xmrig | 72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
Size

1.7MB
MD5

371db95a9a6f7b1bbd197a915c4dfe62
SHA1

1c0f41a62ca2525d4c74391c87fad3b349706f2a
SHA256

72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0
SHA512

49d87d3e4e532e98e960049b2a9245d632fe53540881218fcb527b115f337123406cdb911b027f981ed83d7c6abb9b6864ec17d9d980b40a53d62dc16844adb9
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxeqwMaPm:GemTLkNdfE0pZyr

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000a00000001225c-2.dat	xmrig
behavioral1/files/0x000f00000001756e-7.dat	xmrig
behavioral1/files/0x0009000000018b05-14.dat	xmrig
behavioral1/files/0x0007000000018b50-15.dat	xmrig
behavioral1/files/0x0007000000018b54-25.dat	xmrig
behavioral1/files/0x0007000000018b59-29.dat	xmrig
behavioral1/files/0x0009000000018b71-35.dat	xmrig
behavioral1/files/0x0007000000018b89-39.dat	xmrig
behavioral1/files/0x000500000001975a-44.dat	xmrig
behavioral1/files/0x0005000000019761-49.dat	xmrig
behavioral1/files/0x00050000000197fd-54.dat	xmrig
behavioral1/files/0x000500000001998d-65.dat	xmrig
behavioral1/files/0x0005000000019bf6-73.dat	xmrig
behavioral1/files/0x0005000000019c3c-84.dat	xmrig
behavioral1/files/0x0005000000019d61-87.dat	xmrig
behavioral1/files/0x0005000000019d62-94.dat	xmrig
behavioral1/files/0x0005000000019e92-104.dat	xmrig
behavioral1/files/0x0005000000019fd4-109.dat	xmrig
behavioral1/files/0x000500000001a3fd-154.dat	xmrig
behavioral1/files/0x000500000001a400-159.dat	xmrig
behavioral1/files/0x000500000001a3f8-149.dat	xmrig
behavioral1/files/0x000500000001a3f6-144.dat	xmrig
behavioral1/files/0x000500000001a3ab-139.dat	xmrig
behavioral1/files/0x000500000001a309-134.dat	xmrig
behavioral1/files/0x000500000001a0b6-129.dat	xmrig
behavioral1/files/0x000500000001a03c-119.dat	xmrig
behavioral1/files/0x000500000001a049-124.dat	xmrig
behavioral1/files/0x0005000000019fdd-114.dat	xmrig
behavioral1/files/0x0005000000019d6d-99.dat	xmrig
behavioral1/files/0x0005000000019bf9-80.dat	xmrig
behavioral1/files/0x0005000000019bf5-67.dat	xmrig
behavioral1/files/0x0005000000019820-59.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2288	fIFcLQm.exe
2448	UVMGPcq.exe
2860	DLYKWCb.exe
2932	GjqdPgW.exe
2316	xUSYvEU.exe
3024	MMzUvPe.exe
2904	UYRbSZi.exe
2880	wPEblhD.exe
2716	UPblhIO.exe
2760	xqJdZIa.exe
2588	QWhggli.exe
2356	IJlnvgR.exe
2812	fMBUpME.exe
1676	QJzhEJv.exe
2100	PikVYav.exe
2352	XiWdDUf.exe
1484	MEVjEZl.exe
580	yMeJXAQ.exe
2960	bqDQfCe.exe
2172	cNTLaRk.exe
2176	nrTfxjw.exe
1532	DAgLfgA.exe
3028	rivBucO.exe
2024	jhYdvFE.exe
2248	QWrFaaV.exe
2328	hyPmCCf.exe
1612	pirIPjL.exe
2232	kArPRyq.exe
2228	YwIODlg.exe
2236	DJdAOoE.exe
2672	QpHQYHU.exe
1652	qwJkqua.exe
2056	nBWANyg.exe
2432	urcDDGv.exe
1968	sdwDzXC.exe
612	SkEypyk.exe
1408	TOGApUY.exe
660	yczLOYQ.exe
1644	tiIYhLe.exe
2584	CVyufIv.exe
1244	MFCUZQF.exe
2444	KXtcvoB.exe
456	jbriPls.exe
2284	rEySmdV.exe
1456	rorvilU.exe
2524	PNrzeXT.exe
1640	yLhoLsi.exe
1372	sccezDr.exe
1464	ZPIPrUg.exe
1772	OriRNSQ.exe
920	ziEsCdt.exe
472	BVYxOyL.exe
2368	YeFwebM.exe
556	uCjzPdS.exe
1072	HLqkETd.exe
1512	UAwUXqM.exe
2280	uAjiWAv.exe
884	mTMXmMp.exe
2400	dmiuvyE.exe
1620	tWnlaTD.exe
2184	llHXRCz.exe
1608	ZDhMgsc.exe
780	XAHHcyk.exe
2912	tvZbpkP.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\trkPZpB.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\WnhVDDK.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\smSNXJo.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\ZPIPrUg.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\wSSvIGQ.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\KOJSjfR.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\XffnDHT.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\GsJEXOR.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\GuAOmll.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\jONenup.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\LiXrXoB.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\HcsQnQH.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\OQXXuQZ.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\eccYdeO.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\BmVsYbU.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\RsYjJVE.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\wNRaQuq.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\ZTGvwOs.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\dVSBesI.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\zGPYuEF.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\HIfogzY.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\XkGTqHb.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\IcgZBEh.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\zUagXCi.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\trgIJML.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\YSHqOZF.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\aIXrjkj.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\BQteGdB.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\AvQyXTL.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\ZjHmolb.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\fGDtTWq.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\vhdZndC.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\dmiuvyE.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\HqKEJAp.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\MrLxzhu.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\vFWBONg.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\XEcONDu.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\LbDZbxu.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\LzqxKmk.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\llHXRCz.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\tvInMsk.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\kWHseTM.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\PouZLSz.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\szJXtPz.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\xhvMboI.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\WxgTTlG.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\wXVNyIR.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\GShdvzT.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\ztzoXwS.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\TbjpPNg.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\SKfbAll.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\TOMIjEl.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\jltwPaM.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\ZpVCERk.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\HajVIIT.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\qFARXsH.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\viAEyQq.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\tgbzxnT.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\DEWWNOj.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\kWOjzER.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\byURTGY.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\GCOENnf.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\aoRmTxc.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
File created	C:\Windows\System\MPkggAh.exe	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2288	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	30
PID 2380 wrote to memory of 2288	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	30
PID 2380 wrote to memory of 2288	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	30
PID 2380 wrote to memory of 2448	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	31
PID 2380 wrote to memory of 2448	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	31
PID 2380 wrote to memory of 2448	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	31
PID 2380 wrote to memory of 2860	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	32
PID 2380 wrote to memory of 2860	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	32
PID 2380 wrote to memory of 2860	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	32
PID 2380 wrote to memory of 2932	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	33
PID 2380 wrote to memory of 2932	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	33
PID 2380 wrote to memory of 2932	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	33
PID 2380 wrote to memory of 2316	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	34
PID 2380 wrote to memory of 2316	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	34
PID 2380 wrote to memory of 2316	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	34
PID 2380 wrote to memory of 3024	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	35
PID 2380 wrote to memory of 3024	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	35
PID 2380 wrote to memory of 3024	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	35
PID 2380 wrote to memory of 2904	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	36
PID 2380 wrote to memory of 2904	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	36
PID 2380 wrote to memory of 2904	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	36
PID 2380 wrote to memory of 2880	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	37
PID 2380 wrote to memory of 2880	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	37
PID 2380 wrote to memory of 2880	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	37
PID 2380 wrote to memory of 2716	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	38
PID 2380 wrote to memory of 2716	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	38
PID 2380 wrote to memory of 2716	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	38
PID 2380 wrote to memory of 2760	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	39
PID 2380 wrote to memory of 2760	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	39
PID 2380 wrote to memory of 2760	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	39
PID 2380 wrote to memory of 2588	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	40
PID 2380 wrote to memory of 2588	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	40
PID 2380 wrote to memory of 2588	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	40
PID 2380 wrote to memory of 2356	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	41
PID 2380 wrote to memory of 2356	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	41
PID 2380 wrote to memory of 2356	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	41
PID 2380 wrote to memory of 2812	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	42
PID 2380 wrote to memory of 2812	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	42
PID 2380 wrote to memory of 2812	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	42
PID 2380 wrote to memory of 1676	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	43
PID 2380 wrote to memory of 1676	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	43
PID 2380 wrote to memory of 1676	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	43
PID 2380 wrote to memory of 2100	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	44
PID 2380 wrote to memory of 2100	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	44
PID 2380 wrote to memory of 2100	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	44
PID 2380 wrote to memory of 2352	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	45
PID 2380 wrote to memory of 2352	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	45
PID 2380 wrote to memory of 2352	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	45
PID 2380 wrote to memory of 1484	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	46
PID 2380 wrote to memory of 1484	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	46
PID 2380 wrote to memory of 1484	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	46
PID 2380 wrote to memory of 580	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	47
PID 2380 wrote to memory of 580	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	47
PID 2380 wrote to memory of 580	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	47
PID 2380 wrote to memory of 2960	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	48
PID 2380 wrote to memory of 2960	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	48
PID 2380 wrote to memory of 2960	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	48
PID 2380 wrote to memory of 2172	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	49
PID 2380 wrote to memory of 2172	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	49
PID 2380 wrote to memory of 2172	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	49
PID 2380 wrote to memory of 2176	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	50
PID 2380 wrote to memory of 2176	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	50
PID 2380 wrote to memory of 2176	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	50
PID 2380 wrote to memory of 1532	2380	72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe	51

C:\Users\Admin\AppData\Local\Temp\72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe
"C:\Users\Admin\AppData\Local\Temp\72e824ea14f74cb6920bf3f0b227937c722e450f3eff3e0f44ad4cfdfb2b52f0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System\fIFcLQm.exe
  C:\Windows\System\fIFcLQm.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\UVMGPcq.exe
  C:\Windows\System\UVMGPcq.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\DLYKWCb.exe
  C:\Windows\System\DLYKWCb.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\GjqdPgW.exe
  C:\Windows\System\GjqdPgW.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\xUSYvEU.exe
  C:\Windows\System\xUSYvEU.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\MMzUvPe.exe
  C:\Windows\System\MMzUvPe.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\UYRbSZi.exe
  C:\Windows\System\UYRbSZi.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\wPEblhD.exe
  C:\Windows\System\wPEblhD.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\UPblhIO.exe
  C:\Windows\System\UPblhIO.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\xqJdZIa.exe
  C:\Windows\System\xqJdZIa.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\QWhggli.exe
  C:\Windows\System\QWhggli.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\IJlnvgR.exe
  C:\Windows\System\IJlnvgR.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\fMBUpME.exe
  C:\Windows\System\fMBUpME.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QJzhEJv.exe
  C:\Windows\System\QJzhEJv.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\PikVYav.exe
  C:\Windows\System\PikVYav.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\XiWdDUf.exe
  C:\Windows\System\XiWdDUf.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MEVjEZl.exe
  C:\Windows\System\MEVjEZl.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\yMeJXAQ.exe
  C:\Windows\System\yMeJXAQ.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\bqDQfCe.exe
  C:\Windows\System\bqDQfCe.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cNTLaRk.exe
  C:\Windows\System\cNTLaRk.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\nrTfxjw.exe
  C:\Windows\System\nrTfxjw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\DAgLfgA.exe
  C:\Windows\System\DAgLfgA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\rivBucO.exe
  C:\Windows\System\rivBucO.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\jhYdvFE.exe
  C:\Windows\System\jhYdvFE.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\QWrFaaV.exe
  C:\Windows\System\QWrFaaV.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\hyPmCCf.exe
  C:\Windows\System\hyPmCCf.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\pirIPjL.exe
  C:\Windows\System\pirIPjL.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\kArPRyq.exe
  C:\Windows\System\kArPRyq.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\YwIODlg.exe
  C:\Windows\System\YwIODlg.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\DJdAOoE.exe
  C:\Windows\System\DJdAOoE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\QpHQYHU.exe
  C:\Windows\System\QpHQYHU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\qwJkqua.exe
  C:\Windows\System\qwJkqua.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\nBWANyg.exe
  C:\Windows\System\nBWANyg.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\urcDDGv.exe
  C:\Windows\System\urcDDGv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\sdwDzXC.exe
  C:\Windows\System\sdwDzXC.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\SkEypyk.exe
  C:\Windows\System\SkEypyk.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\TOGApUY.exe
  C:\Windows\System\TOGApUY.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\yczLOYQ.exe
  C:\Windows\System\yczLOYQ.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\tiIYhLe.exe
  C:\Windows\System\tiIYhLe.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\CVyufIv.exe
  C:\Windows\System\CVyufIv.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\MFCUZQF.exe
  C:\Windows\System\MFCUZQF.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\KXtcvoB.exe
  C:\Windows\System\KXtcvoB.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jbriPls.exe
  C:\Windows\System\jbriPls.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\rEySmdV.exe
  C:\Windows\System\rEySmdV.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\rorvilU.exe
  C:\Windows\System\rorvilU.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\PNrzeXT.exe
  C:\Windows\System\PNrzeXT.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\yLhoLsi.exe
  C:\Windows\System\yLhoLsi.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\sccezDr.exe
  C:\Windows\System\sccezDr.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ZPIPrUg.exe
  C:\Windows\System\ZPIPrUg.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\OriRNSQ.exe
  C:\Windows\System\OriRNSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ziEsCdt.exe
  C:\Windows\System\ziEsCdt.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\BVYxOyL.exe
  C:\Windows\System\BVYxOyL.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\YeFwebM.exe
  C:\Windows\System\YeFwebM.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\uCjzPdS.exe
  C:\Windows\System\uCjzPdS.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\HLqkETd.exe
  C:\Windows\System\HLqkETd.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\uAjiWAv.exe
  C:\Windows\System\uAjiWAv.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\UAwUXqM.exe
  C:\Windows\System\UAwUXqM.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\mTMXmMp.exe
  C:\Windows\System\mTMXmMp.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\dmiuvyE.exe
  C:\Windows\System\dmiuvyE.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\tWnlaTD.exe
  C:\Windows\System\tWnlaTD.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\llHXRCz.exe
  C:\Windows\System\llHXRCz.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ZDhMgsc.exe
  C:\Windows\System\ZDhMgsc.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\XAHHcyk.exe
  C:\Windows\System\XAHHcyk.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\tvZbpkP.exe
  C:\Windows\System\tvZbpkP.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\pfNqKTk.exe
  C:\Windows\System\pfNqKTk.exe
  2⤵
  PID:2720
- C:\Windows\System\HdZDKKP.exe
  C:\Windows\System\HdZDKKP.exe
  2⤵
  PID:2408
- C:\Windows\System\ReqZLaf.exe
  C:\Windows\System\ReqZLaf.exe
  2⤵
  PID:2876
- C:\Windows\System\UNYtugH.exe
  C:\Windows\System\UNYtugH.exe
  2⤵
  PID:2728
- C:\Windows\System\uvukbJp.exe
  C:\Windows\System\uvukbJp.exe
  2⤵
  PID:2744
- C:\Windows\System\LAlqcTI.exe
  C:\Windows\System\LAlqcTI.exe
  2⤵
  PID:2532
- C:\Windows\System\MsPwSPj.exe
  C:\Windows\System\MsPwSPj.exe
  2⤵
  PID:2780
- C:\Windows\System\dwNpSns.exe
  C:\Windows\System\dwNpSns.exe
  2⤵
  PID:2508
- C:\Windows\System\TgvsoJi.exe
  C:\Windows\System\TgvsoJi.exe
  2⤵
  PID:2252
- C:\Windows\System\iYoqlbX.exe
  C:\Windows\System\iYoqlbX.exe
  2⤵
  PID:2092
- C:\Windows\System\YOWgnpU.exe
  C:\Windows\System\YOWgnpU.exe
  2⤵
  PID:2800
- C:\Windows\System\vywaHRS.exe
  C:\Windows\System\vywaHRS.exe
  2⤵
  PID:3064
- C:\Windows\System\eYkjaUG.exe
  C:\Windows\System\eYkjaUG.exe
  2⤵
  PID:2764
- C:\Windows\System\eaIFtJK.exe
  C:\Windows\System\eaIFtJK.exe
  2⤵
  PID:2036
- C:\Windows\System\yrrEaop.exe
  C:\Windows\System\yrrEaop.exe
  2⤵
  PID:2456
- C:\Windows\System\oLdVscr.exe
  C:\Windows\System\oLdVscr.exe
  2⤵
  PID:1096
- C:\Windows\System\aFfpHEe.exe
  C:\Windows\System\aFfpHEe.exe
  2⤵
  PID:2272
- C:\Windows\System\CgOQfhQ.exe
  C:\Windows\System\CgOQfhQ.exe
  2⤵
  PID:1160
- C:\Windows\System\PQiUOrA.exe
  C:\Windows\System\PQiUOrA.exe
  2⤵
  PID:2428
- C:\Windows\System\jgBRaoK.exe
  C:\Windows\System\jgBRaoK.exe
  2⤵
  PID:2336
- C:\Windows\System\ItOwkhg.exe
  C:\Windows\System\ItOwkhg.exe
  2⤵
  PID:848
- C:\Windows\System\NyJdQop.exe
  C:\Windows\System\NyJdQop.exe
  2⤵
  PID:2156
- C:\Windows\System\fCInOHI.exe
  C:\Windows\System\fCInOHI.exe
  2⤵
  PID:972
- C:\Windows\System\kLktIec.exe
  C:\Windows\System\kLktIec.exe
  2⤵
  PID:2596
- C:\Windows\System\aiCMrQx.exe
  C:\Windows\System\aiCMrQx.exe
  2⤵
  PID:2068
- C:\Windows\System\eCKgMQl.exe
  C:\Windows\System\eCKgMQl.exe
  2⤵
  PID:3036
- C:\Windows\System\CrdjQzJ.exe
  C:\Windows\System\CrdjQzJ.exe
  2⤵
  PID:1200
- C:\Windows\System\wDObnMD.exe
  C:\Windows\System\wDObnMD.exe
  2⤵
  PID:592
- C:\Windows\System\zEuvxYu.exe
  C:\Windows\System\zEuvxYu.exe
  2⤵
  PID:540
- C:\Windows\System\dRSCMOM.exe
  C:\Windows\System\dRSCMOM.exe
  2⤵
  PID:1296
- C:\Windows\System\BQteGdB.exe
  C:\Windows\System\BQteGdB.exe
  2⤵
  PID:2732
- C:\Windows\System\eVOKHop.exe
  C:\Windows\System\eVOKHop.exe
  2⤵
  PID:2204
- C:\Windows\System\ONpkOXm.exe
  C:\Windows\System\ONpkOXm.exe
  2⤵
  PID:2536
- C:\Windows\System\oaNvZXt.exe
  C:\Windows\System\oaNvZXt.exe
  2⤵
  PID:1832
- C:\Windows\System\gjChGeH.exe
  C:\Windows\System\gjChGeH.exe
  2⤵
  PID:2128
- C:\Windows\System\QgdLBNN.exe
  C:\Windows\System\QgdLBNN.exe
  2⤵
  PID:1056
- C:\Windows\System\sSAoiCs.exe
  C:\Windows\System\sSAoiCs.exe
  2⤵
  PID:640
- C:\Windows\System\ehAHJuW.exe
  C:\Windows\System\ehAHJuW.exe
  2⤵
  PID:844
- C:\Windows\System\oGuRtRi.exe
  C:\Windows\System\oGuRtRi.exe
  2⤵
  PID:2476
- C:\Windows\System\BlTjKaR.exe
  C:\Windows\System\BlTjKaR.exe
  2⤵
  PID:1992
- C:\Windows\System\pFzfAuP.exe
  C:\Windows\System\pFzfAuP.exe
  2⤵
  PID:1792
- C:\Windows\System\iBjXckh.exe
  C:\Windows\System\iBjXckh.exe
  2⤵
  PID:572
- C:\Windows\System\ncfzKKK.exe
  C:\Windows\System\ncfzKKK.exe
  2⤵
  PID:2544
- C:\Windows\System\VcKhmwg.exe
  C:\Windows\System\VcKhmwg.exe
  2⤵
  PID:2324
- C:\Windows\System\YzPBOEb.exe
  C:\Windows\System\YzPBOEb.exe
  2⤵
  PID:236
- C:\Windows\System\AuVzLsp.exe
  C:\Windows\System\AuVzLsp.exe
  2⤵
  PID:2276
- C:\Windows\System\mOEtPok.exe
  C:\Windows\System\mOEtPok.exe
  2⤵
  PID:2552
- C:\Windows\System\cCBflgD.exe
  C:\Windows\System\cCBflgD.exe
  2⤵
  PID:1604
- C:\Windows\System\rNdoQWx.exe
  C:\Windows\System\rNdoQWx.exe
  2⤵
  PID:2144
- C:\Windows\System\HCbffKN.exe
  C:\Windows\System\HCbffKN.exe
  2⤵
  PID:2992
- C:\Windows\System\ACnzcNk.exe
  C:\Windows\System\ACnzcNk.exe
  2⤵
  PID:2824
- C:\Windows\System\ZlphsLh.exe
  C:\Windows\System\ZlphsLh.exe
  2⤵
  PID:2944
- C:\Windows\System\YtmXyrP.exe
  C:\Windows\System\YtmXyrP.exe
  2⤵
  PID:1064
- C:\Windows\System\pRTnKsU.exe
  C:\Windows\System\pRTnKsU.exe
  2⤵
  PID:3048
- C:\Windows\System\PiByoPR.exe
  C:\Windows\System\PiByoPR.exe
  2⤵
  PID:2956
- C:\Windows\System\IAnBVQo.exe
  C:\Windows\System\IAnBVQo.exe
  2⤵
  PID:2540
- C:\Windows\System\uzwfotP.exe
  C:\Windows\System\uzwfotP.exe
  2⤵
  PID:436
- C:\Windows\System\wrVVQFD.exe
  C:\Windows\System\wrVVQFD.exe
  2⤵
  PID:2188
- C:\Windows\System\SkuWQPS.exe
  C:\Windows\System\SkuWQPS.exe
  2⤵
  PID:1812
- C:\Windows\System\vKPlHSi.exe
  C:\Windows\System\vKPlHSi.exe
  2⤵
  PID:2480
- C:\Windows\System\SMSnGxy.exe
  C:\Windows\System\SMSnGxy.exe
  2⤵
  PID:2052
- C:\Windows\System\LjnxOeV.exe
  C:\Windows\System\LjnxOeV.exe
  2⤵
  PID:2140
- C:\Windows\System\OEgUwrh.exe
  C:\Windows\System\OEgUwrh.exe
  2⤵
  PID:2484
- C:\Windows\System\oUQlvMJ.exe
  C:\Windows\System\oUQlvMJ.exe
  2⤵
  PID:2736
- C:\Windows\System\tErlRTe.exe
  C:\Windows\System\tErlRTe.exe
  2⤵
  PID:3020
- C:\Windows\System\nePVPXO.exe
  C:\Windows\System\nePVPXO.exe
  2⤵
  PID:1260
- C:\Windows\System\GugPpBi.exe
  C:\Windows\System\GugPpBi.exe
  2⤵
  PID:2240
- C:\Windows\System\LjLJIyZ.exe
  C:\Windows\System\LjLJIyZ.exe
  2⤵
  PID:3056
- C:\Windows\System\QEbNQdV.exe
  C:\Windows\System\QEbNQdV.exe
  2⤵
  PID:1312
- C:\Windows\System\XXRbBUq.exe
  C:\Windows\System\XXRbBUq.exe
  2⤵
  PID:2320
- C:\Windows\System\aESFBKN.exe
  C:\Windows\System\aESFBKN.exe
  2⤵
  PID:2980
- C:\Windows\System\BTOVssT.exe
  C:\Windows\System\BTOVssT.exe
  2⤵
  PID:388
- C:\Windows\System\jkBaUXX.exe
  C:\Windows\System\jkBaUXX.exe
  2⤵
  PID:2556
- C:\Windows\System\SXMKTlX.exe
  C:\Windows\System\SXMKTlX.exe
  2⤵
  PID:2008
- C:\Windows\System\EUQyQod.exe
  C:\Windows\System\EUQyQod.exe
  2⤵
  PID:924
- C:\Windows\System\gypFMsH.exe
  C:\Windows\System\gypFMsH.exe
  2⤵
  PID:1780
- C:\Windows\System\BBgdBrb.exe
  C:\Windows\System\BBgdBrb.exe
  2⤵
  PID:1304
- C:\Windows\System\yPYGNbS.exe
  C:\Windows\System\yPYGNbS.exe
  2⤵
  PID:1748
- C:\Windows\System\SotTQCP.exe
  C:\Windows\System\SotTQCP.exe
  2⤵
  PID:2256
- C:\Windows\System\ldofjMW.exe
  C:\Windows\System\ldofjMW.exe
  2⤵
  PID:2852
- C:\Windows\System\doHAdQg.exe
  C:\Windows\System\doHAdQg.exe
  2⤵
  PID:3016
- C:\Windows\System\dyTSUIf.exe
  C:\Windows\System\dyTSUIf.exe
  2⤵
  PID:2608
- C:\Windows\System\uOxmvWs.exe
  C:\Windows\System\uOxmvWs.exe
  2⤵
  PID:1660
- C:\Windows\System\gWFayUN.exe
  C:\Windows\System\gWFayUN.exe
  2⤵
  PID:2152
- C:\Windows\System\YtRXdzi.exe
  C:\Windows\System\YtRXdzi.exe
  2⤵
  PID:2332
- C:\Windows\System\xvcqsde.exe
  C:\Windows\System\xvcqsde.exe
  2⤵
  PID:1536
- C:\Windows\System\dsgxvXq.exe
  C:\Windows\System\dsgxvXq.exe
  2⤵
  PID:2244
- C:\Windows\System\AGkLWVv.exe
  C:\Windows\System\AGkLWVv.exe
  2⤵
  PID:2064
- C:\Windows\System\ztzoXwS.exe
  C:\Windows\System\ztzoXwS.exe
  2⤵
  PID:2808
- C:\Windows\System\fWKvPey.exe
  C:\Windows\System\fWKvPey.exe
  2⤵
  PID:2260
- C:\Windows\System\qGnJFij.exe
  C:\Windows\System\qGnJFij.exe
  2⤵
  PID:1448
- C:\Windows\System\WubDsME.exe
  C:\Windows\System\WubDsME.exe
  2⤵
  PID:1148
- C:\Windows\System\BlRHgaK.exe
  C:\Windows\System\BlRHgaK.exe
  2⤵
  PID:2032
- C:\Windows\System\JIZvtdA.exe
  C:\Windows\System\JIZvtdA.exe
  2⤵
  PID:1816
- C:\Windows\System\FyJlwwr.exe
  C:\Windows\System\FyJlwwr.exe
  2⤵
  PID:568
- C:\Windows\System\FazKxpT.exe
  C:\Windows\System\FazKxpT.exe
  2⤵
  PID:1672
- C:\Windows\System\KIiNTKg.exe
  C:\Windows\System\KIiNTKg.exe
  2⤵
  PID:948
- C:\Windows\System\Jmrppse.exe
  C:\Windows\System\Jmrppse.exe
  2⤵
  PID:1600
- C:\Windows\System\DtMaTVz.exe
  C:\Windows\System\DtMaTVz.exe
  2⤵
  PID:3012
- C:\Windows\System\oHgNlZz.exe
  C:\Windows\System\oHgNlZz.exe
  2⤵
  PID:2636
- C:\Windows\System\BLULVsL.exe
  C:\Windows\System\BLULVsL.exe
  2⤵
  PID:2768
- C:\Windows\System\LGAOgOJ.exe
  C:\Windows\System\LGAOgOJ.exe
  2⤵
  PID:2952
- C:\Windows\System\NRLakJi.exe
  C:\Windows\System\NRLakJi.exe
  2⤵
  PID:1744
- C:\Windows\System\jONenup.exe
  C:\Windows\System\jONenup.exe
  2⤵
  PID:2516
- C:\Windows\System\wVqVIUW.exe
  C:\Windows\System\wVqVIUW.exe
  2⤵
  PID:976
- C:\Windows\System\qFVYTUh.exe
  C:\Windows\System\qFVYTUh.exe
  2⤵
  PID:2972
- C:\Windows\System\faDOLfS.exe
  C:\Windows\System\faDOLfS.exe
  2⤵
  PID:1820
- C:\Windows\System\JERQiDU.exe
  C:\Windows\System\JERQiDU.exe
  2⤵
  PID:2436
- C:\Windows\System\AOThMvZ.exe
  C:\Windows\System\AOThMvZ.exe
  2⤵
  PID:1576
- C:\Windows\System\TWycbfH.exe
  C:\Windows\System\TWycbfH.exe
  2⤵
  PID:1692
- C:\Windows\System\jMVKjpj.exe
  C:\Windows\System\jMVKjpj.exe
  2⤵
  PID:2884
- C:\Windows\System\VFiiZSV.exe
  C:\Windows\System\VFiiZSV.exe
  2⤵
  PID:2724
- C:\Windows\System\XyJRAwn.exe
  C:\Windows\System\XyJRAwn.exe
  2⤵
  PID:2580
- C:\Windows\System\Meosbat.exe
  C:\Windows\System\Meosbat.exe
  2⤵
  PID:3080
- C:\Windows\System\NDDsHDx.exe
  C:\Windows\System\NDDsHDx.exe
  2⤵
  PID:3096
- C:\Windows\System\PFJJOts.exe
  C:\Windows\System\PFJJOts.exe
  2⤵
  PID:3112
- C:\Windows\System\YpTbAyx.exe
  C:\Windows\System\YpTbAyx.exe
  2⤵
  PID:3128
- C:\Windows\System\lDBmIUS.exe
  C:\Windows\System\lDBmIUS.exe
  2⤵
  PID:3144
- C:\Windows\System\zgxtQkO.exe
  C:\Windows\System\zgxtQkO.exe
  2⤵
  PID:3160
- C:\Windows\System\OyMLbIs.exe
  C:\Windows\System\OyMLbIs.exe
  2⤵
  PID:3176
- C:\Windows\System\ZuHaQVC.exe
  C:\Windows\System\ZuHaQVC.exe
  2⤵
  PID:3192
- C:\Windows\System\ocoiUQa.exe
  C:\Windows\System\ocoiUQa.exe
  2⤵
  PID:3208
- C:\Windows\System\CETNvIP.exe
  C:\Windows\System\CETNvIP.exe
  2⤵
  PID:3224
- C:\Windows\System\UwKKADq.exe
  C:\Windows\System\UwKKADq.exe
  2⤵
  PID:3240
- C:\Windows\System\ifpOoin.exe
  C:\Windows\System\ifpOoin.exe
  2⤵
  PID:3256
- C:\Windows\System\quIPbyb.exe
  C:\Windows\System\quIPbyb.exe
  2⤵
  PID:3272
- C:\Windows\System\asgRTYD.exe
  C:\Windows\System\asgRTYD.exe
  2⤵
  PID:3288
- C:\Windows\System\zqIeZPO.exe
  C:\Windows\System\zqIeZPO.exe
  2⤵
  PID:3304
- C:\Windows\System\eRvskgV.exe
  C:\Windows\System\eRvskgV.exe
  2⤵
  PID:3320
- C:\Windows\System\uExGaWg.exe
  C:\Windows\System\uExGaWg.exe
  2⤵
  PID:3336
- C:\Windows\System\DjPnImD.exe
  C:\Windows\System\DjPnImD.exe
  2⤵
  PID:3352
- C:\Windows\System\QwqJBUb.exe
  C:\Windows\System\QwqJBUb.exe
  2⤵
  PID:3368
- C:\Windows\System\Jxhlwjn.exe
  C:\Windows\System\Jxhlwjn.exe
  2⤵
  PID:3384
- C:\Windows\System\pxZFeaJ.exe
  C:\Windows\System\pxZFeaJ.exe
  2⤵
  PID:3400
- C:\Windows\System\RqRegGc.exe
  C:\Windows\System\RqRegGc.exe
  2⤵
  PID:3416
- C:\Windows\System\tvInMsk.exe
  C:\Windows\System\tvInMsk.exe
  2⤵
  PID:3432
- C:\Windows\System\toaUjCU.exe
  C:\Windows\System\toaUjCU.exe
  2⤵
  PID:3448
- C:\Windows\System\ufJIHGW.exe
  C:\Windows\System\ufJIHGW.exe
  2⤵
  PID:3464
- C:\Windows\System\nmTOmrI.exe
  C:\Windows\System\nmTOmrI.exe
  2⤵
  PID:3480
- C:\Windows\System\nGuEzwB.exe
  C:\Windows\System\nGuEzwB.exe
  2⤵
  PID:3496
- C:\Windows\System\XnEoCBm.exe
  C:\Windows\System\XnEoCBm.exe
  2⤵
  PID:3512
- C:\Windows\System\XKKadir.exe
  C:\Windows\System\XKKadir.exe
  2⤵
  PID:3528
- C:\Windows\System\oXRyuOj.exe
  C:\Windows\System\oXRyuOj.exe
  2⤵
  PID:3544
- C:\Windows\System\pcncjaA.exe
  C:\Windows\System\pcncjaA.exe
  2⤵
  PID:3560
- C:\Windows\System\eyHSMia.exe
  C:\Windows\System\eyHSMia.exe
  2⤵
  PID:3576
- C:\Windows\System\QAYhvzc.exe
  C:\Windows\System\QAYhvzc.exe
  2⤵
  PID:3592
- C:\Windows\System\hRtCURv.exe
  C:\Windows\System\hRtCURv.exe
  2⤵
  PID:3612
- C:\Windows\System\SmkMykM.exe
  C:\Windows\System\SmkMykM.exe
  2⤵
  PID:3628
- C:\Windows\System\YappgHX.exe
  C:\Windows\System\YappgHX.exe
  2⤵
  PID:3644
- C:\Windows\System\myOExQB.exe
  C:\Windows\System\myOExQB.exe
  2⤵
  PID:3660
- C:\Windows\System\FKGgeIB.exe
  C:\Windows\System\FKGgeIB.exe
  2⤵
  PID:3676
- C:\Windows\System\fSlgTMQ.exe
  C:\Windows\System\fSlgTMQ.exe
  2⤵
  PID:3696
- C:\Windows\System\ljcfLYM.exe
  C:\Windows\System\ljcfLYM.exe
  2⤵
  PID:3712
- C:\Windows\System\wgbRsvl.exe
  C:\Windows\System\wgbRsvl.exe
  2⤵
  PID:3728
- C:\Windows\System\jiWspcH.exe
  C:\Windows\System\jiWspcH.exe
  2⤵
  PID:3744
- C:\Windows\System\VobUpaG.exe
  C:\Windows\System\VobUpaG.exe
  2⤵
  PID:3760
- C:\Windows\System\nPJVpjF.exe
  C:\Windows\System\nPJVpjF.exe
  2⤵
  PID:3784
- C:\Windows\System\PTToeCI.exe
  C:\Windows\System\PTToeCI.exe
  2⤵
  PID:3800
- C:\Windows\System\OHVwCoh.exe
  C:\Windows\System\OHVwCoh.exe
  2⤵
  PID:3816
- C:\Windows\System\QVtLYJL.exe
  C:\Windows\System\QVtLYJL.exe
  2⤵
  PID:3832
- C:\Windows\System\IKSuTag.exe
  C:\Windows\System\IKSuTag.exe
  2⤵
  PID:3848
- C:\Windows\System\WnVhGHh.exe
  C:\Windows\System\WnVhGHh.exe
  2⤵
  PID:3868
- C:\Windows\System\mRwNxma.exe
  C:\Windows\System\mRwNxma.exe
  2⤵
  PID:3884
- C:\Windows\System\iKqDlOx.exe
  C:\Windows\System\iKqDlOx.exe
  2⤵
  PID:3900
- C:\Windows\System\qybApwV.exe
  C:\Windows\System\qybApwV.exe
  2⤵
  PID:3920
- C:\Windows\System\RhbGqmM.exe
  C:\Windows\System\RhbGqmM.exe
  2⤵
  PID:3936
- C:\Windows\System\HzXwylL.exe
  C:\Windows\System\HzXwylL.exe
  2⤵
  PID:3952
- C:\Windows\System\UJPjGNY.exe
  C:\Windows\System\UJPjGNY.exe
  2⤵
  PID:3968
- C:\Windows\System\hMIgPAy.exe
  C:\Windows\System\hMIgPAy.exe
  2⤵
  PID:3984
- C:\Windows\System\tCQXTau.exe
  C:\Windows\System\tCQXTau.exe
  2⤵
  PID:4000
- C:\Windows\System\ipkDOTo.exe
  C:\Windows\System\ipkDOTo.exe
  2⤵
  PID:4016
- C:\Windows\System\nnLzurE.exe
  C:\Windows\System\nnLzurE.exe
  2⤵
  PID:4032
- C:\Windows\System\kfEgnFq.exe
  C:\Windows\System\kfEgnFq.exe
  2⤵
  PID:4048
- C:\Windows\System\TluQnSB.exe
  C:\Windows\System\TluQnSB.exe
  2⤵
  PID:4064
- C:\Windows\System\lZhvusa.exe
  C:\Windows\System\lZhvusa.exe
  2⤵
  PID:4080
- C:\Windows\System\BcwAeyS.exe
  C:\Windows\System\BcwAeyS.exe
  2⤵
  PID:3092
- C:\Windows\System\ZKIBMot.exe
  C:\Windows\System\ZKIBMot.exe
  2⤵
  PID:2652
- C:\Windows\System\ZUlKpgw.exe
  C:\Windows\System\ZUlKpgw.exe
  2⤵
  PID:3216
- C:\Windows\System\yxwzYCh.exe
  C:\Windows\System\yxwzYCh.exe
  2⤵
  PID:3120
- C:\Windows\System\qjDJvJc.exe
  C:\Windows\System\qjDJvJc.exe
  2⤵
  PID:3184
- C:\Windows\System\oTJRgEN.exe
  C:\Windows\System\oTJRgEN.exe
  2⤵
  PID:3312
- C:\Windows\System\LZjOCpU.exe
  C:\Windows\System\LZjOCpU.exe
  2⤵
  PID:3380
- C:\Windows\System\ahtnwJf.exe
  C:\Windows\System\ahtnwJf.exe
  2⤵
  PID:3440
- C:\Windows\System\MVJyOmT.exe
  C:\Windows\System\MVJyOmT.exe
  2⤵
  PID:3136
- C:\Windows\System\OIVywRC.exe
  C:\Windows\System\OIVywRC.exe
  2⤵
  PID:3508
- C:\Windows\System\NSPcmWV.exe
  C:\Windows\System\NSPcmWV.exe
  2⤵
  PID:2604
- C:\Windows\System\LUAObHq.exe
  C:\Windows\System\LUAObHq.exe
  2⤵
  PID:900
- C:\Windows\System\yqjWNFy.exe
  C:\Windows\System\yqjWNFy.exe
  2⤵
  PID:1840
- C:\Windows\System\iMtTUjM.exe
  C:\Windows\System\iMtTUjM.exe
  2⤵
  PID:3104
- C:\Windows\System\iMPokvW.exe
  C:\Windows\System\iMPokvW.exe
  2⤵
  PID:3172
- C:\Windows\System\AeDGLPm.exe
  C:\Windows\System\AeDGLPm.exe
  2⤵
  PID:3264
- C:\Windows\System\iFYpqRW.exe
  C:\Windows\System\iFYpqRW.exe
  2⤵
  PID:3328
- C:\Windows\System\NlnamuZ.exe
  C:\Windows\System\NlnamuZ.exe
  2⤵
  PID:3156
- C:\Windows\System\QwgCSNB.exe
  C:\Windows\System\QwgCSNB.exe
  2⤵
  PID:2168
- C:\Windows\System\AuDAFLb.exe
  C:\Windows\System\AuDAFLb.exe
  2⤵
  PID:3300
- C:\Windows\System\ykHJzAZ.exe
  C:\Windows\System\ykHJzAZ.exe
  2⤵
  PID:1076
- C:\Windows\System\RUzDEFc.exe
  C:\Windows\System\RUzDEFc.exe
  2⤵
  PID:3584
- C:\Windows\System\YmGXWeR.exe
  C:\Windows\System\YmGXWeR.exe
  2⤵
  PID:3620
- C:\Windows\System\eMuXDzg.exe
  C:\Windows\System\eMuXDzg.exe
  2⤵
  PID:3756
- C:\Windows\System\hQWzdXg.exe
  C:\Windows\System\hQWzdXg.exe
  2⤵
  PID:3768
- C:\Windows\System\sChjCmL.exe
  C:\Windows\System\sChjCmL.exe
  2⤵
  PID:3792
- C:\Windows\System\JRuwYmr.exe
  C:\Windows\System\JRuwYmr.exe
  2⤵
  PID:3856
- C:\Windows\System\KOjQlAi.exe
  C:\Windows\System\KOjQlAi.exe
  2⤵
  PID:3916
- C:\Windows\System\sIAwjtY.exe
  C:\Windows\System\sIAwjtY.exe
  2⤵
  PID:4008
- C:\Windows\System\leFpALw.exe
  C:\Windows\System\leFpALw.exe
  2⤵
  PID:4044
- C:\Windows\System\CtPbNyU.exe
  C:\Windows\System\CtPbNyU.exe
  2⤵
  PID:2988
- C:\Windows\System\nZcZXbi.exe
  C:\Windows\System\nZcZXbi.exe
  2⤵
  PID:3892
- C:\Windows\System\AJYOhcU.exe
  C:\Windows\System\AJYOhcU.exe
  2⤵
  PID:3996
- C:\Windows\System\EEFFawV.exe
  C:\Windows\System\EEFFawV.exe
  2⤵
  PID:4060
- C:\Windows\System\TYSjslJ.exe
  C:\Windows\System\TYSjslJ.exe
  2⤵
  PID:3280
- C:\Windows\System\wSCYECo.exe
  C:\Windows\System\wSCYECo.exe
  2⤵
  PID:3412
- C:\Windows\System\qKamRiQ.exe
  C:\Windows\System\qKamRiQ.exe
  2⤵
  PID:3152
- C:\Windows\System\bEVEEPW.exe
  C:\Windows\System\bEVEEPW.exe
  2⤵
  PID:3456
- C:\Windows\System\FprONDY.exe
  C:\Windows\System\FprONDY.exe
  2⤵
  PID:3168
- C:\Windows\System\eCeqSfZ.exe
  C:\Windows\System\eCeqSfZ.exe
  2⤵
  PID:3488
- C:\Windows\System\rzbmkeY.exe
  C:\Windows\System\rzbmkeY.exe
  2⤵
  PID:3524
- C:\Windows\System\tszHjZe.exe
  C:\Windows\System\tszHjZe.exe
  2⤵
  PID:3588
- C:\Windows\System\cHcIqeu.exe
  C:\Windows\System\cHcIqeu.exe
  2⤵
  PID:3704
- C:\Windows\System\qjlCqtZ.exe
  C:\Windows\System\qjlCqtZ.exe
  2⤵
  PID:3692
- C:\Windows\System\atFANkB.exe
  C:\Windows\System\atFANkB.exe
  2⤵
  PID:3812
- C:\Windows\System\hXpZwbT.exe
  C:\Windows\System\hXpZwbT.exe
  2⤵
  PID:3880
- C:\Windows\System\WoICnzm.exe
  C:\Windows\System\WoICnzm.exe
  2⤵
  PID:4076
- C:\Windows\System\RbezPpE.exe
  C:\Windows\System\RbezPpE.exe
  2⤵
  PID:4056
- C:\Windows\System\GIksaNe.exe
  C:\Windows\System\GIksaNe.exe
  2⤵
  PID:3364
- C:\Windows\System\sAZKTHQ.exe
  C:\Windows\System\sAZKTHQ.exe
  2⤵
  PID:3536
- C:\Windows\System\eJAfNez.exe
  C:\Windows\System\eJAfNez.exe
  2⤵
  PID:3864
- C:\Windows\System\ReQCJqH.exe
  C:\Windows\System\ReQCJqH.exe
  2⤵
  PID:4072
- C:\Windows\System\Vcidwck.exe
  C:\Windows\System\Vcidwck.exe
  2⤵
  PID:3424
- C:\Windows\System\OtsreLB.exe
  C:\Windows\System\OtsreLB.exe
  2⤵
  PID:2112
- C:\Windows\System\WQcKAgM.exe
  C:\Windows\System\WQcKAgM.exe
  2⤵
  PID:3908
- C:\Windows\System\WdpZBzl.exe
  C:\Windows\System\WdpZBzl.exe
  2⤵
  PID:4088
- C:\Windows\System\CAmeyEd.exe
  C:\Windows\System\CAmeyEd.exe
  2⤵
  PID:3188
- C:\Windows\System\nqZCREK.exe
  C:\Windows\System\nqZCREK.exe
  2⤵
  PID:3720
- C:\Windows\System\IovkhYn.exe
  C:\Windows\System\IovkhYn.exe
  2⤵
  PID:3408
- C:\Windows\System\BlKSbSi.exe
  C:\Windows\System\BlKSbSi.exe
  2⤵
  PID:3992
- C:\Windows\System\uBjiRZl.exe
  C:\Windows\System\uBjiRZl.exe
  2⤵
  PID:3392
- C:\Windows\System\kVpgESF.exe
  C:\Windows\System\kVpgESF.exe
  2⤵
  PID:3668
- C:\Windows\System\kboFHXR.exe
  C:\Windows\System\kboFHXR.exe
  2⤵
  PID:3600
- C:\Windows\System\RtsUhHD.exe
  C:\Windows\System\RtsUhHD.exe
  2⤵
  PID:3948
- C:\Windows\System\gRTjMtW.exe
  C:\Windows\System\gRTjMtW.exe
  2⤵
  PID:4108
- C:\Windows\System\sVNmYGo.exe
  C:\Windows\System\sVNmYGo.exe
  2⤵
  PID:4124
- C:\Windows\System\luQjQtK.exe
  C:\Windows\System\luQjQtK.exe
  2⤵
  PID:4144
- C:\Windows\System\rApsubA.exe
  C:\Windows\System\rApsubA.exe
  2⤵
  PID:4160
- C:\Windows\System\yIVZsZs.exe
  C:\Windows\System\yIVZsZs.exe
  2⤵
  PID:4180
- C:\Windows\System\TZMKhlU.exe
  C:\Windows\System\TZMKhlU.exe
  2⤵
  PID:4200
- C:\Windows\System\jNKeUPH.exe
  C:\Windows\System\jNKeUPH.exe
  2⤵
  PID:4220
- C:\Windows\System\KdTtLIJ.exe
  C:\Windows\System\KdTtLIJ.exe
  2⤵
  PID:4236
- C:\Windows\System\hFDEbnI.exe
  C:\Windows\System\hFDEbnI.exe
  2⤵
  PID:4256
- C:\Windows\System\lUJukfz.exe
  C:\Windows\System\lUJukfz.exe
  2⤵
  PID:4340
- C:\Windows\System\lZOJBkq.exe
  C:\Windows\System\lZOJBkq.exe
  2⤵
  PID:4360
- C:\Windows\System\yeCNxGU.exe
  C:\Windows\System\yeCNxGU.exe
  2⤵
  PID:4380
- C:\Windows\System\tyWSpvL.exe
  C:\Windows\System\tyWSpvL.exe
  2⤵
  PID:4396
- C:\Windows\System\FeReSTD.exe
  C:\Windows\System\FeReSTD.exe
  2⤵
  PID:4412
- C:\Windows\System\ABJqEpe.exe
  C:\Windows\System\ABJqEpe.exe
  2⤵
  PID:4448
- C:\Windows\System\YMQzWPF.exe
  C:\Windows\System\YMQzWPF.exe
  2⤵
  PID:4464
- C:\Windows\System\hihCwSc.exe
  C:\Windows\System\hihCwSc.exe
  2⤵
  PID:4484
- C:\Windows\System\WgIBXit.exe
  C:\Windows\System\WgIBXit.exe
  2⤵
  PID:4500
- C:\Windows\System\fZXbAsI.exe
  C:\Windows\System\fZXbAsI.exe
  2⤵
  PID:4516
- C:\Windows\System\UpzAYTW.exe
  C:\Windows\System\UpzAYTW.exe
  2⤵
  PID:4532
- C:\Windows\System\asrtsUN.exe
  C:\Windows\System\asrtsUN.exe
  2⤵
  PID:4552
- C:\Windows\System\Nsmjnev.exe
  C:\Windows\System\Nsmjnev.exe
  2⤵
  PID:4568
- C:\Windows\System\JjfkpaN.exe
  C:\Windows\System\JjfkpaN.exe
  2⤵
  PID:4588
- C:\Windows\System\ExaBNRA.exe
  C:\Windows\System\ExaBNRA.exe
  2⤵
  PID:4604
- C:\Windows\System\YGuZpdP.exe
  C:\Windows\System\YGuZpdP.exe
  2⤵
  PID:4620
- C:\Windows\System\xYTmwHd.exe
  C:\Windows\System\xYTmwHd.exe
  2⤵
  PID:4648
- C:\Windows\System\MvUDutO.exe
  C:\Windows\System\MvUDutO.exe
  2⤵
  PID:4664
- C:\Windows\System\BHHRfFL.exe
  C:\Windows\System\BHHRfFL.exe
  2⤵
  PID:4684
- C:\Windows\System\OdiTmPT.exe
  C:\Windows\System\OdiTmPT.exe
  2⤵
  PID:4716
- C:\Windows\System\yufFUsY.exe
  C:\Windows\System\yufFUsY.exe
  2⤵
  PID:4732
- C:\Windows\System\OnXvYUZ.exe
  C:\Windows\System\OnXvYUZ.exe
  2⤵
  PID:4764
- C:\Windows\System\IrmEsZL.exe
  C:\Windows\System\IrmEsZL.exe
  2⤵
  PID:4780
- C:\Windows\System\ciJnYxH.exe
  C:\Windows\System\ciJnYxH.exe
  2⤵
  PID:4812
- C:\Windows\System\sglkHsg.exe
  C:\Windows\System\sglkHsg.exe
  2⤵
  PID:4828
- C:\Windows\System\JNZfqhz.exe
  C:\Windows\System\JNZfqhz.exe
  2⤵
  PID:4848
- C:\Windows\System\KUvAdrp.exe
  C:\Windows\System\KUvAdrp.exe
  2⤵
  PID:4864
- C:\Windows\System\PlTRExw.exe
  C:\Windows\System\PlTRExw.exe
  2⤵
  PID:4880
- C:\Windows\System\KzuSqCp.exe
  C:\Windows\System\KzuSqCp.exe
  2⤵
  PID:4896
- C:\Windows\System\RIWkYwL.exe
  C:\Windows\System\RIWkYwL.exe
  2⤵
  PID:4916
- C:\Windows\System\dWehJux.exe
  C:\Windows\System\dWehJux.exe
  2⤵
  PID:4932
- C:\Windows\System\WJNHcvO.exe
  C:\Windows\System\WJNHcvO.exe
  2⤵
  PID:4952
- C:\Windows\System\akgqesh.exe
  C:\Windows\System\akgqesh.exe
  2⤵
  PID:4972
- C:\Windows\System\kuSCTBf.exe
  C:\Windows\System\kuSCTBf.exe
  2⤵
  PID:5000
- C:\Windows\System\qxamVyL.exe
  C:\Windows\System\qxamVyL.exe
  2⤵
  PID:5016
- C:\Windows\System\sRyVBvY.exe
  C:\Windows\System\sRyVBvY.exe
  2⤵
  PID:5032
- C:\Windows\System\GHijZfP.exe
  C:\Windows\System\GHijZfP.exe
  2⤵
  PID:5048
- C:\Windows\System\jtnoPlX.exe
  C:\Windows\System\jtnoPlX.exe
  2⤵
  PID:5068
- C:\Windows\System\tyvnzPk.exe
  C:\Windows\System\tyvnzPk.exe
  2⤵
  PID:5084
- C:\Windows\System\ppfeBwT.exe
  C:\Windows\System\ppfeBwT.exe
  2⤵
  PID:5108
- C:\Windows\System\RkGHrEx.exe
  C:\Windows\System\RkGHrEx.exe
  2⤵
  PID:4116
- C:\Windows\System\qsoMCPL.exe
  C:\Windows\System\qsoMCPL.exe
  2⤵
  PID:4156
- C:\Windows\System\DkQNHGD.exe
  C:\Windows\System\DkQNHGD.exe
  2⤵
  PID:3740
- C:\Windows\System\uoJoiwM.exe
  C:\Windows\System\uoJoiwM.exe
  2⤵
  PID:3640
- C:\Windows\System\GtFUSmc.exe
  C:\Windows\System\GtFUSmc.exe
  2⤵
  PID:3932
- C:\Windows\System\nuIWGjd.exe
  C:\Windows\System\nuIWGjd.exe
  2⤵
  PID:4132
- C:\Windows\System\AhyKLtg.exe
  C:\Windows\System\AhyKLtg.exe
  2⤵
  PID:4176
- C:\Windows\System\vttngWB.exe
  C:\Windows\System\vttngWB.exe
  2⤵
  PID:4252
- C:\Windows\System\DDIRzqT.exe
  C:\Windows\System\DDIRzqT.exe
  2⤵
  PID:4308
- C:\Windows\System\LfHIAly.exe
  C:\Windows\System\LfHIAly.exe
  2⤵
  PID:4312
- C:\Windows\System\TncgtEx.exe
  C:\Windows\System\TncgtEx.exe
  2⤵
  PID:1572
- C:\Windows\System\XaRyIUG.exe
  C:\Windows\System\XaRyIUG.exe
  2⤵
  PID:4376
- C:\Windows\System\XffnDHT.exe
  C:\Windows\System\XffnDHT.exe
  2⤵
  PID:4352
- C:\Windows\System\EhdSCRJ.exe
  C:\Windows\System\EhdSCRJ.exe
  2⤵
  PID:4436
- C:\Windows\System\fMdlQcD.exe
  C:\Windows\System\fMdlQcD.exe
  2⤵
  PID:4460
- C:\Windows\System\XHKRdLs.exe
  C:\Windows\System\XHKRdLs.exe
  2⤵
  PID:4564
- C:\Windows\System\RvVTogw.exe
  C:\Windows\System\RvVTogw.exe
  2⤵
  PID:4508
- C:\Windows\System\lyquFGG.exe
  C:\Windows\System\lyquFGG.exe
  2⤵
  PID:4476
- C:\Windows\System\fNGomfe.exe
  C:\Windows\System\fNGomfe.exe
  2⤵
  PID:4544
- C:\Windows\System\hxMlVDd.exe
  C:\Windows\System\hxMlVDd.exe
  2⤵
  PID:4612
- C:\Windows\System\KBPEvlt.exe
  C:\Windows\System\KBPEvlt.exe
  2⤵
  PID:4636
- C:\Windows\System\YVJeCOP.exe
  C:\Windows\System\YVJeCOP.exe
  2⤵
  PID:4656
- C:\Windows\System\YkbcOYU.exe
  C:\Windows\System\YkbcOYU.exe
  2⤵
  PID:4696
- C:\Windows\System\OGuzBIE.exe
  C:\Windows\System\OGuzBIE.exe
  2⤵
  PID:4740
- C:\Windows\System\pMMVvrs.exe
  C:\Windows\System\pMMVvrs.exe
  2⤵
  PID:4752
- C:\Windows\System\hevkuEi.exe
  C:\Windows\System\hevkuEi.exe
  2⤵
  PID:4824
- C:\Windows\System\dEECtIp.exe
  C:\Windows\System\dEECtIp.exe
  2⤵
  PID:4892
- C:\Windows\System\DOZjVbZ.exe
  C:\Windows\System\DOZjVbZ.exe
  2⤵
  PID:4968
- C:\Windows\System\oBjXhKQ.exe
  C:\Windows\System\oBjXhKQ.exe
  2⤵
  PID:4800
- C:\Windows\System\MlpAAsC.exe
  C:\Windows\System\MlpAAsC.exe
  2⤵
  PID:4992
- C:\Windows\System\ltzlkwp.exe
  C:\Windows\System\ltzlkwp.exe
  2⤵
  PID:5116
- C:\Windows\System\bnWWAaF.exe
  C:\Windows\System\bnWWAaF.exe
  2⤵
  PID:4996
- C:\Windows\System\seREFui.exe
  C:\Windows\System\seREFui.exe
  2⤵
  PID:4988
- C:\Windows\System\BbXSzZd.exe
  C:\Windows\System\BbXSzZd.exe
  2⤵
  PID:5024
- C:\Windows\System\oGAqtCX.exe
  C:\Windows\System\oGAqtCX.exe
  2⤵
  PID:5100
- C:\Windows\System\YuFdcKF.exe
  C:\Windows\System\YuFdcKF.exe
  2⤵
  PID:3708
- C:\Windows\System\tlNFnKJ.exe
  C:\Windows\System\tlNFnKJ.exe
  2⤵
  PID:3896
- C:\Windows\System\AuWnhUC.exe
  C:\Windows\System\AuWnhUC.exe
  2⤵
  PID:4444
- C:\Windows\System\ldkyrkh.exe
  C:\Windows\System\ldkyrkh.exe
  2⤵
  PID:4420
- C:\Windows\System\rFZpVPM.exe
  C:\Windows\System\rFZpVPM.exe
  2⤵
  PID:4248
- C:\Windows\System\swvUmCY.exe
  C:\Windows\System\swvUmCY.exe
  2⤵
  PID:4368
- C:\Windows\System\jjqjfQx.exe
  C:\Windows\System\jjqjfQx.exe
  2⤵
  PID:4432
- C:\Windows\System\fJjjBxa.exe
  C:\Windows\System\fJjjBxa.exe
  2⤵
  PID:4600
- C:\Windows\System\RqWnBKG.exe
  C:\Windows\System\RqWnBKG.exe
  2⤵
  PID:4680
- C:\Windows\System\bIRGOjI.exe
  C:\Windows\System\bIRGOjI.exe
  2⤵
  PID:4640
- C:\Windows\System\AMVUTmo.exe
  C:\Windows\System\AMVUTmo.exe
  2⤵
  PID:4708
- C:\Windows\System\TkLPQIw.exe
  C:\Windows\System\TkLPQIw.exe
  2⤵
  PID:4856
- C:\Windows\System\zZmtltB.exe
  C:\Windows\System\zZmtltB.exe
  2⤵
  PID:4960
- C:\Windows\System\RsYjJVE.exe
  C:\Windows\System\RsYjJVE.exe
  2⤵
  PID:3780
- C:\Windows\System\zHIRKJd.exe
  C:\Windows\System\zHIRKJd.exe
  2⤵
  PID:4840
- C:\Windows\System\cnFnAXT.exe
  C:\Windows\System\cnFnAXT.exe
  2⤵
  PID:5044
- C:\Windows\System\qfmnyRd.exe
  C:\Windows\System\qfmnyRd.exe
  2⤵
  PID:4908
- C:\Windows\System\RToVFwd.exe
  C:\Windows\System\RToVFwd.exe
  2⤵
  PID:4912
- C:\Windows\System\ndUeAeT.exe
  C:\Windows\System\ndUeAeT.exe
  2⤵
  PID:4196
- C:\Windows\System\GhIvfPa.exe
  C:\Windows\System\GhIvfPa.exe
  2⤵
  PID:3840
- C:\Windows\System\JdgSdHn.exe
  C:\Windows\System\JdgSdHn.exe
  2⤵
  PID:5092
- C:\Windows\System\FscCxEg.exe
  C:\Windows\System\FscCxEg.exe
  2⤵
  PID:4336
- C:\Windows\System\DDAucoW.exe
  C:\Windows\System\DDAucoW.exe
  2⤵
  PID:4540
- C:\Windows\System\VQWcVpu.exe
  C:\Windows\System\VQWcVpu.exe
  2⤵
  PID:4692
- C:\Windows\System\cAOhNUM.exe
  C:\Windows\System\cAOhNUM.exe
  2⤵
  PID:4524
- C:\Windows\System\XJXHqhe.exe
  C:\Windows\System\XJXHqhe.exe
  2⤵
  PID:3672
- C:\Windows\System\OFJOfJm.exe
  C:\Windows\System\OFJOfJm.exe
  2⤵
  PID:4244
- C:\Windows\System\jpyesfw.exe
  C:\Windows\System\jpyesfw.exe
  2⤵
  PID:4216
- C:\Windows\System\zDGqBRX.exe
  C:\Windows\System\zDGqBRX.exe
  2⤵
  PID:4584
- C:\Windows\System\coSlusm.exe
  C:\Windows\System\coSlusm.exe
  2⤵
  PID:4820
- C:\Windows\System\mYcWMYa.exe
  C:\Windows\System\mYcWMYa.exe
  2⤵
  PID:4456
- C:\Windows\System\xHtyyZB.exe
  C:\Windows\System\xHtyyZB.exe
  2⤵
  PID:5012
- C:\Windows\System\JMrOFIA.exe
  C:\Windows\System\JMrOFIA.exe
  2⤵
  PID:4264
- C:\Windows\System\aHXnnMZ.exe
  C:\Windows\System\aHXnnMZ.exe
  2⤵
  PID:4320
- C:\Windows\System\jnCODPi.exe
  C:\Windows\System\jnCODPi.exe
  2⤵
  PID:4332
- C:\Windows\System\TZuYcBj.exe
  C:\Windows\System\TZuYcBj.exe
  2⤵
  PID:4492
- C:\Windows\System\fndqsHk.exe
  C:\Windows\System\fndqsHk.exe
  2⤵
  PID:4756
- C:\Windows\System\IneANNd.exe
  C:\Windows\System\IneANNd.exe
  2⤵
  PID:4348
- C:\Windows\System\CLwdGxj.exe
  C:\Windows\System\CLwdGxj.exe
  2⤵
  PID:4676
- C:\Windows\System\xxXXBKc.exe
  C:\Windows\System\xxXXBKc.exe
  2⤵
  PID:4836
- C:\Windows\System\ZaHyDfw.exe
  C:\Windows\System\ZaHyDfw.exe
  2⤵
  PID:4984
- C:\Windows\System\WLaUsOH.exe
  C:\Windows\System\WLaUsOH.exe
  2⤵
  PID:4888
- C:\Windows\System\JWkPNwx.exe
  C:\Windows\System\JWkPNwx.exe
  2⤵
  PID:4388
- C:\Windows\System\iSMCGCN.exe
  C:\Windows\System\iSMCGCN.exe
  2⤵
  PID:3476
- C:\Windows\System\aPeJvNp.exe
  C:\Windows\System\aPeJvNp.exe
  2⤵
  PID:5132
- C:\Windows\System\nsHoDrN.exe
  C:\Windows\System\nsHoDrN.exe
  2⤵
  PID:5148
- C:\Windows\System\ByeLUdR.exe
  C:\Windows\System\ByeLUdR.exe
  2⤵
  PID:5168
- C:\Windows\System\rmVqcXW.exe
  C:\Windows\System\rmVqcXW.exe
  2⤵
  PID:5184
- C:\Windows\System\ZtzOxpO.exe
  C:\Windows\System\ZtzOxpO.exe
  2⤵
  PID:5200
- C:\Windows\System\YeTlwJp.exe
  C:\Windows\System\YeTlwJp.exe
  2⤵
  PID:5216
- C:\Windows\System\rcSWDXg.exe
  C:\Windows\System\rcSWDXg.exe
  2⤵
  PID:5232
- C:\Windows\System\LbTfVxn.exe
  C:\Windows\System\LbTfVxn.exe
  2⤵
  PID:5248
- C:\Windows\System\SElBVou.exe
  C:\Windows\System\SElBVou.exe
  2⤵
  PID:5264
- C:\Windows\System\fratdPx.exe
  C:\Windows\System\fratdPx.exe
  2⤵
  PID:5280
- C:\Windows\System\UnHxdok.exe
  C:\Windows\System\UnHxdok.exe
  2⤵
  PID:5296
- C:\Windows\System\IgEBmlA.exe
  C:\Windows\System\IgEBmlA.exe
  2⤵
  PID:5312
- C:\Windows\System\RteHFVf.exe
  C:\Windows\System\RteHFVf.exe
  2⤵
  PID:5328
- C:\Windows\System\vmMCeUA.exe
  C:\Windows\System\vmMCeUA.exe
  2⤵
  PID:5344
- C:\Windows\System\NNtSIcj.exe
  C:\Windows\System\NNtSIcj.exe
  2⤵
  PID:5360
- C:\Windows\System\sBSOCyx.exe
  C:\Windows\System\sBSOCyx.exe
  2⤵
  PID:5376
- C:\Windows\System\UpQXJZo.exe
  C:\Windows\System\UpQXJZo.exe
  2⤵
  PID:5392
- C:\Windows\System\zTsIGok.exe
  C:\Windows\System\zTsIGok.exe
  2⤵
  PID:5408
- C:\Windows\System\OBIkIli.exe
  C:\Windows\System\OBIkIli.exe
  2⤵
  PID:5424
- C:\Windows\System\QvByjFa.exe
  C:\Windows\System\QvByjFa.exe
  2⤵
  PID:5440
- C:\Windows\System\YUiKkBR.exe
  C:\Windows\System\YUiKkBR.exe
  2⤵
  PID:5456
- C:\Windows\System\VfalpGW.exe
  C:\Windows\System\VfalpGW.exe
  2⤵
  PID:5472
- C:\Windows\System\QJwhkWE.exe
  C:\Windows\System\QJwhkWE.exe
  2⤵
  PID:5488
- C:\Windows\System\yYhkcMC.exe
  C:\Windows\System\yYhkcMC.exe
  2⤵
  PID:5504
- C:\Windows\System\ZqyPQTE.exe
  C:\Windows\System\ZqyPQTE.exe
  2⤵
  PID:5520
- C:\Windows\System\oMPnItk.exe
  C:\Windows\System\oMPnItk.exe
  2⤵
  PID:5536
- C:\Windows\System\tstppxO.exe
  C:\Windows\System\tstppxO.exe
  2⤵
  PID:5552
- C:\Windows\System\NYpcuEc.exe
  C:\Windows\System\NYpcuEc.exe
  2⤵
  PID:5568
- C:\Windows\System\LJMyvnX.exe
  C:\Windows\System\LJMyvnX.exe
  2⤵
  PID:5584
- C:\Windows\System\QuIKtux.exe
  C:\Windows\System\QuIKtux.exe
  2⤵
  PID:5600
- C:\Windows\System\gdeZyCv.exe
  C:\Windows\System\gdeZyCv.exe
  2⤵
  PID:5616
- C:\Windows\System\DvuLEcW.exe
  C:\Windows\System\DvuLEcW.exe
  2⤵
  PID:5632
- C:\Windows\System\VNFOEYB.exe
  C:\Windows\System\VNFOEYB.exe
  2⤵
  PID:5648
- C:\Windows\System\xrqvyHt.exe
  C:\Windows\System\xrqvyHt.exe
  2⤵
  PID:5664
- C:\Windows\System\gHkFPVF.exe
  C:\Windows\System\gHkFPVF.exe
  2⤵
  PID:5680
- C:\Windows\System\ynogtel.exe
  C:\Windows\System\ynogtel.exe
  2⤵
  PID:5696
- C:\Windows\System\fZLKYvf.exe
  C:\Windows\System\fZLKYvf.exe
  2⤵
  PID:5712
- C:\Windows\System\MZiPGNd.exe
  C:\Windows\System\MZiPGNd.exe
  2⤵
  PID:5728
- C:\Windows\System\bVYsLBw.exe
  C:\Windows\System\bVYsLBw.exe
  2⤵
  PID:5744
- C:\Windows\System\IfUKasf.exe
  C:\Windows\System\IfUKasf.exe
  2⤵
  PID:5960
- C:\Windows\System\nyMegmv.exe
  C:\Windows\System\nyMegmv.exe
  2⤵
  PID:5976
- C:\Windows\System\aOriQkw.exe
  C:\Windows\System\aOriQkw.exe
  2⤵
  PID:5992
- C:\Windows\System\WiQEMpX.exe
  C:\Windows\System\WiQEMpX.exe
  2⤵
  PID:6012
- C:\Windows\System\AYMkDgl.exe
  C:\Windows\System\AYMkDgl.exe
  2⤵
  PID:6028
- C:\Windows\System\afouoJx.exe
  C:\Windows\System\afouoJx.exe
  2⤵
  PID:6044
- C:\Windows\System\IwlRSjz.exe
  C:\Windows\System\IwlRSjz.exe
  2⤵
  PID:6064
- C:\Windows\System\GsJEXOR.exe
  C:\Windows\System\GsJEXOR.exe
  2⤵
  PID:6080
- C:\Windows\System\vCnVUnt.exe
  C:\Windows\System\vCnVUnt.exe
  2⤵
  PID:6096
- C:\Windows\System\AaTgjGS.exe
  C:\Windows\System\AaTgjGS.exe
  2⤵
  PID:6112
- C:\Windows\System\JCAypUc.exe
  C:\Windows\System\JCAypUc.exe
  2⤵
  PID:6128
- C:\Windows\System\RatjcAY.exe
  C:\Windows\System\RatjcAY.exe
  2⤵
  PID:4948
- C:\Windows\System\WfntXOm.exe
  C:\Windows\System\WfntXOm.exe
  2⤵
  PID:5144
- C:\Windows\System\tjbpPWh.exe
  C:\Windows\System\tjbpPWh.exe
  2⤵
  PID:5212
- C:\Windows\System\lOdgxVF.exe
  C:\Windows\System\lOdgxVF.exe
  2⤵
  PID:5272
- C:\Windows\System\InHWoAo.exe
  C:\Windows\System\InHWoAo.exe
  2⤵
  PID:5308
- C:\Windows\System\DQcKVyK.exe
  C:\Windows\System\DQcKVyK.exe
  2⤵
  PID:5372
- C:\Windows\System\TeKwtzV.exe
  C:\Windows\System\TeKwtzV.exe
  2⤵
  PID:4324
- C:\Windows\System\njeLfNn.exe
  C:\Windows\System\njeLfNn.exe
  2⤵
  PID:5160
- C:\Windows\System\ctJpgkw.exe
  C:\Windows\System\ctJpgkw.exe
  2⤵
  PID:5224
- C:\Windows\System\PNnxeqN.exe
  C:\Windows\System\PNnxeqN.exe
  2⤵
  PID:5292
- C:\Windows\System\hJyNxMv.exe
  C:\Windows\System\hJyNxMv.exe
  2⤵
  PID:5356
- C:\Windows\System\ksRuuwK.exe
  C:\Windows\System\ksRuuwK.exe
  2⤵
  PID:5404
- C:\Windows\System\LdzYzYz.exe
  C:\Windows\System\LdzYzYz.exe
  2⤵
  PID:5416
- C:\Windows\System\AsfwQUD.exe
  C:\Windows\System\AsfwQUD.exe
  2⤵
  PID:5496
- C:\Windows\System\wPSjeOU.exe
  C:\Windows\System\wPSjeOU.exe
  2⤵
  PID:5452
- C:\Windows\System\bNIeZYO.exe
  C:\Windows\System\bNIeZYO.exe
  2⤵
  PID:5484
- C:\Windows\System\EMmekkq.exe
  C:\Windows\System\EMmekkq.exe
  2⤵
  PID:5560
- C:\Windows\System\yEgJPdw.exe
  C:\Windows\System\yEgJPdw.exe
  2⤵
  PID:5580
- C:\Windows\System\WHoWthc.exe
  C:\Windows\System\WHoWthc.exe
  2⤵
  PID:5644
- C:\Windows\System\XcsEGEg.exe
  C:\Windows\System\XcsEGEg.exe
  2⤵
  PID:5676
- C:\Windows\System\kWOjzER.exe
  C:\Windows\System\kWOjzER.exe
  2⤵
  PID:5704
- C:\Windows\System\kMxFTLD.exe
  C:\Windows\System\kMxFTLD.exe
  2⤵
  PID:5720
- C:\Windows\System\evBZenL.exe
  C:\Windows\System\evBZenL.exe
  2⤵
  PID:5760
- C:\Windows\System\uZiNoYM.exe
  C:\Windows\System\uZiNoYM.exe
  2⤵
  PID:5772
- C:\Windows\System\HOdshbd.exe
  C:\Windows\System\HOdshbd.exe
  2⤵
  PID:5792
- C:\Windows\System\rVXqoyi.exe
  C:\Windows\System\rVXqoyi.exe
  2⤵
  PID:5804
- C:\Windows\System\GPBIwLW.exe
  C:\Windows\System\GPBIwLW.exe
  2⤵
  PID:5824
- C:\Windows\System\SXzYoxz.exe
  C:\Windows\System\SXzYoxz.exe
  2⤵
  PID:5836
- C:\Windows\System\srSMcmk.exe
  C:\Windows\System\srSMcmk.exe
  2⤵
  PID:5852
- C:\Windows\System\csbEARC.exe
  C:\Windows\System\csbEARC.exe
  2⤵
  PID:5868
- C:\Windows\System\ShjKwYy.exe
  C:\Windows\System\ShjKwYy.exe
  2⤵
  PID:5892
- C:\Windows\System\NTafqfi.exe
  C:\Windows\System\NTafqfi.exe
  2⤵
  PID:5908
- C:\Windows\System\DeNnvJh.exe
  C:\Windows\System\DeNnvJh.exe
  2⤵
  PID:5916
- C:\Windows\System\bajZLel.exe
  C:\Windows\System\bajZLel.exe
  2⤵
  PID:5936
- C:\Windows\System\wcauABu.exe
  C:\Windows\System\wcauABu.exe
  2⤵
  PID:5968
- C:\Windows\System\MmuoQkd.exe
  C:\Windows\System\MmuoQkd.exe
  2⤵
  PID:5972
- C:\Windows\System\mGQbuiW.exe
  C:\Windows\System\mGQbuiW.exe
  2⤵
  PID:6024
- C:\Windows\System\GTkSlek.exe
  C:\Windows\System\GTkSlek.exe
  2⤵
  PID:6060
- C:\Windows\System\rbDUwvH.exe
  C:\Windows\System\rbDUwvH.exe
  2⤵
  PID:4744
- C:\Windows\System\CzQaRyB.exe
  C:\Windows\System\CzQaRyB.exe
  2⤵
  PID:6000
- C:\Windows\System\PCdKQiV.exe
  C:\Windows\System\PCdKQiV.exe
  2⤵
  PID:6140
- C:\Windows\System\CgLvUGA.exe
  C:\Windows\System\CgLvUGA.exe
  2⤵
  PID:6104
- C:\Windows\System\xAZeJwQ.exe
  C:\Windows\System\xAZeJwQ.exe
  2⤵
  PID:5180
- C:\Windows\System\kOQAuEe.exe
  C:\Windows\System\kOQAuEe.exe
  2⤵
  PID:5244
- C:\Windows\System\SkmyMuq.exe
  C:\Windows\System\SkmyMuq.exe
  2⤵
  PID:5256
- C:\Windows\System\ZKnGEmA.exe
  C:\Windows\System\ZKnGEmA.exe
  2⤵
  PID:5388
- C:\Windows\System\Lqrdteb.exe
  C:\Windows\System\Lqrdteb.exe
  2⤵
  PID:5352
- C:\Windows\System\mZqmeWr.exe
  C:\Windows\System\mZqmeWr.exe
  2⤵
  PID:5448
- C:\Windows\System\BPUXjPs.exe
  C:\Windows\System\BPUXjPs.exe
  2⤵
  PID:5640
- C:\Windows\System\bQDGrox.exe
  C:\Windows\System\bQDGrox.exe
  2⤵
  PID:5656
- C:\Windows\System\xhwEGVN.exe
  C:\Windows\System\xhwEGVN.exe
  2⤵
  PID:5624
- C:\Windows\System\iPljFdv.exe
  C:\Windows\System\iPljFdv.exe
  2⤵
  PID:5764
- C:\Windows\System\YlrGRlh.exe
  C:\Windows\System\YlrGRlh.exe
  2⤵
  PID:5796
- C:\Windows\System\wcvVwHR.exe
  C:\Windows\System\wcvVwHR.exe
  2⤵
  PID:5832
- C:\Windows\System\trcFQZZ.exe
  C:\Windows\System\trcFQZZ.exe
  2⤵
  PID:5784
- C:\Windows\System\MIRCmyl.exe
  C:\Windows\System\MIRCmyl.exe
  2⤵
  PID:5844
- C:\Windows\System\hdHYBFA.exe
  C:\Windows\System\hdHYBFA.exe
  2⤵
  PID:5912
- C:\Windows\System\KKWXumy.exe
  C:\Windows\System\KKWXumy.exe
  2⤵
  PID:5932
- C:\Windows\System\lwVLbUq.exe
  C:\Windows\System\lwVLbUq.exe
  2⤵
  PID:6088
- C:\Windows\System\wAwGnAz.exe
  C:\Windows\System\wAwGnAz.exe
  2⤵
  PID:6076
- C:\Windows\System\ASQWmkh.exe
  C:\Windows\System\ASQWmkh.exe
  2⤵
  PID:5288
- C:\Windows\System\AjoNPBq.exe
  C:\Windows\System\AjoNPBq.exe
  2⤵
  PID:5528
- C:\Windows\System\JuYNvOA.exe
  C:\Windows\System\JuYNvOA.exe
  2⤵
  PID:6124
- C:\Windows\System\fkFXPdi.exe
  C:\Windows\System\fkFXPdi.exe
  2⤵
  PID:4940
- C:\Windows\System\ENfJVrE.exe
  C:\Windows\System\ENfJVrE.exe
  2⤵
  PID:5516
- C:\Windows\System\TAdGdHi.exe
  C:\Windows\System\TAdGdHi.exe
  2⤵
  PID:5628
- C:\Windows\System\jOSfcIK.exe
  C:\Windows\System\jOSfcIK.exe
  2⤵
  PID:5780
- C:\Windows\System\cxMwNdc.exe
  C:\Windows\System\cxMwNdc.exe
  2⤵
  PID:5736
- C:\Windows\System\LDHzsrv.exe
  C:\Windows\System\LDHzsrv.exe
  2⤵
  PID:5336
- C:\Windows\System\axNcSMz.exe
  C:\Windows\System\axNcSMz.exe
  2⤵
  PID:5920
- C:\Windows\System\XKTToyx.exe
  C:\Windows\System\XKTToyx.exe
  2⤵
  PID:6036
- C:\Windows\System\wNRaQuq.exe
  C:\Windows\System\wNRaQuq.exe
  2⤵
  PID:5880
- C:\Windows\System\djbSlWz.exe
  C:\Windows\System\djbSlWz.exe
  2⤵
  PID:5740
- C:\Windows\System\AqjpNKh.exe
  C:\Windows\System\AqjpNKh.exe
  2⤵
  PID:5196
- C:\Windows\System\nrtFPKe.exe
  C:\Windows\System\nrtFPKe.exe
  2⤵
  PID:5340
- C:\Windows\System\rTtDNis.exe
  C:\Windows\System\rTtDNis.exe
  2⤵
  PID:5884
- C:\Windows\System\vETtlZR.exe
  C:\Windows\System\vETtlZR.exe
  2⤵
  PID:6156
- C:\Windows\System\uwoOpUl.exe
  C:\Windows\System\uwoOpUl.exe
  2⤵
  PID:6172
- C:\Windows\System\SYfPoue.exe
  C:\Windows\System\SYfPoue.exe
  2⤵
  PID:6188
- C:\Windows\System\NMozgBj.exe
  C:\Windows\System\NMozgBj.exe
  2⤵
  PID:6204
- C:\Windows\System\HDXHqaC.exe
  C:\Windows\System\HDXHqaC.exe
  2⤵
  PID:6220
- C:\Windows\System\VQLfoLC.exe
  C:\Windows\System\VQLfoLC.exe
  2⤵
  PID:6236
- C:\Windows\System\ZtfPQaD.exe
  C:\Windows\System\ZtfPQaD.exe
  2⤵
  PID:6252
- C:\Windows\System\MbZdtBB.exe
  C:\Windows\System\MbZdtBB.exe
  2⤵
  PID:6268
- C:\Windows\System\yHwTgju.exe
  C:\Windows\System\yHwTgju.exe
  2⤵
  PID:6284
- C:\Windows\System\bFFkYnH.exe
  C:\Windows\System\bFFkYnH.exe
  2⤵
  PID:6300
- C:\Windows\System\yfpjdxf.exe
  C:\Windows\System\yfpjdxf.exe
  2⤵
  PID:6316
- C:\Windows\System\UDMuGrv.exe
  C:\Windows\System\UDMuGrv.exe
  2⤵
  PID:6332
- C:\Windows\System\FCzJDxk.exe
  C:\Windows\System\FCzJDxk.exe
  2⤵
  PID:6348
- C:\Windows\System\FvklRxm.exe
  C:\Windows\System\FvklRxm.exe
  2⤵
  PID:6364
- C:\Windows\System\YEbZqGV.exe
  C:\Windows\System\YEbZqGV.exe
  2⤵
  PID:6380
- C:\Windows\System\wSSvIGQ.exe
  C:\Windows\System\wSSvIGQ.exe
  2⤵
  PID:6396
- C:\Windows\System\xBbWzgq.exe
  C:\Windows\System\xBbWzgq.exe
  2⤵
  PID:6412
- C:\Windows\System\uTWJGdw.exe
  C:\Windows\System\uTWJGdw.exe
  2⤵
  PID:6428
- C:\Windows\System\LiegJir.exe
  C:\Windows\System\LiegJir.exe
  2⤵
  PID:6444
- C:\Windows\System\sSamPvJ.exe
  C:\Windows\System\sSamPvJ.exe
  2⤵
  PID:6464
- C:\Windows\System\onfxvXm.exe
  C:\Windows\System\onfxvXm.exe
  2⤵
  PID:6480
- C:\Windows\System\GmWRkaO.exe
  C:\Windows\System\GmWRkaO.exe
  2⤵
  PID:6496
- C:\Windows\System\PoofIjA.exe
  C:\Windows\System\PoofIjA.exe
  2⤵
  PID:6512
- C:\Windows\System\bHsQFqn.exe
  C:\Windows\System\bHsQFqn.exe
  2⤵
  PID:6528
- C:\Windows\System\aXfVtvZ.exe
  C:\Windows\System\aXfVtvZ.exe
  2⤵
  PID:6544
- C:\Windows\System\rEnwyhr.exe
  C:\Windows\System\rEnwyhr.exe
  2⤵
  PID:6564
- C:\Windows\System\NaMzdBw.exe
  C:\Windows\System\NaMzdBw.exe
  2⤵
  PID:6580
- C:\Windows\System\hpReOni.exe
  C:\Windows\System\hpReOni.exe
  2⤵
  PID:6596
- C:\Windows\System\QldpOpL.exe
  C:\Windows\System\QldpOpL.exe
  2⤵
  PID:6612
- C:\Windows\System\PRNscLf.exe
  C:\Windows\System\PRNscLf.exe
  2⤵
  PID:6628
- C:\Windows\System\KOJSjfR.exe
  C:\Windows\System\KOJSjfR.exe
  2⤵
  PID:6644
- C:\Windows\System\MTkAgNx.exe
  C:\Windows\System\MTkAgNx.exe
  2⤵
  PID:6664
- C:\Windows\System\lqojewu.exe
  C:\Windows\System\lqojewu.exe
  2⤵
  PID:6680
- C:\Windows\System\kQYWbgH.exe
  C:\Windows\System\kQYWbgH.exe
  2⤵
  PID:6696
- C:\Windows\System\NEjbTcp.exe
  C:\Windows\System\NEjbTcp.exe
  2⤵
  PID:6712
- C:\Windows\System\AuttKig.exe
  C:\Windows\System\AuttKig.exe
  2⤵
  PID:6728
- C:\Windows\System\KMyTPkJ.exe
  C:\Windows\System\KMyTPkJ.exe
  2⤵
  PID:6744
- C:\Windows\System\oKHHTZn.exe
  C:\Windows\System\oKHHTZn.exe
  2⤵
  PID:6760
- C:\Windows\System\tFTPHpk.exe
  C:\Windows\System\tFTPHpk.exe
  2⤵
  PID:6776
- C:\Windows\System\bXQFGsz.exe
  C:\Windows\System\bXQFGsz.exe
  2⤵
  PID:6792
- C:\Windows\System\XLFhPOb.exe
  C:\Windows\System\XLFhPOb.exe
  2⤵
  PID:6808
- C:\Windows\System\BIxkdHA.exe
  C:\Windows\System\BIxkdHA.exe
  2⤵
  PID:6824
- C:\Windows\System\quxHGKG.exe
  C:\Windows\System\quxHGKG.exe
  2⤵
  PID:6840
- C:\Windows\System\ohBvUFW.exe
  C:\Windows\System\ohBvUFW.exe
  2⤵
  PID:6856
- C:\Windows\System\AVsSnxj.exe
  C:\Windows\System\AVsSnxj.exe
  2⤵
  PID:6872
- C:\Windows\System\EgdfsXa.exe
  C:\Windows\System\EgdfsXa.exe
  2⤵
  PID:6944
- C:\Windows\System\mVkYqgM.exe
  C:\Windows\System\mVkYqgM.exe
  2⤵
  PID:6964
- C:\Windows\System\MhLgKIW.exe
  C:\Windows\System\MhLgKIW.exe
  2⤵
  PID:6980
- C:\Windows\System\jXKoxXZ.exe
  C:\Windows\System\jXKoxXZ.exe
  2⤵
  PID:6996
- C:\Windows\System\HDbpHws.exe
  C:\Windows\System\HDbpHws.exe
  2⤵
  PID:7016
- C:\Windows\System\WfFYxOc.exe
  C:\Windows\System\WfFYxOc.exe
  2⤵
  PID:7036
- C:\Windows\System\nVNFNMV.exe
  C:\Windows\System\nVNFNMV.exe
  2⤵
  PID:7056
- C:\Windows\System\bMFiFhb.exe
  C:\Windows\System\bMFiFhb.exe
  2⤵
  PID:7072
- C:\Windows\System\EHoCqvQ.exe
  C:\Windows\System\EHoCqvQ.exe
  2⤵
  PID:7092
- C:\Windows\System\GzsWKUM.exe
  C:\Windows\System\GzsWKUM.exe
  2⤵
  PID:7132
- C:\Windows\System\LywlnUx.exe
  C:\Windows\System\LywlnUx.exe
  2⤵
  PID:7152
- C:\Windows\System\jpRTwCG.exe
  C:\Windows\System\jpRTwCG.exe
  2⤵
  PID:5988
- C:\Windows\System\BedCnHk.exe
  C:\Windows\System\BedCnHk.exe
  2⤵
  PID:5500
- C:\Windows\System\bLpJkUY.exe
  C:\Windows\System\bLpJkUY.exe
  2⤵
  PID:5576
- C:\Windows\System\OHntFVJ.exe
  C:\Windows\System\OHntFVJ.exe
  2⤵
  PID:5860
- C:\Windows\System\DbemDQk.exe
  C:\Windows\System\DbemDQk.exe
  2⤵
  PID:6180
- C:\Windows\System\hQgjRNT.exe
  C:\Windows\System\hQgjRNT.exe
  2⤵
  PID:6260
- C:\Windows\System\SZahgWS.exe
  C:\Windows\System\SZahgWS.exe
  2⤵
  PID:6292
- C:\Windows\System\YSdqLHg.exe
  C:\Windows\System\YSdqLHg.exe
  2⤵
  PID:6280
- C:\Windows\System\BObaTHz.exe
  C:\Windows\System\BObaTHz.exe
  2⤵
  PID:6184
- C:\Windows\System\aQHjiNk.exe
  C:\Windows\System\aQHjiNk.exe
  2⤵
  PID:6344
- C:\Windows\System\kDFhKFz.exe
  C:\Windows\System\kDFhKFz.exe
  2⤵
  PID:6360
- C:\Windows\System\wTOpKYq.exe
  C:\Windows\System\wTOpKYq.exe
  2⤵
  PID:6372
- C:\Windows\System\hjkvWTs.exe
  C:\Windows\System\hjkvWTs.exe
  2⤵
  PID:6404
- C:\Windows\System\XpDvPUi.exe
  C:\Windows\System\XpDvPUi.exe
  2⤵
  PID:6476
- C:\Windows\System\aPNIPki.exe
  C:\Windows\System\aPNIPki.exe
  2⤵
  PID:6488
- C:\Windows\System\mffAWeN.exe
  C:\Windows\System\mffAWeN.exe
  2⤵
  PID:6540
- C:\Windows\System\WjBjQGV.exe
  C:\Windows\System\WjBjQGV.exe
  2⤵
  PID:6576
- C:\Windows\System\fFQLCDI.exe
  C:\Windows\System\fFQLCDI.exe
  2⤵
  PID:6608
- C:\Windows\System\pFWYmSN.exe
  C:\Windows\System\pFWYmSN.exe
  2⤵
  PID:6704
- C:\Windows\System\mbuGfSa.exe
  C:\Windows\System\mbuGfSa.exe
  2⤵
  PID:6592
- C:\Windows\System\ADyQqum.exe
  C:\Windows\System\ADyQqum.exe
  2⤵
  PID:6656
- C:\Windows\System\vqNzfXF.exe
  C:\Windows\System\vqNzfXF.exe
  2⤵
  PID:6720
- C:\Windows\System\MoQCpjB.exe
  C:\Windows\System\MoQCpjB.exe
  2⤵
  PID:6756
- C:\Windows\System\FBJJGdY.exe
  C:\Windows\System\FBJJGdY.exe
  2⤵
  PID:6772
- C:\Windows\System\HqKEJAp.exe
  C:\Windows\System\HqKEJAp.exe
  2⤵
  PID:6836
- C:\Windows\System\GYNfnav.exe
  C:\Windows\System\GYNfnav.exe
  2⤵
  PID:6820
- C:\Windows\System\zUagXCi.exe
  C:\Windows\System\zUagXCi.exe
  2⤵
  PID:6884
- C:\Windows\System\NFdSWcs.exe
  C:\Windows\System\NFdSWcs.exe
  2⤵
  PID:6896
- C:\Windows\System\UtNxxxv.exe
  C:\Windows\System\UtNxxxv.exe
  2⤵
  PID:6912
- C:\Windows\System\IrBYXux.exe
  C:\Windows\System\IrBYXux.exe
  2⤵
  PID:6960
- C:\Windows\System\frdIPFT.exe
  C:\Windows\System\frdIPFT.exe
  2⤵
  PID:6936
- C:\Windows\System\dkWXwCM.exe
  C:\Windows\System\dkWXwCM.exe
  2⤵
  PID:6972
- C:\Windows\System\TTtcuxd.exe
  C:\Windows\System\TTtcuxd.exe
  2⤵
  PID:6992
- C:\Windows\System\JxjqOge.exe
  C:\Windows\System\JxjqOge.exe
  2⤵
  PID:7052
- C:\Windows\System\utLHQrU.exe
  C:\Windows\System\utLHQrU.exe
  2⤵
  PID:7080
- C:\Windows\System\byURTGY.exe
  C:\Windows\System\byURTGY.exe
  2⤵
  PID:7116
- C:\Windows\System\FxGOJAc.exe
  C:\Windows\System\FxGOJAc.exe
  2⤵
  PID:7148
- C:\Windows\System\osMHFDd.exe
  C:\Windows\System\osMHFDd.exe
  2⤵
  PID:5948
- C:\Windows\System\wzIqEfI.exe
  C:\Windows\System\wzIqEfI.exe
  2⤵
  PID:6052
- C:\Windows\System\DJBeUmK.exe
  C:\Windows\System\DJBeUmK.exe
  2⤵
  PID:6308
- C:\Windows\System\pkIRkbf.exe
  C:\Windows\System\pkIRkbf.exe
  2⤵
  PID:6436
- C:\Windows\System\xmiaKYq.exe
  C:\Windows\System\xmiaKYq.exe
  2⤵
  PID:6168
- C:\Windows\System\bfzGqUp.exe
  C:\Windows\System\bfzGqUp.exe
  2⤵
  PID:6424
- C:\Windows\System\obbNKvn.exe
  C:\Windows\System\obbNKvn.exe
  2⤵
  PID:6472
- C:\Windows\System\ePbRGVl.exe
  C:\Windows\System\ePbRGVl.exe
  2⤵
  PID:6524
- C:\Windows\System\YdsycuR.exe
  C:\Windows\System\YdsycuR.exe
  2⤵
  PID:6672
- C:\Windows\System\vzMOsRw.exe
  C:\Windows\System\vzMOsRw.exe
  2⤵
  PID:6588
- C:\Windows\System\UwcxALe.exe
  C:\Windows\System\UwcxALe.exe
  2⤵
  PID:6620
- C:\Windows\System\YNxXJou.exe
  C:\Windows\System\YNxXJou.exe
  2⤵
  PID:6800
- C:\Windows\System\EHifSQM.exe
  C:\Windows\System\EHifSQM.exe
  2⤵
  PID:6868
- C:\Windows\System\DGqeGri.exe
  C:\Windows\System\DGqeGri.exe
  2⤵
  PID:6988
- C:\Windows\System\OVMHhSk.exe
  C:\Windows\System\OVMHhSk.exe
  2⤵
  PID:6788
- C:\Windows\System\CnJvogo.exe
  C:\Windows\System\CnJvogo.exe
  2⤵
  PID:6892
- C:\Windows\System\yYsSGHY.exe
  C:\Windows\System\yYsSGHY.exe
  2⤵
  PID:6952
- C:\Windows\System\ZVTNYpK.exe
  C:\Windows\System\ZVTNYpK.exe
  2⤵
  PID:7068
- C:\Windows\System\TzrdPPT.exe
  C:\Windows\System\TzrdPPT.exe
  2⤵
  PID:5240
- C:\Windows\System\wYLizjW.exe
  C:\Windows\System\wYLizjW.exe
  2⤵
  PID:6200
- C:\Windows\System\PSYhFor.exe
  C:\Windows\System\PSYhFor.exe
  2⤵
  PID:5888
- C:\Windows\System\yyURAYi.exe
  C:\Windows\System\yyURAYi.exe
  2⤵
  PID:6248
- C:\Windows\System\ZBDGLDt.exe
  C:\Windows\System\ZBDGLDt.exe
  2⤵
  PID:6640
- C:\Windows\System\FFgplzp.exe
  C:\Windows\System\FFgplzp.exe
  2⤵
  PID:6296
- C:\Windows\System\MrAjrPt.exe
  C:\Windows\System\MrAjrPt.exe
  2⤵
  PID:6752
- C:\Windows\System\jzsFOVP.exe
  C:\Windows\System\jzsFOVP.exe
  2⤵
  PID:6956
- C:\Windows\System\FdQFbCF.exe
  C:\Windows\System\FdQFbCF.exe
  2⤵
  PID:7128
- C:\Windows\System\FSOYQXO.exe
  C:\Windows\System\FSOYQXO.exe
  2⤵
  PID:6904
- C:\Windows\System\fjvobsF.exe
  C:\Windows\System\fjvobsF.exe
  2⤵
  PID:7008
- C:\Windows\System\uRIRaqp.exe
  C:\Windows\System\uRIRaqp.exe
  2⤵
  PID:6560
- C:\Windows\System\iXfVtsx.exe
  C:\Windows\System\iXfVtsx.exe
  2⤵
  PID:7044
- C:\Windows\System\MoxUjcw.exe
  C:\Windows\System\MoxUjcw.exe
  2⤵
  PID:6928
- C:\Windows\System\ZTGvwOs.exe
  C:\Windows\System\ZTGvwOs.exe
  2⤵
  PID:6120
- C:\Windows\System\DxSZRKL.exe
  C:\Windows\System\DxSZRKL.exe
  2⤵
  PID:6456
- C:\Windows\System\GCOENnf.exe
  C:\Windows\System\GCOENnf.exe
  2⤵
  PID:6244
- C:\Windows\System\xDxXMnm.exe
  C:\Windows\System\xDxXMnm.exe
  2⤵
  PID:7184
- C:\Windows\System\syllbcw.exe
  C:\Windows\System\syllbcw.exe
  2⤵
  PID:7200
- C:\Windows\System\Jvctzbe.exe
  C:\Windows\System\Jvctzbe.exe
  2⤵
  PID:7216
- C:\Windows\System\FZnujIx.exe
  C:\Windows\System\FZnujIx.exe
  2⤵
  PID:7236
- C:\Windows\System\ckSYjvG.exe
  C:\Windows\System\ckSYjvG.exe
  2⤵
  PID:7252
- C:\Windows\System\CHstHMU.exe
  C:\Windows\System\CHstHMU.exe
  2⤵
  PID:7268
- C:\Windows\System\VXixmAq.exe
  C:\Windows\System\VXixmAq.exe
  2⤵
  PID:7284
- C:\Windows\System\zNlZhaf.exe
  C:\Windows\System\zNlZhaf.exe
  2⤵
  PID:7300
- C:\Windows\System\zeNYrzs.exe
  C:\Windows\System\zeNYrzs.exe
  2⤵
  PID:7316
- C:\Windows\System\dEOCLdi.exe
  C:\Windows\System\dEOCLdi.exe
  2⤵
  PID:7332
- C:\Windows\System\sLkytKa.exe
  C:\Windows\System\sLkytKa.exe
  2⤵
  PID:7348
- C:\Windows\System\XumyZLv.exe
  C:\Windows\System\XumyZLv.exe
  2⤵
  PID:7364
- C:\Windows\System\tttqzmj.exe
  C:\Windows\System\tttqzmj.exe
  2⤵
  PID:7380
- C:\Windows\System\orGjWZv.exe
  C:\Windows\System\orGjWZv.exe
  2⤵
  PID:7396
- C:\Windows\System\FnUPTki.exe
  C:\Windows\System\FnUPTki.exe
  2⤵
  PID:7412
- C:\Windows\System\qKOtZwz.exe
  C:\Windows\System\qKOtZwz.exe
  2⤵
  PID:7428
- C:\Windows\System\DqQWTVs.exe
  C:\Windows\System\DqQWTVs.exe
  2⤵
  PID:7444
- C:\Windows\System\zNltzZK.exe
  C:\Windows\System\zNltzZK.exe
  2⤵
  PID:7504
- C:\Windows\System\zvGyHWU.exe
  C:\Windows\System\zvGyHWU.exe
  2⤵
  PID:7524
- C:\Windows\System\zKrmOKg.exe
  C:\Windows\System\zKrmOKg.exe
  2⤵
  PID:7540
- C:\Windows\System\UZpntCC.exe
  C:\Windows\System\UZpntCC.exe
  2⤵
  PID:7556
- C:\Windows\System\aVhgDpc.exe
  C:\Windows\System\aVhgDpc.exe
  2⤵
  PID:7572
- C:\Windows\System\RxpBlAG.exe
  C:\Windows\System\RxpBlAG.exe
  2⤵
  PID:7588
- C:\Windows\System\HfEwQeD.exe
  C:\Windows\System\HfEwQeD.exe
  2⤵
  PID:7604
- C:\Windows\System\qSpLYcB.exe
  C:\Windows\System\qSpLYcB.exe
  2⤵
  PID:7624
- C:\Windows\System\OsTYyNK.exe
  C:\Windows\System\OsTYyNK.exe
  2⤵
  PID:7640
- C:\Windows\System\vWtylIr.exe
  C:\Windows\System\vWtylIr.exe
  2⤵
  PID:7656
- C:\Windows\System\VqeMLCO.exe
  C:\Windows\System\VqeMLCO.exe
  2⤵
  PID:7672
- C:\Windows\System\mzvBxOM.exe
  C:\Windows\System\mzvBxOM.exe
  2⤵
  PID:7688
- C:\Windows\System\IwgQgWd.exe
  C:\Windows\System\IwgQgWd.exe
  2⤵
  PID:7704
- C:\Windows\System\szJXtPz.exe
  C:\Windows\System\szJXtPz.exe
  2⤵
  PID:7728
- C:\Windows\System\TgymGJD.exe
  C:\Windows\System\TgymGJD.exe
  2⤵
  PID:7744
- C:\Windows\System\bFkaNDB.exe
  C:\Windows\System\bFkaNDB.exe
  2⤵
  PID:7760
- C:\Windows\System\IqAatVa.exe
  C:\Windows\System\IqAatVa.exe
  2⤵
  PID:7776
- C:\Windows\System\YrErIgD.exe
  C:\Windows\System\YrErIgD.exe
  2⤵
  PID:7792
- C:\Windows\System\qOvVpeq.exe
  C:\Windows\System\qOvVpeq.exe
  2⤵
  PID:7808
- C:\Windows\System\mjqqxAb.exe
  C:\Windows\System\mjqqxAb.exe
  2⤵
  PID:7824
- C:\Windows\System\IitwrZR.exe
  C:\Windows\System\IitwrZR.exe
  2⤵
  PID:7840
- C:\Windows\System\iRsVVjc.exe
  C:\Windows\System\iRsVVjc.exe
  2⤵
  PID:7856
- C:\Windows\System\pCVnXgA.exe
  C:\Windows\System\pCVnXgA.exe
  2⤵
  PID:7872
- C:\Windows\System\uSIKmwd.exe
  C:\Windows\System\uSIKmwd.exe
  2⤵
  PID:7888
- C:\Windows\System\lGpKjOs.exe
  C:\Windows\System\lGpKjOs.exe
  2⤵
  PID:7904
- C:\Windows\System\UwILznA.exe
  C:\Windows\System\UwILznA.exe
  2⤵
  PID:7924
- C:\Windows\System\FQtXuXf.exe
  C:\Windows\System\FQtXuXf.exe
  2⤵
  PID:7940
- C:\Windows\System\vFWBONg.exe
  C:\Windows\System\vFWBONg.exe
  2⤵
  PID:7956
- C:\Windows\System\nZMObOl.exe
  C:\Windows\System\nZMObOl.exe
  2⤵
  PID:7972
- C:\Windows\System\FYLWmLB.exe
  C:\Windows\System\FYLWmLB.exe
  2⤵
  PID:7988
- C:\Windows\System\eOsgFhP.exe
  C:\Windows\System\eOsgFhP.exe
  2⤵
  PID:8004
- C:\Windows\System\vzahBAQ.exe
  C:\Windows\System\vzahBAQ.exe
  2⤵
  PID:8020
- C:\Windows\System\ackVYlS.exe
  C:\Windows\System\ackVYlS.exe
  2⤵
  PID:8036
- C:\Windows\System\SBmPNZI.exe
  C:\Windows\System\SBmPNZI.exe
  2⤵
  PID:8052
- C:\Windows\System\QMwIEoO.exe
  C:\Windows\System\QMwIEoO.exe
  2⤵
  PID:8068
- C:\Windows\System\vXbKcXl.exe
  C:\Windows\System\vXbKcXl.exe
  2⤵
  PID:8084
- C:\Windows\System\kzMzztt.exe
  C:\Windows\System\kzMzztt.exe
  2⤵
  PID:8100
- C:\Windows\System\iHjAfDy.exe
  C:\Windows\System\iHjAfDy.exe
  2⤵
  PID:8116
- C:\Windows\System\LARjUfn.exe
  C:\Windows\System\LARjUfn.exe
  2⤵
  PID:8132
- C:\Windows\System\RbOZXxy.exe
  C:\Windows\System\RbOZXxy.exe
  2⤵
  PID:8148
- C:\Windows\System\eWUmmVf.exe
  C:\Windows\System\eWUmmVf.exe
  2⤵
  PID:8164
- C:\Windows\System\Itvbyal.exe
  C:\Windows\System\Itvbyal.exe
  2⤵
  PID:8180
- C:\Windows\System\QjOoFJK.exe
  C:\Windows\System\QjOoFJK.exe
  2⤵
  PID:7028
- C:\Windows\System\smpMgMT.exe
  C:\Windows\System\smpMgMT.exe
  2⤵
  PID:7224
- C:\Windows\System\xXwNYjQ.exe
  C:\Windows\System\xXwNYjQ.exe
  2⤵
  PID:7212
- C:\Windows\System\uxIqmXg.exe
  C:\Windows\System\uxIqmXg.exe
  2⤵
  PID:7228
- C:\Windows\System\DoEXeSx.exe
  C:\Windows\System\DoEXeSx.exe
  2⤵
  PID:7264
- C:\Windows\System\WkVRxLO.exe
  C:\Windows\System\WkVRxLO.exe
  2⤵
  PID:7308
- C:\Windows\System\wMeXILd.exe
  C:\Windows\System\wMeXILd.exe
  2⤵
  PID:7344
- C:\Windows\System\iwPQhsg.exe
  C:\Windows\System\iwPQhsg.exe
  2⤵
  PID:7356
- C:\Windows\System\jOfggJA.exe
  C:\Windows\System\jOfggJA.exe
  2⤵
  PID:7420
- C:\Windows\System\pOxYGGy.exe
  C:\Windows\System\pOxYGGy.exe
  2⤵
  PID:7372
- C:\Windows\System\PSWFRbC.exe
  C:\Windows\System\PSWFRbC.exe
  2⤵
  PID:7440
- C:\Windows\System\hOSKNkW.exe
  C:\Windows\System\hOSKNkW.exe
  2⤵
  PID:7472
- C:\Windows\System\oDYUyBF.exe
  C:\Windows\System\oDYUyBF.exe
  2⤵
  PID:7488
- C:\Windows\System\yQrpyhX.exe
  C:\Windows\System\yQrpyhX.exe
  2⤵
  PID:7456
- C:\Windows\System\sqeqHMw.exe
  C:\Windows\System\sqeqHMw.exe
  2⤵
  PID:7512
- C:\Windows\System\LXWmFhR.exe
  C:\Windows\System\LXWmFhR.exe
  2⤵
  PID:7600
- C:\Windows\System\pdBzaFc.exe
  C:\Windows\System\pdBzaFc.exe
  2⤵
  PID:7584
- C:\Windows\System\PcNpWpz.exe
  C:\Windows\System\PcNpWpz.exe
  2⤵
  PID:7632
- C:\Windows\System\JMhgoej.exe
  C:\Windows\System\JMhgoej.exe
  2⤵
  PID:7696
- C:\Windows\System\IOKJIfj.exe
  C:\Windows\System\IOKJIfj.exe
  2⤵
  PID:7648
- C:\Windows\System\HQDmOCU.exe
  C:\Windows\System\HQDmOCU.exe
  2⤵
  PID:7736
- C:\Windows\System\IhUlFrw.exe
  C:\Windows\System\IhUlFrw.exe
  2⤵
  PID:7800
- C:\Windows\System\WwdDUwF.exe
  C:\Windows\System\WwdDUwF.exe
  2⤵
  PID:7752
- C:\Windows\System\HXUWcxx.exe
  C:\Windows\System\HXUWcxx.exe
  2⤵
  PID:7788
- C:\Windows\System\PXPZRVR.exe
  C:\Windows\System\PXPZRVR.exe
  2⤵
  PID:7864
- C:\Windows\System\oZEzymv.exe
  C:\Windows\System\oZEzymv.exe
  2⤵
  PID:7900
- C:\Windows\System\oRWLmbZ.exe
  C:\Windows\System\oRWLmbZ.exe
  2⤵
  PID:7916
- C:\Windows\System\BurCkdd.exe
  C:\Windows\System\BurCkdd.exe
  2⤵
  PID:7948
- C:\Windows\System\APTTOdN.exe
  C:\Windows\System\APTTOdN.exe
  2⤵
  PID:7996
- C:\Windows\System\WdIetMJ.exe
  C:\Windows\System\WdIetMJ.exe
  2⤵
  PID:7980
- C:\Windows\System\AvdCBTa.exe
  C:\Windows\System\AvdCBTa.exe
  2⤵
  PID:8096
- C:\Windows\System\LQlvQwE.exe
  C:\Windows\System\LQlvQwE.exe
  2⤵
  PID:8016
- C:\Windows\System\KiWkzcd.exe
  C:\Windows\System\KiWkzcd.exe
  2⤵
  PID:8076
- C:\Windows\System\CpJirQy.exe
  C:\Windows\System\CpJirQy.exe
  2⤵
  PID:8108
- C:\Windows\System\MUEDBZc.exe
  C:\Windows\System\MUEDBZc.exe
  2⤵
  PID:7408
- C:\Windows\System\NiJXZVS.exe
  C:\Windows\System\NiJXZVS.exe
  2⤵
  PID:7536
- C:\Windows\System\tMQJtod.exe
  C:\Windows\System\tMQJtod.exe
  2⤵
  PID:8172
- C:\Windows\System\jdakSsf.exe
  C:\Windows\System\jdakSsf.exe
  2⤵
  PID:7208
- C:\Windows\System\EFAWzXX.exe
  C:\Windows\System\EFAWzXX.exe
  2⤵
  PID:7404
- C:\Windows\System\AANjTrl.exe
  C:\Windows\System\AANjTrl.exe
  2⤵
  PID:7468
- C:\Windows\System\BhqxIVu.exe
  C:\Windows\System\BhqxIVu.exe
  2⤵
  PID:7520
- C:\Windows\System\GIQBnDU.exe
  C:\Windows\System\GIQBnDU.exe
  2⤵
  PID:7552
- C:\Windows\System\QLKLIwH.exe
  C:\Windows\System\QLKLIwH.exe
  2⤵
  PID:7684
- C:\Windows\System\zyrAlGh.exe
  C:\Windows\System\zyrAlGh.exe
  2⤵
  PID:7740
- C:\Windows\System\SZfYNBh.exe
  C:\Windows\System\SZfYNBh.exe
  2⤵
  PID:7836
- C:\Windows\System\OuqVncl.exe
  C:\Windows\System\OuqVncl.exe
  2⤵
  PID:7896
- C:\Windows\System\TbjpPNg.exe
  C:\Windows\System\TbjpPNg.exe
  2⤵
  PID:7968
- C:\Windows\System\RWzrWmp.exe
  C:\Windows\System\RWzrWmp.exe
  2⤵
  PID:8112
- C:\Windows\System\CCBIXRi.exe
  C:\Windows\System\CCBIXRi.exe
  2⤵
  PID:8032
- C:\Windows\System\sppOtOD.exe
  C:\Windows\System\sppOtOD.exe
  2⤵
  PID:7124
- C:\Windows\System\QzEBxAh.exe
  C:\Windows\System\QzEBxAh.exe
  2⤵
  PID:6440
- C:\Windows\System\PaLPDbZ.exe
  C:\Windows\System\PaLPDbZ.exe
  2⤵
  PID:7392
- C:\Windows\System\xLxJsSu.exe
  C:\Windows\System\xLxJsSu.exe
  2⤵
  PID:8144
- C:\Windows\System\LiPzbju.exe
  C:\Windows\System\LiPzbju.exe
  2⤵
  PID:7652
- C:\Windows\System\NdTZGjO.exe
  C:\Windows\System\NdTZGjO.exe
  2⤵
  PID:7756
- C:\Windows\System\mGCBjOP.exe
  C:\Windows\System\mGCBjOP.exe
  2⤵
  PID:7196
- C:\Windows\System\IPLOBeX.exe
  C:\Windows\System\IPLOBeX.exe
  2⤵
  PID:7880
- C:\Windows\System\EiwRcLs.exe
  C:\Windows\System\EiwRcLs.exe
  2⤵
  PID:7636
- C:\Windows\System\zlphYyj.exe
  C:\Windows\System\zlphYyj.exe
  2⤵
  PID:8028
- C:\Windows\System\GOMzHKe.exe
  C:\Windows\System\GOMzHKe.exe
  2⤵
  PID:8060
- C:\Windows\System\kkfDCMo.exe
  C:\Windows\System\kkfDCMo.exe
  2⤵
  PID:7296
- C:\Windows\System\mPMJSLv.exe
  C:\Windows\System\mPMJSLv.exe
  2⤵
  PID:8140
- C:\Windows\System\foPxiEq.exe
  C:\Windows\System\foPxiEq.exe
  2⤵
  PID:7804
- C:\Windows\System\zBTfzmj.exe
  C:\Windows\System\zBTfzmj.exe
  2⤵
  PID:8012
- C:\Windows\System\riYEYHY.exe
  C:\Windows\System\riYEYHY.exe
  2⤵
  PID:7360
- C:\Windows\System\QdVqvCc.exe
  C:\Windows\System\QdVqvCc.exe
  2⤵
  PID:8196
- C:\Windows\System\tMOSlby.exe
  C:\Windows\System\tMOSlby.exe
  2⤵
  PID:8212
- C:\Windows\System\SItKiaR.exe
  C:\Windows\System\SItKiaR.exe
  2⤵
  PID:8228
- C:\Windows\System\TnOMgUR.exe
  C:\Windows\System\TnOMgUR.exe
  2⤵
  PID:8244
- C:\Windows\System\UjJyiZK.exe
  C:\Windows\System\UjJyiZK.exe
  2⤵
  PID:8260
- C:\Windows\System\NlOaIvS.exe
  C:\Windows\System\NlOaIvS.exe
  2⤵
  PID:8276
- C:\Windows\System\HFqwBMt.exe
  C:\Windows\System\HFqwBMt.exe
  2⤵
  PID:8292
- C:\Windows\System\byRmFXM.exe
  C:\Windows\System\byRmFXM.exe
  2⤵
  PID:8308
- C:\Windows\System\TyAVukg.exe
  C:\Windows\System\TyAVukg.exe
  2⤵
  PID:8328
- C:\Windows\System\tGYkAtB.exe
  C:\Windows\System\tGYkAtB.exe
  2⤵
  PID:8344
- C:\Windows\System\uNAzrNf.exe
  C:\Windows\System\uNAzrNf.exe
  2⤵
  PID:8360
- C:\Windows\System\QTYycXw.exe
  C:\Windows\System\QTYycXw.exe
  2⤵
  PID:8376
- C:\Windows\System\zqYyRMv.exe
  C:\Windows\System\zqYyRMv.exe
  2⤵
  PID:8392
- C:\Windows\System\pvRZTLv.exe
  C:\Windows\System\pvRZTLv.exe
  2⤵
  PID:8412
- C:\Windows\System\VgRhyYz.exe
  C:\Windows\System\VgRhyYz.exe
  2⤵
  PID:8428
- C:\Windows\System\ILGjist.exe
  C:\Windows\System\ILGjist.exe
  2⤵
  PID:8444
- C:\Windows\System\AECnfUZ.exe
  C:\Windows\System\AECnfUZ.exe
  2⤵
  PID:8460
- C:\Windows\System\SCnsPSy.exe
  C:\Windows\System\SCnsPSy.exe
  2⤵
  PID:8476
- C:\Windows\System\VbKiinp.exe
  C:\Windows\System\VbKiinp.exe
  2⤵
  PID:8492
- C:\Windows\System\YnkOELA.exe
  C:\Windows\System\YnkOELA.exe
  2⤵
  PID:8512
- C:\Windows\System\fbLEfVp.exe
  C:\Windows\System\fbLEfVp.exe
  2⤵
  PID:8536
- C:\Windows\System\LbDZbxu.exe
  C:\Windows\System\LbDZbxu.exe
  2⤵
  PID:8552
- C:\Windows\System\TwJYInI.exe
  C:\Windows\System\TwJYInI.exe
  2⤵
  PID:8568
- C:\Windows\System\wzKRcdi.exe
  C:\Windows\System\wzKRcdi.exe
  2⤵
  PID:8584
- C:\Windows\System\zTddhJz.exe
  C:\Windows\System\zTddhJz.exe
  2⤵
  PID:8600
- C:\Windows\System\ixbMtwU.exe
  C:\Windows\System\ixbMtwU.exe
  2⤵
  PID:8616
- C:\Windows\System\mOjbxPS.exe
  C:\Windows\System\mOjbxPS.exe
  2⤵
  PID:8632
- C:\Windows\System\Cgjkhjh.exe
  C:\Windows\System\Cgjkhjh.exe
  2⤵
  PID:8648
- C:\Windows\System\cCasGOr.exe
  C:\Windows\System\cCasGOr.exe
  2⤵
  PID:8664
- C:\Windows\System\PZipIWX.exe
  C:\Windows\System\PZipIWX.exe
  2⤵
  PID:8680
- C:\Windows\System\nHVmMcE.exe
  C:\Windows\System\nHVmMcE.exe
  2⤵
  PID:8696
- C:\Windows\System\MIxsCOF.exe
  C:\Windows\System\MIxsCOF.exe
  2⤵
  PID:8712
- C:\Windows\System\qFARXsH.exe
  C:\Windows\System\qFARXsH.exe
  2⤵
  PID:8728
- C:\Windows\System\caplbDm.exe
  C:\Windows\System\caplbDm.exe
  2⤵
  PID:8744
- C:\Windows\System\oBTzSJO.exe
  C:\Windows\System\oBTzSJO.exe
  2⤵
  PID:8760
- C:\Windows\System\AxLxalD.exe
  C:\Windows\System\AxLxalD.exe
  2⤵
  PID:8776
- C:\Windows\System\RgSNamx.exe
  C:\Windows\System\RgSNamx.exe
  2⤵
  PID:8792
- C:\Windows\System\aYbSBCN.exe
  C:\Windows\System\aYbSBCN.exe
  2⤵
  PID:8808
- C:\Windows\System\dXfgPIQ.exe
  C:\Windows\System\dXfgPIQ.exe
  2⤵
  PID:8824
- C:\Windows\System\qukVHaj.exe
  C:\Windows\System\qukVHaj.exe
  2⤵
  PID:8840
- C:\Windows\System\xBoRCxg.exe
  C:\Windows\System\xBoRCxg.exe
  2⤵
  PID:8856
- C:\Windows\System\HeFMaaI.exe
  C:\Windows\System\HeFMaaI.exe
  2⤵
  PID:8872
- C:\Windows\System\eOwzdye.exe
  C:\Windows\System\eOwzdye.exe
  2⤵
  PID:8892
- C:\Windows\System\SdBOzxc.exe
  C:\Windows\System\SdBOzxc.exe
  2⤵
  PID:8908
- C:\Windows\System\IlSQsim.exe
  C:\Windows\System\IlSQsim.exe
  2⤵
  PID:8924
- C:\Windows\System\TgnFzqx.exe
  C:\Windows\System\TgnFzqx.exe
  2⤵
  PID:8948
- C:\Windows\System\dVSBesI.exe
  C:\Windows\System\dVSBesI.exe
  2⤵
  PID:8968
- C:\Windows\System\MrLxzhu.exe
  C:\Windows\System\MrLxzhu.exe
  2⤵
  PID:8984
- C:\Windows\System\lycBSyE.exe
  C:\Windows\System\lycBSyE.exe
  2⤵
  PID:9004
- C:\Windows\System\UqKGtCL.exe
  C:\Windows\System\UqKGtCL.exe
  2⤵
  PID:9020
- C:\Windows\System\ynxVQHR.exe
  C:\Windows\System\ynxVQHR.exe
  2⤵
  PID:9036
- C:\Windows\System\XAzEODj.exe
  C:\Windows\System\XAzEODj.exe
  2⤵
  PID:9068
- C:\Windows\System\BInugCB.exe
  C:\Windows\System\BInugCB.exe
  2⤵
  PID:9092
- C:\Windows\System\XCVxImD.exe
  C:\Windows\System\XCVxImD.exe
  2⤵
  PID:9124
- C:\Windows\System\NASELxG.exe
  C:\Windows\System\NASELxG.exe
  2⤵
  PID:9140
- C:\Windows\System\LkGwVBE.exe
  C:\Windows\System\LkGwVBE.exe
  2⤵
  PID:9156
- C:\Windows\System\trkPZpB.exe
  C:\Windows\System\trkPZpB.exe
  2⤵
  PID:9172
- C:\Windows\System\rkjherA.exe
  C:\Windows\System\rkjherA.exe
  2⤵
  PID:9196
- C:\Windows\System\AvQyXTL.exe
  C:\Windows\System\AvQyXTL.exe
  2⤵
  PID:9212
- C:\Windows\System\RapBHjU.exe
  C:\Windows\System\RapBHjU.exe
  2⤵
  PID:6676
- C:\Windows\System\dSJWIzd.exe
  C:\Windows\System\dSJWIzd.exe
  2⤵
  PID:7500
- C:\Windows\System\VmVHlLh.exe
  C:\Windows\System\VmVHlLh.exe
  2⤵
  PID:7832
- C:\Windows\System\lHvFqhd.exe
  C:\Windows\System\lHvFqhd.exe
  2⤵
  PID:8256
- C:\Windows\System\UUYkERu.exe
  C:\Windows\System\UUYkERu.exe
  2⤵
  PID:8272
- C:\Windows\System\oRqjPAs.exe
  C:\Windows\System\oRqjPAs.exe
  2⤵
  PID:8340
- C:\Windows\System\YqGAkPn.exe
  C:\Windows\System\YqGAkPn.exe
  2⤵
  PID:8436
- C:\Windows\System\UOBTSaY.exe
  C:\Windows\System\UOBTSaY.exe
  2⤵
  PID:8420
- C:\Windows\System\PHtMABA.exe
  C:\Windows\System\PHtMABA.exe
  2⤵
  PID:8356
- C:\Windows\System\RmTgiEv.exe
  C:\Windows\System\RmTgiEv.exe
  2⤵
  PID:7616
- C:\Windows\System\chskrFI.exe
  C:\Windows\System\chskrFI.exe
  2⤵
  PID:8456
- C:\Windows\System\vxXXOUQ.exe
  C:\Windows\System\vxXXOUQ.exe
  2⤵
  PID:8520
- C:\Windows\System\ZxGMdeZ.exe
  C:\Windows\System\ZxGMdeZ.exe
  2⤵
  PID:8532
- C:\Windows\System\oiUtwOx.exe
  C:\Windows\System\oiUtwOx.exe
  2⤵
  PID:8560
- C:\Windows\System\eLaItOs.exe
  C:\Windows\System\eLaItOs.exe
  2⤵
  PID:8608
- C:\Windows\System\OGpkkkB.exe
  C:\Windows\System\OGpkkkB.exe
  2⤵
  PID:8672
- C:\Windows\System\ggMxolv.exe
  C:\Windows\System\ggMxolv.exe
  2⤵
  PID:8740
- C:\Windows\System\BrvzcVk.exe
  C:\Windows\System\BrvzcVk.exe
  2⤵
  PID:8868
- C:\Windows\System\kvrZDQf.exe
  C:\Windows\System\kvrZDQf.exe
  2⤵
  PID:8660
- C:\Windows\System\PmBuWhw.exe
  C:\Windows\System\PmBuWhw.exe
  2⤵
  PID:8752
- C:\Windows\System\ZMeIaIH.exe
  C:\Windows\System\ZMeIaIH.exe
  2⤵
  PID:8900
- C:\Windows\System\FSPfJmB.exe
  C:\Windows\System\FSPfJmB.exe
  2⤵
  PID:8940
- C:\Windows\System\eqLyfxg.exe
  C:\Windows\System\eqLyfxg.exe
  2⤵
  PID:9012
- C:\Windows\System\rIicSUY.exe
  C:\Windows\System\rIicSUY.exe
  2⤵
  PID:8992
- C:\Windows\System\wrOxtzq.exe
  C:\Windows\System\wrOxtzq.exe
  2⤵
  PID:8996
- C:\Windows\System\csRuEiC.exe
  C:\Windows\System\csRuEiC.exe
  2⤵
  PID:9056
- C:\Windows\System\FBEsTnS.exe
  C:\Windows\System\FBEsTnS.exe
  2⤵
  PID:9084
- C:\Windows\System\iWwMcse.exe
  C:\Windows\System\iWwMcse.exe
  2⤵
  PID:9132
- C:\Windows\System\gOPBKng.exe
  C:\Windows\System\gOPBKng.exe
  2⤵
  PID:8208
- C:\Windows\System\WiqdRPK.exe
  C:\Windows\System\WiqdRPK.exe
  2⤵
  PID:8240
- C:\Windows\System\XvpbTMm.exe
  C:\Windows\System\XvpbTMm.exe
  2⤵
  PID:8388
- C:\Windows\System\EujkjCq.exe
  C:\Windows\System\EujkjCq.exe
  2⤵
  PID:8528
- C:\Windows\System\uuQDKMA.exe
  C:\Windows\System\uuQDKMA.exe
  2⤵
  PID:8804
- C:\Windows\System\gmOjSEx.exe
  C:\Windows\System\gmOjSEx.exe
  2⤵
  PID:8336
- C:\Windows\System\gWFfLTd.exe
  C:\Windows\System\gWFfLTd.exe
  2⤵
  PID:8440
- C:\Windows\System\vgKoFeW.exe
  C:\Windows\System\vgKoFeW.exe
  2⤵
  PID:8544
- C:\Windows\System\PSWnBxx.exe
  C:\Windows\System\PSWnBxx.exe
  2⤵
  PID:8884
- C:\Windows\System\uxYHsDG.exe
  C:\Windows\System\uxYHsDG.exe
  2⤵
  PID:8640
- C:\Windows\System\jJXsXvC.exe
  C:\Windows\System\jJXsXvC.exe
  2⤵
  PID:9116
- C:\Windows\System\ZOQARpL.exe
  C:\Windows\System\ZOQARpL.exe
  2⤵
  PID:9108
- C:\Windows\System\yrKolCL.exe
  C:\Windows\System\yrKolCL.exe
  2⤵
  PID:9152
- C:\Windows\System\oeyXaqV.exe
  C:\Windows\System\oeyXaqV.exe
  2⤵
  PID:8236
- C:\Windows\System\uCEveWr.exe
  C:\Windows\System\uCEveWr.exe
  2⤵
  PID:8268
- C:\Windows\System\pLBkNNP.exe
  C:\Windows\System\pLBkNNP.exe
  2⤵
  PID:8576
- C:\Windows\System\tLEFhIc.exe
  C:\Windows\System\tLEFhIc.exe
  2⤵
  PID:8864
- C:\Windows\System\TlUoHyH.exe
  C:\Windows\System\TlUoHyH.exe
  2⤵
  PID:8916
- C:\Windows\System\iGMkinE.exe
  C:\Windows\System\iGMkinE.exe
  2⤵
  PID:8788
- C:\Windows\System\CNlioLE.exe
  C:\Windows\System\CNlioLE.exe
  2⤵
  PID:8880
- C:\Windows\System\eSHzosJ.exe
  C:\Windows\System\eSHzosJ.exe
  2⤵
  PID:8816
- C:\Windows\System\XHtbYJn.exe
  C:\Windows\System\XHtbYJn.exe
  2⤵
  PID:8888
- C:\Windows\System\BgmRjfX.exe
  C:\Windows\System\BgmRjfX.exe
  2⤵
  PID:9048
- C:\Windows\System\EumMFVC.exe
  C:\Windows\System\EumMFVC.exe
  2⤵
  PID:8156
- C:\Windows\System\UMJqfGW.exe
  C:\Windows\System\UMJqfGW.exe
  2⤵
  PID:8304
- C:\Windows\System\esbOlqs.exe
  C:\Windows\System\esbOlqs.exe
  2⤵
  PID:8424
- C:\Windows\System\kuHNSyc.exe
  C:\Windows\System\kuHNSyc.exe
  2⤵
  PID:8756
- C:\Windows\System\XzhntxG.exe
  C:\Windows\System\XzhntxG.exe
  2⤵
  PID:9204
- C:\Windows\System\FDtNRuH.exe
  C:\Windows\System\FDtNRuH.exe
  2⤵
  PID:8768
- C:\Windows\System\RJiVRrQ.exe
  C:\Windows\System\RJiVRrQ.exe
  2⤵
  PID:8956
- C:\Windows\System\mhxOZXE.exe
  C:\Windows\System\mhxOZXE.exe
  2⤵
  PID:8400
- C:\Windows\System\kTPhggb.exe
  C:\Windows\System\kTPhggb.exe
  2⤵
  PID:7720
- C:\Windows\System\zdmmRBy.exe
  C:\Windows\System\zdmmRBy.exe
  2⤵
  PID:9208
- C:\Windows\System\qMyWwzR.exe
  C:\Windows\System\qMyWwzR.exe
  2⤵
  PID:8500
- C:\Windows\System\FQlPPjv.exe
  C:\Windows\System\FQlPPjv.exe
  2⤵
  PID:9104
- C:\Windows\System\XoXaOMw.exe
  C:\Windows\System\XoXaOMw.exe
  2⤵
  PID:8580
- C:\Windows\System\CYItNyS.exe
  C:\Windows\System\CYItNyS.exe
  2⤵
  PID:8372
- C:\Windows\System\BQIguUH.exe
  C:\Windows\System\BQIguUH.exe
  2⤵
  PID:8820
- C:\Windows\System\xGeGrsV.exe
  C:\Windows\System\xGeGrsV.exe
  2⤵
  PID:8628
- C:\Windows\System\KGYOOzU.exe
  C:\Windows\System\KGYOOzU.exe
  2⤵
  PID:8784
- C:\Windows\System\KtnDTVg.exe
  C:\Windows\System\KtnDTVg.exe
  2⤵
  PID:7912
- C:\Windows\System\HyIxidb.exe
  C:\Windows\System\HyIxidb.exe
  2⤵
  PID:9080
- C:\Windows\System\XauZJRf.exe
  C:\Windows\System\XauZJRf.exe
  2⤵
  PID:9228
- C:\Windows\System\ALfXemT.exe
  C:\Windows\System\ALfXemT.exe
  2⤵
  PID:9248
- C:\Windows\System\bcFWxNV.exe
  C:\Windows\System\bcFWxNV.exe
  2⤵
  PID:9264
- C:\Windows\System\HPLCqAt.exe
  C:\Windows\System\HPLCqAt.exe
  2⤵
  PID:9280
- C:\Windows\System\QVkObIW.exe
  C:\Windows\System\QVkObIW.exe
  2⤵
  PID:9300
- C:\Windows\System\DxTAJOS.exe
  C:\Windows\System\DxTAJOS.exe
  2⤵
  PID:9320
- C:\Windows\System\YgFCmTf.exe
  C:\Windows\System\YgFCmTf.exe
  2⤵
  PID:9336
- C:\Windows\System\oUtzUyR.exe
  C:\Windows\System\oUtzUyR.exe
  2⤵
  PID:9352
- C:\Windows\System\DiijErp.exe
  C:\Windows\System\DiijErp.exe
  2⤵
  PID:9384
- C:\Windows\System\KbQiasU.exe
  C:\Windows\System\KbQiasU.exe
  2⤵
  PID:9404
- C:\Windows\System\bhtflxk.exe
  C:\Windows\System\bhtflxk.exe
  2⤵
  PID:9420
- C:\Windows\System\dCuwumi.exe
  C:\Windows\System\dCuwumi.exe
  2⤵
  PID:9436
- C:\Windows\System\lTHcffv.exe
  C:\Windows\System\lTHcffv.exe
  2⤵
  PID:9456
- C:\Windows\System\JRxRfiP.exe
  C:\Windows\System\JRxRfiP.exe
  2⤵
  PID:9472
- C:\Windows\System\oAcFqdu.exe
  C:\Windows\System\oAcFqdu.exe
  2⤵
  PID:9492
- C:\Windows\System\RUFNYeZ.exe
  C:\Windows\System\RUFNYeZ.exe
  2⤵
  PID:9508
- C:\Windows\System\yPjmNDs.exe
  C:\Windows\System\yPjmNDs.exe
  2⤵
  PID:9528
- C:\Windows\System\LUwZDmH.exe
  C:\Windows\System\LUwZDmH.exe
  2⤵
  PID:9544
- C:\Windows\System\coFtiSD.exe
  C:\Windows\System\coFtiSD.exe
  2⤵
  PID:9560
- C:\Windows\System\zhlVRnY.exe
  C:\Windows\System\zhlVRnY.exe
  2⤵
  PID:9576
- C:\Windows\System\NKXSyKQ.exe
  C:\Windows\System\NKXSyKQ.exe
  2⤵
  PID:9596
- C:\Windows\System\UOPSHVq.exe
  C:\Windows\System\UOPSHVq.exe
  2⤵
  PID:9612
- C:\Windows\System\cQXysSP.exe
  C:\Windows\System\cQXysSP.exe
  2⤵
  PID:9628
- C:\Windows\System\VWokHlb.exe
  C:\Windows\System\VWokHlb.exe
  2⤵
  PID:9644
- C:\Windows\System\bJLsaLT.exe
  C:\Windows\System\bJLsaLT.exe
  2⤵
  PID:9660
- C:\Windows\System\pINeUCM.exe
  C:\Windows\System\pINeUCM.exe
  2⤵
  PID:9676
- C:\Windows\System\nhVEtgq.exe
  C:\Windows\System\nhVEtgq.exe
  2⤵
  PID:9692
- C:\Windows\System\hSlDGkX.exe
  C:\Windows\System\hSlDGkX.exe
  2⤵
  PID:9708
- C:\Windows\System\vCHSlMf.exe
  C:\Windows\System\vCHSlMf.exe
  2⤵
  PID:9724
- C:\Windows\System\iBjnlYj.exe
  C:\Windows\System\iBjnlYj.exe
  2⤵
  PID:9740
- C:\Windows\System\MLTPMyy.exe
  C:\Windows\System\MLTPMyy.exe
  2⤵
  PID:9756
- C:\Windows\System\dbQWTaQ.exe
  C:\Windows\System\dbQWTaQ.exe
  2⤵
  PID:9772
- C:\Windows\System\edtOJjV.exe
  C:\Windows\System\edtOJjV.exe
  2⤵
  PID:9788
- C:\Windows\System\frHZxSg.exe
  C:\Windows\System\frHZxSg.exe
  2⤵
  PID:9808
- C:\Windows\System\njKlFyW.exe
  C:\Windows\System\njKlFyW.exe
  2⤵
  PID:9824
- C:\Windows\System\hnnNeyV.exe
  C:\Windows\System\hnnNeyV.exe
  2⤵
  PID:9840
- C:\Windows\System\jfcvkjZ.exe
  C:\Windows\System\jfcvkjZ.exe
  2⤵
  PID:9856
- C:\Windows\System\UXVWRqs.exe
  C:\Windows\System\UXVWRqs.exe
  2⤵
  PID:9872
- C:\Windows\System\ZvTxPXG.exe
  C:\Windows\System\ZvTxPXG.exe
  2⤵
  PID:9888
- C:\Windows\System\aFdRmGw.exe
  C:\Windows\System\aFdRmGw.exe
  2⤵
  PID:9904
- C:\Windows\System\MnjWPfq.exe
  C:\Windows\System\MnjWPfq.exe
  2⤵
  PID:9920
- C:\Windows\System\kzriwlH.exe
  C:\Windows\System\kzriwlH.exe
  2⤵
  PID:9936
- C:\Windows\System\lBaqGWy.exe
  C:\Windows\System\lBaqGWy.exe
  2⤵
  PID:9952
- C:\Windows\System\bximwtd.exe
  C:\Windows\System\bximwtd.exe
  2⤵
  PID:9968
- C:\Windows\System\AjDgqqS.exe
  C:\Windows\System\AjDgqqS.exe
  2⤵
  PID:9984
- C:\Windows\System\MXGqAZT.exe
  C:\Windows\System\MXGqAZT.exe
  2⤵
  PID:10000
- C:\Windows\System\OXZHvDv.exe
  C:\Windows\System\OXZHvDv.exe
  2⤵
  PID:10016
- C:\Windows\System\GLfhCAn.exe
  C:\Windows\System\GLfhCAn.exe
  2⤵
  PID:10032
- C:\Windows\System\ssuGFGz.exe
  C:\Windows\System\ssuGFGz.exe
  2⤵
  PID:10048
- C:\Windows\System\ezJkJLc.exe
  C:\Windows\System\ezJkJLc.exe
  2⤵
  PID:10064
- C:\Windows\System\TzhwhZN.exe
  C:\Windows\System\TzhwhZN.exe
  2⤵
  PID:10088
- C:\Windows\System\OdkQiRI.exe
  C:\Windows\System\OdkQiRI.exe
  2⤵
  PID:10108
- C:\Windows\System\KwXGeoi.exe
  C:\Windows\System\KwXGeoi.exe
  2⤵
  PID:10124
- C:\Windows\System\OPkAYGz.exe
  C:\Windows\System\OPkAYGz.exe
  2⤵
  PID:10144
- C:\Windows\System\cEusFyl.exe
  C:\Windows\System\cEusFyl.exe
  2⤵
  PID:10160
- C:\Windows\System\qmAopwY.exe
  C:\Windows\System\qmAopwY.exe
  2⤵
  PID:10176
- C:\Windows\System\kSoLVZp.exe
  C:\Windows\System\kSoLVZp.exe
  2⤵
  PID:9120
- C:\Windows\System\IEYZpCu.exe
  C:\Windows\System\IEYZpCu.exe
  2⤵
  PID:9184
- C:\Windows\System\SQPngcj.exe
  C:\Windows\System\SQPngcj.exe
  2⤵
  PID:9288
- C:\Windows\System\UxuZMTG.exe
  C:\Windows\System\UxuZMTG.exe
  2⤵
  PID:9332
- C:\Windows\System\SWtdZWK.exe
  C:\Windows\System\SWtdZWK.exe
  2⤵
  PID:9312
- C:\Windows\System\HyKgNor.exe
  C:\Windows\System\HyKgNor.exe
  2⤵
  PID:9376
- C:\Windows\System\CiFnJyP.exe
  C:\Windows\System\CiFnJyP.exe
  2⤵
  PID:9412
- C:\Windows\System\mQGOVRE.exe
  C:\Windows\System\mQGOVRE.exe
  2⤵
  PID:9480
- C:\Windows\System\mHaTruN.exe
  C:\Windows\System\mHaTruN.exe
  2⤵
  PID:9516
- C:\Windows\System\trgIJML.exe
  C:\Windows\System\trgIJML.exe
  2⤵
  PID:9524
- C:\Windows\System\LGlFIpN.exe
  C:\Windows\System\LGlFIpN.exe
  2⤵
  PID:9464
- C:\Windows\System\GIeEGVH.exe
  C:\Windows\System\GIeEGVH.exe
  2⤵
  PID:9504
- C:\Windows\System\yrItRQl.exe
  C:\Windows\System\yrItRQl.exe
  2⤵
  PID:9568
- C:\Windows\System\aeVHasu.exe
  C:\Windows\System\aeVHasu.exe
  2⤵
  PID:9624
- C:\Windows\System\hdTUhUt.exe
  C:\Windows\System\hdTUhUt.exe
  2⤵
  PID:9880
- C:\Windows\System\orGvtar.exe
  C:\Windows\System\orGvtar.exe
  2⤵
  PID:9668
- C:\Windows\System\rVVMkGt.exe
  C:\Windows\System\rVVMkGt.exe
  2⤵
  PID:9944
- C:\Windows\System\lnKTKAH.exe
  C:\Windows\System\lnKTKAH.exe
  2⤵
  PID:10008
- C:\Windows\System\qEjTMFz.exe
  C:\Windows\System\qEjTMFz.exe
  2⤵
  PID:9704
- C:\Windows\System\eRiVjYM.exe
  C:\Windows\System\eRiVjYM.exe
  2⤵
  PID:9996
- C:\Windows\System\jVOAiWc.exe
  C:\Windows\System\jVOAiWc.exe
  2⤵
  PID:10024
- C:\Windows\System\idSuRSR.exe
  C:\Windows\System\idSuRSR.exe
  2⤵
  PID:10152
- C:\Windows\System\BfhGlYh.exe
  C:\Windows\System\BfhGlYh.exe
  2⤵
  PID:10104
- C:\Windows\System\hULdtyb.exe
  C:\Windows\System\hULdtyb.exe
  2⤵
  PID:10168
- C:\Windows\System\SZANdYn.exe
  C:\Windows\System\SZANdYn.exe
  2⤵
  PID:10184
- C:\Windows\System\BjsHLln.exe
  C:\Windows\System\BjsHLln.exe
  2⤵
  PID:10196
- C:\Windows\System\TWgDScj.exe
  C:\Windows\System\TWgDScj.exe
  2⤵
  PID:10224
- C:\Windows\System\DAoEVxK.exe
  C:\Windows\System\DAoEVxK.exe
  2⤵
  PID:9220
- C:\Windows\System\OytJhOW.exe
  C:\Windows\System\OytJhOW.exe
  2⤵
  PID:9100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DAgLfgA.exe

Filesize
1.7MB

MD5
d456ae0012953d290c6296303071d6f7

SHA1
a5e1a7ef5de1e7471b912c3e0f4440475e99ed70

SHA256
a71f6129273fc52e7cafdc467ea12eecdd6b833c94039ab8ba29fc9dc0e777aa

SHA512
6639aada03b7a8527d724e0efa442b5152cf8c8881eaaa5603c628ab091759f1db2fce0ab02cc63a99e07c8cac31d2ea6b7f5f377494f23364e992dd5becb89b

Download Submit
C:\Windows\system\DJdAOoE.exe

Filesize
1.7MB

MD5
f2bc7d480cbdc5b9da5c520b8d589123

SHA1
fac8b59b6cddc8f0c5d27393c6b30ae5906ec54e

SHA256
9e037368d1ee2df054d5050c7082b8927151eb2b2429a9ee693627cea331a946

SHA512
c54ee5858dfddd85c9517c34217ad9be40036268b20444beb995e2b78ea5e0c636d97862252d5fa96ddde338987749202c693ab3d00a1a9f887727081b2b4932

Download Submit
C:\Windows\system\DLYKWCb.exe

Filesize
1.7MB

MD5
40bb09ec46f1f6ab2f0accd1c4e751d0

SHA1
87d58aac2cbb7eefc6a4033b867fd908890bdb10

SHA256
624218b6265ada24346bc3ce7166c125ded85d5a24bf41496e94a4686fd5d629

SHA512
37d20b8658c7d866cbad635a47e1cd1183a4f937707f5551a7029ff43c97dd06cdd13b6456884b0fa06d7b168812aa0772e337a42fb676a84674f6db803174f8

Download Submit
C:\Windows\system\IJlnvgR.exe

Filesize
1.7MB

MD5
b46423ba49fb2ee3c88260e923f96a51

SHA1
42c0ef27c7747601182c9252cd2fc922980bbd7f

SHA256
d9a3714a91c2a20deaaf491878fb03cbebca6608defc10f001281f20804d983a

SHA512
3b1f388dd6a8872e3b6e09eddc8d0327c374702e00f784a51fe14bc2177ac362342c31abbc48524c80e75e6a8979f7f1c0a94ac94c4ec2b2659a0a0c982c1b52

Download Submit
C:\Windows\system\MEVjEZl.exe

Filesize
1.7MB

MD5
fe77321aa05aae0369f2413df580e201

SHA1
304ff53232426a315943cc4bf70e0106563e566e

SHA256
a8ff2d3a125530605486afb51e44654b2f53e8c73b74a6ca303b73ccde1d82ef

SHA512
2af863807a08f0f9ef4c200c9774dee7570e070ac8414ae47788e2edda2e2c91deb7b338a516a51f5f652ab2b05a96fe68e810708787276f06877868f72d9dad

Download Submit
C:\Windows\system\MMzUvPe.exe

Filesize
1.7MB

MD5
1043b4e7d42053744287c99bd3166966

SHA1
3a119407e2f4dad927bdf2e1fc2a6fc5541914f2

SHA256
7107c41440ae7cda164575731f62be9ea95314a591fd44eda477f11e534f8c06

SHA512
7728f1edb78075e7fa7ec0507bf0e9801325e3e994fe1d2f076e3d4478d84555fab5ad5e078ff56fac50d893c9e78549e9270aabbf9fce0b8925fc9fc83f1a28

Download Submit
C:\Windows\system\PikVYav.exe

Filesize
1.7MB

MD5
278c423029acd7cfd8edfb309a210a62

SHA1
5450090a3f31219e108e3a9910bafa2155d6cad8

SHA256
0bdb8f5e4ce5e61d0960f3bbc988c883cb77e343e639d3207d550532a0b300da

SHA512
6860d8c92103b0525b81d7000a1aba46c2e7092ff14b9f0d2a12a703e2e84c7125da5ece59e36c63ed79b27a1ac89cf3e89bbbc7493e60fb1f5e245e839aade1

Download Submit
C:\Windows\system\QWhggli.exe

Filesize
1.7MB

MD5
d9d95e5dd29d3f9935d1d9868bba692c

SHA1
651135e7c408bd9062016e6ae5d6de06f58a7533

SHA256
10e5be6d03fa5d4b73a150279f92ff6b437c27493d66286a0b810c380ef294c7

SHA512
1f704d22917ed6c363f8c2844d2570af225ca36f8d5185ed859107c63467c7925bd6ba2f7129962f3870e77232408630b3f5c67f2b08d84006168cbfd23c585d

Download Submit
C:\Windows\system\QWrFaaV.exe

Filesize
1.7MB

MD5
65fbba4ec58e54fae17e89e24a0452b1

SHA1
aee33ecc9415fd18a8ec2d27f3b95d77484b51b2

SHA256
30a55707b30356c411db36c05d170ac9e9ee7287e872d2e8562136a34a655232

SHA512
5209a35e2fb3b8afec9a73011ec9dec1d0e34ecdae7f60ad21a18ab4cbd5b47fe6a46509e6b8152d551296c416f277710529819622cacdb43d1d2598dcea92e0

Download Submit
C:\Windows\system\QpHQYHU.exe

Filesize
1.7MB

MD5
0bcdfe709dd80ca35dc50d19cb21a86a

SHA1
32d8489753c2a2a7368bf22879da32a089d752a5

SHA256
451e47cdb9a9bdf9e01578e49dc381c691026dd08ac769f7577e7a473e8d6e76

SHA512
b5f66a8c59c76f378069eefb998dd98050a2a616bd2ebe5f9a3c658350c38c302168e5a34ca2cc917bb519a06e5e297d869a9586965c1c4dcf75306d3f991be9

Download Submit
C:\Windows\system\UPblhIO.exe

Filesize
1.7MB

MD5
da69e8def26f8cb611fea42d232ac2c3

SHA1
c702800549a5ad1bdeb2187bc42344b4ebccb597

SHA256
9e793d68c02d1371ea40d047628ccf5f9d5db27c98882bb8766209264efa2700

SHA512
0e37d2098650b6e27509bcb9b383cd6c79805aeb06133a73732e3dc42ea5e31930d355ce6731c90979346dae93cad2cb700d50177b2e707f69c351545f0ff205

Download Submit
C:\Windows\system\UYRbSZi.exe

Filesize
1.7MB

MD5
647dda9186230df6652e4cbaf0f0ea2d

SHA1
33e873f87378b01d764db63bedc82206758a7ba7

SHA256
364ac51491fd1bb5f928003c91c434d92e366bf5ad794d987461cbb1915b3406

SHA512
3aef3745b454a83dda6c384a09589640c794f103caf094ecd2e2581ff41b61cb031206e50b5391fd540fc72a3d84538b0aaabaa10dadbcccdff5738f398e7e46

Download Submit
C:\Windows\system\XiWdDUf.exe

Filesize
1.7MB

MD5
bb378b66d1454f75f19a52cb6dbc8c3a

SHA1
fa33f9c8a46513d44360b27981aaabd6bcc2e037

SHA256
e714319502b759ad6cd385b3ab9e0e84b9f43637243ebb628ff28cd3433dafa0

SHA512
aff56ff79a7223117a3f20ea9ef6f0963032a8b82f044e6b117e46fbbb3d44fae969ed918ba02c4355103c398761b2d021830eb3958e3cdb52981fa99b38dc68

Download Submit
C:\Windows\system\YwIODlg.exe

Filesize
1.7MB

MD5
095e0b89d7b2e27c603305a7cda8570a

SHA1
d39da0ee299a6486ba6bbf9e4a4ee351929820e9

SHA256
e71fa15164f190cbffccc76cd774dbad091e7617682e6a43a7cf766d77b8a85c

SHA512
8c2e9eef5de3b0fc97ef97907319176bcaad9aaad9beb0e44029346cee38e8299a354268a3059bd92bbff5357c9e8587216f4f9172278c6688d7dc725b11c73f

Download Submit
C:\Windows\system\bqDQfCe.exe

Filesize
1.7MB

MD5
4be833763aa821c5c95d2ad0cecaf9d0

SHA1
30c2a5056de14e2b1b374fdb3f81afd4eacb091e

SHA256
0ca92c2eef7436a8e7534dffb211d8ecbfd38c4d943fc87f20c64a1eeaf0fa05

SHA512
c7f95d2c5c59eb8e57903ae58fe11e3dad7b5326c239fe79701d7085a75dc65f934997f95d8d9bc9c5b418b41c2ec9b9870af648859ebf6d7925f41c48d06add

Download Submit
C:\Windows\system\cNTLaRk.exe

Filesize
1.7MB

MD5
dee2be972089715b7af14328112c57b0

SHA1
618147ec983c5bdc811326f348c9fa1cd89967e3

SHA256
1ccdeef292405309138830eb01cc948fb9864addfdd7c0e4b89de78d3adaca0d

SHA512
662ffb7db2090dd38ab1fc0dec5ea6a662271eb037eb44d5f9257a33d6f8caddf60bd9d049db382f39fdf1488547bb8040848f95f6e3c79fe58dd3e3235bcf79

Download Submit
C:\Windows\system\fMBUpME.exe

Filesize
1.7MB

MD5
f77a44d504b129d4aad8facf0180d5a9

SHA1
7ede26ade856768c741b45f840b3f7f49e5ec8d4

SHA256
1835e51bba7493808abb827844be6b0b0a1e9d2825db421f58ea2ac2384b5930

SHA512
04a9c731606b6e1d30c0a0c72f62c8ce2fbdafd6ed54f952f4c98b3198bd2bb4e1cd0662515a9065f41a84a13a96b02c563c5b5e09a1e4f85550071ee8563565

Download Submit
C:\Windows\system\hyPmCCf.exe

Filesize
1.7MB

MD5
a4d8dc2126a13c39a9a00b405a18fad7

SHA1
60b04d92b45f019edf521082311840bea43ac722

SHA256
66232eeababf17996df676f62d21bb6dc42746c87b509bb0aa026d9ea7f2fb01

SHA512
fef0c7c3f2acd36405e8784e0485e07c44701e37ae1d457080c4d37fe9bd5be8b7812108dd1b6bfc55aaca33bf0679e7db69c6a787101817d4fa715a94178031

Download Submit
C:\Windows\system\jhYdvFE.exe

Filesize
1.7MB

MD5
1c137941fa0bf28a25efb5b8213aae0e

SHA1
952175b687f02bf30ea67ec4b60505dcd920eccf

SHA256
51b3cae88ac9672e90b4d9484e36893bcd653f4a21c0a38ea0c717d4a1011c4f

SHA512
05298700fd9d6c7592e2b40276fc3c7dbf3b3d044c4558a1867000e0a25825bc8b9fd645c51941a782ed0a3432e8a6c268885cae6d5196260f2f15a5d303dd7b

Download Submit
C:\Windows\system\kArPRyq.exe

Filesize
1.7MB

MD5
fd1b18a570957e2d693cdccccb954239

SHA1
a8a34ac352cced07c68df44eac684cd4dd22c73a

SHA256
27d0f3d1cda50bf2d821bbd1adfa939ca6d68b7aedfb0b4202410d771300a2aa

SHA512
389277a55b6ecf0ae12e0e218d7b3f5cb6bb579fe467d24f14f8ec194d5468dfe329b83c03f9e567b0ad4b5e79d4c6b340841cc74542383d85b46d1c5376b017

Download Submit
C:\Windows\system\nrTfxjw.exe

Filesize
1.7MB

MD5
f6b4741dabdb2f9c8c3b8163e684d6f2

SHA1
d634709091f5167279846d6fb74351e9aec3be84

SHA256
0e022f95135639f175ff3873ca4784286b302ff1257308f90f99587b51fcb6bc

SHA512
e1a2bf54604163537841a04979b73c15c37e0de72c1abcb8aa8946ce48f0fe8b53a6687741f3103d165e65be6e35e824089fb2f3f13f5e389b49e98189910a1e

Download Submit
C:\Windows\system\pirIPjL.exe

Filesize
1.7MB

MD5
5f3d9f3593e24db9a4c56f699e150623

SHA1
79f1276c462147ad4f80791bef5ca5ab648ce24c

SHA256
a4bd673720bfee6ba11f2238d100f6934092e043517ebff203e10977004bed76

SHA512
ffa82178fd0c0fe85de07b965b95b771b0a5902675ead31c0ce5b427bab30bd229d4907c22dde66e748772d7cefd1d2a3c522611de5b9276c9c43d65e3c8b9ff

Download Submit
C:\Windows\system\qwJkqua.exe

Filesize
1.7MB

MD5
a11f397840e2ebb2f97f67a9d0933bbc

SHA1
56392c1187b2702130ec567fe852230ebbd88ee8

SHA256
2b6cbdc9c634acacddc105f85a878db612e1c90e1914dd66e0d1cc6c0ad990ac

SHA512
0f3a9a2553f4661c293a06b7edfccb20759ae92c0dfb27d0262e334dbfef4c2cf67747d566ce4966ac30b90df7887ae7ab5d9a3e9179a61d7e2081ac7d68a921

Download Submit
C:\Windows\system\rivBucO.exe

Filesize
1.7MB

MD5
894b0f5e0ddc991a1e4a4e25796061b9

SHA1
2ea6876b07e042e287b72f54f8b93311b1d67f3d

SHA256
500a2e3b809988cf7d432cd2f7ff7fdad31bf41ab66d18864f0078a748617e07

SHA512
f0607b5d104aedc1f003698c80c7e60c8074334c8c9ec5bf1f376c950fea32c4847bb26207f3be8139ef9defcd4be138e182d4b7da516c0291e23219d3f54f8a

Download Submit
C:\Windows\system\wPEblhD.exe

Filesize
1.7MB

MD5
1922b5a6887ef86261c4fd4dae58b28e

SHA1
8c1121832b814838944cad2fc518bb4b7cd2a8b0

SHA256
eb539768a2afb1a0f924741b9b0a4fbb7376961255b2d9d9b0e0e931c97b2036

SHA512
10acbba0c419d837747f78f19a8695815bf0e3bbb923409e8e12860fdfd9b44b1d2bb9727a0e08eb4cb7384ff23cd416a2bb88c9da3c30b87df24df64f95a9db

Download Submit
C:\Windows\system\xUSYvEU.exe

Filesize
1.7MB

MD5
dd3b34fa3beba98f57688e591f71e64c

SHA1
44b364efd2d07e99ee7a8a4d3cdaedc3b74f04c0

SHA256
fee7e18a7c12fa0dec873100deacbfd8493d7e1a139b549da1f7dd85e7ceacd4

SHA512
b67ccb4b7f5495f9e2021adf7a78a9610f3f74b8e635c461066a2ad94aff5969460de88609a98b0805bad2a63468f972c22e67ad559c67312b1e62449ec23e8b

Download Submit
C:\Windows\system\xqJdZIa.exe

Filesize
1.7MB

MD5
9a2aab39296c7db7cc5513b5e684fbfd

SHA1
1f2d30ed0798cd9cb474b1dbb0085312247714ee

SHA256
544a6009ff509978bc4d64bb64882d94df771af4740faae96258e0f21551ddf1

SHA512
517704f9f29c4804c26e621ef2e616e28a5bf3cdba6b97cc03d14d74ef0682427922a238289532b4484eb3b72e247ef45ad7ae01c2b8fb4060198357ab1cd833

Download Submit
\Windows\system\GjqdPgW.exe

Filesize
1.7MB

MD5
fa88124a9c18e8c57a85f168d70d1eac

SHA1
b4417d68f618d70678e56338a3ec6d1f7992b494

SHA256
4dd5f49913b4f06c975acb2863734d2a0c905e529da1c7272fc6a47c4f80d28a

SHA512
01de3483dbe554f946da0de599a9c557024630700980fa11e1fddad8f923a17f27538bd1a9474f03a42d943404a56e863eb149779c4e59f32f9ba9798203b926

Download Submit
\Windows\system\QJzhEJv.exe

Filesize
1.7MB

MD5
85cb9691d7388eb7537b68d591add125

SHA1
166bfb78f34018e197e0f1dc318d4ceec64ea133

SHA256
d50dfd8eb53b363bd6338be905f042b563ce5425e625a231393688c52fcefefb

SHA512
57851a175a0da06392009285cb2e3eac3921ef6b3802e34205b7438c8cffb12993d3e4c43ac654542f85bad1231d7485a14bd82e7f79b62f946fffb3d2f32493

Download Submit
\Windows\system\UVMGPcq.exe

Filesize
1.7MB

MD5
ef5713fff903e6a3b7d3ea0c8110ea15

SHA1
fad39aa18c986a8a198f9fe511766ebf3d8e55d1

SHA256
417a48379cc8dcf6a996b1b45512ab466e1b36e2022f505a488599c099b30c9d

SHA512
8d54062b5a23f81db2649071e53f68ee35c4c1a6a391a14e8273e07a5e27cdccf8e3b1b7e82d1c45a355d2498dfe35b6cf04edc65f4711822947067d8786b9cd

Download Submit
\Windows\system\fIFcLQm.exe

Filesize
1.7MB

MD5
e08184544e6189bcf2d559753d75bbbf

SHA1
e4321e1b0e8c1ffe03335cdfefd0ac4f1c037790

SHA256
46dec494d2631a9ed36cf831fed0e9613386517f67b85e82f4c894efa44020aa

SHA512
00d9d7f844351ee46861988a731a31a4922b26964c9b8cd62fea5c99386e0dd9747eed0c612cb8cf34b5e6440a33364b88e144338502a6115445848c9725aa94

Download Submit
\Windows\system\yMeJXAQ.exe

Filesize
1.7MB

MD5
72a198a1486c11b2800033057d08b9bc

SHA1
f2c599bb5960b496d0a872e093718d8f64f35d8c

SHA256
f2428448fba2120f227cbaaf260e36be3308ec1f40af31dfc75ec0e6d7a8a844

SHA512
ad58218e3f8780dca0622d73b6fa55165b0c23430f636ac7e6c6ddab9c6109437c0c4e7294b254c8fb7584d1daf9df3b980c7c6d206909258dece185c90ef48e

Download Submit
memory/2380-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download