xmrig | 1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
Size

1.6MB
MD5

a6d400bdc74bf08197c8a97efc097730
SHA1

1da7ba3f91c30e6588f75ed1b70cbb148c779114
SHA256

1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622
SHA512

8de98737d8c1c0011fd24c996b806b449d99ee86547d1e094d721f8fea316aa732203725b01e50bd0b4cd8f68c3536d50de2f7f2bcc6e135719daac277447702
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxTzkx7kvxIWx3JX/:GemTLkNdfE0pZyd

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000012116-2.dat	xmrig
behavioral1/files/0x0007000000018728-13.dat	xmrig
behavioral1/files/0x000600000001873d-21.dat	xmrig
behavioral1/files/0x000600000001878f-29.dat	xmrig
behavioral1/files/0x0005000000019609-45.dat	xmrig
behavioral1/files/0x000500000001960d-53.dat	xmrig
behavioral1/files/0x0005000000019611-61.dat	xmrig
behavioral1/files/0x0005000000019615-69.dat	xmrig
behavioral1/files/0x0005000000019623-100.dat	xmrig
behavioral1/files/0x0005000000019838-128.dat	xmrig
behavioral1/files/0x00050000000197f8-124.dat	xmrig
behavioral1/files/0x000500000001977d-120.dat	xmrig
behavioral1/files/0x00050000000196b1-116.dat	xmrig
behavioral1/files/0x00050000000196af-112.dat	xmrig
behavioral1/files/0x0005000000019625-102.dat	xmrig
behavioral1/files/0x0005000000019667-107.dat	xmrig
behavioral1/files/0x0005000000019622-97.dat	xmrig
behavioral1/files/0x0005000000019621-93.dat	xmrig
behavioral1/files/0x000500000001961f-88.dat	xmrig
behavioral1/files/0x000500000001961d-85.dat	xmrig
behavioral1/files/0x000500000001961b-80.dat	xmrig
behavioral1/files/0x0005000000019619-77.dat	xmrig
behavioral1/files/0x0005000000019617-72.dat	xmrig
behavioral1/files/0x0005000000019613-64.dat	xmrig
behavioral1/files/0x000500000001960f-56.dat	xmrig
behavioral1/files/0x000500000001960b-48.dat	xmrig
behavioral1/files/0x00050000000195c5-40.dat	xmrig
behavioral1/files/0x000800000001925e-36.dat	xmrig
behavioral1/files/0x00060000000187a5-33.dat	xmrig
behavioral1/files/0x0006000000018784-24.dat	xmrig
behavioral1/files/0x00070000000186fd-16.dat	xmrig
behavioral1/files/0x00070000000186ee-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2300	zDFJtfe.exe
2316	GFHHekR.exe
2552	RlWCvnz.exe
1884	kqONFNa.exe
1700	lsphIiO.exe
2100	EFdhsXb.exe
2392	HriZaBE.exe
2728	BAARJDV.exe
2780	wbGJPiq.exe
2920	HcTScbT.exe
2776	OnUPWaa.exe
2968	QPXaAxr.exe
2804	oPKMbPt.exe
1348	aVtraWp.exe
2644	VWWoWxN.exe
2796	DpuFtnJ.exe
2420	jCKHslh.exe
2652	pztRUCq.exe
2052	uXOLlKk.exe
2932	aTDuSGA.exe
2332	uwzFcDf.exe
1092	WQAnvPz.exe
2028	WiCDuET.exe
1684	GcLnpzX.exe
3008	hXxKITT.exe
2212	VCzqrgO.exe
1664	naPKLvL.exe
2516	spegvwJ.exe
2016	EDLJuRi.exe
1148	ViEjgWq.exe
1880	UcDFkhp.exe
2268	XKFYcGx.exe
2716	RvNdpFs.exe
1152	BizbgSc.exe
1888	FJQEjHE.exe
2360	fqNeNcd.exe
2096	GbnWbQj.exe
340	YFfNkbu.exe
1532	dUdjkpo.exe
1460	DFYZiUT.exe
708	NzDEmAq.exe
3068	EnQnqVJ.exe
2272	NFRqLkS.exe
1516	uUBDWPa.exe
956	fppjdTj.exe
2424	pzKHcJt.exe
1816	oGALgcl.exe
1696	OtXzPLV.exe
296	XFRWhko.exe
2288	FFlFqLH.exe
1876	RggWKvk.exe
1612	Mjawrct.exe
1536	EiHELSF.exe
1680	xMlGYxu.exe
1644	PpliVAp.exe
1900	aereLoF.exe
3060	CnHZrHh.exe
2084	oSvUPVl.exe
1904	lmrpbWW.exe
2076	ruFdssq.exe
1360	gKLoNVJ.exe
2064	jJNJXgP.exe
2456	xnjXjRt.exe
2056	imVjjjq.exe

Loads dropped DLL 64 IoCs

pid	Process
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FSzQMRB.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\olsFshp.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\PncCQqk.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\NiRdeTW.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\QfVPmPs.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\PcuRJBW.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\hvbasnf.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\CsQASeG.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\MWGzIQh.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\izpNbES.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\IcOlioU.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\LDPRLMt.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\jKbUIMF.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\ouGXCfL.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\sSJuemX.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\zfDDgAo.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\UMwbjTQ.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\GREqqkv.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\YQDhUOH.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\ExAsTOz.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\mcOGoCG.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\hokuPlg.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\QPXaAxr.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\DAbgsva.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\xTTScBx.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\MQeWuCV.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\wVphmGY.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\KQJPvwp.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\LNuxdQM.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\EAGHPxF.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\YSXMUSn.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\RSZGESf.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\KoRZVrn.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\AAyuMWn.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\HquJVJN.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\jqohMKb.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\LbNmWAA.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\hRqopQD.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\lAGCths.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\CAwaiZy.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\ozFiDkF.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\SiPOMVk.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\bXQmHOD.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\HcTScbT.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\DXheDYS.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\FvVXGEg.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\heyQRRW.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\YUgAHVt.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\LRFVpRm.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\TjgkkiA.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\Mkzhihk.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\cwPUIDS.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\BpcLMau.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\VFMHFuD.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\BLTcuel.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\ZYeWkXd.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\HxhHueN.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\RXHqbwU.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\bMekEEt.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\VUOvuAF.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\oqgbaEN.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\nhyyDKC.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\oNdECNS.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
File created	C:\Windows\System\GYzDcwt.exe	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2300	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	31
PID 2444 wrote to memory of 2300	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	31
PID 2444 wrote to memory of 2300	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	31
PID 2444 wrote to memory of 2316	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	32
PID 2444 wrote to memory of 2316	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	32
PID 2444 wrote to memory of 2316	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	32
PID 2444 wrote to memory of 2552	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	33
PID 2444 wrote to memory of 2552	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	33
PID 2444 wrote to memory of 2552	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	33
PID 2444 wrote to memory of 1884	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	34
PID 2444 wrote to memory of 1884	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	34
PID 2444 wrote to memory of 1884	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	34
PID 2444 wrote to memory of 1700	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	35
PID 2444 wrote to memory of 1700	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	35
PID 2444 wrote to memory of 1700	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	35
PID 2444 wrote to memory of 2100	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	36
PID 2444 wrote to memory of 2100	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	36
PID 2444 wrote to memory of 2100	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	36
PID 2444 wrote to memory of 2392	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	37
PID 2444 wrote to memory of 2392	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	37
PID 2444 wrote to memory of 2392	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	37
PID 2444 wrote to memory of 2728	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	38
PID 2444 wrote to memory of 2728	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	38
PID 2444 wrote to memory of 2728	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	38
PID 2444 wrote to memory of 2780	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	39
PID 2444 wrote to memory of 2780	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	39
PID 2444 wrote to memory of 2780	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	39
PID 2444 wrote to memory of 2920	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	40
PID 2444 wrote to memory of 2920	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	40
PID 2444 wrote to memory of 2920	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	40
PID 2444 wrote to memory of 2776	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	41
PID 2444 wrote to memory of 2776	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	41
PID 2444 wrote to memory of 2776	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	41
PID 2444 wrote to memory of 2968	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	42
PID 2444 wrote to memory of 2968	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	42
PID 2444 wrote to memory of 2968	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	42
PID 2444 wrote to memory of 2804	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	43
PID 2444 wrote to memory of 2804	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	43
PID 2444 wrote to memory of 2804	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	43
PID 2444 wrote to memory of 1348	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	44
PID 2444 wrote to memory of 1348	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	44
PID 2444 wrote to memory of 1348	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	44
PID 2444 wrote to memory of 2644	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	45
PID 2444 wrote to memory of 2644	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	45
PID 2444 wrote to memory of 2644	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	45
PID 2444 wrote to memory of 2796	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	46
PID 2444 wrote to memory of 2796	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	46
PID 2444 wrote to memory of 2796	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	46
PID 2444 wrote to memory of 2420	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	47
PID 2444 wrote to memory of 2420	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	47
PID 2444 wrote to memory of 2420	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	47
PID 2444 wrote to memory of 2652	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	48
PID 2444 wrote to memory of 2652	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	48
PID 2444 wrote to memory of 2652	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	48
PID 2444 wrote to memory of 2052	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	49
PID 2444 wrote to memory of 2052	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	49
PID 2444 wrote to memory of 2052	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	49
PID 2444 wrote to memory of 2932	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	50
PID 2444 wrote to memory of 2932	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	50
PID 2444 wrote to memory of 2932	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	50
PID 2444 wrote to memory of 2332	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	51
PID 2444 wrote to memory of 2332	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	51
PID 2444 wrote to memory of 2332	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	51
PID 2444 wrote to memory of 1092	2444	1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe	52

C:\Users\Admin\AppData\Local\Temp\1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe
"C:\Users\Admin\AppData\Local\Temp\1396c31614079e6df9fffe3ebac1aad9b37e823c4a65fb2bd5f91111dbc8c622.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System\zDFJtfe.exe
  C:\Windows\System\zDFJtfe.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\GFHHekR.exe
  C:\Windows\System\GFHHekR.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\RlWCvnz.exe
  C:\Windows\System\RlWCvnz.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\kqONFNa.exe
  C:\Windows\System\kqONFNa.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\lsphIiO.exe
  C:\Windows\System\lsphIiO.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\EFdhsXb.exe
  C:\Windows\System\EFdhsXb.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\HriZaBE.exe
  C:\Windows\System\HriZaBE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\BAARJDV.exe
  C:\Windows\System\BAARJDV.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\wbGJPiq.exe
  C:\Windows\System\wbGJPiq.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\HcTScbT.exe
  C:\Windows\System\HcTScbT.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\OnUPWaa.exe
  C:\Windows\System\OnUPWaa.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\QPXaAxr.exe
  C:\Windows\System\QPXaAxr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\oPKMbPt.exe
  C:\Windows\System\oPKMbPt.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\aVtraWp.exe
  C:\Windows\System\aVtraWp.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\VWWoWxN.exe
  C:\Windows\System\VWWoWxN.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DpuFtnJ.exe
  C:\Windows\System\DpuFtnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\jCKHslh.exe
  C:\Windows\System\jCKHslh.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\pztRUCq.exe
  C:\Windows\System\pztRUCq.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\uXOLlKk.exe
  C:\Windows\System\uXOLlKk.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\aTDuSGA.exe
  C:\Windows\System\aTDuSGA.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\uwzFcDf.exe
  C:\Windows\System\uwzFcDf.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\WQAnvPz.exe
  C:\Windows\System\WQAnvPz.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\WiCDuET.exe
  C:\Windows\System\WiCDuET.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\GcLnpzX.exe
  C:\Windows\System\GcLnpzX.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\hXxKITT.exe
  C:\Windows\System\hXxKITT.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\naPKLvL.exe
  C:\Windows\System\naPKLvL.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\VCzqrgO.exe
  C:\Windows\System\VCzqrgO.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\spegvwJ.exe
  C:\Windows\System\spegvwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\EDLJuRi.exe
  C:\Windows\System\EDLJuRi.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ViEjgWq.exe
  C:\Windows\System\ViEjgWq.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\UcDFkhp.exe
  C:\Windows\System\UcDFkhp.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\XKFYcGx.exe
  C:\Windows\System\XKFYcGx.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\RvNdpFs.exe
  C:\Windows\System\RvNdpFs.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\BizbgSc.exe
  C:\Windows\System\BizbgSc.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\FJQEjHE.exe
  C:\Windows\System\FJQEjHE.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\fqNeNcd.exe
  C:\Windows\System\fqNeNcd.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GbnWbQj.exe
  C:\Windows\System\GbnWbQj.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\YFfNkbu.exe
  C:\Windows\System\YFfNkbu.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\dUdjkpo.exe
  C:\Windows\System\dUdjkpo.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\DFYZiUT.exe
  C:\Windows\System\DFYZiUT.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\NzDEmAq.exe
  C:\Windows\System\NzDEmAq.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\EnQnqVJ.exe
  C:\Windows\System\EnQnqVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NFRqLkS.exe
  C:\Windows\System\NFRqLkS.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\uUBDWPa.exe
  C:\Windows\System\uUBDWPa.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\fppjdTj.exe
  C:\Windows\System\fppjdTj.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\pzKHcJt.exe
  C:\Windows\System\pzKHcJt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\oGALgcl.exe
  C:\Windows\System\oGALgcl.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\OtXzPLV.exe
  C:\Windows\System\OtXzPLV.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\XFRWhko.exe
  C:\Windows\System\XFRWhko.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\FFlFqLH.exe
  C:\Windows\System\FFlFqLH.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RggWKvk.exe
  C:\Windows\System\RggWKvk.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\Mjawrct.exe
  C:\Windows\System\Mjawrct.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\EiHELSF.exe
  C:\Windows\System\EiHELSF.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\xMlGYxu.exe
  C:\Windows\System\xMlGYxu.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\PpliVAp.exe
  C:\Windows\System\PpliVAp.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\aereLoF.exe
  C:\Windows\System\aereLoF.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\CnHZrHh.exe
  C:\Windows\System\CnHZrHh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\oSvUPVl.exe
  C:\Windows\System\oSvUPVl.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\lmrpbWW.exe
  C:\Windows\System\lmrpbWW.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ruFdssq.exe
  C:\Windows\System\ruFdssq.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\gKLoNVJ.exe
  C:\Windows\System\gKLoNVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\jJNJXgP.exe
  C:\Windows\System\jJNJXgP.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\xnjXjRt.exe
  C:\Windows\System\xnjXjRt.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\imVjjjq.exe
  C:\Windows\System\imVjjjq.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vnIdNSk.exe
  C:\Windows\System\vnIdNSk.exe
  2⤵
  PID:992
- C:\Windows\System\DLYgffX.exe
  C:\Windows\System\DLYgffX.exe
  2⤵
  PID:804
- C:\Windows\System\dIXKpLh.exe
  C:\Windows\System\dIXKpLh.exe
  2⤵
  PID:988
- C:\Windows\System\LUXArje.exe
  C:\Windows\System\LUXArje.exe
  2⤵
  PID:1932
- C:\Windows\System\qhosDxD.exe
  C:\Windows\System\qhosDxD.exe
  2⤵
  PID:2252
- C:\Windows\System\RRbhmDm.exe
  C:\Windows\System\RRbhmDm.exe
  2⤵
  PID:1576
- C:\Windows\System\bMekEEt.exe
  C:\Windows\System\bMekEEt.exe
  2⤵
  PID:1760
- C:\Windows\System\nrfLKAN.exe
  C:\Windows\System\nrfLKAN.exe
  2⤵
  PID:2208
- C:\Windows\System\wUPphrL.exe
  C:\Windows\System\wUPphrL.exe
  2⤵
  PID:2560
- C:\Windows\System\aFnPCHY.exe
  C:\Windows\System\aFnPCHY.exe
  2⤵
  PID:1628
- C:\Windows\System\nOrRVQo.exe
  C:\Windows\System\nOrRVQo.exe
  2⤵
  PID:2712
- C:\Windows\System\InNnKYN.exe
  C:\Windows\System\InNnKYN.exe
  2⤵
  PID:2764
- C:\Windows\System\kjeHhnk.exe
  C:\Windows\System\kjeHhnk.exe
  2⤵
  PID:2956
- C:\Windows\System\xBDJtQL.exe
  C:\Windows\System\xBDJtQL.exe
  2⤵
  PID:1048
- C:\Windows\System\ZXiQTVo.exe
  C:\Windows\System\ZXiQTVo.exe
  2⤵
  PID:2800
- C:\Windows\System\xHdKgRy.exe
  C:\Windows\System\xHdKgRy.exe
  2⤵
  PID:2732
- C:\Windows\System\ZGJYkgJ.exe
  C:\Windows\System\ZGJYkgJ.exe
  2⤵
  PID:2696
- C:\Windows\System\KJBYbqM.exe
  C:\Windows\System\KJBYbqM.exe
  2⤵
  PID:680
- C:\Windows\System\EAGHPxF.exe
  C:\Windows\System\EAGHPxF.exe
  2⤵
  PID:2304
- C:\Windows\System\MYKwFzo.exe
  C:\Windows\System\MYKwFzo.exe
  2⤵
  PID:692
- C:\Windows\System\WBiRYOn.exe
  C:\Windows\System\WBiRYOn.exe
  2⤵
  PID:2036
- C:\Windows\System\FVmMJMF.exe
  C:\Windows\System\FVmMJMF.exe
  2⤵
  PID:1500
- C:\Windows\System\hYrPQIE.exe
  C:\Windows\System\hYrPQIE.exe
  2⤵
  PID:884
- C:\Windows\System\gUkrJNz.exe
  C:\Windows\System\gUkrJNz.exe
  2⤵
  PID:2188
- C:\Windows\System\CJLEzuD.exe
  C:\Windows\System\CJLEzuD.exe
  2⤵
  PID:2380
- C:\Windows\System\jseywKC.exe
  C:\Windows\System\jseywKC.exe
  2⤵
  PID:2152
- C:\Windows\System\rDBzBdm.exe
  C:\Windows\System\rDBzBdm.exe
  2⤵
  PID:2104
- C:\Windows\System\zXYryBG.exe
  C:\Windows\System\zXYryBG.exe
  2⤵
  PID:448
- C:\Windows\System\ojFiTqd.exe
  C:\Windows\System\ojFiTqd.exe
  2⤵
  PID:2596
- C:\Windows\System\fnjHMtz.exe
  C:\Windows\System\fnjHMtz.exe
  2⤵
  PID:292
- C:\Windows\System\SRWKxtq.exe
  C:\Windows\System\SRWKxtq.exe
  2⤵
  PID:1604
- C:\Windows\System\LEJqiMC.exe
  C:\Windows\System\LEJqiMC.exe
  2⤵
  PID:2436
- C:\Windows\System\eaeaHKA.exe
  C:\Windows\System\eaeaHKA.exe
  2⤵
  PID:1556
- C:\Windows\System\cjrKTZd.exe
  C:\Windows\System\cjrKTZd.exe
  2⤵
  PID:1660
- C:\Windows\System\zaWuEnq.exe
  C:\Windows\System\zaWuEnq.exe
  2⤵
  PID:912
- C:\Windows\System\SKXSfKo.exe
  C:\Windows\System\SKXSfKo.exe
  2⤵
  PID:2756
- C:\Windows\System\KNdZyVl.exe
  C:\Windows\System\KNdZyVl.exe
  2⤵
  PID:2276
- C:\Windows\System\ToiFLPA.exe
  C:\Windows\System\ToiFLPA.exe
  2⤵
  PID:2964
- C:\Windows\System\wyUoJdC.exe
  C:\Windows\System\wyUoJdC.exe
  2⤵
  PID:1172
- C:\Windows\System\XzIMmSB.exe
  C:\Windows\System\XzIMmSB.exe
  2⤵
  PID:2060
- C:\Windows\System\zJjGAvS.exe
  C:\Windows\System\zJjGAvS.exe
  2⤵
  PID:564
- C:\Windows\System\rhAcwXA.exe
  C:\Windows\System\rhAcwXA.exe
  2⤵
  PID:1692
- C:\Windows\System\eKEEzcx.exe
  C:\Windows\System\eKEEzcx.exe
  2⤵
  PID:2412
- C:\Windows\System\hxyWgwg.exe
  C:\Windows\System\hxyWgwg.exe
  2⤵
  PID:1584
- C:\Windows\System\RoncNMd.exe
  C:\Windows\System\RoncNMd.exe
  2⤵
  PID:2164
- C:\Windows\System\qcsEqwG.exe
  C:\Windows\System\qcsEqwG.exe
  2⤵
  PID:2724
- C:\Windows\System\hRIEWPl.exe
  C:\Windows\System\hRIEWPl.exe
  2⤵
  PID:2916
- C:\Windows\System\vkpEAov.exe
  C:\Windows\System\vkpEAov.exe
  2⤵
  PID:2888
- C:\Windows\System\GgakzaG.exe
  C:\Windows\System\GgakzaG.exe
  2⤵
  PID:1420
- C:\Windows\System\zDzhwHY.exe
  C:\Windows\System\zDzhwHY.exe
  2⤵
  PID:980
- C:\Windows\System\oNHYbRA.exe
  C:\Windows\System\oNHYbRA.exe
  2⤵
  PID:1108
- C:\Windows\System\CGCkwwf.exe
  C:\Windows\System\CGCkwwf.exe
  2⤵
  PID:3016
- C:\Windows\System\DAbgsva.exe
  C:\Windows\System\DAbgsva.exe
  2⤵
  PID:2200
- C:\Windows\System\gHHQzJK.exe
  C:\Windows\System\gHHQzJK.exe
  2⤵
  PID:2340
- C:\Windows\System\owUezFd.exe
  C:\Windows\System\owUezFd.exe
  2⤵
  PID:2140
- C:\Windows\System\BhmEpOZ.exe
  C:\Windows\System\BhmEpOZ.exe
  2⤵
  PID:2012
- C:\Windows\System\aiUaxPl.exe
  C:\Windows\System\aiUaxPl.exe
  2⤵
  PID:1920
- C:\Windows\System\XqmLFqZ.exe
  C:\Windows\System\XqmLFqZ.exe
  2⤵
  PID:836
- C:\Windows\System\OgVCGZq.exe
  C:\Windows\System\OgVCGZq.exe
  2⤵
  PID:1144
- C:\Windows\System\MUrCveQ.exe
  C:\Windows\System\MUrCveQ.exe
  2⤵
  PID:3080
- C:\Windows\System\SmiDkLz.exe
  C:\Windows\System\SmiDkLz.exe
  2⤵
  PID:3096
- C:\Windows\System\CnzAuln.exe
  C:\Windows\System\CnzAuln.exe
  2⤵
  PID:3112
- C:\Windows\System\oWXRBBs.exe
  C:\Windows\System\oWXRBBs.exe
  2⤵
  PID:3128
- C:\Windows\System\isNdJkg.exe
  C:\Windows\System\isNdJkg.exe
  2⤵
  PID:3144
- C:\Windows\System\dUSHACW.exe
  C:\Windows\System\dUSHACW.exe
  2⤵
  PID:3160
- C:\Windows\System\obippnq.exe
  C:\Windows\System\obippnq.exe
  2⤵
  PID:3176
- C:\Windows\System\kZPbZfa.exe
  C:\Windows\System\kZPbZfa.exe
  2⤵
  PID:3192
- C:\Windows\System\izpNbES.exe
  C:\Windows\System\izpNbES.exe
  2⤵
  PID:3208
- C:\Windows\System\VUOvuAF.exe
  C:\Windows\System\VUOvuAF.exe
  2⤵
  PID:3224
- C:\Windows\System\siMdzyG.exe
  C:\Windows\System\siMdzyG.exe
  2⤵
  PID:3240
- C:\Windows\System\BOYcopr.exe
  C:\Windows\System\BOYcopr.exe
  2⤵
  PID:3256
- C:\Windows\System\kZZdVuD.exe
  C:\Windows\System\kZZdVuD.exe
  2⤵
  PID:3272
- C:\Windows\System\kKKeunA.exe
  C:\Windows\System\kKKeunA.exe
  2⤵
  PID:3288
- C:\Windows\System\MtkHNVs.exe
  C:\Windows\System\MtkHNVs.exe
  2⤵
  PID:3304
- C:\Windows\System\zYuHJzd.exe
  C:\Windows\System\zYuHJzd.exe
  2⤵
  PID:3320
- C:\Windows\System\KdllXCY.exe
  C:\Windows\System\KdllXCY.exe
  2⤵
  PID:3336
- C:\Windows\System\MqCmsYx.exe
  C:\Windows\System\MqCmsYx.exe
  2⤵
  PID:3352
- C:\Windows\System\RWgsWRc.exe
  C:\Windows\System\RWgsWRc.exe
  2⤵
  PID:3368
- C:\Windows\System\bgbyHTK.exe
  C:\Windows\System\bgbyHTK.exe
  2⤵
  PID:3384
- C:\Windows\System\JfIzRMp.exe
  C:\Windows\System\JfIzRMp.exe
  2⤵
  PID:3400
- C:\Windows\System\xPuvLip.exe
  C:\Windows\System\xPuvLip.exe
  2⤵
  PID:3416
- C:\Windows\System\SzIyELV.exe
  C:\Windows\System\SzIyELV.exe
  2⤵
  PID:3432
- C:\Windows\System\tQnUzIg.exe
  C:\Windows\System\tQnUzIg.exe
  2⤵
  PID:3448
- C:\Windows\System\KJyBTbN.exe
  C:\Windows\System\KJyBTbN.exe
  2⤵
  PID:3464
- C:\Windows\System\gsOhRdV.exe
  C:\Windows\System\gsOhRdV.exe
  2⤵
  PID:3480
- C:\Windows\System\tmVaifn.exe
  C:\Windows\System\tmVaifn.exe
  2⤵
  PID:3496
- C:\Windows\System\YkhCWnR.exe
  C:\Windows\System\YkhCWnR.exe
  2⤵
  PID:3512
- C:\Windows\System\FKYiyEO.exe
  C:\Windows\System\FKYiyEO.exe
  2⤵
  PID:3528
- C:\Windows\System\lAWckcD.exe
  C:\Windows\System\lAWckcD.exe
  2⤵
  PID:3544
- C:\Windows\System\RyKlqeD.exe
  C:\Windows\System\RyKlqeD.exe
  2⤵
  PID:3560
- C:\Windows\System\omrvQWg.exe
  C:\Windows\System\omrvQWg.exe
  2⤵
  PID:3576
- C:\Windows\System\iddrwUI.exe
  C:\Windows\System\iddrwUI.exe
  2⤵
  PID:3592
- C:\Windows\System\MXHHAVv.exe
  C:\Windows\System\MXHHAVv.exe
  2⤵
  PID:3608
- C:\Windows\System\ZVlEOsY.exe
  C:\Windows\System\ZVlEOsY.exe
  2⤵
  PID:3624
- C:\Windows\System\lGvtpYH.exe
  C:\Windows\System\lGvtpYH.exe
  2⤵
  PID:3640
- C:\Windows\System\OTZQgvt.exe
  C:\Windows\System\OTZQgvt.exe
  2⤵
  PID:3656
- C:\Windows\System\lZUosmQ.exe
  C:\Windows\System\lZUosmQ.exe
  2⤵
  PID:3672
- C:\Windows\System\uTGcYBT.exe
  C:\Windows\System\uTGcYBT.exe
  2⤵
  PID:3688
- C:\Windows\System\QjpQGnW.exe
  C:\Windows\System\QjpQGnW.exe
  2⤵
  PID:3704
- C:\Windows\System\ePvgBiW.exe
  C:\Windows\System\ePvgBiW.exe
  2⤵
  PID:3724
- C:\Windows\System\yOowLOp.exe
  C:\Windows\System\yOowLOp.exe
  2⤵
  PID:3740
- C:\Windows\System\eEoSKJq.exe
  C:\Windows\System\eEoSKJq.exe
  2⤵
  PID:3756
- C:\Windows\System\gQdHJns.exe
  C:\Windows\System\gQdHJns.exe
  2⤵
  PID:3772
- C:\Windows\System\OYpQfAS.exe
  C:\Windows\System\OYpQfAS.exe
  2⤵
  PID:3788
- C:\Windows\System\CLBHAMb.exe
  C:\Windows\System\CLBHAMb.exe
  2⤵
  PID:3804
- C:\Windows\System\wqFUsHo.exe
  C:\Windows\System\wqFUsHo.exe
  2⤵
  PID:3820
- C:\Windows\System\uZvJnJD.exe
  C:\Windows\System\uZvJnJD.exe
  2⤵
  PID:3836
- C:\Windows\System\RiRPovL.exe
  C:\Windows\System\RiRPovL.exe
  2⤵
  PID:3852
- C:\Windows\System\qPdBzpt.exe
  C:\Windows\System\qPdBzpt.exe
  2⤵
  PID:3868
- C:\Windows\System\pxMaDWE.exe
  C:\Windows\System\pxMaDWE.exe
  2⤵
  PID:3884
- C:\Windows\System\oYTOgAC.exe
  C:\Windows\System\oYTOgAC.exe
  2⤵
  PID:3900
- C:\Windows\System\rqIARJY.exe
  C:\Windows\System\rqIARJY.exe
  2⤵
  PID:3916
- C:\Windows\System\ackcjfQ.exe
  C:\Windows\System\ackcjfQ.exe
  2⤵
  PID:3932
- C:\Windows\System\RwBqDNv.exe
  C:\Windows\System\RwBqDNv.exe
  2⤵
  PID:3948
- C:\Windows\System\HIeeexW.exe
  C:\Windows\System\HIeeexW.exe
  2⤵
  PID:3964
- C:\Windows\System\xdHBjXd.exe
  C:\Windows\System\xdHBjXd.exe
  2⤵
  PID:3980
- C:\Windows\System\BEmUtEl.exe
  C:\Windows\System\BEmUtEl.exe
  2⤵
  PID:3996
- C:\Windows\System\xvYLpbC.exe
  C:\Windows\System\xvYLpbC.exe
  2⤵
  PID:4012
- C:\Windows\System\SUKfIRO.exe
  C:\Windows\System\SUKfIRO.exe
  2⤵
  PID:4028
- C:\Windows\System\kHENUCe.exe
  C:\Windows\System\kHENUCe.exe
  2⤵
  PID:4044
- C:\Windows\System\HFOVqih.exe
  C:\Windows\System\HFOVqih.exe
  2⤵
  PID:4060
- C:\Windows\System\lUyCjwM.exe
  C:\Windows\System\lUyCjwM.exe
  2⤵
  PID:4076
- C:\Windows\System\fBXOtYd.exe
  C:\Windows\System\fBXOtYd.exe
  2⤵
  PID:4092
- C:\Windows\System\iuuxxPe.exe
  C:\Windows\System\iuuxxPe.exe
  2⤵
  PID:2136
- C:\Windows\System\ndmmExk.exe
  C:\Windows\System\ndmmExk.exe
  2⤵
  PID:2072
- C:\Windows\System\rhkYwFs.exe
  C:\Windows\System\rhkYwFs.exe
  2⤵
  PID:2536
- C:\Windows\System\PpZBrbq.exe
  C:\Windows\System\PpZBrbq.exe
  2⤵
  PID:880
- C:\Windows\System\tFBzzZQ.exe
  C:\Windows\System\tFBzzZQ.exe
  2⤵
  PID:2192
- C:\Windows\System\IxZuuWk.exe
  C:\Windows\System\IxZuuWk.exe
  2⤵
  PID:1748
- C:\Windows\System\DPcRswc.exe
  C:\Windows\System\DPcRswc.exe
  2⤵
  PID:3036
- C:\Windows\System\SRkTlTN.exe
  C:\Windows\System\SRkTlTN.exe
  2⤵
  PID:2844
- C:\Windows\System\vTOkyQj.exe
  C:\Windows\System\vTOkyQj.exe
  2⤵
  PID:2856
- C:\Windows\System\UqdxXQu.exe
  C:\Windows\System\UqdxXQu.exe
  2⤵
  PID:2592
- C:\Windows\System\AwiQbPi.exe
  C:\Windows\System\AwiQbPi.exe
  2⤵
  PID:2496
- C:\Windows\System\bFYVkEp.exe
  C:\Windows\System\bFYVkEp.exe
  2⤵
  PID:1088
- C:\Windows\System\pJYSskH.exe
  C:\Windows\System\pJYSskH.exe
  2⤵
  PID:3076
- C:\Windows\System\hcHJmxZ.exe
  C:\Windows\System\hcHJmxZ.exe
  2⤵
  PID:3108
- C:\Windows\System\xvobBPi.exe
  C:\Windows\System\xvobBPi.exe
  2⤵
  PID:3140
- C:\Windows\System\iMhkGCT.exe
  C:\Windows\System\iMhkGCT.exe
  2⤵
  PID:3172
- C:\Windows\System\YSXMUSn.exe
  C:\Windows\System\YSXMUSn.exe
  2⤵
  PID:3204
- C:\Windows\System\vjBxoSp.exe
  C:\Windows\System\vjBxoSp.exe
  2⤵
  PID:3236
- C:\Windows\System\TIvxrgK.exe
  C:\Windows\System\TIvxrgK.exe
  2⤵
  PID:3268
- C:\Windows\System\yBXVSXZ.exe
  C:\Windows\System\yBXVSXZ.exe
  2⤵
  PID:3296
- C:\Windows\System\laHkbfH.exe
  C:\Windows\System\laHkbfH.exe
  2⤵
  PID:3316
- C:\Windows\System\tZiIJqN.exe
  C:\Windows\System\tZiIJqN.exe
  2⤵
  PID:3348
- C:\Windows\System\dKEklxX.exe
  C:\Windows\System\dKEklxX.exe
  2⤵
  PID:580
- C:\Windows\System\xysAIQq.exe
  C:\Windows\System\xysAIQq.exe
  2⤵
  PID:3408
- C:\Windows\System\OOMXARd.exe
  C:\Windows\System\OOMXARd.exe
  2⤵
  PID:3440
- C:\Windows\System\mNFNLNS.exe
  C:\Windows\System\mNFNLNS.exe
  2⤵
  PID:3460
- C:\Windows\System\jUbaSBx.exe
  C:\Windows\System\jUbaSBx.exe
  2⤵
  PID:3492
- C:\Windows\System\VsWmyce.exe
  C:\Windows\System\VsWmyce.exe
  2⤵
  PID:3524
- C:\Windows\System\NvpBkse.exe
  C:\Windows\System\NvpBkse.exe
  2⤵
  PID:3556
- C:\Windows\System\BUwhVsv.exe
  C:\Windows\System\BUwhVsv.exe
  2⤵
  PID:3588
- C:\Windows\System\zWNQBqT.exe
  C:\Windows\System\zWNQBqT.exe
  2⤵
  PID:3604
- C:\Windows\System\skJzdjL.exe
  C:\Windows\System\skJzdjL.exe
  2⤵
  PID:2904
- C:\Windows\System\HAnNheh.exe
  C:\Windows\System\HAnNheh.exe
  2⤵
  PID:3664
- C:\Windows\System\XJNcnMq.exe
  C:\Windows\System\XJNcnMq.exe
  2⤵
  PID:3696
- C:\Windows\System\FsgAElo.exe
  C:\Windows\System\FsgAElo.exe
  2⤵
  PID:3716
- C:\Windows\System\SUalMZD.exe
  C:\Windows\System\SUalMZD.exe
  2⤵
  PID:3752
- C:\Windows\System\RWFOvey.exe
  C:\Windows\System\RWFOvey.exe
  2⤵
  PID:3784
- C:\Windows\System\oJNcoZB.exe
  C:\Windows\System\oJNcoZB.exe
  2⤵
  PID:3812
- C:\Windows\System\PWqGZKM.exe
  C:\Windows\System\PWqGZKM.exe
  2⤵
  PID:3832
- C:\Windows\System\viYKmYM.exe
  C:\Windows\System\viYKmYM.exe
  2⤵
  PID:3860
- C:\Windows\System\PpxoSNc.exe
  C:\Windows\System\PpxoSNc.exe
  2⤵
  PID:3880
- C:\Windows\System\oxiSAZK.exe
  C:\Windows\System\oxiSAZK.exe
  2⤵
  PID:3912
- C:\Windows\System\rUXGnpE.exe
  C:\Windows\System\rUXGnpE.exe
  2⤵
  PID:3928
- C:\Windows\System\SXBjEUC.exe
  C:\Windows\System\SXBjEUC.exe
  2⤵
  PID:3956
- C:\Windows\System\McaPJnx.exe
  C:\Windows\System\McaPJnx.exe
  2⤵
  PID:3972
- C:\Windows\System\WqJsIIg.exe
  C:\Windows\System\WqJsIIg.exe
  2⤵
  PID:2784
- C:\Windows\System\hSCIELf.exe
  C:\Windows\System\hSCIELf.exe
  2⤵
  PID:4008
- C:\Windows\System\hnKyxLO.exe
  C:\Windows\System\hnKyxLO.exe
  2⤵
  PID:2664
- C:\Windows\System\WhCFcUO.exe
  C:\Windows\System\WhCFcUO.exe
  2⤵
  PID:4040
- C:\Windows\System\Dwjmebk.exe
  C:\Windows\System\Dwjmebk.exe
  2⤵
  PID:4072
- C:\Windows\System\ZLyRLTy.exe
  C:\Windows\System\ZLyRLTy.exe
  2⤵
  PID:2400
- C:\Windows\System\fkUGBwD.exe
  C:\Windows\System\fkUGBwD.exe
  2⤵
  PID:284
- C:\Windows\System\augdgSq.exe
  C:\Windows\System\augdgSq.exe
  2⤵
  PID:2684
- C:\Windows\System\OoYSPum.exe
  C:\Windows\System\OoYSPum.exe
  2⤵
  PID:2768
- C:\Windows\System\yzTSifg.exe
  C:\Windows\System\yzTSifg.exe
  2⤵
  PID:2020
- C:\Windows\System\wCdIRtH.exe
  C:\Windows\System\wCdIRtH.exe
  2⤵
  PID:2248
- C:\Windows\System\qpSwuxc.exe
  C:\Windows\System\qpSwuxc.exe
  2⤵
  PID:3124
- C:\Windows\System\uPCrArr.exe
  C:\Windows\System\uPCrArr.exe
  2⤵
  PID:3232
- C:\Windows\System\rPbDHEu.exe
  C:\Windows\System\rPbDHEu.exe
  2⤵
  PID:3284
- C:\Windows\System\uQOKkvn.exe
  C:\Windows\System\uQOKkvn.exe
  2⤵
  PID:3376
- C:\Windows\System\iXrCpGi.exe
  C:\Windows\System\iXrCpGi.exe
  2⤵
  PID:3412
- C:\Windows\System\FxXtioZ.exe
  C:\Windows\System\FxXtioZ.exe
  2⤵
  PID:2404
- C:\Windows\System\fmtVLmE.exe
  C:\Windows\System\fmtVLmE.exe
  2⤵
  PID:3456
- C:\Windows\System\uMJeKEK.exe
  C:\Windows\System\uMJeKEK.exe
  2⤵
  PID:2972
- C:\Windows\System\Nacapij.exe
  C:\Windows\System\Nacapij.exe
  2⤵
  PID:3552
- C:\Windows\System\XHaINsT.exe
  C:\Windows\System\XHaINsT.exe
  2⤵
  PID:3572
- C:\Windows\System\qEWDBjF.exe
  C:\Windows\System\qEWDBjF.exe
  2⤵
  PID:3632
- C:\Windows\System\klCCjTl.exe
  C:\Windows\System\klCCjTl.exe
  2⤵
  PID:3684
- C:\Windows\System\rhtYLry.exe
  C:\Windows\System\rhtYLry.exe
  2⤵
  PID:2748
- C:\Windows\System\wELzcQi.exe
  C:\Windows\System\wELzcQi.exe
  2⤵
  PID:3768
- C:\Windows\System\KoyVstY.exe
  C:\Windows\System\KoyVstY.exe
  2⤵
  PID:1436
- C:\Windows\System\DXheDYS.exe
  C:\Windows\System\DXheDYS.exe
  2⤵
  PID:2656
- C:\Windows\System\cTNUoub.exe
  C:\Windows\System\cTNUoub.exe
  2⤵
  PID:2880
- C:\Windows\System\yjszpAt.exe
  C:\Windows\System\yjszpAt.exe
  2⤵
  PID:2068
- C:\Windows\System\ZKaUOrK.exe
  C:\Windows\System\ZKaUOrK.exe
  2⤵
  PID:2884
- C:\Windows\System\rQXpTaH.exe
  C:\Windows\System\rQXpTaH.exe
  2⤵
  PID:2464
- C:\Windows\System\sMrbJsZ.exe
  C:\Windows\System\sMrbJsZ.exe
  2⤵
  PID:3944
- C:\Windows\System\kTjpNna.exe
  C:\Windows\System\kTjpNna.exe
  2⤵
  PID:2640
- C:\Windows\System\tYhOmxt.exe
  C:\Windows\System\tYhOmxt.exe
  2⤵
  PID:2116
- C:\Windows\System\BToUIuo.exe
  C:\Windows\System\BToUIuo.exe
  2⤵
  PID:2928
- C:\Windows\System\kJzmnlR.exe
  C:\Windows\System\kJzmnlR.exe
  2⤵
  PID:2440
- C:\Windows\System\BLBLhEa.exe
  C:\Windows\System\BLBLhEa.exe
  2⤵
  PID:3252
- C:\Windows\System\laATHGE.exe
  C:\Windows\System\laATHGE.exe
  2⤵
  PID:2676
- C:\Windows\System\mLBRFug.exe
  C:\Windows\System\mLBRFug.exe
  2⤵
  PID:1784
- C:\Windows\System\vnaAPfe.exe
  C:\Windows\System\vnaAPfe.exe
  2⤵
  PID:1740
- C:\Windows\System\GPTWKwW.exe
  C:\Windows\System\GPTWKwW.exe
  2⤵
  PID:3156
- C:\Windows\System\LVsCLvL.exe
  C:\Windows\System\LVsCLvL.exe
  2⤵
  PID:2624
- C:\Windows\System\cnVbWUh.exe
  C:\Windows\System\cnVbWUh.exe
  2⤵
  PID:2648
- C:\Windows\System\HlpPkSG.exe
  C:\Windows\System\HlpPkSG.exe
  2⤵
  PID:3652
- C:\Windows\System\KZRMHuY.exe
  C:\Windows\System\KZRMHuY.exe
  2⤵
  PID:1508
- C:\Windows\System\tTnbNBL.exe
  C:\Windows\System\tTnbNBL.exe
  2⤵
  PID:840
- C:\Windows\System\zMpjKgj.exe
  C:\Windows\System\zMpjKgj.exe
  2⤵
  PID:1332
- C:\Windows\System\lyeQzIN.exe
  C:\Windows\System\lyeQzIN.exe
  2⤵
  PID:3780
- C:\Windows\System\tUoclKb.exe
  C:\Windows\System\tUoclKb.exe
  2⤵
  PID:3960
- C:\Windows\System\EsNiNqQ.exe
  C:\Windows\System\EsNiNqQ.exe
  2⤵
  PID:3312
- C:\Windows\System\ExPbGFi.exe
  C:\Windows\System\ExPbGFi.exe
  2⤵
  PID:3168
- C:\Windows\System\hwAFVfD.exe
  C:\Windows\System\hwAFVfD.exe
  2⤵
  PID:3896
- C:\Windows\System\gqbkGTo.exe
  C:\Windows\System\gqbkGTo.exe
  2⤵
  PID:536
- C:\Windows\System\GLGJMgR.exe
  C:\Windows\System\GLGJMgR.exe
  2⤵
  PID:3344
- C:\Windows\System\TuAbGFw.exe
  C:\Windows\System\TuAbGFw.exe
  2⤵
  PID:3876
- C:\Windows\System\Wvxfwyx.exe
  C:\Windows\System\Wvxfwyx.exe
  2⤵
  PID:916
- C:\Windows\System\RCICXqd.exe
  C:\Windows\System\RCICXqd.exe
  2⤵
  PID:3392
- C:\Windows\System\jTqkAgP.exe
  C:\Windows\System\jTqkAgP.exe
  2⤵
  PID:4100
- C:\Windows\System\asbzahc.exe
  C:\Windows\System\asbzahc.exe
  2⤵
  PID:4116
- C:\Windows\System\ywZdOLv.exe
  C:\Windows\System\ywZdOLv.exe
  2⤵
  PID:4132
- C:\Windows\System\OvdQLPe.exe
  C:\Windows\System\OvdQLPe.exe
  2⤵
  PID:4148
- C:\Windows\System\wIojoMq.exe
  C:\Windows\System\wIojoMq.exe
  2⤵
  PID:4164
- C:\Windows\System\cvaJnTk.exe
  C:\Windows\System\cvaJnTk.exe
  2⤵
  PID:4180
- C:\Windows\System\ROvyIiS.exe
  C:\Windows\System\ROvyIiS.exe
  2⤵
  PID:4196
- C:\Windows\System\HNAXaqN.exe
  C:\Windows\System\HNAXaqN.exe
  2⤵
  PID:4212
- C:\Windows\System\xQuDmYI.exe
  C:\Windows\System\xQuDmYI.exe
  2⤵
  PID:4228
- C:\Windows\System\bfGnkpM.exe
  C:\Windows\System\bfGnkpM.exe
  2⤵
  PID:4244
- C:\Windows\System\FLVtUkN.exe
  C:\Windows\System\FLVtUkN.exe
  2⤵
  PID:4260
- C:\Windows\System\bLVmyyE.exe
  C:\Windows\System\bLVmyyE.exe
  2⤵
  PID:4276
- C:\Windows\System\yFWbDKE.exe
  C:\Windows\System\yFWbDKE.exe
  2⤵
  PID:4292
- C:\Windows\System\MUrjZek.exe
  C:\Windows\System\MUrjZek.exe
  2⤵
  PID:4308
- C:\Windows\System\cBLhoFX.exe
  C:\Windows\System\cBLhoFX.exe
  2⤵
  PID:4324
- C:\Windows\System\IcOlioU.exe
  C:\Windows\System\IcOlioU.exe
  2⤵
  PID:4340
- C:\Windows\System\GRRhzWw.exe
  C:\Windows\System\GRRhzWw.exe
  2⤵
  PID:4356
- C:\Windows\System\FfYhCNx.exe
  C:\Windows\System\FfYhCNx.exe
  2⤵
  PID:4372
- C:\Windows\System\HCAYIdv.exe
  C:\Windows\System\HCAYIdv.exe
  2⤵
  PID:4388
- C:\Windows\System\CtiGcee.exe
  C:\Windows\System\CtiGcee.exe
  2⤵
  PID:4404
- C:\Windows\System\xcsmDAu.exe
  C:\Windows\System\xcsmDAu.exe
  2⤵
  PID:4420
- C:\Windows\System\ypkizBk.exe
  C:\Windows\System\ypkizBk.exe
  2⤵
  PID:4436
- C:\Windows\System\zqCrqqX.exe
  C:\Windows\System\zqCrqqX.exe
  2⤵
  PID:4452
- C:\Windows\System\NJeGqwV.exe
  C:\Windows\System\NJeGqwV.exe
  2⤵
  PID:4468
- C:\Windows\System\HyxHopj.exe
  C:\Windows\System\HyxHopj.exe
  2⤵
  PID:4484
- C:\Windows\System\heraQUt.exe
  C:\Windows\System\heraQUt.exe
  2⤵
  PID:4500
- C:\Windows\System\SePhhAZ.exe
  C:\Windows\System\SePhhAZ.exe
  2⤵
  PID:4516
- C:\Windows\System\jHeCfQM.exe
  C:\Windows\System\jHeCfQM.exe
  2⤵
  PID:4532
- C:\Windows\System\JkrSpAW.exe
  C:\Windows\System\JkrSpAW.exe
  2⤵
  PID:4548
- C:\Windows\System\WaAFrCg.exe
  C:\Windows\System\WaAFrCg.exe
  2⤵
  PID:4564
- C:\Windows\System\ckpRsJi.exe
  C:\Windows\System\ckpRsJi.exe
  2⤵
  PID:4580
- C:\Windows\System\xTTScBx.exe
  C:\Windows\System\xTTScBx.exe
  2⤵
  PID:4596
- C:\Windows\System\PxEMNbO.exe
  C:\Windows\System\PxEMNbO.exe
  2⤵
  PID:4612
- C:\Windows\System\MQeWuCV.exe
  C:\Windows\System\MQeWuCV.exe
  2⤵
  PID:4628
- C:\Windows\System\PcbqmXg.exe
  C:\Windows\System\PcbqmXg.exe
  2⤵
  PID:4644
- C:\Windows\System\zObZUKS.exe
  C:\Windows\System\zObZUKS.exe
  2⤵
  PID:4660
- C:\Windows\System\fBdShFa.exe
  C:\Windows\System\fBdShFa.exe
  2⤵
  PID:4676
- C:\Windows\System\ogPWgLp.exe
  C:\Windows\System\ogPWgLp.exe
  2⤵
  PID:4692
- C:\Windows\System\bZCjHDN.exe
  C:\Windows\System\bZCjHDN.exe
  2⤵
  PID:4708
- C:\Windows\System\nfEbbeD.exe
  C:\Windows\System\nfEbbeD.exe
  2⤵
  PID:4724
- C:\Windows\System\MQidIwQ.exe
  C:\Windows\System\MQidIwQ.exe
  2⤵
  PID:4740
- C:\Windows\System\SZXxfnu.exe
  C:\Windows\System\SZXxfnu.exe
  2⤵
  PID:4756
- C:\Windows\System\hgxRuuM.exe
  C:\Windows\System\hgxRuuM.exe
  2⤵
  PID:4772
- C:\Windows\System\jCKFgDO.exe
  C:\Windows\System\jCKFgDO.exe
  2⤵
  PID:4788
- C:\Windows\System\ldTMWqS.exe
  C:\Windows\System\ldTMWqS.exe
  2⤵
  PID:4804
- C:\Windows\System\oyVQWkP.exe
  C:\Windows\System\oyVQWkP.exe
  2⤵
  PID:4820
- C:\Windows\System\FXNLrIQ.exe
  C:\Windows\System\FXNLrIQ.exe
  2⤵
  PID:4836
- C:\Windows\System\FemuDae.exe
  C:\Windows\System\FemuDae.exe
  2⤵
  PID:4852
- C:\Windows\System\NGcjDii.exe
  C:\Windows\System\NGcjDii.exe
  2⤵
  PID:4868
- C:\Windows\System\yPumpNH.exe
  C:\Windows\System\yPumpNH.exe
  2⤵
  PID:4884
- C:\Windows\System\KAYgAyv.exe
  C:\Windows\System\KAYgAyv.exe
  2⤵
  PID:4900
- C:\Windows\System\GINWPjd.exe
  C:\Windows\System\GINWPjd.exe
  2⤵
  PID:4916
- C:\Windows\System\AuRTzEJ.exe
  C:\Windows\System\AuRTzEJ.exe
  2⤵
  PID:4932
- C:\Windows\System\eVevIaU.exe
  C:\Windows\System\eVevIaU.exe
  2⤵
  PID:4948
- C:\Windows\System\jxfnvtx.exe
  C:\Windows\System\jxfnvtx.exe
  2⤵
  PID:4964
- C:\Windows\System\LFWUMMP.exe
  C:\Windows\System\LFWUMMP.exe
  2⤵
  PID:4980
- C:\Windows\System\YWFImMY.exe
  C:\Windows\System\YWFImMY.exe
  2⤵
  PID:4996
- C:\Windows\System\qwumRcq.exe
  C:\Windows\System\qwumRcq.exe
  2⤵
  PID:5012
- C:\Windows\System\UweeFWh.exe
  C:\Windows\System\UweeFWh.exe
  2⤵
  PID:5028
- C:\Windows\System\RpdAfng.exe
  C:\Windows\System\RpdAfng.exe
  2⤵
  PID:5044
- C:\Windows\System\rPdLkqm.exe
  C:\Windows\System\rPdLkqm.exe
  2⤵
  PID:5060
- C:\Windows\System\uZPvvDF.exe
  C:\Windows\System\uZPvvDF.exe
  2⤵
  PID:5076
- C:\Windows\System\znFjFzm.exe
  C:\Windows\System\znFjFzm.exe
  2⤵
  PID:5092
- C:\Windows\System\yPJKdGR.exe
  C:\Windows\System\yPJKdGR.exe
  2⤵
  PID:5108
- C:\Windows\System\KvaFEmc.exe
  C:\Windows\System\KvaFEmc.exe
  2⤵
  PID:4056
- C:\Windows\System\kpiwHXO.exe
  C:\Windows\System\kpiwHXO.exe
  2⤵
  PID:3712
- C:\Windows\System\FzTABDS.exe
  C:\Windows\System\FzTABDS.exe
  2⤵
  PID:3428
- C:\Windows\System\qsYaeno.exe
  C:\Windows\System\qsYaeno.exe
  2⤵
  PID:3092
- C:\Windows\System\LachQqA.exe
  C:\Windows\System\LachQqA.exe
  2⤵
  PID:2280
- C:\Windows\System\jTWdsdG.exe
  C:\Windows\System\jTWdsdG.exe
  2⤵
  PID:1688
- C:\Windows\System\pPIUtLJ.exe
  C:\Windows\System\pPIUtLJ.exe
  2⤵
  PID:3360
- C:\Windows\System\BdMgQzW.exe
  C:\Windows\System\BdMgQzW.exe
  2⤵
  PID:4144
- C:\Windows\System\sZLqMqH.exe
  C:\Windows\System\sZLqMqH.exe
  2⤵
  PID:4192
- C:\Windows\System\gyZDPUP.exe
  C:\Windows\System\gyZDPUP.exe
  2⤵
  PID:4284
- C:\Windows\System\YzCjefc.exe
  C:\Windows\System\YzCjefc.exe
  2⤵
  PID:4316
- C:\Windows\System\BtnejtX.exe
  C:\Windows\System\BtnejtX.exe
  2⤵
  PID:4208
- C:\Windows\System\YQsydQe.exe
  C:\Windows\System\YQsydQe.exe
  2⤵
  PID:4272
- C:\Windows\System\uVUPogx.exe
  C:\Windows\System\uVUPogx.exe
  2⤵
  PID:4352
- C:\Windows\System\GSmYEEi.exe
  C:\Windows\System\GSmYEEi.exe
  2⤵
  PID:4412
- C:\Windows\System\TOLGIpT.exe
  C:\Windows\System\TOLGIpT.exe
  2⤵
  PID:4336
- C:\Windows\System\NFbANpl.exe
  C:\Windows\System\NFbANpl.exe
  2⤵
  PID:4400
- C:\Windows\System\hKHyQjK.exe
  C:\Windows\System\hKHyQjK.exe
  2⤵
  PID:4540
- C:\Windows\System\arQzFoO.exe
  C:\Windows\System\arQzFoO.exe
  2⤵
  PID:4432
- C:\Windows\System\OFaRtuY.exe
  C:\Windows\System\OFaRtuY.exe
  2⤵
  PID:4496
- C:\Windows\System\CVbWXuf.exe
  C:\Windows\System\CVbWXuf.exe
  2⤵
  PID:4572
- C:\Windows\System\MaEAdsm.exe
  C:\Windows\System\MaEAdsm.exe
  2⤵
  PID:4608
- C:\Windows\System\bbRPVkL.exe
  C:\Windows\System\bbRPVkL.exe
  2⤵
  PID:4672
- C:\Windows\System\lOzaAHR.exe
  C:\Windows\System\lOzaAHR.exe
  2⤵
  PID:4588
- C:\Windows\System\rsNpWFv.exe
  C:\Windows\System\rsNpWFv.exe
  2⤵
  PID:4652
- C:\Windows\System\znWZDpn.exe
  C:\Windows\System\znWZDpn.exe
  2⤵
  PID:4716
- C:\Windows\System\oypBQYf.exe
  C:\Windows\System\oypBQYf.exe
  2⤵
  PID:4764
- C:\Windows\System\tqnUqRL.exe
  C:\Windows\System\tqnUqRL.exe
  2⤵
  PID:4828
- C:\Windows\System\ZsdUYrr.exe
  C:\Windows\System\ZsdUYrr.exe
  2⤵
  PID:4864
- C:\Windows\System\dTdmywT.exe
  C:\Windows\System\dTdmywT.exe
  2⤵
  PID:4928
- C:\Windows\System\UtZlaMA.exe
  C:\Windows\System\UtZlaMA.exe
  2⤵
  PID:5020
- C:\Windows\System\QCNmMgb.exe
  C:\Windows\System\QCNmMgb.exe
  2⤵
  PID:5084
- C:\Windows\System\UwizwJm.exe
  C:\Windows\System\UwizwJm.exe
  2⤵
  PID:4780
- C:\Windows\System\PczUida.exe
  C:\Windows\System\PczUida.exe
  2⤵
  PID:4844
- C:\Windows\System\PJOyPHp.exe
  C:\Windows\System\PJOyPHp.exe
  2⤵
  PID:4908
- C:\Windows\System\TYSjJfJ.exe
  C:\Windows\System\TYSjJfJ.exe
  2⤵
  PID:4972
- C:\Windows\System\bJidemv.exe
  C:\Windows\System\bJidemv.exe
  2⤵
  PID:5036
- C:\Windows\System\mRqEhmo.exe
  C:\Windows\System\mRqEhmo.exe
  2⤵
  PID:5100
- C:\Windows\System\ZaNUuEP.exe
  C:\Windows\System\ZaNUuEP.exe
  2⤵
  PID:1868
- C:\Windows\System\oDwjhdc.exe
  C:\Windows\System\oDwjhdc.exe
  2⤵
  PID:4004
- C:\Windows\System\bKTgPwA.exe
  C:\Windows\System\bKTgPwA.exe
  2⤵
  PID:4224
- C:\Windows\System\jRHNssD.exe
  C:\Windows\System\jRHNssD.exe
  2⤵
  PID:4256
- C:\Windows\System\bYlBErT.exe
  C:\Windows\System\bYlBErT.exe
  2⤵
  PID:2428
- C:\Windows\System\jQiHvvD.exe
  C:\Windows\System\jQiHvvD.exe
  2⤵
  PID:848
- C:\Windows\System\FgkNkic.exe
  C:\Windows\System\FgkNkic.exe
  2⤵
  PID:4240
- C:\Windows\System\mqPsvxW.exe
  C:\Windows\System\mqPsvxW.exe
  2⤵
  PID:4396
- C:\Windows\System\yOFroBg.exe
  C:\Windows\System\yOFroBg.exe
  2⤵
  PID:4524
- C:\Windows\System\QeksmmX.exe
  C:\Windows\System\QeksmmX.exe
  2⤵
  PID:4476
- C:\Windows\System\huAUnqS.exe
  C:\Windows\System\huAUnqS.exe
  2⤵
  PID:4576
- C:\Windows\System\MmLRynD.exe
  C:\Windows\System\MmLRynD.exe
  2⤵
  PID:4684
- C:\Windows\System\xjtfOsb.exe
  C:\Windows\System\xjtfOsb.exe
  2⤵
  PID:4896
- C:\Windows\System\RWllVNL.exe
  C:\Windows\System\RWllVNL.exe
  2⤵
  PID:4812
- C:\Windows\System\VamHQWz.exe
  C:\Windows\System\VamHQWz.exe
  2⤵
  PID:5068
- C:\Windows\System\DbRcCbR.exe
  C:\Windows\System\DbRcCbR.exe
  2⤵
  PID:3600
- C:\Windows\System\ZJghoak.exe
  C:\Windows\System\ZJghoak.exe
  2⤵
  PID:4384
- C:\Windows\System\qaSOWEj.exe
  C:\Windows\System\qaSOWEj.exe
  2⤵
  PID:4556
- C:\Windows\System\TldWpyN.exe
  C:\Windows\System\TldWpyN.exe
  2⤵
  PID:5136
- C:\Windows\System\USwRQXU.exe
  C:\Windows\System\USwRQXU.exe
  2⤵
  PID:5152
- C:\Windows\System\YxnhbAc.exe
  C:\Windows\System\YxnhbAc.exe
  2⤵
  PID:5168
- C:\Windows\System\iArDVES.exe
  C:\Windows\System\iArDVES.exe
  2⤵
  PID:5184
- C:\Windows\System\KwXPrPj.exe
  C:\Windows\System\KwXPrPj.exe
  2⤵
  PID:5200
- C:\Windows\System\hxpIMFC.exe
  C:\Windows\System\hxpIMFC.exe
  2⤵
  PID:5216
- C:\Windows\System\ndKwcNx.exe
  C:\Windows\System\ndKwcNx.exe
  2⤵
  PID:5232
- C:\Windows\System\pAYPKVS.exe
  C:\Windows\System\pAYPKVS.exe
  2⤵
  PID:5248
- C:\Windows\System\VVviRJX.exe
  C:\Windows\System\VVviRJX.exe
  2⤵
  PID:5264
- C:\Windows\System\pAeZKSi.exe
  C:\Windows\System\pAeZKSi.exe
  2⤵
  PID:5280
- C:\Windows\System\CHjoXSR.exe
  C:\Windows\System\CHjoXSR.exe
  2⤵
  PID:5296
- C:\Windows\System\eXLLjLw.exe
  C:\Windows\System\eXLLjLw.exe
  2⤵
  PID:5312
- C:\Windows\System\XTWJzOO.exe
  C:\Windows\System\XTWJzOO.exe
  2⤵
  PID:5332
- C:\Windows\System\AEIyJeJ.exe
  C:\Windows\System\AEIyJeJ.exe
  2⤵
  PID:5348
- C:\Windows\System\pelyGDb.exe
  C:\Windows\System\pelyGDb.exe
  2⤵
  PID:5364
- C:\Windows\System\wyfPRnY.exe
  C:\Windows\System\wyfPRnY.exe
  2⤵
  PID:5380
- C:\Windows\System\OgcIQsl.exe
  C:\Windows\System\OgcIQsl.exe
  2⤵
  PID:5396
- C:\Windows\System\cANvsIB.exe
  C:\Windows\System\cANvsIB.exe
  2⤵
  PID:5412
- C:\Windows\System\UDGzfhf.exe
  C:\Windows\System\UDGzfhf.exe
  2⤵
  PID:5428
- C:\Windows\System\nSCFJtT.exe
  C:\Windows\System\nSCFJtT.exe
  2⤵
  PID:5444
- C:\Windows\System\zIcOPsc.exe
  C:\Windows\System\zIcOPsc.exe
  2⤵
  PID:5460
- C:\Windows\System\NrXTaTa.exe
  C:\Windows\System\NrXTaTa.exe
  2⤵
  PID:5476
- C:\Windows\System\quFnSbX.exe
  C:\Windows\System\quFnSbX.exe
  2⤵
  PID:5492
- C:\Windows\System\gEmFBEZ.exe
  C:\Windows\System\gEmFBEZ.exe
  2⤵
  PID:5508
- C:\Windows\System\DwljxpF.exe
  C:\Windows\System\DwljxpF.exe
  2⤵
  PID:5524
- C:\Windows\System\ELOzXNp.exe
  C:\Windows\System\ELOzXNp.exe
  2⤵
  PID:5540
- C:\Windows\System\ORyWBas.exe
  C:\Windows\System\ORyWBas.exe
  2⤵
  PID:5556
- C:\Windows\System\wbibfOD.exe
  C:\Windows\System\wbibfOD.exe
  2⤵
  PID:5572
- C:\Windows\System\brdjWXf.exe
  C:\Windows\System\brdjWXf.exe
  2⤵
  PID:5588
- C:\Windows\System\nEWMXPr.exe
  C:\Windows\System\nEWMXPr.exe
  2⤵
  PID:5604
- C:\Windows\System\uXQnFyd.exe
  C:\Windows\System\uXQnFyd.exe
  2⤵
  PID:5620
- C:\Windows\System\vQSzeIO.exe
  C:\Windows\System\vQSzeIO.exe
  2⤵
  PID:5636
- C:\Windows\System\qNJuJBC.exe
  C:\Windows\System\qNJuJBC.exe
  2⤵
  PID:5652
- C:\Windows\System\ICMLQTe.exe
  C:\Windows\System\ICMLQTe.exe
  2⤵
  PID:5668
- C:\Windows\System\qjlTaze.exe
  C:\Windows\System\qjlTaze.exe
  2⤵
  PID:5684
- C:\Windows\System\PXfZbmU.exe
  C:\Windows\System\PXfZbmU.exe
  2⤵
  PID:5700
- C:\Windows\System\XtSffdQ.exe
  C:\Windows\System\XtSffdQ.exe
  2⤵
  PID:5716
- C:\Windows\System\RZMAEJa.exe
  C:\Windows\System\RZMAEJa.exe
  2⤵
  PID:5732
- C:\Windows\System\DQyeCMh.exe
  C:\Windows\System\DQyeCMh.exe
  2⤵
  PID:5748
- C:\Windows\System\fiNsvCm.exe
  C:\Windows\System\fiNsvCm.exe
  2⤵
  PID:5848
- C:\Windows\System\kSoWDQI.exe
  C:\Windows\System\kSoWDQI.exe
  2⤵
  PID:5864
- C:\Windows\System\OPNPLIm.exe
  C:\Windows\System\OPNPLIm.exe
  2⤵
  PID:5880
- C:\Windows\System\NvjveRG.exe
  C:\Windows\System\NvjveRG.exe
  2⤵
  PID:5896
- C:\Windows\System\bAVoOGa.exe
  C:\Windows\System\bAVoOGa.exe
  2⤵
  PID:5912
- C:\Windows\System\PtpOHOD.exe
  C:\Windows\System\PtpOHOD.exe
  2⤵
  PID:5932
- C:\Windows\System\JGjMCMW.exe
  C:\Windows\System\JGjMCMW.exe
  2⤵
  PID:5948
- C:\Windows\System\JkgPSdQ.exe
  C:\Windows\System\JkgPSdQ.exe
  2⤵
  PID:5964
- C:\Windows\System\Sotwhuy.exe
  C:\Windows\System\Sotwhuy.exe
  2⤵
  PID:5980
- C:\Windows\System\UDgvrgS.exe
  C:\Windows\System\UDgvrgS.exe
  2⤵
  PID:5996
- C:\Windows\System\vwPtFOK.exe
  C:\Windows\System\vwPtFOK.exe
  2⤵
  PID:6012
- C:\Windows\System\OEYThtX.exe
  C:\Windows\System\OEYThtX.exe
  2⤵
  PID:6028
- C:\Windows\System\PMWQUnf.exe
  C:\Windows\System\PMWQUnf.exe
  2⤵
  PID:6044
- C:\Windows\System\jgEppHm.exe
  C:\Windows\System\jgEppHm.exe
  2⤵
  PID:6060
- C:\Windows\System\RCYJzgJ.exe
  C:\Windows\System\RCYJzgJ.exe
  2⤵
  PID:6076
- C:\Windows\System\SvsmbLi.exe
  C:\Windows\System\SvsmbLi.exe
  2⤵
  PID:6092
- C:\Windows\System\BugLlUH.exe
  C:\Windows\System\BugLlUH.exe
  2⤵
  PID:6108
- C:\Windows\System\FodtNWB.exe
  C:\Windows\System\FodtNWB.exe
  2⤵
  PID:6124
- C:\Windows\System\cThXLVY.exe
  C:\Windows\System\cThXLVY.exe
  2⤵
  PID:6140
- C:\Windows\System\hLcoEBs.exe
  C:\Windows\System\hLcoEBs.exe
  2⤵
  PID:4560
- C:\Windows\System\nidjLQo.exe
  C:\Windows\System\nidjLQo.exe
  2⤵
  PID:4444
- C:\Windows\System\TyESoSK.exe
  C:\Windows\System\TyESoSK.exe
  2⤵
  PID:5176
- C:\Windows\System\shbmzLT.exe
  C:\Windows\System\shbmzLT.exe
  2⤵
  PID:4620
- C:\Windows\System\ZtyyjlB.exe
  C:\Windows\System\ZtyyjlB.exe
  2⤵
  PID:2292
- C:\Windows\System\Ogkanrw.exe
  C:\Windows\System\Ogkanrw.exe
  2⤵
  PID:4736
- C:\Windows\System\WgZzNIB.exe
  C:\Windows\System\WgZzNIB.exe
  2⤵
  PID:4748
- C:\Windows\System\EDfcRjM.exe
  C:\Windows\System\EDfcRjM.exe
  2⤵
  PID:5004
- C:\Windows\System\aaSOFEa.exe
  C:\Windows\System\aaSOFEa.exe
  2⤵
  PID:4172
- C:\Windows\System\pYqSkCj.exe
  C:\Windows\System\pYqSkCj.exe
  2⤵
  PID:4368
- C:\Windows\System\PlnVJyd.exe
  C:\Windows\System\PlnVJyd.exe
  2⤵
  PID:4796
- C:\Windows\System\SpJnHoL.exe
  C:\Windows\System\SpJnHoL.exe
  2⤵
  PID:2432
- C:\Windows\System\xuGPMXT.exe
  C:\Windows\System\xuGPMXT.exe
  2⤵
  PID:5192
- C:\Windows\System\VLZunyr.exe
  C:\Windows\System\VLZunyr.exe
  2⤵
  PID:5260
- C:\Windows\System\KyHmfUF.exe
  C:\Windows\System\KyHmfUF.exe
  2⤵
  PID:5320
- C:\Windows\System\adddyZF.exe
  C:\Windows\System\adddyZF.exe
  2⤵
  PID:5324
- C:\Windows\System\QPyqYbU.exe
  C:\Windows\System\QPyqYbU.exe
  2⤵
  PID:5340
- C:\Windows\System\hRqopQD.exe
  C:\Windows\System\hRqopQD.exe
  2⤵
  PID:5356
- C:\Windows\System\UmqnRhN.exe
  C:\Windows\System\UmqnRhN.exe
  2⤵
  PID:5408
- C:\Windows\System\dmHBIVD.exe
  C:\Windows\System\dmHBIVD.exe
  2⤵
  PID:5472
- C:\Windows\System\vcOAxJq.exe
  C:\Windows\System\vcOAxJq.exe
  2⤵
  PID:5532
- C:\Windows\System\dLkDhpJ.exe
  C:\Windows\System\dLkDhpJ.exe
  2⤵
  PID:5600
- C:\Windows\System\bSBjRmY.exe
  C:\Windows\System\bSBjRmY.exe
  2⤵
  PID:5664
- C:\Windows\System\IIAizwd.exe
  C:\Windows\System\IIAizwd.exe
  2⤵
  PID:5728
- C:\Windows\System\uwLwYJi.exe
  C:\Windows\System\uwLwYJi.exe
  2⤵
  PID:5580
- C:\Windows\System\MhEQIii.exe
  C:\Windows\System\MhEQIii.exe
  2⤵
  PID:5516
- C:\Windows\System\kQbFsDm.exe
  C:\Windows\System\kQbFsDm.exe
  2⤵
  PID:5712
- C:\Windows\System\RSZGESf.exe
  C:\Windows\System\RSZGESf.exe
  2⤵
  PID:5648
- C:\Windows\System\SdpiWTy.exe
  C:\Windows\System\SdpiWTy.exe
  2⤵
  PID:5584
- C:\Windows\System\pGeVRyU.exe
  C:\Windows\System\pGeVRyU.exe
  2⤵
  PID:5800
- C:\Windows\System\EiPxVJf.exe
  C:\Windows\System\EiPxVJf.exe
  2⤵
  PID:5816
- C:\Windows\System\awSnrTq.exe
  C:\Windows\System\awSnrTq.exe
  2⤵
  PID:5832
- C:\Windows\System\TrKMEGA.exe
  C:\Windows\System\TrKMEGA.exe
  2⤵
  PID:5872
- C:\Windows\System\SNudivt.exe
  C:\Windows\System\SNudivt.exe
  2⤵
  PID:5976
- C:\Windows\System\tygeYfU.exe
  C:\Windows\System\tygeYfU.exe
  2⤵
  PID:6072
- C:\Windows\System\LDPRLMt.exe
  C:\Windows\System\LDPRLMt.exe
  2⤵
  PID:6008
- C:\Windows\System\oqgbaEN.exe
  C:\Windows\System\oqgbaEN.exe
  2⤵
  PID:6104
- C:\Windows\System\ZLkpzMi.exe
  C:\Windows\System\ZLkpzMi.exe
  2⤵
  PID:5920
- C:\Windows\System\IZVcdGv.exe
  C:\Windows\System\IZVcdGv.exe
  2⤵
  PID:5924
- C:\Windows\System\wIXCFJf.exe
  C:\Windows\System\wIXCFJf.exe
  2⤵
  PID:5988
- C:\Windows\System\CZbOwpA.exe
  C:\Windows\System\CZbOwpA.exe
  2⤵
  PID:6052
- C:\Windows\System\oLQWcYL.exe
  C:\Windows\System\oLQWcYL.exe
  2⤵
  PID:6120
- C:\Windows\System\ijZzJah.exe
  C:\Windows\System\ijZzJah.exe
  2⤵
  PID:4992
- C:\Windows\System\HwxYJkq.exe
  C:\Windows\System\HwxYJkq.exe
  2⤵
  PID:4188
- C:\Windows\System\hfexmgH.exe
  C:\Windows\System\hfexmgH.exe
  2⤵
  PID:5212
- C:\Windows\System\gLcvlqF.exe
  C:\Windows\System\gLcvlqF.exe
  2⤵
  PID:4464
- C:\Windows\System\jKbUIMF.exe
  C:\Windows\System\jKbUIMF.exe
  2⤵
  PID:5164
- C:\Windows\System\MkepFzL.exe
  C:\Windows\System\MkepFzL.exe
  2⤵
  PID:5308
- C:\Windows\System\ziHWpOn.exe
  C:\Windows\System\ziHWpOn.exe
  2⤵
  PID:5568
- C:\Windows\System\JTQYgFC.exe
  C:\Windows\System\JTQYgFC.exe
  2⤵
  PID:5828
- C:\Windows\System\BeutCAE.exe
  C:\Windows\System\BeutCAE.exe
  2⤵
  PID:5484
- C:\Windows\System\lAGCths.exe
  C:\Windows\System\lAGCths.exe
  2⤵
  PID:5956
- C:\Windows\System\BGHfDOq.exe
  C:\Windows\System\BGHfDOq.exe
  2⤵
  PID:5860
- C:\Windows\System\xuBTJNL.exe
  C:\Windows\System\xuBTJNL.exe
  2⤵
  PID:6116
- C:\Windows\System\FKlJdOC.exe
  C:\Windows\System\FKlJdOC.exe
  2⤵
  PID:4140
- C:\Windows\System\yuWUcFT.exe
  C:\Windows\System\yuWUcFT.exe
  2⤵
  PID:4876
- C:\Windows\System\qBUjlDK.exe
  C:\Windows\System\qBUjlDK.exe
  2⤵
  PID:4940
- C:\Windows\System\BeTFGsl.exe
  C:\Windows\System\BeTFGsl.exe
  2⤵
  PID:5724
- C:\Windows\System\yNFmaoM.exe
  C:\Windows\System\yNFmaoM.exe
  2⤵
  PID:6148
- C:\Windows\System\umKkiaM.exe
  C:\Windows\System\umKkiaM.exe
  2⤵
  PID:6164
- C:\Windows\System\RHEALxW.exe
  C:\Windows\System\RHEALxW.exe
  2⤵
  PID:6180
- C:\Windows\System\PrGoyaw.exe
  C:\Windows\System\PrGoyaw.exe
  2⤵
  PID:6196
- C:\Windows\System\cRZlQXC.exe
  C:\Windows\System\cRZlQXC.exe
  2⤵
  PID:6212
- C:\Windows\System\caaZCwQ.exe
  C:\Windows\System\caaZCwQ.exe
  2⤵
  PID:6228
- C:\Windows\System\TEhCQEi.exe
  C:\Windows\System\TEhCQEi.exe
  2⤵
  PID:6244
- C:\Windows\System\NRawPvb.exe
  C:\Windows\System\NRawPvb.exe
  2⤵
  PID:6260
- C:\Windows\System\ZzRqohk.exe
  C:\Windows\System\ZzRqohk.exe
  2⤵
  PID:6276
- C:\Windows\System\WoWuXts.exe
  C:\Windows\System\WoWuXts.exe
  2⤵
  PID:6292
- C:\Windows\System\lHTcevo.exe
  C:\Windows\System\lHTcevo.exe
  2⤵
  PID:6308
- C:\Windows\System\EfFMUsR.exe
  C:\Windows\System\EfFMUsR.exe
  2⤵
  PID:6324
- C:\Windows\System\XNlsZXj.exe
  C:\Windows\System\XNlsZXj.exe
  2⤵
  PID:6340
- C:\Windows\System\QKxCHMb.exe
  C:\Windows\System\QKxCHMb.exe
  2⤵
  PID:6356
- C:\Windows\System\cAPsqLk.exe
  C:\Windows\System\cAPsqLk.exe
  2⤵
  PID:6372
- C:\Windows\System\bsExsMV.exe
  C:\Windows\System\bsExsMV.exe
  2⤵
  PID:6388
- C:\Windows\System\gTBlClG.exe
  C:\Windows\System\gTBlClG.exe
  2⤵
  PID:6404
- C:\Windows\System\safkarB.exe
  C:\Windows\System\safkarB.exe
  2⤵
  PID:6420
- C:\Windows\System\vGLXVhO.exe
  C:\Windows\System\vGLXVhO.exe
  2⤵
  PID:6436
- C:\Windows\System\nmNCOmX.exe
  C:\Windows\System\nmNCOmX.exe
  2⤵
  PID:6452
- C:\Windows\System\vqrjOUk.exe
  C:\Windows\System\vqrjOUk.exe
  2⤵
  PID:6468
- C:\Windows\System\ledJmtl.exe
  C:\Windows\System\ledJmtl.exe
  2⤵
  PID:6484
- C:\Windows\System\WkqWRnr.exe
  C:\Windows\System\WkqWRnr.exe
  2⤵
  PID:6500
- C:\Windows\System\rZyNYJz.exe
  C:\Windows\System\rZyNYJz.exe
  2⤵
  PID:6516
- C:\Windows\System\edIKKjY.exe
  C:\Windows\System\edIKKjY.exe
  2⤵
  PID:6532
- C:\Windows\System\UwVuTLO.exe
  C:\Windows\System\UwVuTLO.exe
  2⤵
  PID:6548
- C:\Windows\System\BhsRdHs.exe
  C:\Windows\System\BhsRdHs.exe
  2⤵
  PID:6564
- C:\Windows\System\GBmhkqn.exe
  C:\Windows\System\GBmhkqn.exe
  2⤵
  PID:6580
- C:\Windows\System\vPGEfGZ.exe
  C:\Windows\System\vPGEfGZ.exe
  2⤵
  PID:6596
- C:\Windows\System\inYBqdD.exe
  C:\Windows\System\inYBqdD.exe
  2⤵
  PID:6612
- C:\Windows\System\hRfuPDm.exe
  C:\Windows\System\hRfuPDm.exe
  2⤵
  PID:6628
- C:\Windows\System\hHnzpPL.exe
  C:\Windows\System\hHnzpPL.exe
  2⤵
  PID:6644
- C:\Windows\System\RpjscxJ.exe
  C:\Windows\System\RpjscxJ.exe
  2⤵
  PID:6660
- C:\Windows\System\mlgisfU.exe
  C:\Windows\System\mlgisfU.exe
  2⤵
  PID:6676
- C:\Windows\System\RydguYL.exe
  C:\Windows\System\RydguYL.exe
  2⤵
  PID:6692
- C:\Windows\System\HRpaYLn.exe
  C:\Windows\System\HRpaYLn.exe
  2⤵
  PID:6708
- C:\Windows\System\ouGXCfL.exe
  C:\Windows\System\ouGXCfL.exe
  2⤵
  PID:6724
- C:\Windows\System\LTNzMWx.exe
  C:\Windows\System\LTNzMWx.exe
  2⤵
  PID:6740
- C:\Windows\System\JysrWBn.exe
  C:\Windows\System\JysrWBn.exe
  2⤵
  PID:6756
- C:\Windows\System\vtjOCEt.exe
  C:\Windows\System\vtjOCEt.exe
  2⤵
  PID:6772
- C:\Windows\System\ABiDJVY.exe
  C:\Windows\System\ABiDJVY.exe
  2⤵
  PID:6788
- C:\Windows\System\IuNATDe.exe
  C:\Windows\System\IuNATDe.exe
  2⤵
  PID:6804
- C:\Windows\System\hvbasnf.exe
  C:\Windows\System\hvbasnf.exe
  2⤵
  PID:6820
- C:\Windows\System\tqLdLnT.exe
  C:\Windows\System\tqLdLnT.exe
  2⤵
  PID:6836
- C:\Windows\System\hTFUaYS.exe
  C:\Windows\System\hTFUaYS.exe
  2⤵
  PID:6852
- C:\Windows\System\YpOAfsD.exe
  C:\Windows\System\YpOAfsD.exe
  2⤵
  PID:6868
- C:\Windows\System\HIPLoVq.exe
  C:\Windows\System\HIPLoVq.exe
  2⤵
  PID:6916
- C:\Windows\System\MCQHTOZ.exe
  C:\Windows\System\MCQHTOZ.exe
  2⤵
  PID:6936
- C:\Windows\System\ldGOJuP.exe
  C:\Windows\System\ldGOJuP.exe
  2⤵
  PID:6952
- C:\Windows\System\VjIBSZV.exe
  C:\Windows\System\VjIBSZV.exe
  2⤵
  PID:6968
- C:\Windows\System\jYDdANA.exe
  C:\Windows\System\jYDdANA.exe
  2⤵
  PID:6984
- C:\Windows\System\ykYtqyv.exe
  C:\Windows\System\ykYtqyv.exe
  2⤵
  PID:7000
- C:\Windows\System\hZBqBMf.exe
  C:\Windows\System\hZBqBMf.exe
  2⤵
  PID:7016
- C:\Windows\System\pvALpEr.exe
  C:\Windows\System\pvALpEr.exe
  2⤵
  PID:7032
- C:\Windows\System\mhhLThI.exe
  C:\Windows\System\mhhLThI.exe
  2⤵
  PID:7048
- C:\Windows\System\fdrpoZn.exe
  C:\Windows\System\fdrpoZn.exe
  2⤵
  PID:7064
- C:\Windows\System\TjxFxBN.exe
  C:\Windows\System\TjxFxBN.exe
  2⤵
  PID:7080
- C:\Windows\System\OSnpbwT.exe
  C:\Windows\System\OSnpbwT.exe
  2⤵
  PID:7096
- C:\Windows\System\BGbeqNb.exe
  C:\Windows\System\BGbeqNb.exe
  2⤵
  PID:7112
- C:\Windows\System\JITYksJ.exe
  C:\Windows\System\JITYksJ.exe
  2⤵
  PID:7128
- C:\Windows\System\xEWenLV.exe
  C:\Windows\System\xEWenLV.exe
  2⤵
  PID:7144
- C:\Windows\System\USqLAwO.exe
  C:\Windows\System\USqLAwO.exe
  2⤵
  PID:7160
- C:\Windows\System\XXTFALC.exe
  C:\Windows\System\XXTFALC.exe
  2⤵
  PID:4624
- C:\Windows\System\bMQGhOx.exe
  C:\Windows\System\bMQGhOx.exe
  2⤵
  PID:4732
- C:\Windows\System\iOZNdLf.exe
  C:\Windows\System\iOZNdLf.exe
  2⤵
  PID:5468
- C:\Windows\System\AUDJsys.exe
  C:\Windows\System\AUDJsys.exe
  2⤵
  PID:5552
- C:\Windows\System\EyIbDsg.exe
  C:\Windows\System\EyIbDsg.exe
  2⤵
  PID:5616
- C:\Windows\System\KJebrlp.exe
  C:\Windows\System\KJebrlp.exe
  2⤵
  PID:5840
- C:\Windows\System\ORmJYIt.exe
  C:\Windows\System\ORmJYIt.exe
  2⤵
  PID:6136
- C:\Windows\System\DBsfxjn.exe
  C:\Windows\System\DBsfxjn.exe
  2⤵
  PID:6020
- C:\Windows\System\KKcmEiX.exe
  C:\Windows\System\KKcmEiX.exe
  2⤵
  PID:5144
- C:\Windows\System\VuKtEzo.exe
  C:\Windows\System\VuKtEzo.exe
  2⤵
  PID:6160
- C:\Windows\System\RlbrWXj.exe
  C:\Windows\System\RlbrWXj.exe
  2⤵
  PID:6156
- C:\Windows\System\CsQASeG.exe
  C:\Windows\System\CsQASeG.exe
  2⤵
  PID:6040
- C:\Windows\System\wwJdPLR.exe
  C:\Windows\System\wwJdPLR.exe
  2⤵
  PID:1416
- C:\Windows\System\qiDjXkh.exe
  C:\Windows\System\qiDjXkh.exe
  2⤵
  PID:5796
- C:\Windows\System\IhdUzHP.exe
  C:\Windows\System\IhdUzHP.exe
  2⤵
  PID:6204
- C:\Windows\System\rAwQmxs.exe
  C:\Windows\System\rAwQmxs.exe
  2⤵
  PID:6316
- C:\Windows\System\EvGYexn.exe
  C:\Windows\System\EvGYexn.exe
  2⤵
  PID:6252
- C:\Windows\System\FFbwdqO.exe
  C:\Windows\System\FFbwdqO.exe
  2⤵
  PID:6300
- C:\Windows\System\uRlmexT.exe
  C:\Windows\System\uRlmexT.exe
  2⤵
  PID:6364
- C:\Windows\System\HXbysUS.exe
  C:\Windows\System\HXbysUS.exe
  2⤵
  PID:6428
- C:\Windows\System\AcEifgI.exe
  C:\Windows\System\AcEifgI.exe
  2⤵
  PID:6284
- C:\Windows\System\xSCwdZI.exe
  C:\Windows\System\xSCwdZI.exe
  2⤵
  PID:6352
- C:\Windows\System\CAwaiZy.exe
  C:\Windows\System\CAwaiZy.exe
  2⤵
  PID:6412
- C:\Windows\System\gFIVgKk.exe
  C:\Windows\System\gFIVgKk.exe
  2⤵
  PID:6480
- C:\Windows\System\GdhHMWC.exe
  C:\Windows\System\GdhHMWC.exe
  2⤵
  PID:6576
- C:\Windows\System\MgJtkTG.exe
  C:\Windows\System\MgJtkTG.exe
  2⤵
  PID:6672
- C:\Windows\System\lJojXDO.exe
  C:\Windows\System\lJojXDO.exe
  2⤵
  PID:5504
- C:\Windows\System\gbKkBUx.exe
  C:\Windows\System\gbKkBUx.exe
  2⤵
  PID:6528
- C:\Windows\System\BANuyxo.exe
  C:\Windows\System\BANuyxo.exe
  2⤵
  PID:6592
- C:\Windows\System\JLMEPOd.exe
  C:\Windows\System\JLMEPOd.exe
  2⤵
  PID:6652
- C:\Windows\System\KfESOOB.exe
  C:\Windows\System\KfESOOB.exe
  2⤵
  PID:6768
- C:\Windows\System\kgAEuCX.exe
  C:\Windows\System\kgAEuCX.exe
  2⤵
  PID:6832
- C:\Windows\System\RTJTqxl.exe
  C:\Windows\System\RTJTqxl.exe
  2⤵
  PID:6752
- C:\Windows\System\sodtONK.exe
  C:\Windows\System\sodtONK.exe
  2⤵
  PID:6684
- C:\Windows\System\czqmnNL.exe
  C:\Windows\System\czqmnNL.exe
  2⤵
  PID:6816
- C:\Windows\System\MYqzAXe.exe
  C:\Windows\System\MYqzAXe.exe
  2⤵
  PID:6876
- C:\Windows\System\rydXPKm.exe
  C:\Windows\System\rydXPKm.exe
  2⤵
  PID:6892
- C:\Windows\System\nhyyDKC.exe
  C:\Windows\System\nhyyDKC.exe
  2⤵
  PID:6928
- C:\Windows\System\QJsJJYx.exe
  C:\Windows\System\QJsJJYx.exe
  2⤵
  PID:6964
- C:\Windows\System\vQxGyyu.exe
  C:\Windows\System\vQxGyyu.exe
  2⤵
  PID:7056
- C:\Windows\System\YyMMLSq.exe
  C:\Windows\System\YyMMLSq.exe
  2⤵
  PID:7088
- C:\Windows\System\PEvzkmb.exe
  C:\Windows\System\PEvzkmb.exe
  2⤵
  PID:7120
- C:\Windows\System\hlFKFah.exe
  C:\Windows\System\hlFKFah.exe
  2⤵
  PID:7040
- C:\Windows\System\CqahOmQ.exe
  C:\Windows\System\CqahOmQ.exe
  2⤵
  PID:7108
- C:\Windows\System\uvLwfTT.exe
  C:\Windows\System\uvLwfTT.exe
  2⤵
  PID:7012
- C:\Windows\System\eFxHWcs.exe
  C:\Windows\System\eFxHWcs.exe
  2⤵
  PID:7156
- C:\Windows\System\VpepJWz.exe
  C:\Windows\System\VpepJWz.exe
  2⤵
  PID:5376
- C:\Windows\System\OYxVrIx.exe
  C:\Windows\System\OYxVrIx.exe
  2⤵
  PID:5944
- C:\Windows\System\xDJWokh.exe
  C:\Windows\System\xDJWokh.exe
  2⤵
  PID:6188
- C:\Windows\System\jjhHTto.exe
  C:\Windows\System\jjhHTto.exe
  2⤵
  PID:6176
- C:\Windows\System\eIZVNjo.exe
  C:\Windows\System\eIZVNjo.exe
  2⤵
  PID:5808
- C:\Windows\System\RLNoRSJ.exe
  C:\Windows\System\RLNoRSJ.exe
  2⤵
  PID:6460
- C:\Windows\System\oLYDGLL.exe
  C:\Windows\System\oLYDGLL.exe
  2⤵
  PID:6508
- C:\Windows\System\wKvTCXW.exe
  C:\Windows\System\wKvTCXW.exe
  2⤵
  PID:5660
- C:\Windows\System\jbQwUJs.exe
  C:\Windows\System\jbQwUJs.exe
  2⤵
  PID:5132
- C:\Windows\System\NiiwVwA.exe
  C:\Windows\System\NiiwVwA.exe
  2⤵
  PID:4288
- C:\Windows\System\TlopAXS.exe
  C:\Windows\System\TlopAXS.exe
  2⤵
  PID:6640
- C:\Windows\System\EZPRZND.exe
  C:\Windows\System\EZPRZND.exe
  2⤵
  PID:6400
- C:\Windows\System\LCyvbZV.exe
  C:\Windows\System\LCyvbZV.exe
  2⤵
  PID:6636
- C:\Windows\System\FCWadmS.exe
  C:\Windows\System\FCWadmS.exe
  2⤵
  PID:6736
- C:\Windows\System\TgfAFQi.exe
  C:\Windows\System\TgfAFQi.exe
  2⤵
  PID:6560
- C:\Windows\System\CjbCFxf.exe
  C:\Windows\System\CjbCFxf.exe
  2⤵
  PID:6572
- C:\Windows\System\ERAnzdC.exe
  C:\Windows\System\ERAnzdC.exe
  2⤵
  PID:6716
- C:\Windows\System\tBOhVcf.exe
  C:\Windows\System\tBOhVcf.exe
  2⤵
  PID:6888
- C:\Windows\System\GZQsaFd.exe
  C:\Windows\System\GZQsaFd.exe
  2⤵
  PID:6932
- C:\Windows\System\QzoelAj.exe
  C:\Windows\System\QzoelAj.exe
  2⤵
  PID:7008
- C:\Windows\System\DMfZEgJ.exe
  C:\Windows\System\DMfZEgJ.exe
  2⤵
  PID:7024
- C:\Windows\System\neNkpxP.exe
  C:\Windows\System\neNkpxP.exe
  2⤵
  PID:6192
- C:\Windows\System\RLXExMU.exe
  C:\Windows\System\RLXExMU.exe
  2⤵
  PID:6980
- C:\Windows\System\qXsrrci.exe
  C:\Windows\System\qXsrrci.exe
  2⤵
  PID:6172
- C:\Windows\System\zjakpSa.exe
  C:\Windows\System\zjakpSa.exe
  2⤵
  PID:6332
- C:\Windows\System\ouxseDn.exe
  C:\Windows\System\ouxseDn.exe
  2⤵
  PID:5696
- C:\Windows\System\toNcXHU.exe
  C:\Windows\System\toNcXHU.exe
  2⤵
  PID:1376
- C:\Windows\System\hmLuqTb.exe
  C:\Windows\System\hmLuqTb.exe
  2⤵
  PID:6800
- C:\Windows\System\PrUzMby.exe
  C:\Windows\System\PrUzMby.exe
  2⤵
  PID:6748
- C:\Windows\System\DcvfNSQ.exe
  C:\Windows\System\DcvfNSQ.exe
  2⤵
  PID:6236
- C:\Windows\System\yHKFhrx.exe
  C:\Windows\System\yHKFhrx.exe
  2⤵
  PID:6784
- C:\Windows\System\ZeEXyKC.exe
  C:\Windows\System\ZeEXyKC.exe
  2⤵
  PID:6880
- C:\Windows\System\zXiZeDt.exe
  C:\Windows\System\zXiZeDt.exe
  2⤵
  PID:7152
- C:\Windows\System\hJvBaTW.exe
  C:\Windows\System\hJvBaTW.exe
  2⤵
  PID:6448
- C:\Windows\System\cToNFlR.exe
  C:\Windows\System\cToNFlR.exe
  2⤵
  PID:5740
- C:\Windows\System\pSeGgSQ.exe
  C:\Windows\System\pSeGgSQ.exe
  2⤵
  PID:6908
- C:\Windows\System\WkzhuUt.exe
  C:\Windows\System\WkzhuUt.exe
  2⤵
  PID:5404
- C:\Windows\System\zptehrU.exe
  C:\Windows\System\zptehrU.exe
  2⤵
  PID:6668
- C:\Windows\System\xJkZeEI.exe
  C:\Windows\System\xJkZeEI.exe
  2⤵
  PID:6900
- C:\Windows\System\giWTrma.exe
  C:\Windows\System\giWTrma.exe
  2⤵
  PID:7176
- C:\Windows\System\tRhOMaB.exe
  C:\Windows\System\tRhOMaB.exe
  2⤵
  PID:7192
- C:\Windows\System\BCMwbXp.exe
  C:\Windows\System\BCMwbXp.exe
  2⤵
  PID:7208
- C:\Windows\System\fEuurYC.exe
  C:\Windows\System\fEuurYC.exe
  2⤵
  PID:7224
- C:\Windows\System\dSBQeSO.exe
  C:\Windows\System\dSBQeSO.exe
  2⤵
  PID:7240
- C:\Windows\System\FNmuqOt.exe
  C:\Windows\System\FNmuqOt.exe
  2⤵
  PID:7256
- C:\Windows\System\liwoOLP.exe
  C:\Windows\System\liwoOLP.exe
  2⤵
  PID:7272
- C:\Windows\System\BKDWMcJ.exe
  C:\Windows\System\BKDWMcJ.exe
  2⤵
  PID:7288
- C:\Windows\System\xOLtkYf.exe
  C:\Windows\System\xOLtkYf.exe
  2⤵
  PID:7304
- C:\Windows\System\BlhDXuD.exe
  C:\Windows\System\BlhDXuD.exe
  2⤵
  PID:7320
- C:\Windows\System\Uwwakoi.exe
  C:\Windows\System\Uwwakoi.exe
  2⤵
  PID:7336
- C:\Windows\System\KttgsVh.exe
  C:\Windows\System\KttgsVh.exe
  2⤵
  PID:7352
- C:\Windows\System\CbMbZTT.exe
  C:\Windows\System\CbMbZTT.exe
  2⤵
  PID:7368
- C:\Windows\System\slvJtsi.exe
  C:\Windows\System\slvJtsi.exe
  2⤵
  PID:7384
- C:\Windows\System\vwFPrhU.exe
  C:\Windows\System\vwFPrhU.exe
  2⤵
  PID:7400
- C:\Windows\System\QoMIyQb.exe
  C:\Windows\System\QoMIyQb.exe
  2⤵
  PID:7416
- C:\Windows\System\MWGzIQh.exe
  C:\Windows\System\MWGzIQh.exe
  2⤵
  PID:7432
- C:\Windows\System\njHupfd.exe
  C:\Windows\System\njHupfd.exe
  2⤵
  PID:7448
- C:\Windows\System\blxldKF.exe
  C:\Windows\System\blxldKF.exe
  2⤵
  PID:7464
- C:\Windows\System\JSLqIeN.exe
  C:\Windows\System\JSLqIeN.exe
  2⤵
  PID:7480
- C:\Windows\System\exogepj.exe
  C:\Windows\System\exogepj.exe
  2⤵
  PID:7496
- C:\Windows\System\GqjmgGS.exe
  C:\Windows\System\GqjmgGS.exe
  2⤵
  PID:7512
- C:\Windows\System\RHdDPee.exe
  C:\Windows\System\RHdDPee.exe
  2⤵
  PID:7572
- C:\Windows\System\pCzbsLW.exe
  C:\Windows\System\pCzbsLW.exe
  2⤵
  PID:7588
- C:\Windows\System\cWgvYwI.exe
  C:\Windows\System\cWgvYwI.exe
  2⤵
  PID:7604
- C:\Windows\System\kcmdUEm.exe
  C:\Windows\System\kcmdUEm.exe
  2⤵
  PID:7620
- C:\Windows\System\AeIvkkU.exe
  C:\Windows\System\AeIvkkU.exe
  2⤵
  PID:7636
- C:\Windows\System\lfWqqGM.exe
  C:\Windows\System\lfWqqGM.exe
  2⤵
  PID:7652
- C:\Windows\System\lHWXsQO.exe
  C:\Windows\System\lHWXsQO.exe
  2⤵
  PID:7672
- C:\Windows\System\gHjzoAa.exe
  C:\Windows\System\gHjzoAa.exe
  2⤵
  PID:7688
- C:\Windows\System\hTYhjFs.exe
  C:\Windows\System\hTYhjFs.exe
  2⤵
  PID:7704
- C:\Windows\System\fNRGKVE.exe
  C:\Windows\System\fNRGKVE.exe
  2⤵
  PID:7720
- C:\Windows\System\IZfIGMq.exe
  C:\Windows\System\IZfIGMq.exe
  2⤵
  PID:7736
- C:\Windows\System\bjjRcDz.exe
  C:\Windows\System\bjjRcDz.exe
  2⤵
  PID:7752
- C:\Windows\System\kCHFTeA.exe
  C:\Windows\System\kCHFTeA.exe
  2⤵
  PID:7768
- C:\Windows\System\oteodYf.exe
  C:\Windows\System\oteodYf.exe
  2⤵
  PID:7784
- C:\Windows\System\zoPsPyg.exe
  C:\Windows\System\zoPsPyg.exe
  2⤵
  PID:7800
- C:\Windows\System\AktKIXi.exe
  C:\Windows\System\AktKIXi.exe
  2⤵
  PID:7816
- C:\Windows\System\tpjRODt.exe
  C:\Windows\System\tpjRODt.exe
  2⤵
  PID:7832
- C:\Windows\System\EaCXGDf.exe
  C:\Windows\System\EaCXGDf.exe
  2⤵
  PID:7848
- C:\Windows\System\IyCSeYs.exe
  C:\Windows\System\IyCSeYs.exe
  2⤵
  PID:7864
- C:\Windows\System\ehZUIUc.exe
  C:\Windows\System\ehZUIUc.exe
  2⤵
  PID:7880
- C:\Windows\System\uLWDbcz.exe
  C:\Windows\System\uLWDbcz.exe
  2⤵
  PID:7896
- C:\Windows\System\xEDAnjl.exe
  C:\Windows\System\xEDAnjl.exe
  2⤵
  PID:7912
- C:\Windows\System\sSJuemX.exe
  C:\Windows\System\sSJuemX.exe
  2⤵
  PID:7928
- C:\Windows\System\amCnmNQ.exe
  C:\Windows\System\amCnmNQ.exe
  2⤵
  PID:7944
- C:\Windows\System\bYyItaP.exe
  C:\Windows\System\bYyItaP.exe
  2⤵
  PID:7960
- C:\Windows\System\ibESgYr.exe
  C:\Windows\System\ibESgYr.exe
  2⤵
  PID:7976
- C:\Windows\System\fCYRqlT.exe
  C:\Windows\System\fCYRqlT.exe
  2⤵
  PID:7992
- C:\Windows\System\nQTLDJK.exe
  C:\Windows\System\nQTLDJK.exe
  2⤵
  PID:8008
- C:\Windows\System\JxnFcIp.exe
  C:\Windows\System\JxnFcIp.exe
  2⤵
  PID:8024
- C:\Windows\System\aatbJCC.exe
  C:\Windows\System\aatbJCC.exe
  2⤵
  PID:8040
- C:\Windows\System\ThnzxQo.exe
  C:\Windows\System\ThnzxQo.exe
  2⤵
  PID:8056
- C:\Windows\System\JKfLpOR.exe
  C:\Windows\System\JKfLpOR.exe
  2⤵
  PID:8072
- C:\Windows\System\JZlwiEq.exe
  C:\Windows\System\JZlwiEq.exe
  2⤵
  PID:8088
- C:\Windows\System\fhoREoq.exe
  C:\Windows\System\fhoREoq.exe
  2⤵
  PID:8104
- C:\Windows\System\WLTlwIP.exe
  C:\Windows\System\WLTlwIP.exe
  2⤵
  PID:8120
- C:\Windows\System\OMCAqVO.exe
  C:\Windows\System\OMCAqVO.exe
  2⤵
  PID:8136
- C:\Windows\System\ewDacCj.exe
  C:\Windows\System\ewDacCj.exe
  2⤵
  PID:8152
- C:\Windows\System\eXPpXko.exe
  C:\Windows\System\eXPpXko.exe
  2⤵
  PID:8168
- C:\Windows\System\lZxrzlF.exe
  C:\Windows\System\lZxrzlF.exe
  2⤵
  PID:8184
- C:\Windows\System\ioMhISL.exe
  C:\Windows\System\ioMhISL.exe
  2⤵
  PID:6348
- C:\Windows\System\QolURSy.exe
  C:\Windows\System\QolURSy.exe
  2⤵
  PID:6088
- C:\Windows\System\oMmzCdO.exe
  C:\Windows\System\oMmzCdO.exe
  2⤵
  PID:7200
- C:\Windows\System\FDkRbav.exe
  C:\Windows\System\FDkRbav.exe
  2⤵
  PID:7264
- C:\Windows\System\blptuYL.exe
  C:\Windows\System\blptuYL.exe
  2⤵
  PID:5632
- C:\Windows\System\CuQTgJM.exe
  C:\Windows\System\CuQTgJM.exe
  2⤵
  PID:7216
- C:\Windows\System\OShXBsl.exe
  C:\Windows\System\OShXBsl.exe
  2⤵
  PID:7392
- C:\Windows\System\EydYEll.exe
  C:\Windows\System\EydYEll.exe
  2⤵
  PID:7280
- C:\Windows\System\LOziFcU.exe
  C:\Windows\System\LOziFcU.exe
  2⤵
  PID:6268
- C:\Windows\System\fuwhPpy.exe
  C:\Windows\System\fuwhPpy.exe
  2⤵
  PID:7312
- C:\Windows\System\ozFiDkF.exe
  C:\Windows\System\ozFiDkF.exe
  2⤵
  PID:7428
- C:\Windows\System\aisAVpw.exe
  C:\Windows\System\aisAVpw.exe
  2⤵
  PID:7472
- C:\Windows\System\iprIAQP.exe
  C:\Windows\System\iprIAQP.exe
  2⤵
  PID:7440
- C:\Windows\System\AjkEiXa.exe
  C:\Windows\System\AjkEiXa.exe
  2⤵
  PID:7508
- C:\Windows\System\oczwFbF.exe
  C:\Windows\System\oczwFbF.exe
  2⤵
  PID:7532
- C:\Windows\System\AxHRZCm.exe
  C:\Windows\System\AxHRZCm.exe
  2⤵
  PID:7568
- C:\Windows\System\xwCKWKh.exe
  C:\Windows\System\xwCKWKh.exe
  2⤵
  PID:7648
- C:\Windows\System\YhbvECF.exe
  C:\Windows\System\YhbvECF.exe
  2⤵
  PID:7716
- C:\Windows\System\sCZiVyz.exe
  C:\Windows\System\sCZiVyz.exe
  2⤵
  PID:7728
- C:\Windows\System\RjTtVcs.exe
  C:\Windows\System\RjTtVcs.exe
  2⤵
  PID:7664
- C:\Windows\System\IvuHxGI.exe
  C:\Windows\System\IvuHxGI.exe
  2⤵
  PID:7808
- C:\Windows\System\ZXVEyDT.exe
  C:\Windows\System\ZXVEyDT.exe
  2⤵
  PID:7840
- C:\Windows\System\CrLavZp.exe
  C:\Windows\System\CrLavZp.exe
  2⤵
  PID:7872
- C:\Windows\System\oNdECNS.exe
  C:\Windows\System\oNdECNS.exe
  2⤵
  PID:7856
- C:\Windows\System\pHXPnMP.exe
  C:\Windows\System\pHXPnMP.exe
  2⤵
  PID:7888
- C:\Windows\System\GoJbQqg.exe
  C:\Windows\System\GoJbQqg.exe
  2⤵
  PID:7940
- C:\Windows\System\QvqFdYK.exe
  C:\Windows\System\QvqFdYK.exe
  2⤵
  PID:8000
- C:\Windows\System\HiOoRKp.exe
  C:\Windows\System\HiOoRKp.exe
  2⤵
  PID:8064
- C:\Windows\System\WKrkxUc.exe
  C:\Windows\System\WKrkxUc.exe
  2⤵
  PID:7956
- C:\Windows\System\EivYyFC.exe
  C:\Windows\System\EivYyFC.exe
  2⤵
  PID:8096
- C:\Windows\System\hLkAQOn.exe
  C:\Windows\System\hLkAQOn.exe
  2⤵
  PID:8080
- C:\Windows\System\mhjLuVO.exe
  C:\Windows\System\mhjLuVO.exe
  2⤵
  PID:8116
- C:\Windows\System\jPiiqjw.exe
  C:\Windows\System\jPiiqjw.exe
  2⤵
  PID:8144
- C:\Windows\System\foFDNKo.exe
  C:\Windows\System\foFDNKo.exe
  2⤵
  PID:7296
- C:\Windows\System\KqeALkn.exe
  C:\Windows\System\KqeALkn.exe
  2⤵
  PID:8180
- C:\Windows\System\ZwWqsLF.exe
  C:\Windows\System\ZwWqsLF.exe
  2⤵
  PID:5892
- C:\Windows\System\SyROpdf.exe
  C:\Windows\System\SyROpdf.exe
  2⤵
  PID:7232
- C:\Windows\System\KadpWcu.exe
  C:\Windows\System\KadpWcu.exe
  2⤵
  PID:7344
- C:\Windows\System\bfaSsPZ.exe
  C:\Windows\System\bfaSsPZ.exe
  2⤵
  PID:7412
- C:\Windows\System\COyfSTc.exe
  C:\Windows\System\COyfSTc.exe
  2⤵
  PID:7408
- C:\Windows\System\akHfJYn.exe
  C:\Windows\System\akHfJYn.exe
  2⤵
  PID:7528
- C:\Windows\System\liHxxKU.exe
  C:\Windows\System\liHxxKU.exe
  2⤵
  PID:7552
- C:\Windows\System\xdGNErW.exe
  C:\Windows\System\xdGNErW.exe
  2⤵
  PID:7580
- C:\Windows\System\MuirPaf.exe
  C:\Windows\System\MuirPaf.exe
  2⤵
  PID:7628
- C:\Windows\System\LWvFmgZ.exe
  C:\Windows\System\LWvFmgZ.exe
  2⤵
  PID:7644
- C:\Windows\System\dfmJCVs.exe
  C:\Windows\System\dfmJCVs.exe
  2⤵
  PID:7780
- C:\Windows\System\OHMfYyx.exe
  C:\Windows\System\OHMfYyx.exe
  2⤵
  PID:7844
- C:\Windows\System\TnKBtOR.exe
  C:\Windows\System\TnKBtOR.exe
  2⤵
  PID:7792
- C:\Windows\System\BusCbwr.exe
  C:\Windows\System\BusCbwr.exe
  2⤵
  PID:7908
- C:\Windows\System\AjBKMHL.exe
  C:\Windows\System\AjBKMHL.exe
  2⤵
  PID:8048
- C:\Windows\System\hZUnERn.exe
  C:\Windows\System\hZUnERn.exe
  2⤵
  PID:6704
- C:\Windows\System\iNGQZJd.exe
  C:\Windows\System\iNGQZJd.exe
  2⤵
  PID:7248
- C:\Windows\System\CsQCHFr.exe
  C:\Windows\System\CsQCHFr.exe
  2⤵
  PID:8112
- C:\Windows\System\WfBNTta.exe
  C:\Windows\System\WfBNTta.exe
  2⤵
  PID:7936
- C:\Windows\System\cWCAuUL.exe
  C:\Windows\System\cWCAuUL.exe
  2⤵
  PID:7424
- C:\Windows\System\tCEXdmU.exe
  C:\Windows\System\tCEXdmU.exe
  2⤵
  PID:7504
- C:\Windows\System\YJoGRfM.exe
  C:\Windows\System\YJoGRfM.exe
  2⤵
  PID:7560
- C:\Windows\System\kDFbfZM.exe
  C:\Windows\System\kDFbfZM.exe
  2⤵
  PID:7744
- C:\Windows\System\UhuNAtS.exe
  C:\Windows\System\UhuNAtS.exe
  2⤵
  PID:7612
- C:\Windows\System\gULtlHw.exe
  C:\Windows\System\gULtlHw.exe
  2⤵
  PID:7760
- C:\Windows\System\UsHsQyg.exe
  C:\Windows\System\UsHsQyg.exe
  2⤵
  PID:8160
- C:\Windows\System\WiSHiZO.exe
  C:\Windows\System\WiSHiZO.exe
  2⤵
  PID:8020
- C:\Windows\System\JLJFUxf.exe
  C:\Windows\System\JLJFUxf.exe
  2⤵
  PID:7988
- C:\Windows\System\kbgNAGk.exe
  C:\Windows\System\kbgNAGk.exe
  2⤵
  PID:7824
- C:\Windows\System\soaXqDl.exe
  C:\Windows\System\soaXqDl.exe
  2⤵
  PID:6588
- C:\Windows\System\jLwvAjz.exe
  C:\Windows\System\jLwvAjz.exe
  2⤵
  PID:7028
- C:\Windows\System\KSrRQia.exe
  C:\Windows\System\KSrRQia.exe
  2⤵
  PID:8036
- C:\Windows\System\KwwbPow.exe
  C:\Windows\System\KwwbPow.exe
  2⤵
  PID:7548
- C:\Windows\System\AfWzmvP.exe
  C:\Windows\System\AfWzmvP.exe
  2⤵
  PID:7488
- C:\Windows\System\GdkFFwF.exe
  C:\Windows\System\GdkFFwF.exe
  2⤵
  PID:8208
- C:\Windows\System\BCCRWOF.exe
  C:\Windows\System\BCCRWOF.exe
  2⤵
  PID:8224
- C:\Windows\System\jBIvslq.exe
  C:\Windows\System\jBIvslq.exe
  2⤵
  PID:8240
- C:\Windows\System\yYZUbQo.exe
  C:\Windows\System\yYZUbQo.exe
  2⤵
  PID:8256
- C:\Windows\System\TTfIqxy.exe
  C:\Windows\System\TTfIqxy.exe
  2⤵
  PID:8272
- C:\Windows\System\SiPOMVk.exe
  C:\Windows\System\SiPOMVk.exe
  2⤵
  PID:8288
- C:\Windows\System\oPnccIf.exe
  C:\Windows\System\oPnccIf.exe
  2⤵
  PID:8304
- C:\Windows\System\DcZYqJY.exe
  C:\Windows\System\DcZYqJY.exe
  2⤵
  PID:8324
- C:\Windows\System\XNxuKGd.exe
  C:\Windows\System\XNxuKGd.exe
  2⤵
  PID:8340
- C:\Windows\System\PkfRFkh.exe
  C:\Windows\System\PkfRFkh.exe
  2⤵
  PID:8356
- C:\Windows\System\VxieGmg.exe
  C:\Windows\System\VxieGmg.exe
  2⤵
  PID:8372
- C:\Windows\System\rXzYvqr.exe
  C:\Windows\System\rXzYvqr.exe
  2⤵
  PID:8404
- C:\Windows\System\efXmlVv.exe
  C:\Windows\System\efXmlVv.exe
  2⤵
  PID:8424
- C:\Windows\System\flleimY.exe
  C:\Windows\System\flleimY.exe
  2⤵
  PID:8440
- C:\Windows\System\sUOaNLo.exe
  C:\Windows\System\sUOaNLo.exe
  2⤵
  PID:8456
- C:\Windows\System\deJUPRE.exe
  C:\Windows\System\deJUPRE.exe
  2⤵
  PID:8476
- C:\Windows\System\jtJWfpW.exe
  C:\Windows\System\jtJWfpW.exe
  2⤵
  PID:8768
- C:\Windows\System\llSQSyl.exe
  C:\Windows\System\llSQSyl.exe
  2⤵
  PID:8784
- C:\Windows\System\SrewvRC.exe
  C:\Windows\System\SrewvRC.exe
  2⤵
  PID:8804
- C:\Windows\System\Fttbwpc.exe
  C:\Windows\System\Fttbwpc.exe
  2⤵
  PID:8820
- C:\Windows\System\nekMpom.exe
  C:\Windows\System\nekMpom.exe
  2⤵
  PID:8836
- C:\Windows\System\ebWOcal.exe
  C:\Windows\System\ebWOcal.exe
  2⤵
  PID:8852
- C:\Windows\System\IgSmWnz.exe
  C:\Windows\System\IgSmWnz.exe
  2⤵
  PID:8868
- C:\Windows\System\wHcffED.exe
  C:\Windows\System\wHcffED.exe
  2⤵
  PID:8884
- C:\Windows\System\whqsRir.exe
  C:\Windows\System\whqsRir.exe
  2⤵
  PID:8900
- C:\Windows\System\HwxUtNq.exe
  C:\Windows\System\HwxUtNq.exe
  2⤵
  PID:8916
- C:\Windows\System\LGwSZyE.exe
  C:\Windows\System\LGwSZyE.exe
  2⤵
  PID:8936
- C:\Windows\System\EIAjLRm.exe
  C:\Windows\System\EIAjLRm.exe
  2⤵
  PID:8956
- C:\Windows\System\miBrKCg.exe
  C:\Windows\System\miBrKCg.exe
  2⤵
  PID:8976
- C:\Windows\System\EtPyFPo.exe
  C:\Windows\System\EtPyFPo.exe
  2⤵
  PID:9004
- C:\Windows\System\Mkzhihk.exe
  C:\Windows\System\Mkzhihk.exe
  2⤵
  PID:9020
- C:\Windows\System\dvUCccq.exe
  C:\Windows\System\dvUCccq.exe
  2⤵
  PID:9040
- C:\Windows\System\gkICCLK.exe
  C:\Windows\System\gkICCLK.exe
  2⤵
  PID:9060
- C:\Windows\System\ToMBPRG.exe
  C:\Windows\System\ToMBPRG.exe
  2⤵
  PID:9164
- C:\Windows\System\QSayKyS.exe
  C:\Windows\System\QSayKyS.exe
  2⤵
  PID:9180
- C:\Windows\System\ZYeWkXd.exe
  C:\Windows\System\ZYeWkXd.exe
  2⤵
  PID:7952
- C:\Windows\System\PLoLkcf.exe
  C:\Windows\System\PLoLkcf.exe
  2⤵
  PID:7332
- C:\Windows\System\ZYKOPYD.exe
  C:\Windows\System\ZYKOPYD.exe
  2⤵
  PID:8204
- C:\Windows\System\NfQaift.exe
  C:\Windows\System\NfQaift.exe
  2⤵
  PID:8312
- C:\Windows\System\zfdNVAU.exe
  C:\Windows\System\zfdNVAU.exe
  2⤵
  PID:8320
- C:\Windows\System\YdHDCPQ.exe
  C:\Windows\System\YdHDCPQ.exe
  2⤵
  PID:8352
- C:\Windows\System\UTLzIlJ.exe
  C:\Windows\System\UTLzIlJ.exe
  2⤵
  PID:8388
- C:\Windows\System\BfnQouW.exe
  C:\Windows\System\BfnQouW.exe
  2⤵
  PID:8420
- C:\Windows\System\mFMLvtG.exe
  C:\Windows\System\mFMLvtG.exe
  2⤵
  PID:8436
- C:\Windows\System\SviVvCT.exe
  C:\Windows\System\SviVvCT.exe
  2⤵
  PID:8468
- C:\Windows\System\saAkiHe.exe
  C:\Windows\System\saAkiHe.exe
  2⤵
  PID:8492
- C:\Windows\System\FFfJSnu.exe
  C:\Windows\System\FFfJSnu.exe
  2⤵
  PID:8508
- C:\Windows\System\lmxwDNP.exe
  C:\Windows\System\lmxwDNP.exe
  2⤵
  PID:8524
- C:\Windows\System\JcPlzXc.exe
  C:\Windows\System\JcPlzXc.exe
  2⤵
  PID:8540
- C:\Windows\System\YGuGDRJ.exe
  C:\Windows\System\YGuGDRJ.exe
  2⤵
  PID:8556
- C:\Windows\System\GaVDTYB.exe
  C:\Windows\System\GaVDTYB.exe
  2⤵
  PID:8580
- C:\Windows\System\pZLCUgj.exe
  C:\Windows\System\pZLCUgj.exe
  2⤵
  PID:8596
- C:\Windows\System\MdzXqIe.exe
  C:\Windows\System\MdzXqIe.exe
  2⤵
  PID:8604
- C:\Windows\System\fEMZtDH.exe
  C:\Windows\System\fEMZtDH.exe
  2⤵
  PID:8628
- C:\Windows\System\vWejJGl.exe
  C:\Windows\System\vWejJGl.exe
  2⤵
  PID:8636
- C:\Windows\System\FSgfChB.exe
  C:\Windows\System\FSgfChB.exe
  2⤵
  PID:8672
- C:\Windows\System\aWdDmpT.exe
  C:\Windows\System\aWdDmpT.exe
  2⤵
  PID:8664
- C:\Windows\System\hUpkJmy.exe
  C:\Windows\System\hUpkJmy.exe
  2⤵
  PID:8684
- C:\Windows\System\qjPWKTJ.exe
  C:\Windows\System\qjPWKTJ.exe
  2⤵
  PID:8700
- C:\Windows\System\TNzOrqD.exe
  C:\Windows\System\TNzOrqD.exe
  2⤵
  PID:8716
- C:\Windows\System\WvIrCqp.exe
  C:\Windows\System\WvIrCqp.exe
  2⤵
  PID:8732
- C:\Windows\System\IjIjeUk.exe
  C:\Windows\System\IjIjeUk.exe
  2⤵
  PID:8776
- C:\Windows\System\FeWcnJm.exe
  C:\Windows\System\FeWcnJm.exe
  2⤵
  PID:8844
- C:\Windows\System\dgIWnaZ.exe
  C:\Windows\System\dgIWnaZ.exe
  2⤵
  PID:8948
- C:\Windows\System\NTkfMDc.exe
  C:\Windows\System\NTkfMDc.exe
  2⤵
  PID:8748
- C:\Windows\System\yKBhiTh.exe
  C:\Windows\System\yKBhiTh.exe
  2⤵
  PID:8800
- C:\Windows\System\YewNsVh.exe
  C:\Windows\System\YewNsVh.exe
  2⤵
  PID:8984
- C:\Windows\System\dyyooav.exe
  C:\Windows\System\dyyooav.exe
  2⤵
  PID:8924
- C:\Windows\System\zAbJopx.exe
  C:\Windows\System\zAbJopx.exe
  2⤵
  PID:8968
- C:\Windows\System\wgRNFCw.exe
  C:\Windows\System\wgRNFCw.exe
  2⤵
  PID:8996
- C:\Windows\System\jAFWPmB.exe
  C:\Windows\System\jAFWPmB.exe
  2⤵
  PID:9048
- C:\Windows\System\HGuMWUV.exe
  C:\Windows\System\HGuMWUV.exe
  2⤵
  PID:9072
- C:\Windows\System\eZJjTSF.exe
  C:\Windows\System\eZJjTSF.exe
  2⤵
  PID:9076
- C:\Windows\System\rNlswwl.exe
  C:\Windows\System\rNlswwl.exe
  2⤵
  PID:9092
- C:\Windows\System\skunsWz.exe
  C:\Windows\System\skunsWz.exe
  2⤵
  PID:9104
- C:\Windows\System\ywuIeJv.exe
  C:\Windows\System\ywuIeJv.exe
  2⤵
  PID:9124
- C:\Windows\System\sthGVPt.exe
  C:\Windows\System\sthGVPt.exe
  2⤵
  PID:9140
- C:\Windows\System\JMZfohc.exe
  C:\Windows\System\JMZfohc.exe
  2⤵
  PID:9156
- C:\Windows\System\MTIDIpL.exe
  C:\Windows\System\MTIDIpL.exe
  2⤵
  PID:9188
- C:\Windows\System\ZDUAyGL.exe
  C:\Windows\System\ZDUAyGL.exe
  2⤵
  PID:9204
- C:\Windows\System\QVJwCHs.exe
  C:\Windows\System\QVJwCHs.exe
  2⤵
  PID:7380
- C:\Windows\System\Rfmfsut.exe
  C:\Windows\System\Rfmfsut.exe
  2⤵
  PID:8216
- C:\Windows\System\yFjHRxh.exe
  C:\Windows\System\yFjHRxh.exe
  2⤵
  PID:8296
- C:\Windows\System\yjpspgW.exe
  C:\Windows\System\yjpspgW.exe
  2⤵
  PID:8380
- C:\Windows\System\yYqQIZg.exe
  C:\Windows\System\yYqQIZg.exe
  2⤵
  PID:8488
- C:\Windows\System\bVicooq.exe
  C:\Windows\System\bVicooq.exe
  2⤵
  PID:8280
- C:\Windows\System\ZGULVjM.exe
  C:\Windows\System\ZGULVjM.exe
  2⤵
  PID:8520
- C:\Windows\System\VnkOmoR.exe
  C:\Windows\System\VnkOmoR.exe
  2⤵
  PID:8336
- C:\Windows\System\nnSgBUF.exe
  C:\Windows\System\nnSgBUF.exe
  2⤵
  PID:8552
- C:\Windows\System\NpkJlXF.exe
  C:\Windows\System\NpkJlXF.exe
  2⤵
  PID:8612
- C:\Windows\System\aeBgeLU.exe
  C:\Windows\System\aeBgeLU.exe
  2⤵
  PID:8648
- C:\Windows\System\NtgVQiQ.exe
  C:\Windows\System\NtgVQiQ.exe
  2⤵
  PID:8708
- C:\Windows\System\CYXcyxg.exe
  C:\Windows\System\CYXcyxg.exe
  2⤵
  PID:8536
- C:\Windows\System\FYVckHP.exe
  C:\Windows\System\FYVckHP.exe
  2⤵
  PID:8740
- C:\Windows\System\DYiDCZs.exe
  C:\Windows\System\DYiDCZs.exe
  2⤵
  PID:8744
- C:\Windows\System\Dwkebbk.exe
  C:\Windows\System\Dwkebbk.exe
  2⤵
  PID:8728
- C:\Windows\System\ptmVXyx.exe
  C:\Windows\System\ptmVXyx.exe
  2⤵
  PID:8944
- C:\Windows\System\UbFdUGw.exe
  C:\Windows\System\UbFdUGw.exe
  2⤵
  PID:8892
- C:\Windows\System\apCNrMq.exe
  C:\Windows\System\apCNrMq.exe
  2⤵
  PID:8988
- C:\Windows\System\qkgOqpG.exe
  C:\Windows\System\qkgOqpG.exe
  2⤵
  PID:9084
- C:\Windows\System\CkQamce.exe
  C:\Windows\System\CkQamce.exe
  2⤵
  PID:9148
- C:\Windows\System\fZiHjuW.exe
  C:\Windows\System\fZiHjuW.exe
  2⤵
  PID:6796
- C:\Windows\System\CkZncmP.exe
  C:\Windows\System\CkZncmP.exe
  2⤵
  PID:8316
- C:\Windows\System\HquJVJN.exe
  C:\Windows\System\HquJVJN.exe
  2⤵
  PID:8500
- C:\Windows\System\JzPkYZt.exe
  C:\Windows\System\JzPkYZt.exe
  2⤵
  PID:9012
- C:\Windows\System\OgQMCKV.exe
  C:\Windows\System\OgQMCKV.exe
  2⤵
  PID:8348
- C:\Windows\System\uFFLJOh.exe
  C:\Windows\System\uFFLJOh.exe
  2⤵
  PID:9136
- C:\Windows\System\PaHyapZ.exe
  C:\Windows\System\PaHyapZ.exe
  2⤵
  PID:8516
- C:\Windows\System\BgRGhvv.exe
  C:\Windows\System\BgRGhvv.exe
  2⤵
  PID:7616
- C:\Windows\System\eqIUsNL.exe
  C:\Windows\System\eqIUsNL.exe
  2⤵
  PID:8432
- C:\Windows\System\eitsrAk.exe
  C:\Windows\System\eitsrAk.exe
  2⤵
  PID:8588
- C:\Windows\System\qfmepZM.exe
  C:\Windows\System\qfmepZM.exe
  2⤵
  PID:8696
- C:\Windows\System\DIeNsaJ.exe
  C:\Windows\System\DIeNsaJ.exe
  2⤵
  PID:9056
- C:\Windows\System\sSgiOgn.exe
  C:\Windows\System\sSgiOgn.exe
  2⤵
  PID:8656
- C:\Windows\System\SwaeVLN.exe
  C:\Windows\System\SwaeVLN.exe
  2⤵
  PID:8752
- C:\Windows\System\SuQczuX.exe
  C:\Windows\System\SuQczuX.exe
  2⤵
  PID:8448
- C:\Windows\System\dcjhxid.exe
  C:\Windows\System\dcjhxid.exe
  2⤵
  PID:8908
- C:\Windows\System\qqiwnpH.exe
  C:\Windows\System\qqiwnpH.exe
  2⤵
  PID:8264
- C:\Windows\System\HwgOsDn.exe
  C:\Windows\System\HwgOsDn.exe
  2⤵
  PID:8400
- C:\Windows\System\uHpqmvT.exe
  C:\Windows\System\uHpqmvT.exe
  2⤵
  PID:8712
- C:\Windows\System\QRhDiRX.exe
  C:\Windows\System\QRhDiRX.exe
  2⤵
  PID:8600
- C:\Windows\System\zqGwckF.exe
  C:\Windows\System\zqGwckF.exe
  2⤵
  PID:8860
- C:\Windows\System\nCSetNg.exe
  C:\Windows\System\nCSetNg.exe
  2⤵
  PID:8676
- C:\Windows\System\fPCUbct.exe
  C:\Windows\System\fPCUbct.exe
  2⤵
  PID:9232
- C:\Windows\System\vkLWIcL.exe
  C:\Windows\System\vkLWIcL.exe
  2⤵
  PID:9248
- C:\Windows\System\tfNYKOl.exe
  C:\Windows\System\tfNYKOl.exe
  2⤵
  PID:9264
- C:\Windows\System\pBqmBpj.exe
  C:\Windows\System\pBqmBpj.exe
  2⤵
  PID:9280
- C:\Windows\System\QLdTZpS.exe
  C:\Windows\System\QLdTZpS.exe
  2⤵
  PID:9296
- C:\Windows\System\TncFzqd.exe
  C:\Windows\System\TncFzqd.exe
  2⤵
  PID:9312
- C:\Windows\System\zLPGtDR.exe
  C:\Windows\System\zLPGtDR.exe
  2⤵
  PID:9328
- C:\Windows\System\dyggeOW.exe
  C:\Windows\System\dyggeOW.exe
  2⤵
  PID:9344
- C:\Windows\System\mtRtkYa.exe
  C:\Windows\System\mtRtkYa.exe
  2⤵
  PID:9360
- C:\Windows\System\IqCvuyU.exe
  C:\Windows\System\IqCvuyU.exe
  2⤵
  PID:9376
- C:\Windows\System\cwPUIDS.exe
  C:\Windows\System\cwPUIDS.exe
  2⤵
  PID:9392
- C:\Windows\System\HBRaZTL.exe
  C:\Windows\System\HBRaZTL.exe
  2⤵
  PID:9408
- C:\Windows\System\CLArfXH.exe
  C:\Windows\System\CLArfXH.exe
  2⤵
  PID:9424
- C:\Windows\System\LfqUJLo.exe
  C:\Windows\System\LfqUJLo.exe
  2⤵
  PID:9440
- C:\Windows\System\RGFIOTt.exe
  C:\Windows\System\RGFIOTt.exe
  2⤵
  PID:9456
- C:\Windows\System\nCtfbjl.exe
  C:\Windows\System\nCtfbjl.exe
  2⤵
  PID:9472
- C:\Windows\System\OsHqdaO.exe
  C:\Windows\System\OsHqdaO.exe
  2⤵
  PID:9488
- C:\Windows\System\wgWgtIf.exe
  C:\Windows\System\wgWgtIf.exe
  2⤵
  PID:9504
- C:\Windows\System\XRizXmy.exe
  C:\Windows\System\XRizXmy.exe
  2⤵
  PID:9520
- C:\Windows\System\iaMDeZX.exe
  C:\Windows\System\iaMDeZX.exe
  2⤵
  PID:9536
- C:\Windows\System\kvjQDfU.exe
  C:\Windows\System\kvjQDfU.exe
  2⤵
  PID:9552
- C:\Windows\System\skZhimY.exe
  C:\Windows\System\skZhimY.exe
  2⤵
  PID:9568
- C:\Windows\System\hehYhoN.exe
  C:\Windows\System\hehYhoN.exe
  2⤵
  PID:9584
- C:\Windows\System\GgsukOh.exe
  C:\Windows\System\GgsukOh.exe
  2⤵
  PID:9600
- C:\Windows\System\gegWNiv.exe
  C:\Windows\System\gegWNiv.exe
  2⤵
  PID:9616
- C:\Windows\System\uHVoakb.exe
  C:\Windows\System\uHVoakb.exe
  2⤵
  PID:9632
- C:\Windows\System\bTDFlXQ.exe
  C:\Windows\System\bTDFlXQ.exe
  2⤵
  PID:9648
- C:\Windows\System\olsFshp.exe
  C:\Windows\System\olsFshp.exe
  2⤵
  PID:9664
- C:\Windows\System\wVphmGY.exe
  C:\Windows\System\wVphmGY.exe
  2⤵
  PID:9680
- C:\Windows\System\lnCMqfd.exe
  C:\Windows\System\lnCMqfd.exe
  2⤵
  PID:9696
- C:\Windows\System\xoVcYrM.exe
  C:\Windows\System\xoVcYrM.exe
  2⤵
  PID:9712
- C:\Windows\System\xdTfzNS.exe
  C:\Windows\System\xdTfzNS.exe
  2⤵
  PID:9728
- C:\Windows\System\ArpxLxO.exe
  C:\Windows\System\ArpxLxO.exe
  2⤵
  PID:9744
- C:\Windows\System\cHyMpHE.exe
  C:\Windows\System\cHyMpHE.exe
  2⤵
  PID:9760
- C:\Windows\System\SgSNYUl.exe
  C:\Windows\System\SgSNYUl.exe
  2⤵
  PID:9776
- C:\Windows\System\HJwyGon.exe
  C:\Windows\System\HJwyGon.exe
  2⤵
  PID:9792
- C:\Windows\System\ASvCvoT.exe
  C:\Windows\System\ASvCvoT.exe
  2⤵
  PID:9808
- C:\Windows\System\QkQpdul.exe
  C:\Windows\System\QkQpdul.exe
  2⤵
  PID:9824
- C:\Windows\System\SaPIlhm.exe
  C:\Windows\System\SaPIlhm.exe
  2⤵
  PID:9840
- C:\Windows\System\aWGfJQR.exe
  C:\Windows\System\aWGfJQR.exe
  2⤵
  PID:9856
- C:\Windows\System\HBcQgGb.exe
  C:\Windows\System\HBcQgGb.exe
  2⤵
  PID:9872
- C:\Windows\System\auacXPy.exe
  C:\Windows\System\auacXPy.exe
  2⤵
  PID:9888
- C:\Windows\System\VRXQEcQ.exe
  C:\Windows\System\VRXQEcQ.exe
  2⤵
  PID:9904
- C:\Windows\System\ROUJqMZ.exe
  C:\Windows\System\ROUJqMZ.exe
  2⤵
  PID:9920
- C:\Windows\System\loswDel.exe
  C:\Windows\System\loswDel.exe
  2⤵
  PID:9936
- C:\Windows\System\CDgUyAN.exe
  C:\Windows\System\CDgUyAN.exe
  2⤵
  PID:9952
- C:\Windows\System\rJwbMeF.exe
  C:\Windows\System\rJwbMeF.exe
  2⤵
  PID:9968
- C:\Windows\System\jOOxPkB.exe
  C:\Windows\System\jOOxPkB.exe
  2⤵
  PID:9984
- C:\Windows\System\mvjzUIw.exe
  C:\Windows\System\mvjzUIw.exe
  2⤵
  PID:10004
- C:\Windows\System\yJvoizD.exe
  C:\Windows\System\yJvoizD.exe
  2⤵
  PID:10024
- C:\Windows\System\vsJAIwC.exe
  C:\Windows\System\vsJAIwC.exe
  2⤵
  PID:10048
- C:\Windows\System\MrOYyMJ.exe
  C:\Windows\System\MrOYyMJ.exe
  2⤵
  PID:10128
- C:\Windows\System\zewoQyI.exe
  C:\Windows\System\zewoQyI.exe
  2⤵
  PID:10144
- C:\Windows\System\VqsNrhU.exe
  C:\Windows\System\VqsNrhU.exe
  2⤵
  PID:10168
- C:\Windows\System\tDsctad.exe
  C:\Windows\System\tDsctad.exe
  2⤵
  PID:10184
- C:\Windows\System\VpflVvX.exe
  C:\Windows\System\VpflVvX.exe
  2⤵
  PID:10200
- C:\Windows\System\NTIjMUG.exe
  C:\Windows\System\NTIjMUG.exe
  2⤵
  PID:10216
- C:\Windows\System\vrCRLXv.exe
  C:\Windows\System\vrCRLXv.exe
  2⤵
  PID:10232
- C:\Windows\System\rjUqrhN.exe
  C:\Windows\System\rjUqrhN.exe
  2⤵
  PID:8576
- C:\Windows\System\AIvTGbY.exe
  C:\Windows\System\AIvTGbY.exe
  2⤵
  PID:9288
- C:\Windows\System\NWOgyLU.exe
  C:\Windows\System\NWOgyLU.exe
  2⤵
  PID:9452
- C:\Windows\System\GGEPgCc.exe
  C:\Windows\System\GGEPgCc.exe
  2⤵
  PID:9272
- C:\Windows\System\tFyRzmA.exe
  C:\Windows\System\tFyRzmA.exe
  2⤵
  PID:9336
- C:\Windows\System\AgiGNbp.exe
  C:\Windows\System\AgiGNbp.exe
  2⤵
  PID:9576
- C:\Windows\System\AdvqqEn.exe
  C:\Windows\System\AdvqqEn.exe
  2⤵
  PID:9340
- C:\Windows\System\VBMKgVS.exe
  C:\Windows\System\VBMKgVS.exe
  2⤵
  PID:9432
- C:\Windows\System\ptzpLxn.exe
  C:\Windows\System\ptzpLxn.exe
  2⤵
  PID:9640
- C:\Windows\System\qREmejZ.exe
  C:\Windows\System\qREmejZ.exe
  2⤵
  PID:9672
- C:\Windows\System\fdCZsKs.exe
  C:\Windows\System\fdCZsKs.exe
  2⤵
  PID:9704
- C:\Windows\System\MtRuEXw.exe
  C:\Windows\System\MtRuEXw.exe
  2⤵
  PID:9736
- C:\Windows\System\moehkOR.exe
  C:\Windows\System\moehkOR.exe
  2⤵
  PID:9688
- C:\Windows\System\NBZhVkq.exe
  C:\Windows\System\NBZhVkq.exe
  2⤵
  PID:9800
- C:\Windows\System\YJeMvoO.exe
  C:\Windows\System\YJeMvoO.exe
  2⤵
  PID:9864
- C:\Windows\System\TtbDbzw.exe
  C:\Windows\System\TtbDbzw.exe
  2⤵
  PID:9848
- C:\Windows\System\DnFPnyz.exe
  C:\Windows\System\DnFPnyz.exe
  2⤵
  PID:9932
- C:\Windows\System\ZzyHGiS.exe
  C:\Windows\System\ZzyHGiS.exe
  2⤵
  PID:9912
- C:\Windows\System\ASvDZnb.exe
  C:\Windows\System\ASvDZnb.exe
  2⤵
  PID:9880
- C:\Windows\System\HJqQYoh.exe
  C:\Windows\System\HJqQYoh.exe
  2⤵
  PID:8880
- C:\Windows\System\bjQCwgF.exe
  C:\Windows\System\bjQCwgF.exe
  2⤵
  PID:10016
- C:\Windows\System\VukLPFh.exe
  C:\Windows\System\VukLPFh.exe
  2⤵
  PID:10044
- C:\Windows\System\rmbpDqh.exe
  C:\Windows\System\rmbpDqh.exe
  2⤵
  PID:10080
- C:\Windows\System\lPYPLcy.exe
  C:\Windows\System\lPYPLcy.exe
  2⤵
  PID:10100
- C:\Windows\System\zAuHvrG.exe
  C:\Windows\System\zAuHvrG.exe
  2⤵
  PID:10140
- C:\Windows\System\cBJYbkj.exe
  C:\Windows\System\cBJYbkj.exe
  2⤵
  PID:10208
- C:\Windows\System\jSTDYga.exe
  C:\Windows\System\jSTDYga.exe
  2⤵
  PID:9120
- C:\Windows\System\PdKHXSO.exe
  C:\Windows\System\PdKHXSO.exe
  2⤵
  PID:10192
- C:\Windows\System\buuCNNN.exe
  C:\Windows\System\buuCNNN.exe
  2⤵
  PID:10224
- C:\Windows\System\sfFhIsQ.exe
  C:\Windows\System\sfFhIsQ.exe
  2⤵
  PID:9016
- C:\Windows\System\gyoeIXM.exe
  C:\Windows\System\gyoeIXM.exe
  2⤵
  PID:8452
- C:\Windows\System\zDqXMeB.exe
  C:\Windows\System\zDqXMeB.exe
  2⤵
  PID:9324
- C:\Windows\System\baXhDCp.exe
  C:\Windows\System\baXhDCp.exe
  2⤵
  PID:9384
- C:\Windows\System\nArcqqT.exe
  C:\Windows\System\nArcqqT.exe
  2⤵
  PID:9388
- C:\Windows\System\zuXjDkW.exe
  C:\Windows\System\zuXjDkW.exe
  2⤵
  PID:9368
- C:\Windows\System\imNvlGM.exe
  C:\Windows\System\imNvlGM.exe
  2⤵
  PID:9400
- C:\Windows\System\yaogeNf.exe
  C:\Windows\System\yaogeNf.exe
  2⤵
  PID:9612
- C:\Windows\System\HxYFKoa.exe
  C:\Windows\System\HxYFKoa.exe
  2⤵
  PID:9560
- C:\Windows\System\rJFTKeo.exe
  C:\Windows\System\rJFTKeo.exe
  2⤵
  PID:9544
- C:\Windows\System\GqQYffs.exe
  C:\Windows\System\GqQYffs.exe
  2⤵
  PID:9548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BAARJDV.exe

Filesize
1.6MB

MD5
0e22db8741f6a52a4be0400640d959a9

SHA1
966e22b845637aa331383e83c66f4a20cb2b14bb

SHA256
8e918d00d814417659958c21baf1b53a847de02224a9cdd514015c0028c0670d

SHA512
b534ecc56c1ead2bb27103c7c830f12b2b3649eb9581edefdaaec8972e404662e9fe7fd1c7b600291935927b29a90bf0f67ef17d594ecb7f93724230cf7864d9

Download Submit
C:\Windows\system\DpuFtnJ.exe

Filesize
1.6MB

MD5
3a43a32476ec9c39c97a556d167ec6d3

SHA1
14b224c2a2b7507f4c714b7331200e7d295acafe

SHA256
ad088c0c7e3e151cb8c498ae8af93b159e2b21f0eb6fb7da423fe535c74a9fb6

SHA512
b687bd14d199bc54a334abf474f271e30bbcc83f21af54a767f0603f205b8b517c72daa3632bc3a14000d0e4e2d791aa899697b67c2f35ec24afb49574c1eb1e

Download Submit
C:\Windows\system\EDLJuRi.exe

Filesize
1.6MB

MD5
b7be03caff7eb3a55f3294b88c3adc15

SHA1
8cc4e57c4887eed399bdaebdc4c6913befd3192b

SHA256
db74d1401af3f208076f126e2023cedd6141acf71bd6931eb60e34318b95f5a1

SHA512
7c716d85bf951edb7f81a4fa95edfa241300580f92393291e10ea7a218403bd287891d8f29bcb7a6af653b7b959cf1b06f2114bfc5f7a1ab6ec4409db6a59959

Download Submit
C:\Windows\system\EFdhsXb.exe

Filesize
1.6MB

MD5
7fafbcbebc3c28986270191875c37662

SHA1
4a7534e500debf093a9d2005dc73abb0dda402ca

SHA256
8374930973f3a9cbe77b04fdc4e13f0973a62b7076387187755075f0b7224074

SHA512
faf412cb857f18c26bc5d4c5267ab9a5026e9090f77dc7c33cff131ea41b1695d2120b47f52b4dec595c0287dd2a52a2416fc6b7ae2e3fb7c37bc302f9419206

Download Submit
C:\Windows\system\GFHHekR.exe

Filesize
1.6MB

MD5
7dc696d3ca96181eedea6e20718a9c79

SHA1
c8cd81b77bb0c12c0a9925ce3f183dcb08c5dee6

SHA256
98ff6babd0abf8899c615a85da34bb2c4ec57f378c7579defa5ae15e9fff298a

SHA512
1b91f680b2857559170436ef885eab6de6c83a5ee5ad688124fb44ca0babe68697ffba2acb58f2d30d758850847f3141c9d18a3c4ddbb2c5ad1e832af1d68c85

Download Submit
C:\Windows\system\GcLnpzX.exe

Filesize
1.6MB

MD5
25fbe7851b29bbe75b736de9487fe50d

SHA1
dd360557ddf432869f5656c2a8a936406c75513b

SHA256
2109680267358678aac6f1c45e2cf5b25d18693e13a8194ff0df9e39a61ae1d5

SHA512
0065195961daab55ab23be1d0f516c5af2d775801c730b59094fef24d145a4c3a44c045fb14d39c2daa413f06adfa7e2ed82538320caad8a93362c159bbdd713

Download Submit
C:\Windows\system\HcTScbT.exe

Filesize
1.6MB

MD5
92200641c4955507b5f627a1d143afe1

SHA1
dd65d37c83c62de8c37fcefeb76ef4c95c1bbf3b

SHA256
74b1e01b51eac4be36c11b296b96f1258b86ae5518656157e86dabca8512c165

SHA512
a5baf5defe1c80121eb36c037c8c602bca04bbc20351ec494e359ce08d2483960aa5c651eff1e4da004933354d81b347a4a2085b3a1a9cbbdabf25e31c214481

Download Submit
C:\Windows\system\HriZaBE.exe

Filesize
1.6MB

MD5
689eb2afb7dde13870147cf83b1971f5

SHA1
c2ddc0c8739b327954b03a79d64e234c673a31f6

SHA256
cd03bd9670cb7a4ce8ae1d684c5df60ff5c0ff99e0331889fb102b3a053c6fd6

SHA512
274efbbc6e960a872a353f90f45ac13df3f7086e33e891dad8d7ee0674b4535a752f5fb2477757b07f2abeadecd5bb47e9e79f1f9709824baf28d6c852097c65

Download Submit
C:\Windows\system\OnUPWaa.exe

Filesize
1.6MB

MD5
8f5fb06a896fe6a39ef3bd03c736fbb2

SHA1
4e7674de5e4b28948393f94ee6878a987ef772b9

SHA256
341847369525b7f3108bbf95988ce98648091377a190b6fdd5d1e56f4cc904b4

SHA512
c1ecd0197452aae901fcd6bdaa5675dce9b8ed5371876b08b21e26440b8c4054f245b3f32cefe381f1731340d568d7260150ebe42097f923d81eb8c13a5fcd58

Download Submit
C:\Windows\system\QPXaAxr.exe

Filesize
1.6MB

MD5
6c791745fd2cf6eb82699f8f309c8f88

SHA1
78bd984c5a2393f40defac57a40156a4ad9ec31c

SHA256
2d764d34c77772016e47337c6c90cbcd5802051eae505d4e4f90136cf16d9279

SHA512
223801de38fb81aaa021bed2a6d7fffef04d08a005c2a15db600987d6194e0a349ba5a1c1a650fd2ed937cbd40dfc209d7aa064d853328e6228ed17e0dda1c9a

Download Submit
C:\Windows\system\RlWCvnz.exe

Filesize
1.6MB

MD5
a2591891481ca7fe3c91e59f83066576

SHA1
97ae33b2f888230ee9559cf3a77646ca74c02c5c

SHA256
c3feb350e9240f2a7ee9b3f6d3ba7091fc3b6d7c5b43517a6615b1048e461c23

SHA512
5098003293144964bb2745c0f79ba11ded6f3abb681b5fea4f82a200209a9384e4747bdaa2cfe1a871b78831b3d080c38f88a23a9032c2481c842eb6de088f8e

Download Submit
C:\Windows\system\UcDFkhp.exe

Filesize
1.6MB

MD5
61bdd132d728ee52bdbb2e18b2bd2046

SHA1
d4d1333b2c11bf3a7bb2bcbf796addf7f4169b9a

SHA256
2aa48050208877d5d35f866f7a4c1deb6e1b6a0009229993a944ef8e27ee1338

SHA512
5a1b1325f4758b4c71670e0d0b4465ea78c4b2d6696803b4ddd7298e4ff78b07c018377cb9bb4e9135ea10f9a4773c441d29145213b005f8ce371a51d3c5afe8

Download Submit
C:\Windows\system\VCzqrgO.exe

Filesize
1.6MB

MD5
e5d456d51131aae3171d0ad4724cf938

SHA1
b3f7b5b2977001435c5ebe183929e6b3c9ab1515

SHA256
35ea6b568db7277b081bc387b729505789ca5a5609a7e1569f341518a9e0cd83

SHA512
e5b67b697a8ce3adcf5bc51adfe0a1f5f250cad8ce16bc33046bfe0f9604fe8cdc88924047220902e228896fb16eee4d8e1278d4a54ae470ba3c9437065b59bd

Download Submit
C:\Windows\system\VWWoWxN.exe

Filesize
1.6MB

MD5
40e0e02a0b58d93543b641743fa5bc22

SHA1
1f67bcc41f51cac83505b04e3270e741f6c9123d

SHA256
61a0942f9568584e6a150ff25ee00908feffa6670d383198bfcda215192002f0

SHA512
bf64c78dfde204e40101b189123021663f27966fd665ddfc9fa390d4df086dff6c3a5adb04d29d0847c0e98a92be3ce50b670c283292e09656ecd0a8585cd449

Download Submit
C:\Windows\system\ViEjgWq.exe

Filesize
1.6MB

MD5
0d9dc4fbb05c108d8932f5b118129800

SHA1
d650d331dc1df58d5e9a120097ea6309ddf47b05

SHA256
be2dfa82e9e82beb9527ddb283d8dac9fabef17b79e4026b308e2d01058c869a

SHA512
c12f5f8982210a81b5452d55f662c36b63495630b8f56760b4d98cf72c96ad1c31348c382d91618e3e5ed8c2ac80ec049bcfb6f0e6bea201297624e5b289acfd

Download Submit
C:\Windows\system\WQAnvPz.exe

Filesize
1.6MB

MD5
f20cc5075809cc34f0e46e462bb00e24

SHA1
72c91f0a0bf83dde03e6ec0ba4b0892ada551c74

SHA256
3d601ace588d8e36655d60f45f7372d4c93e3c2739e771b357a57b57392990b2

SHA512
1f03bfe7963d9535d9ad8fed62c614963ad542cb8e5fed2de23f0dfc0fede5952f82d5f05a2e3a99e6e4f0eeec9e71833407ebc52f909bbbbb02ceca85163920

Download Submit
C:\Windows\system\WiCDuET.exe

Filesize
1.6MB

MD5
c99e02470b232bef5662312838d80f63

SHA1
0cb17c50837efcab8cf1eab9b8ede5b5285a1b90

SHA256
9efbfcce61bfdc357425db35a7ac62371b6c9c1120cd1f0ac27f54a31f0a5164

SHA512
9b3974a9418920f4db242ff65f145da73a16a1d6a0d83a3ef08fe59679a0faa9ed5ef63cc74648f3b8ea58ff8eee1395d111ff10785a354b4a57d7fc1a661763

Download Submit
C:\Windows\system\XKFYcGx.exe

Filesize
1.6MB

MD5
e368f27861fbaea796b4c27864714b2b

SHA1
7a5c581cf918b6e3459c98a969b9bd5eb56fd640

SHA256
0d3f1a3fe52311627331e4734b6806bed86eac5f3ad03a9cc915ef85cc2fe518

SHA512
433f5e39f1d623be1beef5c72c580ee67c6539e0957abb199087f295bea29caae73d18bfdb9839f20b67db314ec6927e216acd53e86b43e95de4c71d729a778e

Download Submit
C:\Windows\system\aTDuSGA.exe

Filesize
1.6MB

MD5
d945e4ad9bebb05916191596592f8b23

SHA1
bdaa857e529375a7a6a8f4fac2ee52de64afd51b

SHA256
a25d553a4cec5d9a1db71dff3269fd9998a8ab8d35565d271b888507c7c23a11

SHA512
f3218f7da1e0c4c23a832503e47702039afa4f43eb0322e441493291c2d4f22d1c2b1f28def9cf6fd0737e77b60a91909cc947561aee2fe72b9dbf95429b89bf

Download Submit
C:\Windows\system\aVtraWp.exe

Filesize
1.6MB

MD5
6dc8cd79f7e80c17af708136cf054343

SHA1
65a6adb5d548493760095d7fea8a26580f897a18

SHA256
f5477d5382e8096d943af50c159a61b6c05031723f4b897e5b59abbdaba795c2

SHA512
df6378f43a61b02e5d892d7782c5f2cbee7710b209195b76a842eea39eaaece72c3d2d98cdf816530bf0a438935e6c3df4e285599884cb4007061b117512ab85

Download Submit
C:\Windows\system\hXxKITT.exe

Filesize
1.6MB

MD5
2e9e745f1edcceabe55899086a1c498b

SHA1
494365d015956b1690ba11c264b78edb5fe417c4

SHA256
f5093eb01bcf4b554d02fa1e3a06d1d6ac9d53ab48a597ad65fc1b81e88e9fc6

SHA512
bd32602a2eae4f4869e0bb2379e6ca47e519c365db22ca33059229c1916fe18aed800d4874d8ba742e78fa8996deaf7050c8279c22fa2b293c1aab9f19cf9705

Download Submit
C:\Windows\system\jCKHslh.exe

Filesize
1.6MB

MD5
be3b872a6e497c8a27d1190898cbd2ff

SHA1
33ec2473c8629118350671c8eaf94ceec72c03e9

SHA256
177c16a6e1245af63ffa8b8852cf3880bdc19160d964bdebb93b5925d6105123

SHA512
2c4781999f287fb154964f712cec70d0e9090eac82ea48f6d05f2e452640eed274816ffbb8e3698784d85f0dd9b1f699d8ca1bfba6b6e7e46eb8066a9731decf

Download Submit
C:\Windows\system\lsphIiO.exe

Filesize
1.6MB

MD5
d5e0675d5b0d4ba52f7d82a1aabc6c69

SHA1
97647d4d6cb02f1f54ab5cc4d2be192474f0caf1

SHA256
00bfc325a1be39fc3b99343322a26587fd275b7ca7d15985fcdf5672f5140e48

SHA512
76a72bfbbf4cb0007d3416de18b47f661eb56caa8b83eb20c2ab5e8f08caccd8597d2fd84a4dea6fcf51b9e3618e3dd6f94352d5255244dd273548fba4c06018

Download Submit
C:\Windows\system\oPKMbPt.exe

Filesize
1.6MB

MD5
f2c8366ddb9d0b67a88796678c043e66

SHA1
b23358eb26e720d768dfb35ea9c51bc79883fc26

SHA256
0adfb9e2f4b2f9969ac59733c4c6669d208baa3d87c1a241ce99c5be806d203f

SHA512
df9c752f21c57174ea6e9d4e7d8fb1f76c36e48330fd4a48cf94e5b41acfbb20b1ab56e3f97ecbf654c00af8ab7e0aac8ee70b6701446e41b7497663fb25ec08

Download Submit
C:\Windows\system\pztRUCq.exe

Filesize
1.6MB

MD5
e950f40d3ac44b9a2b413d57c972c9a3

SHA1
daf699362fa34195d749ede1c84c912100ab3012

SHA256
f38cd66a99b6553d724e9467562405c00f3e7cc2cbfac6e0d6c28da371e964db

SHA512
ba159dc083308717d58c474dc434f71d3836944d9b73271f650f398353dd83c1e09d631f98abbcbae9057c598fa1914bbe48ec43cd58f03d90d78d6698ed5229

Download Submit
C:\Windows\system\spegvwJ.exe

Filesize
1.6MB

MD5
2ddbc968cd63c527928f786d9e3f685e

SHA1
395b7e520531b91f6e2dd7a4e9e4435cb887412a

SHA256
afa7237d5507651a1c92d1a3f9ff4b889dd27328a949925ec5b73cf250c7667b

SHA512
9d426df8cc2389c580d9517b5fe5505b4a5a70326fa61b77dc2a2e81e45dd1f2aa4b51afbec1c2113821cbb6effd09ca4afdcc100f99aeaf9a084c52a65dfa77

Download Submit
C:\Windows\system\uXOLlKk.exe

Filesize
1.6MB

MD5
842bb9a6a70bf37a928274194f704929

SHA1
5b63eff3fb549e1a2ae31b2b1754b055af842d4a

SHA256
f8eb78004139b6a19ab37a683ba74cbaa7df09bd5b8b9f8065710f6902bd5e4d

SHA512
2ba536a60cb8fcf499cd56c3e57f6f730fed53ea45a5938afa03633a237a18b16aa8ce59b94f2d1e49d461a8e5ab7172bd9a5fffc74ac1ee9f902dd4c7c393d8

Download Submit
C:\Windows\system\uwzFcDf.exe

Filesize
1.6MB

MD5
5afaa0b31a91288e68d846a0579e2723

SHA1
ffe9b7aa7f20db26ef8589bb1903bfa2a0d78cb5

SHA256
9b1463548cbc84902f16906a352f3026df2982c16b264ab84ed8d10f7cb026c2

SHA512
063806c102ce3666bc63e179f39532d59d9e301fe81edabc7b69a02860838d98cddc1d6a9577a731ccd23abe9b69fce8c0116d338470d83c34abe55fbd3fed54

Download Submit
C:\Windows\system\wbGJPiq.exe

Filesize
1.6MB

MD5
9904fcb2f6590e019946fd0c08d5f962

SHA1
f2afce3cdab9765b19b2b267b3cbc48fca654084

SHA256
430d1aa57cade1c76af8456255305f24a55eff0ea1131fe42b6d3de0189a65b5

SHA512
87f0581fc2fa6a061134ed7ec2670f41c7d6ed0fe7d037324217f333e5cb1b5ad3d217e668d78a2ad5b2fbdc90e3957284d3496e1ec8c4fb9ee8d37a81efb815

Download Submit
\Windows\system\kqONFNa.exe

Filesize
1.6MB

MD5
3128c65a687dc89449fab283c7d8e3c4

SHA1
3405639bd9ccca7906eb6aebb26bbd546810c786

SHA256
c4a2119c9ddf809c55bc27fe3bcd8ad2095a0ba0dd5d4ff4f98a42fdc023385e

SHA512
de73ac6595f2146a54c0fb57e30b7b8bcc25217012aee2e8c13b9a72f1ebd62fb9f0796f5245de89af7bd49dc824f0973a9158f9ba790a68cea549c1fead64f7

Download Submit
\Windows\system\naPKLvL.exe

Filesize
1.6MB

MD5
d17fafb68915ef16f7cd8f0f662c3f2d

SHA1
32ae54fd675f1de8fd8e7a2827211b24993e2de6

SHA256
cc013844fb469bacc8a6ae2ca3580dcf5ba8e0a29bc41a3e5e1df7495442533c

SHA512
39c191c96832bb96a5ac56bcb479d66a10a56c993c42213f247c3c9576b8073eee2c34b3ca30585b1174669750d5e1fd3a923ade4504a142ce5480db57e0da48

Download Submit
\Windows\system\zDFJtfe.exe

Filesize
1.6MB

MD5
2611ce4f4929c7a9ea748fcaf0b28a97

SHA1
b49147736df510525015108e344a2d6b8ad9f006

SHA256
f1d0d5457a8874ff0d5ca0041c84e3a2bdf04f2cf82a58960a8e8e7c1aae248f

SHA512
f6efe176f0b64f01190641bb644343c30111f4332e2cdd5b90eaf60e08ecfbd3ed3200b8dc080e30a99d37772267cfb1a2e5939e17967941ccf09124eec12e0a

Download Submit
memory/2444-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download