xmrig | 5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
Size

1.6MB
MD5

89b451bffd41bab9263747469259efb4
SHA1

9a0ecf7bf059f80c5e6b2237900f361e01fb176c
SHA256

5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225
SHA512

6a0ec752b6058cc86bad0237f4c57eaa4ad1ba0cc76dcd1bca9c54d06541046a1e6253635abcebad1e0bcadf4b6b4ade18dbde1ceabb6223c2cfa09a47930d54
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQFYae:GemTLkNdfE0pZyz

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0035000000017530-129.dat	xmrig
behavioral1/files/0x000500000001a41b-126.dat	xmrig
behavioral1/files/0x000500000001a359-121.dat	xmrig
behavioral1/files/0x000500000001a307-117.dat	xmrig
behavioral1/files/0x000500000001a09e-113.dat	xmrig
behavioral1/files/0x000500000001a07e-109.dat	xmrig
behavioral1/files/0x000500000001a075-106.dat	xmrig
behavioral1/files/0x0005000000019f8a-97.dat	xmrig
behavioral1/files/0x0005000000019d8e-89.dat	xmrig
behavioral1/files/0x0005000000019f94-101.dat	xmrig
behavioral1/files/0x0005000000019dbf-93.dat	xmrig
behavioral1/files/0x0005000000019cca-85.dat	xmrig
behavioral1/files/0x0005000000019cba-81.dat	xmrig
behavioral1/files/0x0005000000019c57-77.dat	xmrig
behavioral1/files/0x0005000000019c3e-73.dat	xmrig
behavioral1/files/0x0005000000019c3c-70.dat	xmrig
behavioral1/files/0x0005000000019c34-65.dat	xmrig
behavioral1/files/0x0005000000019926-61.dat	xmrig
behavioral1/files/0x00050000000196a1-57.dat	xmrig
behavioral1/files/0x0005000000019667-53.dat	xmrig
behavioral1/files/0x000500000001961e-49.dat	xmrig
behavioral1/files/0x000500000001961c-46.dat	xmrig
behavioral1/files/0x000500000001960c-41.dat	xmrig
behavioral1/files/0x000500000001960a-37.dat	xmrig
behavioral1/files/0x000600000001932d-34.dat	xmrig
behavioral1/files/0x0009000000018b62-30.dat	xmrig
behavioral1/files/0x0008000000018780-25.dat	xmrig
behavioral1/files/0x0006000000018766-22.dat	xmrig
behavioral1/files/0x0006000000018718-18.dat	xmrig
behavioral1/files/0x0006000000018710-14.dat	xmrig
behavioral1/files/0x00070000000186d9-9.dat	xmrig
behavioral1/files/0x00070000000120fe-5.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2844	uuUvVxT.exe
2876	heHpuzX.exe
2704	OTzlxBn.exe
2828	UdXaBED.exe
3008	WJcrQST.exe
2436	bgPNwjj.exe
2940	jMyPydL.exe
2748	OglpWGS.exe
2628	EfCSmia.exe
2584	LOeMssE.exe
2652	VAyuROx.exe
2096	tjJlJqM.exe
324	udcsorW.exe
2800	gdXTZNS.exe
1736	SlDLICS.exe
2232	AvxDxjj.exe
3036	GdXDKgn.exe
2208	DZEQUzW.exe
2120	UmIsfdp.exe
2204	dvVxVTr.exe
1428	MvWHolu.exe
1612	PJzNeYN.exe
1856	MCsOYGx.exe
2768	NvmBvQd.exe
2912	qvOunbQ.exe
2160	BHCoTwj.exe
592	tAFuDok.exe
284	EgpWSVo.exe
2300	XiUEcer.exe
2184	yWSAzSQ.exe
2396	kjIoSBX.exe
2360	hLPAyqe.exe
3004	VIjGMjw.exe
1996	iMnRJzN.exe
2516	ifDFGmt.exe
2236	wIPbIjn.exe
2264	HLSMVhO.exe
1280	pNFjFIg.exe
1900	KpcEWBN.exe
2152	SlmkQGs.exe
2460	drnCjED.exe
832	zYrhMRs.exe
924	afjgqsH.exe
2780	hcwhhYg.exe
1676	zzRUzbc.exe
864	UmHZscn.exe
1896	lmuZcMC.exe
1288	vBbNJBC.exe
1460	XsiFcIM.exe
1880	swRZgET.exe
1956	QYWyttD.exe
3060	wIemwUv.exe
2064	cYnSJPw.exe
2308	EkxCXvD.exe
3016	qvgNYVY.exe
1592	JJaBWiB.exe
1444	MZSqaPT.exe
2484	zfNvKaV.exe
1696	QRMibLP.exe
1952	tiiucdG.exe
1152	PJIBsLX.exe
2072	hmeLXlh.exe
1904	OprYOMb.exe
2312	nAQVevf.exe

Loads dropped DLL 64 IoCs

pid	Process
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xixbYZb.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\WtlviyL.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\mUTbBpD.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\EzNNeQQ.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\PoXvkUe.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\UwLjTrr.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\pJmkNFQ.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\mchYYnh.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\sTlgOup.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\FnYBvga.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\xAjRLNl.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\EckmsZo.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\mEerXtY.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\UmVrRSM.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\BkOvWgf.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\CIIbvlR.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\yWCkaAf.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\uuUvVxT.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\LOGSYYx.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\SeDyiws.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\zlXQzbg.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\dfzDJQq.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\gYsdMdc.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\ggAFLbt.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\zgRiJhU.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\zJxBguu.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\gOOxmaP.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\cTuZjvB.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\jPiTQcx.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\LaZXpUR.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\dHExSAg.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\RrEGaoz.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\iykLsdj.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\XOPiZBl.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\snWcFUR.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\StFonZO.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\iXYlkXb.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\nlOKDid.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\tuOZijh.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\VNpbJNe.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\bRVMGTH.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\Wyopqxm.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\YDngmaR.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\BTirznI.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\cUtrYaR.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\rNGdGNU.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\lXpEIXL.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\RsANWaK.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\vsMuEzv.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\yAemakJ.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\ILDmQcV.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\elyrBZZ.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\tgLXhlD.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\viNrTwa.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\MohEcvK.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\hVdDgIK.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\QWDyJVd.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\glWiDbe.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\heZGWjm.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\TLVNitP.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\GBtCXwS.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\MOJAAPE.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\ztiUYyj.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
File created	C:\Windows\System\UjAjvmY.exe	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2844	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	31
PID 2008 wrote to memory of 2844	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	31
PID 2008 wrote to memory of 2844	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	31
PID 2008 wrote to memory of 2876	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	32
PID 2008 wrote to memory of 2876	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	32
PID 2008 wrote to memory of 2876	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	32
PID 2008 wrote to memory of 2704	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	33
PID 2008 wrote to memory of 2704	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	33
PID 2008 wrote to memory of 2704	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	33
PID 2008 wrote to memory of 2828	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	34
PID 2008 wrote to memory of 2828	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	34
PID 2008 wrote to memory of 2828	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	34
PID 2008 wrote to memory of 3008	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	35
PID 2008 wrote to memory of 3008	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	35
PID 2008 wrote to memory of 3008	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	35
PID 2008 wrote to memory of 2436	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	36
PID 2008 wrote to memory of 2436	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	36
PID 2008 wrote to memory of 2436	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	36
PID 2008 wrote to memory of 2940	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	37
PID 2008 wrote to memory of 2940	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	37
PID 2008 wrote to memory of 2940	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	37
PID 2008 wrote to memory of 2748	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	38
PID 2008 wrote to memory of 2748	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	38
PID 2008 wrote to memory of 2748	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	38
PID 2008 wrote to memory of 2628	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	39
PID 2008 wrote to memory of 2628	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	39
PID 2008 wrote to memory of 2628	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	39
PID 2008 wrote to memory of 2584	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	40
PID 2008 wrote to memory of 2584	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	40
PID 2008 wrote to memory of 2584	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	40
PID 2008 wrote to memory of 2652	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	41
PID 2008 wrote to memory of 2652	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	41
PID 2008 wrote to memory of 2652	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	41
PID 2008 wrote to memory of 2096	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	42
PID 2008 wrote to memory of 2096	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	42
PID 2008 wrote to memory of 2096	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	42
PID 2008 wrote to memory of 324	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	43
PID 2008 wrote to memory of 324	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	43
PID 2008 wrote to memory of 324	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	43
PID 2008 wrote to memory of 2800	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	44
PID 2008 wrote to memory of 2800	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	44
PID 2008 wrote to memory of 2800	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	44
PID 2008 wrote to memory of 1736	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	45
PID 2008 wrote to memory of 1736	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	45
PID 2008 wrote to memory of 1736	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	45
PID 2008 wrote to memory of 2232	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	46
PID 2008 wrote to memory of 2232	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	46
PID 2008 wrote to memory of 2232	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	46
PID 2008 wrote to memory of 3036	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	47
PID 2008 wrote to memory of 3036	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	47
PID 2008 wrote to memory of 3036	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	47
PID 2008 wrote to memory of 2208	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	48
PID 2008 wrote to memory of 2208	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	48
PID 2008 wrote to memory of 2208	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	48
PID 2008 wrote to memory of 2120	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	49
PID 2008 wrote to memory of 2120	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	49
PID 2008 wrote to memory of 2120	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	49
PID 2008 wrote to memory of 2204	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	50
PID 2008 wrote to memory of 2204	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	50
PID 2008 wrote to memory of 2204	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	50
PID 2008 wrote to memory of 1428	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	51
PID 2008 wrote to memory of 1428	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	51
PID 2008 wrote to memory of 1428	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	51
PID 2008 wrote to memory of 1612	2008	5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe	52

C:\Users\Admin\AppData\Local\Temp\3680856908\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\3680856908\zmstage.exe
1⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe
"C:\Users\Admin\AppData\Local\Temp\5e6d19dc9c2b75ee8967db0a59f7e661c8fc36adae7c3410df9261caaa1dc225.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System\uuUvVxT.exe
  C:\Windows\System\uuUvVxT.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\heHpuzX.exe
  C:\Windows\System\heHpuzX.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\OTzlxBn.exe
  C:\Windows\System\OTzlxBn.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\UdXaBED.exe
  C:\Windows\System\UdXaBED.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\WJcrQST.exe
  C:\Windows\System\WJcrQST.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\bgPNwjj.exe
  C:\Windows\System\bgPNwjj.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\jMyPydL.exe
  C:\Windows\System\jMyPydL.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\OglpWGS.exe
  C:\Windows\System\OglpWGS.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\EfCSmia.exe
  C:\Windows\System\EfCSmia.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\LOeMssE.exe
  C:\Windows\System\LOeMssE.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\VAyuROx.exe
  C:\Windows\System\VAyuROx.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\tjJlJqM.exe
  C:\Windows\System\tjJlJqM.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\udcsorW.exe
  C:\Windows\System\udcsorW.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\gdXTZNS.exe
  C:\Windows\System\gdXTZNS.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\SlDLICS.exe
  C:\Windows\System\SlDLICS.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\AvxDxjj.exe
  C:\Windows\System\AvxDxjj.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\GdXDKgn.exe
  C:\Windows\System\GdXDKgn.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\DZEQUzW.exe
  C:\Windows\System\DZEQUzW.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\UmIsfdp.exe
  C:\Windows\System\UmIsfdp.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\dvVxVTr.exe
  C:\Windows\System\dvVxVTr.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\MvWHolu.exe
  C:\Windows\System\MvWHolu.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\PJzNeYN.exe
  C:\Windows\System\PJzNeYN.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\MCsOYGx.exe
  C:\Windows\System\MCsOYGx.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\NvmBvQd.exe
  C:\Windows\System\NvmBvQd.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\qvOunbQ.exe
  C:\Windows\System\qvOunbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\BHCoTwj.exe
  C:\Windows\System\BHCoTwj.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\tAFuDok.exe
  C:\Windows\System\tAFuDok.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\EgpWSVo.exe
  C:\Windows\System\EgpWSVo.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\XiUEcer.exe
  C:\Windows\System\XiUEcer.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\yWSAzSQ.exe
  C:\Windows\System\yWSAzSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\kjIoSBX.exe
  C:\Windows\System\kjIoSBX.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\hLPAyqe.exe
  C:\Windows\System\hLPAyqe.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\VIjGMjw.exe
  C:\Windows\System\VIjGMjw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\iMnRJzN.exe
  C:\Windows\System\iMnRJzN.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ifDFGmt.exe
  C:\Windows\System\ifDFGmt.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\wIPbIjn.exe
  C:\Windows\System\wIPbIjn.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\HLSMVhO.exe
  C:\Windows\System\HLSMVhO.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\pNFjFIg.exe
  C:\Windows\System\pNFjFIg.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\KpcEWBN.exe
  C:\Windows\System\KpcEWBN.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\SlmkQGs.exe
  C:\Windows\System\SlmkQGs.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\drnCjED.exe
  C:\Windows\System\drnCjED.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\zYrhMRs.exe
  C:\Windows\System\zYrhMRs.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\afjgqsH.exe
  C:\Windows\System\afjgqsH.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\hcwhhYg.exe
  C:\Windows\System\hcwhhYg.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\zzRUzbc.exe
  C:\Windows\System\zzRUzbc.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\UmHZscn.exe
  C:\Windows\System\UmHZscn.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\lmuZcMC.exe
  C:\Windows\System\lmuZcMC.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\vBbNJBC.exe
  C:\Windows\System\vBbNJBC.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\XsiFcIM.exe
  C:\Windows\System\XsiFcIM.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\swRZgET.exe
  C:\Windows\System\swRZgET.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\QYWyttD.exe
  C:\Windows\System\QYWyttD.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wIemwUv.exe
  C:\Windows\System\wIemwUv.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\cYnSJPw.exe
  C:\Windows\System\cYnSJPw.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\EkxCXvD.exe
  C:\Windows\System\EkxCXvD.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\qvgNYVY.exe
  C:\Windows\System\qvgNYVY.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\JJaBWiB.exe
  C:\Windows\System\JJaBWiB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\MZSqaPT.exe
  C:\Windows\System\MZSqaPT.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\zfNvKaV.exe
  C:\Windows\System\zfNvKaV.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\QRMibLP.exe
  C:\Windows\System\QRMibLP.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\tiiucdG.exe
  C:\Windows\System\tiiucdG.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\PJIBsLX.exe
  C:\Windows\System\PJIBsLX.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\hmeLXlh.exe
  C:\Windows\System\hmeLXlh.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\OprYOMb.exe
  C:\Windows\System\OprYOMb.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\nAQVevf.exe
  C:\Windows\System\nAQVevf.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\BZwfOJC.exe
  C:\Windows\System\BZwfOJC.exe
  2⤵
  PID:2196
- C:\Windows\System\HhRlqEt.exe
  C:\Windows\System\HhRlqEt.exe
  2⤵
  PID:1692
- C:\Windows\System\mecERwy.exe
  C:\Windows\System\mecERwy.exe
  2⤵
  PID:2996
- C:\Windows\System\CuZWPSH.exe
  C:\Windows\System\CuZWPSH.exe
  2⤵
  PID:1228
- C:\Windows\System\PMEeLLD.exe
  C:\Windows\System\PMEeLLD.exe
  2⤵
  PID:1012
- C:\Windows\System\VagkWeq.exe
  C:\Windows\System\VagkWeq.exe
  2⤵
  PID:1532
- C:\Windows\System\ORcjxfX.exe
  C:\Windows\System\ORcjxfX.exe
  2⤵
  PID:1636
- C:\Windows\System\RUBXbtL.exe
  C:\Windows\System\RUBXbtL.exe
  2⤵
  PID:2864
- C:\Windows\System\UzfqhDh.exe
  C:\Windows\System\UzfqhDh.exe
  2⤵
  PID:2884
- C:\Windows\System\jHpvgCR.exe
  C:\Windows\System\jHpvgCR.exe
  2⤵
  PID:2216
- C:\Windows\System\zRXxosj.exe
  C:\Windows\System\zRXxosj.exe
  2⤵
  PID:2960
- C:\Windows\System\XrXvkmz.exe
  C:\Windows\System\XrXvkmz.exe
  2⤵
  PID:2908
- C:\Windows\System\ctDnZrc.exe
  C:\Windows\System\ctDnZrc.exe
  2⤵
  PID:2568
- C:\Windows\System\HHAeNrd.exe
  C:\Windows\System\HHAeNrd.exe
  2⤵
  PID:1488
- C:\Windows\System\wcAejMR.exe
  C:\Windows\System\wcAejMR.exe
  2⤵
  PID:612
- C:\Windows\System\fkSMfwY.exe
  C:\Windows\System\fkSMfwY.exe
  2⤵
  PID:1808
- C:\Windows\System\fRdvIhn.exe
  C:\Windows\System\fRdvIhn.exe
  2⤵
  PID:2384
- C:\Windows\System\utTLokE.exe
  C:\Windows\System\utTLokE.exe
  2⤵
  PID:1768
- C:\Windows\System\jPxhAot.exe
  C:\Windows\System\jPxhAot.exe
  2⤵
  PID:2924
- C:\Windows\System\fCDkhPy.exe
  C:\Windows\System\fCDkhPy.exe
  2⤵
  PID:2164
- C:\Windows\System\tuOZijh.exe
  C:\Windows\System\tuOZijh.exe
  2⤵
  PID:2792
- C:\Windows\System\IgzoaQO.exe
  C:\Windows\System\IgzoaQO.exe
  2⤵
  PID:484
- C:\Windows\System\HQyrJWU.exe
  C:\Windows\System\HQyrJWU.exe
  2⤵
  PID:1244
- C:\Windows\System\pATHHZV.exe
  C:\Windows\System\pATHHZV.exe
  2⤵
  PID:1360
- C:\Windows\System\pRSbMTe.exe
  C:\Windows\System\pRSbMTe.exe
  2⤵
  PID:2388
- C:\Windows\System\QmzgDct.exe
  C:\Windows\System\QmzgDct.exe
  2⤵
  PID:2136
- C:\Windows\System\RrEGaoz.exe
  C:\Windows\System\RrEGaoz.exe
  2⤵
  PID:2272
- C:\Windows\System\hsvWjve.exe
  C:\Windows\System\hsvWjve.exe
  2⤵
  PID:1268
- C:\Windows\System\qjEmcCB.exe
  C:\Windows\System\qjEmcCB.exe
  2⤵
  PID:1972
- C:\Windows\System\gBLzhjK.exe
  C:\Windows\System\gBLzhjK.exe
  2⤵
  PID:876
- C:\Windows\System\NfQvmAH.exe
  C:\Windows\System\NfQvmAH.exe
  2⤵
  PID:2992
- C:\Windows\System\UUAkqnP.exe
  C:\Windows\System\UUAkqnP.exe
  2⤵
  PID:1852
- C:\Windows\System\CCSXAPo.exe
  C:\Windows\System\CCSXAPo.exe
  2⤵
  PID:2456
- C:\Windows\System\RrSXydw.exe
  C:\Windows\System\RrSXydw.exe
  2⤵
  PID:2348
- C:\Windows\System\GRVKHaJ.exe
  C:\Windows\System\GRVKHaJ.exe
  2⤵
  PID:1644
- C:\Windows\System\dHExSAg.exe
  C:\Windows\System\dHExSAg.exe
  2⤵
  PID:2324
- C:\Windows\System\qwJjvRp.exe
  C:\Windows\System\qwJjvRp.exe
  2⤵
  PID:2672
- C:\Windows\System\PaRLDrN.exe
  C:\Windows\System\PaRLDrN.exe
  2⤵
  PID:2340
- C:\Windows\System\aLsUvRY.exe
  C:\Windows\System\aLsUvRY.exe
  2⤵
  PID:1272
- C:\Windows\System\OYqwOnO.exe
  C:\Windows\System\OYqwOnO.exe
  2⤵
  PID:2580
- C:\Windows\System\FEZmUHZ.exe
  C:\Windows\System\FEZmUHZ.exe
  2⤵
  PID:988
- C:\Windows\System\JeggHdC.exe
  C:\Windows\System\JeggHdC.exe
  2⤵
  PID:272
- C:\Windows\System\SqvooNh.exe
  C:\Windows\System\SqvooNh.exe
  2⤵
  PID:2696
- C:\Windows\System\RgAHeSC.exe
  C:\Windows\System\RgAHeSC.exe
  2⤵
  PID:2116
- C:\Windows\System\NHBddjk.exe
  C:\Windows\System\NHBddjk.exe
  2⤵
  PID:1500
- C:\Windows\System\MxBfKYh.exe
  C:\Windows\System\MxBfKYh.exe
  2⤵
  PID:2848
- C:\Windows\System\iYCdrOd.exe
  C:\Windows\System\iYCdrOd.exe
  2⤵
  PID:3012
- C:\Windows\System\QPXGJAT.exe
  C:\Windows\System\QPXGJAT.exe
  2⤵
  PID:2968
- C:\Windows\System\vrcGpRN.exe
  C:\Windows\System\vrcGpRN.exe
  2⤵
  PID:2640
- C:\Windows\System\vEILdHm.exe
  C:\Windows\System\vEILdHm.exe
  2⤵
  PID:2416
- C:\Windows\System\sRjRUZh.exe
  C:\Windows\System\sRjRUZh.exe
  2⤵
  PID:3020
- C:\Windows\System\uKomMAP.exe
  C:\Windows\System\uKomMAP.exe
  2⤵
  PID:2796
- C:\Windows\System\TYCpmUy.exe
  C:\Windows\System\TYCpmUy.exe
  2⤵
  PID:1780
- C:\Windows\System\gxcWWHg.exe
  C:\Windows\System\gxcWWHg.exe
  2⤵
  PID:1752
- C:\Windows\System\OqnizMZ.exe
  C:\Windows\System\OqnizMZ.exe
  2⤵
  PID:2004
- C:\Windows\System\xikBPAT.exe
  C:\Windows\System\xikBPAT.exe
  2⤵
  PID:2252
- C:\Windows\System\wboGFZI.exe
  C:\Windows\System\wboGFZI.exe
  2⤵
  PID:956
- C:\Windows\System\gjUzphz.exe
  C:\Windows\System\gjUzphz.exe
  2⤵
  PID:1480
- C:\Windows\System\iFSfhzW.exe
  C:\Windows\System\iFSfhzW.exe
  2⤵
  PID:1688
- C:\Windows\System\EruxzRD.exe
  C:\Windows\System\EruxzRD.exe
  2⤵
  PID:2540
- C:\Windows\System\qzJmlcT.exe
  C:\Windows\System\qzJmlcT.exe
  2⤵
  PID:1756
- C:\Windows\System\EjtJaUh.exe
  C:\Windows\System\EjtJaUh.exe
  2⤵
  PID:2148
- C:\Windows\System\ysWMarI.exe
  C:\Windows\System\ysWMarI.exe
  2⤵
  PID:2520
- C:\Windows\System\guoFxDf.exe
  C:\Windows\System\guoFxDf.exe
  2⤵
  PID:3084
- C:\Windows\System\CaGNXtb.exe
  C:\Windows\System\CaGNXtb.exe
  2⤵
  PID:3100
- C:\Windows\System\KkEpFOC.exe
  C:\Windows\System\KkEpFOC.exe
  2⤵
  PID:3116
- C:\Windows\System\OECMTRc.exe
  C:\Windows\System\OECMTRc.exe
  2⤵
  PID:3132
- C:\Windows\System\tgFegLk.exe
  C:\Windows\System\tgFegLk.exe
  2⤵
  PID:3148
- C:\Windows\System\wjJygLC.exe
  C:\Windows\System\wjJygLC.exe
  2⤵
  PID:3164
- C:\Windows\System\aKwdxIz.exe
  C:\Windows\System\aKwdxIz.exe
  2⤵
  PID:3180
- C:\Windows\System\zchjoqF.exe
  C:\Windows\System\zchjoqF.exe
  2⤵
  PID:3196
- C:\Windows\System\kPlmNzW.exe
  C:\Windows\System\kPlmNzW.exe
  2⤵
  PID:3212
- C:\Windows\System\txauMRu.exe
  C:\Windows\System\txauMRu.exe
  2⤵
  PID:3228
- C:\Windows\System\wfYiKeu.exe
  C:\Windows\System\wfYiKeu.exe
  2⤵
  PID:3244
- C:\Windows\System\xKlFZEw.exe
  C:\Windows\System\xKlFZEw.exe
  2⤵
  PID:3260
- C:\Windows\System\nzxhXBQ.exe
  C:\Windows\System\nzxhXBQ.exe
  2⤵
  PID:3276
- C:\Windows\System\idbKoQS.exe
  C:\Windows\System\idbKoQS.exe
  2⤵
  PID:3292
- C:\Windows\System\HjFfsGi.exe
  C:\Windows\System\HjFfsGi.exe
  2⤵
  PID:3308
- C:\Windows\System\YOwkemh.exe
  C:\Windows\System\YOwkemh.exe
  2⤵
  PID:3324
- C:\Windows\System\SAdZjaR.exe
  C:\Windows\System\SAdZjaR.exe
  2⤵
  PID:3340
- C:\Windows\System\qCixVGt.exe
  C:\Windows\System\qCixVGt.exe
  2⤵
  PID:3356
- C:\Windows\System\mlcMmUZ.exe
  C:\Windows\System\mlcMmUZ.exe
  2⤵
  PID:3372
- C:\Windows\System\eUzHgkx.exe
  C:\Windows\System\eUzHgkx.exe
  2⤵
  PID:3388
- C:\Windows\System\UvZZuiC.exe
  C:\Windows\System\UvZZuiC.exe
  2⤵
  PID:3404
- C:\Windows\System\DAHEdCf.exe
  C:\Windows\System\DAHEdCf.exe
  2⤵
  PID:3420
- C:\Windows\System\ngKVpHo.exe
  C:\Windows\System\ngKVpHo.exe
  2⤵
  PID:3436
- C:\Windows\System\oojbWiY.exe
  C:\Windows\System\oojbWiY.exe
  2⤵
  PID:3452
- C:\Windows\System\dolCqfV.exe
  C:\Windows\System\dolCqfV.exe
  2⤵
  PID:3468
- C:\Windows\System\bEivpeB.exe
  C:\Windows\System\bEivpeB.exe
  2⤵
  PID:3484
- C:\Windows\System\GQlEZiH.exe
  C:\Windows\System\GQlEZiH.exe
  2⤵
  PID:3500
- C:\Windows\System\pZNfgaZ.exe
  C:\Windows\System\pZNfgaZ.exe
  2⤵
  PID:3516
- C:\Windows\System\xqsQdQl.exe
  C:\Windows\System\xqsQdQl.exe
  2⤵
  PID:3532
- C:\Windows\System\FoZevNu.exe
  C:\Windows\System\FoZevNu.exe
  2⤵
  PID:3548
- C:\Windows\System\oTLprPQ.exe
  C:\Windows\System\oTLprPQ.exe
  2⤵
  PID:3564
- C:\Windows\System\MNPsieB.exe
  C:\Windows\System\MNPsieB.exe
  2⤵
  PID:3580
- C:\Windows\System\TQflFyK.exe
  C:\Windows\System\TQflFyK.exe
  2⤵
  PID:3596
- C:\Windows\System\WFcXVLh.exe
  C:\Windows\System\WFcXVLh.exe
  2⤵
  PID:3612
- C:\Windows\System\zVuiOgv.exe
  C:\Windows\System\zVuiOgv.exe
  2⤵
  PID:3628
- C:\Windows\System\HvwsWIJ.exe
  C:\Windows\System\HvwsWIJ.exe
  2⤵
  PID:3644
- C:\Windows\System\MAxFLdl.exe
  C:\Windows\System\MAxFLdl.exe
  2⤵
  PID:3660
- C:\Windows\System\JsQDDPU.exe
  C:\Windows\System\JsQDDPU.exe
  2⤵
  PID:3676
- C:\Windows\System\HJwGKVO.exe
  C:\Windows\System\HJwGKVO.exe
  2⤵
  PID:3692
- C:\Windows\System\ZeDvfdw.exe
  C:\Windows\System\ZeDvfdw.exe
  2⤵
  PID:3708
- C:\Windows\System\povVyND.exe
  C:\Windows\System\povVyND.exe
  2⤵
  PID:3724
- C:\Windows\System\gSXJNXc.exe
  C:\Windows\System\gSXJNXc.exe
  2⤵
  PID:3740
- C:\Windows\System\EEWIwMK.exe
  C:\Windows\System\EEWIwMK.exe
  2⤵
  PID:3756
- C:\Windows\System\SlDkcHC.exe
  C:\Windows\System\SlDkcHC.exe
  2⤵
  PID:3772
- C:\Windows\System\GtvkDLq.exe
  C:\Windows\System\GtvkDLq.exe
  2⤵
  PID:3788
- C:\Windows\System\rXFGVJv.exe
  C:\Windows\System\rXFGVJv.exe
  2⤵
  PID:3804
- C:\Windows\System\SGnjsQw.exe
  C:\Windows\System\SGnjsQw.exe
  2⤵
  PID:3820
- C:\Windows\System\KlqYiDW.exe
  C:\Windows\System\KlqYiDW.exe
  2⤵
  PID:3836
- C:\Windows\System\FBJAEhb.exe
  C:\Windows\System\FBJAEhb.exe
  2⤵
  PID:3852
- C:\Windows\System\JeFtTGv.exe
  C:\Windows\System\JeFtTGv.exe
  2⤵
  PID:3868
- C:\Windows\System\uItKUPR.exe
  C:\Windows\System\uItKUPR.exe
  2⤵
  PID:3884
- C:\Windows\System\zJxBguu.exe
  C:\Windows\System\zJxBguu.exe
  2⤵
  PID:3900
- C:\Windows\System\dNtkVjc.exe
  C:\Windows\System\dNtkVjc.exe
  2⤵
  PID:3916
- C:\Windows\System\TRaYwGs.exe
  C:\Windows\System\TRaYwGs.exe
  2⤵
  PID:3932
- C:\Windows\System\OkLJehb.exe
  C:\Windows\System\OkLJehb.exe
  2⤵
  PID:3948
- C:\Windows\System\YatdWmU.exe
  C:\Windows\System\YatdWmU.exe
  2⤵
  PID:3964
- C:\Windows\System\teCrfnY.exe
  C:\Windows\System\teCrfnY.exe
  2⤵
  PID:3980
- C:\Windows\System\ObtBAWl.exe
  C:\Windows\System\ObtBAWl.exe
  2⤵
  PID:3996
- C:\Windows\System\UjAjvmY.exe
  C:\Windows\System\UjAjvmY.exe
  2⤵
  PID:4012
- C:\Windows\System\waNISsz.exe
  C:\Windows\System\waNISsz.exe
  2⤵
  PID:4028
- C:\Windows\System\laBWfEF.exe
  C:\Windows\System\laBWfEF.exe
  2⤵
  PID:4044
- C:\Windows\System\eAjPlUO.exe
  C:\Windows\System\eAjPlUO.exe
  2⤵
  PID:4060
- C:\Windows\System\VdOmuOa.exe
  C:\Windows\System\VdOmuOa.exe
  2⤵
  PID:4076
- C:\Windows\System\MJFDati.exe
  C:\Windows\System\MJFDati.exe
  2⤵
  PID:4092
- C:\Windows\System\hAaKSkf.exe
  C:\Windows\System\hAaKSkf.exe
  2⤵
  PID:1868
- C:\Windows\System\QkErwBI.exe
  C:\Windows\System\QkErwBI.exe
  2⤵
  PID:1540
- C:\Windows\System\czYGpqD.exe
  C:\Windows\System\czYGpqD.exe
  2⤵
  PID:2608
- C:\Windows\System\jmOwDnx.exe
  C:\Windows\System\jmOwDnx.exe
  2⤵
  PID:2620
- C:\Windows\System\zQxMiTS.exe
  C:\Windows\System\zQxMiTS.exe
  2⤵
  PID:2692
- C:\Windows\System\qpzjAfM.exe
  C:\Windows\System\qpzjAfM.exe
  2⤵
  PID:3028
- C:\Windows\System\tXTODqJ.exe
  C:\Windows\System\tXTODqJ.exe
  2⤵
  PID:2212
- C:\Windows\System\rYVNCYP.exe
  C:\Windows\System\rYVNCYP.exe
  2⤵
  PID:3044
- C:\Windows\System\UCzmyyJ.exe
  C:\Windows\System\UCzmyyJ.exe
  2⤵
  PID:2872
- C:\Windows\System\ZsFnbtQ.exe
  C:\Windows\System\ZsFnbtQ.exe
  2⤵
  PID:560
- C:\Windows\System\heZGWjm.exe
  C:\Windows\System\heZGWjm.exe
  2⤵
  PID:2092
- C:\Windows\System\LaVJgFB.exe
  C:\Windows\System\LaVJgFB.exe
  2⤵
  PID:656
- C:\Windows\System\telNnke.exe
  C:\Windows\System\telNnke.exe
  2⤵
  PID:3092
- C:\Windows\System\ERURViy.exe
  C:\Windows\System\ERURViy.exe
  2⤵
  PID:3124
- C:\Windows\System\ehgPQwL.exe
  C:\Windows\System\ehgPQwL.exe
  2⤵
  PID:3156
- C:\Windows\System\vdkltPG.exe
  C:\Windows\System\vdkltPG.exe
  2⤵
  PID:3188
- C:\Windows\System\VcxrBiV.exe
  C:\Windows\System\VcxrBiV.exe
  2⤵
  PID:3220
- C:\Windows\System\cNfKXnQ.exe
  C:\Windows\System\cNfKXnQ.exe
  2⤵
  PID:3224
- C:\Windows\System\BoVhuRJ.exe
  C:\Windows\System\BoVhuRJ.exe
  2⤵
  PID:3256
- C:\Windows\System\OhJdRKs.exe
  C:\Windows\System\OhJdRKs.exe
  2⤵
  PID:3284
- C:\Windows\System\GFNoGGU.exe
  C:\Windows\System\GFNoGGU.exe
  2⤵
  PID:3316
- C:\Windows\System\MKeUrbE.exe
  C:\Windows\System\MKeUrbE.exe
  2⤵
  PID:3348
- C:\Windows\System\kywxVuP.exe
  C:\Windows\System\kywxVuP.exe
  2⤵
  PID:3380
- C:\Windows\System\bhfiTeR.exe
  C:\Windows\System\bhfiTeR.exe
  2⤵
  PID:3412
- C:\Windows\System\GQsqGYH.exe
  C:\Windows\System\GQsqGYH.exe
  2⤵
  PID:3444
- C:\Windows\System\qEplfkd.exe
  C:\Windows\System\qEplfkd.exe
  2⤵
  PID:3476
- C:\Windows\System\phzZqRU.exe
  C:\Windows\System\phzZqRU.exe
  2⤵
  PID:3508
- C:\Windows\System\xcehDiq.exe
  C:\Windows\System\xcehDiq.exe
  2⤵
  PID:2200
- C:\Windows\System\HSkxORt.exe
  C:\Windows\System\HSkxORt.exe
  2⤵
  PID:2632
- C:\Windows\System\AJPiYZa.exe
  C:\Windows\System\AJPiYZa.exe
  2⤵
  PID:3576
- C:\Windows\System\biulgLs.exe
  C:\Windows\System\biulgLs.exe
  2⤵
  PID:3608
- C:\Windows\System\VwNRmMz.exe
  C:\Windows\System\VwNRmMz.exe
  2⤵
  PID:3640
- C:\Windows\System\mkIWtCl.exe
  C:\Windows\System\mkIWtCl.exe
  2⤵
  PID:3684
- C:\Windows\System\gOOxmaP.exe
  C:\Windows\System\gOOxmaP.exe
  2⤵
  PID:3700
- C:\Windows\System\JcCBzId.exe
  C:\Windows\System\JcCBzId.exe
  2⤵
  PID:3732
- C:\Windows\System\rAQrznQ.exe
  C:\Windows\System\rAQrznQ.exe
  2⤵
  PID:3764
- C:\Windows\System\FTcUBpk.exe
  C:\Windows\System\FTcUBpk.exe
  2⤵
  PID:1724
- C:\Windows\System\psdsZHC.exe
  C:\Windows\System\psdsZHC.exe
  2⤵
  PID:3944
- C:\Windows\System\wpHMUyA.exe
  C:\Windows\System\wpHMUyA.exe
  2⤵
  PID:3976
- C:\Windows\System\Bboscdm.exe
  C:\Windows\System\Bboscdm.exe
  2⤵
  PID:1740
- C:\Windows\System\NXuvwts.exe
  C:\Windows\System\NXuvwts.exe
  2⤵
  PID:4036
- C:\Windows\System\Zifmrpp.exe
  C:\Windows\System\Zifmrpp.exe
  2⤵
  PID:4052
- C:\Windows\System\aqpozAW.exe
  C:\Windows\System\aqpozAW.exe
  2⤵
  PID:4088
- C:\Windows\System\CvxJazO.exe
  C:\Windows\System\CvxJazO.exe
  2⤵
  PID:1524
- C:\Windows\System\BYVrZoq.exe
  C:\Windows\System\BYVrZoq.exe
  2⤵
  PID:2596
- C:\Windows\System\tDPoUgx.exe
  C:\Windows\System\tDPoUgx.exe
  2⤵
  PID:1452
- C:\Windows\System\lsbGqkz.exe
  C:\Windows\System\lsbGqkz.exe
  2⤵
  PID:2824
- C:\Windows\System\DTViqUX.exe
  C:\Windows\System\DTViqUX.exe
  2⤵
  PID:2248
- C:\Windows\System\iHbaVIv.exe
  C:\Windows\System\iHbaVIv.exe
  2⤵
  PID:868
- C:\Windows\System\eEFfROv.exe
  C:\Windows\System\eEFfROv.exe
  2⤵
  PID:2084
- C:\Windows\System\iDTltVT.exe
  C:\Windows\System\iDTltVT.exe
  2⤵
  PID:396
- C:\Windows\System\SawyTYL.exe
  C:\Windows\System\SawyTYL.exe
  2⤵
  PID:3080
- C:\Windows\System\vjNRaqy.exe
  C:\Windows\System\vjNRaqy.exe
  2⤵
  PID:3112
- C:\Windows\System\msPoxqN.exe
  C:\Windows\System\msPoxqN.exe
  2⤵
  PID:3192
- C:\Windows\System\KhgadUW.exe
  C:\Windows\System\KhgadUW.exe
  2⤵
  PID:3252
- C:\Windows\System\sFfLhYT.exe
  C:\Windows\System\sFfLhYT.exe
  2⤵
  PID:3288
- C:\Windows\System\KKyhgMl.exe
  C:\Windows\System\KKyhgMl.exe
  2⤵
  PID:1704
- C:\Windows\System\OQNbgSE.exe
  C:\Windows\System\OQNbgSE.exe
  2⤵
  PID:3448
- C:\Windows\System\xCeVvQV.exe
  C:\Windows\System\xCeVvQV.exe
  2⤵
  PID:2356
- C:\Windows\System\iOZOsiU.exe
  C:\Windows\System\iOZOsiU.exe
  2⤵
  PID:2228
- C:\Windows\System\EqOKSvk.exe
  C:\Windows\System\EqOKSvk.exe
  2⤵
  PID:3052
- C:\Windows\System\FYVBfVs.exe
  C:\Windows\System\FYVBfVs.exe
  2⤵
  PID:3848
- C:\Windows\System\hJbWSAE.exe
  C:\Windows\System\hJbWSAE.exe
  2⤵
  PID:3880
- C:\Windows\System\ETCxSTl.exe
  C:\Windows\System\ETCxSTl.exe
  2⤵
  PID:3040
- C:\Windows\System\eWBTevJ.exe
  C:\Windows\System\eWBTevJ.exe
  2⤵
  PID:1984
- C:\Windows\System\ZclKRof.exe
  C:\Windows\System\ZclKRof.exe
  2⤵
  PID:3988
- C:\Windows\System\bJxYIDG.exe
  C:\Windows\System\bJxYIDG.exe
  2⤵
  PID:4004
- C:\Windows\System\rzyRtzZ.exe
  C:\Windows\System\rzyRtzZ.exe
  2⤵
  PID:2012
- C:\Windows\System\LNQYwDO.exe
  C:\Windows\System\LNQYwDO.exe
  2⤵
  PID:3960
- C:\Windows\System\LzOEpKa.exe
  C:\Windows\System\LzOEpKa.exe
  2⤵
  PID:2736
- C:\Windows\System\FmdpKXs.exe
  C:\Windows\System\FmdpKXs.exe
  2⤵
  PID:1576
- C:\Windows\System\klItRJT.exe
  C:\Windows\System\klItRJT.exe
  2⤵
  PID:1368
- C:\Windows\System\TNCCdej.exe
  C:\Windows\System\TNCCdej.exe
  2⤵
  PID:2816
- C:\Windows\System\DJTQHOj.exe
  C:\Windows\System\DJTQHOj.exe
  2⤵
  PID:584
- C:\Windows\System\FiKeESd.exe
  C:\Windows\System\FiKeESd.exe
  2⤵
  PID:3160
- C:\Windows\System\JeZLJUI.exe
  C:\Windows\System\JeZLJUI.exe
  2⤵
  PID:1020
- C:\Windows\System\eqVPKHZ.exe
  C:\Windows\System\eqVPKHZ.exe
  2⤵
  PID:3384
- C:\Windows\System\qhCKRfS.exe
  C:\Windows\System\qhCKRfS.exe
  2⤵
  PID:3496
- C:\Windows\System\TAalAql.exe
  C:\Windows\System\TAalAql.exe
  2⤵
  PID:2244
- C:\Windows\System\QeekYko.exe
  C:\Windows\System\QeekYko.exe
  2⤵
  PID:3572
- C:\Windows\System\oPqxlLQ.exe
  C:\Windows\System\oPqxlLQ.exe
  2⤵
  PID:3652
- C:\Windows\System\XdKZhLg.exe
  C:\Windows\System\XdKZhLg.exe
  2⤵
  PID:3688
- C:\Windows\System\knMnQIl.exe
  C:\Windows\System\knMnQIl.exe
  2⤵
  PID:3768
- C:\Windows\System\dNtkFJH.exe
  C:\Windows\System\dNtkFJH.exe
  2⤵
  PID:3816
- C:\Windows\System\jRtjDpi.exe
  C:\Windows\System\jRtjDpi.exe
  2⤵
  PID:3604
- C:\Windows\System\ucJkPmt.exe
  C:\Windows\System\ucJkPmt.exe
  2⤵
  PID:3908
- C:\Windows\System\kpFEoAA.exe
  C:\Windows\System\kpFEoAA.exe
  2⤵
  PID:4068
- C:\Windows\System\gBiroiP.exe
  C:\Windows\System\gBiroiP.exe
  2⤵
  PID:1212
- C:\Windows\System\qwcahWp.exe
  C:\Windows\System\qwcahWp.exe
  2⤵
  PID:3860
- C:\Windows\System\zriWcHq.exe
  C:\Windows\System\zriWcHq.exe
  2⤵
  PID:3272
- C:\Windows\System\MmfXpXw.exe
  C:\Windows\System\MmfXpXw.exe
  2⤵
  PID:1044
- C:\Windows\System\hpRvZsG.exe
  C:\Windows\System\hpRvZsG.exe
  2⤵
  PID:2576
- C:\Windows\System\PLsowun.exe
  C:\Windows\System\PLsowun.exe
  2⤵
  PID:292
- C:\Windows\System\glWiDbe.exe
  C:\Windows\System\glWiDbe.exe
  2⤵
  PID:3864
- C:\Windows\System\XaYdGHc.exe
  C:\Windows\System\XaYdGHc.exe
  2⤵
  PID:3400
- C:\Windows\System\oRSnqqm.exe
  C:\Windows\System\oRSnqqm.exe
  2⤵
  PID:3636
- C:\Windows\System\ZbRHEkb.exe
  C:\Windows\System\ZbRHEkb.exe
  2⤵
  PID:3096
- C:\Windows\System\YdSOUZz.exe
  C:\Windows\System\YdSOUZz.exe
  2⤵
  PID:2404
- C:\Windows\System\wRwRrWS.exe
  C:\Windows\System\wRwRrWS.exe
  2⤵
  PID:3924
- C:\Windows\System\LtxOWgO.exe
  C:\Windows\System\LtxOWgO.exe
  2⤵
  PID:2716
- C:\Windows\System\UjGyflc.exe
  C:\Windows\System\UjGyflc.exe
  2⤵
  PID:1664
- C:\Windows\System\tEGlagH.exe
  C:\Windows\System\tEGlagH.exe
  2⤵
  PID:3352
- C:\Windows\System\QvpArwE.exe
  C:\Windows\System\QvpArwE.exe
  2⤵
  PID:3940
- C:\Windows\System\sSRcNcc.exe
  C:\Windows\System\sSRcNcc.exe
  2⤵
  PID:3668
- C:\Windows\System\QNReciP.exe
  C:\Windows\System\QNReciP.exe
  2⤵
  PID:4108
- C:\Windows\System\AUrVMoL.exe
  C:\Windows\System\AUrVMoL.exe
  2⤵
  PID:4124
- C:\Windows\System\pzZBJZk.exe
  C:\Windows\System\pzZBJZk.exe
  2⤵
  PID:4140
- C:\Windows\System\apEOSJJ.exe
  C:\Windows\System\apEOSJJ.exe
  2⤵
  PID:4160
- C:\Windows\System\rNGdGNU.exe
  C:\Windows\System\rNGdGNU.exe
  2⤵
  PID:4176
- C:\Windows\System\EWhLIpu.exe
  C:\Windows\System\EWhLIpu.exe
  2⤵
  PID:4212
- C:\Windows\System\fYPMsUs.exe
  C:\Windows\System\fYPMsUs.exe
  2⤵
  PID:4228
- C:\Windows\System\DSLipli.exe
  C:\Windows\System\DSLipli.exe
  2⤵
  PID:4244
- C:\Windows\System\fkHFMki.exe
  C:\Windows\System\fkHFMki.exe
  2⤵
  PID:4260
- C:\Windows\System\AvgcsGP.exe
  C:\Windows\System\AvgcsGP.exe
  2⤵
  PID:4276
- C:\Windows\System\tybNMZD.exe
  C:\Windows\System\tybNMZD.exe
  2⤵
  PID:4292
- C:\Windows\System\iykLsdj.exe
  C:\Windows\System\iykLsdj.exe
  2⤵
  PID:4308
- C:\Windows\System\OxIxDBV.exe
  C:\Windows\System\OxIxDBV.exe
  2⤵
  PID:4324
- C:\Windows\System\mchYYnh.exe
  C:\Windows\System\mchYYnh.exe
  2⤵
  PID:4340
- C:\Windows\System\xHZCZqj.exe
  C:\Windows\System\xHZCZqj.exe
  2⤵
  PID:4356
- C:\Windows\System\yZQLUpI.exe
  C:\Windows\System\yZQLUpI.exe
  2⤵
  PID:4372
- C:\Windows\System\XyzDADc.exe
  C:\Windows\System\XyzDADc.exe
  2⤵
  PID:4388
- C:\Windows\System\tPMTbaw.exe
  C:\Windows\System\tPMTbaw.exe
  2⤵
  PID:4404
- C:\Windows\System\CJUbxck.exe
  C:\Windows\System\CJUbxck.exe
  2⤵
  PID:4420
- C:\Windows\System\BOOlJqU.exe
  C:\Windows\System\BOOlJqU.exe
  2⤵
  PID:4436
- C:\Windows\System\lZnBmWH.exe
  C:\Windows\System\lZnBmWH.exe
  2⤵
  PID:4452
- C:\Windows\System\gklgzXp.exe
  C:\Windows\System\gklgzXp.exe
  2⤵
  PID:4468
- C:\Windows\System\SGWlaJM.exe
  C:\Windows\System\SGWlaJM.exe
  2⤵
  PID:4484
- C:\Windows\System\ijzNqRB.exe
  C:\Windows\System\ijzNqRB.exe
  2⤵
  PID:4500
- C:\Windows\System\sLYlbcu.exe
  C:\Windows\System\sLYlbcu.exe
  2⤵
  PID:4516
- C:\Windows\System\MlFpSnv.exe
  C:\Windows\System\MlFpSnv.exe
  2⤵
  PID:4532
- C:\Windows\System\ZCDeJiV.exe
  C:\Windows\System\ZCDeJiV.exe
  2⤵
  PID:4548
- C:\Windows\System\gEsKldN.exe
  C:\Windows\System\gEsKldN.exe
  2⤵
  PID:4564
- C:\Windows\System\BhaLunC.exe
  C:\Windows\System\BhaLunC.exe
  2⤵
  PID:4580
- C:\Windows\System\ZQuZQJX.exe
  C:\Windows\System\ZQuZQJX.exe
  2⤵
  PID:4596
- C:\Windows\System\ELeCNYw.exe
  C:\Windows\System\ELeCNYw.exe
  2⤵
  PID:4612
- C:\Windows\System\UZzUAfw.exe
  C:\Windows\System\UZzUAfw.exe
  2⤵
  PID:4628
- C:\Windows\System\LMvTSAw.exe
  C:\Windows\System\LMvTSAw.exe
  2⤵
  PID:4656
- C:\Windows\System\DLZbuef.exe
  C:\Windows\System\DLZbuef.exe
  2⤵
  PID:4672
- C:\Windows\System\iMxbFGr.exe
  C:\Windows\System\iMxbFGr.exe
  2⤵
  PID:4688
- C:\Windows\System\bCbkNNz.exe
  C:\Windows\System\bCbkNNz.exe
  2⤵
  PID:4704
- C:\Windows\System\hPgxaWW.exe
  C:\Windows\System\hPgxaWW.exe
  2⤵
  PID:4720
- C:\Windows\System\dopjGER.exe
  C:\Windows\System\dopjGER.exe
  2⤵
  PID:4736
- C:\Windows\System\KUPnsnF.exe
  C:\Windows\System\KUPnsnF.exe
  2⤵
  PID:4752
- C:\Windows\System\SscSsUD.exe
  C:\Windows\System\SscSsUD.exe
  2⤵
  PID:4768
- C:\Windows\System\QWwgXSv.exe
  C:\Windows\System\QWwgXSv.exe
  2⤵
  PID:4788
- C:\Windows\System\RzhnofR.exe
  C:\Windows\System\RzhnofR.exe
  2⤵
  PID:4804
- C:\Windows\System\AGglNAT.exe
  C:\Windows\System\AGglNAT.exe
  2⤵
  PID:4820
- C:\Windows\System\dNCYXaM.exe
  C:\Windows\System\dNCYXaM.exe
  2⤵
  PID:4836
- C:\Windows\System\NzQTkDm.exe
  C:\Windows\System\NzQTkDm.exe
  2⤵
  PID:4852
- C:\Windows\System\rdqNhGw.exe
  C:\Windows\System\rdqNhGw.exe
  2⤵
  PID:4868
- C:\Windows\System\FXhtwGJ.exe
  C:\Windows\System\FXhtwGJ.exe
  2⤵
  PID:4884
- C:\Windows\System\LZULVRG.exe
  C:\Windows\System\LZULVRG.exe
  2⤵
  PID:4900
- C:\Windows\System\vXmPBZq.exe
  C:\Windows\System\vXmPBZq.exe
  2⤵
  PID:4920
- C:\Windows\System\XOPiZBl.exe
  C:\Windows\System\XOPiZBl.exe
  2⤵
  PID:4936
- C:\Windows\System\TLVNitP.exe
  C:\Windows\System\TLVNitP.exe
  2⤵
  PID:4952
- C:\Windows\System\JjVypXG.exe
  C:\Windows\System\JjVypXG.exe
  2⤵
  PID:4968
- C:\Windows\System\NmSeRyV.exe
  C:\Windows\System\NmSeRyV.exe
  2⤵
  PID:4984
- C:\Windows\System\fVzXEWc.exe
  C:\Windows\System\fVzXEWc.exe
  2⤵
  PID:5000
- C:\Windows\System\FcNeJei.exe
  C:\Windows\System\FcNeJei.exe
  2⤵
  PID:5016
- C:\Windows\System\tQqBWfP.exe
  C:\Windows\System\tQqBWfP.exe
  2⤵
  PID:5032
- C:\Windows\System\ZOLWQPs.exe
  C:\Windows\System\ZOLWQPs.exe
  2⤵
  PID:5048
- C:\Windows\System\KJqCJsP.exe
  C:\Windows\System\KJqCJsP.exe
  2⤵
  PID:5064
- C:\Windows\System\aDrKpeO.exe
  C:\Windows\System\aDrKpeO.exe
  2⤵
  PID:5080
- C:\Windows\System\UCHhHqz.exe
  C:\Windows\System\UCHhHqz.exe
  2⤵
  PID:5096
- C:\Windows\System\VZoHBdt.exe
  C:\Windows\System\VZoHBdt.exe
  2⤵
  PID:5112
- C:\Windows\System\YPRDUHs.exe
  C:\Windows\System\YPRDUHs.exe
  2⤵
  PID:3128
- C:\Windows\System\aeKzatd.exe
  C:\Windows\System\aeKzatd.exe
  2⤵
  PID:4116
- C:\Windows\System\BahmrDw.exe
  C:\Windows\System\BahmrDw.exe
  2⤵
  PID:3844
- C:\Windows\System\kAiFSxm.exe
  C:\Windows\System\kAiFSxm.exe
  2⤵
  PID:4168
- C:\Windows\System\NPVkdFJ.exe
  C:\Windows\System\NPVkdFJ.exe
  2⤵
  PID:3480
- C:\Windows\System\kfzygFO.exe
  C:\Windows\System\kfzygFO.exe
  2⤵
  PID:4156
- C:\Windows\System\vadYhsH.exe
  C:\Windows\System\vadYhsH.exe
  2⤵
  PID:4196
- C:\Windows\System\LYqCMFr.exe
  C:\Windows\System\LYqCMFr.exe
  2⤵
  PID:4240
- C:\Windows\System\GBtCXwS.exe
  C:\Windows\System\GBtCXwS.exe
  2⤵
  PID:4304
- C:\Windows\System\XpmNeHa.exe
  C:\Windows\System\XpmNeHa.exe
  2⤵
  PID:4368
- C:\Windows\System\dPUZkhi.exe
  C:\Windows\System\dPUZkhi.exe
  2⤵
  PID:4432
- C:\Windows\System\BVbQFOs.exe
  C:\Windows\System\BVbQFOs.exe
  2⤵
  PID:4496
- C:\Windows\System\xgWbaKZ.exe
  C:\Windows\System\xgWbaKZ.exe
  2⤵
  PID:4560
- C:\Windows\System\JoTiCuf.exe
  C:\Windows\System\JoTiCuf.exe
  2⤵
  PID:4624
- C:\Windows\System\lSeVfau.exe
  C:\Windows\System\lSeVfau.exe
  2⤵
  PID:4252
- C:\Windows\System\AuzrkgN.exe
  C:\Windows\System\AuzrkgN.exe
  2⤵
  PID:4316
- C:\Windows\System\eHUlJDU.exe
  C:\Windows\System\eHUlJDU.exe
  2⤵
  PID:4668
- C:\Windows\System\VXMlFUB.exe
  C:\Windows\System\VXMlFUB.exe
  2⤵
  PID:4384
- C:\Windows\System\CeTqjOu.exe
  C:\Windows\System\CeTqjOu.exe
  2⤵
  PID:4696
- C:\Windows\System\btlrBHu.exe
  C:\Windows\System\btlrBHu.exe
  2⤵
  PID:4760
- C:\Windows\System\loXKreh.exe
  C:\Windows\System\loXKreh.exe
  2⤵
  PID:4480
- C:\Windows\System\LEANBib.exe
  C:\Windows\System\LEANBib.exe
  2⤵
  PID:4544
- C:\Windows\System\fpxMAsP.exe
  C:\Windows\System\fpxMAsP.exe
  2⤵
  PID:4636
- C:\Windows\System\wcsaqQF.exe
  C:\Windows\System\wcsaqQF.exe
  2⤵
  PID:4832
- C:\Windows\System\UAaYZzZ.exe
  C:\Windows\System\UAaYZzZ.exe
  2⤵
  PID:4640
- C:\Windows\System\aJtOCmw.exe
  C:\Windows\System\aJtOCmw.exe
  2⤵
  PID:4932
- C:\Windows\System\mVvrvCm.exe
  C:\Windows\System\mVvrvCm.exe
  2⤵
  PID:4996
- C:\Windows\System\twNczGv.exe
  C:\Windows\System\twNczGv.exe
  2⤵
  PID:4684
- C:\Windows\System\dRkefdb.exe
  C:\Windows\System\dRkefdb.exe
  2⤵
  PID:4748
- C:\Windows\System\kYDFAHX.exe
  C:\Windows\System\kYDFAHX.exe
  2⤵
  PID:4812
- C:\Windows\System\kQHckoQ.exe
  C:\Windows\System\kQHckoQ.exe
  2⤵
  PID:4876
- C:\Windows\System\ORsJEej.exe
  C:\Windows\System\ORsJEej.exe
  2⤵
  PID:4916
- C:\Windows\System\XpgMmzW.exe
  C:\Windows\System\XpgMmzW.exe
  2⤵
  PID:4980
- C:\Windows\System\BJjCrZR.exe
  C:\Windows\System\BJjCrZR.exe
  2⤵
  PID:5040
- C:\Windows\System\eSgOkrK.exe
  C:\Windows\System\eSgOkrK.exe
  2⤵
  PID:5092
- C:\Windows\System\fCYEqoc.exe
  C:\Windows\System\fCYEqoc.exe
  2⤵
  PID:5104
- C:\Windows\System\JDFIGet.exe
  C:\Windows\System\JDFIGet.exe
  2⤵
  PID:2624
- C:\Windows\System\TnlFrct.exe
  C:\Windows\System\TnlFrct.exe
  2⤵
  PID:4188
- C:\Windows\System\OlObmrZ.exe
  C:\Windows\System\OlObmrZ.exe
  2⤵
  PID:4400
- C:\Windows\System\ZWGpekn.exe
  C:\Windows\System\ZWGpekn.exe
  2⤵
  PID:4556
- C:\Windows\System\PzlMWgr.exe
  C:\Windows\System\PzlMWgr.exe
  2⤵
  PID:4664
- C:\Windows\System\fjkisIt.exe
  C:\Windows\System\fjkisIt.exe
  2⤵
  PID:4476
- C:\Windows\System\vMhWzsX.exe
  C:\Windows\System\vMhWzsX.exe
  2⤵
  PID:4652
- C:\Windows\System\zlXQzbg.exe
  C:\Windows\System\zlXQzbg.exe
  2⤵
  PID:4744
- C:\Windows\System\kCHgmuL.exe
  C:\Windows\System\kCHgmuL.exe
  2⤵
  PID:4948
- C:\Windows\System\IEUsjaR.exe
  C:\Windows\System\IEUsjaR.exe
  2⤵
  PID:4132
- C:\Windows\System\scYgvpg.exe
  C:\Windows\System\scYgvpg.exe
  2⤵
  PID:4644
- C:\Windows\System\OiuXFmP.exe
  C:\Windows\System\OiuXFmP.exe
  2⤵
  PID:4848
- C:\Windows\System\VyfiVwD.exe
  C:\Windows\System\VyfiVwD.exe
  2⤵
  PID:5132
- C:\Windows\System\dRwdocw.exe
  C:\Windows\System\dRwdocw.exe
  2⤵
  PID:5148
- C:\Windows\System\YAaNGwK.exe
  C:\Windows\System\YAaNGwK.exe
  2⤵
  PID:5164
- C:\Windows\System\gytlcim.exe
  C:\Windows\System\gytlcim.exe
  2⤵
  PID:5180
- C:\Windows\System\hcPgDbc.exe
  C:\Windows\System\hcPgDbc.exe
  2⤵
  PID:5196
- C:\Windows\System\eXXEhKV.exe
  C:\Windows\System\eXXEhKV.exe
  2⤵
  PID:5212
- C:\Windows\System\KAqqDvc.exe
  C:\Windows\System\KAqqDvc.exe
  2⤵
  PID:5228
- C:\Windows\System\ynIGXGN.exe
  C:\Windows\System\ynIGXGN.exe
  2⤵
  PID:5244
- C:\Windows\System\vJkhTvG.exe
  C:\Windows\System\vJkhTvG.exe
  2⤵
  PID:5260
- C:\Windows\System\uceXXNl.exe
  C:\Windows\System\uceXXNl.exe
  2⤵
  PID:5276
- C:\Windows\System\ZUWVDIx.exe
  C:\Windows\System\ZUWVDIx.exe
  2⤵
  PID:5292
- C:\Windows\System\VlDgTIM.exe
  C:\Windows\System\VlDgTIM.exe
  2⤵
  PID:5308
- C:\Windows\System\KDIISrk.exe
  C:\Windows\System\KDIISrk.exe
  2⤵
  PID:5324
- C:\Windows\System\dsnLRTO.exe
  C:\Windows\System\dsnLRTO.exe
  2⤵
  PID:5340
- C:\Windows\System\VXCWDuD.exe
  C:\Windows\System\VXCWDuD.exe
  2⤵
  PID:5356
- C:\Windows\System\EltiHwj.exe
  C:\Windows\System\EltiHwj.exe
  2⤵
  PID:5372
- C:\Windows\System\kOFaBTD.exe
  C:\Windows\System\kOFaBTD.exe
  2⤵
  PID:5388
- C:\Windows\System\eEqgJBq.exe
  C:\Windows\System\eEqgJBq.exe
  2⤵
  PID:5404
- C:\Windows\System\QQUnMSY.exe
  C:\Windows\System\QQUnMSY.exe
  2⤵
  PID:5420
- C:\Windows\System\weINWlM.exe
  C:\Windows\System\weINWlM.exe
  2⤵
  PID:5436
- C:\Windows\System\EMnBjrV.exe
  C:\Windows\System\EMnBjrV.exe
  2⤵
  PID:5452
- C:\Windows\System\PQhsyVL.exe
  C:\Windows\System\PQhsyVL.exe
  2⤵
  PID:5468
- C:\Windows\System\bXqTxGw.exe
  C:\Windows\System\bXqTxGw.exe
  2⤵
  PID:5484
- C:\Windows\System\QUqBiZW.exe
  C:\Windows\System\QUqBiZW.exe
  2⤵
  PID:5500
- C:\Windows\System\BMemXkW.exe
  C:\Windows\System\BMemXkW.exe
  2⤵
  PID:5516
- C:\Windows\System\dIlQAOe.exe
  C:\Windows\System\dIlQAOe.exe
  2⤵
  PID:5532
- C:\Windows\System\xixbYZb.exe
  C:\Windows\System\xixbYZb.exe
  2⤵
  PID:5548
- C:\Windows\System\TqBEFqo.exe
  C:\Windows\System\TqBEFqo.exe
  2⤵
  PID:5568
- C:\Windows\System\HeAVAdk.exe
  C:\Windows\System\HeAVAdk.exe
  2⤵
  PID:5592
- C:\Windows\System\JKkDNxa.exe
  C:\Windows\System\JKkDNxa.exe
  2⤵
  PID:5608
- C:\Windows\System\dtdYgKc.exe
  C:\Windows\System\dtdYgKc.exe
  2⤵
  PID:5624
- C:\Windows\System\YEgwNGa.exe
  C:\Windows\System\YEgwNGa.exe
  2⤵
  PID:5640
- C:\Windows\System\CWQnhDa.exe
  C:\Windows\System\CWQnhDa.exe
  2⤵
  PID:5656
- C:\Windows\System\whTaFWE.exe
  C:\Windows\System\whTaFWE.exe
  2⤵
  PID:5672
- C:\Windows\System\NBqASqd.exe
  C:\Windows\System\NBqASqd.exe
  2⤵
  PID:5688
- C:\Windows\System\kHAPtto.exe
  C:\Windows\System\kHAPtto.exe
  2⤵
  PID:5704
- C:\Windows\System\gmtUqOv.exe
  C:\Windows\System\gmtUqOv.exe
  2⤵
  PID:5720
- C:\Windows\System\AqhsDFt.exe
  C:\Windows\System\AqhsDFt.exe
  2⤵
  PID:5740
- C:\Windows\System\KMQQxsp.exe
  C:\Windows\System\KMQQxsp.exe
  2⤵
  PID:5756
- C:\Windows\System\FSzKCqb.exe
  C:\Windows\System\FSzKCqb.exe
  2⤵
  PID:5772
- C:\Windows\System\gAgsdho.exe
  C:\Windows\System\gAgsdho.exe
  2⤵
  PID:5788
- C:\Windows\System\fpvGSjN.exe
  C:\Windows\System\fpvGSjN.exe
  2⤵
  PID:5804
- C:\Windows\System\xQyhzuQ.exe
  C:\Windows\System\xQyhzuQ.exe
  2⤵
  PID:5820
- C:\Windows\System\PkUrdyn.exe
  C:\Windows\System\PkUrdyn.exe
  2⤵
  PID:5836
- C:\Windows\System\lpWmRMO.exe
  C:\Windows\System\lpWmRMO.exe
  2⤵
  PID:5852
- C:\Windows\System\zlcYNxz.exe
  C:\Windows\System\zlcYNxz.exe
  2⤵
  PID:5868
- C:\Windows\System\dxfrQJh.exe
  C:\Windows\System\dxfrQJh.exe
  2⤵
  PID:5884
- C:\Windows\System\MYIKahK.exe
  C:\Windows\System\MYIKahK.exe
  2⤵
  PID:5900
- C:\Windows\System\NWyKCWx.exe
  C:\Windows\System\NWyKCWx.exe
  2⤵
  PID:5916
- C:\Windows\System\lhidbdE.exe
  C:\Windows\System\lhidbdE.exe
  2⤵
  PID:5932
- C:\Windows\System\iQxmDEV.exe
  C:\Windows\System\iQxmDEV.exe
  2⤵
  PID:5948
- C:\Windows\System\TLfanxU.exe
  C:\Windows\System\TLfanxU.exe
  2⤵
  PID:5964
- C:\Windows\System\thwlKxf.exe
  C:\Windows\System\thwlKxf.exe
  2⤵
  PID:5980
- C:\Windows\System\QZmXAkB.exe
  C:\Windows\System\QZmXAkB.exe
  2⤵
  PID:5996
- C:\Windows\System\AMtCSzS.exe
  C:\Windows\System\AMtCSzS.exe
  2⤵
  PID:6012
- C:\Windows\System\ovvXaZd.exe
  C:\Windows\System\ovvXaZd.exe
  2⤵
  PID:6028
- C:\Windows\System\ORHvUpM.exe
  C:\Windows\System\ORHvUpM.exe
  2⤵
  PID:6044
- C:\Windows\System\ursBdVn.exe
  C:\Windows\System\ursBdVn.exe
  2⤵
  PID:6060
- C:\Windows\System\WFMhzUJ.exe
  C:\Windows\System\WFMhzUJ.exe
  2⤵
  PID:6080
- C:\Windows\System\DMAdmRB.exe
  C:\Windows\System\DMAdmRB.exe
  2⤵
  PID:6096
- C:\Windows\System\ubkXlxa.exe
  C:\Windows\System\ubkXlxa.exe
  2⤵
  PID:6112
- C:\Windows\System\YyGsguh.exe
  C:\Windows\System\YyGsguh.exe
  2⤵
  PID:6128
- C:\Windows\System\IHnpxVk.exe
  C:\Windows\System\IHnpxVk.exe
  2⤵
  PID:4300
- C:\Windows\System\pTftWol.exe
  C:\Windows\System\pTftWol.exe
  2⤵
  PID:4224
- C:\Windows\System\XLycPcg.exe
  C:\Windows\System\XLycPcg.exe
  2⤵
  PID:5192
- C:\Windows\System\nSyvwdH.exe
  C:\Windows\System\nSyvwdH.exe
  2⤵
  PID:5256
- C:\Windows\System\IIOiQew.exe
  C:\Windows\System\IIOiQew.exe
  2⤵
  PID:4352
- C:\Windows\System\txkjFdB.exe
  C:\Windows\System\txkjFdB.exe
  2⤵
  PID:5348
- C:\Windows\System\gTbtFUh.exe
  C:\Windows\System\gTbtFUh.exe
  2⤵
  PID:5412
- C:\Windows\System\BMqvWAm.exe
  C:\Windows\System\BMqvWAm.exe
  2⤵
  PID:5476
- C:\Windows\System\udMazZu.exe
  C:\Windows\System\udMazZu.exe
  2⤵
  PID:5540
- C:\Windows\System\oBJyxeS.exe
  C:\Windows\System\oBJyxeS.exe
  2⤵
  PID:5024
- C:\Windows\System\XYjbAhf.exe
  C:\Windows\System\XYjbAhf.exe
  2⤵
  PID:4732
- C:\Windows\System\xhBqdbV.exe
  C:\Windows\System\xhBqdbV.exe
  2⤵
  PID:4528
- C:\Windows\System\eyAPAhg.exe
  C:\Windows\System\eyAPAhg.exe
  2⤵
  PID:4716
- C:\Windows\System\wDoEkfX.exe
  C:\Windows\System\wDoEkfX.exe
  2⤵
  PID:4236
- C:\Windows\System\MTyJYBz.exe
  C:\Windows\System\MTyJYBz.exe
  2⤵
  PID:4464
- C:\Windows\System\IhwtDaU.exe
  C:\Windows\System\IhwtDaU.exe
  2⤵
  PID:4592
- C:\Windows\System\ZXvPIgK.exe
  C:\Windows\System\ZXvPIgK.exe
  2⤵
  PID:4896
- C:\Windows\System\WiJgVqq.exe
  C:\Windows\System\WiJgVqq.exe
  2⤵
  PID:5400
- C:\Windows\System\QVmBkZh.exe
  C:\Windows\System\QVmBkZh.exe
  2⤵
  PID:4448
- C:\Windows\System\sWdlQtd.exe
  C:\Windows\System\sWdlQtd.exe
  2⤵
  PID:2552
- C:\Windows\System\dfzDJQq.exe
  C:\Windows\System\dfzDJQq.exe
  2⤵
  PID:5140
- C:\Windows\System\czTZIgN.exe
  C:\Windows\System\czTZIgN.exe
  2⤵
  PID:5204
- C:\Windows\System\dmkghoO.exe
  C:\Windows\System\dmkghoO.exe
  2⤵
  PID:5268
- C:\Windows\System\ywlvpcj.exe
  C:\Windows\System\ywlvpcj.exe
  2⤵
  PID:5332
- C:\Windows\System\sgsewwt.exe
  C:\Windows\System\sgsewwt.exe
  2⤵
  PID:5460
- C:\Windows\System\sJUfYQM.exe
  C:\Windows\System\sJUfYQM.exe
  2⤵
  PID:5524
- C:\Windows\System\rOIbmyM.exe
  C:\Windows\System\rOIbmyM.exe
  2⤵
  PID:5564
- C:\Windows\System\CNqBCEG.exe
  C:\Windows\System\CNqBCEG.exe
  2⤵
  PID:5620
- C:\Windows\System\bConnUR.exe
  C:\Windows\System\bConnUR.exe
  2⤵
  PID:5684
- C:\Windows\System\UaslyLE.exe
  C:\Windows\System\UaslyLE.exe
  2⤵
  PID:5752
- C:\Windows\System\YyEyzUc.exe
  C:\Windows\System\YyEyzUc.exe
  2⤵
  PID:5812
- C:\Windows\System\xAjRLNl.exe
  C:\Windows\System\xAjRLNl.exe
  2⤵
  PID:5696
- C:\Windows\System\pAUjTjt.exe
  C:\Windows\System\pAUjTjt.exe
  2⤵
  PID:5604
- C:\Windows\System\ivBHmzV.exe
  C:\Windows\System\ivBHmzV.exe
  2⤵
  PID:5664
- C:\Windows\System\KwNqaCD.exe
  C:\Windows\System\KwNqaCD.exe
  2⤵
  PID:5768
- C:\Windows\System\BgFatTd.exe
  C:\Windows\System\BgFatTd.exe
  2⤵
  PID:5860
- C:\Windows\System\lOEsKjF.exe
  C:\Windows\System\lOEsKjF.exe
  2⤵
  PID:5908
- C:\Windows\System\tmRLjpx.exe
  C:\Windows\System\tmRLjpx.exe
  2⤵
  PID:5972
- C:\Windows\System\NepoeZq.exe
  C:\Windows\System\NepoeZq.exe
  2⤵
  PID:6036
- C:\Windows\System\NEPMjaZ.exe
  C:\Windows\System\NEPMjaZ.exe
  2⤵
  PID:6104
- C:\Windows\System\IDhMgRi.exe
  C:\Windows\System\IDhMgRi.exe
  2⤵
  PID:5188
- C:\Windows\System\FdNharW.exe
  C:\Windows\System\FdNharW.exe
  2⤵
  PID:5380
- C:\Windows\System\LnsoUQP.exe
  C:\Windows\System\LnsoUQP.exe
  2⤵
  PID:5072
- C:\Windows\System\DHAYvfA.exe
  C:\Windows\System\DHAYvfA.exe
  2⤵
  PID:4992
- C:\Windows\System\FkMRsvr.exe
  C:\Windows\System\FkMRsvr.exe
  2⤵
  PID:4364
- C:\Windows\System\BkfjdsG.exe
  C:\Windows\System\BkfjdsG.exe
  2⤵
  PID:4284
- C:\Windows\System\qIYkqZV.exe
  C:\Windows\System\qIYkqZV.exe
  2⤵
  PID:4680
- C:\Windows\System\iJKIkBr.exe
  C:\Windows\System\iJKIkBr.exe
  2⤵
  PID:6052
- C:\Windows\System\ioMmngq.exe
  C:\Windows\System\ioMmngq.exe
  2⤵
  PID:5444
- C:\Windows\System\JkPdMsm.exe
  C:\Windows\System\JkPdMsm.exe
  2⤵
  PID:5124
- C:\Windows\System\nqOSMrT.exe
  C:\Windows\System\nqOSMrT.exe
  2⤵
  PID:4136
- C:\Windows\System\qnlPaJr.exe
  C:\Windows\System\qnlPaJr.exe
  2⤵
  PID:5556
- C:\Windows\System\MMpFjYm.exe
  C:\Windows\System\MMpFjYm.exe
  2⤵
  PID:4208
- C:\Windows\System\fZCxjku.exe
  C:\Windows\System\fZCxjku.exe
  2⤵
  PID:5396
- C:\Windows\System\MEjrVoX.exe
  C:\Windows\System\MEjrVoX.exe
  2⤵
  PID:5240
- C:\Windows\System\RTwWnFV.exe
  C:\Windows\System\RTwWnFV.exe
  2⤵
  PID:5560
- C:\Windows\System\bzuhntK.exe
  C:\Windows\System\bzuhntK.exe
  2⤵
  PID:5600
- C:\Windows\System\RCfQmvp.exe
  C:\Windows\System\RCfQmvp.exe
  2⤵
  PID:5764
- C:\Windows\System\JbpuYAQ.exe
  C:\Windows\System\JbpuYAQ.exe
  2⤵
  PID:6008
- C:\Windows\System\bcLWBlu.exe
  C:\Windows\System\bcLWBlu.exe
  2⤵
  PID:5508
- C:\Windows\System\btDWWzo.exe
  C:\Windows\System\btDWWzo.exe
  2⤵
  PID:4288
- C:\Windows\System\TaNNORU.exe
  C:\Windows\System\TaNNORU.exe
  2⤵
  PID:5172
- C:\Windows\System\OmcFnsz.exe
  C:\Windows\System\OmcFnsz.exe
  2⤵
  PID:5304
- C:\Windows\System\wrVkbDN.exe
  C:\Windows\System\wrVkbDN.exe
  2⤵
  PID:5992
- C:\Windows\System\AioWtrC.exe
  C:\Windows\System\AioWtrC.exe
  2⤵
  PID:5748
- C:\Windows\System\CZHGItc.exe
  C:\Windows\System\CZHGItc.exe
  2⤵
  PID:5636
- C:\Windows\System\hnCzcpV.exe
  C:\Windows\System\hnCzcpV.exe
  2⤵
  PID:5944
- C:\Windows\System\SQwIcac.exe
  C:\Windows\System\SQwIcac.exe
  2⤵
  PID:5316
- C:\Windows\System\mVumVIW.exe
  C:\Windows\System\mVumVIW.exe
  2⤵
  PID:4864
- C:\Windows\System\WLViwxv.exe
  C:\Windows\System\WLViwxv.exe
  2⤵
  PID:5880
- C:\Windows\System\OgVxndf.exe
  C:\Windows\System\OgVxndf.exe
  2⤵
  PID:5924
- C:\Windows\System\knDnhkH.exe
  C:\Windows\System\knDnhkH.exe
  2⤵
  PID:5584
- C:\Windows\System\jJXfdRj.exe
  C:\Windows\System\jJXfdRj.exe
  2⤵
  PID:5832
- C:\Windows\System\ZBIDHZw.exe
  C:\Windows\System\ZBIDHZw.exe
  2⤵
  PID:4512
- C:\Windows\System\WrDjUGD.exe
  C:\Windows\System\WrDjUGD.exe
  2⤵
  PID:6156
- C:\Windows\System\eIAYIau.exe
  C:\Windows\System\eIAYIau.exe
  2⤵
  PID:6172
- C:\Windows\System\uWWkgVD.exe
  C:\Windows\System\uWWkgVD.exe
  2⤵
  PID:6188
- C:\Windows\System\YtVgnUC.exe
  C:\Windows\System\YtVgnUC.exe
  2⤵
  PID:6204
- C:\Windows\System\tgfhdGP.exe
  C:\Windows\System\tgfhdGP.exe
  2⤵
  PID:6220
- C:\Windows\System\bFrPLva.exe
  C:\Windows\System\bFrPLva.exe
  2⤵
  PID:6236
- C:\Windows\System\iiJUgrp.exe
  C:\Windows\System\iiJUgrp.exe
  2⤵
  PID:6252
- C:\Windows\System\BJYUcZO.exe
  C:\Windows\System\BJYUcZO.exe
  2⤵
  PID:6268
- C:\Windows\System\MbABFhL.exe
  C:\Windows\System\MbABFhL.exe
  2⤵
  PID:6284
- C:\Windows\System\JXjjnRF.exe
  C:\Windows\System\JXjjnRF.exe
  2⤵
  PID:6300
- C:\Windows\System\QcsZvSl.exe
  C:\Windows\System\QcsZvSl.exe
  2⤵
  PID:6316
- C:\Windows\System\wEzKRkd.exe
  C:\Windows\System\wEzKRkd.exe
  2⤵
  PID:6332
- C:\Windows\System\Nnomrdk.exe
  C:\Windows\System\Nnomrdk.exe
  2⤵
  PID:6348
- C:\Windows\System\WvJmjgS.exe
  C:\Windows\System\WvJmjgS.exe
  2⤵
  PID:6396
- C:\Windows\System\FooGgMA.exe
  C:\Windows\System\FooGgMA.exe
  2⤵
  PID:6420
- C:\Windows\System\yxmzSca.exe
  C:\Windows\System\yxmzSca.exe
  2⤵
  PID:6436
- C:\Windows\System\OYvYbKe.exe
  C:\Windows\System\OYvYbKe.exe
  2⤵
  PID:6452
- C:\Windows\System\owiWZCL.exe
  C:\Windows\System\owiWZCL.exe
  2⤵
  PID:6472
- C:\Windows\System\Xwjyrkw.exe
  C:\Windows\System\Xwjyrkw.exe
  2⤵
  PID:6488
- C:\Windows\System\eyAuquY.exe
  C:\Windows\System\eyAuquY.exe
  2⤵
  PID:6504
- C:\Windows\System\bosppaN.exe
  C:\Windows\System\bosppaN.exe
  2⤵
  PID:6520
- C:\Windows\System\BdaYjHq.exe
  C:\Windows\System\BdaYjHq.exe
  2⤵
  PID:6536
- C:\Windows\System\hiBaYiR.exe
  C:\Windows\System\hiBaYiR.exe
  2⤵
  PID:6552
- C:\Windows\System\SgxRbtQ.exe
  C:\Windows\System\SgxRbtQ.exe
  2⤵
  PID:6568
- C:\Windows\System\iasttWD.exe
  C:\Windows\System\iasttWD.exe
  2⤵
  PID:6584
- C:\Windows\System\EZqMtvG.exe
  C:\Windows\System\EZqMtvG.exe
  2⤵
  PID:6600
- C:\Windows\System\UpiTpme.exe
  C:\Windows\System\UpiTpme.exe
  2⤵
  PID:6616
- C:\Windows\System\qImQXKU.exe
  C:\Windows\System\qImQXKU.exe
  2⤵
  PID:6632
- C:\Windows\System\wwNDyTv.exe
  C:\Windows\System\wwNDyTv.exe
  2⤵
  PID:6648
- C:\Windows\System\mxqQdlt.exe
  C:\Windows\System\mxqQdlt.exe
  2⤵
  PID:6664
- C:\Windows\System\vJbZNvT.exe
  C:\Windows\System\vJbZNvT.exe
  2⤵
  PID:6680
- C:\Windows\System\HOPiKMz.exe
  C:\Windows\System\HOPiKMz.exe
  2⤵
  PID:6696
- C:\Windows\System\rxUaUlA.exe
  C:\Windows\System\rxUaUlA.exe
  2⤵
  PID:6712
- C:\Windows\System\RjsZbjs.exe
  C:\Windows\System\RjsZbjs.exe
  2⤵
  PID:6728
- C:\Windows\System\gvibhfU.exe
  C:\Windows\System\gvibhfU.exe
  2⤵
  PID:6744
- C:\Windows\System\DsvbXjM.exe
  C:\Windows\System\DsvbXjM.exe
  2⤵
  PID:6760
- C:\Windows\System\hQMdYPN.exe
  C:\Windows\System\hQMdYPN.exe
  2⤵
  PID:6776
- C:\Windows\System\RBUJdqT.exe
  C:\Windows\System\RBUJdqT.exe
  2⤵
  PID:6796
- C:\Windows\System\LoGOIQe.exe
  C:\Windows\System\LoGOIQe.exe
  2⤵
  PID:6812
- C:\Windows\System\bVOCfCz.exe
  C:\Windows\System\bVOCfCz.exe
  2⤵
  PID:6828
- C:\Windows\System\ZmDiAqt.exe
  C:\Windows\System\ZmDiAqt.exe
  2⤵
  PID:6844
- C:\Windows\System\JKPbFFE.exe
  C:\Windows\System\JKPbFFE.exe
  2⤵
  PID:6860
- C:\Windows\System\YWYXGAz.exe
  C:\Windows\System\YWYXGAz.exe
  2⤵
  PID:6876
- C:\Windows\System\jGDgMto.exe
  C:\Windows\System\jGDgMto.exe
  2⤵
  PID:6892
- C:\Windows\System\cxkxBzL.exe
  C:\Windows\System\cxkxBzL.exe
  2⤵
  PID:6908
- C:\Windows\System\PcICbUI.exe
  C:\Windows\System\PcICbUI.exe
  2⤵
  PID:6924
- C:\Windows\System\CVEdPAZ.exe
  C:\Windows\System\CVEdPAZ.exe
  2⤵
  PID:6940
- C:\Windows\System\wqCwiMa.exe
  C:\Windows\System\wqCwiMa.exe
  2⤵
  PID:6956
- C:\Windows\System\ElVpygP.exe
  C:\Windows\System\ElVpygP.exe
  2⤵
  PID:6972
- C:\Windows\System\njBpOZu.exe
  C:\Windows\System\njBpOZu.exe
  2⤵
  PID:6988
- C:\Windows\System\WtlviyL.exe
  C:\Windows\System\WtlviyL.exe
  2⤵
  PID:7004
- C:\Windows\System\PLkvlvr.exe
  C:\Windows\System\PLkvlvr.exe
  2⤵
  PID:7020
- C:\Windows\System\svEOmmk.exe
  C:\Windows\System\svEOmmk.exe
  2⤵
  PID:7036
- C:\Windows\System\YdOxYyA.exe
  C:\Windows\System\YdOxYyA.exe
  2⤵
  PID:7052
- C:\Windows\System\kglsfPQ.exe
  C:\Windows\System\kglsfPQ.exe
  2⤵
  PID:7068
- C:\Windows\System\hpbFVyA.exe
  C:\Windows\System\hpbFVyA.exe
  2⤵
  PID:7084
- C:\Windows\System\sjnKaAp.exe
  C:\Windows\System\sjnKaAp.exe
  2⤵
  PID:7100
- C:\Windows\System\ALUgtLG.exe
  C:\Windows\System\ALUgtLG.exe
  2⤵
  PID:7116
- C:\Windows\System\RFcAXqe.exe
  C:\Windows\System\RFcAXqe.exe
  2⤵
  PID:7132
- C:\Windows\System\LJXJpLl.exe
  C:\Windows\System\LJXJpLl.exe
  2⤵
  PID:7148
- C:\Windows\System\aiiPltO.exe
  C:\Windows\System\aiiPltO.exe
  2⤵
  PID:7164
- C:\Windows\System\MCsYXda.exe
  C:\Windows\System\MCsYXda.exe
  2⤵
  PID:6152
- C:\Windows\System\MJgQxTH.exe
  C:\Windows\System\MJgQxTH.exe
  2⤵
  PID:6216
- C:\Windows\System\XnfQmcf.exe
  C:\Windows\System\XnfQmcf.exe
  2⤵
  PID:6280
- C:\Windows\System\Sywydni.exe
  C:\Windows\System\Sywydni.exe
  2⤵
  PID:5448
- C:\Windows\System\tVuoeTw.exe
  C:\Windows\System\tVuoeTw.exe
  2⤵
  PID:6344
- C:\Windows\System\QHzsdtt.exe
  C:\Windows\System\QHzsdtt.exe
  2⤵
  PID:5576
- C:\Windows\System\cqQhkuX.exe
  C:\Windows\System\cqQhkuX.exe
  2⤵
  PID:5300
- C:\Windows\System\TfPzvTE.exe
  C:\Windows\System\TfPzvTE.exe
  2⤵
  PID:6356
- C:\Windows\System\aBOiKxG.exe
  C:\Windows\System\aBOiKxG.exe
  2⤵
  PID:6076
- C:\Windows\System\DRPfusO.exe
  C:\Windows\System\DRPfusO.exe
  2⤵
  PID:5892
- C:\Windows\System\XRazyrv.exe
  C:\Windows\System\XRazyrv.exe
  2⤵
  PID:4152
- C:\Windows\System\FYgNwmY.exe
  C:\Windows\System\FYgNwmY.exe
  2⤵
  PID:6200
- C:\Windows\System\XBARndv.exe
  C:\Windows\System\XBARndv.exe
  2⤵
  PID:6264
- C:\Windows\System\BzJaUwl.exe
  C:\Windows\System\BzJaUwl.exe
  2⤵
  PID:6388
- C:\Windows\System\QBVgARI.exe
  C:\Windows\System\QBVgARI.exe
  2⤵
  PID:6412
- C:\Windows\System\mUTbBpD.exe
  C:\Windows\System\mUTbBpD.exe
  2⤵
  PID:6480
- C:\Windows\System\FiLOPmt.exe
  C:\Windows\System\FiLOPmt.exe
  2⤵
  PID:6544
- C:\Windows\System\ZwIXXWn.exe
  C:\Windows\System\ZwIXXWn.exe
  2⤵
  PID:6460
- C:\Windows\System\nNHCwGh.exe
  C:\Windows\System\nNHCwGh.exe
  2⤵
  PID:6612
- C:\Windows\System\VhTCmzf.exe
  C:\Windows\System\VhTCmzf.exe
  2⤵
  PID:6676
- C:\Windows\System\wkaNPIu.exe
  C:\Windows\System\wkaNPIu.exe
  2⤵
  PID:6740
- C:\Windows\System\pIIIXCZ.exe
  C:\Windows\System\pIIIXCZ.exe
  2⤵
  PID:6772
- C:\Windows\System\MNdsLiq.exe
  C:\Windows\System\MNdsLiq.exe
  2⤵
  PID:6528
- C:\Windows\System\ITfPosP.exe
  C:\Windows\System\ITfPosP.exe
  2⤵
  PID:6592
- C:\Windows\System\VaHjdva.exe
  C:\Windows\System\VaHjdva.exe
  2⤵
  PID:6656
- C:\Windows\System\BsHXHuw.exe
  C:\Windows\System\BsHXHuw.exe
  2⤵
  PID:6724
- C:\Windows\System\sjQapyR.exe
  C:\Windows\System\sjQapyR.exe
  2⤵
  PID:6804
- C:\Windows\System\KYXYzUX.exe
  C:\Windows\System\KYXYzUX.exe
  2⤵
  PID:6868
- C:\Windows\System\FjChWUw.exe
  C:\Windows\System\FjChWUw.exe
  2⤵
  PID:6932
- C:\Windows\System\BBuBdyc.exe
  C:\Windows\System\BBuBdyc.exe
  2⤵
  PID:6788
- C:\Windows\System\QddOBdf.exe
  C:\Windows\System\QddOBdf.exe
  2⤵
  PID:6852
- C:\Windows\System\Bfwsmiw.exe
  C:\Windows\System\Bfwsmiw.exe
  2⤵
  PID:6916
- C:\Windows\System\wqWlWpA.exe
  C:\Windows\System\wqWlWpA.exe
  2⤵
  PID:7000
- C:\Windows\System\evqLVIe.exe
  C:\Windows\System\evqLVIe.exe
  2⤵
  PID:7064
- C:\Windows\System\mEbmCds.exe
  C:\Windows\System\mEbmCds.exe
  2⤵
  PID:7128
- C:\Windows\System\bIKoPcN.exe
  C:\Windows\System\bIKoPcN.exe
  2⤵
  PID:6212
- C:\Windows\System\dVAxgvJ.exe
  C:\Windows\System\dVAxgvJ.exe
  2⤵
  PID:4828
- C:\Windows\System\xDuomKq.exe
  C:\Windows\System\xDuomKq.exe
  2⤵
  PID:5680
- C:\Windows\System\BLFcLsp.exe
  C:\Windows\System\BLFcLsp.exe
  2⤵
  PID:6324
- C:\Windows\System\LBwkyYG.exe
  C:\Windows\System\LBwkyYG.exe
  2⤵
  PID:6428
- C:\Windows\System\whoqtxp.exe
  C:\Windows\System\whoqtxp.exe
  2⤵
  PID:6468
- C:\Windows\System\YnRGHGd.exe
  C:\Windows\System\YnRGHGd.exe
  2⤵
  PID:7108
- C:\Windows\System\ElYfJwZ.exe
  C:\Windows\System\ElYfJwZ.exe
  2⤵
  PID:6840
- C:\Windows\System\HeQbKGR.exe
  C:\Windows\System\HeQbKGR.exe
  2⤵
  PID:6884
- C:\Windows\System\HjIhQgW.exe
  C:\Windows\System\HjIhQgW.exe
  2⤵
  PID:7012
- C:\Windows\System\fOenWLy.exe
  C:\Windows\System\fOenWLy.exe
  2⤵
  PID:6276
- C:\Windows\System\rWVQQDJ.exe
  C:\Windows\System\rWVQQDJ.exe
  2⤵
  PID:6448
- C:\Windows\System\vANBtVN.exe
  C:\Windows\System\vANBtVN.exe
  2⤵
  PID:6820
- C:\Windows\System\YhwyGFq.exe
  C:\Windows\System\YhwyGFq.exe
  2⤵
  PID:6184
- C:\Windows\System\EfwCdUX.exe
  C:\Windows\System\EfwCdUX.exe
  2⤵
  PID:7172
- C:\Windows\System\GfUOGQY.exe
  C:\Windows\System\GfUOGQY.exe
  2⤵
  PID:7188
- C:\Windows\System\TSuZeii.exe
  C:\Windows\System\TSuZeii.exe
  2⤵
  PID:7204
- C:\Windows\System\QoSYGYb.exe
  C:\Windows\System\QoSYGYb.exe
  2⤵
  PID:7220
- C:\Windows\System\EMTZeAk.exe
  C:\Windows\System\EMTZeAk.exe
  2⤵
  PID:7236
- C:\Windows\System\vcAZZKh.exe
  C:\Windows\System\vcAZZKh.exe
  2⤵
  PID:7260
- C:\Windows\System\kNSlNgH.exe
  C:\Windows\System\kNSlNgH.exe
  2⤵
  PID:7276
- C:\Windows\System\AJTObue.exe
  C:\Windows\System\AJTObue.exe
  2⤵
  PID:7292
- C:\Windows\System\ciEbkwt.exe
  C:\Windows\System\ciEbkwt.exe
  2⤵
  PID:7308
- C:\Windows\System\qPFfTTR.exe
  C:\Windows\System\qPFfTTR.exe
  2⤵
  PID:7324
- C:\Windows\System\WSFKPgo.exe
  C:\Windows\System\WSFKPgo.exe
  2⤵
  PID:7340
- C:\Windows\System\shYKZbB.exe
  C:\Windows\System\shYKZbB.exe
  2⤵
  PID:7356
- C:\Windows\System\LZSZEDX.exe
  C:\Windows\System\LZSZEDX.exe
  2⤵
  PID:7372
- C:\Windows\System\kGaSgDZ.exe
  C:\Windows\System\kGaSgDZ.exe
  2⤵
  PID:7388
- C:\Windows\System\IWzczlq.exe
  C:\Windows\System\IWzczlq.exe
  2⤵
  PID:7408
- C:\Windows\System\jRzlCkR.exe
  C:\Windows\System\jRzlCkR.exe
  2⤵
  PID:7428
- C:\Windows\System\lVdeEWO.exe
  C:\Windows\System\lVdeEWO.exe
  2⤵
  PID:7444
- C:\Windows\System\kOGfAqP.exe
  C:\Windows\System\kOGfAqP.exe
  2⤵
  PID:7460
- C:\Windows\System\zkymhbg.exe
  C:\Windows\System\zkymhbg.exe
  2⤵
  PID:7480
- C:\Windows\System\WLavpFg.exe
  C:\Windows\System\WLavpFg.exe
  2⤵
  PID:7496
- C:\Windows\System\ICXnWkz.exe
  C:\Windows\System\ICXnWkz.exe
  2⤵
  PID:7512
- C:\Windows\System\EckmsZo.exe
  C:\Windows\System\EckmsZo.exe
  2⤵
  PID:7528
- C:\Windows\System\snWcFUR.exe
  C:\Windows\System\snWcFUR.exe
  2⤵
  PID:7544
- C:\Windows\System\OxjOyxu.exe
  C:\Windows\System\OxjOyxu.exe
  2⤵
  PID:7560
- C:\Windows\System\ZgTVmvr.exe
  C:\Windows\System\ZgTVmvr.exe
  2⤵
  PID:7576
- C:\Windows\System\XfDdxBG.exe
  C:\Windows\System\XfDdxBG.exe
  2⤵
  PID:7592
- C:\Windows\System\JuIvBBA.exe
  C:\Windows\System\JuIvBBA.exe
  2⤵
  PID:7608
- C:\Windows\System\AhdZmAt.exe
  C:\Windows\System\AhdZmAt.exe
  2⤵
  PID:7624
- C:\Windows\System\AXAiiFi.exe
  C:\Windows\System\AXAiiFi.exe
  2⤵
  PID:7640
- C:\Windows\System\pdHKpMq.exe
  C:\Windows\System\pdHKpMq.exe
  2⤵
  PID:7656
- C:\Windows\System\mEerXtY.exe
  C:\Windows\System\mEerXtY.exe
  2⤵
  PID:7672
- C:\Windows\System\RZeGZtq.exe
  C:\Windows\System\RZeGZtq.exe
  2⤵
  PID:7688
- C:\Windows\System\ucCcEWF.exe
  C:\Windows\System\ucCcEWF.exe
  2⤵
  PID:7704
- C:\Windows\System\JQPwnhp.exe
  C:\Windows\System\JQPwnhp.exe
  2⤵
  PID:7720
- C:\Windows\System\RmUgYef.exe
  C:\Windows\System\RmUgYef.exe
  2⤵
  PID:7736
- C:\Windows\System\vNcuuNG.exe
  C:\Windows\System\vNcuuNG.exe
  2⤵
  PID:7752
- C:\Windows\System\StFonZO.exe
  C:\Windows\System\StFonZO.exe
  2⤵
  PID:7768
- C:\Windows\System\SgMvrkT.exe
  C:\Windows\System\SgMvrkT.exe
  2⤵
  PID:7784
- C:\Windows\System\cUZIHKW.exe
  C:\Windows\System\cUZIHKW.exe
  2⤵
  PID:7800
- C:\Windows\System\Nulrdcu.exe
  C:\Windows\System\Nulrdcu.exe
  2⤵
  PID:7816
- C:\Windows\System\xqzYhwv.exe
  C:\Windows\System\xqzYhwv.exe
  2⤵
  PID:7832
- C:\Windows\System\YoOpfir.exe
  C:\Windows\System\YoOpfir.exe
  2⤵
  PID:7848
- C:\Windows\System\HxUkDjl.exe
  C:\Windows\System\HxUkDjl.exe
  2⤵
  PID:7864
- C:\Windows\System\EzNNeQQ.exe
  C:\Windows\System\EzNNeQQ.exe
  2⤵
  PID:7880
- C:\Windows\System\QyBptFr.exe
  C:\Windows\System\QyBptFr.exe
  2⤵
  PID:7896
- C:\Windows\System\xHscGaG.exe
  C:\Windows\System\xHscGaG.exe
  2⤵
  PID:7912
- C:\Windows\System\kYixeUH.exe
  C:\Windows\System\kYixeUH.exe
  2⤵
  PID:7928
- C:\Windows\System\BXPLUzr.exe
  C:\Windows\System\BXPLUzr.exe
  2⤵
  PID:7944
- C:\Windows\System\ZsuNCCd.exe
  C:\Windows\System\ZsuNCCd.exe
  2⤵
  PID:7960
- C:\Windows\System\skfgnNn.exe
  C:\Windows\System\skfgnNn.exe
  2⤵
  PID:7976
- C:\Windows\System\gqIWUwU.exe
  C:\Windows\System\gqIWUwU.exe
  2⤵
  PID:7992
- C:\Windows\System\rQebxOf.exe
  C:\Windows\System\rQebxOf.exe
  2⤵
  PID:8008
- C:\Windows\System\wJacLOw.exe
  C:\Windows\System\wJacLOw.exe
  2⤵
  PID:8024
- C:\Windows\System\vCTyKKl.exe
  C:\Windows\System\vCTyKKl.exe
  2⤵
  PID:8040
- C:\Windows\System\HRrjUMB.exe
  C:\Windows\System\HRrjUMB.exe
  2⤵
  PID:8056
- C:\Windows\System\rtSwWWm.exe
  C:\Windows\System\rtSwWWm.exe
  2⤵
  PID:8072
- C:\Windows\System\VSuIwxI.exe
  C:\Windows\System\VSuIwxI.exe
  2⤵
  PID:8088
- C:\Windows\System\HedmkxE.exe
  C:\Windows\System\HedmkxE.exe
  2⤵
  PID:8104
- C:\Windows\System\OBPACXo.exe
  C:\Windows\System\OBPACXo.exe
  2⤵
  PID:8120
- C:\Windows\System\HtkHMDw.exe
  C:\Windows\System\HtkHMDw.exe
  2⤵
  PID:8136
- C:\Windows\System\TXLyGGd.exe
  C:\Windows\System\TXLyGGd.exe
  2⤵
  PID:8152
- C:\Windows\System\ASIBeTJ.exe
  C:\Windows\System\ASIBeTJ.exe
  2⤵
  PID:8168
- C:\Windows\System\QclUuPM.exe
  C:\Windows\System\QclUuPM.exe
  2⤵
  PID:8184
- C:\Windows\System\qiufobn.exe
  C:\Windows\System\qiufobn.exe
  2⤵
  PID:6260
- C:\Windows\System\jsEsZzJ.exe
  C:\Windows\System\jsEsZzJ.exe
  2⤵
  PID:7048
- C:\Windows\System\RDijLEP.exe
  C:\Windows\System\RDijLEP.exe
  2⤵
  PID:6980
- C:\Windows\System\GLYaQWH.exe
  C:\Windows\System\GLYaQWH.exe
  2⤵
  PID:7044
- C:\Windows\System\cTuZjvB.exe
  C:\Windows\System\cTuZjvB.exe
  2⤵
  PID:7244
- C:\Windows\System\DsTPOHi.exe
  C:\Windows\System\DsTPOHi.exe
  2⤵
  PID:6516
- C:\Windows\System\XNJoUbW.exe
  C:\Windows\System\XNJoUbW.exe
  2⤵
  PID:6628
- C:\Windows\System\qwgDIen.exe
  C:\Windows\System\qwgDIen.exe
  2⤵
  PID:6148
- C:\Windows\System\wGZNcFf.exe
  C:\Windows\System\wGZNcFf.exe
  2⤵
  PID:5736
- C:\Windows\System\gIsOarp.exe
  C:\Windows\System\gIsOarp.exe
  2⤵
  PID:3828
- C:\Windows\System\eaXYkfP.exe
  C:\Windows\System\eaXYkfP.exe
  2⤵
  PID:6736
- C:\Windows\System\wZlzynm.exe
  C:\Windows\System\wZlzynm.exe
  2⤵
  PID:6784
- C:\Windows\System\HLLvePt.exe
  C:\Windows\System\HLLvePt.exe
  2⤵
  PID:6824
- C:\Windows\System\joHNyox.exe
  C:\Windows\System\joHNyox.exe
  2⤵
  PID:6312
- C:\Windows\System\ijTeCQx.exe
  C:\Windows\System\ijTeCQx.exe
  2⤵
  PID:6672
- C:\Windows\System\tgLXhlD.exe
  C:\Windows\System\tgLXhlD.exe
  2⤵
  PID:6444
- C:\Windows\System\PoXvkUe.exe
  C:\Windows\System\PoXvkUe.exe
  2⤵
  PID:7284
- C:\Windows\System\usMhsXU.exe
  C:\Windows\System\usMhsXU.exe
  2⤵
  PID:7316
- C:\Windows\System\nKzluog.exe
  C:\Windows\System\nKzluog.exe
  2⤵
  PID:7336
- C:\Windows\System\viNrTwa.exe
  C:\Windows\System\viNrTwa.exe
  2⤵
  PID:7380
- C:\Windows\System\VnSUUmA.exe
  C:\Windows\System\VnSUUmA.exe
  2⤵
  PID:7404
- C:\Windows\System\GKmsXHm.exe
  C:\Windows\System\GKmsXHm.exe
  2⤵
  PID:7384
- C:\Windows\System\gYVoBSY.exe
  C:\Windows\System\gYVoBSY.exe
  2⤵
  PID:7424
- C:\Windows\System\nppMbRF.exe
  C:\Windows\System\nppMbRF.exe
  2⤵
  PID:7504
- C:\Windows\System\NQxqlPx.exe
  C:\Windows\System\NQxqlPx.exe
  2⤵
  PID:7488
- C:\Windows\System\iXYlkXb.exe
  C:\Windows\System\iXYlkXb.exe
  2⤵
  PID:7524
- C:\Windows\System\VrYlXWe.exe
  C:\Windows\System\VrYlXWe.exe
  2⤵
  PID:7604
- C:\Windows\System\OjKQZJn.exe
  C:\Windows\System\OjKQZJn.exe
  2⤵
  PID:7668
- C:\Windows\System\zupnmHM.exe
  C:\Windows\System\zupnmHM.exe
  2⤵
  PID:7620
- C:\Windows\System\ihfEoSc.exe
  C:\Windows\System\ihfEoSc.exe
  2⤵
  PID:7584
- C:\Windows\System\FxPhPdM.exe
  C:\Windows\System\FxPhPdM.exe
  2⤵
  PID:7760
- C:\Windows\System\MJnNlBZ.exe
  C:\Windows\System\MJnNlBZ.exe
  2⤵
  PID:7796
- C:\Windows\System\QYDntiv.exe
  C:\Windows\System\QYDntiv.exe
  2⤵
  PID:7680
- C:\Windows\System\YXxOzXe.exe
  C:\Windows\System\YXxOzXe.exe
  2⤵
  PID:7780
- C:\Windows\System\JYKMNjL.exe
  C:\Windows\System\JYKMNjL.exe
  2⤵
  PID:7856
- C:\Windows\System\EbvXfSe.exe
  C:\Windows\System\EbvXfSe.exe
  2⤵
  PID:7876
- C:\Windows\System\gsqrlKK.exe
  C:\Windows\System\gsqrlKK.exe
  2⤵
  PID:7920
- C:\Windows\System\EMhTzrF.exe
  C:\Windows\System\EMhTzrF.exe
  2⤵
  PID:7984
- C:\Windows\System\VvvuFgg.exe
  C:\Windows\System\VvvuFgg.exe
  2⤵
  PID:8020
- C:\Windows\System\JaaDuLG.exe
  C:\Windows\System\JaaDuLG.exe
  2⤵
  PID:8048
- C:\Windows\System\CvgHTTV.exe
  C:\Windows\System\CvgHTTV.exe
  2⤵
  PID:7972
- C:\Windows\System\OwPlEMA.exe
  C:\Windows\System\OwPlEMA.exe
  2⤵
  PID:8116
- C:\Windows\System\DGfzoyW.exe
  C:\Windows\System\DGfzoyW.exe
  2⤵
  PID:8032
- C:\Windows\System\nSCttcb.exe
  C:\Windows\System\nSCttcb.exe
  2⤵
  PID:8064
- C:\Windows\System\NtoLPjR.exe
  C:\Windows\System\NtoLPjR.exe
  2⤵
  PID:8132
- C:\Windows\System\pqEABXg.exe
  C:\Windows\System\pqEABXg.exe
  2⤵
  PID:7196
- C:\Windows\System\vYpXMUL.exe
  C:\Windows\System\vYpXMUL.exe
  2⤵
  PID:6512
- C:\Windows\System\CyITztH.exe
  C:\Windows\System\CyITztH.exe
  2⤵
  PID:6560
- C:\Windows\System\vwWNpCE.exe
  C:\Windows\System\vwWNpCE.exe
  2⤵
  PID:7348
- C:\Windows\System\UtTgKFf.exe
  C:\Windows\System\UtTgKFf.exe
  2⤵
  PID:7368
- C:\Windows\System\AZaVnpL.exe
  C:\Windows\System\AZaVnpL.exe
  2⤵
  PID:7332
- C:\Windows\System\cTotLiv.exe
  C:\Windows\System\cTotLiv.exe
  2⤵
  PID:7468
- C:\Windows\System\DEwAaZO.exe
  C:\Windows\System\DEwAaZO.exe
  2⤵
  PID:7520
- C:\Windows\System\NMEvUAU.exe
  C:\Windows\System\NMEvUAU.exe
  2⤵
  PID:7652
- C:\Windows\System\tZbNSuc.exe
  C:\Windows\System\tZbNSuc.exe
  2⤵
  PID:7452
- C:\Windows\System\xVpfeVp.exe
  C:\Windows\System\xVpfeVp.exe
  2⤵
  PID:7588
- C:\Windows\System\fYYbeAn.exe
  C:\Windows\System\fYYbeAn.exe
  2⤵
  PID:7540
- C:\Windows\System\DwPlDKV.exe
  C:\Windows\System\DwPlDKV.exe
  2⤵
  PID:7952
- C:\Windows\System\IkxzvmA.exe
  C:\Windows\System\IkxzvmA.exe
  2⤵
  PID:7968
- C:\Windows\System\wDkyVbz.exe
  C:\Windows\System\wDkyVbz.exe
  2⤵
  PID:8096
- C:\Windows\System\cKXDgWQ.exe
  C:\Windows\System\cKXDgWQ.exe
  2⤵
  PID:7748
- C:\Windows\System\OqogGwK.exe
  C:\Windows\System\OqogGwK.exe
  2⤵
  PID:7844
- C:\Windows\System\EOgGmBL.exe
  C:\Windows\System\EOgGmBL.exe
  2⤵
  PID:8080
- C:\Windows\System\LOIxuUI.exe
  C:\Windows\System\LOIxuUI.exe
  2⤵
  PID:7112
- C:\Windows\System\UCYoPnz.exe
  C:\Windows\System\UCYoPnz.exe
  2⤵
  PID:6564
- C:\Windows\System\HFZKfvF.exe
  C:\Windows\System\HFZKfvF.exe
  2⤵
  PID:7032
- C:\Windows\System\qQSvfIf.exe
  C:\Windows\System\qQSvfIf.exe
  2⤵
  PID:6120
- C:\Windows\System\yjnXITM.exe
  C:\Windows\System\yjnXITM.exe
  2⤵
  PID:6708
- C:\Windows\System\ybhcEOF.exe
  C:\Windows\System\ybhcEOF.exe
  2⤵
  PID:7060
- C:\Windows\System\FhizfsS.exe
  C:\Windows\System\FhizfsS.exe
  2⤵
  PID:7272
- C:\Windows\System\zyXcdaK.exe
  C:\Windows\System\zyXcdaK.exe
  2⤵
  PID:7396
- C:\Windows\System\rpgbnDI.exe
  C:\Windows\System\rpgbnDI.exe
  2⤵
  PID:7700
- C:\Windows\System\FOpDTMT.exe
  C:\Windows\System\FOpDTMT.exe
  2⤵
  PID:8112
- C:\Windows\System\JFUGLjU.exe
  C:\Windows\System\JFUGLjU.exe
  2⤵
  PID:8144
- C:\Windows\System\PTEbenH.exe
  C:\Windows\System\PTEbenH.exe
  2⤵
  PID:6624
- C:\Windows\System\fEdQXWU.exe
  C:\Windows\System\fEdQXWU.exe
  2⤵
  PID:6196
- C:\Windows\System\DUZriSC.exe
  C:\Windows\System\DUZriSC.exe
  2⤵
  PID:7828
- C:\Windows\System\BwfXEQY.exe
  C:\Windows\System\BwfXEQY.exe
  2⤵
  PID:7016
- C:\Windows\System\MYMwhXH.exe
  C:\Windows\System\MYMwhXH.exe
  2⤵
  PID:7808
- C:\Windows\System\zDBdrsm.exe
  C:\Windows\System\zDBdrsm.exe
  2⤵
  PID:7792
- C:\Windows\System\vqwewXb.exe
  C:\Windows\System\vqwewXb.exe
  2⤵
  PID:7300
- C:\Windows\System\jnwMrhN.exe
  C:\Windows\System\jnwMrhN.exe
  2⤵
  PID:7536
- C:\Windows\System\QNTBtOC.exe
  C:\Windows\System\QNTBtOC.exe
  2⤵
  PID:6580
- C:\Windows\System\PXJRjrK.exe
  C:\Windows\System\PXJRjrK.exe
  2⤵
  PID:8016
- C:\Windows\System\KklFDuG.exe
  C:\Windows\System\KklFDuG.exe
  2⤵
  PID:7476
- C:\Windows\System\GVUIlGP.exe
  C:\Windows\System\GVUIlGP.exe
  2⤵
  PID:7288
- C:\Windows\System\plcPFZP.exe
  C:\Windows\System\plcPFZP.exe
  2⤵
  PID:8200
- C:\Windows\System\kZWORVJ.exe
  C:\Windows\System\kZWORVJ.exe
  2⤵
  PID:8216
- C:\Windows\System\dbozuOz.exe
  C:\Windows\System\dbozuOz.exe
  2⤵
  PID:8232
- C:\Windows\System\IFelIVG.exe
  C:\Windows\System\IFelIVG.exe
  2⤵
  PID:8248
- C:\Windows\System\REzcmza.exe
  C:\Windows\System\REzcmza.exe
  2⤵
  PID:8264
- C:\Windows\System\KnBfynR.exe
  C:\Windows\System\KnBfynR.exe
  2⤵
  PID:8280
- C:\Windows\System\YNXtppl.exe
  C:\Windows\System\YNXtppl.exe
  2⤵
  PID:8296
- C:\Windows\System\mFRtKyz.exe
  C:\Windows\System\mFRtKyz.exe
  2⤵
  PID:8312
- C:\Windows\System\adDIBnk.exe
  C:\Windows\System\adDIBnk.exe
  2⤵
  PID:8328
- C:\Windows\System\obstocw.exe
  C:\Windows\System\obstocw.exe
  2⤵
  PID:8344
- C:\Windows\System\IuQpEhK.exe
  C:\Windows\System\IuQpEhK.exe
  2⤵
  PID:8360
- C:\Windows\System\pqRgZyW.exe
  C:\Windows\System\pqRgZyW.exe
  2⤵
  PID:8376
- C:\Windows\System\YaUvkUe.exe
  C:\Windows\System\YaUvkUe.exe
  2⤵
  PID:8392
- C:\Windows\System\fbDroJc.exe
  C:\Windows\System\fbDroJc.exe
  2⤵
  PID:8408
- C:\Windows\System\LlXVEyw.exe
  C:\Windows\System\LlXVEyw.exe
  2⤵
  PID:8424
- C:\Windows\System\NwMUEYJ.exe
  C:\Windows\System\NwMUEYJ.exe
  2⤵
  PID:8440
- C:\Windows\System\vVIKhJw.exe
  C:\Windows\System\vVIKhJw.exe
  2⤵
  PID:8456
- C:\Windows\System\MWahxAc.exe
  C:\Windows\System\MWahxAc.exe
  2⤵
  PID:8472
- C:\Windows\System\ymwsHwD.exe
  C:\Windows\System\ymwsHwD.exe
  2⤵
  PID:8488
- C:\Windows\System\eNEEaBV.exe
  C:\Windows\System\eNEEaBV.exe
  2⤵
  PID:8504
- C:\Windows\System\vSYIGmS.exe
  C:\Windows\System\vSYIGmS.exe
  2⤵
  PID:8520
- C:\Windows\System\UmVrRSM.exe
  C:\Windows\System\UmVrRSM.exe
  2⤵
  PID:8536
- C:\Windows\System\MohEcvK.exe
  C:\Windows\System\MohEcvK.exe
  2⤵
  PID:8552
- C:\Windows\System\ETCBBqZ.exe
  C:\Windows\System\ETCBBqZ.exe
  2⤵
  PID:8568
- C:\Windows\System\ogzbxnz.exe
  C:\Windows\System\ogzbxnz.exe
  2⤵
  PID:8584
- C:\Windows\System\tOolXrk.exe
  C:\Windows\System\tOolXrk.exe
  2⤵
  PID:8600
- C:\Windows\System\xkJIkDg.exe
  C:\Windows\System\xkJIkDg.exe
  2⤵
  PID:8616
- C:\Windows\System\TedIgDj.exe
  C:\Windows\System\TedIgDj.exe
  2⤵
  PID:8632
- C:\Windows\System\axkooUo.exe
  C:\Windows\System\axkooUo.exe
  2⤵
  PID:8648
- C:\Windows\System\wFFBoSt.exe
  C:\Windows\System\wFFBoSt.exe
  2⤵
  PID:8664
- C:\Windows\System\OfwvjTW.exe
  C:\Windows\System\OfwvjTW.exe
  2⤵
  PID:8680
- C:\Windows\System\UFGAhLp.exe
  C:\Windows\System\UFGAhLp.exe
  2⤵
  PID:8696
- C:\Windows\System\ojosNMf.exe
  C:\Windows\System\ojosNMf.exe
  2⤵
  PID:8712
- C:\Windows\System\xEirAxd.exe
  C:\Windows\System\xEirAxd.exe
  2⤵
  PID:8728
- C:\Windows\System\SWnOUES.exe
  C:\Windows\System\SWnOUES.exe
  2⤵
  PID:8744
- C:\Windows\System\AySMEZi.exe
  C:\Windows\System\AySMEZi.exe
  2⤵
  PID:8760
- C:\Windows\System\zkArCbZ.exe
  C:\Windows\System\zkArCbZ.exe
  2⤵
  PID:8776
- C:\Windows\System\bCdNJIY.exe
  C:\Windows\System\bCdNJIY.exe
  2⤵
  PID:8792
- C:\Windows\System\QzdNXIG.exe
  C:\Windows\System\QzdNXIG.exe
  2⤵
  PID:8808
- C:\Windows\System\aWDYOTc.exe
  C:\Windows\System\aWDYOTc.exe
  2⤵
  PID:8824
- C:\Windows\System\BllsAky.exe
  C:\Windows\System\BllsAky.exe
  2⤵
  PID:8840
- C:\Windows\System\YFSpSBl.exe
  C:\Windows\System\YFSpSBl.exe
  2⤵
  PID:8856
- C:\Windows\System\eSwWMEa.exe
  C:\Windows\System\eSwWMEa.exe
  2⤵
  PID:8872
- C:\Windows\System\KKodggp.exe
  C:\Windows\System\KKodggp.exe
  2⤵
  PID:8888
- C:\Windows\System\umKBULk.exe
  C:\Windows\System\umKBULk.exe
  2⤵
  PID:8904
- C:\Windows\System\FzzhbmU.exe
  C:\Windows\System\FzzhbmU.exe
  2⤵
  PID:8920
- C:\Windows\System\agEOZYl.exe
  C:\Windows\System\agEOZYl.exe
  2⤵
  PID:8936
- C:\Windows\System\xVVqLeG.exe
  C:\Windows\System\xVVqLeG.exe
  2⤵
  PID:8952
- C:\Windows\System\YSygZSd.exe
  C:\Windows\System\YSygZSd.exe
  2⤵
  PID:8968
- C:\Windows\System\VoYjWEa.exe
  C:\Windows\System\VoYjWEa.exe
  2⤵
  PID:8984
- C:\Windows\System\qByrYOX.exe
  C:\Windows\System\qByrYOX.exe
  2⤵
  PID:9004
- C:\Windows\System\lmaLOVb.exe
  C:\Windows\System\lmaLOVb.exe
  2⤵
  PID:9020
- C:\Windows\System\bKDxUHX.exe
  C:\Windows\System\bKDxUHX.exe
  2⤵
  PID:9036
- C:\Windows\System\iurqSsw.exe
  C:\Windows\System\iurqSsw.exe
  2⤵
  PID:9052
- C:\Windows\System\hKWZTxh.exe
  C:\Windows\System\hKWZTxh.exe
  2⤵
  PID:9068
- C:\Windows\System\iqbkOMs.exe
  C:\Windows\System\iqbkOMs.exe
  2⤵
  PID:9084
- C:\Windows\System\dkXOfUh.exe
  C:\Windows\System\dkXOfUh.exe
  2⤵
  PID:9100
- C:\Windows\System\IcbWSrh.exe
  C:\Windows\System\IcbWSrh.exe
  2⤵
  PID:9116
- C:\Windows\System\aQKFBbn.exe
  C:\Windows\System\aQKFBbn.exe
  2⤵
  PID:9132
- C:\Windows\System\IWYsspa.exe
  C:\Windows\System\IWYsspa.exe
  2⤵
  PID:9148
- C:\Windows\System\fxXEUju.exe
  C:\Windows\System\fxXEUju.exe
  2⤵
  PID:9164
- C:\Windows\System\oQbbtDG.exe
  C:\Windows\System\oQbbtDG.exe
  2⤵
  PID:9180
- C:\Windows\System\WfAvmLp.exe
  C:\Windows\System\WfAvmLp.exe
  2⤵
  PID:9196
- C:\Windows\System\ocOGakA.exe
  C:\Windows\System\ocOGakA.exe
  2⤵
  PID:9212
- C:\Windows\System\ZpfuCyN.exe
  C:\Windows\System\ZpfuCyN.exe
  2⤵
  PID:8212
- C:\Windows\System\rOHLXce.exe
  C:\Windows\System\rOHLXce.exe
  2⤵
  PID:8400
- C:\Windows\System\Mesolbw.exe
  C:\Windows\System\Mesolbw.exe
  2⤵
  PID:8464
- C:\Windows\System\hLWqHpw.exe
  C:\Windows\System\hLWqHpw.exe
  2⤵
  PID:7648
- C:\Windows\System\XHqVpzI.exe
  C:\Windows\System\XHqVpzI.exe
  2⤵
  PID:8564
- C:\Windows\System\PzAmmTi.exe
  C:\Windows\System\PzAmmTi.exe
  2⤵
  PID:8628
- C:\Windows\System\uBpMtHP.exe
  C:\Windows\System\uBpMtHP.exe
  2⤵
  PID:8692
- C:\Windows\System\bCaQomw.exe
  C:\Windows\System\bCaQomw.exe
  2⤵
  PID:8292
- C:\Windows\System\WMNMUnw.exe
  C:\Windows\System\WMNMUnw.exe
  2⤵
  PID:8324
- C:\Windows\System\KIoFuPc.exe
  C:\Windows\System\KIoFuPc.exe
  2⤵
  PID:8784
- C:\Windows\System\cbeLQdB.exe
  C:\Windows\System\cbeLQdB.exe
  2⤵
  PID:8420
- C:\Windows\System\aAazgCx.exe
  C:\Windows\System\aAazgCx.exe
  2⤵
  PID:8880
- C:\Windows\System\pVdBLaN.exe
  C:\Windows\System\pVdBLaN.exe
  2⤵
  PID:8944
- C:\Windows\System\jXPngIK.exe
  C:\Windows\System\jXPngIK.exe
  2⤵
  PID:9012
- C:\Windows\System\UwLjTrr.exe
  C:\Windows\System\UwLjTrr.exe
  2⤵
  PID:9076
- C:\Windows\System\ojiEIFJ.exe
  C:\Windows\System\ojiEIFJ.exe
  2⤵
  PID:7940
- C:\Windows\System\CXNGPwG.exe
  C:\Windows\System\CXNGPwG.exe
  2⤵
  PID:9172
- C:\Windows\System\qwSZBRy.exe
  C:\Windows\System\qwSZBRy.exe
  2⤵
  PID:8228
- C:\Windows\System\POxKaKD.exe
  C:\Windows\System\POxKaKD.exe
  2⤵
  PID:8868
- C:\Windows\System\jBnTaoR.exe
  C:\Windows\System\jBnTaoR.exe
  2⤵
  PID:9092
- C:\Windows\System\eXHjIKv.exe
  C:\Windows\System\eXHjIKv.exe
  2⤵
  PID:6952
- C:\Windows\System\RjNZDOI.exe
  C:\Windows\System\RjNZDOI.exe
  2⤵
  PID:8640
- C:\Windows\System\elyrBZZ.exe
  C:\Windows\System\elyrBZZ.exe
  2⤵
  PID:8256
- C:\Windows\System\RhiRpQk.exe
  C:\Windows\System\RhiRpQk.exe
  2⤵
  PID:8388
- C:\Windows\System\eIGjYhu.exe
  C:\Windows\System\eIGjYhu.exe
  2⤵
  PID:8480
- C:\Windows\System\PEoxIfe.exe
  C:\Windows\System\PEoxIfe.exe
  2⤵
  PID:8548
- C:\Windows\System\vzmMRis.exe
  C:\Windows\System\vzmMRis.exe
  2⤵
  PID:8608
- C:\Windows\System\zidccxD.exe
  C:\Windows\System\zidccxD.exe
  2⤵
  PID:8676
- C:\Windows\System\CJBXNHq.exe
  C:\Windows\System\CJBXNHq.exe
  2⤵
  PID:8768
- C:\Windows\System\ptrCHjX.exe
  C:\Windows\System\ptrCHjX.exe
  2⤵
  PID:8900
- C:\Windows\System\yasVMZH.exe
  C:\Windows\System\yasVMZH.exe
  2⤵
  PID:8992
- C:\Windows\System\hPbvLNb.exe
  C:\Windows\System\hPbvLNb.exe
  2⤵
  PID:9096
- C:\Windows\System\WNGrtHU.exe
  C:\Windows\System\WNGrtHU.exe
  2⤵
  PID:9160
- C:\Windows\System\bQGVLMf.exe
  C:\Windows\System\bQGVLMf.exe
  2⤵
  PID:8276
- C:\Windows\System\mFcmwWt.exe
  C:\Windows\System\mFcmwWt.exe
  2⤵
  PID:8340
- C:\Windows\System\KjSDYZt.exe
  C:\Windows\System\KjSDYZt.exe
  2⤵
  PID:8500
- C:\Windows\System\MuimlLw.exe
  C:\Windows\System\MuimlLw.exe
  2⤵
  PID:8288
- C:\Windows\System\ykXYoGt.exe
  C:\Windows\System\ykXYoGt.exe
  2⤵
  PID:8560
- C:\Windows\System\mTLiHqo.exe
  C:\Windows\System\mTLiHqo.exe
  2⤵
  PID:8356
- C:\Windows\System\BkOvWgf.exe
  C:\Windows\System\BkOvWgf.exe
  2⤵
  PID:8976
- C:\Windows\System\OtfCwdT.exe
  C:\Windows\System\OtfCwdT.exe
  2⤵
  PID:9204
- C:\Windows\System\jaUQzWP.exe
  C:\Windows\System\jaUQzWP.exe
  2⤵
  PID:9208
- C:\Windows\System\cCZFUHU.exe
  C:\Windows\System\cCZFUHU.exe
  2⤵
  PID:8196
- C:\Windows\System\xuQkSsQ.exe
  C:\Windows\System\xuQkSsQ.exe
  2⤵
  PID:8516
- C:\Windows\System\YPlWpqC.exe
  C:\Windows\System\YPlWpqC.exe
  2⤵
  PID:8916
- C:\Windows\System\tPYQEvn.exe
  C:\Windows\System\tPYQEvn.exe
  2⤵
  PID:6692
- C:\Windows\System\YgFjiqT.exe
  C:\Windows\System\YgFjiqT.exe
  2⤵
  PID:8708
- C:\Windows\System\SmXPnzb.exe
  C:\Windows\System\SmXPnzb.exe
  2⤵
  PID:9000
- C:\Windows\System\YySVOXM.exe
  C:\Windows\System\YySVOXM.exe
  2⤵
  PID:8272
- C:\Windows\System\KRXQRsx.exe
  C:\Windows\System\KRXQRsx.exe
  2⤵
  PID:8372
- C:\Windows\System\Scwnotl.exe
  C:\Windows\System\Scwnotl.exe
  2⤵
  PID:8848
- C:\Windows\System\WuKwXVM.exe
  C:\Windows\System\WuKwXVM.exe
  2⤵
  PID:8736
- C:\Windows\System\RiaRGmt.exe
  C:\Windows\System\RiaRGmt.exe
  2⤵
  PID:8672
- C:\Windows\System\BcJAXbw.exe
  C:\Windows\System\BcJAXbw.exe
  2⤵
  PID:8864
- C:\Windows\System\WKSSIYo.exe
  C:\Windows\System\WKSSIYo.exe
  2⤵
  PID:8452
- C:\Windows\System\AFRrRgN.exe
  C:\Windows\System\AFRrRgN.exe
  2⤵
  PID:8756
- C:\Windows\System\HMuUTCu.exe
  C:\Windows\System\HMuUTCu.exe
  2⤵
  PID:8688
- C:\Windows\System\WSMRtOK.exe
  C:\Windows\System\WSMRtOK.exe
  2⤵
  PID:8816
- C:\Windows\System\etVdRUH.exe
  C:\Windows\System\etVdRUH.exe
  2⤵
  PID:9128
- C:\Windows\System\CoGUDPN.exe
  C:\Windows\System\CoGUDPN.exe
  2⤵
  PID:9228
- C:\Windows\System\AuJBfQf.exe
  C:\Windows\System\AuJBfQf.exe
  2⤵
  PID:9244
- C:\Windows\System\QxROlVA.exe
  C:\Windows\System\QxROlVA.exe
  2⤵
  PID:9260
- C:\Windows\System\bINtBGp.exe
  C:\Windows\System\bINtBGp.exe
  2⤵
  PID:9276
- C:\Windows\System\gyaPcyH.exe
  C:\Windows\System\gyaPcyH.exe
  2⤵
  PID:9292
- C:\Windows\System\iMUmWcG.exe
  C:\Windows\System\iMUmWcG.exe
  2⤵
  PID:9308
- C:\Windows\System\oJaSKgl.exe
  C:\Windows\System\oJaSKgl.exe
  2⤵
  PID:9324
- C:\Windows\System\IcFfWRw.exe
  C:\Windows\System\IcFfWRw.exe
  2⤵
  PID:9340
- C:\Windows\System\HQmTLaB.exe
  C:\Windows\System\HQmTLaB.exe
  2⤵
  PID:9356
- C:\Windows\System\vsMuEzv.exe
  C:\Windows\System\vsMuEzv.exe
  2⤵
  PID:9372
- C:\Windows\System\kLJdjhm.exe
  C:\Windows\System\kLJdjhm.exe
  2⤵
  PID:9388
- C:\Windows\System\QLKzxsV.exe
  C:\Windows\System\QLKzxsV.exe
  2⤵
  PID:9404
- C:\Windows\System\nlOKDid.exe
  C:\Windows\System\nlOKDid.exe
  2⤵
  PID:9420
- C:\Windows\System\THEtthv.exe
  C:\Windows\System\THEtthv.exe
  2⤵
  PID:9436
- C:\Windows\System\mGOPtap.exe
  C:\Windows\System\mGOPtap.exe
  2⤵
  PID:9452
- C:\Windows\System\oFiaHjT.exe
  C:\Windows\System\oFiaHjT.exe
  2⤵
  PID:9468
- C:\Windows\System\QSkLhAs.exe
  C:\Windows\System\QSkLhAs.exe
  2⤵
  PID:9484
- C:\Windows\System\UuGVuua.exe
  C:\Windows\System\UuGVuua.exe
  2⤵
  PID:9500
- C:\Windows\System\mXRIWGa.exe
  C:\Windows\System\mXRIWGa.exe
  2⤵
  PID:9516
- C:\Windows\System\LkurSeQ.exe
  C:\Windows\System\LkurSeQ.exe
  2⤵
  PID:9532
- C:\Windows\System\hGXfpyz.exe
  C:\Windows\System\hGXfpyz.exe
  2⤵
  PID:9548
- C:\Windows\System\YxozcMY.exe
  C:\Windows\System\YxozcMY.exe
  2⤵
  PID:9564
- C:\Windows\System\urksABm.exe
  C:\Windows\System\urksABm.exe
  2⤵
  PID:9580
- C:\Windows\System\kxMMaWw.exe
  C:\Windows\System\kxMMaWw.exe
  2⤵
  PID:9596
- C:\Windows\System\nmDOQMk.exe
  C:\Windows\System\nmDOQMk.exe
  2⤵
  PID:9612
- C:\Windows\System\LiacaZB.exe
  C:\Windows\System\LiacaZB.exe
  2⤵
  PID:9628
- C:\Windows\System\OemYjYb.exe
  C:\Windows\System\OemYjYb.exe
  2⤵
  PID:9644
- C:\Windows\System\yAemakJ.exe
  C:\Windows\System\yAemakJ.exe
  2⤵
  PID:9660
- C:\Windows\System\pJmkNFQ.exe
  C:\Windows\System\pJmkNFQ.exe
  2⤵
  PID:9676
- C:\Windows\System\gwqEQYl.exe
  C:\Windows\System\gwqEQYl.exe
  2⤵
  PID:9692
- C:\Windows\System\jPiTQcx.exe
  C:\Windows\System\jPiTQcx.exe
  2⤵
  PID:9708
- C:\Windows\System\NacgUeL.exe
  C:\Windows\System\NacgUeL.exe
  2⤵
  PID:9724
- C:\Windows\System\KOdJCiL.exe
  C:\Windows\System\KOdJCiL.exe
  2⤵
  PID:9740
- C:\Windows\System\ZYRkFSV.exe
  C:\Windows\System\ZYRkFSV.exe
  2⤵
  PID:9756
- C:\Windows\System\OuCPIBL.exe
  C:\Windows\System\OuCPIBL.exe
  2⤵
  PID:9772
- C:\Windows\System\xMLKhLO.exe
  C:\Windows\System\xMLKhLO.exe
  2⤵
  PID:9788
- C:\Windows\System\NbraUfr.exe
  C:\Windows\System\NbraUfr.exe
  2⤵
  PID:9804
- C:\Windows\System\dzxHgAF.exe
  C:\Windows\System\dzxHgAF.exe
  2⤵
  PID:9820
- C:\Windows\System\zqlWpTu.exe
  C:\Windows\System\zqlWpTu.exe
  2⤵
  PID:9836
- C:\Windows\System\SPSWeNX.exe
  C:\Windows\System\SPSWeNX.exe
  2⤵
  PID:9852
- C:\Windows\System\sNrOhDI.exe
  C:\Windows\System\sNrOhDI.exe
  2⤵
  PID:9868
- C:\Windows\System\QNzgAXT.exe
  C:\Windows\System\QNzgAXT.exe
  2⤵
  PID:9884
- C:\Windows\System\RWrUEKd.exe
  C:\Windows\System\RWrUEKd.exe
  2⤵
  PID:9900
- C:\Windows\System\ScPOHTn.exe
  C:\Windows\System\ScPOHTn.exe
  2⤵
  PID:9916
- C:\Windows\System\OszUayr.exe
  C:\Windows\System\OszUayr.exe
  2⤵
  PID:9932
- C:\Windows\System\fzndWnv.exe
  C:\Windows\System\fzndWnv.exe
  2⤵
  PID:9948
- C:\Windows\System\MRsZEiX.exe
  C:\Windows\System\MRsZEiX.exe
  2⤵
  PID:9964
- C:\Windows\System\OBPkJEO.exe
  C:\Windows\System\OBPkJEO.exe
  2⤵
  PID:9980
- C:\Windows\System\pmpEmRG.exe
  C:\Windows\System\pmpEmRG.exe
  2⤵
  PID:9996
- C:\Windows\System\UEXyWVa.exe
  C:\Windows\System\UEXyWVa.exe
  2⤵
  PID:10016
- C:\Windows\System\AmGTKlh.exe
  C:\Windows\System\AmGTKlh.exe
  2⤵
  PID:10032
- C:\Windows\System\cdiuUwq.exe
  C:\Windows\System\cdiuUwq.exe
  2⤵
  PID:10048
- C:\Windows\System\CEMvsPu.exe
  C:\Windows\System\CEMvsPu.exe
  2⤵
  PID:10064
- C:\Windows\System\pxnSFjZ.exe
  C:\Windows\System\pxnSFjZ.exe
  2⤵
  PID:10080
- C:\Windows\System\VPZptIh.exe
  C:\Windows\System\VPZptIh.exe
  2⤵
  PID:10096
- C:\Windows\System\zTynJZb.exe
  C:\Windows\System\zTynJZb.exe
  2⤵
  PID:10112
- C:\Windows\System\XjqGqWB.exe
  C:\Windows\System\XjqGqWB.exe
  2⤵
  PID:10128
- C:\Windows\System\NchwlhA.exe
  C:\Windows\System\NchwlhA.exe
  2⤵
  PID:10144
- C:\Windows\System\oOpPCTy.exe
  C:\Windows\System\oOpPCTy.exe
  2⤵
  PID:10160
- C:\Windows\System\hHRONWZ.exe
  C:\Windows\System\hHRONWZ.exe
  2⤵
  PID:10176
- C:\Windows\System\cSORTrQ.exe
  C:\Windows\System\cSORTrQ.exe
  2⤵
  PID:10192
- C:\Windows\System\pwvHFGW.exe
  C:\Windows\System\pwvHFGW.exe
  2⤵
  PID:10208
- C:\Windows\System\zmNfzYn.exe
  C:\Windows\System\zmNfzYn.exe
  2⤵
  PID:10224
- C:\Windows\System\DCdBofR.exe
  C:\Windows\System\DCdBofR.exe
  2⤵
  PID:9220
- C:\Windows\System\fSKSMGg.exe
  C:\Windows\System\fSKSMGg.exe
  2⤵
  PID:9048
- C:\Windows\System\gyXZFJI.exe
  C:\Windows\System\gyXZFJI.exe
  2⤵
  PID:8436
- C:\Windows\System\xBFxbgG.exe
  C:\Windows\System\xBFxbgG.exe
  2⤵
  PID:9284
- C:\Windows\System\neadwOm.exe
  C:\Windows\System\neadwOm.exe
  2⤵
  PID:9348
- C:\Windows\System\DVejBUT.exe
  C:\Windows\System\DVejBUT.exe
  2⤵
  PID:9124
- C:\Windows\System\vUVTgwe.exe
  C:\Windows\System\vUVTgwe.exe
  2⤵
  PID:9416
- C:\Windows\System\MOJAAPE.exe
  C:\Windows\System\MOJAAPE.exe
  2⤵
  PID:9476
- C:\Windows\System\IdTptRk.exe
  C:\Windows\System\IdTptRk.exe
  2⤵
  PID:9540
- C:\Windows\System\FJsJuEi.exe
  C:\Windows\System\FJsJuEi.exe
  2⤵
  PID:9604
- C:\Windows\System\aeFMgDb.exe
  C:\Windows\System\aeFMgDb.exe
  2⤵
  PID:9668
- C:\Windows\System\FnYBvga.exe
  C:\Windows\System\FnYBvga.exe
  2⤵
  PID:8336
- C:\Windows\System\DrykNyl.exe
  C:\Windows\System\DrykNyl.exe
  2⤵
  PID:9304
- C:\Windows\System\JJVLJlY.exe
  C:\Windows\System\JJVLJlY.exe
  2⤵
  PID:9336
- C:\Windows\System\MBsOIMt.exe
  C:\Windows\System\MBsOIMt.exe
  2⤵
  PID:9428
- C:\Windows\System\FlAncYz.exe
  C:\Windows\System\FlAncYz.exe
  2⤵
  PID:9796
- C:\Windows\System\AaSabOQ.exe
  C:\Windows\System\AaSabOQ.exe
  2⤵
  PID:9860
- C:\Windows\System\VgAbNgR.exe
  C:\Windows\System\VgAbNgR.exe
  2⤵
  PID:9924
- C:\Windows\System\llVEdvM.exe
  C:\Windows\System\llVEdvM.exe
  2⤵
  PID:8320
- C:\Windows\System\Wyopqxm.exe
  C:\Windows\System\Wyopqxm.exe
  2⤵
  PID:9960
- C:\Windows\System\AqAuSSJ.exe
  C:\Windows\System\AqAuSSJ.exe
  2⤵
  PID:9528
- C:\Windows\System\ccQAlPm.exe
  C:\Windows\System\ccQAlPm.exe
  2⤵
  PID:9268
- C:\Windows\System\fGstCOp.exe
  C:\Windows\System\fGstCOp.exe
  2⤵
  PID:9368
- C:\Windows\System\MsqyQZj.exe
  C:\Windows\System\MsqyQZj.exe
  2⤵
  PID:9880
- C:\Windows\System\Rwrfdfn.exe
  C:\Windows\System\Rwrfdfn.exe
  2⤵
  PID:9524
- C:\Windows\System\MdHSAXi.exe
  C:\Windows\System\MdHSAXi.exe
  2⤵
  PID:9620
- C:\Windows\System\ufjpVnB.exe
  C:\Windows\System\ufjpVnB.exe
  2⤵
  PID:9684
- C:\Windows\System\LaZXpUR.exe
  C:\Windows\System\LaZXpUR.exe
  2⤵
  PID:9752
- C:\Windows\System\rgZWXuf.exe
  C:\Windows\System\rgZWXuf.exe
  2⤵
  PID:9816
- C:\Windows\System\aTpWOaJ.exe
  C:\Windows\System\aTpWOaJ.exe
  2⤵
  PID:9912
- C:\Windows\System\WvgOPcP.exe
  C:\Windows\System\WvgOPcP.exe
  2⤵
  PID:10004
- C:\Windows\System\wMUYxgN.exe
  C:\Windows\System\wMUYxgN.exe
  2⤵
  PID:10056
- C:\Windows\System\vZaRlst.exe
  C:\Windows\System\vZaRlst.exe
  2⤵
  PID:10120
- C:\Windows\System\CqXeGwF.exe
  C:\Windows\System\CqXeGwF.exe
  2⤵
  PID:10040
- C:\Windows\System\JkgHrdh.exe
  C:\Windows\System\JkgHrdh.exe
  2⤵
  PID:10108
- C:\Windows\System\KyWlDeS.exe
  C:\Windows\System\KyWlDeS.exe
  2⤵
  PID:8704
- C:\Windows\System\aHBFywh.exe
  C:\Windows\System\aHBFywh.exe
  2⤵
  PID:10136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AvxDxjj.exe

Filesize
1.6MB

MD5
9dfb2526119ccd14f5beabce80a133eb

SHA1
a1207b63128dc08d0a5d962faaab32d997e18333

SHA256
5b6e308b3ee80a5feea430699f3c114941e842d0823cf00ac55bf994b9c1c11f

SHA512
b8297f84fb4a00d6dd04753eb56fd7a70c04272789c552c94cc7cbcc4a4bd83935c6584f57bee06cf1816d9311f95fbc46cac269a9e4ff44cf323313c7c7c316

Download Submit
C:\Windows\system\BHCoTwj.exe

Filesize
1.6MB

MD5
6c3f4dbf05406e0551b63f7018bda5e0

SHA1
39b30a0656da2177a8731180e3b6e6be80fa8b1e

SHA256
f982ed12a77dfc8e5c091344438ca254156c679c4d67bc5f714f8eb0aa7ed3ff

SHA512
557cc13905ba9981ae34757842c45b4859030df409e73f0e77f4b524b5858b8b2c2a9b3d2e4a29a310a47c652f0677f3683364d1abe889dabf98ac1bdfff9aa4

Download Submit
C:\Windows\system\DZEQUzW.exe

Filesize
1.6MB

MD5
d83984c6843f52414c396a41eb517a16

SHA1
f6561f5bb092709a45d90b2169184dbf749fae65

SHA256
905c3baf7697e236ef8b8f5f64a93668b315817aba623dd45b606b9b49ee3080

SHA512
97132a45582b96eb3f57afdc2df6a62d506863dc7b47ce79a93a2c314653dac2b695f4f211678e5d60d8450f05a51d41e0e8cbeb5605e9824845809fa7142948

Download Submit
C:\Windows\system\EfCSmia.exe

Filesize
1.6MB

MD5
8bc05a005b9c54ecdbb9a9ffb05a086c

SHA1
01294bff3f723c793242d19680af5b052841a09d

SHA256
950e6170e89496f22ba9275add73971920fbee03506a46fa74cfb6084926213c

SHA512
be2b3a34b21d94e8a0c0ce3dfec89f1b48262e4a8259b2f092b36dcac4c536bbe74c98eca991cbbc02f4404524da4404d817c8beb231c84932407cc084662ad9

Download Submit
C:\Windows\system\EgpWSVo.exe

Filesize
1.6MB

MD5
f3385f32dfdb724edadbf2161d9926c1

SHA1
2065e81dd6a81303d980c13bada3694c22810daa

SHA256
818bc26b327770b6d8b15daf9a7e02cdeee75856c8c991d6bc8305791bb79c7f

SHA512
5ec38f6e29d88ca91719e462cf95c6f56fe97f8b26f849bddbced4ec55deff0b35e6ede96be9e448220c264c2f1895d10921b4c0a663eacfdac01a2930d28b8c

Download Submit
C:\Windows\system\GdXDKgn.exe

Filesize
1.6MB

MD5
d8c0f165b0a381856706166b8ed5cd2f

SHA1
05a506976a161b6cf190a668b0e8635c2c568211

SHA256
6fb3918fa9f2f750e4fbce1afd7859930a75cee55709965951fed1bcf11e5188

SHA512
ed7f55b24752a2a56a784e12a5a1c2c1d76442683f06ccfd94facf6b19ca37445f8afdb99d7f15ca2b6e453fccc80d128c26c9d7b55799c1c5ce741c044917b5

Download Submit
C:\Windows\system\LOeMssE.exe

Filesize
1.6MB

MD5
6226eb9eb8311e2d4274ab031140861f

SHA1
420c0c565dc56a4e23eff9ec295ce2dfd6505c8e

SHA256
8b1cd583bd50bf1d46caf3f6224fdc9934a374007c9f36dcba0fe8455c6d931c

SHA512
13996aebb984e373420f1307f56bf28b76718168814dae60ca86e06efc1850a66b5c7fc69b2d5e73414e5b1b50b8df225ca31a9129e6e3637d38ca8fb74d77a4

Download Submit
C:\Windows\system\MCsOYGx.exe

Filesize
1.6MB

MD5
aae3ea7ae2516f1e698fa041672c86d4

SHA1
26bf9bffaa325050dc78b0599a316ebf624b92da

SHA256
1472d34a031ef4d83c54301a98c8c1e1fbca0424297bf1e003d196a8e27b262f

SHA512
38351944f0993ad218c538b7505f9fe352d8ac3b85b462a273856aed30ae36e1d33e28952b22ee9086017238be08e4d511aebaecc9a1147c201b6ce49fa7a170

Download Submit
C:\Windows\system\MvWHolu.exe

Filesize
1.6MB

MD5
f8a8b315e1c6756cc211570e8c93e5f4

SHA1
1a472576a507005ad9c1f10a4491033082b90b84

SHA256
05509fba0fb5801e94ff41fa14672a465cf727c1aa081a4d7f02af08dad04c9d

SHA512
7f5253115a2336becaa2d260ebdc70ed5bbf18da6047df316dfda3e887ea0f341c0273e0bf8f3f2d7669e8d6a0ade888641a3e84ae8f6ca6ddca59026ee84bbb

Download Submit
C:\Windows\system\NvmBvQd.exe

Filesize
1.6MB

MD5
c1a9cf23d09de3e3bd84a80760420492

SHA1
07969863046ca19456623ae6a765c2d16c78c07a

SHA256
eeea479b71ae3ebeae85dcee456cd9bebb07ae92ec1f3ac787dd00140b1351ac

SHA512
8598d3cd812173ee9fc12bb7ae2e646c161089caa0346a3eeb7a4dfb8214f6a28c776216f0aa92200a9155ba3e1d1ab809d4107a12f26aecd164337a11154422

Download Submit
C:\Windows\system\OTzlxBn.exe

Filesize
1.6MB

MD5
78b4d4e34c4d7b301420be40a44891a0

SHA1
32b5785d1a2c9bed32c9a624ff8e5b19e13da383

SHA256
a7fc4dad9fbb8a2f956f34e077d039061d2b9d29518b635ef76b9cb545550e4f

SHA512
d8f758091da173f7e11db51dbeb0fe3221f6cf8d83f028ff7f7c8c09b4310d0f4cffb282b5600f44da5b8547bae978fb640c0bdacccac3751855046ca5394f8b

Download Submit
C:\Windows\system\OglpWGS.exe

Filesize
1.6MB

MD5
17ac583fdcff2a0fc2cc64afb3fc72e8

SHA1
c33c6039f72b9a31161fcebafaf03195e8414df1

SHA256
1d636f920c1eb37f3bc8d335f4acbc9f39a9ecafa9b86cd4e169b9bdb5e3c9ad

SHA512
19e2dca075e0d8947aa55fc0caba2fb66909bc375aceb0c3099cec5060b74ae041046891a471165b0bef55a2fa6700a10c08231f08c1ed6ee77fbc50f26f93fd

Download Submit
C:\Windows\system\PJzNeYN.exe

Filesize
1.6MB

MD5
e32dd181ca8bf773b62cead2ccbd1f48

SHA1
596514ed324316a1ba9a7583afde2d501a0ef79e

SHA256
e09bd8b9b1b644480ac27c1e6665295741cdc7fdc52b30ecb651480b7abc9d51

SHA512
2fe62294e761b88e46e4eb187fa2d46eb21e2bea07a586b7f7d0e7fb232dcb623088fae3019f29ae4f5e1c435651c3da5912447a72bfe29bd76948c36793d6c0

Download Submit
C:\Windows\system\SlDLICS.exe

Filesize
1.6MB

MD5
ea5e1b3abd95115a9a0ae629079f97bc

SHA1
2c2640f73f6399175eae6d44bf840f27ae0b9382

SHA256
69db8753d938c179e581f624d22b5cf7184ec0a64e49b015d8d330b645d1ea68

SHA512
8fe73009e5662fc4b2a1e6bf1831f59f0318167906bf7e47aeb4075b77a730e91415899695b16e4b40a0456f313994a5d4bec560950546f7ccfcc2fc57b51e98

Download Submit
C:\Windows\system\UdXaBED.exe

Filesize
1.6MB

MD5
4ae6942ad7b4436694763abc43a3fc7b

SHA1
4797adae638ffd2ca46434f3b91dd24a410c1bb5

SHA256
b520f9672cf5f6d61a986f86ea4a0c0cde48ff4c26f101619f1aceabb5050871

SHA512
0a53bcfa53c94a3a7cc914905196ccf6912a6c4b6327b3275381c3d10526a2d27198c97102a3e67ded7d62d5cf6e3366d0d59dc3c88d7de55c2580d4e5c77682

Download Submit
C:\Windows\system\UmIsfdp.exe

Filesize
1.6MB

MD5
f8fa66626a00686aad849237c1d2cd07

SHA1
52c3d520518105e8a2d017107e1a85f253844b71

SHA256
e93019bd67374ca2c40d70570b86f34035f5b01ac21eeefed0256217cfee2bed

SHA512
36d3cb6076004904daedd94fb30a4ed634a1aa127a17858531e6077f299151ceab1e4289db38f1f2e70dbaa8d4da5872855f40e2e8f86bce6ce07ca03309f947

Download Submit
C:\Windows\system\VAyuROx.exe

Filesize
1.6MB

MD5
112b47b736741a0b899e530da790eb0d

SHA1
0d3f7dc2b9d02fd763296dec6da668b4f55b74af

SHA256
0280eb420f338d9597901f3470d31ffbb84ed73d14ead90ecf35e05a8ce9dd42

SHA512
7754e256e34aeb9122f4be1b8b3966bc5c21eb3b1ed4f09c1e299eba06d37b2d181dde4671bb27bd76d122726a80c5542503af49b15bff06dafe88ab33dcddad

Download Submit
C:\Windows\system\WJcrQST.exe

Filesize
1.6MB

MD5
d05c802d99cbb82a7d8b1c5ebe8e258f

SHA1
72edc35df82219c03cf979044d4bac8bc92c2310

SHA256
4b61c27185074ecfdf8bdf882ff48b15705810b773f9f51d6b3a188240dcb216

SHA512
fb462cdbcbb7668eaa8a309171fca42bed331169d32fd8f62efb630aba642fcd2647fba6ff5c92ca51f7212c8d2a442798c9808968e514743e250855d0ab14ae

Download Submit
C:\Windows\system\XiUEcer.exe

Filesize
1.6MB

MD5
61969f577160fcc3149619336381997f

SHA1
be43e8ae838f34173555da8554496dd6154a677c

SHA256
4fef40f642f297076cbe67b210da4a5094d4dd14e06b0bdeb8941d78dc53fbcf

SHA512
5a2e917e2a7e575c1b7b8d05d8a1e1560b183c343fb611c6d631fe2fe1a4a77330565af507a6b364053515c0b66f9934f75386db67df833dd2c271c064a8d11c

Download Submit
C:\Windows\system\bgPNwjj.exe

Filesize
1.6MB

MD5
121e743b1c2b21e6e58ba4472f0091da

SHA1
0563984612ccbefa66bee0fc9da5b5a57fe2b584

SHA256
4db0d71344c1ac2f1a483b7ace94124b7c12864aabc4b376c664023aaaced67e

SHA512
4d17bcb4ebb972347ae88f12d8a24dda2fbeb79f4392d00863309ccc8156c469c93b3b94cd9dc2e5fbbf563c0fb5fffe5390092f0af9e4724630c3eb9b4cea61

Download Submit
C:\Windows\system\dvVxVTr.exe

Filesize
1.6MB

MD5
16286eabff99f8c8a17e5d7698154f8f

SHA1
41732903cc04dc34abb9f0890e8804838c13b444

SHA256
8e5f89566249cf6ef7b41def1f43f3ee66138e010d052876388963e5533db839

SHA512
066e54680d02272c5f7317de3570d218bd96b97c755cf4f287b1cfdd6239983fc00f12bc33815eebb1b175c8717bffc56b421293edaa578349c5d1b3315827fe

Download Submit
C:\Windows\system\gdXTZNS.exe

Filesize
1.6MB

MD5
ff15a0ae7c4f161d615a574a7e8618fd

SHA1
69b9d6e19c4f7a2394a660fb36cacb83cb7de9fa

SHA256
3e0b4bf223fb8a4e6c5f6fc216bfe80e5a24a2ee4c21680f0bbe049711bce5de

SHA512
d27b24bb98c49b4731f8345f55a3d37c8a6a61e0390a4885cb7a4a79f57f705a71e0bb8f264bcf7c9cff77e9137f02d0bbe3e7cceb11506da385e55d8799ccb5

Download Submit
C:\Windows\system\hLPAyqe.exe

Filesize
1.6MB

MD5
79ac221a775f508e25a56c9d5af2f356

SHA1
6c5ef8473708c7013dfeb9997fadfe181ab211c1

SHA256
0d82f13c4610bd999c0c8f17f85a368bdad872deef88651cafa1dc63319b303f

SHA512
e39cccdde7b7a18fab2628d4a0c59d995ac87141dc562917e9cab45d52131d91e8008675a8561eb838fd0b27dac1be29e1a1d882b1770c3c6ff406650a858254

Download Submit
C:\Windows\system\heHpuzX.exe

Filesize
1.6MB

MD5
f16c599031e4d36dc6889b5311e2d6a7

SHA1
28dbef604ae93ce49935da795b6134999c995871

SHA256
23ae8472432fd8fae9dd0792a867662b07e8de50f131b511b55a0896e5b20a31

SHA512
9d0c708460a3754bbad0a721b11a2365dd95b4f837306937fc4284b93395ea78019d4a59b5bf28292555721414af54be5976792a6ca87896856c6d0a4e4758e0

Download Submit
C:\Windows\system\jMyPydL.exe

Filesize
1.6MB

MD5
30d2230f06b081bd1a53487f5891b166

SHA1
f1df07900ee39f883490a8d5742858980df85d2d

SHA256
4e35c6e28e365166b8ff33430982fff4f66429c835705d5c276e43ba3ba41e38

SHA512
c5b330ad280983e19676ffa0bb37c4a039de405b0ad9c8ee4585449d11c101f36dc1520db9b3c21f7d2edc7aa63b9ad780296a120d699a86b729d42b25fffed0

Download Submit
C:\Windows\system\kjIoSBX.exe

Filesize
1.6MB

MD5
e247f316b441607559d4b6ae25ab4804

SHA1
52a067d23e2739aab7fa4baac52bfbc493467b47

SHA256
1eebb22e365aca9c7117d13ce0d1da7b413bb96b551f90f3a5665a97280e9269

SHA512
04bf4b00850c09f6a8aaeabd380bfe898598144467ce705135621f86837edd9c43c9ce30e8aab50892cafdf1b3d3370f871a562dacbacb7306124869bac34fc6

Download Submit
C:\Windows\system\qvOunbQ.exe

Filesize
1.6MB

MD5
5c632a3c6e79aa5b7bd99459713b733f

SHA1
2de44b07d784d62386d23d2ac9996a81158531c4

SHA256
0af7bfc3f513ca9776dd61041413c8373f75e02f1c9dc62bc29a04968506d83b

SHA512
2f9e333e6d63637c272af1dc6884a880da547fe1da83c404a9aeb9199345730093cf81641c199b4e4b8a3ba8528a3f551c90356941d08e6f0dece9f90cc78b81

Download Submit
C:\Windows\system\tAFuDok.exe

Filesize
1.6MB

MD5
2a31c3295ae9a9a91e1d7e6c4ea409ab

SHA1
0dae85d5d28b6a9f00d60a8fee41ef62e7be1b4f

SHA256
d31ce7306efd68e0355bd5e37fe44eeb88ba0cd712e1b8818982b35a3a742643

SHA512
828d25f90a7481877d442f23725255b57cfcfa22266db00293ab3b38f2be5b1ee8790049d153b8f45dc97c3b761474d9f52133485eb9c8e9d1887dc8c68af779

Download Submit
C:\Windows\system\tjJlJqM.exe

Filesize
1.6MB

MD5
ba0279d035006afd3305ddd9bfd72167

SHA1
12e8b658efb6197256825d94a2d56215f16774c8

SHA256
67294a16f37112f892c4abb68bf6b3cd7705cb7a751187e82eda15c0be398086

SHA512
59c8c389f75edd5de025de6d04777b7067998208f3eeb89b489668f79bed55fd040a2c9030064b8309ddcd11ab83bc257773383ad133e9450a7ad300c0cfb41c

Download Submit
C:\Windows\system\udcsorW.exe

Filesize
1.6MB

MD5
29c74a407d201498c759f8da6115d224

SHA1
868fbb85efd0d680c03bc321aea0eec6db5e5efe

SHA256
553cb494c04b909f28ee56d9b1be78c80c0bec38ed2271eb16503a301af6dcb9

SHA512
6fedd6a57b05be9527a7448750faff34281e0a0919eec9c20a2906e7d65d40fdb5534f0b965d0958d963af7bc9ea765aecf125db79ca69d559723aa3c43cd055

Download Submit
C:\Windows\system\uuUvVxT.exe

Filesize
1.6MB

MD5
c4d4b021ad881791f0e854d732366726

SHA1
3bc11e590fdf1cab994a7d3043a25bbe7f6bd155

SHA256
4bc323f0c52ab536a7e8d9a5e8022c96703f93f8505acebc32b5b3550eafe13d

SHA512
1a003730f5a474fc53e1766350b732c79b2a7c900e2544702164ae5815f54380fbde445a72d29e40b9f4551199f056c0999a51587135c26780a8ad3fc9f0b355

Download Submit
C:\Windows\system\yWSAzSQ.exe

Filesize
1.6MB

MD5
568cb89421823377395f52e5b219f114

SHA1
30a9530a55d943dc71005e211fe5bc20de2ee897

SHA256
d53e8d427d7703bf779f2b3101f0fbfbbaf24eced6c841464f3f72f91f0c4685

SHA512
cf11ee1e62a12db814eb71e09eb68cc8352a16dcafaff1f96ea9f494f3c1dbc32fc9dc2f0e7bc9c4a0951c118453b4399888cd42ca59eb2b420b48af9e8ee4c7

Download Submit
memory/2008-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download