xmrig | bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
Size

1.1MB
MD5

cac86b9fd8c99472f6ecf3a884dd1153
SHA1

74df8a1d2e3d2c44265d9928aafceef7ccf64003
SHA256

bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d
SHA512

9a4775aab2bf9fa8beaff944c34a40b262a36afb6bb5ab96a8797a7f084554c7fd2d657a532d3630c98115baf06868170acd4675d9f0503cf38387bb356e680e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7GW/037G:GezaTF8FcNkNdfE0pZ9ozttwIRxoW/CG

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0032000000023b74-3.dat	xmrig
behavioral2/files/0x000a000000023b78-7.dat	xmrig
behavioral2/files/0x000a000000023b79-6.dat	xmrig
behavioral2/files/0x000a000000023b7d-35.dat	xmrig
behavioral2/files/0x000a000000023b7f-43.dat	xmrig
behavioral2/files/0x000a000000023b7e-40.dat	xmrig
behavioral2/files/0x000a000000023b81-54.dat	xmrig
behavioral2/files/0x000a000000023b84-71.dat	xmrig
behavioral2/files/0x000a000000023b87-85.dat	xmrig
behavioral2/files/0x000a000000023b90-129.dat	xmrig
behavioral2/files/0x000a000000023b91-142.dat	xmrig
behavioral2/files/0x000a000000023b95-162.dat	xmrig
behavioral2/files/0x000a000000023b94-160.dat	xmrig
behavioral2/files/0x000a000000023b93-158.dat	xmrig
behavioral2/files/0x000a000000023b98-155.dat	xmrig
behavioral2/files/0x000a000000023b97-154.dat	xmrig
behavioral2/files/0x000a000000023b96-153.dat	xmrig
behavioral2/files/0x000a000000023b92-147.dat	xmrig
behavioral2/files/0x000a000000023b8f-125.dat	xmrig
behavioral2/files/0x000a000000023b8e-123.dat	xmrig
behavioral2/files/0x000a000000023b88-121.dat	xmrig
behavioral2/files/0x000a000000023b8d-119.dat	xmrig
behavioral2/files/0x000a000000023b8c-117.dat	xmrig
behavioral2/files/0x000a000000023b8b-115.dat	xmrig
behavioral2/files/0x000a000000023b89-113.dat	xmrig
behavioral2/files/0x000a000000023b8a-110.dat	xmrig
behavioral2/files/0x000a000000023b86-80.dat	xmrig
behavioral2/files/0x000a000000023b85-78.dat	xmrig
behavioral2/files/0x000a000000023b82-66.dat	xmrig
behavioral2/files/0x000a000000023b83-68.dat	xmrig
behavioral2/files/0x000a000000023b80-50.dat	xmrig
behavioral2/files/0x000a000000023b7c-30.dat	xmrig
behavioral2/files/0x000a000000023b7b-25.dat	xmrig
behavioral2/files/0x000a000000023b7a-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2112	HhhsiyU.exe
2492	eQoRDzC.exe
1376	CgIgKVj.exe
1960	twpkyfo.exe
4508	FIBOEPn.exe
2124	Ivhrtyd.exe
1036	wLoNmAZ.exe
4080	AvnJFAG.exe
3668	pxskOGt.exe
1664	fiCKUdk.exe
3384	jEdWqHO.exe
2008	pIggosk.exe
3532	AsNiUHp.exe
3660	WlBgwtG.exe
4256	xtTWvIR.exe
3652	aRvZlsU.exe
2304	nTDXmMG.exe
556	vSKnlFd.exe
2784	smYtRXu.exe
2984	nUmCSJC.exe
2188	TmGzQxQ.exe
2792	uUePXsp.exe
860	dZCUpOy.exe
620	QrnCfzA.exe
4028	aARoXsz.exe
4388	PrAHJcO.exe
3144	HUCGnWr.exe
3036	agaObKU.exe
688	ECOGXEF.exe
3116	bFfxdIj.exe
992	mLXeACk.exe
208	pqCPjJx.exe
212	yybiTeo.exe
5076	QSPoePr.exe
2196	sjhPIdU.exe
3120	dBMhljh.exe
1732	zzhHgaF.exe
1768	UiOGPIY.exe
3248	wNpZzSa.exe
4684	YxFqDYr.exe
1696	HDDYcgw.exe
1208	ShVTGJQ.exe
5024	jLNQmOy.exe
724	LlkGWFo.exe
3052	aKENCzr.exe
1448	csIfloy.exe
4112	fbfObJP.exe
448	JHqraTh.exe
4960	ZkcHXpe.exe
2604	bgBsXBL.exe
1140	ScklSoH.exe
4560	UNityew.exe
2720	fQjMetS.exe
1076	adPsfNT.exe
3792	knQyMUc.exe
1840	lWhZQdc.exe
2736	UhrcmuO.exe
4040	XWnQnFa.exe
4340	YnCcqKX.exe
2056	KoNhCnE.exe
3948	qSJbcWb.exe
4696	JFVokhh.exe
4496	vJSLEGR.exe
1380	nCJdwjv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XsfrIkX.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\gQMvHiV.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\TFFQcYH.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\EdsDIsM.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\vBVdijC.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\OdNyYeP.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\IulZfHh.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\ajPcAoh.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\BhmcgIt.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\iYJGIEg.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\hdpVVuA.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\euzzQki.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\OwnjTcj.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\jxsjsfL.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\NIoCvSm.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\zWSOvsx.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\BgWlHIF.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\vrFKHfD.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\xdszbRl.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\cienldI.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\dXpyudV.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\eewSMkV.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\vQhNdET.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\seaIMhv.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\QSPoePr.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\rozIxAn.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\HelNFwo.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\LEAODrp.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\zsuQulV.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\QnfnvaI.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\XWhnXXX.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\wgodecN.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\nddqDff.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\IopCLCG.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\PgkMfHU.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\QpXuQEo.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\xCzcAKG.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\YxFqDYr.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\PeMgNfL.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\ghfnkWN.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\Rfswytd.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\pEEwWNu.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\KJPdjMt.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\DAfMyTB.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\CTlDnwU.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\cSXhqgB.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\EtnfMdL.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\DzNbinf.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\PNsurwg.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\OpJhyeH.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\BvVjpEG.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\RiZFleB.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\Vccskeb.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\wNpZzSa.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\JbyVIeg.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\hXXBNyz.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\GkqFfWc.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\qLMzASr.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\TduhJYj.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\kgCDTsE.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\DQSrwSJ.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\vdVKyPs.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\hjUYsdQ.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
File created	C:\Windows\System\axeGBTM.exe	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2112	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	83
PID 1172 wrote to memory of 2112	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	83
PID 1172 wrote to memory of 2492	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	84
PID 1172 wrote to memory of 2492	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	84
PID 1172 wrote to memory of 1376	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	85
PID 1172 wrote to memory of 1376	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	85
PID 1172 wrote to memory of 1960	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	86
PID 1172 wrote to memory of 1960	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	86
PID 1172 wrote to memory of 4508	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	87
PID 1172 wrote to memory of 4508	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	87
PID 1172 wrote to memory of 2124	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	88
PID 1172 wrote to memory of 2124	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	88
PID 1172 wrote to memory of 1036	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	89
PID 1172 wrote to memory of 1036	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	89
PID 1172 wrote to memory of 4080	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	90
PID 1172 wrote to memory of 4080	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	90
PID 1172 wrote to memory of 3668	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	91
PID 1172 wrote to memory of 3668	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	91
PID 1172 wrote to memory of 1664	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	92
PID 1172 wrote to memory of 1664	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	92
PID 1172 wrote to memory of 3384	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	93
PID 1172 wrote to memory of 3384	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	93
PID 1172 wrote to memory of 2008	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	94
PID 1172 wrote to memory of 2008	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	94
PID 1172 wrote to memory of 3532	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	95
PID 1172 wrote to memory of 3532	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	95
PID 1172 wrote to memory of 3660	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	96
PID 1172 wrote to memory of 3660	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	96
PID 1172 wrote to memory of 4256	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	97
PID 1172 wrote to memory of 4256	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	97
PID 1172 wrote to memory of 3652	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	98
PID 1172 wrote to memory of 3652	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	98
PID 1172 wrote to memory of 2304	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	99
PID 1172 wrote to memory of 2304	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	99
PID 1172 wrote to memory of 860	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	100
PID 1172 wrote to memory of 860	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	100
PID 1172 wrote to memory of 556	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	101
PID 1172 wrote to memory of 556	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	101
PID 1172 wrote to memory of 2784	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	102
PID 1172 wrote to memory of 2784	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	102
PID 1172 wrote to memory of 2984	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	103
PID 1172 wrote to memory of 2984	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	103
PID 1172 wrote to memory of 2188	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	104
PID 1172 wrote to memory of 2188	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	104
PID 1172 wrote to memory of 2792	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	105
PID 1172 wrote to memory of 2792	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	105
PID 1172 wrote to memory of 620	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	106
PID 1172 wrote to memory of 620	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	106
PID 1172 wrote to memory of 4028	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	107
PID 1172 wrote to memory of 4028	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	107
PID 1172 wrote to memory of 4388	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	108
PID 1172 wrote to memory of 4388	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	108
PID 1172 wrote to memory of 3144	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	109
PID 1172 wrote to memory of 3144	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	109
PID 1172 wrote to memory of 3036	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	110
PID 1172 wrote to memory of 3036	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	110
PID 1172 wrote to memory of 688	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	111
PID 1172 wrote to memory of 688	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	111
PID 1172 wrote to memory of 3116	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	112
PID 1172 wrote to memory of 3116	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	112
PID 1172 wrote to memory of 992	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	113
PID 1172 wrote to memory of 992	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	113
PID 1172 wrote to memory of 208	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	114
PID 1172 wrote to memory of 208	1172	bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe	114

C:\Users\Admin\AppData\Local\Temp\bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe
"C:\Users\Admin\AppData\Local\Temp\bf6959ef407dc0fd41ede5099590a7d92fa3ed45b992beee78ebbcd43b457e6d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\System\HhhsiyU.exe
  C:\Windows\System\HhhsiyU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\eQoRDzC.exe
  C:\Windows\System\eQoRDzC.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\CgIgKVj.exe
  C:\Windows\System\CgIgKVj.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\twpkyfo.exe
  C:\Windows\System\twpkyfo.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\FIBOEPn.exe
  C:\Windows\System\FIBOEPn.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\Ivhrtyd.exe
  C:\Windows\System\Ivhrtyd.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\wLoNmAZ.exe
  C:\Windows\System\wLoNmAZ.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\AvnJFAG.exe
  C:\Windows\System\AvnJFAG.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\pxskOGt.exe
  C:\Windows\System\pxskOGt.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\fiCKUdk.exe
  C:\Windows\System\fiCKUdk.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\jEdWqHO.exe
  C:\Windows\System\jEdWqHO.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\pIggosk.exe
  C:\Windows\System\pIggosk.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\AsNiUHp.exe
  C:\Windows\System\AsNiUHp.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\WlBgwtG.exe
  C:\Windows\System\WlBgwtG.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\xtTWvIR.exe
  C:\Windows\System\xtTWvIR.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\aRvZlsU.exe
  C:\Windows\System\aRvZlsU.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\nTDXmMG.exe
  C:\Windows\System\nTDXmMG.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\dZCUpOy.exe
  C:\Windows\System\dZCUpOy.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\vSKnlFd.exe
  C:\Windows\System\vSKnlFd.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\smYtRXu.exe
  C:\Windows\System\smYtRXu.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\nUmCSJC.exe
  C:\Windows\System\nUmCSJC.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\TmGzQxQ.exe
  C:\Windows\System\TmGzQxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\uUePXsp.exe
  C:\Windows\System\uUePXsp.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\QrnCfzA.exe
  C:\Windows\System\QrnCfzA.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\aARoXsz.exe
  C:\Windows\System\aARoXsz.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\PrAHJcO.exe
  C:\Windows\System\PrAHJcO.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\HUCGnWr.exe
  C:\Windows\System\HUCGnWr.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\agaObKU.exe
  C:\Windows\System\agaObKU.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ECOGXEF.exe
  C:\Windows\System\ECOGXEF.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\bFfxdIj.exe
  C:\Windows\System\bFfxdIj.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\mLXeACk.exe
  C:\Windows\System\mLXeACk.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\pqCPjJx.exe
  C:\Windows\System\pqCPjJx.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\yybiTeo.exe
  C:\Windows\System\yybiTeo.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\QSPoePr.exe
  C:\Windows\System\QSPoePr.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\sjhPIdU.exe
  C:\Windows\System\sjhPIdU.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\dBMhljh.exe
  C:\Windows\System\dBMhljh.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\zzhHgaF.exe
  C:\Windows\System\zzhHgaF.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\UiOGPIY.exe
  C:\Windows\System\UiOGPIY.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\wNpZzSa.exe
  C:\Windows\System\wNpZzSa.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\YxFqDYr.exe
  C:\Windows\System\YxFqDYr.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\HDDYcgw.exe
  C:\Windows\System\HDDYcgw.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ShVTGJQ.exe
  C:\Windows\System\ShVTGJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\jLNQmOy.exe
  C:\Windows\System\jLNQmOy.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\LlkGWFo.exe
  C:\Windows\System\LlkGWFo.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\aKENCzr.exe
  C:\Windows\System\aKENCzr.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\csIfloy.exe
  C:\Windows\System\csIfloy.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\fbfObJP.exe
  C:\Windows\System\fbfObJP.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\JHqraTh.exe
  C:\Windows\System\JHqraTh.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\ZkcHXpe.exe
  C:\Windows\System\ZkcHXpe.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\bgBsXBL.exe
  C:\Windows\System\bgBsXBL.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ScklSoH.exe
  C:\Windows\System\ScklSoH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\UNityew.exe
  C:\Windows\System\UNityew.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\fQjMetS.exe
  C:\Windows\System\fQjMetS.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\adPsfNT.exe
  C:\Windows\System\adPsfNT.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\knQyMUc.exe
  C:\Windows\System\knQyMUc.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\lWhZQdc.exe
  C:\Windows\System\lWhZQdc.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\UhrcmuO.exe
  C:\Windows\System\UhrcmuO.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\XWnQnFa.exe
  C:\Windows\System\XWnQnFa.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\YnCcqKX.exe
  C:\Windows\System\YnCcqKX.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\KoNhCnE.exe
  C:\Windows\System\KoNhCnE.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\qSJbcWb.exe
  C:\Windows\System\qSJbcWb.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\JFVokhh.exe
  C:\Windows\System\JFVokhh.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\vJSLEGR.exe
  C:\Windows\System\vJSLEGR.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\nCJdwjv.exe
  C:\Windows\System\nCJdwjv.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\vRlaaGD.exe
  C:\Windows\System\vRlaaGD.exe
  2⤵
  PID:3432
- C:\Windows\System\hTDbUFw.exe
  C:\Windows\System\hTDbUFw.exe
  2⤵
  PID:4252
- C:\Windows\System\QTaZRLB.exe
  C:\Windows\System\QTaZRLB.exe
  2⤵
  PID:4688
- C:\Windows\System\DoGbOsm.exe
  C:\Windows\System\DoGbOsm.exe
  2⤵
  PID:396
- C:\Windows\System\TiXUaWr.exe
  C:\Windows\System\TiXUaWr.exe
  2⤵
  PID:4004
- C:\Windows\System\uyeLwWo.exe
  C:\Windows\System\uyeLwWo.exe
  2⤵
  PID:4988
- C:\Windows\System\aQAuJza.exe
  C:\Windows\System\aQAuJza.exe
  2⤵
  PID:2036
- C:\Windows\System\lIRpGUh.exe
  C:\Windows\System\lIRpGUh.exe
  2⤵
  PID:1596
- C:\Windows\System\ZEXyFvk.exe
  C:\Windows\System\ZEXyFvk.exe
  2⤵
  PID:4044
- C:\Windows\System\YSBGdpJ.exe
  C:\Windows\System\YSBGdpJ.exe
  2⤵
  PID:216
- C:\Windows\System\pGAWTGZ.exe
  C:\Windows\System\pGAWTGZ.exe
  2⤵
  PID:876
- C:\Windows\System\RPthdNv.exe
  C:\Windows\System\RPthdNv.exe
  2⤵
  PID:1588
- C:\Windows\System\OMfsjRt.exe
  C:\Windows\System\OMfsjRt.exe
  2⤵
  PID:3680
- C:\Windows\System\IOsBRQH.exe
  C:\Windows\System\IOsBRQH.exe
  2⤵
  PID:3312
- C:\Windows\System\ivMJfNj.exe
  C:\Windows\System\ivMJfNj.exe
  2⤵
  PID:2320
- C:\Windows\System\lrdlfSb.exe
  C:\Windows\System\lrdlfSb.exe
  2⤵
  PID:636
- C:\Windows\System\DBHYNJD.exe
  C:\Windows\System\DBHYNJD.exe
  2⤵
  PID:2424
- C:\Windows\System\TJHfmoV.exe
  C:\Windows\System\TJHfmoV.exe
  2⤵
  PID:792
- C:\Windows\System\rozIxAn.exe
  C:\Windows\System\rozIxAn.exe
  2⤵
  PID:3688
- C:\Windows\System\gzOQsbD.exe
  C:\Windows\System\gzOQsbD.exe
  2⤵
  PID:1692
- C:\Windows\System\gycMDpi.exe
  C:\Windows\System\gycMDpi.exe
  2⤵
  PID:4876
- C:\Windows\System\RnsZyOM.exe
  C:\Windows\System\RnsZyOM.exe
  2⤵
  PID:1720
- C:\Windows\System\pBrUrVI.exe
  C:\Windows\System\pBrUrVI.exe
  2⤵
  PID:4584
- C:\Windows\System\whSjkuZ.exe
  C:\Windows\System\whSjkuZ.exe
  2⤵
  PID:1700
- C:\Windows\System\DXQtmoA.exe
  C:\Windows\System\DXQtmoA.exe
  2⤵
  PID:1480
- C:\Windows\System\VhZdTsR.exe
  C:\Windows\System\VhZdTsR.exe
  2⤵
  PID:1464
- C:\Windows\System\dgrkhhR.exe
  C:\Windows\System\dgrkhhR.exe
  2⤵
  PID:2220
- C:\Windows\System\myhjIJx.exe
  C:\Windows\System\myhjIJx.exe
  2⤵
  PID:2308
- C:\Windows\System\RYhuHWa.exe
  C:\Windows\System\RYhuHWa.exe
  2⤵
  PID:2980
- C:\Windows\System\BBsbuJt.exe
  C:\Windows\System\BBsbuJt.exe
  2⤵
  PID:1956
- C:\Windows\System\KYkDTZH.exe
  C:\Windows\System\KYkDTZH.exe
  2⤵
  PID:4436
- C:\Windows\System\aRnbjeo.exe
  C:\Windows\System\aRnbjeo.exe
  2⤵
  PID:2680
- C:\Windows\System\LhOokfT.exe
  C:\Windows\System\LhOokfT.exe
  2⤵
  PID:3488
- C:\Windows\System\ANjycSt.exe
  C:\Windows\System\ANjycSt.exe
  2⤵
  PID:376
- C:\Windows\System\PeMgNfL.exe
  C:\Windows\System\PeMgNfL.exe
  2⤵
  PID:2092
- C:\Windows\System\XtHbLVT.exe
  C:\Windows\System\XtHbLVT.exe
  2⤵
  PID:4552
- C:\Windows\System\JfVXOTs.exe
  C:\Windows\System\JfVXOTs.exe
  2⤵
  PID:2284
- C:\Windows\System\TcKCDIP.exe
  C:\Windows\System\TcKCDIP.exe
  2⤵
  PID:2908
- C:\Windows\System\JHeMZTZ.exe
  C:\Windows\System\JHeMZTZ.exe
  2⤵
  PID:3336
- C:\Windows\System\CKMCGwP.exe
  C:\Windows\System\CKMCGwP.exe
  2⤵
  PID:5040
- C:\Windows\System\CPfnZvh.exe
  C:\Windows\System\CPfnZvh.exe
  2⤵
  PID:2496
- C:\Windows\System\yXVSAME.exe
  C:\Windows\System\yXVSAME.exe
  2⤵
  PID:1864
- C:\Windows\System\IQWOzfo.exe
  C:\Windows\System\IQWOzfo.exe
  2⤵
  PID:1452
- C:\Windows\System\ppJRyUI.exe
  C:\Windows\System\ppJRyUI.exe
  2⤵
  PID:4832
- C:\Windows\System\MiCgDqE.exe
  C:\Windows\System\MiCgDqE.exe
  2⤵
  PID:1836
- C:\Windows\System\MCliUxJ.exe
  C:\Windows\System\MCliUxJ.exe
  2⤵
  PID:1856
- C:\Windows\System\YcbjQHR.exe
  C:\Windows\System\YcbjQHR.exe
  2⤵
  PID:4292
- C:\Windows\System\gIJREdK.exe
  C:\Windows\System\gIJREdK.exe
  2⤵
  PID:3988
- C:\Windows\System\NljUgjy.exe
  C:\Windows\System\NljUgjy.exe
  2⤵
  PID:4296
- C:\Windows\System\PwRAuIC.exe
  C:\Windows\System\PwRAuIC.exe
  2⤵
  PID:2012
- C:\Windows\System\bZFCdwR.exe
  C:\Windows\System\bZFCdwR.exe
  2⤵
  PID:2116
- C:\Windows\System\odEUCzE.exe
  C:\Windows\System\odEUCzE.exe
  2⤵
  PID:4072
- C:\Windows\System\oEzpgpB.exe
  C:\Windows\System\oEzpgpB.exe
  2⤵
  PID:1388
- C:\Windows\System\FRDeWle.exe
  C:\Windows\System\FRDeWle.exe
  2⤵
  PID:2628
- C:\Windows\System\FFSNfnA.exe
  C:\Windows\System\FFSNfnA.exe
  2⤵
  PID:1264
- C:\Windows\System\DwILUlq.exe
  C:\Windows\System\DwILUlq.exe
  2⤵
  PID:2964
- C:\Windows\System\nJwXgYJ.exe
  C:\Windows\System\nJwXgYJ.exe
  2⤵
  PID:408
- C:\Windows\System\wmdNNVA.exe
  C:\Windows\System\wmdNNVA.exe
  2⤵
  PID:2104
- C:\Windows\System\qCERoUf.exe
  C:\Windows\System\qCERoUf.exe
  2⤵
  PID:5136
- C:\Windows\System\tbwgTQy.exe
  C:\Windows\System\tbwgTQy.exe
  2⤵
  PID:5156
- C:\Windows\System\UbwvGBF.exe
  C:\Windows\System\UbwvGBF.exe
  2⤵
  PID:5192
- C:\Windows\System\GKWPdgd.exe
  C:\Windows\System\GKWPdgd.exe
  2⤵
  PID:5220
- C:\Windows\System\HwGYRIA.exe
  C:\Windows\System\HwGYRIA.exe
  2⤵
  PID:5240
- C:\Windows\System\ojEQNfM.exe
  C:\Windows\System\ojEQNfM.exe
  2⤵
  PID:5272
- C:\Windows\System\wXacIff.exe
  C:\Windows\System\wXacIff.exe
  2⤵
  PID:5304
- C:\Windows\System\ybmGASj.exe
  C:\Windows\System\ybmGASj.exe
  2⤵
  PID:5324
- C:\Windows\System\dpwMoqt.exe
  C:\Windows\System\dpwMoqt.exe
  2⤵
  PID:5356
- C:\Windows\System\uvHZCVU.exe
  C:\Windows\System\uvHZCVU.exe
  2⤵
  PID:5380
- C:\Windows\System\kbZqpWZ.exe
  C:\Windows\System\kbZqpWZ.exe
  2⤵
  PID:5408
- C:\Windows\System\GrVOxGG.exe
  C:\Windows\System\GrVOxGG.exe
  2⤵
  PID:5440
- C:\Windows\System\pXNzzXm.exe
  C:\Windows\System\pXNzzXm.exe
  2⤵
  PID:5464
- C:\Windows\System\UpgiAFa.exe
  C:\Windows\System\UpgiAFa.exe
  2⤵
  PID:5492
- C:\Windows\System\SZfyqNn.exe
  C:\Windows\System\SZfyqNn.exe
  2⤵
  PID:5520
- C:\Windows\System\omLLfPQ.exe
  C:\Windows\System\omLLfPQ.exe
  2⤵
  PID:5548
- C:\Windows\System\JBTyEuq.exe
  C:\Windows\System\JBTyEuq.exe
  2⤵
  PID:5580
- C:\Windows\System\ekjmcep.exe
  C:\Windows\System\ekjmcep.exe
  2⤵
  PID:5608
- C:\Windows\System\OhIvTKq.exe
  C:\Windows\System\OhIvTKq.exe
  2⤵
  PID:5632
- C:\Windows\System\nddqDff.exe
  C:\Windows\System\nddqDff.exe
  2⤵
  PID:5664
- C:\Windows\System\LDKGNnA.exe
  C:\Windows\System\LDKGNnA.exe
  2⤵
  PID:5688
- C:\Windows\System\OydCRvS.exe
  C:\Windows\System\OydCRvS.exe
  2⤵
  PID:5720
- C:\Windows\System\zBgsPYn.exe
  C:\Windows\System\zBgsPYn.exe
  2⤵
  PID:5744
- C:\Windows\System\AWyHPtm.exe
  C:\Windows\System\AWyHPtm.exe
  2⤵
  PID:5772
- C:\Windows\System\RRMSqVW.exe
  C:\Windows\System\RRMSqVW.exe
  2⤵
  PID:5800
- C:\Windows\System\sefHNYv.exe
  C:\Windows\System\sefHNYv.exe
  2⤵
  PID:5828
- C:\Windows\System\PPSrtkU.exe
  C:\Windows\System\PPSrtkU.exe
  2⤵
  PID:5864
- C:\Windows\System\AnjHnXr.exe
  C:\Windows\System\AnjHnXr.exe
  2⤵
  PID:5892
- C:\Windows\System\cvWIuPG.exe
  C:\Windows\System\cvWIuPG.exe
  2⤵
  PID:5912
- C:\Windows\System\vrFKHfD.exe
  C:\Windows\System\vrFKHfD.exe
  2⤵
  PID:5944
- C:\Windows\System\QbGBATR.exe
  C:\Windows\System\QbGBATR.exe
  2⤵
  PID:5972
- C:\Windows\System\VapMyby.exe
  C:\Windows\System\VapMyby.exe
  2⤵
  PID:6012
- C:\Windows\System\rlPjICU.exe
  C:\Windows\System\rlPjICU.exe
  2⤵
  PID:6028
- C:\Windows\System\DDsIZYZ.exe
  C:\Windows\System\DDsIZYZ.exe
  2⤵
  PID:6056
- C:\Windows\System\xdszbRl.exe
  C:\Windows\System\xdszbRl.exe
  2⤵
  PID:6084
- C:\Windows\System\woqXFeI.exe
  C:\Windows\System\woqXFeI.exe
  2⤵
  PID:6112
- C:\Windows\System\nWfjloZ.exe
  C:\Windows\System\nWfjloZ.exe
  2⤵
  PID:6140
- C:\Windows\System\TEYdRZs.exe
  C:\Windows\System\TEYdRZs.exe
  2⤵
  PID:5176
- C:\Windows\System\wGllcou.exe
  C:\Windows\System\wGllcou.exe
  2⤵
  PID:5232
- C:\Windows\System\HNJdwMx.exe
  C:\Windows\System\HNJdwMx.exe
  2⤵
  PID:5312
- C:\Windows\System\tVBgWcz.exe
  C:\Windows\System\tVBgWcz.exe
  2⤵
  PID:5372
- C:\Windows\System\PybVbaY.exe
  C:\Windows\System\PybVbaY.exe
  2⤵
  PID:5432
- C:\Windows\System\RiZFleB.exe
  C:\Windows\System\RiZFleB.exe
  2⤵
  PID:5504
- C:\Windows\System\vbPEJUt.exe
  C:\Windows\System\vbPEJUt.exe
  2⤵
  PID:5568
- C:\Windows\System\njQieBH.exe
  C:\Windows\System\njQieBH.exe
  2⤵
  PID:5628
- C:\Windows\System\fLhQzfQ.exe
  C:\Windows\System\fLhQzfQ.exe
  2⤵
  PID:5708
- C:\Windows\System\GJzRmzF.exe
  C:\Windows\System\GJzRmzF.exe
  2⤵
  PID:5768
- C:\Windows\System\SRNWWet.exe
  C:\Windows\System\SRNWWet.exe
  2⤵
  PID:5840
- C:\Windows\System\gljNIjL.exe
  C:\Windows\System\gljNIjL.exe
  2⤵
  PID:5904
- C:\Windows\System\sTUcZPs.exe
  C:\Windows\System\sTUcZPs.exe
  2⤵
  PID:5964
- C:\Windows\System\OTvQCMq.exe
  C:\Windows\System\OTvQCMq.exe
  2⤵
  PID:6044
- C:\Windows\System\ayKlWiT.exe
  C:\Windows\System\ayKlWiT.exe
  2⤵
  PID:6096
- C:\Windows\System\yXQsLZy.exe
  C:\Windows\System\yXQsLZy.exe
  2⤵
  PID:5152
- C:\Windows\System\EBztrwM.exe
  C:\Windows\System\EBztrwM.exe
  2⤵
  PID:5336
- C:\Windows\System\BBPYPeq.exe
  C:\Windows\System\BBPYPeq.exe
  2⤵
  PID:5480
- C:\Windows\System\hdpVVuA.exe
  C:\Windows\System\hdpVVuA.exe
  2⤵
  PID:5672
- C:\Windows\System\LnlIAyR.exe
  C:\Windows\System\LnlIAyR.exe
  2⤵
  PID:5796
- C:\Windows\System\orLawrQ.exe
  C:\Windows\System\orLawrQ.exe
  2⤵
  PID:5952
- C:\Windows\System\bMaOafl.exe
  C:\Windows\System\bMaOafl.exe
  2⤵
  PID:6100
- C:\Windows\System\sgVjUqJ.exe
  C:\Windows\System\sgVjUqJ.exe
  2⤵
  PID:5428
- C:\Windows\System\PpeWQfM.exe
  C:\Windows\System\PpeWQfM.exe
  2⤵
  PID:5760
- C:\Windows\System\nSHWcfR.exe
  C:\Windows\System\nSHWcfR.exe
  2⤵
  PID:6072
- C:\Windows\System\ammdelv.exe
  C:\Windows\System\ammdelv.exe
  2⤵
  PID:5900
- C:\Windows\System\cSfrVfk.exe
  C:\Windows\System\cSfrVfk.exe
  2⤵
  PID:6152
- C:\Windows\System\XRfWTMd.exe
  C:\Windows\System\XRfWTMd.exe
  2⤵
  PID:6180
- C:\Windows\System\UxRSiRo.exe
  C:\Windows\System\UxRSiRo.exe
  2⤵
  PID:6208
- C:\Windows\System\dpOVZCI.exe
  C:\Windows\System\dpOVZCI.exe
  2⤵
  PID:6244
- C:\Windows\System\IulZfHh.exe
  C:\Windows\System\IulZfHh.exe
  2⤵
  PID:6268
- C:\Windows\System\EqMAAzW.exe
  C:\Windows\System\EqMAAzW.exe
  2⤵
  PID:6296
- C:\Windows\System\XIDIbRz.exe
  C:\Windows\System\XIDIbRz.exe
  2⤵
  PID:6332
- C:\Windows\System\ifNcWJm.exe
  C:\Windows\System\ifNcWJm.exe
  2⤵
  PID:6352
- C:\Windows\System\WHkyKBU.exe
  C:\Windows\System\WHkyKBU.exe
  2⤵
  PID:6380
- C:\Windows\System\IgqrzQe.exe
  C:\Windows\System\IgqrzQe.exe
  2⤵
  PID:6408
- C:\Windows\System\GAbacjF.exe
  C:\Windows\System\GAbacjF.exe
  2⤵
  PID:6436
- C:\Windows\System\YVHesUE.exe
  C:\Windows\System\YVHesUE.exe
  2⤵
  PID:6464
- C:\Windows\System\SCFYFSw.exe
  C:\Windows\System\SCFYFSw.exe
  2⤵
  PID:6492
- C:\Windows\System\NIoCvSm.exe
  C:\Windows\System\NIoCvSm.exe
  2⤵
  PID:6520
- C:\Windows\System\CbZofRR.exe
  C:\Windows\System\CbZofRR.exe
  2⤵
  PID:6548
- C:\Windows\System\oPceGax.exe
  C:\Windows\System\oPceGax.exe
  2⤵
  PID:6576
- C:\Windows\System\HelNFwo.exe
  C:\Windows\System\HelNFwo.exe
  2⤵
  PID:6604
- C:\Windows\System\tYdIaNo.exe
  C:\Windows\System\tYdIaNo.exe
  2⤵
  PID:6628
- C:\Windows\System\UjferfK.exe
  C:\Windows\System\UjferfK.exe
  2⤵
  PID:6656
- C:\Windows\System\ARSgIEW.exe
  C:\Windows\System\ARSgIEW.exe
  2⤵
  PID:6672
- C:\Windows\System\vysCdKg.exe
  C:\Windows\System\vysCdKg.exe
  2⤵
  PID:6704
- C:\Windows\System\pmmHiJd.exe
  C:\Windows\System\pmmHiJd.exe
  2⤵
  PID:6728
- C:\Windows\System\udGUslU.exe
  C:\Windows\System\udGUslU.exe
  2⤵
  PID:6752
- C:\Windows\System\kkUrAur.exe
  C:\Windows\System\kkUrAur.exe
  2⤵
  PID:6780
- C:\Windows\System\gKiFFTw.exe
  C:\Windows\System\gKiFFTw.exe
  2⤵
  PID:6808
- C:\Windows\System\urplUUf.exe
  C:\Windows\System\urplUUf.exe
  2⤵
  PID:6832
- C:\Windows\System\hbtVcQX.exe
  C:\Windows\System\hbtVcQX.exe
  2⤵
  PID:6872
- C:\Windows\System\WtHzgJQ.exe
  C:\Windows\System\WtHzgJQ.exe
  2⤵
  PID:6896
- C:\Windows\System\vgIcrcy.exe
  C:\Windows\System\vgIcrcy.exe
  2⤵
  PID:6920
- C:\Windows\System\kgCDTsE.exe
  C:\Windows\System\kgCDTsE.exe
  2⤵
  PID:6952
- C:\Windows\System\RZgpBaX.exe
  C:\Windows\System\RZgpBaX.exe
  2⤵
  PID:6972
- C:\Windows\System\OKhNlCN.exe
  C:\Windows\System\OKhNlCN.exe
  2⤵
  PID:6996
- C:\Windows\System\kIQhmEV.exe
  C:\Windows\System\kIQhmEV.exe
  2⤵
  PID:7020
- C:\Windows\System\TxjqrOU.exe
  C:\Windows\System\TxjqrOU.exe
  2⤵
  PID:7048
- C:\Windows\System\cqVrzHM.exe
  C:\Windows\System\cqVrzHM.exe
  2⤵
  PID:7080
- C:\Windows\System\rKSVQre.exe
  C:\Windows\System\rKSVQre.exe
  2⤵
  PID:7104
- C:\Windows\System\ksqfXLe.exe
  C:\Windows\System\ksqfXLe.exe
  2⤵
  PID:7140
- C:\Windows\System\IPMGRTb.exe
  C:\Windows\System\IPMGRTb.exe
  2⤵
  PID:7160
- C:\Windows\System\FvoPPaK.exe
  C:\Windows\System\FvoPPaK.exe
  2⤵
  PID:6204
- C:\Windows\System\elHtCht.exe
  C:\Windows\System\elHtCht.exe
  2⤵
  PID:6256
- C:\Windows\System\wwcKnMb.exe
  C:\Windows\System\wwcKnMb.exe
  2⤵
  PID:6320
- C:\Windows\System\dYnssHh.exe
  C:\Windows\System\dYnssHh.exe
  2⤵
  PID:6404
- C:\Windows\System\zWSOvsx.exe
  C:\Windows\System\zWSOvsx.exe
  2⤵
  PID:6448
- C:\Windows\System\wmEbREG.exe
  C:\Windows\System\wmEbREG.exe
  2⤵
  PID:6516
- C:\Windows\System\gmLFfvj.exe
  C:\Windows\System\gmLFfvj.exe
  2⤵
  PID:6260
- C:\Windows\System\BucnyGE.exe
  C:\Windows\System\BucnyGE.exe
  2⤵
  PID:6596
- C:\Windows\System\XsfrIkX.exe
  C:\Windows\System\XsfrIkX.exe
  2⤵
  PID:6680
- C:\Windows\System\iZeepOZ.exe
  C:\Windows\System\iZeepOZ.exe
  2⤵
  PID:6720
- C:\Windows\System\MTdTExU.exe
  C:\Windows\System\MTdTExU.exe
  2⤵
  PID:6796
- C:\Windows\System\DFHhmpo.exe
  C:\Windows\System\DFHhmpo.exe
  2⤵
  PID:6840
- C:\Windows\System\QoZxuaM.exe
  C:\Windows\System\QoZxuaM.exe
  2⤵
  PID:6892
- C:\Windows\System\uPwpBTm.exe
  C:\Windows\System\uPwpBTm.exe
  2⤵
  PID:6968
- C:\Windows\System\fwKqPDB.exe
  C:\Windows\System\fwKqPDB.exe
  2⤵
  PID:7060
- C:\Windows\System\pIHkpTf.exe
  C:\Windows\System\pIHkpTf.exe
  2⤵
  PID:7100
- C:\Windows\System\UiFhWmE.exe
  C:\Windows\System\UiFhWmE.exe
  2⤵
  PID:6172
- C:\Windows\System\OGhiWEK.exe
  C:\Windows\System\OGhiWEK.exe
  2⤵
  PID:6164
- C:\Windows\System\aGovZRf.exe
  C:\Windows\System\aGovZRf.exe
  2⤵
  PID:6460
- C:\Windows\System\xtKUZnD.exe
  C:\Windows\System\xtKUZnD.exe
  2⤵
  PID:6572
- C:\Windows\System\pXMclck.exe
  C:\Windows\System\pXMclck.exe
  2⤵
  PID:6624
- C:\Windows\System\IHaJtfA.exe
  C:\Windows\System\IHaJtfA.exe
  2⤵
  PID:6932
- C:\Windows\System\jkNcFrY.exe
  C:\Windows\System\jkNcFrY.exe
  2⤵
  PID:7128
- C:\Windows\System\pqrzdOM.exe
  C:\Windows\System\pqrzdOM.exe
  2⤵
  PID:6348
- C:\Windows\System\CxBKZUC.exe
  C:\Windows\System\CxBKZUC.exe
  2⤵
  PID:7176
- C:\Windows\System\TmGeJHR.exe
  C:\Windows\System\TmGeJHR.exe
  2⤵
  PID:7208
- C:\Windows\System\jWZKkPN.exe
  C:\Windows\System\jWZKkPN.exe
  2⤵
  PID:7240
- C:\Windows\System\avBYLDJ.exe
  C:\Windows\System\avBYLDJ.exe
  2⤵
  PID:7268
- C:\Windows\System\wNHjoPG.exe
  C:\Windows\System\wNHjoPG.exe
  2⤵
  PID:7300
- C:\Windows\System\tqALAVa.exe
  C:\Windows\System\tqALAVa.exe
  2⤵
  PID:7328
- C:\Windows\System\mreKpWJ.exe
  C:\Windows\System\mreKpWJ.exe
  2⤵
  PID:7360
- C:\Windows\System\eObnSqk.exe
  C:\Windows\System\eObnSqk.exe
  2⤵
  PID:7388
- C:\Windows\System\FVpRtZk.exe
  C:\Windows\System\FVpRtZk.exe
  2⤵
  PID:7416
- C:\Windows\System\spVUxGR.exe
  C:\Windows\System\spVUxGR.exe
  2⤵
  PID:7448
- C:\Windows\System\RaXDsuC.exe
  C:\Windows\System\RaXDsuC.exe
  2⤵
  PID:7468
- C:\Windows\System\ajPcAoh.exe
  C:\Windows\System\ajPcAoh.exe
  2⤵
  PID:7500
- C:\Windows\System\yikrEEF.exe
  C:\Windows\System\yikrEEF.exe
  2⤵
  PID:7532
- C:\Windows\System\qvkDIhx.exe
  C:\Windows\System\qvkDIhx.exe
  2⤵
  PID:7560
- C:\Windows\System\vDUBDFa.exe
  C:\Windows\System\vDUBDFa.exe
  2⤵
  PID:7604
- C:\Windows\System\tEpVSeu.exe
  C:\Windows\System\tEpVSeu.exe
  2⤵
  PID:7628
- C:\Windows\System\DAfMyTB.exe
  C:\Windows\System\DAfMyTB.exe
  2⤵
  PID:7652
- C:\Windows\System\PZcAsMz.exe
  C:\Windows\System\PZcAsMz.exe
  2⤵
  PID:7680
- C:\Windows\System\geKlACC.exe
  C:\Windows\System\geKlACC.exe
  2⤵
  PID:7708
- C:\Windows\System\GeXChOQ.exe
  C:\Windows\System\GeXChOQ.exe
  2⤵
  PID:7740
- C:\Windows\System\KJNVDkk.exe
  C:\Windows\System\KJNVDkk.exe
  2⤵
  PID:7772
- C:\Windows\System\miLiphe.exe
  C:\Windows\System\miLiphe.exe
  2⤵
  PID:7792
- C:\Windows\System\LVcxxhD.exe
  C:\Windows\System\LVcxxhD.exe
  2⤵
  PID:7816
- C:\Windows\System\gKoCaPm.exe
  C:\Windows\System\gKoCaPm.exe
  2⤵
  PID:7856
- C:\Windows\System\JYygQCv.exe
  C:\Windows\System\JYygQCv.exe
  2⤵
  PID:7880
- C:\Windows\System\RwIqkUr.exe
  C:\Windows\System\RwIqkUr.exe
  2⤵
  PID:7916
- C:\Windows\System\CTlDnwU.exe
  C:\Windows\System\CTlDnwU.exe
  2⤵
  PID:7944
- C:\Windows\System\pJlhGGl.exe
  C:\Windows\System\pJlhGGl.exe
  2⤵
  PID:7976
- C:\Windows\System\GngaaNz.exe
  C:\Windows\System\GngaaNz.exe
  2⤵
  PID:8000
- C:\Windows\System\jPVgrUF.exe
  C:\Windows\System\jPVgrUF.exe
  2⤵
  PID:8028
- C:\Windows\System\jMHnVZY.exe
  C:\Windows\System\jMHnVZY.exe
  2⤵
  PID:8056
- C:\Windows\System\lfdtOud.exe
  C:\Windows\System\lfdtOud.exe
  2⤵
  PID:8084
- C:\Windows\System\KASqNjw.exe
  C:\Windows\System\KASqNjw.exe
  2⤵
  PID:8112
- C:\Windows\System\JOxLzyl.exe
  C:\Windows\System\JOxLzyl.exe
  2⤵
  PID:8140
- C:\Windows\System\inEXOTx.exe
  C:\Windows\System\inEXOTx.exe
  2⤵
  PID:8176
- C:\Windows\System\xqrPLrr.exe
  C:\Windows\System\xqrPLrr.exe
  2⤵
  PID:6948
- C:\Windows\System\fDEeBvs.exe
  C:\Windows\System\fDEeBvs.exe
  2⤵
  PID:6252
- C:\Windows\System\AwMwJMw.exe
  C:\Windows\System\AwMwJMw.exe
  2⤵
  PID:6916
- C:\Windows\System\UvkiUAw.exe
  C:\Windows\System\UvkiUAw.exe
  2⤵
  PID:7236
- C:\Windows\System\iuulxiR.exe
  C:\Windows\System\iuulxiR.exe
  2⤵
  PID:7256
- C:\Windows\System\vSYPqOh.exe
  C:\Windows\System\vSYPqOh.exe
  2⤵
  PID:7424
- C:\Windows\System\EyaQjbg.exe
  C:\Windows\System\EyaQjbg.exe
  2⤵
  PID:7456
- C:\Windows\System\IkhQQOG.exe
  C:\Windows\System\IkhQQOG.exe
  2⤵
  PID:7508
- C:\Windows\System\JPAJyvl.exe
  C:\Windows\System\JPAJyvl.exe
  2⤵
  PID:7576
- C:\Windows\System\vUFGJJh.exe
  C:\Windows\System\vUFGJJh.exe
  2⤵
  PID:7672
- C:\Windows\System\WSXmZIa.exe
  C:\Windows\System\WSXmZIa.exe
  2⤵
  PID:7732
- C:\Windows\System\hekGWUI.exe
  C:\Windows\System\hekGWUI.exe
  2⤵
  PID:7784
- C:\Windows\System\jeRrsoa.exe
  C:\Windows\System\jeRrsoa.exe
  2⤵
  PID:7836
- C:\Windows\System\BaILdfA.exe
  C:\Windows\System\BaILdfA.exe
  2⤵
  PID:7900
- C:\Windows\System\XXCeHap.exe
  C:\Windows\System\XXCeHap.exe
  2⤵
  PID:7956
- C:\Windows\System\kNMJcPt.exe
  C:\Windows\System\kNMJcPt.exe
  2⤵
  PID:8076
- C:\Windows\System\QqDnRxT.exe
  C:\Windows\System\QqDnRxT.exe
  2⤵
  PID:7092
- C:\Windows\System\sqjVKeT.exe
  C:\Windows\System\sqjVKeT.exe
  2⤵
  PID:6504
- C:\Windows\System\EwhroFH.exe
  C:\Windows\System\EwhroFH.exe
  2⤵
  PID:7192
- C:\Windows\System\CICTaUr.exe
  C:\Windows\System\CICTaUr.exe
  2⤵
  PID:7308
- C:\Windows\System\cjLouZf.exe
  C:\Windows\System\cjLouZf.exe
  2⤵
  PID:7512
- C:\Windows\System\ycLPiCK.exe
  C:\Windows\System\ycLPiCK.exe
  2⤵
  PID:7588
- C:\Windows\System\QSJsiGW.exe
  C:\Windows\System\QSJsiGW.exe
  2⤵
  PID:7768
- C:\Windows\System\GHXWejf.exe
  C:\Windows\System\GHXWejf.exe
  2⤵
  PID:7876
- C:\Windows\System\yYmkVFq.exe
  C:\Windows\System\yYmkVFq.exe
  2⤵
  PID:8136
- C:\Windows\System\rmKYVcj.exe
  C:\Windows\System\rmKYVcj.exe
  2⤵
  PID:7312
- C:\Windows\System\wbZskpU.exe
  C:\Windows\System\wbZskpU.exe
  2⤵
  PID:7624
- C:\Windows\System\DXCfFAO.exe
  C:\Windows\System\DXCfFAO.exe
  2⤵
  PID:8052
- C:\Windows\System\kmizTGX.exe
  C:\Windows\System\kmizTGX.exe
  2⤵
  PID:7440
- C:\Windows\System\QnfnvaI.exe
  C:\Windows\System\QnfnvaI.exe
  2⤵
  PID:8196
- C:\Windows\System\IPfSvkb.exe
  C:\Windows\System\IPfSvkb.exe
  2⤵
  PID:8224
- C:\Windows\System\cienldI.exe
  C:\Windows\System\cienldI.exe
  2⤵
  PID:8240
- C:\Windows\System\omvAvzC.exe
  C:\Windows\System\omvAvzC.exe
  2⤵
  PID:8260
- C:\Windows\System\EfmfBMH.exe
  C:\Windows\System\EfmfBMH.exe
  2⤵
  PID:8284
- C:\Windows\System\DQSrwSJ.exe
  C:\Windows\System\DQSrwSJ.exe
  2⤵
  PID:8316
- C:\Windows\System\cfkPhFB.exe
  C:\Windows\System\cfkPhFB.exe
  2⤵
  PID:8348
- C:\Windows\System\UkcFCpV.exe
  C:\Windows\System\UkcFCpV.exe
  2⤵
  PID:8372
- C:\Windows\System\euzzQki.exe
  C:\Windows\System\euzzQki.exe
  2⤵
  PID:8404
- C:\Windows\System\XhHaIDn.exe
  C:\Windows\System\XhHaIDn.exe
  2⤵
  PID:8428
- C:\Windows\System\aisRLtO.exe
  C:\Windows\System\aisRLtO.exe
  2⤵
  PID:8468
- C:\Windows\System\yPYiUmW.exe
  C:\Windows\System\yPYiUmW.exe
  2⤵
  PID:8496
- C:\Windows\System\rPTioee.exe
  C:\Windows\System\rPTioee.exe
  2⤵
  PID:8528
- C:\Windows\System\vQhNdET.exe
  C:\Windows\System\vQhNdET.exe
  2⤵
  PID:8552
- C:\Windows\System\ISftAaX.exe
  C:\Windows\System\ISftAaX.exe
  2⤵
  PID:8576
- C:\Windows\System\ypTiouV.exe
  C:\Windows\System\ypTiouV.exe
  2⤵
  PID:8612
- C:\Windows\System\TygcmbO.exe
  C:\Windows\System\TygcmbO.exe
  2⤵
  PID:8636
- C:\Windows\System\CIcSZhM.exe
  C:\Windows\System\CIcSZhM.exe
  2⤵
  PID:8664
- C:\Windows\System\AOXeoPR.exe
  C:\Windows\System\AOXeoPR.exe
  2⤵
  PID:8696
- C:\Windows\System\btRacZp.exe
  C:\Windows\System\btRacZp.exe
  2⤵
  PID:8720
- C:\Windows\System\gQMvHiV.exe
  C:\Windows\System\gQMvHiV.exe
  2⤵
  PID:8748
- C:\Windows\System\KOvhvLV.exe
  C:\Windows\System\KOvhvLV.exe
  2⤵
  PID:8776
- C:\Windows\System\gCmUAtD.exe
  C:\Windows\System\gCmUAtD.exe
  2⤵
  PID:8800
- C:\Windows\System\rYfhUNC.exe
  C:\Windows\System\rYfhUNC.exe
  2⤵
  PID:8828
- C:\Windows\System\PMCYcpj.exe
  C:\Windows\System\PMCYcpj.exe
  2⤵
  PID:8856
- C:\Windows\System\jnPjOSG.exe
  C:\Windows\System\jnPjOSG.exe
  2⤵
  PID:8880
- C:\Windows\System\HUDemqx.exe
  C:\Windows\System\HUDemqx.exe
  2⤵
  PID:8908
- C:\Windows\System\TgtOhdZ.exe
  C:\Windows\System\TgtOhdZ.exe
  2⤵
  PID:8936
- C:\Windows\System\IopCLCG.exe
  C:\Windows\System\IopCLCG.exe
  2⤵
  PID:8960
- C:\Windows\System\GJteySg.exe
  C:\Windows\System\GJteySg.exe
  2⤵
  PID:8996
- C:\Windows\System\AGHCKGS.exe
  C:\Windows\System\AGHCKGS.exe
  2⤵
  PID:9024
- C:\Windows\System\iQQjwsa.exe
  C:\Windows\System\iQQjwsa.exe
  2⤵
  PID:9048
- C:\Windows\System\ZGUAdTA.exe
  C:\Windows\System\ZGUAdTA.exe
  2⤵
  PID:9072
- C:\Windows\System\oNEpNSo.exe
  C:\Windows\System\oNEpNSo.exe
  2⤵
  PID:9100
- C:\Windows\System\jNGCCAT.exe
  C:\Windows\System\jNGCCAT.exe
  2⤵
  PID:9132
- C:\Windows\System\ebjhzGv.exe
  C:\Windows\System\ebjhzGv.exe
  2⤵
  PID:9156
- C:\Windows\System\tGtUtSP.exe
  C:\Windows\System\tGtUtSP.exe
  2⤵
  PID:9184
- C:\Windows\System\IOBcfKM.exe
  C:\Windows\System\IOBcfKM.exe
  2⤵
  PID:9208
- C:\Windows\System\lwXwHVV.exe
  C:\Windows\System\lwXwHVV.exe
  2⤵
  PID:7808
- C:\Windows\System\dXRCqBa.exe
  C:\Windows\System\dXRCqBa.exe
  2⤵
  PID:8324
- C:\Windows\System\HNgzRTi.exe
  C:\Windows\System\HNgzRTi.exe
  2⤵
  PID:8340
- C:\Windows\System\zdjGTwW.exe
  C:\Windows\System\zdjGTwW.exe
  2⤵
  PID:8364
- C:\Windows\System\uoXfRnv.exe
  C:\Windows\System\uoXfRnv.exe
  2⤵
  PID:8504
- C:\Windows\System\aGZAinO.exe
  C:\Windows\System\aGZAinO.exe
  2⤵
  PID:8536
- C:\Windows\System\wobERLa.exe
  C:\Windows\System\wobERLa.exe
  2⤵
  PID:8564
- C:\Windows\System\CCeDidn.exe
  C:\Windows\System\CCeDidn.exe
  2⤵
  PID:8676
- C:\Windows\System\eoSeBgR.exe
  C:\Windows\System\eoSeBgR.exe
  2⤵
  PID:8736
- C:\Windows\System\PUwipub.exe
  C:\Windows\System\PUwipub.exe
  2⤵
  PID:8820
- C:\Windows\System\tjtcbUf.exe
  C:\Windows\System\tjtcbUf.exe
  2⤵
  PID:8872
- C:\Windows\System\AjQtDqh.exe
  C:\Windows\System\AjQtDqh.exe
  2⤵
  PID:8932
- C:\Windows\System\TzvcYGr.exe
  C:\Windows\System\TzvcYGr.exe
  2⤵
  PID:8956
- C:\Windows\System\EfeVVnz.exe
  C:\Windows\System\EfeVVnz.exe
  2⤵
  PID:9088
- C:\Windows\System\JbLBFBe.exe
  C:\Windows\System\JbLBFBe.exe
  2⤵
  PID:9120
- C:\Windows\System\WFBnZUK.exe
  C:\Windows\System\WFBnZUK.exe
  2⤵
  PID:8128
- C:\Windows\System\pmRLkWo.exe
  C:\Windows\System\pmRLkWo.exe
  2⤵
  PID:8248
- C:\Windows\System\fdFOefD.exe
  C:\Windows\System\fdFOefD.exe
  2⤵
  PID:8392
- C:\Windows\System\jVhmywq.exe
  C:\Windows\System\jVhmywq.exe
  2⤵
  PID:8740
- C:\Windows\System\KMKRCtZ.exe
  C:\Windows\System\KMKRCtZ.exe
  2⤵
  PID:8660
- C:\Windows\System\wIKeHGW.exe
  C:\Windows\System\wIKeHGW.exe
  2⤵
  PID:8796
- C:\Windows\System\RixCfaT.exe
  C:\Windows\System\RixCfaT.exe
  2⤵
  PID:8976
- C:\Windows\System\JmCQHdG.exe
  C:\Windows\System\JmCQHdG.exe
  2⤵
  PID:8220
- C:\Windows\System\DfXZUKJ.exe
  C:\Windows\System\DfXZUKJ.exe
  2⤵
  PID:8596
- C:\Windows\System\gENRryA.exe
  C:\Windows\System\gENRryA.exe
  2⤵
  PID:8924
- C:\Windows\System\sQnqxOC.exe
  C:\Windows\System\sQnqxOC.exe
  2⤵
  PID:9060
- C:\Windows\System\cmFtFyc.exe
  C:\Windows\System\cmFtFyc.exe
  2⤵
  PID:9228
- C:\Windows\System\JbyVIeg.exe
  C:\Windows\System\JbyVIeg.exe
  2⤵
  PID:9252
- C:\Windows\System\TyiEOFx.exe
  C:\Windows\System\TyiEOFx.exe
  2⤵
  PID:9280
- C:\Windows\System\MBUcvqB.exe
  C:\Windows\System\MBUcvqB.exe
  2⤵
  PID:9308
- C:\Windows\System\qLMzASr.exe
  C:\Windows\System\qLMzASr.exe
  2⤵
  PID:9332
- C:\Windows\System\YqrPkaB.exe
  C:\Windows\System\YqrPkaB.exe
  2⤵
  PID:9360
- C:\Windows\System\vpMavRA.exe
  C:\Windows\System\vpMavRA.exe
  2⤵
  PID:9384
- C:\Windows\System\TsimBoa.exe
  C:\Windows\System\TsimBoa.exe
  2⤵
  PID:9412
- C:\Windows\System\FMEvwUq.exe
  C:\Windows\System\FMEvwUq.exe
  2⤵
  PID:9444
- C:\Windows\System\GjqgRJh.exe
  C:\Windows\System\GjqgRJh.exe
  2⤵
  PID:9468
- C:\Windows\System\iaiMCaE.exe
  C:\Windows\System\iaiMCaE.exe
  2⤵
  PID:9500
- C:\Windows\System\ZChhmCw.exe
  C:\Windows\System\ZChhmCw.exe
  2⤵
  PID:9528
- C:\Windows\System\cSXhqgB.exe
  C:\Windows\System\cSXhqgB.exe
  2⤵
  PID:9560
- C:\Windows\System\jOKEGlz.exe
  C:\Windows\System\jOKEGlz.exe
  2⤵
  PID:9584
- C:\Windows\System\OHRsAOo.exe
  C:\Windows\System\OHRsAOo.exe
  2⤵
  PID:9612
- C:\Windows\System\EtnfMdL.exe
  C:\Windows\System\EtnfMdL.exe
  2⤵
  PID:9648
- C:\Windows\System\EfMiupq.exe
  C:\Windows\System\EfMiupq.exe
  2⤵
  PID:9668
- C:\Windows\System\axXrwXi.exe
  C:\Windows\System\axXrwXi.exe
  2⤵
  PID:9696
- C:\Windows\System\uqPvsyz.exe
  C:\Windows\System\uqPvsyz.exe
  2⤵
  PID:9724
- C:\Windows\System\uMubEel.exe
  C:\Windows\System\uMubEel.exe
  2⤵
  PID:9756
- C:\Windows\System\ouhQtkh.exe
  C:\Windows\System\ouhQtkh.exe
  2⤵
  PID:9788
- C:\Windows\System\MbfxCQl.exe
  C:\Windows\System\MbfxCQl.exe
  2⤵
  PID:9812
- C:\Windows\System\dVFBtQK.exe
  C:\Windows\System\dVFBtQK.exe
  2⤵
  PID:9836
- C:\Windows\System\Lhkbkve.exe
  C:\Windows\System\Lhkbkve.exe
  2⤵
  PID:9864
- C:\Windows\System\nbBqhKG.exe
  C:\Windows\System\nbBqhKG.exe
  2⤵
  PID:9880
- C:\Windows\System\xofUqVB.exe
  C:\Windows\System\xofUqVB.exe
  2⤵
  PID:9912
- C:\Windows\System\mJOLRPs.exe
  C:\Windows\System\mJOLRPs.exe
  2⤵
  PID:9936
- C:\Windows\System\gGsolLD.exe
  C:\Windows\System\gGsolLD.exe
  2⤵
  PID:9964
- C:\Windows\System\LEAODrp.exe
  C:\Windows\System\LEAODrp.exe
  2⤵
  PID:9992
- C:\Windows\System\kbiaLtI.exe
  C:\Windows\System\kbiaLtI.exe
  2⤵
  PID:10020
- C:\Windows\System\BJdEVPQ.exe
  C:\Windows\System\BJdEVPQ.exe
  2⤵
  PID:10048
- C:\Windows\System\IHKzlOr.exe
  C:\Windows\System\IHKzlOr.exe
  2⤵
  PID:10076
- C:\Windows\System\yxyTVpU.exe
  C:\Windows\System\yxyTVpU.exe
  2⤵
  PID:10100
- C:\Windows\System\gqUadBP.exe
  C:\Windows\System\gqUadBP.exe
  2⤵
  PID:10132
- C:\Windows\System\anJekQq.exe
  C:\Windows\System\anJekQq.exe
  2⤵
  PID:10160
- C:\Windows\System\egugcIg.exe
  C:\Windows\System\egugcIg.exe
  2⤵
  PID:10188
- C:\Windows\System\lrHFXKh.exe
  C:\Windows\System\lrHFXKh.exe
  2⤵
  PID:10220
- C:\Windows\System\mnXlmWV.exe
  C:\Windows\System\mnXlmWV.exe
  2⤵
  PID:8980
- C:\Windows\System\vHwBlza.exe
  C:\Windows\System\vHwBlza.exe
  2⤵
  PID:8452
- C:\Windows\System\EWfnvor.exe
  C:\Windows\System\EWfnvor.exe
  2⤵
  PID:9272
- C:\Windows\System\utnxdzJ.exe
  C:\Windows\System\utnxdzJ.exe
  2⤵
  PID:9368
- C:\Windows\System\jvdUJCk.exe
  C:\Windows\System\jvdUJCk.exe
  2⤵
  PID:9436
- C:\Windows\System\gQkynJx.exe
  C:\Windows\System\gQkynJx.exe
  2⤵
  PID:9432
- C:\Windows\System\nqhDBgt.exe
  C:\Windows\System\nqhDBgt.exe
  2⤵
  PID:9576
- C:\Windows\System\uGKDslp.exe
  C:\Windows\System\uGKDslp.exe
  2⤵
  PID:9600
- C:\Windows\System\tugkcZi.exe
  C:\Windows\System\tugkcZi.exe
  2⤵
  PID:9744
- C:\Windows\System\tsTMCAa.exe
  C:\Windows\System\tsTMCAa.exe
  2⤵
  PID:9740
- C:\Windows\System\TFFQcYH.exe
  C:\Windows\System\TFFQcYH.exe
  2⤵
  PID:9828
- C:\Windows\System\gpdGezP.exe
  C:\Windows\System\gpdGezP.exe
  2⤵
  PID:9908
- C:\Windows\System\eGjEqVo.exe
  C:\Windows\System\eGjEqVo.exe
  2⤵
  PID:10004
- C:\Windows\System\luJMEID.exe
  C:\Windows\System\luJMEID.exe
  2⤵
  PID:10036
- C:\Windows\System\CVhANfd.exe
  C:\Windows\System\CVhANfd.exe
  2⤵
  PID:10096
- C:\Windows\System\fVNIKpc.exe
  C:\Windows\System\fVNIKpc.exe
  2⤵
  PID:10172
- C:\Windows\System\ahdHKiz.exe
  C:\Windows\System\ahdHKiz.exe
  2⤵
  PID:10204
- C:\Windows\System\RrFiFPd.exe
  C:\Windows\System\RrFiFPd.exe
  2⤵
  PID:9328
- C:\Windows\System\gsJjABb.exe
  C:\Windows\System\gsJjABb.exe
  2⤵
  PID:9380
- C:\Windows\System\meqGwIH.exe
  C:\Windows\System\meqGwIH.exe
  2⤵
  PID:9516
- C:\Windows\System\topqALf.exe
  C:\Windows\System\topqALf.exe
  2⤵
  PID:9544
- C:\Windows\System\tJkbhoZ.exe
  C:\Windows\System\tJkbhoZ.exe
  2⤵
  PID:9952
- C:\Windows\System\PchBQUl.exe
  C:\Windows\System\PchBQUl.exe
  2⤵
  PID:10092
- C:\Windows\System\ghfnkWN.exe
  C:\Windows\System\ghfnkWN.exe
  2⤵
  PID:10212
- C:\Windows\System\dfdPlgB.exe
  C:\Windows\System\dfdPlgB.exe
  2⤵
  PID:10116
- C:\Windows\System\SDSbkHa.exe
  C:\Windows\System\SDSbkHa.exe
  2⤵
  PID:9932
- C:\Windows\System\ckRABGs.exe
  C:\Windows\System\ckRABGs.exe
  2⤵
  PID:9892
- C:\Windows\System\nguZEhJ.exe
  C:\Windows\System\nguZEhJ.exe
  2⤵
  PID:10260
- C:\Windows\System\DNLPQgZ.exe
  C:\Windows\System\DNLPQgZ.exe
  2⤵
  PID:10284
- C:\Windows\System\OHjrQoD.exe
  C:\Windows\System\OHjrQoD.exe
  2⤵
  PID:10308
- C:\Windows\System\DRlWVud.exe
  C:\Windows\System\DRlWVud.exe
  2⤵
  PID:10336
- C:\Windows\System\XxPZajA.exe
  C:\Windows\System\XxPZajA.exe
  2⤵
  PID:10364
- C:\Windows\System\QTYptXv.exe
  C:\Windows\System\QTYptXv.exe
  2⤵
  PID:10392
- C:\Windows\System\TduhJYj.exe
  C:\Windows\System\TduhJYj.exe
  2⤵
  PID:10416
- C:\Windows\System\HuGqjzP.exe
  C:\Windows\System\HuGqjzP.exe
  2⤵
  PID:10444
- C:\Windows\System\HtBDYvn.exe
  C:\Windows\System\HtBDYvn.exe
  2⤵
  PID:10472
- C:\Windows\System\eUvlomz.exe
  C:\Windows\System\eUvlomz.exe
  2⤵
  PID:10496
- C:\Windows\System\QynJySv.exe
  C:\Windows\System\QynJySv.exe
  2⤵
  PID:10516
- C:\Windows\System\HBNVQQM.exe
  C:\Windows\System\HBNVQQM.exe
  2⤵
  PID:10544
- C:\Windows\System\ewViuyt.exe
  C:\Windows\System\ewViuyt.exe
  2⤵
  PID:10568
- C:\Windows\System\BhmcgIt.exe
  C:\Windows\System\BhmcgIt.exe
  2⤵
  PID:10600
- C:\Windows\System\RjwiCOY.exe
  C:\Windows\System\RjwiCOY.exe
  2⤵
  PID:10628
- C:\Windows\System\aKlfvSO.exe
  C:\Windows\System\aKlfvSO.exe
  2⤵
  PID:10660
- C:\Windows\System\pJYFrRv.exe
  C:\Windows\System\pJYFrRv.exe
  2⤵
  PID:10688
- C:\Windows\System\GVzTzNK.exe
  C:\Windows\System\GVzTzNK.exe
  2⤵
  PID:10708
- C:\Windows\System\fjwKlPt.exe
  C:\Windows\System\fjwKlPt.exe
  2⤵
  PID:10740
- C:\Windows\System\oofdAJF.exe
  C:\Windows\System\oofdAJF.exe
  2⤵
  PID:10764
- C:\Windows\System\ANrcRxi.exe
  C:\Windows\System\ANrcRxi.exe
  2⤵
  PID:10796
- C:\Windows\System\dEfmdja.exe
  C:\Windows\System\dEfmdja.exe
  2⤵
  PID:10828
- C:\Windows\System\rXWaBAM.exe
  C:\Windows\System\rXWaBAM.exe
  2⤵
  PID:10852
- C:\Windows\System\oHLEwBO.exe
  C:\Windows\System\oHLEwBO.exe
  2⤵
  PID:10876
- C:\Windows\System\Rfgwmle.exe
  C:\Windows\System\Rfgwmle.exe
  2⤵
  PID:10904
- C:\Windows\System\VrAruok.exe
  C:\Windows\System\VrAruok.exe
  2⤵
  PID:10932
- C:\Windows\System\UioNuep.exe
  C:\Windows\System\UioNuep.exe
  2⤵
  PID:10964
- C:\Windows\System\blTEZyy.exe
  C:\Windows\System\blTEZyy.exe
  2⤵
  PID:10988
- C:\Windows\System\SKgolwr.exe
  C:\Windows\System\SKgolwr.exe
  2⤵
  PID:11020
- C:\Windows\System\xhGuoza.exe
  C:\Windows\System\xhGuoza.exe
  2⤵
  PID:11048
- C:\Windows\System\PngJfZd.exe
  C:\Windows\System\PngJfZd.exe
  2⤵
  PID:11076
- C:\Windows\System\qsUrNUn.exe
  C:\Windows\System\qsUrNUn.exe
  2⤵
  PID:11104
- C:\Windows\System\OwnjTcj.exe
  C:\Windows\System\OwnjTcj.exe
  2⤵
  PID:11132
- C:\Windows\System\kFplwxi.exe
  C:\Windows\System\kFplwxi.exe
  2⤵
  PID:11160
- C:\Windows\System\LKrTaZE.exe
  C:\Windows\System\LKrTaZE.exe
  2⤵
  PID:11200
- C:\Windows\System\FixlpME.exe
  C:\Windows\System\FixlpME.exe
  2⤵
  PID:11224
- C:\Windows\System\Vajxlmz.exe
  C:\Windows\System\Vajxlmz.exe
  2⤵
  PID:11252
- C:\Windows\System\TZnzxhM.exe
  C:\Windows\System\TZnzxhM.exe
  2⤵
  PID:9268
- C:\Windows\System\RgqCCFy.exe
  C:\Windows\System\RgqCCFy.exe
  2⤵
  PID:9484
- C:\Windows\System\DzNbinf.exe
  C:\Windows\System\DzNbinf.exe
  2⤵
  PID:10272
- C:\Windows\System\zsuQulV.exe
  C:\Windows\System\zsuQulV.exe
  2⤵
  PID:10408
- C:\Windows\System\HapcGvt.exe
  C:\Windows\System\HapcGvt.exe
  2⤵
  PID:10460
- C:\Windows\System\vZRLJVd.exe
  C:\Windows\System\vZRLJVd.exe
  2⤵
  PID:10536
- C:\Windows\System\mhlMqzq.exe
  C:\Windows\System\mhlMqzq.exe
  2⤵
  PID:10592
- C:\Windows\System\VCHcinV.exe
  C:\Windows\System\VCHcinV.exe
  2⤵
  PID:10612
- C:\Windows\System\SGKHqLm.exe
  C:\Windows\System\SGKHqLm.exe
  2⤵
  PID:10564
- C:\Windows\System\MzIKGQa.exe
  C:\Windows\System\MzIKGQa.exe
  2⤵
  PID:10672
- C:\Windows\System\rEnSjeD.exe
  C:\Windows\System\rEnSjeD.exe
  2⤵
  PID:10776
- C:\Windows\System\uDteyQZ.exe
  C:\Windows\System\uDteyQZ.exe
  2⤵
  PID:10836
- C:\Windows\System\ZKsOXZu.exe
  C:\Windows\System\ZKsOXZu.exe
  2⤵
  PID:10956
- C:\Windows\System\RUTWxkx.exe
  C:\Windows\System\RUTWxkx.exe
  2⤵
  PID:10864
- C:\Windows\System\vmwBClp.exe
  C:\Windows\System\vmwBClp.exe
  2⤵
  PID:10976
- C:\Windows\System\tSYeOdC.exe
  C:\Windows\System\tSYeOdC.exe
  2⤵
  PID:11088
- C:\Windows\System\QOJBHue.exe
  C:\Windows\System\QOJBHue.exe
  2⤵
  PID:11092
- C:\Windows\System\BFfIsNt.exe
  C:\Windows\System\BFfIsNt.exe
  2⤵
  PID:11220
- C:\Windows\System\heaAhfX.exe
  C:\Windows\System\heaAhfX.exe
  2⤵
  PID:10236
- C:\Windows\System\gkHctaK.exe
  C:\Windows\System\gkHctaK.exe
  2⤵
  PID:10280
- C:\Windows\System\IKtFACO.exe
  C:\Windows\System\IKtFACO.exe
  2⤵
  PID:10380
- C:\Windows\System\USJJvAD.exe
  C:\Windows\System\USJJvAD.exe
  2⤵
  PID:10432
- C:\Windows\System\YjvhvJR.exe
  C:\Windows\System\YjvhvJR.exe
  2⤵
  PID:10576
- C:\Windows\System\EuWhrbj.exe
  C:\Windows\System\EuWhrbj.exe
  2⤵
  PID:10920
- C:\Windows\System\Nffyjph.exe
  C:\Windows\System\Nffyjph.exe
  2⤵
  PID:11124
- C:\Windows\System\sMgkbgH.exe
  C:\Windows\System\sMgkbgH.exe
  2⤵
  PID:9688
- C:\Windows\System\QfFlYGf.exe
  C:\Windows\System\QfFlYGf.exe
  2⤵
  PID:11208
- C:\Windows\System\sLHKUak.exe
  C:\Windows\System\sLHKUak.exe
  2⤵
  PID:11280
- C:\Windows\System\KNCNSia.exe
  C:\Windows\System\KNCNSia.exe
  2⤵
  PID:11300
- C:\Windows\System\zbmLakf.exe
  C:\Windows\System\zbmLakf.exe
  2⤵
  PID:11328
- C:\Windows\System\NolhaZD.exe
  C:\Windows\System\NolhaZD.exe
  2⤵
  PID:11356
- C:\Windows\System\udnbTFE.exe
  C:\Windows\System\udnbTFE.exe
  2⤵
  PID:11380
- C:\Windows\System\iVcMjzz.exe
  C:\Windows\System\iVcMjzz.exe
  2⤵
  PID:11400
- C:\Windows\System\wXBflQl.exe
  C:\Windows\System\wXBflQl.exe
  2⤵
  PID:11420
- C:\Windows\System\vqIpnnb.exe
  C:\Windows\System\vqIpnnb.exe
  2⤵
  PID:11440
- C:\Windows\System\cHmFhcK.exe
  C:\Windows\System\cHmFhcK.exe
  2⤵
  PID:11456
- C:\Windows\System\HymZOgQ.exe
  C:\Windows\System\HymZOgQ.exe
  2⤵
  PID:11488
- C:\Windows\System\JnjinzI.exe
  C:\Windows\System\JnjinzI.exe
  2⤵
  PID:11520
- C:\Windows\System\jhZDbsZ.exe
  C:\Windows\System\jhZDbsZ.exe
  2⤵
  PID:11544
- C:\Windows\System\VHwLBgM.exe
  C:\Windows\System\VHwLBgM.exe
  2⤵
  PID:11560
- C:\Windows\System\hjxGudk.exe
  C:\Windows\System\hjxGudk.exe
  2⤵
  PID:11576
- C:\Windows\System\ApgELvc.exe
  C:\Windows\System\ApgELvc.exe
  2⤵
  PID:11600
- C:\Windows\System\hWISsOQ.exe
  C:\Windows\System\hWISsOQ.exe
  2⤵
  PID:11624
- C:\Windows\System\cDEBRbl.exe
  C:\Windows\System\cDEBRbl.exe
  2⤵
  PID:11640
- C:\Windows\System\XWhnXXX.exe
  C:\Windows\System\XWhnXXX.exe
  2⤵
  PID:11664
- C:\Windows\System\nvseaSK.exe
  C:\Windows\System\nvseaSK.exe
  2⤵
  PID:11684
- C:\Windows\System\czTMtXQ.exe
  C:\Windows\System\czTMtXQ.exe
  2⤵
  PID:11700
- C:\Windows\System\ITzsIbJ.exe
  C:\Windows\System\ITzsIbJ.exe
  2⤵
  PID:11728
- C:\Windows\System\hhzUhoF.exe
  C:\Windows\System\hhzUhoF.exe
  2⤵
  PID:11748
- C:\Windows\System\WXNlQsj.exe
  C:\Windows\System\WXNlQsj.exe
  2⤵
  PID:11768
- C:\Windows\System\xQXsOEB.exe
  C:\Windows\System\xQXsOEB.exe
  2⤵
  PID:11800
- C:\Windows\System\LqGMsPT.exe
  C:\Windows\System\LqGMsPT.exe
  2⤵
  PID:11824
- C:\Windows\System\sUziXmK.exe
  C:\Windows\System\sUziXmK.exe
  2⤵
  PID:11844
- C:\Windows\System\hcxAKjT.exe
  C:\Windows\System\hcxAKjT.exe
  2⤵
  PID:11868
- C:\Windows\System\xrCwOMD.exe
  C:\Windows\System\xrCwOMD.exe
  2⤵
  PID:11892
- C:\Windows\System\iVCCSRZ.exe
  C:\Windows\System\iVCCSRZ.exe
  2⤵
  PID:11920
- C:\Windows\System\UjNEduu.exe
  C:\Windows\System\UjNEduu.exe
  2⤵
  PID:11948
- C:\Windows\System\pMlaMyi.exe
  C:\Windows\System\pMlaMyi.exe
  2⤵
  PID:11976
- C:\Windows\System\hvBSfSn.exe
  C:\Windows\System\hvBSfSn.exe
  2⤵
  PID:12004
- C:\Windows\System\FzEgYeT.exe
  C:\Windows\System\FzEgYeT.exe
  2⤵
  PID:12028
- C:\Windows\System\RigkCpw.exe
  C:\Windows\System\RigkCpw.exe
  2⤵
  PID:12052
- C:\Windows\System\wExZYFq.exe
  C:\Windows\System\wExZYFq.exe
  2⤵
  PID:12088
- C:\Windows\System\yvbOAOE.exe
  C:\Windows\System\yvbOAOE.exe
  2⤵
  PID:12112
- C:\Windows\System\CTwoYaB.exe
  C:\Windows\System\CTwoYaB.exe
  2⤵
  PID:12140
- C:\Windows\System\WrIrJJd.exe
  C:\Windows\System\WrIrJJd.exe
  2⤵
  PID:12160
- C:\Windows\System\wLSJxCP.exe
  C:\Windows\System\wLSJxCP.exe
  2⤵
  PID:12188
- C:\Windows\System\gCKucDX.exe
  C:\Windows\System\gCKucDX.exe
  2⤵
  PID:12212
- C:\Windows\System\HIIADUn.exe
  C:\Windows\System\HIIADUn.exe
  2⤵
  PID:12244
- C:\Windows\System\IYvcuVO.exe
  C:\Windows\System\IYvcuVO.exe
  2⤵
  PID:12268
- C:\Windows\System\WtRuMET.exe
  C:\Windows\System\WtRuMET.exe
  2⤵
  PID:10736
- C:\Windows\System\PNsurwg.exe
  C:\Windows\System\PNsurwg.exe
  2⤵
  PID:10728
- C:\Windows\System\EVtUHpU.exe
  C:\Windows\System\EVtUHpU.exe
  2⤵
  PID:11056
- C:\Windows\System\mjMXhnV.exe
  C:\Windows\System\mjMXhnV.exe
  2⤵
  PID:11312
- C:\Windows\System\vQoPYVS.exe
  C:\Windows\System\vQoPYVS.exe
  2⤵
  PID:11432
- C:\Windows\System\MdjffIP.exe
  C:\Windows\System\MdjffIP.exe
  2⤵
  PID:11296
- C:\Windows\System\vdVKyPs.exe
  C:\Windows\System\vdVKyPs.exe
  2⤵
  PID:11412
- C:\Windows\System\kduKrpE.exe
  C:\Windows\System\kduKrpE.exe
  2⤵
  PID:11352
- C:\Windows\System\UvxwzKE.exe
  C:\Windows\System\UvxwzKE.exe
  2⤵
  PID:11672
- C:\Windows\System\vHCXvqG.exe
  C:\Windows\System\vHCXvqG.exe
  2⤵
  PID:11592
- C:\Windows\System\wdpjcps.exe
  C:\Windows\System\wdpjcps.exe
  2⤵
  PID:11764
- C:\Windows\System\VjgkJRi.exe
  C:\Windows\System\VjgkJRi.exe
  2⤵
  PID:11852
- C:\Windows\System\SiuxuLx.exe
  C:\Windows\System\SiuxuLx.exe
  2⤵
  PID:11888
- C:\Windows\System\qWRQQOC.exe
  C:\Windows\System\qWRQQOC.exe
  2⤵
  PID:11636
- C:\Windows\System\JebiIfy.exe
  C:\Windows\System\JebiIfy.exe
  2⤵
  PID:12096
- C:\Windows\System\NSXnXxg.exe
  C:\Windows\System\NSXnXxg.exe
  2⤵
  PID:11908
- C:\Windows\System\ynTRHyO.exe
  C:\Windows\System\ynTRHyO.exe
  2⤵
  PID:12196
- C:\Windows\System\nWmGiMv.exe
  C:\Windows\System\nWmGiMv.exe
  2⤵
  PID:11992
- C:\Windows\System\wZPSpsN.exe
  C:\Windows\System\wZPSpsN.exe
  2⤵
  PID:12284
- C:\Windows\System\wshmgLI.exe
  C:\Windows\System\wshmgLI.exe
  2⤵
  PID:11840
- C:\Windows\System\rHEMlqQ.exe
  C:\Windows\System\rHEMlqQ.exe
  2⤵
  PID:12136
- C:\Windows\System\qvqVlnM.exe
  C:\Windows\System\qvqVlnM.exe
  2⤵
  PID:12200
- C:\Windows\System\RyAnoNl.exe
  C:\Windows\System\RyAnoNl.exe
  2⤵
  PID:12020
- C:\Windows\System\iTapfMq.exe
  C:\Windows\System\iTapfMq.exe
  2⤵
  PID:11292
- C:\Windows\System\WcGPhjl.exe
  C:\Windows\System\WcGPhjl.exe
  2⤵
  PID:11372
- C:\Windows\System\qrZdVmz.exe
  C:\Windows\System\qrZdVmz.exe
  2⤵
  PID:11508
- C:\Windows\System\xEOgqTv.exe
  C:\Windows\System\xEOgqTv.exe
  2⤵
  PID:12156
- C:\Windows\System\zABYlUJ.exe
  C:\Windows\System\zABYlUJ.exe
  2⤵
  PID:12316
- C:\Windows\System\hLSMvAj.exe
  C:\Windows\System\hLSMvAj.exe
  2⤵
  PID:12344
- C:\Windows\System\PMroSKL.exe
  C:\Windows\System\PMroSKL.exe
  2⤵
  PID:12380
- C:\Windows\System\jIebrHr.exe
  C:\Windows\System\jIebrHr.exe
  2⤵
  PID:12400
- C:\Windows\System\UnjZLqV.exe
  C:\Windows\System\UnjZLqV.exe
  2⤵
  PID:12440
- C:\Windows\System\hTwJkfP.exe
  C:\Windows\System\hTwJkfP.exe
  2⤵
  PID:12464
- C:\Windows\System\ClgVSLA.exe
  C:\Windows\System\ClgVSLA.exe
  2⤵
  PID:12492
- C:\Windows\System\EoWLjKH.exe
  C:\Windows\System\EoWLjKH.exe
  2⤵
  PID:12516
- C:\Windows\System\xNtQJoJ.exe
  C:\Windows\System\xNtQJoJ.exe
  2⤵
  PID:12544
- C:\Windows\System\UYbVvDs.exe
  C:\Windows\System\UYbVvDs.exe
  2⤵
  PID:12564
- C:\Windows\System\RMdswyN.exe
  C:\Windows\System\RMdswyN.exe
  2⤵
  PID:12592
- C:\Windows\System\aJAGbch.exe
  C:\Windows\System\aJAGbch.exe
  2⤵
  PID:12616
- C:\Windows\System\kGUlvZH.exe
  C:\Windows\System\kGUlvZH.exe
  2⤵
  PID:12648
- C:\Windows\System\ZoTHMHc.exe
  C:\Windows\System\ZoTHMHc.exe
  2⤵
  PID:12680
- C:\Windows\System\vvbwXmU.exe
  C:\Windows\System\vvbwXmU.exe
  2⤵
  PID:12708
- C:\Windows\System\dXpyudV.exe
  C:\Windows\System\dXpyudV.exe
  2⤵
  PID:12736
- C:\Windows\System\geOnVDW.exe
  C:\Windows\System\geOnVDW.exe
  2⤵
  PID:12764
- C:\Windows\System\FEBgBPF.exe
  C:\Windows\System\FEBgBPF.exe
  2⤵
  PID:12796
- C:\Windows\System\fDNjfmo.exe
  C:\Windows\System\fDNjfmo.exe
  2⤵
  PID:12824
- C:\Windows\System\KGtJvKi.exe
  C:\Windows\System\KGtJvKi.exe
  2⤵
  PID:12852
- C:\Windows\System\hjUYsdQ.exe
  C:\Windows\System\hjUYsdQ.exe
  2⤵
  PID:12872
- C:\Windows\System\kpycYWH.exe
  C:\Windows\System\kpycYWH.exe
  2⤵
  PID:12900
- C:\Windows\System\eewSMkV.exe
  C:\Windows\System\eewSMkV.exe
  2⤵
  PID:12924
- C:\Windows\System\qrmqVCL.exe
  C:\Windows\System\qrmqVCL.exe
  2⤵
  PID:12960
- C:\Windows\System\iZNOoYb.exe
  C:\Windows\System\iZNOoYb.exe
  2⤵
  PID:12988
- C:\Windows\System\YqoxzYr.exe
  C:\Windows\System\YqoxzYr.exe
  2⤵
  PID:13020
- C:\Windows\System\llXIgAe.exe
  C:\Windows\System\llXIgAe.exe
  2⤵
  PID:13052
- C:\Windows\System\jWcrLiQ.exe
  C:\Windows\System\jWcrLiQ.exe
  2⤵
  PID:13084
- C:\Windows\System\rRVjiSG.exe
  C:\Windows\System\rRVjiSG.exe
  2⤵
  PID:13108
- C:\Windows\System\DHqdorT.exe
  C:\Windows\System\DHqdorT.exe
  2⤵
  PID:13140
- C:\Windows\System\tBhVKCX.exe
  C:\Windows\System\tBhVKCX.exe
  2⤵
  PID:13168
- C:\Windows\System\rnHifSW.exe
  C:\Windows\System\rnHifSW.exe
  2⤵
  PID:13200
- C:\Windows\System\AmAQmoD.exe
  C:\Windows\System\AmAQmoD.exe
  2⤵
  PID:13240
- C:\Windows\System\DoUYLku.exe
  C:\Windows\System\DoUYLku.exe
  2⤵
  PID:13264
- C:\Windows\System\Vccskeb.exe
  C:\Windows\System\Vccskeb.exe
  2⤵
  PID:13288
- C:\Windows\System\dIaZpKT.exe
  C:\Windows\System\dIaZpKT.exe
  2⤵
  PID:13308
- C:\Windows\System\KAGjEfX.exe
  C:\Windows\System\KAGjEfX.exe
  2⤵
  PID:11864
- C:\Windows\System\PdyJEpS.exe
  C:\Windows\System\PdyJEpS.exe
  2⤵
  PID:10428
- C:\Windows\System\QdIFYcQ.exe
  C:\Windows\System\QdIFYcQ.exe
  2⤵
  PID:12300
- C:\Windows\System\XRRkiDK.exe
  C:\Windows\System\XRRkiDK.exe
  2⤵
  PID:12352
- C:\Windows\System\VfFgQWw.exe
  C:\Windows\System\VfFgQWw.exe
  2⤵
  PID:12432
- C:\Windows\System\MKRMFil.exe
  C:\Windows\System\MKRMFil.exe
  2⤵
  PID:12172
- C:\Windows\System\KIZKfbL.exe
  C:\Windows\System\KIZKfbL.exe
  2⤵
  PID:12560
- C:\Windows\System\uLEYOVV.exe
  C:\Windows\System\uLEYOVV.exe
  2⤵
  PID:11336
- C:\Windows\System\QSPiqKG.exe
  C:\Windows\System\QSPiqKG.exe
  2⤵
  PID:11692
- C:\Windows\System\CimUOfV.exe
  C:\Windows\System\CimUOfV.exe
  2⤵
  PID:11904
- C:\Windows\System\VFsZlQx.exe
  C:\Windows\System\VFsZlQx.exe
  2⤵
  PID:12604
- C:\Windows\System\AujnWth.exe
  C:\Windows\System\AujnWth.exe
  2⤵
  PID:12912
- C:\Windows\System\lVfrIRL.exe
  C:\Windows\System\lVfrIRL.exe
  2⤵
  PID:12460
- C:\Windows\System\bhvOThR.exe
  C:\Windows\System\bhvOThR.exe
  2⤵
  PID:13036
- C:\Windows\System\EgWjSYo.exe
  C:\Windows\System\EgWjSYo.exe
  2⤵
  PID:13068
- C:\Windows\System\wUHWftE.exe
  C:\Windows\System\wUHWftE.exe
  2⤵
  PID:13156
- C:\Windows\System\NIDZdYl.exe
  C:\Windows\System\NIDZdYl.exe
  2⤵
  PID:12892
- C:\Windows\System\nJsFGHD.exe
  C:\Windows\System\nJsFGHD.exe
  2⤵
  PID:13248
- C:\Windows\System\pEEwWNu.exe
  C:\Windows\System\pEEwWNu.exe
  2⤵
  PID:11268
- C:\Windows\System\BCaWeKb.exe
  C:\Windows\System\BCaWeKb.exe
  2⤵
  PID:11740
- C:\Windows\System\JouAjYc.exe
  C:\Windows\System\JouAjYc.exe
  2⤵
  PID:13252
- C:\Windows\System\WEmOycE.exe
  C:\Windows\System\WEmOycE.exe
  2⤵
  PID:12788
- C:\Windows\System\wplBhLK.exe
  C:\Windows\System\wplBhLK.exe
  2⤵
  PID:13032
- C:\Windows\System\PZMaNWg.exe
  C:\Windows\System\PZMaNWg.exe
  2⤵
  PID:13324
- C:\Windows\System\OMftaCW.exe
  C:\Windows\System\OMftaCW.exe
  2⤵
  PID:13356
- C:\Windows\System\FZZdxYY.exe
  C:\Windows\System\FZZdxYY.exe
  2⤵
  PID:13384
- C:\Windows\System\VzlqopU.exe
  C:\Windows\System\VzlqopU.exe
  2⤵
  PID:13404
- C:\Windows\System\EgGAQBW.exe
  C:\Windows\System\EgGAQBW.exe
  2⤵
  PID:13432
- C:\Windows\System\iCgFkAU.exe
  C:\Windows\System\iCgFkAU.exe
  2⤵
  PID:13456
- C:\Windows\System\auEUwMp.exe
  C:\Windows\System\auEUwMp.exe
  2⤵
  PID:13476
- C:\Windows\System\dhwhwWr.exe
  C:\Windows\System\dhwhwWr.exe
  2⤵
  PID:13492
- C:\Windows\System\BymjpAh.exe
  C:\Windows\System\BymjpAh.exe
  2⤵
  PID:13508
- C:\Windows\System\OiZLzAd.exe
  C:\Windows\System\OiZLzAd.exe
  2⤵
  PID:13532
- C:\Windows\System\nIzNONb.exe
  C:\Windows\System\nIzNONb.exe
  2⤵
  PID:13564
- C:\Windows\System\kVTQCXx.exe
  C:\Windows\System\kVTQCXx.exe
  2⤵
  PID:13584
- C:\Windows\System\IAIinVh.exe
  C:\Windows\System\IAIinVh.exe
  2⤵
  PID:13612
- C:\Windows\System\rMMoNpX.exe
  C:\Windows\System\rMMoNpX.exe
  2⤵
  PID:13644
- C:\Windows\System\BabIBgv.exe
  C:\Windows\System\BabIBgv.exe
  2⤵
  PID:13680
- C:\Windows\System\ZkbdfyX.exe
  C:\Windows\System\ZkbdfyX.exe
  2⤵
  PID:13708
- C:\Windows\System\bPHMiev.exe
  C:\Windows\System\bPHMiev.exe
  2⤵
  PID:13748
- C:\Windows\System\DoJmxnX.exe
  C:\Windows\System\DoJmxnX.exe
  2⤵
  PID:13772
- C:\Windows\System\yhWaDin.exe
  C:\Windows\System\yhWaDin.exe
  2⤵
  PID:13796
- C:\Windows\System\hyHuhQC.exe
  C:\Windows\System\hyHuhQC.exe
  2⤵
  PID:13824
- C:\Windows\System\bxYkDbs.exe
  C:\Windows\System\bxYkDbs.exe
  2⤵
  PID:13840
- C:\Windows\System\Rfswytd.exe
  C:\Windows\System\Rfswytd.exe
  2⤵
  PID:13860
- C:\Windows\System\VgzClba.exe
  C:\Windows\System\VgzClba.exe
  2⤵
  PID:13884
- C:\Windows\System\uQgKGFG.exe
  C:\Windows\System\uQgKGFG.exe
  2⤵
  PID:13904
- C:\Windows\System\NmCziED.exe
  C:\Windows\System\NmCziED.exe
  2⤵
  PID:13928
- C:\Windows\System\KJPdjMt.exe
  C:\Windows\System\KJPdjMt.exe
  2⤵
  PID:13948
- C:\Windows\System\ynDhagl.exe
  C:\Windows\System\ynDhagl.exe
  2⤵
  PID:13980
- C:\Windows\System\xBSVKSC.exe
  C:\Windows\System\xBSVKSC.exe
  2⤵
  PID:14032
- C:\Windows\System\jXjOzoQ.exe
  C:\Windows\System\jXjOzoQ.exe
  2⤵
  PID:13132
- C:\Windows\System\vgjyvwO.exe
  C:\Windows\System\vgjyvwO.exe
  2⤵
  PID:12484
- C:\Windows\System\IilwJlP.exe
  C:\Windows\System\IilwJlP.exe
  2⤵
  PID:12756
- C:\Windows\System\NQXZbnu.exe
  C:\Windows\System\NQXZbnu.exe
  2⤵
  PID:11812
- C:\Windows\System\XlgSeMH.exe
  C:\Windows\System\XlgSeMH.exe
  2⤵
  PID:12488
- C:\Windows\System\dSEkdiw.exe
  C:\Windows\System\dSEkdiw.exe
  2⤵
  PID:13228
- C:\Windows\System\MqjdUyV.exe
  C:\Windows\System\MqjdUyV.exe
  2⤵
  PID:11496
- C:\Windows\System\kmjkKMj.exe
  C:\Windows\System\kmjkKMj.exe
  2⤵
  PID:13276
- C:\Windows\System\ZUMAUaH.exe
  C:\Windows\System\ZUMAUaH.exe
  2⤵
  PID:13596
- C:\Windows\System\VwLtzRD.exe
  C:\Windows\System\VwLtzRD.exe
  2⤵
  PID:13652
- C:\Windows\System\LDztcWy.exe
  C:\Windows\System\LDztcWy.exe
  2⤵
  PID:13352
- C:\Windows\System\LfAtnCz.exe
  C:\Windows\System\LfAtnCz.exe
  2⤵
  PID:13380
- C:\Windows\System\PgkMfHU.exe
  C:\Windows\System\PgkMfHU.exe
  2⤵
  PID:13504
- C:\Windows\System\gBvdRtH.exe
  C:\Windows\System\gBvdRtH.exe
  2⤵
  PID:13572
- C:\Windows\System\qyllQgH.exe
  C:\Windows\System\qyllQgH.exe
  2⤵
  PID:13396
- C:\Windows\System\yxeBXiG.exe
  C:\Windows\System\yxeBXiG.exe
  2⤵
  PID:13452
- C:\Windows\System\oEbGMWs.exe
  C:\Windows\System\oEbGMWs.exe
  2⤵
  PID:13632
- C:\Windows\System\qURWEei.exe
  C:\Windows\System\qURWEei.exe
  2⤵
  PID:13696
- C:\Windows\System\EXsPMGJ.exe
  C:\Windows\System\EXsPMGJ.exe
  2⤵
  PID:13812
- C:\Windows\System\xVYxxla.exe
  C:\Windows\System\xVYxxla.exe
  2⤵
  PID:13900
- C:\Windows\System\QpXuQEo.exe
  C:\Windows\System\QpXuQEo.exe
  2⤵
  PID:13760
- C:\Windows\System\FIkpHWc.exe
  C:\Windows\System\FIkpHWc.exe
  2⤵
  PID:13936
- C:\Windows\System\eZLdlFT.exe
  C:\Windows\System\eZLdlFT.exe
  2⤵
  PID:12260
- C:\Windows\System\imRNQdu.exe
  C:\Windows\System\imRNQdu.exe
  2⤵
  PID:14000
- C:\Windows\System\wxrulFa.exe
  C:\Windows\System\wxrulFa.exe
  2⤵
  PID:13576
- C:\Windows\System\LqFhjHe.exe
  C:\Windows\System\LqFhjHe.exe
  2⤵
  PID:13104
- C:\Windows\System\euGpCnM.exe
  C:\Windows\System\euGpCnM.exe
  2⤵
  PID:13472
- C:\Windows\System\XQshWvf.exe
  C:\Windows\System\XQshWvf.exe
  2⤵
  PID:13556
- C:\Windows\System\aNzSOiX.exe
  C:\Windows\System\aNzSOiX.exe
  2⤵
  PID:9180
- C:\Windows\System\zRgaava.exe
  C:\Windows\System\zRgaava.exe
  2⤵
  PID:13784
- C:\Windows\System\COIvnxV.exe
  C:\Windows\System\COIvnxV.exe
  2⤵
  PID:14052
- C:\Windows\System\CzOMSkb.exe
  C:\Windows\System\CzOMSkb.exe
  2⤵
  PID:13808
- C:\Windows\System\axeGBTM.exe
  C:\Windows\System\axeGBTM.exe
  2⤵
  PID:14024
- C:\Windows\System\dZaSqfi.exe
  C:\Windows\System\dZaSqfi.exe
  2⤵
  PID:12176
- C:\Windows\System\KcVRBhk.exe
  C:\Windows\System\KcVRBhk.exe
  2⤵
  PID:12632
- C:\Windows\System\yGuYMXH.exe
  C:\Windows\System\yGuYMXH.exe
  2⤵
  PID:14348
- C:\Windows\System\lxwuSdo.exe
  C:\Windows\System\lxwuSdo.exe
  2⤵
  PID:14380
- C:\Windows\System\aKKUQRl.exe
  C:\Windows\System\aKKUQRl.exe
  2⤵
  PID:14408
- C:\Windows\System\lqgcBnl.exe
  C:\Windows\System\lqgcBnl.exe
  2⤵
  PID:14432
- C:\Windows\System\mXBkgOP.exe
  C:\Windows\System\mXBkgOP.exe
  2⤵
  PID:14456
- C:\Windows\System\VDznQcN.exe
  C:\Windows\System\VDznQcN.exe
  2⤵
  PID:14484
- C:\Windows\System\EYMsHGA.exe
  C:\Windows\System\EYMsHGA.exe
  2⤵
  PID:14516
- C:\Windows\System\RWYTswG.exe
  C:\Windows\System\RWYTswG.exe
  2⤵
  PID:14540
- C:\Windows\System\bkTOcKS.exe
  C:\Windows\System\bkTOcKS.exe
  2⤵
  PID:14560
- C:\Windows\System\ucJEUbN.exe
  C:\Windows\System\ucJEUbN.exe
  2⤵
  PID:14580
- C:\Windows\System\QjgEluJ.exe
  C:\Windows\System\QjgEluJ.exe
  2⤵
  PID:14604
- C:\Windows\System\osvepRs.exe
  C:\Windows\System\osvepRs.exe
  2⤵
  PID:14640
- C:\Windows\System\EJCNHWX.exe
  C:\Windows\System\EJCNHWX.exe
  2⤵
  PID:14668
- C:\Windows\System\JGJASbb.exe
  C:\Windows\System\JGJASbb.exe
  2⤵
  PID:14704
- C:\Windows\System\PWqkFZX.exe
  C:\Windows\System\PWqkFZX.exe
  2⤵
  PID:14732
- C:\Windows\System\aacfyNe.exe
  C:\Windows\System\aacfyNe.exe
  2⤵
  PID:14756
- C:\Windows\System\GOTOsbQ.exe
  C:\Windows\System\GOTOsbQ.exe
  2⤵
  PID:14776
- C:\Windows\System\aRaXqLv.exe
  C:\Windows\System\aRaXqLv.exe
  2⤵
  PID:14808
- C:\Windows\System\aoYfuGK.exe
  C:\Windows\System\aoYfuGK.exe
  2⤵
  PID:14832
- C:\Windows\System\JqBxiLY.exe
  C:\Windows\System\JqBxiLY.exe
  2⤵
  PID:14868
- C:\Windows\System\FyucMsJ.exe
  C:\Windows\System\FyucMsJ.exe
  2⤵
  PID:14904
- C:\Windows\System\OpJhyeH.exe
  C:\Windows\System\OpJhyeH.exe
  2⤵
  PID:14920
- C:\Windows\System\MxvdwIB.exe
  C:\Windows\System\MxvdwIB.exe
  2⤵
  PID:14936
- C:\Windows\System\FKebbnT.exe
  C:\Windows\System\FKebbnT.exe
  2⤵
  PID:14968
- C:\Windows\System\JLVrcod.exe
  C:\Windows\System\JLVrcod.exe
  2⤵
  PID:15004
- C:\Windows\System\aeoSyLx.exe
  C:\Windows\System\aeoSyLx.exe
  2⤵
  PID:15024
- C:\Windows\System\owXetUe.exe
  C:\Windows\System\owXetUe.exe
  2⤵
  PID:15052
- C:\Windows\System\bsvflHI.exe
  C:\Windows\System\bsvflHI.exe
  2⤵
  PID:15080
- C:\Windows\System\XsbJAbb.exe
  C:\Windows\System\XsbJAbb.exe
  2⤵
  PID:15104
- C:\Windows\System\taqlIRJ.exe
  C:\Windows\System\taqlIRJ.exe
  2⤵
  PID:15132
- C:\Windows\System\aLinuaX.exe
  C:\Windows\System\aLinuaX.exe
  2⤵
  PID:15160
- C:\Windows\System\ohWxtLz.exe
  C:\Windows\System\ohWxtLz.exe
  2⤵
  PID:15184
- C:\Windows\System\KSwVBto.exe
  C:\Windows\System\KSwVBto.exe
  2⤵
  PID:15208
- C:\Windows\System\WIsjagg.exe
  C:\Windows\System\WIsjagg.exe
  2⤵
  PID:15240
- C:\Windows\System\geEkyaF.exe
  C:\Windows\System\geEkyaF.exe
  2⤵
  PID:15260
- C:\Windows\System\EdsDIsM.exe
  C:\Windows\System\EdsDIsM.exe
  2⤵
  PID:15288
- C:\Windows\System\wgodecN.exe
  C:\Windows\System\wgodecN.exe
  2⤵
  PID:15324
- C:\Windows\System\IYqsYyA.exe
  C:\Windows\System\IYqsYyA.exe
  2⤵
  PID:15356
- C:\Windows\System\YSqQBEI.exe
  C:\Windows\System\YSqQBEI.exe
  2⤵
  PID:13856
- C:\Windows\System\QNMuDsh.exe
  C:\Windows\System\QNMuDsh.exe
  2⤵
  PID:12760
- C:\Windows\System\VRVtMqi.exe
  C:\Windows\System\VRVtMqi.exe
  2⤵
  PID:14344
- C:\Windows\System\GYODOlf.exe
  C:\Windows\System\GYODOlf.exe
  2⤵
  PID:14404
- C:\Windows\System\rZNaszj.exe
  C:\Windows\System\rZNaszj.exe
  2⤵
  PID:13528
- C:\Windows\System\BvVjpEG.exe
  C:\Windows\System\BvVjpEG.exe
  2⤵
  PID:14576
- C:\Windows\System\AFFCqxB.exe
  C:\Windows\System\AFFCqxB.exe
  2⤵
  PID:14596
- C:\Windows\System\RpOoYwW.exe
  C:\Windows\System\RpOoYwW.exe
  2⤵
  PID:13640
- C:\Windows\System\SwOmlVZ.exe
  C:\Windows\System\SwOmlVZ.exe
  2⤵
  PID:14804
- C:\Windows\System\iukVvrT.exe
  C:\Windows\System\iukVvrT.exe
  2⤵
  PID:14856
- C:\Windows\System\okFfVAU.exe
  C:\Windows\System\okFfVAU.exe
  2⤵
  PID:14424
- C:\Windows\System\sLaOSis.exe
  C:\Windows\System\sLaOSis.exe
  2⤵
  PID:14452
- C:\Windows\System\mdcUPLB.exe
  C:\Windows\System\mdcUPLB.exe
  2⤵
  PID:14948
- C:\Windows\System\lkvzENn.exe
  C:\Windows\System\lkvzENn.exe
  2⤵
  PID:14740
- C:\Windows\System\WQKXTgA.exe
  C:\Windows\System\WQKXTgA.exe
  2⤵
  PID:14772
- C:\Windows\System\sWRkElL.exe
  C:\Windows\System\sWRkElL.exe
  2⤵
  PID:14900
- C:\Windows\System\YHIfTsT.exe
  C:\Windows\System\YHIfTsT.exe
  2⤵
  PID:14960
- C:\Windows\System\UZWkYpf.exe
  C:\Windows\System\UZWkYpf.exe
  2⤵
  PID:15308
- C:\Windows\System\aaDCmyg.exe
  C:\Windows\System\aaDCmyg.exe
  2⤵
  PID:15096
- C:\Windows\System\uwSwHVR.exe
  C:\Windows\System\uwSwHVR.exe
  2⤵
  PID:15156
- C:\Windows\System\hXXBNyz.exe
  C:\Windows\System\hXXBNyz.exe
  2⤵
  PID:12700
- C:\Windows\System\kEhacax.exe
  C:\Windows\System\kEhacax.exe
  2⤵
  PID:14496
- C:\Windows\System\xCzcAKG.exe
  C:\Windows\System\xCzcAKG.exe
  2⤵
  PID:15252
- C:\Windows\System\IaPgfJM.exe
  C:\Windows\System\IaPgfJM.exe
  2⤵
  PID:14632
- C:\Windows\System\PWTauIx.exe
  C:\Windows\System\PWTauIx.exe
  2⤵
  PID:15368
- C:\Windows\System\PdyynLE.exe
  C:\Windows\System\PdyynLE.exe
  2⤵
  PID:15396
- C:\Windows\System\mpodJgH.exe
  C:\Windows\System\mpodJgH.exe
  2⤵
  PID:15412
- C:\Windows\System\JgPnBCZ.exe
  C:\Windows\System\JgPnBCZ.exe
  2⤵
  PID:15440
- C:\Windows\System\kWLOVnQ.exe
  C:\Windows\System\kWLOVnQ.exe
  2⤵
  PID:15456
- C:\Windows\System\ZzSZyED.exe
  C:\Windows\System\ZzSZyED.exe
  2⤵
  PID:15472
- C:\Windows\System\CmwQgOo.exe
  C:\Windows\System\CmwQgOo.exe
  2⤵
  PID:15496
- C:\Windows\System\GkqFfWc.exe
  C:\Windows\System\GkqFfWc.exe
  2⤵
  PID:15520
- C:\Windows\System\VvTHbeD.exe
  C:\Windows\System\VvTHbeD.exe
  2⤵
  PID:15556
- C:\Windows\System\gZeyTUv.exe
  C:\Windows\System\gZeyTUv.exe
  2⤵
  PID:15572
- C:\Windows\System\NgviLah.exe
  C:\Windows\System\NgviLah.exe
  2⤵
  PID:15588
- C:\Windows\System\RmduPkX.exe
  C:\Windows\System\RmduPkX.exe
  2⤵
  PID:15616
- C:\Windows\System\veaRmsJ.exe
  C:\Windows\System\veaRmsJ.exe
  2⤵
  PID:15652
- C:\Windows\System\wNCYMbU.exe
  C:\Windows\System\wNCYMbU.exe
  2⤵
  PID:15684
- C:\Windows\System\jxsjsfL.exe
  C:\Windows\System\jxsjsfL.exe
  2⤵
  PID:15708
- C:\Windows\System\WxjWAGR.exe
  C:\Windows\System\WxjWAGR.exe
  2⤵
  PID:15728
- C:\Windows\System\nNAOWax.exe
  C:\Windows\System\nNAOWax.exe
  2⤵
  PID:15764
- C:\Windows\System\EADlKex.exe
  C:\Windows\System\EADlKex.exe
  2⤵
  PID:15788
- C:\Windows\System\rGdJsUQ.exe
  C:\Windows\System\rGdJsUQ.exe
  2⤵
  PID:15816
- C:\Windows\System\vEwwOqw.exe
  C:\Windows\System\vEwwOqw.exe
  2⤵
  PID:15844
- C:\Windows\System\xyMPpwJ.exe
  C:\Windows\System\xyMPpwJ.exe
  2⤵
  PID:15868
- C:\Windows\System\sXDmuvv.exe
  C:\Windows\System\sXDmuvv.exe
  2⤵
  PID:15892
- C:\Windows\System\MidgsZS.exe
  C:\Windows\System\MidgsZS.exe
  2⤵
  PID:15916
- C:\Windows\System\tQvVvsl.exe
  C:\Windows\System\tQvVvsl.exe
  2⤵
  PID:15948
- C:\Windows\System\zisYOGq.exe
  C:\Windows\System\zisYOGq.exe
  2⤵
  PID:15972
- C:\Windows\System\WqXjcYU.exe
  C:\Windows\System\WqXjcYU.exe
  2⤵
  PID:15992
- C:\Windows\System\oBzsgWa.exe
  C:\Windows\System\oBzsgWa.exe
  2⤵
  PID:16012
- C:\Windows\System\GOBbvpd.exe
  C:\Windows\System\GOBbvpd.exe
  2⤵
  PID:16044
- C:\Windows\System\OGcRFrD.exe
  C:\Windows\System\OGcRFrD.exe
  2⤵
  PID:16076
- C:\Windows\System\OSgjExx.exe
  C:\Windows\System\OSgjExx.exe
  2⤵
  PID:16104
- C:\Windows\System\fDJacFn.exe
  C:\Windows\System\fDJacFn.exe
  2⤵
  PID:16136
- C:\Windows\System\sSCPnPe.exe
  C:\Windows\System\sSCPnPe.exe
  2⤵
  PID:16152
- C:\Windows\System\MRUxuWp.exe
  C:\Windows\System\MRUxuWp.exe
  2⤵
  PID:16176
- C:\Windows\System\tpWuVhy.exe
  C:\Windows\System\tpWuVhy.exe
  2⤵
  PID:16196
- C:\Windows\System\oKswtMv.exe
  C:\Windows\System\oKswtMv.exe
  2⤵
  PID:16228
- C:\Windows\System\jonAmHj.exe
  C:\Windows\System\jonAmHj.exe
  2⤵
  PID:16252
- C:\Windows\System\sgFYOrO.exe
  C:\Windows\System\sgFYOrO.exe
  2⤵
  PID:16272
- C:\Windows\System\nQUihsq.exe
  C:\Windows\System\nQUihsq.exe
  2⤵
  PID:16296
- C:\Windows\System\AKtTHPk.exe
  C:\Windows\System\AKtTHPk.exe
  2⤵
  PID:16344
- C:\Windows\System\zWOQCbs.exe
  C:\Windows\System\zWOQCbs.exe
  2⤵
  PID:16376
- C:\Windows\System\OpZYzxP.exe
  C:\Windows\System\OpZYzxP.exe
  2⤵
  PID:15196
- C:\Windows\System\pBLeYzE.exe
  C:\Windows\System\pBLeYzE.exe
  2⤵
  PID:14360
- C:\Windows\System\QpIxZik.exe
  C:\Windows\System\QpIxZik.exe
  2⤵
  PID:13372
- C:\Windows\System\RgCoqhv.exe
  C:\Windows\System\RgCoqhv.exe
  2⤵
  PID:14716
- C:\Windows\System\qAeaCaf.exe
  C:\Windows\System\qAeaCaf.exe
  2⤵
  PID:14988
- C:\Windows\System\mUjyyEm.exe
  C:\Windows\System\mUjyyEm.exe
  2⤵
  PID:15388
- C:\Windows\System\gJDExLy.exe
  C:\Windows\System\gJDExLy.exe
  2⤵
  PID:15464
- C:\Windows\System\GcbljXk.exe
  C:\Windows\System\GcbljXk.exe
  2⤵
  PID:15076
- C:\Windows\System\dlSyaNR.exe
  C:\Windows\System\dlSyaNR.exe
  2⤵
  PID:15596
- C:\Windows\System\cwuTjIe.exe
  C:\Windows\System\cwuTjIe.exe
  2⤵
  PID:15624
- C:\Windows\System\EhbsBiP.exe
  C:\Windows\System\EhbsBiP.exe
  2⤵
  PID:15648
- C:\Windows\System\XGMrcmm.exe
  C:\Windows\System\XGMrcmm.exe
  2⤵
  PID:14428
- C:\Windows\System\vBVdijC.exe
  C:\Windows\System\vBVdijC.exe
  2⤵
  PID:15452
- C:\Windows\System\OnImJUl.exe
  C:\Windows\System\OnImJUl.exe
  2⤵
  PID:15908
- C:\Windows\System\ouXtXtP.exe
  C:\Windows\System\ouXtXtP.exe
  2⤵
  PID:15172
- C:\Windows\System\WywSpeP.exe
  C:\Windows\System\WywSpeP.exe
  2⤵
  PID:16036
- C:\Windows\System\sRZegSy.exe
  C:\Windows\System\sRZegSy.exe
  2⤵
  PID:15680
- C:\Windows\System\ACQVUvi.exe
  C:\Windows\System\ACQVUvi.exe
  2⤵
  PID:16168
- C:\Windows\System\yzlKPxS.exe
  C:\Windows\System\yzlKPxS.exe
  2⤵
  PID:16264
- C:\Windows\System\hCZTjxc.exe
  C:\Windows\System\hCZTjxc.exe
  2⤵
  PID:15880
- C:\Windows\System\nwDYfRk.exe
  C:\Windows\System\nwDYfRk.exe
  2⤵
  PID:15964
- C:\Windows\System\BeoCBYL.exe
  C:\Windows\System\BeoCBYL.exe
  2⤵
  PID:16368
- C:\Windows\System\qSkaBZe.exe
  C:\Windows\System\qSkaBZe.exe
  2⤵
  PID:15216
- C:\Windows\System\fFHuMrF.exe
  C:\Windows\System\fFHuMrF.exe
  2⤵
  PID:16408
- C:\Windows\System\tCLeiDC.exe
  C:\Windows\System\tCLeiDC.exe
  2⤵
  PID:16432
- C:\Windows\System\wNwWXdz.exe
  C:\Windows\System\wNwWXdz.exe
  2⤵
  PID:16456
- C:\Windows\System\SWYSJVX.exe
  C:\Windows\System\SWYSJVX.exe
  2⤵
  PID:16480
- C:\Windows\System\sTambyp.exe
  C:\Windows\System\sTambyp.exe
  2⤵
  PID:16508
- C:\Windows\System\uROPYqL.exe
  C:\Windows\System\uROPYqL.exe
  2⤵
  PID:16528
- C:\Windows\System\rUsiLfD.exe
  C:\Windows\System\rUsiLfD.exe
  2⤵
  PID:16556
- C:\Windows\System\BmmkJHa.exe
  C:\Windows\System\BmmkJHa.exe
  2⤵
  PID:16584
- C:\Windows\System\fXvydkC.exe
  C:\Windows\System\fXvydkC.exe
  2⤵
  PID:16604
- C:\Windows\System\YFZMAUj.exe
  C:\Windows\System\YFZMAUj.exe
  2⤵
  PID:16620
- C:\Windows\System\HhZLMID.exe
  C:\Windows\System\HhZLMID.exe
  2⤵
  PID:16648
- C:\Windows\System\gvlFlej.exe
  C:\Windows\System\gvlFlej.exe
  2⤵
  PID:16672
- C:\Windows\System\XFvJHMm.exe
  C:\Windows\System\XFvJHMm.exe
  2⤵
  PID:16700
- C:\Windows\System\bDBtZnA.exe
  C:\Windows\System\bDBtZnA.exe
  2⤵
  PID:16728
- C:\Windows\System\imNDojp.exe
  C:\Windows\System\imNDojp.exe
  2⤵
  PID:16756
- C:\Windows\System\oFyOWOV.exe
  C:\Windows\System\oFyOWOV.exe
  2⤵
  PID:16784
- C:\Windows\System\UrPucRm.exe
  C:\Windows\System\UrPucRm.exe
  2⤵
  PID:16820
- C:\Windows\System\FMKdkWY.exe
  C:\Windows\System\FMKdkWY.exe
  2⤵
  PID:16856
- C:\Windows\System\KMAqwDT.exe
  C:\Windows\System\KMAqwDT.exe
  2⤵
  PID:16876
- C:\Windows\System\RZwkHMY.exe
  C:\Windows\System\RZwkHMY.exe
  2⤵
  PID:16892
- C:\Windows\System\oquNPXW.exe
  C:\Windows\System\oquNPXW.exe
  2⤵
  PID:16916
- C:\Windows\System\JOmGLnr.exe
  C:\Windows\System\JOmGLnr.exe
  2⤵
  PID:16944
- C:\Windows\System\wQVvHxc.exe
  C:\Windows\System\wQVvHxc.exe
  2⤵
  PID:16960
- C:\Windows\System\xmsJElI.exe
  C:\Windows\System\xmsJElI.exe
  2⤵
  PID:16988
- C:\Windows\System\IMEQsKH.exe
  C:\Windows\System\IMEQsKH.exe
  2⤵
  PID:17004
- C:\Windows\System\EsiIdmG.exe
  C:\Windows\System\EsiIdmG.exe
  2⤵
  PID:17028
- C:\Windows\System\kdCyook.exe
  C:\Windows\System\kdCyook.exe
  2⤵
  PID:17048
- C:\Windows\System\hoEgDaY.exe
  C:\Windows\System\hoEgDaY.exe
  2⤵
  PID:17076
- C:\Windows\System\seaIMhv.exe
  C:\Windows\System\seaIMhv.exe
  2⤵
  PID:17104
- C:\Windows\System\lRAHwSX.exe
  C:\Windows\System\lRAHwSX.exe
  2⤵
  PID:17136
- C:\Windows\System\tgFydns.exe
  C:\Windows\System\tgFydns.exe
  2⤵
  PID:15828
- C:\Windows\System\YmhnLJT.exe
  C:\Windows\System\YmhnLJT.exe
  2⤵
  PID:16236
- C:\Windows\System\RJORmYw.exe
  C:\Windows\System\RJORmYw.exe
  2⤵
  PID:16500
- C:\Windows\System\fVlSKOX.exe
  C:\Windows\System\fVlSKOX.exe
  2⤵
  PID:16496
- C:\Windows\System\KvvYHhm.exe
  C:\Windows\System\KvvYHhm.exe
  2⤵
  PID:17220
- C:\Windows\System\BcptQsC.exe
  C:\Windows\System\BcptQsC.exe
  2⤵
  PID:16592
- C:\Windows\System\ahOvoKD.exe
  C:\Windows\System\ahOvoKD.exe
  2⤵
  PID:16668
- C:\Windows\System\PakAkca.exe
  C:\Windows\System\PakAkca.exe
  2⤵
  PID:16712
- C:\Windows\System\MTuDHVB.exe
  C:\Windows\System\MTuDHVB.exe
  2⤵
  PID:16908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AsNiUHp.exe

Filesize
1.1MB

MD5
9a945b9d6c28c98452708ae30afe54c2

SHA1
fdbbde359df02e335b7ef435fbd7ea3e62494e72

SHA256
a38aceb58f120ec0f95c4e4cc90680615960bd1befd358aa2667387972442421

SHA512
a7985699c0cbb929932bc9ef1dc47a64a650902728088b7a6128618390e0a74532d765dd44e2dfacbbd56e666009d8f9619e49f87a54493f02ca6e636413c115

Download Submit
C:\Windows\System\AvnJFAG.exe

Filesize
1.1MB

MD5
e3864b807a3297688d02c266f7e4926a

SHA1
45b2f238379d1b66d3603634db629bb8cd0c29e3

SHA256
67ed7e5ab4f5b4513032de6df80c138181d6a261269eac70e365613622263501

SHA512
9854e2d4673a67340cd23ab8ee24d7269d8625823fea92a78cb443d4e5d84c675e1bcc8927a03a087a4996485fdd1f4b56781504a8caef4c88058b3db9cde244

Download Submit
C:\Windows\System\CgIgKVj.exe

Filesize
1.1MB

MD5
899ed61bff665adc1c546e08f4f51038

SHA1
035b88843d611882c95ebfe1c32c2eb045f674dc

SHA256
ad412b3ffd7ed6847d09f3c1dbb3c2c4dce4cce068b3d1270a56a495fb83a9ed

SHA512
f84a8c5bc3b04a777b5463006d33d97d0a7eb161ee2d2c4e6e2f799586b860006e75820b7442f09c8a7e8cada0f43de668d247f17c0d7919a6bedb8d7e80416b

Download Submit
C:\Windows\System\ECOGXEF.exe

Filesize
1.1MB

MD5
114a79343e0a53fd0c54c679e74284a1

SHA1
c80fb104ace714bb4825736a4e54c31b18b433cb

SHA256
9121b7f704d1dcf825cb695c333fab482e7e3f0389ac769fd66c65caf8d2eb47

SHA512
daccca05f693d6b42d475baf956ccbfd4c767dcf57cec388576d65a32734547bf3c9984a36b0f5f5bac5efba445bd8b03d8db04c830a1f365150470f22395a88

Download Submit
C:\Windows\System\FIBOEPn.exe

Filesize
1.1MB

MD5
c867dde6f986aea73498b9c51fc918c6

SHA1
8ee45dc33ca40e26e8bad9f4c269533852aac7f2

SHA256
6eabe8631de7fba2749f3ea132b847677abbc874ebb8eea1397fb7b4310ff2f3

SHA512
f1a25ceb8c1bd8f6ab7c152e2e8bca0f68087726c279ff6d20228683ddaa9d5a08d8f5c5cab5f8f1142ce275693235ad496e46c4bc098057830fd9c551c7626c

Download Submit
C:\Windows\System\HUCGnWr.exe

Filesize
1.1MB

MD5
9a8a6c742dec4bde81cceae9beccfd56

SHA1
917487a7c4b3b2f034f3f850f99b3a1e553f8319

SHA256
0dd3fcae27921f9a2ffefb4b92f894ecb2a27e7b5c1d000c3a847747d2204257

SHA512
9d4991863e141d5eb6949b958dc99024860b7d11c140cdc7712bc4cfa0d19d5047cfe4e1aa8bf2994cc1fec39133838db441582a2eb9595a88b576906dc34224

Download Submit
C:\Windows\System\HhhsiyU.exe

Filesize
1.1MB

MD5
2edacdfe75a28942d47d3f5ecc1bea33

SHA1
d564b62bd7bf20a90df231ef9cad9f5cacce82e3

SHA256
9d19f0c62e9143de93da6304a21c086dc6933d0c36dd21a7867f51784b80da7a

SHA512
9553b7b092e146c95198b95e1c492d4ee3e931f15f9e78927255781b1f37ed2783a5673d095ce7366a905eac1a5f48727d58145e2e684cc8de7ab8cf8c3bc7c8

Download Submit
C:\Windows\System\Ivhrtyd.exe

Filesize
1.1MB

MD5
6243754400866c8829129a4b8bd94e0b

SHA1
8dce4591f9aaa96e38ef3ba79ebcda9aa1156866

SHA256
78083e174e358bdc16ee27a68e71d041c3a3e65221989a941d0ac072b883f31f

SHA512
37f4f649080827cfb50572775d8d814d8a3441a1848d2d1dadfe457dc018cb2de2e956af583720b32c451f6508c941337b6ff0671542864a9b9820cf87e9aba9

Download Submit
C:\Windows\System\PrAHJcO.exe

Filesize
1.1MB

MD5
043a8cdb89231b17905efe420ad751ac

SHA1
569cbc567a4f581261a7fb66979bdbaee31ed78d

SHA256
fc11e9d89094372d374d0942401f0b5c1b80ae7105f0cb459c8bf22c102b75bf

SHA512
c25237acc641a42e254bcef2ba2520a0c2b12a03df796fc0e963e03d9b08ca800962bcebe2fb9a8ad266decbf23f9e762f0ff684a6abc1e4a5fdd51f3967c4a0

Download Submit
C:\Windows\System\QSPoePr.exe

Filesize
1.1MB

MD5
28725e94b7368a6ee0a8bc064999b7cf

SHA1
5724d3f94c3095f0b08d6e813dd8d1ad41c2cc7d

SHA256
d7104d2b0d0ce68b065e5404711b7182aab14d1b38080e6c020aee0f65b9f466

SHA512
830599edc16b8e7696fea9beaff3eca7ca1df43fe8570b5e3ace8a8d8af5d98d6087aaffab57561ffbd502c1fc83062f27f57418e67cec16d39d7003cf2677d4

Download Submit
C:\Windows\System\QrnCfzA.exe

Filesize
1.1MB

MD5
f69df283b9c98455040a62ef852ea14c

SHA1
6aefbde795cd8d23f6bfed525b02d5eef1a40f37

SHA256
a92e4c27415a11037102d2b316256ca3f87fd341369c31d1c679d3b03ff2798b

SHA512
5d1040ab1fac499607ccf633642af5e208ef0db2c5871ccf475fd1f30dd8a71d7ff5759b65375e47845a12c7e7e67c2b5c6bdc0b9ceb5c043672c69a66920f74

Download Submit
C:\Windows\System\TmGzQxQ.exe

Filesize
1.1MB

MD5
14ca4d070d23df14751875d10df8eb9f

SHA1
5b559e812dea2f9b607a9caaa2dac0ae7d950c22

SHA256
927f2382716be4d6858585b6126cdb1557259c9444d0bc12bce49fc624febb2b

SHA512
89641ac178400fc6a15f1d9744047d5b50045cbc2d06ecc69f52e8b0ca7039c6324f68dceb8012303a7a0a11a2503b29db643402edbec34fcfffe0bd723bb595

Download Submit
C:\Windows\System\WlBgwtG.exe

Filesize
1.1MB

MD5
c5c1e53a9d8baa6d6fdbe166620d6928

SHA1
09cd72cb6b52494ad86f751e11f6fca7f2c502f8

SHA256
62924abf29692a059ff742fceed0833d20c51a3e3329b41f521c9e303e2fcfe1

SHA512
e18bd56a5d55c817617f04f34d3676628c345b339556556b8d9aca81b9c2aa8b32b0c2bd6a1edcb78ba0e21d053b446b460eabba28f1dac7316cbb9a0e603be3

Download Submit
C:\Windows\System\aARoXsz.exe

Filesize
1.1MB

MD5
d2f47bb2fb875bf3708256d404a6fb71

SHA1
f8767cf2bce714e985fc884bd667f382611a6327

SHA256
f7dc88f490a00bdd5872cd387905aa5c1439fb2eb379b749feb18f1706153524

SHA512
8efc74da571c925970ed91ced4cc0189220620d1af0525cc2ca377e4317d163bcc96f8521e508a5855a2fe51a7aba9c9f2361fe1f5b57a53212e1fac6a43e850

Download Submit
C:\Windows\System\aRvZlsU.exe

Filesize
1.1MB

MD5
5c3a4dc54db3e0b3c8e570e817a75e8b

SHA1
56ee282fb2d26e4fdcc28badbd44460a03e84c1c

SHA256
a27b9497c4a9fd64b16679a4a76ed79bf3cfceee885fe08ca6dc520d968c80ad

SHA512
4ef99aa2ff3125d5673c386f4c9654072dc6f9d632a1d1d7f9cc47b04c71ab1936ba29b7a5d44752a0bbc769b206c203ce93f3e65a9a4c2bf026cb86d077f4fc

Download Submit
C:\Windows\System\agaObKU.exe

Filesize
1.1MB

MD5
8862c2659bba7612434901fd4129fbe6

SHA1
9e63972acfb8ed1e103cee231eb250009d0afc6c

SHA256
18d3b7a13c9e77077bfcc10050d42b20669264dde5190c148d11a138fdb31563

SHA512
49139d90870d769758b7dc174f7ab61ea38ac5189901ce83aea6e60938e5ff29d6f2afb0720c3f99f35e742933a40871d4408413983eab524f6cc16130f1fb8d

Download Submit
C:\Windows\System\bFfxdIj.exe

Filesize
1.1MB

MD5
2f0814743f093ef859da5f385b750a00

SHA1
24574d6f64fab5a4a4ef57414872bdb5c56dfbab

SHA256
433835375cf8acf68d9f363f4218b59346dbfb77ee04ecd9a267c6a1fe6ee4eb

SHA512
9479bcbe71c1f55aac9d2ff414a39b8da0326fc921eaf3fbad5f92c92a89a7ddf49b03385537a542b24abd6a85166087e88cb0f418e23694ca73dd7767db2b0c

Download Submit
C:\Windows\System\dZCUpOy.exe

Filesize
1.1MB

MD5
747f73e557c76faa4f3b96af705c1246

SHA1
9187fdf1c9c817067193041dd46325a853fedb63

SHA256
1c4e7aa4573f47cf89b2fb8ef442d4e79787b29414eb1e9987f507795883d845

SHA512
593c90a2ec94f136222bce1c2105351e3594a842be2e3a0765bec24b72ebb8d287f82586bc3fa6f78d32b5dcf02df2b26ff8a9db1a94586d8740ec9e5788eff8

Download Submit
C:\Windows\System\eQoRDzC.exe

Filesize
1.1MB

MD5
b01d0cbd5ceebd5a1d9c96e5bf65ee54

SHA1
d9e4c557f7717cbcd3227c514734a2eab73d70b9

SHA256
0f1126718c4cd40681a610cda45df9cbef19394deab25f03472939d7abee9641

SHA512
ba7325c763d9da9a0211ff3e2820db78da63e96fe5c2637733e6ca3e8d48ad7da9db13d3d8fb9b37f6f91b09cc14200cc12d0488cf43678f9e497a69380d8bcc

Download Submit
C:\Windows\System\fiCKUdk.exe

Filesize
1.1MB

MD5
e744403568609a7d2feae3193faee285

SHA1
74f1908537e4c47c38a4a1c78741cab2b79afbd2

SHA256
827c8bf20dcef6d559663669f250e681d71f98401365174bb96b5cb6639d35ee

SHA512
251a9fc29472db98474da05fc6dd59decd2eccf9dd353b1ed7fc848335eaf62ab33ca841cef046a0a91c3d4dbc416dbc4eace8132a542e8b0e6eff4c70d2d893

Download Submit
C:\Windows\System\jEdWqHO.exe

Filesize
1.1MB

MD5
4b906d0e9397a595f12d5270f4ae829c

SHA1
8eee37905854949cdf59b85e97e253f57897efa7

SHA256
713270ae9686681814ca880724221241eb12789c3b02dacaf76326f8917833c7

SHA512
09f4875f710c9f6c9207f814f4d632fa2f01494fd03ec637abe08adcece672d759b2c0d52cf89d54eee88834419e41af857ce59e6a6edea63b49c036a55945c2

Download Submit
C:\Windows\System\mLXeACk.exe

Filesize
1.1MB

MD5
9fad8520890a78a552c1963fde2fdb68

SHA1
03220efca23bf1bc3aaff940fa854d0503c63dc9

SHA256
ad497ec92cc94f4614c7122a7d754ded5a5cc6d7ed78acdb0ca7642d2eb22791

SHA512
69acab859444d4737ac19a7d759461146df5a80c2e218d1b3072610a96f2d9b6e69a3ee513075d42456e20fbb4555fbe8388cf03ed1761279c3a73a1e80d2f55

Download Submit
C:\Windows\System\nTDXmMG.exe

Filesize
1.1MB

MD5
bfd5076fadec437d851206c932ed48af

SHA1
c694abd4ce76218b4ea5993e768531d3d89bccb4

SHA256
f18e96b789de73636564ea1af74b0ab9f19209d89462fdba2cbf2c417ed38f39

SHA512
59e900732859d0405298afbd299c78a27584fbaf6915ef3a5c6164b49593721a1b346d7d1581f2ef34ebbb899e039fac4e6e10dd856c515ac22a2ea9eed5f1bd

Download Submit
C:\Windows\System\nUmCSJC.exe

Filesize
1.1MB

MD5
d2f0bbae7911d1dd2f7d089788c2e275

SHA1
ff15ce02212c47cb506cd064e6a1a14e98a761ff

SHA256
70a71e8b2fa490845a88763df4f247bd549022178b2c85fa0261a79f28039e7f

SHA512
1aabef7c17e334d4c57e552d9fd4c71b9acd7267e60cc2302bbe444afa5ae18c07540ab701e85198e561bb75314cc059824f5d45edbcd40df20d9e6dc17edc19

Download Submit
C:\Windows\System\pIggosk.exe

Filesize
1.1MB

MD5
38c8bffebcc00057e9311397d2ec2c42

SHA1
ed11ca0e2df1027741d5c179c088fcad3329992c

SHA256
4e11390319f699968be7388b3e0e0208e2d33b89488b4816877c0b0bb0f39aaf

SHA512
4ba8ba04ebecec4f0deb6362f9993fb81c0de58aba4dc3ed46268d92c59eeaf9511be5a4f0cfa9bccabaee4b33c7142deada3a786c3905414486aa3d79d26e87

Download Submit
C:\Windows\System\pqCPjJx.exe

Filesize
1.1MB

MD5
7b45725696e6c740396f9dbfbb587ca9

SHA1
7ed69f110fc711ce8aeaddc8d36c04960db1d78a

SHA256
472d6502fb786d78301faacef89ad533dfb3e49d83ee00516d7dba8fb2ba0c54

SHA512
cd4bf6ae841f4d296171b20f566afe71685b7ba44cd437cdb2cbc6833c30abe6e15d2e5fc88f83b915e4a57af4ebc2653e66f09d22b536a1e074ec8c78e102d8

Download Submit
C:\Windows\System\pxskOGt.exe

Filesize
1.1MB

MD5
e77368f6f6df89fe697e5c1aafffa475

SHA1
4577e355ccf9b9212544beaf6fd00650c0a42516

SHA256
68088d08f10de9abc817afdcd738da90010b992963e34ceeecc8ce50e1498805

SHA512
e7698094732104a18e0e0d3a5f25df443389475cd27eafca2f8a4876d59da049a62209f8169d3b811e76207f523917a56195fa09df0c5c388560662dcb579c13

Download Submit
C:\Windows\System\smYtRXu.exe

Filesize
1.1MB

MD5
fb2dbdc3e6fbe92b891ffd849849d9f7

SHA1
c8089521eea09da0784895512d81598ed5218054

SHA256
74014daafd2a49350a8867e1b2e07b6dd7acc2910c02f7e5544473409b0d60de

SHA512
317c8f80d43450eef871cc03d93729b58d3b91869b5d7357da60bc3c23080caab15251156472efedce69164a63f95e4b6d655ab8e5fedc24879c1a6a3f4fe611

Download Submit
C:\Windows\System\twpkyfo.exe

Filesize
1.1MB

MD5
6da2990b4be541bbd5299398c4b4a9b6

SHA1
cba69faff1a585b534456417f3ab27828bf1e8fc

SHA256
5ce3a56a75d689e097f2a423e16ed174aa2b6295132c9844bdbeb3ea931428d4

SHA512
cc7063244bdace81962ff99ff3466fd7d47776ff99c7f40d5c850ceb0ef407e4ce8a0746b2c1c8b87a892d7b575369a1d01689d42d1b237b8268dbb9221aa855

Download Submit
C:\Windows\System\uUePXsp.exe

Filesize
1.1MB

MD5
5ea590ca7dc98279a1655cf565994e39

SHA1
fc0b1231278a8acd799bc22751c012e807314d75

SHA256
77c9282a146759bf215c635abf11619119906a37d8d2d2b591c735bb9d5f85ef

SHA512
70e25e418124542286c28cac9943295eb980ff86689fd535337ce3ae085ba257eab1a3972c80667d24b764e650b03df605308601c15d37e6575bdd284cd900a8

Download Submit
C:\Windows\System\vSKnlFd.exe

Filesize
1.1MB

MD5
cdb9c000c215750b7d900523ced13398

SHA1
9ddd5f7dc3882c7ad8b400b0369e976dc9241b2b

SHA256
40c61a352066980cb0b95b0ca0492c967d7e45bc3943d812c5556b15d23596fa

SHA512
ae5a4f02abbcfee754a3f96ba640d2f941e830487e153a0dc08cc2be1072c727699b2227f3587af610f0af36336ddbfa9e1e602a0deb5307d6337c2aa6fda80b

Download Submit
C:\Windows\System\wLoNmAZ.exe

Filesize
1.1MB

MD5
1f918aa14dc3b9695dc8de1c1882c849

SHA1
b0b02dcafb977e9077cc4779936d539b9f3a2ed2

SHA256
d6b68fdb58b9bc6f35f5dfa727a50b067080e012f2ca5c0dc0aa80d87e6f0a3f

SHA512
e1cf3ef691e4b4666ae97ff5268cd6143edf4f54004acf1323609484cbb34b48351d7d22200a15dcb962d9c409823bc75e94a3929c30b0abc61cc359947e4a06

Download Submit
C:\Windows\System\xtTWvIR.exe

Filesize
1.1MB

MD5
695ed6be621c207afc2942508dc4e40d

SHA1
fd934941ee48eb8ec5eeba6e405f916c63767a54

SHA256
f162ec11beda6be0b357b87ec949f156af9475ba90e90a1136c5ecc40806f064

SHA512
d9de31ac1516556051285e867dcb90bb202cca8dd1ed1594d0a9a848a6ad911f7f8750c2057babdde29e488176bc4a714e3dfd9bd9a794c3be1565bd9ed6f39a

Download Submit
C:\Windows\System\yybiTeo.exe

Filesize
1.1MB

MD5
c39bb66a5bace4f0c7db320d5cdedb20

SHA1
2281cdac339118296f1e77b2b0942fab2a7fec21

SHA256
7e0fa961ef609293c369fa219fc85fb8b043ecc1a57c637a59ce971db74315e8

SHA512
aaf6cf9ff3b44b52f1fa689d0297a432ce6c70e9822fd7ecce38b557824330e3ffb5cb25cb22428bf12b14497772de9158371c8269b17ab00908c1b3f66ef3c2

Download Submit
memory/1172-0-0x000001C756BF0000-0x000001C756C00000-memory.dmp

Filesize
64KB

Download