xmrig | e5c9d7ecdd2c71b692845614c41cad947465115b6cd0e231232c00490cd7304e

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_f3aeda2131f029de821d41ca75abf260.exe
Size

3.2MB
MD5

f3aeda2131f029de821d41ca75abf260
SHA1

a799b97a300bf53f778295c23b60123943d22911
SHA256

e5c9d7ecdd2c71b692845614c41cad947465115b6cd0e231232c00490cd7304e
SHA512

8501e7ff5f396b74d29f5e319c95fee7cb990dbfa8fd386867e0b05f93f5147f5a2e624186bae1f4b77b6d362234c1eb913157640cb5dd7bb8f9b1935d980ee1
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFk0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/2188-1-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	xmrig
behavioral1/files/0x000c000000013413-3.dat	xmrig
behavioral1/memory/2524-9-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	xmrig
behavioral1/files/0x0035000000013a3a-10.dat	xmrig
behavioral1/files/0x0009000000013acb-12.dat	xmrig
behavioral1/memory/2628-20-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/files/0x000e0000000054ab-38.dat	xmrig
behavioral1/memory/2708-40-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2692-43-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2660-44-0x000000013F150000-0x000000013F546000-memory.dmp	xmrig
behavioral1/files/0x0007000000014186-45.dat	xmrig
behavioral1/memory/1784-55-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/files/0x0006000000014826-65.dat	xmrig
behavioral1/files/0x000800000001471a-57.dat	xmrig
behavioral1/memory/2936-89-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/files/0x0006000000014bbc-94.dat	xmrig
behavioral1/memory/2188-102-0x0000000003390000-0x0000000003786000-memory.dmp	xmrig
behavioral1/files/0x0006000000014b4c-103.dat	xmrig
behavioral1/files/0x0035000000013a46-101.dat	xmrig
behavioral1/files/0x0006000000014fa2-119.dat	xmrig
behavioral1/memory/2988-97-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/files/0x000600000001487f-77.dat	xmrig
behavioral1/files/0x0006000000015c9e-148.dat	xmrig
behavioral1/files/0x0006000000015cd9-160.dat	xmrig
behavioral1/files/0x0006000000014e71-115.dat	xmrig
behavioral1/memory/2460-1052-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5f-185.dat	xmrig
behavioral1/files/0x0006000000015d4e-178.dat	xmrig
behavioral1/files/0x0006000000015d20-171.dat	xmrig
behavioral1/files/0x0006000000015ce3-164.dat	xmrig
behavioral1/files/0x0006000000015ccd-157.dat	xmrig
behavioral1/files/0x0006000000015cae-150.dat	xmrig
behavioral1/files/0x0006000000015c87-143.dat	xmrig
behavioral1/files/0x0006000000015677-136.dat	xmrig
behavioral1/files/0x0006000000015653-129.dat	xmrig
behavioral1/files/0x000600000001535e-122.dat	xmrig
behavioral1/files/0x0006000000015d6b-190.dat	xmrig
behavioral1/files/0x0006000000015d56-183.dat	xmrig
behavioral1/files/0x0006000000015d42-176.dat	xmrig
behavioral1/files/0x0006000000015cff-169.dat	xmrig
behavioral1/files/0x0006000000015cb6-155.dat	xmrig
behavioral1/files/0x0006000000015684-141.dat	xmrig
behavioral1/files/0x000600000001565d-134.dat	xmrig
behavioral1/files/0x000600000001564f-127.dat	xmrig
behavioral1/memory/2188-76-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/memory/2188-74-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	xmrig
behavioral1/memory/2832-73-0x000000013FF00000-0x00000001402F6000-memory.dmp	xmrig
behavioral1/memory/2976-70-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/files/0x0006000000014b18-88.dat	xmrig
behavioral1/files/0x0006000000014a9a-81.dat	xmrig
behavioral1/memory/2460-54-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/files/0x0007000000014207-53.dat	xmrig
behavioral1/files/0x0008000000014175-36.dat	xmrig
behavioral1/memory/2988-8540-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2628-8825-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2460-8977-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/memory/2988-9018-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2524	bgXhpvR.exe
2628	xPNewHm.exe
2708	kqSzTBB.exe
2692	fwYtcQN.exe
2660	SEtaEJJ.exe
2460	cfVaUKf.exe
1784	QvlsMtU.exe
2976	PiPgLyH.exe
2832	VFJlnhE.exe
2936	FQivnHg.exe
2988	akCgWxV.exe
2780	MqRIsaZ.exe
2292	iCNOVJG.exe
2752	HlHcXku.exe
1808	UEQTgGj.exe
1856	TqFFEsN.exe
1380	ChwRmZz.exe
2092	HZZqneL.exe
2072	iYIMRCx.exe
2076	SWQoYjs.exe
2512	YZVXXmd.exe
1140	vbMlvOe.exe
1792	yEhQDyD.exe
1072	nkcLhrC.exe
1588	WrQvBOm.exe
2116	bXTWtGp.exe
2888	CMKvssp.exe
1280	eCxUbwp.exe
332	RiWINrS.exe
320	ViAPEHk.exe
2252	tsyHzPe.exe
2244	gGRhKht.exe
1900	KNHIWzJ.exe
800	bJcaeel.exe
992	AHLnJah.exe
2132	aGnLLLn.exe
848	JQzghPH.exe
1508	TguRsGs.exe
1520	etMerRN.exe
2632	CalXOIf.exe
2596	diilVYT.exe
2472	WZTahVb.exe
3012	UQGNWxO.exe
1564	rNWCscd.exe
2656	XlOIuDE.exe
1176	WeVuPNo.exe
2204	uwHiEma.exe
932	gMQpNEP.exe
2108	SRBuTEG.exe
844	kwolOGi.exe
1644	fNCAxVA.exe
1012	kUdzeZj.exe
3048	JjBhfcb.exe
1236	UAxqkpl.exe
3100	cJErmJT.exe
3132	uwgPSTk.exe
3164	hHhwVif.exe
3196	NwfnoNH.exe
3228	kIGWwrQ.exe
3260	BETfQof.exe
3292	PWwFkqv.exe
3324	WlNhjQV.exe
3356	OJBeHXP.exe
3388	ntKkBGq.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-1-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	upx
behavioral1/files/0x000c000000013413-3.dat	upx
behavioral1/memory/2524-9-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	upx
behavioral1/files/0x0035000000013a3a-10.dat	upx
behavioral1/files/0x0009000000013acb-12.dat	upx
behavioral1/memory/2628-20-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-38.dat	upx
behavioral1/memory/2708-40-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/memory/2692-43-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2660-44-0x000000013F150000-0x000000013F546000-memory.dmp	upx
behavioral1/files/0x0007000000014186-45.dat	upx
behavioral1/memory/1784-55-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/files/0x0006000000014826-65.dat	upx
behavioral1/files/0x000800000001471a-57.dat	upx
behavioral1/memory/2936-89-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/files/0x0006000000014bbc-94.dat	upx
behavioral1/files/0x0006000000014b4c-103.dat	upx
behavioral1/files/0x0035000000013a46-101.dat	upx
behavioral1/files/0x0006000000014fa2-119.dat	upx
behavioral1/memory/2988-97-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/files/0x000600000001487f-77.dat	upx
behavioral1/files/0x0006000000015c9e-148.dat	upx
behavioral1/files/0x0006000000015cd9-160.dat	upx
behavioral1/files/0x0006000000014e71-115.dat	upx
behavioral1/memory/2460-1052-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/files/0x0006000000015d5f-185.dat	upx
behavioral1/files/0x0006000000015d4e-178.dat	upx
behavioral1/files/0x0006000000015d20-171.dat	upx
behavioral1/files/0x0006000000015ce3-164.dat	upx
behavioral1/files/0x0006000000015ccd-157.dat	upx
behavioral1/files/0x0006000000015cae-150.dat	upx
behavioral1/files/0x0006000000015c87-143.dat	upx
behavioral1/files/0x0006000000015677-136.dat	upx
behavioral1/files/0x0006000000015653-129.dat	upx
behavioral1/files/0x000600000001535e-122.dat	upx
behavioral1/files/0x0006000000015d6b-190.dat	upx
behavioral1/files/0x0006000000015d56-183.dat	upx
behavioral1/files/0x0006000000015d42-176.dat	upx
behavioral1/files/0x0006000000015cff-169.dat	upx
behavioral1/files/0x0006000000015cb6-155.dat	upx
behavioral1/files/0x0006000000015684-141.dat	upx
behavioral1/files/0x000600000001565d-134.dat	upx
behavioral1/files/0x000600000001564f-127.dat	upx
behavioral1/memory/2188-74-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	upx
behavioral1/memory/2832-73-0x000000013FF00000-0x00000001402F6000-memory.dmp	upx
behavioral1/memory/2976-70-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/files/0x0006000000014b18-88.dat	upx
behavioral1/files/0x0006000000014a9a-81.dat	upx
behavioral1/memory/2460-54-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/files/0x0007000000014207-53.dat	upx
behavioral1/files/0x0008000000014175-36.dat	upx
behavioral1/memory/2988-8540-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2460-8977-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/memory/2988-9018-0x000000013FE30000-0x0000000140226000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hCZWVWq.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\CoRwOjT.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\cHurlfw.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\ijHyxus.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\aaJsZWT.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\CgQdKFW.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\hvCahDG.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\RUbIaXO.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\VwJmJkh.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\XGPsPSC.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\uFqexbD.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\zmrffBM.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\KyAOFNO.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\GFRxtHM.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\AZegHeb.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\WPlCXHO.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\jQGFVgC.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\NMtmBZY.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\UgjZUAE.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\sDfnQYW.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\yDUoHuF.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\TnghpOM.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\eZkwLEU.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\erSAjRB.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\CZTfsyy.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\aRXzTid.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\ywVtOHT.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\JnXTatH.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\QXuALIN.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\nqOzfaJ.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\ZZXVDdj.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\MIWxJfN.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\pzaJSdo.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\kjSHhZI.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\HpGHNje.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\LRSSjcE.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\DpeDxXN.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\TimsQym.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\UYycOlm.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\icOptYi.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\lulqNuw.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\pTIBUVi.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\jZuRQhD.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\rpnjfyH.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\wspuCib.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\oShncCE.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\FksSyzS.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\AbbPksz.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\zwkWLoJ.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\UDvYzok.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\ZvapNTu.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\lWHaCMC.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\htlRFyG.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\artOApj.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\TJrZjea.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\MQLxhfp.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\bnXiIAZ.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\hBLJisN.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\Jvmatch.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\LvAmtiz.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\pfOIoEE.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\ckyAPnL.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\pOZEKfR.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
File created	C:\Windows\System\vPSTjvQ.exe	virussign.com_f3aeda2131f029de821d41ca75abf260.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
Token: SeLockMemoryPrivilege	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe
Token: SeDebugPrivilege	1728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1728	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	29
PID 2188 wrote to memory of 1728	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	29
PID 2188 wrote to memory of 1728	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	29
PID 2188 wrote to memory of 2524	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	30
PID 2188 wrote to memory of 2524	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	30
PID 2188 wrote to memory of 2524	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	30
PID 2188 wrote to memory of 2628	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	31
PID 2188 wrote to memory of 2628	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	31
PID 2188 wrote to memory of 2628	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	31
PID 2188 wrote to memory of 2708	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	32
PID 2188 wrote to memory of 2708	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	32
PID 2188 wrote to memory of 2708	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	32
PID 2188 wrote to memory of 2660	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	33
PID 2188 wrote to memory of 2660	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	33
PID 2188 wrote to memory of 2660	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	33
PID 2188 wrote to memory of 2692	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	34
PID 2188 wrote to memory of 2692	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	34
PID 2188 wrote to memory of 2692	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	34
PID 2188 wrote to memory of 2460	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	35
PID 2188 wrote to memory of 2460	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	35
PID 2188 wrote to memory of 2460	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	35
PID 2188 wrote to memory of 1784	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	36
PID 2188 wrote to memory of 1784	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	36
PID 2188 wrote to memory of 1784	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	36
PID 2188 wrote to memory of 2976	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	37
PID 2188 wrote to memory of 2976	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	37
PID 2188 wrote to memory of 2976	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	37
PID 2188 wrote to memory of 2832	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	38
PID 2188 wrote to memory of 2832	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	38
PID 2188 wrote to memory of 2832	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	38
PID 2188 wrote to memory of 2936	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	39
PID 2188 wrote to memory of 2936	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	39
PID 2188 wrote to memory of 2936	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	39
PID 2188 wrote to memory of 2988	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	40
PID 2188 wrote to memory of 2988	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	40
PID 2188 wrote to memory of 2988	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	40
PID 2188 wrote to memory of 2752	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	41
PID 2188 wrote to memory of 2752	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	41
PID 2188 wrote to memory of 2752	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	41
PID 2188 wrote to memory of 2780	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	42
PID 2188 wrote to memory of 2780	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	42
PID 2188 wrote to memory of 2780	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	42
PID 2188 wrote to memory of 1808	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	43
PID 2188 wrote to memory of 1808	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	43
PID 2188 wrote to memory of 1808	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	43
PID 2188 wrote to memory of 2292	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	44
PID 2188 wrote to memory of 2292	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	44
PID 2188 wrote to memory of 2292	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	44
PID 2188 wrote to memory of 1856	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	45
PID 2188 wrote to memory of 1856	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	45
PID 2188 wrote to memory of 1856	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	45
PID 2188 wrote to memory of 1380	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	46
PID 2188 wrote to memory of 1380	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	46
PID 2188 wrote to memory of 1380	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	46
PID 2188 wrote to memory of 2056	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	47
PID 2188 wrote to memory of 2056	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	47
PID 2188 wrote to memory of 2056	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	47
PID 2188 wrote to memory of 2092	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	48
PID 2188 wrote to memory of 2092	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	48
PID 2188 wrote to memory of 2092	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	48
PID 2188 wrote to memory of 1964	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	49
PID 2188 wrote to memory of 1964	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	49
PID 2188 wrote to memory of 1964	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	49
PID 2188 wrote to memory of 2072	2188	virussign.com_f3aeda2131f029de821d41ca75abf260.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_f3aeda2131f029de821d41ca75abf260.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_f3aeda2131f029de821d41ca75abf260.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\System\bgXhpvR.exe
  C:\Windows\System\bgXhpvR.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\xPNewHm.exe
  C:\Windows\System\xPNewHm.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\kqSzTBB.exe
  C:\Windows\System\kqSzTBB.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\SEtaEJJ.exe
  C:\Windows\System\SEtaEJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\fwYtcQN.exe
  C:\Windows\System\fwYtcQN.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\cfVaUKf.exe
  C:\Windows\System\cfVaUKf.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\QvlsMtU.exe
  C:\Windows\System\QvlsMtU.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\PiPgLyH.exe
  C:\Windows\System\PiPgLyH.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\VFJlnhE.exe
  C:\Windows\System\VFJlnhE.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\FQivnHg.exe
  C:\Windows\System\FQivnHg.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\akCgWxV.exe
  C:\Windows\System\akCgWxV.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\HlHcXku.exe
  C:\Windows\System\HlHcXku.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\MqRIsaZ.exe
  C:\Windows\System\MqRIsaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\UEQTgGj.exe
  C:\Windows\System\UEQTgGj.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\iCNOVJG.exe
  C:\Windows\System\iCNOVJG.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\TqFFEsN.exe
  C:\Windows\System\TqFFEsN.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ChwRmZz.exe
  C:\Windows\System\ChwRmZz.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\BChHysS.exe
  C:\Windows\System\BChHysS.exe
  2⤵
  PID:2056
- C:\Windows\System\HZZqneL.exe
  C:\Windows\System\HZZqneL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\uDhoGle.exe
  C:\Windows\System\uDhoGle.exe
  2⤵
  PID:1964
- C:\Windows\System\iYIMRCx.exe
  C:\Windows\System\iYIMRCx.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\WBZVgdZ.exe
  C:\Windows\System\WBZVgdZ.exe
  2⤵
  PID:2016
- C:\Windows\System\SWQoYjs.exe
  C:\Windows\System\SWQoYjs.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\OkVDBDy.exe
  C:\Windows\System\OkVDBDy.exe
  2⤵
  PID:1568
- C:\Windows\System\YZVXXmd.exe
  C:\Windows\System\YZVXXmd.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\uCUhVYD.exe
  C:\Windows\System\uCUhVYD.exe
  2⤵
  PID:688
- C:\Windows\System\vbMlvOe.exe
  C:\Windows\System\vbMlvOe.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\pWtuugu.exe
  C:\Windows\System\pWtuugu.exe
  2⤵
  PID:1412
- C:\Windows\System\yEhQDyD.exe
  C:\Windows\System\yEhQDyD.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\mcgGYfN.exe
  C:\Windows\System\mcgGYfN.exe
  2⤵
  PID:1892
- C:\Windows\System\nkcLhrC.exe
  C:\Windows\System\nkcLhrC.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\qFTCHFO.exe
  C:\Windows\System\qFTCHFO.exe
  2⤵
  PID:912
- C:\Windows\System\WrQvBOm.exe
  C:\Windows\System\WrQvBOm.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\WgdINpa.exe
  C:\Windows\System\WgdINpa.exe
  2⤵
  PID:1672
- C:\Windows\System\bXTWtGp.exe
  C:\Windows\System\bXTWtGp.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KvCJkMp.exe
  C:\Windows\System\KvCJkMp.exe
  2⤵
  PID:1696
- C:\Windows\System\CMKvssp.exe
  C:\Windows\System\CMKvssp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bgLzYwK.exe
  C:\Windows\System\bgLzYwK.exe
  2⤵
  PID:1936
- C:\Windows\System\eCxUbwp.exe
  C:\Windows\System\eCxUbwp.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\DCRQZrX.exe
  C:\Windows\System\DCRQZrX.exe
  2⤵
  PID:1804
- C:\Windows\System\RiWINrS.exe
  C:\Windows\System\RiWINrS.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\WUeQBRu.exe
  C:\Windows\System\WUeQBRu.exe
  2⤵
  PID:1208
- C:\Windows\System\ViAPEHk.exe
  C:\Windows\System\ViAPEHk.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\kWPCixg.exe
  C:\Windows\System\kWPCixg.exe
  2⤵
  PID:868
- C:\Windows\System\tsyHzPe.exe
  C:\Windows\System\tsyHzPe.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\paOvrIL.exe
  C:\Windows\System\paOvrIL.exe
  2⤵
  PID:2856
- C:\Windows\System\gGRhKht.exe
  C:\Windows\System\gGRhKht.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\PZRyOLd.exe
  C:\Windows\System\PZRyOLd.exe
  2⤵
  PID:772
- C:\Windows\System\KNHIWzJ.exe
  C:\Windows\System\KNHIWzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\JavRkJi.exe
  C:\Windows\System\JavRkJi.exe
  2⤵
  PID:1932
- C:\Windows\System\bJcaeel.exe
  C:\Windows\System\bJcaeel.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\JVGeyDI.exe
  C:\Windows\System\JVGeyDI.exe
  2⤵
  PID:3028
- C:\Windows\System\AHLnJah.exe
  C:\Windows\System\AHLnJah.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\XFNwbVZ.exe
  C:\Windows\System\XFNwbVZ.exe
  2⤵
  PID:2852
- C:\Windows\System\aGnLLLn.exe
  C:\Windows\System\aGnLLLn.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\hCMPvir.exe
  C:\Windows\System\hCMPvir.exe
  2⤵
  PID:1444
- C:\Windows\System\JQzghPH.exe
  C:\Windows\System\JQzghPH.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\aVdyqus.exe
  C:\Windows\System\aVdyqus.exe
  2⤵
  PID:2496
- C:\Windows\System\TguRsGs.exe
  C:\Windows\System\TguRsGs.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\OadqTYX.exe
  C:\Windows\System\OadqTYX.exe
  2⤵
  PID:2212
- C:\Windows\System\etMerRN.exe
  C:\Windows\System\etMerRN.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RGtuoxr.exe
  C:\Windows\System\RGtuoxr.exe
  2⤵
  PID:2324
- C:\Windows\System\CalXOIf.exe
  C:\Windows\System\CalXOIf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\VProyfi.exe
  C:\Windows\System\VProyfi.exe
  2⤵
  PID:2864
- C:\Windows\System\diilVYT.exe
  C:\Windows\System\diilVYT.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\aYxXQFQ.exe
  C:\Windows\System\aYxXQFQ.exe
  2⤵
  PID:2704
- C:\Windows\System\WZTahVb.exe
  C:\Windows\System\WZTahVb.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\zfqkbQp.exe
  C:\Windows\System\zfqkbQp.exe
  2⤵
  PID:2840
- C:\Windows\System\UQGNWxO.exe
  C:\Windows\System\UQGNWxO.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\sXiJXXd.exe
  C:\Windows\System\sXiJXXd.exe
  2⤵
  PID:1556
- C:\Windows\System\rNWCscd.exe
  C:\Windows\System\rNWCscd.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\BYkLTMb.exe
  C:\Windows\System\BYkLTMb.exe
  2⤵
  PID:1648
- C:\Windows\System\XlOIuDE.exe
  C:\Windows\System\XlOIuDE.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\oXIuKHH.exe
  C:\Windows\System\oXIuKHH.exe
  2⤵
  PID:2504
- C:\Windows\System\WeVuPNo.exe
  C:\Windows\System\WeVuPNo.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\YEjXIuL.exe
  C:\Windows\System\YEjXIuL.exe
  2⤵
  PID:1232
- C:\Windows\System\uwHiEma.exe
  C:\Windows\System\uwHiEma.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\tBWojoT.exe
  C:\Windows\System\tBWojoT.exe
  2⤵
  PID:2316
- C:\Windows\System\gMQpNEP.exe
  C:\Windows\System\gMQpNEP.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\TKidcJc.exe
  C:\Windows\System\TKidcJc.exe
  2⤵
  PID:2300
- C:\Windows\System\SRBuTEG.exe
  C:\Windows\System\SRBuTEG.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fBiOVpj.exe
  C:\Windows\System\fBiOVpj.exe
  2⤵
  PID:1064
- C:\Windows\System\kwolOGi.exe
  C:\Windows\System\kwolOGi.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\byWGIEA.exe
  C:\Windows\System\byWGIEA.exe
  2⤵
  PID:2180
- C:\Windows\System\fNCAxVA.exe
  C:\Windows\System\fNCAxVA.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\UvwVTBI.exe
  C:\Windows\System\UvwVTBI.exe
  2⤵
  PID:1680
- C:\Windows\System\kUdzeZj.exe
  C:\Windows\System\kUdzeZj.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\QtvUUAx.exe
  C:\Windows\System\QtvUUAx.exe
  2⤵
  PID:2540
- C:\Windows\System\JjBhfcb.exe
  C:\Windows\System\JjBhfcb.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\vxIbwUi.exe
  C:\Windows\System\vxIbwUi.exe
  2⤵
  PID:2992
- C:\Windows\System\UAxqkpl.exe
  C:\Windows\System\UAxqkpl.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\ZIDXZaZ.exe
  C:\Windows\System\ZIDXZaZ.exe
  2⤵
  PID:3084
- C:\Windows\System\cJErmJT.exe
  C:\Windows\System\cJErmJT.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\JjuFBhr.exe
  C:\Windows\System\JjuFBhr.exe
  2⤵
  PID:3116
- C:\Windows\System\uwgPSTk.exe
  C:\Windows\System\uwgPSTk.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\imDiKjr.exe
  C:\Windows\System\imDiKjr.exe
  2⤵
  PID:3148
- C:\Windows\System\hHhwVif.exe
  C:\Windows\System\hHhwVif.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\GoNWBPM.exe
  C:\Windows\System\GoNWBPM.exe
  2⤵
  PID:3180
- C:\Windows\System\NwfnoNH.exe
  C:\Windows\System\NwfnoNH.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\tsmcfRk.exe
  C:\Windows\System\tsmcfRk.exe
  2⤵
  PID:3212
- C:\Windows\System\kIGWwrQ.exe
  C:\Windows\System\kIGWwrQ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\yuWSyMg.exe
  C:\Windows\System\yuWSyMg.exe
  2⤵
  PID:3244
- C:\Windows\System\BETfQof.exe
  C:\Windows\System\BETfQof.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\rXBgcxb.exe
  C:\Windows\System\rXBgcxb.exe
  2⤵
  PID:3276
- C:\Windows\System\PWwFkqv.exe
  C:\Windows\System\PWwFkqv.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\bISmiAb.exe
  C:\Windows\System\bISmiAb.exe
  2⤵
  PID:3308
- C:\Windows\System\WlNhjQV.exe
  C:\Windows\System\WlNhjQV.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\xdnYsgK.exe
  C:\Windows\System\xdnYsgK.exe
  2⤵
  PID:3340
- C:\Windows\System\OJBeHXP.exe
  C:\Windows\System\OJBeHXP.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\GCdqMzV.exe
  C:\Windows\System\GCdqMzV.exe
  2⤵
  PID:3372
- C:\Windows\System\ntKkBGq.exe
  C:\Windows\System\ntKkBGq.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\MZkxdle.exe
  C:\Windows\System\MZkxdle.exe
  2⤵
  PID:3404
- C:\Windows\System\ADSOylE.exe
  C:\Windows\System\ADSOylE.exe
  2⤵
  PID:3420
- C:\Windows\System\qAvCDqc.exe
  C:\Windows\System\qAvCDqc.exe
  2⤵
  PID:3436
- C:\Windows\System\XjzGOzo.exe
  C:\Windows\System\XjzGOzo.exe
  2⤵
  PID:3452
- C:\Windows\System\oLVYvtV.exe
  C:\Windows\System\oLVYvtV.exe
  2⤵
  PID:3468
- C:\Windows\System\KJLPXbm.exe
  C:\Windows\System\KJLPXbm.exe
  2⤵
  PID:3484
- C:\Windows\System\wgTdBQl.exe
  C:\Windows\System\wgTdBQl.exe
  2⤵
  PID:3500
- C:\Windows\System\QHoFhaI.exe
  C:\Windows\System\QHoFhaI.exe
  2⤵
  PID:3516
- C:\Windows\System\eNFxWUW.exe
  C:\Windows\System\eNFxWUW.exe
  2⤵
  PID:3532
- C:\Windows\System\SyDAvWa.exe
  C:\Windows\System\SyDAvWa.exe
  2⤵
  PID:3548
- C:\Windows\System\EdOrQgS.exe
  C:\Windows\System\EdOrQgS.exe
  2⤵
  PID:3564
- C:\Windows\System\qyUFzDl.exe
  C:\Windows\System\qyUFzDl.exe
  2⤵
  PID:3580
- C:\Windows\System\WwcCHqX.exe
  C:\Windows\System\WwcCHqX.exe
  2⤵
  PID:3596
- C:\Windows\System\DQLrNsV.exe
  C:\Windows\System\DQLrNsV.exe
  2⤵
  PID:3612
- C:\Windows\System\JVncOQC.exe
  C:\Windows\System\JVncOQC.exe
  2⤵
  PID:3628
- C:\Windows\System\QjZHxoA.exe
  C:\Windows\System\QjZHxoA.exe
  2⤵
  PID:3644
- C:\Windows\System\yFZICrq.exe
  C:\Windows\System\yFZICrq.exe
  2⤵
  PID:3660
- C:\Windows\System\qMhOUqH.exe
  C:\Windows\System\qMhOUqH.exe
  2⤵
  PID:3676
- C:\Windows\System\KywzQbW.exe
  C:\Windows\System\KywzQbW.exe
  2⤵
  PID:3692
- C:\Windows\System\zJXMwwy.exe
  C:\Windows\System\zJXMwwy.exe
  2⤵
  PID:3708
- C:\Windows\System\kGEYFgT.exe
  C:\Windows\System\kGEYFgT.exe
  2⤵
  PID:3724
- C:\Windows\System\HxEHguA.exe
  C:\Windows\System\HxEHguA.exe
  2⤵
  PID:3740
- C:\Windows\System\haYgcSD.exe
  C:\Windows\System\haYgcSD.exe
  2⤵
  PID:3756
- C:\Windows\System\ifJgjYR.exe
  C:\Windows\System\ifJgjYR.exe
  2⤵
  PID:3772
- C:\Windows\System\MgEMGiU.exe
  C:\Windows\System\MgEMGiU.exe
  2⤵
  PID:3788
- C:\Windows\System\FMAEXYb.exe
  C:\Windows\System\FMAEXYb.exe
  2⤵
  PID:3804
- C:\Windows\System\SgxkJfL.exe
  C:\Windows\System\SgxkJfL.exe
  2⤵
  PID:3820
- C:\Windows\System\ctLHAMs.exe
  C:\Windows\System\ctLHAMs.exe
  2⤵
  PID:3836
- C:\Windows\System\xCvnzmX.exe
  C:\Windows\System\xCvnzmX.exe
  2⤵
  PID:3852
- C:\Windows\System\uXaKwlz.exe
  C:\Windows\System\uXaKwlz.exe
  2⤵
  PID:3868
- C:\Windows\System\FEqypsK.exe
  C:\Windows\System\FEqypsK.exe
  2⤵
  PID:3884
- C:\Windows\System\aWbBrIX.exe
  C:\Windows\System\aWbBrIX.exe
  2⤵
  PID:3900
- C:\Windows\System\qLWjxlM.exe
  C:\Windows\System\qLWjxlM.exe
  2⤵
  PID:3916
- C:\Windows\System\ZUOryJX.exe
  C:\Windows\System\ZUOryJX.exe
  2⤵
  PID:3936
- C:\Windows\System\zqSwECl.exe
  C:\Windows\System\zqSwECl.exe
  2⤵
  PID:3952
- C:\Windows\System\IZTDBLC.exe
  C:\Windows\System\IZTDBLC.exe
  2⤵
  PID:3968
- C:\Windows\System\IekoghZ.exe
  C:\Windows\System\IekoghZ.exe
  2⤵
  PID:3984
- C:\Windows\System\ObsnQcU.exe
  C:\Windows\System\ObsnQcU.exe
  2⤵
  PID:4000
- C:\Windows\System\fYAGUPL.exe
  C:\Windows\System\fYAGUPL.exe
  2⤵
  PID:4016
- C:\Windows\System\qszIJtx.exe
  C:\Windows\System\qszIJtx.exe
  2⤵
  PID:4032
- C:\Windows\System\bfcjDhm.exe
  C:\Windows\System\bfcjDhm.exe
  2⤵
  PID:4048
- C:\Windows\System\HWGPNos.exe
  C:\Windows\System\HWGPNos.exe
  2⤵
  PID:4064
- C:\Windows\System\LNHHoAj.exe
  C:\Windows\System\LNHHoAj.exe
  2⤵
  PID:4080
- C:\Windows\System\cHkCBER.exe
  C:\Windows\System\cHkCBER.exe
  2⤵
  PID:1620
- C:\Windows\System\NxryBVG.exe
  C:\Windows\System\NxryBVG.exe
  2⤵
  PID:1552
- C:\Windows\System\AjDpgXI.exe
  C:\Windows\System\AjDpgXI.exe
  2⤵
  PID:1768
- C:\Windows\System\BGhNRsI.exe
  C:\Windows\System\BGhNRsI.exe
  2⤵
  PID:2564
- C:\Windows\System\SQirwGF.exe
  C:\Windows\System\SQirwGF.exe
  2⤵
  PID:3080
- C:\Windows\System\NUypgVZ.exe
  C:\Windows\System\NUypgVZ.exe
  2⤵
  PID:3144
- C:\Windows\System\VqaJKIU.exe
  C:\Windows\System\VqaJKIU.exe
  2⤵
  PID:3204
- C:\Windows\System\ViEYldX.exe
  C:\Windows\System\ViEYldX.exe
  2⤵
  PID:3268
- C:\Windows\System\tPHqege.exe
  C:\Windows\System\tPHqege.exe
  2⤵
  PID:3332
- C:\Windows\System\QhvLTBe.exe
  C:\Windows\System\QhvLTBe.exe
  2⤵
  PID:3396
- C:\Windows\System\cChwAOY.exe
  C:\Windows\System\cChwAOY.exe
  2⤵
  PID:2456
- C:\Windows\System\VDLWeqG.exe
  C:\Windows\System\VDLWeqG.exe
  2⤵
  PID:3492
- C:\Windows\System\weTovNp.exe
  C:\Windows\System\weTovNp.exe
  2⤵
  PID:3528
- C:\Windows\System\GxlroHF.exe
  C:\Windows\System\GxlroHF.exe
  2⤵
  PID:3592
- C:\Windows\System\GJnUyIg.exe
  C:\Windows\System\GJnUyIg.exe
  2⤵
  PID:3656
- C:\Windows\System\KOFbzxK.exe
  C:\Windows\System\KOFbzxK.exe
  2⤵
  PID:3688
- C:\Windows\System\pGoRmcQ.exe
  C:\Windows\System\pGoRmcQ.exe
  2⤵
  PID:1256
- C:\Windows\System\KrYqRUM.exe
  C:\Windows\System\KrYqRUM.exe
  2⤵
  PID:3780
- C:\Windows\System\VzWPmih.exe
  C:\Windows\System\VzWPmih.exe
  2⤵
  PID:3844
- C:\Windows\System\aJqavod.exe
  C:\Windows\System\aJqavod.exe
  2⤵
  PID:3908
- C:\Windows\System\fNEXipO.exe
  C:\Windows\System\fNEXipO.exe
  2⤵
  PID:3976
- C:\Windows\System\YTpDPfx.exe
  C:\Windows\System\YTpDPfx.exe
  2⤵
  PID:4040
- C:\Windows\System\KEqocpV.exe
  C:\Windows\System\KEqocpV.exe
  2⤵
  PID:568
- C:\Windows\System\dovcaOm.exe
  C:\Windows\System\dovcaOm.exe
  2⤵
  PID:3140
- C:\Windows\System\aSVdpHN.exe
  C:\Windows\System\aSVdpHN.exe
  2⤵
  PID:3364
- C:\Windows\System\rnuDWAS.exe
  C:\Windows\System\rnuDWAS.exe
  2⤵
  PID:3560
- C:\Windows\System\CAphhwl.exe
  C:\Windows\System\CAphhwl.exe
  2⤵
  PID:2412
- C:\Windows\System\xzpOltT.exe
  C:\Windows\System\xzpOltT.exe
  2⤵
  PID:4104
- C:\Windows\System\mEvMWOr.exe
  C:\Windows\System\mEvMWOr.exe
  2⤵
  PID:4120
- C:\Windows\System\Jemxttv.exe
  C:\Windows\System\Jemxttv.exe
  2⤵
  PID:4136
- C:\Windows\System\zxWpyWo.exe
  C:\Windows\System\zxWpyWo.exe
  2⤵
  PID:4152
- C:\Windows\System\USXqBlp.exe
  C:\Windows\System\USXqBlp.exe
  2⤵
  PID:4168
- C:\Windows\System\HyBEvHw.exe
  C:\Windows\System\HyBEvHw.exe
  2⤵
  PID:4184
- C:\Windows\System\bZMixCf.exe
  C:\Windows\System\bZMixCf.exe
  2⤵
  PID:4200
- C:\Windows\System\qltGYSP.exe
  C:\Windows\System\qltGYSP.exe
  2⤵
  PID:4216
- C:\Windows\System\NDvyyNp.exe
  C:\Windows\System\NDvyyNp.exe
  2⤵
  PID:4232
- C:\Windows\System\FxdEnxx.exe
  C:\Windows\System\FxdEnxx.exe
  2⤵
  PID:4248
- C:\Windows\System\ywuubzO.exe
  C:\Windows\System\ywuubzO.exe
  2⤵
  PID:4264
- C:\Windows\System\MVxrVSc.exe
  C:\Windows\System\MVxrVSc.exe
  2⤵
  PID:4280
- C:\Windows\System\EvHlUEG.exe
  C:\Windows\System\EvHlUEG.exe
  2⤵
  PID:4296
- C:\Windows\System\KXyhWzh.exe
  C:\Windows\System\KXyhWzh.exe
  2⤵
  PID:4312
- C:\Windows\System\JdzPBSR.exe
  C:\Windows\System\JdzPBSR.exe
  2⤵
  PID:4328
- C:\Windows\System\EPcgyum.exe
  C:\Windows\System\EPcgyum.exe
  2⤵
  PID:4344
- C:\Windows\System\aRHMPjs.exe
  C:\Windows\System\aRHMPjs.exe
  2⤵
  PID:4360
- C:\Windows\System\RNBvTSY.exe
  C:\Windows\System\RNBvTSY.exe
  2⤵
  PID:4376
- C:\Windows\System\JaAoSQi.exe
  C:\Windows\System\JaAoSQi.exe
  2⤵
  PID:4392
- C:\Windows\System\knPkOme.exe
  C:\Windows\System\knPkOme.exe
  2⤵
  PID:4408
- C:\Windows\System\aeqcRKk.exe
  C:\Windows\System\aeqcRKk.exe
  2⤵
  PID:4424
- C:\Windows\System\diQDeWd.exe
  C:\Windows\System\diQDeWd.exe
  2⤵
  PID:4440
- C:\Windows\System\TExIdLj.exe
  C:\Windows\System\TExIdLj.exe
  2⤵
  PID:4456
- C:\Windows\System\XQTxTFq.exe
  C:\Windows\System\XQTxTFq.exe
  2⤵
  PID:4472
- C:\Windows\System\WcXEhWJ.exe
  C:\Windows\System\WcXEhWJ.exe
  2⤵
  PID:4488
- C:\Windows\System\PXUlHmH.exe
  C:\Windows\System\PXUlHmH.exe
  2⤵
  PID:4504
- C:\Windows\System\bKJQlQV.exe
  C:\Windows\System\bKJQlQV.exe
  2⤵
  PID:4520
- C:\Windows\System\pAxWQPE.exe
  C:\Windows\System\pAxWQPE.exe
  2⤵
  PID:4536
- C:\Windows\System\txlIXqU.exe
  C:\Windows\System\txlIXqU.exe
  2⤵
  PID:4552
- C:\Windows\System\tDpDByc.exe
  C:\Windows\System\tDpDByc.exe
  2⤵
  PID:4568
- C:\Windows\System\VIonmTl.exe
  C:\Windows\System\VIonmTl.exe
  2⤵
  PID:4584
- C:\Windows\System\avohImN.exe
  C:\Windows\System\avohImN.exe
  2⤵
  PID:4600
- C:\Windows\System\yVanUqF.exe
  C:\Windows\System\yVanUqF.exe
  2⤵
  PID:4616
- C:\Windows\System\MFuRTyC.exe
  C:\Windows\System\MFuRTyC.exe
  2⤵
  PID:4632
- C:\Windows\System\RXkwVeH.exe
  C:\Windows\System\RXkwVeH.exe
  2⤵
  PID:4648
- C:\Windows\System\UEduJlI.exe
  C:\Windows\System\UEduJlI.exe
  2⤵
  PID:4664
- C:\Windows\System\cryCzHA.exe
  C:\Windows\System\cryCzHA.exe
  2⤵
  PID:4680
- C:\Windows\System\OwTsjOm.exe
  C:\Windows\System\OwTsjOm.exe
  2⤵
  PID:4696
- C:\Windows\System\qWsIoaL.exe
  C:\Windows\System\qWsIoaL.exe
  2⤵
  PID:4712
- C:\Windows\System\GSNevVS.exe
  C:\Windows\System\GSNevVS.exe
  2⤵
  PID:4728
- C:\Windows\System\ksFSmFk.exe
  C:\Windows\System\ksFSmFk.exe
  2⤵
  PID:4744
- C:\Windows\System\GzWxpCh.exe
  C:\Windows\System\GzWxpCh.exe
  2⤵
  PID:4760
- C:\Windows\System\ttZrvOl.exe
  C:\Windows\System\ttZrvOl.exe
  2⤵
  PID:4808
- C:\Windows\System\FJRKKjH.exe
  C:\Windows\System\FJRKKjH.exe
  2⤵
  PID:4844
- C:\Windows\System\aJyTtOf.exe
  C:\Windows\System\aJyTtOf.exe
  2⤵
  PID:4864
- C:\Windows\System\LoCsRvn.exe
  C:\Windows\System\LoCsRvn.exe
  2⤵
  PID:4880
- C:\Windows\System\jSkwiVv.exe
  C:\Windows\System\jSkwiVv.exe
  2⤵
  PID:4900
- C:\Windows\System\jRTAkka.exe
  C:\Windows\System\jRTAkka.exe
  2⤵
  PID:4920
- C:\Windows\System\cbIjHKa.exe
  C:\Windows\System\cbIjHKa.exe
  2⤵
  PID:4940
- C:\Windows\System\bnjphLW.exe
  C:\Windows\System\bnjphLW.exe
  2⤵
  PID:4956
- C:\Windows\System\KRcwkpo.exe
  C:\Windows\System\KRcwkpo.exe
  2⤵
  PID:4976
- C:\Windows\System\YkDeSDQ.exe
  C:\Windows\System\YkDeSDQ.exe
  2⤵
  PID:4996
- C:\Windows\System\KxbepnV.exe
  C:\Windows\System\KxbepnV.exe
  2⤵
  PID:5016
- C:\Windows\System\HsDMONH.exe
  C:\Windows\System\HsDMONH.exe
  2⤵
  PID:5040
- C:\Windows\System\fxitPDY.exe
  C:\Windows\System\fxitPDY.exe
  2⤵
  PID:5060
- C:\Windows\System\WXbsWlt.exe
  C:\Windows\System\WXbsWlt.exe
  2⤵
  PID:2740
- C:\Windows\System\HxDfAnJ.exe
  C:\Windows\System\HxDfAnJ.exe
  2⤵
  PID:4576
- C:\Windows\System\voPMqWB.exe
  C:\Windows\System\voPMqWB.exe
  2⤵
  PID:4640
- C:\Windows\System\qXpjKgs.exe
  C:\Windows\System\qXpjKgs.exe
  2⤵
  PID:4676
- C:\Windows\System\rWXmRmJ.exe
  C:\Windows\System\rWXmRmJ.exe
  2⤵
  PID:4740
- C:\Windows\System\Gedudyy.exe
  C:\Windows\System\Gedudyy.exe
  2⤵
  PID:4780
- C:\Windows\System\SbLPdCv.exe
  C:\Windows\System\SbLPdCv.exe
  2⤵
  PID:4796
- C:\Windows\System\eIAyYKW.exe
  C:\Windows\System\eIAyYKW.exe
  2⤵
  PID:4856
- C:\Windows\System\MlnKLEs.exe
  C:\Windows\System\MlnKLEs.exe
  2⤵
  PID:4896
- C:\Windows\System\CtprQfI.exe
  C:\Windows\System\CtprQfI.exe
  2⤵
  PID:4964
- C:\Windows\System\IwbHVsC.exe
  C:\Windows\System\IwbHVsC.exe
  2⤵
  PID:5008
- C:\Windows\System\lppUYBp.exe
  C:\Windows\System\lppUYBp.exe
  2⤵
  PID:5056
- C:\Windows\System\tGhivdO.exe
  C:\Windows\System\tGhivdO.exe
  2⤵
  PID:2588
- C:\Windows\System\ewPQSmw.exe
  C:\Windows\System\ewPQSmw.exe
  2⤵
  PID:4548
- C:\Windows\System\CEmuigz.exe
  C:\Windows\System\CEmuigz.exe
  2⤵
  PID:2408
- C:\Windows\System\nROAYwd.exe
  C:\Windows\System\nROAYwd.exe
  2⤵
  PID:2424
- C:\Windows\System\QDTQXAJ.exe
  C:\Windows\System\QDTQXAJ.exe
  2⤵
  PID:2960
- C:\Windows\System\shotBXq.exe
  C:\Windows\System\shotBXq.exe
  2⤵
  PID:548
- C:\Windows\System\LmDefgQ.exe
  C:\Windows\System\LmDefgQ.exe
  2⤵
  PID:3252
- C:\Windows\System\btDfEqA.exe
  C:\Windows\System\btDfEqA.exe
  2⤵
  PID:2428
- C:\Windows\System\aWrFgsT.exe
  C:\Windows\System\aWrFgsT.exe
  2⤵
  PID:1224
- C:\Windows\System\bxkesxX.exe
  C:\Windows\System\bxkesxX.exe
  2⤵
  PID:1664
- C:\Windows\System\rmVsVVP.exe
  C:\Windows\System\rmVsVVP.exe
  2⤵
  PID:2392
- C:\Windows\System\KgTMHSZ.exe
  C:\Windows\System\KgTMHSZ.exe
  2⤵
  PID:2112
- C:\Windows\System\QAcbAXC.exe
  C:\Windows\System\QAcbAXC.exe
  2⤵
  PID:1720
- C:\Windows\System\nrXtUek.exe
  C:\Windows\System\nrXtUek.exe
  2⤵
  PID:964
- C:\Windows\System\ISaydtu.exe
  C:\Windows\System\ISaydtu.exe
  2⤵
  PID:1572
- C:\Windows\System\dxmDeeJ.exe
  C:\Windows\System\dxmDeeJ.exe
  2⤵
  PID:1488
- C:\Windows\System\fewmGmL.exe
  C:\Windows\System\fewmGmL.exe
  2⤵
  PID:3476
- C:\Windows\System\MSRCUKS.exe
  C:\Windows\System\MSRCUKS.exe
  2⤵
  PID:3608
- C:\Windows\System\PVEZfgD.exe
  C:\Windows\System\PVEZfgD.exe
  2⤵
  PID:3700
- C:\Windows\System\oBLhcSZ.exe
  C:\Windows\System\oBLhcSZ.exe
  2⤵
  PID:3764
- C:\Windows\System\jfTDDwm.exe
  C:\Windows\System\jfTDDwm.exe
  2⤵
  PID:3896
- C:\Windows\System\jfhLPue.exe
  C:\Windows\System\jfhLPue.exe
  2⤵
  PID:3960
- C:\Windows\System\NIaVeZZ.exe
  C:\Windows\System\NIaVeZZ.exe
  2⤵
  PID:4024
- C:\Windows\System\KvfUqzX.exe
  C:\Windows\System\KvfUqzX.exe
  2⤵
  PID:4088
- C:\Windows\System\xyhlDsg.exe
  C:\Windows\System\xyhlDsg.exe
  2⤵
  PID:3076
- C:\Windows\System\xdfDGyk.exe
  C:\Windows\System\xdfDGyk.exe
  2⤵
  PID:3304
- C:\Windows\System\ZKzGlKi.exe
  C:\Windows\System\ZKzGlKi.exe
  2⤵
  PID:3624
- C:\Windows\System\afMzrzN.exe
  C:\Windows\System\afMzrzN.exe
  2⤵
  PID:3720
- C:\Windows\System\lxzJBMb.exe
  C:\Windows\System\lxzJBMb.exe
  2⤵
  PID:3948
- C:\Windows\System\hFgptnC.exe
  C:\Windows\System\hFgptnC.exe
  2⤵
  PID:3240
- C:\Windows\System\CtKKvpa.exe
  C:\Windows\System\CtKKvpa.exe
  2⤵
  PID:4116
- C:\Windows\System\xcbINmO.exe
  C:\Windows\System\xcbINmO.exe
  2⤵
  PID:4208
- C:\Windows\System\eNBJgMD.exe
  C:\Windows\System\eNBJgMD.exe
  2⤵
  PID:4272
- C:\Windows\System\zGnnPaG.exe
  C:\Windows\System\zGnnPaG.exe
  2⤵
  PID:4336
- C:\Windows\System\KOJVcQA.exe
  C:\Windows\System\KOJVcQA.exe
  2⤵
  PID:4432
- C:\Windows\System\evqYtIA.exe
  C:\Windows\System\evqYtIA.exe
  2⤵
  PID:1548
- C:\Windows\System\zPqpGTF.exe
  C:\Windows\System\zPqpGTF.exe
  2⤵
  PID:4560
- C:\Windows\System\UKiDCEj.exe
  C:\Windows\System\UKiDCEj.exe
  2⤵
  PID:4624
- C:\Windows\System\OGOPcYY.exe
  C:\Windows\System\OGOPcYY.exe
  2⤵
  PID:4688
- C:\Windows\System\srHDyPJ.exe
  C:\Windows\System\srHDyPJ.exe
  2⤵
  PID:4776
- C:\Windows\System\kgZAUrS.exe
  C:\Windows\System\kgZAUrS.exe
  2⤵
  PID:5052
- C:\Windows\System\FOfKRCd.exe
  C:\Windows\System\FOfKRCd.exe
  2⤵
  PID:1760
- C:\Windows\System\TCQFflF.exe
  C:\Windows\System\TCQFflF.exe
  2⤵
  PID:4824
- C:\Windows\System\KurwbcP.exe
  C:\Windows\System\KurwbcP.exe
  2⤵
  PID:4988
- C:\Windows\System\HqcTgOo.exe
  C:\Windows\System\HqcTgOo.exe
  2⤵
  PID:5024
- C:\Windows\System\HMLgMXy.exe
  C:\Windows\System\HMLgMXy.exe
  2⤵
  PID:5072
- C:\Windows\System\ycpnkDW.exe
  C:\Windows\System\ycpnkDW.exe
  2⤵
  PID:2036
- C:\Windows\System\VjOYkOo.exe
  C:\Windows\System\VjOYkOo.exe
  2⤵
  PID:4060
- C:\Windows\System\PGESoPz.exe
  C:\Windows\System\PGESoPz.exe
  2⤵
  PID:3320
- C:\Windows\System\hqcIWzi.exe
  C:\Windows\System\hqcIWzi.exe
  2⤵
  PID:4580
- C:\Windows\System\iLUKJNg.exe
  C:\Windows\System\iLUKJNg.exe
  2⤵
  PID:4788
- C:\Windows\System\xuRRYKs.exe
  C:\Windows\System\xuRRYKs.exe
  2⤵
  PID:2140
- C:\Windows\System\JcbjSsF.exe
  C:\Windows\System\JcbjSsF.exe
  2⤵
  PID:3004
- C:\Windows\System\wwCZLzc.exe
  C:\Windows\System\wwCZLzc.exe
  2⤵
  PID:1748
- C:\Windows\System\jPwpTEP.exe
  C:\Windows\System\jPwpTEP.exe
  2⤵
  PID:1268
- C:\Windows\System\yppepJh.exe
  C:\Windows\System\yppepJh.exe
  2⤵
  PID:2364
- C:\Windows\System\hiCKTBx.exe
  C:\Windows\System\hiCKTBx.exe
  2⤵
  PID:296
- C:\Windows\System\ipPSMay.exe
  C:\Windows\System\ipPSMay.exe
  2⤵
  PID:3236
- C:\Windows\System\pFAPxFC.exe
  C:\Windows\System\pFAPxFC.exe
  2⤵
  PID:3480
- C:\Windows\System\tsMybpN.exe
  C:\Windows\System\tsMybpN.exe
  2⤵
  PID:3768
- C:\Windows\System\IkgZFYB.exe
  C:\Windows\System\IkgZFYB.exe
  2⤵
  PID:3924
- C:\Windows\System\rzmqdmV.exe
  C:\Windows\System\rzmqdmV.exe
  2⤵
  PID:4028
- C:\Windows\System\KsorOMf.exe
  C:\Windows\System\KsorOMf.exe
  2⤵
  PID:2580
- C:\Windows\System\lFoVzNU.exe
  C:\Windows\System\lFoVzNU.exe
  2⤵
  PID:4596
- C:\Windows\System\rIhfPFX.exe
  C:\Windows\System\rIhfPFX.exe
  2⤵
  PID:3816
- C:\Windows\System\zcmlIXh.exe
  C:\Windows\System\zcmlIXh.exe
  2⤵
  PID:4372
- C:\Windows\System\jTJaRoI.exe
  C:\Windows\System\jTJaRoI.exe
  2⤵
  PID:2068
- C:\Windows\System\HSERLvX.exe
  C:\Windows\System\HSERLvX.exe
  2⤵
  PID:4528
- C:\Windows\System\DrXomup.exe
  C:\Windows\System\DrXomup.exe
  2⤵
  PID:5048
- C:\Windows\System\kDqxhmL.exe
  C:\Windows\System\kDqxhmL.exe
  2⤵
  PID:392
- C:\Windows\System\ZCakxlT.exe
  C:\Windows\System\ZCakxlT.exe
  2⤵
  PID:4840
- C:\Windows\System\zgaXVtz.exe
  C:\Windows\System\zgaXVtz.exe
  2⤵
  PID:4912
- C:\Windows\System\EPpUdHZ.exe
  C:\Windows\System\EPpUdHZ.exe
  2⤵
  PID:2688
- C:\Windows\System\VAhiwCJ.exe
  C:\Windows\System\VAhiwCJ.exe
  2⤵
  PID:4948
- C:\Windows\System\aXmCUXh.exe
  C:\Windows\System\aXmCUXh.exe
  2⤵
  PID:2196
- C:\Windows\System\HqFtLHx.exe
  C:\Windows\System\HqFtLHx.exe
  2⤵
  PID:4952
- C:\Windows\System\txjVWKn.exe
  C:\Windows\System\txjVWKn.exe
  2⤵
  PID:1432
- C:\Windows\System\EFQXLaI.exe
  C:\Windows\System\EFQXLaI.exe
  2⤵
  PID:2556
- C:\Windows\System\PvoyWeQ.exe
  C:\Windows\System\PvoyWeQ.exe
  2⤵
  PID:2484
- C:\Windows\System\eNbwCHm.exe
  C:\Windows\System\eNbwCHm.exe
  2⤵
  PID:1712
- C:\Windows\System\ZchXVzH.exe
  C:\Windows\System\ZchXVzH.exe
  2⤵
  PID:1476
- C:\Windows\System\IkwYEMx.exe
  C:\Windows\System\IkwYEMx.exe
  2⤵
  PID:5108
- C:\Windows\System\MKXWtSC.exe
  C:\Windows\System\MKXWtSC.exe
  2⤵
  PID:4480
- C:\Windows\System\hHLzyLy.exe
  C:\Windows\System\hHLzyLy.exe
  2⤵
  PID:5112
- C:\Windows\System\JbvnHeX.exe
  C:\Windows\System\JbvnHeX.exe
  2⤵
  PID:4012
- C:\Windows\System\XaBDnza.exe
  C:\Windows\System\XaBDnza.exe
  2⤵
  PID:3876
- C:\Windows\System\XEVneej.exe
  C:\Windows\System\XEVneej.exe
  2⤵
  PID:4160
- C:\Windows\System\bdAabCW.exe
  C:\Windows\System\bdAabCW.exe
  2⤵
  PID:4260
- C:\Windows\System\FdGttxr.exe
  C:\Windows\System\FdGttxr.exe
  2⤵
  PID:4320
- C:\Windows\System\sYFkCVB.exe
  C:\Windows\System\sYFkCVB.exe
  2⤵
  PID:4384
- C:\Windows\System\ykLPldK.exe
  C:\Windows\System\ykLPldK.exe
  2⤵
  PID:4452
- C:\Windows\System\fUWLqVP.exe
  C:\Windows\System\fUWLqVP.exe
  2⤵
  PID:4516
- C:\Windows\System\XIWAdWK.exe
  C:\Windows\System\XIWAdWK.exe
  2⤵
  PID:2104
- C:\Windows\System\AFwIJVe.exe
  C:\Windows\System\AFwIJVe.exe
  2⤵
  PID:1536
- C:\Windows\System\cdscpRZ.exe
  C:\Windows\System\cdscpRZ.exe
  2⤵
  PID:2724
- C:\Windows\System\vLpPYSF.exe
  C:\Windows\System\vLpPYSF.exe
  2⤵
  PID:2644
- C:\Windows\System\wWKlsdt.exe
  C:\Windows\System\wWKlsdt.exe
  2⤵
  PID:1656
- C:\Windows\System\xjMbapm.exe
  C:\Windows\System\xjMbapm.exe
  2⤵
  PID:1688
- C:\Windows\System\AuuBCmU.exe
  C:\Windows\System\AuuBCmU.exe
  2⤵
  PID:1500
- C:\Windows\System\GfxUMYz.exe
  C:\Windows\System\GfxUMYz.exe
  2⤵
  PID:2648
- C:\Windows\System\RKWfNdJ.exe
  C:\Windows\System\RKWfNdJ.exe
  2⤵
  PID:3156
- C:\Windows\System\QQJJLJR.exe
  C:\Windows\System\QQJJLJR.exe
  2⤵
  PID:3224
- C:\Windows\System\msDZRnC.exe
  C:\Windows\System\msDZRnC.exe
  2⤵
  PID:3380
- C:\Windows\System\AykSFwL.exe
  C:\Windows\System\AykSFwL.exe
  2⤵
  PID:3284
- C:\Windows\System\ZLDDUJw.exe
  C:\Windows\System\ZLDDUJw.exe
  2⤵
  PID:4972
- C:\Windows\System\uUbvFnr.exe
  C:\Windows\System\uUbvFnr.exe
  2⤵
  PID:4932
- C:\Windows\System\VChgKPX.exe
  C:\Windows\System\VChgKPX.exe
  2⤵
  PID:780
- C:\Windows\System\tOXuWgD.exe
  C:\Windows\System\tOXuWgD.exe
  2⤵
  PID:1676
- C:\Windows\System\mtYMdQw.exe
  C:\Windows\System\mtYMdQw.exe
  2⤵
  PID:3672
- C:\Windows\System\qvXmCyF.exe
  C:\Windows\System\qvXmCyF.exe
  2⤵
  PID:2464
- C:\Windows\System\xtEVuRh.exe
  C:\Windows\System\xtEVuRh.exe
  2⤵
  PID:2096
- C:\Windows\System\BLfaRnx.exe
  C:\Windows\System\BLfaRnx.exe
  2⤵
  PID:4176
- C:\Windows\System\ysiSUtR.exe
  C:\Windows\System\ysiSUtR.exe
  2⤵
  PID:4592
- C:\Windows\System\SoptQwM.exe
  C:\Windows\System\SoptQwM.exe
  2⤵
  PID:2332
- C:\Windows\System\owJmNYp.exe
  C:\Windows\System\owJmNYp.exe
  2⤵
  PID:2616
- C:\Windows\System\uzedmUP.exe
  C:\Windows\System\uzedmUP.exe
  2⤵
  PID:4876
- C:\Windows\System\SEGoimn.exe
  C:\Windows\System\SEGoimn.exe
  2⤵
  PID:2128
- C:\Windows\System\hiWPgdu.exe
  C:\Windows\System\hiWPgdu.exe
  2⤵
  PID:1616
- C:\Windows\System\fJZPjkQ.exe
  C:\Windows\System\fJZPjkQ.exe
  2⤵
  PID:4228
- C:\Windows\System\YnnDYqT.exe
  C:\Windows\System\YnnDYqT.exe
  2⤵
  PID:3928
- C:\Windows\System\jTZqsFb.exe
  C:\Windows\System\jTZqsFb.exe
  2⤵
  PID:4672
- C:\Windows\System\nKkpjFo.exe
  C:\Windows\System\nKkpjFo.exe
  2⤵
  PID:904
- C:\Windows\System\yWoWFgu.exe
  C:\Windows\System\yWoWFgu.exe
  2⤵
  PID:4836
- C:\Windows\System\AAszNFH.exe
  C:\Windows\System\AAszNFH.exe
  2⤵
  PID:2296
- C:\Windows\System\SosjYjL.exe
  C:\Windows\System\SosjYjL.exe
  2⤵
  PID:5092
- C:\Windows\System\odRofMk.exe
  C:\Windows\System\odRofMk.exe
  2⤵
  PID:4008
- C:\Windows\System\AjyjJNs.exe
  C:\Windows\System\AjyjJNs.exe
  2⤵
  PID:4388
- C:\Windows\System\yDKtSpV.exe
  C:\Windows\System\yDKtSpV.exe
  2⤵
  PID:452
- C:\Windows\System\oteGsKW.exe
  C:\Windows\System\oteGsKW.exe
  2⤵
  PID:2000
- C:\Windows\System\BuEUmUo.exe
  C:\Windows\System\BuEUmUo.exe
  2⤵
  PID:4256
- C:\Windows\System\qPwVZjC.exe
  C:\Windows\System\qPwVZjC.exe
  2⤵
  PID:112
- C:\Windows\System\ouIgbUY.exe
  C:\Windows\System\ouIgbUY.exe
  2⤵
  PID:2416
- C:\Windows\System\xgjgJDO.exe
  C:\Windows\System\xgjgJDO.exe
  2⤵
  PID:4544
- C:\Windows\System\kdFdETi.exe
  C:\Windows\System\kdFdETi.exe
  2⤵
  PID:2764
- C:\Windows\System\PvCfhHx.exe
  C:\Windows\System\PvCfhHx.exe
  2⤵
  PID:4888
- C:\Windows\System\QsUNmjA.exe
  C:\Windows\System\QsUNmjA.exe
  2⤵
  PID:3064
- C:\Windows\System\arhHUFO.exe
  C:\Windows\System\arhHUFO.exe
  2⤵
  PID:2304
- C:\Windows\System\lilkliQ.exe
  C:\Windows\System\lilkliQ.exe
  2⤵
  PID:3352
- C:\Windows\System\nmLTbxQ.exe
  C:\Windows\System\nmLTbxQ.exe
  2⤵
  PID:988
- C:\Windows\System\YvHjxqM.exe
  C:\Windows\System\YvHjxqM.exe
  2⤵
  PID:4736
- C:\Windows\System\dlxCgmG.exe
  C:\Windows\System\dlxCgmG.exe
  2⤵
  PID:3832
- C:\Windows\System\lvHpUHu.exe
  C:\Windows\System\lvHpUHu.exe
  2⤵
  PID:3652
- C:\Windows\System\HnPTYBF.exe
  C:\Windows\System\HnPTYBF.exe
  2⤵
  PID:2152
- C:\Windows\System\KwkMHPk.exe
  C:\Windows\System\KwkMHPk.exe
  2⤵
  PID:3992
- C:\Windows\System\guoSnGD.exe
  C:\Windows\System\guoSnGD.exe
  2⤵
  PID:4512
- C:\Windows\System\uPqcvPK.exe
  C:\Windows\System\uPqcvPK.exe
  2⤵
  PID:4724
- C:\Windows\System\rsdWWwG.exe
  C:\Windows\System\rsdWWwG.exe
  2⤵
  PID:4132
- C:\Windows\System\DsUGBxX.exe
  C:\Windows\System\DsUGBxX.exe
  2⤵
  PID:4708
- C:\Windows\System\mFlqXwd.exe
  C:\Windows\System\mFlqXwd.exe
  2⤵
  PID:3176
- C:\Windows\System\VAhcuxm.exe
  C:\Windows\System\VAhcuxm.exe
  2⤵
  PID:2368
- C:\Windows\System\BgRhhdX.exe
  C:\Windows\System\BgRhhdX.exe
  2⤵
  PID:5124
- C:\Windows\System\udwjQcX.exe
  C:\Windows\System\udwjQcX.exe
  2⤵
  PID:5140
- C:\Windows\System\RvIBwZR.exe
  C:\Windows\System\RvIBwZR.exe
  2⤵
  PID:5156
- C:\Windows\System\AfRAlsX.exe
  C:\Windows\System\AfRAlsX.exe
  2⤵
  PID:5172
- C:\Windows\System\WfCUNjW.exe
  C:\Windows\System\WfCUNjW.exe
  2⤵
  PID:5188
- C:\Windows\System\EuhsigN.exe
  C:\Windows\System\EuhsigN.exe
  2⤵
  PID:5204
- C:\Windows\System\CdMVRAv.exe
  C:\Windows\System\CdMVRAv.exe
  2⤵
  PID:5220
- C:\Windows\System\IplzPxV.exe
  C:\Windows\System\IplzPxV.exe
  2⤵
  PID:5236
- C:\Windows\System\egKfNnQ.exe
  C:\Windows\System\egKfNnQ.exe
  2⤵
  PID:5252
- C:\Windows\System\AwigreO.exe
  C:\Windows\System\AwigreO.exe
  2⤵
  PID:5268
- C:\Windows\System\djflHYe.exe
  C:\Windows\System\djflHYe.exe
  2⤵
  PID:5284
- C:\Windows\System\kqHdGLD.exe
  C:\Windows\System\kqHdGLD.exe
  2⤵
  PID:5300
- C:\Windows\System\NbSjIzI.exe
  C:\Windows\System\NbSjIzI.exe
  2⤵
  PID:5316
- C:\Windows\System\vmpxCmF.exe
  C:\Windows\System\vmpxCmF.exe
  2⤵
  PID:5332
- C:\Windows\System\qCyjcae.exe
  C:\Windows\System\qCyjcae.exe
  2⤵
  PID:5348
- C:\Windows\System\EBpEzvS.exe
  C:\Windows\System\EBpEzvS.exe
  2⤵
  PID:5364
- C:\Windows\System\SKGMUEI.exe
  C:\Windows\System\SKGMUEI.exe
  2⤵
  PID:5380
- C:\Windows\System\jPswgUu.exe
  C:\Windows\System\jPswgUu.exe
  2⤵
  PID:5396
- C:\Windows\System\xFNOvxJ.exe
  C:\Windows\System\xFNOvxJ.exe
  2⤵
  PID:5412
- C:\Windows\System\ZYaSijv.exe
  C:\Windows\System\ZYaSijv.exe
  2⤵
  PID:5428
- C:\Windows\System\VPNKRFf.exe
  C:\Windows\System\VPNKRFf.exe
  2⤵
  PID:5448
- C:\Windows\System\YlwkgNR.exe
  C:\Windows\System\YlwkgNR.exe
  2⤵
  PID:5464
- C:\Windows\System\bBcEhtp.exe
  C:\Windows\System\bBcEhtp.exe
  2⤵
  PID:5480
- C:\Windows\System\Njkwuir.exe
  C:\Windows\System\Njkwuir.exe
  2⤵
  PID:5496
- C:\Windows\System\dpDspNv.exe
  C:\Windows\System\dpDspNv.exe
  2⤵
  PID:5540
- C:\Windows\System\EEHDZTT.exe
  C:\Windows\System\EEHDZTT.exe
  2⤵
  PID:5560
- C:\Windows\System\xiJHyRK.exe
  C:\Windows\System\xiJHyRK.exe
  2⤵
  PID:5576
- C:\Windows\System\JIoYWkb.exe
  C:\Windows\System\JIoYWkb.exe
  2⤵
  PID:5592
- C:\Windows\System\YXBdBog.exe
  C:\Windows\System\YXBdBog.exe
  2⤵
  PID:5608
- C:\Windows\System\EAnCbzy.exe
  C:\Windows\System\EAnCbzy.exe
  2⤵
  PID:5624
- C:\Windows\System\pEcUSUR.exe
  C:\Windows\System\pEcUSUR.exe
  2⤵
  PID:5640
- C:\Windows\System\OYaecUX.exe
  C:\Windows\System\OYaecUX.exe
  2⤵
  PID:5656
- C:\Windows\System\XzkJltU.exe
  C:\Windows\System\XzkJltU.exe
  2⤵
  PID:5672
- C:\Windows\System\tMhrnim.exe
  C:\Windows\System\tMhrnim.exe
  2⤵
  PID:5688
- C:\Windows\System\KnyKTMJ.exe
  C:\Windows\System\KnyKTMJ.exe
  2⤵
  PID:5704
- C:\Windows\System\LkwubwD.exe
  C:\Windows\System\LkwubwD.exe
  2⤵
  PID:5720
- C:\Windows\System\MDvAJjj.exe
  C:\Windows\System\MDvAJjj.exe
  2⤵
  PID:5736
- C:\Windows\System\zbtAlPF.exe
  C:\Windows\System\zbtAlPF.exe
  2⤵
  PID:5752
- C:\Windows\System\uNAwuTq.exe
  C:\Windows\System\uNAwuTq.exe
  2⤵
  PID:5768
- C:\Windows\System\OrAYYPP.exe
  C:\Windows\System\OrAYYPP.exe
  2⤵
  PID:5784
- C:\Windows\System\jydcmEM.exe
  C:\Windows\System\jydcmEM.exe
  2⤵
  PID:5800
- C:\Windows\System\xSTsKgi.exe
  C:\Windows\System\xSTsKgi.exe
  2⤵
  PID:5816
- C:\Windows\System\ORNFQFV.exe
  C:\Windows\System\ORNFQFV.exe
  2⤵
  PID:5832
- C:\Windows\System\yuBOTAn.exe
  C:\Windows\System\yuBOTAn.exe
  2⤵
  PID:5848
- C:\Windows\System\EyNHNah.exe
  C:\Windows\System\EyNHNah.exe
  2⤵
  PID:5864
- C:\Windows\System\QVpDBWk.exe
  C:\Windows\System\QVpDBWk.exe
  2⤵
  PID:5880
- C:\Windows\System\ZkypAMs.exe
  C:\Windows\System\ZkypAMs.exe
  2⤵
  PID:5896
- C:\Windows\System\AmteJuR.exe
  C:\Windows\System\AmteJuR.exe
  2⤵
  PID:5912
- C:\Windows\System\OOrSfbm.exe
  C:\Windows\System\OOrSfbm.exe
  2⤵
  PID:5928
- C:\Windows\System\UKiaPll.exe
  C:\Windows\System\UKiaPll.exe
  2⤵
  PID:5944
- C:\Windows\System\ErmeJHX.exe
  C:\Windows\System\ErmeJHX.exe
  2⤵
  PID:5960
- C:\Windows\System\wZLhJWM.exe
  C:\Windows\System\wZLhJWM.exe
  2⤵
  PID:5976
- C:\Windows\System\zqnSOit.exe
  C:\Windows\System\zqnSOit.exe
  2⤵
  PID:5992
- C:\Windows\System\VxnBGaW.exe
  C:\Windows\System\VxnBGaW.exe
  2⤵
  PID:6008
- C:\Windows\System\HGqurtF.exe
  C:\Windows\System\HGqurtF.exe
  2⤵
  PID:6024
- C:\Windows\System\zAnjorE.exe
  C:\Windows\System\zAnjorE.exe
  2⤵
  PID:6040
- C:\Windows\System\eXcIhNk.exe
  C:\Windows\System\eXcIhNk.exe
  2⤵
  PID:6056
- C:\Windows\System\YIImvTa.exe
  C:\Windows\System\YIImvTa.exe
  2⤵
  PID:6072
- C:\Windows\System\rMgJKPq.exe
  C:\Windows\System\rMgJKPq.exe
  2⤵
  PID:6088
- C:\Windows\System\agXeLtz.exe
  C:\Windows\System\agXeLtz.exe
  2⤵
  PID:6104
- C:\Windows\System\QHjkIdn.exe
  C:\Windows\System\QHjkIdn.exe
  2⤵
  PID:6120
- C:\Windows\System\BImNvlj.exe
  C:\Windows\System\BImNvlj.exe
  2⤵
  PID:6136
- C:\Windows\System\EhvvIOQ.exe
  C:\Windows\System\EhvvIOQ.exe
  2⤵
  PID:3124
- C:\Windows\System\uKKRmdN.exe
  C:\Windows\System\uKKRmdN.exe
  2⤵
  PID:3444
- C:\Windows\System\UQPjqND.exe
  C:\Windows\System\UQPjqND.exe
  2⤵
  PID:5164
- C:\Windows\System\kCjqZeU.exe
  C:\Windows\System\kCjqZeU.exe
  2⤵
  PID:5228
- C:\Windows\System\xJDaeiX.exe
  C:\Windows\System\xJDaeiX.exe
  2⤵
  PID:5324
- C:\Windows\System\roJfJvz.exe
  C:\Windows\System\roJfJvz.exe
  2⤵
  PID:5356
- C:\Windows\System\EjlOlGw.exe
  C:\Windows\System\EjlOlGw.exe
  2⤵
  PID:5420
- C:\Windows\System\qDtmBZC.exe
  C:\Windows\System\qDtmBZC.exe
  2⤵
  PID:5276
- C:\Windows\System\fYAxOxg.exe
  C:\Windows\System\fYAxOxg.exe
  2⤵
  PID:5408
- C:\Windows\System\DMyDvDr.exe
  C:\Windows\System\DMyDvDr.exe
  2⤵
  PID:5460
- C:\Windows\System\FzWHMXl.exe
  C:\Windows\System\FzWHMXl.exe
  2⤵
  PID:4660
- C:\Windows\System\OKfIyFg.exe
  C:\Windows\System\OKfIyFg.exe
  2⤵
  PID:4128
- C:\Windows\System\nMTbIoL.exe
  C:\Windows\System\nMTbIoL.exe
  2⤵
  PID:600
- C:\Windows\System\yuyzuRc.exe
  C:\Windows\System\yuyzuRc.exe
  2⤵
  PID:2772
- C:\Windows\System\LupUBwe.exe
  C:\Windows\System\LupUBwe.exe
  2⤵
  PID:2012
- C:\Windows\System\ISPmlZX.exe
  C:\Windows\System\ISPmlZX.exe
  2⤵
  PID:1868
- C:\Windows\System\JAgaUep.exe
  C:\Windows\System\JAgaUep.exe
  2⤵
  PID:4420
- C:\Windows\System\tKxDFiL.exe
  C:\Windows\System\tKxDFiL.exe
  2⤵
  PID:4992
- C:\Windows\System\asdkirB.exe
  C:\Windows\System\asdkirB.exe
  2⤵
  PID:5184
- C:\Windows\System\UWvUzgi.exe
  C:\Windows\System\UWvUzgi.exe
  2⤵
  PID:5280
- C:\Windows\System\JGBfbnt.exe
  C:\Windows\System\JGBfbnt.exe
  2⤵
  PID:5376
- C:\Windows\System\SidNCCD.exe
  C:\Windows\System\SidNCCD.exe
  2⤵
  PID:5548
- C:\Windows\System\kWYncKI.exe
  C:\Windows\System\kWYncKI.exe
  2⤵
  PID:5584
- C:\Windows\System\kYznvRP.exe
  C:\Windows\System\kYznvRP.exe
  2⤵
  PID:5648
- C:\Windows\System\pXWvKCT.exe
  C:\Windows\System\pXWvKCT.exe
  2⤵
  PID:5712
- C:\Windows\System\VGibJYU.exe
  C:\Windows\System\VGibJYU.exe
  2⤵
  PID:5440
- C:\Windows\System\UhoTbKk.exe
  C:\Windows\System\UhoTbKk.exe
  2⤵
  PID:5524
- C:\Windows\System\dHOrVvC.exe
  C:\Windows\System\dHOrVvC.exe
  2⤵
  PID:5472
- C:\Windows\System\IztkKXq.exe
  C:\Windows\System\IztkKXq.exe
  2⤵
  PID:5780
- C:\Windows\System\XuvWEMX.exe
  C:\Windows\System\XuvWEMX.exe
  2⤵
  PID:5840
- C:\Windows\System\uscDQuw.exe
  C:\Windows\System\uscDQuw.exe
  2⤵
  PID:5904
- C:\Windows\System\tIGEWYf.exe
  C:\Windows\System\tIGEWYf.exe
  2⤵
  PID:5972
- C:\Windows\System\uzZPPOF.exe
  C:\Windows\System\uzZPPOF.exe
  2⤵
  PID:6036
- C:\Windows\System\TuFJpNv.exe
  C:\Windows\System\TuFJpNv.exe
  2⤵
  PID:6100
- C:\Windows\System\LwcQcMk.exe
  C:\Windows\System\LwcQcMk.exe
  2⤵
  PID:5636
- C:\Windows\System\LCqaeBy.exe
  C:\Windows\System\LCqaeBy.exe
  2⤵
  PID:5728
- C:\Windows\System\oODzoQe.exe
  C:\Windows\System\oODzoQe.exe
  2⤵
  PID:5824
- C:\Windows\System\Ngbajuf.exe
  C:\Windows\System\Ngbajuf.exe
  2⤵
  PID:5892
- C:\Windows\System\BvBUxpV.exe
  C:\Windows\System\BvBUxpV.exe
  2⤵
  PID:5956
- C:\Windows\System\zaYeLnN.exe
  C:\Windows\System\zaYeLnN.exe
  2⤵
  PID:5296
- C:\Windows\System\AhSPdBq.exe
  C:\Windows\System\AhSPdBq.exe
  2⤵
  PID:6016
- C:\Windows\System\TIwsDjd.exe
  C:\Windows\System\TIwsDjd.exe
  2⤵
  PID:5568
- C:\Windows\System\NlhKtwj.exe
  C:\Windows\System\NlhKtwj.exe
  2⤵
  PID:3732
- C:\Windows\System\LQTxFLN.exe
  C:\Windows\System\LQTxFLN.exe
  2⤵
  PID:6112
- C:\Windows\System\oKpYyWb.exe
  C:\Windows\System\oKpYyWb.exe
  2⤵
  PID:5132
- C:\Windows\System\JLSnJLD.exe
  C:\Windows\System\JLSnJLD.exe
  2⤵
  PID:5388
- C:\Windows\System\HJSzFJJ.exe
  C:\Windows\System\HJSzFJJ.exe
  2⤵
  PID:4352
- C:\Windows\System\VorLqaD.exe
  C:\Windows\System\VorLqaD.exe
  2⤵
  PID:2500
- C:\Windows\System\TckmfVj.exe
  C:\Windows\System\TckmfVj.exe
  2⤵
  PID:3416
- C:\Windows\System\pbynoLL.exe
  C:\Windows\System\pbynoLL.exe
  2⤵
  PID:5248
- C:\Windows\System\cChiQIT.exe
  C:\Windows\System\cChiQIT.exe
  2⤵
  PID:5488
- C:\Windows\System\CGPpYzv.exe
  C:\Windows\System\CGPpYzv.exe
  2⤵
  PID:5620
- C:\Windows\System\DvcHgnT.exe
  C:\Windows\System\DvcHgnT.exe
  2⤵
  PID:5744
- C:\Windows\System\wtRFKJd.exe
  C:\Windows\System\wtRFKJd.exe
  2⤵
  PID:5684
- C:\Windows\System\YkKAVza.exe
  C:\Windows\System\YkKAVza.exe
  2⤵
  PID:5520
- C:\Windows\System\PdoQwFX.exe
  C:\Windows\System\PdoQwFX.exe
  2⤵
  PID:5940
- C:\Windows\System\LJqQVMZ.exe
  C:\Windows\System\LJqQVMZ.exe
  2⤵
  PID:6068
- C:\Windows\System\cJPbBMI.exe
  C:\Windows\System\cJPbBMI.exe
  2⤵
  PID:5664
- C:\Windows\System\SzBiMTf.exe
  C:\Windows\System\SzBiMTf.exe
  2⤵
  PID:5516
- C:\Windows\System\IBuvgXW.exe
  C:\Windows\System\IBuvgXW.exe
  2⤵
  PID:4916
- C:\Windows\System\eNhZDJX.exe
  C:\Windows\System\eNhZDJX.exe
  2⤵
  PID:5696
- C:\Windows\System\kujLPOO.exe
  C:\Windows\System\kujLPOO.exe
  2⤵
  PID:5888
- C:\Windows\System\DxzpmNi.exe
  C:\Windows\System\DxzpmNi.exe
  2⤵
  PID:6080
- C:\Windows\System\eQeFbfy.exe
  C:\Windows\System\eQeFbfy.exe
  2⤵
  PID:592
- C:\Windows\System\cmwnwDI.exe
  C:\Windows\System\cmwnwDI.exe
  2⤵
  PID:5244
- C:\Windows\System\XkNmpXe.exe
  C:\Windows\System\XkNmpXe.exe
  2⤵
  PID:6032
- C:\Windows\System\WLtiBLu.exe
  C:\Windows\System\WLtiBLu.exe
  2⤵
  PID:5680
- C:\Windows\System\HJSsKkD.exe
  C:\Windows\System\HJSsKkD.exe
  2⤵
  PID:6096
- C:\Windows\System\uOPjuxf.exe
  C:\Windows\System\uOPjuxf.exe
  2⤵
  PID:5860
- C:\Windows\System\cjrMNFP.exe
  C:\Windows\System\cjrMNFP.exe
  2⤵
  PID:6152
- C:\Windows\System\gmjoNHf.exe
  C:\Windows\System\gmjoNHf.exe
  2⤵
  PID:6172
- C:\Windows\System\jYGAuom.exe
  C:\Windows\System\jYGAuom.exe
  2⤵
  PID:6188
- C:\Windows\System\Sogcutb.exe
  C:\Windows\System\Sogcutb.exe
  2⤵
  PID:6204
- C:\Windows\System\fjhLReR.exe
  C:\Windows\System\fjhLReR.exe
  2⤵
  PID:6220
- C:\Windows\System\cNjLsMy.exe
  C:\Windows\System\cNjLsMy.exe
  2⤵
  PID:6236
- C:\Windows\System\jyXrakX.exe
  C:\Windows\System\jyXrakX.exe
  2⤵
  PID:6252
- C:\Windows\System\KEjNztv.exe
  C:\Windows\System\KEjNztv.exe
  2⤵
  PID:6268
- C:\Windows\System\qoUqmDL.exe
  C:\Windows\System\qoUqmDL.exe
  2⤵
  PID:6284
- C:\Windows\System\cHQzHVI.exe
  C:\Windows\System\cHQzHVI.exe
  2⤵
  PID:6300
- C:\Windows\System\tNpUPqf.exe
  C:\Windows\System\tNpUPqf.exe
  2⤵
  PID:6316
- C:\Windows\System\esGkPXQ.exe
  C:\Windows\System\esGkPXQ.exe
  2⤵
  PID:6332
- C:\Windows\System\BbnbBUD.exe
  C:\Windows\System\BbnbBUD.exe
  2⤵
  PID:6348
- C:\Windows\System\zhqUNbQ.exe
  C:\Windows\System\zhqUNbQ.exe
  2⤵
  PID:6364
- C:\Windows\System\zOVeCfP.exe
  C:\Windows\System\zOVeCfP.exe
  2⤵
  PID:6380
- C:\Windows\System\lMFjZOs.exe
  C:\Windows\System\lMFjZOs.exe
  2⤵
  PID:6396
- C:\Windows\System\dlCGbKV.exe
  C:\Windows\System\dlCGbKV.exe
  2⤵
  PID:6412
- C:\Windows\System\ErrCAvq.exe
  C:\Windows\System\ErrCAvq.exe
  2⤵
  PID:6428
- C:\Windows\System\PTyeFKw.exe
  C:\Windows\System\PTyeFKw.exe
  2⤵
  PID:6444
- C:\Windows\System\aHMwSSC.exe
  C:\Windows\System\aHMwSSC.exe
  2⤵
  PID:6460
- C:\Windows\System\tliXNIY.exe
  C:\Windows\System\tliXNIY.exe
  2⤵
  PID:6476
- C:\Windows\System\ARbgfMp.exe
  C:\Windows\System\ARbgfMp.exe
  2⤵
  PID:6492
- C:\Windows\System\IHRtKfe.exe
  C:\Windows\System\IHRtKfe.exe
  2⤵
  PID:6508
- C:\Windows\System\LUzqlSl.exe
  C:\Windows\System\LUzqlSl.exe
  2⤵
  PID:6524
- C:\Windows\System\upQKCjI.exe
  C:\Windows\System\upQKCjI.exe
  2⤵
  PID:6540
- C:\Windows\System\iWqPIVx.exe
  C:\Windows\System\iWqPIVx.exe
  2⤵
  PID:6556
- C:\Windows\System\nkmezaT.exe
  C:\Windows\System\nkmezaT.exe
  2⤵
  PID:6572
- C:\Windows\System\CfWYHzm.exe
  C:\Windows\System\CfWYHzm.exe
  2⤵
  PID:6588
- C:\Windows\System\dowJJgW.exe
  C:\Windows\System\dowJJgW.exe
  2⤵
  PID:6604
- C:\Windows\System\wWZziFi.exe
  C:\Windows\System\wWZziFi.exe
  2⤵
  PID:6620
- C:\Windows\System\oqCcSdf.exe
  C:\Windows\System\oqCcSdf.exe
  2⤵
  PID:6636
- C:\Windows\System\yxGVbhy.exe
  C:\Windows\System\yxGVbhy.exe
  2⤵
  PID:6652
- C:\Windows\System\lKGtaAk.exe
  C:\Windows\System\lKGtaAk.exe
  2⤵
  PID:6672
- C:\Windows\System\tcOPZKp.exe
  C:\Windows\System\tcOPZKp.exe
  2⤵
  PID:6688
- C:\Windows\System\bhXIHwh.exe
  C:\Windows\System\bhXIHwh.exe
  2⤵
  PID:6704
- C:\Windows\System\pykdfMP.exe
  C:\Windows\System\pykdfMP.exe
  2⤵
  PID:6720
- C:\Windows\System\NQaJkJC.exe
  C:\Windows\System\NQaJkJC.exe
  2⤵
  PID:6736
- C:\Windows\System\wQmYrjl.exe
  C:\Windows\System\wQmYrjl.exe
  2⤵
  PID:6752
- C:\Windows\System\eqSlVKY.exe
  C:\Windows\System\eqSlVKY.exe
  2⤵
  PID:6768
- C:\Windows\System\bWJEKRZ.exe
  C:\Windows\System\bWJEKRZ.exe
  2⤵
  PID:6784
- C:\Windows\System\iRheLbF.exe
  C:\Windows\System\iRheLbF.exe
  2⤵
  PID:6800
- C:\Windows\System\lDuaZLP.exe
  C:\Windows\System\lDuaZLP.exe
  2⤵
  PID:6816
- C:\Windows\System\mjevsIJ.exe
  C:\Windows\System\mjevsIJ.exe
  2⤵
  PID:6832
- C:\Windows\System\rvJhLlj.exe
  C:\Windows\System\rvJhLlj.exe
  2⤵
  PID:6848
- C:\Windows\System\pbdphtE.exe
  C:\Windows\System\pbdphtE.exe
  2⤵
  PID:6864
- C:\Windows\System\aVkXurW.exe
  C:\Windows\System\aVkXurW.exe
  2⤵
  PID:6880
- C:\Windows\System\qrubSkj.exe
  C:\Windows\System\qrubSkj.exe
  2⤵
  PID:6896
- C:\Windows\System\dePIqZx.exe
  C:\Windows\System\dePIqZx.exe
  2⤵
  PID:6912
- C:\Windows\System\yHqbLcg.exe
  C:\Windows\System\yHqbLcg.exe
  2⤵
  PID:6928
- C:\Windows\System\MzMksst.exe
  C:\Windows\System\MzMksst.exe
  2⤵
  PID:6944
- C:\Windows\System\JWWUtQM.exe
  C:\Windows\System\JWWUtQM.exe
  2⤵
  PID:6960
- C:\Windows\System\NhNUYWr.exe
  C:\Windows\System\NhNUYWr.exe
  2⤵
  PID:6976
- C:\Windows\System\ieVnpCE.exe
  C:\Windows\System\ieVnpCE.exe
  2⤵
  PID:6992
- C:\Windows\System\OeAcxmt.exe
  C:\Windows\System\OeAcxmt.exe
  2⤵
  PID:7008
- C:\Windows\System\ScUOAnn.exe
  C:\Windows\System\ScUOAnn.exe
  2⤵
  PID:7024
- C:\Windows\System\larpPVk.exe
  C:\Windows\System\larpPVk.exe
  2⤵
  PID:7040
- C:\Windows\System\ZemDLDm.exe
  C:\Windows\System\ZemDLDm.exe
  2⤵
  PID:7056
- C:\Windows\System\osbxgOt.exe
  C:\Windows\System\osbxgOt.exe
  2⤵
  PID:7072
- C:\Windows\System\QwuplCg.exe
  C:\Windows\System\QwuplCg.exe
  2⤵
  PID:7088
- C:\Windows\System\XJcGYMK.exe
  C:\Windows\System\XJcGYMK.exe
  2⤵
  PID:7104
- C:\Windows\System\MFFZlLL.exe
  C:\Windows\System\MFFZlLL.exe
  2⤵
  PID:7120
- C:\Windows\System\gWVmmag.exe
  C:\Windows\System\gWVmmag.exe
  2⤵
  PID:7136
- C:\Windows\System\ZenZYlD.exe
  C:\Windows\System\ZenZYlD.exe
  2⤵
  PID:7152
- C:\Windows\System\iHtZIZz.exe
  C:\Windows\System\iHtZIZz.exe
  2⤵
  PID:5760
- C:\Windows\System\zghMcfR.exe
  C:\Windows\System\zghMcfR.exe
  2⤵
  PID:5264
- C:\Windows\System\mCXYtBv.exe
  C:\Windows\System\mCXYtBv.exe
  2⤵
  PID:648
- C:\Windows\System\dcErVEV.exe
  C:\Windows\System\dcErVEV.exe
  2⤵
  PID:5776
- C:\Windows\System\MebhzlP.exe
  C:\Windows\System\MebhzlP.exe
  2⤵
  PID:5508
- C:\Windows\System\iJyNtTF.exe
  C:\Windows\System\iJyNtTF.exe
  2⤵
  PID:6184
- C:\Windows\System\uoVHSbO.exe
  C:\Windows\System\uoVHSbO.exe
  2⤵
  PID:5032
- C:\Windows\System\xcZUeyQ.exe
  C:\Windows\System\xcZUeyQ.exe
  2⤵
  PID:5796
- C:\Windows\System\gLwzYcR.exe
  C:\Windows\System\gLwzYcR.exe
  2⤵
  PID:5924
- C:\Windows\System\IjJtKwP.exe
  C:\Windows\System\IjJtKwP.exe
  2⤵
  PID:5600
- C:\Windows\System\yhlCVFo.exe
  C:\Windows\System\yhlCVFo.exe
  2⤵
  PID:3220
- C:\Windows\System\GTxPuRj.exe
  C:\Windows\System\GTxPuRj.exe
  2⤵
  PID:6196
- C:\Windows\System\hhbgLLZ.exe
  C:\Windows\System\hhbgLLZ.exe
  2⤵
  PID:6228
- C:\Windows\System\RjOfPPF.exe
  C:\Windows\System\RjOfPPF.exe
  2⤵
  PID:6308
- C:\Windows\System\vyoJnVn.exe
  C:\Windows\System\vyoJnVn.exe
  2⤵
  PID:804
- C:\Windows\System\AEbEyKh.exe
  C:\Windows\System\AEbEyKh.exe
  2⤵
  PID:6372
- C:\Windows\System\CBHdyCn.exe
  C:\Windows\System\CBHdyCn.exe
  2⤵
  PID:6436
- C:\Windows\System\bKDZgAI.exe
  C:\Windows\System\bKDZgAI.exe
  2⤵
  PID:6500
- C:\Windows\System\Lpsbrry.exe
  C:\Windows\System\Lpsbrry.exe
  2⤵
  PID:6536
- C:\Windows\System\bGPSQow.exe
  C:\Windows\System\bGPSQow.exe
  2⤵
  PID:6596
- C:\Windows\System\hQhwHyy.exe
  C:\Windows\System\hQhwHyy.exe
  2⤵
  PID:6392
- C:\Windows\System\YvebYSM.exe
  C:\Windows\System\YvebYSM.exe
  2⤵
  PID:6456
- C:\Windows\System\oACstRE.exe
  C:\Windows\System\oACstRE.exe
  2⤵
  PID:6520
- C:\Windows\System\lBiifjk.exe
  C:\Windows\System\lBiifjk.exe
  2⤵
  PID:6584
- C:\Windows\System\mpVFumI.exe
  C:\Windows\System\mpVFumI.exe
  2⤵
  PID:6324
- C:\Windows\System\gSROUia.exe
  C:\Windows\System\gSROUia.exe
  2⤵
  PID:6644
- C:\Windows\System\kGLqBff.exe
  C:\Windows\System\kGLqBff.exe
  2⤵
  PID:6684
- C:\Windows\System\xoSoKiX.exe
  C:\Windows\System\xoSoKiX.exe
  2⤵
  PID:6628
- C:\Windows\System\fEBggoc.exe
  C:\Windows\System\fEBggoc.exe
  2⤵
  PID:6776
- C:\Windows\System\GhcNeEh.exe
  C:\Windows\System\GhcNeEh.exe
  2⤵
  PID:6668
- C:\Windows\System\QCfnuDc.exe
  C:\Windows\System\QCfnuDc.exe
  2⤵
  PID:6808
- C:\Windows\System\mXlgpgW.exe
  C:\Windows\System\mXlgpgW.exe
  2⤵
  PID:6824
- C:\Windows\System\xAGAAwN.exe
  C:\Windows\System\xAGAAwN.exe
  2⤵
  PID:6860
- C:\Windows\System\fFrquCC.exe
  C:\Windows\System\fFrquCC.exe
  2⤵
  PID:6840
- C:\Windows\System\KbKUJQB.exe
  C:\Windows\System\KbKUJQB.exe
  2⤵
  PID:6876
- C:\Windows\System\eXkTBzv.exe
  C:\Windows\System\eXkTBzv.exe
  2⤵
  PID:7000
- C:\Windows\System\IYQeuGG.exe
  C:\Windows\System\IYQeuGG.exe
  2⤵
  PID:6968
- C:\Windows\System\nNhmTVC.exe
  C:\Windows\System\nNhmTVC.exe
  2⤵
  PID:7068
- C:\Windows\System\DGdzfin.exe
  C:\Windows\System\DGdzfin.exe
  2⤵
  PID:7100
- C:\Windows\System\wjEklgp.exe
  C:\Windows\System\wjEklgp.exe
  2⤵
  PID:5148
- C:\Windows\System\xNXpIBF.exe
  C:\Windows\System\xNXpIBF.exe
  2⤵
  PID:5856
- C:\Windows\System\VqYURqv.exe
  C:\Windows\System\VqYURqv.exe
  2⤵
  PID:7020
- C:\Windows\System\hGJTpdN.exe
  C:\Windows\System\hGJTpdN.exe
  2⤵
  PID:6988
- C:\Windows\System\nWmoNYy.exe
  C:\Windows\System\nWmoNYy.exe
  2⤵
  PID:5096
- C:\Windows\System\NLaiuEk.exe
  C:\Windows\System\NLaiuEk.exe
  2⤵
  PID:7016
- C:\Windows\System\qToIMZJ.exe
  C:\Windows\System\qToIMZJ.exe
  2⤵
  PID:7080
- C:\Windows\System\FUVEPkA.exe
  C:\Windows\System\FUVEPkA.exe
  2⤵
  PID:7144
- C:\Windows\System\NuREjFg.exe
  C:\Windows\System\NuREjFg.exe
  2⤵
  PID:6260
- C:\Windows\System\UwIFONf.exe
  C:\Windows\System\UwIFONf.exe
  2⤵
  PID:6388
- C:\Windows\System\fbfUIDn.exe
  C:\Windows\System\fbfUIDn.exe
  2⤵
  PID:5528
- C:\Windows\System\ScZPgQh.exe
  C:\Windows\System\ScZPgQh.exe
  2⤵
  PID:5492
- C:\Windows\System\myxkHqj.exe
  C:\Windows\System\myxkHqj.exe
  2⤵
  PID:5404
- C:\Windows\System\dPMXvku.exe
  C:\Windows\System\dPMXvku.exe
  2⤵
  PID:6680
- C:\Windows\System\oykfKqD.exe
  C:\Windows\System\oykfKqD.exe
  2⤵
  PID:6744
- C:\Windows\System\NhYAcrW.exe
  C:\Windows\System\NhYAcrW.exe
  2⤵
  PID:6856
- C:\Windows\System\StixtyV.exe
  C:\Windows\System\StixtyV.exe
  2⤵
  PID:6344
- C:\Windows\System\VWKGtWg.exe
  C:\Windows\System\VWKGtWg.exe
  2⤵
  PID:6600
- C:\Windows\System\roNyDUn.exe
  C:\Windows\System\roNyDUn.exe
  2⤵
  PID:6580
- C:\Windows\System\nEyLeNm.exe
  C:\Windows\System\nEyLeNm.exe
  2⤵
  PID:6612
- C:\Windows\System\GHTjyLh.exe
  C:\Windows\System\GHTjyLh.exe
  2⤵
  PID:7128
- C:\Windows\System\MZvrZJk.exe
  C:\Windows\System\MZvrZJk.exe
  2⤵
  PID:5668
- C:\Windows\System\GmKboQv.exe
  C:\Windows\System\GmKboQv.exe
  2⤵
  PID:6700
- C:\Windows\System\bJFbJjm.exe
  C:\Windows\System\bJFbJjm.exe
  2⤵
  PID:6984
- C:\Windows\System\YYAUxOI.exe
  C:\Windows\System\YYAUxOI.exe
  2⤵
  PID:6940
- C:\Windows\System\LYLwBbm.exe
  C:\Windows\System\LYLwBbm.exe
  2⤵
  PID:7112
- C:\Windows\System\QyeuQpk.exe
  C:\Windows\System\QyeuQpk.exe
  2⤵
  PID:6532
- C:\Windows\System\DbXjSmU.exe
  C:\Windows\System\DbXjSmU.exe
  2⤵
  PID:2276
- C:\Windows\System\DYgWPGb.exe
  C:\Windows\System\DYgWPGb.exe
  2⤵
  PID:860
- C:\Windows\System\sdOpgdE.exe
  C:\Windows\System\sdOpgdE.exe
  2⤵
  PID:1244
- C:\Windows\System\eLPKDyN.exe
  C:\Windows\System\eLPKDyN.exe
  2⤵
  PID:6264
- C:\Windows\System\Nxktrsx.exe
  C:\Windows\System\Nxktrsx.exe
  2⤵
  PID:5152
- C:\Windows\System\WvPkiYR.exe
  C:\Windows\System\WvPkiYR.exe
  2⤵
  PID:6472
- C:\Windows\System\uPnSDxD.exe
  C:\Windows\System\uPnSDxD.exe
  2⤵
  PID:6872
- C:\Windows\System\MYFuOVV.exe
  C:\Windows\System\MYFuOVV.exe
  2⤵
  PID:6748
- C:\Windows\System\nlWKMll.exe
  C:\Windows\System\nlWKMll.exe
  2⤵
  PID:7116
- C:\Windows\System\nCqiMdy.exe
  C:\Windows\System\nCqiMdy.exe
  2⤵
  PID:6552
- C:\Windows\System\SoSTKGj.exe
  C:\Windows\System\SoSTKGj.exe
  2⤵
  PID:6248
- C:\Windows\System\GnSEAHP.exe
  C:\Windows\System\GnSEAHP.exe
  2⤵
  PID:6180
- C:\Windows\System\sSPXCAp.exe
  C:\Windows\System\sSPXCAp.exe
  2⤵
  PID:6936
- C:\Windows\System\rUHQdtg.exe
  C:\Windows\System\rUHQdtg.exe
  2⤵
  PID:7064
- C:\Windows\System\jBuSRdE.exe
  C:\Windows\System\jBuSRdE.exe
  2⤵
  PID:2860
- C:\Windows\System\DBefZbQ.exe
  C:\Windows\System\DBefZbQ.exe
  2⤵
  PID:2672
- C:\Windows\System\IVtczzu.exe
  C:\Windows\System\IVtczzu.exe
  2⤵
  PID:6052
- C:\Windows\System\zfAjmoH.exe
  C:\Windows\System\zfAjmoH.exe
  2⤵
  PID:5952
- C:\Windows\System\zfdmcCL.exe
  C:\Windows\System\zfdmcCL.exe
  2⤵
  PID:6696
- C:\Windows\System\YJbUhZy.exe
  C:\Windows\System\YJbUhZy.exe
  2⤵
  PID:6828
- C:\Windows\System\HyOmRLP.exe
  C:\Windows\System\HyOmRLP.exe
  2⤵
  PID:2952
- C:\Windows\System\hBHmUFr.exe
  C:\Windows\System\hBHmUFr.exe
  2⤵
  PID:7052
- C:\Windows\System\mhNwQdS.exe
  C:\Windows\System\mhNwQdS.exe
  2⤵
  PID:284
- C:\Windows\System\HVBfaBG.exe
  C:\Windows\System\HVBfaBG.exe
  2⤵
  PID:7184
- C:\Windows\System\dnnLxlm.exe
  C:\Windows\System\dnnLxlm.exe
  2⤵
  PID:7200
- C:\Windows\System\PLxUHcF.exe
  C:\Windows\System\PLxUHcF.exe
  2⤵
  PID:7216
- C:\Windows\System\jogLEIT.exe
  C:\Windows\System\jogLEIT.exe
  2⤵
  PID:7232
- C:\Windows\System\YdpTmyO.exe
  C:\Windows\System\YdpTmyO.exe
  2⤵
  PID:7248
- C:\Windows\System\lDGghzl.exe
  C:\Windows\System\lDGghzl.exe
  2⤵
  PID:7264
- C:\Windows\System\vDQilXZ.exe
  C:\Windows\System\vDQilXZ.exe
  2⤵
  PID:7280
- C:\Windows\System\gLUfrFc.exe
  C:\Windows\System\gLUfrFc.exe
  2⤵
  PID:7296
- C:\Windows\System\DOcOyjl.exe
  C:\Windows\System\DOcOyjl.exe
  2⤵
  PID:7312
- C:\Windows\System\ZHmEukP.exe
  C:\Windows\System\ZHmEukP.exe
  2⤵
  PID:7328
- C:\Windows\System\WtmXFYp.exe
  C:\Windows\System\WtmXFYp.exe
  2⤵
  PID:7344
- C:\Windows\System\ktAtNHt.exe
  C:\Windows\System\ktAtNHt.exe
  2⤵
  PID:7360
- C:\Windows\System\wAQIBqB.exe
  C:\Windows\System\wAQIBqB.exe
  2⤵
  PID:7376
- C:\Windows\System\ebVPkIL.exe
  C:\Windows\System\ebVPkIL.exe
  2⤵
  PID:7392
- C:\Windows\System\gVeRtuD.exe
  C:\Windows\System\gVeRtuD.exe
  2⤵
  PID:7408
- C:\Windows\System\zYmmFeo.exe
  C:\Windows\System\zYmmFeo.exe
  2⤵
  PID:7424
- C:\Windows\System\ugBwkEz.exe
  C:\Windows\System\ugBwkEz.exe
  2⤵
  PID:7440
- C:\Windows\System\THrzNfZ.exe
  C:\Windows\System\THrzNfZ.exe
  2⤵
  PID:7456
- C:\Windows\System\cQPVkJn.exe
  C:\Windows\System\cQPVkJn.exe
  2⤵
  PID:7472
- C:\Windows\System\dFFbmYS.exe
  C:\Windows\System\dFFbmYS.exe
  2⤵
  PID:7488
- C:\Windows\System\SCtTOGk.exe
  C:\Windows\System\SCtTOGk.exe
  2⤵
  PID:7504
- C:\Windows\System\YuWCNuq.exe
  C:\Windows\System\YuWCNuq.exe
  2⤵
  PID:7520
- C:\Windows\System\lrDXNWp.exe
  C:\Windows\System\lrDXNWp.exe
  2⤵
  PID:7536
- C:\Windows\System\anBQfSE.exe
  C:\Windows\System\anBQfSE.exe
  2⤵
  PID:7552
- C:\Windows\System\ysKrNBw.exe
  C:\Windows\System\ysKrNBw.exe
  2⤵
  PID:7568
- C:\Windows\System\mzVlDcC.exe
  C:\Windows\System\mzVlDcC.exe
  2⤵
  PID:7584
- C:\Windows\System\wmVtgNO.exe
  C:\Windows\System\wmVtgNO.exe
  2⤵
  PID:7600
- C:\Windows\System\XbBRSVt.exe
  C:\Windows\System\XbBRSVt.exe
  2⤵
  PID:7616
- C:\Windows\System\CKsNqMh.exe
  C:\Windows\System\CKsNqMh.exe
  2⤵
  PID:7632
- C:\Windows\System\RcdTpuX.exe
  C:\Windows\System\RcdTpuX.exe
  2⤵
  PID:7648
- C:\Windows\System\pHyaqxc.exe
  C:\Windows\System\pHyaqxc.exe
  2⤵
  PID:7664
- C:\Windows\System\IKWvcpI.exe
  C:\Windows\System\IKWvcpI.exe
  2⤵
  PID:7680
- C:\Windows\System\kgCTcZx.exe
  C:\Windows\System\kgCTcZx.exe
  2⤵
  PID:7696
- C:\Windows\System\hGUTdBw.exe
  C:\Windows\System\hGUTdBw.exe
  2⤵
  PID:7712
- C:\Windows\System\MauoERJ.exe
  C:\Windows\System\MauoERJ.exe
  2⤵
  PID:7728
- C:\Windows\System\mLhnKdI.exe
  C:\Windows\System\mLhnKdI.exe
  2⤵
  PID:7744
- C:\Windows\System\YLoHVvW.exe
  C:\Windows\System\YLoHVvW.exe
  2⤵
  PID:7760
- C:\Windows\System\SDbkeii.exe
  C:\Windows\System\SDbkeii.exe
  2⤵
  PID:7776
- C:\Windows\System\KwoKjqK.exe
  C:\Windows\System\KwoKjqK.exe
  2⤵
  PID:7792
- C:\Windows\System\vgDsPib.exe
  C:\Windows\System\vgDsPib.exe
  2⤵
  PID:7808
- C:\Windows\System\XKujYio.exe
  C:\Windows\System\XKujYio.exe
  2⤵
  PID:7824
- C:\Windows\System\JuOseTG.exe
  C:\Windows\System\JuOseTG.exe
  2⤵
  PID:7840
- C:\Windows\System\VwUuipt.exe
  C:\Windows\System\VwUuipt.exe
  2⤵
  PID:7856
- C:\Windows\System\GOHDdFy.exe
  C:\Windows\System\GOHDdFy.exe
  2⤵
  PID:2284
- C:\Windows\System\SlZtkeo.exe
  C:\Windows\System\SlZtkeo.exe
  2⤵
  PID:7356
- C:\Windows\System\UzwSeGz.exe
  C:\Windows\System\UzwSeGz.exe
  2⤵
  PID:7336
- C:\Windows\System\tksrmmw.exe
  C:\Windows\System\tksrmmw.exe
  2⤵
  PID:7176
- C:\Windows\System\RuKSQQw.exe
  C:\Windows\System\RuKSQQw.exe
  2⤵
  PID:7276
- C:\Windows\System\mfkaylT.exe
  C:\Windows\System\mfkaylT.exe
  2⤵
  PID:7304
- C:\Windows\System\eXZCOQg.exe
  C:\Windows\System\eXZCOQg.exe
  2⤵
  PID:7464
- C:\Windows\System\kMIaYvE.exe
  C:\Windows\System\kMIaYvE.exe
  2⤵
  PID:7480
- C:\Windows\System\mNFVKNC.exe
  C:\Windows\System\mNFVKNC.exe
  2⤵
  PID:2956
- C:\Windows\System\neAqWtY.exe
  C:\Windows\System\neAqWtY.exe
  2⤵
  PID:7452
- C:\Windows\System\tKLlQFD.exe
  C:\Windows\System\tKLlQFD.exe
  2⤵
  PID:7592
- C:\Windows\System\BRfedTo.exe
  C:\Windows\System\BRfedTo.exe
  2⤵
  PID:6168
- C:\Windows\System\nhitOxR.exe
  C:\Windows\System\nhitOxR.exe
  2⤵
  PID:7676
- C:\Windows\System\YVZceZV.exe
  C:\Windows\System\YVZceZV.exe
  2⤵
  PID:7708
- C:\Windows\System\PilbSHg.exe
  C:\Windows\System\PilbSHg.exe
  2⤵
  PID:7736
- C:\Windows\System\fJLISCF.exe
  C:\Windows\System\fJLISCF.exe
  2⤵
  PID:7768
- C:\Windows\System\SrMENSZ.exe
  C:\Windows\System\SrMENSZ.exe
  2⤵
  PID:7800
- C:\Windows\System\YTutABo.exe
  C:\Windows\System\YTutABo.exe
  2⤵
  PID:7864
- C:\Windows\System\AloowiF.exe
  C:\Windows\System\AloowiF.exe
  2⤵
  PID:7784
- C:\Windows\System\WirYBES.exe
  C:\Windows\System\WirYBES.exe
  2⤵
  PID:7876
- C:\Windows\System\xZOkxES.exe
  C:\Windows\System\xZOkxES.exe
  2⤵
  PID:7892
- C:\Windows\System\RNAMEDf.exe
  C:\Windows\System\RNAMEDf.exe
  2⤵
  PID:7908
- C:\Windows\System\vOPnJKL.exe
  C:\Windows\System\vOPnJKL.exe
  2⤵
  PID:7924
- C:\Windows\System\CNEUHzL.exe
  C:\Windows\System\CNEUHzL.exe
  2⤵
  PID:7940
- C:\Windows\System\RtWsNsT.exe
  C:\Windows\System\RtWsNsT.exe
  2⤵
  PID:7956
- C:\Windows\System\hOktsmX.exe
  C:\Windows\System\hOktsmX.exe
  2⤵
  PID:7972
- C:\Windows\System\GLfxZIt.exe
  C:\Windows\System\GLfxZIt.exe
  2⤵
  PID:7992
- C:\Windows\System\KPlQsJe.exe
  C:\Windows\System\KPlQsJe.exe
  2⤵
  PID:8008
- C:\Windows\System\OVeSEXl.exe
  C:\Windows\System\OVeSEXl.exe
  2⤵
  PID:8028
- C:\Windows\System\BVzYvUK.exe
  C:\Windows\System\BVzYvUK.exe
  2⤵
  PID:8048
- C:\Windows\System\bhBXnpe.exe
  C:\Windows\System\bhBXnpe.exe
  2⤵
  PID:8060
- C:\Windows\System\umNXwyy.exe
  C:\Windows\System\umNXwyy.exe
  2⤵
  PID:8076
- C:\Windows\System\DXXDkxO.exe
  C:\Windows\System\DXXDkxO.exe
  2⤵
  PID:8096
- C:\Windows\System\OoVfMlE.exe
  C:\Windows\System\OoVfMlE.exe
  2⤵
  PID:8112
- C:\Windows\System\xYlTEbP.exe
  C:\Windows\System\xYlTEbP.exe
  2⤵
  PID:8120
- C:\Windows\System\CkOhBju.exe
  C:\Windows\System\CkOhBju.exe
  2⤵
  PID:8140
- C:\Windows\System\aLmsjuT.exe
  C:\Windows\System\aLmsjuT.exe
  2⤵
  PID:8156
- C:\Windows\System\RPqjOrk.exe
  C:\Windows\System\RPqjOrk.exe
  2⤵
  PID:8172
- C:\Windows\System\zZMuCgm.exe
  C:\Windows\System\zZMuCgm.exe
  2⤵
  PID:8188
- C:\Windows\System\ddiwFzy.exe
  C:\Windows\System\ddiwFzy.exe
  2⤵
  PID:7192
- C:\Windows\System\sQoNabS.exe
  C:\Windows\System\sQoNabS.exe
  2⤵
  PID:588
- C:\Windows\System\HKvnxVj.exe
  C:\Windows\System\HKvnxVj.exe
  2⤵
  PID:7288
- C:\Windows\System\HgNkqWj.exe
  C:\Windows\System\HgNkqWj.exe
  2⤵
  PID:7260
- C:\Windows\System\XxhhrGM.exe
  C:\Windows\System\XxhhrGM.exe
  2⤵
  PID:7384
- C:\Windows\System\llwbLhZ.exe
  C:\Windows\System\llwbLhZ.exe
  2⤵
  PID:7368
- C:\Windows\System\KDJBCrV.exe
  C:\Windows\System\KDJBCrV.exe
  2⤵
  PID:7432
- C:\Windows\System\EjVZzDk.exe
  C:\Windows\System\EjVZzDk.exe
  2⤵
  PID:7404
- C:\Windows\System\WpurTlf.exe
  C:\Windows\System\WpurTlf.exe
  2⤵
  PID:7548
- C:\Windows\System\EAWytfW.exe
  C:\Windows\System\EAWytfW.exe
  2⤵
  PID:7516
- C:\Windows\System\clFuUUy.exe
  C:\Windows\System\clFuUUy.exe
  2⤵
  PID:7628
- C:\Windows\System\KKLcNLW.exe
  C:\Windows\System\KKLcNLW.exe
  2⤵
  PID:7532
- C:\Windows\System\FglhXPp.exe
  C:\Windows\System\FglhXPp.exe
  2⤵
  PID:7692
- C:\Windows\System\IKcyCeS.exe
  C:\Windows\System\IKcyCeS.exe
  2⤵
  PID:7608
- C:\Windows\System\zkTOgJY.exe
  C:\Windows\System\zkTOgJY.exe
  2⤵
  PID:7640
- C:\Windows\System\ISFbLEr.exe
  C:\Windows\System\ISFbLEr.exe
  2⤵
  PID:7884
- C:\Windows\System\PZyvMJw.exe
  C:\Windows\System\PZyvMJw.exe
  2⤵
  PID:7948
- C:\Windows\System\zjmiHdl.exe
  C:\Windows\System\zjmiHdl.exe
  2⤵
  PID:7988
- C:\Windows\System\ljvXwXZ.exe
  C:\Windows\System\ljvXwXZ.exe
  2⤵
  PID:7832
- C:\Windows\System\NtStFiS.exe
  C:\Windows\System\NtStFiS.exe
  2⤵
  PID:7740
- C:\Windows\System\OFjvRWN.exe
  C:\Windows\System\OFjvRWN.exe
  2⤵
  PID:7900
- C:\Windows\System\MUMsnwc.exe
  C:\Windows\System\MUMsnwc.exe
  2⤵
  PID:8000
- C:\Windows\System\tLSXtPh.exe
  C:\Windows\System\tLSXtPh.exe
  2⤵
  PID:8052
- C:\Windows\System\SvpAznm.exe
  C:\Windows\System\SvpAznm.exe
  2⤵
  PID:8068
- C:\Windows\System\Tbivvut.exe
  C:\Windows\System\Tbivvut.exe
  2⤵
  PID:8092
- C:\Windows\System\hRDEWQF.exe
  C:\Windows\System\hRDEWQF.exe
  2⤵
  PID:8148
- C:\Windows\System\uWtYugS.exe
  C:\Windows\System\uWtYugS.exe
  2⤵
  PID:8180
- C:\Windows\System\HspVHmA.exe
  C:\Windows\System\HspVHmA.exe
  2⤵
  PID:1628
- C:\Windows\System\Wqcsqfn.exe
  C:\Windows\System\Wqcsqfn.exe
  2⤵
  PID:7256
- C:\Windows\System\fknakkI.exe
  C:\Windows\System\fknakkI.exe
  2⤵
  PID:7272
- C:\Windows\System\HDTADJu.exe
  C:\Windows\System\HDTADJu.exe
  2⤵
  PID:7528
- C:\Windows\System\fSEgdvT.exe
  C:\Windows\System\fSEgdvT.exe
  2⤵
  PID:3008
- C:\Windows\System\JtPGiiZ.exe
  C:\Windows\System\JtPGiiZ.exe
  2⤵
  PID:7564
- C:\Windows\System\vDQNGYa.exe
  C:\Windows\System\vDQNGYa.exe
  2⤵
  PID:1632
- C:\Windows\System\PxisXFg.exe
  C:\Windows\System\PxisXFg.exe
  2⤵
  PID:7496
- C:\Windows\System\qmIEcof.exe
  C:\Windows\System\qmIEcof.exe
  2⤵
  PID:7916
- C:\Windows\System\gEZQhpe.exe
  C:\Windows\System\gEZQhpe.exe
  2⤵
  PID:7980
- C:\Windows\System\cZnAtek.exe
  C:\Windows\System\cZnAtek.exe
  2⤵
  PID:7964
- C:\Windows\System\MrbsTnU.exe
  C:\Windows\System\MrbsTnU.exe
  2⤵
  PID:8104
- C:\Windows\System\Iqogiia.exe
  C:\Windows\System\Iqogiia.exe
  2⤵
  PID:7208
- C:\Windows\System\razCISK.exe
  C:\Windows\System\razCISK.exe
  2⤵
  PID:7324
- C:\Windows\System\ouGTqpl.exe
  C:\Windows\System\ouGTqpl.exe
  2⤵
  PID:7596
- C:\Windows\System\YoaQJPU.exe
  C:\Windows\System\YoaQJPU.exe
  2⤵
  PID:1604
- C:\Windows\System\svSfUHy.exe
  C:\Windows\System\svSfUHy.exe
  2⤵
  PID:8020
- C:\Windows\System\aNdJGKX.exe
  C:\Windows\System\aNdJGKX.exe
  2⤵
  PID:8124
- C:\Windows\System\FdEVEuy.exe
  C:\Windows\System\FdEVEuy.exe
  2⤵
  PID:7500
- C:\Windows\System\RPOPfRo.exe
  C:\Windows\System\RPOPfRo.exe
  2⤵
  PID:8016
- C:\Windows\System\oTuCWrY.exe
  C:\Windows\System\oTuCWrY.exe
  2⤵
  PID:8164
- C:\Windows\System\sEMxoUY.exe
  C:\Windows\System\sEMxoUY.exe
  2⤵
  PID:8024
- C:\Windows\System\ZfewuQx.exe
  C:\Windows\System\ZfewuQx.exe
  2⤵
  PID:8036
- C:\Windows\System\rqkTkLz.exe
  C:\Windows\System\rqkTkLz.exe
  2⤵
  PID:7720
- C:\Windows\System\PGAgXXQ.exe
  C:\Windows\System\PGAgXXQ.exe
  2⤵
  PID:8196
- C:\Windows\System\DKGLArg.exe
  C:\Windows\System\DKGLArg.exe
  2⤵
  PID:8212
- C:\Windows\System\dGdvord.exe
  C:\Windows\System\dGdvord.exe
  2⤵
  PID:8232
- C:\Windows\System\mFahvdI.exe
  C:\Windows\System\mFahvdI.exe
  2⤵
  PID:8248
- C:\Windows\System\iRmsTtq.exe
  C:\Windows\System\iRmsTtq.exe
  2⤵
  PID:8268
- C:\Windows\System\unZcEqi.exe
  C:\Windows\System\unZcEqi.exe
  2⤵
  PID:8284
- C:\Windows\System\sSNXXug.exe
  C:\Windows\System\sSNXXug.exe
  2⤵
  PID:8300
- C:\Windows\System\ZXTaKeN.exe
  C:\Windows\System\ZXTaKeN.exe
  2⤵
  PID:8316
- C:\Windows\System\cJfwKbt.exe
  C:\Windows\System\cJfwKbt.exe
  2⤵
  PID:8332
- C:\Windows\System\emCrRYq.exe
  C:\Windows\System\emCrRYq.exe
  2⤵
  PID:8348
- C:\Windows\System\lmADrnw.exe
  C:\Windows\System\lmADrnw.exe
  2⤵
  PID:8364
- C:\Windows\System\zkiNRAW.exe
  C:\Windows\System\zkiNRAW.exe
  2⤵
  PID:8380
- C:\Windows\System\lhJPGBH.exe
  C:\Windows\System\lhJPGBH.exe
  2⤵
  PID:8396
- C:\Windows\System\fXZiAIF.exe
  C:\Windows\System\fXZiAIF.exe
  2⤵
  PID:8412
- C:\Windows\System\AdRTqxz.exe
  C:\Windows\System\AdRTqxz.exe
  2⤵
  PID:8428
- C:\Windows\System\YpecXqU.exe
  C:\Windows\System\YpecXqU.exe
  2⤵
  PID:8444
- C:\Windows\System\KRQUJIf.exe
  C:\Windows\System\KRQUJIf.exe
  2⤵
  PID:8460
- C:\Windows\System\kABmsKB.exe
  C:\Windows\System\kABmsKB.exe
  2⤵
  PID:8476
- C:\Windows\System\UCXOVBU.exe
  C:\Windows\System\UCXOVBU.exe
  2⤵
  PID:8492
- C:\Windows\System\NIyGbYo.exe
  C:\Windows\System\NIyGbYo.exe
  2⤵
  PID:8508
- C:\Windows\System\MNTcren.exe
  C:\Windows\System\MNTcren.exe
  2⤵
  PID:8524
- C:\Windows\System\lYJpUzI.exe
  C:\Windows\System\lYJpUzI.exe
  2⤵
  PID:8540
- C:\Windows\System\OnWpgjQ.exe
  C:\Windows\System\OnWpgjQ.exe
  2⤵
  PID:8556
- C:\Windows\System\CUoNNZK.exe
  C:\Windows\System\CUoNNZK.exe
  2⤵
  PID:8572
- C:\Windows\System\urKdOVQ.exe
  C:\Windows\System\urKdOVQ.exe
  2⤵
  PID:8588
- C:\Windows\System\YJUfMhi.exe
  C:\Windows\System\YJUfMhi.exe
  2⤵
  PID:8604
- C:\Windows\System\QJCRqEH.exe
  C:\Windows\System\QJCRqEH.exe
  2⤵
  PID:8620
- C:\Windows\System\EvPNpVk.exe
  C:\Windows\System\EvPNpVk.exe
  2⤵
  PID:8636
- C:\Windows\System\uYpVGDv.exe
  C:\Windows\System\uYpVGDv.exe
  2⤵
  PID:8652
- C:\Windows\System\RbHCznv.exe
  C:\Windows\System\RbHCznv.exe
  2⤵
  PID:8668
- C:\Windows\System\qJjrMRz.exe
  C:\Windows\System\qJjrMRz.exe
  2⤵
  PID:8684
- C:\Windows\System\vGXENpm.exe
  C:\Windows\System\vGXENpm.exe
  2⤵
  PID:8700
- C:\Windows\System\MLmYXYQ.exe
  C:\Windows\System\MLmYXYQ.exe
  2⤵
  PID:8716
- C:\Windows\System\YANKPim.exe
  C:\Windows\System\YANKPim.exe
  2⤵
  PID:8732
- C:\Windows\System\dwekiqI.exe
  C:\Windows\System\dwekiqI.exe
  2⤵
  PID:8748
- C:\Windows\System\UKgaZTD.exe
  C:\Windows\System\UKgaZTD.exe
  2⤵
  PID:8764
- C:\Windows\System\oNKWcbC.exe
  C:\Windows\System\oNKWcbC.exe
  2⤵
  PID:8780
- C:\Windows\System\BewQnNB.exe
  C:\Windows\System\BewQnNB.exe
  2⤵
  PID:8796
- C:\Windows\System\gJbUriW.exe
  C:\Windows\System\gJbUriW.exe
  2⤵
  PID:8812
- C:\Windows\System\qbtrTQv.exe
  C:\Windows\System\qbtrTQv.exe
  2⤵
  PID:8828
- C:\Windows\System\nlYcWnM.exe
  C:\Windows\System\nlYcWnM.exe
  2⤵
  PID:8844
- C:\Windows\System\djEYuco.exe
  C:\Windows\System\djEYuco.exe
  2⤵
  PID:8860
- C:\Windows\System\mzRPVWH.exe
  C:\Windows\System\mzRPVWH.exe
  2⤵
  PID:8876
- C:\Windows\System\dBclYtn.exe
  C:\Windows\System\dBclYtn.exe
  2⤵
  PID:8892
- C:\Windows\System\zjuITyb.exe
  C:\Windows\System\zjuITyb.exe
  2⤵
  PID:8908
- C:\Windows\System\HWjQyHB.exe
  C:\Windows\System\HWjQyHB.exe
  2⤵
  PID:8924
- C:\Windows\System\frNIWXv.exe
  C:\Windows\System\frNIWXv.exe
  2⤵
  PID:8940
- C:\Windows\System\EwyfNPD.exe
  C:\Windows\System\EwyfNPD.exe
  2⤵
  PID:8956
- C:\Windows\System\juuDixy.exe
  C:\Windows\System\juuDixy.exe
  2⤵
  PID:8972
- C:\Windows\System\elbLJrU.exe
  C:\Windows\System\elbLJrU.exe
  2⤵
  PID:8988
- C:\Windows\System\BVRYiNT.exe
  C:\Windows\System\BVRYiNT.exe
  2⤵
  PID:9004
- C:\Windows\System\GSByNoj.exe
  C:\Windows\System\GSByNoj.exe
  2⤵
  PID:9020
- C:\Windows\System\nKisWBS.exe
  C:\Windows\System\nKisWBS.exe
  2⤵
  PID:9036
- C:\Windows\System\XjwAcjy.exe
  C:\Windows\System\XjwAcjy.exe
  2⤵
  PID:9052
- C:\Windows\System\TlgynDN.exe
  C:\Windows\System\TlgynDN.exe
  2⤵
  PID:9068
- C:\Windows\System\sVbKAXs.exe
  C:\Windows\System\sVbKAXs.exe
  2⤵
  PID:9084
- C:\Windows\System\QsSWPWK.exe
  C:\Windows\System\QsSWPWK.exe
  2⤵
  PID:9104
- C:\Windows\System\vNzkrUJ.exe
  C:\Windows\System\vNzkrUJ.exe
  2⤵
  PID:9120
- C:\Windows\System\hYXahRp.exe
  C:\Windows\System\hYXahRp.exe
  2⤵
  PID:9136
- C:\Windows\System\niUgaHX.exe
  C:\Windows\System\niUgaHX.exe
  2⤵
  PID:9152
- C:\Windows\System\mRzragH.exe
  C:\Windows\System\mRzragH.exe
  2⤵
  PID:9168
- C:\Windows\System\aqBGoik.exe
  C:\Windows\System\aqBGoik.exe
  2⤵
  PID:9184
- C:\Windows\System\vbKSbzv.exe
  C:\Windows\System\vbKSbzv.exe
  2⤵
  PID:9200
- C:\Windows\System\dxsyymm.exe
  C:\Windows\System\dxsyymm.exe
  2⤵
  PID:3016
- C:\Windows\System\AOraokS.exe
  C:\Windows\System\AOraokS.exe
  2⤵
  PID:8420
- C:\Windows\System\GCdqQQv.exe
  C:\Windows\System\GCdqQQv.exe
  2⤵
  PID:9048
- C:\Windows\System\IIugxJl.exe
  C:\Windows\System\IIugxJl.exe
  2⤵
  PID:9144
- C:\Windows\System\cnodLZq.exe
  C:\Windows\System\cnodLZq.exe
  2⤵
  PID:9208
- C:\Windows\System\oGrEsBf.exe
  C:\Windows\System\oGrEsBf.exe
  2⤵
  PID:7688
- C:\Windows\System\zArmHjV.exe
  C:\Windows\System\zArmHjV.exe
  2⤵
  PID:8292
- C:\Windows\System\bjGOTaX.exe
  C:\Windows\System\bjGOTaX.exe
  2⤵
  PID:6812
- C:\Windows\System\nSHWyMW.exe
  C:\Windows\System\nSHWyMW.exe
  2⤵
  PID:9196
- C:\Windows\System\nWypeNL.exe
  C:\Windows\System\nWypeNL.exe
  2⤵
  PID:8840
- C:\Windows\System\QFBBRdA.exe
  C:\Windows\System\QFBBRdA.exe
  2⤵
  PID:8932
- C:\Windows\System\AECmWpl.exe
  C:\Windows\System\AECmWpl.exe
  2⤵
  PID:9000
- C:\Windows\System\SvppnqZ.exe
  C:\Windows\System\SvppnqZ.exe
  2⤵
  PID:9160
- C:\Windows\System\xrEHPqO.exe
  C:\Windows\System\xrEHPqO.exe
  2⤵
  PID:8888
- C:\Windows\System\ooCilNH.exe
  C:\Windows\System\ooCilNH.exe
  2⤵
  PID:8468
- C:\Windows\System\jUebWEo.exe
  C:\Windows\System\jUebWEo.exe
  2⤵
  PID:8536
- C:\Windows\System\RzmdnEJ.exe
  C:\Windows\System\RzmdnEJ.exe
  2⤵
  PID:8660
- C:\Windows\System\xPdzGDa.exe
  C:\Windows\System\xPdzGDa.exe
  2⤵
  PID:8724
- C:\Windows\System\bigRyVq.exe
  C:\Windows\System\bigRyVq.exe
  2⤵
  PID:8580
- C:\Windows\System\zcYqWHO.exe
  C:\Windows\System\zcYqWHO.exe
  2⤵
  PID:8744
- C:\Windows\System\LWvqBuM.exe
  C:\Windows\System\LWvqBuM.exe
  2⤵
  PID:8564
- C:\Windows\System\KZxGbBX.exe
  C:\Windows\System\KZxGbBX.exe
  2⤵
  PID:8088
- C:\Windows\System\PfIvAnE.exe
  C:\Windows\System\PfIvAnE.exe
  2⤵
  PID:8968
- C:\Windows\System\vMhqcAA.exe
  C:\Windows\System\vMhqcAA.exe
  2⤵
  PID:8692
- C:\Windows\System\kvHMDnW.exe
  C:\Windows\System\kvHMDnW.exe
  2⤵
  PID:8824
- C:\Windows\System\uFuGKwe.exe
  C:\Windows\System\uFuGKwe.exe
  2⤵
  PID:8808
- C:\Windows\System\AttASLx.exe
  C:\Windows\System\AttASLx.exe
  2⤵
  PID:9080
- C:\Windows\System\nYacVIQ.exe
  C:\Windows\System\nYacVIQ.exe
  2⤵
  PID:8228
- C:\Windows\System\rzZOqsV.exe
  C:\Windows\System\rzZOqsV.exe
  2⤵
  PID:8516
- C:\Windows\System\KrsZsJI.exe
  C:\Windows\System\KrsZsJI.exe
  2⤵
  PID:7612
- C:\Windows\System\kBotYeY.exe
  C:\Windows\System\kBotYeY.exe
  2⤵
  PID:8208
- C:\Windows\System\EoqrlwS.exe
  C:\Windows\System\EoqrlwS.exe
  2⤵
  PID:8440
- C:\Windows\System\VeMJIFT.exe
  C:\Windows\System\VeMJIFT.exe
  2⤵
  PID:8836
- C:\Windows\System\TcPnrsG.exe
  C:\Windows\System\TcPnrsG.exe
  2⤵
  PID:8904
- C:\Windows\System\xNqkxRL.exe
  C:\Windows\System\xNqkxRL.exe
  2⤵
  PID:8980
- C:\Windows\System\KfhhnHM.exe
  C:\Windows\System\KfhhnHM.exe
  2⤵
  PID:8920
- C:\Windows\System\OnWTprm.exe
  C:\Windows\System\OnWTprm.exe
  2⤵
  PID:8964
- C:\Windows\System\ZGWAxTI.exe
  C:\Windows\System\ZGWAxTI.exe
  2⤵
  PID:8820
- C:\Windows\System\bhQeNxP.exe
  C:\Windows\System\bhQeNxP.exe
  2⤵
  PID:8324
- C:\Windows\System\ovGSNhX.exe
  C:\Windows\System\ovGSNhX.exe
  2⤵
  PID:8856
- C:\Windows\System\yYnUKlv.exe
  C:\Windows\System\yYnUKlv.exe
  2⤵
  PID:8340
- C:\Windows\System\GVTcviv.exe
  C:\Windows\System\GVTcviv.exe
  2⤵
  PID:8372
- C:\Windows\System\ywaKiQG.exe
  C:\Windows\System\ywaKiQG.exe
  2⤵
  PID:8520
- C:\Windows\System\FIEJhty.exe
  C:\Windows\System\FIEJhty.exe
  2⤵
  PID:8404
- C:\Windows\System\OtFNcgp.exe
  C:\Windows\System\OtFNcgp.exe
  2⤵
  PID:8452
- C:\Windows\System\oxjwqIp.exe
  C:\Windows\System\oxjwqIp.exe
  2⤵
  PID:8740
- C:\Windows\System\gDwpQOR.exe
  C:\Windows\System\gDwpQOR.exe
  2⤵
  PID:8276
- C:\Windows\System\QYBdmxK.exe
  C:\Windows\System\QYBdmxK.exe
  2⤵
  PID:9132
- C:\Windows\System\pmObKue.exe
  C:\Windows\System\pmObKue.exe
  2⤵
  PID:8952
- C:\Windows\System\UdSIqLt.exe
  C:\Windows\System\UdSIqLt.exe
  2⤵
  PID:9116
- C:\Windows\System\GHYidYc.exe
  C:\Windows\System\GHYidYc.exe
  2⤵
  PID:2440
- C:\Windows\System\ygcgVGd.exe
  C:\Windows\System\ygcgVGd.exe
  2⤵
  PID:8224
- C:\Windows\System\iIpympA.exe
  C:\Windows\System\iIpympA.exe
  2⤵
  PID:8240
- C:\Windows\System\lhTDOnz.exe
  C:\Windows\System\lhTDOnz.exe
  2⤵
  PID:8376
- C:\Windows\System\QIqvitS.exe
  C:\Windows\System\QIqvitS.exe
  2⤵
  PID:7772
- C:\Windows\System\tHkThBv.exe
  C:\Windows\System\tHkThBv.exe
  2⤵
  PID:8708
- C:\Windows\System\NplWtRj.exe
  C:\Windows\System\NplWtRj.exe
  2⤵
  PID:8680
- C:\Windows\System\UFDmrbB.exe
  C:\Windows\System\UFDmrbB.exe
  2⤵
  PID:8696
- C:\Windows\System\nHpegCk.exe
  C:\Windows\System\nHpegCk.exe
  2⤵
  PID:8204
- C:\Windows\System\wnbfYmv.exe
  C:\Windows\System\wnbfYmv.exe
  2⤵
  PID:9232
- C:\Windows\System\bfwhckT.exe
  C:\Windows\System\bfwhckT.exe
  2⤵
  PID:9248
- C:\Windows\System\fdQXDYX.exe
  C:\Windows\System\fdQXDYX.exe
  2⤵
  PID:9264
- C:\Windows\System\lkYACyX.exe
  C:\Windows\System\lkYACyX.exe
  2⤵
  PID:9284
- C:\Windows\System\DhOXwyb.exe
  C:\Windows\System\DhOXwyb.exe
  2⤵
  PID:9300
- C:\Windows\System\DwWOTyA.exe
  C:\Windows\System\DwWOTyA.exe
  2⤵
  PID:9320
- C:\Windows\System\xFjRbfL.exe
  C:\Windows\System\xFjRbfL.exe
  2⤵
  PID:9336
- C:\Windows\System\AfoTUdT.exe
  C:\Windows\System\AfoTUdT.exe
  2⤵
  PID:9356
- C:\Windows\System\AZTVRMg.exe
  C:\Windows\System\AZTVRMg.exe
  2⤵
  PID:9372
- C:\Windows\System\ZiBHEVi.exe
  C:\Windows\System\ZiBHEVi.exe
  2⤵
  PID:9388
- C:\Windows\System\clnKVUx.exe
  C:\Windows\System\clnKVUx.exe
  2⤵
  PID:9408
- C:\Windows\System\vYRYUKH.exe
  C:\Windows\System\vYRYUKH.exe
  2⤵
  PID:9428
- C:\Windows\System\NaSoaan.exe
  C:\Windows\System\NaSoaan.exe
  2⤵
  PID:9448
- C:\Windows\System\tgnHHkW.exe
  C:\Windows\System\tgnHHkW.exe
  2⤵
  PID:9472
- C:\Windows\System\fyqwYZs.exe
  C:\Windows\System\fyqwYZs.exe
  2⤵
  PID:9540
- C:\Windows\System\YdXstui.exe
  C:\Windows\System\YdXstui.exe
  2⤵
  PID:9564
- C:\Windows\System\GNWmnhF.exe
  C:\Windows\System\GNWmnhF.exe
  2⤵
  PID:9580
- C:\Windows\System\gYzQGvl.exe
  C:\Windows\System\gYzQGvl.exe
  2⤵
  PID:9596
- C:\Windows\System\jCjqYKK.exe
  C:\Windows\System\jCjqYKK.exe
  2⤵
  PID:9612
- C:\Windows\System\uEcCoZM.exe
  C:\Windows\System\uEcCoZM.exe
  2⤵
  PID:9628
- C:\Windows\System\nEKyiZf.exe
  C:\Windows\System\nEKyiZf.exe
  2⤵
  PID:9644
- C:\Windows\System\OZrvMUx.exe
  C:\Windows\System\OZrvMUx.exe
  2⤵
  PID:9660
- C:\Windows\System\wTbcysQ.exe
  C:\Windows\System\wTbcysQ.exe
  2⤵
  PID:9680
- C:\Windows\System\kVXPRIU.exe
  C:\Windows\System\kVXPRIU.exe
  2⤵
  PID:9696
- C:\Windows\System\CAOXErw.exe
  C:\Windows\System\CAOXErw.exe
  2⤵
  PID:9712
- C:\Windows\System\emLwGCq.exe
  C:\Windows\System\emLwGCq.exe
  2⤵
  PID:9732
- C:\Windows\System\DqiqfEd.exe
  C:\Windows\System\DqiqfEd.exe
  2⤵
  PID:9748
- C:\Windows\System\ZFRDJNj.exe
  C:\Windows\System\ZFRDJNj.exe
  2⤵
  PID:9764
- C:\Windows\System\xKnHXoM.exe
  C:\Windows\System\xKnHXoM.exe
  2⤵
  PID:9784
- C:\Windows\System\eNIUvIU.exe
  C:\Windows\System\eNIUvIU.exe
  2⤵
  PID:9804
- C:\Windows\System\nuQJsxf.exe
  C:\Windows\System\nuQJsxf.exe
  2⤵
  PID:9824
- C:\Windows\System\nRSrDkI.exe
  C:\Windows\System\nRSrDkI.exe
  2⤵
  PID:9844
- C:\Windows\System\HXHgxuI.exe
  C:\Windows\System\HXHgxuI.exe
  2⤵
  PID:9864
- C:\Windows\System\URjBmHo.exe
  C:\Windows\System\URjBmHo.exe
  2⤵
  PID:9884
- C:\Windows\System\MrfNfnj.exe
  C:\Windows\System\MrfNfnj.exe
  2⤵
  PID:9908
- C:\Windows\System\WCAlXXR.exe
  C:\Windows\System\WCAlXXR.exe
  2⤵
  PID:9932
- C:\Windows\System\PUZtiXW.exe
  C:\Windows\System\PUZtiXW.exe
  2⤵
  PID:9968
- C:\Windows\System\sBDDquq.exe
  C:\Windows\System\sBDDquq.exe
  2⤵
  PID:10000
- C:\Windows\System\GQxGkVv.exe
  C:\Windows\System\GQxGkVv.exe
  2⤵
  PID:10028
- C:\Windows\System\PnfAbgO.exe
  C:\Windows\System\PnfAbgO.exe
  2⤵
  PID:10048
- C:\Windows\System\oRFLxJq.exe
  C:\Windows\System\oRFLxJq.exe
  2⤵
  PID:10068
- C:\Windows\System\xtSumvu.exe
  C:\Windows\System\xtSumvu.exe
  2⤵
  PID:10084
- C:\Windows\System\ozKjGmr.exe
  C:\Windows\System\ozKjGmr.exe
  2⤵
  PID:10100
- C:\Windows\System\yntRNnB.exe
  C:\Windows\System\yntRNnB.exe
  2⤵
  PID:10116
- C:\Windows\System\qvsfqfO.exe
  C:\Windows\System\qvsfqfO.exe
  2⤵
  PID:10132
- C:\Windows\System\nUmgjnm.exe
  C:\Windows\System\nUmgjnm.exe
  2⤵
  PID:10148
- C:\Windows\System\OZYgWju.exe
  C:\Windows\System\OZYgWju.exe
  2⤵
  PID:10164
- C:\Windows\System\Ggbrjtx.exe
  C:\Windows\System\Ggbrjtx.exe
  2⤵
  PID:10180
- C:\Windows\System\kGYLPGr.exe
  C:\Windows\System\kGYLPGr.exe
  2⤵
  PID:10196
- C:\Windows\System\JCVPBLj.exe
  C:\Windows\System\JCVPBLj.exe
  2⤵
  PID:10212
- C:\Windows\System\vivpxqP.exe
  C:\Windows\System\vivpxqP.exe
  2⤵
  PID:10228
- C:\Windows\System\yzuQVqv.exe
  C:\Windows\System\yzuQVqv.exe
  2⤵
  PID:8552
- C:\Windows\System\wTpZSmt.exe
  C:\Windows\System\wTpZSmt.exe
  2⤵
  PID:8388
- C:\Windows\System\TIIzVKT.exe
  C:\Windows\System\TIIzVKT.exe
  2⤵
  PID:8488
- C:\Windows\System\NjSsISe.exe
  C:\Windows\System\NjSsISe.exe
  2⤵
  PID:8500
- C:\Windows\System\svcHJlN.exe
  C:\Windows\System\svcHJlN.exe
  2⤵
  PID:8264
- C:\Windows\System\UuVxidq.exe
  C:\Windows\System\UuVxidq.exe
  2⤵
  PID:9256
- C:\Windows\System\VOEacWG.exe
  C:\Windows\System\VOEacWG.exe
  2⤵
  PID:8392
- C:\Windows\System\opYNSmp.exe
  C:\Windows\System\opYNSmp.exe
  2⤵
  PID:9396
- C:\Windows\System\IgFLful.exe
  C:\Windows\System\IgFLful.exe
  2⤵
  PID:9480
- C:\Windows\System\xKgiiju.exe
  C:\Windows\System\xKgiiju.exe
  2⤵
  PID:9500
- C:\Windows\System\phAadEZ.exe
  C:\Windows\System\phAadEZ.exe
  2⤵
  PID:9512
- C:\Windows\System\hSleqtj.exe
  C:\Windows\System\hSleqtj.exe
  2⤵
  PID:9460
- C:\Windows\System\FXVParh.exe
  C:\Windows\System\FXVParh.exe
  2⤵
  PID:9280
- C:\Windows\System\JxhySoZ.exe
  C:\Windows\System\JxhySoZ.exe
  2⤵
  PID:9528
- C:\Windows\System\KqMzPtU.exe
  C:\Windows\System\KqMzPtU.exe
  2⤵
  PID:9532
- C:\Windows\System\maMikwg.exe
  C:\Windows\System\maMikwg.exe
  2⤵
  PID:9276
- C:\Windows\System\gJAqqkG.exe
  C:\Windows\System\gJAqqkG.exe
  2⤵
  PID:9456
- C:\Windows\System\mVMDKpg.exe
  C:\Windows\System\mVMDKpg.exe
  2⤵
  PID:9572
- C:\Windows\System\qTxCRgl.exe
  C:\Windows\System\qTxCRgl.exe
  2⤵
  PID:9740
- C:\Windows\System\aDotjjA.exe
  C:\Windows\System\aDotjjA.exe
  2⤵
  PID:9552
- C:\Windows\System\ryanNqk.exe
  C:\Windows\System\ryanNqk.exe
  2⤵
  PID:9872
- C:\Windows\System\PpGQrte.exe
  C:\Windows\System\PpGQrte.exe
  2⤵
  PID:9592
- C:\Windows\System\kwVAwJb.exe
  C:\Windows\System\kwVAwJb.exe
  2⤵
  PID:9720
- C:\Windows\System\eJKzeoE.exe
  C:\Windows\System\eJKzeoE.exe
  2⤵
  PID:9836
- C:\Windows\System\wsxrLzF.exe
  C:\Windows\System\wsxrLzF.exe
  2⤵
  PID:9876
- C:\Windows\System\ISCwOaw.exe
  C:\Windows\System\ISCwOaw.exe
  2⤵
  PID:9928
- C:\Windows\System\keocvGk.exe
  C:\Windows\System\keocvGk.exe
  2⤵
  PID:9984
- C:\Windows\System\KmIOBrw.exe
  C:\Windows\System\KmIOBrw.exe
  2⤵
  PID:9980
- C:\Windows\System\jboDayq.exe
  C:\Windows\System\jboDayq.exe
  2⤵
  PID:10016
- C:\Windows\System\azKTSjs.exe
  C:\Windows\System\azKTSjs.exe
  2⤵
  PID:10056
- C:\Windows\System\UGxFVYT.exe
  C:\Windows\System\UGxFVYT.exe
  2⤵
  PID:10080
- C:\Windows\System\MTtnJCM.exe
  C:\Windows\System\MTtnJCM.exe
  2⤵
  PID:10096
- C:\Windows\System\goTPSuM.exe
  C:\Windows\System\goTPSuM.exe
  2⤵
  PID:10160
- C:\Windows\System\WyZPGzz.exe
  C:\Windows\System\WyZPGzz.exe
  2⤵
  PID:10224
- C:\Windows\System\vzZWMBU.exe
  C:\Windows\System\vzZWMBU.exe
  2⤵
  PID:9164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CMKvssp.exe

Filesize
3.2MB

MD5
0e47ec176387d256bdab5d2b95e63c83

SHA1
069ff817cbb9e770752615b011c660a38b804fa4

SHA256
a212163732c5714a87a3947be4658a03dd54608420d5aac00f99f06913b81b81

SHA512
4561715464a2af760c916f4305ae74f3112ef6cc108f83dfdcd7b1ce3767ead765e201d7c868b3aea5be0537aad4707195334ef1e048093eb4ea66d173687638

Download Submit
C:\Windows\system\ChwRmZz.exe

Filesize
3.2MB

MD5
f98e0c80adb80a1d0ad23cfed3d1314a

SHA1
dc85993084fa6d008faf3b22642d9aa9d798058f

SHA256
9fa48f0df81804c4a10eff0bfe81d62cceb7d7ff5c92df027a37c85585ce80ec

SHA512
a4d0abe29092d00979e00baeb1e4b0aeb4136b25c2b36a3dbbda74810ab0fa27d7bee6f2c157b1027926991e792ffad4138bed42c236d960dad152943af16afd

Download Submit
C:\Windows\system\FQivnHg.exe

Filesize
3.2MB

MD5
a438eeac2eb944af097f563ab603825d

SHA1
6f01903604c3dd47e9b8d14f73b41ac1e1bdeb68

SHA256
a8b1eec7d907d462f7db54a68af4ec1bec0fa268948c391f3a6dee7ba7af7b64

SHA512
3c3723d60a3f4244f27e35e0e089b0ac209638f92bd8772dba583a447481d261790e6bce637924780c7bb6e527c4893440a1fd8ace14f5297235694182ea77e0

Download Submit
C:\Windows\system\HZZqneL.exe

Filesize
3.2MB

MD5
7df56c5d0cd51193999e7301826b1761

SHA1
76e673ffca3b15a83bde4f04d0d47a93bc2b6001

SHA256
4a77483bdbaaf0138d85adfb6362f22f3ea9f498763132832269980f43d92c91

SHA512
eacdf7f22fa50411fd552ed52f29c257380cedc0d08c1b2cb1dcaa372a9f1c0b15a907a679062b4b61655af94f2a7cb272ff25e66783907ec4cf7af9458abdf1

Download Submit
C:\Windows\system\HlHcXku.exe

Filesize
3.2MB

MD5
cab9348f76b67167deabca2fae89c3cb

SHA1
c156d0661c411c4c4f52be9280322accda0331b7

SHA256
b14ce293a4453036be83c9f3358260266741955661b7b6c62d7e3fc5da08d78e

SHA512
b45ad2d26f69d84b76f56418fda18f047687e23acb5f3b71540f7ec49e270a70c819aab6b2a5c41af9a45d7d5110566016f984e015b41c1232910d2907acd891

Download Submit
C:\Windows\system\MqRIsaZ.exe

Filesize
3.2MB

MD5
d7a6541bf86967c4f194ccdfa376eae4

SHA1
e37793dd055def20be07e14ccfc723b5de12d544

SHA256
9eebd8eee0638954954f2fc0835bcbd0f156ddc67216deb01c80243db0d130b6

SHA512
54b715646425d2f9e7a5bf30a7b637b9cba34b5de35c0c42fbd6350e98e3ecc76012747c47c7b75c2052628c45e0a33d72bf2c3c28a553a213017575a994821a

Download Submit
C:\Windows\system\QvlsMtU.exe

Filesize
3.2MB

MD5
ac56dcea265df07ebef80f9dafe375c5

SHA1
98f276d8cdec3342f9ce6f2c88a847cf061e1377

SHA256
384e31a80add8ef82a5301fb92bb408c7995782fb1a7f42920d53ec83789bc63

SHA512
bec663ed6475466627ea65a2471d17edb179b9b0601efe04e62a1381086ac09138a4948fc1dbc7915e894ca1bee9b11816222ca2c71f3e7033d3f7be7de29a02

Download Submit
C:\Windows\system\SEtaEJJ.exe

Filesize
3.2MB

MD5
9d32e2bf8afd440412ab9f725a66940f

SHA1
6cffe8d8ada8b06744915cb0094c1c0e9a61475e

SHA256
3a37d8c5ddf0a1e79c656af48117907a3a27c18135c8adf3d5a2f99f5e63ea52

SHA512
b102622b0aa7c85d6c093fd8f1f31b7945018e713188b2af7ecd5d0c819cd6945c5bf6818482064981179f11dffd5f6e21c806cd49a0b697b4da5f1469d15746

Download Submit
C:\Windows\system\SWQoYjs.exe

Filesize
3.2MB

MD5
c5d78454a582f80a9f12f8c59d141072

SHA1
70bc9a50938dfe375958af060a1f3534aa9b93e3

SHA256
1e58a5b8a8ca841cdf965b86dba22805e916e3580ebd027ab00d25543481dac6

SHA512
c8f5b66a4d147408c76c0838e7255fa47c9ce1d62fe10df21d1b81b34e3c51056a09d3653ef4230df8b367bbf0a8027615692276e9f60eb1f342b7469ac1fa48

Download Submit
C:\Windows\system\TqFFEsN.exe

Filesize
3.2MB

MD5
cc3540e70d6d2919f3ab2c7a9c52f5ee

SHA1
382399915d747dcc73fd97d2104a6f330926976f

SHA256
9734d98b3e403c8c5af01297d0726eb3dea5a8ead2331f0f4c0bc8fee15993fe

SHA512
b866dac2c750be421e5db642f37ad725802f8ba4d594caec0c1873c856aeb3d2340cfc8b40e9cfb68e85d3d6e601a3e15f6b477ab2c56596f791ea67e4fe61fd

Download Submit
C:\Windows\system\UEQTgGj.exe

Filesize
3.2MB

MD5
b89efb10f7ceb31e790b4a92694b3cf0

SHA1
aab2e7d91f015e0dfc78952fd2706c2d1a36743c

SHA256
8228d4f1e882905cbcf128fb1c03784be940e4502553918cd7341b99948e73f0

SHA512
87285217fae82e8041ad04017e9bdf3a43a852837c70fd3f5bf12081987bd168c44f0c17217fcea5ca208fff19f3bf9e1dacc56ac5d91c7c5466384a92c4f271

Download Submit
C:\Windows\system\VFJlnhE.exe

Filesize
3.2MB

MD5
babcae7b5fcbdfc40412f332984c4d36

SHA1
900b5a9ec82f3ff61f4e7e7ba09e8a7d4f2c9de6

SHA256
c53bc5b9c460076f06acb9d6eb47af300af02b9e50505f8e2d5920487e6b0be0

SHA512
40d97e468bcd23cd69c32e1858bd7ec598087b106ccd4d60a381895a629886442af77149514fff90b11e292168273b2d6dc048961dd786b329d848771d44764f

Download Submit
C:\Windows\system\WrQvBOm.exe

Filesize
3.2MB

MD5
91f898df7214d822ad30df51c8f08731

SHA1
c0b484761e6c9d8e84bd9648e3d8abd5a331e53f

SHA256
ec8a7b3f50c9f9f1721cc8daf402320ceffb70f54a7d426ae7e9d59feb192b02

SHA512
e9d1a833c99fcd1919ad7aebd909f03f82e5a28e20f1c0b6ad6b50592702ccc74a7a0a63ac5b10985b44742538d64c3625e21d03aafa4701c7bf2bae9b9c34d7

Download Submit
C:\Windows\system\YZVXXmd.exe

Filesize
3.2MB

MD5
19c5a2ce22c504e5a9efa2989cc91a13

SHA1
c3f9eb9b8d661d39c3f52081045165cb21689fc2

SHA256
f0e4a35b5eca23c71ee916b54186d761f8a565460b361f6c807883e65c342ddf

SHA512
beac8b59954ad384dd73627ccdd056e6cb87f9faeff4c7bb415391ee4f59783a43e3f1fefc0cd9dfc325ca38f3105bf3a61f8608663e5d7fadb5815c01dbd171

Download Submit
C:\Windows\system\akCgWxV.exe

Filesize
3.2MB

MD5
5b0f52a4ac1077d330f4ee63709c8fab

SHA1
b16a7e93438ee04e660f2bb7e7897d7f2c95b2fe

SHA256
ed8f3a67c49836d8ea51e997e770ce1921b3b5989ea3d181df5af8920ef168fd

SHA512
adf210c6f9868ca2567aeab5881cc0b74876c6fdd60f05414b1a2903ba8067729481941dd5df04bd360822bff14338a186c993c3cbf337e082eccc6e1d4a3618

Download Submit
C:\Windows\system\bXTWtGp.exe

Filesize
3.2MB

MD5
3fa615bd960e48267d7b6c206ee4beb3

SHA1
44054130627c68bcb7edd1fe9ef6d515b81588e5

SHA256
26c0af3376be4c512c68434995f8a81fc8218108af3ddd23ea1b883dd5d87387

SHA512
031f6c96254231798c1aae04a6ec13d0b1137920f3b447978b94fdbe072d58d06805cd6aedaa2e86a83ccdc2ba39cf03af4657e9cc1508489490d74be5972f84

Download Submit
C:\Windows\system\fwYtcQN.exe

Filesize
3.2MB

MD5
e6303af61f29dfd0cba874511c800a33

SHA1
9353fc331e21ed203e573e89fe1e74f40ece369e

SHA256
e2305028104c491e0b793ba00bdcd775958bd62c20577afe368ebdd330e79b0f

SHA512
02b27188ba018daa15dfec43c7e4e3801993749c65fc1af1121009fa88df8e34766fb1b9cfdb07521dc3f8ccb4f6741f21b4212b634dc9ee0ecd218a5280243a

Download Submit
C:\Windows\system\iYIMRCx.exe

Filesize
3.2MB

MD5
59e2ba7f84e2d86f1c5740d8ae3fb136

SHA1
3cfb2bbbada1dcbd72ed027f4e9dc3941e2d0e70

SHA256
91c608cbbdff46dc21a539047d2ac0e76e6bbb4772d4e4edd1f029a1f97638b2

SHA512
176551fb0a3ab0cee32f44cc7dcd5c430d5aa95537d9e5648e6053cfeca8994f0b90cba6a4043419458e953cb5c03c7b61e5295741737924da25b58bd0bc245d

Download Submit
C:\Windows\system\kqSzTBB.exe

Filesize
3.2MB

MD5
ef7925446fd581f36e4c7b6aa65c0de0

SHA1
6d8a3748a573531a8546290c43778334140bf3d8

SHA256
20f68c65272d7cabceab37000d6ac31056f3e5eae4fffa69f4b721942746fcce

SHA512
1a48d8a9ee9ebe6fa621581d0b34b662d62d0b9949974d25301c7af51f5a549db3e006e517248d9f8ec408d593fd25a7b03c19d345fb31a2d55f787d09b16054

Download Submit
C:\Windows\system\nkcLhrC.exe

Filesize
3.2MB

MD5
2d0dd2d8b9a98f79e8f7f7798fa1d10c

SHA1
14688a007fb0f22b9c9931088784d9f0148a99d7

SHA256
c24763b7f48651929a62bf03fa997805e0f2c5063a31ec40c3259574c401f4c8

SHA512
d18425b1a9d0e90bcbc510467c360343201d1c290898af4e08a26bd2e5e90b70d7928f56d456035ea3e5cfa36be7b552819d102a43b9ebc44707aaaa690761fd

Download Submit
C:\Windows\system\vbMlvOe.exe

Filesize
3.2MB

MD5
5a5f0cb8d5c453017f06a569153661f6

SHA1
cfc90ea5cd87eed085128cf976198c6ca1bc7b0b

SHA256
535466562f329c6db345840f5ab4b40ca4f476cac782e6f0cbb70df30415f9df

SHA512
c8cb16806662aeaabfe544d7bac0db75f1ea8f75ebe48692d320acec7b593b31962c7ec29d399dc6f599f93c774fc7eb43bc8966bcc7195a87e836ac89032616

Download Submit
\Windows\system\BChHysS.exe

Filesize
3.2MB

MD5
3fe49968c4ed84115f1145a0c29eae9f

SHA1
1a31859692edb3c4083c072705031eb5ed30c403

SHA256
e7dbde3e4f5357c6e77e4e7a0114aadaed56a5c83f682503b0e3ef78a9dd1597

SHA512
c3ca5814fa48b7081edd6fb4298793a1ed03b6955fad39656343d0db129ed097e5a830d86761e355348bd0afa38e717e4f308e2a521b2085343bc3a0e84db0bb

Download Submit
\Windows\system\KvCJkMp.exe

Filesize
3.2MB

MD5
03ce0692ed2092e8745eb8862354dc97

SHA1
2d912f88bb4a6c4e5c36a66489afc1946b22765e

SHA256
4784a24bc10813068a28df99604ba01a9386b1352e610d02bf6d499856fd38a8

SHA512
94b5002449721a25f61668d4dafc4e8596e10ff5e847cad55f627245649527a76adb37ff59090288be11b96d71e465d5c18b516a565a1b83e462077e85f35789

Download Submit
\Windows\system\OkVDBDy.exe

Filesize
3.2MB

MD5
7052c54318622910b3f57a80849bc247

SHA1
0ac258e99e18b18bd963e99b8285144a6c9551b9

SHA256
827e958a7bf35e73f867863a85c1778c5eec341604468d2b72498715a95d0666

SHA512
f137a7205f7b451c17c27dbef3d463edc56f3b98452900b21908d2490af9339122691c185b5a13088355858995e1377a284bc911df9b72386e06b6e8d6875d6e

Download Submit
\Windows\system\PiPgLyH.exe

Filesize
3.2MB

MD5
e9858819ba2c972107fd1efd2bdab4e0

SHA1
1c474c23f2668688eb5193e3948f2af99184aee9

SHA256
8db494a39bff90a21f2d6616f8258bb5f400655032214dca8c70e2eefbf86c88

SHA512
445bee63c00104f2ec50438b18830c3f419fe5d01b9a92a47fbd5c99aa2e0b776e361c38f713f60bcc898ae1522ee6eccd563ede087b46b29cba876d6bc476b2

Download Submit
\Windows\system\WBZVgdZ.exe

Filesize
3.2MB

MD5
da6ee3381eaf7a2e18ec06aaa48449be

SHA1
ec9724da0d88154748f39551d7f5c3f024029015

SHA256
29625a2f0d69889095782ced62c22a195f34471e1bde09c5a4c081fbd83206e7

SHA512
489114727d47188f1f3efc0bb95fc34d226a9b95ce79325db766c9a9d406264df0dfcf799a632fafb7aaaaa991b82ca5176e133a9baf11cf86768ca0f66a5902

Download Submit
\Windows\system\WgdINpa.exe

Filesize
3.2MB

MD5
6d293572209d04a62ba8a563725cf370

SHA1
3f363565ecb44a11ea95c0f4202571a02bda69a1

SHA256
c424349621c70c39581880f0ef2458414c0a5e507fdf5a4e1c417b1f7cef46af

SHA512
e1dd8bd6870130e0bc11f15a56fbcfe769b5e92235e9d1ca8540bb22d04c75432bfb0e425d600ca7b2ed633bc88d825b1cef9d42787a8f5c8947fbe781d1b137

Download Submit
\Windows\system\bgXhpvR.exe

Filesize
3.2MB

MD5
19eae1038e1278bbb0b3a41f245ab760

SHA1
f841a05a883bee72864d431a22af98aea7e39988

SHA256
4a4c3e2f1aebf880ee5c0bc7b21ca0446aff5823e7ce9e37b5b60d9b6417437c

SHA512
21c7d3fc01a1eacc654ce93cbdc987a6b08c2edb069d959d06ec898aea75622e595a2c28dac7089e3b0c5b169adfeed6d23bb16cff7aa44b104762bb487cc79b

Download Submit
\Windows\system\cfVaUKf.exe

Filesize
3.2MB

MD5
1249d5cd0a0dec58ebfd5cfba8dfb89d

SHA1
ed9d26d56f6c9ce6bd89848abc3f9f5fbef028cc

SHA256
acf4c0faeb268e050ef85848368f31d1d849707e0646b2808465e1b6c720a113

SHA512
3466dd67e3faccf406bad6cba8764a1a0411de229b3e11883d484c170a2427a4499fb0227616d60323d6fb2f479021cf3652a3076277f437d6a0565bf4e25b43

Download Submit
\Windows\system\iCNOVJG.exe

Filesize
3.2MB

MD5
2b63ae3ba1cd1ac5ed6ade2dfd459e76

SHA1
714b6f175bb42b73f0b88e46ca6f9d89f8e0ef43

SHA256
dd7a8e5e501e50ac8a62257b6831247a2aa5991b70e19e3b04210ccb0f82b2b3

SHA512
03cd02b3c700a05293faff438397c37533ba67e965bcbc391bcf5e532b8a1dfe2607b90f1a785e449d58222058d0db9d2188e6462bd7e12259703b61c40a74a1

Download Submit
\Windows\system\mcgGYfN.exe

Filesize
3.2MB

MD5
410cabb31ac34997337e2836d2906516

SHA1
75e0e824613c1bf4ec20659b27ac84c57d20cc36

SHA256
d5c8dc5af4aeef67c25f9dfb2a96ed12b7a66f31f66745eef428169b45f4aefe

SHA512
fb24bb37ae13d134f5b47e191819c18b9969c9df31a84d9b6a9314fd546f5af8e65a1be1e3665b8417b695efd92cd25a675751436e20b50b31e77c50dca3c08a

Download Submit
\Windows\system\pWtuugu.exe

Filesize
3.2MB

MD5
bc2632d4522e8edbdd8d9314d76f34d8

SHA1
f331b3f75a16b4e3f059f1abfb6a30e2f8d431af

SHA256
c6ea79d22ca403b4ed54fdabe0075ed3ab4d4aa705a445b11d413c87b19d1811

SHA512
395374935091e57c19a52d1bb4c0705887b8b8ab0d314e8e97d8280823fdff98267616934f41e5a7ca0da1d56973f24c9ec63fcb8fa8fbe5c077e0cfad8a0a69

Download Submit
\Windows\system\qFTCHFO.exe

Filesize
3.2MB

MD5
848139d73b3a1a28ec7d27e50dc56bad

SHA1
6745bcd5bb6f97d4275046acb5488daefce4b909

SHA256
9a6eeff5881f874f910cd2761206873adccbe87b5362dc6d141bece497d59a0c

SHA512
0dbadd7c5b3ac472ef03013c987fec73d4aacdea37ffb5422a23fa6823bf66526ddbc9002288c943ed077a9b42e65f6b859719a65ef9937a005bdfd85e873fcc

Download Submit
\Windows\system\uCUhVYD.exe

Filesize
3.2MB

MD5
31f4243d97d2a9983fb543ac1aaa7027

SHA1
3163c042a3a37bc1ae83afbe6bebbaa5b7049c2d

SHA256
0752ab29db9605567e99d15fc612bce4ed2d35b62d6ff82620a7705965abd227

SHA512
9767811cfeec0e9d4d7b723b513660746eceb546c95f652867d22c4310e0aba0c4314deee39e3828f674fee4b8086969921a458ca2ad6d08cc15b85a6c659845

Download Submit
\Windows\system\uDhoGle.exe

Filesize
3.2MB

MD5
0a77b5dd66eafaa0e77a36f1a1fc93f1

SHA1
e80997c2f2359b442a0c36c7e271fdeb10c66a45

SHA256
7b27313a923f9a981e48d054385c2bbf63c5365e436793360fb3f8b6ff4ef495

SHA512
af78f472eda783925411ba1a7db7869c21a08602c9027c10bd72732f0e046ac09a9d06ef66a804fcf7857d7bc4e407544a3081402a09fa77e3f7beb0dc78061e

Download Submit
\Windows\system\xPNewHm.exe

Filesize
3.2MB

MD5
4a6ee3cfb69af356c0eb4f79dac78f63

SHA1
f0e40434dea2a2c92f0c62105e983c8d12d88297

SHA256
f60bfee0bbf509059dfd10bf7b5c717e7c44a0a9b2cc7d4d765b4dad90d4b08f

SHA512
bc3da2272a42ef0cef75bb2f39464a24d059d9295d7bfeac451dc7dbc605cc22c2c8437c48435cbf4557d92ff344aa5b0fb6d3e3d3bb776f7756cd9b355a79ad

Download Submit
\Windows\system\yEhQDyD.exe

Filesize
3.2MB

MD5
02497f13ce4092f90d4eca11828042c0

SHA1
918eb4cb41fb5e78cc8f19adc19458bdcaa28e7e

SHA256
73b6b14fa98d2d6f69f31454133c6459a3fa4c46eeea8e48967b24be7232ada4

SHA512
dfba544d512a7475d39589323d9a5fb8d3959986e1265fa330661fd8b5792acf76f4b7209625778e74937a4c2e0c5d1c9811b7cea3e93386a7e88d18e86afc8a

Download Submit
memory/1728-22-0x000007FEF5A1E000-0x000007FEF5A1F000-memory.dmp

Filesize
4KB

Download
memory/1728-110-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1728-35-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1728-99-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/1728-823-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1728-26-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1728-21-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/1728-114-0x0000000001F90000-0x0000000001F98000-memory.dmp

Filesize
32KB

Download
memory/1784-55-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2188-74-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2188-1-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-8724-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-42-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-19-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2188-76-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-102-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-100-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-56-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-49-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-37-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-8-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-72-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-2790-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2188-90-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2188-2857-0x0000000003390000-0x0000000003786000-memory.dmp

Filesize
4.0MB

Download
memory/2460-1052-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/2460-54-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/2460-8977-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/2524-9-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-8825-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2628-20-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2660-44-0x000000013F150000-0x000000013F546000-memory.dmp

Filesize
4.0MB

Download
memory/2692-43-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2708-40-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download
memory/2832-73-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2936-89-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2936-9016-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2976-70-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2988-8540-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2988-97-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2988-9018-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download