xmrig | ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
Size

1.7MB
MD5

92f4d67b6c2b23e68885b4f94307cec0
SHA1

600234b18b49e9317db74e808507b02cdd7df986
SHA256

ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28
SHA512

e4786071fd8c545c1fad825651441162821cb8b0a120214a0ac1be07bd7b648a4223c8c7c82c417ee35442241d568f276871f7c2de7f84551bf73dfcc3a89942
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxecd2Kkq:GemTLkNdfE0pZyz

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000012102-4.dat	xmrig
behavioral1/files/0x0008000000015cfd-6.dat	xmrig
behavioral1/files/0x0008000000015d07-8.dat	xmrig
behavioral1/files/0x0008000000015d19-16.dat	xmrig
behavioral1/files/0x0007000000015d48-23.dat	xmrig
behavioral1/files/0x0007000000015d68-26.dat	xmrig
behavioral1/files/0x0007000000015d70-31.dat	xmrig
behavioral1/files/0x0008000000015da1-35.dat	xmrig
behavioral1/files/0x000d000000018662-46.dat	xmrig
behavioral1/files/0x000500000001867d-50.dat	xmrig
behavioral1/files/0x00050000000186c8-54.dat	xmrig
behavioral1/files/0x000500000001878d-58.dat	xmrig
behavioral1/files/0x00060000000190c6-62.dat	xmrig
behavioral1/files/0x00050000000191fd-74.dat	xmrig
behavioral1/files/0x0005000000019238-86.dat	xmrig
behavioral1/files/0x0005000000019263-98.dat	xmrig
behavioral1/files/0x00050000000193d4-146.dat	xmrig
behavioral1/files/0x00050000000193c1-145.dat	xmrig
behavioral1/files/0x0005000000019399-116.dat	xmrig
behavioral1/files/0x0005000000019280-108.dat	xmrig
behavioral1/files/0x00050000000193c8-139.dat	xmrig
behavioral1/files/0x00050000000193b7-122.dat	xmrig
behavioral1/files/0x000500000001938b-113.dat	xmrig
behavioral1/files/0x0005000000019278-102.dat	xmrig
behavioral1/files/0x000500000001925d-94.dat	xmrig
behavioral1/files/0x0005000000019240-90.dat	xmrig
behavioral1/files/0x0005000000019220-82.dat	xmrig
behavioral1/files/0x0005000000019217-78.dat	xmrig
behavioral1/files/0x00050000000191f3-70.dat	xmrig
behavioral1/files/0x00060000000190c9-66.dat	xmrig
behavioral1/files/0x0014000000018657-42.dat	xmrig
behavioral1/files/0x0008000000016c9b-38.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2808	OeFfgQl.exe
2668	vNSVcUZ.exe
2820	yPExRXJ.exe
2780	XiSJtgN.exe
2976	sbdkypO.exe
1632	hQkJXnQ.exe
2600	Rcojkqb.exe
2540	ugCLvDT.exe
2608	pSkSpcf.exe
1724	hlEUvNc.exe
2104	kijGxtw.exe
560	FmHxZnd.exe
2920	mirxUoj.exe
1700	kKFOnvu.exe
3008	FKCCqzG.exe
2584	dLWOweN.exe
2120	WmcWTFp.exe
1964	xJTNMXT.exe
2928	ZRPPpmw.exe
2888	WQnaumW.exe
528	SOjIrMd.exe
2924	QCVFhZJ.exe
2776	yHDWbwj.exe
2912	hbNuKTp.exe
2876	NrViktB.exe
2036	hDydrbK.exe
1608	ZQWCBDc.exe
2220	OSwnpPc.exe
2188	yMIIuNm.exe
1012	uEtwdjq.exe
2088	yxLkJov.exe
1188	bBhqBWm.exe
1932	MNLAFHT.exe
908	VOwcFEI.exe
1640	xusUunF.exe
1544	lNjDhbR.exe
1508	rcfQrpX.exe
2132	WeRiJDb.exe
900	ETWTREF.exe
1560	qRyavsd.exe
2348	IRXHjyC.exe
316	HNIqZQX.exe
1464	lAcJNAv.exe
1696	ahtnDbT.exe
2484	YMyHBix.exe
2528	oISbkSI.exe
1648	TskopHi.exe
2184	QLQrYwA.exe
1600	SoBrEBD.exe
292	jXCCiQy.exe
2372	ULwqehF.exe
2260	HNgYjWc.exe
1416	GUSOrGp.exe
688	SXmesWc.exe
1212	xSgragX.exe
2136	JyikgnA.exe
1792	yVwxxGp.exe
2452	QQtQGtF.exe
1580	etvyCbW.exe
2024	JVXJrLd.exe
876	SUeUfDm.exe
2072	OvaFIsw.exe
2756	KYhVQgF.exe
2788	rCtdZFH.exe

Loads dropped DLL 64 IoCs

pid	Process
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zvmWcvZ.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\uEtwdjq.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\QLQrYwA.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\zCFxlrR.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\RGbWcqM.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\dRGMzOl.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\xdundve.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\fEhrksT.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\MWyBHdp.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\FEntqyq.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\nIoaTpA.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\EypvXOA.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\fDpebmb.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\WeKvYDC.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\CZpPcjQ.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\yHDWbwj.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\mecyeJK.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\FMdXGjf.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\XqNwogs.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\isKSaqv.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\WwxzzMl.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\RTSjFRt.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\fvTqLNx.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\JnousHj.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\iiGFujg.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\cxzipLl.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\vaCMfCS.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\lkEcqnH.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\kJWpqOo.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\ZkzuHtc.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\CcZchao.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\ghVcGTY.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\VtCtPtx.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\IOPLoNY.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\bTmIkwr.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\icZGPSu.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\OYOsoVR.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\EUeuTxb.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\ntxmwME.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\LgNLwXr.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\lGrunMR.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\lWQqmvJ.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\XcSHrpi.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\VZKmsWK.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\sDhYeBn.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\JnuWeKC.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\vaDDvNv.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\LgCwPll.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\BTqihSD.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\dcLssNo.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\pSkSpcf.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\MnWFUhq.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\SpCldqG.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\srBvLmS.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\ForgKAv.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\Iiowvsb.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\TwLLWTz.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\fBtBzmk.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\sZVWIOU.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\LsOkmRz.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\ULwqehF.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\NnXGfBJ.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\kZAjoeg.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
File created	C:\Windows\System\GUtVqrA.exe	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2808	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	32
PID 2648 wrote to memory of 2808	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	32
PID 2648 wrote to memory of 2808	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	32
PID 2648 wrote to memory of 2668	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	33
PID 2648 wrote to memory of 2668	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	33
PID 2648 wrote to memory of 2668	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	33
PID 2648 wrote to memory of 2820	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	34
PID 2648 wrote to memory of 2820	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	34
PID 2648 wrote to memory of 2820	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	34
PID 2648 wrote to memory of 2780	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	35
PID 2648 wrote to memory of 2780	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	35
PID 2648 wrote to memory of 2780	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	35
PID 2648 wrote to memory of 2976	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	36
PID 2648 wrote to memory of 2976	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	36
PID 2648 wrote to memory of 2976	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	36
PID 2648 wrote to memory of 1632	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	37
PID 2648 wrote to memory of 1632	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	37
PID 2648 wrote to memory of 1632	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	37
PID 2648 wrote to memory of 2600	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	38
PID 2648 wrote to memory of 2600	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	38
PID 2648 wrote to memory of 2600	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	38
PID 2648 wrote to memory of 2540	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	39
PID 2648 wrote to memory of 2540	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	39
PID 2648 wrote to memory of 2540	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	39
PID 2648 wrote to memory of 2608	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	40
PID 2648 wrote to memory of 2608	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	40
PID 2648 wrote to memory of 2608	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	40
PID 2648 wrote to memory of 1724	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	41
PID 2648 wrote to memory of 1724	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	41
PID 2648 wrote to memory of 1724	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	41
PID 2648 wrote to memory of 2104	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	42
PID 2648 wrote to memory of 2104	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	42
PID 2648 wrote to memory of 2104	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	42
PID 2648 wrote to memory of 560	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	43
PID 2648 wrote to memory of 560	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	43
PID 2648 wrote to memory of 560	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	43
PID 2648 wrote to memory of 2920	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	44
PID 2648 wrote to memory of 2920	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	44
PID 2648 wrote to memory of 2920	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	44
PID 2648 wrote to memory of 1700	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	45
PID 2648 wrote to memory of 1700	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	45
PID 2648 wrote to memory of 1700	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	45
PID 2648 wrote to memory of 3008	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	46
PID 2648 wrote to memory of 3008	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	46
PID 2648 wrote to memory of 3008	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	46
PID 2648 wrote to memory of 2584	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	47
PID 2648 wrote to memory of 2584	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	47
PID 2648 wrote to memory of 2584	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	47
PID 2648 wrote to memory of 2120	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	48
PID 2648 wrote to memory of 2120	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	48
PID 2648 wrote to memory of 2120	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	48
PID 2648 wrote to memory of 1964	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	49
PID 2648 wrote to memory of 1964	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	49
PID 2648 wrote to memory of 1964	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	49
PID 2648 wrote to memory of 2928	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	50
PID 2648 wrote to memory of 2928	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	50
PID 2648 wrote to memory of 2928	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	50
PID 2648 wrote to memory of 2888	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	51
PID 2648 wrote to memory of 2888	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	51
PID 2648 wrote to memory of 2888	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	51
PID 2648 wrote to memory of 528	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	52
PID 2648 wrote to memory of 528	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	52
PID 2648 wrote to memory of 528	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	52
PID 2648 wrote to memory of 2924	2648	ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe	53

C:\Users\Admin\AppData\Local\Temp\ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe
"C:\Users\Admin\AppData\Local\Temp\ab1545532782d5b9bd65bf56f163d9c0b8d8c52b1a41f87f0db061c1369d2f28.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System\OeFfgQl.exe
  C:\Windows\System\OeFfgQl.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vNSVcUZ.exe
  C:\Windows\System\vNSVcUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\yPExRXJ.exe
  C:\Windows\System\yPExRXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\XiSJtgN.exe
  C:\Windows\System\XiSJtgN.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\sbdkypO.exe
  C:\Windows\System\sbdkypO.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\hQkJXnQ.exe
  C:\Windows\System\hQkJXnQ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\Rcojkqb.exe
  C:\Windows\System\Rcojkqb.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ugCLvDT.exe
  C:\Windows\System\ugCLvDT.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pSkSpcf.exe
  C:\Windows\System\pSkSpcf.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\hlEUvNc.exe
  C:\Windows\System\hlEUvNc.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\kijGxtw.exe
  C:\Windows\System\kijGxtw.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FmHxZnd.exe
  C:\Windows\System\FmHxZnd.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\mirxUoj.exe
  C:\Windows\System\mirxUoj.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\kKFOnvu.exe
  C:\Windows\System\kKFOnvu.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\FKCCqzG.exe
  C:\Windows\System\FKCCqzG.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\dLWOweN.exe
  C:\Windows\System\dLWOweN.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\WmcWTFp.exe
  C:\Windows\System\WmcWTFp.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\xJTNMXT.exe
  C:\Windows\System\xJTNMXT.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ZRPPpmw.exe
  C:\Windows\System\ZRPPpmw.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WQnaumW.exe
  C:\Windows\System\WQnaumW.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\SOjIrMd.exe
  C:\Windows\System\SOjIrMd.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\QCVFhZJ.exe
  C:\Windows\System\QCVFhZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\yHDWbwj.exe
  C:\Windows\System\yHDWbwj.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\hbNuKTp.exe
  C:\Windows\System\hbNuKTp.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\NrViktB.exe
  C:\Windows\System\NrViktB.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\yMIIuNm.exe
  C:\Windows\System\yMIIuNm.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\hDydrbK.exe
  C:\Windows\System\hDydrbK.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uEtwdjq.exe
  C:\Windows\System\uEtwdjq.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ZQWCBDc.exe
  C:\Windows\System\ZQWCBDc.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\yxLkJov.exe
  C:\Windows\System\yxLkJov.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\OSwnpPc.exe
  C:\Windows\System\OSwnpPc.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\bBhqBWm.exe
  C:\Windows\System\bBhqBWm.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\MNLAFHT.exe
  C:\Windows\System\MNLAFHT.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\VOwcFEI.exe
  C:\Windows\System\VOwcFEI.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\xusUunF.exe
  C:\Windows\System\xusUunF.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\lNjDhbR.exe
  C:\Windows\System\lNjDhbR.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\rcfQrpX.exe
  C:\Windows\System\rcfQrpX.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\WeRiJDb.exe
  C:\Windows\System\WeRiJDb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\ETWTREF.exe
  C:\Windows\System\ETWTREF.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\qRyavsd.exe
  C:\Windows\System\qRyavsd.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\IRXHjyC.exe
  C:\Windows\System\IRXHjyC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\HNIqZQX.exe
  C:\Windows\System\HNIqZQX.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\lAcJNAv.exe
  C:\Windows\System\lAcJNAv.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\ahtnDbT.exe
  C:\Windows\System\ahtnDbT.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YMyHBix.exe
  C:\Windows\System\YMyHBix.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\oISbkSI.exe
  C:\Windows\System\oISbkSI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\TskopHi.exe
  C:\Windows\System\TskopHi.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\QLQrYwA.exe
  C:\Windows\System\QLQrYwA.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\SoBrEBD.exe
  C:\Windows\System\SoBrEBD.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\jXCCiQy.exe
  C:\Windows\System\jXCCiQy.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\ULwqehF.exe
  C:\Windows\System\ULwqehF.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HNgYjWc.exe
  C:\Windows\System\HNgYjWc.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\GUSOrGp.exe
  C:\Windows\System\GUSOrGp.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\SXmesWc.exe
  C:\Windows\System\SXmesWc.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\xSgragX.exe
  C:\Windows\System\xSgragX.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\JyikgnA.exe
  C:\Windows\System\JyikgnA.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\yVwxxGp.exe
  C:\Windows\System\yVwxxGp.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\QQtQGtF.exe
  C:\Windows\System\QQtQGtF.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\etvyCbW.exe
  C:\Windows\System\etvyCbW.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\JVXJrLd.exe
  C:\Windows\System\JVXJrLd.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\SUeUfDm.exe
  C:\Windows\System\SUeUfDm.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\OvaFIsw.exe
  C:\Windows\System\OvaFIsw.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KYhVQgF.exe
  C:\Windows\System\KYhVQgF.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\rCtdZFH.exe
  C:\Windows\System\rCtdZFH.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\bdlevJT.exe
  C:\Windows\System\bdlevJT.exe
  2⤵
  PID:1528
- C:\Windows\System\gCMadlJ.exe
  C:\Windows\System\gCMadlJ.exe
  2⤵
  PID:2792
- C:\Windows\System\IqySxlT.exe
  C:\Windows\System\IqySxlT.exe
  2⤵
  PID:3024
- C:\Windows\System\zCICBYT.exe
  C:\Windows\System\zCICBYT.exe
  2⤵
  PID:2632
- C:\Windows\System\icZGPSu.exe
  C:\Windows\System\icZGPSu.exe
  2⤵
  PID:2592
- C:\Windows\System\HEcYchH.exe
  C:\Windows\System\HEcYchH.exe
  2⤵
  PID:2700
- C:\Windows\System\iqgABhX.exe
  C:\Windows\System\iqgABhX.exe
  2⤵
  PID:2664
- C:\Windows\System\ZrGKKOI.exe
  C:\Windows\System\ZrGKKOI.exe
  2⤵
  PID:2016
- C:\Windows\System\IfnatVg.exe
  C:\Windows\System\IfnatVg.exe
  2⤵
  PID:2904
- C:\Windows\System\DWaVwDY.exe
  C:\Windows\System\DWaVwDY.exe
  2⤵
  PID:2968
- C:\Windows\System\okuLZDv.exe
  C:\Windows\System\okuLZDv.exe
  2⤵
  PID:2228
- C:\Windows\System\OwuOQKt.exe
  C:\Windows\System\OwuOQKt.exe
  2⤵
  PID:700
- C:\Windows\System\dhTlqdx.exe
  C:\Windows\System\dhTlqdx.exe
  2⤵
  PID:2728
- C:\Windows\System\sjsCllo.exe
  C:\Windows\System\sjsCllo.exe
  2⤵
  PID:2872
- C:\Windows\System\jtIqKwv.exe
  C:\Windows\System\jtIqKwv.exe
  2⤵
  PID:1836
- C:\Windows\System\YklAmwW.exe
  C:\Windows\System\YklAmwW.exe
  2⤵
  PID:472
- C:\Windows\System\EypvXOA.exe
  C:\Windows\System\EypvXOA.exe
  2⤵
  PID:3036
- C:\Windows\System\DbwmOua.exe
  C:\Windows\System\DbwmOua.exe
  2⤵
  PID:2216
- C:\Windows\System\eXpzxBK.exe
  C:\Windows\System\eXpzxBK.exe
  2⤵
  PID:1112
- C:\Windows\System\tAhauQh.exe
  C:\Windows\System\tAhauQh.exe
  2⤵
  PID:1936
- C:\Windows\System\bPIRtjP.exe
  C:\Windows\System\bPIRtjP.exe
  2⤵
  PID:2416
- C:\Windows\System\KLOvcEK.exe
  C:\Windows\System\KLOvcEK.exe
  2⤵
  PID:2224
- C:\Windows\System\kQWmiwm.exe
  C:\Windows\System\kQWmiwm.exe
  2⤵
  PID:624
- C:\Windows\System\NnXGfBJ.exe
  C:\Windows\System\NnXGfBJ.exe
  2⤵
  PID:2504
- C:\Windows\System\KjjRarq.exe
  C:\Windows\System\KjjRarq.exe
  2⤵
  PID:1788
- C:\Windows\System\mDKqxme.exe
  C:\Windows\System\mDKqxme.exe
  2⤵
  PID:1192
- C:\Windows\System\wXwPydQ.exe
  C:\Windows\System\wXwPydQ.exe
  2⤵
  PID:1916
- C:\Windows\System\clLoysO.exe
  C:\Windows\System\clLoysO.exe
  2⤵
  PID:1224
- C:\Windows\System\VIFTkiQ.exe
  C:\Windows\System\VIFTkiQ.exe
  2⤵
  PID:912
- C:\Windows\System\HhNnFHN.exe
  C:\Windows\System\HhNnFHN.exe
  2⤵
  PID:1652
- C:\Windows\System\JnfgzYH.exe
  C:\Windows\System\JnfgzYH.exe
  2⤵
  PID:2472
- C:\Windows\System\vOlzEll.exe
  C:\Windows\System\vOlzEll.exe
  2⤵
  PID:1636
- C:\Windows\System\sxwtAGX.exe
  C:\Windows\System\sxwtAGX.exe
  2⤵
  PID:2268
- C:\Windows\System\qOtLrgs.exe
  C:\Windows\System\qOtLrgs.exe
  2⤵
  PID:796
- C:\Windows\System\XRUETkK.exe
  C:\Windows\System\XRUETkK.exe
  2⤵
  PID:1360
- C:\Windows\System\JzPyptj.exe
  C:\Windows\System\JzPyptj.exe
  2⤵
  PID:2468
- C:\Windows\System\zmvbnQG.exe
  C:\Windows\System\zmvbnQG.exe
  2⤵
  PID:2128
- C:\Windows\System\jbTEPUt.exe
  C:\Windows\System\jbTEPUt.exe
  2⤵
  PID:2116
- C:\Windows\System\CxekwwV.exe
  C:\Windows\System\CxekwwV.exe
  2⤵
  PID:264
- C:\Windows\System\FHRtXzr.exe
  C:\Windows\System\FHRtXzr.exe
  2⤵
  PID:1504
- C:\Windows\System\JqKzhgA.exe
  C:\Windows\System\JqKzhgA.exe
  2⤵
  PID:2552
- C:\Windows\System\cbjMpMF.exe
  C:\Windows\System\cbjMpMF.exe
  2⤵
  PID:2952
- C:\Windows\System\rvTTZUQ.exe
  C:\Windows\System\rvTTZUQ.exe
  2⤵
  PID:2676
- C:\Windows\System\gPEJAfA.exe
  C:\Windows\System\gPEJAfA.exe
  2⤵
  PID:2604
- C:\Windows\System\rPlXnKe.exe
  C:\Windows\System\rPlXnKe.exe
  2⤵
  PID:2176
- C:\Windows\System\ldkTsMn.exe
  C:\Windows\System\ldkTsMn.exe
  2⤵
  PID:1784
- C:\Windows\System\UFrulqa.exe
  C:\Windows\System\UFrulqa.exe
  2⤵
  PID:2984
- C:\Windows\System\exZxxfL.exe
  C:\Windows\System\exZxxfL.exe
  2⤵
  PID:2512
- C:\Windows\System\rTYrkFd.exe
  C:\Windows\System\rTYrkFd.exe
  2⤵
  PID:2160
- C:\Windows\System\RkCbSEd.exe
  C:\Windows\System\RkCbSEd.exe
  2⤵
  PID:2420
- C:\Windows\System\VUBCWAn.exe
  C:\Windows\System\VUBCWAn.exe
  2⤵
  PID:1704
- C:\Windows\System\AWMwyny.exe
  C:\Windows\System\AWMwyny.exe
  2⤵
  PID:1736
- C:\Windows\System\CaYVUzJ.exe
  C:\Windows\System\CaYVUzJ.exe
  2⤵
  PID:1324
- C:\Windows\System\jmejjog.exe
  C:\Windows\System\jmejjog.exe
  2⤵
  PID:328
- C:\Windows\System\okngrZL.exe
  C:\Windows\System\okngrZL.exe
  2⤵
  PID:1484
- C:\Windows\System\JsnceJI.exe
  C:\Windows\System\JsnceJI.exe
  2⤵
  PID:1044
- C:\Windows\System\FNWNyhz.exe
  C:\Windows\System\FNWNyhz.exe
  2⤵
  PID:2800
- C:\Windows\System\LokPIxU.exe
  C:\Windows\System\LokPIxU.exe
  2⤵
  PID:2384
- C:\Windows\System\TuWaQrG.exe
  C:\Windows\System\TuWaQrG.exe
  2⤵
  PID:1740
- C:\Windows\System\caiGutR.exe
  C:\Windows\System\caiGutR.exe
  2⤵
  PID:1532
- C:\Windows\System\fnfcsqu.exe
  C:\Windows\System\fnfcsqu.exe
  2⤵
  PID:2840
- C:\Windows\System\sfXpqEq.exe
  C:\Windows\System\sfXpqEq.exe
  2⤵
  PID:2816
- C:\Windows\System\IzmtNcv.exe
  C:\Windows\System\IzmtNcv.exe
  2⤵
  PID:2908
- C:\Windows\System\xwjAnHI.exe
  C:\Windows\System\xwjAnHI.exe
  2⤵
  PID:2916
- C:\Windows\System\WvIlWzt.exe
  C:\Windows\System\WvIlWzt.exe
  2⤵
  PID:2548
- C:\Windows\System\BNotBlR.exe
  C:\Windows\System\BNotBlR.exe
  2⤵
  PID:1896
- C:\Windows\System\mrcSvuE.exe
  C:\Windows\System\mrcSvuE.exe
  2⤵
  PID:2656
- C:\Windows\System\KKGHCeI.exe
  C:\Windows\System\KKGHCeI.exe
  2⤵
  PID:684
- C:\Windows\System\zLSXzDW.exe
  C:\Windows\System\zLSXzDW.exe
  2⤵
  PID:1924
- C:\Windows\System\rrfhbug.exe
  C:\Windows\System\rrfhbug.exe
  2⤵
  PID:2496
- C:\Windows\System\pMQBmhP.exe
  C:\Windows\System\pMQBmhP.exe
  2⤵
  PID:2620
- C:\Windows\System\IkcxjVl.exe
  C:\Windows\System\IkcxjVl.exe
  2⤵
  PID:1644
- C:\Windows\System\bwCDmEb.exe
  C:\Windows\System\bwCDmEb.exe
  2⤵
  PID:2564
- C:\Windows\System\WhaMDFV.exe
  C:\Windows\System\WhaMDFV.exe
  2⤵
  PID:768
- C:\Windows\System\SpmudGJ.exe
  C:\Windows\System\SpmudGJ.exe
  2⤵
  PID:2364
- C:\Windows\System\ZCKUzjH.exe
  C:\Windows\System\ZCKUzjH.exe
  2⤵
  PID:2300
- C:\Windows\System\ZPwxOlN.exe
  C:\Windows\System\ZPwxOlN.exe
  2⤵
  PID:1864
- C:\Windows\System\agCLEIr.exe
  C:\Windows\System\agCLEIr.exe
  2⤵
  PID:1844
- C:\Windows\System\zwxufmy.exe
  C:\Windows\System\zwxufmy.exe
  2⤵
  PID:1000
- C:\Windows\System\oLCcPmT.exe
  C:\Windows\System\oLCcPmT.exe
  2⤵
  PID:2152
- C:\Windows\System\MnWFUhq.exe
  C:\Windows\System\MnWFUhq.exe
  2⤵
  PID:2712
- C:\Windows\System\FWDGMZJ.exe
  C:\Windows\System\FWDGMZJ.exe
  2⤵
  PID:1572
- C:\Windows\System\TekayTE.exe
  C:\Windows\System\TekayTE.exe
  2⤵
  PID:2576
- C:\Windows\System\OovcdEq.exe
  C:\Windows\System\OovcdEq.exe
  2⤵
  PID:3080
- C:\Windows\System\FtyChqi.exe
  C:\Windows\System\FtyChqi.exe
  2⤵
  PID:3100
- C:\Windows\System\aIASAJd.exe
  C:\Windows\System\aIASAJd.exe
  2⤵
  PID:3116
- C:\Windows\System\NpFPBme.exe
  C:\Windows\System\NpFPBme.exe
  2⤵
  PID:3132
- C:\Windows\System\SBPiKnt.exe
  C:\Windows\System\SBPiKnt.exe
  2⤵
  PID:3148
- C:\Windows\System\KnJtdnU.exe
  C:\Windows\System\KnJtdnU.exe
  2⤵
  PID:3164
- C:\Windows\System\HrVfXUa.exe
  C:\Windows\System\HrVfXUa.exe
  2⤵
  PID:3180
- C:\Windows\System\cFPBUYH.exe
  C:\Windows\System\cFPBUYH.exe
  2⤵
  PID:3196
- C:\Windows\System\FueaoqX.exe
  C:\Windows\System\FueaoqX.exe
  2⤵
  PID:3212
- C:\Windows\System\qKlDaqg.exe
  C:\Windows\System\qKlDaqg.exe
  2⤵
  PID:3232
- C:\Windows\System\ndqTSDA.exe
  C:\Windows\System\ndqTSDA.exe
  2⤵
  PID:3248
- C:\Windows\System\GMTHAvJ.exe
  C:\Windows\System\GMTHAvJ.exe
  2⤵
  PID:3264
- C:\Windows\System\rsorxRj.exe
  C:\Windows\System\rsorxRj.exe
  2⤵
  PID:3280
- C:\Windows\System\jaJvcQF.exe
  C:\Windows\System\jaJvcQF.exe
  2⤵
  PID:3296
- C:\Windows\System\YQkWUZs.exe
  C:\Windows\System\YQkWUZs.exe
  2⤵
  PID:3312
- C:\Windows\System\eByUPCL.exe
  C:\Windows\System\eByUPCL.exe
  2⤵
  PID:3328
- C:\Windows\System\vJDCyWK.exe
  C:\Windows\System\vJDCyWK.exe
  2⤵
  PID:3344
- C:\Windows\System\DOdJffs.exe
  C:\Windows\System\DOdJffs.exe
  2⤵
  PID:3360
- C:\Windows\System\CwQwGng.exe
  C:\Windows\System\CwQwGng.exe
  2⤵
  PID:3376
- C:\Windows\System\LIxzAtq.exe
  C:\Windows\System\LIxzAtq.exe
  2⤵
  PID:3392
- C:\Windows\System\RvuTimj.exe
  C:\Windows\System\RvuTimj.exe
  2⤵
  PID:3408
- C:\Windows\System\FkcMwkk.exe
  C:\Windows\System\FkcMwkk.exe
  2⤵
  PID:3424
- C:\Windows\System\hvIRPob.exe
  C:\Windows\System\hvIRPob.exe
  2⤵
  PID:3440
- C:\Windows\System\fpRAMBo.exe
  C:\Windows\System\fpRAMBo.exe
  2⤵
  PID:3456
- C:\Windows\System\BhPPqqe.exe
  C:\Windows\System\BhPPqqe.exe
  2⤵
  PID:3476
- C:\Windows\System\jnpqFHT.exe
  C:\Windows\System\jnpqFHT.exe
  2⤵
  PID:3492
- C:\Windows\System\sOuotsf.exe
  C:\Windows\System\sOuotsf.exe
  2⤵
  PID:3508
- C:\Windows\System\AuqaecI.exe
  C:\Windows\System\AuqaecI.exe
  2⤵
  PID:3524
- C:\Windows\System\sFnDdrB.exe
  C:\Windows\System\sFnDdrB.exe
  2⤵
  PID:3540
- C:\Windows\System\mJjrFnB.exe
  C:\Windows\System\mJjrFnB.exe
  2⤵
  PID:3556
- C:\Windows\System\MynGsjg.exe
  C:\Windows\System\MynGsjg.exe
  2⤵
  PID:3572
- C:\Windows\System\niDspLV.exe
  C:\Windows\System\niDspLV.exe
  2⤵
  PID:3588
- C:\Windows\System\NIgYCPF.exe
  C:\Windows\System\NIgYCPF.exe
  2⤵
  PID:3604
- C:\Windows\System\yVbgQQF.exe
  C:\Windows\System\yVbgQQF.exe
  2⤵
  PID:3620
- C:\Windows\System\bllFbIK.exe
  C:\Windows\System\bllFbIK.exe
  2⤵
  PID:3636
- C:\Windows\System\zZJhlYw.exe
  C:\Windows\System\zZJhlYw.exe
  2⤵
  PID:3652
- C:\Windows\System\GtyTHvo.exe
  C:\Windows\System\GtyTHvo.exe
  2⤵
  PID:3668
- C:\Windows\System\eGbRrjR.exe
  C:\Windows\System\eGbRrjR.exe
  2⤵
  PID:3684
- C:\Windows\System\mecyeJK.exe
  C:\Windows\System\mecyeJK.exe
  2⤵
  PID:3700
- C:\Windows\System\dJfFdAr.exe
  C:\Windows\System\dJfFdAr.exe
  2⤵
  PID:3716
- C:\Windows\System\WDPoWJL.exe
  C:\Windows\System\WDPoWJL.exe
  2⤵
  PID:3732
- C:\Windows\System\gsSsiKG.exe
  C:\Windows\System\gsSsiKG.exe
  2⤵
  PID:3748
- C:\Windows\System\dvcOlKe.exe
  C:\Windows\System\dvcOlKe.exe
  2⤵
  PID:3764
- C:\Windows\System\kKsjXCb.exe
  C:\Windows\System\kKsjXCb.exe
  2⤵
  PID:3784
- C:\Windows\System\YTOZHBw.exe
  C:\Windows\System\YTOZHBw.exe
  2⤵
  PID:3800
- C:\Windows\System\kuKuqwW.exe
  C:\Windows\System\kuKuqwW.exe
  2⤵
  PID:3816
- C:\Windows\System\LOGvbCU.exe
  C:\Windows\System\LOGvbCU.exe
  2⤵
  PID:3832
- C:\Windows\System\ZCRBQYI.exe
  C:\Windows\System\ZCRBQYI.exe
  2⤵
  PID:3848
- C:\Windows\System\vigSDCN.exe
  C:\Windows\System\vigSDCN.exe
  2⤵
  PID:3864
- C:\Windows\System\iIZrqYi.exe
  C:\Windows\System\iIZrqYi.exe
  2⤵
  PID:3880
- C:\Windows\System\euyweQi.exe
  C:\Windows\System\euyweQi.exe
  2⤵
  PID:3896
- C:\Windows\System\TzjgksS.exe
  C:\Windows\System\TzjgksS.exe
  2⤵
  PID:3912
- C:\Windows\System\wcbfogy.exe
  C:\Windows\System\wcbfogy.exe
  2⤵
  PID:3928
- C:\Windows\System\siUMHkP.exe
  C:\Windows\System\siUMHkP.exe
  2⤵
  PID:3944
- C:\Windows\System\lCcrxGk.exe
  C:\Windows\System\lCcrxGk.exe
  2⤵
  PID:3960
- C:\Windows\System\EIkJnJE.exe
  C:\Windows\System\EIkJnJE.exe
  2⤵
  PID:3976
- C:\Windows\System\PUwfHbe.exe
  C:\Windows\System\PUwfHbe.exe
  2⤵
  PID:3992
- C:\Windows\System\xvoAMyO.exe
  C:\Windows\System\xvoAMyO.exe
  2⤵
  PID:4008
- C:\Windows\System\reMtXRx.exe
  C:\Windows\System\reMtXRx.exe
  2⤵
  PID:4024
- C:\Windows\System\iHycovq.exe
  C:\Windows\System\iHycovq.exe
  2⤵
  PID:4040
- C:\Windows\System\FMdXGjf.exe
  C:\Windows\System\FMdXGjf.exe
  2⤵
  PID:4060
- C:\Windows\System\ejiMpPE.exe
  C:\Windows\System\ejiMpPE.exe
  2⤵
  PID:4076
- C:\Windows\System\IoTlUVj.exe
  C:\Windows\System\IoTlUVj.exe
  2⤵
  PID:4092
- C:\Windows\System\BIBwvia.exe
  C:\Windows\System\BIBwvia.exe
  2⤵
  PID:2396
- C:\Windows\System\GogLurI.exe
  C:\Windows\System\GogLurI.exe
  2⤵
  PID:1904
- C:\Windows\System\MiTuYdj.exe
  C:\Windows\System\MiTuYdj.exe
  2⤵
  PID:3108
- C:\Windows\System\KKVDksm.exe
  C:\Windows\System\KKVDksm.exe
  2⤵
  PID:3172
- C:\Windows\System\pnjtFSU.exe
  C:\Windows\System\pnjtFSU.exe
  2⤵
  PID:3204
- C:\Windows\System\jhJQIdI.exe
  C:\Windows\System\jhJQIdI.exe
  2⤵
  PID:3308
- C:\Windows\System\hwqWkln.exe
  C:\Windows\System\hwqWkln.exe
  2⤵
  PID:3304
- C:\Windows\System\UKffIWK.exe
  C:\Windows\System\UKffIWK.exe
  2⤵
  PID:2848
- C:\Windows\System\wqlNZTN.exe
  C:\Windows\System\wqlNZTN.exe
  2⤵
  PID:3188
- C:\Windows\System\wPXYSbG.exe
  C:\Windows\System\wPXYSbG.exe
  2⤵
  PID:3128
- C:\Windows\System\UnjDquv.exe
  C:\Windows\System\UnjDquv.exe
  2⤵
  PID:2532
- C:\Windows\System\KdSsQSI.exe
  C:\Windows\System\KdSsQSI.exe
  2⤵
  PID:3384
- C:\Windows\System\SNJHjRf.exe
  C:\Windows\System\SNJHjRf.exe
  2⤵
  PID:3288
- C:\Windows\System\gJUCNha.exe
  C:\Windows\System\gJUCNha.exe
  2⤵
  PID:2144
- C:\Windows\System\YfRrQoY.exe
  C:\Windows\System\YfRrQoY.exe
  2⤵
  PID:3404
- C:\Windows\System\yoFEYJv.exe
  C:\Windows\System\yoFEYJv.exe
  2⤵
  PID:3448
- C:\Windows\System\NHVTZYX.exe
  C:\Windows\System\NHVTZYX.exe
  2⤵
  PID:2980
- C:\Windows\System\rbGHYBq.exe
  C:\Windows\System\rbGHYBq.exe
  2⤵
  PID:3436
- C:\Windows\System\AxhXxaZ.exe
  C:\Windows\System\AxhXxaZ.exe
  2⤵
  PID:3552
- C:\Windows\System\ceVtNVR.exe
  C:\Windows\System\ceVtNVR.exe
  2⤵
  PID:3536
- C:\Windows\System\mqIOIlm.exe
  C:\Windows\System\mqIOIlm.exe
  2⤵
  PID:3772
- C:\Windows\System\lCwgUdE.exe
  C:\Windows\System\lCwgUdE.exe
  2⤵
  PID:2204
- C:\Windows\System\vxiDcZl.exe
  C:\Windows\System\vxiDcZl.exe
  2⤵
  PID:3844
- C:\Windows\System\aKuFgsZ.exe
  C:\Windows\System\aKuFgsZ.exe
  2⤵
  PID:3908
- C:\Windows\System\XFHdpCI.exe
  C:\Windows\System\XFHdpCI.exe
  2⤵
  PID:3596
- C:\Windows\System\sbebQui.exe
  C:\Windows\System\sbebQui.exe
  2⤵
  PID:4000
- C:\Windows\System\AKbhcjj.exe
  C:\Windows\System\AKbhcjj.exe
  2⤵
  PID:4036
- C:\Windows\System\uTkLLXx.exe
  C:\Windows\System\uTkLLXx.exe
  2⤵
  PID:3628
- C:\Windows\System\igZyUEb.exe
  C:\Windows\System\igZyUEb.exe
  2⤵
  PID:3692
- C:\Windows\System\TrOocDE.exe
  C:\Windows\System\TrOocDE.exe
  2⤵
  PID:3756
- C:\Windows\System\IYxpXQT.exe
  C:\Windows\System\IYxpXQT.exe
  2⤵
  PID:3796
- C:\Windows\System\PPmBezK.exe
  C:\Windows\System\PPmBezK.exe
  2⤵
  PID:3860
- C:\Windows\System\enPCnKy.exe
  C:\Windows\System\enPCnKy.exe
  2⤵
  PID:3924
- C:\Windows\System\kKnyrgW.exe
  C:\Windows\System\kKnyrgW.exe
  2⤵
  PID:4072
- C:\Windows\System\jLolnxM.exe
  C:\Windows\System\jLolnxM.exe
  2⤵
  PID:4016
- C:\Windows\System\qRIQXSh.exe
  C:\Windows\System\qRIQXSh.exe
  2⤵
  PID:4084
- C:\Windows\System\MvDcvhf.exe
  C:\Windows\System\MvDcvhf.exe
  2⤵
  PID:3140
- C:\Windows\System\wwmpChH.exe
  C:\Windows\System\wwmpChH.exe
  2⤵
  PID:2880
- C:\Windows\System\qCsHZGK.exe
  C:\Windows\System\qCsHZGK.exe
  2⤵
  PID:2900
- C:\Windows\System\eBikFNf.exe
  C:\Windows\System\eBikFNf.exe
  2⤵
  PID:3356
- C:\Windows\System\bfZDBhy.exe
  C:\Windows\System\bfZDBhy.exe
  2⤵
  PID:3176
- C:\Windows\System\bBRXvbe.exe
  C:\Windows\System\bBRXvbe.exe
  2⤵
  PID:3416
- C:\Windows\System\OfPbUOR.exe
  C:\Windows\System\OfPbUOR.exe
  2⤵
  PID:2764
- C:\Windows\System\ZbBDlOT.exe
  C:\Windows\System\ZbBDlOT.exe
  2⤵
  PID:3276
- C:\Windows\System\TZMFCGd.exe
  C:\Windows\System\TZMFCGd.exe
  2⤵
  PID:3584
- C:\Windows\System\fRXWGCw.exe
  C:\Windows\System\fRXWGCw.exe
  2⤵
  PID:3488
- C:\Windows\System\IJAYOXI.exe
  C:\Windows\System\IJAYOXI.exe
  2⤵
  PID:3680
- C:\Windows\System\iaZFMXM.exe
  C:\Windows\System\iaZFMXM.exe
  2⤵
  PID:3904
- C:\Windows\System\toTsTjk.exe
  C:\Windows\System\toTsTjk.exe
  2⤵
  PID:2948
- C:\Windows\System\reViBcZ.exe
  C:\Windows\System\reViBcZ.exe
  2⤵
  PID:3936
- C:\Windows\System\RkxqTJh.exe
  C:\Windows\System\RkxqTJh.exe
  2⤵
  PID:2340
- C:\Windows\System\ziRPBBm.exe
  C:\Windows\System\ziRPBBm.exe
  2⤵
  PID:3664
- C:\Windows\System\wFmEbxy.exe
  C:\Windows\System\wFmEbxy.exe
  2⤵
  PID:3892
- C:\Windows\System\BRgUmbq.exe
  C:\Windows\System\BRgUmbq.exe
  2⤵
  PID:3920
- C:\Windows\System\zPqHJLJ.exe
  C:\Windows\System\zPqHJLJ.exe
  2⤵
  PID:2560
- C:\Windows\System\FyrEdUk.exe
  C:\Windows\System\FyrEdUk.exe
  2⤵
  PID:3368
- C:\Windows\System\apbPjEy.exe
  C:\Windows\System\apbPjEy.exe
  2⤵
  PID:2812
- C:\Windows\System\PDvTswb.exe
  C:\Windows\System\PDvTswb.exe
  2⤵
  PID:3472
- C:\Windows\System\yhFdBja.exe
  C:\Windows\System\yhFdBja.exe
  2⤵
  PID:1144
- C:\Windows\System\uPpcDNP.exe
  C:\Windows\System\uPpcDNP.exe
  2⤵
  PID:3564
- C:\Windows\System\obfPimQ.exe
  C:\Windows\System\obfPimQ.exe
  2⤵
  PID:552
- C:\Windows\System\PLlCAJj.exe
  C:\Windows\System\PLlCAJj.exe
  2⤵
  PID:3728
- C:\Windows\System\IgedGKJ.exe
  C:\Windows\System\IgedGKJ.exe
  2⤵
  PID:3352
- C:\Windows\System\wsFTStN.exe
  C:\Windows\System\wsFTStN.exe
  2⤵
  PID:4052
- C:\Windows\System\ksnJeKj.exe
  C:\Windows\System\ksnJeKj.exe
  2⤵
  PID:3256
- C:\Windows\System\QUdcTjk.exe
  C:\Windows\System\QUdcTjk.exe
  2⤵
  PID:3400
- C:\Windows\System\vttNCsg.exe
  C:\Windows\System\vttNCsg.exe
  2⤵
  PID:3660
- C:\Windows\System\obRINVg.exe
  C:\Windows\System\obRINVg.exe
  2⤵
  PID:3988
- C:\Windows\System\vINRmZz.exe
  C:\Windows\System\vINRmZz.exe
  2⤵
  PID:1628
- C:\Windows\System\JnousHj.exe
  C:\Windows\System\JnousHj.exe
  2⤵
  PID:2264
- C:\Windows\System\SoXswxl.exe
  C:\Windows\System\SoXswxl.exe
  2⤵
  PID:2344
- C:\Windows\System\HjdPrsx.exe
  C:\Windows\System\HjdPrsx.exe
  2⤵
  PID:3856
- C:\Windows\System\cIsFIKT.exe
  C:\Windows\System\cIsFIKT.exe
  2⤵
  PID:3320
- C:\Windows\System\CMZotrm.exe
  C:\Windows\System\CMZotrm.exe
  2⤵
  PID:3160
- C:\Windows\System\SpCldqG.exe
  C:\Windows\System\SpCldqG.exe
  2⤵
  PID:3876
- C:\Windows\System\nlbjise.exe
  C:\Windows\System\nlbjise.exe
  2⤵
  PID:2852
- C:\Windows\System\sGEhKcI.exe
  C:\Windows\System\sGEhKcI.exe
  2⤵
  PID:3156
- C:\Windows\System\qrqdPRr.exe
  C:\Windows\System\qrqdPRr.exe
  2⤵
  PID:3240
- C:\Windows\System\YLRzBqN.exe
  C:\Windows\System\YLRzBqN.exe
  2⤵
  PID:4112
- C:\Windows\System\VbjZOuK.exe
  C:\Windows\System\VbjZOuK.exe
  2⤵
  PID:4128
- C:\Windows\System\pAalqPP.exe
  C:\Windows\System\pAalqPP.exe
  2⤵
  PID:4144
- C:\Windows\System\eFtGSCZ.exe
  C:\Windows\System\eFtGSCZ.exe
  2⤵
  PID:4160
- C:\Windows\System\dtKopBa.exe
  C:\Windows\System\dtKopBa.exe
  2⤵
  PID:4176
- C:\Windows\System\lvCClEc.exe
  C:\Windows\System\lvCClEc.exe
  2⤵
  PID:4192
- C:\Windows\System\kBPHZfT.exe
  C:\Windows\System\kBPHZfT.exe
  2⤵
  PID:4208
- C:\Windows\System\SWTZsQc.exe
  C:\Windows\System\SWTZsQc.exe
  2⤵
  PID:4224
- C:\Windows\System\EbwGYVw.exe
  C:\Windows\System\EbwGYVw.exe
  2⤵
  PID:4240
- C:\Windows\System\FCmYoIy.exe
  C:\Windows\System\FCmYoIy.exe
  2⤵
  PID:4256
- C:\Windows\System\snMAxvU.exe
  C:\Windows\System\snMAxvU.exe
  2⤵
  PID:4272
- C:\Windows\System\VWwErVg.exe
  C:\Windows\System\VWwErVg.exe
  2⤵
  PID:4288
- C:\Windows\System\hbLSvkv.exe
  C:\Windows\System\hbLSvkv.exe
  2⤵
  PID:4304
- C:\Windows\System\PZNfloQ.exe
  C:\Windows\System\PZNfloQ.exe
  2⤵
  PID:4320
- C:\Windows\System\TRvrmqE.exe
  C:\Windows\System\TRvrmqE.exe
  2⤵
  PID:4336
- C:\Windows\System\nvzwJnd.exe
  C:\Windows\System\nvzwJnd.exe
  2⤵
  PID:4352
- C:\Windows\System\RTzwhyW.exe
  C:\Windows\System\RTzwhyW.exe
  2⤵
  PID:4368
- C:\Windows\System\DqDfCHk.exe
  C:\Windows\System\DqDfCHk.exe
  2⤵
  PID:4384
- C:\Windows\System\tiMKUJn.exe
  C:\Windows\System\tiMKUJn.exe
  2⤵
  PID:4400
- C:\Windows\System\SFmtAAx.exe
  C:\Windows\System\SFmtAAx.exe
  2⤵
  PID:4416
- C:\Windows\System\obLhwuT.exe
  C:\Windows\System\obLhwuT.exe
  2⤵
  PID:4432
- C:\Windows\System\TVWoYaa.exe
  C:\Windows\System\TVWoYaa.exe
  2⤵
  PID:4448
- C:\Windows\System\TQogedn.exe
  C:\Windows\System\TQogedn.exe
  2⤵
  PID:4464
- C:\Windows\System\uNAmYvS.exe
  C:\Windows\System\uNAmYvS.exe
  2⤵
  PID:4480
- C:\Windows\System\xLxeHHM.exe
  C:\Windows\System\xLxeHHM.exe
  2⤵
  PID:4496
- C:\Windows\System\mnhBURY.exe
  C:\Windows\System\mnhBURY.exe
  2⤵
  PID:4512
- C:\Windows\System\qqNEgiS.exe
  C:\Windows\System\qqNEgiS.exe
  2⤵
  PID:4528
- C:\Windows\System\qSSfsLc.exe
  C:\Windows\System\qSSfsLc.exe
  2⤵
  PID:4544
- C:\Windows\System\INBlkOg.exe
  C:\Windows\System\INBlkOg.exe
  2⤵
  PID:4560
- C:\Windows\System\PUdCGUm.exe
  C:\Windows\System\PUdCGUm.exe
  2⤵
  PID:4576
- C:\Windows\System\ZQYJytg.exe
  C:\Windows\System\ZQYJytg.exe
  2⤵
  PID:4592
- C:\Windows\System\bkdqkkU.exe
  C:\Windows\System\bkdqkkU.exe
  2⤵
  PID:4608
- C:\Windows\System\QrGPMEX.exe
  C:\Windows\System\QrGPMEX.exe
  2⤵
  PID:4624
- C:\Windows\System\VDmNYIr.exe
  C:\Windows\System\VDmNYIr.exe
  2⤵
  PID:4640
- C:\Windows\System\ZnyRtdM.exe
  C:\Windows\System\ZnyRtdM.exe
  2⤵
  PID:4656
- C:\Windows\System\NSaXHUG.exe
  C:\Windows\System\NSaXHUG.exe
  2⤵
  PID:4672
- C:\Windows\System\VNIMLGw.exe
  C:\Windows\System\VNIMLGw.exe
  2⤵
  PID:4688
- C:\Windows\System\LCnDGgX.exe
  C:\Windows\System\LCnDGgX.exe
  2⤵
  PID:4704
- C:\Windows\System\vkQZKsk.exe
  C:\Windows\System\vkQZKsk.exe
  2⤵
  PID:4720
- C:\Windows\System\CVyIgGq.exe
  C:\Windows\System\CVyIgGq.exe
  2⤵
  PID:4736
- C:\Windows\System\uRMjEYp.exe
  C:\Windows\System\uRMjEYp.exe
  2⤵
  PID:4752
- C:\Windows\System\OzElFnX.exe
  C:\Windows\System\OzElFnX.exe
  2⤵
  PID:4768
- C:\Windows\System\lkEcqnH.exe
  C:\Windows\System\lkEcqnH.exe
  2⤵
  PID:4784
- C:\Windows\System\yJxBRwq.exe
  C:\Windows\System\yJxBRwq.exe
  2⤵
  PID:4800
- C:\Windows\System\ohneRUa.exe
  C:\Windows\System\ohneRUa.exe
  2⤵
  PID:4816
- C:\Windows\System\kEPUwfQ.exe
  C:\Windows\System\kEPUwfQ.exe
  2⤵
  PID:4832
- C:\Windows\System\YuTPcnQ.exe
  C:\Windows\System\YuTPcnQ.exe
  2⤵
  PID:4848
- C:\Windows\System\VgXrMXC.exe
  C:\Windows\System\VgXrMXC.exe
  2⤵
  PID:4864
- C:\Windows\System\bJiyZIn.exe
  C:\Windows\System\bJiyZIn.exe
  2⤵
  PID:4880
- C:\Windows\System\RGkhPxD.exe
  C:\Windows\System\RGkhPxD.exe
  2⤵
  PID:4896
- C:\Windows\System\MOYVsVT.exe
  C:\Windows\System\MOYVsVT.exe
  2⤵
  PID:4912
- C:\Windows\System\VYmpcWN.exe
  C:\Windows\System\VYmpcWN.exe
  2⤵
  PID:4928
- C:\Windows\System\DqQXXft.exe
  C:\Windows\System\DqQXXft.exe
  2⤵
  PID:4944
- C:\Windows\System\cxifmsM.exe
  C:\Windows\System\cxifmsM.exe
  2⤵
  PID:4960
- C:\Windows\System\IqWJDlF.exe
  C:\Windows\System\IqWJDlF.exe
  2⤵
  PID:4976
- C:\Windows\System\rLNLESi.exe
  C:\Windows\System\rLNLESi.exe
  2⤵
  PID:4992
- C:\Windows\System\iBXHtUI.exe
  C:\Windows\System\iBXHtUI.exe
  2⤵
  PID:5008
- C:\Windows\System\NyORNiQ.exe
  C:\Windows\System\NyORNiQ.exe
  2⤵
  PID:5024
- C:\Windows\System\mNQAaBo.exe
  C:\Windows\System\mNQAaBo.exe
  2⤵
  PID:5040
- C:\Windows\System\XqNwogs.exe
  C:\Windows\System\XqNwogs.exe
  2⤵
  PID:5056
- C:\Windows\System\girzaSZ.exe
  C:\Windows\System\girzaSZ.exe
  2⤵
  PID:5072
- C:\Windows\System\ayXKZDG.exe
  C:\Windows\System\ayXKZDG.exe
  2⤵
  PID:5088
- C:\Windows\System\NwuTJJK.exe
  C:\Windows\System\NwuTJJK.exe
  2⤵
  PID:5104
- C:\Windows\System\YoVWZJB.exe
  C:\Windows\System\YoVWZJB.exe
  2⤵
  PID:3088
- C:\Windows\System\LwQxCST.exe
  C:\Windows\System\LwQxCST.exe
  2⤵
  PID:3568
- C:\Windows\System\NrrBvnR.exe
  C:\Windows\System\NrrBvnR.exe
  2⤵
  PID:4140
- C:\Windows\System\qbgyNFD.exe
  C:\Windows\System\qbgyNFD.exe
  2⤵
  PID:4204
- C:\Windows\System\AfEZJZs.exe
  C:\Windows\System\AfEZJZs.exe
  2⤵
  PID:444
- C:\Windows\System\fEhrksT.exe
  C:\Windows\System\fEhrksT.exe
  2⤵
  PID:2236
- C:\Windows\System\kJWpqOo.exe
  C:\Windows\System\kJWpqOo.exe
  2⤵
  PID:4184
- C:\Windows\System\pDpUOTF.exe
  C:\Windows\System\pDpUOTF.exe
  2⤵
  PID:4220
- C:\Windows\System\kJZFqQX.exe
  C:\Windows\System\kJZFqQX.exe
  2⤵
  PID:4300
- C:\Windows\System\EFpPZnk.exe
  C:\Windows\System\EFpPZnk.exe
  2⤵
  PID:4364
- C:\Windows\System\AZAbvMP.exe
  C:\Windows\System\AZAbvMP.exe
  2⤵
  PID:4456
- C:\Windows\System\FzdPzMz.exe
  C:\Windows\System\FzdPzMz.exe
  2⤵
  PID:4492
- C:\Windows\System\isKSaqv.exe
  C:\Windows\System\isKSaqv.exe
  2⤵
  PID:4556
- C:\Windows\System\byxSYNC.exe
  C:\Windows\System\byxSYNC.exe
  2⤵
  PID:4280
- C:\Windows\System\OWCkAWF.exe
  C:\Windows\System\OWCkAWF.exe
  2⤵
  PID:4620
- C:\Windows\System\nKZeROX.exe
  C:\Windows\System\nKZeROX.exe
  2⤵
  PID:4652
- C:\Windows\System\kRyXhLn.exe
  C:\Windows\System\kRyXhLn.exe
  2⤵
  PID:4444
- C:\Windows\System\wykALLf.exe
  C:\Windows\System\wykALLf.exe
  2⤵
  PID:4348
- C:\Windows\System\YnVEIXe.exe
  C:\Windows\System\YnVEIXe.exe
  2⤵
  PID:4504
- C:\Windows\System\ZkzuHtc.exe
  C:\Windows\System\ZkzuHtc.exe
  2⤵
  PID:4568
- C:\Windows\System\yPZIWmt.exe
  C:\Windows\System\yPZIWmt.exe
  2⤵
  PID:4632
- C:\Windows\System\qFjFnrO.exe
  C:\Windows\System\qFjFnrO.exe
  2⤵
  PID:4684
- C:\Windows\System\PZMtSIR.exe
  C:\Windows\System\PZMtSIR.exe
  2⤵
  PID:4700
- C:\Windows\System\iSSNiKN.exe
  C:\Windows\System\iSSNiKN.exe
  2⤵
  PID:4796
- C:\Windows\System\kZAjoeg.exe
  C:\Windows\System\kZAjoeg.exe
  2⤵
  PID:4716
- C:\Windows\System\GUtVqrA.exe
  C:\Windows\System\GUtVqrA.exe
  2⤵
  PID:4812
- C:\Windows\System\ncOxBdV.exe
  C:\Windows\System\ncOxBdV.exe
  2⤵
  PID:4904
- C:\Windows\System\SQyVFXx.exe
  C:\Windows\System\SQyVFXx.exe
  2⤵
  PID:4968
- C:\Windows\System\okTUiZS.exe
  C:\Windows\System\okTUiZS.exe
  2⤵
  PID:4876
- C:\Windows\System\vsRTjyS.exe
  C:\Windows\System\vsRTjyS.exe
  2⤵
  PID:4828
- C:\Windows\System\QgNjzMi.exe
  C:\Windows\System\QgNjzMi.exe
  2⤵
  PID:4892
- C:\Windows\System\dAUyClZ.exe
  C:\Windows\System\dAUyClZ.exe
  2⤵
  PID:4956
- C:\Windows\System\wOZdNyr.exe
  C:\Windows\System\wOZdNyr.exe
  2⤵
  PID:5020
- C:\Windows\System\tWIgZPw.exe
  C:\Windows\System\tWIgZPw.exe
  2⤵
  PID:5068
- C:\Windows\System\pPFhall.exe
  C:\Windows\System\pPFhall.exe
  2⤵
  PID:3340
- C:\Windows\System\ixwmOPb.exe
  C:\Windows\System\ixwmOPb.exe
  2⤵
  PID:4236
- C:\Windows\System\qOeViOt.exe
  C:\Windows\System\qOeViOt.exe
  2⤵
  PID:4360
- C:\Windows\System\ZlXCdDT.exe
  C:\Windows\System\ZlXCdDT.exe
  2⤵
  PID:4248
- C:\Windows\System\VSZtzwq.exe
  C:\Windows\System\VSZtzwq.exe
  2⤵
  PID:4344
- C:\Windows\System\dfqgKtf.exe
  C:\Windows\System\dfqgKtf.exe
  2⤵
  PID:4680
- C:\Windows\System\QPurwVx.exe
  C:\Windows\System\QPurwVx.exe
  2⤵
  PID:4748
- C:\Windows\System\PrxQbvO.exe
  C:\Windows\System\PrxQbvO.exe
  2⤵
  PID:4152
- C:\Windows\System\nTTNaBq.exe
  C:\Windows\System\nTTNaBq.exe
  2⤵
  PID:4924
- C:\Windows\System\FBzxgqc.exe
  C:\Windows\System\FBzxgqc.exe
  2⤵
  PID:4200
- C:\Windows\System\UkWTPWq.exe
  C:\Windows\System\UkWTPWq.exe
  2⤵
  PID:4540
- C:\Windows\System\GnfmoRV.exe
  C:\Windows\System\GnfmoRV.exe
  2⤵
  PID:5084
- C:\Windows\System\tSneNHK.exe
  C:\Windows\System\tSneNHK.exe
  2⤵
  PID:4136
- C:\Windows\System\zuTcjWB.exe
  C:\Windows\System\zuTcjWB.exe
  2⤵
  PID:2028
- C:\Windows\System\MfHkTdK.exe
  C:\Windows\System\MfHkTdK.exe
  2⤵
  PID:4872
- C:\Windows\System\aeVNUju.exe
  C:\Windows\System\aeVNUju.exe
  2⤵
  PID:5064
- C:\Windows\System\OaxpLZB.exe
  C:\Windows\System\OaxpLZB.exe
  2⤵
  PID:5080
- C:\Windows\System\YnNtcEs.exe
  C:\Windows\System\YnNtcEs.exe
  2⤵
  PID:5136
- C:\Windows\System\xxKjeng.exe
  C:\Windows\System\xxKjeng.exe
  2⤵
  PID:5152
- C:\Windows\System\HNJkGWm.exe
  C:\Windows\System\HNJkGWm.exe
  2⤵
  PID:5168
- C:\Windows\System\ofmngOJ.exe
  C:\Windows\System\ofmngOJ.exe
  2⤵
  PID:5184
- C:\Windows\System\IYzDZwL.exe
  C:\Windows\System\IYzDZwL.exe
  2⤵
  PID:5200
- C:\Windows\System\uuwnFcZ.exe
  C:\Windows\System\uuwnFcZ.exe
  2⤵
  PID:5216
- C:\Windows\System\kyfAOFY.exe
  C:\Windows\System\kyfAOFY.exe
  2⤵
  PID:5232
- C:\Windows\System\VTTHdpP.exe
  C:\Windows\System\VTTHdpP.exe
  2⤵
  PID:5248
- C:\Windows\System\ggaaOct.exe
  C:\Windows\System\ggaaOct.exe
  2⤵
  PID:5264
- C:\Windows\System\CYKusPb.exe
  C:\Windows\System\CYKusPb.exe
  2⤵
  PID:5280
- C:\Windows\System\EASwuWj.exe
  C:\Windows\System\EASwuWj.exe
  2⤵
  PID:5296
- C:\Windows\System\hqWjQoX.exe
  C:\Windows\System\hqWjQoX.exe
  2⤵
  PID:5312
- C:\Windows\System\ddQGuVe.exe
  C:\Windows\System\ddQGuVe.exe
  2⤵
  PID:5328
- C:\Windows\System\LnKHIlq.exe
  C:\Windows\System\LnKHIlq.exe
  2⤵
  PID:5344
- C:\Windows\System\ctAEVUX.exe
  C:\Windows\System\ctAEVUX.exe
  2⤵
  PID:5360
- C:\Windows\System\FCspekH.exe
  C:\Windows\System\FCspekH.exe
  2⤵
  PID:5376
- C:\Windows\System\XvFmLzi.exe
  C:\Windows\System\XvFmLzi.exe
  2⤵
  PID:5392
- C:\Windows\System\gauaQHa.exe
  C:\Windows\System\gauaQHa.exe
  2⤵
  PID:5408
- C:\Windows\System\aAqqOjY.exe
  C:\Windows\System\aAqqOjY.exe
  2⤵
  PID:5424
- C:\Windows\System\OnaKLKO.exe
  C:\Windows\System\OnaKLKO.exe
  2⤵
  PID:5440
- C:\Windows\System\wyXjYht.exe
  C:\Windows\System\wyXjYht.exe
  2⤵
  PID:5456
- C:\Windows\System\WCgzIjH.exe
  C:\Windows\System\WCgzIjH.exe
  2⤵
  PID:5472
- C:\Windows\System\WOeUaYq.exe
  C:\Windows\System\WOeUaYq.exe
  2⤵
  PID:5488
- C:\Windows\System\rSDwAdr.exe
  C:\Windows\System\rSDwAdr.exe
  2⤵
  PID:5504
- C:\Windows\System\MalRMVe.exe
  C:\Windows\System\MalRMVe.exe
  2⤵
  PID:5520
- C:\Windows\System\pHPFPgU.exe
  C:\Windows\System\pHPFPgU.exe
  2⤵
  PID:5536
- C:\Windows\System\xHwagmG.exe
  C:\Windows\System\xHwagmG.exe
  2⤵
  PID:5552
- C:\Windows\System\QgKSfrM.exe
  C:\Windows\System\QgKSfrM.exe
  2⤵
  PID:5568
- C:\Windows\System\BoXSggL.exe
  C:\Windows\System\BoXSggL.exe
  2⤵
  PID:5584
- C:\Windows\System\deemzPY.exe
  C:\Windows\System\deemzPY.exe
  2⤵
  PID:5600
- C:\Windows\System\yFdpmxh.exe
  C:\Windows\System\yFdpmxh.exe
  2⤵
  PID:5616
- C:\Windows\System\evFoJzj.exe
  C:\Windows\System\evFoJzj.exe
  2⤵
  PID:5632
- C:\Windows\System\FDvZocA.exe
  C:\Windows\System\FDvZocA.exe
  2⤵
  PID:5648
- C:\Windows\System\JBrddtz.exe
  C:\Windows\System\JBrddtz.exe
  2⤵
  PID:5664
- C:\Windows\System\JNhsWRt.exe
  C:\Windows\System\JNhsWRt.exe
  2⤵
  PID:5680
- C:\Windows\System\OYOsoVR.exe
  C:\Windows\System\OYOsoVR.exe
  2⤵
  PID:5696
- C:\Windows\System\CIGjiuo.exe
  C:\Windows\System\CIGjiuo.exe
  2⤵
  PID:5712
- C:\Windows\System\YqVavkr.exe
  C:\Windows\System\YqVavkr.exe
  2⤵
  PID:5728
- C:\Windows\System\GkFOKth.exe
  C:\Windows\System\GkFOKth.exe
  2⤵
  PID:5744
- C:\Windows\System\RmtoZtV.exe
  C:\Windows\System\RmtoZtV.exe
  2⤵
  PID:5760
- C:\Windows\System\SsZIVsU.exe
  C:\Windows\System\SsZIVsU.exe
  2⤵
  PID:5776
- C:\Windows\System\RWfaYZv.exe
  C:\Windows\System\RWfaYZv.exe
  2⤵
  PID:5792
- C:\Windows\System\CKmXpqU.exe
  C:\Windows\System\CKmXpqU.exe
  2⤵
  PID:5808
- C:\Windows\System\UpIMobd.exe
  C:\Windows\System\UpIMobd.exe
  2⤵
  PID:5824
- C:\Windows\System\YwsMKUP.exe
  C:\Windows\System\YwsMKUP.exe
  2⤵
  PID:5840
- C:\Windows\System\JiDbMJy.exe
  C:\Windows\System\JiDbMJy.exe
  2⤵
  PID:5856
- C:\Windows\System\ymdhUQn.exe
  C:\Windows\System\ymdhUQn.exe
  2⤵
  PID:5872
- C:\Windows\System\OFFATGv.exe
  C:\Windows\System\OFFATGv.exe
  2⤵
  PID:5888
- C:\Windows\System\UdLShuG.exe
  C:\Windows\System\UdLShuG.exe
  2⤵
  PID:5904
- C:\Windows\System\WPOgmTp.exe
  C:\Windows\System\WPOgmTp.exe
  2⤵
  PID:5920
- C:\Windows\System\eCJSmhd.exe
  C:\Windows\System\eCJSmhd.exe
  2⤵
  PID:5936
- C:\Windows\System\HOXoMDX.exe
  C:\Windows\System\HOXoMDX.exe
  2⤵
  PID:5952
- C:\Windows\System\CaoPuUY.exe
  C:\Windows\System\CaoPuUY.exe
  2⤵
  PID:5968
- C:\Windows\System\uzINHVc.exe
  C:\Windows\System\uzINHVc.exe
  2⤵
  PID:5984
- C:\Windows\System\WwxzzMl.exe
  C:\Windows\System\WwxzzMl.exe
  2⤵
  PID:6000
- C:\Windows\System\NRbQrjs.exe
  C:\Windows\System\NRbQrjs.exe
  2⤵
  PID:6016
- C:\Windows\System\ltvkExZ.exe
  C:\Windows\System\ltvkExZ.exe
  2⤵
  PID:6032
- C:\Windows\System\wOsfmOr.exe
  C:\Windows\System\wOsfmOr.exe
  2⤵
  PID:6048
- C:\Windows\System\szNZhuk.exe
  C:\Windows\System\szNZhuk.exe
  2⤵
  PID:6064
- C:\Windows\System\UQYsvRB.exe
  C:\Windows\System\UQYsvRB.exe
  2⤵
  PID:6080
- C:\Windows\System\BxqqnLI.exe
  C:\Windows\System\BxqqnLI.exe
  2⤵
  PID:6096
- C:\Windows\System\XJYkZoI.exe
  C:\Windows\System\XJYkZoI.exe
  2⤵
  PID:6112
- C:\Windows\System\PHEIjVE.exe
  C:\Windows\System\PHEIjVE.exe
  2⤵
  PID:6128
- C:\Windows\System\sdQBOZq.exe
  C:\Windows\System\sdQBOZq.exe
  2⤵
  PID:4476
- C:\Windows\System\FJNPDYU.exe
  C:\Windows\System\FJNPDYU.exe
  2⤵
  PID:5128
- C:\Windows\System\DZCTxyN.exe
  C:\Windows\System\DZCTxyN.exe
  2⤵
  PID:5192
- C:\Windows\System\AiwAnqS.exe
  C:\Windows\System\AiwAnqS.exe
  2⤵
  PID:5256
- C:\Windows\System\lJFIHVg.exe
  C:\Windows\System\lJFIHVg.exe
  2⤵
  PID:4428
- C:\Windows\System\OqENAxE.exe
  C:\Windows\System\OqENAxE.exe
  2⤵
  PID:4600
- C:\Windows\System\GWkKKyH.exe
  C:\Windows\System\GWkKKyH.exe
  2⤵
  PID:4844
- C:\Windows\System\mzLpcTL.exe
  C:\Windows\System\mzLpcTL.exe
  2⤵
  PID:4488
- C:\Windows\System\BLDAUzx.exe
  C:\Windows\System\BLDAUzx.exe
  2⤵
  PID:4888
- C:\Windows\System\SMmrxfy.exe
  C:\Windows\System\SMmrxfy.exe
  2⤵
  PID:5276
- C:\Windows\System\gpSdJgM.exe
  C:\Windows\System\gpSdJgM.exe
  2⤵
  PID:4216
- C:\Windows\System\DtuANat.exe
  C:\Windows\System\DtuANat.exe
  2⤵
  PID:4764
- C:\Windows\System\mrSpEIG.exe
  C:\Windows\System\mrSpEIG.exe
  2⤵
  PID:4588
- C:\Windows\System\TLlHXnT.exe
  C:\Windows\System\TLlHXnT.exe
  2⤵
  PID:4156
- C:\Windows\System\mUZCTlH.exe
  C:\Windows\System\mUZCTlH.exe
  2⤵
  PID:5148
- C:\Windows\System\EHzXjUJ.exe
  C:\Windows\System\EHzXjUJ.exe
  2⤵
  PID:5212
- C:\Windows\System\GLHDExF.exe
  C:\Windows\System\GLHDExF.exe
  2⤵
  PID:5356
- C:\Windows\System\leWZcKx.exe
  C:\Windows\System\leWZcKx.exe
  2⤵
  PID:5420
- C:\Windows\System\fQAkEqB.exe
  C:\Windows\System\fQAkEqB.exe
  2⤵
  PID:5512
- C:\Windows\System\lDAMyLA.exe
  C:\Windows\System\lDAMyLA.exe
  2⤵
  PID:5580
- C:\Windows\System\fhJHNEF.exe
  C:\Windows\System\fhJHNEF.exe
  2⤵
  PID:5740
- C:\Windows\System\apdXDBv.exe
  C:\Windows\System\apdXDBv.exe
  2⤵
  PID:5340
- C:\Windows\System\ZhwZUzB.exe
  C:\Windows\System\ZhwZUzB.exe
  2⤵
  PID:5404
- C:\Windows\System\LgrzoqO.exe
  C:\Windows\System\LgrzoqO.exe
  2⤵
  PID:5468
- C:\Windows\System\EcENnVv.exe
  C:\Windows\System\EcENnVv.exe
  2⤵
  PID:5592
- C:\Windows\System\KGSqsid.exe
  C:\Windows\System\KGSqsid.exe
  2⤵
  PID:5500
- C:\Windows\System\SSUVkBP.exe
  C:\Windows\System\SSUVkBP.exe
  2⤵
  PID:5688
- C:\Windows\System\oGkJeMA.exe
  C:\Windows\System\oGkJeMA.exe
  2⤵
  PID:5660
- C:\Windows\System\ZivNkup.exe
  C:\Windows\System\ZivNkup.exe
  2⤵
  PID:5804
- C:\Windows\System\iGsKAAc.exe
  C:\Windows\System\iGsKAAc.exe
  2⤵
  PID:5896
- C:\Windows\System\yYkLIzk.exe
  C:\Windows\System\yYkLIzk.exe
  2⤵
  PID:5960
- C:\Windows\System\mUWLCKl.exe
  C:\Windows\System\mUWLCKl.exe
  2⤵
  PID:5816
- C:\Windows\System\IwqLtrs.exe
  C:\Windows\System\IwqLtrs.exe
  2⤵
  PID:5884
- C:\Windows\System\OUpHxcv.exe
  C:\Windows\System\OUpHxcv.exe
  2⤵
  PID:5948
- C:\Windows\System\boREsXW.exe
  C:\Windows\System\boREsXW.exe
  2⤵
  PID:6024
- C:\Windows\System\RoJVPuq.exe
  C:\Windows\System\RoJVPuq.exe
  2⤵
  PID:6088
- C:\Windows\System\nVnTTTP.exe
  C:\Windows\System\nVnTTTP.exe
  2⤵
  PID:5116
- C:\Windows\System\KebeTMd.exe
  C:\Windows\System\KebeTMd.exe
  2⤵
  PID:5228
- C:\Windows\System\gWEVJzo.exe
  C:\Windows\System\gWEVJzo.exe
  2⤵
  PID:5244
- C:\Windows\System\AhYouBQ.exe
  C:\Windows\System\AhYouBQ.exe
  2⤵
  PID:4252
- C:\Windows\System\sKRXvah.exe
  C:\Windows\System\sKRXvah.exe
  2⤵
  PID:5208
- C:\Windows\System\naeTzub.exe
  C:\Windows\System\naeTzub.exe
  2⤵
  PID:4696
- C:\Windows\System\cHzGXIF.exe
  C:\Windows\System\cHzGXIF.exe
  2⤵
  PID:5144
- C:\Windows\System\rKxmlmu.exe
  C:\Windows\System\rKxmlmu.exe
  2⤵
  PID:6044
- C:\Windows\System\aybqfHw.exe
  C:\Windows\System\aybqfHw.exe
  2⤵
  PID:6108
- C:\Windows\System\mzDbjVc.exe
  C:\Windows\System\mzDbjVc.exe
  2⤵
  PID:5164
- C:\Windows\System\XQvIpzE.exe
  C:\Windows\System\XQvIpzE.exe
  2⤵
  PID:4860
- C:\Windows\System\NxBXbYQ.exe
  C:\Windows\System\NxBXbYQ.exe
  2⤵
  PID:5324
- C:\Windows\System\HNbamrR.exe
  C:\Windows\System\HNbamrR.exe
  2⤵
  PID:5548
- C:\Windows\System\GfXIzwR.exe
  C:\Windows\System\GfXIzwR.exe
  2⤵
  PID:5308
- C:\Windows\System\QTKhaBL.exe
  C:\Windows\System\QTKhaBL.exe
  2⤵
  PID:5708
- C:\Windows\System\DOoimGj.exe
  C:\Windows\System\DOoimGj.exe
  2⤵
  PID:5372
- C:\Windows\System\quUzCwB.exe
  C:\Windows\System\quUzCwB.exe
  2⤵
  PID:5628
- C:\Windows\System\dJlTfpS.exe
  C:\Windows\System\dJlTfpS.exe
  2⤵
  PID:5528
- C:\Windows\System\uBjDMgL.exe
  C:\Windows\System\uBjDMgL.exe
  2⤵
  PID:5752
- C:\Windows\System\IWKyvwJ.exe
  C:\Windows\System\IWKyvwJ.exe
  2⤵
  PID:5724
- C:\Windows\System\ztBumSO.exe
  C:\Windows\System\ztBumSO.exe
  2⤵
  PID:5916
- C:\Windows\System\SGRWbld.exe
  C:\Windows\System\SGRWbld.exe
  2⤵
  PID:5992
- C:\Windows\System\PdZTFMD.exe
  C:\Windows\System\PdZTFMD.exe
  2⤵
  PID:5224
- C:\Windows\System\kBhcpzz.exe
  C:\Windows\System\kBhcpzz.exe
  2⤵
  PID:5852
- C:\Windows\System\WGHQZlm.exe
  C:\Windows\System\WGHQZlm.exe
  2⤵
  PID:4988
- C:\Windows\System\RphSkjg.exe
  C:\Windows\System\RphSkjg.exe
  2⤵
  PID:6008
- C:\Windows\System\ngPjtqD.exe
  C:\Windows\System\ngPjtqD.exe
  2⤵
  PID:5304
- C:\Windows\System\fNHRcly.exe
  C:\Windows\System\fNHRcly.exe
  2⤵
  PID:6076
- C:\Windows\System\ipMcHVS.exe
  C:\Windows\System\ipMcHVS.exe
  2⤵
  PID:5036
- C:\Windows\System\iNWBxTv.exe
  C:\Windows\System\iNWBxTv.exe
  2⤵
  PID:5336
- C:\Windows\System\EmGUlnz.exe
  C:\Windows\System\EmGUlnz.exe
  2⤵
  PID:5864
- C:\Windows\System\CSYYoJa.exe
  C:\Windows\System\CSYYoJa.exe
  2⤵
  PID:4616
- C:\Windows\System\SHQqyPV.exe
  C:\Windows\System\SHQqyPV.exe
  2⤵
  PID:6012
- C:\Windows\System\rEQtzju.exe
  C:\Windows\System\rEQtzju.exe
  2⤵
  PID:5692
- C:\Windows\System\qlqkdBo.exe
  C:\Windows\System\qlqkdBo.exe
  2⤵
  PID:5484
- C:\Windows\System\pMaMDYy.exe
  C:\Windows\System\pMaMDYy.exe
  2⤵
  PID:6148
- C:\Windows\System\WUswmaX.exe
  C:\Windows\System\WUswmaX.exe
  2⤵
  PID:6164
- C:\Windows\System\hXLQXby.exe
  C:\Windows\System\hXLQXby.exe
  2⤵
  PID:6180
- C:\Windows\System\lrKtOsr.exe
  C:\Windows\System\lrKtOsr.exe
  2⤵
  PID:6196
- C:\Windows\System\UokXvaL.exe
  C:\Windows\System\UokXvaL.exe
  2⤵
  PID:6212
- C:\Windows\System\xYYABlT.exe
  C:\Windows\System\xYYABlT.exe
  2⤵
  PID:6228
- C:\Windows\System\EVqEwHq.exe
  C:\Windows\System\EVqEwHq.exe
  2⤵
  PID:6244
- C:\Windows\System\OzlJoGb.exe
  C:\Windows\System\OzlJoGb.exe
  2⤵
  PID:6260
- C:\Windows\System\OUlRjDg.exe
  C:\Windows\System\OUlRjDg.exe
  2⤵
  PID:6276
- C:\Windows\System\geslZvn.exe
  C:\Windows\System\geslZvn.exe
  2⤵
  PID:6292
- C:\Windows\System\njqYfVz.exe
  C:\Windows\System\njqYfVz.exe
  2⤵
  PID:6308
- C:\Windows\System\lbJHxIW.exe
  C:\Windows\System\lbJHxIW.exe
  2⤵
  PID:6324
- C:\Windows\System\lckytar.exe
  C:\Windows\System\lckytar.exe
  2⤵
  PID:6340
- C:\Windows\System\GrUZIES.exe
  C:\Windows\System\GrUZIES.exe
  2⤵
  PID:6356
- C:\Windows\System\zIWwbMq.exe
  C:\Windows\System\zIWwbMq.exe
  2⤵
  PID:6372
- C:\Windows\System\gmeSOCE.exe
  C:\Windows\System\gmeSOCE.exe
  2⤵
  PID:6388
- C:\Windows\System\eXHPzOX.exe
  C:\Windows\System\eXHPzOX.exe
  2⤵
  PID:6404
- C:\Windows\System\ABPMCuv.exe
  C:\Windows\System\ABPMCuv.exe
  2⤵
  PID:6420
- C:\Windows\System\CRdGyAT.exe
  C:\Windows\System\CRdGyAT.exe
  2⤵
  PID:6436
- C:\Windows\System\apZKFFT.exe
  C:\Windows\System\apZKFFT.exe
  2⤵
  PID:6452
- C:\Windows\System\EUeuTxb.exe
  C:\Windows\System\EUeuTxb.exe
  2⤵
  PID:6468
- C:\Windows\System\oUitgMj.exe
  C:\Windows\System\oUitgMj.exe
  2⤵
  PID:6484
- C:\Windows\System\CcZchao.exe
  C:\Windows\System\CcZchao.exe
  2⤵
  PID:6504
- C:\Windows\System\xBoQIIw.exe
  C:\Windows\System\xBoQIIw.exe
  2⤵
  PID:6520
- C:\Windows\System\JUSentL.exe
  C:\Windows\System\JUSentL.exe
  2⤵
  PID:6536
- C:\Windows\System\ijlaHkQ.exe
  C:\Windows\System\ijlaHkQ.exe
  2⤵
  PID:6552
- C:\Windows\System\kklAoXr.exe
  C:\Windows\System\kklAoXr.exe
  2⤵
  PID:6568
- C:\Windows\System\TXeLUMY.exe
  C:\Windows\System\TXeLUMY.exe
  2⤵
  PID:6584
- C:\Windows\System\FYCyOwI.exe
  C:\Windows\System\FYCyOwI.exe
  2⤵
  PID:6600
- C:\Windows\System\PxEwjge.exe
  C:\Windows\System\PxEwjge.exe
  2⤵
  PID:6616
- C:\Windows\System\EEnWRYs.exe
  C:\Windows\System\EEnWRYs.exe
  2⤵
  PID:6632
- C:\Windows\System\ALprxZG.exe
  C:\Windows\System\ALprxZG.exe
  2⤵
  PID:6648
- C:\Windows\System\ZDDMjrN.exe
  C:\Windows\System\ZDDMjrN.exe
  2⤵
  PID:6664
- C:\Windows\System\bpLsgqh.exe
  C:\Windows\System\bpLsgqh.exe
  2⤵
  PID:6680
- C:\Windows\System\hagxgHp.exe
  C:\Windows\System\hagxgHp.exe
  2⤵
  PID:6696
- C:\Windows\System\GFbDbRc.exe
  C:\Windows\System\GFbDbRc.exe
  2⤵
  PID:6712
- C:\Windows\System\kQOZjuf.exe
  C:\Windows\System\kQOZjuf.exe
  2⤵
  PID:6728
- C:\Windows\System\DXyqGGK.exe
  C:\Windows\System\DXyqGGK.exe
  2⤵
  PID:6744
- C:\Windows\System\mLerFER.exe
  C:\Windows\System\mLerFER.exe
  2⤵
  PID:6760
- C:\Windows\System\tsgJSNy.exe
  C:\Windows\System\tsgJSNy.exe
  2⤵
  PID:6776
- C:\Windows\System\XcSHrpi.exe
  C:\Windows\System\XcSHrpi.exe
  2⤵
  PID:6792
- C:\Windows\System\dXmTYQy.exe
  C:\Windows\System\dXmTYQy.exe
  2⤵
  PID:6808
- C:\Windows\System\VDJWELT.exe
  C:\Windows\System\VDJWELT.exe
  2⤵
  PID:6824
- C:\Windows\System\ZQeanGy.exe
  C:\Windows\System\ZQeanGy.exe
  2⤵
  PID:6840
- C:\Windows\System\ewsYosF.exe
  C:\Windows\System\ewsYosF.exe
  2⤵
  PID:6856
- C:\Windows\System\diNklUt.exe
  C:\Windows\System\diNklUt.exe
  2⤵
  PID:6872
- C:\Windows\System\rEutdNL.exe
  C:\Windows\System\rEutdNL.exe
  2⤵
  PID:6888
- C:\Windows\System\NxInEEB.exe
  C:\Windows\System\NxInEEB.exe
  2⤵
  PID:6904
- C:\Windows\System\ZJemwBj.exe
  C:\Windows\System\ZJemwBj.exe
  2⤵
  PID:6920
- C:\Windows\System\brcbvMb.exe
  C:\Windows\System\brcbvMb.exe
  2⤵
  PID:6936
- C:\Windows\System\EiZQxEZ.exe
  C:\Windows\System\EiZQxEZ.exe
  2⤵
  PID:6952
- C:\Windows\System\wMdlQkk.exe
  C:\Windows\System\wMdlQkk.exe
  2⤵
  PID:6968
- C:\Windows\System\MWyBHdp.exe
  C:\Windows\System\MWyBHdp.exe
  2⤵
  PID:6984
- C:\Windows\System\jYvZtbN.exe
  C:\Windows\System\jYvZtbN.exe
  2⤵
  PID:7000
- C:\Windows\System\oZgaJsi.exe
  C:\Windows\System\oZgaJsi.exe
  2⤵
  PID:7016
- C:\Windows\System\gaLdUQl.exe
  C:\Windows\System\gaLdUQl.exe
  2⤵
  PID:7032
- C:\Windows\System\VmNLUnz.exe
  C:\Windows\System\VmNLUnz.exe
  2⤵
  PID:7048
- C:\Windows\System\ZMmWauK.exe
  C:\Windows\System\ZMmWauK.exe
  2⤵
  PID:7064
- C:\Windows\System\cUceljW.exe
  C:\Windows\System\cUceljW.exe
  2⤵
  PID:7080
- C:\Windows\System\ETxNpOv.exe
  C:\Windows\System\ETxNpOv.exe
  2⤵
  PID:7096
- C:\Windows\System\kXamftN.exe
  C:\Windows\System\kXamftN.exe
  2⤵
  PID:7112
- C:\Windows\System\pFPJSGb.exe
  C:\Windows\System\pFPJSGb.exe
  2⤵
  PID:7128
- C:\Windows\System\uukOHAt.exe
  C:\Windows\System\uukOHAt.exe
  2⤵
  PID:7144
- C:\Windows\System\TpphKoJ.exe
  C:\Windows\System\TpphKoJ.exe
  2⤵
  PID:7160
- C:\Windows\System\ghVcGTY.exe
  C:\Windows\System\ghVcGTY.exe
  2⤵
  PID:5596
- C:\Windows\System\DIvPuQU.exe
  C:\Windows\System\DIvPuQU.exe
  2⤵
  PID:5436
- C:\Windows\System\Rlyvvuu.exe
  C:\Windows\System\Rlyvvuu.exe
  2⤵
  PID:6060
- C:\Windows\System\sZVWIOU.exe
  C:\Windows\System\sZVWIOU.exe
  2⤵
  PID:6204
- C:\Windows\System\JVrFjXo.exe
  C:\Windows\System\JVrFjXo.exe
  2⤵
  PID:3872
- C:\Windows\System\fBLYeNl.exe
  C:\Windows\System\fBLYeNl.exe
  2⤵
  PID:4316
- C:\Windows\System\ADqzCBO.exe
  C:\Windows\System\ADqzCBO.exe
  2⤵
  PID:5160
- C:\Windows\System\HAHXnaj.exe
  C:\Windows\System\HAHXnaj.exe
  2⤵
  PID:6156
- C:\Windows\System\LWDXXHV.exe
  C:\Windows\System\LWDXXHV.exe
  2⤵
  PID:6300
- C:\Windows\System\erehUUU.exe
  C:\Windows\System\erehUUU.exe
  2⤵
  PID:6224
- C:\Windows\System\eazlZvR.exe
  C:\Windows\System\eazlZvR.exe
  2⤵
  PID:6332
- C:\Windows\System\lKvnabc.exe
  C:\Windows\System\lKvnabc.exe
  2⤵
  PID:6396
- C:\Windows\System\lrNSTyP.exe
  C:\Windows\System\lrNSTyP.exe
  2⤵
  PID:6432
- C:\Windows\System\rOnFvDx.exe
  C:\Windows\System\rOnFvDx.exe
  2⤵
  PID:6464
- C:\Windows\System\CELarIT.exe
  C:\Windows\System\CELarIT.exe
  2⤵
  PID:6348
- C:\Windows\System\VZKmsWK.exe
  C:\Windows\System\VZKmsWK.exe
  2⤵
  PID:6476
- C:\Windows\System\kNzketO.exe
  C:\Windows\System\kNzketO.exe
  2⤵
  PID:6492
- C:\Windows\System\qBTDDSi.exe
  C:\Windows\System\qBTDDSi.exe
  2⤵
  PID:6560
- C:\Windows\System\VtCtPtx.exe
  C:\Windows\System\VtCtPtx.exe
  2⤵
  PID:6624
- C:\Windows\System\VUhpjyh.exe
  C:\Windows\System\VUhpjyh.exe
  2⤵
  PID:6688
- C:\Windows\System\ITufzTJ.exe
  C:\Windows\System\ITufzTJ.exe
  2⤵
  PID:6784
- C:\Windows\System\yaiiOTa.exe
  C:\Windows\System\yaiiOTa.exe
  2⤵
  PID:6724
- C:\Windows\System\smNfmvt.exe
  C:\Windows\System\smNfmvt.exe
  2⤵
  PID:6880
- C:\Windows\System\AEFAKgU.exe
  C:\Windows\System\AEFAKgU.exe
  2⤵
  PID:6644
- C:\Windows\System\brrTYSC.exe
  C:\Windows\System\brrTYSC.exe
  2⤵
  PID:6736
- C:\Windows\System\CRCDYUM.exe
  C:\Windows\System\CRCDYUM.exe
  2⤵
  PID:6512
- C:\Windows\System\eaHRlrC.exe
  C:\Windows\System\eaHRlrC.exe
  2⤵
  PID:6580
- C:\Windows\System\utvbkCG.exe
  C:\Windows\System\utvbkCG.exe
  2⤵
  PID:6708
- C:\Windows\System\tjNudhJ.exe
  C:\Windows\System\tjNudhJ.exe
  2⤵
  PID:6772
- C:\Windows\System\RBJyjbz.exe
  C:\Windows\System\RBJyjbz.exe
  2⤵
  PID:6900
- C:\Windows\System\BODcjiJ.exe
  C:\Windows\System\BODcjiJ.exe
  2⤵
  PID:6976
- C:\Windows\System\mTrgQIX.exe
  C:\Windows\System\mTrgQIX.exe
  2⤵
  PID:7040
- C:\Windows\System\FMqwgnL.exe
  C:\Windows\System\FMqwgnL.exe
  2⤵
  PID:7104
- C:\Windows\System\mxflYrk.exe
  C:\Windows\System\mxflYrk.exe
  2⤵
  PID:6104
- C:\Windows\System\XAUiYVW.exe
  C:\Windows\System\XAUiYVW.exe
  2⤵
  PID:6932
- C:\Windows\System\uXecffF.exe
  C:\Windows\System\uXecffF.exe
  2⤵
  PID:5928
- C:\Windows\System\JAAfJvY.exe
  C:\Windows\System\JAAfJvY.exe
  2⤵
  PID:7124
- C:\Windows\System\CMUuNHl.exe
  C:\Windows\System\CMUuNHl.exe
  2⤵
  PID:7092
- C:\Windows\System\lXgQAlt.exe
  C:\Windows\System\lXgQAlt.exe
  2⤵
  PID:5180
- C:\Windows\System\kOesZkM.exe
  C:\Windows\System\kOesZkM.exe
  2⤵
  PID:5544
- C:\Windows\System\rwGgjBh.exe
  C:\Windows\System\rwGgjBh.exe
  2⤵
  PID:5676
- C:\Windows\System\bbTUNif.exe
  C:\Windows\System\bbTUNif.exe
  2⤵
  PID:5736
- C:\Windows\System\UdJYvGV.exe
  C:\Windows\System\UdJYvGV.exe
  2⤵
  PID:6428
- C:\Windows\System\xhoBVtH.exe
  C:\Windows\System\xhoBVtH.exe
  2⤵
  PID:6480
- C:\Windows\System\UsiWZFC.exe
  C:\Windows\System\UsiWZFC.exe
  2⤵
  PID:6720
- C:\Windows\System\SGheEpi.exe
  C:\Windows\System\SGheEpi.exe
  2⤵
  PID:6852
- C:\Windows\System\nXLkvmY.exe
  C:\Windows\System\nXLkvmY.exe
  2⤵
  PID:6544
- C:\Windows\System\mzfjyIL.exe
  C:\Windows\System\mzfjyIL.exe
  2⤵
  PID:6288
- C:\Windows\System\sDhYeBn.exe
  C:\Windows\System\sDhYeBn.exe
  2⤵
  PID:6640
- C:\Windows\System\ezNIovI.exe
  C:\Windows\System\ezNIovI.exe
  2⤵
  PID:6384
- C:\Windows\System\KQiVtkB.exe
  C:\Windows\System\KQiVtkB.exe
  2⤵
  PID:6660
- C:\Windows\System\JXBIZOa.exe
  C:\Windows\System\JXBIZOa.exe
  2⤵
  PID:6944
- C:\Windows\System\okgKASb.exe
  C:\Windows\System\okgKASb.exe
  2⤵
  PID:6960
- C:\Windows\System\WeKvYDC.exe
  C:\Windows\System\WeKvYDC.exe
  2⤵
  PID:6240
- C:\Windows\System\iRaAioa.exe
  C:\Windows\System\iRaAioa.exe
  2⤵
  PID:7008
- C:\Windows\System\JqBnGLO.exe
  C:\Windows\System\JqBnGLO.exe
  2⤵
  PID:6272
- C:\Windows\System\CkrGSnd.exe
  C:\Windows\System\CkrGSnd.exe
  2⤵
  PID:4424
- C:\Windows\System\pgNbNWq.exe
  C:\Windows\System\pgNbNWq.exe
  2⤵
  PID:7028
- C:\Windows\System\ytItQrB.exe
  C:\Windows\System\ytItQrB.exe
  2⤵
  PID:6316
- C:\Windows\System\GbYcCnZ.exe
  C:\Windows\System\GbYcCnZ.exe
  2⤵
  PID:6836
- C:\Windows\System\zHegEBQ.exe
  C:\Windows\System\zHegEBQ.exe
  2⤵
  PID:6368
- C:\Windows\System\bgNtrsz.exe
  C:\Windows\System\bgNtrsz.exe
  2⤵
  PID:6532
- C:\Windows\System\YETIMvO.exe
  C:\Windows\System\YETIMvO.exe
  2⤵
  PID:6804
- C:\Windows\System\lUiKGPG.exe
  C:\Windows\System\lUiKGPG.exe
  2⤵
  PID:6896
- C:\Windows\System\RDTxusT.exe
  C:\Windows\System\RDTxusT.exe
  2⤵
  PID:6364
- C:\Windows\System\pRXtdXZ.exe
  C:\Windows\System\pRXtdXZ.exe
  2⤵
  PID:6676
- C:\Windows\System\FEntqyq.exe
  C:\Windows\System\FEntqyq.exe
  2⤵
  PID:7056
- C:\Windows\System\aHNtHGa.exe
  C:\Windows\System\aHNtHGa.exe
  2⤵
  PID:7072
- C:\Windows\System\HIACpng.exe
  C:\Windows\System\HIACpng.exe
  2⤵
  PID:7140
- C:\Windows\System\UulVILN.exe
  C:\Windows\System\UulVILN.exe
  2⤵
  PID:5788
- C:\Windows\System\iJzXlpU.exe
  C:\Windows\System\iJzXlpU.exe
  2⤵
  PID:6848
- C:\Windows\System\hnykaju.exe
  C:\Windows\System\hnykaju.exe
  2⤵
  PID:6176
- C:\Windows\System\fDpebmb.exe
  C:\Windows\System\fDpebmb.exe
  2⤵
  PID:7180
- C:\Windows\System\RGahOuE.exe
  C:\Windows\System\RGahOuE.exe
  2⤵
  PID:7196
- C:\Windows\System\ucFWeCf.exe
  C:\Windows\System\ucFWeCf.exe
  2⤵
  PID:7212
- C:\Windows\System\AhjoIds.exe
  C:\Windows\System\AhjoIds.exe
  2⤵
  PID:7228
- C:\Windows\System\aYgFXqy.exe
  C:\Windows\System\aYgFXqy.exe
  2⤵
  PID:7244
- C:\Windows\System\wctVeDZ.exe
  C:\Windows\System\wctVeDZ.exe
  2⤵
  PID:7260
- C:\Windows\System\bfDBPfK.exe
  C:\Windows\System\bfDBPfK.exe
  2⤵
  PID:7276
- C:\Windows\System\RbANgqM.exe
  C:\Windows\System\RbANgqM.exe
  2⤵
  PID:7292
- C:\Windows\System\JnuWeKC.exe
  C:\Windows\System\JnuWeKC.exe
  2⤵
  PID:7308
- C:\Windows\System\oKVNiTF.exe
  C:\Windows\System\oKVNiTF.exe
  2⤵
  PID:7324
- C:\Windows\System\usUTjne.exe
  C:\Windows\System\usUTjne.exe
  2⤵
  PID:7340
- C:\Windows\System\zzJweNQ.exe
  C:\Windows\System\zzJweNQ.exe
  2⤵
  PID:7356
- C:\Windows\System\JtMzRci.exe
  C:\Windows\System\JtMzRci.exe
  2⤵
  PID:7372
- C:\Windows\System\mgVlscE.exe
  C:\Windows\System\mgVlscE.exe
  2⤵
  PID:7388
- C:\Windows\System\RwqkQSr.exe
  C:\Windows\System\RwqkQSr.exe
  2⤵
  PID:7404
- C:\Windows\System\nIoaTpA.exe
  C:\Windows\System\nIoaTpA.exe
  2⤵
  PID:7424
- C:\Windows\System\PzykOlT.exe
  C:\Windows\System\PzykOlT.exe
  2⤵
  PID:7440
- C:\Windows\System\mpwogdc.exe
  C:\Windows\System\mpwogdc.exe
  2⤵
  PID:7456
- C:\Windows\System\JWyUxLE.exe
  C:\Windows\System\JWyUxLE.exe
  2⤵
  PID:7472
- C:\Windows\System\cssVZaP.exe
  C:\Windows\System\cssVZaP.exe
  2⤵
  PID:7488
- C:\Windows\System\ObhKxzS.exe
  C:\Windows\System\ObhKxzS.exe
  2⤵
  PID:7504
- C:\Windows\System\yxVMwLG.exe
  C:\Windows\System\yxVMwLG.exe
  2⤵
  PID:7520
- C:\Windows\System\ctSyiOH.exe
  C:\Windows\System\ctSyiOH.exe
  2⤵
  PID:7536
- C:\Windows\System\cRnMlvI.exe
  C:\Windows\System\cRnMlvI.exe
  2⤵
  PID:7552
- C:\Windows\System\HdMCeBD.exe
  C:\Windows\System\HdMCeBD.exe
  2⤵
  PID:7568
- C:\Windows\System\WgkVOsv.exe
  C:\Windows\System\WgkVOsv.exe
  2⤵
  PID:7584
- C:\Windows\System\pIFSiuw.exe
  C:\Windows\System\pIFSiuw.exe
  2⤵
  PID:7600
- C:\Windows\System\JWxfMsA.exe
  C:\Windows\System\JWxfMsA.exe
  2⤵
  PID:7616
- C:\Windows\System\ruEIRwl.exe
  C:\Windows\System\ruEIRwl.exe
  2⤵
  PID:7632
- C:\Windows\System\UFWMlGO.exe
  C:\Windows\System\UFWMlGO.exe
  2⤵
  PID:7648
- C:\Windows\System\KQOfLUi.exe
  C:\Windows\System\KQOfLUi.exe
  2⤵
  PID:7664
- C:\Windows\System\Unbfaze.exe
  C:\Windows\System\Unbfaze.exe
  2⤵
  PID:7680
- C:\Windows\System\KntawKH.exe
  C:\Windows\System\KntawKH.exe
  2⤵
  PID:7696
- C:\Windows\System\Cpargco.exe
  C:\Windows\System\Cpargco.exe
  2⤵
  PID:7712
- C:\Windows\System\YuTcpRT.exe
  C:\Windows\System\YuTcpRT.exe
  2⤵
  PID:7728
- C:\Windows\System\HyrVjqS.exe
  C:\Windows\System\HyrVjqS.exe
  2⤵
  PID:7744
- C:\Windows\System\wXuvkvS.exe
  C:\Windows\System\wXuvkvS.exe
  2⤵
  PID:7760
- C:\Windows\System\WrmdQEy.exe
  C:\Windows\System\WrmdQEy.exe
  2⤵
  PID:7776
- C:\Windows\System\ujnoeKg.exe
  C:\Windows\System\ujnoeKg.exe
  2⤵
  PID:7792
- C:\Windows\System\vcrKbMp.exe
  C:\Windows\System\vcrKbMp.exe
  2⤵
  PID:7808
- C:\Windows\System\CZpPcjQ.exe
  C:\Windows\System\CZpPcjQ.exe
  2⤵
  PID:7824
- C:\Windows\System\fFkvaKh.exe
  C:\Windows\System\fFkvaKh.exe
  2⤵
  PID:7840
- C:\Windows\System\hLxpQPc.exe
  C:\Windows\System\hLxpQPc.exe
  2⤵
  PID:7856
- C:\Windows\System\vfBxGDj.exe
  C:\Windows\System\vfBxGDj.exe
  2⤵
  PID:7872
- C:\Windows\System\mxpJLQI.exe
  C:\Windows\System\mxpJLQI.exe
  2⤵
  PID:7888
- C:\Windows\System\nwxCdKk.exe
  C:\Windows\System\nwxCdKk.exe
  2⤵
  PID:7904
- C:\Windows\System\aJEzsVo.exe
  C:\Windows\System\aJEzsVo.exe
  2⤵
  PID:7920
- C:\Windows\System\zwpzaqE.exe
  C:\Windows\System\zwpzaqE.exe
  2⤵
  PID:7936
- C:\Windows\System\GpYSold.exe
  C:\Windows\System\GpYSold.exe
  2⤵
  PID:7952
- C:\Windows\System\BfSTmPW.exe
  C:\Windows\System\BfSTmPW.exe
  2⤵
  PID:7968
- C:\Windows\System\SACMpXM.exe
  C:\Windows\System\SACMpXM.exe
  2⤵
  PID:7984
- C:\Windows\System\nojgPLc.exe
  C:\Windows\System\nojgPLc.exe
  2⤵
  PID:8000
- C:\Windows\System\PMzYohT.exe
  C:\Windows\System\PMzYohT.exe
  2⤵
  PID:8016
- C:\Windows\System\LmHzAQQ.exe
  C:\Windows\System\LmHzAQQ.exe
  2⤵
  PID:8032
- C:\Windows\System\RTSjFRt.exe
  C:\Windows\System\RTSjFRt.exe
  2⤵
  PID:8048
- C:\Windows\System\HdtFFaH.exe
  C:\Windows\System\HdtFFaH.exe
  2⤵
  PID:8064
- C:\Windows\System\NcxbGoQ.exe
  C:\Windows\System\NcxbGoQ.exe
  2⤵
  PID:8080
- C:\Windows\System\vhaTuSa.exe
  C:\Windows\System\vhaTuSa.exe
  2⤵
  PID:8096
- C:\Windows\System\aNlrQGx.exe
  C:\Windows\System\aNlrQGx.exe
  2⤵
  PID:8112
- C:\Windows\System\qWzYicJ.exe
  C:\Windows\System\qWzYicJ.exe
  2⤵
  PID:8128
- C:\Windows\System\tNbHvgJ.exe
  C:\Windows\System\tNbHvgJ.exe
  2⤵
  PID:8144
- C:\Windows\System\fsLEeHv.exe
  C:\Windows\System\fsLEeHv.exe
  2⤵
  PID:8160
- C:\Windows\System\unKEhrM.exe
  C:\Windows\System\unKEhrM.exe
  2⤵
  PID:8176
- C:\Windows\System\rxvczwa.exe
  C:\Windows\System\rxvczwa.exe
  2⤵
  PID:7172
- C:\Windows\System\xhiiFyw.exe
  C:\Windows\System\xhiiFyw.exe
  2⤵
  PID:7156
- C:\Windows\System\UfLMfrB.exe
  C:\Windows\System\UfLMfrB.exe
  2⤵
  PID:6596
- C:\Windows\System\LHyWpdA.exe
  C:\Windows\System\LHyWpdA.exe
  2⤵
  PID:7240
- C:\Windows\System\FYwrWZi.exe
  C:\Windows\System\FYwrWZi.exe
  2⤵
  PID:7304
- C:\Windows\System\UzpAqyg.exe
  C:\Windows\System\UzpAqyg.exe
  2⤵
  PID:7220
- C:\Windows\System\vaDDvNv.exe
  C:\Windows\System\vaDDvNv.exe
  2⤵
  PID:7316
- C:\Windows\System\kjriQEe.exe
  C:\Windows\System\kjriQEe.exe
  2⤵
  PID:7368
- C:\Windows\System\vqLEaOB.exe
  C:\Windows\System\vqLEaOB.exe
  2⤵
  PID:7436
- C:\Windows\System\ESxeDYI.exe
  C:\Windows\System\ESxeDYI.exe
  2⤵
  PID:7384
- C:\Windows\System\ntxmwME.exe
  C:\Windows\System\ntxmwME.exe
  2⤵
  PID:7448
- C:\Windows\System\HpPtplv.exe
  C:\Windows\System\HpPtplv.exe
  2⤵
  PID:7560
- C:\Windows\System\zCFxlrR.exe
  C:\Windows\System\zCFxlrR.exe
  2⤵
  PID:7624
- C:\Windows\System\LlzbCyI.exe
  C:\Windows\System\LlzbCyI.exe
  2⤵
  PID:7412
- C:\Windows\System\tuPNuMq.exe
  C:\Windows\System\tuPNuMq.exe
  2⤵
  PID:6500
- C:\Windows\System\QelNPuT.exe
  C:\Windows\System\QelNPuT.exe
  2⤵
  PID:7724
- C:\Windows\System\TzJsjKX.exe
  C:\Windows\System\TzJsjKX.exe
  2⤵
  PID:7516
- C:\Windows\System\SzlDsvC.exe
  C:\Windows\System\SzlDsvC.exe
  2⤵
  PID:7548
- C:\Windows\System\mrQsupv.exe
  C:\Windows\System\mrQsupv.exe
  2⤵
  PID:7612
- C:\Windows\System\kwajYPr.exe
  C:\Windows\System\kwajYPr.exe
  2⤵
  PID:7676
- C:\Windows\System\wTIDDBp.exe
  C:\Windows\System\wTIDDBp.exe
  2⤵
  PID:7784
- C:\Windows\System\QmTEVJD.exe
  C:\Windows\System\QmTEVJD.exe
  2⤵
  PID:7740
- C:\Windows\System\SWVQOee.exe
  C:\Windows\System\SWVQOee.exe
  2⤵
  PID:7864
- C:\Windows\System\Gflydky.exe
  C:\Windows\System\Gflydky.exe
  2⤵
  PID:7848
- C:\Windows\System\GNwLmqg.exe
  C:\Windows\System\GNwLmqg.exe
  2⤵
  PID:7868
- C:\Windows\System\MLucNxJ.exe
  C:\Windows\System\MLucNxJ.exe
  2⤵
  PID:7900
- C:\Windows\System\bBzzLZO.exe
  C:\Windows\System\bBzzLZO.exe
  2⤵
  PID:7948
- C:\Windows\System\RPENjQR.exe
  C:\Windows\System\RPENjQR.exe
  2⤵
  PID:7980
- C:\Windows\System\fkvPFLt.exe
  C:\Windows\System\fkvPFLt.exe
  2⤵
  PID:7996
- C:\Windows\System\GylgTwR.exe
  C:\Windows\System\GylgTwR.exe
  2⤵
  PID:8024
- C:\Windows\System\FqbPGbE.exe
  C:\Windows\System\FqbPGbE.exe
  2⤵
  PID:8076
- C:\Windows\System\iUgfHBs.exe
  C:\Windows\System\iUgfHBs.exe
  2⤵
  PID:8140
- C:\Windows\System\wdxVzKb.exe
  C:\Windows\System\wdxVzKb.exe
  2⤵
  PID:7208
- C:\Windows\System\QPsdVmK.exe
  C:\Windows\System\QPsdVmK.exe
  2⤵
  PID:7224
- C:\Windows\System\qlWFypw.exe
  C:\Windows\System\qlWFypw.exe
  2⤵
  PID:7336
- C:\Windows\System\hMSnVsM.exe
  C:\Windows\System\hMSnVsM.exe
  2⤵
  PID:8124
- C:\Windows\System\sjlyelX.exe
  C:\Windows\System\sjlyelX.exe
  2⤵
  PID:7288
- C:\Windows\System\MvMDrND.exe
  C:\Windows\System\MvMDrND.exe
  2⤵
  PID:8188
- C:\Windows\System\IDNWpOe.exe
  C:\Windows\System\IDNWpOe.exe
  2⤵
  PID:7380
- C:\Windows\System\AuXZWMN.exe
  C:\Windows\System\AuXZWMN.exe
  2⤵
  PID:7452
- C:\Windows\System\UqpYHkm.exe
  C:\Windows\System\UqpYHkm.exe
  2⤵
  PID:7500
- C:\Windows\System\PowDjzb.exe
  C:\Windows\System\PowDjzb.exe
  2⤵
  PID:7596
- C:\Windows\System\QekSkNK.exe
  C:\Windows\System\QekSkNK.exe
  2⤵
  PID:7640
- C:\Windows\System\lJKQqHb.exe
  C:\Windows\System\lJKQqHb.exe
  2⤵
  PID:7580
- C:\Windows\System\dyweUZV.exe
  C:\Windows\System\dyweUZV.exe
  2⤵
  PID:7820
- C:\Windows\System\QkmwCmt.exe
  C:\Windows\System\QkmwCmt.exe
  2⤵
  PID:7832
- C:\Windows\System\sSPSmGr.exe
  C:\Windows\System\sSPSmGr.exe
  2⤵
  PID:7896
- C:\Windows\System\gOhKftT.exe
  C:\Windows\System\gOhKftT.exe
  2⤵
  PID:8072
- C:\Windows\System\pcCTVlB.exe
  C:\Windows\System\pcCTVlB.exe
  2⤵
  PID:7928
- C:\Windows\System\srBvLmS.exe
  C:\Windows\System\srBvLmS.exe
  2⤵
  PID:8012
- C:\Windows\System\KUZCRYR.exe
  C:\Windows\System\KUZCRYR.exe
  2⤵
  PID:8088
- C:\Windows\System\dteLWna.exe
  C:\Windows\System\dteLWna.exe
  2⤵
  PID:6672
- C:\Windows\System\yyVdBcZ.exe
  C:\Windows\System\yyVdBcZ.exe
  2⤵
  PID:7660
- C:\Windows\System\LgCwPll.exe
  C:\Windows\System\LgCwPll.exe
  2⤵
  PID:7284
- C:\Windows\System\iplJWCw.exe
  C:\Windows\System\iplJWCw.exe
  2⤵
  PID:7672
- C:\Windows\System\YCZPCUu.exe
  C:\Windows\System\YCZPCUu.exe
  2⤵
  PID:8184
- C:\Windows\System\KUtcnBv.exe
  C:\Windows\System\KUtcnBv.exe
  2⤵
  PID:7992
- C:\Windows\System\HaLKDdW.exe
  C:\Windows\System\HaLKDdW.exe
  2⤵
  PID:7836
- C:\Windows\System\zjhfXpi.exe
  C:\Windows\System\zjhfXpi.exe
  2⤵
  PID:8136
- C:\Windows\System\whJgcCT.exe
  C:\Windows\System\whJgcCT.exe
  2⤵
  PID:7236
- C:\Windows\System\tkqlyIa.exe
  C:\Windows\System\tkqlyIa.exe
  2⤵
  PID:7644
- C:\Windows\System\sFbqGBV.exe
  C:\Windows\System\sFbqGBV.exe
  2⤵
  PID:7736
- C:\Windows\System\qBMHxFm.exe
  C:\Windows\System\qBMHxFm.exe
  2⤵
  PID:8240
- C:\Windows\System\iemyVPW.exe
  C:\Windows\System\iemyVPW.exe
  2⤵
  PID:8256
- C:\Windows\System\ZsOAOsk.exe
  C:\Windows\System\ZsOAOsk.exe
  2⤵
  PID:8272
- C:\Windows\System\erLIyVh.exe
  C:\Windows\System\erLIyVh.exe
  2⤵
  PID:8288
- C:\Windows\System\gbXiyZF.exe
  C:\Windows\System\gbXiyZF.exe
  2⤵
  PID:8304
- C:\Windows\System\DdvYKtJ.exe
  C:\Windows\System\DdvYKtJ.exe
  2⤵
  PID:8320
- C:\Windows\System\KzgaSPh.exe
  C:\Windows\System\KzgaSPh.exe
  2⤵
  PID:8336
- C:\Windows\System\nZnubKq.exe
  C:\Windows\System\nZnubKq.exe
  2⤵
  PID:8352
- C:\Windows\System\ENpywyT.exe
  C:\Windows\System\ENpywyT.exe
  2⤵
  PID:8368
- C:\Windows\System\jOTHKyI.exe
  C:\Windows\System\jOTHKyI.exe
  2⤵
  PID:8384
- C:\Windows\System\xUrJrCu.exe
  C:\Windows\System\xUrJrCu.exe
  2⤵
  PID:8400
- C:\Windows\System\ikQCMJk.exe
  C:\Windows\System\ikQCMJk.exe
  2⤵
  PID:8416
- C:\Windows\System\ebejFFS.exe
  C:\Windows\System\ebejFFS.exe
  2⤵
  PID:8436
- C:\Windows\System\VUxNKHE.exe
  C:\Windows\System\VUxNKHE.exe
  2⤵
  PID:8452
- C:\Windows\System\NegPRWk.exe
  C:\Windows\System\NegPRWk.exe
  2⤵
  PID:8468
- C:\Windows\System\BTkdqMF.exe
  C:\Windows\System\BTkdqMF.exe
  2⤵
  PID:8484
- C:\Windows\System\ntCNaNL.exe
  C:\Windows\System\ntCNaNL.exe
  2⤵
  PID:8500
- C:\Windows\System\eUJnKRR.exe
  C:\Windows\System\eUJnKRR.exe
  2⤵
  PID:8516
- C:\Windows\System\cxzipLl.exe
  C:\Windows\System\cxzipLl.exe
  2⤵
  PID:8532
- C:\Windows\System\sDAPviy.exe
  C:\Windows\System\sDAPviy.exe
  2⤵
  PID:8548
- C:\Windows\System\TztvnSG.exe
  C:\Windows\System\TztvnSG.exe
  2⤵
  PID:8564
- C:\Windows\System\FEUEybZ.exe
  C:\Windows\System\FEUEybZ.exe
  2⤵
  PID:8580
- C:\Windows\System\PvQvttc.exe
  C:\Windows\System\PvQvttc.exe
  2⤵
  PID:8596
- C:\Windows\System\bzTNLrT.exe
  C:\Windows\System\bzTNLrT.exe
  2⤵
  PID:8612
- C:\Windows\System\UjEuosI.exe
  C:\Windows\System\UjEuosI.exe
  2⤵
  PID:8628
- C:\Windows\System\jyvLRQY.exe
  C:\Windows\System\jyvLRQY.exe
  2⤵
  PID:8644
- C:\Windows\System\BzTtcRA.exe
  C:\Windows\System\BzTtcRA.exe
  2⤵
  PID:8660
- C:\Windows\System\YUcQwYg.exe
  C:\Windows\System\YUcQwYg.exe
  2⤵
  PID:8676
- C:\Windows\System\pksJaqc.exe
  C:\Windows\System\pksJaqc.exe
  2⤵
  PID:8692
- C:\Windows\System\RnNzKah.exe
  C:\Windows\System\RnNzKah.exe
  2⤵
  PID:8708
- C:\Windows\System\TKKsrMj.exe
  C:\Windows\System\TKKsrMj.exe
  2⤵
  PID:8724
- C:\Windows\System\BVgnoxJ.exe
  C:\Windows\System\BVgnoxJ.exe
  2⤵
  PID:8740
- C:\Windows\System\pMJzsuo.exe
  C:\Windows\System\pMJzsuo.exe
  2⤵
  PID:8756
- C:\Windows\System\hUdjfZB.exe
  C:\Windows\System\hUdjfZB.exe
  2⤵
  PID:8772
- C:\Windows\System\tOgahAT.exe
  C:\Windows\System\tOgahAT.exe
  2⤵
  PID:8788
- C:\Windows\System\sLbNocq.exe
  C:\Windows\System\sLbNocq.exe
  2⤵
  PID:8804
- C:\Windows\System\iUEPTXY.exe
  C:\Windows\System\iUEPTXY.exe
  2⤵
  PID:8820
- C:\Windows\System\yZCCwHp.exe
  C:\Windows\System\yZCCwHp.exe
  2⤵
  PID:8836
- C:\Windows\System\fMjgNWp.exe
  C:\Windows\System\fMjgNWp.exe
  2⤵
  PID:8852
- C:\Windows\System\QhPrXAv.exe
  C:\Windows\System\QhPrXAv.exe
  2⤵
  PID:8868
- C:\Windows\System\hsVLqmx.exe
  C:\Windows\System\hsVLqmx.exe
  2⤵
  PID:8884
- C:\Windows\System\QyCbusc.exe
  C:\Windows\System\QyCbusc.exe
  2⤵
  PID:8900
- C:\Windows\System\nfVVugb.exe
  C:\Windows\System\nfVVugb.exe
  2⤵
  PID:8916
- C:\Windows\System\yfmwelD.exe
  C:\Windows\System\yfmwelD.exe
  2⤵
  PID:8932
- C:\Windows\System\ZEaUUsi.exe
  C:\Windows\System\ZEaUUsi.exe
  2⤵
  PID:8948
- C:\Windows\System\lWQqmvJ.exe
  C:\Windows\System\lWQqmvJ.exe
  2⤵
  PID:8964
- C:\Windows\System\ZSAQOSg.exe
  C:\Windows\System\ZSAQOSg.exe
  2⤵
  PID:8980
- C:\Windows\System\aBGGnEW.exe
  C:\Windows\System\aBGGnEW.exe
  2⤵
  PID:8996
- C:\Windows\System\XxuvnRh.exe
  C:\Windows\System\XxuvnRh.exe
  2⤵
  PID:9012
- C:\Windows\System\yCbffXv.exe
  C:\Windows\System\yCbffXv.exe
  2⤵
  PID:9028
- C:\Windows\System\omhRDwR.exe
  C:\Windows\System\omhRDwR.exe
  2⤵
  PID:9044
- C:\Windows\System\hJmyqQd.exe
  C:\Windows\System\hJmyqQd.exe
  2⤵
  PID:9060
- C:\Windows\System\nbtdHNo.exe
  C:\Windows\System\nbtdHNo.exe
  2⤵
  PID:9076
- C:\Windows\System\WcDIgYb.exe
  C:\Windows\System\WcDIgYb.exe
  2⤵
  PID:9092
- C:\Windows\System\EPegAgn.exe
  C:\Windows\System\EPegAgn.exe
  2⤵
  PID:9108
- C:\Windows\System\EGqLhFr.exe
  C:\Windows\System\EGqLhFr.exe
  2⤵
  PID:9124
- C:\Windows\System\MgmJkHY.exe
  C:\Windows\System\MgmJkHY.exe
  2⤵
  PID:9140
- C:\Windows\System\SUfphNo.exe
  C:\Windows\System\SUfphNo.exe
  2⤵
  PID:9156
- C:\Windows\System\xpnyfYf.exe
  C:\Windows\System\xpnyfYf.exe
  2⤵
  PID:9172
- C:\Windows\System\EbZuFFy.exe
  C:\Windows\System\EbZuFFy.exe
  2⤵
  PID:9188
- C:\Windows\System\qDuDlAW.exe
  C:\Windows\System\qDuDlAW.exe
  2⤵
  PID:9204
- C:\Windows\System\margLuK.exe
  C:\Windows\System\margLuK.exe
  2⤵
  PID:8172
- C:\Windows\System\vHvmOqN.exe
  C:\Windows\System\vHvmOqN.exe
  2⤵
  PID:7496
- C:\Windows\System\oeFpdqg.exe
  C:\Windows\System\oeFpdqg.exe
  2⤵
  PID:7204
- C:\Windows\System\iGJYFda.exe
  C:\Windows\System\iGJYFda.exe
  2⤵
  PID:8312
- C:\Windows\System\EEBpFCl.exe
  C:\Windows\System\EEBpFCl.exe
  2⤵
  PID:8344
- C:\Windows\System\YKaCIaX.exe
  C:\Windows\System\YKaCIaX.exe
  2⤵
  PID:8360
- C:\Windows\System\FhkTNed.exe
  C:\Windows\System\FhkTNed.exe
  2⤵
  PID:8392
- C:\Windows\System\dgPsEDB.exe
  C:\Windows\System\dgPsEDB.exe
  2⤵
  PID:8448
- C:\Windows\System\BovKXgK.exe
  C:\Windows\System\BovKXgK.exe
  2⤵
  PID:8512
- C:\Windows\System\civfBwm.exe
  C:\Windows\System\civfBwm.exe
  2⤵
  PID:8492
- C:\Windows\System\qYHuDeM.exe
  C:\Windows\System\qYHuDeM.exe
  2⤵
  PID:8576
- C:\Windows\System\VcCytxg.exe
  C:\Windows\System\VcCytxg.exe
  2⤵
  PID:8668
- C:\Windows\System\EqSGBnw.exe
  C:\Windows\System\EqSGBnw.exe
  2⤵
  PID:8460
- C:\Windows\System\zUCeHan.exe
  C:\Windows\System\zUCeHan.exe
  2⤵
  PID:8620
- C:\Windows\System\vfiYikp.exe
  C:\Windows\System\vfiYikp.exe
  2⤵
  PID:8736
- C:\Windows\System\ymkeFuI.exe
  C:\Windows\System\ymkeFuI.exe
  2⤵
  PID:8768
- C:\Windows\System\vFklOlU.exe
  C:\Windows\System\vFklOlU.exe
  2⤵
  PID:8800
- C:\Windows\System\TlTGiYE.exe
  C:\Windows\System\TlTGiYE.exe
  2⤵
  PID:8624
- C:\Windows\System\QjCWsiV.exe
  C:\Windows\System\QjCWsiV.exe
  2⤵
  PID:8720
- C:\Windows\System\rXjvutN.exe
  C:\Windows\System\rXjvutN.exe
  2⤵
  PID:8784
- C:\Windows\System\bvoXqGN.exe
  C:\Windows\System\bvoXqGN.exe
  2⤵
  PID:8844
- C:\Windows\System\CMTmawY.exe
  C:\Windows\System\CMTmawY.exe
  2⤵
  PID:8892
- C:\Windows\System\kKrMDEY.exe
  C:\Windows\System\kKrMDEY.exe
  2⤵
  PID:8956
- C:\Windows\System\xxNhDXV.exe
  C:\Windows\System\xxNhDXV.exe
  2⤵
  PID:8992
- C:\Windows\System\FWYlWkm.exe
  C:\Windows\System\FWYlWkm.exe
  2⤵
  PID:9056
- C:\Windows\System\IiskAYm.exe
  C:\Windows\System\IiskAYm.exe
  2⤵
  PID:9084
- C:\Windows\System\aOcaECW.exe
  C:\Windows\System\aOcaECW.exe
  2⤵
  PID:8876
- C:\Windows\System\FzvoGXs.exe
  C:\Windows\System\FzvoGXs.exe
  2⤵
  PID:9100
- C:\Windows\System\axVliPL.exe
  C:\Windows\System\axVliPL.exe
  2⤵
  PID:9036
- C:\Windows\System\BjEOiFP.exe
  C:\Windows\System\BjEOiFP.exe
  2⤵
  PID:9148
- C:\Windows\System\CyBJckU.exe
  C:\Windows\System\CyBJckU.exe
  2⤵
  PID:9168
- C:\Windows\System\zROjALu.exe
  C:\Windows\System\zROjALu.exe
  2⤵
  PID:9212
- C:\Windows\System\panlUEp.exe
  C:\Windows\System\panlUEp.exe
  2⤵
  PID:8280
- C:\Windows\System\mhbjeEi.exe
  C:\Windows\System\mhbjeEi.exe
  2⤵
  PID:8328
- C:\Windows\System\pRxtsqk.exe
  C:\Windows\System\pRxtsqk.exe
  2⤵
  PID:8508
- C:\Windows\System\HVZcCXN.exe
  C:\Windows\System\HVZcCXN.exe
  2⤵
  PID:8556
- C:\Windows\System\WNuVceq.exe
  C:\Windows\System\WNuVceq.exe
  2⤵
  PID:8496
- C:\Windows\System\rttmzUP.exe
  C:\Windows\System\rttmzUP.exe
  2⤵
  PID:8524
- C:\Windows\System\TXuCukB.exe
  C:\Windows\System\TXuCukB.exe
  2⤵
  PID:8588
- C:\Windows\System\zRYcKFj.exe
  C:\Windows\System\zRYcKFj.exe
  2⤵
  PID:8716
- C:\Windows\System\AQRTuzd.exe
  C:\Windows\System\AQRTuzd.exe
  2⤵
  PID:8560
- C:\Windows\System\hltrBxA.exe
  C:\Windows\System\hltrBxA.exe
  2⤵
  PID:8316
- C:\Windows\System\CmTZDqa.exe
  C:\Windows\System\CmTZDqa.exe
  2⤵
  PID:8432
- C:\Windows\System\MVIyIkN.exe
  C:\Windows\System\MVIyIkN.exe
  2⤵
  PID:9200
- C:\Windows\System\zyBKrOg.exe
  C:\Windows\System\zyBKrOg.exe
  2⤵
  PID:8924
- C:\Windows\System\CqCtvxL.exe
  C:\Windows\System\CqCtvxL.exe
  2⤵
  PID:8828
- C:\Windows\System\MpwemdC.exe
  C:\Windows\System\MpwemdC.exe
  2⤵
  PID:9052
- C:\Windows\System\ohxRTwN.exe
  C:\Windows\System\ohxRTwN.exe
  2⤵
  PID:8912
- C:\Windows\System\pIAvhPb.exe
  C:\Windows\System\pIAvhPb.exe
  2⤵
  PID:9164
- C:\Windows\System\HlKUlph.exe
  C:\Windows\System\HlKUlph.exe
  2⤵
  PID:8408
- C:\Windows\System\BkPbaqC.exe
  C:\Windows\System\BkPbaqC.exe
  2⤵
  PID:8732
- C:\Windows\System\UPjpxyU.exe
  C:\Windows\System\UPjpxyU.exe
  2⤵
  PID:9196
- C:\Windows\System\qbzObzu.exe
  C:\Windows\System\qbzObzu.exe
  2⤵
  PID:9004
- C:\Windows\System\YCCrLfN.exe
  C:\Windows\System\YCCrLfN.exe
  2⤵
  PID:8960
- C:\Windows\System\YfaJKFa.exe
  C:\Windows\System\YfaJKFa.exe
  2⤵
  PID:9040
- C:\Windows\System\VIbmMWW.exe
  C:\Windows\System\VIbmMWW.exe
  2⤵
  PID:8412
- C:\Windows\System\zdlMaEp.exe
  C:\Windows\System\zdlMaEp.exe
  2⤵
  PID:8284
- C:\Windows\System\lYUbHCb.exe
  C:\Windows\System\lYUbHCb.exe
  2⤵
  PID:9120
- C:\Windows\System\FGdiJRx.exe
  C:\Windows\System\FGdiJRx.exe
  2⤵
  PID:8860
- C:\Windows\System\wGrOndL.exe
  C:\Windows\System\wGrOndL.exe
  2⤵
  PID:8908
- C:\Windows\System\brxjIlQ.exe
  C:\Windows\System\brxjIlQ.exe
  2⤵
  PID:9220
- C:\Windows\System\ltSDBXi.exe
  C:\Windows\System\ltSDBXi.exe
  2⤵
  PID:9236
- C:\Windows\System\vJWLDaH.exe
  C:\Windows\System\vJWLDaH.exe
  2⤵
  PID:9252
- C:\Windows\System\PBlBXsC.exe
  C:\Windows\System\PBlBXsC.exe
  2⤵
  PID:9268
- C:\Windows\System\taOnYWs.exe
  C:\Windows\System\taOnYWs.exe
  2⤵
  PID:9284
- C:\Windows\System\fxplfOe.exe
  C:\Windows\System\fxplfOe.exe
  2⤵
  PID:9300
- C:\Windows\System\UaRbOrY.exe
  C:\Windows\System\UaRbOrY.exe
  2⤵
  PID:9316
- C:\Windows\System\doGpxMl.exe
  C:\Windows\System\doGpxMl.exe
  2⤵
  PID:9332
- C:\Windows\System\oHIWLWV.exe
  C:\Windows\System\oHIWLWV.exe
  2⤵
  PID:9348
- C:\Windows\System\gqcMhHd.exe
  C:\Windows\System\gqcMhHd.exe
  2⤵
  PID:9364
- C:\Windows\System\XPkuseu.exe
  C:\Windows\System\XPkuseu.exe
  2⤵
  PID:9380
- C:\Windows\System\uoaQcVc.exe
  C:\Windows\System\uoaQcVc.exe
  2⤵
  PID:9396
- C:\Windows\System\HqIIObC.exe
  C:\Windows\System\HqIIObC.exe
  2⤵
  PID:9412
- C:\Windows\System\GCnMWaM.exe
  C:\Windows\System\GCnMWaM.exe
  2⤵
  PID:9428
- C:\Windows\System\dmcuOXm.exe
  C:\Windows\System\dmcuOXm.exe
  2⤵
  PID:9444
- C:\Windows\System\ILzfTyj.exe
  C:\Windows\System\ILzfTyj.exe
  2⤵
  PID:9460
- C:\Windows\System\oKROwfB.exe
  C:\Windows\System\oKROwfB.exe
  2⤵
  PID:9476
- C:\Windows\System\qRNNZPT.exe
  C:\Windows\System\qRNNZPT.exe
  2⤵
  PID:9492
- C:\Windows\System\imUmQuY.exe
  C:\Windows\System\imUmQuY.exe
  2⤵
  PID:9508
- C:\Windows\System\fwxsHsO.exe
  C:\Windows\System\fwxsHsO.exe
  2⤵
  PID:9524
- C:\Windows\System\vdkoUnk.exe
  C:\Windows\System\vdkoUnk.exe
  2⤵
  PID:9540
- C:\Windows\System\ntROjMO.exe
  C:\Windows\System\ntROjMO.exe
  2⤵
  PID:9556
- C:\Windows\System\fhaDpcZ.exe
  C:\Windows\System\fhaDpcZ.exe
  2⤵
  PID:9572
- C:\Windows\System\KyhairV.exe
  C:\Windows\System\KyhairV.exe
  2⤵
  PID:9588
- C:\Windows\System\eWasahi.exe
  C:\Windows\System\eWasahi.exe
  2⤵
  PID:9604
- C:\Windows\System\IxolNdG.exe
  C:\Windows\System\IxolNdG.exe
  2⤵
  PID:9620
- C:\Windows\System\rTVuXzL.exe
  C:\Windows\System\rTVuXzL.exe
  2⤵
  PID:9636
- C:\Windows\System\IBNeFEb.exe
  C:\Windows\System\IBNeFEb.exe
  2⤵
  PID:9652
- C:\Windows\System\baSdUkj.exe
  C:\Windows\System\baSdUkj.exe
  2⤵
  PID:9668
- C:\Windows\System\MNjSUpB.exe
  C:\Windows\System\MNjSUpB.exe
  2⤵
  PID:9684
- C:\Windows\System\ejXSTEG.exe
  C:\Windows\System\ejXSTEG.exe
  2⤵
  PID:9700
- C:\Windows\System\wMifGUF.exe
  C:\Windows\System\wMifGUF.exe
  2⤵
  PID:9716
- C:\Windows\System\UYrwPgr.exe
  C:\Windows\System\UYrwPgr.exe
  2⤵
  PID:9732
- C:\Windows\System\puyfmkW.exe
  C:\Windows\System\puyfmkW.exe
  2⤵
  PID:9748
- C:\Windows\System\jsCrtPL.exe
  C:\Windows\System\jsCrtPL.exe
  2⤵
  PID:9764
- C:\Windows\System\mkiTpdf.exe
  C:\Windows\System\mkiTpdf.exe
  2⤵
  PID:9780
- C:\Windows\System\Kbbxpah.exe
  C:\Windows\System\Kbbxpah.exe
  2⤵
  PID:9796
- C:\Windows\System\sYNalpo.exe
  C:\Windows\System\sYNalpo.exe
  2⤵
  PID:9812
- C:\Windows\System\KYjmrLr.exe
  C:\Windows\System\KYjmrLr.exe
  2⤵
  PID:9828
- C:\Windows\System\PziTEjJ.exe
  C:\Windows\System\PziTEjJ.exe
  2⤵
  PID:9848
- C:\Windows\System\GVCMayS.exe
  C:\Windows\System\GVCMayS.exe
  2⤵
  PID:9864
- C:\Windows\System\pCEtbTb.exe
  C:\Windows\System\pCEtbTb.exe
  2⤵
  PID:9880
- C:\Windows\System\ITswCqk.exe
  C:\Windows\System\ITswCqk.exe
  2⤵
  PID:9896
- C:\Windows\System\JvRcUri.exe
  C:\Windows\System\JvRcUri.exe
  2⤵
  PID:9912
- C:\Windows\System\rYFIyWB.exe
  C:\Windows\System\rYFIyWB.exe
  2⤵
  PID:9928
- C:\Windows\System\OzWDGyG.exe
  C:\Windows\System\OzWDGyG.exe
  2⤵
  PID:9948
- C:\Windows\System\IFualMW.exe
  C:\Windows\System\IFualMW.exe
  2⤵
  PID:9976
- C:\Windows\System\WSaRzHu.exe
  C:\Windows\System\WSaRzHu.exe
  2⤵
  PID:10064
- C:\Windows\System\cSAqcGa.exe
  C:\Windows\System\cSAqcGa.exe
  2⤵
  PID:10080
- C:\Windows\System\dTVoulD.exe
  C:\Windows\System\dTVoulD.exe
  2⤵
  PID:10096
- C:\Windows\System\VgGVjHl.exe
  C:\Windows\System\VgGVjHl.exe
  2⤵
  PID:10112
- C:\Windows\System\fkqJkzt.exe
  C:\Windows\System\fkqJkzt.exe
  2⤵
  PID:10128
- C:\Windows\System\HEtvWwh.exe
  C:\Windows\System\HEtvWwh.exe
  2⤵
  PID:10144
- C:\Windows\System\dBUUgWs.exe
  C:\Windows\System\dBUUgWs.exe
  2⤵
  PID:10160
- C:\Windows\System\FharUEG.exe
  C:\Windows\System\FharUEG.exe
  2⤵
  PID:10176
- C:\Windows\System\ZeBBExE.exe
  C:\Windows\System\ZeBBExE.exe
  2⤵
  PID:10192
- C:\Windows\System\wvMJYll.exe
  C:\Windows\System\wvMJYll.exe
  2⤵
  PID:10208
- C:\Windows\System\EVsImCN.exe
  C:\Windows\System\EVsImCN.exe
  2⤵
  PID:10224
- C:\Windows\System\aBaOqvM.exe
  C:\Windows\System\aBaOqvM.exe
  2⤵
  PID:9024
- C:\Windows\System\YXjbsvU.exe
  C:\Windows\System\YXjbsvU.exe
  2⤵
  PID:9276
- C:\Windows\System\lFWQSEC.exe
  C:\Windows\System\lFWQSEC.exe
  2⤵
  PID:9312
- C:\Windows\System\MWpUzKB.exe
  C:\Windows\System\MWpUzKB.exe
  2⤵
  PID:9232
- C:\Windows\System\TJwzzyG.exe
  C:\Windows\System\TJwzzyG.exe
  2⤵
  PID:9264
- C:\Windows\System\PFYMnJL.exe
  C:\Windows\System\PFYMnJL.exe
  2⤵
  PID:9376
- C:\Windows\System\WWLLjTp.exe
  C:\Windows\System\WWLLjTp.exe
  2⤵
  PID:9228
- C:\Windows\System\SCEXjPt.exe
  C:\Windows\System\SCEXjPt.exe
  2⤵
  PID:9296
- C:\Windows\System\KfOqWCr.exe
  C:\Windows\System\KfOqWCr.exe
  2⤵
  PID:9472
- C:\Windows\System\gyiLjzZ.exe
  C:\Windows\System\gyiLjzZ.exe
  2⤵
  PID:9324
- C:\Windows\System\dMXBked.exe
  C:\Windows\System\dMXBked.exe
  2⤵
  PID:9568
- C:\Windows\System\iAeZxxk.exe
  C:\Windows\System\iAeZxxk.exe
  2⤵
  PID:9392
- C:\Windows\System\REmMGoH.exe
  C:\Windows\System\REmMGoH.exe
  2⤵
  PID:9600
- C:\Windows\System\TmOguIF.exe
  C:\Windows\System\TmOguIF.exe
  2⤵
  PID:9664
- C:\Windows\System\YpWHxpA.exe
  C:\Windows\System\YpWHxpA.exe
  2⤵
  PID:9520
- C:\Windows\System\NEYspgL.exe
  C:\Windows\System\NEYspgL.exe
  2⤵
  PID:9728
- C:\Windows\System\ApMnILk.exe
  C:\Windows\System\ApMnILk.exe
  2⤵
  PID:9756
- C:\Windows\System\kiCnwbT.exe
  C:\Windows\System\kiCnwbT.exe
  2⤵
  PID:9616
- C:\Windows\System\iOrkQLq.exe
  C:\Windows\System\iOrkQLq.exe
  2⤵
  PID:9680
- C:\Windows\System\GluDXiA.exe
  C:\Windows\System\GluDXiA.exe
  2⤵
  PID:9740
- C:\Windows\System\BKctDbD.exe
  C:\Windows\System\BKctDbD.exe
  2⤵
  PID:9804
- C:\Windows\System\xqXJqBr.exe
  C:\Windows\System\xqXJqBr.exe
  2⤵
  PID:9836
- C:\Windows\System\TejHkkY.exe
  C:\Windows\System\TejHkkY.exe
  2⤵
  PID:9888
- C:\Windows\System\ONfYSXX.exe
  C:\Windows\System\ONfYSXX.exe
  2⤵
  PID:9904
- C:\Windows\System\UdySbpZ.exe
  C:\Windows\System\UdySbpZ.exe
  2⤵
  PID:9940
- C:\Windows\System\kgDijZn.exe
  C:\Windows\System\kgDijZn.exe
  2⤵
  PID:9968
- C:\Windows\System\OauSgtP.exe
  C:\Windows\System\OauSgtP.exe
  2⤵
  PID:9992
- C:\Windows\System\lRnnlGe.exe
  C:\Windows\System\lRnnlGe.exe
  2⤵
  PID:10008
- C:\Windows\System\rFjnYmd.exe
  C:\Windows\System\rFjnYmd.exe
  2⤵
  PID:10024
- C:\Windows\System\IxiyLza.exe
  C:\Windows\System\IxiyLza.exe
  2⤵
  PID:10052
- C:\Windows\System\QEcpnjg.exe
  C:\Windows\System\QEcpnjg.exe
  2⤵
  PID:10104
- C:\Windows\System\eZzsfuD.exe
  C:\Windows\System\eZzsfuD.exe
  2⤵
  PID:10092
- C:\Windows\System\ovjpYpY.exe
  C:\Windows\System\ovjpYpY.exe
  2⤵
  PID:10124
- C:\Windows\System\zbEated.exe
  C:\Windows\System\zbEated.exe
  2⤵
  PID:10120
- C:\Windows\System\xpVAeFs.exe
  C:\Windows\System\xpVAeFs.exe
  2⤵
  PID:10232
- C:\Windows\System\HpepAop.exe
  C:\Windows\System\HpepAop.exe
  2⤵
  PID:9308
- C:\Windows\System\GvwdVXJ.exe
  C:\Windows\System\GvwdVXJ.exe
  2⤵
  PID:8752
- C:\Windows\System\uhYAWww.exe
  C:\Windows\System\uhYAWww.exe
  2⤵
  PID:9408
- C:\Windows\System\QPhoFSh.exe
  C:\Windows\System\QPhoFSh.exe
  2⤵
  PID:9340
- C:\Windows\System\KWyeQIR.exe
  C:\Windows\System\KWyeQIR.exe
  2⤵
  PID:9504
- C:\Windows\System\TuLqWEj.exe
  C:\Windows\System\TuLqWEj.exe
  2⤵
  PID:9356
- C:\Windows\System\RGbWcqM.exe
  C:\Windows\System\RGbWcqM.exe
  2⤵
  PID:9488
- C:\Windows\System\MqFRFJh.exe
  C:\Windows\System\MqFRFJh.exe
  2⤵
  PID:9724
- C:\Windows\System\cLKWJNz.exe
  C:\Windows\System\cLKWJNz.exe
  2⤵
  PID:9772
- C:\Windows\System\Thvvgly.exe
  C:\Windows\System\Thvvgly.exe
  2⤵
  PID:9776
- C:\Windows\System\yNimsUx.exe
  C:\Windows\System\yNimsUx.exe
  2⤵
  PID:9876
- C:\Windows\System\BujQEEH.exe
  C:\Windows\System\BujQEEH.exe
  2⤵
  PID:9972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FKCCqzG.exe

Filesize
1.7MB

MD5
a752bc85d1a082ed35dcf7a348e5e69b

SHA1
577d757b417f54f4fe9aa9a1e121b2ddc19b9920

SHA256
ae6c3b28c88f2b58b9b40a3a2ff498383c16c7d5a181ad7f37e2645c9915b148

SHA512
2f38542f5bfd10ca5f3b7e85c263d47008169b337eecde4e035b82115355514887ca701911fdf6aff96da6788b428397593a8d80928cca9a28bcec7ece05866a

Download Submit
C:\Windows\system\FmHxZnd.exe

Filesize
1.7MB

MD5
4b9ab18bf102592143aefe0bb3e41072

SHA1
20734bec482edae6f797829887438c34d7f55213

SHA256
c3be6b14c79fa548431318666b85ec68d9c8939a6de1535e307d27eaff89019e

SHA512
477801bad9cdebc47697cda28e83fe264cc78c720e29635b53e9ede96ae49ea2c922afd9a0717e8ce889ca675ead60450dd7ebc561a32be390a950ce62ab907d

Download Submit
C:\Windows\system\NrViktB.exe

Filesize
1.7MB

MD5
d82e799502d1589f2f3907f87a3cfa4f

SHA1
89ff0134de28523bdb250aea810e97d54ad911bf

SHA256
01ca57947170047b6e8bf975a9729d42403cdc493fe37b5c2bc960b55a78e641

SHA512
6eaab82ecd798092868bba4dc4ce70485d07125e9a5b44310e3f2dd6f6a71c1637739570ccd8b597e2effa8683d6a6acd0aff2ad5d4cdd310e8ae87464052bd6

Download Submit
C:\Windows\system\OSwnpPc.exe

Filesize
1.7MB

MD5
b00a6f67606912acb2e9cbfbed408e38

SHA1
af462dc4b0d68720a12bdfab8fcbd906713e0b74

SHA256
0aea7b335853cf2b8d104a69ffe4ec7ec08d4d1cd23b63d018c31d2d8cec4d38

SHA512
325e7616c1a6898a7d6f80409cfb098e0dc7f9e0c866aee975a05b6d36125f16dd3e74027d57b0188519d167bd44b08a2521720e1494df619a88c0a1af14e9b2

Download Submit
C:\Windows\system\OeFfgQl.exe

Filesize
1.7MB

MD5
f445db8fa0bddd8aa244f26144b2dd75

SHA1
8b65e9d2df503baa7a732acc3c9ef51017fdaf93

SHA256
c385e15245cac98114cc081e44f3c9fc9b7326be12544f13b2a4bf9754c54e6d

SHA512
09f5f362d9d8d7a0b0b5c01b21c32b2ee4f2f9ba9777e137cb586b28843ec5dbf8458018919cdf7e34141da07e5b0ea6d4c5e9ff5bce76d3b5b05bb5299ae2d9

Download Submit
C:\Windows\system\QCVFhZJ.exe

Filesize
1.7MB

MD5
ecff2bf72dc9bf6237c47407d0bd7564

SHA1
169ace099618e3afacc910e16ce68a8bd1bf59e1

SHA256
d38c5b9591597d269d185cb912cec2f621a3b9af5eac4c4bd5eb65390ebe9da4

SHA512
602c0a0596c972f6414657a5025277eb6ecdfa77439b48132550dce3c6dec0f4d09810772a16310e943ebc19a25ce5bc541a55cfe7fb6033e2699b4f67476384

Download Submit
C:\Windows\system\Rcojkqb.exe

Filesize
1.7MB

MD5
4797878bbd32c2787aec768a47130f72

SHA1
fdcdf74ff537814558be05bd97f06427a9d0959d

SHA256
0e5e207a24ca2d5941770551c3e761fbe476202e179c85d5d54bf64ee9701b44

SHA512
007148c6f73f208c79dc1d56cc09110d94f075cf7c66326da1de94c1cceafbc6262ffad50129dd48e13ed2dd7713c4b06608636f3b4c7593fc6eebcebbf90f2f

Download Submit
C:\Windows\system\SOjIrMd.exe

Filesize
1.7MB

MD5
867b40b5a1603ed83b99d41f5221fbb9

SHA1
3aa2890e028cf9bafc2e9fa81adf4c37c13f9031

SHA256
5bb1265f255c95067717e5d43ba2542497a55d21bdb05d5f2eb5c8375881fdb0

SHA512
5856ac632d7140cc7eb6da765e5da2953b12fda0bbdba1d09d3a0908daa0af495e4bd4c3204bbe31f5c03dbbf288219293fb9ef4d500bb8cd007e94d78039533

Download Submit
C:\Windows\system\WQnaumW.exe

Filesize
1.7MB

MD5
8f1924b0473991ee3da7ec49668dcb4d

SHA1
01fa357321792d746c0ed2a2ffe377c3f7ab8eaa

SHA256
67cc4f2fc742d9354980417f18678bd99a66049dfbf311c7eca99a5b761e140b

SHA512
ddfd92dfe3cf8f48e65451e83a071e04c2914f76a2ffee78ead29e3d6f65b5c6a963a703d2792f462154d6d47664d0603a29c0d405e80ccf99a0f5b74def3202

Download Submit
C:\Windows\system\WmcWTFp.exe

Filesize
1.7MB

MD5
55daa160ba99963c946146ad03d69008

SHA1
9a9d78599b349e71321210a9d3fecc49ee263c82

SHA256
c1b887fb4b4127dbffc6d72a269d448c15d5b808a4a9de5bf6f7b1eb969923ac

SHA512
61270721e5107095db851f8fb2b2ac5c58222d962e2c64b82f0344eb31d378672de81ae5870d69605130212a8bf372b700ba615a3a71b773091bed9063adf44b

Download Submit
C:\Windows\system\ZQWCBDc.exe

Filesize
1.7MB

MD5
4bbadf3845706eb622d0428c793df602

SHA1
3610d8306c60500284ce2c2793fdbdd55ed5e80e

SHA256
311b41e0a6b33a2dda601aa335dacc63388eab6d85315756f77343ccdbed0839

SHA512
9eaca1c6b4a4bc0443bf45f889712593097f4161a3638e46db4dd799f184f942cb293f5b9f3080e08d9bc5241f3360eeb7bdf992079c6e728f578c166b0e67b6

Download Submit
C:\Windows\system\ZRPPpmw.exe

Filesize
1.7MB

MD5
ddc3a2e62a0384f2c5fc2eb5d846e4f7

SHA1
a857598d57fbdcdaf910ea4b7e827f4b9c47a3bc

SHA256
8fad9cf965e1b9fbc8afb96936017fd9b6c79253c1c832503f81c1e38207f4f7

SHA512
1ba187853b08b4e89628267cab8561d3cd2e750b3d497c025e83a94647e5e910f5e24fcacd03687d37e716ea5fed5da9e4275813e92581c8037dd10b3e7eb71a

Download Submit
C:\Windows\system\bBhqBWm.exe

Filesize
1.7MB

MD5
1c1707d67b934cd9c3546d6249cd6e57

SHA1
5c3b8bf2b1af9c47661b9d7a566f4a3862f23954

SHA256
0162454a042740b47524083ea53662cb7d14e4381028a7387ed7e7fbbdd16244

SHA512
f50e2c78c1cd6d33069cc28267982cb13a27696a9d9d79086711dcee0d20a0531e357bf964edc924e0fecca0ea2ce38819575b2c2903409e1ab4d5be29554ff3

Download Submit
C:\Windows\system\dLWOweN.exe

Filesize
1.7MB

MD5
e66da0c1682298c524cff903550154be

SHA1
bc778fce2a2dfb2c29c9c20c6d4a3eb7b963fc5a

SHA256
c5e13987b8ee9f84a6cfc66a25dbeabfe0866dd1e4b610599d822d9e32916f9e

SHA512
a35ae7bde78d78b08affe9b0a31fc72ca06deb8d971c10a5abf20c2c8cdba5fa1371add6077c34b9470fdeab8f67a85bb389db38018fb4921a49c0952eb4d2be

Download Submit
C:\Windows\system\hDydrbK.exe

Filesize
1.7MB

MD5
6c58e1c8c107e7b6d500ee1a1044f6f2

SHA1
415cc98b8f38f6307802597708ca09cab0c03a68

SHA256
3a6a786198f438f7cdbe2523671247fc6bd3ddfa1830751a0240309f3cc77b0f

SHA512
159f40d9d47c833dd2b822e65dc86efd3e5c8b831803850afc07d75c326c6563a6a7b4292f2f8d4e8f1a34480b3b56d30a5b886ad33b9237de9c79497bf0861a

Download Submit
C:\Windows\system\hQkJXnQ.exe

Filesize
1.7MB

MD5
dbce8b635e25650356f10516f2d51e23

SHA1
04dec6162acf05186e941b4efdb20b5d42c000e7

SHA256
d94f5ed3664226ac68b86c459dd7caab7f27cebd43fdb461f4c7f8f5b9e24f66

SHA512
56e976cff70b83c6cc6d2cfdbbd28c63d69552bad35113a21cd87ced4fe7b7ac335f6fa992c0791697f084d39ca3ec06ca41cc5e207beb74b8b3d8f6a5520423

Download Submit
C:\Windows\system\hbNuKTp.exe

Filesize
1.7MB

MD5
2728675e01adacac72fb40139d6c9590

SHA1
923799e3aa4fae901859451ec485947eb7cbf103

SHA256
6065eb5aa85e828e3dee57ca0fa85ef3ad9973acf0b2c77d74766a70f988105d

SHA512
9fe474b516f6466904f96e83e04f244428350ae038a6662dd1e23f43424d5e26942a89489905ea0738d9fe84f27523c8375c68474d8a87ad4ca9e77a23cbb56b

Download Submit
C:\Windows\system\hlEUvNc.exe

Filesize
1.7MB

MD5
c4399f71607bfdc8e948207a1eeb4cb9

SHA1
0372b724ecf17d116b8b98348ab1aeed487d8b81

SHA256
e797a81cc76ff1125039fdc2eb77c5cd8f5cec6edbded5072673b2e4a1a72a54

SHA512
de6898def4b4575ff0ce88e1b69607ba596bbd172fdcec3705be741950a0c76fa09cce46b992527dc4c791743860b9ed104337977279ff6c8b6c14181f85fc3c

Download Submit
C:\Windows\system\kKFOnvu.exe

Filesize
1.7MB

MD5
3009397509ca738210539c6abe67cd46

SHA1
ef26eef2e4323dfc25696f2d8028816ec654a138

SHA256
3eb5fa42852dbea981055a419805cf919f5dd952f58918aeff4c9b2984657116

SHA512
cf56f8c4d8b58ae9d0f92a097b825943c89bb070b8d7720114e5cb9c7c24b813ff9d662b92f9e13a3307266c324ccad5af70d3c083933316f205703da8964819

Download Submit
C:\Windows\system\kijGxtw.exe

Filesize
1.7MB

MD5
6929cbddfc066811ae2e169f3af110e9

SHA1
16d31bdf7462167b0df89c7020da4b3b323415c6

SHA256
f22becf22a5936687511a3779f707a0ec199599fd6ca7696d284b3a8587a303a

SHA512
3cf99c380e5b2893d57981b2465495b3e03cf6f46ad85d7c0e651980b230a5a73027c883f19d5b6aee10b214900d53388e9479d2ed3265bb08079b4d256c8a5a

Download Submit
C:\Windows\system\mirxUoj.exe

Filesize
1.7MB

MD5
a175015b1a904ab46bdb5baa30cd08a5

SHA1
e2d5a69327dbc8d60b7bff9b1d61c5ba273052f1

SHA256
86acd0893f5078c916e93baab294b2bf23c79ecf85adb72e34e18e3cd45463f7

SHA512
73cdba91e8a90f686286a691c43e9bc06406bd6d963d4b4c2beea78b676e16c46c6616fc1e2cac786cee446c540272ed1e229bca4dfe1c1b2b97970e029b1033

Download Submit
C:\Windows\system\pSkSpcf.exe

Filesize
1.7MB

MD5
bb082489ed11977f3324bc84dd613e7a

SHA1
f362cf8066aa7ab7c6044feb627e3ce898ead13b

SHA256
8af0205f2eb3780662e084674c74b6fc3ba9fa24db9dd33a7ddad418dcf4f8e9

SHA512
808b3a855cc59e77d9b2d7a0ae069789bbc421075c528fa1e71571ec76df2f4ac9715da70ec2a1560242bcf183724856df0b2ba556c111777335c48cde1bb298

Download Submit
C:\Windows\system\sbdkypO.exe

Filesize
1.7MB

MD5
47d689e0654199c9bb3799c586794a55

SHA1
acfde422c65184571f6243b34c443c132d7cceb7

SHA256
e3ae7e4d0d88cca45031cd84870de5dcc4df08c116bacd6543b540671c78ddfc

SHA512
4826164d9926b65a6ee0558f5eb836245b55a121d78327027c7cc3aeb0129c0a00214d1b7e7c045f6748adfaea817f236dc840fc0c2e233e1cff8da14eeec0b4

Download Submit
C:\Windows\system\ugCLvDT.exe

Filesize
1.7MB

MD5
78e1567f13a6f8b752c232716a04aa79

SHA1
1bc9f691ebb183fe28b2750831d17d211ee72130

SHA256
87f48cfd8be3e89befa96fc71b6bfdb5b1393e497ff626208ea3b24dd73751f0

SHA512
e2f883ca245ca2e07d94220036c90b6feb9310423cee3c2519dd851223f4a499e8855314d43e40ea988305e6802446df895e13ed7cd4eaa420e0e0303472a3b5

Download Submit
C:\Windows\system\xJTNMXT.exe

Filesize
1.7MB

MD5
5551dca6921649bb0a4ee655f34a4660

SHA1
9ef69d38aeb4ce65ca1021cfa9499a677f8817de

SHA256
2ed6b206500a46f0fbdb944e895a5ef36cc9a804ac549a58f3c779575e7832c2

SHA512
0f328d712e2c35a77940dda9f8555a23fb5a468eaa6c36f9aced05914541094de3683ed149164f707e7fa3f6f7856cb2d07aaa63ccc2b100915c388056a9d0fe

Download Submit
C:\Windows\system\yHDWbwj.exe

Filesize
1.7MB

MD5
e7fb2449bd7c361cf1daf9ac8929454a

SHA1
98f7b1c7a0b28b1955573321f47e963fa5df190d

SHA256
722d76c76cebecc21cfe544113654465196379ffe495c30e2bcea18aa503f22b

SHA512
fe7e2cc940d53d615f0b083ca7e649ced3ff465bb0714fc6391de5fbb2b490f3942b31d00d8cde7b72df885de2e164fa27cf3eaea3b4739807ce1cd04a6067f0

Download Submit
C:\Windows\system\yPExRXJ.exe

Filesize
1.7MB

MD5
53bf16a9eb855df1deb4ff74bcfe826f

SHA1
26f8538d4d1b0a3a04d2a6d00a398cbfdf17ffdc

SHA256
e336900e2f053aabb8161c952d13b5148052b382af0ae18de170ee6e8d4c8441

SHA512
8cdd214291bdf669158e906def4c075c95b62d900056293db7f19fea725a201cf5b8668ca56ea042a19118fa4aad3fd2a2fb41ded2975db1ac4008ca2b6b9200

Download Submit
C:\Windows\system\yxLkJov.exe

Filesize
1.7MB

MD5
546bbb047c05aecc31f53ba14e97ad26

SHA1
30e28c11c62e46d0495f86649e946d3119f8374b

SHA256
06c56719c68b007ea48d72a0bec5a6700903e9065e7352f7df4ee6c779bf41df

SHA512
49690fb783a0cda51b39c110282c8e244b6cee5be28eb143e731034f69ec38ceb39b6520e5416766169a3dab424036efc0a081061c9c0c42ec6747aac79dfe07

Download Submit
\Windows\system\XiSJtgN.exe

Filesize
1.7MB

MD5
958e5218c59ccc76872677419d30853c

SHA1
e34838e77968f1dd575e428065703b5fa8fd0830

SHA256
e26fd3cbd550872d58b6ddf065176fc7a254fe939e49a57ab12241b199d66267

SHA512
cfec53e4aed577362be20d19444e2dada035cb1984b147c6c8a308f62d43646fa59d5be7f3cddfcdbe9c03761f165cc21fa5cac50236723f0efc2c7018b1f260

Download Submit
\Windows\system\uEtwdjq.exe

Filesize
1.7MB

MD5
69224856e317a20e9a1767ffc119718b

SHA1
f78571293aa2509f5c86890efd64d4bf9fbefed5

SHA256
6d58ebe9fa95acaeca6c0b482be015959e8aa3029b54c2e39ef4bb7884e4e2fd

SHA512
ed10a40142691d241a600cb6c2eb9edaa8df8a79a78eb27e731a0d90bf426f4f4058b053d19fa6077f434d724d4889973be5ccb3f4cc39e1b53baa6d03a2da91

Download Submit
\Windows\system\vNSVcUZ.exe

Filesize
1.7MB

MD5
65c94093f632beba41ccbaadf82cd288

SHA1
ba20c767979c3088835440684469a0e68deff6b1

SHA256
180150391a0700ea55826b38b8de51a572757d21c1f7a4c5ea4d88c97c24b787

SHA512
059afa8197e9c5283ac34d562472487fd64d2f43f159332eec034ced6b3ac0fc67c5103d669f76816fe3cbf667d1635bb78e678953ad2b9e5b2219a8c4f5d58e

Download Submit
\Windows\system\yMIIuNm.exe

Filesize
1.7MB

MD5
540cda4474d5dafcf2b9b4e19e9e74cf

SHA1
86d6867cedeba1a10fe5aaf74b1c6d32a5a541a2

SHA256
a8bcede5a690cb2776869d273f05eb3443c624f4e47a3c245129e2be345aca21

SHA512
4aec6b26e0bbe09ec34fcf14cb76ea32029f01e8e05b646dec8905ed7a5a96abef2f52bf73b18be4bfcc2bce2129734bf027a0c855261883711b9e29825afc0e

Download Submit
memory/2648-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download