xmrig | d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
Size

1.5MB
MD5

ce2b49633b416f7b2bbb83226c09f4ff
SHA1

36b3f85d4016d23c716645219614519dff7e2de0
SHA256

d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9
SHA512

ddcbd2bb3d08a3c4e5b9ac552a5073fb53a02f4b4b0a7bdfcd5c85728a3c52b03ce0f11576aa06868df8554aad2ed746277010a1ac042edbc7423b25953c3b98
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3QjVwiPk:GemTLkNdfE0pZyf

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c000000012266-2.dat	xmrig
behavioral1/files/0x0008000000016cf0-9.dat	xmrig
behavioral1/files/0x0007000000016d0c-8.dat	xmrig
behavioral1/files/0x0007000000016d1c-17.dat	xmrig
behavioral1/files/0x000a000000016d2c-21.dat	xmrig
behavioral1/files/0x0009000000016d3f-24.dat	xmrig
behavioral1/files/0x0002000000018334-28.dat	xmrig
behavioral1/files/0x00050000000194ef-32.dat	xmrig
behavioral1/files/0x000500000001950f-37.dat	xmrig
behavioral1/files/0x000b000000016cab-49.dat	xmrig
behavioral1/files/0x0005000000019515-54.dat	xmrig
behavioral1/files/0x000500000001957c-64.dat	xmrig
behavioral1/files/0x00050000000195a9-75.dat	xmrig
behavioral1/files/0x00050000000195b7-107.dat	xmrig
behavioral1/files/0x00050000000195bd-119.dat	xmrig
behavioral1/files/0x00050000000195c3-129.dat	xmrig
behavioral1/files/0x000500000001975a-159.dat	xmrig
behavioral1/files/0x0005000000019643-154.dat	xmrig
behavioral1/files/0x000500000001960c-149.dat	xmrig
behavioral1/files/0x00050000000195c7-144.dat	xmrig
behavioral1/files/0x00050000000195c5-135.dat	xmrig
behavioral1/files/0x00050000000195c6-139.dat	xmrig
behavioral1/files/0x00050000000195c1-125.dat	xmrig
behavioral1/files/0x00050000000195bb-114.dat	xmrig
behavioral1/files/0x00050000000195b5-105.dat	xmrig
behavioral1/files/0x00050000000195b1-95.dat	xmrig
behavioral1/files/0x00050000000195b3-98.dat	xmrig
behavioral1/files/0x00050000000195ad-85.dat	xmrig
behavioral1/files/0x00050000000195af-88.dat	xmrig
behavioral1/files/0x00050000000195ab-79.dat	xmrig
behavioral1/files/0x00050000000195a7-69.dat	xmrig
behavioral1/files/0x0005000000019547-59.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2224	MdpIgob.exe
2424	vMXzYXs.exe
2420	liMUxGp.exe
2948	tLvajzK.exe
2036	lPhNEnx.exe
2160	yqabdLQ.exe
2964	acvKSkp.exe
2152	iMnnhxs.exe
3032	qULLkZZ.exe
2812	YyJPaCm.exe
2880	kYLiasc.exe
2564	KvIKMAU.exe
2540	wDZWbhb.exe
1944	QOXYIVl.exe
1872	hYIbWDD.exe
944	OanQJkn.exe
2332	HzSiOTp.exe
1516	AdwTBWF.exe
2132	VSHOwTn.exe
1436	MssZGDM.exe
1500	RgZbcjf.exe
2344	zLGFANI.exe
980	IljIlcw.exe
2676	NjLxoFa.exe
2348	AkZIbkO.exe
1028	WwtTjEj.exe
588	DEwsGdD.exe
2504	TNPplnw.exe
2508	rRTicbz.exe
520	odOsUuJ.exe
864	NVvxsPp.exe
2456	rUVisQq.exe
2472	uwJMLmJ.exe
1876	XsTwefB.exe
2064	eqgYLTs.exe
1716	BtCNumQ.exe
1164	mxcehQK.exe
756	wMUAhbV.exe
1868	nZSxoGB.exe
1080	PazzAgp.exe
1796	vOGCOwp.exe
1356	AzHVFAU.exe
1540	YxNZNGk.exe
2584	oAXmZsA.exe
2300	CtBXwsQ.exe
2520	IpXxoEe.exe
2440	bCMndJi.exe
1088	aKiMmOa.exe
2604	OhAzmgt.exe
2892	VZGPhKD.exe
576	ATiaiVb.exe
2172	RiiyXyl.exe
2140	POezjRt.exe
1748	SZyPitn.exe
892	ZgpCcki.exe
1528	AVxcRFr.exe
2188	PmJwZbG.exe
2236	OxOhUBo.exe
1620	qVaTqAa.exe
760	ctyOKzM.exe
2156	HEYCPVw.exe
2004	FCVgVTY.exe
3052	nmSuFwB.exe
2932	JaNvLXV.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bMUHrEn.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\TOLqvIR.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\geJSsnM.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\oRIkYxi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\pfkzybM.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\sSqsqTW.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\AuTuGeq.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\HEYCPVw.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\srPoXyE.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ATiaiVb.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\fohcjlY.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\IpXxoEe.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\mIoMngI.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\HlFIAUD.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\DHxPMhQ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\dFNvKPt.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\rHMCfmI.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\MerShfD.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\DsnuBSE.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\wMUAhbV.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\wtvVIuV.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\csfpNNY.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\NYhLLlx.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\qpOZRgM.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\LmqsYBv.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\gbdlUYt.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\OninQDZ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\XwccGIs.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\XqEcTZQ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\XDdqinp.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ZfPADIh.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ghvaeDj.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\jRJleEp.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\RUiMtDh.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\VRWdTCs.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\FjEBsCM.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\GdgtyhZ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\tfLqacF.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\tkYYpIg.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\TlkTlHy.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\gtcczze.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\NeAhvkN.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\nkevLed.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\jywRaRg.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ioHZeNn.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\JaNvLXV.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\QFGtcWd.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\kcQXXxi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\LznAMQR.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\qNEgigI.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\hzsstFx.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\NSCKdJe.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\EFCChth.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\YlDrYCw.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\GCmRvYp.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\iNSSjBp.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\meFBbVi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\kdRchhV.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ZLQqjrc.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\exmiTEP.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\yaKitoi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\TlVHsvr.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\tuEObNc.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ksExqLV.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2224	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	31
PID 1688 wrote to memory of 2224	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	31
PID 1688 wrote to memory of 2224	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	31
PID 1688 wrote to memory of 2424	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	32
PID 1688 wrote to memory of 2424	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	32
PID 1688 wrote to memory of 2424	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	32
PID 1688 wrote to memory of 2420	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	33
PID 1688 wrote to memory of 2420	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	33
PID 1688 wrote to memory of 2420	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	33
PID 1688 wrote to memory of 2948	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	34
PID 1688 wrote to memory of 2948	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	34
PID 1688 wrote to memory of 2948	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	34
PID 1688 wrote to memory of 2036	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	35
PID 1688 wrote to memory of 2036	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	35
PID 1688 wrote to memory of 2036	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	35
PID 1688 wrote to memory of 2160	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	36
PID 1688 wrote to memory of 2160	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	36
PID 1688 wrote to memory of 2160	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	36
PID 1688 wrote to memory of 2964	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	37
PID 1688 wrote to memory of 2964	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	37
PID 1688 wrote to memory of 2964	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	37
PID 1688 wrote to memory of 2152	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	38
PID 1688 wrote to memory of 2152	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	38
PID 1688 wrote to memory of 2152	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	38
PID 1688 wrote to memory of 3032	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	39
PID 1688 wrote to memory of 3032	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	39
PID 1688 wrote to memory of 3032	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	39
PID 1688 wrote to memory of 2812	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	40
PID 1688 wrote to memory of 2812	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	40
PID 1688 wrote to memory of 2812	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	40
PID 1688 wrote to memory of 2880	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	41
PID 1688 wrote to memory of 2880	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	41
PID 1688 wrote to memory of 2880	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	41
PID 1688 wrote to memory of 2564	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	42
PID 1688 wrote to memory of 2564	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	42
PID 1688 wrote to memory of 2564	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	42
PID 1688 wrote to memory of 2540	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	43
PID 1688 wrote to memory of 2540	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	43
PID 1688 wrote to memory of 2540	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	43
PID 1688 wrote to memory of 1944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	44
PID 1688 wrote to memory of 1944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	44
PID 1688 wrote to memory of 1944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	44
PID 1688 wrote to memory of 1872	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	45
PID 1688 wrote to memory of 1872	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	45
PID 1688 wrote to memory of 1872	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	45
PID 1688 wrote to memory of 944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	46
PID 1688 wrote to memory of 944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	46
PID 1688 wrote to memory of 944	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	46
PID 1688 wrote to memory of 2332	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	47
PID 1688 wrote to memory of 2332	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	47
PID 1688 wrote to memory of 2332	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	47
PID 1688 wrote to memory of 1516	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	48
PID 1688 wrote to memory of 1516	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	48
PID 1688 wrote to memory of 1516	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	48
PID 1688 wrote to memory of 2132	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	49
PID 1688 wrote to memory of 2132	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	49
PID 1688 wrote to memory of 2132	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	49
PID 1688 wrote to memory of 1436	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	50
PID 1688 wrote to memory of 1436	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	50
PID 1688 wrote to memory of 1436	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	50
PID 1688 wrote to memory of 1500	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	51
PID 1688 wrote to memory of 1500	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	51
PID 1688 wrote to memory of 1500	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	51
PID 1688 wrote to memory of 2344	1688	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	52

C:\Users\Admin\AppData\Local\Temp\d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
"C:\Users\Admin\AppData\Local\Temp\d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System\MdpIgob.exe
  C:\Windows\System\MdpIgob.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\vMXzYXs.exe
  C:\Windows\System\vMXzYXs.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\liMUxGp.exe
  C:\Windows\System\liMUxGp.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\tLvajzK.exe
  C:\Windows\System\tLvajzK.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\lPhNEnx.exe
  C:\Windows\System\lPhNEnx.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\yqabdLQ.exe
  C:\Windows\System\yqabdLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\acvKSkp.exe
  C:\Windows\System\acvKSkp.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\iMnnhxs.exe
  C:\Windows\System\iMnnhxs.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\qULLkZZ.exe
  C:\Windows\System\qULLkZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\YyJPaCm.exe
  C:\Windows\System\YyJPaCm.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\kYLiasc.exe
  C:\Windows\System\kYLiasc.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\KvIKMAU.exe
  C:\Windows\System\KvIKMAU.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wDZWbhb.exe
  C:\Windows\System\wDZWbhb.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\QOXYIVl.exe
  C:\Windows\System\QOXYIVl.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\hYIbWDD.exe
  C:\Windows\System\hYIbWDD.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\OanQJkn.exe
  C:\Windows\System\OanQJkn.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\HzSiOTp.exe
  C:\Windows\System\HzSiOTp.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\AdwTBWF.exe
  C:\Windows\System\AdwTBWF.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\VSHOwTn.exe
  C:\Windows\System\VSHOwTn.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\MssZGDM.exe
  C:\Windows\System\MssZGDM.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\RgZbcjf.exe
  C:\Windows\System\RgZbcjf.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\zLGFANI.exe
  C:\Windows\System\zLGFANI.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\IljIlcw.exe
  C:\Windows\System\IljIlcw.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\NjLxoFa.exe
  C:\Windows\System\NjLxoFa.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\AkZIbkO.exe
  C:\Windows\System\AkZIbkO.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\WwtTjEj.exe
  C:\Windows\System\WwtTjEj.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\DEwsGdD.exe
  C:\Windows\System\DEwsGdD.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\TNPplnw.exe
  C:\Windows\System\TNPplnw.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\rRTicbz.exe
  C:\Windows\System\rRTicbz.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\odOsUuJ.exe
  C:\Windows\System\odOsUuJ.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\NVvxsPp.exe
  C:\Windows\System\NVvxsPp.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\rUVisQq.exe
  C:\Windows\System\rUVisQq.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\uwJMLmJ.exe
  C:\Windows\System\uwJMLmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\XsTwefB.exe
  C:\Windows\System\XsTwefB.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\eqgYLTs.exe
  C:\Windows\System\eqgYLTs.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\BtCNumQ.exe
  C:\Windows\System\BtCNumQ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mxcehQK.exe
  C:\Windows\System\mxcehQK.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\wMUAhbV.exe
  C:\Windows\System\wMUAhbV.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\nZSxoGB.exe
  C:\Windows\System\nZSxoGB.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\PazzAgp.exe
  C:\Windows\System\PazzAgp.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\vOGCOwp.exe
  C:\Windows\System\vOGCOwp.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\AzHVFAU.exe
  C:\Windows\System\AzHVFAU.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\YxNZNGk.exe
  C:\Windows\System\YxNZNGk.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\oAXmZsA.exe
  C:\Windows\System\oAXmZsA.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\CtBXwsQ.exe
  C:\Windows\System\CtBXwsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\IpXxoEe.exe
  C:\Windows\System\IpXxoEe.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bCMndJi.exe
  C:\Windows\System\bCMndJi.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\aKiMmOa.exe
  C:\Windows\System\aKiMmOa.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\OhAzmgt.exe
  C:\Windows\System\OhAzmgt.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\VZGPhKD.exe
  C:\Windows\System\VZGPhKD.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ATiaiVb.exe
  C:\Windows\System\ATiaiVb.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\RiiyXyl.exe
  C:\Windows\System\RiiyXyl.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\POezjRt.exe
  C:\Windows\System\POezjRt.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\SZyPitn.exe
  C:\Windows\System\SZyPitn.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ZgpCcki.exe
  C:\Windows\System\ZgpCcki.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\AVxcRFr.exe
  C:\Windows\System\AVxcRFr.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\PmJwZbG.exe
  C:\Windows\System\PmJwZbG.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\OxOhUBo.exe
  C:\Windows\System\OxOhUBo.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\qVaTqAa.exe
  C:\Windows\System\qVaTqAa.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ctyOKzM.exe
  C:\Windows\System\ctyOKzM.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HEYCPVw.exe
  C:\Windows\System\HEYCPVw.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\FCVgVTY.exe
  C:\Windows\System\FCVgVTY.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\nmSuFwB.exe
  C:\Windows\System\nmSuFwB.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\JaNvLXV.exe
  C:\Windows\System\JaNvLXV.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\GKaDRQl.exe
  C:\Windows\System\GKaDRQl.exe
  2⤵
  PID:2824
- C:\Windows\System\jkcwmkZ.exe
  C:\Windows\System\jkcwmkZ.exe
  2⤵
  PID:2944
- C:\Windows\System\vTtybIN.exe
  C:\Windows\System\vTtybIN.exe
  2⤵
  PID:2920
- C:\Windows\System\TWXEhVP.exe
  C:\Windows\System\TWXEhVP.exe
  2⤵
  PID:2444
- C:\Windows\System\PNXEgNx.exe
  C:\Windows\System\PNXEgNx.exe
  2⤵
  PID:1968
- C:\Windows\System\PuHspvX.exe
  C:\Windows\System\PuHspvX.exe
  2⤵
  PID:1264
- C:\Windows\System\QwmasPk.exe
  C:\Windows\System\QwmasPk.exe
  2⤵
  PID:1492
- C:\Windows\System\zbeYveP.exe
  C:\Windows\System\zbeYveP.exe
  2⤵
  PID:1784
- C:\Windows\System\CQzVlwq.exe
  C:\Windows\System\CQzVlwq.exe
  2⤵
  PID:1952
- C:\Windows\System\xlxIxvx.exe
  C:\Windows\System\xlxIxvx.exe
  2⤵
  PID:2460
- C:\Windows\System\yaKitoi.exe
  C:\Windows\System\yaKitoi.exe
  2⤵
  PID:1780
- C:\Windows\System\XTGYxKr.exe
  C:\Windows\System\XTGYxKr.exe
  2⤵
  PID:2120
- C:\Windows\System\cAYHQLf.exe
  C:\Windows\System\cAYHQLf.exe
  2⤵
  PID:1348
- C:\Windows\System\bAymsEp.exe
  C:\Windows\System\bAymsEp.exe
  2⤵
  PID:1956
- C:\Windows\System\IWgICkG.exe
  C:\Windows\System\IWgICkG.exe
  2⤵
  PID:2212
- C:\Windows\System\QvKlCEl.exe
  C:\Windows\System\QvKlCEl.exe
  2⤵
  PID:2168
- C:\Windows\System\QYWxEvw.exe
  C:\Windows\System\QYWxEvw.exe
  2⤵
  PID:2436
- C:\Windows\System\dTHMGwh.exe
  C:\Windows\System\dTHMGwh.exe
  2⤵
  PID:2280
- C:\Windows\System\NmwyBpN.exe
  C:\Windows\System\NmwyBpN.exe
  2⤵
  PID:2408
- C:\Windows\System\aVkMOER.exe
  C:\Windows\System\aVkMOER.exe
  2⤵
  PID:900
- C:\Windows\System\zCcwWVi.exe
  C:\Windows\System\zCcwWVi.exe
  2⤵
  PID:2468
- C:\Windows\System\EkOdmCw.exe
  C:\Windows\System\EkOdmCw.exe
  2⤵
  PID:1320
- C:\Windows\System\NDWNNFB.exe
  C:\Windows\System\NDWNNFB.exe
  2⤵
  PID:1700
- C:\Windows\System\bTzaZQs.exe
  C:\Windows\System\bTzaZQs.exe
  2⤵
  PID:1564
- C:\Windows\System\MCimuBR.exe
  C:\Windows\System\MCimuBR.exe
  2⤵
  PID:2764
- C:\Windows\System\tCLNbmi.exe
  C:\Windows\System\tCLNbmi.exe
  2⤵
  PID:2072
- C:\Windows\System\bAVxGQV.exe
  C:\Windows\System\bAVxGQV.exe
  2⤵
  PID:1656
- C:\Windows\System\ECxccMx.exe
  C:\Windows\System\ECxccMx.exe
  2⤵
  PID:632
- C:\Windows\System\lkYyYFi.exe
  C:\Windows\System\lkYyYFi.exe
  2⤵
  PID:2056
- C:\Windows\System\PpBLuGo.exe
  C:\Windows\System\PpBLuGo.exe
  2⤵
  PID:544
- C:\Windows\System\ayaGqUG.exe
  C:\Windows\System\ayaGqUG.exe
  2⤵
  PID:2616
- C:\Windows\System\SWAyzhz.exe
  C:\Windows\System\SWAyzhz.exe
  2⤵
  PID:936
- C:\Windows\System\jwuEoNU.exe
  C:\Windows\System\jwuEoNU.exe
  2⤵
  PID:2288
- C:\Windows\System\kgyTAVM.exe
  C:\Windows\System\kgyTAVM.exe
  2⤵
  PID:1612
- C:\Windows\System\kLWkeaO.exe
  C:\Windows\System\kLWkeaO.exe
  2⤵
  PID:1616
- C:\Windows\System\DOWRfwS.exe
  C:\Windows\System\DOWRfwS.exe
  2⤵
  PID:2324
- C:\Windows\System\apmpFhC.exe
  C:\Windows\System\apmpFhC.exe
  2⤵
  PID:2828
- C:\Windows\System\hIxHBvh.exe
  C:\Windows\System\hIxHBvh.exe
  2⤵
  PID:2480
- C:\Windows\System\yajdQny.exe
  C:\Windows\System\yajdQny.exe
  2⤵
  PID:2252
- C:\Windows\System\IhXyWfh.exe
  C:\Windows\System\IhXyWfh.exe
  2⤵
  PID:2876
- C:\Windows\System\Vqgbdts.exe
  C:\Windows\System\Vqgbdts.exe
  2⤵
  PID:3004
- C:\Windows\System\WRVrcTW.exe
  C:\Windows\System\WRVrcTW.exe
  2⤵
  PID:984
- C:\Windows\System\DtbKTNx.exe
  C:\Windows\System\DtbKTNx.exe
  2⤵
  PID:2536
- C:\Windows\System\yULHYYG.exe
  C:\Windows\System\yULHYYG.exe
  2⤵
  PID:2316
- C:\Windows\System\CXVNWex.exe
  C:\Windows\System\CXVNWex.exe
  2⤵
  PID:2988
- C:\Windows\System\dQUfBIK.exe
  C:\Windows\System\dQUfBIK.exe
  2⤵
  PID:1408
- C:\Windows\System\drkSOdp.exe
  C:\Windows\System\drkSOdp.exe
  2⤵
  PID:2052
- C:\Windows\System\rhwOJNg.exe
  C:\Windows\System\rhwOJNg.exe
  2⤵
  PID:2548
- C:\Windows\System\dlnnogh.exe
  C:\Windows\System\dlnnogh.exe
  2⤵
  PID:2336
- C:\Windows\System\bjmqIJF.exe
  C:\Windows\System\bjmqIJF.exe
  2⤵
  PID:2428
- C:\Windows\System\xzAwDkb.exe
  C:\Windows\System\xzAwDkb.exe
  2⤵
  PID:1992
- C:\Windows\System\fqaXzzu.exe
  C:\Windows\System\fqaXzzu.exe
  2⤵
  PID:2776
- C:\Windows\System\fKDuRaD.exe
  C:\Windows\System\fKDuRaD.exe
  2⤵
  PID:1572
- C:\Windows\System\FZKJPVQ.exe
  C:\Windows\System\FZKJPVQ.exe
  2⤵
  PID:1996
- C:\Windows\System\QqyjDTR.exe
  C:\Windows\System\QqyjDTR.exe
  2⤵
  PID:1108
- C:\Windows\System\mhaojdU.exe
  C:\Windows\System\mhaojdU.exe
  2⤵
  PID:1308
- C:\Windows\System\JMXlWSX.exe
  C:\Windows\System\JMXlWSX.exe
  2⤵
  PID:2356
- C:\Windows\System\vNHMHXP.exe
  C:\Windows\System\vNHMHXP.exe
  2⤵
  PID:608
- C:\Windows\System\ofGkNxA.exe
  C:\Windows\System\ofGkNxA.exe
  2⤵
  PID:580
- C:\Windows\System\eaSZzBE.exe
  C:\Windows\System\eaSZzBE.exe
  2⤵
  PID:1232
- C:\Windows\System\AqmIEEC.exe
  C:\Windows\System\AqmIEEC.exe
  2⤵
  PID:2308
- C:\Windows\System\xjurlhy.exe
  C:\Windows\System\xjurlhy.exe
  2⤵
  PID:2452
- C:\Windows\System\jOUovhS.exe
  C:\Windows\System\jOUovhS.exe
  2⤵
  PID:2476
- C:\Windows\System\atOPpvC.exe
  C:\Windows\System\atOPpvC.exe
  2⤵
  PID:2952
- C:\Windows\System\GdnoCXg.exe
  C:\Windows\System\GdnoCXg.exe
  2⤵
  PID:2260
- C:\Windows\System\YofVVDp.exe
  C:\Windows\System\YofVVDp.exe
  2⤵
  PID:2904
- C:\Windows\System\hfABQBZ.exe
  C:\Windows\System\hfABQBZ.exe
  2⤵
  PID:1704
- C:\Windows\System\UOmBivx.exe
  C:\Windows\System\UOmBivx.exe
  2⤵
  PID:1236
- C:\Windows\System\wvTADQE.exe
  C:\Windows\System\wvTADQE.exe
  2⤵
  PID:3064
- C:\Windows\System\DcUkmfz.exe
  C:\Windows\System\DcUkmfz.exe
  2⤵
  PID:2484
- C:\Windows\System\EmFiTKc.exe
  C:\Windows\System\EmFiTKc.exe
  2⤵
  PID:2984
- C:\Windows\System\YZGiSNR.exe
  C:\Windows\System\YZGiSNR.exe
  2⤵
  PID:2512
- C:\Windows\System\FlnEuKf.exe
  C:\Windows\System\FlnEuKf.exe
  2⤵
  PID:2580
- C:\Windows\System\lBaemxy.exe
  C:\Windows\System\lBaemxy.exe
  2⤵
  PID:1016
- C:\Windows\System\gTbLDpW.exe
  C:\Windows\System\gTbLDpW.exe
  2⤵
  PID:2124
- C:\Windows\System\CDUFOBP.exe
  C:\Windows\System\CDUFOBP.exe
  2⤵
  PID:2176
- C:\Windows\System\NFRrKey.exe
  C:\Windows\System\NFRrKey.exe
  2⤵
  PID:2000
- C:\Windows\System\lMZTctr.exe
  C:\Windows\System\lMZTctr.exe
  2⤵
  PID:2568
- C:\Windows\System\aRokXYS.exe
  C:\Windows\System\aRokXYS.exe
  2⤵
  PID:2024
- C:\Windows\System\HoKfUTm.exe
  C:\Windows\System\HoKfUTm.exe
  2⤵
  PID:2008
- C:\Windows\System\mvdRzLd.exe
  C:\Windows\System\mvdRzLd.exe
  2⤵
  PID:1304
- C:\Windows\System\bkLGBod.exe
  C:\Windows\System\bkLGBod.exe
  2⤵
  PID:2628
- C:\Windows\System\aSqPnFS.exe
  C:\Windows\System\aSqPnFS.exe
  2⤵
  PID:2656
- C:\Windows\System\HQsbGhC.exe
  C:\Windows\System\HQsbGhC.exe
  2⤵
  PID:1692
- C:\Windows\System\cPYjDsA.exe
  C:\Windows\System\cPYjDsA.exe
  2⤵
  PID:2992
- C:\Windows\System\SvllLXO.exe
  C:\Windows\System\SvllLXO.exe
  2⤵
  PID:1588
- C:\Windows\System\ROwVGiT.exe
  C:\Windows\System\ROwVGiT.exe
  2⤵
  PID:1456
- C:\Windows\System\dagEYha.exe
  C:\Windows\System\dagEYha.exe
  2⤵
  PID:2016
- C:\Windows\System\qVBGWdx.exe
  C:\Windows\System\qVBGWdx.exe
  2⤵
  PID:2908
- C:\Windows\System\rDjYRjZ.exe
  C:\Windows\System\rDjYRjZ.exe
  2⤵
  PID:432
- C:\Windows\System\iLQjQHf.exe
  C:\Windows\System\iLQjQHf.exe
  2⤵
  PID:2240
- C:\Windows\System\WIylbYo.exe
  C:\Windows\System\WIylbYo.exe
  2⤵
  PID:624
- C:\Windows\System\uaCTiGm.exe
  C:\Windows\System\uaCTiGm.exe
  2⤵
  PID:2544
- C:\Windows\System\MvMFYGY.exe
  C:\Windows\System\MvMFYGY.exe
  2⤵
  PID:1764
- C:\Windows\System\WeBJchn.exe
  C:\Windows\System\WeBJchn.exe
  2⤵
  PID:2632
- C:\Windows\System\xvgjogq.exe
  C:\Windows\System\xvgjogq.exe
  2⤵
  PID:536
- C:\Windows\System\ymOCBEc.exe
  C:\Windows\System\ymOCBEc.exe
  2⤵
  PID:1828
- C:\Windows\System\YABKFUN.exe
  C:\Windows\System\YABKFUN.exe
  2⤵
  PID:1132
- C:\Windows\System\mcqlMzf.exe
  C:\Windows\System\mcqlMzf.exe
  2⤵
  PID:2524
- C:\Windows\System\ehsLgGV.exe
  C:\Windows\System\ehsLgGV.exe
  2⤵
  PID:3020
- C:\Windows\System\KswkqvR.exe
  C:\Windows\System\KswkqvR.exe
  2⤵
  PID:2384
- C:\Windows\System\rpBYumq.exe
  C:\Windows\System\rpBYumq.exe
  2⤵
  PID:1208
- C:\Windows\System\rRzwNQp.exe
  C:\Windows\System\rRzwNQp.exe
  2⤵
  PID:112
- C:\Windows\System\xTfaWzJ.exe
  C:\Windows\System\xTfaWzJ.exe
  2⤵
  PID:2644
- C:\Windows\System\NFRSxpA.exe
  C:\Windows\System\NFRSxpA.exe
  2⤵
  PID:2128
- C:\Windows\System\NeNxkgb.exe
  C:\Windows\System\NeNxkgb.exe
  2⤵
  PID:2740
- C:\Windows\System\jICPkVd.exe
  C:\Windows\System\jICPkVd.exe
  2⤵
  PID:2412
- C:\Windows\System\eFSondo.exe
  C:\Windows\System\eFSondo.exe
  2⤵
  PID:2136
- C:\Windows\System\HUmQdWK.exe
  C:\Windows\System\HUmQdWK.exe
  2⤵
  PID:2760
- C:\Windows\System\cpdHnMC.exe
  C:\Windows\System\cpdHnMC.exe
  2⤵
  PID:1316
- C:\Windows\System\FwfXrBy.exe
  C:\Windows\System\FwfXrBy.exe
  2⤵
  PID:2792
- C:\Windows\System\cMuEjCU.exe
  C:\Windows\System\cMuEjCU.exe
  2⤵
  PID:1740
- C:\Windows\System\XXCpXUu.exe
  C:\Windows\System\XXCpXUu.exe
  2⤵
  PID:2268
- C:\Windows\System\QUieAqW.exe
  C:\Windows\System\QUieAqW.exe
  2⤵
  PID:1548
- C:\Windows\System\OGCjzNS.exe
  C:\Windows\System\OGCjzNS.exe
  2⤵
  PID:3008
- C:\Windows\System\HfSXAYQ.exe
  C:\Windows\System\HfSXAYQ.exe
  2⤵
  PID:3092
- C:\Windows\System\DBWkNQR.exe
  C:\Windows\System\DBWkNQR.exe
  2⤵
  PID:3112
- C:\Windows\System\CSdlVWy.exe
  C:\Windows\System\CSdlVWy.exe
  2⤵
  PID:3128
- C:\Windows\System\NSCKdJe.exe
  C:\Windows\System\NSCKdJe.exe
  2⤵
  PID:3152
- C:\Windows\System\IgELneD.exe
  C:\Windows\System\IgELneD.exe
  2⤵
  PID:3168
- C:\Windows\System\QQYRwka.exe
  C:\Windows\System\QQYRwka.exe
  2⤵
  PID:3192
- C:\Windows\System\PQJzEad.exe
  C:\Windows\System\PQJzEad.exe
  2⤵
  PID:3208
- C:\Windows\System\WEUvrXB.exe
  C:\Windows\System\WEUvrXB.exe
  2⤵
  PID:3236
- C:\Windows\System\RJFZMkp.exe
  C:\Windows\System\RJFZMkp.exe
  2⤵
  PID:3256
- C:\Windows\System\CYkzvee.exe
  C:\Windows\System\CYkzvee.exe
  2⤵
  PID:3276
- C:\Windows\System\fduAdmN.exe
  C:\Windows\System\fduAdmN.exe
  2⤵
  PID:3296
- C:\Windows\System\CkmZhys.exe
  C:\Windows\System\CkmZhys.exe
  2⤵
  PID:3316
- C:\Windows\System\mwlVVIN.exe
  C:\Windows\System\mwlVVIN.exe
  2⤵
  PID:3336
- C:\Windows\System\AVLvUCw.exe
  C:\Windows\System\AVLvUCw.exe
  2⤵
  PID:3352
- C:\Windows\System\QUPDLXg.exe
  C:\Windows\System\QUPDLXg.exe
  2⤵
  PID:3368
- C:\Windows\System\vMwobrX.exe
  C:\Windows\System\vMwobrX.exe
  2⤵
  PID:3384
- C:\Windows\System\mIoMngI.exe
  C:\Windows\System\mIoMngI.exe
  2⤵
  PID:3400
- C:\Windows\System\igEXrtr.exe
  C:\Windows\System\igEXrtr.exe
  2⤵
  PID:3416
- C:\Windows\System\RQEKbep.exe
  C:\Windows\System\RQEKbep.exe
  2⤵
  PID:3432
- C:\Windows\System\bqWMidp.exe
  C:\Windows\System\bqWMidp.exe
  2⤵
  PID:3448
- C:\Windows\System\NLzYwKO.exe
  C:\Windows\System\NLzYwKO.exe
  2⤵
  PID:3496
- C:\Windows\System\qduTkYe.exe
  C:\Windows\System\qduTkYe.exe
  2⤵
  PID:3512
- C:\Windows\System\GYZlpMf.exe
  C:\Windows\System\GYZlpMf.exe
  2⤵
  PID:3532
- C:\Windows\System\GosRPEq.exe
  C:\Windows\System\GosRPEq.exe
  2⤵
  PID:3548
- C:\Windows\System\PtMoXLV.exe
  C:\Windows\System\PtMoXLV.exe
  2⤵
  PID:3568
- C:\Windows\System\tqDZrmR.exe
  C:\Windows\System\tqDZrmR.exe
  2⤵
  PID:3584
- C:\Windows\System\pKfHwfy.exe
  C:\Windows\System\pKfHwfy.exe
  2⤵
  PID:3600
- C:\Windows\System\BNfTQcg.exe
  C:\Windows\System\BNfTQcg.exe
  2⤵
  PID:3624
- C:\Windows\System\KlPJNWy.exe
  C:\Windows\System\KlPJNWy.exe
  2⤵
  PID:3648
- C:\Windows\System\PMrNJHq.exe
  C:\Windows\System\PMrNJHq.exe
  2⤵
  PID:3672
- C:\Windows\System\wBggzGY.exe
  C:\Windows\System\wBggzGY.exe
  2⤵
  PID:3692
- C:\Windows\System\wxVhHPW.exe
  C:\Windows\System\wxVhHPW.exe
  2⤵
  PID:3724
- C:\Windows\System\vAPwbhh.exe
  C:\Windows\System\vAPwbhh.exe
  2⤵
  PID:3744
- C:\Windows\System\mEhOHxh.exe
  C:\Windows\System\mEhOHxh.exe
  2⤵
  PID:3764
- C:\Windows\System\qvgSFHV.exe
  C:\Windows\System\qvgSFHV.exe
  2⤵
  PID:3784
- C:\Windows\System\vjqjWmG.exe
  C:\Windows\System\vjqjWmG.exe
  2⤵
  PID:3800
- C:\Windows\System\vlHetTb.exe
  C:\Windows\System\vlHetTb.exe
  2⤵
  PID:3820
- C:\Windows\System\DWzBtti.exe
  C:\Windows\System\DWzBtti.exe
  2⤵
  PID:3840
- C:\Windows\System\eYnQRpi.exe
  C:\Windows\System\eYnQRpi.exe
  2⤵
  PID:3860
- C:\Windows\System\yWsuNNX.exe
  C:\Windows\System\yWsuNNX.exe
  2⤵
  PID:3884
- C:\Windows\System\rPPZDIH.exe
  C:\Windows\System\rPPZDIH.exe
  2⤵
  PID:3900
- C:\Windows\System\YohFqoo.exe
  C:\Windows\System\YohFqoo.exe
  2⤵
  PID:3924
- C:\Windows\System\buGlCSN.exe
  C:\Windows\System\buGlCSN.exe
  2⤵
  PID:3940
- C:\Windows\System\ozCLyey.exe
  C:\Windows\System\ozCLyey.exe
  2⤵
  PID:3960
- C:\Windows\System\DoioXUl.exe
  C:\Windows\System\DoioXUl.exe
  2⤵
  PID:3980
- C:\Windows\System\nZFHCzh.exe
  C:\Windows\System\nZFHCzh.exe
  2⤵
  PID:4004
- C:\Windows\System\NEJLslq.exe
  C:\Windows\System\NEJLslq.exe
  2⤵
  PID:4020
- C:\Windows\System\owiykiL.exe
  C:\Windows\System\owiykiL.exe
  2⤵
  PID:4044
- C:\Windows\System\YuGMmvR.exe
  C:\Windows\System\YuGMmvR.exe
  2⤵
  PID:4060
- C:\Windows\System\mfHdyaK.exe
  C:\Windows\System\mfHdyaK.exe
  2⤵
  PID:4080
- C:\Windows\System\YHIHzZo.exe
  C:\Windows\System\YHIHzZo.exe
  2⤵
  PID:3080
- C:\Windows\System\HyKhJAk.exe
  C:\Windows\System\HyKhJAk.exe
  2⤵
  PID:3104
- C:\Windows\System\jFRudMH.exe
  C:\Windows\System\jFRudMH.exe
  2⤵
  PID:3140
- C:\Windows\System\PpBvUVt.exe
  C:\Windows\System\PpBvUVt.exe
  2⤵
  PID:3176
- C:\Windows\System\MvyYKev.exe
  C:\Windows\System\MvyYKev.exe
  2⤵
  PID:3204
- C:\Windows\System\vXatjTc.exe
  C:\Windows\System\vXatjTc.exe
  2⤵
  PID:3224
- C:\Windows\System\sEAGGMA.exe
  C:\Windows\System\sEAGGMA.exe
  2⤵
  PID:3268
- C:\Windows\System\zZsEDPK.exe
  C:\Windows\System\zZsEDPK.exe
  2⤵
  PID:3308
- C:\Windows\System\xYcvRjM.exe
  C:\Windows\System\xYcvRjM.exe
  2⤵
  PID:3348
- C:\Windows\System\kMafIkI.exe
  C:\Windows\System\kMafIkI.exe
  2⤵
  PID:3408
- C:\Windows\System\trWqCMc.exe
  C:\Windows\System\trWqCMc.exe
  2⤵
  PID:3392
- C:\Windows\System\WWMJdAw.exe
  C:\Windows\System\WWMJdAw.exe
  2⤵
  PID:3428
- C:\Windows\System\GsQuuIC.exe
  C:\Windows\System\GsQuuIC.exe
  2⤵
  PID:3476
- C:\Windows\System\PtmHcPw.exe
  C:\Windows\System\PtmHcPw.exe
  2⤵
  PID:3488
- C:\Windows\System\FiopgEL.exe
  C:\Windows\System\FiopgEL.exe
  2⤵
  PID:3544
- C:\Windows\System\fUpYjkt.exe
  C:\Windows\System\fUpYjkt.exe
  2⤵
  PID:3620
- C:\Windows\System\SmPwbWN.exe
  C:\Windows\System\SmPwbWN.exe
  2⤵
  PID:3668
- C:\Windows\System\gEVMwww.exe
  C:\Windows\System\gEVMwww.exe
  2⤵
  PID:3556
- C:\Windows\System\qHvEJNd.exe
  C:\Windows\System\qHvEJNd.exe
  2⤵
  PID:3700
- C:\Windows\System\ihwXepl.exe
  C:\Windows\System\ihwXepl.exe
  2⤵
  PID:3636
- C:\Windows\System\cPgQjPC.exe
  C:\Windows\System\cPgQjPC.exe
  2⤵
  PID:3756
- C:\Windows\System\IFKKGzJ.exe
  C:\Windows\System\IFKKGzJ.exe
  2⤵
  PID:3792
- C:\Windows\System\jajpCSL.exe
  C:\Windows\System\jajpCSL.exe
  2⤵
  PID:3836
- C:\Windows\System\nSgnNBi.exe
  C:\Windows\System\nSgnNBi.exe
  2⤵
  PID:3868
- C:\Windows\System\QlqIlMc.exe
  C:\Windows\System\QlqIlMc.exe
  2⤵
  PID:3880
- C:\Windows\System\nsLcrWc.exe
  C:\Windows\System\nsLcrWc.exe
  2⤵
  PID:3920
- C:\Windows\System\XiVGfTk.exe
  C:\Windows\System\XiVGfTk.exe
  2⤵
  PID:3956
- C:\Windows\System\knlGtYS.exe
  C:\Windows\System\knlGtYS.exe
  2⤵
  PID:3972
- C:\Windows\System\ZEchPEy.exe
  C:\Windows\System\ZEchPEy.exe
  2⤵
  PID:4016
- C:\Windows\System\RAYksaN.exe
  C:\Windows\System\RAYksaN.exe
  2⤵
  PID:4052
- C:\Windows\System\jjxitxR.exe
  C:\Windows\System\jjxitxR.exe
  2⤵
  PID:4072
- C:\Windows\System\YNSgyfs.exe
  C:\Windows\System\YNSgyfs.exe
  2⤵
  PID:3108
- C:\Windows\System\NObHTdQ.exe
  C:\Windows\System\NObHTdQ.exe
  2⤵
  PID:3164
- C:\Windows\System\PHLcsDv.exe
  C:\Windows\System\PHLcsDv.exe
  2⤵
  PID:3232
- C:\Windows\System\iFdubxi.exe
  C:\Windows\System\iFdubxi.exe
  2⤵
  PID:3272
- C:\Windows\System\iGsYqyG.exe
  C:\Windows\System\iGsYqyG.exe
  2⤵
  PID:3376
- C:\Windows\System\vXkAbhz.exe
  C:\Windows\System\vXkAbhz.exe
  2⤵
  PID:3608
- C:\Windows\System\wlvXNlV.exe
  C:\Windows\System\wlvXNlV.exe
  2⤵
  PID:3528
- C:\Windows\System\CJcSgBL.exe
  C:\Windows\System\CJcSgBL.exe
  2⤵
  PID:3472
- C:\Windows\System\yLuqpBe.exe
  C:\Windows\System\yLuqpBe.exe
  2⤵
  PID:3688
- C:\Windows\System\viEuEsS.exe
  C:\Windows\System\viEuEsS.exe
  2⤵
  PID:3508
- C:\Windows\System\qYAYBfK.exe
  C:\Windows\System\qYAYBfK.exe
  2⤵
  PID:3780
- C:\Windows\System\pOhUHES.exe
  C:\Windows\System\pOhUHES.exe
  2⤵
  PID:3896
- C:\Windows\System\NKtbzut.exe
  C:\Windows\System\NKtbzut.exe
  2⤵
  PID:3828
- C:\Windows\System\ilSeyVC.exe
  C:\Windows\System\ilSeyVC.exe
  2⤵
  PID:3720
- C:\Windows\System\BExDSmG.exe
  C:\Windows\System\BExDSmG.exe
  2⤵
  PID:4032
- C:\Windows\System\AyVjvdQ.exe
  C:\Windows\System\AyVjvdQ.exe
  2⤵
  PID:3088
- C:\Windows\System\AFjSQoR.exe
  C:\Windows\System\AFjSQoR.exe
  2⤵
  PID:4012
- C:\Windows\System\ZFOHrTR.exe
  C:\Windows\System\ZFOHrTR.exe
  2⤵
  PID:3144
- C:\Windows\System\TmedfSL.exe
  C:\Windows\System\TmedfSL.exe
  2⤵
  PID:3304
- C:\Windows\System\NEzJMzv.exe
  C:\Windows\System\NEzJMzv.exe
  2⤵
  PID:3380
- C:\Windows\System\KcpnFlI.exe
  C:\Windows\System\KcpnFlI.exe
  2⤵
  PID:3664
- C:\Windows\System\RxJFuYH.exe
  C:\Windows\System\RxJFuYH.exe
  2⤵
  PID:3612
- C:\Windows\System\yMhBPML.exe
  C:\Windows\System\yMhBPML.exe
  2⤵
  PID:3444
- C:\Windows\System\WlCYeMs.exe
  C:\Windows\System\WlCYeMs.exe
  2⤵
  PID:3540
- C:\Windows\System\pFdTggR.exe
  C:\Windows\System\pFdTggR.exe
  2⤵
  PID:3916
- C:\Windows\System\RHCgMdn.exe
  C:\Windows\System\RHCgMdn.exe
  2⤵
  PID:4000
- C:\Windows\System\AlDMwum.exe
  C:\Windows\System\AlDMwum.exe
  2⤵
  PID:3996
- C:\Windows\System\nMwqFez.exe
  C:\Windows\System\nMwqFez.exe
  2⤵
  PID:3228
- C:\Windows\System\jBrDsFL.exe
  C:\Windows\System\jBrDsFL.exe
  2⤵
  PID:3440
- C:\Windows\System\ZrzrdAW.exe
  C:\Windows\System\ZrzrdAW.exe
  2⤵
  PID:4056
- C:\Windows\System\anPVibK.exe
  C:\Windows\System\anPVibK.exe
  2⤵
  PID:4120
- C:\Windows\System\sgiLrgi.exe
  C:\Windows\System\sgiLrgi.exe
  2⤵
  PID:4140
- C:\Windows\System\JyoycHf.exe
  C:\Windows\System\JyoycHf.exe
  2⤵
  PID:4160
- C:\Windows\System\DkfdYkH.exe
  C:\Windows\System\DkfdYkH.exe
  2⤵
  PID:4208
- C:\Windows\System\kwoFiYt.exe
  C:\Windows\System\kwoFiYt.exe
  2⤵
  PID:4224
- C:\Windows\System\QbcTqsd.exe
  C:\Windows\System\QbcTqsd.exe
  2⤵
  PID:4240
- C:\Windows\System\fzhvAoo.exe
  C:\Windows\System\fzhvAoo.exe
  2⤵
  PID:4260
- C:\Windows\System\HvEILWq.exe
  C:\Windows\System\HvEILWq.exe
  2⤵
  PID:4280
- C:\Windows\System\TdsHwiz.exe
  C:\Windows\System\TdsHwiz.exe
  2⤵
  PID:4296
- C:\Windows\System\ZJJkywR.exe
  C:\Windows\System\ZJJkywR.exe
  2⤵
  PID:4312
- C:\Windows\System\IhMAXuJ.exe
  C:\Windows\System\IhMAXuJ.exe
  2⤵
  PID:4328
- C:\Windows\System\kMfwcCW.exe
  C:\Windows\System\kMfwcCW.exe
  2⤵
  PID:4348
- C:\Windows\System\gJvdxQz.exe
  C:\Windows\System\gJvdxQz.exe
  2⤵
  PID:4364
- C:\Windows\System\CtOCkVb.exe
  C:\Windows\System\CtOCkVb.exe
  2⤵
  PID:4424
- C:\Windows\System\ErRtozo.exe
  C:\Windows\System\ErRtozo.exe
  2⤵
  PID:4440
- C:\Windows\System\sgPfjUi.exe
  C:\Windows\System\sgPfjUi.exe
  2⤵
  PID:4456
- C:\Windows\System\xELLMfl.exe
  C:\Windows\System\xELLMfl.exe
  2⤵
  PID:4476
- C:\Windows\System\GjlypYc.exe
  C:\Windows\System\GjlypYc.exe
  2⤵
  PID:4496
- C:\Windows\System\HbykoCt.exe
  C:\Windows\System\HbykoCt.exe
  2⤵
  PID:4512
- C:\Windows\System\LOwudaS.exe
  C:\Windows\System\LOwudaS.exe
  2⤵
  PID:4528
- C:\Windows\System\dgPRvJL.exe
  C:\Windows\System\dgPRvJL.exe
  2⤵
  PID:4548
- C:\Windows\System\EdrRmmT.exe
  C:\Windows\System\EdrRmmT.exe
  2⤵
  PID:4576
- C:\Windows\System\mJncPHe.exe
  C:\Windows\System\mJncPHe.exe
  2⤵
  PID:4596
- C:\Windows\System\RFlMcxW.exe
  C:\Windows\System\RFlMcxW.exe
  2⤵
  PID:4616
- C:\Windows\System\CJuRwpo.exe
  C:\Windows\System\CJuRwpo.exe
  2⤵
  PID:4636
- C:\Windows\System\LAcPnnC.exe
  C:\Windows\System\LAcPnnC.exe
  2⤵
  PID:4656
- C:\Windows\System\xDQDcRN.exe
  C:\Windows\System\xDQDcRN.exe
  2⤵
  PID:4676
- C:\Windows\System\PLsqiZd.exe
  C:\Windows\System\PLsqiZd.exe
  2⤵
  PID:4692
- C:\Windows\System\aCTWNyM.exe
  C:\Windows\System\aCTWNyM.exe
  2⤵
  PID:4720
- C:\Windows\System\VVyhPgJ.exe
  C:\Windows\System\VVyhPgJ.exe
  2⤵
  PID:4736
- C:\Windows\System\bHrfrqc.exe
  C:\Windows\System\bHrfrqc.exe
  2⤵
  PID:4756
- C:\Windows\System\qXGhFQo.exe
  C:\Windows\System\qXGhFQo.exe
  2⤵
  PID:4776
- C:\Windows\System\jXmcPni.exe
  C:\Windows\System\jXmcPni.exe
  2⤵
  PID:4796
- C:\Windows\System\KQFjaiW.exe
  C:\Windows\System\KQFjaiW.exe
  2⤵
  PID:4820
- C:\Windows\System\ixtdnTY.exe
  C:\Windows\System\ixtdnTY.exe
  2⤵
  PID:4840
- C:\Windows\System\jhpSwbz.exe
  C:\Windows\System\jhpSwbz.exe
  2⤵
  PID:4860
- C:\Windows\System\CyrbLNq.exe
  C:\Windows\System\CyrbLNq.exe
  2⤵
  PID:4876
- C:\Windows\System\cOBthZZ.exe
  C:\Windows\System\cOBthZZ.exe
  2⤵
  PID:4900
- C:\Windows\System\HMVjbnn.exe
  C:\Windows\System\HMVjbnn.exe
  2⤵
  PID:4916
- C:\Windows\System\gNUQWwa.exe
  C:\Windows\System\gNUQWwa.exe
  2⤵
  PID:4936
- C:\Windows\System\GVzOxzL.exe
  C:\Windows\System\GVzOxzL.exe
  2⤵
  PID:4956
- C:\Windows\System\nfHPeyS.exe
  C:\Windows\System\nfHPeyS.exe
  2⤵
  PID:4976
- C:\Windows\System\TbyVeRP.exe
  C:\Windows\System\TbyVeRP.exe
  2⤵
  PID:4992
- C:\Windows\System\DrInoxD.exe
  C:\Windows\System\DrInoxD.exe
  2⤵
  PID:5016
- C:\Windows\System\Kspvaae.exe
  C:\Windows\System\Kspvaae.exe
  2⤵
  PID:5032
- C:\Windows\System\MqpDojA.exe
  C:\Windows\System\MqpDojA.exe
  2⤵
  PID:5048
- C:\Windows\System\KSFfiNl.exe
  C:\Windows\System\KSFfiNl.exe
  2⤵
  PID:5064
- C:\Windows\System\UxqusKr.exe
  C:\Windows\System\UxqusKr.exe
  2⤵
  PID:5092
- C:\Windows\System\yuixyGN.exe
  C:\Windows\System\yuixyGN.exe
  2⤵
  PID:5108
- C:\Windows\System\XWmSkwB.exe
  C:\Windows\System\XWmSkwB.exe
  2⤵
  PID:4116
- C:\Windows\System\KqjCHko.exe
  C:\Windows\System\KqjCHko.exe
  2⤵
  PID:4092
- C:\Windows\System\xVmWxaC.exe
  C:\Windows\System\xVmWxaC.exe
  2⤵
  PID:4040
- C:\Windows\System\ZWyxcKc.exe
  C:\Windows\System\ZWyxcKc.exe
  2⤵
  PID:3424
- C:\Windows\System\PObwWde.exe
  C:\Windows\System\PObwWde.exe
  2⤵
  PID:3560
- C:\Windows\System\TIqfdEr.exe
  C:\Windows\System\TIqfdEr.exe
  2⤵
  PID:3992
- C:\Windows\System\UpMqviT.exe
  C:\Windows\System\UpMqviT.exe
  2⤵
  PID:4188
- C:\Windows\System\CmrxwEG.exe
  C:\Windows\System\CmrxwEG.exe
  2⤵
  PID:4176
- C:\Windows\System\ezlVBPZ.exe
  C:\Windows\System\ezlVBPZ.exe
  2⤵
  PID:4252
- C:\Windows\System\bWKtQZV.exe
  C:\Windows\System\bWKtQZV.exe
  2⤵
  PID:4292
- C:\Windows\System\JBmmmDf.exe
  C:\Windows\System\JBmmmDf.exe
  2⤵
  PID:4360
- C:\Windows\System\aeGAOaK.exe
  C:\Windows\System\aeGAOaK.exe
  2⤵
  PID:4276
- C:\Windows\System\GskBoNl.exe
  C:\Windows\System\GskBoNl.exe
  2⤵
  PID:4372
- C:\Windows\System\cgNVJri.exe
  C:\Windows\System\cgNVJri.exe
  2⤵
  PID:4400
- C:\Windows\System\WSyVAMc.exe
  C:\Windows\System\WSyVAMc.exe
  2⤵
  PID:4416
- C:\Windows\System\xvufexs.exe
  C:\Windows\System\xvufexs.exe
  2⤵
  PID:4468
- C:\Windows\System\VcyxVow.exe
  C:\Windows\System\VcyxVow.exe
  2⤵
  PID:4508
- C:\Windows\System\iQZvbqb.exe
  C:\Windows\System\iQZvbqb.exe
  2⤵
  PID:4452
- C:\Windows\System\IWYCVLc.exe
  C:\Windows\System\IWYCVLc.exe
  2⤵
  PID:4520
- C:\Windows\System\MvOYvQz.exe
  C:\Windows\System\MvOYvQz.exe
  2⤵
  PID:4632
- C:\Windows\System\JooltIu.exe
  C:\Windows\System\JooltIu.exe
  2⤵
  PID:4524
- C:\Windows\System\tGfaYjH.exe
  C:\Windows\System\tGfaYjH.exe
  2⤵
  PID:4608
- C:\Windows\System\iPrUxUF.exe
  C:\Windows\System\iPrUxUF.exe
  2⤵
  PID:4712
- C:\Windows\System\PzSujfo.exe
  C:\Windows\System\PzSujfo.exe
  2⤵
  PID:4728
- C:\Windows\System\jnWwlbf.exe
  C:\Windows\System\jnWwlbf.exe
  2⤵
  PID:4752
- C:\Windows\System\JlcZxTX.exe
  C:\Windows\System\JlcZxTX.exe
  2⤵
  PID:4788
- C:\Windows\System\FKpxqda.exe
  C:\Windows\System\FKpxqda.exe
  2⤵
  PID:4804
- C:\Windows\System\DgzumiD.exe
  C:\Windows\System\DgzumiD.exe
  2⤵
  PID:4832
- C:\Windows\System\PHYhQml.exe
  C:\Windows\System\PHYhQml.exe
  2⤵
  PID:4908
- C:\Windows\System\YKlTetU.exe
  C:\Windows\System\YKlTetU.exe
  2⤵
  PID:4948
- C:\Windows\System\WYfthmZ.exe
  C:\Windows\System\WYfthmZ.exe
  2⤵
  PID:4892
- C:\Windows\System\yiYIxkN.exe
  C:\Windows\System\yiYIxkN.exe
  2⤵
  PID:4932
- C:\Windows\System\clKmZLh.exe
  C:\Windows\System\clKmZLh.exe
  2⤵
  PID:5012
- C:\Windows\System\vhgJWtc.exe
  C:\Windows\System\vhgJWtc.exe
  2⤵
  PID:5000
- C:\Windows\System\HJgfjJk.exe
  C:\Windows\System\HJgfjJk.exe
  2⤵
  PID:3596
- C:\Windows\System\YhkMWnn.exe
  C:\Windows\System\YhkMWnn.exe
  2⤵
  PID:3816
- C:\Windows\System\rfEnAIj.exe
  C:\Windows\System\rfEnAIj.exe
  2⤵
  PID:3948
- C:\Windows\System\YBJMFTc.exe
  C:\Windows\System\YBJMFTc.exe
  2⤵
  PID:3680
- C:\Windows\System\inmuXdh.exe
  C:\Windows\System\inmuXdh.exe
  2⤵
  PID:4288
- C:\Windows\System\wVGefBD.exe
  C:\Windows\System\wVGefBD.exe
  2⤵
  PID:4268
- C:\Windows\System\pMtwJEy.exe
  C:\Windows\System\pMtwJEy.exe
  2⤵
  PID:4388
- C:\Windows\System\rsOgFfH.exe
  C:\Windows\System\rsOgFfH.exe
  2⤵
  PID:4540
- C:\Windows\System\beRzetX.exe
  C:\Windows\System\beRzetX.exe
  2⤵
  PID:4628
- C:\Windows\System\rFbLTGV.exe
  C:\Windows\System\rFbLTGV.exe
  2⤵
  PID:4672
- C:\Windows\System\GSgoWqS.exe
  C:\Windows\System\GSgoWqS.exe
  2⤵
  PID:3200
- C:\Windows\System\jQwCgDw.exe
  C:\Windows\System\jQwCgDw.exe
  2⤵
  PID:4792
- C:\Windows\System\nmlIlZI.exe
  C:\Windows\System\nmlIlZI.exe
  2⤵
  PID:4324
- C:\Windows\System\uSKpYKq.exe
  C:\Windows\System\uSKpYKq.exe
  2⤵
  PID:4340
- C:\Windows\System\DPZGQCd.exe
  C:\Windows\System\DPZGQCd.exe
  2⤵
  PID:4592
- C:\Windows\System\oJpDmZw.exe
  C:\Windows\System\oJpDmZw.exe
  2⤵
  PID:4764
- C:\Windows\System\TKiZRKo.exe
  C:\Windows\System\TKiZRKo.exe
  2⤵
  PID:4380
- C:\Windows\System\mPRdiym.exe
  C:\Windows\System\mPRdiym.exe
  2⤵
  PID:4488
- C:\Windows\System\tnltBGA.exe
  C:\Windows\System\tnltBGA.exe
  2⤵
  PID:4924
- C:\Windows\System\OIRtNAl.exe
  C:\Windows\System\OIRtNAl.exe
  2⤵
  PID:4868
- C:\Windows\System\pjShsxM.exe
  C:\Windows\System\pjShsxM.exe
  2⤵
  PID:4872
- C:\Windows\System\wlMxbag.exe
  C:\Windows\System\wlMxbag.exe
  2⤵
  PID:4884
- C:\Windows\System\bOtKHTP.exe
  C:\Windows\System\bOtKHTP.exe
  2⤵
  PID:5088
- C:\Windows\System\HXLoRmu.exe
  C:\Windows\System\HXLoRmu.exe
  2⤵
  PID:3124
- C:\Windows\System\BSUWlJC.exe
  C:\Windows\System\BSUWlJC.exe
  2⤵
  PID:5084
- C:\Windows\System\sRJuopz.exe
  C:\Windows\System\sRJuopz.exe
  2⤵
  PID:3708
- C:\Windows\System\LJtEbDe.exe
  C:\Windows\System\LJtEbDe.exe
  2⤵
  PID:3460
- C:\Windows\System\NwJHAMS.exe
  C:\Windows\System\NwJHAMS.exe
  2⤵
  PID:4668
- C:\Windows\System\exmiTEP.exe
  C:\Windows\System\exmiTEP.exe
  2⤵
  PID:4220
- C:\Windows\System\owtwVdK.exe
  C:\Windows\System\owtwVdK.exe
  2⤵
  PID:4492
- C:\Windows\System\ZXqfRsj.exe
  C:\Windows\System\ZXqfRsj.exe
  2⤵
  PID:4808
- C:\Windows\System\sivDBeP.exe
  C:\Windows\System\sivDBeP.exe
  2⤵
  PID:1584
- C:\Windows\System\kmysLhI.exe
  C:\Windows\System\kmysLhI.exe
  2⤵
  PID:5028
- C:\Windows\System\FggrNpj.exe
  C:\Windows\System\FggrNpj.exe
  2⤵
  PID:4412
- C:\Windows\System\GAdEpgc.exe
  C:\Windows\System\GAdEpgc.exe
  2⤵
  PID:4988
- C:\Windows\System\aZqapqo.exe
  C:\Windows\System\aZqapqo.exe
  2⤵
  PID:4172
- C:\Windows\System\YdMQZdB.exe
  C:\Windows\System\YdMQZdB.exe
  2⤵
  PID:4624
- C:\Windows\System\DMrSOGz.exe
  C:\Windows\System\DMrSOGz.exe
  2⤵
  PID:4168
- C:\Windows\System\RAfllCk.exe
  C:\Windows\System\RAfllCk.exe
  2⤵
  PID:4108
- C:\Windows\System\Brkhzkl.exe
  C:\Windows\System\Brkhzkl.exe
  2⤵
  PID:4744
- C:\Windows\System\yxJWFCP.exe
  C:\Windows\System\yxJWFCP.exe
  2⤵
  PID:4812
- C:\Windows\System\agpKpiI.exe
  C:\Windows\System\agpKpiI.exe
  2⤵
  PID:4420
- C:\Windows\System\ZwodVit.exe
  C:\Windows\System\ZwodVit.exe
  2⤵
  PID:5056
- C:\Windows\System\jkpinMa.exe
  C:\Windows\System\jkpinMa.exe
  2⤵
  PID:4896
- C:\Windows\System\HJVTVKa.exe
  C:\Windows\System\HJVTVKa.exe
  2⤵
  PID:5024
- C:\Windows\System\LWanwEu.exe
  C:\Windows\System\LWanwEu.exe
  2⤵
  PID:4648
- C:\Windows\System\JCZSLAT.exe
  C:\Windows\System\JCZSLAT.exe
  2⤵
  PID:3660
- C:\Windows\System\maMxpzX.exe
  C:\Windows\System\maMxpzX.exe
  2⤵
  PID:4704
- C:\Windows\System\UBFaCdR.exe
  C:\Windows\System\UBFaCdR.exe
  2⤵
  PID:4944
- C:\Windows\System\ZZKNUry.exe
  C:\Windows\System\ZZKNUry.exe
  2⤵
  PID:4256
- C:\Windows\System\rJFLyfq.exe
  C:\Windows\System\rJFLyfq.exe
  2⤵
  PID:5140
- C:\Windows\System\CDlsUyQ.exe
  C:\Windows\System\CDlsUyQ.exe
  2⤵
  PID:5160
- C:\Windows\System\hjLhanW.exe
  C:\Windows\System\hjLhanW.exe
  2⤵
  PID:5176
- C:\Windows\System\EFCChth.exe
  C:\Windows\System\EFCChth.exe
  2⤵
  PID:5196
- C:\Windows\System\rflmhCC.exe
  C:\Windows\System\rflmhCC.exe
  2⤵
  PID:5236
- C:\Windows\System\WNyWpuo.exe
  C:\Windows\System\WNyWpuo.exe
  2⤵
  PID:5252
- C:\Windows\System\AqFAcnv.exe
  C:\Windows\System\AqFAcnv.exe
  2⤵
  PID:5268
- C:\Windows\System\UMbuXRo.exe
  C:\Windows\System\UMbuXRo.exe
  2⤵
  PID:5292
- C:\Windows\System\UlPaGOO.exe
  C:\Windows\System\UlPaGOO.exe
  2⤵
  PID:5308
- C:\Windows\System\OXpTZYi.exe
  C:\Windows\System\OXpTZYi.exe
  2⤵
  PID:5328
- C:\Windows\System\cwoLmta.exe
  C:\Windows\System\cwoLmta.exe
  2⤵
  PID:5348
- C:\Windows\System\vIHmxno.exe
  C:\Windows\System\vIHmxno.exe
  2⤵
  PID:5364
- C:\Windows\System\JVqIaCA.exe
  C:\Windows\System\JVqIaCA.exe
  2⤵
  PID:5400
- C:\Windows\System\LnTCTKe.exe
  C:\Windows\System\LnTCTKe.exe
  2⤵
  PID:5424
- C:\Windows\System\VVkadUm.exe
  C:\Windows\System\VVkadUm.exe
  2⤵
  PID:5444
- C:\Windows\System\pQgCtoI.exe
  C:\Windows\System\pQgCtoI.exe
  2⤵
  PID:5468
- C:\Windows\System\xNSNhAz.exe
  C:\Windows\System\xNSNhAz.exe
  2⤵
  PID:5484
- C:\Windows\System\wwPWDEf.exe
  C:\Windows\System\wwPWDEf.exe
  2⤵
  PID:5504
- C:\Windows\System\AtMIwzH.exe
  C:\Windows\System\AtMIwzH.exe
  2⤵
  PID:5524
- C:\Windows\System\yQIbleM.exe
  C:\Windows\System\yQIbleM.exe
  2⤵
  PID:5540
- C:\Windows\System\dhELytU.exe
  C:\Windows\System\dhELytU.exe
  2⤵
  PID:5560
- C:\Windows\System\JMJyFDA.exe
  C:\Windows\System\JMJyFDA.exe
  2⤵
  PID:5580
- C:\Windows\System\eDWnehT.exe
  C:\Windows\System\eDWnehT.exe
  2⤵
  PID:5600
- C:\Windows\System\audLmpA.exe
  C:\Windows\System\audLmpA.exe
  2⤵
  PID:5616
- C:\Windows\System\DYsXCSm.exe
  C:\Windows\System\DYsXCSm.exe
  2⤵
  PID:5632
- C:\Windows\System\ufcZWpl.exe
  C:\Windows\System\ufcZWpl.exe
  2⤵
  PID:5648
- C:\Windows\System\gMmtbgA.exe
  C:\Windows\System\gMmtbgA.exe
  2⤵
  PID:5688
- C:\Windows\System\opinHbp.exe
  C:\Windows\System\opinHbp.exe
  2⤵
  PID:5704
- C:\Windows\System\yjXIyiF.exe
  C:\Windows\System\yjXIyiF.exe
  2⤵
  PID:5720
- C:\Windows\System\itjWDMb.exe
  C:\Windows\System\itjWDMb.exe
  2⤵
  PID:5740
- C:\Windows\System\yAyBPDC.exe
  C:\Windows\System\yAyBPDC.exe
  2⤵
  PID:5756
- C:\Windows\System\NJneRXc.exe
  C:\Windows\System\NJneRXc.exe
  2⤵
  PID:5772
- C:\Windows\System\TYbuzaB.exe
  C:\Windows\System\TYbuzaB.exe
  2⤵
  PID:5792
- C:\Windows\System\gKoyrMU.exe
  C:\Windows\System\gKoyrMU.exe
  2⤵
  PID:5812
- C:\Windows\System\PIdyMPR.exe
  C:\Windows\System\PIdyMPR.exe
  2⤵
  PID:5828
- C:\Windows\System\ucCBwIE.exe
  C:\Windows\System\ucCBwIE.exe
  2⤵
  PID:5848
- C:\Windows\System\gnOQNMZ.exe
  C:\Windows\System\gnOQNMZ.exe
  2⤵
  PID:5868
- C:\Windows\System\AyRMSpF.exe
  C:\Windows\System\AyRMSpF.exe
  2⤵
  PID:5884
- C:\Windows\System\WGWxVlh.exe
  C:\Windows\System\WGWxVlh.exe
  2⤵
  PID:5916
- C:\Windows\System\rkJHJPg.exe
  C:\Windows\System\rkJHJPg.exe
  2⤵
  PID:5932
- C:\Windows\System\vBjIYOm.exe
  C:\Windows\System\vBjIYOm.exe
  2⤵
  PID:5960
- C:\Windows\System\abMJzKg.exe
  C:\Windows\System\abMJzKg.exe
  2⤵
  PID:5980
- C:\Windows\System\kkAORQm.exe
  C:\Windows\System\kkAORQm.exe
  2⤵
  PID:6004
- C:\Windows\System\JuEMesv.exe
  C:\Windows\System\JuEMesv.exe
  2⤵
  PID:6020
- C:\Windows\System\oJlCueK.exe
  C:\Windows\System\oJlCueK.exe
  2⤵
  PID:6044
- C:\Windows\System\rlRJAmU.exe
  C:\Windows\System\rlRJAmU.exe
  2⤵
  PID:6060
- C:\Windows\System\dBpINsn.exe
  C:\Windows\System\dBpINsn.exe
  2⤵
  PID:6080
- C:\Windows\System\XYKAGMP.exe
  C:\Windows\System\XYKAGMP.exe
  2⤵
  PID:6096
- C:\Windows\System\NeAhvkN.exe
  C:\Windows\System\NeAhvkN.exe
  2⤵
  PID:6112
- C:\Windows\System\fctbFtR.exe
  C:\Windows\System\fctbFtR.exe
  2⤵
  PID:6136
- C:\Windows\System\fUVeFRL.exe
  C:\Windows\System\fUVeFRL.exe
  2⤵
  PID:5148
- C:\Windows\System\fxLDXCc.exe
  C:\Windows\System\fxLDXCc.exe
  2⤵
  PID:5192
- C:\Windows\System\OysMMso.exe
  C:\Windows\System\OysMMso.exe
  2⤵
  PID:4984
- C:\Windows\System\fPAdHlE.exe
  C:\Windows\System\fPAdHlE.exe
  2⤵
  PID:5208
- C:\Windows\System\mHIRngN.exe
  C:\Windows\System\mHIRngN.exe
  2⤵
  PID:5228
- C:\Windows\System\YHvOvNU.exe
  C:\Windows\System\YHvOvNU.exe
  2⤵
  PID:5224
- C:\Windows\System\MnqUpRd.exe
  C:\Windows\System\MnqUpRd.exe
  2⤵
  PID:5284
- C:\Windows\System\ZNZSBRs.exe
  C:\Windows\System\ZNZSBRs.exe
  2⤵
  PID:5324
- C:\Windows\System\gTSuIFT.exe
  C:\Windows\System\gTSuIFT.exe
  2⤵
  PID:5372
- C:\Windows\System\WIefxuT.exe
  C:\Windows\System\WIefxuT.exe
  2⤵
  PID:5412
- C:\Windows\System\clLxVob.exe
  C:\Windows\System\clLxVob.exe
  2⤵
  PID:5388
- C:\Windows\System\CTAcKdJ.exe
  C:\Windows\System\CTAcKdJ.exe
  2⤵
  PID:5432
- C:\Windows\System\tLFwLOo.exe
  C:\Windows\System\tLFwLOo.exe
  2⤵
  PID:5460
- C:\Windows\System\psWAyiW.exe
  C:\Windows\System\psWAyiW.exe
  2⤵
  PID:5480
- C:\Windows\System\xhXOhzZ.exe
  C:\Windows\System\xhXOhzZ.exe
  2⤵
  PID:5516
- C:\Windows\System\hBGAgkO.exe
  C:\Windows\System\hBGAgkO.exe
  2⤵
  PID:5608
- C:\Windows\System\FXUHdYv.exe
  C:\Windows\System\FXUHdYv.exe
  2⤵
  PID:5552
- C:\Windows\System\kSiKgaN.exe
  C:\Windows\System\kSiKgaN.exe
  2⤵
  PID:5624
- C:\Windows\System\uBgMAAK.exe
  C:\Windows\System\uBgMAAK.exe
  2⤵
  PID:5680
- C:\Windows\System\PklRDKB.exe
  C:\Windows\System\PklRDKB.exe
  2⤵
  PID:5696
- C:\Windows\System\azVZrVN.exe
  C:\Windows\System\azVZrVN.exe
  2⤵
  PID:5732
- C:\Windows\System\TmGwNrb.exe
  C:\Windows\System\TmGwNrb.exe
  2⤵
  PID:5808
- C:\Windows\System\OyXfaXe.exe
  C:\Windows\System\OyXfaXe.exe
  2⤵
  PID:5716
- C:\Windows\System\ylnbkmU.exe
  C:\Windows\System\ylnbkmU.exe
  2⤵
  PID:5780
- C:\Windows\System\mPWSlWv.exe
  C:\Windows\System\mPWSlWv.exe
  2⤵
  PID:5856
- C:\Windows\System\hKAAnAX.exe
  C:\Windows\System\hKAAnAX.exe
  2⤵
  PID:5900
- C:\Windows\System\LvdZbBT.exe
  C:\Windows\System\LvdZbBT.exe
  2⤵
  PID:5820
- C:\Windows\System\zsfIZYD.exe
  C:\Windows\System\zsfIZYD.exe
  2⤵
  PID:5972
- C:\Windows\System\ViCgHCm.exe
  C:\Windows\System\ViCgHCm.exe
  2⤵
  PID:6092
- C:\Windows\System\sYjKptK.exe
  C:\Windows\System\sYjKptK.exe
  2⤵
  PID:6132
- C:\Windows\System\AyOcnRS.exe
  C:\Windows\System\AyOcnRS.exe
  2⤵
  PID:5276
- C:\Windows\System\eErbtkv.exe
  C:\Windows\System\eErbtkv.exe
  2⤵
  PID:5168
- C:\Windows\System\NOQbsqx.exe
  C:\Windows\System\NOQbsqx.exe
  2⤵
  PID:6032
- C:\Windows\System\hTPoVgJ.exe
  C:\Windows\System\hTPoVgJ.exe
  2⤵
  PID:6072
- C:\Windows\System\DEDJIta.exe
  C:\Windows\System\DEDJIta.exe
  2⤵
  PID:5320
- C:\Windows\System\fohcjlY.exe
  C:\Windows\System\fohcjlY.exe
  2⤵
  PID:4856
- C:\Windows\System\Tmmxztb.exe
  C:\Windows\System\Tmmxztb.exe
  2⤵
  PID:4436
- C:\Windows\System\UoHJUEw.exe
  C:\Windows\System\UoHJUEw.exe
  2⤵
  PID:4572
- C:\Windows\System\ZNAQZTR.exe
  C:\Windows\System\ZNAQZTR.exe
  2⤵
  PID:5340
- C:\Windows\System\CbnCAuH.exe
  C:\Windows\System\CbnCAuH.exe
  2⤵
  PID:964
- C:\Windows\System\ZCfWEoS.exe
  C:\Windows\System\ZCfWEoS.exe
  2⤵
  PID:5456
- C:\Windows\System\LDbCVtj.exe
  C:\Windows\System\LDbCVtj.exe
  2⤵
  PID:5452
- C:\Windows\System\ThxcgOO.exe
  C:\Windows\System\ThxcgOO.exe
  2⤵
  PID:5572
- C:\Windows\System\lVhlGBJ.exe
  C:\Windows\System\lVhlGBJ.exe
  2⤵
  PID:5512
- C:\Windows\System\ycNRUVZ.exe
  C:\Windows\System\ycNRUVZ.exe
  2⤵
  PID:5628
- C:\Windows\System\aBNpxwK.exe
  C:\Windows\System\aBNpxwK.exe
  2⤵
  PID:5668
- C:\Windows\System\sQazzra.exe
  C:\Windows\System\sQazzra.exe
  2⤵
  PID:5800
- C:\Windows\System\sZamZcd.exe
  C:\Windows\System\sZamZcd.exe
  2⤵
  PID:5840
- C:\Windows\System\cKVASLZ.exe
  C:\Windows\System\cKVASLZ.exe
  2⤵
  PID:5864
- C:\Windows\System\ZfSKKjD.exe
  C:\Windows\System\ZfSKKjD.exe
  2⤵
  PID:6056
- C:\Windows\System\AhDBXYD.exe
  C:\Windows\System\AhDBXYD.exe
  2⤵
  PID:5944
- C:\Windows\System\ulEwaan.exe
  C:\Windows\System\ulEwaan.exe
  2⤵
  PID:5132
- C:\Windows\System\wYvaKdK.exe
  C:\Windows\System\wYvaKdK.exe
  2⤵
  PID:5248
- C:\Windows\System\hlfTrVT.exe
  C:\Windows\System\hlfTrVT.exe
  2⤵
  PID:6000
- C:\Windows\System\yoRiHmO.exe
  C:\Windows\System\yoRiHmO.exe
  2⤵
  PID:5380
- C:\Windows\System\OIeFWvv.exe
  C:\Windows\System\OIeFWvv.exe
  2⤵
  PID:5212
- C:\Windows\System\yrWXFCd.exe
  C:\Windows\System\yrWXFCd.exe
  2⤵
  PID:1288
- C:\Windows\System\HzdRhST.exe
  C:\Windows\System\HzdRhST.exe
  2⤵
  PID:5076
- C:\Windows\System\OScIbBC.exe
  C:\Windows\System\OScIbBC.exe
  2⤵
  PID:5588
- C:\Windows\System\hMnrSfV.exe
  C:\Windows\System\hMnrSfV.exe
  2⤵
  PID:5712
- C:\Windows\System\YlDrYCw.exe
  C:\Windows\System\YlDrYCw.exe
  2⤵
  PID:6052
- C:\Windows\System\gZPIUKb.exe
  C:\Windows\System\gZPIUKb.exe
  2⤵
  PID:5136
- C:\Windows\System\fXIGyPW.exe
  C:\Windows\System\fXIGyPW.exe
  2⤵
  PID:5568
- C:\Windows\System\WZvbtbQ.exe
  C:\Windows\System\WZvbtbQ.exe
  2⤵
  PID:5556
- C:\Windows\System\WLbJsTc.exe
  C:\Windows\System\WLbJsTc.exe
  2⤵
  PID:5880
- C:\Windows\System\AeRpaQd.exe
  C:\Windows\System\AeRpaQd.exe
  2⤵
  PID:5188
- C:\Windows\System\eqQxoDB.exe
  C:\Windows\System\eqQxoDB.exe
  2⤵
  PID:5996
- C:\Windows\System\RbFhWnd.exe
  C:\Windows\System\RbFhWnd.exe
  2⤵
  PID:5316
- C:\Windows\System\YTVrepY.exe
  C:\Windows\System\YTVrepY.exe
  2⤵
  PID:5408
- C:\Windows\System\FMgyScE.exe
  C:\Windows\System\FMgyScE.exe
  2⤵
  PID:5912
- C:\Windows\System\UyhRTdX.exe
  C:\Windows\System\UyhRTdX.exe
  2⤵
  PID:5896
- C:\Windows\System\Fdokrqu.exe
  C:\Windows\System\Fdokrqu.exe
  2⤵
  PID:5060
- C:\Windows\System\BJAxOfE.exe
  C:\Windows\System\BJAxOfE.exe
  2⤵
  PID:5924
- C:\Windows\System\ReAzjBu.exe
  C:\Windows\System\ReAzjBu.exe
  2⤵
  PID:5336
- C:\Windows\System\INZXfnR.exe
  C:\Windows\System\INZXfnR.exe
  2⤵
  PID:5220
- C:\Windows\System\DVFAMYC.exe
  C:\Windows\System\DVFAMYC.exe
  2⤵
  PID:5956
- C:\Windows\System\JxkEhvz.exe
  C:\Windows\System\JxkEhvz.exe
  2⤵
  PID:2500
- C:\Windows\System\bMUHrEn.exe
  C:\Windows\System\bMUHrEn.exe
  2⤵
  PID:5216
- C:\Windows\System\SNfpOhX.exe
  C:\Windows\System\SNfpOhX.exe
  2⤵
  PID:5940
- C:\Windows\System\FaODYqJ.exe
  C:\Windows\System\FaODYqJ.exe
  2⤵
  PID:6160
- C:\Windows\System\guHRGbr.exe
  C:\Windows\System\guHRGbr.exe
  2⤵
  PID:6176
- C:\Windows\System\ZrszqUE.exe
  C:\Windows\System\ZrszqUE.exe
  2⤵
  PID:6212
- C:\Windows\System\DMSMoaI.exe
  C:\Windows\System\DMSMoaI.exe
  2⤵
  PID:6236
- C:\Windows\System\kjEbrTo.exe
  C:\Windows\System\kjEbrTo.exe
  2⤵
  PID:6256
- C:\Windows\System\JCQSymg.exe
  C:\Windows\System\JCQSymg.exe
  2⤵
  PID:6272
- C:\Windows\System\IxQJbUW.exe
  C:\Windows\System\IxQJbUW.exe
  2⤵
  PID:6288
- C:\Windows\System\cKFlUma.exe
  C:\Windows\System\cKFlUma.exe
  2⤵
  PID:6308
- C:\Windows\System\FklwbLI.exe
  C:\Windows\System\FklwbLI.exe
  2⤵
  PID:6328
- C:\Windows\System\gytqOMf.exe
  C:\Windows\System\gytqOMf.exe
  2⤵
  PID:6348
- C:\Windows\System\XPVXTWM.exe
  C:\Windows\System\XPVXTWM.exe
  2⤵
  PID:6364
- C:\Windows\System\AOXskfc.exe
  C:\Windows\System\AOXskfc.exe
  2⤵
  PID:6380
- C:\Windows\System\cdpWKYb.exe
  C:\Windows\System\cdpWKYb.exe
  2⤵
  PID:6400
- C:\Windows\System\nSgUCET.exe
  C:\Windows\System\nSgUCET.exe
  2⤵
  PID:6420
- C:\Windows\System\uiyxoJW.exe
  C:\Windows\System\uiyxoJW.exe
  2⤵
  PID:6444
- C:\Windows\System\njjjsVg.exe
  C:\Windows\System\njjjsVg.exe
  2⤵
  PID:6460
- C:\Windows\System\ihnaIUg.exe
  C:\Windows\System\ihnaIUg.exe
  2⤵
  PID:6480
- C:\Windows\System\TPluBvy.exe
  C:\Windows\System\TPluBvy.exe
  2⤵
  PID:6504
- C:\Windows\System\rGTyzwc.exe
  C:\Windows\System\rGTyzwc.exe
  2⤵
  PID:6528
- C:\Windows\System\XNgpWde.exe
  C:\Windows\System\XNgpWde.exe
  2⤵
  PID:6544
- C:\Windows\System\tEmbikn.exe
  C:\Windows\System\tEmbikn.exe
  2⤵
  PID:6564
- C:\Windows\System\aiZSYQk.exe
  C:\Windows\System\aiZSYQk.exe
  2⤵
  PID:6580
- C:\Windows\System\PgnNjfs.exe
  C:\Windows\System\PgnNjfs.exe
  2⤵
  PID:6600
- C:\Windows\System\iBqBiLr.exe
  C:\Windows\System\iBqBiLr.exe
  2⤵
  PID:6624
- C:\Windows\System\lJqZiqW.exe
  C:\Windows\System\lJqZiqW.exe
  2⤵
  PID:6648
- C:\Windows\System\mIiISik.exe
  C:\Windows\System\mIiISik.exe
  2⤵
  PID:6668
- C:\Windows\System\SVOQEpY.exe
  C:\Windows\System\SVOQEpY.exe
  2⤵
  PID:6684
- C:\Windows\System\qBKnaZI.exe
  C:\Windows\System\qBKnaZI.exe
  2⤵
  PID:6700
- C:\Windows\System\fHhAnvu.exe
  C:\Windows\System\fHhAnvu.exe
  2⤵
  PID:6724
- C:\Windows\System\peAfymO.exe
  C:\Windows\System\peAfymO.exe
  2⤵
  PID:6744
- C:\Windows\System\RuNrMwS.exe
  C:\Windows\System\RuNrMwS.exe
  2⤵
  PID:6764
- C:\Windows\System\ukSxKJG.exe
  C:\Windows\System\ukSxKJG.exe
  2⤵
  PID:6780
- C:\Windows\System\ByUcwMO.exe
  C:\Windows\System\ByUcwMO.exe
  2⤵
  PID:6796
- C:\Windows\System\afqGWIh.exe
  C:\Windows\System\afqGWIh.exe
  2⤵
  PID:6816
- C:\Windows\System\ziGzvYi.exe
  C:\Windows\System\ziGzvYi.exe
  2⤵
  PID:6836
- C:\Windows\System\qNeItAb.exe
  C:\Windows\System\qNeItAb.exe
  2⤵
  PID:6852
- C:\Windows\System\rYBVvtU.exe
  C:\Windows\System\rYBVvtU.exe
  2⤵
  PID:6872
- C:\Windows\System\pAIFLkb.exe
  C:\Windows\System\pAIFLkb.exe
  2⤵
  PID:6896
- C:\Windows\System\FjEBsCM.exe
  C:\Windows\System\FjEBsCM.exe
  2⤵
  PID:6928
- C:\Windows\System\yahMRLd.exe
  C:\Windows\System\yahMRLd.exe
  2⤵
  PID:6944
- C:\Windows\System\HCTohdE.exe
  C:\Windows\System\HCTohdE.exe
  2⤵
  PID:6972
- C:\Windows\System\oKilLRa.exe
  C:\Windows\System\oKilLRa.exe
  2⤵
  PID:6988
- C:\Windows\System\BEfqmly.exe
  C:\Windows\System\BEfqmly.exe
  2⤵
  PID:7004
- C:\Windows\System\qsRtITs.exe
  C:\Windows\System\qsRtITs.exe
  2⤵
  PID:7028
- C:\Windows\System\sDHWOON.exe
  C:\Windows\System\sDHWOON.exe
  2⤵
  PID:7044
- C:\Windows\System\BfFpCsh.exe
  C:\Windows\System\BfFpCsh.exe
  2⤵
  PID:7072
- C:\Windows\System\eUPCJht.exe
  C:\Windows\System\eUPCJht.exe
  2⤵
  PID:7092
- C:\Windows\System\OsFYMjR.exe
  C:\Windows\System\OsFYMjR.exe
  2⤵
  PID:7112
- C:\Windows\System\bEUKxQo.exe
  C:\Windows\System\bEUKxQo.exe
  2⤵
  PID:7128
- C:\Windows\System\aCmpEjl.exe
  C:\Windows\System\aCmpEjl.exe
  2⤵
  PID:7148
- C:\Windows\System\YLbwHrY.exe
  C:\Windows\System\YLbwHrY.exe
  2⤵
  PID:5764
- C:\Windows\System\jLrBooY.exe
  C:\Windows\System\jLrBooY.exe
  2⤵
  PID:5672
- C:\Windows\System\bHWuvDC.exe
  C:\Windows\System\bHWuvDC.exe
  2⤵
  PID:5304
- C:\Windows\System\EkJvNeM.exe
  C:\Windows\System\EkJvNeM.exe
  2⤵
  PID:6196
- C:\Windows\System\nvUMIqV.exe
  C:\Windows\System\nvUMIqV.exe
  2⤵
  PID:6124
- C:\Windows\System\gEVOvbJ.exe
  C:\Windows\System\gEVOvbJ.exe
  2⤵
  PID:6244
- C:\Windows\System\vRZlJum.exe
  C:\Windows\System\vRZlJum.exe
  2⤵
  PID:6284
- C:\Windows\System\rCPdlln.exe
  C:\Windows\System\rCPdlln.exe
  2⤵
  PID:6356
- C:\Windows\System\XcPFQVJ.exe
  C:\Windows\System\XcPFQVJ.exe
  2⤵
  PID:6396
- C:\Windows\System\OUNjhmj.exe
  C:\Windows\System\OUNjhmj.exe
  2⤵
  PID:6428
- C:\Windows\System\ThLsYWX.exe
  C:\Windows\System\ThLsYWX.exe
  2⤵
  PID:6412
- C:\Windows\System\uiykCcI.exe
  C:\Windows\System\uiykCcI.exe
  2⤵
  PID:6472
- C:\Windows\System\vmuAwyZ.exe
  C:\Windows\System\vmuAwyZ.exe
  2⤵
  PID:6520
- C:\Windows\System\YtnNpId.exe
  C:\Windows\System\YtnNpId.exe
  2⤵
  PID:6592
- C:\Windows\System\kfJcIPl.exe
  C:\Windows\System\kfJcIPl.exe
  2⤵
  PID:6576
- C:\Windows\System\QMCkpbm.exe
  C:\Windows\System\QMCkpbm.exe
  2⤵
  PID:6680
- C:\Windows\System\BcXtNrW.exe
  C:\Windows\System\BcXtNrW.exe
  2⤵
  PID:6492
- C:\Windows\System\yZXmosG.exe
  C:\Windows\System\yZXmosG.exe
  2⤵
  PID:6716
- C:\Windows\System\mNuXtHn.exe
  C:\Windows\System\mNuXtHn.exe
  2⤵
  PID:6760
- C:\Windows\System\nOfhgTc.exe
  C:\Windows\System\nOfhgTc.exe
  2⤵
  PID:6612
- C:\Windows\System\XHhdQOj.exe
  C:\Windows\System\XHhdQOj.exe
  2⤵
  PID:6864
- C:\Windows\System\xPfHtKo.exe
  C:\Windows\System\xPfHtKo.exe
  2⤵
  PID:6916
- C:\Windows\System\xStBCcJ.exe
  C:\Windows\System\xStBCcJ.exe
  2⤵
  PID:6964
- C:\Windows\System\iEiyFoC.exe
  C:\Windows\System\iEiyFoC.exe
  2⤵
  PID:6664
- C:\Windows\System\pPvaNGN.exe
  C:\Windows\System\pPvaNGN.exe
  2⤵
  PID:6696
- C:\Windows\System\XPoGthq.exe
  C:\Windows\System\XPoGthq.exe
  2⤵
  PID:6996
- C:\Windows\System\QqHCNOW.exe
  C:\Windows\System\QqHCNOW.exe
  2⤵
  PID:6808
- C:\Windows\System\nOFLoGR.exe
  C:\Windows\System\nOFLoGR.exe
  2⤵
  PID:7012
- C:\Windows\System\pWjzbli.exe
  C:\Windows\System\pWjzbli.exe
  2⤵
  PID:7036
- C:\Windows\System\OYkonBl.exe
  C:\Windows\System\OYkonBl.exe
  2⤵
  PID:7080
- C:\Windows\System\JgSMebO.exe
  C:\Windows\System\JgSMebO.exe
  2⤵
  PID:7052
- C:\Windows\System\AYzmNWp.exe
  C:\Windows\System\AYzmNWp.exe
  2⤵
  PID:7164
- C:\Windows\System\qlhdLCX.exe
  C:\Windows\System\qlhdLCX.exe
  2⤵
  PID:7108
- C:\Windows\System\qnhBYZj.exe
  C:\Windows\System\qnhBYZj.exe
  2⤵
  PID:6152
- C:\Windows\System\QghHwYK.exe
  C:\Windows\System\QghHwYK.exe
  2⤵
  PID:6172
- C:\Windows\System\bYDiNDf.exe
  C:\Windows\System\bYDiNDf.exe
  2⤵
  PID:6224
- C:\Windows\System\tpPwWFi.exe
  C:\Windows\System\tpPwWFi.exe
  2⤵
  PID:6268
- C:\Windows\System\UyQitHE.exe
  C:\Windows\System\UyQitHE.exe
  2⤵
  PID:6304
- C:\Windows\System\ilXnsOS.exe
  C:\Windows\System\ilXnsOS.exe
  2⤵
  PID:6408
- C:\Windows\System\EZyuzBB.exe
  C:\Windows\System\EZyuzBB.exe
  2⤵
  PID:6632
- C:\Windows\System\prtwmWt.exe
  C:\Windows\System\prtwmWt.exe
  2⤵
  PID:6572
- C:\Windows\System\oeyZwkb.exe
  C:\Windows\System\oeyZwkb.exe
  2⤵
  PID:6436
- C:\Windows\System\eWpRLnO.exe
  C:\Windows\System\eWpRLnO.exe
  2⤵
  PID:6608
- C:\Windows\System\mVhHjHr.exe
  C:\Windows\System\mVhHjHr.exe
  2⤵
  PID:6536
- C:\Windows\System\uBkfkEf.exe
  C:\Windows\System\uBkfkEf.exe
  2⤵
  PID:6788
- C:\Windows\System\kQrfemQ.exe
  C:\Windows\System\kQrfemQ.exe
  2⤵
  PID:6828
- C:\Windows\System\BdcUKHR.exe
  C:\Windows\System\BdcUKHR.exe
  2⤵
  PID:6908
- C:\Windows\System\DzEBATT.exe
  C:\Windows\System\DzEBATT.exe
  2⤵
  PID:6960
- C:\Windows\System\CEEhtqv.exe
  C:\Windows\System\CEEhtqv.exe
  2⤵
  PID:6812
- C:\Windows\System\qPpuLjc.exe
  C:\Windows\System\qPpuLjc.exe
  2⤵
  PID:6888
- C:\Windows\System\oOWzyxl.exe
  C:\Windows\System\oOWzyxl.exe
  2⤵
  PID:6940
- C:\Windows\System\gtcczze.exe
  C:\Windows\System\gtcczze.exe
  2⤵
  PID:6148
- C:\Windows\System\XDdqinp.exe
  C:\Windows\System\XDdqinp.exe
  2⤵
  PID:5836
- C:\Windows\System\eoGjEOn.exe
  C:\Windows\System\eoGjEOn.exe
  2⤵
  PID:7104
- C:\Windows\System\GqPKYaR.exe
  C:\Windows\System\GqPKYaR.exe
  2⤵
  PID:6340
- C:\Windows\System\zcrYjKn.exe
  C:\Windows\System\zcrYjKn.exe
  2⤵
  PID:5640
- C:\Windows\System\jxSYJWo.exe
  C:\Windows\System\jxSYJWo.exe
  2⤵
  PID:6456
- C:\Windows\System\cHClZFu.exe
  C:\Windows\System\cHClZFu.exe
  2⤵
  PID:6516
- C:\Windows\System\aSIJUzw.exe
  C:\Windows\System\aSIJUzw.exe
  2⤵
  PID:6228
- C:\Windows\System\EHplZCg.exe
  C:\Windows\System\EHplZCg.exe
  2⤵
  PID:6848
- C:\Windows\System\nkevLed.exe
  C:\Windows\System\nkevLed.exe
  2⤵
  PID:6776
- C:\Windows\System\JAcOYoM.exe
  C:\Windows\System\JAcOYoM.exe
  2⤵
  PID:6192
- C:\Windows\System\TwwIeZY.exe
  C:\Windows\System\TwwIeZY.exe
  2⤵
  PID:6556
- C:\Windows\System\SwWhTIw.exe
  C:\Windows\System\SwWhTIw.exe
  2⤵
  PID:6636
- C:\Windows\System\VLnrDvq.exe
  C:\Windows\System\VLnrDvq.exe
  2⤵
  PID:7140
- C:\Windows\System\zvGkwWL.exe
  C:\Windows\System\zvGkwWL.exe
  2⤵
  PID:6500
- C:\Windows\System\auBUKQG.exe
  C:\Windows\System\auBUKQG.exe
  2⤵
  PID:6880
- C:\Windows\System\DCRqLjZ.exe
  C:\Windows\System\DCRqLjZ.exe
  2⤵
  PID:7064
- C:\Windows\System\gvQYzAE.exe
  C:\Windows\System\gvQYzAE.exe
  2⤵
  PID:7016
- C:\Windows\System\HKygdXO.exe
  C:\Windows\System\HKygdXO.exe
  2⤵
  PID:5904
- C:\Windows\System\fQjkPeP.exe
  C:\Windows\System\fQjkPeP.exe
  2⤵
  PID:6752
- C:\Windows\System\wbMWPyG.exe
  C:\Windows\System\wbMWPyG.exe
  2⤵
  PID:7156
- C:\Windows\System\ySwvjfX.exe
  C:\Windows\System\ySwvjfX.exe
  2⤵
  PID:6692
- C:\Windows\System\fcEWrRj.exe
  C:\Windows\System\fcEWrRj.exe
  2⤵
  PID:6640
- C:\Windows\System\AKrsHVa.exe
  C:\Windows\System\AKrsHVa.exe
  2⤵
  PID:6392
- C:\Windows\System\KcDawNC.exe
  C:\Windows\System\KcDawNC.exe
  2⤵
  PID:6440
- C:\Windows\System\GWzbqYo.exe
  C:\Windows\System\GWzbqYo.exe
  2⤵
  PID:7180
- C:\Windows\System\aQpKHZB.exe
  C:\Windows\System\aQpKHZB.exe
  2⤵
  PID:7196
- C:\Windows\System\tXzYtcm.exe
  C:\Windows\System\tXzYtcm.exe
  2⤵
  PID:7216
- C:\Windows\System\UbzjKJs.exe
  C:\Windows\System\UbzjKJs.exe
  2⤵
  PID:7232
- C:\Windows\System\WcjzfQr.exe
  C:\Windows\System\WcjzfQr.exe
  2⤵
  PID:7272
- C:\Windows\System\jnHLoVK.exe
  C:\Windows\System\jnHLoVK.exe
  2⤵
  PID:7288
- C:\Windows\System\HbELyzV.exe
  C:\Windows\System\HbELyzV.exe
  2⤵
  PID:7304
- C:\Windows\System\XIgqvMe.exe
  C:\Windows\System\XIgqvMe.exe
  2⤵
  PID:7320
- C:\Windows\System\kZNDqrB.exe
  C:\Windows\System\kZNDqrB.exe
  2⤵
  PID:7340
- C:\Windows\System\rzzerMW.exe
  C:\Windows\System\rzzerMW.exe
  2⤵
  PID:7368
- C:\Windows\System\vElsxRH.exe
  C:\Windows\System\vElsxRH.exe
  2⤵
  PID:7384
- C:\Windows\System\pWbDaON.exe
  C:\Windows\System\pWbDaON.exe
  2⤵
  PID:7400
- C:\Windows\System\XorquwF.exe
  C:\Windows\System\XorquwF.exe
  2⤵
  PID:7420
- C:\Windows\System\kxwLDKZ.exe
  C:\Windows\System\kxwLDKZ.exe
  2⤵
  PID:7456
- C:\Windows\System\ZyjpWVZ.exe
  C:\Windows\System\ZyjpWVZ.exe
  2⤵
  PID:7472
- C:\Windows\System\pdRNfop.exe
  C:\Windows\System\pdRNfop.exe
  2⤵
  PID:7492
- C:\Windows\System\nHkTfho.exe
  C:\Windows\System\nHkTfho.exe
  2⤵
  PID:7508
- C:\Windows\System\RkvQYMZ.exe
  C:\Windows\System\RkvQYMZ.exe
  2⤵
  PID:7524
- C:\Windows\System\BFMhYmu.exe
  C:\Windows\System\BFMhYmu.exe
  2⤵
  PID:7540
- C:\Windows\System\CESSWuY.exe
  C:\Windows\System\CESSWuY.exe
  2⤵
  PID:7560
- C:\Windows\System\FTjkSmR.exe
  C:\Windows\System\FTjkSmR.exe
  2⤵
  PID:7592
- C:\Windows\System\Gfxeaks.exe
  C:\Windows\System\Gfxeaks.exe
  2⤵
  PID:7616
- C:\Windows\System\SHkPQHH.exe
  C:\Windows\System\SHkPQHH.exe
  2⤵
  PID:7632
- C:\Windows\System\bDQYReK.exe
  C:\Windows\System\bDQYReK.exe
  2⤵
  PID:7648
- C:\Windows\System\VVeClTh.exe
  C:\Windows\System\VVeClTh.exe
  2⤵
  PID:7672
- C:\Windows\System\yicAWWB.exe
  C:\Windows\System\yicAWWB.exe
  2⤵
  PID:7692
- C:\Windows\System\NqokOCr.exe
  C:\Windows\System\NqokOCr.exe
  2⤵
  PID:7708
- C:\Windows\System\ZuWBeWV.exe
  C:\Windows\System\ZuWBeWV.exe
  2⤵
  PID:7724
- C:\Windows\System\wEukGdY.exe
  C:\Windows\System\wEukGdY.exe
  2⤵
  PID:7752
- C:\Windows\System\PFJOjGX.exe
  C:\Windows\System\PFJOjGX.exe
  2⤵
  PID:7772
- C:\Windows\System\lUnSkdJ.exe
  C:\Windows\System\lUnSkdJ.exe
  2⤵
  PID:7788
- C:\Windows\System\oaWnZjy.exe
  C:\Windows\System\oaWnZjy.exe
  2⤵
  PID:7804
- C:\Windows\System\xKHerfJ.exe
  C:\Windows\System\xKHerfJ.exe
  2⤵
  PID:7824
- C:\Windows\System\aPZKBfr.exe
  C:\Windows\System\aPZKBfr.exe
  2⤵
  PID:7848
- C:\Windows\System\QFIIdKQ.exe
  C:\Windows\System\QFIIdKQ.exe
  2⤵
  PID:7876
- C:\Windows\System\pDXFMsN.exe
  C:\Windows\System\pDXFMsN.exe
  2⤵
  PID:7892
- C:\Windows\System\JSGkWOs.exe
  C:\Windows\System\JSGkWOs.exe
  2⤵
  PID:7908
- C:\Windows\System\caKyhuO.exe
  C:\Windows\System\caKyhuO.exe
  2⤵
  PID:7924
- C:\Windows\System\qslNsbo.exe
  C:\Windows\System\qslNsbo.exe
  2⤵
  PID:7940
- C:\Windows\System\VcXgIqO.exe
  C:\Windows\System\VcXgIqO.exe
  2⤵
  PID:7964
- C:\Windows\System\IJEBgYr.exe
  C:\Windows\System\IJEBgYr.exe
  2⤵
  PID:7984
- C:\Windows\System\CWUmKHE.exe
  C:\Windows\System\CWUmKHE.exe
  2⤵
  PID:8004
- C:\Windows\System\kgLHEyE.exe
  C:\Windows\System\kgLHEyE.exe
  2⤵
  PID:8020
- C:\Windows\System\lyqfyNz.exe
  C:\Windows\System\lyqfyNz.exe
  2⤵
  PID:8044
- C:\Windows\System\FxmOLky.exe
  C:\Windows\System\FxmOLky.exe
  2⤵
  PID:8064
- C:\Windows\System\IxWbWKa.exe
  C:\Windows\System\IxWbWKa.exe
  2⤵
  PID:8080
- C:\Windows\System\BcGegVa.exe
  C:\Windows\System\BcGegVa.exe
  2⤵
  PID:8104
- C:\Windows\System\mQxcYDY.exe
  C:\Windows\System\mQxcYDY.exe
  2⤵
  PID:8132
- C:\Windows\System\CitDMAh.exe
  C:\Windows\System\CitDMAh.exe
  2⤵
  PID:8148
- C:\Windows\System\xoLyuAe.exe
  C:\Windows\System\xoLyuAe.exe
  2⤵
  PID:8164
- C:\Windows\System\gtAsOau.exe
  C:\Windows\System\gtAsOau.exe
  2⤵
  PID:8180
- C:\Windows\System\VOsOsbG.exe
  C:\Windows\System\VOsOsbG.exe
  2⤵
  PID:6956
- C:\Windows\System\qbIeAik.exe
  C:\Windows\System\qbIeAik.exe
  2⤵
  PID:7172
- C:\Windows\System\EXztcXP.exe
  C:\Windows\System\EXztcXP.exe
  2⤵
  PID:7212
- C:\Windows\System\kBRfDrZ.exe
  C:\Windows\System\kBRfDrZ.exe
  2⤵
  PID:7260
- C:\Windows\System\vnbcrgP.exe
  C:\Windows\System\vnbcrgP.exe
  2⤵
  PID:7224
- C:\Windows\System\zVmjKdj.exe
  C:\Windows\System\zVmjKdj.exe
  2⤵
  PID:7284
- C:\Windows\System\jgJDxMK.exe
  C:\Windows\System\jgJDxMK.exe
  2⤵
  PID:7376
- C:\Windows\System\NIzGauB.exe
  C:\Windows\System\NIzGauB.exe
  2⤵
  PID:7416
- C:\Windows\System\egBLvEv.exe
  C:\Windows\System\egBLvEv.exe
  2⤵
  PID:7364
- C:\Windows\System\mLJNMDQ.exe
  C:\Windows\System\mLJNMDQ.exe
  2⤵
  PID:7396
- C:\Windows\System\VtzYuDw.exe
  C:\Windows\System\VtzYuDw.exe
  2⤵
  PID:7440
- C:\Windows\System\NmrSflZ.exe
  C:\Windows\System\NmrSflZ.exe
  2⤵
  PID:7520
- C:\Windows\System\wAzmyxV.exe
  C:\Windows\System\wAzmyxV.exe
  2⤵
  PID:7536
- C:\Windows\System\qwLOIWx.exe
  C:\Windows\System\qwLOIWx.exe
  2⤵
  PID:7568
- C:\Windows\System\tvnjbAl.exe
  C:\Windows\System\tvnjbAl.exe
  2⤵
  PID:7588
- C:\Windows\System\cwUzxZo.exe
  C:\Windows\System\cwUzxZo.exe
  2⤵
  PID:7644
- C:\Windows\System\cYRfewZ.exe
  C:\Windows\System\cYRfewZ.exe
  2⤵
  PID:7660
- C:\Windows\System\vTIqbrD.exe
  C:\Windows\System\vTIqbrD.exe
  2⤵
  PID:7704
- C:\Windows\System\SnKXYeq.exe
  C:\Windows\System\SnKXYeq.exe
  2⤵
  PID:7748
- C:\Windows\System\tZPrdOG.exe
  C:\Windows\System\tZPrdOG.exe
  2⤵
  PID:7680
- C:\Windows\System\JswGWoQ.exe
  C:\Windows\System\JswGWoQ.exe
  2⤵
  PID:7820
- C:\Windows\System\bWQYsjU.exe
  C:\Windows\System\bWQYsjU.exe
  2⤵
  PID:7864
- C:\Windows\System\ZKHOEku.exe
  C:\Windows\System\ZKHOEku.exe
  2⤵
  PID:7800
- C:\Windows\System\shYOQqG.exe
  C:\Windows\System\shYOQqG.exe
  2⤵
  PID:7860
- C:\Windows\System\UPyQGKW.exe
  C:\Windows\System\UPyQGKW.exe
  2⤵
  PID:7972
- C:\Windows\System\FkzjgPo.exe
  C:\Windows\System\FkzjgPo.exe
  2⤵
  PID:8000
- C:\Windows\System\bpovYLt.exe
  C:\Windows\System\bpovYLt.exe
  2⤵
  PID:7992
- C:\Windows\System\KePqZCq.exe
  C:\Windows\System\KePqZCq.exe
  2⤵
  PID:8016
- C:\Windows\System\GdgtyhZ.exe
  C:\Windows\System\GdgtyhZ.exe
  2⤵
  PID:8100
- C:\Windows\System\PSsynYT.exe
  C:\Windows\System\PSsynYT.exe
  2⤵
  PID:8172
- C:\Windows\System\kkXCrYV.exe
  C:\Windows\System\kkXCrYV.exe
  2⤵
  PID:7176
- C:\Windows\System\MktILJq.exe
  C:\Windows\System\MktILJq.exe
  2⤵
  PID:8124
- C:\Windows\System\oEewigK.exe
  C:\Windows\System\oEewigK.exe
  2⤵
  PID:8188
- C:\Windows\System\kwLkuDe.exe
  C:\Windows\System\kwLkuDe.exe
  2⤵
  PID:7136
- C:\Windows\System\JQwDMTn.exe
  C:\Windows\System\JQwDMTn.exe
  2⤵
  PID:7256
- C:\Windows\System\JRpIDvY.exe
  C:\Windows\System\JRpIDvY.exe
  2⤵
  PID:7252
- C:\Windows\System\wwUBDgr.exe
  C:\Windows\System\wwUBDgr.exe
  2⤵
  PID:7408
- C:\Windows\System\fpcnIcW.exe
  C:\Windows\System\fpcnIcW.exe
  2⤵
  PID:7348
- C:\Windows\System\sZpnhOY.exe
  C:\Windows\System\sZpnhOY.exe
  2⤵
  PID:7436
- C:\Windows\System\itTjdtS.exe
  C:\Windows\System\itTjdtS.exe
  2⤵
  PID:7468
- C:\Windows\System\XqEcTZQ.exe
  C:\Windows\System\XqEcTZQ.exe
  2⤵
  PID:7552
- C:\Windows\System\rBwZcSn.exe
  C:\Windows\System\rBwZcSn.exe
  2⤵
  PID:7640
- C:\Windows\System\NxPNlMV.exe
  C:\Windows\System\NxPNlMV.exe
  2⤵
  PID:7736
- C:\Windows\System\MyKzgFv.exe
  C:\Windows\System\MyKzgFv.exe
  2⤵
  PID:7716
- C:\Windows\System\JBWUjPt.exe
  C:\Windows\System\JBWUjPt.exe
  2⤵
  PID:7816
- C:\Windows\System\zAoTnHw.exe
  C:\Windows\System\zAoTnHw.exe
  2⤵
  PID:7872
- C:\Windows\System\lVopZHo.exe
  C:\Windows\System\lVopZHo.exe
  2⤵
  PID:7764
- C:\Windows\System\cHnenBt.exe
  C:\Windows\System\cHnenBt.exe
  2⤵
  PID:7904
- C:\Windows\System\jrzOPaa.exe
  C:\Windows\System\jrzOPaa.exe
  2⤵
  PID:7996
- C:\Windows\System\wUOvBjI.exe
  C:\Windows\System\wUOvBjI.exe
  2⤵
  PID:8144
- C:\Windows\System\gTfRDNe.exe
  C:\Windows\System\gTfRDNe.exe
  2⤵
  PID:8060
- C:\Windows\System\LCBQgyO.exe
  C:\Windows\System\LCBQgyO.exe
  2⤵
  PID:7120
- C:\Windows\System\MsVsBAr.exe
  C:\Windows\System\MsVsBAr.exe
  2⤵
  PID:6620
- C:\Windows\System\SALnmEn.exe
  C:\Windows\System\SALnmEn.exe
  2⤵
  PID:6360
- C:\Windows\System\mgryOFl.exe
  C:\Windows\System\mgryOFl.exe
  2⤵
  PID:7464
- C:\Windows\System\czxSrzT.exe
  C:\Windows\System\czxSrzT.exe
  2⤵
  PID:7444
- C:\Windows\System\YDRSqZG.exe
  C:\Windows\System\YDRSqZG.exe
  2⤵
  PID:7432
- C:\Windows\System\DcTtmUK.exe
  C:\Windows\System\DcTtmUK.exe
  2⤵
  PID:7504
- C:\Windows\System\yXxHcny.exe
  C:\Windows\System\yXxHcny.exe
  2⤵
  PID:7784
- C:\Windows\System\IWmOetb.exe
  C:\Windows\System\IWmOetb.exe
  2⤵
  PID:7580
- C:\Windows\System\tfLqacF.exe
  C:\Windows\System\tfLqacF.exe
  2⤵
  PID:7840
- C:\Windows\System\namtChq.exe
  C:\Windows\System\namtChq.exe
  2⤵
  PID:7740
- C:\Windows\System\QQIdGsH.exe
  C:\Windows\System\QQIdGsH.exe
  2⤵
  PID:7936
- C:\Windows\System\IRDSHDq.exe
  C:\Windows\System\IRDSHDq.exe
  2⤵
  PID:7020
- C:\Windows\System\lkHgrcs.exe
  C:\Windows\System\lkHgrcs.exe
  2⤵
  PID:8128
- C:\Windows\System\bbeXQec.exe
  C:\Windows\System\bbeXQec.exe
  2⤵
  PID:7192
- C:\Windows\System\MScMBHF.exe
  C:\Windows\System\MScMBHF.exe
  2⤵
  PID:7360
- C:\Windows\System\PveKyEo.exe
  C:\Windows\System\PveKyEo.exe
  2⤵
  PID:7480
- C:\Windows\System\KkVseED.exe
  C:\Windows\System\KkVseED.exe
  2⤵
  PID:7856
- C:\Windows\System\wNEpZrI.exe
  C:\Windows\System\wNEpZrI.exe
  2⤵
  PID:7532
- C:\Windows\System\HZUunXR.exe
  C:\Windows\System\HZUunXR.exe
  2⤵
  PID:8212
- C:\Windows\System\ViGDUts.exe
  C:\Windows\System\ViGDUts.exe
  2⤵
  PID:8232
- C:\Windows\System\QUoZFLQ.exe
  C:\Windows\System\QUoZFLQ.exe
  2⤵
  PID:8252
- C:\Windows\System\ZfPADIh.exe
  C:\Windows\System\ZfPADIh.exe
  2⤵
  PID:8276
- C:\Windows\System\mxRIoJC.exe
  C:\Windows\System\mxRIoJC.exe
  2⤵
  PID:8292
- C:\Windows\System\yxlzqrT.exe
  C:\Windows\System\yxlzqrT.exe
  2⤵
  PID:8344
- C:\Windows\System\ANTlwty.exe
  C:\Windows\System\ANTlwty.exe
  2⤵
  PID:8360
- C:\Windows\System\UHWbmav.exe
  C:\Windows\System\UHWbmav.exe
  2⤵
  PID:8376
- C:\Windows\System\XWjBUcT.exe
  C:\Windows\System\XWjBUcT.exe
  2⤵
  PID:8392
- C:\Windows\System\mvVAyxM.exe
  C:\Windows\System\mvVAyxM.exe
  2⤵
  PID:8408
- C:\Windows\System\wGUgPJq.exe
  C:\Windows\System\wGUgPJq.exe
  2⤵
  PID:8424
- C:\Windows\System\YznKlrX.exe
  C:\Windows\System\YznKlrX.exe
  2⤵
  PID:8440
- C:\Windows\System\DltRZjM.exe
  C:\Windows\System\DltRZjM.exe
  2⤵
  PID:8460
- C:\Windows\System\aOLVNmu.exe
  C:\Windows\System\aOLVNmu.exe
  2⤵
  PID:8476
- C:\Windows\System\hBcdmgE.exe
  C:\Windows\System\hBcdmgE.exe
  2⤵
  PID:8524
- C:\Windows\System\hAmPSvQ.exe
  C:\Windows\System\hAmPSvQ.exe
  2⤵
  PID:8540
- C:\Windows\System\LaNavtm.exe
  C:\Windows\System\LaNavtm.exe
  2⤵
  PID:8556
- C:\Windows\System\jLWOkCT.exe
  C:\Windows\System\jLWOkCT.exe
  2⤵
  PID:8572
- C:\Windows\System\OJairXL.exe
  C:\Windows\System\OJairXL.exe
  2⤵
  PID:8588
- C:\Windows\System\PrxElwa.exe
  C:\Windows\System\PrxElwa.exe
  2⤵
  PID:8604
- C:\Windows\System\onqVyUG.exe
  C:\Windows\System\onqVyUG.exe
  2⤵
  PID:8620
- C:\Windows\System\XqBjDBb.exe
  C:\Windows\System\XqBjDBb.exe
  2⤵
  PID:8640
- C:\Windows\System\kTmEttT.exe
  C:\Windows\System\kTmEttT.exe
  2⤵
  PID:8656
- C:\Windows\System\RGvMzLT.exe
  C:\Windows\System\RGvMzLT.exe
  2⤵
  PID:8676
- C:\Windows\System\zXUcshr.exe
  C:\Windows\System\zXUcshr.exe
  2⤵
  PID:8696
- C:\Windows\System\NMVaqTY.exe
  C:\Windows\System\NMVaqTY.exe
  2⤵
  PID:8728
- C:\Windows\System\qfTmYjn.exe
  C:\Windows\System\qfTmYjn.exe
  2⤵
  PID:8760
- C:\Windows\System\DSvVlie.exe
  C:\Windows\System\DSvVlie.exe
  2⤵
  PID:8780
- C:\Windows\System\ijyGmhQ.exe
  C:\Windows\System\ijyGmhQ.exe
  2⤵
  PID:8796
- C:\Windows\System\ogaFrYE.exe
  C:\Windows\System\ogaFrYE.exe
  2⤵
  PID:8812
- C:\Windows\System\gjvgIax.exe
  C:\Windows\System\gjvgIax.exe
  2⤵
  PID:8828
- C:\Windows\System\LEhufND.exe
  C:\Windows\System\LEhufND.exe
  2⤵
  PID:8844
- C:\Windows\System\ukDWajT.exe
  C:\Windows\System\ukDWajT.exe
  2⤵
  PID:8864
- C:\Windows\System\GCmRvYp.exe
  C:\Windows\System\GCmRvYp.exe
  2⤵
  PID:8884
- C:\Windows\System\tifkuWC.exe
  C:\Windows\System\tifkuWC.exe
  2⤵
  PID:8900
- C:\Windows\System\TOHjUcN.exe
  C:\Windows\System\TOHjUcN.exe
  2⤵
  PID:8920
- C:\Windows\System\BjEecmH.exe
  C:\Windows\System\BjEecmH.exe
  2⤵
  PID:8940
- C:\Windows\System\DMuemyJ.exe
  C:\Windows\System\DMuemyJ.exe
  2⤵
  PID:8960
- C:\Windows\System\dxhtxeG.exe
  C:\Windows\System\dxhtxeG.exe
  2⤵
  PID:8984
- C:\Windows\System\qUFIDVU.exe
  C:\Windows\System\qUFIDVU.exe
  2⤵
  PID:9020
- C:\Windows\System\LQpOkUM.exe
  C:\Windows\System\LQpOkUM.exe
  2⤵
  PID:9036
- C:\Windows\System\KXJOKXf.exe
  C:\Windows\System\KXJOKXf.exe
  2⤵
  PID:9052
- C:\Windows\System\lqBnDKm.exe
  C:\Windows\System\lqBnDKm.exe
  2⤵
  PID:9072
- C:\Windows\System\zhbjmPn.exe
  C:\Windows\System\zhbjmPn.exe
  2⤵
  PID:9088
- C:\Windows\System\feDDhMq.exe
  C:\Windows\System\feDDhMq.exe
  2⤵
  PID:9104
- C:\Windows\System\pHWMyPs.exe
  C:\Windows\System\pHWMyPs.exe
  2⤵
  PID:9144
- C:\Windows\System\tquuzqN.exe
  C:\Windows\System\tquuzqN.exe
  2⤵
  PID:9160
- C:\Windows\System\HlFIAUD.exe
  C:\Windows\System\HlFIAUD.exe
  2⤵
  PID:9176
- C:\Windows\System\epoevKc.exe
  C:\Windows\System\epoevKc.exe
  2⤵
  PID:9192
- C:\Windows\System\qULLfTI.exe
  C:\Windows\System\qULLfTI.exe
  2⤵
  PID:7956
- C:\Windows\System\PwtjZDQ.exe
  C:\Windows\System\PwtjZDQ.exe
  2⤵
  PID:8088
- C:\Windows\System\KYNxouW.exe
  C:\Windows\System\KYNxouW.exe
  2⤵
  PID:8156
- C:\Windows\System\CsLSGbI.exe
  C:\Windows\System\CsLSGbI.exe
  2⤵
  PID:8220
- C:\Windows\System\zTyUfan.exe
  C:\Windows\System\zTyUfan.exe
  2⤵
  PID:8272
- C:\Windows\System\LAZqpRX.exe
  C:\Windows\System\LAZqpRX.exe
  2⤵
  PID:8316
- C:\Windows\System\efrKQGF.exe
  C:\Windows\System\efrKQGF.exe
  2⤵
  PID:8240
- C:\Windows\System\fnRmxTD.exe
  C:\Windows\System\fnRmxTD.exe
  2⤵
  PID:8288
- C:\Windows\System\Sewbcba.exe
  C:\Windows\System\Sewbcba.exe
  2⤵
  PID:7336
- C:\Windows\System\ZliuUmx.exe
  C:\Windows\System\ZliuUmx.exe
  2⤵
  PID:8196
- C:\Windows\System\YSpQRnE.exe
  C:\Windows\System\YSpQRnE.exe
  2⤵
  PID:8368
- C:\Windows\System\epfrZwg.exe
  C:\Windows\System\epfrZwg.exe
  2⤵
  PID:8404
- C:\Windows\System\OWFWErJ.exe
  C:\Windows\System\OWFWErJ.exe
  2⤵
  PID:8356
- C:\Windows\System\CEeOFPf.exe
  C:\Windows\System\CEeOFPf.exe
  2⤵
  PID:8420
- C:\Windows\System\LmghIMe.exe
  C:\Windows\System\LmghIMe.exe
  2⤵
  PID:8500
- C:\Windows\System\oWZNPLb.exe
  C:\Windows\System\oWZNPLb.exe
  2⤵
  PID:8600
- C:\Windows\System\ApoCHzM.exe
  C:\Windows\System\ApoCHzM.exe
  2⤵
  PID:8664
- C:\Windows\System\WsffNsQ.exe
  C:\Windows\System\WsffNsQ.exe
  2⤵
  PID:8492
- C:\Windows\System\IQLUUDw.exe
  C:\Windows\System\IQLUUDw.exe
  2⤵
  PID:8704
- C:\Windows\System\daqnvHZ.exe
  C:\Windows\System\daqnvHZ.exe
  2⤵
  PID:8724
- C:\Windows\System\PRLuzzo.exe
  C:\Windows\System\PRLuzzo.exe
  2⤵
  PID:8616
- C:\Windows\System\eMFreQT.exe
  C:\Windows\System\eMFreQT.exe
  2⤵
  PID:8768
- C:\Windows\System\BchiUXd.exe
  C:\Windows\System\BchiUXd.exe
  2⤵
  PID:8692
- C:\Windows\System\RwQMUOl.exe
  C:\Windows\System\RwQMUOl.exe
  2⤵
  PID:8756
- C:\Windows\System\RDcYzpo.exe
  C:\Windows\System\RDcYzpo.exe
  2⤵
  PID:8916
- C:\Windows\System\sDYlbUl.exe
  C:\Windows\System\sDYlbUl.exe
  2⤵
  PID:8956
- C:\Windows\System\FuyGZlZ.exe
  C:\Windows\System\FuyGZlZ.exe
  2⤵
  PID:8824
- C:\Windows\System\bgumBTf.exe
  C:\Windows\System\bgumBTf.exe
  2⤵
  PID:9008
- C:\Windows\System\ULRaMIx.exe
  C:\Windows\System\ULRaMIx.exe
  2⤵
  PID:8896
- C:\Windows\System\LAnuREw.exe
  C:\Windows\System\LAnuREw.exe
  2⤵
  PID:8980
- C:\Windows\System\gHoRoHp.exe
  C:\Windows\System\gHoRoHp.exe
  2⤵
  PID:9028
- C:\Windows\System\BlgPEEN.exe
  C:\Windows\System\BlgPEEN.exe
  2⤵
  PID:9068
- C:\Windows\System\czThbZg.exe
  C:\Windows\System\czThbZg.exe
  2⤵
  PID:9124
- C:\Windows\System\ZuLtvJe.exe
  C:\Windows\System\ZuLtvJe.exe
  2⤵
  PID:9140
- C:\Windows\System\CCAKPWv.exe
  C:\Windows\System\CCAKPWv.exe
  2⤵
  PID:9172
- C:\Windows\System\wiglfFF.exe
  C:\Windows\System\wiglfFF.exe
  2⤵
  PID:9184
- C:\Windows\System\wFYFeNv.exe
  C:\Windows\System\wFYFeNv.exe
  2⤵
  PID:8012
- C:\Windows\System\VuYhUix.exe
  C:\Windows\System\VuYhUix.exe
  2⤵
  PID:7352
- C:\Windows\System\RdRsjVs.exe
  C:\Windows\System\RdRsjVs.exe
  2⤵
  PID:8120
- C:\Windows\System\TmnzoBd.exe
  C:\Windows\System\TmnzoBd.exe
  2⤵
  PID:6296
- C:\Windows\System\oGACRVb.exe
  C:\Windows\System\oGACRVb.exe
  2⤵
  PID:7700
- C:\Windows\System\UeNgJwI.exe
  C:\Windows\System\UeNgJwI.exe
  2⤵
  PID:7612
- C:\Windows\System\yfFqxeq.exe
  C:\Windows\System\yfFqxeq.exe
  2⤵
  PID:9136
- C:\Windows\System\QIXvNXp.exe
  C:\Windows\System\QIXvNXp.exe
  2⤵
  PID:8388
- C:\Windows\System\ONlDtzz.exe
  C:\Windows\System\ONlDtzz.exe
  2⤵
  PID:8496
- C:\Windows\System\pfqaVjo.exe
  C:\Windows\System\pfqaVjo.exe
  2⤵
  PID:8596
- C:\Windows\System\tsVQOax.exe
  C:\Windows\System\tsVQOax.exe
  2⤵
  PID:8452
- C:\Windows\System\cPaiuiF.exe
  C:\Windows\System\cPaiuiF.exe
  2⤵
  PID:8836
- C:\Windows\System\nQgqqvS.exe
  C:\Windows\System\nQgqqvS.exe
  2⤵
  PID:8520
- C:\Windows\System\qKoBHck.exe
  C:\Windows\System\qKoBHck.exe
  2⤵
  PID:8748
- C:\Windows\System\yKvxukK.exe
  C:\Windows\System\yKvxukK.exe
  2⤵
  PID:8908
- C:\Windows\System\HflSGrr.exe
  C:\Windows\System\HflSGrr.exe
  2⤵
  PID:8856
- C:\Windows\System\GlDwOcx.exe
  C:\Windows\System\GlDwOcx.exe
  2⤵
  PID:8932
- C:\Windows\System\CXDkbis.exe
  C:\Windows\System\CXDkbis.exe
  2⤵
  PID:8936
- C:\Windows\System\ciVSPES.exe
  C:\Windows\System\ciVSPES.exe
  2⤵
  PID:9080
- C:\Windows\System\ySqHBnj.exe
  C:\Windows\System\ySqHBnj.exe
  2⤵
  PID:9116
- C:\Windows\System\bsGZBla.exe
  C:\Windows\System\bsGZBla.exe
  2⤵
  PID:8264
- C:\Windows\System\rtMgarp.exe
  C:\Windows\System\rtMgarp.exe
  2⤵
  PID:9188
- C:\Windows\System\yCpfqvx.exe
  C:\Windows\System\yCpfqvx.exe
  2⤵
  PID:8324
- C:\Windows\System\fKCPIuk.exe
  C:\Windows\System\fKCPIuk.exe
  2⤵
  PID:8312
- C:\Windows\System\zEoQGZB.exe
  C:\Windows\System\zEoQGZB.exe
  2⤵
  PID:8284
- C:\Windows\System\YOKvEXd.exe
  C:\Windows\System\YOKvEXd.exe
  2⤵
  PID:8448
- C:\Windows\System\VzuQTAp.exe
  C:\Windows\System\VzuQTAp.exe
  2⤵
  PID:8636
- C:\Windows\System\yBVEfXW.exe
  C:\Windows\System\yBVEfXW.exe
  2⤵
  PID:8648
- C:\Windows\System\CXEPmCi.exe
  C:\Windows\System\CXEPmCi.exe
  2⤵
  PID:8688
- C:\Windows\System\OtzQJqV.exe
  C:\Windows\System\OtzQJqV.exe
  2⤵
  PID:8372
- C:\Windows\System\sbxpItx.exe
  C:\Windows\System\sbxpItx.exe
  2⤵
  PID:8992
- C:\Windows\System\VWcwTkD.exe
  C:\Windows\System\VWcwTkD.exe
  2⤵
  PID:9004
- C:\Windows\System\WoMaVNm.exe
  C:\Windows\System\WoMaVNm.exe
  2⤵
  PID:8304
- C:\Windows\System\PKuFhtS.exe
  C:\Windows\System\PKuFhtS.exe
  2⤵
  PID:9100
- C:\Windows\System\XmmNGuE.exe
  C:\Windows\System\XmmNGuE.exe
  2⤵
  PID:7916
- C:\Windows\System\XSgHhzy.exe
  C:\Windows\System\XSgHhzy.exe
  2⤵
  PID:8208
- C:\Windows\System\CoxnxSP.exe
  C:\Windows\System\CoxnxSP.exe
  2⤵
  PID:8536
- C:\Windows\System\yqrIXel.exe
  C:\Windows\System\yqrIXel.exe
  2⤵
  PID:8568
- C:\Windows\System\NMWxZmb.exe
  C:\Windows\System\NMWxZmb.exe
  2⤵
  PID:8776
- C:\Windows\System\KvygCcD.exe
  C:\Windows\System\KvygCcD.exe
  2⤵
  PID:8948
- C:\Windows\System\ZHwuzXu.exe
  C:\Windows\System\ZHwuzXu.exe
  2⤵
  PID:8976
- C:\Windows\System\ZROosbN.exe
  C:\Windows\System\ZROosbN.exe
  2⤵
  PID:8268
- C:\Windows\System\sVklEgh.exe
  C:\Windows\System\sVklEgh.exe
  2⤵
  PID:7312
- C:\Windows\System\YTTeWlI.exe
  C:\Windows\System\YTTeWlI.exe
  2⤵
  PID:8456
- C:\Windows\System\MOKoROR.exe
  C:\Windows\System\MOKoROR.exe
  2⤵
  PID:8352
- C:\Windows\System\DowGrrj.exe
  C:\Windows\System\DowGrrj.exe
  2⤵
  PID:6924
- C:\Windows\System\QYwEnsr.exe
  C:\Windows\System\QYwEnsr.exe
  2⤵
  PID:7576
- C:\Windows\System\OsadGot.exe
  C:\Windows\System\OsadGot.exe
  2⤵
  PID:8200
- C:\Windows\System\ogTBmdU.exe
  C:\Windows\System\ogTBmdU.exe
  2⤵
  PID:9168
- C:\Windows\System\TtfwgLi.exe
  C:\Windows\System\TtfwgLi.exe
  2⤵
  PID:9220
- C:\Windows\System\cemsynZ.exe
  C:\Windows\System\cemsynZ.exe
  2⤵
  PID:9236
- C:\Windows\System\YquLOaK.exe
  C:\Windows\System\YquLOaK.exe
  2⤵
  PID:9252
- C:\Windows\System\DBTukpa.exe
  C:\Windows\System\DBTukpa.exe
  2⤵
  PID:9268
- C:\Windows\System\MspnUYs.exe
  C:\Windows\System\MspnUYs.exe
  2⤵
  PID:9288
- C:\Windows\System\OUfWPxX.exe
  C:\Windows\System\OUfWPxX.exe
  2⤵
  PID:9312
- C:\Windows\System\ghvaeDj.exe
  C:\Windows\System\ghvaeDj.exe
  2⤵
  PID:9356
- C:\Windows\System\GUsBxDH.exe
  C:\Windows\System\GUsBxDH.exe
  2⤵
  PID:9376
- C:\Windows\System\rJIOcHG.exe
  C:\Windows\System\rJIOcHG.exe
  2⤵
  PID:9392
- C:\Windows\System\OZwizyj.exe
  C:\Windows\System\OZwizyj.exe
  2⤵
  PID:9408
- C:\Windows\System\wjEsDUr.exe
  C:\Windows\System\wjEsDUr.exe
  2⤵
  PID:9424
- C:\Windows\System\vMQrTlj.exe
  C:\Windows\System\vMQrTlj.exe
  2⤵
  PID:9460
- C:\Windows\System\gCVAJJx.exe
  C:\Windows\System\gCVAJJx.exe
  2⤵
  PID:9476
- C:\Windows\System\oFYBUmP.exe
  C:\Windows\System\oFYBUmP.exe
  2⤵
  PID:9492
- C:\Windows\System\ZTUkFNg.exe
  C:\Windows\System\ZTUkFNg.exe
  2⤵
  PID:9508
- C:\Windows\System\hEIHUje.exe
  C:\Windows\System\hEIHUje.exe
  2⤵
  PID:9528
- C:\Windows\System\ILQVXOp.exe
  C:\Windows\System\ILQVXOp.exe
  2⤵
  PID:9544
- C:\Windows\System\zUazvPi.exe
  C:\Windows\System\zUazvPi.exe
  2⤵
  PID:9560
- C:\Windows\System\XhOCNyS.exe
  C:\Windows\System\XhOCNyS.exe
  2⤵
  PID:9576
- C:\Windows\System\NpbqoPn.exe
  C:\Windows\System\NpbqoPn.exe
  2⤵
  PID:9592
- C:\Windows\System\elBXvPn.exe
  C:\Windows\System\elBXvPn.exe
  2⤵
  PID:9644
- C:\Windows\System\RHMocsw.exe
  C:\Windows\System\RHMocsw.exe
  2⤵
  PID:9660
- C:\Windows\System\VOYobNz.exe
  C:\Windows\System\VOYobNz.exe
  2⤵
  PID:9676
- C:\Windows\System\VnJSOwh.exe
  C:\Windows\System\VnJSOwh.exe
  2⤵
  PID:9692
- C:\Windows\System\NtXjrJc.exe
  C:\Windows\System\NtXjrJc.exe
  2⤵
  PID:9708
- C:\Windows\System\NKVUpOx.exe
  C:\Windows\System\NKVUpOx.exe
  2⤵
  PID:9728
- C:\Windows\System\bWaPvjO.exe
  C:\Windows\System\bWaPvjO.exe
  2⤵
  PID:9764
- C:\Windows\System\TwJRZpY.exe
  C:\Windows\System\TwJRZpY.exe
  2⤵
  PID:9780
- C:\Windows\System\JKtfWvA.exe
  C:\Windows\System\JKtfWvA.exe
  2⤵
  PID:9796
- C:\Windows\System\qNQjvVu.exe
  C:\Windows\System\qNQjvVu.exe
  2⤵
  PID:9812
- C:\Windows\System\TcghhIw.exe
  C:\Windows\System\TcghhIw.exe
  2⤵
  PID:9832
- C:\Windows\System\tVCskUh.exe
  C:\Windows\System\tVCskUh.exe
  2⤵
  PID:9852
- C:\Windows\System\lCIatoL.exe
  C:\Windows\System\lCIatoL.exe
  2⤵
  PID:9868
- C:\Windows\System\gVQszeE.exe
  C:\Windows\System\gVQszeE.exe
  2⤵
  PID:9884
- C:\Windows\System\sLFQIvm.exe
  C:\Windows\System\sLFQIvm.exe
  2⤵
  PID:9900
- C:\Windows\System\ZLyDYOv.exe
  C:\Windows\System\ZLyDYOv.exe
  2⤵
  PID:9932
- C:\Windows\System\yEbiPin.exe
  C:\Windows\System\yEbiPin.exe
  2⤵
  PID:9948
- C:\Windows\System\aOUYLSW.exe
  C:\Windows\System\aOUYLSW.exe
  2⤵
  PID:9968
- C:\Windows\System\CbYuGPm.exe
  C:\Windows\System\CbYuGPm.exe
  2⤵
  PID:9984
- C:\Windows\System\xgzxAKN.exe
  C:\Windows\System\xgzxAKN.exe
  2⤵
  PID:10004
- C:\Windows\System\VwWOaQR.exe
  C:\Windows\System\VwWOaQR.exe
  2⤵
  PID:10040
- C:\Windows\System\KsamVbM.exe
  C:\Windows\System\KsamVbM.exe
  2⤵
  PID:10064
- C:\Windows\System\imgNZqA.exe
  C:\Windows\System\imgNZqA.exe
  2⤵
  PID:10080
- C:\Windows\System\ETDmqRZ.exe
  C:\Windows\System\ETDmqRZ.exe
  2⤵
  PID:10096
- C:\Windows\System\VhBJMna.exe
  C:\Windows\System\VhBJMna.exe
  2⤵
  PID:10116
- C:\Windows\System\fytORyW.exe
  C:\Windows\System\fytORyW.exe
  2⤵
  PID:10132
- C:\Windows\System\xOMNxXT.exe
  C:\Windows\System\xOMNxXT.exe
  2⤵
  PID:10152
- C:\Windows\System\xxSgCSh.exe
  C:\Windows\System\xxSgCSh.exe
  2⤵
  PID:10168
- C:\Windows\System\lSuqEIa.exe
  C:\Windows\System\lSuqEIa.exe
  2⤵
  PID:10184
- C:\Windows\System\irRfweV.exe
  C:\Windows\System\irRfweV.exe
  2⤵
  PID:10200
- C:\Windows\System\yQAIshc.exe
  C:\Windows\System\yQAIshc.exe
  2⤵
  PID:10216
- C:\Windows\System\QQpaueK.exe
  C:\Windows\System\QQpaueK.exe
  2⤵
  PID:10236
- C:\Windows\System\SvpwsIY.exe
  C:\Windows\System\SvpwsIY.exe
  2⤵
  PID:8472
- C:\Windows\System\XbzPXrZ.exe
  C:\Windows\System\XbzPXrZ.exe
  2⤵
  PID:9264
- C:\Windows\System\oyIjiPA.exe
  C:\Windows\System\oyIjiPA.exe
  2⤵
  PID:9304
- C:\Windows\System\oVVndgF.exe
  C:\Windows\System\oVVndgF.exe
  2⤵
  PID:9276
- C:\Windows\System\uYBcUyX.exe
  C:\Windows\System\uYBcUyX.exe
  2⤵
  PID:9368
- C:\Windows\System\TOLqvIR.exe
  C:\Windows\System\TOLqvIR.exe
  2⤵
  PID:9432
- C:\Windows\System\QzlXqlx.exe
  C:\Windows\System\QzlXqlx.exe
  2⤵
  PID:9388
- C:\Windows\System\XtnNcgn.exe
  C:\Windows\System\XtnNcgn.exe
  2⤵
  PID:9468
- C:\Windows\System\KrqqQgt.exe
  C:\Windows\System\KrqqQgt.exe
  2⤵
  PID:9504
- C:\Windows\System\XjGaRiY.exe
  C:\Windows\System\XjGaRiY.exe
  2⤵
  PID:9536
- C:\Windows\System\JkxthYC.exe
  C:\Windows\System\JkxthYC.exe
  2⤵
  PID:9556
- C:\Windows\System\NuodrUI.exe
  C:\Windows\System\NuodrUI.exe
  2⤵
  PID:9608
- C:\Windows\System\dvUDyud.exe
  C:\Windows\System\dvUDyud.exe
  2⤵
  PID:9620
- C:\Windows\System\ZmjBEji.exe
  C:\Windows\System\ZmjBEji.exe
  2⤵
  PID:9636
- C:\Windows\System\PvSnCHC.exe
  C:\Windows\System\PvSnCHC.exe
  2⤵
  PID:9684
- C:\Windows\System\aFMsdUR.exe
  C:\Windows\System\aFMsdUR.exe
  2⤵
  PID:9672
- C:\Windows\System\IwHmceK.exe
  C:\Windows\System\IwHmceK.exe
  2⤵
  PID:9756
- C:\Windows\System\MnhsEmY.exe
  C:\Windows\System\MnhsEmY.exe
  2⤵
  PID:9804
- C:\Windows\System\wkboCKh.exe
  C:\Windows\System\wkboCKh.exe
  2⤵
  PID:9820
- C:\Windows\System\sALQMAV.exe
  C:\Windows\System\sALQMAV.exe
  2⤵
  PID:9876
- C:\Windows\System\iTJBkOR.exe
  C:\Windows\System\iTJBkOR.exe
  2⤵
  PID:9880
- C:\Windows\System\OwwmBBn.exe
  C:\Windows\System\OwwmBBn.exe
  2⤵
  PID:9928
- C:\Windows\System\eBxbkuZ.exe
  C:\Windows\System\eBxbkuZ.exe
  2⤵
  PID:9960
- C:\Windows\System\QvrTjwe.exe
  C:\Windows\System\QvrTjwe.exe
  2⤵
  PID:9940
- C:\Windows\System\XmEUhHD.exe
  C:\Windows\System\XmEUhHD.exe
  2⤵
  PID:10060
- C:\Windows\System\PMlMfYn.exe
  C:\Windows\System\PMlMfYn.exe
  2⤵
  PID:10092
- C:\Windows\System\piMqDkV.exe
  C:\Windows\System\piMqDkV.exe
  2⤵
  PID:10128
- C:\Windows\System\zGlmfik.exe
  C:\Windows\System\zGlmfik.exe
  2⤵
  PID:10160
- C:\Windows\System\dqIInVK.exe
  C:\Windows\System\dqIInVK.exe
  2⤵
  PID:10072
- C:\Windows\System\EeHAjVh.exe
  C:\Windows\System\EeHAjVh.exe
  2⤵
  PID:10180
- C:\Windows\System\KjbSdgi.exe
  C:\Windows\System\KjbSdgi.exe
  2⤵
  PID:9324
- C:\Windows\System\weETvsc.exe
  C:\Windows\System\weETvsc.exe
  2⤵
  PID:10212
- C:\Windows\System\dfZLXXS.exe
  C:\Windows\System\dfZLXXS.exe
  2⤵
  PID:9096
- C:\Windows\System\tbcrNcS.exe
  C:\Windows\System\tbcrNcS.exe
  2⤵
  PID:9332
- C:\Windows\System\VyDvqCv.exe
  C:\Windows\System\VyDvqCv.exe
  2⤵
  PID:9344
- C:\Windows\System\BAyhNvm.exe
  C:\Windows\System\BAyhNvm.exe
  2⤵
  PID:9444
- C:\Windows\System\jhcugFO.exe
  C:\Windows\System\jhcugFO.exe
  2⤵
  PID:9484
- C:\Windows\System\PdXzJmC.exe
  C:\Windows\System\PdXzJmC.exe
  2⤵
  PID:9584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdwTBWF.exe

Filesize
1.5MB

MD5
a5216bd9c017baf422b6d86ab230569e

SHA1
51b2d2ef80eb0f358877f36e6606395b67c38353

SHA256
4437b46859bd5f63cdc8452d122a6916e5d6bffe09847b07f7c8a5ad74838270

SHA512
b5d5a4cfcbfad90c3e58461614ce9fb12c8bc6ff27bb3af93fb88505f6c5e38ae48c86c433a333dc06020e7123721b9deb374bbbc9c7e246f124d5104e9235e5

Download Submit
C:\Windows\system\AkZIbkO.exe

Filesize
1.5MB

MD5
217fc800a50225bd26f621ce5169b053

SHA1
86be1f19f3601322549027c610742964eed061fb

SHA256
0abeefd54e4757e4f052c056d70618146a5921753a9063284a349a21e8b23a8c

SHA512
72c185dd03398047021396f8ffe41033567c8327fb39174f136404fe57f54d52708cc819b9cf01d3031987fa2bc6867b162dea86e370ea9027016d7308c3ad7c

Download Submit
C:\Windows\system\DEwsGdD.exe

Filesize
1.5MB

MD5
48cfb48104bfeffa4fb3538595a4bf83

SHA1
c3268ab97e74cb0fae7a09882c4d241e6e6c830b

SHA256
e72b4a1eb6ea8490e54bc395fad1db9c0deb0e14a3ff17887b7b41bf93813d1b

SHA512
99de033244c778c49fcffd8cd2391065fd1b734d4e499bbff0fd3baf7e34f2c777775e98a0606df5d19bab941b0fead1c2cbd72c3c2598af92404d5eeb94a8e5

Download Submit
C:\Windows\system\HzSiOTp.exe

Filesize
1.5MB

MD5
948d47ee6fe22c0b24ed9b6dc3ab9156

SHA1
c34cee13cdfa88c6cf14b017690bafb4d4dcd32d

SHA256
f499366923615a539fcabb23595cbf6ba2dd9f9b7b6c84f639922b39a8ba9f7d

SHA512
20673783c9795f03f78af234756ffeb9b008d73d47b5e4dee69b567c2f2976a52094800bf61ba72ed2b10ab2482477d2a7be6acec5720c9f822c57b4d94051b8

Download Submit
C:\Windows\system\IljIlcw.exe

Filesize
1.5MB

MD5
dc23fe7a3786188a2ec61323003ca29e

SHA1
ecd68ecd9b57cb1d809c2cf64c7485ae9e4f6315

SHA256
2bcd26ee439439596150e6ff74cf6c79afff13374473f9cbd1950b12ad959e35

SHA512
2ecf904b4a21bd2ad7f64ff079f0615e832e679fd52baf08356458a87d2dc671f7ff73d52c1eec13d38a29855736b9abac55d2e65c9dbba93bcf64002f16560d

Download Submit
C:\Windows\system\KvIKMAU.exe

Filesize
1.5MB

MD5
ad5cc231e97d0ec08e8eec6af4f9a0e5

SHA1
7f541d486ff1199e7632e948df33c13d1ddf6f67

SHA256
aea908fcb4e34f2e2d70935f02070eb265a0e915b1406f89a9db64f90c6a9e24

SHA512
51100a960577e1684282c6cd1bb2335ca5800d118103c0f1edcadd953aaa14a01cdd15bb0b1a962527c3f698dc8cefea77c8a78da0c9308c65ce4407a6159446

Download Submit
C:\Windows\system\MssZGDM.exe

Filesize
1.5MB

MD5
9767f55f5e8ae587d60e21e0cb4257f4

SHA1
21bfac036bfc21a8ba749837632fb27028e67dcd

SHA256
e1c5bbb06418c291c663b0f89817217adf8d6dcc636f6b887332079a2776155f

SHA512
4e88c16aa2af484c080da6dce3006150a3a6b7aed629dd10fcf69de59d1a857e4503c3008792d099082667bdc295f2c24556f5ff65138bba82790ac735f0dbab

Download Submit
C:\Windows\system\NVvxsPp.exe

Filesize
1.5MB

MD5
25473f184532e07efcd3ce823973b0e3

SHA1
b0adf4c7e9ec32325a0edc169e327eddc48409e5

SHA256
ae77175d339d18606a172538e9db70b30da195620a1cef7ba6517eebbefa9edc

SHA512
425abcac3a0410f7c26badffd7702915cebf8154d2718efdb53462c91e2d0b7515021ce221213ea67453c625d80f3e6b630fe27350f7b9e219633ebf278a3a45

Download Submit
C:\Windows\system\NjLxoFa.exe

Filesize
1.5MB

MD5
a63eefaa0d2fc78fe60cb79057d0cb37

SHA1
27895a442d76c57cb5082895258e37f615eacb34

SHA256
48e0ac9d86f15dbac6310360cacd76709d19cf237bafc9597cdf63dede350f7b

SHA512
55f49123c932fa773994f254b55fbf28a767ffea7b52e3668052b7736b82a5bcecbd2094f3ff7442890efc3dd83d1bc8d1552e47a75543217b3c1879f344d45a

Download Submit
C:\Windows\system\OanQJkn.exe

Filesize
1.5MB

MD5
227785496fcad788b09d57965e88ccea

SHA1
d1e05f024b0ebe5df1285e24acd4ab4ae4e77fb9

SHA256
fb3972b42c008c860b12d8f383f8567938eab2bfb6b6b57d180fce081ffa4b22

SHA512
82db661c0ee050dec065a25042b0bc304a1aea809d0ea999d292b88e022bc4fcc3ce61d3d011940031cb6cfadee7dc19c9a9ca61b13a92183d979d78cd19a58c

Download Submit
C:\Windows\system\QOXYIVl.exe

Filesize
1.5MB

MD5
dd27d3e8e87b8600c6769d6d55b58a14

SHA1
2df6579fb80551db22044442dd67b80569901b70

SHA256
e9e7d4aa1ead9deb16acf3e4b1527faa75faea9d3161ccb9aeb2c4853d7c63fc

SHA512
7c4cd33e5abc5887110c0dc9d45c6990df54f701379f116358ffb146f381f06ba50bb37673d0693610dddd92e56b162d783f87028009f2d8423f662dd75ff5a8

Download Submit
C:\Windows\system\RgZbcjf.exe

Filesize
1.5MB

MD5
d2c88dc8b8b214cb3cbd200280e0e16e

SHA1
9b09af0c0b8fec22fe966021d0c6332e5cd5f464

SHA256
e0d366746b5810ea67d74766c3daff2718cd6219feae5774b165a9ce85e1e6df

SHA512
cea3d73684ad7674bda66d2a9b429306db12fe68a6223a89acd723de923a5f99e1b3023596eed4ac11216dd371ed6d55f4364c7d4f7823eeed1623ec6c683f3a

Download Submit
C:\Windows\system\TNPplnw.exe

Filesize
1.5MB

MD5
fc517d10885af4b75cefdedfb149140f

SHA1
1bff256655561b448644ab1cda7919f32b355807

SHA256
f377e34227741ba13fd68e03764da72ddfd86678bfe42a2ed50bbcdc87a77b72

SHA512
5b53adcaa3eadec4e6a930976ebed695d3bd81adcb6c235cebb8d1b8d931deb197999ff5f611db1bd9cc296e4245a91deb76f44ca702ba2b3f34f5c4ac37e059

Download Submit
C:\Windows\system\VSHOwTn.exe

Filesize
1.5MB

MD5
18b43ead84a531dd3fd299f11425c983

SHA1
c921a92847c632b768f0bba9e8b0cb8f304b816f

SHA256
c7d906e6c20ca6e7ccbd4c14296e9226799e5de7512be4926d6e4c141f3c2fc6

SHA512
05239abe0aa1dd72bc64a71d4fd1241c6fe5db6af613edfe9d22137cccf0d556a3a29b42ddb2a9fd0a2314de00438b85c72d1f04d605693c24167df0d90130ad

Download Submit
C:\Windows\system\WwtTjEj.exe

Filesize
1.5MB

MD5
dd2cb273cfc63ade6baed38cf5facbf0

SHA1
e24f816fd7bcc27c61b8e608a2c0e07bf1c7b33c

SHA256
96ae10c338408bbbfdfba5ff2e24b811c9b895357050652ff879bbab4722ece0

SHA512
fe4b190e984742fbc053af0fb5abf83dcb0027a935acc9194f5671c486d2bc88603652cf1436b3ce24261c017334f7ecd3a1ddffa831f1a244ad72197add5869

Download Submit
C:\Windows\system\YyJPaCm.exe

Filesize
1.5MB

MD5
5def1a2d952fa372c49ad25aa4ad6eae

SHA1
ceea34e3652be7652ab669dfde398a3dab341e5f

SHA256
1cdeabfa0416bc9d7b1ce1ff8e32463d11b2125a4cf6c495b422dfd5578f4bc1

SHA512
cba15f8224f22430c4f80870b21f5588dbc62f82b8286deebf33582dec42f8e55ec661dd4afcc65b5da5b3b7e2f5dc3488d6a357bfa5df85c66147ccb0587437

Download Submit
C:\Windows\system\acvKSkp.exe

Filesize
1.5MB

MD5
3628f12d35519a582b93840a55b7b4ac

SHA1
45078f9e9a24940fef57eb5b608996b11f20e5b6

SHA256
aa0041636621f940dccacfcc5549ceede737ceee86476b2a5356c892600684c2

SHA512
cd9ee3304a6dc43c860c35d30e3fe797cb16e9d2ad3332140e666664520ffdd91096b5fb2baf4fc92cd02c9203e081a7d1d5ac77b8d03a2b6f2a1c91204af994

Download Submit
C:\Windows\system\hYIbWDD.exe

Filesize
1.5MB

MD5
169540ca4706156e407c603475989f17

SHA1
fdc78d66bf91f347f11df9385d0139082967bef7

SHA256
88e9233dbcd9c65f8053f51065ae85f3e5bdfcdd60c74f93d0b9b5bef269a00f

SHA512
bd27e9bcf9d8b2c324c3ecfd425d1fda9547ea14c783716605a6e88c7f5bd0ff03220e46c1bd60f03e7ac9aa1478c28b2aa19b08de75d518c0e4080b58d38b53

Download Submit
C:\Windows\system\iMnnhxs.exe

Filesize
1.5MB

MD5
4b6db7b406c004588155e3d0d80b2f94

SHA1
6055636d9ffa4f007efa6480c8b2f866200ce4fb

SHA256
98be9ebad329027aa911c241b1f810d95337ccbc3c468cc1dd3320708be4fc49

SHA512
3df4fe6c58bd54ceb076eb7707c0b14a844aade359471988ada0245223ca1cd5f68c021d66d232afcbd97e054f51168e6fd0a3e50462a6b28eea61ef6855abdc

Download Submit
C:\Windows\system\kYLiasc.exe

Filesize
1.5MB

MD5
79eee07139d8251216993ccc9121d9c2

SHA1
0f8edaac1162ea790dcd336af3a8cf8a31b556b8

SHA256
475b5209e865a10a5b8e0a6a619bd13a26c05a67fc3426ed2a3fc6f98f2a49ea

SHA512
49f59ad75802b22bf6a30b40db50024ba84541cf7c3b4a1c706f6be8fda288878968ff9c2fc53cc819d53be21d6db31174039f8b360dad579d70e6c504c3734a

Download Submit
C:\Windows\system\lPhNEnx.exe

Filesize
1.5MB

MD5
d6da3a7b9a64d351aff5a45e4683b0eb

SHA1
09876d24c5c53cb5eac91cd49e77ae455e0c73d4

SHA256
e63ddb8fdd60f50d6138c5303d06dc997c3e3cb9bf5324647e3b6091490b7cc3

SHA512
21d4cdb76a5e6ecd23f7a36b995fcde35198909999e75fb6731a5b0d30edd068ec51c5384a3f8f1bec4d1741016a26f152cbbf4dec4d84699b4efde1a70932f3

Download Submit
C:\Windows\system\liMUxGp.exe

Filesize
1.5MB

MD5
1132d0be323222847bfbb3689f9fda0f

SHA1
8db4a56da2ff5c410796b0148241bb9f8b2d9da3

SHA256
3d504b56b63acc8dca3d4c8816224abe04d52700cafd51e6ed55c1bc8001a0ec

SHA512
520e3f1d2b120298cbc9c3169cd444268ebb228a2f78a06feac6638de9bb863c3902368ccb352e2b496696dab009b94f40ff033addc48aad8e1a543182d35ead

Download Submit
C:\Windows\system\odOsUuJ.exe

Filesize
1.5MB

MD5
3bae1df6cef079cf84b6e5b70d639f0d

SHA1
2d94908a6a5e3d2c8167f3c387c352cef0a6bd58

SHA256
0d7b53ef3f09933f044d482124dd2430b8877ae3f8617e032f0e83174b48b713

SHA512
7c532ca4e51915f7681e892c8ca2ee4b2aa6d8cce021e4591b5707a4ae2e59767595045dfa20a4d97103371a126980cb3069522e8cb74ba8da54b6c5c83f0ca4

Download Submit
C:\Windows\system\qULLkZZ.exe

Filesize
1.5MB

MD5
8090039822fc52786b9e70dace6ab43e

SHA1
8dddbc00a31436d941c8e95a8c769da2107c08f2

SHA256
c5ccaf266e1b6f11da1cd54e201ad7cca26c9c59ed5414d0a940bab7fe1887dd

SHA512
6ec2fabb5f26009191e2185fe681b917169908977ec9f5f3afbba1a7ff7157b09f0e8e2e59bb88d7106b7dc44190c59e55f13735510a947f76bea45cb8559f61

Download Submit
C:\Windows\system\rRTicbz.exe

Filesize
1.5MB

MD5
53dd2f9b9dd8e2840cbe17236911e9b4

SHA1
d845236b2fd9062c8856c2bf02f09f742d1b029f

SHA256
08e0796808e99135d5444769250dc24fa0b4ee945e9538d20b6b01d607fcbeea

SHA512
26388206e36035cbba57dd0e56fa0969cb9636c83cf9eae7f87523178f2e120be0c477950781b3096e1aee1131e75ccecb4156441ba534c749d72081bc44472f

Download Submit
C:\Windows\system\rUVisQq.exe

Filesize
1.5MB

MD5
bde09225482affd2cced274ed5aadd1c

SHA1
02b1e82cfbafcca7678ede645135b622a7b02925

SHA256
d0159d235197b652adbc962324caeef7486ef53aac87faaf06afc464d92298e2

SHA512
8de6731bfcb8129d37a24b6d33b4486acd406027c793378f99a81bf7c8a14bb95147a05925682e849915009e3590778a2d8e99d1e738aacd9fdccbb361396f76

Download Submit
C:\Windows\system\tLvajzK.exe

Filesize
1.5MB

MD5
b490685bacd87684e1e9888bc1aef2a3

SHA1
c5171a3be934ddf490f3582e6c46dd845f521d2d

SHA256
6349128041945a71b2c2f6f825cd9c5bf8700a42bbbb4d3408c179f0ae5c0135

SHA512
da26adc2217c02276cdf26f26f42d5879de11cbeebf49aed25a2081b5bc65f0ce0d49666f9ff581cf42518b054235bd2d600f52b64ab97ff602493f9444b96ff

Download Submit
C:\Windows\system\vMXzYXs.exe

Filesize
1.5MB

MD5
41e90881f06cc6ae527532941c0b895b

SHA1
9df08ff0b9b2850286bcc4d2efdbdd9bfc598e2b

SHA256
8d456784581ce5946d3b142f99e54ef72e6a9567127708a7a74382ee3a483a26

SHA512
996bc94593eb10ef23476427f19540751ff162b3351d2a511fa02939ef23008cdff4eaf62546684735258681c93bfc5dd90ae033bcead51b1deedebe525fe1ed

Download Submit
C:\Windows\system\wDZWbhb.exe

Filesize
1.5MB

MD5
2609b6b214b64ab480790e3de2387eee

SHA1
1933ff0deb56396c77e3e186dbb1ad1d030faa0d

SHA256
a0da5181f6549a27ae50e4352b0db9b4fda740d29c1765ccd0fdffe475446607

SHA512
681e3ff42f5173880228f7c0028eea1641b2a110852c8909fb3e79f09934223fed11e183a9ad5b6e7220d7a68a0939e42fadaf12782d68784b107a3b94a955ac

Download Submit
C:\Windows\system\yqabdLQ.exe

Filesize
1.5MB

MD5
984b33c7f014fed7b143cf36d54f0140

SHA1
fe83573a2a847076aa6859765d4aa54e18eba5cb

SHA256
cbd8e8a1e6d7ca964c760ea35e6667e32193e7c5633d3667930d6a074a7ee5d2

SHA512
e52a86dc8156aaca3f48967b73f87bbbf75c9fd3abf19bb3409e24054e33f773e910b851a2f349ec6c8b0eb309e01c4657d0b31a41d313d55d8431f0a2e322cb

Download Submit
\Windows\system\MdpIgob.exe

Filesize
1.5MB

MD5
db6e2d61d693b6659cb9297dd362fb92

SHA1
8aec5f9b7d276491b3987c785a7058d95e967c47

SHA256
bb06401c1ce010aa2e31f06f5a01228623f72bf36addac2c561926278165aca1

SHA512
60e2736a6eeaba16252262c3f3d5c8faec69fb0c3ac562e2239daa0f7de689a2bf4e09e7dfbb0627563111549cea51a8b4d73784cbe6a7e0db034cf703c7844a

Download Submit
\Windows\system\zLGFANI.exe

Filesize
1.5MB

MD5
d2c4af7701f1a2e2f6dac9ced4a33f8b

SHA1
7895a2a9fc7416bf239a59d0511ed216e1a061a9

SHA256
abfb9805f2a998b7ad29d41866ef93f8877f358552b3991712996bca055ae056

SHA512
027b0d2a355ac5b667e062e391059acbe9988ffcbe84d85069680caa829f0fd93ed43e108cf8cbae0187497f948c326689af09b6c19df02793e00a5ed86dd132

Download Submit
memory/1688-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download