xmrig | d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b

Analysis

max time kernel
74s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
Size

1.8MB
MD5

10eb8b29e7b249c68377d0b43521cfbd
SHA1

8410e57bd8fc7e8af21af910e59612eb5cd22c7a
SHA256

d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b
SHA512

2281f023599d68253511890f50cb73c46491aeec7c2bb0d69d0874dbe8516160d460a4d3c3381cfb2658ddcd6bb3bd8b891680009fcb8d1773a81b29775e1fe8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zouZxT:GemTLkNdfE0pZy5

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000b00000001227d-2.dat	xmrig
behavioral1/files/0x000f00000001866e-10.dat	xmrig
behavioral1/files/0x0006000000018687-14.dat	xmrig
behavioral1/files/0x0007000000018c1a-16.dat	xmrig
behavioral1/files/0x0007000000018c26-25.dat	xmrig
behavioral1/files/0x0007000000018f53-29.dat	xmrig
behavioral1/files/0x000700000001903b-35.dat	xmrig
behavioral1/files/0x00080000000190ce-40.dat	xmrig
behavioral1/files/0x00080000000190e0-45.dat	xmrig
behavioral1/files/0x0005000000019423-54.dat	xmrig
behavioral1/files/0x0005000000019426-59.dat	xmrig
behavioral1/files/0x0005000000019442-69.dat	xmrig
behavioral1/files/0x000500000001944d-74.dat	xmrig
behavioral1/files/0x00050000000194ae-99.dat	xmrig
behavioral1/files/0x000500000001952c-119.dat	xmrig
behavioral1/files/0x00050000000197aa-146.dat	xmrig
behavioral1/files/0x0005000000019aff-160.dat	xmrig
behavioral1/files/0x0005000000019a62-144.dat	xmrig
behavioral1/files/0x000500000001963b-139.dat	xmrig
behavioral1/files/0x0005000000019632-130.dat	xmrig
behavioral1/files/0x0005000000019afd-151.dat	xmrig
behavioral1/files/0x000500000001963a-134.dat	xmrig
behavioral1/files/0x0005000000019630-125.dat	xmrig
behavioral1/files/0x00050000000194ff-114.dat	xmrig
behavioral1/files/0x00050000000194df-109.dat	xmrig
behavioral1/files/0x00050000000194c9-104.dat	xmrig
behavioral1/files/0x000500000001946b-89.dat	xmrig
behavioral1/files/0x000500000001946e-94.dat	xmrig
behavioral1/files/0x000500000001945c-84.dat	xmrig
behavioral1/files/0x0005000000019458-79.dat	xmrig
behavioral1/files/0x0005000000019438-64.dat	xmrig
behavioral1/files/0x0006000000019397-49.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2696	NNlRdqa.exe
2748	asVASId.exe
2680	OGTNkuf.exe
2844	wkWraRk.exe
2768	VimtWGU.exe
2676	HmxHsCg.exe
2652	XOeyVyj.exe
2536	HMPMSSt.exe
2612	ArhjocG.exe
3052	RPDisOW.exe
2392	cekDMUk.exe
1128	LmrpVpp.exe
2068	ZgKfwLr.exe
2640	aaqgCMY.exe
940	HqAcVdS.exe
2988	MvFVOGv.exe
2104	bPExQOP.exe
2160	RRpQvKj.exe
3028	xSWyNAI.exe
2856	yIyjyDU.exe
2932	NEVkPtI.exe
2636	nmnyioL.exe
2880	DATzhpN.exe
2176	KlnBEua.exe
2408	TgOLbcb.exe
1476	sBGAkGC.exe
2976	aOYiAdr.exe
2964	OuSvRKo.exe
2440	EYUDdcz.exe
3020	QfUXYIk.exe
1472	XrgMfhh.exe
2152	kbjozly.exe
2024	GFKROKF.exe
896	fSZUFiE.exe
1716	oCffybJ.exe
1092	kGmkIQU.exe
1928	FuutXTY.exe
1760	OMFrLey.exe
1352	idHkYau.exe
2452	FSXGEbv.exe
1672	JpmNHRP.exe
580	buQITlr.exe
1404	SzzAIRh.exe
2436	zrISqvw.exe
2276	QhXDDRU.exe
2028	CoaYKCM.exe
764	xFcWHwV.exe
992	HKxWMgA.exe
2040	GBmBiFX.exe
1620	GVpqYPu.exe
768	NHnUqlf.exe
1616	WxYxgta.exe
2236	yJFwtvE.exe
884	JWcilyK.exe
2064	BkaPVOo.exe
1980	whrxUlk.exe
1576	etveEEn.exe
1580	ZmXIwgK.exe
2800	DWGylSb.exe
2784	YafpWvy.exe
2752	rsVJhKj.exe
2732	SaleYcC.exe
2560	UlFRKBL.exe
2708	amqsSLX.exe

Loads dropped DLL 64 IoCs

pid	Process
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GUggAfH.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\JANwxAM.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LyJvyLl.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LstKwko.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\msCYBQy.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LyqccFd.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\seUoEBr.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\Jlywcqq.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\nLKvTBA.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\oykhFPY.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\QfSwpbf.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\AffPFFM.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\ZvFgyeu.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\kHCJXYC.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\Ulgngut.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\NdudayK.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LVOuiSu.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\KMadKwh.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LdDDSCc.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\saktaZm.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\FJsdQjB.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\tAXySjH.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\tvQvpME.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\WkIsUJF.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\GJlelQi.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\oxpFRQw.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\aOYiAdr.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\JWcilyK.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\PxPYvCY.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\SbzuDjL.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\fbboZTR.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\PODpVeL.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\kfVRlHb.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\lZkIbKL.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\KGAcJkb.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\CwcOTcB.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\jGPTqVO.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\upoYiXy.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\wYQJlZT.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LphIbCi.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\nJQnYtZ.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\oqRfTbu.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\TUDUqke.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\hBlpOmO.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\PRhadYw.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\fRNUvyw.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LJOqEUL.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\IorLspI.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\dpLghoo.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\wPhTNEW.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\RnKujtw.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LSBATTs.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\groDLlE.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\TJXINBw.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\ggyjuhb.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\LjLkkqA.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\CUHmiTG.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\hnDyZfW.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\geMBWod.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\PrBQVKq.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\fhvqzIC.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\HbYsGOy.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\JDBLgqD.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
File created	C:\Windows\System\zmckdnH.exe	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2696	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	31
PID 2400 wrote to memory of 2696	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	31
PID 2400 wrote to memory of 2696	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	31
PID 2400 wrote to memory of 2748	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	32
PID 2400 wrote to memory of 2748	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	32
PID 2400 wrote to memory of 2748	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	32
PID 2400 wrote to memory of 2680	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	33
PID 2400 wrote to memory of 2680	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	33
PID 2400 wrote to memory of 2680	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	33
PID 2400 wrote to memory of 2844	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	34
PID 2400 wrote to memory of 2844	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	34
PID 2400 wrote to memory of 2844	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	34
PID 2400 wrote to memory of 2768	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	35
PID 2400 wrote to memory of 2768	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	35
PID 2400 wrote to memory of 2768	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	35
PID 2400 wrote to memory of 2676	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	36
PID 2400 wrote to memory of 2676	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	36
PID 2400 wrote to memory of 2676	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	36
PID 2400 wrote to memory of 2652	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	37
PID 2400 wrote to memory of 2652	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	37
PID 2400 wrote to memory of 2652	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	37
PID 2400 wrote to memory of 2536	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	38
PID 2400 wrote to memory of 2536	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	38
PID 2400 wrote to memory of 2536	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	38
PID 2400 wrote to memory of 2612	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	39
PID 2400 wrote to memory of 2612	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	39
PID 2400 wrote to memory of 2612	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	39
PID 2400 wrote to memory of 3052	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	40
PID 2400 wrote to memory of 3052	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	40
PID 2400 wrote to memory of 3052	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	40
PID 2400 wrote to memory of 2392	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	41
PID 2400 wrote to memory of 2392	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	41
PID 2400 wrote to memory of 2392	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	41
PID 2400 wrote to memory of 1128	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	42
PID 2400 wrote to memory of 1128	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	42
PID 2400 wrote to memory of 1128	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	42
PID 2400 wrote to memory of 2068	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	43
PID 2400 wrote to memory of 2068	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	43
PID 2400 wrote to memory of 2068	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	43
PID 2400 wrote to memory of 2640	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	44
PID 2400 wrote to memory of 2640	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	44
PID 2400 wrote to memory of 2640	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	44
PID 2400 wrote to memory of 940	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	45
PID 2400 wrote to memory of 940	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	45
PID 2400 wrote to memory of 940	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	45
PID 2400 wrote to memory of 2988	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	46
PID 2400 wrote to memory of 2988	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	46
PID 2400 wrote to memory of 2988	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	46
PID 2400 wrote to memory of 2104	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	47
PID 2400 wrote to memory of 2104	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	47
PID 2400 wrote to memory of 2104	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	47
PID 2400 wrote to memory of 2160	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	48
PID 2400 wrote to memory of 2160	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	48
PID 2400 wrote to memory of 2160	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	48
PID 2400 wrote to memory of 3028	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	49
PID 2400 wrote to memory of 3028	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	49
PID 2400 wrote to memory of 3028	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	49
PID 2400 wrote to memory of 2856	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	50
PID 2400 wrote to memory of 2856	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	50
PID 2400 wrote to memory of 2856	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	50
PID 2400 wrote to memory of 2932	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	51
PID 2400 wrote to memory of 2932	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	51
PID 2400 wrote to memory of 2932	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	51
PID 2400 wrote to memory of 2636	2400	d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe	52

C:\Users\Admin\AppData\Local\Temp\d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe
"C:\Users\Admin\AppData\Local\Temp\d47bc7bbd210267b82b35759a14c1c3dd0b8cec553bb2f81c2b51a2d08f96b0b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System\NNlRdqa.exe
  C:\Windows\System\NNlRdqa.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\asVASId.exe
  C:\Windows\System\asVASId.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\OGTNkuf.exe
  C:\Windows\System\OGTNkuf.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\wkWraRk.exe
  C:\Windows\System\wkWraRk.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\VimtWGU.exe
  C:\Windows\System\VimtWGU.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\HmxHsCg.exe
  C:\Windows\System\HmxHsCg.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\XOeyVyj.exe
  C:\Windows\System\XOeyVyj.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\HMPMSSt.exe
  C:\Windows\System\HMPMSSt.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ArhjocG.exe
  C:\Windows\System\ArhjocG.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\RPDisOW.exe
  C:\Windows\System\RPDisOW.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\cekDMUk.exe
  C:\Windows\System\cekDMUk.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\LmrpVpp.exe
  C:\Windows\System\LmrpVpp.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ZgKfwLr.exe
  C:\Windows\System\ZgKfwLr.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\aaqgCMY.exe
  C:\Windows\System\aaqgCMY.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\HqAcVdS.exe
  C:\Windows\System\HqAcVdS.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\MvFVOGv.exe
  C:\Windows\System\MvFVOGv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\bPExQOP.exe
  C:\Windows\System\bPExQOP.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\RRpQvKj.exe
  C:\Windows\System\RRpQvKj.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\xSWyNAI.exe
  C:\Windows\System\xSWyNAI.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\yIyjyDU.exe
  C:\Windows\System\yIyjyDU.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\NEVkPtI.exe
  C:\Windows\System\NEVkPtI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\nmnyioL.exe
  C:\Windows\System\nmnyioL.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\DATzhpN.exe
  C:\Windows\System\DATzhpN.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\KlnBEua.exe
  C:\Windows\System\KlnBEua.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\TgOLbcb.exe
  C:\Windows\System\TgOLbcb.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\sBGAkGC.exe
  C:\Windows\System\sBGAkGC.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\aOYiAdr.exe
  C:\Windows\System\aOYiAdr.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\OuSvRKo.exe
  C:\Windows\System\OuSvRKo.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\EYUDdcz.exe
  C:\Windows\System\EYUDdcz.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\XrgMfhh.exe
  C:\Windows\System\XrgMfhh.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\QfUXYIk.exe
  C:\Windows\System\QfUXYIk.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\kbjozly.exe
  C:\Windows\System\kbjozly.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\GFKROKF.exe
  C:\Windows\System\GFKROKF.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\fSZUFiE.exe
  C:\Windows\System\fSZUFiE.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\oCffybJ.exe
  C:\Windows\System\oCffybJ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\kGmkIQU.exe
  C:\Windows\System\kGmkIQU.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\FuutXTY.exe
  C:\Windows\System\FuutXTY.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\OMFrLey.exe
  C:\Windows\System\OMFrLey.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\idHkYau.exe
  C:\Windows\System\idHkYau.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\FSXGEbv.exe
  C:\Windows\System\FSXGEbv.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\JpmNHRP.exe
  C:\Windows\System\JpmNHRP.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\buQITlr.exe
  C:\Windows\System\buQITlr.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\SzzAIRh.exe
  C:\Windows\System\SzzAIRh.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\zrISqvw.exe
  C:\Windows\System\zrISqvw.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\QhXDDRU.exe
  C:\Windows\System\QhXDDRU.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\CoaYKCM.exe
  C:\Windows\System\CoaYKCM.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\xFcWHwV.exe
  C:\Windows\System\xFcWHwV.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\HKxWMgA.exe
  C:\Windows\System\HKxWMgA.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\GBmBiFX.exe
  C:\Windows\System\GBmBiFX.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\GVpqYPu.exe
  C:\Windows\System\GVpqYPu.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\NHnUqlf.exe
  C:\Windows\System\NHnUqlf.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\WxYxgta.exe
  C:\Windows\System\WxYxgta.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\yJFwtvE.exe
  C:\Windows\System\yJFwtvE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\JWcilyK.exe
  C:\Windows\System\JWcilyK.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\BkaPVOo.exe
  C:\Windows\System\BkaPVOo.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\whrxUlk.exe
  C:\Windows\System\whrxUlk.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\etveEEn.exe
  C:\Windows\System\etveEEn.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ZmXIwgK.exe
  C:\Windows\System\ZmXIwgK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\DWGylSb.exe
  C:\Windows\System\DWGylSb.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\YafpWvy.exe
  C:\Windows\System\YafpWvy.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\rsVJhKj.exe
  C:\Windows\System\rsVJhKj.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\SaleYcC.exe
  C:\Windows\System\SaleYcC.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\UlFRKBL.exe
  C:\Windows\System\UlFRKBL.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\amqsSLX.exe
  C:\Windows\System\amqsSLX.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\uOjWCxW.exe
  C:\Windows\System\uOjWCxW.exe
  2⤵
  PID:1044
- C:\Windows\System\CKSFBTM.exe
  C:\Windows\System\CKSFBTM.exe
  2⤵
  PID:1772
- C:\Windows\System\IBVWkTR.exe
  C:\Windows\System\IBVWkTR.exe
  2⤵
  PID:2928
- C:\Windows\System\YOJybcT.exe
  C:\Windows\System\YOJybcT.exe
  2⤵
  PID:3000
- C:\Windows\System\qbmJcmX.exe
  C:\Windows\System\qbmJcmX.exe
  2⤵
  PID:2792
- C:\Windows\System\GUggAfH.exe
  C:\Windows\System\GUggAfH.exe
  2⤵
  PID:2136
- C:\Windows\System\jUbhTrF.exe
  C:\Windows\System\jUbhTrF.exe
  2⤵
  PID:2948
- C:\Windows\System\HHHaFcf.exe
  C:\Windows\System\HHHaFcf.exe
  2⤵
  PID:3068
- C:\Windows\System\HaxRYRr.exe
  C:\Windows\System\HaxRYRr.exe
  2⤵
  PID:2460
- C:\Windows\System\VoRnonK.exe
  C:\Windows\System\VoRnonK.exe
  2⤵
  PID:3012
- C:\Windows\System\hRqZwUW.exe
  C:\Windows\System\hRqZwUW.exe
  2⤵
  PID:1324
- C:\Windows\System\YZsvAvl.exe
  C:\Windows\System\YZsvAvl.exe
  2⤵
  PID:2764
- C:\Windows\System\sIelpmu.exe
  C:\Windows\System\sIelpmu.exe
  2⤵
  PID:676
- C:\Windows\System\qheyYvI.exe
  C:\Windows\System\qheyYvI.exe
  2⤵
  PID:1240
- C:\Windows\System\vwRXAqo.exe
  C:\Windows\System\vwRXAqo.exe
  2⤵
  PID:2432
- C:\Windows\System\AnMOjeP.exe
  C:\Windows\System\AnMOjeP.exe
  2⤵
  PID:1800
- C:\Windows\System\oDuEwEH.exe
  C:\Windows\System\oDuEwEH.exe
  2⤵
  PID:2472
- C:\Windows\System\kSNUsAk.exe
  C:\Windows\System\kSNUsAk.exe
  2⤵
  PID:2036
- C:\Windows\System\JHJkJiV.exe
  C:\Windows\System\JHJkJiV.exe
  2⤵
  PID:1644
- C:\Windows\System\srIqfbV.exe
  C:\Windows\System\srIqfbV.exe
  2⤵
  PID:268
- C:\Windows\System\JcMaFgp.exe
  C:\Windows\System\JcMaFgp.exe
  2⤵
  PID:1856
- C:\Windows\System\KWvlBJO.exe
  C:\Windows\System\KWvlBJO.exe
  2⤵
  PID:1156
- C:\Windows\System\cyeVzib.exe
  C:\Windows\System\cyeVzib.exe
  2⤵
  PID:1952
- C:\Windows\System\IHydUjX.exe
  C:\Windows\System\IHydUjX.exe
  2⤵
  PID:816
- C:\Windows\System\XazlnlJ.exe
  C:\Windows\System\XazlnlJ.exe
  2⤵
  PID:2428
- C:\Windows\System\nNVQjwB.exe
  C:\Windows\System\nNVQjwB.exe
  2⤵
  PID:1916
- C:\Windows\System\PxPYvCY.exe
  C:\Windows\System\PxPYvCY.exe
  2⤵
  PID:1552
- C:\Windows\System\JANwxAM.exe
  C:\Windows\System\JANwxAM.exe
  2⤵
  PID:2268
- C:\Windows\System\SbzuDjL.exe
  C:\Windows\System\SbzuDjL.exe
  2⤵
  PID:2620
- C:\Windows\System\ABCsFQI.exe
  C:\Windows\System\ABCsFQI.exe
  2⤵
  PID:1688
- C:\Windows\System\kMywikY.exe
  C:\Windows\System\kMywikY.exe
  2⤵
  PID:2740
- C:\Windows\System\iJkKkbn.exe
  C:\Windows\System\iJkKkbn.exe
  2⤵
  PID:2832
- C:\Windows\System\tRcbMhZ.exe
  C:\Windows\System\tRcbMhZ.exe
  2⤵
  PID:2760
- C:\Windows\System\vwGIeGQ.exe
  C:\Windows\System\vwGIeGQ.exe
  2⤵
  PID:2756
- C:\Windows\System\yOBDnNR.exe
  C:\Windows\System\yOBDnNR.exe
  2⤵
  PID:2544
- C:\Windows\System\LURNFac.exe
  C:\Windows\System\LURNFac.exe
  2⤵
  PID:2328
- C:\Windows\System\NpxeQCP.exe
  C:\Windows\System\NpxeQCP.exe
  2⤵
  PID:2924
- C:\Windows\System\MYfmfPe.exe
  C:\Windows\System\MYfmfPe.exe
  2⤵
  PID:2252
- C:\Windows\System\XUGmPda.exe
  C:\Windows\System\XUGmPda.exe
  2⤵
  PID:2340
- C:\Windows\System\dgUyAZD.exe
  C:\Windows\System\dgUyAZD.exe
  2⤵
  PID:952
- C:\Windows\System\RdATFEP.exe
  C:\Windows\System\RdATFEP.exe
  2⤵
  PID:556
- C:\Windows\System\JUWJChX.exe
  C:\Windows\System\JUWJChX.exe
  2⤵
  PID:3048
- C:\Windows\System\mAAPMBL.exe
  C:\Windows\System\mAAPMBL.exe
  2⤵
  PID:2204
- C:\Windows\System\FejMMkD.exe
  C:\Windows\System\FejMMkD.exe
  2⤵
  PID:1732
- C:\Windows\System\rZMvJVM.exe
  C:\Windows\System\rZMvJVM.exe
  2⤵
  PID:2448
- C:\Windows\System\LYHxODC.exe
  C:\Windows\System\LYHxODC.exe
  2⤵
  PID:1628
- C:\Windows\System\MTBrmJr.exe
  C:\Windows\System\MTBrmJr.exe
  2⤵
  PID:1744
- C:\Windows\System\NgTcgzc.exe
  C:\Windows\System\NgTcgzc.exe
  2⤵
  PID:2820
- C:\Windows\System\jXkNemj.exe
  C:\Windows\System\jXkNemj.exe
  2⤵
  PID:2540
- C:\Windows\System\xiSYPyF.exe
  C:\Windows\System\xiSYPyF.exe
  2⤵
  PID:2132
- C:\Windows\System\APbPLoz.exe
  C:\Windows\System\APbPLoz.exe
  2⤵
  PID:1144
- C:\Windows\System\oXCpWQP.exe
  C:\Windows\System\oXCpWQP.exe
  2⤵
  PID:1624
- C:\Windows\System\Dqbufds.exe
  C:\Windows\System\Dqbufds.exe
  2⤵
  PID:3064
- C:\Windows\System\oxnfkjp.exe
  C:\Windows\System\oxnfkjp.exe
  2⤵
  PID:3088
- C:\Windows\System\MiytNEp.exe
  C:\Windows\System\MiytNEp.exe
  2⤵
  PID:3108
- C:\Windows\System\fCDnRDO.exe
  C:\Windows\System\fCDnRDO.exe
  2⤵
  PID:3124
- C:\Windows\System\XYnfjnT.exe
  C:\Windows\System\XYnfjnT.exe
  2⤵
  PID:3140
- C:\Windows\System\mIAsiNU.exe
  C:\Windows\System\mIAsiNU.exe
  2⤵
  PID:3160
- C:\Windows\System\mvMkvaH.exe
  C:\Windows\System\mvMkvaH.exe
  2⤵
  PID:3184
- C:\Windows\System\DYQtoAh.exe
  C:\Windows\System\DYQtoAh.exe
  2⤵
  PID:3204
- C:\Windows\System\WDOHkxx.exe
  C:\Windows\System\WDOHkxx.exe
  2⤵
  PID:3220
- C:\Windows\System\UVJWIoU.exe
  C:\Windows\System\UVJWIoU.exe
  2⤵
  PID:3240
- C:\Windows\System\IorLspI.exe
  C:\Windows\System\IorLspI.exe
  2⤵
  PID:3260
- C:\Windows\System\DeyHGcM.exe
  C:\Windows\System\DeyHGcM.exe
  2⤵
  PID:3276
- C:\Windows\System\gBQRfnH.exe
  C:\Windows\System\gBQRfnH.exe
  2⤵
  PID:3296
- C:\Windows\System\OLxzvby.exe
  C:\Windows\System\OLxzvby.exe
  2⤵
  PID:3312
- C:\Windows\System\WAYMbxS.exe
  C:\Windows\System\WAYMbxS.exe
  2⤵
  PID:3332
- C:\Windows\System\KXsEUqb.exe
  C:\Windows\System\KXsEUqb.exe
  2⤵
  PID:3396
- C:\Windows\System\gwcXoAm.exe
  C:\Windows\System\gwcXoAm.exe
  2⤵
  PID:3412
- C:\Windows\System\CnmwMYD.exe
  C:\Windows\System\CnmwMYD.exe
  2⤵
  PID:3428
- C:\Windows\System\BcHPloM.exe
  C:\Windows\System\BcHPloM.exe
  2⤵
  PID:3444
- C:\Windows\System\rFUIOjF.exe
  C:\Windows\System\rFUIOjF.exe
  2⤵
  PID:3468
- C:\Windows\System\DKgrFpK.exe
  C:\Windows\System\DKgrFpK.exe
  2⤵
  PID:3488
- C:\Windows\System\wfNJWyp.exe
  C:\Windows\System\wfNJWyp.exe
  2⤵
  PID:3504
- C:\Windows\System\bcuFfbs.exe
  C:\Windows\System\bcuFfbs.exe
  2⤵
  PID:3524
- C:\Windows\System\oocVsxq.exe
  C:\Windows\System\oocVsxq.exe
  2⤵
  PID:3548
- C:\Windows\System\YMUCNPk.exe
  C:\Windows\System\YMUCNPk.exe
  2⤵
  PID:3564
- C:\Windows\System\MxVSHJg.exe
  C:\Windows\System\MxVSHJg.exe
  2⤵
  PID:3580
- C:\Windows\System\SZelnvq.exe
  C:\Windows\System\SZelnvq.exe
  2⤵
  PID:3596
- C:\Windows\System\ZnkPqzf.exe
  C:\Windows\System\ZnkPqzf.exe
  2⤵
  PID:3620
- C:\Windows\System\vLslohf.exe
  C:\Windows\System\vLslohf.exe
  2⤵
  PID:3648
- C:\Windows\System\LubADUY.exe
  C:\Windows\System\LubADUY.exe
  2⤵
  PID:3664
- C:\Windows\System\cbpSfWW.exe
  C:\Windows\System\cbpSfWW.exe
  2⤵
  PID:3680
- C:\Windows\System\NohkOKC.exe
  C:\Windows\System\NohkOKC.exe
  2⤵
  PID:3696
- C:\Windows\System\xiQhGpU.exe
  C:\Windows\System\xiQhGpU.exe
  2⤵
  PID:3712
- C:\Windows\System\jrJvoFB.exe
  C:\Windows\System\jrJvoFB.exe
  2⤵
  PID:3728
- C:\Windows\System\QdXedKy.exe
  C:\Windows\System\QdXedKy.exe
  2⤵
  PID:3744
- C:\Windows\System\TAmirSK.exe
  C:\Windows\System\TAmirSK.exe
  2⤵
  PID:3760
- C:\Windows\System\NeQhMSX.exe
  C:\Windows\System\NeQhMSX.exe
  2⤵
  PID:3776
- C:\Windows\System\mwtNQzr.exe
  C:\Windows\System\mwtNQzr.exe
  2⤵
  PID:3792
- C:\Windows\System\cQjKMFs.exe
  C:\Windows\System\cQjKMFs.exe
  2⤵
  PID:3808
- C:\Windows\System\yLHIFWy.exe
  C:\Windows\System\yLHIFWy.exe
  2⤵
  PID:3824
- C:\Windows\System\xusaocG.exe
  C:\Windows\System\xusaocG.exe
  2⤵
  PID:3840
- C:\Windows\System\LRyLYmV.exe
  C:\Windows\System\LRyLYmV.exe
  2⤵
  PID:3856
- C:\Windows\System\vyLbBzy.exe
  C:\Windows\System\vyLbBzy.exe
  2⤵
  PID:3872
- C:\Windows\System\xDuQATs.exe
  C:\Windows\System\xDuQATs.exe
  2⤵
  PID:3888
- C:\Windows\System\zmckdnH.exe
  C:\Windows\System\zmckdnH.exe
  2⤵
  PID:3904
- C:\Windows\System\TBSQRrE.exe
  C:\Windows\System\TBSQRrE.exe
  2⤵
  PID:3920
- C:\Windows\System\JhRLvUo.exe
  C:\Windows\System\JhRLvUo.exe
  2⤵
  PID:3936
- C:\Windows\System\kHrcqUV.exe
  C:\Windows\System\kHrcqUV.exe
  2⤵
  PID:3952
- C:\Windows\System\REloIfJ.exe
  C:\Windows\System\REloIfJ.exe
  2⤵
  PID:3968
- C:\Windows\System\ECMLvYK.exe
  C:\Windows\System\ECMLvYK.exe
  2⤵
  PID:3984
- C:\Windows\System\OpkMoTs.exe
  C:\Windows\System\OpkMoTs.exe
  2⤵
  PID:4000
- C:\Windows\System\FutGOmO.exe
  C:\Windows\System\FutGOmO.exe
  2⤵
  PID:4016
- C:\Windows\System\SeRwAWE.exe
  C:\Windows\System\SeRwAWE.exe
  2⤵
  PID:4032
- C:\Windows\System\WOYLPyd.exe
  C:\Windows\System\WOYLPyd.exe
  2⤵
  PID:4048
- C:\Windows\System\ZJWXeyo.exe
  C:\Windows\System\ZJWXeyo.exe
  2⤵
  PID:4064
- C:\Windows\System\dLkpmUH.exe
  C:\Windows\System\dLkpmUH.exe
  2⤵
  PID:4080
- C:\Windows\System\vZWfxrs.exe
  C:\Windows\System\vZWfxrs.exe
  2⤵
  PID:876
- C:\Windows\System\VJsdeLy.exe
  C:\Windows\System\VJsdeLy.exe
  2⤵
  PID:1548
- C:\Windows\System\NmEuttm.exe
  C:\Windows\System\NmEuttm.exe
  2⤵
  PID:1524
- C:\Windows\System\gRtFNXn.exe
  C:\Windows\System\gRtFNXn.exe
  2⤵
  PID:2780
- C:\Windows\System\ZHJMqks.exe
  C:\Windows\System\ZHJMqks.exe
  2⤵
  PID:1936
- C:\Windows\System\oqRfTbu.exe
  C:\Windows\System\oqRfTbu.exe
  2⤵
  PID:3120
- C:\Windows\System\kzvAStN.exe
  C:\Windows\System\kzvAStN.exe
  2⤵
  PID:3156
- C:\Windows\System\fbboZTR.exe
  C:\Windows\System\fbboZTR.exe
  2⤵
  PID:3228
- C:\Windows\System\tmlxPIq.exe
  C:\Windows\System\tmlxPIq.exe
  2⤵
  PID:792
- C:\Windows\System\gJJpYKF.exe
  C:\Windows\System\gJJpYKF.exe
  2⤵
  PID:336
- C:\Windows\System\tDihpff.exe
  C:\Windows\System\tDihpff.exe
  2⤵
  PID:2496
- C:\Windows\System\FXEZZfr.exe
  C:\Windows\System\FXEZZfr.exe
  2⤵
  PID:1572
- C:\Windows\System\CBVOCBF.exe
  C:\Windows\System\CBVOCBF.exe
  2⤵
  PID:2564
- C:\Windows\System\PuXiBPB.exe
  C:\Windows\System\PuXiBPB.exe
  2⤵
  PID:2572
- C:\Windows\System\Fgebfrn.exe
  C:\Windows\System\Fgebfrn.exe
  2⤵
  PID:2084
- C:\Windows\System\hcTcBwF.exe
  C:\Windows\System\hcTcBwF.exe
  2⤵
  PID:2112
- C:\Windows\System\stnVmem.exe
  C:\Windows\System\stnVmem.exe
  2⤵
  PID:3036
- C:\Windows\System\dpLghoo.exe
  C:\Windows\System\dpLghoo.exe
  2⤵
  PID:2060
- C:\Windows\System\FaHwvoW.exe
  C:\Windows\System\FaHwvoW.exe
  2⤵
  PID:2156
- C:\Windows\System\EVTScTk.exe
  C:\Windows\System\EVTScTk.exe
  2⤵
  PID:1784
- C:\Windows\System\ZBYwFtR.exe
  C:\Windows\System\ZBYwFtR.exe
  2⤵
  PID:2836
- C:\Windows\System\aRBqDlT.exe
  C:\Windows\System\aRBqDlT.exe
  2⤵
  PID:3104
- C:\Windows\System\lXknYJK.exe
  C:\Windows\System\lXknYJK.exe
  2⤵
  PID:672
- C:\Windows\System\JhFVBUk.exe
  C:\Windows\System\JhFVBUk.exe
  2⤵
  PID:3292
- C:\Windows\System\aJPNywg.exe
  C:\Windows\System\aJPNywg.exe
  2⤵
  PID:1944
- C:\Windows\System\dYDSUBs.exe
  C:\Windows\System\dYDSUBs.exe
  2⤵
  PID:3360
- C:\Windows\System\RuDwPYV.exe
  C:\Windows\System\RuDwPYV.exe
  2⤵
  PID:3368
- C:\Windows\System\vLzfIsF.exe
  C:\Windows\System\vLzfIsF.exe
  2⤵
  PID:3376
- C:\Windows\System\ClqzeqO.exe
  C:\Windows\System\ClqzeqO.exe
  2⤵
  PID:3172
- C:\Windows\System\bjaHKav.exe
  C:\Windows\System\bjaHKav.exe
  2⤵
  PID:3100
- C:\Windows\System\YLbdYTE.exe
  C:\Windows\System\YLbdYTE.exe
  2⤵
  PID:2388
- C:\Windows\System\BqPIQbY.exe
  C:\Windows\System\BqPIQbY.exe
  2⤵
  PID:2804
- C:\Windows\System\wnexaKx.exe
  C:\Windows\System\wnexaKx.exe
  2⤵
  PID:3388
- C:\Windows\System\QrPphbu.exe
  C:\Windows\System\QrPphbu.exe
  2⤵
  PID:3420
- C:\Windows\System\eGVNrDC.exe
  C:\Windows\System\eGVNrDC.exe
  2⤵
  PID:3456
- C:\Windows\System\emdmzea.exe
  C:\Windows\System\emdmzea.exe
  2⤵
  PID:3040
- C:\Windows\System\siBxRWB.exe
  C:\Windows\System\siBxRWB.exe
  2⤵
  PID:3536
- C:\Windows\System\auSBJpn.exe
  C:\Windows\System\auSBJpn.exe
  2⤵
  PID:3576
- C:\Windows\System\EbepAzX.exe
  C:\Windows\System\EbepAzX.exe
  2⤵
  PID:3616
- C:\Windows\System\LyqccFd.exe
  C:\Windows\System\LyqccFd.exe
  2⤵
  PID:2248
- C:\Windows\System\xxxoNTn.exe
  C:\Windows\System\xxxoNTn.exe
  2⤵
  PID:2272
- C:\Windows\System\SebTDAi.exe
  C:\Windows\System\SebTDAi.exe
  2⤵
  PID:3516
- C:\Windows\System\ujwxwGL.exe
  C:\Windows\System\ujwxwGL.exe
  2⤵
  PID:3476
- C:\Windows\System\SMMHvSQ.exe
  C:\Windows\System\SMMHvSQ.exe
  2⤵
  PID:3688
- C:\Windows\System\GgkPtir.exe
  C:\Windows\System\GgkPtir.exe
  2⤵
  PID:3640
- C:\Windows\System\SMmvbED.exe
  C:\Windows\System\SMmvbED.exe
  2⤵
  PID:3708
- C:\Windows\System\JjgVcBD.exe
  C:\Windows\System\JjgVcBD.exe
  2⤵
  PID:3784
- C:\Windows\System\BUUeRgo.exe
  C:\Windows\System\BUUeRgo.exe
  2⤵
  PID:2592
- C:\Windows\System\skKjrCt.exe
  C:\Windows\System\skKjrCt.exe
  2⤵
  PID:3832
- C:\Windows\System\hmSZKkD.exe
  C:\Windows\System\hmSZKkD.exe
  2⤵
  PID:3836
- C:\Windows\System\YzjBnLh.exe
  C:\Windows\System\YzjBnLh.exe
  2⤵
  PID:3900
- C:\Windows\System\QIdIdIH.exe
  C:\Windows\System\QIdIdIH.exe
  2⤵
  PID:3928
- C:\Windows\System\TFgEXFm.exe
  C:\Windows\System\TFgEXFm.exe
  2⤵
  PID:3976
- C:\Windows\System\LqWRVOT.exe
  C:\Windows\System\LqWRVOT.exe
  2⤵
  PID:4008
- C:\Windows\System\LrlQtBm.exe
  C:\Windows\System\LrlQtBm.exe
  2⤵
  PID:4024
- C:\Windows\System\fksvbqi.exe
  C:\Windows\System\fksvbqi.exe
  2⤵
  PID:4056
- C:\Windows\System\FPGyxKu.exe
  C:\Windows\System\FPGyxKu.exe
  2⤵
  PID:4076
- C:\Windows\System\ySlnHQY.exe
  C:\Windows\System\ySlnHQY.exe
  2⤵
  PID:1076
- C:\Windows\System\rgYsUlf.exe
  C:\Windows\System\rgYsUlf.exe
  2⤵
  PID:2588
- C:\Windows\System\NbULGLo.exe
  C:\Windows\System\NbULGLo.exe
  2⤵
  PID:2660
- C:\Windows\System\WNsfzMi.exe
  C:\Windows\System\WNsfzMi.exe
  2⤵
  PID:3152
- C:\Windows\System\TDsOnqz.exe
  C:\Windows\System\TDsOnqz.exe
  2⤵
  PID:2072
- C:\Windows\System\ollvSVM.exe
  C:\Windows\System\ollvSVM.exe
  2⤵
  PID:2016
- C:\Windows\System\YxBUoPL.exe
  C:\Windows\System\YxBUoPL.exe
  2⤵
  PID:2020
- C:\Windows\System\HEdQTqS.exe
  C:\Windows\System\HEdQTqS.exe
  2⤵
  PID:2524
- C:\Windows\System\OrvjHLm.exe
  C:\Windows\System\OrvjHLm.exe
  2⤵
  PID:3272
- C:\Windows\System\kGbPpxa.exe
  C:\Windows\System\kGbPpxa.exe
  2⤵
  PID:2892
- C:\Windows\System\LXBIhcW.exe
  C:\Windows\System\LXBIhcW.exe
  2⤵
  PID:844
- C:\Windows\System\VguNPIG.exe
  C:\Windows\System\VguNPIG.exe
  2⤵
  PID:2508
- C:\Windows\System\PWMCppn.exe
  C:\Windows\System\PWMCppn.exe
  2⤵
  PID:564
- C:\Windows\System\bjVJHLT.exe
  C:\Windows\System\bjVJHLT.exe
  2⤵
  PID:3284
- C:\Windows\System\AcDKjGl.exe
  C:\Windows\System\AcDKjGl.exe
  2⤵
  PID:3344
- C:\Windows\System\YaJNhdc.exe
  C:\Windows\System\YaJNhdc.exe
  2⤵
  PID:3216
- C:\Windows\System\GjrXTuO.exe
  C:\Windows\System\GjrXTuO.exe
  2⤵
  PID:3380
- C:\Windows\System\nRwApku.exe
  C:\Windows\System\nRwApku.exe
  2⤵
  PID:1436
- C:\Windows\System\sYelqsK.exe
  C:\Windows\System\sYelqsK.exe
  2⤵
  PID:316
- C:\Windows\System\QfSwpbf.exe
  C:\Windows\System\QfSwpbf.exe
  2⤵
  PID:3392
- C:\Windows\System\VfjEjrh.exe
  C:\Windows\System\VfjEjrh.exe
  2⤵
  PID:3544
- C:\Windows\System\MgueFHS.exe
  C:\Windows\System\MgueFHS.exe
  2⤵
  PID:3484
- C:\Windows\System\tKCirbG.exe
  C:\Windows\System\tKCirbG.exe
  2⤵
  PID:3384
- C:\Windows\System\zDSIGlq.exe
  C:\Windows\System\zDSIGlq.exe
  2⤵
  PID:2480
- C:\Windows\System\zjRBVUU.exe
  C:\Windows\System\zjRBVUU.exe
  2⤵
  PID:3532
- C:\Windows\System\JhrrZfO.exe
  C:\Windows\System\JhrrZfO.exe
  2⤵
  PID:1312
- C:\Windows\System\EsFWBvP.exe
  C:\Windows\System\EsFWBvP.exe
  2⤵
  PID:3560
- C:\Windows\System\gnHpyPB.exe
  C:\Windows\System\gnHpyPB.exe
  2⤵
  PID:2868
- C:\Windows\System\KipJlFI.exe
  C:\Windows\System\KipJlFI.exe
  2⤵
  PID:3692
- C:\Windows\System\capSzTO.exe
  C:\Windows\System\capSzTO.exe
  2⤵
  PID:3788
- C:\Windows\System\XISJPSn.exe
  C:\Windows\System\XISJPSn.exe
  2⤵
  PID:3740
- C:\Windows\System\AJbozdM.exe
  C:\Windows\System\AJbozdM.exe
  2⤵
  PID:3980
- C:\Windows\System\ayjrEJP.exe
  C:\Windows\System\ayjrEJP.exe
  2⤵
  PID:3820
- C:\Windows\System\wyRQxnq.exe
  C:\Windows\System\wyRQxnq.exe
  2⤵
  PID:3864
- C:\Windows\System\vAuXFPZ.exe
  C:\Windows\System\vAuXFPZ.exe
  2⤵
  PID:4012
- C:\Windows\System\HAjxPeb.exe
  C:\Windows\System\HAjxPeb.exe
  2⤵
  PID:3768
- C:\Windows\System\HCIGhxM.exe
  C:\Windows\System\HCIGhxM.exe
  2⤵
  PID:1736
- C:\Windows\System\hpBVngc.exe
  C:\Windows\System\hpBVngc.exe
  2⤵
  PID:3268
- C:\Windows\System\RVmfEwk.exe
  C:\Windows\System\RVmfEwk.exe
  2⤵
  PID:3308
- C:\Windows\System\cqyEpep.exe
  C:\Windows\System\cqyEpep.exe
  2⤵
  PID:3352
- C:\Windows\System\GakDslh.exe
  C:\Windows\System\GakDslh.exe
  2⤵
  PID:2712
- C:\Windows\System\sSsMKDy.exe
  C:\Windows\System\sSsMKDy.exe
  2⤵
  PID:540
- C:\Windows\System\muTIJSg.exe
  C:\Windows\System\muTIJSg.exe
  2⤵
  PID:3632
- C:\Windows\System\QOBQxfz.exe
  C:\Windows\System\QOBQxfz.exe
  2⤵
  PID:4104
- C:\Windows\System\BSuyoZW.exe
  C:\Windows\System\BSuyoZW.exe
  2⤵
  PID:4120
- C:\Windows\System\LuFMmrC.exe
  C:\Windows\System\LuFMmrC.exe
  2⤵
  PID:4136
- C:\Windows\System\LyJvyLl.exe
  C:\Windows\System\LyJvyLl.exe
  2⤵
  PID:4152
- C:\Windows\System\JfDsKaw.exe
  C:\Windows\System\JfDsKaw.exe
  2⤵
  PID:4168
- C:\Windows\System\YrslLbP.exe
  C:\Windows\System\YrslLbP.exe
  2⤵
  PID:4184
- C:\Windows\System\mlBPiOQ.exe
  C:\Windows\System\mlBPiOQ.exe
  2⤵
  PID:4200
- C:\Windows\System\lhaweAG.exe
  C:\Windows\System\lhaweAG.exe
  2⤵
  PID:4216
- C:\Windows\System\cHfZhqF.exe
  C:\Windows\System\cHfZhqF.exe
  2⤵
  PID:4232
- C:\Windows\System\pjZBAOv.exe
  C:\Windows\System\pjZBAOv.exe
  2⤵
  PID:4248
- C:\Windows\System\zpjZJLO.exe
  C:\Windows\System\zpjZJLO.exe
  2⤵
  PID:4264
- C:\Windows\System\STcohxE.exe
  C:\Windows\System\STcohxE.exe
  2⤵
  PID:4280
- C:\Windows\System\vmJMcBb.exe
  C:\Windows\System\vmJMcBb.exe
  2⤵
  PID:4316
- C:\Windows\System\shxllZO.exe
  C:\Windows\System\shxllZO.exe
  2⤵
  PID:4372
- C:\Windows\System\rUTOKpB.exe
  C:\Windows\System\rUTOKpB.exe
  2⤵
  PID:4388
- C:\Windows\System\KRWUEXC.exe
  C:\Windows\System\KRWUEXC.exe
  2⤵
  PID:4404
- C:\Windows\System\tCKSEOG.exe
  C:\Windows\System\tCKSEOG.exe
  2⤵
  PID:4420
- C:\Windows\System\PnTCMGd.exe
  C:\Windows\System\PnTCMGd.exe
  2⤵
  PID:4436
- C:\Windows\System\uiDNVrP.exe
  C:\Windows\System\uiDNVrP.exe
  2⤵
  PID:4452
- C:\Windows\System\Iusncgt.exe
  C:\Windows\System\Iusncgt.exe
  2⤵
  PID:4468
- C:\Windows\System\JltpUeq.exe
  C:\Windows\System\JltpUeq.exe
  2⤵
  PID:4484
- C:\Windows\System\WfRdQgf.exe
  C:\Windows\System\WfRdQgf.exe
  2⤵
  PID:4500
- C:\Windows\System\zUknMDm.exe
  C:\Windows\System\zUknMDm.exe
  2⤵
  PID:4516
- C:\Windows\System\dFItont.exe
  C:\Windows\System\dFItont.exe
  2⤵
  PID:4532
- C:\Windows\System\gSHtOqe.exe
  C:\Windows\System\gSHtOqe.exe
  2⤵
  PID:4548
- C:\Windows\System\xEYRkHT.exe
  C:\Windows\System\xEYRkHT.exe
  2⤵
  PID:4564
- C:\Windows\System\UZeIYJn.exe
  C:\Windows\System\UZeIYJn.exe
  2⤵
  PID:4580
- C:\Windows\System\oxdOuWh.exe
  C:\Windows\System\oxdOuWh.exe
  2⤵
  PID:4596
- C:\Windows\System\byiNYLk.exe
  C:\Windows\System\byiNYLk.exe
  2⤵
  PID:4612
- C:\Windows\System\RzqgQeX.exe
  C:\Windows\System\RzqgQeX.exe
  2⤵
  PID:4628
- C:\Windows\System\ioNUgJr.exe
  C:\Windows\System\ioNUgJr.exe
  2⤵
  PID:4644
- C:\Windows\System\VrxLfYb.exe
  C:\Windows\System\VrxLfYb.exe
  2⤵
  PID:4660
- C:\Windows\System\cjpNspp.exe
  C:\Windows\System\cjpNspp.exe
  2⤵
  PID:4676
- C:\Windows\System\TqtRSdb.exe
  C:\Windows\System\TqtRSdb.exe
  2⤵
  PID:4692
- C:\Windows\System\DeIKrrY.exe
  C:\Windows\System\DeIKrrY.exe
  2⤵
  PID:4708
- C:\Windows\System\cvOrBdJ.exe
  C:\Windows\System\cvOrBdJ.exe
  2⤵
  PID:4724
- C:\Windows\System\yWdRlLy.exe
  C:\Windows\System\yWdRlLy.exe
  2⤵
  PID:4740
- C:\Windows\System\bTzveZx.exe
  C:\Windows\System\bTzveZx.exe
  2⤵
  PID:4756
- C:\Windows\System\IQadCuy.exe
  C:\Windows\System\IQadCuy.exe
  2⤵
  PID:4772
- C:\Windows\System\YQttqTa.exe
  C:\Windows\System\YQttqTa.exe
  2⤵
  PID:4788
- C:\Windows\System\LjvZzdX.exe
  C:\Windows\System\LjvZzdX.exe
  2⤵
  PID:4804
- C:\Windows\System\CwcOTcB.exe
  C:\Windows\System\CwcOTcB.exe
  2⤵
  PID:4820
- C:\Windows\System\UULiKwc.exe
  C:\Windows\System\UULiKwc.exe
  2⤵
  PID:4836
- C:\Windows\System\TtrLCmY.exe
  C:\Windows\System\TtrLCmY.exe
  2⤵
  PID:4852
- C:\Windows\System\aUdLwxu.exe
  C:\Windows\System\aUdLwxu.exe
  2⤵
  PID:4868
- C:\Windows\System\MfBoyHS.exe
  C:\Windows\System\MfBoyHS.exe
  2⤵
  PID:4884
- C:\Windows\System\jVWNkOm.exe
  C:\Windows\System\jVWNkOm.exe
  2⤵
  PID:4900
- C:\Windows\System\pfAiDlx.exe
  C:\Windows\System\pfAiDlx.exe
  2⤵
  PID:4916
- C:\Windows\System\daCcwcl.exe
  C:\Windows\System\daCcwcl.exe
  2⤵
  PID:4932
- C:\Windows\System\PODpVeL.exe
  C:\Windows\System\PODpVeL.exe
  2⤵
  PID:4948
- C:\Windows\System\WwrqAmA.exe
  C:\Windows\System\WwrqAmA.exe
  2⤵
  PID:4964
- C:\Windows\System\omGLYrm.exe
  C:\Windows\System\omGLYrm.exe
  2⤵
  PID:4980
- C:\Windows\System\yJULZcc.exe
  C:\Windows\System\yJULZcc.exe
  2⤵
  PID:4996
- C:\Windows\System\FOiTxle.exe
  C:\Windows\System\FOiTxle.exe
  2⤵
  PID:5012
- C:\Windows\System\UHKOIDk.exe
  C:\Windows\System\UHKOIDk.exe
  2⤵
  PID:5028
- C:\Windows\System\DJmTxrk.exe
  C:\Windows\System\DJmTxrk.exe
  2⤵
  PID:5044
- C:\Windows\System\maoSkVk.exe
  C:\Windows\System\maoSkVk.exe
  2⤵
  PID:5060
- C:\Windows\System\WVcKNkE.exe
  C:\Windows\System\WVcKNkE.exe
  2⤵
  PID:5076
- C:\Windows\System\zroCYYy.exe
  C:\Windows\System\zroCYYy.exe
  2⤵
  PID:5092
- C:\Windows\System\OhfMMls.exe
  C:\Windows\System\OhfMMls.exe
  2⤵
  PID:5108
- C:\Windows\System\YhDLDko.exe
  C:\Windows\System\YhDLDko.exe
  2⤵
  PID:1796
- C:\Windows\System\qDdjjSZ.exe
  C:\Windows\System\qDdjjSZ.exe
  2⤵
  PID:4060
- C:\Windows\System\pjJmybg.exe
  C:\Windows\System\pjJmybg.exe
  2⤵
  PID:880
- C:\Windows\System\nYvgfhA.exe
  C:\Windows\System\nYvgfhA.exe
  2⤵
  PID:1348
- C:\Windows\System\lUwpqDT.exe
  C:\Windows\System\lUwpqDT.exe
  2⤵
  PID:4128
- C:\Windows\System\AKbkWdH.exe
  C:\Windows\System\AKbkWdH.exe
  2⤵
  PID:4160
- C:\Windows\System\vZwUTXo.exe
  C:\Windows\System\vZwUTXo.exe
  2⤵
  PID:4224
- C:\Windows\System\CkIpsSd.exe
  C:\Windows\System\CkIpsSd.exe
  2⤵
  PID:2580
- C:\Windows\System\JtbAtsN.exe
  C:\Windows\System\JtbAtsN.exe
  2⤵
  PID:2688
- C:\Windows\System\QmkryyC.exe
  C:\Windows\System\QmkryyC.exe
  2⤵
  PID:2476
- C:\Windows\System\seUoEBr.exe
  C:\Windows\System\seUoEBr.exe
  2⤵
  PID:3364
- C:\Windows\System\UlWLuMy.exe
  C:\Windows\System\UlWLuMy.exe
  2⤵
  PID:4176
- C:\Windows\System\tcKwLhj.exe
  C:\Windows\System\tcKwLhj.exe
  2⤵
  PID:3496
- C:\Windows\System\VGoUfvu.exe
  C:\Windows\System\VGoUfvu.exe
  2⤵
  PID:3480
- C:\Windows\System\YSmpRjP.exe
  C:\Windows\System\YSmpRjP.exe
  2⤵
  PID:3852
- C:\Windows\System\BvrHFSc.exe
  C:\Windows\System\BvrHFSc.exe
  2⤵
  PID:3960
- C:\Windows\System\ivWevaM.exe
  C:\Windows\System\ivWevaM.exe
  2⤵
  PID:2980
- C:\Windows\System\CtYgQCT.exe
  C:\Windows\System\CtYgQCT.exe
  2⤵
  PID:3612
- C:\Windows\System\IwttYoa.exe
  C:\Windows\System\IwttYoa.exe
  2⤵
  PID:4144
- C:\Windows\System\NKvgiDQ.exe
  C:\Windows\System\NKvgiDQ.exe
  2⤵
  PID:4212
- C:\Windows\System\VUETKYz.exe
  C:\Windows\System\VUETKYz.exe
  2⤵
  PID:4292
- C:\Windows\System\gTepqce.exe
  C:\Windows\System\gTepqce.exe
  2⤵
  PID:4336
- C:\Windows\System\pIaHfQX.exe
  C:\Windows\System\pIaHfQX.exe
  2⤵
  PID:4352
- C:\Windows\System\jGPTqVO.exe
  C:\Windows\System\jGPTqVO.exe
  2⤵
  PID:4368
- C:\Windows\System\BakVKPm.exe
  C:\Windows\System\BakVKPm.exe
  2⤵
  PID:4416
- C:\Windows\System\kKjGIYr.exe
  C:\Windows\System\kKjGIYr.exe
  2⤵
  PID:4480
- C:\Windows\System\QaLIEAD.exe
  C:\Windows\System\QaLIEAD.exe
  2⤵
  PID:4544
- C:\Windows\System\VdJYIMa.exe
  C:\Windows\System\VdJYIMa.exe
  2⤵
  PID:4608
- C:\Windows\System\wkJRdfK.exe
  C:\Windows\System\wkJRdfK.exe
  2⤵
  PID:4672
- C:\Windows\System\yASpUtX.exe
  C:\Windows\System\yASpUtX.exe
  2⤵
  PID:4736
- C:\Windows\System\LlMhkLd.exe
  C:\Windows\System\LlMhkLd.exe
  2⤵
  PID:4800
- C:\Windows\System\zKoeMlI.exe
  C:\Windows\System\zKoeMlI.exe
  2⤵
  PID:4864
- C:\Windows\System\LdDDSCc.exe
  C:\Windows\System\LdDDSCc.exe
  2⤵
  PID:4928
- C:\Windows\System\bVgQItq.exe
  C:\Windows\System\bVgQItq.exe
  2⤵
  PID:4992
- C:\Windows\System\dIHrUIC.exe
  C:\Windows\System\dIHrUIC.exe
  2⤵
  PID:5056
- C:\Windows\System\wcvnzZc.exe
  C:\Windows\System\wcvnzZc.exe
  2⤵
  PID:4556
- C:\Windows\System\IQYAFlK.exe
  C:\Windows\System\IQYAFlK.exe
  2⤵
  PID:4620
- C:\Windows\System\GBSKcaO.exe
  C:\Windows\System\GBSKcaO.exe
  2⤵
  PID:4748
- C:\Windows\System\HtAhVID.exe
  C:\Windows\System\HtAhVID.exe
  2⤵
  PID:4524
- C:\Windows\System\aLYeQry.exe
  C:\Windows\System\aLYeQry.exe
  2⤵
  PID:4592
- C:\Windows\System\QGDGXDu.exe
  C:\Windows\System\QGDGXDu.exe
  2⤵
  PID:4684
- C:\Windows\System\qoPtOQI.exe
  C:\Windows\System\qoPtOQI.exe
  2⤵
  PID:4752
- C:\Windows\System\zKjtSnX.exe
  C:\Windows\System\zKjtSnX.exe
  2⤵
  PID:4816
- C:\Windows\System\rjRxHPM.exe
  C:\Windows\System\rjRxHPM.exe
  2⤵
  PID:4880
- C:\Windows\System\VNbIraI.exe
  C:\Windows\System\VNbIraI.exe
  2⤵
  PID:4944
- C:\Windows\System\UceZuvH.exe
  C:\Windows\System\UceZuvH.exe
  2⤵
  PID:5036
- C:\Windows\System\EARvFyp.exe
  C:\Windows\System\EARvFyp.exe
  2⤵
  PID:5100
- C:\Windows\System\bGcqEBQ.exe
  C:\Windows\System\bGcqEBQ.exe
  2⤵
  PID:3180
- C:\Windows\System\xyeTwcE.exe
  C:\Windows\System\xyeTwcE.exe
  2⤵
  PID:4132
- C:\Windows\System\DotPvOh.exe
  C:\Windows\System\DotPvOh.exe
  2⤵
  PID:4100
- C:\Windows\System\XPQOHws.exe
  C:\Windows\System\XPQOHws.exe
  2⤵
  PID:4260
- C:\Windows\System\WKAXwoq.exe
  C:\Windows\System\WKAXwoq.exe
  2⤵
  PID:1072
- C:\Windows\System\IrreOVP.exe
  C:\Windows\System\IrreOVP.exe
  2⤵
  PID:4112
- C:\Windows\System\PSapXBS.exe
  C:\Windows\System\PSapXBS.exe
  2⤵
  PID:4276
- C:\Windows\System\VtzKvzO.exe
  C:\Windows\System\VtzKvzO.exe
  2⤵
  PID:4288
- C:\Windows\System\iwZrWML.exe
  C:\Windows\System\iwZrWML.exe
  2⤵
  PID:3520
- C:\Windows\System\pAqbKUT.exe
  C:\Windows\System\pAqbKUT.exe
  2⤵
  PID:3132
- C:\Windows\System\HUJlilX.exe
  C:\Windows\System\HUJlilX.exe
  2⤵
  PID:4344
- C:\Windows\System\zprWKuw.exe
  C:\Windows\System\zprWKuw.exe
  2⤵
  PID:4512
- C:\Windows\System\DmEEqhO.exe
  C:\Windows\System\DmEEqhO.exe
  2⤵
  PID:4668
- C:\Windows\System\PxvyRQA.exe
  C:\Windows\System\PxvyRQA.exe
  2⤵
  PID:4924
- C:\Windows\System\qrYqcCg.exe
  C:\Windows\System\qrYqcCg.exe
  2⤵
  PID:4428
- C:\Windows\System\tgskvNs.exe
  C:\Windows\System\tgskvNs.exe
  2⤵
  PID:4656
- C:\Windows\System\yAkURaa.exe
  C:\Windows\System\yAkURaa.exe
  2⤵
  PID:4940
- C:\Windows\System\sLZsLnm.exe
  C:\Windows\System\sLZsLnm.exe
  2⤵
  PID:4092
- C:\Windows\System\MWwGlnC.exe
  C:\Windows\System\MWwGlnC.exe
  2⤵
  PID:3196
- C:\Windows\System\jxKWWmX.exe
  C:\Windows\System\jxKWWmX.exe
  2⤵
  PID:4044
- C:\Windows\System\oPrgmAB.exe
  C:\Windows\System\oPrgmAB.exe
  2⤵
  PID:4796
- C:\Windows\System\RHudHnQ.exe
  C:\Windows\System\RHudHnQ.exe
  2⤵
  PID:5072
- C:\Windows\System\kpCeaQj.exe
  C:\Windows\System\kpCeaQj.exe
  2⤵
  PID:5132
- C:\Windows\System\vwdhduC.exe
  C:\Windows\System\vwdhduC.exe
  2⤵
  PID:5148
- C:\Windows\System\rPyJPED.exe
  C:\Windows\System\rPyJPED.exe
  2⤵
  PID:5164
- C:\Windows\System\CWDxSOF.exe
  C:\Windows\System\CWDxSOF.exe
  2⤵
  PID:5180
- C:\Windows\System\JOvzGpy.exe
  C:\Windows\System\JOvzGpy.exe
  2⤵
  PID:5196
- C:\Windows\System\gEqznoX.exe
  C:\Windows\System\gEqznoX.exe
  2⤵
  PID:5212
- C:\Windows\System\YAnpxVC.exe
  C:\Windows\System\YAnpxVC.exe
  2⤵
  PID:5228
- C:\Windows\System\AWvbEkC.exe
  C:\Windows\System\AWvbEkC.exe
  2⤵
  PID:5244
- C:\Windows\System\QgdPwkw.exe
  C:\Windows\System\QgdPwkw.exe
  2⤵
  PID:5260
- C:\Windows\System\ikHeyYE.exe
  C:\Windows\System\ikHeyYE.exe
  2⤵
  PID:5276
- C:\Windows\System\CQKSmzm.exe
  C:\Windows\System\CQKSmzm.exe
  2⤵
  PID:5292
- C:\Windows\System\ZgvYgxg.exe
  C:\Windows\System\ZgvYgxg.exe
  2⤵
  PID:5308
- C:\Windows\System\mrNxzbM.exe
  C:\Windows\System\mrNxzbM.exe
  2⤵
  PID:5324
- C:\Windows\System\zNqbrOE.exe
  C:\Windows\System\zNqbrOE.exe
  2⤵
  PID:5340
- C:\Windows\System\oqGSyCQ.exe
  C:\Windows\System\oqGSyCQ.exe
  2⤵
  PID:5356
- C:\Windows\System\TwlXsQl.exe
  C:\Windows\System\TwlXsQl.exe
  2⤵
  PID:5372
- C:\Windows\System\wPhTNEW.exe
  C:\Windows\System\wPhTNEW.exe
  2⤵
  PID:5388
- C:\Windows\System\IxiurFu.exe
  C:\Windows\System\IxiurFu.exe
  2⤵
  PID:5404
- C:\Windows\System\UsSpPaL.exe
  C:\Windows\System\UsSpPaL.exe
  2⤵
  PID:5420
- C:\Windows\System\NvBReXl.exe
  C:\Windows\System\NvBReXl.exe
  2⤵
  PID:5436
- C:\Windows\System\pnVqJgt.exe
  C:\Windows\System\pnVqJgt.exe
  2⤵
  PID:5452
- C:\Windows\System\AZmEZtK.exe
  C:\Windows\System\AZmEZtK.exe
  2⤵
  PID:5468
- C:\Windows\System\tObLKCR.exe
  C:\Windows\System\tObLKCR.exe
  2⤵
  PID:5484
- C:\Windows\System\PsiEwIE.exe
  C:\Windows\System\PsiEwIE.exe
  2⤵
  PID:5500
- C:\Windows\System\IdtSKma.exe
  C:\Windows\System\IdtSKma.exe
  2⤵
  PID:5516
- C:\Windows\System\jwebmLv.exe
  C:\Windows\System\jwebmLv.exe
  2⤵
  PID:5532
- C:\Windows\System\oqeZuoo.exe
  C:\Windows\System\oqeZuoo.exe
  2⤵
  PID:5548
- C:\Windows\System\TziuvuU.exe
  C:\Windows\System\TziuvuU.exe
  2⤵
  PID:5564
- C:\Windows\System\GJlelQi.exe
  C:\Windows\System\GJlelQi.exe
  2⤵
  PID:5580
- C:\Windows\System\zBjoQLl.exe
  C:\Windows\System\zBjoQLl.exe
  2⤵
  PID:5596
- C:\Windows\System\sMevabX.exe
  C:\Windows\System\sMevabX.exe
  2⤵
  PID:5612
- C:\Windows\System\nCORdAz.exe
  C:\Windows\System\nCORdAz.exe
  2⤵
  PID:5628
- C:\Windows\System\RkNjNFQ.exe
  C:\Windows\System\RkNjNFQ.exe
  2⤵
  PID:5644
- C:\Windows\System\TfVksTy.exe
  C:\Windows\System\TfVksTy.exe
  2⤵
  PID:5660
- C:\Windows\System\VSxzKkV.exe
  C:\Windows\System\VSxzKkV.exe
  2⤵
  PID:5676
- C:\Windows\System\aZuLDJh.exe
  C:\Windows\System\aZuLDJh.exe
  2⤵
  PID:5692
- C:\Windows\System\jbifiSR.exe
  C:\Windows\System\jbifiSR.exe
  2⤵
  PID:5708
- C:\Windows\System\NYDwrgW.exe
  C:\Windows\System\NYDwrgW.exe
  2⤵
  PID:5724
- C:\Windows\System\mXHbjNJ.exe
  C:\Windows\System\mXHbjNJ.exe
  2⤵
  PID:5740
- C:\Windows\System\NkCqaPy.exe
  C:\Windows\System\NkCqaPy.exe
  2⤵
  PID:5756
- C:\Windows\System\mgldKfl.exe
  C:\Windows\System\mgldKfl.exe
  2⤵
  PID:5772
- C:\Windows\System\PXEQJix.exe
  C:\Windows\System\PXEQJix.exe
  2⤵
  PID:5788
- C:\Windows\System\qtcTKbE.exe
  C:\Windows\System\qtcTKbE.exe
  2⤵
  PID:5804
- C:\Windows\System\AfwEDHy.exe
  C:\Windows\System\AfwEDHy.exe
  2⤵
  PID:5824
- C:\Windows\System\fnkkYZx.exe
  C:\Windows\System\fnkkYZx.exe
  2⤵
  PID:5840
- C:\Windows\System\eLZtpen.exe
  C:\Windows\System\eLZtpen.exe
  2⤵
  PID:5856
- C:\Windows\System\bopkzlj.exe
  C:\Windows\System\bopkzlj.exe
  2⤵
  PID:5872
- C:\Windows\System\qSnPMCq.exe
  C:\Windows\System\qSnPMCq.exe
  2⤵
  PID:5892
- C:\Windows\System\wiqCHKE.exe
  C:\Windows\System\wiqCHKE.exe
  2⤵
  PID:5908
- C:\Windows\System\wHDHUSX.exe
  C:\Windows\System\wHDHUSX.exe
  2⤵
  PID:5928
- C:\Windows\System\uVrTPhF.exe
  C:\Windows\System\uVrTPhF.exe
  2⤵
  PID:5944
- C:\Windows\System\jbpAJiq.exe
  C:\Windows\System\jbpAJiq.exe
  2⤵
  PID:5964
- C:\Windows\System\WXuOOod.exe
  C:\Windows\System\WXuOOod.exe
  2⤵
  PID:5984
- C:\Windows\System\gZLJhgJ.exe
  C:\Windows\System\gZLJhgJ.exe
  2⤵
  PID:6008
- C:\Windows\System\kWLJVYj.exe
  C:\Windows\System\kWLJVYj.exe
  2⤵
  PID:6052
- C:\Windows\System\CRqAabs.exe
  C:\Windows\System\CRqAabs.exe
  2⤵
  PID:6068
- C:\Windows\System\elKPFNC.exe
  C:\Windows\System\elKPFNC.exe
  2⤵
  PID:6084
- C:\Windows\System\jleWkHV.exe
  C:\Windows\System\jleWkHV.exe
  2⤵
  PID:6100
- C:\Windows\System\UIfaFek.exe
  C:\Windows\System\UIfaFek.exe
  2⤵
  PID:6116
- C:\Windows\System\UkopIQv.exe
  C:\Windows\System\UkopIQv.exe
  2⤵
  PID:6132
- C:\Windows\System\ISTfATc.exe
  C:\Windows\System\ISTfATc.exe
  2⤵
  PID:4448
- C:\Windows\System\oBqFeZv.exe
  C:\Windows\System\oBqFeZv.exe
  2⤵
  PID:4652
- C:\Windows\System\GlRpPOk.exe
  C:\Windows\System\GlRpPOk.exe
  2⤵
  PID:5204
- C:\Windows\System\fYjcoiq.exe
  C:\Windows\System\fYjcoiq.exe
  2⤵
  PID:5268
- C:\Windows\System\vLluHUL.exe
  C:\Windows\System\vLluHUL.exe
  2⤵
  PID:5332
- C:\Windows\System\DeSKyae.exe
  C:\Windows\System\DeSKyae.exe
  2⤵
  PID:4476
- C:\Windows\System\CYisOFb.exe
  C:\Windows\System\CYisOFb.exe
  2⤵
  PID:5432
- C:\Windows\System\WXVfeDA.exe
  C:\Windows\System\WXVfeDA.exe
  2⤵
  PID:5496
- C:\Windows\System\JgqVazf.exe
  C:\Windows\System\JgqVazf.exe
  2⤵
  PID:5560
- C:\Windows\System\qvgxVuQ.exe
  C:\Windows\System\qvgxVuQ.exe
  2⤵
  PID:4960
- C:\Windows\System\LrJpSEN.exe
  C:\Windows\System\LrJpSEN.exe
  2⤵
  PID:5592
- C:\Windows\System\wqfwlHT.exe
  C:\Windows\System\wqfwlHT.exe
  2⤵
  PID:5656
- C:\Windows\System\QCnbPAK.exe
  C:\Windows\System\QCnbPAK.exe
  2⤵
  PID:5720
- C:\Windows\System\UhMwKXE.exe
  C:\Windows\System\UhMwKXE.exe
  2⤵
  PID:5784
- C:\Windows\System\CQrfObd.exe
  C:\Windows\System\CQrfObd.exe
  2⤵
  PID:5848
- C:\Windows\System\EtNvbyb.exe
  C:\Windows\System\EtNvbyb.exe
  2⤵
  PID:5888
- C:\Windows\System\sfpVyTP.exe
  C:\Windows\System\sfpVyTP.exe
  2⤵
  PID:5952
- C:\Windows\System\ovfcCIE.exe
  C:\Windows\System\ovfcCIE.exe
  2⤵
  PID:5992
- C:\Windows\System\EOSDoOE.exe
  C:\Windows\System\EOSDoOE.exe
  2⤵
  PID:5288
- C:\Windows\System\LdlheZl.exe
  C:\Windows\System\LdlheZl.exe
  2⤵
  PID:4704
- C:\Windows\System\BnebKei.exe
  C:\Windows\System\BnebKei.exe
  2⤵
  PID:5088
- C:\Windows\System\rGPFONc.exe
  C:\Windows\System\rGPFONc.exe
  2⤵
  PID:4588
- C:\Windows\System\QDrBhWp.exe
  C:\Windows\System\QDrBhWp.exe
  2⤵
  PID:4876
- C:\Windows\System\uAHSUPC.exe
  C:\Windows\System\uAHSUPC.exe
  2⤵
  PID:5636
- C:\Windows\System\TZDQSTz.exe
  C:\Windows\System\TZDQSTz.exe
  2⤵
  PID:3660
- C:\Windows\System\CWrfyxh.exe
  C:\Windows\System\CWrfyxh.exe
  2⤵
  PID:4384
- C:\Windows\System\KyDWbvY.exe
  C:\Windows\System\KyDWbvY.exe
  2⤵
  PID:5220
- C:\Windows\System\LlHavNP.exe
  C:\Windows\System\LlHavNP.exe
  2⤵
  PID:5316
- C:\Windows\System\qEFLyXs.exe
  C:\Windows\System\qEFLyXs.exe
  2⤵
  PID:5412
- C:\Windows\System\fvKiGgv.exe
  C:\Windows\System\fvKiGgv.exe
  2⤵
  PID:5476
- C:\Windows\System\mKPnJeG.exe
  C:\Windows\System\mKPnJeG.exe
  2⤵
  PID:5540
- C:\Windows\System\jcRxicf.exe
  C:\Windows\System\jcRxicf.exe
  2⤵
  PID:5864
- C:\Windows\System\zmiTiOW.exe
  C:\Windows\System\zmiTiOW.exe
  2⤵
  PID:4332
- C:\Windows\System\HJaQkqq.exe
  C:\Windows\System\HJaQkqq.exe
  2⤵
  PID:3232
- C:\Windows\System\TUDUqke.exe
  C:\Windows\System\TUDUqke.exe
  2⤵
  PID:5124
- C:\Windows\System\QqnxvgK.exe
  C:\Windows\System\QqnxvgK.exe
  2⤵
  PID:5608
- C:\Windows\System\xXZQomp.exe
  C:\Windows\System\xXZQomp.exe
  2⤵
  PID:5736
- C:\Windows\System\LZAnigp.exe
  C:\Windows\System\LZAnigp.exe
  2⤵
  PID:5836
- C:\Windows\System\PhdvBqM.exe
  C:\Windows\System\PhdvBqM.exe
  2⤵
  PID:5936
- C:\Windows\System\BgLBKww.exe
  C:\Windows\System\BgLBKww.exe
  2⤵
  PID:5980
- C:\Windows\System\ScnmSwG.exe
  C:\Windows\System\ScnmSwG.exe
  2⤵
  PID:6000
- C:\Windows\System\QJWxDYF.exe
  C:\Windows\System\QJWxDYF.exe
  2⤵
  PID:6024
- C:\Windows\System\iuZJNBl.exe
  C:\Windows\System\iuZJNBl.exe
  2⤵
  PID:6040
- C:\Windows\System\bZYOtLN.exe
  C:\Windows\System\bZYOtLN.exe
  2⤵
  PID:6096
- C:\Windows\System\QkGlsqq.exe
  C:\Windows\System\QkGlsqq.exe
  2⤵
  PID:4496
- C:\Windows\System\bikKYQw.exe
  C:\Windows\System\bikKYQw.exe
  2⤵
  PID:5368
- C:\Windows\System\OdfAtZy.exe
  C:\Windows\System\OdfAtZy.exe
  2⤵
  PID:6048
- C:\Windows\System\oHXRDgS.exe
  C:\Windows\System\oHXRDgS.exe
  2⤵
  PID:6112
- C:\Windows\System\evqvlbm.exe
  C:\Windows\System\evqvlbm.exe
  2⤵
  PID:5652
- C:\Windows\System\aZVzMnv.exe
  C:\Windows\System\aZVzMnv.exe
  2⤵
  PID:6080
- C:\Windows\System\JpsvIAK.exe
  C:\Windows\System\JpsvIAK.exe
  2⤵
  PID:5880
- C:\Windows\System\JKbrGGy.exe
  C:\Windows\System\JKbrGGy.exe
  2⤵
  PID:5352
- C:\Windows\System\ABoUWox.exe
  C:\Windows\System\ABoUWox.exe
  2⤵
  PID:5716
- C:\Windows\System\wwRVYaz.exe
  C:\Windows\System\wwRVYaz.exe
  2⤵
  PID:5528
- C:\Windows\System\tbwsRRo.exe
  C:\Windows\System\tbwsRRo.exe
  2⤵
  PID:5820
- C:\Windows\System\mKGByqL.exe
  C:\Windows\System\mKGByqL.exe
  2⤵
  PID:5916
- C:\Windows\System\cQfqXTc.exe
  C:\Windows\System\cQfqXTc.exe
  2⤵
  PID:5448
- C:\Windows\System\mHyrcTS.exe
  C:\Windows\System\mHyrcTS.exe
  2⤵
  PID:4912
- C:\Windows\System\ICbrfGj.exe
  C:\Windows\System\ICbrfGj.exe
  2⤵
  PID:5688
- C:\Windows\System\ITsCPZV.exe
  C:\Windows\System\ITsCPZV.exe
  2⤵
  PID:5572
- C:\Windows\System\KjQNkVY.exe
  C:\Windows\System\KjQNkVY.exe
  2⤵
  PID:4832
- C:\Windows\System\cqQJgLt.exe
  C:\Windows\System\cqQJgLt.exe
  2⤵
  PID:3912
- C:\Windows\System\YZSTqqk.exe
  C:\Windows\System\YZSTqqk.exe
  2⤵
  PID:5384
- C:\Windows\System\EmxGcbI.exe
  C:\Windows\System\EmxGcbI.exe
  2⤵
  PID:4640
- C:\Windows\System\TYlngLc.exe
  C:\Windows\System\TYlngLc.exe
  2⤵
  PID:6020
- C:\Windows\System\zHlOavc.exe
  C:\Windows\System\zHlOavc.exe
  2⤵
  PID:5364
- C:\Windows\System\vGwOzxu.exe
  C:\Windows\System\vGwOzxu.exe
  2⤵
  PID:6128
- C:\Windows\System\fzYhpJd.exe
  C:\Windows\System\fzYhpJd.exe
  2⤵
  PID:5700
- C:\Windows\System\reOyrlO.exe
  C:\Windows\System\reOyrlO.exe
  2⤵
  PID:4244
- C:\Windows\System\LoNIJHO.exe
  C:\Windows\System\LoNIJHO.exe
  2⤵
  PID:6032
- C:\Windows\System\rGSuAaj.exe
  C:\Windows\System\rGSuAaj.exe
  2⤵
  PID:4604
- C:\Windows\System\PcQlHBS.exe
  C:\Windows\System\PcQlHBS.exe
  2⤵
  PID:5428
- C:\Windows\System\LXjehly.exe
  C:\Windows\System\LXjehly.exe
  2⤵
  PID:4812
- C:\Windows\System\exQycZu.exe
  C:\Windows\System\exQycZu.exe
  2⤵
  PID:5732
- C:\Windows\System\HqIZlMv.exe
  C:\Windows\System\HqIZlMv.exe
  2⤵
  PID:5240
- C:\Windows\System\vwHQaNw.exe
  C:\Windows\System\vwHQaNw.exe
  2⤵
  PID:5492
- C:\Windows\System\YzuEFNK.exe
  C:\Windows\System\YzuEFNK.exe
  2⤵
  PID:5004
- C:\Windows\System\eRXuEMy.exe
  C:\Windows\System\eRXuEMy.exe
  2⤵
  PID:5008
- C:\Windows\System\jxUOPnN.exe
  C:\Windows\System\jxUOPnN.exe
  2⤵
  PID:6044
- C:\Windows\System\jZtXRgl.exe
  C:\Windows\System\jZtXRgl.exe
  2⤵
  PID:6016
- C:\Windows\System\sUVItXC.exe
  C:\Windows\System\sUVItXC.exe
  2⤵
  PID:5624
- C:\Windows\System\AffPFFM.exe
  C:\Windows\System\AffPFFM.exe
  2⤵
  PID:4464
- C:\Windows\System\zWTmILI.exe
  C:\Windows\System\zWTmILI.exe
  2⤵
  PID:5640
- C:\Windows\System\aIFtANR.exe
  C:\Windows\System\aIFtANR.exe
  2⤵
  PID:5188
- C:\Windows\System\GuwDeVQ.exe
  C:\Windows\System\GuwDeVQ.exe
  2⤵
  PID:6160
- C:\Windows\System\ajFNuOm.exe
  C:\Windows\System\ajFNuOm.exe
  2⤵
  PID:6176
- C:\Windows\System\JAEwjWF.exe
  C:\Windows\System\JAEwjWF.exe
  2⤵
  PID:6192
- C:\Windows\System\DJWwUCz.exe
  C:\Windows\System\DJWwUCz.exe
  2⤵
  PID:6208
- C:\Windows\System\sJXtfZr.exe
  C:\Windows\System\sJXtfZr.exe
  2⤵
  PID:6224
- C:\Windows\System\uNzMHNx.exe
  C:\Windows\System\uNzMHNx.exe
  2⤵
  PID:6240
- C:\Windows\System\OebzBpV.exe
  C:\Windows\System\OebzBpV.exe
  2⤵
  PID:6256
- C:\Windows\System\ZYiXHRv.exe
  C:\Windows\System\ZYiXHRv.exe
  2⤵
  PID:6272
- C:\Windows\System\sYLpkPB.exe
  C:\Windows\System\sYLpkPB.exe
  2⤵
  PID:6288
- C:\Windows\System\HJnJRrH.exe
  C:\Windows\System\HJnJRrH.exe
  2⤵
  PID:6304
- C:\Windows\System\IVEHjcA.exe
  C:\Windows\System\IVEHjcA.exe
  2⤵
  PID:6320
- C:\Windows\System\ABqRXMp.exe
  C:\Windows\System\ABqRXMp.exe
  2⤵
  PID:6336
- C:\Windows\System\LstKwko.exe
  C:\Windows\System\LstKwko.exe
  2⤵
  PID:6352
- C:\Windows\System\htNXkMb.exe
  C:\Windows\System\htNXkMb.exe
  2⤵
  PID:6368
- C:\Windows\System\mvAiZaQ.exe
  C:\Windows\System\mvAiZaQ.exe
  2⤵
  PID:6384
- C:\Windows\System\HwHzITh.exe
  C:\Windows\System\HwHzITh.exe
  2⤵
  PID:6408
- C:\Windows\System\RNSKddx.exe
  C:\Windows\System\RNSKddx.exe
  2⤵
  PID:6424
- C:\Windows\System\ofPfefC.exe
  C:\Windows\System\ofPfefC.exe
  2⤵
  PID:6440
- C:\Windows\System\bfJiQyx.exe
  C:\Windows\System\bfJiQyx.exe
  2⤵
  PID:6456
- C:\Windows\System\kawweRu.exe
  C:\Windows\System\kawweRu.exe
  2⤵
  PID:6472
- C:\Windows\System\HmIxJtt.exe
  C:\Windows\System\HmIxJtt.exe
  2⤵
  PID:6488
- C:\Windows\System\xbYFMoS.exe
  C:\Windows\System\xbYFMoS.exe
  2⤵
  PID:6504
- C:\Windows\System\JgNLViJ.exe
  C:\Windows\System\JgNLViJ.exe
  2⤵
  PID:6520
- C:\Windows\System\HvxBdAp.exe
  C:\Windows\System\HvxBdAp.exe
  2⤵
  PID:6536
- C:\Windows\System\KfHCRuW.exe
  C:\Windows\System\KfHCRuW.exe
  2⤵
  PID:6552
- C:\Windows\System\bQFMNzS.exe
  C:\Windows\System\bQFMNzS.exe
  2⤵
  PID:6568
- C:\Windows\System\FDhTrTE.exe
  C:\Windows\System\FDhTrTE.exe
  2⤵
  PID:6584
- C:\Windows\System\fvDDNHi.exe
  C:\Windows\System\fvDDNHi.exe
  2⤵
  PID:6600
- C:\Windows\System\EBzpypE.exe
  C:\Windows\System\EBzpypE.exe
  2⤵
  PID:6616
- C:\Windows\System\FksHMhM.exe
  C:\Windows\System\FksHMhM.exe
  2⤵
  PID:6632
- C:\Windows\System\WLjVTsB.exe
  C:\Windows\System\WLjVTsB.exe
  2⤵
  PID:6648
- C:\Windows\System\KUCZsOb.exe
  C:\Windows\System\KUCZsOb.exe
  2⤵
  PID:6664
- C:\Windows\System\RxKKKEN.exe
  C:\Windows\System\RxKKKEN.exe
  2⤵
  PID:6680
- C:\Windows\System\PILXdMC.exe
  C:\Windows\System\PILXdMC.exe
  2⤵
  PID:6696
- C:\Windows\System\BTAljBA.exe
  C:\Windows\System\BTAljBA.exe
  2⤵
  PID:6712
- C:\Windows\System\RgXjpzL.exe
  C:\Windows\System\RgXjpzL.exe
  2⤵
  PID:6728
- C:\Windows\System\LjLkkqA.exe
  C:\Windows\System\LjLkkqA.exe
  2⤵
  PID:6744
- C:\Windows\System\vrsoDJx.exe
  C:\Windows\System\vrsoDJx.exe
  2⤵
  PID:6760
- C:\Windows\System\VxIWmwv.exe
  C:\Windows\System\VxIWmwv.exe
  2⤵
  PID:6776
- C:\Windows\System\jzNJdLk.exe
  C:\Windows\System\jzNJdLk.exe
  2⤵
  PID:6792
- C:\Windows\System\eocjBck.exe
  C:\Windows\System\eocjBck.exe
  2⤵
  PID:6808
- C:\Windows\System\jGYJRJU.exe
  C:\Windows\System\jGYJRJU.exe
  2⤵
  PID:6824
- C:\Windows\System\CgULuql.exe
  C:\Windows\System\CgULuql.exe
  2⤵
  PID:6840
- C:\Windows\System\hLaIijL.exe
  C:\Windows\System\hLaIijL.exe
  2⤵
  PID:6856
- C:\Windows\System\cbWSXPk.exe
  C:\Windows\System\cbWSXPk.exe
  2⤵
  PID:6872
- C:\Windows\System\YrffyJf.exe
  C:\Windows\System\YrffyJf.exe
  2⤵
  PID:6888
- C:\Windows\System\QjXoAec.exe
  C:\Windows\System\QjXoAec.exe
  2⤵
  PID:6904
- C:\Windows\System\ZjbFewG.exe
  C:\Windows\System\ZjbFewG.exe
  2⤵
  PID:6920
- C:\Windows\System\LYfeRAo.exe
  C:\Windows\System\LYfeRAo.exe
  2⤵
  PID:6936
- C:\Windows\System\UtteymZ.exe
  C:\Windows\System\UtteymZ.exe
  2⤵
  PID:6952
- C:\Windows\System\KmpaLvs.exe
  C:\Windows\System\KmpaLvs.exe
  2⤵
  PID:6968
- C:\Windows\System\kYjkrJT.exe
  C:\Windows\System\kYjkrJT.exe
  2⤵
  PID:6984
- C:\Windows\System\YYoWCiJ.exe
  C:\Windows\System\YYoWCiJ.exe
  2⤵
  PID:7000
- C:\Windows\System\ZUQdjeV.exe
  C:\Windows\System\ZUQdjeV.exe
  2⤵
  PID:7016
- C:\Windows\System\qUEuiaQ.exe
  C:\Windows\System\qUEuiaQ.exe
  2⤵
  PID:7032
- C:\Windows\System\QbaWwHn.exe
  C:\Windows\System\QbaWwHn.exe
  2⤵
  PID:7048
- C:\Windows\System\IsaNcQJ.exe
  C:\Windows\System\IsaNcQJ.exe
  2⤵
  PID:7064
- C:\Windows\System\kBvNsaI.exe
  C:\Windows\System\kBvNsaI.exe
  2⤵
  PID:7080
- C:\Windows\System\fjgNjyD.exe
  C:\Windows\System\fjgNjyD.exe
  2⤵
  PID:7096
- C:\Windows\System\LVSrVfW.exe
  C:\Windows\System\LVSrVfW.exe
  2⤵
  PID:7112
- C:\Windows\System\yPIucvT.exe
  C:\Windows\System\yPIucvT.exe
  2⤵
  PID:7128
- C:\Windows\System\Jlywcqq.exe
  C:\Windows\System\Jlywcqq.exe
  2⤵
  PID:7144
- C:\Windows\System\yFRxKmS.exe
  C:\Windows\System\yFRxKmS.exe
  2⤵
  PID:7160
- C:\Windows\System\bpPtiQb.exe
  C:\Windows\System\bpPtiQb.exe
  2⤵
  PID:5116
- C:\Windows\System\vhfbvNe.exe
  C:\Windows\System\vhfbvNe.exe
  2⤵
  PID:4576
- C:\Windows\System\qkIyhIO.exe
  C:\Windows\System\qkIyhIO.exe
  2⤵
  PID:5904
- C:\Windows\System\BfoOlql.exe
  C:\Windows\System\BfoOlql.exe
  2⤵
  PID:6156
- C:\Windows\System\vduWqOL.exe
  C:\Windows\System\vduWqOL.exe
  2⤵
  PID:6300
- C:\Windows\System\SOOIcQz.exe
  C:\Windows\System\SOOIcQz.exe
  2⤵
  PID:5796
- C:\Windows\System\QJfgkxz.exe
  C:\Windows\System\QJfgkxz.exe
  2⤵
  PID:5832
- C:\Windows\System\DpYwugi.exe
  C:\Windows\System\DpYwugi.exe
  2⤵
  PID:6184
- C:\Windows\System\ahwKyxI.exe
  C:\Windows\System\ahwKyxI.exe
  2⤵
  PID:6316
- C:\Windows\System\KPtPAAh.exe
  C:\Windows\System\KPtPAAh.exe
  2⤵
  PID:6280
- C:\Windows\System\nMmpiYa.exe
  C:\Windows\System\nMmpiYa.exe
  2⤵
  PID:6312
- C:\Windows\System\XZLaWFY.exe
  C:\Windows\System\XZLaWFY.exe
  2⤵
  PID:6392
- C:\Windows\System\saktaZm.exe
  C:\Windows\System\saktaZm.exe
  2⤵
  PID:6432
- C:\Windows\System\NJbsxpn.exe
  C:\Windows\System\NJbsxpn.exe
  2⤵
  PID:6560
- C:\Windows\System\RfjVcie.exe
  C:\Windows\System\RfjVcie.exe
  2⤵
  PID:6532
- C:\Windows\System\uuuIlpx.exe
  C:\Windows\System\uuuIlpx.exe
  2⤵
  PID:6624
- C:\Windows\System\onaEhxe.exe
  C:\Windows\System\onaEhxe.exe
  2⤵
  PID:6660
- C:\Windows\System\BDdNkpN.exe
  C:\Windows\System\BDdNkpN.exe
  2⤵
  PID:6724
- C:\Windows\System\cYMQBXi.exe
  C:\Windows\System\cYMQBXi.exe
  2⤵
  PID:6788
- C:\Windows\System\yZwcLPr.exe
  C:\Windows\System\yZwcLPr.exe
  2⤵
  PID:6852
- C:\Windows\System\rACLtke.exe
  C:\Windows\System\rACLtke.exe
  2⤵
  PID:6916
- C:\Windows\System\mmBuuLl.exe
  C:\Windows\System\mmBuuLl.exe
  2⤵
  PID:6448
- C:\Windows\System\ZLdzVEI.exe
  C:\Windows\System\ZLdzVEI.exe
  2⤵
  PID:7040
- C:\Windows\System\RnKujtw.exe
  C:\Windows\System\RnKujtw.exe
  2⤵
  PID:6480
- C:\Windows\System\lLtrUTy.exe
  C:\Windows\System\lLtrUTy.exe
  2⤵
  PID:6416
- C:\Windows\System\MeKwErV.exe
  C:\Windows\System\MeKwErV.exe
  2⤵
  PID:6740
- C:\Windows\System\MSQPJkE.exe
  C:\Windows\System\MSQPJkE.exe
  2⤵
  PID:7140
- C:\Windows\System\JGHYWQY.exe
  C:\Windows\System\JGHYWQY.exe
  2⤵
  PID:6204
- C:\Windows\System\XjhuOol.exe
  C:\Windows\System\XjhuOol.exe
  2⤵
  PID:6548
- C:\Windows\System\DJPWoKn.exe
  C:\Windows\System\DJPWoKn.exe
  2⤵
  PID:6644
- C:\Windows\System\lAvOnNy.exe
  C:\Windows\System\lAvOnNy.exe
  2⤵
  PID:6768
- C:\Windows\System\MMghcyj.exe
  C:\Windows\System\MMghcyj.exe
  2⤵
  PID:6836
- C:\Windows\System\ebUuPNB.exe
  C:\Windows\System\ebUuPNB.exe
  2⤵
  PID:6928
- C:\Windows\System\SvqJRZI.exe
  C:\Windows\System\SvqJRZI.exe
  2⤵
  PID:6992
- C:\Windows\System\mFXehnI.exe
  C:\Windows\System\mFXehnI.exe
  2⤵
  PID:7056
- C:\Windows\System\QUcYNol.exe
  C:\Windows\System\QUcYNol.exe
  2⤵
  PID:5900
- C:\Windows\System\LKeNWOT.exe
  C:\Windows\System\LKeNWOT.exe
  2⤵
  PID:7156
- C:\Windows\System\ZvpxdkJ.exe
  C:\Windows\System\ZvpxdkJ.exe
  2⤵
  PID:6152
- C:\Windows\System\LYNzCqZ.exe
  C:\Windows\System\LYNzCqZ.exe
  2⤵
  PID:6092
- C:\Windows\System\ClKlMZx.exe
  C:\Windows\System\ClKlMZx.exe
  2⤵
  PID:5976
- C:\Windows\System\ZJNoSFj.exe
  C:\Windows\System\ZJNoSFj.exe
  2⤵
  PID:6400
- C:\Windows\System\yhVmYUY.exe
  C:\Windows\System\yhVmYUY.exe
  2⤵
  PID:6364
- C:\Windows\System\pSJlNwj.exe
  C:\Windows\System\pSJlNwj.exe
  2⤵
  PID:6380
- C:\Windows\System\uNBdfJb.exe
  C:\Windows\System\uNBdfJb.exe
  2⤵
  PID:6596
- C:\Windows\System\dURDPti.exe
  C:\Windows\System\dURDPti.exe
  2⤵
  PID:6784
- C:\Windows\System\uBGjSma.exe
  C:\Windows\System\uBGjSma.exe
  2⤵
  PID:7012
- C:\Windows\System\vIoFyPu.exe
  C:\Windows\System\vIoFyPu.exe
  2⤵
  PID:6580
- C:\Windows\System\KkQDwYI.exe
  C:\Windows\System\KkQDwYI.exe
  2⤵
  PID:6692
- C:\Windows\System\BpmvMSH.exe
  C:\Windows\System\BpmvMSH.exe
  2⤵
  PID:6708
- C:\Windows\System\jxCzetJ.exe
  C:\Windows\System\jxCzetJ.exe
  2⤵
  PID:7024
- C:\Windows\System\YveFBzz.exe
  C:\Windows\System\YveFBzz.exe
  2⤵
  PID:7072
- C:\Windows\System\zIwlaPL.exe
  C:\Windows\System\zIwlaPL.exe
  2⤵
  PID:6344
- C:\Windows\System\lQQwwGH.exe
  C:\Windows\System\lQQwwGH.exe
  2⤵
  PID:6736
- C:\Windows\System\GLXFyjJ.exe
  C:\Windows\System\GLXFyjJ.exe
  2⤵
  PID:6484
- C:\Windows\System\OoPDuAx.exe
  C:\Windows\System\OoPDuAx.exe
  2⤵
  PID:6804
- C:\Windows\System\WPODpSY.exe
  C:\Windows\System\WPODpSY.exe
  2⤵
  PID:7088
- C:\Windows\System\wwUDmcb.exe
  C:\Windows\System\wwUDmcb.exe
  2⤵
  PID:5924
- C:\Windows\System\ddDLagQ.exe
  C:\Windows\System\ddDLagQ.exe
  2⤵
  PID:6468
- C:\Windows\System\etQoTmx.exe
  C:\Windows\System\etQoTmx.exe
  2⤵
  PID:6820
- C:\Windows\System\ILOacJd.exe
  C:\Windows\System\ILOacJd.exe
  2⤵
  PID:6948
- C:\Windows\System\DFgMGhH.exe
  C:\Windows\System\DFgMGhH.exe
  2⤵
  PID:6640
- C:\Windows\System\eUGWkel.exe
  C:\Windows\System\eUGWkel.exe
  2⤵
  PID:6756
- C:\Windows\System\FJsdQjB.exe
  C:\Windows\System\FJsdQjB.exe
  2⤵
  PID:6676
- C:\Windows\System\WwkFaDn.exe
  C:\Windows\System\WwkFaDn.exe
  2⤵
  PID:6868
- C:\Windows\System\JLBHtga.exe
  C:\Windows\System\JLBHtga.exe
  2⤵
  PID:7184
- C:\Windows\System\UPnBvDH.exe
  C:\Windows\System\UPnBvDH.exe
  2⤵
  PID:7200
- C:\Windows\System\JsNTGtO.exe
  C:\Windows\System\JsNTGtO.exe
  2⤵
  PID:7216
- C:\Windows\System\HrfjfNn.exe
  C:\Windows\System\HrfjfNn.exe
  2⤵
  PID:7232
- C:\Windows\System\QRfMmEq.exe
  C:\Windows\System\QRfMmEq.exe
  2⤵
  PID:7260
- C:\Windows\System\vVJyJGB.exe
  C:\Windows\System\vVJyJGB.exe
  2⤵
  PID:7276
- C:\Windows\System\kzCeRsR.exe
  C:\Windows\System\kzCeRsR.exe
  2⤵
  PID:7292
- C:\Windows\System\IQTBltm.exe
  C:\Windows\System\IQTBltm.exe
  2⤵
  PID:7308
- C:\Windows\System\lHuDmIi.exe
  C:\Windows\System\lHuDmIi.exe
  2⤵
  PID:7324
- C:\Windows\System\NWsqqbB.exe
  C:\Windows\System\NWsqqbB.exe
  2⤵
  PID:7340
- C:\Windows\System\bNVSIeo.exe
  C:\Windows\System\bNVSIeo.exe
  2⤵
  PID:7356
- C:\Windows\System\USuMtWY.exe
  C:\Windows\System\USuMtWY.exe
  2⤵
  PID:7372
- C:\Windows\System\pbTWLQC.exe
  C:\Windows\System\pbTWLQC.exe
  2⤵
  PID:7388
- C:\Windows\System\FzdlPKn.exe
  C:\Windows\System\FzdlPKn.exe
  2⤵
  PID:7404
- C:\Windows\System\XTXdsoG.exe
  C:\Windows\System\XTXdsoG.exe
  2⤵
  PID:7420
- C:\Windows\System\dlOXoCd.exe
  C:\Windows\System\dlOXoCd.exe
  2⤵
  PID:7436
- C:\Windows\System\jbwYPHs.exe
  C:\Windows\System\jbwYPHs.exe
  2⤵
  PID:7452
- C:\Windows\System\ZcsUWWr.exe
  C:\Windows\System\ZcsUWWr.exe
  2⤵
  PID:7472
- C:\Windows\System\UdVqRcO.exe
  C:\Windows\System\UdVqRcO.exe
  2⤵
  PID:7488
- C:\Windows\System\SuRoGjK.exe
  C:\Windows\System\SuRoGjK.exe
  2⤵
  PID:7504
- C:\Windows\System\GeCnZgS.exe
  C:\Windows\System\GeCnZgS.exe
  2⤵
  PID:7520
- C:\Windows\System\brwmCPm.exe
  C:\Windows\System\brwmCPm.exe
  2⤵
  PID:7536
- C:\Windows\System\PYugSjz.exe
  C:\Windows\System\PYugSjz.exe
  2⤵
  PID:7552
- C:\Windows\System\doIWQax.exe
  C:\Windows\System\doIWQax.exe
  2⤵
  PID:7568
- C:\Windows\System\BJNvsHN.exe
  C:\Windows\System\BJNvsHN.exe
  2⤵
  PID:7584
- C:\Windows\System\GRGOImr.exe
  C:\Windows\System\GRGOImr.exe
  2⤵
  PID:7600
- C:\Windows\System\IsjDObJ.exe
  C:\Windows\System\IsjDObJ.exe
  2⤵
  PID:7616
- C:\Windows\System\cjjoVdh.exe
  C:\Windows\System\cjjoVdh.exe
  2⤵
  PID:7632
- C:\Windows\System\biDhVGH.exe
  C:\Windows\System\biDhVGH.exe
  2⤵
  PID:7648
- C:\Windows\System\cWHBZTo.exe
  C:\Windows\System\cWHBZTo.exe
  2⤵
  PID:7664
- C:\Windows\System\snFgSap.exe
  C:\Windows\System\snFgSap.exe
  2⤵
  PID:7680
- C:\Windows\System\JUmBYBQ.exe
  C:\Windows\System\JUmBYBQ.exe
  2⤵
  PID:7700
- C:\Windows\System\oxpFRQw.exe
  C:\Windows\System\oxpFRQw.exe
  2⤵
  PID:7716
- C:\Windows\System\fVadaIu.exe
  C:\Windows\System\fVadaIu.exe
  2⤵
  PID:7732
- C:\Windows\System\GAUOvsp.exe
  C:\Windows\System\GAUOvsp.exe
  2⤵
  PID:7748
- C:\Windows\System\tXOGDvT.exe
  C:\Windows\System\tXOGDvT.exe
  2⤵
  PID:7764
- C:\Windows\System\SQmQFvi.exe
  C:\Windows\System\SQmQFvi.exe
  2⤵
  PID:7780
- C:\Windows\System\tlvwbBP.exe
  C:\Windows\System\tlvwbBP.exe
  2⤵
  PID:7796
- C:\Windows\System\wrtdNTL.exe
  C:\Windows\System\wrtdNTL.exe
  2⤵
  PID:7812
- C:\Windows\System\rPhJgDj.exe
  C:\Windows\System\rPhJgDj.exe
  2⤵
  PID:7828
- C:\Windows\System\ZoEkMCM.exe
  C:\Windows\System\ZoEkMCM.exe
  2⤵
  PID:7844
- C:\Windows\System\CBTVKZj.exe
  C:\Windows\System\CBTVKZj.exe
  2⤵
  PID:7860
- C:\Windows\System\zeXmrJw.exe
  C:\Windows\System\zeXmrJw.exe
  2⤵
  PID:7876
- C:\Windows\System\UoFWwgv.exe
  C:\Windows\System\UoFWwgv.exe
  2⤵
  PID:7892
- C:\Windows\System\OwIuNtE.exe
  C:\Windows\System\OwIuNtE.exe
  2⤵
  PID:7908
- C:\Windows\System\vvlLmFc.exe
  C:\Windows\System\vvlLmFc.exe
  2⤵
  PID:7924
- C:\Windows\System\MatPvMv.exe
  C:\Windows\System\MatPvMv.exe
  2⤵
  PID:7940
- C:\Windows\System\EhLOiwc.exe
  C:\Windows\System\EhLOiwc.exe
  2⤵
  PID:7956
- C:\Windows\System\vxMMpkC.exe
  C:\Windows\System\vxMMpkC.exe
  2⤵
  PID:7972
- C:\Windows\System\nCOpUkB.exe
  C:\Windows\System\nCOpUkB.exe
  2⤵
  PID:7988
- C:\Windows\System\NnphDiw.exe
  C:\Windows\System\NnphDiw.exe
  2⤵
  PID:8004
- C:\Windows\System\KPJaenK.exe
  C:\Windows\System\KPJaenK.exe
  2⤵
  PID:8020
- C:\Windows\System\yvyAMZv.exe
  C:\Windows\System\yvyAMZv.exe
  2⤵
  PID:8036
- C:\Windows\System\WDGSigv.exe
  C:\Windows\System\WDGSigv.exe
  2⤵
  PID:8052
- C:\Windows\System\MStjZhL.exe
  C:\Windows\System\MStjZhL.exe
  2⤵
  PID:8068
- C:\Windows\System\GkohyIr.exe
  C:\Windows\System\GkohyIr.exe
  2⤵
  PID:8084
- C:\Windows\System\NSJeviM.exe
  C:\Windows\System\NSJeviM.exe
  2⤵
  PID:8100
- C:\Windows\System\hBlpOmO.exe
  C:\Windows\System\hBlpOmO.exe
  2⤵
  PID:8116
- C:\Windows\System\ZhCwvPS.exe
  C:\Windows\System\ZhCwvPS.exe
  2⤵
  PID:8132
- C:\Windows\System\kpkhRIk.exe
  C:\Windows\System\kpkhRIk.exe
  2⤵
  PID:8148
- C:\Windows\System\iMHSuIC.exe
  C:\Windows\System\iMHSuIC.exe
  2⤵
  PID:8164
- C:\Windows\System\BGGInJs.exe
  C:\Windows\System\BGGInJs.exe
  2⤵
  PID:8180
- C:\Windows\System\LSBATTs.exe
  C:\Windows\System\LSBATTs.exe
  2⤵
  PID:7176
- C:\Windows\System\aiRdtho.exe
  C:\Windows\System\aiRdtho.exe
  2⤵
  PID:7212
- C:\Windows\System\aXVYreB.exe
  C:\Windows\System\aXVYreB.exe
  2⤵
  PID:6236
- C:\Windows\System\BRoKdLD.exe
  C:\Windows\System\BRoKdLD.exe
  2⤵
  PID:6576
- C:\Windows\System\BvCxIKB.exe
  C:\Windows\System\BvCxIKB.exe
  2⤵
  PID:6656
- C:\Windows\System\KNNaJsa.exe
  C:\Windows\System\KNNaJsa.exe
  2⤵
  PID:7124
- C:\Windows\System\FUWMwzZ.exe
  C:\Windows\System\FUWMwzZ.exe
  2⤵
  PID:7244
- C:\Windows\System\muCrmnY.exe
  C:\Windows\System\muCrmnY.exe
  2⤵
  PID:7284
- C:\Windows\System\WXHXqbp.exe
  C:\Windows\System\WXHXqbp.exe
  2⤵
  PID:7348
- C:\Windows\System\BPnzhwi.exe
  C:\Windows\System\BPnzhwi.exe
  2⤵
  PID:7412
- C:\Windows\System\CXXPqXR.exe
  C:\Windows\System\CXXPqXR.exe
  2⤵
  PID:7300
- C:\Windows\System\zYhybPr.exe
  C:\Windows\System\zYhybPr.exe
  2⤵
  PID:7336
- C:\Windows\System\UfJLFSR.exe
  C:\Windows\System\UfJLFSR.exe
  2⤵
  PID:7400
- C:\Windows\System\PmEgkCm.exe
  C:\Windows\System\PmEgkCm.exe
  2⤵
  PID:7460
- C:\Windows\System\SvQwrIK.exe
  C:\Windows\System\SvQwrIK.exe
  2⤵
  PID:7480
- C:\Windows\System\zeSoIjp.exe
  C:\Windows\System\zeSoIjp.exe
  2⤵
  PID:7516
- C:\Windows\System\nJPjhdY.exe
  C:\Windows\System\nJPjhdY.exe
  2⤵
  PID:7580
- C:\Windows\System\VTWfltI.exe
  C:\Windows\System\VTWfltI.exe
  2⤵
  PID:7644
- C:\Windows\System\FWJKENc.exe
  C:\Windows\System\FWJKENc.exe
  2⤵
  PID:7528
- C:\Windows\System\ttAUVOF.exe
  C:\Windows\System\ttAUVOF.exe
  2⤵
  PID:7696
- C:\Windows\System\ROUUroc.exe
  C:\Windows\System\ROUUroc.exe
  2⤵
  PID:7564
- C:\Windows\System\cMqfljC.exe
  C:\Windows\System\cMqfljC.exe
  2⤵
  PID:7628
- C:\Windows\System\NzmvgCx.exe
  C:\Windows\System\NzmvgCx.exe
  2⤵
  PID:7772
- C:\Windows\System\zaqsqAI.exe
  C:\Windows\System\zaqsqAI.exe
  2⤵
  PID:7804
- C:\Windows\System\fTBgTqv.exe
  C:\Windows\System\fTBgTqv.exe
  2⤵
  PID:7836
- C:\Windows\System\tWfqaAK.exe
  C:\Windows\System\tWfqaAK.exe
  2⤵
  PID:7900
- C:\Windows\System\LEHiYic.exe
  C:\Windows\System\LEHiYic.exe
  2⤵
  PID:7968
- C:\Windows\System\hnCtzPA.exe
  C:\Windows\System\hnCtzPA.exe
  2⤵
  PID:8032
- C:\Windows\System\QdAwpHU.exe
  C:\Windows\System\QdAwpHU.exe
  2⤵
  PID:8064
- C:\Windows\System\hGnDgJf.exe
  C:\Windows\System\hGnDgJf.exe
  2⤵
  PID:8092
- C:\Windows\System\WFediCo.exe
  C:\Windows\System\WFediCo.exe
  2⤵
  PID:7856
- C:\Windows\System\gNRbPMh.exe
  C:\Windows\System\gNRbPMh.exe
  2⤵
  PID:7920
- C:\Windows\System\ZvFgyeu.exe
  C:\Windows\System\ZvFgyeu.exe
  2⤵
  PID:7984
- C:\Windows\System\LcJydSQ.exe
  C:\Windows\System\LcJydSQ.exe
  2⤵
  PID:8048
- C:\Windows\System\IfBjUrZ.exe
  C:\Windows\System\IfBjUrZ.exe
  2⤵
  PID:8108
- C:\Windows\System\gjQdBRM.exe
  C:\Windows\System\gjQdBRM.exe
  2⤵
  PID:8160
- C:\Windows\System\usiSnXO.exe
  C:\Windows\System\usiSnXO.exe
  2⤵
  PID:7180
- C:\Windows\System\wgsOdWn.exe
  C:\Windows\System\wgsOdWn.exe
  2⤵
  PID:6296
- C:\Windows\System\SxLMXNX.exe
  C:\Windows\System\SxLMXNX.exe
  2⤵
  PID:7208
- C:\Windows\System\PQtakzT.exe
  C:\Windows\System\PQtakzT.exe
  2⤵
  PID:6912
- C:\Windows\System\vbkJYYN.exe
  C:\Windows\System\vbkJYYN.exe
  2⤵
  PID:7272
- C:\Windows\System\UKFJyqr.exe
  C:\Windows\System\UKFJyqr.exe
  2⤵
  PID:7380
- C:\Windows\System\LtaoGvu.exe
  C:\Windows\System\LtaoGvu.exe
  2⤵
  PID:7304
- C:\Windows\System\jFmdpoZ.exe
  C:\Windows\System\jFmdpoZ.exe
  2⤵
  PID:7576
- C:\Windows\System\qBKkbUZ.exe
  C:\Windows\System\qBKkbUZ.exe
  2⤵
  PID:7740
- C:\Windows\System\JERNxKX.exe
  C:\Windows\System\JERNxKX.exe
  2⤵
  PID:7612
- C:\Windows\System\zAJOJSl.exe
  C:\Windows\System\zAJOJSl.exe
  2⤵
  PID:7932
- C:\Windows\System\WsnGZEw.exe
  C:\Windows\System\WsnGZEw.exe
  2⤵
  PID:7756
- C:\Windows\System\groDLlE.exe
  C:\Windows\System\groDLlE.exe
  2⤵
  PID:8080
- C:\Windows\System\pluWeBv.exe
  C:\Windows\System\pluWeBv.exe
  2⤵
  PID:8140
- C:\Windows\System\wWlkvCK.exe
  C:\Windows\System\wWlkvCK.exe
  2⤵
  PID:7596
- C:\Windows\System\HrbvZoc.exe
  C:\Windows\System\HrbvZoc.exe
  2⤵
  PID:8000
- C:\Windows\System\VQgxCGk.exe
  C:\Windows\System\VQgxCGk.exe
  2⤵
  PID:7916
- C:\Windows\System\MoCatDj.exe
  C:\Windows\System\MoCatDj.exe
  2⤵
  PID:8156
- C:\Windows\System\DOqhmiF.exe
  C:\Windows\System\DOqhmiF.exe
  2⤵
  PID:6200
- C:\Windows\System\NNMlCkm.exe
  C:\Windows\System\NNMlCkm.exe
  2⤵
  PID:7320
- C:\Windows\System\FCaeZFK.exe
  C:\Windows\System\FCaeZFK.exe
  2⤵
  PID:7368
- C:\Windows\System\upoYiXy.exe
  C:\Windows\System\upoYiXy.exe
  2⤵
  PID:7712
- C:\Windows\System\gmVtdqe.exe
  C:\Windows\System\gmVtdqe.exe
  2⤵
  PID:7496
- C:\Windows\System\BettYxX.exe
  C:\Windows\System\BettYxX.exe
  2⤵
  PID:7500
- C:\Windows\System\jIVRNad.exe
  C:\Windows\System\jIVRNad.exe
  2⤵
  PID:7824
- C:\Windows\System\GtKvGaF.exe
  C:\Windows\System\GtKvGaF.exe
  2⤵
  PID:7792
- C:\Windows\System\OTjwggJ.exe
  C:\Windows\System\OTjwggJ.exe
  2⤵
  PID:7196
- C:\Windows\System\FWDyDbs.exe
  C:\Windows\System\FWDyDbs.exe
  2⤵
  PID:7728
- C:\Windows\System\CBVKWrZ.exe
  C:\Windows\System\CBVKWrZ.exe
  2⤵
  PID:7872
- C:\Windows\System\WMiqdhX.exe
  C:\Windows\System\WMiqdhX.exe
  2⤵
  PID:8060
- C:\Windows\System\VBRzexC.exe
  C:\Windows\System\VBRzexC.exe
  2⤵
  PID:7708
- C:\Windows\System\eXmJZZi.exe
  C:\Windows\System\eXmJZZi.exe
  2⤵
  PID:7448
- C:\Windows\System\cWxcJyT.exe
  C:\Windows\System\cWxcJyT.exe
  2⤵
  PID:7548
- C:\Windows\System\kgGQsKm.exe
  C:\Windows\System\kgGQsKm.exe
  2⤵
  PID:7868
- C:\Windows\System\jrFkRki.exe
  C:\Windows\System\jrFkRki.exe
  2⤵
  PID:8204
- C:\Windows\System\HIrKscY.exe
  C:\Windows\System\HIrKscY.exe
  2⤵
  PID:8220
- C:\Windows\System\rsMXziW.exe
  C:\Windows\System\rsMXziW.exe
  2⤵
  PID:8236
- C:\Windows\System\WZgKsRo.exe
  C:\Windows\System\WZgKsRo.exe
  2⤵
  PID:8252
- C:\Windows\System\xFryCih.exe
  C:\Windows\System\xFryCih.exe
  2⤵
  PID:8268
- C:\Windows\System\eiDiZFt.exe
  C:\Windows\System\eiDiZFt.exe
  2⤵
  PID:8284
- C:\Windows\System\QAzFIbV.exe
  C:\Windows\System\QAzFIbV.exe
  2⤵
  PID:8300
- C:\Windows\System\xGRPDfh.exe
  C:\Windows\System\xGRPDfh.exe
  2⤵
  PID:8316
- C:\Windows\System\XylaciI.exe
  C:\Windows\System\XylaciI.exe
  2⤵
  PID:8332
- C:\Windows\System\bAOmCrz.exe
  C:\Windows\System\bAOmCrz.exe
  2⤵
  PID:8348
- C:\Windows\System\yQSRVta.exe
  C:\Windows\System\yQSRVta.exe
  2⤵
  PID:8364
- C:\Windows\System\JBofoJj.exe
  C:\Windows\System\JBofoJj.exe
  2⤵
  PID:8380
- C:\Windows\System\sWKHyjA.exe
  C:\Windows\System\sWKHyjA.exe
  2⤵
  PID:8396
- C:\Windows\System\NumtrGi.exe
  C:\Windows\System\NumtrGi.exe
  2⤵
  PID:8412
- C:\Windows\System\GKUycJu.exe
  C:\Windows\System\GKUycJu.exe
  2⤵
  PID:8432
- C:\Windows\System\JACcFyU.exe
  C:\Windows\System\JACcFyU.exe
  2⤵
  PID:8448
- C:\Windows\System\wYQJlZT.exe
  C:\Windows\System\wYQJlZT.exe
  2⤵
  PID:8464
- C:\Windows\System\wvwdfkk.exe
  C:\Windows\System\wvwdfkk.exe
  2⤵
  PID:8480
- C:\Windows\System\VAgSlQA.exe
  C:\Windows\System\VAgSlQA.exe
  2⤵
  PID:8496
- C:\Windows\System\NzvnbIq.exe
  C:\Windows\System\NzvnbIq.exe
  2⤵
  PID:8512
- C:\Windows\System\wRFDUQR.exe
  C:\Windows\System\wRFDUQR.exe
  2⤵
  PID:8528
- C:\Windows\System\TdoYMVx.exe
  C:\Windows\System\TdoYMVx.exe
  2⤵
  PID:8544
- C:\Windows\System\BeednRn.exe
  C:\Windows\System\BeednRn.exe
  2⤵
  PID:8560
- C:\Windows\System\QGhNbBm.exe
  C:\Windows\System\QGhNbBm.exe
  2⤵
  PID:8576
- C:\Windows\System\yAzOZLF.exe
  C:\Windows\System\yAzOZLF.exe
  2⤵
  PID:8592
- C:\Windows\System\lOLIIEs.exe
  C:\Windows\System\lOLIIEs.exe
  2⤵
  PID:8608
- C:\Windows\System\AIdbtVb.exe
  C:\Windows\System\AIdbtVb.exe
  2⤵
  PID:8624
- C:\Windows\System\pQtzRdj.exe
  C:\Windows\System\pQtzRdj.exe
  2⤵
  PID:8640
- C:\Windows\System\SYkPLFG.exe
  C:\Windows\System\SYkPLFG.exe
  2⤵
  PID:8656
- C:\Windows\System\OtLWqrQ.exe
  C:\Windows\System\OtLWqrQ.exe
  2⤵
  PID:8672
- C:\Windows\System\ZvOPRzF.exe
  C:\Windows\System\ZvOPRzF.exe
  2⤵
  PID:8688
- C:\Windows\System\tSddgUz.exe
  C:\Windows\System\tSddgUz.exe
  2⤵
  PID:8704
- C:\Windows\System\pONIChg.exe
  C:\Windows\System\pONIChg.exe
  2⤵
  PID:8720
- C:\Windows\System\DxpfKUb.exe
  C:\Windows\System\DxpfKUb.exe
  2⤵
  PID:8736
- C:\Windows\System\VJToTcw.exe
  C:\Windows\System\VJToTcw.exe
  2⤵
  PID:8752
- C:\Windows\System\tAXySjH.exe
  C:\Windows\System\tAXySjH.exe
  2⤵
  PID:8768
- C:\Windows\System\HngiUUR.exe
  C:\Windows\System\HngiUUR.exe
  2⤵
  PID:8784
- C:\Windows\System\XpnuLRf.exe
  C:\Windows\System\XpnuLRf.exe
  2⤵
  PID:8800
- C:\Windows\System\EPSuxoI.exe
  C:\Windows\System\EPSuxoI.exe
  2⤵
  PID:8816
- C:\Windows\System\YJrjScw.exe
  C:\Windows\System\YJrjScw.exe
  2⤵
  PID:8832
- C:\Windows\System\EDrDoRB.exe
  C:\Windows\System\EDrDoRB.exe
  2⤵
  PID:8848
- C:\Windows\System\AaxjhSl.exe
  C:\Windows\System\AaxjhSl.exe
  2⤵
  PID:8864
- C:\Windows\System\ttndUWb.exe
  C:\Windows\System\ttndUWb.exe
  2⤵
  PID:8884
- C:\Windows\System\vRCOItl.exe
  C:\Windows\System\vRCOItl.exe
  2⤵
  PID:8900
- C:\Windows\System\eZBChbi.exe
  C:\Windows\System\eZBChbi.exe
  2⤵
  PID:8916
- C:\Windows\System\kQFqHSu.exe
  C:\Windows\System\kQFqHSu.exe
  2⤵
  PID:8932
- C:\Windows\System\SQNKwkT.exe
  C:\Windows\System\SQNKwkT.exe
  2⤵
  PID:8948
- C:\Windows\System\EXFZYKZ.exe
  C:\Windows\System\EXFZYKZ.exe
  2⤵
  PID:8964
- C:\Windows\System\wduKeAz.exe
  C:\Windows\System\wduKeAz.exe
  2⤵
  PID:8980
- C:\Windows\System\WIFIPYa.exe
  C:\Windows\System\WIFIPYa.exe
  2⤵
  PID:8996
- C:\Windows\System\gMGcouZ.exe
  C:\Windows\System\gMGcouZ.exe
  2⤵
  PID:9012
- C:\Windows\System\WCADsvs.exe
  C:\Windows\System\WCADsvs.exe
  2⤵
  PID:9028
- C:\Windows\System\OUQtLrp.exe
  C:\Windows\System\OUQtLrp.exe
  2⤵
  PID:9048
- C:\Windows\System\iVNEkKH.exe
  C:\Windows\System\iVNEkKH.exe
  2⤵
  PID:9064
- C:\Windows\System\iTWGCPb.exe
  C:\Windows\System\iTWGCPb.exe
  2⤵
  PID:9080
- C:\Windows\System\mWKMLED.exe
  C:\Windows\System\mWKMLED.exe
  2⤵
  PID:9096
- C:\Windows\System\KRUfcGn.exe
  C:\Windows\System\KRUfcGn.exe
  2⤵
  PID:9112
- C:\Windows\System\ofKdrtN.exe
  C:\Windows\System\ofKdrtN.exe
  2⤵
  PID:9128
- C:\Windows\System\kNliWOb.exe
  C:\Windows\System\kNliWOb.exe
  2⤵
  PID:9144
- C:\Windows\System\taxcMzK.exe
  C:\Windows\System\taxcMzK.exe
  2⤵
  PID:9160
- C:\Windows\System\ecQxBvt.exe
  C:\Windows\System\ecQxBvt.exe
  2⤵
  PID:9192
- C:\Windows\System\HdysfMw.exe
  C:\Windows\System\HdysfMw.exe
  2⤵
  PID:9208
- C:\Windows\System\oltPZrk.exe
  C:\Windows\System\oltPZrk.exe
  2⤵
  PID:8228
- C:\Windows\System\lFXMeIf.exe
  C:\Windows\System\lFXMeIf.exe
  2⤵
  PID:8292
- C:\Windows\System\sCKULbu.exe
  C:\Windows\System\sCKULbu.exe
  2⤵
  PID:8328
- C:\Windows\System\OETQpJJ.exe
  C:\Windows\System\OETQpJJ.exe
  2⤵
  PID:8356
- C:\Windows\System\lzoldwg.exe
  C:\Windows\System\lzoldwg.exe
  2⤵
  PID:6900
- C:\Windows\System\bjSOSLx.exe
  C:\Windows\System\bjSOSLx.exe
  2⤵
  PID:8312
- C:\Windows\System\KIawikL.exe
  C:\Windows\System\KIawikL.exe
  2⤵
  PID:8344
- C:\Windows\System\QPKjKoe.exe
  C:\Windows\System\QPKjKoe.exe
  2⤵
  PID:8428
- C:\Windows\System\JoyvZHo.exe
  C:\Windows\System\JoyvZHo.exe
  2⤵
  PID:8460
- C:\Windows\System\JZhAaKt.exe
  C:\Windows\System\JZhAaKt.exe
  2⤵
  PID:8524
- C:\Windows\System\YSgtQuu.exe
  C:\Windows\System\YSgtQuu.exe
  2⤵
  PID:8588
- C:\Windows\System\dKZGoPr.exe
  C:\Windows\System\dKZGoPr.exe
  2⤵
  PID:8652
- C:\Windows\System\uRFxyOR.exe
  C:\Windows\System\uRFxyOR.exe
  2⤵
  PID:8408
- C:\Windows\System\RXPgdbo.exe
  C:\Windows\System\RXPgdbo.exe
  2⤵
  PID:8712
- C:\Windows\System\KfWXYYR.exe
  C:\Windows\System\KfWXYYR.exe
  2⤵
  PID:8776
- C:\Windows\System\uexWGZi.exe
  C:\Windows\System\uexWGZi.exe
  2⤵
  PID:8604
- C:\Windows\System\jGBuSff.exe
  C:\Windows\System\jGBuSff.exe
  2⤵
  PID:8536
- C:\Windows\System\geGEwJu.exe
  C:\Windows\System\geGEwJu.exe
  2⤵
  PID:8792
- C:\Windows\System\bdXahix.exe
  C:\Windows\System\bdXahix.exe
  2⤵
  PID:8796
- C:\Windows\System\oRwhXgI.exe
  C:\Windows\System\oRwhXgI.exe
  2⤵
  PID:8872
- C:\Windows\System\dWCHWmq.exe
  C:\Windows\System\dWCHWmq.exe
  2⤵
  PID:8636
- C:\Windows\System\VwkRFBN.exe
  C:\Windows\System\VwkRFBN.exe
  2⤵
  PID:8760
- C:\Windows\System\rAaXkeD.exe
  C:\Windows\System\rAaXkeD.exe
  2⤵
  PID:8880
- C:\Windows\System\eCwtMhc.exe
  C:\Windows\System\eCwtMhc.exe
  2⤵
  PID:8940
- C:\Windows\System\dCxCHgR.exe
  C:\Windows\System\dCxCHgR.exe
  2⤵
  PID:8928
- C:\Windows\System\lAbtipf.exe
  C:\Windows\System\lAbtipf.exe
  2⤵
  PID:9004
- C:\Windows\System\maRDWiY.exe
  C:\Windows\System\maRDWiY.exe
  2⤵
  PID:8992
- C:\Windows\System\dEMDCkA.exe
  C:\Windows\System\dEMDCkA.exe
  2⤵
  PID:9044
- C:\Windows\System\JjohpVa.exe
  C:\Windows\System\JjohpVa.exe
  2⤵
  PID:9136
- C:\Windows\System\TQilKeZ.exe
  C:\Windows\System\TQilKeZ.exe
  2⤵
  PID:9020
- C:\Windows\System\GyXPJzZ.exe
  C:\Windows\System\GyXPJzZ.exe
  2⤵
  PID:9092
- C:\Windows\System\rmzDhXk.exe
  C:\Windows\System\rmzDhXk.exe
  2⤵
  PID:9156
- C:\Windows\System\BqegpVM.exe
  C:\Windows\System\BqegpVM.exe
  2⤵
  PID:9184
- C:\Windows\System\oqdLaOl.exe
  C:\Windows\System\oqdLaOl.exe
  2⤵
  PID:8324
- C:\Windows\System\IusxkKM.exe
  C:\Windows\System\IusxkKM.exe
  2⤵
  PID:8360
- C:\Windows\System\lkgCvwV.exe
  C:\Windows\System\lkgCvwV.exe
  2⤵
  PID:8420
- C:\Windows\System\sFQuDEB.exe
  C:\Windows\System\sFQuDEB.exe
  2⤵
  PID:8264
- C:\Windows\System\uNFkcum.exe
  C:\Windows\System\uNFkcum.exe
  2⤵
  PID:8308
- C:\Windows\System\xzsTSEx.exe
  C:\Windows\System\xzsTSEx.exe
  2⤵
  PID:8492
- C:\Windows\System\shQvSnD.exe
  C:\Windows\System\shQvSnD.exe
  2⤵
  PID:8404
- C:\Windows\System\zqXhZqD.exe
  C:\Windows\System\zqXhZqD.exe
  2⤵
  PID:8748
- C:\Windows\System\MZBoDKb.exe
  C:\Windows\System\MZBoDKb.exe
  2⤵
  PID:8728
- C:\Windows\System\huawBxE.exe
  C:\Windows\System\huawBxE.exe
  2⤵
  PID:8504
- C:\Windows\System\LBdflID.exe
  C:\Windows\System\LBdflID.exe
  2⤵
  PID:8572
- C:\Windows\System\NcoWhCf.exe
  C:\Windows\System\NcoWhCf.exe
  2⤵
  PID:8860
- C:\Windows\System\pYQHgxC.exe
  C:\Windows\System\pYQHgxC.exe
  2⤵
  PID:8924
- C:\Windows\System\LtcbPAU.exe
  C:\Windows\System\LtcbPAU.exe
  2⤵
  PID:9076
- C:\Windows\System\AwBqAVM.exe
  C:\Windows\System\AwBqAVM.exe
  2⤵
  PID:8912
- C:\Windows\System\bXmsQny.exe
  C:\Windows\System\bXmsQny.exe
  2⤵
  PID:8568
- C:\Windows\System\ZbMislY.exe
  C:\Windows\System\ZbMislY.exe
  2⤵
  PID:9176
- C:\Windows\System\djoRosk.exe
  C:\Windows\System\djoRosk.exe
  2⤵
  PID:7240
- C:\Windows\System\stZtwPb.exe
  C:\Windows\System\stZtwPb.exe
  2⤵
  PID:8200
- C:\Windows\System\WTOUAVm.exe
  C:\Windows\System\WTOUAVm.exe
  2⤵
  PID:8424
- C:\Windows\System\nLKvTBA.exe
  C:\Windows\System\nLKvTBA.exe
  2⤵
  PID:8744
- C:\Windows\System\asGFhzV.exe
  C:\Windows\System\asGFhzV.exe
  2⤵
  PID:8684
- C:\Windows\System\DMvBipK.exe
  C:\Windows\System\DMvBipK.exe
  2⤵
  PID:8668
- C:\Windows\System\AhHoppx.exe
  C:\Windows\System\AhHoppx.exe
  2⤵
  PID:8700
- C:\Windows\System\RtlXNxS.exe
  C:\Windows\System\RtlXNxS.exe
  2⤵
  PID:8972
- C:\Windows\System\LnmCOCY.exe
  C:\Windows\System\LnmCOCY.exe
  2⤵
  PID:6976
- C:\Windows\System\pOYsPvo.exe
  C:\Windows\System\pOYsPvo.exe
  2⤵
  PID:8584
- C:\Windows\System\hjXJipD.exe
  C:\Windows\System\hjXJipD.exe
  2⤵
  PID:9056
- C:\Windows\System\OPhGACQ.exe
  C:\Windows\System\OPhGACQ.exe
  2⤵
  PID:8244
- C:\Windows\System\pJutIpE.exe
  C:\Windows\System\pJutIpE.exe
  2⤵
  PID:9172
- C:\Windows\System\NlGQrhp.exe
  C:\Windows\System\NlGQrhp.exe
  2⤵
  PID:9120
- C:\Windows\System\sQavayY.exe
  C:\Windows\System\sQavayY.exe
  2⤵
  PID:8260
- C:\Windows\System\bUePRyV.exe
  C:\Windows\System\bUePRyV.exe
  2⤵
  PID:8444
- C:\Windows\System\lkQyMni.exe
  C:\Windows\System\lkQyMni.exe
  2⤵
  PID:8196
- C:\Windows\System\cFSRjZj.exe
  C:\Windows\System\cFSRjZj.exe
  2⤵
  PID:9228
- C:\Windows\System\azrSWeb.exe
  C:\Windows\System\azrSWeb.exe
  2⤵
  PID:9244
- C:\Windows\System\hUhKxuO.exe
  C:\Windows\System\hUhKxuO.exe
  2⤵
  PID:9260
- C:\Windows\System\pMMACaS.exe
  C:\Windows\System\pMMACaS.exe
  2⤵
  PID:9276
- C:\Windows\System\XpSZgWa.exe
  C:\Windows\System\XpSZgWa.exe
  2⤵
  PID:9292
- C:\Windows\System\WUpKdfq.exe
  C:\Windows\System\WUpKdfq.exe
  2⤵
  PID:9308
- C:\Windows\System\OhUICeq.exe
  C:\Windows\System\OhUICeq.exe
  2⤵
  PID:9324
- C:\Windows\System\RFDFmTf.exe
  C:\Windows\System\RFDFmTf.exe
  2⤵
  PID:9340
- C:\Windows\System\hLXKWLT.exe
  C:\Windows\System\hLXKWLT.exe
  2⤵
  PID:9356
- C:\Windows\System\tDevXGi.exe
  C:\Windows\System\tDevXGi.exe
  2⤵
  PID:9372
- C:\Windows\System\BcvNBnN.exe
  C:\Windows\System\BcvNBnN.exe
  2⤵
  PID:9388
- C:\Windows\System\qPQVKwY.exe
  C:\Windows\System\qPQVKwY.exe
  2⤵
  PID:9408
- C:\Windows\System\OSVUMJp.exe
  C:\Windows\System\OSVUMJp.exe
  2⤵
  PID:9424
- C:\Windows\System\MJQNTjj.exe
  C:\Windows\System\MJQNTjj.exe
  2⤵
  PID:9440
- C:\Windows\System\IJMLsYW.exe
  C:\Windows\System\IJMLsYW.exe
  2⤵
  PID:9456
- C:\Windows\System\fNHJalh.exe
  C:\Windows\System\fNHJalh.exe
  2⤵
  PID:9472
- C:\Windows\System\GhsTcHC.exe
  C:\Windows\System\GhsTcHC.exe
  2⤵
  PID:9488
- C:\Windows\System\HOjbcQZ.exe
  C:\Windows\System\HOjbcQZ.exe
  2⤵
  PID:9504
- C:\Windows\System\CIDrKsM.exe
  C:\Windows\System\CIDrKsM.exe
  2⤵
  PID:9520
- C:\Windows\System\jMOekQK.exe
  C:\Windows\System\jMOekQK.exe
  2⤵
  PID:9536
- C:\Windows\System\pnQZNff.exe
  C:\Windows\System\pnQZNff.exe
  2⤵
  PID:9552
- C:\Windows\System\SuJgcSL.exe
  C:\Windows\System\SuJgcSL.exe
  2⤵
  PID:9568
- C:\Windows\System\doUESNc.exe
  C:\Windows\System\doUESNc.exe
  2⤵
  PID:9588
- C:\Windows\System\LUwBRPT.exe
  C:\Windows\System\LUwBRPT.exe
  2⤵
  PID:9604
- C:\Windows\System\TAXZkDJ.exe
  C:\Windows\System\TAXZkDJ.exe
  2⤵
  PID:9620
- C:\Windows\System\IsydhYC.exe
  C:\Windows\System\IsydhYC.exe
  2⤵
  PID:9636
- C:\Windows\System\FfJjKEf.exe
  C:\Windows\System\FfJjKEf.exe
  2⤵
  PID:9652
- C:\Windows\System\oxsFYdJ.exe
  C:\Windows\System\oxsFYdJ.exe
  2⤵
  PID:9668
- C:\Windows\System\FXENCJz.exe
  C:\Windows\System\FXENCJz.exe
  2⤵
  PID:9684
- C:\Windows\System\BULCndy.exe
  C:\Windows\System\BULCndy.exe
  2⤵
  PID:9700
- C:\Windows\System\tvQvpME.exe
  C:\Windows\System\tvQvpME.exe
  2⤵
  PID:9716
- C:\Windows\System\ouEzcmA.exe
  C:\Windows\System\ouEzcmA.exe
  2⤵
  PID:9732
- C:\Windows\System\aYPQBYw.exe
  C:\Windows\System\aYPQBYw.exe
  2⤵
  PID:9748
- C:\Windows\System\GexqOUX.exe
  C:\Windows\System\GexqOUX.exe
  2⤵
  PID:9764
- C:\Windows\System\PDhDozQ.exe
  C:\Windows\System\PDhDozQ.exe
  2⤵
  PID:9780
- C:\Windows\System\hEsuMYq.exe
  C:\Windows\System\hEsuMYq.exe
  2⤵
  PID:9796
- C:\Windows\System\NUWJEzK.exe
  C:\Windows\System\NUWJEzK.exe
  2⤵
  PID:9812
- C:\Windows\System\ystwsex.exe
  C:\Windows\System\ystwsex.exe
  2⤵
  PID:9828
- C:\Windows\System\vmVEZjj.exe
  C:\Windows\System\vmVEZjj.exe
  2⤵
  PID:9844
- C:\Windows\System\Odzafzu.exe
  C:\Windows\System\Odzafzu.exe
  2⤵
  PID:9860
- C:\Windows\System\EPFCpBr.exe
  C:\Windows\System\EPFCpBr.exe
  2⤵
  PID:9876
- C:\Windows\System\vZlaBqA.exe
  C:\Windows\System\vZlaBqA.exe
  2⤵
  PID:9892
- C:\Windows\System\kHCJXYC.exe
  C:\Windows\System\kHCJXYC.exe
  2⤵
  PID:9908
- C:\Windows\System\CDqyhMX.exe
  C:\Windows\System\CDqyhMX.exe
  2⤵
  PID:9924
- C:\Windows\System\lTRaHug.exe
  C:\Windows\System\lTRaHug.exe
  2⤵
  PID:9940
- C:\Windows\System\MDdSdYH.exe
  C:\Windows\System\MDdSdYH.exe
  2⤵
  PID:9956
- C:\Windows\System\RhCuELQ.exe
  C:\Windows\System\RhCuELQ.exe
  2⤵
  PID:9972
- C:\Windows\System\XlSHRJI.exe
  C:\Windows\System\XlSHRJI.exe
  2⤵
  PID:9988
- C:\Windows\System\tAhQIGN.exe
  C:\Windows\System\tAhQIGN.exe
  2⤵
  PID:10004
- C:\Windows\System\JTovHBI.exe
  C:\Windows\System\JTovHBI.exe
  2⤵
  PID:10020
- C:\Windows\System\TLNIFVI.exe
  C:\Windows\System\TLNIFVI.exe
  2⤵
  PID:10036
- C:\Windows\System\EJwPErr.exe
  C:\Windows\System\EJwPErr.exe
  2⤵
  PID:10052
- C:\Windows\System\oHSCvas.exe
  C:\Windows\System\oHSCvas.exe
  2⤵
  PID:10068
- C:\Windows\System\zfaPKpa.exe
  C:\Windows\System\zfaPKpa.exe
  2⤵
  PID:10084
- C:\Windows\System\dpglKny.exe
  C:\Windows\System\dpglKny.exe
  2⤵
  PID:10100
- C:\Windows\System\fVeCnMw.exe
  C:\Windows\System\fVeCnMw.exe
  2⤵
  PID:10116
- C:\Windows\System\AnGNXlj.exe
  C:\Windows\System\AnGNXlj.exe
  2⤵
  PID:10132
- C:\Windows\System\jnFyyIH.exe
  C:\Windows\System\jnFyyIH.exe
  2⤵
  PID:10148
- C:\Windows\System\qoiRDDR.exe
  C:\Windows\System\qoiRDDR.exe
  2⤵
  PID:10164
- C:\Windows\System\XfXIfWQ.exe
  C:\Windows\System\XfXIfWQ.exe
  2⤵
  PID:10180
- C:\Windows\System\nOQIKvt.exe
  C:\Windows\System\nOQIKvt.exe
  2⤵
  PID:10196
- C:\Windows\System\UScDJCk.exe
  C:\Windows\System\UScDJCk.exe
  2⤵
  PID:10212
- C:\Windows\System\DUhkvMR.exe
  C:\Windows\System\DUhkvMR.exe
  2⤵
  PID:10228
- C:\Windows\System\jOrMrht.exe
  C:\Windows\System\jOrMrht.exe
  2⤵
  PID:8828
- C:\Windows\System\bpMgVtv.exe
  C:\Windows\System\bpMgVtv.exe
  2⤵
  PID:9272
- C:\Windows\System\ZRiSgrH.exe
  C:\Windows\System\ZRiSgrH.exe
  2⤵
  PID:9336
- C:\Windows\System\mRVaaAV.exe
  C:\Windows\System\mRVaaAV.exe
  2⤵
  PID:9396
- C:\Windows\System\SLZzOgR.exe
  C:\Windows\System\SLZzOgR.exe
  2⤵
  PID:9220
- C:\Windows\System\SxjTlMB.exe
  C:\Windows\System\SxjTlMB.exe
  2⤵
  PID:9468
- C:\Windows\System\rkOuyyM.exe
  C:\Windows\System\rkOuyyM.exe
  2⤵
  PID:9252
- C:\Windows\System\yXyPthc.exe
  C:\Windows\System\yXyPthc.exe
  2⤵
  PID:9320
- C:\Windows\System\yfEhuyv.exe
  C:\Windows\System\yfEhuyv.exe
  2⤵
  PID:9352
- C:\Windows\System\Ulgngut.exe
  C:\Windows\System\Ulgngut.exe
  2⤵
  PID:9480
- C:\Windows\System\aDuEUpX.exe
  C:\Windows\System\aDuEUpX.exe
  2⤵
  PID:9420
- C:\Windows\System\ddYXesR.exe
  C:\Windows\System\ddYXesR.exe
  2⤵
  PID:9596
- C:\Windows\System\QYaGcwP.exe
  C:\Windows\System\QYaGcwP.exe
  2⤵
  PID:9632
- C:\Windows\System\XtGDELj.exe
  C:\Windows\System\XtGDELj.exe
  2⤵
  PID:9616
- C:\Windows\System\hQHWyxa.exe
  C:\Windows\System\hQHWyxa.exe
  2⤵
  PID:9648
- C:\Windows\System\LphIbCi.exe
  C:\Windows\System\LphIbCi.exe
  2⤵
  PID:9544
- C:\Windows\System\KlYEtNh.exe
  C:\Windows\System\KlYEtNh.exe
  2⤵
  PID:9756
- C:\Windows\System\yiHEdSE.exe
  C:\Windows\System\yiHEdSE.exe
  2⤵
  PID:9712
- C:\Windows\System\fXjZmFS.exe
  C:\Windows\System\fXjZmFS.exe
  2⤵
  PID:9820
- C:\Windows\System\iEqylhJ.exe
  C:\Windows\System\iEqylhJ.exe
  2⤵
  PID:9808
- C:\Windows\System\uuZEAmu.exe
  C:\Windows\System\uuZEAmu.exe
  2⤵
  PID:9840
- C:\Windows\System\ssBbUSx.exe
  C:\Windows\System\ssBbUSx.exe
  2⤵
  PID:9888
- C:\Windows\System\POOLosT.exe
  C:\Windows\System\POOLosT.exe
  2⤵
  PID:9948
- C:\Windows\System\qxEtxka.exe
  C:\Windows\System\qxEtxka.exe
  2⤵
  PID:9900
- C:\Windows\System\jVsDLls.exe
  C:\Windows\System\jVsDLls.exe
  2⤵
  PID:9936
- C:\Windows\System\vKyVGjn.exe
  C:\Windows\System\vKyVGjn.exe
  2⤵
  PID:10048
- C:\Windows\System\RTTgtSb.exe
  C:\Windows\System\RTTgtSb.exe
  2⤵
  PID:10076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ArhjocG.exe

Filesize
1.8MB

MD5
02e3d906f8cd310d6d31a239437a6d4b

SHA1
39df91a8e38ca818318b03e5d90c18597cd2034e

SHA256
e8da625495ff042e5982b212946e3668452adafc393babe661b26d3bd4b93e75

SHA512
6239c09e12cf2067c10bdbe429eea8c567abe00403116ace1fef46c4ac20f392975ed17c5de4bdd12b728efa13bd00cb0b95d1dea46aba3ca3b1e3cbe94ca28e

Download Submit
C:\Windows\system\DATzhpN.exe

Filesize
1.8MB

MD5
65751dc82bc098b989871c6a077323f2

SHA1
78eff376660dad356c0b1e3ca518f451491b234c

SHA256
449dbbe53c19a8a0eea8fc2e16320a3afd87ef1f716a639dd45a2df079283eb0

SHA512
57e4431bcf4bdb6051bf9b4f9a31eb1db5075a0226cc45f8dfac73a201ec09a767f77acf538dc7351a9cf664bfb7102cd12c4c3afd272b0ab32a92c642ac90e9

Download Submit
C:\Windows\system\EYUDdcz.exe

Filesize
1.8MB

MD5
2cbab08a7c6af226fcbc80a441bb8d7c

SHA1
67b8b64afde0a52651283320d4eef865df928234

SHA256
e221e1b9dda0fe2482261a95152ea84eed554a28964621322b42c49e3fc58914

SHA512
8fab88137af2ec8722634e218adbea245a69bbaebac1ba5479ff3df006ba61c654eb063d617a0883538f0105cdcab56cf624fb474eba932b6566a18aff46015d

Download Submit
C:\Windows\system\HMPMSSt.exe

Filesize
1.8MB

MD5
e5d53969dc664d25b339ace81dc89270

SHA1
e8c5ed756e79d968f8ae4fe2e967274dd533b4e3

SHA256
581bfb4748b83b38228449bdf8f310111a0e0dda6c28b203e6903e2adf2a138a

SHA512
3f4f598a37b926e0fbf5173c081702ad672a2f19c06881909a0e5fee5ca816e4986d3ec6be4cef1329d11d42cbeb4cf722d0581e02a27d9ad99dc4a8e833a161

Download Submit
C:\Windows\system\HmxHsCg.exe

Filesize
1.8MB

MD5
2ce9c1a0a6615c8c9bcb1fc41a83e219

SHA1
c64301f048f79aece3181b2b7cef75aa3a0b87e2

SHA256
02e23e5145d561c5f708851e3cf1158a3391b8df67ed820962365bf48cf6d4d5

SHA512
327ab438d574bc83371a867f95c2573de6f705811dc2731b88a20892c291f5ca30580a80d30701b69565949b0fdae528d94cc0bbc1c5791650d36c678fbe3cf6

Download Submit
C:\Windows\system\HqAcVdS.exe

Filesize
1.8MB

MD5
3d2e21ba667285eb42f495b64795da88

SHA1
d88ad6fc7e8c853c4cafedc467e98d9399d54c82

SHA256
3583ba9dfcaad2c2e3e1cad45313df98173b3b99c285acae5b038bfd7c5861f5

SHA512
19b84bfacedb32bef15b24f59f8970825fdfe3283f03b8e2fd1fa54c837607bf1a0bc181f5d575b482ddfdb4d35f1a94189f7f6f819a9fc00229bd102f0d226e

Download Submit
C:\Windows\system\KlnBEua.exe

Filesize
1.8MB

MD5
6c781d56eafa4a8b6b18e163cecc09d4

SHA1
49a3c4f1555b733efaf40b702faaf0b1ca33619c

SHA256
5c9f0f0e2f866ba8b5a13b8e35861dc7b1e95f39013d1ece78a2f476d8e79173

SHA512
38f577b37138f26929ead48e5d35a1df9510a77a38456778d376b42431bda98452ab468b0cff275ff5579acad7eb0f0ba7255225448708b3fcb42521aead5b13

Download Submit
C:\Windows\system\LmrpVpp.exe

Filesize
1.8MB

MD5
fa21b70badfc5283ed9ee7fcc4d3949a

SHA1
7168f7534733a02b7da16ada805ee9697b7ee183

SHA256
5d19f9b074bef21678a1be1b42c8b49c37d7a1f89f0218b005de19b156134339

SHA512
dbe060002385c762d77ce96a3fe5bac9f9590049f58693654669e3f17922ee72a35a06d583c607b53addd939121ec31a56df86dc3393fdf88af8f7f370e44d13

Download Submit
C:\Windows\system\MvFVOGv.exe

Filesize
1.8MB

MD5
3ddc086ed7a60508830fe06d20cf0e42

SHA1
e0a697060abe2508f4ac96d20e440ea70bf9fd6f

SHA256
b8099247334ef8941116c1ba5f2cb87ce1dfd253bef017e7e9cbb989d87943fd

SHA512
d68bc73c52275c75730d52b71fcf407d94f905edf4de48a87a839bc92935bb65fed9f5b271b986896788b159f031bf2cba91e2b83331e88c462046e2efa4a440

Download Submit
C:\Windows\system\NEVkPtI.exe

Filesize
1.8MB

MD5
749ff06517e5a069f489e4fc792ff4ef

SHA1
9c738796c5697aebf3377a4aa814522f0da81131

SHA256
6a2bb39676e4879373cf85b199d83bc595a56f7f3a275174b36e492ec5b8695a

SHA512
e835c2a369913dd2ab5cfcbeb8020e093de9ebad7d86c8bc8ac587348c065c5964088194af382db20979ca00f48e0c494f07ff48f7f85c8e7e77d46229158100

Download Submit
C:\Windows\system\OGTNkuf.exe

Filesize
1.8MB

MD5
21bce17a328bb6a25b8e17428db3ddc9

SHA1
9f1dce8996f3f527fb94538227963a391ecd1c40

SHA256
c338844f5c5bf5a5c694b2cb7f0d550e0b1959d24d1e254a14382945619ba68a

SHA512
162cdc47b3494e9ef96fd474e1c2009750c6b1b0d24d035e992ef52bb8b3d08e50a0a7e5f8f7031b53b61f0d4bbe9f610592da3229c69fc4b1e1d131037dcbbf

Download Submit
C:\Windows\system\OuSvRKo.exe

Filesize
1.8MB

MD5
2ff50ec3d7f38fc44fc37a9c4c068e10

SHA1
c189bc29d57fc686517deab2cff149b9d217ea55

SHA256
d31fb0a32a889e4471404c9de9232750d026075fa10899f8bb3c431ca6f47a14

SHA512
476d3e2c79af5e76bb3868900df60ff15d2418cafc1821881e749887b7771eff04e6d66581839e9fac34bc8044c2810cdd9c578532c5ff7b06f52e7bb0dd28f1

Download Submit
C:\Windows\system\QfUXYIk.exe

Filesize
1.8MB

MD5
ca126693464759ec1c256bbfc44f758b

SHA1
b9972e959a16b36acfb8b0f0403d5b159b240197

SHA256
3ca57a6ff347831db372aa8a1a5fdbe247cf3e8b5630bd4b9b0abc6501138cb0

SHA512
46486fbe0a6448055db47cfa61e084a4ef3bebab93f09d59e31455515da87b371940d444f5e10b7cfdb511cb9517afa39cbd62322d8cd4d324348ff4a1aceaf5

Download Submit
C:\Windows\system\RPDisOW.exe

Filesize
1.8MB

MD5
0b0ab37de0ecbaaeb59804c62aa9e69e

SHA1
834df12c3870844faae9512f68a94e3d0df219c9

SHA256
ff5fbc485fc8704bf174c5bf785bf460de0903d00c3c54d1d05d1322a038d5f4

SHA512
6e0c8bcb00d32b75a5a9e661aeec50395b3ef9427e8ca14095f1a05f7f317074a053b6558cba483c4a6efb0c7e838019151ee2085fb03a1f20c65983b8e37cc9

Download Submit
C:\Windows\system\RRpQvKj.exe

Filesize
1.8MB

MD5
97397ac40c26ff88c26f9e9484bca12a

SHA1
18bcc17daa2d8823e71161e79a7683612ffec110

SHA256
3e6b564bd6dad447439767a725c1b6f4069a24be051681f97de20aec8caefb50

SHA512
ccef93881b3231b559dc1528ba860234e0176e87cb24122c1631f54ca0a4b925e08389a5e928e456b065caa13c79a08e6e56b879b79e422e8aec6e6e12baaaed

Download Submit
C:\Windows\system\TgOLbcb.exe

Filesize
1.8MB

MD5
a63c6cb0760d68b67813a58542e858de

SHA1
36e17568de1728435808f669d23542c60f6fba4b

SHA256
a254fc361b80df503edf21d15f53e605d988eabdd527bc872e8bbd71ab44d813

SHA512
325f24827febd1611a7374767aba79cbdf6c6e2a4f9b26074214ccf04ceb2a9aa5e964a4ffe0940bbd082a90e2027d33b7524abba391b7848aba695f8a3f2027

Download Submit
C:\Windows\system\VimtWGU.exe

Filesize
1.8MB

MD5
eaff2ec129491cf9a863dcd705be8501

SHA1
5d6511e01c17806f1b958b97d322a2ee132027c3

SHA256
37eb2eeec0f1c53756027c026a93772d48f67a22705e6399bfa8beaa27e4b8a3

SHA512
99962351aefc9cfa0d1381f819c9b966cbd27f7fde452159eb770261e8125b90234e3adfe5d6dd145baba6a88437c4bc6ef8e69355f73a506dbd1d751739d0f5

Download Submit
C:\Windows\system\XOeyVyj.exe

Filesize
1.8MB

MD5
7555bf9dc9f1c1fd5ce304f5f726d1d2

SHA1
b81ed35af69a7713de28c22cbc16cdf9f09672cf

SHA256
c1642a28d79d88cf921e0d6d1430e7adb43ed9860eb008458375c05a266b76b4

SHA512
4372b1c02ec7e7d39dc159c5137bde3b52051a9f80c4a7fe1406565e7f815105be4d8c6d5797471e04207302f127f499d76da13b54382a34cc2e6ba3002f3e4f

Download Submit
C:\Windows\system\ZgKfwLr.exe

Filesize
1.8MB

MD5
00b8b0f4015e3378059a8615f58720f4

SHA1
d3113fb17e8855f7ea32bec930c6e34c9be12b24

SHA256
f13ffbcf7ae09a0e1c9778153da4799f7450a471161fcf16ebd1c43505823d13

SHA512
79cbe1eb1df2d673cd381152c44bfab244c720f9e2f0e9f0d46b7a3172d3c281cd70928eb40075b2203cd6d0cfb935524276d5dc136c614300a8f4d8c47ab17a

Download Submit
C:\Windows\system\aOYiAdr.exe

Filesize
1.8MB

MD5
8ac71beb592c30ce17a03693514a0762

SHA1
09ce92afd809c2fddefb82edfe058b8bb04b7022

SHA256
64bf47893a448952333f1ff823857b9475608e39d0b1677feb1dbd9b25403479

SHA512
fbc26e82c41b8d60207176c9dfb11ad254301967c63b5c9cabc585816144725fa876208cf34429f3cbb5b819b31a7ad7cbb85692665da7a9b4c3586122f0e383

Download Submit
C:\Windows\system\aaqgCMY.exe

Filesize
1.8MB

MD5
afae5b7df7128a0a727211f878fe81a4

SHA1
82add43eb4ecc1cfe6ff3c2ee487b1a93b4dba21

SHA256
355b3a04528712f49ab761c6e796824742353144762e886e0f62f21603daf04d

SHA512
6f3af6d0bc605fd4b7cb74a378b9f757dc3733705f5ac3409437fb622289d59d7bd2d21d3642b4865054734e0c16bbbee46a36edc9f7756a703fbb196bc3cf49

Download Submit
C:\Windows\system\asVASId.exe

Filesize
1.8MB

MD5
e5d1a2fe7ab80015c02b559ce13bc4d3

SHA1
bc165eeff71dc862e6d883a5c96a1c3e1f030511

SHA256
0487e99caf75547b28c29748dc2e15fddc1347c290b65803e23f8cc2c3f442ed

SHA512
f64f1425a94883dde41047c11386134b9c0f83565fcdc2510d9b4129413a3d1da25165d9105c53c556e482413119fa84783eaefcd18c8199fee4b2e077ba2237

Download Submit
C:\Windows\system\bPExQOP.exe

Filesize
1.8MB

MD5
6b38c200390ed4aaa748f3e2ba4dee50

SHA1
ef739e6cb84a49254862efc830e2bd9bbc8187d9

SHA256
15f6c07291b74104ef16b3bcd32b748ac8f3c484fa8a401f050af0bb465a5648

SHA512
31070929d581d3ca8078019be6313dc4382740a1392681439709219061b9b56615e0cffb9c7307b983d1e93f40a4ec86d628d4a19748ffa68050437d4fb1d71f

Download Submit
C:\Windows\system\cekDMUk.exe

Filesize
1.8MB

MD5
8a0926a0fcaff8f270005ce95fa5e8c5

SHA1
2011643a77f60a7a500659a274c2fc22960f85ad

SHA256
66ec8e76ee8b829eef92b89b9258effad505865e0e13f73e3a2f773ef1c4fd32

SHA512
9475a04a3d2d7598ca28edf6da03276efad3b2133facce1d9049491d9f93ec01938f439a3978c69031eb244234fca086789f240249a77795f67698a0b3442b91

Download Submit
C:\Windows\system\kbjozly.exe

Filesize
1.8MB

MD5
602611275cb7bb8ab0cd4921846a5c40

SHA1
1a2dcc5de8851224e657c02ae1c405705f07c8fe

SHA256
5db31534f4dd2bd85b928ff6388222696b7375022f449226de52cd35f074fb3b

SHA512
0ef7ffddbdaed2c6728d503e9ab3584d72e2450efbdf09aa12836413c2a53d13aa345b5b4daa049fdd28474ebc42695082a45c40dbb1c71ea9b5eb1b3785f9ce

Download Submit
C:\Windows\system\nmnyioL.exe

Filesize
1.8MB

MD5
0885f59fe359e0496a49725c2e815363

SHA1
9ba580d4006131077cc5a48288dc9c58749abf3f

SHA256
d5a3b2b910ac14e33f855d29aabce1971028773fc3428ab1ea4b9e10fcad90aa

SHA512
f69438cacd77b84ff00ffaf7efbab9131a29dc0fc5ff083ca3579f9753cb16ee2654fb67282632982035b05dead5dd1ca186c19e260f422fcfbecf5c3c74ea1a

Download Submit
C:\Windows\system\sBGAkGC.exe

Filesize
1.8MB

MD5
4917c7eb1250f4b387b13155cdd9508d

SHA1
b1448c0954934886ef4fbfba05c19b5681c53472

SHA256
f6c716f9cdd3cee728c8c0d1d62850483c2024e028ded3bfcb78ff699481a5ad

SHA512
3c3460294481f627fefbc83896d96e112202c600e0bdc464a54ecbe3d1a62f87ddc219bf593e2c9157c7c686cda0ffd8df8c7ae5dff5d017a920d2380cbb289d

Download Submit
C:\Windows\system\xSWyNAI.exe

Filesize
1.8MB

MD5
ebd7cef4ca1b6a9469b7db9273d4490a

SHA1
490065813b0eacfe5c1ebba710f81dc1189ed8e5

SHA256
499667f5f211a48ba46623d3406059af58ee3e104c38cebbfffd3898f11cd04b

SHA512
7a1a3b16b5ec92c5f4bb986aa5b9d96e4f85d10fb144410c4459cfa9f4f59bebbf5204fd51d2a8e94fa2c449e6f5f98d1e2bd8c02cd20bc8c808f7b6e44c0359

Download Submit
C:\Windows\system\yIyjyDU.exe

Filesize
1.8MB

MD5
53feec847d483dd04ba16f02a1622982

SHA1
49d3682993e4db6a7480d7472ee48c6ba01130b2

SHA256
675321690bab53733332daa5fe9060c0a9863e20aa278150a3df52ac0228b081

SHA512
714e0e846581bcce792d9c6d2d9caf44a12ed07b935dcda3c22f2682ceb34ab8bde518d5e00a42bb45d54ed4631019656f2e282d2d619edbd1d1535edcb0a714

Download Submit
\Windows\system\NNlRdqa.exe

Filesize
1.8MB

MD5
72fa994c5de328fcf2c76252cb6f09ba

SHA1
0276878fee97baaf91df9e13e910a4b5f252c89a

SHA256
ad3cdd46005649fc12e5f707381a288f1cb2d3f63ff9dc3178367b23bd8e9ab3

SHA512
5589c04732afa17b79ea3be38fc6d937e3b966c720dbb92b715a33b943c700283142950f21f8f24822d7a95f99e04468607318d99a78f1c15724ab8d5f5563c8

Download Submit
\Windows\system\XrgMfhh.exe

Filesize
1.8MB

MD5
1326c28de2178ca481b39810e3fa1f0b

SHA1
27b37cd25c0ce7045ef89d9779eca0c6e016256b

SHA256
5ded2ae5d0a9013ca6d0a92ff2b8af2f5e943e0b2e57383998356771a397469f

SHA512
641eda2933b7300dbe87f1be6bf7a7b959ff0bfd6fa37fe1265e0b3b0a531e74f404f7c133d7866060a1cf31cb9e503be1ba94aa4cd694b57f4d9e389ab7def1

Download Submit
\Windows\system\wkWraRk.exe

Filesize
1.8MB

MD5
4a3a1baea9949f40b6d79a0d4771f8d1

SHA1
0fe472d1a7b4b8f21e41e29462da40a86f1267ea

SHA256
aefca71e5a83a6294ccf11c54a938b4a92f02b9247261875cdc15cc92bf5322b

SHA512
8714f8a12d7be3ba0250e217120bcf7ac004ff7732a583b99cac5243dcdd4231758c099c83e0d5f54c5794c46c59666e1ecfb69cf3ad8574263d1a7d03260ebc

Download Submit
memory/2400-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download