xmrig | da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
Size

1.1MB
MD5

20a2fb493187599f622dc6e3d34fa8e5
SHA1

72dce56dd395e892053736451aaf89a6fd649b8e
SHA256

da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4
SHA512

c7c2af34c146001d7c91d7c0542e9062ab27943a1fbd68aa33c4935610d0e0f5696a4462a9405f6743ad09eb258e3c7c7a9ec399c5542917e2a30642c3189a57
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJkgs17y1/:GezaTF8FcNkNdfE0pZ9ozttwIRx0S

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral1/files/0x000b00000001225e-4.dat	xmrig
behavioral1/files/0x000800000001876a-6.dat	xmrig
behavioral1/files/0x0007000000018780-8.dat	xmrig
behavioral1/files/0x0008000000018bdd-20.dat	xmrig
behavioral1/files/0x000700000001921d-24.dat	xmrig
behavioral1/files/0x000600000001923e-25.dat	xmrig
behavioral1/files/0x000600000001925b-37.dat	xmrig
behavioral1/files/0x00050000000194e4-45.dat	xmrig
behavioral1/files/0x00050000000195c0-64.dat	xmrig
behavioral1/files/0x00050000000195f7-68.dat	xmrig
behavioral1/files/0x0005000000019615-116.dat	xmrig
behavioral1/files/0x000500000001969b-130.dat	xmrig
behavioral1/files/0x0005000000019c32-151.dat	xmrig
behavioral1/files/0x0005000000019c34-155.dat	xmrig
behavioral1/files/0x0005000000019c36-160.dat	xmrig
behavioral1/files/0x0008000000018718-147.dat	xmrig
behavioral1/files/0x0005000000019999-145.dat	xmrig
behavioral1/files/0x0005000000019605-135.dat	xmrig
behavioral1/files/0x0005000000019601-126.dat	xmrig
behavioral1/files/0x0005000000019659-119.dat	xmrig
behavioral1/files/0x00050000000196ed-140.dat	xmrig
behavioral1/files/0x00050000000195fe-85.dat	xmrig
behavioral1/files/0x0005000000019603-101.dat	xmrig
behavioral1/files/0x00050000000195ff-88.dat	xmrig
behavioral1/files/0x00050000000195fd-81.dat	xmrig
behavioral1/files/0x00050000000195fb-76.dat	xmrig
behavioral1/files/0x00050000000195f9-73.dat	xmrig
behavioral1/files/0x0005000000019581-60.dat	xmrig
behavioral1/files/0x000500000001955c-56.dat	xmrig
behavioral1/files/0x0005000000019551-52.dat	xmrig
behavioral1/files/0x00050000000194e6-48.dat	xmrig
behavioral1/files/0x000800000001930d-40.dat	xmrig
behavioral1/files/0x0006000000019242-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2608	swklpyI.exe
1748	WAXEtah.exe
2532	BjuIUiw.exe
3028	gsBdWCJ.exe
2464	fFIhLuE.exe
1580	IJEdzZD.exe
2956	vqwusFp.exe
3012	elYAmut.exe
2824	CcdtYtQ.exe
2288	lfelpzJ.exe
3068	MDOmICZ.exe
2996	HAUcjjG.exe
2912	oojCVGR.exe
2984	NlmsaaQ.exe
2752	fuoPTKi.exe
2708	xrsfIyI.exe
2764	OicIceD.exe
2348	nyeQeeq.exe
2268	bejXXuN.exe
1088	NxPWaiR.exe
1788	EvifNVG.exe
1760	pyrXspa.exe
2108	FrpAxIM.exe
1992	vRDyvFn.exe
1692	KRCEQdb.exe
1744	yzObwgF.exe
3044	SPQkAsi.exe
2684	LwzjxkV.exe
2924	lhQnHKZ.exe
1224	jBKoJTV.exe
2176	SzpjRBv.exe
448	NgRuwIo.exe
1600	BQVJOYS.exe
2292	gdBVwDG.exe
684	cvApMaF.exe
328	Njtpgko.exe
1544	zhjxrEX.exe
352	WRvpWzU.exe
2124	TdlyFBB.exe
320	ETrKSTu.exe
796	kBAWKPF.exe
840	FgvxvZT.exe
1700	qYzyUYt.exe
1920	yiMmBCA.exe
1656	yqztKsr.exe
2024	PYedTGM.exe
780	HvNZUAg.exe
1400	HgraEoW.exe
2520	RrjtJva.exe
560	qlOoOID.exe
2880	ZOhEaQD.exe
1212	yuGiKUU.exe
1444	tnDoeaN.exe
2432	feYuHDL.exe
2572	YAWSDXx.exe
1508	SprlZzL.exe
2140	cpgZfaR.exe
2352	UwSLWEC.exe
2620	BdFnLxW.exe
2588	yIwpZBU.exe
2252	uUTIjbD.exe
2856	HFHpMjf.exe
3024	drsFYoS.exe
2724	pyeZSEE.exe

Loads dropped DLL 64 IoCs

pid	Process
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IgqFYdc.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\zpiuAMC.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\XCrLwvs.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\cCUtaEA.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\PpjQTsA.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\CnTIOcT.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\zQwZQjt.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\PfmpiQf.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\bPaZBiw.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\aJNnicU.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\XpcaVLf.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\LqlGrvg.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\kUouoTD.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\sSdQSnJ.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\affnCGh.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\alqBbFu.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\gtkqrTC.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\eKkyixS.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\bZZXYiB.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\dttUXxa.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\HtgjyCG.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\XDcqjdW.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\QJuKVdL.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\HvZTqum.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\uDOIWEw.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\FafvUDI.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\rLUdGLB.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\FrTzYyR.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\jomwfeG.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\TbucIQX.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\NgRuwIo.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\yHVfIkN.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\mszurGv.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\VbKNQqO.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\wMDvUMl.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\SVquDpC.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\qgHXFgT.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\rCPvZhK.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\nWcWTcn.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\qMNAkMz.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\OXlnkKO.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\gsxfwfi.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\UiwaHtZ.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\OSpboUX.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\QjmUKRm.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\YqXBHrH.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\gHcNMGW.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\Ajumyfk.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\QhlNZrG.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\POpoyXo.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\pNsEjYB.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\jONjJhK.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\FnYydKM.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\NoBvuwU.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\xZsIwnt.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\ZvqDJFR.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\zCyzHPv.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\TIteIsz.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\TiHlHLM.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\yBhXFHK.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\zExcIpJ.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\bOiRLLk.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\NJHDYCl.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
File created	C:\Windows\System\AxWbUgm.exe	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2608	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	31
PID 3064 wrote to memory of 2608	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	31
PID 3064 wrote to memory of 2608	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	31
PID 3064 wrote to memory of 1748	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	32
PID 3064 wrote to memory of 1748	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	32
PID 3064 wrote to memory of 1748	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	32
PID 3064 wrote to memory of 2532	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	33
PID 3064 wrote to memory of 2532	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	33
PID 3064 wrote to memory of 2532	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	33
PID 3064 wrote to memory of 3028	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	34
PID 3064 wrote to memory of 3028	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	34
PID 3064 wrote to memory of 3028	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	34
PID 3064 wrote to memory of 2464	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	35
PID 3064 wrote to memory of 2464	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	35
PID 3064 wrote to memory of 2464	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	35
PID 3064 wrote to memory of 1580	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	36
PID 3064 wrote to memory of 1580	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	36
PID 3064 wrote to memory of 1580	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	36
PID 3064 wrote to memory of 2956	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	37
PID 3064 wrote to memory of 2956	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	37
PID 3064 wrote to memory of 2956	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	37
PID 3064 wrote to memory of 3012	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	38
PID 3064 wrote to memory of 3012	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	38
PID 3064 wrote to memory of 3012	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	38
PID 3064 wrote to memory of 2824	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	39
PID 3064 wrote to memory of 2824	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	39
PID 3064 wrote to memory of 2824	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	39
PID 3064 wrote to memory of 2288	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	40
PID 3064 wrote to memory of 2288	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	40
PID 3064 wrote to memory of 2288	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	40
PID 3064 wrote to memory of 3068	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	41
PID 3064 wrote to memory of 3068	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	41
PID 3064 wrote to memory of 3068	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	41
PID 3064 wrote to memory of 2996	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	42
PID 3064 wrote to memory of 2996	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	42
PID 3064 wrote to memory of 2996	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	42
PID 3064 wrote to memory of 2912	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	43
PID 3064 wrote to memory of 2912	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	43
PID 3064 wrote to memory of 2912	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	43
PID 3064 wrote to memory of 2984	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	44
PID 3064 wrote to memory of 2984	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	44
PID 3064 wrote to memory of 2984	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	44
PID 3064 wrote to memory of 2752	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	45
PID 3064 wrote to memory of 2752	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	45
PID 3064 wrote to memory of 2752	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	45
PID 3064 wrote to memory of 2708	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	46
PID 3064 wrote to memory of 2708	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	46
PID 3064 wrote to memory of 2708	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	46
PID 3064 wrote to memory of 2764	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	47
PID 3064 wrote to memory of 2764	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	47
PID 3064 wrote to memory of 2764	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	47
PID 3064 wrote to memory of 2348	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	48
PID 3064 wrote to memory of 2348	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	48
PID 3064 wrote to memory of 2348	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	48
PID 3064 wrote to memory of 2268	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	49
PID 3064 wrote to memory of 2268	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	49
PID 3064 wrote to memory of 2268	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	49
PID 3064 wrote to memory of 1088	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	50
PID 3064 wrote to memory of 1088	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	50
PID 3064 wrote to memory of 1088	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	50
PID 3064 wrote to memory of 1788	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	51
PID 3064 wrote to memory of 1788	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	51
PID 3064 wrote to memory of 1788	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	51
PID 3064 wrote to memory of 1992	3064	da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe	52

C:\Users\Admin\AppData\Local\Temp\da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe
"C:\Users\Admin\AppData\Local\Temp\da313e9d43141af06f0fed89bca46a46fac482aff7bd5d6ebbfc8ef482e8a5f4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System\swklpyI.exe
  C:\Windows\System\swklpyI.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\WAXEtah.exe
  C:\Windows\System\WAXEtah.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\BjuIUiw.exe
  C:\Windows\System\BjuIUiw.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\gsBdWCJ.exe
  C:\Windows\System\gsBdWCJ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\fFIhLuE.exe
  C:\Windows\System\fFIhLuE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\IJEdzZD.exe
  C:\Windows\System\IJEdzZD.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\vqwusFp.exe
  C:\Windows\System\vqwusFp.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\elYAmut.exe
  C:\Windows\System\elYAmut.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\CcdtYtQ.exe
  C:\Windows\System\CcdtYtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lfelpzJ.exe
  C:\Windows\System\lfelpzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\MDOmICZ.exe
  C:\Windows\System\MDOmICZ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\HAUcjjG.exe
  C:\Windows\System\HAUcjjG.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\oojCVGR.exe
  C:\Windows\System\oojCVGR.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\NlmsaaQ.exe
  C:\Windows\System\NlmsaaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\fuoPTKi.exe
  C:\Windows\System\fuoPTKi.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\xrsfIyI.exe
  C:\Windows\System\xrsfIyI.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OicIceD.exe
  C:\Windows\System\OicIceD.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\nyeQeeq.exe
  C:\Windows\System\nyeQeeq.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\bejXXuN.exe
  C:\Windows\System\bejXXuN.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\NxPWaiR.exe
  C:\Windows\System\NxPWaiR.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\EvifNVG.exe
  C:\Windows\System\EvifNVG.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\vRDyvFn.exe
  C:\Windows\System\vRDyvFn.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\pyrXspa.exe
  C:\Windows\System\pyrXspa.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\yzObwgF.exe
  C:\Windows\System\yzObwgF.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\FrpAxIM.exe
  C:\Windows\System\FrpAxIM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\LwzjxkV.exe
  C:\Windows\System\LwzjxkV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KRCEQdb.exe
  C:\Windows\System\KRCEQdb.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\lhQnHKZ.exe
  C:\Windows\System\lhQnHKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SPQkAsi.exe
  C:\Windows\System\SPQkAsi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\SzpjRBv.exe
  C:\Windows\System\SzpjRBv.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\jBKoJTV.exe
  C:\Windows\System\jBKoJTV.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\BQVJOYS.exe
  C:\Windows\System\BQVJOYS.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\NgRuwIo.exe
  C:\Windows\System\NgRuwIo.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\gdBVwDG.exe
  C:\Windows\System\gdBVwDG.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\cvApMaF.exe
  C:\Windows\System\cvApMaF.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\Njtpgko.exe
  C:\Windows\System\Njtpgko.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\zhjxrEX.exe
  C:\Windows\System\zhjxrEX.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\WRvpWzU.exe
  C:\Windows\System\WRvpWzU.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\TdlyFBB.exe
  C:\Windows\System\TdlyFBB.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\ETrKSTu.exe
  C:\Windows\System\ETrKSTu.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\kBAWKPF.exe
  C:\Windows\System\kBAWKPF.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\FgvxvZT.exe
  C:\Windows\System\FgvxvZT.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\qYzyUYt.exe
  C:\Windows\System\qYzyUYt.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\yiMmBCA.exe
  C:\Windows\System\yiMmBCA.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\yqztKsr.exe
  C:\Windows\System\yqztKsr.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\PYedTGM.exe
  C:\Windows\System\PYedTGM.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\HvNZUAg.exe
  C:\Windows\System\HvNZUAg.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\HgraEoW.exe
  C:\Windows\System\HgraEoW.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\RrjtJva.exe
  C:\Windows\System\RrjtJva.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\qlOoOID.exe
  C:\Windows\System\qlOoOID.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\ZOhEaQD.exe
  C:\Windows\System\ZOhEaQD.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\yuGiKUU.exe
  C:\Windows\System\yuGiKUU.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\tnDoeaN.exe
  C:\Windows\System\tnDoeaN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\feYuHDL.exe
  C:\Windows\System\feYuHDL.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\YAWSDXx.exe
  C:\Windows\System\YAWSDXx.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SprlZzL.exe
  C:\Windows\System\SprlZzL.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\cpgZfaR.exe
  C:\Windows\System\cpgZfaR.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\UwSLWEC.exe
  C:\Windows\System\UwSLWEC.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\BdFnLxW.exe
  C:\Windows\System\BdFnLxW.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\yIwpZBU.exe
  C:\Windows\System\yIwpZBU.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\uUTIjbD.exe
  C:\Windows\System\uUTIjbD.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HFHpMjf.exe
  C:\Windows\System\HFHpMjf.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\drsFYoS.exe
  C:\Windows\System\drsFYoS.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\pyeZSEE.exe
  C:\Windows\System\pyeZSEE.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\bvmgblD.exe
  C:\Windows\System\bvmgblD.exe
  2⤵
  PID:2692
- C:\Windows\System\SdRuvvd.exe
  C:\Windows\System\SdRuvvd.exe
  2⤵
  PID:668
- C:\Windows\System\UBVCTia.exe
  C:\Windows\System\UBVCTia.exe
  2⤵
  PID:1940
- C:\Windows\System\dttUXxa.exe
  C:\Windows\System\dttUXxa.exe
  2⤵
  PID:1728
- C:\Windows\System\OzsZZZq.exe
  C:\Windows\System\OzsZZZq.exe
  2⤵
  PID:2748
- C:\Windows\System\esCJdZn.exe
  C:\Windows\System\esCJdZn.exe
  2⤵
  PID:2284
- C:\Windows\System\RBZiEPD.exe
  C:\Windows\System\RBZiEPD.exe
  2⤵
  PID:2032
- C:\Windows\System\ZHGXyeb.exe
  C:\Windows\System\ZHGXyeb.exe
  2⤵
  PID:2088
- C:\Windows\System\dGHwhhx.exe
  C:\Windows\System\dGHwhhx.exe
  2⤵
  PID:756
- C:\Windows\System\nFdKkDT.exe
  C:\Windows\System\nFdKkDT.exe
  2⤵
  PID:284
- C:\Windows\System\MXuFlyW.exe
  C:\Windows\System\MXuFlyW.exe
  2⤵
  PID:1844
- C:\Windows\System\LRfbuEA.exe
  C:\Windows\System\LRfbuEA.exe
  2⤵
  PID:2892
- C:\Windows\System\MvDZfxx.exe
  C:\Windows\System\MvDZfxx.exe
  2⤵
  PID:2208
- C:\Windows\System\hubaWJE.exe
  C:\Windows\System\hubaWJE.exe
  2⤵
  PID:716
- C:\Windows\System\bdPwTDv.exe
  C:\Windows\System\bdPwTDv.exe
  2⤵
  PID:2184
- C:\Windows\System\rBZiftz.exe
  C:\Windows\System\rBZiftz.exe
  2⤵
  PID:1876
- C:\Windows\System\cZwUgFS.exe
  C:\Windows\System\cZwUgFS.exe
  2⤵
  PID:1796
- C:\Windows\System\MayTfEv.exe
  C:\Windows\System\MayTfEv.exe
  2⤵
  PID:3036
- C:\Windows\System\BiQIhIr.exe
  C:\Windows\System\BiQIhIr.exe
  2⤵
  PID:2368
- C:\Windows\System\zkarJAv.exe
  C:\Windows\System\zkarJAv.exe
  2⤵
  PID:1464
- C:\Windows\System\UkcXyoF.exe
  C:\Windows\System\UkcXyoF.exe
  2⤵
  PID:944
- C:\Windows\System\QDurmpD.exe
  C:\Windows\System\QDurmpD.exe
  2⤵
  PID:2592
- C:\Windows\System\zCKBLJQ.exe
  C:\Windows\System\zCKBLJQ.exe
  2⤵
  PID:1872
- C:\Windows\System\GRXMExW.exe
  C:\Windows\System\GRXMExW.exe
  2⤵
  PID:332
- C:\Windows\System\wymlsVJ.exe
  C:\Windows\System\wymlsVJ.exe
  2⤵
  PID:1680
- C:\Windows\System\MevalWv.exe
  C:\Windows\System\MevalWv.exe
  2⤵
  PID:916
- C:\Windows\System\denslzH.exe
  C:\Windows\System\denslzH.exe
  2⤵
  PID:2584
- C:\Windows\System\pHZoUVT.exe
  C:\Windows\System\pHZoUVT.exe
  2⤵
  PID:1956
- C:\Windows\System\ciXZCDT.exe
  C:\Windows\System\ciXZCDT.exe
  2⤵
  PID:1644
- C:\Windows\System\yAAqCCY.exe
  C:\Windows\System\yAAqCCY.exe
  2⤵
  PID:2528
- C:\Windows\System\NIXSDMm.exe
  C:\Windows\System\NIXSDMm.exe
  2⤵
  PID:2092
- C:\Windows\System\slJcova.exe
  C:\Windows\System\slJcova.exe
  2⤵
  PID:2704
- C:\Windows\System\YdAFbCE.exe
  C:\Windows\System\YdAFbCE.exe
  2⤵
  PID:2732
- C:\Windows\System\VUjbXfY.exe
  C:\Windows\System\VUjbXfY.exe
  2⤵
  PID:1724
- C:\Windows\System\cXMLRZp.exe
  C:\Windows\System\cXMLRZp.exe
  2⤵
  PID:1980
- C:\Windows\System\ypVLaqi.exe
  C:\Windows\System\ypVLaqi.exe
  2⤵
  PID:2036
- C:\Windows\System\ZvqDJFR.exe
  C:\Windows\System\ZvqDJFR.exe
  2⤵
  PID:860
- C:\Windows\System\HVlowRN.exe
  C:\Windows\System\HVlowRN.exe
  2⤵
  PID:2968
- C:\Windows\System\UOcsXbS.exe
  C:\Windows\System\UOcsXbS.exe
  2⤵
  PID:2440
- C:\Windows\System\LPSvMPX.exe
  C:\Windows\System\LPSvMPX.exe
  2⤵
  PID:2988
- C:\Windows\System\trAXhMZ.exe
  C:\Windows\System\trAXhMZ.exe
  2⤵
  PID:2276
- C:\Windows\System\yKldyXO.exe
  C:\Windows\System\yKldyXO.exe
  2⤵
  PID:2304
- C:\Windows\System\iMKvsCW.exe
  C:\Windows\System\iMKvsCW.exe
  2⤵
  PID:1284
- C:\Windows\System\oHiGipd.exe
  C:\Windows\System\oHiGipd.exe
  2⤵
  PID:1852
- C:\Windows\System\vvYNeeM.exe
  C:\Windows\System\vvYNeeM.exe
  2⤵
  PID:868
- C:\Windows\System\pIBQNdw.exe
  C:\Windows\System\pIBQNdw.exe
  2⤵
  PID:1572
- C:\Windows\System\ifEyJTb.exe
  C:\Windows\System\ifEyJTb.exe
  2⤵
  PID:2784
- C:\Windows\System\MuHsDkJ.exe
  C:\Windows\System\MuHsDkJ.exe
  2⤵
  PID:892
- C:\Windows\System\XDGNxpS.exe
  C:\Windows\System\XDGNxpS.exe
  2⤵
  PID:2468
- C:\Windows\System\YlbdBJX.exe
  C:\Windows\System\YlbdBJX.exe
  2⤵
  PID:1440
- C:\Windows\System\jUfWxST.exe
  C:\Windows\System\jUfWxST.exe
  2⤵
  PID:2604
- C:\Windows\System\EyonnEj.exe
  C:\Windows\System\EyonnEj.exe
  2⤵
  PID:2960
- C:\Windows\System\XEMbffw.exe
  C:\Windows\System\XEMbffw.exe
  2⤵
  PID:2920
- C:\Windows\System\QmDBvZs.exe
  C:\Windows\System\QmDBvZs.exe
  2⤵
  PID:2552
- C:\Windows\System\IHbyAnu.exe
  C:\Windows\System\IHbyAnu.exe
  2⤵
  PID:1800
- C:\Windows\System\CRmHrvG.exe
  C:\Windows\System\CRmHrvG.exe
  2⤵
  PID:2488
- C:\Windows\System\AfbHBbC.exe
  C:\Windows\System\AfbHBbC.exe
  2⤵
  PID:3088
- C:\Windows\System\TXZpyLY.exe
  C:\Windows\System\TXZpyLY.exe
  2⤵
  PID:3108
- C:\Windows\System\SHwDosW.exe
  C:\Windows\System\SHwDosW.exe
  2⤵
  PID:3124
- C:\Windows\System\vWoUYli.exe
  C:\Windows\System\vWoUYli.exe
  2⤵
  PID:3144
- C:\Windows\System\QFcFiuK.exe
  C:\Windows\System\QFcFiuK.exe
  2⤵
  PID:3168
- C:\Windows\System\RykjMMb.exe
  C:\Windows\System\RykjMMb.exe
  2⤵
  PID:3188
- C:\Windows\System\jbBjejE.exe
  C:\Windows\System\jbBjejE.exe
  2⤵
  PID:3208
- C:\Windows\System\mrVHMQU.exe
  C:\Windows\System\mrVHMQU.exe
  2⤵
  PID:3228
- C:\Windows\System\ipFfTFs.exe
  C:\Windows\System\ipFfTFs.exe
  2⤵
  PID:3244
- C:\Windows\System\kWoazDZ.exe
  C:\Windows\System\kWoazDZ.exe
  2⤵
  PID:3268
- C:\Windows\System\gcKZmoF.exe
  C:\Windows\System\gcKZmoF.exe
  2⤵
  PID:3288
- C:\Windows\System\OlRyZdp.exe
  C:\Windows\System\OlRyZdp.exe
  2⤵
  PID:3308
- C:\Windows\System\qRWWiPM.exe
  C:\Windows\System\qRWWiPM.exe
  2⤵
  PID:3328
- C:\Windows\System\jhQvUBW.exe
  C:\Windows\System\jhQvUBW.exe
  2⤵
  PID:3348
- C:\Windows\System\jmRhRGT.exe
  C:\Windows\System\jmRhRGT.exe
  2⤵
  PID:3368
- C:\Windows\System\ElupCdq.exe
  C:\Windows\System\ElupCdq.exe
  2⤵
  PID:3388
- C:\Windows\System\TLmyzWM.exe
  C:\Windows\System\TLmyzWM.exe
  2⤵
  PID:3408
- C:\Windows\System\HTdazqu.exe
  C:\Windows\System\HTdazqu.exe
  2⤵
  PID:3428
- C:\Windows\System\SoQFlgO.exe
  C:\Windows\System\SoQFlgO.exe
  2⤵
  PID:3448
- C:\Windows\System\yBnRCTY.exe
  C:\Windows\System\yBnRCTY.exe
  2⤵
  PID:3476
- C:\Windows\System\hKYyNXQ.exe
  C:\Windows\System\hKYyNXQ.exe
  2⤵
  PID:3496
- C:\Windows\System\gKoDWaT.exe
  C:\Windows\System\gKoDWaT.exe
  2⤵
  PID:3540
- C:\Windows\System\tnqFNNr.exe
  C:\Windows\System\tnqFNNr.exe
  2⤵
  PID:3568
- C:\Windows\System\DUcimzy.exe
  C:\Windows\System\DUcimzy.exe
  2⤵
  PID:3612
- C:\Windows\System\maTMBxX.exe
  C:\Windows\System\maTMBxX.exe
  2⤵
  PID:3632
- C:\Windows\System\jAlUHoR.exe
  C:\Windows\System\jAlUHoR.exe
  2⤵
  PID:3648
- C:\Windows\System\cnOqFJu.exe
  C:\Windows\System\cnOqFJu.exe
  2⤵
  PID:3672
- C:\Windows\System\UGFkTeg.exe
  C:\Windows\System\UGFkTeg.exe
  2⤵
  PID:3688
- C:\Windows\System\cpQkHOl.exe
  C:\Windows\System\cpQkHOl.exe
  2⤵
  PID:3712
- C:\Windows\System\QlOGmKp.exe
  C:\Windows\System\QlOGmKp.exe
  2⤵
  PID:3728
- C:\Windows\System\BPNneJk.exe
  C:\Windows\System\BPNneJk.exe
  2⤵
  PID:3752
- C:\Windows\System\PAnHYlG.exe
  C:\Windows\System\PAnHYlG.exe
  2⤵
  PID:3768
- C:\Windows\System\izPxVvo.exe
  C:\Windows\System\izPxVvo.exe
  2⤵
  PID:3792
- C:\Windows\System\WKEkUnh.exe
  C:\Windows\System\WKEkUnh.exe
  2⤵
  PID:3812
- C:\Windows\System\dQJPSvb.exe
  C:\Windows\System\dQJPSvb.exe
  2⤵
  PID:3828
- C:\Windows\System\EkjQiVc.exe
  C:\Windows\System\EkjQiVc.exe
  2⤵
  PID:3844
- C:\Windows\System\eyBkoaJ.exe
  C:\Windows\System\eyBkoaJ.exe
  2⤵
  PID:3860
- C:\Windows\System\pksptoA.exe
  C:\Windows\System\pksptoA.exe
  2⤵
  PID:3880
- C:\Windows\System\vZjEmGx.exe
  C:\Windows\System\vZjEmGx.exe
  2⤵
  PID:3900
- C:\Windows\System\MXKFicW.exe
  C:\Windows\System\MXKFicW.exe
  2⤵
  PID:3916
- C:\Windows\System\iICczgH.exe
  C:\Windows\System\iICczgH.exe
  2⤵
  PID:3932
- C:\Windows\System\Tkbkdju.exe
  C:\Windows\System\Tkbkdju.exe
  2⤵
  PID:3948
- C:\Windows\System\UsePeSe.exe
  C:\Windows\System\UsePeSe.exe
  2⤵
  PID:3968
- C:\Windows\System\TDlQoIG.exe
  C:\Windows\System\TDlQoIG.exe
  2⤵
  PID:3984
- C:\Windows\System\vRbLKMj.exe
  C:\Windows\System\vRbLKMj.exe
  2⤵
  PID:4000
- C:\Windows\System\wMDvUMl.exe
  C:\Windows\System\wMDvUMl.exe
  2⤵
  PID:4040
- C:\Windows\System\nLuiHvZ.exe
  C:\Windows\System\nLuiHvZ.exe
  2⤵
  PID:4068
- C:\Windows\System\nUnRdFY.exe
  C:\Windows\System\nUnRdFY.exe
  2⤵
  PID:4084
- C:\Windows\System\QOJnycf.exe
  C:\Windows\System\QOJnycf.exe
  2⤵
  PID:316
- C:\Windows\System\RJZHrnY.exe
  C:\Windows\System\RJZHrnY.exe
  2⤵
  PID:1008
- C:\Windows\System\eZTOTev.exe
  C:\Windows\System\eZTOTev.exe
  2⤵
  PID:2196
- C:\Windows\System\FafvUDI.exe
  C:\Windows\System\FafvUDI.exe
  2⤵
  PID:1232
- C:\Windows\System\QprLuDa.exe
  C:\Windows\System\QprLuDa.exe
  2⤵
  PID:1312
- C:\Windows\System\OXlnkKO.exe
  C:\Windows\System\OXlnkKO.exe
  2⤵
  PID:1704
- C:\Windows\System\NSHjbDj.exe
  C:\Windows\System\NSHjbDj.exe
  2⤵
  PID:324
- C:\Windows\System\adNrJSV.exe
  C:\Windows\System\adNrJSV.exe
  2⤵
  PID:2224
- C:\Windows\System\kOOBmfo.exe
  C:\Windows\System\kOOBmfo.exe
  2⤵
  PID:2944
- C:\Windows\System\oBLnPBL.exe
  C:\Windows\System\oBLnPBL.exe
  2⤵
  PID:1404
- C:\Windows\System\HDapjKs.exe
  C:\Windows\System\HDapjKs.exe
  2⤵
  PID:3100
- C:\Windows\System\QVbnAhd.exe
  C:\Windows\System\QVbnAhd.exe
  2⤵
  PID:3116
- C:\Windows\System\SeAjqWn.exe
  C:\Windows\System\SeAjqWn.exe
  2⤵
  PID:3136
- C:\Windows\System\fsKdAAP.exe
  C:\Windows\System\fsKdAAP.exe
  2⤵
  PID:3176
- C:\Windows\System\AEcxyXa.exe
  C:\Windows\System\AEcxyXa.exe
  2⤵
  PID:3204
- C:\Windows\System\QuXbLyw.exe
  C:\Windows\System\QuXbLyw.exe
  2⤵
  PID:3256
- C:\Windows\System\IgqFYdc.exe
  C:\Windows\System\IgqFYdc.exe
  2⤵
  PID:3276
- C:\Windows\System\cDZykhi.exe
  C:\Windows\System\cDZykhi.exe
  2⤵
  PID:3316
- C:\Windows\System\ZVCQsiu.exe
  C:\Windows\System\ZVCQsiu.exe
  2⤵
  PID:3320
- C:\Windows\System\jFjCRVt.exe
  C:\Windows\System\jFjCRVt.exe
  2⤵
  PID:2872
- C:\Windows\System\GnuElTS.exe
  C:\Windows\System\GnuElTS.exe
  2⤵
  PID:2776
- C:\Windows\System\qtqzRdO.exe
  C:\Windows\System\qtqzRdO.exe
  2⤵
  PID:2992
- C:\Windows\System\wGJZKkM.exe
  C:\Windows\System\wGJZKkM.exe
  2⤵
  PID:1608
- C:\Windows\System\hFJnFyA.exe
  C:\Windows\System\hFJnFyA.exe
  2⤵
  PID:3400
- C:\Windows\System\UqzdnRI.exe
  C:\Windows\System\UqzdnRI.exe
  2⤵
  PID:3424
- C:\Windows\System\WdxzvyB.exe
  C:\Windows\System\WdxzvyB.exe
  2⤵
  PID:3440
- C:\Windows\System\ljBmskH.exe
  C:\Windows\System\ljBmskH.exe
  2⤵
  PID:3464
- C:\Windows\System\FThHEuu.exe
  C:\Windows\System\FThHEuu.exe
  2⤵
  PID:3488
- C:\Windows\System\cEyQrwr.exe
  C:\Windows\System\cEyQrwr.exe
  2⤵
  PID:656
- C:\Windows\System\DCaeomG.exe
  C:\Windows\System\DCaeomG.exe
  2⤵
  PID:1732
- C:\Windows\System\wWrlIJp.exe
  C:\Windows\System\wWrlIJp.exe
  2⤵
  PID:748
- C:\Windows\System\dYEghHV.exe
  C:\Windows\System\dYEghHV.exe
  2⤵
  PID:2796
- C:\Windows\System\sSdQSnJ.exe
  C:\Windows\System\sSdQSnJ.exe
  2⤵
  PID:2932
- C:\Windows\System\waAGkUF.exe
  C:\Windows\System\waAGkUF.exe
  2⤵
  PID:1108
- C:\Windows\System\xdQnoJT.exe
  C:\Windows\System\xdQnoJT.exe
  2⤵
  PID:2540
- C:\Windows\System\EIfjOOK.exe
  C:\Windows\System\EIfjOOK.exe
  2⤵
  PID:3152
- C:\Windows\System\naIopLk.exe
  C:\Windows\System\naIopLk.exe
  2⤵
  PID:3604
- C:\Windows\System\PbifsCx.exe
  C:\Windows\System\PbifsCx.exe
  2⤵
  PID:3640
- C:\Windows\System\kbCaEfc.exe
  C:\Windows\System\kbCaEfc.exe
  2⤵
  PID:3656
- C:\Windows\System\bbdwULR.exe
  C:\Windows\System\bbdwULR.exe
  2⤵
  PID:3684
- C:\Windows\System\uunQriW.exe
  C:\Windows\System\uunQriW.exe
  2⤵
  PID:3700
- C:\Windows\System\zCyzHPv.exe
  C:\Windows\System\zCyzHPv.exe
  2⤵
  PID:3744
- C:\Windows\System\xwrXFwQ.exe
  C:\Windows\System\xwrXFwQ.exe
  2⤵
  PID:3784
- C:\Windows\System\lKgRpxK.exe
  C:\Windows\System\lKgRpxK.exe
  2⤵
  PID:3804
- C:\Windows\System\evPPSyA.exe
  C:\Windows\System\evPPSyA.exe
  2⤵
  PID:3836
- C:\Windows\System\bddmEXR.exe
  C:\Windows\System\bddmEXR.exe
  2⤵
  PID:3872
- C:\Windows\System\ZkUIjdr.exe
  C:\Windows\System\ZkUIjdr.exe
  2⤵
  PID:3956
- C:\Windows\System\dHdnqfL.exe
  C:\Windows\System\dHdnqfL.exe
  2⤵
  PID:3924
- C:\Windows\System\zTsduJG.exe
  C:\Windows\System\zTsduJG.exe
  2⤵
  PID:4008
- C:\Windows\System\FiTPOCi.exe
  C:\Windows\System\FiTPOCi.exe
  2⤵
  PID:4020
- C:\Windows\System\yjGDOKb.exe
  C:\Windows\System\yjGDOKb.exe
  2⤵
  PID:4036
- C:\Windows\System\eHhpNFS.exe
  C:\Windows\System\eHhpNFS.exe
  2⤵
  PID:912
- C:\Windows\System\RKIsUvu.exe
  C:\Windows\System\RKIsUvu.exe
  2⤵
  PID:2248
- C:\Windows\System\TnjAVZt.exe
  C:\Windows\System\TnjAVZt.exe
  2⤵
  PID:2680
- C:\Windows\System\QRLuGEq.exe
  C:\Windows\System\QRLuGEq.exe
  2⤵
  PID:2396
- C:\Windows\System\FKWbqnm.exe
  C:\Windows\System\FKWbqnm.exe
  2⤵
  PID:1012
- C:\Windows\System\weBnYGT.exe
  C:\Windows\System\weBnYGT.exe
  2⤵
  PID:984
- C:\Windows\System\eMCSXsE.exe
  C:\Windows\System\eMCSXsE.exe
  2⤵
  PID:2332
- C:\Windows\System\OdzFteG.exe
  C:\Windows\System\OdzFteG.exe
  2⤵
  PID:3164
- C:\Windows\System\maRGbvF.exe
  C:\Windows\System\maRGbvF.exe
  2⤵
  PID:3252
- C:\Windows\System\LoONSae.exe
  C:\Windows\System\LoONSae.exe
  2⤵
  PID:3264
- C:\Windows\System\gmtZFza.exe
  C:\Windows\System\gmtZFza.exe
  2⤵
  PID:3280
- C:\Windows\System\ZqirUSm.exe
  C:\Windows\System\ZqirUSm.exe
  2⤵
  PID:3344
- C:\Windows\System\NCeRpWh.exe
  C:\Windows\System\NCeRpWh.exe
  2⤵
  PID:2716
- C:\Windows\System\nNWiEuH.exe
  C:\Windows\System\nNWiEuH.exe
  2⤵
  PID:2316
- C:\Windows\System\okrzUWr.exe
  C:\Windows\System\okrzUWr.exe
  2⤵
  PID:3484
- C:\Windows\System\czTbSow.exe
  C:\Windows\System\czTbSow.exe
  2⤵
  PID:1944
- C:\Windows\System\gsxfwfi.exe
  C:\Windows\System\gsxfwfi.exe
  2⤵
  PID:2800
- C:\Windows\System\TbUGIHz.exe
  C:\Windows\System\TbUGIHz.exe
  2⤵
  PID:3492
- C:\Windows\System\yMYBMLi.exe
  C:\Windows\System\yMYBMLi.exe
  2⤵
  PID:2896
- C:\Windows\System\GUePjYO.exe
  C:\Windows\System\GUePjYO.exe
  2⤵
  PID:2104
- C:\Windows\System\aJNnicU.exe
  C:\Windows\System\aJNnicU.exe
  2⤵
  PID:2052
- C:\Windows\System\UsmwtSM.exe
  C:\Windows\System\UsmwtSM.exe
  2⤵
  PID:4064
- C:\Windows\System\cNRKsTH.exe
  C:\Windows\System\cNRKsTH.exe
  2⤵
  PID:1452
- C:\Windows\System\YDweYoA.exe
  C:\Windows\System\YDweYoA.exe
  2⤵
  PID:3724
- C:\Windows\System\sfmgDCY.exe
  C:\Windows\System\sfmgDCY.exe
  2⤵
  PID:2888
- C:\Windows\System\ukZRVfn.exe
  C:\Windows\System\ukZRVfn.exe
  2⤵
  PID:3708
- C:\Windows\System\KOugOzQ.exe
  C:\Windows\System\KOugOzQ.exe
  2⤵
  PID:3820
- C:\Windows\System\OAlYBgc.exe
  C:\Windows\System\OAlYBgc.exe
  2⤵
  PID:1924
- C:\Windows\System\uPlMXnk.exe
  C:\Windows\System\uPlMXnk.exe
  2⤵
  PID:4024
- C:\Windows\System\yHVfIkN.exe
  C:\Windows\System\yHVfIkN.exe
  2⤵
  PID:3940
- C:\Windows\System\SfHseCj.exe
  C:\Windows\System\SfHseCj.exe
  2⤵
  PID:2844
- C:\Windows\System\dQWToma.exe
  C:\Windows\System\dQWToma.exe
  2⤵
  PID:2852
- C:\Windows\System\XErAeFf.exe
  C:\Windows\System\XErAeFf.exe
  2⤵
  PID:2976
- C:\Windows\System\uKblUES.exe
  C:\Windows\System\uKblUES.exe
  2⤵
  PID:2744
- C:\Windows\System\encgUIO.exe
  C:\Windows\System\encgUIO.exe
  2⤵
  PID:1320
- C:\Windows\System\VbdOrUG.exe
  C:\Windows\System\VbdOrUG.exe
  2⤵
  PID:3180
- C:\Windows\System\kMUANzA.exe
  C:\Windows\System\kMUANzA.exe
  2⤵
  PID:3628
- C:\Windows\System\JJOUdqp.exe
  C:\Windows\System\JJOUdqp.exe
  2⤵
  PID:2040
- C:\Windows\System\WPZSazF.exe
  C:\Windows\System\WPZSazF.exe
  2⤵
  PID:3084
- C:\Windows\System\vnHUJQu.exe
  C:\Windows\System\vnHUJQu.exe
  2⤵
  PID:2916
- C:\Windows\System\QYFsIcF.exe
  C:\Windows\System\QYFsIcF.exe
  2⤵
  PID:1408
- C:\Windows\System\yjwAPLB.exe
  C:\Windows\System\yjwAPLB.exe
  2⤵
  PID:2828
- C:\Windows\System\TNZgRfR.exe
  C:\Windows\System\TNZgRfR.exe
  2⤵
  PID:2100
- C:\Windows\System\woYorJV.exe
  C:\Windows\System\woYorJV.exe
  2⤵
  PID:3664
- C:\Windows\System\zIIkijc.exe
  C:\Windows\System\zIIkijc.exe
  2⤵
  PID:3776
- C:\Windows\System\NUgVuJw.exe
  C:\Windows\System\NUgVuJw.exe
  2⤵
  PID:3576
- C:\Windows\System\Wyltoos.exe
  C:\Windows\System\Wyltoos.exe
  2⤵
  PID:3016
- C:\Windows\System\FTHaCRQ.exe
  C:\Windows\System\FTHaCRQ.exe
  2⤵
  PID:1248
- C:\Windows\System\yFjxwuG.exe
  C:\Windows\System\yFjxwuG.exe
  2⤵
  PID:3644
- C:\Windows\System\OnCJRmY.exe
  C:\Windows\System\OnCJRmY.exe
  2⤵
  PID:2484
- C:\Windows\System\kMsMmEg.exe
  C:\Windows\System\kMsMmEg.exe
  2⤵
  PID:3336
- C:\Windows\System\FWlasuw.exe
  C:\Windows\System\FWlasuw.exe
  2⤵
  PID:3376
- C:\Windows\System\FvowJCJ.exe
  C:\Windows\System\FvowJCJ.exe
  2⤵
  PID:2116
- C:\Windows\System\WNrHaDP.exe
  C:\Windows\System\WNrHaDP.exe
  2⤵
  PID:2760
- C:\Windows\System\oVBLBdS.exe
  C:\Windows\System\oVBLBdS.exe
  2⤵
  PID:1620
- C:\Windows\System\OiqhQiv.exe
  C:\Windows\System\OiqhQiv.exe
  2⤵
  PID:3736
- C:\Windows\System\AlnVMFb.exe
  C:\Windows\System\AlnVMFb.exe
  2⤵
  PID:3764
- C:\Windows\System\UmfoctT.exe
  C:\Windows\System\UmfoctT.exe
  2⤵
  PID:2240
- C:\Windows\System\BbNpmhX.exe
  C:\Windows\System\BbNpmhX.exe
  2⤵
  PID:2340
- C:\Windows\System\tnbZofc.exe
  C:\Windows\System\tnbZofc.exe
  2⤵
  PID:3740
- C:\Windows\System\MXxVcAt.exe
  C:\Windows\System\MXxVcAt.exe
  2⤵
  PID:3824
- C:\Windows\System\vdlEJEZ.exe
  C:\Windows\System\vdlEJEZ.exe
  2⤵
  PID:4016
- C:\Windows\System\FWZgYsc.exe
  C:\Windows\System\FWZgYsc.exe
  2⤵
  PID:4080
- C:\Windows\System\FmxRlnf.exe
  C:\Windows\System\FmxRlnf.exe
  2⤵
  PID:3240
- C:\Windows\System\fZDgZmH.exe
  C:\Windows\System\fZDgZmH.exe
  2⤵
  PID:3156
- C:\Windows\System\CnuFgOU.exe
  C:\Windows\System\CnuFgOU.exe
  2⤵
  PID:4100
- C:\Windows\System\dQnSmIB.exe
  C:\Windows\System\dQnSmIB.exe
  2⤵
  PID:4120
- C:\Windows\System\ocEjXIZ.exe
  C:\Windows\System\ocEjXIZ.exe
  2⤵
  PID:4152
- C:\Windows\System\HtgjyCG.exe
  C:\Windows\System\HtgjyCG.exe
  2⤵
  PID:4176
- C:\Windows\System\QXMJHGu.exe
  C:\Windows\System\QXMJHGu.exe
  2⤵
  PID:4192
- C:\Windows\System\SVquDpC.exe
  C:\Windows\System\SVquDpC.exe
  2⤵
  PID:4208
- C:\Windows\System\ZfxYkFX.exe
  C:\Windows\System\ZfxYkFX.exe
  2⤵
  PID:4228
- C:\Windows\System\EJRXAjt.exe
  C:\Windows\System\EJRXAjt.exe
  2⤵
  PID:4248
- C:\Windows\System\oIzAZvM.exe
  C:\Windows\System\oIzAZvM.exe
  2⤵
  PID:4268
- C:\Windows\System\LewzHzq.exe
  C:\Windows\System\LewzHzq.exe
  2⤵
  PID:4288
- C:\Windows\System\vkBcODR.exe
  C:\Windows\System\vkBcODR.exe
  2⤵
  PID:4304
- C:\Windows\System\zYvSRlC.exe
  C:\Windows\System\zYvSRlC.exe
  2⤵
  PID:4324
- C:\Windows\System\FujlKQJ.exe
  C:\Windows\System\FujlKQJ.exe
  2⤵
  PID:4340
- C:\Windows\System\ZIrkIPK.exe
  C:\Windows\System\ZIrkIPK.exe
  2⤵
  PID:4360
- C:\Windows\System\yCgVcZN.exe
  C:\Windows\System\yCgVcZN.exe
  2⤵
  PID:4376
- C:\Windows\System\fADzQzV.exe
  C:\Windows\System\fADzQzV.exe
  2⤵
  PID:4392
- C:\Windows\System\HujXxNF.exe
  C:\Windows\System\HujXxNF.exe
  2⤵
  PID:4412
- C:\Windows\System\VwkzCJl.exe
  C:\Windows\System\VwkzCJl.exe
  2⤵
  PID:4448
- C:\Windows\System\LlqDnlb.exe
  C:\Windows\System\LlqDnlb.exe
  2⤵
  PID:4468
- C:\Windows\System\ShbOjMH.exe
  C:\Windows\System\ShbOjMH.exe
  2⤵
  PID:4484
- C:\Windows\System\kIWnNty.exe
  C:\Windows\System\kIWnNty.exe
  2⤵
  PID:4500
- C:\Windows\System\BCZbkpX.exe
  C:\Windows\System\BCZbkpX.exe
  2⤵
  PID:4516
- C:\Windows\System\KzkhBVh.exe
  C:\Windows\System\KzkhBVh.exe
  2⤵
  PID:4532
- C:\Windows\System\cbKwDYq.exe
  C:\Windows\System\cbKwDYq.exe
  2⤵
  PID:4548
- C:\Windows\System\fXlYjAC.exe
  C:\Windows\System\fXlYjAC.exe
  2⤵
  PID:4568
- C:\Windows\System\UyRnZDr.exe
  C:\Windows\System\UyRnZDr.exe
  2⤵
  PID:4588
- C:\Windows\System\LGqjlxH.exe
  C:\Windows\System\LGqjlxH.exe
  2⤵
  PID:4612
- C:\Windows\System\aqWLzYT.exe
  C:\Windows\System\aqWLzYT.exe
  2⤵
  PID:4632
- C:\Windows\System\IxAAlrv.exe
  C:\Windows\System\IxAAlrv.exe
  2⤵
  PID:4652
- C:\Windows\System\AYkfnhd.exe
  C:\Windows\System\AYkfnhd.exe
  2⤵
  PID:4676
- C:\Windows\System\mAsACJm.exe
  C:\Windows\System\mAsACJm.exe
  2⤵
  PID:4696
- C:\Windows\System\mhXWJOD.exe
  C:\Windows\System\mhXWJOD.exe
  2⤵
  PID:4716
- C:\Windows\System\DRZUNnC.exe
  C:\Windows\System\DRZUNnC.exe
  2⤵
  PID:4736
- C:\Windows\System\ZXqkbjx.exe
  C:\Windows\System\ZXqkbjx.exe
  2⤵
  PID:4752
- C:\Windows\System\InSzcSe.exe
  C:\Windows\System\InSzcSe.exe
  2⤵
  PID:4772
- C:\Windows\System\xEpSorZ.exe
  C:\Windows\System\xEpSorZ.exe
  2⤵
  PID:4792
- C:\Windows\System\tfBOMMd.exe
  C:\Windows\System\tfBOMMd.exe
  2⤵
  PID:4820
- C:\Windows\System\eWmSfrx.exe
  C:\Windows\System\eWmSfrx.exe
  2⤵
  PID:4836
- C:\Windows\System\rnKdRGV.exe
  C:\Windows\System\rnKdRGV.exe
  2⤵
  PID:4852
- C:\Windows\System\iwNNxGP.exe
  C:\Windows\System\iwNNxGP.exe
  2⤵
  PID:4872
- C:\Windows\System\pzEyqdk.exe
  C:\Windows\System\pzEyqdk.exe
  2⤵
  PID:4896
- C:\Windows\System\FmPCYOm.exe
  C:\Windows\System\FmPCYOm.exe
  2⤵
  PID:4912
- C:\Windows\System\fxJScCv.exe
  C:\Windows\System\fxJScCv.exe
  2⤵
  PID:4932
- C:\Windows\System\mszurGv.exe
  C:\Windows\System\mszurGv.exe
  2⤵
  PID:4948
- C:\Windows\System\owjSYHB.exe
  C:\Windows\System\owjSYHB.exe
  2⤵
  PID:4964
- C:\Windows\System\ZaAxMzP.exe
  C:\Windows\System\ZaAxMzP.exe
  2⤵
  PID:4984
- C:\Windows\System\juPvDgB.exe
  C:\Windows\System\juPvDgB.exe
  2⤵
  PID:5000
- C:\Windows\System\GlXvXmR.exe
  C:\Windows\System\GlXvXmR.exe
  2⤵
  PID:5020
- C:\Windows\System\jNLSIUA.exe
  C:\Windows\System\jNLSIUA.exe
  2⤵
  PID:5036
- C:\Windows\System\lTWASup.exe
  C:\Windows\System\lTWASup.exe
  2⤵
  PID:5056
- C:\Windows\System\NMBKdhK.exe
  C:\Windows\System\NMBKdhK.exe
  2⤵
  PID:5072
- C:\Windows\System\sMGVRzc.exe
  C:\Windows\System\sMGVRzc.exe
  2⤵
  PID:5096
- C:\Windows\System\NDzyapy.exe
  C:\Windows\System\NDzyapy.exe
  2⤵
  PID:5112
- C:\Windows\System\ucKFjuM.exe
  C:\Windows\System\ucKFjuM.exe
  2⤵
  PID:4112
- C:\Windows\System\BlLgeLK.exe
  C:\Windows\System\BlLgeLK.exe
  2⤵
  PID:3356
- C:\Windows\System\bmeIsha.exe
  C:\Windows\System\bmeIsha.exe
  2⤵
  PID:3980
- C:\Windows\System\kdGOCjD.exe
  C:\Windows\System\kdGOCjD.exe
  2⤵
  PID:4160
- C:\Windows\System\vhYrqnQ.exe
  C:\Windows\System\vhYrqnQ.exe
  2⤵
  PID:4172
- C:\Windows\System\UFGybtX.exe
  C:\Windows\System\UFGybtX.exe
  2⤵
  PID:4276
- C:\Windows\System\MjPlEru.exe
  C:\Windows\System\MjPlEru.exe
  2⤵
  PID:4320
- C:\Windows\System\yaqzEEH.exe
  C:\Windows\System\yaqzEEH.exe
  2⤵
  PID:4388
- C:\Windows\System\TIteIsz.exe
  C:\Windows\System\TIteIsz.exe
  2⤵
  PID:4184
- C:\Windows\System\QSKRrjD.exe
  C:\Windows\System\QSKRrjD.exe
  2⤵
  PID:4224
- C:\Windows\System\jJtkarO.exe
  C:\Windows\System\jJtkarO.exe
  2⤵
  PID:4300
- C:\Windows\System\DNCojIS.exe
  C:\Windows\System\DNCojIS.exe
  2⤵
  PID:4372
- C:\Windows\System\ZgToMnf.exe
  C:\Windows\System\ZgToMnf.exe
  2⤵
  PID:4424
- C:\Windows\System\nFALVLS.exe
  C:\Windows\System\nFALVLS.exe
  2⤵
  PID:4440
- C:\Windows\System\iNMJlTf.exe
  C:\Windows\System\iNMJlTf.exe
  2⤵
  PID:4508
- C:\Windows\System\EiLyylr.exe
  C:\Windows\System\EiLyylr.exe
  2⤵
  PID:4584
- C:\Windows\System\LzVXjEV.exe
  C:\Windows\System\LzVXjEV.exe
  2⤵
  PID:4668
- C:\Windows\System\NOSJCKQ.exe
  C:\Windows\System\NOSJCKQ.exe
  2⤵
  PID:4660
- C:\Windows\System\WCNLGjL.exe
  C:\Windows\System\WCNLGjL.exe
  2⤵
  PID:4744
- C:\Windows\System\SVyUgCn.exe
  C:\Windows\System\SVyUgCn.exe
  2⤵
  PID:4528
- C:\Windows\System\JlvcuMA.exe
  C:\Windows\System\JlvcuMA.exe
  2⤵
  PID:4860
- C:\Windows\System\gkowZED.exe
  C:\Windows\System\gkowZED.exe
  2⤵
  PID:4940
- C:\Windows\System\TiHlHLM.exe
  C:\Windows\System\TiHlHLM.exe
  2⤵
  PID:5008
- C:\Windows\System\mqkQGDd.exe
  C:\Windows\System\mqkQGDd.exe
  2⤵
  PID:4140
- C:\Windows\System\yMtPnTJ.exe
  C:\Windows\System\yMtPnTJ.exe
  2⤵
  PID:4264
- C:\Windows\System\uFwFFFy.exe
  C:\Windows\System\uFwFFFy.exe
  2⤵
  PID:4540
- C:\Windows\System\erhaicG.exe
  C:\Windows\System\erhaicG.exe
  2⤵
  PID:4980
- C:\Windows\System\nCBamuD.exe
  C:\Windows\System\nCBamuD.exe
  2⤵
  PID:4524
- C:\Windows\System\QGApcjV.exe
  C:\Windows\System\QGApcjV.exe
  2⤵
  PID:4128
- C:\Windows\System\bbmTEva.exe
  C:\Windows\System\bbmTEva.exe
  2⤵
  PID:4456
- C:\Windows\System\YGsWqbb.exe
  C:\Windows\System\YGsWqbb.exe
  2⤵
  PID:4596
- C:\Windows\System\ebiCSNf.exe
  C:\Windows\System\ebiCSNf.exe
  2⤵
  PID:4644
- C:\Windows\System\ksYybwk.exe
  C:\Windows\System\ksYybwk.exe
  2⤵
  PID:4760
- C:\Windows\System\mYOBUtu.exe
  C:\Windows\System\mYOBUtu.exe
  2⤵
  PID:4804
- C:\Windows\System\iKNbobe.exe
  C:\Windows\System\iKNbobe.exe
  2⤵
  PID:4844
- C:\Windows\System\aDzNRry.exe
  C:\Windows\System\aDzNRry.exe
  2⤵
  PID:4928
- C:\Windows\System\hwZxNgV.exe
  C:\Windows\System\hwZxNgV.exe
  2⤵
  PID:4996
- C:\Windows\System\EXclXcR.exe
  C:\Windows\System\EXclXcR.exe
  2⤵
  PID:5104
- C:\Windows\System\fAtXNOi.exe
  C:\Windows\System\fAtXNOi.exe
  2⤵
  PID:4240
- C:\Windows\System\MNDRTbE.exe
  C:\Windows\System\MNDRTbE.exe
  2⤵
  PID:4220
- C:\Windows\System\YaTEnrA.exe
  C:\Windows\System\YaTEnrA.exe
  2⤵
  PID:4664
- C:\Windows\System\wEgmoSa.exe
  C:\Windows\System\wEgmoSa.exe
  2⤵
  PID:5044
- C:\Windows\System\sVrrRcZ.exe
  C:\Windows\System\sVrrRcZ.exe
  2⤵
  PID:5088
- C:\Windows\System\eZeYdky.exe
  C:\Windows\System\eZeYdky.exe
  2⤵
  PID:2456
- C:\Windows\System\HfYvcOK.exe
  C:\Windows\System\HfYvcOK.exe
  2⤵
  PID:3184
- C:\Windows\System\TOSMbct.exe
  C:\Windows\System\TOSMbct.exe
  2⤵
  PID:4296
- C:\Windows\System\PksXztJ.exe
  C:\Windows\System\PksXztJ.exe
  2⤵
  PID:4404
- C:\Windows\System\hMEzYmj.exe
  C:\Windows\System\hMEzYmj.exe
  2⤵
  PID:4864
- C:\Windows\System\MuqkAtF.exe
  C:\Windows\System\MuqkAtF.exe
  2⤵
  PID:4420
- C:\Windows\System\PsEaVSc.exe
  C:\Windows\System\PsEaVSc.exe
  2⤵
  PID:4432
- C:\Windows\System\LyxJLsm.exe
  C:\Windows\System\LyxJLsm.exe
  2⤵
  PID:4628
- C:\Windows\System\yMmqDeH.exe
  C:\Windows\System\yMmqDeH.exe
  2⤵
  PID:4812
- C:\Windows\System\jfeHTdl.exe
  C:\Windows\System\jfeHTdl.exe
  2⤵
  PID:4764
- C:\Windows\System\dJONaAI.exe
  C:\Windows\System\dJONaAI.exe
  2⤵
  PID:4924
- C:\Windows\System\uVrmnnX.exe
  C:\Windows\System\uVrmnnX.exe
  2⤵
  PID:4960
- C:\Windows\System\affnCGh.exe
  C:\Windows\System\affnCGh.exe
  2⤵
  PID:4356
- C:\Windows\System\RfiSPkC.exe
  C:\Windows\System\RfiSPkC.exe
  2⤵
  PID:4784
- C:\Windows\System\RZiWYlD.exe
  C:\Windows\System\RZiWYlD.exe
  2⤵
  PID:5084
- C:\Windows\System\qHPMjrV.exe
  C:\Windows\System\qHPMjrV.exe
  2⤵
  PID:4908
- C:\Windows\System\YjNmKMU.exe
  C:\Windows\System\YjNmKMU.exe
  2⤵
  PID:4904
- C:\Windows\System\RhkbTVN.exe
  C:\Windows\System\RhkbTVN.exe
  2⤵
  PID:4204
- C:\Windows\System\UQgyrSq.exe
  C:\Windows\System\UQgyrSq.exe
  2⤵
  PID:4708
- C:\Windows\System\ANRgQPM.exe
  C:\Windows\System\ANRgQPM.exe
  2⤵
  PID:5032
- C:\Windows\System\XjHUXfA.exe
  C:\Windows\System\XjHUXfA.exe
  2⤵
  PID:1236
- C:\Windows\System\VhulItC.exe
  C:\Windows\System\VhulItC.exe
  2⤵
  PID:4200
- C:\Windows\System\BcyJbqB.exe
  C:\Windows\System\BcyJbqB.exe
  2⤵
  PID:4480
- C:\Windows\System\BayMWKb.exe
  C:\Windows\System\BayMWKb.exe
  2⤵
  PID:4560
- C:\Windows\System\NVzGffr.exe
  C:\Windows\System\NVzGffr.exe
  2⤵
  PID:4132
- C:\Windows\System\zholDWe.exe
  C:\Windows\System\zholDWe.exe
  2⤵
  PID:4312
- C:\Windows\System\mNeSrPI.exe
  C:\Windows\System\mNeSrPI.exe
  2⤵
  PID:4640
- C:\Windows\System\WJjOkNj.exe
  C:\Windows\System\WJjOkNj.exe
  2⤵
  PID:5052
- C:\Windows\System\seXehgn.exe
  C:\Windows\System\seXehgn.exe
  2⤵
  PID:4492
- C:\Windows\System\pOPSTzN.exe
  C:\Windows\System\pOPSTzN.exe
  2⤵
  PID:4216
- C:\Windows\System\dmlSYSH.exe
  C:\Windows\System\dmlSYSH.exe
  2⤵
  PID:4608
- C:\Windows\System\jIPTRNf.exe
  C:\Windows\System\jIPTRNf.exe
  2⤵
  PID:4688
- C:\Windows\System\SrXZwRY.exe
  C:\Windows\System\SrXZwRY.exe
  2⤵
  PID:5136
- C:\Windows\System\FjLtXvP.exe
  C:\Windows\System\FjLtXvP.exe
  2⤵
  PID:5160
- C:\Windows\System\JNhQJkS.exe
  C:\Windows\System\JNhQJkS.exe
  2⤵
  PID:5176
- C:\Windows\System\CJeonOA.exe
  C:\Windows\System\CJeonOA.exe
  2⤵
  PID:5192
- C:\Windows\System\HYGMrGF.exe
  C:\Windows\System\HYGMrGF.exe
  2⤵
  PID:5212
- C:\Windows\System\WtSWdKn.exe
  C:\Windows\System\WtSWdKn.exe
  2⤵
  PID:5228
- C:\Windows\System\CdAwzKZ.exe
  C:\Windows\System\CdAwzKZ.exe
  2⤵
  PID:5248
- C:\Windows\System\mWmnhAI.exe
  C:\Windows\System\mWmnhAI.exe
  2⤵
  PID:5264
- C:\Windows\System\JCcLxcK.exe
  C:\Windows\System\JCcLxcK.exe
  2⤵
  PID:5280
- C:\Windows\System\PbRZmpI.exe
  C:\Windows\System\PbRZmpI.exe
  2⤵
  PID:5296
- C:\Windows\System\AfwsBVK.exe
  C:\Windows\System\AfwsBVK.exe
  2⤵
  PID:5312
- C:\Windows\System\MaAqRIV.exe
  C:\Windows\System\MaAqRIV.exe
  2⤵
  PID:5328
- C:\Windows\System\moWfXOw.exe
  C:\Windows\System\moWfXOw.exe
  2⤵
  PID:5344
- C:\Windows\System\BJqLKaN.exe
  C:\Windows\System\BJqLKaN.exe
  2⤵
  PID:5360
- C:\Windows\System\TgBTlPv.exe
  C:\Windows\System\TgBTlPv.exe
  2⤵
  PID:5376
- C:\Windows\System\XxXlspe.exe
  C:\Windows\System\XxXlspe.exe
  2⤵
  PID:5392
- C:\Windows\System\BSoKKlp.exe
  C:\Windows\System\BSoKKlp.exe
  2⤵
  PID:5408
- C:\Windows\System\pwcyjeQ.exe
  C:\Windows\System\pwcyjeQ.exe
  2⤵
  PID:5424
- C:\Windows\System\udxGPtb.exe
  C:\Windows\System\udxGPtb.exe
  2⤵
  PID:5440
- C:\Windows\System\qgHXFgT.exe
  C:\Windows\System\qgHXFgT.exe
  2⤵
  PID:5456
- C:\Windows\System\wEKQXyt.exe
  C:\Windows\System\wEKQXyt.exe
  2⤵
  PID:5472
- C:\Windows\System\ciQONDs.exe
  C:\Windows\System\ciQONDs.exe
  2⤵
  PID:5488
- C:\Windows\System\SxWfLQH.exe
  C:\Windows\System\SxWfLQH.exe
  2⤵
  PID:5504
- C:\Windows\System\vTwqaGs.exe
  C:\Windows\System\vTwqaGs.exe
  2⤵
  PID:5520
- C:\Windows\System\pXjIhAK.exe
  C:\Windows\System\pXjIhAK.exe
  2⤵
  PID:5536
- C:\Windows\System\tuZfHpM.exe
  C:\Windows\System\tuZfHpM.exe
  2⤵
  PID:5552
- C:\Windows\System\bvVfhvl.exe
  C:\Windows\System\bvVfhvl.exe
  2⤵
  PID:5568
- C:\Windows\System\VECxGIO.exe
  C:\Windows\System\VECxGIO.exe
  2⤵
  PID:5584
- C:\Windows\System\wYylWfD.exe
  C:\Windows\System\wYylWfD.exe
  2⤵
  PID:5608
- C:\Windows\System\tgQfazO.exe
  C:\Windows\System\tgQfazO.exe
  2⤵
  PID:5624
- C:\Windows\System\vtOSFuC.exe
  C:\Windows\System\vtOSFuC.exe
  2⤵
  PID:5640
- C:\Windows\System\BXwQyHp.exe
  C:\Windows\System\BXwQyHp.exe
  2⤵
  PID:5656
- C:\Windows\System\liVxZQi.exe
  C:\Windows\System\liVxZQi.exe
  2⤵
  PID:5672
- C:\Windows\System\IkCyCSJ.exe
  C:\Windows\System\IkCyCSJ.exe
  2⤵
  PID:5688
- C:\Windows\System\tvjoDLV.exe
  C:\Windows\System\tvjoDLV.exe
  2⤵
  PID:5704
- C:\Windows\System\dttRgiC.exe
  C:\Windows\System\dttRgiC.exe
  2⤵
  PID:5720
- C:\Windows\System\PLnUGxf.exe
  C:\Windows\System\PLnUGxf.exe
  2⤵
  PID:5736
- C:\Windows\System\TPkIliu.exe
  C:\Windows\System\TPkIliu.exe
  2⤵
  PID:5752
- C:\Windows\System\ltDKfVP.exe
  C:\Windows\System\ltDKfVP.exe
  2⤵
  PID:5768
- C:\Windows\System\fXOlCYc.exe
  C:\Windows\System\fXOlCYc.exe
  2⤵
  PID:5784
- C:\Windows\System\gtLntFB.exe
  C:\Windows\System\gtLntFB.exe
  2⤵
  PID:5800
- C:\Windows\System\MiZEwom.exe
  C:\Windows\System\MiZEwom.exe
  2⤵
  PID:5816
- C:\Windows\System\TnYTYim.exe
  C:\Windows\System\TnYTYim.exe
  2⤵
  PID:5836
- C:\Windows\System\jDmUzHa.exe
  C:\Windows\System\jDmUzHa.exe
  2⤵
  PID:5856
- C:\Windows\System\UhyDKCi.exe
  C:\Windows\System\UhyDKCi.exe
  2⤵
  PID:5872
- C:\Windows\System\XcNZkot.exe
  C:\Windows\System\XcNZkot.exe
  2⤵
  PID:5888
- C:\Windows\System\BNKGcBE.exe
  C:\Windows\System\BNKGcBE.exe
  2⤵
  PID:5904
- C:\Windows\System\FRLZZJg.exe
  C:\Windows\System\FRLZZJg.exe
  2⤵
  PID:5920
- C:\Windows\System\rFqfYeU.exe
  C:\Windows\System\rFqfYeU.exe
  2⤵
  PID:5944
- C:\Windows\System\sqiehoG.exe
  C:\Windows\System\sqiehoG.exe
  2⤵
  PID:5964
- C:\Windows\System\XrYleig.exe
  C:\Windows\System\XrYleig.exe
  2⤵
  PID:5980
- C:\Windows\System\ZnbUKNr.exe
  C:\Windows\System\ZnbUKNr.exe
  2⤵
  PID:6000
- C:\Windows\System\haLOSWz.exe
  C:\Windows\System\haLOSWz.exe
  2⤵
  PID:6016
- C:\Windows\System\FxPeMiJ.exe
  C:\Windows\System\FxPeMiJ.exe
  2⤵
  PID:6036
- C:\Windows\System\agbMfkc.exe
  C:\Windows\System\agbMfkc.exe
  2⤵
  PID:6052
- C:\Windows\System\yBhXFHK.exe
  C:\Windows\System\yBhXFHK.exe
  2⤵
  PID:6068
- C:\Windows\System\Xxuwbin.exe
  C:\Windows\System\Xxuwbin.exe
  2⤵
  PID:6084
- C:\Windows\System\PbwrBiD.exe
  C:\Windows\System\PbwrBiD.exe
  2⤵
  PID:6104
- C:\Windows\System\fcNuoSD.exe
  C:\Windows\System\fcNuoSD.exe
  2⤵
  PID:6124
- C:\Windows\System\cmlZjax.exe
  C:\Windows\System\cmlZjax.exe
  2⤵
  PID:4352
- C:\Windows\System\pgFETFN.exe
  C:\Windows\System\pgFETFN.exe
  2⤵
  PID:4148
- C:\Windows\System\xMacyhj.exe
  C:\Windows\System\xMacyhj.exe
  2⤵
  PID:3096
- C:\Windows\System\zHyIVLM.exe
  C:\Windows\System\zHyIVLM.exe
  2⤵
  PID:5128
- C:\Windows\System\OSFdogK.exe
  C:\Windows\System\OSFdogK.exe
  2⤵
  PID:5184
- C:\Windows\System\OCbgRpy.exe
  C:\Windows\System\OCbgRpy.exe
  2⤵
  PID:5224
- C:\Windows\System\IkbesgB.exe
  C:\Windows\System\IkbesgB.exe
  2⤵
  PID:5260
- C:\Windows\System\eIiERZn.exe
  C:\Windows\System\eIiERZn.exe
  2⤵
  PID:5352
- C:\Windows\System\omylUdA.exe
  C:\Windows\System\omylUdA.exe
  2⤵
  PID:5416
- C:\Windows\System\FUtAVLO.exe
  C:\Windows\System\FUtAVLO.exe
  2⤵
  PID:5484
- C:\Windows\System\VcZrnOa.exe
  C:\Windows\System\VcZrnOa.exe
  2⤵
  PID:5512
- C:\Windows\System\IBlsHcS.exe
  C:\Windows\System\IBlsHcS.exe
  2⤵
  PID:5548
- C:\Windows\System\WcGvZiP.exe
  C:\Windows\System\WcGvZiP.exe
  2⤵
  PID:5204
- C:\Windows\System\VXHrqwR.exe
  C:\Windows\System\VXHrqwR.exe
  2⤵
  PID:5368
- C:\Windows\System\fXkiriO.exe
  C:\Windows\System\fXkiriO.exe
  2⤵
  PID:5336
- C:\Windows\System\PpjQTsA.exe
  C:\Windows\System\PpjQTsA.exe
  2⤵
  PID:5372
- C:\Windows\System\yuYcljL.exe
  C:\Windows\System\yuYcljL.exe
  2⤵
  PID:5468
- C:\Windows\System\lRzVGig.exe
  C:\Windows\System\lRzVGig.exe
  2⤵
  PID:5404
- C:\Windows\System\xToBHDg.exe
  C:\Windows\System\xToBHDg.exe
  2⤵
  PID:5564
- C:\Windows\System\BoZCAQp.exe
  C:\Windows\System\BoZCAQp.exe
  2⤵
  PID:5596
- C:\Windows\System\fyKrsjg.exe
  C:\Windows\System\fyKrsjg.exe
  2⤵
  PID:5636
- C:\Windows\System\hfiggrU.exe
  C:\Windows\System\hfiggrU.exe
  2⤵
  PID:5684
- C:\Windows\System\qfkLcuQ.exe
  C:\Windows\System\qfkLcuQ.exe
  2⤵
  PID:5744
- C:\Windows\System\wllVXdq.exe
  C:\Windows\System\wllVXdq.exe
  2⤵
  PID:5780
- C:\Windows\System\SKHSHMK.exe
  C:\Windows\System\SKHSHMK.exe
  2⤵
  PID:5792
- C:\Windows\System\dgmunbO.exe
  C:\Windows\System\dgmunbO.exe
  2⤵
  PID:5824
- C:\Windows\System\phvUDUx.exe
  C:\Windows\System\phvUDUx.exe
  2⤵
  PID:5848
- C:\Windows\System\DnNzZtY.exe
  C:\Windows\System\DnNzZtY.exe
  2⤵
  PID:5912
- C:\Windows\System\kzgxVqZ.exe
  C:\Windows\System\kzgxVqZ.exe
  2⤵
  PID:5896
- C:\Windows\System\SgpxQUe.exe
  C:\Windows\System\SgpxQUe.exe
  2⤵
  PID:5936
- C:\Windows\System\QhlNZrG.exe
  C:\Windows\System\QhlNZrG.exe
  2⤵
  PID:5988
- C:\Windows\System\mBDJhan.exe
  C:\Windows\System\mBDJhan.exe
  2⤵
  PID:6024
- C:\Windows\System\EMiJLMV.exe
  C:\Windows\System\EMiJLMV.exe
  2⤵
  PID:6060
- C:\Windows\System\XeKxrUM.exe
  C:\Windows\System\XeKxrUM.exe
  2⤵
  PID:6100
- C:\Windows\System\wbjMQCQ.exe
  C:\Windows\System\wbjMQCQ.exe
  2⤵
  PID:4544
- C:\Windows\System\cSCMBdn.exe
  C:\Windows\System\cSCMBdn.exe
  2⤵
  PID:6076
- C:\Windows\System\xAcQseD.exe
  C:\Windows\System\xAcQseD.exe
  2⤵
  PID:6116
- C:\Windows\System\NveJvTi.exe
  C:\Windows\System\NveJvTi.exe
  2⤵
  PID:6044
- C:\Windows\System\wNQVVDu.exe
  C:\Windows\System\wNQVVDu.exe
  2⤵
  PID:5256
- C:\Windows\System\FzwooiM.exe
  C:\Windows\System\FzwooiM.exe
  2⤵
  PID:5288
- C:\Windows\System\dOsElKT.exe
  C:\Windows\System\dOsElKT.exe
  2⤵
  PID:5188
- C:\Windows\System\VovJsol.exe
  C:\Windows\System\VovJsol.exe
  2⤵
  PID:5244
- C:\Windows\System\ncUyUOX.exe
  C:\Windows\System\ncUyUOX.exe
  2⤵
  PID:5320
- C:\Windows\System\AcxfFjW.exe
  C:\Windows\System\AcxfFjW.exe
  2⤵
  PID:5652
- C:\Windows\System\mDCBvvA.exe
  C:\Windows\System\mDCBvvA.exe
  2⤵
  PID:5272
- C:\Windows\System\CvhClrM.exe
  C:\Windows\System\CvhClrM.exe
  2⤵
  PID:5560
- C:\Windows\System\EHMkWIp.exe
  C:\Windows\System\EHMkWIp.exe
  2⤵
  PID:5604
- C:\Windows\System\bgioYEz.exe
  C:\Windows\System\bgioYEz.exe
  2⤵
  PID:5764
- C:\Windows\System\udLXhau.exe
  C:\Windows\System\udLXhau.exe
  2⤵
  PID:5844
- C:\Windows\System\ZVJTXWW.exe
  C:\Windows\System\ZVJTXWW.exe
  2⤵
  PID:5864
- C:\Windows\System\paTCpfR.exe
  C:\Windows\System\paTCpfR.exe
  2⤵
  PID:5796
- C:\Windows\System\BWtQqnN.exe
  C:\Windows\System\BWtQqnN.exe
  2⤵
  PID:5976
- C:\Windows\System\CsfNjbx.exe
  C:\Windows\System\CsfNjbx.exe
  2⤵
  PID:5940
- C:\Windows\System\zRgOcIM.exe
  C:\Windows\System\zRgOcIM.exe
  2⤵
  PID:6132
- C:\Windows\System\KVEZgoq.exe
  C:\Windows\System\KVEZgoq.exe
  2⤵
  PID:6120
- C:\Windows\System\FQsbmYs.exe
  C:\Windows\System\FQsbmYs.exe
  2⤵
  PID:6012
- C:\Windows\System\cGPOQnz.exe
  C:\Windows\System\cGPOQnz.exe
  2⤵
  PID:5580
- C:\Windows\System\ljrshyZ.exe
  C:\Windows\System\ljrshyZ.exe
  2⤵
  PID:5500
- C:\Windows\System\qbHpnes.exe
  C:\Windows\System\qbHpnes.exe
  2⤵
  PID:5448
- C:\Windows\System\wweELMc.exe
  C:\Windows\System\wweELMc.exe
  2⤵
  PID:5532
- C:\Windows\System\WOBBBlw.exe
  C:\Windows\System\WOBBBlw.exe
  2⤵
  PID:5668
- C:\Windows\System\uqLvGzP.exe
  C:\Windows\System\uqLvGzP.exe
  2⤵
  PID:6032
- C:\Windows\System\doEdcmK.exe
  C:\Windows\System\doEdcmK.exe
  2⤵
  PID:5388
- C:\Windows\System\QKJBLqc.exe
  C:\Windows\System\QKJBLqc.exe
  2⤵
  PID:5712
- C:\Windows\System\YZZBFZS.exe
  C:\Windows\System\YZZBFZS.exe
  2⤵
  PID:5996
- C:\Windows\System\ShmeqmR.exe
  C:\Windows\System\ShmeqmR.exe
  2⤵
  PID:5152
- C:\Windows\System\KDNrkmR.exe
  C:\Windows\System\KDNrkmR.exe
  2⤵
  PID:5432
- C:\Windows\System\OhmpMLs.exe
  C:\Windows\System\OhmpMLs.exe
  2⤵
  PID:5952
- C:\Windows\System\jWcIdcw.exe
  C:\Windows\System\jWcIdcw.exe
  2⤵
  PID:5760
- C:\Windows\System\PhGUGTV.exe
  C:\Windows\System\PhGUGTV.exe
  2⤵
  PID:5812
- C:\Windows\System\KLgDdRF.exe
  C:\Windows\System\KLgDdRF.exe
  2⤵
  PID:6080
- C:\Windows\System\TlXPbqH.exe
  C:\Windows\System\TlXPbqH.exe
  2⤵
  PID:5276
- C:\Windows\System\ekUjsSJ.exe
  C:\Windows\System\ekUjsSJ.exe
  2⤵
  PID:6160
- C:\Windows\System\mXgRcxW.exe
  C:\Windows\System\mXgRcxW.exe
  2⤵
  PID:6176
- C:\Windows\System\mfGVYZQ.exe
  C:\Windows\System\mfGVYZQ.exe
  2⤵
  PID:6196
- C:\Windows\System\ziMiaFf.exe
  C:\Windows\System\ziMiaFf.exe
  2⤵
  PID:6212
- C:\Windows\System\JRnnOgI.exe
  C:\Windows\System\JRnnOgI.exe
  2⤵
  PID:6228
- C:\Windows\System\POpoyXo.exe
  C:\Windows\System\POpoyXo.exe
  2⤵
  PID:6248
- C:\Windows\System\rCPvZhK.exe
  C:\Windows\System\rCPvZhK.exe
  2⤵
  PID:6264
- C:\Windows\System\ZtzzFDs.exe
  C:\Windows\System\ZtzzFDs.exe
  2⤵
  PID:6280
- C:\Windows\System\FOOENZA.exe
  C:\Windows\System\FOOENZA.exe
  2⤵
  PID:6296
- C:\Windows\System\fBZrNHP.exe
  C:\Windows\System\fBZrNHP.exe
  2⤵
  PID:6316
- C:\Windows\System\WtNJDwr.exe
  C:\Windows\System\WtNJDwr.exe
  2⤵
  PID:6332
- C:\Windows\System\BdPWOMK.exe
  C:\Windows\System\BdPWOMK.exe
  2⤵
  PID:6348
- C:\Windows\System\rNQKVZs.exe
  C:\Windows\System\rNQKVZs.exe
  2⤵
  PID:6364
- C:\Windows\System\JpJYGUW.exe
  C:\Windows\System\JpJYGUW.exe
  2⤵
  PID:6380
- C:\Windows\System\FGdwiyP.exe
  C:\Windows\System\FGdwiyP.exe
  2⤵
  PID:6396
- C:\Windows\System\FkdAwgX.exe
  C:\Windows\System\FkdAwgX.exe
  2⤵
  PID:6412
- C:\Windows\System\LBaPICe.exe
  C:\Windows\System\LBaPICe.exe
  2⤵
  PID:6428
- C:\Windows\System\BLKvTpM.exe
  C:\Windows\System\BLKvTpM.exe
  2⤵
  PID:6444
- C:\Windows\System\CFvoXzC.exe
  C:\Windows\System\CFvoXzC.exe
  2⤵
  PID:6460
- C:\Windows\System\GuFkWlu.exe
  C:\Windows\System\GuFkWlu.exe
  2⤵
  PID:6476
- C:\Windows\System\zGITaOT.exe
  C:\Windows\System\zGITaOT.exe
  2⤵
  PID:6492
- C:\Windows\System\LxlzDbq.exe
  C:\Windows\System\LxlzDbq.exe
  2⤵
  PID:6508
- C:\Windows\System\jQFGRmC.exe
  C:\Windows\System\jQFGRmC.exe
  2⤵
  PID:6524
- C:\Windows\System\AmhySuQ.exe
  C:\Windows\System\AmhySuQ.exe
  2⤵
  PID:6676
- C:\Windows\System\AVbuKCx.exe
  C:\Windows\System\AVbuKCx.exe
  2⤵
  PID:6696
- C:\Windows\System\tmipsan.exe
  C:\Windows\System\tmipsan.exe
  2⤵
  PID:6712
- C:\Windows\System\TGEGlED.exe
  C:\Windows\System\TGEGlED.exe
  2⤵
  PID:6728
- C:\Windows\System\JkFjYWf.exe
  C:\Windows\System\JkFjYWf.exe
  2⤵
  PID:6748
- C:\Windows\System\IwYkntg.exe
  C:\Windows\System\IwYkntg.exe
  2⤵
  PID:6784
- C:\Windows\System\LdVutQK.exe
  C:\Windows\System\LdVutQK.exe
  2⤵
  PID:6800
- C:\Windows\System\sQWwZIy.exe
  C:\Windows\System\sQWwZIy.exe
  2⤵
  PID:6820
- C:\Windows\System\JBFreSl.exe
  C:\Windows\System\JBFreSl.exe
  2⤵
  PID:6836
- C:\Windows\System\rYOmtow.exe
  C:\Windows\System\rYOmtow.exe
  2⤵
  PID:6852
- C:\Windows\System\ptqFTht.exe
  C:\Windows\System\ptqFTht.exe
  2⤵
  PID:6868
- C:\Windows\System\JyidGob.exe
  C:\Windows\System\JyidGob.exe
  2⤵
  PID:6888
- C:\Windows\System\PjhZWve.exe
  C:\Windows\System\PjhZWve.exe
  2⤵
  PID:6904
- C:\Windows\System\xlDMVUC.exe
  C:\Windows\System\xlDMVUC.exe
  2⤵
  PID:6924
- C:\Windows\System\GmKywbQ.exe
  C:\Windows\System\GmKywbQ.exe
  2⤵
  PID:6940
- C:\Windows\System\zXflRJO.exe
  C:\Windows\System\zXflRJO.exe
  2⤵
  PID:6956
- C:\Windows\System\DYfxBXW.exe
  C:\Windows\System\DYfxBXW.exe
  2⤵
  PID:6972
- C:\Windows\System\VEOzyzS.exe
  C:\Windows\System\VEOzyzS.exe
  2⤵
  PID:6988
- C:\Windows\System\NotvQzb.exe
  C:\Windows\System\NotvQzb.exe
  2⤵
  PID:7004
- C:\Windows\System\hgipFsE.exe
  C:\Windows\System\hgipFsE.exe
  2⤵
  PID:7020
- C:\Windows\System\vDWEMIL.exe
  C:\Windows\System\vDWEMIL.exe
  2⤵
  PID:7036
- C:\Windows\System\YPQtzqY.exe
  C:\Windows\System\YPQtzqY.exe
  2⤵
  PID:7052
- C:\Windows\System\EstiHAd.exe
  C:\Windows\System\EstiHAd.exe
  2⤵
  PID:7072
- C:\Windows\System\XKuzFwU.exe
  C:\Windows\System\XKuzFwU.exe
  2⤵
  PID:7088
- C:\Windows\System\ZhoCQGO.exe
  C:\Windows\System\ZhoCQGO.exe
  2⤵
  PID:7108
- C:\Windows\System\XlFCMqP.exe
  C:\Windows\System\XlFCMqP.exe
  2⤵
  PID:7124
- C:\Windows\System\ITotSCo.exe
  C:\Windows\System\ITotSCo.exe
  2⤵
  PID:7140
- C:\Windows\System\FYkdFZK.exe
  C:\Windows\System\FYkdFZK.exe
  2⤵
  PID:7160
- C:\Windows\System\XpcaVLf.exe
  C:\Windows\System\XpcaVLf.exe
  2⤵
  PID:5496
- C:\Windows\System\dmlfBMj.exe
  C:\Windows\System\dmlfBMj.exe
  2⤵
  PID:6184
- C:\Windows\System\iQqQMcT.exe
  C:\Windows\System\iQqQMcT.exe
  2⤵
  PID:6172
- C:\Windows\System\PgEOoTT.exe
  C:\Windows\System\PgEOoTT.exe
  2⤵
  PID:6256
- C:\Windows\System\fCZkGan.exe
  C:\Windows\System\fCZkGan.exe
  2⤵
  PID:6292
- C:\Windows\System\ZkgDqbs.exe
  C:\Windows\System\ZkgDqbs.exe
  2⤵
  PID:6356
- C:\Windows\System\WFsDSUf.exe
  C:\Windows\System\WFsDSUf.exe
  2⤵
  PID:6424
- C:\Windows\System\QnRsAAY.exe
  C:\Windows\System\QnRsAAY.exe
  2⤵
  PID:6244
- C:\Windows\System\iHnzbGR.exe
  C:\Windows\System\iHnzbGR.exe
  2⤵
  PID:6304
- C:\Windows\System\gVeibwb.exe
  C:\Windows\System\gVeibwb.exe
  2⤵
  PID:6344
- C:\Windows\System\ZpGytjz.exe
  C:\Windows\System\ZpGytjz.exe
  2⤵
  PID:6376
- C:\Windows\System\vKYvcOM.exe
  C:\Windows\System\vKYvcOM.exe
  2⤵
  PID:6440
- C:\Windows\System\ihYzGIV.exe
  C:\Windows\System\ihYzGIV.exe
  2⤵
  PID:6504
- C:\Windows\System\yvJTPBu.exe
  C:\Windows\System\yvJTPBu.exe
  2⤵
  PID:6564
- C:\Windows\System\aNIdgzn.exe
  C:\Windows\System\aNIdgzn.exe
  2⤵
  PID:6628
- C:\Windows\System\wbRJYqv.exe
  C:\Windows\System\wbRJYqv.exe
  2⤵
  PID:6688
- C:\Windows\System\IrpRYBF.exe
  C:\Windows\System\IrpRYBF.exe
  2⤵
  PID:6692
- C:\Windows\System\jgkuQbL.exe
  C:\Windows\System\jgkuQbL.exe
  2⤵
  PID:6708
- C:\Windows\System\pYRLVVH.exe
  C:\Windows\System\pYRLVVH.exe
  2⤵
  PID:6740
- C:\Windows\System\xHTDpMB.exe
  C:\Windows\System\xHTDpMB.exe
  2⤵
  PID:6776
- C:\Windows\System\uEjeZid.exe
  C:\Windows\System\uEjeZid.exe
  2⤵
  PID:6808
- C:\Windows\System\VbKNQqO.exe
  C:\Windows\System\VbKNQqO.exe
  2⤵
  PID:6876
- C:\Windows\System\JzWgRYI.exe
  C:\Windows\System\JzWgRYI.exe
  2⤵
  PID:6920
- C:\Windows\System\MwQufyn.exe
  C:\Windows\System\MwQufyn.exe
  2⤵
  PID:7012
- C:\Windows\System\VrXFMWo.exe
  C:\Windows\System\VrXFMWo.exe
  2⤵
  PID:6860
- C:\Windows\System\tCTfHEa.exe
  C:\Windows\System\tCTfHEa.exe
  2⤵
  PID:6968
- C:\Windows\System\KnfljTk.exe
  C:\Windows\System\KnfljTk.exe
  2⤵
  PID:7000
- C:\Windows\System\wfFQBHE.exe
  C:\Windows\System\wfFQBHE.exe
  2⤵
  PID:7028
- C:\Windows\System\pqZqmdu.exe
  C:\Windows\System\pqZqmdu.exe
  2⤵
  PID:7116
- C:\Windows\System\lNjuorC.exe
  C:\Windows\System\lNjuorC.exe
  2⤵
  PID:7156
- C:\Windows\System\kUHgIYp.exe
  C:\Windows\System\kUHgIYp.exe
  2⤵
  PID:6224
- C:\Windows\System\alqBbFu.exe
  C:\Windows\System\alqBbFu.exe
  2⤵
  PID:6392
- C:\Windows\System\GhATqjT.exe
  C:\Windows\System\GhATqjT.exe
  2⤵
  PID:6468
- C:\Windows\System\ungBnbM.exe
  C:\Windows\System\ungBnbM.exe
  2⤵
  PID:5776
- C:\Windows\System\qbzGVRW.exe
  C:\Windows\System\qbzGVRW.exe
  2⤵
  PID:6208
- C:\Windows\System\wtxfONE.exe
  C:\Windows\System\wtxfONE.exe
  2⤵
  PID:6436
- C:\Windows\System\NWarsTW.exe
  C:\Windows\System\NWarsTW.exe
  2⤵
  PID:6500
- C:\Windows\System\mWDZFbh.exe
  C:\Windows\System\mWDZFbh.exe
  2⤵
  PID:6548
- C:\Windows\System\mthEzBV.exe
  C:\Windows\System\mthEzBV.exe
  2⤵
  PID:6560
- C:\Windows\System\sSXKGsJ.exe
  C:\Windows\System\sSXKGsJ.exe
  2⤵
  PID:6584
- C:\Windows\System\YvVguiw.exe
  C:\Windows\System\YvVguiw.exe
  2⤵
  PID:6604
- C:\Windows\System\nSNMQKq.exe
  C:\Windows\System\nSNMQKq.exe
  2⤵
  PID:6616
- C:\Windows\System\CnTIOcT.exe
  C:\Windows\System\CnTIOcT.exe
  2⤵
  PID:6640
- C:\Windows\System\CRFWyqH.exe
  C:\Windows\System\CRFWyqH.exe
  2⤵
  PID:6656
- C:\Windows\System\RTOyCWQ.exe
  C:\Windows\System\RTOyCWQ.exe
  2⤵
  PID:6704
- C:\Windows\System\hvhUoJt.exe
  C:\Windows\System\hvhUoJt.exe
  2⤵
  PID:6780
- C:\Windows\System\tIlREBP.exe
  C:\Windows\System\tIlREBP.exe
  2⤵
  PID:6772
- C:\Windows\System\XkPJMFU.exe
  C:\Windows\System\XkPJMFU.exe
  2⤵
  PID:6796
- C:\Windows\System\sardpKx.exe
  C:\Windows\System\sardpKx.exe
  2⤵
  PID:6952
- C:\Windows\System\iukXzhi.exe
  C:\Windows\System\iukXzhi.exe
  2⤵
  PID:6828
- C:\Windows\System\IxdUvCv.exe
  C:\Windows\System\IxdUvCv.exe
  2⤵
  PID:6936
- C:\Windows\System\BSmEtui.exe
  C:\Windows\System\BSmEtui.exe
  2⤵
  PID:7084
- C:\Windows\System\WCtiorH.exe
  C:\Windows\System\WCtiorH.exe
  2⤵
  PID:7080
- C:\Windows\System\mAPOPPq.exe
  C:\Windows\System\mAPOPPq.exe
  2⤵
  PID:6204
- C:\Windows\System\QCFiDdr.exe
  C:\Windows\System\QCFiDdr.exe
  2⤵
  PID:6312
- C:\Windows\System\lwQlVgA.exe
  C:\Windows\System\lwQlVgA.exe
  2⤵
  PID:6408
- C:\Windows\System\uxdNNHl.exe
  C:\Windows\System\uxdNNHl.exe
  2⤵
  PID:6152
- C:\Windows\System\MIwdvdJ.exe
  C:\Windows\System\MIwdvdJ.exe
  2⤵
  PID:6544
- C:\Windows\System\tNAkufp.exe
  C:\Windows\System\tNAkufp.exe
  2⤵
  PID:6816
- C:\Windows\System\QPpFOCs.exe
  C:\Windows\System\QPpFOCs.exe
  2⤵
  PID:6848
- C:\Windows\System\hrAsyZv.exe
  C:\Windows\System\hrAsyZv.exe
  2⤵
  PID:6556
- C:\Windows\System\QJdPINn.exe
  C:\Windows\System\QJdPINn.exe
  2⤵
  PID:6932
- C:\Windows\System\XKQKIzy.exe
  C:\Windows\System\XKQKIzy.exe
  2⤵
  PID:6724
- C:\Windows\System\VTYjubN.exe
  C:\Windows\System\VTYjubN.exe
  2⤵
  PID:6832
- C:\Windows\System\XDcqjdW.exe
  C:\Windows\System\XDcqjdW.exe
  2⤵
  PID:6288
- C:\Windows\System\zQwZQjt.exe
  C:\Windows\System\zQwZQjt.exe
  2⤵
  PID:7152
- C:\Windows\System\EjEORmH.exe
  C:\Windows\System\EjEORmH.exe
  2⤵
  PID:6612
- C:\Windows\System\srUvJcy.exe
  C:\Windows\System\srUvJcy.exe
  2⤵
  PID:6192
- C:\Windows\System\WRFTzLd.exe
  C:\Windows\System\WRFTzLd.exe
  2⤵
  PID:6980
- C:\Windows\System\zTUnfHq.exe
  C:\Windows\System\zTUnfHq.exe
  2⤵
  PID:6916
- C:\Windows\System\UnGEDLY.exe
  C:\Windows\System\UnGEDLY.exe
  2⤵
  PID:6388
- C:\Windows\System\HXnyoef.exe
  C:\Windows\System\HXnyoef.exe
  2⤵
  PID:7136
- C:\Windows\System\HevOpLy.exe
  C:\Windows\System\HevOpLy.exe
  2⤵
  PID:6420
- C:\Windows\System\IfRrCYd.exe
  C:\Windows\System\IfRrCYd.exe
  2⤵
  PID:6900
- C:\Windows\System\QCMZbTq.exe
  C:\Windows\System\QCMZbTq.exe
  2⤵
  PID:6240
- C:\Windows\System\XHQPHxY.exe
  C:\Windows\System\XHQPHxY.exe
  2⤵
  PID:6648
- C:\Windows\System\FjlOinB.exe
  C:\Windows\System\FjlOinB.exe
  2⤵
  PID:6404
- C:\Windows\System\TtHNyjc.exe
  C:\Windows\System\TtHNyjc.exe
  2⤵
  PID:6844
- C:\Windows\System\uNPptuu.exe
  C:\Windows\System\uNPptuu.exe
  2⤵
  PID:7176
- C:\Windows\System\XgDWvHm.exe
  C:\Windows\System\XgDWvHm.exe
  2⤵
  PID:7192
- C:\Windows\System\FFMGhHe.exe
  C:\Windows\System\FFMGhHe.exe
  2⤵
  PID:7208
- C:\Windows\System\AHEBLOk.exe
  C:\Windows\System\AHEBLOk.exe
  2⤵
  PID:7224
- C:\Windows\System\tQnYnqD.exe
  C:\Windows\System\tQnYnqD.exe
  2⤵
  PID:7240
- C:\Windows\System\HziiZEB.exe
  C:\Windows\System\HziiZEB.exe
  2⤵
  PID:7256
- C:\Windows\System\qWfZuCB.exe
  C:\Windows\System\qWfZuCB.exe
  2⤵
  PID:7272
- C:\Windows\System\elcdipo.exe
  C:\Windows\System\elcdipo.exe
  2⤵
  PID:7288
- C:\Windows\System\lcohjuL.exe
  C:\Windows\System\lcohjuL.exe
  2⤵
  PID:7304
- C:\Windows\System\sIARyvj.exe
  C:\Windows\System\sIARyvj.exe
  2⤵
  PID:7320
- C:\Windows\System\OlVZojW.exe
  C:\Windows\System\OlVZojW.exe
  2⤵
  PID:7336
- C:\Windows\System\jTZJbEC.exe
  C:\Windows\System\jTZJbEC.exe
  2⤵
  PID:7352
- C:\Windows\System\BWHkclz.exe
  C:\Windows\System\BWHkclz.exe
  2⤵
  PID:7368
- C:\Windows\System\WiuwxQf.exe
  C:\Windows\System\WiuwxQf.exe
  2⤵
  PID:7384
- C:\Windows\System\VmZPtus.exe
  C:\Windows\System\VmZPtus.exe
  2⤵
  PID:7400
- C:\Windows\System\kxymLvj.exe
  C:\Windows\System\kxymLvj.exe
  2⤵
  PID:7420
- C:\Windows\System\OsjpOXc.exe
  C:\Windows\System\OsjpOXc.exe
  2⤵
  PID:7436
- C:\Windows\System\aKTQmKD.exe
  C:\Windows\System\aKTQmKD.exe
  2⤵
  PID:7452
- C:\Windows\System\TlwDhod.exe
  C:\Windows\System\TlwDhod.exe
  2⤵
  PID:7476
- C:\Windows\System\wvbzKJa.exe
  C:\Windows\System\wvbzKJa.exe
  2⤵
  PID:7492
- C:\Windows\System\CSADtpz.exe
  C:\Windows\System\CSADtpz.exe
  2⤵
  PID:7508
- C:\Windows\System\dFpgnNQ.exe
  C:\Windows\System\dFpgnNQ.exe
  2⤵
  PID:7524
- C:\Windows\System\lUgzzAf.exe
  C:\Windows\System\lUgzzAf.exe
  2⤵
  PID:7544
- C:\Windows\System\QIEKXrt.exe
  C:\Windows\System\QIEKXrt.exe
  2⤵
  PID:7560
- C:\Windows\System\jnpDDII.exe
  C:\Windows\System\jnpDDII.exe
  2⤵
  PID:7576
- C:\Windows\System\lHRfhHU.exe
  C:\Windows\System\lHRfhHU.exe
  2⤵
  PID:7592
- C:\Windows\System\UiwaHtZ.exe
  C:\Windows\System\UiwaHtZ.exe
  2⤵
  PID:7608
- C:\Windows\System\EnSrpHb.exe
  C:\Windows\System\EnSrpHb.exe
  2⤵
  PID:7652
- C:\Windows\System\dmeMiHM.exe
  C:\Windows\System\dmeMiHM.exe
  2⤵
  PID:7748
- C:\Windows\System\kyDYoZz.exe
  C:\Windows\System\kyDYoZz.exe
  2⤵
  PID:7764
- C:\Windows\System\vuMRqTJ.exe
  C:\Windows\System\vuMRqTJ.exe
  2⤵
  PID:7780
- C:\Windows\System\UmHduQi.exe
  C:\Windows\System\UmHduQi.exe
  2⤵
  PID:7796
- C:\Windows\System\AhpVKzk.exe
  C:\Windows\System\AhpVKzk.exe
  2⤵
  PID:7812
- C:\Windows\System\rThsVId.exe
  C:\Windows\System\rThsVId.exe
  2⤵
  PID:7828
- C:\Windows\System\fmDHcQF.exe
  C:\Windows\System\fmDHcQF.exe
  2⤵
  PID:7848
- C:\Windows\System\LqlGrvg.exe
  C:\Windows\System\LqlGrvg.exe
  2⤵
  PID:7864
- C:\Windows\System\SdmEoMO.exe
  C:\Windows\System\SdmEoMO.exe
  2⤵
  PID:7884
- C:\Windows\System\nbCEGAL.exe
  C:\Windows\System\nbCEGAL.exe
  2⤵
  PID:7900
- C:\Windows\System\bLrCPEW.exe
  C:\Windows\System\bLrCPEW.exe
  2⤵
  PID:7916
- C:\Windows\System\gUqqKpm.exe
  C:\Windows\System\gUqqKpm.exe
  2⤵
  PID:7932
- C:\Windows\System\OqJRovx.exe
  C:\Windows\System\OqJRovx.exe
  2⤵
  PID:7948
- C:\Windows\System\LEoPrHs.exe
  C:\Windows\System\LEoPrHs.exe
  2⤵
  PID:7964
- C:\Windows\System\OrjYViH.exe
  C:\Windows\System\OrjYViH.exe
  2⤵
  PID:7980
- C:\Windows\System\rnhUtZc.exe
  C:\Windows\System\rnhUtZc.exe
  2⤵
  PID:7996
- C:\Windows\System\VqJEAom.exe
  C:\Windows\System\VqJEAom.exe
  2⤵
  PID:8016
- C:\Windows\System\XGIHVXC.exe
  C:\Windows\System\XGIHVXC.exe
  2⤵
  PID:8032
- C:\Windows\System\YhRlSYF.exe
  C:\Windows\System\YhRlSYF.exe
  2⤵
  PID:8048
- C:\Windows\System\NJjyTmA.exe
  C:\Windows\System\NJjyTmA.exe
  2⤵
  PID:8064
- C:\Windows\System\tTFaDMS.exe
  C:\Windows\System\tTFaDMS.exe
  2⤵
  PID:8084
- C:\Windows\System\tCSDHLo.exe
  C:\Windows\System\tCSDHLo.exe
  2⤵
  PID:7184
- C:\Windows\System\VlBPkBW.exe
  C:\Windows\System\VlBPkBW.exe
  2⤵
  PID:7204
- C:\Windows\System\lOBnbrQ.exe
  C:\Windows\System\lOBnbrQ.exe
  2⤵
  PID:7248
- C:\Windows\System\KGvihYM.exe
  C:\Windows\System\KGvihYM.exe
  2⤵
  PID:7284
- C:\Windows\System\xQprsqz.exe
  C:\Windows\System\xQprsqz.exe
  2⤵
  PID:7312
- C:\Windows\System\HehRcZQ.exe
  C:\Windows\System\HehRcZQ.exe
  2⤵
  PID:7348
- C:\Windows\System\WYXsGXY.exe
  C:\Windows\System\WYXsGXY.exe
  2⤵
  PID:7360
- C:\Windows\System\usctaqK.exe
  C:\Windows\System\usctaqK.exe
  2⤵
  PID:7392
- C:\Windows\System\LsQTwCC.exe
  C:\Windows\System\LsQTwCC.exe
  2⤵
  PID:7460
- C:\Windows\System\lmlzSzq.exe
  C:\Windows\System\lmlzSzq.exe
  2⤵
  PID:7484
- C:\Windows\System\LnwASBZ.exe
  C:\Windows\System\LnwASBZ.exe
  2⤵
  PID:7556
- C:\Windows\System\VXVeVpo.exe
  C:\Windows\System\VXVeVpo.exe
  2⤵
  PID:7540
- C:\Windows\System\OSpboUX.exe
  C:\Windows\System\OSpboUX.exe
  2⤵
  PID:7572
- C:\Windows\System\PUWYznj.exe
  C:\Windows\System\PUWYznj.exe
  2⤵
  PID:7604
- C:\Windows\System\pNsEjYB.exe
  C:\Windows\System\pNsEjYB.exe
  2⤵
  PID:7636
- C:\Windows\System\IsTIrOM.exe
  C:\Windows\System\IsTIrOM.exe
  2⤵
  PID:7660
- C:\Windows\System\HCiBtNV.exe
  C:\Windows\System\HCiBtNV.exe
  2⤵
  PID:7676
- C:\Windows\System\MjNtCIU.exe
  C:\Windows\System\MjNtCIU.exe
  2⤵
  PID:7692
- C:\Windows\System\UXubAzD.exe
  C:\Windows\System\UXubAzD.exe
  2⤵
  PID:7704
- C:\Windows\System\Ksnfcta.exe
  C:\Windows\System\Ksnfcta.exe
  2⤵
  PID:7720
- C:\Windows\System\ImRNXko.exe
  C:\Windows\System\ImRNXko.exe
  2⤵
  PID:7736
- C:\Windows\System\iyTLYbI.exe
  C:\Windows\System\iyTLYbI.exe
  2⤵
  PID:7788
- C:\Windows\System\EXgJbfy.exe
  C:\Windows\System\EXgJbfy.exe
  2⤵
  PID:7804
- C:\Windows\System\lguyOws.exe
  C:\Windows\System\lguyOws.exe
  2⤵
  PID:7956
- C:\Windows\System\EYDeUbL.exe
  C:\Windows\System\EYDeUbL.exe
  2⤵
  PID:8128
- C:\Windows\System\RgVqcDk.exe
  C:\Windows\System\RgVqcDk.exe
  2⤵
  PID:8152
- C:\Windows\System\chwajdc.exe
  C:\Windows\System\chwajdc.exe
  2⤵
  PID:8176
- C:\Windows\System\BqBQTKW.exe
  C:\Windows\System\BqBQTKW.exe
  2⤵
  PID:6532
- C:\Windows\System\PJGbKaA.exe
  C:\Windows\System\PJGbKaA.exe
  2⤵
  PID:7200
- C:\Windows\System\vYqxxnL.exe
  C:\Windows\System\vYqxxnL.exe
  2⤵
  PID:7264
- C:\Windows\System\gukUaxb.exe
  C:\Windows\System\gukUaxb.exe
  2⤵
  PID:7448
- C:\Windows\System\rLUdGLB.exe
  C:\Windows\System\rLUdGLB.exe
  2⤵
  PID:7468
- C:\Windows\System\rMiFoKU.exe
  C:\Windows\System\rMiFoKU.exe
  2⤵
  PID:7500
- C:\Windows\System\pGrFPkK.exe
  C:\Windows\System\pGrFPkK.exe
  2⤵
  PID:7624
- C:\Windows\System\JBkEarf.exe
  C:\Windows\System\JBkEarf.exe
  2⤵
  PID:7668
- C:\Windows\System\HFqOdfb.exe
  C:\Windows\System\HFqOdfb.exe
  2⤵
  PID:7688
- C:\Windows\System\QjmUKRm.exe
  C:\Windows\System\QjmUKRm.exe
  2⤵
  PID:7716
- C:\Windows\System\wAPAXqp.exe
  C:\Windows\System\wAPAXqp.exe
  2⤵
  PID:7756
- C:\Windows\System\gLkYEql.exe
  C:\Windows\System\gLkYEql.exe
  2⤵
  PID:7856
- C:\Windows\System\evFRkny.exe
  C:\Windows\System\evFRkny.exe
  2⤵
  PID:7772
- C:\Windows\System\MMciQcr.exe
  C:\Windows\System\MMciQcr.exe
  2⤵
  PID:7876
- C:\Windows\System\gadyoSK.exe
  C:\Windows\System\gadyoSK.exe
  2⤵
  PID:7896
- C:\Windows\System\FvOKkwi.exe
  C:\Windows\System\FvOKkwi.exe
  2⤵
  PID:7928
- C:\Windows\System\OyEOhck.exe
  C:\Windows\System\OyEOhck.exe
  2⤵
  PID:8004
- C:\Windows\System\lZqxMAl.exe
  C:\Windows\System\lZqxMAl.exe
  2⤵
  PID:7972
- C:\Windows\System\MhpvMlk.exe
  C:\Windows\System\MhpvMlk.exe
  2⤵
  PID:8072
- C:\Windows\System\NSPzXCH.exe
  C:\Windows\System\NSPzXCH.exe
  2⤵
  PID:8108
- C:\Windows\System\OaxExFy.exe
  C:\Windows\System\OaxExFy.exe
  2⤵
  PID:8132
- C:\Windows\System\vrWfkeu.exe
  C:\Windows\System\vrWfkeu.exe
  2⤵
  PID:8164
- C:\Windows\System\yXivSsI.exe
  C:\Windows\System\yXivSsI.exe
  2⤵
  PID:8188
- C:\Windows\System\fASMUVQ.exe
  C:\Windows\System\fASMUVQ.exe
  2⤵
  PID:7280
- C:\Windows\System\BFNxZAq.exe
  C:\Windows\System\BFNxZAq.exe
  2⤵
  PID:7328
- C:\Windows\System\HHVLonT.exe
  C:\Windows\System\HHVLonT.exe
  2⤵
  PID:7396
- C:\Windows\System\YGpWjxz.exe
  C:\Windows\System\YGpWjxz.exe
  2⤵
  PID:7520
- C:\Windows\System\TMDntym.exe
  C:\Windows\System\TMDntym.exe
  2⤵
  PID:7584
- C:\Windows\System\PJtzhiN.exe
  C:\Windows\System\PJtzhiN.exe
  2⤵
  PID:7824
- C:\Windows\System\KEquUYE.exe
  C:\Windows\System\KEquUYE.exe
  2⤵
  PID:7728
- C:\Windows\System\vSuUofJ.exe
  C:\Windows\System\vSuUofJ.exe
  2⤵
  PID:7840
- C:\Windows\System\tdebMeV.exe
  C:\Windows\System\tdebMeV.exe
  2⤵
  PID:7944
- C:\Windows\System\xkMhpob.exe
  C:\Windows\System\xkMhpob.exe
  2⤵
  PID:8076
- C:\Windows\System\Sfewoiu.exe
  C:\Windows\System\Sfewoiu.exe
  2⤵
  PID:8092
- C:\Windows\System\CxVyLoa.exe
  C:\Windows\System\CxVyLoa.exe
  2⤵
  PID:8140
- C:\Windows\System\Eyoelik.exe
  C:\Windows\System\Eyoelik.exe
  2⤵
  PID:8056
- C:\Windows\System\eHyOnCk.exe
  C:\Windows\System\eHyOnCk.exe
  2⤵
  PID:7628
- C:\Windows\System\LKeIaWk.exe
  C:\Windows\System\LKeIaWk.exe
  2⤵
  PID:876
- C:\Windows\System\XQhybUm.exe
  C:\Windows\System\XQhybUm.exe
  2⤵
  PID:7880
- C:\Windows\System\tVtQToy.exe
  C:\Windows\System\tVtQToy.exe
  2⤵
  PID:7216
- C:\Windows\System\mplMpMo.exe
  C:\Windows\System\mplMpMo.exe
  2⤵
  PID:7640
- C:\Windows\System\UTpjztm.exe
  C:\Windows\System\UTpjztm.exe
  2⤵
  PID:7908
- C:\Windows\System\guxnDva.exe
  C:\Windows\System\guxnDva.exe
  2⤵
  PID:7744
- C:\Windows\System\mtEvBkW.exe
  C:\Windows\System\mtEvBkW.exe
  2⤵
  PID:8124
- C:\Windows\System\rMaVVGD.exe
  C:\Windows\System\rMaVVGD.exe
  2⤵
  PID:7820
- C:\Windows\System\IiuUClx.exe
  C:\Windows\System\IiuUClx.exe
  2⤵
  PID:7408
- C:\Windows\System\ZCgqKeH.exe
  C:\Windows\System\ZCgqKeH.exe
  2⤵
  PID:8012
- C:\Windows\System\Biydzfa.exe
  C:\Windows\System\Biydzfa.exe
  2⤵
  PID:8116
- C:\Windows\System\CRbJdRj.exe
  C:\Windows\System\CRbJdRj.exe
  2⤵
  PID:8200
- C:\Windows\System\RVCOens.exe
  C:\Windows\System\RVCOens.exe
  2⤵
  PID:8216
- C:\Windows\System\gMcGlvf.exe
  C:\Windows\System\gMcGlvf.exe
  2⤵
  PID:8232
- C:\Windows\System\kJzpwLm.exe
  C:\Windows\System\kJzpwLm.exe
  2⤵
  PID:8248
- C:\Windows\System\SWvLWWf.exe
  C:\Windows\System\SWvLWWf.exe
  2⤵
  PID:8264
- C:\Windows\System\UnQOWnJ.exe
  C:\Windows\System\UnQOWnJ.exe
  2⤵
  PID:8280
- C:\Windows\System\YyRZSgC.exe
  C:\Windows\System\YyRZSgC.exe
  2⤵
  PID:8296
- C:\Windows\System\DTntxXM.exe
  C:\Windows\System\DTntxXM.exe
  2⤵
  PID:8312
- C:\Windows\System\MFBbUCG.exe
  C:\Windows\System\MFBbUCG.exe
  2⤵
  PID:8328
- C:\Windows\System\ErFESFp.exe
  C:\Windows\System\ErFESFp.exe
  2⤵
  PID:8344
- C:\Windows\System\QsXtTZc.exe
  C:\Windows\System\QsXtTZc.exe
  2⤵
  PID:8360
- C:\Windows\System\YnDwMPY.exe
  C:\Windows\System\YnDwMPY.exe
  2⤵
  PID:8376
- C:\Windows\System\YOUaNvf.exe
  C:\Windows\System\YOUaNvf.exe
  2⤵
  PID:8396
- C:\Windows\System\ChgQBCP.exe
  C:\Windows\System\ChgQBCP.exe
  2⤵
  PID:8436
- C:\Windows\System\VDcyDte.exe
  C:\Windows\System\VDcyDte.exe
  2⤵
  PID:8452
- C:\Windows\System\ETjWNeA.exe
  C:\Windows\System\ETjWNeA.exe
  2⤵
  PID:8476
- C:\Windows\System\BuBShhR.exe
  C:\Windows\System\BuBShhR.exe
  2⤵
  PID:8492
- C:\Windows\System\HWzSsJA.exe
  C:\Windows\System\HWzSsJA.exe
  2⤵
  PID:8508
- C:\Windows\System\pWmCvWZ.exe
  C:\Windows\System\pWmCvWZ.exe
  2⤵
  PID:8524
- C:\Windows\System\mnzTrvz.exe
  C:\Windows\System\mnzTrvz.exe
  2⤵
  PID:8544
- C:\Windows\System\YgVJbHc.exe
  C:\Windows\System\YgVJbHc.exe
  2⤵
  PID:8560
- C:\Windows\System\aaDTlkC.exe
  C:\Windows\System\aaDTlkC.exe
  2⤵
  PID:8576
- C:\Windows\System\gLYdkyc.exe
  C:\Windows\System\gLYdkyc.exe
  2⤵
  PID:8592
- C:\Windows\System\luYBDCq.exe
  C:\Windows\System\luYBDCq.exe
  2⤵
  PID:8608
- C:\Windows\System\VtjjAdQ.exe
  C:\Windows\System\VtjjAdQ.exe
  2⤵
  PID:8624
- C:\Windows\System\PEKUrCm.exe
  C:\Windows\System\PEKUrCm.exe
  2⤵
  PID:8640
- C:\Windows\System\nQBvAtO.exe
  C:\Windows\System\nQBvAtO.exe
  2⤵
  PID:8660
- C:\Windows\System\pCGHMbp.exe
  C:\Windows\System\pCGHMbp.exe
  2⤵
  PID:8676
- C:\Windows\System\VCJwWsJ.exe
  C:\Windows\System\VCJwWsJ.exe
  2⤵
  PID:8692
- C:\Windows\System\AWySCVG.exe
  C:\Windows\System\AWySCVG.exe
  2⤵
  PID:8708
- C:\Windows\System\qGcsvWf.exe
  C:\Windows\System\qGcsvWf.exe
  2⤵
  PID:8736
- C:\Windows\System\lRLdIrv.exe
  C:\Windows\System\lRLdIrv.exe
  2⤵
  PID:8820
- C:\Windows\System\MerGXQV.exe
  C:\Windows\System\MerGXQV.exe
  2⤵
  PID:8852
- C:\Windows\System\tSByksw.exe
  C:\Windows\System\tSByksw.exe
  2⤵
  PID:8872
- C:\Windows\System\hiaVewh.exe
  C:\Windows\System\hiaVewh.exe
  2⤵
  PID:8892
- C:\Windows\System\XjhDnfZ.exe
  C:\Windows\System\XjhDnfZ.exe
  2⤵
  PID:8908
- C:\Windows\System\oYRzVzj.exe
  C:\Windows\System\oYRzVzj.exe
  2⤵
  PID:8924
- C:\Windows\System\tDYRnzk.exe
  C:\Windows\System\tDYRnzk.exe
  2⤵
  PID:8940
- C:\Windows\System\SkSIYXg.exe
  C:\Windows\System\SkSIYXg.exe
  2⤵
  PID:8964
- C:\Windows\System\GRvKbIb.exe
  C:\Windows\System\GRvKbIb.exe
  2⤵
  PID:8988
- C:\Windows\System\ObicBTd.exe
  C:\Windows\System\ObicBTd.exe
  2⤵
  PID:9008
- C:\Windows\System\LWBuQiB.exe
  C:\Windows\System\LWBuQiB.exe
  2⤵
  PID:9064
- C:\Windows\System\pQEOZHm.exe
  C:\Windows\System\pQEOZHm.exe
  2⤵
  PID:9084
- C:\Windows\System\XOPmniy.exe
  C:\Windows\System\XOPmniy.exe
  2⤵
  PID:9112
- C:\Windows\System\baJpXJE.exe
  C:\Windows\System\baJpXJE.exe
  2⤵
  PID:9136
- C:\Windows\System\uJqrtcM.exe
  C:\Windows\System\uJqrtcM.exe
  2⤵
  PID:9156
- C:\Windows\System\lyzizWj.exe
  C:\Windows\System\lyzizWj.exe
  2⤵
  PID:9172
- C:\Windows\System\rKfZEXF.exe
  C:\Windows\System\rKfZEXF.exe
  2⤵
  PID:9200
- C:\Windows\System\SWJsZCY.exe
  C:\Windows\System\SWJsZCY.exe
  2⤵
  PID:8208
- C:\Windows\System\onxhNll.exe
  C:\Windows\System\onxhNll.exe
  2⤵
  PID:7488
- C:\Windows\System\wPavZId.exe
  C:\Windows\System\wPavZId.exe
  2⤵
  PID:8240
- C:\Windows\System\oYyJioJ.exe
  C:\Windows\System\oYyJioJ.exe
  2⤵
  PID:8256
- C:\Windows\System\mSiyYhB.exe
  C:\Windows\System\mSiyYhB.exe
  2⤵
  PID:8288
- C:\Windows\System\CCkvhjT.exe
  C:\Windows\System\CCkvhjT.exe
  2⤵
  PID:8352
- C:\Windows\System\HjnziFy.exe
  C:\Windows\System\HjnziFy.exe
  2⤵
  PID:8372
- C:\Windows\System\pgZYMtS.exe
  C:\Windows\System\pgZYMtS.exe
  2⤵
  PID:8392
- C:\Windows\System\WVdDcax.exe
  C:\Windows\System\WVdDcax.exe
  2⤵
  PID:8752
- C:\Windows\System\aqaKYwz.exe
  C:\Windows\System\aqaKYwz.exe
  2⤵
  PID:8768
- C:\Windows\System\sRVFvmG.exe
  C:\Windows\System\sRVFvmG.exe
  2⤵
  PID:8788
- C:\Windows\System\EOXAiZh.exe
  C:\Windows\System\EOXAiZh.exe
  2⤵
  PID:8808
- C:\Windows\System\rWQdeTC.exe
  C:\Windows\System\rWQdeTC.exe
  2⤵
  PID:8864
- C:\Windows\System\PUfErDM.exe
  C:\Windows\System\PUfErDM.exe
  2⤵
  PID:8868
- C:\Windows\System\BzGndHR.exe
  C:\Windows\System\BzGndHR.exe
  2⤵
  PID:8888
- C:\Windows\System\TASlCyy.exe
  C:\Windows\System\TASlCyy.exe
  2⤵
  PID:8936
- C:\Windows\System\lUcpdAO.exe
  C:\Windows\System\lUcpdAO.exe
  2⤵
  PID:8976
- C:\Windows\System\qWHlBzD.exe
  C:\Windows\System\qWHlBzD.exe
  2⤵
  PID:8972
- C:\Windows\System\YWtEQEy.exe
  C:\Windows\System\YWtEQEy.exe
  2⤵
  PID:9024
- C:\Windows\System\oKMwsdY.exe
  C:\Windows\System\oKMwsdY.exe
  2⤵
  PID:9060
- C:\Windows\System\nyTCnfN.exe
  C:\Windows\System\nyTCnfN.exe
  2⤵
  PID:9148
- C:\Windows\System\qqrUfPU.exe
  C:\Windows\System\qqrUfPU.exe
  2⤵
  PID:9196
- C:\Windows\System\FuajIKw.exe
  C:\Windows\System\FuajIKw.exe
  2⤵
  PID:8272
- C:\Windows\System\ypQTElE.exe
  C:\Windows\System\ypQTElE.exe
  2⤵
  PID:9080
- C:\Windows\System\rWpwbTd.exe
  C:\Windows\System\rWpwbTd.exe
  2⤵
  PID:9128
- C:\Windows\System\PHtbiiM.exe
  C:\Windows\System\PHtbiiM.exe
  2⤵
  PID:9004
- C:\Windows\System\ymLiLnm.exe
  C:\Windows\System\ymLiLnm.exe
  2⤵
  PID:9072
- C:\Windows\System\cibozaP.exe
  C:\Windows\System\cibozaP.exe
  2⤵
  PID:9212
- C:\Windows\System\OKbOaHc.exe
  C:\Windows\System\OKbOaHc.exe
  2⤵
  PID:8260
- C:\Windows\System\AyIYdLX.exe
  C:\Windows\System\AyIYdLX.exe
  2⤵
  PID:8388
- C:\Windows\System\FnYydKM.exe
  C:\Windows\System\FnYydKM.exe
  2⤵
  PID:8424
- C:\Windows\System\ffibvHb.exe
  C:\Windows\System\ffibvHb.exe
  2⤵
  PID:8472
- C:\Windows\System\HWLSTHI.exe
  C:\Windows\System\HWLSTHI.exe
  2⤵
  PID:7428
- C:\Windows\System\vFIJPRp.exe
  C:\Windows\System\vFIJPRp.exe
  2⤵
  PID:8632
- C:\Windows\System\SWXvFAh.exe
  C:\Windows\System\SWXvFAh.exe
  2⤵
  PID:8488
- C:\Windows\System\QxlswCc.exe
  C:\Windows\System\QxlswCc.exe
  2⤵
  PID:8604
- C:\Windows\System\TQittoZ.exe
  C:\Windows\System\TQittoZ.exe
  2⤵
  PID:8616
- C:\Windows\System\REOWKQX.exe
  C:\Windows\System\REOWKQX.exe
  2⤵
  PID:8684
- C:\Windows\System\ktDWBzW.exe
  C:\Windows\System\ktDWBzW.exe
  2⤵
  PID:8720
- C:\Windows\System\YuYWVRT.exe
  C:\Windows\System\YuYWVRT.exe
  2⤵
  PID:8748
- C:\Windows\System\VqSZrNV.exe
  C:\Windows\System\VqSZrNV.exe
  2⤵
  PID:8828
- C:\Windows\System\BsvbokF.exe
  C:\Windows\System\BsvbokF.exe
  2⤵
  PID:8812
- C:\Windows\System\oafrHkZ.exe
  C:\Windows\System\oafrHkZ.exe
  2⤵
  PID:8840
- C:\Windows\System\jKWRfHJ.exe
  C:\Windows\System\jKWRfHJ.exe
  2⤵
  PID:2160
- C:\Windows\System\fPeJFAX.exe
  C:\Windows\System\fPeJFAX.exe
  2⤵
  PID:9044
- C:\Windows\System\dtJBeHZ.exe
  C:\Windows\System\dtJBeHZ.exe
  2⤵
  PID:9144
- C:\Windows\System\NoBvuwU.exe
  C:\Windows\System\NoBvuwU.exe
  2⤵
  PID:9188
- C:\Windows\System\jONjJhK.exe
  C:\Windows\System\jONjJhK.exe
  2⤵
  PID:9132
- C:\Windows\System\oHlbkqO.exe
  C:\Windows\System\oHlbkqO.exe
  2⤵
  PID:7532
- C:\Windows\System\AOgzmNS.exe
  C:\Windows\System\AOgzmNS.exe
  2⤵
  PID:8504
- C:\Windows\System\kRIbyDR.exe
  C:\Windows\System\kRIbyDR.exe
  2⤵
  PID:8668
- C:\Windows\System\hstYDuT.exe
  C:\Windows\System\hstYDuT.exe
  2⤵
  PID:8600
- C:\Windows\System\kqdhiuG.exe
  C:\Windows\System\kqdhiuG.exe
  2⤵
  PID:9124
- C:\Windows\System\oEdgFid.exe
  C:\Windows\System\oEdgFid.exe
  2⤵
  PID:8784
- C:\Windows\System\AmpjYdo.exe
  C:\Windows\System\AmpjYdo.exe
  2⤵
  PID:8704
- C:\Windows\System\QURnKIf.exe
  C:\Windows\System\QURnKIf.exe
  2⤵
  PID:8484
- C:\Windows\System\vohUARZ.exe
  C:\Windows\System\vohUARZ.exe
  2⤵
  PID:8308
- C:\Windows\System\mjcIkKJ.exe
  C:\Windows\System\mjcIkKJ.exe
  2⤵
  PID:8884
- C:\Windows\System\YxedUFY.exe
  C:\Windows\System\YxedUFY.exe
  2⤵
  PID:9020
- C:\Windows\System\kccLcwm.exe
  C:\Windows\System\kccLcwm.exe
  2⤵
  PID:8984
- C:\Windows\System\PStXHtg.exe
  C:\Windows\System\PStXHtg.exe
  2⤵
  PID:9016
- C:\Windows\System\ILJSlOc.exe
  C:\Windows\System\ILJSlOc.exe
  2⤵
  PID:9040
- C:\Windows\System\hOfqkoN.exe
  C:\Windows\System\hOfqkoN.exe
  2⤵
  PID:9168
- C:\Windows\System\kKkTZtG.exe
  C:\Windows\System\kKkTZtG.exe
  2⤵
  PID:8144
- C:\Windows\System\xZsIwnt.exe
  C:\Windows\System\xZsIwnt.exe
  2⤵
  PID:8956
- C:\Windows\System\ZiwyvgR.exe
  C:\Windows\System\ZiwyvgR.exe
  2⤵
  PID:8516
- C:\Windows\System\oBScsCa.exe
  C:\Windows\System\oBScsCa.exe
  2⤵
  PID:8920
- C:\Windows\System\pazsONx.exe
  C:\Windows\System\pazsONx.exe
  2⤵
  PID:7940
- C:\Windows\System\JHPqvAv.exe
  C:\Windows\System\JHPqvAv.exe
  2⤵
  PID:8656
- C:\Windows\System\iIBIjTa.exe
  C:\Windows\System\iIBIjTa.exe
  2⤵
  PID:9096
- C:\Windows\System\ULnBEim.exe
  C:\Windows\System\ULnBEim.exe
  2⤵
  PID:9192
- C:\Windows\System\ARpZjzU.exe
  C:\Windows\System\ARpZjzU.exe
  2⤵
  PID:8408
- C:\Windows\System\IuKMtHe.exe
  C:\Windows\System\IuKMtHe.exe
  2⤵
  PID:8420
- C:\Windows\System\EeLSGsb.exe
  C:\Windows\System\EeLSGsb.exe
  2⤵
  PID:8728
- C:\Windows\System\XqiKMGM.exe
  C:\Windows\System\XqiKMGM.exe
  2⤵
  PID:1504
- C:\Windows\System\KEUGLIr.exe
  C:\Windows\System\KEUGLIr.exe
  2⤵
  PID:9036
- C:\Windows\System\bKedEUL.exe
  C:\Windows\System\bKedEUL.exe
  2⤵
  PID:8340
- C:\Windows\System\yfOJsbH.exe
  C:\Windows\System\yfOJsbH.exe
  2⤵
  PID:8848
- C:\Windows\System\DIHJDqa.exe
  C:\Windows\System\DIHJDqa.exe
  2⤵
  PID:9000
- C:\Windows\System\rYRhNJx.exe
  C:\Windows\System\rYRhNJx.exe
  2⤵
  PID:9232
- C:\Windows\System\FrTzYyR.exe
  C:\Windows\System\FrTzYyR.exe
  2⤵
  PID:9248
- C:\Windows\System\fRAbewU.exe
  C:\Windows\System\fRAbewU.exe
  2⤵
  PID:9276
- C:\Windows\System\rPzBAJC.exe
  C:\Windows\System\rPzBAJC.exe
  2⤵
  PID:9296
- C:\Windows\System\SErQfWx.exe
  C:\Windows\System\SErQfWx.exe
  2⤵
  PID:9324
- C:\Windows\System\LhzEltJ.exe
  C:\Windows\System\LhzEltJ.exe
  2⤵
  PID:9340
- C:\Windows\System\mtRcvGD.exe
  C:\Windows\System\mtRcvGD.exe
  2⤵
  PID:9368
- C:\Windows\System\rSevyHK.exe
  C:\Windows\System\rSevyHK.exe
  2⤵
  PID:9384
- C:\Windows\System\sONEEDZ.exe
  C:\Windows\System\sONEEDZ.exe
  2⤵
  PID:9404
- C:\Windows\System\zoncGRB.exe
  C:\Windows\System\zoncGRB.exe
  2⤵
  PID:9424
- C:\Windows\System\iOohrcN.exe
  C:\Windows\System\iOohrcN.exe
  2⤵
  PID:9440
- C:\Windows\System\XGwbEdH.exe
  C:\Windows\System\XGwbEdH.exe
  2⤵
  PID:9464
- C:\Windows\System\myadiEt.exe
  C:\Windows\System\myadiEt.exe
  2⤵
  PID:9488
- C:\Windows\System\rWdhcMD.exe
  C:\Windows\System\rWdhcMD.exe
  2⤵
  PID:9508
- C:\Windows\System\IEFlMrT.exe
  C:\Windows\System\IEFlMrT.exe
  2⤵
  PID:9524
- C:\Windows\System\vwTlaBy.exe
  C:\Windows\System\vwTlaBy.exe
  2⤵
  PID:9548
- C:\Windows\System\NmdLzGv.exe
  C:\Windows\System\NmdLzGv.exe
  2⤵
  PID:9568
- C:\Windows\System\SMEPkXf.exe
  C:\Windows\System\SMEPkXf.exe
  2⤵
  PID:9588
- C:\Windows\System\pTtnUNt.exe
  C:\Windows\System\pTtnUNt.exe
  2⤵
  PID:9604
- C:\Windows\System\qcIjNYv.exe
  C:\Windows\System\qcIjNYv.exe
  2⤵
  PID:9620
- C:\Windows\System\YUsGUEN.exe
  C:\Windows\System\YUsGUEN.exe
  2⤵
  PID:9652
- C:\Windows\System\KiPYbyt.exe
  C:\Windows\System\KiPYbyt.exe
  2⤵
  PID:9668
- C:\Windows\System\ycwcBMd.exe
  C:\Windows\System\ycwcBMd.exe
  2⤵
  PID:9684
- C:\Windows\System\lXoRhGk.exe
  C:\Windows\System\lXoRhGk.exe
  2⤵
  PID:9708
- C:\Windows\System\TMpewdW.exe
  C:\Windows\System\TMpewdW.exe
  2⤵
  PID:9728
- C:\Windows\System\pnvpUDl.exe
  C:\Windows\System\pnvpUDl.exe
  2⤵
  PID:9744
- C:\Windows\System\aGEOCiV.exe
  C:\Windows\System\aGEOCiV.exe
  2⤵
  PID:9764
- C:\Windows\System\ZPiquUe.exe
  C:\Windows\System\ZPiquUe.exe
  2⤵
  PID:9780
- C:\Windows\System\WekEGhK.exe
  C:\Windows\System\WekEGhK.exe
  2⤵
  PID:9796
- C:\Windows\System\nPeDlCH.exe
  C:\Windows\System\nPeDlCH.exe
  2⤵
  PID:9816
- C:\Windows\System\XQHsqxA.exe
  C:\Windows\System\XQHsqxA.exe
  2⤵
  PID:9840
- C:\Windows\System\axkkotu.exe
  C:\Windows\System\axkkotu.exe
  2⤵
  PID:9864
- C:\Windows\System\iJSdnln.exe
  C:\Windows\System\iJSdnln.exe
  2⤵
  PID:9880
- C:\Windows\System\wENdRUn.exe
  C:\Windows\System\wENdRUn.exe
  2⤵
  PID:9896
- C:\Windows\System\aBDDRaS.exe
  C:\Windows\System\aBDDRaS.exe
  2⤵
  PID:9916
- C:\Windows\System\jomwfeG.exe
  C:\Windows\System\jomwfeG.exe
  2⤵
  PID:9936
- C:\Windows\System\xODDBoo.exe
  C:\Windows\System\xODDBoo.exe
  2⤵
  PID:9956
- C:\Windows\System\rmJHQSz.exe
  C:\Windows\System\rmJHQSz.exe
  2⤵
  PID:9976
- C:\Windows\System\cWIJXMf.exe
  C:\Windows\System\cWIJXMf.exe
  2⤵
  PID:9992
- C:\Windows\System\CRivDRI.exe
  C:\Windows\System\CRivDRI.exe
  2⤵
  PID:10012
- C:\Windows\System\RamgGQe.exe
  C:\Windows\System\RamgGQe.exe
  2⤵
  PID:10036
- C:\Windows\System\ufHrOph.exe
  C:\Windows\System\ufHrOph.exe
  2⤵
  PID:10052
- C:\Windows\System\orEGKCb.exe
  C:\Windows\System\orEGKCb.exe
  2⤵
  PID:10072
- C:\Windows\System\qMNAkMz.exe
  C:\Windows\System\qMNAkMz.exe
  2⤵
  PID:10092
- C:\Windows\System\eKgeclL.exe
  C:\Windows\System\eKgeclL.exe
  2⤵
  PID:10108
- C:\Windows\System\dBiQPuK.exe
  C:\Windows\System\dBiQPuK.exe
  2⤵
  PID:10128
- C:\Windows\System\iFBefII.exe
  C:\Windows\System\iFBefII.exe
  2⤵
  PID:10176
- C:\Windows\System\RPFjJFT.exe
  C:\Windows\System\RPFjJFT.exe
  2⤵
  PID:10192
- C:\Windows\System\woNhUMq.exe
  C:\Windows\System\woNhUMq.exe
  2⤵
  PID:10208
- C:\Windows\System\EBqaKHW.exe
  C:\Windows\System\EBqaKHW.exe
  2⤵
  PID:10224
- C:\Windows\System\BsHeShs.exe
  C:\Windows\System\BsHeShs.exe
  2⤵
  PID:9164
- C:\Windows\System\wZrIAjN.exe
  C:\Windows\System\wZrIAjN.exe
  2⤵
  PID:9224
- C:\Windows\System\rZxOBJu.exe
  C:\Windows\System\rZxOBJu.exe
  2⤵
  PID:8760
- C:\Windows\System\nHhtOAv.exe
  C:\Windows\System\nHhtOAv.exe
  2⤵
  PID:9288
- C:\Windows\System\odjyQmO.exe
  C:\Windows\System\odjyQmO.exe
  2⤵
  PID:9312
- C:\Windows\System\JQiFCAO.exe
  C:\Windows\System\JQiFCAO.exe
  2⤵
  PID:9292
- C:\Windows\System\KQSVvNI.exe
  C:\Windows\System\KQSVvNI.exe
  2⤵
  PID:9376
- C:\Windows\System\TsOeCjb.exe
  C:\Windows\System\TsOeCjb.exe
  2⤵
  PID:9432
- C:\Windows\System\QSDNVFA.exe
  C:\Windows\System\QSDNVFA.exe
  2⤵
  PID:9476
- C:\Windows\System\JWjCKWw.exe
  C:\Windows\System\JWjCKWw.exe
  2⤵
  PID:9460
- C:\Windows\System\GvvuLCh.exe
  C:\Windows\System\GvvuLCh.exe
  2⤵
  PID:9500
- C:\Windows\System\RuZcaKO.exe
  C:\Windows\System\RuZcaKO.exe
  2⤵
  PID:9520
- C:\Windows\System\PbDjTFC.exe
  C:\Windows\System\PbDjTFC.exe
  2⤵
  PID:9540
- C:\Windows\System\yWBhsRH.exe
  C:\Windows\System\yWBhsRH.exe
  2⤵
  PID:9628
- C:\Windows\System\LTgBuRV.exe
  C:\Windows\System\LTgBuRV.exe
  2⤵
  PID:9640
- C:\Windows\System\qrYKaPA.exe
  C:\Windows\System\qrYKaPA.exe
  2⤵
  PID:9664
- C:\Windows\System\TPpNPCH.exe
  C:\Windows\System\TPpNPCH.exe
  2⤵
  PID:9692
- C:\Windows\System\BnpaSfp.exe
  C:\Windows\System\BnpaSfp.exe
  2⤵
  PID:9704
- C:\Windows\System\YGIGlJr.exe
  C:\Windows\System\YGIGlJr.exe
  2⤵
  PID:9740
- C:\Windows\System\WCfuDLH.exe
  C:\Windows\System\WCfuDLH.exe
  2⤵
  PID:9788
- C:\Windows\System\KhNqVfD.exe
  C:\Windows\System\KhNqVfD.exe
  2⤵
  PID:9860
- C:\Windows\System\uXEAHik.exe
  C:\Windows\System\uXEAHik.exe
  2⤵
  PID:9876
- C:\Windows\System\ghDxpNJ.exe
  C:\Windows\System\ghDxpNJ.exe
  2⤵
  PID:9944
- C:\Windows\System\MXAxUfJ.exe
  C:\Windows\System\MXAxUfJ.exe
  2⤵
  PID:10020
- C:\Windows\System\XfcTxTw.exe
  C:\Windows\System\XfcTxTw.exe
  2⤵
  PID:9888
- C:\Windows\System\TwtMKRJ.exe
  C:\Windows\System\TwtMKRJ.exe
  2⤵
  PID:10000
- C:\Windows\System\BjThQME.exe
  C:\Windows\System\BjThQME.exe
  2⤵
  PID:10064
- C:\Windows\System\HwPULdx.exe
  C:\Windows\System\HwPULdx.exe
  2⤵
  PID:10084
- C:\Windows\System\dzBUaZD.exe
  C:\Windows\System\dzBUaZD.exe
  2⤵
  PID:10148
- C:\Windows\System\DhcxuHJ.exe
  C:\Windows\System\DhcxuHJ.exe
  2⤵
  PID:10152
- C:\Windows\System\LfBaIFq.exe
  C:\Windows\System\LfBaIFq.exe
  2⤵
  PID:10164
- C:\Windows\System\HqSaHny.exe
  C:\Windows\System\HqSaHny.exe
  2⤵
  PID:10188
- C:\Windows\System\TQWdORm.exe
  C:\Windows\System\TQWdORm.exe
  2⤵
  PID:10220
- C:\Windows\System\dRZTSYf.exe
  C:\Windows\System\dRZTSYf.exe
  2⤵
  PID:9272
- C:\Windows\System\BvGHKVd.exe
  C:\Windows\System\BvGHKVd.exe
  2⤵
  PID:9240
- C:\Windows\System\kTwrgIu.exe
  C:\Windows\System\kTwrgIu.exe
  2⤵
  PID:9352
- C:\Windows\System\swHHXeu.exe
  C:\Windows\System\swHHXeu.exe
  2⤵
  PID:9392
- C:\Windows\System\gCQGggi.exe
  C:\Windows\System\gCQGggi.exe
  2⤵
  PID:9472
- C:\Windows\System\sNdBsSf.exe
  C:\Windows\System\sNdBsSf.exe
  2⤵
  PID:9484
- C:\Windows\System\zpiuAMC.exe
  C:\Windows\System\zpiuAMC.exe
  2⤵
  PID:9516
- C:\Windows\System\uzBNOxw.exe
  C:\Windows\System\uzBNOxw.exe
  2⤵
  PID:9544
- C:\Windows\System\EesgrAp.exe
  C:\Windows\System\EesgrAp.exe
  2⤵
  PID:9580
- C:\Windows\System\OjkZHGW.exe
  C:\Windows\System\OjkZHGW.exe
  2⤵
  PID:9660
- C:\Windows\System\DyeUjQV.exe
  C:\Windows\System\DyeUjQV.exe
  2⤵
  PID:9720
- C:\Windows\System\yoDSyFc.exe
  C:\Windows\System\yoDSyFc.exe
  2⤵
  PID:9756
- C:\Windows\System\XoZaZNb.exe
  C:\Windows\System\XoZaZNb.exe
  2⤵
  PID:9832
- C:\Windows\System\LDfemRC.exe
  C:\Windows\System\LDfemRC.exe
  2⤵
  PID:9872
- C:\Windows\System\luHKQrJ.exe
  C:\Windows\System\luHKQrJ.exe
  2⤵
  PID:9984
- C:\Windows\System\AjKjhkl.exe
  C:\Windows\System\AjKjhkl.exe
  2⤵
  PID:9964
- C:\Windows\System\xAwBJPO.exe
  C:\Windows\System\xAwBJPO.exe
  2⤵
  PID:10008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BjuIUiw.exe

Filesize
1.1MB

MD5
cbe6fb06ba30aedc093527d813ba4ebe

SHA1
b7b17acf459c44df2f5ac33be305a780a94b15f5

SHA256
c5419e861ac26c32edc9d6579fa427aba664d2a2521e9670e0bad67e6a28d2da

SHA512
a0f094dbfbbbab67541a3f829dac5955eb50f929e032b495be12775f75a6ea1647313e997b0a0beac8064c2d1c4da6b52ea650ccd1a663ff072d3db3878daf07

Download Submit
C:\Windows\system\CcdtYtQ.exe

Filesize
1.1MB

MD5
96d15c01c5e6f8915c88fa1a21e125f6

SHA1
e4e76afe05b008854a2430d1d13617653df3582c

SHA256
5053aa0ba8a208289558d424c7f79efdf61d9f863c3c63e1e2dd7a38e0dc690c

SHA512
f7b158118efde7dc2b30bd7444ed095182b5ac3076d2e7c64fcccefa785def5c90a4a1f95a8ad15f3a7f33363d1b2bc181185f4c9285908cbf2410e2b74fd9e0

Download Submit
C:\Windows\system\EvifNVG.exe

Filesize
1.1MB

MD5
05d48bdf23a61e69b1391ebd465d0050

SHA1
cb8575ba90bf6456f6e2127a77f19629da03dca2

SHA256
480506d3c8679f5f69d58445fb912b5ced2bfc5505f6a0f06a26b68ab0070cee

SHA512
c42ef20c67c7cc99512130a0de06a5a650fd0fea2239ab454db9e3d73813dd94541f81ef0497e8928c9d8487afada2fafc05a1aad44e4ced9117e6e8c7c54ac3

Download Submit
C:\Windows\system\FrpAxIM.exe

Filesize
1.1MB

MD5
da38cae5aa7df698485f572700bd9243

SHA1
86cae4ce4dd2f5a53822a90af451c1b821bd2bb7

SHA256
160c5625720a593f64b210766a8cbb4e1db268c4994b77845ddc8421ce56c0a9

SHA512
bca39b8ef8977965e8a69de931b578e3f1be352260b56bc542579e651d99df607cf3dc9a60859d6475adf30a149ef502099a1ad6a867c768a5e23c86877fa2c9

Download Submit
C:\Windows\system\HAUcjjG.exe

Filesize
1.1MB

MD5
301ebda66faefe03a453286d5689e32b

SHA1
a1a40c09c56813626598ec86fbb6a4f1e77f7fc9

SHA256
fb363d1c976e0ef973e0ec697fd0de4b8b288a09628cca558d4ad37a7cdbd242

SHA512
164dbea1641ca005af52cf19fa00d39b9b4ba6f2b1be5feba434b3af0eed81d09480f81cf2d4e14bb5a6f3f4392bc76da30c283701c3e96a2c11529c695fc3c5

Download Submit
C:\Windows\system\KRCEQdb.exe

Filesize
1.1MB

MD5
a36d7d24f865880b60a5a4665e3776c7

SHA1
93a169d2356bd1321e5ff046e0d073de63fa9347

SHA256
659db56395619d8481f821b684072c9b10cbb3c67855886dd48c36ef669c6197

SHA512
0aa0d598d8885b71dee345178afa39687efda00e15be344d80dd31f5c7f2d8477959152071b72cab71c5a8553eb7a0dea25ffd971c9a5600c9bd9cb496b5d3de

Download Submit
C:\Windows\system\MDOmICZ.exe

Filesize
1.1MB

MD5
b854b539acde821498305a2035ba9c0d

SHA1
f2d7bc712e8e54ecfe1e729c630910ae92e71fee

SHA256
b5feb45e82007769623c73e21c284404658d7ac879ce555f604cbbcdcce405ea

SHA512
29ddc568b51176f2ee95484de0cbb04ac560e7fcc08fdd53b217b6eccaf2f98ac9d9856453d6427fd869c36bee1635320b3e01d75538b4ea587f0932139421a4

Download Submit
C:\Windows\system\NlmsaaQ.exe

Filesize
1.1MB

MD5
0b5a022140d56cbf6ae9af466a4c47db

SHA1
d34a83cd596231421097747d0b0243ad05897430

SHA256
25f843db00e3de15a5f3dab54c4a13380b41aadb59ed162ed11f01ef1dc2dee3

SHA512
cb52650352ffc322277245fd96a1b865520c5cccd94f9320def3758e5f35f3ce744c0254f85a07881bcfb63742d5a3dc6d9896a05dcfcb79f5bf42c9871b98c1

Download Submit
C:\Windows\system\NxPWaiR.exe

Filesize
1.1MB

MD5
68c0d9abe578d5da7f638f7a7ea47b00

SHA1
ee6b66eabd9cb572fa3ac1e464737ddd4923ab11

SHA256
60443e0f1a0edf6d03ab3b2d1cb77f81278306e5b9bed30b33d4aee9fff05563

SHA512
40fb4271809896434374f58558f583971fe972066eb8e17f45e51e139475029d931d2b16df064a190580563d5b42e60c63fbec70d6e91ab6cb0daaf0d8fb7056

Download Submit
C:\Windows\system\OicIceD.exe

Filesize
1.1MB

MD5
aadde08a1e3f40f453c66580bae9edf5

SHA1
bac59aca7e2afb39597763d143c1c88588a95775

SHA256
4408ce96fc52753d00023a5b1b9538044cf56888ea6eb32307a2e607052abb61

SHA512
49ca798770fec1975787712286afa5fbc319ce35b5d1b1d6b25b4b8685e4e422e0e8016932536923a8e73577e512bd22afd341c5713fea3131dbb81953c3f11a

Download Submit
C:\Windows\system\SPQkAsi.exe

Filesize
1.1MB

MD5
eee436396de7d9642fb7bbe90452280f

SHA1
3dd25aa3a807685872259434da5c7adee9edbf26

SHA256
2aecd1b7a56f51e92507f22224ea02a4179d7590a8b7700fc37fd8d5b122ee0a

SHA512
ace6dd2655f291b544edc7dbf38ed1231bbe1c26fd68c0968842326759ae6aa612197b65e7157a67fc6ad6ec5772adaa7522aa6a63c0270735451c5e92d091f9

Download Submit
C:\Windows\system\bejXXuN.exe

Filesize
1.1MB

MD5
c52d873a6d8f5365089a80fcda6b5fb4

SHA1
06e83e8c00617636b52a130aad72dae9b72ce38e

SHA256
ab947105ac727cf08aa57d3091f0fd2d64071cccd378ae12a4753c0df40086ca

SHA512
86cce8ee772f751e5839262fd8334942de096d134b6e718d3a6fe2f5714f95abdc6c22be856c3c70063cee8fdf2343b855a1bab960fc4c111d1aa454041439ac

Download Submit
C:\Windows\system\elYAmut.exe

Filesize
1.1MB

MD5
9c676ab0f05083b83f8f4cac9f680109

SHA1
1d1563161840b0d98af55d4bf108fc1af6951d80

SHA256
8df6c66b7e7f016d497b8bd9b5331664fc08326e295f3d418995011007b69acc

SHA512
2f9bfb0ab04a5ee6ff5ebadc0eaa5bd1690475418fffc9fcbba770ae861c80c027b7bb4bbf1db0958c41d8d7a148aaa54611330c7394700cadc8f5a386df72bb

Download Submit
C:\Windows\system\fFIhLuE.exe

Filesize
1.1MB

MD5
f2be04a72463b2fde940e3fa082caf61

SHA1
3b0557b4a3a5ada2e8448fd24e249e66f1e6b434

SHA256
2339726222b61f94d8a1bc4bf5ef88412549c10cf690a3b430c5cbae8ce02f11

SHA512
c374306ec0254d25bc35304e99cadc52c10f041646e64040527d4d5630dbef706eb305b70548c6bab816a36f915d14a4956a1adfc3741b4e1261f16bf2df66a6

Download Submit
C:\Windows\system\fuoPTKi.exe

Filesize
1.1MB

MD5
a8c05339e57fe3ae06558888e93da85b

SHA1
531ea87d352d308b4afb10f77330a0f3582e9a6b

SHA256
6ec4fbb428b75d840b67b9592c36760970a2a44a3e7120659e9c7db970c3b40a

SHA512
818fe19743740acb04ce2b7bfb5c1c13e361273b7ea8625e93f79ae4a4906be566dd12bd8cb8503f3726fe345e35c1fc3ede125697d48ee2071643f6f8f747a3

Download Submit
C:\Windows\system\gsBdWCJ.exe

Filesize
1.1MB

MD5
87750248be3dc8a8f82a383967e1b1a5

SHA1
fe7f8b03f446d84916e8828e9e793ef57edcc679

SHA256
1e702546c0578dff47fda079b35444cc9d937c3ffa4946b33387a590984ecdda

SHA512
53f566a19695544b8c0e3d5b25115d705ae31a949b32171376d361f9bc4079e1ed5e04274c529d38cbebc533df3935b1896c33fe0c84cbabfffd2bcdf9526759

Download Submit
C:\Windows\system\jBKoJTV.exe

Filesize
1.1MB

MD5
e8568a60f16ab006aa9412fe4de12f47

SHA1
eac95174644ea2a937f65e46265db4fd1571bae6

SHA256
cce67fc275cc31e5386aab8ad414197ff83e2aabff63e32f2879bf6188e36df7

SHA512
7ada2c3dd8712f78740ffd47b5271a1f4f559ed3ea4902fb4d8ccb0c0677e9bbd7fd9264c5af348bb22715bfd2a3cfa068bc1bfb6eeec7bd6276da14f1331da6

Download Submit
C:\Windows\system\lfelpzJ.exe

Filesize
1.1MB

MD5
869db5530ba7454b21bdf257c8a2dd5a

SHA1
4f07fd88e34daa5b4fa6c709eef06720531169ac

SHA256
dfacd224dcd788c12f90cc266c4bba447cdabe03af7ac18295f494d126cd909c

SHA512
b853fa93a81efa230510402eba800fe88dd7d1ab136f5c3e0a7b62497d0622dd03f7887a4bf481c7fe65c48012cc15b3b8b8b26c5b709023176f64532bc9962a

Download Submit
C:\Windows\system\lhQnHKZ.exe

Filesize
1.1MB

MD5
14d100f77f4bd345708f11bc70e107ab

SHA1
ae2b765bdf687f7bd68a226dd44318a58ad35b0e

SHA256
9cab22a83406e0800f58a74fa66d706410709983abdcd2c154b791673069823f

SHA512
2634259b82bf477ee2935556aa95f0f7842f60b22b60cbfbd572a3e837a20af4d5b34c6d04408f4b9b82edaeebd6c1e08d945075141c91b9a1f6d8fdf136394d

Download Submit
C:\Windows\system\nyeQeeq.exe

Filesize
1.1MB

MD5
6a5bc2013e39c85f5d4269278f5fff6c

SHA1
f016fb8a31c1bedda5889013f76a00609a408c79

SHA256
ad236b536f788f17321c9ca47bca45e6bb730326b52a3b289633c9fd139f0dd2

SHA512
81b342ce003bfbde112578b916b33722424b28d67c7e82b495c4c3bdd8b64b8f108e8e5700fc06593f5c757872f34c66136b520f681d3fbeba5173dd5e440183

Download Submit
C:\Windows\system\oojCVGR.exe

Filesize
1.1MB

MD5
94be22136527713ed9b5768087ce8d8c

SHA1
f93042feec2d56a4c7dc371cbb0824a5a42701cd

SHA256
c61e045c870418d2508f1d58fbd0e0cff9b9bbd0aea2b17f4acf2d3158614549

SHA512
5fd04405f380bbd51b579113157be4a267338e3a99cace6b8c7085cfcd3547aac286fc8d45959b29ae9552f0f385d233ad683bf500ffbfea0aeff7fc72b0827c

Download Submit
C:\Windows\system\pyrXspa.exe

Filesize
1.1MB

MD5
11b9d3a70b6db67aab37287f43c85b7a

SHA1
750b77adde3c40bc9ac00a00d06f794067ed784c

SHA256
3e81bb5bf520ad3b5676f328cafdba87877f2256e89f43d4882a1c5a178e8d3c

SHA512
a6f478d1a3b7bb21273ea2dc233d2f126c3f090c4614505d38da7bb680199dde5dea8179e1a4b8a8b8ae4e4721cfa4761609539d1edcea11a8dcead3978fe2cc

Download Submit
C:\Windows\system\swklpyI.exe

Filesize
1.1MB

MD5
2c909e0ba2720599454750d168123ea9

SHA1
e6236cba6d32c54e6c04b96e532482515aac866f

SHA256
13d1604a3e281b6edee5c2df25fdadc60e763057e5df52cf2c8b27c1e7b31b38

SHA512
f97d14d567b555233a1c557816807cb9dd399995fac28b0165405b8a66c55d55b3c416c1d715339649169530845f88a680cbbab0f7357a825853420f96f3c3e5

Download Submit
C:\Windows\system\vRDyvFn.exe

Filesize
1.1MB

MD5
552b408618ad038eff44c8b5fbaeedd5

SHA1
f57a37bb02d10c8420187362722a457a42606ad1

SHA256
1cc4271277654937dc3234fbd05ed449f4eb2373dc5b38a67515ac14b1c3f31d

SHA512
b24886dc4674184d3b7f03d92db5de0f23a612cfbe55987aabf12a8b3c2be63f798c5a8eff7ca5184c4635909d07122cc277a53450bc36b594f92d3d306b58d0

Download Submit
C:\Windows\system\vqwusFp.exe

Filesize
1.1MB

MD5
6ec8c26e0e9ab4fd2dc57da2addc2076

SHA1
d0e11133abe0f1312a0b381f3739a3a2c23706a4

SHA256
b7ebf42399c401307bc27201fb438993b8da24f0175fd4479c578a88538c6338

SHA512
8dc6fe0f21dd6290ce175750557466a9f80a6d29058252e34776c0a5edbae13c9df8159553ac52fff8eb8f2f50123b576de430c4811a6e40417ea357c2846b9f

Download Submit
C:\Windows\system\xrsfIyI.exe

Filesize
1.1MB

MD5
2fa8e3ac8683509b99a785d25c1f0274

SHA1
4cf3c98938a03ae8f94ac306e89cdd90c799cd9a

SHA256
021d3ccdb38abec49cccd9941269a5e822c65f75122088c09daa31f211936537

SHA512
694d7fb1814ac6e1f1dcd2076beeaa52c5df032d2e9a223c128d444475feaa5f9c976977ff0c9c3cf8bd47c218b49c147c92a9b637ba82a0571463fd4bfe662c

Download Submit
C:\Windows\system\yzObwgF.exe

Filesize
1.1MB

MD5
389096784c6b338eb6ebc6d62ee1542f

SHA1
1fe2d7b957972f72ce4f519a869aa913c232f8c8

SHA256
955f4a0d8fb3262e2042b2ea4929cdb1e4fc693cd8fb87fbef899fe04622d493

SHA512
a9f0cb488962e929c004fc1be1c5f9ff30ffb91c979134472b89848c4fd1ac78326311f3b0dde79ceab2fa5fbc6dcfaccfd6679cf489e2eecef0f2689114431d

Download Submit
\Windows\system\BQVJOYS.exe

Filesize
1.1MB

MD5
caf51fe735b090326f4ae0708bcb3ce6

SHA1
ef3f97f17669585f8d3c4f0aa97039e359107c8b

SHA256
50bf9bfc3202c77544e09a0065282a67e34b35a32d9c58f9aca69bc34e5284c0

SHA512
87b62402c64d3a42fda04fbd43b8ae08606e38c44f9df934eaa08f0da6d28577fd0c0f1e1f2d98e9396f8f4eab26d78ab526b09c844370afff3e653a4eddd56e

Download Submit
\Windows\system\IJEdzZD.exe

Filesize
1.1MB

MD5
165c7a2bc1ece0c13343ceb4da827bb2

SHA1
703b8550389c9ee1e17b9189704ecc24f84f6408

SHA256
f87d8ee279d50de9ba2a39cf72e43a1fed828f35507cb39fc32df8c163adc762

SHA512
58131d4a285d9d234a24e333f1a36eee95af9008d17106b920b6599bbdef746c405ba49493049742fc91bb7f99011200154f01ea2f82badbb2b5852b9d602785

Download Submit
\Windows\system\LwzjxkV.exe

Filesize
1.1MB

MD5
789685ad844691d27295f6a3cefc30e9

SHA1
c020e6215239d9ac12c404fc95ee0dde81fbfe3f

SHA256
d86bd9e829cb314826b5784a777d67304d4a96c5c618aa179889b69238e83d85

SHA512
00807ec20c1fd0e2544326457426e6ce2c508b0290e0da977e87644d06c763f2bb88723bff9bbae5d1848a19a40f5aedf4123de68cd3569e6277fd30f7fc4a49

Download Submit
\Windows\system\NgRuwIo.exe

Filesize
1.1MB

MD5
f34d96b949aeb2dae14712aa97fc1d43

SHA1
d3c28c781e78a3f6bb2657cc3b0868fab460758c

SHA256
8db57ab0400a0a66321b09844556c1042fc21fd5da837c88f83cdcc75addbe50

SHA512
92c32676d73b43123c5a45559f1f97bc6a50760c2194f1ff080c244378d0255cc4ce2cb53cda9df13f61049e9b5c1774a6dc9441ed01953ca255338d5e2e8531

Download Submit
\Windows\system\SzpjRBv.exe

Filesize
1.1MB

MD5
9828952a4703baadd3ae4464ae915cc7

SHA1
f4c2e40f2223474d93057f22fcfa901c641ca575

SHA256
2441a1cc33f32c7d85eb17372d952c73d271970e737156024e9572119d39dd0e

SHA512
f2d20d3f49c6679439e5b349919479bb8c457c14915870ba975eb7c702cff7327958c6e95b77f5fe1f384f649a3c7737c482ee34f9836bd1f1fc6b128174a9dc

Download Submit
\Windows\system\WAXEtah.exe

Filesize
1.1MB

MD5
890d5e551e1e4575ae7ecd15412063d4

SHA1
219cef782cc2946849196a0b12d47f24278008c5

SHA256
c72c6843799a480f83d6433c9cc18c3b2a499a47fffd577ded946b0bfa960214

SHA512
5d16eb48fb629bfd9d0a60af04e7798eee2b0e565bdf9754ae84bfc4aa95816a2a71c2a0fd78e21458015fb7c50e0cb02ccf5b6e319e507a9cfc97c21ad41da5

Download Submit
memory/3064-0-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download