xmrig | 237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/12/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
Size

1.3MB
MD5

630a84f960024ff7825f885c4c36532c
SHA1

6aea2cd75fd42f56c4c5df0a05f978c64c3204d6
SHA256

237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f
SHA512

0053b59b92e442fabb6061be30ee5158437d149a7f0a36a468b27912ce58c15ab2d0e3a0f6f9abe4dcbd96740e3d99014dd8d087e4aea0ea246e1cd09ae7e44a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvY5:GezaTF8FcNkNdfE0pZ9ozttwIRakG37g

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001202c-2.dat	xmrig
behavioral1/files/0x0008000000015ef6-13.dat	xmrig
behavioral1/files/0x0008000000015f4f-14.dat	xmrig
behavioral1/files/0x0007000000016239-22.dat	xmrig
behavioral1/files/0x000500000001925b-40.dat	xmrig
behavioral1/files/0x000500000001932a-52.dat	xmrig
behavioral1/files/0x000500000001938a-60.dat	xmrig
behavioral1/files/0x0005000000019481-84.dat	xmrig
behavioral1/files/0x000500000001949d-92.dat	xmrig
behavioral1/files/0x00050000000195c0-128.dat	xmrig
behavioral1/files/0x0005000000019581-124.dat	xmrig
behavioral1/files/0x000500000001955c-120.dat	xmrig
behavioral1/files/0x0005000000019551-116.dat	xmrig
behavioral1/files/0x00050000000194e6-112.dat	xmrig
behavioral1/files/0x00050000000194e4-109.dat	xmrig
behavioral1/files/0x00050000000194da-105.dat	xmrig
behavioral1/files/0x00050000000194d0-100.dat	xmrig
behavioral1/files/0x00050000000194c6-96.dat	xmrig
behavioral1/files/0x0005000000019490-88.dat	xmrig
behavioral1/files/0x000500000001946b-80.dat	xmrig
behavioral1/files/0x0005000000019429-76.dat	xmrig
behavioral1/files/0x000500000001941b-72.dat	xmrig
behavioral1/files/0x000500000001939c-68.dat	xmrig
behavioral1/files/0x000500000001938e-64.dat	xmrig
behavioral1/files/0x0005000000019377-56.dat	xmrig
behavioral1/files/0x000500000001930d-48.dat	xmrig
behavioral1/files/0x000500000001925d-44.dat	xmrig
behavioral1/files/0x0008000000016621-36.dat	xmrig
behavioral1/files/0x0007000000016485-33.dat	xmrig
behavioral1/files/0x0007000000016307-29.dat	xmrig
behavioral1/files/0x0008000000015fdb-21.dat	xmrig
behavioral1/files/0x0008000000015e8f-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1012	CPPeOpS.exe
2488	XMYTLQJ.exe
2184	ZUQuTwx.exe
2224	DXiXVHq.exe
2236	FLySYXG.exe
804	AeZLgZY.exe
2440	kpPOyPE.exe
1996	WcgyPrP.exe
2960	TYJAvam.exe
2668	DKnoleS.exe
2812	sNwFQYd.exe
2788	MPRVgXZ.exe
2632	fwaSLzK.exe
2672	DssQsAp.exe
2796	MHeHWpC.exe
2836	QbVhqTn.exe
2780	vLUmifI.exe
2724	AdkoOyr.exe
2688	LbzlNrU.exe
2768	HsUGyRQ.exe
2536	rGKkDMh.exe
2596	AxhiczR.exe
3068	tZKQAnF.exe
2492	IpjLIXP.exe
1704	tWFKNHm.exe
1724	HxGOiVs.exe
2508	UjZoUjJ.exe
1992	hmGVckc.exe
1688	CcHvoYH.exe
1328	OrgjDzR.exe
1188	MIzOWcf.exe
2920	reuegNw.exe
2944	zMoNHiM.exe
2904	YnLDzcV.exe
2876	PDsUsOS.exe
3048	OxxVLln.exe
484	SfZYssY.exe
332	eIfWamr.exe
580	qeHffEM.exe
1956	ajWscKs.exe
3060	fhBTfRA.exe
2080	XgPjrBa.exe
2916	pHZUSqn.exe
276	VMwCLAP.exe
1616	wTkCqbM.exe
448	HQBtSlL.exe
1160	PCuLwOF.exe
2100	zBlIMqu.exe
1092	jqPYoqT.exe
328	ZGVCbpP.exe
1552	jCdiFuP.exe
1296	mIeuRnv.exe
936	fDGNtoT.exe
3056	VdFlvDM.exe
1748	TrIMClH.exe
1264	sqqyiRA.exe
2200	vKMyJlQ.exe
1752	OmxkAMf.exe
896	HgMCWXa.exe
1532	zbpTnvp.exe
2992	HiHgxTk.exe
1016	yYSOCJp.exe
1936	GytpxAy.exe
2320	FUuRMUm.exe

Loads dropped DLL 64 IoCs

pid	Process
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GIUOxfb.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\NNcpJvw.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\yTuGnEY.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\iFZsone.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\OgIuUMn.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\XrHkhFh.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\IXuCXPt.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\NkPwxzV.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\kHmVXYN.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\dZRIhEW.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\dPniNFs.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\RxMhwnV.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\OmGDdmQ.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\bFVdemQ.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\vaDYOCb.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\jbpgUtl.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\oalmtmO.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\MYUPPCE.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\MdDyRTK.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\wJZuUBr.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\BQQOsrv.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\yYSOCJp.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\ctOsLVv.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\cgdyqaK.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\QINSAiS.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\LizUQyo.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\XvZfXEL.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\pgvaUxK.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\tSJGTuc.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\ORrjHRx.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\bBvtwYT.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\wYKVnvc.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\ZxYdNit.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\MugWdVo.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\EAsibaQ.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\OgUOaqf.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\aqigIgt.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\UiDcAym.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\UInNwGp.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\UMBJwXY.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\OCjglxk.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\OsDAofw.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\iuLKiEx.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\xtbwbti.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\QoeiJfI.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\uZmbWRk.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\ZaGUWRm.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\rJWZmsm.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\VtyjRmX.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\cqjSHSG.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\nZXPfgC.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\LbzlNrU.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\HiHgxTk.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\EzLnbHt.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\JLCpfbA.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\lSPQLrY.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\pNznGKH.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\CXjkBLv.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\TOyZnIk.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\TDuRPrw.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\UrxJoSk.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\WYUFkto.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\gvWBFrr.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
File created	C:\Windows\System\CmIZlGS.exe	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1012	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	29
PID 1596 wrote to memory of 1012	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	29
PID 1596 wrote to memory of 1012	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	29
PID 1596 wrote to memory of 2488	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	30
PID 1596 wrote to memory of 2488	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	30
PID 1596 wrote to memory of 2488	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	30
PID 1596 wrote to memory of 2184	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	31
PID 1596 wrote to memory of 2184	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	31
PID 1596 wrote to memory of 2184	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	31
PID 1596 wrote to memory of 2224	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	32
PID 1596 wrote to memory of 2224	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	32
PID 1596 wrote to memory of 2224	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	32
PID 1596 wrote to memory of 2236	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	33
PID 1596 wrote to memory of 2236	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	33
PID 1596 wrote to memory of 2236	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	33
PID 1596 wrote to memory of 804	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	34
PID 1596 wrote to memory of 804	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	34
PID 1596 wrote to memory of 804	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	34
PID 1596 wrote to memory of 2440	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	35
PID 1596 wrote to memory of 2440	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	35
PID 1596 wrote to memory of 2440	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	35
PID 1596 wrote to memory of 1996	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	36
PID 1596 wrote to memory of 1996	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	36
PID 1596 wrote to memory of 1996	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	36
PID 1596 wrote to memory of 2960	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	37
PID 1596 wrote to memory of 2960	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	37
PID 1596 wrote to memory of 2960	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	37
PID 1596 wrote to memory of 2668	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	38
PID 1596 wrote to memory of 2668	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	38
PID 1596 wrote to memory of 2668	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	38
PID 1596 wrote to memory of 2812	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	39
PID 1596 wrote to memory of 2812	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	39
PID 1596 wrote to memory of 2812	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	39
PID 1596 wrote to memory of 2788	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	40
PID 1596 wrote to memory of 2788	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	40
PID 1596 wrote to memory of 2788	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	40
PID 1596 wrote to memory of 2632	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	41
PID 1596 wrote to memory of 2632	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	41
PID 1596 wrote to memory of 2632	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	41
PID 1596 wrote to memory of 2672	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	42
PID 1596 wrote to memory of 2672	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	42
PID 1596 wrote to memory of 2672	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	42
PID 1596 wrote to memory of 2796	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	43
PID 1596 wrote to memory of 2796	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	43
PID 1596 wrote to memory of 2796	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	43
PID 1596 wrote to memory of 2836	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	44
PID 1596 wrote to memory of 2836	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	44
PID 1596 wrote to memory of 2836	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	44
PID 1596 wrote to memory of 2780	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	45
PID 1596 wrote to memory of 2780	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	45
PID 1596 wrote to memory of 2780	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	45
PID 1596 wrote to memory of 2724	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	46
PID 1596 wrote to memory of 2724	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	46
PID 1596 wrote to memory of 2724	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	46
PID 1596 wrote to memory of 2688	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	47
PID 1596 wrote to memory of 2688	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	47
PID 1596 wrote to memory of 2688	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	47
PID 1596 wrote to memory of 2768	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	48
PID 1596 wrote to memory of 2768	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	48
PID 1596 wrote to memory of 2768	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	48
PID 1596 wrote to memory of 2536	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	49
PID 1596 wrote to memory of 2536	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	49
PID 1596 wrote to memory of 2536	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	49
PID 1596 wrote to memory of 2596	1596	237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe	50

C:\Users\Admin\AppData\Local\Temp\237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe
"C:\Users\Admin\AppData\Local\Temp\237af72b45d6c4cf3ee0dc256469aee44a4acf0c19a8b7a631eea7dd98772d2f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\System\CPPeOpS.exe
  C:\Windows\System\CPPeOpS.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\XMYTLQJ.exe
  C:\Windows\System\XMYTLQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\ZUQuTwx.exe
  C:\Windows\System\ZUQuTwx.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\DXiXVHq.exe
  C:\Windows\System\DXiXVHq.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FLySYXG.exe
  C:\Windows\System\FLySYXG.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\AeZLgZY.exe
  C:\Windows\System\AeZLgZY.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\kpPOyPE.exe
  C:\Windows\System\kpPOyPE.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\WcgyPrP.exe
  C:\Windows\System\WcgyPrP.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\TYJAvam.exe
  C:\Windows\System\TYJAvam.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DKnoleS.exe
  C:\Windows\System\DKnoleS.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\sNwFQYd.exe
  C:\Windows\System\sNwFQYd.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\MPRVgXZ.exe
  C:\Windows\System\MPRVgXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\fwaSLzK.exe
  C:\Windows\System\fwaSLzK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DssQsAp.exe
  C:\Windows\System\DssQsAp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MHeHWpC.exe
  C:\Windows\System\MHeHWpC.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\QbVhqTn.exe
  C:\Windows\System\QbVhqTn.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\vLUmifI.exe
  C:\Windows\System\vLUmifI.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AdkoOyr.exe
  C:\Windows\System\AdkoOyr.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\LbzlNrU.exe
  C:\Windows\System\LbzlNrU.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\HsUGyRQ.exe
  C:\Windows\System\HsUGyRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\rGKkDMh.exe
  C:\Windows\System\rGKkDMh.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\AxhiczR.exe
  C:\Windows\System\AxhiczR.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\tZKQAnF.exe
  C:\Windows\System\tZKQAnF.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\IpjLIXP.exe
  C:\Windows\System\IpjLIXP.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\tWFKNHm.exe
  C:\Windows\System\tWFKNHm.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\HxGOiVs.exe
  C:\Windows\System\HxGOiVs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\UjZoUjJ.exe
  C:\Windows\System\UjZoUjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\hmGVckc.exe
  C:\Windows\System\hmGVckc.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\CcHvoYH.exe
  C:\Windows\System\CcHvoYH.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\OrgjDzR.exe
  C:\Windows\System\OrgjDzR.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\MIzOWcf.exe
  C:\Windows\System\MIzOWcf.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\reuegNw.exe
  C:\Windows\System\reuegNw.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\zMoNHiM.exe
  C:\Windows\System\zMoNHiM.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\YnLDzcV.exe
  C:\Windows\System\YnLDzcV.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\PDsUsOS.exe
  C:\Windows\System\PDsUsOS.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\OxxVLln.exe
  C:\Windows\System\OxxVLln.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\SfZYssY.exe
  C:\Windows\System\SfZYssY.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\eIfWamr.exe
  C:\Windows\System\eIfWamr.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\qeHffEM.exe
  C:\Windows\System\qeHffEM.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\ajWscKs.exe
  C:\Windows\System\ajWscKs.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\fhBTfRA.exe
  C:\Windows\System\fhBTfRA.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\XgPjrBa.exe
  C:\Windows\System\XgPjrBa.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pHZUSqn.exe
  C:\Windows\System\pHZUSqn.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\VMwCLAP.exe
  C:\Windows\System\VMwCLAP.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\wTkCqbM.exe
  C:\Windows\System\wTkCqbM.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\HQBtSlL.exe
  C:\Windows\System\HQBtSlL.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\PCuLwOF.exe
  C:\Windows\System\PCuLwOF.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\zBlIMqu.exe
  C:\Windows\System\zBlIMqu.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\jqPYoqT.exe
  C:\Windows\System\jqPYoqT.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ZGVCbpP.exe
  C:\Windows\System\ZGVCbpP.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\jCdiFuP.exe
  C:\Windows\System\jCdiFuP.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\mIeuRnv.exe
  C:\Windows\System\mIeuRnv.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\fDGNtoT.exe
  C:\Windows\System\fDGNtoT.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\VdFlvDM.exe
  C:\Windows\System\VdFlvDM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\TrIMClH.exe
  C:\Windows\System\TrIMClH.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\sqqyiRA.exe
  C:\Windows\System\sqqyiRA.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\vKMyJlQ.exe
  C:\Windows\System\vKMyJlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\OmxkAMf.exe
  C:\Windows\System\OmxkAMf.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\HgMCWXa.exe
  C:\Windows\System\HgMCWXa.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\zbpTnvp.exe
  C:\Windows\System\zbpTnvp.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\HiHgxTk.exe
  C:\Windows\System\HiHgxTk.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\yYSOCJp.exe
  C:\Windows\System\yYSOCJp.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\GytpxAy.exe
  C:\Windows\System\GytpxAy.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\FUuRMUm.exe
  C:\Windows\System\FUuRMUm.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\UuORfBt.exe
  C:\Windows\System\UuORfBt.exe
  2⤵
  PID:2400
- C:\Windows\System\GZtwHLS.exe
  C:\Windows\System\GZtwHLS.exe
  2⤵
  PID:2892
- C:\Windows\System\AFiYuER.exe
  C:\Windows\System\AFiYuER.exe
  2⤵
  PID:2008
- C:\Windows\System\AIQZWBu.exe
  C:\Windows\System\AIQZWBu.exe
  2⤵
  PID:1548
- C:\Windows\System\bVmrsiX.exe
  C:\Windows\System\bVmrsiX.exe
  2⤵
  PID:2288
- C:\Windows\System\MAOKzxM.exe
  C:\Windows\System\MAOKzxM.exe
  2⤵
  PID:1872
- C:\Windows\System\rTKMBhS.exe
  C:\Windows\System\rTKMBhS.exe
  2⤵
  PID:888
- C:\Windows\System\CWtZsio.exe
  C:\Windows\System\CWtZsio.exe
  2⤵
  PID:2364
- C:\Windows\System\wdSQfvK.exe
  C:\Windows\System\wdSQfvK.exe
  2⤵
  PID:2376
- C:\Windows\System\JUahuoH.exe
  C:\Windows\System\JUahuoH.exe
  2⤵
  PID:1500
- C:\Windows\System\qOLcglV.exe
  C:\Windows\System\qOLcglV.exe
  2⤵
  PID:2024
- C:\Windows\System\waRKfVm.exe
  C:\Windows\System\waRKfVm.exe
  2⤵
  PID:2248
- C:\Windows\System\PcFjKBe.exe
  C:\Windows\System\PcFjKBe.exe
  2⤵
  PID:2192
- C:\Windows\System\AnynSRx.exe
  C:\Windows\System\AnynSRx.exe
  2⤵
  PID:2220
- C:\Windows\System\bQdVCLz.exe
  C:\Windows\System\bQdVCLz.exe
  2⤵
  PID:2460
- C:\Windows\System\YDNeAYT.exe
  C:\Windows\System\YDNeAYT.exe
  2⤵
  PID:2000
- C:\Windows\System\CckiSNe.exe
  C:\Windows\System\CckiSNe.exe
  2⤵
  PID:2804
- C:\Windows\System\CgxkQBK.exe
  C:\Windows\System\CgxkQBK.exe
  2⤵
  PID:1952
- C:\Windows\System\MhunkhE.exe
  C:\Windows\System\MhunkhE.exe
  2⤵
  PID:2528
- C:\Windows\System\ndSUktS.exe
  C:\Windows\System\ndSUktS.exe
  2⤵
  PID:2732
- C:\Windows\System\nqQZwtK.exe
  C:\Windows\System\nqQZwtK.exe
  2⤵
  PID:2180
- C:\Windows\System\chHjuOM.exe
  C:\Windows\System\chHjuOM.exe
  2⤵
  PID:2524
- C:\Windows\System\hTvBDVP.exe
  C:\Windows\System\hTvBDVP.exe
  2⤵
  PID:2068
- C:\Windows\System\vCwviBC.exe
  C:\Windows\System\vCwviBC.exe
  2⤵
  PID:1648
- C:\Windows\System\jyPVKYX.exe
  C:\Windows\System\jyPVKYX.exe
  2⤵
  PID:2744
- C:\Windows\System\JsVCmXF.exe
  C:\Windows\System\JsVCmXF.exe
  2⤵
  PID:2716
- C:\Windows\System\qIXbCfc.exe
  C:\Windows\System\qIXbCfc.exe
  2⤵
  PID:1252
- C:\Windows\System\SNstwSq.exe
  C:\Windows\System\SNstwSq.exe
  2⤵
  PID:2888
- C:\Windows\System\pziddpE.exe
  C:\Windows\System\pziddpE.exe
  2⤵
  PID:2912
- C:\Windows\System\BNQxJst.exe
  C:\Windows\System\BNQxJst.exe
  2⤵
  PID:768
- C:\Windows\System\cBnVBdn.exe
  C:\Windows\System\cBnVBdn.exe
  2⤵
  PID:2152
- C:\Windows\System\lUIoTRs.exe
  C:\Windows\System\lUIoTRs.exe
  2⤵
  PID:1112
- C:\Windows\System\syntpFw.exe
  C:\Windows\System\syntpFw.exe
  2⤵
  PID:2884
- C:\Windows\System\fktLJkE.exe
  C:\Windows\System\fktLJkE.exe
  2⤵
  PID:1784
- C:\Windows\System\CwWIJnc.exe
  C:\Windows\System\CwWIJnc.exe
  2⤵
  PID:1836
- C:\Windows\System\HIjFsng.exe
  C:\Windows\System\HIjFsng.exe
  2⤵
  PID:2120
- C:\Windows\System\RLvtzlE.exe
  C:\Windows\System\RLvtzlE.exe
  2⤵
  PID:1852
- C:\Windows\System\dpQyZWj.exe
  C:\Windows\System\dpQyZWj.exe
  2⤵
  PID:684
- C:\Windows\System\WJEJYoR.exe
  C:\Windows\System\WJEJYoR.exe
  2⤵
  PID:1312
- C:\Windows\System\ChgZeGD.exe
  C:\Windows\System\ChgZeGD.exe
  2⤵
  PID:2088
- C:\Windows\System\NjsnmJz.exe
  C:\Windows\System\NjsnmJz.exe
  2⤵
  PID:852
- C:\Windows\System\TMAgTKP.exe
  C:\Windows\System\TMAgTKP.exe
  2⤵
  PID:1968
- C:\Windows\System\hSykxdj.exe
  C:\Windows\System\hSykxdj.exe
  2⤵
  PID:1508
- C:\Windows\System\hZSilXr.exe
  C:\Windows\System\hZSilXr.exe
  2⤵
  PID:1860
- C:\Windows\System\XfAhahF.exe
  C:\Windows\System\XfAhahF.exe
  2⤵
  PID:2304
- C:\Windows\System\xkgkdEx.exe
  C:\Windows\System\xkgkdEx.exe
  2⤵
  PID:2056
- C:\Windows\System\JCJJAoK.exe
  C:\Windows\System\JCJJAoK.exe
  2⤵
  PID:3016
- C:\Windows\System\pnEWqWB.exe
  C:\Windows\System\pnEWqWB.exe
  2⤵
  PID:2844
- C:\Windows\System\NmeSIYC.exe
  C:\Windows\System\NmeSIYC.exe
  2⤵
  PID:1640
- C:\Windows\System\DOyYDBk.exe
  C:\Windows\System\DOyYDBk.exe
  2⤵
  PID:2424
- C:\Windows\System\sEUuZEY.exe
  C:\Windows\System\sEUuZEY.exe
  2⤵
  PID:1620
- C:\Windows\System\SYHNPGF.exe
  C:\Windows\System\SYHNPGF.exe
  2⤵
  PID:1884
- C:\Windows\System\JAavYUv.exe
  C:\Windows\System\JAavYUv.exe
  2⤵
  PID:2976
- C:\Windows\System\pNznGKH.exe
  C:\Windows\System\pNznGKH.exe
  2⤵
  PID:1008
- C:\Windows\System\ctOsLVv.exe
  C:\Windows\System\ctOsLVv.exe
  2⤵
  PID:2600
- C:\Windows\System\TDDBikp.exe
  C:\Windows\System\TDDBikp.exe
  2⤵
  PID:1472
- C:\Windows\System\aLhUgAj.exe
  C:\Windows\System\aLhUgAj.exe
  2⤵
  PID:1900
- C:\Windows\System\uDXQLdD.exe
  C:\Windows\System\uDXQLdD.exe
  2⤵
  PID:1220
- C:\Windows\System\DGKVcHc.exe
  C:\Windows\System\DGKVcHc.exe
  2⤵
  PID:3084
- C:\Windows\System\tPcudzt.exe
  C:\Windows\System\tPcudzt.exe
  2⤵
  PID:3100
- C:\Windows\System\OVSlDwX.exe
  C:\Windows\System\OVSlDwX.exe
  2⤵
  PID:3116
- C:\Windows\System\OjcgBUL.exe
  C:\Windows\System\OjcgBUL.exe
  2⤵
  PID:3132
- C:\Windows\System\FlMeglr.exe
  C:\Windows\System\FlMeglr.exe
  2⤵
  PID:3148
- C:\Windows\System\yQPYuHW.exe
  C:\Windows\System\yQPYuHW.exe
  2⤵
  PID:3164
- C:\Windows\System\xfLKsXp.exe
  C:\Windows\System\xfLKsXp.exe
  2⤵
  PID:3180
- C:\Windows\System\lBoeKgi.exe
  C:\Windows\System\lBoeKgi.exe
  2⤵
  PID:3196
- C:\Windows\System\nloCEGc.exe
  C:\Windows\System\nloCEGc.exe
  2⤵
  PID:3212
- C:\Windows\System\AWOSUfI.exe
  C:\Windows\System\AWOSUfI.exe
  2⤵
  PID:3228
- C:\Windows\System\hKubGee.exe
  C:\Windows\System\hKubGee.exe
  2⤵
  PID:3244
- C:\Windows\System\mkKDqtU.exe
  C:\Windows\System\mkKDqtU.exe
  2⤵
  PID:3260
- C:\Windows\System\cjspfHx.exe
  C:\Windows\System\cjspfHx.exe
  2⤵
  PID:3276
- C:\Windows\System\esfYnbB.exe
  C:\Windows\System\esfYnbB.exe
  2⤵
  PID:3292
- C:\Windows\System\SsOngsE.exe
  C:\Windows\System\SsOngsE.exe
  2⤵
  PID:3308
- C:\Windows\System\QbiyFTM.exe
  C:\Windows\System\QbiyFTM.exe
  2⤵
  PID:3324
- C:\Windows\System\kGughGU.exe
  C:\Windows\System\kGughGU.exe
  2⤵
  PID:3340
- C:\Windows\System\FkVqHTh.exe
  C:\Windows\System\FkVqHTh.exe
  2⤵
  PID:3356
- C:\Windows\System\OMpYLUI.exe
  C:\Windows\System\OMpYLUI.exe
  2⤵
  PID:3372
- C:\Windows\System\uozBDOF.exe
  C:\Windows\System\uozBDOF.exe
  2⤵
  PID:3388
- C:\Windows\System\IIndOZK.exe
  C:\Windows\System\IIndOZK.exe
  2⤵
  PID:3404
- C:\Windows\System\JyKpNfp.exe
  C:\Windows\System\JyKpNfp.exe
  2⤵
  PID:3420
- C:\Windows\System\TIuUSyW.exe
  C:\Windows\System\TIuUSyW.exe
  2⤵
  PID:3436
- C:\Windows\System\kXzXQxU.exe
  C:\Windows\System\kXzXQxU.exe
  2⤵
  PID:3452
- C:\Windows\System\QeWNNkL.exe
  C:\Windows\System\QeWNNkL.exe
  2⤵
  PID:3468
- C:\Windows\System\qDqcWgk.exe
  C:\Windows\System\qDqcWgk.exe
  2⤵
  PID:3484
- C:\Windows\System\KZvLWMG.exe
  C:\Windows\System\KZvLWMG.exe
  2⤵
  PID:3500
- C:\Windows\System\zbMClJX.exe
  C:\Windows\System\zbMClJX.exe
  2⤵
  PID:3516
- C:\Windows\System\UNiACrn.exe
  C:\Windows\System\UNiACrn.exe
  2⤵
  PID:3532
- C:\Windows\System\iSxQeCo.exe
  C:\Windows\System\iSxQeCo.exe
  2⤵
  PID:3548
- C:\Windows\System\fsdymhR.exe
  C:\Windows\System\fsdymhR.exe
  2⤵
  PID:3564
- C:\Windows\System\IXuCXPt.exe
  C:\Windows\System\IXuCXPt.exe
  2⤵
  PID:3580
- C:\Windows\System\AALlKpC.exe
  C:\Windows\System\AALlKpC.exe
  2⤵
  PID:3596
- C:\Windows\System\xmlsQIc.exe
  C:\Windows\System\xmlsQIc.exe
  2⤵
  PID:3612
- C:\Windows\System\TOyZnIk.exe
  C:\Windows\System\TOyZnIk.exe
  2⤵
  PID:3628
- C:\Windows\System\luCymxu.exe
  C:\Windows\System\luCymxu.exe
  2⤵
  PID:3644
- C:\Windows\System\hXeLlGR.exe
  C:\Windows\System\hXeLlGR.exe
  2⤵
  PID:3660
- C:\Windows\System\wNngZWM.exe
  C:\Windows\System\wNngZWM.exe
  2⤵
  PID:3676
- C:\Windows\System\YCIYOQx.exe
  C:\Windows\System\YCIYOQx.exe
  2⤵
  PID:3692
- C:\Windows\System\GIwWdCS.exe
  C:\Windows\System\GIwWdCS.exe
  2⤵
  PID:3708
- C:\Windows\System\iMppTSU.exe
  C:\Windows\System\iMppTSU.exe
  2⤵
  PID:3724
- C:\Windows\System\ipcrJBu.exe
  C:\Windows\System\ipcrJBu.exe
  2⤵
  PID:3740
- C:\Windows\System\penSclP.exe
  C:\Windows\System\penSclP.exe
  2⤵
  PID:3756
- C:\Windows\System\ygDBtmE.exe
  C:\Windows\System\ygDBtmE.exe
  2⤵
  PID:3772
- C:\Windows\System\sBPpsHa.exe
  C:\Windows\System\sBPpsHa.exe
  2⤵
  PID:3788
- C:\Windows\System\iuLKiEx.exe
  C:\Windows\System\iuLKiEx.exe
  2⤵
  PID:3804
- C:\Windows\System\ATNhQzr.exe
  C:\Windows\System\ATNhQzr.exe
  2⤵
  PID:3820
- C:\Windows\System\fQnqxkc.exe
  C:\Windows\System\fQnqxkc.exe
  2⤵
  PID:3836
- C:\Windows\System\tkIwedB.exe
  C:\Windows\System\tkIwedB.exe
  2⤵
  PID:3852
- C:\Windows\System\TDuRPrw.exe
  C:\Windows\System\TDuRPrw.exe
  2⤵
  PID:3868
- C:\Windows\System\jbpgUtl.exe
  C:\Windows\System\jbpgUtl.exe
  2⤵
  PID:3884
- C:\Windows\System\JuTlNvx.exe
  C:\Windows\System\JuTlNvx.exe
  2⤵
  PID:3900
- C:\Windows\System\NFiTIOB.exe
  C:\Windows\System\NFiTIOB.exe
  2⤵
  PID:3916
- C:\Windows\System\QkMNuwT.exe
  C:\Windows\System\QkMNuwT.exe
  2⤵
  PID:3932
- C:\Windows\System\NIQaMNm.exe
  C:\Windows\System\NIQaMNm.exe
  2⤵
  PID:3948
- C:\Windows\System\GpceIiv.exe
  C:\Windows\System\GpceIiv.exe
  2⤵
  PID:3964
- C:\Windows\System\cZRbvMw.exe
  C:\Windows\System\cZRbvMw.exe
  2⤵
  PID:3980
- C:\Windows\System\DRbTJtE.exe
  C:\Windows\System\DRbTJtE.exe
  2⤵
  PID:3996
- C:\Windows\System\rlHVCWz.exe
  C:\Windows\System\rlHVCWz.exe
  2⤵
  PID:4012
- C:\Windows\System\SWnPUMn.exe
  C:\Windows\System\SWnPUMn.exe
  2⤵
  PID:4028
- C:\Windows\System\QlnuckJ.exe
  C:\Windows\System\QlnuckJ.exe
  2⤵
  PID:4044
- C:\Windows\System\OINsvSZ.exe
  C:\Windows\System\OINsvSZ.exe
  2⤵
  PID:4060
- C:\Windows\System\bOYQiTQ.exe
  C:\Windows\System\bOYQiTQ.exe
  2⤵
  PID:4076
- C:\Windows\System\jXytcDq.exe
  C:\Windows\System\jXytcDq.exe
  2⤵
  PID:4092
- C:\Windows\System\rAYAfQy.exe
  C:\Windows\System\rAYAfQy.exe
  2⤵
  PID:2880
- C:\Windows\System\dgTgPLG.exe
  C:\Windows\System\dgTgPLG.exe
  2⤵
  PID:2948
- C:\Windows\System\soifnQw.exe
  C:\Windows\System\soifnQw.exe
  2⤵
  PID:2312
- C:\Windows\System\bYwYRzr.exe
  C:\Windows\System\bYwYRzr.exe
  2⤵
  PID:1080
- C:\Windows\System\BqbdjNx.exe
  C:\Windows\System\BqbdjNx.exe
  2⤵
  PID:1164
- C:\Windows\System\vntYfvt.exe
  C:\Windows\System\vntYfvt.exe
  2⤵
  PID:1468
- C:\Windows\System\zywyqam.exe
  C:\Windows\System\zywyqam.exe
  2⤵
  PID:1424
- C:\Windows\System\stfMfTm.exe
  C:\Windows\System\stfMfTm.exe
  2⤵
  PID:2456
- C:\Windows\System\SBcNfFG.exe
  C:\Windows\System\SBcNfFG.exe
  2⤵
  PID:2408
- C:\Windows\System\idmRlxy.exe
  C:\Windows\System\idmRlxy.exe
  2⤵
  PID:2392
- C:\Windows\System\WTEluIF.exe
  C:\Windows\System\WTEluIF.exe
  2⤵
  PID:1520
- C:\Windows\System\WlhPNot.exe
  C:\Windows\System\WlhPNot.exe
  2⤵
  PID:2496
- C:\Windows\System\XMVYWJd.exe
  C:\Windows\System\XMVYWJd.exe
  2⤵
  PID:2340
- C:\Windows\System\OVOjkKI.exe
  C:\Windows\System\OVOjkKI.exe
  2⤵
  PID:2568
- C:\Windows\System\jkdgIhm.exe
  C:\Windows\System\jkdgIhm.exe
  2⤵
  PID:2244
- C:\Windows\System\KJLAvYN.exe
  C:\Windows\System\KJLAvYN.exe
  2⤵
  PID:3076
- C:\Windows\System\SuPURKK.exe
  C:\Windows\System\SuPURKK.exe
  2⤵
  PID:3108
- C:\Windows\System\gzzszgM.exe
  C:\Windows\System\gzzszgM.exe
  2⤵
  PID:3140
- C:\Windows\System\ScvayBG.exe
  C:\Windows\System\ScvayBG.exe
  2⤵
  PID:3188
- C:\Windows\System\nWUWFTf.exe
  C:\Windows\System\nWUWFTf.exe
  2⤵
  PID:3204
- C:\Windows\System\jBEMPLV.exe
  C:\Windows\System\jBEMPLV.exe
  2⤵
  PID:3236
- C:\Windows\System\eRAHUcH.exe
  C:\Windows\System\eRAHUcH.exe
  2⤵
  PID:3268
- C:\Windows\System\yQUSusC.exe
  C:\Windows\System\yQUSusC.exe
  2⤵
  PID:3300
- C:\Windows\System\feCwbrJ.exe
  C:\Windows\System\feCwbrJ.exe
  2⤵
  PID:3332
- C:\Windows\System\IfXoENV.exe
  C:\Windows\System\IfXoENV.exe
  2⤵
  PID:3380
- C:\Windows\System\mnmEIOA.exe
  C:\Windows\System\mnmEIOA.exe
  2⤵
  PID:3396
- C:\Windows\System\SEnuPoK.exe
  C:\Windows\System\SEnuPoK.exe
  2⤵
  PID:3428
- C:\Windows\System\vjIEffo.exe
  C:\Windows\System\vjIEffo.exe
  2⤵
  PID:3460
- C:\Windows\System\kuNGtUP.exe
  C:\Windows\System\kuNGtUP.exe
  2⤵
  PID:3492
- C:\Windows\System\Bfoalsm.exe
  C:\Windows\System\Bfoalsm.exe
  2⤵
  PID:3524
- C:\Windows\System\VkiSfRo.exe
  C:\Windows\System\VkiSfRo.exe
  2⤵
  PID:3556
- C:\Windows\System\WhvrbBT.exe
  C:\Windows\System\WhvrbBT.exe
  2⤵
  PID:3588
- C:\Windows\System\GwgZZxP.exe
  C:\Windows\System\GwgZZxP.exe
  2⤵
  PID:3620
- C:\Windows\System\KlZNIpQ.exe
  C:\Windows\System\KlZNIpQ.exe
  2⤵
  PID:3652
- C:\Windows\System\OJPlsco.exe
  C:\Windows\System\OJPlsco.exe
  2⤵
  PID:3684
- C:\Windows\System\UrxJoSk.exe
  C:\Windows\System\UrxJoSk.exe
  2⤵
  PID:3716
- C:\Windows\System\ZiczUvg.exe
  C:\Windows\System\ZiczUvg.exe
  2⤵
  PID:3748
- C:\Windows\System\nesEItT.exe
  C:\Windows\System\nesEItT.exe
  2⤵
  PID:3780
- C:\Windows\System\uPkVDGe.exe
  C:\Windows\System\uPkVDGe.exe
  2⤵
  PID:3812
- C:\Windows\System\tohTjib.exe
  C:\Windows\System\tohTjib.exe
  2⤵
  PID:3844
- C:\Windows\System\hcGCYSA.exe
  C:\Windows\System\hcGCYSA.exe
  2⤵
  PID:3876
- C:\Windows\System\jjkgjnh.exe
  C:\Windows\System\jjkgjnh.exe
  2⤵
  PID:3908
- C:\Windows\System\xtbwbti.exe
  C:\Windows\System\xtbwbti.exe
  2⤵
  PID:3940
- C:\Windows\System\VQKqcRy.exe
  C:\Windows\System\VQKqcRy.exe
  2⤵
  PID:3972
- C:\Windows\System\gvOTKTl.exe
  C:\Windows\System\gvOTKTl.exe
  2⤵
  PID:3992
- C:\Windows\System\WECQUEO.exe
  C:\Windows\System\WECQUEO.exe
  2⤵
  PID:2228
- C:\Windows\System\ysmpHSs.exe
  C:\Windows\System\ysmpHSs.exe
  2⤵
  PID:4040
- C:\Windows\System\csLsKUP.exe
  C:\Windows\System\csLsKUP.exe
  2⤵
  PID:4072
- C:\Windows\System\JqvMoXr.exe
  C:\Windows\System\JqvMoXr.exe
  2⤵
  PID:2076
- C:\Windows\System\ofKjFie.exe
  C:\Windows\System\ofKjFie.exe
  2⤵
  PID:864
- C:\Windows\System\bbnYMvc.exe
  C:\Windows\System\bbnYMvc.exe
  2⤵
  PID:1304
- C:\Windows\System\Ptthshl.exe
  C:\Windows\System\Ptthshl.exe
  2⤵
  PID:772
- C:\Windows\System\XxrrBUR.exe
  C:\Windows\System\XxrrBUR.exe
  2⤵
  PID:1888
- C:\Windows\System\nJMAQbF.exe
  C:\Windows\System\nJMAQbF.exe
  2⤵
  PID:1524
- C:\Windows\System\QEilleb.exe
  C:\Windows\System\QEilleb.exe
  2⤵
  PID:1000
- C:\Windows\System\wrctERu.exe
  C:\Windows\System\wrctERu.exe
  2⤵
  PID:2128
- C:\Windows\System\lGSZzqI.exe
  C:\Windows\System\lGSZzqI.exe
  2⤵
  PID:3112
- C:\Windows\System\bAeTXfI.exe
  C:\Windows\System\bAeTXfI.exe
  2⤵
  PID:3176
- C:\Windows\System\ZaGUWRm.exe
  C:\Windows\System\ZaGUWRm.exe
  2⤵
  PID:3220
- C:\Windows\System\OEuGWml.exe
  C:\Windows\System\OEuGWml.exe
  2⤵
  PID:3256
- C:\Windows\System\BCcHRvA.exe
  C:\Windows\System\BCcHRvA.exe
  2⤵
  PID:1644
- C:\Windows\System\BUYMzIo.exe
  C:\Windows\System\BUYMzIo.exe
  2⤵
  PID:3352
- C:\Windows\System\avqsFJB.exe
  C:\Windows\System\avqsFJB.exe
  2⤵
  PID:3432
- C:\Windows\System\XveaDIB.exe
  C:\Windows\System\XveaDIB.exe
  2⤵
  PID:3480
- C:\Windows\System\oCYIgOi.exe
  C:\Windows\System\oCYIgOi.exe
  2⤵
  PID:2240
- C:\Windows\System\HzBEFiV.exe
  C:\Windows\System\HzBEFiV.exe
  2⤵
  PID:3592
- C:\Windows\System\TqHBUVu.exe
  C:\Windows\System\TqHBUVu.exe
  2⤵
  PID:3668
- C:\Windows\System\LPgGMNz.exe
  C:\Windows\System\LPgGMNz.exe
  2⤵
  PID:3720
- C:\Windows\System\EAsibaQ.exe
  C:\Windows\System\EAsibaQ.exe
  2⤵
  PID:3796
- C:\Windows\System\QKUgNZw.exe
  C:\Windows\System\QKUgNZw.exe
  2⤵
  PID:3848
- C:\Windows\System\QaUcLgB.exe
  C:\Windows\System\QaUcLgB.exe
  2⤵
  PID:3912
- C:\Windows\System\gowjKDs.exe
  C:\Windows\System\gowjKDs.exe
  2⤵
  PID:2356
- C:\Windows\System\OdBtZmb.exe
  C:\Windows\System\OdBtZmb.exe
  2⤵
  PID:4020
- C:\Windows\System\aPqbqSO.exe
  C:\Windows\System\aPqbqSO.exe
  2⤵
  PID:2712
- C:\Windows\System\UfPrgQu.exe
  C:\Windows\System\UfPrgQu.exe
  2⤵
  PID:1960
- C:\Windows\System\gkrmlLM.exe
  C:\Windows\System\gkrmlLM.exe
  2⤵
  PID:1700
- C:\Windows\System\AGhWWqG.exe
  C:\Windows\System\AGhWWqG.exe
  2⤵
  PID:1476
- C:\Windows\System\CmHXbmX.exe
  C:\Windows\System\CmHXbmX.exe
  2⤵
  PID:792
- C:\Windows\System\OnbUdpW.exe
  C:\Windows\System\OnbUdpW.exe
  2⤵
  PID:2572
- C:\Windows\System\lDlPWTk.exe
  C:\Windows\System\lDlPWTk.exe
  2⤵
  PID:2784
- C:\Windows\System\pmFpfjg.exe
  C:\Windows\System\pmFpfjg.exe
  2⤵
  PID:3192
- C:\Windows\System\WYUFkto.exe
  C:\Windows\System\WYUFkto.exe
  2⤵
  PID:3288
- C:\Windows\System\WbioPrT.exe
  C:\Windows\System\WbioPrT.exe
  2⤵
  PID:4108
- C:\Windows\System\zmDRXbu.exe
  C:\Windows\System\zmDRXbu.exe
  2⤵
  PID:4124
- C:\Windows\System\lgwNHUu.exe
  C:\Windows\System\lgwNHUu.exe
  2⤵
  PID:4140
- C:\Windows\System\rkorxqc.exe
  C:\Windows\System\rkorxqc.exe
  2⤵
  PID:4156
- C:\Windows\System\zPVybJw.exe
  C:\Windows\System\zPVybJw.exe
  2⤵
  PID:4172
- C:\Windows\System\FZmlPLa.exe
  C:\Windows\System\FZmlPLa.exe
  2⤵
  PID:4188
- C:\Windows\System\hImUpQi.exe
  C:\Windows\System\hImUpQi.exe
  2⤵
  PID:4204
- C:\Windows\System\VBQJHEt.exe
  C:\Windows\System\VBQJHEt.exe
  2⤵
  PID:4220
- C:\Windows\System\iOEtSOE.exe
  C:\Windows\System\iOEtSOE.exe
  2⤵
  PID:4236
- C:\Windows\System\CBXQKxy.exe
  C:\Windows\System\CBXQKxy.exe
  2⤵
  PID:4252
- C:\Windows\System\vgvaAtk.exe
  C:\Windows\System\vgvaAtk.exe
  2⤵
  PID:4268
- C:\Windows\System\gLbwpne.exe
  C:\Windows\System\gLbwpne.exe
  2⤵
  PID:4284
- C:\Windows\System\GGiFEKs.exe
  C:\Windows\System\GGiFEKs.exe
  2⤵
  PID:4300
- C:\Windows\System\RWehFQN.exe
  C:\Windows\System\RWehFQN.exe
  2⤵
  PID:4316
- C:\Windows\System\gvWBFrr.exe
  C:\Windows\System\gvWBFrr.exe
  2⤵
  PID:4332
- C:\Windows\System\pdFRQCJ.exe
  C:\Windows\System\pdFRQCJ.exe
  2⤵
  PID:4348
- C:\Windows\System\hvdlnyG.exe
  C:\Windows\System\hvdlnyG.exe
  2⤵
  PID:4364
- C:\Windows\System\MPiHGOo.exe
  C:\Windows\System\MPiHGOo.exe
  2⤵
  PID:4380
- C:\Windows\System\LbRGvfL.exe
  C:\Windows\System\LbRGvfL.exe
  2⤵
  PID:4396
- C:\Windows\System\KDRoSmg.exe
  C:\Windows\System\KDRoSmg.exe
  2⤵
  PID:4412
- C:\Windows\System\magItoJ.exe
  C:\Windows\System\magItoJ.exe
  2⤵
  PID:4428
- C:\Windows\System\IXOEjbn.exe
  C:\Windows\System\IXOEjbn.exe
  2⤵
  PID:4444
- C:\Windows\System\tkDUXAb.exe
  C:\Windows\System\tkDUXAb.exe
  2⤵
  PID:4460
- C:\Windows\System\GLAPYQx.exe
  C:\Windows\System\GLAPYQx.exe
  2⤵
  PID:4476
- C:\Windows\System\tjUqVQz.exe
  C:\Windows\System\tjUqVQz.exe
  2⤵
  PID:4492
- C:\Windows\System\ueQCcot.exe
  C:\Windows\System\ueQCcot.exe
  2⤵
  PID:4508
- C:\Windows\System\jKgYfWp.exe
  C:\Windows\System\jKgYfWp.exe
  2⤵
  PID:4524
- C:\Windows\System\ONniUFv.exe
  C:\Windows\System\ONniUFv.exe
  2⤵
  PID:4540
- C:\Windows\System\iDmsuwD.exe
  C:\Windows\System\iDmsuwD.exe
  2⤵
  PID:4556
- C:\Windows\System\sonvgWC.exe
  C:\Windows\System\sonvgWC.exe
  2⤵
  PID:4572
- C:\Windows\System\tDgZtfo.exe
  C:\Windows\System\tDgZtfo.exe
  2⤵
  PID:4588
- C:\Windows\System\LolvnhF.exe
  C:\Windows\System\LolvnhF.exe
  2⤵
  PID:4604
- C:\Windows\System\nWitjKq.exe
  C:\Windows\System\nWitjKq.exe
  2⤵
  PID:4620
- C:\Windows\System\fCKLMHz.exe
  C:\Windows\System\fCKLMHz.exe
  2⤵
  PID:4636
- C:\Windows\System\cuPmVFb.exe
  C:\Windows\System\cuPmVFb.exe
  2⤵
  PID:4652
- C:\Windows\System\aqigIgt.exe
  C:\Windows\System\aqigIgt.exe
  2⤵
  PID:4668
- C:\Windows\System\wVuSdjt.exe
  C:\Windows\System\wVuSdjt.exe
  2⤵
  PID:4684
- C:\Windows\System\iKhQRFo.exe
  C:\Windows\System\iKhQRFo.exe
  2⤵
  PID:4700
- C:\Windows\System\NmRzShj.exe
  C:\Windows\System\NmRzShj.exe
  2⤵
  PID:4716
- C:\Windows\System\YUYGiBG.exe
  C:\Windows\System\YUYGiBG.exe
  2⤵
  PID:4736
- C:\Windows\System\bqWsPKU.exe
  C:\Windows\System\bqWsPKU.exe
  2⤵
  PID:4764
- C:\Windows\System\vxBwJIL.exe
  C:\Windows\System\vxBwJIL.exe
  2⤵
  PID:4780
- C:\Windows\System\pdzvmuU.exe
  C:\Windows\System\pdzvmuU.exe
  2⤵
  PID:4804
- C:\Windows\System\NTdJUVq.exe
  C:\Windows\System\NTdJUVq.exe
  2⤵
  PID:4820
- C:\Windows\System\YJYaEDQ.exe
  C:\Windows\System\YJYaEDQ.exe
  2⤵
  PID:4844
- C:\Windows\System\UiDcAym.exe
  C:\Windows\System\UiDcAym.exe
  2⤵
  PID:4860
- C:\Windows\System\YDgcnOG.exe
  C:\Windows\System\YDgcnOG.exe
  2⤵
  PID:4876
- C:\Windows\System\nwdjDFI.exe
  C:\Windows\System\nwdjDFI.exe
  2⤵
  PID:4892
- C:\Windows\System\ygiIsgq.exe
  C:\Windows\System\ygiIsgq.exe
  2⤵
  PID:4916
- C:\Windows\System\JHXDALt.exe
  C:\Windows\System\JHXDALt.exe
  2⤵
  PID:4932
- C:\Windows\System\VYJnuyR.exe
  C:\Windows\System\VYJnuyR.exe
  2⤵
  PID:4948
- C:\Windows\System\FcMpqEB.exe
  C:\Windows\System\FcMpqEB.exe
  2⤵
  PID:4964
- C:\Windows\System\nkERNqg.exe
  C:\Windows\System\nkERNqg.exe
  2⤵
  PID:4980
- C:\Windows\System\bHGSPFm.exe
  C:\Windows\System\bHGSPFm.exe
  2⤵
  PID:4996
- C:\Windows\System\CprRBho.exe
  C:\Windows\System\CprRBho.exe
  2⤵
  PID:5012
- C:\Windows\System\lhNIcTy.exe
  C:\Windows\System\lhNIcTy.exe
  2⤵
  PID:5028
- C:\Windows\System\bYzmBlT.exe
  C:\Windows\System\bYzmBlT.exe
  2⤵
  PID:5044
- C:\Windows\System\YdxTMmA.exe
  C:\Windows\System\YdxTMmA.exe
  2⤵
  PID:5060
- C:\Windows\System\wPJCtHE.exe
  C:\Windows\System\wPJCtHE.exe
  2⤵
  PID:5076
- C:\Windows\System\yTQsoMJ.exe
  C:\Windows\System\yTQsoMJ.exe
  2⤵
  PID:5092
- C:\Windows\System\PapXeVv.exe
  C:\Windows\System\PapXeVv.exe
  2⤵
  PID:5108
- C:\Windows\System\jQNCkzq.exe
  C:\Windows\System\jQNCkzq.exe
  2⤵
  PID:3400
- C:\Windows\System\ztMubVM.exe
  C:\Windows\System\ztMubVM.exe
  2⤵
  PID:3512
- C:\Windows\System\aeFpUCS.exe
  C:\Windows\System\aeFpUCS.exe
  2⤵
  PID:3576
- C:\Windows\System\FaSrnUf.exe
  C:\Windows\System\FaSrnUf.exe
  2⤵
  PID:3704
- C:\Windows\System\YEOnxru.exe
  C:\Windows\System\YEOnxru.exe
  2⤵
  PID:3832
- C:\Windows\System\cIYxgZA.exe
  C:\Windows\System\cIYxgZA.exe
  2⤵
  PID:2316
- C:\Windows\System\wKoLRyY.exe
  C:\Windows\System\wKoLRyY.exe
  2⤵
  PID:2216
- C:\Windows\System\bPRMQxj.exe
  C:\Windows\System\bPRMQxj.exe
  2⤵
  PID:2012
- C:\Windows\System\gbEaSAR.exe
  C:\Windows\System\gbEaSAR.exe
  2⤵
  PID:2308
- C:\Windows\System\uhlsRgS.exe
  C:\Windows\System\uhlsRgS.exe
  2⤵
  PID:3020
- C:\Windows\System\WsKGtin.exe
  C:\Windows\System\WsKGtin.exe
  2⤵
  PID:2800
- C:\Windows\System\ypaxPiu.exe
  C:\Windows\System\ypaxPiu.exe
  2⤵
  PID:2464
- C:\Windows\System\PIFfsiN.exe
  C:\Windows\System\PIFfsiN.exe
  2⤵
  PID:2628
- C:\Windows\System\UQsBkiv.exe
  C:\Windows\System\UQsBkiv.exe
  2⤵
  PID:4148
- C:\Windows\System\fGwHQxO.exe
  C:\Windows\System\fGwHQxO.exe
  2⤵
  PID:4164
- C:\Windows\System\ghRmNxh.exe
  C:\Windows\System\ghRmNxh.exe
  2⤵
  PID:4184
- C:\Windows\System\QABkapb.exe
  C:\Windows\System\QABkapb.exe
  2⤵
  PID:2764
- C:\Windows\System\fSOFPyv.exe
  C:\Windows\System\fSOFPyv.exe
  2⤵
  PID:4232
- C:\Windows\System\SOPLVSC.exe
  C:\Windows\System\SOPLVSC.exe
  2⤵
  PID:4260
- C:\Windows\System\nlsKwCw.exe
  C:\Windows\System\nlsKwCw.exe
  2⤵
  PID:2560
- C:\Windows\System\DUuzciI.exe
  C:\Windows\System\DUuzciI.exe
  2⤵
  PID:4296
- C:\Windows\System\LGhorDc.exe
  C:\Windows\System\LGhorDc.exe
  2⤵
  PID:4328
- C:\Windows\System\NjMKyMl.exe
  C:\Windows\System\NjMKyMl.exe
  2⤵
  PID:4360
- C:\Windows\System\ErzLHtl.exe
  C:\Windows\System\ErzLHtl.exe
  2⤵
  PID:4404
- C:\Windows\System\oalmtmO.exe
  C:\Windows\System\oalmtmO.exe
  2⤵
  PID:2584
- C:\Windows\System\hfKPMQp.exe
  C:\Windows\System\hfKPMQp.exe
  2⤵
  PID:4424
- C:\Windows\System\rJWZmsm.exe
  C:\Windows\System\rJWZmsm.exe
  2⤵
  PID:4452
- C:\Windows\System\pxfhQkT.exe
  C:\Windows\System\pxfhQkT.exe
  2⤵
  PID:4500
- C:\Windows\System\qVZpLWx.exe
  C:\Windows\System\qVZpLWx.exe
  2⤵
  PID:1932
- C:\Windows\System\XkUscgl.exe
  C:\Windows\System\XkUscgl.exe
  2⤵
  PID:4520
- C:\Windows\System\GxCRWfG.exe
  C:\Windows\System\GxCRWfG.exe
  2⤵
  PID:4564
- C:\Windows\System\MgVKBCe.exe
  C:\Windows\System\MgVKBCe.exe
  2⤵
  PID:4568
- C:\Windows\System\dvBPZZg.exe
  C:\Windows\System\dvBPZZg.exe
  2⤵
  PID:4580
- C:\Windows\System\OEBTYZw.exe
  C:\Windows\System\OEBTYZw.exe
  2⤵
  PID:4632
- C:\Windows\System\HIPHVUR.exe
  C:\Windows\System\HIPHVUR.exe
  2⤵
  PID:4660
- C:\Windows\System\qMLKHDs.exe
  C:\Windows\System\qMLKHDs.exe
  2⤵
  PID:1100
- C:\Windows\System\ZECBwll.exe
  C:\Windows\System\ZECBwll.exe
  2⤵
  PID:1288
- C:\Windows\System\SNyreeV.exe
  C:\Windows\System\SNyreeV.exe
  2⤵
  PID:4696
- C:\Windows\System\JqFMGLt.exe
  C:\Windows\System\JqFMGLt.exe
  2⤵
  PID:4776
- C:\Windows\System\nwSqSIc.exe
  C:\Windows\System\nwSqSIc.exe
  2⤵
  PID:4816
- C:\Windows\System\NkPwxzV.exe
  C:\Windows\System\NkPwxzV.exe
  2⤵
  PID:4708
- C:\Windows\System\mLJxSec.exe
  C:\Windows\System\mLJxSec.exe
  2⤵
  PID:2932
- C:\Windows\System\wbtUxTE.exe
  C:\Windows\System\wbtUxTE.exe
  2⤵
  PID:4756
- C:\Windows\System\tuiQTMV.exe
  C:\Windows\System\tuiQTMV.exe
  2⤵
  PID:4796
- C:\Windows\System\LiTIwlj.exe
  C:\Windows\System\LiTIwlj.exe
  2⤵
  PID:4852
- C:\Windows\System\fZqFApZ.exe
  C:\Windows\System\fZqFApZ.exe
  2⤵
  PID:4924
- C:\Windows\System\wTWSsfr.exe
  C:\Windows\System\wTWSsfr.exe
  2⤵
  PID:4680
- C:\Windows\System\vdIqvJz.exe
  C:\Windows\System\vdIqvJz.exe
  2⤵
  PID:4944
- C:\Windows\System\NuFHDtv.exe
  C:\Windows\System\NuFHDtv.exe
  2⤵
  PID:4976
- C:\Windows\System\IkOJpIR.exe
  C:\Windows\System\IkOJpIR.exe
  2⤵
  PID:5004
- C:\Windows\System\RrZdJbM.exe
  C:\Windows\System\RrZdJbM.exe
  2⤵
  PID:5100
- C:\Windows\System\pSGkagF.exe
  C:\Windows\System\pSGkagF.exe
  2⤵
  PID:3640
- C:\Windows\System\wJcXEBQ.exe
  C:\Windows\System\wJcXEBQ.exe
  2⤵
  PID:4956
- C:\Windows\System\MhdGqau.exe
  C:\Windows\System\MhdGqau.exe
  2⤵
  PID:4068
- C:\Windows\System\KmlmRNl.exe
  C:\Windows\System\KmlmRNl.exe
  2⤵
  PID:3336
- C:\Windows\System\wTGtqHt.exe
  C:\Windows\System\wTGtqHt.exe
  2⤵
  PID:5084
- C:\Windows\System\PeSubxP.exe
  C:\Windows\System\PeSubxP.exe
  2⤵
  PID:4244
- C:\Windows\System\CMayPRb.exe
  C:\Windows\System\CMayPRb.exe
  2⤵
  PID:4280
- C:\Windows\System\hqrvxEA.exe
  C:\Windows\System\hqrvxEA.exe
  2⤵
  PID:2824
- C:\Windows\System\hTAxjwr.exe
  C:\Windows\System\hTAxjwr.exe
  2⤵
  PID:4484
- C:\Windows\System\enxnscZ.exe
  C:\Windows\System\enxnscZ.exe
  2⤵
  PID:4600
- C:\Windows\System\FpbRQLs.exe
  C:\Windows\System\FpbRQLs.exe
  2⤵
  PID:4992
- C:\Windows\System\ijDFzTy.exe
  C:\Windows\System\ijDFzTy.exe
  2⤵
  PID:1168
- C:\Windows\System\ScJkLpV.exe
  C:\Windows\System\ScJkLpV.exe
  2⤵
  PID:4664
- C:\Windows\System\OJxSotM.exe
  C:\Windows\System\OJxSotM.exe
  2⤵
  PID:2792
- C:\Windows\System\CsIYFSY.exe
  C:\Windows\System\CsIYFSY.exe
  2⤵
  PID:4788
- C:\Windows\System\QSxYQWt.exe
  C:\Windows\System\QSxYQWt.exe
  2⤵
  PID:4868
- C:\Windows\System\BhCncJW.exe
  C:\Windows\System\BhCncJW.exe
  2⤵
  PID:3464
- C:\Windows\System\TzrojSj.exe
  C:\Windows\System\TzrojSj.exe
  2⤵
  PID:1032
- C:\Windows\System\lCaccKm.exe
  C:\Windows\System\lCaccKm.exe
  2⤵
  PID:4228
- C:\Windows\System\lAyUuPw.exe
  C:\Windows\System\lAyUuPw.exe
  2⤵
  PID:2860
- C:\Windows\System\chwOgOK.exe
  C:\Windows\System\chwOgOK.exe
  2⤵
  PID:2516
- C:\Windows\System\GsOgrng.exe
  C:\Windows\System\GsOgrng.exe
  2⤵
  PID:4180
- C:\Windows\System\itFNatV.exe
  C:\Windows\System\itFNatV.exe
  2⤵
  PID:4472
- C:\Windows\System\ANXkQsi.exe
  C:\Windows\System\ANXkQsi.exe
  2⤵
  PID:4644
- C:\Windows\System\PCONaXH.exe
  C:\Windows\System\PCONaXH.exe
  2⤵
  PID:2952
- C:\Windows\System\OVOszsh.exe
  C:\Windows\System\OVOszsh.exe
  2⤵
  PID:4356
- C:\Windows\System\DJNzXaH.exe
  C:\Windows\System\DJNzXaH.exe
  2⤵
  PID:3896
- C:\Windows\System\PlyilQR.exe
  C:\Windows\System\PlyilQR.exe
  2⤵
  PID:1880
- C:\Windows\System\RiXGWBv.exe
  C:\Windows\System\RiXGWBv.exe
  2⤵
  PID:2256
- C:\Windows\System\HIyDgHT.exe
  C:\Windows\System\HIyDgHT.exe
  2⤵
  PID:824
- C:\Windows\System\NVqTEyN.exe
  C:\Windows\System\NVqTEyN.exe
  2⤵
  PID:4900
- C:\Windows\System\FCtohWt.exe
  C:\Windows\System\FCtohWt.exe
  2⤵
  PID:2900
- C:\Windows\System\iugcjjl.exe
  C:\Windows\System\iugcjjl.exe
  2⤵
  PID:4712
- C:\Windows\System\kzGHiVG.exe
  C:\Windows\System\kzGHiVG.exe
  2⤵
  PID:4436
- C:\Windows\System\liEIvii.exe
  C:\Windows\System\liEIvii.exe
  2⤵
  PID:4152
- C:\Windows\System\wvQHnMt.exe
  C:\Windows\System\wvQHnMt.exe
  2⤵
  PID:3544
- C:\Windows\System\MFlHEWS.exe
  C:\Windows\System\MFlHEWS.exe
  2⤵
  PID:1848
- C:\Windows\System\gcJwtqk.exe
  C:\Windows\System\gcJwtqk.exe
  2⤵
  PID:2624
- C:\Windows\System\AOqKfRm.exe
  C:\Windows\System\AOqKfRm.exe
  2⤵
  PID:4104
- C:\Windows\System\OccyzFY.exe
  C:\Windows\System\OccyzFY.exe
  2⤵
  PID:4908
- C:\Windows\System\RDGNOJj.exe
  C:\Windows\System\RDGNOJj.exe
  2⤵
  PID:4928
- C:\Windows\System\LvNezUC.exe
  C:\Windows\System\LvNezUC.exe
  2⤵
  PID:672
- C:\Windows\System\aWQCNaz.exe
  C:\Windows\System\aWQCNaz.exe
  2⤵
  PID:5072
- C:\Windows\System\ftZpjkR.exe
  C:\Windows\System\ftZpjkR.exe
  2⤵
  PID:4676
- C:\Windows\System\USDLgrz.exe
  C:\Windows\System\USDLgrz.exe
  2⤵
  PID:4008
- C:\Windows\System\OmAzguF.exe
  C:\Windows\System\OmAzguF.exe
  2⤵
  PID:4248
- C:\Windows\System\XxImZIo.exe
  C:\Windows\System\XxImZIo.exe
  2⤵
  PID:4616
- C:\Windows\System\iINYceG.exe
  C:\Windows\System\iINYceG.exe
  2⤵
  PID:4888
- C:\Windows\System\afsoqml.exe
  C:\Windows\System\afsoqml.exe
  2⤵
  PID:4772
- C:\Windows\System\uUFYcCd.exe
  C:\Windows\System\uUFYcCd.exe
  2⤵
  PID:5124
- C:\Windows\System\zKUrPys.exe
  C:\Windows\System\zKUrPys.exe
  2⤵
  PID:5140
- C:\Windows\System\ktFlPXI.exe
  C:\Windows\System\ktFlPXI.exe
  2⤵
  PID:5156
- C:\Windows\System\rhkUfcB.exe
  C:\Windows\System\rhkUfcB.exe
  2⤵
  PID:5172
- C:\Windows\System\gxikDLd.exe
  C:\Windows\System\gxikDLd.exe
  2⤵
  PID:5188
- C:\Windows\System\rqKIlJN.exe
  C:\Windows\System\rqKIlJN.exe
  2⤵
  PID:5204
- C:\Windows\System\ymiEbUU.exe
  C:\Windows\System\ymiEbUU.exe
  2⤵
  PID:5220
- C:\Windows\System\PFkluBm.exe
  C:\Windows\System\PFkluBm.exe
  2⤵
  PID:5236
- C:\Windows\System\JagLjCD.exe
  C:\Windows\System\JagLjCD.exe
  2⤵
  PID:5252
- C:\Windows\System\zMIOtXg.exe
  C:\Windows\System\zMIOtXg.exe
  2⤵
  PID:5268
- C:\Windows\System\cepkefA.exe
  C:\Windows\System\cepkefA.exe
  2⤵
  PID:5284
- C:\Windows\System\tvcFOmo.exe
  C:\Windows\System\tvcFOmo.exe
  2⤵
  PID:5300
- C:\Windows\System\GIUOxfb.exe
  C:\Windows\System\GIUOxfb.exe
  2⤵
  PID:5316
- C:\Windows\System\VZhXhsT.exe
  C:\Windows\System\VZhXhsT.exe
  2⤵
  PID:5332
- C:\Windows\System\ezMtcRS.exe
  C:\Windows\System\ezMtcRS.exe
  2⤵
  PID:5348
- C:\Windows\System\sjKMeOH.exe
  C:\Windows\System\sjKMeOH.exe
  2⤵
  PID:5364
- C:\Windows\System\HFNmoKw.exe
  C:\Windows\System\HFNmoKw.exe
  2⤵
  PID:5380
- C:\Windows\System\BlcfyRt.exe
  C:\Windows\System\BlcfyRt.exe
  2⤵
  PID:5396
- C:\Windows\System\bowNOsR.exe
  C:\Windows\System\bowNOsR.exe
  2⤵
  PID:5412
- C:\Windows\System\TETXgke.exe
  C:\Windows\System\TETXgke.exe
  2⤵
  PID:5428
- C:\Windows\System\CZufYir.exe
  C:\Windows\System\CZufYir.exe
  2⤵
  PID:5444
- C:\Windows\System\FDnLTPO.exe
  C:\Windows\System\FDnLTPO.exe
  2⤵
  PID:5460
- C:\Windows\System\XwIpvwz.exe
  C:\Windows\System\XwIpvwz.exe
  2⤵
  PID:5476
- C:\Windows\System\fbaNAcq.exe
  C:\Windows\System\fbaNAcq.exe
  2⤵
  PID:5492
- C:\Windows\System\vvZlUuz.exe
  C:\Windows\System\vvZlUuz.exe
  2⤵
  PID:5508
- C:\Windows\System\BEFTIjw.exe
  C:\Windows\System\BEFTIjw.exe
  2⤵
  PID:5524
- C:\Windows\System\nzDLFQy.exe
  C:\Windows\System\nzDLFQy.exe
  2⤵
  PID:5540
- C:\Windows\System\PPJHMok.exe
  C:\Windows\System\PPJHMok.exe
  2⤵
  PID:5556
- C:\Windows\System\FqjzeFo.exe
  C:\Windows\System\FqjzeFo.exe
  2⤵
  PID:5572
- C:\Windows\System\sedrZAb.exe
  C:\Windows\System\sedrZAb.exe
  2⤵
  PID:5588
- C:\Windows\System\cPLFhmN.exe
  C:\Windows\System\cPLFhmN.exe
  2⤵
  PID:5604
- C:\Windows\System\ibhTwlc.exe
  C:\Windows\System\ibhTwlc.exe
  2⤵
  PID:5620
- C:\Windows\System\FkoLxdO.exe
  C:\Windows\System\FkoLxdO.exe
  2⤵
  PID:5636
- C:\Windows\System\RSAZRqW.exe
  C:\Windows\System\RSAZRqW.exe
  2⤵
  PID:5652
- C:\Windows\System\CmIZlGS.exe
  C:\Windows\System\CmIZlGS.exe
  2⤵
  PID:5668
- C:\Windows\System\ksOyxVb.exe
  C:\Windows\System\ksOyxVb.exe
  2⤵
  PID:5684
- C:\Windows\System\xeOnKoV.exe
  C:\Windows\System\xeOnKoV.exe
  2⤵
  PID:5700
- C:\Windows\System\vwzDmtk.exe
  C:\Windows\System\vwzDmtk.exe
  2⤵
  PID:5716
- C:\Windows\System\ZHLGrtC.exe
  C:\Windows\System\ZHLGrtC.exe
  2⤵
  PID:5732
- C:\Windows\System\PciabSG.exe
  C:\Windows\System\PciabSG.exe
  2⤵
  PID:5748
- C:\Windows\System\rbDFuEy.exe
  C:\Windows\System\rbDFuEy.exe
  2⤵
  PID:5764
- C:\Windows\System\MYUPPCE.exe
  C:\Windows\System\MYUPPCE.exe
  2⤵
  PID:5780
- C:\Windows\System\yUBzQoj.exe
  C:\Windows\System\yUBzQoj.exe
  2⤵
  PID:5796
- C:\Windows\System\rYYcTYW.exe
  C:\Windows\System\rYYcTYW.exe
  2⤵
  PID:5812
- C:\Windows\System\KxYqljm.exe
  C:\Windows\System\KxYqljm.exe
  2⤵
  PID:5828
- C:\Windows\System\IrIVfNX.exe
  C:\Windows\System\IrIVfNX.exe
  2⤵
  PID:5844
- C:\Windows\System\bvpwaaW.exe
  C:\Windows\System\bvpwaaW.exe
  2⤵
  PID:5860
- C:\Windows\System\CXxLIyh.exe
  C:\Windows\System\CXxLIyh.exe
  2⤵
  PID:5876
- C:\Windows\System\jnwkAQY.exe
  C:\Windows\System\jnwkAQY.exe
  2⤵
  PID:5892
- C:\Windows\System\dUPzWpe.exe
  C:\Windows\System\dUPzWpe.exe
  2⤵
  PID:5908
- C:\Windows\System\nSxmTlY.exe
  C:\Windows\System\nSxmTlY.exe
  2⤵
  PID:5924
- C:\Windows\System\yNCbKzx.exe
  C:\Windows\System\yNCbKzx.exe
  2⤵
  PID:5940
- C:\Windows\System\vfFrEcC.exe
  C:\Windows\System\vfFrEcC.exe
  2⤵
  PID:5956
- C:\Windows\System\oRmFwwy.exe
  C:\Windows\System\oRmFwwy.exe
  2⤵
  PID:5972
- C:\Windows\System\IlBFdVE.exe
  C:\Windows\System\IlBFdVE.exe
  2⤵
  PID:5988
- C:\Windows\System\WkvJxNZ.exe
  C:\Windows\System\WkvJxNZ.exe
  2⤵
  PID:6004
- C:\Windows\System\HlQujuN.exe
  C:\Windows\System\HlQujuN.exe
  2⤵
  PID:6020
- C:\Windows\System\CvEbbED.exe
  C:\Windows\System\CvEbbED.exe
  2⤵
  PID:6036
- C:\Windows\System\PRJJVVr.exe
  C:\Windows\System\PRJJVVr.exe
  2⤵
  PID:6052
- C:\Windows\System\OycuHsM.exe
  C:\Windows\System\OycuHsM.exe
  2⤵
  PID:6068
- C:\Windows\System\nMxkhcN.exe
  C:\Windows\System\nMxkhcN.exe
  2⤵
  PID:6084
- C:\Windows\System\XFkFBpq.exe
  C:\Windows\System\XFkFBpq.exe
  2⤵
  PID:6104
- C:\Windows\System\frVpbDQ.exe
  C:\Windows\System\frVpbDQ.exe
  2⤵
  PID:6120
- C:\Windows\System\rNjfGOM.exe
  C:\Windows\System\rNjfGOM.exe
  2⤵
  PID:6136
- C:\Windows\System\EKkrErG.exe
  C:\Windows\System\EKkrErG.exe
  2⤵
  PID:5164
- C:\Windows\System\JsWhjyZ.exe
  C:\Windows\System\JsWhjyZ.exe
  2⤵
  PID:2588
- C:\Windows\System\zdHbtNm.exe
  C:\Windows\System\zdHbtNm.exe
  2⤵
  PID:4340
- C:\Windows\System\ivGGkTe.exe
  C:\Windows\System\ivGGkTe.exe
  2⤵
  PID:5148
- C:\Windows\System\OayJnhl.exe
  C:\Windows\System\OayJnhl.exe
  2⤵
  PID:5024
- C:\Windows\System\sGMMGNh.exe
  C:\Windows\System\sGMMGNh.exe
  2⤵
  PID:5196
- C:\Windows\System\GsBfWxA.exe
  C:\Windows\System\GsBfWxA.exe
  2⤵
  PID:5260
- C:\Windows\System\mRHCSaJ.exe
  C:\Windows\System\mRHCSaJ.exe
  2⤵
  PID:5324
- C:\Windows\System\ZHQdSXl.exe
  C:\Windows\System\ZHQdSXl.exe
  2⤵
  PID:5340
- C:\Windows\System\tARCbcb.exe
  C:\Windows\System\tARCbcb.exe
  2⤵
  PID:5376
- C:\Windows\System\vAMKqsL.exe
  C:\Windows\System\vAMKqsL.exe
  2⤵
  PID:5248
- C:\Windows\System\FODjZbi.exe
  C:\Windows\System\FODjZbi.exe
  2⤵
  PID:5452
- C:\Windows\System\TbVyMBq.exe
  C:\Windows\System\TbVyMBq.exe
  2⤵
  PID:5484
- C:\Windows\System\utpBiRs.exe
  C:\Windows\System\utpBiRs.exe
  2⤵
  PID:5548
- C:\Windows\System\cNXkbPR.exe
  C:\Windows\System\cNXkbPR.exe
  2⤵
  PID:5612
- C:\Windows\System\rUcNRSB.exe
  C:\Windows\System\rUcNRSB.exe
  2⤵
  PID:5436
- C:\Windows\System\veaXRfp.exe
  C:\Windows\System\veaXRfp.exe
  2⤵
  PID:5500
- C:\Windows\System\ohyTFsF.exe
  C:\Windows\System\ohyTFsF.exe
  2⤵
  PID:5568
- C:\Windows\System\cRzrVAE.exe
  C:\Windows\System\cRzrVAE.exe
  2⤵
  PID:5644
- C:\Windows\System\kXkUOIh.exe
  C:\Windows\System\kXkUOIh.exe
  2⤵
  PID:5708
- C:\Windows\System\mHjgsdC.exe
  C:\Windows\System\mHjgsdC.exe
  2⤵
  PID:5744
- C:\Windows\System\lRkNqvI.exe
  C:\Windows\System\lRkNqvI.exe
  2⤵
  PID:5808
- C:\Windows\System\owBNJwb.exe
  C:\Windows\System\owBNJwb.exe
  2⤵
  PID:5872
- C:\Windows\System\OqBRHDI.exe
  C:\Windows\System\OqBRHDI.exe
  2⤵
  PID:5936
- C:\Windows\System\GBojYjO.exe
  C:\Windows\System\GBojYjO.exe
  2⤵
  PID:6000
- C:\Windows\System\bGRzbWK.exe
  C:\Windows\System\bGRzbWK.exe
  2⤵
  PID:5724
- C:\Windows\System\AeUuobi.exe
  C:\Windows\System\AeUuobi.exe
  2⤵
  PID:5660
- C:\Windows\System\CDXqJPM.exe
  C:\Windows\System\CDXqJPM.exe
  2⤵
  PID:5884
- C:\Windows\System\EOSAiuk.exe
  C:\Windows\System\EOSAiuk.exe
  2⤵
  PID:6044
- C:\Windows\System\rgsnIHl.exe
  C:\Windows\System\rgsnIHl.exe
  2⤵
  PID:5856
- C:\Windows\System\iuZAFSp.exe
  C:\Windows\System\iuZAFSp.exe
  2⤵
  PID:5948
- C:\Windows\System\GdscWOF.exe
  C:\Windows\System\GdscWOF.exe
  2⤵
  PID:6012
- C:\Windows\System\sWUlfcR.exe
  C:\Windows\System\sWUlfcR.exe
  2⤵
  PID:6080
- C:\Windows\System\bHllmuT.exe
  C:\Windows\System\bHllmuT.exe
  2⤵
  PID:6132
- C:\Windows\System\YnQDvLH.exe
  C:\Windows\System\YnQDvLH.exe
  2⤵
  PID:5180
- C:\Windows\System\iCQIydF.exe
  C:\Windows\System\iCQIydF.exe
  2⤵
  PID:5292
- C:\Windows\System\kruXbOe.exe
  C:\Windows\System\kruXbOe.exe
  2⤵
  PID:5392
- C:\Windows\System\BrqRQGl.exe
  C:\Windows\System\BrqRQGl.exe
  2⤵
  PID:5532
- C:\Windows\System\NPWqCan.exe
  C:\Windows\System\NPWqCan.exe
  2⤵
  PID:5536
- C:\Windows\System\sJYQeqd.exe
  C:\Windows\System\sJYQeqd.exe
  2⤵
  PID:5904
- C:\Windows\System\KjKENll.exe
  C:\Windows\System\KjKENll.exe
  2⤵
  PID:5228
- C:\Windows\System\XNfOKSm.exe
  C:\Windows\System\XNfOKSm.exe
  2⤵
  PID:5580
- C:\Windows\System\aXyvNKM.exe
  C:\Windows\System\aXyvNKM.exe
  2⤵
  PID:5136
- C:\Windows\System\colxEuz.exe
  C:\Windows\System\colxEuz.exe
  2⤵
  PID:5840
- C:\Windows\System\tlrfPph.exe
  C:\Windows\System\tlrfPph.exe
  2⤵
  PID:5308
- C:\Windows\System\fZmjYxH.exe
  C:\Windows\System\fZmjYxH.exe
  2⤵
  PID:5696
- C:\Windows\System\bJBOKmX.exe
  C:\Windows\System\bJBOKmX.exe
  2⤵
  PID:5424
- C:\Windows\System\tIsScew.exe
  C:\Windows\System\tIsScew.exe
  2⤵
  PID:5600
- C:\Windows\System\gdGZqyM.exe
  C:\Windows\System\gdGZqyM.exe
  2⤵
  PID:5868
- C:\Windows\System\vUJRysm.exe
  C:\Windows\System\vUJRysm.exe
  2⤵
  PID:5760
- C:\Windows\System\XNvdOAf.exe
  C:\Windows\System\XNvdOAf.exe
  2⤵
  PID:5984
- C:\Windows\System\WmetMHI.exe
  C:\Windows\System\WmetMHI.exe
  2⤵
  PID:5516
- C:\Windows\System\jUjvcYr.exe
  C:\Windows\System\jUjvcYr.exe
  2⤵
  PID:5776
- C:\Windows\System\ZHkSMkS.exe
  C:\Windows\System\ZHkSMkS.exe
  2⤵
  PID:5804
- C:\Windows\System\ooUXjwt.exe
  C:\Windows\System\ooUXjwt.exe
  2⤵
  PID:5372
- C:\Windows\System\qBZKDib.exe
  C:\Windows\System\qBZKDib.exe
  2⤵
  PID:6112
- C:\Windows\System\MGrUHzR.exe
  C:\Windows\System\MGrUHzR.exe
  2⤵
  PID:5632
- C:\Windows\System\VtyjRmX.exe
  C:\Windows\System\VtyjRmX.exe
  2⤵
  PID:5472
- C:\Windows\System\kwfeqZs.exe
  C:\Windows\System\kwfeqZs.exe
  2⤵
  PID:6048
- C:\Windows\System\znkcasD.exe
  C:\Windows\System\znkcasD.exe
  2⤵
  PID:5564
- C:\Windows\System\EOmWAYw.exe
  C:\Windows\System\EOmWAYw.exe
  2⤵
  PID:5276
- C:\Windows\System\IZFACPY.exe
  C:\Windows\System\IZFACPY.exe
  2⤵
  PID:6156
- C:\Windows\System\vbhrxZQ.exe
  C:\Windows\System\vbhrxZQ.exe
  2⤵
  PID:6172
- C:\Windows\System\TeXKFkT.exe
  C:\Windows\System\TeXKFkT.exe
  2⤵
  PID:6188
- C:\Windows\System\hdVMNng.exe
  C:\Windows\System\hdVMNng.exe
  2⤵
  PID:6204
- C:\Windows\System\GMCbAOu.exe
  C:\Windows\System\GMCbAOu.exe
  2⤵
  PID:6220
- C:\Windows\System\TQFdicb.exe
  C:\Windows\System\TQFdicb.exe
  2⤵
  PID:6236
- C:\Windows\System\HTHtRyd.exe
  C:\Windows\System\HTHtRyd.exe
  2⤵
  PID:6252
- C:\Windows\System\FrHTpsb.exe
  C:\Windows\System\FrHTpsb.exe
  2⤵
  PID:6268
- C:\Windows\System\NNcpJvw.exe
  C:\Windows\System\NNcpJvw.exe
  2⤵
  PID:6284
- C:\Windows\System\AHsgVOy.exe
  C:\Windows\System\AHsgVOy.exe
  2⤵
  PID:6300
- C:\Windows\System\gbbQASk.exe
  C:\Windows\System\gbbQASk.exe
  2⤵
  PID:6316
- C:\Windows\System\wiDNdjw.exe
  C:\Windows\System\wiDNdjw.exe
  2⤵
  PID:6332
- C:\Windows\System\ulNERin.exe
  C:\Windows\System\ulNERin.exe
  2⤵
  PID:6348
- C:\Windows\System\LrJmgHi.exe
  C:\Windows\System\LrJmgHi.exe
  2⤵
  PID:6364
- C:\Windows\System\eXBnErt.exe
  C:\Windows\System\eXBnErt.exe
  2⤵
  PID:6380
- C:\Windows\System\kdPnuCs.exe
  C:\Windows\System\kdPnuCs.exe
  2⤵
  PID:6396
- C:\Windows\System\DxnYuMw.exe
  C:\Windows\System\DxnYuMw.exe
  2⤵
  PID:6412
- C:\Windows\System\ZAMqBcc.exe
  C:\Windows\System\ZAMqBcc.exe
  2⤵
  PID:6428
- C:\Windows\System\fMbWpPy.exe
  C:\Windows\System\fMbWpPy.exe
  2⤵
  PID:6444
- C:\Windows\System\ZQRCpvA.exe
  C:\Windows\System\ZQRCpvA.exe
  2⤵
  PID:6460
- C:\Windows\System\BYzidOS.exe
  C:\Windows\System\BYzidOS.exe
  2⤵
  PID:6476
- C:\Windows\System\CmsvCaF.exe
  C:\Windows\System\CmsvCaF.exe
  2⤵
  PID:6492
- C:\Windows\System\AfoXYFl.exe
  C:\Windows\System\AfoXYFl.exe
  2⤵
  PID:6508
- C:\Windows\System\ygaOCVI.exe
  C:\Windows\System\ygaOCVI.exe
  2⤵
  PID:6524
- C:\Windows\System\SLrwmIB.exe
  C:\Windows\System\SLrwmIB.exe
  2⤵
  PID:6540
- C:\Windows\System\fNUFPzw.exe
  C:\Windows\System\fNUFPzw.exe
  2⤵
  PID:6556
- C:\Windows\System\ApevgSO.exe
  C:\Windows\System\ApevgSO.exe
  2⤵
  PID:6572
- C:\Windows\System\ekBGstm.exe
  C:\Windows\System\ekBGstm.exe
  2⤵
  PID:6588
- C:\Windows\System\iRNqPqN.exe
  C:\Windows\System\iRNqPqN.exe
  2⤵
  PID:6604
- C:\Windows\System\cOWBink.exe
  C:\Windows\System\cOWBink.exe
  2⤵
  PID:6620
- C:\Windows\System\sptXjxh.exe
  C:\Windows\System\sptXjxh.exe
  2⤵
  PID:6636
- C:\Windows\System\vOeBkBn.exe
  C:\Windows\System\vOeBkBn.exe
  2⤵
  PID:6652
- C:\Windows\System\yWXbkkC.exe
  C:\Windows\System\yWXbkkC.exe
  2⤵
  PID:6668
- C:\Windows\System\uPvyuVY.exe
  C:\Windows\System\uPvyuVY.exe
  2⤵
  PID:6684
- C:\Windows\System\uqURipa.exe
  C:\Windows\System\uqURipa.exe
  2⤵
  PID:6700
- C:\Windows\System\iXfFmWa.exe
  C:\Windows\System\iXfFmWa.exe
  2⤵
  PID:6716
- C:\Windows\System\HKBDnFy.exe
  C:\Windows\System\HKBDnFy.exe
  2⤵
  PID:6732
- C:\Windows\System\hQFSTFg.exe
  C:\Windows\System\hQFSTFg.exe
  2⤵
  PID:6748
- C:\Windows\System\CogdbwF.exe
  C:\Windows\System\CogdbwF.exe
  2⤵
  PID:6764
- C:\Windows\System\fLsbuui.exe
  C:\Windows\System\fLsbuui.exe
  2⤵
  PID:6780
- C:\Windows\System\quWEkoW.exe
  C:\Windows\System\quWEkoW.exe
  2⤵
  PID:6796
- C:\Windows\System\yVMlBei.exe
  C:\Windows\System\yVMlBei.exe
  2⤵
  PID:6812
- C:\Windows\System\YZiOoQY.exe
  C:\Windows\System\YZiOoQY.exe
  2⤵
  PID:6828
- C:\Windows\System\HAVJYRg.exe
  C:\Windows\System\HAVJYRg.exe
  2⤵
  PID:6844
- C:\Windows\System\hXMkWVl.exe
  C:\Windows\System\hXMkWVl.exe
  2⤵
  PID:6860
- C:\Windows\System\mtrBUOg.exe
  C:\Windows\System\mtrBUOg.exe
  2⤵
  PID:6876
- C:\Windows\System\fOoNKJA.exe
  C:\Windows\System\fOoNKJA.exe
  2⤵
  PID:6892
- C:\Windows\System\IZnAUgW.exe
  C:\Windows\System\IZnAUgW.exe
  2⤵
  PID:6908
- C:\Windows\System\uPeifGj.exe
  C:\Windows\System\uPeifGj.exe
  2⤵
  PID:6924
- C:\Windows\System\MKMTfFN.exe
  C:\Windows\System\MKMTfFN.exe
  2⤵
  PID:6940
- C:\Windows\System\kELBxcO.exe
  C:\Windows\System\kELBxcO.exe
  2⤵
  PID:6956
- C:\Windows\System\AoLQdtB.exe
  C:\Windows\System\AoLQdtB.exe
  2⤵
  PID:6972
- C:\Windows\System\bFVdemQ.exe
  C:\Windows\System\bFVdemQ.exe
  2⤵
  PID:6988
- C:\Windows\System\aQWJuJY.exe
  C:\Windows\System\aQWJuJY.exe
  2⤵
  PID:7004
- C:\Windows\System\FNxSSvk.exe
  C:\Windows\System\FNxSSvk.exe
  2⤵
  PID:7020
- C:\Windows\System\DSGrfti.exe
  C:\Windows\System\DSGrfti.exe
  2⤵
  PID:7036
- C:\Windows\System\FRAfRSE.exe
  C:\Windows\System\FRAfRSE.exe
  2⤵
  PID:7052
- C:\Windows\System\RsvzJAO.exe
  C:\Windows\System\RsvzJAO.exe
  2⤵
  PID:7068
- C:\Windows\System\jRgPXYM.exe
  C:\Windows\System\jRgPXYM.exe
  2⤵
  PID:7084
- C:\Windows\System\QIcVXYp.exe
  C:\Windows\System\QIcVXYp.exe
  2⤵
  PID:7100
- C:\Windows\System\mhfZLHU.exe
  C:\Windows\System\mhfZLHU.exe
  2⤵
  PID:7116
- C:\Windows\System\NfhwtuU.exe
  C:\Windows\System\NfhwtuU.exe
  2⤵
  PID:7132
- C:\Windows\System\RKjwmtj.exe
  C:\Windows\System\RKjwmtj.exe
  2⤵
  PID:7148
- C:\Windows\System\ykUkimT.exe
  C:\Windows\System\ykUkimT.exe
  2⤵
  PID:7164
- C:\Windows\System\dwzdWbA.exe
  C:\Windows\System\dwzdWbA.exe
  2⤵
  PID:6184
- C:\Windows\System\UInNwGp.exe
  C:\Windows\System\UInNwGp.exe
  2⤵
  PID:6248
- C:\Windows\System\zzouezp.exe
  C:\Windows\System\zzouezp.exe
  2⤵
  PID:6312
- C:\Windows\System\YWCopDn.exe
  C:\Windows\System\YWCopDn.exe
  2⤵
  PID:6376
- C:\Windows\System\BCmCBdZ.exe
  C:\Windows\System\BCmCBdZ.exe
  2⤵
  PID:6440
- C:\Windows\System\XnREldL.exe
  C:\Windows\System\XnREldL.exe
  2⤵
  PID:6504
- C:\Windows\System\WZfoyZx.exe
  C:\Windows\System\WZfoyZx.exe
  2⤵
  PID:6600
- C:\Windows\System\cHRSlcM.exe
  C:\Windows\System\cHRSlcM.exe
  2⤵
  PID:6164
- C:\Windows\System\OgUOaqf.exe
  C:\Windows\System\OgUOaqf.exe
  2⤵
  PID:6664
- C:\Windows\System\JHCAQON.exe
  C:\Windows\System\JHCAQON.exe
  2⤵
  PID:6728
- C:\Windows\System\XaBHhGx.exe
  C:\Windows\System\XaBHhGx.exe
  2⤵
  PID:6792
- C:\Windows\System\oGZQQDE.exe
  C:\Windows\System\oGZQQDE.exe
  2⤵
  PID:6856
- C:\Windows\System\MYAlCPl.exe
  C:\Windows\System\MYAlCPl.exe
  2⤵
  PID:6920
- C:\Windows\System\PYDJxTg.exe
  C:\Windows\System\PYDJxTg.exe
  2⤵
  PID:7012
- C:\Windows\System\qxmWEDF.exe
  C:\Windows\System\qxmWEDF.exe
  2⤵
  PID:7108
- C:\Windows\System\VidQiEh.exe
  C:\Windows\System\VidQiEh.exe
  2⤵
  PID:6152
- C:\Windows\System\UABrIEs.exe
  C:\Windows\System\UABrIEs.exe
  2⤵
  PID:7048
- C:\Windows\System\AlwCYhl.exe
  C:\Windows\System\AlwCYhl.exe
  2⤵
  PID:6536
- C:\Windows\System\iQYcoiV.exe
  C:\Windows\System\iQYcoiV.exe
  2⤵
  PID:5852
- C:\Windows\System\FlXpCTL.exe
  C:\Windows\System\FlXpCTL.exe
  2⤵
  PID:6788
- C:\Windows\System\VsTotkE.exe
  C:\Windows\System\VsTotkE.exe
  2⤵
  PID:6916
- C:\Windows\System\QDSnhOS.exe
  C:\Windows\System\QDSnhOS.exe
  2⤵
  PID:6984
- C:\Windows\System\dFOtbUS.exe
  C:\Windows\System\dFOtbUS.exe
  2⤵
  PID:6060
- C:\Windows\System\OyRNBDZ.exe
  C:\Windows\System\OyRNBDZ.exe
  2⤵
  PID:4372
- C:\Windows\System\KQDDJHZ.exe
  C:\Windows\System\KQDDJHZ.exe
  2⤵
  PID:7184
- C:\Windows\System\kEDatuj.exe
  C:\Windows\System\kEDatuj.exe
  2⤵
  PID:7200
- C:\Windows\System\bzTkzsi.exe
  C:\Windows\System\bzTkzsi.exe
  2⤵
  PID:7216
- C:\Windows\System\phGBFRv.exe
  C:\Windows\System\phGBFRv.exe
  2⤵
  PID:7232
- C:\Windows\System\wBwkrVV.exe
  C:\Windows\System\wBwkrVV.exe
  2⤵
  PID:7248
- C:\Windows\System\tEpFyFW.exe
  C:\Windows\System\tEpFyFW.exe
  2⤵
  PID:7264
- C:\Windows\System\PlObEfc.exe
  C:\Windows\System\PlObEfc.exe
  2⤵
  PID:7280
- C:\Windows\System\zdnkIep.exe
  C:\Windows\System\zdnkIep.exe
  2⤵
  PID:7296
- C:\Windows\System\VbUXrXe.exe
  C:\Windows\System\VbUXrXe.exe
  2⤵
  PID:7312
- C:\Windows\System\UurLfvT.exe
  C:\Windows\System\UurLfvT.exe
  2⤵
  PID:7328
- C:\Windows\System\jPmwkhl.exe
  C:\Windows\System\jPmwkhl.exe
  2⤵
  PID:7344
- C:\Windows\System\aQZkwsU.exe
  C:\Windows\System\aQZkwsU.exe
  2⤵
  PID:7360
- C:\Windows\System\NWooEAN.exe
  C:\Windows\System\NWooEAN.exe
  2⤵
  PID:7376
- C:\Windows\System\rErptJA.exe
  C:\Windows\System\rErptJA.exe
  2⤵
  PID:7392
- C:\Windows\System\EgshBHh.exe
  C:\Windows\System\EgshBHh.exe
  2⤵
  PID:7408
- C:\Windows\System\mnvMzLd.exe
  C:\Windows\System\mnvMzLd.exe
  2⤵
  PID:7424
- C:\Windows\System\XFDvyVG.exe
  C:\Windows\System\XFDvyVG.exe
  2⤵
  PID:7440
- C:\Windows\System\tkxKMil.exe
  C:\Windows\System\tkxKMil.exe
  2⤵
  PID:7456
- C:\Windows\System\VBCpzot.exe
  C:\Windows\System\VBCpzot.exe
  2⤵
  PID:7472
- C:\Windows\System\KkTJIMx.exe
  C:\Windows\System\KkTJIMx.exe
  2⤵
  PID:7488
- C:\Windows\System\UHVcOAZ.exe
  C:\Windows\System\UHVcOAZ.exe
  2⤵
  PID:7504
- C:\Windows\System\ieJnuXE.exe
  C:\Windows\System\ieJnuXE.exe
  2⤵
  PID:7520
- C:\Windows\System\UFbzTTz.exe
  C:\Windows\System\UFbzTTz.exe
  2⤵
  PID:7536
- C:\Windows\System\bQhpzFT.exe
  C:\Windows\System\bQhpzFT.exe
  2⤵
  PID:7552
- C:\Windows\System\pgvaUxK.exe
  C:\Windows\System\pgvaUxK.exe
  2⤵
  PID:7568
- C:\Windows\System\gzCuwrJ.exe
  C:\Windows\System\gzCuwrJ.exe
  2⤵
  PID:7584
- C:\Windows\System\MgoCNQw.exe
  C:\Windows\System\MgoCNQw.exe
  2⤵
  PID:7600
- C:\Windows\System\ByLFLWf.exe
  C:\Windows\System\ByLFLWf.exe
  2⤵
  PID:7616
- C:\Windows\System\modPPki.exe
  C:\Windows\System\modPPki.exe
  2⤵
  PID:7632
- C:\Windows\System\KSrFkHk.exe
  C:\Windows\System\KSrFkHk.exe
  2⤵
  PID:7648
- C:\Windows\System\hunFZzy.exe
  C:\Windows\System\hunFZzy.exe
  2⤵
  PID:7664
- C:\Windows\System\TvDoMIt.exe
  C:\Windows\System\TvDoMIt.exe
  2⤵
  PID:7680
- C:\Windows\System\pOoABSi.exe
  C:\Windows\System\pOoABSi.exe
  2⤵
  PID:7696
- C:\Windows\System\BaqCPTZ.exe
  C:\Windows\System\BaqCPTZ.exe
  2⤵
  PID:7712
- C:\Windows\System\odkKZUs.exe
  C:\Windows\System\odkKZUs.exe
  2⤵
  PID:7728
- C:\Windows\System\yvNtEwb.exe
  C:\Windows\System\yvNtEwb.exe
  2⤵
  PID:7744
- C:\Windows\System\xiwCFjD.exe
  C:\Windows\System\xiwCFjD.exe
  2⤵
  PID:7764
- C:\Windows\System\OmZuWpL.exe
  C:\Windows\System\OmZuWpL.exe
  2⤵
  PID:7780
- C:\Windows\System\OTmzdcg.exe
  C:\Windows\System\OTmzdcg.exe
  2⤵
  PID:7796
- C:\Windows\System\LJYCNBY.exe
  C:\Windows\System\LJYCNBY.exe
  2⤵
  PID:7812
- C:\Windows\System\yTuGnEY.exe
  C:\Windows\System\yTuGnEY.exe
  2⤵
  PID:7828
- C:\Windows\System\boJlvKG.exe
  C:\Windows\System\boJlvKG.exe
  2⤵
  PID:7844
- C:\Windows\System\swqylhy.exe
  C:\Windows\System\swqylhy.exe
  2⤵
  PID:7860
- C:\Windows\System\JtOWuXT.exe
  C:\Windows\System\JtOWuXT.exe
  2⤵
  PID:7876
- C:\Windows\System\ixkRDMh.exe
  C:\Windows\System\ixkRDMh.exe
  2⤵
  PID:7892
- C:\Windows\System\SxlQiYe.exe
  C:\Windows\System\SxlQiYe.exe
  2⤵
  PID:7908
- C:\Windows\System\HQmRXIm.exe
  C:\Windows\System\HQmRXIm.exe
  2⤵
  PID:7924
- C:\Windows\System\vfFxULZ.exe
  C:\Windows\System\vfFxULZ.exe
  2⤵
  PID:7940
- C:\Windows\System\sCGsRvY.exe
  C:\Windows\System\sCGsRvY.exe
  2⤵
  PID:7956
- C:\Windows\System\DhzbnyO.exe
  C:\Windows\System\DhzbnyO.exe
  2⤵
  PID:7972
- C:\Windows\System\aIzyfxW.exe
  C:\Windows\System\aIzyfxW.exe
  2⤵
  PID:7988
- C:\Windows\System\ugShjeN.exe
  C:\Windows\System\ugShjeN.exe
  2⤵
  PID:8004
- C:\Windows\System\RBXRIjc.exe
  C:\Windows\System\RBXRIjc.exe
  2⤵
  PID:8020
- C:\Windows\System\buyujGF.exe
  C:\Windows\System\buyujGF.exe
  2⤵
  PID:8036
- C:\Windows\System\hRTcTze.exe
  C:\Windows\System\hRTcTze.exe
  2⤵
  PID:8052
- C:\Windows\System\yPtKLst.exe
  C:\Windows\System\yPtKLst.exe
  2⤵
  PID:8068
- C:\Windows\System\xHsTFKK.exe
  C:\Windows\System\xHsTFKK.exe
  2⤵
  PID:8084
- C:\Windows\System\RUUxHRv.exe
  C:\Windows\System\RUUxHRv.exe
  2⤵
  PID:8100
- C:\Windows\System\eQdLYro.exe
  C:\Windows\System\eQdLYro.exe
  2⤵
  PID:8116
- C:\Windows\System\gHtiCLo.exe
  C:\Windows\System\gHtiCLo.exe
  2⤵
  PID:8132
- C:\Windows\System\vaDYOCb.exe
  C:\Windows\System\vaDYOCb.exe
  2⤵
  PID:8148
- C:\Windows\System\hDFcLji.exe
  C:\Windows\System\hDFcLji.exe
  2⤵
  PID:8164
- C:\Windows\System\ZcoahMw.exe
  C:\Windows\System\ZcoahMw.exe
  2⤵
  PID:8180
- C:\Windows\System\KCekfPK.exe
  C:\Windows\System\KCekfPK.exe
  2⤵
  PID:5132
- C:\Windows\System\iiYjtjs.exe
  C:\Windows\System\iiYjtjs.exe
  2⤵
  PID:6292
- C:\Windows\System\fZkLARm.exe
  C:\Windows\System\fZkLARm.exe
  2⤵
  PID:6516
- C:\Windows\System\uVODoTW.exe
  C:\Windows\System\uVODoTW.exe
  2⤵
  PID:7212
- C:\Windows\System\uHDuNuq.exe
  C:\Windows\System\uHDuNuq.exe
  2⤵
  PID:7276
- C:\Windows\System\ZjeofTC.exe
  C:\Windows\System\ZjeofTC.exe
  2⤵
  PID:7368
- C:\Windows\System\GfJiYFa.exe
  C:\Windows\System\GfJiYFa.exe
  2⤵
  PID:6580
- C:\Windows\System\ZjKdeRD.exe
  C:\Windows\System\ZjKdeRD.exe
  2⤵
  PID:6612
- C:\Windows\System\mAdXbsK.exe
  C:\Windows\System\mAdXbsK.exe
  2⤵
  PID:7436
- C:\Windows\System\owdknHx.exe
  C:\Windows\System\owdknHx.exe
  2⤵
  PID:7500
- C:\Windows\System\VeqzoOz.exe
  C:\Windows\System\VeqzoOz.exe
  2⤵
  PID:7532
- C:\Windows\System\nQcGQbA.exe
  C:\Windows\System\nQcGQbA.exe
  2⤵
  PID:6772
- C:\Windows\System\IIfuDFC.exe
  C:\Windows\System\IIfuDFC.exe
  2⤵
  PID:5584
- C:\Windows\System\JQyMZHF.exe
  C:\Windows\System\JQyMZHF.exe
  2⤵
  PID:7564
- C:\Windows\System\VkDxJfW.exe
  C:\Windows\System\VkDxJfW.exe
  2⤵
  PID:7628
- C:\Windows\System\EGOzOJW.exe
  C:\Windows\System\EGOzOJW.exe
  2⤵
  PID:7660
- C:\Windows\System\NfTFzOI.exe
  C:\Windows\System\NfTFzOI.exe
  2⤵
  PID:7724
- C:\Windows\System\VnJzSyZ.exe
  C:\Windows\System\VnJzSyZ.exe
  2⤵
  PID:6260
- C:\Windows\System\jxmrfha.exe
  C:\Windows\System\jxmrfha.exe
  2⤵
  PID:6296
- C:\Windows\System\CNPFRlF.exe
  C:\Windows\System\CNPFRlF.exe
  2⤵
  PID:7000
- C:\Windows\System\MdUIHQK.exe
  C:\Windows\System\MdUIHQK.exe
  2⤵
  PID:6388
- C:\Windows\System\GxFfmOe.exe
  C:\Windows\System\GxFfmOe.exe
  2⤵
  PID:7092
- C:\Windows\System\aspONKO.exe
  C:\Windows\System\aspONKO.exe
  2⤵
  PID:7124
- C:\Windows\System\fWNAFwD.exe
  C:\Windows\System\fWNAFwD.exe
  2⤵
  PID:6484
- C:\Windows\System\nvvXIUP.exe
  C:\Windows\System\nvvXIUP.exe
  2⤵
  PID:7196
- C:\Windows\System\cFRLjCM.exe
  C:\Windows\System\cFRLjCM.exe
  2⤵
  PID:6552
- C:\Windows\System\SLzllWp.exe
  C:\Windows\System\SLzllWp.exe
  2⤵
  PID:7420
- C:\Windows\System\jYGbGZU.exe
  C:\Windows\System\jYGbGZU.exe
  2⤵
  PID:6616
- C:\Windows\System\pQqOmsK.exe
  C:\Windows\System\pQqOmsK.exe
  2⤵
  PID:7144
- C:\Windows\System\jcwNLSu.exe
  C:\Windows\System\jcwNLSu.exe
  2⤵
  PID:6308
- C:\Windows\System\CcIqdnc.exe
  C:\Windows\System\CcIqdnc.exe
  2⤵
  PID:6760
- C:\Windows\System\cUZDzGZ.exe
  C:\Windows\System\cUZDzGZ.exe
  2⤵
  PID:6872
- C:\Windows\System\kgYVDYr.exe
  C:\Windows\System\kgYVDYr.exe
  2⤵
  PID:7756
- C:\Windows\System\CzVzDDD.exe
  C:\Windows\System\CzVzDDD.exe
  2⤵
  PID:7224
- C:\Windows\System\vhHUWFh.exe
  C:\Windows\System\vhHUWFh.exe
  2⤵
  PID:7356
- C:\Windows\System\FxRgeGr.exe
  C:\Windows\System\FxRgeGr.exe
  2⤵
  PID:7140
- C:\Windows\System\mRIDkJS.exe
  C:\Windows\System\mRIDkJS.exe
  2⤵
  PID:7076
- C:\Windows\System\qFQRXYW.exe
  C:\Windows\System\qFQRXYW.exe
  2⤵
  PID:7824
- C:\Windows\System\XsCJJNJ.exe
  C:\Windows\System\XsCJJNJ.exe
  2⤵
  PID:7228
- C:\Windows\System\hJbFlsG.exe
  C:\Windows\System\hJbFlsG.exe
  2⤵
  PID:7320
- C:\Windows\System\JGlCSqN.exe
  C:\Windows\System\JGlCSqN.exe
  2⤵
  PID:7920
- C:\Windows\System\ISefjsD.exe
  C:\Windows\System\ISefjsD.exe
  2⤵
  PID:7452
- C:\Windows\System\tAWgiyN.exe
  C:\Windows\System\tAWgiyN.exe
  2⤵
  PID:7548
- C:\Windows\System\pNZsvbf.exe
  C:\Windows\System\pNZsvbf.exe
  2⤵
  PID:7608
- C:\Windows\System\QZgzDrp.exe
  C:\Windows\System\QZgzDrp.exe
  2⤵
  PID:7644
- C:\Windows\System\Jquqgia.exe
  C:\Windows\System\Jquqgia.exe
  2⤵
  PID:7708
- C:\Windows\System\eHHsFEB.exe
  C:\Windows\System\eHHsFEB.exe
  2⤵
  PID:7804
- C:\Windows\System\yEMUxmo.exe
  C:\Windows\System\yEMUxmo.exe
  2⤵
  PID:7836
- C:\Windows\System\PHREwTp.exe
  C:\Windows\System\PHREwTp.exe
  2⤵
  PID:7872
- C:\Windows\System\xYgquWF.exe
  C:\Windows\System\xYgquWF.exe
  2⤵
  PID:7936
- C:\Windows\System\gNnxPtr.exe
  C:\Windows\System\gNnxPtr.exe
  2⤵
  PID:8016
- C:\Windows\System\NmXaURi.exe
  C:\Windows\System\NmXaURi.exe
  2⤵
  PID:8000
- C:\Windows\System\DwTxPdY.exe
  C:\Windows\System\DwTxPdY.exe
  2⤵
  PID:8140
- C:\Windows\System\YHMnCEU.exe
  C:\Windows\System\YHMnCEU.exe
  2⤵
  PID:6228
- C:\Windows\System\nXurYRN.exe
  C:\Windows\System\nXurYRN.exe
  2⤵
  PID:7336
- C:\Windows\System\RLuozKd.exe
  C:\Windows\System\RLuozKd.exe
  2⤵
  PID:8092
- C:\Windows\System\QkipYZQ.exe
  C:\Windows\System\QkipYZQ.exe
  2⤵
  PID:5212
- C:\Windows\System\GuNAnGQ.exe
  C:\Windows\System\GuNAnGQ.exe
  2⤵
  PID:8060
- C:\Windows\System\wcfGWFi.exe
  C:\Windows\System\wcfGWFi.exe
  2⤵
  PID:7560
- C:\Windows\System\lTrGDhK.exe
  C:\Windows\System\lTrGDhK.exe
  2⤵
  PID:6936
- C:\Windows\System\syltPyh.exe
  C:\Windows\System\syltPyh.exe
  2⤵
  PID:7064
- C:\Windows\System\KxenCEL.exe
  C:\Windows\System\KxenCEL.exe
  2⤵
  PID:4836
- C:\Windows\System\LXpZCli.exe
  C:\Windows\System\LXpZCli.exe
  2⤵
  PID:8124
- C:\Windows\System\fOZtHzs.exe
  C:\Windows\System\fOZtHzs.exe
  2⤵
  PID:8188
- C:\Windows\System\DXAQLoJ.exe
  C:\Windows\System\DXAQLoJ.exe
  2⤵
  PID:5740
- C:\Windows\System\PrBQMlq.exe
  C:\Windows\System\PrBQMlq.exe
  2⤵
  PID:6128
- C:\Windows\System\gLhmGzP.exe
  C:\Windows\System\gLhmGzP.exe
  2⤵
  PID:6840
- C:\Windows\System\ZSCSLvw.exe
  C:\Windows\System\ZSCSLvw.exe
  2⤵
  PID:7792
- C:\Windows\System\NvORpqd.exe
  C:\Windows\System\NvORpqd.exe
  2⤵
  PID:5920
- C:\Windows\System\THYfXtc.exe
  C:\Windows\System\THYfXtc.exe
  2⤵
  PID:7948
- C:\Windows\System\IpXvouq.exe
  C:\Windows\System\IpXvouq.exe
  2⤵
  PID:7580
- C:\Windows\System\tSJGTuc.exe
  C:\Windows\System\tSJGTuc.exe
  2⤵
  PID:8048
- C:\Windows\System\anIfkEu.exe
  C:\Windows\System\anIfkEu.exe
  2⤵
  PID:8176
- C:\Windows\System\AtEyixI.exe
  C:\Windows\System\AtEyixI.exe
  2⤵
  PID:7416
- C:\Windows\System\fjVNloZ.exe
  C:\Windows\System\fjVNloZ.exe
  2⤵
  PID:8028
- C:\Windows\System\sIsCOWK.exe
  C:\Windows\System\sIsCOWK.exe
  2⤵
  PID:7656
- C:\Windows\System\MdDyRTK.exe
  C:\Windows\System\MdDyRTK.exe
  2⤵
  PID:7272
- C:\Windows\System\vgwCPdj.exe
  C:\Windows\System\vgwCPdj.exe
  2⤵
  PID:6436
- C:\Windows\System\XQDBnSk.exe
  C:\Windows\System\XQDBnSk.exe
  2⤵
  PID:7292
- C:\Windows\System\OWMcMfR.exe
  C:\Windows\System\OWMcMfR.exe
  2⤵
  PID:7596
- C:\Windows\System\QfgDIHV.exe
  C:\Windows\System\QfgDIHV.exe
  2⤵
  PID:6968
- C:\Windows\System\WNwgVWH.exe
  C:\Windows\System\WNwgVWH.exe
  2⤵
  PID:6456
- C:\Windows\System\yAVVzVc.exe
  C:\Windows\System\yAVVzVc.exe
  2⤵
  PID:6644
- C:\Windows\System\XRthdch.exe
  C:\Windows\System\XRthdch.exe
  2⤵
  PID:6804
- C:\Windows\System\kPEVrqV.exe
  C:\Windows\System\kPEVrqV.exe
  2⤵
  PID:7776
- C:\Windows\System\SgYECUN.exe
  C:\Windows\System\SgYECUN.exe
  2⤵
  PID:6932
- C:\Windows\System\GsKFbXg.exe
  C:\Windows\System\GsKFbXg.exe
  2⤵
  PID:8196
- C:\Windows\System\RgqYnJc.exe
  C:\Windows\System\RgqYnJc.exe
  2⤵
  PID:8212
- C:\Windows\System\mCPyrwC.exe
  C:\Windows\System\mCPyrwC.exe
  2⤵
  PID:8228
- C:\Windows\System\spAwIUe.exe
  C:\Windows\System\spAwIUe.exe
  2⤵
  PID:8244
- C:\Windows\System\KILVmsz.exe
  C:\Windows\System\KILVmsz.exe
  2⤵
  PID:8260
- C:\Windows\System\PvxAyYQ.exe
  C:\Windows\System\PvxAyYQ.exe
  2⤵
  PID:8276
- C:\Windows\System\eFwNJVa.exe
  C:\Windows\System\eFwNJVa.exe
  2⤵
  PID:8292
- C:\Windows\System\NLyVznr.exe
  C:\Windows\System\NLyVznr.exe
  2⤵
  PID:8308
- C:\Windows\System\qqXYXtz.exe
  C:\Windows\System\qqXYXtz.exe
  2⤵
  PID:8324
- C:\Windows\System\JgGQqhZ.exe
  C:\Windows\System\JgGQqhZ.exe
  2⤵
  PID:8340
- C:\Windows\System\UQCYIug.exe
  C:\Windows\System\UQCYIug.exe
  2⤵
  PID:8356
- C:\Windows\System\CkASiii.exe
  C:\Windows\System\CkASiii.exe
  2⤵
  PID:8372
- C:\Windows\System\jerEgvu.exe
  C:\Windows\System\jerEgvu.exe
  2⤵
  PID:8388
- C:\Windows\System\ytYooOx.exe
  C:\Windows\System\ytYooOx.exe
  2⤵
  PID:8404
- C:\Windows\System\cAPwdoC.exe
  C:\Windows\System\cAPwdoC.exe
  2⤵
  PID:8420
- C:\Windows\System\KFWzZkH.exe
  C:\Windows\System\KFWzZkH.exe
  2⤵
  PID:8436
- C:\Windows\System\EWsUyLu.exe
  C:\Windows\System\EWsUyLu.exe
  2⤵
  PID:8452
- C:\Windows\System\tFgNpDF.exe
  C:\Windows\System\tFgNpDF.exe
  2⤵
  PID:8468
- C:\Windows\System\mTXmOxN.exe
  C:\Windows\System\mTXmOxN.exe
  2⤵
  PID:8484
- C:\Windows\System\RYcGVod.exe
  C:\Windows\System\RYcGVod.exe
  2⤵
  PID:8500
- C:\Windows\System\sbmxBel.exe
  C:\Windows\System\sbmxBel.exe
  2⤵
  PID:8516
- C:\Windows\System\hJZNqoq.exe
  C:\Windows\System\hJZNqoq.exe
  2⤵
  PID:8532
- C:\Windows\System\FvOGTev.exe
  C:\Windows\System\FvOGTev.exe
  2⤵
  PID:8548
- C:\Windows\System\HlPOhMU.exe
  C:\Windows\System\HlPOhMU.exe
  2⤵
  PID:8564
- C:\Windows\System\yISdiCy.exe
  C:\Windows\System\yISdiCy.exe
  2⤵
  PID:8580
- C:\Windows\System\srKHyMn.exe
  C:\Windows\System\srKHyMn.exe
  2⤵
  PID:8596
- C:\Windows\System\KuLBHAk.exe
  C:\Windows\System\KuLBHAk.exe
  2⤵
  PID:8612
- C:\Windows\System\XlcJSyw.exe
  C:\Windows\System\XlcJSyw.exe
  2⤵
  PID:8628
- C:\Windows\System\ObGRKoR.exe
  C:\Windows\System\ObGRKoR.exe
  2⤵
  PID:8644
- C:\Windows\System\cnPynXx.exe
  C:\Windows\System\cnPynXx.exe
  2⤵
  PID:8660
- C:\Windows\System\CxDIOsb.exe
  C:\Windows\System\CxDIOsb.exe
  2⤵
  PID:8676
- C:\Windows\System\gHtMpjJ.exe
  C:\Windows\System\gHtMpjJ.exe
  2⤵
  PID:8692
- C:\Windows\System\LsEwCDo.exe
  C:\Windows\System\LsEwCDo.exe
  2⤵
  PID:8712
- C:\Windows\System\PmJvrxE.exe
  C:\Windows\System\PmJvrxE.exe
  2⤵
  PID:8728
- C:\Windows\System\iBQQiMP.exe
  C:\Windows\System\iBQQiMP.exe
  2⤵
  PID:8744
- C:\Windows\System\gYDpLjd.exe
  C:\Windows\System\gYDpLjd.exe
  2⤵
  PID:8760
- C:\Windows\System\lqUuSZf.exe
  C:\Windows\System\lqUuSZf.exe
  2⤵
  PID:8776
- C:\Windows\System\BiTaYlo.exe
  C:\Windows\System\BiTaYlo.exe
  2⤵
  PID:8792
- C:\Windows\System\nApQUVE.exe
  C:\Windows\System\nApQUVE.exe
  2⤵
  PID:8808
- C:\Windows\System\EePUvlJ.exe
  C:\Windows\System\EePUvlJ.exe
  2⤵
  PID:8824
- C:\Windows\System\JCmTAGI.exe
  C:\Windows\System\JCmTAGI.exe
  2⤵
  PID:8852
- C:\Windows\System\jwZfquQ.exe
  C:\Windows\System\jwZfquQ.exe
  2⤵
  PID:8876
- C:\Windows\System\zvfYOrE.exe
  C:\Windows\System\zvfYOrE.exe
  2⤵
  PID:8900
- C:\Windows\System\cLJRRxY.exe
  C:\Windows\System\cLJRRxY.exe
  2⤵
  PID:8916
- C:\Windows\System\HPljQJQ.exe
  C:\Windows\System\HPljQJQ.exe
  2⤵
  PID:8932
- C:\Windows\System\MgbiVxy.exe
  C:\Windows\System\MgbiVxy.exe
  2⤵
  PID:8948
- C:\Windows\System\jZsomlG.exe
  C:\Windows\System\jZsomlG.exe
  2⤵
  PID:8964
- C:\Windows\System\TskQnLn.exe
  C:\Windows\System\TskQnLn.exe
  2⤵
  PID:8980
- C:\Windows\System\FqGZahd.exe
  C:\Windows\System\FqGZahd.exe
  2⤵
  PID:8996
- C:\Windows\System\LbQJRPq.exe
  C:\Windows\System\LbQJRPq.exe
  2⤵
  PID:9012
- C:\Windows\System\KKkXKpB.exe
  C:\Windows\System\KKkXKpB.exe
  2⤵
  PID:9028
- C:\Windows\System\PRodrpd.exe
  C:\Windows\System\PRodrpd.exe
  2⤵
  PID:9044
- C:\Windows\System\wfiCHlj.exe
  C:\Windows\System\wfiCHlj.exe
  2⤵
  PID:9060
- C:\Windows\System\ZwBGvjv.exe
  C:\Windows\System\ZwBGvjv.exe
  2⤵
  PID:9076
- C:\Windows\System\fznBcXk.exe
  C:\Windows\System\fznBcXk.exe
  2⤵
  PID:9092
- C:\Windows\System\cRknsje.exe
  C:\Windows\System\cRknsje.exe
  2⤵
  PID:9108
- C:\Windows\System\BzEiDbp.exe
  C:\Windows\System\BzEiDbp.exe
  2⤵
  PID:9124
- C:\Windows\System\jjJkdBJ.exe
  C:\Windows\System\jjJkdBJ.exe
  2⤵
  PID:9140
- C:\Windows\System\MCuZQRy.exe
  C:\Windows\System\MCuZQRy.exe
  2⤵
  PID:9156
- C:\Windows\System\wmdaVfs.exe
  C:\Windows\System\wmdaVfs.exe
  2⤵
  PID:9172
- C:\Windows\System\QUAfWgD.exe
  C:\Windows\System\QUAfWgD.exe
  2⤵
  PID:9188
- C:\Windows\System\AIRyHdf.exe
  C:\Windows\System\AIRyHdf.exe
  2⤵
  PID:9204
- C:\Windows\System\lvLBqht.exe
  C:\Windows\System\lvLBqht.exe
  2⤵
  PID:8204
- C:\Windows\System\UZqgySg.exe
  C:\Windows\System\UZqgySg.exe
  2⤵
  PID:8240
- C:\Windows\System\mpstvtY.exe
  C:\Windows\System\mpstvtY.exe
  2⤵
  PID:8272
- C:\Windows\System\MZuGYKO.exe
  C:\Windows\System\MZuGYKO.exe
  2⤵
  PID:7260
- C:\Windows\System\CEPpcmc.exe
  C:\Windows\System\CEPpcmc.exe
  2⤵
  PID:7888
- C:\Windows\System\TJARoRK.exe
  C:\Windows\System\TJARoRK.exe
  2⤵
  PID:7612
- C:\Windows\System\dDPpchu.exe
  C:\Windows\System\dDPpchu.exe
  2⤵
  PID:6852
- C:\Windows\System\XWVGoZK.exe
  C:\Windows\System\XWVGoZK.exe
  2⤵
  PID:8032
- C:\Windows\System\qDJeEqU.exe
  C:\Windows\System\qDJeEqU.exe
  2⤵
  PID:7388
- C:\Windows\System\OuwIUUZ.exe
  C:\Windows\System\OuwIUUZ.exe
  2⤵
  PID:7996
- C:\Windows\System\evnOcgN.exe
  C:\Windows\System\evnOcgN.exe
  2⤵
  PID:8112
- C:\Windows\System\AiNTIMu.exe
  C:\Windows\System\AiNTIMu.exe
  2⤵
  PID:6744
- C:\Windows\System\lMWWnGd.exe
  C:\Windows\System\lMWWnGd.exe
  2⤵
  PID:6328
- C:\Windows\System\vMURcKF.exe
  C:\Windows\System\vMURcKF.exe
  2⤵
  PID:5980
- C:\Windows\System\ORrjHRx.exe
  C:\Windows\System\ORrjHRx.exe
  2⤵
  PID:8384
- C:\Windows\System\LgbYZXT.exe
  C:\Windows\System\LgbYZXT.exe
  2⤵
  PID:7676
- C:\Windows\System\JsRIFoc.exe
  C:\Windows\System\JsRIFoc.exe
  2⤵
  PID:7308
- C:\Windows\System\XcgsXPd.exe
  C:\Windows\System\XcgsXPd.exe
  2⤵
  PID:6424
- C:\Windows\System\CXjkBLv.exe
  C:\Windows\System\CXjkBLv.exe
  2⤵
  PID:8252
- C:\Windows\System\cTwgJmy.exe
  C:\Windows\System\cTwgJmy.exe
  2⤵
  PID:8432
- C:\Windows\System\kbSSYdE.exe
  C:\Windows\System\kbSSYdE.exe
  2⤵
  PID:8412
- C:\Windows\System\DOeUZni.exe
  C:\Windows\System\DOeUZni.exe
  2⤵
  PID:8492
- C:\Windows\System\mnZRxuG.exe
  C:\Windows\System\mnZRxuG.exe
  2⤵
  PID:8524
- C:\Windows\System\qZWUACl.exe
  C:\Windows\System\qZWUACl.exe
  2⤵
  PID:8480
- C:\Windows\System\BmkRIYb.exe
  C:\Windows\System\BmkRIYb.exe
  2⤵
  PID:8592
- C:\Windows\System\WJfcPun.exe
  C:\Windows\System\WJfcPun.exe
  2⤵
  PID:8684
- C:\Windows\System\iRuShWb.exe
  C:\Windows\System\iRuShWb.exe
  2⤵
  PID:8724
- C:\Windows\System\rLqIkRT.exe
  C:\Windows\System\rLqIkRT.exe
  2⤵
  PID:8608
- C:\Windows\System\KZepobq.exe
  C:\Windows\System\KZepobq.exe
  2⤵
  PID:8540
- C:\Windows\System\FfJpbwH.exe
  C:\Windows\System\FfJpbwH.exe
  2⤵
  PID:8668
- C:\Windows\System\jSALurB.exe
  C:\Windows\System\jSALurB.exe
  2⤵
  PID:8640
- C:\Windows\System\bcdkYHT.exe
  C:\Windows\System\bcdkYHT.exe
  2⤵
  PID:8708
- C:\Windows\System\TIthCWM.exe
  C:\Windows\System\TIthCWM.exe
  2⤵
  PID:8804
- C:\Windows\System\nhwfrPz.exe
  C:\Windows\System\nhwfrPz.exe
  2⤵
  PID:8832
- C:\Windows\System\YEKqvua.exe
  C:\Windows\System\YEKqvua.exe
  2⤵
  PID:8908
- C:\Windows\System\kHmVXYN.exe
  C:\Windows\System\kHmVXYN.exe
  2⤵
  PID:8972
- C:\Windows\System\kRwrWVZ.exe
  C:\Windows\System\kRwrWVZ.exe
  2⤵
  PID:9008
- C:\Windows\System\dGRbKOt.exe
  C:\Windows\System\dGRbKOt.exe
  2⤵
  PID:9036
- C:\Windows\System\dKZRxUE.exe
  C:\Windows\System\dKZRxUE.exe
  2⤵
  PID:9068
- C:\Windows\System\BpAqHaQ.exe
  C:\Windows\System\BpAqHaQ.exe
  2⤵
  PID:9132
- C:\Windows\System\gfQktns.exe
  C:\Windows\System\gfQktns.exe
  2⤵
  PID:9196
- C:\Windows\System\kgswDFb.exe
  C:\Windows\System\kgswDFb.exe
  2⤵
  PID:9024
- C:\Windows\System\LtQBooR.exe
  C:\Windows\System\LtQBooR.exe
  2⤵
  PID:9120
- C:\Windows\System\dZRIhEW.exe
  C:\Windows\System\dZRIhEW.exe
  2⤵
  PID:8332
- C:\Windows\System\EzDtOrC.exe
  C:\Windows\System\EzDtOrC.exe
  2⤵
  PID:7884
- C:\Windows\System\sPxXIiE.exe
  C:\Windows\System\sPxXIiE.exe
  2⤵
  PID:7208
- C:\Windows\System\YEgkfLb.exe
  C:\Windows\System\YEgkfLb.exe
  2⤵
  PID:7032
- C:\Windows\System\LcBOUdv.exe
  C:\Windows\System\LcBOUdv.exe
  2⤵
  PID:9052
- C:\Windows\System\GkuRHoc.exe
  C:\Windows\System\GkuRHoc.exe
  2⤵
  PID:8464
- C:\Windows\System\STfIIMs.exe
  C:\Windows\System\STfIIMs.exe
  2⤵
  PID:7856
- C:\Windows\System\aYJvHFn.exe
  C:\Windows\System\aYJvHFn.exe
  2⤵
  PID:8652
- C:\Windows\System\bRxEbnt.exe
  C:\Windows\System\bRxEbnt.exe
  2⤵
  PID:8700
- C:\Windows\System\BnWAfMA.exe
  C:\Windows\System\BnWAfMA.exe
  2⤵
  PID:8844
- C:\Windows\System\bNJAKai.exe
  C:\Windows\System\bNJAKai.exe
  2⤵
  PID:8928
- C:\Windows\System\DUrNsLn.exe
  C:\Windows\System\DUrNsLn.exe
  2⤵
  PID:9020
- C:\Windows\System\SzvShCz.exe
  C:\Windows\System\SzvShCz.exe
  2⤵
  PID:9180
- C:\Windows\System\PElCbci.exe
  C:\Windows\System\PElCbci.exe
  2⤵
  PID:8076
- C:\Windows\System\iwcjWVV.exe
  C:\Windows\System\iwcjWVV.exe
  2⤵
  PID:7288
- C:\Windows\System\vOzcVJK.exe
  C:\Windows\System\vOzcVJK.exe
  2⤵
  PID:8012
- C:\Windows\System\JOxeDmK.exe
  C:\Windows\System\JOxeDmK.exe
  2⤵
  PID:8400
- C:\Windows\System\DASJaRN.exe
  C:\Windows\System\DASJaRN.exe
  2⤵
  PID:8224
- C:\Windows\System\WXigUeI.exe
  C:\Windows\System\WXigUeI.exe
  2⤵
  PID:8444
- C:\Windows\System\IeKGiSf.exe
  C:\Windows\System\IeKGiSf.exe
  2⤵
  PID:8512
- C:\Windows\System\JHpPjDR.exe
  C:\Windows\System\JHpPjDR.exe
  2⤵
  PID:8772
- C:\Windows\System\thRAOXK.exe
  C:\Windows\System\thRAOXK.exe
  2⤵
  PID:9004
- C:\Windows\System\EzLnbHt.exe
  C:\Windows\System\EzLnbHt.exe
  2⤵
  PID:9168
- C:\Windows\System\fprBoJo.exe
  C:\Windows\System\fprBoJo.exe
  2⤵
  PID:9084
- C:\Windows\System\yyJnSfN.exe
  C:\Windows\System\yyJnSfN.exe
  2⤵
  PID:6660
- C:\Windows\System\iqVxrFF.exe
  C:\Windows\System\iqVxrFF.exe
  2⤵
  PID:8944
- C:\Windows\System\XJWIxap.exe
  C:\Windows\System\XJWIxap.exe
  2⤵
  PID:6216
- C:\Windows\System\BjBDdGK.exe
  C:\Windows\System\BjBDdGK.exe
  2⤵
  PID:7740
- C:\Windows\System\DwCJYbU.exe
  C:\Windows\System\DwCJYbU.exe
  2⤵
  PID:8992
- C:\Windows\System\sXyGHSW.exe
  C:\Windows\System\sXyGHSW.exe
  2⤵
  PID:9152
- C:\Windows\System\NEkRNkY.exe
  C:\Windows\System\NEkRNkY.exe
  2⤵
  PID:8636
- C:\Windows\System\OUXBTxK.exe
  C:\Windows\System\OUXBTxK.exe
  2⤵
  PID:9232
- C:\Windows\System\pVgFTiE.exe
  C:\Windows\System\pVgFTiE.exe
  2⤵
  PID:9248
- C:\Windows\System\FMvmlLA.exe
  C:\Windows\System\FMvmlLA.exe
  2⤵
  PID:9264
- C:\Windows\System\gUMRdkk.exe
  C:\Windows\System\gUMRdkk.exe
  2⤵
  PID:9280
- C:\Windows\System\ShtteyY.exe
  C:\Windows\System\ShtteyY.exe
  2⤵
  PID:9296
- C:\Windows\System\sSQYPVz.exe
  C:\Windows\System\sSQYPVz.exe
  2⤵
  PID:9312
- C:\Windows\System\HCuaSnC.exe
  C:\Windows\System\HCuaSnC.exe
  2⤵
  PID:9328
- C:\Windows\System\TLBUiKo.exe
  C:\Windows\System\TLBUiKo.exe
  2⤵
  PID:9344
- C:\Windows\System\rIoxvEb.exe
  C:\Windows\System\rIoxvEb.exe
  2⤵
  PID:9360
- C:\Windows\System\yCzhRwH.exe
  C:\Windows\System\yCzhRwH.exe
  2⤵
  PID:9376
- C:\Windows\System\eXSHAvK.exe
  C:\Windows\System\eXSHAvK.exe
  2⤵
  PID:9392
- C:\Windows\System\IwqEDXu.exe
  C:\Windows\System\IwqEDXu.exe
  2⤵
  PID:9408
- C:\Windows\System\aVfUEhV.exe
  C:\Windows\System\aVfUEhV.exe
  2⤵
  PID:9424
- C:\Windows\System\rstnrJm.exe
  C:\Windows\System\rstnrJm.exe
  2⤵
  PID:9440
- C:\Windows\System\uXoFFWQ.exe
  C:\Windows\System\uXoFFWQ.exe
  2⤵
  PID:9456
- C:\Windows\System\MPWlVjk.exe
  C:\Windows\System\MPWlVjk.exe
  2⤵
  PID:9472
- C:\Windows\System\LqLADPy.exe
  C:\Windows\System\LqLADPy.exe
  2⤵
  PID:9488
- C:\Windows\System\VQCTCiA.exe
  C:\Windows\System\VQCTCiA.exe
  2⤵
  PID:9504
- C:\Windows\System\dYSLLgz.exe
  C:\Windows\System\dYSLLgz.exe
  2⤵
  PID:9520
- C:\Windows\System\TPnhbQF.exe
  C:\Windows\System\TPnhbQF.exe
  2⤵
  PID:9536
- C:\Windows\System\ySKoStV.exe
  C:\Windows\System\ySKoStV.exe
  2⤵
  PID:9552
- C:\Windows\System\CMshrYE.exe
  C:\Windows\System\CMshrYE.exe
  2⤵
  PID:9568
- C:\Windows\System\GBzlKkJ.exe
  C:\Windows\System\GBzlKkJ.exe
  2⤵
  PID:9584
- C:\Windows\System\YwjZeqK.exe
  C:\Windows\System\YwjZeqK.exe
  2⤵
  PID:9600
- C:\Windows\System\cgtRKnz.exe
  C:\Windows\System\cgtRKnz.exe
  2⤵
  PID:9616
- C:\Windows\System\WSfhPKr.exe
  C:\Windows\System\WSfhPKr.exe
  2⤵
  PID:9632
- C:\Windows\System\VYoQknG.exe
  C:\Windows\System\VYoQknG.exe
  2⤵
  PID:9648
- C:\Windows\System\PndqqeM.exe
  C:\Windows\System\PndqqeM.exe
  2⤵
  PID:9664
- C:\Windows\System\aTNyFPf.exe
  C:\Windows\System\aTNyFPf.exe
  2⤵
  PID:9680
- C:\Windows\System\JHRvEFf.exe
  C:\Windows\System\JHRvEFf.exe
  2⤵
  PID:9696
- C:\Windows\System\zLagyap.exe
  C:\Windows\System\zLagyap.exe
  2⤵
  PID:9712
- C:\Windows\System\uYMyAKv.exe
  C:\Windows\System\uYMyAKv.exe
  2⤵
  PID:9728
- C:\Windows\System\akkJSQu.exe
  C:\Windows\System\akkJSQu.exe
  2⤵
  PID:9744
- C:\Windows\System\lLXvcGw.exe
  C:\Windows\System\lLXvcGw.exe
  2⤵
  PID:9760
- C:\Windows\System\dGInEyH.exe
  C:\Windows\System\dGInEyH.exe
  2⤵
  PID:9780
- C:\Windows\System\JPadtVc.exe
  C:\Windows\System\JPadtVc.exe
  2⤵
  PID:9796
- C:\Windows\System\kTCjmQf.exe
  C:\Windows\System\kTCjmQf.exe
  2⤵
  PID:9812
- C:\Windows\System\SVMnGrn.exe
  C:\Windows\System\SVMnGrn.exe
  2⤵
  PID:9828
- C:\Windows\System\IxuEoPL.exe
  C:\Windows\System\IxuEoPL.exe
  2⤵
  PID:9844
- C:\Windows\System\yciHwZV.exe
  C:\Windows\System\yciHwZV.exe
  2⤵
  PID:9860
- C:\Windows\System\UhWmpMB.exe
  C:\Windows\System\UhWmpMB.exe
  2⤵
  PID:9876
- C:\Windows\System\dpKkhMl.exe
  C:\Windows\System\dpKkhMl.exe
  2⤵
  PID:9892
- C:\Windows\System\tdFNKxl.exe
  C:\Windows\System\tdFNKxl.exe
  2⤵
  PID:9908
- C:\Windows\System\rIwsbde.exe
  C:\Windows\System\rIwsbde.exe
  2⤵
  PID:9924
- C:\Windows\System\gKrjOIM.exe
  C:\Windows\System\gKrjOIM.exe
  2⤵
  PID:9940
- C:\Windows\System\rueAyvm.exe
  C:\Windows\System\rueAyvm.exe
  2⤵
  PID:9956
- C:\Windows\System\yyvqzQt.exe
  C:\Windows\System\yyvqzQt.exe
  2⤵
  PID:9972
- C:\Windows\System\XlrBIqm.exe
  C:\Windows\System\XlrBIqm.exe
  2⤵
  PID:9988
- C:\Windows\System\BdrKydd.exe
  C:\Windows\System\BdrKydd.exe
  2⤵
  PID:10004
- C:\Windows\System\aqcvxHE.exe
  C:\Windows\System\aqcvxHE.exe
  2⤵
  PID:10020
- C:\Windows\System\LbqtWjA.exe
  C:\Windows\System\LbqtWjA.exe
  2⤵
  PID:10036
- C:\Windows\System\EMdqceQ.exe
  C:\Windows\System\EMdqceQ.exe
  2⤵
  PID:10052
- C:\Windows\System\uCjFygE.exe
  C:\Windows\System\uCjFygE.exe
  2⤵
  PID:10068
- C:\Windows\System\LhaNhza.exe
  C:\Windows\System\LhaNhza.exe
  2⤵
  PID:10084
- C:\Windows\System\vAHNexZ.exe
  C:\Windows\System\vAHNexZ.exe
  2⤵
  PID:10100
- C:\Windows\System\iPoQLYn.exe
  C:\Windows\System\iPoQLYn.exe
  2⤵
  PID:10116
- C:\Windows\System\vRPykTD.exe
  C:\Windows\System\vRPykTD.exe
  2⤵
  PID:10136
- C:\Windows\System\KaceVjK.exe
  C:\Windows\System\KaceVjK.exe
  2⤵
  PID:10152
- C:\Windows\System\eQgWJee.exe
  C:\Windows\System\eQgWJee.exe
  2⤵
  PID:10168
- C:\Windows\System\yoELNWQ.exe
  C:\Windows\System\yoELNWQ.exe
  2⤵
  PID:10184
- C:\Windows\System\jJbfDnv.exe
  C:\Windows\System\jJbfDnv.exe
  2⤵
  PID:10212
- C:\Windows\System\DiltfvF.exe
  C:\Windows\System\DiltfvF.exe
  2⤵
  PID:8896
- C:\Windows\System\sspNGWy.exe
  C:\Windows\System\sspNGWy.exe
  2⤵
  PID:9116
- C:\Windows\System\vfQJhJc.exe
  C:\Windows\System\vfQJhJc.exe
  2⤵
  PID:8476
- C:\Windows\System\iFZsone.exe
  C:\Windows\System\iFZsone.exe
  2⤵
  PID:8720
- C:\Windows\System\kmKqyUb.exe
  C:\Windows\System\kmKqyUb.exe
  2⤵
  PID:9260
- C:\Windows\System\mTBmIeT.exe
  C:\Windows\System\mTBmIeT.exe
  2⤵
  PID:9352
- C:\Windows\System\JsamPEh.exe
  C:\Windows\System\JsamPEh.exe
  2⤵
  PID:9404
- C:\Windows\System\VPPNAHQ.exe
  C:\Windows\System\VPPNAHQ.exe
  2⤵
  PID:9416
- C:\Windows\System\ekieYCT.exe
  C:\Windows\System\ekieYCT.exe
  2⤵
  PID:9388
- C:\Windows\System\sSmbbdG.exe
  C:\Windows\System\sSmbbdG.exe
  2⤵
  PID:9452
- C:\Windows\System\wBuGwJg.exe
  C:\Windows\System\wBuGwJg.exe
  2⤵
  PID:9480
- C:\Windows\System\JZtmqHN.exe
  C:\Windows\System\JZtmqHN.exe
  2⤵
  PID:9516
- C:\Windows\System\ZfdNROe.exe
  C:\Windows\System\ZfdNROe.exe
  2⤵
  PID:9624
- C:\Windows\System\UmnlyOz.exe
  C:\Windows\System\UmnlyOz.exe
  2⤵
  PID:9580
- C:\Windows\System\yhboHVK.exe
  C:\Windows\System\yhboHVK.exe
  2⤵
  PID:9644
- C:\Windows\System\UMBJwXY.exe
  C:\Windows\System\UMBJwXY.exe
  2⤵
  PID:9724
- C:\Windows\System\VHxWVrT.exe
  C:\Windows\System\VHxWVrT.exe
  2⤵
  PID:9708
- C:\Windows\System\yCfpPEy.exe
  C:\Windows\System\yCfpPEy.exe
  2⤵
  PID:9740
- C:\Windows\System\LOdIDUt.exe
  C:\Windows\System\LOdIDUt.exe
  2⤵
  PID:9852
- C:\Windows\System\fjlbSaN.exe
  C:\Windows\System\fjlbSaN.exe
  2⤵
  PID:9776
- C:\Windows\System\oYpRsjL.exe
  C:\Windows\System\oYpRsjL.exe
  2⤵
  PID:9872
- C:\Windows\System\hezJQan.exe
  C:\Windows\System\hezJQan.exe
  2⤵
  PID:9904
- C:\Windows\System\hYCOpRm.exe
  C:\Windows\System\hYCOpRm.exe
  2⤵
  PID:9984
- C:\Windows\System\nVGQibH.exe
  C:\Windows\System\nVGQibH.exe
  2⤵
  PID:9964
- C:\Windows\System\qwswBKB.exe
  C:\Windows\System\qwswBKB.exe
  2⤵
  PID:9996
- C:\Windows\System\LzgnCaw.exe
  C:\Windows\System\LzgnCaw.exe
  2⤵
  PID:10108
- C:\Windows\System\wJZuUBr.exe
  C:\Windows\System\wJZuUBr.exe
  2⤵
  PID:10032
- C:\Windows\System\dMitLJw.exe
  C:\Windows\System\dMitLJw.exe
  2⤵
  PID:10096
- C:\Windows\System\jSrADkW.exe
  C:\Windows\System\jSrADkW.exe
  2⤵
  PID:10164
- C:\Windows\System\YMepBHZ.exe
  C:\Windows\System\YMepBHZ.exe
  2⤵
  PID:10196
- C:\Windows\System\BQWFVUa.exe
  C:\Windows\System\BQWFVUa.exe
  2⤵
  PID:10224
- C:\Windows\System\GFVSUKC.exe
  C:\Windows\System\GFVSUKC.exe
  2⤵
  PID:9240
- C:\Windows\System\lxwJoCa.exe
  C:\Windows\System\lxwJoCa.exe
  2⤵
  PID:9308
- C:\Windows\System\MpTirbo.exe
  C:\Windows\System\MpTirbo.exe
  2⤵
  PID:9272
- C:\Windows\System\OCjglxk.exe
  C:\Windows\System\OCjglxk.exe
  2⤵
  PID:8284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdkoOyr.exe

Filesize
1.3MB

MD5
f4d25d5d6e197acda6b506ca2d3fe7b0

SHA1
2675a76bd6359a7f27a35a19276beb3e3eafeff2

SHA256
2495a3dcc5004cf1b0b5fe3dfde62f2649e88bb8207a24e67f772da2573ba207

SHA512
ddb62f888b5bdba16c5c933ad73087d01e8b33a34b6af2cbf4901017c94adf1fa209d1af412c24f30d1d5eeb4895635ee89d5d64fc5db0b498c47b537bbd40c4

Download Submit
C:\Windows\system\AxhiczR.exe

Filesize
1.3MB

MD5
559efb3115127204875322ef1b612b00

SHA1
a1ac6f47c28f840d9fff4b650564e3a45ee17077

SHA256
46a743ebd78227fe923a68b046b1dea4a4a9035731bdd7b45edde745d9f39c95

SHA512
153aa487134e3a4bd5288de94dd7d470eef0ea0930e137e08066116dda2ccf42fb100a9beeb9f5d9abb9270df3044638699426bdcda924a16a890e7080a9b387

Download Submit
C:\Windows\system\CcHvoYH.exe

Filesize
1.3MB

MD5
8f9ae76da3333cf3f9dcf55816d13fbf

SHA1
099737844afaad649039208a8f59899f0edced0a

SHA256
8dce351d29711cd5bc423f3b0b8eef31d8cba2b2b4ac84489c7cd6da6187a012

SHA512
37ca6b34edefcb4073ebecb0fcb0d902f18d06655fc44dbd53a6bfe2c98311a374d25a94926f13610001c47854cc15997b0fa6051178271445ae1bb9baa39aab

Download Submit
C:\Windows\system\DKnoleS.exe

Filesize
1.3MB

MD5
0af9890815d75f79fc6f0bfb82f9f82b

SHA1
64354b0e2d34bd74eb5199797d3b830035f4a295

SHA256
513923065bfcbb20295383610e0da013055b14463127ee6937bb062f3b8fd83c

SHA512
f78e9f366288d3df6eeca94038fd554db5962881b525bee943606e6e30b378b92fafe481285ecb60520ae3490be3ad96a5ab357e6bf0aa4f1ac25a073a576399

Download Submit
C:\Windows\system\DssQsAp.exe

Filesize
1.3MB

MD5
fb4338307f74530da4b6c4956b8f179b

SHA1
d308965043406aa8a3ab30cbd6c185a58a7f4a40

SHA256
14a790c90a3a525052be1bac5c67144c290808dc5653670aa0c6689a5933c102

SHA512
ed7b89b15f108b0625c03814b0211fe8b25c9647f074353217b511e0f2d63b5a4dde018295a9f68e30fd3f5a01a7beacaa6288d56021d8a53a2efd8a3307b6d7

Download Submit
C:\Windows\system\FLySYXG.exe

Filesize
1.3MB

MD5
0080031acc78257164198eaaf5ca3c6f

SHA1
476a70cc86c294f1cc9737077d26508cc5792b20

SHA256
135d68bc23c5e7b7d480e42f2a8f75f5fd3803b8ca28b472467f3354bdbdc6fe

SHA512
35c72ec48c99338c02849c5f08b8a06bba67b9556b92931d73ea44120fc5045be1ce5b4b66c741ca7fbacd6fa1f1fa44c13e780544627b994b482f5e50b0e73b

Download Submit
C:\Windows\system\HsUGyRQ.exe

Filesize
1.3MB

MD5
41562a89d2a7668c472e83f8b9adac16

SHA1
466156a34cfe8e4e0a13d117e992f73d33d2ddc5

SHA256
0e3399569b58ed08ee1a159c2d4442f4077908c6e71f772f921dfa1eea0cbf0f

SHA512
a8afd6ac214803aaa5569dd561abbd4bac9a3df14990670878b9cd4b8f5673d510786d0a92a2082432da183d921b456b384f49271e2a2e828f0152af3987c2ec

Download Submit
C:\Windows\system\HxGOiVs.exe

Filesize
1.3MB

MD5
194b54d5b00cc52d51b3ad1bdaa444fe

SHA1
84a3001473ce1c714adcfb455f27bd07d988d44e

SHA256
ab2dbf1cac2eb9b54ac0e7d7b84d128cdd7a6ce27c1b104f985fe6c809c1e411

SHA512
ed0aabf8c086eebdf2392ce79cca31069f495d5e5c8b67fc113967d9c604252d4289300616e1ead385f882c4802e48df42945ed7ee43c7424f85c4385e79999b

Download Submit
C:\Windows\system\IpjLIXP.exe

Filesize
1.3MB

MD5
46262bc2d03484f1511777ca2b3868a9

SHA1
5809d95945101011fe515854ee88751613b43e10

SHA256
6eb60a689e0f466d1649d7e682bdaeef1e1a1c7b0ed6c03c16070f37e83d7004

SHA512
2ed50371a47c2f8b68fc92dadbefe65d1ca6c7e7fd5a81e060b4e6c8ca49dd47833fb189a5da765fbad82bb4d3b277afb4ba13dcc4435e499076ca3327e63025

Download Submit
C:\Windows\system\LbzlNrU.exe

Filesize
1.3MB

MD5
81db510c9afdfc3c18750631106eb4ee

SHA1
6c1c060eed6ebbdbb145ee31d27eaa9bd691e1f8

SHA256
d3042e6e261692543a3c627fbff714e15d040bda738771d9e839186517ff28c7

SHA512
027a9b043662bfe46d2015c0eb42f5f908717e89f72b5fe059940bc09d90c529a52518c50308efd854ab017361dd81b845b774da260e30bd1114f4ab8e2fe16d

Download Submit
C:\Windows\system\MHeHWpC.exe

Filesize
1.3MB

MD5
e0c97f9a4d493651e547786926bc4a06

SHA1
4b4ae452bb9d6949726844278d649f9b14f8df2d

SHA256
22a747e6ea09fcd3456bc8e6de961576ff5cc1deb8e6dd28bae11945e553e1d2

SHA512
71900b6caa29c093288365a4864128ec7ee0d472332359a0d113bf40062459332311a4b5472d828bd1994067cb7c8e38e40c97ae9db9e4f593ac3da01ecf5453

Download Submit
C:\Windows\system\MIzOWcf.exe

Filesize
1.3MB

MD5
e04cd87e0aaeea78fc561f6a2a9fa70d

SHA1
548a3d71bd1de7e38d04c57aa38101cb4ae04efe

SHA256
17636c3d478b0d903f18fab1101be5402644e2833e74cb55eaeaaaa10d7cea1f

SHA512
9562db5947f8e684451ec151471ffd7cc406f1719e36934161275f3da91ce00324a2a23688ad095936148587c0bd351cf32f75c50d3d2dd2b493f6712cba3db6

Download Submit
C:\Windows\system\MPRVgXZ.exe

Filesize
1.3MB

MD5
bae9e17cd9a14d33c40d8a807e69a241

SHA1
b9236bf6ed39076a92eacab2573b814beda73374

SHA256
4317c3d0a4640cdae9e4271b559daedb11155a7c1f10a6f9edc6b8dc5833066a

SHA512
f69168bb616d28bc5dba75a589d2ad178b0b2c005ddfddc9ac4cffdfd91269d139b339903fcdc6c8119ca8ff25b8d23a63e14d2ce10accf911e3ff23892b6dfe

Download Submit
C:\Windows\system\OrgjDzR.exe

Filesize
1.3MB

MD5
633b394fa8b8d36aed2a552f9e8d1ad8

SHA1
14adbac758c86ed138f10c0596f35f755b892be4

SHA256
2fb61a75eac230e7ab0ddc2b29bc15bb1ef1b4e26122bb98b86c4e49044a1a84

SHA512
614e4a5a82698957ade96764d1e3cf419b68ffb3740a2e0811be71a9630cdb10e8899b6dfd6f4887d2bb530bf67c8eee6424dc969412f57979dadf068ee8d629

Download Submit
C:\Windows\system\QbVhqTn.exe

Filesize
1.3MB

MD5
c1b8a3bff1e2bcdcfcd90169ecabaa52

SHA1
2373fd2579be3ef019804aca1db9e1ed8f547cb7

SHA256
af36512a526fe4af0a9266af1803bd0b278c10333fc20c5ee2f8720a288e607a

SHA512
bd35423a156d6e0b87b4f4d7de993798a8f5ad48f8238c3fddcfc3b98b020b330b22b7845b7e24e249677cf51b63c374b461e7001f5706edddd76575cfdfb0d6

Download Submit
C:\Windows\system\TYJAvam.exe

Filesize
1.3MB

MD5
d2112442bed6df9d0407110b98bb659f

SHA1
db3be32dca30a15e5c411ce3b734307f8513671e

SHA256
b1546a9b274816d3b1c9c8903b9c099391104de6b41607a34d8634b7a9a78078

SHA512
b5b37cde6baab531a3a7e4c9ee7c8b406267faddd3fc1624d648dd8b8f23bfe34bfa125272c6e70cff299ea6fbdc00fd9cac7bbf4b86c3517b6d6908ba434b79

Download Submit
C:\Windows\system\UjZoUjJ.exe

Filesize
1.3MB

MD5
78e9cc6c1c039e58bbce8cb9c8014388

SHA1
165c5823613c989145c9c2ca51e3ed52c03ae9c4

SHA256
ebe752e70e48be467e1b60fbdd6d22bca0ffe3044f2e8475421220996c31823a

SHA512
6ac0df7c312c46b210548ca79285d0b7cc39eb60fa00e43da01241dc2cb40fca877f59384128feb3d2958a2e9a1b49919f49cbd774f35b96d22ea20d950e8bc9

Download Submit
C:\Windows\system\WcgyPrP.exe

Filesize
1.3MB

MD5
be78c699462887fd414e461e2c554e7b

SHA1
59702f832d4630020a371f22f74702b87438e99e

SHA256
3b3532d078956106740224a55c1c1f973317b99ae245271914651831b2306574

SHA512
93c25b92077ce89d02cc22b3407f09ed6e1ab8a3c2f849c48ab6a8d37538fcc5b8d8de97bc901f7a059028e891dab158bf6c47b474fd48bed2a942fbb8e08c04

Download Submit
C:\Windows\system\XMYTLQJ.exe

Filesize
1.3MB

MD5
1045f3ab5fe41bedf012bb1c2fcaffb7

SHA1
1a37c91014ae3615821dff3ee08a78b74079323f

SHA256
7d1770570ac5600d94bb287a1fe5b2c6edc424d210a3daec14d250267b31b269

SHA512
d9f5af2394a7e8efeb7e37b61e666510320c48db1728d146868c37b24d0d6c8eaa6c0eb668e5ba9025f769fd2fbf09ad975521cb5ffaba8c097ae72b047d27a4

Download Submit
C:\Windows\system\ZUQuTwx.exe

Filesize
1.3MB

MD5
041548f58892375e4076d771675132b4

SHA1
671ed58fc3be9c5abb63a9c235e7c8d0fd085970

SHA256
de1c946e5a2544e43eb9578ee9a459781db0cbad7dd22f98f4d39a04f6c2d655

SHA512
d44a823582520ac48658385437d2c1053b817349c9c18d57a2c448621e692abd66a99f8cf6c7a17755616fe0b57a8f786c7c51e89f3b833fb6242a7a276e2648

Download Submit
C:\Windows\system\fwaSLzK.exe

Filesize
1.3MB

MD5
16cd43fae2e0678dec3b19cde0a4a41e

SHA1
45cea04199d2bc53add6aa442e2df9674d09b8ad

SHA256
74314b2322e40f89750222b903720b571d2c7f2d3f71330e75854f3ca6eaad70

SHA512
4d582f68a4b648d359b3512fc6adb67cf6f45533063c1afca227d1897d1c634fbe70d0ee2cde04bd9fc6116abb1a0b21090e9946489ec30470245d77a2dac0b3

Download Submit
C:\Windows\system\hmGVckc.exe

Filesize
1.3MB

MD5
b2d96fd822e0c88fd90d3a0da280d460

SHA1
7490976be58904f7ff4907737328cb00082a31ea

SHA256
1ccac6834f98ef768299089bac80bc177598297ce15c2670b1c343f1d2699844

SHA512
fc5ef4e0e0384e481e9f9eaaeb5c431e431df71561ca3cc01e56f229f73913b6eff83593bcab1672dd5800e16f1a4c45c5399782cff6d320b6c3b8c2411925b2

Download Submit
C:\Windows\system\kpPOyPE.exe

Filesize
1.3MB

MD5
fee121b78e513e8a6852d63a7433019f

SHA1
904f7227a432b50a030d307b10db42ca3d43e924

SHA256
484421d2fe6e45b1db26e6efc8d1d9e8e3688d12c4740adb6ad24c83954f65b2

SHA512
a0b9b94a43c38554d1ddf322208fe7e7a79deda4078276c0632d1757aa9ec3925f4c749da732dea96cbbef6b554b63cb662bff93bb3be4e9e61ad632b21f167e

Download Submit
C:\Windows\system\rGKkDMh.exe

Filesize
1.3MB

MD5
6c4bee1a8c8d310ba6443c7c618f48f5

SHA1
2e7c9790e4788495b8ab2421db7f7edda4e224af

SHA256
2470ec6810f6f8d92d6fb36fea81b31a0c2b3ea53aec3f3cf4f4b2ead72d6b92

SHA512
9056629001fba86298c8139a75b3095e76c8f7840d22b35ceb44e51938587d051c18806cabd0b1518666d05fa1ec3ae0bed1298e79faf877dc3455296b1f3b00

Download Submit
C:\Windows\system\reuegNw.exe

Filesize
1.3MB

MD5
b0374bfc827a6da44f975cc9028cbf48

SHA1
0011287d762d88a4cbc0bc0316f034067cff19fb

SHA256
711cce5f539b385de10055e2137205aacb6dc731fb165ba83a68562202cf29fe

SHA512
5da10e67359a8038422f17d05fb10e38057e7b4e155ce0d8dd52f490b907ad39803a5e982f344d793758f65a21cefc8429297fd602c4a4f073b117ed566f9c14

Download Submit
C:\Windows\system\sNwFQYd.exe

Filesize
1.3MB

MD5
4dad56a6edc67a97c3d3af8f50780cbf

SHA1
f28b2d6ae3ccf7310ff7b850ea0f75741a54ae4c

SHA256
badb40b20dda69321fe0f2ddf519f247402d4be565eb6ac943a3c1603fa08984

SHA512
59fa8db7759bdd198600043e64844f74547eaac06825705ac865c6a916187979a7069e1f09932f55a8805b8de95f234be51e5ecc7c93f7f55b19c377ac76edd0

Download Submit
C:\Windows\system\tWFKNHm.exe

Filesize
1.3MB

MD5
2139565b79e38982940cd4e0bb0ac9c0

SHA1
9bcdad15e96b79fba632ccc16f1b6334d7a8cc9d

SHA256
b65c7e26aacb6ccff0488f24ddcd9d812d2f254d1bf25eede43e3c44088849ae

SHA512
8be44b57a17a0aaa8ac7ba198dbef67a44030c125afe5467f8b7cc171d82746d79f3d6977d471b10da13db15bd97279f6c13ebedaf410d5761f1284804ea83ba

Download Submit
C:\Windows\system\tZKQAnF.exe

Filesize
1.3MB

MD5
60ad406438517916b0605a1982ceec1c

SHA1
ab4f77f9f1657b952fe79967ac117938437fedf6

SHA256
9680ed8900e789de195abf363845d096de78f287983735dee9fb9f1753795a2b

SHA512
a9fba233119dd131482b29dbcf307a38e57cda9d91b34be12fb7f3dc19dc0edf0c536e9811cb1f937348aa3c729bc72d7b49a8bccc2ba58d7d539481c69e08be

Download Submit
C:\Windows\system\vLUmifI.exe

Filesize
1.3MB

MD5
769a768a659ca1dc927e0ca1ad89cc31

SHA1
2b975dc3081cc614071c7a9ca73d59b783276067

SHA256
4aad419e746c3eba5e02590986a521ce798831415862d8cead0758fc1f454338

SHA512
34a7790bc6cb8e0b8245992773323995cfcf3692c5958c4c3b3b2a3b1441608cefbfd539427bc5ee887fc9ba376d0c8434a14df3b0429f04df045a8f7c3c6a54

Download Submit
\Windows\system\AeZLgZY.exe

Filesize
1.3MB

MD5
e2fc571de370183a94148e90118c418a

SHA1
64600a484c66e318f0f5774f6b544fe04307d860

SHA256
992333bb96944367bc0227b441f99c981be3ae9eaa5f54e9558b9549131ad2d8

SHA512
08bcec960dbe8a94ec9921c1488ad66dc42df3948c78779918025df9de2dcd08194e3e08636eaa1079b7b8b5af55c98c0b656085d911e610efbecad3ae786e7f

Download Submit
\Windows\system\CPPeOpS.exe

Filesize
1.3MB

MD5
372af3dbd7942f62c8d3d5498259deb1

SHA1
2a76f8a440dfcad2d5d16b5925671b132237e9a4

SHA256
7e5a6e25d226c1c8b8f959e779a5fb5154299cc96c003ffc7de004376b29ac63

SHA512
19598e5feafe307c613f514820f1fff781195b46ae3477de71b2f82a19f7af7b7903ee9992d0136b9cf75b516f40e402b9961ccb54e2472bbd8a0d8f684bf272

Download Submit
\Windows\system\DXiXVHq.exe

Filesize
1.3MB

MD5
c89833a1bb5a1ea262ac10f0f09bf593

SHA1
075fb1bb9974d1c6652c100e07f25978f213ce42

SHA256
c1a4b1dc83f3978e56addabe46b61502473062ede133bd9cdf8634bc9c494c23

SHA512
12ceb23dcf1ad531182c7f2020b7e675dbfff4aad0158309e448414403eadf22fb66e3b89b91a436d87c76184600b3cfb30c430caee0b12f127065facf3f31db

Download Submit
memory/1596-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download