xmrig | 6ba81a657aaf27dc78e1cb30746cc7dd1d8d53f70e70e536f4da71032d7b22a0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_89cafe46566a88864e84675ba49d9480.exe
Size

1.4MB
MD5

89cafe46566a88864e84675ba49d9480
SHA1

aa6bc463a661ef026cfd5d81f5e697ef62cbad68
SHA256

6ba81a657aaf27dc78e1cb30746cc7dd1d8d53f70e70e536f4da71032d7b22a0
SHA512

541ed1dc7ba9ca10663ee60c83de0f4e44ea60e0cb0a4df8def39ff5ac0c33631c3d532e55e426ddce696ea3c36d78eddd01643f6bd0855d91163a29ee1457ca
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUc:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVM

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001226d-2.dat	xmrig
behavioral1/files/0x00380000000141b7-9.dat	xmrig
behavioral1/files/0x0008000000014342-17.dat	xmrig
behavioral1/files/0x0007000000014388-21.dat	xmrig
behavioral1/files/0x0006000000015b63-48.dat	xmrig
behavioral1/files/0x0006000000015c82-56.dat	xmrig
behavioral1/files/0x0006000000015cb7-68.dat	xmrig
behavioral1/files/0x0006000000015d09-96.dat	xmrig
behavioral1/files/0x0006000000015d72-112.dat	xmrig
behavioral1/files/0x0006000000015fd4-128.dat	xmrig
behavioral1/files/0x0006000000015de5-120.dat	xmrig
behavioral1/files/0x0006000000015f54-124.dat	xmrig
behavioral1/files/0x0006000000015d97-116.dat	xmrig
behavioral1/files/0x0006000000015d42-108.dat	xmrig
behavioral1/files/0x0006000000015d20-105.dat	xmrig
behavioral1/files/0x0006000000015d13-100.dat	xmrig
behavioral1/files/0x0006000000015cfd-92.dat	xmrig
behavioral1/files/0x0006000000015cf3-88.dat	xmrig
behavioral1/files/0x0006000000015cea-84.dat	xmrig
behavioral1/files/0x0006000000015ce2-80.dat	xmrig
behavioral1/files/0x0006000000015cd6-76.dat	xmrig
behavioral1/files/0x0006000000015cbf-72.dat	xmrig
behavioral1/files/0x0006000000015caf-64.dat	xmrig
behavioral1/files/0x0006000000015c8c-60.dat	xmrig
behavioral1/files/0x0006000000015bc7-52.dat	xmrig
behavioral1/files/0x0006000000015679-44.dat	xmrig
behavioral1/files/0x000600000001562c-40.dat	xmrig
behavioral1/files/0x000600000001542b-36.dat	xmrig
behavioral1/files/0x000800000001451c-32.dat	xmrig
behavioral1/files/0x0007000000014508-29.dat	xmrig
behavioral1/files/0x0007000000014415-24.dat	xmrig
behavioral1/files/0x00070000000142d4-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2396	PqwSIUU.exe
1236	BAGCyRI.exe
2740	PGpmVqx.exe
1408	zGPTQHt.exe
2704	PslSATs.exe
2780	SCdYFfn.exe
2752	ynZsIkg.exe
2664	dkDOIuU.exe
2564	gPkyKNo.exe
2676	fHecCYc.exe
2744	qDsmXwc.exe
2264	YgwEkvU.exe
2608	LOCgcDU.exe
2560	iiTRHNB.exe
2600	JdFjhHo.exe
3068	tGYtNhF.exe
1156	VUAJbiI.exe
864	BqLeZJn.exe
2792	dRdSbLG.exe
2832	CfbNcuO.exe
2916	LlcRgVJ.exe
2944	CemPKcV.exe
2956	wItxMZr.exe
1080	RyUlasH.exe
1900	SOaZyUn.exe
2624	gCqCQpT.exe
1908	SzulOyz.exe
344	dcanJfL.exe
1196	RCUFlfk.exe
1620	xhgBRNa.exe
2144	prwTFhi.exe
2424	mKAoXwS.exe
868	TvZSiPp.exe
1340	VDQoDoW.exe
1104	fNLaDve.exe
828	VzIEDet.exe
1808	nkXDpBn.exe
1140	VeVboSZ.exe
3020	YOnJCop.exe
1136	XzndcRf.exe
2408	ltNKTzc.exe
2428	zkdPHqk.exe
984	dXKAEsD.exe
1388	lqWvVDE.exe
1968	czvFDgr.exe
1100	tFTSRQO.exe
844	RDRKNrv.exe
1816	WPaVgoz.exe
1984	BFRtKOh.exe
832	zSVCcAV.exe
1328	DJzAQFf.exe
2100	ZZRflxG.exe
1736	tWpCTIL.exe
2160	JbqlLQi.exe
2192	yujEQsU.exe
1624	ANYKkDV.exe
888	xdGqLSR.exe
1992	EnCHScY.exe
316	YseiUvv.exe
2108	tiWCGXZ.exe
1688	IoUQyJG.exe
1596	MvEMRur.exe
2304	KVMBWZx.exe
2748	LUZfNNK.exe

Loads dropped DLL 64 IoCs

pid	Process
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe
2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OmnduFW.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\lAnFDQo.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\nOFhRDw.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\HUFSHXW.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\NoEQmKY.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\kTBSCQr.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\ylTWBjO.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\CThaIVT.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\mPADXei.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\oCKNAdK.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\SfiYTaz.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\eXRmltm.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\FMjeyWT.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\rsmbeqE.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\hdCbwww.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\ihhFvJy.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\VTNlCFg.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\tJjHTcR.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\NAjHaZD.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qAJOMvG.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\lGIPDhz.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\kgsaFlo.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\JvtXcYF.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\xlShlLr.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qtFmimO.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\rtLlfSw.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\mVzBIoN.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\bDxiyFc.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qaLEOcK.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qNEkKMr.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\iOUFUaW.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\snQluTI.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\UyLXRXg.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\COnzwOn.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\wqwgIaH.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\oFsiouT.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\hxQwPth.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\pTRaSxU.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\nhMhEsl.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\zhnzQOr.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\CWOfttj.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\gYaJMKn.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\nBLJfJy.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\WuWmEcr.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\tEMJjRl.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\ZqSkEDn.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\DQoSLfR.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\WXKHKnH.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\FDrDkdK.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qXjfGxQ.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\GoUIZfC.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\qJZgNGI.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\PzTEPkG.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\kkxhhxG.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\dkDOIuU.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\SvRtaaG.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\gtrVyZf.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\LfpbnoJ.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\OMmDWTz.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\YdSoIYJ.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\bNwzEoz.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\OSgCXBS.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\WlWPsof.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe
File created	C:\Windows\System\JqSXGJD.exe	virussign.com_89cafe46566a88864e84675ba49d9480.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2396	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	29
PID 2228 wrote to memory of 2396	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	29
PID 2228 wrote to memory of 2396	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	29
PID 2228 wrote to memory of 1236	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	30
PID 2228 wrote to memory of 1236	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	30
PID 2228 wrote to memory of 1236	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	30
PID 2228 wrote to memory of 2740	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	31
PID 2228 wrote to memory of 2740	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	31
PID 2228 wrote to memory of 2740	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	31
PID 2228 wrote to memory of 1408	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	32
PID 2228 wrote to memory of 1408	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	32
PID 2228 wrote to memory of 1408	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	32
PID 2228 wrote to memory of 2704	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	33
PID 2228 wrote to memory of 2704	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	33
PID 2228 wrote to memory of 2704	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	33
PID 2228 wrote to memory of 2780	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	34
PID 2228 wrote to memory of 2780	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	34
PID 2228 wrote to memory of 2780	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	34
PID 2228 wrote to memory of 2752	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	35
PID 2228 wrote to memory of 2752	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	35
PID 2228 wrote to memory of 2752	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	35
PID 2228 wrote to memory of 2664	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	36
PID 2228 wrote to memory of 2664	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	36
PID 2228 wrote to memory of 2664	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	36
PID 2228 wrote to memory of 2564	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	37
PID 2228 wrote to memory of 2564	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	37
PID 2228 wrote to memory of 2564	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	37
PID 2228 wrote to memory of 2676	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	38
PID 2228 wrote to memory of 2676	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	38
PID 2228 wrote to memory of 2676	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	38
PID 2228 wrote to memory of 2744	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	39
PID 2228 wrote to memory of 2744	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	39
PID 2228 wrote to memory of 2744	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	39
PID 2228 wrote to memory of 2264	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	40
PID 2228 wrote to memory of 2264	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	40
PID 2228 wrote to memory of 2264	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	40
PID 2228 wrote to memory of 2608	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	41
PID 2228 wrote to memory of 2608	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	41
PID 2228 wrote to memory of 2608	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	41
PID 2228 wrote to memory of 2560	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	42
PID 2228 wrote to memory of 2560	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	42
PID 2228 wrote to memory of 2560	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	42
PID 2228 wrote to memory of 2600	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	43
PID 2228 wrote to memory of 2600	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	43
PID 2228 wrote to memory of 2600	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	43
PID 2228 wrote to memory of 3068	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	44
PID 2228 wrote to memory of 3068	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	44
PID 2228 wrote to memory of 3068	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	44
PID 2228 wrote to memory of 1156	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	45
PID 2228 wrote to memory of 1156	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	45
PID 2228 wrote to memory of 1156	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	45
PID 2228 wrote to memory of 864	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	46
PID 2228 wrote to memory of 864	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	46
PID 2228 wrote to memory of 864	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	46
PID 2228 wrote to memory of 2792	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	47
PID 2228 wrote to memory of 2792	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	47
PID 2228 wrote to memory of 2792	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	47
PID 2228 wrote to memory of 2832	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	48
PID 2228 wrote to memory of 2832	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	48
PID 2228 wrote to memory of 2832	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	48
PID 2228 wrote to memory of 2916	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	49
PID 2228 wrote to memory of 2916	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	49
PID 2228 wrote to memory of 2916	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	49
PID 2228 wrote to memory of 2944	2228	virussign.com_89cafe46566a88864e84675ba49d9480.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_89cafe46566a88864e84675ba49d9480.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_89cafe46566a88864e84675ba49d9480.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System\PqwSIUU.exe
  C:\Windows\System\PqwSIUU.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\BAGCyRI.exe
  C:\Windows\System\BAGCyRI.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\PGpmVqx.exe
  C:\Windows\System\PGpmVqx.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\zGPTQHt.exe
  C:\Windows\System\zGPTQHt.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\PslSATs.exe
  C:\Windows\System\PslSATs.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\SCdYFfn.exe
  C:\Windows\System\SCdYFfn.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ynZsIkg.exe
  C:\Windows\System\ynZsIkg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\dkDOIuU.exe
  C:\Windows\System\dkDOIuU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\gPkyKNo.exe
  C:\Windows\System\gPkyKNo.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\fHecCYc.exe
  C:\Windows\System\fHecCYc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\qDsmXwc.exe
  C:\Windows\System\qDsmXwc.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\YgwEkvU.exe
  C:\Windows\System\YgwEkvU.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\LOCgcDU.exe
  C:\Windows\System\LOCgcDU.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\iiTRHNB.exe
  C:\Windows\System\iiTRHNB.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JdFjhHo.exe
  C:\Windows\System\JdFjhHo.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tGYtNhF.exe
  C:\Windows\System\tGYtNhF.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\VUAJbiI.exe
  C:\Windows\System\VUAJbiI.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\BqLeZJn.exe
  C:\Windows\System\BqLeZJn.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\dRdSbLG.exe
  C:\Windows\System\dRdSbLG.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\CfbNcuO.exe
  C:\Windows\System\CfbNcuO.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\LlcRgVJ.exe
  C:\Windows\System\LlcRgVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\CemPKcV.exe
  C:\Windows\System\CemPKcV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wItxMZr.exe
  C:\Windows\System\wItxMZr.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RyUlasH.exe
  C:\Windows\System\RyUlasH.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\SOaZyUn.exe
  C:\Windows\System\SOaZyUn.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\gCqCQpT.exe
  C:\Windows\System\gCqCQpT.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\SzulOyz.exe
  C:\Windows\System\SzulOyz.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\dcanJfL.exe
  C:\Windows\System\dcanJfL.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\RCUFlfk.exe
  C:\Windows\System\RCUFlfk.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\xhgBRNa.exe
  C:\Windows\System\xhgBRNa.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\prwTFhi.exe
  C:\Windows\System\prwTFhi.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\mKAoXwS.exe
  C:\Windows\System\mKAoXwS.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\TvZSiPp.exe
  C:\Windows\System\TvZSiPp.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\VDQoDoW.exe
  C:\Windows\System\VDQoDoW.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\fNLaDve.exe
  C:\Windows\System\fNLaDve.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\VzIEDet.exe
  C:\Windows\System\VzIEDet.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\nkXDpBn.exe
  C:\Windows\System\nkXDpBn.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\VeVboSZ.exe
  C:\Windows\System\VeVboSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\YOnJCop.exe
  C:\Windows\System\YOnJCop.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\XzndcRf.exe
  C:\Windows\System\XzndcRf.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ltNKTzc.exe
  C:\Windows\System\ltNKTzc.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\zkdPHqk.exe
  C:\Windows\System\zkdPHqk.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dXKAEsD.exe
  C:\Windows\System\dXKAEsD.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\lqWvVDE.exe
  C:\Windows\System\lqWvVDE.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\czvFDgr.exe
  C:\Windows\System\czvFDgr.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\tFTSRQO.exe
  C:\Windows\System\tFTSRQO.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\RDRKNrv.exe
  C:\Windows\System\RDRKNrv.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\WPaVgoz.exe
  C:\Windows\System\WPaVgoz.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BFRtKOh.exe
  C:\Windows\System\BFRtKOh.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\zSVCcAV.exe
  C:\Windows\System\zSVCcAV.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\DJzAQFf.exe
  C:\Windows\System\DJzAQFf.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ZZRflxG.exe
  C:\Windows\System\ZZRflxG.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\tWpCTIL.exe
  C:\Windows\System\tWpCTIL.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\JbqlLQi.exe
  C:\Windows\System\JbqlLQi.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\yujEQsU.exe
  C:\Windows\System\yujEQsU.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ANYKkDV.exe
  C:\Windows\System\ANYKkDV.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\xdGqLSR.exe
  C:\Windows\System\xdGqLSR.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\EnCHScY.exe
  C:\Windows\System\EnCHScY.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\YseiUvv.exe
  C:\Windows\System\YseiUvv.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\tiWCGXZ.exe
  C:\Windows\System\tiWCGXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\IoUQyJG.exe
  C:\Windows\System\IoUQyJG.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\MvEMRur.exe
  C:\Windows\System\MvEMRur.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\KVMBWZx.exe
  C:\Windows\System\KVMBWZx.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\LUZfNNK.exe
  C:\Windows\System\LUZfNNK.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\QlgunQK.exe
  C:\Windows\System\QlgunQK.exe
  2⤵
  PID:2708
- C:\Windows\System\ZQLHGYn.exe
  C:\Windows\System\ZQLHGYn.exe
  2⤵
  PID:2900
- C:\Windows\System\nthOzNQ.exe
  C:\Windows\System\nthOzNQ.exe
  2⤵
  PID:2728
- C:\Windows\System\Ypqatec.exe
  C:\Windows\System\Ypqatec.exe
  2⤵
  PID:2588
- C:\Windows\System\aEHVDwU.exe
  C:\Windows\System\aEHVDwU.exe
  2⤵
  PID:2076
- C:\Windows\System\oUeWqkP.exe
  C:\Windows\System\oUeWqkP.exe
  2⤵
  PID:2904
- C:\Windows\System\lwgVXhy.exe
  C:\Windows\System\lwgVXhy.exe
  2⤵
  PID:2804
- C:\Windows\System\ycNnswK.exe
  C:\Windows\System\ycNnswK.exe
  2⤵
  PID:1088
- C:\Windows\System\QOZjFia.exe
  C:\Windows\System\QOZjFia.exe
  2⤵
  PID:2516
- C:\Windows\System\gXcJLPD.exe
  C:\Windows\System\gXcJLPD.exe
  2⤵
  PID:1284
- C:\Windows\System\erDCKhu.exe
  C:\Windows\System\erDCKhu.exe
  2⤵
  PID:2156
- C:\Windows\System\rTptBba.exe
  C:\Windows\System\rTptBba.exe
  2⤵
  PID:1288
- C:\Windows\System\RevzfAh.exe
  C:\Windows\System\RevzfAh.exe
  2⤵
  PID:1612
- C:\Windows\System\eisYsZs.exe
  C:\Windows\System\eisYsZs.exe
  2⤵
  PID:3012
- C:\Windows\System\gsvzSSI.exe
  C:\Windows\System\gsvzSSI.exe
  2⤵
  PID:2788
- C:\Windows\System\fCQNLmR.exe
  C:\Windows\System\fCQNLmR.exe
  2⤵
  PID:2152
- C:\Windows\System\QJuSTtL.exe
  C:\Windows\System\QJuSTtL.exe
  2⤵
  PID:668
- C:\Windows\System\WNddAPO.exe
  C:\Windows\System\WNddAPO.exe
  2⤵
  PID:684
- C:\Windows\System\XwUlWzz.exe
  C:\Windows\System\XwUlWzz.exe
  2⤵
  PID:1308
- C:\Windows\System\rFrWLBI.exe
  C:\Windows\System\rFrWLBI.exe
  2⤵
  PID:1500
- C:\Windows\System\rCmttTH.exe
  C:\Windows\System\rCmttTH.exe
  2⤵
  PID:308
- C:\Windows\System\qOyOsDe.exe
  C:\Windows\System\qOyOsDe.exe
  2⤵
  PID:1036
- C:\Windows\System\KxsMxlr.exe
  C:\Windows\System\KxsMxlr.exe
  2⤵
  PID:2376
- C:\Windows\System\SpcYZdR.exe
  C:\Windows\System\SpcYZdR.exe
  2⤵
  PID:1384
- C:\Windows\System\FTqBily.exe
  C:\Windows\System\FTqBily.exe
  2⤵
  PID:1608
- C:\Windows\System\SaZtxYL.exe
  C:\Windows\System\SaZtxYL.exe
  2⤵
  PID:2392
- C:\Windows\System\KfvMxPO.exe
  C:\Windows\System\KfvMxPO.exe
  2⤵
  PID:1972
- C:\Windows\System\PrxGDKU.exe
  C:\Windows\System\PrxGDKU.exe
  2⤵
  PID:1640
- C:\Windows\System\AJiyHrY.exe
  C:\Windows\System\AJiyHrY.exe
  2⤵
  PID:2196
- C:\Windows\System\wtlGbMn.exe
  C:\Windows\System\wtlGbMn.exe
  2⤵
  PID:1632
- C:\Windows\System\XEZIrqf.exe
  C:\Windows\System\XEZIrqf.exe
  2⤵
  PID:1348
- C:\Windows\System\zjFZUDc.exe
  C:\Windows\System\zjFZUDc.exe
  2⤵
  PID:2104
- C:\Windows\System\iITDwTi.exe
  C:\Windows\System\iITDwTi.exe
  2⤵
  PID:2096
- C:\Windows\System\VTNvLCH.exe
  C:\Windows\System\VTNvLCH.exe
  2⤵
  PID:3052
- C:\Windows\System\WznmxiG.exe
  C:\Windows\System\WznmxiG.exe
  2⤵
  PID:268
- C:\Windows\System\EEKzjXc.exe
  C:\Windows\System\EEKzjXc.exe
  2⤵
  PID:2372
- C:\Windows\System\IojODbl.exe
  C:\Windows\System\IojODbl.exe
  2⤵
  PID:2772
- C:\Windows\System\VGUpIml.exe
  C:\Windows\System\VGUpIml.exe
  2⤵
  PID:2984
- C:\Windows\System\jHCoPmd.exe
  C:\Windows\System\jHCoPmd.exe
  2⤵
  PID:2580
- C:\Windows\System\OutcIqu.exe
  C:\Windows\System\OutcIqu.exe
  2⤵
  PID:2632
- C:\Windows\System\pEGGHcw.exe
  C:\Windows\System\pEGGHcw.exe
  2⤵
  PID:2092
- C:\Windows\System\ZZMPeeq.exe
  C:\Windows\System\ZZMPeeq.exe
  2⤵
  PID:2896
- C:\Windows\System\pIPUtXb.exe
  C:\Windows\System\pIPUtXb.exe
  2⤵
  PID:3044
- C:\Windows\System\VpvWzQA.exe
  C:\Windows\System\VpvWzQA.exe
  2⤵
  PID:2496
- C:\Windows\System\OmnduFW.exe
  C:\Windows\System\OmnduFW.exe
  2⤵
  PID:2364
- C:\Windows\System\lGIPDhz.exe
  C:\Windows\System\lGIPDhz.exe
  2⤵
  PID:1936
- C:\Windows\System\jshKtRP.exe
  C:\Windows\System\jshKtRP.exe
  2⤵
  PID:3004
- C:\Windows\System\ZPMsFHB.exe
  C:\Windows\System\ZPMsFHB.exe
  2⤵
  PID:768
- C:\Windows\System\aUZWJsT.exe
  C:\Windows\System\aUZWJsT.exe
  2⤵
  PID:572
- C:\Windows\System\WcXHbpM.exe
  C:\Windows\System\WcXHbpM.exe
  2⤵
  PID:2028
- C:\Windows\System\xXOgkdo.exe
  C:\Windows\System\xXOgkdo.exe
  2⤵
  PID:448
- C:\Windows\System\oFEszXT.exe
  C:\Windows\System\oFEszXT.exe
  2⤵
  PID:1544
- C:\Windows\System\VkQNWMX.exe
  C:\Windows\System\VkQNWMX.exe
  2⤵
  PID:1548
- C:\Windows\System\flUVsKn.exe
  C:\Windows\System\flUVsKn.exe
  2⤵
  PID:928
- C:\Windows\System\gCOxCFZ.exe
  C:\Windows\System\gCOxCFZ.exe
  2⤵
  PID:2684
- C:\Windows\System\QOfSbwU.exe
  C:\Windows\System\QOfSbwU.exe
  2⤵
  PID:1880
- C:\Windows\System\peyEBfv.exe
  C:\Windows\System\peyEBfv.exe
  2⤵
  PID:2512
- C:\Windows\System\zUDWJJC.exe
  C:\Windows\System\zUDWJJC.exe
  2⤵
  PID:1692
- C:\Windows\System\qJZgNGI.exe
  C:\Windows\System\qJZgNGI.exe
  2⤵
  PID:1592
- C:\Windows\System\HNqXRsv.exe
  C:\Windows\System\HNqXRsv.exe
  2⤵
  PID:1628
- C:\Windows\System\NNGCRlj.exe
  C:\Windows\System\NNGCRlj.exe
  2⤵
  PID:2668
- C:\Windows\System\gKtLUXq.exe
  C:\Windows\System\gKtLUXq.exe
  2⤵
  PID:1332
- C:\Windows\System\NAPavdV.exe
  C:\Windows\System\NAPavdV.exe
  2⤵
  PID:2660
- C:\Windows\System\COnzwOn.exe
  C:\Windows\System\COnzwOn.exe
  2⤵
  PID:2764
- C:\Windows\System\JTIwhrv.exe
  C:\Windows\System\JTIwhrv.exe
  2⤵
  PID:2272
- C:\Windows\System\UXXnmaM.exe
  C:\Windows\System\UXXnmaM.exe
  2⤵
  PID:356
- C:\Windows\System\dioUqkR.exe
  C:\Windows\System\dioUqkR.exe
  2⤵
  PID:3000
- C:\Windows\System\tLPkkqn.exe
  C:\Windows\System\tLPkkqn.exe
  2⤵
  PID:536
- C:\Windows\System\ctxGvPU.exe
  C:\Windows\System\ctxGvPU.exe
  2⤵
  PID:720
- C:\Windows\System\PCQxKKm.exe
  C:\Windows\System\PCQxKKm.exe
  2⤵
  PID:2412
- C:\Windows\System\wKhihjy.exe
  C:\Windows\System\wKhihjy.exe
  2⤵
  PID:1292
- C:\Windows\System\UCHrAhe.exe
  C:\Windows\System\UCHrAhe.exe
  2⤵
  PID:1980
- C:\Windows\System\YsiGKlz.exe
  C:\Windows\System\YsiGKlz.exe
  2⤵
  PID:2296
- C:\Windows\System\KVIsIJY.exe
  C:\Windows\System\KVIsIJY.exe
  2⤵
  PID:2592
- C:\Windows\System\LtRJNNK.exe
  C:\Windows\System\LtRJNNK.exe
  2⤵
  PID:2088
- C:\Windows\System\eveOLdU.exe
  C:\Windows\System\eveOLdU.exe
  2⤵
  PID:2628
- C:\Windows\System\inXBCsA.exe
  C:\Windows\System\inXBCsA.exe
  2⤵
  PID:1208
- C:\Windows\System\WXKHKnH.exe
  C:\Windows\System\WXKHKnH.exe
  2⤵
  PID:1372
- C:\Windows\System\EjvMFur.exe
  C:\Windows\System\EjvMFur.exe
  2⤵
  PID:2568
- C:\Windows\System\vLYgyHx.exe
  C:\Windows\System\vLYgyHx.exe
  2⤵
  PID:2776
- C:\Windows\System\PNMNxGF.exe
  C:\Windows\System\PNMNxGF.exe
  2⤵
  PID:2440
- C:\Windows\System\pmfrTkL.exe
  C:\Windows\System\pmfrTkL.exe
  2⤵
  PID:2852
- C:\Windows\System\IpRmqjR.exe
  C:\Windows\System\IpRmqjR.exe
  2⤵
  PID:2556
- C:\Windows\System\oXoMlGd.exe
  C:\Windows\System\oXoMlGd.exe
  2⤵
  PID:2964
- C:\Windows\System\AkLHfxD.exe
  C:\Windows\System\AkLHfxD.exe
  2⤵
  PID:1876
- C:\Windows\System\fGWuoom.exe
  C:\Windows\System\fGWuoom.exe
  2⤵
  PID:2604
- C:\Windows\System\wtDPQzR.exe
  C:\Windows\System\wtDPQzR.exe
  2⤵
  PID:2060
- C:\Windows\System\ZRXlExw.exe
  C:\Windows\System\ZRXlExw.exe
  2⤵
  PID:2892
- C:\Windows\System\sVCKpKh.exe
  C:\Windows\System\sVCKpKh.exe
  2⤵
  PID:2540
- C:\Windows\System\SvMLSeX.exe
  C:\Windows\System\SvMLSeX.exe
  2⤵
  PID:2616
- C:\Windows\System\xoAaNnF.exe
  C:\Windows\System\xoAaNnF.exe
  2⤵
  PID:2876
- C:\Windows\System\ptKKLsj.exe
  C:\Windows\System\ptKKLsj.exe
  2⤵
  PID:1376
- C:\Windows\System\lQrpOjK.exe
  C:\Windows\System\lQrpOjK.exe
  2⤵
  PID:1960
- C:\Windows\System\vIGDfdT.exe
  C:\Windows\System\vIGDfdT.exe
  2⤵
  PID:3040
- C:\Windows\System\hJStqdv.exe
  C:\Windows\System\hJStqdv.exe
  2⤵
  PID:1356
- C:\Windows\System\zyksZiz.exe
  C:\Windows\System\zyksZiz.exe
  2⤵
  PID:1748
- C:\Windows\System\lQWElgH.exe
  C:\Windows\System\lQWElgH.exe
  2⤵
  PID:2768
- C:\Windows\System\uQBkfUA.exe
  C:\Windows\System\uQBkfUA.exe
  2⤵
  PID:2700
- C:\Windows\System\DONCUQn.exe
  C:\Windows\System\DONCUQn.exe
  2⤵
  PID:1824
- C:\Windows\System\nYaitDR.exe
  C:\Windows\System\nYaitDR.exe
  2⤵
  PID:1060
- C:\Windows\System\TeeXsJV.exe
  C:\Windows\System\TeeXsJV.exe
  2⤵
  PID:2292
- C:\Windows\System\WONwLYU.exe
  C:\Windows\System\WONwLYU.exe
  2⤵
  PID:2536
- C:\Windows\System\akQzBpb.exe
  C:\Windows\System\akQzBpb.exe
  2⤵
  PID:1556
- C:\Windows\System\sqXxgLj.exe
  C:\Windows\System\sqXxgLj.exe
  2⤵
  PID:2324
- C:\Windows\System\FucnuDD.exe
  C:\Windows\System\FucnuDD.exe
  2⤵
  PID:2008
- C:\Windows\System\gQuKhzB.exe
  C:\Windows\System\gQuKhzB.exe
  2⤵
  PID:1756
- C:\Windows\System\MHzGnNZ.exe
  C:\Windows\System\MHzGnNZ.exe
  2⤵
  PID:2680
- C:\Windows\System\gkFGuSn.exe
  C:\Windows\System\gkFGuSn.exe
  2⤵
  PID:2504
- C:\Windows\System\dyLkNRR.exe
  C:\Windows\System\dyLkNRR.exe
  2⤵
  PID:2796
- C:\Windows\System\xKfMyLT.exe
  C:\Windows\System\xKfMyLT.exe
  2⤵
  PID:2912
- C:\Windows\System\tJjHTcR.exe
  C:\Windows\System\tJjHTcR.exe
  2⤵
  PID:2240
- C:\Windows\System\mJZCySF.exe
  C:\Windows\System\mJZCySF.exe
  2⤵
  PID:1352
- C:\Windows\System\MGvhOQl.exe
  C:\Windows\System\MGvhOQl.exe
  2⤵
  PID:1232
- C:\Windows\System\YvAJqOx.exe
  C:\Windows\System\YvAJqOx.exe
  2⤵
  PID:3076
- C:\Windows\System\FDrDkdK.exe
  C:\Windows\System\FDrDkdK.exe
  2⤵
  PID:3092
- C:\Windows\System\TZXLwvM.exe
  C:\Windows\System\TZXLwvM.exe
  2⤵
  PID:3108
- C:\Windows\System\TTzXuQJ.exe
  C:\Windows\System\TTzXuQJ.exe
  2⤵
  PID:3124
- C:\Windows\System\WWLpfuC.exe
  C:\Windows\System\WWLpfuC.exe
  2⤵
  PID:3140
- C:\Windows\System\PurGywO.exe
  C:\Windows\System\PurGywO.exe
  2⤵
  PID:3156
- C:\Windows\System\Klmhesv.exe
  C:\Windows\System\Klmhesv.exe
  2⤵
  PID:3180
- C:\Windows\System\kbHvNev.exe
  C:\Windows\System\kbHvNev.exe
  2⤵
  PID:3200
- C:\Windows\System\IXzYcJR.exe
  C:\Windows\System\IXzYcJR.exe
  2⤵
  PID:3220
- C:\Windows\System\mrTNngK.exe
  C:\Windows\System\mrTNngK.exe
  2⤵
  PID:3236
- C:\Windows\System\afrBKuw.exe
  C:\Windows\System\afrBKuw.exe
  2⤵
  PID:3260
- C:\Windows\System\xrqjLAq.exe
  C:\Windows\System\xrqjLAq.exe
  2⤵
  PID:3284
- C:\Windows\System\rqHGFNA.exe
  C:\Windows\System\rqHGFNA.exe
  2⤵
  PID:3340
- C:\Windows\System\BDnQqzA.exe
  C:\Windows\System\BDnQqzA.exe
  2⤵
  PID:3364
- C:\Windows\System\CKoCrvg.exe
  C:\Windows\System\CKoCrvg.exe
  2⤵
  PID:3380
- C:\Windows\System\vaCNMnn.exe
  C:\Windows\System\vaCNMnn.exe
  2⤵
  PID:3404
- C:\Windows\System\sfrWBAq.exe
  C:\Windows\System\sfrWBAq.exe
  2⤵
  PID:3420
- C:\Windows\System\ZcSMcCL.exe
  C:\Windows\System\ZcSMcCL.exe
  2⤵
  PID:3440
- C:\Windows\System\yJhUhgE.exe
  C:\Windows\System\yJhUhgE.exe
  2⤵
  PID:3456
- C:\Windows\System\gParjDq.exe
  C:\Windows\System\gParjDq.exe
  2⤵
  PID:3480
- C:\Windows\System\yfMgPjB.exe
  C:\Windows\System\yfMgPjB.exe
  2⤵
  PID:3496
- C:\Windows\System\kPeAEfy.exe
  C:\Windows\System\kPeAEfy.exe
  2⤵
  PID:3512
- C:\Windows\System\FagpQWH.exe
  C:\Windows\System\FagpQWH.exe
  2⤵
  PID:3536
- C:\Windows\System\gyEFORX.exe
  C:\Windows\System\gyEFORX.exe
  2⤵
  PID:3552
- C:\Windows\System\HxQylXh.exe
  C:\Windows\System\HxQylXh.exe
  2⤵
  PID:3572
- C:\Windows\System\LVvHdZi.exe
  C:\Windows\System\LVvHdZi.exe
  2⤵
  PID:3592
- C:\Windows\System\qSABcIB.exe
  C:\Windows\System\qSABcIB.exe
  2⤵
  PID:3612
- C:\Windows\System\MijNaQY.exe
  C:\Windows\System\MijNaQY.exe
  2⤵
  PID:3632
- C:\Windows\System\jnumTqY.exe
  C:\Windows\System\jnumTqY.exe
  2⤵
  PID:3648
- C:\Windows\System\MqTZXtJ.exe
  C:\Windows\System\MqTZXtJ.exe
  2⤵
  PID:3668
- C:\Windows\System\RmDWxIX.exe
  C:\Windows\System\RmDWxIX.exe
  2⤵
  PID:3688
- C:\Windows\System\LGcvxFy.exe
  C:\Windows\System\LGcvxFy.exe
  2⤵
  PID:3708
- C:\Windows\System\mgjnFYU.exe
  C:\Windows\System\mgjnFYU.exe
  2⤵
  PID:3724
- C:\Windows\System\rsmbeqE.exe
  C:\Windows\System\rsmbeqE.exe
  2⤵
  PID:3740
- C:\Windows\System\GxWzJIx.exe
  C:\Windows\System\GxWzJIx.exe
  2⤵
  PID:3768
- C:\Windows\System\gccEgOD.exe
  C:\Windows\System\gccEgOD.exe
  2⤵
  PID:3784
- C:\Windows\System\gZEujLF.exe
  C:\Windows\System\gZEujLF.exe
  2⤵
  PID:3800
- C:\Windows\System\DpcbNTH.exe
  C:\Windows\System\DpcbNTH.exe
  2⤵
  PID:3816
- C:\Windows\System\qDAVTUF.exe
  C:\Windows\System\qDAVTUF.exe
  2⤵
  PID:3832
- C:\Windows\System\jSQXKKo.exe
  C:\Windows\System\jSQXKKo.exe
  2⤵
  PID:3848
- C:\Windows\System\IXRwPoV.exe
  C:\Windows\System\IXRwPoV.exe
  2⤵
  PID:3864
- C:\Windows\System\PMDasLe.exe
  C:\Windows\System\PMDasLe.exe
  2⤵
  PID:3880
- C:\Windows\System\UPrehLO.exe
  C:\Windows\System\UPrehLO.exe
  2⤵
  PID:3896
- C:\Windows\System\USXDcie.exe
  C:\Windows\System\USXDcie.exe
  2⤵
  PID:3912
- C:\Windows\System\rLVdOYz.exe
  C:\Windows\System\rLVdOYz.exe
  2⤵
  PID:3928
- C:\Windows\System\nJBbsqy.exe
  C:\Windows\System\nJBbsqy.exe
  2⤵
  PID:3948
- C:\Windows\System\tuuvSIP.exe
  C:\Windows\System\tuuvSIP.exe
  2⤵
  PID:3968
- C:\Windows\System\BsOWPPr.exe
  C:\Windows\System\BsOWPPr.exe
  2⤵
  PID:3984
- C:\Windows\System\STJYyyv.exe
  C:\Windows\System\STJYyyv.exe
  2⤵
  PID:4004
- C:\Windows\System\eLXIrGJ.exe
  C:\Windows\System\eLXIrGJ.exe
  2⤵
  PID:4020
- C:\Windows\System\qbGilba.exe
  C:\Windows\System\qbGilba.exe
  2⤵
  PID:4036
- C:\Windows\System\ohwOOKJ.exe
  C:\Windows\System\ohwOOKJ.exe
  2⤵
  PID:4052
- C:\Windows\System\yZvwbXq.exe
  C:\Windows\System\yZvwbXq.exe
  2⤵
  PID:4068
- C:\Windows\System\VxSbyOZ.exe
  C:\Windows\System\VxSbyOZ.exe
  2⤵
  PID:4088
- C:\Windows\System\YJQBQUE.exe
  C:\Windows\System\YJQBQUE.exe
  2⤵
  PID:264
- C:\Windows\System\tMnIGEZ.exe
  C:\Windows\System\tMnIGEZ.exe
  2⤵
  PID:2720
- C:\Windows\System\WtPEgTh.exe
  C:\Windows\System\WtPEgTh.exe
  2⤵
  PID:2300
- C:\Windows\System\cwavwbZ.exe
  C:\Windows\System\cwavwbZ.exe
  2⤵
  PID:1944
- C:\Windows\System\IDQfAHm.exe
  C:\Windows\System\IDQfAHm.exe
  2⤵
  PID:2672
- C:\Windows\System\fwuOFZF.exe
  C:\Windows\System\fwuOFZF.exe
  2⤵
  PID:3100
- C:\Windows\System\eeLKUrC.exe
  C:\Windows\System\eeLKUrC.exe
  2⤵
  PID:3136
- C:\Windows\System\DZmwIBj.exe
  C:\Windows\System\DZmwIBj.exe
  2⤵
  PID:3172
- C:\Windows\System\tBFPXwN.exe
  C:\Windows\System\tBFPXwN.exe
  2⤵
  PID:3188
- C:\Windows\System\pUlAJZt.exe
  C:\Windows\System\pUlAJZt.exe
  2⤵
  PID:3228
- C:\Windows\System\RkITBPr.exe
  C:\Windows\System\RkITBPr.exe
  2⤵
  PID:3216
- C:\Windows\System\WIjhIMW.exe
  C:\Windows\System\WIjhIMW.exe
  2⤵
  PID:3268
- C:\Windows\System\rkAynAw.exe
  C:\Windows\System\rkAynAw.exe
  2⤵
  PID:3292
- C:\Windows\System\oYlLyPA.exe
  C:\Windows\System\oYlLyPA.exe
  2⤵
  PID:3308
- C:\Windows\System\RPcCYsB.exe
  C:\Windows\System\RPcCYsB.exe
  2⤵
  PID:3356
- C:\Windows\System\tasoEUN.exe
  C:\Windows\System\tasoEUN.exe
  2⤵
  PID:3396
- C:\Windows\System\aebCirc.exe
  C:\Windows\System\aebCirc.exe
  2⤵
  PID:3436
- C:\Windows\System\roSGnaL.exe
  C:\Windows\System\roSGnaL.exe
  2⤵
  PID:3476
- C:\Windows\System\jTmULdJ.exe
  C:\Windows\System\jTmULdJ.exe
  2⤵
  PID:3328
- C:\Windows\System\kHQtFSR.exe
  C:\Windows\System\kHQtFSR.exe
  2⤵
  PID:3544
- C:\Windows\System\wtWoJKB.exe
  C:\Windows\System\wtWoJKB.exe
  2⤵
  PID:3588
- C:\Windows\System\joqmivG.exe
  C:\Windows\System\joqmivG.exe
  2⤵
  PID:3656
- C:\Windows\System\jACupUQ.exe
  C:\Windows\System\jACupUQ.exe
  2⤵
  PID:3700
- C:\Windows\System\ZZkTXej.exe
  C:\Windows\System\ZZkTXej.exe
  2⤵
  PID:3332
- C:\Windows\System\dXkXabn.exe
  C:\Windows\System\dXkXabn.exe
  2⤵
  PID:3412
- C:\Windows\System\UAIvWBq.exe
  C:\Windows\System\UAIvWBq.exe
  2⤵
  PID:3840
- C:\Windows\System\joujtVp.exe
  C:\Windows\System\joujtVp.exe
  2⤵
  PID:3876
- C:\Windows\System\DAXkTIN.exe
  C:\Windows\System\DAXkTIN.exe
  2⤵
  PID:3524
- C:\Windows\System\HKQUhcd.exe
  C:\Windows\System\HKQUhcd.exe
  2⤵
  PID:3564
- C:\Windows\System\GkqeSSJ.exe
  C:\Windows\System\GkqeSSJ.exe
  2⤵
  PID:3608
- C:\Windows\System\EMUUHxK.exe
  C:\Windows\System\EMUUHxK.exe
  2⤵
  PID:3676
- C:\Windows\System\HPJGGdl.exe
  C:\Windows\System\HPJGGdl.exe
  2⤵
  PID:3720
- C:\Windows\System\AbIKtme.exe
  C:\Windows\System\AbIKtme.exe
  2⤵
  PID:3760
- C:\Windows\System\McoYPqP.exe
  C:\Windows\System\McoYPqP.exe
  2⤵
  PID:3796
- C:\Windows\System\hTrfShD.exe
  C:\Windows\System\hTrfShD.exe
  2⤵
  PID:3856
- C:\Windows\System\JOgXRRU.exe
  C:\Windows\System\JOgXRRU.exe
  2⤵
  PID:3920
- C:\Windows\System\hxQwPth.exe
  C:\Windows\System\hxQwPth.exe
  2⤵
  PID:3964
- C:\Windows\System\ZnpEdsN.exe
  C:\Windows\System\ZnpEdsN.exe
  2⤵
  PID:3940
- C:\Windows\System\PDSWWrR.exe
  C:\Windows\System\PDSWWrR.exe
  2⤵
  PID:3976
- C:\Windows\System\QkhKesu.exe
  C:\Windows\System\QkhKesu.exe
  2⤵
  PID:4044
- C:\Windows\System\WPoqgsa.exe
  C:\Windows\System\WPoqgsa.exe
  2⤵
  PID:4080
- C:\Windows\System\ilhTPZy.exe
  C:\Windows\System\ilhTPZy.exe
  2⤵
  PID:908
- C:\Windows\System\hUnuxFS.exe
  C:\Windows\System\hUnuxFS.exe
  2⤵
  PID:3088
- C:\Windows\System\jQOFiJM.exe
  C:\Windows\System\jQOFiJM.exe
  2⤵
  PID:3256
- C:\Windows\System\HHCqLUQ.exe
  C:\Windows\System\HHCqLUQ.exe
  2⤵
  PID:3392
- C:\Windows\System\ZSIfqbc.exe
  C:\Windows\System\ZSIfqbc.exe
  2⤵
  PID:4064
- C:\Windows\System\BsnjTLD.exe
  C:\Windows\System\BsnjTLD.exe
  2⤵
  PID:3628
- C:\Windows\System\hdCbwww.exe
  C:\Windows\System\hdCbwww.exe
  2⤵
  PID:4100
- C:\Windows\System\WfFIGYW.exe
  C:\Windows\System\WfFIGYW.exe
  2⤵
  PID:4116
- C:\Windows\System\rqLBRzB.exe
  C:\Windows\System\rqLBRzB.exe
  2⤵
  PID:4132
- C:\Windows\System\csubNOn.exe
  C:\Windows\System\csubNOn.exe
  2⤵
  PID:4148
- C:\Windows\System\mkxVYHk.exe
  C:\Windows\System\mkxVYHk.exe
  2⤵
  PID:4164
- C:\Windows\System\XwCTNrY.exe
  C:\Windows\System\XwCTNrY.exe
  2⤵
  PID:4180
- C:\Windows\System\dBWorpe.exe
  C:\Windows\System\dBWorpe.exe
  2⤵
  PID:4196
- C:\Windows\System\qeEzedF.exe
  C:\Windows\System\qeEzedF.exe
  2⤵
  PID:4212
- C:\Windows\System\tCtedQY.exe
  C:\Windows\System\tCtedQY.exe
  2⤵
  PID:4228
- C:\Windows\System\YgMbPic.exe
  C:\Windows\System\YgMbPic.exe
  2⤵
  PID:4244
- C:\Windows\System\EYcVEsO.exe
  C:\Windows\System\EYcVEsO.exe
  2⤵
  PID:4260
- C:\Windows\System\bLDiPbK.exe
  C:\Windows\System\bLDiPbK.exe
  2⤵
  PID:4276
- C:\Windows\System\LKDIqUQ.exe
  C:\Windows\System\LKDIqUQ.exe
  2⤵
  PID:4292
- C:\Windows\System\pWUyUeO.exe
  C:\Windows\System\pWUyUeO.exe
  2⤵
  PID:4308
- C:\Windows\System\vGWdMrv.exe
  C:\Windows\System\vGWdMrv.exe
  2⤵
  PID:4324
- C:\Windows\System\XwGcGIH.exe
  C:\Windows\System\XwGcGIH.exe
  2⤵
  PID:4340
- C:\Windows\System\dmxcQhJ.exe
  C:\Windows\System\dmxcQhJ.exe
  2⤵
  PID:4356
- C:\Windows\System\FxvnRgL.exe
  C:\Windows\System\FxvnRgL.exe
  2⤵
  PID:4372
- C:\Windows\System\ylTWBjO.exe
  C:\Windows\System\ylTWBjO.exe
  2⤵
  PID:4388
- C:\Windows\System\JnoIrqy.exe
  C:\Windows\System\JnoIrqy.exe
  2⤵
  PID:4404
- C:\Windows\System\fywPqox.exe
  C:\Windows\System\fywPqox.exe
  2⤵
  PID:4420
- C:\Windows\System\TWAMwoo.exe
  C:\Windows\System\TWAMwoo.exe
  2⤵
  PID:4436
- C:\Windows\System\aHAqktD.exe
  C:\Windows\System\aHAqktD.exe
  2⤵
  PID:4452
- C:\Windows\System\HxsoYpg.exe
  C:\Windows\System\HxsoYpg.exe
  2⤵
  PID:4468
- C:\Windows\System\VOneHvE.exe
  C:\Windows\System\VOneHvE.exe
  2⤵
  PID:4484
- C:\Windows\System\XqIHEub.exe
  C:\Windows\System\XqIHEub.exe
  2⤵
  PID:4500
- C:\Windows\System\zyxcuQp.exe
  C:\Windows\System\zyxcuQp.exe
  2⤵
  PID:4516
- C:\Windows\System\TfbzMfK.exe
  C:\Windows\System\TfbzMfK.exe
  2⤵
  PID:4532
- C:\Windows\System\mTSBUqS.exe
  C:\Windows\System\mTSBUqS.exe
  2⤵
  PID:4548
- C:\Windows\System\uwalwjb.exe
  C:\Windows\System\uwalwjb.exe
  2⤵
  PID:4564
- C:\Windows\System\XurKemw.exe
  C:\Windows\System\XurKemw.exe
  2⤵
  PID:4580
- C:\Windows\System\UMBncrz.exe
  C:\Windows\System\UMBncrz.exe
  2⤵
  PID:4596
- C:\Windows\System\zhnzQOr.exe
  C:\Windows\System\zhnzQOr.exe
  2⤵
  PID:4612
- C:\Windows\System\dUAiRWW.exe
  C:\Windows\System\dUAiRWW.exe
  2⤵
  PID:4628
- C:\Windows\System\ewlSfIa.exe
  C:\Windows\System\ewlSfIa.exe
  2⤵
  PID:4644
- C:\Windows\System\MVRXHEz.exe
  C:\Windows\System\MVRXHEz.exe
  2⤵
  PID:4660
- C:\Windows\System\YAEXmXm.exe
  C:\Windows\System\YAEXmXm.exe
  2⤵
  PID:4676
- C:\Windows\System\DeNravA.exe
  C:\Windows\System\DeNravA.exe
  2⤵
  PID:4692
- C:\Windows\System\guJsgeX.exe
  C:\Windows\System\guJsgeX.exe
  2⤵
  PID:4708
- C:\Windows\System\qXjfGxQ.exe
  C:\Windows\System\qXjfGxQ.exe
  2⤵
  PID:4724
- C:\Windows\System\qTbaOnA.exe
  C:\Windows\System\qTbaOnA.exe
  2⤵
  PID:4740
- C:\Windows\System\GCfrBXz.exe
  C:\Windows\System\GCfrBXz.exe
  2⤵
  PID:4756
- C:\Windows\System\ihAaiwB.exe
  C:\Windows\System\ihAaiwB.exe
  2⤵
  PID:4772
- C:\Windows\System\oDcfePB.exe
  C:\Windows\System\oDcfePB.exe
  2⤵
  PID:4788
- C:\Windows\System\jFzleqB.exe
  C:\Windows\System\jFzleqB.exe
  2⤵
  PID:4804
- C:\Windows\System\VTNlCFg.exe
  C:\Windows\System\VTNlCFg.exe
  2⤵
  PID:4820
- C:\Windows\System\OJNPaxi.exe
  C:\Windows\System\OJNPaxi.exe
  2⤵
  PID:4836
- C:\Windows\System\rVCkNUH.exe
  C:\Windows\System\rVCkNUH.exe
  2⤵
  PID:4852
- C:\Windows\System\OAphlJY.exe
  C:\Windows\System\OAphlJY.exe
  2⤵
  PID:4868
- C:\Windows\System\JKcqtuJ.exe
  C:\Windows\System\JKcqtuJ.exe
  2⤵
  PID:4884
- C:\Windows\System\lVllDud.exe
  C:\Windows\System\lVllDud.exe
  2⤵
  PID:4900
- C:\Windows\System\WmZGbWP.exe
  C:\Windows\System\WmZGbWP.exe
  2⤵
  PID:4916
- C:\Windows\System\IVASEQr.exe
  C:\Windows\System\IVASEQr.exe
  2⤵
  PID:4932
- C:\Windows\System\JvtXcYF.exe
  C:\Windows\System\JvtXcYF.exe
  2⤵
  PID:4948
- C:\Windows\System\PhLxdML.exe
  C:\Windows\System\PhLxdML.exe
  2⤵
  PID:4964
- C:\Windows\System\UaUfzOo.exe
  C:\Windows\System\UaUfzOo.exe
  2⤵
  PID:4980
- C:\Windows\System\wqwgIaH.exe
  C:\Windows\System\wqwgIaH.exe
  2⤵
  PID:4996
- C:\Windows\System\UdhdPYW.exe
  C:\Windows\System\UdhdPYW.exe
  2⤵
  PID:5012
- C:\Windows\System\SZbPrfq.exe
  C:\Windows\System\SZbPrfq.exe
  2⤵
  PID:5028
- C:\Windows\System\uWFXIhm.exe
  C:\Windows\System\uWFXIhm.exe
  2⤵
  PID:5044
- C:\Windows\System\iiBHeHZ.exe
  C:\Windows\System\iiBHeHZ.exe
  2⤵
  PID:5060
- C:\Windows\System\oEyayOH.exe
  C:\Windows\System\oEyayOH.exe
  2⤵
  PID:5076
- C:\Windows\System\RtWmAQj.exe
  C:\Windows\System\RtWmAQj.exe
  2⤵
  PID:5092
- C:\Windows\System\iGzditA.exe
  C:\Windows\System\iGzditA.exe
  2⤵
  PID:5108
- C:\Windows\System\bARsZHE.exe
  C:\Windows\System\bARsZHE.exe
  2⤵
  PID:3492
- C:\Windows\System\bIhZqXp.exe
  C:\Windows\System\bIhZqXp.exe
  2⤵
  PID:3684
- C:\Windows\System\KWzfvyp.exe
  C:\Windows\System\KWzfvyp.exe
  2⤵
  PID:3888
- C:\Windows\System\HyytmjX.exe
  C:\Windows\System\HyytmjX.exe
  2⤵
  PID:4012
- C:\Windows\System\nmDTMCP.exe
  C:\Windows\System\nmDTMCP.exe
  2⤵
  PID:3016
- C:\Windows\System\NKWxoJF.exe
  C:\Windows\System\NKWxoJF.exe
  2⤵
  PID:3504
- C:\Windows\System\AqBXOTX.exe
  C:\Windows\System\AqBXOTX.exe
  2⤵
  PID:4128
- C:\Windows\System\WQJutnP.exe
  C:\Windows\System\WQJutnP.exe
  2⤵
  PID:4156
- C:\Windows\System\fhWWfcl.exe
  C:\Windows\System\fhWWfcl.exe
  2⤵
  PID:4220
- C:\Windows\System\qgtbYUv.exe
  C:\Windows\System\qgtbYUv.exe
  2⤵
  PID:3324
- C:\Windows\System\wTiYfmo.exe
  C:\Windows\System\wTiYfmo.exe
  2⤵
  PID:4284
- C:\Windows\System\jRYXnEL.exe
  C:\Windows\System\jRYXnEL.exe
  2⤵
  PID:3376
- C:\Windows\System\Hynrthp.exe
  C:\Windows\System\Hynrthp.exe
  2⤵
  PID:2696
- C:\Windows\System\hJLnwGm.exe
  C:\Windows\System\hJLnwGm.exe
  2⤵
  PID:4352
- C:\Windows\System\kZatSoS.exe
  C:\Windows\System\kZatSoS.exe
  2⤵
  PID:3212
- C:\Windows\System\YCeJnuX.exe
  C:\Windows\System\YCeJnuX.exe
  2⤵
  PID:3352
- C:\Windows\System\getNlJB.exe
  C:\Windows\System\getNlJB.exe
  2⤵
  PID:4416
- C:\Windows\System\pyqktkv.exe
  C:\Windows\System\pyqktkv.exe
  2⤵
  PID:3372
- C:\Windows\System\GvRNqHa.exe
  C:\Windows\System\GvRNqHa.exe
  2⤵
  PID:3696
- C:\Windows\System\HTzSDlE.exe
  C:\Windows\System\HTzSDlE.exe
  2⤵
  PID:4508
- C:\Windows\System\cROZMpu.exe
  C:\Windows\System\cROZMpu.exe
  2⤵
  PID:4572
- C:\Windows\System\vUBOCkN.exe
  C:\Windows\System\vUBOCkN.exe
  2⤵
  PID:4636
- C:\Windows\System\QQtdcku.exe
  C:\Windows\System\QQtdcku.exe
  2⤵
  PID:3560
- C:\Windows\System\jNijGFZ.exe
  C:\Windows\System\jNijGFZ.exe
  2⤵
  PID:3824
- C:\Windows\System\zxodPYw.exe
  C:\Windows\System\zxodPYw.exe
  2⤵
  PID:3300
- C:\Windows\System\SdDZych.exe
  C:\Windows\System\SdDZych.exe
  2⤵
  PID:3624
- C:\Windows\System\wrVUpFM.exe
  C:\Windows\System\wrVUpFM.exe
  2⤵
  PID:4640
- C:\Windows\System\HUFSHXW.exe
  C:\Windows\System\HUFSHXW.exe
  2⤵
  PID:4704
- C:\Windows\System\cshMQAI.exe
  C:\Windows\System\cshMQAI.exe
  2⤵
  PID:4768
- C:\Windows\System\qqJVbMF.exe
  C:\Windows\System\qqJVbMF.exe
  2⤵
  PID:4832
- C:\Windows\System\oefDCRV.exe
  C:\Windows\System\oefDCRV.exe
  2⤵
  PID:4240
- C:\Windows\System\LkkxNss.exe
  C:\Windows\System\LkkxNss.exe
  2⤵
  PID:4304
- C:\Windows\System\awqOySJ.exe
  C:\Windows\System\awqOySJ.exe
  2⤵
  PID:4524
- C:\Windows\System\BgbpVFZ.exe
  C:\Windows\System\BgbpVFZ.exe
  2⤵
  PID:4864
- C:\Windows\System\iIqvxAA.exe
  C:\Windows\System\iIqvxAA.exe
  2⤵
  PID:4928
- C:\Windows\System\ssGYqnZ.exe
  C:\Windows\System\ssGYqnZ.exe
  2⤵
  PID:4464
- C:\Windows\System\nfrsksY.exe
  C:\Windows\System\nfrsksY.exe
  2⤵
  PID:4560
- C:\Windows\System\ejNjiGv.exe
  C:\Windows\System\ejNjiGv.exe
  2⤵
  PID:4624
- C:\Windows\System\mBvBzQF.exe
  C:\Windows\System\mBvBzQF.exe
  2⤵
  PID:4988
- C:\Windows\System\qNEkKMr.exe
  C:\Windows\System\qNEkKMr.exe
  2⤵
  PID:5052
- C:\Windows\System\eJCijSd.exe
  C:\Windows\System\eJCijSd.exe
  2⤵
  PID:5116
- C:\Windows\System\tuRihGg.exe
  C:\Windows\System\tuRihGg.exe
  2⤵
  PID:4752
- C:\Windows\System\QOlqfJO.exe
  C:\Windows\System\QOlqfJO.exe
  2⤵
  PID:4720
- C:\Windows\System\aYNVmvD.exe
  C:\Windows\System\aYNVmvD.exe
  2⤵
  PID:4812
- C:\Windows\System\akzCFjm.exe
  C:\Windows\System\akzCFjm.exe
  2⤵
  PID:4876
- C:\Windows\System\OImGSoz.exe
  C:\Windows\System\OImGSoz.exe
  2⤵
  PID:4940
- C:\Windows\System\RVjzGXn.exe
  C:\Windows\System\RVjzGXn.exe
  2⤵
  PID:5072
- C:\Windows\System\WFkidOq.exe
  C:\Windows\System\WFkidOq.exe
  2⤵
  PID:4124
- C:\Windows\System\CrmEHOl.exe
  C:\Windows\System\CrmEHOl.exe
  2⤵
  PID:4256
- C:\Windows\System\cmmMWyJ.exe
  C:\Windows\System\cmmMWyJ.exe
  2⤵
  PID:5008
- C:\Windows\System\BOnmNWD.exe
  C:\Windows\System\BOnmNWD.exe
  2⤵
  PID:3600
- C:\Windows\System\ZnmIRDM.exe
  C:\Windows\System\ZnmIRDM.exe
  2⤵
  PID:4000
- C:\Windows\System\WazckfT.exe
  C:\Windows\System\WazckfT.exe
  2⤵
  PID:3132
- C:\Windows\System\VVmvHMn.exe
  C:\Windows\System\VVmvHMn.exe
  2⤵
  PID:4348
- C:\Windows\System\wdIexbG.exe
  C:\Windows\System\wdIexbG.exe
  2⤵
  PID:4448
- C:\Windows\System\lViFmWL.exe
  C:\Windows\System\lViFmWL.exe
  2⤵
  PID:3432
- C:\Windows\System\xHPfcVK.exe
  C:\Windows\System\xHPfcVK.exe
  2⤵
  PID:3644
- C:\Windows\System\ZJtmzLY.exe
  C:\Windows\System\ZJtmzLY.exe
  2⤵
  PID:4604
- C:\Windows\System\mITQReY.exe
  C:\Windows\System\mITQReY.exe
  2⤵
  PID:4412
- C:\Windows\System\adXTjwi.exe
  C:\Windows\System\adXTjwi.exe
  2⤵
  PID:3756
- C:\Windows\System\XFXTSJv.exe
  C:\Windows\System\XFXTSJv.exe
  2⤵
  PID:4144
- C:\Windows\System\uEsPpFE.exe
  C:\Windows\System\uEsPpFE.exe
  2⤵
  PID:4764
- C:\Windows\System\jaUyukb.exe
  C:\Windows\System\jaUyukb.exe
  2⤵
  PID:4700
- C:\Windows\System\nxEDilV.exe
  C:\Windows\System\nxEDilV.exe
  2⤵
  PID:4300
- C:\Windows\System\WbiqcoL.exe
  C:\Windows\System\WbiqcoL.exe
  2⤵
  PID:4460
- C:\Windows\System\nyBhupY.exe
  C:\Windows\System\nyBhupY.exe
  2⤵
  PID:4432
- C:\Windows\System\CCMuCCh.exe
  C:\Windows\System\CCMuCCh.exe
  2⤵
  PID:4528
- C:\Windows\System\zOlKIEw.exe
  C:\Windows\System\zOlKIEw.exe
  2⤵
  PID:5024
- C:\Windows\System\bqAvoFP.exe
  C:\Windows\System\bqAvoFP.exe
  2⤵
  PID:4784
- C:\Windows\System\wibHwNt.exe
  C:\Windows\System\wibHwNt.exe
  2⤵
  PID:5084
- C:\Windows\System\pMqlMtC.exe
  C:\Windows\System\pMqlMtC.exe
  2⤵
  PID:4688
- C:\Windows\System\eyHSFib.exe
  C:\Windows\System\eyHSFib.exe
  2⤵
  PID:4192
- C:\Windows\System\aZcKLFR.exe
  C:\Windows\System\aZcKLFR.exe
  2⤵
  PID:3472
- C:\Windows\System\epZtCBW.exe
  C:\Windows\System\epZtCBW.exe
  2⤵
  PID:3304
- C:\Windows\System\wCyAEul.exe
  C:\Windows\System\wCyAEul.exe
  2⤵
  PID:3792
- C:\Windows\System\JxFrTFx.exe
  C:\Windows\System\JxFrTFx.exe
  2⤵
  PID:3992
- C:\Windows\System\IwKxsWO.exe
  C:\Windows\System\IwKxsWO.exe
  2⤵
  PID:3120
- C:\Windows\System\lAnFDQo.exe
  C:\Windows\System\lAnFDQo.exe
  2⤵
  PID:4828
- C:\Windows\System\UheFcIa.exe
  C:\Windows\System\UheFcIa.exe
  2⤵
  PID:4620
- C:\Windows\System\CcIWTyi.exe
  C:\Windows\System\CcIWTyi.exe
  2⤵
  PID:4848
- C:\Windows\System\EJrbInA.exe
  C:\Windows\System\EJrbInA.exe
  2⤵
  PID:4428
- C:\Windows\System\TJQEuso.exe
  C:\Windows\System\TJQEuso.exe
  2⤵
  PID:4780
- C:\Windows\System\vrTYhBp.exe
  C:\Windows\System\vrTYhBp.exe
  2⤵
  PID:5040
- C:\Windows\System\LtuoaUv.exe
  C:\Windows\System\LtuoaUv.exe
  2⤵
  PID:5104
- C:\Windows\System\zTKCCGd.exe
  C:\Windows\System\zTKCCGd.exe
  2⤵
  PID:5136
- C:\Windows\System\HicsypV.exe
  C:\Windows\System\HicsypV.exe
  2⤵
  PID:5156
- C:\Windows\System\AvmPwvd.exe
  C:\Windows\System\AvmPwvd.exe
  2⤵
  PID:5172
- C:\Windows\System\UzxLGKK.exe
  C:\Windows\System\UzxLGKK.exe
  2⤵
  PID:5188
- C:\Windows\System\dVSMKJn.exe
  C:\Windows\System\dVSMKJn.exe
  2⤵
  PID:5204
- C:\Windows\System\IuUZPpZ.exe
  C:\Windows\System\IuUZPpZ.exe
  2⤵
  PID:5220
- C:\Windows\System\eUHJvbO.exe
  C:\Windows\System\eUHJvbO.exe
  2⤵
  PID:5240
- C:\Windows\System\yeHPPeH.exe
  C:\Windows\System\yeHPPeH.exe
  2⤵
  PID:5256
- C:\Windows\System\cuThsmb.exe
  C:\Windows\System\cuThsmb.exe
  2⤵
  PID:5272
- C:\Windows\System\JhqOsSe.exe
  C:\Windows\System\JhqOsSe.exe
  2⤵
  PID:5288
- C:\Windows\System\OMmDWTz.exe
  C:\Windows\System\OMmDWTz.exe
  2⤵
  PID:5304
- C:\Windows\System\SYHUhaA.exe
  C:\Windows\System\SYHUhaA.exe
  2⤵
  PID:5320
- C:\Windows\System\IrTnDvN.exe
  C:\Windows\System\IrTnDvN.exe
  2⤵
  PID:5336
- C:\Windows\System\wuOWAgt.exe
  C:\Windows\System\wuOWAgt.exe
  2⤵
  PID:5352
- C:\Windows\System\FAXJeNN.exe
  C:\Windows\System\FAXJeNN.exe
  2⤵
  PID:5368
- C:\Windows\System\hpKsyCl.exe
  C:\Windows\System\hpKsyCl.exe
  2⤵
  PID:5384
- C:\Windows\System\DkpnuMe.exe
  C:\Windows\System\DkpnuMe.exe
  2⤵
  PID:5400
- C:\Windows\System\NgTccvU.exe
  C:\Windows\System\NgTccvU.exe
  2⤵
  PID:5416
- C:\Windows\System\miwgWKo.exe
  C:\Windows\System\miwgWKo.exe
  2⤵
  PID:5432
- C:\Windows\System\yWHWXJK.exe
  C:\Windows\System\yWHWXJK.exe
  2⤵
  PID:5448
- C:\Windows\System\eiHiXmB.exe
  C:\Windows\System\eiHiXmB.exe
  2⤵
  PID:5464
- C:\Windows\System\KwjfURK.exe
  C:\Windows\System\KwjfURK.exe
  2⤵
  PID:5480
- C:\Windows\System\tzvuPsT.exe
  C:\Windows\System\tzvuPsT.exe
  2⤵
  PID:5496
- C:\Windows\System\fnVKGEJ.exe
  C:\Windows\System\fnVKGEJ.exe
  2⤵
  PID:5516
- C:\Windows\System\idxJBDB.exe
  C:\Windows\System\idxJBDB.exe
  2⤵
  PID:5532
- C:\Windows\System\gkFMvtp.exe
  C:\Windows\System\gkFMvtp.exe
  2⤵
  PID:5552
- C:\Windows\System\JesKeVq.exe
  C:\Windows\System\JesKeVq.exe
  2⤵
  PID:5568
- C:\Windows\System\aRUvTxV.exe
  C:\Windows\System\aRUvTxV.exe
  2⤵
  PID:5584
- C:\Windows\System\CPgFHAZ.exe
  C:\Windows\System\CPgFHAZ.exe
  2⤵
  PID:5600
- C:\Windows\System\lAkBWJD.exe
  C:\Windows\System\lAkBWJD.exe
  2⤵
  PID:5616
- C:\Windows\System\emGfZps.exe
  C:\Windows\System\emGfZps.exe
  2⤵
  PID:5632
- C:\Windows\System\OZHxzUi.exe
  C:\Windows\System\OZHxzUi.exe
  2⤵
  PID:5648
- C:\Windows\System\zIlwoyM.exe
  C:\Windows\System\zIlwoyM.exe
  2⤵
  PID:5664
- C:\Windows\System\xGtssed.exe
  C:\Windows\System\xGtssed.exe
  2⤵
  PID:5680
- C:\Windows\System\zmjZtyj.exe
  C:\Windows\System\zmjZtyj.exe
  2⤵
  PID:5696
- C:\Windows\System\ywerLIZ.exe
  C:\Windows\System\ywerLIZ.exe
  2⤵
  PID:5712
- C:\Windows\System\lBgTWBB.exe
  C:\Windows\System\lBgTWBB.exe
  2⤵
  PID:5728
- C:\Windows\System\vWgCiWC.exe
  C:\Windows\System\vWgCiWC.exe
  2⤵
  PID:5744
- C:\Windows\System\unbZKHh.exe
  C:\Windows\System\unbZKHh.exe
  2⤵
  PID:5760
- C:\Windows\System\vCkmWwc.exe
  C:\Windows\System\vCkmWwc.exe
  2⤵
  PID:5776
- C:\Windows\System\CSMeGLr.exe
  C:\Windows\System\CSMeGLr.exe
  2⤵
  PID:5792
- C:\Windows\System\UsnUZyJ.exe
  C:\Windows\System\UsnUZyJ.exe
  2⤵
  PID:5808
- C:\Windows\System\DoNyAoD.exe
  C:\Windows\System\DoNyAoD.exe
  2⤵
  PID:5824
- C:\Windows\System\oeqCFqV.exe
  C:\Windows\System\oeqCFqV.exe
  2⤵
  PID:5840
- C:\Windows\System\xhTQCOR.exe
  C:\Windows\System\xhTQCOR.exe
  2⤵
  PID:5856
- C:\Windows\System\sDrMxYB.exe
  C:\Windows\System\sDrMxYB.exe
  2⤵
  PID:5872
- C:\Windows\System\hVXCIco.exe
  C:\Windows\System\hVXCIco.exe
  2⤵
  PID:5888
- C:\Windows\System\iQbBhYC.exe
  C:\Windows\System\iQbBhYC.exe
  2⤵
  PID:5904
- C:\Windows\System\EIwmAjJ.exe
  C:\Windows\System\EIwmAjJ.exe
  2⤵
  PID:5920
- C:\Windows\System\fLhGPmp.exe
  C:\Windows\System\fLhGPmp.exe
  2⤵
  PID:5936
- C:\Windows\System\lcLdnbe.exe
  C:\Windows\System\lcLdnbe.exe
  2⤵
  PID:5952
- C:\Windows\System\WHueMvP.exe
  C:\Windows\System\WHueMvP.exe
  2⤵
  PID:5968
- C:\Windows\System\oYbOCQE.exe
  C:\Windows\System\oYbOCQE.exe
  2⤵
  PID:5984
- C:\Windows\System\JULpzWz.exe
  C:\Windows\System\JULpzWz.exe
  2⤵
  PID:6000
- C:\Windows\System\EheEDTN.exe
  C:\Windows\System\EheEDTN.exe
  2⤵
  PID:6016
- C:\Windows\System\BaRqPNo.exe
  C:\Windows\System\BaRqPNo.exe
  2⤵
  PID:6032
- C:\Windows\System\ELYxDHB.exe
  C:\Windows\System\ELYxDHB.exe
  2⤵
  PID:6048
- C:\Windows\System\oKYfrHZ.exe
  C:\Windows\System\oKYfrHZ.exe
  2⤵
  PID:6064
- C:\Windows\System\trxHyQj.exe
  C:\Windows\System\trxHyQj.exe
  2⤵
  PID:6080
- C:\Windows\System\beGcwcg.exe
  C:\Windows\System\beGcwcg.exe
  2⤵
  PID:6096
- C:\Windows\System\LwCNBSy.exe
  C:\Windows\System\LwCNBSy.exe
  2⤵
  PID:6112
- C:\Windows\System\UKhSPHa.exe
  C:\Windows\System\UKhSPHa.exe
  2⤵
  PID:6128
- C:\Windows\System\vAzcekM.exe
  C:\Windows\System\vAzcekM.exe
  2⤵
  PID:3664
- C:\Windows\System\NoEQmKY.exe
  C:\Windows\System\NoEQmKY.exe
  2⤵
  PID:4320
- C:\Windows\System\AGiuIKs.exe
  C:\Windows\System\AGiuIKs.exe
  2⤵
  PID:4368
- C:\Windows\System\LvjHoUg.exe
  C:\Windows\System\LvjHoUg.exe
  2⤵
  PID:2936
- C:\Windows\System\WbdrkSS.exe
  C:\Windows\System\WbdrkSS.exe
  2⤵
  PID:5164
- C:\Windows\System\xGpoYwt.exe
  C:\Windows\System\xGpoYwt.exe
  2⤵
  PID:5228
- C:\Windows\System\AoKMnRl.exe
  C:\Windows\System\AoKMnRl.exe
  2⤵
  PID:5268
- C:\Windows\System\oUtJlma.exe
  C:\Windows\System\oUtJlma.exe
  2⤵
  PID:3752
- C:\Windows\System\YcazGyT.exe
  C:\Windows\System\YcazGyT.exe
  2⤵
  PID:4960
- C:\Windows\System\WZTzGFh.exe
  C:\Windows\System\WZTzGFh.exe
  2⤵
  PID:4108
- C:\Windows\System\CCUpUcb.exe
  C:\Windows\System\CCUpUcb.exe
  2⤵
  PID:5152
- C:\Windows\System\xTPzjGu.exe
  C:\Windows\System\xTPzjGu.exe
  2⤵
  PID:5216
- C:\Windows\System\kTBSCQr.exe
  C:\Windows\System\kTBSCQr.exe
  2⤵
  PID:5284
- C:\Windows\System\RsIfDiz.exe
  C:\Windows\System\RsIfDiz.exe
  2⤵
  PID:5332
- C:\Windows\System\vpRnheB.exe
  C:\Windows\System\vpRnheB.exe
  2⤵
  PID:5396
- C:\Windows\System\oFsiouT.exe
  C:\Windows\System\oFsiouT.exe
  2⤵
  PID:5460
- C:\Windows\System\ZDCTAzZ.exe
  C:\Windows\System\ZDCTAzZ.exe
  2⤵
  PID:5528
- C:\Windows\System\VwmimgB.exe
  C:\Windows\System\VwmimgB.exe
  2⤵
  PID:5344
- C:\Windows\System\eGnmMVq.exe
  C:\Windows\System\eGnmMVq.exe
  2⤵
  PID:5408
- C:\Windows\System\QwihHFR.exe
  C:\Windows\System\QwihHFR.exe
  2⤵
  PID:5472
- C:\Windows\System\ZdwehHo.exe
  C:\Windows\System\ZdwehHo.exe
  2⤵
  PID:5512
- C:\Windows\System\WIapnLj.exe
  C:\Windows\System\WIapnLj.exe
  2⤵
  PID:5564
- C:\Windows\System\bPVzsAk.exe
  C:\Windows\System\bPVzsAk.exe
  2⤵
  PID:5628
- C:\Windows\System\isPXMYJ.exe
  C:\Windows\System\isPXMYJ.exe
  2⤵
  PID:5688
- C:\Windows\System\rUPnxUn.exe
  C:\Windows\System\rUPnxUn.exe
  2⤵
  PID:5752
- C:\Windows\System\LfMePEl.exe
  C:\Windows\System\LfMePEl.exe
  2⤵
  PID:5816
- C:\Windows\System\Njbjkkc.exe
  C:\Windows\System\Njbjkkc.exe
  2⤵
  PID:5608
- C:\Windows\System\SwwWvXm.exe
  C:\Windows\System\SwwWvXm.exe
  2⤵
  PID:5672
- C:\Windows\System\gxYcXLd.exe
  C:\Windows\System\gxYcXLd.exe
  2⤵
  PID:5736
- C:\Windows\System\JwlOERr.exe
  C:\Windows\System\JwlOERr.exe
  2⤵
  PID:5772
- C:\Windows\System\xyLtlVx.exe
  C:\Windows\System\xyLtlVx.exe
  2⤵
  PID:5836
- C:\Windows\System\gAgNjwd.exe
  C:\Windows\System\gAgNjwd.exe
  2⤵
  PID:5916
- C:\Windows\System\DzitrxU.exe
  C:\Windows\System\DzitrxU.exe
  2⤵
  PID:5896
- C:\Windows\System\dJCEYIF.exe
  C:\Windows\System\dJCEYIF.exe
  2⤵
  PID:5976
- C:\Windows\System\xgCnoMm.exe
  C:\Windows\System\xgCnoMm.exe
  2⤵
  PID:6008
- C:\Windows\System\ZPBRTeB.exe
  C:\Windows\System\ZPBRTeB.exe
  2⤵
  PID:6076
- C:\Windows\System\MSeORcQ.exe
  C:\Windows\System\MSeORcQ.exe
  2⤵
  PID:6140
- C:\Windows\System\ruPaKfm.exe
  C:\Windows\System\ruPaKfm.exe
  2⤵
  PID:5960
- C:\Windows\System\uNnfGUy.exe
  C:\Windows\System\uNnfGUy.exe
  2⤵
  PID:4480
- C:\Windows\System\glbBaFq.exe
  C:\Windows\System\glbBaFq.exe
  2⤵
  PID:5236
- C:\Windows\System\yhlfkmu.exe
  C:\Windows\System\yhlfkmu.exe
  2⤵
  PID:5144
- C:\Windows\System\ncIXiPP.exe
  C:\Windows\System\ncIXiPP.exe
  2⤵
  PID:5364
- C:\Windows\System\oppDikn.exe
  C:\Windows\System\oppDikn.exe
  2⤵
  PID:6088
- C:\Windows\System\iYPpTxF.exe
  C:\Windows\System\iYPpTxF.exe
  2⤵
  PID:5376
- C:\Windows\System\tktAnkp.exe
  C:\Windows\System\tktAnkp.exe
  2⤵
  PID:5596
- C:\Windows\System\VUFmuND.exe
  C:\Windows\System\VUFmuND.exe
  2⤵
  PID:4672
- C:\Windows\System\cnqrpxq.exe
  C:\Windows\System\cnqrpxq.exe
  2⤵
  PID:4976
- C:\Windows\System\YlYFJaf.exe
  C:\Windows\System\YlYFJaf.exe
  2⤵
  PID:5184
- C:\Windows\System\NZCyTzd.exe
  C:\Windows\System\NZCyTzd.exe
  2⤵
  PID:5428
- C:\Windows\System\GbYXbom.exe
  C:\Windows\System\GbYXbom.exe
  2⤵
  PID:5624
- C:\Windows\System\svTbQxX.exe
  C:\Windows\System\svTbQxX.exe
  2⤵
  PID:5444
- C:\Windows\System\CThaIVT.exe
  C:\Windows\System\CThaIVT.exe
  2⤵
  PID:5660
- C:\Windows\System\bCLlKke.exe
  C:\Windows\System\bCLlKke.exe
  2⤵
  PID:5704
- C:\Windows\System\yMSTtyK.exe
  C:\Windows\System\yMSTtyK.exe
  2⤵
  PID:5832
- C:\Windows\System\DnAcmRb.exe
  C:\Windows\System\DnAcmRb.exe
  2⤵
  PID:6012
- C:\Windows\System\FEKFJLR.exe
  C:\Windows\System\FEKFJLR.exe
  2⤵
  PID:5996
- C:\Windows\System\ILkmISZ.exe
  C:\Windows\System\ILkmISZ.exe
  2⤵
  PID:5644
- C:\Windows\System\jxEKAAY.exe
  C:\Windows\System\jxEKAAY.exe
  2⤵
  PID:5196
- C:\Windows\System\qwRIfXZ.exe
  C:\Windows\System\qwRIfXZ.exe
  2⤵
  PID:5884
- C:\Windows\System\wwSGakK.exe
  C:\Windows\System\wwSGakK.exe
  2⤵
  PID:6152
- C:\Windows\System\pfroMHl.exe
  C:\Windows\System\pfroMHl.exe
  2⤵
  PID:6168
- C:\Windows\System\czqzbnC.exe
  C:\Windows\System\czqzbnC.exe
  2⤵
  PID:6184
- C:\Windows\System\nLFQwAT.exe
  C:\Windows\System\nLFQwAT.exe
  2⤵
  PID:6204
- C:\Windows\System\Sdpvktd.exe
  C:\Windows\System\Sdpvktd.exe
  2⤵
  PID:6220
- C:\Windows\System\UbXEZRV.exe
  C:\Windows\System\UbXEZRV.exe
  2⤵
  PID:6236
- C:\Windows\System\xxxWmYN.exe
  C:\Windows\System\xxxWmYN.exe
  2⤵
  PID:6252
- C:\Windows\System\sOpMKOp.exe
  C:\Windows\System\sOpMKOp.exe
  2⤵
  PID:6268
- C:\Windows\System\DgsfhAq.exe
  C:\Windows\System\DgsfhAq.exe
  2⤵
  PID:6284
- C:\Windows\System\GVIWAAF.exe
  C:\Windows\System\GVIWAAF.exe
  2⤵
  PID:6300
- C:\Windows\System\WUPhlJk.exe
  C:\Windows\System\WUPhlJk.exe
  2⤵
  PID:6316
- C:\Windows\System\bKfYOOG.exe
  C:\Windows\System\bKfYOOG.exe
  2⤵
  PID:6332
- C:\Windows\System\FQZXWmM.exe
  C:\Windows\System\FQZXWmM.exe
  2⤵
  PID:6348
- C:\Windows\System\aRKJggr.exe
  C:\Windows\System\aRKJggr.exe
  2⤵
  PID:6364
- C:\Windows\System\RbrGGIZ.exe
  C:\Windows\System\RbrGGIZ.exe
  2⤵
  PID:6380
- C:\Windows\System\bnQMpBY.exe
  C:\Windows\System\bnQMpBY.exe
  2⤵
  PID:6396
- C:\Windows\System\NJOdIrh.exe
  C:\Windows\System\NJOdIrh.exe
  2⤵
  PID:6412
- C:\Windows\System\vYbLCOP.exe
  C:\Windows\System\vYbLCOP.exe
  2⤵
  PID:6428
- C:\Windows\System\YzqDGQx.exe
  C:\Windows\System\YzqDGQx.exe
  2⤵
  PID:6444
- C:\Windows\System\WHgwSjc.exe
  C:\Windows\System\WHgwSjc.exe
  2⤵
  PID:6460
- C:\Windows\System\HyNNcPh.exe
  C:\Windows\System\HyNNcPh.exe
  2⤵
  PID:6476
- C:\Windows\System\ViGRBcg.exe
  C:\Windows\System\ViGRBcg.exe
  2⤵
  PID:6492
- C:\Windows\System\LIVIdib.exe
  C:\Windows\System\LIVIdib.exe
  2⤵
  PID:6508
- C:\Windows\System\nSHWecr.exe
  C:\Windows\System\nSHWecr.exe
  2⤵
  PID:6524
- C:\Windows\System\LsubVNN.exe
  C:\Windows\System\LsubVNN.exe
  2⤵
  PID:6540
- C:\Windows\System\ipTusAJ.exe
  C:\Windows\System\ipTusAJ.exe
  2⤵
  PID:6556
- C:\Windows\System\WVrkZab.exe
  C:\Windows\System\WVrkZab.exe
  2⤵
  PID:6572
- C:\Windows\System\fbgJgbu.exe
  C:\Windows\System\fbgJgbu.exe
  2⤵
  PID:6588
- C:\Windows\System\nBjyDva.exe
  C:\Windows\System\nBjyDva.exe
  2⤵
  PID:6604
- C:\Windows\System\mgHwmqC.exe
  C:\Windows\System\mgHwmqC.exe
  2⤵
  PID:6620
- C:\Windows\System\gQDovrt.exe
  C:\Windows\System\gQDovrt.exe
  2⤵
  PID:6636
- C:\Windows\System\SbHDPck.exe
  C:\Windows\System\SbHDPck.exe
  2⤵
  PID:6652
- C:\Windows\System\QoxOVfS.exe
  C:\Windows\System\QoxOVfS.exe
  2⤵
  PID:6668
- C:\Windows\System\VZQgvIC.exe
  C:\Windows\System\VZQgvIC.exe
  2⤵
  PID:6684
- C:\Windows\System\snQluTI.exe
  C:\Windows\System\snQluTI.exe
  2⤵
  PID:6700
- C:\Windows\System\ZtwnNzA.exe
  C:\Windows\System\ZtwnNzA.exe
  2⤵
  PID:6716
- C:\Windows\System\eRYTgjl.exe
  C:\Windows\System\eRYTgjl.exe
  2⤵
  PID:6732
- C:\Windows\System\UifMvrX.exe
  C:\Windows\System\UifMvrX.exe
  2⤵
  PID:6748
- C:\Windows\System\enhKqop.exe
  C:\Windows\System\enhKqop.exe
  2⤵
  PID:6764
- C:\Windows\System\xZuExRl.exe
  C:\Windows\System\xZuExRl.exe
  2⤵
  PID:6780
- C:\Windows\System\ZwyUZTx.exe
  C:\Windows\System\ZwyUZTx.exe
  2⤵
  PID:6796
- C:\Windows\System\YaFqRWf.exe
  C:\Windows\System\YaFqRWf.exe
  2⤵
  PID:6812
- C:\Windows\System\oQVtUQf.exe
  C:\Windows\System\oQVtUQf.exe
  2⤵
  PID:6828
- C:\Windows\System\WuWogwP.exe
  C:\Windows\System\WuWogwP.exe
  2⤵
  PID:6844
- C:\Windows\System\bOcOuPu.exe
  C:\Windows\System\bOcOuPu.exe
  2⤵
  PID:6860
- C:\Windows\System\SnXaNqe.exe
  C:\Windows\System\SnXaNqe.exe
  2⤵
  PID:6876
- C:\Windows\System\NAjHaZD.exe
  C:\Windows\System\NAjHaZD.exe
  2⤵
  PID:6892
- C:\Windows\System\TxUzvNF.exe
  C:\Windows\System\TxUzvNF.exe
  2⤵
  PID:6908
- C:\Windows\System\YUEAjlc.exe
  C:\Windows\System\YUEAjlc.exe
  2⤵
  PID:6924
- C:\Windows\System\JmJhZHk.exe
  C:\Windows\System\JmJhZHk.exe
  2⤵
  PID:6940
- C:\Windows\System\LhSyZyh.exe
  C:\Windows\System\LhSyZyh.exe
  2⤵
  PID:6956
- C:\Windows\System\fFNrnHf.exe
  C:\Windows\System\fFNrnHf.exe
  2⤵
  PID:6972
- C:\Windows\System\KNFZdfW.exe
  C:\Windows\System\KNFZdfW.exe
  2⤵
  PID:6988
- C:\Windows\System\tvbXhRq.exe
  C:\Windows\System\tvbXhRq.exe
  2⤵
  PID:7004
- C:\Windows\System\VBkkdIm.exe
  C:\Windows\System\VBkkdIm.exe
  2⤵
  PID:7020
- C:\Windows\System\KIFrUbb.exe
  C:\Windows\System\KIFrUbb.exe
  2⤵
  PID:7036
- C:\Windows\System\qvtCvGJ.exe
  C:\Windows\System\qvtCvGJ.exe
  2⤵
  PID:7052
- C:\Windows\System\ilmuyFk.exe
  C:\Windows\System\ilmuyFk.exe
  2⤵
  PID:7072
- C:\Windows\System\GlMEszY.exe
  C:\Windows\System\GlMEszY.exe
  2⤵
  PID:7088
- C:\Windows\System\tpButPA.exe
  C:\Windows\System\tpButPA.exe
  2⤵
  PID:7104
- C:\Windows\System\nuLnXPA.exe
  C:\Windows\System\nuLnXPA.exe
  2⤵
  PID:7120
- C:\Windows\System\AlHDDLD.exe
  C:\Windows\System\AlHDDLD.exe
  2⤵
  PID:7136
- C:\Windows\System\gFSuNoB.exe
  C:\Windows\System\gFSuNoB.exe
  2⤵
  PID:7152
- C:\Windows\System\mTZCKzq.exe
  C:\Windows\System\mTZCKzq.exe
  2⤵
  PID:2084
- C:\Windows\System\YdlJzPy.exe
  C:\Windows\System\YdlJzPy.exe
  2⤵
  PID:5912
- C:\Windows\System\vEMjjmo.exe
  C:\Windows\System\vEMjjmo.exe
  2⤵
  PID:6044
- C:\Windows\System\OQPjxQT.exe
  C:\Windows\System\OQPjxQT.exe
  2⤵
  PID:5724
- C:\Windows\System\XOCQBSP.exe
  C:\Windows\System\XOCQBSP.exe
  2⤵
  PID:5868
- C:\Windows\System\zptOlwR.exe
  C:\Windows\System\zptOlwR.exe
  2⤵
  PID:5300
- C:\Windows\System\hLVRqni.exe
  C:\Windows\System\hLVRqni.exe
  2⤵
  PID:6192
- C:\Windows\System\oPBvqyM.exe
  C:\Windows\System\oPBvqyM.exe
  2⤵
  PID:6264
- C:\Windows\System\Zofsciv.exe
  C:\Windows\System\Zofsciv.exe
  2⤵
  PID:6324
- C:\Windows\System\rEBXXvv.exe
  C:\Windows\System\rEBXXvv.exe
  2⤵
  PID:6388
- C:\Windows\System\hhRzsCs.exe
  C:\Windows\System\hhRzsCs.exe
  2⤵
  PID:5252
- C:\Windows\System\IdWmPme.exe
  C:\Windows\System\IdWmPme.exe
  2⤵
  PID:6488
- C:\Windows\System\JEQVQxm.exe
  C:\Windows\System\JEQVQxm.exe
  2⤵
  PID:4716
- C:\Windows\System\xagfwqI.exe
  C:\Windows\System\xagfwqI.exe
  2⤵
  PID:6520
- C:\Windows\System\xMXYkfO.exe
  C:\Windows\System\xMXYkfO.exe
  2⤵
  PID:5548
- C:\Windows\System\uyuTZqV.exe
  C:\Windows\System\uyuTZqV.exe
  2⤵
  PID:6584
- C:\Windows\System\tXPJReS.exe
  C:\Windows\System\tXPJReS.exe
  2⤵
  PID:6136
- C:\Windows\System\ByJYgaY.exe
  C:\Windows\System\ByJYgaY.exe
  2⤵
  PID:5508
- C:\Windows\System\QrknvPV.exe
  C:\Windows\System\QrknvPV.exe
  2⤵
  PID:6440
- C:\Windows\System\oKprtXD.exe
  C:\Windows\System\oKprtXD.exe
  2⤵
  PID:6180
- C:\Windows\System\FswiJRS.exe
  C:\Windows\System\FswiJRS.exe
  2⤵
  PID:6280
- C:\Windows\System\UsFCotJ.exe
  C:\Windows\System\UsFCotJ.exe
  2⤵
  PID:6344
- C:\Windows\System\dYnUseD.exe
  C:\Windows\System\dYnUseD.exe
  2⤵
  PID:6468
- C:\Windows\System\eKHbdbK.exe
  C:\Windows\System\eKHbdbK.exe
  2⤵
  PID:6532
- C:\Windows\System\KwLOZYN.exe
  C:\Windows\System\KwLOZYN.exe
  2⤵
  PID:6596
- C:\Windows\System\urbitOU.exe
  C:\Windows\System\urbitOU.exe
  2⤵
  PID:6648
- C:\Windows\System\pvyNnpI.exe
  C:\Windows\System\pvyNnpI.exe
  2⤵
  PID:6708
- C:\Windows\System\vldAxcr.exe
  C:\Windows\System\vldAxcr.exe
  2⤵
  PID:6660
- C:\Windows\System\YkITaMb.exe
  C:\Windows\System\YkITaMb.exe
  2⤵
  PID:6776
- C:\Windows\System\eESbTpX.exe
  C:\Windows\System\eESbTpX.exe
  2⤵
  PID:6756
- C:\Windows\System\cDRKUBc.exe
  C:\Windows\System\cDRKUBc.exe
  2⤵
  PID:6840
- C:\Windows\System\DgsxAmP.exe
  C:\Windows\System\DgsxAmP.exe
  2⤵
  PID:6788
- C:\Windows\System\JhTOHsG.exe
  C:\Windows\System\JhTOHsG.exe
  2⤵
  PID:6852
- C:\Windows\System\GvPBNQR.exe
  C:\Windows\System\GvPBNQR.exe
  2⤵
  PID:6916
- C:\Windows\System\PLmiUVI.exe
  C:\Windows\System\PLmiUVI.exe
  2⤵
  PID:6932
- C:\Windows\System\QKTUHHx.exe
  C:\Windows\System\QKTUHHx.exe
  2⤵
  PID:6964
- C:\Windows\System\pPFZceV.exe
  C:\Windows\System\pPFZceV.exe
  2⤵
  PID:7028
- C:\Windows\System\toXMBdW.exe
  C:\Windows\System\toXMBdW.exe
  2⤵
  PID:7068
- C:\Windows\System\NeRPqCR.exe
  C:\Windows\System\NeRPqCR.exe
  2⤵
  PID:7128
- C:\Windows\System\mOumgzK.exe
  C:\Windows\System\mOumgzK.exe
  2⤵
  PID:7016
- C:\Windows\System\wkmchrO.exe
  C:\Windows\System\wkmchrO.exe
  2⤵
  PID:7160
- C:\Windows\System\aRZGUyM.exe
  C:\Windows\System\aRZGUyM.exe
  2⤵
  PID:7112
- C:\Windows\System\xlShlLr.exe
  C:\Windows\System\xlShlLr.exe
  2⤵
  PID:5768
- C:\Windows\System\ptcZfPy.exe
  C:\Windows\System\ptcZfPy.exe
  2⤵
  PID:5580
- C:\Windows\System\nWOlJRP.exe
  C:\Windows\System\nWOlJRP.exe
  2⤵
  PID:6296
- C:\Windows\System\MoJGqpw.exe
  C:\Windows\System\MoJGqpw.exe
  2⤵
  PID:6424
- C:\Windows\System\mVzBIoN.exe
  C:\Windows\System\mVzBIoN.exe
  2⤵
  PID:6228
- C:\Windows\System\hqSWxTk.exe
  C:\Windows\System\hqSWxTk.exe
  2⤵
  PID:6456
- C:\Windows\System\xfLyMCA.exe
  C:\Windows\System\xfLyMCA.exe
  2⤵
  PID:3280
- C:\Windows\System\CXeHmHC.exe
  C:\Windows\System\CXeHmHC.exe
  2⤵
  PID:5804
- C:\Windows\System\EhjwQCE.exe
  C:\Windows\System\EhjwQCE.exe
  2⤵
  PID:6376
- C:\Windows\System\oZLTWsa.exe
  C:\Windows\System\oZLTWsa.exe
  2⤵
  PID:6212
- C:\Windows\System\KeSPrya.exe
  C:\Windows\System\KeSPrya.exe
  2⤵
  PID:6564
- C:\Windows\System\CuxPNoS.exe
  C:\Windows\System\CuxPNoS.exe
  2⤵
  PID:6312
- C:\Windows\System\NxABxzm.exe
  C:\Windows\System\NxABxzm.exe
  2⤵
  PID:6644
- C:\Windows\System\WvEbjvo.exe
  C:\Windows\System\WvEbjvo.exe
  2⤵
  PID:6824
- C:\Windows\System\WuWmEcr.exe
  C:\Windows\System\WuWmEcr.exe
  2⤵
  PID:6664
- C:\Windows\System\pyLzckN.exe
  C:\Windows\System\pyLzckN.exe
  2⤵
  PID:7000
- C:\Windows\System\gSEXVtX.exe
  C:\Windows\System\gSEXVtX.exe
  2⤵
  PID:7096
- C:\Windows\System\LZaudFh.exe
  C:\Windows\System\LZaudFh.exe
  2⤵
  PID:6952
- C:\Windows\System\wnIICLt.exe
  C:\Windows\System\wnIICLt.exe
  2⤵
  PID:6888
- C:\Windows\System\UyLXRXg.exe
  C:\Windows\System\UyLXRXg.exe
  2⤵
  PID:7012
- C:\Windows\System\NznextF.exe
  C:\Windows\System\NznextF.exe
  2⤵
  PID:6164
- C:\Windows\System\CDbEWbs.exe
  C:\Windows\System\CDbEWbs.exe
  2⤵
  PID:5708
- C:\Windows\System\UQJmWOw.exe
  C:\Windows\System\UQJmWOw.exe
  2⤵
  PID:6148
- C:\Windows\System\peWOSno.exe
  C:\Windows\System\peWOSno.exe
  2⤵
  PID:6772
- C:\Windows\System\rfEVOxN.exe
  C:\Windows\System\rfEVOxN.exe
  2⤵
  PID:6948
- C:\Windows\System\LNweQDK.exe
  C:\Windows\System\LNweQDK.exe
  2⤵
  PID:6072
- C:\Windows\System\nsoplrq.exe
  C:\Windows\System\nsoplrq.exe
  2⤵
  PID:6436
- C:\Windows\System\RCboquz.exe
  C:\Windows\System\RCboquz.exe
  2⤵
  PID:6680
- C:\Windows\System\uGkbWUe.exe
  C:\Windows\System\uGkbWUe.exe
  2⤵
  PID:7184
- C:\Windows\System\grgverb.exe
  C:\Windows\System\grgverb.exe
  2⤵
  PID:7200
- C:\Windows\System\pIAknFy.exe
  C:\Windows\System\pIAknFy.exe
  2⤵
  PID:7216
- C:\Windows\System\YlowMKs.exe
  C:\Windows\System\YlowMKs.exe
  2⤵
  PID:7232
- C:\Windows\System\RKmbxbI.exe
  C:\Windows\System\RKmbxbI.exe
  2⤵
  PID:7248
- C:\Windows\System\pflFUSX.exe
  C:\Windows\System\pflFUSX.exe
  2⤵
  PID:7264
- C:\Windows\System\sWPrDVy.exe
  C:\Windows\System\sWPrDVy.exe
  2⤵
  PID:7280
- C:\Windows\System\EpWayOI.exe
  C:\Windows\System\EpWayOI.exe
  2⤵
  PID:7324
- C:\Windows\System\LMqIKAB.exe
  C:\Windows\System\LMqIKAB.exe
  2⤵
  PID:7344
- C:\Windows\System\pmgPZEv.exe
  C:\Windows\System\pmgPZEv.exe
  2⤵
  PID:7360
- C:\Windows\System\SvRtaaG.exe
  C:\Windows\System\SvRtaaG.exe
  2⤵
  PID:7380
- C:\Windows\System\FbafCLh.exe
  C:\Windows\System\FbafCLh.exe
  2⤵
  PID:7396
- C:\Windows\System\sjXeoLL.exe
  C:\Windows\System\sjXeoLL.exe
  2⤵
  PID:7412
- C:\Windows\System\oQxUhwT.exe
  C:\Windows\System\oQxUhwT.exe
  2⤵
  PID:7428
- C:\Windows\System\UNOxKdz.exe
  C:\Windows\System\UNOxKdz.exe
  2⤵
  PID:7444
- C:\Windows\System\oNEWImi.exe
  C:\Windows\System\oNEWImi.exe
  2⤵
  PID:7460
- C:\Windows\System\xORAxBM.exe
  C:\Windows\System\xORAxBM.exe
  2⤵
  PID:7480
- C:\Windows\System\MZEWyUm.exe
  C:\Windows\System\MZEWyUm.exe
  2⤵
  PID:7500
- C:\Windows\System\XHCQTDd.exe
  C:\Windows\System\XHCQTDd.exe
  2⤵
  PID:7516
- C:\Windows\System\qeJJHZz.exe
  C:\Windows\System\qeJJHZz.exe
  2⤵
  PID:7532
- C:\Windows\System\xnrfPhf.exe
  C:\Windows\System\xnrfPhf.exe
  2⤵
  PID:7548
- C:\Windows\System\zpEIPHe.exe
  C:\Windows\System\zpEIPHe.exe
  2⤵
  PID:7564
- C:\Windows\System\FnVGGDz.exe
  C:\Windows\System\FnVGGDz.exe
  2⤵
  PID:7580
- C:\Windows\System\UYXjnWq.exe
  C:\Windows\System\UYXjnWq.exe
  2⤵
  PID:7600
- C:\Windows\System\STbBxyN.exe
  C:\Windows\System\STbBxyN.exe
  2⤵
  PID:7616
- C:\Windows\System\ZZVsBlO.exe
  C:\Windows\System\ZZVsBlO.exe
  2⤵
  PID:7632
- C:\Windows\System\uIGjjfh.exe
  C:\Windows\System\uIGjjfh.exe
  2⤵
  PID:7648
- C:\Windows\System\YCyubPE.exe
  C:\Windows\System\YCyubPE.exe
  2⤵
  PID:7676
- C:\Windows\System\YmEvwlf.exe
  C:\Windows\System\YmEvwlf.exe
  2⤵
  PID:7692
- C:\Windows\System\cwXBhEs.exe
  C:\Windows\System\cwXBhEs.exe
  2⤵
  PID:7712
- C:\Windows\System\JFEUsfm.exe
  C:\Windows\System\JFEUsfm.exe
  2⤵
  PID:7728
- C:\Windows\System\zctDLLM.exe
  C:\Windows\System\zctDLLM.exe
  2⤵
  PID:7744
- C:\Windows\System\OBhbaXb.exe
  C:\Windows\System\OBhbaXb.exe
  2⤵
  PID:7760
- C:\Windows\System\HLDKbCY.exe
  C:\Windows\System\HLDKbCY.exe
  2⤵
  PID:7776
- C:\Windows\System\wlEDlQH.exe
  C:\Windows\System\wlEDlQH.exe
  2⤵
  PID:7792
- C:\Windows\System\qNsBWPi.exe
  C:\Windows\System\qNsBWPi.exe
  2⤵
  PID:7808
- C:\Windows\System\steaCtE.exe
  C:\Windows\System\steaCtE.exe
  2⤵
  PID:7828
- C:\Windows\System\nOFhRDw.exe
  C:\Windows\System\nOFhRDw.exe
  2⤵
  PID:7844
- C:\Windows\System\oeUvjoO.exe
  C:\Windows\System\oeUvjoO.exe
  2⤵
  PID:7860
- C:\Windows\System\bcwoiGv.exe
  C:\Windows\System\bcwoiGv.exe
  2⤵
  PID:7876
- C:\Windows\System\vGkhBbr.exe
  C:\Windows\System\vGkhBbr.exe
  2⤵
  PID:7892
- C:\Windows\System\nlnvhpq.exe
  C:\Windows\System\nlnvhpq.exe
  2⤵
  PID:7912
- C:\Windows\System\AXRjQiY.exe
  C:\Windows\System\AXRjQiY.exe
  2⤵
  PID:7928
- C:\Windows\System\kCxePGj.exe
  C:\Windows\System\kCxePGj.exe
  2⤵
  PID:7948
- C:\Windows\System\gaBCOsa.exe
  C:\Windows\System\gaBCOsa.exe
  2⤵
  PID:7964
- C:\Windows\System\yiugxUi.exe
  C:\Windows\System\yiugxUi.exe
  2⤵
  PID:7980
- C:\Windows\System\hXIABWV.exe
  C:\Windows\System\hXIABWV.exe
  2⤵
  PID:7996
- C:\Windows\System\gtrVyZf.exe
  C:\Windows\System\gtrVyZf.exe
  2⤵
  PID:8012
- C:\Windows\System\VLjLDcp.exe
  C:\Windows\System\VLjLDcp.exe
  2⤵
  PID:8028
- C:\Windows\System\xQaBVuK.exe
  C:\Windows\System\xQaBVuK.exe
  2⤵
  PID:8044
- C:\Windows\System\suDXBhN.exe
  C:\Windows\System\suDXBhN.exe
  2⤵
  PID:8060
- C:\Windows\System\VxBAHEJ.exe
  C:\Windows\System\VxBAHEJ.exe
  2⤵
  PID:8076
- C:\Windows\System\sIlughQ.exe
  C:\Windows\System\sIlughQ.exe
  2⤵
  PID:8092
- C:\Windows\System\LBSlgZV.exe
  C:\Windows\System\LBSlgZV.exe
  2⤵
  PID:8108
- C:\Windows\System\jpwrNwV.exe
  C:\Windows\System\jpwrNwV.exe
  2⤵
  PID:8124
- C:\Windows\System\DTvqLaV.exe
  C:\Windows\System\DTvqLaV.exe
  2⤵
  PID:8140
- C:\Windows\System\VcMJAhy.exe
  C:\Windows\System\VcMJAhy.exe
  2⤵
  PID:8156
- C:\Windows\System\LbbhLSj.exe
  C:\Windows\System\LbbhLSj.exe
  2⤵
  PID:8172
- C:\Windows\System\weHNOxv.exe
  C:\Windows\System\weHNOxv.exe
  2⤵
  PID:8188
- C:\Windows\System\VHHqEZW.exe
  C:\Windows\System\VHHqEZW.exe
  2⤵
  PID:7208
- C:\Windows\System\tnDeAfy.exe
  C:\Windows\System\tnDeAfy.exe
  2⤵
  PID:5932
- C:\Windows\System\JBfjCjp.exe
  C:\Windows\System\JBfjCjp.exe
  2⤵
  PID:7244
- C:\Windows\System\MKkCCFh.exe
  C:\Windows\System\MKkCCFh.exe
  2⤵
  PID:6356
- C:\Windows\System\qidNXzt.exe
  C:\Windows\System\qidNXzt.exe
  2⤵
  PID:6276
- C:\Windows\System\IxgpniR.exe
  C:\Windows\System\IxgpniR.exe
  2⤵
  PID:6500
- C:\Windows\System\PJnCOss.exe
  C:\Windows\System\PJnCOss.exe
  2⤵
  PID:7148
- C:\Windows\System\SCQKFwG.exe
  C:\Windows\System\SCQKFwG.exe
  2⤵
  PID:6884
- C:\Windows\System\QUQufvL.exe
  C:\Windows\System\QUQufvL.exe
  2⤵
  PID:7192
- C:\Windows\System\XNuehMh.exe
  C:\Windows\System\XNuehMh.exe
  2⤵
  PID:7260
- C:\Windows\System\nvyfjLr.exe
  C:\Windows\System\nvyfjLr.exe
  2⤵
  PID:7308
- C:\Windows\System\DgvddXA.exe
  C:\Windows\System\DgvddXA.exe
  2⤵
  PID:7332
- C:\Windows\System\oibckml.exe
  C:\Windows\System\oibckml.exe
  2⤵
  PID:7320
- C:\Windows\System\efRcWeC.exe
  C:\Windows\System\efRcWeC.exe
  2⤵
  PID:7404
- C:\Windows\System\CktGpWa.exe
  C:\Windows\System\CktGpWa.exe
  2⤵
  PID:7440
- C:\Windows\System\gOCETuK.exe
  C:\Windows\System\gOCETuK.exe
  2⤵
  PID:7392
- C:\Windows\System\Obcvlda.exe
  C:\Windows\System\Obcvlda.exe
  2⤵
  PID:7424
- C:\Windows\System\NNzjYDX.exe
  C:\Windows\System\NNzjYDX.exe
  2⤵
  PID:7540
- C:\Windows\System\oSeqLzr.exe
  C:\Windows\System\oSeqLzr.exe
  2⤵
  PID:7492
- C:\Windows\System\fCoAZSE.exe
  C:\Windows\System\fCoAZSE.exe
  2⤵
  PID:7524
- C:\Windows\System\hWSQdKM.exe
  C:\Windows\System\hWSQdKM.exe
  2⤵
  PID:7592
- C:\Windows\System\FUhFcTN.exe
  C:\Windows\System\FUhFcTN.exe
  2⤵
  PID:7560
- C:\Windows\System\ReUvORD.exe
  C:\Windows\System\ReUvORD.exe
  2⤵
  PID:7664
- C:\Windows\System\ucoomiF.exe
  C:\Windows\System\ucoomiF.exe
  2⤵
  PID:7724
- C:\Windows\System\VRIIwOc.exe
  C:\Windows\System\VRIIwOc.exe
  2⤵
  PID:7784
- C:\Windows\System\lYUDiRU.exe
  C:\Windows\System\lYUDiRU.exe
  2⤵
  PID:7824
- C:\Windows\System\wJoBoXY.exe
  C:\Windows\System\wJoBoXY.exe
  2⤵
  PID:7704
- C:\Windows\System\mvUFAvi.exe
  C:\Windows\System\mvUFAvi.exe
  2⤵
  PID:7740
- C:\Windows\System\UzMdjfW.exe
  C:\Windows\System\UzMdjfW.exe
  2⤵
  PID:7852
- C:\Windows\System\JiXgzZi.exe
  C:\Windows\System\JiXgzZi.exe
  2⤵
  PID:7888
- C:\Windows\System\kPhzmIS.exe
  C:\Windows\System\kPhzmIS.exe
  2⤵
  PID:8088
- C:\Windows\System\hZkEHmo.exe
  C:\Windows\System\hZkEHmo.exe
  2⤵
  PID:8180
- C:\Windows\System\aoaffIp.exe
  C:\Windows\System\aoaffIp.exe
  2⤵
  PID:8184
- C:\Windows\System\kAdjJar.exe
  C:\Windows\System\kAdjJar.exe
  2⤵
  PID:8040
- C:\Windows\System\cSVeira.exe
  C:\Windows\System\cSVeira.exe
  2⤵
  PID:8132
- C:\Windows\System\mPADXei.exe
  C:\Windows\System\mPADXei.exe
  2⤵
  PID:7176
- C:\Windows\System\naiRYIf.exe
  C:\Windows\System\naiRYIf.exe
  2⤵
  PID:7276
- C:\Windows\System\jjusFOH.exe
  C:\Windows\System\jjusFOH.exe
  2⤵
  PID:4316
- C:\Windows\System\ranjBFs.exe
  C:\Windows\System\ranjBFs.exe
  2⤵
  PID:7256
- C:\Windows\System\zHKEasC.exe
  C:\Windows\System\zHKEasC.exe
  2⤵
  PID:7060
- C:\Windows\System\TYdRqxz.exe
  C:\Windows\System\TYdRqxz.exe
  2⤵
  PID:5524
- C:\Windows\System\qjiWyda.exe
  C:\Windows\System\qjiWyda.exe
  2⤵
  PID:5848
- C:\Windows\System\FnWfBta.exe
  C:\Windows\System\FnWfBta.exe
  2⤵
  PID:7304
- C:\Windows\System\pteOIpk.exe
  C:\Windows\System\pteOIpk.exe
  2⤵
  PID:7576
- C:\Windows\System\lKHSqIz.exe
  C:\Windows\System\lKHSqIz.exe
  2⤵
  PID:7588
- C:\Windows\System\jripIcU.exe
  C:\Windows\System\jripIcU.exe
  2⤵
  PID:7572
- C:\Windows\System\DygvRWu.exe
  C:\Windows\System\DygvRWu.exe
  2⤵
  PID:7456
- C:\Windows\System\WoZXRid.exe
  C:\Windows\System\WoZXRid.exe
  2⤵
  PID:7836
- C:\Windows\System\agqXajH.exe
  C:\Windows\System\agqXajH.exe
  2⤵
  PID:7804
- C:\Windows\System\ftdiZGE.exe
  C:\Windows\System\ftdiZGE.exe
  2⤵
  PID:8020
- C:\Windows\System\IOqKiJe.exe
  C:\Windows\System\IOqKiJe.exe
  2⤵
  PID:8052
- C:\Windows\System\oPTJdMn.exe
  C:\Windows\System\oPTJdMn.exe
  2⤵
  PID:8152
- C:\Windows\System\hldIiRe.exe
  C:\Windows\System\hldIiRe.exe
  2⤵
  PID:8084
- C:\Windows\System\qtLKTSw.exe
  C:\Windows\System\qtLKTSw.exe
  2⤵
  PID:8104
- C:\Windows\System\atghnVq.exe
  C:\Windows\System\atghnVq.exe
  2⤵
  PID:7164
- C:\Windows\System\FsmDqRs.exe
  C:\Windows\System\FsmDqRs.exe
  2⤵
  PID:7064
- C:\Windows\System\wvdWlWk.exe
  C:\Windows\System\wvdWlWk.exe
  2⤵
  PID:7476
- C:\Windows\System\KUZPkRZ.exe
  C:\Windows\System\KUZPkRZ.exe
  2⤵
  PID:7688
- C:\Windows\System\MpbsCyV.exe
  C:\Windows\System\MpbsCyV.exe
  2⤵
  PID:7352
- C:\Windows\System\GmZnuIc.exe
  C:\Windows\System\GmZnuIc.exe
  2⤵
  PID:7720
- C:\Windows\System\kKBIZJr.exe
  C:\Windows\System\kKBIZJr.exe
  2⤵
  PID:7756
- C:\Windows\System\yQHMeSm.exe
  C:\Windows\System\yQHMeSm.exe
  2⤵
  PID:7656
- C:\Windows\System\FxiZgMs.exe
  C:\Windows\System\FxiZgMs.exe
  2⤵
  PID:7840
- C:\Windows\System\qpdfuEg.exe
  C:\Windows\System\qpdfuEg.exe
  2⤵
  PID:7868
- C:\Windows\System\VfmoLwo.exe
  C:\Windows\System\VfmoLwo.exe
  2⤵
  PID:7988
- C:\Windows\System\RhqBvBR.exe
  C:\Windows\System\RhqBvBR.exe
  2⤵
  PID:8164
- C:\Windows\System\PBIYudL.exe
  C:\Windows\System\PBIYudL.exe
  2⤵
  PID:7508
- C:\Windows\System\wvQPCMn.exe
  C:\Windows\System\wvQPCMn.exe
  2⤵
  PID:7528
- C:\Windows\System\RahwhRd.exe
  C:\Windows\System\RahwhRd.exe
  2⤵
  PID:7972
- C:\Windows\System\JDBADdL.exe
  C:\Windows\System\JDBADdL.exe
  2⤵
  PID:7228
- C:\Windows\System\YsYPOcG.exe
  C:\Windows\System\YsYPOcG.exe
  2⤵
  PID:7708
- C:\Windows\System\ypjGgeL.exe
  C:\Windows\System\ypjGgeL.exe
  2⤵
  PID:7924
- C:\Windows\System\RYtYLyq.exe
  C:\Windows\System\RYtYLyq.exe
  2⤵
  PID:8116
- C:\Windows\System\UNNnqBs.exe
  C:\Windows\System\UNNnqBs.exe
  2⤵
  PID:7496
- C:\Windows\System\YkozwCe.exe
  C:\Windows\System\YkozwCe.exe
  2⤵
  PID:7472
- C:\Windows\System\mJtcwjC.exe
  C:\Windows\System\mJtcwjC.exe
  2⤵
  PID:7820
- C:\Windows\System\qcwBmEY.exe
  C:\Windows\System\qcwBmEY.exe
  2⤵
  PID:8036
- C:\Windows\System\AtGdoKT.exe
  C:\Windows\System\AtGdoKT.exe
  2⤵
  PID:8204
- C:\Windows\System\FwZbdrW.exe
  C:\Windows\System\FwZbdrW.exe
  2⤵
  PID:8224
- C:\Windows\System\taDtIuo.exe
  C:\Windows\System\taDtIuo.exe
  2⤵
  PID:8240
- C:\Windows\System\CLPEvVS.exe
  C:\Windows\System\CLPEvVS.exe
  2⤵
  PID:8256
- C:\Windows\System\ZMBXtPs.exe
  C:\Windows\System\ZMBXtPs.exe
  2⤵
  PID:8276
- C:\Windows\System\LIRoDXG.exe
  C:\Windows\System\LIRoDXG.exe
  2⤵
  PID:8292
- C:\Windows\System\HuUsmdn.exe
  C:\Windows\System\HuUsmdn.exe
  2⤵
  PID:8460
- C:\Windows\System\oSYdhaH.exe
  C:\Windows\System\oSYdhaH.exe
  2⤵
  PID:8496
- C:\Windows\System\CitChWV.exe
  C:\Windows\System\CitChWV.exe
  2⤵
  PID:8512
- C:\Windows\System\XhrPqCa.exe
  C:\Windows\System\XhrPqCa.exe
  2⤵
  PID:8528
- C:\Windows\System\cqFgpQr.exe
  C:\Windows\System\cqFgpQr.exe
  2⤵
  PID:8544
- C:\Windows\System\tsolKst.exe
  C:\Windows\System\tsolKst.exe
  2⤵
  PID:8564
- C:\Windows\System\GzoiqFG.exe
  C:\Windows\System\GzoiqFG.exe
  2⤵
  PID:8580
- C:\Windows\System\wMRvOJN.exe
  C:\Windows\System\wMRvOJN.exe
  2⤵
  PID:8600
- C:\Windows\System\zqbdUNt.exe
  C:\Windows\System\zqbdUNt.exe
  2⤵
  PID:8620
- C:\Windows\System\CGlafUC.exe
  C:\Windows\System\CGlafUC.exe
  2⤵
  PID:8636
- C:\Windows\System\vYgUEhd.exe
  C:\Windows\System\vYgUEhd.exe
  2⤵
  PID:8652
- C:\Windows\System\evMPbaY.exe
  C:\Windows\System\evMPbaY.exe
  2⤵
  PID:8684
- C:\Windows\System\LfpbnoJ.exe
  C:\Windows\System\LfpbnoJ.exe
  2⤵
  PID:8700
- C:\Windows\System\hHfNWSe.exe
  C:\Windows\System\hHfNWSe.exe
  2⤵
  PID:8716
- C:\Windows\System\pTRaSxU.exe
  C:\Windows\System\pTRaSxU.exe
  2⤵
  PID:8732
- C:\Windows\System\okbfRAE.exe
  C:\Windows\System\okbfRAE.exe
  2⤵
  PID:8748
- C:\Windows\System\acwLTni.exe
  C:\Windows\System\acwLTni.exe
  2⤵
  PID:8764
- C:\Windows\System\YSGCxhL.exe
  C:\Windows\System\YSGCxhL.exe
  2⤵
  PID:8780
- C:\Windows\System\FijxGOT.exe
  C:\Windows\System\FijxGOT.exe
  2⤵
  PID:8796
- C:\Windows\System\lWiUjLo.exe
  C:\Windows\System\lWiUjLo.exe
  2⤵
  PID:8812
- C:\Windows\System\wrbMXpK.exe
  C:\Windows\System\wrbMXpK.exe
  2⤵
  PID:8828
- C:\Windows\System\QsmycYb.exe
  C:\Windows\System\QsmycYb.exe
  2⤵
  PID:8848
- C:\Windows\System\iaQNvCt.exe
  C:\Windows\System\iaQNvCt.exe
  2⤵
  PID:8864
- C:\Windows\System\OrlgLNT.exe
  C:\Windows\System\OrlgLNT.exe
  2⤵
  PID:8880
- C:\Windows\System\DkmVqDy.exe
  C:\Windows\System\DkmVqDy.exe
  2⤵
  PID:8896
- C:\Windows\System\MZJFaAk.exe
  C:\Windows\System\MZJFaAk.exe
  2⤵
  PID:8912
- C:\Windows\System\crhuBTI.exe
  C:\Windows\System\crhuBTI.exe
  2⤵
  PID:8928
- C:\Windows\System\BlPdVzm.exe
  C:\Windows\System\BlPdVzm.exe
  2⤵
  PID:8944
- C:\Windows\System\SrthuZD.exe
  C:\Windows\System\SrthuZD.exe
  2⤵
  PID:8960
- C:\Windows\System\ZCrjGaK.exe
  C:\Windows\System\ZCrjGaK.exe
  2⤵
  PID:8976
- C:\Windows\System\XlpCUME.exe
  C:\Windows\System\XlpCUME.exe
  2⤵
  PID:8992
- C:\Windows\System\OtDhGsA.exe
  C:\Windows\System\OtDhGsA.exe
  2⤵
  PID:9008
- C:\Windows\System\cvjfLUQ.exe
  C:\Windows\System\cvjfLUQ.exe
  2⤵
  PID:9024
- C:\Windows\System\TvGTndJ.exe
  C:\Windows\System\TvGTndJ.exe
  2⤵
  PID:9040
- C:\Windows\System\GOodhmd.exe
  C:\Windows\System\GOodhmd.exe
  2⤵
  PID:9056
- C:\Windows\System\qdxQmrP.exe
  C:\Windows\System\qdxQmrP.exe
  2⤵
  PID:9072
- C:\Windows\System\bDxiyFc.exe
  C:\Windows\System\bDxiyFc.exe
  2⤵
  PID:9088
- C:\Windows\System\oCKNAdK.exe
  C:\Windows\System\oCKNAdK.exe
  2⤵
  PID:9104
- C:\Windows\System\zCtscQH.exe
  C:\Windows\System\zCtscQH.exe
  2⤵
  PID:9120
- C:\Windows\System\tEwEJND.exe
  C:\Windows\System\tEwEJND.exe
  2⤵
  PID:9136
- C:\Windows\System\hPfEtca.exe
  C:\Windows\System\hPfEtca.exe
  2⤵
  PID:9152
- C:\Windows\System\vrzBbEr.exe
  C:\Windows\System\vrzBbEr.exe
  2⤵
  PID:9172
- C:\Windows\System\yJyZVqB.exe
  C:\Windows\System\yJyZVqB.exe
  2⤵
  PID:9188
- C:\Windows\System\mARHxyu.exe
  C:\Windows\System\mARHxyu.exe
  2⤵
  PID:9208
- C:\Windows\System\zSaXuyd.exe
  C:\Windows\System\zSaXuyd.exe
  2⤵
  PID:7700
- C:\Windows\System\iDeagFE.exe
  C:\Windows\System\iDeagFE.exe
  2⤵
  PID:7960
- C:\Windows\System\TFzPizt.exe
  C:\Windows\System\TFzPizt.exe
  2⤵
  PID:8212
- C:\Windows\System\VYJmQMg.exe
  C:\Windows\System\VYJmQMg.exe
  2⤵
  PID:8252
- C:\Windows\System\YgZlTqP.exe
  C:\Windows\System\YgZlTqP.exe
  2⤵
  PID:8304
- C:\Windows\System\qtFmimO.exe
  C:\Windows\System\qtFmimO.exe
  2⤵
  PID:8320
- C:\Windows\System\qOoEpaw.exe
  C:\Windows\System\qOoEpaw.exe
  2⤵
  PID:8336
- C:\Windows\System\yRlqPdi.exe
  C:\Windows\System\yRlqPdi.exe
  2⤵
  PID:8356
- C:\Windows\System\AdCqbwK.exe
  C:\Windows\System\AdCqbwK.exe
  2⤵
  PID:8368
- C:\Windows\System\uPszezo.exe
  C:\Windows\System\uPszezo.exe
  2⤵
  PID:8388
- C:\Windows\System\vQvTadE.exe
  C:\Windows\System\vQvTadE.exe
  2⤵
  PID:8408
- C:\Windows\System\icLjPuA.exe
  C:\Windows\System\icLjPuA.exe
  2⤵
  PID:8412
- C:\Windows\System\CKPQGkL.exe
  C:\Windows\System\CKPQGkL.exe
  2⤵
  PID:8432
- C:\Windows\System\LkTwFvc.exe
  C:\Windows\System\LkTwFvc.exe
  2⤵
  PID:8452
- C:\Windows\System\nQvmULr.exe
  C:\Windows\System\nQvmULr.exe
  2⤵
  PID:8472
- C:\Windows\System\mxMOOor.exe
  C:\Windows\System\mxMOOor.exe
  2⤵
  PID:8536
- C:\Windows\System\ULCtVND.exe
  C:\Windows\System\ULCtVND.exe
  2⤵
  PID:8608
- C:\Windows\System\nbvFDOJ.exe
  C:\Windows\System\nbvFDOJ.exe
  2⤵
  PID:8648
- C:\Windows\System\HpWqqjG.exe
  C:\Windows\System\HpWqqjG.exe
  2⤵
  PID:8724
- C:\Windows\System\UNUTWdE.exe
  C:\Windows\System\UNUTWdE.exe
  2⤵
  PID:8756
- C:\Windows\System\eilUhmN.exe
  C:\Windows\System\eilUhmN.exe
  2⤵
  PID:8820
- C:\Windows\System\ObVlymb.exe
  C:\Windows\System\ObVlymb.exe
  2⤵
  PID:8520
- C:\Windows\System\iGTUIWY.exe
  C:\Windows\System\iGTUIWY.exe
  2⤵
  PID:8668
- C:\Windows\System\jtKRnWl.exe
  C:\Windows\System\jtKRnWl.exe
  2⤵
  PID:8740
- C:\Windows\System\jKNtfuJ.exe
  C:\Windows\System\jKNtfuJ.exe
  2⤵
  PID:8804
- C:\Windows\System\ppSSaUs.exe
  C:\Windows\System\ppSSaUs.exe
  2⤵
  PID:8588
- C:\Windows\System\FEnAiQh.exe
  C:\Windows\System\FEnAiQh.exe
  2⤵
  PID:8856
- C:\Windows\System\tEMJjRl.exe
  C:\Windows\System\tEMJjRl.exe
  2⤵
  PID:8872
- C:\Windows\System\JYgSmlf.exe
  C:\Windows\System\JYgSmlf.exe
  2⤵
  PID:8924
- C:\Windows\System\WYoWUJM.exe
  C:\Windows\System\WYoWUJM.exe
  2⤵
  PID:8940
- C:\Windows\System\OmOJjjs.exe
  C:\Windows\System\OmOJjjs.exe
  2⤵
  PID:8936
- C:\Windows\System\WVePwAe.exe
  C:\Windows\System\WVePwAe.exe
  2⤵
  PID:8972
- C:\Windows\System\SfiYTaz.exe
  C:\Windows\System\SfiYTaz.exe
  2⤵
  PID:9080
- C:\Windows\System\IoqjKeZ.exe
  C:\Windows\System\IoqjKeZ.exe
  2⤵
  PID:9084
- C:\Windows\System\ETQfvNf.exe
  C:\Windows\System\ETQfvNf.exe
  2⤵
  PID:9116
- C:\Windows\System\ktXpyux.exe
  C:\Windows\System\ktXpyux.exe
  2⤵
  PID:9180
- C:\Windows\System\bVifyJs.exe
  C:\Windows\System\bVifyJs.exe
  2⤵
  PID:8200
- C:\Windows\System\ljKVriN.exe
  C:\Windows\System\ljKVriN.exe
  2⤵
  PID:8248
- C:\Windows\System\WTqTQYC.exe
  C:\Windows\System\WTqTQYC.exe
  2⤵
  PID:9164
- C:\Windows\System\dgQXalm.exe
  C:\Windows\System\dgQXalm.exe
  2⤵
  PID:9204
- C:\Windows\System\LkLjgQb.exe
  C:\Windows\System\LkLjgQb.exe
  2⤵
  PID:7240
- C:\Windows\System\cmdvkGn.exe
  C:\Windows\System\cmdvkGn.exe
  2⤵
  PID:8364
- C:\Windows\System\UbOWEWJ.exe
  C:\Windows\System\UbOWEWJ.exe
  2⤵
  PID:8396
- C:\Windows\System\sfErjGH.exe
  C:\Windows\System\sfErjGH.exe
  2⤵
  PID:8468
- C:\Windows\System\gGzFvPW.exe
  C:\Windows\System\gGzFvPW.exe
  2⤵
  PID:8348
- C:\Windows\System\WqKYyJS.exe
  C:\Windows\System\WqKYyJS.exe
  2⤵
  PID:8344
- C:\Windows\System\tzlAZLg.exe
  C:\Windows\System\tzlAZLg.exe
  2⤵
  PID:8444
- C:\Windows\System\VReCmkY.exe
  C:\Windows\System\VReCmkY.exe
  2⤵
  PID:2488
- C:\Windows\System\cvtXvky.exe
  C:\Windows\System\cvtXvky.exe
  2⤵
  PID:8596
- C:\Windows\System\krKRuix.exe
  C:\Windows\System\krKRuix.exe
  2⤵
  PID:8776
- C:\Windows\System\GToXvRY.exe
  C:\Windows\System\GToXvRY.exe
  2⤵
  PID:8480
- C:\Windows\System\YIdwsVt.exe
  C:\Windows\System\YIdwsVt.exe
  2⤵
  PID:8616
- C:\Windows\System\TDMSIWQ.exe
  C:\Windows\System\TDMSIWQ.exe
  2⤵
  PID:9032
- C:\Windows\System\cfHYvdq.exe
  C:\Windows\System\cfHYvdq.exe
  2⤵
  PID:8484
- C:\Windows\System\rDuNGbK.exe
  C:\Windows\System\rDuNGbK.exe
  2⤵
  PID:8712
- C:\Windows\System\zmtKERR.exe
  C:\Windows\System\zmtKERR.exe
  2⤵
  PID:8952
- C:\Windows\System\UMTznRS.exe
  C:\Windows\System\UMTznRS.exe
  2⤵
  PID:4956
- C:\Windows\System\wzkceOP.exe
  C:\Windows\System\wzkceOP.exe
  2⤵
  PID:9000
- C:\Windows\System\JFTaozL.exe
  C:\Windows\System\JFTaozL.exe
  2⤵
  PID:8148
- C:\Windows\System\yLHFzKR.exe
  C:\Windows\System\yLHFzKR.exe
  2⤵
  PID:9144
- C:\Windows\System\BXCJLTj.exe
  C:\Windows\System\BXCJLTj.exe
  2⤵
  PID:8424
- C:\Windows\System\oNwYWab.exe
  C:\Windows\System\oNwYWab.exe
  2⤵
  PID:9200
- C:\Windows\System\vFzljWn.exe
  C:\Windows\System\vFzljWn.exe
  2⤵
  PID:8428
- C:\Windows\System\tkmbGTs.exe
  C:\Windows\System\tkmbGTs.exe
  2⤵
  PID:8592
- C:\Windows\System\RtCaCsU.exe
  C:\Windows\System\RtCaCsU.exe
  2⤵
  PID:8772
- C:\Windows\System\WSLcUUL.exe
  C:\Windows\System\WSLcUUL.exe
  2⤵
  PID:8560
- C:\Windows\System\IiwHxUa.exe
  C:\Windows\System\IiwHxUa.exe
  2⤵
  PID:8576
- C:\Windows\System\XXftcyt.exe
  C:\Windows\System\XXftcyt.exe
  2⤵
  PID:1240
- C:\Windows\System\dNccrkL.exe
  C:\Windows\System\dNccrkL.exe
  2⤵
  PID:8300
- C:\Windows\System\JFITcKc.exe
  C:\Windows\System\JFITcKc.exe
  2⤵
  PID:9020
- C:\Windows\System\kjLolxo.exe
  C:\Windows\System\kjLolxo.exe
  2⤵
  PID:8236
- C:\Windows\System\zAQZgMO.exe
  C:\Windows\System\zAQZgMO.exe
  2⤵
  PID:8332
- C:\Windows\System\AgrTeWJ.exe
  C:\Windows\System\AgrTeWJ.exe
  2⤵
  PID:9096
- C:\Windows\System\HyPaExd.exe
  C:\Windows\System\HyPaExd.exe
  2⤵
  PID:8692
- C:\Windows\System\EXJGPJl.exe
  C:\Windows\System\EXJGPJl.exe
  2⤵
  PID:8676
- C:\Windows\System\AYAMgAm.exe
  C:\Windows\System\AYAMgAm.exe
  2⤵
  PID:8436
- C:\Windows\System\hCqImHH.exe
  C:\Windows\System\hCqImHH.exe
  2⤵
  PID:9232
- C:\Windows\System\NqWhDld.exe
  C:\Windows\System\NqWhDld.exe
  2⤵
  PID:9256
- C:\Windows\System\aKiQbfO.exe
  C:\Windows\System\aKiQbfO.exe
  2⤵
  PID:9272
- C:\Windows\System\KNepqYl.exe
  C:\Windows\System\KNepqYl.exe
  2⤵
  PID:9292
- C:\Windows\System\FHxzesb.exe
  C:\Windows\System\FHxzesb.exe
  2⤵
  PID:9308
- C:\Windows\System\vPMHNZz.exe
  C:\Windows\System\vPMHNZz.exe
  2⤵
  PID:9324
- C:\Windows\System\jUrfrWm.exe
  C:\Windows\System\jUrfrWm.exe
  2⤵
  PID:9340
- C:\Windows\System\AKJHLUB.exe
  C:\Windows\System\AKJHLUB.exe
  2⤵
  PID:9356
- C:\Windows\System\GueJrcr.exe
  C:\Windows\System\GueJrcr.exe
  2⤵
  PID:9404
- C:\Windows\System\tRUjClQ.exe
  C:\Windows\System\tRUjClQ.exe
  2⤵
  PID:9420
- C:\Windows\System\rHKOyke.exe
  C:\Windows\System\rHKOyke.exe
  2⤵
  PID:9436
- C:\Windows\System\GXzazBq.exe
  C:\Windows\System\GXzazBq.exe
  2⤵
  PID:9452
- C:\Windows\System\NcdKCzt.exe
  C:\Windows\System\NcdKCzt.exe
  2⤵
  PID:9468
- C:\Windows\System\lfdLlmX.exe
  C:\Windows\System\lfdLlmX.exe
  2⤵
  PID:9488
- C:\Windows\System\fGZAqrF.exe
  C:\Windows\System\fGZAqrF.exe
  2⤵
  PID:9504
- C:\Windows\System\mKvsZPw.exe
  C:\Windows\System\mKvsZPw.exe
  2⤵
  PID:9520
- C:\Windows\System\iPdDnmv.exe
  C:\Windows\System\iPdDnmv.exe
  2⤵
  PID:9536
- C:\Windows\System\IHOFIxQ.exe
  C:\Windows\System\IHOFIxQ.exe
  2⤵
  PID:9552
- C:\Windows\System\lgpOsHC.exe
  C:\Windows\System\lgpOsHC.exe
  2⤵
  PID:9568
- C:\Windows\System\IZPhqhV.exe
  C:\Windows\System\IZPhqhV.exe
  2⤵
  PID:9584
- C:\Windows\System\oJdsPgm.exe
  C:\Windows\System\oJdsPgm.exe
  2⤵
  PID:9600
- C:\Windows\System\yaZWFoY.exe
  C:\Windows\System\yaZWFoY.exe
  2⤵
  PID:9616
- C:\Windows\System\eRSfYUS.exe
  C:\Windows\System\eRSfYUS.exe
  2⤵
  PID:9632
- C:\Windows\System\AGMMaaR.exe
  C:\Windows\System\AGMMaaR.exe
  2⤵
  PID:9648
- C:\Windows\System\PVBZvwh.exe
  C:\Windows\System\PVBZvwh.exe
  2⤵
  PID:9664
- C:\Windows\System\fGMTpan.exe
  C:\Windows\System\fGMTpan.exe
  2⤵
  PID:9680
- C:\Windows\System\sluWNEA.exe
  C:\Windows\System\sluWNEA.exe
  2⤵
  PID:9696
- C:\Windows\System\DDZUoDp.exe
  C:\Windows\System\DDZUoDp.exe
  2⤵
  PID:9712
- C:\Windows\System\gHKkNYB.exe
  C:\Windows\System\gHKkNYB.exe
  2⤵
  PID:9728
- C:\Windows\System\xhtBqpx.exe
  C:\Windows\System\xhtBqpx.exe
  2⤵
  PID:9744
- C:\Windows\System\sZPetKu.exe
  C:\Windows\System\sZPetKu.exe
  2⤵
  PID:9760
- C:\Windows\System\eXRmltm.exe
  C:\Windows\System\eXRmltm.exe
  2⤵
  PID:9776
- C:\Windows\System\pMFaOdy.exe
  C:\Windows\System\pMFaOdy.exe
  2⤵
  PID:9792
- C:\Windows\System\NkyZHtK.exe
  C:\Windows\System\NkyZHtK.exe
  2⤵
  PID:9808
- C:\Windows\System\yTbWyNi.exe
  C:\Windows\System\yTbWyNi.exe
  2⤵
  PID:9824
- C:\Windows\System\obISGMa.exe
  C:\Windows\System\obISGMa.exe
  2⤵
  PID:9840
- C:\Windows\System\oFTKZPT.exe
  C:\Windows\System\oFTKZPT.exe
  2⤵
  PID:9856
- C:\Windows\System\apmjLYP.exe
  C:\Windows\System\apmjLYP.exe
  2⤵
  PID:9872
- C:\Windows\System\vPiobmK.exe
  C:\Windows\System\vPiobmK.exe
  2⤵
  PID:9888
- C:\Windows\System\GTIYHPm.exe
  C:\Windows\System\GTIYHPm.exe
  2⤵
  PID:9904
- C:\Windows\System\PuzmudH.exe
  C:\Windows\System\PuzmudH.exe
  2⤵
  PID:9920
- C:\Windows\System\ylqjcQw.exe
  C:\Windows\System\ylqjcQw.exe
  2⤵
  PID:9936
- C:\Windows\System\zbNSEGF.exe
  C:\Windows\System\zbNSEGF.exe
  2⤵
  PID:9952
- C:\Windows\System\TBsmnyU.exe
  C:\Windows\System\TBsmnyU.exe
  2⤵
  PID:9968
- C:\Windows\System\yjDjIJQ.exe
  C:\Windows\System\yjDjIJQ.exe
  2⤵
  PID:9984
- C:\Windows\System\QlPMtQf.exe
  C:\Windows\System\QlPMtQf.exe
  2⤵
  PID:10000
- C:\Windows\System\SSBUIij.exe
  C:\Windows\System\SSBUIij.exe
  2⤵
  PID:10016
- C:\Windows\System\DJraWQe.exe
  C:\Windows\System\DJraWQe.exe
  2⤵
  PID:10032
- C:\Windows\System\UnKCeXE.exe
  C:\Windows\System\UnKCeXE.exe
  2⤵
  PID:10048
- C:\Windows\System\nhMhEsl.exe
  C:\Windows\System\nhMhEsl.exe
  2⤵
  PID:10064
- C:\Windows\System\ckUfrxk.exe
  C:\Windows\System\ckUfrxk.exe
  2⤵
  PID:10080
- C:\Windows\System\OXDnEop.exe
  C:\Windows\System\OXDnEop.exe
  2⤵
  PID:10096
- C:\Windows\System\meJXCWb.exe
  C:\Windows\System\meJXCWb.exe
  2⤵
  PID:10112
- C:\Windows\System\XStUSUB.exe
  C:\Windows\System\XStUSUB.exe
  2⤵
  PID:10128
- C:\Windows\System\ahsuIpw.exe
  C:\Windows\System\ahsuIpw.exe
  2⤵
  PID:10144
- C:\Windows\System\euTQqws.exe
  C:\Windows\System\euTQqws.exe
  2⤵
  PID:10160
- C:\Windows\System\WxLQJtm.exe
  C:\Windows\System\WxLQJtm.exe
  2⤵
  PID:10176
- C:\Windows\System\CLOSqSH.exe
  C:\Windows\System\CLOSqSH.exe
  2⤵
  PID:10192
- C:\Windows\System\SlUZzJI.exe
  C:\Windows\System\SlUZzJI.exe
  2⤵
  PID:10208
- C:\Windows\System\zAjGswL.exe
  C:\Windows\System\zAjGswL.exe
  2⤵
  PID:10224
- C:\Windows\System\GoUIZfC.exe
  C:\Windows\System\GoUIZfC.exe
  2⤵
  PID:8844
- C:\Windows\System\YwrGzxR.exe
  C:\Windows\System\YwrGzxR.exe
  2⤵
  PID:9268
- C:\Windows\System\bVxnEYn.exe
  C:\Windows\System\bVxnEYn.exe
  2⤵
  PID:9336
- C:\Windows\System\iXpFjQa.exe
  C:\Windows\System\iXpFjQa.exe
  2⤵
  PID:8440
- C:\Windows\System\hiLpgzu.exe
  C:\Windows\System\hiLpgzu.exe
  2⤵
  PID:9244
- C:\Windows\System\GVUqaru.exe
  C:\Windows\System\GVUqaru.exe
  2⤵
  PID:9284
- C:\Windows\System\BTyfzPU.exe
  C:\Windows\System\BTyfzPU.exe
  2⤵
  PID:9348
- C:\Windows\System\kZEiWUA.exe
  C:\Windows\System\kZEiWUA.exe
  2⤵
  PID:8988
- C:\Windows\System\wsbUrWQ.exe
  C:\Windows\System\wsbUrWQ.exe
  2⤵
  PID:9196
- C:\Windows\System\kCGxSaQ.exe
  C:\Windows\System\kCGxSaQ.exe
  2⤵
  PID:9380
- C:\Windows\System\dgebZxu.exe
  C:\Windows\System\dgebZxu.exe
  2⤵
  PID:9396
- C:\Windows\System\cTajtad.exe
  C:\Windows\System\cTajtad.exe
  2⤵
  PID:9460
- C:\Windows\System\WpdzeUI.exe
  C:\Windows\System\WpdzeUI.exe
  2⤵
  PID:9528
- C:\Windows\System\DpHgHZS.exe
  C:\Windows\System\DpHgHZS.exe
  2⤵
  PID:9564
- C:\Windows\System\QbhRhUD.exe
  C:\Windows\System\QbhRhUD.exe
  2⤵
  PID:9444
- C:\Windows\System\eHoqgZT.exe
  C:\Windows\System\eHoqgZT.exe
  2⤵
  PID:9480
- C:\Windows\System\AYjBNZq.exe
  C:\Windows\System\AYjBNZq.exe
  2⤵
  PID:9512
- C:\Windows\System\xIUauFF.exe
  C:\Windows\System\xIUauFF.exe
  2⤵
  PID:9628
- C:\Windows\System\KyWDuxu.exe
  C:\Windows\System\KyWDuxu.exe
  2⤵
  PID:9640
- C:\Windows\System\PMYAiee.exe
  C:\Windows\System\PMYAiee.exe
  2⤵
  PID:9688
- C:\Windows\System\MwwNxhn.exe
  C:\Windows\System\MwwNxhn.exe
  2⤵
  PID:9720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BAGCyRI.exe

Filesize
1.4MB

MD5
cc956e0ac7e9f2743495a22b0cdb25b7

SHA1
fa5211d447c7761ae8a4ea7423b22354068b4c0c

SHA256
17ebb0241b0960dca0117a17f3e737373af16b5decb49d6f435f6d38728e442b

SHA512
14f9e8c365960ebda46803fa4d5ab263f235d34fb3c6bbb0e71487479842f5a7ec8d53abc2e36eb6ac9bab858ddb885fca312dcceed7387b1b8a81268e97aca6

Download Submit
C:\Windows\system\BqLeZJn.exe

Filesize
1.4MB

MD5
2ad6f0c40c04b27d79d85d3f5e94a25d

SHA1
fbc3eb848167fd6af29865f15d1fe0199bf05185

SHA256
b5bea60009c276f47905a7a9eb39a94504b6f076c2ee1b7bed7d50d8b882ff2e

SHA512
41ae58eb1da774a894474f92abe66a4f81ec2068ae86ae0b4fc5c7b0580f2819c393f8dbe6f440e469bcd66797df9b197e8323695f19dc3262f753463dc39084

Download Submit
C:\Windows\system\CemPKcV.exe

Filesize
1.4MB

MD5
3cbe81016056564e1db100d459ba5ea4

SHA1
60457ac12d18e9f5277e55c0aca7016305d4c5ec

SHA256
31d810e07a7ddcd503a62a935893951f8259f2cc76a3c8774913be606a366769

SHA512
11d0d746e953e39a7eade69c6cd78945692aedf2d91062608b5cb6c2d4c89707b6351e7e6bbe23e01d139eed4a63e210a8f807afe0409bafdd490027124e192a

Download Submit
C:\Windows\system\CfbNcuO.exe

Filesize
1.4MB

MD5
11734f41f362d55ddb435f2ea1058c8c

SHA1
555071e50c9fa80dbe1067d4389a35b621de46d8

SHA256
47848cb34d24fa140af1c2cdc0b13d25adcaa64277d7ae32ada7d5ffc1aeca37

SHA512
9818c99b4c64cd64f1f4bc57f276f4fb9807c4a0bfcaa93dde2fed948bd5a0905914a5658e95ee8db5b8d932102897357536d41d23eeabc34bdf76cc379d89b1

Download Submit
C:\Windows\system\JdFjhHo.exe

Filesize
1.4MB

MD5
c1a95d1539883e28ba7a43d402409b14

SHA1
1379b5bcba56fd7aae4f5b9b0ea4f799af9b313c

SHA256
ca88f95d1fb0fae361d095494bcc01f39e356a1b1fa7b6d023f4386b791ce774

SHA512
6c50f89bfa0af01d39295e610c693b255286c6fda624e0c334ad647a5cdc573dcb1337ec20a279e88401071e2bce739d91b07967024b6ca889f5b743e0026ae4

Download Submit
C:\Windows\system\LOCgcDU.exe

Filesize
1.4MB

MD5
77253ab29aea479839ca13682fbf1593

SHA1
68c85c397699a02c38880f96bc3cc176bafcd4a7

SHA256
f0f1009432d63803c19f4372429302d2ec9063e292b9ab6f9fd8a999d7d21d6a

SHA512
16e68523f728e9668f6f9dad056e653b9efbbb8a24faed25c777cb8177c92a3fda45d89b57e4609de361b0c8bf52323ca4916cfbd8d4dae3df546244321278af

Download Submit
C:\Windows\system\LlcRgVJ.exe

Filesize
1.4MB

MD5
59cf840fed90b401415997c8c11853e4

SHA1
5c5debd2d5fc977934d6e75f27302866c05a1449

SHA256
baab7da2fd0b81e3ec3143a548a8ed822273bedcff956f9707944ab9666183ef

SHA512
54edb1e0b8e747e97d79edd0e620f6fc24ca19bfeaac78cb7478bb6a15312903be0b7174c779800c7b3e94488a7d9dd109b07a223e3e75e3bca9d5c5fafbc43d

Download Submit
C:\Windows\system\PGpmVqx.exe

Filesize
1.4MB

MD5
a85d49c8c6d4f2e9aaac4d4b9e1234e1

SHA1
505a122ffb4a59fef9431e157e8d2c688368acd6

SHA256
249a5d2205f93f36d1fb5927638ca783f21ae37d8dae213121177936a9b8dc9b

SHA512
ef3e9c9192fa1fbdfc267e274e6c4732d6f68ed4405c04b1d4f85e2f794768a7f7423936ccd77cf8599857d9c463c1203ff5e55b085106926eb5cdf8ce96543c

Download Submit
C:\Windows\system\PslSATs.exe

Filesize
1.4MB

MD5
f15ff02d037628b19951f8e97a1a8f4e

SHA1
bb6f3fc98b68d1a6c663ace9ff533ab87be5c3b4

SHA256
4bfb1571b330ce200bff7015448fc92fd8cda8d8ce548def45797b99f5703680

SHA512
9972534d2991cb9cc868285e3c61965281b9848ed26717d0cd889f62ba8b81e158a8de3e39e93907654bd3cf11412912d4be1eb3465fc782899f4c1cba716038

Download Submit
C:\Windows\system\RCUFlfk.exe

Filesize
1.4MB

MD5
95e7aa8f3877b1ed958a8f98d426e75e

SHA1
488edceaf474ae6ef66a5b09af0819440c73bda0

SHA256
e60d5e9b3e680df0a76862361091d2a4cd0942fdf07d9e901b13c7500c2cc610

SHA512
8686d70477b0ef705203f2867a864cbb58d1b2e88a467b413c1f37775a488d1f2dbe25c47f8940c2ae7b303c62aa4dfc7c728313ad9c2f65a3ad0070866189b6

Download Submit
C:\Windows\system\RyUlasH.exe

Filesize
1.4MB

MD5
243f0d662521e4118a614f64dfd297d5

SHA1
3f7627f0d639017384aaca7ac0ac25ecb5ea0dc3

SHA256
182eb3a42b53d3e73faedc4c894dafcf0d67e52dacca4c775951969aeb39cad0

SHA512
3f0973c90b3bc450f0aca33a251f8baa82945a8d6bb145bafe45c4194df17dce944b8105ca101b4942e359099a3b62f842f43dcbc8471f857b1bc14d723e7c8e

Download Submit
C:\Windows\system\SCdYFfn.exe

Filesize
1.4MB

MD5
c9c71d29b21b79095be3e743217b66b3

SHA1
604c14e5fe08caa6e5e2f17b70ae5e3fb6ec7811

SHA256
fd5ae624512c040efdaabb9dd6d04edf990afda763643f8c84fdf75089a014b9

SHA512
014012ac326dff3f4bdf974455b7adfbb7278676d405a53857994a6ebcc6840e18baea3bd2545bdc16cbe3e9dc0aca715bb47315cccf1818d2ac486de95fffc8

Download Submit
C:\Windows\system\SOaZyUn.exe

Filesize
1.4MB

MD5
71bb29cd92bca91111203572545ba150

SHA1
0ad90c004cc81fdeda6ce1b8f4123f7c6c4671e1

SHA256
49b6e26ed4ef3c1253b30e4f371a192b48f2ce14ee7556b740d779ec00b103fa

SHA512
fcdbd131b8051b7d8287be9356cecb479142ecd1051e993a93528abba8a786d96a7d097e5ff815a0e0750cfc475b7033c942ea038e65bfc030a980b2c8aa7dfc

Download Submit
C:\Windows\system\SzulOyz.exe

Filesize
1.4MB

MD5
e152ef38ffc684d4e7e95753246fea69

SHA1
4e60c54b1f00ca96c84c809e08fa86724f963ab6

SHA256
d1fa590e112554f7b3984c2ef60898c2989b2adade59954ddf1607280ffc27b3

SHA512
23d03a371cddbc15848b30cad7ace94c723094130d630fadfd2dfaba2ed24561567747ed634f20e0db19eab8f58c5d2973cb0a9db8287bc2182a7cd6b64a4363

Download Submit
C:\Windows\system\VUAJbiI.exe

Filesize
1.4MB

MD5
41b52d47f14d8b6dc3f78cff36c78f2c

SHA1
a95aa926f618741d849f84f6bcff3aff727595cc

SHA256
74a55279b52f4416b78d96093e32546eb13037a6732242a7ecfbe8fa22c55b04

SHA512
090f564e4d68a340f873fe63e634e1ba35e1827305f649a1330cb795ed785cdc6d8834871f60ff1bd6983917480fd74b531cb5067c993f0cb7eb0e9c9643dbc3

Download Submit
C:\Windows\system\YgwEkvU.exe

Filesize
1.4MB

MD5
f88a2bb0aeaee6b24160aa24a2b9d00c

SHA1
a3aa9d2eb1cc22b82ff31af7caa4d0fa3cf57293

SHA256
737207d53b04373b0b37c0389f925cd594f6f4d08806b974f034c13246d64df7

SHA512
9116f7016c5c68a0571e3719cfa8586c4cce52ab13cb91b0c074e29da8e6713bbf5714ae795b060160a0993194b3b046a3e70ddb72f006973ead3da569776cf4

Download Submit
C:\Windows\system\dRdSbLG.exe

Filesize
1.4MB

MD5
68194e50fe1b805558347c17b8b52bdd

SHA1
de3895a23f8dd7fe6bdb07c82fcc038ed7b920f0

SHA256
2abfc2574bc6dbc41c7641fe6dfa8db6b1a6699324e66c0bb6999413bc0c2461

SHA512
ccd96ef4edea149a0b351a36d65746b7cdc8c1ee078c0fc877b5b121fe46bb4b89e9adc310f45e2d892d8a64b222c868de6c257a872ab20ef32aeb98edf9533a

Download Submit
C:\Windows\system\dcanJfL.exe

Filesize
1.4MB

MD5
b7a690c69985c91b305e15f59248fdc4

SHA1
e8a8e8078995f658feeb2daba7156833cc68ade5

SHA256
57714a01bf0f54b4b68ac8b843340e6c55d769b6da706c24683833ccf9c11d07

SHA512
306208874f38798fd6ab7d2106e139b2380be2d98a3d5ce582e78dd12ab0c0d500f2e3045929fd7a875b207a426c1f8d0157e414b98ea7aeaf58b9f15474d843

Download Submit
C:\Windows\system\dkDOIuU.exe

Filesize
1.4MB

MD5
377dd50bca60ab9873ba176e4e5f516d

SHA1
82f48281df836226f66c28853424cb9fb96ffcb0

SHA256
6daf0caeb4b15352406aec78c2d66898eb28de35da5441489fbe292e2dd1d4f2

SHA512
2c5b72c2d12f19d87b0a7271291823def122ae6a1d2c14b12196132697988e4ce3f4a8d3ac418b13174628e8d4e071b37bc7771a154d54f01b87d3b7e74f874e

Download Submit
C:\Windows\system\fHecCYc.exe

Filesize
1.4MB

MD5
309f91c610e5565f9863bebb99cdf1fe

SHA1
6e2c4c9c3a127ba5f2bb418717d2b13fa38ce196

SHA256
25c4a5c863b4746f56ea0717401921464686c602ea4aaa0126d88e24d753cdcc

SHA512
e51c0aff71819982c5b4baeef4274e5dcaaaf2e0d7982e7f3a1a788c6f7dd14e911fd2b1274f0d9a5413ecef41eec509d17457802cf14bcc7bc0f70c140d2f81

Download Submit
C:\Windows\system\gCqCQpT.exe

Filesize
1.4MB

MD5
d64b42ed6441636e11d6e01e53668474

SHA1
a2ac818363017695e75e245dab97f299b06e79f9

SHA256
13e8c758760a02bddc8442a7bfa8df3f219a0e82f84492b068e7ef202a0cdd71

SHA512
26582c0a3fa7f9aa0d6a707c4c1b18ad8a7fab0fd68d9dbb3357d435b9dfaa94ab7a683d1d6c0bff9f2bf50589a46be0c9d1a88d1000deee6cbfb1ae842c1c82

Download Submit
C:\Windows\system\gPkyKNo.exe

Filesize
1.4MB

MD5
9ff152d845b44fc5cdd1e5486c0be8d8

SHA1
0783a9cc266f5ebca5618f54113aaee14bd022e4

SHA256
e394ccabe4446b3aac4fa2c3ada8e23b89321b5d73cb81ef99d25fff22ec5e18

SHA512
ca3597bc74ae867112c6b2345cc7e7ee6bd175895784fd38fbbf8b75a7ed8bf5a77731e49ae80aba760b492266b6a8043010a27dd2a67f2e32b44c51f9a45445

Download Submit
C:\Windows\system\iiTRHNB.exe

Filesize
1.4MB

MD5
fb777a38bb97b141ef299925fbed1106

SHA1
b1f1919b40f7b8cf392d051a53c22cc6784257d5

SHA256
b9d2f6a97b03ccfa69794fb49c400758ce009708d5a87b24221c90b28671171e

SHA512
b768b1593c6a768e3f4b03b5bad322ff98adb92bf357c1ec19f01cb9ed2b6fabd8e1808978e38d2d4823b92c4936aa0ff445d3095790f31d2ba94de9bbe6c016

Download Submit
C:\Windows\system\mKAoXwS.exe

Filesize
1.4MB

MD5
9dfa2d47a0e593fb3885091ba9ddec1c

SHA1
232d0eef80ba51bf20888fda313f969b1541152d

SHA256
43d8c52c67254a4e06bc1c26976cc086e7fd6e964a5ef7926f74cb9139e9de7b

SHA512
caa8038a943a7d78609c8d37e664c7154a3e6efd20693301792867a26d4fa41c16939521ed78769a2026406f7003eb637f7af65cd3f27896f8279035e84bcda0

Download Submit
C:\Windows\system\prwTFhi.exe

Filesize
1.4MB

MD5
c812d5f36a6f7b21ff1de6697b7ecd79

SHA1
2cbe52427a424c46d27e65344779fb028d3b62de

SHA256
b3f9489bf419a08058b787997d1d3b8e1650da5cd1deb822e229cfc5d3e3ccb4

SHA512
aa57711873f715e7fc93148affb09ed421c25a74b07520cf7c37812d1568b630276121982f24d737fa4e88730367526c72b147a720269f653aaaf24622065e0d

Download Submit
C:\Windows\system\qDsmXwc.exe

Filesize
1.4MB

MD5
63cf4bff52fa50a5fd1a33bc5164443c

SHA1
3111760fb119eebbd2238802b9ced6aa165eb757

SHA256
3ce097be09a22f1363719af2263cbc3a097d16a91c0cb86b8cca069ce46bacbb

SHA512
e459a2e1891382696a6e3fb1e6f436a3c16601aeb4cbf52e56529fd46da35a5c167da170e477387a13675d619261eddd4973fce8af5be75ae6aa4985afe50248

Download Submit
C:\Windows\system\tGYtNhF.exe

Filesize
1.4MB

MD5
d9f7c8a27615e21e0d01a3050dbb31e3

SHA1
73a3adca1fc13a29218e3e1876bf8ee02d421789

SHA256
df5dc1668251f882356a8ece7b2fb305eb54f51651db09ff23118e8d4f0f21cc

SHA512
65f16d56534453d156b7b411d178f204d31873ccb4df971ce2a8d3a189c92ef0c8e6d121f21c202b30d29100dd9d220ad7c746698a54754bf1547a25c4331e2f

Download Submit
C:\Windows\system\wItxMZr.exe

Filesize
1.4MB

MD5
d727a626705dc90aa1fa4a73c68e6c20

SHA1
50834b731ccd0d330f3df0c815fe51be705b1e04

SHA256
abd85df49be0c108a588b46b843aecf50b128622266107e89aba48dc52208995

SHA512
e53533b5a6cf61ae8eabb028c7832aa5f6df4bf4f882aa1bc528c2c73fbfb18b839d9ef97123a537b065f0b9f74fb42bf68a26cdd482ff5c6b2bf242a2a334d0

Download Submit
C:\Windows\system\xhgBRNa.exe

Filesize
1.4MB

MD5
a8fdddd8be5736f8e009312a81c2bbeb

SHA1
03ce526ff25a63ce19af7696680650cdb1ece027

SHA256
ecd95e0af3787db8ff7cba1263712a49b247a2be02658ce5e8429e872fc7b53c

SHA512
b14933db6333c8eb2ed23a917e6f48147e39e158f758a017154e422c9f1ae68cba454ef0702403c425fc8129ddf9629505210793e380d62cde808f7ae7bdd751

Download Submit
C:\Windows\system\ynZsIkg.exe

Filesize
1.4MB

MD5
322c1b6d06dd4cbcc196be03632ab0ec

SHA1
350cc045359bd5727985640a010b63192418c8ab

SHA256
875f2be00625a46bfc59520e52e9cdd8642fd2fa70466f8e30b40deacafee55f

SHA512
954f78944b4099875909a4087804c944b5bb038c8e24b97839671ee94f215ec8ca85ba8e10cf5dd96d9057a1f3716928aa874c080a60b70f7e82d7f43521b341

Download Submit
C:\Windows\system\zGPTQHt.exe

Filesize
1.4MB

MD5
007d42cfb178877a49d8a7a738fdb408

SHA1
88c88f25ac0a42baa6f4906fe5ee7a4cf7924ed0

SHA256
cc8cfe70db47c8bdee1f4f879b3817362d55f1a0cc9544a1212181985ce0c4af

SHA512
17037ec05b94ae1ee7279c8c511f990ae8f438fb7a94c688a1b403ef0411552af50d5e3c0fcedfaa1aa4b9678d8aa418d3c11833e951a0a72e1d09a18109afaa

Download Submit
\Windows\system\PqwSIUU.exe

Filesize
1.4MB

MD5
f30899bcb94a94b912632b88781135e2

SHA1
e3e904a1145cb03e496e60ec7ac0ab0165216a66

SHA256
5faed31ec81ac241a2aa54e5a85b0e6cbfdb8374ab32968945d4f803bac16d74

SHA512
e869ceccd22fdd4e3b5e22c261c0ebebfbbc5432750c22a5a625d67977ead5c33a9b59f705e1261e3fc913af15765b67d55b8dab5b04de33e956727be5442073

Download Submit
memory/2228-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download