xmrig | 37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
Size

1.2MB
MD5

0bfae033e5af5900401c163a94673514
SHA1

a5ec49d9dabe7421942bde1b7156bf59fb95da75
SHA256

37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4
SHA512

6922fe04bab4a859dd8d54dbb86d35901c60e7359cacee3c95bd6bfbdddba53077625a8671310ff530cc22792f323a63b5aa0d1e96ad8b5532410ccfbdde13ad
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70Vwt6lq:GezaTF8FcNkNdfE0pZ9ozttwIRx2Vct

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000012102-2.dat	xmrig
behavioral1/files/0x00080000000174bf-13.dat	xmrig
behavioral1/files/0x0008000000017481-9.dat	xmrig
behavioral1/files/0x000600000001867d-29.dat	xmrig
behavioral1/files/0x00060000000186c8-35.dat	xmrig
behavioral1/files/0x000600000001878d-40.dat	xmrig
behavioral1/files/0x0005000000019c3a-54.dat	xmrig
behavioral1/files/0x0005000000019d44-69.dat	xmrig
behavioral1/files/0x000500000001a42d-125.dat	xmrig
behavioral1/files/0x000500000001a48c-150.dat	xmrig
behavioral1/files/0x000500000001a49a-159.dat	xmrig
behavioral1/files/0x000500000001a48e-154.dat	xmrig
behavioral1/files/0x000500000001a46a-144.dat	xmrig
behavioral1/files/0x000500000001a434-139.dat	xmrig
behavioral1/files/0x000500000001a42f-129.dat	xmrig
behavioral1/files/0x000500000001a431-133.dat	xmrig
behavioral1/files/0x000500000001a42b-119.dat	xmrig
behavioral1/files/0x000500000001a301-109.dat	xmrig
behavioral1/files/0x000500000001a345-114.dat	xmrig
behavioral1/files/0x000500000001a0a1-104.dat	xmrig
behavioral1/files/0x000500000001a07b-99.dat	xmrig
behavioral1/files/0x000500000001a067-94.dat	xmrig
behavioral1/files/0x0005000000019fb9-89.dat	xmrig
behavioral1/files/0x0005000000019f9f-84.dat	xmrig
behavioral1/files/0x0005000000019db8-79.dat	xmrig
behavioral1/files/0x0005000000019da4-74.dat	xmrig
behavioral1/files/0x0005000000019d20-64.dat	xmrig
behavioral1/files/0x0005000000019c53-59.dat	xmrig
behavioral1/files/0x0005000000019c38-50.dat	xmrig
behavioral1/files/0x00080000000190c9-44.dat	xmrig
behavioral1/files/0x0016000000018657-24.dat	xmrig
behavioral1/files/0x000800000001749c-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2052	oIKCAyY.exe
2508	OsWkwRV.exe
2488	qMybEvy.exe
2952	qDWqAvt.exe
2452	UMLQtPM.exe
2732	vdkRwnE.exe
2884	vaFOydb.exe
2736	XvZWUoG.exe
2864	rsOmXqd.exe
2700	IRhVxqK.exe
2784	rwyYWuJ.exe
2612	ATSAKgl.exe
2632	CTFvZRe.exe
2580	ZaKEZlp.exe
2656	DUchwId.exe
2204	skUQHWq.exe
2180	GUFAdhA.exe
2008	jBMOyOh.exe
956	chRgGSE.exe
1152	PfDOuaz.exe
1676	LOknTIn.exe
1996	hwTOhve.exe
1428	rqqkvLy.exe
1056	AkiOEEr.exe
2000	YsRXnXZ.exe
2164	RcsSwsd.exe
264	XFKDahp.exe
2944	AKJIyTr.exe
1720	pdlBiQk.exe
640	efUBSqj.exe
2568	DLenlzt.exe
2316	aUzTkkr.exe
1344	zWafmRl.exe
940	BeYMaoC.exe
1192	uuyAqoG.exe
1120	aQBTRBR.exe
1516	oufGdlt.exe
1988	zbxTXqF.exe
1672	xqJSGny.exe
908	GWWtmnH.exe
1532	eqwFWmZ.exe
976	QJWUTdW.exe
700	OTgFWhh.exe
3064	hwHrWvo.exe
1036	ewJkHdT.exe
788	GLtjSIH.exe
2124	GjINuNZ.exe
316	QeFggZI.exe
2268	mcigTmP.exe
2208	HhtsXzS.exe
904	ODNLJmG.exe
896	naCblzP.exe
548	dQxurRN.exe
1584	xDZriGz.exe
2064	HZIjhvL.exe
2104	LNTzOec.exe
2148	yhbXUDp.exe
484	ygZxJhp.exe
2300	XtccSOY.exe
2836	RGpkjeW.exe
2448	xroHYnM.exe
2964	zFVzHjb.exe
2752	hWxhVuQ.exe
2584	OmNIxFa.exe

Loads dropped DLL 64 IoCs

pid	Process
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dAgoxiZ.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\nsYJhAh.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\FcqMKTa.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\xdNHjpB.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\TFAuIFv.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ItImMBW.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\QcgbbYF.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\IVJrqMX.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\DKjdFNK.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\chRgGSE.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\gCZawZz.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\qHOtCgs.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\SUShtgj.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\MHnJHWg.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\hzxONNV.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\WskFBWY.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\pdNEexa.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ClxPajq.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\KRuvjaO.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\cIdXlaa.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\TfnACWZ.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\qRHIRxO.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\inHkUAp.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\wDjDufa.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\TVyCXob.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\NIodilH.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\lwYmOXK.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\vyiDVAc.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\qgVxmfT.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\IpYHYRg.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\IKEGxro.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\DMmFIwf.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\EJCease.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\kTdMTrk.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\JmGvJrX.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\JDCDipn.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\IrCuIrK.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\KGYnptL.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ayEijTj.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\wRzvgrl.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\dVxGYPs.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ILBNSiB.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\yhxhaIB.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\iAJIWcv.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\aUCCcQj.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\aHmCqsh.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ckMVWzH.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\PNqddHB.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\KeUjfQk.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\rUrvHjA.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\etCPyrD.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\THRlpBQ.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\WOZbidK.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ECETLEl.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\dzvROAU.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\jYESIvk.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\MHTRxah.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\ktbQaoM.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\uPTQuKG.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\qwxxANi.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\LeiHKvn.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\fhhDsCg.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\GEWkkdD.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
File created	C:\Windows\System\OMJVJPX.exe	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2052	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	31
PID 1788 wrote to memory of 2052	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	31
PID 1788 wrote to memory of 2052	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	31
PID 1788 wrote to memory of 2508	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	32
PID 1788 wrote to memory of 2508	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	32
PID 1788 wrote to memory of 2508	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	32
PID 1788 wrote to memory of 2488	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	33
PID 1788 wrote to memory of 2488	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	33
PID 1788 wrote to memory of 2488	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	33
PID 1788 wrote to memory of 2952	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	34
PID 1788 wrote to memory of 2952	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	34
PID 1788 wrote to memory of 2952	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	34
PID 1788 wrote to memory of 2452	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	35
PID 1788 wrote to memory of 2452	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	35
PID 1788 wrote to memory of 2452	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	35
PID 1788 wrote to memory of 2732	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	36
PID 1788 wrote to memory of 2732	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	36
PID 1788 wrote to memory of 2732	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	36
PID 1788 wrote to memory of 2884	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	37
PID 1788 wrote to memory of 2884	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	37
PID 1788 wrote to memory of 2884	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	37
PID 1788 wrote to memory of 2736	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	38
PID 1788 wrote to memory of 2736	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	38
PID 1788 wrote to memory of 2736	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	38
PID 1788 wrote to memory of 2864	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	39
PID 1788 wrote to memory of 2864	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	39
PID 1788 wrote to memory of 2864	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	39
PID 1788 wrote to memory of 2700	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	40
PID 1788 wrote to memory of 2700	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	40
PID 1788 wrote to memory of 2700	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	40
PID 1788 wrote to memory of 2784	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	41
PID 1788 wrote to memory of 2784	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	41
PID 1788 wrote to memory of 2784	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	41
PID 1788 wrote to memory of 2612	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	42
PID 1788 wrote to memory of 2612	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	42
PID 1788 wrote to memory of 2612	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	42
PID 1788 wrote to memory of 2632	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	43
PID 1788 wrote to memory of 2632	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	43
PID 1788 wrote to memory of 2632	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	43
PID 1788 wrote to memory of 2580	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	44
PID 1788 wrote to memory of 2580	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	44
PID 1788 wrote to memory of 2580	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	44
PID 1788 wrote to memory of 2656	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	45
PID 1788 wrote to memory of 2656	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	45
PID 1788 wrote to memory of 2656	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	45
PID 1788 wrote to memory of 2204	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	46
PID 1788 wrote to memory of 2204	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	46
PID 1788 wrote to memory of 2204	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	46
PID 1788 wrote to memory of 2180	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	47
PID 1788 wrote to memory of 2180	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	47
PID 1788 wrote to memory of 2180	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	47
PID 1788 wrote to memory of 2008	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	48
PID 1788 wrote to memory of 2008	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	48
PID 1788 wrote to memory of 2008	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	48
PID 1788 wrote to memory of 956	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	49
PID 1788 wrote to memory of 956	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	49
PID 1788 wrote to memory of 956	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	49
PID 1788 wrote to memory of 1152	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	50
PID 1788 wrote to memory of 1152	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	50
PID 1788 wrote to memory of 1152	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	50
PID 1788 wrote to memory of 1676	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	51
PID 1788 wrote to memory of 1676	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	51
PID 1788 wrote to memory of 1676	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	51
PID 1788 wrote to memory of 1996	1788	37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe	52

C:\Users\Admin\AppData\Local\Temp\37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe
"C:\Users\Admin\AppData\Local\Temp\37272351c94adef501ff7e8b32f2360e3e5ab88ba242a59ce30a99dcf8a8dfa4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System\oIKCAyY.exe
  C:\Windows\System\oIKCAyY.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\OsWkwRV.exe
  C:\Windows\System\OsWkwRV.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\qMybEvy.exe
  C:\Windows\System\qMybEvy.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\qDWqAvt.exe
  C:\Windows\System\qDWqAvt.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\UMLQtPM.exe
  C:\Windows\System\UMLQtPM.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\vdkRwnE.exe
  C:\Windows\System\vdkRwnE.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\vaFOydb.exe
  C:\Windows\System\vaFOydb.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\XvZWUoG.exe
  C:\Windows\System\XvZWUoG.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\rsOmXqd.exe
  C:\Windows\System\rsOmXqd.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\IRhVxqK.exe
  C:\Windows\System\IRhVxqK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\rwyYWuJ.exe
  C:\Windows\System\rwyYWuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ATSAKgl.exe
  C:\Windows\System\ATSAKgl.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\CTFvZRe.exe
  C:\Windows\System\CTFvZRe.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\ZaKEZlp.exe
  C:\Windows\System\ZaKEZlp.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\DUchwId.exe
  C:\Windows\System\DUchwId.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\skUQHWq.exe
  C:\Windows\System\skUQHWq.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\GUFAdhA.exe
  C:\Windows\System\GUFAdhA.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\jBMOyOh.exe
  C:\Windows\System\jBMOyOh.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\chRgGSE.exe
  C:\Windows\System\chRgGSE.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\PfDOuaz.exe
  C:\Windows\System\PfDOuaz.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\LOknTIn.exe
  C:\Windows\System\LOknTIn.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\hwTOhve.exe
  C:\Windows\System\hwTOhve.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\rqqkvLy.exe
  C:\Windows\System\rqqkvLy.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\AkiOEEr.exe
  C:\Windows\System\AkiOEEr.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\YsRXnXZ.exe
  C:\Windows\System\YsRXnXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\RcsSwsd.exe
  C:\Windows\System\RcsSwsd.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\XFKDahp.exe
  C:\Windows\System\XFKDahp.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\AKJIyTr.exe
  C:\Windows\System\AKJIyTr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\pdlBiQk.exe
  C:\Windows\System\pdlBiQk.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\efUBSqj.exe
  C:\Windows\System\efUBSqj.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\DLenlzt.exe
  C:\Windows\System\DLenlzt.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\aUzTkkr.exe
  C:\Windows\System\aUzTkkr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\zWafmRl.exe
  C:\Windows\System\zWafmRl.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\BeYMaoC.exe
  C:\Windows\System\BeYMaoC.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\uuyAqoG.exe
  C:\Windows\System\uuyAqoG.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\aQBTRBR.exe
  C:\Windows\System\aQBTRBR.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\oufGdlt.exe
  C:\Windows\System\oufGdlt.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\zbxTXqF.exe
  C:\Windows\System\zbxTXqF.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\xqJSGny.exe
  C:\Windows\System\xqJSGny.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\GWWtmnH.exe
  C:\Windows\System\GWWtmnH.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\eqwFWmZ.exe
  C:\Windows\System\eqwFWmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QJWUTdW.exe
  C:\Windows\System\QJWUTdW.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\OTgFWhh.exe
  C:\Windows\System\OTgFWhh.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\hwHrWvo.exe
  C:\Windows\System\hwHrWvo.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ewJkHdT.exe
  C:\Windows\System\ewJkHdT.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\GLtjSIH.exe
  C:\Windows\System\GLtjSIH.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\GjINuNZ.exe
  C:\Windows\System\GjINuNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\mcigTmP.exe
  C:\Windows\System\mcigTmP.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QeFggZI.exe
  C:\Windows\System\QeFggZI.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\HhtsXzS.exe
  C:\Windows\System\HhtsXzS.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ODNLJmG.exe
  C:\Windows\System\ODNLJmG.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\naCblzP.exe
  C:\Windows\System\naCblzP.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\dQxurRN.exe
  C:\Windows\System\dQxurRN.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\HZIjhvL.exe
  C:\Windows\System\HZIjhvL.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\xDZriGz.exe
  C:\Windows\System\xDZriGz.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\LNTzOec.exe
  C:\Windows\System\LNTzOec.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\yhbXUDp.exe
  C:\Windows\System\yhbXUDp.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\ygZxJhp.exe
  C:\Windows\System\ygZxJhp.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\XtccSOY.exe
  C:\Windows\System\XtccSOY.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\RGpkjeW.exe
  C:\Windows\System\RGpkjeW.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\xroHYnM.exe
  C:\Windows\System\xroHYnM.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\zFVzHjb.exe
  C:\Windows\System\zFVzHjb.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\hWxhVuQ.exe
  C:\Windows\System\hWxhVuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\OmNIxFa.exe
  C:\Windows\System\OmNIxFa.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\sZzbMMW.exe
  C:\Windows\System\sZzbMMW.exe
  2⤵
  PID:1716
- C:\Windows\System\DJypPRf.exe
  C:\Windows\System\DJypPRf.exe
  2⤵
  PID:1832
- C:\Windows\System\BxNREUs.exe
  C:\Windows\System\BxNREUs.exe
  2⤵
  PID:1732
- C:\Windows\System\wnUyRXd.exe
  C:\Windows\System\wnUyRXd.exe
  2⤵
  PID:1920
- C:\Windows\System\ybrsTJe.exe
  C:\Windows\System\ybrsTJe.exe
  2⤵
  PID:1480
- C:\Windows\System\xVRLNAL.exe
  C:\Windows\System\xVRLNAL.exe
  2⤵
  PID:1856
- C:\Windows\System\bWAIrXP.exe
  C:\Windows\System\bWAIrXP.exe
  2⤵
  PID:2004
- C:\Windows\System\AktLyPj.exe
  C:\Windows\System\AktLyPj.exe
  2⤵
  PID:1792
- C:\Windows\System\vbqmtgJ.exe
  C:\Windows\System\vbqmtgJ.exe
  2⤵
  PID:2336
- C:\Windows\System\EaXklgL.exe
  C:\Windows\System\EaXklgL.exe
  2⤵
  PID:1500
- C:\Windows\System\zZZEpLY.exe
  C:\Windows\System\zZZEpLY.exe
  2⤵
  PID:2996
- C:\Windows\System\wNZrLwG.exe
  C:\Windows\System\wNZrLwG.exe
  2⤵
  PID:1928
- C:\Windows\System\UMVkAAY.exe
  C:\Windows\System\UMVkAAY.exe
  2⤵
  PID:1332
- C:\Windows\System\qwxxANi.exe
  C:\Windows\System\qwxxANi.exe
  2⤵
  PID:2132
- C:\Windows\System\yZpldhC.exe
  C:\Windows\System\yZpldhC.exe
  2⤵
  PID:2820
- C:\Windows\System\rikhkEq.exe
  C:\Windows\System\rikhkEq.exe
  2⤵
  PID:1364
- C:\Windows\System\ZrmoosK.exe
  C:\Windows\System\ZrmoosK.exe
  2⤵
  PID:780
- C:\Windows\System\rmAEFZI.exe
  C:\Windows\System\rmAEFZI.exe
  2⤵
  PID:1352
- C:\Windows\System\pyqtMsq.exe
  C:\Windows\System\pyqtMsq.exe
  2⤵
  PID:536
- C:\Windows\System\fnfXRKK.exe
  C:\Windows\System\fnfXRKK.exe
  2⤵
  PID:3028
- C:\Windows\System\QoIDAZx.exe
  C:\Windows\System\QoIDAZx.exe
  2⤵
  PID:1476
- C:\Windows\System\tSBbyZa.exe
  C:\Windows\System\tSBbyZa.exe
  2⤵
  PID:584
- C:\Windows\System\XivZVzs.exe
  C:\Windows\System\XivZVzs.exe
  2⤵
  PID:996
- C:\Windows\System\ZpkdOyN.exe
  C:\Windows\System\ZpkdOyN.exe
  2⤵
  PID:3016
- C:\Windows\System\NTXvSTw.exe
  C:\Windows\System\NTXvSTw.exe
  2⤵
  PID:2356
- C:\Windows\System\FvkAYiZ.exe
  C:\Windows\System\FvkAYiZ.exe
  2⤵
  PID:1552
- C:\Windows\System\DJTWZDW.exe
  C:\Windows\System\DJTWZDW.exe
  2⤵
  PID:2484
- C:\Windows\System\RMxrEhy.exe
  C:\Windows\System\RMxrEhy.exe
  2⤵
  PID:2472
- C:\Windows\System\GjuLOWn.exe
  C:\Windows\System\GjuLOWn.exe
  2⤵
  PID:2184
- C:\Windows\System\SUhmZUO.exe
  C:\Windows\System\SUhmZUO.exe
  2⤵
  PID:2968
- C:\Windows\System\pCXRbAr.exe
  C:\Windows\System\pCXRbAr.exe
  2⤵
  PID:2588
- C:\Windows\System\IGqphwA.exe
  C:\Windows\System\IGqphwA.exe
  2⤵
  PID:2696
- C:\Windows\System\XxSoLuD.exe
  C:\Windows\System\XxSoLuD.exe
  2⤵
  PID:1704
- C:\Windows\System\rHXuDhJ.exe
  C:\Windows\System\rHXuDhJ.exe
  2⤵
  PID:672
- C:\Windows\System\DoMzcep.exe
  C:\Windows\System\DoMzcep.exe
  2⤵
  PID:1524
- C:\Windows\System\ZjSzjqh.exe
  C:\Windows\System\ZjSzjqh.exe
  2⤵
  PID:1224
- C:\Windows\System\aeRlfPG.exe
  C:\Windows\System\aeRlfPG.exe
  2⤵
  PID:2624
- C:\Windows\System\wWBlVnw.exe
  C:\Windows\System\wWBlVnw.exe
  2⤵
  PID:1784
- C:\Windows\System\rDWOmTo.exe
  C:\Windows\System\rDWOmTo.exe
  2⤵
  PID:1852
- C:\Windows\System\wDjDufa.exe
  C:\Windows\System\wDjDufa.exe
  2⤵
  PID:2016
- C:\Windows\System\wLdCsiP.exe
  C:\Windows\System\wLdCsiP.exe
  2⤵
  PID:2544
- C:\Windows\System\jwmivOS.exe
  C:\Windows\System\jwmivOS.exe
  2⤵
  PID:2216
- C:\Windows\System\tKRPhuP.exe
  C:\Windows\System\tKRPhuP.exe
  2⤵
  PID:2248
- C:\Windows\System\EzGHOZr.exe
  C:\Windows\System\EzGHOZr.exe
  2⤵
  PID:1736
- C:\Windows\System\MpwNdJh.exe
  C:\Windows\System\MpwNdJh.exe
  2⤵
  PID:616
- C:\Windows\System\ZupyAKS.exe
  C:\Windows\System\ZupyAKS.exe
  2⤵
  PID:2352
- C:\Windows\System\ZHPIRuW.exe
  C:\Windows\System\ZHPIRuW.exe
  2⤵
  PID:2100
- C:\Windows\System\EgrQeGr.exe
  C:\Windows\System\EgrQeGr.exe
  2⤵
  PID:2492
- C:\Windows\System\PcpTQse.exe
  C:\Windows\System\PcpTQse.exe
  2⤵
  PID:2380
- C:\Windows\System\sGdjAcK.exe
  C:\Windows\System\sGdjAcK.exe
  2⤵
  PID:2880
- C:\Windows\System\RzyVFFA.exe
  C:\Windows\System\RzyVFFA.exe
  2⤵
  PID:1808
- C:\Windows\System\npyXZHC.exe
  C:\Windows\System\npyXZHC.exe
  2⤵
  PID:2620
- C:\Windows\System\mcPdpxC.exe
  C:\Windows\System\mcPdpxC.exe
  2⤵
  PID:2748
- C:\Windows\System\TzoMvBH.exe
  C:\Windows\System\TzoMvBH.exe
  2⤵
  PID:3052
- C:\Windows\System\UHeiDFT.exe
  C:\Windows\System\UHeiDFT.exe
  2⤵
  PID:2832
- C:\Windows\System\JmNDSxD.exe
  C:\Windows\System\JmNDSxD.exe
  2⤵
  PID:308
- C:\Windows\System\pdNEexa.exe
  C:\Windows\System\pdNEexa.exe
  2⤵
  PID:1796
- C:\Windows\System\FhLyGKA.exe
  C:\Windows\System\FhLyGKA.exe
  2⤵
  PID:2136
- C:\Windows\System\vaSFNrg.exe
  C:\Windows\System\vaSFNrg.exe
  2⤵
  PID:1520
- C:\Windows\System\MFioUyO.exe
  C:\Windows\System\MFioUyO.exe
  2⤵
  PID:2196
- C:\Windows\System\DZlqdWU.exe
  C:\Windows\System\DZlqdWU.exe
  2⤵
  PID:1740
- C:\Windows\System\CsPiFHc.exe
  C:\Windows\System\CsPiFHc.exe
  2⤵
  PID:544
- C:\Windows\System\volGLni.exe
  C:\Windows\System\volGLni.exe
  2⤵
  PID:2664
- C:\Windows\System\bGGAXkR.exe
  C:\Windows\System\bGGAXkR.exe
  2⤵
  PID:2940
- C:\Windows\System\JDCDipn.exe
  C:\Windows\System\JDCDipn.exe
  2⤵
  PID:1712
- C:\Windows\System\ClxPajq.exe
  C:\Windows\System\ClxPajq.exe
  2⤵
  PID:924
- C:\Windows\System\YryAwuT.exe
  C:\Windows\System\YryAwuT.exe
  2⤵
  PID:2668
- C:\Windows\System\jtQpYgJ.exe
  C:\Windows\System\jtQpYgJ.exe
  2⤵
  PID:688
- C:\Windows\System\PNqddHB.exe
  C:\Windows\System\PNqddHB.exe
  2⤵
  PID:3096
- C:\Windows\System\mssxEFt.exe
  C:\Windows\System\mssxEFt.exe
  2⤵
  PID:3112
- C:\Windows\System\sIdBvtD.exe
  C:\Windows\System\sIdBvtD.exe
  2⤵
  PID:3132
- C:\Windows\System\wMShMXm.exe
  C:\Windows\System\wMShMXm.exe
  2⤵
  PID:3152
- C:\Windows\System\opsdKOG.exe
  C:\Windows\System\opsdKOG.exe
  2⤵
  PID:3176
- C:\Windows\System\GjeERDW.exe
  C:\Windows\System\GjeERDW.exe
  2⤵
  PID:3196
- C:\Windows\System\xzkOQSN.exe
  C:\Windows\System\xzkOQSN.exe
  2⤵
  PID:3212
- C:\Windows\System\thyxHVq.exe
  C:\Windows\System\thyxHVq.exe
  2⤵
  PID:3232
- C:\Windows\System\TFAuIFv.exe
  C:\Windows\System\TFAuIFv.exe
  2⤵
  PID:3248
- C:\Windows\System\jYeBpJr.exe
  C:\Windows\System\jYeBpJr.exe
  2⤵
  PID:3264
- C:\Windows\System\pQnzZFs.exe
  C:\Windows\System\pQnzZFs.exe
  2⤵
  PID:3288
- C:\Windows\System\xAfonoA.exe
  C:\Windows\System\xAfonoA.exe
  2⤵
  PID:3304
- C:\Windows\System\pAqqCDs.exe
  C:\Windows\System\pAqqCDs.exe
  2⤵
  PID:3320
- C:\Windows\System\SkEYkDd.exe
  C:\Windows\System\SkEYkDd.exe
  2⤵
  PID:3336
- C:\Windows\System\dSjkLzs.exe
  C:\Windows\System\dSjkLzs.exe
  2⤵
  PID:3356
- C:\Windows\System\vSCHeis.exe
  C:\Windows\System\vSCHeis.exe
  2⤵
  PID:3372
- C:\Windows\System\HOfxFdk.exe
  C:\Windows\System\HOfxFdk.exe
  2⤵
  PID:3388
- C:\Windows\System\arBUJrB.exe
  C:\Windows\System\arBUJrB.exe
  2⤵
  PID:3408
- C:\Windows\System\sjmSBjm.exe
  C:\Windows\System\sjmSBjm.exe
  2⤵
  PID:3448
- C:\Windows\System\gbRpdzu.exe
  C:\Windows\System\gbRpdzu.exe
  2⤵
  PID:3464
- C:\Windows\System\aMWWDjC.exe
  C:\Windows\System\aMWWDjC.exe
  2⤵
  PID:3492
- C:\Windows\System\oCpbuXq.exe
  C:\Windows\System\oCpbuXq.exe
  2⤵
  PID:3508
- C:\Windows\System\CojFqfl.exe
  C:\Windows\System\CojFqfl.exe
  2⤵
  PID:3524
- C:\Windows\System\ekXkUEU.exe
  C:\Windows\System\ekXkUEU.exe
  2⤵
  PID:3544
- C:\Windows\System\xRuWmDb.exe
  C:\Windows\System\xRuWmDb.exe
  2⤵
  PID:3560
- C:\Windows\System\gczGTKs.exe
  C:\Windows\System\gczGTKs.exe
  2⤵
  PID:3576
- C:\Windows\System\nYamaCp.exe
  C:\Windows\System\nYamaCp.exe
  2⤵
  PID:3592
- C:\Windows\System\RcxjXKa.exe
  C:\Windows\System\RcxjXKa.exe
  2⤵
  PID:3608
- C:\Windows\System\kvMnnMQ.exe
  C:\Windows\System\kvMnnMQ.exe
  2⤵
  PID:3628
- C:\Windows\System\ocWVIAF.exe
  C:\Windows\System\ocWVIAF.exe
  2⤵
  PID:3648
- C:\Windows\System\HyZGgJx.exe
  C:\Windows\System\HyZGgJx.exe
  2⤵
  PID:3680
- C:\Windows\System\oAVhYix.exe
  C:\Windows\System\oAVhYix.exe
  2⤵
  PID:3712
- C:\Windows\System\KXfNmrY.exe
  C:\Windows\System\KXfNmrY.exe
  2⤵
  PID:3728
- C:\Windows\System\DbfzKAr.exe
  C:\Windows\System\DbfzKAr.exe
  2⤵
  PID:3748
- C:\Windows\System\nNEolLW.exe
  C:\Windows\System\nNEolLW.exe
  2⤵
  PID:3768
- C:\Windows\System\ZbPKLhy.exe
  C:\Windows\System\ZbPKLhy.exe
  2⤵
  PID:3788
- C:\Windows\System\jtvbsyV.exe
  C:\Windows\System\jtvbsyV.exe
  2⤵
  PID:3816
- C:\Windows\System\MjOlXEX.exe
  C:\Windows\System\MjOlXEX.exe
  2⤵
  PID:3832
- C:\Windows\System\TqNLJkq.exe
  C:\Windows\System\TqNLJkq.exe
  2⤵
  PID:3848
- C:\Windows\System\jAILJzR.exe
  C:\Windows\System\jAILJzR.exe
  2⤵
  PID:3864
- C:\Windows\System\VCAQHXV.exe
  C:\Windows\System\VCAQHXV.exe
  2⤵
  PID:3880
- C:\Windows\System\kAHTNhR.exe
  C:\Windows\System\kAHTNhR.exe
  2⤵
  PID:3932
- C:\Windows\System\xhoJCuz.exe
  C:\Windows\System\xhoJCuz.exe
  2⤵
  PID:3948
- C:\Windows\System\JkcxNNT.exe
  C:\Windows\System\JkcxNNT.exe
  2⤵
  PID:3964
- C:\Windows\System\DYzSMLY.exe
  C:\Windows\System\DYzSMLY.exe
  2⤵
  PID:3980
- C:\Windows\System\JoNfyuv.exe
  C:\Windows\System\JoNfyuv.exe
  2⤵
  PID:4004
- C:\Windows\System\akSsDKn.exe
  C:\Windows\System\akSsDKn.exe
  2⤵
  PID:4028
- C:\Windows\System\YibrUKQ.exe
  C:\Windows\System\YibrUKQ.exe
  2⤵
  PID:4044
- C:\Windows\System\AtRxWUM.exe
  C:\Windows\System\AtRxWUM.exe
  2⤵
  PID:4064
- C:\Windows\System\pSrwsXG.exe
  C:\Windows\System\pSrwsXG.exe
  2⤵
  PID:4080
- C:\Windows\System\ntyBazO.exe
  C:\Windows\System\ntyBazO.exe
  2⤵
  PID:2276
- C:\Windows\System\KnWTjvR.exe
  C:\Windows\System\KnWTjvR.exe
  2⤵
  PID:2920
- C:\Windows\System\UbVVXcu.exe
  C:\Windows\System\UbVVXcu.exe
  2⤵
  PID:2012
- C:\Windows\System\rOtjXls.exe
  C:\Windows\System\rOtjXls.exe
  2⤵
  PID:1424
- C:\Windows\System\VLYXKaC.exe
  C:\Windows\System\VLYXKaC.exe
  2⤵
  PID:1468
- C:\Windows\System\LqNHALf.exe
  C:\Windows\System\LqNHALf.exe
  2⤵
  PID:3000
- C:\Windows\System\MjtmvEV.exe
  C:\Windows\System\MjtmvEV.exe
  2⤵
  PID:2560
- C:\Windows\System\OBeXuIk.exe
  C:\Windows\System\OBeXuIk.exe
  2⤵
  PID:3080
- C:\Windows\System\OxCrUMc.exe
  C:\Windows\System\OxCrUMc.exe
  2⤵
  PID:2608
- C:\Windows\System\DSfKpSv.exe
  C:\Windows\System\DSfKpSv.exe
  2⤵
  PID:2708
- C:\Windows\System\GESCHrk.exe
  C:\Windows\System\GESCHrk.exe
  2⤵
  PID:3220
- C:\Windows\System\oGsWmnv.exe
  C:\Windows\System\oGsWmnv.exe
  2⤵
  PID:3260
- C:\Windows\System\dIQpKfA.exe
  C:\Windows\System\dIQpKfA.exe
  2⤵
  PID:3300
- C:\Windows\System\vJSISlQ.exe
  C:\Windows\System\vJSISlQ.exe
  2⤵
  PID:3164
- C:\Windows\System\azGAgGu.exe
  C:\Windows\System\azGAgGu.exe
  2⤵
  PID:3368
- C:\Windows\System\xIJCyWw.exe
  C:\Windows\System\xIJCyWw.exe
  2⤵
  PID:3344
- C:\Windows\System\ugMRdEP.exe
  C:\Windows\System\ugMRdEP.exe
  2⤵
  PID:3244
- C:\Windows\System\XYuhzqH.exe
  C:\Windows\System\XYuhzqH.exe
  2⤵
  PID:3420
- C:\Windows\System\mtrcuEm.exe
  C:\Windows\System\mtrcuEm.exe
  2⤵
  PID:3424
- C:\Windows\System\Xskupxu.exe
  C:\Windows\System\Xskupxu.exe
  2⤵
  PID:3460
- C:\Windows\System\yIWIXQX.exe
  C:\Windows\System\yIWIXQX.exe
  2⤵
  PID:2860
- C:\Windows\System\vYcOFdu.exe
  C:\Windows\System\vYcOFdu.exe
  2⤵
  PID:3520
- C:\Windows\System\qnfSMog.exe
  C:\Windows\System\qnfSMog.exe
  2⤵
  PID:2704
- C:\Windows\System\dWJIIeX.exe
  C:\Windows\System\dWJIIeX.exe
  2⤵
  PID:3500
- C:\Windows\System\xBHwsmc.exe
  C:\Windows\System\xBHwsmc.exe
  2⤵
  PID:3536
- C:\Windows\System\RiibOag.exe
  C:\Windows\System\RiibOag.exe
  2⤵
  PID:3604
- C:\Windows\System\GQeQWlK.exe
  C:\Windows\System\GQeQWlK.exe
  2⤵
  PID:3656
- C:\Windows\System\IaQkYeU.exe
  C:\Windows\System\IaQkYeU.exe
  2⤵
  PID:3664
- C:\Windows\System\cjrjLpJ.exe
  C:\Windows\System\cjrjLpJ.exe
  2⤵
  PID:3692
- C:\Windows\System\sOWruJa.exe
  C:\Windows\System\sOWruJa.exe
  2⤵
  PID:3760
- C:\Windows\System\NYzvYfa.exe
  C:\Windows\System\NYzvYfa.exe
  2⤵
  PID:3780
- C:\Windows\System\AmyUzNE.exe
  C:\Windows\System\AmyUzNE.exe
  2⤵
  PID:2600
- C:\Windows\System\qCKaXDE.exe
  C:\Windows\System\qCKaXDE.exe
  2⤵
  PID:3872
- C:\Windows\System\WsyVsVY.exe
  C:\Windows\System\WsyVsVY.exe
  2⤵
  PID:3856
- C:\Windows\System\XPnwQjg.exe
  C:\Windows\System\XPnwQjg.exe
  2⤵
  PID:3972
- C:\Windows\System\xdNHjpB.exe
  C:\Windows\System\xdNHjpB.exe
  2⤵
  PID:4020
- C:\Windows\System\gYPiuxN.exe
  C:\Windows\System\gYPiuxN.exe
  2⤵
  PID:776
- C:\Windows\System\EezBLiW.exe
  C:\Windows\System\EezBLiW.exe
  2⤵
  PID:3996
- C:\Windows\System\zfOvGeq.exe
  C:\Windows\System\zfOvGeq.exe
  2⤵
  PID:3924
- C:\Windows\System\NicRfkv.exe
  C:\Windows\System\NicRfkv.exe
  2⤵
  PID:3900
- C:\Windows\System\aHmeNfn.exe
  C:\Windows\System\aHmeNfn.exe
  2⤵
  PID:3916
- C:\Windows\System\UnonJLy.exe
  C:\Windows\System\UnonJLy.exe
  2⤵
  PID:3956
- C:\Windows\System\WrrKtyo.exe
  C:\Windows\System\WrrKtyo.exe
  2⤵
  PID:4036
- C:\Windows\System\HZJgzVD.exe
  C:\Windows\System\HZJgzVD.exe
  2⤵
  PID:2308
- C:\Windows\System\JXaHDHf.exe
  C:\Windows\System\JXaHDHf.exe
  2⤵
  PID:2368
- C:\Windows\System\UPWPIbg.exe
  C:\Windows\System\UPWPIbg.exe
  2⤵
  PID:3092
- C:\Windows\System\lvUGlSz.exe
  C:\Windows\System\lvUGlSz.exe
  2⤵
  PID:3296
- C:\Windows\System\ZGboZBJ.exe
  C:\Windows\System\ZGboZBJ.exe
  2⤵
  PID:1636
- C:\Windows\System\OyfyWDf.exe
  C:\Windows\System\OyfyWDf.exe
  2⤵
  PID:1032
- C:\Windows\System\hYXeIRf.exe
  C:\Windows\System\hYXeIRf.exe
  2⤵
  PID:3084
- C:\Windows\System\nqDrTiv.exe
  C:\Windows\System\nqDrTiv.exe
  2⤵
  PID:3228
- C:\Windows\System\teWVEtr.exe
  C:\Windows\System\teWVEtr.exe
  2⤵
  PID:2676
- C:\Windows\System\zFhscBP.exe
  C:\Windows\System\zFhscBP.exe
  2⤵
  PID:2412
- C:\Windows\System\XcXpHqn.exe
  C:\Windows\System\XcXpHqn.exe
  2⤵
  PID:3148
- C:\Windows\System\ZvSMZvf.exe
  C:\Windows\System\ZvSMZvf.exe
  2⤵
  PID:2896
- C:\Windows\System\cvjEoTr.exe
  C:\Windows\System\cvjEoTr.exe
  2⤵
  PID:3556
- C:\Windows\System\dlLKSbg.exe
  C:\Windows\System\dlLKSbg.exe
  2⤵
  PID:3584
- C:\Windows\System\BxUXkGS.exe
  C:\Windows\System\BxUXkGS.exe
  2⤵
  PID:1688
- C:\Windows\System\sOPnqGq.exe
  C:\Windows\System\sOPnqGq.exe
  2⤵
  PID:3688
- C:\Windows\System\EmdUkrP.exe
  C:\Windows\System\EmdUkrP.exe
  2⤵
  PID:3744
- C:\Windows\System\OxGokRt.exe
  C:\Windows\System\OxGokRt.exe
  2⤵
  PID:448
- C:\Windows\System\ROaCliO.exe
  C:\Windows\System\ROaCliO.exe
  2⤵
  PID:4060
- C:\Windows\System\SBKXJBI.exe
  C:\Windows\System\SBKXJBI.exe
  2⤵
  PID:3860
- C:\Windows\System\jAHUzFV.exe
  C:\Windows\System\jAHUzFV.exe
  2⤵
  PID:4000
- C:\Windows\System\PSbeUxy.exe
  C:\Windows\System\PSbeUxy.exe
  2⤵
  PID:3108
- C:\Windows\System\lpGgAiQ.exe
  C:\Windows\System\lpGgAiQ.exe
  2⤵
  PID:3328
- C:\Windows\System\UzDJaie.exe
  C:\Windows\System\UzDJaie.exe
  2⤵
  PID:840
- C:\Windows\System\oHHtFuy.exe
  C:\Windows\System\oHHtFuy.exe
  2⤵
  PID:3380
- C:\Windows\System\Steqbbp.exe
  C:\Windows\System\Steqbbp.exe
  2⤵
  PID:3476
- C:\Windows\System\ztZuOba.exe
  C:\Windows\System\ztZuOba.exe
  2⤵
  PID:3404
- C:\Windows\System\DRpbesA.exe
  C:\Windows\System\DRpbesA.exe
  2⤵
  PID:3312
- C:\Windows\System\ibDISAo.exe
  C:\Windows\System\ibDISAo.exe
  2⤵
  PID:800
- C:\Windows\System\hPVnwKy.exe
  C:\Windows\System\hPVnwKy.exe
  2⤵
  PID:1936
- C:\Windows\System\OOXcLVy.exe
  C:\Windows\System\OOXcLVy.exe
  2⤵
  PID:2172
- C:\Windows\System\UPocqVh.exe
  C:\Windows\System\UPocqVh.exe
  2⤵
  PID:3624
- C:\Windows\System\BXezGNG.exe
  C:\Windows\System\BXezGNG.exe
  2⤵
  PID:4012
- C:\Windows\System\gCZawZz.exe
  C:\Windows\System\gCZawZz.exe
  2⤵
  PID:3124
- C:\Windows\System\YDdhjGr.exe
  C:\Windows\System\YDdhjGr.exe
  2⤵
  PID:380
- C:\Windows\System\IWpAojc.exe
  C:\Windows\System\IWpAojc.exe
  2⤵
  PID:3812
- C:\Windows\System\ECETLEl.exe
  C:\Windows\System\ECETLEl.exe
  2⤵
  PID:2816
- C:\Windows\System\MSRQVaO.exe
  C:\Windows\System\MSRQVaO.exe
  2⤵
  PID:3588
- C:\Windows\System\rBRZKXt.exe
  C:\Windows\System\rBRZKXt.exe
  2⤵
  PID:2720
- C:\Windows\System\cewFIyW.exe
  C:\Windows\System\cewFIyW.exe
  2⤵
  PID:3940
- C:\Windows\System\eRtZrBk.exe
  C:\Windows\System\eRtZrBk.exe
  2⤵
  PID:3364
- C:\Windows\System\GGQnILW.exe
  C:\Windows\System\GGQnILW.exe
  2⤵
  PID:2468
- C:\Windows\System\FIoOeKS.exe
  C:\Windows\System\FIoOeKS.exe
  2⤵
  PID:3316
- C:\Windows\System\zsGyWJO.exe
  C:\Windows\System\zsGyWJO.exe
  2⤵
  PID:3896
- C:\Windows\System\HitjLST.exe
  C:\Windows\System\HitjLST.exe
  2⤵
  PID:3756
- C:\Windows\System\dAgoxiZ.exe
  C:\Windows\System\dAgoxiZ.exe
  2⤵
  PID:3776
- C:\Windows\System\tcMIiml.exe
  C:\Windows\System\tcMIiml.exe
  2⤵
  PID:3840
- C:\Windows\System\bdNeZBH.exe
  C:\Windows\System\bdNeZBH.exe
  2⤵
  PID:4088
- C:\Windows\System\ZEnSxgo.exe
  C:\Windows\System\ZEnSxgo.exe
  2⤵
  PID:2756
- C:\Windows\System\xoXAnKX.exe
  C:\Windows\System\xoXAnKX.exe
  2⤵
  PID:3960
- C:\Windows\System\uNkZodo.exe
  C:\Windows\System\uNkZodo.exe
  2⤵
  PID:2408
- C:\Windows\System\OvhbLrw.exe
  C:\Windows\System\OvhbLrw.exe
  2⤵
  PID:3636
- C:\Windows\System\KeZTDXn.exe
  C:\Windows\System\KeZTDXn.exe
  2⤵
  PID:3208
- C:\Windows\System\kwEhhkJ.exe
  C:\Windows\System\kwEhhkJ.exe
  2⤵
  PID:3504
- C:\Windows\System\zOHTDeM.exe
  C:\Windows\System\zOHTDeM.exe
  2⤵
  PID:3540
- C:\Windows\System\qIFSWfG.exe
  C:\Windows\System\qIFSWfG.exe
  2⤵
  PID:1360
- C:\Windows\System\FcAwuhK.exe
  C:\Windows\System\FcAwuhK.exe
  2⤵
  PID:3616
- C:\Windows\System\YnHPkdX.exe
  C:\Windows\System\YnHPkdX.exe
  2⤵
  PID:3804
- C:\Windows\System\GiMlxRn.exe
  C:\Windows\System\GiMlxRn.exe
  2⤵
  PID:916
- C:\Windows\System\YxChnmh.exe
  C:\Windows\System\YxChnmh.exe
  2⤵
  PID:580
- C:\Windows\System\gOZfeDF.exe
  C:\Windows\System\gOZfeDF.exe
  2⤵
  PID:3352
- C:\Windows\System\KdjFBRs.exe
  C:\Windows\System\KdjFBRs.exe
  2⤵
  PID:1972
- C:\Windows\System\lRyYspo.exe
  C:\Windows\System\lRyYspo.exe
  2⤵
  PID:4100
- C:\Windows\System\YBUwigt.exe
  C:\Windows\System\YBUwigt.exe
  2⤵
  PID:4120
- C:\Windows\System\pGLFRsa.exe
  C:\Windows\System\pGLFRsa.exe
  2⤵
  PID:4140
- C:\Windows\System\eNrxHST.exe
  C:\Windows\System\eNrxHST.exe
  2⤵
  PID:4156
- C:\Windows\System\pogJSMG.exe
  C:\Windows\System\pogJSMG.exe
  2⤵
  PID:4176
- C:\Windows\System\yYRMdKp.exe
  C:\Windows\System\yYRMdKp.exe
  2⤵
  PID:4192
- C:\Windows\System\BYYAUKS.exe
  C:\Windows\System\BYYAUKS.exe
  2⤵
  PID:4212
- C:\Windows\System\DaADeUM.exe
  C:\Windows\System\DaADeUM.exe
  2⤵
  PID:4232
- C:\Windows\System\XYGfera.exe
  C:\Windows\System\XYGfera.exe
  2⤵
  PID:4252
- C:\Windows\System\YRZOQDV.exe
  C:\Windows\System\YRZOQDV.exe
  2⤵
  PID:4268
- C:\Windows\System\LFhqFoA.exe
  C:\Windows\System\LFhqFoA.exe
  2⤵
  PID:4288
- C:\Windows\System\aRpuZLl.exe
  C:\Windows\System\aRpuZLl.exe
  2⤵
  PID:4304
- C:\Windows\System\IJPDvpw.exe
  C:\Windows\System\IJPDvpw.exe
  2⤵
  PID:4320
- C:\Windows\System\bZhBJKO.exe
  C:\Windows\System\bZhBJKO.exe
  2⤵
  PID:4344
- C:\Windows\System\BEkUJKx.exe
  C:\Windows\System\BEkUJKx.exe
  2⤵
  PID:4372
- C:\Windows\System\mfLaJUg.exe
  C:\Windows\System\mfLaJUg.exe
  2⤵
  PID:4388
- C:\Windows\System\ItImMBW.exe
  C:\Windows\System\ItImMBW.exe
  2⤵
  PID:4404
- C:\Windows\System\CLwcadH.exe
  C:\Windows\System\CLwcadH.exe
  2⤵
  PID:4424
- C:\Windows\System\eskCvCj.exe
  C:\Windows\System\eskCvCj.exe
  2⤵
  PID:4444
- C:\Windows\System\oqeGneM.exe
  C:\Windows\System\oqeGneM.exe
  2⤵
  PID:4476
- C:\Windows\System\XzLAduY.exe
  C:\Windows\System\XzLAduY.exe
  2⤵
  PID:4492
- C:\Windows\System\aSahMoW.exe
  C:\Windows\System\aSahMoW.exe
  2⤵
  PID:4512
- C:\Windows\System\xsxqEPX.exe
  C:\Windows\System\xsxqEPX.exe
  2⤵
  PID:4528
- C:\Windows\System\kAlLtcp.exe
  C:\Windows\System\kAlLtcp.exe
  2⤵
  PID:4544
- C:\Windows\System\vrTfiYY.exe
  C:\Windows\System\vrTfiYY.exe
  2⤵
  PID:4596
- C:\Windows\System\dCaHYgd.exe
  C:\Windows\System\dCaHYgd.exe
  2⤵
  PID:4624
- C:\Windows\System\LhQRUut.exe
  C:\Windows\System\LhQRUut.exe
  2⤵
  PID:4640
- C:\Windows\System\OHsGxye.exe
  C:\Windows\System\OHsGxye.exe
  2⤵
  PID:4656
- C:\Windows\System\wKjvXUO.exe
  C:\Windows\System\wKjvXUO.exe
  2⤵
  PID:4676
- C:\Windows\System\VooVWeZ.exe
  C:\Windows\System\VooVWeZ.exe
  2⤵
  PID:4696
- C:\Windows\System\bAqsEVs.exe
  C:\Windows\System\bAqsEVs.exe
  2⤵
  PID:4716
- C:\Windows\System\lQNZmQn.exe
  C:\Windows\System\lQNZmQn.exe
  2⤵
  PID:4736
- C:\Windows\System\DnfPjvu.exe
  C:\Windows\System\DnfPjvu.exe
  2⤵
  PID:4756
- C:\Windows\System\yMEqgTV.exe
  C:\Windows\System\yMEqgTV.exe
  2⤵
  PID:4772
- C:\Windows\System\toIgrKy.exe
  C:\Windows\System\toIgrKy.exe
  2⤵
  PID:4792
- C:\Windows\System\GcpJSKn.exe
  C:\Windows\System\GcpJSKn.exe
  2⤵
  PID:4808
- C:\Windows\System\xPeyXzG.exe
  C:\Windows\System\xPeyXzG.exe
  2⤵
  PID:4824
- C:\Windows\System\BEjgwbF.exe
  C:\Windows\System\BEjgwbF.exe
  2⤵
  PID:4840
- C:\Windows\System\InsKTJb.exe
  C:\Windows\System\InsKTJb.exe
  2⤵
  PID:4856
- C:\Windows\System\XurrtJR.exe
  C:\Windows\System\XurrtJR.exe
  2⤵
  PID:4872
- C:\Windows\System\zSJjvvd.exe
  C:\Windows\System\zSJjvvd.exe
  2⤵
  PID:4888
- C:\Windows\System\zuLOwwJ.exe
  C:\Windows\System\zuLOwwJ.exe
  2⤵
  PID:4904
- C:\Windows\System\UvrhwbQ.exe
  C:\Windows\System\UvrhwbQ.exe
  2⤵
  PID:4920
- C:\Windows\System\ATBAlNs.exe
  C:\Windows\System\ATBAlNs.exe
  2⤵
  PID:4936
- C:\Windows\System\ILBNSiB.exe
  C:\Windows\System\ILBNSiB.exe
  2⤵
  PID:4952
- C:\Windows\System\fBAADRS.exe
  C:\Windows\System\fBAADRS.exe
  2⤵
  PID:4972
- C:\Windows\System\eVXIELn.exe
  C:\Windows\System\eVXIELn.exe
  2⤵
  PID:5004
- C:\Windows\System\mJfEpzx.exe
  C:\Windows\System\mJfEpzx.exe
  2⤵
  PID:5024
- C:\Windows\System\WPiBSYY.exe
  C:\Windows\System\WPiBSYY.exe
  2⤵
  PID:5048
- C:\Windows\System\ssBWnMs.exe
  C:\Windows\System\ssBWnMs.exe
  2⤵
  PID:5072
- C:\Windows\System\wOqAakp.exe
  C:\Windows\System\wOqAakp.exe
  2⤵
  PID:5088
- C:\Windows\System\tFPCcUH.exe
  C:\Windows\System\tFPCcUH.exe
  2⤵
  PID:5116
- C:\Windows\System\MCjGeFG.exe
  C:\Windows\System\MCjGeFG.exe
  2⤵
  PID:4108
- C:\Windows\System\hyYkKJp.exe
  C:\Windows\System\hyYkKJp.exe
  2⤵
  PID:4136
- C:\Windows\System\ddRpaap.exe
  C:\Windows\System\ddRpaap.exe
  2⤵
  PID:4264
- C:\Windows\System\jEzDpMK.exe
  C:\Windows\System\jEzDpMK.exe
  2⤵
  PID:4332
- C:\Windows\System\CgrqoYl.exe
  C:\Windows\System\CgrqoYl.exe
  2⤵
  PID:768
- C:\Windows\System\BcdOYgL.exe
  C:\Windows\System\BcdOYgL.exe
  2⤵
  PID:4204
- C:\Windows\System\EMLulMY.exe
  C:\Windows\System\EMLulMY.exe
  2⤵
  PID:3928
- C:\Windows\System\zjCiSvX.exe
  C:\Windows\System\zjCiSvX.exe
  2⤵
  PID:4056
- C:\Windows\System\ZgHkpYJ.exe
  C:\Windows\System\ZgHkpYJ.exe
  2⤵
  PID:4412
- C:\Windows\System\bApERhH.exe
  C:\Windows\System\bApERhH.exe
  2⤵
  PID:4244
- C:\Windows\System\fQhtYaW.exe
  C:\Windows\System\fQhtYaW.exe
  2⤵
  PID:4368
- C:\Windows\System\SQfrNDZ.exe
  C:\Windows\System\SQfrNDZ.exe
  2⤵
  PID:4432
- C:\Windows\System\ioAirKz.exe
  C:\Windows\System\ioAirKz.exe
  2⤵
  PID:3708
- C:\Windows\System\HNrFVah.exe
  C:\Windows\System\HNrFVah.exe
  2⤵
  PID:4464
- C:\Windows\System\evBPVSr.exe
  C:\Windows\System\evBPVSr.exe
  2⤵
  PID:4536
- C:\Windows\System\lrMtwIM.exe
  C:\Windows\System\lrMtwIM.exe
  2⤵
  PID:4540
- C:\Windows\System\fPYJPVh.exe
  C:\Windows\System\fPYJPVh.exe
  2⤵
  PID:4568
- C:\Windows\System\ekBsqxM.exe
  C:\Windows\System\ekBsqxM.exe
  2⤵
  PID:4616
- C:\Windows\System\RXzSUQf.exe
  C:\Windows\System\RXzSUQf.exe
  2⤵
  PID:4572
- C:\Windows\System\crXvxdl.exe
  C:\Windows\System\crXvxdl.exe
  2⤵
  PID:4592
- C:\Windows\System\UBFesHL.exe
  C:\Windows\System\UBFesHL.exe
  2⤵
  PID:4632
- C:\Windows\System\pqZAMTK.exe
  C:\Windows\System\pqZAMTK.exe
  2⤵
  PID:4668
- C:\Windows\System\JRIVQxK.exe
  C:\Windows\System\JRIVQxK.exe
  2⤵
  PID:4900
- C:\Windows\System\kRYxKsJ.exe
  C:\Windows\System\kRYxKsJ.exe
  2⤵
  PID:4964
- C:\Windows\System\dJlgmzV.exe
  C:\Windows\System\dJlgmzV.exe
  2⤵
  PID:5020
- C:\Windows\System\kyDfNKr.exe
  C:\Windows\System\kyDfNKr.exe
  2⤵
  PID:4916
- C:\Windows\System\uMjLmQm.exe
  C:\Windows\System\uMjLmQm.exe
  2⤵
  PID:4996
- C:\Windows\System\DnVtiJQ.exe
  C:\Windows\System\DnVtiJQ.exe
  2⤵
  PID:4752
- C:\Windows\System\IKEGxro.exe
  C:\Windows\System\IKEGxro.exe
  2⤵
  PID:4784
- C:\Windows\System\odPwNgU.exe
  C:\Windows\System\odPwNgU.exe
  2⤵
  PID:5068
- C:\Windows\System\avqVqLC.exe
  C:\Windows\System\avqVqLC.exe
  2⤵
  PID:4116
- C:\Windows\System\KzxsuSk.exe
  C:\Windows\System\KzxsuSk.exe
  2⤵
  PID:4852
- C:\Windows\System\KzRZraZ.exe
  C:\Windows\System\KzRZraZ.exe
  2⤵
  PID:5040
- C:\Windows\System\IPDZglV.exe
  C:\Windows\System\IPDZglV.exe
  2⤵
  PID:5044
- C:\Windows\System\wuEgNCR.exe
  C:\Windows\System\wuEgNCR.exe
  2⤵
  PID:4224
- C:\Windows\System\tdSTsqr.exe
  C:\Windows\System\tdSTsqr.exe
  2⤵
  PID:4336
- C:\Windows\System\skPaQUW.exe
  C:\Windows\System\skPaQUW.exe
  2⤵
  PID:4132
- C:\Windows\System\WinpZXU.exe
  C:\Windows\System\WinpZXU.exe
  2⤵
  PID:3944
- C:\Windows\System\JOxuvPS.exe
  C:\Windows\System\JOxuvPS.exe
  2⤵
  PID:4416
- C:\Windows\System\MIhcrAR.exe
  C:\Windows\System\MIhcrAR.exe
  2⤵
  PID:4280
- C:\Windows\System\tFjILtR.exe
  C:\Windows\System\tFjILtR.exe
  2⤵
  PID:4260
- C:\Windows\System\KefliyP.exe
  C:\Windows\System\KefliyP.exe
  2⤵
  PID:3828
- C:\Windows\System\MAmDxWj.exe
  C:\Windows\System\MAmDxWj.exe
  2⤵
  PID:4360
- C:\Windows\System\dqUbTCY.exe
  C:\Windows\System\dqUbTCY.exe
  2⤵
  PID:4524
- C:\Windows\System\OHPgODU.exe
  C:\Windows\System\OHPgODU.exe
  2⤵
  PID:4584
- C:\Windows\System\hjlmZiI.exe
  C:\Windows\System\hjlmZiI.exe
  2⤵
  PID:4652
- C:\Windows\System\vyiDVAc.exe
  C:\Windows\System\vyiDVAc.exe
  2⤵
  PID:4884
- C:\Windows\System\viKdWhd.exe
  C:\Windows\System\viKdWhd.exe
  2⤵
  PID:5064
- C:\Windows\System\XxlGpcw.exe
  C:\Windows\System\XxlGpcw.exe
  2⤵
  PID:4604
- C:\Windows\System\MLpCNsS.exe
  C:\Windows\System\MLpCNsS.exe
  2⤵
  PID:4732
- C:\Windows\System\ktFJFWU.exe
  C:\Windows\System\ktFJFWU.exe
  2⤵
  PID:2400
- C:\Windows\System\GsuUvXQ.exe
  C:\Windows\System\GsuUvXQ.exe
  2⤵
  PID:4248
- C:\Windows\System\xvHujEj.exe
  C:\Windows\System\xvHujEj.exe
  2⤵
  PID:4400
- C:\Windows\System\eoPKUXA.exe
  C:\Windows\System\eoPKUXA.exe
  2⤵
  PID:5112
- C:\Windows\System\lozajrG.exe
  C:\Windows\System\lozajrG.exe
  2⤵
  PID:4172
- C:\Windows\System\VpChmhL.exe
  C:\Windows\System\VpChmhL.exe
  2⤵
  PID:4164
- C:\Windows\System\MookgHs.exe
  C:\Windows\System\MookgHs.exe
  2⤵
  PID:4228
- C:\Windows\System\lbavxuY.exe
  C:\Windows\System\lbavxuY.exe
  2⤵
  PID:4688
- C:\Windows\System\qFLtTjO.exe
  C:\Windows\System\qFLtTjO.exe
  2⤵
  PID:4992
- C:\Windows\System\QcgbbYF.exe
  C:\Windows\System\QcgbbYF.exe
  2⤵
  PID:4356
- C:\Windows\System\iKTEcdJ.exe
  C:\Windows\System\iKTEcdJ.exe
  2⤵
  PID:4556
- C:\Windows\System\HujJkvt.exe
  C:\Windows\System\HujJkvt.exe
  2⤵
  PID:4748
- C:\Windows\System\OZVAcqR.exe
  C:\Windows\System\OZVAcqR.exe
  2⤵
  PID:4692
- C:\Windows\System\bWKtFwY.exe
  C:\Windows\System\bWKtFwY.exe
  2⤵
  PID:4804
- C:\Windows\System\PAgfNNv.exe
  C:\Windows\System\PAgfNNv.exe
  2⤵
  PID:4832
- C:\Windows\System\nAWySdX.exe
  C:\Windows\System\nAWySdX.exe
  2⤵
  PID:4864
- C:\Windows\System\YjsPQsr.exe
  C:\Windows\System\YjsPQsr.exe
  2⤵
  PID:5032
- C:\Windows\System\zxcNrBO.exe
  C:\Windows\System\zxcNrBO.exe
  2⤵
  PID:5124
- C:\Windows\System\olTbgNg.exe
  C:\Windows\System\olTbgNg.exe
  2⤵
  PID:5144
- C:\Windows\System\MtfJsYA.exe
  C:\Windows\System\MtfJsYA.exe
  2⤵
  PID:5164
- C:\Windows\System\JPaVsUg.exe
  C:\Windows\System\JPaVsUg.exe
  2⤵
  PID:5184
- C:\Windows\System\FjhORnQ.exe
  C:\Windows\System\FjhORnQ.exe
  2⤵
  PID:5200
- C:\Windows\System\dxHeorF.exe
  C:\Windows\System\dxHeorF.exe
  2⤵
  PID:5216
- C:\Windows\System\RCIEwvG.exe
  C:\Windows\System\RCIEwvG.exe
  2⤵
  PID:5232
- C:\Windows\System\DMmFIwf.exe
  C:\Windows\System\DMmFIwf.exe
  2⤵
  PID:5248
- C:\Windows\System\zaApLhi.exe
  C:\Windows\System\zaApLhi.exe
  2⤵
  PID:5264
- C:\Windows\System\tiBRMFo.exe
  C:\Windows\System\tiBRMFo.exe
  2⤵
  PID:5280
- C:\Windows\System\KrzlHlk.exe
  C:\Windows\System\KrzlHlk.exe
  2⤵
  PID:5300
- C:\Windows\System\KwiSlZK.exe
  C:\Windows\System\KwiSlZK.exe
  2⤵
  PID:5316
- C:\Windows\System\TxwVSob.exe
  C:\Windows\System\TxwVSob.exe
  2⤵
  PID:5332
- C:\Windows\System\lZRMaeT.exe
  C:\Windows\System\lZRMaeT.exe
  2⤵
  PID:5348
- C:\Windows\System\khlcTxg.exe
  C:\Windows\System\khlcTxg.exe
  2⤵
  PID:5364
- C:\Windows\System\JVXVIxI.exe
  C:\Windows\System\JVXVIxI.exe
  2⤵
  PID:5448
- C:\Windows\System\SawiShx.exe
  C:\Windows\System\SawiShx.exe
  2⤵
  PID:5464
- C:\Windows\System\XWIdfVt.exe
  C:\Windows\System\XWIdfVt.exe
  2⤵
  PID:5484
- C:\Windows\System\TVyCXob.exe
  C:\Windows\System\TVyCXob.exe
  2⤵
  PID:5504
- C:\Windows\System\VYrIyQi.exe
  C:\Windows\System\VYrIyQi.exe
  2⤵
  PID:5520
- C:\Windows\System\QxzREvj.exe
  C:\Windows\System\QxzREvj.exe
  2⤵
  PID:5544
- C:\Windows\System\njxYkyq.exe
  C:\Windows\System\njxYkyq.exe
  2⤵
  PID:5560
- C:\Windows\System\AABGJtG.exe
  C:\Windows\System\AABGJtG.exe
  2⤵
  PID:5576
- C:\Windows\System\cunxAHj.exe
  C:\Windows\System\cunxAHj.exe
  2⤵
  PID:5600
- C:\Windows\System\pBoMmWr.exe
  C:\Windows\System\pBoMmWr.exe
  2⤵
  PID:5616
- C:\Windows\System\UGsAeSb.exe
  C:\Windows\System\UGsAeSb.exe
  2⤵
  PID:5648
- C:\Windows\System\KeUjfQk.exe
  C:\Windows\System\KeUjfQk.exe
  2⤵
  PID:5672
- C:\Windows\System\VFtOyiO.exe
  C:\Windows\System\VFtOyiO.exe
  2⤵
  PID:5696
- C:\Windows\System\hQcsSPT.exe
  C:\Windows\System\hQcsSPT.exe
  2⤵
  PID:5712
- C:\Windows\System\xBFdUeq.exe
  C:\Windows\System\xBFdUeq.exe
  2⤵
  PID:5728
- C:\Windows\System\dzLFQgS.exe
  C:\Windows\System\dzLFQgS.exe
  2⤵
  PID:5748
- C:\Windows\System\EipxEML.exe
  C:\Windows\System\EipxEML.exe
  2⤵
  PID:5764
- C:\Windows\System\LMchSxu.exe
  C:\Windows\System\LMchSxu.exe
  2⤵
  PID:5784
- C:\Windows\System\XOSjoRO.exe
  C:\Windows\System\XOSjoRO.exe
  2⤵
  PID:5800
- C:\Windows\System\UxtmAFb.exe
  C:\Windows\System\UxtmAFb.exe
  2⤵
  PID:5820
- C:\Windows\System\qoKgHvR.exe
  C:\Windows\System\qoKgHvR.exe
  2⤵
  PID:5836
- C:\Windows\System\ZeNeOXN.exe
  C:\Windows\System\ZeNeOXN.exe
  2⤵
  PID:5856
- C:\Windows\System\YTUElqr.exe
  C:\Windows\System\YTUElqr.exe
  2⤵
  PID:5872
- C:\Windows\System\BNKRTAT.exe
  C:\Windows\System\BNKRTAT.exe
  2⤵
  PID:5904
- C:\Windows\System\XdgYVSu.exe
  C:\Windows\System\XdgYVSu.exe
  2⤵
  PID:5928
- C:\Windows\System\fvoEWkw.exe
  C:\Windows\System\fvoEWkw.exe
  2⤵
  PID:5948
- C:\Windows\System\pASxfFI.exe
  C:\Windows\System\pASxfFI.exe
  2⤵
  PID:5968
- C:\Windows\System\BsUGEgc.exe
  C:\Windows\System\BsUGEgc.exe
  2⤵
  PID:5984
- C:\Windows\System\fHfvjhE.exe
  C:\Windows\System\fHfvjhE.exe
  2⤵
  PID:6000
- C:\Windows\System\yFhFJKF.exe
  C:\Windows\System\yFhFJKF.exe
  2⤵
  PID:6016
- C:\Windows\System\BaBwShG.exe
  C:\Windows\System\BaBwShG.exe
  2⤵
  PID:6032
- C:\Windows\System\iuXBXES.exe
  C:\Windows\System\iuXBXES.exe
  2⤵
  PID:6052
- C:\Windows\System\dGRKpgd.exe
  C:\Windows\System\dGRKpgd.exe
  2⤵
  PID:6068
- C:\Windows\System\SFcZvqK.exe
  C:\Windows\System\SFcZvqK.exe
  2⤵
  PID:6088
- C:\Windows\System\aAamJnm.exe
  C:\Windows\System\aAamJnm.exe
  2⤵
  PID:6104
- C:\Windows\System\ClRAaSq.exe
  C:\Windows\System\ClRAaSq.exe
  2⤵
  PID:6128
- C:\Windows\System\oaEoONp.exe
  C:\Windows\System\oaEoONp.exe
  2⤵
  PID:4488
- C:\Windows\System\FTmcMXb.exe
  C:\Windows\System\FTmcMXb.exe
  2⤵
  PID:4780
- C:\Windows\System\wXBVFIz.exe
  C:\Windows\System\wXBVFIz.exe
  2⤵
  PID:4168
- C:\Windows\System\aEQLEWk.exe
  C:\Windows\System\aEQLEWk.exe
  2⤵
  PID:4768
- C:\Windows\System\GwAJxkh.exe
  C:\Windows\System\GwAJxkh.exe
  2⤵
  PID:5372
- C:\Windows\System\LyuUdpE.exe
  C:\Windows\System\LyuUdpE.exe
  2⤵
  PID:5272
- C:\Windows\System\dsBsVrH.exe
  C:\Windows\System\dsBsVrH.exe
  2⤵
  PID:5340
- C:\Windows\System\yOKUfiF.exe
  C:\Windows\System\yOKUfiF.exe
  2⤵
  PID:4364
- C:\Windows\System\OzntGOO.exe
  C:\Windows\System\OzntGOO.exe
  2⤵
  PID:4896
- C:\Windows\System\sjZRbjv.exe
  C:\Windows\System\sjZRbjv.exe
  2⤵
  PID:5136
- C:\Windows\System\DpXnoCD.exe
  C:\Windows\System\DpXnoCD.exe
  2⤵
  PID:5016
- C:\Windows\System\bPAyHnf.exe
  C:\Windows\System\bPAyHnf.exe
  2⤵
  PID:5180
- C:\Windows\System\MGPDwLJ.exe
  C:\Windows\System\MGPDwLJ.exe
  2⤵
  PID:5244
- C:\Windows\System\ntvFlKy.exe
  C:\Windows\System\ntvFlKy.exe
  2⤵
  PID:5380
- C:\Windows\System\cYaQGwV.exe
  C:\Windows\System\cYaQGwV.exe
  2⤵
  PID:5196
- C:\Windows\System\VtKcCJw.exe
  C:\Windows\System\VtKcCJw.exe
  2⤵
  PID:5416
- C:\Windows\System\dDsddHZ.exe
  C:\Windows\System\dDsddHZ.exe
  2⤵
  PID:5436
- C:\Windows\System\BjfrwqL.exe
  C:\Windows\System\BjfrwqL.exe
  2⤵
  PID:5476
- C:\Windows\System\dzFAByO.exe
  C:\Windows\System\dzFAByO.exe
  2⤵
  PID:4744
- C:\Windows\System\GVSFrGv.exe
  C:\Windows\System\GVSFrGv.exe
  2⤵
  PID:5528
- C:\Windows\System\nmkJzTY.exe
  C:\Windows\System\nmkJzTY.exe
  2⤵
  PID:5532
- C:\Windows\System\IaPFsje.exe
  C:\Windows\System\IaPFsje.exe
  2⤵
  PID:5296
- C:\Windows\System\uZOBAWH.exe
  C:\Windows\System\uZOBAWH.exe
  2⤵
  PID:5536
- C:\Windows\System\ebNYgTX.exe
  C:\Windows\System\ebNYgTX.exe
  2⤵
  PID:5588
- C:\Windows\System\QGnjNTa.exe
  C:\Windows\System\QGnjNTa.exe
  2⤵
  PID:5628
- C:\Windows\System\gITyQuv.exe
  C:\Windows\System\gITyQuv.exe
  2⤵
  PID:5644
- C:\Windows\System\zIgzcMM.exe
  C:\Windows\System\zIgzcMM.exe
  2⤵
  PID:5668
- C:\Windows\System\OmNVdYr.exe
  C:\Windows\System\OmNVdYr.exe
  2⤵
  PID:5740
- C:\Windows\System\ydFWBbx.exe
  C:\Windows\System\ydFWBbx.exe
  2⤵
  PID:5808
- C:\Windows\System\QIOgOGl.exe
  C:\Windows\System\QIOgOGl.exe
  2⤵
  PID:5852
- C:\Windows\System\uziWzap.exe
  C:\Windows\System\uziWzap.exe
  2⤵
  PID:5812
- C:\Windows\System\NTAKwYP.exe
  C:\Windows\System\NTAKwYP.exe
  2⤵
  PID:5944
- C:\Windows\System\zMdJeFI.exe
  C:\Windows\System\zMdJeFI.exe
  2⤵
  PID:6012
- C:\Windows\System\rZpnbAa.exe
  C:\Windows\System\rZpnbAa.exe
  2⤵
  PID:6076
- C:\Windows\System\eDnnohG.exe
  C:\Windows\System\eDnnohG.exe
  2⤵
  PID:5888
- C:\Windows\System\KRuvjaO.exe
  C:\Windows\System\KRuvjaO.exe
  2⤵
  PID:3644
- C:\Windows\System\XRNzyGc.exe
  C:\Windows\System\XRNzyGc.exe
  2⤵
  PID:4960
- C:\Windows\System\UypFMfu.exe
  C:\Windows\System\UypFMfu.exe
  2⤵
  PID:4520
- C:\Windows\System\aLXuQXg.exe
  C:\Windows\System\aLXuQXg.exe
  2⤵
  PID:6124
- C:\Windows\System\pVSdDbY.exe
  C:\Windows\System\pVSdDbY.exe
  2⤵
  PID:5444
- C:\Windows\System\rUrvHjA.exe
  C:\Windows\System\rUrvHjA.exe
  2⤵
  PID:5492
- C:\Windows\System\sNXdafe.exe
  C:\Windows\System\sNXdafe.exe
  2⤵
  PID:5552
- C:\Windows\System\BxqsEPG.exe
  C:\Windows\System\BxqsEPG.exe
  2⤵
  PID:5640
- C:\Windows\System\ZgqfWxd.exe
  C:\Windows\System\ZgqfWxd.exe
  2⤵
  PID:6148
- C:\Windows\System\MFPpRTB.exe
  C:\Windows\System\MFPpRTB.exe
  2⤵
  PID:6164
- C:\Windows\System\Shvzzwz.exe
  C:\Windows\System\Shvzzwz.exe
  2⤵
  PID:6180
- C:\Windows\System\lNihfNU.exe
  C:\Windows\System\lNihfNU.exe
  2⤵
  PID:6196
- C:\Windows\System\vmaXGQN.exe
  C:\Windows\System\vmaXGQN.exe
  2⤵
  PID:6212
- C:\Windows\System\peOHUEV.exe
  C:\Windows\System\peOHUEV.exe
  2⤵
  PID:6228
- C:\Windows\System\EgaSqFz.exe
  C:\Windows\System\EgaSqFz.exe
  2⤵
  PID:6244
- C:\Windows\System\GyfXxPJ.exe
  C:\Windows\System\GyfXxPJ.exe
  2⤵
  PID:6260
- C:\Windows\System\DngPcwN.exe
  C:\Windows\System\DngPcwN.exe
  2⤵
  PID:6280
- C:\Windows\System\tQvWrLN.exe
  C:\Windows\System\tQvWrLN.exe
  2⤵
  PID:6296
- C:\Windows\System\ESlkoqc.exe
  C:\Windows\System\ESlkoqc.exe
  2⤵
  PID:6316
- C:\Windows\System\JdpIcVx.exe
  C:\Windows\System\JdpIcVx.exe
  2⤵
  PID:6336
- C:\Windows\System\aEJtyDP.exe
  C:\Windows\System\aEJtyDP.exe
  2⤵
  PID:6356
- C:\Windows\System\vpgPaAR.exe
  C:\Windows\System\vpgPaAR.exe
  2⤵
  PID:6380
- C:\Windows\System\RXhbOde.exe
  C:\Windows\System\RXhbOde.exe
  2⤵
  PID:6400
- C:\Windows\System\ckfyRKL.exe
  C:\Windows\System\ckfyRKL.exe
  2⤵
  PID:6420
- C:\Windows\System\vRdFNWr.exe
  C:\Windows\System\vRdFNWr.exe
  2⤵
  PID:6440
- C:\Windows\System\atZjQKx.exe
  C:\Windows\System\atZjQKx.exe
  2⤵
  PID:6460
- C:\Windows\System\XPOkmdk.exe
  C:\Windows\System\XPOkmdk.exe
  2⤵
  PID:6476
- C:\Windows\System\apYnvtz.exe
  C:\Windows\System\apYnvtz.exe
  2⤵
  PID:6496
- C:\Windows\System\jLcOmEM.exe
  C:\Windows\System\jLcOmEM.exe
  2⤵
  PID:6512
- C:\Windows\System\GoMDyxd.exe
  C:\Windows\System\GoMDyxd.exe
  2⤵
  PID:6528
- C:\Windows\System\TBXwTTJ.exe
  C:\Windows\System\TBXwTTJ.exe
  2⤵
  PID:6548
- C:\Windows\System\lozWgdV.exe
  C:\Windows\System\lozWgdV.exe
  2⤵
  PID:6568
- C:\Windows\System\GSNoAYU.exe
  C:\Windows\System\GSNoAYU.exe
  2⤵
  PID:6588
- C:\Windows\System\PxPoWNM.exe
  C:\Windows\System\PxPoWNM.exe
  2⤵
  PID:6628
- C:\Windows\System\yJaRQif.exe
  C:\Windows\System\yJaRQif.exe
  2⤵
  PID:6648
- C:\Windows\System\LXphEAX.exe
  C:\Windows\System\LXphEAX.exe
  2⤵
  PID:6676
- C:\Windows\System\xcrtUWl.exe
  C:\Windows\System\xcrtUWl.exe
  2⤵
  PID:6700
- C:\Windows\System\VWRsZBI.exe
  C:\Windows\System\VWRsZBI.exe
  2⤵
  PID:6716
- C:\Windows\System\glzOavc.exe
  C:\Windows\System\glzOavc.exe
  2⤵
  PID:6736
- C:\Windows\System\rgPxZuo.exe
  C:\Windows\System\rgPxZuo.exe
  2⤵
  PID:6752
- C:\Windows\System\PeNKUTU.exe
  C:\Windows\System\PeNKUTU.exe
  2⤵
  PID:6768
- C:\Windows\System\pbtbTxW.exe
  C:\Windows\System\pbtbTxW.exe
  2⤵
  PID:6788
- C:\Windows\System\ofbtkPW.exe
  C:\Windows\System\ofbtkPW.exe
  2⤵
  PID:6804
- C:\Windows\System\ASRycJj.exe
  C:\Windows\System\ASRycJj.exe
  2⤵
  PID:6824
- C:\Windows\System\uTXiXSk.exe
  C:\Windows\System\uTXiXSk.exe
  2⤵
  PID:6844
- C:\Windows\System\frejuwk.exe
  C:\Windows\System\frejuwk.exe
  2⤵
  PID:6860
- C:\Windows\System\knNhIXw.exe
  C:\Windows\System\knNhIXw.exe
  2⤵
  PID:6888
- C:\Windows\System\aENUttm.exe
  C:\Windows\System\aENUttm.exe
  2⤵
  PID:6908
- C:\Windows\System\RMwbLvx.exe
  C:\Windows\System\RMwbLvx.exe
  2⤵
  PID:6924
- C:\Windows\System\ULlTVKN.exe
  C:\Windows\System\ULlTVKN.exe
  2⤵
  PID:6940
- C:\Windows\System\nILlzRq.exe
  C:\Windows\System\nILlzRq.exe
  2⤵
  PID:6960
- C:\Windows\System\KUznCdb.exe
  C:\Windows\System\KUznCdb.exe
  2⤵
  PID:6980
- C:\Windows\System\rtUDneO.exe
  C:\Windows\System\rtUDneO.exe
  2⤵
  PID:6996
- C:\Windows\System\AXEQObo.exe
  C:\Windows\System\AXEQObo.exe
  2⤵
  PID:7012
- C:\Windows\System\MijtXSl.exe
  C:\Windows\System\MijtXSl.exe
  2⤵
  PID:7028
- C:\Windows\System\rihsBVG.exe
  C:\Windows\System\rihsBVG.exe
  2⤵
  PID:7044
- C:\Windows\System\JjQgwdm.exe
  C:\Windows\System\JjQgwdm.exe
  2⤵
  PID:7060
- C:\Windows\System\APJCaNt.exe
  C:\Windows\System\APJCaNt.exe
  2⤵
  PID:7076
- C:\Windows\System\LnKmEjp.exe
  C:\Windows\System\LnKmEjp.exe
  2⤵
  PID:7096
- C:\Windows\System\GkYLLMn.exe
  C:\Windows\System\GkYLLMn.exe
  2⤵
  PID:7112
- C:\Windows\System\caZSQRb.exe
  C:\Windows\System\caZSQRb.exe
  2⤵
  PID:7132
- C:\Windows\System\goLLydw.exe
  C:\Windows\System\goLLydw.exe
  2⤵
  PID:7152
- C:\Windows\System\kBnFOvj.exe
  C:\Windows\System\kBnFOvj.exe
  2⤵
  PID:5844
- C:\Windows\System\BJyZGNe.exe
  C:\Windows\System\BJyZGNe.exe
  2⤵
  PID:5828
- C:\Windows\System\DnPwwlE.exe
  C:\Windows\System\DnPwwlE.exe
  2⤵
  PID:5688
- C:\Windows\System\yvBPexg.exe
  C:\Windows\System\yvBPexg.exe
  2⤵
  PID:5760
- C:\Windows\System\nsYJhAh.exe
  C:\Windows\System\nsYJhAh.exe
  2⤵
  PID:4932
- C:\Windows\System\HcRCbjP.exe
  C:\Windows\System\HcRCbjP.exe
  2⤵
  PID:5376
- C:\Windows\System\pyyKqjE.exe
  C:\Windows\System\pyyKqjE.exe
  2⤵
  PID:6392
- C:\Windows\System\Pugukjz.exe
  C:\Windows\System\Pugukjz.exe
  2⤵
  PID:6240
- C:\Windows\System\hWJeXsI.exe
  C:\Windows\System\hWJeXsI.exe
  2⤵
  PID:6536
- C:\Windows\System\ljRqKjD.exe
  C:\Windows\System\ljRqKjD.exe
  2⤵
  PID:6576
- C:\Windows\System\wKlqTpt.exe
  C:\Windows\System\wKlqTpt.exe
  2⤵
  PID:6584
- C:\Windows\System\BhjEaem.exe
  C:\Windows\System\BhjEaem.exe
  2⤵
  PID:6696
- C:\Windows\System\ZoYNWbx.exe
  C:\Windows\System\ZoYNWbx.exe
  2⤵
  PID:6796
- C:\Windows\System\JPUEcwn.exe
  C:\Windows\System\JPUEcwn.exe
  2⤵
  PID:6832
- C:\Windows\System\GZPuDvH.exe
  C:\Windows\System\GZPuDvH.exe
  2⤵
  PID:6868
- C:\Windows\System\PHKPZUb.exe
  C:\Windows\System\PHKPZUb.exe
  2⤵
  PID:6836
- C:\Windows\System\qTSGCkm.exe
  C:\Windows\System\qTSGCkm.exe
  2⤵
  PID:6872
- C:\Windows\System\NczVBsH.exe
  C:\Windows\System\NczVBsH.exe
  2⤵
  PID:6992
- C:\Windows\System\UOCSePQ.exe
  C:\Windows\System\UOCSePQ.exe
  2⤵
  PID:7056
- C:\Windows\System\BqFScMD.exe
  C:\Windows\System\BqFScMD.exe
  2⤵
  PID:7120
- C:\Windows\System\fHMMVQc.exe
  C:\Windows\System\fHMMVQc.exe
  2⤵
  PID:7164
- C:\Windows\System\xuMsevM.exe
  C:\Windows\System\xuMsevM.exe
  2⤵
  PID:6116
- C:\Windows\System\fljXXJF.exe
  C:\Windows\System\fljXXJF.exe
  2⤵
  PID:6176
- C:\Windows\System\xaUpyxc.exe
  C:\Windows\System\xaUpyxc.exe
  2⤵
  PID:5916
- C:\Windows\System\hZIvXml.exe
  C:\Windows\System\hZIvXml.exe
  2⤵
  PID:5864
- C:\Windows\System\kdOoHEI.exe
  C:\Windows\System\kdOoHEI.exe
  2⤵
  PID:5976
- C:\Windows\System\mgCCIqV.exe
  C:\Windows\System\mgCCIqV.exe
  2⤵
  PID:6156
- C:\Windows\System\kmwXOsJ.exe
  C:\Windows\System\kmwXOsJ.exe
  2⤵
  PID:6364
- C:\Windows\System\YEzHQwp.exe
  C:\Windows\System\YEzHQwp.exe
  2⤵
  PID:6064
- C:\Windows\System\QOSGFRl.exe
  C:\Windows\System\QOSGFRl.exe
  2⤵
  PID:6140
- C:\Windows\System\xvtrBDG.exe
  C:\Windows\System\xvtrBDG.exe
  2⤵
  PID:4564
- C:\Windows\System\quszqkH.exe
  C:\Windows\System\quszqkH.exe
  2⤵
  PID:6852
- C:\Windows\System\cUCdPNJ.exe
  C:\Windows\System\cUCdPNJ.exe
  2⤵
  PID:5308
- C:\Windows\System\GDfuiXC.exe
  C:\Windows\System\GDfuiXC.exe
  2⤵
  PID:4184
- C:\Windows\System\QopygcP.exe
  C:\Windows\System\QopygcP.exe
  2⤵
  PID:5388
- C:\Windows\System\IwwqSum.exe
  C:\Windows\System\IwwqSum.exe
  2⤵
  PID:5428
- C:\Windows\System\JjTVfci.exe
  C:\Windows\System\JjTVfci.exe
  2⤵
  PID:5288
- C:\Windows\System\LGejSeY.exe
  C:\Windows\System\LGejSeY.exe
  2⤵
  PID:5256
- C:\Windows\System\ZAqChSV.exe
  C:\Windows\System\ZAqChSV.exe
  2⤵
  PID:5656
- C:\Windows\System\qdSDdNo.exe
  C:\Windows\System\qdSDdNo.exe
  2⤵
  PID:5776
- C:\Windows\System\eClZhWK.exe
  C:\Windows\System\eClZhWK.exe
  2⤵
  PID:6008
- C:\Windows\System\wadvYLk.exe
  C:\Windows\System\wadvYLk.exe
  2⤵
  PID:5396
- C:\Windows\System\sGGrCCP.exe
  C:\Windows\System\sGGrCCP.exe
  2⤵
  PID:5456
- C:\Windows\System\OvjZhkv.exe
  C:\Windows\System\OvjZhkv.exe
  2⤵
  PID:6160
- C:\Windows\System\tENLDEB.exe
  C:\Windows\System\tENLDEB.exe
  2⤵
  PID:6224
- C:\Windows\System\dwcuzdb.exe
  C:\Windows\System\dwcuzdb.exe
  2⤵
  PID:6292
- C:\Windows\System\LfyjXrk.exe
  C:\Windows\System\LfyjXrk.exe
  2⤵
  PID:6368
- C:\Windows\System\ZTEODbx.exe
  C:\Windows\System\ZTEODbx.exe
  2⤵
  PID:6416
- C:\Windows\System\BXHtBxG.exe
  C:\Windows\System\BXHtBxG.exe
  2⤵
  PID:6456
- C:\Windows\System\kOCUcwx.exe
  C:\Windows\System\kOCUcwx.exe
  2⤵
  PID:6524
- C:\Windows\System\HjmbHXB.exe
  C:\Windows\System\HjmbHXB.exe
  2⤵
  PID:6596
- C:\Windows\System\WxTZVaR.exe
  C:\Windows\System\WxTZVaR.exe
  2⤵
  PID:6612
- C:\Windows\System\ZgBclPe.exe
  C:\Windows\System\ZgBclPe.exe
  2⤵
  PID:6656
- C:\Windows\System\hTjdEeR.exe
  C:\Windows\System\hTjdEeR.exe
  2⤵
  PID:6672
- C:\Windows\System\YylsxBY.exe
  C:\Windows\System\YylsxBY.exe
  2⤵
  PID:6780
- C:\Windows\System\IpYHYRg.exe
  C:\Windows\System\IpYHYRg.exe
  2⤵
  PID:6856
- C:\Windows\System\yhxhaIB.exe
  C:\Windows\System\yhxhaIB.exe
  2⤵
  PID:6936
- C:\Windows\System\jZLhUnq.exe
  C:\Windows\System\jZLhUnq.exe
  2⤵
  PID:7008
- C:\Windows\System\QYbMbIY.exe
  C:\Windows\System\QYbMbIY.exe
  2⤵
  PID:7108
- C:\Windows\System\bfeJZXV.exe
  C:\Windows\System\bfeJZXV.exe
  2⤵
  PID:5900
- C:\Windows\System\PBLKyUw.exe
  C:\Windows\System\PBLKyUw.exe
  2⤵
  PID:5724
- C:\Windows\System\SediMBq.exe
  C:\Windows\System\SediMBq.exe
  2⤵
  PID:5312
- C:\Windows\System\MnvAzOv.exe
  C:\Windows\System\MnvAzOv.exe
  2⤵
  PID:6312
- C:\Windows\System\EcdOPyN.exe
  C:\Windows\System\EcdOPyN.exe
  2⤵
  PID:6308
- C:\Windows\System\ERRlelS.exe
  C:\Windows\System\ERRlelS.exe
  2⤵
  PID:6436
- C:\Windows\System\UpHTMcO.exe
  C:\Windows\System\UpHTMcO.exe
  2⤵
  PID:6508
- C:\Windows\System\HlUTfiX.exe
  C:\Windows\System\HlUTfiX.exe
  2⤵
  PID:6640
- C:\Windows\System\ejCbFsU.exe
  C:\Windows\System\ejCbFsU.exe
  2⤵
  PID:6544
- C:\Windows\System\DBohZlo.exe
  C:\Windows\System\DBohZlo.exe
  2⤵
  PID:6732
- C:\Windows\System\nRHyGlD.exe
  C:\Windows\System\nRHyGlD.exe
  2⤵
  PID:4724
- C:\Windows\System\WxrCYaT.exe
  C:\Windows\System\WxrCYaT.exe
  2⤵
  PID:7052
- C:\Windows\System\CZiWOkk.exe
  C:\Windows\System\CZiWOkk.exe
  2⤵
  PID:6236
- C:\Windows\System\kwzZccf.exe
  C:\Windows\System\kwzZccf.exe
  2⤵
  PID:6028
- C:\Windows\System\youwboC.exe
  C:\Windows\System\youwboC.exe
  2⤵
  PID:6948
- C:\Windows\System\NbUSuGL.exe
  C:\Windows\System\NbUSuGL.exe
  2⤵
  PID:5160
- C:\Windows\System\jsBeIxi.exe
  C:\Windows\System\jsBeIxi.exe
  2⤵
  PID:5624
- C:\Windows\System\wtTxQaC.exe
  C:\Windows\System\wtTxQaC.exe
  2⤵
  PID:5500
- C:\Windows\System\ohHEhob.exe
  C:\Windows\System\ohHEhob.exe
  2⤵
  PID:7088
- C:\Windows\System\qCrMSyE.exe
  C:\Windows\System\qCrMSyE.exe
  2⤵
  PID:6204
- C:\Windows\System\kttgfqq.exe
  C:\Windows\System\kttgfqq.exe
  2⤵
  PID:5992
- C:\Windows\System\fpdYLaj.exe
  C:\Windows\System\fpdYLaj.exe
  2⤵
  PID:6744
- C:\Windows\System\xoqWzFl.exe
  C:\Windows\System\xoqWzFl.exe
  2⤵
  PID:5192
- C:\Windows\System\fpIadXt.exe
  C:\Windows\System\fpIadXt.exe
  2⤵
  PID:6220
- C:\Windows\System\ZdfRfmh.exe
  C:\Windows\System\ZdfRfmh.exe
  2⤵
  PID:5884
- C:\Windows\System\ObRykTz.exe
  C:\Windows\System\ObRykTz.exe
  2⤵
  PID:6332
- C:\Windows\System\fTeVErN.exe
  C:\Windows\System\fTeVErN.exe
  2⤵
  PID:6564
- C:\Windows\System\QhWQGQE.exe
  C:\Windows\System\QhWQGQE.exe
  2⤵
  PID:6776
- C:\Windows\System\BkEImIs.exe
  C:\Windows\System\BkEImIs.exe
  2⤵
  PID:5940
- C:\Windows\System\ZQTjJRF.exe
  C:\Windows\System\ZQTjJRF.exe
  2⤵
  PID:6276
- C:\Windows\System\EAvsgmx.exe
  C:\Windows\System\EAvsgmx.exe
  2⤵
  PID:5736
- C:\Windows\System\cLfFjIS.exe
  C:\Windows\System\cLfFjIS.exe
  2⤵
  PID:6692
- C:\Windows\System\XlQaLqI.exe
  C:\Windows\System\XlQaLqI.exe
  2⤵
  PID:5924
- C:\Windows\System\WfBRRrm.exe
  C:\Windows\System\WfBRRrm.exe
  2⤵
  PID:7160
- C:\Windows\System\kQzBMOp.exe
  C:\Windows\System\kQzBMOp.exe
  2⤵
  PID:6100
- C:\Windows\System\nuQUfWc.exe
  C:\Windows\System\nuQUfWc.exe
  2⤵
  PID:6048
- C:\Windows\System\OYDFvcX.exe
  C:\Windows\System\OYDFvcX.exe
  2⤵
  PID:6256
- C:\Windows\System\DymPreG.exe
  C:\Windows\System\DymPreG.exe
  2⤵
  PID:6408
- C:\Windows\System\UslZrYc.exe
  C:\Windows\System\UslZrYc.exe
  2⤵
  PID:5424
- C:\Windows\System\ByeZFuj.exe
  C:\Windows\System\ByeZFuj.exe
  2⤵
  PID:6272
- C:\Windows\System\TBevAcM.exe
  C:\Windows\System\TBevAcM.exe
  2⤵
  PID:6492
- C:\Windows\System\Vzekclo.exe
  C:\Windows\System\Vzekclo.exe
  2⤵
  PID:6820
- C:\Windows\System\etCPyrD.exe
  C:\Windows\System\etCPyrD.exe
  2⤵
  PID:5408
- C:\Windows\System\GKyejhM.exe
  C:\Windows\System\GKyejhM.exe
  2⤵
  PID:6760
- C:\Windows\System\zvrLNMS.exe
  C:\Windows\System\zvrLNMS.exe
  2⤵
  PID:7176
- C:\Windows\System\TQDcRHy.exe
  C:\Windows\System\TQDcRHy.exe
  2⤵
  PID:7196
- C:\Windows\System\lhIADPD.exe
  C:\Windows\System\lhIADPD.exe
  2⤵
  PID:7212
- C:\Windows\System\RZfyBuE.exe
  C:\Windows\System\RZfyBuE.exe
  2⤵
  PID:7228
- C:\Windows\System\YYgPVHg.exe
  C:\Windows\System\YYgPVHg.exe
  2⤵
  PID:7244
- C:\Windows\System\rOVJYdY.exe
  C:\Windows\System\rOVJYdY.exe
  2⤵
  PID:7264
- C:\Windows\System\amqTimI.exe
  C:\Windows\System\amqTimI.exe
  2⤵
  PID:7280
- C:\Windows\System\VlmnuoT.exe
  C:\Windows\System\VlmnuoT.exe
  2⤵
  PID:7296
- C:\Windows\System\ULxNtIb.exe
  C:\Windows\System\ULxNtIb.exe
  2⤵
  PID:7312
- C:\Windows\System\ZoUtSiO.exe
  C:\Windows\System\ZoUtSiO.exe
  2⤵
  PID:7328
- C:\Windows\System\unRrVIh.exe
  C:\Windows\System\unRrVIh.exe
  2⤵
  PID:7344
- C:\Windows\System\oWDXEQT.exe
  C:\Windows\System\oWDXEQT.exe
  2⤵
  PID:7360
- C:\Windows\System\EGyuXdM.exe
  C:\Windows\System\EGyuXdM.exe
  2⤵
  PID:7376
- C:\Windows\System\FbYGWax.exe
  C:\Windows\System\FbYGWax.exe
  2⤵
  PID:7392
- C:\Windows\System\febJnOQ.exe
  C:\Windows\System\febJnOQ.exe
  2⤵
  PID:7408
- C:\Windows\System\ytgdCXL.exe
  C:\Windows\System\ytgdCXL.exe
  2⤵
  PID:7424
- C:\Windows\System\ZfIyvNt.exe
  C:\Windows\System\ZfIyvNt.exe
  2⤵
  PID:7440
- C:\Windows\System\GbIpqNG.exe
  C:\Windows\System\GbIpqNG.exe
  2⤵
  PID:7456
- C:\Windows\System\HrnZesz.exe
  C:\Windows\System\HrnZesz.exe
  2⤵
  PID:7472
- C:\Windows\System\RyJFiRT.exe
  C:\Windows\System\RyJFiRT.exe
  2⤵
  PID:7488
- C:\Windows\System\iRNEXFY.exe
  C:\Windows\System\iRNEXFY.exe
  2⤵
  PID:7504
- C:\Windows\System\zdumVtX.exe
  C:\Windows\System\zdumVtX.exe
  2⤵
  PID:7520
- C:\Windows\System\wfXSCkj.exe
  C:\Windows\System\wfXSCkj.exe
  2⤵
  PID:7536
- C:\Windows\System\IrCuIrK.exe
  C:\Windows\System\IrCuIrK.exe
  2⤵
  PID:7552
- C:\Windows\System\nIyWkaT.exe
  C:\Windows\System\nIyWkaT.exe
  2⤵
  PID:7568
- C:\Windows\System\POuNCEu.exe
  C:\Windows\System\POuNCEu.exe
  2⤵
  PID:7584
- C:\Windows\System\ZwtDAXR.exe
  C:\Windows\System\ZwtDAXR.exe
  2⤵
  PID:7600
- C:\Windows\System\xbMnaxg.exe
  C:\Windows\System\xbMnaxg.exe
  2⤵
  PID:7616
- C:\Windows\System\ueBGCgI.exe
  C:\Windows\System\ueBGCgI.exe
  2⤵
  PID:7632
- C:\Windows\System\wcOwTri.exe
  C:\Windows\System\wcOwTri.exe
  2⤵
  PID:7648
- C:\Windows\System\BTxQOhp.exe
  C:\Windows\System\BTxQOhp.exe
  2⤵
  PID:7664
- C:\Windows\System\jWqmoWa.exe
  C:\Windows\System\jWqmoWa.exe
  2⤵
  PID:7680
- C:\Windows\System\QgarpYf.exe
  C:\Windows\System\QgarpYf.exe
  2⤵
  PID:7696
- C:\Windows\System\fOMSPSw.exe
  C:\Windows\System\fOMSPSw.exe
  2⤵
  PID:7712
- C:\Windows\System\kiwZHJG.exe
  C:\Windows\System\kiwZHJG.exe
  2⤵
  PID:7728
- C:\Windows\System\EYfnRWb.exe
  C:\Windows\System\EYfnRWb.exe
  2⤵
  PID:7744
- C:\Windows\System\ppMsSMz.exe
  C:\Windows\System\ppMsSMz.exe
  2⤵
  PID:7760
- C:\Windows\System\xdXUsdv.exe
  C:\Windows\System\xdXUsdv.exe
  2⤵
  PID:7776
- C:\Windows\System\akJhbWS.exe
  C:\Windows\System\akJhbWS.exe
  2⤵
  PID:7792
- C:\Windows\System\SlcqAZN.exe
  C:\Windows\System\SlcqAZN.exe
  2⤵
  PID:7808
- C:\Windows\System\TsAmliv.exe
  C:\Windows\System\TsAmliv.exe
  2⤵
  PID:7824
- C:\Windows\System\nvkfxKu.exe
  C:\Windows\System\nvkfxKu.exe
  2⤵
  PID:7840
- C:\Windows\System\aypiMne.exe
  C:\Windows\System\aypiMne.exe
  2⤵
  PID:7856
- C:\Windows\System\BIlvoiL.exe
  C:\Windows\System\BIlvoiL.exe
  2⤵
  PID:7872
- C:\Windows\System\FDggJrO.exe
  C:\Windows\System\FDggJrO.exe
  2⤵
  PID:7888
- C:\Windows\System\SUbbqZO.exe
  C:\Windows\System\SUbbqZO.exe
  2⤵
  PID:7904
- C:\Windows\System\UYoHXib.exe
  C:\Windows\System\UYoHXib.exe
  2⤵
  PID:7920
- C:\Windows\System\ymsoojx.exe
  C:\Windows\System\ymsoojx.exe
  2⤵
  PID:7936
- C:\Windows\System\ICEtvxa.exe
  C:\Windows\System\ICEtvxa.exe
  2⤵
  PID:7952
- C:\Windows\System\afpAnzP.exe
  C:\Windows\System\afpAnzP.exe
  2⤵
  PID:7968
- C:\Windows\System\ZlGPnbV.exe
  C:\Windows\System\ZlGPnbV.exe
  2⤵
  PID:7984
- C:\Windows\System\cLDkEUP.exe
  C:\Windows\System\cLDkEUP.exe
  2⤵
  PID:8000
- C:\Windows\System\XKiYuUM.exe
  C:\Windows\System\XKiYuUM.exe
  2⤵
  PID:8016
- C:\Windows\System\FbxzMfL.exe
  C:\Windows\System\FbxzMfL.exe
  2⤵
  PID:8032
- C:\Windows\System\ctYSIaP.exe
  C:\Windows\System\ctYSIaP.exe
  2⤵
  PID:8048
- C:\Windows\System\RXVHAdF.exe
  C:\Windows\System\RXVHAdF.exe
  2⤵
  PID:8064
- C:\Windows\System\LmiYBvl.exe
  C:\Windows\System\LmiYBvl.exe
  2⤵
  PID:8080
- C:\Windows\System\pYNrjMC.exe
  C:\Windows\System\pYNrjMC.exe
  2⤵
  PID:8096
- C:\Windows\System\jAsnSel.exe
  C:\Windows\System\jAsnSel.exe
  2⤵
  PID:8112
- C:\Windows\System\gMaFymB.exe
  C:\Windows\System\gMaFymB.exe
  2⤵
  PID:8128
- C:\Windows\System\NYFzpZp.exe
  C:\Windows\System\NYFzpZp.exe
  2⤵
  PID:8144
- C:\Windows\System\qJvDnfi.exe
  C:\Windows\System\qJvDnfi.exe
  2⤵
  PID:8160
- C:\Windows\System\rlaTqWM.exe
  C:\Windows\System\rlaTqWM.exe
  2⤵
  PID:8176
- C:\Windows\System\cyAdlBb.exe
  C:\Windows\System\cyAdlBb.exe
  2⤵
  PID:5980
- C:\Windows\System\uCkdCES.exe
  C:\Windows\System\uCkdCES.exe
  2⤵
  PID:6540
- C:\Windows\System\XqIBRWb.exe
  C:\Windows\System\XqIBRWb.exe
  2⤵
  PID:5108
- C:\Windows\System\HnVZMcK.exe
  C:\Windows\System\HnVZMcK.exe
  2⤵
  PID:6988
- C:\Windows\System\sYLesdy.exe
  C:\Windows\System\sYLesdy.exe
  2⤵
  PID:4712
- C:\Windows\System\TASUsqk.exe
  C:\Windows\System\TASUsqk.exe
  2⤵
  PID:6932
- C:\Windows\System\CWiuAPG.exe
  C:\Windows\System\CWiuAPG.exe
  2⤵
  PID:6920
- C:\Windows\System\tlYpeFf.exe
  C:\Windows\System\tlYpeFf.exe
  2⤵
  PID:6668
- C:\Windows\System\whImntm.exe
  C:\Windows\System\whImntm.exe
  2⤵
  PID:6748
- C:\Windows\System\LfOGUTr.exe
  C:\Windows\System\LfOGUTr.exe
  2⤵
  PID:7148
- C:\Windows\System\kAxXshL.exe
  C:\Windows\System\kAxXshL.exe
  2⤵
  PID:6972
- C:\Windows\System\tWaAtfI.exe
  C:\Windows\System\tWaAtfI.exe
  2⤵
  PID:7192
- C:\Windows\System\zZkJBMq.exe
  C:\Windows\System\zZkJBMq.exe
  2⤵
  PID:7224
- C:\Windows\System\jhjqxoo.exe
  C:\Windows\System\jhjqxoo.exe
  2⤵
  PID:7256
- C:\Windows\System\JXJztMr.exe
  C:\Windows\System\JXJztMr.exe
  2⤵
  PID:7320
- C:\Windows\System\rlrheLh.exe
  C:\Windows\System\rlrheLh.exe
  2⤵
  PID:7384
- C:\Windows\System\pBINJeU.exe
  C:\Windows\System\pBINJeU.exe
  2⤵
  PID:7448
- C:\Windows\System\OhUXqXA.exe
  C:\Windows\System\OhUXqXA.exe
  2⤵
  PID:7516
- C:\Windows\System\RqGjjbp.exe
  C:\Windows\System\RqGjjbp.exe
  2⤵
  PID:7548
- C:\Windows\System\Inkkzmv.exe
  C:\Windows\System\Inkkzmv.exe
  2⤵
  PID:7640
- C:\Windows\System\lrjzDcQ.exe
  C:\Windows\System\lrjzDcQ.exe
  2⤵
  PID:7704
- C:\Windows\System\Sdyeszb.exe
  C:\Windows\System\Sdyeszb.exe
  2⤵
  PID:7768
- C:\Windows\System\kjWIIrp.exe
  C:\Windows\System\kjWIIrp.exe
  2⤵
  PID:7276
- C:\Windows\System\gRrbYRu.exe
  C:\Windows\System\gRrbYRu.exe
  2⤵
  PID:7868
- C:\Windows\System\FRDLjhB.exe
  C:\Windows\System\FRDLjhB.exe
  2⤵
  PID:7960
- C:\Windows\System\cADnefQ.exe
  C:\Windows\System\cADnefQ.exe
  2⤵
  PID:7996
- C:\Windows\System\QivzPug.exe
  C:\Windows\System\QivzPug.exe
  2⤵
  PID:8060
- C:\Windows\System\SsZXqPI.exe
  C:\Windows\System\SsZXqPI.exe
  2⤵
  PID:8120
- C:\Windows\System\qZEUCOX.exe
  C:\Windows\System\qZEUCOX.exe
  2⤵
  PID:8184
- C:\Windows\System\LeiHKvn.exe
  C:\Windows\System\LeiHKvn.exe
  2⤵
  PID:5912
- C:\Windows\System\RZGGUYz.exe
  C:\Windows\System\RZGGUYz.exe
  2⤵
  PID:7184
- C:\Windows\System\BcfXbjg.exe
  C:\Windows\System\BcfXbjg.exe
  2⤵
  PID:7208
- C:\Windows\System\VhPMzmV.exe
  C:\Windows\System\VhPMzmV.exe
  2⤵
  PID:7272
- C:\Windows\System\IbnpsGb.exe
  C:\Windows\System\IbnpsGb.exe
  2⤵
  PID:7624
- C:\Windows\System\cIdXlaa.exe
  C:\Windows\System\cIdXlaa.exe
  2⤵
  PID:7340
- C:\Windows\System\enYoNVB.exe
  C:\Windows\System\enYoNVB.exe
  2⤵
  PID:7400
- C:\Windows\System\nWliQAI.exe
  C:\Windows\System\nWliQAI.exe
  2⤵
  PID:7464
- C:\Windows\System\QvxkaPb.exe
  C:\Windows\System\QvxkaPb.exe
  2⤵
  PID:7560
- C:\Windows\System\KGVDTFr.exe
  C:\Windows\System\KGVDTFr.exe
  2⤵
  PID:7628
- C:\Windows\System\SirUBDF.exe
  C:\Windows\System\SirUBDF.exe
  2⤵
  PID:7692
- C:\Windows\System\HuezgMS.exe
  C:\Windows\System\HuezgMS.exe
  2⤵
  PID:7788
- C:\Windows\System\JCLiVBa.exe
  C:\Windows\System\JCLiVBa.exe
  2⤵
  PID:7852
- C:\Windows\System\BCbrroS.exe
  C:\Windows\System\BCbrroS.exe
  2⤵
  PID:7916
- C:\Windows\System\nijFnEi.exe
  C:\Windows\System\nijFnEi.exe
  2⤵
  PID:7980
- C:\Windows\System\twZNojP.exe
  C:\Windows\System\twZNojP.exe
  2⤵
  PID:8044
- C:\Windows\System\qHOtCgs.exe
  C:\Windows\System\qHOtCgs.exe
  2⤵
  PID:8108
- C:\Windows\System\agrsjwB.exe
  C:\Windows\System\agrsjwB.exe
  2⤵
  PID:8172
- C:\Windows\System\XWhPrOD.exe
  C:\Windows\System\XWhPrOD.exe
  2⤵
  PID:5512
- C:\Windows\System\RCjPFOX.exe
  C:\Windows\System\RCjPFOX.exe
  2⤵
  PID:5684
- C:\Windows\System\iMbOcES.exe
  C:\Windows\System\iMbOcES.exe
  2⤵
  PID:6352
- C:\Windows\System\rBfriun.exe
  C:\Windows\System\rBfriun.exe
  2⤵
  PID:7576
- C:\Windows\System\GQaSJFJ.exe
  C:\Windows\System\GQaSJFJ.exe
  2⤵
  PID:7804
- C:\Windows\System\LunxoyP.exe
  C:\Windows\System\LunxoyP.exe
  2⤵
  PID:7356
- C:\Windows\System\zyhFcey.exe
  C:\Windows\System\zyhFcey.exe
  2⤵
  PID:8028
- C:\Windows\System\IaqLlWP.exe
  C:\Windows\System\IaqLlWP.exe
  2⤵
  PID:7752
- C:\Windows\System\STdXxIG.exe
  C:\Windows\System\STdXxIG.exe
  2⤵
  PID:7512
- C:\Windows\System\UaDiTRx.exe
  C:\Windows\System\UaDiTRx.exe
  2⤵
  PID:7740
- C:\Windows\System\gwgbvwk.exe
  C:\Windows\System\gwgbvwk.exe
  2⤵
  PID:7992
- C:\Windows\System\uvQnVBi.exe
  C:\Windows\System\uvQnVBi.exe
  2⤵
  PID:6172
- C:\Windows\System\OtwEYHp.exe
  C:\Windows\System\OtwEYHp.exe
  2⤵
  PID:7528
- C:\Windows\System\qnObYsF.exe
  C:\Windows\System\qnObYsF.exe
  2⤵
  PID:7592
- C:\Windows\System\ZKvOcWq.exe
  C:\Windows\System\ZKvOcWq.exe
  2⤵
  PID:7500
- C:\Windows\System\gBhYOEj.exe
  C:\Windows\System\gBhYOEj.exe
  2⤵
  PID:7784
- C:\Windows\System\XIlxDHW.exe
  C:\Windows\System\XIlxDHW.exe
  2⤵
  PID:8012
- C:\Windows\System\aUjTJNN.exe
  C:\Windows\System\aUjTJNN.exe
  2⤵
  PID:6044
- C:\Windows\System\bxwTkzj.exe
  C:\Windows\System\bxwTkzj.exe
  2⤵
  PID:7932
- C:\Windows\System\xnxzGPb.exe
  C:\Windows\System\xnxzGPb.exe
  2⤵
  PID:5516
- C:\Windows\System\SusUnpp.exe
  C:\Windows\System\SusUnpp.exe
  2⤵
  PID:6816
- C:\Windows\System\dcnnEui.exe
  C:\Windows\System\dcnnEui.exe
  2⤵
  PID:7420
- C:\Windows\System\WqukBSz.exe
  C:\Windows\System\WqukBSz.exe
  2⤵
  PID:8168
- C:\Windows\System\xRleCIN.exe
  C:\Windows\System\xRleCIN.exe
  2⤵
  PID:6472
- C:\Windows\System\qMFPHDs.exe
  C:\Windows\System\qMFPHDs.exe
  2⤵
  PID:8200
- C:\Windows\System\ToHYzyB.exe
  C:\Windows\System\ToHYzyB.exe
  2⤵
  PID:8216
- C:\Windows\System\AsCsvAs.exe
  C:\Windows\System\AsCsvAs.exe
  2⤵
  PID:8232
- C:\Windows\System\NpydKqG.exe
  C:\Windows\System\NpydKqG.exe
  2⤵
  PID:8248
- C:\Windows\System\QrQxErG.exe
  C:\Windows\System\QrQxErG.exe
  2⤵
  PID:8264
- C:\Windows\System\wUlfcaD.exe
  C:\Windows\System\wUlfcaD.exe
  2⤵
  PID:8280
- C:\Windows\System\XVaNRMO.exe
  C:\Windows\System\XVaNRMO.exe
  2⤵
  PID:8296
- C:\Windows\System\xOEnXLa.exe
  C:\Windows\System\xOEnXLa.exe
  2⤵
  PID:8312
- C:\Windows\System\ZpaLqTI.exe
  C:\Windows\System\ZpaLqTI.exe
  2⤵
  PID:8328
- C:\Windows\System\kkSIjdp.exe
  C:\Windows\System\kkSIjdp.exe
  2⤵
  PID:8344
- C:\Windows\System\dzvROAU.exe
  C:\Windows\System\dzvROAU.exe
  2⤵
  PID:8360
- C:\Windows\System\vtgWMUC.exe
  C:\Windows\System\vtgWMUC.exe
  2⤵
  PID:8376
- C:\Windows\System\qdDOWYP.exe
  C:\Windows\System\qdDOWYP.exe
  2⤵
  PID:8392
- C:\Windows\System\vRVWEWO.exe
  C:\Windows\System\vRVWEWO.exe
  2⤵
  PID:8412
- C:\Windows\System\WgYbzBu.exe
  C:\Windows\System\WgYbzBu.exe
  2⤵
  PID:8428
- C:\Windows\System\dvNGNoH.exe
  C:\Windows\System\dvNGNoH.exe
  2⤵
  PID:8444
- C:\Windows\System\gOIyPQu.exe
  C:\Windows\System\gOIyPQu.exe
  2⤵
  PID:8460
- C:\Windows\System\bhiTeKf.exe
  C:\Windows\System\bhiTeKf.exe
  2⤵
  PID:8476
- C:\Windows\System\DhvNobp.exe
  C:\Windows\System\DhvNobp.exe
  2⤵
  PID:8492
- C:\Windows\System\IjXSMdg.exe
  C:\Windows\System\IjXSMdg.exe
  2⤵
  PID:8508
- C:\Windows\System\bPSeMHq.exe
  C:\Windows\System\bPSeMHq.exe
  2⤵
  PID:8524
- C:\Windows\System\lgPKqpD.exe
  C:\Windows\System\lgPKqpD.exe
  2⤵
  PID:8540
- C:\Windows\System\RUQQFXS.exe
  C:\Windows\System\RUQQFXS.exe
  2⤵
  PID:8556
- C:\Windows\System\vkbOsKJ.exe
  C:\Windows\System\vkbOsKJ.exe
  2⤵
  PID:8572
- C:\Windows\System\NhgrwLZ.exe
  C:\Windows\System\NhgrwLZ.exe
  2⤵
  PID:8588
- C:\Windows\System\LDtmgab.exe
  C:\Windows\System\LDtmgab.exe
  2⤵
  PID:8604
- C:\Windows\System\TyTkwFN.exe
  C:\Windows\System\TyTkwFN.exe
  2⤵
  PID:8620
- C:\Windows\System\vlahZIS.exe
  C:\Windows\System\vlahZIS.exe
  2⤵
  PID:8636
- C:\Windows\System\pJmjCGT.exe
  C:\Windows\System\pJmjCGT.exe
  2⤵
  PID:8652
- C:\Windows\System\YvyVksy.exe
  C:\Windows\System\YvyVksy.exe
  2⤵
  PID:8668
- C:\Windows\System\cooQRaG.exe
  C:\Windows\System\cooQRaG.exe
  2⤵
  PID:8684
- C:\Windows\System\nqNAFUz.exe
  C:\Windows\System\nqNAFUz.exe
  2⤵
  PID:8700
- C:\Windows\System\phsjUGL.exe
  C:\Windows\System\phsjUGL.exe
  2⤵
  PID:8716
- C:\Windows\System\RmaurwP.exe
  C:\Windows\System\RmaurwP.exe
  2⤵
  PID:8732
- C:\Windows\System\BYBCQha.exe
  C:\Windows\System\BYBCQha.exe
  2⤵
  PID:8748
- C:\Windows\System\dVGBhks.exe
  C:\Windows\System\dVGBhks.exe
  2⤵
  PID:8764
- C:\Windows\System\ZsGgdKH.exe
  C:\Windows\System\ZsGgdKH.exe
  2⤵
  PID:8780
- C:\Windows\System\EDeAYuR.exe
  C:\Windows\System\EDeAYuR.exe
  2⤵
  PID:8796
- C:\Windows\System\sRVWBCg.exe
  C:\Windows\System\sRVWBCg.exe
  2⤵
  PID:8812
- C:\Windows\System\jBZQGHP.exe
  C:\Windows\System\jBZQGHP.exe
  2⤵
  PID:8828
- C:\Windows\System\hjKrLRt.exe
  C:\Windows\System\hjKrLRt.exe
  2⤵
  PID:8844
- C:\Windows\System\ZIgmYBE.exe
  C:\Windows\System\ZIgmYBE.exe
  2⤵
  PID:8860
- C:\Windows\System\LuSZmiH.exe
  C:\Windows\System\LuSZmiH.exe
  2⤵
  PID:8876
- C:\Windows\System\qMJuuol.exe
  C:\Windows\System\qMJuuol.exe
  2⤵
  PID:8892
- C:\Windows\System\MJYEpbk.exe
  C:\Windows\System\MJYEpbk.exe
  2⤵
  PID:8908
- C:\Windows\System\VuHrSjo.exe
  C:\Windows\System\VuHrSjo.exe
  2⤵
  PID:8924
- C:\Windows\System\XHqiQgl.exe
  C:\Windows\System\XHqiQgl.exe
  2⤵
  PID:8940
- C:\Windows\System\MABiGmT.exe
  C:\Windows\System\MABiGmT.exe
  2⤵
  PID:8956
- C:\Windows\System\CYhmSVj.exe
  C:\Windows\System\CYhmSVj.exe
  2⤵
  PID:8972
- C:\Windows\System\wDezBYa.exe
  C:\Windows\System\wDezBYa.exe
  2⤵
  PID:8988
- C:\Windows\System\TfnACWZ.exe
  C:\Windows\System\TfnACWZ.exe
  2⤵
  PID:9004
- C:\Windows\System\BuiNjnN.exe
  C:\Windows\System\BuiNjnN.exe
  2⤵
  PID:9020
- C:\Windows\System\qRHIRxO.exe
  C:\Windows\System\qRHIRxO.exe
  2⤵
  PID:9036
- C:\Windows\System\LRdZnZe.exe
  C:\Windows\System\LRdZnZe.exe
  2⤵
  PID:9052
- C:\Windows\System\FZahaQn.exe
  C:\Windows\System\FZahaQn.exe
  2⤵
  PID:9068
- C:\Windows\System\yvllbaw.exe
  C:\Windows\System\yvllbaw.exe
  2⤵
  PID:9084
- C:\Windows\System\uMwnUSW.exe
  C:\Windows\System\uMwnUSW.exe
  2⤵
  PID:9100
- C:\Windows\System\QhgwsuT.exe
  C:\Windows\System\QhgwsuT.exe
  2⤵
  PID:9116
- C:\Windows\System\nNIjacp.exe
  C:\Windows\System\nNIjacp.exe
  2⤵
  PID:9132
- C:\Windows\System\KdFuoeP.exe
  C:\Windows\System\KdFuoeP.exe
  2⤵
  PID:9148
- C:\Windows\System\JgcidGE.exe
  C:\Windows\System\JgcidGE.exe
  2⤵
  PID:9164
- C:\Windows\System\eIqRRts.exe
  C:\Windows\System\eIqRRts.exe
  2⤵
  PID:9180
- C:\Windows\System\KGYnptL.exe
  C:\Windows\System\KGYnptL.exe
  2⤵
  PID:9196
- C:\Windows\System\pGNBbiu.exe
  C:\Windows\System\pGNBbiu.exe
  2⤵
  PID:9212
- C:\Windows\System\TCiskbS.exe
  C:\Windows\System\TCiskbS.exe
  2⤵
  PID:6560
- C:\Windows\System\zIUhRYH.exe
  C:\Windows\System\zIUhRYH.exe
  2⤵
  PID:8304
- C:\Windows\System\AETUTkr.exe
  C:\Windows\System\AETUTkr.exe
  2⤵
  PID:7976
- C:\Windows\System\RJCxpuL.exe
  C:\Windows\System\RJCxpuL.exe
  2⤵
  PID:8340
- C:\Windows\System\wvoRhnM.exe
  C:\Windows\System\wvoRhnM.exe
  2⤵
  PID:8468
- C:\Windows\System\JkJXCyl.exe
  C:\Windows\System\JkJXCyl.exe
  2⤵
  PID:8372
- C:\Windows\System\LZXUjTN.exe
  C:\Windows\System\LZXUjTN.exe
  2⤵
  PID:8076
- C:\Windows\System\vCReQiU.exe
  C:\Windows\System\vCReQiU.exe
  2⤵
  PID:8632
- C:\Windows\System\rAhqvJQ.exe
  C:\Windows\System\rAhqvJQ.exe
  2⤵
  PID:8600
- C:\Windows\System\MJBSfFe.exe
  C:\Windows\System\MJBSfFe.exe
  2⤵
  PID:8724
- C:\Windows\System\zJGsKOa.exe
  C:\Windows\System\zJGsKOa.exe
  2⤵
  PID:8788
- C:\Windows\System\AwtHibY.exe
  C:\Windows\System\AwtHibY.exe
  2⤵
  PID:8852
- C:\Windows\System\NmEDwOK.exe
  C:\Windows\System\NmEDwOK.exe
  2⤵
  PID:8916
- C:\Windows\System\IGLuulC.exe
  C:\Windows\System\IGLuulC.exe
  2⤵
  PID:8980
- C:\Windows\System\jYESIvk.exe
  C:\Windows\System\jYESIvk.exe
  2⤵
  PID:9044
- C:\Windows\System\TZVDUCp.exe
  C:\Windows\System\TZVDUCp.exe
  2⤵
  PID:9108
- C:\Windows\System\NIodilH.exe
  C:\Windows\System\NIodilH.exe
  2⤵
  PID:9172
- C:\Windows\System\xTnWnrR.exe
  C:\Windows\System\xTnWnrR.exe
  2⤵
  PID:8208
- C:\Windows\System\OtrRrpl.exe
  C:\Windows\System\OtrRrpl.exe
  2⤵
  PID:8308
- C:\Windows\System\TEjKvXl.exe
  C:\Windows\System\TEjKvXl.exe
  2⤵
  PID:8628
- C:\Windows\System\ukWHMiY.exe
  C:\Windows\System\ukWHMiY.exe
  2⤵
  PID:8824
- C:\Windows\System\DKSJrTx.exe
  C:\Windows\System\DKSJrTx.exe
  2⤵
  PID:9080
- C:\Windows\System\vpcYKiw.exe
  C:\Windows\System\vpcYKiw.exe
  2⤵
  PID:8596
- C:\Windows\System\BBCPaoG.exe
  C:\Windows\System\BBCPaoG.exe
  2⤵
  PID:9228
- C:\Windows\System\THRlpBQ.exe
  C:\Windows\System\THRlpBQ.exe
  2⤵
  PID:9244
- C:\Windows\System\KSNTsvd.exe
  C:\Windows\System\KSNTsvd.exe
  2⤵
  PID:9260
- C:\Windows\System\kxvARLI.exe
  C:\Windows\System\kxvARLI.exe
  2⤵
  PID:9276
- C:\Windows\System\pnDBJhb.exe
  C:\Windows\System\pnDBJhb.exe
  2⤵
  PID:9292
- C:\Windows\System\JChRhru.exe
  C:\Windows\System\JChRhru.exe
  2⤵
  PID:9308
- C:\Windows\System\XRkCtyH.exe
  C:\Windows\System\XRkCtyH.exe
  2⤵
  PID:9324
- C:\Windows\System\MvIyGqh.exe
  C:\Windows\System\MvIyGqh.exe
  2⤵
  PID:9340
- C:\Windows\System\SUShtgj.exe
  C:\Windows\System\SUShtgj.exe
  2⤵
  PID:9356
- C:\Windows\System\fchQLeS.exe
  C:\Windows\System\fchQLeS.exe
  2⤵
  PID:9372
- C:\Windows\System\vHwxtzj.exe
  C:\Windows\System\vHwxtzj.exe
  2⤵
  PID:9388
- C:\Windows\System\IvDcBEQ.exe
  C:\Windows\System\IvDcBEQ.exe
  2⤵
  PID:9404
- C:\Windows\System\sDwbdnv.exe
  C:\Windows\System\sDwbdnv.exe
  2⤵
  PID:9420
- C:\Windows\System\foeKlUj.exe
  C:\Windows\System\foeKlUj.exe
  2⤵
  PID:9436
- C:\Windows\System\qjqxafk.exe
  C:\Windows\System\qjqxafk.exe
  2⤵
  PID:9452
- C:\Windows\System\rVKOnEB.exe
  C:\Windows\System\rVKOnEB.exe
  2⤵
  PID:9468
- C:\Windows\System\lFIfEhl.exe
  C:\Windows\System\lFIfEhl.exe
  2⤵
  PID:9484
- C:\Windows\System\KlftsGs.exe
  C:\Windows\System\KlftsGs.exe
  2⤵
  PID:9500
- C:\Windows\System\xYCDBYZ.exe
  C:\Windows\System\xYCDBYZ.exe
  2⤵
  PID:9516
- C:\Windows\System\aZVwVBm.exe
  C:\Windows\System\aZVwVBm.exe
  2⤵
  PID:9532
- C:\Windows\System\kcKLWYP.exe
  C:\Windows\System\kcKLWYP.exe
  2⤵
  PID:9548
- C:\Windows\System\zYEUApk.exe
  C:\Windows\System\zYEUApk.exe
  2⤵
  PID:9564
- C:\Windows\System\RaedQpL.exe
  C:\Windows\System\RaedQpL.exe
  2⤵
  PID:9580
- C:\Windows\System\JPlxfzX.exe
  C:\Windows\System\JPlxfzX.exe
  2⤵
  PID:9596
- C:\Windows\System\kraNZZK.exe
  C:\Windows\System\kraNZZK.exe
  2⤵
  PID:9612
- C:\Windows\System\hmdyUbq.exe
  C:\Windows\System\hmdyUbq.exe
  2⤵
  PID:9628
- C:\Windows\System\VubMdAK.exe
  C:\Windows\System\VubMdAK.exe
  2⤵
  PID:9644
- C:\Windows\System\oJVGBTT.exe
  C:\Windows\System\oJVGBTT.exe
  2⤵
  PID:9660
- C:\Windows\System\vJcrtAM.exe
  C:\Windows\System\vJcrtAM.exe
  2⤵
  PID:9676
- C:\Windows\System\THzEwvN.exe
  C:\Windows\System\THzEwvN.exe
  2⤵
  PID:9692
- C:\Windows\System\aPcNiMk.exe
  C:\Windows\System\aPcNiMk.exe
  2⤵
  PID:9708
- C:\Windows\System\VnOnSer.exe
  C:\Windows\System\VnOnSer.exe
  2⤵
  PID:9724
- C:\Windows\System\hbPUCMp.exe
  C:\Windows\System\hbPUCMp.exe
  2⤵
  PID:9740
- C:\Windows\System\LHKTusf.exe
  C:\Windows\System\LHKTusf.exe
  2⤵
  PID:9756
- C:\Windows\System\MHTRxah.exe
  C:\Windows\System\MHTRxah.exe
  2⤵
  PID:9772
- C:\Windows\System\OcDcxrS.exe
  C:\Windows\System\OcDcxrS.exe
  2⤵
  PID:9788
- C:\Windows\System\RweePES.exe
  C:\Windows\System\RweePES.exe
  2⤵
  PID:9804
- C:\Windows\System\FcqMKTa.exe
  C:\Windows\System\FcqMKTa.exe
  2⤵
  PID:9820
- C:\Windows\System\RXSgeiH.exe
  C:\Windows\System\RXSgeiH.exe
  2⤵
  PID:9836
- C:\Windows\System\ysfNMpC.exe
  C:\Windows\System\ysfNMpC.exe
  2⤵
  PID:9852
- C:\Windows\System\uQzwjPI.exe
  C:\Windows\System\uQzwjPI.exe
  2⤵
  PID:9868
- C:\Windows\System\FNbVOcK.exe
  C:\Windows\System\FNbVOcK.exe
  2⤵
  PID:9884
- C:\Windows\System\IDnqKRx.exe
  C:\Windows\System\IDnqKRx.exe
  2⤵
  PID:9900
- C:\Windows\System\OxCIwtg.exe
  C:\Windows\System\OxCIwtg.exe
  2⤵
  PID:9916
- C:\Windows\System\LeKStzp.exe
  C:\Windows\System\LeKStzp.exe
  2⤵
  PID:9932
- C:\Windows\System\lAFJJmC.exe
  C:\Windows\System\lAFJJmC.exe
  2⤵
  PID:9948
- C:\Windows\System\YnNYmIe.exe
  C:\Windows\System\YnNYmIe.exe
  2⤵
  PID:9964
- C:\Windows\System\wKBFRvn.exe
  C:\Windows\System\wKBFRvn.exe
  2⤵
  PID:9980
- C:\Windows\System\xVTlrlF.exe
  C:\Windows\System\xVTlrlF.exe
  2⤵
  PID:9996
- C:\Windows\System\vMnSkwu.exe
  C:\Windows\System\vMnSkwu.exe
  2⤵
  PID:10012
- C:\Windows\System\oMGnSAr.exe
  C:\Windows\System\oMGnSAr.exe
  2⤵
  PID:10028
- C:\Windows\System\XEYUTbG.exe
  C:\Windows\System\XEYUTbG.exe
  2⤵
  PID:10044
- C:\Windows\System\fHjcFMo.exe
  C:\Windows\System\fHjcFMo.exe
  2⤵
  PID:10060
- C:\Windows\System\IUjLEEp.exe
  C:\Windows\System\IUjLEEp.exe
  2⤵
  PID:10076
- C:\Windows\System\jQMwofT.exe
  C:\Windows\System\jQMwofT.exe
  2⤵
  PID:10092
- C:\Windows\System\pTOKNCG.exe
  C:\Windows\System\pTOKNCG.exe
  2⤵
  PID:10108
- C:\Windows\System\OViLTwe.exe
  C:\Windows\System\OViLTwe.exe
  2⤵
  PID:10124
- C:\Windows\System\aKshOZv.exe
  C:\Windows\System\aKshOZv.exe
  2⤵
  PID:10140
- C:\Windows\System\wXhYyZT.exe
  C:\Windows\System\wXhYyZT.exe
  2⤵
  PID:10160
- C:\Windows\System\XKvtzpq.exe
  C:\Windows\System\XKvtzpq.exe
  2⤵
  PID:10176
- C:\Windows\System\ooTfuvs.exe
  C:\Windows\System\ooTfuvs.exe
  2⤵
  PID:10192
- C:\Windows\System\lzywWyy.exe
  C:\Windows\System\lzywWyy.exe
  2⤵
  PID:10208
- C:\Windows\System\ghNVhjk.exe
  C:\Windows\System\ghNVhjk.exe
  2⤵
  PID:10224
- C:\Windows\System\WwVoueu.exe
  C:\Windows\System\WwVoueu.exe
  2⤵
  PID:9220
- C:\Windows\System\AFCGbiS.exe
  C:\Windows\System\AFCGbiS.exe
  2⤵
  PID:7676
- C:\Windows\System\fhhDsCg.exe
  C:\Windows\System\fhhDsCg.exe
  2⤵
  PID:8156
- C:\Windows\System\OUOyrrC.exe
  C:\Windows\System\OUOyrrC.exe
  2⤵
  PID:8352
- C:\Windows\System\EJCease.exe
  C:\Windows\System\EJCease.exe
  2⤵
  PID:8484
- C:\Windows\System\WCeBGjn.exe
  C:\Windows\System\WCeBGjn.exe
  2⤵
  PID:8644
- C:\Windows\System\hRBWUdD.exe
  C:\Windows\System\hRBWUdD.exe
  2⤵
  PID:8708
- C:\Windows\System\uDtnnCx.exe
  C:\Windows\System\uDtnnCx.exe
  2⤵
  PID:7948
- C:\Windows\System\NpmoORY.exe
  C:\Windows\System\NpmoORY.exe
  2⤵
  PID:7660
- C:\Windows\System\dIxZgIe.exe
  C:\Windows\System\dIxZgIe.exe
  2⤵
  PID:9124
- C:\Windows\System\XHVSkRb.exe
  C:\Windows\System\XHVSkRb.exe
  2⤵
  PID:8660
- C:\Windows\System\yPIjNrC.exe
  C:\Windows\System\yPIjNrC.exe
  2⤵
  PID:8260
- C:\Windows\System\qxNXuYE.exe
  C:\Windows\System\qxNXuYE.exe
  2⤵
  PID:9236
- C:\Windows\System\CeJjBzJ.exe
  C:\Windows\System\CeJjBzJ.exe
  2⤵
  PID:8356
- C:\Windows\System\aOUSleK.exe
  C:\Windows\System\aOUSleK.exe
  2⤵
  PID:8424
- C:\Windows\System\eOuabuV.exe
  C:\Windows\System\eOuabuV.exe
  2⤵
  PID:8552
- C:\Windows\System\yLBhgGB.exe
  C:\Windows\System\yLBhgGB.exe
  2⤵
  PID:8616
- C:\Windows\System\LXxBxcu.exe
  C:\Windows\System\LXxBxcu.exe
  2⤵
  PID:9316
- C:\Windows\System\dGfDCFo.exe
  C:\Windows\System\dGfDCFo.exe
  2⤵
  PID:8776
- C:\Windows\System\eWmQWch.exe
  C:\Windows\System\eWmQWch.exe
  2⤵
  PID:8840
- C:\Windows\System\TDXZADn.exe
  C:\Windows\System\TDXZADn.exe
  2⤵
  PID:8904
- C:\Windows\System\MHnJHWg.exe
  C:\Windows\System\MHnJHWg.exe
  2⤵
  PID:8968
- C:\Windows\System\ampwaHK.exe
  C:\Windows\System\ampwaHK.exe
  2⤵
  PID:9064
- C:\Windows\System\guJlyiz.exe
  C:\Windows\System\guJlyiz.exe
  2⤵
  PID:9160
- C:\Windows\System\vIdkNxR.exe
  C:\Windows\System\vIdkNxR.exe
  2⤵
  PID:8212
- C:\Windows\System\tgAKGVB.exe
  C:\Windows\System\tgAKGVB.exe
  2⤵
  PID:8536
- C:\Windows\System\zEYjWDi.exe
  C:\Windows\System\zEYjWDi.exe
  2⤵
  PID:8884
- C:\Windows\System\ebyYULZ.exe
  C:\Windows\System\ebyYULZ.exe
  2⤵
  PID:9348
- C:\Windows\System\hISZJbf.exe
  C:\Windows\System\hISZJbf.exe
  2⤵
  PID:8244
- C:\Windows\System\TzlfELC.exe
  C:\Windows\System\TzlfELC.exe
  2⤵
  PID:8368
- C:\Windows\System\QrVCCZJ.exe
  C:\Windows\System\QrVCCZJ.exe
  2⤵
  PID:9272
- C:\Windows\System\cKiyOkh.exe
  C:\Windows\System\cKiyOkh.exe
  2⤵
  PID:9444
- C:\Windows\System\TDZTuEb.exe
  C:\Windows\System\TDZTuEb.exe
  2⤵
  PID:9304
- C:\Windows\System\gCqfASJ.exe
  C:\Windows\System\gCqfASJ.exe
  2⤵
  PID:9544
- C:\Windows\System\jPlcBTi.exe
  C:\Windows\System\jPlcBTi.exe
  2⤵
  PID:9608
- C:\Windows\System\ogrItSm.exe
  C:\Windows\System\ogrItSm.exe
  2⤵
  PID:9672
- C:\Windows\System\nLzmIMQ.exe
  C:\Windows\System\nLzmIMQ.exe
  2⤵
  PID:9764
- C:\Windows\System\LqtPWjC.exe
  C:\Windows\System\LqtPWjC.exe
  2⤵
  PID:9800
- C:\Windows\System\JuStKIL.exe
  C:\Windows\System\JuStKIL.exe
  2⤵
  PID:9864
- C:\Windows\System\qvAYDpI.exe
  C:\Windows\System\qvAYDpI.exe
  2⤵
  PID:9928
- C:\Windows\System\HRjDtsA.exe
  C:\Windows\System\HRjDtsA.exe
  2⤵
  PID:9992
- C:\Windows\System\PtrxpJx.exe
  C:\Windows\System\PtrxpJx.exe
  2⤵
  PID:10052
- C:\Windows\System\rgcndMg.exe
  C:\Windows\System\rgcndMg.exe
  2⤵
  PID:10116
- C:\Windows\System\tvrSOLy.exe
  C:\Windows\System\tvrSOLy.exe
  2⤵
  PID:10184
- C:\Windows\System\DpeJBhz.exe
  C:\Windows\System\DpeJBhz.exe
  2⤵
  PID:9368
- C:\Windows\System\pzlEpHZ.exe
  C:\Windows\System\pzlEpHZ.exe
  2⤵
  PID:9688
- C:\Windows\System\WXUjwPP.exe
  C:\Windows\System\WXUjwPP.exe
  2⤵
  PID:7544
- C:\Windows\System\FroDGoj.exe
  C:\Windows\System\FroDGoj.exe
  2⤵
  PID:7912
- C:\Windows\System\VJMKAvV.exe
  C:\Windows\System\VJMKAvV.exe
  2⤵
  PID:8228
- C:\Windows\System\LKSSBcX.exe
  C:\Windows\System\LKSSBcX.exe
  2⤵
  PID:8488
- C:\Windows\System\tktXeqO.exe
  C:\Windows\System\tktXeqO.exe
  2⤵
  PID:9876
- C:\Windows\System\huNHQjX.exe
  C:\Windows\System\huNHQjX.exe
  2⤵
  PID:10072
- C:\Windows\System\OGuWUBb.exe
  C:\Windows\System\OGuWUBb.exe
  2⤵
  PID:9336
- C:\Windows\System\dSLqwrV.exe
  C:\Windows\System\dSLqwrV.exe
  2⤵
  PID:9624
- C:\Windows\System\HtrHbHE.exe
  C:\Windows\System\HtrHbHE.exe
  2⤵
  PID:9400
- C:\Windows\System\ayEijTj.exe
  C:\Windows\System\ayEijTj.exe
  2⤵
  PID:10232
- C:\Windows\System\voRwUJP.exe
  C:\Windows\System\voRwUJP.exe
  2⤵
  PID:9496
- C:\Windows\System\tcxGjZb.exe
  C:\Windows\System\tcxGjZb.exe
  2⤵
  PID:9720
- C:\Windows\System\pgbzbiU.exe
  C:\Windows\System\pgbzbiU.exe
  2⤵
  PID:9784
- C:\Windows\System\PBAWZfs.exe
  C:\Windows\System\PBAWZfs.exe
  2⤵
  PID:7308
- C:\Windows\System\KDqLoIR.exe
  C:\Windows\System\KDqLoIR.exe
  2⤵
  PID:9848
- C:\Windows\System\oKTSRRc.exe
  C:\Windows\System\oKTSRRc.exe
  2⤵
  PID:9944
- C:\Windows\System\gglZPWL.exe
  C:\Windows\System\gglZPWL.exe
  2⤵
  PID:10040
- C:\Windows\System\TLoXzMl.exe
  C:\Windows\System\TLoXzMl.exe
  2⤵
  PID:10200
- C:\Windows\System\egQiJCw.exe
  C:\Windows\System\egQiJCw.exe
  2⤵
  PID:7820
- C:\Windows\System\MKgMaUa.exe
  C:\Windows\System\MKgMaUa.exe
  2⤵
  PID:8288
- C:\Windows\System\XPJzHAy.exe
  C:\Windows\System\XPJzHAy.exe
  2⤵
  PID:8612
- C:\Windows\System\WMOGYzP.exe
  C:\Windows\System\WMOGYzP.exe
  2⤵
  PID:8900
- C:\Windows\System\rMtgYSs.exe
  C:\Windows\System\rMtgYSs.exe
  2⤵
  PID:9156
- C:\Windows\System\VEyrfUf.exe
  C:\Windows\System\VEyrfUf.exe
  2⤵
  PID:9016
- C:\Windows\System\WGYbYaN.exe
  C:\Windows\System\WGYbYaN.exe
  2⤵
  PID:7188
- C:\Windows\System\GBNeJwY.exe
  C:\Windows\System\GBNeJwY.exe
  2⤵
  PID:9140
- C:\Windows\System\KESFpZG.exe
  C:\Windows\System\KESFpZG.exe
  2⤵
  PID:8760
- C:\Windows\System\oimkSgl.exe
  C:\Windows\System\oimkSgl.exe
  2⤵
  PID:9476
- C:\Windows\System\GCSFBSJ.exe
  C:\Windows\System\GCSFBSJ.exe
  2⤵
  PID:9576
- C:\Windows\System\Gxdhsvh.exe
  C:\Windows\System\Gxdhsvh.exe
  2⤵
  PID:9736
- C:\Windows\System\eIuPzrJ.exe
  C:\Windows\System\eIuPzrJ.exe
  2⤵
  PID:9860
- C:\Windows\System\zxffCGH.exe
  C:\Windows\System\zxffCGH.exe
  2⤵
  PID:10148
- C:\Windows\System\CXoaSoJ.exe
  C:\Windows\System\CXoaSoJ.exe
  2⤵
  PID:9652
- C:\Windows\System\JyVhiLw.exe
  C:\Windows\System\JyVhiLw.exe
  2⤵
  PID:9592
- C:\Windows\System\dPefLwA.exe
  C:\Windows\System\dPefLwA.exe
  2⤵
  PID:9096
- C:\Windows\System\WPDCQoH.exe
  C:\Windows\System\WPDCQoH.exe
  2⤵
  PID:9252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKJIyTr.exe

Filesize
1.2MB

MD5
45c7a7346cc6e114f5e02d14a9fbf7c9

SHA1
841bf195fd9118b8fa53b9d0535d5433293d1783

SHA256
86b886d7e31b874c0dfd2923ef429610c8b5c01e5a4915add5a4ff434f449719

SHA512
240a64683b3bda6edbdbe8311f6f554042361e8d80fa2216569c40822925e05c9b0e85defbc51cda43fb31c04fc33d86c0344f798733b6383b802960f70c2961

Download Submit
C:\Windows\system\ATSAKgl.exe

Filesize
1.2MB

MD5
9910a155a9e971ad538cc6982e982d8b

SHA1
88a9c51cc51360f2e67afe65ae742fc1ec3055ff

SHA256
3395ad0e5e25d183fb61898d609506251249d206b3484be1711e8aadd4dcb46d

SHA512
742b2bf25975e76a3d5369c8c7b061d359f7d48eab5f357d5f71be5188e733d58599dcc68f1b42b5beb50e4c0f6479959b9c1d34bc146e60d78baa063d3d51b0

Download Submit
C:\Windows\system\AkiOEEr.exe

Filesize
1.2MB

MD5
4c145a0d74c8649487dd3c9683f1b5d4

SHA1
0e8d321beb72f7b3f99dbaa386906a7af51b1a99

SHA256
e5c79036bc2996fe0cdc38b186e71d7ffee4dec45314c3388f884b0879a07858

SHA512
d3c1a4b0e45c8afec7ed482fb0761e5e2678a8e532981f44479347d3754807e5e4b8af1b8caf7543a518617007bbc89c28a9968dbdad1e5f7151846657d49c6b

Download Submit
C:\Windows\system\CTFvZRe.exe

Filesize
1.2MB

MD5
b1786a1d08cda2ac93ee819d91d96ea7

SHA1
decf0a5d3479cba1db7876beab8ed1eac5332c21

SHA256
d5c14b8aeaf5fc9d59cace657f8d31944f2e7954f3ed99c466f1cc377e5f8fb5

SHA512
7393778831f155815d4c591f2978888e324839f2281f40fca1eed0f0b3d088340967bf19ffcc788c539c93b691b4b3ff5108b1ac068db350511a5c2b48cefca8

Download Submit
C:\Windows\system\DLenlzt.exe

Filesize
1.2MB

MD5
0577f2de75bbc910d8a4442d2479b92d

SHA1
30c4475fe2a81b49dfb169c91335f02f28ac3b5d

SHA256
57f11dcbd9cad5e4313ce69315ee2d1a87d2b56c7fbe410b009d9c3826d104aa

SHA512
b5754162aad90ed5036711fa3233ecacfc384a541b565ac94706094d5658d8432777da7b82c02472d2fbe521eb97e974c21a9d813ae12335b8a35ffd49f07e15

Download Submit
C:\Windows\system\DUchwId.exe

Filesize
1.2MB

MD5
f352349e50a9c6b016fa878fecf22c53

SHA1
8cfe6cf8549a01b0cfaf9d556fc41802c7d29614

SHA256
33e8bda6fc0c5b1de8cd1237b287201815e08b796dbb803126bce80bde6b6138

SHA512
7cb4dc727c86bcde28d07200fe5af65eb35122369b391eee3bd40c25a6274b463ee6867d48b1bf8c3fa729d2d4bbbf84a79269b12723c20b6b506026f75c2680

Download Submit
C:\Windows\system\GUFAdhA.exe

Filesize
1.2MB

MD5
4a8091642e11b3d808e09512922264c5

SHA1
b01ce3de10e8f81b32ccbb47c6448034db0781ef

SHA256
3d7af8d85e2a8064231fea0b1bfb3f6af10b2d84cbf544b5c775bb3d9008ee81

SHA512
7c8a965513315ed40551f142d23cf850f9c9c60741ef23ac6f9acaa84fe807e115d4016a805d603b82870fab058c2b360e3e00001499f80232e400be4ce16b61

Download Submit
C:\Windows\system\IRhVxqK.exe

Filesize
1.2MB

MD5
80345fe0152a10dfd03e81f6c9b39d94

SHA1
cff506539bbbabbc0e1a96ba1a7a97e9fbe3cc59

SHA256
75927d8cf83487a47648e0aad7bd0b91989614043a6a801f682bcd2c065e70de

SHA512
58deeee1e0b398bb6279201c3f40261b15388827d52e34fe83fafca2d7508e2e44fa16ab2c5e2221e3e462a237fdc681c8d2b5847767f63960f070076b386eb1

Download Submit
C:\Windows\system\LOknTIn.exe

Filesize
1.2MB

MD5
457b5b151605feb8695f6df405dbcdbb

SHA1
403723acb65eaf0767a05788a59d819221d5ec57

SHA256
f2fcafb7e9aaa0141d4c0fecd4a3f77528ff1b5a2036a472fa8c3a82d53c401a

SHA512
361b81edc07770204d1ca375d5f0950e19156f58ada76691930d63db410c8d44df522060a9339d98d4a31b1410f92acdc69b9c13849395af126a474af6756d03

Download Submit
C:\Windows\system\OsWkwRV.exe

Filesize
1.2MB

MD5
a9ee150b44ce0fa1c20a47894533a4a0

SHA1
0373bc5b6d2a9b0e76bb747a6cae3a3c8ce72a20

SHA256
023b5c9b12a9acbe8757efa9cc3e93e931bc632e84fe39775aeeb2c1521d8c27

SHA512
0f4f59ce569ad4b605a6088a40f505e74318b32f444bdfec391f888e12a26aa77289a8d388e7526fad36382f55c530276708e761e3d1b18e112530396cf3bf82

Download Submit
C:\Windows\system\PfDOuaz.exe

Filesize
1.2MB

MD5
8472efb726240bc19b4599fcaa08384f

SHA1
ce1e55534bbb65f438d7d8d6aea0f8568d572358

SHA256
24cfdf36011cae6df72cca5c25497059aaba6fa70b910df4fe60a7b99965ff34

SHA512
1afc0657b72921e5a389888d1c5aea5fe2f83fb8ba7f2b42c527b80f8179349224bb4a0604da9927cbff64e3a39a4d6f406aed9cd125511ff1d96aec20afd015

Download Submit
C:\Windows\system\RcsSwsd.exe

Filesize
1.2MB

MD5
1666c4b0804f8103efe86d8781c8b229

SHA1
135e37626b6b512e40071763c2de23a64d6f74f9

SHA256
782a6bd11fd0838434599400e122ba2bbcc1082d144408ca5b1d8d9fefadbc78

SHA512
7c14e34e03422ad81ff161d0cd0dbea541ea33652466d59fa063827aac21b0581601526dd07b507762de4cf44c361445bbbe4846019ca442355e9cf2f441c708

Download Submit
C:\Windows\system\UMLQtPM.exe

Filesize
1.2MB

MD5
c994c5feb343e8b8fcc635130859a76d

SHA1
710385962d3c91402aacbbd8a4b87e8eb6be46e4

SHA256
173ce7eb7772365c8fe13d8fa60b57d289805b0bf814c641c7ca85d6853876ce

SHA512
05cc602100828d41b56ebb65458f1b6b173237bf1d23d72470d150e3e018122baced824c7e4cbbaed6698b41722b5515683228b37e5c6fab26edae4ffd5996f6

Download Submit
C:\Windows\system\XFKDahp.exe

Filesize
1.2MB

MD5
1e37e67da25d5edfd64142ef6498cc9a

SHA1
c4b04871a2e4b5880c41a664a7ac2a256a8a4aab

SHA256
9c8493a1808658a29dc9f72d79127c046bd2c9b361848cb5ad338130bf6f8da1

SHA512
47c9a8ae86e83342642d18dd94ce85c92e5b4f063dcb996939f7f99d8dd952fffe627f0ce17a34a625379f6ba15acb819033981b133ee91ef80e00ea1d488db8

Download Submit
C:\Windows\system\XvZWUoG.exe

Filesize
1.2MB

MD5
219f92b8219d4ef62916178dfcc2ce06

SHA1
1c0b1c329b0ec61cb49e2db6f266bfb271eac545

SHA256
ec951b56642819baf2fc2cff98f7e671c155e36a9f000a45e4f4bb59c25ca0cb

SHA512
3a02c97b90c21b2a8edca4c15182076f9d2a3bd8c4a330030cc06656025af69909e86e849fd85a93b654dd8b14a90b9e7e5a43fe6c039a13863c03b9fa56b26c

Download Submit
C:\Windows\system\YsRXnXZ.exe

Filesize
1.2MB

MD5
eabf698870a3e9b961732f6045105515

SHA1
0ae516e17a19eb4eab7cdb2e5dce963ed2dea3f9

SHA256
ccf6dcae72e27ed8e1c308507032b939ad7f7ec63819163aae59aa7aa18a25ad

SHA512
135e27ce1d00cb1123303611c5502d1b19a223e98d30d34bdf6dd59f495c4149d56b67685efbff49121b5590e86eeb628b08055370a257957b5ee99586054970

Download Submit
C:\Windows\system\ZaKEZlp.exe

Filesize
1.2MB

MD5
8cdd2eb9561ebe1415ab236b6b2fcab4

SHA1
82e67eef4d8ffb5bf527c6d96e6753254866e7e3

SHA256
88aa16e6264770ba6740fa04df05154b9c5b68afe0de99d7593c77110054b68a

SHA512
617b4e2357a6e8046f20d9c689e7c9e2b2dadb1c7bf8f8da92dbc2e6b045e0789f0fb1166cedacd04fc3f5efca05f3498121e7353644b1df3c51383915e8143b

Download Submit
C:\Windows\system\aUzTkkr.exe

Filesize
1.2MB

MD5
0caff3f26606d150f1a7e2bda22d8d57

SHA1
c0805194ae294a671f6afc95d295b1bdf72a40dd

SHA256
72f1005a9b0791bf88afcb6b61ced6cb58a460d97fadaa9a5c9dd5dedfd9d23a

SHA512
0cc60b8f5955293561dfc70780f77192fce43168a17c9071db6f93a5ec60fe3850658400fb81af3ab4e2c436626124d55e28781ec4fa438b10adc4d19c09ad46

Download Submit
C:\Windows\system\chRgGSE.exe

Filesize
1.2MB

MD5
1add0e65bf66d1ebddc5c14d756fcfca

SHA1
5d081e3a878bcd5180789b981ad756ade3b87564

SHA256
2643ae3112581ff764f5fbb0515b049eae24a6cb38b9aeaa6bde8843fc579bdb

SHA512
aec94838d3fc1755e1d6de82051e4e6393293f433d06de08d132a87cc92f02b433c291ce55e45a4cc46ad1b0bf758052df313668b45f7e1228f6936824769835

Download Submit
C:\Windows\system\efUBSqj.exe

Filesize
1.2MB

MD5
5cf9d8c75867adefeef9cdce718d6a95

SHA1
e6ffc0c7e8bcd0bdf5470ce5035d46a718c81fae

SHA256
af3458090db1f1efbc7695b792566ab1ba8cb01d806e7a4be1b8ef249c3a06f2

SHA512
9f324b8af94147f53614855c27923822ca2119da8a66b017610c0b14a4841f2f6b0ff1e6b0ff9fde78124a74ebe8e6fe0606364ad285259776274d65c5776070

Download Submit
C:\Windows\system\hwTOhve.exe

Filesize
1.2MB

MD5
bbb8089e4a6eca726188ea17a90a309d

SHA1
fae4cd0f7a124b72099ce5c30122327ae5a6ee03

SHA256
a3a1dc8e65c1084dcc864fbe436fe0a2706d36470b787e748a5eea9285371e12

SHA512
224a23a9f5c3dd612af96a6f7f5961d9b9322a659dd4d6c890ccb71a57cae95665f01bf12bae36ae41ecbdc116ca8b92102d985fb3c97cbc5dee9202a9cee155

Download Submit
C:\Windows\system\jBMOyOh.exe

Filesize
1.2MB

MD5
c7bdd4d2d959c04a0838909aa3fe39fb

SHA1
8fa6b652f87eb36f6f7687365def329e65c7f968

SHA256
2781f099c37bcef6a274e80de543a1d19bb5e2876249e407b4fcc9ec76438181

SHA512
2cbfcd7f795f324cefcda5411e093233bdc2ed57489ef1b51fd19ef8eb9d61a2923cbb3243ee3a810cb4d37deaaae2567cb304cc90b6a81583beb297d550fe28

Download Submit
C:\Windows\system\pdlBiQk.exe

Filesize
1.2MB

MD5
78c822dcfc295ca4389850dea0387ae7

SHA1
f8c976caec4fa808e3924b854c16ce1f3bc16695

SHA256
8fbe2cdd757ea2f38cde622574fad7e001677272dd1ab7bddb5b9707c1bf8d12

SHA512
4f73402c11cc107f679980d5a450842ad0c3f8092e7b86e6b5d7f7ccbc63a528501f8e009c1198f7cfc85c418f917892b84a24c1d33ad2e8dea6d0682a5003cf

Download Submit
C:\Windows\system\qDWqAvt.exe

Filesize
1.2MB

MD5
0ae7ddcfbf05cc2379a98e8f7ab27dbc

SHA1
1597d5af16e6e3870c3536b25cf76f395c9ed3ba

SHA256
d4a83e255aaaf3f0d6bf1a8dbd4e790c5904fa49eaddbad24002613205c23213

SHA512
680961147e6391addd6af346e4afdb4b753fa10c5b4d2a629d9e303d6585cd53b9d0b4174c66aeeaacf2d01d98973cde0e47ffd146f6aba4b1c1b8fd4bce945b

Download Submit
C:\Windows\system\qMybEvy.exe

Filesize
1.2MB

MD5
f075521eb65d79c72a1c4db47a998696

SHA1
c1e5b7e310484eda602b58376d162c2603eed338

SHA256
f47c385aa0e64edb1d01b9c0df1adf3132f470cbeb26506655c099706cfe90d2

SHA512
37f925df6d3011b899727be812fe2ab4ab0a7ba090312440241fecb140d5b48bed699f2572c3c2fdb2668aa4206076f839fbf4271036a6b751fb0f5fb9698f91

Download Submit
C:\Windows\system\rqqkvLy.exe

Filesize
1.2MB

MD5
580386e3d00b023dab9ca513f1d74622

SHA1
190c89d70c1b2c5f0591cf4eec9b6d782b3443a9

SHA256
689e4b6232d27a4fe30b9f8719a1d88e3f028717d6d6af0c77e2cb4b8cc2d065

SHA512
dd9f0c62b4184fbdffc21a6eb8459db7df076ddcc2b386a40247265f4257b252bffe69ae6d2f408d27f8e66027b64f12a1248be9068ed437b73a293e2988e248

Download Submit
C:\Windows\system\rsOmXqd.exe

Filesize
1.2MB

MD5
856642c8a63487b615a41985d071ffa2

SHA1
072fe6aa3b6dd71c0a63c4621b0aeef6af3daa6d

SHA256
0c0800a76b709893cc6372a2d9a0e2d37bd038e615300d4af7415c5d66544729

SHA512
9e86a0f3bac2753934d66808e3d9fe438e68b55afdf82ecc56de8876514b52025413f6cc8861a10386fab01bf2149567e6d8ec85d125a2396f4a9acb1eb55ba5

Download Submit
C:\Windows\system\rwyYWuJ.exe

Filesize
1.2MB

MD5
f8111ba66df83fe464f722588c36f366

SHA1
f64eb114cd9ee305c7c4ea7417673c98068fb7db

SHA256
eadbd8823cfa9330afaecafc5e3c7699a70793ec7a3d1cce39e4b60afedc484d

SHA512
fd7eb4a14d81ff15fc33aa53b6f1787c7768b477031ffabf37f4d3ec388bdf19e467a086060ea35d6e2ff8ca2210a820e1b65eca735b97ec3e9c6d00461a9c59

Download Submit
C:\Windows\system\skUQHWq.exe

Filesize
1.2MB

MD5
5e4ad8fa6bfd4717ccd30dd54b2a4ab4

SHA1
27b12f0177896194fd0dfff4cd64873517b0c35c

SHA256
83f933b3a24b003c2ab497f06129967607256f7cb145b1d55deba93a4a2f5c5c

SHA512
3a25c1ee2704c429ad845c22e8559a67fa13429575a73bf21a1ab118621612919c2f216a9bfc7782f728069b9746ebd27dfd0b335e786b623ac40c082bb3b784

Download Submit
C:\Windows\system\vaFOydb.exe

Filesize
1.2MB

MD5
fae5e36f084b7b9923473f48322588ea

SHA1
6f00d1130d79344c18e74a448f0c95dbfe117bb9

SHA256
889a7efafd327a35c10b09afb344be674090cc2bc2a2269bdfd45a114f9a41aa

SHA512
db6bc6895fad4211647b6403b06f8519370469aed4311000a58d800528bff429bdbc13b191bc370a9f7946d201de0fe001efe65376d5a785a4ddbdd25da7e621

Download Submit
C:\Windows\system\vdkRwnE.exe

Filesize
1.2MB

MD5
2b93f85bd078c5ce25c32e27e12a4cff

SHA1
5eced493106d185151946e3505ae897a985cdf40

SHA256
0cefe0aa9afa67ce611302de278257631b9a9c3a2ec43b2d62f555c70b34132e

SHA512
61d53c778e3b1b41db6f1d0b0c1c755a5cbede1495fd508c8a73e1a0f6e249a61103bba4164e0db592fc0c02ed5da5343687a2cc6c073157712f0d5829249f38

Download Submit
\Windows\system\oIKCAyY.exe

Filesize
1.2MB

MD5
d9c30c1f93d24fc30dc3305117de6b35

SHA1
95c1542ce191a0fe1f8049f9cb41578d50ce32ff

SHA256
e192902f6a2500a9554eb213cd258fb5c14752a4447ae915ea118d08e8dc9492

SHA512
cdc217d3abd71e415c9c9aa7da9c4a331d759e158ba47d62cb28f7209c9ed10d5f3e7eedafa0ff413b2378777f49629a8a9b36e6147b5d5c78190712592ba732

Download Submit
memory/1788-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download