xmrig | 3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
Size

1.9MB
MD5

792032b96a44b346d0b2a715a160e46b
SHA1

08866c578cb7811830c7d8abb35f8e57b7cb4eab
SHA256

3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4
SHA512

1033471eddccb27b8293a5376d696cd6557f562907b8b0ad94c0445e8ff10e17d1abb0db45332034904bcb64986b30836f7b8871836736cf8566a00f4c12c1a0
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7eqTVXT:GemTLkNdfE0pZyu

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012117-5.dat	xmrig
behavioral1/files/0x0007000000015cdc-11.dat	xmrig
behavioral1/files/0x00060000000173a9-159.dat	xmrig
behavioral1/files/0x00060000000173a7-154.dat	xmrig
behavioral1/files/0x00060000000171a8-149.dat	xmrig
behavioral1/files/0x0006000000017079-143.dat	xmrig
behavioral1/files/0x0006000000016fdf-139.dat	xmrig
behavioral1/files/0x0006000000016d6d-129.dat	xmrig
behavioral1/files/0x0006000000016d89-133.dat	xmrig
behavioral1/files/0x0006000000016d64-119.dat	xmrig
behavioral1/files/0x0006000000016d68-124.dat	xmrig
behavioral1/files/0x0006000000016d5e-114.dat	xmrig
behavioral1/files/0x0006000000016d4a-109.dat	xmrig
behavioral1/files/0x0006000000016d42-104.dat	xmrig
behavioral1/files/0x0006000000016d3a-99.dat	xmrig
behavioral1/files/0x0006000000016d31-94.dat	xmrig
behavioral1/files/0x0006000000016d29-89.dat	xmrig
behavioral1/files/0x0006000000016d21-84.dat	xmrig
behavioral1/files/0x0006000000016d18-79.dat	xmrig
behavioral1/files/0x0006000000016d0e-74.dat	xmrig
behavioral1/files/0x0006000000016d06-69.dat	xmrig
behavioral1/files/0x0006000000016cec-64.dat	xmrig
behavioral1/files/0x0006000000016cc8-59.dat	xmrig
behavioral1/files/0x0006000000016c9d-54.dat	xmrig
behavioral1/files/0x0006000000016c51-49.dat	xmrig
behavioral1/files/0x0007000000016c4a-44.dat	xmrig
behavioral1/files/0x0008000000015d78-40.dat	xmrig
behavioral1/files/0x0009000000015d1a-34.dat	xmrig
behavioral1/files/0x0007000000015d03-28.dat	xmrig
behavioral1/files/0x0007000000015ce4-16.dat	xmrig
behavioral1/files/0x0008000000015cd0-9.dat	xmrig
behavioral1/files/0x0007000000015cf1-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2984	MgJeplS.exe
3032	GBJSLsl.exe
2412	WVJybSf.exe
2520	RWRYQWf.exe
1328	HORidxp.exe
2168	TuPDKYC.exe
2300	MJVMamg.exe
2748	TascPnD.exe
2836	bZkkDlQ.exe
2772	fSEBaEU.exe
2624	bslvyhJ.exe
2892	FMXgLDG.exe
2644	wTdXslM.exe
2880	YILeStg.exe
1056	YnkFnzT.exe
2632	uFMErNv.exe
2740	iQfhrYZ.exe
2176	NHigtGR.exe
2660	oYiXZuh.exe
1632	waXPrck.exe
2688	CjuAwwT.exe
1828	mKwGwBt.exe
1832	IrhEyxp.exe
2088	DWimaZU.exe
1860	tRsbcqb.exe
2944	UCWvraj.exe
2936	XSaVPkl.exe
2144	iuWejdV.exe
1088	XRQzEIy.exe
1688	VCMFiNY.exe
1360	SUPXDgl.exe
2932	nfLYbGK.exe
2028	HOTCoDg.exe
1624	aunHQhj.exe
2032	ELNrqIq.exe
776	KPWBnrp.exe
532	AYwwQOc.exe
2720	CQXVcJX.exe
584	BFceZoJ.exe
740	SVFxEmd.exe
1352	CKzPBOl.exe
656	ZyafSOj.exe
2072	FZdLuoW.exe
808	GzBQaDO.exe
2332	VoztbNR.exe
1768	VSLthBP.exe
1844	OYkwSKi.exe
2284	XbvxSCB.exe
1496	TBifFJL.exe
2456	HjQlxTh.exe
1232	hyeOHYM.exe
2188	BKlJHBV.exe
2320	qVseqkj.exe
2232	pSxGXcN.exe
1656	bUJaDAG.exe
1716	rbvoTCW.exe
2528	HUWhWqn.exe
2404	OhOtgoH.exe
2112	yGZehDf.exe
264	PAvgawo.exe
2824	OZBGSwL.exe
2988	vttVCzM.exe
2652	JPRUMhb.exe
2656	VdFiQka.exe

Loads dropped DLL 64 IoCs

pid	Process
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MubPZUz.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\XkvBKji.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\OhHotYS.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\djeKnWI.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\voEgTqf.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\lYyGyka.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\cYYGihX.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\NHigtGR.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\cSxFnxL.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\QBGeqkP.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\geTAfTu.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\XGKAXaX.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\OxsGzRD.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\yVguSuu.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\PkGhSIQ.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\TEubCDI.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\VYhunQu.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\rugnOdR.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\CdOfYiG.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\AENdgIs.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\FRUjLxV.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\wTdXslM.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\oYiXZuh.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\qGJkaoF.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\aZYvfua.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\mpkGkiG.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\LqpcuXS.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\shhACaR.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\TuPDKYC.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\DECEQqi.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\GTIGLSM.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\XZudVbm.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\Sodcyom.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\HotmmIl.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\eIfzoIL.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\qvyheDk.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\YIasVnK.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\aQCpFBr.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\JCZbzwY.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\sJxbkMM.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\tMjCZfu.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\eiXbKfS.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\YBxWzAp.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\cQAzOtu.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\Gmwfyfe.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\pOEDLTJ.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\fxXQrvy.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\ODPsYor.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\mpMBPMp.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\WvHOzVm.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\pJYdvAq.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\EVHEFOZ.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\KVOAxNV.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\dtyCHey.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\wCODdUX.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\UWhHpXT.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\rvTBGVV.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\XevubQf.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\MIZvBwL.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\gZgrfiO.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\hkblZsI.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\KZedybP.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\HOTCoDg.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
File created	C:\Windows\System\yawvnlv.exe	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2984	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	31
PID 2368 wrote to memory of 2984	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	31
PID 2368 wrote to memory of 2984	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	31
PID 2368 wrote to memory of 3032	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	32
PID 2368 wrote to memory of 3032	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	32
PID 2368 wrote to memory of 3032	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	32
PID 2368 wrote to memory of 2412	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	33
PID 2368 wrote to memory of 2412	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	33
PID 2368 wrote to memory of 2412	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	33
PID 2368 wrote to memory of 1328	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	34
PID 2368 wrote to memory of 1328	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	34
PID 2368 wrote to memory of 1328	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	34
PID 2368 wrote to memory of 2520	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	35
PID 2368 wrote to memory of 2520	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	35
PID 2368 wrote to memory of 2520	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	35
PID 2368 wrote to memory of 2168	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	36
PID 2368 wrote to memory of 2168	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	36
PID 2368 wrote to memory of 2168	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	36
PID 2368 wrote to memory of 2300	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	37
PID 2368 wrote to memory of 2300	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	37
PID 2368 wrote to memory of 2300	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	37
PID 2368 wrote to memory of 2748	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	38
PID 2368 wrote to memory of 2748	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	38
PID 2368 wrote to memory of 2748	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	38
PID 2368 wrote to memory of 2836	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	39
PID 2368 wrote to memory of 2836	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	39
PID 2368 wrote to memory of 2836	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	39
PID 2368 wrote to memory of 2772	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	40
PID 2368 wrote to memory of 2772	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	40
PID 2368 wrote to memory of 2772	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	40
PID 2368 wrote to memory of 2624	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	41
PID 2368 wrote to memory of 2624	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	41
PID 2368 wrote to memory of 2624	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	41
PID 2368 wrote to memory of 2892	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	42
PID 2368 wrote to memory of 2892	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	42
PID 2368 wrote to memory of 2892	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	42
PID 2368 wrote to memory of 2644	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	43
PID 2368 wrote to memory of 2644	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	43
PID 2368 wrote to memory of 2644	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	43
PID 2368 wrote to memory of 2880	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	44
PID 2368 wrote to memory of 2880	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	44
PID 2368 wrote to memory of 2880	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	44
PID 2368 wrote to memory of 1056	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	45
PID 2368 wrote to memory of 1056	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	45
PID 2368 wrote to memory of 1056	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	45
PID 2368 wrote to memory of 2632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	46
PID 2368 wrote to memory of 2632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	46
PID 2368 wrote to memory of 2632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	46
PID 2368 wrote to memory of 2740	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	47
PID 2368 wrote to memory of 2740	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	47
PID 2368 wrote to memory of 2740	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	47
PID 2368 wrote to memory of 2176	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	48
PID 2368 wrote to memory of 2176	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	48
PID 2368 wrote to memory of 2176	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	48
PID 2368 wrote to memory of 2660	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	49
PID 2368 wrote to memory of 2660	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	49
PID 2368 wrote to memory of 2660	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	49
PID 2368 wrote to memory of 1632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	50
PID 2368 wrote to memory of 1632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	50
PID 2368 wrote to memory of 1632	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	50
PID 2368 wrote to memory of 2688	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	51
PID 2368 wrote to memory of 2688	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	51
PID 2368 wrote to memory of 2688	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	51
PID 2368 wrote to memory of 1828	2368	3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe	52

C:\Users\Admin\AppData\Local\Temp\3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe
"C:\Users\Admin\AppData\Local\Temp\3076a1c60676698d9a46c15e1e12b0b2a9f7b30b0a6665e5aef428c4d682fab4.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System\MgJeplS.exe
  C:\Windows\System\MgJeplS.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\GBJSLsl.exe
  C:\Windows\System\GBJSLsl.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\WVJybSf.exe
  C:\Windows\System\WVJybSf.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\HORidxp.exe
  C:\Windows\System\HORidxp.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\RWRYQWf.exe
  C:\Windows\System\RWRYQWf.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\TuPDKYC.exe
  C:\Windows\System\TuPDKYC.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\MJVMamg.exe
  C:\Windows\System\MJVMamg.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\TascPnD.exe
  C:\Windows\System\TascPnD.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\bZkkDlQ.exe
  C:\Windows\System\bZkkDlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\fSEBaEU.exe
  C:\Windows\System\fSEBaEU.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\bslvyhJ.exe
  C:\Windows\System\bslvyhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\FMXgLDG.exe
  C:\Windows\System\FMXgLDG.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\wTdXslM.exe
  C:\Windows\System\wTdXslM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\YILeStg.exe
  C:\Windows\System\YILeStg.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\YnkFnzT.exe
  C:\Windows\System\YnkFnzT.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\uFMErNv.exe
  C:\Windows\System\uFMErNv.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\iQfhrYZ.exe
  C:\Windows\System\iQfhrYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\NHigtGR.exe
  C:\Windows\System\NHigtGR.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\oYiXZuh.exe
  C:\Windows\System\oYiXZuh.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\waXPrck.exe
  C:\Windows\System\waXPrck.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\CjuAwwT.exe
  C:\Windows\System\CjuAwwT.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\mKwGwBt.exe
  C:\Windows\System\mKwGwBt.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\IrhEyxp.exe
  C:\Windows\System\IrhEyxp.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\DWimaZU.exe
  C:\Windows\System\DWimaZU.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\tRsbcqb.exe
  C:\Windows\System\tRsbcqb.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\UCWvraj.exe
  C:\Windows\System\UCWvraj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\XSaVPkl.exe
  C:\Windows\System\XSaVPkl.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\iuWejdV.exe
  C:\Windows\System\iuWejdV.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\XRQzEIy.exe
  C:\Windows\System\XRQzEIy.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\VCMFiNY.exe
  C:\Windows\System\VCMFiNY.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\SUPXDgl.exe
  C:\Windows\System\SUPXDgl.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\nfLYbGK.exe
  C:\Windows\System\nfLYbGK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\HOTCoDg.exe
  C:\Windows\System\HOTCoDg.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\aunHQhj.exe
  C:\Windows\System\aunHQhj.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ELNrqIq.exe
  C:\Windows\System\ELNrqIq.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\KPWBnrp.exe
  C:\Windows\System\KPWBnrp.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\AYwwQOc.exe
  C:\Windows\System\AYwwQOc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\CQXVcJX.exe
  C:\Windows\System\CQXVcJX.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\BFceZoJ.exe
  C:\Windows\System\BFceZoJ.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\SVFxEmd.exe
  C:\Windows\System\SVFxEmd.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\CKzPBOl.exe
  C:\Windows\System\CKzPBOl.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ZyafSOj.exe
  C:\Windows\System\ZyafSOj.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\FZdLuoW.exe
  C:\Windows\System\FZdLuoW.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GzBQaDO.exe
  C:\Windows\System\GzBQaDO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\VoztbNR.exe
  C:\Windows\System\VoztbNR.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\VSLthBP.exe
  C:\Windows\System\VSLthBP.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\OYkwSKi.exe
  C:\Windows\System\OYkwSKi.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\XbvxSCB.exe
  C:\Windows\System\XbvxSCB.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\TBifFJL.exe
  C:\Windows\System\TBifFJL.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\HjQlxTh.exe
  C:\Windows\System\HjQlxTh.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hyeOHYM.exe
  C:\Windows\System\hyeOHYM.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\BKlJHBV.exe
  C:\Windows\System\BKlJHBV.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\qVseqkj.exe
  C:\Windows\System\qVseqkj.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\pSxGXcN.exe
  C:\Windows\System\pSxGXcN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\bUJaDAG.exe
  C:\Windows\System\bUJaDAG.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\rbvoTCW.exe
  C:\Windows\System\rbvoTCW.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\HUWhWqn.exe
  C:\Windows\System\HUWhWqn.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\OhOtgoH.exe
  C:\Windows\System\OhOtgoH.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\yGZehDf.exe
  C:\Windows\System\yGZehDf.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\PAvgawo.exe
  C:\Windows\System\PAvgawo.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\OZBGSwL.exe
  C:\Windows\System\OZBGSwL.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\vttVCzM.exe
  C:\Windows\System\vttVCzM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\JPRUMhb.exe
  C:\Windows\System\JPRUMhb.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\VdFiQka.exe
  C:\Windows\System\VdFiQka.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\RmMPNUu.exe
  C:\Windows\System\RmMPNUu.exe
  2⤵
  PID:2612
- C:\Windows\System\rCydktM.exe
  C:\Windows\System\rCydktM.exe
  2⤵
  PID:2696
- C:\Windows\System\WnenYWH.exe
  C:\Windows\System\WnenYWH.exe
  2⤵
  PID:2116
- C:\Windows\System\AyxJBGm.exe
  C:\Windows\System\AyxJBGm.exe
  2⤵
  PID:980
- C:\Windows\System\yjygtkv.exe
  C:\Windows\System\yjygtkv.exe
  2⤵
  PID:2812
- C:\Windows\System\qvyheDk.exe
  C:\Windows\System\qvyheDk.exe
  2⤵
  PID:1912
- C:\Windows\System\XerQgHh.exe
  C:\Windows\System\XerQgHh.exe
  2⤵
  PID:1528
- C:\Windows\System\rfNOLGJ.exe
  C:\Windows\System\rfNOLGJ.exe
  2⤵
  PID:2940
- C:\Windows\System\ollMADt.exe
  C:\Windows\System\ollMADt.exe
  2⤵
  PID:1412
- C:\Windows\System\wCODdUX.exe
  C:\Windows\System\wCODdUX.exe
  2⤵
  PID:860
- C:\Windows\System\vDJYghN.exe
  C:\Windows\System\vDJYghN.exe
  2⤵
  PID:2316
- C:\Windows\System\kncAvUL.exe
  C:\Windows\System\kncAvUL.exe
  2⤵
  PID:2572
- C:\Windows\System\nrJNxRS.exe
  C:\Windows\System\nrJNxRS.exe
  2⤵
  PID:2460
- C:\Windows\System\djSCxuV.exe
  C:\Windows\System\djSCxuV.exe
  2⤵
  PID:2448
- C:\Windows\System\ZYJeDpL.exe
  C:\Windows\System\ZYJeDpL.exe
  2⤵
  PID:1188
- C:\Windows\System\McvMyTX.exe
  C:\Windows\System\McvMyTX.exe
  2⤵
  PID:2256
- C:\Windows\System\TtOoBKP.exe
  C:\Windows\System\TtOoBKP.exe
  2⤵
  PID:1800
- C:\Windows\System\vgdWWoc.exe
  C:\Windows\System\vgdWWoc.exe
  2⤵
  PID:568
- C:\Windows\System\MAConsM.exe
  C:\Windows\System\MAConsM.exe
  2⤵
  PID:1184
- C:\Windows\System\WDQGvLg.exe
  C:\Windows\System\WDQGvLg.exe
  2⤵
  PID:2100
- C:\Windows\System\LXcGzEX.exe
  C:\Windows\System\LXcGzEX.exe
  2⤵
  PID:1044
- C:\Windows\System\MnqBZAU.exe
  C:\Windows\System\MnqBZAU.exe
  2⤵
  PID:1048
- C:\Windows\System\UkkKSfN.exe
  C:\Windows\System\UkkKSfN.exe
  2⤵
  PID:1264
- C:\Windows\System\cCYgeLr.exe
  C:\Windows\System\cCYgeLr.exe
  2⤵
  PID:1616
- C:\Windows\System\SgyCbTr.exe
  C:\Windows\System\SgyCbTr.exe
  2⤵
  PID:3024
- C:\Windows\System\DuWQLEK.exe
  C:\Windows\System\DuWQLEK.exe
  2⤵
  PID:2172
- C:\Windows\System\eViySZu.exe
  C:\Windows\System\eViySZu.exe
  2⤵
  PID:1544
- C:\Windows\System\eyzhmCZ.exe
  C:\Windows\System\eyzhmCZ.exe
  2⤵
  PID:2752
- C:\Windows\System\YxGQZFh.exe
  C:\Windows\System\YxGQZFh.exe
  2⤵
  PID:2780
- C:\Windows\System\eRLFzik.exe
  C:\Windows\System\eRLFzik.exe
  2⤵
  PID:2672
- C:\Windows\System\yHwPFRu.exe
  C:\Windows\System\yHwPFRu.exe
  2⤵
  PID:2628
- C:\Windows\System\OAjCYGR.exe
  C:\Windows\System\OAjCYGR.exe
  2⤵
  PID:2000
- C:\Windows\System\NIzMdXu.exe
  C:\Windows\System\NIzMdXu.exe
  2⤵
  PID:1708
- C:\Windows\System\LQtFHhg.exe
  C:\Windows\System\LQtFHhg.exe
  2⤵
  PID:2276
- C:\Windows\System\BezMdqp.exe
  C:\Windows\System\BezMdqp.exe
  2⤵
  PID:1152
- C:\Windows\System\nKeWEws.exe
  C:\Windows\System\nKeWEws.exe
  2⤵
  PID:900
- C:\Windows\System\rgQJgvp.exe
  C:\Windows\System\rgQJgvp.exe
  2⤵
  PID:2052
- C:\Windows\System\MdupMFW.exe
  C:\Windows\System\MdupMFW.exe
  2⤵
  PID:3088
- C:\Windows\System\qIAuOEJ.exe
  C:\Windows\System\qIAuOEJ.exe
  2⤵
  PID:3108
- C:\Windows\System\vqTTavT.exe
  C:\Windows\System\vqTTavT.exe
  2⤵
  PID:3128
- C:\Windows\System\VYOPkeW.exe
  C:\Windows\System\VYOPkeW.exe
  2⤵
  PID:3148
- C:\Windows\System\FcDWdKH.exe
  C:\Windows\System\FcDWdKH.exe
  2⤵
  PID:3168
- C:\Windows\System\cCRBAkm.exe
  C:\Windows\System\cCRBAkm.exe
  2⤵
  PID:3184
- C:\Windows\System\nUsUFDP.exe
  C:\Windows\System\nUsUFDP.exe
  2⤵
  PID:3208
- C:\Windows\System\OtgLhwb.exe
  C:\Windows\System\OtgLhwb.exe
  2⤵
  PID:3224
- C:\Windows\System\MLkmLZY.exe
  C:\Windows\System\MLkmLZY.exe
  2⤵
  PID:3248
- C:\Windows\System\jEzknVn.exe
  C:\Windows\System\jEzknVn.exe
  2⤵
  PID:3268
- C:\Windows\System\MdZWZHW.exe
  C:\Windows\System\MdZWZHW.exe
  2⤵
  PID:3288
- C:\Windows\System\HJacDYm.exe
  C:\Windows\System\HJacDYm.exe
  2⤵
  PID:3308
- C:\Windows\System\tEwSwiv.exe
  C:\Windows\System\tEwSwiv.exe
  2⤵
  PID:3328
- C:\Windows\System\RjAvIQh.exe
  C:\Windows\System\RjAvIQh.exe
  2⤵
  PID:3344
- C:\Windows\System\zvrKIUn.exe
  C:\Windows\System\zvrKIUn.exe
  2⤵
  PID:3368
- C:\Windows\System\iMlpFMP.exe
  C:\Windows\System\iMlpFMP.exe
  2⤵
  PID:3384
- C:\Windows\System\nXYwlkC.exe
  C:\Windows\System\nXYwlkC.exe
  2⤵
  PID:3404
- C:\Windows\System\smWJGlZ.exe
  C:\Windows\System\smWJGlZ.exe
  2⤵
  PID:3424
- C:\Windows\System\yYHlkHz.exe
  C:\Windows\System\yYHlkHz.exe
  2⤵
  PID:3440
- C:\Windows\System\imakgWb.exe
  C:\Windows\System\imakgWb.exe
  2⤵
  PID:3464
- C:\Windows\System\sQOjAhI.exe
  C:\Windows\System\sQOjAhI.exe
  2⤵
  PID:3484
- C:\Windows\System\XAcAgIB.exe
  C:\Windows\System\XAcAgIB.exe
  2⤵
  PID:3504
- C:\Windows\System\QyuDUcr.exe
  C:\Windows\System\QyuDUcr.exe
  2⤵
  PID:3520
- C:\Windows\System\clhKBfZ.exe
  C:\Windows\System\clhKBfZ.exe
  2⤵
  PID:3544
- C:\Windows\System\OijtnnM.exe
  C:\Windows\System\OijtnnM.exe
  2⤵
  PID:3560
- C:\Windows\System\tmaSTbm.exe
  C:\Windows\System\tmaSTbm.exe
  2⤵
  PID:3584
- C:\Windows\System\PloaObi.exe
  C:\Windows\System\PloaObi.exe
  2⤵
  PID:3600
- C:\Windows\System\HrlXzoa.exe
  C:\Windows\System\HrlXzoa.exe
  2⤵
  PID:3624
- C:\Windows\System\VEyLFvc.exe
  C:\Windows\System\VEyLFvc.exe
  2⤵
  PID:3640
- C:\Windows\System\ksJPtep.exe
  C:\Windows\System\ksJPtep.exe
  2⤵
  PID:3664
- C:\Windows\System\MxlsrNu.exe
  C:\Windows\System\MxlsrNu.exe
  2⤵
  PID:3680
- C:\Windows\System\oiunVdx.exe
  C:\Windows\System\oiunVdx.exe
  2⤵
  PID:3704
- C:\Windows\System\VFprjws.exe
  C:\Windows\System\VFprjws.exe
  2⤵
  PID:3724
- C:\Windows\System\CLTQcih.exe
  C:\Windows\System\CLTQcih.exe
  2⤵
  PID:3744
- C:\Windows\System\qGJkaoF.exe
  C:\Windows\System\qGJkaoF.exe
  2⤵
  PID:3764
- C:\Windows\System\dxvoCJB.exe
  C:\Windows\System\dxvoCJB.exe
  2⤵
  PID:3784
- C:\Windows\System\jbuzFYP.exe
  C:\Windows\System\jbuzFYP.exe
  2⤵
  PID:3804
- C:\Windows\System\JXdfeNy.exe
  C:\Windows\System\JXdfeNy.exe
  2⤵
  PID:3824
- C:\Windows\System\bTRUqPf.exe
  C:\Windows\System\bTRUqPf.exe
  2⤵
  PID:3848
- C:\Windows\System\RVYqtFm.exe
  C:\Windows\System\RVYqtFm.exe
  2⤵
  PID:3864
- C:\Windows\System\GOWTqwV.exe
  C:\Windows\System\GOWTqwV.exe
  2⤵
  PID:3888
- C:\Windows\System\NRQFOcK.exe
  C:\Windows\System\NRQFOcK.exe
  2⤵
  PID:3904
- C:\Windows\System\NQhrRfc.exe
  C:\Windows\System\NQhrRfc.exe
  2⤵
  PID:3928
- C:\Windows\System\kpujIGU.exe
  C:\Windows\System\kpujIGU.exe
  2⤵
  PID:3944
- C:\Windows\System\zKuyzpI.exe
  C:\Windows\System\zKuyzpI.exe
  2⤵
  PID:3964
- C:\Windows\System\uydVaRI.exe
  C:\Windows\System\uydVaRI.exe
  2⤵
  PID:3980
- C:\Windows\System\rvylYPI.exe
  C:\Windows\System\rvylYPI.exe
  2⤵
  PID:4000
- C:\Windows\System\WYNyXUQ.exe
  C:\Windows\System\WYNyXUQ.exe
  2⤵
  PID:4020
- C:\Windows\System\xzheAEb.exe
  C:\Windows\System\xzheAEb.exe
  2⤵
  PID:4040
- C:\Windows\System\jscOcWn.exe
  C:\Windows\System\jscOcWn.exe
  2⤵
  PID:4060
- C:\Windows\System\MgiwuKD.exe
  C:\Windows\System\MgiwuKD.exe
  2⤵
  PID:4080
- C:\Windows\System\LgUKAiu.exe
  C:\Windows\System\LgUKAiu.exe
  2⤵
  PID:268
- C:\Windows\System\ZXRgbsk.exe
  C:\Windows\System\ZXRgbsk.exe
  2⤵
  PID:2040
- C:\Windows\System\iusJGWM.exe
  C:\Windows\System\iusJGWM.exe
  2⤵
  PID:1084
- C:\Windows\System\RltAfNY.exe
  C:\Windows\System\RltAfNY.exe
  2⤵
  PID:1620
- C:\Windows\System\HmOEupN.exe
  C:\Windows\System\HmOEupN.exe
  2⤵
  PID:1504
- C:\Windows\System\jrkFqRD.exe
  C:\Windows\System\jrkFqRD.exe
  2⤵
  PID:628
- C:\Windows\System\OvyvBUr.exe
  C:\Windows\System\OvyvBUr.exe
  2⤵
  PID:880
- C:\Windows\System\TDGGeiq.exe
  C:\Windows\System\TDGGeiq.exe
  2⤵
  PID:2432
- C:\Windows\System\XhlgZcz.exe
  C:\Windows\System\XhlgZcz.exe
  2⤵
  PID:2392
- C:\Windows\System\rbnHfwL.exe
  C:\Windows\System\rbnHfwL.exe
  2⤵
  PID:2764
- C:\Windows\System\ckcPUEt.exe
  C:\Windows\System\ckcPUEt.exe
  2⤵
  PID:2744
- C:\Windows\System\MuDfjIB.exe
  C:\Windows\System\MuDfjIB.exe
  2⤵
  PID:2192
- C:\Windows\System\tqAJVIT.exe
  C:\Windows\System\tqAJVIT.exe
  2⤵
  PID:2092
- C:\Windows\System\PSnpPzg.exe
  C:\Windows\System\PSnpPzg.exe
  2⤵
  PID:2108
- C:\Windows\System\omeqdZV.exe
  C:\Windows\System\omeqdZV.exe
  2⤵
  PID:1908
- C:\Windows\System\DmBUgnV.exe
  C:\Windows\System\DmBUgnV.exe
  2⤵
  PID:940
- C:\Windows\System\cFyEGYa.exe
  C:\Windows\System\cFyEGYa.exe
  2⤵
  PID:3096
- C:\Windows\System\LwzHgOX.exe
  C:\Windows\System\LwzHgOX.exe
  2⤵
  PID:3100
- C:\Windows\System\FipGWsr.exe
  C:\Windows\System\FipGWsr.exe
  2⤵
  PID:3160
- C:\Windows\System\NeMlGsi.exe
  C:\Windows\System\NeMlGsi.exe
  2⤵
  PID:3200
- C:\Windows\System\wgNHIux.exe
  C:\Windows\System\wgNHIux.exe
  2⤵
  PID:3244
- C:\Windows\System\bDznTKs.exe
  C:\Windows\System\bDznTKs.exe
  2⤵
  PID:3256
- C:\Windows\System\EFGcTxb.exe
  C:\Windows\System\EFGcTxb.exe
  2⤵
  PID:3264
- C:\Windows\System\LkHiEkb.exe
  C:\Windows\System\LkHiEkb.exe
  2⤵
  PID:3360
- C:\Windows\System\kVqJMIp.exe
  C:\Windows\System\kVqJMIp.exe
  2⤵
  PID:3392
- C:\Windows\System\WLDGkly.exe
  C:\Windows\System\WLDGkly.exe
  2⤵
  PID:3436
- C:\Windows\System\UWhHpXT.exe
  C:\Windows\System\UWhHpXT.exe
  2⤵
  PID:3412
- C:\Windows\System\kHpLTxI.exe
  C:\Windows\System\kHpLTxI.exe
  2⤵
  PID:3460
- C:\Windows\System\EouHFMs.exe
  C:\Windows\System\EouHFMs.exe
  2⤵
  PID:3556
- C:\Windows\System\gvniFtC.exe
  C:\Windows\System\gvniFtC.exe
  2⤵
  PID:3528
- C:\Windows\System\NIgFgjX.exe
  C:\Windows\System\NIgFgjX.exe
  2⤵
  PID:3568
- C:\Windows\System\DOmYajW.exe
  C:\Windows\System\DOmYajW.exe
  2⤵
  PID:3576
- C:\Windows\System\ZLvwUgt.exe
  C:\Windows\System\ZLvwUgt.exe
  2⤵
  PID:3620
- C:\Windows\System\lIJYsCF.exe
  C:\Windows\System\lIJYsCF.exe
  2⤵
  PID:3716
- C:\Windows\System\fXqAnMU.exe
  C:\Windows\System\fXqAnMU.exe
  2⤵
  PID:3692
- C:\Windows\System\RbjrwCq.exe
  C:\Windows\System\RbjrwCq.exe
  2⤵
  PID:3760
- C:\Windows\System\cjvlIAP.exe
  C:\Windows\System\cjvlIAP.exe
  2⤵
  PID:3740
- C:\Windows\System\xuCxali.exe
  C:\Windows\System\xuCxali.exe
  2⤵
  PID:3844
- C:\Windows\System\ZldREDY.exe
  C:\Windows\System\ZldREDY.exe
  2⤵
  PID:3812
- C:\Windows\System\LmjDwDz.exe
  C:\Windows\System\LmjDwDz.exe
  2⤵
  PID:3880
- C:\Windows\System\hIvdzmA.exe
  C:\Windows\System\hIvdzmA.exe
  2⤵
  PID:3920
- C:\Windows\System\NQFAzjV.exe
  C:\Windows\System\NQFAzjV.exe
  2⤵
  PID:3860
- C:\Windows\System\NGMtWJE.exe
  C:\Windows\System\NGMtWJE.exe
  2⤵
  PID:3992
- C:\Windows\System\ZYvsgJN.exe
  C:\Windows\System\ZYvsgJN.exe
  2⤵
  PID:4036
- C:\Windows\System\xzpgOtr.exe
  C:\Windows\System\xzpgOtr.exe
  2⤵
  PID:4072
- C:\Windows\System\sxCdXns.exe
  C:\Windows\System\sxCdXns.exe
  2⤵
  PID:3972
- C:\Windows\System\WPXxSGE.exe
  C:\Windows\System\WPXxSGE.exe
  2⤵
  PID:1500
- C:\Windows\System\Oagsyzm.exe
  C:\Windows\System\Oagsyzm.exe
  2⤵
  PID:2260
- C:\Windows\System\ygaafuA.exe
  C:\Windows\System\ygaafuA.exe
  2⤵
  PID:1420
- C:\Windows\System\ktOuoTw.exe
  C:\Windows\System\ktOuoTw.exe
  2⤵
  PID:2440
- C:\Windows\System\FJEdsdU.exe
  C:\Windows\System\FJEdsdU.exe
  2⤵
  PID:1652
- C:\Windows\System\TJEhOrC.exe
  C:\Windows\System\TJEhOrC.exe
  2⤵
  PID:3028
- C:\Windows\System\pdPyqVP.exe
  C:\Windows\System\pdPyqVP.exe
  2⤵
  PID:2896
- C:\Windows\System\LQPUBss.exe
  C:\Windows\System\LQPUBss.exe
  2⤵
  PID:3084
- C:\Windows\System\ihAPWND.exe
  C:\Windows\System\ihAPWND.exe
  2⤵
  PID:2736
- C:\Windows\System\nTLpQMT.exe
  C:\Windows\System\nTLpQMT.exe
  2⤵
  PID:3276
- C:\Windows\System\FBTuefx.exe
  C:\Windows\System\FBTuefx.exe
  2⤵
  PID:3432
- C:\Windows\System\dhvepuF.exe
  C:\Windows\System\dhvepuF.exe
  2⤵
  PID:3420
- C:\Windows\System\JVAQVek.exe
  C:\Windows\System\JVAQVek.exe
  2⤵
  PID:3136
- C:\Windows\System\ZvtNEwf.exe
  C:\Windows\System\ZvtNEwf.exe
  2⤵
  PID:3320
- C:\Windows\System\jDFZLwl.exe
  C:\Windows\System\jDFZLwl.exe
  2⤵
  PID:3176
- C:\Windows\System\jzeKdSY.exe
  C:\Windows\System\jzeKdSY.exe
  2⤵
  PID:3336
- C:\Windows\System\HURGFrZ.exe
  C:\Windows\System\HURGFrZ.exe
  2⤵
  PID:3720
- C:\Windows\System\urHmhEI.exe
  C:\Windows\System\urHmhEI.exe
  2⤵
  PID:3836
- C:\Windows\System\sHbXTTg.exe
  C:\Windows\System\sHbXTTg.exe
  2⤵
  PID:3552
- C:\Windows\System\QiUqAJm.exe
  C:\Windows\System\QiUqAJm.exe
  2⤵
  PID:3536
- C:\Windows\System\ZoerNzP.exe
  C:\Windows\System\ZoerNzP.exe
  2⤵
  PID:3608
- C:\Windows\System\tbQAquK.exe
  C:\Windows\System\tbQAquK.exe
  2⤵
  PID:3652
- C:\Windows\System\MdmzDVn.exe
  C:\Windows\System\MdmzDVn.exe
  2⤵
  PID:3796
- C:\Windows\System\AhyZQNJ.exe
  C:\Windows\System\AhyZQNJ.exe
  2⤵
  PID:1200
- C:\Windows\System\mqWcvca.exe
  C:\Windows\System\mqWcvca.exe
  2⤵
  PID:3772
- C:\Windows\System\GTsFYtj.exe
  C:\Windows\System\GTsFYtj.exe
  2⤵
  PID:600
- C:\Windows\System\ZOrDmDb.exe
  C:\Windows\System\ZOrDmDb.exe
  2⤵
  PID:3936
- C:\Windows\System\IYrrOCi.exe
  C:\Windows\System\IYrrOCi.exe
  2⤵
  PID:684
- C:\Windows\System\hiAFnFK.exe
  C:\Windows\System\hiAFnFK.exe
  2⤵
  PID:3036
- C:\Windows\System\cBqJlBi.exe
  C:\Windows\System\cBqJlBi.exe
  2⤵
  PID:4108
- C:\Windows\System\lpCcVUe.exe
  C:\Windows\System\lpCcVUe.exe
  2⤵
  PID:4132
- C:\Windows\System\qDwCzel.exe
  C:\Windows\System\qDwCzel.exe
  2⤵
  PID:4148
- C:\Windows\System\FQSbCcY.exe
  C:\Windows\System\FQSbCcY.exe
  2⤵
  PID:4168
- C:\Windows\System\EiybRjJ.exe
  C:\Windows\System\EiybRjJ.exe
  2⤵
  PID:4188
- C:\Windows\System\LqMCOPA.exe
  C:\Windows\System\LqMCOPA.exe
  2⤵
  PID:4208
- C:\Windows\System\niabEFg.exe
  C:\Windows\System\niabEFg.exe
  2⤵
  PID:4228
- C:\Windows\System\RuTlZPa.exe
  C:\Windows\System\RuTlZPa.exe
  2⤵
  PID:4252
- C:\Windows\System\eKSSeXd.exe
  C:\Windows\System\eKSSeXd.exe
  2⤵
  PID:4268
- C:\Windows\System\ZsJHDsN.exe
  C:\Windows\System\ZsJHDsN.exe
  2⤵
  PID:4292
- C:\Windows\System\CTvEFhz.exe
  C:\Windows\System\CTvEFhz.exe
  2⤵
  PID:4312
- C:\Windows\System\whLVQOy.exe
  C:\Windows\System\whLVQOy.exe
  2⤵
  PID:4332
- C:\Windows\System\pJYdvAq.exe
  C:\Windows\System\pJYdvAq.exe
  2⤵
  PID:4352
- C:\Windows\System\VdcnPbX.exe
  C:\Windows\System\VdcnPbX.exe
  2⤵
  PID:4372
- C:\Windows\System\BMiVLbC.exe
  C:\Windows\System\BMiVLbC.exe
  2⤵
  PID:4392
- C:\Windows\System\NyZJjuT.exe
  C:\Windows\System\NyZJjuT.exe
  2⤵
  PID:4412
- C:\Windows\System\ybdGQkJ.exe
  C:\Windows\System\ybdGQkJ.exe
  2⤵
  PID:4436
- C:\Windows\System\wipborn.exe
  C:\Windows\System\wipborn.exe
  2⤵
  PID:4452
- C:\Windows\System\GiECEoB.exe
  C:\Windows\System\GiECEoB.exe
  2⤵
  PID:4468
- C:\Windows\System\byQFkOR.exe
  C:\Windows\System\byQFkOR.exe
  2⤵
  PID:4492
- C:\Windows\System\qvxeAbK.exe
  C:\Windows\System\qvxeAbK.exe
  2⤵
  PID:4516
- C:\Windows\System\cEpdecu.exe
  C:\Windows\System\cEpdecu.exe
  2⤵
  PID:4532
- C:\Windows\System\nWyUVGA.exe
  C:\Windows\System\nWyUVGA.exe
  2⤵
  PID:4556
- C:\Windows\System\FFTDDZD.exe
  C:\Windows\System\FFTDDZD.exe
  2⤵
  PID:4576
- C:\Windows\System\bvUIiBj.exe
  C:\Windows\System\bvUIiBj.exe
  2⤵
  PID:4596
- C:\Windows\System\yfNfLiX.exe
  C:\Windows\System\yfNfLiX.exe
  2⤵
  PID:4612
- C:\Windows\System\omKaukY.exe
  C:\Windows\System\omKaukY.exe
  2⤵
  PID:4628
- C:\Windows\System\EExgzgx.exe
  C:\Windows\System\EExgzgx.exe
  2⤵
  PID:4652
- C:\Windows\System\FWpQqqC.exe
  C:\Windows\System\FWpQqqC.exe
  2⤵
  PID:4668
- C:\Windows\System\TRVrRqG.exe
  C:\Windows\System\TRVrRqG.exe
  2⤵
  PID:4692
- C:\Windows\System\MubPZUz.exe
  C:\Windows\System\MubPZUz.exe
  2⤵
  PID:4708
- C:\Windows\System\ntaSrsf.exe
  C:\Windows\System\ntaSrsf.exe
  2⤵
  PID:4728
- C:\Windows\System\ijWUmfL.exe
  C:\Windows\System\ijWUmfL.exe
  2⤵
  PID:4744
- C:\Windows\System\EtXEzGb.exe
  C:\Windows\System\EtXEzGb.exe
  2⤵
  PID:4768
- C:\Windows\System\rCwttTP.exe
  C:\Windows\System\rCwttTP.exe
  2⤵
  PID:4784
- C:\Windows\System\huNyuEn.exe
  C:\Windows\System\huNyuEn.exe
  2⤵
  PID:4812
- C:\Windows\System\pkGCaog.exe
  C:\Windows\System\pkGCaog.exe
  2⤵
  PID:4832
- C:\Windows\System\XzWsWQS.exe
  C:\Windows\System\XzWsWQS.exe
  2⤵
  PID:4852
- C:\Windows\System\rNFLXfK.exe
  C:\Windows\System\rNFLXfK.exe
  2⤵
  PID:4868
- C:\Windows\System\YJqmvQP.exe
  C:\Windows\System\YJqmvQP.exe
  2⤵
  PID:4892
- C:\Windows\System\fwsTFhs.exe
  C:\Windows\System\fwsTFhs.exe
  2⤵
  PID:4908
- C:\Windows\System\SicFfdt.exe
  C:\Windows\System\SicFfdt.exe
  2⤵
  PID:4932
- C:\Windows\System\tteXSyP.exe
  C:\Windows\System\tteXSyP.exe
  2⤵
  PID:4952
- C:\Windows\System\ntJqVQE.exe
  C:\Windows\System\ntJqVQE.exe
  2⤵
  PID:4968
- C:\Windows\System\ICfNPwG.exe
  C:\Windows\System\ICfNPwG.exe
  2⤵
  PID:4988
- C:\Windows\System\uIhyCmY.exe
  C:\Windows\System\uIhyCmY.exe
  2⤵
  PID:5012
- C:\Windows\System\BqDcXyL.exe
  C:\Windows\System\BqDcXyL.exe
  2⤵
  PID:5032
- C:\Windows\System\fSJiRfX.exe
  C:\Windows\System\fSJiRfX.exe
  2⤵
  PID:5056
- C:\Windows\System\zXhJiPt.exe
  C:\Windows\System\zXhJiPt.exe
  2⤵
  PID:5076
- C:\Windows\System\jjDzSvU.exe
  C:\Windows\System\jjDzSvU.exe
  2⤵
  PID:5092
- C:\Windows\System\ByzsZeF.exe
  C:\Windows\System\ByzsZeF.exe
  2⤵
  PID:5116
- C:\Windows\System\ubSuwlC.exe
  C:\Windows\System\ubSuwlC.exe
  2⤵
  PID:4088
- C:\Windows\System\WUvLVmi.exe
  C:\Windows\System\WUvLVmi.exe
  2⤵
  PID:1148
- C:\Windows\System\tyQMpmx.exe
  C:\Windows\System\tyQMpmx.exe
  2⤵
  PID:1868
- C:\Windows\System\eLRDAlJ.exe
  C:\Windows\System\eLRDAlJ.exe
  2⤵
  PID:2264
- C:\Windows\System\GsqTMzI.exe
  C:\Windows\System\GsqTMzI.exe
  2⤵
  PID:3120
- C:\Windows\System\AicVTgr.exe
  C:\Windows\System\AicVTgr.exe
  2⤵
  PID:984
- C:\Windows\System\TdCUYcd.exe
  C:\Windows\System\TdCUYcd.exe
  2⤵
  PID:3364
- C:\Windows\System\NrgXssG.exe
  C:\Windows\System\NrgXssG.exe
  2⤵
  PID:3304
- C:\Windows\System\hVKlDGN.exe
  C:\Windows\System\hVKlDGN.exe
  2⤵
  PID:3872
- C:\Windows\System\PBxXXUi.exe
  C:\Windows\System\PBxXXUi.exe
  2⤵
  PID:3632
- C:\Windows\System\veqkpDe.exe
  C:\Windows\System\veqkpDe.exe
  2⤵
  PID:3516
- C:\Windows\System\EPHJWQv.exe
  C:\Windows\System\EPHJWQv.exe
  2⤵
  PID:3956
- C:\Windows\System\hvkduaI.exe
  C:\Windows\System\hvkduaI.exe
  2⤵
  PID:3816
- C:\Windows\System\VTBEwvZ.exe
  C:\Windows\System\VTBEwvZ.exe
  2⤵
  PID:3776
- C:\Windows\System\TGopWBy.exe
  C:\Windows\System\TGopWBy.exe
  2⤵
  PID:2388
- C:\Windows\System\NLHwKTd.exe
  C:\Windows\System\NLHwKTd.exe
  2⤵
  PID:4140
- C:\Windows\System\flGVSFV.exe
  C:\Windows\System\flGVSFV.exe
  2⤵
  PID:4180
- C:\Windows\System\ohmtfTd.exe
  C:\Windows\System\ohmtfTd.exe
  2⤵
  PID:4120
- C:\Windows\System\yzbsUAi.exe
  C:\Windows\System\yzbsUAi.exe
  2⤵
  PID:4220
- C:\Windows\System\xJpKTMv.exe
  C:\Windows\System\xJpKTMv.exe
  2⤵
  PID:4196
- C:\Windows\System\aZYvfua.exe
  C:\Windows\System\aZYvfua.exe
  2⤵
  PID:4284
- C:\Windows\System\czQITMn.exe
  C:\Windows\System\czQITMn.exe
  2⤵
  PID:4340
- C:\Windows\System\UuwQaNp.exe
  C:\Windows\System\UuwQaNp.exe
  2⤵
  PID:4348
- C:\Windows\System\azkTpqd.exe
  C:\Windows\System\azkTpqd.exe
  2⤵
  PID:4420
- C:\Windows\System\NIgnYKt.exe
  C:\Windows\System\NIgnYKt.exe
  2⤵
  PID:4368
- C:\Windows\System\gbkrPQq.exe
  C:\Windows\System\gbkrPQq.exe
  2⤵
  PID:4460
- C:\Windows\System\ekOFkHI.exe
  C:\Windows\System\ekOFkHI.exe
  2⤵
  PID:4512
- C:\Windows\System\SazWrSv.exe
  C:\Windows\System\SazWrSv.exe
  2⤵
  PID:4484
- C:\Windows\System\sTciIFn.exe
  C:\Windows\System\sTciIFn.exe
  2⤵
  PID:4544
- C:\Windows\System\AvWwzAY.exe
  C:\Windows\System\AvWwzAY.exe
  2⤵
  PID:4592
- C:\Windows\System\mpkGkiG.exe
  C:\Windows\System\mpkGkiG.exe
  2⤵
  PID:4620
- C:\Windows\System\RpKpEMD.exe
  C:\Windows\System\RpKpEMD.exe
  2⤵
  PID:4604
- C:\Windows\System\ZzsGBgt.exe
  C:\Windows\System\ZzsGBgt.exe
  2⤵
  PID:4640
- C:\Windows\System\vVDyWra.exe
  C:\Windows\System\vVDyWra.exe
  2⤵
  PID:4684
- C:\Windows\System\bEIWrBT.exe
  C:\Windows\System\bEIWrBT.exe
  2⤵
  PID:4820
- C:\Windows\System\MNoWZSU.exe
  C:\Windows\System\MNoWZSU.exe
  2⤵
  PID:4680
- C:\Windows\System\UzrxawA.exe
  C:\Windows\System\UzrxawA.exe
  2⤵
  PID:4828
- C:\Windows\System\NfvtSqI.exe
  C:\Windows\System\NfvtSqI.exe
  2⤵
  PID:4796
- C:\Windows\System\bkRMqPQ.exe
  C:\Windows\System\bkRMqPQ.exe
  2⤵
  PID:4904
- C:\Windows\System\AJAsFFs.exe
  C:\Windows\System\AJAsFFs.exe
  2⤵
  PID:4876
- C:\Windows\System\obefMnd.exe
  C:\Windows\System\obefMnd.exe
  2⤵
  PID:4944
- C:\Windows\System\BzNTJpx.exe
  C:\Windows\System\BzNTJpx.exe
  2⤵
  PID:4928
- C:\Windows\System\BJNaefj.exe
  C:\Windows\System\BJNaefj.exe
  2⤵
  PID:4984
- C:\Windows\System\ZawBugq.exe
  C:\Windows\System\ZawBugq.exe
  2⤵
  PID:5008
- C:\Windows\System\zWrmNqU.exe
  C:\Windows\System\zWrmNqU.exe
  2⤵
  PID:2848
- C:\Windows\System\vOLVjOJ.exe
  C:\Windows\System\vOLVjOJ.exe
  2⤵
  PID:5044
- C:\Windows\System\JdNiTtA.exe
  C:\Windows\System\JdNiTtA.exe
  2⤵
  PID:5068
- C:\Windows\System\OuIoQZV.exe
  C:\Windows\System\OuIoQZV.exe
  2⤵
  PID:4016
- C:\Windows\System\BVkokMA.exe
  C:\Windows\System\BVkokMA.exe
  2⤵
  PID:1520
- C:\Windows\System\KvkHmaD.exe
  C:\Windows\System\KvkHmaD.exe
  2⤵
  PID:3192
- C:\Windows\System\pVDmvIQ.exe
  C:\Windows\System\pVDmvIQ.exe
  2⤵
  PID:3356
- C:\Windows\System\UfmffBl.exe
  C:\Windows\System\UfmffBl.exe
  2⤵
  PID:3732
- C:\Windows\System\oWvBpfz.exe
  C:\Windows\System\oWvBpfz.exe
  2⤵
  PID:2980
- C:\Windows\System\aalZaci.exe
  C:\Windows\System\aalZaci.exe
  2⤵
  PID:3480
- C:\Windows\System\mwEqUcc.exe
  C:\Windows\System\mwEqUcc.exe
  2⤵
  PID:3940
- C:\Windows\System\mLSlqVs.exe
  C:\Windows\System\mLSlqVs.exe
  2⤵
  PID:3660
- C:\Windows\System\YATCuEE.exe
  C:\Windows\System\YATCuEE.exe
  2⤵
  PID:4008
- C:\Windows\System\zvvnqbr.exe
  C:\Windows\System\zvvnqbr.exe
  2⤵
  PID:4156
- C:\Windows\System\boQDATr.exe
  C:\Windows\System\boQDATr.exe
  2⤵
  PID:4248
- C:\Windows\System\vZKIoWD.exe
  C:\Windows\System\vZKIoWD.exe
  2⤵
  PID:4128
- C:\Windows\System\TlaWsgG.exe
  C:\Windows\System\TlaWsgG.exe
  2⤵
  PID:2724
- C:\Windows\System\RqvHfQO.exe
  C:\Windows\System\RqvHfQO.exe
  2⤵
  PID:4260
- C:\Windows\System\EmiXSSx.exe
  C:\Windows\System\EmiXSSx.exe
  2⤵
  PID:4428
- C:\Windows\System\ctyqmTU.exe
  C:\Windows\System\ctyqmTU.exe
  2⤵
  PID:4320
- C:\Windows\System\iSurQRC.exe
  C:\Windows\System\iSurQRC.exe
  2⤵
  PID:4508
- C:\Windows\System\JvnvNna.exe
  C:\Windows\System\JvnvNna.exe
  2⤵
  PID:4540
- C:\Windows\System\TUxRgCR.exe
  C:\Windows\System\TUxRgCR.exe
  2⤵
  PID:4572
- C:\Windows\System\utKjdZF.exe
  C:\Windows\System\utKjdZF.exe
  2⤵
  PID:2012
- C:\Windows\System\xaiOUmV.exe
  C:\Windows\System\xaiOUmV.exe
  2⤵
  PID:4776
- C:\Windows\System\wUSrivv.exe
  C:\Windows\System\wUSrivv.exe
  2⤵
  PID:4716
- C:\Windows\System\tLofVHh.exe
  C:\Windows\System\tLofVHh.exe
  2⤵
  PID:4444
- C:\Windows\System\TYgBKfn.exe
  C:\Windows\System\TYgBKfn.exe
  2⤵
  PID:4588
- C:\Windows\System\OTTTauz.exe
  C:\Windows\System\OTTTauz.exe
  2⤵
  PID:4808
- C:\Windows\System\zFezpfa.exe
  C:\Windows\System\zFezpfa.exe
  2⤵
  PID:2296
- C:\Windows\System\JCjJnBQ.exe
  C:\Windows\System\JCjJnBQ.exe
  2⤵
  PID:4920
- C:\Windows\System\uDCSmqV.exe
  C:\Windows\System\uDCSmqV.exe
  2⤵
  PID:5048
- C:\Windows\System\yVWgKOT.exe
  C:\Windows\System\yVWgKOT.exe
  2⤵
  PID:1684
- C:\Windows\System\PeajKHs.exe
  C:\Windows\System\PeajKHs.exe
  2⤵
  PID:2888
- C:\Windows\System\HJxJbAA.exe
  C:\Windows\System\HJxJbAA.exe
  2⤵
  PID:4848
- C:\Windows\System\ATDurOZ.exe
  C:\Windows\System\ATDurOZ.exe
  2⤵
  PID:2648
- C:\Windows\System\Fyvzfci.exe
  C:\Windows\System\Fyvzfci.exe
  2⤵
  PID:2684
- C:\Windows\System\mVxBBiX.exe
  C:\Windows\System\mVxBBiX.exe
  2⤵
  PID:3180
- C:\Windows\System\GTbTIvT.exe
  C:\Windows\System\GTbTIvT.exe
  2⤵
  PID:5108
- C:\Windows\System\BByfrHX.exe
  C:\Windows\System\BByfrHX.exe
  2⤵
  PID:2248
- C:\Windows\System\GVZgKNT.exe
  C:\Windows\System\GVZgKNT.exe
  2⤵
  PID:2832
- C:\Windows\System\GTIGLSM.exe
  C:\Windows\System\GTIGLSM.exe
  2⤵
  PID:1508
- C:\Windows\System\FJixKen.exe
  C:\Windows\System\FJixKen.exe
  2⤵
  PID:3612
- C:\Windows\System\VuieEku.exe
  C:\Windows\System\VuieEku.exe
  2⤵
  PID:3512
- C:\Windows\System\XkvBKji.exe
  C:\Windows\System\XkvBKji.exe
  2⤵
  PID:4052
- C:\Windows\System\yfzbaTA.exe
  C:\Windows\System\yfzbaTA.exe
  2⤵
  PID:1464
- C:\Windows\System\PHicrUc.exe
  C:\Windows\System\PHicrUc.exe
  2⤵
  PID:2964
- C:\Windows\System\OJoOHHl.exe
  C:\Windows\System\OJoOHHl.exe
  2⤵
  PID:1700
- C:\Windows\System\NPniRfF.exe
  C:\Windows\System\NPniRfF.exe
  2⤵
  PID:4264
- C:\Windows\System\GakQhFP.exe
  C:\Windows\System\GakQhFP.exe
  2⤵
  PID:4244
- C:\Windows\System\TOlzsZv.exe
  C:\Windows\System\TOlzsZv.exe
  2⤵
  PID:2912
- C:\Windows\System\bMhSaiM.exe
  C:\Windows\System\bMhSaiM.exe
  2⤵
  PID:4100
- C:\Windows\System\bcurlft.exe
  C:\Windows\System\bcurlft.exe
  2⤵
  PID:4432
- C:\Windows\System\nYfyISc.exe
  C:\Windows\System\nYfyISc.exe
  2⤵
  PID:1432
- C:\Windows\System\TEAcxQv.exe
  C:\Windows\System\TEAcxQv.exe
  2⤵
  PID:4400
- C:\Windows\System\rugnOdR.exe
  C:\Windows\System\rugnOdR.exe
  2⤵
  PID:4480
- C:\Windows\System\GQnxKgS.exe
  C:\Windows\System\GQnxKgS.exe
  2⤵
  PID:4524
- C:\Windows\System\TnTGUYM.exe
  C:\Windows\System\TnTGUYM.exe
  2⤵
  PID:4448
- C:\Windows\System\dbdPxAq.exe
  C:\Windows\System\dbdPxAq.exe
  2⤵
  PID:2784
- C:\Windows\System\LUWiiPA.exe
  C:\Windows\System\LUWiiPA.exe
  2⤵
  PID:2728
- C:\Windows\System\ddsYUrR.exe
  C:\Windows\System\ddsYUrR.exe
  2⤵
  PID:2580
- C:\Windows\System\vxxpTHx.exe
  C:\Windows\System\vxxpTHx.exe
  2⤵
  PID:5088
- C:\Windows\System\bxWVYeL.exe
  C:\Windows\System\bxWVYeL.exe
  2⤵
  PID:1204
- C:\Windows\System\XXMeIMz.exe
  C:\Windows\System\XXMeIMz.exe
  2⤵
  PID:2360
- C:\Windows\System\eRnsWVy.exe
  C:\Windows\System\eRnsWVy.exe
  2⤵
  PID:1492
- C:\Windows\System\YQIWqTh.exe
  C:\Windows\System\YQIWqTh.exe
  2⤵
  PID:3800
- C:\Windows\System\MKZIQVC.exe
  C:\Windows\System\MKZIQVC.exe
  2⤵
  PID:4752
- C:\Windows\System\RusleZW.exe
  C:\Windows\System\RusleZW.exe
  2⤵
  PID:4308
- C:\Windows\System\FQAjdFU.exe
  C:\Windows\System\FQAjdFU.exe
  2⤵
  PID:3712
- C:\Windows\System\cAEDezo.exe
  C:\Windows\System\cAEDezo.exe
  2⤵
  PID:4160
- C:\Windows\System\yvSNaJx.exe
  C:\Windows\System\yvSNaJx.exe
  2⤵
  PID:4636
- C:\Windows\System\Pvbarkp.exe
  C:\Windows\System\Pvbarkp.exe
  2⤵
  PID:4288
- C:\Windows\System\nlTLglk.exe
  C:\Windows\System\nlTLglk.exe
  2⤵
  PID:2160
- C:\Windows\System\aUnMopO.exe
  C:\Windows\System\aUnMopO.exe
  2⤵
  PID:2272
- C:\Windows\System\YNcOefB.exe
  C:\Windows\System\YNcOefB.exe
  2⤵
  PID:3672
- C:\Windows\System\DEalful.exe
  C:\Windows\System\DEalful.exe
  2⤵
  PID:4724
- C:\Windows\System\ZLffpGn.exe
  C:\Windows\System\ZLffpGn.exe
  2⤵
  PID:4700
- C:\Windows\System\XGZNyjN.exe
  C:\Windows\System\XGZNyjN.exe
  2⤵
  PID:2508
- C:\Windows\System\kusRoBM.exe
  C:\Windows\System\kusRoBM.exe
  2⤵
  PID:2864
- C:\Windows\System\bCsXaeU.exe
  C:\Windows\System\bCsXaeU.exe
  2⤵
  PID:1608
- C:\Windows\System\tRuJQYC.exe
  C:\Windows\System\tRuJQYC.exe
  2⤵
  PID:5040
- C:\Windows\System\HBZYhny.exe
  C:\Windows\System\HBZYhny.exe
  2⤵
  PID:2416
- C:\Windows\System\YVryGUm.exe
  C:\Windows\System\YVryGUm.exe
  2⤵
  PID:1984
- C:\Windows\System\OIJtNCH.exe
  C:\Windows\System\OIJtNCH.exe
  2⤵
  PID:4304
- C:\Windows\System\ahGFHfm.exe
  C:\Windows\System\ahGFHfm.exe
  2⤵
  PID:4648
- C:\Windows\System\dQJmNoK.exe
  C:\Windows\System\dQJmNoK.exe
  2⤵
  PID:5136
- C:\Windows\System\YGMQmIl.exe
  C:\Windows\System\YGMQmIl.exe
  2⤵
  PID:5156
- C:\Windows\System\zJBRpkH.exe
  C:\Windows\System\zJBRpkH.exe
  2⤵
  PID:5176
- C:\Windows\System\yRdHYpo.exe
  C:\Windows\System\yRdHYpo.exe
  2⤵
  PID:5248
- C:\Windows\System\YOoxcFO.exe
  C:\Windows\System\YOoxcFO.exe
  2⤵
  PID:5264
- C:\Windows\System\QfBiCeF.exe
  C:\Windows\System\QfBiCeF.exe
  2⤵
  PID:5280
- C:\Windows\System\gZZvqxC.exe
  C:\Windows\System\gZZvqxC.exe
  2⤵
  PID:5296
- C:\Windows\System\iFaCWjo.exe
  C:\Windows\System\iFaCWjo.exe
  2⤵
  PID:5312
- C:\Windows\System\wfhyrlv.exe
  C:\Windows\System\wfhyrlv.exe
  2⤵
  PID:5328
- C:\Windows\System\ricSexa.exe
  C:\Windows\System\ricSexa.exe
  2⤵
  PID:5344
- C:\Windows\System\aJIiCsc.exe
  C:\Windows\System\aJIiCsc.exe
  2⤵
  PID:5360
- C:\Windows\System\uEAuRCI.exe
  C:\Windows\System\uEAuRCI.exe
  2⤵
  PID:5376
- C:\Windows\System\cQAzOtu.exe
  C:\Windows\System\cQAzOtu.exe
  2⤵
  PID:5392
- C:\Windows\System\tNdHskm.exe
  C:\Windows\System\tNdHskm.exe
  2⤵
  PID:5408
- C:\Windows\System\sWQtien.exe
  C:\Windows\System\sWQtien.exe
  2⤵
  PID:5424
- C:\Windows\System\zLCSSUu.exe
  C:\Windows\System\zLCSSUu.exe
  2⤵
  PID:5460
- C:\Windows\System\OfzlwJe.exe
  C:\Windows\System\OfzlwJe.exe
  2⤵
  PID:5492
- C:\Windows\System\JrMCabc.exe
  C:\Windows\System\JrMCabc.exe
  2⤵
  PID:5516
- C:\Windows\System\HcHLLRk.exe
  C:\Windows\System\HcHLLRk.exe
  2⤵
  PID:5532
- C:\Windows\System\LCVnZLZ.exe
  C:\Windows\System\LCVnZLZ.exe
  2⤵
  PID:5548
- C:\Windows\System\gSkmtGQ.exe
  C:\Windows\System\gSkmtGQ.exe
  2⤵
  PID:5564
- C:\Windows\System\oiXwpma.exe
  C:\Windows\System\oiXwpma.exe
  2⤵
  PID:5580
- C:\Windows\System\VEOJwsO.exe
  C:\Windows\System\VEOJwsO.exe
  2⤵
  PID:5596
- C:\Windows\System\EKLMyJn.exe
  C:\Windows\System\EKLMyJn.exe
  2⤵
  PID:5612
- C:\Windows\System\KBlVdum.exe
  C:\Windows\System\KBlVdum.exe
  2⤵
  PID:5628
- C:\Windows\System\lCHkArD.exe
  C:\Windows\System\lCHkArD.exe
  2⤵
  PID:5680
- C:\Windows\System\DDnBLls.exe
  C:\Windows\System\DDnBLls.exe
  2⤵
  PID:5700
- C:\Windows\System\QwcoblY.exe
  C:\Windows\System\QwcoblY.exe
  2⤵
  PID:5720
- C:\Windows\System\NpjoEAt.exe
  C:\Windows\System\NpjoEAt.exe
  2⤵
  PID:5740
- C:\Windows\System\CwGTYzF.exe
  C:\Windows\System\CwGTYzF.exe
  2⤵
  PID:5756
- C:\Windows\System\lXVHPeV.exe
  C:\Windows\System\lXVHPeV.exe
  2⤵
  PID:5772
- C:\Windows\System\UJVlDzA.exe
  C:\Windows\System\UJVlDzA.exe
  2⤵
  PID:5788
- C:\Windows\System\cFfDqJM.exe
  C:\Windows\System\cFfDqJM.exe
  2⤵
  PID:5804
- C:\Windows\System\OgJTOly.exe
  C:\Windows\System\OgJTOly.exe
  2⤵
  PID:5820
- C:\Windows\System\cRLvDdr.exe
  C:\Windows\System\cRLvDdr.exe
  2⤵
  PID:5836
- C:\Windows\System\LqpcuXS.exe
  C:\Windows\System\LqpcuXS.exe
  2⤵
  PID:5852
- C:\Windows\System\hvgdVFH.exe
  C:\Windows\System\hvgdVFH.exe
  2⤵
  PID:5868
- C:\Windows\System\SLQFoQB.exe
  C:\Windows\System\SLQFoQB.exe
  2⤵
  PID:5884
- C:\Windows\System\vLOURjf.exe
  C:\Windows\System\vLOURjf.exe
  2⤵
  PID:5900
- C:\Windows\System\pnPNRxj.exe
  C:\Windows\System\pnPNRxj.exe
  2⤵
  PID:5916
- C:\Windows\System\UBAhapv.exe
  C:\Windows\System\UBAhapv.exe
  2⤵
  PID:5936
- C:\Windows\System\tcxtVqy.exe
  C:\Windows\System\tcxtVqy.exe
  2⤵
  PID:5952
- C:\Windows\System\EpolSjo.exe
  C:\Windows\System\EpolSjo.exe
  2⤵
  PID:5972
- C:\Windows\System\vKCNQax.exe
  C:\Windows\System\vKCNQax.exe
  2⤵
  PID:5992
- C:\Windows\System\tFChHel.exe
  C:\Windows\System\tFChHel.exe
  2⤵
  PID:6008
- C:\Windows\System\NxljCEJ.exe
  C:\Windows\System\NxljCEJ.exe
  2⤵
  PID:6032
- C:\Windows\System\cxRWHuK.exe
  C:\Windows\System\cxRWHuK.exe
  2⤵
  PID:6052
- C:\Windows\System\NrtCnww.exe
  C:\Windows\System\NrtCnww.exe
  2⤵
  PID:6068
- C:\Windows\System\VyYeKsl.exe
  C:\Windows\System\VyYeKsl.exe
  2⤵
  PID:6088
- C:\Windows\System\gZlFPsQ.exe
  C:\Windows\System\gZlFPsQ.exe
  2⤵
  PID:6104
- C:\Windows\System\ZYXLCKy.exe
  C:\Windows\System\ZYXLCKy.exe
  2⤵
  PID:6120
- C:\Windows\System\bVGMDnT.exe
  C:\Windows\System\bVGMDnT.exe
  2⤵
  PID:6136
- C:\Windows\System\WFfIBIu.exe
  C:\Windows\System\WFfIBIu.exe
  2⤵
  PID:2464
- C:\Windows\System\hfPAHZm.exe
  C:\Windows\System\hfPAHZm.exe
  2⤵
  PID:5132
- C:\Windows\System\JUwRjFp.exe
  C:\Windows\System\JUwRjFp.exe
  2⤵
  PID:4384
- C:\Windows\System\aKzkOZu.exe
  C:\Windows\System\aKzkOZu.exe
  2⤵
  PID:4664
- C:\Windows\System\qXztpxv.exe
  C:\Windows\System\qXztpxv.exe
  2⤵
  PID:5144
- C:\Windows\System\uZejShN.exe
  C:\Windows\System\uZejShN.exe
  2⤵
  PID:4844
- C:\Windows\System\aEhNxpR.exe
  C:\Windows\System\aEhNxpR.exe
  2⤵
  PID:664
- C:\Windows\System\pbRfvnD.exe
  C:\Windows\System\pbRfvnD.exe
  2⤵
  PID:4564
- C:\Windows\System\yIBnuPW.exe
  C:\Windows\System\yIBnuPW.exe
  2⤵
  PID:5152
- C:\Windows\System\BnnrqaM.exe
  C:\Windows\System\BnnrqaM.exe
  2⤵
  PID:5200
- C:\Windows\System\kmqArKF.exe
  C:\Windows\System\kmqArKF.exe
  2⤵
  PID:5216
- C:\Windows\System\eQfgIPo.exe
  C:\Windows\System\eQfgIPo.exe
  2⤵
  PID:5232
- C:\Windows\System\vayHKRM.exe
  C:\Windows\System\vayHKRM.exe
  2⤵
  PID:5192
- C:\Windows\System\GTEjSzb.exe
  C:\Windows\System\GTEjSzb.exe
  2⤵
  PID:5292
- C:\Windows\System\zfwmaTW.exe
  C:\Windows\System\zfwmaTW.exe
  2⤵
  PID:5356
- C:\Windows\System\JebIsYY.exe
  C:\Windows\System\JebIsYY.exe
  2⤵
  PID:5388
- C:\Windows\System\oTYHncZ.exe
  C:\Windows\System\oTYHncZ.exe
  2⤵
  PID:5308
- C:\Windows\System\CgOvccX.exe
  C:\Windows\System\CgOvccX.exe
  2⤵
  PID:5432
- C:\Windows\System\CZvSMEB.exe
  C:\Windows\System\CZvSMEB.exe
  2⤵
  PID:5448
- C:\Windows\System\qPGBRGA.exe
  C:\Windows\System\qPGBRGA.exe
  2⤵
  PID:5540
- C:\Windows\System\nRsAWnB.exe
  C:\Windows\System\nRsAWnB.exe
  2⤵
  PID:5480
- C:\Windows\System\mpztUmW.exe
  C:\Windows\System\mpztUmW.exe
  2⤵
  PID:5556
- C:\Windows\System\skRhiZc.exe
  C:\Windows\System\skRhiZc.exe
  2⤵
  PID:5500
- C:\Windows\System\gGJGZKm.exe
  C:\Windows\System\gGJGZKm.exe
  2⤵
  PID:5544
- C:\Windows\System\ZhzzkJD.exe
  C:\Windows\System\ZhzzkJD.exe
  2⤵
  PID:5652
- C:\Windows\System\VaEUJaC.exe
  C:\Windows\System\VaEUJaC.exe
  2⤵
  PID:5672
- C:\Windows\System\TyKAbgp.exe
  C:\Windows\System\TyKAbgp.exe
  2⤵
  PID:5592
- C:\Windows\System\BrNCkme.exe
  C:\Windows\System\BrNCkme.exe
  2⤵
  PID:5692
- C:\Windows\System\ceAOCbq.exe
  C:\Windows\System\ceAOCbq.exe
  2⤵
  PID:5736
- C:\Windows\System\JCaqGwn.exe
  C:\Windows\System\JCaqGwn.exe
  2⤵
  PID:5800
- C:\Windows\System\YguSCrW.exe
  C:\Windows\System\YguSCrW.exe
  2⤵
  PID:5896
- C:\Windows\System\DVMFXxI.exe
  C:\Windows\System\DVMFXxI.exe
  2⤵
  PID:5964
- C:\Windows\System\CZimBnr.exe
  C:\Windows\System\CZimBnr.exe
  2⤵
  PID:6040
- C:\Windows\System\BtHOsyC.exe
  C:\Windows\System\BtHOsyC.exe
  2⤵
  PID:6080
- C:\Windows\System\gPOCvVp.exe
  C:\Windows\System\gPOCvVp.exe
  2⤵
  PID:5084
- C:\Windows\System\JdAPour.exe
  C:\Windows\System\JdAPour.exe
  2⤵
  PID:4964
- C:\Windows\System\MEnjhBB.exe
  C:\Windows\System\MEnjhBB.exe
  2⤵
  PID:4884
- C:\Windows\System\uYJRXwK.exe
  C:\Windows\System\uYJRXwK.exe
  2⤵
  PID:5240
- C:\Windows\System\jNWeXuM.exe
  C:\Windows\System\jNWeXuM.exe
  2⤵
  PID:5276
- C:\Windows\System\BzopkbA.exe
  C:\Windows\System\BzopkbA.exe
  2⤵
  PID:5444
- C:\Windows\System\rvTBGVV.exe
  C:\Windows\System\rvTBGVV.exe
  2⤵
  PID:5644
- C:\Windows\System\GhmGFlQ.exe
  C:\Windows\System\GhmGFlQ.exe
  2⤵
  PID:5640
- C:\Windows\System\kRjUWLk.exe
  C:\Windows\System\kRjUWLk.exe
  2⤵
  PID:5732
- C:\Windows\System\HlhIfti.exe
  C:\Windows\System\HlhIfti.exe
  2⤵
  PID:5748
- C:\Windows\System\kYqcgTk.exe
  C:\Windows\System\kYqcgTk.exe
  2⤵
  PID:5456
- C:\Windows\System\mXUyJDI.exe
  C:\Windows\System\mXUyJDI.exe
  2⤵
  PID:5780
- C:\Windows\System\bKFtoTm.exe
  C:\Windows\System\bKFtoTm.exe
  2⤵
  PID:6028
- C:\Windows\System\BRHmyGK.exe
  C:\Windows\System\BRHmyGK.exe
  2⤵
  PID:6128
- C:\Windows\System\vaSEfql.exe
  C:\Windows\System\vaSEfql.exe
  2⤵
  PID:3396
- C:\Windows\System\FOahgFW.exe
  C:\Windows\System\FOahgFW.exe
  2⤵
  PID:5188
- C:\Windows\System\zBWAmZV.exe
  C:\Windows\System\zBWAmZV.exe
  2⤵
  PID:5228
- C:\Windows\System\dQDidRF.exe
  C:\Windows\System\dQDidRF.exe
  2⤵
  PID:5400
- C:\Windows\System\ujrUYbt.exe
  C:\Windows\System\ujrUYbt.exe
  2⤵
  PID:5420
- C:\Windows\System\croJkkQ.exe
  C:\Windows\System\croJkkQ.exe
  2⤵
  PID:5512
- C:\Windows\System\nuKStan.exe
  C:\Windows\System\nuKStan.exe
  2⤵
  PID:5716
- C:\Windows\System\REshFAp.exe
  C:\Windows\System\REshFAp.exe
  2⤵
  PID:5948
- C:\Windows\System\DrKHeqf.exe
  C:\Windows\System\DrKHeqf.exe
  2⤵
  PID:6020
- C:\Windows\System\EVvqDft.exe
  C:\Windows\System\EVvqDft.exe
  2⤵
  PID:5908
- C:\Windows\System\AIkYRxt.exe
  C:\Windows\System\AIkYRxt.exe
  2⤵
  PID:5844
- C:\Windows\System\hVzCAxv.exe
  C:\Windows\System\hVzCAxv.exe
  2⤵
  PID:6000
- C:\Windows\System\BPHTDQA.exe
  C:\Windows\System\BPHTDQA.exe
  2⤵
  PID:5928
- C:\Windows\System\VKONesT.exe
  C:\Windows\System\VKONesT.exe
  2⤵
  PID:5932
- C:\Windows\System\YPnvyLR.exe
  C:\Windows\System\YPnvyLR.exe
  2⤵
  PID:6076
- C:\Windows\System\eXhrOVP.exe
  C:\Windows\System\eXhrOVP.exe
  2⤵
  PID:5440
- C:\Windows\System\SCzUMYZ.exe
  C:\Windows\System\SCzUMYZ.exe
  2⤵
  PID:5752
- C:\Windows\System\fmxpRvV.exe
  C:\Windows\System\fmxpRvV.exe
  2⤵
  PID:1960
- C:\Windows\System\fYXVJtA.exe
  C:\Windows\System\fYXVJtA.exe
  2⤵
  PID:6148
- C:\Windows\System\sEJKtOD.exe
  C:\Windows\System\sEJKtOD.exe
  2⤵
  PID:6164
- C:\Windows\System\ARwfNgn.exe
  C:\Windows\System\ARwfNgn.exe
  2⤵
  PID:6180
- C:\Windows\System\XDEKSTF.exe
  C:\Windows\System\XDEKSTF.exe
  2⤵
  PID:6196
- C:\Windows\System\mseOjEY.exe
  C:\Windows\System\mseOjEY.exe
  2⤵
  PID:6212
- C:\Windows\System\QHTTDby.exe
  C:\Windows\System\QHTTDby.exe
  2⤵
  PID:6228
- C:\Windows\System\cOKqoYg.exe
  C:\Windows\System\cOKqoYg.exe
  2⤵
  PID:6244
- C:\Windows\System\JmzLDgc.exe
  C:\Windows\System\JmzLDgc.exe
  2⤵
  PID:6260
- C:\Windows\System\jEIkPAi.exe
  C:\Windows\System\jEIkPAi.exe
  2⤵
  PID:6276
- C:\Windows\System\CySTAAC.exe
  C:\Windows\System\CySTAAC.exe
  2⤵
  PID:6292
- C:\Windows\System\UBbyOhz.exe
  C:\Windows\System\UBbyOhz.exe
  2⤵
  PID:6308
- C:\Windows\System\IYpezYF.exe
  C:\Windows\System\IYpezYF.exe
  2⤵
  PID:6324
- C:\Windows\System\eSutnWB.exe
  C:\Windows\System\eSutnWB.exe
  2⤵
  PID:6340
- C:\Windows\System\SkhOEzF.exe
  C:\Windows\System\SkhOEzF.exe
  2⤵
  PID:6356
- C:\Windows\System\EQInJAv.exe
  C:\Windows\System\EQInJAv.exe
  2⤵
  PID:6372
- C:\Windows\System\uHdztCq.exe
  C:\Windows\System\uHdztCq.exe
  2⤵
  PID:6388
- C:\Windows\System\cOneMwe.exe
  C:\Windows\System\cOneMwe.exe
  2⤵
  PID:6404
- C:\Windows\System\WsrtZCj.exe
  C:\Windows\System\WsrtZCj.exe
  2⤵
  PID:6420
- C:\Windows\System\xqpMlsU.exe
  C:\Windows\System\xqpMlsU.exe
  2⤵
  PID:6436
- C:\Windows\System\MUHHsRO.exe
  C:\Windows\System\MUHHsRO.exe
  2⤵
  PID:6452
- C:\Windows\System\gtFOSWd.exe
  C:\Windows\System\gtFOSWd.exe
  2⤵
  PID:6468
- C:\Windows\System\AoopFJR.exe
  C:\Windows\System\AoopFJR.exe
  2⤵
  PID:6484
- C:\Windows\System\bCLBwiE.exe
  C:\Windows\System\bCLBwiE.exe
  2⤵
  PID:6500
- C:\Windows\System\fCaQadG.exe
  C:\Windows\System\fCaQadG.exe
  2⤵
  PID:6516
- C:\Windows\System\HcxMbcq.exe
  C:\Windows\System\HcxMbcq.exe
  2⤵
  PID:6532
- C:\Windows\System\Tjiqgxs.exe
  C:\Windows\System\Tjiqgxs.exe
  2⤵
  PID:6548
- C:\Windows\System\kvMDUFX.exe
  C:\Windows\System\kvMDUFX.exe
  2⤵
  PID:6564
- C:\Windows\System\JZlnYYF.exe
  C:\Windows\System\JZlnYYF.exe
  2⤵
  PID:6580
- C:\Windows\System\nVNzmAl.exe
  C:\Windows\System\nVNzmAl.exe
  2⤵
  PID:6596
- C:\Windows\System\JWCGGyU.exe
  C:\Windows\System\JWCGGyU.exe
  2⤵
  PID:6612
- C:\Windows\System\UUtaruq.exe
  C:\Windows\System\UUtaruq.exe
  2⤵
  PID:6628
- C:\Windows\System\dSjioOH.exe
  C:\Windows\System\dSjioOH.exe
  2⤵
  PID:6644
- C:\Windows\System\gBoHwYs.exe
  C:\Windows\System\gBoHwYs.exe
  2⤵
  PID:6660
- C:\Windows\System\PXKPAnm.exe
  C:\Windows\System\PXKPAnm.exe
  2⤵
  PID:6676
- C:\Windows\System\ItrTdvy.exe
  C:\Windows\System\ItrTdvy.exe
  2⤵
  PID:6692
- C:\Windows\System\MtwyIav.exe
  C:\Windows\System\MtwyIav.exe
  2⤵
  PID:6708
- C:\Windows\System\sWoVjHC.exe
  C:\Windows\System\sWoVjHC.exe
  2⤵
  PID:6724
- C:\Windows\System\VrctiQl.exe
  C:\Windows\System\VrctiQl.exe
  2⤵
  PID:6740
- C:\Windows\System\RFhCNMm.exe
  C:\Windows\System\RFhCNMm.exe
  2⤵
  PID:6756
- C:\Windows\System\tyREFrc.exe
  C:\Windows\System\tyREFrc.exe
  2⤵
  PID:6772
- C:\Windows\System\KCBOfqf.exe
  C:\Windows\System\KCBOfqf.exe
  2⤵
  PID:6788
- C:\Windows\System\NlaYtdX.exe
  C:\Windows\System\NlaYtdX.exe
  2⤵
  PID:6804
- C:\Windows\System\FRUjLxV.exe
  C:\Windows\System\FRUjLxV.exe
  2⤵
  PID:6820
- C:\Windows\System\OePeymp.exe
  C:\Windows\System\OePeymp.exe
  2⤵
  PID:6836
- C:\Windows\System\sfLChqz.exe
  C:\Windows\System\sfLChqz.exe
  2⤵
  PID:6852
- C:\Windows\System\VbEaeww.exe
  C:\Windows\System\VbEaeww.exe
  2⤵
  PID:6868
- C:\Windows\System\ptynACC.exe
  C:\Windows\System\ptynACC.exe
  2⤵
  PID:6884
- C:\Windows\System\udbYHov.exe
  C:\Windows\System\udbYHov.exe
  2⤵
  PID:6900
- C:\Windows\System\ibAwWZL.exe
  C:\Windows\System\ibAwWZL.exe
  2⤵
  PID:6916
- C:\Windows\System\CZZpfuq.exe
  C:\Windows\System\CZZpfuq.exe
  2⤵
  PID:6932
- C:\Windows\System\LaMWLAd.exe
  C:\Windows\System\LaMWLAd.exe
  2⤵
  PID:6948
- C:\Windows\System\CSQflMZ.exe
  C:\Windows\System\CSQflMZ.exe
  2⤵
  PID:6964
- C:\Windows\System\RgoHrBH.exe
  C:\Windows\System\RgoHrBH.exe
  2⤵
  PID:6980
- C:\Windows\System\uPeTrxn.exe
  C:\Windows\System\uPeTrxn.exe
  2⤵
  PID:6996
- C:\Windows\System\cMLvHcF.exe
  C:\Windows\System\cMLvHcF.exe
  2⤵
  PID:7012
- C:\Windows\System\WcRXoNa.exe
  C:\Windows\System\WcRXoNa.exe
  2⤵
  PID:7028
- C:\Windows\System\snAGFlL.exe
  C:\Windows\System\snAGFlL.exe
  2⤵
  PID:7044
- C:\Windows\System\GjynvLN.exe
  C:\Windows\System\GjynvLN.exe
  2⤵
  PID:7060
- C:\Windows\System\GdFqPYn.exe
  C:\Windows\System\GdFqPYn.exe
  2⤵
  PID:7076
- C:\Windows\System\rTQCIPt.exe
  C:\Windows\System\rTQCIPt.exe
  2⤵
  PID:7092
- C:\Windows\System\ybBdPdJ.exe
  C:\Windows\System\ybBdPdJ.exe
  2⤵
  PID:7108
- C:\Windows\System\rveRdmz.exe
  C:\Windows\System\rveRdmz.exe
  2⤵
  PID:7124
- C:\Windows\System\PbVMSOD.exe
  C:\Windows\System\PbVMSOD.exe
  2⤵
  PID:7140
- C:\Windows\System\HXdpacR.exe
  C:\Windows\System\HXdpacR.exe
  2⤵
  PID:7156
- C:\Windows\System\tMjCZfu.exe
  C:\Windows\System\tMjCZfu.exe
  2⤵
  PID:5524
- C:\Windows\System\xOMIyVc.exe
  C:\Windows\System\xOMIyVc.exe
  2⤵
  PID:5336
- C:\Windows\System\DJgVNKI.exe
  C:\Windows\System\DJgVNKI.exe
  2⤵
  PID:5812
- C:\Windows\System\lAUdJuA.exe
  C:\Windows\System\lAUdJuA.exe
  2⤵
  PID:4792
- C:\Windows\System\RZJRpic.exe
  C:\Windows\System\RZJRpic.exe
  2⤵
  PID:5168
- C:\Windows\System\IQoenuS.exe
  C:\Windows\System\IQoenuS.exe
  2⤵
  PID:2228
- C:\Windows\System\rEAxNwO.exe
  C:\Windows\System\rEAxNwO.exe
  2⤵
  PID:5124
- C:\Windows\System\HOhKrFo.exe
  C:\Windows\System\HOhKrFo.exe
  2⤵
  PID:5372
- C:\Windows\System\OhHotYS.exe
  C:\Windows\System\OhHotYS.exe
  2⤵
  PID:6064
- C:\Windows\System\qvFzRay.exe
  C:\Windows\System\qvFzRay.exe
  2⤵
  PID:6160
- C:\Windows\System\zmHBrlX.exe
  C:\Windows\System\zmHBrlX.exe
  2⤵
  PID:5848
- C:\Windows\System\RNPaXOd.exe
  C:\Windows\System\RNPaXOd.exe
  2⤵
  PID:6252
- C:\Windows\System\efXrwcm.exe
  C:\Windows\System\efXrwcm.exe
  2⤵
  PID:6316
- C:\Windows\System\WoxkIBj.exe
  C:\Windows\System\WoxkIBj.exe
  2⤵
  PID:6380
- C:\Windows\System\NoSSEzv.exe
  C:\Windows\System\NoSSEzv.exe
  2⤵
  PID:6444
- C:\Windows\System\AIotnrS.exe
  C:\Windows\System\AIotnrS.exe
  2⤵
  PID:6508
- C:\Windows\System\eNnaXer.exe
  C:\Windows\System\eNnaXer.exe
  2⤵
  PID:6048
- C:\Windows\System\XJxmAQx.exe
  C:\Windows\System\XJxmAQx.exe
  2⤵
  PID:5476
- C:\Windows\System\xoKDLpJ.exe
  C:\Windows\System\xoKDLpJ.exe
  2⤵
  PID:6208
- C:\Windows\System\LWUfeWJ.exe
  C:\Windows\System\LWUfeWJ.exe
  2⤵
  PID:6272
- C:\Windows\System\aQUGLWf.exe
  C:\Windows\System\aQUGLWf.exe
  2⤵
  PID:6336
- C:\Windows\System\KFnLVMw.exe
  C:\Windows\System\KFnLVMw.exe
  2⤵
  PID:6400
- C:\Windows\System\QbsOSgD.exe
  C:\Windows\System\QbsOSgD.exe
  2⤵
  PID:6464
- C:\Windows\System\AvAaQTs.exe
  C:\Windows\System\AvAaQTs.exe
  2⤵
  PID:6528
- C:\Windows\System\CXxNcha.exe
  C:\Windows\System\CXxNcha.exe
  2⤵
  PID:6592
- C:\Windows\System\dHwDxqF.exe
  C:\Windows\System\dHwDxqF.exe
  2⤵
  PID:6656
- C:\Windows\System\umcCPHJ.exe
  C:\Windows\System\umcCPHJ.exe
  2⤵
  PID:6720
- C:\Windows\System\JgWMxFL.exe
  C:\Windows\System\JgWMxFL.exe
  2⤵
  PID:6784
- C:\Windows\System\vsPHPdV.exe
  C:\Windows\System\vsPHPdV.exe
  2⤵
  PID:6604
- C:\Windows\System\BFPVWnV.exe
  C:\Windows\System\BFPVWnV.exe
  2⤵
  PID:6876
- C:\Windows\System\CbWPsrv.exe
  C:\Windows\System\CbWPsrv.exe
  2⤵
  PID:6828
- C:\Windows\System\iUltwSp.exe
  C:\Windows\System\iUltwSp.exe
  2⤵
  PID:6640
- C:\Windows\System\AieAztx.exe
  C:\Windows\System\AieAztx.exe
  2⤵
  PID:6704
- C:\Windows\System\AdlIGjo.exe
  C:\Windows\System\AdlIGjo.exe
  2⤵
  PID:6944
- C:\Windows\System\nwzVJJT.exe
  C:\Windows\System\nwzVJJT.exe
  2⤵
  PID:7004
- C:\Windows\System\qPUHwGU.exe
  C:\Windows\System\qPUHwGU.exe
  2⤵
  PID:6736
- C:\Windows\System\QEdQEro.exe
  C:\Windows\System\QEdQEro.exe
  2⤵
  PID:6800
- C:\Windows\System\aBXXYAT.exe
  C:\Windows\System\aBXXYAT.exe
  2⤵
  PID:6896
- C:\Windows\System\gHfgPEB.exe
  C:\Windows\System\gHfgPEB.exe
  2⤵
  PID:6960
- C:\Windows\System\SenAdox.exe
  C:\Windows\System\SenAdox.exe
  2⤵
  PID:7056
- C:\Windows\System\xEdtuXt.exe
  C:\Windows\System\xEdtuXt.exe
  2⤵
  PID:7104
- C:\Windows\System\bcssCjb.exe
  C:\Windows\System\bcssCjb.exe
  2⤵
  PID:5604
- C:\Windows\System\BvyIKvM.exe
  C:\Windows\System\BvyIKvM.exe
  2⤵
  PID:5860
- C:\Windows\System\mdIftMt.exe
  C:\Windows\System\mdIftMt.exe
  2⤵
  PID:7116
- C:\Windows\System\XncFSgA.exe
  C:\Windows\System\XncFSgA.exe
  2⤵
  PID:5624
- C:\Windows\System\kBsJemK.exe
  C:\Windows\System\kBsJemK.exe
  2⤵
  PID:7052
- C:\Windows\System\rbyYjra.exe
  C:\Windows\System\rbyYjra.exe
  2⤵
  PID:6416
- C:\Windows\System\ZDAJLAq.exe
  C:\Windows\System\ZDAJLAq.exe
  2⤵
  PID:6204
- C:\Windows\System\yUrpHuT.exe
  C:\Windows\System\yUrpHuT.exe
  2⤵
  PID:7120
- C:\Windows\System\uSPAadK.exe
  C:\Windows\System\uSPAadK.exe
  2⤵
  PID:5796
- C:\Windows\System\SPQySpW.exe
  C:\Windows\System\SPQySpW.exe
  2⤵
  PID:6560
- C:\Windows\System\tAWIYFW.exe
  C:\Windows\System\tAWIYFW.exe
  2⤵
  PID:6928
- C:\Windows\System\YjxiNPM.exe
  C:\Windows\System\YjxiNPM.exe
  2⤵
  PID:5712
- C:\Windows\System\txOsJtB.exe
  C:\Windows\System\txOsJtB.exe
  2⤵
  PID:6288
- C:\Windows\System\qMMreHO.exe
  C:\Windows\System\qMMreHO.exe
  2⤵
  PID:6716
- C:\Windows\System\hkauGrd.exe
  C:\Windows\System\hkauGrd.exe
  2⤵
  PID:6572
- C:\Windows\System\LJxZwPB.exe
  C:\Windows\System\LJxZwPB.exe
  2⤵
  PID:6796
- C:\Windows\System\CwPkMrm.exe
  C:\Windows\System\CwPkMrm.exe
  2⤵
  PID:7100
- C:\Windows\System\FIadEHo.exe
  C:\Windows\System\FIadEHo.exe
  2⤵
  PID:7176
- C:\Windows\System\VzPEreW.exe
  C:\Windows\System\VzPEreW.exe
  2⤵
  PID:7192
- C:\Windows\System\WlWSHWR.exe
  C:\Windows\System\WlWSHWR.exe
  2⤵
  PID:7208
- C:\Windows\System\SETJkPV.exe
  C:\Windows\System\SETJkPV.exe
  2⤵
  PID:7224
- C:\Windows\System\bTHStJA.exe
  C:\Windows\System\bTHStJA.exe
  2⤵
  PID:7240
- C:\Windows\System\SGSbMud.exe
  C:\Windows\System\SGSbMud.exe
  2⤵
  PID:7256
- C:\Windows\System\XAUwTiP.exe
  C:\Windows\System\XAUwTiP.exe
  2⤵
  PID:7272
- C:\Windows\System\LYTndpr.exe
  C:\Windows\System\LYTndpr.exe
  2⤵
  PID:7288
- C:\Windows\System\oiIcdUP.exe
  C:\Windows\System\oiIcdUP.exe
  2⤵
  PID:7304
- C:\Windows\System\mFRRFPv.exe
  C:\Windows\System\mFRRFPv.exe
  2⤵
  PID:7320
- C:\Windows\System\yEEyUUC.exe
  C:\Windows\System\yEEyUUC.exe
  2⤵
  PID:7336
- C:\Windows\System\zWsvHcu.exe
  C:\Windows\System\zWsvHcu.exe
  2⤵
  PID:7352
- C:\Windows\System\FxPpQhS.exe
  C:\Windows\System\FxPpQhS.exe
  2⤵
  PID:7368
- C:\Windows\System\jBzUYaC.exe
  C:\Windows\System\jBzUYaC.exe
  2⤵
  PID:7384
- C:\Windows\System\MWrVJeS.exe
  C:\Windows\System\MWrVJeS.exe
  2⤵
  PID:7400
- C:\Windows\System\bxSzcGK.exe
  C:\Windows\System\bxSzcGK.exe
  2⤵
  PID:7416
- C:\Windows\System\cNmCfss.exe
  C:\Windows\System\cNmCfss.exe
  2⤵
  PID:7432
- C:\Windows\System\LGmDejF.exe
  C:\Windows\System\LGmDejF.exe
  2⤵
  PID:7448
- C:\Windows\System\YVMQuSk.exe
  C:\Windows\System\YVMQuSk.exe
  2⤵
  PID:7464
- C:\Windows\System\fiAMcjO.exe
  C:\Windows\System\fiAMcjO.exe
  2⤵
  PID:7484
- C:\Windows\System\ZJRXSrX.exe
  C:\Windows\System\ZJRXSrX.exe
  2⤵
  PID:7500
- C:\Windows\System\MyqGJdn.exe
  C:\Windows\System\MyqGJdn.exe
  2⤵
  PID:7516
- C:\Windows\System\QxlTLGH.exe
  C:\Windows\System\QxlTLGH.exe
  2⤵
  PID:7532
- C:\Windows\System\IBcjhoX.exe
  C:\Windows\System\IBcjhoX.exe
  2⤵
  PID:7548
- C:\Windows\System\DgSNySW.exe
  C:\Windows\System\DgSNySW.exe
  2⤵
  PID:7564
- C:\Windows\System\WQOXWcH.exe
  C:\Windows\System\WQOXWcH.exe
  2⤵
  PID:7580
- C:\Windows\System\qFKkfKf.exe
  C:\Windows\System\qFKkfKf.exe
  2⤵
  PID:7596
- C:\Windows\System\aLBjZSO.exe
  C:\Windows\System\aLBjZSO.exe
  2⤵
  PID:7612
- C:\Windows\System\GPLtHJm.exe
  C:\Windows\System\GPLtHJm.exe
  2⤵
  PID:7628
- C:\Windows\System\Gawrlhb.exe
  C:\Windows\System\Gawrlhb.exe
  2⤵
  PID:7644
- C:\Windows\System\exCqQoB.exe
  C:\Windows\System\exCqQoB.exe
  2⤵
  PID:7660
- C:\Windows\System\cmvxpdO.exe
  C:\Windows\System\cmvxpdO.exe
  2⤵
  PID:7676
- C:\Windows\System\zSHfmoJ.exe
  C:\Windows\System\zSHfmoJ.exe
  2⤵
  PID:7692
- C:\Windows\System\FqzOAnj.exe
  C:\Windows\System\FqzOAnj.exe
  2⤵
  PID:7708
- C:\Windows\System\aZEhPeC.exe
  C:\Windows\System\aZEhPeC.exe
  2⤵
  PID:7724
- C:\Windows\System\fBzOFwI.exe
  C:\Windows\System\fBzOFwI.exe
  2⤵
  PID:7740
- C:\Windows\System\JNrVChs.exe
  C:\Windows\System\JNrVChs.exe
  2⤵
  PID:7756
- C:\Windows\System\uPvKbpZ.exe
  C:\Windows\System\uPvKbpZ.exe
  2⤵
  PID:7772
- C:\Windows\System\MoeigjG.exe
  C:\Windows\System\MoeigjG.exe
  2⤵
  PID:7788
- C:\Windows\System\iWOqXYt.exe
  C:\Windows\System\iWOqXYt.exe
  2⤵
  PID:7804
- C:\Windows\System\vEqqtDS.exe
  C:\Windows\System\vEqqtDS.exe
  2⤵
  PID:7820
- C:\Windows\System\HMmueEg.exe
  C:\Windows\System\HMmueEg.exe
  2⤵
  PID:7836
- C:\Windows\System\usdtEXk.exe
  C:\Windows\System\usdtEXk.exe
  2⤵
  PID:7852
- C:\Windows\System\OQRsKZn.exe
  C:\Windows\System\OQRsKZn.exe
  2⤵
  PID:7868
- C:\Windows\System\XArSfSn.exe
  C:\Windows\System\XArSfSn.exe
  2⤵
  PID:7884
- C:\Windows\System\ZjQKegL.exe
  C:\Windows\System\ZjQKegL.exe
  2⤵
  PID:7900
- C:\Windows\System\Ydhtftl.exe
  C:\Windows\System\Ydhtftl.exe
  2⤵
  PID:7916
- C:\Windows\System\OwbQEar.exe
  C:\Windows\System\OwbQEar.exe
  2⤵
  PID:7932
- C:\Windows\System\LeCVIsf.exe
  C:\Windows\System\LeCVIsf.exe
  2⤵
  PID:7948
- C:\Windows\System\SXaQubl.exe
  C:\Windows\System\SXaQubl.exe
  2⤵
  PID:7964
- C:\Windows\System\BYoHfFj.exe
  C:\Windows\System\BYoHfFj.exe
  2⤵
  PID:7980
- C:\Windows\System\BSLOmcG.exe
  C:\Windows\System\BSLOmcG.exe
  2⤵
  PID:7996
- C:\Windows\System\SVwJoSK.exe
  C:\Windows\System\SVwJoSK.exe
  2⤵
  PID:8012
- C:\Windows\System\yezybqd.exe
  C:\Windows\System\yezybqd.exe
  2⤵
  PID:8028
- C:\Windows\System\XevubQf.exe
  C:\Windows\System\XevubQf.exe
  2⤵
  PID:8044
- C:\Windows\System\Lqnnoxx.exe
  C:\Windows\System\Lqnnoxx.exe
  2⤵
  PID:8060
- C:\Windows\System\fmEZhJI.exe
  C:\Windows\System\fmEZhJI.exe
  2⤵
  PID:8076
- C:\Windows\System\MqRfBMB.exe
  C:\Windows\System\MqRfBMB.exe
  2⤵
  PID:8092
- C:\Windows\System\pAVUwZC.exe
  C:\Windows\System\pAVUwZC.exe
  2⤵
  PID:8108
- C:\Windows\System\LkOzDOx.exe
  C:\Windows\System\LkOzDOx.exe
  2⤵
  PID:8124
- C:\Windows\System\McfQgJe.exe
  C:\Windows\System\McfQgJe.exe
  2⤵
  PID:8140
- C:\Windows\System\PdalHFo.exe
  C:\Windows\System\PdalHFo.exe
  2⤵
  PID:8156
- C:\Windows\System\nTStYfi.exe
  C:\Windows\System\nTStYfi.exe
  2⤵
  PID:8172
- C:\Windows\System\mhIGbcK.exe
  C:\Windows\System\mhIGbcK.exe
  2⤵
  PID:8188
- C:\Windows\System\XZudVbm.exe
  C:\Windows\System\XZudVbm.exe
  2⤵
  PID:6100
- C:\Windows\System\PQjedYi.exe
  C:\Windows\System\PQjedYi.exe
  2⤵
  PID:7172
- C:\Windows\System\YBLyHGv.exe
  C:\Windows\System\YBLyHGv.exe
  2⤵
  PID:6556
- C:\Windows\System\zLXkwbA.exe
  C:\Windows\System\zLXkwbA.exe
  2⤵
  PID:6116
- C:\Windows\System\ErrEmaA.exe
  C:\Windows\System\ErrEmaA.exe
  2⤵
  PID:6480
- C:\Windows\System\zPZEObX.exe
  C:\Windows\System\zPZEObX.exe
  2⤵
  PID:6268
- C:\Windows\System\tDbbPPb.exe
  C:\Windows\System\tDbbPPb.exe
  2⤵
  PID:6524
- C:\Windows\System\VtgXjDi.exe
  C:\Windows\System\VtgXjDi.exe
  2⤵
  PID:6752
- C:\Windows\System\ohivZZa.exe
  C:\Windows\System\ohivZZa.exe
  2⤵
  PID:6912
- C:\Windows\System\cSLFUtc.exe
  C:\Windows\System\cSLFUtc.exe
  2⤵
  PID:6860
- C:\Windows\System\hgtfWCg.exe
  C:\Windows\System\hgtfWCg.exe
  2⤵
  PID:7232
- C:\Windows\System\PbIIbic.exe
  C:\Windows\System\PbIIbic.exe
  2⤵
  PID:7296
- C:\Windows\System\gyfWBHe.exe
  C:\Windows\System\gyfWBHe.exe
  2⤵
  PID:6016
- C:\Windows\System\tZAvoHB.exe
  C:\Windows\System\tZAvoHB.exe
  2⤵
  PID:5864
- C:\Windows\System\fvoPbRo.exe
  C:\Windows\System\fvoPbRo.exe
  2⤵
  PID:6544
- C:\Windows\System\zBYsGIp.exe
  C:\Windows\System\zBYsGIp.exe
  2⤵
  PID:6672
- C:\Windows\System\DmgtwrK.exe
  C:\Windows\System\DmgtwrK.exe
  2⤵
  PID:7216
- C:\Windows\System\OKXYSVk.exe
  C:\Windows\System\OKXYSVk.exe
  2⤵
  PID:7364
- C:\Windows\System\tprjXbQ.exe
  C:\Windows\System\tprjXbQ.exe
  2⤵
  PID:7428
- C:\Windows\System\nNjfsoq.exe
  C:\Windows\System\nNjfsoq.exe
  2⤵
  PID:7376
- C:\Windows\System\Sodcyom.exe
  C:\Windows\System\Sodcyom.exe
  2⤵
  PID:7248
- C:\Windows\System\OSbZaVR.exe
  C:\Windows\System\OSbZaVR.exe
  2⤵
  PID:7312
- C:\Windows\System\iQrZysK.exe
  C:\Windows\System\iQrZysK.exe
  2⤵
  PID:7524
- C:\Windows\System\UZAdcFT.exe
  C:\Windows\System\UZAdcFT.exe
  2⤵
  PID:7588
- C:\Windows\System\PuZxJuB.exe
  C:\Windows\System\PuZxJuB.exe
  2⤵
  PID:7652
- C:\Windows\System\lGRkcQA.exe
  C:\Windows\System\lGRkcQA.exe
  2⤵
  PID:7716
- C:\Windows\System\JbwVcKH.exe
  C:\Windows\System\JbwVcKH.exe
  2⤵
  PID:7440
- C:\Windows\System\IbPKBoE.exe
  C:\Windows\System\IbPKBoE.exe
  2⤵
  PID:7752
- C:\Windows\System\YrOgJTf.exe
  C:\Windows\System\YrOgJTf.exe
  2⤵
  PID:7668
- C:\Windows\System\TygjXTH.exe
  C:\Windows\System\TygjXTH.exe
  2⤵
  PID:7512
- C:\Windows\System\myNYZgr.exe
  C:\Windows\System\myNYZgr.exe
  2⤵
  PID:7576
- C:\Windows\System\OVnrXhK.exe
  C:\Windows\System\OVnrXhK.exe
  2⤵
  PID:7704
- C:\Windows\System\ZUcblBh.exe
  C:\Windows\System\ZUcblBh.exe
  2⤵
  PID:7780
- C:\Windows\System\ZAqRcEr.exe
  C:\Windows\System\ZAqRcEr.exe
  2⤵
  PID:7816
- C:\Windows\System\TMYSTeV.exe
  C:\Windows\System\TMYSTeV.exe
  2⤵
  PID:7880
- C:\Windows\System\rmKvUwP.exe
  C:\Windows\System\rmKvUwP.exe
  2⤵
  PID:7796
- C:\Windows\System\saZridI.exe
  C:\Windows\System\saZridI.exe
  2⤵
  PID:7864
- C:\Windows\System\MAgTbbt.exe
  C:\Windows\System\MAgTbbt.exe
  2⤵
  PID:7892
- C:\Windows\System\tVDJvPq.exe
  C:\Windows\System\tVDJvPq.exe
  2⤵
  PID:8008
- C:\Windows\System\oHrbSjy.exe
  C:\Windows\System\oHrbSjy.exe
  2⤵
  PID:8036
- C:\Windows\System\OScOZwG.exe
  C:\Windows\System\OScOZwG.exe
  2⤵
  PID:8020
- C:\Windows\System\VRgxlrP.exe
  C:\Windows\System\VRgxlrP.exe
  2⤵
  PID:8104
- C:\Windows\System\mFYMxSp.exe
  C:\Windows\System\mFYMxSp.exe
  2⤵
  PID:8168
- C:\Windows\System\ENevsRT.exe
  C:\Windows\System\ENevsRT.exe
  2⤵
  PID:5196
- C:\Windows\System\SVshJdc.exe
  C:\Windows\System\SVshJdc.exe
  2⤵
  PID:8052
- C:\Windows\System\LidbDRT.exe
  C:\Windows\System\LidbDRT.exe
  2⤵
  PID:8116
- C:\Windows\System\DhrJeBt.exe
  C:\Windows\System\DhrJeBt.exe
  2⤵
  PID:8180
- C:\Windows\System\IeIqVSt.exe
  C:\Windows\System\IeIqVSt.exe
  2⤵
  PID:5876
- C:\Windows\System\HEOrPVw.exe
  C:\Windows\System\HEOrPVw.exe
  2⤵
  PID:6396
- C:\Windows\System\yNVtpIz.exe
  C:\Windows\System\yNVtpIz.exe
  2⤵
  PID:6496
- C:\Windows\System\EvikBTv.exe
  C:\Windows\System\EvikBTv.exe
  2⤵
  PID:7136
- C:\Windows\System\ncBarlz.exe
  C:\Windows\System\ncBarlz.exe
  2⤵
  PID:7184
- C:\Windows\System\djeKnWI.exe
  C:\Windows\System\djeKnWI.exe
  2⤵
  PID:7380
- C:\Windows\System\xypIXZa.exe
  C:\Windows\System\xypIXZa.exe
  2⤵
  PID:7620
- C:\Windows\System\HekkVVd.exe
  C:\Windows\System\HekkVVd.exe
  2⤵
  PID:7604
- C:\Windows\System\QqUnFrT.exe
  C:\Windows\System\QqUnFrT.exe
  2⤵
  PID:7736
- C:\Windows\System\GaHqUhD.exe
  C:\Windows\System\GaHqUhD.exe
  2⤵
  PID:7832
- C:\Windows\System\PQUuMVM.exe
  C:\Windows\System\PQUuMVM.exe
  2⤵
  PID:7988
- C:\Windows\System\NzkgvaZ.exe
  C:\Windows\System\NzkgvaZ.exe
  2⤵
  PID:6476
- C:\Windows\System\iYxKFqu.exe
  C:\Windows\System\iYxKFqu.exe
  2⤵
  PID:8152
- C:\Windows\System\ykXRbnp.exe
  C:\Windows\System\ykXRbnp.exe
  2⤵
  PID:7024
- C:\Windows\System\XYtGhOZ.exe
  C:\Windows\System\XYtGhOZ.exe
  2⤵
  PID:7764
- C:\Windows\System\TgmBjMh.exe
  C:\Windows\System\TgmBjMh.exe
  2⤵
  PID:7020
- C:\Windows\System\TxrMkzR.exe
  C:\Windows\System\TxrMkzR.exe
  2⤵
  PID:6976
- C:\Windows\System\ukNFylV.exe
  C:\Windows\System\ukNFylV.exe
  2⤵
  PID:7360
- C:\Windows\System\enYxtPu.exe
  C:\Windows\System\enYxtPu.exe
  2⤵
  PID:7556
- C:\Windows\System\sSPwLuS.exe
  C:\Windows\System\sSPwLuS.exe
  2⤵
  PID:7748
- C:\Windows\System\fXqCfzY.exe
  C:\Windows\System\fXqCfzY.exe
  2⤵
  PID:7812
- C:\Windows\System\MjYiSpf.exe
  C:\Windows\System\MjYiSpf.exe
  2⤵
  PID:7960
- C:\Windows\System\ZxbnkTn.exe
  C:\Windows\System\ZxbnkTn.exe
  2⤵
  PID:8084
- C:\Windows\System\rVeKpmK.exe
  C:\Windows\System\rVeKpmK.exe
  2⤵
  PID:448
- C:\Windows\System\rCqnTrY.exe
  C:\Windows\System\rCqnTrY.exe
  2⤵
  PID:7348
- C:\Windows\System\heDkpOq.exe
  C:\Windows\System\heDkpOq.exe
  2⤵
  PID:8164
- C:\Windows\System\uzWTBRs.exe
  C:\Windows\System\uzWTBRs.exe
  2⤵
  PID:6220
- C:\Windows\System\qvieFPL.exe
  C:\Windows\System\qvieFPL.exe
  2⤵
  PID:7688
- C:\Windows\System\apmSPQL.exe
  C:\Windows\System\apmSPQL.exe
  2⤵
  PID:8208
- C:\Windows\System\LzZUoLZ.exe
  C:\Windows\System\LzZUoLZ.exe
  2⤵
  PID:8228
- C:\Windows\System\SSYCpPh.exe
  C:\Windows\System\SSYCpPh.exe
  2⤵
  PID:8244
- C:\Windows\System\WvHOzVm.exe
  C:\Windows\System\WvHOzVm.exe
  2⤵
  PID:8260
- C:\Windows\System\gSrGugP.exe
  C:\Windows\System\gSrGugP.exe
  2⤵
  PID:8276
- C:\Windows\System\wklfFmO.exe
  C:\Windows\System\wklfFmO.exe
  2⤵
  PID:8292
- C:\Windows\System\sxcfYgS.exe
  C:\Windows\System\sxcfYgS.exe
  2⤵
  PID:8308
- C:\Windows\System\jbalcUg.exe
  C:\Windows\System\jbalcUg.exe
  2⤵
  PID:8324
- C:\Windows\System\tOdYRpQ.exe
  C:\Windows\System\tOdYRpQ.exe
  2⤵
  PID:8340
- C:\Windows\System\eoDCYzc.exe
  C:\Windows\System\eoDCYzc.exe
  2⤵
  PID:8356
- C:\Windows\System\zbbHJGR.exe
  C:\Windows\System\zbbHJGR.exe
  2⤵
  PID:8372
- C:\Windows\System\MqjDzjg.exe
  C:\Windows\System\MqjDzjg.exe
  2⤵
  PID:8388
- C:\Windows\System\FRtXNsr.exe
  C:\Windows\System\FRtXNsr.exe
  2⤵
  PID:8404
- C:\Windows\System\pVwcVOs.exe
  C:\Windows\System\pVwcVOs.exe
  2⤵
  PID:8420
- C:\Windows\System\csiZJlQ.exe
  C:\Windows\System\csiZJlQ.exe
  2⤵
  PID:8436
- C:\Windows\System\ZawQIxx.exe
  C:\Windows\System\ZawQIxx.exe
  2⤵
  PID:8452
- C:\Windows\System\EYvnBKH.exe
  C:\Windows\System\EYvnBKH.exe
  2⤵
  PID:8468
- C:\Windows\System\OPTLiKU.exe
  C:\Windows\System\OPTLiKU.exe
  2⤵
  PID:8484
- C:\Windows\System\qgzpRQt.exe
  C:\Windows\System\qgzpRQt.exe
  2⤵
  PID:8500
- C:\Windows\System\WABblKs.exe
  C:\Windows\System\WABblKs.exe
  2⤵
  PID:8516
- C:\Windows\System\hbMmozs.exe
  C:\Windows\System\hbMmozs.exe
  2⤵
  PID:8532
- C:\Windows\System\OwVqoqf.exe
  C:\Windows\System\OwVqoqf.exe
  2⤵
  PID:8548
- C:\Windows\System\xixsvlO.exe
  C:\Windows\System\xixsvlO.exe
  2⤵
  PID:8564
- C:\Windows\System\SYzqgSg.exe
  C:\Windows\System\SYzqgSg.exe
  2⤵
  PID:8580
- C:\Windows\System\GmlOIUc.exe
  C:\Windows\System\GmlOIUc.exe
  2⤵
  PID:8596
- C:\Windows\System\CgRSdeL.exe
  C:\Windows\System\CgRSdeL.exe
  2⤵
  PID:8612
- C:\Windows\System\EfHNzaX.exe
  C:\Windows\System\EfHNzaX.exe
  2⤵
  PID:8628
- C:\Windows\System\hphcIgx.exe
  C:\Windows\System\hphcIgx.exe
  2⤵
  PID:8644
- C:\Windows\System\GMmemrV.exe
  C:\Windows\System\GMmemrV.exe
  2⤵
  PID:8660
- C:\Windows\System\GSpVNhf.exe
  C:\Windows\System\GSpVNhf.exe
  2⤵
  PID:8676
- C:\Windows\System\zdwwvgF.exe
  C:\Windows\System\zdwwvgF.exe
  2⤵
  PID:8692
- C:\Windows\System\QArfmNL.exe
  C:\Windows\System\QArfmNL.exe
  2⤵
  PID:8708
- C:\Windows\System\EQypfMh.exe
  C:\Windows\System\EQypfMh.exe
  2⤵
  PID:8724
- C:\Windows\System\ZpKtduB.exe
  C:\Windows\System\ZpKtduB.exe
  2⤵
  PID:8740
- C:\Windows\System\yawvnlv.exe
  C:\Windows\System\yawvnlv.exe
  2⤵
  PID:8756
- C:\Windows\System\CReSniI.exe
  C:\Windows\System\CReSniI.exe
  2⤵
  PID:8772
- C:\Windows\System\rxBIQVD.exe
  C:\Windows\System\rxBIQVD.exe
  2⤵
  PID:8788
- C:\Windows\System\lrsRuGS.exe
  C:\Windows\System\lrsRuGS.exe
  2⤵
  PID:8804
- C:\Windows\System\TrxEPed.exe
  C:\Windows\System\TrxEPed.exe
  2⤵
  PID:8820
- C:\Windows\System\OYkbSvQ.exe
  C:\Windows\System\OYkbSvQ.exe
  2⤵
  PID:8836
- C:\Windows\System\koGdLWh.exe
  C:\Windows\System\koGdLWh.exe
  2⤵
  PID:8852
- C:\Windows\System\fAaYQAC.exe
  C:\Windows\System\fAaYQAC.exe
  2⤵
  PID:8872
- C:\Windows\System\vdbubzo.exe
  C:\Windows\System\vdbubzo.exe
  2⤵
  PID:8888
- C:\Windows\System\DTzmtnD.exe
  C:\Windows\System\DTzmtnD.exe
  2⤵
  PID:8904
- C:\Windows\System\tqBIjbM.exe
  C:\Windows\System\tqBIjbM.exe
  2⤵
  PID:8920
- C:\Windows\System\ngAKLFU.exe
  C:\Windows\System\ngAKLFU.exe
  2⤵
  PID:8936
- C:\Windows\System\Gdtiuza.exe
  C:\Windows\System\Gdtiuza.exe
  2⤵
  PID:8952
- C:\Windows\System\nMGbdDR.exe
  C:\Windows\System\nMGbdDR.exe
  2⤵
  PID:8968
- C:\Windows\System\nyaCchE.exe
  C:\Windows\System\nyaCchE.exe
  2⤵
  PID:8984
- C:\Windows\System\MIZvBwL.exe
  C:\Windows\System\MIZvBwL.exe
  2⤵
  PID:9000
- C:\Windows\System\hlEVjTP.exe
  C:\Windows\System\hlEVjTP.exe
  2⤵
  PID:9016
- C:\Windows\System\fdaGAHQ.exe
  C:\Windows\System\fdaGAHQ.exe
  2⤵
  PID:9032
- C:\Windows\System\ACXrbwX.exe
  C:\Windows\System\ACXrbwX.exe
  2⤵
  PID:9048
- C:\Windows\System\EwsLnAJ.exe
  C:\Windows\System\EwsLnAJ.exe
  2⤵
  PID:9064
- C:\Windows\System\UbiBDcM.exe
  C:\Windows\System\UbiBDcM.exe
  2⤵
  PID:9080
- C:\Windows\System\ylqxoma.exe
  C:\Windows\System\ylqxoma.exe
  2⤵
  PID:9096
- C:\Windows\System\gWkSnHu.exe
  C:\Windows\System\gWkSnHu.exe
  2⤵
  PID:9112
- C:\Windows\System\NmuOAhC.exe
  C:\Windows\System\NmuOAhC.exe
  2⤵
  PID:9128
- C:\Windows\System\ikdNejX.exe
  C:\Windows\System\ikdNejX.exe
  2⤵
  PID:9144
- C:\Windows\System\yMfdpuN.exe
  C:\Windows\System\yMfdpuN.exe
  2⤵
  PID:9160
- C:\Windows\System\JumgEcB.exe
  C:\Windows\System\JumgEcB.exe
  2⤵
  PID:9176
- C:\Windows\System\tMEchjQ.exe
  C:\Windows\System\tMEchjQ.exe
  2⤵
  PID:9192
- C:\Windows\System\gvqBEnY.exe
  C:\Windows\System\gvqBEnY.exe
  2⤵
  PID:9208
- C:\Windows\System\VeircgQ.exe
  C:\Windows\System\VeircgQ.exe
  2⤵
  PID:6816
- C:\Windows\System\voEgTqf.exe
  C:\Windows\System\voEgTqf.exe
  2⤵
  PID:7876
- C:\Windows\System\arPSZBX.exe
  C:\Windows\System\arPSZBX.exe
  2⤵
  PID:8220
- C:\Windows\System\shDbCfG.exe
  C:\Windows\System\shDbCfG.exe
  2⤵
  PID:8284
- C:\Windows\System\hPCVicG.exe
  C:\Windows\System\hPCVicG.exe
  2⤵
  PID:8348
- C:\Windows\System\tCXwTxU.exe
  C:\Windows\System\tCXwTxU.exe
  2⤵
  PID:8412
- C:\Windows\System\zElsWom.exe
  C:\Windows\System\zElsWom.exe
  2⤵
  PID:8476
- C:\Windows\System\ORLxxlg.exe
  C:\Windows\System\ORLxxlg.exe
  2⤵
  PID:8540
- C:\Windows\System\gGfqyJZ.exe
  C:\Windows\System\gGfqyJZ.exe
  2⤵
  PID:8604
- C:\Windows\System\VZqMSWG.exe
  C:\Windows\System\VZqMSWG.exe
  2⤵
  PID:8668
- C:\Windows\System\vbhwlQx.exe
  C:\Windows\System\vbhwlQx.exe
  2⤵
  PID:8736
- C:\Windows\System\duCojid.exe
  C:\Windows\System\duCojid.exe
  2⤵
  PID:8768
- C:\Windows\System\TQMGGEd.exe
  C:\Windows\System\TQMGGEd.exe
  2⤵
  PID:8832
- C:\Windows\System\mIgulVq.exe
  C:\Windows\System\mIgulVq.exe
  2⤵
  PID:7544
- C:\Windows\System\VZlFASZ.exe
  C:\Windows\System\VZlFASZ.exe
  2⤵
  PID:8556
- C:\Windows\System\XRPfnYw.exe
  C:\Windows\System\XRPfnYw.exe
  2⤵
  PID:8812
- C:\Windows\System\QDEzxQc.exe
  C:\Windows\System\QDEzxQc.exe
  2⤵
  PID:7956
- C:\Windows\System\zrrTxbz.exe
  C:\Windows\System\zrrTxbz.exe
  2⤵
  PID:8368
- C:\Windows\System\oCBQRMY.exe
  C:\Windows\System\oCBQRMY.exe
  2⤵
  PID:7700
- C:\Windows\System\jDJSLMD.exe
  C:\Windows\System\jDJSLMD.exe
  2⤵
  PID:8524
- C:\Windows\System\OJdSzmR.exe
  C:\Windows\System\OJdSzmR.exe
  2⤵
  PID:7640
- C:\Windows\System\kJPdqve.exe
  C:\Windows\System\kJPdqve.exe
  2⤵
  PID:8780
- C:\Windows\System\kpVAnCx.exe
  C:\Windows\System\kpVAnCx.exe
  2⤵
  PID:8464
- C:\Windows\System\uHKokNA.exe
  C:\Windows\System\uHKokNA.exe
  2⤵
  PID:8560
- C:\Windows\System\UZWccON.exe
  C:\Windows\System\UZWccON.exe
  2⤵
  PID:8624
- C:\Windows\System\qTbbbAi.exe
  C:\Windows\System\qTbbbAi.exe
  2⤵
  PID:8716
- C:\Windows\System\NFNKaOF.exe
  C:\Windows\System\NFNKaOF.exe
  2⤵
  PID:8816
- C:\Windows\System\ywmTkbO.exe
  C:\Windows\System\ywmTkbO.exe
  2⤵
  PID:8300
- C:\Windows\System\BlUUwff.exe
  C:\Windows\System\BlUUwff.exe
  2⤵
  PID:8868
- C:\Windows\System\QYehhRU.exe
  C:\Windows\System\QYehhRU.exe
  2⤵
  PID:8932
- C:\Windows\System\pzhiVRt.exe
  C:\Windows\System\pzhiVRt.exe
  2⤵
  PID:8996
- C:\Windows\System\KZJwfKm.exe
  C:\Windows\System\KZJwfKm.exe
  2⤵
  PID:8884
- C:\Windows\System\lpwTzcm.exe
  C:\Windows\System\lpwTzcm.exe
  2⤵
  PID:8916
- C:\Windows\System\OtRStcH.exe
  C:\Windows\System\OtRStcH.exe
  2⤵
  PID:9012
- C:\Windows\System\UpNSfRh.exe
  C:\Windows\System\UpNSfRh.exe
  2⤵
  PID:9092
- C:\Windows\System\ccbyQgV.exe
  C:\Windows\System\ccbyQgV.exe
  2⤵
  PID:9040
- C:\Windows\System\hRKrfNv.exe
  C:\Windows\System\hRKrfNv.exe
  2⤵
  PID:9076
- C:\Windows\System\CnkyEhT.exe
  C:\Windows\System\CnkyEhT.exe
  2⤵
  PID:9140
- C:\Windows\System\OPGFNSN.exe
  C:\Windows\System\OPGFNSN.exe
  2⤵
  PID:7976
- C:\Windows\System\LESzGGO.exe
  C:\Windows\System\LESzGGO.exe
  2⤵
  PID:9200
- C:\Windows\System\Kyelcct.exe
  C:\Windows\System\Kyelcct.exe
  2⤵
  PID:8448
- C:\Windows\System\rVHqgOI.exe
  C:\Windows\System\rVHqgOI.exe
  2⤵
  PID:8252
- C:\Windows\System\eZPDDbf.exe
  C:\Windows\System\eZPDDbf.exe
  2⤵
  PID:8380
- C:\Windows\System\OxsGzRD.exe
  C:\Windows\System\OxsGzRD.exe
  2⤵
  PID:8508
- C:\Windows\System\UjqqTqc.exe
  C:\Windows\System\UjqqTqc.exe
  2⤵
  PID:8004
- C:\Windows\System\OlAJHYI.exe
  C:\Windows\System\OlAJHYI.exe
  2⤵
  PID:7280
- C:\Windows\System\bkJNHwN.exe
  C:\Windows\System\bkJNHwN.exe
  2⤵
  PID:8432
- C:\Windows\System\VmraZLX.exe
  C:\Windows\System\VmraZLX.exe
  2⤵
  PID:8752
- C:\Windows\System\yyjMYEe.exe
  C:\Windows\System\yyjMYEe.exe
  2⤵
  PID:8992
- C:\Windows\System\TaXauAz.exe
  C:\Windows\System\TaXauAz.exe
  2⤵
  PID:8636
- C:\Windows\System\uLbpxuR.exe
  C:\Windows\System\uLbpxuR.exe
  2⤵
  PID:7496
- C:\Windows\System\pLpPdEK.exe
  C:\Windows\System\pLpPdEK.exe
  2⤵
  PID:8332
- C:\Windows\System\saDXffq.exe
  C:\Windows\System\saDXffq.exe
  2⤵
  PID:8496
- C:\Windows\System\deIHkiB.exe
  C:\Windows\System\deIHkiB.exe
  2⤵
  PID:8304
- C:\Windows\System\QyZoIOT.exe
  C:\Windows\System\QyZoIOT.exe
  2⤵
  PID:8976
- C:\Windows\System\TyWFjKK.exe
  C:\Windows\System\TyWFjKK.exe
  2⤵
  PID:9088
- C:\Windows\System\jBIdRlg.exe
  C:\Windows\System\jBIdRlg.exe
  2⤵
  PID:7972
- C:\Windows\System\kxtRims.exe
  C:\Windows\System\kxtRims.exe
  2⤵
  PID:9156
- C:\Windows\System\WUWuwjb.exe
  C:\Windows\System\WUWuwjb.exe
  2⤵
  PID:8704
- C:\Windows\System\xSFqUfQ.exe
  C:\Windows\System\xSFqUfQ.exe
  2⤵
  PID:8320
- C:\Windows\System\ESteokD.exe
  C:\Windows\System\ESteokD.exe
  2⤵
  PID:7572
- C:\Windows\System\LiGyATF.exe
  C:\Windows\System\LiGyATF.exe
  2⤵
  PID:8964
- C:\Windows\System\fcgWJDr.exe
  C:\Windows\System\fcgWJDr.exe
  2⤵
  PID:8732
- C:\Windows\System\TPEfVmj.exe
  C:\Windows\System\TPEfVmj.exe
  2⤵
  PID:8148
- C:\Windows\System\SIJfzVd.exe
  C:\Windows\System\SIJfzVd.exe
  2⤵
  PID:7220
- C:\Windows\System\yelcgnx.exe
  C:\Windows\System\yelcgnx.exe
  2⤵
  PID:8684
- C:\Windows\System\hHXYUMt.exe
  C:\Windows\System\hHXYUMt.exe
  2⤵
  PID:7204
- C:\Windows\System\tqljTWM.exe
  C:\Windows\System\tqljTWM.exe
  2⤵
  PID:5212
- C:\Windows\System\FDPsiwi.exe
  C:\Windows\System\FDPsiwi.exe
  2⤵
  PID:8912
- C:\Windows\System\CGgTDkU.exe
  C:\Windows\System\CGgTDkU.exe
  2⤵
  PID:8572
- C:\Windows\System\QBMoDyM.exe
  C:\Windows\System\QBMoDyM.exe
  2⤵
  PID:8980
- C:\Windows\System\ZMGIjQQ.exe
  C:\Windows\System\ZMGIjQQ.exe
  2⤵
  PID:8336
- C:\Windows\System\LLIlEBg.exe
  C:\Windows\System\LLIlEBg.exe
  2⤵
  PID:9228
- C:\Windows\System\XFxXuyK.exe
  C:\Windows\System\XFxXuyK.exe
  2⤵
  PID:9244
- C:\Windows\System\gZgrfiO.exe
  C:\Windows\System\gZgrfiO.exe
  2⤵
  PID:9260
- C:\Windows\System\ePlAFJP.exe
  C:\Windows\System\ePlAFJP.exe
  2⤵
  PID:9276
- C:\Windows\System\NiydnKG.exe
  C:\Windows\System\NiydnKG.exe
  2⤵
  PID:9292
- C:\Windows\System\IPLiuzQ.exe
  C:\Windows\System\IPLiuzQ.exe
  2⤵
  PID:9308
- C:\Windows\System\swVxLBb.exe
  C:\Windows\System\swVxLBb.exe
  2⤵
  PID:9324
- C:\Windows\System\mZaqMRK.exe
  C:\Windows\System\mZaqMRK.exe
  2⤵
  PID:9340
- C:\Windows\System\RqLHyrU.exe
  C:\Windows\System\RqLHyrU.exe
  2⤵
  PID:9356
- C:\Windows\System\HotmmIl.exe
  C:\Windows\System\HotmmIl.exe
  2⤵
  PID:9372
- C:\Windows\System\etLYmSv.exe
  C:\Windows\System\etLYmSv.exe
  2⤵
  PID:9388
- C:\Windows\System\uNGlhVv.exe
  C:\Windows\System\uNGlhVv.exe
  2⤵
  PID:9404
- C:\Windows\System\PFryHvw.exe
  C:\Windows\System\PFryHvw.exe
  2⤵
  PID:9424
- C:\Windows\System\fzOJCsX.exe
  C:\Windows\System\fzOJCsX.exe
  2⤵
  PID:9444
- C:\Windows\System\RckkKyd.exe
  C:\Windows\System\RckkKyd.exe
  2⤵
  PID:9460
- C:\Windows\System\msgovGR.exe
  C:\Windows\System\msgovGR.exe
  2⤵
  PID:9480
- C:\Windows\System\DlDxJpL.exe
  C:\Windows\System\DlDxJpL.exe
  2⤵
  PID:9500
- C:\Windows\System\ppzcrbZ.exe
  C:\Windows\System\ppzcrbZ.exe
  2⤵
  PID:9516
- C:\Windows\System\YRLeJiK.exe
  C:\Windows\System\YRLeJiK.exe
  2⤵
  PID:9532
- C:\Windows\System\GqdbMRq.exe
  C:\Windows\System\GqdbMRq.exe
  2⤵
  PID:9548
- C:\Windows\System\uNAVOII.exe
  C:\Windows\System\uNAVOII.exe
  2⤵
  PID:9568
- C:\Windows\System\mMWhuVt.exe
  C:\Windows\System\mMWhuVt.exe
  2⤵
  PID:9584
- C:\Windows\System\mhcdKhU.exe
  C:\Windows\System\mhcdKhU.exe
  2⤵
  PID:9600
- C:\Windows\System\Esnptue.exe
  C:\Windows\System\Esnptue.exe
  2⤵
  PID:9616
- C:\Windows\System\PPxPInq.exe
  C:\Windows\System\PPxPInq.exe
  2⤵
  PID:9632
- C:\Windows\System\WvUFYvn.exe
  C:\Windows\System\WvUFYvn.exe
  2⤵
  PID:9648
- C:\Windows\System\vpFLUFT.exe
  C:\Windows\System\vpFLUFT.exe
  2⤵
  PID:9668
- C:\Windows\System\TTRLRcM.exe
  C:\Windows\System\TTRLRcM.exe
  2⤵
  PID:9684
- C:\Windows\System\gRXJMOs.exe
  C:\Windows\System\gRXJMOs.exe
  2⤵
  PID:9700
- C:\Windows\System\JEUpHmX.exe
  C:\Windows\System\JEUpHmX.exe
  2⤵
  PID:9716
- C:\Windows\System\EVHEFOZ.exe
  C:\Windows\System\EVHEFOZ.exe
  2⤵
  PID:9736
- C:\Windows\System\IQEOszS.exe
  C:\Windows\System\IQEOszS.exe
  2⤵
  PID:9752
- C:\Windows\System\ghKKyEl.exe
  C:\Windows\System\ghKKyEl.exe
  2⤵
  PID:9772
- C:\Windows\System\BAaaBWI.exe
  C:\Windows\System\BAaaBWI.exe
  2⤵
  PID:9788
- C:\Windows\System\JNtaVlf.exe
  C:\Windows\System\JNtaVlf.exe
  2⤵
  PID:9804
- C:\Windows\System\UKslEyr.exe
  C:\Windows\System\UKslEyr.exe
  2⤵
  PID:9820
- C:\Windows\System\kevxvvU.exe
  C:\Windows\System\kevxvvU.exe
  2⤵
  PID:9836
- C:\Windows\System\rkxjKzc.exe
  C:\Windows\System\rkxjKzc.exe
  2⤵
  PID:9852
- C:\Windows\System\wZByWjo.exe
  C:\Windows\System\wZByWjo.exe
  2⤵
  PID:9868
- C:\Windows\System\NiLjbtj.exe
  C:\Windows\System\NiLjbtj.exe
  2⤵
  PID:9884
- C:\Windows\System\ohogDoR.exe
  C:\Windows\System\ohogDoR.exe
  2⤵
  PID:9900
- C:\Windows\System\hoQQRvX.exe
  C:\Windows\System\hoQQRvX.exe
  2⤵
  PID:9916
- C:\Windows\System\AxWxrFN.exe
  C:\Windows\System\AxWxrFN.exe
  2⤵
  PID:9932
- C:\Windows\System\bTuADQi.exe
  C:\Windows\System\bTuADQi.exe
  2⤵
  PID:9948
- C:\Windows\System\kWqCMFL.exe
  C:\Windows\System\kWqCMFL.exe
  2⤵
  PID:9964
- C:\Windows\System\CdOfYiG.exe
  C:\Windows\System\CdOfYiG.exe
  2⤵
  PID:9980
- C:\Windows\System\KmGXdMR.exe
  C:\Windows\System\KmGXdMR.exe
  2⤵
  PID:10008
- C:\Windows\System\hkWitiW.exe
  C:\Windows\System\hkWitiW.exe
  2⤵
  PID:10028
- C:\Windows\System\xANzKVO.exe
  C:\Windows\System\xANzKVO.exe
  2⤵
  PID:10044
- C:\Windows\System\CrZzqNv.exe
  C:\Windows\System\CrZzqNv.exe
  2⤵
  PID:10060
- C:\Windows\System\rXWOOPI.exe
  C:\Windows\System\rXWOOPI.exe
  2⤵
  PID:10076
- C:\Windows\System\TphdDqv.exe
  C:\Windows\System\TphdDqv.exe
  2⤵
  PID:10092
- C:\Windows\System\ffrbdwP.exe
  C:\Windows\System\ffrbdwP.exe
  2⤵
  PID:10108
- C:\Windows\System\dODMunU.exe
  C:\Windows\System\dODMunU.exe
  2⤵
  PID:10124
- C:\Windows\System\zCLPePy.exe
  C:\Windows\System\zCLPePy.exe
  2⤵
  PID:10140
- C:\Windows\System\ZiOygPN.exe
  C:\Windows\System\ZiOygPN.exe
  2⤵
  PID:10156
- C:\Windows\System\KHwqixM.exe
  C:\Windows\System\KHwqixM.exe
  2⤵
  PID:10176
- C:\Windows\System\IcBuIHz.exe
  C:\Windows\System\IcBuIHz.exe
  2⤵
  PID:10192
- C:\Windows\System\pTHUyip.exe
  C:\Windows\System\pTHUyip.exe
  2⤵
  PID:10208
- C:\Windows\System\roimARU.exe
  C:\Windows\System\roimARU.exe
  2⤵
  PID:10224
- C:\Windows\System\YmoVNNJ.exe
  C:\Windows\System\YmoVNNJ.exe
  2⤵
  PID:9220
- C:\Windows\System\TFyONsw.exe
  C:\Windows\System\TFyONsw.exe
  2⤵
  PID:9152
- C:\Windows\System\YczWlYG.exe
  C:\Windows\System\YczWlYG.exe
  2⤵
  PID:9284
- C:\Windows\System\fiHsAkj.exe
  C:\Windows\System\fiHsAkj.exe
  2⤵
  PID:9348
- C:\Windows\System\EJILOtM.exe
  C:\Windows\System\EJILOtM.exe
  2⤵
  PID:9412
- C:\Windows\System\nnxIzir.exe
  C:\Windows\System\nnxIzir.exe
  2⤵
  PID:9008
- C:\Windows\System\FAVDIqN.exe
  C:\Windows\System\FAVDIqN.exe
  2⤵
  PID:9368
- C:\Windows\System\EJeWjhJ.exe
  C:\Windows\System\EJeWjhJ.exe
  2⤵
  PID:8204
- C:\Windows\System\cchVSSp.exe
  C:\Windows\System\cchVSSp.exe
  2⤵
  PID:9304
- C:\Windows\System\dawqizp.exe
  C:\Windows\System\dawqizp.exe
  2⤵
  PID:9364
- C:\Windows\System\woNYroa.exe
  C:\Windows\System\woNYroa.exe
  2⤵
  PID:9416
- C:\Windows\System\hpCheXc.exe
  C:\Windows\System\hpCheXc.exe
  2⤵
  PID:9488
- C:\Windows\System\UfNffRh.exe
  C:\Windows\System\UfNffRh.exe
  2⤵
  PID:9528
- C:\Windows\System\eKfLOto.exe
  C:\Windows\System\eKfLOto.exe
  2⤵
  PID:9560
- C:\Windows\System\woTGhvF.exe
  C:\Windows\System\woTGhvF.exe
  2⤵
  PID:9440
- C:\Windows\System\TrKsHZf.exe
  C:\Windows\System\TrKsHZf.exe
  2⤵
  PID:9508
- C:\Windows\System\jZimpGj.exe
  C:\Windows\System\jZimpGj.exe
  2⤵
  PID:9664
- C:\Windows\System\KkDShyc.exe
  C:\Windows\System\KkDShyc.exe
  2⤵
  PID:9724
- C:\Windows\System\MYrLReC.exe
  C:\Windows\System\MYrLReC.exe
  2⤵
  PID:9728
- C:\Windows\System\fwrVBZp.exe
  C:\Windows\System\fwrVBZp.exe
  2⤵
  PID:9676
- C:\Windows\System\pOYMaAy.exe
  C:\Windows\System\pOYMaAy.exe
  2⤵
  PID:9796
- C:\Windows\System\aFnzzSB.exe
  C:\Windows\System\aFnzzSB.exe
  2⤵
  PID:9800
- C:\Windows\System\zZGTKFO.exe
  C:\Windows\System\zZGTKFO.exe
  2⤵
  PID:9860
- C:\Windows\System\EeSqMar.exe
  C:\Windows\System\EeSqMar.exe
  2⤵
  PID:9748
- C:\Windows\System\HACCpvo.exe
  C:\Windows\System\HACCpvo.exe
  2⤵
  PID:9812
- C:\Windows\System\gzkGFOa.exe
  C:\Windows\System\gzkGFOa.exe
  2⤵
  PID:9876
- C:\Windows\System\FmHEaZV.exe
  C:\Windows\System\FmHEaZV.exe
  2⤵
  PID:9960
- C:\Windows\System\SHKSKEu.exe
  C:\Windows\System\SHKSKEu.exe
  2⤵
  PID:9944
- C:\Windows\System\nfNJNhY.exe
  C:\Windows\System\nfNJNhY.exe
  2⤵
  PID:10004
- C:\Windows\System\QilvmJs.exe
  C:\Windows\System\QilvmJs.exe
  2⤵
  PID:10020
- C:\Windows\System\OtyMWzV.exe
  C:\Windows\System\OtyMWzV.exe
  2⤵
  PID:10056
- C:\Windows\System\pxODPDo.exe
  C:\Windows\System\pxODPDo.exe
  2⤵
  PID:10104
- C:\Windows\System\QImbgsN.exe
  C:\Windows\System\QImbgsN.exe
  2⤵
  PID:10148
- C:\Windows\System\gVwxxlm.exe
  C:\Windows\System\gVwxxlm.exe
  2⤵
  PID:10172
- C:\Windows\System\ZlDFkJz.exe
  C:\Windows\System\ZlDFkJz.exe
  2⤵
  PID:10232
- C:\Windows\System\cdErgWh.exe
  C:\Windows\System\cdErgWh.exe
  2⤵
  PID:10188
- C:\Windows\System\wTBdocd.exe
  C:\Windows\System\wTBdocd.exe
  2⤵
  PID:9380
- C:\Windows\System\shhACaR.exe
  C:\Windows\System\shhACaR.exe
  2⤵
  PID:10216
- C:\Windows\System\IZAigwa.exe
  C:\Windows\System\IZAigwa.exe
  2⤵
  PID:9400
- C:\Windows\System\UBvekIR.exe
  C:\Windows\System\UBvekIR.exe
  2⤵
  PID:7040
- C:\Windows\System\hmwiluz.exe
  C:\Windows\System\hmwiluz.exe
  2⤵
  PID:8620
- C:\Windows\System\dKueawC.exe
  C:\Windows\System\dKueawC.exe
  2⤵
  PID:9336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CjuAwwT.exe

Filesize
1.9MB

MD5
8b3d44e5bc72fad6ddfbee2be02187a0

SHA1
12b37516ce97b15e1a4bcfe0cd3905ef23812f6d

SHA256
af081f58aef0069265cc14c29ae184f69a1ae8000f3bd1d80d1526310665d68c

SHA512
52594a6e9905e8d1586f960e7341df500a57b39947fcc103107840a36debf317593f5462a8599cf15ff34ffafc6805854eb9a385db42aa6724338017dfbd51a9

Download Submit
C:\Windows\system\DWimaZU.exe

Filesize
1.9MB

MD5
a7d4bb13778ebc91bce2426243b5f080

SHA1
5bbd8d4e44f9cf942935a97443a4fffde60412fe

SHA256
5812c4d1ae0faf328f110c5ec7638f5d4674934aae63e8dd2c8b7febbdbd9357

SHA512
79370b51d618a4af12db2f172ab71d23b412a024d8da7c7de450151ff80153e2b30c0ab5711d88a70799f78ded1a96dfebefe76e33bdabbfedfe8a2fab214f5a

Download Submit
C:\Windows\system\FMXgLDG.exe

Filesize
1.9MB

MD5
4e9f048abd48e3a7aaf9ca5904ed7b15

SHA1
9b310b49c576eec5fcbf44490c951cea1c17b9da

SHA256
2d1b7493b3d784eedc670b5c224a4ae98c0a84001861e7928c8f14e9313eb791

SHA512
844b9b8821abad3c3506e1bf4b5018050e542cf0051a464c517cdf7996cb406da84828b7739a697882e06631736ee3fa1a376b1b32da9eac1f1632c84ae0ff64

Download Submit
C:\Windows\system\GBJSLsl.exe

Filesize
1.9MB

MD5
8cbd43a8507046875f62133bcc88074b

SHA1
067e755d7e9815ce35c6613914d54d566ae634ea

SHA256
de4b5ebd11db47443ace0c86e3d234c59139ba7bccc1a28badb5d99394621aa9

SHA512
8ff77c7b30f703e5fb617e04922265fcef614196e2177f8855bd0dffed86fce6e8db3b928ef41b7d17c39fcbd021a9e7412a83630ced197e1eea6a4d65423ce9

Download Submit
C:\Windows\system\IrhEyxp.exe

Filesize
1.9MB

MD5
1a5515387370d2ccf8647aa6d316bf2b

SHA1
2797f0303edf52cd8155e7767ef895ecc971e27e

SHA256
e05753607198c712d51d3431f225062b1a8109151bda204982a8fc0878551733

SHA512
40be7ae06267cf8f974349f210b25cc90c01b5eadaf3fcf0e025fcde82ffbdd57acb4e171962a8f4d831fadb460cc7baf2f9daf2acfa828d96e1ed13abe66d12

Download Submit
C:\Windows\system\MJVMamg.exe

Filesize
1.9MB

MD5
385fc19dade0e3e2c1e2d303b8ae1cdc

SHA1
3286a4e8c1e0021a44511713e219f557c0b70603

SHA256
cd7cc25bc2281627f9904eef6c793165ff52e6e96b3e4bdb3d8dfda4d98d1bb5

SHA512
382847b1c97c0b27335e5bb5942b5942392e13dd7ffb69d03b254c6ecf70e1607b6d75abd61f99b34565a1135987de76e0675ce568861d4f50ea3341f0a2ca82

Download Submit
C:\Windows\system\MgJeplS.exe

Filesize
1.9MB

MD5
3fb41f8baba5850ec867598b4f38f1f0

SHA1
0430425ab95e2b10d11589c5ef02c569801563f9

SHA256
24913fd49c5879f2320c7a818d090eecb10c5bf39223865b452021843bf80477

SHA512
7c3dbefdf142c814db6f74e95731fd4551a72b69a8ccc49893589b0a6d998aebbaf93135cfbc1a73be4eeca5aa6a4bddd81916d1867c28740bca256d41c4c78c

Download Submit
C:\Windows\system\NHigtGR.exe

Filesize
1.9MB

MD5
c70d1d2b5dd55b5ee5d24cce1e0995f6

SHA1
a28825906e8543e411e5020c583012da37400356

SHA256
148476e6381bf6f582f43d05868356481944ebd5cc2f25485a10da53c252aa28

SHA512
e3a1c21b7e2385d85f4fd79ac3d87365c125c72b8184ba6a42c45c0724d15abbbc9505a43452e5dbdb1c33f304c8ac1d37ff8c127261faa7596e195d198d6c9a

Download Submit
C:\Windows\system\RWRYQWf.exe

Filesize
1.9MB

MD5
a78a1550067c4cf9b70b8a33cf27e034

SHA1
36cf041f9a965e8292c2e01144ff1642fd64827b

SHA256
6b10caf69ec5947d9d5d2681fa696668e8fe3c3df2f0f83720d34aaf70026f9c

SHA512
9b8718970d0d2f90bea11db0529b2b2be9d96745f5d1eda41d4f3b3d01a2f718b3466465ef15ecdc204a47be11b6c4321f686876482575d85e707af40b16e0bc

Download Submit
C:\Windows\system\SUPXDgl.exe

Filesize
1.9MB

MD5
f7a2f708a6e8a4be5545a1f00dbe42fe

SHA1
7095c272e105bde8bc5946bc7ce6c13dacb3634d

SHA256
a6be9c8242528e1fd0ee4cdf58b2ffd885760f7dfa07f9764c353d63e575b8ea

SHA512
71c4fd34e8d577f800803ca8b68038e7e8d295cb575f380cf937d9cc623e4ab7440938367ab08984bce426ed998b1d07119f582ac2d63db4d81b9f38fe138228

Download Submit
C:\Windows\system\TascPnD.exe

Filesize
1.9MB

MD5
4f8a5db7c099a0a7301150f7d03d6ac9

SHA1
094eeb96d8b2b73dbac3eefe377b445171971b6e

SHA256
ce1cf403ca2c939c47132d4842aa9be714192d890ff43d11f4562edfd40cc6eb

SHA512
4fbd0e5056acd8f45b2f3cc951080fa1659f25364eaac737b7ed163381e7af1de065b93fb18cb9ca30281f942631670a65feeba217d6496aa61d67ca60e3dd17

Download Submit
C:\Windows\system\TuPDKYC.exe

Filesize
1.9MB

MD5
d566a1b74e32c7f0327279917af81802

SHA1
7799dc209ca5797bb14b088f9967d42e43578ec3

SHA256
ff297fec42b348b17a58baa9357238417ed15326966aeb5913ff471264dcfe07

SHA512
9b5c2ef97759b5f7f6e5109905e85e9a61d832ec1876dea69af5a892219bbd797c6dadc78c8f3bd93a3485b55f76811c1d6b2965540a0bb992cf018b520cbe46

Download Submit
C:\Windows\system\UCWvraj.exe

Filesize
1.9MB

MD5
100a58e8d57a12ddc226d7bb2c11a281

SHA1
0e2e07f6314a08643e0a183bf440ba6d55a57339

SHA256
ef89ac99a9aa0e563b41afc1214742f47c158160c32d5cca3eb01eaa6b36e9d4

SHA512
643fa4946af1096802dc2f29468735d1b11654834778187d1eddad06ba507a16eb963ccf826156585b098d4f3f6ec7240f444a9f724590ff83fbef8df3b1358d

Download Submit
C:\Windows\system\VCMFiNY.exe

Filesize
1.9MB

MD5
0862abcc71093fe7f2d4e5cb479c43d3

SHA1
21f39c6dc8fe20994929aeda8af07ff79d9d3e27

SHA256
a76a15075a0ddfb1f1a0aaa93d72994e2da660aa7e5a208c9c8a953298658365

SHA512
b8522993ad9d6b7a718b9f1a676a3de005a63d0ebcf150fa93d33b26e118415265158d3874a387dfacd210b808ffe03772ac654a9046e70b5182c29c1bc3536c

Download Submit
C:\Windows\system\XRQzEIy.exe

Filesize
1.9MB

MD5
b54f87c828c3a10c7facbddd5bb7eaf6

SHA1
1287534374a74d67cf5def8dc1df1237b5575533

SHA256
962420486d2c06f8b8c12c3e9d1d1034f0938fb810d00365c164dd17e3a2703c

SHA512
04f3b2af96e6b8f8f111bf30a39efa3799ba9a64845f20f650edcdc4fe61c8e14ffd102337eed2c469932290c10debfda33374748c48a3181c028d6fe5835da6

Download Submit
C:\Windows\system\XSaVPkl.exe

Filesize
1.9MB

MD5
c273b06d34d856a7e33aafb2aa28f875

SHA1
41984353d7146deb767837a2291dbb9d09a6959a

SHA256
a817b48fc7fd8557f4c3b0773085aa05a4fe4f9b81d45bfe0431dffb9df079e4

SHA512
1c5eb256fae4fffd5452a3bb8da97301b12f5e2176a584945ff9e1c37731bfc3a81c68a06541ef836a57f800f825c08a23eb269ea1fb652c8feebf45251a9a3d

Download Submit
C:\Windows\system\YILeStg.exe

Filesize
1.9MB

MD5
e04e2cf882480c659150239ed1426a14

SHA1
22b813cca914c23dc391c7ca9dc71a9f70e9de7b

SHA256
d643d9519f7878b9c99987e8393b50f1f2db6e5df252fe6500d041a34db225f7

SHA512
7757877916fbc40bd4e949c168ec07a8785618b9cc75182a1719319b058dca9c56332b90802f586aae88c9eb4ae2b01fe2c55385336bb2ba011a54a0a4cc4cd2

Download Submit
C:\Windows\system\YnkFnzT.exe

Filesize
1.9MB

MD5
e1a3ad0215a31290b2007de9e7a5ba8c

SHA1
471ca59249a291df42143f3d5a563be54d24f778

SHA256
a0f67c64a56ad4f8701acac0569baf67c265482b64911d7f0ae4ed27cfa81686

SHA512
4635e40b7aaa43263ed00b17a389be3ead8f36c228058cd76dc464e3f1d45e84d1604cc115d8dee250fd5b6fce4f2132df801f9c12ae502b98e10329e187c5b7

Download Submit
C:\Windows\system\bZkkDlQ.exe

Filesize
1.9MB

MD5
a03377b9db450ee090f396d913292e93

SHA1
41f45932026060517ba3ea2240eead9136aa67c2

SHA256
631fe3c1f3ea55caee1f0c2842a147e90bdb6376fa6e5c5a3137daab17255c5b

SHA512
c6a87414d279c47041127a82f84d03801a05c68f7a613638eedeb6911c482a540701a926d6259f61af483940fc5550cdc6de8037aa0697e055059f2e76d7f26c

Download Submit
C:\Windows\system\bslvyhJ.exe

Filesize
1.9MB

MD5
7c480ab0665849a139bc444059705e30

SHA1
bedd4e3acfd05dd709abd4584382f77108519615

SHA256
dbaf923081a91405fdc166fa91eab74c48af1c029bc641b32d090831162cf4fb

SHA512
e45f3591cfb7c9cf8f4e394bdc72f5829bf285db11678c6e818dc8ccb6fe192b6aaa5597d93a0aae39766fb778ada97effca75aab98ef0c5adc481c96938fcb5

Download Submit
C:\Windows\system\fSEBaEU.exe

Filesize
1.9MB

MD5
7365251e9bca0e274943a25cf96ceca4

SHA1
d027ef86e40455c2d65404b35b14e45aa2fc62a3

SHA256
d4926728961d307d966478089426905212284c3b09dfbc2b4152a049764a47b3

SHA512
137a3e62980fd047ae87f3ba98bd7aa3df0fc714dec2ae324a7f79c18ce1a9be66af88c50543e985c5aace8dc395dae05ac35b2b514204a04e6453b0136c43a2

Download Submit
C:\Windows\system\iQfhrYZ.exe

Filesize
1.9MB

MD5
6888f27ed50995c864848964e89707f8

SHA1
da0dc102203fcddb3af8bdf74e5f47d624f45716

SHA256
9e1978d445732dd4010ea78e5af8b15c59b578b4e79538e7255337f9394b5491

SHA512
d87fa9424859adeac22c98bc67331dae0825211c3a5f50b59dad8335cf826bfc65b4853e74e90001fbcb6583ebe982086765446db747c279d3f34b14a7fecf74

Download Submit
C:\Windows\system\iuWejdV.exe

Filesize
1.9MB

MD5
89ca3de891bf4dc9aa2de2838d951063

SHA1
6ab9e076548c2842a136c790fb81188d1e921aca

SHA256
4b0e07edd0a537688531ff8661abbf78795a183ae93c580d56af3472a2a0c53f

SHA512
78db328b8b88e3d12792e31c18d26b7344f8d13619255f1bced6156096188b9b2f9e84a5b0f492290cfbdeac265245d650ac109d2deba64b8e9be0558b2bfc4f

Download Submit
C:\Windows\system\mKwGwBt.exe

Filesize
1.9MB

MD5
79945ea6e56bb154150f54ae3c69f657

SHA1
5054e298aa5da087f626836048769a72d3a27212

SHA256
05ea45ddedc09f8826bfa184a0e8288d4234c742c065f488218a2b0f346b71d0

SHA512
09f1ceb52128d31185d04cef3d2de8db50d08f1a96a587c3d91434eba66f49e6ceaf8969c0e1645961b9bce41d01b4b85f6a5440b2d19fc0c16e1c9309100c19

Download Submit
C:\Windows\system\nfLYbGK.exe

Filesize
1.9MB

MD5
5bf2d687a2f350b1de760af926af27be

SHA1
c57f4ffbff6c355d44c485e64966f6177d388a2d

SHA256
9a9d374dc82c5da3fab8cadcf3f538dc069b109bcf756831f551b1dc61048d83

SHA512
e4ee3cba95189ae1f8497c78f9059569620fb70c02b4dbf4a9238832d6d597e95abe470b3f1a3542d5f2b656d79d76dfaf8351e49ed656c8dc34247b64580c64

Download Submit
C:\Windows\system\oYiXZuh.exe

Filesize
1.9MB

MD5
4998eb683eeb1703e24de2505612d0ee

SHA1
d84ab34b2d464588d472e73114ea5d2bc891e164

SHA256
8ddbca6c8e3389e5ff03c29c01ebe1ad3813289228019af0bdfc3d7d38a352ec

SHA512
3b5c89e88b9d4e9e6fd54d0e0aaae45990849c82ee524212eda03b5e0ca78dd24de8e9a0995527fa9318ec020be45e6553d2c8987dfacb1d258f0156a6b5adef

Download Submit
C:\Windows\system\tRsbcqb.exe

Filesize
1.9MB

MD5
d4377ed3a047d24482dcb29b8e722474

SHA1
5648817f77db2a2b86511ab245ab14d2f208264e

SHA256
c135a578c76de1f5d9d089fd8250b8c8349350f8261bd29fcf080c52e378b48f

SHA512
f76d3e640ce5a4afdce97a54602db0de6ace7a2686ae9727485e6daeabf56dc9f82657f6f088e10af68a9c78ad0897094dfb7f583eee61483cf388d3ad8ce122

Download Submit
C:\Windows\system\uFMErNv.exe

Filesize
1.9MB

MD5
39d846b51051c6277dde748e5a820a75

SHA1
4dc11bc54a592e9a7bcac8061ab71d6b86ef91ab

SHA256
f67eeaa397baeac06ee2f7e9261b5705d3950dde8baeea5016dee88a00217e77

SHA512
19e9766ad65b88428b3ad3f5abe9ee41ca9e572a25ca60a683a25957c4bbf19221b83269be085bb2ffb96f929318e87e1fbab33b1277c33d7990989a3876aa42

Download Submit
C:\Windows\system\wTdXslM.exe

Filesize
1.9MB

MD5
a1d62d5b91f466a0240ad54df2d931cc

SHA1
82c81da1561a0e4628fd5e2244878e8e2cf8aba2

SHA256
b918bd71e25b09d5b790e85738a51efbdbab2c422f207148e0c1ac25c5de49ed

SHA512
9cff6d1c3b7daa29f09ee31191d711ea71b5adee3fdf0340dc49e1d3a20efa163b183fc0111adad99e05c7ed60f59868f8c9ea9505a2cc9edc25c4de5de79f73

Download Submit
C:\Windows\system\waXPrck.exe

Filesize
1.9MB

MD5
9f7104ca335747cf324a93a0b4fc0c56

SHA1
ee3dbf60ce5aed8343b9fd6a0ce1f3879da360ae

SHA256
fea9e86836633ee4adde07e72ab8106f95cb6203c615bcd22c1c1a379860ef72

SHA512
a8ac9b9f06a912e295f7f51aabfb114ccbb498d8d92cfcccb04c66f0b41400651325adccc043036162cf6652f22d98ff4d39849a5cd09fd376d6c334bc83a50b

Download Submit
\Windows\system\HORidxp.exe

Filesize
1.9MB

MD5
1faaba839c233245aacca8e248183f51

SHA1
0ccfffee6e59b3bb2ad7a41f393f2309aef00308

SHA256
a8ef4865555f8770122a54946a478b12cbdd2366c1f42a0ee0fcf2a49d66d725

SHA512
d69e18d40de8692a7b2225fd4c74491bbc7848dec900c49a349828d6cb4befcb693160bb402d85a58c42e87e047e6dbdb22f7794be86ab5d2c940bbd1226f06d

Download Submit
\Windows\system\WVJybSf.exe

Filesize
1.9MB

MD5
a02b3e83d2924a83fcdeb43a306be189

SHA1
a2ce280ceaf5602a479740fd588ddb415a6bc52e

SHA256
b301daf12f294463d214450b72953de33d6f8dc52fe058cee1bd0a69cd92fa09

SHA512
7958cce20b9ac06f6af8c106812f2fdb377e68b6d7e9299ff7798cf292f9e252ebe25c6821af09123279bfd6f06f2096b37c458291094a1391fd6b21b75c200a

Download Submit
memory/2368-0-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download