xmrig | 0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
Size

1.8MB
MD5

7fa2ccb2322941200c8eca70d0971b66
SHA1

5d4e692cd02c3d77614455dfbeffb40b644eca45
SHA256

0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4
SHA512

97e9a82061a72be6c1905533349d96592840fc130c19d1afe8d4ff0bb36d08f4332ce69b879ae86bb172418088a06053746cfc64eb82da9699ca5d9fcd311191
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y2PF6fRXzsEJ:GemTLkNdfE0pZyC

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000012102-2.dat	xmrig
behavioral1/files/0x00080000000190c6-6.dat	xmrig
behavioral1/files/0x00080000000190c9-12.dat	xmrig
behavioral1/files/0x00070000000191f3-16.dat	xmrig
behavioral1/files/0x0006000000019238-33.dat	xmrig
behavioral1/files/0x000800000001925d-37.dat	xmrig
behavioral1/files/0x00070000000194bd-40.dat	xmrig
behavioral1/files/0x000500000001a067-48.dat	xmrig
behavioral1/files/0x000500000001a0a1-57.dat	xmrig
behavioral1/files/0x000500000001a301-60.dat	xmrig
behavioral1/files/0x000500000001a42d-73.dat	xmrig
behavioral1/files/0x000500000001a42f-76.dat	xmrig
behavioral1/files/0x000500000001a434-84.dat	xmrig
behavioral1/files/0x000500000001a48c-93.dat	xmrig
behavioral1/files/0x000500000001a49a-100.dat	xmrig
behavioral1/files/0x000500000001a4c6-132.dat	xmrig
behavioral1/files/0x000500000001a4c4-129.dat	xmrig
behavioral1/files/0x000500000001a4c0-124.dat	xmrig
behavioral1/files/0x000500000001a4b7-113.dat	xmrig
behavioral1/files/0x000500000001a4aa-106.dat	xmrig
behavioral1/files/0x000500000001a4bb-118.dat	xmrig
behavioral1/files/0x000500000001a4b5-112.dat	xmrig
behavioral1/files/0x000500000001a49c-104.dat	xmrig
behavioral1/files/0x000500000001a48e-96.dat	xmrig
behavioral1/files/0x000500000001a46a-88.dat	xmrig
behavioral1/files/0x000500000001a431-80.dat	xmrig
behavioral1/files/0x000500000001a42b-68.dat	xmrig
behavioral1/files/0x000500000001a345-64.dat	xmrig
behavioral1/files/0x000500000001a07b-52.dat	xmrig
behavioral1/files/0x0005000000019fb9-44.dat	xmrig
behavioral1/files/0x0006000000019220-28.dat	xmrig
behavioral1/files/0x0006000000019217-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2840	AxjhlWZ.exe
2668	zcBFfYr.exe
2864	auLwhBs.exe
2680	NMHHbPT.exe
2908	IsAuEGA.exe
2092	wzuqTEj.exe
2612	CUQVRYd.exe
2564	tLvQUCo.exe
1560	yPWWwVL.exe
2684	FpfJKVu.exe
2608	WOwhZqT.exe
1224	xKcXUQx.exe
1540	HrlUqrD.exe
2956	ADDuZcf.exe
2604	rspbLAC.exe
1044	DDTkgnb.exe
572	PdplRgG.exe
1204	DpMwCCD.exe
2748	FCOcGgf.exe
1968	CKaOaCQ.exe
1660	qnLlpti.exe
2800	gkZwTIW.exe
2084	pBctwyz.exe
2788	DnvREAP.exe
1664	vQWXhbb.exe
3004	wtyLOMr.exe
492	OKVdfYd.exe
2416	iCCkFBv.exe
1940	glhcmyq.exe
2216	XESSORI.exe
1884	SsyEZCA.exe
1404	YxqHULr.exe
1092	OtoiJAG.exe
2040	nwuvezm.exe
2016	rQfwYyP.exe
2532	fDIaYTU.exe
948	iURJeqi.exe
1500	BkoWeHD.exe
944	ibOWtsg.exe
2536	inrUNbW.exe
1504	Xehhcuc.exe
900	RAQLsKq.exe
1684	ZSwMsNS.exe
2224	UkvPmzn.exe
1452	zkehWGH.exe
1708	BKVvmGJ.exe
1424	csbnlmX.exe
1620	uuQduSH.exe
1632	WCsNZfo.exe
1596	iTfEGMV.exe
632	WQZzrmm.exe
704	yjphbKw.exe
2200	FxXNPzM.exe
2984	eaVjZtH.exe
2148	tBOViNu.exe
2328	bFxrmlT.exe
2256	RaXrNVn.exe
1640	OnZeRZV.exe
2116	eShvPJd.exe
2468	FCWukii.exe
2320	qhUZYHX.exe
1180	UhkOcmq.exe
1948	hxmzmqL.exe
352	MeTqtOG.exe

Loads dropped DLL 64 IoCs

pid	Process
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YKldEbd.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\qogWZDn.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\aanrapo.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\BOAIgan.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\HwNkhxe.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\kSJhphn.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\WXUOgMe.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\zpwYNzM.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\yHcFlrt.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\qgjNEmw.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\OnmaGeR.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\WFcCCpJ.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\csbnlmX.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\zAovrHA.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\KSkLNYV.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\IAdGwdm.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\GWEzJae.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\dkPaiga.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\VzXofBl.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\dhVxLiD.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\JLVDRln.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\pYApaNX.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\FQGnxyH.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\AoCdlYp.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\DLyQLEI.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\fXKMygF.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\vXAxbLy.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\vkIXtjK.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\QXLAIWo.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\vPcGhjB.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\VZKHgIZ.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\CdOeFtE.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\XtFQAsQ.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\uTXpvPM.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\njNenEY.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\eejEepE.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\MSXLYHP.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\hefuCSK.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\MIviylg.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\INIrSxM.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\XTCKIzx.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\WCsNZfo.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\FxXNPzM.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\PUUIaUI.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\WMsFSio.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\KBVrjCi.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\YBQSoSk.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\ubGYHBn.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\DfIzvxZ.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\juRRPVt.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\wDEnHvr.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\BEfNZnE.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\FbfkRPS.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\rVbCagb.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\ezUJvBm.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\ZiPIosy.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\bLVFugM.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\EMnUQzF.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\lOptjnm.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\MgWpSFV.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\ogNjmke.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\cIhAAGw.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\qhAjerw.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
File created	C:\Windows\System\xsuiLtI.exe	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2840	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	31
PID 2692 wrote to memory of 2840	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	31
PID 2692 wrote to memory of 2840	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	31
PID 2692 wrote to memory of 2668	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	32
PID 2692 wrote to memory of 2668	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	32
PID 2692 wrote to memory of 2668	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	32
PID 2692 wrote to memory of 2864	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	33
PID 2692 wrote to memory of 2864	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	33
PID 2692 wrote to memory of 2864	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	33
PID 2692 wrote to memory of 2680	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	34
PID 2692 wrote to memory of 2680	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	34
PID 2692 wrote to memory of 2680	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	34
PID 2692 wrote to memory of 2908	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	35
PID 2692 wrote to memory of 2908	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	35
PID 2692 wrote to memory of 2908	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	35
PID 2692 wrote to memory of 2092	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	36
PID 2692 wrote to memory of 2092	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	36
PID 2692 wrote to memory of 2092	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	36
PID 2692 wrote to memory of 2612	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	37
PID 2692 wrote to memory of 2612	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	37
PID 2692 wrote to memory of 2612	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	37
PID 2692 wrote to memory of 2564	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	38
PID 2692 wrote to memory of 2564	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	38
PID 2692 wrote to memory of 2564	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	38
PID 2692 wrote to memory of 1560	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	39
PID 2692 wrote to memory of 1560	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	39
PID 2692 wrote to memory of 1560	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	39
PID 2692 wrote to memory of 2684	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	40
PID 2692 wrote to memory of 2684	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	40
PID 2692 wrote to memory of 2684	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	40
PID 2692 wrote to memory of 2608	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	41
PID 2692 wrote to memory of 2608	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	41
PID 2692 wrote to memory of 2608	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	41
PID 2692 wrote to memory of 1224	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	42
PID 2692 wrote to memory of 1224	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	42
PID 2692 wrote to memory of 1224	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	42
PID 2692 wrote to memory of 1540	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	43
PID 2692 wrote to memory of 1540	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	43
PID 2692 wrote to memory of 1540	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	43
PID 2692 wrote to memory of 2956	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	44
PID 2692 wrote to memory of 2956	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	44
PID 2692 wrote to memory of 2956	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	44
PID 2692 wrote to memory of 2604	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	45
PID 2692 wrote to memory of 2604	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	45
PID 2692 wrote to memory of 2604	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	45
PID 2692 wrote to memory of 1044	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	46
PID 2692 wrote to memory of 1044	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	46
PID 2692 wrote to memory of 1044	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	46
PID 2692 wrote to memory of 572	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	47
PID 2692 wrote to memory of 572	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	47
PID 2692 wrote to memory of 572	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	47
PID 2692 wrote to memory of 1204	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	48
PID 2692 wrote to memory of 1204	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	48
PID 2692 wrote to memory of 1204	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	48
PID 2692 wrote to memory of 2748	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	49
PID 2692 wrote to memory of 2748	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	49
PID 2692 wrote to memory of 2748	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	49
PID 2692 wrote to memory of 1968	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	50
PID 2692 wrote to memory of 1968	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	50
PID 2692 wrote to memory of 1968	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	50
PID 2692 wrote to memory of 1660	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	51
PID 2692 wrote to memory of 1660	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	51
PID 2692 wrote to memory of 1660	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	51
PID 2692 wrote to memory of 2800	2692	0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe	52

C:\Users\Admin\AppData\Local\Temp\0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe
"C:\Users\Admin\AppData\Local\Temp\0e9a5a3d18f02b36b6aca50982ba0dfbf1ac5d93785ab8494ff5bca45e67b0c4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System\AxjhlWZ.exe
  C:\Windows\System\AxjhlWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\zcBFfYr.exe
  C:\Windows\System\zcBFfYr.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\auLwhBs.exe
  C:\Windows\System\auLwhBs.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NMHHbPT.exe
  C:\Windows\System\NMHHbPT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IsAuEGA.exe
  C:\Windows\System\IsAuEGA.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\wzuqTEj.exe
  C:\Windows\System\wzuqTEj.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\CUQVRYd.exe
  C:\Windows\System\CUQVRYd.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\tLvQUCo.exe
  C:\Windows\System\tLvQUCo.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\yPWWwVL.exe
  C:\Windows\System\yPWWwVL.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\FpfJKVu.exe
  C:\Windows\System\FpfJKVu.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WOwhZqT.exe
  C:\Windows\System\WOwhZqT.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\xKcXUQx.exe
  C:\Windows\System\xKcXUQx.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\HrlUqrD.exe
  C:\Windows\System\HrlUqrD.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ADDuZcf.exe
  C:\Windows\System\ADDuZcf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\rspbLAC.exe
  C:\Windows\System\rspbLAC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\DDTkgnb.exe
  C:\Windows\System\DDTkgnb.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\PdplRgG.exe
  C:\Windows\System\PdplRgG.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\DpMwCCD.exe
  C:\Windows\System\DpMwCCD.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\FCOcGgf.exe
  C:\Windows\System\FCOcGgf.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\CKaOaCQ.exe
  C:\Windows\System\CKaOaCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\qnLlpti.exe
  C:\Windows\System\qnLlpti.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\gkZwTIW.exe
  C:\Windows\System\gkZwTIW.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pBctwyz.exe
  C:\Windows\System\pBctwyz.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\DnvREAP.exe
  C:\Windows\System\DnvREAP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\vQWXhbb.exe
  C:\Windows\System\vQWXhbb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\iCCkFBv.exe
  C:\Windows\System\iCCkFBv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\wtyLOMr.exe
  C:\Windows\System\wtyLOMr.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\glhcmyq.exe
  C:\Windows\System\glhcmyq.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OKVdfYd.exe
  C:\Windows\System\OKVdfYd.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\XESSORI.exe
  C:\Windows\System\XESSORI.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\SsyEZCA.exe
  C:\Windows\System\SsyEZCA.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\YxqHULr.exe
  C:\Windows\System\YxqHULr.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\OtoiJAG.exe
  C:\Windows\System\OtoiJAG.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\nwuvezm.exe
  C:\Windows\System\nwuvezm.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\rQfwYyP.exe
  C:\Windows\System\rQfwYyP.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\fDIaYTU.exe
  C:\Windows\System\fDIaYTU.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\iURJeqi.exe
  C:\Windows\System\iURJeqi.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\BkoWeHD.exe
  C:\Windows\System\BkoWeHD.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ibOWtsg.exe
  C:\Windows\System\ibOWtsg.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\inrUNbW.exe
  C:\Windows\System\inrUNbW.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\Xehhcuc.exe
  C:\Windows\System\Xehhcuc.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\RAQLsKq.exe
  C:\Windows\System\RAQLsKq.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\ZSwMsNS.exe
  C:\Windows\System\ZSwMsNS.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\UkvPmzn.exe
  C:\Windows\System\UkvPmzn.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\zkehWGH.exe
  C:\Windows\System\zkehWGH.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\BKVvmGJ.exe
  C:\Windows\System\BKVvmGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\csbnlmX.exe
  C:\Windows\System\csbnlmX.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\uuQduSH.exe
  C:\Windows\System\uuQduSH.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\WCsNZfo.exe
  C:\Windows\System\WCsNZfo.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\iTfEGMV.exe
  C:\Windows\System\iTfEGMV.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\WQZzrmm.exe
  C:\Windows\System\WQZzrmm.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\yjphbKw.exe
  C:\Windows\System\yjphbKw.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\FxXNPzM.exe
  C:\Windows\System\FxXNPzM.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eaVjZtH.exe
  C:\Windows\System\eaVjZtH.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\tBOViNu.exe
  C:\Windows\System\tBOViNu.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\bFxrmlT.exe
  C:\Windows\System\bFxrmlT.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\RaXrNVn.exe
  C:\Windows\System\RaXrNVn.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\OnZeRZV.exe
  C:\Windows\System\OnZeRZV.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\eShvPJd.exe
  C:\Windows\System\eShvPJd.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\FCWukii.exe
  C:\Windows\System\FCWukii.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\qhUZYHX.exe
  C:\Windows\System\qhUZYHX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\UhkOcmq.exe
  C:\Windows\System\UhkOcmq.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\hxmzmqL.exe
  C:\Windows\System\hxmzmqL.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\MeTqtOG.exe
  C:\Windows\System\MeTqtOG.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\nUdqRij.exe
  C:\Windows\System\nUdqRij.exe
  2⤵
  PID:356
- C:\Windows\System\qJAXdCX.exe
  C:\Windows\System\qJAXdCX.exe
  2⤵
  PID:2388
- C:\Windows\System\vYhgSbw.exe
  C:\Windows\System\vYhgSbw.exe
  2⤵
  PID:2344
- C:\Windows\System\odsnMte.exe
  C:\Windows\System\odsnMte.exe
  2⤵
  PID:2492
- C:\Windows\System\zQtkEcd.exe
  C:\Windows\System\zQtkEcd.exe
  2⤵
  PID:2836
- C:\Windows\System\RHepULY.exe
  C:\Windows\System\RHepULY.exe
  2⤵
  PID:1584
- C:\Windows\System\pAfYYZG.exe
  C:\Windows\System\pAfYYZG.exe
  2⤵
  PID:2716
- C:\Windows\System\USGMnaI.exe
  C:\Windows\System\USGMnaI.exe
  2⤵
  PID:2572
- C:\Windows\System\oleTRSz.exe
  C:\Windows\System\oleTRSz.exe
  2⤵
  PID:2924
- C:\Windows\System\KykvrFc.exe
  C:\Windows\System\KykvrFc.exe
  2⤵
  PID:2700
- C:\Windows\System\eXZzuCC.exe
  C:\Windows\System\eXZzuCC.exe
  2⤵
  PID:2872
- C:\Windows\System\lHMizyI.exe
  C:\Windows\System\lHMizyI.exe
  2⤵
  PID:2640
- C:\Windows\System\nnczaxP.exe
  C:\Windows\System\nnczaxP.exe
  2⤵
  PID:2064
- C:\Windows\System\XKgDjaU.exe
  C:\Windows\System\XKgDjaU.exe
  2⤵
  PID:2940
- C:\Windows\System\LhETFfv.exe
  C:\Windows\System\LhETFfv.exe
  2⤵
  PID:2816
- C:\Windows\System\yXnkBTl.exe
  C:\Windows\System\yXnkBTl.exe
  2⤵
  PID:2172
- C:\Windows\System\KPVSCSq.exe
  C:\Windows\System\KPVSCSq.exe
  2⤵
  PID:2360
- C:\Windows\System\PwQElce.exe
  C:\Windows\System\PwQElce.exe
  2⤵
  PID:1952
- C:\Windows\System\pYApaNX.exe
  C:\Windows\System\pYApaNX.exe
  2⤵
  PID:2928
- C:\Windows\System\nBPoJAz.exe
  C:\Windows\System\nBPoJAz.exe
  2⤵
  PID:300
- C:\Windows\System\EppUJSV.exe
  C:\Windows\System\EppUJSV.exe
  2⤵
  PID:2548
- C:\Windows\System\dcjWhus.exe
  C:\Windows\System\dcjWhus.exe
  2⤵
  PID:2124
- C:\Windows\System\pdStNtX.exe
  C:\Windows\System\pdStNtX.exe
  2⤵
  PID:2108
- C:\Windows\System\HPYzTBV.exe
  C:\Windows\System\HPYzTBV.exe
  2⤵
  PID:2812
- C:\Windows\System\yHsRoXq.exe
  C:\Windows\System\yHsRoXq.exe
  2⤵
  PID:1348
- C:\Windows\System\gXxpgTE.exe
  C:\Windows\System\gXxpgTE.exe
  2⤵
  PID:1628
- C:\Windows\System\lRqRONN.exe
  C:\Windows\System\lRqRONN.exe
  2⤵
  PID:840
- C:\Windows\System\JuEUGPf.exe
  C:\Windows\System\JuEUGPf.exe
  2⤵
  PID:1532
- C:\Windows\System\bPqjgTc.exe
  C:\Windows\System\bPqjgTc.exe
  2⤵
  PID:836
- C:\Windows\System\HfNcZrU.exe
  C:\Windows\System\HfNcZrU.exe
  2⤵
  PID:1512
- C:\Windows\System\CRqNDvv.exe
  C:\Windows\System\CRqNDvv.exe
  2⤵
  PID:1552
- C:\Windows\System\nbzBpnO.exe
  C:\Windows\System\nbzBpnO.exe
  2⤵
  PID:3036
- C:\Windows\System\cVrNZiy.exe
  C:\Windows\System\cVrNZiy.exe
  2⤵
  PID:1924
- C:\Windows\System\iLbAcYh.exe
  C:\Windows\System\iLbAcYh.exe
  2⤵
  PID:604
- C:\Windows\System\zgILBDG.exe
  C:\Windows\System\zgILBDG.exe
  2⤵
  PID:2476
- C:\Windows\System\YGtckwt.exe
  C:\Windows\System\YGtckwt.exe
  2⤵
  PID:2860
- C:\Windows\System\OhdYkQh.exe
  C:\Windows\System\OhdYkQh.exe
  2⤵
  PID:2964
- C:\Windows\System\IBBGrcN.exe
  C:\Windows\System\IBBGrcN.exe
  2⤵
  PID:1840
- C:\Windows\System\pOEkVZV.exe
  C:\Windows\System\pOEkVZV.exe
  2⤵
  PID:700
- C:\Windows\System\ojPSPDt.exe
  C:\Windows\System\ojPSPDt.exe
  2⤵
  PID:324
- C:\Windows\System\pbwRfbf.exe
  C:\Windows\System\pbwRfbf.exe
  2⤵
  PID:1676
- C:\Windows\System\DmRpPvQ.exe
  C:\Windows\System\DmRpPvQ.exe
  2⤵
  PID:2100
- C:\Windows\System\SciPsaG.exe
  C:\Windows\System\SciPsaG.exe
  2⤵
  PID:1576
- C:\Windows\System\gwuyPlR.exe
  C:\Windows\System\gwuyPlR.exe
  2⤵
  PID:2848
- C:\Windows\System\XGLDeQJ.exe
  C:\Windows\System\XGLDeQJ.exe
  2⤵
  PID:2600
- C:\Windows\System\FIkXJFq.exe
  C:\Windows\System\FIkXJFq.exe
  2⤵
  PID:2972
- C:\Windows\System\GyPZSHi.exe
  C:\Windows\System\GyPZSHi.exe
  2⤵
  PID:2196
- C:\Windows\System\LjMCNPV.exe
  C:\Windows\System\LjMCNPV.exe
  2⤵
  PID:2904
- C:\Windows\System\vNdbVHW.exe
  C:\Windows\System\vNdbVHW.exe
  2⤵
  PID:2384
- C:\Windows\System\ZcFMJle.exe
  C:\Windows\System\ZcFMJle.exe
  2⤵
  PID:2912
- C:\Windows\System\lvCmjOF.exe
  C:\Windows\System\lvCmjOF.exe
  2⤵
  PID:2364
- C:\Windows\System\ujGNdux.exe
  C:\Windows\System\ujGNdux.exe
  2⤵
  PID:328
- C:\Windows\System\obERFxM.exe
  C:\Windows\System\obERFxM.exe
  2⤵
  PID:1872
- C:\Windows\System\GvsfCVL.exe
  C:\Windows\System\GvsfCVL.exe
  2⤵
  PID:2308
- C:\Windows\System\ZkbkYEG.exe
  C:\Windows\System\ZkbkYEG.exe
  2⤵
  PID:1976
- C:\Windows\System\qjboxVY.exe
  C:\Windows\System\qjboxVY.exe
  2⤵
  PID:684
- C:\Windows\System\NAIUBRh.exe
  C:\Windows\System\NAIUBRh.exe
  2⤵
  PID:1624
- C:\Windows\System\pntvzbH.exe
  C:\Windows\System\pntvzbH.exe
  2⤵
  PID:1616
- C:\Windows\System\VDaOZLk.exe
  C:\Windows\System\VDaOZLk.exe
  2⤵
  PID:2316
- C:\Windows\System\WmLKajv.exe
  C:\Windows\System\WmLKajv.exe
  2⤵
  PID:1124
- C:\Windows\System\mRTJtRE.exe
  C:\Windows\System\mRTJtRE.exe
  2⤵
  PID:884
- C:\Windows\System\AjiwBIq.exe
  C:\Windows\System\AjiwBIq.exe
  2⤵
  PID:2960
- C:\Windows\System\ffrJolU.exe
  C:\Windows\System\ffrJolU.exe
  2⤵
  PID:1484
- C:\Windows\System\VcDcNCC.exe
  C:\Windows\System\VcDcNCC.exe
  2⤵
  PID:2696
- C:\Windows\System\DlNysyt.exe
  C:\Windows\System\DlNysyt.exe
  2⤵
  PID:1752
- C:\Windows\System\RqnHTyQ.exe
  C:\Windows\System\RqnHTyQ.exe
  2⤵
  PID:3076
- C:\Windows\System\vdjqzjt.exe
  C:\Windows\System\vdjqzjt.exe
  2⤵
  PID:3092
- C:\Windows\System\YVTbTHh.exe
  C:\Windows\System\YVTbTHh.exe
  2⤵
  PID:3108
- C:\Windows\System\sRJooHQ.exe
  C:\Windows\System\sRJooHQ.exe
  2⤵
  PID:3124
- C:\Windows\System\zugDIKI.exe
  C:\Windows\System\zugDIKI.exe
  2⤵
  PID:3140
- C:\Windows\System\cakWZhP.exe
  C:\Windows\System\cakWZhP.exe
  2⤵
  PID:3156
- C:\Windows\System\CgQYmpa.exe
  C:\Windows\System\CgQYmpa.exe
  2⤵
  PID:3172
- C:\Windows\System\bFPmpDu.exe
  C:\Windows\System\bFPmpDu.exe
  2⤵
  PID:3188
- C:\Windows\System\lQwNVDf.exe
  C:\Windows\System\lQwNVDf.exe
  2⤵
  PID:3204
- C:\Windows\System\IVzIwku.exe
  C:\Windows\System\IVzIwku.exe
  2⤵
  PID:3220
- C:\Windows\System\FmupZoW.exe
  C:\Windows\System\FmupZoW.exe
  2⤵
  PID:3236
- C:\Windows\System\ODLEKtZ.exe
  C:\Windows\System\ODLEKtZ.exe
  2⤵
  PID:3252
- C:\Windows\System\mDyIjNF.exe
  C:\Windows\System\mDyIjNF.exe
  2⤵
  PID:3268
- C:\Windows\System\Hosbhfw.exe
  C:\Windows\System\Hosbhfw.exe
  2⤵
  PID:3284
- C:\Windows\System\lwOBDdw.exe
  C:\Windows\System\lwOBDdw.exe
  2⤵
  PID:3300
- C:\Windows\System\iwvFdEV.exe
  C:\Windows\System\iwvFdEV.exe
  2⤵
  PID:3316
- C:\Windows\System\ubhmQMC.exe
  C:\Windows\System\ubhmQMC.exe
  2⤵
  PID:3332
- C:\Windows\System\LxSHLYZ.exe
  C:\Windows\System\LxSHLYZ.exe
  2⤵
  PID:3348
- C:\Windows\System\hSRKPXG.exe
  C:\Windows\System\hSRKPXG.exe
  2⤵
  PID:3384
- C:\Windows\System\tbKFCZm.exe
  C:\Windows\System\tbKFCZm.exe
  2⤵
  PID:3400
- C:\Windows\System\vyaIdTa.exe
  C:\Windows\System\vyaIdTa.exe
  2⤵
  PID:3416
- C:\Windows\System\GztnoZL.exe
  C:\Windows\System\GztnoZL.exe
  2⤵
  PID:3432
- C:\Windows\System\Jwkysoh.exe
  C:\Windows\System\Jwkysoh.exe
  2⤵
  PID:3448
- C:\Windows\System\yHcFlrt.exe
  C:\Windows\System\yHcFlrt.exe
  2⤵
  PID:3464
- C:\Windows\System\xcoDcmD.exe
  C:\Windows\System\xcoDcmD.exe
  2⤵
  PID:3480
- C:\Windows\System\ByLRqpF.exe
  C:\Windows\System\ByLRqpF.exe
  2⤵
  PID:3504
- C:\Windows\System\jlgTuBx.exe
  C:\Windows\System\jlgTuBx.exe
  2⤵
  PID:3528
- C:\Windows\System\bFzKdEc.exe
  C:\Windows\System\bFzKdEc.exe
  2⤵
  PID:3544
- C:\Windows\System\wJmdPYo.exe
  C:\Windows\System\wJmdPYo.exe
  2⤵
  PID:3560
- C:\Windows\System\HQQUcAK.exe
  C:\Windows\System\HQQUcAK.exe
  2⤵
  PID:3576
- C:\Windows\System\RlYDPQi.exe
  C:\Windows\System\RlYDPQi.exe
  2⤵
  PID:3592
- C:\Windows\System\OvEuPYZ.exe
  C:\Windows\System\OvEuPYZ.exe
  2⤵
  PID:3628
- C:\Windows\System\jqjLrbR.exe
  C:\Windows\System\jqjLrbR.exe
  2⤵
  PID:3648
- C:\Windows\System\qPkDiHG.exe
  C:\Windows\System\qPkDiHG.exe
  2⤵
  PID:3664
- C:\Windows\System\TuJJuMC.exe
  C:\Windows\System\TuJJuMC.exe
  2⤵
  PID:3680
- C:\Windows\System\smugzhx.exe
  C:\Windows\System\smugzhx.exe
  2⤵
  PID:3696
- C:\Windows\System\AFweORb.exe
  C:\Windows\System\AFweORb.exe
  2⤵
  PID:3712
- C:\Windows\System\NTsFgtK.exe
  C:\Windows\System\NTsFgtK.exe
  2⤵
  PID:3728
- C:\Windows\System\VAzeKlW.exe
  C:\Windows\System\VAzeKlW.exe
  2⤵
  PID:3744
- C:\Windows\System\wvUsgwn.exe
  C:\Windows\System\wvUsgwn.exe
  2⤵
  PID:3760
- C:\Windows\System\kopYwSV.exe
  C:\Windows\System\kopYwSV.exe
  2⤵
  PID:3776
- C:\Windows\System\NajsQVH.exe
  C:\Windows\System\NajsQVH.exe
  2⤵
  PID:3792
- C:\Windows\System\MpOhqcj.exe
  C:\Windows\System\MpOhqcj.exe
  2⤵
  PID:3808
- C:\Windows\System\FwvveLe.exe
  C:\Windows\System\FwvveLe.exe
  2⤵
  PID:3824
- C:\Windows\System\ogNjmke.exe
  C:\Windows\System\ogNjmke.exe
  2⤵
  PID:3840
- C:\Windows\System\pjMpqRc.exe
  C:\Windows\System\pjMpqRc.exe
  2⤵
  PID:3856
- C:\Windows\System\nPDXCzt.exe
  C:\Windows\System\nPDXCzt.exe
  2⤵
  PID:3872
- C:\Windows\System\ODjMHIc.exe
  C:\Windows\System\ODjMHIc.exe
  2⤵
  PID:3888
- C:\Windows\System\IRYwdZl.exe
  C:\Windows\System\IRYwdZl.exe
  2⤵
  PID:3904
- C:\Windows\System\XuKPUst.exe
  C:\Windows\System\XuKPUst.exe
  2⤵
  PID:3920
- C:\Windows\System\KlJYaui.exe
  C:\Windows\System\KlJYaui.exe
  2⤵
  PID:3936
- C:\Windows\System\flVHjCm.exe
  C:\Windows\System\flVHjCm.exe
  2⤵
  PID:3952
- C:\Windows\System\WiEuekX.exe
  C:\Windows\System\WiEuekX.exe
  2⤵
  PID:3968
- C:\Windows\System\qOZaEoO.exe
  C:\Windows\System\qOZaEoO.exe
  2⤵
  PID:3984
- C:\Windows\System\sVxRSXX.exe
  C:\Windows\System\sVxRSXX.exe
  2⤵
  PID:4000
- C:\Windows\System\pcncglo.exe
  C:\Windows\System\pcncglo.exe
  2⤵
  PID:4016
- C:\Windows\System\PIYmlAf.exe
  C:\Windows\System\PIYmlAf.exe
  2⤵
  PID:4032
- C:\Windows\System\aHyuIDd.exe
  C:\Windows\System\aHyuIDd.exe
  2⤵
  PID:4060
- C:\Windows\System\zgCRGYw.exe
  C:\Windows\System\zgCRGYw.exe
  2⤵
  PID:4076
- C:\Windows\System\FFxvftn.exe
  C:\Windows\System\FFxvftn.exe
  2⤵
  PID:4092
- C:\Windows\System\lcNlcGV.exe
  C:\Windows\System\lcNlcGV.exe
  2⤵
  PID:2588
- C:\Windows\System\ufVxMNc.exe
  C:\Windows\System\ufVxMNc.exe
  2⤵
  PID:2776
- C:\Windows\System\wyozJtH.exe
  C:\Windows\System\wyozJtH.exe
  2⤵
  PID:1200
- C:\Windows\System\UrbNxjH.exe
  C:\Windows\System\UrbNxjH.exe
  2⤵
  PID:1516
- C:\Windows\System\dbFwGcv.exe
  C:\Windows\System\dbFwGcv.exe
  2⤵
  PID:2688
- C:\Windows\System\FSVtJGs.exe
  C:\Windows\System\FSVtJGs.exe
  2⤵
  PID:1704
- C:\Windows\System\FGvFJdY.exe
  C:\Windows\System\FGvFJdY.exe
  2⤵
  PID:1680
- C:\Windows\System\celctVx.exe
  C:\Windows\System\celctVx.exe
  2⤵
  PID:2324
- C:\Windows\System\VbDjDRD.exe
  C:\Windows\System\VbDjDRD.exe
  2⤵
  PID:1600
- C:\Windows\System\ECXvpqc.exe
  C:\Windows\System\ECXvpqc.exe
  2⤵
  PID:3100
- C:\Windows\System\qSOWNux.exe
  C:\Windows\System\qSOWNux.exe
  2⤵
  PID:3132
- C:\Windows\System\yADRQUd.exe
  C:\Windows\System\yADRQUd.exe
  2⤵
  PID:3168
- C:\Windows\System\TaUJTrl.exe
  C:\Windows\System\TaUJTrl.exe
  2⤵
  PID:3200
- C:\Windows\System\FHcVjoZ.exe
  C:\Windows\System\FHcVjoZ.exe
  2⤵
  PID:3264
- C:\Windows\System\aKBCVjk.exe
  C:\Windows\System\aKBCVjk.exe
  2⤵
  PID:3324
- C:\Windows\System\njNenEY.exe
  C:\Windows\System\njNenEY.exe
  2⤵
  PID:3212
- C:\Windows\System\zaODuQa.exe
  C:\Windows\System\zaODuQa.exe
  2⤵
  PID:2620
- C:\Windows\System\sauFEmE.exe
  C:\Windows\System\sauFEmE.exe
  2⤵
  PID:3372
- C:\Windows\System\BpxUxhx.exe
  C:\Windows\System\BpxUxhx.exe
  2⤵
  PID:3412
- C:\Windows\System\XyOQfih.exe
  C:\Windows\System\XyOQfih.exe
  2⤵
  PID:3244
- C:\Windows\System\zeZZlDv.exe
  C:\Windows\System\zeZZlDv.exe
  2⤵
  PID:3308
- C:\Windows\System\QjMWwNE.exe
  C:\Windows\System\QjMWwNE.exe
  2⤵
  PID:3524
- C:\Windows\System\QpgOHNh.exe
  C:\Windows\System\QpgOHNh.exe
  2⤵
  PID:3344
- C:\Windows\System\NVXLDjw.exe
  C:\Windows\System\NVXLDjw.exe
  2⤵
  PID:3500
- C:\Windows\System\yWrNBof.exe
  C:\Windows\System\yWrNBof.exe
  2⤵
  PID:3584
- C:\Windows\System\LwStFFP.exe
  C:\Windows\System\LwStFFP.exe
  2⤵
  PID:3568
- C:\Windows\System\uksaQGz.exe
  C:\Windows\System\uksaQGz.exe
  2⤵
  PID:2560
- C:\Windows\System\qeuotnX.exe
  C:\Windows\System\qeuotnX.exe
  2⤵
  PID:3624
- C:\Windows\System\UtjJxYU.exe
  C:\Windows\System\UtjJxYU.exe
  2⤵
  PID:3044
- C:\Windows\System\IPTpTnz.exe
  C:\Windows\System\IPTpTnz.exe
  2⤵
  PID:1448
- C:\Windows\System\RPBWEWJ.exe
  C:\Windows\System\RPBWEWJ.exe
  2⤵
  PID:1052
- C:\Windows\System\BkDDzLl.exe
  C:\Windows\System\BkDDzLl.exe
  2⤵
  PID:2144
- C:\Windows\System\FMgCIHP.exe
  C:\Windows\System\FMgCIHP.exe
  2⤵
  PID:2880
- C:\Windows\System\kRPCYiE.exe
  C:\Windows\System\kRPCYiE.exe
  2⤵
  PID:3640
- C:\Windows\System\OXPnOsl.exe
  C:\Windows\System\OXPnOsl.exe
  2⤵
  PID:1604
- C:\Windows\System\hHrLUKd.exe
  C:\Windows\System\hHrLUKd.exe
  2⤵
  PID:1856
- C:\Windows\System\rVbCagb.exe
  C:\Windows\System\rVbCagb.exe
  2⤵
  PID:3752
- C:\Windows\System\knoQBwk.exe
  C:\Windows\System\knoQBwk.exe
  2⤵
  PID:3788
- C:\Windows\System\SZGJDMW.exe
  C:\Windows\System\SZGJDMW.exe
  2⤵
  PID:3676
- C:\Windows\System\uyVtKke.exe
  C:\Windows\System\uyVtKke.exe
  2⤵
  PID:3736
- C:\Windows\System\JDYYoeg.exe
  C:\Windows\System\JDYYoeg.exe
  2⤵
  PID:3804
- C:\Windows\System\GOxuFWq.exe
  C:\Windows\System\GOxuFWq.exe
  2⤵
  PID:3768
- C:\Windows\System\tIPaGcg.exe
  C:\Windows\System\tIPaGcg.exe
  2⤵
  PID:3880
- C:\Windows\System\IQzqEhG.exe
  C:\Windows\System\IQzqEhG.exe
  2⤵
  PID:3884
- C:\Windows\System\XOJIYsH.exe
  C:\Windows\System\XOJIYsH.exe
  2⤵
  PID:3980
- C:\Windows\System\jUMuVCu.exe
  C:\Windows\System\jUMuVCu.exe
  2⤵
  PID:4040
- C:\Windows\System\JRciPKN.exe
  C:\Windows\System\JRciPKN.exe
  2⤵
  PID:3960
- C:\Windows\System\qejfHcA.exe
  C:\Windows\System\qejfHcA.exe
  2⤵
  PID:3928
- C:\Windows\System\ZDkrSPD.exe
  C:\Windows\System\ZDkrSPD.exe
  2⤵
  PID:4056
- C:\Windows\System\wlfFgKX.exe
  C:\Windows\System\wlfFgKX.exe
  2⤵
  PID:4084
- C:\Windows\System\NsuySsv.exe
  C:\Windows\System\NsuySsv.exe
  2⤵
  PID:1412
- C:\Windows\System\davZpwl.exe
  C:\Windows\System\davZpwl.exe
  2⤵
  PID:3068
- C:\Windows\System\cqemqnh.exe
  C:\Windows\System\cqemqnh.exe
  2⤵
  PID:2428
- C:\Windows\System\zytUioz.exe
  C:\Windows\System\zytUioz.exe
  2⤵
  PID:2764
- C:\Windows\System\jqahmne.exe
  C:\Windows\System\jqahmne.exe
  2⤵
  PID:2448
- C:\Windows\System\PSiZLoZ.exe
  C:\Windows\System\PSiZLoZ.exe
  2⤵
  PID:2192
- C:\Windows\System\TvJwVbT.exe
  C:\Windows\System\TvJwVbT.exe
  2⤵
  PID:3164
- C:\Windows\System\EddXzQN.exe
  C:\Windows\System\EddXzQN.exe
  2⤵
  PID:3180
- C:\Windows\System\wEnAXnc.exe
  C:\Windows\System\wEnAXnc.exe
  2⤵
  PID:3444
- C:\Windows\System\GWEzJae.exe
  C:\Windows\System\GWEzJae.exe
  2⤵
  PID:3196
- C:\Windows\System\MZjdsWp.exe
  C:\Windows\System\MZjdsWp.exe
  2⤵
  PID:3328
- C:\Windows\System\uYqDrCE.exe
  C:\Windows\System\uYqDrCE.exe
  2⤵
  PID:3556
- C:\Windows\System\WFivyeZ.exe
  C:\Windows\System\WFivyeZ.exe
  2⤵
  PID:2868
- C:\Windows\System\mZvGVXP.exe
  C:\Windows\System\mZvGVXP.exe
  2⤵
  PID:3148
- C:\Windows\System\fXKMygF.exe
  C:\Windows\System\fXKMygF.exe
  2⤵
  PID:3396
- C:\Windows\System\FBhhfgY.exe
  C:\Windows\System\FBhhfgY.exe
  2⤵
  PID:2876
- C:\Windows\System\ekvvaSG.exe
  C:\Windows\System\ekvvaSG.exe
  2⤵
  PID:2784
- C:\Windows\System\ZFDjpzY.exe
  C:\Windows\System\ZFDjpzY.exe
  2⤵
  PID:2636
- C:\Windows\System\hEbWCkg.exe
  C:\Windows\System\hEbWCkg.exe
  2⤵
  PID:3692
- C:\Windows\System\qgjNEmw.exe
  C:\Windows\System\qgjNEmw.exe
  2⤵
  PID:3656
- C:\Windows\System\CSlnREi.exe
  C:\Windows\System\CSlnREi.exe
  2⤵
  PID:3456
- C:\Windows\System\CvJCWxg.exe
  C:\Windows\System\CvJCWxg.exe
  2⤵
  PID:2056
- C:\Windows\System\gttwEZH.exe
  C:\Windows\System\gttwEZH.exe
  2⤵
  PID:3708
- C:\Windows\System\xsbXUKg.exe
  C:\Windows\System\xsbXUKg.exe
  2⤵
  PID:3720
- C:\Windows\System\xBbxKhq.exe
  C:\Windows\System\xBbxKhq.exe
  2⤵
  PID:3852
- C:\Windows\System\KQcfZNA.exe
  C:\Windows\System\KQcfZNA.exe
  2⤵
  PID:3976
- C:\Windows\System\TkDenZL.exe
  C:\Windows\System\TkDenZL.exe
  2⤵
  PID:3900
- C:\Windows\System\swxPTet.exe
  C:\Windows\System\swxPTet.exe
  2⤵
  PID:1256
- C:\Windows\System\vJezwiO.exe
  C:\Windows\System\vJezwiO.exe
  2⤵
  PID:4028
- C:\Windows\System\rvrBMAt.exe
  C:\Windows\System\rvrBMAt.exe
  2⤵
  PID:2436
- C:\Windows\System\LvICfnS.exe
  C:\Windows\System\LvICfnS.exe
  2⤵
  PID:3260
- C:\Windows\System\GNSvetA.exe
  C:\Windows\System\GNSvetA.exe
  2⤵
  PID:808
- C:\Windows\System\FeMvIvz.exe
  C:\Windows\System\FeMvIvz.exe
  2⤵
  PID:3136
- C:\Windows\System\wXviYJc.exe
  C:\Windows\System\wXviYJc.exe
  2⤵
  PID:3600
- C:\Windows\System\fxVqGsD.exe
  C:\Windows\System\fxVqGsD.exe
  2⤵
  PID:3704
- C:\Windows\System\DcuKqMN.exe
  C:\Windows\System\DcuKqMN.exe
  2⤵
  PID:3944
- C:\Windows\System\bLGKaPj.exe
  C:\Windows\System\bLGKaPj.exe
  2⤵
  PID:2916
- C:\Windows\System\jKXKIqo.exe
  C:\Windows\System\jKXKIqo.exe
  2⤵
  PID:2340
- C:\Windows\System\FwatvxN.exe
  C:\Windows\System\FwatvxN.exe
  2⤵
  PID:4104
- C:\Windows\System\JztFawC.exe
  C:\Windows\System\JztFawC.exe
  2⤵
  PID:4120
- C:\Windows\System\iFDoKBu.exe
  C:\Windows\System\iFDoKBu.exe
  2⤵
  PID:4136
- C:\Windows\System\nLRTUMs.exe
  C:\Windows\System\nLRTUMs.exe
  2⤵
  PID:4152
- C:\Windows\System\nyeGCIu.exe
  C:\Windows\System\nyeGCIu.exe
  2⤵
  PID:4168
- C:\Windows\System\FQGnxyH.exe
  C:\Windows\System\FQGnxyH.exe
  2⤵
  PID:4184
- C:\Windows\System\HelPMgi.exe
  C:\Windows\System\HelPMgi.exe
  2⤵
  PID:4200
- C:\Windows\System\iOqEBEt.exe
  C:\Windows\System\iOqEBEt.exe
  2⤵
  PID:4216
- C:\Windows\System\LOgdnJa.exe
  C:\Windows\System\LOgdnJa.exe
  2⤵
  PID:4232
- C:\Windows\System\GIsvubC.exe
  C:\Windows\System\GIsvubC.exe
  2⤵
  PID:4252
- C:\Windows\System\tpLQBqw.exe
  C:\Windows\System\tpLQBqw.exe
  2⤵
  PID:4280
- C:\Windows\System\kJvGfVE.exe
  C:\Windows\System\kJvGfVE.exe
  2⤵
  PID:4308
- C:\Windows\System\qgHmqzH.exe
  C:\Windows\System\qgHmqzH.exe
  2⤵
  PID:4328
- C:\Windows\System\IzbDUkP.exe
  C:\Windows\System\IzbDUkP.exe
  2⤵
  PID:4344
- C:\Windows\System\puRkXRW.exe
  C:\Windows\System\puRkXRW.exe
  2⤵
  PID:4360
- C:\Windows\System\BIxLCxB.exe
  C:\Windows\System\BIxLCxB.exe
  2⤵
  PID:4376
- C:\Windows\System\SPSehgC.exe
  C:\Windows\System\SPSehgC.exe
  2⤵
  PID:4392
- C:\Windows\System\TXwNtDq.exe
  C:\Windows\System\TXwNtDq.exe
  2⤵
  PID:4408
- C:\Windows\System\XBecnCc.exe
  C:\Windows\System\XBecnCc.exe
  2⤵
  PID:4424
- C:\Windows\System\gkWkWjU.exe
  C:\Windows\System\gkWkWjU.exe
  2⤵
  PID:4440
- C:\Windows\System\tUUSSzS.exe
  C:\Windows\System\tUUSSzS.exe
  2⤵
  PID:4456
- C:\Windows\System\EiZhXFX.exe
  C:\Windows\System\EiZhXFX.exe
  2⤵
  PID:4472
- C:\Windows\System\THEOEpC.exe
  C:\Windows\System\THEOEpC.exe
  2⤵
  PID:4488
- C:\Windows\System\pBjFtcH.exe
  C:\Windows\System\pBjFtcH.exe
  2⤵
  PID:4504
- C:\Windows\System\CfJNtiC.exe
  C:\Windows\System\CfJNtiC.exe
  2⤵
  PID:4520
- C:\Windows\System\UODNFkY.exe
  C:\Windows\System\UODNFkY.exe
  2⤵
  PID:4536
- C:\Windows\System\GFkSQvm.exe
  C:\Windows\System\GFkSQvm.exe
  2⤵
  PID:4552
- C:\Windows\System\QARABty.exe
  C:\Windows\System\QARABty.exe
  2⤵
  PID:4568
- C:\Windows\System\YLHVXKn.exe
  C:\Windows\System\YLHVXKn.exe
  2⤵
  PID:4584
- C:\Windows\System\uyFLIqr.exe
  C:\Windows\System\uyFLIqr.exe
  2⤵
  PID:4600
- C:\Windows\System\NIALMfy.exe
  C:\Windows\System\NIALMfy.exe
  2⤵
  PID:4616
- C:\Windows\System\LdqBTxV.exe
  C:\Windows\System\LdqBTxV.exe
  2⤵
  PID:4632
- C:\Windows\System\cihOubu.exe
  C:\Windows\System\cihOubu.exe
  2⤵
  PID:4648
- C:\Windows\System\abafxfU.exe
  C:\Windows\System\abafxfU.exe
  2⤵
  PID:4664
- C:\Windows\System\DHEwZOO.exe
  C:\Windows\System\DHEwZOO.exe
  2⤵
  PID:4680
- C:\Windows\System\TWatdmL.exe
  C:\Windows\System\TWatdmL.exe
  2⤵
  PID:4696
- C:\Windows\System\UexuMTI.exe
  C:\Windows\System\UexuMTI.exe
  2⤵
  PID:4712
- C:\Windows\System\cJVRPfw.exe
  C:\Windows\System\cJVRPfw.exe
  2⤵
  PID:4728
- C:\Windows\System\FndcrgJ.exe
  C:\Windows\System\FndcrgJ.exe
  2⤵
  PID:4744
- C:\Windows\System\WOBugHd.exe
  C:\Windows\System\WOBugHd.exe
  2⤵
  PID:4760
- C:\Windows\System\JIBYaWf.exe
  C:\Windows\System\JIBYaWf.exe
  2⤵
  PID:4884
- C:\Windows\System\RZHQxIo.exe
  C:\Windows\System\RZHQxIo.exe
  2⤵
  PID:4900
- C:\Windows\System\TOXJPVH.exe
  C:\Windows\System\TOXJPVH.exe
  2⤵
  PID:4920
- C:\Windows\System\HwcoQEt.exe
  C:\Windows\System\HwcoQEt.exe
  2⤵
  PID:4960
- C:\Windows\System\XKUJnin.exe
  C:\Windows\System\XKUJnin.exe
  2⤵
  PID:4980
- C:\Windows\System\amwyzNr.exe
  C:\Windows\System\amwyzNr.exe
  2⤵
  PID:5004
- C:\Windows\System\cIhAAGw.exe
  C:\Windows\System\cIhAAGw.exe
  2⤵
  PID:5024
- C:\Windows\System\vMUVwcw.exe
  C:\Windows\System\vMUVwcw.exe
  2⤵
  PID:5044
- C:\Windows\System\TCXXAsp.exe
  C:\Windows\System\TCXXAsp.exe
  2⤵
  PID:5060
- C:\Windows\System\WARWhPI.exe
  C:\Windows\System\WARWhPI.exe
  2⤵
  PID:5076
- C:\Windows\System\DYgyKtl.exe
  C:\Windows\System\DYgyKtl.exe
  2⤵
  PID:5092
- C:\Windows\System\nfyAwuP.exe
  C:\Windows\System\nfyAwuP.exe
  2⤵
  PID:5108
- C:\Windows\System\yKPQaJY.exe
  C:\Windows\System\yKPQaJY.exe
  2⤵
  PID:3064
- C:\Windows\System\nvlvLLW.exe
  C:\Windows\System\nvlvLLW.exe
  2⤵
  PID:3512
- C:\Windows\System\ZmdbKQr.exe
  C:\Windows\System\ZmdbKQr.exe
  2⤵
  PID:4144
- C:\Windows\System\KjktGHv.exe
  C:\Windows\System\KjktGHv.exe
  2⤵
  PID:4024
- C:\Windows\System\VmPgDLN.exe
  C:\Windows\System\VmPgDLN.exe
  2⤵
  PID:3280
- C:\Windows\System\IvrrmVU.exe
  C:\Windows\System\IvrrmVU.exe
  2⤵
  PID:4208
- C:\Windows\System\PPKQskv.exe
  C:\Windows\System\PPKQskv.exe
  2⤵
  PID:3296
- C:\Windows\System\iVdrLXD.exe
  C:\Windows\System\iVdrLXD.exe
  2⤵
  PID:4228
- C:\Windows\System\OkUvDHw.exe
  C:\Windows\System\OkUvDHw.exe
  2⤵
  PID:4264
- C:\Windows\System\GyDLMZM.exe
  C:\Windows\System\GyDLMZM.exe
  2⤵
  PID:4276
- C:\Windows\System\bmVcQaN.exe
  C:\Windows\System\bmVcQaN.exe
  2⤵
  PID:4300
- C:\Windows\System\IxrGyAR.exe
  C:\Windows\System\IxrGyAR.exe
  2⤵
  PID:4368
- C:\Windows\System\YtSDora.exe
  C:\Windows\System\YtSDora.exe
  2⤵
  PID:4432
- C:\Windows\System\zjRldEB.exe
  C:\Windows\System\zjRldEB.exe
  2⤵
  PID:4468
- C:\Windows\System\guayMuH.exe
  C:\Windows\System\guayMuH.exe
  2⤵
  PID:4560
- C:\Windows\System\JPCldAi.exe
  C:\Windows\System\JPCldAi.exe
  2⤵
  PID:4592
- C:\Windows\System\frYHota.exe
  C:\Windows\System\frYHota.exe
  2⤵
  PID:4484
- C:\Windows\System\lZWdjII.exe
  C:\Windows\System\lZWdjII.exe
  2⤵
  PID:4548
- C:\Windows\System\nsCobmi.exe
  C:\Windows\System\nsCobmi.exe
  2⤵
  PID:4352
- C:\Windows\System\poSvkHC.exe
  C:\Windows\System\poSvkHC.exe
  2⤵
  PID:4628
- C:\Windows\System\FaWcUjM.exe
  C:\Windows\System\FaWcUjM.exe
  2⤵
  PID:4580
- C:\Windows\System\QxbADBj.exe
  C:\Windows\System\QxbADBj.exe
  2⤵
  PID:4660
- C:\Windows\System\zDSeVGy.exe
  C:\Windows\System\zDSeVGy.exe
  2⤵
  PID:4672
- C:\Windows\System\khNdZka.exe
  C:\Windows\System\khNdZka.exe
  2⤵
  PID:4752
- C:\Windows\System\fwCgbts.exe
  C:\Windows\System\fwCgbts.exe
  2⤵
  PID:4736
- C:\Windows\System\PWKDnyQ.exe
  C:\Windows\System\PWKDnyQ.exe
  2⤵
  PID:4784
- C:\Windows\System\NdpDFxi.exe
  C:\Windows\System\NdpDFxi.exe
  2⤵
  PID:4796
- C:\Windows\System\kVUnecC.exe
  C:\Windows\System\kVUnecC.exe
  2⤵
  PID:4812
- C:\Windows\System\kcNiceS.exe
  C:\Windows\System\kcNiceS.exe
  2⤵
  PID:4828
- C:\Windows\System\gWZwToe.exe
  C:\Windows\System\gWZwToe.exe
  2⤵
  PID:4844
- C:\Windows\System\UutHQGZ.exe
  C:\Windows\System\UutHQGZ.exe
  2⤵
  PID:4860
- C:\Windows\System\pKYwfEj.exe
  C:\Windows\System\pKYwfEj.exe
  2⤵
  PID:4876
- C:\Windows\System\lmvkQIc.exe
  C:\Windows\System\lmvkQIc.exe
  2⤵
  PID:4896
- C:\Windows\System\ochtGnq.exe
  C:\Windows\System\ochtGnq.exe
  2⤵
  PID:4916
- C:\Windows\System\SDpuWoX.exe
  C:\Windows\System\SDpuWoX.exe
  2⤵
  PID:4944
- C:\Windows\System\bTiTLeB.exe
  C:\Windows\System\bTiTLeB.exe
  2⤵
  PID:4968
- C:\Windows\System\MZbqexG.exe
  C:\Windows\System\MZbqexG.exe
  2⤵
  PID:4992
- C:\Windows\System\pJlbpZi.exe
  C:\Windows\System\pJlbpZi.exe
  2⤵
  PID:5032
- C:\Windows\System\ViSYiRT.exe
  C:\Windows\System\ViSYiRT.exe
  2⤵
  PID:5020
- C:\Windows\System\VPUfjNS.exe
  C:\Windows\System\VPUfjNS.exe
  2⤵
  PID:5072
- C:\Windows\System\idgUlkv.exe
  C:\Windows\System\idgUlkv.exe
  2⤵
  PID:3836
- C:\Windows\System\TSfHmSA.exe
  C:\Windows\System\TSfHmSA.exe
  2⤵
  PID:4112
- C:\Windows\System\HhATJkG.exe
  C:\Windows\System\HhATJkG.exe
  2⤵
  PID:3368
- C:\Windows\System\ljedLYn.exe
  C:\Windows\System\ljedLYn.exe
  2⤵
  PID:1176
- C:\Windows\System\iAauKKw.exe
  C:\Windows\System\iAauKKw.exe
  2⤵
  PID:3356
- C:\Windows\System\tXNThPP.exe
  C:\Windows\System\tXNThPP.exe
  2⤵
  PID:4128
- C:\Windows\System\JSdFnWq.exe
  C:\Windows\System\JSdFnWq.exe
  2⤵
  PID:3088
- C:\Windows\System\RMqukmo.exe
  C:\Windows\System\RMqukmo.exe
  2⤵
  PID:2028
- C:\Windows\System\afrsIWw.exe
  C:\Windows\System\afrsIWw.exe
  2⤵
  PID:3660
- C:\Windows\System\RmEwgGC.exe
  C:\Windows\System\RmEwgGC.exe
  2⤵
  PID:2592
- C:\Windows\System\dIcIwyd.exe
  C:\Windows\System\dIcIwyd.exe
  2⤵
  PID:3896
- C:\Windows\System\haibfRl.exe
  C:\Windows\System\haibfRl.exe
  2⤵
  PID:4260
- C:\Windows\System\ErWmtQW.exe
  C:\Windows\System\ErWmtQW.exe
  2⤵
  PID:4340
- C:\Windows\System\esDSdrD.exe
  C:\Windows\System\esDSdrD.exe
  2⤵
  PID:4420
- C:\Windows\System\qkWvKSZ.exe
  C:\Windows\System\qkWvKSZ.exe
  2⤵
  PID:4388
- C:\Windows\System\BZeNVlV.exe
  C:\Windows\System\BZeNVlV.exe
  2⤵
  PID:4720
- C:\Windows\System\QrBNIPb.exe
  C:\Windows\System\QrBNIPb.exe
  2⤵
  PID:4776
- C:\Windows\System\QoBEDKG.exe
  C:\Windows\System\QoBEDKG.exe
  2⤵
  PID:4840
- C:\Windows\System\usawKJp.exe
  C:\Windows\System\usawKJp.exe
  2⤵
  PID:4808
- C:\Windows\System\LFTJTQh.exe
  C:\Windows\System\LFTJTQh.exe
  2⤵
  PID:4956
- C:\Windows\System\sRwNrwU.exe
  C:\Windows\System\sRwNrwU.exe
  2⤵
  PID:4688
- C:\Windows\System\xaEsdwQ.exe
  C:\Windows\System\xaEsdwQ.exe
  2⤵
  PID:4480
- C:\Windows\System\HrtHoJt.exe
  C:\Windows\System\HrtHoJt.exe
  2⤵
  PID:4676
- C:\Windows\System\QQGkvEJ.exe
  C:\Windows\System\QQGkvEJ.exe
  2⤵
  PID:5068
- C:\Windows\System\MwtnrMa.exe
  C:\Windows\System\MwtnrMa.exe
  2⤵
  PID:4824
- C:\Windows\System\LpZTHlh.exe
  C:\Windows\System\LpZTHlh.exe
  2⤵
  PID:4892
- C:\Windows\System\stxuOTX.exe
  C:\Windows\System\stxuOTX.exe
  2⤵
  PID:4988
- C:\Windows\System\EIRbcgr.exe
  C:\Windows\System\EIRbcgr.exe
  2⤵
  PID:4176
- C:\Windows\System\fAIxOac.exe
  C:\Windows\System\fAIxOac.exe
  2⤵
  PID:2104
- C:\Windows\System\HjSPdpj.exe
  C:\Windows\System\HjSPdpj.exe
  2⤵
  PID:4416
- C:\Windows\System\UIweMbd.exe
  C:\Windows\System\UIweMbd.exe
  2⤵
  PID:4336
- C:\Windows\System\pCObhGt.exe
  C:\Windows\System\pCObhGt.exe
  2⤵
  PID:4384
- C:\Windows\System\zYbtpMm.exe
  C:\Windows\System\zYbtpMm.exe
  2⤵
  PID:3688
- C:\Windows\System\XQjavVs.exe
  C:\Windows\System\XQjavVs.exe
  2⤵
  PID:3364
- C:\Windows\System\kEhKUVG.exe
  C:\Windows\System\kEhKUVG.exe
  2⤵
  PID:4400
- C:\Windows\System\nLzHlAQ.exe
  C:\Windows\System\nLzHlAQ.exe
  2⤵
  PID:4872
- C:\Windows\System\RPwqTtG.exe
  C:\Windows\System\RPwqTtG.exe
  2⤵
  PID:4532
- C:\Windows\System\vGbUacf.exe
  C:\Windows\System\vGbUacf.exe
  2⤵
  PID:4772
- C:\Windows\System\xLxyWmO.exe
  C:\Windows\System\xLxyWmO.exe
  2⤵
  PID:2900
- C:\Windows\System\MwdiZpv.exe
  C:\Windows\System\MwdiZpv.exe
  2⤵
  PID:876
- C:\Windows\System\nwGFvtT.exe
  C:\Windows\System\nwGFvtT.exe
  2⤵
  PID:5132
- C:\Windows\System\jWxleYG.exe
  C:\Windows\System\jWxleYG.exe
  2⤵
  PID:5148
- C:\Windows\System\nfQQNUV.exe
  C:\Windows\System\nfQQNUV.exe
  2⤵
  PID:5164
- C:\Windows\System\jzJKclY.exe
  C:\Windows\System\jzJKclY.exe
  2⤵
  PID:5180
- C:\Windows\System\IkVRZqf.exe
  C:\Windows\System\IkVRZqf.exe
  2⤵
  PID:5196
- C:\Windows\System\bdLDnPQ.exe
  C:\Windows\System\bdLDnPQ.exe
  2⤵
  PID:5212
- C:\Windows\System\jBlhZEN.exe
  C:\Windows\System\jBlhZEN.exe
  2⤵
  PID:5228
- C:\Windows\System\JXYrRWc.exe
  C:\Windows\System\JXYrRWc.exe
  2⤵
  PID:5244
- C:\Windows\System\fbZTMMP.exe
  C:\Windows\System\fbZTMMP.exe
  2⤵
  PID:5260
- C:\Windows\System\RWgXHmu.exe
  C:\Windows\System\RWgXHmu.exe
  2⤵
  PID:5276
- C:\Windows\System\KCfcWqF.exe
  C:\Windows\System\KCfcWqF.exe
  2⤵
  PID:5292
- C:\Windows\System\ZCOHfGl.exe
  C:\Windows\System\ZCOHfGl.exe
  2⤵
  PID:5308
- C:\Windows\System\eBvGSbf.exe
  C:\Windows\System\eBvGSbf.exe
  2⤵
  PID:5324
- C:\Windows\System\vsbSRVZ.exe
  C:\Windows\System\vsbSRVZ.exe
  2⤵
  PID:5340
- C:\Windows\System\PXQTOMg.exe
  C:\Windows\System\PXQTOMg.exe
  2⤵
  PID:5356
- C:\Windows\System\DtXczdF.exe
  C:\Windows\System\DtXczdF.exe
  2⤵
  PID:5372
- C:\Windows\System\MUaIWYj.exe
  C:\Windows\System\MUaIWYj.exe
  2⤵
  PID:5388
- C:\Windows\System\KOlWdGu.exe
  C:\Windows\System\KOlWdGu.exe
  2⤵
  PID:5404
- C:\Windows\System\hlQFovE.exe
  C:\Windows\System\hlQFovE.exe
  2⤵
  PID:5420
- C:\Windows\System\AGlLmuc.exe
  C:\Windows\System\AGlLmuc.exe
  2⤵
  PID:5436
- C:\Windows\System\CSujKdh.exe
  C:\Windows\System\CSujKdh.exe
  2⤵
  PID:5452
- C:\Windows\System\GCpUjPz.exe
  C:\Windows\System\GCpUjPz.exe
  2⤵
  PID:5468
- C:\Windows\System\vIYuUFF.exe
  C:\Windows\System\vIYuUFF.exe
  2⤵
  PID:5484
- C:\Windows\System\qhxdFSq.exe
  C:\Windows\System\qhxdFSq.exe
  2⤵
  PID:5500
- C:\Windows\System\uydOAkt.exe
  C:\Windows\System\uydOAkt.exe
  2⤵
  PID:5516
- C:\Windows\System\LuOEipD.exe
  C:\Windows\System\LuOEipD.exe
  2⤵
  PID:5532
- C:\Windows\System\SzBSRIl.exe
  C:\Windows\System\SzBSRIl.exe
  2⤵
  PID:5548
- C:\Windows\System\uFufNMT.exe
  C:\Windows\System\uFufNMT.exe
  2⤵
  PID:5564
- C:\Windows\System\ZLwyFaH.exe
  C:\Windows\System\ZLwyFaH.exe
  2⤵
  PID:5580
- C:\Windows\System\cRmVILN.exe
  C:\Windows\System\cRmVILN.exe
  2⤵
  PID:5596
- C:\Windows\System\BtxLOtX.exe
  C:\Windows\System\BtxLOtX.exe
  2⤵
  PID:5612
- C:\Windows\System\MhrvJfB.exe
  C:\Windows\System\MhrvJfB.exe
  2⤵
  PID:5628
- C:\Windows\System\uJQjJnn.exe
  C:\Windows\System\uJQjJnn.exe
  2⤵
  PID:5644
- C:\Windows\System\hMDJdrx.exe
  C:\Windows\System\hMDJdrx.exe
  2⤵
  PID:5660
- C:\Windows\System\ZWuErEk.exe
  C:\Windows\System\ZWuErEk.exe
  2⤵
  PID:5676
- C:\Windows\System\urTpXOS.exe
  C:\Windows\System\urTpXOS.exe
  2⤵
  PID:5692
- C:\Windows\System\zAovrHA.exe
  C:\Windows\System\zAovrHA.exe
  2⤵
  PID:5708
- C:\Windows\System\fYMHEfi.exe
  C:\Windows\System\fYMHEfi.exe
  2⤵
  PID:5724
- C:\Windows\System\jCMrsZF.exe
  C:\Windows\System\jCMrsZF.exe
  2⤵
  PID:5740
- C:\Windows\System\swboRtl.exe
  C:\Windows\System\swboRtl.exe
  2⤵
  PID:5756
- C:\Windows\System\HBiGJFp.exe
  C:\Windows\System\HBiGJFp.exe
  2⤵
  PID:5772
- C:\Windows\System\FuNcAls.exe
  C:\Windows\System\FuNcAls.exe
  2⤵
  PID:5792
- C:\Windows\System\NLNfyUn.exe
  C:\Windows\System\NLNfyUn.exe
  2⤵
  PID:5808
- C:\Windows\System\OnmaGeR.exe
  C:\Windows\System\OnmaGeR.exe
  2⤵
  PID:5824
- C:\Windows\System\geeqQcC.exe
  C:\Windows\System\geeqQcC.exe
  2⤵
  PID:5840
- C:\Windows\System\PLBBDRT.exe
  C:\Windows\System\PLBBDRT.exe
  2⤵
  PID:5856
- C:\Windows\System\eqVGKCr.exe
  C:\Windows\System\eqVGKCr.exe
  2⤵
  PID:5872
- C:\Windows\System\CzkzEBq.exe
  C:\Windows\System\CzkzEBq.exe
  2⤵
  PID:5888
- C:\Windows\System\xyIjEMS.exe
  C:\Windows\System\xyIjEMS.exe
  2⤵
  PID:5904
- C:\Windows\System\PXhlxam.exe
  C:\Windows\System\PXhlxam.exe
  2⤵
  PID:5920
- C:\Windows\System\ErjBNWg.exe
  C:\Windows\System\ErjBNWg.exe
  2⤵
  PID:5936
- C:\Windows\System\DYWFonJ.exe
  C:\Windows\System\DYWFonJ.exe
  2⤵
  PID:5952
- C:\Windows\System\xMOJHmr.exe
  C:\Windows\System\xMOJHmr.exe
  2⤵
  PID:5968
- C:\Windows\System\eZDGiRO.exe
  C:\Windows\System\eZDGiRO.exe
  2⤵
  PID:5984
- C:\Windows\System\btOwxjc.exe
  C:\Windows\System\btOwxjc.exe
  2⤵
  PID:6000
- C:\Windows\System\YxjPWlb.exe
  C:\Windows\System\YxjPWlb.exe
  2⤵
  PID:6016
- C:\Windows\System\znqBUny.exe
  C:\Windows\System\znqBUny.exe
  2⤵
  PID:6032
- C:\Windows\System\CeMlLaC.exe
  C:\Windows\System\CeMlLaC.exe
  2⤵
  PID:6048
- C:\Windows\System\BEvXHXD.exe
  C:\Windows\System\BEvXHXD.exe
  2⤵
  PID:6064
- C:\Windows\System\NleJxWV.exe
  C:\Windows\System\NleJxWV.exe
  2⤵
  PID:6080
- C:\Windows\System\aEnnpeu.exe
  C:\Windows\System\aEnnpeu.exe
  2⤵
  PID:6096
- C:\Windows\System\enCqaIB.exe
  C:\Windows\System\enCqaIB.exe
  2⤵
  PID:6112
- C:\Windows\System\dkPaiga.exe
  C:\Windows\System\dkPaiga.exe
  2⤵
  PID:6128
- C:\Windows\System\LLZmwBv.exe
  C:\Windows\System\LLZmwBv.exe
  2⤵
  PID:4768
- C:\Windows\System\RtDxSIG.exe
  C:\Windows\System\RtDxSIG.exe
  2⤵
  PID:4116
- C:\Windows\System\kTfiJqC.exe
  C:\Windows\System\kTfiJqC.exe
  2⤵
  PID:5016
- C:\Windows\System\DpcTSWt.exe
  C:\Windows\System\DpcTSWt.exe
  2⤵
  PID:4192
- C:\Windows\System\gpzXsYQ.exe
  C:\Windows\System\gpzXsYQ.exe
  2⤵
  PID:5104
- C:\Windows\System\MRGGAoM.exe
  C:\Windows\System\MRGGAoM.exe
  2⤵
  PID:5204
- C:\Windows\System\DmReRhd.exe
  C:\Windows\System\DmReRhd.exe
  2⤵
  PID:5236
- C:\Windows\System\ezUJvBm.exe
  C:\Windows\System\ezUJvBm.exe
  2⤵
  PID:4544
- C:\Windows\System\HwNkhxe.exe
  C:\Windows\System\HwNkhxe.exe
  2⤵
  PID:2796
- C:\Windows\System\irkDmGA.exe
  C:\Windows\System\irkDmGA.exe
  2⤵
  PID:5128
- C:\Windows\System\JSnRUYr.exe
  C:\Windows\System\JSnRUYr.exe
  2⤵
  PID:5364
- C:\Windows\System\vGbBWnk.exe
  C:\Windows\System\vGbBWnk.exe
  2⤵
  PID:5428
- C:\Windows\System\NvRBppd.exe
  C:\Windows\System\NvRBppd.exe
  2⤵
  PID:5492
- C:\Windows\System\RLpRWFD.exe
  C:\Windows\System\RLpRWFD.exe
  2⤵
  PID:5588
- C:\Windows\System\aHfzkeY.exe
  C:\Windows\System\aHfzkeY.exe
  2⤵
  PID:5656
- C:\Windows\System\JciMYtd.exe
  C:\Windows\System\JciMYtd.exe
  2⤵
  PID:5592
- C:\Windows\System\ZHridDS.exe
  C:\Windows\System\ZHridDS.exe
  2⤵
  PID:5780
- C:\Windows\System\KfAQKJn.exe
  C:\Windows\System\KfAQKJn.exe
  2⤵
  PID:5256
- C:\Windows\System\KcYsYIb.exe
  C:\Windows\System\KcYsYIb.exe
  2⤵
  PID:4940
- C:\Windows\System\tSBGAaM.exe
  C:\Windows\System\tSBGAaM.exe
  2⤵
  PID:5448
- C:\Windows\System\PUUIaUI.exe
  C:\Windows\System\PUUIaUI.exe
  2⤵
  PID:5576
- C:\Windows\System\FRAOBls.exe
  C:\Windows\System\FRAOBls.exe
  2⤵
  PID:5848
- C:\Windows\System\kRSFIdQ.exe
  C:\Windows\System\kRSFIdQ.exe
  2⤵
  PID:5944
- C:\Windows\System\YlhREmN.exe
  C:\Windows\System\YlhREmN.exe
  2⤵
  PID:5884
- C:\Windows\System\PREisrC.exe
  C:\Windows\System\PREisrC.exe
  2⤵
  PID:6072
- C:\Windows\System\SwWoDHQ.exe
  C:\Windows\System\SwWoDHQ.exe
  2⤵
  PID:6136
- C:\Windows\System\iqcCWyA.exe
  C:\Windows\System\iqcCWyA.exe
  2⤵
  PID:4304
- C:\Windows\System\uwAEnxI.exe
  C:\Windows\System\uwAEnxI.exe
  2⤵
  PID:5160
- C:\Windows\System\BnJaynV.exe
  C:\Windows\System\BnJaynV.exe
  2⤵
  PID:5300
- C:\Windows\System\wRlVWKE.exe
  C:\Windows\System\wRlVWKE.exe
  2⤵
  PID:5460
- C:\Windows\System\lxMDlwH.exe
  C:\Windows\System\lxMDlwH.exe
  2⤵
  PID:5544
- C:\Windows\System\YAhfFuG.exe
  C:\Windows\System\YAhfFuG.exe
  2⤵
  PID:5464
- C:\Windows\System\XHWOlQF.exe
  C:\Windows\System\XHWOlQF.exe
  2⤵
  PID:5720
- C:\Windows\System\CKhPyWb.exe
  C:\Windows\System\CKhPyWb.exe
  2⤵
  PID:5572
- C:\Windows\System\YlZmDmO.exe
  C:\Windows\System\YlZmDmO.exe
  2⤵
  PID:5380
- C:\Windows\System\SjBWZKL.exe
  C:\Windows\System\SjBWZKL.exe
  2⤵
  PID:5608
- C:\Windows\System\mzPAYsd.exe
  C:\Windows\System\mzPAYsd.exe
  2⤵
  PID:5704
- C:\Windows\System\DfIzvxZ.exe
  C:\Windows\System\DfIzvxZ.exe
  2⤵
  PID:6088
- C:\Windows\System\VHzISTt.exe
  C:\Windows\System\VHzISTt.exe
  2⤵
  PID:5752
- C:\Windows\System\QADDkWK.exe
  C:\Windows\System\QADDkWK.exe
  2⤵
  PID:5896
- C:\Windows\System\oOtnEKY.exe
  C:\Windows\System\oOtnEKY.exe
  2⤵
  PID:5964
- C:\Windows\System\NiOgAug.exe
  C:\Windows\System\NiOgAug.exe
  2⤵
  PID:6028
- C:\Windows\System\sMBQxOz.exe
  C:\Windows\System\sMBQxOz.exe
  2⤵
  PID:6120
- C:\Windows\System\VTJNFLf.exe
  C:\Windows\System\VTJNFLf.exe
  2⤵
  PID:4820
- C:\Windows\System\XocgaTZ.exe
  C:\Windows\System\XocgaTZ.exe
  2⤵
  PID:5056
- C:\Windows\System\WClDsME.exe
  C:\Windows\System\WClDsME.exe
  2⤵
  PID:5524
- C:\Windows\System\ntUCAPZ.exe
  C:\Windows\System\ntUCAPZ.exe
  2⤵
  PID:5348
- C:\Windows\System\HNZVJlW.exe
  C:\Windows\System\HNZVJlW.exe
  2⤵
  PID:5732
- C:\Windows\System\sgMlPnY.exe
  C:\Windows\System\sgMlPnY.exe
  2⤵
  PID:5816
- C:\Windows\System\IBSENPv.exe
  C:\Windows\System\IBSENPv.exe
  2⤵
  PID:5980
- C:\Windows\System\xdYsDkJ.exe
  C:\Windows\System\xdYsDkJ.exe
  2⤵
  PID:5140
- C:\Windows\System\cWuqats.exe
  C:\Windows\System\cWuqats.exe
  2⤵
  PID:5192
- C:\Windows\System\CpKtLEN.exe
  C:\Windows\System\CpKtLEN.exe
  2⤵
  PID:5652
- C:\Windows\System\staEbZG.exe
  C:\Windows\System\staEbZG.exe
  2⤵
  PID:6008
- C:\Windows\System\DBpgfFI.exe
  C:\Windows\System\DBpgfFI.exe
  2⤵
  PID:5208
- C:\Windows\System\VjDMPeZ.exe
  C:\Windows\System\VjDMPeZ.exe
  2⤵
  PID:5540
- C:\Windows\System\oyXRVkY.exe
  C:\Windows\System\oyXRVkY.exe
  2⤵
  PID:5700
- C:\Windows\System\yPsuDYc.exe
  C:\Windows\System\yPsuDYc.exe
  2⤵
  PID:6060
- C:\Windows\System\oMfiTGR.exe
  C:\Windows\System\oMfiTGR.exe
  2⤵
  PID:5684
- C:\Windows\System\zFzzBCo.exe
  C:\Windows\System\zFzzBCo.exe
  2⤵
  PID:6040
- C:\Windows\System\iopNxCD.exe
  C:\Windows\System\iopNxCD.exe
  2⤵
  PID:5476
- C:\Windows\System\nDMfZUG.exe
  C:\Windows\System\nDMfZUG.exe
  2⤵
  PID:5224
- C:\Windows\System\zWbYZlL.exe
  C:\Windows\System\zWbYZlL.exe
  2⤵
  PID:6160
- C:\Windows\System\LRNYZMA.exe
  C:\Windows\System\LRNYZMA.exe
  2⤵
  PID:6176
- C:\Windows\System\eJyZlOj.exe
  C:\Windows\System\eJyZlOj.exe
  2⤵
  PID:6196
- C:\Windows\System\pLoFmcP.exe
  C:\Windows\System\pLoFmcP.exe
  2⤵
  PID:6212
- C:\Windows\System\IthYRGk.exe
  C:\Windows\System\IthYRGk.exe
  2⤵
  PID:6228
- C:\Windows\System\MxqFlgz.exe
  C:\Windows\System\MxqFlgz.exe
  2⤵
  PID:6244
- C:\Windows\System\XkOthmW.exe
  C:\Windows\System\XkOthmW.exe
  2⤵
  PID:6260
- C:\Windows\System\xnZCtzy.exe
  C:\Windows\System\xnZCtzy.exe
  2⤵
  PID:6276
- C:\Windows\System\XyZMqzV.exe
  C:\Windows\System\XyZMqzV.exe
  2⤵
  PID:6292
- C:\Windows\System\kWGyYDw.exe
  C:\Windows\System\kWGyYDw.exe
  2⤵
  PID:6308
- C:\Windows\System\tisRWQM.exe
  C:\Windows\System\tisRWQM.exe
  2⤵
  PID:6324
- C:\Windows\System\rjOQRGO.exe
  C:\Windows\System\rjOQRGO.exe
  2⤵
  PID:6340
- C:\Windows\System\nXUYZYU.exe
  C:\Windows\System\nXUYZYU.exe
  2⤵
  PID:6356
- C:\Windows\System\SjkhcAj.exe
  C:\Windows\System\SjkhcAj.exe
  2⤵
  PID:6372
- C:\Windows\System\TRbDjXO.exe
  C:\Windows\System\TRbDjXO.exe
  2⤵
  PID:6388
- C:\Windows\System\tvKfqHm.exe
  C:\Windows\System\tvKfqHm.exe
  2⤵
  PID:6404
- C:\Windows\System\xBRnvnv.exe
  C:\Windows\System\xBRnvnv.exe
  2⤵
  PID:6420
- C:\Windows\System\eBsizPb.exe
  C:\Windows\System\eBsizPb.exe
  2⤵
  PID:6436
- C:\Windows\System\wDpQKNr.exe
  C:\Windows\System\wDpQKNr.exe
  2⤵
  PID:6452
- C:\Windows\System\SJKmSJZ.exe
  C:\Windows\System\SJKmSJZ.exe
  2⤵
  PID:6468
- C:\Windows\System\qbfEcwK.exe
  C:\Windows\System\qbfEcwK.exe
  2⤵
  PID:6484
- C:\Windows\System\JMHXHJQ.exe
  C:\Windows\System\JMHXHJQ.exe
  2⤵
  PID:6500
- C:\Windows\System\JLKyise.exe
  C:\Windows\System\JLKyise.exe
  2⤵
  PID:6516
- C:\Windows\System\wqbdWcy.exe
  C:\Windows\System\wqbdWcy.exe
  2⤵
  PID:6532
- C:\Windows\System\CmJlnXA.exe
  C:\Windows\System\CmJlnXA.exe
  2⤵
  PID:6548
- C:\Windows\System\zrOyHGD.exe
  C:\Windows\System\zrOyHGD.exe
  2⤵
  PID:6564
- C:\Windows\System\pfUCLod.exe
  C:\Windows\System\pfUCLod.exe
  2⤵
  PID:6580
- C:\Windows\System\oSOTGvs.exe
  C:\Windows\System\oSOTGvs.exe
  2⤵
  PID:6596
- C:\Windows\System\YSGmGQK.exe
  C:\Windows\System\YSGmGQK.exe
  2⤵
  PID:6612
- C:\Windows\System\CvVScmm.exe
  C:\Windows\System\CvVScmm.exe
  2⤵
  PID:6628
- C:\Windows\System\rWAephI.exe
  C:\Windows\System\rWAephI.exe
  2⤵
  PID:6644
- C:\Windows\System\gVzGGye.exe
  C:\Windows\System\gVzGGye.exe
  2⤵
  PID:6660
- C:\Windows\System\lDcgpkN.exe
  C:\Windows\System\lDcgpkN.exe
  2⤵
  PID:6676
- C:\Windows\System\lvBHmxn.exe
  C:\Windows\System\lvBHmxn.exe
  2⤵
  PID:6692
- C:\Windows\System\zwLVsoV.exe
  C:\Windows\System\zwLVsoV.exe
  2⤵
  PID:6708
- C:\Windows\System\wMisMAU.exe
  C:\Windows\System\wMisMAU.exe
  2⤵
  PID:6724
- C:\Windows\System\sLHldzN.exe
  C:\Windows\System\sLHldzN.exe
  2⤵
  PID:6740
- C:\Windows\System\nCxsFAi.exe
  C:\Windows\System\nCxsFAi.exe
  2⤵
  PID:6756
- C:\Windows\System\JYnYRte.exe
  C:\Windows\System\JYnYRte.exe
  2⤵
  PID:6772
- C:\Windows\System\kwFnekK.exe
  C:\Windows\System\kwFnekK.exe
  2⤵
  PID:6788
- C:\Windows\System\YjzbGrj.exe
  C:\Windows\System\YjzbGrj.exe
  2⤵
  PID:6804
- C:\Windows\System\LjAlQuK.exe
  C:\Windows\System\LjAlQuK.exe
  2⤵
  PID:6820
- C:\Windows\System\MRMVhTE.exe
  C:\Windows\System\MRMVhTE.exe
  2⤵
  PID:6836
- C:\Windows\System\FcyAKNt.exe
  C:\Windows\System\FcyAKNt.exe
  2⤵
  PID:6852
- C:\Windows\System\eWZqOyL.exe
  C:\Windows\System\eWZqOyL.exe
  2⤵
  PID:6868
- C:\Windows\System\NpzTWKE.exe
  C:\Windows\System\NpzTWKE.exe
  2⤵
  PID:6884
- C:\Windows\System\yeKbjhI.exe
  C:\Windows\System\yeKbjhI.exe
  2⤵
  PID:6900
- C:\Windows\System\UPjDDYR.exe
  C:\Windows\System\UPjDDYR.exe
  2⤵
  PID:6916
- C:\Windows\System\GyEZAYc.exe
  C:\Windows\System\GyEZAYc.exe
  2⤵
  PID:6932
- C:\Windows\System\zstSQnr.exe
  C:\Windows\System\zstSQnr.exe
  2⤵
  PID:6948
- C:\Windows\System\TPRDlhB.exe
  C:\Windows\System\TPRDlhB.exe
  2⤵
  PID:6964
- C:\Windows\System\RvojnoC.exe
  C:\Windows\System\RvojnoC.exe
  2⤵
  PID:6980
- C:\Windows\System\RgTMVhl.exe
  C:\Windows\System\RgTMVhl.exe
  2⤵
  PID:6996
- C:\Windows\System\wPnmKtj.exe
  C:\Windows\System\wPnmKtj.exe
  2⤵
  PID:7012
- C:\Windows\System\bOypMna.exe
  C:\Windows\System\bOypMna.exe
  2⤵
  PID:7028
- C:\Windows\System\sVUuCxc.exe
  C:\Windows\System\sVUuCxc.exe
  2⤵
  PID:7044
- C:\Windows\System\frcGhRC.exe
  C:\Windows\System\frcGhRC.exe
  2⤵
  PID:7060
- C:\Windows\System\qogWZDn.exe
  C:\Windows\System\qogWZDn.exe
  2⤵
  PID:7080
- C:\Windows\System\YdALnPB.exe
  C:\Windows\System\YdALnPB.exe
  2⤵
  PID:7096
- C:\Windows\System\zLSbfDg.exe
  C:\Windows\System\zLSbfDg.exe
  2⤵
  PID:7112
- C:\Windows\System\Rnjooka.exe
  C:\Windows\System\Rnjooka.exe
  2⤵
  PID:7128
- C:\Windows\System\CJtyhhY.exe
  C:\Windows\System\CJtyhhY.exe
  2⤵
  PID:7144
- C:\Windows\System\RKEpeAn.exe
  C:\Windows\System\RKEpeAn.exe
  2⤵
  PID:7160
- C:\Windows\System\psXzkel.exe
  C:\Windows\System\psXzkel.exe
  2⤵
  PID:6104
- C:\Windows\System\QMWwWZU.exe
  C:\Windows\System\QMWwWZU.exe
  2⤵
  PID:6184
- C:\Windows\System\vOaXOaD.exe
  C:\Windows\System\vOaXOaD.exe
  2⤵
  PID:6252
- C:\Windows\System\eVmHVjz.exe
  C:\Windows\System\eVmHVjz.exe
  2⤵
  PID:6256
- C:\Windows\System\JBwXaiR.exe
  C:\Windows\System\JBwXaiR.exe
  2⤵
  PID:6352
- C:\Windows\System\eejEepE.exe
  C:\Windows\System\eejEepE.exe
  2⤵
  PID:6416
- C:\Windows\System\ObuqvKS.exe
  C:\Windows\System\ObuqvKS.exe
  2⤵
  PID:6480
- C:\Windows\System\VzXofBl.exe
  C:\Windows\System\VzXofBl.exe
  2⤵
  PID:6544
- C:\Windows\System\ODttWWP.exe
  C:\Windows\System\ODttWWP.exe
  2⤵
  PID:6636
- C:\Windows\System\UwWVdNB.exe
  C:\Windows\System\UwWVdNB.exe
  2⤵
  PID:6700
- C:\Windows\System\wQnlfTc.exe
  C:\Windows\System\wQnlfTc.exe
  2⤵
  PID:6764
- C:\Windows\System\HrtAHcJ.exe
  C:\Windows\System\HrtAHcJ.exe
  2⤵
  PID:6832
- C:\Windows\System\bTgGYPK.exe
  C:\Windows\System\bTgGYPK.exe
  2⤵
  PID:6796
- C:\Windows\System\ljCIAPE.exe
  C:\Windows\System\ljCIAPE.exe
  2⤵
  PID:6928
- C:\Windows\System\sKLnNdd.exe
  C:\Windows\System\sKLnNdd.exe
  2⤵
  PID:5864
- C:\Windows\System\orgnmLK.exe
  C:\Windows\System\orgnmLK.exe
  2⤵
  PID:7024
- C:\Windows\System\CWIFLJq.exe
  C:\Windows\System\CWIFLJq.exe
  2⤵
  PID:5560
- C:\Windows\System\mdwuMpd.exe
  C:\Windows\System\mdwuMpd.exe
  2⤵
  PID:3460
- C:\Windows\System\WHNhnsv.exe
  C:\Windows\System\WHNhnsv.exe
  2⤵
  PID:5836
- C:\Windows\System\julRiXs.exe
  C:\Windows\System\julRiXs.exe
  2⤵
  PID:6268
- C:\Windows\System\ZQfpSLt.exe
  C:\Windows\System\ZQfpSLt.exe
  2⤵
  PID:6364
- C:\Windows\System\AZmwBpX.exe
  C:\Windows\System\AZmwBpX.exe
  2⤵
  PID:6656
- C:\Windows\System\qoHzIgL.exe
  C:\Windows\System\qoHzIgL.exe
  2⤵
  PID:6876
- C:\Windows\System\hefuCSK.exe
  C:\Windows\System\hefuCSK.exe
  2⤵
  PID:5912
- C:\Windows\System\sVHvOgE.exe
  C:\Windows\System\sVHvOgE.exe
  2⤵
  PID:6236
- C:\Windows\System\ZZuDthw.exe
  C:\Windows\System\ZZuDthw.exe
  2⤵
  PID:4856
- C:\Windows\System\dYvQwou.exe
  C:\Windows\System\dYvQwou.exe
  2⤵
  PID:6780
- C:\Windows\System\cQutUtQ.exe
  C:\Windows\System\cQutUtQ.exe
  2⤵
  PID:4708
- C:\Windows\System\AfNvztC.exe
  C:\Windows\System\AfNvztC.exe
  2⤵
  PID:7088
- C:\Windows\System\MrHSzZa.exe
  C:\Windows\System\MrHSzZa.exe
  2⤵
  PID:6208
- C:\Windows\System\vQDDrXZ.exe
  C:\Windows\System\vQDDrXZ.exe
  2⤵
  PID:6400
- C:\Windows\System\MJCvQQV.exe
  C:\Windows\System\MJCvQQV.exe
  2⤵
  PID:6464
- C:\Windows\System\YTurcuv.exe
  C:\Windows\System\YTurcuv.exe
  2⤵
  PID:6528
- C:\Windows\System\XcxIwsO.exe
  C:\Windows\System\XcxIwsO.exe
  2⤵
  PID:6624
- C:\Windows\System\VfMBOKB.exe
  C:\Windows\System\VfMBOKB.exe
  2⤵
  PID:6752
- C:\Windows\System\ITZrlll.exe
  C:\Windows\System\ITZrlll.exe
  2⤵
  PID:6844
- C:\Windows\System\ApHeTrP.exe
  C:\Windows\System\ApHeTrP.exe
  2⤵
  PID:6940
- C:\Windows\System\UUBtcLB.exe
  C:\Windows\System\UUBtcLB.exe
  2⤵
  PID:7008
- C:\Windows\System\hPnJcnU.exe
  C:\Windows\System\hPnJcnU.exe
  2⤵
  PID:6152
- C:\Windows\System\adjKHLU.exe
  C:\Windows\System\adjKHLU.exe
  2⤵
  PID:6384
- C:\Windows\System\tcMqMDz.exe
  C:\Windows\System\tcMqMDz.exe
  2⤵
  PID:6540
- C:\Windows\System\PiFSFcN.exe
  C:\Windows\System\PiFSFcN.exe
  2⤵
  PID:6800
- C:\Windows\System\YGuocQK.exe
  C:\Windows\System\YGuocQK.exe
  2⤵
  PID:7104
- C:\Windows\System\RrNqhlz.exe
  C:\Windows\System\RrNqhlz.exe
  2⤵
  PID:5272
- C:\Windows\System\lSWdGOA.exe
  C:\Windows\System\lSWdGOA.exe
  2⤵
  PID:6320
- C:\Windows\System\rNcwtre.exe
  C:\Windows\System\rNcwtre.exe
  2⤵
  PID:6960
- C:\Windows\System\aanrapo.exe
  C:\Windows\System\aanrapo.exe
  2⤵
  PID:6732
- C:\Windows\System\QXLAIWo.exe
  C:\Windows\System\QXLAIWo.exe
  2⤵
  PID:5444
- C:\Windows\System\KLmRAMq.exe
  C:\Windows\System\KLmRAMq.exe
  2⤵
  PID:6588
- C:\Windows\System\LJuUWei.exe
  C:\Windows\System\LJuUWei.exe
  2⤵
  PID:7004
- C:\Windows\System\iscIMCq.exe
  C:\Windows\System\iscIMCq.exe
  2⤵
  PID:6024
- C:\Windows\System\HIzTWLh.exe
  C:\Windows\System\HIzTWLh.exe
  2⤵
  PID:7124
- C:\Windows\System\FGRKGTL.exe
  C:\Windows\System\FGRKGTL.exe
  2⤵
  PID:6304
- C:\Windows\System\BDBlQoi.exe
  C:\Windows\System\BDBlQoi.exe
  2⤵
  PID:5932
- C:\Windows\System\OPCmZoX.exe
  C:\Windows\System\OPCmZoX.exe
  2⤵
  PID:4972
- C:\Windows\System\HnCbJYk.exe
  C:\Windows\System\HnCbJYk.exe
  2⤵
  PID:6460
- C:\Windows\System\JLnATJG.exe
  C:\Windows\System\JLnATJG.exe
  2⤵
  PID:6816
- C:\Windows\System\xsuiLtI.exe
  C:\Windows\System\xsuiLtI.exe
  2⤵
  PID:6976
- C:\Windows\System\BOAIgan.exe
  C:\Windows\System\BOAIgan.exe
  2⤵
  PID:6880
- C:\Windows\System\VXurvqm.exe
  C:\Windows\System\VXurvqm.exe
  2⤵
  PID:6284
- C:\Windows\System\PHoWgxF.exe
  C:\Windows\System\PHoWgxF.exe
  2⤵
  PID:6896
- C:\Windows\System\kJKXJAp.exe
  C:\Windows\System\kJKXJAp.exe
  2⤵
  PID:6476
- C:\Windows\System\NEMooJw.exe
  C:\Windows\System\NEMooJw.exe
  2⤵
  PID:5240
- C:\Windows\System\vdujDwl.exe
  C:\Windows\System\vdujDwl.exe
  2⤵
  PID:6924
- C:\Windows\System\UvnJWJc.exe
  C:\Windows\System\UvnJWJc.exe
  2⤵
  PID:6432
- C:\Windows\System\anKYyaB.exe
  C:\Windows\System\anKYyaB.exe
  2⤵
  PID:6220
- C:\Windows\System\DUErjqQ.exe
  C:\Windows\System\DUErjqQ.exe
  2⤵
  PID:5480
- C:\Windows\System\fujMoYn.exe
  C:\Windows\System\fujMoYn.exe
  2⤵
  PID:5352
- C:\Windows\System\XedKHfh.exe
  C:\Windows\System\XedKHfh.exe
  2⤵
  PID:7140
- C:\Windows\System\LsooHZx.exe
  C:\Windows\System\LsooHZx.exe
  2⤵
  PID:7120
- C:\Windows\System\Rnfbnps.exe
  C:\Windows\System\Rnfbnps.exe
  2⤵
  PID:6668
- C:\Windows\System\xWhERLq.exe
  C:\Windows\System\xWhERLq.exe
  2⤵
  PID:6828
- C:\Windows\System\TeCkwps.exe
  C:\Windows\System\TeCkwps.exe
  2⤵
  PID:7184
- C:\Windows\System\GjMNXHV.exe
  C:\Windows\System\GjMNXHV.exe
  2⤵
  PID:7200
- C:\Windows\System\LrtcByl.exe
  C:\Windows\System\LrtcByl.exe
  2⤵
  PID:7216
- C:\Windows\System\KuXmObp.exe
  C:\Windows\System\KuXmObp.exe
  2⤵
  PID:7232
- C:\Windows\System\qTJVYnD.exe
  C:\Windows\System\qTJVYnD.exe
  2⤵
  PID:7248
- C:\Windows\System\pwTyOzl.exe
  C:\Windows\System\pwTyOzl.exe
  2⤵
  PID:7264
- C:\Windows\System\HoHVgSL.exe
  C:\Windows\System\HoHVgSL.exe
  2⤵
  PID:7280
- C:\Windows\System\QEVQWgD.exe
  C:\Windows\System\QEVQWgD.exe
  2⤵
  PID:7296
- C:\Windows\System\mWwVczo.exe
  C:\Windows\System\mWwVczo.exe
  2⤵
  PID:7312
- C:\Windows\System\uDswPWL.exe
  C:\Windows\System\uDswPWL.exe
  2⤵
  PID:7328
- C:\Windows\System\scmiXaU.exe
  C:\Windows\System\scmiXaU.exe
  2⤵
  PID:7344
- C:\Windows\System\DKLNUBM.exe
  C:\Windows\System\DKLNUBM.exe
  2⤵
  PID:7360
- C:\Windows\System\vXAxbLy.exe
  C:\Windows\System\vXAxbLy.exe
  2⤵
  PID:7376
- C:\Windows\System\QUcOfpu.exe
  C:\Windows\System\QUcOfpu.exe
  2⤵
  PID:7392
- C:\Windows\System\ArkCcgy.exe
  C:\Windows\System\ArkCcgy.exe
  2⤵
  PID:7408
- C:\Windows\System\NJFKwaA.exe
  C:\Windows\System\NJFKwaA.exe
  2⤵
  PID:7424
- C:\Windows\System\FmFApAx.exe
  C:\Windows\System\FmFApAx.exe
  2⤵
  PID:7440
- C:\Windows\System\NvURmoP.exe
  C:\Windows\System\NvURmoP.exe
  2⤵
  PID:7456
- C:\Windows\System\mqTSFFP.exe
  C:\Windows\System\mqTSFFP.exe
  2⤵
  PID:7472
- C:\Windows\System\LapPMuP.exe
  C:\Windows\System\LapPMuP.exe
  2⤵
  PID:7488
- C:\Windows\System\bWRZMeu.exe
  C:\Windows\System\bWRZMeu.exe
  2⤵
  PID:7504
- C:\Windows\System\eDAoxUj.exe
  C:\Windows\System\eDAoxUj.exe
  2⤵
  PID:7520
- C:\Windows\System\kfviZhm.exe
  C:\Windows\System\kfviZhm.exe
  2⤵
  PID:7536
- C:\Windows\System\zQAhMpb.exe
  C:\Windows\System\zQAhMpb.exe
  2⤵
  PID:7552
- C:\Windows\System\hnXMamU.exe
  C:\Windows\System\hnXMamU.exe
  2⤵
  PID:7568
- C:\Windows\System\xWgvFZC.exe
  C:\Windows\System\xWgvFZC.exe
  2⤵
  PID:7584
- C:\Windows\System\kunHAZp.exe
  C:\Windows\System\kunHAZp.exe
  2⤵
  PID:7600
- C:\Windows\System\NgpXpeY.exe
  C:\Windows\System\NgpXpeY.exe
  2⤵
  PID:7616
- C:\Windows\System\sDvumNw.exe
  C:\Windows\System\sDvumNw.exe
  2⤵
  PID:7632
- C:\Windows\System\GCmmQQr.exe
  C:\Windows\System\GCmmQQr.exe
  2⤵
  PID:7648
- C:\Windows\System\cXbVqNC.exe
  C:\Windows\System\cXbVqNC.exe
  2⤵
  PID:7664
- C:\Windows\System\imGZZUA.exe
  C:\Windows\System\imGZZUA.exe
  2⤵
  PID:7680
- C:\Windows\System\jawbAek.exe
  C:\Windows\System\jawbAek.exe
  2⤵
  PID:7696
- C:\Windows\System\bjkUWwW.exe
  C:\Windows\System\bjkUWwW.exe
  2⤵
  PID:7712
- C:\Windows\System\FUfIqLd.exe
  C:\Windows\System\FUfIqLd.exe
  2⤵
  PID:7728
- C:\Windows\System\PfQKjeR.exe
  C:\Windows\System\PfQKjeR.exe
  2⤵
  PID:7744
- C:\Windows\System\SgNeuZc.exe
  C:\Windows\System\SgNeuZc.exe
  2⤵
  PID:7760
- C:\Windows\System\GTTkEfN.exe
  C:\Windows\System\GTTkEfN.exe
  2⤵
  PID:7776
- C:\Windows\System\shEPpUr.exe
  C:\Windows\System\shEPpUr.exe
  2⤵
  PID:7792
- C:\Windows\System\RZotWNO.exe
  C:\Windows\System\RZotWNO.exe
  2⤵
  PID:7808
- C:\Windows\System\CQuvAMD.exe
  C:\Windows\System\CQuvAMD.exe
  2⤵
  PID:7824
- C:\Windows\System\keeGvLU.exe
  C:\Windows\System\keeGvLU.exe
  2⤵
  PID:7840
- C:\Windows\System\vfLrRkO.exe
  C:\Windows\System\vfLrRkO.exe
  2⤵
  PID:7856
- C:\Windows\System\rznjClt.exe
  C:\Windows\System\rznjClt.exe
  2⤵
  PID:7872
- C:\Windows\System\wFurWMx.exe
  C:\Windows\System\wFurWMx.exe
  2⤵
  PID:7888
- C:\Windows\System\jxjrERa.exe
  C:\Windows\System\jxjrERa.exe
  2⤵
  PID:7904
- C:\Windows\System\QdapyYF.exe
  C:\Windows\System\QdapyYF.exe
  2⤵
  PID:7920
- C:\Windows\System\CwBCroM.exe
  C:\Windows\System\CwBCroM.exe
  2⤵
  PID:7936
- C:\Windows\System\SEkMrFr.exe
  C:\Windows\System\SEkMrFr.exe
  2⤵
  PID:7952
- C:\Windows\System\juRRPVt.exe
  C:\Windows\System\juRRPVt.exe
  2⤵
  PID:7968
- C:\Windows\System\vMADjXR.exe
  C:\Windows\System\vMADjXR.exe
  2⤵
  PID:7984
- C:\Windows\System\PmKPGKK.exe
  C:\Windows\System\PmKPGKK.exe
  2⤵
  PID:8000
- C:\Windows\System\FbhOtMb.exe
  C:\Windows\System\FbhOtMb.exe
  2⤵
  PID:8016
- C:\Windows\System\GMtvjGh.exe
  C:\Windows\System\GMtvjGh.exe
  2⤵
  PID:8032
- C:\Windows\System\IQdGxgs.exe
  C:\Windows\System\IQdGxgs.exe
  2⤵
  PID:8048
- C:\Windows\System\rcoKBrI.exe
  C:\Windows\System\rcoKBrI.exe
  2⤵
  PID:8064
- C:\Windows\System\gwxXXTL.exe
  C:\Windows\System\gwxXXTL.exe
  2⤵
  PID:8080
- C:\Windows\System\YAkWpaK.exe
  C:\Windows\System\YAkWpaK.exe
  2⤵
  PID:8096
- C:\Windows\System\FZsphwz.exe
  C:\Windows\System\FZsphwz.exe
  2⤵
  PID:8112
- C:\Windows\System\ZyGdxZa.exe
  C:\Windows\System\ZyGdxZa.exe
  2⤵
  PID:8128
- C:\Windows\System\fwtGhNj.exe
  C:\Windows\System\fwtGhNj.exe
  2⤵
  PID:8144
- C:\Windows\System\GONGdcb.exe
  C:\Windows\System\GONGdcb.exe
  2⤵
  PID:8160
- C:\Windows\System\sxZCeXq.exe
  C:\Windows\System\sxZCeXq.exe
  2⤵
  PID:8176
- C:\Windows\System\ElCpArN.exe
  C:\Windows\System\ElCpArN.exe
  2⤵
  PID:6012
- C:\Windows\System\GzyBWQU.exe
  C:\Windows\System\GzyBWQU.exe
  2⤵
  PID:5396
- C:\Windows\System\QuxxUSE.exe
  C:\Windows\System\QuxxUSE.exe
  2⤵
  PID:7224
- C:\Windows\System\dqmJpbE.exe
  C:\Windows\System\dqmJpbE.exe
  2⤵
  PID:7288
- C:\Windows\System\OTikAGu.exe
  C:\Windows\System\OTikAGu.exe
  2⤵
  PID:6396
- C:\Windows\System\vnmFISi.exe
  C:\Windows\System\vnmFISi.exe
  2⤵
  PID:7212
- C:\Windows\System\PwkYuen.exe
  C:\Windows\System\PwkYuen.exe
  2⤵
  PID:7320
- C:\Windows\System\vMhzKDN.exe
  C:\Windows\System\vMhzKDN.exe
  2⤵
  PID:7384
- C:\Windows\System\iyOuicp.exe
  C:\Windows\System\iyOuicp.exe
  2⤵
  PID:7452
- C:\Windows\System\kBdETeb.exe
  C:\Windows\System\kBdETeb.exe
  2⤵
  PID:7484
- C:\Windows\System\YLDROQg.exe
  C:\Windows\System\YLDROQg.exe
  2⤵
  PID:7548
- C:\Windows\System\MSXLYHP.exe
  C:\Windows\System\MSXLYHP.exe
  2⤵
  PID:7612
- C:\Windows\System\QMmxFXM.exe
  C:\Windows\System\QMmxFXM.exe
  2⤵
  PID:7676
- C:\Windows\System\DSRLBVp.exe
  C:\Windows\System\DSRLBVp.exe
  2⤵
  PID:7740
- C:\Windows\System\YPKtRve.exe
  C:\Windows\System\YPKtRve.exe
  2⤵
  PID:7804
- C:\Windows\System\OYLFDUd.exe
  C:\Windows\System\OYLFDUd.exe
  2⤵
  PID:6512
- C:\Windows\System\WAmQeZn.exe
  C:\Windows\System\WAmQeZn.exe
  2⤵
  PID:7272
- C:\Windows\System\zBxkiIb.exe
  C:\Windows\System\zBxkiIb.exe
  2⤵
  PID:7720
- C:\Windows\System\JiIqFGb.exe
  C:\Windows\System\JiIqFGb.exe
  2⤵
  PID:7820
- C:\Windows\System\JkHKPXW.exe
  C:\Windows\System\JkHKPXW.exe
  2⤵
  PID:7304
- C:\Windows\System\zumQuwB.exe
  C:\Windows\System\zumQuwB.exe
  2⤵
  PID:7340
- C:\Windows\System\BgYTZRo.exe
  C:\Windows\System\BgYTZRo.exe
  2⤵
  PID:7400
- C:\Windows\System\IAdGwdm.exe
  C:\Windows\System\IAdGwdm.exe
  2⤵
  PID:7896
- C:\Windows\System\qBdpGeA.exe
  C:\Windows\System\qBdpGeA.exe
  2⤵
  PID:7964
- C:\Windows\System\ZmSdwVD.exe
  C:\Windows\System\ZmSdwVD.exe
  2⤵
  PID:7500
- C:\Windows\System\DNqXtTs.exe
  C:\Windows\System\DNqXtTs.exe
  2⤵
  PID:7596
- C:\Windows\System\vbtVdqX.exe
  C:\Windows\System\vbtVdqX.exe
  2⤵
  PID:7724
- C:\Windows\System\xaCLizS.exe
  C:\Windows\System\xaCLizS.exe
  2⤵
  PID:7996
- C:\Windows\System\jnKbrwv.exe
  C:\Windows\System\jnKbrwv.exe
  2⤵
  PID:8060
- C:\Windows\System\dZWeOcD.exe
  C:\Windows\System\dZWeOcD.exe
  2⤵
  PID:8124
- C:\Windows\System\HwrsQci.exe
  C:\Windows\System\HwrsQci.exe
  2⤵
  PID:8188
- C:\Windows\System\PwxcKAY.exe
  C:\Windows\System\PwxcKAY.exe
  2⤵
  PID:6652
- C:\Windows\System\MHhkFzB.exe
  C:\Windows\System\MHhkFzB.exe
  2⤵
  PID:7416
- C:\Windows\System\yVbgztQ.exe
  C:\Windows\System\yVbgztQ.exe
  2⤵
  PID:7544
- C:\Windows\System\MKigiQv.exe
  C:\Windows\System\MKigiQv.exe
  2⤵
  PID:7672
- C:\Windows\System\LXkdAhl.exe
  C:\Windows\System\LXkdAhl.exe
  2⤵
  PID:7176
- C:\Windows\System\plhRYHT.exe
  C:\Windows\System\plhRYHT.exe
  2⤵
  PID:7816
- C:\Windows\System\naQJbey.exe
  C:\Windows\System\naQJbey.exe
  2⤵
  PID:7464
- C:\Windows\System\sKlhHMP.exe
  C:\Windows\System\sKlhHMP.exe
  2⤵
  PID:8028
- C:\Windows\System\emrBvAj.exe
  C:\Windows\System\emrBvAj.exe
  2⤵
  PID:8184
- C:\Windows\System\prYopql.exe
  C:\Windows\System\prYopql.exe
  2⤵
  PID:7644
- C:\Windows\System\qEsEOEv.exe
  C:\Windows\System\qEsEOEv.exe
  2⤵
  PID:7368
- C:\Windows\System\uhnPrdV.exe
  C:\Windows\System\uhnPrdV.exe
  2⤵
  PID:8172
- C:\Windows\System\DbRfqgY.exe
  C:\Windows\System\DbRfqgY.exe
  2⤵
  PID:6812
- C:\Windows\System\YZdSMbh.exe
  C:\Windows\System\YZdSMbh.exe
  2⤵
  PID:8168
- C:\Windows\System\OEaNuHt.exe
  C:\Windows\System\OEaNuHt.exe
  2⤵
  PID:7688
- C:\Windows\System\rkBntkL.exe
  C:\Windows\System\rkBntkL.exe
  2⤵
  PID:8200
- C:\Windows\System\qhAjerw.exe
  C:\Windows\System\qhAjerw.exe
  2⤵
  PID:8216
- C:\Windows\System\XRIqRBa.exe
  C:\Windows\System\XRIqRBa.exe
  2⤵
  PID:8232
- C:\Windows\System\sOXwhdM.exe
  C:\Windows\System\sOXwhdM.exe
  2⤵
  PID:8248
- C:\Windows\System\ZbdAFue.exe
  C:\Windows\System\ZbdAFue.exe
  2⤵
  PID:8264
- C:\Windows\System\UOYcTrx.exe
  C:\Windows\System\UOYcTrx.exe
  2⤵
  PID:8280
- C:\Windows\System\VbMaoVm.exe
  C:\Windows\System\VbMaoVm.exe
  2⤵
  PID:8296
- C:\Windows\System\CDOQzWk.exe
  C:\Windows\System\CDOQzWk.exe
  2⤵
  PID:8312
- C:\Windows\System\zfXgCCP.exe
  C:\Windows\System\zfXgCCP.exe
  2⤵
  PID:8328
- C:\Windows\System\ZqPSdDn.exe
  C:\Windows\System\ZqPSdDn.exe
  2⤵
  PID:8344
- C:\Windows\System\LjGmQzF.exe
  C:\Windows\System\LjGmQzF.exe
  2⤵
  PID:8360
- C:\Windows\System\ErxAmxd.exe
  C:\Windows\System\ErxAmxd.exe
  2⤵
  PID:8376
- C:\Windows\System\rUEkaHS.exe
  C:\Windows\System\rUEkaHS.exe
  2⤵
  PID:8392
- C:\Windows\System\ZPRrfpX.exe
  C:\Windows\System\ZPRrfpX.exe
  2⤵
  PID:8408
- C:\Windows\System\TIWIRyh.exe
  C:\Windows\System\TIWIRyh.exe
  2⤵
  PID:8424
- C:\Windows\System\aqkvPaK.exe
  C:\Windows\System\aqkvPaK.exe
  2⤵
  PID:8440
- C:\Windows\System\VwCsoMg.exe
  C:\Windows\System\VwCsoMg.exe
  2⤵
  PID:8456
- C:\Windows\System\vSCNzan.exe
  C:\Windows\System\vSCNzan.exe
  2⤵
  PID:8472
- C:\Windows\System\CQTrzFl.exe
  C:\Windows\System\CQTrzFl.exe
  2⤵
  PID:8488
- C:\Windows\System\YZLdKPA.exe
  C:\Windows\System\YZLdKPA.exe
  2⤵
  PID:8504
- C:\Windows\System\mSXTLYD.exe
  C:\Windows\System\mSXTLYD.exe
  2⤵
  PID:8520
- C:\Windows\System\RNGWNuN.exe
  C:\Windows\System\RNGWNuN.exe
  2⤵
  PID:8536
- C:\Windows\System\TuXdoqW.exe
  C:\Windows\System\TuXdoqW.exe
  2⤵
  PID:8556
- C:\Windows\System\WnXDtCz.exe
  C:\Windows\System\WnXDtCz.exe
  2⤵
  PID:8572
- C:\Windows\System\tZMABKg.exe
  C:\Windows\System\tZMABKg.exe
  2⤵
  PID:8588
- C:\Windows\System\oSxrjJq.exe
  C:\Windows\System\oSxrjJq.exe
  2⤵
  PID:8604
- C:\Windows\System\Xkfejbi.exe
  C:\Windows\System\Xkfejbi.exe
  2⤵
  PID:8620
- C:\Windows\System\KSkLNYV.exe
  C:\Windows\System\KSkLNYV.exe
  2⤵
  PID:8636
- C:\Windows\System\aVzGnOV.exe
  C:\Windows\System\aVzGnOV.exe
  2⤵
  PID:8652
- C:\Windows\System\rnzqemE.exe
  C:\Windows\System\rnzqemE.exe
  2⤵
  PID:8668
- C:\Windows\System\RBafIpg.exe
  C:\Windows\System\RBafIpg.exe
  2⤵
  PID:8684
- C:\Windows\System\GdKpsqG.exe
  C:\Windows\System\GdKpsqG.exe
  2⤵
  PID:8700
- C:\Windows\System\xKEBYMc.exe
  C:\Windows\System\xKEBYMc.exe
  2⤵
  PID:8716
- C:\Windows\System\xTIWEbf.exe
  C:\Windows\System\xTIWEbf.exe
  2⤵
  PID:8732
- C:\Windows\System\jHeuAJn.exe
  C:\Windows\System\jHeuAJn.exe
  2⤵
  PID:8748
- C:\Windows\System\VKunpoT.exe
  C:\Windows\System\VKunpoT.exe
  2⤵
  PID:8768
- C:\Windows\System\aQZXbVh.exe
  C:\Windows\System\aQZXbVh.exe
  2⤵
  PID:8788
- C:\Windows\System\byqrxDm.exe
  C:\Windows\System\byqrxDm.exe
  2⤵
  PID:8804
- C:\Windows\System\YFtZzlf.exe
  C:\Windows\System\YFtZzlf.exe
  2⤵
  PID:8824
- C:\Windows\System\ZyGXEBj.exe
  C:\Windows\System\ZyGXEBj.exe
  2⤵
  PID:8840
- C:\Windows\System\wctKjtH.exe
  C:\Windows\System\wctKjtH.exe
  2⤵
  PID:8860
- C:\Windows\System\dMAnhcV.exe
  C:\Windows\System\dMAnhcV.exe
  2⤵
  PID:8876
- C:\Windows\System\NhrhBGB.exe
  C:\Windows\System\NhrhBGB.exe
  2⤵
  PID:8896
- C:\Windows\System\OiaFQzo.exe
  C:\Windows\System\OiaFQzo.exe
  2⤵
  PID:8912
- C:\Windows\System\HxUjAjj.exe
  C:\Windows\System\HxUjAjj.exe
  2⤵
  PID:8928
- C:\Windows\System\xOYsNKa.exe
  C:\Windows\System\xOYsNKa.exe
  2⤵
  PID:8964
- C:\Windows\System\ZYJrEJO.exe
  C:\Windows\System\ZYJrEJO.exe
  2⤵
  PID:8980
- C:\Windows\System\uzOULaL.exe
  C:\Windows\System\uzOULaL.exe
  2⤵
  PID:8996
- C:\Windows\System\byvrNuY.exe
  C:\Windows\System\byvrNuY.exe
  2⤵
  PID:9012
- C:\Windows\System\vPcGhjB.exe
  C:\Windows\System\vPcGhjB.exe
  2⤵
  PID:9032
- C:\Windows\System\dpDJIRF.exe
  C:\Windows\System\dpDJIRF.exe
  2⤵
  PID:9048
- C:\Windows\System\ZrCwIME.exe
  C:\Windows\System\ZrCwIME.exe
  2⤵
  PID:9064
- C:\Windows\System\dgtopFc.exe
  C:\Windows\System\dgtopFc.exe
  2⤵
  PID:9080
- C:\Windows\System\ZmkgOFC.exe
  C:\Windows\System\ZmkgOFC.exe
  2⤵
  PID:9096
- C:\Windows\System\sJbzMpB.exe
  C:\Windows\System\sJbzMpB.exe
  2⤵
  PID:9112
- C:\Windows\System\upnFsBZ.exe
  C:\Windows\System\upnFsBZ.exe
  2⤵
  PID:9128
- C:\Windows\System\VBIzYMO.exe
  C:\Windows\System\VBIzYMO.exe
  2⤵
  PID:9148
- C:\Windows\System\JFwbfrJ.exe
  C:\Windows\System\JFwbfrJ.exe
  2⤵
  PID:9172
- C:\Windows\System\nxxEohi.exe
  C:\Windows\System\nxxEohi.exe
  2⤵
  PID:9188
- C:\Windows\System\iqghbxf.exe
  C:\Windows\System\iqghbxf.exe
  2⤵
  PID:9204
- C:\Windows\System\YSmLBHG.exe
  C:\Windows\System\YSmLBHG.exe
  2⤵
  PID:8196
- C:\Windows\System\qbcQsWU.exe
  C:\Windows\System\qbcQsWU.exe
  2⤵
  PID:8224
- C:\Windows\System\iNNoteF.exe
  C:\Windows\System\iNNoteF.exe
  2⤵
  PID:7836
- C:\Windows\System\yffUWsu.exe
  C:\Windows\System\yffUWsu.exe
  2⤵
  PID:8292
- C:\Windows\System\CHifqmN.exe
  C:\Windows\System\CHifqmN.exe
  2⤵
  PID:8324
- C:\Windows\System\BrnMJfi.exe
  C:\Windows\System\BrnMJfi.exe
  2⤵
  PID:8388
- C:\Windows\System\WbyTMpa.exe
  C:\Windows\System\WbyTMpa.exe
  2⤵
  PID:7800
- C:\Windows\System\SaTjGWt.exe
  C:\Windows\System\SaTjGWt.exe
  2⤵
  PID:7436
- C:\Windows\System\VqkibXL.exe
  C:\Windows\System\VqkibXL.exe
  2⤵
  PID:7180
- C:\Windows\System\nIvBgsC.exe
  C:\Windows\System\nIvBgsC.exe
  2⤵
  PID:7976
- C:\Windows\System\UPkEUVu.exe
  C:\Windows\System\UPkEUVu.exe
  2⤵
  PID:8012
- C:\Windows\System\KImGGex.exe
  C:\Windows\System\KImGGex.exe
  2⤵
  PID:7960
- C:\Windows\System\iVtHCRe.exe
  C:\Windows\System\iVtHCRe.exe
  2⤵
  PID:8092
- C:\Windows\System\SrruEDO.exe
  C:\Windows\System\SrruEDO.exe
  2⤵
  PID:7912
- C:\Windows\System\MKvfXGT.exe
  C:\Windows\System\MKvfXGT.exe
  2⤵
  PID:8208
- C:\Windows\System\ANisnof.exe
  C:\Windows\System\ANisnof.exe
  2⤵
  PID:7628
- C:\Windows\System\bSZdSUq.exe
  C:\Windows\System\bSZdSUq.exe
  2⤵
  PID:8432
- C:\Windows\System\ZZJrWHV.exe
  C:\Windows\System\ZZJrWHV.exe
  2⤵
  PID:8056
- C:\Windows\System\mpAHHYv.exe
  C:\Windows\System\mpAHHYv.exe
  2⤵
  PID:8276
- C:\Windows\System\kYPxGRL.exe
  C:\Windows\System\kYPxGRL.exe
  2⤵
  PID:8368
- C:\Windows\System\pCygrrO.exe
  C:\Windows\System\pCygrrO.exe
  2⤵
  PID:8480
- C:\Windows\System\wgczElw.exe
  C:\Windows\System\wgczElw.exe
  2⤵
  PID:8516
- C:\Windows\System\eEvvclL.exe
  C:\Windows\System\eEvvclL.exe
  2⤵
  PID:8584
- C:\Windows\System\kOlhper.exe
  C:\Windows\System\kOlhper.exe
  2⤵
  PID:8680
- C:\Windows\System\yIfgNru.exe
  C:\Windows\System\yIfgNru.exe
  2⤵
  PID:8532
- C:\Windows\System\IcqVKfo.exe
  C:\Windows\System\IcqVKfo.exe
  2⤵
  PID:8600
- C:\Windows\System\obiBTVx.exe
  C:\Windows\System\obiBTVx.exe
  2⤵
  PID:8856
- C:\Windows\System\RDDhPIh.exe
  C:\Windows\System\RDDhPIh.exe
  2⤵
  PID:8904
- C:\Windows\System\ZyAMqRe.exe
  C:\Windows\System\ZyAMqRe.exe
  2⤵
  PID:9040
- C:\Windows\System\ZyXSSKe.exe
  C:\Windows\System\ZyXSSKe.exe
  2⤵
  PID:8952
- C:\Windows\System\yijSgvX.exe
  C:\Windows\System\yijSgvX.exe
  2⤵
  PID:9160
- C:\Windows\System\pVFxZXH.exe
  C:\Windows\System\pVFxZXH.exe
  2⤵
  PID:9056
- C:\Windows\System\lxwSOUm.exe
  C:\Windows\System\lxwSOUm.exe
  2⤵
  PID:9164
- C:\Windows\System\ptzxEji.exe
  C:\Windows\System\ptzxEji.exe
  2⤵
  PID:7864
- C:\Windows\System\zwZoewD.exe
  C:\Windows\System\zwZoewD.exe
  2⤵
  PID:7560
- C:\Windows\System\LYaYPUo.exe
  C:\Windows\System\LYaYPUo.exe
  2⤵
  PID:8272
- C:\Windows\System\ChBOvKH.exe
  C:\Windows\System\ChBOvKH.exe
  2⤵
  PID:8356
- C:\Windows\System\QYiLIHl.exe
  C:\Windows\System\QYiLIHl.exe
  2⤵
  PID:7788
- C:\Windows\System\KXjKYYe.exe
  C:\Windows\System\KXjKYYe.exe
  2⤵
  PID:7208
- C:\Windows\System\LulioFA.exe
  C:\Windows\System\LulioFA.exe
  2⤵
  PID:8464
- C:\Windows\System\oIcWIbw.exe
  C:\Windows\System\oIcWIbw.exe
  2⤵
  PID:8580
- C:\Windows\System\vAatomI.exe
  C:\Windows\System\vAatomI.exe
  2⤵
  PID:8696
- C:\Windows\System\FiloXTA.exe
  C:\Windows\System\FiloXTA.exe
  2⤵
  PID:8660
- C:\Windows\System\gEBEeYk.exe
  C:\Windows\System\gEBEeYk.exe
  2⤵
  PID:8776
- C:\Windows\System\axxniON.exe
  C:\Windows\System\axxniON.exe
  2⤵
  PID:8812
- C:\Windows\System\EaQtXxR.exe
  C:\Windows\System\EaQtXxR.exe
  2⤵
  PID:8936
- C:\Windows\System\oZkLjyc.exe
  C:\Windows\System\oZkLjyc.exe
  2⤵
  PID:8940
- C:\Windows\System\BoUXlck.exe
  C:\Windows\System\BoUXlck.exe
  2⤵
  PID:9144
- C:\Windows\System\zqIPhfO.exe
  C:\Windows\System\zqIPhfO.exe
  2⤵
  PID:9196
- C:\Windows\System\AVWeIsy.exe
  C:\Windows\System\AVWeIsy.exe
  2⤵
  PID:8044
- C:\Windows\System\cbONEWk.exe
  C:\Windows\System\cbONEWk.exe
  2⤵
  PID:7992
- C:\Windows\System\JilagSs.exe
  C:\Windows\System\JilagSs.exe
  2⤵
  PID:8468
- C:\Windows\System\tsLbfKm.exe
  C:\Windows\System\tsLbfKm.exe
  2⤵
  PID:9184
- C:\Windows\System\ABFrTda.exe
  C:\Windows\System\ABFrTda.exe
  2⤵
  PID:9120
- C:\Windows\System\lSuHRcl.exe
  C:\Windows\System\lSuHRcl.exe
  2⤵
  PID:8552
- C:\Windows\System\prkDYEr.exe
  C:\Windows\System\prkDYEr.exe
  2⤵
  PID:8784
- C:\Windows\System\ertPCCc.exe
  C:\Windows\System\ertPCCc.exe
  2⤵
  PID:9664
- C:\Windows\System\pKMztHp.exe
  C:\Windows\System\pKMztHp.exe
  2⤵
  PID:9692
- C:\Windows\System\vYqFGDO.exe
  C:\Windows\System\vYqFGDO.exe
  2⤵
  PID:9708
- C:\Windows\System\XDxTuXX.exe
  C:\Windows\System\XDxTuXX.exe
  2⤵
  PID:9788
- C:\Windows\System\sYVmoKL.exe
  C:\Windows\System\sYVmoKL.exe
  2⤵
  PID:9836
- C:\Windows\System\cqOEVfk.exe
  C:\Windows\System\cqOEVfk.exe
  2⤵
  PID:9912
- C:\Windows\System\gPVMHHF.exe
  C:\Windows\System\gPVMHHF.exe
  2⤵
  PID:9988
- C:\Windows\System\TmeQrSj.exe
  C:\Windows\System\TmeQrSj.exe
  2⤵
  PID:10008
- C:\Windows\System\XiGGulC.exe
  C:\Windows\System\XiGGulC.exe
  2⤵
  PID:10072
- C:\Windows\System\DjBWeut.exe
  C:\Windows\System\DjBWeut.exe
  2⤵
  PID:10120
- C:\Windows\System\AiqJwoM.exe
  C:\Windows\System\AiqJwoM.exe
  2⤵
  PID:10200
- C:\Windows\System\RSukQgZ.exe
  C:\Windows\System\RSukQgZ.exe
  2⤵
  PID:10232
- C:\Windows\System\cXHxfVB.exe
  C:\Windows\System\cXHxfVB.exe
  2⤵
  PID:9088
- C:\Windows\System\ZLUoyjQ.exe
  C:\Windows\System\ZLUoyjQ.exe
  2⤵
  PID:9236
- C:\Windows\System\JAQKYHj.exe
  C:\Windows\System\JAQKYHj.exe
  2⤵
  PID:9252
- C:\Windows\System\BdNNSGV.exe
  C:\Windows\System\BdNNSGV.exe
  2⤵
  PID:9280
- C:\Windows\System\wDEnHvr.exe
  C:\Windows\System\wDEnHvr.exe
  2⤵
  PID:9300
- C:\Windows\System\Iiqotgs.exe
  C:\Windows\System\Iiqotgs.exe
  2⤵
  PID:9324
- C:\Windows\System\QhhpHdt.exe
  C:\Windows\System\QhhpHdt.exe
  2⤵
  PID:9356
- C:\Windows\System\AoCdlYp.exe
  C:\Windows\System\AoCdlYp.exe
  2⤵
  PID:9380
- C:\Windows\System\MIviylg.exe
  C:\Windows\System\MIviylg.exe
  2⤵
  PID:9412
- C:\Windows\System\bxMopbc.exe
  C:\Windows\System\bxMopbc.exe
  2⤵
  PID:9432
- C:\Windows\System\xhQlLLf.exe
  C:\Windows\System\xhQlLLf.exe
  2⤵
  PID:9348
- C:\Windows\System\OkVHLLI.exe
  C:\Windows\System\OkVHLLI.exe
  2⤵
  PID:9404
- C:\Windows\System\TCYRoJJ.exe
  C:\Windows\System\TCYRoJJ.exe
  2⤵
  PID:9536
- C:\Windows\System\GPwjCYZ.exe
  C:\Windows\System\GPwjCYZ.exe
  2⤵
  PID:9564
- C:\Windows\System\pLHFMtJ.exe
  C:\Windows\System\pLHFMtJ.exe
  2⤵
  PID:8616
- C:\Windows\System\tzKAxCq.exe
  C:\Windows\System\tzKAxCq.exe
  2⤵
  PID:8848
- C:\Windows\System\FYyxrMh.exe
  C:\Windows\System\FYyxrMh.exe
  2⤵
  PID:8800
- C:\Windows\System\dtbYLwZ.exe
  C:\Windows\System\dtbYLwZ.exe
  2⤵
  PID:8920
- C:\Windows\System\trrXYgD.exe
  C:\Windows\System\trrXYgD.exe
  2⤵
  PID:9180
- C:\Windows\System\wZikSWa.exe
  C:\Windows\System\wZikSWa.exe
  2⤵
  PID:7736
- C:\Windows\System\WMsFSio.exe
  C:\Windows\System\WMsFSio.exe
  2⤵
  PID:8072
- C:\Windows\System\ZTSVwCA.exe
  C:\Windows\System\ZTSVwCA.exe
  2⤵
  PID:9168
- C:\Windows\System\xfznAxE.exe
  C:\Windows\System\xfznAxE.exe
  2⤵
  PID:7948
- C:\Windows\System\KsfpFhR.exe
  C:\Windows\System\KsfpFhR.exe
  2⤵
  PID:8664
- C:\Windows\System\PDMOXKt.exe
  C:\Windows\System\PDMOXKt.exe
  2⤵
  PID:8756
- C:\Windows\System\Pcyhcob.exe
  C:\Windows\System\Pcyhcob.exe
  2⤵
  PID:7564
- C:\Windows\System\wFizuxT.exe
  C:\Windows\System\wFizuxT.exe
  2⤵
  PID:9684
- C:\Windows\System\pGTWQpo.exe
  C:\Windows\System\pGTWQpo.exe
  2⤵
  PID:9724
- C:\Windows\System\ssUwYOK.exe
  C:\Windows\System\ssUwYOK.exe
  2⤵
  PID:9744
- C:\Windows\System\qfySDqe.exe
  C:\Windows\System\qfySDqe.exe
  2⤵
  PID:9768
- C:\Windows\System\OZxdjmG.exe
  C:\Windows\System\OZxdjmG.exe
  2⤵
  PID:9756
- C:\Windows\System\bLVFugM.exe
  C:\Windows\System\bLVFugM.exe
  2⤵
  PID:9604
- C:\Windows\System\xEVsXjE.exe
  C:\Windows\System\xEVsXjE.exe
  2⤵
  PID:9648
- C:\Windows\System\IziOOLe.exe
  C:\Windows\System\IziOOLe.exe
  2⤵
  PID:9800
- C:\Windows\System\LGjvcpd.exe
  C:\Windows\System\LGjvcpd.exe
  2⤵
  PID:9824
- C:\Windows\System\TXiftdA.exe
  C:\Windows\System\TXiftdA.exe
  2⤵
  PID:9920
- C:\Windows\System\mKhQTyy.exe
  C:\Windows\System\mKhQTyy.exe
  2⤵
  PID:9940
- C:\Windows\System\uikBcbD.exe
  C:\Windows\System\uikBcbD.exe
  2⤵
  PID:9972
- C:\Windows\System\PBvnZBF.exe
  C:\Windows\System\PBvnZBF.exe
  2⤵
  PID:9844
- C:\Windows\System\GDmuCJa.exe
  C:\Windows\System\GDmuCJa.exe
  2⤵
  PID:10016
- C:\Windows\System\fKURbVt.exe
  C:\Windows\System\fKURbVt.exe
  2⤵
  PID:10032
- C:\Windows\System\IRHFwve.exe
  C:\Windows\System\IRHFwve.exe
  2⤵
  PID:10056
- C:\Windows\System\uUJGFYd.exe
  C:\Windows\System\uUJGFYd.exe
  2⤵
  PID:10068
- C:\Windows\System\kJsTEBf.exe
  C:\Windows\System\kJsTEBf.exe
  2⤵
  PID:10148
- C:\Windows\System\vtBvlli.exe
  C:\Windows\System\vtBvlli.exe
  2⤵
  PID:10172
- C:\Windows\System\ZZnBQfR.exe
  C:\Windows\System\ZZnBQfR.exe
  2⤵
  PID:9156
- C:\Windows\System\Aoceysu.exe
  C:\Windows\System\Aoceysu.exe
  2⤵
  PID:9968
- C:\Windows\System\zIrWGoM.exe
  C:\Windows\System\zIrWGoM.exe
  2⤵
  PID:9288
- C:\Windows\System\GeDRlwP.exe
  C:\Windows\System\GeDRlwP.exe
  2⤵
  PID:9864
- C:\Windows\System\RRvMvMm.exe
  C:\Windows\System\RRvMvMm.exe
  2⤵
  PID:9868
- C:\Windows\System\XAjfWxY.exe
  C:\Windows\System\XAjfWxY.exe
  2⤵
  PID:9340
- C:\Windows\System\RJLaPHy.exe
  C:\Windows\System\RJLaPHy.exe
  2⤵
  PID:9392
- C:\Windows\System\JQfiGPY.exe
  C:\Windows\System\JQfiGPY.exe
  2⤵
  PID:9352
- C:\Windows\System\kFYslHq.exe
  C:\Windows\System\kFYslHq.exe
  2⤵
  PID:9448
- C:\Windows\System\nMgpnBj.exe
  C:\Windows\System\nMgpnBj.exe
  2⤵
  PID:9408
- C:\Windows\System\AeKZJel.exe
  C:\Windows\System\AeKZJel.exe
  2⤵
  PID:9452
- C:\Windows\System\OznnaSd.exe
  C:\Windows\System\OznnaSd.exe
  2⤵
  PID:9580
- C:\Windows\System\EtmcCLu.exe
  C:\Windows\System\EtmcCLu.exe
  2⤵
  PID:8596
- C:\Windows\System\DucbMSR.exe
  C:\Windows\System\DucbMSR.exe
  2⤵
  PID:9104
- C:\Windows\System\hodydSS.exe
  C:\Windows\System\hodydSS.exe
  2⤵
  PID:7928
- C:\Windows\System\vPoNxnO.exe
  C:\Windows\System\vPoNxnO.exe
  2⤵
  PID:8740
- C:\Windows\System\PnLyFQk.exe
  C:\Windows\System\PnLyFQk.exe
  2⤵
  PID:2184
- C:\Windows\System\DSBpKvq.exe
  C:\Windows\System\DSBpKvq.exe
  2⤵
  PID:8136
- C:\Windows\System\KSityGW.exe
  C:\Windows\System\KSityGW.exe
  2⤵
  PID:9908
- C:\Windows\System\UKwLWjz.exe
  C:\Windows\System\UKwLWjz.exe
  2⤵
  PID:8244
- C:\Windows\System\SpvHePN.exe
  C:\Windows\System\SpvHePN.exe
  2⤵
  PID:10092
- C:\Windows\System\KuaJYHq.exe
  C:\Windows\System\KuaJYHq.exe
  2⤵
  PID:10112
- C:\Windows\System\NCJSIHF.exe
  C:\Windows\System\NCJSIHF.exe
  2⤵
  PID:10216
- C:\Windows\System\FihnhUT.exe
  C:\Windows\System\FihnhUT.exe
  2⤵
  PID:9228
- C:\Windows\System\dwxwjCp.exe
  C:\Windows\System\dwxwjCp.exe
  2⤵
  PID:9272
- C:\Windows\System\cVsGggk.exe
  C:\Windows\System\cVsGggk.exe
  2⤵
  PID:9368
- C:\Windows\System\FVGupEW.exe
  C:\Windows\System\FVGupEW.exe
  2⤵
  PID:9428
- C:\Windows\System\oDQzWkK.exe
  C:\Windows\System\oDQzWkK.exe
  2⤵
  PID:9492
- C:\Windows\System\iGsGRay.exe
  C:\Windows\System\iGsGRay.exe
  2⤵
  PID:9548
- C:\Windows\System\IhMMYql.exe
  C:\Windows\System\IhMMYql.exe
  2⤵
  PID:8836
- C:\Windows\System\oepJWJx.exe
  C:\Windows\System\oepJWJx.exe
  2⤵
  PID:8892
- C:\Windows\System\gssMeOY.exe
  C:\Windows\System\gssMeOY.exe
  2⤵
  PID:8512
- C:\Windows\System\XNoVCKq.exe
  C:\Windows\System\XNoVCKq.exe
  2⤵
  PID:8308
- C:\Windows\System\ZHdaoXy.exe
  C:\Windows\System\ZHdaoXy.exe
  2⤵
  PID:9628
- C:\Windows\System\ERAFZVi.exe
  C:\Windows\System\ERAFZVi.exe
  2⤵
  PID:9672
- C:\Windows\System\vTevUPr.exe
  C:\Windows\System\vTevUPr.exe
  2⤵
  PID:9780
- C:\Windows\System\qYoMwLN.exe
  C:\Windows\System\qYoMwLN.exe
  2⤵
  PID:9816
- C:\Windows\System\zXTJqsQ.exe
  C:\Windows\System\zXTJqsQ.exe
  2⤵
  PID:9904
- C:\Windows\System\FLYpGNZ.exe
  C:\Windows\System\FLYpGNZ.exe
  2⤵
  PID:9760
- C:\Windows\System\jHDxZBO.exe
  C:\Windows\System\jHDxZBO.exe
  2⤵
  PID:9964
- C:\Windows\System\dHOmyfF.exe
  C:\Windows\System\dHOmyfF.exe
  2⤵
  PID:9592
- C:\Windows\System\AIJSVFH.exe
  C:\Windows\System\AIJSVFH.exe
  2⤵
  PID:10160
- C:\Windows\System\ZVbaAjT.exe
  C:\Windows\System\ZVbaAjT.exe
  2⤵
  PID:9296
- C:\Windows\System\QofNdtS.exe
  C:\Windows\System\QofNdtS.exe
  2⤵
  PID:9860
- C:\Windows\System\VYSeQiv.exe
  C:\Windows\System\VYSeQiv.exe
  2⤵
  PID:8548
- C:\Windows\System\NDiKVuk.exe
  C:\Windows\System\NDiKVuk.exe
  2⤵
  PID:10192
- C:\Windows\System\NNHOBEd.exe
  C:\Windows\System\NNHOBEd.exe
  2⤵
  PID:10180
- C:\Windows\System\gYImlwq.exe
  C:\Windows\System\gYImlwq.exe
  2⤵
  PID:9576
- C:\Windows\System\xdacmcM.exe
  C:\Windows\System\xdacmcM.exe
  2⤵
  PID:9456
- C:\Windows\System\ZoeBSFd.exe
  C:\Windows\System\ZoeBSFd.exe
  2⤵
  PID:9072
- C:\Windows\System\mGUTbHC.exe
  C:\Windows\System\mGUTbHC.exe
  2⤵
  PID:7624
- C:\Windows\System\nQqLABH.exe
  C:\Windows\System\nQqLABH.exe
  2⤵
  PID:10100
- C:\Windows\System\lcUZgjQ.exe
  C:\Windows\System\lcUZgjQ.exe
  2⤵
  PID:8676
- C:\Windows\System\gOShEAn.exe
  C:\Windows\System\gOShEAn.exe
  2⤵
  PID:9484
- C:\Windows\System\TzQQpKU.exe
  C:\Windows\System\TzQQpKU.exe
  2⤵
  PID:9560
- C:\Windows\System\FyfGRNr.exe
  C:\Windows\System\FyfGRNr.exe
  2⤵
  PID:9028
- C:\Windows\System\MBHtsRk.exe
  C:\Windows\System\MBHtsRk.exe
  2⤵
  PID:9620
- C:\Windows\System\mOnpqnq.exe
  C:\Windows\System\mOnpqnq.exe
  2⤵
  PID:8888
- C:\Windows\System\KmUletm.exe
  C:\Windows\System\KmUletm.exe
  2⤵
  PID:8760
- C:\Windows\System\bPnQcDv.exe
  C:\Windows\System\bPnQcDv.exe
  2⤵
  PID:10196
- C:\Windows\System\BjfYLFN.exe
  C:\Windows\System\BjfYLFN.exe
  2⤵
  PID:9680
- C:\Windows\System\GLViMYz.exe
  C:\Windows\System\GLViMYz.exe
  2⤵
  PID:9420
- C:\Windows\System\wwdvKpC.exe
  C:\Windows\System\wwdvKpC.exe
  2⤵
  PID:9928
- C:\Windows\System\QeldHGl.exe
  C:\Windows\System\QeldHGl.exe
  2⤵
  PID:8404
- C:\Windows\System\RmoGstN.exe
  C:\Windows\System\RmoGstN.exe
  2⤵
  PID:9752
- C:\Windows\System\QcgHDaD.exe
  C:\Windows\System\QcgHDaD.exe
  2⤵
  PID:10144
- C:\Windows\System\rixbYgQ.exe
  C:\Windows\System\rixbYgQ.exe
  2⤵
  PID:9856
- C:\Windows\System\VZKHgIZ.exe
  C:\Windows\System\VZKHgIZ.exe
  2⤵
  PID:9736
- C:\Windows\System\XTTbOke.exe
  C:\Windows\System\XTTbOke.exe
  2⤵
  PID:9500
- C:\Windows\System\EFVHsdH.exe
  C:\Windows\System\EFVHsdH.exe
  2⤵
  PID:9528
- C:\Windows\System\imoncDc.exe
  C:\Windows\System\imoncDc.exe
  2⤵
  PID:9588
- C:\Windows\System\MYHLEcc.exe
  C:\Windows\System\MYHLEcc.exe
  2⤵
  PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADDuZcf.exe

Filesize
1.8MB

MD5
f70c0dbe5a89069d60d286433c3a4150

SHA1
8d350ed281dd0019f6d6825e3b48e4e89f1d7f66

SHA256
951d2cb42823a6b63b68f71e71bc68e12bcbde807d4a188edff143884dcada0e

SHA512
b9ba4bc60b11fa99980ad09f03a1aa866dd59105105b06dcc5cbcd1ea1a4e3555eeafd596c989e8177c0006a94ca8d798d2890220f7093e2d52cda2ccb3e9a66

Download Submit
C:\Windows\system\CKaOaCQ.exe

Filesize
1.8MB

MD5
61418cc8ffbd5428df999378a6774b1d

SHA1
9cd29d645d8a6dfff8b41748f0422070caa0ef8a

SHA256
7d7d689539d912bd3d8f83b8bf7da1f00e872ecffb33d5b1fd221b5aa1ff1343

SHA512
a5cd1704a9356fa3d47e883594237af248ebf85ea3dfdb3fcf49e07b72dfe182629c45a763a996dd696b3de7335aad6d8f0b110c9129e290aa4f724f5b6e5a97

Download Submit
C:\Windows\system\CUQVRYd.exe

Filesize
1.8MB

MD5
14abefe5c53dcd891aff1333e06cd227

SHA1
a8cee3ebc8cc94afef5c9cb41bfa0f50a674823d

SHA256
915c92dfb72df365460dc602e3e890013b578294f70fb73dc792641e32ecfdb9

SHA512
3402ce9c4389983442d4ac66113196c129383c6958a42b6bcee154f923b1588bd282d5f6f7f5433bcc9c06484b187df3ce066b9a028aa4bfe358ca7742f589d1

Download Submit
C:\Windows\system\DDTkgnb.exe

Filesize
1.8MB

MD5
e4828fbd5e9ee2ede4a793d22d201faa

SHA1
cff7f8f0f3a6cf8f4ec666db64d9eb87e48b1cff

SHA256
e71b05195d3fbb7a40838b8e2d008280d0841657a998e97c58e0a352b81c94e4

SHA512
10e010c22b729ac25a0b1e02e35b7a99f87914033aba2df98092ab988a36433853c4a0d7b9fb6637fc4766353113b05fc814f875ef5288079389c18de1f5b8a7

Download Submit
C:\Windows\system\DnvREAP.exe

Filesize
1.8MB

MD5
63f759fc4b13ff89c1d3b42359b36ca2

SHA1
55310a15c7edc3d73e6a6bc9a919e80c16bd074f

SHA256
6f2be18714edd376f7f307f097dbfed6fa6df13820cbccb3ad120f4148f8a06c

SHA512
434ad094247b16e238c9e9d31b0d3ea989b2e6ca6c7eaa8c4c629b904bfcf7ad499d1fd21552698aa792abca7d414273761264f151ed6abfc4fe647e85ffe2b9

Download Submit
C:\Windows\system\DpMwCCD.exe

Filesize
1.8MB

MD5
ad25d83d5ceafc64873ef8dc83ed0365

SHA1
a656a85a14bc06bc2f38982c743480e0163bece2

SHA256
cff55504f651e709f4fadb6d717789f32cec6c47ecb6bffed8a51834eab95085

SHA512
c9b98999988fa13f4f80bd6a0585c112dd5d67edc2818e68cf6ff712ab0d22f7ecb7559bd493adb5acfba4f870ee2cf8979a51bc0c26eaccf8be6a7b00bcd0ba

Download Submit
C:\Windows\system\FCOcGgf.exe

Filesize
1.8MB

MD5
b2519ccfa87b99f809fa3ffaaa219d9e

SHA1
67dd8092dae61e2843ccca806f264b1147be4962

SHA256
f5ee23eb0964476ec2f19f46a7a0b78461e61a36d07ebfa93dc2911bc59ab882

SHA512
a79eabfd31a54c8dfa741caa463f58c1f6a0682e0370e49bd26df08eea528b542a78d1e626ddb4547bf6a69ad310541b9177620f72a951c955d88960ace73e84

Download Submit
C:\Windows\system\FpfJKVu.exe

Filesize
1.8MB

MD5
07782388e2a89637b0f78970440042fb

SHA1
8a6833434a04c4b49823e053de595f3ca13fdf21

SHA256
e5ea59cc040523b318274686c4bf7e6b8d509cbe9115ad01aef5fdce1fae5ee5

SHA512
96dac0c12d93efd27ac0b617bdb510e6f53285e06a22e13425b81e6478c6ca08574841866286373cab6fb563e6f977e5829004dd6b457f400923843e55b53b74

Download Submit
C:\Windows\system\HrlUqrD.exe

Filesize
1.8MB

MD5
b0e900285f2e6bb58c5328aec9a43f05

SHA1
2fa3795aad7dbd600a02eefdfc69df7c157cb093

SHA256
084d1bff0bf23c8ba0a6fe065238225f4a44eddfb52bb01226acf586da489427

SHA512
8863f938703777816ddd278bcba73e9cd0b5331b08110f063f835c6881ef96ddfe6b0ee6a0df997af52e0f1c02dd527b21dd0d17b4090aae59e08adf364369ed

Download Submit
C:\Windows\system\IsAuEGA.exe

Filesize
1.8MB

MD5
3d670b5a63a7c3993fe597d210e2091f

SHA1
4e4fb9c9e0fca4fd8d0b1f6c182c776f1793b7a9

SHA256
c23e5da6748a3526b5b990800130976906f12247af96b84432b2004b94228654

SHA512
6b893840e460e9b71019c6e76c6693b0e9502a8e98a2abc779e84bf89909d055dadd9beb633932f246612ed98c28e4eb6b2853edc926a432873d821ffc5c77f9

Download Submit
C:\Windows\system\OKVdfYd.exe

Filesize
1.8MB

MD5
457ab74e8c8091c0c2a7db0dc7a23ca1

SHA1
1698ffdcef8e6c9c06e3876e396590f0b88b8fd6

SHA256
54d01834c5d053e6742bdf2701818ce5b73638a779843639929877141ba247f1

SHA512
ffb611cff6f4cdb653961c8969a46b2437ffe00552ce49f1f16e8b22f26a7c1128cfa6e3f2a1051cf2341da7146ae330268b82b07dafd496178ca03d05e978a8

Download Submit
C:\Windows\system\PdplRgG.exe

Filesize
1.8MB

MD5
1c926e8f8c6892e82fc717e1655a9a45

SHA1
30d2d8ba69f22dc57f2c19fa057a39e7efccd5c8

SHA256
703789e5c251f7699c5fd941e03437c9d499ba520e0b193507f8008ef5e5784f

SHA512
cb39cb859a68e117d3cbc5b343127094a75728d436a6f2b6697b36dd002eeebd158c6f7df9c6137e42525cad32b76e507b34589d574c35d687e4877c43eef54e

Download Submit
C:\Windows\system\SsyEZCA.exe

Filesize
1.8MB

MD5
e37b6841c8b2bfefcdc8db77fd3a5d5f

SHA1
9f8dc395a234ff4483b0e7272cf0fb0ffb52c717

SHA256
6bc583be85cd7daa65708bb35d08f02912d4f5d55d36e5e7e745755f6092c2e9

SHA512
dbf5cfa1a7108226886cda5f4a60e6bc1dea80e22b221c3a7cf1e1468bbf952910e48eb2038d9be262f7208cab737044874d8505552043ef4680cdaad2a9f222

Download Submit
C:\Windows\system\WOwhZqT.exe

Filesize
1.8MB

MD5
89fd027bd83ee16442da3bafb052ab27

SHA1
336c316e4735d9e8b169ca3d15b05eccf7f48483

SHA256
d522f25ac3f5b723263c59ec5539cd92d2f4c25a2956c473123402dc329eedd8

SHA512
f4a6777b7a42979979e91063bad25cca93127f0c4dfb640c13a958e32b852573e92afd434e0ec23c03579869720ad46c9b6cf358d85b48bec2a170f8c3b305b3

Download Submit
C:\Windows\system\XESSORI.exe

Filesize
1.8MB

MD5
d373a5baab08f6a3fd4354778847134f

SHA1
0d177f255b108790d5523361ce7f857150df6e18

SHA256
7641b63b30937057f4e542ac210f684c773694072e8113e659ee50776818cb93

SHA512
4389732d4bee014a7d603dab9d7edb0812debcbb907460102dfc6e4ec1c491883e40835791260577c0ef6c50a92385b5233f952fbfafe977b7e8b39ca7f6d393

Download Submit
C:\Windows\system\YxqHULr.exe

Filesize
1.8MB

MD5
03d58f2b99c52154885de011bcd20a65

SHA1
cfac4def178c2803662e1d7d25722255c0f0555c

SHA256
e19bc9e164acd1f2c125b6ee39cfd2f2044f0907feec5b0305b28298a1115e52

SHA512
2e0e2b15af19fc1c7c2ec1cbc945da10ba418924ab8414cce20730222e1d6c0002403986ccec20951f4ac09e512c0d8e287e326f61588fe9b9e7e11381c03184

Download Submit
C:\Windows\system\gkZwTIW.exe

Filesize
1.8MB

MD5
484dae365e193bd265d5a51f8c7fdb93

SHA1
23bcf660dd44b7638ca04105ae7d2668f49483d1

SHA256
c16ae5a87d4ea0bbd83ebd1862f637642a66b7e823fd59d4fc36f83f330e9835

SHA512
1ff6b9bff5cabe841a8206fe2e60d07605e415f3c5c6d9b16e7e4a54164beba3d79d2a6524466790e6a900c7213e54da4c4ab50b19630809160cad57a4c6ab48

Download Submit
C:\Windows\system\pBctwyz.exe

Filesize
1.8MB

MD5
607a83c29c2e74ac16c53d66ca14258a

SHA1
5a8822fa0a9ebc11bb45768505264f66441f73b1

SHA256
87197826a5d42e153aa5c3d9fb0331ebf17cef8ca5eba9bee14d2e7e1c0a21f4

SHA512
c7fa57e1f35c1c233e1c28a3376f79675f170f500df0ad61fd113bd6f73d1faa6cca25cb01f379422fa4d610476df34ae37eec550a2fdc5a2d85916c4de1a102

Download Submit
C:\Windows\system\qnLlpti.exe

Filesize
1.8MB

MD5
98158405f2894c62289473ef0d725dea

SHA1
5148bfb7c12f56b2516b0a94664c628559d72636

SHA256
bb6e3e582e76d5cc34e031cc9d0be8a8f20241abfe050102459e71e8cd341ea5

SHA512
42d7a87e20f444745fa6537d960cb8fe7bfaaba2460aa615eb3c7e9c8dd2f0f67ae5740c9f1f5379e7e88bfa88e3b0a7bc414ab3decb395ace9e39421c4d1457

Download Submit
C:\Windows\system\rspbLAC.exe

Filesize
1.8MB

MD5
4fcdfe338a3e1f25e8c697fb5a4b3cd9

SHA1
95338124c25f3b9fb025f9487481d68ec223d80e

SHA256
9e38f1861b19cd7d831f17221357678a6ec67e5a6dd218f386009e4208347a73

SHA512
f4798fe7ba03a81eb94a8c8ccfd47410c69387444f2cd866f7005c4a0678ce94a34a03c3e7f459eb6c558e0a5730dd8060c99b75ce0390c47110470336e3e05d

Download Submit
C:\Windows\system\tLvQUCo.exe

Filesize
1.8MB

MD5
cf33028444d18c5e27acff9225c2f8bc

SHA1
3309bb8c62ab47f29831e8422f282ae367b4f34e

SHA256
e5fa2a35bb9f156f482173472f22573cb68a6c50d9148254914ddcab98797d30

SHA512
56ee7d5d8e69f99de2186ebda53f67b71748bdbb789c5e940199c348f3c5250d5a501551c0bd9c35c2b6a9928a0a17ba4bad98831e500c786c35140a1d5e369e

Download Submit
C:\Windows\system\vQWXhbb.exe

Filesize
1.8MB

MD5
046b0468d37c6be27a7f6c36fdcfcf43

SHA1
cbe6e46d319bb564f67d58d336add274223d1c18

SHA256
45c838c76c75c01b079eefe5d3b61b24f5d1bab7a3a1fc0e1d3ac1b295590849

SHA512
8b3335c30c142fd969fcf321c9e238383e4b3bbf56fad0f0c820bd6568fa1a71cd59c22eb6b6457e9b51e5cc530d53b14ed0cd7382ae909c3e3874101026c4b1

Download Submit
C:\Windows\system\wtyLOMr.exe

Filesize
1.8MB

MD5
4ebde0e492cfc2f2484e77ef068b82e4

SHA1
6efea809771314f1d0f9a3cb7fb13d083a700556

SHA256
36edaa3a97611bca7072a15b64351d10a8fe3a4f236d5aef18168576d617df29

SHA512
808d3c35cd2e505bac9efb4337bc18a44d2518a9a5e12bb2e532e55e7600ec27ffe888c878e45b647fa3a1a3968aebd6a09b4c3ca669169325133a9b2551ef97

Download Submit
C:\Windows\system\wzuqTEj.exe

Filesize
1.8MB

MD5
00923bf9f8a8f44b1399140d95f8cbba

SHA1
5d3e161ba20cac4682458e91d46bb483d880f80d

SHA256
6f2df75e8913e57e7cfc4ff9fe1a58331ab42b8694cd404ec5dd222f3df7e0b5

SHA512
520234be4cd014074fd5852ab005aaec3a88e216e3ceba82fd679037fd8b438fdb907f184a27a3660ad404c2132ea84405d61aeb147257653bfd26e8e0b8a335

Download Submit
C:\Windows\system\xKcXUQx.exe

Filesize
1.8MB

MD5
e94920e4f86f2bbac1e79d77a112270e

SHA1
3331779d2f19062498f7e16091484bb7567cfee9

SHA256
4fab8c39ac5a21b791371f3f50e9668c03eef4ca74d28be5bbb4331cdb47725f

SHA512
c559627ee92b20c90ef31af241c91a5de83411f252304333d6d5662fb7720c470742ea727fc1cc02a481cc7fcaf3fa903e9944d0b9c5a0d88b0fc4d88218e9ef

Download Submit
C:\Windows\system\yPWWwVL.exe

Filesize
1.8MB

MD5
ac89838c75fe7c16e79d017ddcceac53

SHA1
078bbde472116ef27f539aa24398ee84a761218c

SHA256
8e0b583ff41d36ca5d5d221debde5ae244a3c891789c90cc896459f87049118e

SHA512
2d05ccb2f64caec025ae39c84c5156574900231928f6a13971aec3c9c8d4a4225ec89e9f3a000c8f2551ec15a426b277f3357e93f78db8f4ce4fbfabe8bac981

Download Submit
\Windows\system\AxjhlWZ.exe

Filesize
1.8MB

MD5
7ba01239a5fff22191ed4a9569cb62d2

SHA1
1b5f7483b56f9c6670e7cc57b1526bc4af47a0ca

SHA256
8112c8f819758ad31f031c6c802c1ed1650c0cd308e38aab06baa957351eccdb

SHA512
6a6366c364465ff1b85ae100e9144337aee7367f44e4f6ed61a95c801a6f95bffb3bb8ef032f5e1e722dbc283b8fbd35eb1208a6381196cd88369f536c756582

Download Submit
\Windows\system\NMHHbPT.exe

Filesize
1.8MB

MD5
5b3574b49ea98897bc5edccc0c405919

SHA1
f746583393541462c1a096c24f1907e9a153eaf1

SHA256
68df0d3837bfa6ab029af3d3d683a49a9280143317625d118ed81068ad61db61

SHA512
bd57a675fa83ce530442bb2fc3d1a3fd4579034f1b09e593e3c36dfed7c1c6531588b622abff262086b56103d0bfc1515a543d66a2299b1146779521d7414532

Download Submit
\Windows\system\auLwhBs.exe

Filesize
1.8MB

MD5
cd34f1fa0a428e4ee170f0d8aa83e0cf

SHA1
22688045aaad858e92e13ffb240b470b060d0d9b

SHA256
572f83a0beb9c3b59d102bc13d2a5633fee379324baa4b76527c75bee604fa8a

SHA512
7c04c23425b73e3850486208ca90e56832a922ff33ad2998c789f45e3f298b2c744bc8cf0ad68105bf6e5f85c2f13954e57e1f52a2b69ca9f5bc76b2a03d47b0

Download Submit
\Windows\system\glhcmyq.exe

Filesize
1.8MB

MD5
091b2835581811a0f6e3094639d7f3f2

SHA1
35128395d96f3813920550ba5f9316130347afc2

SHA256
5caea303dc1a1a5b46252c23354961a35bed6519d98387a53474c2b7db1f5733

SHA512
c43fdbb3ace10e3d3a592e5f4dff0811f76b141079fd3fe71c41efb6bb24bb0d5d86f157440cad9bc264ea12b15bad349d5866c0708b78040e8422b51e4e982a

Download Submit
\Windows\system\iCCkFBv.exe

Filesize
1.8MB

MD5
c9ee900597ad8a20cc65393ce263f8d0

SHA1
5f6353f9b0a23b60c2ea84137102ac9695185540

SHA256
6a74363648ec2f8a9aba7b821d7dc155418a15d07df3cd81d9b39901c22e20f1

SHA512
0fdbf57c14a9d6c31d32691a33b555ca9e68c799c9a3d581987fc4e5ae757827cba7890a778218ecb48eb61388a02202411c3e9d776e589433f2667f99637c41

Download Submit
\Windows\system\zcBFfYr.exe

Filesize
1.8MB

MD5
513efae965b8e0bf1c6422f98978fae8

SHA1
29d48dba43b35d47e71ff39dfbdc6f5358621942

SHA256
fb183e2e6a726ae79581832f7f94d8c7add24075e49b03e79a4498ee6ce30c9e

SHA512
1b55c424d0da8a91000f74d03bd450ebfee141d4598e0349cab3db98f00afbf43435b53ac655d71a8b4e9f746aaab542ddde4a2dbd810dafe0404f927b698bd3

Download Submit
memory/2692-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download