- C:\Windows\System\qVvaaux.exe
  C:\Windows\System\qVvaaux.exe
  2⤵
  PID:7568
- C:\Windows\System\EpkYdMz.exe
  C:\Windows\System\EpkYdMz.exe
  2⤵
  PID:7740
- C:\Windows\System\dbiaKPv.exe
  C:\Windows\System\dbiaKPv.exe
  2⤵
  PID:7800
- C:\Windows\System\CchCBHb.exe
  C:\Windows\System\CchCBHb.exe
  2⤵
  PID:7736
- C:\Windows\System\weIJVry.exe
  C:\Windows\System\weIJVry.exe
  2⤵
  PID:8056
- C:\Windows\System\bxUvEuX.exe
  C:\Windows\System\bxUvEuX.exe
  2⤵
  PID:7916
- C:\Windows\System\UqQrCtL.exe
  C:\Windows\System\UqQrCtL.exe
  2⤵
  PID:7984
- C:\Windows\System\TRyNvBG.exe
  C:\Windows\System\TRyNvBG.exe
  2⤵
  PID:7956
- C:\Windows\System\TYXqRYM.exe
  C:\Windows\System\TYXqRYM.exe
  2⤵
  PID:6428
- C:\Windows\System\HvqbPsT.exe
  C:\Windows\System\HvqbPsT.exe
  2⤵
  PID:7260
- C:\Windows\System\jaOCMct.exe
  C:\Windows\System\jaOCMct.exe
  2⤵
  PID:7396
- C:\Windows\System\OPIjwzm.exe
  C:\Windows\System\OPIjwzm.exe
  2⤵
  PID:7640
- C:\Windows\System\ThBwCqT.exe
  C:\Windows\System\ThBwCqT.exe
  2⤵
  PID:7468
- C:\Windows\System\gdmHPMZ.exe
  C:\Windows\System\gdmHPMZ.exe
  2⤵
  PID:7792
- C:\Windows\System\YksqyZV.exe
  C:\Windows\System\YksqyZV.exe
  2⤵
  PID:8076
- C:\Windows\System\teDeMSS.exe
  C:\Windows\System\teDeMSS.exe
  2⤵
  PID:8160
- C:\Windows\System\ALzgCVY.exe
  C:\Windows\System\ALzgCVY.exe
  2⤵
  PID:7188
- C:\Windows\System\hQANiOX.exe
  C:\Windows\System\hQANiOX.exe
  2⤵
  PID:7316
- C:\Windows\System\fXnshBZ.exe
  C:\Windows\System\fXnshBZ.exe
  2⤵
  PID:7776
- C:\Windows\System\pUeleQx.exe
  C:\Windows\System\pUeleQx.exe
  2⤵
  PID:7088
- C:\Windows\System\pdyhdGP.exe
  C:\Windows\System\pdyhdGP.exe
  2⤵
  PID:8136
- C:\Windows\System\uqbtfRc.exe
  C:\Windows\System\uqbtfRc.exe
  2⤵
  PID:8120
- C:\Windows\System\TKerhEJ.exe
  C:\Windows\System\TKerhEJ.exe
  2⤵
  PID:7528
- C:\Windows\System\KBayexT.exe
  C:\Windows\System\KBayexT.exe
  2⤵
  PID:8208
- C:\Windows\System\BaLOUek.exe
  C:\Windows\System\BaLOUek.exe
  2⤵
  PID:8232
- C:\Windows\System\gXWpaES.exe
  C:\Windows\System\gXWpaES.exe
  2⤵
  PID:8252
- C:\Windows\System\JAwpMDj.exe
  C:\Windows\System\JAwpMDj.exe
  2⤵
  PID:8272
- C:\Windows\System\CvnovIa.exe
  C:\Windows\System\CvnovIa.exe
  2⤵
  PID:8288
- C:\Windows\System\nMALTPf.exe
  C:\Windows\System\nMALTPf.exe
  2⤵
  PID:8308
- C:\Windows\System\MJTmyUp.exe
  C:\Windows\System\MJTmyUp.exe
  2⤵
  PID:8332
- C:\Windows\System\ubVpWvp.exe
  C:\Windows\System\ubVpWvp.exe
  2⤵
  PID:8352
- C:\Windows\System\rKHgqRb.exe
  C:\Windows\System\rKHgqRb.exe
  2⤵
  PID:8380
- C:\Windows\System\ZIOdVlj.exe
  C:\Windows\System\ZIOdVlj.exe
  2⤵
  PID:8396
- C:\Windows\System\hZgfMVV.exe
  C:\Windows\System\hZgfMVV.exe
  2⤵
  PID:8412
- C:\Windows\System\ztZOlQd.exe
  C:\Windows\System\ztZOlQd.exe
  2⤵
  PID:8432
- C:\Windows\System\YuFoYxz.exe
  C:\Windows\System\YuFoYxz.exe
  2⤵
  PID:8456
- C:\Windows\System\pMGMXjW.exe
  C:\Windows\System\pMGMXjW.exe
  2⤵
  PID:8476
- C:\Windows\System\RDLZEEa.exe
  C:\Windows\System\RDLZEEa.exe
  2⤵
  PID:8496
- C:\Windows\System\nHTweCy.exe
  C:\Windows\System\nHTweCy.exe
  2⤵
  PID:8512
- C:\Windows\System\JLqIjDt.exe
  C:\Windows\System\JLqIjDt.exe
  2⤵
  PID:8536
- C:\Windows\System\xqToWLe.exe
  C:\Windows\System\xqToWLe.exe
  2⤵
  PID:8552
- C:\Windows\System\kmXwZUA.exe
  C:\Windows\System\kmXwZUA.exe
  2⤵
  PID:8576
- C:\Windows\System\okXYEbK.exe
  C:\Windows\System\okXYEbK.exe
  2⤵
  PID:8592
- C:\Windows\System\HECiszI.exe
  C:\Windows\System\HECiszI.exe
  2⤵
  PID:8612
- C:\Windows\System\GQrcNYp.exe
  C:\Windows\System\GQrcNYp.exe
  2⤵
  PID:8636
- C:\Windows\System\koLKOmn.exe
  C:\Windows\System\koLKOmn.exe
  2⤵
  PID:8656
- C:\Windows\System\zgKhpBO.exe
  C:\Windows\System\zgKhpBO.exe
  2⤵
  PID:8676
- C:\Windows\System\aLsHDaA.exe
  C:\Windows\System\aLsHDaA.exe
  2⤵
  PID:8692
- C:\Windows\System\qTqPlZg.exe
  C:\Windows\System\qTqPlZg.exe
  2⤵
  PID:8716
- C:\Windows\System\GPBijOB.exe
  C:\Windows\System\GPBijOB.exe
  2⤵
  PID:8732
- C:\Windows\System\wffbdkA.exe
  C:\Windows\System\wffbdkA.exe
  2⤵
  PID:8764
- C:\Windows\System\zXuDduU.exe
  C:\Windows\System\zXuDduU.exe
  2⤵
  PID:8780
- C:\Windows\System\JEdMkIr.exe
  C:\Windows\System\JEdMkIr.exe
  2⤵
  PID:8800
- C:\Windows\System\dAlqxFF.exe
  C:\Windows\System\dAlqxFF.exe
  2⤵
  PID:8824
- C:\Windows\System\rHDvfkV.exe
  C:\Windows\System\rHDvfkV.exe
  2⤵
  PID:8840
- C:\Windows\System\oTUEvcg.exe
  C:\Windows\System\oTUEvcg.exe
  2⤵
  PID:8856
- C:\Windows\System\YBZVrdf.exe
  C:\Windows\System\YBZVrdf.exe
  2⤵
  PID:8884
- C:\Windows\System\HZkEPiY.exe
  C:\Windows\System\HZkEPiY.exe
  2⤵
  PID:8904
- C:\Windows\System\DgELiMH.exe
  C:\Windows\System\DgELiMH.exe
  2⤵
  PID:8924
- C:\Windows\System\ImmRGCr.exe
  C:\Windows\System\ImmRGCr.exe
  2⤵
  PID:8940
- C:\Windows\System\dcQqryG.exe
  C:\Windows\System\dcQqryG.exe
  2⤵
  PID:8956
- C:\Windows\System\oEmuqOh.exe
  C:\Windows\System\oEmuqOh.exe
  2⤵
  PID:8976
- C:\Windows\System\vkEwPXj.exe
  C:\Windows\System\vkEwPXj.exe
  2⤵
  PID:8992
- C:\Windows\System\bgIYVbk.exe
  C:\Windows\System\bgIYVbk.exe
  2⤵
  PID:9008
- C:\Windows\System\qallBvz.exe
  C:\Windows\System\qallBvz.exe
  2⤵
  PID:9032
- C:\Windows\System\uWVquvO.exe
  C:\Windows\System\uWVquvO.exe
  2⤵
  PID:9068
- C:\Windows\System\GyeEBBz.exe
  C:\Windows\System\GyeEBBz.exe
  2⤵
  PID:9084
- C:\Windows\System\neTjuMr.exe
  C:\Windows\System\neTjuMr.exe
  2⤵
  PID:9100
- C:\Windows\System\dfaMDgz.exe
  C:\Windows\System\dfaMDgz.exe
  2⤵
  PID:9120
- C:\Windows\System\TeuYUCf.exe
  C:\Windows\System\TeuYUCf.exe
  2⤵
  PID:9152
- C:\Windows\System\IbYGaga.exe
  C:\Windows\System\IbYGaga.exe
  2⤵
  PID:9168
- C:\Windows\System\cizuuYX.exe
  C:\Windows\System\cizuuYX.exe
  2⤵
  PID:9184
- C:\Windows\System\KuTdNhT.exe
  C:\Windows\System\KuTdNhT.exe
  2⤵
  PID:9208
- C:\Windows\System\Ywebxkv.exe
  C:\Windows\System\Ywebxkv.exe
  2⤵
  PID:8000
- C:\Windows\System\iBlDaun.exe
  C:\Windows\System\iBlDaun.exe
  2⤵
  PID:8280
- C:\Windows\System\bqXmVhH.exe
  C:\Windows\System\bqXmVhH.exe
  2⤵
  PID:6176
- C:\Windows\System\UNyaoCD.exe
  C:\Windows\System\UNyaoCD.exe
  2⤵
  PID:8224
- C:\Windows\System\Xwbmbnk.exe
  C:\Windows\System\Xwbmbnk.exe
  2⤵
  PID:8328
- C:\Windows\System\DehfrNI.exe
  C:\Windows\System\DehfrNI.exe
  2⤵
  PID:8300
- C:\Windows\System\JoiajOx.exe
  C:\Windows\System\JoiajOx.exe
  2⤵
  PID:8348
- C:\Windows\System\LnsFmig.exe
  C:\Windows\System\LnsFmig.exe
  2⤵
  PID:7232
- C:\Windows\System\yrhEUdQ.exe
  C:\Windows\System\yrhEUdQ.exe
  2⤵
  PID:8440
- C:\Windows\System\MQYHnlZ.exe
  C:\Windows\System\MQYHnlZ.exe
  2⤵
  PID:8424
- C:\Windows\System\gceETvt.exe
  C:\Windows\System\gceETvt.exe
  2⤵
  PID:8488
- C:\Windows\System\PjpmaWc.exe
  C:\Windows\System\PjpmaWc.exe
  2⤵
  PID:8472
- C:\Windows\System\WwJqFzX.exe
  C:\Windows\System\WwJqFzX.exe
  2⤵
  PID:8584
- C:\Windows\System\AkrKUQv.exe
  C:\Windows\System\AkrKUQv.exe
  2⤵
  PID:8588
- C:\Windows\System\lOcFIIp.exe
  C:\Windows\System\lOcFIIp.exe
  2⤵
  PID:8628
- C:\Windows\System\ZhbASyG.exe
  C:\Windows\System\ZhbASyG.exe
  2⤵
  PID:8652
- C:\Windows\System\fnEmgmT.exe
  C:\Windows\System\fnEmgmT.exe
  2⤵
  PID:8668
- C:\Windows\System\QBWEpWX.exe
  C:\Windows\System\QBWEpWX.exe
  2⤵
  PID:8744
- C:\Windows\System\qVuqOwI.exe
  C:\Windows\System\qVuqOwI.exe
  2⤵
  PID:8772
- C:\Windows\System\pzHExPC.exe
  C:\Windows\System\pzHExPC.exe
  2⤵
  PID:8808
- C:\Windows\System\CxHBSgl.exe
  C:\Windows\System\CxHBSgl.exe
  2⤵
  PID:8848
- C:\Windows\System\ilDBBHX.exe
  C:\Windows\System\ilDBBHX.exe
  2⤵
  PID:8900
- C:\Windows\System\mkdEiuL.exe
  C:\Windows\System\mkdEiuL.exe
  2⤵
  PID:8964
- C:\Windows\System\KhReRUD.exe
  C:\Windows\System\KhReRUD.exe
  2⤵
  PID:8872
- C:\Windows\System\TKPviRi.exe
  C:\Windows\System\TKPviRi.exe
  2⤵
  PID:9004
- C:\Windows\System\HewZIlV.exe
  C:\Windows\System\HewZIlV.exe
  2⤵
  PID:9060
- C:\Windows\System\USSCjAi.exe
  C:\Windows\System\USSCjAi.exe
  2⤵
  PID:9016
- C:\Windows\System\ibndwrP.exe
  C:\Windows\System\ibndwrP.exe
  2⤵
  PID:9092
- C:\Windows\System\XMbAOaQ.exe
  C:\Windows\System\XMbAOaQ.exe
  2⤵
  PID:9132
- C:\Windows\System\bcDReSK.exe
  C:\Windows\System\bcDReSK.exe
  2⤵
  PID:9140
- C:\Windows\System\IdkwAnN.exe
  C:\Windows\System\IdkwAnN.exe
  2⤵
  PID:9164
- C:\Windows\System\PuaTcaV.exe
  C:\Windows\System\PuaTcaV.exe
  2⤵
  PID:9200
- C:\Windows\System\ISFIGjw.exe
  C:\Windows\System\ISFIGjw.exe
  2⤵
  PID:8164
- C:\Windows\System\VofNIDr.exe
  C:\Windows\System\VofNIDr.exe
  2⤵
  PID:8012
- C:\Windows\System\tXHsPVi.exe
  C:\Windows\System\tXHsPVi.exe
  2⤵
  PID:8264
- C:\Windows\System\PUWFNuv.exe
  C:\Windows\System\PUWFNuv.exe
  2⤵
  PID:8360
- C:\Windows\System\mezDSWm.exe
  C:\Windows\System\mezDSWm.exe
  2⤵
  PID:8420
- C:\Windows\System\RYaakPy.exe
  C:\Windows\System\RYaakPy.exe
  2⤵
  PID:8452
- C:\Windows\System\OMWlitz.exe
  C:\Windows\System\OMWlitz.exe
  2⤵
  PID:8520
- C:\Windows\System\BGEeSLy.exe
  C:\Windows\System\BGEeSLy.exe
  2⤵
  PID:8544
- C:\Windows\System\DebLKKb.exe
  C:\Windows\System\DebLKKb.exe
  2⤵
  PID:8624
- C:\Windows\System\JqgLHXo.exe
  C:\Windows\System\JqgLHXo.exe
  2⤵
  PID:8700
- C:\Windows\System\ANJWijg.exe
  C:\Windows\System\ANJWijg.exe
  2⤵
  PID:8760
- C:\Windows\System\fqTicYQ.exe
  C:\Windows\System\fqTicYQ.exe
  2⤵
  PID:8756
- C:\Windows\System\WTYqJpS.exe
  C:\Windows\System\WTYqJpS.exe
  2⤵
  PID:8932
- C:\Windows\System\gBscjtJ.exe
  C:\Windows\System\gBscjtJ.exe
  2⤵
  PID:8972
- C:\Windows\System\NVrCzkb.exe
  C:\Windows\System\NVrCzkb.exe
  2⤵
  PID:8868
- C:\Windows\System\ehjzAho.exe
  C:\Windows\System\ehjzAho.exe
  2⤵
  PID:8988
- C:\Windows\System\VqlFdHh.exe
  C:\Windows\System\VqlFdHh.exe
  2⤵
  PID:9044
- C:\Windows\System\nJoUBZm.exe
  C:\Windows\System\nJoUBZm.exe
  2⤵
  PID:9148
- C:\Windows\System\wQVBmTY.exe
  C:\Windows\System\wQVBmTY.exe
  2⤵
  PID:8204
- C:\Windows\System\cPlqXQo.exe
  C:\Windows\System\cPlqXQo.exe
  2⤵
  PID:9064
- C:\Windows\System\urWiPil.exe
  C:\Windows\System\urWiPil.exe
  2⤵
  PID:8324
- C:\Windows\System\dIFdhOB.exe
  C:\Windows\System\dIFdhOB.exe
  2⤵
  PID:8268
- C:\Windows\System\VxmWwCZ.exe
  C:\Windows\System\VxmWwCZ.exe
  2⤵
  PID:8428
- C:\Windows\System\zOwgijA.exe
  C:\Windows\System\zOwgijA.exe
  2⤵
  PID:8528
- C:\Windows\System\UaMHRAs.exe
  C:\Windows\System\UaMHRAs.exe
  2⤵
  PID:8708
- C:\Windows\System\lmFQvtI.exe
  C:\Windows\System\lmFQvtI.exe
  2⤵
  PID:8648
- C:\Windows\System\loKtVJq.exe
  C:\Windows\System\loKtVJq.exe
  2⤵
  PID:8704
- C:\Windows\System\NBAKsRd.exe
  C:\Windows\System\NBAKsRd.exe
  2⤵
  PID:8912
- C:\Windows\System\uhozvGY.exe
  C:\Windows\System\uhozvGY.exe
  2⤵
  PID:8532
- C:\Windows\System\oMFVLJD.exe
  C:\Windows\System\oMFVLJD.exe
  2⤵
  PID:8916
- C:\Windows\System\wtSZAmq.exe
  C:\Windows\System\wtSZAmq.exe
  2⤵
  PID:8216
- C:\Windows\System\aZcIOWB.exe
  C:\Windows\System\aZcIOWB.exe
  2⤵
  PID:8200
- C:\Windows\System\qiHXRRa.exe
  C:\Windows\System\qiHXRRa.exe
  2⤵
  PID:8368
- C:\Windows\System\EazYZHq.exe
  C:\Windows\System\EazYZHq.exe
  2⤵
  PID:8740
- C:\Windows\System\wRcDJEP.exe
  C:\Windows\System\wRcDJEP.exe
  2⤵
  PID:8444
- C:\Windows\System\ziyOeJT.exe
  C:\Windows\System\ziyOeJT.exe
  2⤵
  PID:9000
- C:\Windows\System\xqnIPqv.exe
  C:\Windows\System\xqnIPqv.exe
  2⤵
  PID:9128
- C:\Windows\System\DDMdFnX.exe
  C:\Windows\System\DDMdFnX.exe
  2⤵
  PID:9192
- C:\Windows\System\wTISdot.exe
  C:\Windows\System\wTISdot.exe
  2⤵
  PID:8408
- C:\Windows\System\TKrPoRX.exe
  C:\Windows\System\TKrPoRX.exe
  2⤵
  PID:8448
- C:\Windows\System\frLUBFE.exe
  C:\Windows\System\frLUBFE.exe
  2⤵
  PID:8832
- C:\Windows\System\MKzBVwZ.exe
  C:\Windows\System\MKzBVwZ.exe
  2⤵
  PID:9112
- C:\Windows\System\IEfnSXJ.exe
  C:\Windows\System\IEfnSXJ.exe
  2⤵
  PID:8604
- C:\Windows\System\gcLhLiR.exe
  C:\Windows\System\gcLhLiR.exe
  2⤵
  PID:8984
- C:\Windows\System\MUaGSUa.exe
  C:\Windows\System\MUaGSUa.exe
  2⤵
  PID:8296
- C:\Windows\System\xedBZGN.exe
  C:\Windows\System\xedBZGN.exe
  2⤵
  PID:8620
- C:\Windows\System\DEyjPqf.exe
  C:\Windows\System\DEyjPqf.exe
  2⤵
  PID:8852
- C:\Windows\System\cTIWqBz.exe
  C:\Windows\System\cTIWqBz.exe
  2⤵
  PID:9056
- C:\Windows\System\fCHTJaP.exe
  C:\Windows\System\fCHTJaP.exe
  2⤵
  PID:9240
- C:\Windows\System\hbwRxmR.exe
  C:\Windows\System\hbwRxmR.exe
  2⤵
  PID:9260
- C:\Windows\System\LOuMoqe.exe
  C:\Windows\System\LOuMoqe.exe
  2⤵
  PID:9280
- C:\Windows\System\KMVLriT.exe
  C:\Windows\System\KMVLriT.exe
  2⤵
  PID:9296
- C:\Windows\System\ufWGvEC.exe
  C:\Windows\System\ufWGvEC.exe
  2⤵
  PID:9316
- C:\Windows\System\eWueext.exe
  C:\Windows\System\eWueext.exe
  2⤵
  PID:9340
- C:\Windows\System\PoeHZlN.exe
  C:\Windows\System\PoeHZlN.exe
  2⤵
  PID:9360
- C:\Windows\System\GtZYLcm.exe
  C:\Windows\System\GtZYLcm.exe
  2⤵
  PID:9376
- C:\Windows\System\tueDyLu.exe
  C:\Windows\System\tueDyLu.exe
  2⤵
  PID:9396
- C:\Windows\System\dlbCjBr.exe
  C:\Windows\System\dlbCjBr.exe
  2⤵
  PID:9420
- C:\Windows\System\XiLYdBB.exe
  C:\Windows\System\XiLYdBB.exe
  2⤵
  PID:9436
- C:\Windows\System\ggAUiEy.exe
  C:\Windows\System\ggAUiEy.exe
  2⤵
  PID:9460
- C:\Windows\System\iktyvcA.exe
  C:\Windows\System\iktyvcA.exe
  2⤵
  PID:9476
- C:\Windows\System\cJwvRzR.exe
  C:\Windows\System\cJwvRzR.exe
  2⤵
  PID:9496
- C:\Windows\System\VginkvC.exe
  C:\Windows\System\VginkvC.exe
  2⤵
  PID:9516
- C:\Windows\System\xSpHZKG.exe
  C:\Windows\System\xSpHZKG.exe
  2⤵
  PID:9540
- C:\Windows\System\PBkoVzD.exe
  C:\Windows\System\PBkoVzD.exe
  2⤵
  PID:9556
- C:\Windows\System\bebAZqp.exe
  C:\Windows\System\bebAZqp.exe
  2⤵
  PID:9580
- C:\Windows\System\KRYzABE.exe
  C:\Windows\System\KRYzABE.exe
  2⤵
  PID:9596
- C:\Windows\System\vaMBJwG.exe
  C:\Windows\System\vaMBJwG.exe
  2⤵
  PID:9628
- C:\Windows\System\XfLpOgy.exe
  C:\Windows\System\XfLpOgy.exe
  2⤵
  PID:9644
- C:\Windows\System\TEfYmAY.exe
  C:\Windows\System\TEfYmAY.exe
  2⤵
  PID:9664
- C:\Windows\System\PiYhFgU.exe
  C:\Windows\System\PiYhFgU.exe
  2⤵
  PID:9688
- C:\Windows\System\BdTKpnv.exe
  C:\Windows\System\BdTKpnv.exe
  2⤵
  PID:9708
- C:\Windows\System\MphiMfh.exe
  C:\Windows\System\MphiMfh.exe
  2⤵
  PID:9724
- C:\Windows\System\vkrqxnh.exe
  C:\Windows\System\vkrqxnh.exe
  2⤵
  PID:9748
- C:\Windows\System\GaIFAeP.exe
  C:\Windows\System\GaIFAeP.exe
  2⤵
  PID:9768
- C:\Windows\System\eZdTZzK.exe
  C:\Windows\System\eZdTZzK.exe
  2⤵
  PID:9784
- C:\Windows\System\xMLFJBE.exe
  C:\Windows\System\xMLFJBE.exe
  2⤵
  PID:9808
- C:\Windows\System\WGHlFgD.exe
  C:\Windows\System\WGHlFgD.exe
  2⤵
  PID:9824
- C:\Windows\System\LALTcwN.exe
  C:\Windows\System\LALTcwN.exe
  2⤵
  PID:9848
- C:\Windows\System\QVOanux.exe
  C:\Windows\System\QVOanux.exe
  2⤵
  PID:9864
- C:\Windows\System\zHCyJeZ.exe
  C:\Windows\System\zHCyJeZ.exe
  2⤵
  PID:9884
- C:\Windows\System\SkHFHTW.exe
  C:\Windows\System\SkHFHTW.exe
  2⤵
  PID:9904
- C:\Windows\System\lBKKAWb.exe
  C:\Windows\System\lBKKAWb.exe
  2⤵
  PID:9924
- C:\Windows\System\aZUEbSP.exe
  C:\Windows\System\aZUEbSP.exe
  2⤵
  PID:9944
- C:\Windows\System\dHAJMCT.exe
  C:\Windows\System\dHAJMCT.exe
  2⤵
  PID:9968
- C:\Windows\System\DbyqVjm.exe
  C:\Windows\System\DbyqVjm.exe
  2⤵
  PID:9984
- C:\Windows\System\RUfyQKn.exe
  C:\Windows\System\RUfyQKn.exe
  2⤵
  PID:10000
- C:\Windows\System\vlcxxEp.exe
  C:\Windows\System\vlcxxEp.exe
  2⤵
  PID:10016
- C:\Windows\System\yKEqSKa.exe
  C:\Windows\System\yKEqSKa.exe
  2⤵
  PID:10040
- C:\Windows\System\GcfvfaD.exe
  C:\Windows\System\GcfvfaD.exe
  2⤵
  PID:10056
- C:\Windows\System\fZuPGdc.exe
  C:\Windows\System\fZuPGdc.exe
  2⤵
  PID:10084
- C:\Windows\System\LwEHuJI.exe
  C:\Windows\System\LwEHuJI.exe
  2⤵
  PID:10104
- C:\Windows\System\jVskLRD.exe
  C:\Windows\System\jVskLRD.exe
  2⤵
  PID:10132
- C:\Windows\System\doaRLjg.exe
  C:\Windows\System\doaRLjg.exe
  2⤵
  PID:10152
- C:\Windows\System\WKFrDHp.exe
  C:\Windows\System\WKFrDHp.exe
  2⤵
  PID:10180
- C:\Windows\System\mztMZim.exe
  C:\Windows\System\mztMZim.exe
  2⤵
  PID:10196
- C:\Windows\System\YPBbzhF.exe
  C:\Windows\System\YPBbzhF.exe
  2⤵
  PID:10212
- C:\Windows\System\IIcvMQb.exe
  C:\Windows\System\IIcvMQb.exe
  2⤵
  PID:10232
- C:\Windows\System\iXWgzYO.exe
  C:\Windows\System\iXWgzYO.exe
  2⤵
  PID:9232
- C:\Windows\System\AQyJUpU.exe
  C:\Windows\System\AQyJUpU.exe
  2⤵
  PID:9252
- C:\Windows\System\RdvwzpA.exe
  C:\Windows\System\RdvwzpA.exe
  2⤵
  PID:9304
- C:\Windows\System\ExYfmCx.exe
  C:\Windows\System\ExYfmCx.exe
  2⤵
  PID:9352
- C:\Windows\System\EoaAMvj.exe
  C:\Windows\System\EoaAMvj.exe
  2⤵
  PID:9332
- C:\Windows\System\TsPBdRZ.exe
  C:\Windows\System\TsPBdRZ.exe
  2⤵
  PID:9372
- C:\Windows\System\cuShIXP.exe
  C:\Windows\System\cuShIXP.exe
  2⤵
  PID:9412
- C:\Windows\System\yjKRXTX.exe
  C:\Windows\System\yjKRXTX.exe
  2⤵
  PID:9448
- C:\Windows\System\vTpeAts.exe
  C:\Windows\System\vTpeAts.exe
  2⤵
  PID:9508
- C:\Windows\System\WqswAtz.exe
  C:\Windows\System\WqswAtz.exe
  2⤵
  PID:9492
- C:\Windows\System\ZJSQkaW.exe
  C:\Windows\System\ZJSQkaW.exe
  2⤵
  PID:9552
- C:\Windows\System\KrxtgSx.exe
  C:\Windows\System\KrxtgSx.exe
  2⤵
  PID:9604
- C:\Windows\System\WMKvuPT.exe
  C:\Windows\System\WMKvuPT.exe
  2⤵
  PID:9620
- C:\Windows\System\wluNQFL.exe
  C:\Windows\System\wluNQFL.exe
  2⤵
  PID:9652
- C:\Windows\System\ntnxwAq.exe
  C:\Windows\System\ntnxwAq.exe
  2⤵
  PID:9680
- C:\Windows\System\FKYIehM.exe
  C:\Windows\System\FKYIehM.exe
  2⤵
  PID:9720
- C:\Windows\System\nMbXPCj.exe
  C:\Windows\System\nMbXPCj.exe
  2⤵
  PID:9760
- C:\Windows\System\wSitpqx.exe
  C:\Windows\System\wSitpqx.exe
  2⤵
  PID:9796
- C:\Windows\System\RfwawEA.exe
  C:\Windows\System\RfwawEA.exe
  2⤵
  PID:9820
- C:\Windows\System\OTuwKNd.exe
  C:\Windows\System\OTuwKNd.exe
  2⤵
  PID:9856
- C:\Windows\System\CFrdRhT.exe
  C:\Windows\System\CFrdRhT.exe
  2⤵
  PID:9896
- C:\Windows\System\TcGGHux.exe
  C:\Windows\System\TcGGHux.exe
  2⤵
  PID:9952
- C:\Windows\System\UWfgRap.exe
  C:\Windows\System\UWfgRap.exe
  2⤵
  PID:9956
- C:\Windows\System\pWxqaei.exe
  C:\Windows\System\pWxqaei.exe
  2⤵
  PID:9996
- C:\Windows\System\bhuzdfO.exe
  C:\Windows\System\bhuzdfO.exe
  2⤵
  PID:10024
- C:\Windows\System\lmAKMMN.exe
  C:\Windows\System\lmAKMMN.exe
  2⤵
  PID:10052
- C:\Windows\System\YYnTBdN.exe
  C:\Windows\System\YYnTBdN.exe
  2⤵
  PID:10096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AlENahR.exe

Filesize
1.3MB

MD5
3860a973d0034c3d05cbbd9903c2a098

SHA1
17aa590e91e3140a0fdc90b1898b933c2b74f342

SHA256
8a0440d2fdc64761bbd9959e66f63c98ab7b974b3c1f30d4b3bbfc8c788405fc

SHA512
63847bfe3c37b88a56a0d2b684b67b2a5edcec8ef8e722ac6504dd407bfcbf729581cdb1e2fe624133ae5a88e9b543ed2f36881173d8b0db377878f4d946d319

Download Submit
C:\Windows\system\BPbisPQ.exe

Filesize
1.3MB

MD5
5771e3432a22fdb0bfe3995fa204f05c

SHA1
48ef2b63b0ea0b60f254f07b21daf48cc7f1fa3f

SHA256
0baa48b89534416b3438fec9e805ec33057b78c1a341670a6c6fa7046809bf08

SHA512
5ebb68c4ea71f776bffcf3166720176918fab069549ef50593bf86f2c6b70365bcaf76892f7d484dd1f6f16de48ebab80af3459ed774115a7ab5698b869502e3

Download Submit
C:\Windows\system\EETfmpU.exe

Filesize
1.3MB

MD5
00081ad838d6f991312a16f418f9e07d

SHA1
b474d0adc5cd26b42a285a2bbac3062ab2cfc1a3

SHA256
d73a48503327ec7acf82d79afdc603af5bb1132ac13a715a04d5c1da2df2e561

SHA512
45cfe294602c42b188536fff5c2280923b46af508ca1253770e624511f7071a56fe1c97d3e3a79a30b5660d934b197d413596e67f6b536400b635ea4982f24e8

Download Submit
C:\Windows\system\EsZWQlB.exe

Filesize
1.3MB

MD5
ee429c81846f0383f90b5d1d63ca6a39

SHA1
64576f2e8b9e122cb08a7b6c99c95d96d25a1886

SHA256
fc72e2561ca4cd603754d337b7351da78b11616259a604b34e8e569bc965d517

SHA512
d3063b4ad8567c8a067c75d68b908b1c33c056f8db00b58a5b23fb1c89fe11827193333e8111676f9f633991c1e695833ebc023216f75c8215cf54096ccb57a3

Download Submit
C:\Windows\system\FAvcGpD.exe

Filesize
1.3MB

MD5
f13eeabce9148ca8e273bb3f7bd6ac8d

SHA1
10e44157723a49848b38539fa9b4c5aca4653c10

SHA256
81427485cacf8d0f7b50442d8d743af0df45a7ffa9ea4524659cf26abdc716af

SHA512
4232b0ad2db18949e8a337c2f24520cd13f6cea99849ef95e7fa10d801ab77786eb32dad1948c9d525d4029d864d5d11bcac3a61089d135d9422d134b096d773

Download Submit
C:\Windows\system\MEsFiCX.exe

Filesize
1.3MB

MD5
24fd2d9c41f03ca0e4e24f811e655350

SHA1
2320eb1b25f26e693812d07b47d4f2c44dfbcdca

SHA256
6f5b16146b8b3fb73792cc0d789f8b87e794486e0d14a2f1b858d1c0643f2114

SHA512
ad950b15d2a1a1d2c1604dff957f4ee8e1c4e87801f9b38cadc9fdc3a191dd7a41e4d8822415e6af83af40965ef237ed7670f44713394b1776bd8576c1e57d99

Download Submit
C:\Windows\system\PVZsrcw.exe

Filesize
1.3MB

MD5
bbf1f5c73f9ad07adbb8cbc0b516de48

SHA1
59ba8f1f52ed1c01546a173c32e4187ea8094271

SHA256
8b00f935e714cb8a32d61da9aa767aa64fdb519acb2349d019edd57b0bdb4a03

SHA512
d020471b98cd142f1a3e9ad108f5be5dc6f293970cd72158a322aaffddf7ada6b84021a6b919ca99c20314f091eb7d8053d144203b6804576f07bdbbad350b69

Download Submit
C:\Windows\system\SWGZjXt.exe

Filesize
1.3MB

MD5
c5bafe76542b419c8315d6140d0ca974

SHA1
b5b2c174868d1b1d1620218cea2b7a8036895ef8

SHA256
a6854e80d01d425db491e15254349db37b1112a10ecb31843bdb0a66b899a3c0

SHA512
f153c4c61bbc7b061e7e170ef0e3e757281366ac1a8b586a2e7ebd8cacd343c38a80edb3e79cf4da75f35f85d68d61405e70ca969beec626783d69e63fce362a

Download Submit
C:\Windows\system\VZFsWkB.exe

Filesize
1.3MB

MD5
ded511475df2c6d4bb07b12d3259336f

SHA1
9a1d92457076923e7235debe9e27563224ee1abc

SHA256
0949a77e4d4312070317db9abfda09cb84a3a7cc99d9b4d774b4d884ad45a9f4

SHA512
d9fedec272a671e0e8d5634e76f3cf592fffc79741599d2b21b7290480525209c714450eb6414e6dda26efc77953a26dcb104ded0d77c4ca86241b24713dd6a7

Download Submit
C:\Windows\system\ZRayMvl.exe

Filesize
1.3MB

MD5
ffe1495acfaf6564b5075b6aca0690e5

SHA1
d089da8e21965148a3a2351ab8e0fece0dbb57b2

SHA256
56ba55769ec519f135c6921a8995fc3aa5ca9a04e64d504dbd119f9bc776dd3d

SHA512
93b19b9114fdb9b426b3591651387d63dfed81004090de7fcca1656f86db91bf81bf68110971b76dc73f9ddcebf02d2f9f4a371224e056e7e73c2f1d3aae58d3

Download Submit
C:\Windows\system\aXVOnGA.exe

Filesize
1.3MB

MD5
edef8cff49620702553e3cae740eee88

SHA1
77c779f9f457299a83eda2389be55e94b396e518

SHA256
38b3af274b05cb906f84655b2a73c2e432715629fc8904588a09d1fb4636e5a2

SHA512
9aea3c454bdcdd2a925903cdc29c051480df55c1c1f4a875dd2b37b534a96fea3e3976237f49e5b70487e75e92df671ac2e20f3930a22f9a83eac38470f9b182

Download Submit
C:\Windows\system\amIIFvT.exe

Filesize
1.3MB

MD5
c570bc623604234446cacbf846f01bec

SHA1
bbe35966d02984d38b23a8ecbcfe6c5045663ece

SHA256
6088584b0f6e57c5badb364aaf2bca4187ceb1141b8916bd461317a596d4d4ba

SHA512
9fdae1e09c1850ac01d3ff2ddd3e582e269967a83f36b9ad7c747f29dc9dbf9dda7b05b27cd957f3db09c3cd49eb0763ccb23a538260e6958713978db7263c8f

Download Submit
C:\Windows\system\bYIQzyD.exe

Filesize
1.3MB

MD5
4c608164defcf1a063891900bff36c3d

SHA1
4badad80817723f6ab0a91218fa3e7f7ced66788

SHA256
88bb3ccf41c73fb3296e5a9a3ee55afd547d7a607aff5e09ac95386a3ab9248d

SHA512
a4836c7970efe2a942608838c1ea547e24d9be81a3eecd5e4e1ed666fe9666bbfcb9c5f593ba62b771ce4b58bd25c39c3b6d1c03d32623c2ccafe2971609e73a

Download Submit
C:\Windows\system\bzgbFcw.exe

Filesize
1.3MB

MD5
379f926c6aea5686f4741938137feb98

SHA1
0a9b70a71d9e33faddc550062d9940e50190d31d

SHA256
01455b6f7a70006ab1cc70d0072674156dc495eea651645c86ecde9243183d23

SHA512
142512a2db94c94f584476d63e529eddaed46b436b5b3cc04ae5576c60f4c95c719c55c4c75f1e6a23559b8785edb5658e86efc6ddde0edc2aeb4f325f388489

Download Submit
C:\Windows\system\fjMbSzz.exe

Filesize
1.3MB

MD5
960c57258cd4ca37916010b0a259960f

SHA1
ef31237ebf56c503b4de6df8486e24d0b5828240

SHA256
a92b46d8e8bab899d16a7c966a43fef4cc84cd9ab108281b2ab5bc9c989f37c5

SHA512
36a4655785950338f005c72fc359ba18345a2681ded337c959da09b6c57db487672ca0ec4b2a5f4e4122229dff82dbe7892466978055f05c0c9e3e9c30029a33

Download Submit
C:\Windows\system\gpigVBF.exe

Filesize
1.3MB

MD5
a2c061201b6d9f3af19d7910811dfafe

SHA1
bbfb47d095f6484ff884e34b02363aaaabf230aa

SHA256
91f4ba20e7517ebf21455f199449dfaad5c241865f90f5e34f4c103c8f384802

SHA512
4f217d5327789baeb59b32b42a6642d669f0ac85eba0a90764c3cc000164194b74a4e024a5c0c63f0fe04739ec03088b468143ee49e367ecdfc8c1ebc1104ea2

Download Submit
C:\Windows\system\kCDyWDe.exe

Filesize
1.3MB

MD5
8741701810cacd96f89ce441a2c628b2

SHA1
f5bb287894deee8848b857f26580e36eec0bbd90

SHA256
9d502986cbe263197d2ea924e9c944bc2a3704f5ca3733a348450e1d39dbf068

SHA512
422b4df5d9da070642e8050c9d1fb0ee4652a4545492dd58d2eda6c2753685688933441547cb94d10bab32955940c8d369a8e560a30689211c94c95df319ac91

Download Submit
C:\Windows\system\lgMpAIK.exe

Filesize
1.3MB

MD5
bcd59fae013043ad1f50f0fc28192951

SHA1
4dd1e7b19add836a8efc0f2b366c0e23a03bd780

SHA256
26a2c64def7467000491e11d5e7e8184c0c7d146e29e7de8c5850f67db22abb8

SHA512
25830f0769e1381f184c98a4dfd6704588fd41f2fba6e2e263b56db894469e95455862bf67618aabf1d725e342dcd0556c89d06c7759ee86c6908942b85bd043

Download Submit
C:\Windows\system\muTLcoV.exe

Filesize
1.3MB

MD5
51cfcf7ce98c30322a38f7fe1e02ebb7

SHA1
fe63a6593a15d00f076c4be6e3aa63d07559e9e1

SHA256
23ddd269e36ce3bddd5bfe909395f41762e851afb35de396f53138a209379f48

SHA512
23e63ac02de8c4f7969ec279f084897adbef1a7aa6fcb9e59a24e443fc2624cfab17d21089d350a8929a0d884fe33159a4ded032fbb88dde9addb56b248a489b

Download Submit
C:\Windows\system\nWKOVAe.exe

Filesize
1.3MB

MD5
02c1ea7de362a4259f42da1192257903

SHA1
1d1f25439943ad3973ae096b06d8374c3a9074f2

SHA256
5e82716dd4638c3ce521d3572cafc45bb1c4810f30c01a99e8782fbd57c335b2

SHA512
d490f8954af86b15b65e4e9a2b9352be986ac6d0f9aeeb5f4f584f646600fe8e02c6d19486bbf4dc6676f928f1de39255289df6fc5a0fda64485217ac9fe828c

Download Submit
C:\Windows\system\nnLtmCJ.exe

Filesize
1.3MB

MD5
28f7e1b08cadcf20b735c0f3a3aebe56

SHA1
5e9c3c5879534289c92a09f022728bce1de03ea3

SHA256
7c365d3696e27383675b45edb75d660f1eea72d04d28e07275e1ca060b5e8830

SHA512
7cfffb121dae7438d2cbfb3656273cbb6c0a78b6d51648e300484cc80749e78da4e33a782c87f028459e30a118ea62a7ce82f162c4711819c7057d841098add2

Download Submit
C:\Windows\system\vwWoixc.exe

Filesize
1.3MB

MD5
d6b099b2f0441df5982b4f61b05e1b6a

SHA1
dec192dc15c2856827410be3675d7b593a31c2ca

SHA256
a6a78d4bdcace4738aaca796434ce5699008ad329b298908ce655016531e66e8

SHA512
a13b8bee6a4d41be08a370e21c1d15b5a23fc1bc80b16bce6be43a36ebf4368deef993be3cdc0d14bd8798f0d0cd89ed9a9adb8619a651965b6978fa8baf5e95

Download Submit
C:\Windows\system\xWqXdyS.exe

Filesize
1.3MB

MD5
e7bbc7c1e49a9117f85e249a6186fd31

SHA1
be90514541a1efce83894495b76791d53532f816

SHA256
3ebf0d6274f2a5be462d5dcd09e8c0023d4f7fd896ebb8a89093f19833a2c9e3

SHA512
0eb466e310ba2d7544364dcdfca6b9ab79c5cde61d9b09af7fb86e8c6649a68c84481c8f84e3240aec763ecded4c2835117dd1fc61537aaef32a8676c5417c5d

Download Submit
C:\Windows\system\zBBvfDk.exe

Filesize
1.3MB

MD5
93a692fb75b8168b09a998bf2ad13182

SHA1
6af4bda5bb9d659f4f0127dc7b6cf2178b8d7b1c

SHA256
7107c770ba98580583b52b90fa06de3b50794269dd05d9f21a90332943d55222

SHA512
c5eab18f3259f7a3ed7ed2a411e57014719c557f285c6890d9be9f706c89544c2c934e18feae39f561443a8fcd03ffcb3b2cb8e0169440c31c382039e2f95261

Download Submit
C:\Windows\system\zWutjjf.exe

Filesize
1.3MB

MD5
66cfd7b92214bbaee131fa81134a11ff

SHA1
95e98007a862b6d854869b4be8231707a4e5c0c1

SHA256
8a0bb85ea8dcca4ebfeac859f91beefea10082a636ab761f3670812025039319

SHA512
138dc8818a9978364541b815b19afcad9fd4a8d7eee60c87b3dfaa0f4c7efbd3becf5886680fb2a2c5c2d2aece792bbe7d67e0e258ab2a74b6cc3ee29d117d1f

Download Submit
C:\Windows\system\zZxxvOL.exe

Filesize
1.3MB

MD5
cbcf904ea64c30bf6efb33912d74793f

SHA1
157d86e5ae785a6901362360de3c628da41e3b47

SHA256
aee55d31a02640904adfdbbd449b0389d61110920eda71784c5d2d4ed02dc248

SHA512
8b50d3dd2ef76fe955efe9a6817f6e2e84548f7f4f97cc8f276a3a18013dcb8a8ebc6e47e2f9374b1fe184fa1ffc1975e58a8c5042a0196ef7132210be3d9732

Download Submit
C:\Windows\system\ziduwnn.exe

Filesize
1.3MB

MD5
4242cf61e1d81ae593dc6ba094ccc51a

SHA1
7345f75d02a597dc20e2ec72a4d9aa5d7f9b3b0b

SHA256
92e025d51c233c8046bccdcb5dab054bcd634331958af884d8605adf27da06ed

SHA512
0f7584bef3c65ef203a3eba5435395f6100c3825674c3c82cc8c1c34aab660712a9b0b3ae706be1ab148b934f09b67d0bc77dbd2f847138d59afdc090a102f3e

Download Submit
\Windows\system\CLqswtD.exe

Filesize
1.3MB

MD5
93e9e6bf92db769f6a74f2ff14efd0bc

SHA1
de7f665fd19592e9047e06f238ce6dcfc3ba8d2b

SHA256
ce7501996748245f3167fcb630770397fd56b7f72cadacfeac4f507098a49558

SHA512
e7e444998573617287da5fa205cddd1143bf25e9e17c9758ef6e36a56e06bc60fcf8dac534bb1d67db389517c04ed56dfd98a4b453a835f9d8d55b9672f029be

Download Submit
\Windows\system\FioUAly.exe

Filesize
1.3MB

MD5
9c5eb33cc5e006ed4a9881ccfe28f316

SHA1
888cca4804ed01c329f3156aef369d2dec703703

SHA256
02d4201926f8cae238a37ba20771248ee0f5ec135d2169a6171e369c2e61a09b

SHA512
817fafd6b83373cea721fff1cba7ef80262ef4e79a0883516932fb89b07cefce791c37f30e6b6dedf053ec2837406f5435f4f4ad0b4484790428034da221cc71

Download Submit
\Windows\system\TuSxDod.exe

Filesize
1.3MB

MD5
2ad36a73864c3a4dd846d381e933a87d

SHA1
50105790d01bf17d7c2366cf9789ceace9788013

SHA256
cba98ed17d45e3b191d851aae7df7eb72de8693df1a71661b05abd1754925b26

SHA512
57feb1308947975f48f3325349155bd71b182bce9cd7a1c56d8f8da987050d16fc066b1db3639619b20cdf4938b49cce5fe1b41352c4f6d75abaad8fc53a2b84

Download Submit
\Windows\system\WlQxzYx.exe

Filesize
1.3MB

MD5
c496ef91316bd98db3db3bfec409f4a8

SHA1
29e84db3da51dd7a083f7bccc234cf3484baeb0b

SHA256
c8034607b682952e16e8f2269528d8f64746d78d7cc9ce5a83505d99d409b981

SHA512
ce16aded9dc2c4244f595ab84fdcd45a4c0b47e7bc9bc10fbd0d32ddf40c4ab4f330cf72411890f6ad5b2118f00f2b269710fbf9e9cfadedb19597209e46e057

Download Submit
\Windows\system\gcebLkj.exe

Filesize
1.3MB

MD5
5246cdd958b1a9791a480d92ce412019

SHA1
5a4bd868274cc4d2e4bdfeec1d242ca9fce5159e

SHA256
dc36345cc4b7faf062df2e434ae01330af3adff7dcdec0edf5d02c4b9ee0fd1b

SHA512
b4bf17e4858884ef4d478764203d69a0f97e73d8ad738eb0f0305bcbc19debada25d06bc62fb26df2900d3d0607fbfb4dd57ab94bc2fb2229f3e75d6625665da

Download Submit
memory/2536-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download