xmrig | 15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
Size 1.7MB
Sample240614-xp91saselc
SHA256 15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6
MD5 07edc8ffd1e112797e23097abb981bb3
SHA1 99501515adda6156677a9dcb859a9bb46c80208e
SHA512 1311ed545880e4676144291cfe90f7de3a89a80ad4514a973d545cc3f53aae38e3f3b05ec4bdc97f80f7df9f5152dc35e7b16163e6a1dc6ce0c2d905a4515cff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d93:Lz071uv4BPMkFfdk2auTqao/c/3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 11 IoCs

resource	yara_rule
behavioral1/memory/2808-186-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2592-188-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2588-177-0x000000013FDA0000-0x0000000140192000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2656-164-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/1972-4891-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2668-4893-0x000000013F410000-0x000000013F802000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2656-4899-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2592-4898-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2588-5048-0x000000013FDA0000-0x0000000140192000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2808-5038-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/2128-8920-0x000000013F2A0000-0x000000013F692000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 53 IoCs

resource	yara_rule
behavioral1/memory/2128-0-0x000000013F2A0000-0x000000013F692000-memory.dmp	UPX
behavioral1/files/0x000b0000000141a2-3.dat	UPX
behavioral1/files/0x00090000000143ec-11.dat	UPX
behavioral1/files/0x0008000000014539-10.dat	UPX
behavioral1/files/0x0007000000014667-20.dat	UPX
behavioral1/files/0x0006000000015018-64.dat	UPX
behavioral1/files/0x0007000000014af6-47.dat	UPX
behavioral1/files/0x0006000000015d27-176.dat	UPX
behavioral1/memory/2808-186-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	UPX
behavioral1/files/0x0006000000014b70-194.dat	UPX
behavioral1/files/0x0006000000015b6f-96.dat	UPX
behavioral1/files/0x0006000000015d0f-157.dat	UPX
behavioral1/files/0x0006000000015cfe-156.dat	UPX
behavioral1/files/0x0006000000015cee-155.dat	UPX
behavioral1/files/0x0006000000015cb6-154.dat	UPX
behavioral1/files/0x0006000000015c83-153.dat	UPX
behavioral1/files/0x0006000000015c6b-152.dat	UPX
behavioral1/files/0x0006000000015c3d-151.dat	UPX
behavioral1/files/0x0006000000015626-150.dat	UPX
behavioral1/files/0x0007000000015616-149.dat	UPX
behavioral1/files/0x00060000000155f3-148.dat	UPX
behavioral1/files/0x0006000000015d1a-138.dat	UPX
behavioral1/files/0x0006000000015d07-132.dat	UPX
behavioral1/files/0x0006000000015cf6-126.dat	UPX
behavioral1/files/0x0006000000015cce-120.dat	UPX
behavioral1/files/0x0006000000015c9f-114.dat	UPX
behavioral1/files/0x0006000000015c78-108.dat	UPX
behavioral1/files/0x0006000000015c52-102.dat	UPX
behavioral1/files/0x000f000000005578-90.dat	UPX
behavioral1/files/0x00060000000155f7-80.dat	UPX
behavioral1/files/0x0006000000014de9-75.dat	UPX
behavioral1/files/0x0006000000014b31-74.dat	UPX
behavioral1/files/0x0007000000014abe-73.dat	UPX
behavioral1/files/0x000b000000014825-72.dat	UPX
behavioral1/files/0x000a0000000146b8-70.dat	UPX
behavioral1/files/0x00060000000155ed-67.dat	UPX
behavioral1/files/0x0006000000014ef8-61.dat	UPX
behavioral1/memory/2592-188-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	UPX
behavioral1/memory/2588-177-0x000000013FDA0000-0x0000000140192000-memory.dmp	UPX
behavioral1/files/0x00070000000149f5-169.dat	UPX
behavioral1/files/0x00090000000146c0-167.dat	UPX
behavioral1/files/0x00070000000146a2-165.dat	UPX
behavioral1/memory/2656-164-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	UPX
behavioral1/memory/1972-24-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	UPX
behavioral1/memory/2668-19-0x000000013F410000-0x000000013F802000-memory.dmp	UPX
behavioral1/memory/3012-14-0x000000013FDA0000-0x0000000140192000-memory.dmp	UPX
behavioral1/memory/1972-4891-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	UPX
behavioral1/memory/2668-4893-0x000000013F410000-0x000000013F802000-memory.dmp	UPX
behavioral1/memory/2656-4899-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	UPX
behavioral1/memory/2592-4898-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	UPX
behavioral1/memory/2588-5048-0x000000013FDA0000-0x0000000140192000-memory.dmp	UPX
behavioral1/memory/2808-5038-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	UPX
behavioral1/memory/2128-8920-0x000000013F2A0000-0x000000013F692000-memory.dmp	UPX

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2808-186-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2128-189-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2592-188-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2588-177-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2656-164-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/1972-4891-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2668-4893-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2656-4899-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2592-4898-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2588-5048-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2808-5038-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2128-8920-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3012	kzhZMUi.exe
2668	oKaxLgI.exe
1972	yWdUHzx.exe
2656	COzodZx.exe
2588	wHmaeeg.exe
2808	oVQGSwE.exe
2592	IXSYrsr.exe
2452	vfYPDbk.exe
2624	LUmkYiW.exe
2088	VpgLoIr.exe
2876	cCCbAEQ.exe
2756	xPSzUjD.exe
1816	nzWUwMH.exe
2776	inNdZno.exe
2888	AQafrOB.exe
1820	XPuNWUj.exe
1272	aThtiug.exe
2916	YnZlPYf.exe
1300	zjHaHPq.exe
1860	opGlllv.exe
2648	coXMrac.exe
2616	BDQxwKY.exe
2700	gSSGChD.exe
668	ftGFGCo.exe
2000	bxKbcrq.exe
2508	utdQnkO.exe
2904	YQVGiyM.exe
1980	APFUMiO.exe
1392	OWucenH.exe
2824	roemEhd.exe
1464	FXUdoJX.exe
2864	VhBoqED.exe
2136	waGsucl.exe
2880	HVEQEQM.exe
1636	ODxgpXY.exe
1780	eNAvOsm.exe
2908	oZOBfpG.exe
856	XaFZixs.exe
1752	BTXkXZl.exe
692	utsKDQN.exe
1616	tTQkGKU.exe
1076	OobCgiA.exe
1612	CcmavLq.exe
792	JPSfGxC.exe
1540	YvHDmZn.exe
900	VGefVfv.exe
1868	dgUzEvU.exe
1596	mBpBaqq.exe
3064	YIqNIJr.exe
3000	vqCCZDu.exe
2484	dsLNtFf.exe
1668	FWipFhv.exe
1456	JxheREB.exe
632	wPrKwcY.exe
1180	dfdrQaz.exe
1812	DCEfIZG.exe
1684	euOztVG.exe
2216	chTomSQ.exe
656	DjkKJEP.exe
2208	exuHrzz.exe
2708	avHHzcm.exe
3080	hMbwicY.exe
3112	ybALXwt.exe
3144	VhVRxGH.exe

Loads dropped DLL 64 IoCs

pid	Process
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-0-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x000b0000000141a2-3.dat	upx
behavioral1/files/0x00090000000143ec-11.dat	upx
behavioral1/files/0x0008000000014539-10.dat	upx
behavioral1/files/0x0007000000014667-20.dat	upx
behavioral1/files/0x0006000000015018-64.dat	upx
behavioral1/files/0x0007000000014af6-47.dat	upx
behavioral1/files/0x0006000000015d27-176.dat	upx
behavioral1/memory/2808-186-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0006000000014b70-194.dat	upx
behavioral1/files/0x0006000000015b6f-96.dat	upx
behavioral1/files/0x0006000000015d0f-157.dat	upx
behavioral1/files/0x0006000000015cfe-156.dat	upx
behavioral1/files/0x0006000000015cee-155.dat	upx
behavioral1/files/0x0006000000015cb6-154.dat	upx
behavioral1/files/0x0006000000015c83-153.dat	upx
behavioral1/files/0x0006000000015c6b-152.dat	upx
behavioral1/files/0x0006000000015c3d-151.dat	upx
behavioral1/files/0x0006000000015626-150.dat	upx
behavioral1/files/0x0007000000015616-149.dat	upx
behavioral1/files/0x00060000000155f3-148.dat	upx
behavioral1/files/0x0006000000015d1a-138.dat	upx
behavioral1/files/0x0006000000015d07-132.dat	upx
behavioral1/files/0x0006000000015cf6-126.dat	upx
behavioral1/files/0x0006000000015cce-120.dat	upx
behavioral1/files/0x0006000000015c9f-114.dat	upx
behavioral1/files/0x0006000000015c78-108.dat	upx
behavioral1/files/0x0006000000015c52-102.dat	upx
behavioral1/files/0x000f000000005578-90.dat	upx
behavioral1/files/0x00060000000155f7-80.dat	upx
behavioral1/files/0x0006000000014de9-75.dat	upx
behavioral1/files/0x0006000000014b31-74.dat	upx
behavioral1/files/0x0007000000014abe-73.dat	upx
behavioral1/files/0x000b000000014825-72.dat	upx
behavioral1/files/0x000a0000000146b8-70.dat	upx
behavioral1/files/0x00060000000155ed-67.dat	upx
behavioral1/files/0x0006000000014ef8-61.dat	upx
behavioral1/memory/2592-188-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2588-177-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x00070000000149f5-169.dat	upx
behavioral1/files/0x00090000000146c0-167.dat	upx
behavioral1/files/0x00070000000146a2-165.dat	upx
behavioral1/memory/2656-164-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/1972-24-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2668-19-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/3012-14-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2128-4-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/1972-4891-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2668-4893-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2656-4899-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2592-4898-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2588-5048-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2808-5038-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2128-8920-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HgUbgwr.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\VQRQZmP.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\jJZRgPc.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\eKFkIbB.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\LLqCUeP.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\orkkZKd.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\QQwKvlV.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\EDADcpF.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\AibevrS.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\BjuriXx.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\wGXDXLa.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\mBgBymG.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\tnrhrPO.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\qYlIFyH.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\LBjACyr.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\txqpSjF.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\SUXMRbY.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\zcluQBA.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\obAWddZ.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\genEelj.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\QocWOKM.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\pxnYDHq.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\kNwcjrw.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\hZRtEoL.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\YqbTEoN.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\qjmmDng.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\rNlGnyD.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\yzCKbrt.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\PoapqEq.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\WxQGblZ.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\CKkSQJB.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\aliSVVi.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\UsEUSpz.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\faeSEWJ.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\qAXEnsZ.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\NhvYtOk.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\mHniPKm.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\OyRHjAv.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\ZTrNGLV.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\ySihpdj.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\DYTQFow.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\FGiWoWk.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\ifOlVYY.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\ePJcnjD.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\kMlZYAc.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\gYrPYEz.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\XoFEWsP.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\UJNqHSi.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\EevOYdS.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\IzAjzCv.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\ZLsPVVE.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\xkHSEGg.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\GStVqHD.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\BYEKMfp.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\kiAnSGS.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\bZbGTMV.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\YPiGrTe.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\IeVKMHi.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\injAZdu.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\FGeiRYm.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\PlXZrkn.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\vcjYlTu.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\QvQzhss.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
File created	C:\Windows\System\Bftvhko.exe	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
Token: SeLockMemoryPrivilege	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2996	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	29
PID 2128 wrote to memory of 2996	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	29
PID 2128 wrote to memory of 2996	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	29
PID 2128 wrote to memory of 3012	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	30
PID 2128 wrote to memory of 3012	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	30
PID 2128 wrote to memory of 3012	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	30
PID 2128 wrote to memory of 2668	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	31
PID 2128 wrote to memory of 2668	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	31
PID 2128 wrote to memory of 2668	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	31
PID 2128 wrote to memory of 1972	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	32
PID 2128 wrote to memory of 1972	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	32
PID 2128 wrote to memory of 1972	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	32
PID 2128 wrote to memory of 2656	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	33
PID 2128 wrote to memory of 2656	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	33
PID 2128 wrote to memory of 2656	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	33
PID 2128 wrote to memory of 2648	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	34
PID 2128 wrote to memory of 2648	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	34
PID 2128 wrote to memory of 2648	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	34
PID 2128 wrote to memory of 2588	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	35
PID 2128 wrote to memory of 2588	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	35
PID 2128 wrote to memory of 2588	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	35
PID 2128 wrote to memory of 2616	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	36
PID 2128 wrote to memory of 2616	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	36
PID 2128 wrote to memory of 2616	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	36
PID 2128 wrote to memory of 2808	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	37
PID 2128 wrote to memory of 2808	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	37
PID 2128 wrote to memory of 2808	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	37
PID 2128 wrote to memory of 2700	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	38
PID 2128 wrote to memory of 2700	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	38
PID 2128 wrote to memory of 2700	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	38
PID 2128 wrote to memory of 2592	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	39
PID 2128 wrote to memory of 2592	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	39
PID 2128 wrote to memory of 2592	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	39
PID 2128 wrote to memory of 2000	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	40
PID 2128 wrote to memory of 2000	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	40
PID 2128 wrote to memory of 2000	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	40
PID 2128 wrote to memory of 2452	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	41
PID 2128 wrote to memory of 2452	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	41
PID 2128 wrote to memory of 2452	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	41
PID 2128 wrote to memory of 2508	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	42
PID 2128 wrote to memory of 2508	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	42
PID 2128 wrote to memory of 2508	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	42
PID 2128 wrote to memory of 2624	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	43
PID 2128 wrote to memory of 2624	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	43
PID 2128 wrote to memory of 2624	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	43
PID 2128 wrote to memory of 2904	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	44
PID 2128 wrote to memory of 2904	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	44
PID 2128 wrote to memory of 2904	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	44
PID 2128 wrote to memory of 2088	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	45
PID 2128 wrote to memory of 2088	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	45
PID 2128 wrote to memory of 2088	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	45
PID 2128 wrote to memory of 1980	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	46
PID 2128 wrote to memory of 1980	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	46
PID 2128 wrote to memory of 1980	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	46
PID 2128 wrote to memory of 2876	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	47
PID 2128 wrote to memory of 2876	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	47
PID 2128 wrote to memory of 2876	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	47
PID 2128 wrote to memory of 1392	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	48
PID 2128 wrote to memory of 1392	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	48
PID 2128 wrote to memory of 1392	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	48
PID 2128 wrote to memory of 2756	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	49
PID 2128 wrote to memory of 2756	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	49
PID 2128 wrote to memory of 2756	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	49
PID 2128 wrote to memory of 2824	2128	15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe	50

C:\Users\Admin\AppData\Local\Temp\15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe
"C:\Users\Admin\AppData\Local\Temp\15ca70b66d443ad16db13fab72d794f4f7859fe6c81f53f81ae62a1be11e0ff6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System\kzhZMUi.exe
  C:\Windows\System\kzhZMUi.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\oKaxLgI.exe
  C:\Windows\System\oKaxLgI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\yWdUHzx.exe
  C:\Windows\System\yWdUHzx.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\COzodZx.exe
  C:\Windows\System\COzodZx.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\coXMrac.exe
  C:\Windows\System\coXMrac.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\wHmaeeg.exe
  C:\Windows\System\wHmaeeg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\BDQxwKY.exe
  C:\Windows\System\BDQxwKY.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\oVQGSwE.exe
  C:\Windows\System\oVQGSwE.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\gSSGChD.exe
  C:\Windows\System\gSSGChD.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\IXSYrsr.exe
  C:\Windows\System\IXSYrsr.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bxKbcrq.exe
  C:\Windows\System\bxKbcrq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\vfYPDbk.exe
  C:\Windows\System\vfYPDbk.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\utdQnkO.exe
  C:\Windows\System\utdQnkO.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\LUmkYiW.exe
  C:\Windows\System\LUmkYiW.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\YQVGiyM.exe
  C:\Windows\System\YQVGiyM.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\VpgLoIr.exe
  C:\Windows\System\VpgLoIr.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\APFUMiO.exe
  C:\Windows\System\APFUMiO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\cCCbAEQ.exe
  C:\Windows\System\cCCbAEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\OWucenH.exe
  C:\Windows\System\OWucenH.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\xPSzUjD.exe
  C:\Windows\System\xPSzUjD.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\roemEhd.exe
  C:\Windows\System\roemEhd.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\nzWUwMH.exe
  C:\Windows\System\nzWUwMH.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\FXUdoJX.exe
  C:\Windows\System\FXUdoJX.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\inNdZno.exe
  C:\Windows\System\inNdZno.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\VhBoqED.exe
  C:\Windows\System\VhBoqED.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\AQafrOB.exe
  C:\Windows\System\AQafrOB.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\HVEQEQM.exe
  C:\Windows\System\HVEQEQM.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\XPuNWUj.exe
  C:\Windows\System\XPuNWUj.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\ODxgpXY.exe
  C:\Windows\System\ODxgpXY.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\aThtiug.exe
  C:\Windows\System\aThtiug.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\eNAvOsm.exe
  C:\Windows\System\eNAvOsm.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\YnZlPYf.exe
  C:\Windows\System\YnZlPYf.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\oZOBfpG.exe
  C:\Windows\System\oZOBfpG.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\zjHaHPq.exe
  C:\Windows\System\zjHaHPq.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\XaFZixs.exe
  C:\Windows\System\XaFZixs.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\opGlllv.exe
  C:\Windows\System\opGlllv.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\BTXkXZl.exe
  C:\Windows\System\BTXkXZl.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\ftGFGCo.exe
  C:\Windows\System\ftGFGCo.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\tTQkGKU.exe
  C:\Windows\System\tTQkGKU.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\waGsucl.exe
  C:\Windows\System\waGsucl.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OobCgiA.exe
  C:\Windows\System\OobCgiA.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\utsKDQN.exe
  C:\Windows\System\utsKDQN.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\CcmavLq.exe
  C:\Windows\System\CcmavLq.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\JPSfGxC.exe
  C:\Windows\System\JPSfGxC.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\Mvemyqr.exe
  C:\Windows\System\Mvemyqr.exe
  2⤵
  PID:2972
- C:\Windows\System\YvHDmZn.exe
  C:\Windows\System\YvHDmZn.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\Furespf.exe
  C:\Windows\System\Furespf.exe
  2⤵
  PID:1776
- C:\Windows\System\VGefVfv.exe
  C:\Windows\System\VGefVfv.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\wwUwtAy.exe
  C:\Windows\System\wwUwtAy.exe
  2⤵
  PID:860
- C:\Windows\System\dgUzEvU.exe
  C:\Windows\System\dgUzEvU.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\MIzDCqU.exe
  C:\Windows\System\MIzDCqU.exe
  2⤵
  PID:2960
- C:\Windows\System\mBpBaqq.exe
  C:\Windows\System\mBpBaqq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\YRETEqb.exe
  C:\Windows\System\YRETEqb.exe
  2⤵
  PID:1600
- C:\Windows\System\YIqNIJr.exe
  C:\Windows\System\YIqNIJr.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\HhgmDRH.exe
  C:\Windows\System\HhgmDRH.exe
  2⤵
  PID:2324
- C:\Windows\System\vqCCZDu.exe
  C:\Windows\System\vqCCZDu.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\TyTXvbL.exe
  C:\Windows\System\TyTXvbL.exe
  2⤵
  PID:1132
- C:\Windows\System\dsLNtFf.exe
  C:\Windows\System\dsLNtFf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\hBDKFQA.exe
  C:\Windows\System\hBDKFQA.exe
  2⤵
  PID:2488
- C:\Windows\System\FWipFhv.exe
  C:\Windows\System\FWipFhv.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\gOjOctH.exe
  C:\Windows\System\gOjOctH.exe
  2⤵
  PID:2884
- C:\Windows\System\JxheREB.exe
  C:\Windows\System\JxheREB.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\BmFfZVA.exe
  C:\Windows\System\BmFfZVA.exe
  2⤵
  PID:2816
- C:\Windows\System\wPrKwcY.exe
  C:\Windows\System\wPrKwcY.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\vaVVStn.exe
  C:\Windows\System\vaVVStn.exe
  2⤵
  PID:1560
- C:\Windows\System\dfdrQaz.exe
  C:\Windows\System\dfdrQaz.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\qCfTKXK.exe
  C:\Windows\System\qCfTKXK.exe
  2⤵
  PID:1844
- C:\Windows\System\DCEfIZG.exe
  C:\Windows\System\DCEfIZG.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\HQGIgTt.exe
  C:\Windows\System\HQGIgTt.exe
  2⤵
  PID:2432
- C:\Windows\System\euOztVG.exe
  C:\Windows\System\euOztVG.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xRGfBtg.exe
  C:\Windows\System\xRGfBtg.exe
  2⤵
  PID:384
- C:\Windows\System\chTomSQ.exe
  C:\Windows\System\chTomSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\dGXndZH.exe
  C:\Windows\System\dGXndZH.exe
  2⤵
  PID:2580
- C:\Windows\System\DjkKJEP.exe
  C:\Windows\System\DjkKJEP.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\IZOAumd.exe
  C:\Windows\System\IZOAumd.exe
  2⤵
  PID:2080
- C:\Windows\System\exuHrzz.exe
  C:\Windows\System\exuHrzz.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\poFtWAE.exe
  C:\Windows\System\poFtWAE.exe
  2⤵
  PID:1704
- C:\Windows\System\avHHzcm.exe
  C:\Windows\System\avHHzcm.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\YBGZDyE.exe
  C:\Windows\System\YBGZDyE.exe
  2⤵
  PID:2784
- C:\Windows\System\hMbwicY.exe
  C:\Windows\System\hMbwicY.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\HmofijG.exe
  C:\Windows\System\HmofijG.exe
  2⤵
  PID:3096
- C:\Windows\System\ybALXwt.exe
  C:\Windows\System\ybALXwt.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\wYYQtzK.exe
  C:\Windows\System\wYYQtzK.exe
  2⤵
  PID:3128
- C:\Windows\System\VhVRxGH.exe
  C:\Windows\System\VhVRxGH.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\gLJDGjh.exe
  C:\Windows\System\gLJDGjh.exe
  2⤵
  PID:3160
- C:\Windows\System\HXOGqML.exe
  C:\Windows\System\HXOGqML.exe
  2⤵
  PID:3176
- C:\Windows\System\nuPNeGS.exe
  C:\Windows\System\nuPNeGS.exe
  2⤵
  PID:3192
- C:\Windows\System\qoZEnbg.exe
  C:\Windows\System\qoZEnbg.exe
  2⤵
  PID:3208
- C:\Windows\System\cuPSqRX.exe
  C:\Windows\System\cuPSqRX.exe
  2⤵
  PID:3224
- C:\Windows\System\UScQsAL.exe
  C:\Windows\System\UScQsAL.exe
  2⤵
  PID:3240
- C:\Windows\System\UWcPdBt.exe
  C:\Windows\System\UWcPdBt.exe
  2⤵
  PID:3256
- C:\Windows\System\oeBzjSJ.exe
  C:\Windows\System\oeBzjSJ.exe
  2⤵
  PID:3272
- C:\Windows\System\YSHvPIH.exe
  C:\Windows\System\YSHvPIH.exe
  2⤵
  PID:3288
- C:\Windows\System\LMbfKhb.exe
  C:\Windows\System\LMbfKhb.exe
  2⤵
  PID:3304
- C:\Windows\System\MOJDLBA.exe
  C:\Windows\System\MOJDLBA.exe
  2⤵
  PID:3320
- C:\Windows\System\aBVbmAs.exe
  C:\Windows\System\aBVbmAs.exe
  2⤵
  PID:3336
- C:\Windows\System\DOiCnxS.exe
  C:\Windows\System\DOiCnxS.exe
  2⤵
  PID:3352
- C:\Windows\System\abBWLul.exe
  C:\Windows\System\abBWLul.exe
  2⤵
  PID:3368
- C:\Windows\System\gNaGjab.exe
  C:\Windows\System\gNaGjab.exe
  2⤵
  PID:3384
- C:\Windows\System\BuAVOki.exe
  C:\Windows\System\BuAVOki.exe
  2⤵
  PID:3400
- C:\Windows\System\unhMEFK.exe
  C:\Windows\System\unhMEFK.exe
  2⤵
  PID:3416
- C:\Windows\System\dPEqCAA.exe
  C:\Windows\System\dPEqCAA.exe
  2⤵
  PID:3432
- C:\Windows\System\IFVEemz.exe
  C:\Windows\System\IFVEemz.exe
  2⤵
  PID:3448
- C:\Windows\System\WOPLJzE.exe
  C:\Windows\System\WOPLJzE.exe
  2⤵
  PID:3464
- C:\Windows\System\tkvBLMd.exe
  C:\Windows\System\tkvBLMd.exe
  2⤵
  PID:3480
- C:\Windows\System\IOycBOy.exe
  C:\Windows\System\IOycBOy.exe
  2⤵
  PID:3496
- C:\Windows\System\rBjOKsr.exe
  C:\Windows\System\rBjOKsr.exe
  2⤵
  PID:3512
- C:\Windows\System\SNjyKDl.exe
  C:\Windows\System\SNjyKDl.exe
  2⤵
  PID:3528
- C:\Windows\System\UBAIgaR.exe
  C:\Windows\System\UBAIgaR.exe
  2⤵
  PID:3544
- C:\Windows\System\GLjtIvT.exe
  C:\Windows\System\GLjtIvT.exe
  2⤵
  PID:3560
- C:\Windows\System\OVOiqJd.exe
  C:\Windows\System\OVOiqJd.exe
  2⤵
  PID:3576
- C:\Windows\System\UupvMFi.exe
  C:\Windows\System\UupvMFi.exe
  2⤵
  PID:3592
- C:\Windows\System\BtALAxw.exe
  C:\Windows\System\BtALAxw.exe
  2⤵
  PID:3608
- C:\Windows\System\nxsFmTT.exe
  C:\Windows\System\nxsFmTT.exe
  2⤵
  PID:3624
- C:\Windows\System\TFcATpq.exe
  C:\Windows\System\TFcATpq.exe
  2⤵
  PID:3640
- C:\Windows\System\PlhQljw.exe
  C:\Windows\System\PlhQljw.exe
  2⤵
  PID:3656
- C:\Windows\System\gyocmWQ.exe
  C:\Windows\System\gyocmWQ.exe
  2⤵
  PID:3672
- C:\Windows\System\QrLIoYh.exe
  C:\Windows\System\QrLIoYh.exe
  2⤵
  PID:3688
- C:\Windows\System\gIthEDi.exe
  C:\Windows\System\gIthEDi.exe
  2⤵
  PID:3704
- C:\Windows\System\gmFrdrN.exe
  C:\Windows\System\gmFrdrN.exe
  2⤵
  PID:3720
- C:\Windows\System\VAoZPme.exe
  C:\Windows\System\VAoZPme.exe
  2⤵
  PID:3736
- C:\Windows\System\pPVSved.exe
  C:\Windows\System\pPVSved.exe
  2⤵
  PID:3752
- C:\Windows\System\HsHqEUL.exe
  C:\Windows\System\HsHqEUL.exe
  2⤵
  PID:3768
- C:\Windows\System\MZLSWIR.exe
  C:\Windows\System\MZLSWIR.exe
  2⤵
  PID:3784
- C:\Windows\System\IJaONFx.exe
  C:\Windows\System\IJaONFx.exe
  2⤵
  PID:3800
- C:\Windows\System\ViyOUUQ.exe
  C:\Windows\System\ViyOUUQ.exe
  2⤵
  PID:3816
- C:\Windows\System\zpvAnFJ.exe
  C:\Windows\System\zpvAnFJ.exe
  2⤵
  PID:3832
- C:\Windows\System\ebHDAGO.exe
  C:\Windows\System\ebHDAGO.exe
  2⤵
  PID:3848
- C:\Windows\System\jGSkfJp.exe
  C:\Windows\System\jGSkfJp.exe
  2⤵
  PID:3980
- C:\Windows\System\uLFJKGl.exe
  C:\Windows\System\uLFJKGl.exe
  2⤵
  PID:3216
- C:\Windows\System\ZEyOhIM.exe
  C:\Windows\System\ZEyOhIM.exe
  2⤵
  PID:3312
- C:\Windows\System\kqXLSXW.exe
  C:\Windows\System\kqXLSXW.exe
  2⤵
  PID:3440
- C:\Windows\System\EqwYJRj.exe
  C:\Windows\System\EqwYJRj.exe
  2⤵
  PID:2772
- C:\Windows\System\FbMZuzc.exe
  C:\Windows\System\FbMZuzc.exe
  2⤵
  PID:2296
- C:\Windows\System\aUOdFDj.exe
  C:\Windows\System\aUOdFDj.exe
  2⤵
  PID:1148
- C:\Windows\System\YgSVvWm.exe
  C:\Windows\System\YgSVvWm.exe
  2⤵
  PID:1352
- C:\Windows\System\HLGRgzc.exe
  C:\Windows\System\HLGRgzc.exe
  2⤵
  PID:3508
- C:\Windows\System\hujYMZd.exe
  C:\Windows\System\hujYMZd.exe
  2⤵
  PID:3600
- C:\Windows\System\sMnguqL.exe
  C:\Windows\System\sMnguqL.exe
  2⤵
  PID:3668
- C:\Windows\System\ZYSEjCy.exe
  C:\Windows\System\ZYSEjCy.exe
  2⤵
  PID:3760
- C:\Windows\System\eqcNTkh.exe
  C:\Windows\System\eqcNTkh.exe
  2⤵
  PID:3792
- C:\Windows\System\bbiYFUG.exe
  C:\Windows\System\bbiYFUG.exe
  2⤵
  PID:2060
- C:\Windows\System\qiidXhl.exe
  C:\Windows\System\qiidXhl.exe
  2⤵
  PID:1880
- C:\Windows\System\IRKMFvA.exe
  C:\Windows\System\IRKMFvA.exe
  2⤵
  PID:976
- C:\Windows\System\MqtXjMx.exe
  C:\Windows\System\MqtXjMx.exe
  2⤵
  PID:2532
- C:\Windows\System\KsmrMMb.exe
  C:\Windows\System\KsmrMMb.exe
  2⤵
  PID:2556
- C:\Windows\System\YlHfcuH.exe
  C:\Windows\System\YlHfcuH.exe
  2⤵
  PID:2688
- C:\Windows\System\qblFZjE.exe
  C:\Windows\System\qblFZjE.exe
  2⤵
  PID:2760
- C:\Windows\System\QVszJVb.exe
  C:\Windows\System\QVszJVb.exe
  2⤵
  PID:1548
- C:\Windows\System\XLslTGH.exe
  C:\Windows\System\XLslTGH.exe
  2⤵
  PID:2108
- C:\Windows\System\vWTSzpg.exe
  C:\Windows\System\vWTSzpg.exe
  2⤵
  PID:1976
- C:\Windows\System\xbmvyTL.exe
  C:\Windows\System\xbmvyTL.exe
  2⤵
  PID:336
- C:\Windows\System\EkaTauS.exe
  C:\Windows\System\EkaTauS.exe
  2⤵
  PID:1720
- C:\Windows\System\PHVASPW.exe
  C:\Windows\System\PHVASPW.exe
  2⤵
  PID:2104
- C:\Windows\System\JnECsnt.exe
  C:\Windows\System\JnECsnt.exe
  2⤵
  PID:1348
- C:\Windows\System\exlScKL.exe
  C:\Windows\System\exlScKL.exe
  2⤵
  PID:2720
- C:\Windows\System\xhsYaNw.exe
  C:\Windows\System\xhsYaNw.exe
  2⤵
  PID:3140
- C:\Windows\System\aViaoCy.exe
  C:\Windows\System\aViaoCy.exe
  2⤵
  PID:3204
- C:\Windows\System\HgrFiVC.exe
  C:\Windows\System\HgrFiVC.exe
  2⤵
  PID:3392
- C:\Windows\System\LzlMfEf.exe
  C:\Windows\System\LzlMfEf.exe
  2⤵
  PID:3616
- C:\Windows\System\jUMShsZ.exe
  C:\Windows\System\jUMShsZ.exe
  2⤵
  PID:3712
- C:\Windows\System\wKPxrFi.exe
  C:\Windows\System\wKPxrFi.exe
  2⤵
  PID:3868
- C:\Windows\System\VSWTQyd.exe
  C:\Windows\System\VSWTQyd.exe
  2⤵
  PID:3892
- C:\Windows\System\IloeSec.exe
  C:\Windows\System\IloeSec.exe
  2⤵
  PID:3912
- C:\Windows\System\vffrydW.exe
  C:\Windows\System\vffrydW.exe
  2⤵
  PID:3928
- C:\Windows\System\pmDZNKZ.exe
  C:\Windows\System\pmDZNKZ.exe
  2⤵
  PID:3944
- C:\Windows\System\UAoiOpn.exe
  C:\Windows\System\UAoiOpn.exe
  2⤵
  PID:3964
- C:\Windows\System\zUcNkKd.exe
  C:\Windows\System\zUcNkKd.exe
  2⤵
  PID:3248
- C:\Windows\System\iZRmRgd.exe
  C:\Windows\System\iZRmRgd.exe
  2⤵
  PID:2212
- C:\Windows\System\mLtBNdp.exe
  C:\Windows\System\mLtBNdp.exe
  2⤵
  PID:568
- C:\Windows\System\GxIGmGy.exe
  C:\Windows\System\GxIGmGy.exe
  2⤵
  PID:1680
- C:\Windows\System\UwaWhXI.exe
  C:\Windows\System\UwaWhXI.exe
  2⤵
  PID:2420
- C:\Windows\System\LatiwSt.exe
  C:\Windows\System\LatiwSt.exe
  2⤵
  PID:2492
- C:\Windows\System\hgZIVlP.exe
  C:\Windows\System\hgZIVlP.exe
  2⤵
  PID:2496
- C:\Windows\System\QlWLkTv.exe
  C:\Windows\System\QlWLkTv.exe
  2⤵
  PID:3236
- C:\Windows\System\HBwrkjG.exe
  C:\Windows\System\HBwrkjG.exe
  2⤵
  PID:3332
- C:\Windows\System\eUaMCkG.exe
  C:\Windows\System\eUaMCkG.exe
  2⤵
  PID:3428
- C:\Windows\System\FdIPxsB.exe
  C:\Windows\System\FdIPxsB.exe
  2⤵
  PID:3524
- C:\Windows\System\WZcwNmi.exe
  C:\Windows\System\WZcwNmi.exe
  2⤵
  PID:3620
- C:\Windows\System\ACiEfsH.exe
  C:\Windows\System\ACiEfsH.exe
  2⤵
  PID:4036
- C:\Windows\System\ghvNZez.exe
  C:\Windows\System\ghvNZez.exe
  2⤵
  PID:4076
- C:\Windows\System\ptmQmGo.exe
  C:\Windows\System\ptmQmGo.exe
  2⤵
  PID:4092
- C:\Windows\System\mdVNBsJ.exe
  C:\Windows\System\mdVNBsJ.exe
  2⤵
  PID:1104
- C:\Windows\System\tNkMPvf.exe
  C:\Windows\System\tNkMPvf.exe
  2⤵
  PID:1064
- C:\Windows\System\vqGkqwa.exe
  C:\Windows\System\vqGkqwa.exe
  2⤵
  PID:2256
- C:\Windows\System\zhyCqHa.exe
  C:\Windows\System\zhyCqHa.exe
  2⤵
  PID:2340
- C:\Windows\System\nKHFPAL.exe
  C:\Windows\System\nKHFPAL.exe
  2⤵
  PID:2928
- C:\Windows\System\stLsyij.exe
  C:\Windows\System\stLsyij.exe
  2⤵
  PID:3156
- C:\Windows\System\LaqmWfZ.exe
  C:\Windows\System\LaqmWfZ.exe
  2⤵
  PID:3776
- C:\Windows\System\KfsEGnD.exe
  C:\Windows\System\KfsEGnD.exe
  2⤵
  PID:3840
- C:\Windows\System\DlnuYsJ.exe
  C:\Windows\System\DlnuYsJ.exe
  2⤵
  PID:2920
- C:\Windows\System\bhMoZdX.exe
  C:\Windows\System\bhMoZdX.exe
  2⤵
  PID:3104
- C:\Windows\System\XCdsjvv.exe
  C:\Windows\System\XCdsjvv.exe
  2⤵
  PID:4004
- C:\Windows\System\RBtOSFp.exe
  C:\Windows\System\RBtOSFp.exe
  2⤵
  PID:4032
- C:\Windows\System\TkUxJhJ.exe
  C:\Windows\System\TkUxJhJ.exe
  2⤵
  PID:4056
- C:\Windows\System\LDMdAsj.exe
  C:\Windows\System\LDMdAsj.exe
  2⤵
  PID:3380
- C:\Windows\System\hWivUwT.exe
  C:\Windows\System\hWivUwT.exe
  2⤵
  PID:2536
- C:\Windows\System\ZwlhKMW.exe
  C:\Windows\System\ZwlhKMW.exe
  2⤵
  PID:2052
- C:\Windows\System\FPIehXn.exe
  C:\Windows\System\FPIehXn.exe
  2⤵
  PID:2184
- C:\Windows\System\apNVRJW.exe
  C:\Windows\System\apNVRJW.exe
  2⤵
  PID:1796
- C:\Windows\System\KIfESpF.exe
  C:\Windows\System\KIfESpF.exe
  2⤵
  PID:3540
- C:\Windows\System\XcqFEyd.exe
  C:\Windows\System\XcqFEyd.exe
  2⤵
  PID:3568
- C:\Windows\System\DZwYzSw.exe
  C:\Windows\System\DZwYzSw.exe
  2⤵
  PID:2528
- C:\Windows\System\GLkvVXB.exe
  C:\Windows\System\GLkvVXB.exe
  2⤵
  PID:2512
- C:\Windows\System\nmoIxQA.exe
  C:\Windows\System\nmoIxQA.exe
  2⤵
  PID:2628
- C:\Windows\System\UsnqKWu.exe
  C:\Windows\System\UsnqKWu.exe
  2⤵
  PID:2524
- C:\Windows\System\kpnHSSp.exe
  C:\Windows\System\kpnHSSp.exe
  2⤵
  PID:2848
- C:\Windows\System\ZSlolAx.exe
  C:\Windows\System\ZSlolAx.exe
  2⤵
  PID:2856
- C:\Windows\System\CSQsPmR.exe
  C:\Windows\System\CSQsPmR.exe
  2⤵
  PID:2612
- C:\Windows\System\ZXEepRo.exe
  C:\Windows\System\ZXEepRo.exe
  2⤵
  PID:1096
- C:\Windows\System\kARVxnO.exe
  C:\Windows\System\kARVxnO.exe
  2⤵
  PID:1716
- C:\Windows\System\EqkKxKF.exe
  C:\Windows\System\EqkKxKF.exe
  2⤵
  PID:2020
- C:\Windows\System\UNkscoL.exe
  C:\Windows\System\UNkscoL.exe
  2⤵
  PID:3076
- C:\Windows\System\URsKbnz.exe
  C:\Windows\System\URsKbnz.exe
  2⤵
  PID:3328
- C:\Windows\System\TjidbXT.exe
  C:\Windows\System\TjidbXT.exe
  2⤵
  PID:3876
- C:\Windows\System\MKrlmYn.exe
  C:\Windows\System\MKrlmYn.exe
  2⤵
  PID:3920
- C:\Windows\System\uuLpkJe.exe
  C:\Windows\System\uuLpkJe.exe
  2⤵
  PID:3956
- C:\Windows\System\liLQdWU.exe
  C:\Windows\System\liLQdWU.exe
  2⤵
  PID:1992
- C:\Windows\System\tdzBABm.exe
  C:\Windows\System\tdzBABm.exe
  2⤵
  PID:1732
- C:\Windows\System\JikULOd.exe
  C:\Windows\System\JikULOd.exe
  2⤵
  PID:3396
- C:\Windows\System\qJySqjw.exe
  C:\Windows\System\qJySqjw.exe
  2⤵
  PID:4064
- C:\Windows\System\GDwGqWt.exe
  C:\Windows\System\GDwGqWt.exe
  2⤵
  PID:2372
- C:\Windows\System\DihsVzN.exe
  C:\Windows\System\DihsVzN.exe
  2⤵
  PID:2144
- C:\Windows\System\sqmVEpI.exe
  C:\Windows\System\sqmVEpI.exe
  2⤵
  PID:936
- C:\Windows\System\ovhrDRJ.exe
  C:\Windows\System\ovhrDRJ.exe
  2⤵
  PID:3908
- C:\Windows\System\lYxkFiF.exe
  C:\Windows\System\lYxkFiF.exe
  2⤵
  PID:3036
- C:\Windows\System\keXHfMA.exe
  C:\Windows\System\keXHfMA.exe
  2⤵
  PID:2968
- C:\Windows\System\TciVVCH.exe
  C:\Windows\System\TciVVCH.exe
  2⤵
  PID:3716
- C:\Windows\System\sJmTimn.exe
  C:\Windows\System\sJmTimn.exe
  2⤵
  PID:3748
- C:\Windows\System\tRBpahl.exe
  C:\Windows\System\tRBpahl.exe
  2⤵
  PID:3996
- C:\Windows\System\hglVZXz.exe
  C:\Windows\System\hglVZXz.exe
  2⤵
  PID:2792
- C:\Windows\System\DhFUArA.exe
  C:\Windows\System\DhFUArA.exe
  2⤵
  PID:3504
- C:\Windows\System\rvpIWuy.exe
  C:\Windows\System\rvpIWuy.exe
  2⤵
  PID:1580
- C:\Windows\System\fFceaYe.exe
  C:\Windows\System\fFceaYe.exe
  2⤵
  PID:980
- C:\Windows\System\ZAYSIUn.exe
  C:\Windows\System\ZAYSIUn.exe
  2⤵
  PID:1324
- C:\Windows\System\TorsPiX.exe
  C:\Windows\System\TorsPiX.exe
  2⤵
  PID:2860
- C:\Windows\System\SlXvYfn.exe
  C:\Windows\System\SlXvYfn.exe
  2⤵
  PID:1856
- C:\Windows\System\tdhpSIj.exe
  C:\Windows\System\tdhpSIj.exe
  2⤵
  PID:3584
- C:\Windows\System\nSZhMEO.exe
  C:\Windows\System\nSZhMEO.exe
  2⤵
  PID:1724
- C:\Windows\System\kHQmJil.exe
  C:\Windows\System\kHQmJil.exe
  2⤵
  PID:4104
- C:\Windows\System\FGiWoWk.exe
  C:\Windows\System\FGiWoWk.exe
  2⤵
  PID:4120
- C:\Windows\System\KHMEppc.exe
  C:\Windows\System\KHMEppc.exe
  2⤵
  PID:4136
- C:\Windows\System\rwBJYic.exe
  C:\Windows\System\rwBJYic.exe
  2⤵
  PID:4152
- C:\Windows\System\zbKrruG.exe
  C:\Windows\System\zbKrruG.exe
  2⤵
  PID:4312
- C:\Windows\System\PGidyPU.exe
  C:\Windows\System\PGidyPU.exe
  2⤵
  PID:4328
- C:\Windows\System\DBfKEGe.exe
  C:\Windows\System\DBfKEGe.exe
  2⤵
  PID:4344
- C:\Windows\System\Wuqylzn.exe
  C:\Windows\System\Wuqylzn.exe
  2⤵
  PID:4364
- C:\Windows\System\dyjMGJL.exe
  C:\Windows\System\dyjMGJL.exe
  2⤵
  PID:4380
- C:\Windows\System\HAPtQkO.exe
  C:\Windows\System\HAPtQkO.exe
  2⤵
  PID:4396
- C:\Windows\System\pVASSUw.exe
  C:\Windows\System\pVASSUw.exe
  2⤵
  PID:4416
- C:\Windows\System\iOmvUYa.exe
  C:\Windows\System\iOmvUYa.exe
  2⤵
  PID:4432
- C:\Windows\System\SuZhpmx.exe
  C:\Windows\System\SuZhpmx.exe
  2⤵
  PID:4448
- C:\Windows\System\ZidZZNU.exe
  C:\Windows\System\ZidZZNU.exe
  2⤵
  PID:4464
- C:\Windows\System\dVRMwsm.exe
  C:\Windows\System\dVRMwsm.exe
  2⤵
  PID:4480
- C:\Windows\System\XipKZVS.exe
  C:\Windows\System\XipKZVS.exe
  2⤵
  PID:4496
- C:\Windows\System\TeQFTAh.exe
  C:\Windows\System\TeQFTAh.exe
  2⤵
  PID:4512
- C:\Windows\System\NjXaGIJ.exe
  C:\Windows\System\NjXaGIJ.exe
  2⤵
  PID:4532
- C:\Windows\System\MXhTKSj.exe
  C:\Windows\System\MXhTKSj.exe
  2⤵
  PID:4552
- C:\Windows\System\EPrnPnM.exe
  C:\Windows\System\EPrnPnM.exe
  2⤵
  PID:4568
- C:\Windows\System\zofhwgE.exe
  C:\Windows\System\zofhwgE.exe
  2⤵
  PID:4584
- C:\Windows\System\wKJuUva.exe
  C:\Windows\System\wKJuUva.exe
  2⤵
  PID:4604
- C:\Windows\System\iFIuGrN.exe
  C:\Windows\System\iFIuGrN.exe
  2⤵
  PID:4620
- C:\Windows\System\sfkgviH.exe
  C:\Windows\System\sfkgviH.exe
  2⤵
  PID:4636
- C:\Windows\System\gOQREqY.exe
  C:\Windows\System\gOQREqY.exe
  2⤵
  PID:4656
- C:\Windows\System\CyaRCFF.exe
  C:\Windows\System\CyaRCFF.exe
  2⤵
  PID:4672
- C:\Windows\System\DQEWBob.exe
  C:\Windows\System\DQEWBob.exe
  2⤵
  PID:4696
- C:\Windows\System\xhdkJGe.exe
  C:\Windows\System\xhdkJGe.exe
  2⤵
  PID:4712
- C:\Windows\System\oOcofvI.exe
  C:\Windows\System\oOcofvI.exe
  2⤵
  PID:4728
- C:\Windows\System\blsHQhl.exe
  C:\Windows\System\blsHQhl.exe
  2⤵
  PID:4744
- C:\Windows\System\LGfKejC.exe
  C:\Windows\System\LGfKejC.exe
  2⤵
  PID:4760
- C:\Windows\System\AYzqYee.exe
  C:\Windows\System\AYzqYee.exe
  2⤵
  PID:4776
- C:\Windows\System\eMQzSlt.exe
  C:\Windows\System\eMQzSlt.exe
  2⤵
  PID:4792
- C:\Windows\System\JMFzuQB.exe
  C:\Windows\System\JMFzuQB.exe
  2⤵
  PID:4808
- C:\Windows\System\INmhIbG.exe
  C:\Windows\System\INmhIbG.exe
  2⤵
  PID:4824
- C:\Windows\System\DCYbnob.exe
  C:\Windows\System\DCYbnob.exe
  2⤵
  PID:4840
- C:\Windows\System\cRtFvci.exe
  C:\Windows\System\cRtFvci.exe
  2⤵
  PID:4856
- C:\Windows\System\CoLnJAd.exe
  C:\Windows\System\CoLnJAd.exe
  2⤵
  PID:4872
- C:\Windows\System\XquxSXw.exe
  C:\Windows\System\XquxSXw.exe
  2⤵
  PID:4888
- C:\Windows\System\RIqxifa.exe
  C:\Windows\System\RIqxifa.exe
  2⤵
  PID:4904
- C:\Windows\System\hqwrXSK.exe
  C:\Windows\System\hqwrXSK.exe
  2⤵
  PID:4920
- C:\Windows\System\wJPAyyq.exe
  C:\Windows\System\wJPAyyq.exe
  2⤵
  PID:4936
- C:\Windows\System\CIJMOyr.exe
  C:\Windows\System\CIJMOyr.exe
  2⤵
  PID:4952
- C:\Windows\System\kXQouMK.exe
  C:\Windows\System\kXQouMK.exe
  2⤵
  PID:4968
- C:\Windows\System\tnFjqXP.exe
  C:\Windows\System\tnFjqXP.exe
  2⤵
  PID:4984
- C:\Windows\System\tRQzIlS.exe
  C:\Windows\System\tRQzIlS.exe
  2⤵
  PID:5000
- C:\Windows\System\zGoAjRM.exe
  C:\Windows\System\zGoAjRM.exe
  2⤵
  PID:5016
- C:\Windows\System\cNkBLzr.exe
  C:\Windows\System\cNkBLzr.exe
  2⤵
  PID:5036
- C:\Windows\System\oRWlruc.exe
  C:\Windows\System\oRWlruc.exe
  2⤵
  PID:5060
- C:\Windows\System\iSoFYmi.exe
  C:\Windows\System\iSoFYmi.exe
  2⤵
  PID:5076
- C:\Windows\System\uNrTwKG.exe
  C:\Windows\System\uNrTwKG.exe
  2⤵
  PID:5092
- C:\Windows\System\HVskDqW.exe
  C:\Windows\System\HVskDqW.exe
  2⤵
  PID:5108
- C:\Windows\System\gsztLNq.exe
  C:\Windows\System\gsztLNq.exe
  2⤵
  PID:2176
- C:\Windows\System\vRENSgn.exe
  C:\Windows\System\vRENSgn.exe
  2⤵
  PID:540
- C:\Windows\System\nppfUAF.exe
  C:\Windows\System\nppfUAF.exe
  2⤵
  PID:1960
- C:\Windows\System\zpgmrrH.exe
  C:\Windows\System\zpgmrrH.exe
  2⤵
  PID:2364
- C:\Windows\System\mIqOCjm.exe
  C:\Windows\System\mIqOCjm.exe
  2⤵
  PID:3960
- C:\Windows\System\StLkrQf.exe
  C:\Windows\System\StLkrQf.exe
  2⤵
  PID:3588
- C:\Windows\System\HrjTvcp.exe
  C:\Windows\System\HrjTvcp.exe
  2⤵
  PID:3972
- C:\Windows\System\jBmZiMD.exe
  C:\Windows\System\jBmZiMD.exe
  2⤵
  PID:4052
- C:\Windows\System\sgnrlvy.exe
  C:\Windows\System\sgnrlvy.exe
  2⤵
  PID:616
- C:\Windows\System\XoFEWsP.exe
  C:\Windows\System\XoFEWsP.exe
  2⤵
  PID:3004
- C:\Windows\System\qDDEyHD.exe
  C:\Windows\System\qDDEyHD.exe
  2⤵
  PID:4112
- C:\Windows\System\gHxyULQ.exe
  C:\Windows\System\gHxyULQ.exe
  2⤵
  PID:1696
- C:\Windows\System\FDDyrmy.exe
  C:\Windows\System\FDDyrmy.exe
  2⤵
  PID:956
- C:\Windows\System\QWkSYHm.exe
  C:\Windows\System\QWkSYHm.exe
  2⤵
  PID:1232
- C:\Windows\System\KcApmbS.exe
  C:\Windows\System\KcApmbS.exe
  2⤵
  PID:3460
- C:\Windows\System\XBOpZkk.exe
  C:\Windows\System\XBOpZkk.exe
  2⤵
  PID:3880
- C:\Windows\System\bZYzPMJ.exe
  C:\Windows\System\bZYzPMJ.exe
  2⤵
  PID:3040
- C:\Windows\System\NXaAbxT.exe
  C:\Windows\System\NXaAbxT.exe
  2⤵
  PID:2692
- C:\Windows\System\elOWFVQ.exe
  C:\Windows\System\elOWFVQ.exe
  2⤵
  PID:3492
- C:\Windows\System\CzOBYdm.exe
  C:\Windows\System\CzOBYdm.exe
  2⤵
  PID:4088
- C:\Windows\System\sCDQirF.exe
  C:\Windows\System\sCDQirF.exe
  2⤵
  PID:1608
- C:\Windows\System\ssBzJHy.exe
  C:\Windows\System\ssBzJHy.exe
  2⤵
  PID:3152
- C:\Windows\System\KtKhzWN.exe
  C:\Windows\System\KtKhzWN.exe
  2⤵
  PID:2192
- C:\Windows\System\VRXCKVP.exe
  C:\Windows\System\VRXCKVP.exe
  2⤵
  PID:4068
- C:\Windows\System\pjpazhD.exe
  C:\Windows\System\pjpazhD.exe
  2⤵
  PID:1516
- C:\Windows\System\ONRYNnR.exe
  C:\Windows\System\ONRYNnR.exe
  2⤵
  PID:3728
- C:\Windows\System\YYwVohR.exe
  C:\Windows\System\YYwVohR.exe
  2⤵
  PID:2564
- C:\Windows\System\lQBUMJK.exe
  C:\Windows\System\lQBUMJK.exe
  2⤵
  PID:1848
- C:\Windows\System\CqQxfcB.exe
  C:\Windows\System\CqQxfcB.exe
  2⤵
  PID:3520
- C:\Windows\System\MtDFozP.exe
  C:\Windows\System\MtDFozP.exe
  2⤵
  PID:1804
- C:\Windows\System\GOiorbg.exe
  C:\Windows\System\GOiorbg.exe
  2⤵
  PID:4168
- C:\Windows\System\wdqVduE.exe
  C:\Windows\System\wdqVduE.exe
  2⤵
  PID:4184
- C:\Windows\System\oKdycGF.exe
  C:\Windows\System\oKdycGF.exe
  2⤵
  PID:4200
- C:\Windows\System\ngvpUvH.exe
  C:\Windows\System\ngvpUvH.exe
  2⤵
  PID:4216
- C:\Windows\System\tbdJwkj.exe
  C:\Windows\System\tbdJwkj.exe
  2⤵
  PID:4232
- C:\Windows\System\VMuLBDj.exe
  C:\Windows\System\VMuLBDj.exe
  2⤵
  PID:4248
- C:\Windows\System\RUDJYzx.exe
  C:\Windows\System\RUDJYzx.exe
  2⤵
  PID:4264
- C:\Windows\System\UgLUCXq.exe
  C:\Windows\System\UgLUCXq.exe
  2⤵
  PID:4280
- C:\Windows\System\bbTGwaI.exe
  C:\Windows\System\bbTGwaI.exe
  2⤵
  PID:4360
- C:\Windows\System\CkWDcAy.exe
  C:\Windows\System\CkWDcAy.exe
  2⤵
  PID:4428
- C:\Windows\System\fvPKoiX.exe
  C:\Windows\System\fvPKoiX.exe
  2⤵
  PID:4492
- C:\Windows\System\ueHiBHl.exe
  C:\Windows\System\ueHiBHl.exe
  2⤵
  PID:4528
- C:\Windows\System\LoUXVDi.exe
  C:\Windows\System\LoUXVDi.exe
  2⤵
  PID:4592
- C:\Windows\System\lLdLNNa.exe
  C:\Windows\System\lLdLNNa.exe
  2⤵
  PID:4664
- C:\Windows\System\auoOhvH.exe
  C:\Windows\System\auoOhvH.exe
  2⤵
  PID:2652
- C:\Windows\System\OlIEAge.exe
  C:\Windows\System\OlIEAge.exe
  2⤵
  PID:4412
- C:\Windows\System\ClZgcxz.exe
  C:\Windows\System\ClZgcxz.exe
  2⤵
  PID:4472
- C:\Windows\System\hKfhCmH.exe
  C:\Windows\System\hKfhCmH.exe
  2⤵
  PID:4540
- C:\Windows\System\wmIatBb.exe
  C:\Windows\System\wmIatBb.exe
  2⤵
  PID:4708
- C:\Windows\System\YqbTEoN.exe
  C:\Windows\System\YqbTEoN.exe
  2⤵
  PID:4768
- C:\Windows\System\DlPhcto.exe
  C:\Windows\System\DlPhcto.exe
  2⤵
  PID:4896
- C:\Windows\System\cSxnVDB.exe
  C:\Windows\System\cSxnVDB.exe
  2⤵
  PID:4960
- C:\Windows\System\KSmlWMf.exe
  C:\Windows\System\KSmlWMf.exe
  2⤵
  PID:5024
- C:\Windows\System\UJNqHSi.exe
  C:\Windows\System\UJNqHSi.exe
  2⤵
  PID:5068
- C:\Windows\System\TIPLgmN.exe
  C:\Windows\System\TIPLgmN.exe
  2⤵
  PID:2748
- C:\Windows\System\aHgyIgM.exe
  C:\Windows\System\aHgyIgM.exe
  2⤵
  PID:1080
- C:\Windows\System\yoQrEIt.exe
  C:\Windows\System\yoQrEIt.exe
  2⤵
  PID:4648
- C:\Windows\System\EPmPuwN.exe
  C:\Windows\System\EPmPuwN.exe
  2⤵
  PID:4048
- C:\Windows\System\Zdicbfn.exe
  C:\Windows\System\Zdicbfn.exe
  2⤵
  PID:4148
- C:\Windows\System\OJdHgGO.exe
  C:\Windows\System\OJdHgGO.exe
  2⤵
  PID:3888
- C:\Windows\System\DSjhDcN.exe
  C:\Windows\System\DSjhDcN.exe
  2⤵
  PID:4684
- C:\Windows\System\KuoCQYa.exe
  C:\Windows\System\KuoCQYa.exe
  2⤵
  PID:4848
- C:\Windows\System\RsduYgZ.exe
  C:\Windows\System\RsduYgZ.exe
  2⤵
  PID:4912
- C:\Windows\System\cOVXZFS.exe
  C:\Windows\System\cOVXZFS.exe
  2⤵
  PID:4976
- C:\Windows\System\xsJvMbh.exe
  C:\Windows\System\xsJvMbh.exe
  2⤵
  PID:5044
- C:\Windows\System\llvQfqJ.exe
  C:\Windows\System\llvQfqJ.exe
  2⤵
  PID:5088
- C:\Windows\System\ixDHEBO.exe
  C:\Windows\System\ixDHEBO.exe
  2⤵
  PID:1728
- C:\Windows\System\GuFgVeX.exe
  C:\Windows\System\GuFgVeX.exe
  2⤵
  PID:3860
- C:\Windows\System\RaXTRRV.exe
  C:\Windows\System\RaXTRRV.exe
  2⤵
  PID:4084
- C:\Windows\System\OoXqKrU.exe
  C:\Windows\System\OoXqKrU.exe
  2⤵
  PID:1528
- C:\Windows\System\yLmHmpb.exe
  C:\Windows\System\yLmHmpb.exe
  2⤵
  PID:4720
- C:\Windows\System\kdrsKrI.exe
  C:\Windows\System\kdrsKrI.exe
  2⤵
  PID:2548
- C:\Windows\System\uUMkFvR.exe
  C:\Windows\System\uUMkFvR.exe
  2⤵
  PID:2460
- C:\Windows\System\QpDZNOS.exe
  C:\Windows\System\QpDZNOS.exe
  2⤵
  PID:4324
- C:\Windows\System\FlocBoT.exe
  C:\Windows\System\FlocBoT.exe
  2⤵
  PID:3572
- C:\Windows\System\JZYcjJX.exe
  C:\Windows\System\JZYcjJX.exe
  2⤵
  PID:1840
- C:\Windows\System\URnYuaN.exe
  C:\Windows\System\URnYuaN.exe
  2⤵
  PID:2604
- C:\Windows\System\dmwcgmM.exe
  C:\Windows\System\dmwcgmM.exe
  2⤵
  PID:320
- C:\Windows\System\iAQppty.exe
  C:\Windows\System\iAQppty.exe
  2⤵
  PID:2836
- C:\Windows\System\bVnFyWT.exe
  C:\Windows\System\bVnFyWT.exe
  2⤵
  PID:3300
- C:\Windows\System\MjooTUA.exe
  C:\Windows\System\MjooTUA.exe
  2⤵
  PID:3976
- C:\Windows\System\KhGPiXY.exe
  C:\Windows\System\KhGPiXY.exe
  2⤵
  PID:2948
- C:\Windows\System\WKYfdjX.exe
  C:\Windows\System\WKYfdjX.exe
  2⤵
  PID:2004
- C:\Windows\System\Xpoamtp.exe
  C:\Windows\System\Xpoamtp.exe
  2⤵
  PID:4224
- C:\Windows\System\TtaDfpF.exe
  C:\Windows\System\TtaDfpF.exe
  2⤵
  PID:2732
- C:\Windows\System\HkmfORe.exe
  C:\Windows\System\HkmfORe.exe
  2⤵
  PID:4460
- C:\Windows\System\BaUFdlQ.exe
  C:\Windows\System\BaUFdlQ.exe
  2⤵
  PID:4336
- C:\Windows\System\LOPAFrq.exe
  C:\Windows\System\LOPAFrq.exe
  2⤵
  PID:4544
- C:\Windows\System\FJjOQne.exe
  C:\Windows\System\FJjOQne.exe
  2⤵
  PID:4832
- C:\Windows\System\Hfxeiig.exe
  C:\Windows\System\Hfxeiig.exe
  2⤵
  PID:4208
- C:\Windows\System\lUljUfN.exe
  C:\Windows\System\lUljUfN.exe
  2⤵
  PID:4240
- C:\Windows\System\kqUDDQH.exe
  C:\Windows\System\kqUDDQH.exe
  2⤵
  PID:4392
- C:\Windows\System\tAJsjMQ.exe
  C:\Windows\System\tAJsjMQ.exe
  2⤵
  PID:4524
- C:\Windows\System\UfYumdJ.exe
  C:\Windows\System\UfYumdJ.exe
  2⤵
  PID:4408
- C:\Windows\System\XpeUSJi.exe
  C:\Windows\System\XpeUSJi.exe
  2⤵
  PID:4740
- C:\Windows\System\YulrFNf.exe
  C:\Windows\System\YulrFNf.exe
  2⤵
  PID:2204
- C:\Windows\System\jNEJTfq.exe
  C:\Windows\System\jNEJTfq.exe
  2⤵
  PID:4644
- C:\Windows\System\xAmXeIZ.exe
  C:\Windows\System\xAmXeIZ.exe
  2⤵
  PID:4880
- C:\Windows\System\QCriWVO.exe
  C:\Windows\System\QCriWVO.exe
  2⤵
  PID:2168
- C:\Windows\System\adyxurP.exe
  C:\Windows\System\adyxurP.exe
  2⤵
  PID:2352
- C:\Windows\System\NCXNVwn.exe
  C:\Windows\System\NCXNVwn.exe
  2⤵
  PID:2988
- C:\Windows\System\KvuZKsj.exe
  C:\Windows\System\KvuZKsj.exe
  2⤵
  PID:848
- C:\Windows\System\BsfKjpW.exe
  C:\Windows\System\BsfKjpW.exe
  2⤵
  PID:5104
- C:\Windows\System\ztDekeh.exe
  C:\Windows\System\ztDekeh.exe
  2⤵
  PID:3200
- C:\Windows\System\fMTGIrv.exe
  C:\Windows\System\fMTGIrv.exe
  2⤵
  PID:4928
- C:\Windows\System\EyoYKZC.exe
  C:\Windows\System\EyoYKZC.exe
  2⤵
  PID:3856
- C:\Windows\System\EevOYdS.exe
  C:\Windows\System\EevOYdS.exe
  2⤵
  PID:4820
- C:\Windows\System\fTpySan.exe
  C:\Windows\System\fTpySan.exe
  2⤵
  PID:3952
- C:\Windows\System\mKzBxer.exe
  C:\Windows\System\mKzBxer.exe
  2⤵
  PID:4752
- C:\Windows\System\noJCJTe.exe
  C:\Windows\System\noJCJTe.exe
  2⤵
  PID:4724
- C:\Windows\System\aIfadYS.exe
  C:\Windows\System\aIfadYS.exe
  2⤵
  PID:4256
- C:\Windows\System\aBCDOUg.exe
  C:\Windows\System\aBCDOUg.exe
  2⤵
  PID:4596
- C:\Windows\System\mmxoVNk.exe
  C:\Windows\System\mmxoVNk.exe
  2⤵
  PID:1956
- C:\Windows\System\dOTuHgs.exe
  C:\Windows\System\dOTuHgs.exe
  2⤵
  PID:4304
- C:\Windows\System\gwdbqKx.exe
  C:\Windows\System\gwdbqKx.exe
  2⤵
  PID:4616
- C:\Windows\System\YRKDqIQ.exe
  C:\Windows\System\YRKDqIQ.exe
  2⤵
  PID:3344
- C:\Windows\System\ewDWtXu.exe
  C:\Windows\System\ewDWtXu.exe
  2⤵
  PID:5052
- C:\Windows\System\pJhQeBa.exe
  C:\Windows\System\pJhQeBa.exe
  2⤵
  PID:4196
- C:\Windows\System\qDdyqgt.exe
  C:\Windows\System\qDdyqgt.exe
  2⤵
  PID:1904
- C:\Windows\System\PCszvco.exe
  C:\Windows\System\PCszvco.exe
  2⤵
  PID:4488
- C:\Windows\System\JmReovU.exe
  C:\Windows\System\JmReovU.exe
  2⤵
  PID:4868
- C:\Windows\System\OIgcKTf.exe
  C:\Windows\System\OIgcKTf.exe
  2⤵
  PID:4996
- C:\Windows\System\QRGqiXL.exe
  C:\Windows\System\QRGqiXL.exe
  2⤵
  PID:4772
- C:\Windows\System\ONBgYQx.exe
  C:\Windows\System\ONBgYQx.exe
  2⤵
  PID:2744
- C:\Windows\System\xdPgwzJ.exe
  C:\Windows\System\xdPgwzJ.exe
  2⤵
  PID:4132
- C:\Windows\System\LrXrDaa.exe
  C:\Windows\System\LrXrDaa.exe
  2⤵
  PID:5032
- C:\Windows\System\cdwgFOv.exe
  C:\Windows\System\cdwgFOv.exe
  2⤵
  PID:4212
- C:\Windows\System\BiejPJU.exe
  C:\Windows\System\BiejPJU.exe
  2⤵
  PID:4632
- C:\Windows\System\YhePxfA.exe
  C:\Windows\System\YhePxfA.exe
  2⤵
  PID:1524
- C:\Windows\System\LDGeuhV.exe
  C:\Windows\System\LDGeuhV.exe
  2⤵
  PID:4864
- C:\Windows\System\WCnpvAK.exe
  C:\Windows\System\WCnpvAK.exe
  2⤵
  PID:3904
- C:\Windows\System\KvRglTr.exe
  C:\Windows\System\KvRglTr.exe
  2⤵
  PID:5056
- C:\Windows\System\mfltJLL.exe
  C:\Windows\System\mfltJLL.exe
  2⤵
  PID:2476
- C:\Windows\System\LXFhtal.exe
  C:\Windows\System\LXFhtal.exe
  2⤵
  PID:4736
- C:\Windows\System\MyZfufi.exe
  C:\Windows\System\MyZfufi.exe
  2⤵
  PID:4276
- C:\Windows\System\EHgrKIk.exe
  C:\Windows\System\EHgrKIk.exe
  2⤵
  PID:4164
- C:\Windows\System\MCwHtOp.exe
  C:\Windows\System\MCwHtOp.exe
  2⤵
  PID:5124
- C:\Windows\System\HQVBZxm.exe
  C:\Windows\System\HQVBZxm.exe
  2⤵
  PID:5140
- C:\Windows\System\QwGuGYo.exe
  C:\Windows\System\QwGuGYo.exe
  2⤵
  PID:5156
- C:\Windows\System\ELRfxlO.exe
  C:\Windows\System\ELRfxlO.exe
  2⤵
  PID:5172
- C:\Windows\System\PnaDuXi.exe
  C:\Windows\System\PnaDuXi.exe
  2⤵
  PID:5188
- C:\Windows\System\XHXXrBH.exe
  C:\Windows\System\XHXXrBH.exe
  2⤵
  PID:5204
- C:\Windows\System\QutVYts.exe
  C:\Windows\System\QutVYts.exe
  2⤵
  PID:5220
- C:\Windows\System\iMkAtwb.exe
  C:\Windows\System\iMkAtwb.exe
  2⤵
  PID:5236
- C:\Windows\System\ODCPNvv.exe
  C:\Windows\System\ODCPNvv.exe
  2⤵
  PID:5252
- C:\Windows\System\PjqumqM.exe
  C:\Windows\System\PjqumqM.exe
  2⤵
  PID:5268
- C:\Windows\System\jDbukzq.exe
  C:\Windows\System\jDbukzq.exe
  2⤵
  PID:5284
- C:\Windows\System\qswhvkY.exe
  C:\Windows\System\qswhvkY.exe
  2⤵
  PID:5300
- C:\Windows\System\MCtmtwv.exe
  C:\Windows\System\MCtmtwv.exe
  2⤵
  PID:5316
- C:\Windows\System\WclhpFC.exe
  C:\Windows\System\WclhpFC.exe
  2⤵
  PID:5332
- C:\Windows\System\MXDXIJd.exe
  C:\Windows\System\MXDXIJd.exe
  2⤵
  PID:5348
- C:\Windows\System\DSTVdCn.exe
  C:\Windows\System\DSTVdCn.exe
  2⤵
  PID:5364
- C:\Windows\System\aXnTcvM.exe
  C:\Windows\System\aXnTcvM.exe
  2⤵
  PID:5380
- C:\Windows\System\CLqUVeF.exe
  C:\Windows\System\CLqUVeF.exe
  2⤵
  PID:5396
- C:\Windows\System\DEsXjxo.exe
  C:\Windows\System\DEsXjxo.exe
  2⤵
  PID:5412
- C:\Windows\System\cUoUBBQ.exe
  C:\Windows\System\cUoUBBQ.exe
  2⤵
  PID:5428
- C:\Windows\System\mNScVFI.exe
  C:\Windows\System\mNScVFI.exe
  2⤵
  PID:5444
- C:\Windows\System\diIFamM.exe
  C:\Windows\System\diIFamM.exe
  2⤵
  PID:5460
- C:\Windows\System\zaXUmjr.exe
  C:\Windows\System\zaXUmjr.exe
  2⤵
  PID:5476
- C:\Windows\System\WhskGNN.exe
  C:\Windows\System\WhskGNN.exe
  2⤵
  PID:5492
- C:\Windows\System\egeupSL.exe
  C:\Windows\System\egeupSL.exe
  2⤵
  PID:5508
- C:\Windows\System\GkhhCta.exe
  C:\Windows\System\GkhhCta.exe
  2⤵
  PID:5524
- C:\Windows\System\ByhYrEo.exe
  C:\Windows\System\ByhYrEo.exe
  2⤵
  PID:5540
- C:\Windows\System\NDBfKKf.exe
  C:\Windows\System\NDBfKKf.exe
  2⤵
  PID:5556
- C:\Windows\System\wCqQvrc.exe
  C:\Windows\System\wCqQvrc.exe
  2⤵
  PID:5572
- C:\Windows\System\CngDggZ.exe
  C:\Windows\System\CngDggZ.exe
  2⤵
  PID:5588
- C:\Windows\System\bsauwNr.exe
  C:\Windows\System\bsauwNr.exe
  2⤵
  PID:5604
- C:\Windows\System\KkJspsV.exe
  C:\Windows\System\KkJspsV.exe
  2⤵
  PID:5620
- C:\Windows\System\pVCrrDG.exe
  C:\Windows\System\pVCrrDG.exe
  2⤵
  PID:5636
- C:\Windows\System\xRgKYgZ.exe
  C:\Windows\System\xRgKYgZ.exe
  2⤵
  PID:5652
- C:\Windows\System\imZTpiH.exe
  C:\Windows\System\imZTpiH.exe
  2⤵
  PID:5668
- C:\Windows\System\PYzKhOU.exe
  C:\Windows\System\PYzKhOU.exe
  2⤵
  PID:5684
- C:\Windows\System\govDlZR.exe
  C:\Windows\System\govDlZR.exe
  2⤵
  PID:5700
- C:\Windows\System\qfhTZsG.exe
  C:\Windows\System\qfhTZsG.exe
  2⤵
  PID:5716
- C:\Windows\System\uKawTLj.exe
  C:\Windows\System\uKawTLj.exe
  2⤵
  PID:5732
- C:\Windows\System\yfZYzTI.exe
  C:\Windows\System\yfZYzTI.exe
  2⤵
  PID:5748
- C:\Windows\System\EYAMtfp.exe
  C:\Windows\System\EYAMtfp.exe
  2⤵
  PID:5764
- C:\Windows\System\QZrVvis.exe
  C:\Windows\System\QZrVvis.exe
  2⤵
  PID:5780
- C:\Windows\System\Rrazfal.exe
  C:\Windows\System\Rrazfal.exe
  2⤵
  PID:5796
- C:\Windows\System\pUNoHNX.exe
  C:\Windows\System\pUNoHNX.exe
  2⤵
  PID:5812
- C:\Windows\System\hoZLyij.exe
  C:\Windows\System\hoZLyij.exe
  2⤵
  PID:5836
- C:\Windows\System\reTFlji.exe
  C:\Windows\System\reTFlji.exe
  2⤵
  PID:5852
- C:\Windows\System\xpghGpD.exe
  C:\Windows\System\xpghGpD.exe
  2⤵
  PID:5868
- C:\Windows\System\AfkdQpW.exe
  C:\Windows\System\AfkdQpW.exe
  2⤵
  PID:5884
- C:\Windows\System\gxEpski.exe
  C:\Windows\System\gxEpski.exe
  2⤵
  PID:5900
- C:\Windows\System\vviEXbH.exe
  C:\Windows\System\vviEXbH.exe
  2⤵
  PID:5916
- C:\Windows\System\gpEtdlC.exe
  C:\Windows\System\gpEtdlC.exe
  2⤵
  PID:5932
- C:\Windows\System\yGKhgFU.exe
  C:\Windows\System\yGKhgFU.exe
  2⤵
  PID:5948
- C:\Windows\System\CfIniOz.exe
  C:\Windows\System\CfIniOz.exe
  2⤵
  PID:5964
- C:\Windows\System\cwoztKz.exe
  C:\Windows\System\cwoztKz.exe
  2⤵
  PID:5980
- C:\Windows\System\qmGuvMS.exe
  C:\Windows\System\qmGuvMS.exe
  2⤵
  PID:5996
- C:\Windows\System\RkDauVk.exe
  C:\Windows\System\RkDauVk.exe
  2⤵
  PID:6012
- C:\Windows\System\gTgkguU.exe
  C:\Windows\System\gTgkguU.exe
  2⤵
  PID:6028
- C:\Windows\System\cfRnmED.exe
  C:\Windows\System\cfRnmED.exe
  2⤵
  PID:6044
- C:\Windows\System\wwBoBnP.exe
  C:\Windows\System\wwBoBnP.exe
  2⤵
  PID:6060
- C:\Windows\System\TSHqYIP.exe
  C:\Windows\System\TSHqYIP.exe
  2⤵
  PID:6076
- C:\Windows\System\zuKxypb.exe
  C:\Windows\System\zuKxypb.exe
  2⤵
  PID:6092
- C:\Windows\System\hvmWbnK.exe
  C:\Windows\System\hvmWbnK.exe
  2⤵
  PID:6108
- C:\Windows\System\SvJScZE.exe
  C:\Windows\System\SvJScZE.exe
  2⤵
  PID:6124
- C:\Windows\System\fAFVMUl.exe
  C:\Windows\System\fAFVMUl.exe
  2⤵
  PID:6140
- C:\Windows\System\ADqnDPg.exe
  C:\Windows\System\ADqnDPg.exe
  2⤵
  PID:2820
- C:\Windows\System\Omvpewg.exe
  C:\Windows\System\Omvpewg.exe
  2⤵
  PID:4508
- C:\Windows\System\lQvpsKE.exe
  C:\Windows\System\lQvpsKE.exe
  2⤵
  PID:5184
- C:\Windows\System\cyMkaph.exe
  C:\Windows\System\cyMkaph.exe
  2⤵
  PID:5244
- C:\Windows\System\NOmxvEF.exe
  C:\Windows\System\NOmxvEF.exe
  2⤵
  PID:5232
- C:\Windows\System\GsboxhN.exe
  C:\Windows\System\GsboxhN.exe
  2⤵
  PID:5196
- C:\Windows\System\ifOlVYY.exe
  C:\Windows\System\ifOlVYY.exe
  2⤵
  PID:5228
- C:\Windows\System\bpRLwcK.exe
  C:\Windows\System\bpRLwcK.exe
  2⤵
  PID:5344
- C:\Windows\System\FqOkSUy.exe
  C:\Windows\System\FqOkSUy.exe
  2⤵
  PID:5408
- C:\Windows\System\CbyVnmB.exe
  C:\Windows\System\CbyVnmB.exe
  2⤵
  PID:5472
- C:\Windows\System\CNFWemg.exe
  C:\Windows\System\CNFWemg.exe
  2⤵
  PID:5536
- C:\Windows\System\OgatDuw.exe
  C:\Windows\System\OgatDuw.exe
  2⤵
  PID:5600
- C:\Windows\System\pCNlkob.exe
  C:\Windows\System\pCNlkob.exe
  2⤵
  PID:5664
- C:\Windows\System\SdSUIfu.exe
  C:\Windows\System\SdSUIfu.exe
  2⤵
  PID:5728
- C:\Windows\System\rCxeNpg.exe
  C:\Windows\System\rCxeNpg.exe
  2⤵
  PID:5356
- C:\Windows\System\zJEKetG.exe
  C:\Windows\System\zJEKetG.exe
  2⤵
  PID:5776
- C:\Windows\System\oDViIOP.exe
  C:\Windows\System\oDViIOP.exe
  2⤵
  PID:5612
- C:\Windows\System\xmWWUjQ.exe
  C:\Windows\System\xmWWUjQ.exe
  2⤵
  PID:5860
- C:\Windows\System\mtBhUZE.exe
  C:\Windows\System\mtBhUZE.exe
  2⤵
  PID:5908
- C:\Windows\System\JwnjSZt.exe
  C:\Windows\System\JwnjSZt.exe
  2⤵
  PID:5312
- C:\Windows\System\btvHPaz.exe
  C:\Windows\System\btvHPaz.exe
  2⤵
  PID:5440
- C:\Windows\System\QhjdKFu.exe
  C:\Windows\System\QhjdKFu.exe
  2⤵
  PID:5340
- C:\Windows\System\rhbUjWx.exe
  C:\Windows\System\rhbUjWx.exe
  2⤵
  PID:5452
- C:\Windows\System\Ivrhwpw.exe
  C:\Windows\System\Ivrhwpw.exe
  2⤵
  PID:5772
- C:\Windows\System\zQKQCkN.exe
  C:\Windows\System\zQKQCkN.exe
  2⤵
  PID:5808
- C:\Windows\System\jtQaeby.exe
  C:\Windows\System\jtQaeby.exe
  2⤵
  PID:5520
- C:\Windows\System\HiEEjVv.exe
  C:\Windows\System\HiEEjVv.exe
  2⤵
  PID:5580
- C:\Windows\System\RqSIFQX.exe
  C:\Windows\System\RqSIFQX.exe
  2⤵
  PID:5676
- C:\Windows\System\bQyOPaD.exe
  C:\Windows\System\bQyOPaD.exe
  2⤵
  PID:5744
- C:\Windows\System\eTcWlbK.exe
  C:\Windows\System\eTcWlbK.exe
  2⤵
  PID:4404
- C:\Windows\System\ILZRiJx.exe
  C:\Windows\System\ILZRiJx.exe
  2⤵
  PID:6052
- C:\Windows\System\FfCOwcg.exe
  C:\Windows\System\FfCOwcg.exe
  2⤵
  PID:5944
- C:\Windows\System\zEXuByy.exe
  C:\Windows\System\zEXuByy.exe
  2⤵
  PID:6008
- C:\Windows\System\ObokAIj.exe
  C:\Windows\System\ObokAIj.exe
  2⤵
  PID:1800
- C:\Windows\System\dyRNGuT.exe
  C:\Windows\System\dyRNGuT.exe
  2⤵
  PID:5164
- C:\Windows\System\ziDEkNB.exe
  C:\Windows\System\ziDEkNB.exe
  2⤵
  PID:6072
- C:\Windows\System\tRjlLwW.exe
  C:\Windows\System\tRjlLwW.exe
  2⤵
  PID:5264
- C:\Windows\System\lWCcJkb.exe
  C:\Windows\System\lWCcJkb.exe
  2⤵
  PID:4816
- C:\Windows\System\KacVKnW.exe
  C:\Windows\System\KacVKnW.exe
  2⤵
  PID:5276
- C:\Windows\System\dQsBdXt.exe
  C:\Windows\System\dQsBdXt.exe
  2⤵
  PID:6100
- C:\Windows\System\IeVKMHi.exe
  C:\Windows\System\IeVKMHi.exe
  2⤵
  PID:5388
- C:\Windows\System\TWbDJsj.exe
  C:\Windows\System\TWbDJsj.exe
  2⤵
  PID:5596
- C:\Windows\System\FUUwawy.exe
  C:\Windows\System\FUUwawy.exe
  2⤵
  PID:5724
- C:\Windows\System\DITjvse.exe
  C:\Windows\System\DITjvse.exe
  2⤵
  PID:5708
- C:\Windows\System\nAKggyf.exe
  C:\Windows\System\nAKggyf.exe
  2⤵
  PID:5820
- C:\Windows\System\CfHLwvK.exe
  C:\Windows\System\CfHLwvK.exe
  2⤵
  PID:6084
- C:\Windows\System\qVSnTkz.exe
  C:\Windows\System\qVSnTkz.exe
  2⤵
  PID:6004
- C:\Windows\System\DDdeCOX.exe
  C:\Windows\System\DDdeCOX.exe
  2⤵
  PID:5248
- C:\Windows\System\BQWPXBp.exe
  C:\Windows\System\BQWPXBp.exe
  2⤵
  PID:5972
- C:\Windows\System\bFEDhEp.exe
  C:\Windows\System\bFEDhEp.exe
  2⤵
  PID:5404
- C:\Windows\System\uusxWDy.exe
  C:\Windows\System\uusxWDy.exe
  2⤵
  PID:6136
- C:\Windows\System\QAyhiov.exe
  C:\Windows\System\QAyhiov.exe
  2⤵
  PID:5488
- C:\Windows\System\WghOFWu.exe
  C:\Windows\System\WghOFWu.exe
  2⤵
  PID:5292
- C:\Windows\System\nGbguMb.exe
  C:\Windows\System\nGbguMb.exe
  2⤵
  PID:5960
- C:\Windows\System\vhlvDMI.exe
  C:\Windows\System\vhlvDMI.exe
  2⤵
  PID:5180
- C:\Windows\System\RdUAbmb.exe
  C:\Windows\System\RdUAbmb.exe
  2⤵
  PID:5504
- C:\Windows\System\JttjXnP.exe
  C:\Windows\System\JttjXnP.exe
  2⤵
  PID:6024
- C:\Windows\System\vuglOxL.exe
  C:\Windows\System\vuglOxL.exe
  2⤵
  PID:4356
- C:\Windows\System\WLdITvI.exe
  C:\Windows\System\WLdITvI.exe
  2⤵
  PID:5712
- C:\Windows\System\eIytrGj.exe
  C:\Windows\System\eIytrGj.exe
  2⤵
  PID:5648
- C:\Windows\System\jEAesQA.exe
  C:\Windows\System\jEAesQA.exe
  2⤵
  PID:5880
- C:\Windows\System\RvpwsjM.exe
  C:\Windows\System\RvpwsjM.exe
  2⤵
  PID:6156
- C:\Windows\System\CPAFKjn.exe
  C:\Windows\System\CPAFKjn.exe
  2⤵
  PID:6172
- C:\Windows\System\tUPjbSR.exe
  C:\Windows\System\tUPjbSR.exe
  2⤵
  PID:6188
- C:\Windows\System\hSJJpDo.exe
  C:\Windows\System\hSJJpDo.exe
  2⤵
  PID:6204
- C:\Windows\System\MLaYwEN.exe
  C:\Windows\System\MLaYwEN.exe
  2⤵
  PID:6220
- C:\Windows\System\zEWqkvF.exe
  C:\Windows\System\zEWqkvF.exe
  2⤵
  PID:6236
- C:\Windows\System\xmynqyw.exe
  C:\Windows\System\xmynqyw.exe
  2⤵
  PID:6252
- C:\Windows\System\qRGSaar.exe
  C:\Windows\System\qRGSaar.exe
  2⤵
  PID:6268
- C:\Windows\System\WeiLOIw.exe
  C:\Windows\System\WeiLOIw.exe
  2⤵
  PID:6284
- C:\Windows\System\KDqkmFe.exe
  C:\Windows\System\KDqkmFe.exe
  2⤵
  PID:6300
- C:\Windows\System\kwShtsz.exe
  C:\Windows\System\kwShtsz.exe
  2⤵
  PID:6316
- C:\Windows\System\mzVinYS.exe
  C:\Windows\System\mzVinYS.exe
  2⤵
  PID:6332
- C:\Windows\System\heefxyN.exe
  C:\Windows\System\heefxyN.exe
  2⤵
  PID:6348
- C:\Windows\System\afJMTUT.exe
  C:\Windows\System\afJMTUT.exe
  2⤵
  PID:6364
- C:\Windows\System\CouWCCP.exe
  C:\Windows\System\CouWCCP.exe
  2⤵
  PID:6380
- C:\Windows\System\UVZAkEC.exe
  C:\Windows\System\UVZAkEC.exe
  2⤵
  PID:6400
- C:\Windows\System\cTpFVJu.exe
  C:\Windows\System\cTpFVJu.exe
  2⤵
  PID:6416
- C:\Windows\System\ovHMqKd.exe
  C:\Windows\System\ovHMqKd.exe
  2⤵
  PID:6432
- C:\Windows\System\uSUzcJc.exe
  C:\Windows\System\uSUzcJc.exe
  2⤵
  PID:6448
- C:\Windows\System\bGqanYB.exe
  C:\Windows\System\bGqanYB.exe
  2⤵
  PID:6464
- C:\Windows\System\zfKPsQF.exe
  C:\Windows\System\zfKPsQF.exe
  2⤵
  PID:6484
- C:\Windows\System\eiJBhvc.exe
  C:\Windows\System\eiJBhvc.exe
  2⤵
  PID:6500
- C:\Windows\System\TXkLmfm.exe
  C:\Windows\System\TXkLmfm.exe
  2⤵
  PID:6516
- C:\Windows\System\rrsFjVQ.exe
  C:\Windows\System\rrsFjVQ.exe
  2⤵
  PID:6532
- C:\Windows\System\HNjPlfd.exe
  C:\Windows\System\HNjPlfd.exe
  2⤵
  PID:6552
- C:\Windows\System\RAwLEhi.exe
  C:\Windows\System\RAwLEhi.exe
  2⤵
  PID:6568
- C:\Windows\System\QnOtLqd.exe
  C:\Windows\System\QnOtLqd.exe
  2⤵
  PID:6584
- C:\Windows\System\ghAbDVm.exe
  C:\Windows\System\ghAbDVm.exe
  2⤵
  PID:6600
- C:\Windows\System\SaXfzhn.exe
  C:\Windows\System\SaXfzhn.exe
  2⤵
  PID:6616
- C:\Windows\System\GPNJyVS.exe
  C:\Windows\System\GPNJyVS.exe
  2⤵
  PID:6632
- C:\Windows\System\mFQynwL.exe
  C:\Windows\System\mFQynwL.exe
  2⤵
  PID:6648
- C:\Windows\System\USpskRo.exe
  C:\Windows\System\USpskRo.exe
  2⤵
  PID:6664
- C:\Windows\System\EgNASQv.exe
  C:\Windows\System\EgNASQv.exe
  2⤵
  PID:6680
- C:\Windows\System\QYFYouS.exe
  C:\Windows\System\QYFYouS.exe
  2⤵
  PID:6696
- C:\Windows\System\ngIYrgd.exe
  C:\Windows\System\ngIYrgd.exe
  2⤵
  PID:6712
- C:\Windows\System\nPaTjfm.exe
  C:\Windows\System\nPaTjfm.exe
  2⤵
  PID:6728
- C:\Windows\System\VXsRVgT.exe
  C:\Windows\System\VXsRVgT.exe
  2⤵
  PID:6744
- C:\Windows\System\dybRxss.exe
  C:\Windows\System\dybRxss.exe
  2⤵
  PID:6760
- C:\Windows\System\cQpoSCy.exe
  C:\Windows\System\cQpoSCy.exe
  2⤵
  PID:6780
- C:\Windows\System\mFDmOhA.exe
  C:\Windows\System\mFDmOhA.exe
  2⤵
  PID:6796
- C:\Windows\System\SXmbQrs.exe
  C:\Windows\System\SXmbQrs.exe
  2⤵
  PID:6820
- C:\Windows\System\odfOyoA.exe
  C:\Windows\System\odfOyoA.exe
  2⤵
  PID:6836
- C:\Windows\System\MvwxRvd.exe
  C:\Windows\System\MvwxRvd.exe
  2⤵
  PID:6864
- C:\Windows\System\xxhdiDg.exe
  C:\Windows\System\xxhdiDg.exe
  2⤵
  PID:6880
- C:\Windows\System\WCLBXuL.exe
  C:\Windows\System\WCLBXuL.exe
  2⤵
  PID:6896
- C:\Windows\System\BoFXZVv.exe
  C:\Windows\System\BoFXZVv.exe
  2⤵
  PID:6928
- C:\Windows\System\XwibyyG.exe
  C:\Windows\System\XwibyyG.exe
  2⤵
  PID:6944
- C:\Windows\System\YmgwbHE.exe
  C:\Windows\System\YmgwbHE.exe
  2⤵
  PID:6960
- C:\Windows\System\yFlrxBP.exe
  C:\Windows\System\yFlrxBP.exe
  2⤵
  PID:6976
- C:\Windows\System\nABINji.exe
  C:\Windows\System\nABINji.exe
  2⤵
  PID:7008
- C:\Windows\System\KeueRwh.exe
  C:\Windows\System\KeueRwh.exe
  2⤵
  PID:7024
- C:\Windows\System\vgFmSYQ.exe
  C:\Windows\System\vgFmSYQ.exe
  2⤵
  PID:7040
- C:\Windows\System\XizqkOu.exe
  C:\Windows\System\XizqkOu.exe
  2⤵
  PID:7056
- C:\Windows\System\AsOkrPB.exe
  C:\Windows\System\AsOkrPB.exe
  2⤵
  PID:7072
- C:\Windows\System\baMSkua.exe
  C:\Windows\System\baMSkua.exe
  2⤵
  PID:7088
- C:\Windows\System\VAGtByY.exe
  C:\Windows\System\VAGtByY.exe
  2⤵
  PID:7104
- C:\Windows\System\TExzyiI.exe
  C:\Windows\System\TExzyiI.exe
  2⤵
  PID:7120
- C:\Windows\System\uGssDAw.exe
  C:\Windows\System\uGssDAw.exe
  2⤵
  PID:7136
- C:\Windows\System\LNWDRDD.exe
  C:\Windows\System\LNWDRDD.exe
  2⤵
  PID:7156
- C:\Windows\System\gowkVDu.exe
  C:\Windows\System\gowkVDu.exe
  2⤵
  PID:6148
- C:\Windows\System\uEPdEpZ.exe
  C:\Windows\System\uEPdEpZ.exe
  2⤵
  PID:6180
- C:\Windows\System\CuYvAPF.exe
  C:\Windows\System\CuYvAPF.exe
  2⤵
  PID:6232
- C:\Windows\System\usYeVgo.exe
  C:\Windows\System\usYeVgo.exe
  2⤵
  PID:2392
- C:\Windows\System\aNumvkM.exe
  C:\Windows\System\aNumvkM.exe
  2⤵
  PID:6292
- C:\Windows\System\VNZZcJF.exe
  C:\Windows\System\VNZZcJF.exe
  2⤵
  PID:6356
- C:\Windows\System\qqQspet.exe
  C:\Windows\System\qqQspet.exe
  2⤵
  PID:6248
- C:\Windows\System\GSNYLgb.exe
  C:\Windows\System\GSNYLgb.exe
  2⤵
  PID:6340
- C:\Windows\System\DBfwyqU.exe
  C:\Windows\System\DBfwyqU.exe
  2⤵
  PID:6456
- C:\Windows\System\lWwvbxQ.exe
  C:\Windows\System\lWwvbxQ.exe
  2⤵
  PID:6372
- C:\Windows\System\FNDBree.exe
  C:\Windows\System\FNDBree.exe
  2⤵
  PID:6440
- C:\Windows\System\zqxryDD.exe
  C:\Windows\System\zqxryDD.exe
  2⤵
  PID:6476
- C:\Windows\System\eGuQNBO.exe
  C:\Windows\System\eGuQNBO.exe
  2⤵
  PID:6512
- C:\Windows\System\kYzDiCy.exe
  C:\Windows\System\kYzDiCy.exe
  2⤵
  PID:6544
- C:\Windows\System\uRnHtmf.exe
  C:\Windows\System\uRnHtmf.exe
  2⤵
  PID:6592
- C:\Windows\System\ozEknIi.exe
  C:\Windows\System\ozEknIi.exe
  2⤵
  PID:6608
- C:\Windows\System\zUpyavx.exe
  C:\Windows\System\zUpyavx.exe
  2⤵
  PID:6640
- C:\Windows\System\GfCBArr.exe
  C:\Windows\System\GfCBArr.exe
  2⤵
  PID:6676
- C:\Windows\System\KLHYMQK.exe
  C:\Windows\System\KLHYMQK.exe
  2⤵
  PID:6720
- C:\Windows\System\MYRaJBj.exe
  C:\Windows\System\MYRaJBj.exe
  2⤵
  PID:6740
- C:\Windows\System\rmQmyJO.exe
  C:\Windows\System\rmQmyJO.exe
  2⤵
  PID:6772
- C:\Windows\System\HtzIqtX.exe
  C:\Windows\System\HtzIqtX.exe
  2⤵
  PID:6804
- C:\Windows\System\AACxFTx.exe
  C:\Windows\System\AACxFTx.exe
  2⤵
  PID:6812
- C:\Windows\System\Nipbbhn.exe
  C:\Windows\System\Nipbbhn.exe
  2⤵
  PID:6876
- C:\Windows\System\MbQMoMk.exe
  C:\Windows\System\MbQMoMk.exe
  2⤵
  PID:6844
- C:\Windows\System\vLvAOOs.exe
  C:\Windows\System\vLvAOOs.exe
  2⤵
  PID:6860
- C:\Windows\System\XYmaVov.exe
  C:\Windows\System\XYmaVov.exe
  2⤵
  PID:6872
- C:\Windows\System\isalJMb.exe
  C:\Windows\System\isalJMb.exe
  2⤵
  PID:6956
- C:\Windows\System\RMxkwDL.exe
  C:\Windows\System\RMxkwDL.exe
  2⤵
  PID:6996
- C:\Windows\System\ouVLPYc.exe
  C:\Windows\System\ouVLPYc.exe
  2⤵
  PID:7032
- C:\Windows\System\boVSQGB.exe
  C:\Windows\System\boVSQGB.exe
  2⤵
  PID:7132
- C:\Windows\System\AGWBoMl.exe
  C:\Windows\System\AGWBoMl.exe
  2⤵
  PID:7164
- C:\Windows\System\jKsBCUY.exe
  C:\Windows\System\jKsBCUY.exe
  2⤵
  PID:6936
- C:\Windows\System\EdXQiYS.exe
  C:\Windows\System\EdXQiYS.exe
  2⤵
  PID:6260
- C:\Windows\System\KMFwsIl.exe
  C:\Windows\System\KMFwsIl.exe
  2⤵
  PID:7080
- C:\Windows\System\ottGECU.exe
  C:\Windows\System\ottGECU.exe
  2⤵
  PID:7148
- C:\Windows\System\lpFmFhz.exe
  C:\Windows\System\lpFmFhz.exe
  2⤵
  PID:6168
- C:\Windows\System\DihjJjB.exe
  C:\Windows\System\DihjJjB.exe
  2⤵
  PID:6324
- C:\Windows\System\DkhyMcF.exe
  C:\Windows\System\DkhyMcF.exe
  2⤵
  PID:6396
- C:\Windows\System\QjWhAoQ.exe
  C:\Windows\System\QjWhAoQ.exe
  2⤵
  PID:6376
- C:\Windows\System\XWDdjjx.exe
  C:\Windows\System\XWDdjjx.exe
  2⤵
  PID:6596
- C:\Windows\System\QdZWTVB.exe
  C:\Windows\System\QdZWTVB.exe
  2⤵
  PID:6560
- C:\Windows\System\fTLjghV.exe
  C:\Windows\System\fTLjghV.exe
  2⤵
  PID:6692
- C:\Windows\System\ryKFfJY.exe
  C:\Windows\System\ryKFfJY.exe
  2⤵
  PID:6580
- C:\Windows\System\mcTvHqt.exe
  C:\Windows\System\mcTvHqt.exe
  2⤵
  PID:6756
- C:\Windows\System\sfwghoo.exe
  C:\Windows\System\sfwghoo.exe
  2⤵
  PID:6816
- C:\Windows\System\VDyvryf.exe
  C:\Windows\System\VDyvryf.exe
  2⤵
  PID:6992
- C:\Windows\System\WYLFNEX.exe
  C:\Windows\System\WYLFNEX.exe
  2⤵
  PID:6988
- C:\Windows\System\XkeWHRK.exe
  C:\Windows\System\XkeWHRK.exe
  2⤵
  PID:6200
- C:\Windows\System\DxDfnlu.exe
  C:\Windows\System\DxDfnlu.exe
  2⤵
  PID:7152
- C:\Windows\System\eScYDgY.exe
  C:\Windows\System\eScYDgY.exe
  2⤵
  PID:6392
- C:\Windows\System\DBHywiN.exe
  C:\Windows\System\DBHywiN.exe
  2⤵
  PID:6628
- C:\Windows\System\saGYXsY.exe
  C:\Windows\System\saGYXsY.exe
  2⤵
  PID:6952
- C:\Windows\System\jURgJHj.exe
  C:\Windows\System\jURgJHj.exe
  2⤵
  PID:6424
- C:\Windows\System\fKPGtzq.exe
  C:\Windows\System\fKPGtzq.exe
  2⤵
  PID:7176
- C:\Windows\System\nvqCYTC.exe
  C:\Windows\System\nvqCYTC.exe
  2⤵
  PID:7192
- C:\Windows\System\ylrbjNz.exe
  C:\Windows\System\ylrbjNz.exe
  2⤵
  PID:7208
- C:\Windows\System\tBlNgUs.exe
  C:\Windows\System\tBlNgUs.exe
  2⤵
  PID:7224
- C:\Windows\System\EqXsetd.exe
  C:\Windows\System\EqXsetd.exe
  2⤵
  PID:7240
- C:\Windows\System\OdQshmW.exe
  C:\Windows\System\OdQshmW.exe
  2⤵
  PID:7256
- C:\Windows\System\wyrrHsw.exe
  C:\Windows\System\wyrrHsw.exe
  2⤵
  PID:7272
- C:\Windows\System\wbgjGBZ.exe
  C:\Windows\System\wbgjGBZ.exe
  2⤵
  PID:7288
- C:\Windows\System\iKbpJom.exe
  C:\Windows\System\iKbpJom.exe
  2⤵
  PID:7304
- C:\Windows\System\wnvNIBC.exe
  C:\Windows\System\wnvNIBC.exe
  2⤵
  PID:7320
- C:\Windows\System\LztmKNO.exe
  C:\Windows\System\LztmKNO.exe
  2⤵
  PID:7336
- C:\Windows\System\MQqGrbS.exe
  C:\Windows\System\MQqGrbS.exe
  2⤵
  PID:7352
- C:\Windows\System\iNsmPFS.exe
  C:\Windows\System\iNsmPFS.exe
  2⤵
  PID:7368
- C:\Windows\System\yoIJyAs.exe
  C:\Windows\System\yoIJyAs.exe
  2⤵
  PID:7384
- C:\Windows\System\EcYGzFP.exe
  C:\Windows\System\EcYGzFP.exe
  2⤵
  PID:7400
- C:\Windows\System\LHAerGD.exe
  C:\Windows\System\LHAerGD.exe
  2⤵
  PID:7416
- C:\Windows\System\tTvGiOJ.exe
  C:\Windows\System\tTvGiOJ.exe
  2⤵
  PID:7432
- C:\Windows\System\nzmVJHX.exe
  C:\Windows\System\nzmVJHX.exe
  2⤵
  PID:7448
- C:\Windows\System\WlTOCTD.exe
  C:\Windows\System\WlTOCTD.exe
  2⤵
  PID:7464
- C:\Windows\System\xgbWgeR.exe
  C:\Windows\System\xgbWgeR.exe
  2⤵
  PID:7480
- C:\Windows\System\FCuilBv.exe
  C:\Windows\System\FCuilBv.exe
  2⤵
  PID:7496
- C:\Windows\System\qnvlQKv.exe
  C:\Windows\System\qnvlQKv.exe
  2⤵
  PID:7512
- C:\Windows\System\ZaWpWgU.exe
  C:\Windows\System\ZaWpWgU.exe
  2⤵
  PID:7528
- C:\Windows\System\eAqgpfV.exe
  C:\Windows\System\eAqgpfV.exe
  2⤵
  PID:7544
- C:\Windows\System\BKYmlYB.exe
  C:\Windows\System\BKYmlYB.exe
  2⤵
  PID:7560
- C:\Windows\System\ogxxSxn.exe
  C:\Windows\System\ogxxSxn.exe
  2⤵
  PID:7580
- C:\Windows\System\uhEUVUh.exe
  C:\Windows\System\uhEUVUh.exe
  2⤵
  PID:7596
- C:\Windows\System\LDuKkBz.exe
  C:\Windows\System\LDuKkBz.exe
  2⤵
  PID:7612
- C:\Windows\System\MuXhfjK.exe
  C:\Windows\System\MuXhfjK.exe
  2⤵
  PID:7628
- C:\Windows\System\TqVzfzq.exe
  C:\Windows\System\TqVzfzq.exe
  2⤵
  PID:7644
- C:\Windows\System\taQTpXJ.exe
  C:\Windows\System\taQTpXJ.exe
  2⤵
  PID:7660
- C:\Windows\System\XgusOfs.exe
  C:\Windows\System\XgusOfs.exe
  2⤵
  PID:7676
- C:\Windows\System\ALZStZO.exe
  C:\Windows\System\ALZStZO.exe
  2⤵
  PID:7692
- C:\Windows\System\KVuzMyB.exe
  C:\Windows\System\KVuzMyB.exe
  2⤵
  PID:7708
- C:\Windows\System\ZQxjNzX.exe
  C:\Windows\System\ZQxjNzX.exe
  2⤵
  PID:7724
- C:\Windows\System\Pqvptsy.exe
  C:\Windows\System\Pqvptsy.exe
  2⤵
  PID:7740
- C:\Windows\System\pvmtVgT.exe
  C:\Windows\System\pvmtVgT.exe
  2⤵
  PID:7756
- C:\Windows\System\vdEIXsN.exe
  C:\Windows\System\vdEIXsN.exe
  2⤵
  PID:7772
- C:\Windows\System\krCpuLE.exe
  C:\Windows\System\krCpuLE.exe
  2⤵
  PID:7788
- C:\Windows\System\NbdgMLv.exe
  C:\Windows\System\NbdgMLv.exe
  2⤵
  PID:7804
- C:\Windows\System\ToqQAvq.exe
  C:\Windows\System\ToqQAvq.exe
  2⤵
  PID:7820
- C:\Windows\System\boxBRqK.exe
  C:\Windows\System\boxBRqK.exe
  2⤵
  PID:7836
- C:\Windows\System\nESQgKq.exe
  C:\Windows\System\nESQgKq.exe
  2⤵
  PID:7852
- C:\Windows\System\KvqIZYM.exe
  C:\Windows\System\KvqIZYM.exe
  2⤵
  PID:7868
- C:\Windows\System\fKWBNiQ.exe
  C:\Windows\System\fKWBNiQ.exe
  2⤵
  PID:7884
- C:\Windows\System\wygjJAF.exe
  C:\Windows\System\wygjJAF.exe
  2⤵
  PID:7900
- C:\Windows\System\EwREMOA.exe
  C:\Windows\System\EwREMOA.exe
  2⤵
  PID:7916
- C:\Windows\System\XgPXQRO.exe
  C:\Windows\System\XgPXQRO.exe
  2⤵
  PID:7932
- C:\Windows\System\mHUgmGa.exe
  C:\Windows\System\mHUgmGa.exe
  2⤵
  PID:7948
- C:\Windows\System\gtvGaVF.exe
  C:\Windows\System\gtvGaVF.exe
  2⤵
  PID:7964
- C:\Windows\System\xCCRbCx.exe
  C:\Windows\System\xCCRbCx.exe
  2⤵
  PID:7980
- C:\Windows\System\CnGPKzx.exe
  C:\Windows\System\CnGPKzx.exe
  2⤵
  PID:7996
- C:\Windows\System\JdFiulm.exe
  C:\Windows\System\JdFiulm.exe
  2⤵
  PID:8012
- C:\Windows\System\PuoEDQV.exe
  C:\Windows\System\PuoEDQV.exe
  2⤵
  PID:8028
- C:\Windows\System\whfognf.exe
  C:\Windows\System\whfognf.exe
  2⤵
  PID:8044
- C:\Windows\System\ntorywV.exe
  C:\Windows\System\ntorywV.exe
  2⤵
  PID:8060
- C:\Windows\System\xzNPSUF.exe
  C:\Windows\System\xzNPSUF.exe
  2⤵
  PID:8076
- C:\Windows\System\qhHdnFw.exe
  C:\Windows\System\qhHdnFw.exe
  2⤵
  PID:8092
- C:\Windows\System\SoWYUdT.exe
  C:\Windows\System\SoWYUdT.exe
  2⤵
  PID:8108
- C:\Windows\System\TyssgpX.exe
  C:\Windows\System\TyssgpX.exe
  2⤵
  PID:8124
- C:\Windows\System\BQJewSS.exe
  C:\Windows\System\BQJewSS.exe
  2⤵
  PID:8140
- C:\Windows\System\BPDFFhR.exe
  C:\Windows\System\BPDFFhR.exe
  2⤵
  PID:8156
- C:\Windows\System\gVgzESB.exe
  C:\Windows\System\gVgzESB.exe
  2⤵
  PID:8172
- C:\Windows\System\NvQjNnM.exe
  C:\Windows\System\NvQjNnM.exe
  2⤵
  PID:8188
- C:\Windows\System\OmSXRLV.exe
  C:\Windows\System\OmSXRLV.exe
  2⤵
  PID:7000
- C:\Windows\System\ETXaaKo.exe
  C:\Windows\System\ETXaaKo.exe
  2⤵
  PID:7236
- C:\Windows\System\WGmxfpK.exe
  C:\Windows\System\WGmxfpK.exe
  2⤵
  PID:7300
- C:\Windows\System\HnEHteB.exe
  C:\Windows\System\HnEHteB.exe
  2⤵
  PID:6892
- C:\Windows\System\pJiJlKV.exe
  C:\Windows\System\pJiJlKV.exe
  2⤵
  PID:6492
- C:\Windows\System\PYuwYVN.exe
  C:\Windows\System\PYuwYVN.exe
  2⤵
  PID:6856
- C:\Windows\System\xbRYJZL.exe
  C:\Windows\System\xbRYJZL.exe
  2⤵
  PID:6724
- C:\Windows\System\bvyBBIu.exe
  C:\Windows\System\bvyBBIu.exe
  2⤵
  PID:6920
- C:\Windows\System\kdiVcJy.exe
  C:\Windows\System\kdiVcJy.exe
  2⤵
  PID:6508
- C:\Windows\System\ZYZWEbe.exe
  C:\Windows\System\ZYZWEbe.exe
  2⤵
  PID:7188
- C:\Windows\System\XvJSyHW.exe
  C:\Windows\System\XvJSyHW.exe
  2⤵
  PID:7016
- C:\Windows\System\hbaOfJM.exe
  C:\Windows\System\hbaOfJM.exe
  2⤵
  PID:7116
- C:\Windows\System\smvgOGs.exe
  C:\Windows\System\smvgOGs.exe
  2⤵
  PID:6408
- C:\Windows\System\UdGdBOh.exe
  C:\Windows\System\UdGdBOh.exe
  2⤵
  PID:7252
- C:\Windows\System\hOSRBKb.exe
  C:\Windows\System\hOSRBKb.exe
  2⤵
  PID:7316
- C:\Windows\System\tVVuVSo.exe
  C:\Windows\System\tVVuVSo.exe
  2⤵
  PID:7428
- C:\Windows\System\eTfoYjv.exe
  C:\Windows\System\eTfoYjv.exe
  2⤵
  PID:7492
- C:\Windows\System\nLYKfKN.exe
  C:\Windows\System\nLYKfKN.exe
  2⤵
  PID:7552
- C:\Windows\System\TJegGvs.exe
  C:\Windows\System\TJegGvs.exe
  2⤵
  PID:7592
- C:\Windows\System\hVBoBsU.exe
  C:\Windows\System\hVBoBsU.exe
  2⤵
  PID:7656
- C:\Windows\System\DILwzdg.exe
  C:\Windows\System\DILwzdg.exe
  2⤵
  PID:7688
- C:\Windows\System\KtuZWHG.exe
  C:\Windows\System\KtuZWHG.exe
  2⤵
  PID:7752
- C:\Windows\System\rYrlYUg.exe
  C:\Windows\System\rYrlYUg.exe
  2⤵
  PID:7844
- C:\Windows\System\ivzQkmo.exe
  C:\Windows\System\ivzQkmo.exe
  2⤵
  PID:7704
- C:\Windows\System\fdpEWqu.exe
  C:\Windows\System\fdpEWqu.exe
  2⤵
  PID:7476
- C:\Windows\System\KTnrjvi.exe
  C:\Windows\System\KTnrjvi.exe
  2⤵
  PID:7944
- C:\Windows\System\xcpPLYJ.exe
  C:\Windows\System\xcpPLYJ.exe
  2⤵
  PID:8008
- C:\Windows\System\HKLfufZ.exe
  C:\Windows\System\HKLfufZ.exe
  2⤵
  PID:8068
- C:\Windows\System\jHdomkF.exe
  C:\Windows\System\jHdomkF.exe
  2⤵
  PID:7672
- C:\Windows\System\goAtjXu.exe
  C:\Windows\System\goAtjXu.exe
  2⤵
  PID:7992
- C:\Windows\System\yUUQMFO.exe
  C:\Windows\System\yUUQMFO.exe
  2⤵
  PID:7896
- C:\Windows\System\gYAeVNY.exe
  C:\Windows\System\gYAeVNY.exe
  2⤵
  PID:7956
- C:\Windows\System\XswbqUK.exe
  C:\Windows\System\XswbqUK.exe
  2⤵
  PID:8088
- C:\Windows\System\iufHScA.exe
  C:\Windows\System\iufHScA.exe
  2⤵
  PID:8132
- C:\Windows\System\gNYURcC.exe
  C:\Windows\System\gNYURcC.exe
  2⤵
  PID:7172
- C:\Windows\System\mjIBxfh.exe
  C:\Windows\System\mjIBxfh.exe
  2⤵
  PID:2224
- C:\Windows\System\cavVDjP.exe
  C:\Windows\System\cavVDjP.exe
  2⤵
  PID:7364
- C:\Windows\System\MHnNAOW.exe
  C:\Windows\System\MHnNAOW.exe
  2⤵
  PID:7328
- C:\Windows\System\xZfXxfk.exe
  C:\Windows\System\xZfXxfk.exe
  2⤵
  PID:6704
- C:\Windows\System\ApMSgJS.exe
  C:\Windows\System\ApMSgJS.exe
  2⤵
  PID:7220
- C:\Windows\System\rmrGNwJ.exe
  C:\Windows\System\rmrGNwJ.exe
  2⤵
  PID:6984
- C:\Windows\System\lQtAfBa.exe
  C:\Windows\System\lQtAfBa.exe
  2⤵
  PID:7284
- C:\Windows\System\sySoerL.exe
  C:\Windows\System\sySoerL.exe
  2⤵
  PID:7344
- C:\Windows\System\nzqoWYr.exe
  C:\Windows\System\nzqoWYr.exe
  2⤵
  PID:7588
- C:\Windows\System\tEyHGik.exe
  C:\Windows\System\tEyHGik.exe
  2⤵
  PID:7684
- C:\Windows\System\cHGOUfe.exe
  C:\Windows\System\cHGOUfe.exe
  2⤵
  PID:7524
- C:\Windows\System\jJNhMoz.exe
  C:\Windows\System\jJNhMoz.exe
  2⤵
  PID:7652
- C:\Windows\System\hnnKGeE.exe
  C:\Windows\System\hnnKGeE.exe
  2⤵
  PID:7444
- C:\Windows\System\jAIywhl.exe
  C:\Windows\System\jAIywhl.exe
  2⤵
  PID:7828
- C:\Windows\System\nqZiNLg.exe
  C:\Windows\System\nqZiNLg.exe
  2⤵
  PID:7640
- C:\Windows\System\IXrnyzq.exe
  C:\Windows\System\IXrnyzq.exe
  2⤵
  PID:7576
- C:\Windows\System\CSKHWRH.exe
  C:\Windows\System\CSKHWRH.exe
  2⤵
  PID:8040
- C:\Windows\System\RzxLjrX.exe
  C:\Windows\System\RzxLjrX.exe
  2⤵
  PID:7908
- C:\Windows\System\cmBUiRr.exe
  C:\Windows\System\cmBUiRr.exe
  2⤵
  PID:7768
- C:\Windows\System\eoEASac.exe
  C:\Windows\System\eoEASac.exe
  2⤵
  PID:7812
- C:\Windows\System\vzCvumO.exe
  C:\Windows\System\vzCvumO.exe
  2⤵
  PID:8104
- C:\Windows\System\FmcjWeo.exe
  C:\Windows\System\FmcjWeo.exe
  2⤵
  PID:8168
- C:\Windows\System\iQzIWzi.exe
  C:\Windows\System\iQzIWzi.exe
  2⤵
  PID:7280
- C:\Windows\System\TMoUDsl.exe
  C:\Windows\System\TMoUDsl.exe
  2⤵
  PID:7112
- C:\Windows\System\rKUJCii.exe
  C:\Windows\System\rKUJCii.exe
  2⤵
  PID:7720
- C:\Windows\System\UrtdNzD.exe
  C:\Windows\System\UrtdNzD.exe
  2⤵
  PID:8004
- C:\Windows\System\UJtftqt.exe
  C:\Windows\System\UJtftqt.exe
  2⤵
  PID:7732
- C:\Windows\System\CvCmuMp.exe
  C:\Windows\System\CvCmuMp.exe
  2⤵
  PID:7764
- C:\Windows\System\FftQvll.exe
  C:\Windows\System\FftQvll.exe
  2⤵
  PID:6852
- C:\Windows\System\dxRobgp.exe
  C:\Windows\System\dxRobgp.exe
  2⤵
  PID:7184
- C:\Windows\System\INsGQex.exe
  C:\Windows\System\INsGQex.exe
  2⤵
  PID:7668
- C:\Windows\System\bQURHEV.exe
  C:\Windows\System\bQURHEV.exe
  2⤵
  PID:7892
- C:\Windows\System\zorBHyr.exe
  C:\Windows\System\zorBHyr.exe
  2⤵
  PID:8020
- C:\Windows\System\HFmArWp.exe
  C:\Windows\System\HFmArWp.exe
  2⤵
  PID:6940
- C:\Windows\System\KJKKvvB.exe
  C:\Windows\System\KJKKvvB.exe
  2⤵
  PID:7784
- C:\Windows\System\OSKlNgL.exe
  C:\Windows\System\OSKlNgL.exe
  2⤵
  PID:7268
- C:\Windows\System\SbxUSFz.exe
  C:\Windows\System\SbxUSFz.exe
  2⤵
  PID:6888
- C:\Windows\System\hnRhAHY.exe
  C:\Windows\System\hnRhAHY.exe
  2⤵
  PID:8072
- C:\Windows\System\UULvlnB.exe
  C:\Windows\System\UULvlnB.exe
  2⤵
  PID:8208
- C:\Windows\System\JwmPFXG.exe
  C:\Windows\System\JwmPFXG.exe
  2⤵
  PID:8224
- C:\Windows\System\eZhWFLR.exe
  C:\Windows\System\eZhWFLR.exe
  2⤵
  PID:8240
- C:\Windows\System\fnUzENt.exe
  C:\Windows\System\fnUzENt.exe
  2⤵
  PID:8256
- C:\Windows\System\nyiTJbS.exe
  C:\Windows\System\nyiTJbS.exe
  2⤵
  PID:8272
- C:\Windows\System\iKsITDB.exe
  C:\Windows\System\iKsITDB.exe
  2⤵
  PID:8288
- C:\Windows\System\NwcrKQS.exe
  C:\Windows\System\NwcrKQS.exe
  2⤵
  PID:8304
- C:\Windows\System\refCOcX.exe
  C:\Windows\System\refCOcX.exe
  2⤵
  PID:8320
- C:\Windows\System\NZOOGPS.exe
  C:\Windows\System\NZOOGPS.exe
  2⤵
  PID:8336
- C:\Windows\System\AySlQlA.exe
  C:\Windows\System\AySlQlA.exe
  2⤵
  PID:8352
- C:\Windows\System\TggCUml.exe
  C:\Windows\System\TggCUml.exe
  2⤵
  PID:8368
- C:\Windows\System\tTefsBt.exe
  C:\Windows\System\tTefsBt.exe
  2⤵
  PID:8384
- C:\Windows\System\wLMWfoa.exe
  C:\Windows\System\wLMWfoa.exe
  2⤵
  PID:8400
- C:\Windows\System\lhzdXhN.exe
  C:\Windows\System\lhzdXhN.exe
  2⤵
  PID:8416
- C:\Windows\System\uQqBlsD.exe
  C:\Windows\System\uQqBlsD.exe
  2⤵
  PID:8432
- C:\Windows\System\kvulcto.exe
  C:\Windows\System\kvulcto.exe
  2⤵
  PID:8448
- C:\Windows\System\jytYwZj.exe
  C:\Windows\System\jytYwZj.exe
  2⤵
  PID:8464
- C:\Windows\System\CWEEUXx.exe
  C:\Windows\System\CWEEUXx.exe
  2⤵
  PID:8480
- C:\Windows\System\ODUcBux.exe
  C:\Windows\System\ODUcBux.exe
  2⤵
  PID:8496
- C:\Windows\System\nYlFkUE.exe
  C:\Windows\System\nYlFkUE.exe
  2⤵
  PID:8512
- C:\Windows\System\FeJiLey.exe
  C:\Windows\System\FeJiLey.exe
  2⤵
  PID:8528
- C:\Windows\System\uaJZtII.exe
  C:\Windows\System\uaJZtII.exe
  2⤵
  PID:8544
- C:\Windows\System\SMPtzhR.exe
  C:\Windows\System\SMPtzhR.exe
  2⤵
  PID:8560
- C:\Windows\System\ckjooDA.exe
  C:\Windows\System\ckjooDA.exe
  2⤵
  PID:8576
- C:\Windows\System\WWYqoeW.exe
  C:\Windows\System\WWYqoeW.exe
  2⤵
  PID:8620
- C:\Windows\System\nvkzAwa.exe
  C:\Windows\System\nvkzAwa.exe
  2⤵
  PID:8636
- C:\Windows\System\hbFFOeH.exe
  C:\Windows\System\hbFFOeH.exe
  2⤵
  PID:8652
- C:\Windows\System\xCDnIQY.exe
  C:\Windows\System\xCDnIQY.exe
  2⤵
  PID:8668
- C:\Windows\System\zBYcFjU.exe
  C:\Windows\System\zBYcFjU.exe
  2⤵
  PID:8688
- C:\Windows\System\VeZYhkF.exe
  C:\Windows\System\VeZYhkF.exe
  2⤵
  PID:8704
- C:\Windows\System\wYhrwRx.exe
  C:\Windows\System\wYhrwRx.exe
  2⤵
  PID:8720
- C:\Windows\System\azoQcii.exe
  C:\Windows\System\azoQcii.exe
  2⤵
  PID:8740
- C:\Windows\System\ibhDjRE.exe
  C:\Windows\System\ibhDjRE.exe
  2⤵
  PID:8756
- C:\Windows\System\yVQfbex.exe
  C:\Windows\System\yVQfbex.exe
  2⤵
  PID:8772
- C:\Windows\System\feZPEtZ.exe
  C:\Windows\System\feZPEtZ.exe
  2⤵
  PID:8792
- C:\Windows\System\ZgQjysf.exe
  C:\Windows\System\ZgQjysf.exe
  2⤵
  PID:8808
- C:\Windows\System\CMdjfKm.exe
  C:\Windows\System\CMdjfKm.exe
  2⤵
  PID:8828
- C:\Windows\System\FNmSBmx.exe
  C:\Windows\System\FNmSBmx.exe
  2⤵
  PID:8844
- C:\Windows\System\LyJZzue.exe
  C:\Windows\System\LyJZzue.exe
  2⤵
  PID:8864
- C:\Windows\System\IEIQPwK.exe
  C:\Windows\System\IEIQPwK.exe
  2⤵
  PID:8880
- C:\Windows\System\BOQWdVC.exe
  C:\Windows\System\BOQWdVC.exe
  2⤵
  PID:8896
- C:\Windows\System\QMDWQHa.exe
  C:\Windows\System\QMDWQHa.exe
  2⤵
  PID:8912
- C:\Windows\System\OlvCLjD.exe
  C:\Windows\System\OlvCLjD.exe
  2⤵
  PID:8928
- C:\Windows\System\SvbFUIA.exe
  C:\Windows\System\SvbFUIA.exe
  2⤵
  PID:8948
- C:\Windows\System\yyMWgkc.exe
  C:\Windows\System\yyMWgkc.exe
  2⤵
  PID:8964
- C:\Windows\System\HfgouFP.exe
  C:\Windows\System\HfgouFP.exe
  2⤵
  PID:8984
- C:\Windows\System\kampBTA.exe
  C:\Windows\System\kampBTA.exe
  2⤵
  PID:9000
- C:\Windows\System\YzwvShG.exe
  C:\Windows\System\YzwvShG.exe
  2⤵
  PID:9016
- C:\Windows\System\NhCTGmO.exe
  C:\Windows\System\NhCTGmO.exe
  2⤵
  PID:9032
- C:\Windows\System\AKYymOv.exe
  C:\Windows\System\AKYymOv.exe
  2⤵
  PID:9128
- C:\Windows\System\hdJFxbY.exe
  C:\Windows\System\hdJFxbY.exe
  2⤵
  PID:9144
- C:\Windows\System\dqavgHV.exe
  C:\Windows\System\dqavgHV.exe
  2⤵
  PID:9168
- C:\Windows\System\cwUWZmF.exe
  C:\Windows\System\cwUWZmF.exe
  2⤵
  PID:9184
- C:\Windows\System\kUQNGkv.exe
  C:\Windows\System\kUQNGkv.exe
  2⤵
  PID:9200
- C:\Windows\System\isHapua.exe
  C:\Windows\System\isHapua.exe
  2⤵
  PID:8184
- C:\Windows\System\yeQwZhs.exe
  C:\Windows\System\yeQwZhs.exe
  2⤵
  PID:7408
- C:\Windows\System\LftxjHg.exe
  C:\Windows\System\LftxjHg.exe
  2⤵
  PID:7204
- C:\Windows\System\ZfEnWNs.exe
  C:\Windows\System\ZfEnWNs.exe
  2⤵
  PID:8204
- C:\Windows\System\PruDnNA.exe
  C:\Windows\System\PruDnNA.exe
  2⤵
  PID:8220
- C:\Windows\System\WJFhAwK.exe
  C:\Windows\System\WJFhAwK.exe
  2⤵
  PID:8280
- C:\Windows\System\VRcOVzE.exe
  C:\Windows\System\VRcOVzE.exe
  2⤵
  PID:8312
- C:\Windows\System\Wcjqyzt.exe
  C:\Windows\System\Wcjqyzt.exe
  2⤵
  PID:8408
- C:\Windows\System\TgjeTds.exe
  C:\Windows\System\TgjeTds.exe
  2⤵
  PID:8296
- C:\Windows\System\iXFAhFU.exe
  C:\Windows\System\iXFAhFU.exe
  2⤵
  PID:8300
- C:\Windows\System\PmhEnXO.exe
  C:\Windows\System\PmhEnXO.exe
  2⤵
  PID:8268
- C:\Windows\System\cBdmPlK.exe
  C:\Windows\System\cBdmPlK.exe
  2⤵
  PID:8360
- C:\Windows\System\NJVdLqE.exe
  C:\Windows\System\NJVdLqE.exe
  2⤵
  PID:8488
- C:\Windows\System\LUuQSrH.exe
  C:\Windows\System\LUuQSrH.exe
  2⤵
  PID:8536
- C:\Windows\System\kYpSTfH.exe
  C:\Windows\System\kYpSTfH.exe
  2⤵
  PID:8572
- C:\Windows\System\BFOrzme.exe
  C:\Windows\System\BFOrzme.exe
  2⤵
  PID:8584
- C:\Windows\System\aASxXxY.exe
  C:\Windows\System\aASxXxY.exe
  2⤵
  PID:7928
- C:\Windows\System\oDrfeha.exe
  C:\Windows\System\oDrfeha.exe
  2⤵
  PID:8664
- C:\Windows\System\DdJKXjY.exe
  C:\Windows\System\DdJKXjY.exe
  2⤵
  PID:8644
- C:\Windows\System\TghnFeM.exe
  C:\Windows\System\TghnFeM.exe
  2⤵
  PID:8680
- C:\Windows\System\BaPgkBM.exe
  C:\Windows\System\BaPgkBM.exe
  2⤵
  PID:8732
- C:\Windows\System\waUosfq.exe
  C:\Windows\System\waUosfq.exe
  2⤵
  PID:8768
- C:\Windows\System\aywJyTS.exe
  C:\Windows\System\aywJyTS.exe
  2⤵
  PID:8872
- C:\Windows\System\qpAJbax.exe
  C:\Windows\System\qpAJbax.exe
  2⤵
  PID:8908
- C:\Windows\System\cBTfOgT.exe
  C:\Windows\System\cBTfOgT.exe
  2⤵
  PID:8972
- C:\Windows\System\osUrQsJ.exe
  C:\Windows\System\osUrQsJ.exe
  2⤵
  PID:8748
- C:\Windows\System\kCzwmMH.exe
  C:\Windows\System\kCzwmMH.exe
  2⤵
  PID:8960
- C:\Windows\System\UmJKkgd.exe
  C:\Windows\System\UmJKkgd.exe
  2⤵
  PID:8788
- C:\Windows\System\MHQoYlP.exe
  C:\Windows\System\MHQoYlP.exe
  2⤵
  PID:8852
- C:\Windows\System\hKsHRbc.exe
  C:\Windows\System\hKsHRbc.exe
  2⤵
  PID:8920
- C:\Windows\System\visPKQG.exe
  C:\Windows\System\visPKQG.exe
  2⤵
  PID:9008
- C:\Windows\System\hFlCvfx.exe
  C:\Windows\System\hFlCvfx.exe
  2⤵
  PID:9024
- C:\Windows\System\pdFChLa.exe
  C:\Windows\System\pdFChLa.exe
  2⤵
  PID:9064
- C:\Windows\System\xnqIDDg.exe
  C:\Windows\System\xnqIDDg.exe
  2⤵
  PID:9080
- C:\Windows\System\RsRRshm.exe
  C:\Windows\System\RsRRshm.exe
  2⤵
  PID:9100
- C:\Windows\System\EyHQPXN.exe
  C:\Windows\System\EyHQPXN.exe
  2⤵
  PID:9116
- C:\Windows\System\WViIAzL.exe
  C:\Windows\System\WViIAzL.exe
  2⤵
  PID:9192
- C:\Windows\System\LeBDxQY.exe
  C:\Windows\System\LeBDxQY.exe
  2⤵
  PID:9152
- C:\Windows\System\TgLkVfe.exe
  C:\Windows\System\TgLkVfe.exe
  2⤵
  PID:9176
- C:\Windows\System\QtaJnRE.exe
  C:\Windows\System\QtaJnRE.exe
  2⤵
  PID:9140
- C:\Windows\System\xfcJOoU.exe
  C:\Windows\System\xfcJOoU.exe
  2⤵
  PID:7864
- C:\Windows\System\MGOtblu.exe
  C:\Windows\System\MGOtblu.exe
  2⤵
  PID:8248
- C:\Windows\System\zcluQBA.exe
  C:\Windows\System\zcluQBA.exe
  2⤵
  PID:8380
- C:\Windows\System\OlZfDoH.exe
  C:\Windows\System\OlZfDoH.exe
  2⤵
  PID:8332
- C:\Windows\System\avxHTPB.exe
  C:\Windows\System\avxHTPB.exe
  2⤵
  PID:8456
- C:\Windows\System\VcoBQmb.exe
  C:\Windows\System\VcoBQmb.exe
  2⤵
  PID:8364
- C:\Windows\System\NXOhNHY.exe
  C:\Windows\System\NXOhNHY.exe
  2⤵
  PID:8588
- C:\Windows\System\ujaWwIc.exe
  C:\Windows\System\ujaWwIc.exe
  2⤵
  PID:8568
- C:\Windows\System\GGyzbIQ.exe
  C:\Windows\System\GGyzbIQ.exe
  2⤵
  PID:8632
- C:\Windows\System\XOEJAUS.exe
  C:\Windows\System\XOEJAUS.exe
  2⤵
  PID:8840
- C:\Windows\System\PsSCGEh.exe
  C:\Windows\System\PsSCGEh.exe
  2⤵
  PID:8736
- C:\Windows\System\hCELBdy.exe
  C:\Windows\System\hCELBdy.exe
  2⤵
  PID:8804
- C:\Windows\System\CyceprV.exe
  C:\Windows\System\CyceprV.exe
  2⤵
  PID:9040
- C:\Windows\System\sGMNbPy.exe
  C:\Windows\System\sGMNbPy.exe
  2⤵
  PID:8892
- C:\Windows\System\pHxmiLK.exe
  C:\Windows\System\pHxmiLK.exe
  2⤵
  PID:9076
- C:\Windows\System\IEFcrQA.exe
  C:\Windows\System\IEFcrQA.exe
  2⤵
  PID:1564
- C:\Windows\System\jFhAkDx.exe
  C:\Windows\System\jFhAkDx.exe
  2⤵
  PID:8992
- C:\Windows\System\SPTmkZS.exe
  C:\Windows\System\SPTmkZS.exe
  2⤵
  PID:8996
- C:\Windows\System\fNOlTBF.exe
  C:\Windows\System\fNOlTBF.exe
  2⤵
  PID:9164
- C:\Windows\System\jnOJDrt.exe
  C:\Windows\System\jnOJDrt.exe
  2⤵
  PID:7924
- C:\Windows\System\buupRAP.exe
  C:\Windows\System\buupRAP.exe
  2⤵
  PID:8392
- C:\Windows\System\TyCmqsa.exe
  C:\Windows\System\TyCmqsa.exe
  2⤵
  PID:8264
- C:\Windows\System\hrSmDBZ.exe
  C:\Windows\System\hrSmDBZ.exe
  2⤵
  PID:9160
- C:\Windows\System\BLDTuDD.exe
  C:\Windows\System\BLDTuDD.exe
  2⤵
  PID:8860
- C:\Windows\System\HJESaKD.exe
  C:\Windows\System\HJESaKD.exe
  2⤵
  PID:9136
- C:\Windows\System\CiMMlMl.exe
  C:\Windows\System\CiMMlMl.exe
  2⤵
  PID:8508
- C:\Windows\System\CaTPgkJ.exe
  C:\Windows\System\CaTPgkJ.exe
  2⤵
  PID:8764
- C:\Windows\System\NKmOrGk.exe
  C:\Windows\System\NKmOrGk.exe
  2⤵
  PID:9048
- C:\Windows\System\qZtEUab.exe
  C:\Windows\System\qZtEUab.exe
  2⤵
  PID:9088
- C:\Windows\System\eWSUYdm.exe
  C:\Windows\System\eWSUYdm.exe
  2⤵
  PID:8956
- C:\Windows\System\RvxXnSM.exe
  C:\Windows\System\RvxXnSM.exe
  2⤵
  PID:8520
- C:\Windows\System\JddPUSy.exe
  C:\Windows\System\JddPUSy.exe
  2⤵
  PID:8784
- C:\Windows\System\YWHsXbh.exe
  C:\Windows\System\YWHsXbh.exe
  2⤵
  PID:8980
- C:\Windows\System\VBYHLkT.exe
  C:\Windows\System\VBYHLkT.exe
  2⤵
  PID:8252
- C:\Windows\System\hvvMefd.exe
  C:\Windows\System\hvvMefd.exe
  2⤵
  PID:9228
- C:\Windows\System\UzXDpqG.exe
  C:\Windows\System\UzXDpqG.exe
  2⤵
  PID:9244
- C:\Windows\System\AshcbKQ.exe
  C:\Windows\System\AshcbKQ.exe
  2⤵
  PID:9260
- C:\Windows\System\QaYuOwU.exe
  C:\Windows\System\QaYuOwU.exe
  2⤵
  PID:9276
- C:\Windows\System\xjVHEGA.exe
  C:\Windows\System\xjVHEGA.exe
  2⤵
  PID:9296
- C:\Windows\System\wzxdERE.exe
  C:\Windows\System\wzxdERE.exe
  2⤵
  PID:9312
- C:\Windows\System\IkRavAu.exe
  C:\Windows\System\IkRavAu.exe
  2⤵
  PID:9328
- C:\Windows\System\HWYMDoi.exe
  C:\Windows\System\HWYMDoi.exe
  2⤵
  PID:9344
- C:\Windows\System\wxvqFVZ.exe
  C:\Windows\System\wxvqFVZ.exe
  2⤵
  PID:9360
- C:\Windows\System\XGNSyCk.exe
  C:\Windows\System\XGNSyCk.exe
  2⤵
  PID:9376
- C:\Windows\System\liSRFJC.exe
  C:\Windows\System\liSRFJC.exe
  2⤵
  PID:9392
- C:\Windows\System\NCfnygj.exe
  C:\Windows\System\NCfnygj.exe
  2⤵
  PID:9408
- C:\Windows\System\SCKCpgK.exe
  C:\Windows\System\SCKCpgK.exe
  2⤵
  PID:9428
- C:\Windows\System\tPgpQDc.exe
  C:\Windows\System\tPgpQDc.exe
  2⤵
  PID:9444
- C:\Windows\System\zvzwmLS.exe
  C:\Windows\System\zvzwmLS.exe
  2⤵
  PID:9460
- C:\Windows\System\cbBwscg.exe
  C:\Windows\System\cbBwscg.exe
  2⤵
  PID:9476
- C:\Windows\System\fexNWso.exe
  C:\Windows\System\fexNWso.exe
  2⤵
  PID:9492
- C:\Windows\System\TmESXLN.exe
  C:\Windows\System\TmESXLN.exe
  2⤵
  PID:9508
- C:\Windows\System\eqFkdRA.exe
  C:\Windows\System\eqFkdRA.exe
  2⤵
  PID:9524
- C:\Windows\System\PkMHpoT.exe
  C:\Windows\System\PkMHpoT.exe
  2⤵
  PID:9540
- C:\Windows\System\jBtrYga.exe
  C:\Windows\System\jBtrYga.exe
  2⤵
  PID:9556
- C:\Windows\System\AEZqeUd.exe
  C:\Windows\System\AEZqeUd.exe
  2⤵
  PID:9572
- C:\Windows\System\ZLpppgb.exe
  C:\Windows\System\ZLpppgb.exe
  2⤵
  PID:9600
- C:\Windows\System\hhlcHDW.exe
  C:\Windows\System\hhlcHDW.exe
  2⤵
  PID:9616
- C:\Windows\System\mRSMFgk.exe
  C:\Windows\System\mRSMFgk.exe
  2⤵
  PID:9636
- C:\Windows\System\WehCkBA.exe
  C:\Windows\System\WehCkBA.exe
  2⤵
  PID:9652
- C:\Windows\System\CqHbfgx.exe
  C:\Windows\System\CqHbfgx.exe
  2⤵
  PID:9668
- C:\Windows\System\ZYJYpCc.exe
  C:\Windows\System\ZYJYpCc.exe
  2⤵
  PID:9684
- C:\Windows\System\QwtqvBM.exe
  C:\Windows\System\QwtqvBM.exe
  2⤵
  PID:9700
- C:\Windows\System\bLchNXG.exe
  C:\Windows\System\bLchNXG.exe
  2⤵
  PID:9720
- C:\Windows\System\InBUQeH.exe
  C:\Windows\System\InBUQeH.exe
  2⤵
  PID:9736
- C:\Windows\System\Fgbegcf.exe
  C:\Windows\System\Fgbegcf.exe
  2⤵
  PID:9752
- C:\Windows\System\aBRESei.exe
  C:\Windows\System\aBRESei.exe
  2⤵
  PID:9768
- C:\Windows\System\WZIQKYC.exe
  C:\Windows\System\WZIQKYC.exe
  2⤵
  PID:9784
- C:\Windows\System\IMFRPlf.exe
  C:\Windows\System\IMFRPlf.exe
  2⤵
  PID:9804
- C:\Windows\System\vECkiyH.exe
  C:\Windows\System\vECkiyH.exe
  2⤵
  PID:9820
- C:\Windows\System\IWGZhXd.exe
  C:\Windows\System\IWGZhXd.exe
  2⤵
  PID:9836
- C:\Windows\System\SEOebPq.exe
  C:\Windows\System\SEOebPq.exe
  2⤵
  PID:9852
- C:\Windows\System\zvESypy.exe
  C:\Windows\System\zvESypy.exe
  2⤵
  PID:9872
- C:\Windows\System\WLpVllL.exe
  C:\Windows\System\WLpVllL.exe
  2⤵
  PID:9892
- C:\Windows\System\wtkSsYT.exe
  C:\Windows\System\wtkSsYT.exe
  2⤵
  PID:9908
- C:\Windows\System\vNMZNiD.exe
  C:\Windows\System\vNMZNiD.exe
  2⤵
  PID:9924
- C:\Windows\System\wSqltfK.exe
  C:\Windows\System\wSqltfK.exe
  2⤵
  PID:9952
- C:\Windows\System\fuOHWFL.exe
  C:\Windows\System\fuOHWFL.exe
  2⤵
  PID:9972
- C:\Windows\System\BlEjmzE.exe
  C:\Windows\System\BlEjmzE.exe
  2⤵
  PID:9988
- C:\Windows\System\ffKTUsr.exe
  C:\Windows\System\ffKTUsr.exe
  2⤵
  PID:10004
- C:\Windows\System\KxFxBlW.exe
  C:\Windows\System\KxFxBlW.exe
  2⤵
  PID:10020
- C:\Windows\System\PmvlbCU.exe
  C:\Windows\System\PmvlbCU.exe
  2⤵
  PID:10044
- C:\Windows\System\wQnrFtB.exe
  C:\Windows\System\wQnrFtB.exe
  2⤵
  PID:10060
- C:\Windows\System\eyWuASY.exe
  C:\Windows\System\eyWuASY.exe
  2⤵
  PID:10076
- C:\Windows\System\cebdjjh.exe
  C:\Windows\System\cebdjjh.exe
  2⤵
  PID:10096
- C:\Windows\System\WDzaMZw.exe
  C:\Windows\System\WDzaMZw.exe
  2⤵
  PID:10112
- C:\Windows\System\zIuVZvt.exe
  C:\Windows\System\zIuVZvt.exe
  2⤵
  PID:10136
- C:\Windows\System\xsllYAx.exe
  C:\Windows\System\xsllYAx.exe
  2⤵
  PID:10208
- C:\Windows\System\mvTPSNo.exe
  C:\Windows\System\mvTPSNo.exe
  2⤵
  PID:10224
- C:\Windows\System\ORnTuik.exe
  C:\Windows\System\ORnTuik.exe
  2⤵
  PID:9124
- C:\Windows\System\ftoqJWg.exe
  C:\Windows\System\ftoqJWg.exe
  2⤵
  PID:9268
- C:\Windows\System\tSSfUUj.exe
  C:\Windows\System\tSSfUUj.exe
  2⤵
  PID:9308
- C:\Windows\System\MxwttvU.exe
  C:\Windows\System\MxwttvU.exe
  2⤵
  PID:9372
- C:\Windows\System\UfJUDNb.exe
  C:\Windows\System\UfJUDNb.exe
  2⤵
  PID:8684
- C:\Windows\System\LVfKzvo.exe
  C:\Windows\System\LVfKzvo.exe
  2⤵
  PID:9440
- C:\Windows\System\nEPHbPx.exe
  C:\Windows\System\nEPHbPx.exe
  2⤵
  PID:9472
- C:\Windows\System\XoNpzIf.exe
  C:\Windows\System\XoNpzIf.exe
  2⤵
  PID:9532
- C:\Windows\System\sfwOOEH.exe
  C:\Windows\System\sfwOOEH.exe
  2⤵
  PID:9292
- C:\Windows\System\qOBgrcO.exe
  C:\Windows\System\qOBgrcO.exe
  2⤵
  PID:9104
- C:\Windows\System\VODZyue.exe
  C:\Windows\System\VODZyue.exe
  2⤵
  PID:9220
- C:\Windows\System\tOBHHHw.exe
  C:\Windows\System\tOBHHHw.exe
  2⤵
  PID:9320
- C:\Windows\System\qRPCxDO.exe
  C:\Windows\System\qRPCxDO.exe
  2⤵
  PID:9516
- C:\Windows\System\DeAuNnJ.exe
  C:\Windows\System\DeAuNnJ.exe
  2⤵
  PID:9424
- C:\Windows\System\NDjbyoR.exe
  C:\Windows\System\NDjbyoR.exe
  2⤵
  PID:9520
- C:\Windows\System\nFHYiKt.exe
  C:\Windows\System\nFHYiKt.exe
  2⤵
  PID:9644
- C:\Windows\System\lRYgyDF.exe
  C:\Windows\System\lRYgyDF.exe
  2⤵
  PID:9708
- C:\Windows\System\dndhkOT.exe
  C:\Windows\System\dndhkOT.exe
  2⤵
  PID:9816
- C:\Windows\System\LFsUmYh.exe
  C:\Windows\System\LFsUmYh.exe
  2⤵
  PID:9844
- C:\Windows\System\BNqSXtt.exe
  C:\Windows\System\BNqSXtt.exe
  2⤵
  PID:9880
- C:\Windows\System\qLVYdzN.exe
  C:\Windows\System\qLVYdzN.exe
  2⤵
  PID:9888
- C:\Windows\System\nOaYIky.exe
  C:\Windows\System\nOaYIky.exe
  2⤵
  PID:9920
- C:\Windows\System\oUZkzGI.exe
  C:\Windows\System\oUZkzGI.exe
  2⤵
  PID:9932
- C:\Windows\System\XNktRhq.exe
  C:\Windows\System\XNktRhq.exe
  2⤵
  PID:9940
- C:\Windows\System\aNTkutJ.exe
  C:\Windows\System\aNTkutJ.exe
  2⤵
  PID:10028
- C:\Windows\System\KwLJLIs.exe
  C:\Windows\System\KwLJLIs.exe
  2⤵
  PID:10072
- C:\Windows\System\MXtEqKJ.exe
  C:\Windows\System\MXtEqKJ.exe
  2⤵
  PID:9980
- C:\Windows\System\WXKsTKK.exe
  C:\Windows\System\WXKsTKK.exe
  2⤵
  PID:10084
- C:\Windows\System\jHXYUon.exe
  C:\Windows\System\jHXYUon.exe
  2⤵
  PID:10124
- C:\Windows\System\UyYMaWa.exe
  C:\Windows\System\UyYMaWa.exe
  2⤵
  PID:10132
- C:\Windows\System\ZZyWjwe.exe
  C:\Windows\System\ZZyWjwe.exe
  2⤵
  PID:10168
- C:\Windows\System\HlbhhwZ.exe
  C:\Windows\System\HlbhhwZ.exe
  2⤵
  PID:10184
- C:\Windows\System\kBxzdQG.exe
  C:\Windows\System\kBxzdQG.exe
  2⤵
  PID:10200
- C:\Windows\System\XlAyfYc.exe
  C:\Windows\System\XlAyfYc.exe
  2⤵
  PID:10236
- C:\Windows\System\iSQxwkM.exe
  C:\Windows\System\iSQxwkM.exe
  2⤵
  PID:9212
- C:\Windows\System\imQOvVF.exe
  C:\Windows\System\imQOvVF.exe
  2⤵
  PID:9368
- C:\Windows\System\FtzHkzx.exe
  C:\Windows\System\FtzHkzx.exe
  2⤵
  PID:9284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AQafrOB.exe

Path C:\Windows\system\AQafrOB.exe
Size 1.7MB
SHA256 1b5c4773e3815c4f3ecadcc3727bc6681568ed306caec92eaf3e309d4a8fd609
MD5 bcffd4a5c46fe117e6e554fbc1d083a5
SHA1 0d9a5681fd538ffe386d716466d6660f5b5d60aa
SHA512 489b17f3bcafd193029b3dd9b7759d9c188da7f27a3216656220eccc287bf1edec0e2c70135d37b734015cb8e8a74efcd63bdb26fe40f9df3950a13b4e26cf69
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9W:Lz071uv4BPMkFfdk2auTqao/c/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDQxwKY.exe

Path C:\Windows\system\BDQxwKY.exe
Size 1.7MB
SHA256 39ccded63378a452cbce0ccc94762f7fb6d9b757592ec37a3756dd45bb467624
MD5 7b1c00545c403be29edf4013bc6fadb2
SHA1 7ef0dcaa47c8d7f72d9633804bff17e7a2df1d96
SHA512 d70f52078bb9699f04174a4be37856de08d16864b13cb361940b2ad284e37b04cdc7601bba13b1d11b9801732f691f24763d2120b1862a2d3a8736a883a2dc99
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9w:Lz071uv4BPMkFfdk2auTqao/c/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXSYrsr.exe

Path C:\Windows\system\IXSYrsr.exe
Size 1.7MB
SHA256 73d31fbc4d3179a853f91746ee0905fc1f03f8b1a32d5c3a5ebe36dfdc83a4e0
MD5 d44b569c68e0133ad6b421b414936d3a
SHA1 c13e6f00491221ee6cd8b3ddc7f4c445b6e6ca4e
SHA512 c0bc1cb058c53be01d48f3d0885c86d7bdc1f0812271096e61fce8d7fbcc29b21fabce6b8d595320ac64825b817455bd0fbc99165e8389ce566756be29ff2b2c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9Z:Lz071uv4BPMkFfdk2auTqao/c/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

LUmkYiW.exe

Path C:\Windows\system\LUmkYiW.exe
Size 1.7MB
SHA256 4481b1cb16a79f80821e556142f761cb5fd69cc575bbdedde9edd346902a4529
MD5 3fe2626c720b9444846d753ab18248d0
SHA1 e5244e79bcab9dcd9d8f895829f6fdc793fb4178
SHA512 f413a8db3f5430cbee3949a51405316e1e290b4e0357db11be68c28d6682ab8be98d66e16739b25cbf29112e7acbdae79c7029aa567338741d920ba5fb71349a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9wz:Lz071uv4BPMkFfdk2auTqao/c/wz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPuNWUj.exe

Path C:\Windows\system\XPuNWUj.exe
Size 1.7MB
SHA256 90406eaf8bbdce90a64985c546600865b7c9e0311287394a7c75828f57c8461e
MD5 cca2ca0b0e3da9ffff5269254003bbf5
SHA1 f4c5031f066d721866a799f0b05a089f48da554d
SHA512 a543158e750f603644a9cfc8fba3c07a338ea38bc5b46c084f2b7bde63f15f1d52e34c589062cf7232b2ee49276a6e1ce86b86b131ff2aa20623cdb15c731d73
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9d6f:Lz071uv4BPMkFfdk2auTqao/c/cf
MD5 SHA1 SHA512 SSDEEP

Submit Download

YnZlPYf.exe

Path C:\Windows\system\YnZlPYf.exe
Size 1.7MB
SHA256 3fbe86d352c6d8421fbb3ace8d712a12860bbd3c1c5a4dd15da1e50c74c7af7b
MD5 f767d6979f8309361a96a7262309d7f2
SHA1 7a3eed1ba0a2f7d4ae78d321fe6f78a54c5c239d
SHA512 624ba1c2469f10d3adba7ae7df284357494dced33b89b47578c7d2cc5fdf7408774b3a111ec66511df1cb818ab7797d028c7cd7d44c2542dc52b6a9aa3acf94f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d906:Lz071uv4BPMkFfdk2auTqao/c/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

aThtiug.exe

Path C:\Windows\system\aThtiug.exe
Size 1.7MB
SHA256 f87ff0e1f243afbcbae4e28de3a5f217601529e96396c124ad9b025ed961e28e
MD5 4145a3635a247914cc09342e42db1059
SHA1 1fa3211f6370a175a6fd5f3f0fd00a6f75918e4d
SHA512 ce912bf4753ca2190806f38087f70b029db0c6395a0a15c9336387840a56ae0cf8646987778d758aa17793f31c94f52c9a8192cf0e7de359788314b3fb5cc283
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9Z:Lz071uv4BPMkFfdk2auTqao/c/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cCCbAEQ.exe

Path C:\Windows\system\cCCbAEQ.exe
Size 1.7MB
SHA256 994c032d312d41ad6ffc7f4b86a447eb3b212fcca36efb0402bd091d46ac18ba
MD5 1fffba9127db582e2e8cf1a64fdfaac9
SHA1 95e7725b228c3d3104d01bbda553f2b525a861e4
SHA512 8b0262acf215eac9a642370bdc054e1397fe410a09af9b732aca8aaa45f8e1468838257e3fa6ebb3f99889226f2099fc4eeae943ccacec366ae76d01b62c1a78
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9Z:Lz071uv4BPMkFfdk2auTqao/c/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

coXMrac.exe

Path C:\Windows\system\coXMrac.exe
Size 1.7MB
SHA256 f63491e2ff2a4d3e0f1951f6b353b8bac81b435b6873365090f9c08e555a2c82
MD5 56efc3178a8d22fb7856fb25ff761cbc
SHA1 d8426f4e0fe86daf9d48c5b6ba8aa08c695c9b45
SHA512 84c14c99898bd88a26b7666b5e74c245f25686e3c3bc60e46cea517f610c1749ea50ed2ac609ad7ffe51a010cb29d995de57f0d5981db436a5f3747317619d1b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9D:Lz071uv4BPMkFfdk2auTqao/c/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftGFGCo.exe

Path C:\Windows\system\ftGFGCo.exe
Size 1.7MB
SHA256 d6f22fbfacb75b2daa2de773563ee4b4f35204b47bab54a919809f1c846c01fd
MD5 d78384cd1aee3a70542a92024b9b0516
SHA1 4ebd83e692d75c3a07a162beff29ebcf558516e8
SHA512 8fc7f5dc21bd54186008485ee6bd12fbf295355afe834e6e932eda20a337de19d2ec501bbc224957920c4141ee9b1ad383f62433a96ce4250e9f588451630750
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d99VTk:Lz071uv4BPMkFfdk2auTqao/c/9Vo
MD5 SHA1 SHA512 SSDEEP

Submit Download

gSSGChD.exe

Path C:\Windows\system\gSSGChD.exe
Size 1.7MB
SHA256 4219665036ce96b09d40ba1543feb2e2595fd4e02f7fd6cbb5c063a88d8f3d6d
MD5 84947489fc077b3fc4f350187a7482fe
SHA1 e47711d4361844efe34f03ffb17fd86389efce9a
SHA512 aa59e2afcb9aeb81547b02a40eea495f8232c7f2db94a26ae73f5fd6b090800b691427a157240df145d497195c52358738fc4f04f092086861fa76b82c6d06c4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9Ta:Lz071uv4BPMkFfdk2auTqao/c/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

inNdZno.exe

Path C:\Windows\system\inNdZno.exe
Size 1.7MB
SHA256 6dff28d4d8731828baa9267661b1bc82ee2e50b9bd98cb8d9e36138c9632ba50
MD5 ecaf732c0bf4a62ba553de0279378c2e
SHA1 a95ea7d267df6f1de44ef134c83da788e5202487
SHA512 edc69869252a9f0199dbac567946aa23df7e678e01981f86a4f2d65cf07904ef8cf6403b2d0c0f88b1faa30b2781cff039735d9faf32faba927c3d7312056e02
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9N:Lz071uv4BPMkFfdk2auTqao/c/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

nzWUwMH.exe

Path C:\Windows\system\nzWUwMH.exe
Size 1.7MB
SHA256 8197aa02c084b41474bf43e81c7e7a2b8b2f2da78c3f5c1395b2cc957d717f60
MD5 e5940a37f54091325f1b9f437a83233e
SHA1 c1ed69a21c35c5f265377c03bdae328fd384502a
SHA512 4f35ed17a1e473984f83aad1fd256e67a93484b496a89001e04ac5b1fd6766053acd18b576b4ee92d7aad717a1823b9e48f96dc2f83fa22fc0a04d1e57a9522e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d91:Lz071uv4BPMkFfdk2auTqao/c/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKaxLgI.exe

Path C:\Windows\system\oKaxLgI.exe
Size 1.7MB
SHA256 c54fd6255774a37381cd6c1ad88d36cfc2a81923b2ab4b8eea99e3f96d566740
MD5 065898cd3e68214a8963d530a77def21
SHA1 7cbad244466ca8abf20f759a1ad7f65fcc61bcae
SHA512 fbcc3ca199b4fced9bab199aa22b88c4976852e8a96a0c686cac23097aca12f7e52ae879fba83284e5099244d91a070481a364c1a7ccbd1d36c9b2ba8a9c3195
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9/:Lz071uv4BPMkFfdk2auTqao/c//
MD5 SHA1 SHA512 SSDEEP

Submit Download

oVQGSwE.exe

Path C:\Windows\system\oVQGSwE.exe
Size 1.7MB
SHA256 73879b6af8bc2dde827eb1ed3b77be902271d2533430c0d15f3e5d401409ca8f
MD5 d4520daa7fd177da35875546186e78ab
SHA1 71f51c0f406b9eff3f2fd09400fc32d205dff5c0
SHA512 829d16de029a413fa0db80d430aaca616f4814725da5a7a2e7e66b9c10063f85462a0941e9ed031f60434a0ae0a17b8167e7b312a30ea50e2d1fe8e3cbdaa084
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9F:Lz071uv4BPMkFfdk2auTqao/c/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

opGlllv.exe

Path C:\Windows\system\opGlllv.exe
Size 1.7MB
SHA256 f9bd7d592de44a1adead216d114be0168ff73805f2e5a70d8caecdc0584f4aae
MD5 cd8874b4860a14f08f95d3ccfc80e56c
SHA1 c24fbd13273d75e13402b972faa2b0da1f6d9b05
SHA512 3a94d3e8888d6ad4e75de0c98882a8d8c224f23ae56434f5dba15a046d547f863748865254856047fdce71e1401ff4a6da030af97d6f66bad0750d66cfdc207c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9s:Lz071uv4BPMkFfdk2auTqao/c/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

utdQnkO.exe

Path C:\Windows\system\utdQnkO.exe
Size 1.7MB
SHA256 0f9129bd5e61897e98e6a2f3aac7542da2b5f11b77e4514283f90ee7477b5266
MD5 5ba53fb89f0fe2b66bcda1b6c15eaa1d
SHA1 fa8874b7705c0f59fd1aeebaf956401be1214143
SHA512 fc13e2da84fb2da083c11a3e93c83df4ac1db28a08844e6c8947f322db7bceaefbd3735cca20ca30e8ddf60eef1b9126a6e2c15850bf8d279978ea921a9e53e8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9F:Lz071uv4BPMkFfdk2auTqao/c/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfYPDbk.exe

Path C:\Windows\system\vfYPDbk.exe
Size 1.7MB
SHA256 c6738e4be6aa6eebdbdf25c443ff50816056ae85dc11a61b6e3bd5e80b011d59
MD5 014d5bbbf223d726c7c7ae37b5532635
SHA1 f6b3d4c1b90eb1dcd3fb596eb501dfd8812c9d21
SHA512 9615038b63a684b6303e88f3a972844e4124650fe4b02268be6e34dd2b0a78bf543a619451da3acecedc85547ed6b7f75d2c4f6a13fdf10596104417e14ff228
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9E8:Lz071uv4BPMkFfdk2auTqao/c/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

wHmaeeg.exe

Path C:\Windows\system\wHmaeeg.exe
Size 1.7MB
SHA256 b70a92bb90d91a397b40979e8a93da52dd5a705a454be5301fcc11c618fae263
MD5 faa9961afa0928ecbd4bf123153b1d0d
SHA1 063af1c9aa5f27a7dade44cc6cc02af57a698520
SHA512 6f95858a26c7cdee5804597da991da7920c73b155197d439bcb2f8abf3247a925fba31dddda63ac1ce8a45d2580f8d2d61955b077d67722064b9ddfdd4a2168e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9/:Lz071uv4BPMkFfdk2auTqao/c//
MD5 SHA1 SHA512 SSDEEP

Submit Download

xPSzUjD.exe

Path C:\Windows\system\xPSzUjD.exe
Size 1.7MB
SHA256 70276c13b1022fa67538ba1c82cf28baf3f621c7ee7997df24deb17f1360ac2a
MD5 e70c79bd295d1fa26ca93aff18ea39dc
SHA1 67fd722f28a07e5cae242b8f480842b956526860
SHA512 c5520a4c00df506569cdfbd16c8449d10757dc7c3512391127c3d3c5545083d8e527d2c09e7d1bc27ada2e7a6ed8cc35085297fbd2ac61ee38d57c21553cdcdd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9b:Lz071uv4BPMkFfdk2auTqao/c/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

yWdUHzx.exe

Path C:\Windows\system\yWdUHzx.exe
Size 1.7MB
SHA256 fa2b933638e7505532b01365b8683d6a3c326fe8e1559dbd097615e18d92f001
MD5 1dc2200b33c914e6ad24b25a70979f27
SHA1 6530a8123ae355527e99c4b71ab370b3eb250652
SHA512 a3567141055b39562ca81537de1d017f4b5d90938497da7fa0a55d70bf5f37a65c45060ed4f3a2c00b177702e4cf7c98a3bdddaffa6e1bf1d3976005849192fc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9C:Lz071uv4BPMkFfdk2auTqao/c/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

zjHaHPq.exe

Path C:\Windows\system\zjHaHPq.exe
Size 1.7MB
SHA256 c1a8c4af097080a78082e1bf4416501546e7a7f68674748fbd3330e168877367
MD5 a974eb6e43a71a1d6bdc3d11c401cbb2
SHA1 a6e684697fa20f7a044fe31037153752f5800dec
SHA512 ab1fd4b2b54a4ec3a1726b53adfd73d3009b5be2eef93a7649b9d86d938db7be6b72c68fefd152881165257aa51389458066ecb3ab97d572b0860f80631de828
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9m:Lz071uv4BPMkFfdk2auTqao/c/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

APFUMiO.exe

Path \Windows\system\APFUMiO.exe
Size 1.7MB
SHA256 2c7f5390de7a05819c3ebe6b5a26bc6069867f45b4ad036548b258a3afe7bfaa
MD5 3e3b3209d3a9a8c3f3c749ae82325d4d
SHA1 07893efa58aaf2e76a9200ace7a8b27092aaca88
SHA512 b39ce689e44ebba105d4a12cb6a6f5d3a34ebbdfd9bccd03645a8da991ef37508914d052b1e1622aa65a9b5b5b74b38a2427a637fe8ffbb66243069c5f1e138b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9G:Lz071uv4BPMkFfdk2auTqao/c/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTXkXZl.exe

Path \Windows\system\BTXkXZl.exe
Size 1.7MB
SHA256 425975ff0c61045c7c232b3647aabeb20d2e682666b6302885dc35f405156ee0
MD5 7b974b6bfbff25212f281f12af7143b9
SHA1 4bd94cb41f62125c98dea2ba23be61b741ea0d2e
SHA512 72f61de73f349153fce97b01d1ac46d243d2b01efe6c378ca3a39c4996df36fbb2e78fb71207e7a7111fcdcac0c0e44488ef4815d52bd3d05fd777a8619ec7cf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9X:Lz071uv4BPMkFfdk2auTqao/c/X
MD5 SHA1 SHA512 SSDEEP

Submit Download

COzodZx.exe

Path \Windows\system\COzodZx.exe
Size 1.7MB
SHA256 19ab56f8b24a95133388452fa73917d9b370817bcb4c7705ff0cc2b533a5f13a
MD5 1ec74a1391bf79efa89ff64cad149940
SHA1 6b47092e44695c4e68dae5610d5ce7df1d51b63f
SHA512 5c321f2a8d193f7376e701ce8c2e8234c80f39c5a1deaf15841b7b4a08332aee0b5cd586ee78b75cc7e45596c268d4c66aa7bd6fe6c0e0b5c0f2710a3dc32bd1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d94:Lz071uv4BPMkFfdk2auTqao/c/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXUdoJX.exe

Path \Windows\system\FXUdoJX.exe
Size 1.7MB
SHA256 eb61c6cb96390f609f75072bfe263a97314ce1c3c7d06d7929f0c2129b580f31
MD5 1c66939713a2a4a27b3c595da9ce35d2
SHA1 aa04967639445f6df9973784ad7887fd5cca1048
SHA512 d80b2047302ab177549de7546f1279b753d6f9969d46163a6f69ae61b229c795fcfba7a43ff30d6b408b05a020bbf91bfc998e412531164cb69ec497f8dc4407
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d99:Lz071uv4BPMkFfdk2auTqao/c/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVEQEQM.exe

Path \Windows\system\HVEQEQM.exe
Size 1.7MB
SHA256 b034315b0d2b877fc15f779b19857b96e834ae60dce60c63143bbcc9c34c09ed
MD5 ace6e09faf6d7a115864dae83c5c8b46
SHA1 485c9007c5d0c6561974ae6bf19305198c500a59
SHA512 d92c6a922472e29d0cc1285edcd0070be5d6e89408684fdd208638c926af8ee953c1c3a4256fc28fcade86c3850f97b76228aeaaf87ee67e156220571ac3ac50
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9gY:Lz071uv4BPMkFfdk2auTqao/c/gY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODxgpXY.exe

Path \Windows\system\ODxgpXY.exe
Size 1.7MB
SHA256 5868e45568259aa21372574c7225c02caa4af31d5a8832d816b725b57cea787f
MD5 41da7ff2d58a39abe6efbb6621d8e104
SHA1 349543616fd2e6959625acd01384e91f6ec91c37
SHA512 6f732f1d944d0efe7124601e1ed7c921ed19a663d59c65e4e4ac1752530d78d961e6e3ffa4e55be591582119169cc627260f9801664d234a2c2eaa916934ac98
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9p:Lz071uv4BPMkFfdk2auTqao/c/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWucenH.exe

Path \Windows\system\OWucenH.exe
Size 1.7MB
SHA256 0944b7d2aac095c5634b7fdd765ac2b50c3e929b2057cdb389ff956cc783488c
MD5 08c857edf4cdc98e27488a39c4d19ddf
SHA1 b45afcb5027e2dd6f8879393dc97e7f7a14dfd66
SHA512 2b9c08c1638d73c7fc0703c59b588c1bcc44373ca1ec04b32aef2f69cef9c7555395efca7a4030ec4f0d40cc42cae24dc1dc9fbe94cbe888a80be0d8d8c1be25
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d94:Lz071uv4BPMkFfdk2auTqao/c/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VhBoqED.exe

Path \Windows\system\VhBoqED.exe
Size 1.7MB
SHA256 81b95275e4ea491dde79ce30f2ef295c94a0d4d8d4f061398520f53703109ec7
MD5 d48045aede4471c85389852d9f391c4e
SHA1 21c9b0c9dbcdcd0193816cc321d822c1e23e0c9c
SHA512 0a77c23981167f5210236347a3c8d47c8a079020fcf4b9afbeaacb2b7b22810cd13e8a002717c23c3e45433883965a58b45fb38dc8107aa6ca639405c7aab163
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9d:Lz071uv4BPMkFfdk2auTqao/c/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

VpgLoIr.exe

Path \Windows\system\VpgLoIr.exe
Size 1.7MB
SHA256 0111ddd3917165d7d023ac7246abd1e74a755f4832cee1a8b434dcf27d82c669
MD5 2daa90dd74d7ba16d962823c1eb0f471
SHA1 536cf3d793026166b58da8ef1e672cc74bd77bf7
SHA512 7f652f73284e3f1ae1f0fce95bd9858ab480ac78e4c65d938f5700008ab8e94f7391453831d3b0e4f55eece0beb78756f5e5907e0d8686248e51f328926fa0e1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d987:Lz071uv4BPMkFfdk2auTqao/c/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

XaFZixs.exe

Path \Windows\system\XaFZixs.exe
Size 1.7MB
SHA256 aeebcbc62005a540e40f6fb79aab452eebf8fcf841db9c8c0df4cc4708c49e42
MD5 13e0a8da78041bb2b341d6d4529bc38b
SHA1 6efef6ff2c1cbda558bbb2f5ca269b1328d3a41d
SHA512 d1778b141f98c3aa8ab14d262e5e7748670de0e5c57afd2e6ce9036be14d2172f42f7a91e9ab1ccf930299c771238adaf02d770508aa4694c32d77540aee3ab3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9H:Lz071uv4BPMkFfdk2auTqao/c/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

YQVGiyM.exe

Path \Windows\system\YQVGiyM.exe
Size 1.7MB
SHA256 e39d4bc43b23a88357bf935db3f682f507c40f0e8873a0788ccd447c47a56411
MD5 d53c5fbb671b270094050f11201c5740
SHA1 4a15ca6a63e0d81ed75c6dd84fceb4e8e63e1036
SHA512 ee84e34cfebd587ba5cab1526eb0092628a9c6a596bc126f81bf79e3aca709a537c136de314b1b070f0c93b3d0044c63f07d7f213ed335878850995c32e6fbbd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9NP:Lz071uv4BPMkFfdk2auTqao/c/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxKbcrq.exe

Path \Windows\system\bxKbcrq.exe
Size 1.7MB
SHA256 670a0c2f7c9365b053cf57f6be67ff0d381252d702cd3e7dba03966a5d3a1942
MD5 5f7dc56343d673c5c09dacdfefac17d5
SHA1 d7b57c5a6865e74c8390b38aea5c642b32d149e3
SHA512 8979ab25b16b80cd842cd8bf5f559cf34702a46804c1360be252e5a85c5a4fd928dd7dfd264fd5e5fc547492036a55deb572bb66e52edfde469f403d4d565b4d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9s:Lz071uv4BPMkFfdk2auTqao/c/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

eNAvOsm.exe

Path \Windows\system\eNAvOsm.exe
Size 1.7MB
SHA256 072a37808d66dd21b2e53a5f4a3e97b293b675582024933b69519b2b75c0932f
MD5 b93db4c82da5479ac6edb5f5ec195d20
SHA1 5caec1b26659e2e313130ad29fff622439fe42fb
SHA512 ce6da27346397912dec432340cb8eae74c004bbdd469d600ff9e46578194b496e9dd7cd3c7b685ecf2ffa8dd213e22b0e0d40ad43cdff7223773ebc6ed0771cf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9m:Lz071uv4BPMkFfdk2auTqao/c/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kzhZMUi.exe

Path \Windows\system\kzhZMUi.exe
Size 1.7MB
SHA256 2f3948563159929b7f2ab13afd6532df8c0b8f05ea649c4a75d9d836af90f0df
MD5 4ac4b3aa420d3401374d2811e57c6ade
SHA1 0a96fe43baa4f8a065e6beee5edab2783812d537
SHA512 45a15ba9d1648725c40e29afdf4029a900e1e61908c3b7bfaf2cbd82a74e0f4d7b98dd25025df20d0e6240907007b10bbe35d489d655947f667626e23478d8be
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9p:Lz071uv4BPMkFfdk2auTqao/c/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

oZOBfpG.exe

Path \Windows\system\oZOBfpG.exe
Size 1.7MB
SHA256 c3ac10ac44ac7955e3ef12490f9b2216f5c3450084d575ea3656796dee65c9c7
MD5 5603e86d9031a4f60455d7c7531bc2c4
SHA1 d1b92754825d4e3db953123e949072c4e572e45a
SHA512 f7c568569e782de343c8dcac3aca027c46b0b028c25100c67f012dc8739afb247ff6811342169b7fbacc2cb8312864aabecabf59c17e8f934d5ca3838ee69506
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9/:Lz071uv4BPMkFfdk2auTqao/c//
MD5 SHA1 SHA512 SSDEEP

Submit Download

roemEhd.exe

Path \Windows\system\roemEhd.exe
Size 1.7MB
SHA256 56988a6b2cb21a9822d80fdab63320a73ce4d56ef4fb98384f267ecd1ff7a85b
MD5 8f57df6f3823cc76d26c362f521e4cb1
SHA1 aab0786ca2d8727e150f2b4ce5d008b39870c0a3
SHA512 24cfa043537c8dde244b554b4f7455e9fc372a25955397df97a7749de3f596bb7f38434ed07dfafdfc6d7fdac439de1eccadae1057efdb27f8c2f5325ce12f47
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTqaQV/cets/d9WJ:Lz071uv4BPMkFfdk2auTqao/c/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1972-24-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Download

memory/1972-4891-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Download

memory/2128-192-0x000000013F980000-0x000000013FD72000-memory.dmp

Download

memory/2128-0-0x000000013F2A0000-0x000000013F692000-memory.dmp

Download

memory/2128-12971-0x00000000029D0000-0x0000000002DC2000-memory.dmp

Download

memory/2128-50-0x000000013F740000-0x000000013FB32000-memory.dmp

Download

memory/2128-12868-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download

memory/2128-146-0x000000013FA60000-0x000000013FE52000-memory.dmp

Download

memory/2128-190-0x0000000002F70000-0x0000000003362000-memory.dmp

Download

memory/2128-189-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Download

memory/2128-8920-0x000000013F2A0000-0x000000013F692000-memory.dmp

Download

memory/2128-16-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Download

memory/2128-160-0x000000013FB40000-0x000000013FF32000-memory.dmp

Download

memory/2128-191-0x000000013FF30000-0x0000000140322000-memory.dmp

Download

memory/2128-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/2128-4-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download

memory/2128-36-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download

memory/2128-28-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Download

memory/2128-59-0x0000000002F70000-0x0000000003362000-memory.dmp

Download

memory/2128-46-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Download

memory/2128-193-0x0000000002F70000-0x0000000003362000-memory.dmp

Download

memory/2128-15-0x00000000029D0000-0x0000000002DC2000-memory.dmp

Download

memory/2588-177-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download

memory/2588-5048-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download

memory/2592-4898-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Download

memory/2592-188-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Download

memory/2656-164-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Download

memory/2656-4899-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Download

memory/2668-19-0x000000013F410000-0x000000013F802000-memory.dmp

Download

memory/2668-4893-0x000000013F410000-0x000000013F802000-memory.dmp

Download

memory/2808-186-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Download

memory/2808-5038-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Download

memory/2996-218-0x00000000028E0000-0x00000000028E8000-memory.dmp

Download

memory/2996-145-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Download

memory/3012-14-0x000000013FDA0000-0x0000000140192000-memory.dmp

Download