strela | 65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcf

Analysis

max time kernel
84s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 06:38 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
Size

1.9MB
MD5

aed26e5d6ecb8411abdbbce9d71c29d0
SHA1

f641103468335f210d9e1c2b5ba55faca2ecf373
SHA256

65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcf
SHA512

d4304fb1c0bb6895ed4caa835563a3ef1a3eb14ffac84267ab28509a1e9023890aa6b729ba5303731d81c8c6e6d43e1a7b4257c4f45a023d3a291c0bae1109f4
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQHxJ1U/QjT:oemTLkNdfE0pZrQN

Score

10^/10

strela xmrig miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/540-2593-0x000000013FA30000-0x000000013FD84000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/540-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016eb8-17.dat	xmrig
behavioral1/files/0x000b0000000122ea-21.dat	xmrig
behavioral1/files/0x00080000000190e1-35.dat	xmrig
behavioral1/files/0x000500000001926c-79.dat	xmrig
behavioral1/files/0x000500000001929a-94.dat	xmrig
behavioral1/files/0x00050000000193b3-124.dat	xmrig
behavioral1/memory/2308-921-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/896-923-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/2680-994-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/memory/2316-1014-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/284-1011-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/memory/2508-1009-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/memory/2988-992-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2780-987-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/2672-954-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2760-937-0x000000013FA30000-0x000000013FD84000-memory.dmp	xmrig
behavioral1/memory/1944-934-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2812-926-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/files/0x0005000000019479-164.dat	xmrig
behavioral1/files/0x000500000001946a-159.dat	xmrig
behavioral1/files/0x0005000000019465-153.dat	xmrig
behavioral1/files/0x000500000001945b-149.dat	xmrig
behavioral1/files/0x0005000000019450-144.dat	xmrig
behavioral1/files/0x0005000000019446-139.dat	xmrig
behavioral1/files/0x0005000000019433-134.dat	xmrig
behavioral1/files/0x00050000000193c1-129.dat	xmrig
behavioral1/files/0x00050000000193a4-119.dat	xmrig
behavioral1/files/0x0005000000019387-114.dat	xmrig
behavioral1/files/0x0005000000019377-109.dat	xmrig
behavioral1/files/0x0005000000019365-104.dat	xmrig
behavioral1/files/0x0005000000019319-99.dat	xmrig
behavioral1/files/0x0005000000019278-89.dat	xmrig
behavioral1/files/0x0005000000019275-84.dat	xmrig
behavioral1/files/0x0005000000019268-74.dat	xmrig
behavioral1/files/0x0005000000019259-69.dat	xmrig
behavioral1/files/0x0005000000019217-60.dat	xmrig
behavioral1/files/0x0005000000019240-63.dat	xmrig
behavioral1/files/0x0008000000017400-47.dat	xmrig
behavioral1/files/0x0007000000016edb-45.dat	xmrig
behavioral1/files/0x00050000000191d2-41.dat	xmrig
behavioral1/files/0x00050000000191f6-50.dat	xmrig
behavioral1/files/0x000700000001707c-38.dat	xmrig
behavioral1/memory/1740-29-0x000000013F090000-0x000000013F3E4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016de4-28.dat	xmrig
behavioral1/memory/2020-20-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016dd0-16.dat	xmrig
behavioral1/memory/540-2283-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2308-2402-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/1740-4052-0x000000013F090000-0x000000013F3E4000-memory.dmp	xmrig
behavioral1/memory/2020-4053-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/2316-4054-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/896-4055-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/1944-4056-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2760-4057-0x000000013FA30000-0x000000013FD84000-memory.dmp	xmrig
behavioral1/memory/2672-4058-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2680-4060-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/memory/2780-4064-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/2508-4063-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/memory/284-4062-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/memory/2988-4061-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2812-4059-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/2308-4065-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2020	poPZBNM.exe
1740	veFQLiu.exe
2316	EwEwoOf.exe
2308	MQMFtHs.exe
896	QsstspI.exe
2812	TwHrOIC.exe
1944	VitWgxc.exe
2760	kUkZzHs.exe
2672	iSVDJFG.exe
2780	XKCrEPm.exe
2988	OgOGgSF.exe
2680	JRGhJda.exe
2508	GnCLnqr.exe
284	dJjOLkj.exe
2992	ZpUQqWS.exe
2984	AVjSghY.exe
584	hseYFEo.exe
1744	amdnIdL.exe
2740	bEWSaWN.exe
2008	AhQUXUN.exe
2392	YhIWzFA.exe
2404	zPlBLJS.exe
752	OhsAfNW.exe
2728	bjgQaWq.exe
1980	SJxRrja.exe
2148	JPqtXKE.exe
2116	QhgdlSQ.exe
2112	vTFdfAK.exe
1532	jqygMRa.exe
448	nzkyZPP.exe
2372	ZWjUFlZ.exe
700	GZYdlQp.exe
1516	UeAFQSH.exe
692	StJcKQp.exe
1984	ABJFXCE.exe
764	dNuZotJ.exe
1684	NrgHGsG.exe
2368	NrYDUQU.exe
936	TwZSxRD.exe
2788	YjteuRp.exe
1536	ujhJvzu.exe
2484	FXuFbAV.exe
1016	OXUAvaV.exe
2212	LBcWViz.exe
1932	ULNXICd.exe
1804	lgtltFC.exe
2344	dGZztuC.exe
1572	hHfAdsQ.exe
756	AIpDCjI.exe
2396	hfXxCni.exe
1236	qGdmpkv.exe
1680	lvxpiDe.exe
1252	dkTnZfk.exe
1172	mfgtxri.exe
2296	vpsiPRy.exe
2040	KqCVnle.exe
2488	ikmFFrh.exe
2616	YFidQor.exe
2548	fRqXwER.exe
2620	ptdQbwZ.exe
2784	DmuqWDW.exe
2512	RKdLlef.exe
2676	vVbKBVO.exe
2564	IFNDfTz.exe

Loads dropped DLL 64 IoCs

pid	Process
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/540-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/files/0x0007000000016eb8-17.dat	upx
behavioral1/files/0x000b0000000122ea-21.dat	upx
behavioral1/files/0x00080000000190e1-35.dat	upx
behavioral1/files/0x000500000001926c-79.dat	upx
behavioral1/files/0x000500000001929a-94.dat	upx
behavioral1/files/0x00050000000193b3-124.dat	upx
behavioral1/memory/2308-921-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/896-923-0x000000013F470000-0x000000013F7C4000-memory.dmp	upx
behavioral1/memory/2680-994-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2316-1014-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/284-1011-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/memory/2508-1009-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/2988-992-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2780-987-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/2672-954-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/memory/2760-937-0x000000013FA30000-0x000000013FD84000-memory.dmp	upx
behavioral1/memory/1944-934-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2812-926-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/files/0x0005000000019479-164.dat	upx
behavioral1/files/0x000500000001946a-159.dat	upx
behavioral1/files/0x0005000000019465-153.dat	upx
behavioral1/files/0x000500000001945b-149.dat	upx
behavioral1/files/0x0005000000019450-144.dat	upx
behavioral1/files/0x0005000000019446-139.dat	upx
behavioral1/files/0x0005000000019433-134.dat	upx
behavioral1/files/0x00050000000193c1-129.dat	upx
behavioral1/files/0x00050000000193a4-119.dat	upx
behavioral1/files/0x0005000000019387-114.dat	upx
behavioral1/files/0x0005000000019377-109.dat	upx
behavioral1/files/0x0005000000019365-104.dat	upx
behavioral1/files/0x0005000000019319-99.dat	upx
behavioral1/files/0x0005000000019278-89.dat	upx
behavioral1/files/0x0005000000019275-84.dat	upx
behavioral1/files/0x0005000000019268-74.dat	upx
behavioral1/files/0x0005000000019259-69.dat	upx
behavioral1/files/0x0005000000019217-60.dat	upx
behavioral1/files/0x0005000000019240-63.dat	upx
behavioral1/files/0x0008000000017400-47.dat	upx
behavioral1/files/0x0007000000016edb-45.dat	upx
behavioral1/files/0x00050000000191d2-41.dat	upx
behavioral1/files/0x00050000000191f6-50.dat	upx
behavioral1/files/0x000700000001707c-38.dat	upx
behavioral1/memory/1740-29-0x000000013F090000-0x000000013F3E4000-memory.dmp	upx
behavioral1/files/0x0008000000016de4-28.dat	upx
behavioral1/memory/2020-20-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x0008000000016dd0-16.dat	upx
behavioral1/memory/540-2283-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2308-2402-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/1740-4052-0x000000013F090000-0x000000013F3E4000-memory.dmp	upx
behavioral1/memory/2020-4053-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2316-4054-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/896-4055-0x000000013F470000-0x000000013F7C4000-memory.dmp	upx
behavioral1/memory/1944-4056-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2760-4057-0x000000013FA30000-0x000000013FD84000-memory.dmp	upx
behavioral1/memory/2672-4058-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/memory/2680-4060-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2780-4064-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/2508-4063-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/284-4062-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/memory/2988-4061-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2812-4059-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/2308-4065-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PRppCgw.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\MmvlgyT.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\VitWgxc.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\BZdxPRv.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\HlRzahP.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\LcYhdHM.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\EfYTuGb.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\iEHRfCw.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\OlspNQb.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\uCtWLMl.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\lIrgWyU.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\CWPZaYS.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\xhshVfb.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\VlTCPYA.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\VNeSTLL.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\XKCrEPm.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\CKIzCBu.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\HbYTsqQ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\EAtwmgz.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\EyQasEA.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\jtsxZlh.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\SPyDCtc.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\lVjqzPa.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\XYJfolv.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\GDWQPYx.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\rsCPKYQ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\StJcKQp.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\DVWkpBz.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\hbHJoDw.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\viEXXyi.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\UOfMmWe.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\SOvOVSO.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\swVghcp.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\AerOQPS.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\ikGdkqt.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\HeFJKrq.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\JwEAgWa.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\WmHuRCH.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\kctWVLK.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\evApfHT.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\DaOXaaZ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\IZJVVcQ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\SflSZVH.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\lRasnzI.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\kzyAUqp.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\ENwzmIo.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\mRtZdSN.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\FomjUcH.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\UqOvpYb.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\dbAKCVI.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\KjaRSLb.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\jiKBRjs.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\OHNoALZ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\slvuFEH.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\fcuEeGY.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\nDTjgZe.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\gxqFLyu.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\pclfeiO.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\JwExVeZ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\LXyhEUV.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\uCGJWVc.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\ubAGWAZ.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\gssMPph.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
File created	C:\Windows\System\dvjSvYd.exe	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2316	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	32
PID 540 wrote to memory of 2316	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	32
PID 540 wrote to memory of 2316	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	32
PID 540 wrote to memory of 2020	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	33
PID 540 wrote to memory of 2020	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	33
PID 540 wrote to memory of 2020	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	33
PID 540 wrote to memory of 2308	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	34
PID 540 wrote to memory of 2308	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	34
PID 540 wrote to memory of 2308	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	34
PID 540 wrote to memory of 1740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	35
PID 540 wrote to memory of 1740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	35
PID 540 wrote to memory of 1740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	35
PID 540 wrote to memory of 1944	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	36
PID 540 wrote to memory of 1944	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	36
PID 540 wrote to memory of 1944	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	36
PID 540 wrote to memory of 896	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	37
PID 540 wrote to memory of 896	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	37
PID 540 wrote to memory of 896	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	37
PID 540 wrote to memory of 2760	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	38
PID 540 wrote to memory of 2760	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	38
PID 540 wrote to memory of 2760	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	38
PID 540 wrote to memory of 2812	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	39
PID 540 wrote to memory of 2812	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	39
PID 540 wrote to memory of 2812	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	39
PID 540 wrote to memory of 2780	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	40
PID 540 wrote to memory of 2780	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	40
PID 540 wrote to memory of 2780	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	40
PID 540 wrote to memory of 2672	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	41
PID 540 wrote to memory of 2672	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	41
PID 540 wrote to memory of 2672	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	41
PID 540 wrote to memory of 2988	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	42
PID 540 wrote to memory of 2988	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	42
PID 540 wrote to memory of 2988	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	42
PID 540 wrote to memory of 2680	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	43
PID 540 wrote to memory of 2680	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	43
PID 540 wrote to memory of 2680	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	43
PID 540 wrote to memory of 2508	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	44
PID 540 wrote to memory of 2508	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	44
PID 540 wrote to memory of 2508	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	44
PID 540 wrote to memory of 284	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	45
PID 540 wrote to memory of 284	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	45
PID 540 wrote to memory of 284	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	45
PID 540 wrote to memory of 2992	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	46
PID 540 wrote to memory of 2992	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	46
PID 540 wrote to memory of 2992	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	46
PID 540 wrote to memory of 2984	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	47
PID 540 wrote to memory of 2984	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	47
PID 540 wrote to memory of 2984	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	47
PID 540 wrote to memory of 584	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	48
PID 540 wrote to memory of 584	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	48
PID 540 wrote to memory of 584	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	48
PID 540 wrote to memory of 1744	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	49
PID 540 wrote to memory of 1744	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	49
PID 540 wrote to memory of 1744	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	49
PID 540 wrote to memory of 2740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	50
PID 540 wrote to memory of 2740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	50
PID 540 wrote to memory of 2740	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	50
PID 540 wrote to memory of 2008	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	51
PID 540 wrote to memory of 2008	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	51
PID 540 wrote to memory of 2008	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	51
PID 540 wrote to memory of 2392	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	52
PID 540 wrote to memory of 2392	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	52
PID 540 wrote to memory of 2392	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	52
PID 540 wrote to memory of 2404	540	65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe	53

C:\Users\Admin\AppData\Local\Temp\65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe
"C:\Users\Admin\AppData\Local\Temp\65814ba6262f7bb543c1ecdea63dd830c02d6cae44dcdfa80755db312bf2cbcfN.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System\EwEwoOf.exe
  C:\Windows\System\EwEwoOf.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\poPZBNM.exe
  C:\Windows\System\poPZBNM.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\MQMFtHs.exe
  C:\Windows\System\MQMFtHs.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\veFQLiu.exe
  C:\Windows\System\veFQLiu.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\VitWgxc.exe
  C:\Windows\System\VitWgxc.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\QsstspI.exe
  C:\Windows\System\QsstspI.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\kUkZzHs.exe
  C:\Windows\System\kUkZzHs.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\TwHrOIC.exe
  C:\Windows\System\TwHrOIC.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\XKCrEPm.exe
  C:\Windows\System\XKCrEPm.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\iSVDJFG.exe
  C:\Windows\System\iSVDJFG.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OgOGgSF.exe
  C:\Windows\System\OgOGgSF.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\JRGhJda.exe
  C:\Windows\System\JRGhJda.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\GnCLnqr.exe
  C:\Windows\System\GnCLnqr.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\dJjOLkj.exe
  C:\Windows\System\dJjOLkj.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\ZpUQqWS.exe
  C:\Windows\System\ZpUQqWS.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\AVjSghY.exe
  C:\Windows\System\AVjSghY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\hseYFEo.exe
  C:\Windows\System\hseYFEo.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\amdnIdL.exe
  C:\Windows\System\amdnIdL.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\bEWSaWN.exe
  C:\Windows\System\bEWSaWN.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\AhQUXUN.exe
  C:\Windows\System\AhQUXUN.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\YhIWzFA.exe
  C:\Windows\System\YhIWzFA.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\zPlBLJS.exe
  C:\Windows\System\zPlBLJS.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\OhsAfNW.exe
  C:\Windows\System\OhsAfNW.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\bjgQaWq.exe
  C:\Windows\System\bjgQaWq.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\SJxRrja.exe
  C:\Windows\System\SJxRrja.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\JPqtXKE.exe
  C:\Windows\System\JPqtXKE.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\QhgdlSQ.exe
  C:\Windows\System\QhgdlSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\vTFdfAK.exe
  C:\Windows\System\vTFdfAK.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\jqygMRa.exe
  C:\Windows\System\jqygMRa.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\nzkyZPP.exe
  C:\Windows\System\nzkyZPP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\ZWjUFlZ.exe
  C:\Windows\System\ZWjUFlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\GZYdlQp.exe
  C:\Windows\System\GZYdlQp.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\UeAFQSH.exe
  C:\Windows\System\UeAFQSH.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\StJcKQp.exe
  C:\Windows\System\StJcKQp.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ABJFXCE.exe
  C:\Windows\System\ABJFXCE.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\dNuZotJ.exe
  C:\Windows\System\dNuZotJ.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\NrgHGsG.exe
  C:\Windows\System\NrgHGsG.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\NrYDUQU.exe
  C:\Windows\System\NrYDUQU.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\TwZSxRD.exe
  C:\Windows\System\TwZSxRD.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\YjteuRp.exe
  C:\Windows\System\YjteuRp.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ujhJvzu.exe
  C:\Windows\System\ujhJvzu.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\FXuFbAV.exe
  C:\Windows\System\FXuFbAV.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OXUAvaV.exe
  C:\Windows\System\OXUAvaV.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\LBcWViz.exe
  C:\Windows\System\LBcWViz.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ULNXICd.exe
  C:\Windows\System\ULNXICd.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\lgtltFC.exe
  C:\Windows\System\lgtltFC.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\dGZztuC.exe
  C:\Windows\System\dGZztuC.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\hHfAdsQ.exe
  C:\Windows\System\hHfAdsQ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\AIpDCjI.exe
  C:\Windows\System\AIpDCjI.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\hfXxCni.exe
  C:\Windows\System\hfXxCni.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\qGdmpkv.exe
  C:\Windows\System\qGdmpkv.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\lvxpiDe.exe
  C:\Windows\System\lvxpiDe.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\dkTnZfk.exe
  C:\Windows\System\dkTnZfk.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\mfgtxri.exe
  C:\Windows\System\mfgtxri.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\vpsiPRy.exe
  C:\Windows\System\vpsiPRy.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\KqCVnle.exe
  C:\Windows\System\KqCVnle.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\ikmFFrh.exe
  C:\Windows\System\ikmFFrh.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\YFidQor.exe
  C:\Windows\System\YFidQor.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\fRqXwER.exe
  C:\Windows\System\fRqXwER.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ptdQbwZ.exe
  C:\Windows\System\ptdQbwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\DmuqWDW.exe
  C:\Windows\System\DmuqWDW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\RKdLlef.exe
  C:\Windows\System\RKdLlef.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vVbKBVO.exe
  C:\Windows\System\vVbKBVO.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\IFNDfTz.exe
  C:\Windows\System\IFNDfTz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\KUbkIit.exe
  C:\Windows\System\KUbkIit.exe
  2⤵
  PID:1792
- C:\Windows\System\aKRpFcv.exe
  C:\Windows\System\aKRpFcv.exe
  2⤵
  PID:1752
- C:\Windows\System\IasbUWw.exe
  C:\Windows\System\IasbUWw.exe
  2⤵
  PID:2024
- C:\Windows\System\gIWsYvP.exe
  C:\Windows\System\gIWsYvP.exe
  2⤵
  PID:2828
- C:\Windows\System\JwExVeZ.exe
  C:\Windows\System\JwExVeZ.exe
  2⤵
  PID:856
- C:\Windows\System\AerOQPS.exe
  C:\Windows\System\AerOQPS.exe
  2⤵
  PID:2724
- C:\Windows\System\bDkMPKw.exe
  C:\Windows\System\bDkMPKw.exe
  2⤵
  PID:2844
- C:\Windows\System\yAScqBO.exe
  C:\Windows\System\yAScqBO.exe
  2⤵
  PID:2688
- C:\Windows\System\suUtCMs.exe
  C:\Windows\System\suUtCMs.exe
  2⤵
  PID:300
- C:\Windows\System\dKOBTNm.exe
  C:\Windows\System\dKOBTNm.exe
  2⤵
  PID:2712
- C:\Windows\System\kVYDTKJ.exe
  C:\Windows\System\kVYDTKJ.exe
  2⤵
  PID:836
- C:\Windows\System\FMsMgaF.exe
  C:\Windows\System\FMsMgaF.exe
  2⤵
  PID:2336
- C:\Windows\System\HLnBbcz.exe
  C:\Windows\System\HLnBbcz.exe
  2⤵
  PID:1660
- C:\Windows\System\TdHkUDc.exe
  C:\Windows\System\TdHkUDc.exe
  2⤵
  PID:1876
- C:\Windows\System\hxczutn.exe
  C:\Windows\System\hxczutn.exe
  2⤵
  PID:2264
- C:\Windows\System\ziCJDmC.exe
  C:\Windows\System\ziCJDmC.exe
  2⤵
  PID:3064
- C:\Windows\System\SCaCWVd.exe
  C:\Windows\System\SCaCWVd.exe
  2⤵
  PID:1524
- C:\Windows\System\keymUPU.exe
  C:\Windows\System\keymUPU.exe
  2⤵
  PID:1936
- C:\Windows\System\SnjNJJx.exe
  C:\Windows\System\SnjNJJx.exe
  2⤵
  PID:2052
- C:\Windows\System\FLPcvkb.exe
  C:\Windows\System\FLPcvkb.exe
  2⤵
  PID:2236
- C:\Windows\System\rwVTKHi.exe
  C:\Windows\System\rwVTKHi.exe
  2⤵
  PID:2084
- C:\Windows\System\NqgtoMf.exe
  C:\Windows\System\NqgtoMf.exe
  2⤵
  PID:2176
- C:\Windows\System\jWBmFLa.exe
  C:\Windows\System\jWBmFLa.exe
  2⤵
  PID:2892
- C:\Windows\System\DVWkpBz.exe
  C:\Windows\System\DVWkpBz.exe
  2⤵
  PID:1588
- C:\Windows\System\fXEaKjs.exe
  C:\Windows\System\fXEaKjs.exe
  2⤵
  PID:3008
- C:\Windows\System\aJfjVVq.exe
  C:\Windows\System\aJfjVVq.exe
  2⤵
  PID:2284
- C:\Windows\System\zGrrptj.exe
  C:\Windows\System\zGrrptj.exe
  2⤵
  PID:2328
- C:\Windows\System\ZUpTUPk.exe
  C:\Windows\System\ZUpTUPk.exe
  2⤵
  PID:3044
- C:\Windows\System\FgyIYNE.exe
  C:\Windows\System\FgyIYNE.exe
  2⤵
  PID:2800
- C:\Windows\System\cFpEEET.exe
  C:\Windows\System\cFpEEET.exe
  2⤵
  PID:2976
- C:\Windows\System\jvrVtNZ.exe
  C:\Windows\System\jvrVtNZ.exe
  2⤵
  PID:1488
- C:\Windows\System\xzixKGc.exe
  C:\Windows\System\xzixKGc.exe
  2⤵
  PID:1324
- C:\Windows\System\kzyAUqp.exe
  C:\Windows\System\kzyAUqp.exe
  2⤵
  PID:2340
- C:\Windows\System\PoXDvmW.exe
  C:\Windows\System\PoXDvmW.exe
  2⤵
  PID:1756
- C:\Windows\System\EJCzqzd.exe
  C:\Windows\System\EJCzqzd.exe
  2⤵
  PID:2120
- C:\Windows\System\gUSvlnC.exe
  C:\Windows\System\gUSvlnC.exe
  2⤵
  PID:1332
- C:\Windows\System\boZsFJq.exe
  C:\Windows\System\boZsFJq.exe
  2⤵
  PID:1620
- C:\Windows\System\MNGvbTC.exe
  C:\Windows\System\MNGvbTC.exe
  2⤵
  PID:680
- C:\Windows\System\mtSmLTN.exe
  C:\Windows\System\mtSmLTN.exe
  2⤵
  PID:644
- C:\Windows\System\ecULSRi.exe
  C:\Windows\System\ecULSRi.exe
  2⤵
  PID:3088
- C:\Windows\System\EdnwujB.exe
  C:\Windows\System\EdnwujB.exe
  2⤵
  PID:3108
- C:\Windows\System\iKJpvUp.exe
  C:\Windows\System\iKJpvUp.exe
  2⤵
  PID:3132
- C:\Windows\System\lMpzZut.exe
  C:\Windows\System\lMpzZut.exe
  2⤵
  PID:3152
- C:\Windows\System\rKLSChM.exe
  C:\Windows\System\rKLSChM.exe
  2⤵
  PID:3168
- C:\Windows\System\JMiQNSK.exe
  C:\Windows\System\JMiQNSK.exe
  2⤵
  PID:3188
- C:\Windows\System\rPCUEjM.exe
  C:\Windows\System\rPCUEjM.exe
  2⤵
  PID:3208
- C:\Windows\System\LqkxNmP.exe
  C:\Windows\System\LqkxNmP.exe
  2⤵
  PID:3232
- C:\Windows\System\BXxQvVp.exe
  C:\Windows\System\BXxQvVp.exe
  2⤵
  PID:3248
- C:\Windows\System\XGcxWdy.exe
  C:\Windows\System\XGcxWdy.exe
  2⤵
  PID:3268
- C:\Windows\System\iTkvind.exe
  C:\Windows\System\iTkvind.exe
  2⤵
  PID:3288
- C:\Windows\System\sWWYilp.exe
  C:\Windows\System\sWWYilp.exe
  2⤵
  PID:3312
- C:\Windows\System\RxPvqFT.exe
  C:\Windows\System\RxPvqFT.exe
  2⤵
  PID:3332
- C:\Windows\System\rCuNKhZ.exe
  C:\Windows\System\rCuNKhZ.exe
  2⤵
  PID:3352
- C:\Windows\System\rSiYJgH.exe
  C:\Windows\System\rSiYJgH.exe
  2⤵
  PID:3368
- C:\Windows\System\iEHRfCw.exe
  C:\Windows\System\iEHRfCw.exe
  2⤵
  PID:3388
- C:\Windows\System\BBgFbrA.exe
  C:\Windows\System\BBgFbrA.exe
  2⤵
  PID:3408
- C:\Windows\System\fcuEeGY.exe
  C:\Windows\System\fcuEeGY.exe
  2⤵
  PID:3432
- C:\Windows\System\KaBpMjp.exe
  C:\Windows\System\KaBpMjp.exe
  2⤵
  PID:3448
- C:\Windows\System\AZHuScj.exe
  C:\Windows\System\AZHuScj.exe
  2⤵
  PID:3468
- C:\Windows\System\oZWQuru.exe
  C:\Windows\System\oZWQuru.exe
  2⤵
  PID:3488
- C:\Windows\System\kxRaSNY.exe
  C:\Windows\System\kxRaSNY.exe
  2⤵
  PID:3508
- C:\Windows\System\TjgNtqV.exe
  C:\Windows\System\TjgNtqV.exe
  2⤵
  PID:3528
- C:\Windows\System\fCPCBmL.exe
  C:\Windows\System\fCPCBmL.exe
  2⤵
  PID:3552
- C:\Windows\System\sOYZvlg.exe
  C:\Windows\System\sOYZvlg.exe
  2⤵
  PID:3568
- C:\Windows\System\NtNarUz.exe
  C:\Windows\System\NtNarUz.exe
  2⤵
  PID:3592
- C:\Windows\System\HGvcjxJ.exe
  C:\Windows\System\HGvcjxJ.exe
  2⤵
  PID:3608
- C:\Windows\System\zkRkrdz.exe
  C:\Windows\System\zkRkrdz.exe
  2⤵
  PID:3632
- C:\Windows\System\mDBRZDT.exe
  C:\Windows\System\mDBRZDT.exe
  2⤵
  PID:3648
- C:\Windows\System\IEDTCwU.exe
  C:\Windows\System\IEDTCwU.exe
  2⤵
  PID:3672
- C:\Windows\System\pEsRLng.exe
  C:\Windows\System\pEsRLng.exe
  2⤵
  PID:3688
- C:\Windows\System\aTilObw.exe
  C:\Windows\System\aTilObw.exe
  2⤵
  PID:3712
- C:\Windows\System\YfRdnPM.exe
  C:\Windows\System\YfRdnPM.exe
  2⤵
  PID:3732
- C:\Windows\System\WmvtXod.exe
  C:\Windows\System\WmvtXod.exe
  2⤵
  PID:3752
- C:\Windows\System\ocQXaNN.exe
  C:\Windows\System\ocQXaNN.exe
  2⤵
  PID:3772
- C:\Windows\System\YOAJArM.exe
  C:\Windows\System\YOAJArM.exe
  2⤵
  PID:3792
- C:\Windows\System\BYZhmwg.exe
  C:\Windows\System\BYZhmwg.exe
  2⤵
  PID:3812
- C:\Windows\System\PKbuVeh.exe
  C:\Windows\System\PKbuVeh.exe
  2⤵
  PID:3832
- C:\Windows\System\OBBzQso.exe
  C:\Windows\System\OBBzQso.exe
  2⤵
  PID:3852
- C:\Windows\System\diCPVag.exe
  C:\Windows\System\diCPVag.exe
  2⤵
  PID:3872
- C:\Windows\System\YiGfPXi.exe
  C:\Windows\System\YiGfPXi.exe
  2⤵
  PID:3892
- C:\Windows\System\fwYLlcS.exe
  C:\Windows\System\fwYLlcS.exe
  2⤵
  PID:3908
- C:\Windows\System\OMbcZaM.exe
  C:\Windows\System\OMbcZaM.exe
  2⤵
  PID:3932
- C:\Windows\System\EAtwmgz.exe
  C:\Windows\System\EAtwmgz.exe
  2⤵
  PID:3948
- C:\Windows\System\kNlaqwg.exe
  C:\Windows\System\kNlaqwg.exe
  2⤵
  PID:3972
- C:\Windows\System\fpSjOSp.exe
  C:\Windows\System\fpSjOSp.exe
  2⤵
  PID:3992
- C:\Windows\System\MFOKQys.exe
  C:\Windows\System\MFOKQys.exe
  2⤵
  PID:4012
- C:\Windows\System\yMhOZvp.exe
  C:\Windows\System\yMhOZvp.exe
  2⤵
  PID:4032
- C:\Windows\System\CKIzCBu.exe
  C:\Windows\System\CKIzCBu.exe
  2⤵
  PID:4052
- C:\Windows\System\sdleNNB.exe
  C:\Windows\System\sdleNNB.exe
  2⤵
  PID:4072
- C:\Windows\System\CKNoBRH.exe
  C:\Windows\System\CKNoBRH.exe
  2⤵
  PID:4092
- C:\Windows\System\aFysSVU.exe
  C:\Windows\System\aFysSVU.exe
  2⤵
  PID:1188
- C:\Windows\System\xmrvIUL.exe
  C:\Windows\System\xmrvIUL.exe
  2⤵
  PID:876
- C:\Windows\System\GYRYMJP.exe
  C:\Windows\System\GYRYMJP.exe
  2⤵
  PID:984
- C:\Windows\System\mkVviIs.exe
  C:\Windows\System\mkVviIs.exe
  2⤵
  PID:2920
- C:\Windows\System\mhuEBUS.exe
  C:\Windows\System\mhuEBUS.exe
  2⤵
  PID:2004
- C:\Windows\System\vIUKYAc.exe
  C:\Windows\System\vIUKYAc.exe
  2⤵
  PID:1828
- C:\Windows\System\uUXpKKn.exe
  C:\Windows\System\uUXpKKn.exe
  2⤵
  PID:1716
- C:\Windows\System\XStOJxl.exe
  C:\Windows\System\XStOJxl.exe
  2⤵
  PID:2352
- C:\Windows\System\ygKgzhN.exe
  C:\Windows\System\ygKgzhN.exe
  2⤵
  PID:2576
- C:\Windows\System\xLLjNwK.exe
  C:\Windows\System\xLLjNwK.exe
  2⤵
  PID:1500
- C:\Windows\System\UEugNvs.exe
  C:\Windows\System\UEugNvs.exe
  2⤵
  PID:536
- C:\Windows\System\bbGAuBt.exe
  C:\Windows\System\bbGAuBt.exe
  2⤵
  PID:2136
- C:\Windows\System\njNobIL.exe
  C:\Windows\System\njNobIL.exe
  2⤵
  PID:1732
- C:\Windows\System\UUjDQRx.exe
  C:\Windows\System\UUjDQRx.exe
  2⤵
  PID:408
- C:\Windows\System\GcgUJip.exe
  C:\Windows\System\GcgUJip.exe
  2⤵
  PID:3104
- C:\Windows\System\abpYtVK.exe
  C:\Windows\System\abpYtVK.exe
  2⤵
  PID:3084
- C:\Windows\System\vMbXUTO.exe
  C:\Windows\System\vMbXUTO.exe
  2⤵
  PID:3124
- C:\Windows\System\cIhXeTp.exe
  C:\Windows\System\cIhXeTp.exe
  2⤵
  PID:3164
- C:\Windows\System\AYaBrDZ.exe
  C:\Windows\System\AYaBrDZ.exe
  2⤵
  PID:3204
- C:\Windows\System\zBppFDD.exe
  C:\Windows\System\zBppFDD.exe
  2⤵
  PID:3240
- C:\Windows\System\OwxMToZ.exe
  C:\Windows\System\OwxMToZ.exe
  2⤵
  PID:3308
- C:\Windows\System\FjOFWvo.exe
  C:\Windows\System\FjOFWvo.exe
  2⤵
  PID:3284
- C:\Windows\System\jAegSmP.exe
  C:\Windows\System\jAegSmP.exe
  2⤵
  PID:3328
- C:\Windows\System\rbGZEcd.exe
  C:\Windows\System\rbGZEcd.exe
  2⤵
  PID:3380
- C:\Windows\System\hYcjTvw.exe
  C:\Windows\System\hYcjTvw.exe
  2⤵
  PID:3428
- C:\Windows\System\yXwvtuw.exe
  C:\Windows\System\yXwvtuw.exe
  2⤵
  PID:3460
- C:\Windows\System\jihvdpD.exe
  C:\Windows\System\jihvdpD.exe
  2⤵
  PID:3500
- C:\Windows\System\lWvkcvN.exe
  C:\Windows\System\lWvkcvN.exe
  2⤵
  PID:3484
- C:\Windows\System\FkPlxhu.exe
  C:\Windows\System\FkPlxhu.exe
  2⤵
  PID:3516
- C:\Windows\System\kjKoUlB.exe
  C:\Windows\System\kjKoUlB.exe
  2⤵
  PID:3584
- C:\Windows\System\ZVsgPgI.exe
  C:\Windows\System\ZVsgPgI.exe
  2⤵
  PID:3624
- C:\Windows\System\capMijp.exe
  C:\Windows\System\capMijp.exe
  2⤵
  PID:3640
- C:\Windows\System\QHQFhor.exe
  C:\Windows\System\QHQFhor.exe
  2⤵
  PID:3704
- C:\Windows\System\ZxNgzjT.exe
  C:\Windows\System\ZxNgzjT.exe
  2⤵
  PID:3684
- C:\Windows\System\ZzFuPAR.exe
  C:\Windows\System\ZzFuPAR.exe
  2⤵
  PID:3744
- C:\Windows\System\icAttFw.exe
  C:\Windows\System\icAttFw.exe
  2⤵
  PID:3780
- C:\Windows\System\RMFgNSP.exe
  C:\Windows\System\RMFgNSP.exe
  2⤵
  PID:3828
- C:\Windows\System\caAvATD.exe
  C:\Windows\System\caAvATD.exe
  2⤵
  PID:3864
- C:\Windows\System\NbNaVEO.exe
  C:\Windows\System\NbNaVEO.exe
  2⤵
  PID:3840
- C:\Windows\System\SOpXBKF.exe
  C:\Windows\System\SOpXBKF.exe
  2⤵
  PID:3940
- C:\Windows\System\ZkVlwRj.exe
  C:\Windows\System\ZkVlwRj.exe
  2⤵
  PID:3980
- C:\Windows\System\FTCvJWX.exe
  C:\Windows\System\FTCvJWX.exe
  2⤵
  PID:3968
- C:\Windows\System\LMyxJvl.exe
  C:\Windows\System\LMyxJvl.exe
  2⤵
  PID:4008
- C:\Windows\System\HLHpxrP.exe
  C:\Windows\System\HLHpxrP.exe
  2⤵
  PID:4040
- C:\Windows\System\XHSzwcU.exe
  C:\Windows\System\XHSzwcU.exe
  2⤵
  PID:2200
- C:\Windows\System\qpsplmw.exe
  C:\Windows\System\qpsplmw.exe
  2⤵
  PID:2916
- C:\Windows\System\dXFKDaz.exe
  C:\Windows\System\dXFKDaz.exe
  2⤵
  PID:1384
- C:\Windows\System\hFVweSR.exe
  C:\Windows\System\hFVweSR.exe
  2⤵
  PID:1672
- C:\Windows\System\AdTqygd.exe
  C:\Windows\System\AdTqygd.exe
  2⤵
  PID:2364
- C:\Windows\System\fczjQKT.exe
  C:\Windows\System\fczjQKT.exe
  2⤵
  PID:2868
- C:\Windows\System\mXAKrdZ.exe
  C:\Windows\System\mXAKrdZ.exe
  2⤵
  PID:1600
- C:\Windows\System\uLJlXbZ.exe
  C:\Windows\System\uLJlXbZ.exe
  2⤵
  PID:2028
- C:\Windows\System\XLGFXhp.exe
  C:\Windows\System\XLGFXhp.exe
  2⤵
  PID:1816
- C:\Windows\System\ppuJolA.exe
  C:\Windows\System\ppuJolA.exe
  2⤵
  PID:3096
- C:\Windows\System\qDcxkLM.exe
  C:\Windows\System\qDcxkLM.exe
  2⤵
  PID:3120
- C:\Windows\System\GNIebZZ.exe
  C:\Windows\System\GNIebZZ.exe
  2⤵
  PID:3180
- C:\Windows\System\hYamllj.exe
  C:\Windows\System\hYamllj.exe
  2⤵
  PID:3228
- C:\Windows\System\fQsFtqd.exe
  C:\Windows\System\fQsFtqd.exe
  2⤵
  PID:3300
- C:\Windows\System\VVPXzuP.exe
  C:\Windows\System\VVPXzuP.exe
  2⤵
  PID:3276
- C:\Windows\System\BBVFvbB.exe
  C:\Windows\System\BBVFvbB.exe
  2⤵
  PID:3400
- C:\Windows\System\yaOzVSF.exe
  C:\Windows\System\yaOzVSF.exe
  2⤵
  PID:3524
- C:\Windows\System\MtyLvig.exe
  C:\Windows\System\MtyLvig.exe
  2⤵
  PID:3480
- C:\Windows\System\WgpXLaf.exe
  C:\Windows\System\WgpXLaf.exe
  2⤵
  PID:3580
- C:\Windows\System\JamFxRu.exe
  C:\Windows\System\JamFxRu.exe
  2⤵
  PID:3660
- C:\Windows\System\TnJJwBT.exe
  C:\Windows\System\TnJJwBT.exe
  2⤵
  PID:3656
- C:\Windows\System\KtHsrca.exe
  C:\Windows\System\KtHsrca.exe
  2⤵
  PID:3748
- C:\Windows\System\CDlYWKx.exe
  C:\Windows\System\CDlYWKx.exe
  2⤵
  PID:3820
- C:\Windows\System\ePSwHGB.exe
  C:\Windows\System\ePSwHGB.exe
  2⤵
  PID:3764
- C:\Windows\System\FEfpgti.exe
  C:\Windows\System\FEfpgti.exe
  2⤵
  PID:3916
- C:\Windows\System\XPpKsjD.exe
  C:\Windows\System\XPpKsjD.exe
  2⤵
  PID:3884
- C:\Windows\System\pGyjPQq.exe
  C:\Windows\System\pGyjPQq.exe
  2⤵
  PID:3984
- C:\Windows\System\CSHRwBK.exe
  C:\Windows\System\CSHRwBK.exe
  2⤵
  PID:4068
- C:\Windows\System\IFSxEnO.exe
  C:\Windows\System\IFSxEnO.exe
  2⤵
  PID:1560
- C:\Windows\System\TzjFMEO.exe
  C:\Windows\System\TzjFMEO.exe
  2⤵
  PID:2016
- C:\Windows\System\MzLwqCN.exe
  C:\Windows\System\MzLwqCN.exe
  2⤵
  PID:988
- C:\Windows\System\EmwTwhX.exe
  C:\Windows\System\EmwTwhX.exe
  2⤵
  PID:2276
- C:\Windows\System\chCqTPB.exe
  C:\Windows\System\chCqTPB.exe
  2⤵
  PID:3148
- C:\Windows\System\VvivXSW.exe
  C:\Windows\System\VvivXSW.exe
  2⤵
  PID:3160
- C:\Windows\System\qrrzaTE.exe
  C:\Windows\System\qrrzaTE.exe
  2⤵
  PID:3324
- C:\Windows\System\xjUzLiN.exe
  C:\Windows\System\xjUzLiN.exe
  2⤵
  PID:2240
- C:\Windows\System\QykFYVK.exe
  C:\Windows\System\QykFYVK.exe
  2⤵
  PID:3220
- C:\Windows\System\eTECpQa.exe
  C:\Windows\System\eTECpQa.exe
  2⤵
  PID:3600
- C:\Windows\System\jnnieQK.exe
  C:\Windows\System\jnnieQK.exe
  2⤵
  PID:3364
- C:\Windows\System\AFCfuGy.exe
  C:\Windows\System\AFCfuGy.exe
  2⤵
  PID:3808
- C:\Windows\System\fFQZNVu.exe
  C:\Windows\System\fFQZNVu.exe
  2⤵
  PID:3464
- C:\Windows\System\jtsxZlh.exe
  C:\Windows\System\jtsxZlh.exe
  2⤵
  PID:3720
- C:\Windows\System\wjhpMGU.exe
  C:\Windows\System\wjhpMGU.exe
  2⤵
  PID:3740
- C:\Windows\System\HhzTOGo.exe
  C:\Windows\System\HhzTOGo.exe
  2⤵
  PID:1596
- C:\Windows\System\axpBWZN.exe
  C:\Windows\System\axpBWZN.exe
  2⤵
  PID:3860
- C:\Windows\System\YmyBHlm.exe
  C:\Windows\System\YmyBHlm.exe
  2⤵
  PID:2768
- C:\Windows\System\DlkBopg.exe
  C:\Windows\System\DlkBopg.exe
  2⤵
  PID:3344
- C:\Windows\System\gCZlbhq.exe
  C:\Windows\System\gCZlbhq.exe
  2⤵
  PID:4080
- C:\Windows\System\uNCMWMo.exe
  C:\Windows\System\uNCMWMo.exe
  2⤵
  PID:2124
- C:\Windows\System\FDMXOsP.exe
  C:\Windows\System\FDMXOsP.exe
  2⤵
  PID:3784
- C:\Windows\System\ceImOUX.exe
  C:\Windows\System\ceImOUX.exe
  2⤵
  PID:3616
- C:\Windows\System\pFgbxLv.exe
  C:\Windows\System\pFgbxLv.exe
  2⤵
  PID:3696
- C:\Windows\System\bYyICpx.exe
  C:\Windows\System\bYyICpx.exe
  2⤵
  PID:3424
- C:\Windows\System\uqWmwnM.exe
  C:\Windows\System\uqWmwnM.exe
  2⤵
  PID:1364
- C:\Windows\System\sXRtaLs.exe
  C:\Windows\System\sXRtaLs.exe
  2⤵
  PID:2696
- C:\Windows\System\qpLDMnz.exe
  C:\Windows\System\qpLDMnz.exe
  2⤵
  PID:3068
- C:\Windows\System\rzwTrJn.exe
  C:\Windows\System\rzwTrJn.exe
  2⤵
  PID:2272
- C:\Windows\System\CEEpabd.exe
  C:\Windows\System\CEEpabd.exe
  2⤵
  PID:4024
- C:\Windows\System\uhWvKso.exe
  C:\Windows\System\uhWvKso.exe
  2⤵
  PID:888
- C:\Windows\System\pXvNJwr.exe
  C:\Windows\System\pXvNJwr.exe
  2⤵
  PID:3256
- C:\Windows\System\aTeqmKK.exe
  C:\Windows\System\aTeqmKK.exe
  2⤵
  PID:2960
- C:\Windows\System\GXJHoDv.exe
  C:\Windows\System\GXJHoDv.exe
  2⤵
  PID:4000
- C:\Windows\System\YFFnxOg.exe
  C:\Windows\System\YFFnxOg.exe
  2⤵
  PID:3560
- C:\Windows\System\WOsfmAl.exe
  C:\Windows\System\WOsfmAl.exe
  2⤵
  PID:4104
- C:\Windows\System\NjEPtaE.exe
  C:\Windows\System\NjEPtaE.exe
  2⤵
  PID:4124
- C:\Windows\System\qBPlxRe.exe
  C:\Windows\System\qBPlxRe.exe
  2⤵
  PID:4144
- C:\Windows\System\RZlSSnN.exe
  C:\Windows\System\RZlSSnN.exe
  2⤵
  PID:4164
- C:\Windows\System\GUHBIEs.exe
  C:\Windows\System\GUHBIEs.exe
  2⤵
  PID:4184
- C:\Windows\System\LjWGgST.exe
  C:\Windows\System\LjWGgST.exe
  2⤵
  PID:4204
- C:\Windows\System\itIeYSK.exe
  C:\Windows\System\itIeYSK.exe
  2⤵
  PID:4224
- C:\Windows\System\sfETvoM.exe
  C:\Windows\System\sfETvoM.exe
  2⤵
  PID:4244
- C:\Windows\System\zYHkmKq.exe
  C:\Windows\System\zYHkmKq.exe
  2⤵
  PID:4264
- C:\Windows\System\OlspNQb.exe
  C:\Windows\System\OlspNQb.exe
  2⤵
  PID:4288
- C:\Windows\System\JSqPubo.exe
  C:\Windows\System\JSqPubo.exe
  2⤵
  PID:4308
- C:\Windows\System\ZeLEWUB.exe
  C:\Windows\System\ZeLEWUB.exe
  2⤵
  PID:4328
- C:\Windows\System\NYFPOVl.exe
  C:\Windows\System\NYFPOVl.exe
  2⤵
  PID:4348
- C:\Windows\System\ZKQHAhp.exe
  C:\Windows\System\ZKQHAhp.exe
  2⤵
  PID:4368
- C:\Windows\System\sbmNaHG.exe
  C:\Windows\System\sbmNaHG.exe
  2⤵
  PID:4388
- C:\Windows\System\CDcSBGr.exe
  C:\Windows\System\CDcSBGr.exe
  2⤵
  PID:4408
- C:\Windows\System\WKXRNGX.exe
  C:\Windows\System\WKXRNGX.exe
  2⤵
  PID:4428
- C:\Windows\System\sZGuErm.exe
  C:\Windows\System\sZGuErm.exe
  2⤵
  PID:4448
- C:\Windows\System\SjgqCLf.exe
  C:\Windows\System\SjgqCLf.exe
  2⤵
  PID:4468
- C:\Windows\System\ikGdkqt.exe
  C:\Windows\System\ikGdkqt.exe
  2⤵
  PID:4488
- C:\Windows\System\cvoSriv.exe
  C:\Windows\System\cvoSriv.exe
  2⤵
  PID:4508
- C:\Windows\System\EnxWfiV.exe
  C:\Windows\System\EnxWfiV.exe
  2⤵
  PID:4528
- C:\Windows\System\YcFHBHO.exe
  C:\Windows\System\YcFHBHO.exe
  2⤵
  PID:4556
- C:\Windows\System\ZxNDRvp.exe
  C:\Windows\System\ZxNDRvp.exe
  2⤵
  PID:4576
- C:\Windows\System\CnCOLTd.exe
  C:\Windows\System\CnCOLTd.exe
  2⤵
  PID:4596
- C:\Windows\System\nXxTKpe.exe
  C:\Windows\System\nXxTKpe.exe
  2⤵
  PID:4612
- C:\Windows\System\ztvpFDz.exe
  C:\Windows\System\ztvpFDz.exe
  2⤵
  PID:4628
- C:\Windows\System\VhbnMIY.exe
  C:\Windows\System\VhbnMIY.exe
  2⤵
  PID:4664
- C:\Windows\System\cNefpdB.exe
  C:\Windows\System\cNefpdB.exe
  2⤵
  PID:4680
- C:\Windows\System\RNbOzyi.exe
  C:\Windows\System\RNbOzyi.exe
  2⤵
  PID:4696
- C:\Windows\System\yjSUrKP.exe
  C:\Windows\System\yjSUrKP.exe
  2⤵
  PID:4720
- C:\Windows\System\noULEpf.exe
  C:\Windows\System\noULEpf.exe
  2⤵
  PID:4740
- C:\Windows\System\OuscNoG.exe
  C:\Windows\System\OuscNoG.exe
  2⤵
  PID:4756
- C:\Windows\System\HlRzahP.exe
  C:\Windows\System\HlRzahP.exe
  2⤵
  PID:4776
- C:\Windows\System\Ftdjbbl.exe
  C:\Windows\System\Ftdjbbl.exe
  2⤵
  PID:4792
- C:\Windows\System\rzMLDgY.exe
  C:\Windows\System\rzMLDgY.exe
  2⤵
  PID:4808
- C:\Windows\System\LKkVDYL.exe
  C:\Windows\System\LKkVDYL.exe
  2⤵
  PID:4824
- C:\Windows\System\RbJcybw.exe
  C:\Windows\System\RbJcybw.exe
  2⤵
  PID:4840
- C:\Windows\System\ueOHrcf.exe
  C:\Windows\System\ueOHrcf.exe
  2⤵
  PID:4856
- C:\Windows\System\BssCWFq.exe
  C:\Windows\System\BssCWFq.exe
  2⤵
  PID:4872
- C:\Windows\System\lZpbKPx.exe
  C:\Windows\System\lZpbKPx.exe
  2⤵
  PID:4888
- C:\Windows\System\wkWIqRT.exe
  C:\Windows\System\wkWIqRT.exe
  2⤵
  PID:4904
- C:\Windows\System\VJmYSoM.exe
  C:\Windows\System\VJmYSoM.exe
  2⤵
  PID:4920
- C:\Windows\System\mPOjVwm.exe
  C:\Windows\System\mPOjVwm.exe
  2⤵
  PID:4936
- C:\Windows\System\maYgaok.exe
  C:\Windows\System\maYgaok.exe
  2⤵
  PID:4956
- C:\Windows\System\elHWSUM.exe
  C:\Windows\System\elHWSUM.exe
  2⤵
  PID:4976
- C:\Windows\System\jqbJQXr.exe
  C:\Windows\System\jqbJQXr.exe
  2⤵
  PID:4992
- C:\Windows\System\GnHSthb.exe
  C:\Windows\System\GnHSthb.exe
  2⤵
  PID:5020
- C:\Windows\System\kbiFsao.exe
  C:\Windows\System\kbiFsao.exe
  2⤵
  PID:5036
- C:\Windows\System\kWHcXoW.exe
  C:\Windows\System\kWHcXoW.exe
  2⤵
  PID:5112
- C:\Windows\System\eCTCJkU.exe
  C:\Windows\System\eCTCJkU.exe
  2⤵
  PID:3048
- C:\Windows\System\IUyJRjL.exe
  C:\Windows\System\IUyJRjL.exe
  2⤵
  PID:2748
- C:\Windows\System\BWseVgT.exe
  C:\Windows\System\BWseVgT.exe
  2⤵
  PID:2332
- C:\Windows\System\JsbWQWC.exe
  C:\Windows\System\JsbWQWC.exe
  2⤵
  PID:3564
- C:\Windows\System\BvFKQdO.exe
  C:\Windows\System\BvFKQdO.exe
  2⤵
  PID:4152
- C:\Windows\System\LCZkpLU.exe
  C:\Windows\System\LCZkpLU.exe
  2⤵
  PID:4196
- C:\Windows\System\vLMORTF.exe
  C:\Windows\System\vLMORTF.exe
  2⤵
  PID:4172
- C:\Windows\System\DvyoluM.exe
  C:\Windows\System\DvyoluM.exe
  2⤵
  PID:356
- C:\Windows\System\HeovxzB.exe
  C:\Windows\System\HeovxzB.exe
  2⤵
  PID:4284
- C:\Windows\System\JAaBamb.exe
  C:\Windows\System\JAaBamb.exe
  2⤵
  PID:3020
- C:\Windows\System\fwqjCuT.exe
  C:\Windows\System\fwqjCuT.exe
  2⤵
  PID:4400
- C:\Windows\System\nUCftvz.exe
  C:\Windows\System\nUCftvz.exe
  2⤵
  PID:4424
- C:\Windows\System\zYmNtKg.exe
  C:\Windows\System\zYmNtKg.exe
  2⤵
  PID:4440
- C:\Windows\System\hmgwqtd.exe
  C:\Windows\System\hmgwqtd.exe
  2⤵
  PID:4456
- C:\Windows\System\Lqrbfgk.exe
  C:\Windows\System\Lqrbfgk.exe
  2⤵
  PID:2292
- C:\Windows\System\otdkBsQ.exe
  C:\Windows\System\otdkBsQ.exe
  2⤵
  PID:4520
- C:\Windows\System\WjXtmhK.exe
  C:\Windows\System\WjXtmhK.exe
  2⤵
  PID:2556
- C:\Windows\System\HXLyZmW.exe
  C:\Windows\System\HXLyZmW.exe
  2⤵
  PID:4620
- C:\Windows\System\SqYtOaU.exe
  C:\Windows\System\SqYtOaU.exe
  2⤵
  PID:2708
- C:\Windows\System\VrpCUMw.exe
  C:\Windows\System\VrpCUMw.exe
  2⤵
  PID:4704
- C:\Windows\System\KfyAcZF.exe
  C:\Windows\System\KfyAcZF.exe
  2⤵
  PID:4636
- C:\Windows\System\pSdbEgc.exe
  C:\Windows\System\pSdbEgc.exe
  2⤵
  PID:1604
- C:\Windows\System\iXshbzX.exe
  C:\Windows\System\iXshbzX.exe
  2⤵
  PID:4880
- C:\Windows\System\yANexhc.exe
  C:\Windows\System\yANexhc.exe
  2⤵
  PID:2000
- C:\Windows\System\RiewieK.exe
  C:\Windows\System\RiewieK.exe
  2⤵
  PID:4984
- C:\Windows\System\eiDNPbb.exe
  C:\Windows\System\eiDNPbb.exe
  2⤵
  PID:4788
- C:\Windows\System\UOfMmWe.exe
  C:\Windows\System\UOfMmWe.exe
  2⤵
  PID:4708
- C:\Windows\System\gbmNETW.exe
  C:\Windows\System\gbmNETW.exe
  2⤵
  PID:4688
- C:\Windows\System\OTqXzeQ.exe
  C:\Windows\System\OTqXzeQ.exe
  2⤵
  PID:4768
- C:\Windows\System\LtxFcjF.exe
  C:\Windows\System\LtxFcjF.exe
  2⤵
  PID:4832
- C:\Windows\System\ZXnbKwp.exe
  C:\Windows\System\ZXnbKwp.exe
  2⤵
  PID:4896
- C:\Windows\System\KQcTCDS.exe
  C:\Windows\System\KQcTCDS.exe
  2⤵
  PID:4964
- C:\Windows\System\iDfsilh.exe
  C:\Windows\System\iDfsilh.exe
  2⤵
  PID:5008
- C:\Windows\System\joZhgUL.exe
  C:\Windows\System\joZhgUL.exe
  2⤵
  PID:1340
- C:\Windows\System\GQFyNrr.exe
  C:\Windows\System\GQFyNrr.exe
  2⤵
  PID:1068
- C:\Windows\System\EyQasEA.exe
  C:\Windows\System\EyQasEA.exe
  2⤵
  PID:4116
- C:\Windows\System\kzRMbsx.exe
  C:\Windows\System\kzRMbsx.exe
  2⤵
  PID:1812
- C:\Windows\System\XVNyZBP.exe
  C:\Windows\System\XVNyZBP.exe
  2⤵
  PID:1608
- C:\Windows\System\YfwqmLe.exe
  C:\Windows\System\YfwqmLe.exe
  2⤵
  PID:4136
- C:\Windows\System\tDiuwQb.exe
  C:\Windows\System\tDiuwQb.exe
  2⤵
  PID:4276
- C:\Windows\System\iiBBSfO.exe
  C:\Windows\System\iiBBSfO.exe
  2⤵
  PID:4304
- C:\Windows\System\WsqJoML.exe
  C:\Windows\System\WsqJoML.exe
  2⤵
  PID:4356
- C:\Windows\System\pbExetK.exe
  C:\Windows\System\pbExetK.exe
  2⤵
  PID:2380
- C:\Windows\System\dbAKCVI.exe
  C:\Windows\System\dbAKCVI.exe
  2⤵
  PID:4360
- C:\Windows\System\OIKIkDT.exe
  C:\Windows\System\OIKIkDT.exe
  2⤵
  PID:4384
- C:\Windows\System\tspWIxn.exe
  C:\Windows\System\tspWIxn.exe
  2⤵
  PID:2528
- C:\Windows\System\pmGTxSM.exe
  C:\Windows\System\pmGTxSM.exe
  2⤵
  PID:2540
- C:\Windows\System\ekvBsyK.exe
  C:\Windows\System\ekvBsyK.exe
  2⤵
  PID:4516
- C:\Windows\System\UtAvMxO.exe
  C:\Windows\System\UtAvMxO.exe
  2⤵
  PID:2012
- C:\Windows\System\hkHcHnM.exe
  C:\Windows\System\hkHcHnM.exe
  2⤵
  PID:4548
- C:\Windows\System\dXcYIif.exe
  C:\Windows\System\dXcYIif.exe
  2⤵
  PID:1924
- C:\Windows\System\sPnKguE.exe
  C:\Windows\System\sPnKguE.exe
  2⤵
  PID:4652
- C:\Windows\System\SSKFsmY.exe
  C:\Windows\System\SSKFsmY.exe
  2⤵
  PID:4608
- C:\Windows\System\ScdZwcn.exe
  C:\Windows\System\ScdZwcn.exe
  2⤵
  PID:4848
- C:\Windows\System\YGfxtQM.exe
  C:\Windows\System\YGfxtQM.exe
  2⤵
  PID:4952
- C:\Windows\System\CLNUyfZ.exe
  C:\Windows\System\CLNUyfZ.exe
  2⤵
  PID:4716
- C:\Windows\System\aYsDELq.exe
  C:\Windows\System\aYsDELq.exe
  2⤵
  PID:4732
- C:\Windows\System\SPyDCtc.exe
  C:\Windows\System\SPyDCtc.exe
  2⤵
  PID:4864
- C:\Windows\System\kVSxLTT.exe
  C:\Windows\System\kVSxLTT.exe
  2⤵
  PID:1728
- C:\Windows\System\kzwXLcO.exe
  C:\Windows\System\kzwXLcO.exe
  2⤵
  PID:4044
- C:\Windows\System\YWmCUkt.exe
  C:\Windows\System\YWmCUkt.exe
  2⤵
  PID:4256
- C:\Windows\System\EIKrfuQ.exe
  C:\Windows\System\EIKrfuQ.exe
  2⤵
  PID:4300
- C:\Windows\System\NxRappW.exe
  C:\Windows\System\NxRappW.exe
  2⤵
  PID:3540
- C:\Windows\System\KAmBjMF.exe
  C:\Windows\System\KAmBjMF.exe
  2⤵
  PID:2796
- C:\Windows\System\CItYtYz.exe
  C:\Windows\System\CItYtYz.exe
  2⤵
  PID:4364
- C:\Windows\System\ODjWKRT.exe
  C:\Windows\System\ODjWKRT.exe
  2⤵
  PID:1864
- C:\Windows\System\IKMULum.exe
  C:\Windows\System\IKMULum.exe
  2⤵
  PID:4376
- C:\Windows\System\vONAfcs.exe
  C:\Windows\System\vONAfcs.exe
  2⤵
  PID:4460
- C:\Windows\System\llCMuOn.exe
  C:\Windows\System\llCMuOn.exe
  2⤵
  PID:4420
- C:\Windows\System\sHdTyDk.exe
  C:\Windows\System\sHdTyDk.exe
  2⤵
  PID:332
- C:\Windows\System\hKODayo.exe
  C:\Windows\System\hKODayo.exe
  2⤵
  PID:4820
- C:\Windows\System\sjOGyOI.exe
  C:\Windows\System\sjOGyOI.exe
  2⤵
  PID:4672
- C:\Windows\System\ktsgZrD.exe
  C:\Windows\System\ktsgZrD.exe
  2⤵
  PID:4764
- C:\Windows\System\hkcCZeV.exe
  C:\Windows\System\hkcCZeV.exe
  2⤵
  PID:5000
- C:\Windows\System\XTIJNeS.exe
  C:\Windows\System\XTIJNeS.exe
  2⤵
  PID:4804
- C:\Windows\System\yAbfJhi.exe
  C:\Windows\System\yAbfJhi.exe
  2⤵
  PID:4212
- C:\Windows\System\ONpdflo.exe
  C:\Windows\System\ONpdflo.exe
  2⤵
  PID:4252
- C:\Windows\System\lRTRYGN.exe
  C:\Windows\System\lRTRYGN.exe
  2⤵
  PID:4240
- C:\Windows\System\RHZsqDb.exe
  C:\Windows\System\RHZsqDb.exe
  2⤵
  PID:4344
- C:\Windows\System\cjjzhUw.exe
  C:\Windows\System\cjjzhUw.exe
  2⤵
  PID:4484
- C:\Windows\System\JJKwrVJ.exe
  C:\Windows\System\JJKwrVJ.exe
  2⤵
  PID:892
- C:\Windows\System\lOLhmcU.exe
  C:\Windows\System\lOLhmcU.exe
  2⤵
  PID:4396
- C:\Windows\System\temBGtX.exe
  C:\Windows\System\temBGtX.exe
  2⤵
  PID:4748
- C:\Windows\System\OGxWWoD.exe
  C:\Windows\System\OGxWWoD.exe
  2⤵
  PID:4604
- C:\Windows\System\DRDuqOZ.exe
  C:\Windows\System\DRDuqOZ.exe
  2⤵
  PID:5044
- C:\Windows\System\KfCiGBj.exe
  C:\Windows\System\KfCiGBj.exe
  2⤵
  PID:4972
- C:\Windows\System\dKOnMGY.exe
  C:\Windows\System\dKOnMGY.exe
  2⤵
  PID:4296
- C:\Windows\System\fArBlIm.exe
  C:\Windows\System\fArBlIm.exe
  2⤵
  PID:5004
- C:\Windows\System\PoaVGiq.exe
  C:\Windows\System\PoaVGiq.exe
  2⤵
  PID:4404
- C:\Windows\System\QvWwLWN.exe
  C:\Windows\System\QvWwLWN.exe
  2⤵
  PID:1668
- C:\Windows\System\FDpVQbW.exe
  C:\Windows\System\FDpVQbW.exe
  2⤵
  PID:4932
- C:\Windows\System\yCLKaxg.exe
  C:\Windows\System\yCLKaxg.exe
  2⤵
  PID:2792
- C:\Windows\System\dnYTvsm.exe
  C:\Windows\System\dnYTvsm.exe
  2⤵
  PID:2580
- C:\Windows\System\KcaAxAp.exe
  C:\Windows\System\KcaAxAp.exe
  2⤵
  PID:4320
- C:\Windows\System\xNhPCBG.exe
  C:\Windows\System\xNhPCBG.exe
  2⤵
  PID:5136
- C:\Windows\System\FNoiICC.exe
  C:\Windows\System\FNoiICC.exe
  2⤵
  PID:5156
- C:\Windows\System\uCtWLMl.exe
  C:\Windows\System\uCtWLMl.exe
  2⤵
  PID:5172
- C:\Windows\System\JBfnvVh.exe
  C:\Windows\System\JBfnvVh.exe
  2⤵
  PID:5192
- C:\Windows\System\WbbahZU.exe
  C:\Windows\System\WbbahZU.exe
  2⤵
  PID:5216
- C:\Windows\System\XgcdJKC.exe
  C:\Windows\System\XgcdJKC.exe
  2⤵
  PID:5236
- C:\Windows\System\ggMGDIM.exe
  C:\Windows\System\ggMGDIM.exe
  2⤵
  PID:5252
- C:\Windows\System\kgdADwv.exe
  C:\Windows\System\kgdADwv.exe
  2⤵
  PID:5276
- C:\Windows\System\XdIkBtT.exe
  C:\Windows\System\XdIkBtT.exe
  2⤵
  PID:5292
- C:\Windows\System\Qrhoohc.exe
  C:\Windows\System\Qrhoohc.exe
  2⤵
  PID:5308
- C:\Windows\System\UtsQNAj.exe
  C:\Windows\System\UtsQNAj.exe
  2⤵
  PID:5332
- C:\Windows\System\UzboHee.exe
  C:\Windows\System\UzboHee.exe
  2⤵
  PID:5348
- C:\Windows\System\CfPfVfy.exe
  C:\Windows\System\CfPfVfy.exe
  2⤵
  PID:5368
- C:\Windows\System\gddCfls.exe
  C:\Windows\System\gddCfls.exe
  2⤵
  PID:5388
- C:\Windows\System\TusndPM.exe
  C:\Windows\System\TusndPM.exe
  2⤵
  PID:5408
- C:\Windows\System\zOCxJKu.exe
  C:\Windows\System\zOCxJKu.exe
  2⤵
  PID:5436
- C:\Windows\System\pzjTcKv.exe
  C:\Windows\System\pzjTcKv.exe
  2⤵
  PID:5452
- C:\Windows\System\jVGBFpE.exe
  C:\Windows\System\jVGBFpE.exe
  2⤵
  PID:5468
- C:\Windows\System\XfoeDEd.exe
  C:\Windows\System\XfoeDEd.exe
  2⤵
  PID:5484
- C:\Windows\System\ENwzmIo.exe
  C:\Windows\System\ENwzmIo.exe
  2⤵
  PID:5504
- C:\Windows\System\xjUtaeN.exe
  C:\Windows\System\xjUtaeN.exe
  2⤵
  PID:5520
- C:\Windows\System\TJIHoBW.exe
  C:\Windows\System\TJIHoBW.exe
  2⤵
  PID:5548
- C:\Windows\System\wDwVAWK.exe
  C:\Windows\System\wDwVAWK.exe
  2⤵
  PID:5568
- C:\Windows\System\KjaRSLb.exe
  C:\Windows\System\KjaRSLb.exe
  2⤵
  PID:5588
- C:\Windows\System\ITSMXWf.exe
  C:\Windows\System\ITSMXWf.exe
  2⤵
  PID:5608
- C:\Windows\System\SiniFEr.exe
  C:\Windows\System\SiniFEr.exe
  2⤵
  PID:5624
- C:\Windows\System\daHqnfV.exe
  C:\Windows\System\daHqnfV.exe
  2⤵
  PID:5644
- C:\Windows\System\SYvpxpi.exe
  C:\Windows\System\SYvpxpi.exe
  2⤵
  PID:5660
- C:\Windows\System\hjrFtDM.exe
  C:\Windows\System\hjrFtDM.exe
  2⤵
  PID:5692
- C:\Windows\System\SYKsZkC.exe
  C:\Windows\System\SYKsZkC.exe
  2⤵
  PID:5712
- C:\Windows\System\ZjLYEjv.exe
  C:\Windows\System\ZjLYEjv.exe
  2⤵
  PID:5732
- C:\Windows\System\hvZAaQr.exe
  C:\Windows\System\hvZAaQr.exe
  2⤵
  PID:5756
- C:\Windows\System\EPiYdLn.exe
  C:\Windows\System\EPiYdLn.exe
  2⤵
  PID:5772
- C:\Windows\System\mSLMGWb.exe
  C:\Windows\System\mSLMGWb.exe
  2⤵
  PID:5788
- C:\Windows\System\JdnOLFI.exe
  C:\Windows\System\JdnOLFI.exe
  2⤵
  PID:5808
- C:\Windows\System\giGQbZz.exe
  C:\Windows\System\giGQbZz.exe
  2⤵
  PID:5824
- C:\Windows\System\LEkBlBy.exe
  C:\Windows\System\LEkBlBy.exe
  2⤵
  PID:5840
- C:\Windows\System\HziFHrZ.exe
  C:\Windows\System\HziFHrZ.exe
  2⤵
  PID:5856
- C:\Windows\System\qAOPRJZ.exe
  C:\Windows\System\qAOPRJZ.exe
  2⤵
  PID:5872
- C:\Windows\System\lbVlAIp.exe
  C:\Windows\System\lbVlAIp.exe
  2⤵
  PID:5896
- C:\Windows\System\dKPeCHI.exe
  C:\Windows\System\dKPeCHI.exe
  2⤵
  PID:5912
- C:\Windows\System\mggXGlx.exe
  C:\Windows\System\mggXGlx.exe
  2⤵
  PID:5940
- C:\Windows\System\IYUYTMf.exe
  C:\Windows\System\IYUYTMf.exe
  2⤵
  PID:5972
- C:\Windows\System\hMgQsWQ.exe
  C:\Windows\System\hMgQsWQ.exe
  2⤵
  PID:5988
- C:\Windows\System\zsXHYNi.exe
  C:\Windows\System\zsXHYNi.exe
  2⤵
  PID:6008
- C:\Windows\System\Rmkznrn.exe
  C:\Windows\System\Rmkznrn.exe
  2⤵
  PID:6024
- C:\Windows\System\mvjubWN.exe
  C:\Windows\System\mvjubWN.exe
  2⤵
  PID:6048
- C:\Windows\System\ojClLfr.exe
  C:\Windows\System\ojClLfr.exe
  2⤵
  PID:6068
- C:\Windows\System\DQwTtJu.exe
  C:\Windows\System\DQwTtJu.exe
  2⤵
  PID:6088
- C:\Windows\System\KREwbLt.exe
  C:\Windows\System\KREwbLt.exe
  2⤵
  PID:6104
- C:\Windows\System\ihCvWGd.exe
  C:\Windows\System\ihCvWGd.exe
  2⤵
  PID:6120
- C:\Windows\System\BZdxPRv.exe
  C:\Windows\System\BZdxPRv.exe
  2⤵
  PID:6136
- C:\Windows\System\nqMZaxE.exe
  C:\Windows\System\nqMZaxE.exe
  2⤵
  PID:4380
- C:\Windows\System\fgFBcjp.exe
  C:\Windows\System\fgFBcjp.exe
  2⤵
  PID:4948
- C:\Windows\System\FkqTIeY.exe
  C:\Windows\System\FkqTIeY.exe
  2⤵
  PID:5148
- C:\Windows\System\JPjlJOz.exe
  C:\Windows\System\JPjlJOz.exe
  2⤵
  PID:5184
- C:\Windows\System\eBHPIAJ.exe
  C:\Windows\System\eBHPIAJ.exe
  2⤵
  PID:5204
- C:\Windows\System\dLsKAvY.exe
  C:\Windows\System\dLsKAvY.exe
  2⤵
  PID:5228
- C:\Windows\System\xpySQud.exe
  C:\Windows\System\xpySQud.exe
  2⤵
  PID:5272
- C:\Windows\System\nkuxOPr.exe
  C:\Windows\System\nkuxOPr.exe
  2⤵
  PID:5248
- C:\Windows\System\uCGJWVc.exe
  C:\Windows\System\uCGJWVc.exe
  2⤵
  PID:5320
- C:\Windows\System\QxtuYrd.exe
  C:\Windows\System\QxtuYrd.exe
  2⤵
  PID:5344
- C:\Windows\System\dxAFCwv.exe
  C:\Windows\System\dxAFCwv.exe
  2⤵
  PID:5360
- C:\Windows\System\NHwiaaz.exe
  C:\Windows\System\NHwiaaz.exe
  2⤵
  PID:5400
- C:\Windows\System\WzxFmEo.exe
  C:\Windows\System\WzxFmEo.exe
  2⤵
  PID:5424
- C:\Windows\System\ypqGkPH.exe
  C:\Windows\System\ypqGkPH.exe
  2⤵
  PID:5460
- C:\Windows\System\ssgEhTX.exe
  C:\Windows\System\ssgEhTX.exe
  2⤵
  PID:5496
- C:\Windows\System\QnvSmID.exe
  C:\Windows\System\QnvSmID.exe
  2⤵
  PID:5512
- C:\Windows\System\WFFOCsr.exe
  C:\Windows\System\WFFOCsr.exe
  2⤵
  PID:5576
- C:\Windows\System\VcQdzRx.exe
  C:\Windows\System\VcQdzRx.exe
  2⤵
  PID:5600
- C:\Windows\System\CVEeHbI.exe
  C:\Windows\System\CVEeHbI.exe
  2⤵
  PID:5604
- C:\Windows\System\YxJaNwh.exe
  C:\Windows\System\YxJaNwh.exe
  2⤵
  PID:5680
- C:\Windows\System\DaOXaaZ.exe
  C:\Windows\System\DaOXaaZ.exe
  2⤵
  PID:5704
- C:\Windows\System\xZDDkhY.exe
  C:\Windows\System\xZDDkhY.exe
  2⤵
  PID:5744
- C:\Windows\System\aKuWZRq.exe
  C:\Windows\System\aKuWZRq.exe
  2⤵
  PID:5728
- C:\Windows\System\kwuhNWV.exe
  C:\Windows\System\kwuhNWV.exe
  2⤵
  PID:4568
- C:\Windows\System\tatMlBD.exe
  C:\Windows\System\tatMlBD.exe
  2⤵
  PID:5816
- C:\Windows\System\CgWxhCr.exe
  C:\Windows\System\CgWxhCr.exe
  2⤵
  PID:5880
- C:\Windows\System\aolTNVJ.exe
  C:\Windows\System\aolTNVJ.exe
  2⤵
  PID:5920
- C:\Windows\System\rjEXmLj.exe
  C:\Windows\System\rjEXmLj.exe
  2⤵
  PID:4644
- C:\Windows\System\nNppmpO.exe
  C:\Windows\System\nNppmpO.exe
  2⤵
  PID:5016
- C:\Windows\System\FRUexPf.exe
  C:\Windows\System\FRUexPf.exe
  2⤵
  PID:5904
- C:\Windows\System\QJXdSvn.exe
  C:\Windows\System\QJXdSvn.exe
  2⤵
  PID:5864
- C:\Windows\System\kOvgQAU.exe
  C:\Windows\System\kOvgQAU.exe
  2⤵
  PID:5956
- C:\Windows\System\FqILZth.exe
  C:\Windows\System\FqILZth.exe
  2⤵
  PID:5984
- C:\Windows\System\dGishZT.exe
  C:\Windows\System\dGishZT.exe
  2⤵
  PID:5996
- C:\Windows\System\DkoKHqz.exe
  C:\Windows\System\DkoKHqz.exe
  2⤵
  PID:6040
- C:\Windows\System\lIrgWyU.exe
  C:\Windows\System\lIrgWyU.exe
  2⤵
  PID:6056
- C:\Windows\System\uJMoVMS.exe
  C:\Windows\System\uJMoVMS.exe
  2⤵
  PID:6064
- C:\Windows\System\LXyhEUV.exe
  C:\Windows\System\LXyhEUV.exe
  2⤵
  PID:6132
- C:\Windows\System\cCBBsAP.exe
  C:\Windows\System\cCBBsAP.exe
  2⤵
  PID:4324
- C:\Windows\System\IKXUAHI.exe
  C:\Windows\System\IKXUAHI.exe
  2⤵
  PID:4772
- C:\Windows\System\VPJZUTn.exe
  C:\Windows\System\VPJZUTn.exe
  2⤵
  PID:5300
- C:\Windows\System\zMwlkpT.exe
  C:\Windows\System\zMwlkpT.exe
  2⤵
  PID:5328
- C:\Windows\System\QwixuRo.exe
  C:\Windows\System\QwixuRo.exe
  2⤵
  PID:3868
- C:\Windows\System\dsxcaKA.exe
  C:\Windows\System\dsxcaKA.exe
  2⤵
  PID:2304
- C:\Windows\System\vKJMYwl.exe
  C:\Windows\System\vKJMYwl.exe
  2⤵
  PID:5128
- C:\Windows\System\gxqFLyu.exe
  C:\Windows\System\gxqFLyu.exe
  2⤵
  PID:6116
- C:\Windows\System\fbKIauP.exe
  C:\Windows\System\fbKIauP.exe
  2⤵
  PID:5396
- C:\Windows\System\zCSxvnr.exe
  C:\Windows\System\zCSxvnr.exe
  2⤵
  PID:5544
- C:\Windows\System\kagDVAd.exe
  C:\Windows\System\kagDVAd.exe
  2⤵
  PID:5492
- C:\Windows\System\HbYTsqQ.exe
  C:\Windows\System\HbYTsqQ.exe
  2⤵
  PID:5260
- C:\Windows\System\AjTMuvO.exe
  C:\Windows\System\AjTMuvO.exe
  2⤵
  PID:5416
- C:\Windows\System\pKtLCSw.exe
  C:\Windows\System\pKtLCSw.exe
  2⤵
  PID:4100
- C:\Windows\System\FWPaBPn.exe
  C:\Windows\System\FWPaBPn.exe
  2⤵
  PID:5640
- C:\Windows\System\tFAAtiS.exe
  C:\Windows\System\tFAAtiS.exe
  2⤵
  PID:5532
- C:\Windows\System\mRtZdSN.exe
  C:\Windows\System\mRtZdSN.exe
  2⤵
  PID:5652
- C:\Windows\System\nQbYlrr.exe
  C:\Windows\System\nQbYlrr.exe
  2⤵
  PID:5768
- C:\Windows\System\rgykMNl.exe
  C:\Windows\System\rgykMNl.exe
  2⤵
  PID:5056
- C:\Windows\System\bjBqRab.exe
  C:\Windows\System\bjBqRab.exe
  2⤵
  PID:6020
- C:\Windows\System\nKyZypa.exe
  C:\Windows\System\nKyZypa.exe
  2⤵
  PID:5968
- C:\Windows\System\yvilXYG.exe
  C:\Windows\System\yvilXYG.exe
  2⤵
  PID:5188
- C:\Windows\System\DSSMzRd.exe
  C:\Windows\System\DSSMzRd.exe
  2⤵
  PID:5784
- C:\Windows\System\ABXWlIl.exe
  C:\Windows\System\ABXWlIl.exe
  2⤵
  PID:5688
- C:\Windows\System\HLVyGIo.exe
  C:\Windows\System\HLVyGIo.exe
  2⤵
  PID:5936
- C:\Windows\System\qxBeqxh.exe
  C:\Windows\System\qxBeqxh.exe
  2⤵
  PID:5980
- C:\Windows\System\QTSAcpz.exe
  C:\Windows\System\QTSAcpz.exe
  2⤵
  PID:5244
- C:\Windows\System\ywhUHQk.exe
  C:\Windows\System\ywhUHQk.exe
  2⤵
  PID:2744
- C:\Windows\System\sDzZVts.exe
  C:\Windows\System\sDzZVts.exe
  2⤵
  PID:5540
- C:\Windows\System\MFFgBoW.exe
  C:\Windows\System\MFFgBoW.exe
  2⤵
  PID:5584
- C:\Windows\System\IuRoXtO.exe
  C:\Windows\System\IuRoXtO.exe
  2⤵
  PID:5764
- C:\Windows\System\cQOAlLa.exe
  C:\Windows\System\cQOAlLa.exe
  2⤵
  PID:5636
- C:\Windows\System\lVjqzPa.exe
  C:\Windows\System\lVjqzPa.exe
  2⤵
  PID:2668
- C:\Windows\System\jGBDMaZ.exe
  C:\Windows\System\jGBDMaZ.exe
  2⤵
  PID:6128
- C:\Windows\System\OQwFWwA.exe
  C:\Windows\System\OQwFWwA.exe
  2⤵
  PID:5212
- C:\Windows\System\YZLTYqM.exe
  C:\Windows\System\YZLTYqM.exe
  2⤵
  PID:6032
- C:\Windows\System\SeaEcYZ.exe
  C:\Windows\System\SeaEcYZ.exe
  2⤵
  PID:6036
- C:\Windows\System\jIJABFL.exe
  C:\Windows\System\jIJABFL.exe
  2⤵
  PID:5780
- C:\Windows\System\QrDEIuu.exe
  C:\Windows\System\QrDEIuu.exe
  2⤵
  PID:5224
- C:\Windows\System\YLTrQjQ.exe
  C:\Windows\System\YLTrQjQ.exe
  2⤵
  PID:5740
- C:\Windows\System\yEGywHz.exe
  C:\Windows\System\yEGywHz.exe
  2⤵
  PID:5852
- C:\Windows\System\YBwfrWR.exe
  C:\Windows\System\YBwfrWR.exe
  2⤵
  PID:2624
- C:\Windows\System\xWjZwjd.exe
  C:\Windows\System\xWjZwjd.exe
  2⤵
  PID:6100
- C:\Windows\System\yrnYfFv.exe
  C:\Windows\System\yrnYfFv.exe
  2⤵
  PID:5048
- C:\Windows\System\UiHctsE.exe
  C:\Windows\System\UiHctsE.exe
  2⤵
  PID:5528
- C:\Windows\System\UKpEEIp.exe
  C:\Windows\System\UKpEEIp.exe
  2⤵
  PID:6152
- C:\Windows\System\sZmEPJW.exe
  C:\Windows\System\sZmEPJW.exe
  2⤵
  PID:6168
- C:\Windows\System\KCmjmEJ.exe
  C:\Windows\System\KCmjmEJ.exe
  2⤵
  PID:6188
- C:\Windows\System\ebIgSLH.exe
  C:\Windows\System\ebIgSLH.exe
  2⤵
  PID:6204
- C:\Windows\System\chnvuRE.exe
  C:\Windows\System\chnvuRE.exe
  2⤵
  PID:6220
- C:\Windows\System\QccRiPD.exe
  C:\Windows\System\QccRiPD.exe
  2⤵
  PID:6244
- C:\Windows\System\TnrwcbL.exe
  C:\Windows\System\TnrwcbL.exe
  2⤵
  PID:6260
- C:\Windows\System\NDTEriG.exe
  C:\Windows\System\NDTEriG.exe
  2⤵
  PID:6276
- C:\Windows\System\jnRFtZy.exe
  C:\Windows\System\jnRFtZy.exe
  2⤵
  PID:6292
- C:\Windows\System\VLCsjiJ.exe
  C:\Windows\System\VLCsjiJ.exe
  2⤵
  PID:6308
- C:\Windows\System\cPsKkIt.exe
  C:\Windows\System\cPsKkIt.exe
  2⤵
  PID:6324
- C:\Windows\System\kJbnOjz.exe
  C:\Windows\System\kJbnOjz.exe
  2⤵
  PID:6340
- C:\Windows\System\atAbNPB.exe
  C:\Windows\System\atAbNPB.exe
  2⤵
  PID:6356
- C:\Windows\System\MvEoueL.exe
  C:\Windows\System\MvEoueL.exe
  2⤵
  PID:6372
- C:\Windows\System\SuwNHql.exe
  C:\Windows\System\SuwNHql.exe
  2⤵
  PID:6392
- C:\Windows\System\bmStOXR.exe
  C:\Windows\System\bmStOXR.exe
  2⤵
  PID:6408
- C:\Windows\System\znsWzKM.exe
  C:\Windows\System\znsWzKM.exe
  2⤵
  PID:6424
- C:\Windows\System\IwDjRkd.exe
  C:\Windows\System\IwDjRkd.exe
  2⤵
  PID:6444
- C:\Windows\System\pcgituf.exe
  C:\Windows\System\pcgituf.exe
  2⤵
  PID:6476
- C:\Windows\System\nhPjdlS.exe
  C:\Windows\System\nhPjdlS.exe
  2⤵
  PID:6500
- C:\Windows\System\KIZZKcu.exe
  C:\Windows\System\KIZZKcu.exe
  2⤵
  PID:6540
- C:\Windows\System\VfblsII.exe
  C:\Windows\System\VfblsII.exe
  2⤵
  PID:6568
- C:\Windows\System\PavhEHn.exe
  C:\Windows\System\PavhEHn.exe
  2⤵
  PID:6588
- C:\Windows\System\QCznEhW.exe
  C:\Windows\System\QCznEhW.exe
  2⤵
  PID:6608
- C:\Windows\System\dVsorNM.exe
  C:\Windows\System\dVsorNM.exe
  2⤵
  PID:6632
- C:\Windows\System\YZqSizv.exe
  C:\Windows\System\YZqSizv.exe
  2⤵
  PID:6648
- C:\Windows\System\ulskpOc.exe
  C:\Windows\System\ulskpOc.exe
  2⤵
  PID:6664
- C:\Windows\System\IZJVVcQ.exe
  C:\Windows\System\IZJVVcQ.exe
  2⤵
  PID:6680
- C:\Windows\System\ILNCaxA.exe
  C:\Windows\System\ILNCaxA.exe
  2⤵
  PID:6696
- C:\Windows\System\VpAMdbN.exe
  C:\Windows\System\VpAMdbN.exe
  2⤵
  PID:6712
- C:\Windows\System\yFOjCuJ.exe
  C:\Windows\System\yFOjCuJ.exe
  2⤵
  PID:6732
- C:\Windows\System\jXDWmjg.exe
  C:\Windows\System\jXDWmjg.exe
  2⤵
  PID:6748
- C:\Windows\System\IkpwzhJ.exe
  C:\Windows\System\IkpwzhJ.exe
  2⤵
  PID:6764
- C:\Windows\System\nLgLUuK.exe
  C:\Windows\System\nLgLUuK.exe
  2⤵
  PID:6780
- C:\Windows\System\JXbcjKr.exe
  C:\Windows\System\JXbcjKr.exe
  2⤵
  PID:6796
- C:\Windows\System\wUtpJNR.exe
  C:\Windows\System\wUtpJNR.exe
  2⤵
  PID:6812
- C:\Windows\System\CWPZaYS.exe
  C:\Windows\System\CWPZaYS.exe
  2⤵
  PID:6828
- C:\Windows\System\RXxECeB.exe
  C:\Windows\System\RXxECeB.exe
  2⤵
  PID:6844
- C:\Windows\System\YLOFxqE.exe
  C:\Windows\System\YLOFxqE.exe
  2⤵
  PID:6860
- C:\Windows\System\xhshVfb.exe
  C:\Windows\System\xhshVfb.exe
  2⤵
  PID:6876
- C:\Windows\System\DWdtRGc.exe
  C:\Windows\System\DWdtRGc.exe
  2⤵
  PID:6892
- C:\Windows\System\URqmMMI.exe
  C:\Windows\System\URqmMMI.exe
  2⤵
  PID:6908
- C:\Windows\System\MpriaIK.exe
  C:\Windows\System\MpriaIK.exe
  2⤵
  PID:6924
- C:\Windows\System\vtFIves.exe
  C:\Windows\System\vtFIves.exe
  2⤵
  PID:6948
- C:\Windows\System\caAVZrv.exe
  C:\Windows\System\caAVZrv.exe
  2⤵
  PID:6964
- C:\Windows\System\MUInTBs.exe
  C:\Windows\System\MUInTBs.exe
  2⤵
  PID:6980
- C:\Windows\System\FzdzUNd.exe
  C:\Windows\System\FzdzUNd.exe
  2⤵
  PID:7004
- C:\Windows\System\lrjFVuo.exe
  C:\Windows\System\lrjFVuo.exe
  2⤵
  PID:7020
- C:\Windows\System\COOCCmT.exe
  C:\Windows\System\COOCCmT.exe
  2⤵
  PID:7036
- C:\Windows\System\unCHREP.exe
  C:\Windows\System\unCHREP.exe
  2⤵
  PID:7052
- C:\Windows\System\AhHUers.exe
  C:\Windows\System\AhHUers.exe
  2⤵
  PID:7072
- C:\Windows\System\JXXajhk.exe
  C:\Windows\System\JXXajhk.exe
  2⤵
  PID:7088
- C:\Windows\System\tQWumMb.exe
  C:\Windows\System\tQWumMb.exe
  2⤵
  PID:7104
- C:\Windows\System\JwWVjXD.exe
  C:\Windows\System\JwWVjXD.exe
  2⤵
  PID:7132
- C:\Windows\System\stqLRSN.exe
  C:\Windows\System\stqLRSN.exe
  2⤵
  PID:7148
- C:\Windows\System\ZdGRBRb.exe
  C:\Windows\System\ZdGRBRb.exe
  2⤵
  PID:7164
- C:\Windows\System\cLTWYwe.exe
  C:\Windows\System\cLTWYwe.exe
  2⤵
  PID:5384
- C:\Windows\System\PyfcuyV.exe
  C:\Windows\System\PyfcuyV.exe
  2⤵
  PID:6212
- C:\Windows\System\etRnCOw.exe
  C:\Windows\System\etRnCOw.exe
  2⤵
  PID:6216
- C:\Windows\System\DvxTRnJ.exe
  C:\Windows\System\DvxTRnJ.exe
  2⤵
  PID:2568
- C:\Windows\System\ZwkOMHL.exe
  C:\Windows\System\ZwkOMHL.exe
  2⤵
  PID:5724
- C:\Windows\System\jBGPzXl.exe
  C:\Windows\System\jBGPzXl.exe
  2⤵
  PID:6196
- C:\Windows\System\qdLmAxP.exe
  C:\Windows\System\qdLmAxP.exe
  2⤵
  PID:6256
- C:\Windows\System\QBUrnUz.exe
  C:\Windows\System\QBUrnUz.exe
  2⤵
  PID:6320
- C:\Windows\System\iQNxRsM.exe
  C:\Windows\System\iQNxRsM.exe
  2⤵
  PID:6384
- C:\Windows\System\aosrvXT.exe
  C:\Windows\System\aosrvXT.exe
  2⤵
  PID:6452
- C:\Windows\System\tNnWQhW.exe
  C:\Windows\System\tNnWQhW.exe
  2⤵
  PID:6432
- C:\Windows\System\SOvOVSO.exe
  C:\Windows\System\SOvOVSO.exe
  2⤵
  PID:6364
- C:\Windows\System\SXvYqPX.exe
  C:\Windows\System\SXvYqPX.exe
  2⤵
  PID:6300
- C:\Windows\System\eUXlgXo.exe
  C:\Windows\System\eUXlgXo.exe
  2⤵
  PID:6272
- C:\Windows\System\MwgHwtu.exe
  C:\Windows\System\MwgHwtu.exe
  2⤵
  PID:6508
- C:\Windows\System\mPovBJL.exe
  C:\Windows\System\mPovBJL.exe
  2⤵
  PID:6516
- C:\Windows\System\ylXSBYP.exe
  C:\Windows\System\ylXSBYP.exe
  2⤵
  PID:6536
- C:\Windows\System\BCJxIyc.exe
  C:\Windows\System\BCJxIyc.exe
  2⤵
  PID:6616
- C:\Windows\System\IZaWzTY.exe
  C:\Windows\System\IZaWzTY.exe
  2⤵
  PID:6564
- C:\Windows\System\UXXxEIM.exe
  C:\Windows\System\UXXxEIM.exe
  2⤵
  PID:6656
- C:\Windows\System\sEMbmoh.exe
  C:\Windows\System\sEMbmoh.exe
  2⤵
  PID:6644
- C:\Windows\System\amcwbLL.exe
  C:\Windows\System\amcwbLL.exe
  2⤵
  PID:6728
- C:\Windows\System\KEGSeLR.exe
  C:\Windows\System\KEGSeLR.exe
  2⤵
  PID:6788
- C:\Windows\System\YwSCwIX.exe
  C:\Windows\System\YwSCwIX.exe
  2⤵
  PID:6852
- C:\Windows\System\ISuZdjC.exe
  C:\Windows\System\ISuZdjC.exe
  2⤵
  PID:6708
- C:\Windows\System\rnZrBCZ.exe
  C:\Windows\System\rnZrBCZ.exe
  2⤵
  PID:6744
- C:\Windows\System\UdEVODR.exe
  C:\Windows\System\UdEVODR.exe
  2⤵
  PID:6868
- C:\Windows\System\obWUEfk.exe
  C:\Windows\System\obWUEfk.exe
  2⤵
  PID:6840
- C:\Windows\System\OTRLDTQ.exe
  C:\Windows\System\OTRLDTQ.exe
  2⤵
  PID:6956
- C:\Windows\System\LUttWpz.exe
  C:\Windows\System\LUttWpz.exe
  2⤵
  PID:6988
- C:\Windows\System\DKtcWJp.exe
  C:\Windows\System\DKtcWJp.exe
  2⤵
  PID:6996
- C:\Windows\System\lJWeJgl.exe
  C:\Windows\System\lJWeJgl.exe
  2⤵
  PID:6976
- C:\Windows\System\vkIHxNd.exe
  C:\Windows\System\vkIHxNd.exe
  2⤵
  PID:6972
- C:\Windows\System\ehmWfcK.exe
  C:\Windows\System\ehmWfcK.exe
  2⤵
  PID:7048
- C:\Windows\System\xFjwJnX.exe
  C:\Windows\System\xFjwJnX.exe
  2⤵
  PID:7084
- C:\Windows\System\ttcaOHX.exe
  C:\Windows\System\ttcaOHX.exe
  2⤵
  PID:7140
- C:\Windows\System\mYeSgVo.exe
  C:\Windows\System\mYeSgVo.exe
  2⤵
  PID:6148
- C:\Windows\System\pcswfHI.exe
  C:\Windows\System\pcswfHI.exe
  2⤵
  PID:6160
- C:\Windows\System\oqMcNOE.exe
  C:\Windows\System\oqMcNOE.exe
  2⤵
  PID:5232
- C:\Windows\System\DrpKRLC.exe
  C:\Windows\System\DrpKRLC.exe
  2⤵
  PID:7160
- C:\Windows\System\Kguywnh.exe
  C:\Windows\System\Kguywnh.exe
  2⤵
  PID:5356
- C:\Windows\System\dgLfpPq.exe
  C:\Windows\System\dgLfpPq.exe
  2⤵
  PID:6416
- C:\Windows\System\WeDBJgo.exe
  C:\Windows\System\WeDBJgo.exe
  2⤵
  PID:6464
- C:\Windows\System\pHuYCMH.exe
  C:\Windows\System\pHuYCMH.exe
  2⤵
  PID:6252
- C:\Windows\System\vAOEKja.exe
  C:\Windows\System\vAOEKja.exe
  2⤵
  PID:6488
- C:\Windows\System\mdgRsMg.exe
  C:\Windows\System\mdgRsMg.exe
  2⤵
  PID:6404
- C:\Windows\System\YGMvyeo.exe
  C:\Windows\System\YGMvyeo.exe
  2⤵
  PID:6552
- C:\Windows\System\wpoTOMQ.exe
  C:\Windows\System\wpoTOMQ.exe
  2⤵
  PID:6556
- C:\Windows\System\fARcvZw.exe
  C:\Windows\System\fARcvZw.exe
  2⤵
  PID:6756
- C:\Windows\System\WwwCoZL.exe
  C:\Windows\System\WwwCoZL.exe
  2⤵
  PID:6904
- C:\Windows\System\MJuTqWT.exe
  C:\Windows\System\MJuTqWT.exe
  2⤵
  PID:7096
- C:\Windows\System\LQFexlf.exe
  C:\Windows\System\LQFexlf.exe
  2⤵
  PID:6820
- C:\Windows\System\zvEmzDO.exe
  C:\Windows\System\zvEmzDO.exe
  2⤵
  PID:6960
- C:\Windows\System\gXjJHPA.exe
  C:\Windows\System\gXjJHPA.exe
  2⤵
  PID:7032
- C:\Windows\System\CUtRdip.exe
  C:\Windows\System\CUtRdip.exe
  2⤵
  PID:6512
- C:\Windows\System\LsIeteb.exe
  C:\Windows\System\LsIeteb.exe
  2⤵
  PID:6484
- C:\Windows\System\LeMcJRW.exe
  C:\Windows\System\LeMcJRW.exe
  2⤵
  PID:6524
- C:\Windows\System\uMFIeGV.exe
  C:\Windows\System\uMFIeGV.exe
  2⤵
  PID:6584
- C:\Windows\System\OjSFzhC.exe
  C:\Windows\System\OjSFzhC.exe
  2⤵
  PID:7016
- C:\Windows\System\gkMxATx.exe
  C:\Windows\System\gkMxATx.exe
  2⤵
  PID:6672
- C:\Windows\System\nQZIShJ.exe
  C:\Windows\System\nQZIShJ.exe
  2⤵
  PID:5124
- C:\Windows\System\LbIgFiL.exe
  C:\Windows\System\LbIgFiL.exe
  2⤵
  PID:7060
- C:\Windows\System\vvoGPnU.exe
  C:\Windows\System\vvoGPnU.exe
  2⤵
  PID:6268
- C:\Windows\System\IIoLqqa.exe
  C:\Windows\System\IIoLqqa.exe
  2⤵
  PID:6288
- C:\Windows\System\kyQfpAq.exe
  C:\Windows\System\kyQfpAq.exe
  2⤵
  PID:6920
- C:\Windows\System\MPOafFv.exe
  C:\Windows\System\MPOafFv.exe
  2⤵
  PID:6688
- C:\Windows\System\GTKwInZ.exe
  C:\Windows\System\GTKwInZ.exe
  2⤵
  PID:6720
- C:\Windows\System\DkwDKsK.exe
  C:\Windows\System\DkwDKsK.exe
  2⤵
  PID:4868
- C:\Windows\System\nzWOTyO.exe
  C:\Windows\System\nzWOTyO.exe
  2⤵
  PID:6808
- C:\Windows\System\lqkSYEX.exe
  C:\Windows\System\lqkSYEX.exe
  2⤵
  PID:6352
- C:\Windows\System\CFYMWCB.exe
  C:\Windows\System\CFYMWCB.exe
  2⤵
  PID:7172
- C:\Windows\System\Fbfcorj.exe
  C:\Windows\System\Fbfcorj.exe
  2⤵
  PID:7188
- C:\Windows\System\guqSrqw.exe
  C:\Windows\System\guqSrqw.exe
  2⤵
  PID:7208
- C:\Windows\System\JwJLuEJ.exe
  C:\Windows\System\JwJLuEJ.exe
  2⤵
  PID:7228
- C:\Windows\System\JMPBFps.exe
  C:\Windows\System\JMPBFps.exe
  2⤵
  PID:7248
- C:\Windows\System\cnaLoFM.exe
  C:\Windows\System\cnaLoFM.exe
  2⤵
  PID:7364
- C:\Windows\System\JNsZRvW.exe
  C:\Windows\System\JNsZRvW.exe
  2⤵
  PID:7380
- C:\Windows\System\WDDuDXk.exe
  C:\Windows\System\WDDuDXk.exe
  2⤵
  PID:7396
- C:\Windows\System\gYNGxEW.exe
  C:\Windows\System\gYNGxEW.exe
  2⤵
  PID:7416
- C:\Windows\System\UXTkvXc.exe
  C:\Windows\System\UXTkvXc.exe
  2⤵
  PID:7436
- C:\Windows\System\outruTK.exe
  C:\Windows\System\outruTK.exe
  2⤵
  PID:7468
- C:\Windows\System\FqiAnFs.exe
  C:\Windows\System\FqiAnFs.exe
  2⤵
  PID:7484
- C:\Windows\System\lEmpstP.exe
  C:\Windows\System\lEmpstP.exe
  2⤵
  PID:7504
- C:\Windows\System\DMTifJc.exe
  C:\Windows\System\DMTifJc.exe
  2⤵
  PID:7520
- C:\Windows\System\IfhINkC.exe
  C:\Windows\System\IfhINkC.exe
  2⤵
  PID:7536
- C:\Windows\System\nxtBGRC.exe
  C:\Windows\System\nxtBGRC.exe
  2⤵
  PID:7552
- C:\Windows\System\FYcmaxk.exe
  C:\Windows\System\FYcmaxk.exe
  2⤵
  PID:7568
- C:\Windows\System\aTkAoXZ.exe
  C:\Windows\System\aTkAoXZ.exe
  2⤵
  PID:7584
- C:\Windows\System\JXnukNq.exe
  C:\Windows\System\JXnukNq.exe
  2⤵
  PID:7616
- C:\Windows\System\UDNQAsE.exe
  C:\Windows\System\UDNQAsE.exe
  2⤵
  PID:7632
- C:\Windows\System\obWVBOf.exe
  C:\Windows\System\obWVBOf.exe
  2⤵
  PID:7668
- C:\Windows\System\oXlWPWo.exe
  C:\Windows\System\oXlWPWo.exe
  2⤵
  PID:7684
- C:\Windows\System\zGXHzlO.exe
  C:\Windows\System\zGXHzlO.exe
  2⤵
  PID:7700
- C:\Windows\System\BdHEgbx.exe
  C:\Windows\System\BdHEgbx.exe
  2⤵
  PID:7728
- C:\Windows\System\lOLgMUl.exe
  C:\Windows\System\lOLgMUl.exe
  2⤵
  PID:7748
- C:\Windows\System\fxYLUmL.exe
  C:\Windows\System\fxYLUmL.exe
  2⤵
  PID:7764
- C:\Windows\System\JlkeFpx.exe
  C:\Windows\System\JlkeFpx.exe
  2⤵
  PID:7780
- C:\Windows\System\FKvzcdo.exe
  C:\Windows\System\FKvzcdo.exe
  2⤵
  PID:7796
- C:\Windows\System\Kuluoku.exe
  C:\Windows\System\Kuluoku.exe
  2⤵
  PID:7816
- C:\Windows\System\UAzSQqR.exe
  C:\Windows\System\UAzSQqR.exe
  2⤵
  PID:7836
- C:\Windows\System\tulLVsN.exe
  C:\Windows\System\tulLVsN.exe
  2⤵
  PID:7856
- C:\Windows\System\LhhoWcp.exe
  C:\Windows\System\LhhoWcp.exe
  2⤵
  PID:7872
- C:\Windows\System\ddmsWLZ.exe
  C:\Windows\System\ddmsWLZ.exe
  2⤵
  PID:7888
- C:\Windows\System\tZpscBs.exe
  C:\Windows\System\tZpscBs.exe
  2⤵
  PID:7904
- C:\Windows\System\AOKyyLv.exe
  C:\Windows\System\AOKyyLv.exe
  2⤵
  PID:7928
- C:\Windows\System\xSNcObF.exe
  C:\Windows\System\xSNcObF.exe
  2⤵
  PID:7956
- C:\Windows\System\thyrFtd.exe
  C:\Windows\System\thyrFtd.exe
  2⤵
  PID:7976
- C:\Windows\System\akLPgfA.exe
  C:\Windows\System\akLPgfA.exe
  2⤵
  PID:8004
- C:\Windows\System\EyaABBZ.exe
  C:\Windows\System\EyaABBZ.exe
  2⤵
  PID:8024
- C:\Windows\System\bdjQEKF.exe
  C:\Windows\System\bdjQEKF.exe
  2⤵
  PID:8040
- C:\Windows\System\LPVqzbR.exe
  C:\Windows\System\LPVqzbR.exe
  2⤵
  PID:8072
- C:\Windows\System\oFODfDm.exe
  C:\Windows\System\oFODfDm.exe
  2⤵
  PID:8088
- C:\Windows\System\TEJDLdb.exe
  C:\Windows\System\TEJDLdb.exe
  2⤵
  PID:8104
- C:\Windows\System\BwArPFq.exe
  C:\Windows\System\BwArPFq.exe
  2⤵
  PID:8128
- C:\Windows\System\mGYWlvA.exe
  C:\Windows\System\mGYWlvA.exe
  2⤵
  PID:8144
- C:\Windows\System\BXdnxMw.exe
  C:\Windows\System\BXdnxMw.exe
  2⤵
  PID:8164
- C:\Windows\System\XFTBcnA.exe
  C:\Windows\System\XFTBcnA.exe
  2⤵
  PID:8184
- C:\Windows\System\vItHgtB.exe
  C:\Windows\System\vItHgtB.exe
  2⤵
  PID:7080
- C:\Windows\System\XYJfolv.exe
  C:\Windows\System\XYJfolv.exe
  2⤵
  PID:7240
- C:\Windows\System\VlTCPYA.exe
  C:\Windows\System\VlTCPYA.exe
  2⤵
  PID:6888
- C:\Windows\System\jsFWZVb.exe
  C:\Windows\System\jsFWZVb.exe
  2⤵
  PID:6804
- C:\Windows\System\bCevuTf.exe
  C:\Windows\System\bCevuTf.exe
  2⤵
  PID:6180
- C:\Windows\System\VaUgKaA.exe
  C:\Windows\System\VaUgKaA.exe
  2⤵
  PID:7184
- C:\Windows\System\eYlhSKs.exe
  C:\Windows\System\eYlhSKs.exe
  2⤵
  PID:7372
- C:\Windows\System\zjaLmQH.exe
  C:\Windows\System\zjaLmQH.exe
  2⤵
  PID:7404
- C:\Windows\System\wJqTArh.exe
  C:\Windows\System\wJqTArh.exe
  2⤵
  PID:7260
- C:\Windows\System\xXmVqQJ.exe
  C:\Windows\System\xXmVqQJ.exe
  2⤵
  PID:7280
- C:\Windows\System\ZPJDtVI.exe
  C:\Windows\System\ZPJDtVI.exe
  2⤵
  PID:7300
- C:\Windows\System\vWGsbxJ.exe
  C:\Windows\System\vWGsbxJ.exe
  2⤵
  PID:7316
- C:\Windows\System\VsmqnLd.exe
  C:\Windows\System\VsmqnLd.exe
  2⤵
  PID:7336
- C:\Windows\System\bHgyhDq.exe
  C:\Windows\System\bHgyhDq.exe
  2⤵
  PID:7360
- C:\Windows\System\qMnIZmc.exe
  C:\Windows\System\qMnIZmc.exe
  2⤵
  PID:7448
- C:\Windows\System\jbPYGoF.exe
  C:\Windows\System\jbPYGoF.exe
  2⤵
  PID:7460
- C:\Windows\System\JLLwplj.exe
  C:\Windows\System\JLLwplj.exe
  2⤵
  PID:7528
- C:\Windows\System\oLkGZTO.exe
  C:\Windows\System\oLkGZTO.exe
  2⤵
  PID:7476
- C:\Windows\System\nfgewYP.exe
  C:\Windows\System\nfgewYP.exe
  2⤵
  PID:7628
- C:\Windows\System\JiHGSAf.exe
  C:\Windows\System\JiHGSAf.exe
  2⤵
  PID:7680
- C:\Windows\System\RUnZkvT.exe
  C:\Windows\System\RUnZkvT.exe
  2⤵
  PID:7656
- C:\Windows\System\ijRPVLp.exe
  C:\Windows\System\ijRPVLp.exe
  2⤵
  PID:7696
- C:\Windows\System\msJEsxP.exe
  C:\Windows\System\msJEsxP.exe
  2⤵
  PID:7740
- C:\Windows\System\oIEhwie.exe
  C:\Windows\System\oIEhwie.exe
  2⤵
  PID:7812
- C:\Windows\System\KMOtzzO.exe
  C:\Windows\System\KMOtzzO.exe
  2⤵
  PID:7880
- C:\Windows\System\umLsszp.exe
  C:\Windows\System\umLsszp.exe
  2⤵
  PID:7884
- C:\Windows\System\zkwKbEh.exe
  C:\Windows\System\zkwKbEh.exe
  2⤵
  PID:7824
- C:\Windows\System\EVmEhPD.exe
  C:\Windows\System\EVmEhPD.exe
  2⤵
  PID:7924
- C:\Windows\System\ryJwKuv.exe
  C:\Windows\System\ryJwKuv.exe
  2⤵
  PID:7972
- C:\Windows\System\zXsEVha.exe
  C:\Windows\System\zXsEVha.exe
  2⤵
  PID:7936
- C:\Windows\System\BIPYvPW.exe
  C:\Windows\System\BIPYvPW.exe
  2⤵
  PID:7996
- C:\Windows\System\owhMMXC.exe
  C:\Windows\System\owhMMXC.exe
  2⤵
  PID:7984
- C:\Windows\System\LGtpeXK.exe
  C:\Windows\System\LGtpeXK.exe
  2⤵
  PID:8064
- C:\Windows\System\IMyOrEl.exe
  C:\Windows\System\IMyOrEl.exe
  2⤵
  PID:8136
- C:\Windows\System\ZfhIMlj.exe
  C:\Windows\System\ZfhIMlj.exe
  2⤵
  PID:8156
- C:\Windows\System\kiRsgXF.exe
  C:\Windows\System\kiRsgXF.exe
  2⤵
  PID:8176
- C:\Windows\System\FrnfpQw.exe
  C:\Windows\System\FrnfpQw.exe
  2⤵
  PID:7204
- C:\Windows\System\JuSbUcF.exe
  C:\Windows\System\JuSbUcF.exe
  2⤵
  PID:2996
- C:\Windows\System\UGQyMpS.exe
  C:\Windows\System\UGQyMpS.exe
  2⤵
  PID:6316
- C:\Windows\System\ZKrBTmx.exe
  C:\Windows\System\ZKrBTmx.exe
  2⤵
  PID:7348
- C:\Windows\System\KYyWMuI.exe
  C:\Windows\System\KYyWMuI.exe
  2⤵
  PID:7224
- C:\Windows\System\HYqnEfw.exe
  C:\Windows\System\HYqnEfw.exe
  2⤵
  PID:7312
- C:\Windows\System\KxHybmZ.exe
  C:\Windows\System\KxHybmZ.exe
  2⤵
  PID:7288
- C:\Windows\System\itERFOH.exe
  C:\Windows\System\itERFOH.exe
  2⤵
  PID:7432
- C:\Windows\System\xXHZjsP.exe
  C:\Windows\System\xXHZjsP.exe
  2⤵
  PID:7492
- C:\Windows\System\vwEtnTN.exe
  C:\Windows\System\vwEtnTN.exe
  2⤵
  PID:7548
- C:\Windows\System\fOuTUWs.exe
  C:\Windows\System\fOuTUWs.exe
  2⤵
  PID:7604
- C:\Windows\System\tUHWuNG.exe
  C:\Windows\System\tUHWuNG.exe
  2⤵
  PID:7624
- C:\Windows\System\xIVsCqs.exe
  C:\Windows\System\xIVsCqs.exe
  2⤵
  PID:7612
- C:\Windows\System\xXAXjhY.exe
  C:\Windows\System\xXAXjhY.exe
  2⤵
  PID:7716
- C:\Windows\System\riLfSdW.exe
  C:\Windows\System\riLfSdW.exe
  2⤵
  PID:8016
- C:\Windows\System\YDXrVrm.exe
  C:\Windows\System\YDXrVrm.exe
  2⤵
  PID:8032
- C:\Windows\System\WZUeFiB.exe
  C:\Windows\System\WZUeFiB.exe
  2⤵
  PID:7808
- C:\Windows\System\YNPsJpL.exe
  C:\Windows\System\YNPsJpL.exe
  2⤵
  PID:7712
- C:\Windows\System\pHrynYC.exe
  C:\Windows\System\pHrynYC.exe
  2⤵
  PID:8056
- C:\Windows\System\iutWTRQ.exe
  C:\Windows\System\iutWTRQ.exe
  2⤵
  PID:7968
- C:\Windows\System\KEGghBM.exe
  C:\Windows\System\KEGghBM.exe
  2⤵
  PID:7948
- C:\Windows\System\xSbUSRd.exe
  C:\Windows\System\xSbUSRd.exe
  2⤵
  PID:7200
- C:\Windows\System\anGQbxf.exe
  C:\Windows\System\anGQbxf.exe
  2⤵
  PID:2952
- C:\Windows\System\lDResBj.exe
  C:\Windows\System\lDResBj.exe
  2⤵
  PID:6660
- C:\Windows\System\KkGGVMm.exe
  C:\Windows\System\KkGGVMm.exe
  2⤵
  PID:7328
- C:\Windows\System\BAvXvbx.exe
  C:\Windows\System\BAvXvbx.exe
  2⤵
  PID:7392
- C:\Windows\System\GYpUBUf.exe
  C:\Windows\System\GYpUBUf.exe
  2⤵
  PID:7512
- C:\Windows\System\wQIpAdD.exe
  C:\Windows\System\wQIpAdD.exe
  2⤵
  PID:7356
- C:\Windows\System\oBMFmTt.exe
  C:\Windows\System\oBMFmTt.exe
  2⤵
  PID:7644
- C:\Windows\System\HjltgUn.exe
  C:\Windows\System\HjltgUn.exe
  2⤵
  PID:7596
- C:\Windows\System\dDReoVY.exe
  C:\Windows\System\dDReoVY.exe
  2⤵
  PID:7744
- C:\Windows\System\ChfPdKP.exe
  C:\Windows\System\ChfPdKP.exe
  2⤵
  PID:8012
- C:\Windows\System\ypxrGGE.exe
  C:\Windows\System\ypxrGGE.exe
  2⤵
  PID:8116
- C:\Windows\System\hFLtclC.exe
  C:\Windows\System\hFLtclC.exe
  2⤵
  PID:8096
- C:\Windows\System\nGirBaB.exe
  C:\Windows\System\nGirBaB.exe
  2⤵
  PID:8084
- C:\Windows\System\rUeTtai.exe
  C:\Windows\System\rUeTtai.exe
  2⤵
  PID:7028
- C:\Windows\System\dJdJoAq.exe
  C:\Windows\System\dJdJoAq.exe
  2⤵
  PID:6184
- C:\Windows\System\KTZYuKB.exe
  C:\Windows\System\KTZYuKB.exe
  2⤵
  PID:4728
- C:\Windows\System\KwvBEXq.exe
  C:\Windows\System\KwvBEXq.exe
  2⤵
  PID:7916
- C:\Windows\System\BCsYyaO.exe
  C:\Windows\System\BCsYyaO.exe
  2⤵
  PID:8036
- C:\Windows\System\wRhYqvY.exe
  C:\Windows\System\wRhYqvY.exe
  2⤵
  PID:8124
- C:\Windows\System\SflSZVH.exe
  C:\Windows\System\SflSZVH.exe
  2⤵
  PID:7864
- C:\Windows\System\gjqHdgx.exe
  C:\Windows\System\gjqHdgx.exe
  2⤵
  PID:6232
- C:\Windows\System\PktUYdD.exe
  C:\Windows\System\PktUYdD.exe
  2⤵
  PID:6236
- C:\Windows\System\oytSsrJ.exe
  C:\Windows\System\oytSsrJ.exe
  2⤵
  PID:7412
- C:\Windows\System\mlYwJxk.exe
  C:\Windows\System\mlYwJxk.exe
  2⤵
  PID:7848
- C:\Windows\System\evLyEYQ.exe
  C:\Windows\System\evLyEYQ.exe
  2⤵
  PID:6200
- C:\Windows\System\JEXXOyE.exe
  C:\Windows\System\JEXXOyE.exe
  2⤵
  PID:7676
- C:\Windows\System\DNYsZFU.exe
  C:\Windows\System\DNYsZFU.exe
  2⤵
  PID:7564
- C:\Windows\System\InEisEa.exe
  C:\Windows\System\InEisEa.exe
  2⤵
  PID:8180
- C:\Windows\System\vGHRSKZ.exe
  C:\Windows\System\vGHRSKZ.exe
  2⤵
  PID:8208
- C:\Windows\System\FjyeBwh.exe
  C:\Windows\System\FjyeBwh.exe
  2⤵
  PID:8236
- C:\Windows\System\yYRBNoW.exe
  C:\Windows\System\yYRBNoW.exe
  2⤵
  PID:8252
- C:\Windows\System\sfcVjrK.exe
  C:\Windows\System\sfcVjrK.exe
  2⤵
  PID:8272
- C:\Windows\System\zpXvqHX.exe
  C:\Windows\System\zpXvqHX.exe
  2⤵
  PID:8288
- C:\Windows\System\tcMZYLG.exe
  C:\Windows\System\tcMZYLG.exe
  2⤵
  PID:8312
- C:\Windows\System\SPySkWr.exe
  C:\Windows\System\SPySkWr.exe
  2⤵
  PID:8332
- C:\Windows\System\TQAqphp.exe
  C:\Windows\System\TQAqphp.exe
  2⤵
  PID:8348
- C:\Windows\System\iTTQUNn.exe
  C:\Windows\System\iTTQUNn.exe
  2⤵
  PID:8372
- C:\Windows\System\yJHBKkz.exe
  C:\Windows\System\yJHBKkz.exe
  2⤵
  PID:8388
- C:\Windows\System\KdaUCaJ.exe
  C:\Windows\System\KdaUCaJ.exe
  2⤵
  PID:8404
- C:\Windows\System\xiZdCTY.exe
  C:\Windows\System\xiZdCTY.exe
  2⤵
  PID:8424
- C:\Windows\System\lPYVbNl.exe
  C:\Windows\System\lPYVbNl.exe
  2⤵
  PID:8444
- C:\Windows\System\LBXFtCl.exe
  C:\Windows\System\LBXFtCl.exe
  2⤵
  PID:8464
- C:\Windows\System\MITguyE.exe
  C:\Windows\System\MITguyE.exe
  2⤵
  PID:8480
- C:\Windows\System\zJtyKxg.exe
  C:\Windows\System\zJtyKxg.exe
  2⤵
  PID:8508
- C:\Windows\System\zwLnKku.exe
  C:\Windows\System\zwLnKku.exe
  2⤵
  PID:8528
- C:\Windows\System\VjyQldr.exe
  C:\Windows\System\VjyQldr.exe
  2⤵
  PID:8544
- C:\Windows\System\hyAwkxW.exe
  C:\Windows\System\hyAwkxW.exe
  2⤵
  PID:8560
- C:\Windows\System\LcYhdHM.exe
  C:\Windows\System\LcYhdHM.exe
  2⤵
  PID:8576
- C:\Windows\System\Otpjits.exe
  C:\Windows\System\Otpjits.exe
  2⤵
  PID:8596
- C:\Windows\System\WgQLTwv.exe
  C:\Windows\System\WgQLTwv.exe
  2⤵
  PID:8620
- C:\Windows\System\uhsuCtB.exe
  C:\Windows\System\uhsuCtB.exe
  2⤵
  PID:8640
- C:\Windows\System\eGyiMdZ.exe
  C:\Windows\System\eGyiMdZ.exe
  2⤵
  PID:8656
- C:\Windows\System\lepCkLS.exe
  C:\Windows\System\lepCkLS.exe
  2⤵
  PID:8672
- C:\Windows\System\CjKqtpO.exe
  C:\Windows\System\CjKqtpO.exe
  2⤵
  PID:8692
- C:\Windows\System\GDWQPYx.exe
  C:\Windows\System\GDWQPYx.exe
  2⤵
  PID:8712
- C:\Windows\System\cEfPufV.exe
  C:\Windows\System\cEfPufV.exe
  2⤵
  PID:8728
- C:\Windows\System\LRXEXYw.exe
  C:\Windows\System\LRXEXYw.exe
  2⤵
  PID:8744
- C:\Windows\System\bDkrKkg.exe
  C:\Windows\System\bDkrKkg.exe
  2⤵
  PID:8760
- C:\Windows\System\YkerwbB.exe
  C:\Windows\System\YkerwbB.exe
  2⤵
  PID:8780
- C:\Windows\System\FWOOvzs.exe
  C:\Windows\System\FWOOvzs.exe
  2⤵
  PID:8800
- C:\Windows\System\bNFRfdz.exe
  C:\Windows\System\bNFRfdz.exe
  2⤵
  PID:8820
- C:\Windows\System\OVOCYEE.exe
  C:\Windows\System\OVOCYEE.exe
  2⤵
  PID:8836
- C:\Windows\System\BdeHTUF.exe
  C:\Windows\System\BdeHTUF.exe
  2⤵
  PID:8908
- C:\Windows\System\zEAJPbH.exe
  C:\Windows\System\zEAJPbH.exe
  2⤵
  PID:8924
- C:\Windows\System\twMzmSR.exe
  C:\Windows\System\twMzmSR.exe
  2⤵
  PID:8948
- C:\Windows\System\HIBAqpZ.exe
  C:\Windows\System\HIBAqpZ.exe
  2⤵
  PID:8964
- C:\Windows\System\blKfKVa.exe
  C:\Windows\System\blKfKVa.exe
  2⤵
  PID:8980
- C:\Windows\System\VWsFFuf.exe
  C:\Windows\System\VWsFFuf.exe
  2⤵
  PID:9000
- C:\Windows\System\bIRxXhE.exe
  C:\Windows\System\bIRxXhE.exe
  2⤵
  PID:9016
- C:\Windows\System\nDTjgZe.exe
  C:\Windows\System\nDTjgZe.exe
  2⤵
  PID:9032
- C:\Windows\System\pgrOSrm.exe
  C:\Windows\System\pgrOSrm.exe
  2⤵
  PID:9056
- C:\Windows\System\KIWyNTx.exe
  C:\Windows\System\KIWyNTx.exe
  2⤵
  PID:9080
- C:\Windows\System\eqpgBlY.exe
  C:\Windows\System\eqpgBlY.exe
  2⤵
  PID:9096
- C:\Windows\System\ElVEbzI.exe
  C:\Windows\System\ElVEbzI.exe
  2⤵
  PID:9120
- C:\Windows\System\ttmkkYq.exe
  C:\Windows\System\ttmkkYq.exe
  2⤵
  PID:9144
- C:\Windows\System\pUoryHd.exe
  C:\Windows\System\pUoryHd.exe
  2⤵
  PID:9168
- C:\Windows\System\bvXaOWo.exe
  C:\Windows\System\bvXaOWo.exe
  2⤵
  PID:9188
- C:\Windows\System\hxjpLXE.exe
  C:\Windows\System\hxjpLXE.exe
  2⤵
  PID:9208
- C:\Windows\System\cIzTZNJ.exe
  C:\Windows\System\cIzTZNJ.exe
  2⤵
  PID:8160
- C:\Windows\System\etcewMK.exe
  C:\Windows\System\etcewMK.exe
  2⤵
  PID:8204
- C:\Windows\System\VlsYdvx.exe
  C:\Windows\System\VlsYdvx.exe
  2⤵
  PID:7272
- C:\Windows\System\bomUzUd.exe
  C:\Windows\System\bomUzUd.exe
  2⤵
  PID:8244
- C:\Windows\System\cTyzkyS.exe
  C:\Windows\System\cTyzkyS.exe
  2⤵
  PID:8268
- C:\Windows\System\FjMsIeN.exe
  C:\Windows\System\FjMsIeN.exe
  2⤵
  PID:8304
- C:\Windows\System\SlivlfE.exe
  C:\Windows\System\SlivlfE.exe
  2⤵
  PID:8344
- C:\Windows\System\lWJZNwK.exe
  C:\Windows\System\lWJZNwK.exe
  2⤵
  PID:8416
- C:\Windows\System\nzwPHdh.exe
  C:\Windows\System\nzwPHdh.exe
  2⤵
  PID:8356
- C:\Windows\System\PRppCgw.exe
  C:\Windows\System\PRppCgw.exe
  2⤵
  PID:8396
- C:\Windows\System\WgowueM.exe
  C:\Windows\System\WgowueM.exe
  2⤵
  PID:8500
- C:\Windows\System\cdkmvhX.exe
  C:\Windows\System\cdkmvhX.exe
  2⤵
  PID:8568
- C:\Windows\System\eyXNRJO.exe
  C:\Windows\System\eyXNRJO.exe
  2⤵
  PID:8616
- C:\Windows\System\rsCPKYQ.exe
  C:\Windows\System\rsCPKYQ.exe
  2⤵
  PID:8680
- C:\Windows\System\XMLBJvZ.exe
  C:\Windows\System\XMLBJvZ.exe
  2⤵
  PID:8588
- C:\Windows\System\wsqkiEt.exe
  C:\Windows\System\wsqkiEt.exe
  2⤵
  PID:8476
- C:\Windows\System\oHxMPSd.exe
  C:\Windows\System\oHxMPSd.exe
  2⤵
  PID:8636
- C:\Windows\System\hfarQYJ.exe
  C:\Windows\System\hfarQYJ.exe
  2⤵
  PID:8796
- C:\Windows\System\UzdQdJQ.exe
  C:\Windows\System\UzdQdJQ.exe
  2⤵
  PID:8828
- C:\Windows\System\wsTBkIQ.exe
  C:\Windows\System\wsTBkIQ.exe
  2⤵
  PID:8704
- C:\Windows\System\WgKBldC.exe
  C:\Windows\System\WgKBldC.exe
  2⤵
  PID:8768
- C:\Windows\System\jkXhsKF.exe
  C:\Windows\System\jkXhsKF.exe
  2⤵
  PID:8816
- C:\Windows\System\GwIByUl.exe
  C:\Windows\System\GwIByUl.exe
  2⤵
  PID:8904
- C:\Windows\System\hOTvTgc.exe
  C:\Windows\System\hOTvTgc.exe
  2⤵
  PID:8960
- C:\Windows\System\twyXMCO.exe
  C:\Windows\System\twyXMCO.exe
  2⤵
  PID:9024
- C:\Windows\System\avfkpvZ.exe
  C:\Windows\System\avfkpvZ.exe
  2⤵
  PID:9072
- C:\Windows\System\vEkMBMc.exe
  C:\Windows\System\vEkMBMc.exe
  2⤵
  PID:9116
- C:\Windows\System\dBhuDJw.exe
  C:\Windows\System\dBhuDJw.exe
  2⤵
  PID:9128
- C:\Windows\System\AmejXPA.exe
  C:\Windows\System\AmejXPA.exe
  2⤵
  PID:8940
- C:\Windows\System\DtVQPYm.exe
  C:\Windows\System\DtVQPYm.exe
  2⤵
  PID:9008
- C:\Windows\System\AYeDJNk.exe
  C:\Windows\System\AYeDJNk.exe
  2⤵
  PID:9088
- C:\Windows\System\lMKVrry.exe
  C:\Windows\System\lMKVrry.exe
  2⤵
  PID:9180
- C:\Windows\System\dWrKeha.exe
  C:\Windows\System\dWrKeha.exe
  2⤵
  PID:9204
- C:\Windows\System\nsrvjAz.exe
  C:\Windows\System\nsrvjAz.exe
  2⤵
  PID:7500
- C:\Windows\System\gOJVjra.exe
  C:\Windows\System\gOJVjra.exe
  2⤵
  PID:8224
- C:\Windows\System\RyUNOSt.exe
  C:\Windows\System\RyUNOSt.exe
  2⤵
  PID:6492
- C:\Windows\System\QgwngSw.exe
  C:\Windows\System\QgwngSw.exe
  2⤵
  PID:8260
- C:\Windows\System\itOlJFI.exe
  C:\Windows\System\itOlJFI.exe
  2⤵
  PID:8324
- C:\Windows\System\mEEexYe.exe
  C:\Windows\System\mEEexYe.exe
  2⤵
  PID:8436
- C:\Windows\System\UfEwEjP.exe
  C:\Windows\System\UfEwEjP.exe
  2⤵
  PID:8536
- C:\Windows\System\XETLxXc.exe
  C:\Windows\System\XETLxXc.exe
  2⤵
  PID:8628
- C:\Windows\System\KDxmOmd.exe
  C:\Windows\System\KDxmOmd.exe
  2⤵
  PID:8608
- C:\Windows\System\gIKfiiH.exe
  C:\Windows\System\gIKfiiH.exe
  2⤵
  PID:8584
- C:\Windows\System\yeJusWI.exe
  C:\Windows\System\yeJusWI.exe
  2⤵
  PID:8792
- C:\Windows\System\LQGBqDZ.exe
  C:\Windows\System\LQGBqDZ.exe
  2⤵
  PID:8700
- C:\Windows\System\bfuRhQO.exe
  C:\Windows\System\bfuRhQO.exe
  2⤵
  PID:8892
- C:\Windows\System\RuiTkmy.exe
  C:\Windows\System\RuiTkmy.exe
  2⤵
  PID:8868
- C:\Windows\System\bWFgUuo.exe
  C:\Windows\System\bWFgUuo.exe
  2⤵
  PID:8896
- C:\Windows\System\nZpGykN.exe
  C:\Windows\System\nZpGykN.exe
  2⤵
  PID:9064
- C:\Windows\System\HFKqsav.exe
  C:\Windows\System\HFKqsav.exe
  2⤵
  PID:9136
- C:\Windows\System\snFnEte.exe
  C:\Windows\System\snFnEte.exe
  2⤵
  PID:8216
- C:\Windows\System\kctWVLK.exe
  C:\Windows\System\kctWVLK.exe
  2⤵
  PID:8300
- C:\Windows\System\yLUxnpZ.exe
  C:\Windows\System\yLUxnpZ.exe
  2⤵
  PID:9164
- C:\Windows\System\qhQVlnc.exe
  C:\Windows\System\qhQVlnc.exe
  2⤵
  PID:7964
- C:\Windows\System\jiKBRjs.exe
  C:\Windows\System\jiKBRjs.exe
  2⤵
  PID:8264
- C:\Windows\System\ubAGWAZ.exe
  C:\Windows\System\ubAGWAZ.exe
  2⤵
  PID:8456
- C:\Windows\System\NplraTa.exe
  C:\Windows\System\NplraTa.exe
  2⤵
  PID:8652
- C:\Windows\System\cEOHDrF.exe
  C:\Windows\System\cEOHDrF.exe
  2⤵
  PID:8604
- C:\Windows\System\MRXMpzI.exe
  C:\Windows\System\MRXMpzI.exe
  2⤵
  PID:8552
- C:\Windows\System\yLDJKgo.exe
  C:\Windows\System\yLDJKgo.exe
  2⤵
  PID:8888
- C:\Windows\System\SVasOVY.exe
  C:\Windows\System\SVasOVY.exe
  2⤵
  PID:8916
- C:\Windows\System\oVkrioo.exe
  C:\Windows\System\oVkrioo.exe
  2⤵
  PID:9152
- C:\Windows\System\eGkQwOW.exe
  C:\Windows\System\eGkQwOW.exe
  2⤵
  PID:9132
- C:\Windows\System\MmvlgyT.exe
  C:\Windows\System\MmvlgyT.exe
  2⤵
  PID:9176
- C:\Windows\System\veuBgrG.exe
  C:\Windows\System\veuBgrG.exe
  2⤵
  PID:7736
- C:\Windows\System\NpHkaXu.exe
  C:\Windows\System\NpHkaXu.exe
  2⤵
  PID:9044
- C:\Windows\System\tazJCuc.exe
  C:\Windows\System\tazJCuc.exe
  2⤵
  PID:8400
- C:\Windows\System\vZlscay.exe
  C:\Windows\System\vZlscay.exe
  2⤵
  PID:8496
- C:\Windows\System\paVEpcV.exe
  C:\Windows\System\paVEpcV.exe
  2⤵
  PID:8788
- C:\Windows\System\pclfeiO.exe
  C:\Windows\System\pclfeiO.exe
  2⤵
  PID:8668
- C:\Windows\System\GxZmTjI.exe
  C:\Windows\System\GxZmTjI.exe
  2⤵
  PID:9040
- C:\Windows\System\IfsEKGl.exe
  C:\Windows\System\IfsEKGl.exe
  2⤵
  PID:7832
- C:\Windows\System\NvTUAwn.exe
  C:\Windows\System\NvTUAwn.exe
  2⤵
  PID:8284
- C:\Windows\System\fbxhdLD.exe
  C:\Windows\System\fbxhdLD.exe
  2⤵
  PID:8340
- C:\Windows\System\AZfbETc.exe
  C:\Windows\System\AZfbETc.exe
  2⤵
  PID:8860
- C:\Windows\System\yJFyhJU.exe
  C:\Windows\System\yJFyhJU.exe
  2⤵
  PID:8976
- C:\Windows\System\dJQoZIU.exe
  C:\Windows\System\dJQoZIU.exe
  2⤵
  PID:9112
- C:\Windows\System\fiCZAaS.exe
  C:\Windows\System\fiCZAaS.exe
  2⤵
  PID:8724
- C:\Windows\System\icWdJtW.exe
  C:\Windows\System\icWdJtW.exe
  2⤵
  PID:8516
- C:\Windows\System\jwkgyzt.exe
  C:\Windows\System\jwkgyzt.exe
  2⤵
  PID:8876
- C:\Windows\System\xgMqXEZ.exe
  C:\Windows\System\xgMqXEZ.exe
  2⤵
  PID:8956
- C:\Windows\System\pNozepu.exe
  C:\Windows\System\pNozepu.exe
  2⤵
  PID:9228
- C:\Windows\System\iiMriKe.exe
  C:\Windows\System\iiMriKe.exe
  2⤵
  PID:9244
- C:\Windows\System\mUFAOmr.exe
  C:\Windows\System\mUFAOmr.exe
  2⤵
  PID:9260
- C:\Windows\System\Pmrfdum.exe
  C:\Windows\System\Pmrfdum.exe
  2⤵
  PID:9280
- C:\Windows\System\xaveCHs.exe
  C:\Windows\System\xaveCHs.exe
  2⤵
  PID:9304
- C:\Windows\System\ZvgJBwB.exe
  C:\Windows\System\ZvgJBwB.exe
  2⤵
  PID:9320
- C:\Windows\System\tYxzryB.exe
  C:\Windows\System\tYxzryB.exe
  2⤵
  PID:9340
- C:\Windows\System\WBbiEqc.exe
  C:\Windows\System\WBbiEqc.exe
  2⤵
  PID:9360
- C:\Windows\System\uGSPKIo.exe
  C:\Windows\System\uGSPKIo.exe
  2⤵
  PID:9384
- C:\Windows\System\COLBjea.exe
  C:\Windows\System\COLBjea.exe
  2⤵
  PID:9408
- C:\Windows\System\uhXmndE.exe
  C:\Windows\System\uhXmndE.exe
  2⤵
  PID:9428
- C:\Windows\System\VQKTSjE.exe
  C:\Windows\System\VQKTSjE.exe
  2⤵
  PID:9452
- C:\Windows\System\rCgWPml.exe
  C:\Windows\System\rCgWPml.exe
  2⤵
  PID:9476
- C:\Windows\System\BvNThuF.exe
  C:\Windows\System\BvNThuF.exe
  2⤵
  PID:9500
- C:\Windows\System\fmtcvgV.exe
  C:\Windows\System\fmtcvgV.exe
  2⤵
  PID:9516
- C:\Windows\System\PxdExtw.exe
  C:\Windows\System\PxdExtw.exe
  2⤵
  PID:9540
- C:\Windows\System\OyaNiln.exe
  C:\Windows\System\OyaNiln.exe
  2⤵
  PID:9560
- C:\Windows\System\qIPYLXp.exe
  C:\Windows\System\qIPYLXp.exe
  2⤵
  PID:9576
- C:\Windows\System\XWIutNR.exe
  C:\Windows\System\XWIutNR.exe
  2⤵
  PID:9596
- C:\Windows\System\wfeXBdL.exe
  C:\Windows\System\wfeXBdL.exe
  2⤵
  PID:9616
- C:\Windows\System\jpgJREz.exe
  C:\Windows\System\jpgJREz.exe
  2⤵
  PID:9648
- C:\Windows\System\OSsdoSk.exe
  C:\Windows\System\OSsdoSk.exe
  2⤵
  PID:9664
- C:\Windows\System\gfzcKkw.exe
  C:\Windows\System\gfzcKkw.exe
  2⤵
  PID:9680
- C:\Windows\System\OzEVRqe.exe
  C:\Windows\System\OzEVRqe.exe
  2⤵
  PID:9700
- C:\Windows\System\AtUczqT.exe
  C:\Windows\System\AtUczqT.exe
  2⤵
  PID:9720
- C:\Windows\System\GcSbWaJ.exe
  C:\Windows\System\GcSbWaJ.exe
  2⤵
  PID:9736
- C:\Windows\System\EPiFWsi.exe
  C:\Windows\System\EPiFWsi.exe
  2⤵
  PID:9752
- C:\Windows\System\gssMPph.exe
  C:\Windows\System\gssMPph.exe
  2⤵
  PID:9768
- C:\Windows\System\JBuWiML.exe
  C:\Windows\System\JBuWiML.exe
  2⤵
  PID:9784
- C:\Windows\System\mdTADsT.exe
  C:\Windows\System\mdTADsT.exe
  2⤵
  PID:9808
- C:\Windows\System\ArOnMqA.exe
  C:\Windows\System\ArOnMqA.exe
  2⤵
  PID:9828
- C:\Windows\System\EItASZi.exe
  C:\Windows\System\EItASZi.exe
  2⤵
  PID:9848
- C:\Windows\System\rVALSZt.exe
  C:\Windows\System\rVALSZt.exe
  2⤵
  PID:9864
- C:\Windows\System\hunNNfg.exe
  C:\Windows\System\hunNNfg.exe
  2⤵
  PID:9896
- C:\Windows\System\cvGTJxV.exe
  C:\Windows\System\cvGTJxV.exe
  2⤵
  PID:9932
- C:\Windows\System\mZFVnoR.exe
  C:\Windows\System\mZFVnoR.exe
  2⤵
  PID:9948
- C:\Windows\System\gphDdOp.exe
  C:\Windows\System\gphDdOp.exe
  2⤵
  PID:9964
- C:\Windows\System\GTulZtJ.exe
  C:\Windows\System\GTulZtJ.exe
  2⤵
  PID:9980
- C:\Windows\System\DHrjcmY.exe
  C:\Windows\System\DHrjcmY.exe
  2⤵
  PID:9996
- C:\Windows\System\IJYIIrQ.exe
  C:\Windows\System\IJYIIrQ.exe
  2⤵
  PID:10016
- C:\Windows\System\CPPnyAP.exe
  C:\Windows\System\CPPnyAP.exe
  2⤵
  PID:10032
- C:\Windows\System\PhvmQAZ.exe
  C:\Windows\System\PhvmQAZ.exe
  2⤵
  PID:10052
- C:\Windows\System\WcFxijF.exe
  C:\Windows\System\WcFxijF.exe
  2⤵
  PID:10080
- C:\Windows\System\zhbknke.exe
  C:\Windows\System\zhbknke.exe
  2⤵
  PID:10100
- C:\Windows\System\HeFJKrq.exe
  C:\Windows\System\HeFJKrq.exe
  2⤵
  PID:10120
- C:\Windows\System\lQRhCIN.exe
  C:\Windows\System\lQRhCIN.exe
  2⤵
  PID:10136
- C:\Windows\System\wFomMMu.exe
  C:\Windows\System\wFomMMu.exe
  2⤵
  PID:10152
- C:\Windows\System\lWpWbKI.exe
  C:\Windows\System\lWpWbKI.exe
  2⤵
  PID:10196
- C:\Windows\System\oUeGySH.exe
  C:\Windows\System\oUeGySH.exe
  2⤵
  PID:10212
- C:\Windows\System\uQAHCXu.exe
  C:\Windows\System\uQAHCXu.exe
  2⤵
  PID:10228
- C:\Windows\System\TETcmpZ.exe
  C:\Windows\System\TETcmpZ.exe
  2⤵
  PID:9220
- C:\Windows\System\rCeyqcA.exe
  C:\Windows\System\rCeyqcA.exe
  2⤵
  PID:9292
- C:\Windows\System\nykEIEQ.exe
  C:\Windows\System\nykEIEQ.exe
  2⤵
  PID:9332
- C:\Windows\System\KrNFjTf.exe
  C:\Windows\System\KrNFjTf.exe
  2⤵
  PID:9352
- C:\Windows\System\EqFchKY.exe
  C:\Windows\System\EqFchKY.exe
  2⤵
  PID:9368
- C:\Windows\System\GaSkeok.exe
  C:\Windows\System\GaSkeok.exe
  2⤵
  PID:9236
- C:\Windows\System\qxeqIHs.exe
  C:\Windows\System\qxeqIHs.exe
  2⤵
  PID:9380
- C:\Windows\System\OHNoALZ.exe
  C:\Windows\System\OHNoALZ.exe
  2⤵
  PID:9404
- C:\Windows\System\wUehgyz.exe
  C:\Windows\System\wUehgyz.exe
  2⤵
  PID:9460
- C:\Windows\System\KrjIYWb.exe
  C:\Windows\System\KrjIYWb.exe
  2⤵
  PID:9508
- C:\Windows\System\VMYVoPT.exe
  C:\Windows\System\VMYVoPT.exe
  2⤵
  PID:9552
- C:\Windows\System\IfdpGUe.exe
  C:\Windows\System\IfdpGUe.exe
  2⤵
  PID:9584
- C:\Windows\System\jWgapxd.exe
  C:\Windows\System\jWgapxd.exe
  2⤵
  PID:9528
- C:\Windows\System\CIUEMTM.exe
  C:\Windows\System\CIUEMTM.exe
  2⤵
  PID:9568
- C:\Windows\System\MiiYVTh.exe
  C:\Windows\System\MiiYVTh.exe
  2⤵
  PID:9644
- C:\Windows\System\haagfJo.exe
  C:\Windows\System\haagfJo.exe
  2⤵
  PID:9676
- C:\Windows\System\IiHDBkR.exe
  C:\Windows\System\IiHDBkR.exe
  2⤵
  PID:9744
- C:\Windows\System\JJHJsGy.exe
  C:\Windows\System\JJHJsGy.exe
  2⤵
  PID:9732
- C:\Windows\System\YHeQPqo.exe
  C:\Windows\System\YHeQPqo.exe
  2⤵
  PID:9804
- C:\Windows\System\oSRBuEg.exe
  C:\Windows\System\oSRBuEg.exe
  2⤵
  PID:9844
- C:\Windows\System\XPpdicS.exe
  C:\Windows\System\XPpdicS.exe
  2⤵
  PID:9904
- C:\Windows\System\TIAhsvN.exe
  C:\Windows\System\TIAhsvN.exe
  2⤵
  PID:9888
- C:\Windows\System\AIBdktZ.exe
  C:\Windows\System\AIBdktZ.exe
  2⤵
  PID:9928
- C:\Windows\System\ZEMzbSV.exe
  C:\Windows\System\ZEMzbSV.exe
  2⤵
  PID:9988
- C:\Windows\System\erFSUxX.exe
  C:\Windows\System\erFSUxX.exe
  2⤵
  PID:10028
- C:\Windows\System\XXRdAmk.exe
  C:\Windows\System\XXRdAmk.exe
  2⤵
  PID:10068
- C:\Windows\System\pzsnjfw.exe
  C:\Windows\System\pzsnjfw.exe
  2⤵
  PID:10096
- C:\Windows\System\BgoWjoD.exe
  C:\Windows\System\BgoWjoD.exe
  2⤵
  PID:10112
- C:\Windows\System\lRasnzI.exe
  C:\Windows\System\lRasnzI.exe
  2⤵
  PID:10160
- C:\Windows\System\EuktNWU.exe
  C:\Windows\System\EuktNWU.exe
  2⤵
  PID:10172
- C:\Windows\System\IuBzeHa.exe
  C:\Windows\System\IuBzeHa.exe
  2⤵
  PID:9840
- C:\Windows\System\irvefCY.exe
  C:\Windows\System\irvefCY.exe
  2⤵
  PID:10236
- C:\Windows\System\QoRwnAn.exe
  C:\Windows\System\QoRwnAn.exe
  2⤵
  PID:9316
- C:\Windows\System\kPOcBue.exe
  C:\Windows\System\kPOcBue.exe
  2⤵
  PID:9256
- C:\Windows\System\BNALUuv.exe
  C:\Windows\System\BNALUuv.exe
  2⤵
  PID:9376
- C:\Windows\System\JeQXAxI.exe
  C:\Windows\System\JeQXAxI.exe
  2⤵
  PID:9400
- C:\Windows\System\kQhpncW.exe
  C:\Windows\System\kQhpncW.exe
  2⤵
  PID:9436
- C:\Windows\System\wFRkNaV.exe
  C:\Windows\System\wFRkNaV.exe
  2⤵
  PID:9548
- C:\Windows\System\dGrqtOy.exe
  C:\Windows\System\dGrqtOy.exe
  2⤵
  PID:9604
- C:\Windows\System\JghoEBc.exe
  C:\Windows\System\JghoEBc.exe
  2⤵
  PID:9484
- C:\Windows\System\xHDkSDH.exe
  C:\Windows\System\xHDkSDH.exe
  2⤵
  PID:9496
- C:\Windows\System\BhkFLLp.exe
  C:\Windows\System\BhkFLLp.exe
  2⤵
  PID:9792
- C:\Windows\System\ZPPZuyd.exe
  C:\Windows\System\ZPPZuyd.exe
  2⤵
  PID:9688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVjSghY.exe

Filesize
1.9MB

MD5
3ba7d8298f744648c1c8539452cbb60f

SHA1
59e71509c0ce77903c91b959062fdb58b639ecf4

SHA256
948730762ef4359c98ababca8338f1ce4ad3cb91c3ed5b8a19a7c7355d072cd1

SHA512
49d180eb085d07fbede9af324689b8244feec7822ad25dba20b8a28b220299e93a18a457fe228e5ff326f34b1fd517af1bb8e489b17976cc7e8431e61df7f009

Download Submit
C:\Windows\system\AhQUXUN.exe

Filesize
1.9MB

MD5
fa15aa80b9caf2180495300716c2b24d

SHA1
5d099ca72d5df45c50cb7de3c7048621b9637913

SHA256
c5dcd247923842e5a9d9d95d7b9e44db9115f4a432fe53cabf66c75e88dd921b

SHA512
6d10c506447a420d2e8238ae2d81525b0ed7a62222470fa86145bbfb92273e221ebb8bc82cac544bc9cae246dc123fee0bc8a17b09ca3948156c70eeb3e35650

Download Submit
C:\Windows\system\EwEwoOf.exe

Filesize
1.9MB

MD5
047f5aa75a0f3b2b9cf5955f86b8a499

SHA1
9252405f8007a15615c63e4ad5bc48deaeeacb27

SHA256
74e013e1594e973e234b543a9ff9a0a5a70abfa8252871a899f42e73285d7f21

SHA512
b2c7c9eb0a23787890113993b057354eac36923947d27dc8c2353116e12cf2f12532a7d713827480c998d2fdc7f05fc02dae8be217b3839752cefc3bb428fb9a

Download Submit
C:\Windows\system\GZYdlQp.exe

Filesize
1.9MB

MD5
66c5e9433e6f20b449c3a9abe1533c21

SHA1
cf3159b5ab7a8f8f138df97c8b7c8e15de48c388

SHA256
614525607e3697fe65998cf1ab676db4cf992399e2a34674f566c63095a64745

SHA512
e7d2cdeb5443ed433d3a4fa390736880fc808010c18d22687a8e98e02eb413c675a9eb262e23fdb0ea6a792abcf4b9f78aa3d8bd87c589624d9c1d3ab331db88

Download Submit
C:\Windows\system\GnCLnqr.exe

Filesize
1.9MB

MD5
9787923ce535e3185ba4637a0509b3a6

SHA1
5b30e12d123f5c8186cecc23323bcdfdf88532bf

SHA256
1013abe875f9e588fd752b90634bf4a1dc5baa269ba1c8d8a84e7447e1fa1417

SHA512
0ba36d0072945d9587cae050aa0aa58a4194981d6fa5f65668187564b5ed73845ebaffd96ff662105c0101540f6a0f1b977f3fc8893bc6cadba2f8f47edf0e4e

Download Submit
C:\Windows\system\JPqtXKE.exe

Filesize
1.9MB

MD5
985a46907dcf0ea97a2c2f8ab219c04e

SHA1
dcf7efbdb2a9708fdd95ed726658123db2101e20

SHA256
b631d97354e6559a834260fe4ef47973425b1fa422f737aebd638d30696f93bc

SHA512
b7b247e906e4470c2d793835ded1a21107a97f1f42088f54506464856179709de879bee1071a1a944e7594f2c0ce76e47f705755ae475ddaf0ea3328536e209e

Download Submit
C:\Windows\system\JRGhJda.exe

Filesize
1.9MB

MD5
a0cb78a14fa7a1e8b4185e5e9a14b0cd

SHA1
aeddccb4ccbd05c2aa29b2ade4146ca4883aa9bc

SHA256
4faa304971facc2dcb89626eed5b5a19196e3a5b645a5fd3ef52ac6c8ea3eaa3

SHA512
b7fc413d61b087b28d86b907bb140b09c0f4a84950acd191cb39075f09ae2ae7b51f32b09a8099f9e16d7ae42a883e9b5fe3127e907a3c365dbe5fb1f141e9a3

Download Submit
C:\Windows\system\MQMFtHs.exe

Filesize
1.9MB

MD5
2d97882b806893aa83c9a55dbb188e17

SHA1
6d360980e87cf89030569239f2f91215ce4e3e88

SHA256
6601c4008c3bba39b2fbdbdddd76de5f84cb00036d4349aafe4e36e39fda9ab4

SHA512
c6cbf683343f3a8b68763bd1eb835eb663c4b3a8cf977c710ed0f6a73306f66014e7e7c61bb78965aeb6521f51430ab4830ccf14b12edf7ae8a6a62af5c6b744

Download Submit
C:\Windows\system\OgOGgSF.exe

Filesize
1.9MB

MD5
c52d2795c45670b483e00846daf024f8

SHA1
158a91725bcb5cdb2fc0b3e9069c785c57e63611

SHA256
20ce9e75bc872c74dea9b9d21edf8d03ec9f615db1b0382adcfaa6b700cdb784

SHA512
b37ff5e420b2233b9a85810b7cc5fde609db453c71d3ecda6eba97e604ee6db86d481663b55b88fc750bc5eb18b773657865edaa29ab88d0fa2a1c053ee129fd

Download Submit
C:\Windows\system\OhsAfNW.exe

Filesize
1.9MB

MD5
869fc80cd4e9385a4ce0a23735a19f4c

SHA1
3522558b0c3c129070baae766268c718e55d0b1d

SHA256
8c8c737707dbe6efe1786e89b41d83ad4ec8d2347d5aa6d99e56fb190fe3e9b1

SHA512
98f35e3add01c593a8d7a0cfad5e68c39cd5e00cdb9c75f792c188421f5f2ff17b8ceae23b147da097c102f0f724a8d099bd544c38487ddbb2cfe5ea1dfc1dbd

Download Submit
C:\Windows\system\QhgdlSQ.exe

Filesize
1.9MB

MD5
ee426529295aaa2a596b59a7946c87a9

SHA1
467b49985db4d5e526089d830809085c9124051f

SHA256
7cde93838acd517c8ee52502ab0453340ee9d9ddab1dc7fde1e1a2cc0624b2d2

SHA512
0f78dc386ca260486c77d2e8763c73e10af11ca0f6d56bccca011b1de5665eee79ee5cf36a59f058b165c62813b45d3799755a8b979d91caabc6141302293588

Download Submit
C:\Windows\system\QsstspI.exe

Filesize
1.9MB

MD5
adae02088f45fd81b0e9f896dc533a87

SHA1
c5fa7d9243e86f80d5a47af10a893728eab0720d

SHA256
c762f987164743a817580895947633c9df9a354b14da57cf503bbf313af01dc7

SHA512
8155535fab1ede2d7173502dfd746b2c7bb6d871f2310aad5a5e31b0e193155d754c0d14e720dbdb21531094017fb01b737e84620a5062c52bb998047182f2f8

Download Submit
C:\Windows\system\SJxRrja.exe

Filesize
1.9MB

MD5
758ea077bcb0dde52b79bcd2bbac1f56

SHA1
d943d58c0f3790f175abd0f46a5879f4fa68800d

SHA256
f9d903d436569821d580939cd138c6b6149578b56463eaf277ee4b3dd4bb7268

SHA512
5996b215d355f562ae3c14060bab4fb1f55ef7036f8739b7a8a1ea818b53ca8eb2894481d2097c2c710255e08137439b29b69db1b8be156f9e593b8f2cf2b71f

Download Submit
C:\Windows\system\VitWgxc.exe

Filesize
1.9MB

MD5
d7f971a2b4e5daa05dc5ac04ca5a8d77

SHA1
c9970cbbc910b1b5bf026dd848a6430619147715

SHA256
7d2851e670ced2c18ca9d3fbee7e29574b7bbfee1d3e940d549cb840583da45a

SHA512
a52ffff74aa4bc0c515a0d7ad37bac5913a7500a569db66ebcbcf5c977cd4919c9ba2ddde929724cf413b8405348b2aa97f2fccf423f3695ae99f316be1bafee

Download Submit
C:\Windows\system\YhIWzFA.exe

Filesize
1.9MB

MD5
e409bbe6355578bbd47014f25f732e7b

SHA1
e97afa2699ed07529df3313226b42ae4497059ba

SHA256
ba2c5783abc75d9fafa672de11a66b66230a4cbc3fbb66d8c827d6fd40b0c503

SHA512
b0f3548028065402b69f04ac220ee88b8b8689354c4a0f2dceca742d8fcfcb2a405f5f27977858dad1a213e0cfe98d1cf52e95fae2c4d8c70b74cdb3ead994fe

Download Submit
C:\Windows\system\ZWjUFlZ.exe

Filesize
1.9MB

MD5
fd3b5bd8f1af4a35d5d5b3c2bb874a7c

SHA1
c735449e4f8a60b7e76b6b248cf6f0adcdc0983f

SHA256
320e3c496b21d6d9d57d4b5f1422f50d9c2f1b36cbe42d3d36f958a8aa92cb01

SHA512
56f213ed587cb46b071f2b16eff719337d7b8a308e2fff96a0f76a1f05724f00daaa93adf881401eca33d91e2793483f6f62d48a0a47e16198f023eaa3106c28

Download Submit
C:\Windows\system\ZpUQqWS.exe

Filesize
1.9MB

MD5
2f295085901c4e16a19221ace53d3aa7

SHA1
dadddcfa283bb8076317b645aa567b26671b8f7a

SHA256
e32476497c53bb454d75bbd4ef9c87ad3c14d5cda83d7964ee694a9636664c93

SHA512
a24c1143e50e32d77f2f34b99077f7c8d8480524d92e3de997e782701e9d644edaefd205b233a2dcfc75ca2f05e4170b6f22a64ccc11b49aa721f7feff4b5a5e

Download Submit
C:\Windows\system\amdnIdL.exe

Filesize
1.9MB

MD5
52013bcef41604930f75a772336bde6f

SHA1
3942f4a1ee321c1f5ac18809bf142cae1219c4dc

SHA256
2e59b08295afdf712ae305746615823e2c130447d3fab816a007d03aa2a7a1cb

SHA512
b9aa9404d61634ee524f2c4674a880d1a07b442a6731713407bd4c370d88017ad59a0366ee069a455250bfb8849c6db6f64e81c72aba4a13933701c8d55a7fef

Download Submit
C:\Windows\system\bEWSaWN.exe

Filesize
1.9MB

MD5
c67418c7d7fbb8e96c2fdc57fe0c89d0

SHA1
3c3c9eb376596a46f68df7f9eb4e8b020f650980

SHA256
29d9ad13d859c045ceb92186c5f28e1b09caf3a49a084258edbf877808306b5e

SHA512
37a225980f126f0d67bec03b134e311162bff2b5c9d773b887bc0b345c1a97d9a761a378bc14b8fba44f3c85d468ddbd91b28b403249b1a156cde198786eae3a

Download Submit
C:\Windows\system\bjgQaWq.exe

Filesize
1.9MB

MD5
ce8a4e77f50dc37894d16a21c232183d

SHA1
896ffca0282a06508bf04abd73145f9a8287f3d8

SHA256
e520a234199a2fcb346db8a2507b84b2eab5d682965072441237f6e7a7ae68de

SHA512
f49e486e33d8f89d7b6f964a9aabffd11dea002278da53e922699c2f92c2eb14df0206df70af829950bf0b9c407886647094b2673b8618b2cd9669e92a51cbbe

Download Submit
C:\Windows\system\dJjOLkj.exe

Filesize
1.9MB

MD5
5aebb99433b1df52cf0cc62c2cfce1bf

SHA1
f46e21f3392ed49ca5990f092dc7177c56527adb

SHA256
325b7ced8d1849769f01951f1f24d00ad4e6ab03a1b149fc328368a59110a748

SHA512
d24ec315c63573fd8f2c34a52f8b7ef05cd98929433c8aceb9ad0a89b304d7343bd105effb2db67de7e738db893a1b78f179f68d198461d9eb7657636f3a637a

Download Submit
C:\Windows\system\hseYFEo.exe

Filesize
1.9MB

MD5
de1db0dfc3cf4a08a6d17a5fc5a8a55f

SHA1
ece44eaee9956a458908239c54e93960c76326ea

SHA256
fa2473a505ec2fb99707f1b323aa67882a01fa2c37e56041c47cde010d125245

SHA512
b6bf134f6ee5a3db47aefd7e192b393659de26f70b99a6fcace3b2a3dc848ca50a5179c72321738c0f2d5fde3f0e938059cdc5969cab1cd0e434a72ebc8ad775

Download Submit
C:\Windows\system\iSVDJFG.exe

Filesize
1.9MB

MD5
6e710634cf800883a9a71b3a99d5ad3d

SHA1
49445d933758eb95093ba2046b32d1d3c8571a85

SHA256
9cc71f6486adebd63f43a929f57b595e01a57b8d57ec1fc533b9c927ea23efb2

SHA512
0945964eb32d23b98b9264619c1209e46044303a2b5b4a8c7fc1f8ee3dbf34664968cc1616f914125d600a76b535affe49f6d3d40ffc1953656f85515b8043a9

Download Submit
C:\Windows\system\jqygMRa.exe

Filesize
1.9MB

MD5
ce17f8b1ada37849fd753e33fff570c7

SHA1
de09673b5df1cc1df9c8c5e8de7e6af0c21c1355

SHA256
05d54f68971b09728eb372e1c29d59536070054822f6df3313524005db244aa1

SHA512
702f2524724250862df3529717cdfdb1c7fa3c711bcdd75ed35027a7455f20df107234041e83e0cbd703209a42bb387e54bba0c92d383273c45efd32218bf977

Download Submit
C:\Windows\system\kUkZzHs.exe

Filesize
1.9MB

MD5
1c487978c83ee49aeecbd2e6b1cfc6b1

SHA1
d343a1e7db29eb8281d380e4028a415db5904f65

SHA256
d6f38ff4eb2448041300444f05e23c17df953d1abf71658bee1b9873f068f3cc

SHA512
f6a09caa755501fe0ea658bb8e8420eee1ff3812aa8dc38f251dc1f22740a9750cf9b83676dd7a5b1059c9e38ccd01327b43ec6fc10dbea73eb84d7d63601313

Download Submit
C:\Windows\system\nzkyZPP.exe

Filesize
1.9MB

MD5
bca19b888538b46e33eceecc750f49bf

SHA1
163ab59a02c73079b91537b1e4465461b07f733e

SHA256
965ed687ef7c14ec41969b70ff5ae67a206f288c15298c3415e1f02eed8ddba2

SHA512
e4a9f8b356f41dfe45591e6f7a6a3a81155f32cc8f1d1efccd15a907d9db4e69b80b1c4cfb3b3c6ad8f8ac392e429ed30c239e18a36e262005a9bc5cfc23b03c

Download Submit
C:\Windows\system\poPZBNM.exe

Filesize
1.9MB

MD5
6522e325fa28433254e96cd516b19a10

SHA1
ad02e344d07715cf3955098bbe1eb04f6d68977e

SHA256
4a28591c7940a806903f32cca1137d7a3bc5ba70ef4766e2a29a80f9c2711b47

SHA512
5e40d7667d493aa0289e84992fd497099ac8ef91bf9e48c0883bf4d7c665d106c7d2790ea08f366f278b01aa8310bb4b09744cc25159d2805bf37b1b3c5e2953

Download Submit
C:\Windows\system\vTFdfAK.exe

Filesize
1.9MB

MD5
f3db47a27ab19587fec4b3d9d81f4827

SHA1
8be4ee611f9022acfa8fe4449679e8a28df565d1

SHA256
de67480780bf4c5390ed4e761fb8af5b2d8db4229074f4b056a7a7bf9d7c9444

SHA512
dfd0e8c14a79a3e8859f80fffdb2c860445107aa950500364d77be9f47d7f0ae6d40ba395f3e238c3a64d6379f6b7f2d114127794de1bcd9d1819bdb53a06454

Download Submit
C:\Windows\system\veFQLiu.exe

Filesize
1.9MB

MD5
154c1f6261a76a1c795f88a2940f0f2b

SHA1
41470d96cb13b85e3ccb0051eb005a499172a564

SHA256
113d17e7d864ce29d3fbd4970db170624a1689ae29cce22ed8005715cd8c1f34

SHA512
b57831ea9b5c0056f188aebc3f6d80f3634cf1cb03550563b4091e73b63b0561b60e7bdb6a1ee720c053b2b61343caaac19fb0afcd9d95f211b4198dea0c9271

Download Submit
C:\Windows\system\zPlBLJS.exe

Filesize
1.9MB

MD5
ce3d9d0c0c798fbeba66cf9b15980766

SHA1
c7feedb93c922b5ab3dd61ef513f227fd34b55c3

SHA256
d56ec7767a346d3ae877baa4003a55aa450177bd0e044d34335ece2cc6019dc2

SHA512
1257fc9e090e21fc49c967955f74164c46cf70aa3df182418c883e2440810ba6abd28593c7382c03e0e857db76f042167dc51ea966e35efd0d69d96c8647c5fe

Download Submit
\Windows\system\TwHrOIC.exe

Filesize
1.9MB

MD5
4beebfd88814b3802a17c61d45ae458e

SHA1
507bc5b73346ae34ac7438c05020a21deeec606e

SHA256
4d784c659e7d13059f28c46466d315856815e18089a240b1ec159af7134f9776

SHA512
a3de643bf91aa134773c5b3c0ba30a18b80dbe93431572c3e3d576e9796bc240e7cc3c6a0ee8d62574f98aca641b21d6afcc31714c1e4531c0fc0151a390718e

Download Submit
\Windows\system\XKCrEPm.exe

Filesize
1.9MB

MD5
5647345ceeb5a751024e0a737445c719

SHA1
4eaba794b3ffe950bbf01c3f7c3e63748e83edb5

SHA256
204b3ee39183adece652df074deccf81ecfed49e20cf1d5b9c315b46f5045dc4

SHA512
55d8ba5bf2e68b22b3ba81ac78c2bacf5ea1c2356782183941e29b2aa388783068b9f159b54c93563fcbc2c5c285235c7752d564d5a56eaffaaded5067d264b9

Download Submit
memory/284-4062-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/284-1011-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/540-2487-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2283-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/540-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/540-2593-0x000000013FA30000-0x000000013FD84000-memory.dmp

Filesize
3.3MB

Download
memory/540-2599-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/540-2600-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/540-991-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2586-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/540-1003-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2491-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/540-1010-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/540-1013-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/540-1015-0x000000013FA30000-0x000000013FD84000-memory.dmp

Filesize
3.3MB

Download
memory/540-1016-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/540-1018-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/540-2492-0x000000013F5E0000-0x000000013F934000-memory.dmp

Filesize
3.3MB

Download
memory/540-1012-0x000000013F5E0000-0x000000013F934000-memory.dmp

Filesize
3.3MB

Download
memory/540-2484-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/540-34-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/540-993-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-40-0x000000013F470000-0x000000013F7C4000-memory.dmp

Filesize
3.3MB

Download
memory/540-947-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2489-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2485-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2479-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-15-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-2386-0x0000000001E90000-0x00000000021E4000-memory.dmp

Filesize
3.3MB

Download
memory/896-4055-0x000000013F470000-0x000000013F7C4000-memory.dmp

Filesize
3.3MB

Download
memory/896-923-0x000000013F470000-0x000000013F7C4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-4052-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-29-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/1944-4056-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1944-934-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2020-20-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2020-4053-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2308-921-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2308-4065-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2308-2402-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2316-1014-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2316-4054-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2508-1009-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4063-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2672-954-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2672-4058-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-994-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2680-4060-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2760-937-0x000000013FA30000-0x000000013FD84000-memory.dmp

Filesize
3.3MB

Download
memory/2760-4057-0x000000013FA30000-0x000000013FD84000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4064-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2780-987-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2812-926-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2812-4059-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2988-4061-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2988-992-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download