xmrig | 5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
Size

1.0MB
MD5

6f0946a5f041b178138a8e0c35f762be
SHA1

c5bf169e5f61f1cf8dc92cd873c295a18513b863
SHA256

5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe
SHA512

3748644d4e04ed77fe8d0cab0b96d875a199dd380648aa738f9f097a1e83691337f6fd690ffc58f1e1e278113910002fdd71824bb06b782f5d39b2d73b3dfc55
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrl0g:GezaTF8FcNkNdfE0pZ9ozttwIRQag

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012254-2.dat	xmrig
behavioral1/files/0x000800000001650a-8.dat	xmrig
behavioral1/files/0x00070000000167ea-15.dat	xmrig
behavioral1/files/0x0007000000016c36-27.dat	xmrig
behavioral1/files/0x0007000000016a49-21.dat	xmrig
behavioral1/files/0x0008000000016c53-32.dat	xmrig
behavioral1/files/0x0005000000019278-49.dat	xmrig
behavioral1/files/0x000500000001938b-59.dat	xmrig
behavioral1/files/0x0005000000019399-64.dat	xmrig
behavioral1/files/0x00050000000195d9-128.dat	xmrig
behavioral1/files/0x0005000000019610-155.dat	xmrig
behavioral1/files/0x0005000000019612-159.dat	xmrig
behavioral1/files/0x000500000001960d-145.dat	xmrig
behavioral1/files/0x000500000001960e-148.dat	xmrig
behavioral1/files/0x000500000001960a-135.dat	xmrig
behavioral1/files/0x0005000000019537-125.dat	xmrig
behavioral1/files/0x000500000001960c-139.dat	xmrig
behavioral1/files/0x00050000000194bd-114.dat	xmrig
behavioral1/files/0x00050000000194f3-119.dat	xmrig
behavioral1/files/0x0005000000019436-105.dat	xmrig
behavioral1/files/0x0005000000019441-109.dat	xmrig
behavioral1/files/0x0005000000019417-94.dat	xmrig
behavioral1/files/0x000500000001941a-99.dat	xmrig
behavioral1/files/0x00050000000193ec-89.dat	xmrig
behavioral1/files/0x00050000000193d4-84.dat	xmrig
behavioral1/files/0x00050000000193c8-79.dat	xmrig
behavioral1/files/0x00050000000193c1-74.dat	xmrig
behavioral1/files/0x00050000000193b7-69.dat	xmrig
behavioral1/files/0x0005000000019280-54.dat	xmrig
behavioral1/files/0x0005000000019263-44.dat	xmrig
behavioral1/files/0x0008000000016dc1-39.dat	xmrig
behavioral1/files/0x0008000000016276-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2492	dkdRLxx.exe
1048	lOakBNh.exe
2640	aFZmlrB.exe
1424	hwROvGM.exe
1572	ESmuZUf.exe
2660	FnZshdp.exe
2828	eGxhJQn.exe
2708	eGKRBPF.exe
2796	bbtYmCT.exe
2772	iCWsikQ.exe
2880	ayzgCPa.exe
2524	OVZaPYJ.exe
2668	OVYULFi.exe
2568	WKCRIZj.exe
2632	LmqUtwl.exe
3008	jRzIBAp.exe
3020	qJNddaR.exe
1472	sAIwEnH.exe
2544	XScekRv.exe
584	stpiZPI.exe
1792	pqJaRUL.exe
2748	BSBthaO.exe
400	UWIhqNU.exe
1964	EiSTgGx.exe
1952	oHkGyXo.exe
2164	efBFdVk.exe
1300	stWhiDu.exe
2652	DjThJkm.exe
1968	lHGVeUy.exe
1124	EOmLHzJ.exe
2024	FCaizpx.exe
2136	NvUzVwP.exe
1204	VEhMvRI.exe
1316	GKJkIUi.exe
2268	uuLhDcm.exe
2032	BnFMobF.exe
1840	AvzxuHR.exe
1928	xVFoGmZ.exe
1440	MLAYpiR.exe
616	QHvYEMT.exe
108	sMOxxAO.exe
1492	BENgBel.exe
1708	NqmarWt.exe
892	TWMdaFA.exe
2596	xUrpruj.exe
1684	MlAuFAA.exe
2448	YOoYmHZ.exe
1420	ZXrjAtu.exe
2220	ZjZxlgw.exe
1560	MKajHcQ.exe
2940	UaVtvbC.exe
1436	FMvqWDZ.exe
760	KgnnHkD.exe
2256	ILtaQsN.exe
2320	gGGLEyI.exe
1540	dBWRyMk.exe
3064	NVBmVuH.exe
1372	uWznsKo.exe
2240	XCtsrCb.exe
2788	AgqEIpw.exe
2664	EQsxOyo.exe
2844	ofnySgU.exe
2816	ZMwbQSJ.exe
1652	AyMQVKX.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FCaizpx.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\QHvYEMT.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\QrusDEz.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\rpQMmHj.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\TFlItqy.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\xcaDLlZ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\rehczTM.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\gLyslQs.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\cPMLuhv.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\MLAYpiR.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\NqmarWt.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\JXLhhcf.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\qkoidbf.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\dTxFBff.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\kBZoRaZ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\isXPwih.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\eudbEaI.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\DiKFQjc.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\qTNkQWf.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\mikUFeg.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\LimfIrD.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\nXWhYvP.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\ztixdBr.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\moVtGsE.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\UbrCIgO.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\KpDdAUI.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\UmRWgTY.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\VCntClC.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\cXXEiXl.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\nRNhKZv.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\zqhMkOx.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\VtsJtnD.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\vrqyqPr.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\kJnqNZZ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\GEMYhDJ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\Oaaxnfr.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\xYtSySl.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\frAyFJm.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\uGLadlD.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\EmvDWfi.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\pziowfl.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\LTrIjiY.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\ARLpGUD.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\xjWCtVY.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\MYCZKJh.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\rBnNMsm.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\hWwpZdr.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\pcRTikj.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\YvgjxmM.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\ijfjTnU.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\wdpkAXH.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\HOXbIDV.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\ByLnZNK.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\kwwJoaZ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\LeUSVLX.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\kYjNrvw.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\dxkliCQ.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\RGHQkDe.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\vZFYwSw.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\SxAxpjN.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\jhoyMab.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\GiYurlv.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\rXaSoBl.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
File created	C:\Windows\System\GORBhDv.exe	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2492	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	32
PID 2380 wrote to memory of 2492	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	32
PID 2380 wrote to memory of 2492	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	32
PID 2380 wrote to memory of 1048	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	33
PID 2380 wrote to memory of 1048	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	33
PID 2380 wrote to memory of 1048	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	33
PID 2380 wrote to memory of 2640	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	34
PID 2380 wrote to memory of 2640	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	34
PID 2380 wrote to memory of 2640	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	34
PID 2380 wrote to memory of 1424	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	35
PID 2380 wrote to memory of 1424	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	35
PID 2380 wrote to memory of 1424	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	35
PID 2380 wrote to memory of 1572	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	36
PID 2380 wrote to memory of 1572	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	36
PID 2380 wrote to memory of 1572	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	36
PID 2380 wrote to memory of 2660	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	37
PID 2380 wrote to memory of 2660	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	37
PID 2380 wrote to memory of 2660	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	37
PID 2380 wrote to memory of 2828	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	38
PID 2380 wrote to memory of 2828	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	38
PID 2380 wrote to memory of 2828	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	38
PID 2380 wrote to memory of 2708	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	39
PID 2380 wrote to memory of 2708	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	39
PID 2380 wrote to memory of 2708	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	39
PID 2380 wrote to memory of 2796	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	40
PID 2380 wrote to memory of 2796	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	40
PID 2380 wrote to memory of 2796	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	40
PID 2380 wrote to memory of 2772	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	41
PID 2380 wrote to memory of 2772	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	41
PID 2380 wrote to memory of 2772	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	41
PID 2380 wrote to memory of 2880	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	42
PID 2380 wrote to memory of 2880	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	42
PID 2380 wrote to memory of 2880	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	42
PID 2380 wrote to memory of 2524	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	43
PID 2380 wrote to memory of 2524	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	43
PID 2380 wrote to memory of 2524	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	43
PID 2380 wrote to memory of 2668	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	44
PID 2380 wrote to memory of 2668	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	44
PID 2380 wrote to memory of 2668	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	44
PID 2380 wrote to memory of 2568	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	45
PID 2380 wrote to memory of 2568	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	45
PID 2380 wrote to memory of 2568	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	45
PID 2380 wrote to memory of 2632	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	46
PID 2380 wrote to memory of 2632	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	46
PID 2380 wrote to memory of 2632	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	46
PID 2380 wrote to memory of 3008	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	47
PID 2380 wrote to memory of 3008	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	47
PID 2380 wrote to memory of 3008	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	47
PID 2380 wrote to memory of 3020	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	48
PID 2380 wrote to memory of 3020	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	48
PID 2380 wrote to memory of 3020	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	48
PID 2380 wrote to memory of 1472	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	49
PID 2380 wrote to memory of 1472	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	49
PID 2380 wrote to memory of 1472	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	49
PID 2380 wrote to memory of 2544	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	50
PID 2380 wrote to memory of 2544	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	50
PID 2380 wrote to memory of 2544	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	50
PID 2380 wrote to memory of 584	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	51
PID 2380 wrote to memory of 584	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	51
PID 2380 wrote to memory of 584	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	51
PID 2380 wrote to memory of 1792	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	52
PID 2380 wrote to memory of 1792	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	52
PID 2380 wrote to memory of 1792	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	52
PID 2380 wrote to memory of 2748	2380	5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe	53

C:\Users\Admin\AppData\Local\Temp\5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe
"C:\Users\Admin\AppData\Local\Temp\5dd60adfbf167c6a4f8a1a0278483d6acd6aea595ed066bf276c8aaa0f87fcbe.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System\dkdRLxx.exe
  C:\Windows\System\dkdRLxx.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\lOakBNh.exe
  C:\Windows\System\lOakBNh.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\aFZmlrB.exe
  C:\Windows\System\aFZmlrB.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\hwROvGM.exe
  C:\Windows\System\hwROvGM.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\ESmuZUf.exe
  C:\Windows\System\ESmuZUf.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\FnZshdp.exe
  C:\Windows\System\FnZshdp.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\eGxhJQn.exe
  C:\Windows\System\eGxhJQn.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\eGKRBPF.exe
  C:\Windows\System\eGKRBPF.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\bbtYmCT.exe
  C:\Windows\System\bbtYmCT.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\iCWsikQ.exe
  C:\Windows\System\iCWsikQ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ayzgCPa.exe
  C:\Windows\System\ayzgCPa.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\OVZaPYJ.exe
  C:\Windows\System\OVZaPYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\OVYULFi.exe
  C:\Windows\System\OVYULFi.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\WKCRIZj.exe
  C:\Windows\System\WKCRIZj.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LmqUtwl.exe
  C:\Windows\System\LmqUtwl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\jRzIBAp.exe
  C:\Windows\System\jRzIBAp.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\qJNddaR.exe
  C:\Windows\System\qJNddaR.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\sAIwEnH.exe
  C:\Windows\System\sAIwEnH.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\XScekRv.exe
  C:\Windows\System\XScekRv.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\stpiZPI.exe
  C:\Windows\System\stpiZPI.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\pqJaRUL.exe
  C:\Windows\System\pqJaRUL.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\BSBthaO.exe
  C:\Windows\System\BSBthaO.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\UWIhqNU.exe
  C:\Windows\System\UWIhqNU.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\EiSTgGx.exe
  C:\Windows\System\EiSTgGx.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\oHkGyXo.exe
  C:\Windows\System\oHkGyXo.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\efBFdVk.exe
  C:\Windows\System\efBFdVk.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\stWhiDu.exe
  C:\Windows\System\stWhiDu.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\DjThJkm.exe
  C:\Windows\System\DjThJkm.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\lHGVeUy.exe
  C:\Windows\System\lHGVeUy.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\EOmLHzJ.exe
  C:\Windows\System\EOmLHzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\FCaizpx.exe
  C:\Windows\System\FCaizpx.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NvUzVwP.exe
  C:\Windows\System\NvUzVwP.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\VEhMvRI.exe
  C:\Windows\System\VEhMvRI.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\GKJkIUi.exe
  C:\Windows\System\GKJkIUi.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\uuLhDcm.exe
  C:\Windows\System\uuLhDcm.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\BnFMobF.exe
  C:\Windows\System\BnFMobF.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\AvzxuHR.exe
  C:\Windows\System\AvzxuHR.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\xVFoGmZ.exe
  C:\Windows\System\xVFoGmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\MLAYpiR.exe
  C:\Windows\System\MLAYpiR.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\QHvYEMT.exe
  C:\Windows\System\QHvYEMT.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\sMOxxAO.exe
  C:\Windows\System\sMOxxAO.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\BENgBel.exe
  C:\Windows\System\BENgBel.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\NqmarWt.exe
  C:\Windows\System\NqmarWt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\TWMdaFA.exe
  C:\Windows\System\TWMdaFA.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\xUrpruj.exe
  C:\Windows\System\xUrpruj.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\MlAuFAA.exe
  C:\Windows\System\MlAuFAA.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\YOoYmHZ.exe
  C:\Windows\System\YOoYmHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ZXrjAtu.exe
  C:\Windows\System\ZXrjAtu.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\ZjZxlgw.exe
  C:\Windows\System\ZjZxlgw.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\MKajHcQ.exe
  C:\Windows\System\MKajHcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\UaVtvbC.exe
  C:\Windows\System\UaVtvbC.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\FMvqWDZ.exe
  C:\Windows\System\FMvqWDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\KgnnHkD.exe
  C:\Windows\System\KgnnHkD.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ILtaQsN.exe
  C:\Windows\System\ILtaQsN.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\gGGLEyI.exe
  C:\Windows\System\gGGLEyI.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\dBWRyMk.exe
  C:\Windows\System\dBWRyMk.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\NVBmVuH.exe
  C:\Windows\System\NVBmVuH.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\uWznsKo.exe
  C:\Windows\System\uWznsKo.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\XCtsrCb.exe
  C:\Windows\System\XCtsrCb.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\AgqEIpw.exe
  C:\Windows\System\AgqEIpw.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\EQsxOyo.exe
  C:\Windows\System\EQsxOyo.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ofnySgU.exe
  C:\Windows\System\ofnySgU.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ZMwbQSJ.exe
  C:\Windows\System\ZMwbQSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\AyMQVKX.exe
  C:\Windows\System\AyMQVKX.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\hVgLXFC.exe
  C:\Windows\System\hVgLXFC.exe
  2⤵
  PID:2552
- C:\Windows\System\eHOjAuS.exe
  C:\Windows\System\eHOjAuS.exe
  2⤵
  PID:3016
- C:\Windows\System\iIgfBzK.exe
  C:\Windows\System\iIgfBzK.exe
  2⤵
  PID:2036
- C:\Windows\System\drYadRp.exe
  C:\Windows\System\drYadRp.exe
  2⤵
  PID:1740
- C:\Windows\System\zrrqSUy.exe
  C:\Windows\System\zrrqSUy.exe
  2⤵
  PID:568
- C:\Windows\System\pBvFybY.exe
  C:\Windows\System\pBvFybY.exe
  2⤵
  PID:1832
- C:\Windows\System\IZMjwkW.exe
  C:\Windows\System\IZMjwkW.exe
  2⤵
  PID:2180
- C:\Windows\System\wfmQAqi.exe
  C:\Windows\System\wfmQAqi.exe
  2⤵
  PID:1780
- C:\Windows\System\NvCKhEJ.exe
  C:\Windows\System\NvCKhEJ.exe
  2⤵
  PID:1268
- C:\Windows\System\ScrsdUT.exe
  C:\Windows\System\ScrsdUT.exe
  2⤵
  PID:2416
- C:\Windows\System\fGEWXsD.exe
  C:\Windows\System\fGEWXsD.exe
  2⤵
  PID:448
- C:\Windows\System\CsEGlpM.exe
  C:\Windows\System\CsEGlpM.exe
  2⤵
  PID:1512
- C:\Windows\System\kqqYbNQ.exe
  C:\Windows\System\kqqYbNQ.exe
  2⤵
  PID:1556
- C:\Windows\System\DLGlLtm.exe
  C:\Windows\System\DLGlLtm.exe
  2⤵
  PID:1296
- C:\Windows\System\OByJNwT.exe
  C:\Windows\System\OByJNwT.exe
  2⤵
  PID:1568
- C:\Windows\System\sGHBjJB.exe
  C:\Windows\System\sGHBjJB.exe
  2⤵
  PID:2200
- C:\Windows\System\ORHAqIr.exe
  C:\Windows\System\ORHAqIr.exe
  2⤵
  PID:2636
- C:\Windows\System\qCsyJhs.exe
  C:\Windows\System\qCsyJhs.exe
  2⤵
  PID:1712
- C:\Windows\System\rQsMYyu.exe
  C:\Windows\System\rQsMYyu.exe
  2⤵
  PID:1480
- C:\Windows\System\vSxxehH.exe
  C:\Windows\System\vSxxehH.exe
  2⤵
  PID:1680
- C:\Windows\System\kXQMKrt.exe
  C:\Windows\System\kXQMKrt.exe
  2⤵
  PID:2440
- C:\Windows\System\YbrWCFV.exe
  C:\Windows\System\YbrWCFV.exe
  2⤵
  PID:2156
- C:\Windows\System\AYoKrfh.exe
  C:\Windows\System\AYoKrfh.exe
  2⤵
  PID:1640
- C:\Windows\System\LQpxlMH.exe
  C:\Windows\System\LQpxlMH.exe
  2⤵
  PID:2740
- C:\Windows\System\wotmrog.exe
  C:\Windows\System\wotmrog.exe
  2⤵
  PID:2684
- C:\Windows\System\gsLyiFS.exe
  C:\Windows\System\gsLyiFS.exe
  2⤵
  PID:1008
- C:\Windows\System\fwIXWMA.exe
  C:\Windows\System\fwIXWMA.exe
  2⤵
  PID:1544
- C:\Windows\System\BZePRTO.exe
  C:\Windows\System\BZePRTO.exe
  2⤵
  PID:2700
- C:\Windows\System\NGEIUsM.exe
  C:\Windows\System\NGEIUsM.exe
  2⤵
  PID:2968
- C:\Windows\System\OKSUYhh.exe
  C:\Windows\System\OKSUYhh.exe
  2⤵
  PID:2920
- C:\Windows\System\ZMpcwTD.exe
  C:\Windows\System\ZMpcwTD.exe
  2⤵
  PID:3068
- C:\Windows\System\uIfbzRO.exe
  C:\Windows\System\uIfbzRO.exe
  2⤵
  PID:2704
- C:\Windows\System\nVBKTNo.exe
  C:\Windows\System\nVBKTNo.exe
  2⤵
  PID:2820
- C:\Windows\System\XnjxEjl.exe
  C:\Windows\System\XnjxEjl.exe
  2⤵
  PID:2604
- C:\Windows\System\fpQvUJd.exe
  C:\Windows\System\fpQvUJd.exe
  2⤵
  PID:2580
- C:\Windows\System\oetkevc.exe
  C:\Windows\System\oetkevc.exe
  2⤵
  PID:2620
- C:\Windows\System\JGMkhjl.exe
  C:\Windows\System\JGMkhjl.exe
  2⤵
  PID:280
- C:\Windows\System\XbtxeRm.exe
  C:\Windows\System\XbtxeRm.exe
  2⤵
  PID:1896
- C:\Windows\System\vnnJGNR.exe
  C:\Windows\System\vnnJGNR.exe
  2⤵
  PID:2372
- C:\Windows\System\mZpXDQv.exe
  C:\Windows\System\mZpXDQv.exe
  2⤵
  PID:2392
- C:\Windows\System\nqepuqF.exe
  C:\Windows\System\nqepuqF.exe
  2⤵
  PID:1868
- C:\Windows\System\vCmIyda.exe
  C:\Windows\System\vCmIyda.exe
  2⤵
  PID:1156
- C:\Windows\System\AtDzLLn.exe
  C:\Windows\System\AtDzLLn.exe
  2⤵
  PID:2004
- C:\Windows\System\kWOGSZD.exe
  C:\Windows\System\kWOGSZD.exe
  2⤵
  PID:1796
- C:\Windows\System\TOrlwct.exe
  C:\Windows\System\TOrlwct.exe
  2⤵
  PID:788
- C:\Windows\System\GjMgRzz.exe
  C:\Windows\System\GjMgRzz.exe
  2⤵
  PID:696
- C:\Windows\System\hdFNuQx.exe
  C:\Windows\System\hdFNuQx.exe
  2⤵
  PID:1616
- C:\Windows\System\TCLDsmA.exe
  C:\Windows\System\TCLDsmA.exe
  2⤵
  PID:596
- C:\Windows\System\kXkkyuA.exe
  C:\Windows\System\kXkkyuA.exe
  2⤵
  PID:2724
- C:\Windows\System\mMoPJXZ.exe
  C:\Windows\System\mMoPJXZ.exe
  2⤵
  PID:2928
- C:\Windows\System\fMAQgqg.exe
  C:\Windows\System\fMAQgqg.exe
  2⤵
  PID:1788
- C:\Windows\System\KEMBrGq.exe
  C:\Windows\System\KEMBrGq.exe
  2⤵
  PID:1760
- C:\Windows\System\qTacWST.exe
  C:\Windows\System\qTacWST.exe
  2⤵
  PID:2936
- C:\Windows\System\yzBgukj.exe
  C:\Windows\System\yzBgukj.exe
  2⤵
  PID:2780
- C:\Windows\System\IWhGPOd.exe
  C:\Windows\System\IWhGPOd.exe
  2⤵
  PID:2948
- C:\Windows\System\EHsIUwC.exe
  C:\Windows\System\EHsIUwC.exe
  2⤵
  PID:2576
- C:\Windows\System\mPeBQeL.exe
  C:\Windows\System\mPeBQeL.exe
  2⤵
  PID:2688
- C:\Windows\System\OShzsdO.exe
  C:\Windows\System\OShzsdO.exe
  2⤵
  PID:2592
- C:\Windows\System\cnrViPC.exe
  C:\Windows\System\cnrViPC.exe
  2⤵
  PID:2084
- C:\Windows\System\yEhzuuI.exe
  C:\Windows\System\yEhzuuI.exe
  2⤵
  PID:1892
- C:\Windows\System\nLwFMTC.exe
  C:\Windows\System\nLwFMTC.exe
  2⤵
  PID:3044
- C:\Windows\System\bZLiolY.exe
  C:\Windows\System\bZLiolY.exe
  2⤵
  PID:1628
- C:\Windows\System\QexZFgh.exe
  C:\Windows\System\QexZFgh.exe
  2⤵
  PID:1528
- C:\Windows\System\janLiSE.exe
  C:\Windows\System\janLiSE.exe
  2⤵
  PID:1948
- C:\Windows\System\amcSWSF.exe
  C:\Windows\System\amcSWSF.exe
  2⤵
  PID:964
- C:\Windows\System\PMTRNDZ.exe
  C:\Windows\System\PMTRNDZ.exe
  2⤵
  PID:1940
- C:\Windows\System\jLLGDFI.exe
  C:\Windows\System\jLLGDFI.exe
  2⤵
  PID:2064
- C:\Windows\System\GaFyidC.exe
  C:\Windows\System\GaFyidC.exe
  2⤵
  PID:1960
- C:\Windows\System\FVUXrPK.exe
  C:\Windows\System\FVUXrPK.exe
  2⤵
  PID:1916
- C:\Windows\System\pfgJOLH.exe
  C:\Windows\System\pfgJOLH.exe
  2⤵
  PID:2752
- C:\Windows\System\MWeeKRd.exe
  C:\Windows\System\MWeeKRd.exe
  2⤵
  PID:2096
- C:\Windows\System\exxoVwm.exe
  C:\Windows\System\exxoVwm.exe
  2⤵
  PID:2468
- C:\Windows\System\CHZhwcN.exe
  C:\Windows\System\CHZhwcN.exe
  2⤵
  PID:752
- C:\Windows\System\OwVnBmt.exe
  C:\Windows\System\OwVnBmt.exe
  2⤵
  PID:2336
- C:\Windows\System\EwFuCzK.exe
  C:\Windows\System\EwFuCzK.exe
  2⤵
  PID:2300
- C:\Windows\System\ARduPHQ.exe
  C:\Windows\System\ARduPHQ.exe
  2⤵
  PID:1912
- C:\Windows\System\mlQJtBB.exe
  C:\Windows\System\mlQJtBB.exe
  2⤵
  PID:2080
- C:\Windows\System\Getspit.exe
  C:\Windows\System\Getspit.exe
  2⤵
  PID:2556
- C:\Windows\System\GQhGBBp.exe
  C:\Windows\System\GQhGBBp.exe
  2⤵
  PID:2864
- C:\Windows\System\wEPobGr.exe
  C:\Windows\System\wEPobGr.exe
  2⤵
  PID:316
- C:\Windows\System\wdXXXWK.exe
  C:\Windows\System\wdXXXWK.exe
  2⤵
  PID:2112
- C:\Windows\System\sQtEDxs.exe
  C:\Windows\System\sQtEDxs.exe
  2⤵
  PID:956
- C:\Windows\System\OHWAVaM.exe
  C:\Windows\System\OHWAVaM.exe
  2⤵
  PID:320
- C:\Windows\System\rJMUyIG.exe
  C:\Windows\System\rJMUyIG.exe
  2⤵
  PID:884
- C:\Windows\System\idFgkxh.exe
  C:\Windows\System\idFgkxh.exe
  2⤵
  PID:2316
- C:\Windows\System\NHrHveJ.exe
  C:\Windows\System\NHrHveJ.exe
  2⤵
  PID:1800
- C:\Windows\System\ZiyXzrZ.exe
  C:\Windows\System\ZiyXzrZ.exe
  2⤵
  PID:2028
- C:\Windows\System\aDphLOU.exe
  C:\Windows\System\aDphLOU.exe
  2⤵
  PID:2368
- C:\Windows\System\uzFqAmI.exe
  C:\Windows\System\uzFqAmI.exe
  2⤵
  PID:2188
- C:\Windows\System\SHyepIe.exe
  C:\Windows\System\SHyepIe.exe
  2⤵
  PID:2764
- C:\Windows\System\ijPTrRN.exe
  C:\Windows\System\ijPTrRN.exe
  2⤵
  PID:3076
- C:\Windows\System\AmQBFHb.exe
  C:\Windows\System\AmQBFHb.exe
  2⤵
  PID:3092
- C:\Windows\System\XmySnbV.exe
  C:\Windows\System\XmySnbV.exe
  2⤵
  PID:3108
- C:\Windows\System\SRyucMW.exe
  C:\Windows\System\SRyucMW.exe
  2⤵
  PID:3128
- C:\Windows\System\eZASNda.exe
  C:\Windows\System\eZASNda.exe
  2⤵
  PID:3184
- C:\Windows\System\PuidThl.exe
  C:\Windows\System\PuidThl.exe
  2⤵
  PID:3224
- C:\Windows\System\YJTpSbB.exe
  C:\Windows\System\YJTpSbB.exe
  2⤵
  PID:3240
- C:\Windows\System\DxODyiY.exe
  C:\Windows\System\DxODyiY.exe
  2⤵
  PID:3256
- C:\Windows\System\fqxLbFb.exe
  C:\Windows\System\fqxLbFb.exe
  2⤵
  PID:3280
- C:\Windows\System\kYjNrvw.exe
  C:\Windows\System\kYjNrvw.exe
  2⤵
  PID:3296
- C:\Windows\System\ZPVsFRb.exe
  C:\Windows\System\ZPVsFRb.exe
  2⤵
  PID:3316
- C:\Windows\System\HEzZSho.exe
  C:\Windows\System\HEzZSho.exe
  2⤵
  PID:3340
- C:\Windows\System\newKuMs.exe
  C:\Windows\System\newKuMs.exe
  2⤵
  PID:3360
- C:\Windows\System\kvvVBYz.exe
  C:\Windows\System\kvvVBYz.exe
  2⤵
  PID:3380
- C:\Windows\System\cHoyHgR.exe
  C:\Windows\System\cHoyHgR.exe
  2⤵
  PID:3396
- C:\Windows\System\JgoGpHt.exe
  C:\Windows\System\JgoGpHt.exe
  2⤵
  PID:3412
- C:\Windows\System\niNSpWc.exe
  C:\Windows\System\niNSpWc.exe
  2⤵
  PID:3432
- C:\Windows\System\jtOsGBL.exe
  C:\Windows\System\jtOsGBL.exe
  2⤵
  PID:3448
- C:\Windows\System\JhwgDBg.exe
  C:\Windows\System\JhwgDBg.exe
  2⤵
  PID:3464
- C:\Windows\System\mkiaZWD.exe
  C:\Windows\System\mkiaZWD.exe
  2⤵
  PID:3480
- C:\Windows\System\Rrtqham.exe
  C:\Windows\System\Rrtqham.exe
  2⤵
  PID:3496
- C:\Windows\System\CLLxjCw.exe
  C:\Windows\System\CLLxjCw.exe
  2⤵
  PID:3516
- C:\Windows\System\VWWAapt.exe
  C:\Windows\System\VWWAapt.exe
  2⤵
  PID:3532
- C:\Windows\System\MrbJwVs.exe
  C:\Windows\System\MrbJwVs.exe
  2⤵
  PID:3560
- C:\Windows\System\WYgJycJ.exe
  C:\Windows\System\WYgJycJ.exe
  2⤵
  PID:3580
- C:\Windows\System\tPwYaOg.exe
  C:\Windows\System\tPwYaOg.exe
  2⤵
  PID:3600
- C:\Windows\System\OUTPzEk.exe
  C:\Windows\System\OUTPzEk.exe
  2⤵
  PID:3620
- C:\Windows\System\GjDJeuV.exe
  C:\Windows\System\GjDJeuV.exe
  2⤵
  PID:3636
- C:\Windows\System\SdnZNYe.exe
  C:\Windows\System\SdnZNYe.exe
  2⤵
  PID:3652
- C:\Windows\System\LXChqvq.exe
  C:\Windows\System\LXChqvq.exe
  2⤵
  PID:3676
- C:\Windows\System\YQhHPmk.exe
  C:\Windows\System\YQhHPmk.exe
  2⤵
  PID:3728
- C:\Windows\System\FDgeBUr.exe
  C:\Windows\System\FDgeBUr.exe
  2⤵
  PID:3744
- C:\Windows\System\JlyRGXZ.exe
  C:\Windows\System\JlyRGXZ.exe
  2⤵
  PID:3760
- C:\Windows\System\mHmXYZm.exe
  C:\Windows\System\mHmXYZm.exe
  2⤵
  PID:3776
- C:\Windows\System\OwlnsAG.exe
  C:\Windows\System\OwlnsAG.exe
  2⤵
  PID:3792
- C:\Windows\System\EGKKuSd.exe
  C:\Windows\System\EGKKuSd.exe
  2⤵
  PID:3808
- C:\Windows\System\zfFntDu.exe
  C:\Windows\System\zfFntDu.exe
  2⤵
  PID:3848
- C:\Windows\System\hOvcAdo.exe
  C:\Windows\System\hOvcAdo.exe
  2⤵
  PID:3864
- C:\Windows\System\RlMsexE.exe
  C:\Windows\System\RlMsexE.exe
  2⤵
  PID:3880
- C:\Windows\System\PrMsvvH.exe
  C:\Windows\System\PrMsvvH.exe
  2⤵
  PID:3896
- C:\Windows\System\jwjrfbC.exe
  C:\Windows\System\jwjrfbC.exe
  2⤵
  PID:3948
- C:\Windows\System\CUJPbGc.exe
  C:\Windows\System\CUJPbGc.exe
  2⤵
  PID:3964
- C:\Windows\System\vodbXeu.exe
  C:\Windows\System\vodbXeu.exe
  2⤵
  PID:3980
- C:\Windows\System\LrASOrA.exe
  C:\Windows\System\LrASOrA.exe
  2⤵
  PID:3996
- C:\Windows\System\NfjFgrK.exe
  C:\Windows\System\NfjFgrK.exe
  2⤵
  PID:4016
- C:\Windows\System\DUqGvlV.exe
  C:\Windows\System\DUqGvlV.exe
  2⤵
  PID:4032
- C:\Windows\System\AqzoGpJ.exe
  C:\Windows\System\AqzoGpJ.exe
  2⤵
  PID:4052
- C:\Windows\System\dSHtbwK.exe
  C:\Windows\System\dSHtbwK.exe
  2⤵
  PID:4068
- C:\Windows\System\hTjUPWk.exe
  C:\Windows\System\hTjUPWk.exe
  2⤵
  PID:4084
- C:\Windows\System\oixaoCE.exe
  C:\Windows\System\oixaoCE.exe
  2⤵
  PID:1364
- C:\Windows\System\LhPtYnQ.exe
  C:\Windows\System\LhPtYnQ.exe
  2⤵
  PID:3100
- C:\Windows\System\KRuQvbh.exe
  C:\Windows\System\KRuQvbh.exe
  2⤵
  PID:2360
- C:\Windows\System\ZSijYUw.exe
  C:\Windows\System\ZSijYUw.exe
  2⤵
  PID:1212
- C:\Windows\System\ATImgWV.exe
  C:\Windows\System\ATImgWV.exe
  2⤵
  PID:2776
- C:\Windows\System\jHyGjCl.exe
  C:\Windows\System\jHyGjCl.exe
  2⤵
  PID:2608
- C:\Windows\System\FdLrzlq.exe
  C:\Windows\System\FdLrzlq.exe
  2⤵
  PID:1872
- C:\Windows\System\JXoLgyc.exe
  C:\Windows\System\JXoLgyc.exe
  2⤵
  PID:3156
- C:\Windows\System\kAlHRdD.exe
  C:\Windows\System\kAlHRdD.exe
  2⤵
  PID:3172
- C:\Windows\System\wEdCIOU.exe
  C:\Windows\System\wEdCIOU.exe
  2⤵
  PID:3268
- C:\Windows\System\AvXJQAx.exe
  C:\Windows\System\AvXJQAx.exe
  2⤵
  PID:3308
- C:\Windows\System\DSfknzb.exe
  C:\Windows\System\DSfknzb.exe
  2⤵
  PID:3348
- C:\Windows\System\IneDuvo.exe
  C:\Windows\System\IneDuvo.exe
  2⤵
  PID:3192
- C:\Windows\System\xugjUNJ.exe
  C:\Windows\System\xugjUNJ.exe
  2⤵
  PID:3204
- C:\Windows\System\DiFDVqI.exe
  C:\Windows\System\DiFDVqI.exe
  2⤵
  PID:3456
- C:\Windows\System\JBeGagN.exe
  C:\Windows\System\JBeGagN.exe
  2⤵
  PID:3288
- C:\Windows\System\RaITgMZ.exe
  C:\Windows\System\RaITgMZ.exe
  2⤵
  PID:3440
- C:\Windows\System\CntBQVB.exe
  C:\Windows\System\CntBQVB.exe
  2⤵
  PID:3252
- C:\Windows\System\cIrQcYn.exe
  C:\Windows\System\cIrQcYn.exe
  2⤵
  PID:3368
- C:\Windows\System\MegYFVN.exe
  C:\Windows\System\MegYFVN.exe
  2⤵
  PID:3208
- C:\Windows\System\HxapRru.exe
  C:\Windows\System\HxapRru.exe
  2⤵
  PID:3476
- C:\Windows\System\ZcnflCu.exe
  C:\Windows\System\ZcnflCu.exe
  2⤵
  PID:3508
- C:\Windows\System\vpyQJjt.exe
  C:\Windows\System\vpyQJjt.exe
  2⤵
  PID:3612
- C:\Windows\System\ifkNXYI.exe
  C:\Windows\System\ifkNXYI.exe
  2⤵
  PID:3596
- C:\Windows\System\SGIZftY.exe
  C:\Windows\System\SGIZftY.exe
  2⤵
  PID:3588
- C:\Windows\System\EwPXLzk.exe
  C:\Windows\System\EwPXLzk.exe
  2⤵
  PID:3660
- C:\Windows\System\cUgWNKy.exe
  C:\Windows\System\cUgWNKy.exe
  2⤵
  PID:3700
- C:\Windows\System\FggPqZx.exe
  C:\Windows\System\FggPqZx.exe
  2⤵
  PID:3716
- C:\Windows\System\tDmosuF.exe
  C:\Windows\System\tDmosuF.exe
  2⤵
  PID:3756
- C:\Windows\System\XUpyDPZ.exe
  C:\Windows\System\XUpyDPZ.exe
  2⤵
  PID:3740
- C:\Windows\System\SMyvCME.exe
  C:\Windows\System\SMyvCME.exe
  2⤵
  PID:3804
- C:\Windows\System\eHQrwsP.exe
  C:\Windows\System\eHQrwsP.exe
  2⤵
  PID:3836
- C:\Windows\System\jTdqdvU.exe
  C:\Windows\System\jTdqdvU.exe
  2⤵
  PID:3876
- C:\Windows\System\qdNtbBf.exe
  C:\Windows\System\qdNtbBf.exe
  2⤵
  PID:3928
- C:\Windows\System\jNiQRyL.exe
  C:\Windows\System\jNiQRyL.exe
  2⤵
  PID:3892
- C:\Windows\System\yELLIRQ.exe
  C:\Windows\System\yELLIRQ.exe
  2⤵
  PID:3860
- C:\Windows\System\wkgqHOK.exe
  C:\Windows\System\wkgqHOK.exe
  2⤵
  PID:4012
- C:\Windows\System\LkyDate.exe
  C:\Windows\System\LkyDate.exe
  2⤵
  PID:3960
- C:\Windows\System\BYHdBya.exe
  C:\Windows\System\BYHdBya.exe
  2⤵
  PID:3992
- C:\Windows\System\dkExWFU.exe
  C:\Windows\System\dkExWFU.exe
  2⤵
  PID:4028
- C:\Windows\System\BNPgyDi.exe
  C:\Windows\System\BNPgyDi.exe
  2⤵
  PID:3148
- C:\Windows\System\mKkEOwx.exe
  C:\Windows\System\mKkEOwx.exe
  2⤵
  PID:3248
- C:\Windows\System\XCbXLgT.exe
  C:\Windows\System\XCbXLgT.exe
  2⤵
  PID:3116
- C:\Windows\System\hDkfTDU.exe
  C:\Windows\System\hDkfTDU.exe
  2⤵
  PID:3512
- C:\Windows\System\RgpQXBl.exe
  C:\Windows\System\RgpQXBl.exe
  2⤵
  PID:3592
- C:\Windows\System\ccvqVMN.exe
  C:\Windows\System\ccvqVMN.exe
  2⤵
  PID:3736
- C:\Windows\System\MRkbsSn.exe
  C:\Windows\System\MRkbsSn.exe
  2⤵
  PID:3924
- C:\Windows\System\tRySjmG.exe
  C:\Windows\System\tRySjmG.exe
  2⤵
  PID:4048
- C:\Windows\System\ckCjdtj.exe
  C:\Windows\System\ckCjdtj.exe
  2⤵
  PID:3988
- C:\Windows\System\YdiTqIp.exe
  C:\Windows\System\YdiTqIp.exe
  2⤵
  PID:3872
- C:\Windows\System\rezmYRD.exe
  C:\Windows\System\rezmYRD.exe
  2⤵
  PID:1836
- C:\Windows\System\JXLhhcf.exe
  C:\Windows\System\JXLhhcf.exe
  2⤵
  PID:3276
- C:\Windows\System\bQDzdEa.exe
  C:\Windows\System\bQDzdEa.exe
  2⤵
  PID:3336
- C:\Windows\System\hoyjpEo.exe
  C:\Windows\System\hoyjpEo.exe
  2⤵
  PID:3576
- C:\Windows\System\bTmGfSv.exe
  C:\Windows\System\bTmGfSv.exe
  2⤵
  PID:3548
- C:\Windows\System\KeLCkMW.exe
  C:\Windows\System\KeLCkMW.exe
  2⤵
  PID:3752
- C:\Windows\System\qhTrPQT.exe
  C:\Windows\System\qhTrPQT.exe
  2⤵
  PID:3908
- C:\Windows\System\FowlEzE.exe
  C:\Windows\System\FowlEzE.exe
  2⤵
  PID:4004
- C:\Windows\System\bniiZNo.exe
  C:\Windows\System\bniiZNo.exe
  2⤵
  PID:2148
- C:\Windows\System\MLqIaWu.exe
  C:\Windows\System\MLqIaWu.exe
  2⤵
  PID:840
- C:\Windows\System\MoPfjtO.exe
  C:\Windows\System\MoPfjtO.exe
  2⤵
  PID:3232
- C:\Windows\System\PEIaYnl.exe
  C:\Windows\System\PEIaYnl.exe
  2⤵
  PID:1412
- C:\Windows\System\AslMXwO.exe
  C:\Windows\System\AslMXwO.exe
  2⤵
  PID:3264
- C:\Windows\System\BemUBEh.exe
  C:\Windows\System\BemUBEh.exe
  2⤵
  PID:3388
- C:\Windows\System\BNreRml.exe
  C:\Windows\System\BNreRml.exe
  2⤵
  PID:2952
- C:\Windows\System\xSCbZxl.exe
  C:\Windows\System\xSCbZxl.exe
  2⤵
  PID:3556
- C:\Windows\System\wfyccaK.exe
  C:\Windows\System\wfyccaK.exe
  2⤵
  PID:3832
- C:\Windows\System\tDyADoY.exe
  C:\Windows\System\tDyADoY.exe
  2⤵
  PID:3472
- C:\Windows\System\EDFJTax.exe
  C:\Windows\System\EDFJTax.exe
  2⤵
  PID:3524
- C:\Windows\System\EVMeXrh.exe
  C:\Windows\System\EVMeXrh.exe
  2⤵
  PID:4044
- C:\Windows\System\SWVwVQX.exe
  C:\Windows\System\SWVwVQX.exe
  2⤵
  PID:3376
- C:\Windows\System\TUCwRNm.exe
  C:\Windows\System\TUCwRNm.exe
  2⤵
  PID:3304
- C:\Windows\System\XixORSr.exe
  C:\Windows\System\XixORSr.exe
  2⤵
  PID:3688
- C:\Windows\System\VBnmJGa.exe
  C:\Windows\System\VBnmJGa.exe
  2⤵
  PID:3540
- C:\Windows\System\YZpbIee.exe
  C:\Windows\System\YZpbIee.exe
  2⤵
  PID:3904
- C:\Windows\System\UOPEXIJ.exe
  C:\Windows\System\UOPEXIJ.exe
  2⤵
  PID:3200
- C:\Windows\System\ehnbAmm.exe
  C:\Windows\System\ehnbAmm.exe
  2⤵
  PID:3168
- C:\Windows\System\qTNkQWf.exe
  C:\Windows\System\qTNkQWf.exe
  2⤵
  PID:1448
- C:\Windows\System\sKRbPkd.exe
  C:\Windows\System\sKRbPkd.exe
  2⤵
  PID:2184
- C:\Windows\System\vrqyqPr.exe
  C:\Windows\System\vrqyqPr.exe
  2⤵
  PID:2956
- C:\Windows\System\UuTNXDH.exe
  C:\Windows\System\UuTNXDH.exe
  2⤵
  PID:4108
- C:\Windows\System\sKFGGfP.exe
  C:\Windows\System\sKFGGfP.exe
  2⤵
  PID:4128
- C:\Windows\System\veMaPJp.exe
  C:\Windows\System\veMaPJp.exe
  2⤵
  PID:4148
- C:\Windows\System\BuIaZCV.exe
  C:\Windows\System\BuIaZCV.exe
  2⤵
  PID:4168
- C:\Windows\System\GqyDwdR.exe
  C:\Windows\System\GqyDwdR.exe
  2⤵
  PID:4184
- C:\Windows\System\FqnKIKA.exe
  C:\Windows\System\FqnKIKA.exe
  2⤵
  PID:4204
- C:\Windows\System\TZCrSsR.exe
  C:\Windows\System\TZCrSsR.exe
  2⤵
  PID:4224
- C:\Windows\System\iqmZhaX.exe
  C:\Windows\System\iqmZhaX.exe
  2⤵
  PID:4240
- C:\Windows\System\qOwdrol.exe
  C:\Windows\System\qOwdrol.exe
  2⤵
  PID:4256
- C:\Windows\System\QrusDEz.exe
  C:\Windows\System\QrusDEz.exe
  2⤵
  PID:4276
- C:\Windows\System\isTXMAa.exe
  C:\Windows\System\isTXMAa.exe
  2⤵
  PID:4296
- C:\Windows\System\NWqwxHG.exe
  C:\Windows\System\NWqwxHG.exe
  2⤵
  PID:4312
- C:\Windows\System\mAFeoMq.exe
  C:\Windows\System\mAFeoMq.exe
  2⤵
  PID:4332
- C:\Windows\System\DztHHAW.exe
  C:\Windows\System\DztHHAW.exe
  2⤵
  PID:4352
- C:\Windows\System\nNFpEQA.exe
  C:\Windows\System\nNFpEQA.exe
  2⤵
  PID:4368
- C:\Windows\System\oBfihKp.exe
  C:\Windows\System\oBfihKp.exe
  2⤵
  PID:4388
- C:\Windows\System\JcXJUVx.exe
  C:\Windows\System\JcXJUVx.exe
  2⤵
  PID:4412
- C:\Windows\System\vLbMtQg.exe
  C:\Windows\System\vLbMtQg.exe
  2⤵
  PID:4428
- C:\Windows\System\VgBixAM.exe
  C:\Windows\System\VgBixAM.exe
  2⤵
  PID:4444
- C:\Windows\System\JZdMDlu.exe
  C:\Windows\System\JZdMDlu.exe
  2⤵
  PID:4460
- C:\Windows\System\pfOhYJw.exe
  C:\Windows\System\pfOhYJw.exe
  2⤵
  PID:4480
- C:\Windows\System\aRpLKrV.exe
  C:\Windows\System\aRpLKrV.exe
  2⤵
  PID:4500
- C:\Windows\System\pWQrHau.exe
  C:\Windows\System\pWQrHau.exe
  2⤵
  PID:4528
- C:\Windows\System\PWxbnVy.exe
  C:\Windows\System\PWxbnVy.exe
  2⤵
  PID:4544
- C:\Windows\System\zuMzVJS.exe
  C:\Windows\System\zuMzVJS.exe
  2⤵
  PID:4560
- C:\Windows\System\pxWACQs.exe
  C:\Windows\System\pxWACQs.exe
  2⤵
  PID:4580
- C:\Windows\System\TQDljPr.exe
  C:\Windows\System\TQDljPr.exe
  2⤵
  PID:4600
- C:\Windows\System\HonucrC.exe
  C:\Windows\System\HonucrC.exe
  2⤵
  PID:4616
- C:\Windows\System\XGcNNaq.exe
  C:\Windows\System\XGcNNaq.exe
  2⤵
  PID:4632
- C:\Windows\System\GfEhTDD.exe
  C:\Windows\System\GfEhTDD.exe
  2⤵
  PID:4712
- C:\Windows\System\zEQpRrq.exe
  C:\Windows\System\zEQpRrq.exe
  2⤵
  PID:4728
- C:\Windows\System\FaSuboF.exe
  C:\Windows\System\FaSuboF.exe
  2⤵
  PID:4748
- C:\Windows\System\cmoAeKW.exe
  C:\Windows\System\cmoAeKW.exe
  2⤵
  PID:4764
- C:\Windows\System\qkoidbf.exe
  C:\Windows\System\qkoidbf.exe
  2⤵
  PID:4780
- C:\Windows\System\jaDqlld.exe
  C:\Windows\System\jaDqlld.exe
  2⤵
  PID:4796
- C:\Windows\System\oOLLFpN.exe
  C:\Windows\System\oOLLFpN.exe
  2⤵
  PID:4816
- C:\Windows\System\VzAETJb.exe
  C:\Windows\System\VzAETJb.exe
  2⤵
  PID:4832
- C:\Windows\System\cyapblY.exe
  C:\Windows\System\cyapblY.exe
  2⤵
  PID:4852
- C:\Windows\System\HIBGhsO.exe
  C:\Windows\System\HIBGhsO.exe
  2⤵
  PID:4880
- C:\Windows\System\xlFLrIg.exe
  C:\Windows\System\xlFLrIg.exe
  2⤵
  PID:4900
- C:\Windows\System\FNkoLAa.exe
  C:\Windows\System\FNkoLAa.exe
  2⤵
  PID:4916
- C:\Windows\System\uZudOkx.exe
  C:\Windows\System\uZudOkx.exe
  2⤵
  PID:4932
- C:\Windows\System\ZijPAPK.exe
  C:\Windows\System\ZijPAPK.exe
  2⤵
  PID:4948
- C:\Windows\System\gpUfAbc.exe
  C:\Windows\System\gpUfAbc.exe
  2⤵
  PID:4964
- C:\Windows\System\tlMesIC.exe
  C:\Windows\System\tlMesIC.exe
  2⤵
  PID:4988
- C:\Windows\System\AVjtGSG.exe
  C:\Windows\System\AVjtGSG.exe
  2⤵
  PID:5004
- C:\Windows\System\PjlpUUI.exe
  C:\Windows\System\PjlpUUI.exe
  2⤵
  PID:5024
- C:\Windows\System\xjWCtVY.exe
  C:\Windows\System\xjWCtVY.exe
  2⤵
  PID:5040
- C:\Windows\System\sgsiiYr.exe
  C:\Windows\System\sgsiiYr.exe
  2⤵
  PID:5060
- C:\Windows\System\ZUqHMaW.exe
  C:\Windows\System\ZUqHMaW.exe
  2⤵
  PID:5080
- C:\Windows\System\fAEkmeD.exe
  C:\Windows\System\fAEkmeD.exe
  2⤵
  PID:5096
- C:\Windows\System\qPwCFMI.exe
  C:\Windows\System\qPwCFMI.exe
  2⤵
  PID:5116
- C:\Windows\System\scvznwL.exe
  C:\Windows\System\scvznwL.exe
  2⤵
  PID:3976
- C:\Windows\System\iaMOnBZ.exe
  C:\Windows\System\iaMOnBZ.exe
  2⤵
  PID:4156
- C:\Windows\System\GkjfEiP.exe
  C:\Windows\System\GkjfEiP.exe
  2⤵
  PID:4232
- C:\Windows\System\hTaCHyQ.exe
  C:\Windows\System\hTaCHyQ.exe
  2⤵
  PID:4272
- C:\Windows\System\wHMqMVB.exe
  C:\Windows\System\wHMqMVB.exe
  2⤵
  PID:4348
- C:\Windows\System\OyZRkeW.exe
  C:\Windows\System\OyZRkeW.exe
  2⤵
  PID:4420
- C:\Windows\System\GbhxMCI.exe
  C:\Windows\System\GbhxMCI.exe
  2⤵
  PID:4492
- C:\Windows\System\ukmuKvr.exe
  C:\Windows\System\ukmuKvr.exe
  2⤵
  PID:3088
- C:\Windows\System\ErJtCBi.exe
  C:\Windows\System\ErJtCBi.exe
  2⤵
  PID:3912
- C:\Windows\System\VwldYHh.exe
  C:\Windows\System\VwldYHh.exe
  2⤵
  PID:3428
- C:\Windows\System\lEJZvgF.exe
  C:\Windows\System\lEJZvgF.exe
  2⤵
  PID:4644
- C:\Windows\System\sCXdFdg.exe
  C:\Windows\System\sCXdFdg.exe
  2⤵
  PID:4652
- C:\Windows\System\cgJTaqF.exe
  C:\Windows\System\cgJTaqF.exe
  2⤵
  PID:4284
- C:\Windows\System\apRmWvc.exe
  C:\Windows\System\apRmWvc.exe
  2⤵
  PID:4668
- C:\Windows\System\MqfAyjP.exe
  C:\Windows\System\MqfAyjP.exe
  2⤵
  PID:4680
- C:\Windows\System\foqopMh.exe
  C:\Windows\System\foqopMh.exe
  2⤵
  PID:4692
- C:\Windows\System\WzfnlbI.exe
  C:\Windows\System\WzfnlbI.exe
  2⤵
  PID:4136
- C:\Windows\System\CAJtuwX.exe
  C:\Windows\System\CAJtuwX.exe
  2⤵
  PID:4700
- C:\Windows\System\CrTgdsb.exe
  C:\Windows\System\CrTgdsb.exe
  2⤵
  PID:3332
- C:\Windows\System\BBCsNQh.exe
  C:\Windows\System\BBCsNQh.exe
  2⤵
  PID:4328
- C:\Windows\System\DCCyTwz.exe
  C:\Windows\System\DCCyTwz.exe
  2⤵
  PID:4364
- C:\Windows\System\DSlfRlV.exe
  C:\Windows\System\DSlfRlV.exe
  2⤵
  PID:4512
- C:\Windows\System\niyQrTl.exe
  C:\Windows\System\niyQrTl.exe
  2⤵
  PID:4804
- C:\Windows\System\KaHhVqE.exe
  C:\Windows\System\KaHhVqE.exe
  2⤵
  PID:4840
- C:\Windows\System\WRVyLNN.exe
  C:\Windows\System\WRVyLNN.exe
  2⤵
  PID:4556
- C:\Windows\System\VGUAbWv.exe
  C:\Windows\System\VGUAbWv.exe
  2⤵
  PID:4756
- C:\Windows\System\QzhxIMg.exe
  C:\Windows\System\QzhxIMg.exe
  2⤵
  PID:4892
- C:\Windows\System\NNbTATS.exe
  C:\Windows\System\NNbTATS.exe
  2⤵
  PID:4960
- C:\Windows\System\BVPjPlf.exe
  C:\Windows\System\BVPjPlf.exe
  2⤵
  PID:5032
- C:\Windows\System\caphQWD.exe
  C:\Windows\System\caphQWD.exe
  2⤵
  PID:5076
- C:\Windows\System\OnzETey.exe
  C:\Windows\System\OnzETey.exe
  2⤵
  PID:4124
- C:\Windows\System\dxkliCQ.exe
  C:\Windows\System\dxkliCQ.exe
  2⤵
  PID:4376
- C:\Windows\System\DKUNInU.exe
  C:\Windows\System\DKUNInU.exe
  2⤵
  PID:4828
- C:\Windows\System\UOzSpBr.exe
  C:\Windows\System\UOzSpBr.exe
  2⤵
  PID:3788
- C:\Windows\System\NUVsnaR.exe
  C:\Windows\System\NUVsnaR.exe
  2⤵
  PID:4908
- C:\Windows\System\tFDPOgH.exe
  C:\Windows\System\tFDPOgH.exe
  2⤵
  PID:4984
- C:\Windows\System\fHIDgAB.exe
  C:\Windows\System\fHIDgAB.exe
  2⤵
  PID:4972
- C:\Windows\System\MJIxUzd.exe
  C:\Windows\System\MJIxUzd.exe
  2⤵
  PID:5048
- C:\Windows\System\jCArnoL.exe
  C:\Windows\System\jCArnoL.exe
  2⤵
  PID:5092
- C:\Windows\System\NIsWBUF.exe
  C:\Windows\System\NIsWBUF.exe
  2⤵
  PID:4200
- C:\Windows\System\cZkcIDO.exe
  C:\Windows\System\cZkcIDO.exe
  2⤵
  PID:4456
- C:\Windows\System\RGHQkDe.exe
  C:\Windows\System\RGHQkDe.exe
  2⤵
  PID:4536
- C:\Windows\System\mkxuYHP.exe
  C:\Windows\System\mkxuYHP.exe
  2⤵
  PID:4216
- C:\Windows\System\xMbwEef.exe
  C:\Windows\System\xMbwEef.exe
  2⤵
  PID:4688
- C:\Windows\System\lGZYGgh.exe
  C:\Windows\System\lGZYGgh.exe
  2⤵
  PID:4400
- C:\Windows\System\nYfOONf.exe
  C:\Windows\System\nYfOONf.exe
  2⤵
  PID:4076
- C:\Windows\System\UkFiWCQ.exe
  C:\Windows\System\UkFiWCQ.exe
  2⤵
  PID:4468
- C:\Windows\System\ptrewgE.exe
  C:\Windows\System\ptrewgE.exe
  2⤵
  PID:4592
- C:\Windows\System\aztbOyv.exe
  C:\Windows\System\aztbOyv.exe
  2⤵
  PID:4928
- C:\Windows\System\PTqAaDl.exe
  C:\Windows\System\PTqAaDl.exe
  2⤵
  PID:4092
- C:\Windows\System\uWwIROk.exe
  C:\Windows\System\uWwIROk.exe
  2⤵
  PID:5016
- C:\Windows\System\QeSfMDO.exe
  C:\Windows\System\QeSfMDO.exe
  2⤵
  PID:4196
- C:\Windows\System\lFQIvIG.exe
  C:\Windows\System\lFQIvIG.exe
  2⤵
  PID:4476
- C:\Windows\System\eDyXnPA.exe
  C:\Windows\System\eDyXnPA.exe
  2⤵
  PID:5108
- C:\Windows\System\UILwCfA.exe
  C:\Windows\System\UILwCfA.exe
  2⤵
  PID:3544
- C:\Windows\System\WLsaFoe.exe
  C:\Windows\System\WLsaFoe.exe
  2⤵
  PID:5132
- C:\Windows\System\WMOqbGF.exe
  C:\Windows\System\WMOqbGF.exe
  2⤵
  PID:5152
- C:\Windows\System\vZFYwSw.exe
  C:\Windows\System\vZFYwSw.exe
  2⤵
  PID:5172
- C:\Windows\System\BkpdHvY.exe
  C:\Windows\System\BkpdHvY.exe
  2⤵
  PID:5192
- C:\Windows\System\sGSeuWi.exe
  C:\Windows\System\sGSeuWi.exe
  2⤵
  PID:5212
- C:\Windows\System\JucDqGJ.exe
  C:\Windows\System\JucDqGJ.exe
  2⤵
  PID:5228
- C:\Windows\System\GLTNIds.exe
  C:\Windows\System\GLTNIds.exe
  2⤵
  PID:5248
- C:\Windows\System\doRBGcx.exe
  C:\Windows\System\doRBGcx.exe
  2⤵
  PID:5264
- C:\Windows\System\leJToSN.exe
  C:\Windows\System\leJToSN.exe
  2⤵
  PID:5280
- C:\Windows\System\LmVPxFF.exe
  C:\Windows\System\LmVPxFF.exe
  2⤵
  PID:5408
- C:\Windows\System\LFrBWQj.exe
  C:\Windows\System\LFrBWQj.exe
  2⤵
  PID:5424
- C:\Windows\System\SjfJBvl.exe
  C:\Windows\System\SjfJBvl.exe
  2⤵
  PID:5440
- C:\Windows\System\rOhPfrT.exe
  C:\Windows\System\rOhPfrT.exe
  2⤵
  PID:5456
- C:\Windows\System\bflaOpH.exe
  C:\Windows\System\bflaOpH.exe
  2⤵
  PID:5472
- C:\Windows\System\bhrJFYR.exe
  C:\Windows\System\bhrJFYR.exe
  2⤵
  PID:5488
- C:\Windows\System\egsDHTa.exe
  C:\Windows\System\egsDHTa.exe
  2⤵
  PID:5504
- C:\Windows\System\JyLjJDj.exe
  C:\Windows\System\JyLjJDj.exe
  2⤵
  PID:5520
- C:\Windows\System\hHDevLy.exe
  C:\Windows\System\hHDevLy.exe
  2⤵
  PID:5536
- C:\Windows\System\ZIPiDJI.exe
  C:\Windows\System\ZIPiDJI.exe
  2⤵
  PID:5552
- C:\Windows\System\NjDJscL.exe
  C:\Windows\System\NjDJscL.exe
  2⤵
  PID:5580
- C:\Windows\System\qCoqMCH.exe
  C:\Windows\System\qCoqMCH.exe
  2⤵
  PID:5604
- C:\Windows\System\GadaUHZ.exe
  C:\Windows\System\GadaUHZ.exe
  2⤵
  PID:5620
- C:\Windows\System\nOiPEHg.exe
  C:\Windows\System\nOiPEHg.exe
  2⤵
  PID:5640
- C:\Windows\System\PetfFDO.exe
  C:\Windows\System\PetfFDO.exe
  2⤵
  PID:5656
- C:\Windows\System\COuTsLu.exe
  C:\Windows\System\COuTsLu.exe
  2⤵
  PID:5676
- C:\Windows\System\ZqZNTXh.exe
  C:\Windows\System\ZqZNTXh.exe
  2⤵
  PID:5696
- C:\Windows\System\IxZrEGe.exe
  C:\Windows\System\IxZrEGe.exe
  2⤵
  PID:5716
- C:\Windows\System\BpYXxik.exe
  C:\Windows\System\BpYXxik.exe
  2⤵
  PID:5736
- C:\Windows\System\HqiMetG.exe
  C:\Windows\System\HqiMetG.exe
  2⤵
  PID:5752
- C:\Windows\System\GJDKXtd.exe
  C:\Windows\System\GJDKXtd.exe
  2⤵
  PID:5772
- C:\Windows\System\drdMkQS.exe
  C:\Windows\System\drdMkQS.exe
  2⤵
  PID:5792
- C:\Windows\System\RkyZyna.exe
  C:\Windows\System\RkyZyna.exe
  2⤵
  PID:5812
- C:\Windows\System\xCXSTeC.exe
  C:\Windows\System\xCXSTeC.exe
  2⤵
  PID:5828
- C:\Windows\System\TsVMWEn.exe
  C:\Windows\System\TsVMWEn.exe
  2⤵
  PID:5844
- C:\Windows\System\dgZlmUV.exe
  C:\Windows\System\dgZlmUV.exe
  2⤵
  PID:5864
- C:\Windows\System\YWBQimi.exe
  C:\Windows\System\YWBQimi.exe
  2⤵
  PID:5888
- C:\Windows\System\DifHkGl.exe
  C:\Windows\System\DifHkGl.exe
  2⤵
  PID:5908
- C:\Windows\System\XUbRdiJ.exe
  C:\Windows\System\XUbRdiJ.exe
  2⤵
  PID:5928
- C:\Windows\System\oVUktsV.exe
  C:\Windows\System\oVUktsV.exe
  2⤵
  PID:5944
- C:\Windows\System\ssHqGuk.exe
  C:\Windows\System\ssHqGuk.exe
  2⤵
  PID:5964
- C:\Windows\System\HTfvosb.exe
  C:\Windows\System\HTfvosb.exe
  2⤵
  PID:5988
- C:\Windows\System\MnvsYoW.exe
  C:\Windows\System\MnvsYoW.exe
  2⤵
  PID:6008
- C:\Windows\System\HlvSQBn.exe
  C:\Windows\System\HlvSQBn.exe
  2⤵
  PID:6028
- C:\Windows\System\hAanFpX.exe
  C:\Windows\System\hAanFpX.exe
  2⤵
  PID:6068
- C:\Windows\System\WFhEfPe.exe
  C:\Windows\System\WFhEfPe.exe
  2⤵
  PID:6096
- C:\Windows\System\gnPCCEC.exe
  C:\Windows\System\gnPCCEC.exe
  2⤵
  PID:6116
- C:\Windows\System\WmXtzJG.exe
  C:\Windows\System\WmXtzJG.exe
  2⤵
  PID:6136
- C:\Windows\System\aClluZv.exe
  C:\Windows\System\aClluZv.exe
  2⤵
  PID:5124
- C:\Windows\System\KrlhujR.exe
  C:\Windows\System\KrlhujR.exe
  2⤵
  PID:5208
- C:\Windows\System\OBZGWXN.exe
  C:\Windows\System\OBZGWXN.exe
  2⤵
  PID:4640
- C:\Windows\System\yblHJwl.exe
  C:\Windows\System\yblHJwl.exe
  2⤵
  PID:4672
- C:\Windows\System\wdKmwPK.exe
  C:\Windows\System\wdKmwPK.exe
  2⤵
  PID:5276
- C:\Windows\System\cTlYCag.exe
  C:\Windows\System\cTlYCag.exe
  2⤵
  PID:4740
- C:\Windows\System\sRJFTzp.exe
  C:\Windows\System\sRJFTzp.exe
  2⤵
  PID:4120
- C:\Windows\System\NxmNIeO.exe
  C:\Windows\System\NxmNIeO.exe
  2⤵
  PID:5056
- C:\Windows\System\olmeLIn.exe
  C:\Windows\System\olmeLIn.exe
  2⤵
  PID:4452
- C:\Windows\System\rehczTM.exe
  C:\Windows\System\rehczTM.exe
  2⤵
  PID:4176
- C:\Windows\System\bUTNIWR.exe
  C:\Windows\System\bUTNIWR.exe
  2⤵
  PID:4596
- C:\Windows\System\ZgTzfev.exe
  C:\Windows\System\ZgTzfev.exe
  2⤵
  PID:3528
- C:\Windows\System\hpIIaig.exe
  C:\Windows\System\hpIIaig.exe
  2⤵
  PID:5184
- C:\Windows\System\yPpMmZi.exe
  C:\Windows\System\yPpMmZi.exe
  2⤵
  PID:3648
- C:\Windows\System\LzyJaiz.exe
  C:\Windows\System\LzyJaiz.exe
  2⤵
  PID:5312
- C:\Windows\System\bPifYSa.exe
  C:\Windows\System\bPifYSa.exe
  2⤵
  PID:4888
- C:\Windows\System\lBRRtEP.exe
  C:\Windows\System\lBRRtEP.exe
  2⤵
  PID:5328
- C:\Windows\System\SxAxpjN.exe
  C:\Windows\System\SxAxpjN.exe
  2⤵
  PID:4872
- C:\Windows\System\OfJdgTC.exe
  C:\Windows\System\OfJdgTC.exe
  2⤵
  PID:5356
- C:\Windows\System\zhlHxUP.exe
  C:\Windows\System\zhlHxUP.exe
  2⤵
  PID:4976
- C:\Windows\System\nVtDHRI.exe
  C:\Windows\System\nVtDHRI.exe
  2⤵
  PID:5484
- C:\Windows\System\ztixdBr.exe
  C:\Windows\System\ztixdBr.exe
  2⤵
  PID:5420
- C:\Windows\System\jTPryiA.exe
  C:\Windows\System\jTPryiA.exe
  2⤵
  PID:5220
- C:\Windows\System\SEllawy.exe
  C:\Windows\System\SEllawy.exe
  2⤵
  PID:5588
- C:\Windows\System\LPNVfOD.exe
  C:\Windows\System\LPNVfOD.exe
  2⤵
  PID:5628
- C:\Windows\System\yExJKFT.exe
  C:\Windows\System\yExJKFT.exe
  2⤵
  PID:5668
- C:\Windows\System\ZKJplCE.exe
  C:\Windows\System\ZKJplCE.exe
  2⤵
  PID:5712
- C:\Windows\System\cEgBxwg.exe
  C:\Windows\System\cEgBxwg.exe
  2⤵
  PID:5068
- C:\Windows\System\OwLxPfO.exe
  C:\Windows\System\OwLxPfO.exe
  2⤵
  PID:5856
- C:\Windows\System\UPCatLW.exe
  C:\Windows\System\UPCatLW.exe
  2⤵
  PID:5372
- C:\Windows\System\rWRtkuq.exe
  C:\Windows\System\rWRtkuq.exe
  2⤵
  PID:5896
- C:\Windows\System\XYzoDuX.exe
  C:\Windows\System\XYzoDuX.exe
  2⤵
  PID:5616
- C:\Windows\System\zsalSKN.exe
  C:\Windows\System\zsalSKN.exe
  2⤵
  PID:5936
- C:\Windows\System\mHzYwMD.exe
  C:\Windows\System\mHzYwMD.exe
  2⤵
  PID:5984
- C:\Windows\System\SUSIBdD.exe
  C:\Windows\System\SUSIBdD.exe
  2⤵
  PID:5392
- C:\Windows\System\vjwjOJA.exe
  C:\Windows\System\vjwjOJA.exe
  2⤵
  PID:5496
- C:\Windows\System\ZnYDHbw.exe
  C:\Windows\System\ZnYDHbw.exe
  2⤵
  PID:5564
- C:\Windows\System\PcqxOmm.exe
  C:\Windows\System\PcqxOmm.exe
  2⤵
  PID:5688
- C:\Windows\System\qHckaNZ.exe
  C:\Windows\System\qHckaNZ.exe
  2⤵
  PID:5764
- C:\Windows\System\kDcnLqm.exe
  C:\Windows\System\kDcnLqm.exe
  2⤵
  PID:5872
- C:\Windows\System\rtBNbEK.exe
  C:\Windows\System\rtBNbEK.exe
  2⤵
  PID:5880
- C:\Windows\System\vjKZKUU.exe
  C:\Windows\System\vjKZKUU.exe
  2⤵
  PID:5952
- C:\Windows\System\TifyLWo.exe
  C:\Windows\System\TifyLWo.exe
  2⤵
  PID:6004
- C:\Windows\System\BYAGWeG.exe
  C:\Windows\System\BYAGWeG.exe
  2⤵
  PID:6084
- C:\Windows\System\oxSMfwL.exe
  C:\Windows\System\oxSMfwL.exe
  2⤵
  PID:6128
- C:\Windows\System\RMLLRsF.exe
  C:\Windows\System\RMLLRsF.exe
  2⤵
  PID:5168
- C:\Windows\System\DfrnGfE.exe
  C:\Windows\System\DfrnGfE.exe
  2⤵
  PID:6064
- C:\Windows\System\TpBjpyV.exe
  C:\Windows\System\TpBjpyV.exe
  2⤵
  PID:4320
- C:\Windows\System\gEyikNv.exe
  C:\Windows\System\gEyikNv.exe
  2⤵
  PID:5244
- C:\Windows\System\SgSbazt.exe
  C:\Windows\System\SgSbazt.exe
  2⤵
  PID:4248
- C:\Windows\System\elqwojT.exe
  C:\Windows\System\elqwojT.exe
  2⤵
  PID:4572
- C:\Windows\System\WYZLVYQ.exe
  C:\Windows\System\WYZLVYQ.exe
  2⤵
  PID:3424
- C:\Windows\System\kieFBYm.exe
  C:\Windows\System\kieFBYm.exe
  2⤵
  PID:5260
- C:\Windows\System\vLwMSJD.exe
  C:\Windows\System\vLwMSJD.exe
  2⤵
  PID:5292
- C:\Windows\System\BbggTMZ.exe
  C:\Windows\System\BbggTMZ.exe
  2⤵
  PID:4324
- C:\Windows\System\oWIBcwq.exe
  C:\Windows\System\oWIBcwq.exe
  2⤵
  PID:5448
- C:\Windows\System\rZXRwvr.exe
  C:\Windows\System\rZXRwvr.exe
  2⤵
  PID:5344
- C:\Windows\System\aJEUVIb.exe
  C:\Windows\System\aJEUVIb.exe
  2⤵
  PID:5308
- C:\Windows\System\YxipDoz.exe
  C:\Windows\System\YxipDoz.exe
  2⤵
  PID:5664
- C:\Windows\System\gIGOPmf.exe
  C:\Windows\System\gIGOPmf.exe
  2⤵
  PID:4160
- C:\Windows\System\pmAPgeT.exe
  C:\Windows\System\pmAPgeT.exe
  2⤵
  PID:5576
- C:\Windows\System\MLwFNQE.exe
  C:\Windows\System\MLwFNQE.exe
  2⤵
  PID:5724
- C:\Windows\System\jhoyMab.exe
  C:\Windows\System\jhoyMab.exe
  2⤵
  PID:5684
- C:\Windows\System\MkSbdaV.exe
  C:\Windows\System\MkSbdaV.exe
  2⤵
  PID:5808
- C:\Windows\System\ShMHloo.exe
  C:\Windows\System\ShMHloo.exe
  2⤵
  PID:6040
- C:\Windows\System\cCUEvaN.exe
  C:\Windows\System\cCUEvaN.exe
  2⤵
  PID:5632
- C:\Windows\System\arCtFRi.exe
  C:\Windows\System\arCtFRi.exe
  2⤵
  PID:5596
- C:\Windows\System\xYtSySl.exe
  C:\Windows\System\xYtSySl.exe
  2⤵
  PID:5708
- C:\Windows\System\ZQFbtht.exe
  C:\Windows\System\ZQFbtht.exe
  2⤵
  PID:5904
- C:\Windows\System\zbHGnKs.exe
  C:\Windows\System\zbHGnKs.exe
  2⤵
  PID:6044
- C:\Windows\System\kHPpaQB.exe
  C:\Windows\System\kHPpaQB.exe
  2⤵
  PID:5924
- C:\Windows\System\pAayYaf.exe
  C:\Windows\System\pAayYaf.exe
  2⤵
  PID:5164
- C:\Windows\System\NCSfjjr.exe
  C:\Windows\System\NCSfjjr.exe
  2⤵
  PID:4704
- C:\Windows\System\vjRzSgo.exe
  C:\Windows\System\vjRzSgo.exe
  2⤵
  PID:4340
- C:\Windows\System\neWoPQi.exe
  C:\Windows\System\neWoPQi.exe
  2⤵
  PID:5960
- C:\Windows\System\QfEKZKB.exe
  C:\Windows\System\QfEKZKB.exe
  2⤵
  PID:6052
- C:\Windows\System\rdMTYyL.exe
  C:\Windows\System\rdMTYyL.exe
  2⤵
  PID:4708
- C:\Windows\System\smIsVGw.exe
  C:\Windows\System\smIsVGw.exe
  2⤵
  PID:4848
- C:\Windows\System\ShfWVJk.exe
  C:\Windows\System\ShfWVJk.exe
  2⤵
  PID:4760
- C:\Windows\System\XbvVEgv.exe
  C:\Windows\System\XbvVEgv.exe
  2⤵
  PID:5112
- C:\Windows\System\XxuHCyq.exe
  C:\Windows\System\XxuHCyq.exe
  2⤵
  PID:5784
- C:\Windows\System\UVxgpiA.exe
  C:\Windows\System\UVxgpiA.exe
  2⤵
  PID:5980
- C:\Windows\System\hUZeyAm.exe
  C:\Windows\System\hUZeyAm.exe
  2⤵
  PID:5600
- C:\Windows\System\ZTsLhKS.exe
  C:\Windows\System\ZTsLhKS.exe
  2⤵
  PID:2100
- C:\Windows\System\pEbCJma.exe
  C:\Windows\System\pEbCJma.exe
  2⤵
  PID:5876
- C:\Windows\System\iJcxyHO.exe
  C:\Windows\System\iJcxyHO.exe
  2⤵
  PID:5548
- C:\Windows\System\nvDQGyz.exe
  C:\Windows\System\nvDQGyz.exe
  2⤵
  PID:5272
- C:\Windows\System\JFbwaXi.exe
  C:\Windows\System\JFbwaXi.exe
  2⤵
  PID:4940
- C:\Windows\System\YOgCbRH.exe
  C:\Windows\System\YOgCbRH.exe
  2⤵
  PID:5368
- C:\Windows\System\gmbqDZl.exe
  C:\Windows\System\gmbqDZl.exe
  2⤵
  PID:6156
- C:\Windows\System\USoBqqH.exe
  C:\Windows\System\USoBqqH.exe
  2⤵
  PID:6172
- C:\Windows\System\EXkRvyj.exe
  C:\Windows\System\EXkRvyj.exe
  2⤵
  PID:6188
- C:\Windows\System\JRfjHqt.exe
  C:\Windows\System\JRfjHqt.exe
  2⤵
  PID:6204
- C:\Windows\System\BxvrAmf.exe
  C:\Windows\System\BxvrAmf.exe
  2⤵
  PID:6220
- C:\Windows\System\RYItiEB.exe
  C:\Windows\System\RYItiEB.exe
  2⤵
  PID:6236
- C:\Windows\System\HJClfbj.exe
  C:\Windows\System\HJClfbj.exe
  2⤵
  PID:6252
- C:\Windows\System\anrzZFx.exe
  C:\Windows\System\anrzZFx.exe
  2⤵
  PID:6268
- C:\Windows\System\lPZhWmb.exe
  C:\Windows\System\lPZhWmb.exe
  2⤵
  PID:6284
- C:\Windows\System\OKCZlts.exe
  C:\Windows\System\OKCZlts.exe
  2⤵
  PID:6300
- C:\Windows\System\mikUFeg.exe
  C:\Windows\System\mikUFeg.exe
  2⤵
  PID:6316
- C:\Windows\System\lwLgTNM.exe
  C:\Windows\System\lwLgTNM.exe
  2⤵
  PID:6332
- C:\Windows\System\frAyFJm.exe
  C:\Windows\System\frAyFJm.exe
  2⤵
  PID:6348
- C:\Windows\System\zzuXDwx.exe
  C:\Windows\System\zzuXDwx.exe
  2⤵
  PID:6364
- C:\Windows\System\tWqVQUT.exe
  C:\Windows\System\tWqVQUT.exe
  2⤵
  PID:6384
- C:\Windows\System\RzscZNm.exe
  C:\Windows\System\RzscZNm.exe
  2⤵
  PID:6404
- C:\Windows\System\ygAINdu.exe
  C:\Windows\System\ygAINdu.exe
  2⤵
  PID:6424
- C:\Windows\System\Siqolxa.exe
  C:\Windows\System\Siqolxa.exe
  2⤵
  PID:6444
- C:\Windows\System\SPGpPmL.exe
  C:\Windows\System\SPGpPmL.exe
  2⤵
  PID:6464
- C:\Windows\System\KCVMayK.exe
  C:\Windows\System\KCVMayK.exe
  2⤵
  PID:6484
- C:\Windows\System\rfoniTr.exe
  C:\Windows\System\rfoniTr.exe
  2⤵
  PID:6504
- C:\Windows\System\JghsUbf.exe
  C:\Windows\System\JghsUbf.exe
  2⤵
  PID:6524
- C:\Windows\System\ZxSRvcn.exe
  C:\Windows\System\ZxSRvcn.exe
  2⤵
  PID:6544
- C:\Windows\System\uYEfxbY.exe
  C:\Windows\System\uYEfxbY.exe
  2⤵
  PID:6564
- C:\Windows\System\EKvtkdB.exe
  C:\Windows\System\EKvtkdB.exe
  2⤵
  PID:6584
- C:\Windows\System\GiYurlv.exe
  C:\Windows\System\GiYurlv.exe
  2⤵
  PID:6612
- C:\Windows\System\JUzYrRz.exe
  C:\Windows\System\JUzYrRz.exe
  2⤵
  PID:6652
- C:\Windows\System\HXPcqNS.exe
  C:\Windows\System\HXPcqNS.exe
  2⤵
  PID:6708
- C:\Windows\System\cmeopvj.exe
  C:\Windows\System\cmeopvj.exe
  2⤵
  PID:6772
- C:\Windows\System\yhwLEIw.exe
  C:\Windows\System\yhwLEIw.exe
  2⤵
  PID:6788
- C:\Windows\System\TcRMEsa.exe
  C:\Windows\System\TcRMEsa.exe
  2⤵
  PID:6808
- C:\Windows\System\UhsHGNi.exe
  C:\Windows\System\UhsHGNi.exe
  2⤵
  PID:6824
- C:\Windows\System\UCfaflw.exe
  C:\Windows\System\UCfaflw.exe
  2⤵
  PID:6840
- C:\Windows\System\wsSwHLj.exe
  C:\Windows\System\wsSwHLj.exe
  2⤵
  PID:6864
- C:\Windows\System\uREaxcs.exe
  C:\Windows\System\uREaxcs.exe
  2⤵
  PID:6884
- C:\Windows\System\gMrOVTO.exe
  C:\Windows\System\gMrOVTO.exe
  2⤵
  PID:6904
- C:\Windows\System\wBHXBBI.exe
  C:\Windows\System\wBHXBBI.exe
  2⤵
  PID:6920
- C:\Windows\System\gzECGIM.exe
  C:\Windows\System\gzECGIM.exe
  2⤵
  PID:6940
- C:\Windows\System\SoTLbvu.exe
  C:\Windows\System\SoTLbvu.exe
  2⤵
  PID:6960
- C:\Windows\System\zYepTsC.exe
  C:\Windows\System\zYepTsC.exe
  2⤵
  PID:6980
- C:\Windows\System\XzOAjXS.exe
  C:\Windows\System\XzOAjXS.exe
  2⤵
  PID:6996
- C:\Windows\System\jJUfRLO.exe
  C:\Windows\System\jJUfRLO.exe
  2⤵
  PID:7016
- C:\Windows\System\FokGXlG.exe
  C:\Windows\System\FokGXlG.exe
  2⤵
  PID:7032
- C:\Windows\System\fvvydrO.exe
  C:\Windows\System\fvvydrO.exe
  2⤵
  PID:7080
- C:\Windows\System\NImidpy.exe
  C:\Windows\System\NImidpy.exe
  2⤵
  PID:7100
- C:\Windows\System\GtoOSFW.exe
  C:\Windows\System\GtoOSFW.exe
  2⤵
  PID:7120
- C:\Windows\System\yjXxuys.exe
  C:\Windows\System\yjXxuys.exe
  2⤵
  PID:7136
- C:\Windows\System\fyEnOvk.exe
  C:\Windows\System\fyEnOvk.exe
  2⤵
  PID:7156
- C:\Windows\System\AGFacaU.exe
  C:\Windows\System\AGFacaU.exe
  2⤵
  PID:5976
- C:\Windows\System\bKJCnaR.exe
  C:\Windows\System\bKJCnaR.exe
  2⤵
  PID:5340
- C:\Windows\System\UpLtibM.exe
  C:\Windows\System\UpLtibM.exe
  2⤵
  PID:6080
- C:\Windows\System\BPtHhAg.exe
  C:\Windows\System\BPtHhAg.exe
  2⤵
  PID:6148
- C:\Windows\System\SxDdzPx.exe
  C:\Windows\System\SxDdzPx.exe
  2⤵
  PID:6184
- C:\Windows\System\PVufcFq.exe
  C:\Windows\System\PVufcFq.exe
  2⤵
  PID:6308
- C:\Windows\System\elAyRZu.exe
  C:\Windows\System\elAyRZu.exe
  2⤵
  PID:6376
- C:\Windows\System\DZhssha.exe
  C:\Windows\System\DZhssha.exe
  2⤵
  PID:6420
- C:\Windows\System\vsiMxjo.exe
  C:\Windows\System\vsiMxjo.exe
  2⤵
  PID:6492
- C:\Windows\System\kmNSOYt.exe
  C:\Windows\System\kmNSOYt.exe
  2⤵
  PID:5388
- C:\Windows\System\RleKuGt.exe
  C:\Windows\System\RleKuGt.exe
  2⤵
  PID:5916
- C:\Windows\System\SsgAxXG.exe
  C:\Windows\System\SsgAxXG.exe
  2⤵
  PID:6536
- C:\Windows\System\FjqYMZr.exe
  C:\Windows\System\FjqYMZr.exe
  2⤵
  PID:6580
- C:\Windows\System\ITTMBcI.exe
  C:\Windows\System\ITTMBcI.exe
  2⤵
  PID:6480
- C:\Windows\System\xUdUHkF.exe
  C:\Windows\System\xUdUHkF.exe
  2⤵
  PID:6624
- C:\Windows\System\OzwWOeu.exe
  C:\Windows\System\OzwWOeu.exe
  2⤵
  PID:5180
- C:\Windows\System\gOAoMWI.exe
  C:\Windows\System\gOAoMWI.exe
  2⤵
  PID:6592
- C:\Windows\System\GQVjhcM.exe
  C:\Windows\System\GQVjhcM.exe
  2⤵
  PID:6604
- C:\Windows\System\tUPWtYu.exe
  C:\Windows\System\tUPWtYu.exe
  2⤵
  PID:5288
- C:\Windows\System\YUkeZlg.exe
  C:\Windows\System\YUkeZlg.exe
  2⤵
  PID:5840
- C:\Windows\System\lQJLJNv.exe
  C:\Windows\System\lQJLJNv.exe
  2⤵
  PID:5732
- C:\Windows\System\MGllszJ.exe
  C:\Windows\System\MGllszJ.exe
  2⤵
  PID:6168
- C:\Windows\System\qfzgRyK.exe
  C:\Windows\System\qfzgRyK.exe
  2⤵
  PID:6232
- C:\Windows\System\OBOabZB.exe
  C:\Windows\System\OBOabZB.exe
  2⤵
  PID:6296
- C:\Windows\System\OOizcxQ.exe
  C:\Windows\System\OOizcxQ.exe
  2⤵
  PID:6360
- C:\Windows\System\rxibKMT.exe
  C:\Windows\System\rxibKMT.exe
  2⤵
  PID:6716
- C:\Windows\System\fLqSnAx.exe
  C:\Windows\System\fLqSnAx.exe
  2⤵
  PID:6676
- C:\Windows\System\geiOFGG.exe
  C:\Windows\System\geiOFGG.exe
  2⤵
  PID:6696
- C:\Windows\System\IDDleAC.exe
  C:\Windows\System\IDDleAC.exe
  2⤵
  PID:6736
- C:\Windows\System\GSSGdgD.exe
  C:\Windows\System\GSSGdgD.exe
  2⤵
  PID:6752
- C:\Windows\System\NqllONa.exe
  C:\Windows\System\NqllONa.exe
  2⤵
  PID:6768
- C:\Windows\System\MlKSbgL.exe
  C:\Windows\System\MlKSbgL.exe
  2⤵
  PID:6880
- C:\Windows\System\OPwvLDp.exe
  C:\Windows\System\OPwvLDp.exe
  2⤵
  PID:6948
- C:\Windows\System\vgCxwCX.exe
  C:\Windows\System\vgCxwCX.exe
  2⤵
  PID:6992
- C:\Windows\System\KpDdAUI.exe
  C:\Windows\System\KpDdAUI.exe
  2⤵
  PID:6900
- C:\Windows\System\IMIdPei.exe
  C:\Windows\System\IMIdPei.exe
  2⤵
  PID:6852
- C:\Windows\System\pDiCwdD.exe
  C:\Windows\System\pDiCwdD.exe
  2⤵
  PID:6936
- C:\Windows\System\YkyhjPz.exe
  C:\Windows\System\YkyhjPz.exe
  2⤵
  PID:7012
- C:\Windows\System\KhwEPwn.exe
  C:\Windows\System\KhwEPwn.exe
  2⤵
  PID:7048
- C:\Windows\System\tvdFazH.exe
  C:\Windows\System\tvdFazH.exe
  2⤵
  PID:7088
- C:\Windows\System\kjmeWhJ.exe
  C:\Windows\System\kjmeWhJ.exe
  2⤵
  PID:7132
- C:\Windows\System\hcrysrY.exe
  C:\Windows\System\hcrysrY.exe
  2⤵
  PID:5468
- C:\Windows\System\BMwVVEP.exe
  C:\Windows\System\BMwVVEP.exe
  2⤵
  PID:6340
- C:\Windows\System\OiSxJRv.exe
  C:\Windows\System\OiSxJRv.exe
  2⤵
  PID:6024
- C:\Windows\System\UbYiTwe.exe
  C:\Windows\System\UbYiTwe.exe
  2⤵
  PID:5516
- C:\Windows\System\gmDNpwx.exe
  C:\Windows\System\gmDNpwx.exe
  2⤵
  PID:7112
- C:\Windows\System\KwZiejc.exe
  C:\Windows\System\KwZiejc.exe
  2⤵
  PID:7116
- C:\Windows\System\bogqIsX.exe
  C:\Windows\System\bogqIsX.exe
  2⤵
  PID:6276
- C:\Windows\System\uOBQHyF.exe
  C:\Windows\System\uOBQHyF.exe
  2⤵
  PID:6416
- C:\Windows\System\kJnqNZZ.exe
  C:\Windows\System\kJnqNZZ.exe
  2⤵
  PID:4868
- C:\Windows\System\WmwrPLt.exe
  C:\Windows\System\WmwrPLt.exe
  2⤵
  PID:6228
- C:\Windows\System\iXvDXfz.exe
  C:\Windows\System\iXvDXfz.exe
  2⤵
  PID:5780
- C:\Windows\System\RwTLXFX.exe
  C:\Windows\System\RwTLXFX.exe
  2⤵
  PID:5404
- C:\Windows\System\aciyzQO.exe
  C:\Windows\System\aciyzQO.exe
  2⤵
  PID:6292
- C:\Windows\System\bsXlUaO.exe
  C:\Windows\System\bsXlUaO.exe
  2⤵
  PID:6432
- C:\Windows\System\beywJFl.exe
  C:\Windows\System\beywJFl.exe
  2⤵
  PID:6476
- C:\Windows\System\xkyryoz.exe
  C:\Windows\System\xkyryoz.exe
  2⤵
  PID:6644
- C:\Windows\System\PtXvPQo.exe
  C:\Windows\System\PtXvPQo.exe
  2⤵
  PID:6728
- C:\Windows\System\bnChbWv.exe
  C:\Windows\System\bnChbWv.exe
  2⤵
  PID:6692
- C:\Windows\System\Agbwirx.exe
  C:\Windows\System\Agbwirx.exe
  2⤵
  PID:6780
- C:\Windows\System\zGVYgja.exe
  C:\Windows\System\zGVYgja.exe
  2⤵
  PID:6860
- C:\Windows\System\CqUHJwU.exe
  C:\Windows\System\CqUHJwU.exe
  2⤵
  PID:6748
- C:\Windows\System\ubQWVgW.exe
  C:\Windows\System\ubQWVgW.exe
  2⤵
  PID:6956
- C:\Windows\System\zlRcSEx.exe
  C:\Windows\System\zlRcSEx.exe
  2⤵
  PID:6972
- C:\Windows\System\IFPUqZC.exe
  C:\Windows\System\IFPUqZC.exe
  2⤵
  PID:6836
- C:\Windows\System\nuZGRYj.exe
  C:\Windows\System\nuZGRYj.exe
  2⤵
  PID:6848
- C:\Windows\System\PrFgblX.exe
  C:\Windows\System\PrFgblX.exe
  2⤵
  PID:7096
- C:\Windows\System\jmHaPKk.exe
  C:\Windows\System\jmHaPKk.exe
  2⤵
  PID:6180
- C:\Windows\System\DeHtKGB.exe
  C:\Windows\System\DeHtKGB.exe
  2⤵
  PID:6576
- C:\Windows\System\dtUguGI.exe
  C:\Windows\System\dtUguGI.exe
  2⤵
  PID:5920
- C:\Windows\System\SMisgFc.exe
  C:\Windows\System\SMisgFc.exe
  2⤵
  PID:5648
- C:\Windows\System\FnPdVNj.exe
  C:\Windows\System\FnPdVNj.exe
  2⤵
  PID:6512
- C:\Windows\System\nbgUhFl.exe
  C:\Windows\System\nbgUhFl.exe
  2⤵
  PID:7108
- C:\Windows\System\nBGfAaC.exe
  C:\Windows\System\nBGfAaC.exe
  2⤵
  PID:5324
- C:\Windows\System\iJyOuPy.exe
  C:\Windows\System\iJyOuPy.exe
  2⤵
  PID:6892
- C:\Windows\System\nNXAamR.exe
  C:\Windows\System\nNXAamR.exe
  2⤵
  PID:6760
- C:\Windows\System\GZgxIOs.exe
  C:\Windows\System\GZgxIOs.exe
  2⤵
  PID:6800
- C:\Windows\System\vlpZYHo.exe
  C:\Windows\System\vlpZYHo.exe
  2⤵
  PID:6872
- C:\Windows\System\UwBbVMa.exe
  C:\Windows\System\UwBbVMa.exe
  2⤵
  PID:7072
- C:\Windows\System\RwMTWsv.exe
  C:\Windows\System\RwMTWsv.exe
  2⤵
  PID:5820
- C:\Windows\System\uGLadlD.exe
  C:\Windows\System\uGLadlD.exe
  2⤵
  PID:6440
- C:\Windows\System\rLmIuuE.exe
  C:\Windows\System\rLmIuuE.exe
  2⤵
  PID:4212
- C:\Windows\System\EYxCvUR.exe
  C:\Windows\System\EYxCvUR.exe
  2⤵
  PID:6472
- C:\Windows\System\HgexkGc.exe
  C:\Windows\System\HgexkGc.exe
  2⤵
  PID:5860
- C:\Windows\System\CsvczWJ.exe
  C:\Windows\System\CsvczWJ.exe
  2⤵
  PID:6532
- C:\Windows\System\ZmtlJrR.exe
  C:\Windows\System\ZmtlJrR.exe
  2⤵
  PID:7052
- C:\Windows\System\tOMxApL.exe
  C:\Windows\System\tOMxApL.exe
  2⤵
  PID:6164
- C:\Windows\System\IybUpfB.exe
  C:\Windows\System\IybUpfB.exe
  2⤵
  PID:6456
- C:\Windows\System\UxaxRxy.exe
  C:\Windows\System\UxaxRxy.exe
  2⤵
  PID:7180
- C:\Windows\System\qNjUBTV.exe
  C:\Windows\System\qNjUBTV.exe
  2⤵
  PID:7208
- C:\Windows\System\aUPHlXK.exe
  C:\Windows\System\aUPHlXK.exe
  2⤵
  PID:7248
- C:\Windows\System\SplfhuX.exe
  C:\Windows\System\SplfhuX.exe
  2⤵
  PID:7268
- C:\Windows\System\MfzrIZA.exe
  C:\Windows\System\MfzrIZA.exe
  2⤵
  PID:7284
- C:\Windows\System\CcRVhpx.exe
  C:\Windows\System\CcRVhpx.exe
  2⤵
  PID:7300
- C:\Windows\System\JXkrTlU.exe
  C:\Windows\System\JXkrTlU.exe
  2⤵
  PID:7324
- C:\Windows\System\tVaBsIB.exe
  C:\Windows\System\tVaBsIB.exe
  2⤵
  PID:7344
- C:\Windows\System\wFbiQTF.exe
  C:\Windows\System\wFbiQTF.exe
  2⤵
  PID:7364
- C:\Windows\System\NjWUFve.exe
  C:\Windows\System\NjWUFve.exe
  2⤵
  PID:7384
- C:\Windows\System\LaaIVju.exe
  C:\Windows\System\LaaIVju.exe
  2⤵
  PID:7404
- C:\Windows\System\dLkxqdW.exe
  C:\Windows\System\dLkxqdW.exe
  2⤵
  PID:7428
- C:\Windows\System\yVQrIOu.exe
  C:\Windows\System\yVQrIOu.exe
  2⤵
  PID:7444
- C:\Windows\System\KYBStJw.exe
  C:\Windows\System\KYBStJw.exe
  2⤵
  PID:7460
- C:\Windows\System\QemeYka.exe
  C:\Windows\System\QemeYka.exe
  2⤵
  PID:7480
- C:\Windows\System\pZcirwO.exe
  C:\Windows\System\pZcirwO.exe
  2⤵
  PID:7504
- C:\Windows\System\lvwIPhy.exe
  C:\Windows\System\lvwIPhy.exe
  2⤵
  PID:7520
- C:\Windows\System\wAKMKrZ.exe
  C:\Windows\System\wAKMKrZ.exe
  2⤵
  PID:7540
- C:\Windows\System\wSsfLDs.exe
  C:\Windows\System\wSsfLDs.exe
  2⤵
  PID:7556
- C:\Windows\System\hpkQRIY.exe
  C:\Windows\System\hpkQRIY.exe
  2⤵
  PID:7576
- C:\Windows\System\AcTeNFw.exe
  C:\Windows\System\AcTeNFw.exe
  2⤵
  PID:7612
- C:\Windows\System\gSpQKNK.exe
  C:\Windows\System\gSpQKNK.exe
  2⤵
  PID:7632
- C:\Windows\System\JwbOFNp.exe
  C:\Windows\System\JwbOFNp.exe
  2⤵
  PID:7656
- C:\Windows\System\wbPxJEH.exe
  C:\Windows\System\wbPxJEH.exe
  2⤵
  PID:7672
- C:\Windows\System\vRiuQRj.exe
  C:\Windows\System\vRiuQRj.exe
  2⤵
  PID:7696
- C:\Windows\System\bSBhcDS.exe
  C:\Windows\System\bSBhcDS.exe
  2⤵
  PID:7712
- C:\Windows\System\LimfIrD.exe
  C:\Windows\System\LimfIrD.exe
  2⤵
  PID:7732
- C:\Windows\System\dAzabKT.exe
  C:\Windows\System\dAzabKT.exe
  2⤵
  PID:7748
- C:\Windows\System\NBkpagt.exe
  C:\Windows\System\NBkpagt.exe
  2⤵
  PID:7768
- C:\Windows\System\yYgiklJ.exe
  C:\Windows\System\yYgiklJ.exe
  2⤵
  PID:7788
- C:\Windows\System\cStJSVF.exe
  C:\Windows\System\cStJSVF.exe
  2⤵
  PID:7804
- C:\Windows\System\zSpWHDM.exe
  C:\Windows\System\zSpWHDM.exe
  2⤵
  PID:7828
- C:\Windows\System\rQtPFPB.exe
  C:\Windows\System\rQtPFPB.exe
  2⤵
  PID:7844
- C:\Windows\System\auyEfwV.exe
  C:\Windows\System\auyEfwV.exe
  2⤵
  PID:7860
- C:\Windows\System\zVehibc.exe
  C:\Windows\System\zVehibc.exe
  2⤵
  PID:7880
- C:\Windows\System\cKuzMLv.exe
  C:\Windows\System\cKuzMLv.exe
  2⤵
  PID:7896
- C:\Windows\System\tSFNtwC.exe
  C:\Windows\System\tSFNtwC.exe
  2⤵
  PID:7928
- C:\Windows\System\bFqwLYW.exe
  C:\Windows\System\bFqwLYW.exe
  2⤵
  PID:7952
- C:\Windows\System\BBOZiOc.exe
  C:\Windows\System\BBOZiOc.exe
  2⤵
  PID:7968
- C:\Windows\System\dTxFBff.exe
  C:\Windows\System\dTxFBff.exe
  2⤵
  PID:7984
- C:\Windows\System\BTvbDJU.exe
  C:\Windows\System\BTvbDJU.exe
  2⤵
  PID:8004
- C:\Windows\System\ikVglcc.exe
  C:\Windows\System\ikVglcc.exe
  2⤵
  PID:8020
- C:\Windows\System\TspUjVX.exe
  C:\Windows\System\TspUjVX.exe
  2⤵
  PID:8040
- C:\Windows\System\AJdmazH.exe
  C:\Windows\System\AJdmazH.exe
  2⤵
  PID:8060
- C:\Windows\System\UQsbWJj.exe
  C:\Windows\System\UQsbWJj.exe
  2⤵
  PID:8076
- C:\Windows\System\GMVlQYX.exe
  C:\Windows\System\GMVlQYX.exe
  2⤵
  PID:8096
- C:\Windows\System\kExBYdY.exe
  C:\Windows\System\kExBYdY.exe
  2⤵
  PID:8116
- C:\Windows\System\kNIDqzM.exe
  C:\Windows\System\kNIDqzM.exe
  2⤵
  PID:8132
- C:\Windows\System\Ccibcgm.exe
  C:\Windows\System\Ccibcgm.exe
  2⤵
  PID:8152
- C:\Windows\System\ONninYW.exe
  C:\Windows\System\ONninYW.exe
  2⤵
  PID:8172
- C:\Windows\System\tBtZNIG.exe
  C:\Windows\System\tBtZNIG.exe
  2⤵
  PID:6380
- C:\Windows\System\fbWnFdH.exe
  C:\Windows\System\fbWnFdH.exe
  2⤵
  PID:6260
- C:\Windows\System\kBjAeeH.exe
  C:\Windows\System\kBjAeeH.exe
  2⤵
  PID:6372
- C:\Windows\System\UTWyPDi.exe
  C:\Windows\System\UTWyPDi.exe
  2⤵
  PID:6556
- C:\Windows\System\WQdDycq.exe
  C:\Windows\System\WQdDycq.exe
  2⤵
  PID:7244
- C:\Windows\System\iAKIlmo.exe
  C:\Windows\System\iAKIlmo.exe
  2⤵
  PID:5148
- C:\Windows\System\JpGMVsz.exe
  C:\Windows\System\JpGMVsz.exe
  2⤵
  PID:6876
- C:\Windows\System\kPkqsbe.exe
  C:\Windows\System\kPkqsbe.exe
  2⤵
  PID:4524
- C:\Windows\System\wEpKQZu.exe
  C:\Windows\System\wEpKQZu.exe
  2⤵
  PID:6672
- C:\Windows\System\NVlBxzQ.exe
  C:\Windows\System\NVlBxzQ.exe
  2⤵
  PID:7200
- C:\Windows\System\xxCTXmG.exe
  C:\Windows\System\xxCTXmG.exe
  2⤵
  PID:7280
- C:\Windows\System\UmvOFNT.exe
  C:\Windows\System\UmvOFNT.exe
  2⤵
  PID:7352
- C:\Windows\System\gLyslQs.exe
  C:\Windows\System\gLyslQs.exe
  2⤵
  PID:7044
- C:\Windows\System\ALYfPmr.exe
  C:\Windows\System\ALYfPmr.exe
  2⤵
  PID:7396
- C:\Windows\System\nuofimE.exe
  C:\Windows\System\nuofimE.exe
  2⤵
  PID:7264
- C:\Windows\System\eTknmJp.exe
  C:\Windows\System\eTknmJp.exe
  2⤵
  PID:7472
- C:\Windows\System\qHXtyLh.exe
  C:\Windows\System\qHXtyLh.exe
  2⤵
  PID:7340
- C:\Windows\System\JuCqTum.exe
  C:\Windows\System\JuCqTum.exe
  2⤵
  PID:7584
- C:\Windows\System\vWXucKI.exe
  C:\Windows\System\vWXucKI.exe
  2⤵
  PID:7416
- C:\Windows\System\IlbUuDr.exe
  C:\Windows\System\IlbUuDr.exe
  2⤵
  PID:7380
- C:\Windows\System\EBwvMsp.exe
  C:\Windows\System\EBwvMsp.exe
  2⤵
  PID:7532
- C:\Windows\System\MRJwlpX.exe
  C:\Windows\System\MRJwlpX.exe
  2⤵
  PID:7456
- C:\Windows\System\UvdBSct.exe
  C:\Windows\System\UvdBSct.exe
  2⤵
  PID:7648
- C:\Windows\System\qYzdwPA.exe
  C:\Windows\System\qYzdwPA.exe
  2⤵
  PID:7680
- C:\Windows\System\SrfPtDo.exe
  C:\Windows\System\SrfPtDo.exe
  2⤵
  PID:7708
- C:\Windows\System\GoVyacU.exe
  C:\Windows\System\GoVyacU.exe
  2⤵
  PID:7756
- C:\Windows\System\KbLuNXw.exe
  C:\Windows\System\KbLuNXw.exe
  2⤵
  PID:7780
- C:\Windows\System\xCvsOTd.exe
  C:\Windows\System\xCvsOTd.exe
  2⤵
  PID:7872
- C:\Windows\System\klpuInA.exe
  C:\Windows\System\klpuInA.exe
  2⤵
  PID:7916
- C:\Windows\System\PCycUyR.exe
  C:\Windows\System\PCycUyR.exe
  2⤵
  PID:7812
- C:\Windows\System\UmRWgTY.exe
  C:\Windows\System\UmRWgTY.exe
  2⤵
  PID:7908
- C:\Windows\System\eUNdufs.exe
  C:\Windows\System\eUNdufs.exe
  2⤵
  PID:8032
- C:\Windows\System\zHmhUbp.exe
  C:\Windows\System\zHmhUbp.exe
  2⤵
  PID:8036
- C:\Windows\System\riwVPuX.exe
  C:\Windows\System\riwVPuX.exe
  2⤵
  PID:7936
- C:\Windows\System\jeCcyEM.exe
  C:\Windows\System\jeCcyEM.exe
  2⤵
  PID:7944
- C:\Windows\System\GJRLOEU.exe
  C:\Windows\System\GJRLOEU.exe
  2⤵
  PID:8112
- C:\Windows\System\TBhTaiw.exe
  C:\Windows\System\TBhTaiw.exe
  2⤵
  PID:8184
- C:\Windows\System\OwhMRql.exe
  C:\Windows\System\OwhMRql.exe
  2⤵
  PID:7228
- C:\Windows\System\FIeUwRB.exe
  C:\Windows\System\FIeUwRB.exe
  2⤵
  PID:8056
- C:\Windows\System\OFriBsK.exe
  C:\Windows\System\OFriBsK.exe
  2⤵
  PID:6640
- C:\Windows\System\SdgzpsF.exe
  C:\Windows\System\SdgzpsF.exe
  2⤵
  PID:8124
- C:\Windows\System\bVcYhFO.exe
  C:\Windows\System\bVcYhFO.exe
  2⤵
  PID:7360
- C:\Windows\System\IndWnCB.exe
  C:\Windows\System\IndWnCB.exe
  2⤵
  PID:7420
- C:\Windows\System\rwfjIHx.exe
  C:\Windows\System\rwfjIHx.exe
  2⤵
  PID:8164
- C:\Windows\System\RtDvhGb.exe
  C:\Windows\System\RtDvhGb.exe
  2⤵
  PID:7516
- C:\Windows\System\CazBVCP.exe
  C:\Windows\System\CazBVCP.exe
  2⤵
  PID:7496
- C:\Windows\System\APOncns.exe
  C:\Windows\System\APOncns.exe
  2⤵
  PID:7624
- C:\Windows\System\hkihBQF.exe
  C:\Windows\System\hkihBQF.exe
  2⤵
  PID:8168
- C:\Windows\System\geFBNGj.exe
  C:\Windows\System\geFBNGj.exe
  2⤵
  PID:6744
- C:\Windows\System\spfxAmk.exe
  C:\Windows\System\spfxAmk.exe
  2⤵
  PID:7312
- C:\Windows\System\aOWrQko.exe
  C:\Windows\System\aOWrQko.exe
  2⤵
  PID:7392
- C:\Windows\System\OoDxlpd.exe
  C:\Windows\System\OoDxlpd.exe
  2⤵
  PID:7468
- C:\Windows\System\RkQSVfc.exe
  C:\Windows\System\RkQSVfc.exe
  2⤵
  PID:7572
- C:\Windows\System\hojaXHF.exe
  C:\Windows\System\hojaXHF.exe
  2⤵
  PID:7452
- C:\Windows\System\XsCjUrC.exe
  C:\Windows\System\XsCjUrC.exe
  2⤵
  PID:7764
- C:\Windows\System\xHOYmTb.exe
  C:\Windows\System\xHOYmTb.exe
  2⤵
  PID:7840
- C:\Windows\System\MPkHrlo.exe
  C:\Windows\System\MPkHrlo.exe
  2⤵
  PID:7724
- C:\Windows\System\JKEhHrw.exe
  C:\Windows\System\JKEhHrw.exe
  2⤵
  PID:7824
- C:\Windows\System\gTKvJDg.exe
  C:\Windows\System\gTKvJDg.exe
  2⤵
  PID:8072
- C:\Windows\System\LeUSVLX.exe
  C:\Windows\System\LeUSVLX.exe
  2⤵
  PID:7784
- C:\Windows\System\rpQMmHj.exe
  C:\Windows\System\rpQMmHj.exe
  2⤵
  PID:7924
- C:\Windows\System\VCntClC.exe
  C:\Windows\System\VCntClC.exe
  2⤵
  PID:8140
- C:\Windows\System\OhGDfMc.exe
  C:\Windows\System\OhGDfMc.exe
  2⤵
  PID:8160
- C:\Windows\System\QKdAgxU.exe
  C:\Windows\System\QKdAgxU.exe
  2⤵
  PID:7600
- C:\Windows\System\CozBAnE.exe
  C:\Windows\System\CozBAnE.exe
  2⤵
  PID:7068
- C:\Windows\System\DyinSas.exe
  C:\Windows\System\DyinSas.exe
  2⤵
  PID:6916
- C:\Windows\System\ZCTBxEU.exe
  C:\Windows\System\ZCTBxEU.exe
  2⤵
  PID:7704
- C:\Windows\System\iriDdgA.exe
  C:\Windows\System\iriDdgA.exe
  2⤵
  PID:7996
- C:\Windows\System\YeNWciJ.exe
  C:\Windows\System\YeNWciJ.exe
  2⤵
  PID:7892
- C:\Windows\System\ZXjhbKe.exe
  C:\Windows\System\ZXjhbKe.exe
  2⤵
  PID:7800
- C:\Windows\System\OnSCJVs.exe
  C:\Windows\System\OnSCJVs.exe
  2⤵
  PID:8108
- C:\Windows\System\ZUOnjDv.exe
  C:\Windows\System\ZUOnjDv.exe
  2⤵
  PID:7188
- C:\Windows\System\qWPbxTK.exe
  C:\Windows\System\qWPbxTK.exe
  2⤵
  PID:7564
- C:\Windows\System\bDkrfni.exe
  C:\Windows\System\bDkrfni.exe
  2⤵
  PID:7060
- C:\Windows\System\VrKNBSe.exe
  C:\Windows\System\VrKNBSe.exe
  2⤵
  PID:7424
- C:\Windows\System\YBYKarw.exe
  C:\Windows\System\YBYKarw.exe
  2⤵
  PID:7684
- C:\Windows\System\LAUaHlS.exe
  C:\Windows\System\LAUaHlS.exe
  2⤵
  PID:7192
- C:\Windows\System\ZiXJACh.exe
  C:\Windows\System\ZiXJACh.exe
  2⤵
  PID:7152
- C:\Windows\System\VfRJXZL.exe
  C:\Windows\System\VfRJXZL.exe
  2⤵
  PID:6832
- C:\Windows\System\lNGkYtw.exe
  C:\Windows\System\lNGkYtw.exe
  2⤵
  PID:7492
- C:\Windows\System\QalzvQj.exe
  C:\Windows\System\QalzvQj.exe
  2⤵
  PID:7628
- C:\Windows\System\DrbKWQc.exe
  C:\Windows\System\DrbKWQc.exe
  2⤵
  PID:7196
- C:\Windows\System\CJsQmCg.exe
  C:\Windows\System\CJsQmCg.exe
  2⤵
  PID:8200
- C:\Windows\System\EmvDWfi.exe
  C:\Windows\System\EmvDWfi.exe
  2⤵
  PID:8216
- C:\Windows\System\LohGoak.exe
  C:\Windows\System\LohGoak.exe
  2⤵
  PID:8276
- C:\Windows\System\gPqPtPO.exe
  C:\Windows\System\gPqPtPO.exe
  2⤵
  PID:8292
- C:\Windows\System\NkeUTqO.exe
  C:\Windows\System\NkeUTqO.exe
  2⤵
  PID:8308
- C:\Windows\System\ThoUcCZ.exe
  C:\Windows\System\ThoUcCZ.exe
  2⤵
  PID:8324
- C:\Windows\System\misPBUL.exe
  C:\Windows\System\misPBUL.exe
  2⤵
  PID:8344
- C:\Windows\System\PRKegJB.exe
  C:\Windows\System\PRKegJB.exe
  2⤵
  PID:8364
- C:\Windows\System\XHTvEiw.exe
  C:\Windows\System\XHTvEiw.exe
  2⤵
  PID:8384
- C:\Windows\System\dQYlYHr.exe
  C:\Windows\System\dQYlYHr.exe
  2⤵
  PID:8404
- C:\Windows\System\wMJYYRp.exe
  C:\Windows\System\wMJYYRp.exe
  2⤵
  PID:8420
- C:\Windows\System\rXaSoBl.exe
  C:\Windows\System\rXaSoBl.exe
  2⤵
  PID:8436
- C:\Windows\System\FhJgcJq.exe
  C:\Windows\System\FhJgcJq.exe
  2⤵
  PID:8452
- C:\Windows\System\IKirExe.exe
  C:\Windows\System\IKirExe.exe
  2⤵
  PID:8468
- C:\Windows\System\xsfDpVj.exe
  C:\Windows\System\xsfDpVj.exe
  2⤵
  PID:8484
- C:\Windows\System\xEsQyfd.exe
  C:\Windows\System\xEsQyfd.exe
  2⤵
  PID:8500
- C:\Windows\System\aOycMTj.exe
  C:\Windows\System\aOycMTj.exe
  2⤵
  PID:8516
- C:\Windows\System\pfcTqEy.exe
  C:\Windows\System\pfcTqEy.exe
  2⤵
  PID:8540
- C:\Windows\System\hIgzxWu.exe
  C:\Windows\System\hIgzxWu.exe
  2⤵
  PID:8556
- C:\Windows\System\pcRTikj.exe
  C:\Windows\System\pcRTikj.exe
  2⤵
  PID:8616
- C:\Windows\System\sxwKEzA.exe
  C:\Windows\System\sxwKEzA.exe
  2⤵
  PID:8636
- C:\Windows\System\hcxyXrs.exe
  C:\Windows\System\hcxyXrs.exe
  2⤵
  PID:8656
- C:\Windows\System\fPEUaDR.exe
  C:\Windows\System\fPEUaDR.exe
  2⤵
  PID:8672
- C:\Windows\System\swJbEeT.exe
  C:\Windows\System\swJbEeT.exe
  2⤵
  PID:8688
- C:\Windows\System\XqvVtvk.exe
  C:\Windows\System\XqvVtvk.exe
  2⤵
  PID:8708
- C:\Windows\System\iCKXBCd.exe
  C:\Windows\System\iCKXBCd.exe
  2⤵
  PID:8724
- C:\Windows\System\dpCoyXj.exe
  C:\Windows\System\dpCoyXj.exe
  2⤵
  PID:8740
- C:\Windows\System\GSvMibc.exe
  C:\Windows\System\GSvMibc.exe
  2⤵
  PID:8756
- C:\Windows\System\GtGrPcH.exe
  C:\Windows\System\GtGrPcH.exe
  2⤵
  PID:8772
- C:\Windows\System\oHmjEOr.exe
  C:\Windows\System\oHmjEOr.exe
  2⤵
  PID:8788
- C:\Windows\System\qGLQUOi.exe
  C:\Windows\System\qGLQUOi.exe
  2⤵
  PID:8808
- C:\Windows\System\ghglWcj.exe
  C:\Windows\System\ghglWcj.exe
  2⤵
  PID:8828
- C:\Windows\System\HorssTw.exe
  C:\Windows\System\HorssTw.exe
  2⤵
  PID:8848
- C:\Windows\System\iqGWjHM.exe
  C:\Windows\System\iqGWjHM.exe
  2⤵
  PID:8864
- C:\Windows\System\szDylnC.exe
  C:\Windows\System\szDylnC.exe
  2⤵
  PID:8888
- C:\Windows\System\CokbaHA.exe
  C:\Windows\System\CokbaHA.exe
  2⤵
  PID:8904
- C:\Windows\System\rxUWdxF.exe
  C:\Windows\System\rxUWdxF.exe
  2⤵
  PID:8920
- C:\Windows\System\PvoGtCN.exe
  C:\Windows\System\PvoGtCN.exe
  2⤵
  PID:8944
- C:\Windows\System\vCarbbN.exe
  C:\Windows\System\vCarbbN.exe
  2⤵
  PID:8968
- C:\Windows\System\FsfGGyY.exe
  C:\Windows\System\FsfGGyY.exe
  2⤵
  PID:8992
- C:\Windows\System\tbYNgwU.exe
  C:\Windows\System\tbYNgwU.exe
  2⤵
  PID:9040
- C:\Windows\System\XzOoigv.exe
  C:\Windows\System\XzOoigv.exe
  2⤵
  PID:9056
- C:\Windows\System\ZLYxChN.exe
  C:\Windows\System\ZLYxChN.exe
  2⤵
  PID:9072
- C:\Windows\System\wBNTmdk.exe
  C:\Windows\System\wBNTmdk.exe
  2⤵
  PID:9088
- C:\Windows\System\blZnRee.exe
  C:\Windows\System\blZnRee.exe
  2⤵
  PID:9124
- C:\Windows\System\OssoGiB.exe
  C:\Windows\System\OssoGiB.exe
  2⤵
  PID:9140
- C:\Windows\System\IanhbnO.exe
  C:\Windows\System\IanhbnO.exe
  2⤵
  PID:9156
- C:\Windows\System\nXWhYvP.exe
  C:\Windows\System\nXWhYvP.exe
  2⤵
  PID:9172
- C:\Windows\System\GsUMybY.exe
  C:\Windows\System\GsUMybY.exe
  2⤵
  PID:9188
- C:\Windows\System\mjgVCzK.exe
  C:\Windows\System\mjgVCzK.exe
  2⤵
  PID:9204
- C:\Windows\System\iuWTjwW.exe
  C:\Windows\System\iuWTjwW.exe
  2⤵
  PID:6152
- C:\Windows\System\aFnehfo.exe
  C:\Windows\System\aFnehfo.exe
  2⤵
  PID:7216
- C:\Windows\System\YIewNrJ.exe
  C:\Windows\System\YIewNrJ.exe
  2⤵
  PID:8092
- C:\Windows\System\GORBhDv.exe
  C:\Windows\System\GORBhDv.exe
  2⤵
  PID:7888
- C:\Windows\System\mYNjtiE.exe
  C:\Windows\System\mYNjtiE.exe
  2⤵
  PID:8224
- C:\Windows\System\cXzzcWC.exe
  C:\Windows\System\cXzzcWC.exe
  2⤵
  PID:8244
- C:\Windows\System\UGGZUpw.exe
  C:\Windows\System\UGGZUpw.exe
  2⤵
  PID:8332
- C:\Windows\System\qjYXWTz.exe
  C:\Windows\System\qjYXWTz.exe
  2⤵
  PID:8448
- C:\Windows\System\djzBXJQ.exe
  C:\Windows\System\djzBXJQ.exe
  2⤵
  PID:8360
- C:\Windows\System\ItQIZGX.exe
  C:\Windows\System\ItQIZGX.exe
  2⤵
  PID:8288
- C:\Windows\System\sWYzDoj.exe
  C:\Windows\System\sWYzDoj.exe
  2⤵
  PID:8416
- C:\Windows\System\PJtgsxm.exe
  C:\Windows\System\PJtgsxm.exe
  2⤵
  PID:8512
- C:\Windows\System\HsKdIfL.exe
  C:\Windows\System\HsKdIfL.exe
  2⤵
  PID:8496
- C:\Windows\System\MmYxCGN.exe
  C:\Windows\System\MmYxCGN.exe
  2⤵
  PID:8528
- C:\Windows\System\VtCoNQV.exe
  C:\Windows\System\VtCoNQV.exe
  2⤵
  PID:8584
- C:\Windows\System\pVFmVTG.exe
  C:\Windows\System\pVFmVTG.exe
  2⤵
  PID:8604
- C:\Windows\System\yNeGdoi.exe
  C:\Windows\System\yNeGdoi.exe
  2⤵
  PID:8664
- C:\Windows\System\uxaWVDh.exe
  C:\Windows\System\uxaWVDh.exe
  2⤵
  PID:8704
- C:\Windows\System\QLdAzBw.exe
  C:\Windows\System\QLdAzBw.exe
  2⤵
  PID:8764
- C:\Windows\System\zcORWwA.exe
  C:\Windows\System\zcORWwA.exe
  2⤵
  PID:8804
- C:\Windows\System\ENXbkyb.exe
  C:\Windows\System\ENXbkyb.exe
  2⤵
  PID:8876
- C:\Windows\System\fgAAguE.exe
  C:\Windows\System\fgAAguE.exe
  2⤵
  PID:8952
- C:\Windows\System\vfEWdpL.exe
  C:\Windows\System\vfEWdpL.exe
  2⤵
  PID:8784
- C:\Windows\System\QUrjYca.exe
  C:\Windows\System\QUrjYca.exe
  2⤵
  PID:8652
- C:\Windows\System\AFRgDmE.exe
  C:\Windows\System\AFRgDmE.exe
  2⤵
  PID:8684
- C:\Windows\System\QOGwAJW.exe
  C:\Windows\System\QOGwAJW.exe
  2⤵
  PID:8860
- C:\Windows\System\vSzaVpV.exe
  C:\Windows\System\vSzaVpV.exe
  2⤵
  PID:8984
- C:\Windows\System\tZjQTfS.exe
  C:\Windows\System\tZjQTfS.exe
  2⤵
  PID:8748
- C:\Windows\System\ckuISPe.exe
  C:\Windows\System\ckuISPe.exe
  2⤵
  PID:9020
- C:\Windows\System\OftWDLx.exe
  C:\Windows\System\OftWDLx.exe
  2⤵
  PID:7568
- C:\Windows\System\heniTMY.exe
  C:\Windows\System\heniTMY.exe
  2⤵
  PID:9068
- C:\Windows\System\dsVWyBd.exe
  C:\Windows\System\dsVWyBd.exe
  2⤵
  PID:9136
- C:\Windows\System\rQgpuBq.exe
  C:\Windows\System\rQgpuBq.exe
  2⤵
  PID:9184
- C:\Windows\System\LUciycx.exe
  C:\Windows\System\LUciycx.exe
  2⤵
  PID:8128
- C:\Windows\System\mWENHVA.exe
  C:\Windows\System\mWENHVA.exe
  2⤵
  PID:7552
- C:\Windows\System\vxAgwyl.exe
  C:\Windows\System\vxAgwyl.exe
  2⤵
  PID:9200
- C:\Windows\System\qBWhOuI.exe
  C:\Windows\System\qBWhOuI.exe
  2⤵
  PID:8240
- C:\Windows\System\yITYVvD.exe
  C:\Windows\System\yITYVvD.exe
  2⤵
  PID:8264
- C:\Windows\System\WWKtFnS.exe
  C:\Windows\System\WWKtFnS.exe
  2⤵
  PID:8208
- C:\Windows\System\Dkrcwui.exe
  C:\Windows\System\Dkrcwui.exe
  2⤵
  PID:8340
- C:\Windows\System\NGBupDx.exe
  C:\Windows\System\NGBupDx.exe
  2⤵
  PID:8356
- C:\Windows\System\AQKzeUR.exe
  C:\Windows\System\AQKzeUR.exe
  2⤵
  PID:8432
- C:\Windows\System\uGlThir.exe
  C:\Windows\System\uGlThir.exe
  2⤵
  PID:8552
- C:\Windows\System\rbrTQos.exe
  C:\Windows\System\rbrTQos.exe
  2⤵
  PID:8592
- C:\Windows\System\TWzQbvm.exe
  C:\Windows\System\TWzQbvm.exe
  2⤵
  PID:8624
- C:\Windows\System\sqCrKJO.exe
  C:\Windows\System\sqCrKJO.exe
  2⤵
  PID:8700
- C:\Windows\System\EvpnKKf.exe
  C:\Windows\System\EvpnKKf.exe
  2⤵
  PID:8720
- C:\Windows\System\YvgjxmM.exe
  C:\Windows\System\YvgjxmM.exe
  2⤵
  PID:8796
- C:\Windows\System\OIPDHGM.exe
  C:\Windows\System\OIPDHGM.exe
  2⤵
  PID:8884
- C:\Windows\System\hPPQzpo.exe
  C:\Windows\System\hPPQzpo.exe
  2⤵
  PID:8932
- C:\Windows\System\lYARJVB.exe
  C:\Windows\System\lYARJVB.exe
  2⤵
  PID:9012
- C:\Windows\System\SEPKWjO.exe
  C:\Windows\System\SEPKWjO.exe
  2⤵
  PID:8900
- C:\Windows\System\gUKPSyv.exe
  C:\Windows\System\gUKPSyv.exe
  2⤵
  PID:9032
- C:\Windows\System\hfDlGQH.exe
  C:\Windows\System\hfDlGQH.exe
  2⤵
  PID:9084
- C:\Windows\System\EgrmGQa.exe
  C:\Windows\System\EgrmGQa.exe
  2⤵
  PID:9104
- C:\Windows\System\sUXqvVE.exe
  C:\Windows\System\sUXqvVE.exe
  2⤵
  PID:9152
- C:\Windows\System\fXogrmx.exe
  C:\Windows\System\fXogrmx.exe
  2⤵
  PID:7276
- C:\Windows\System\gMBJtmv.exe
  C:\Windows\System\gMBJtmv.exe
  2⤵
  PID:9168
- C:\Windows\System\mcrUjMl.exe
  C:\Windows\System\mcrUjMl.exe
  2⤵
  PID:9116
- C:\Windows\System\zkvxqRZ.exe
  C:\Windows\System\zkvxqRZ.exe
  2⤵
  PID:8212
- C:\Windows\System\EYGJWJB.exe
  C:\Windows\System\EYGJWJB.exe
  2⤵
  PID:8476
- C:\Windows\System\KITmoHQ.exe
  C:\Windows\System\KITmoHQ.exe
  2⤵
  PID:8564
- C:\Windows\System\HjFawYn.exe
  C:\Windows\System\HjFawYn.exe
  2⤵
  PID:8572
- C:\Windows\System\PGQCgGF.exe
  C:\Windows\System\PGQCgGF.exe
  2⤵
  PID:8872
- C:\Windows\System\smgiwFK.exe
  C:\Windows\System\smgiwFK.exe
  2⤵
  PID:8940
- C:\Windows\System\oqNfraP.exe
  C:\Windows\System\oqNfraP.exe
  2⤵
  PID:8696
- C:\Windows\System\FEIfsNf.exe
  C:\Windows\System\FEIfsNf.exe
  2⤵
  PID:8196
- C:\Windows\System\WZweohh.exe
  C:\Windows\System\WZweohh.exe
  2⤵
  PID:9000
- C:\Windows\System\TFlItqy.exe
  C:\Windows\System\TFlItqy.exe
  2⤵
  PID:8256
- C:\Windows\System\Rnwmpwy.exe
  C:\Windows\System\Rnwmpwy.exe
  2⤵
  PID:8580
- C:\Windows\System\SbHjlrd.exe
  C:\Windows\System\SbHjlrd.exe
  2⤵
  PID:8380
- C:\Windows\System\tgeHZsq.exe
  C:\Windows\System\tgeHZsq.exe
  2⤵
  PID:8836
- C:\Windows\System\WqDzhpo.exe
  C:\Windows\System\WqDzhpo.exe
  2⤵
  PID:8460
- C:\Windows\System\dLAnVNv.exe
  C:\Windows\System\dLAnVNv.exe
  2⤵
  PID:8844
- C:\Windows\System\YpmVXVj.exe
  C:\Windows\System\YpmVXVj.exe
  2⤵
  PID:8820
- C:\Windows\System\WhNVpwC.exe
  C:\Windows\System\WhNVpwC.exe
  2⤵
  PID:9028
- C:\Windows\System\llFXsmH.exe
  C:\Windows\System\llFXsmH.exe
  2⤵
  PID:8236
- C:\Windows\System\OuiqpeN.exe
  C:\Windows\System\OuiqpeN.exe
  2⤵
  PID:7260
- C:\Windows\System\zGEyGWq.exe
  C:\Windows\System\zGEyGWq.exe
  2⤵
  PID:8464
- C:\Windows\System\AgfONlK.exe
  C:\Windows\System\AgfONlK.exe
  2⤵
  PID:9016
- C:\Windows\System\ACohDJH.exe
  C:\Windows\System\ACohDJH.exe
  2⤵
  PID:8600
- C:\Windows\System\eeFBFnJ.exe
  C:\Windows\System\eeFBFnJ.exe
  2⤵
  PID:8780
- C:\Windows\System\dWmPzJi.exe
  C:\Windows\System\dWmPzJi.exe
  2⤵
  PID:8532
- C:\Windows\System\TrRlJRy.exe
  C:\Windows\System\TrRlJRy.exe
  2⤵
  PID:8304
- C:\Windows\System\gSIGXij.exe
  C:\Windows\System\gSIGXij.exe
  2⤵
  PID:9212
- C:\Windows\System\Tbewdqe.exe
  C:\Windows\System\Tbewdqe.exe
  2⤵
  PID:8988
- C:\Windows\System\KdJoDuF.exe
  C:\Windows\System\KdJoDuF.exe
  2⤵
  PID:2288
- C:\Windows\System\MAZYpKF.exe
  C:\Windows\System\MAZYpKF.exe
  2⤵
  PID:9232
- C:\Windows\System\oTGyrTJ.exe
  C:\Windows\System\oTGyrTJ.exe
  2⤵
  PID:9268
- C:\Windows\System\nZHiLHb.exe
  C:\Windows\System\nZHiLHb.exe
  2⤵
  PID:9288
- C:\Windows\System\fzkoIKw.exe
  C:\Windows\System\fzkoIKw.exe
  2⤵
  PID:9308
- C:\Windows\System\udQvsoF.exe
  C:\Windows\System\udQvsoF.exe
  2⤵
  PID:9328
- C:\Windows\System\MmlDaPR.exe
  C:\Windows\System\MmlDaPR.exe
  2⤵
  PID:9344
- C:\Windows\System\oXaVCnI.exe
  C:\Windows\System\oXaVCnI.exe
  2⤵
  PID:9364
- C:\Windows\System\rgcjsNR.exe
  C:\Windows\System\rgcjsNR.exe
  2⤵
  PID:9392
- C:\Windows\System\YRNJdHM.exe
  C:\Windows\System\YRNJdHM.exe
  2⤵
  PID:9408
- C:\Windows\System\UMkaMHW.exe
  C:\Windows\System\UMkaMHW.exe
  2⤵
  PID:9432
- C:\Windows\System\eXhdxFE.exe
  C:\Windows\System\eXhdxFE.exe
  2⤵
  PID:9448
- C:\Windows\System\FmgzKUs.exe
  C:\Windows\System\FmgzKUs.exe
  2⤵
  PID:9468
- C:\Windows\System\lXcciEV.exe
  C:\Windows\System\lXcciEV.exe
  2⤵
  PID:9484
- C:\Windows\System\aljyCbl.exe
  C:\Windows\System\aljyCbl.exe
  2⤵
  PID:9504
- C:\Windows\System\ixWcMye.exe
  C:\Windows\System\ixWcMye.exe
  2⤵
  PID:9520
- C:\Windows\System\BDtgHDG.exe
  C:\Windows\System\BDtgHDG.exe
  2⤵
  PID:9536
- C:\Windows\System\tsyFQAX.exe
  C:\Windows\System\tsyFQAX.exe
  2⤵
  PID:9572
- C:\Windows\System\kMFHWOr.exe
  C:\Windows\System\kMFHWOr.exe
  2⤵
  PID:9588
- C:\Windows\System\rRvGnnq.exe
  C:\Windows\System\rRvGnnq.exe
  2⤵
  PID:9608
- C:\Windows\System\bvjnfxY.exe
  C:\Windows\System\bvjnfxY.exe
  2⤵
  PID:9628
- C:\Windows\System\ZMNlDYE.exe
  C:\Windows\System\ZMNlDYE.exe
  2⤵
  PID:9648
- C:\Windows\System\NJGNZZC.exe
  C:\Windows\System\NJGNZZC.exe
  2⤵
  PID:9672
- C:\Windows\System\DRdPfdi.exe
  C:\Windows\System\DRdPfdi.exe
  2⤵
  PID:9696
- C:\Windows\System\cXXEiXl.exe
  C:\Windows\System\cXXEiXl.exe
  2⤵
  PID:9712
- C:\Windows\System\koxZOSp.exe
  C:\Windows\System\koxZOSp.exe
  2⤵
  PID:9732
- C:\Windows\System\oubPqsX.exe
  C:\Windows\System\oubPqsX.exe
  2⤵
  PID:9748
- C:\Windows\System\NiBNhQZ.exe
  C:\Windows\System\NiBNhQZ.exe
  2⤵
  PID:9764
- C:\Windows\System\IPPhBhB.exe
  C:\Windows\System\IPPhBhB.exe
  2⤵
  PID:9780
- C:\Windows\System\jiWlYMh.exe
  C:\Windows\System\jiWlYMh.exe
  2⤵
  PID:9796
- C:\Windows\System\HuNORua.exe
  C:\Windows\System\HuNORua.exe
  2⤵
  PID:9836
- C:\Windows\System\dIUGwKY.exe
  C:\Windows\System\dIUGwKY.exe
  2⤵
  PID:9852
- C:\Windows\System\ELygdHD.exe
  C:\Windows\System\ELygdHD.exe
  2⤵
  PID:9868
- C:\Windows\System\vjervUR.exe
  C:\Windows\System\vjervUR.exe
  2⤵
  PID:9884
- C:\Windows\System\cPlVaBw.exe
  C:\Windows\System\cPlVaBw.exe
  2⤵
  PID:9900
- C:\Windows\System\mToHZUH.exe
  C:\Windows\System\mToHZUH.exe
  2⤵
  PID:9916
- C:\Windows\System\raPIVoF.exe
  C:\Windows\System\raPIVoF.exe
  2⤵
  PID:9936
- C:\Windows\System\oUzdALP.exe
  C:\Windows\System\oUzdALP.exe
  2⤵
  PID:9956
- C:\Windows\System\tcHNAjc.exe
  C:\Windows\System\tcHNAjc.exe
  2⤵
  PID:9976
- C:\Windows\System\BnpwRiZ.exe
  C:\Windows\System\BnpwRiZ.exe
  2⤵
  PID:10020
- C:\Windows\System\rguNMUh.exe
  C:\Windows\System\rguNMUh.exe
  2⤵
  PID:10040
- C:\Windows\System\GEMYhDJ.exe
  C:\Windows\System\GEMYhDJ.exe
  2⤵
  PID:10056
- C:\Windows\System\pfLDHZF.exe
  C:\Windows\System\pfLDHZF.exe
  2⤵
  PID:10076
- C:\Windows\System\sKpUklG.exe
  C:\Windows\System\sKpUklG.exe
  2⤵
  PID:10092
- C:\Windows\System\mfcFnpS.exe
  C:\Windows\System\mfcFnpS.exe
  2⤵
  PID:10112
- C:\Windows\System\pqVJZDW.exe
  C:\Windows\System\pqVJZDW.exe
  2⤵
  PID:10128
- C:\Windows\System\yVTRhzN.exe
  C:\Windows\System\yVTRhzN.exe
  2⤵
  PID:10148
- C:\Windows\System\uhhXFBk.exe
  C:\Windows\System\uhhXFBk.exe
  2⤵
  PID:10168
- C:\Windows\System\BFkfTwl.exe
  C:\Windows\System\BFkfTwl.exe
  2⤵
  PID:10204
- C:\Windows\System\SgLgcCy.exe
  C:\Windows\System\SgLgcCy.exe
  2⤵
  PID:10220
- C:\Windows\System\jzjbYLC.exe
  C:\Windows\System\jzjbYLC.exe
  2⤵
  PID:10236
- C:\Windows\System\nzDCagz.exe
  C:\Windows\System\nzDCagz.exe
  2⤵
  PID:9224
- C:\Windows\System\ijfjTnU.exe
  C:\Windows\System\ijfjTnU.exe
  2⤵
  PID:9248
- C:\Windows\System\MnxAkrV.exe
  C:\Windows\System\MnxAkrV.exe
  2⤵
  PID:9284
- C:\Windows\System\npIdcnT.exe
  C:\Windows\System\npIdcnT.exe
  2⤵
  PID:9336
- C:\Windows\System\DXxmsOf.exe
  C:\Windows\System\DXxmsOf.exe
  2⤵
  PID:9320
- C:\Windows\System\FNTSMwd.exe
  C:\Windows\System\FNTSMwd.exe
  2⤵
  PID:9376
- C:\Windows\System\JuDFkIT.exe
  C:\Windows\System\JuDFkIT.exe
  2⤵
  PID:9416
- C:\Windows\System\atfajYm.exe
  C:\Windows\System\atfajYm.exe
  2⤵
  PID:9404
- C:\Windows\System\bWzJcdm.exe
  C:\Windows\System\bWzJcdm.exe
  2⤵
  PID:9496
- C:\Windows\System\XUXHzmE.exe
  C:\Windows\System\XUXHzmE.exe
  2⤵
  PID:9532
- C:\Windows\System\LcIqKdO.exe
  C:\Windows\System\LcIqKdO.exe
  2⤵
  PID:9556
- C:\Windows\System\RvASuyg.exe
  C:\Windows\System\RvASuyg.exe
  2⤵
  PID:9580
- C:\Windows\System\jctKgFG.exe
  C:\Windows\System\jctKgFG.exe
  2⤵
  PID:9620
- C:\Windows\System\lIaLLnB.exe
  C:\Windows\System\lIaLLnB.exe
  2⤵
  PID:9644
- C:\Windows\System\JzSSFCZ.exe
  C:\Windows\System\JzSSFCZ.exe
  2⤵
  PID:9680
- C:\Windows\System\PaviBKi.exe
  C:\Windows\System\PaviBKi.exe
  2⤵
  PID:9692
- C:\Windows\System\oyEIeJC.exe
  C:\Windows\System\oyEIeJC.exe
  2⤵
  PID:9740
- C:\Windows\System\FubHclQ.exe
  C:\Windows\System\FubHclQ.exe
  2⤵
  PID:9756
- C:\Windows\System\bSSknIG.exe
  C:\Windows\System\bSSknIG.exe
  2⤵
  PID:9812
- C:\Windows\System\moVtGsE.exe
  C:\Windows\System\moVtGsE.exe
  2⤵
  PID:9828
- C:\Windows\System\cQAfmlu.exe
  C:\Windows\System\cQAfmlu.exe
  2⤵
  PID:9860
- C:\Windows\System\FriFjJP.exe
  C:\Windows\System\FriFjJP.exe
  2⤵
  PID:9972
- C:\Windows\System\IwARcCU.exe
  C:\Windows\System\IwARcCU.exe
  2⤵
  PID:9952
- C:\Windows\System\FyFovxf.exe
  C:\Windows\System\FyFovxf.exe
  2⤵
  PID:9992
- C:\Windows\System\GYxRIfM.exe
  C:\Windows\System\GYxRIfM.exe
  2⤵
  PID:10008
- C:\Windows\System\JIWGJBR.exe
  C:\Windows\System\JIWGJBR.exe
  2⤵
  PID:10036
- C:\Windows\System\HGZShhT.exe
  C:\Windows\System\HGZShhT.exe
  2⤵
  PID:10072
- C:\Windows\System\XxvnmdK.exe
  C:\Windows\System\XxvnmdK.exe
  2⤵
  PID:10104
- C:\Windows\System\vjROgNP.exe
  C:\Windows\System\vjROgNP.exe
  2⤵
  PID:10156
- C:\Windows\System\jlNlmhR.exe
  C:\Windows\System\jlNlmhR.exe
  2⤵
  PID:10184
- C:\Windows\System\pwcJniB.exe
  C:\Windows\System\pwcJniB.exe
  2⤵
  PID:10200
- C:\Windows\System\brFCgYf.exe
  C:\Windows\System\brFCgYf.exe
  2⤵
  PID:9244
- C:\Windows\System\wqTJiXM.exe
  C:\Windows\System\wqTJiXM.exe
  2⤵
  PID:9228
- C:\Windows\System\WKzokCh.exe
  C:\Windows\System\WKzokCh.exe
  2⤵
  PID:9300
- C:\Windows\System\eeDWeAi.exe
  C:\Windows\System\eeDWeAi.exe
  2⤵
  PID:9324
- C:\Windows\System\QeXNLoX.exe
  C:\Windows\System\QeXNLoX.exe
  2⤵
  PID:9420
- C:\Windows\System\VsMOtJx.exe
  C:\Windows\System\VsMOtJx.exe
  2⤵
  PID:9460
- C:\Windows\System\cUODnsC.exe
  C:\Windows\System\cUODnsC.exe
  2⤵
  PID:9516
- C:\Windows\System\JDAiOvW.exe
  C:\Windows\System\JDAiOvW.exe
  2⤵
  PID:9596
- C:\Windows\System\SeANDJq.exe
  C:\Windows\System\SeANDJq.exe
  2⤵
  PID:9640
- C:\Windows\System\PTaHGxO.exe
  C:\Windows\System\PTaHGxO.exe
  2⤵
  PID:2132
- C:\Windows\System\dIlwNHG.exe
  C:\Windows\System\dIlwNHG.exe
  2⤵
  PID:9772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BSBthaO.exe

Filesize
1.0MB

MD5
b6af0f5d933c32267f9c1febaf19f9fd

SHA1
2e32cd5fb96a9e34efd99ab42e80a912febc6366

SHA256
2486a3e6d37c1b8b01ba98cdd1b0fe2b1dd007b4065a20eedcedff16cfa9d580

SHA512
04c364e55778f310cb47a41a19beb0062730e48870d74eb4c2e59052afad897cbcf0d536f224481347a24ca2d7a10ce579beb3127688d85da8585ad2ef54ef2d

Download Submit
C:\Windows\system\DjThJkm.exe

Filesize
1.0MB

MD5
2fd9b474a95d68e3b0f6178dae1a4148

SHA1
49dcacd8f0cc1e2e8873825284649b290ed4f569

SHA256
68ab991711cbd439071b04ab1752c8660dc44bcec22b7130b5c8954b0653f8c4

SHA512
61889f487f80c035420c93fb1e126f725aeee1bb471fe433e521d7370c6bec1c46378232794466c3ad7774600afa15015c4a5b8d35aa8e7785042987c703a3de

Download Submit
C:\Windows\system\EOmLHzJ.exe

Filesize
1.0MB

MD5
96aaf27ec55c3b203378cdc892a043c2

SHA1
ac46d5808b33745006bec91f0428607f370b855d

SHA256
b62316f1502a7ca38858c6cada472d03d44498f50a15f956bf7110e9e7116fa0

SHA512
106b4b818498b8c273810eee3357224fc61b67bb5d6e5e39ec54e47fc14194e2ef99756cb51618e5028486c21b35bdba3c5e92a4650478f397088a0e8c5365a5

Download Submit
C:\Windows\system\EiSTgGx.exe

Filesize
1.0MB

MD5
12f327c7f691c8a43015af2af641ff86

SHA1
a635e4f0b2dfc34a0b8392585042c17b388561af

SHA256
0244eae152defb52acd2ec3dabb4c6fcb14cc94f9a13b223e02d9ce10429f764

SHA512
34731bee8de2ea9cc4f6eba4749421d2a50d663084167f5fef9f490964632343649db0ec0f372fdc3904081b2447a182bd2cc7ec721ea4fd5fe40ba010c15267

Download Submit
C:\Windows\system\FCaizpx.exe

Filesize
1.0MB

MD5
038ecf0c7930d13b9e2188592c43576d

SHA1
787b466b9a3aa8adfbaf6068685eb7bd3eebe838

SHA256
162b898ce0c9172330f84a2e9e9ac4a1b3c6824756b74462171b5b667269bc0d

SHA512
fe66eeb7b1e531ce989c55bf600c7f0ff8a971b9a6d0f7dff96a2cbd5f8a61382b27e827ecc3f769058f8ec859adb6b5cf30e98e9b0f6ea5ee34edbc44b3ef7f

Download Submit
C:\Windows\system\FnZshdp.exe

Filesize
1.0MB

MD5
38c4fdb8c21a39f14cddca0fb6f4adb1

SHA1
ae31ce2c0f8ff97c8147ca32d775aeabcc5f13c8

SHA256
a86a658b52b952555a1023744e11bd424e748f81794de7f5c6fbbe0a02a629b3

SHA512
9cdae8b63ea6ac074b54aeffd29d0b9b7d74336cce3e884597ffd4deaa7ae8716dce6cfa0c6f45f88c1199c308844b984205ebe56ac9762679ab931f7bf4ac64

Download Submit
C:\Windows\system\LmqUtwl.exe

Filesize
1.0MB

MD5
9cb6606a71e333cef6ce68bdedd5c8bf

SHA1
872830b180a97bf267e593a8a47888d541680107

SHA256
2dbe8131d1d934aa1f298d9b3c10596f492608b245a05d4ff08c90ba36204b17

SHA512
856a8bb10624ee9bb3dabb8451f507471046023683e7ff3d042892a6fbb22ab409240e30eb4e96706ada14f91b4ca2183cd510536a7d54e6e7cc0ca46cd9a984

Download Submit
C:\Windows\system\NvUzVwP.exe

Filesize
1.0MB

MD5
9d1ea69d0a4aa2e55b736265a750a1c8

SHA1
7fad5c8c9d2b3ebcae7db8f42417f791d06e8561

SHA256
9b4d19522751166f08ec8168dbdee72de96508989f8d1e1eb4fa06633fa4b47c

SHA512
152c1a3b50e6451330011ee86a19dbd349f5b410d92152e6b8e6597a610b6224bdc20669fb7746b5e33882241f6854c8320236cdaee16bc0423dde49dc5fa061

Download Submit
C:\Windows\system\OVYULFi.exe

Filesize
1.0MB

MD5
da93c79b5c2e69ab6abf9b2fbd9412d9

SHA1
d233b25c09f18687d02c815605a837f839fb37aa

SHA256
e28a29a9478c38516b508aa659fe70fb040920968e49100caa61d0c60c362a03

SHA512
f5cf3922d7edb4c14c0b30d0967406a1aaeae95bcb8d7a9c6d4c93e3f2b1cb78d45aac3e6e205522323d0ce60fef80eb92f0e32c05fc6a316955bb9bcc9fafe0

Download Submit
C:\Windows\system\OVZaPYJ.exe

Filesize
1.0MB

MD5
98bd09a02669df45e525a5368ae293f3

SHA1
2a4c6417e9ca67da50d43a54eeaf1f3a68778b12

SHA256
8e60d1941a44f185755f55c439b0f2e9303fbc48d1eb522e8b7b875dfdb30162

SHA512
e4ec6b730c113d48e653e4d4b12b7583dc68a60f99bd7f2b30e50c97e92b3eb2f43b1f86334d4cf610574f628e996e0740c77fbcbe217153f4544c4b4bd066e1

Download Submit
C:\Windows\system\UWIhqNU.exe

Filesize
1.0MB

MD5
3527f7141eccce8fdf87f22b2101bce6

SHA1
a1901a50b6316aa1bbe267e9a1fbb7c29cd9625b

SHA256
772b0d268ea7d1c9c78b824bab89400603d3d5245d2138cec42ac00dc8763f35

SHA512
bed8f03a6c2b3733fc7f6ba5b81e48f9d1184f6d51dfa7ea59ff093caffbb7a1e0026030b626cb2104d38771dd35c70ca9a21ba1614e6c4e9c098123c457487e

Download Submit
C:\Windows\system\WKCRIZj.exe

Filesize
1.0MB

MD5
b826fa3520c01feaf963329e60b1b950

SHA1
90d852131b3b9c9e946fa227d2ad201a57209764

SHA256
3910a3e2fa540d7f7c1bb0de9bae75f6c108b94e1daa59eefeaae6f1e1e743e7

SHA512
7d8742b8c43913f36f6f1a2f9d8c62ec570c1d3cbeab92c3866decc641b1b28bd4f51103ed9bc5db1bfccda6bded3939a9a16e544221e197753caeb1cd844877

Download Submit
C:\Windows\system\XScekRv.exe

Filesize
1.0MB

MD5
3f403584241481a478a32bff1d41d13e

SHA1
08ce60f1d9c54bcf126cfb13796848d0db0cdce7

SHA256
7184e63a6010d8e045716a4a4d941d05adc9aae03415f0108d6917d8c1fb038d

SHA512
7c240f2ce5fb4299ef01cfc0c493038974f5282f2bfb917f5e9e6917834046ce574b5cdf926b529b9cda10f6eea55c217a9c8c44bb729bc7640cf67975005ff6

Download Submit
C:\Windows\system\aFZmlrB.exe

Filesize
1.0MB

MD5
e1ef345305100d373ef989e6002d9589

SHA1
20140fe2bf0d328685122637bd92ae99fc24a7e4

SHA256
519ed8564299660fb4e7ceca433e5eda1a9d2c5cf0133dbe19598a24f8dc2c03

SHA512
24d24308931ebfb72b5bd4e8de8c12ffb62ab1f67dc1ee4d7f0e369998c7ab55cba4079f764982016e32504dd2d5378388319790ef1242b826de4630d7c122d6

Download Submit
C:\Windows\system\ayzgCPa.exe

Filesize
1.0MB

MD5
13b189b88e4065cb35ea32bcae201e6f

SHA1
89edceb6efff2c6f3c56902a3099033cfdf68574

SHA256
0c767706eb9ed58f09ef3ff2a4589b5a3249c54889c268daa49e9dfe1626cd47

SHA512
d086ac8cde16313f5a545260376b8ece2f5141d6a23e602d842a09aa37d13a68a062bd4ccf8592a686fe48fa82ffe03d832f6e3dc26f17c9484a49c700ae3303

Download Submit
C:\Windows\system\bbtYmCT.exe

Filesize
1.0MB

MD5
ac989313bc1679890d6948fea6e20b14

SHA1
007f759228207170e8d32572fada489ccbcb3368

SHA256
0aca0ab9f786b522f068a47591474d914255f227657f97fdddd6200bfa260e56

SHA512
fb6874738a1f518a7c651af7b8f89cc3042175e761e19be832a1dc61a8f46cfd874f09ea1a61719f88ee03f247678bb276e3fa70ae0aae76ce400c5b8c709ca8

Download Submit
C:\Windows\system\eGKRBPF.exe

Filesize
1.0MB

MD5
f1d764877c0263c7fced8e7833fb92cb

SHA1
1cc61acd04fde55326a2c210d0c0aeec5080642e

SHA256
bf499ab15edf58a531b64e896dc8e8966bb8545b9d05e03727e931b2a8d9772b

SHA512
e03ed008aace09c88e8d00a7f1ff90f4a5bea277f8424f8ec4139dd96980c4a2620b3bf4f057e27d720c44094d3218ad209ba7af7cfd661bcbbaafc1c2349ed8

Download Submit
C:\Windows\system\efBFdVk.exe

Filesize
1.0MB

MD5
bcd4a67f02d121a4cf99346f4bfeba48

SHA1
87c740c0da0e6f3b8f5e673a55110b0cda7defb9

SHA256
d34b46859da6391985d8fd3ab77192401f278f2d0c4ad2ca02c55db340307159

SHA512
ef7cb65051bf813107445db6216bea7ba075676644e012a2b49231a48486995b317ea76c2eaec6258d7da6cfcbc9e39db45c14466cd518821c2845090176766a

Download Submit
C:\Windows\system\iCWsikQ.exe

Filesize
1.0MB

MD5
4d066f88459686595acbab07ab5c772e

SHA1
2cfde03e5db6a18a556dff04cbab284cfe67b0ca

SHA256
a35b9d72f3743f2021922762e0df65ea2a0dc36d247e72d8660e51ef2f406479

SHA512
0445285807a109f8a689dc9a3201db85e0ade3e385100b79867559aecd53c862d7bebee9e7711fcf608ef144cf2f70e1ba0be558613f12a2ed58f51f65e8a3e8

Download Submit
C:\Windows\system\jRzIBAp.exe

Filesize
1.0MB

MD5
9a910181479d40350ffddf4b079a59c1

SHA1
176509e596244ae33610a7a658a173137a713741

SHA256
2df5e303a3931b3eb87b635baa2943c89cdb632a776d44c8659fd9dd3cb7d31c

SHA512
a053bf0a440a863dc66c74c51ec497c8d2657a4606723dd6d686f2932b48dd385603a1f8273fede4d68e0d03725e167d8622bb8ed497bfbf045673398c94f251

Download Submit
C:\Windows\system\lHGVeUy.exe

Filesize
1.0MB

MD5
b4d4ae85595f56c10057c4c6ac9c5790

SHA1
ec56d7e48718b99ce2ea0a15a28050f6abf74e33

SHA256
80af6858676e8425944370e7fbd80607bcd08efef9763033cc52b736227422dc

SHA512
a5135eb9dcda420485a6ab5016d55f502a44e422655db084166186044141e80518cc3a1edc679dca78df89975c056b70f6f9679b19e8c5a4b74b58bc2306d0e8

Download Submit
C:\Windows\system\lOakBNh.exe

Filesize
1.0MB

MD5
bc86a86f6c832a99f9341ad25508792d

SHA1
fcd74ed4bd3bfd78a7789eb8957424b6ae858d97

SHA256
dd74e0e5c4f359d4c3e05b3519ffca5eadd169db4d0b0fea3952c26580dd5b31

SHA512
b329429ae9f48da0dde05587ecf944e4e1701faaf288ef524eb180cb4295aa7102d83d0000637652c2cf7cae5488f192aeb9efbcc9982b42e34a582a103502bf

Download Submit
C:\Windows\system\oHkGyXo.exe

Filesize
1.0MB

MD5
8ff1f90a1f3305fcebf4fe5c67227646

SHA1
8496f621a5a093caf1677865af8e38290ee9aa3f

SHA256
88adaa24c72f39ea15f6567ac7d4e7f922b5b3014e336e793a16ed4ebcb211cf

SHA512
8525ccd0da4b05972265073476e5c1ebed915dd33c29db1facab09f6a0115cd5381961fea7c264642b510c4f15c04ee43a5363390c25a1daab77ed55c65de209

Download Submit
C:\Windows\system\pqJaRUL.exe

Filesize
1.0MB

MD5
73b3a2c5b7ec3f6aff1bf3ad1a2aaa7c

SHA1
a43acd8006e1daadf79b448d66f45ad4d91c697d

SHA256
d073948bfcf7b7299ad90e2dcd2b7be72519a2ebee182d408291070170b3144c

SHA512
5c53249bfba6fa1700d7ea4acd2f4b15281d532c1090c3b14c3b0d1404f261fc21aa06b23d58d4b7d22377e1378f06b3e6c74fa5b95b91678b8a152ab61a0e76

Download Submit
C:\Windows\system\qJNddaR.exe

Filesize
1.0MB

MD5
25d53b947c3501cdcd5f979385755505

SHA1
82e4566fe2037ceaa86e5a58b1befbe13dac38f7

SHA256
80153d7492180c81b33afc78ccbc9246b76f27e9f2ce166aa95d11e8905e8799

SHA512
cf85202a2b77db4f453f375e9320f5c712861a6340f33e5d250ee8ac5c57a36d99d9ac5b1248b23ac619febd36d2f40151a77b6861d7bb62328721cdf1ce9967

Download Submit
C:\Windows\system\sAIwEnH.exe

Filesize
1.0MB

MD5
6d5da2c894935766e3558f186a34bb01

SHA1
07a1bbfa0dfae605782ebaaa9ccad6349b32f94b

SHA256
719c65734839e5858d01cce45a90352279b187b7acbe332c94189a686fe9aaba

SHA512
340b1d89d7d15b0dbaa604e3b007b1451d41d9766d76f5579538cc82d9a21e69e3710db74689baa0f374ab11bc7d70f4e59754385d7460cda1d2f569f0d93912

Download Submit
C:\Windows\system\stWhiDu.exe

Filesize
1.0MB

MD5
11b188ff7ab9eeaf0ec135210dde9013

SHA1
665cfd597ded2222efb016bb72c16f16407f605c

SHA256
282ceaf259cac133c62e7d2dd97c88cd4763e6000d79bcf4f9359ba482bca609

SHA512
5951c21f9e49fd4c69615e8f2af4ad2629eee80a1b12e6d47178fce254feb8d474eb4223fdb42bacd6ba68fb31835ad50b9191eef4bee16213667ae5237f2b6c

Download Submit
C:\Windows\system\stpiZPI.exe

Filesize
1.0MB

MD5
1b413d747d0ef02fca15387ea800c164

SHA1
83d7b39b44a1e23f6478acc8171c6f50f99cc479

SHA256
2f69b2d18438c0846077c609eb37585f78dfa5ba3d432b53282ae8a3217ca629

SHA512
ab4a9a104b78002df0a0a930f16624c16e50c97c931977e6dfefa8c6929bae9755a7aced1df2871e56d958f44c2b08a9b5a45d3fe330aa312f3776733ba5cb81

Download Submit
\Windows\system\ESmuZUf.exe

Filesize
1.0MB

MD5
98db710c4a0dcc5b46b39a01670c6e4b

SHA1
50b778ca0ee2b51d8c1fad27350518889e04a117

SHA256
94b415e013330e2276db1d65f9c7edf007cf6ad561bf34e1666783cb3608cb15

SHA512
3fa9728c9303f11ec679926c81aea416188a25c7e5f45b30acc52efe4b6e964e44653b056de98c472113e1af714314fa8c9a45f3d7ff2baa99106d3692e06d83

Download Submit
\Windows\system\dkdRLxx.exe

Filesize
1.0MB

MD5
f3f0f6ae173716ab66c8133a4d0ab49a

SHA1
cfd87307e3ca6a58537735dd94e41081d3bfdd9c

SHA256
3bad92d0c406285534ffecdf18ae0c936dd2c50cac24905d97168dd51608d9e3

SHA512
047d530a5db4170388beb677f2c4cbac2a113a22a9bdbfdb35cc6c5cb6e162a36172ed12705d5ef512cb0583e7212675103eee42cf764cb39674e3bbf5df0fc5

Download Submit
\Windows\system\eGxhJQn.exe

Filesize
1.0MB

MD5
75044fcdb4da0b03a073b6aa3cf60d01

SHA1
c4c86fc90a8e17b10d8e2f6ec0d19bfed75de889

SHA256
a505e19b6b7238805df6aa2be2f56042c6b285f7601c98c376f0410fb77c5b17

SHA512
1094071dc1f8556524338189d69d3380d603e33fb56aff94a8a8f9960a861b288d22f8b603549abd78fc532e30e3e1b9d99017390012bb0c318d0fad9eed6031

Download Submit
\Windows\system\hwROvGM.exe

Filesize
1.0MB

MD5
cdf5caeca17640a0681df5de64b82edd

SHA1
84f93e66868ee3dd129d0483a332637f242319c4

SHA256
6de3073802129a7a7688fd726e4f22f32f049320b75753c074d33dfa81cfa924

SHA512
feca09b8adb71bf6db46b4de052e1dac22771ce342f472b34d4bf0ab439158d895d40681348e69e9530482e7a9607ce2e2b5072a49b638c677ff497689cf91e4

Download Submit
memory/2380-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download