xmrig | 42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
Size

1.1MB
MD5

8e6e52f2251d7ab75d5436812fc1ec86
SHA1

106c9901eb219d2b89c18a4f4632e8cf5f4c222b
SHA256

42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934
SHA512

dc1327a4bb535aac6683740b96d3486f7386e2079fb2a4dfe8ee7ff2f5c5a3e8f2e2e956ea4b4acc694ce6506b09ddf5e6b7bca511a08917051d57188aea0a89
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B3872Z3sMi:GezaTF8FcNkNdfE0pZ9ozttwIRakG3dW

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000012102-2.dat	xmrig
behavioral1/files/0x00080000000173b2-9.dat	xmrig
behavioral1/files/0x00070000000173ee-15.dat	xmrig
behavioral1/files/0x00070000000173f6-16.dat	xmrig
behavioral1/files/0x000700000001746c-23.dat	xmrig
behavioral1/files/0x0007000000017474-26.dat	xmrig
behavioral1/files/0x000a00000001749c-31.dat	xmrig
behavioral1/files/0x0006000000019238-34.dat	xmrig
behavioral1/files/0x0005000000019616-42.dat	xmrig
behavioral1/files/0x000500000001962a-50.dat	xmrig
behavioral1/files/0x000500000001966c-54.dat	xmrig
behavioral1/files/0x00050000000196e8-62.dat	xmrig
behavioral1/files/0x0005000000019c36-70.dat	xmrig
behavioral1/files/0x0005000000019c3a-78.dat	xmrig
behavioral1/files/0x0005000000019d44-90.dat	xmrig
behavioral1/files/0x0005000000019db8-98.dat	xmrig
behavioral1/files/0x000500000001a301-126.dat	xmrig
behavioral1/files/0x000500000001a345-130.dat	xmrig
behavioral1/files/0x000500000001a0a1-122.dat	xmrig
behavioral1/files/0x000500000001a07b-118.dat	xmrig
behavioral1/files/0x000500000001a067-114.dat	xmrig
behavioral1/files/0x0033000000016e73-110.dat	xmrig
behavioral1/files/0x0005000000019fb9-107.dat	xmrig
behavioral1/files/0x0005000000019f9f-102.dat	xmrig
behavioral1/files/0x0005000000019da4-94.dat	xmrig
behavioral1/files/0x0005000000019d20-86.dat	xmrig
behavioral1/files/0x0005000000019c53-82.dat	xmrig
behavioral1/files/0x0005000000019c38-75.dat	xmrig
behavioral1/files/0x000500000001997c-66.dat	xmrig
behavioral1/files/0x00050000000196ac-58.dat	xmrig
behavioral1/files/0x0005000000019618-46.dat	xmrig
behavioral1/files/0x0005000000019614-39.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2848	xJDUXYp.exe
2864	WZVJspw.exe
1032	GeTWtcl.exe
2116	XSLnMfX.exe
2152	MNaMqoe.exe
3060	YXLUhnP.exe
2768	PaEMLmM.exe
2724	tkfNQKM.exe
2812	yHRRtMd.exe
2580	YOgKFfg.exe
2680	ogIkObg.exe
2280	RqhCqPr.exe
2052	IGYjKWN.exe
692	hBJmRUl.exe
3056	lJdAqSj.exe
2436	rrKLRUv.exe
1484	qfsWjmX.exe
2308	FxEcLWk.exe
2924	QFhwnDK.exe
860	tlkaNom.exe
1272	uxbgNcu.exe
828	okbCNfA.exe
2908	EcmBhnc.exe
976	LlUJmfx.exe
2648	eeDsQkH.exe
1916	JzGmsIU.exe
2440	JLnnBJv.exe
2988	wimSycO.exe
2260	ZpiyrwU.exe
2128	tSWbohp.exe
2380	YCClCKF.exe
1616	QJhUBgC.exe
956	dsaYXmU.exe
2452	DbapVHk.exe
1096	dNZpXIV.exe
1820	xBYyBen.exe
1796	phpuoMh.exe
684	qKeKari.exe
1320	ibajRHl.exe
1620	aNqXcKX.exe
984	TqbSRwV.exe
2360	BNJKEGg.exe
896	QHtOqJG.exe
1996	wvgKrKF.exe
2408	sOYxldw.exe
1552	nVwThbd.exe
1644	Bkoimue.exe
1360	SchagAR.exe
2332	upsjPep.exe
2276	ilogbNF.exe
1728	EbeNJgr.exe
2396	hYoxabR.exe
2012	eJHXedo.exe
2132	zekUpZC.exe
2028	jrZaDxQ.exe
2336	wYpMRIU.exe
3024	hBBSGiz.exe
1672	gNZDTjN.exe
2244	DYIOybU.exe
1064	ivKeYZm.exe
2532	tGQwJmf.exe
1828	kJqWgNv.exe
1824	hlnPmhv.exe
2896	uNBZyKD.exe

Loads dropped DLL 64 IoCs

pid	Process
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wimSycO.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\UnAIGMW.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\vUoOFbG.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\fdqdVpd.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\yFKAPYR.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\CTdOBZh.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\QdFnhPP.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\WbbwNpm.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\AXcVmze.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\yClSAmR.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\kApCFzW.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\KxSWNNC.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\tcGTZcC.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\QIHpojK.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\PRfkmzn.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\JGSijqD.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\zeSfNYb.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\csARwem.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\gxtKZyR.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\FwThWVJ.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\UzzpYmp.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\AuNicmC.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\mqJXqnb.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\naUZTgK.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\vUerVoK.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\EsSrDqv.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\FoiwyCL.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\sttMlZJ.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\cdIriIN.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\blbDdDT.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\FKbIxzx.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\macytqc.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\tldkOwS.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\DYbMCQy.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\gqkHGJr.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\uyOgtYB.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\pMZqOpa.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\FbOTDrL.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\eRmprqH.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\xDKyhec.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\bdibtgl.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\ZZgeNGt.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\VkeYPhs.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\AQVGLmm.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\lljmSOt.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\GBasPeJ.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\CYCrvJh.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\dsGtNDJ.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\ZJpSxHw.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\DPsXBLy.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\GUrxWys.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\ZeZnfFa.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\zibBTGw.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\MVCfsKU.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\vLyCSXQ.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\ToUjgtA.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\xbJxPZj.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\IgenIUI.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\OqcPKwD.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\zmhGToR.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\LBOFdAL.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\MtihMIP.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\RDfpCVl.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
File created	C:\Windows\System\WfHyPmt.exe	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2848	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	32
PID 2704 wrote to memory of 2848	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	32
PID 2704 wrote to memory of 2848	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	32
PID 2704 wrote to memory of 2864	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	33
PID 2704 wrote to memory of 2864	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	33
PID 2704 wrote to memory of 2864	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	33
PID 2704 wrote to memory of 1032	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	34
PID 2704 wrote to memory of 1032	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	34
PID 2704 wrote to memory of 1032	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	34
PID 2704 wrote to memory of 2116	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	35
PID 2704 wrote to memory of 2116	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	35
PID 2704 wrote to memory of 2116	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	35
PID 2704 wrote to memory of 2152	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	36
PID 2704 wrote to memory of 2152	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	36
PID 2704 wrote to memory of 2152	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	36
PID 2704 wrote to memory of 3060	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	37
PID 2704 wrote to memory of 3060	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	37
PID 2704 wrote to memory of 3060	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	37
PID 2704 wrote to memory of 2768	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	38
PID 2704 wrote to memory of 2768	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	38
PID 2704 wrote to memory of 2768	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	38
PID 2704 wrote to memory of 2724	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	39
PID 2704 wrote to memory of 2724	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	39
PID 2704 wrote to memory of 2724	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	39
PID 2704 wrote to memory of 2812	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	40
PID 2704 wrote to memory of 2812	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	40
PID 2704 wrote to memory of 2812	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	40
PID 2704 wrote to memory of 2580	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	41
PID 2704 wrote to memory of 2580	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	41
PID 2704 wrote to memory of 2580	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	41
PID 2704 wrote to memory of 2680	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	42
PID 2704 wrote to memory of 2680	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	42
PID 2704 wrote to memory of 2680	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	42
PID 2704 wrote to memory of 2280	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	43
PID 2704 wrote to memory of 2280	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	43
PID 2704 wrote to memory of 2280	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	43
PID 2704 wrote to memory of 2052	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	44
PID 2704 wrote to memory of 2052	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	44
PID 2704 wrote to memory of 2052	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	44
PID 2704 wrote to memory of 692	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	45
PID 2704 wrote to memory of 692	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	45
PID 2704 wrote to memory of 692	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	45
PID 2704 wrote to memory of 3056	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	46
PID 2704 wrote to memory of 3056	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	46
PID 2704 wrote to memory of 3056	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	46
PID 2704 wrote to memory of 2436	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	47
PID 2704 wrote to memory of 2436	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	47
PID 2704 wrote to memory of 2436	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	47
PID 2704 wrote to memory of 1484	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	48
PID 2704 wrote to memory of 1484	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	48
PID 2704 wrote to memory of 1484	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	48
PID 2704 wrote to memory of 2308	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	49
PID 2704 wrote to memory of 2308	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	49
PID 2704 wrote to memory of 2308	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	49
PID 2704 wrote to memory of 2924	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	50
PID 2704 wrote to memory of 2924	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	50
PID 2704 wrote to memory of 2924	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	50
PID 2704 wrote to memory of 860	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	51
PID 2704 wrote to memory of 860	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	51
PID 2704 wrote to memory of 860	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	51
PID 2704 wrote to memory of 1272	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	52
PID 2704 wrote to memory of 1272	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	52
PID 2704 wrote to memory of 1272	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	52
PID 2704 wrote to memory of 828	2704	42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe	53

C:\Users\Admin\AppData\Local\Temp\42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe
"C:\Users\Admin\AppData\Local\Temp\42496e6a16b00bb5f3a995e7a1e1a0979be650ec0a8b7c9ac6e3b5734a4b8934.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System\xJDUXYp.exe
  C:\Windows\System\xJDUXYp.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\WZVJspw.exe
  C:\Windows\System\WZVJspw.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\GeTWtcl.exe
  C:\Windows\System\GeTWtcl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\XSLnMfX.exe
  C:\Windows\System\XSLnMfX.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\MNaMqoe.exe
  C:\Windows\System\MNaMqoe.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\YXLUhnP.exe
  C:\Windows\System\YXLUhnP.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\PaEMLmM.exe
  C:\Windows\System\PaEMLmM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\tkfNQKM.exe
  C:\Windows\System\tkfNQKM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\yHRRtMd.exe
  C:\Windows\System\yHRRtMd.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YOgKFfg.exe
  C:\Windows\System\YOgKFfg.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ogIkObg.exe
  C:\Windows\System\ogIkObg.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\RqhCqPr.exe
  C:\Windows\System\RqhCqPr.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\IGYjKWN.exe
  C:\Windows\System\IGYjKWN.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\hBJmRUl.exe
  C:\Windows\System\hBJmRUl.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\lJdAqSj.exe
  C:\Windows\System\lJdAqSj.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\rrKLRUv.exe
  C:\Windows\System\rrKLRUv.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\qfsWjmX.exe
  C:\Windows\System\qfsWjmX.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\FxEcLWk.exe
  C:\Windows\System\FxEcLWk.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\QFhwnDK.exe
  C:\Windows\System\QFhwnDK.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\tlkaNom.exe
  C:\Windows\System\tlkaNom.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\uxbgNcu.exe
  C:\Windows\System\uxbgNcu.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\okbCNfA.exe
  C:\Windows\System\okbCNfA.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\EcmBhnc.exe
  C:\Windows\System\EcmBhnc.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\LlUJmfx.exe
  C:\Windows\System\LlUJmfx.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\eeDsQkH.exe
  C:\Windows\System\eeDsQkH.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\JzGmsIU.exe
  C:\Windows\System\JzGmsIU.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\JLnnBJv.exe
  C:\Windows\System\JLnnBJv.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\wimSycO.exe
  C:\Windows\System\wimSycO.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ZpiyrwU.exe
  C:\Windows\System\ZpiyrwU.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\tSWbohp.exe
  C:\Windows\System\tSWbohp.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YCClCKF.exe
  C:\Windows\System\YCClCKF.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\QJhUBgC.exe
  C:\Windows\System\QJhUBgC.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\dsaYXmU.exe
  C:\Windows\System\dsaYXmU.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\DbapVHk.exe
  C:\Windows\System\DbapVHk.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\dNZpXIV.exe
  C:\Windows\System\dNZpXIV.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\xBYyBen.exe
  C:\Windows\System\xBYyBen.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\phpuoMh.exe
  C:\Windows\System\phpuoMh.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\qKeKari.exe
  C:\Windows\System\qKeKari.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ibajRHl.exe
  C:\Windows\System\ibajRHl.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\aNqXcKX.exe
  C:\Windows\System\aNqXcKX.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\TqbSRwV.exe
  C:\Windows\System\TqbSRwV.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\BNJKEGg.exe
  C:\Windows\System\BNJKEGg.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\QHtOqJG.exe
  C:\Windows\System\QHtOqJG.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\wvgKrKF.exe
  C:\Windows\System\wvgKrKF.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\sOYxldw.exe
  C:\Windows\System\sOYxldw.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\nVwThbd.exe
  C:\Windows\System\nVwThbd.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\Bkoimue.exe
  C:\Windows\System\Bkoimue.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\SchagAR.exe
  C:\Windows\System\SchagAR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\upsjPep.exe
  C:\Windows\System\upsjPep.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\ilogbNF.exe
  C:\Windows\System\ilogbNF.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\EbeNJgr.exe
  C:\Windows\System\EbeNJgr.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\hYoxabR.exe
  C:\Windows\System\hYoxabR.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\eJHXedo.exe
  C:\Windows\System\eJHXedo.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\zekUpZC.exe
  C:\Windows\System\zekUpZC.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\jrZaDxQ.exe
  C:\Windows\System\jrZaDxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\wYpMRIU.exe
  C:\Windows\System\wYpMRIU.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hBBSGiz.exe
  C:\Windows\System\hBBSGiz.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\gNZDTjN.exe
  C:\Windows\System\gNZDTjN.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\DYIOybU.exe
  C:\Windows\System\DYIOybU.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\ivKeYZm.exe
  C:\Windows\System\ivKeYZm.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\tGQwJmf.exe
  C:\Windows\System\tGQwJmf.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\kJqWgNv.exe
  C:\Windows\System\kJqWgNv.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\hlnPmhv.exe
  C:\Windows\System\hlnPmhv.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\uNBZyKD.exe
  C:\Windows\System\uNBZyKD.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\SCEdjpu.exe
  C:\Windows\System\SCEdjpu.exe
  2⤵
  PID:1760
- C:\Windows\System\dmqnBTR.exe
  C:\Windows\System\dmqnBTR.exe
  2⤵
  PID:1300
- C:\Windows\System\YFMGnxX.exe
  C:\Windows\System\YFMGnxX.exe
  2⤵
  PID:1964
- C:\Windows\System\osxGlWA.exe
  C:\Windows\System\osxGlWA.exe
  2⤵
  PID:1688
- C:\Windows\System\NhcxsUL.exe
  C:\Windows\System\NhcxsUL.exe
  2⤵
  PID:1572
- C:\Windows\System\uZiRzAc.exe
  C:\Windows\System\uZiRzAc.exe
  2⤵
  PID:1712
- C:\Windows\System\VPmOncT.exe
  C:\Windows\System\VPmOncT.exe
  2⤵
  PID:2836
- C:\Windows\System\twdiUuR.exe
  C:\Windows\System\twdiUuR.exe
  2⤵
  PID:2300
- C:\Windows\System\FyOKmhL.exe
  C:\Windows\System\FyOKmhL.exe
  2⤵
  PID:2872
- C:\Windows\System\jWyRGXh.exe
  C:\Windows\System\jWyRGXh.exe
  2⤵
  PID:2596
- C:\Windows\System\etaRrTQ.exe
  C:\Windows\System\etaRrTQ.exe
  2⤵
  PID:2584
- C:\Windows\System\LvnyiMM.exe
  C:\Windows\System\LvnyiMM.exe
  2⤵
  PID:2616
- C:\Windows\System\zeVpmwz.exe
  C:\Windows\System\zeVpmwz.exe
  2⤵
  PID:2624
- C:\Windows\System\LmnOiXb.exe
  C:\Windows\System\LmnOiXb.exe
  2⤵
  PID:2568
- C:\Windows\System\hVUvIVx.exe
  C:\Windows\System\hVUvIVx.exe
  2⤵
  PID:2416
- C:\Windows\System\xbDwfqE.exe
  C:\Windows\System\xbDwfqE.exe
  2⤵
  PID:3040
- C:\Windows\System\KxauYFY.exe
  C:\Windows\System\KxauYFY.exe
  2⤵
  PID:1436
- C:\Windows\System\dMURgOg.exe
  C:\Windows\System\dMURgOg.exe
  2⤵
  PID:2524
- C:\Windows\System\BIfheUj.exe
  C:\Windows\System\BIfheUj.exe
  2⤵
  PID:2056
- C:\Windows\System\vaJIVYk.exe
  C:\Windows\System\vaJIVYk.exe
  2⤵
  PID:1740
- C:\Windows\System\LJLSWoY.exe
  C:\Windows\System\LJLSWoY.exe
  2⤵
  PID:2920
- C:\Windows\System\lrypnxk.exe
  C:\Windows\System\lrypnxk.exe
  2⤵
  PID:1052
- C:\Windows\System\VcJZaYv.exe
  C:\Windows\System\VcJZaYv.exe
  2⤵
  PID:2104
- C:\Windows\System\cohlhmQ.exe
  C:\Windows\System\cohlhmQ.exe
  2⤵
  PID:2976
- C:\Windows\System\obCpSfl.exe
  C:\Windows\System\obCpSfl.exe
  2⤵
  PID:2424
- C:\Windows\System\iGRVsrX.exe
  C:\Windows\System\iGRVsrX.exe
  2⤵
  PID:2748
- C:\Windows\System\RLNICgG.exe
  C:\Windows\System\RLNICgG.exe
  2⤵
  PID:1968
- C:\Windows\System\RFSJMkY.exe
  C:\Windows\System\RFSJMkY.exe
  2⤵
  PID:2232
- C:\Windows\System\iWuHfgE.exe
  C:\Windows\System\iWuHfgE.exe
  2⤵
  PID:2080
- C:\Windows\System\biFOebT.exe
  C:\Windows\System\biFOebT.exe
  2⤵
  PID:2892
- C:\Windows\System\vUerVoK.exe
  C:\Windows\System\vUerVoK.exe
  2⤵
  PID:1388
- C:\Windows\System\yNbncPg.exe
  C:\Windows\System\yNbncPg.exe
  2⤵
  PID:2348
- C:\Windows\System\JtLYbwu.exe
  C:\Windows\System\JtLYbwu.exe
  2⤵
  PID:596
- C:\Windows\System\yBcrXbv.exe
  C:\Windows\System\yBcrXbv.exe
  2⤵
  PID:1544
- C:\Windows\System\vOigGnZ.exe
  C:\Windows\System\vOigGnZ.exe
  2⤵
  PID:1532
- C:\Windows\System\RjGzxHn.exe
  C:\Windows\System\RjGzxHn.exe
  2⤵
  PID:2880
- C:\Windows\System\kEdYJIF.exe
  C:\Windows\System\kEdYJIF.exe
  2⤵
  PID:2040
- C:\Windows\System\jAQdotM.exe
  C:\Windows\System\jAQdotM.exe
  2⤵
  PID:1720
- C:\Windows\System\oeAlvMO.exe
  C:\Windows\System\oeAlvMO.exe
  2⤵
  PID:2100
- C:\Windows\System\WbbwNpm.exe
  C:\Windows\System\WbbwNpm.exe
  2⤵
  PID:2120
- C:\Windows\System\eHOYggt.exe
  C:\Windows\System\eHOYggt.exe
  2⤵
  PID:1948
- C:\Windows\System\mZKOXqH.exe
  C:\Windows\System\mZKOXqH.exe
  2⤵
  PID:1800
- C:\Windows\System\rjUJtRx.exe
  C:\Windows\System\rjUJtRx.exe
  2⤵
  PID:1600
- C:\Windows\System\KejaAGg.exe
  C:\Windows\System\KejaAGg.exe
  2⤵
  PID:2700
- C:\Windows\System\HXJetxn.exe
  C:\Windows\System\HXJetxn.exe
  2⤵
  PID:2912
- C:\Windows\System\aVnDflQ.exe
  C:\Windows\System\aVnDflQ.exe
  2⤵
  PID:2572
- C:\Windows\System\ZkqwQHg.exe
  C:\Windows\System\ZkqwQHg.exe
  2⤵
  PID:2632
- C:\Windows\System\FrbZYKd.exe
  C:\Windows\System\FrbZYKd.exe
  2⤵
  PID:2160
- C:\Windows\System\RDWtYOe.exe
  C:\Windows\System\RDWtYOe.exe
  2⤵
  PID:688
- C:\Windows\System\hBwNoLt.exe
  C:\Windows\System\hBwNoLt.exe
  2⤵
  PID:988
- C:\Windows\System\ooEpATe.exe
  C:\Windows\System\ooEpATe.exe
  2⤵
  PID:2884
- C:\Windows\System\tCoTtzr.exe
  C:\Windows\System\tCoTtzr.exe
  2⤵
  PID:2188
- C:\Windows\System\BglIpCZ.exe
  C:\Windows\System\BglIpCZ.exe
  2⤵
  PID:2540
- C:\Windows\System\fhWefwW.exe
  C:\Windows\System\fhWefwW.exe
  2⤵
  PID:2248
- C:\Windows\System\ZltDjkJ.exe
  C:\Windows\System\ZltDjkJ.exe
  2⤵
  PID:2628
- C:\Windows\System\kcufRhw.exe
  C:\Windows\System\kcufRhw.exe
  2⤵
  PID:2144
- C:\Windows\System\skysCoY.exe
  C:\Windows\System\skysCoY.exe
  2⤵
  PID:2376
- C:\Windows\System\zDKDjiD.exe
  C:\Windows\System\zDKDjiD.exe
  2⤵
  PID:1768
- C:\Windows\System\AXcVmze.exe
  C:\Windows\System\AXcVmze.exe
  2⤵
  PID:780
- C:\Windows\System\HsKOoEF.exe
  C:\Windows\System\HsKOoEF.exe
  2⤵
  PID:1788
- C:\Windows\System\ZBZBBFH.exe
  C:\Windows\System\ZBZBBFH.exe
  2⤵
  PID:2620
- C:\Windows\System\uPPOgaT.exe
  C:\Windows\System\uPPOgaT.exe
  2⤵
  PID:792
- C:\Windows\System\DTigIXE.exe
  C:\Windows\System\DTigIXE.exe
  2⤵
  PID:2172
- C:\Windows\System\ppSqoVw.exe
  C:\Windows\System\ppSqoVw.exe
  2⤵
  PID:1000
- C:\Windows\System\BwwMLAg.exe
  C:\Windows\System\BwwMLAg.exe
  2⤵
  PID:764
- C:\Windows\System\vRzdQFd.exe
  C:\Windows\System\vRzdQFd.exe
  2⤵
  PID:1324
- C:\Windows\System\RExxqmP.exe
  C:\Windows\System\RExxqmP.exe
  2⤵
  PID:1696
- C:\Windows\System\WqqSNth.exe
  C:\Windows\System\WqqSNth.exe
  2⤵
  PID:1596
- C:\Windows\System\JvGtEMS.exe
  C:\Windows\System\JvGtEMS.exe
  2⤵
  PID:2720
- C:\Windows\System\abjbcrp.exe
  C:\Windows\System\abjbcrp.exe
  2⤵
  PID:3044
- C:\Windows\System\MsVdaYC.exe
  C:\Windows\System\MsVdaYC.exe
  2⤵
  PID:2612
- C:\Windows\System\QQGOqoN.exe
  C:\Windows\System\QQGOqoN.exe
  2⤵
  PID:2176
- C:\Windows\System\tpqNeka.exe
  C:\Windows\System\tpqNeka.exe
  2⤵
  PID:1956
- C:\Windows\System\ZNVmEfX.exe
  C:\Windows\System\ZNVmEfX.exe
  2⤵
  PID:2008
- C:\Windows\System\XBEWkrS.exe
  C:\Windows\System\XBEWkrS.exe
  2⤵
  PID:636
- C:\Windows\System\tMnXyXW.exe
  C:\Windows\System\tMnXyXW.exe
  2⤵
  PID:2916
- C:\Windows\System\yYPCbDL.exe
  C:\Windows\System\yYPCbDL.exe
  2⤵
  PID:2932
- C:\Windows\System\LRrbihd.exe
  C:\Windows\System\LRrbihd.exe
  2⤵
  PID:1404
- C:\Windows\System\bSaolHv.exe
  C:\Windows\System\bSaolHv.exe
  2⤵
  PID:2868
- C:\Windows\System\StvxNdQ.exe
  C:\Windows\System\StvxNdQ.exe
  2⤵
  PID:1868
- C:\Windows\System\HgrcBac.exe
  C:\Windows\System\HgrcBac.exe
  2⤵
  PID:1308
- C:\Windows\System\fBlFBfp.exe
  C:\Windows\System\fBlFBfp.exe
  2⤵
  PID:2220
- C:\Windows\System\lTFJnGT.exe
  C:\Windows\System\lTFJnGT.exe
  2⤵
  PID:2236
- C:\Windows\System\WvgBvxi.exe
  C:\Windows\System\WvgBvxi.exe
  2⤵
  PID:872
- C:\Windows\System\DYbwQuA.exe
  C:\Windows\System\DYbwQuA.exe
  2⤵
  PID:1252
- C:\Windows\System\vWkGVGE.exe
  C:\Windows\System\vWkGVGE.exe
  2⤵
  PID:2780
- C:\Windows\System\HTmgwrq.exe
  C:\Windows\System\HTmgwrq.exe
  2⤵
  PID:2180
- C:\Windows\System\IBFMSxR.exe
  C:\Windows\System\IBFMSxR.exe
  2⤵
  PID:2240
- C:\Windows\System\ToUjgtA.exe
  C:\Windows\System\ToUjgtA.exe
  2⤵
  PID:3028
- C:\Windows\System\yoXqmOg.exe
  C:\Windows\System\yoXqmOg.exe
  2⤵
  PID:2508
- C:\Windows\System\AZvlhQf.exe
  C:\Windows\System\AZvlhQf.exe
  2⤵
  PID:2492
- C:\Windows\System\zYsaxSp.exe
  C:\Windows\System\zYsaxSp.exe
  2⤵
  PID:1028
- C:\Windows\System\VKDjPBu.exe
  C:\Windows\System\VKDjPBu.exe
  2⤵
  PID:304
- C:\Windows\System\eTnXMgY.exe
  C:\Windows\System\eTnXMgY.exe
  2⤵
  PID:1772
- C:\Windows\System\MSFejzf.exe
  C:\Windows\System\MSFejzf.exe
  2⤵
  PID:2068
- C:\Windows\System\vAVJxvs.exe
  C:\Windows\System\vAVJxvs.exe
  2⤵
  PID:1200
- C:\Windows\System\XrCiyBA.exe
  C:\Windows\System\XrCiyBA.exe
  2⤵
  PID:2016
- C:\Windows\System\rqJRyAc.exe
  C:\Windows\System\rqJRyAc.exe
  2⤵
  PID:3004
- C:\Windows\System\kqvXBra.exe
  C:\Windows\System\kqvXBra.exe
  2⤵
  PID:1680
- C:\Windows\System\WepeQDM.exe
  C:\Windows\System\WepeQDM.exe
  2⤵
  PID:2296
- C:\Windows\System\tZtrDoL.exe
  C:\Windows\System\tZtrDoL.exe
  2⤵
  PID:2904
- C:\Windows\System\yClSAmR.exe
  C:\Windows\System\yClSAmR.exe
  2⤵
  PID:2984
- C:\Windows\System\QGppIca.exe
  C:\Windows\System\QGppIca.exe
  2⤵
  PID:2372
- C:\Windows\System\xbJxPZj.exe
  C:\Windows\System\xbJxPZj.exe
  2⤵
  PID:3092
- C:\Windows\System\ikXAxSm.exe
  C:\Windows\System\ikXAxSm.exe
  2⤵
  PID:3120
- C:\Windows\System\WrKiwCp.exe
  C:\Windows\System\WrKiwCp.exe
  2⤵
  PID:3200
- C:\Windows\System\WmAEJur.exe
  C:\Windows\System\WmAEJur.exe
  2⤵
  PID:3224
- C:\Windows\System\xNIshkI.exe
  C:\Windows\System\xNIshkI.exe
  2⤵
  PID:3240
- C:\Windows\System\VGDHnWM.exe
  C:\Windows\System\VGDHnWM.exe
  2⤵
  PID:3256
- C:\Windows\System\SiMhdzM.exe
  C:\Windows\System\SiMhdzM.exe
  2⤵
  PID:3308
- C:\Windows\System\piLQVvu.exe
  C:\Windows\System\piLQVvu.exe
  2⤵
  PID:3324
- C:\Windows\System\YZyDNlk.exe
  C:\Windows\System\YZyDNlk.exe
  2⤵
  PID:3340
- C:\Windows\System\ByNREVK.exe
  C:\Windows\System\ByNREVK.exe
  2⤵
  PID:3356
- C:\Windows\System\rXRKemo.exe
  C:\Windows\System\rXRKemo.exe
  2⤵
  PID:3372
- C:\Windows\System\sMSltDT.exe
  C:\Windows\System\sMSltDT.exe
  2⤵
  PID:3388
- C:\Windows\System\qfaKfat.exe
  C:\Windows\System\qfaKfat.exe
  2⤵
  PID:3404
- C:\Windows\System\mWTsRgU.exe
  C:\Windows\System\mWTsRgU.exe
  2⤵
  PID:3420
- C:\Windows\System\TRblczL.exe
  C:\Windows\System\TRblczL.exe
  2⤵
  PID:3436
- C:\Windows\System\YDIvRni.exe
  C:\Windows\System\YDIvRni.exe
  2⤵
  PID:3508
- C:\Windows\System\winfanr.exe
  C:\Windows\System\winfanr.exe
  2⤵
  PID:3572
- C:\Windows\System\DjALNex.exe
  C:\Windows\System\DjALNex.exe
  2⤵
  PID:3592
- C:\Windows\System\EsSrDqv.exe
  C:\Windows\System\EsSrDqv.exe
  2⤵
  PID:3612
- C:\Windows\System\AlcgDnC.exe
  C:\Windows\System\AlcgDnC.exe
  2⤵
  PID:3632
- C:\Windows\System\SFNIDRN.exe
  C:\Windows\System\SFNIDRN.exe
  2⤵
  PID:3652
- C:\Windows\System\AKCkCEq.exe
  C:\Windows\System\AKCkCEq.exe
  2⤵
  PID:3672
- C:\Windows\System\GOWkbWj.exe
  C:\Windows\System\GOWkbWj.exe
  2⤵
  PID:3692
- C:\Windows\System\ihfGKIh.exe
  C:\Windows\System\ihfGKIh.exe
  2⤵
  PID:3712
- C:\Windows\System\HvqGXZw.exe
  C:\Windows\System\HvqGXZw.exe
  2⤵
  PID:3728
- C:\Windows\System\miKNOXR.exe
  C:\Windows\System\miKNOXR.exe
  2⤵
  PID:3752
- C:\Windows\System\wrhyvgE.exe
  C:\Windows\System\wrhyvgE.exe
  2⤵
  PID:3772
- C:\Windows\System\KZDsrAC.exe
  C:\Windows\System\KZDsrAC.exe
  2⤵
  PID:3788
- C:\Windows\System\aphfIqu.exe
  C:\Windows\System\aphfIqu.exe
  2⤵
  PID:3812
- C:\Windows\System\cDVdEZQ.exe
  C:\Windows\System\cDVdEZQ.exe
  2⤵
  PID:3828
- C:\Windows\System\vCKrMpv.exe
  C:\Windows\System\vCKrMpv.exe
  2⤵
  PID:3844
- C:\Windows\System\AyDtpXU.exe
  C:\Windows\System\AyDtpXU.exe
  2⤵
  PID:3868
- C:\Windows\System\PhAzIiP.exe
  C:\Windows\System\PhAzIiP.exe
  2⤵
  PID:3892
- C:\Windows\System\OQkVheV.exe
  C:\Windows\System\OQkVheV.exe
  2⤵
  PID:3908
- C:\Windows\System\DrvgnYM.exe
  C:\Windows\System\DrvgnYM.exe
  2⤵
  PID:3932
- C:\Windows\System\zvqaghX.exe
  C:\Windows\System\zvqaghX.exe
  2⤵
  PID:3952
- C:\Windows\System\BatiUBL.exe
  C:\Windows\System\BatiUBL.exe
  2⤵
  PID:3972
- C:\Windows\System\wZtHuLq.exe
  C:\Windows\System\wZtHuLq.exe
  2⤵
  PID:3988
- C:\Windows\System\YAyypCn.exe
  C:\Windows\System\YAyypCn.exe
  2⤵
  PID:4012
- C:\Windows\System\yUeTuUl.exe
  C:\Windows\System\yUeTuUl.exe
  2⤵
  PID:4032
- C:\Windows\System\aKbtwgt.exe
  C:\Windows\System\aKbtwgt.exe
  2⤵
  PID:4052
- C:\Windows\System\qHxjQSV.exe
  C:\Windows\System\qHxjQSV.exe
  2⤵
  PID:4072
- C:\Windows\System\psNGgcx.exe
  C:\Windows\System\psNGgcx.exe
  2⤵
  PID:4092
- C:\Windows\System\kXvpAYp.exe
  C:\Windows\System\kXvpAYp.exe
  2⤵
  PID:2576
- C:\Windows\System\pyJTVCA.exe
  C:\Windows\System\pyJTVCA.exe
  2⤵
  PID:876
- C:\Windows\System\qKXCaYK.exe
  C:\Windows\System\qKXCaYK.exe
  2⤵
  PID:3084
- C:\Windows\System\PWskFSx.exe
  C:\Windows\System\PWskFSx.exe
  2⤵
  PID:3116
- C:\Windows\System\fgSgwph.exe
  C:\Windows\System\fgSgwph.exe
  2⤵
  PID:3148
- C:\Windows\System\rkmrsVw.exe
  C:\Windows\System\rkmrsVw.exe
  2⤵
  PID:3168
- C:\Windows\System\opvXxyP.exe
  C:\Windows\System\opvXxyP.exe
  2⤵
  PID:3184
- C:\Windows\System\FoiwyCL.exe
  C:\Windows\System\FoiwyCL.exe
  2⤵
  PID:3216
- C:\Windows\System\aCFNkoS.exe
  C:\Windows\System\aCFNkoS.exe
  2⤵
  PID:3236
- C:\Windows\System\TUDQFuf.exe
  C:\Windows\System\TUDQFuf.exe
  2⤵
  PID:3276
- C:\Windows\System\gsYGJim.exe
  C:\Windows\System\gsYGJim.exe
  2⤵
  PID:3292
- C:\Windows\System\yYDFhHe.exe
  C:\Windows\System\yYDFhHe.exe
  2⤵
  PID:3304
- C:\Windows\System\BYZfxWE.exe
  C:\Windows\System\BYZfxWE.exe
  2⤵
  PID:3336
- C:\Windows\System\vOwzacr.exe
  C:\Windows\System\vOwzacr.exe
  2⤵
  PID:3380
- C:\Windows\System\yVfxptN.exe
  C:\Windows\System\yVfxptN.exe
  2⤵
  PID:3416
- C:\Windows\System\cZaGytD.exe
  C:\Windows\System\cZaGytD.exe
  2⤵
  PID:3464
- C:\Windows\System\YUAqCPe.exe
  C:\Windows\System\YUAqCPe.exe
  2⤵
  PID:3472
- C:\Windows\System\QNDubBt.exe
  C:\Windows\System\QNDubBt.exe
  2⤵
  PID:3492
- C:\Windows\System\GdZsamI.exe
  C:\Windows\System\GdZsamI.exe
  2⤵
  PID:3500
- C:\Windows\System\dZvJTNn.exe
  C:\Windows\System\dZvJTNn.exe
  2⤵
  PID:3528
- C:\Windows\System\lakaALr.exe
  C:\Windows\System\lakaALr.exe
  2⤵
  PID:3544
- C:\Windows\System\XSHZqxZ.exe
  C:\Windows\System\XSHZqxZ.exe
  2⤵
  PID:3568
- C:\Windows\System\cyWpdfL.exe
  C:\Windows\System\cyWpdfL.exe
  2⤵
  PID:3584
- C:\Windows\System\AsbZpkF.exe
  C:\Windows\System\AsbZpkF.exe
  2⤵
  PID:3640
- C:\Windows\System\fjomzsi.exe
  C:\Windows\System\fjomzsi.exe
  2⤵
  PID:3736
- C:\Windows\System\aVoAOKo.exe
  C:\Windows\System\aVoAOKo.exe
  2⤵
  PID:3780
- C:\Windows\System\Pxtoewk.exe
  C:\Windows\System\Pxtoewk.exe
  2⤵
  PID:3800
- C:\Windows\System\czktpWo.exe
  C:\Windows\System\czktpWo.exe
  2⤵
  PID:3820
- C:\Windows\System\HguahhA.exe
  C:\Windows\System\HguahhA.exe
  2⤵
  PID:3880
- C:\Windows\System\ehYFTBN.exe
  C:\Windows\System\ehYFTBN.exe
  2⤵
  PID:3900
- C:\Windows\System\GuDvTmr.exe
  C:\Windows\System\GuDvTmr.exe
  2⤵
  PID:3928
- C:\Windows\System\pYteeyg.exe
  C:\Windows\System\pYteeyg.exe
  2⤵
  PID:3968
- C:\Windows\System\HCVIPMm.exe
  C:\Windows\System\HCVIPMm.exe
  2⤵
  PID:3996
- C:\Windows\System\kaSzwwz.exe
  C:\Windows\System\kaSzwwz.exe
  2⤵
  PID:4024
- C:\Windows\System\rbuYPaR.exe
  C:\Windows\System\rbuYPaR.exe
  2⤵
  PID:4060
- C:\Windows\System\lhqmEsf.exe
  C:\Windows\System\lhqmEsf.exe
  2⤵
  PID:4084
- C:\Windows\System\QKswPcy.exe
  C:\Windows\System\QKswPcy.exe
  2⤵
  PID:3088
- C:\Windows\System\HbIeohL.exe
  C:\Windows\System\HbIeohL.exe
  2⤵
  PID:2404
- C:\Windows\System\IzRjPRy.exe
  C:\Windows\System\IzRjPRy.exe
  2⤵
  PID:3144
- C:\Windows\System\VQfilXS.exe
  C:\Windows\System\VQfilXS.exe
  2⤵
  PID:3160
- C:\Windows\System\YdAOkAI.exe
  C:\Windows\System\YdAOkAI.exe
  2⤵
  PID:3196
- C:\Windows\System\ikGrZht.exe
  C:\Windows\System\ikGrZht.exe
  2⤵
  PID:3332
- C:\Windows\System\mCPcAEX.exe
  C:\Windows\System\mCPcAEX.exe
  2⤵
  PID:3400
- C:\Windows\System\zeSfNYb.exe
  C:\Windows\System\zeSfNYb.exe
  2⤵
  PID:3504
- C:\Windows\System\JgLiXwW.exe
  C:\Windows\System\JgLiXwW.exe
  2⤵
  PID:3516
- C:\Windows\System\FYjyDyV.exe
  C:\Windows\System\FYjyDyV.exe
  2⤵
  PID:3604
- C:\Windows\System\DxuTvcf.exe
  C:\Windows\System\DxuTvcf.exe
  2⤵
  PID:3280
- C:\Windows\System\IgenIUI.exe
  C:\Windows\System\IgenIUI.exe
  2⤵
  PID:3680
- C:\Windows\System\xRAqMjC.exe
  C:\Windows\System\xRAqMjC.exe
  2⤵
  PID:3720
- C:\Windows\System\XZtKmRb.exe
  C:\Windows\System\XZtKmRb.exe
  2⤵
  PID:3856
- C:\Windows\System\TbTheTv.exe
  C:\Windows\System\TbTheTv.exe
  2⤵
  PID:3916
- C:\Windows\System\BVDZXKx.exe
  C:\Windows\System\BVDZXKx.exe
  2⤵
  PID:3852
- C:\Windows\System\phXcitT.exe
  C:\Windows\System\phXcitT.exe
  2⤵
  PID:2832
- C:\Windows\System\NqGnIoO.exe
  C:\Windows\System\NqGnIoO.exe
  2⤵
  PID:3180
- C:\Windows\System\QcEIzek.exe
  C:\Windows\System\QcEIzek.exe
  2⤵
  PID:3248
- C:\Windows\System\DjiBnOn.exe
  C:\Windows\System\DjiBnOn.exe
  2⤵
  PID:3540
- C:\Windows\System\SMguIjK.exe
  C:\Windows\System\SMguIjK.exe
  2⤵
  PID:3760
- C:\Windows\System\mcNzqCV.exe
  C:\Windows\System\mcNzqCV.exe
  2⤵
  PID:3888
- C:\Windows\System\FtXjlWr.exe
  C:\Windows\System\FtXjlWr.exe
  2⤵
  PID:2560
- C:\Windows\System\uwaKbpp.exe
  C:\Windows\System\uwaKbpp.exe
  2⤵
  PID:3156
- C:\Windows\System\OqcPKwD.exe
  C:\Windows\System\OqcPKwD.exe
  2⤵
  PID:3252
- C:\Windows\System\qawIBcJ.exe
  C:\Windows\System\qawIBcJ.exe
  2⤵
  PID:3412
- C:\Windows\System\ZLiLjgy.exe
  C:\Windows\System\ZLiLjgy.exe
  2⤵
  PID:3488
- C:\Windows\System\mPCqgOS.exe
  C:\Windows\System\mPCqgOS.exe
  2⤵
  PID:3724
- C:\Windows\System\rjOUbzq.exe
  C:\Windows\System\rjOUbzq.exe
  2⤵
  PID:3588
- C:\Windows\System\OEgGmVe.exe
  C:\Windows\System\OEgGmVe.exe
  2⤵
  PID:3108
- C:\Windows\System\wyrIOjW.exe
  C:\Windows\System\wyrIOjW.exe
  2⤵
  PID:3948
- C:\Windows\System\jKxENoG.exe
  C:\Windows\System\jKxENoG.exe
  2⤵
  PID:3320
- C:\Windows\System\TBHGvZj.exe
  C:\Windows\System\TBHGvZj.exe
  2⤵
  PID:3288
- C:\Windows\System\WzPanqS.exe
  C:\Windows\System\WzPanqS.exe
  2⤵
  PID:3684
- C:\Windows\System\tAFEshi.exe
  C:\Windows\System\tAFEshi.exe
  2⤵
  PID:3704
- C:\Windows\System\XztpCnA.exe
  C:\Windows\System\XztpCnA.exe
  2⤵
  PID:3804
- C:\Windows\System\HJbNkOb.exe
  C:\Windows\System\HJbNkOb.exe
  2⤵
  PID:4048
- C:\Windows\System\fxxsttZ.exe
  C:\Windows\System\fxxsttZ.exe
  2⤵
  PID:4020
- C:\Windows\System\uOxRUwg.exe
  C:\Windows\System\uOxRUwg.exe
  2⤵
  PID:3700
- C:\Windows\System\jCxJJVo.exe
  C:\Windows\System\jCxJJVo.exe
  2⤵
  PID:3452
- C:\Windows\System\bcEiJjO.exe
  C:\Windows\System\bcEiJjO.exe
  2⤵
  PID:3648
- C:\Windows\System\iWSNhRv.exe
  C:\Windows\System\iWSNhRv.exe
  2⤵
  PID:3608
- C:\Windows\System\ZwiOqPz.exe
  C:\Windows\System\ZwiOqPz.exe
  2⤵
  PID:4108
- C:\Windows\System\gTIPToN.exe
  C:\Windows\System\gTIPToN.exe
  2⤵
  PID:4128
- C:\Windows\System\HZCsEET.exe
  C:\Windows\System\HZCsEET.exe
  2⤵
  PID:4144
- C:\Windows\System\Xlngoiv.exe
  C:\Windows\System\Xlngoiv.exe
  2⤵
  PID:4160
- C:\Windows\System\GMayKAe.exe
  C:\Windows\System\GMayKAe.exe
  2⤵
  PID:4176
- C:\Windows\System\OxDaKvR.exe
  C:\Windows\System\OxDaKvR.exe
  2⤵
  PID:4196
- C:\Windows\System\OLNJTQY.exe
  C:\Windows\System\OLNJTQY.exe
  2⤵
  PID:4220
- C:\Windows\System\kQZAeOq.exe
  C:\Windows\System\kQZAeOq.exe
  2⤵
  PID:4236
- C:\Windows\System\PQbgtjo.exe
  C:\Windows\System\PQbgtjo.exe
  2⤵
  PID:4256
- C:\Windows\System\qYIETCu.exe
  C:\Windows\System\qYIETCu.exe
  2⤵
  PID:4276
- C:\Windows\System\QTxsmiI.exe
  C:\Windows\System\QTxsmiI.exe
  2⤵
  PID:4308
- C:\Windows\System\HOFFdhg.exe
  C:\Windows\System\HOFFdhg.exe
  2⤵
  PID:4328
- C:\Windows\System\zlLEGCm.exe
  C:\Windows\System\zlLEGCm.exe
  2⤵
  PID:4348
- C:\Windows\System\KJFuFxg.exe
  C:\Windows\System\KJFuFxg.exe
  2⤵
  PID:4372
- C:\Windows\System\dGDJwNX.exe
  C:\Windows\System\dGDJwNX.exe
  2⤵
  PID:4392
- C:\Windows\System\CAPWSND.exe
  C:\Windows\System\CAPWSND.exe
  2⤵
  PID:4412
- C:\Windows\System\oqzbVKk.exe
  C:\Windows\System\oqzbVKk.exe
  2⤵
  PID:4428
- C:\Windows\System\iMSteen.exe
  C:\Windows\System\iMSteen.exe
  2⤵
  PID:4448
- C:\Windows\System\BCLDDFr.exe
  C:\Windows\System\BCLDDFr.exe
  2⤵
  PID:4472
- C:\Windows\System\gRohNJF.exe
  C:\Windows\System\gRohNJF.exe
  2⤵
  PID:4488
- C:\Windows\System\GSAbBqc.exe
  C:\Windows\System\GSAbBqc.exe
  2⤵
  PID:4508
- C:\Windows\System\QibxTzc.exe
  C:\Windows\System\QibxTzc.exe
  2⤵
  PID:4524
- C:\Windows\System\NtDCEQA.exe
  C:\Windows\System\NtDCEQA.exe
  2⤵
  PID:4556
- C:\Windows\System\hTsdgcp.exe
  C:\Windows\System\hTsdgcp.exe
  2⤵
  PID:4572
- C:\Windows\System\GgICtgP.exe
  C:\Windows\System\GgICtgP.exe
  2⤵
  PID:4592
- C:\Windows\System\NOAJkUS.exe
  C:\Windows\System\NOAJkUS.exe
  2⤵
  PID:4616
- C:\Windows\System\qkxUbBQ.exe
  C:\Windows\System\qkxUbBQ.exe
  2⤵
  PID:4632
- C:\Windows\System\HnlguHN.exe
  C:\Windows\System\HnlguHN.exe
  2⤵
  PID:4648
- C:\Windows\System\nIMznAH.exe
  C:\Windows\System\nIMznAH.exe
  2⤵
  PID:4684
- C:\Windows\System\MexnLZH.exe
  C:\Windows\System\MexnLZH.exe
  2⤵
  PID:4700
- C:\Windows\System\KQgnzaT.exe
  C:\Windows\System\KQgnzaT.exe
  2⤵
  PID:4716
- C:\Windows\System\dEXhJog.exe
  C:\Windows\System\dEXhJog.exe
  2⤵
  PID:4732
- C:\Windows\System\hkRDEbJ.exe
  C:\Windows\System\hkRDEbJ.exe
  2⤵
  PID:4748
- C:\Windows\System\MvkAJku.exe
  C:\Windows\System\MvkAJku.exe
  2⤵
  PID:4768
- C:\Windows\System\UfpgmaB.exe
  C:\Windows\System\UfpgmaB.exe
  2⤵
  PID:4784
- C:\Windows\System\ItcDHzg.exe
  C:\Windows\System\ItcDHzg.exe
  2⤵
  PID:4812
- C:\Windows\System\sttMlZJ.exe
  C:\Windows\System\sttMlZJ.exe
  2⤵
  PID:4828
- C:\Windows\System\EZrQlxj.exe
  C:\Windows\System\EZrQlxj.exe
  2⤵
  PID:4844
- C:\Windows\System\gRWcLKm.exe
  C:\Windows\System\gRWcLKm.exe
  2⤵
  PID:4888
- C:\Windows\System\xdsKFvE.exe
  C:\Windows\System\xdsKFvE.exe
  2⤵
  PID:4904
- C:\Windows\System\rpnHAST.exe
  C:\Windows\System\rpnHAST.exe
  2⤵
  PID:4924
- C:\Windows\System\XmVWYoE.exe
  C:\Windows\System\XmVWYoE.exe
  2⤵
  PID:4940
- C:\Windows\System\NTSqpRu.exe
  C:\Windows\System\NTSqpRu.exe
  2⤵
  PID:4960
- C:\Windows\System\czIRflT.exe
  C:\Windows\System\czIRflT.exe
  2⤵
  PID:4980
- C:\Windows\System\JvhPCnh.exe
  C:\Windows\System\JvhPCnh.exe
  2⤵
  PID:4996
- C:\Windows\System\VYwUEjT.exe
  C:\Windows\System\VYwUEjT.exe
  2⤵
  PID:5012
- C:\Windows\System\csARwem.exe
  C:\Windows\System\csARwem.exe
  2⤵
  PID:5032
- C:\Windows\System\cslUHoL.exe
  C:\Windows\System\cslUHoL.exe
  2⤵
  PID:5052
- C:\Windows\System\KApxxaX.exe
  C:\Windows\System\KApxxaX.exe
  2⤵
  PID:5080
- C:\Windows\System\vMaxpJS.exe
  C:\Windows\System\vMaxpJS.exe
  2⤵
  PID:5096
- C:\Windows\System\ApcTzms.exe
  C:\Windows\System\ApcTzms.exe
  2⤵
  PID:5112
- C:\Windows\System\wEyvSPo.exe
  C:\Windows\System\wEyvSPo.exe
  2⤵
  PID:4136
- C:\Windows\System\xwktnKE.exe
  C:\Windows\System\xwktnKE.exe
  2⤵
  PID:4212
- C:\Windows\System\oEpaUBH.exe
  C:\Windows\System\oEpaUBH.exe
  2⤵
  PID:4248
- C:\Windows\System\xqPJeMr.exe
  C:\Windows\System\xqPJeMr.exe
  2⤵
  PID:4188
- C:\Windows\System\jjcNvLB.exe
  C:\Windows\System\jjcNvLB.exe
  2⤵
  PID:4288
- C:\Windows\System\PfhALfx.exe
  C:\Windows\System\PfhALfx.exe
  2⤵
  PID:4292
- C:\Windows\System\xpQCDgc.exe
  C:\Windows\System\xpQCDgc.exe
  2⤵
  PID:3428
- C:\Windows\System\znhNCbu.exe
  C:\Windows\System\znhNCbu.exe
  2⤵
  PID:4380
- C:\Windows\System\AaJuLXP.exe
  C:\Windows\System\AaJuLXP.exe
  2⤵
  PID:4124
- C:\Windows\System\vpaoYXA.exe
  C:\Windows\System\vpaoYXA.exe
  2⤵
  PID:4264
- C:\Windows\System\exlWcZy.exe
  C:\Windows\System\exlWcZy.exe
  2⤵
  PID:4504
- C:\Windows\System\HotadXb.exe
  C:\Windows\System\HotadXb.exe
  2⤵
  PID:4316
- C:\Windows\System\gxtKZyR.exe
  C:\Windows\System\gxtKZyR.exe
  2⤵
  PID:4360
- C:\Windows\System\SIbZLYV.exe
  C:\Windows\System\SIbZLYV.exe
  2⤵
  PID:4436
- C:\Windows\System\LoqbyqI.exe
  C:\Windows\System\LoqbyqI.exe
  2⤵
  PID:4404
- C:\Windows\System\RBjyfyX.exe
  C:\Windows\System\RBjyfyX.exe
  2⤵
  PID:4520
- C:\Windows\System\XGxkJls.exe
  C:\Windows\System\XGxkJls.exe
  2⤵
  PID:4552
- C:\Windows\System\RxazUyr.exe
  C:\Windows\System\RxazUyr.exe
  2⤵
  PID:4624
- C:\Windows\System\oqGnLcX.exe
  C:\Windows\System\oqGnLcX.exe
  2⤵
  PID:4668
- C:\Windows\System\NBhGhkW.exe
  C:\Windows\System\NBhGhkW.exe
  2⤵
  PID:4708
- C:\Windows\System\EpfAogd.exe
  C:\Windows\System\EpfAogd.exe
  2⤵
  PID:4612
- C:\Windows\System\iXGFYqa.exe
  C:\Windows\System\iXGFYqa.exe
  2⤵
  PID:4776
- C:\Windows\System\cCRHvoS.exe
  C:\Windows\System\cCRHvoS.exe
  2⤵
  PID:4696
- C:\Windows\System\kCZReJk.exe
  C:\Windows\System\kCZReJk.exe
  2⤵
  PID:4764
- C:\Windows\System\Cbldvog.exe
  C:\Windows\System\Cbldvog.exe
  2⤵
  PID:4808
- C:\Windows\System\rVOsfha.exe
  C:\Windows\System\rVOsfha.exe
  2⤵
  PID:4856
- C:\Windows\System\ColJAas.exe
  C:\Windows\System\ColJAas.exe
  2⤵
  PID:4872
- C:\Windows\System\tpftaVd.exe
  C:\Windows\System\tpftaVd.exe
  2⤵
  PID:4912
- C:\Windows\System\eSqcWys.exe
  C:\Windows\System\eSqcWys.exe
  2⤵
  PID:4948
- C:\Windows\System\bDMQyIh.exe
  C:\Windows\System\bDMQyIh.exe
  2⤵
  PID:5024
- C:\Windows\System\lCfhQfw.exe
  C:\Windows\System\lCfhQfw.exe
  2⤵
  PID:5064
- C:\Windows\System\OGmWfvP.exe
  C:\Windows\System\OGmWfvP.exe
  2⤵
  PID:5068
- C:\Windows\System\oBtZQkf.exe
  C:\Windows\System\oBtZQkf.exe
  2⤵
  PID:5108
- C:\Windows\System\dYjmZZN.exe
  C:\Windows\System\dYjmZZN.exe
  2⤵
  PID:4936
- C:\Windows\System\IvOqixJ.exe
  C:\Windows\System\IvOqixJ.exe
  2⤵
  PID:4976
- C:\Windows\System\nxUmcLd.exe
  C:\Windows\System\nxUmcLd.exe
  2⤵
  PID:3980
- C:\Windows\System\ahSzEMW.exe
  C:\Windows\System\ahSzEMW.exe
  2⤵
  PID:4300
- C:\Windows\System\hhQeZpJ.exe
  C:\Windows\System\hhQeZpJ.exe
  2⤵
  PID:4232
- C:\Windows\System\IHpLEZN.exe
  C:\Windows\System\IHpLEZN.exe
  2⤵
  PID:4088
- C:\Windows\System\ENhdwja.exe
  C:\Windows\System\ENhdwja.exe
  2⤵
  PID:4192
- C:\Windows\System\RuaeWlZ.exe
  C:\Windows\System\RuaeWlZ.exe
  2⤵
  PID:4120
- C:\Windows\System\EdlSgJE.exe
  C:\Windows\System\EdlSgJE.exe
  2⤵
  PID:4496
- C:\Windows\System\HnGGTpj.exe
  C:\Windows\System\HnGGTpj.exe
  2⤵
  PID:4536
- C:\Windows\System\MQMyCwx.exe
  C:\Windows\System\MQMyCwx.exe
  2⤵
  PID:4676
- C:\Windows\System\dKEgLKi.exe
  C:\Windows\System\dKEgLKi.exe
  2⤵
  PID:4744
- C:\Windows\System\pcBstpD.exe
  C:\Windows\System\pcBstpD.exe
  2⤵
  PID:4840
- C:\Windows\System\mxCIEtb.exe
  C:\Windows\System\mxCIEtb.exe
  2⤵
  PID:4480
- C:\Windows\System\qAbqeGG.exe
  C:\Windows\System\qAbqeGG.exe
  2⤵
  PID:5008
- C:\Windows\System\zmhGToR.exe
  C:\Windows\System\zmhGToR.exe
  2⤵
  PID:4296
- C:\Windows\System\BGYPAIp.exe
  C:\Windows\System\BGYPAIp.exe
  2⤵
  PID:4796
- C:\Windows\System\oicVCLx.exe
  C:\Windows\System\oicVCLx.exe
  2⤵
  PID:4388
- C:\Windows\System\flKZrFS.exe
  C:\Windows\System\flKZrFS.exe
  2⤵
  PID:4920
- C:\Windows\System\VTGNTLM.exe
  C:\Windows\System\VTGNTLM.exe
  2⤵
  PID:4456
- C:\Windows\System\cyDBQDD.exe
  C:\Windows\System\cyDBQDD.exe
  2⤵
  PID:4484
- C:\Windows\System\ZLEWGvf.exe
  C:\Windows\System\ZLEWGvf.exe
  2⤵
  PID:4500
- C:\Windows\System\GdBWLcp.exe
  C:\Windows\System\GdBWLcp.exe
  2⤵
  PID:5020
- C:\Windows\System\UHUtGvt.exe
  C:\Windows\System\UHUtGvt.exe
  2⤵
  PID:4400
- C:\Windows\System\wnwugsa.exe
  C:\Windows\System\wnwugsa.exe
  2⤵
  PID:4740
- C:\Windows\System\FZFssbN.exe
  C:\Windows\System\FZFssbN.exe
  2⤵
  PID:4252
- C:\Windows\System\GUrxWys.exe
  C:\Windows\System\GUrxWys.exe
  2⤵
  PID:4532
- C:\Windows\System\qJCuRpT.exe
  C:\Windows\System\qJCuRpT.exe
  2⤵
  PID:4896
- C:\Windows\System\YhyJqNQ.exe
  C:\Windows\System\YhyJqNQ.exe
  2⤵
  PID:5104
- C:\Windows\System\qDHkXUs.exe
  C:\Windows\System\qDHkXUs.exe
  2⤵
  PID:5092
- C:\Windows\System\lVnBPyc.exe
  C:\Windows\System\lVnBPyc.exe
  2⤵
  PID:4916
- C:\Windows\System\kApCFzW.exe
  C:\Windows\System\kApCFzW.exe
  2⤵
  PID:4884
- C:\Windows\System\macytqc.exe
  C:\Windows\System\macytqc.exe
  2⤵
  PID:4440
- C:\Windows\System\nNcZipw.exe
  C:\Windows\System\nNcZipw.exe
  2⤵
  PID:4580
- C:\Windows\System\AQVGLmm.exe
  C:\Windows\System\AQVGLmm.exe
  2⤵
  PID:4272
- C:\Windows\System\YLpboxn.exe
  C:\Windows\System\YLpboxn.exe
  2⤵
  PID:5044
- C:\Windows\System\zmzMFLF.exe
  C:\Windows\System\zmzMFLF.exe
  2⤵
  PID:4344
- C:\Windows\System\lljmSOt.exe
  C:\Windows\System\lljmSOt.exe
  2⤵
  PID:5132
- C:\Windows\System\yYwcpqc.exe
  C:\Windows\System\yYwcpqc.exe
  2⤵
  PID:5148
- C:\Windows\System\nobNJEp.exe
  C:\Windows\System\nobNJEp.exe
  2⤵
  PID:5164
- C:\Windows\System\zMAvxvD.exe
  C:\Windows\System\zMAvxvD.exe
  2⤵
  PID:5228
- C:\Windows\System\FwThWVJ.exe
  C:\Windows\System\FwThWVJ.exe
  2⤵
  PID:5244
- C:\Windows\System\zQnQkdF.exe
  C:\Windows\System\zQnQkdF.exe
  2⤵
  PID:5264
- C:\Windows\System\BrgbyVu.exe
  C:\Windows\System\BrgbyVu.exe
  2⤵
  PID:5284
- C:\Windows\System\AIyxiHb.exe
  C:\Windows\System\AIyxiHb.exe
  2⤵
  PID:5300
- C:\Windows\System\pTInVSS.exe
  C:\Windows\System\pTInVSS.exe
  2⤵
  PID:5324
- C:\Windows\System\enpHXMN.exe
  C:\Windows\System\enpHXMN.exe
  2⤵
  PID:5340
- C:\Windows\System\xThdZHh.exe
  C:\Windows\System\xThdZHh.exe
  2⤵
  PID:5356
- C:\Windows\System\PdPwmNO.exe
  C:\Windows\System\PdPwmNO.exe
  2⤵
  PID:5376
- C:\Windows\System\uqqPkXl.exe
  C:\Windows\System\uqqPkXl.exe
  2⤵
  PID:5396
- C:\Windows\System\dTGJbOL.exe
  C:\Windows\System\dTGJbOL.exe
  2⤵
  PID:5416
- C:\Windows\System\EAFjyyS.exe
  C:\Windows\System\EAFjyyS.exe
  2⤵
  PID:5440
- C:\Windows\System\PLMXdvb.exe
  C:\Windows\System\PLMXdvb.exe
  2⤵
  PID:5456
- C:\Windows\System\MTGxAnU.exe
  C:\Windows\System\MTGxAnU.exe
  2⤵
  PID:5484
- C:\Windows\System\HwVffUu.exe
  C:\Windows\System\HwVffUu.exe
  2⤵
  PID:5504
- C:\Windows\System\KluVldw.exe
  C:\Windows\System\KluVldw.exe
  2⤵
  PID:5524
- C:\Windows\System\KvQXSNz.exe
  C:\Windows\System\KvQXSNz.exe
  2⤵
  PID:5552
- C:\Windows\System\qLGemSx.exe
  C:\Windows\System\qLGemSx.exe
  2⤵
  PID:5568
- C:\Windows\System\eRIQEjP.exe
  C:\Windows\System\eRIQEjP.exe
  2⤵
  PID:5592
- C:\Windows\System\qOxIIDz.exe
  C:\Windows\System\qOxIIDz.exe
  2⤵
  PID:5608
- C:\Windows\System\bNsOrZe.exe
  C:\Windows\System\bNsOrZe.exe
  2⤵
  PID:5628
- C:\Windows\System\EnPQScT.exe
  C:\Windows\System\EnPQScT.exe
  2⤵
  PID:5648
- C:\Windows\System\CosBYdk.exe
  C:\Windows\System\CosBYdk.exe
  2⤵
  PID:5664
- C:\Windows\System\GhoTTly.exe
  C:\Windows\System\GhoTTly.exe
  2⤵
  PID:5680
- C:\Windows\System\TVRVBWt.exe
  C:\Windows\System\TVRVBWt.exe
  2⤵
  PID:5704
- C:\Windows\System\lSvYreu.exe
  C:\Windows\System\lSvYreu.exe
  2⤵
  PID:5724
- C:\Windows\System\qRToHQe.exe
  C:\Windows\System\qRToHQe.exe
  2⤵
  PID:5748
- C:\Windows\System\uKLRuAg.exe
  C:\Windows\System\uKLRuAg.exe
  2⤵
  PID:5772
- C:\Windows\System\VjnrVlu.exe
  C:\Windows\System\VjnrVlu.exe
  2⤵
  PID:5788
- C:\Windows\System\uOyWdgx.exe
  C:\Windows\System\uOyWdgx.exe
  2⤵
  PID:5804
- C:\Windows\System\xxtqhGv.exe
  C:\Windows\System\xxtqhGv.exe
  2⤵
  PID:5824
- C:\Windows\System\sKdapUB.exe
  C:\Windows\System\sKdapUB.exe
  2⤵
  PID:5856
- C:\Windows\System\fpOUWHM.exe
  C:\Windows\System\fpOUWHM.exe
  2⤵
  PID:5872
- C:\Windows\System\LIiGDEH.exe
  C:\Windows\System\LIiGDEH.exe
  2⤵
  PID:5888
- C:\Windows\System\ghyrZvq.exe
  C:\Windows\System\ghyrZvq.exe
  2⤵
  PID:5908
- C:\Windows\System\kbhbnwV.exe
  C:\Windows\System\kbhbnwV.exe
  2⤵
  PID:5924
- C:\Windows\System\hlPHkSV.exe
  C:\Windows\System\hlPHkSV.exe
  2⤵
  PID:5944
- C:\Windows\System\MiLQQvl.exe
  C:\Windows\System\MiLQQvl.exe
  2⤵
  PID:5960
- C:\Windows\System\XDFzCzp.exe
  C:\Windows\System\XDFzCzp.exe
  2⤵
  PID:5980
- C:\Windows\System\TrkSWzL.exe
  C:\Windows\System\TrkSWzL.exe
  2⤵
  PID:6000
- C:\Windows\System\gFqJhff.exe
  C:\Windows\System\gFqJhff.exe
  2⤵
  PID:6032
- C:\Windows\System\GXUHunP.exe
  C:\Windows\System\GXUHunP.exe
  2⤵
  PID:6052
- C:\Windows\System\MNUEaXd.exe
  C:\Windows\System\MNUEaXd.exe
  2⤵
  PID:6068
- C:\Windows\System\UnAIGMW.exe
  C:\Windows\System\UnAIGMW.exe
  2⤵
  PID:6084
- C:\Windows\System\xAxkIQy.exe
  C:\Windows\System\xAxkIQy.exe
  2⤵
  PID:6100
- C:\Windows\System\vnvKBWY.exe
  C:\Windows\System\vnvKBWY.exe
  2⤵
  PID:6116
- C:\Windows\System\nKfhbEy.exe
  C:\Windows\System\nKfhbEy.exe
  2⤵
  PID:6136
- C:\Windows\System\ILnOhLA.exe
  C:\Windows\System\ILnOhLA.exe
  2⤵
  PID:5172
- C:\Windows\System\vbGCyqR.exe
  C:\Windows\System\vbGCyqR.exe
  2⤵
  PID:5180
- C:\Windows\System\yDUmciP.exe
  C:\Windows\System\yDUmciP.exe
  2⤵
  PID:5196
- C:\Windows\System\VgDmnaz.exe
  C:\Windows\System\VgDmnaz.exe
  2⤵
  PID:4172
- C:\Windows\System\eJflxHJ.exe
  C:\Windows\System\eJflxHJ.exe
  2⤵
  PID:4424
- C:\Windows\System\OLlzGIp.exe
  C:\Windows\System\OLlzGIp.exe
  2⤵
  PID:4664
- C:\Windows\System\cdIriIN.exe
  C:\Windows\System\cdIriIN.exe
  2⤵
  PID:4600
- C:\Windows\System\hJCgpfz.exe
  C:\Windows\System\hJCgpfz.exe
  2⤵
  PID:5252
- C:\Windows\System\QMTfriR.exe
  C:\Windows\System\QMTfriR.exe
  2⤵
  PID:5160
- C:\Windows\System\hWxGhzv.exe
  C:\Windows\System\hWxGhzv.exe
  2⤵
  PID:5332
- C:\Windows\System\LEAGjrZ.exe
  C:\Windows\System\LEAGjrZ.exe
  2⤵
  PID:5408
- C:\Windows\System\nfVdIXd.exe
  C:\Windows\System\nfVdIXd.exe
  2⤵
  PID:5388
- C:\Windows\System\wtaVmIy.exe
  C:\Windows\System\wtaVmIy.exe
  2⤵
  PID:5272
- C:\Windows\System\ceDrDqw.exe
  C:\Windows\System\ceDrDqw.exe
  2⤵
  PID:5348
- C:\Windows\System\JIyClhR.exe
  C:\Windows\System\JIyClhR.exe
  2⤵
  PID:5448
- C:\Windows\System\xHGLUtz.exe
  C:\Windows\System\xHGLUtz.exe
  2⤵
  PID:5464
- C:\Windows\System\jCbiGjj.exe
  C:\Windows\System\jCbiGjj.exe
  2⤵
  PID:5500
- C:\Windows\System\alxxDzf.exe
  C:\Windows\System\alxxDzf.exe
  2⤵
  PID:5540
- C:\Windows\System\KbrOXmv.exe
  C:\Windows\System\KbrOXmv.exe
  2⤵
  PID:5588
- C:\Windows\System\FlkkReO.exe
  C:\Windows\System\FlkkReO.exe
  2⤵
  PID:5620
- C:\Windows\System\KXfLEwp.exe
  C:\Windows\System\KXfLEwp.exe
  2⤵
  PID:5688
- C:\Windows\System\XRcftNN.exe
  C:\Windows\System\XRcftNN.exe
  2⤵
  PID:5696
- C:\Windows\System\OhRLVRZ.exe
  C:\Windows\System\OhRLVRZ.exe
  2⤵
  PID:5604
- C:\Windows\System\HQzQsjd.exe
  C:\Windows\System\HQzQsjd.exe
  2⤵
  PID:5712
- C:\Windows\System\vUXgwYb.exe
  C:\Windows\System\vUXgwYb.exe
  2⤵
  PID:5720
- C:\Windows\System\IIXEmRf.exe
  C:\Windows\System\IIXEmRf.exe
  2⤵
  PID:5820
- C:\Windows\System\qEtMItz.exe
  C:\Windows\System\qEtMItz.exe
  2⤵
  PID:5796
- C:\Windows\System\TmphzXE.exe
  C:\Windows\System\TmphzXE.exe
  2⤵
  PID:5864
- C:\Windows\System\mOLVmdh.exe
  C:\Windows\System\mOLVmdh.exe
  2⤵
  PID:5832
- C:\Windows\System\xvvLyyo.exe
  C:\Windows\System\xvvLyyo.exe
  2⤵
  PID:5844
- C:\Windows\System\DKvDyjp.exe
  C:\Windows\System\DKvDyjp.exe
  2⤵
  PID:5852
- C:\Windows\System\tUSDtQu.exe
  C:\Windows\System\tUSDtQu.exe
  2⤵
  PID:5956
- C:\Windows\System\nQCsBZQ.exe
  C:\Windows\System\nQCsBZQ.exe
  2⤵
  PID:5988
- C:\Windows\System\ovaOVZM.exe
  C:\Windows\System\ovaOVZM.exe
  2⤵
  PID:6024
- C:\Windows\System\QvSUfYl.exe
  C:\Windows\System\QvSUfYl.exe
  2⤵
  PID:6064
- C:\Windows\System\stccZLG.exe
  C:\Windows\System\stccZLG.exe
  2⤵
  PID:5184
- C:\Windows\System\EBodGVB.exe
  C:\Windows\System\EBodGVB.exe
  2⤵
  PID:6044
- C:\Windows\System\RPCbmBw.exe
  C:\Windows\System\RPCbmBw.exe
  2⤵
  PID:5140
- C:\Windows\System\aagGuyY.exe
  C:\Windows\System\aagGuyY.exe
  2⤵
  PID:5144
- C:\Windows\System\tcHTnIg.exe
  C:\Windows\System\tcHTnIg.exe
  2⤵
  PID:5292
- C:\Windows\System\FKcKBGM.exe
  C:\Windows\System\FKcKBGM.exe
  2⤵
  PID:5316
- C:\Windows\System\YQgzzTW.exe
  C:\Windows\System\YQgzzTW.exe
  2⤵
  PID:5428
- C:\Windows\System\nYiDwGn.exe
  C:\Windows\System\nYiDwGn.exe
  2⤵
  PID:5480
- C:\Windows\System\becYZPL.exe
  C:\Windows\System\becYZPL.exe
  2⤵
  PID:5700
- C:\Windows\System\dNgiNFx.exe
  C:\Windows\System\dNgiNFx.exe
  2⤵
  PID:4608
- C:\Windows\System\zdsfzrj.exe
  C:\Windows\System\zdsfzrj.exe
  2⤵
  PID:5936
- C:\Windows\System\nFbHrXc.exe
  C:\Windows\System\nFbHrXc.exe
  2⤵
  PID:3348
- C:\Windows\System\tQmnTtF.exe
  C:\Windows\System\tQmnTtF.exe
  2⤵
  PID:5260
- C:\Windows\System\ovukjrZ.exe
  C:\Windows\System\ovukjrZ.exe
  2⤵
  PID:6020
- C:\Windows\System\ufoaAFp.exe
  C:\Windows\System\ufoaAFp.exe
  2⤵
  PID:5492
- C:\Windows\System\oqDLeRg.exe
  C:\Windows\System\oqDLeRg.exe
  2⤵
  PID:5536
- C:\Windows\System\YmGdWJM.exe
  C:\Windows\System\YmGdWJM.exe
  2⤵
  PID:5636
- C:\Windows\System\yqKtMDj.exe
  C:\Windows\System\yqKtMDj.exe
  2⤵
  PID:5760
- C:\Windows\System\TuMESJo.exe
  C:\Windows\System\TuMESJo.exe
  2⤵
  PID:5800
- C:\Windows\System\pxhXRxi.exe
  C:\Windows\System\pxhXRxi.exe
  2⤵
  PID:5920
- C:\Windows\System\TSLUIki.exe
  C:\Windows\System\TSLUIki.exe
  2⤵
  PID:6124
- C:\Windows\System\YWuzBNp.exe
  C:\Windows\System\YWuzBNp.exe
  2⤵
  PID:6108
- C:\Windows\System\TPZfjnH.exe
  C:\Windows\System\TPZfjnH.exe
  2⤵
  PID:5220
- C:\Windows\System\UFCXmfR.exe
  C:\Windows\System\UFCXmfR.exe
  2⤵
  PID:4244
- C:\Windows\System\OLBRkXA.exe
  C:\Windows\System\OLBRkXA.exe
  2⤵
  PID:4692
- C:\Windows\System\WyGXOlD.exe
  C:\Windows\System\WyGXOlD.exe
  2⤵
  PID:5624
- C:\Windows\System\wnaVqvm.exe
  C:\Windows\System\wnaVqvm.exe
  2⤵
  PID:5412
- C:\Windows\System\wOCSKqj.exe
  C:\Windows\System\wOCSKqj.exe
  2⤵
  PID:5784
- C:\Windows\System\TRKXstV.exe
  C:\Windows\System\TRKXstV.exe
  2⤵
  PID:5932
- C:\Windows\System\yowRUqC.exe
  C:\Windows\System\yowRUqC.exe
  2⤵
  PID:5372
- C:\Windows\System\cxdcuxK.exe
  C:\Windows\System\cxdcuxK.exe
  2⤵
  PID:6040
- C:\Windows\System\tldkOwS.exe
  C:\Windows\System\tldkOwS.exe
  2⤵
  PID:5512
- C:\Windows\System\mEadsYZ.exe
  C:\Windows\System\mEadsYZ.exe
  2⤵
  PID:5520
- C:\Windows\System\qTcHuWm.exe
  C:\Windows\System\qTcHuWm.exe
  2⤵
  PID:5780
- C:\Windows\System\KxSWNNC.exe
  C:\Windows\System\KxSWNNC.exe
  2⤵
  PID:4952
- C:\Windows\System\eixBjID.exe
  C:\Windows\System\eixBjID.exe
  2⤵
  PID:5972
- C:\Windows\System\QaJNIcT.exe
  C:\Windows\System\QaJNIcT.exe
  2⤵
  PID:4156
- C:\Windows\System\lpfZUMP.exe
  C:\Windows\System\lpfZUMP.exe
  2⤵
  PID:4656
- C:\Windows\System\UAWmhEE.exe
  C:\Windows\System\UAWmhEE.exe
  2⤵
  PID:5384
- C:\Windows\System\UPyYDji.exe
  C:\Windows\System\UPyYDji.exe
  2⤵
  PID:4800
- C:\Windows\System\UzzpYmp.exe
  C:\Windows\System\UzzpYmp.exe
  2⤵
  PID:5560
- C:\Windows\System\fisyGnQ.exe
  C:\Windows\System\fisyGnQ.exe
  2⤵
  PID:5884
- C:\Windows\System\OfRfPkE.exe
  C:\Windows\System\OfRfPkE.exe
  2⤵
  PID:5900
- C:\Windows\System\bRRuOAL.exe
  C:\Windows\System\bRRuOAL.exe
  2⤵
  PID:6148
- C:\Windows\System\mRpWlgN.exe
  C:\Windows\System\mRpWlgN.exe
  2⤵
  PID:6164
- C:\Windows\System\gpaluIG.exe
  C:\Windows\System\gpaluIG.exe
  2⤵
  PID:6180
- C:\Windows\System\YovPaHa.exe
  C:\Windows\System\YovPaHa.exe
  2⤵
  PID:6196
- C:\Windows\System\nMtoTTF.exe
  C:\Windows\System\nMtoTTF.exe
  2⤵
  PID:6216
- C:\Windows\System\MbMxuSM.exe
  C:\Windows\System\MbMxuSM.exe
  2⤵
  PID:6236
- C:\Windows\System\RWqnQTZ.exe
  C:\Windows\System\RWqnQTZ.exe
  2⤵
  PID:6252
- C:\Windows\System\sTIfLKY.exe
  C:\Windows\System\sTIfLKY.exe
  2⤵
  PID:6272
- C:\Windows\System\fxkaXiD.exe
  C:\Windows\System\fxkaXiD.exe
  2⤵
  PID:6288
- C:\Windows\System\fstRPOH.exe
  C:\Windows\System\fstRPOH.exe
  2⤵
  PID:6308
- C:\Windows\System\rnEMqjM.exe
  C:\Windows\System\rnEMqjM.exe
  2⤵
  PID:6324
- C:\Windows\System\RRIUCWK.exe
  C:\Windows\System\RRIUCWK.exe
  2⤵
  PID:6344
- C:\Windows\System\ACyXfNx.exe
  C:\Windows\System\ACyXfNx.exe
  2⤵
  PID:6368
- C:\Windows\System\RGfCjHS.exe
  C:\Windows\System\RGfCjHS.exe
  2⤵
  PID:6384
- C:\Windows\System\EOOEikn.exe
  C:\Windows\System\EOOEikn.exe
  2⤵
  PID:6404
- C:\Windows\System\hItkyty.exe
  C:\Windows\System\hItkyty.exe
  2⤵
  PID:6420
- C:\Windows\System\CIBQJvL.exe
  C:\Windows\System\CIBQJvL.exe
  2⤵
  PID:6440
- C:\Windows\System\vKDAERE.exe
  C:\Windows\System\vKDAERE.exe
  2⤵
  PID:6480
- C:\Windows\System\FvITxXJ.exe
  C:\Windows\System\FvITxXJ.exe
  2⤵
  PID:6512
- C:\Windows\System\ZzthiKC.exe
  C:\Windows\System\ZzthiKC.exe
  2⤵
  PID:6528
- C:\Windows\System\vAoYnFV.exe
  C:\Windows\System\vAoYnFV.exe
  2⤵
  PID:6564
- C:\Windows\System\jqBpQjV.exe
  C:\Windows\System\jqBpQjV.exe
  2⤵
  PID:6588
- C:\Windows\System\tyDxuAs.exe
  C:\Windows\System\tyDxuAs.exe
  2⤵
  PID:6604
- C:\Windows\System\XmTZBTd.exe
  C:\Windows\System\XmTZBTd.exe
  2⤵
  PID:6624
- C:\Windows\System\HtaMXFw.exe
  C:\Windows\System\HtaMXFw.exe
  2⤵
  PID:6640
- C:\Windows\System\creMuPO.exe
  C:\Windows\System\creMuPO.exe
  2⤵
  PID:6660
- C:\Windows\System\hjDXBVf.exe
  C:\Windows\System\hjDXBVf.exe
  2⤵
  PID:6676
- C:\Windows\System\xCjdWou.exe
  C:\Windows\System\xCjdWou.exe
  2⤵
  PID:6696
- C:\Windows\System\boQYwUp.exe
  C:\Windows\System\boQYwUp.exe
  2⤵
  PID:6712
- C:\Windows\System\EALNjGR.exe
  C:\Windows\System\EALNjGR.exe
  2⤵
  PID:6732
- C:\Windows\System\cPubdfg.exe
  C:\Windows\System\cPubdfg.exe
  2⤵
  PID:6748
- C:\Windows\System\lscQJgd.exe
  C:\Windows\System\lscQJgd.exe
  2⤵
  PID:6772
- C:\Windows\System\PhMJaSV.exe
  C:\Windows\System\PhMJaSV.exe
  2⤵
  PID:6792
- C:\Windows\System\QtnnzhS.exe
  C:\Windows\System\QtnnzhS.exe
  2⤵
  PID:6808
- C:\Windows\System\tcGTZcC.exe
  C:\Windows\System\tcGTZcC.exe
  2⤵
  PID:6848
- C:\Windows\System\cQWLEMV.exe
  C:\Windows\System\cQWLEMV.exe
  2⤵
  PID:6868
- C:\Windows\System\jhuuAos.exe
  C:\Windows\System\jhuuAos.exe
  2⤵
  PID:6888
- C:\Windows\System\tAMVTCi.exe
  C:\Windows\System\tAMVTCi.exe
  2⤵
  PID:6908
- C:\Windows\System\blbDdDT.exe
  C:\Windows\System\blbDdDT.exe
  2⤵
  PID:6924
- C:\Windows\System\GEziIvW.exe
  C:\Windows\System\GEziIvW.exe
  2⤵
  PID:6944
- C:\Windows\System\kfIbDsp.exe
  C:\Windows\System\kfIbDsp.exe
  2⤵
  PID:6964
- C:\Windows\System\eDtQHOF.exe
  C:\Windows\System\eDtQHOF.exe
  2⤵
  PID:6980
- C:\Windows\System\PIVyjiy.exe
  C:\Windows\System\PIVyjiy.exe
  2⤵
  PID:6996
- C:\Windows\System\tHcdzoh.exe
  C:\Windows\System\tHcdzoh.exe
  2⤵
  PID:7012
- C:\Windows\System\kAWVEAL.exe
  C:\Windows\System\kAWVEAL.exe
  2⤵
  PID:7036
- C:\Windows\System\MtoEBGk.exe
  C:\Windows\System\MtoEBGk.exe
  2⤵
  PID:7056
- C:\Windows\System\IYFVzqh.exe
  C:\Windows\System\IYFVzqh.exe
  2⤵
  PID:7076
- C:\Windows\System\UuRjMAV.exe
  C:\Windows\System\UuRjMAV.exe
  2⤵
  PID:7100
- C:\Windows\System\sMKVbjs.exe
  C:\Windows\System\sMKVbjs.exe
  2⤵
  PID:7120
- C:\Windows\System\JvlRSaP.exe
  C:\Windows\System\JvlRSaP.exe
  2⤵
  PID:7136
- C:\Windows\System\MSSiNwE.exe
  C:\Windows\System\MSSiNwE.exe
  2⤵
  PID:7152
- C:\Windows\System\NJDXgwm.exe
  C:\Windows\System\NJDXgwm.exe
  2⤵
  PID:4724
- C:\Windows\System\MMgpsYI.exe
  C:\Windows\System\MMgpsYI.exe
  2⤵
  PID:6232
- C:\Windows\System\cmqtTEM.exe
  C:\Windows\System\cmqtTEM.exe
  2⤵
  PID:6228
- C:\Windows\System\JUlxIFU.exe
  C:\Windows\System\JUlxIFU.exe
  2⤵
  PID:5312
- C:\Windows\System\gMVjvNA.exe
  C:\Windows\System\gMVjvNA.exe
  2⤵
  PID:6416
- C:\Windows\System\XGKvYhX.exe
  C:\Windows\System\XGKvYhX.exe
  2⤵
  PID:6468
- C:\Windows\System\unwvhWm.exe
  C:\Windows\System\unwvhWm.exe
  2⤵
  PID:6476
- C:\Windows\System\MrVsJwq.exe
  C:\Windows\System\MrVsJwq.exe
  2⤵
  PID:5028
- C:\Windows\System\ChDGvaG.exe
  C:\Windows\System\ChDGvaG.exe
  2⤵
  PID:5516
- C:\Windows\System\ZDDQTTT.exe
  C:\Windows\System\ZDDQTTT.exe
  2⤵
  PID:5976
- C:\Windows\System\TLbPTnY.exe
  C:\Windows\System\TLbPTnY.exe
  2⤵
  PID:6356
- C:\Windows\System\hpFnqTo.exe
  C:\Windows\System\hpFnqTo.exe
  2⤵
  PID:6112
- C:\Windows\System\hBdRewn.exe
  C:\Windows\System\hBdRewn.exe
  2⤵
  PID:5532
- C:\Windows\System\pRlxgsy.exe
  C:\Windows\System\pRlxgsy.exe
  2⤵
  PID:6320
- C:\Windows\System\zWQMcMJ.exe
  C:\Windows\System\zWQMcMJ.exe
  2⤵
  PID:6492
- C:\Windows\System\NpqdBNg.exe
  C:\Windows\System\NpqdBNg.exe
  2⤵
  PID:6488
- C:\Windows\System\GDVYncm.exe
  C:\Windows\System\GDVYncm.exe
  2⤵
  PID:6544
- C:\Windows\System\idKQXCw.exe
  C:\Windows\System\idKQXCw.exe
  2⤵
  PID:6576
- C:\Windows\System\YGtoLwu.exe
  C:\Windows\System\YGtoLwu.exe
  2⤵
  PID:6648
- C:\Windows\System\Avhvgzo.exe
  C:\Windows\System\Avhvgzo.exe
  2⤵
  PID:6684
- C:\Windows\System\JVBYUpC.exe
  C:\Windows\System\JVBYUpC.exe
  2⤵
  PID:6724
- C:\Windows\System\uQWtaHb.exe
  C:\Windows\System\uQWtaHb.exe
  2⤵
  PID:6768
- C:\Windows\System\pqbpeic.exe
  C:\Windows\System\pqbpeic.exe
  2⤵
  PID:6668
- C:\Windows\System\cGGuvpu.exe
  C:\Windows\System\cGGuvpu.exe
  2⤵
  PID:6780
- C:\Windows\System\YxlLsXo.exe
  C:\Windows\System\YxlLsXo.exe
  2⤵
  PID:6632
- C:\Windows\System\ipdEJUT.exe
  C:\Windows\System\ipdEJUT.exe
  2⤵
  PID:6816
- C:\Windows\System\MGjFaVj.exe
  C:\Windows\System\MGjFaVj.exe
  2⤵
  PID:6856
- C:\Windows\System\JNIyAcG.exe
  C:\Windows\System\JNIyAcG.exe
  2⤵
  PID:6876
- C:\Windows\System\FStgaJA.exe
  C:\Windows\System\FStgaJA.exe
  2⤵
  PID:6932
- C:\Windows\System\LBOFdAL.exe
  C:\Windows\System\LBOFdAL.exe
  2⤵
  PID:6936
- C:\Windows\System\LXwkEPV.exe
  C:\Windows\System\LXwkEPV.exe
  2⤵
  PID:6976
- C:\Windows\System\MXQVkMF.exe
  C:\Windows\System\MXQVkMF.exe
  2⤵
  PID:7088
- C:\Windows\System\RlUrIDG.exe
  C:\Windows\System\RlUrIDG.exe
  2⤵
  PID:7132
- C:\Windows\System\PdARGhi.exe
  C:\Windows\System\PdARGhi.exe
  2⤵
  PID:6952
- C:\Windows\System\sIRQTsc.exe
  C:\Windows\System\sIRQTsc.exe
  2⤵
  PID:7020
- C:\Windows\System\OeeYmfu.exe
  C:\Windows\System\OeeYmfu.exe
  2⤵
  PID:7024
- C:\Windows\System\PFlAzQe.exe
  C:\Windows\System\PFlAzQe.exe
  2⤵
  PID:7112
- C:\Windows\System\MpbeFYB.exe
  C:\Windows\System\MpbeFYB.exe
  2⤵
  PID:6224
- C:\Windows\System\RtBtXwx.exe
  C:\Windows\System\RtBtXwx.exe
  2⤵
  PID:6452
- C:\Windows\System\KNwxBSO.exe
  C:\Windows\System\KNwxBSO.exe
  2⤵
  PID:6376
- C:\Windows\System\MGyKiSA.exe
  C:\Windows\System\MGyKiSA.exe
  2⤵
  PID:5496
- C:\Windows\System\jQrrzRi.exe
  C:\Windows\System\jQrrzRi.exe
  2⤵
  PID:5188
- C:\Windows\System\vHUHLPH.exe
  C:\Windows\System\vHUHLPH.exe
  2⤵
  PID:6316
- C:\Windows\System\OYrgeht.exe
  C:\Windows\System\OYrgeht.exe
  2⤵
  PID:6504
- C:\Windows\System\BsJaKHX.exe
  C:\Windows\System\BsJaKHX.exe
  2⤵
  PID:6204
- C:\Windows\System\etmWDmc.exe
  C:\Windows\System\etmWDmc.exe
  2⤵
  PID:5992
- C:\Windows\System\iBoXLGB.exe
  C:\Windows\System\iBoXLGB.exe
  2⤵
  PID:6584
- C:\Windows\System\geDgtTO.exe
  C:\Windows\System\geDgtTO.exe
  2⤵
  PID:6720
- C:\Windows\System\NIfVRcr.exe
  C:\Windows\System\NIfVRcr.exe
  2⤵
  PID:6704
- C:\Windows\System\GgQHdfd.exe
  C:\Windows\System\GgQHdfd.exe
  2⤵
  PID:6172
- C:\Windows\System\EnNPKuE.exe
  C:\Windows\System\EnNPKuE.exe
  2⤵
  PID:6284
- C:\Windows\System\vtNMEYp.exe
  C:\Windows\System\vtNMEYp.exe
  2⤵
  PID:6208
- C:\Windows\System\mfYGkYZ.exe
  C:\Windows\System\mfYGkYZ.exe
  2⤵
  PID:6596
- C:\Windows\System\sLeJfIe.exe
  C:\Windows\System\sLeJfIe.exe
  2⤵
  PID:6820
- C:\Windows\System\peLAfAb.exe
  C:\Windows\System\peLAfAb.exe
  2⤵
  PID:6636
- C:\Windows\System\GEzXDdo.exe
  C:\Windows\System\GEzXDdo.exe
  2⤵
  PID:7064
- C:\Windows\System\iKTTXKi.exe
  C:\Windows\System\iKTTXKi.exe
  2⤵
  PID:6616
- C:\Windows\System\pfAoClS.exe
  C:\Windows\System\pfAoClS.exe
  2⤵
  PID:6836
- C:\Windows\System\cPEsVUI.exe
  C:\Windows\System\cPEsVUI.exe
  2⤵
  PID:6828
- C:\Windows\System\wwbKtVy.exe
  C:\Windows\System\wwbKtVy.exe
  2⤵
  PID:7044
- C:\Windows\System\BmKrkUZ.exe
  C:\Windows\System\BmKrkUZ.exe
  2⤵
  PID:7116
- C:\Windows\System\bTFAiIE.exe
  C:\Windows\System\bTFAiIE.exe
  2⤵
  PID:6472
- C:\Windows\System\brjPwQm.exe
  C:\Windows\System\brjPwQm.exe
  2⤵
  PID:6396
- C:\Windows\System\oUoYBoH.exe
  C:\Windows\System\oUoYBoH.exe
  2⤵
  PID:7160
- C:\Windows\System\JRahezb.exe
  C:\Windows\System\JRahezb.exe
  2⤵
  PID:6264
- C:\Windows\System\JHFjBbD.exe
  C:\Windows\System\JHFjBbD.exe
  2⤵
  PID:6456
- C:\Windows\System\XwdbZbT.exe
  C:\Windows\System\XwdbZbT.exe
  2⤵
  PID:6600
- C:\Windows\System\XbaCcsN.exe
  C:\Windows\System\XbaCcsN.exe
  2⤵
  PID:6572
- C:\Windows\System\uEmFQPZ.exe
  C:\Windows\System\uEmFQPZ.exe
  2⤵
  PID:6788
- C:\Windows\System\ScLJfrm.exe
  C:\Windows\System\ScLJfrm.exe
  2⤵
  PID:6692
- C:\Windows\System\bKzUaBD.exe
  C:\Windows\System\bKzUaBD.exe
  2⤵
  PID:6884
- C:\Windows\System\gyxGAzN.exe
  C:\Windows\System\gyxGAzN.exe
  2⤵
  PID:6244
- C:\Windows\System\zdMldNr.exe
  C:\Windows\System\zdMldNr.exe
  2⤵
  PID:7164
- C:\Windows\System\VzhmpVh.exe
  C:\Windows\System\VzhmpVh.exe
  2⤵
  PID:6552
- C:\Windows\System\OAauVgk.exe
  C:\Windows\System\OAauVgk.exe
  2⤵
  PID:7176
- C:\Windows\System\ODHEIAq.exe
  C:\Windows\System\ODHEIAq.exe
  2⤵
  PID:7224
- C:\Windows\System\pDngJXX.exe
  C:\Windows\System\pDngJXX.exe
  2⤵
  PID:7240
- C:\Windows\System\qwAIfpk.exe
  C:\Windows\System\qwAIfpk.exe
  2⤵
  PID:7256
- C:\Windows\System\ypzSnhb.exe
  C:\Windows\System\ypzSnhb.exe
  2⤵
  PID:7276
- C:\Windows\System\JdZunET.exe
  C:\Windows\System\JdZunET.exe
  2⤵
  PID:7296
- C:\Windows\System\GIaxYel.exe
  C:\Windows\System\GIaxYel.exe
  2⤵
  PID:7312
- C:\Windows\System\WaJKuzD.exe
  C:\Windows\System\WaJKuzD.exe
  2⤵
  PID:7328
- C:\Windows\System\JtEgGBs.exe
  C:\Windows\System\JtEgGBs.exe
  2⤵
  PID:7348
- C:\Windows\System\ePxuKEN.exe
  C:\Windows\System\ePxuKEN.exe
  2⤵
  PID:7368
- C:\Windows\System\IMpzYDV.exe
  C:\Windows\System\IMpzYDV.exe
  2⤵
  PID:7384
- C:\Windows\System\VGggGZp.exe
  C:\Windows\System\VGggGZp.exe
  2⤵
  PID:7404
- C:\Windows\System\zbRNPbW.exe
  C:\Windows\System\zbRNPbW.exe
  2⤵
  PID:7420
- C:\Windows\System\KprWrmg.exe
  C:\Windows\System\KprWrmg.exe
  2⤵
  PID:7440
- C:\Windows\System\jTOrbtL.exe
  C:\Windows\System\jTOrbtL.exe
  2⤵
  PID:7460
- C:\Windows\System\BJqireO.exe
  C:\Windows\System\BJqireO.exe
  2⤵
  PID:7480
- C:\Windows\System\lPNibmJ.exe
  C:\Windows\System\lPNibmJ.exe
  2⤵
  PID:7496
- C:\Windows\System\trDjDRg.exe
  C:\Windows\System\trDjDRg.exe
  2⤵
  PID:7516
- C:\Windows\System\KsfIkdW.exe
  C:\Windows\System\KsfIkdW.exe
  2⤵
  PID:7532
- C:\Windows\System\EEoGOSG.exe
  C:\Windows\System\EEoGOSG.exe
  2⤵
  PID:7548
- C:\Windows\System\nvgEiVb.exe
  C:\Windows\System\nvgEiVb.exe
  2⤵
  PID:7564
- C:\Windows\System\cQKwmsi.exe
  C:\Windows\System\cQKwmsi.exe
  2⤵
  PID:7584
- C:\Windows\System\oNXZelI.exe
  C:\Windows\System\oNXZelI.exe
  2⤵
  PID:7600
- C:\Windows\System\JfSkhHX.exe
  C:\Windows\System\JfSkhHX.exe
  2⤵
  PID:7620
- C:\Windows\System\FGbttFj.exe
  C:\Windows\System\FGbttFj.exe
  2⤵
  PID:7640
- C:\Windows\System\VVqPobt.exe
  C:\Windows\System\VVqPobt.exe
  2⤵
  PID:7660
- C:\Windows\System\EthRMMY.exe
  C:\Windows\System\EthRMMY.exe
  2⤵
  PID:7676
- C:\Windows\System\rdUQAAN.exe
  C:\Windows\System\rdUQAAN.exe
  2⤵
  PID:7692
- C:\Windows\System\yuMepRz.exe
  C:\Windows\System\yuMepRz.exe
  2⤵
  PID:7712
- C:\Windows\System\MsrqJWw.exe
  C:\Windows\System\MsrqJWw.exe
  2⤵
  PID:7732
- C:\Windows\System\OKZngJc.exe
  C:\Windows\System\OKZngJc.exe
  2⤵
  PID:7752
- C:\Windows\System\xkhsBQf.exe
  C:\Windows\System\xkhsBQf.exe
  2⤵
  PID:7772
- C:\Windows\System\rGPIzWw.exe
  C:\Windows\System\rGPIzWw.exe
  2⤵
  PID:7788
- C:\Windows\System\WzpNcwo.exe
  C:\Windows\System\WzpNcwo.exe
  2⤵
  PID:7808
- C:\Windows\System\pIwOiqJ.exe
  C:\Windows\System\pIwOiqJ.exe
  2⤵
  PID:7824
- C:\Windows\System\pzcCAjN.exe
  C:\Windows\System\pzcCAjN.exe
  2⤵
  PID:7848
- C:\Windows\System\rHxvFji.exe
  C:\Windows\System\rHxvFji.exe
  2⤵
  PID:7864
- C:\Windows\System\nRbfxSv.exe
  C:\Windows\System\nRbfxSv.exe
  2⤵
  PID:7880
- C:\Windows\System\JSlZrwb.exe
  C:\Windows\System\JSlZrwb.exe
  2⤵
  PID:7900
- C:\Windows\System\vUoOFbG.exe
  C:\Windows\System\vUoOFbG.exe
  2⤵
  PID:7920
- C:\Windows\System\gafGJIe.exe
  C:\Windows\System\gafGJIe.exe
  2⤵
  PID:7936
- C:\Windows\System\fdqdVpd.exe
  C:\Windows\System\fdqdVpd.exe
  2⤵
  PID:7952
- C:\Windows\System\vKbwsTv.exe
  C:\Windows\System\vKbwsTv.exe
  2⤵
  PID:7972
- C:\Windows\System\WWkEvkd.exe
  C:\Windows\System\WWkEvkd.exe
  2⤵
  PID:7992
- C:\Windows\System\uAtQcnK.exe
  C:\Windows\System\uAtQcnK.exe
  2⤵
  PID:8008
- C:\Windows\System\jYiqfra.exe
  C:\Windows\System\jYiqfra.exe
  2⤵
  PID:8028
- C:\Windows\System\DUCohEE.exe
  C:\Windows\System\DUCohEE.exe
  2⤵
  PID:8048
- C:\Windows\System\bfYRnAg.exe
  C:\Windows\System\bfYRnAg.exe
  2⤵
  PID:8064
- C:\Windows\System\KaPRNwP.exe
  C:\Windows\System\KaPRNwP.exe
  2⤵
  PID:8084
- C:\Windows\System\wfCohMU.exe
  C:\Windows\System\wfCohMU.exe
  2⤵
  PID:8104
- C:\Windows\System\XvdsUzd.exe
  C:\Windows\System\XvdsUzd.exe
  2⤵
  PID:8120
- C:\Windows\System\SmlTmme.exe
  C:\Windows\System\SmlTmme.exe
  2⤵
  PID:8144
- C:\Windows\System\FnrZEmA.exe
  C:\Windows\System\FnrZEmA.exe
  2⤵
  PID:8160
- C:\Windows\System\BTPQpDG.exe
  C:\Windows\System\BTPQpDG.exe
  2⤵
  PID:8180
- C:\Windows\System\MOdvlgK.exe
  C:\Windows\System\MOdvlgK.exe
  2⤵
  PID:6844
- C:\Windows\System\fngnBVm.exe
  C:\Windows\System\fngnBVm.exe
  2⤵
  PID:6620
- C:\Windows\System\rGSTTtq.exe
  C:\Windows\System\rGSTTtq.exe
  2⤵
  PID:6304
- C:\Windows\System\sJYzkhv.exe
  C:\Windows\System\sJYzkhv.exe
  2⤵
  PID:6296
- C:\Windows\System\NwWpdkX.exe
  C:\Windows\System\NwWpdkX.exe
  2⤵
  PID:6016
- C:\Windows\System\pMZqOpa.exe
  C:\Windows\System\pMZqOpa.exe
  2⤵
  PID:6920
- C:\Windows\System\XsuZgoy.exe
  C:\Windows\System\XsuZgoy.exe
  2⤵
  PID:7272
- C:\Windows\System\ANXBzcE.exe
  C:\Windows\System\ANXBzcE.exe
  2⤵
  PID:6212
- C:\Windows\System\zwtYRYa.exe
  C:\Windows\System\zwtYRYa.exe
  2⤵
  PID:7204
- C:\Windows\System\xgyRbpe.exe
  C:\Windows\System\xgyRbpe.exe
  2⤵
  PID:7376
- C:\Windows\System\KFuneGQ.exe
  C:\Windows\System\KFuneGQ.exe
  2⤵
  PID:7452
- C:\Windows\System\SQxwnBO.exe
  C:\Windows\System\SQxwnBO.exe
  2⤵
  PID:7492
- C:\Windows\System\mVctiET.exe
  C:\Windows\System\mVctiET.exe
  2⤵
  PID:7592
- C:\Windows\System\iRwuXaF.exe
  C:\Windows\System\iRwuXaF.exe
  2⤵
  PID:2268
- C:\Windows\System\FbOTDrL.exe
  C:\Windows\System\FbOTDrL.exe
  2⤵
  PID:7704
- C:\Windows\System\lidaIZO.exe
  C:\Windows\System\lidaIZO.exe
  2⤵
  PID:7212
- C:\Windows\System\ePYKHRG.exe
  C:\Windows\System\ePYKHRG.exe
  2⤵
  PID:7784
- C:\Windows\System\rZVNjbe.exe
  C:\Windows\System\rZVNjbe.exe
  2⤵
  PID:7888
- C:\Windows\System\LcKCMUO.exe
  C:\Windows\System\LcKCMUO.exe
  2⤵
  PID:7928
- C:\Windows\System\PaMFlaF.exe
  C:\Windows\System\PaMFlaF.exe
  2⤵
  PID:8004
- C:\Windows\System\fgTXkgA.exe
  C:\Windows\System\fgTXkgA.exe
  2⤵
  PID:8072
- C:\Windows\System\KDyqLLd.exe
  C:\Windows\System\KDyqLLd.exe
  2⤵
  PID:8116
- C:\Windows\System\oiXRAAz.exe
  C:\Windows\System\oiXRAAz.exe
  2⤵
  PID:8188
- C:\Windows\System\ZeZnfFa.exe
  C:\Windows\System\ZeZnfFa.exe
  2⤵
  PID:6336
- C:\Windows\System\hNAZLvp.exe
  C:\Windows\System\hNAZLvp.exe
  2⤵
  PID:7196
- C:\Windows\System\qxFBXOQ.exe
  C:\Windows\System\qxFBXOQ.exe
  2⤵
  PID:8168
- C:\Windows\System\GpNFYJf.exe
  C:\Windows\System\GpNFYJf.exe
  2⤵
  PID:6332
- C:\Windows\System\wbmADaT.exe
  C:\Windows\System\wbmADaT.exe
  2⤵
  PID:6460
- C:\Windows\System\FTTHtTc.exe
  C:\Windows\System\FTTHtTc.exe
  2⤵
  PID:7184
- C:\Windows\System\YqVHJsT.exe
  C:\Windows\System\YqVHJsT.exe
  2⤵
  PID:7284
- C:\Windows\System\FKCPwDw.exe
  C:\Windows\System\FKCPwDw.exe
  2⤵
  PID:7632
- C:\Windows\System\eRmprqH.exe
  C:\Windows\System\eRmprqH.exe
  2⤵
  PID:7648
- C:\Windows\System\TACqWYd.exe
  C:\Windows\System\TACqWYd.exe
  2⤵
  PID:7820
- C:\Windows\System\PtSNqsA.exe
  C:\Windows\System\PtSNqsA.exe
  2⤵
  PID:8112
- C:\Windows\System\INnUCwi.exe
  C:\Windows\System\INnUCwi.exe
  2⤵
  PID:7320
- C:\Windows\System\EqJKPYv.exe
  C:\Windows\System\EqJKPYv.exe
  2⤵
  PID:7916
- C:\Windows\System\CKYMgie.exe
  C:\Windows\System\CKYMgie.exe
  2⤵
  PID:8060
- C:\Windows\System\FraBlpr.exe
  C:\Windows\System\FraBlpr.exe
  2⤵
  PID:7432
- C:\Windows\System\KpIfUGr.exe
  C:\Windows\System\KpIfUGr.exe
  2⤵
  PID:6824
- C:\Windows\System\osNnDlU.exe
  C:\Windows\System\osNnDlU.exe
  2⤵
  PID:7684
- C:\Windows\System\MvMEyly.exe
  C:\Windows\System\MvMEyly.exe
  2⤵
  PID:7944
- C:\Windows\System\odZuOGx.exe
  C:\Windows\System\odZuOGx.exe
  2⤵
  PID:7764
- C:\Windows\System\QBtVGwe.exe
  C:\Windows\System\QBtVGwe.exe
  2⤵
  PID:7840
- C:\Windows\System\apHtEbV.exe
  C:\Windows\System\apHtEbV.exe
  2⤵
  PID:7988
- C:\Windows\System\HdCEhfL.exe
  C:\Windows\System\HdCEhfL.exe
  2⤵
  PID:8024
- C:\Windows\System\vXJPPlA.exe
  C:\Windows\System\vXJPPlA.exe
  2⤵
  PID:8140
- C:\Windows\System\IICOQVd.exe
  C:\Windows\System\IICOQVd.exe
  2⤵
  PID:7488
- C:\Windows\System\YckrwvM.exe
  C:\Windows\System\YckrwvM.exe
  2⤵
  PID:6988
- C:\Windows\System\kLjOeJF.exe
  C:\Windows\System\kLjOeJF.exe
  2⤵
  PID:6188
- C:\Windows\System\cJJOgPP.exe
  C:\Windows\System\cJJOgPP.exe
  2⤵
  PID:7932
- C:\Windows\System\RyArrpo.exe
  C:\Windows\System\RyArrpo.exe
  2⤵
  PID:7264
- C:\Windows\System\ZLsqibs.exe
  C:\Windows\System\ZLsqibs.exe
  2⤵
  PID:7948
- C:\Windows\System\JqgLDBq.exe
  C:\Windows\System\JqgLDBq.exe
  2⤵
  PID:6900
- C:\Windows\System\vUHeVkG.exe
  C:\Windows\System\vUHeVkG.exe
  2⤵
  PID:7740
- C:\Windows\System\LVvILjA.exe
  C:\Windows\System\LVvILjA.exe
  2⤵
  PID:8056
- C:\Windows\System\oUsOafs.exe
  C:\Windows\System\oUsOafs.exe
  2⤵
  PID:7656
- C:\Windows\System\GBasPeJ.exe
  C:\Windows\System\GBasPeJ.exe
  2⤵
  PID:6496
- C:\Windows\System\eHCbTNT.exe
  C:\Windows\System\eHCbTNT.exe
  2⤵
  PID:7872
- C:\Windows\System\wGwpbLz.exe
  C:\Windows\System\wGwpbLz.exe
  2⤵
  PID:7652
- C:\Windows\System\aFZBufl.exe
  C:\Windows\System\aFZBufl.exe
  2⤵
  PID:8156
- C:\Windows\System\CYCrvJh.exe
  C:\Windows\System\CYCrvJh.exe
  2⤵
  PID:7580
- C:\Windows\System\fvFpjNB.exe
  C:\Windows\System\fvFpjNB.exe
  2⤵
  PID:7556
- C:\Windows\System\FMWWyNH.exe
  C:\Windows\System\FMWWyNH.exe
  2⤵
  PID:7344
- C:\Windows\System\PKAarFV.exe
  C:\Windows\System\PKAarFV.exe
  2⤵
  PID:7236
- C:\Windows\System\eLoYSZU.exe
  C:\Windows\System\eLoYSZU.exe
  2⤵
  PID:7760
- C:\Windows\System\KYRlctF.exe
  C:\Windows\System\KYRlctF.exe
  2⤵
  PID:8080
- C:\Windows\System\MlJUoau.exe
  C:\Windows\System\MlJUoau.exe
  2⤵
  PID:7800
- C:\Windows\System\AGGgGtg.exe
  C:\Windows\System\AGGgGtg.exe
  2⤵
  PID:7468
- C:\Windows\System\yVXDtTN.exe
  C:\Windows\System\yVXDtTN.exe
  2⤵
  PID:8196
- C:\Windows\System\nsuLrQR.exe
  C:\Windows\System\nsuLrQR.exe
  2⤵
  PID:8216
- C:\Windows\System\WkydUrb.exe
  C:\Windows\System\WkydUrb.exe
  2⤵
  PID:8236
- C:\Windows\System\exnJZhT.exe
  C:\Windows\System\exnJZhT.exe
  2⤵
  PID:8256
- C:\Windows\System\ONuXSED.exe
  C:\Windows\System\ONuXSED.exe
  2⤵
  PID:8272
- C:\Windows\System\CdhWrhs.exe
  C:\Windows\System\CdhWrhs.exe
  2⤵
  PID:8288
- C:\Windows\System\kDNeSMI.exe
  C:\Windows\System\kDNeSMI.exe
  2⤵
  PID:8312
- C:\Windows\System\yLLMfCB.exe
  C:\Windows\System\yLLMfCB.exe
  2⤵
  PID:8332
- C:\Windows\System\hUnXrcr.exe
  C:\Windows\System\hUnXrcr.exe
  2⤵
  PID:8356
- C:\Windows\System\itIoofr.exe
  C:\Windows\System\itIoofr.exe
  2⤵
  PID:8372
- C:\Windows\System\nrpIlNp.exe
  C:\Windows\System\nrpIlNp.exe
  2⤵
  PID:8440
- C:\Windows\System\WMErhmR.exe
  C:\Windows\System\WMErhmR.exe
  2⤵
  PID:8456
- C:\Windows\System\BlSyrgC.exe
  C:\Windows\System\BlSyrgC.exe
  2⤵
  PID:8472
- C:\Windows\System\KQEqQuh.exe
  C:\Windows\System\KQEqQuh.exe
  2⤵
  PID:8496
- C:\Windows\System\ntduKeM.exe
  C:\Windows\System\ntduKeM.exe
  2⤵
  PID:8516
- C:\Windows\System\DrocIgm.exe
  C:\Windows\System\DrocIgm.exe
  2⤵
  PID:8532
- C:\Windows\System\EoMdGTK.exe
  C:\Windows\System\EoMdGTK.exe
  2⤵
  PID:8548
- C:\Windows\System\fBhHpnM.exe
  C:\Windows\System\fBhHpnM.exe
  2⤵
  PID:8568
- C:\Windows\System\RcmMnyh.exe
  C:\Windows\System\RcmMnyh.exe
  2⤵
  PID:8584
- C:\Windows\System\xDKyhec.exe
  C:\Windows\System\xDKyhec.exe
  2⤵
  PID:8600
- C:\Windows\System\OUlUsyU.exe
  C:\Windows\System\OUlUsyU.exe
  2⤵
  PID:8624
- C:\Windows\System\zFTfWRX.exe
  C:\Windows\System\zFTfWRX.exe
  2⤵
  PID:8644
- C:\Windows\System\tHzhREZ.exe
  C:\Windows\System\tHzhREZ.exe
  2⤵
  PID:8660
- C:\Windows\System\muBZkUV.exe
  C:\Windows\System\muBZkUV.exe
  2⤵
  PID:8680
- C:\Windows\System\pKlLSIm.exe
  C:\Windows\System\pKlLSIm.exe
  2⤵
  PID:8696
- C:\Windows\System\vKfzsft.exe
  C:\Windows\System\vKfzsft.exe
  2⤵
  PID:8716
- C:\Windows\System\rvnqYbe.exe
  C:\Windows\System\rvnqYbe.exe
  2⤵
  PID:8732
- C:\Windows\System\diYTnfX.exe
  C:\Windows\System\diYTnfX.exe
  2⤵
  PID:8752
- C:\Windows\System\UmVMTjc.exe
  C:\Windows\System\UmVMTjc.exe
  2⤵
  PID:8768
- C:\Windows\System\HMhDjLx.exe
  C:\Windows\System\HMhDjLx.exe
  2⤵
  PID:8788
- C:\Windows\System\jYtYDal.exe
  C:\Windows\System\jYtYDal.exe
  2⤵
  PID:8804
- C:\Windows\System\OOJxLhX.exe
  C:\Windows\System\OOJxLhX.exe
  2⤵
  PID:8824
- C:\Windows\System\VPldHfg.exe
  C:\Windows\System\VPldHfg.exe
  2⤵
  PID:8856
- C:\Windows\System\PjPVeeq.exe
  C:\Windows\System\PjPVeeq.exe
  2⤵
  PID:8872
- C:\Windows\System\hiHnEYu.exe
  C:\Windows\System\hiHnEYu.exe
  2⤵
  PID:8888
- C:\Windows\System\MYcbknX.exe
  C:\Windows\System\MYcbknX.exe
  2⤵
  PID:8908
- C:\Windows\System\tAEwhxu.exe
  C:\Windows\System\tAEwhxu.exe
  2⤵
  PID:8924
- C:\Windows\System\wLjaGyT.exe
  C:\Windows\System\wLjaGyT.exe
  2⤵
  PID:8948
- C:\Windows\System\yuxpExY.exe
  C:\Windows\System\yuxpExY.exe
  2⤵
  PID:8964
- C:\Windows\System\lltUMnd.exe
  C:\Windows\System\lltUMnd.exe
  2⤵
  PID:8984
- C:\Windows\System\GXinQSN.exe
  C:\Windows\System\GXinQSN.exe
  2⤵
  PID:9048
- C:\Windows\System\zKjrDXB.exe
  C:\Windows\System\zKjrDXB.exe
  2⤵
  PID:9064
- C:\Windows\System\QIHpojK.exe
  C:\Windows\System\QIHpojK.exe
  2⤵
  PID:9080
- C:\Windows\System\KgwNuyx.exe
  C:\Windows\System\KgwNuyx.exe
  2⤵
  PID:9100
- C:\Windows\System\rGWiDyl.exe
  C:\Windows\System\rGWiDyl.exe
  2⤵
  PID:9116
- C:\Windows\System\DuZrfhw.exe
  C:\Windows\System\DuZrfhw.exe
  2⤵
  PID:9136
- C:\Windows\System\rTiuQoy.exe
  C:\Windows\System\rTiuQoy.exe
  2⤵
  PID:9152
- C:\Windows\System\njZSYZE.exe
  C:\Windows\System\njZSYZE.exe
  2⤵
  PID:9172
- C:\Windows\System\NOXMJml.exe
  C:\Windows\System\NOXMJml.exe
  2⤵
  PID:9188
- C:\Windows\System\HkFPPmO.exe
  C:\Windows\System\HkFPPmO.exe
  2⤵
  PID:9208
- C:\Windows\System\eUuTaPA.exe
  C:\Windows\System\eUuTaPA.exe
  2⤵
  PID:7560
- C:\Windows\System\zhYsASy.exe
  C:\Windows\System\zhYsASy.exe
  2⤵
  PID:8228
- C:\Windows\System\JwhYjVj.exe
  C:\Windows\System\JwhYjVj.exe
  2⤵
  PID:8308
- C:\Windows\System\OQLzaZG.exe
  C:\Windows\System\OQLzaZG.exe
  2⤵
  PID:8348
- C:\Windows\System\DzwWNwL.exe
  C:\Windows\System\DzwWNwL.exe
  2⤵
  PID:8384
- C:\Windows\System\cNYpHbA.exe
  C:\Windows\System\cNYpHbA.exe
  2⤵
  PID:7456
- C:\Windows\System\exZkxhh.exe
  C:\Windows\System\exZkxhh.exe
  2⤵
  PID:8408
- C:\Windows\System\Xnxbdsn.exe
  C:\Windows\System\Xnxbdsn.exe
  2⤵
  PID:8420
- C:\Windows\System\IxFPokt.exe
  C:\Windows\System\IxFPokt.exe
  2⤵
  PID:7396
- C:\Windows\System\uOLlxBv.exe
  C:\Windows\System\uOLlxBv.exe
  2⤵
  PID:8388
- C:\Windows\System\zibBTGw.exe
  C:\Windows\System\zibBTGw.exe
  2⤵
  PID:8176
- C:\Windows\System\qVFouwg.exe
  C:\Windows\System\qVFouwg.exe
  2⤵
  PID:7908
- C:\Windows\System\atmzfht.exe
  C:\Windows\System\atmzfht.exe
  2⤵
  PID:6612
- C:\Windows\System\AprEIXj.exe
  C:\Windows\System\AprEIXj.exe
  2⤵
  PID:8468
- C:\Windows\System\nXfWzWb.exe
  C:\Windows\System\nXfWzWb.exe
  2⤵
  PID:7720
- C:\Windows\System\ZasUhYO.exe
  C:\Windows\System\ZasUhYO.exe
  2⤵
  PID:7860
- C:\Windows\System\RXZVNkj.exe
  C:\Windows\System\RXZVNkj.exe
  2⤵
  PID:8248
- C:\Windows\System\htqrdHO.exe
  C:\Windows\System\htqrdHO.exe
  2⤵
  PID:8324
- C:\Windows\System\YwMRssj.exe
  C:\Windows\System\YwMRssj.exe
  2⤵
  PID:8244
- C:\Windows\System\IMapTfS.exe
  C:\Windows\System\IMapTfS.exe
  2⤵
  PID:8540
- C:\Windows\System\eRJSigs.exe
  C:\Windows\System\eRJSigs.exe
  2⤵
  PID:8612
- C:\Windows\System\YVhDQFB.exe
  C:\Windows\System\YVhDQFB.exe
  2⤵
  PID:8956
- C:\Windows\System\AYrkHXY.exe
  C:\Windows\System\AYrkHXY.exe
  2⤵
  PID:8448
- C:\Windows\System\gXsuvaL.exe
  C:\Windows\System\gXsuvaL.exe
  2⤵
  PID:9000
- C:\Windows\System\waoBPwh.exe
  C:\Windows\System\waoBPwh.exe
  2⤵
  PID:8596
- C:\Windows\System\UWpWEUQ.exe
  C:\Windows\System\UWpWEUQ.exe
  2⤵
  PID:8480
- C:\Windows\System\vmFqjQz.exe
  C:\Windows\System\vmFqjQz.exe
  2⤵
  PID:8524
- C:\Windows\System\dnVFEUM.exe
  C:\Windows\System\dnVFEUM.exe
  2⤵
  PID:8592
- C:\Windows\System\DyrjSvi.exe
  C:\Windows\System\DyrjSvi.exe
  2⤵
  PID:8712
- C:\Windows\System\WjwapCR.exe
  C:\Windows\System\WjwapCR.exe
  2⤵
  PID:8904
- C:\Windows\System\qcGVbVR.exe
  C:\Windows\System\qcGVbVR.exe
  2⤵
  PID:8868
- C:\Windows\System\rnolcOE.exe
  C:\Windows\System\rnolcOE.exe
  2⤵
  PID:8812
- C:\Windows\System\AlEHvxa.exe
  C:\Windows\System\AlEHvxa.exe
  2⤵
  PID:8940
- C:\Windows\System\OoFfznS.exe
  C:\Windows\System\OoFfznS.exe
  2⤵
  PID:9036
- C:\Windows\System\qbyOPRq.exe
  C:\Windows\System\qbyOPRq.exe
  2⤵
  PID:9076
- C:\Windows\System\KHmmpKq.exe
  C:\Windows\System\KHmmpKq.exe
  2⤵
  PID:9180
- C:\Windows\System\FSzbcsL.exe
  C:\Windows\System\FSzbcsL.exe
  2⤵
  PID:8396
- C:\Windows\System\obMhDKF.exe
  C:\Windows\System\obMhDKF.exe
  2⤵
  PID:8428
- C:\Windows\System\FypwynI.exe
  C:\Windows\System\FypwynI.exe
  2⤵
  PID:7628
- C:\Windows\System\lORGxjC.exe
  C:\Windows\System\lORGxjC.exe
  2⤵
  PID:7672
- C:\Windows\System\QLUYZqX.exe
  C:\Windows\System\QLUYZqX.exe
  2⤵
  PID:8208
- C:\Windows\System\chBrqip.exe
  C:\Windows\System\chBrqip.exe
  2⤵
  PID:9128
- C:\Windows\System\NnMkeXZ.exe
  C:\Windows\System\NnMkeXZ.exe
  2⤵
  PID:8232
- C:\Windows\System\vIhjLqm.exe
  C:\Windows\System\vIhjLqm.exe
  2⤵
  PID:7528
- C:\Windows\System\cYNlKKZ.exe
  C:\Windows\System\cYNlKKZ.exe
  2⤵
  PID:8436
- C:\Windows\System\XhxDNbV.exe
  C:\Windows\System\XhxDNbV.exe
  2⤵
  PID:8464
- C:\Windows\System\pFTjxTi.exe
  C:\Windows\System\pFTjxTi.exe
  2⤵
  PID:8280
- C:\Windows\System\oTFyhYE.exe
  C:\Windows\System\oTFyhYE.exe
  2⤵
  PID:8608
- C:\Windows\System\rHvPNba.exe
  C:\Windows\System\rHvPNba.exe
  2⤵
  PID:8656
- C:\Windows\System\islgNLO.exe
  C:\Windows\System\islgNLO.exe
  2⤵
  PID:8400
- C:\Windows\System\ADroCqZ.exe
  C:\Windows\System\ADroCqZ.exe
  2⤵
  PID:8796
- C:\Windows\System\JOfLeSx.exe
  C:\Windows\System\JOfLeSx.exe
  2⤵
  PID:8836
- C:\Windows\System\BfCiFdC.exe
  C:\Windows\System\BfCiFdC.exe
  2⤵
  PID:8564
- C:\Windows\System\DYbMCQy.exe
  C:\Windows\System\DYbMCQy.exe
  2⤵
  PID:8632
- C:\Windows\System\SZkUdsn.exe
  C:\Windows\System\SZkUdsn.exe
  2⤵
  PID:8556
- C:\Windows\System\TUheQxV.exe
  C:\Windows\System\TUheQxV.exe
  2⤵
  PID:8668
- C:\Windows\System\SCQHpei.exe
  C:\Windows\System\SCQHpei.exe
  2⤵
  PID:8936
- C:\Windows\System\xxeYnwC.exe
  C:\Windows\System\xxeYnwC.exe
  2⤵
  PID:8780
- C:\Windows\System\gQARwcb.exe
  C:\Windows\System\gQARwcb.exe
  2⤵
  PID:9204
- C:\Windows\System\XYrroGt.exe
  C:\Windows\System\XYrroGt.exe
  2⤵
  PID:9144
- C:\Windows\System\eUvCoKN.exe
  C:\Windows\System\eUvCoKN.exe
  2⤵
  PID:8304
- C:\Windows\System\QSDOMwG.exe
  C:\Windows\System\QSDOMwG.exe
  2⤵
  PID:8132
- C:\Windows\System\ZHgnCxU.exe
  C:\Windows\System\ZHgnCxU.exe
  2⤵
  PID:7172
- C:\Windows\System\bLQQXAH.exe
  C:\Windows\System\bLQQXAH.exe
  2⤵
  PID:9124
- C:\Windows\System\xuZVfYF.exe
  C:\Windows\System\xuZVfYF.exe
  2⤵
  PID:8264
- C:\Windows\System\jvmLCIN.exe
  C:\Windows\System\jvmLCIN.exe
  2⤵
  PID:8432
- C:\Windows\System\GJxIEpk.exe
  C:\Windows\System\GJxIEpk.exe
  2⤵
  PID:7804
- C:\Windows\System\bGxBMop.exe
  C:\Windows\System\bGxBMop.exe
  2⤵
  PID:8544
- C:\Windows\System\AcVYKMg.exe
  C:\Windows\System\AcVYKMg.exe
  2⤵
  PID:7572
- C:\Windows\System\pgjpWod.exe
  C:\Windows\System\pgjpWod.exe
  2⤵
  PID:8848
- C:\Windows\System\jwiHrkG.exe
  C:\Windows\System\jwiHrkG.exe
  2⤵
  PID:8852
- C:\Windows\System\HWNMEMD.exe
  C:\Windows\System\HWNMEMD.exe
  2⤵
  PID:8992
- C:\Windows\System\zAoPHNB.exe
  C:\Windows\System\zAoPHNB.exe
  2⤵
  PID:9028
- C:\Windows\System\rHdSOwD.exe
  C:\Windows\System\rHdSOwD.exe
  2⤵
  PID:9012
- C:\Windows\System\HULuSsO.exe
  C:\Windows\System\HULuSsO.exe
  2⤵
  PID:8708
- C:\Windows\System\vTiAERz.exe
  C:\Windows\System\vTiAERz.exe
  2⤵
  PID:9096
- C:\Windows\System\Fhqjmik.exe
  C:\Windows\System\Fhqjmik.exe
  2⤵
  PID:7220
- C:\Windows\System\GnVAINs.exe
  C:\Windows\System\GnVAINs.exe
  2⤵
  PID:8296
- C:\Windows\System\etdPtSZ.exe
  C:\Windows\System\etdPtSZ.exe
  2⤵
  PID:9060
- C:\Windows\System\VKCcMsh.exe
  C:\Windows\System\VKCcMsh.exe
  2⤵
  PID:8580
- C:\Windows\System\qxdMCZU.exe
  C:\Windows\System\qxdMCZU.exe
  2⤵
  PID:8820
- C:\Windows\System\BCyLRBu.exe
  C:\Windows\System\BCyLRBu.exe
  2⤵
  PID:8920
- C:\Windows\System\aHRPjZg.exe
  C:\Windows\System\aHRPjZg.exe
  2⤵
  PID:8268
- C:\Windows\System\kuhVaXY.exe
  C:\Windows\System\kuhVaXY.exe
  2⤵
  PID:8212
- C:\Windows\System\KJAgUvs.exe
  C:\Windows\System\KJAgUvs.exe
  2⤵
  PID:9164
- C:\Windows\System\qJfGOsk.exe
  C:\Windows\System\qJfGOsk.exe
  2⤵
  PID:9092
- C:\Windows\System\tVCdCVM.exe
  C:\Windows\System\tVCdCVM.exe
  2⤵
  PID:8832
- C:\Windows\System\hVojmZe.exe
  C:\Windows\System\hVojmZe.exe
  2⤵
  PID:8020
- C:\Windows\System\hYwJzrE.exe
  C:\Windows\System\hYwJzrE.exe
  2⤵
  PID:8688
- C:\Windows\System\kIMSPKv.exe
  C:\Windows\System\kIMSPKv.exe
  2⤵
  PID:7364
- C:\Windows\System\oBPFpYC.exe
  C:\Windows\System\oBPFpYC.exe
  2⤵
  PID:8840
- C:\Windows\System\ZjQNToP.exe
  C:\Windows\System\ZjQNToP.exe
  2⤵
  PID:8640
- C:\Windows\System\NTPqOuV.exe
  C:\Windows\System\NTPqOuV.exe
  2⤵
  PID:9024
- C:\Windows\System\Uxgofin.exe
  C:\Windows\System\Uxgofin.exe
  2⤵
  PID:8636
- C:\Windows\System\RquOseR.exe
  C:\Windows\System\RquOseR.exe
  2⤵
  PID:9236
- C:\Windows\System\OrHCVLf.exe
  C:\Windows\System\OrHCVLf.exe
  2⤵
  PID:9256
- C:\Windows\System\WAHGUoZ.exe
  C:\Windows\System\WAHGUoZ.exe
  2⤵
  PID:9272
- C:\Windows\System\BOyRgmp.exe
  C:\Windows\System\BOyRgmp.exe
  2⤵
  PID:9288
- C:\Windows\System\lUgMOey.exe
  C:\Windows\System\lUgMOey.exe
  2⤵
  PID:9308
- C:\Windows\System\SVoqbfF.exe
  C:\Windows\System\SVoqbfF.exe
  2⤵
  PID:9324
- C:\Windows\System\yZJqekd.exe
  C:\Windows\System\yZJqekd.exe
  2⤵
  PID:9340
- C:\Windows\System\cXLpytX.exe
  C:\Windows\System\cXLpytX.exe
  2⤵
  PID:9364
- C:\Windows\System\XXkvcRu.exe
  C:\Windows\System\XXkvcRu.exe
  2⤵
  PID:9396
- C:\Windows\System\KHfxHjW.exe
  C:\Windows\System\KHfxHjW.exe
  2⤵
  PID:9416
- C:\Windows\System\AlKuznm.exe
  C:\Windows\System\AlKuznm.exe
  2⤵
  PID:9432
- C:\Windows\System\hIgZRUu.exe
  C:\Windows\System\hIgZRUu.exe
  2⤵
  PID:9452
- C:\Windows\System\FmXdNDX.exe
  C:\Windows\System\FmXdNDX.exe
  2⤵
  PID:9468
- C:\Windows\System\RIEICeX.exe
  C:\Windows\System\RIEICeX.exe
  2⤵
  PID:9484
- C:\Windows\System\alMhwto.exe
  C:\Windows\System\alMhwto.exe
  2⤵
  PID:9508
- C:\Windows\System\XeZNPpN.exe
  C:\Windows\System\XeZNPpN.exe
  2⤵
  PID:9524
- C:\Windows\System\yfkaXlc.exe
  C:\Windows\System\yfkaXlc.exe
  2⤵
  PID:9540
- C:\Windows\System\kxrKAnp.exe
  C:\Windows\System\kxrKAnp.exe
  2⤵
  PID:9556
- C:\Windows\System\AqPmced.exe
  C:\Windows\System\AqPmced.exe
  2⤵
  PID:9572
- C:\Windows\System\kSRikVd.exe
  C:\Windows\System\kSRikVd.exe
  2⤵
  PID:9588
- C:\Windows\System\PEvAoLB.exe
  C:\Windows\System\PEvAoLB.exe
  2⤵
  PID:9612
- C:\Windows\System\LdRGwPP.exe
  C:\Windows\System\LdRGwPP.exe
  2⤵
  PID:9640
- C:\Windows\System\dsGtNDJ.exe
  C:\Windows\System\dsGtNDJ.exe
  2⤵
  PID:9660
- C:\Windows\System\xqZDcdO.exe
  C:\Windows\System\xqZDcdO.exe
  2⤵
  PID:9684
- C:\Windows\System\Yszfetq.exe
  C:\Windows\System\Yszfetq.exe
  2⤵
  PID:9700
- C:\Windows\System\KpbxytH.exe
  C:\Windows\System\KpbxytH.exe
  2⤵
  PID:9720
- C:\Windows\System\gXWFMmz.exe
  C:\Windows\System\gXWFMmz.exe
  2⤵
  PID:9744
- C:\Windows\System\lijCHRf.exe
  C:\Windows\System\lijCHRf.exe
  2⤵
  PID:9776
- C:\Windows\System\xNuJbrk.exe
  C:\Windows\System\xNuJbrk.exe
  2⤵
  PID:9808
- C:\Windows\System\gKggdBW.exe
  C:\Windows\System\gKggdBW.exe
  2⤵
  PID:9824
- C:\Windows\System\yqeYPXj.exe
  C:\Windows\System\yqeYPXj.exe
  2⤵
  PID:9840
- C:\Windows\System\skVmcoH.exe
  C:\Windows\System\skVmcoH.exe
  2⤵
  PID:9856
- C:\Windows\System\rlEnKXT.exe
  C:\Windows\System\rlEnKXT.exe
  2⤵
  PID:9872
- C:\Windows\System\iwfpkWj.exe
  C:\Windows\System\iwfpkWj.exe
  2⤵
  PID:9896
- C:\Windows\System\vbrAkVt.exe
  C:\Windows\System\vbrAkVt.exe
  2⤵
  PID:9912
- C:\Windows\System\UCygaMj.exe
  C:\Windows\System\UCygaMj.exe
  2⤵
  PID:9932
- C:\Windows\System\jOAUuCb.exe
  C:\Windows\System\jOAUuCb.exe
  2⤵
  PID:9948
- C:\Windows\System\yoSpxys.exe
  C:\Windows\System\yoSpxys.exe
  2⤵
  PID:9968
- C:\Windows\System\NRMIFbY.exe
  C:\Windows\System\NRMIFbY.exe
  2⤵
  PID:9984
- C:\Windows\System\NhGRGGQ.exe
  C:\Windows\System\NhGRGGQ.exe
  2⤵
  PID:10032
- C:\Windows\System\GjyrDZa.exe
  C:\Windows\System\GjyrDZa.exe
  2⤵
  PID:10048
- C:\Windows\System\WnRBxMl.exe
  C:\Windows\System\WnRBxMl.exe
  2⤵
  PID:10064
- C:\Windows\System\omkHMlD.exe
  C:\Windows\System\omkHMlD.exe
  2⤵
  PID:10080
- C:\Windows\System\MEBtOBG.exe
  C:\Windows\System\MEBtOBG.exe
  2⤵
  PID:10104
- C:\Windows\System\isCKKzW.exe
  C:\Windows\System\isCKKzW.exe
  2⤵
  PID:10120
- C:\Windows\System\NiKjIZe.exe
  C:\Windows\System\NiKjIZe.exe
  2⤵
  PID:10140
- C:\Windows\System\amTCkvA.exe
  C:\Windows\System\amTCkvA.exe
  2⤵
  PID:10156
- C:\Windows\System\QvLQREX.exe
  C:\Windows\System\QvLQREX.exe
  2⤵
  PID:10196
- C:\Windows\System\KEhpOKf.exe
  C:\Windows\System\KEhpOKf.exe
  2⤵
  PID:10212
- C:\Windows\System\sFQLpFW.exe
  C:\Windows\System\sFQLpFW.exe
  2⤵
  PID:10232
- C:\Windows\System\jlUMRvk.exe
  C:\Windows\System\jlUMRvk.exe
  2⤵
  PID:9220
- C:\Windows\System\XEthdhl.exe
  C:\Windows\System\XEthdhl.exe
  2⤵
  PID:7308
- C:\Windows\System\aszYvTE.exe
  C:\Windows\System\aszYvTE.exe
  2⤵
  PID:9224
- C:\Windows\System\ZiqmYmm.exe
  C:\Windows\System\ZiqmYmm.exe
  2⤵
  PID:9280
- C:\Windows\System\zlxoGYs.exe
  C:\Windows\System\zlxoGYs.exe
  2⤵
  PID:9348
- C:\Windows\System\TwZxFns.exe
  C:\Windows\System\TwZxFns.exe
  2⤵
  PID:9360
- C:\Windows\System\nWjRshw.exe
  C:\Windows\System\nWjRshw.exe
  2⤵
  PID:9388
- C:\Windows\System\iAsMbwz.exe
  C:\Windows\System\iAsMbwz.exe
  2⤵
  PID:9460
- C:\Windows\System\gQDFIjU.exe
  C:\Windows\System\gQDFIjU.exe
  2⤵
  PID:9412
- C:\Windows\System\NktMBqm.exe
  C:\Windows\System\NktMBqm.exe
  2⤵
  PID:9444
- C:\Windows\System\ortAJFA.exe
  C:\Windows\System\ortAJFA.exe
  2⤵
  PID:9500
- C:\Windows\System\jsqjOuO.exe
  C:\Windows\System\jsqjOuO.exe
  2⤵
  PID:9600
- C:\Windows\System\kxZzpcI.exe
  C:\Windows\System\kxZzpcI.exe
  2⤵
  PID:9648
- C:\Windows\System\SPwFbqz.exe
  C:\Windows\System\SPwFbqz.exe
  2⤵
  PID:9584
- C:\Windows\System\tIZBstA.exe
  C:\Windows\System\tIZBstA.exe
  2⤵
  PID:9636
- C:\Windows\System\xaGniPb.exe
  C:\Windows\System\xaGniPb.exe
  2⤵
  PID:9736
- C:\Windows\System\EqmATke.exe
  C:\Windows\System\EqmATke.exe
  2⤵
  PID:9716
- C:\Windows\System\MtihMIP.exe
  C:\Windows\System\MtihMIP.exe
  2⤵
  PID:9764
- C:\Windows\System\TzKhbCY.exe
  C:\Windows\System\TzKhbCY.exe
  2⤵
  PID:9792
- C:\Windows\System\TTUwMZc.exe
  C:\Windows\System\TTUwMZc.exe
  2⤵
  PID:9816
- C:\Windows\System\MVCfsKU.exe
  C:\Windows\System\MVCfsKU.exe
  2⤵
  PID:9904
- C:\Windows\System\MuqFnds.exe
  C:\Windows\System\MuqFnds.exe
  2⤵
  PID:9980
- C:\Windows\System\iQUQGyx.exe
  C:\Windows\System\iQUQGyx.exe
  2⤵
  PID:9880
- C:\Windows\System\fcJoiUH.exe
  C:\Windows\System\fcJoiUH.exe
  2⤵
  PID:9928
- C:\Windows\System\vWbYyUz.exe
  C:\Windows\System\vWbYyUz.exe
  2⤵
  PID:10016
- C:\Windows\System\vnUMeBn.exe
  C:\Windows\System\vnUMeBn.exe
  2⤵
  PID:9800
- C:\Windows\System\sXPVlEV.exe
  C:\Windows\System\sXPVlEV.exe
  2⤵
  PID:10076
- C:\Windows\System\EdlYUiJ.exe
  C:\Windows\System\EdlYUiJ.exe
  2⤵
  PID:10148
- C:\Windows\System\ZWgaaPs.exe
  C:\Windows\System\ZWgaaPs.exe
  2⤵
  PID:10132
- C:\Windows\System\eOximlH.exe
  C:\Windows\System\eOximlH.exe
  2⤵
  PID:10184
- C:\Windows\System\tbjwYmu.exe
  C:\Windows\System\tbjwYmu.exe
  2⤵
  PID:10220
- C:\Windows\System\fJlNhKL.exe
  C:\Windows\System\fJlNhKL.exe
  2⤵
  PID:7428
- C:\Windows\System\gHClnSR.exe
  C:\Windows\System\gHClnSR.exe
  2⤵
  PID:9316
- C:\Windows\System\MUvjfzR.exe
  C:\Windows\System\MUvjfzR.exe
  2⤵
  PID:9320
- C:\Windows\System\FxqHKBk.exe
  C:\Windows\System\FxqHKBk.exe
  2⤵
  PID:9284
- C:\Windows\System\mVBfiAN.exe
  C:\Windows\System\mVBfiAN.exe
  2⤵
  PID:9428
- C:\Windows\System\fGAZUDT.exe
  C:\Windows\System\fGAZUDT.exe
  2⤵
  PID:9440
- C:\Windows\System\BvztYjn.exe
  C:\Windows\System\BvztYjn.exe
  2⤵
  PID:9448
- C:\Windows\System\CrKDigs.exe
  C:\Windows\System\CrKDigs.exe
  2⤵
  PID:9692
- C:\Windows\System\UcmkZwS.exe
  C:\Windows\System\UcmkZwS.exe
  2⤵
  PID:9568
- C:\Windows\System\xHnTzCv.exe
  C:\Windows\System\xHnTzCv.exe
  2⤵
  PID:9680
- C:\Windows\System\aDFIzAo.exe
  C:\Windows\System\aDFIzAo.exe
  2⤵
  PID:9728
- C:\Windows\System\UoBITaC.exe
  C:\Windows\System\UoBITaC.exe
  2⤵
  PID:9864
- C:\Windows\System\SJeCRnM.exe
  C:\Windows\System\SJeCRnM.exe
  2⤵
  PID:9848
- C:\Windows\System\DJLniWG.exe
  C:\Windows\System\DJLniWG.exe
  2⤵
  PID:9852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EcmBhnc.exe

Filesize
1.1MB

MD5
d74a741f628f61bf416a857f05e5c766

SHA1
e0deac4e2ee883e19a8b538292bd229e0a19eae3

SHA256
709f1ba7c936b2c30fca955aacb769cccda2ea656375160f5b0f77a7455399c9

SHA512
212d0aed7b9f4f599c17ed3d07e1a7ac15669c8865e5cea5bbc191b297e0f1eeb3216715a709851a3842e4fffe5632594cea826e03d34c5c9731b79d8c77ac02

Download Submit
C:\Windows\system\FxEcLWk.exe

Filesize
1.1MB

MD5
8cf8ffb0d127789a89f360af79a317a5

SHA1
81e3092006980f7be805d3d8d7c1e7178c70fbcf

SHA256
40aea75e240c1beed730a5c2c0fbd5d4b79b279f2f74087e6ad188c092b95864

SHA512
b96114617d3967f131bcfb72581c24b3ea9ab9916c042f292b8f482c637390451cab9a4b2ff320168cc992fe485e9ec9ae60900cafe9909485033724fbcd85bf

Download Submit
C:\Windows\system\GeTWtcl.exe

Filesize
1.1MB

MD5
6bf967673464fd4ac7952bd7e97cfa09

SHA1
86038a0622d74d319c372730d9fdf090f62da4d3

SHA256
ca49ccf38b9e4eb0fc84b014a96f659e34877fc5900544814ad6c87af35e3def

SHA512
0671350401134890b54ec47a9043293c3ae0c7e4aea6ceb8bd2360b33927a8ea689d1e0c021d4847821feac9e28636e3c4c978ea9d75a2519a4b12ebd6232395

Download Submit
C:\Windows\system\IGYjKWN.exe

Filesize
1.1MB

MD5
422709e19d63fb2d1e97dfc696402bc8

SHA1
e11248712ba02ba89fe517f2c96afdf160aaac69

SHA256
47285021f126d46c52ee1f600664c0100a77b56a074635a3fb21d605e46608a8

SHA512
fc27cad97e96ced7ead75a23189da73c2982d50136824563fa14874b04e94a92d4144377ec167e39a7df3e99fdf6bbc5f2b61cbc6fc56384a14ea4837481fec8

Download Submit
C:\Windows\system\JLnnBJv.exe

Filesize
1.1MB

MD5
79c133237dc32b141e4d371f0466229c

SHA1
d7eec5444bdaf7e992dd171f386524c720caaad0

SHA256
c67b090f5639e300231cac8e22ebe37b74868051f53c9d9cba7d6eb28b13907e

SHA512
2adc30683758dbf122effb945e25d56d55e47c36a27946744a9e4a6f810c4f5f54459cce484727a0ba454be81ed6f75872ec6f4623065d1501632037010bac83

Download Submit
C:\Windows\system\JzGmsIU.exe

Filesize
1.1MB

MD5
dad16ed249b757124e4820167d6624cb

SHA1
2f11b51b472d4481d486912a3325b484a694a70e

SHA256
fd2c370f50577c4803f257ad4ab63634d6ce0ae35e28254b3e31461e72787118

SHA512
d3323a2d060058bcba48379294b0e3e3ceb68cf67874bc1880e6fe2945b7e32a2b22a3360c13313b90d45bb74bd8bc254488de2bf61359ea1e3fb8165237bc8a

Download Submit
C:\Windows\system\LlUJmfx.exe

Filesize
1.1MB

MD5
b1400b8834dfb5c2a340251d97986c5f

SHA1
3f2ac1e38712655a7f1fc092cadf2189f5ca0b41

SHA256
1b80daade1556c84c6237d793208980c3c12ef32537f29c20975a8c73d06ace6

SHA512
cf34487219685e74802bd5ba403076bf6303cbd4704d8ab64bc38f47159dc58e4eb01f975cfc3af6d34cc5bcf2aef2fde2c33ab8913b2ed5e88e3e2bd81f5235

Download Submit
C:\Windows\system\MNaMqoe.exe

Filesize
1.1MB

MD5
9d421c31c5c1420480236e292dad2032

SHA1
495ca9d8558945d9f940b3a322f70b9767261e80

SHA256
efc7a11305e77a014548e84e15e0994cbbf2944d99c70e4054179df5d9f91d0e

SHA512
0259e8a221dca5f053f80bf74c38681fbd2f12d401d9b38cdce44e1c5e93faa78029633f332a3767ff7616bbbf41ca6a0f27cbf5337f97c2c5cf607498840f22

Download Submit
C:\Windows\system\PaEMLmM.exe

Filesize
1.1MB

MD5
86af79215e47e3a65d79e2092ce320df

SHA1
cdc20eddc5b1225988058a04d4dd0a307d069a8e

SHA256
1dd2575e893cf9280faf343a40bb62e81a712f8b1cbae8d6f8dd069726a2d128

SHA512
ff1c70a2e61be910dd9de1b361fefc4e22486c7d14f11d238eb429c2d9ea1c338104fbd37e3ef63766f6c0ce3ed63b9df3cecf4adcd10ea58d4acc6cd83fb101

Download Submit
C:\Windows\system\QFhwnDK.exe

Filesize
1.1MB

MD5
a607a1b287b05f173791ce2d45f7f4e0

SHA1
99958ea7f586b3e36b10ce1810f0bf7034356beb

SHA256
b731d1d4e7547d2a4c91727e37962a7c69865daa77c467e8a7e5a97ef197a063

SHA512
c7d7c424b04370c9ab0082c0685f5186f2b75098681cb1848f2417c7dc06e6cb7f140cf42f02915a0fe23d8b84791825287ff648ee7469c0bf4d4e42719308a4

Download Submit
C:\Windows\system\QJhUBgC.exe

Filesize
1.1MB

MD5
7ac84f7da79d5a63e2bd5cc619d98664

SHA1
deda545482a026f22c2e81bbd3174aa2fddb2052

SHA256
8982c19ee85a3421c078d8e11d01e3268f4ff9ac3b1abc4a70ab0194ad9ccb7f

SHA512
4f572c816828081712ecbde4621af69493532ac2e9724d01629889c731d5cdaa6e974cdee6e23869c42bad0b8a9632e699b79f14d8e30508155312b8c0aec4bc

Download Submit
C:\Windows\system\RqhCqPr.exe

Filesize
1.1MB

MD5
42fc59009b7544549d70d026bac00a21

SHA1
e8a463ea478199108c4f2419e65a529bb0d0e8d0

SHA256
21f4d171f2286f62d2e8b08bff0042a55de2e35b204cf5aa4a9b0c99fbf08627

SHA512
4097dbe991c12a38736a8f4ed0696c1f16b520e7333082947bd7d27db8c69ec8b7f88a0734e5a4d7b27b68d64ca542384b1f2bb07a554b707beadbfc4932bb14

Download Submit
C:\Windows\system\WZVJspw.exe

Filesize
1.1MB

MD5
2154f97013c3305944e3dbfa1cb3d702

SHA1
4128335d408f423494e9170ebd117aca3b2c00c1

SHA256
231ba015236e3ee095c3d73cd00f580e5a0ab2c9ce60832f2327a521e1860b33

SHA512
e94b98d5b42917d4763506448b91a87621fadc31e800d1eb4c4fdc8813f8bf0f5095232ee44ef071af2f7fed3e98a0dc222c78de1999470210c5816f021b77c4

Download Submit
C:\Windows\system\YCClCKF.exe

Filesize
1.1MB

MD5
a70fb6de9344f2a7b691d34505c1effb

SHA1
4b2989ad3bfcc1bf987bc8e8c524e400748bcb53

SHA256
e61fc2a9d29c1a073333d3c755024df443e712122f7d23343ef8148815520144

SHA512
aa7f62a4306e596c236ea17a7551bafc0e446f3cdfb2460e5473fe3a0ed5dc5daa112b585f277208b7cbf77293323f00a016a879e6b6ebcffabf2c3d98e56b82

Download Submit
C:\Windows\system\YOgKFfg.exe

Filesize
1.1MB

MD5
8211263907459105a4759b17f0a53502

SHA1
434c073a5890196521a7e3dea27031686cb3270c

SHA256
3d49df6632d2c12a5e64c747265e069aa85c3f5e1c01b82388b54db5f0f68e1e

SHA512
0506389cb1f77ac5b768737d9a49a8de32ec884c2a0da07eb4f57473f929b6f1579757c6207cf0d92516904a6fbc259c79570fd807607b33b5b0aae4fb310e39

Download Submit
C:\Windows\system\YXLUhnP.exe

Filesize
1.1MB

MD5
08b8eace0cc6eb3e545f04c09839693f

SHA1
44162d7aaa0aab34267f8b11140eac4c2a5a3603

SHA256
b1bd63dd9252c864e028f5ad1fc052558936ca35e5f8003a8f28ae34e6c9e63b

SHA512
c02a7d67d35103100f734457cb98af40baf67c7640c2802a74f0719e6beaf079c5e4329e6b4a272969714a27c07101f7b4c398063967ee6a9fa28f17fcea03a1

Download Submit
C:\Windows\system\ZpiyrwU.exe

Filesize
1.1MB

MD5
f911c28e181a962d92938df4830834b3

SHA1
4dc1439bb29ef27b8ce13a95d1a595ea2db970be

SHA256
f039fc888fe6215b6da03ebb5865a2e933e976cd16377c62e80db98c7f8c5cdf

SHA512
e7ef4d29c3f8ea94aa3f779ee440afe558e10a16777e2bfff5f7915ccaaede7d4ad56ee3dd8081f0d9d83d1cbfbedcb8b20f68ef120091c9cebba791464fa6a2

Download Submit
C:\Windows\system\eeDsQkH.exe

Filesize
1.1MB

MD5
249aca258f477b7f0ee323edb074f3a6

SHA1
8ec81a8953a9165d94013865023d5e4f4c955086

SHA256
eb2a8269daa16b5787da9a6db9e76606c18e0b3614cf2834c2be768d93e58f43

SHA512
14284065692ead85979d372e8a132e3994b925cc167ec77fd5a617499cec96860899774e72426e2d8e4fc7ce133da66048f0c755ca270128de83bf9d1a4b8135

Download Submit
C:\Windows\system\hBJmRUl.exe

Filesize
1.1MB

MD5
08f70fe27db9b630cd343248fb80367e

SHA1
f6b17e82f4fc22460d3bfc08fe047033f2b25715

SHA256
9d71c9602eba5e17ec432c49b0929305a0a42fd6f3c2cc84a0cf005f7cd2d8e3

SHA512
a5a76c20780f74635a7fef41551e15c39085915cd4e43bbd1e5f8a3c3225f46ecb01eeb4bd1d8d88710b456c5f80d9da234387f31a662b1caa0e2caf92d8f611

Download Submit
C:\Windows\system\lJdAqSj.exe

Filesize
1.1MB

MD5
d70aa071462338f3dfe62249a2f203dc

SHA1
c13dd17186824a1c77a0a7dcce6f7cd71de1a07f

SHA256
add8131a66d3eca23ad8f8e39c671c45eead07b07f7ebfaa72251172e63a56d0

SHA512
e128e8df7a876de595a982943effcadfdc839e1865bc85f0b0464d400f36f7257adae4719007e6c83e8ab6f8b0eb8261d871026411d8aa86a5e8241204b66d44

Download Submit
C:\Windows\system\ogIkObg.exe

Filesize
1.1MB

MD5
c6044805392c59c723b655dee4d85234

SHA1
280648e08c43dd2bd0228638fa1e45e1e4b5daf0

SHA256
a68408cc212f79bbcfa5c805995962b4e816963026f75485d2b2e2352290c68a

SHA512
ac48ba88ff6472cefadba9f624edbd3940eaf573ee54c4edb17ccfcf6b654eb17943369ca3228d14db166099dd43dd1e06180ee81c24535539f9b773c9196d07

Download Submit
C:\Windows\system\okbCNfA.exe

Filesize
1.1MB

MD5
14186746eb43bc84529fd9f755ac7c63

SHA1
3ed61b56afef19e03a2188148835d74dcc1a03b2

SHA256
3d1e9b9475784dd610eb78529126f91a2bb1a68fb40f4bd541eed9fa30136b1b

SHA512
f4ef205dc865b962d857b2399947de8dc9c88feeeaf6749b57349889e756131d806bc5d7b6cd1a7bb1df3f71875b3a159a0f140c03c51c4e12ca70d2886bc4f5

Download Submit
C:\Windows\system\qfsWjmX.exe

Filesize
1.1MB

MD5
e774413dfcc750c2abe5811fe61b4b4d

SHA1
35598c429ace02c4a1e1ddc3dbc068e09315dbb3

SHA256
c14503d7f522810b06798257b825fab6847900e3b28036eeb156687103741642

SHA512
50fcb0b3eca92c70b2a0238ac02682c27d989325816757d1d2b7b7941a74d30106e58514b8ce033bdff20bd74cb801dfcb1abced60ea7dfed6cd888538682c51

Download Submit
C:\Windows\system\rrKLRUv.exe

Filesize
1.1MB

MD5
d1c4ab685f2f433969961a31bc10801f

SHA1
84459e5a6e9f55a4d39916d4ef6ef62b32410a30

SHA256
05d54613154160b40ca250847d950ec594d21d6d5e8f6153e69c6b350d98750d

SHA512
f7f384f0775d6495222af25f07a153b0d3bbfb3a08d678458031fcc32f8123db2a3a5b99e039daf38040d3c75224d7a114ba8514c9d60f174d12b67b71734c8a

Download Submit
C:\Windows\system\tSWbohp.exe

Filesize
1.1MB

MD5
35713ac688553906a07f536fbc654ad0

SHA1
c242629a4c0181f46309c03489246c3d16d31ba7

SHA256
549ed0cf0c5b9c7b5d50c4a580d4cae00155c3b60effaa44af8600eed743410f

SHA512
2d58e42aab7dee9c6f7b6c71b73d75b623bd7fe72c0e44b79bd6cc18aa555225ad7d4ae3c21b881b03b5dc4a68834ce7bc40c8891f7d3ec31fc113981e049ee1

Download Submit
C:\Windows\system\tkfNQKM.exe

Filesize
1.1MB

MD5
8a68c5ddd956bcf4f09c9317f7fa5c84

SHA1
f578edb2cf334371ede23d276ece1120281bdbb9

SHA256
0b3391fa8f5343f07b13903f761f7a8e088afd862dd1a1c6287d5a39ac251174

SHA512
c20126bd801626e58eb2d3c52cc069af48be0630927a8454e1d63b9ea26021ab6189432556a5ba4444c7eaaf4b83821f9d5c06b3d5ded3825138a76b673faf56

Download Submit
C:\Windows\system\tlkaNom.exe

Filesize
1.1MB

MD5
ba58591fb8608566bcb264b27f0a69b3

SHA1
e3054845fe47f34fa03925c532f8d90ebe7687e7

SHA256
6decdd688cd1444409bb7c7cceb7a89a3149c3356fdf972d4b3b351a441a16a4

SHA512
290ee12f24d9c92a8a48d5360b0be1d98fe17c572426165f1fc0d9de61185a1f2a8ad1ab03fd9bfbfed10e31a502d435ef5a83d288b174f51fb68a4046fdf687

Download Submit
C:\Windows\system\uxbgNcu.exe

Filesize
1.1MB

MD5
528ddc50126b592455d699aa2c5cf8c1

SHA1
0f4bc666b882e4836632e0adadd3fda1641dcb34

SHA256
9ed6c75e16c35c97a2c5e7a26a1bdf2ad617e3cc08b28c720f3c5d91962c8148

SHA512
876b2ea4391b08bb4d45a565b6960831c89fd689fcc2342207e01b73f6ed4fe1f6a824b8a258bb07b88fef88642b572dced9cd8215939c61d6d5932979aa293f

Download Submit
C:\Windows\system\wimSycO.exe

Filesize
1.1MB

MD5
dc608dfb3b8fbe8ce6152521cad56632

SHA1
7a98607d5ab3180c49780c1c079ebdfa3e03dc40

SHA256
a2198977327f6003dc60a543654dbc56ddfd95149312ed8db7312ee5256f144a

SHA512
9c72a98daea090f64b95761b8e675c1ca8a9a49afd208e0481ddcd2915821583e9159d3b0d3bfccdc6105455ed6b9bbb73f025c95e4522cc50f796c6ae05975c

Download Submit
C:\Windows\system\yHRRtMd.exe

Filesize
1.1MB

MD5
d2b5356feff536f2142f98cb27181465

SHA1
9e0f9a040a650122a5cf93cf54889925982a4395

SHA256
ed422f79a16ef9563df5fdaa3abaf460dc495ff20062e28fbdb672369850c906

SHA512
583e7e533943128ac7967aac2ce3d4ea0bc7dcd10c69471bc5937a7f866fa2577c1c3cc65f22d79c53e90d5de64b7f6dac21db7489078fdfb4b8551aaab16815

Download Submit
\Windows\system\XSLnMfX.exe

Filesize
1.1MB

MD5
14311f13b504bde2c4a2e065e22cac4a

SHA1
d6b9b66b16482056af32c42899a1cbd0d1476925

SHA256
7800d83eb51f8c185c122d50ca67f7fcdeab1d5fac785eaa4e508dc7e212dcf3

SHA512
f769556c8ab50e1ce4a636ced1504cb3b40f67db0ba74bd136efbdabb07a55de307b663a829c67015af45fd50af79b1bb0e4d94e48fac0a524c913634d2fd612

Download Submit
\Windows\system\xJDUXYp.exe

Filesize
1.1MB

MD5
b9f10dbff331b3fee678e97b681840c4

SHA1
74901a21b22129a189671f2278cdea94d6103a2d

SHA256
1ebafd374fd44c1e2bdbb15b4d11570a8e056d766c93907bcca82d5d769de3ca

SHA512
be6e63d5a730396c97f7253980cde28be0045a25653f0f1240b316ee181f59e920a980959f3e4d2523f08b6dafb207239890848802425b6011944e52af6fa713

Download Submit
memory/2704-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download