xmrig | 299cf7a50745b91f99e64d88c0f7109977d055302b639f9b4ccb34722e248914

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_99e49ed4601d256f09cff799de839ce0.exe
Size

1.5MB
MD5

99e49ed4601d256f09cff799de839ce0
SHA1

6ccd029e49929244c8cc28de4d6969ab7619017c
SHA256

299cf7a50745b91f99e64d88c0f7109977d055302b639f9b4ccb34722e248914
SHA512

4471f8a22d031b27fb33584885307ab123d57dbfb9837f2221c1d06cb2f565fd5e3f8d53e139e238e1f18f1bfa64363c612def23bbe615b04ec51689df505467
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbfCuZXejQ7:Lz071uv4BPMkHC0IlnASEx/mCuZOjQ7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2872-10-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2616-20-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/1092-214-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2436-187-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/1036-205-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2392-184-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2816-194-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2568-181-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2644-179-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2244-178-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2688-176-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2804-191-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2528-174-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2616-3875-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2568-3873-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2872-3881-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2392-3965-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2528-3969-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2436-4072-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2688-4073-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2644-4032-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2804-3970-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2816-4071-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/1036-3968-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/1092-3967-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2872	XhhxIdv.exe
2616	zbapWUO.exe
2528	PYzuRzA.exe
2688	VklsftI.exe
2644	FDDSUZY.exe
2568	aQYNbKR.exe
2392	JRADHSY.exe
2436	aWVxujY.exe
2804	lDSIzxD.exe
2816	yCdWOmy.exe
1036	ePFVNlD.exe
1092	rcYhLVB.exe
1640	oSUbMen.exe
1972	aFFaFVj.exe
1856	caEiMlH.exe
1812	HriWkMA.exe
1844	jmfshim.exe
2664	cnDyJHr.exe
1468	VNYUuZQ.exe
1820	lkRRGnc.exe
1204	TyQoftm.exe
1948	ITfuTIF.exe
2340	XRBVgCr.exe
2180	eIbCvrx.exe
936	MKVnqTA.exe
2168	hdVpEPU.exe
1792	BnpvtMd.exe
1500	QRLrGdn.exe
1048	XkWVGpP.exe
2292	RuIdldF.exe
2140	qBxXzIM.exe
2920	Irigkxs.exe
432	kewGzeM.exe
2040	YOkVlyB.exe
976	ciyiZus.exe
828	rQrfZOZ.exe
792	vjtctkz.exe
900	XlgjlJq.exe
1588	OIDPgEm.exe
1016	OGKoVUO.exe
816	ngAgkFP.exe
1244	helKBrT.exe
616	lZxOAZC.exe
2892	bqgjdnV.exe
948	qgnCTAf.exe
2236	JlImFbv.exe
1688	SZQjHYR.exe
2900	fjKEoZa.exe
804	IXgMalW.exe
3000	rvsmikM.exe
1568	abzzqHA.exe
1912	LLeQgxz.exe
1644	BMKRSEG.exe
1576	ZIBvYqX.exe
1608	JTXuxrZ.exe
2600	wvbegAu.exe
2744	ZfueBdv.exe
2560	cQOleFh.exe
2704	yWkJurg.exe
2448	YVrOfkZ.exe
2508	NXQSKyJ.exe
2988	cBjdwkq.exe
548	MtdvteW.exe
628	jINWNQo.exe

Loads dropped DLL 64 IoCs

pid	Process
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-1-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x0009000000015c5d-6.dat	upx
behavioral1/memory/2872-10-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/files/0x0027000000015d88-11.dat	upx
behavioral1/files/0x0007000000015e6f-13.dat	upx
behavioral1/memory/2616-20-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-31.dat	upx
behavioral1/files/0x0008000000015e7c-36.dat	upx
behavioral1/files/0x0009000000015ec0-40.dat	upx
behavioral1/files/0x0007000000016c23-45.dat	upx
behavioral1/files/0x0006000000018b42-50.dat	upx
behavioral1/files/0x0006000000018b4a-55.dat	upx
behavioral1/files/0x0006000000018b6a-60.dat	upx
behavioral1/files/0x0006000000018b96-70.dat	upx
behavioral1/files/0x0006000000018d06-80.dat	upx
behavioral1/files/0x00050000000192f4-90.dat	upx
behavioral1/files/0x0005000000019333-100.dat	upx
behavioral1/files/0x00050000000193b0-120.dat	upx
behavioral1/files/0x0005000000019485-144.dat	upx
behavioral1/files/0x00040000000194d6-153.dat	upx
behavioral1/files/0x00050000000194a4-148.dat	upx
behavioral1/files/0x0005000000019473-140.dat	upx
behavioral1/files/0x00040000000194d8-160.dat	upx
behavioral1/memory/1092-214-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2436-187-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/1036-205-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2392-184-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x00040000000194dc-183.dat	upx
behavioral1/memory/2816-194-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2568-181-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2644-179-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2688-176-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2804-191-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2528-174-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0016000000015db4-166.dat	upx
behavioral1/files/0x000500000001946b-130.dat	upx
behavioral1/files/0x000500000001946f-134.dat	upx
behavioral1/files/0x0005000000019410-125.dat	upx
behavioral1/files/0x0005000000019377-111.dat	upx
behavioral1/files/0x000500000001939b-114.dat	upx
behavioral1/files/0x0005000000019368-104.dat	upx
behavioral1/files/0x000500000001931b-95.dat	upx
behavioral1/files/0x00050000000192c9-85.dat	upx
behavioral1/files/0x0006000000018ba2-75.dat	upx
behavioral1/files/0x0006000000018b73-65.dat	upx
behavioral1/memory/2616-3875-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2568-3873-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2872-3881-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2392-3965-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2528-3969-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2436-4072-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2688-4073-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2644-4032-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2804-3970-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2816-4071-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/1036-3968-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/1092-3967-0x000000013F120000-0x000000013F512000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zkubqEj.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\FRGqQEQ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gxoLIxO.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\yigOBPS.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ViBmXGe.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\rXivQUB.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\nuMeDRk.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\cmYHapr.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\MKVnqTA.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\WQWHcUz.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\tNtZgVe.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\aBPERwx.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\csPeMea.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\mglkOZC.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\DEQfnxz.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\qczdALZ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\LXMtoaM.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\tsOIOJr.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\fLOjKau.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\VNBfbAy.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\muDQYAP.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\PCyACvI.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\newaqJF.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\auIuuJf.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\RXVJKWi.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\MtdvteW.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\rGGhfkG.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\dMAZVBJ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\mcQGwoH.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\Ewkilif.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\Zqpzbal.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\oJrrbUr.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\OrJsLwq.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\hZrzVag.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\iwYsBiq.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\GmhCDor.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\WMMnaBj.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gkMMLJo.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ciXWiva.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\Shpgwhc.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ILSfpRf.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\TqlHgbG.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\pMHiDtr.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\FCzydTS.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\EWbIgVU.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\zcaOCFl.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\EVUqiFV.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\VjhVgVJ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\BeDbgjJ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\isSlHPY.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\LVtPfgq.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\KulkGRV.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\DsLxtLV.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\mMWPaNe.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\vbbiqNg.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\yVQnTqY.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\LxXyRks.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\XbZnQLu.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\lBiReax.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gEQkAyC.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\cYdEAOR.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\OGKoVUO.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\GApcxcm.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\EHEoRvs.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeLockMemoryPrivilege	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2984	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	29
PID 2244 wrote to memory of 2984	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	29
PID 2244 wrote to memory of 2984	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	29
PID 2244 wrote to memory of 2872	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	30
PID 2244 wrote to memory of 2872	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	30
PID 2244 wrote to memory of 2872	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	30
PID 2244 wrote to memory of 2616	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	31
PID 2244 wrote to memory of 2616	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	31
PID 2244 wrote to memory of 2616	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	31
PID 2244 wrote to memory of 2528	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	32
PID 2244 wrote to memory of 2528	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	32
PID 2244 wrote to memory of 2528	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	32
PID 2244 wrote to memory of 2688	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	33
PID 2244 wrote to memory of 2688	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	33
PID 2244 wrote to memory of 2688	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	33
PID 2244 wrote to memory of 2644	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	34
PID 2244 wrote to memory of 2644	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	34
PID 2244 wrote to memory of 2644	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	34
PID 2244 wrote to memory of 2568	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	35
PID 2244 wrote to memory of 2568	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	35
PID 2244 wrote to memory of 2568	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	35
PID 2244 wrote to memory of 2392	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	36
PID 2244 wrote to memory of 2392	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	36
PID 2244 wrote to memory of 2392	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	36
PID 2244 wrote to memory of 2436	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	37
PID 2244 wrote to memory of 2436	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	37
PID 2244 wrote to memory of 2436	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	37
PID 2244 wrote to memory of 2804	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	38
PID 2244 wrote to memory of 2804	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	38
PID 2244 wrote to memory of 2804	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	38
PID 2244 wrote to memory of 2816	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	39
PID 2244 wrote to memory of 2816	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	39
PID 2244 wrote to memory of 2816	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	39
PID 2244 wrote to memory of 1036	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	40
PID 2244 wrote to memory of 1036	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	40
PID 2244 wrote to memory of 1036	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	40
PID 2244 wrote to memory of 1092	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	41
PID 2244 wrote to memory of 1092	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	41
PID 2244 wrote to memory of 1092	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	41
PID 2244 wrote to memory of 1640	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	42
PID 2244 wrote to memory of 1640	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	42
PID 2244 wrote to memory of 1640	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	42
PID 2244 wrote to memory of 1972	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	43
PID 2244 wrote to memory of 1972	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	43
PID 2244 wrote to memory of 1972	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	43
PID 2244 wrote to memory of 1856	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	44
PID 2244 wrote to memory of 1856	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	44
PID 2244 wrote to memory of 1856	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	44
PID 2244 wrote to memory of 1812	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	45
PID 2244 wrote to memory of 1812	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	45
PID 2244 wrote to memory of 1812	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	45
PID 2244 wrote to memory of 1844	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	46
PID 2244 wrote to memory of 1844	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	46
PID 2244 wrote to memory of 1844	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	46
PID 2244 wrote to memory of 2664	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	47
PID 2244 wrote to memory of 2664	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	47
PID 2244 wrote to memory of 2664	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	47
PID 2244 wrote to memory of 1468	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	48
PID 2244 wrote to memory of 1468	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	48
PID 2244 wrote to memory of 1468	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	48
PID 2244 wrote to memory of 1820	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	49
PID 2244 wrote to memory of 1820	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	49
PID 2244 wrote to memory of 1820	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	49
PID 2244 wrote to memory of 1204	2244	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_99e49ed4601d256f09cff799de839ce0.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_99e49ed4601d256f09cff799de839ce0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System\XhhxIdv.exe
  C:\Windows\System\XhhxIdv.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\zbapWUO.exe
  C:\Windows\System\zbapWUO.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\PYzuRzA.exe
  C:\Windows\System\PYzuRzA.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\VklsftI.exe
  C:\Windows\System\VklsftI.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FDDSUZY.exe
  C:\Windows\System\FDDSUZY.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\aQYNbKR.exe
  C:\Windows\System\aQYNbKR.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JRADHSY.exe
  C:\Windows\System\JRADHSY.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\aWVxujY.exe
  C:\Windows\System\aWVxujY.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\lDSIzxD.exe
  C:\Windows\System\lDSIzxD.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\yCdWOmy.exe
  C:\Windows\System\yCdWOmy.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ePFVNlD.exe
  C:\Windows\System\ePFVNlD.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\rcYhLVB.exe
  C:\Windows\System\rcYhLVB.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\oSUbMen.exe
  C:\Windows\System\oSUbMen.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\aFFaFVj.exe
  C:\Windows\System\aFFaFVj.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\caEiMlH.exe
  C:\Windows\System\caEiMlH.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\HriWkMA.exe
  C:\Windows\System\HriWkMA.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\jmfshim.exe
  C:\Windows\System\jmfshim.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\cnDyJHr.exe
  C:\Windows\System\cnDyJHr.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\VNYUuZQ.exe
  C:\Windows\System\VNYUuZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\lkRRGnc.exe
  C:\Windows\System\lkRRGnc.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\TyQoftm.exe
  C:\Windows\System\TyQoftm.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\ITfuTIF.exe
  C:\Windows\System\ITfuTIF.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\XRBVgCr.exe
  C:\Windows\System\XRBVgCr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\eIbCvrx.exe
  C:\Windows\System\eIbCvrx.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\MKVnqTA.exe
  C:\Windows\System\MKVnqTA.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\hdVpEPU.exe
  C:\Windows\System\hdVpEPU.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\BnpvtMd.exe
  C:\Windows\System\BnpvtMd.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\XkWVGpP.exe
  C:\Windows\System\XkWVGpP.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\QRLrGdn.exe
  C:\Windows\System\QRLrGdn.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\RuIdldF.exe
  C:\Windows\System\RuIdldF.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\qBxXzIM.exe
  C:\Windows\System\qBxXzIM.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\Irigkxs.exe
  C:\Windows\System\Irigkxs.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\kewGzeM.exe
  C:\Windows\System\kewGzeM.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\OIDPgEm.exe
  C:\Windows\System\OIDPgEm.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\YOkVlyB.exe
  C:\Windows\System\YOkVlyB.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\OGKoVUO.exe
  C:\Windows\System\OGKoVUO.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\ciyiZus.exe
  C:\Windows\System\ciyiZus.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\ngAgkFP.exe
  C:\Windows\System\ngAgkFP.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\rQrfZOZ.exe
  C:\Windows\System\rQrfZOZ.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\helKBrT.exe
  C:\Windows\System\helKBrT.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\vjtctkz.exe
  C:\Windows\System\vjtctkz.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\lZxOAZC.exe
  C:\Windows\System\lZxOAZC.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\XlgjlJq.exe
  C:\Windows\System\XlgjlJq.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\bqgjdnV.exe
  C:\Windows\System\bqgjdnV.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\qgnCTAf.exe
  C:\Windows\System\qgnCTAf.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\JlImFbv.exe
  C:\Windows\System\JlImFbv.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SZQjHYR.exe
  C:\Windows\System\SZQjHYR.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\fjKEoZa.exe
  C:\Windows\System\fjKEoZa.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\IXgMalW.exe
  C:\Windows\System\IXgMalW.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\rvsmikM.exe
  C:\Windows\System\rvsmikM.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\abzzqHA.exe
  C:\Windows\System\abzzqHA.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\LLeQgxz.exe
  C:\Windows\System\LLeQgxz.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\BMKRSEG.exe
  C:\Windows\System\BMKRSEG.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZIBvYqX.exe
  C:\Windows\System\ZIBvYqX.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\JTXuxrZ.exe
  C:\Windows\System\JTXuxrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wvbegAu.exe
  C:\Windows\System\wvbegAu.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ZfueBdv.exe
  C:\Windows\System\ZfueBdv.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\yWkJurg.exe
  C:\Windows\System\yWkJurg.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\cQOleFh.exe
  C:\Windows\System\cQOleFh.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\NXQSKyJ.exe
  C:\Windows\System\NXQSKyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YVrOfkZ.exe
  C:\Windows\System\YVrOfkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\cBjdwkq.exe
  C:\Windows\System\cBjdwkq.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\MtdvteW.exe
  C:\Windows\System\MtdvteW.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\jINWNQo.exe
  C:\Windows\System\jINWNQo.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\WYuJkFG.exe
  C:\Windows\System\WYuJkFG.exe
  2⤵
  PID:1308
- C:\Windows\System\BfSbkzm.exe
  C:\Windows\System\BfSbkzm.exe
  2⤵
  PID:2648
- C:\Windows\System\YrzMwRi.exe
  C:\Windows\System\YrzMwRi.exe
  2⤵
  PID:1060
- C:\Windows\System\UxvWTkS.exe
  C:\Windows\System\UxvWTkS.exe
  2⤵
  PID:1988
- C:\Windows\System\RJuIfRm.exe
  C:\Windows\System\RJuIfRm.exe
  2⤵
  PID:1480
- C:\Windows\System\liOFFba.exe
  C:\Windows\System\liOFFba.exe
  2⤵
  PID:2336
- C:\Windows\System\QcvptPy.exe
  C:\Windows\System\QcvptPy.exe
  2⤵
  PID:1220
- C:\Windows\System\VvVtPPU.exe
  C:\Windows\System\VvVtPPU.exe
  2⤵
  PID:1636
- C:\Windows\System\gJwfzlR.exe
  C:\Windows\System\gJwfzlR.exe
  2⤵
  PID:2112
- C:\Windows\System\AnQyQbW.exe
  C:\Windows\System\AnQyQbW.exe
  2⤵
  PID:3020
- C:\Windows\System\bsQPSLp.exe
  C:\Windows\System\bsQPSLp.exe
  2⤵
  PID:2388
- C:\Windows\System\iFarROp.exe
  C:\Windows\System\iFarROp.exe
  2⤵
  PID:2052
- C:\Windows\System\vxAAQhv.exe
  C:\Windows\System\vxAAQhv.exe
  2⤵
  PID:2408
- C:\Windows\System\FUvlJJS.exe
  C:\Windows\System\FUvlJJS.exe
  2⤵
  PID:2432
- C:\Windows\System\eReJDIi.exe
  C:\Windows\System\eReJDIi.exe
  2⤵
  PID:2012
- C:\Windows\System\IrPJCGy.exe
  C:\Windows\System\IrPJCGy.exe
  2⤵
  PID:2960
- C:\Windows\System\TIndNom.exe
  C:\Windows\System\TIndNom.exe
  2⤵
  PID:2964
- C:\Windows\System\uGlcORE.exe
  C:\Windows\System\uGlcORE.exe
  2⤵
  PID:1704
- C:\Windows\System\xJhcadh.exe
  C:\Windows\System\xJhcadh.exe
  2⤵
  PID:2032
- C:\Windows\System\cKQxsDW.exe
  C:\Windows\System\cKQxsDW.exe
  2⤵
  PID:2544
- C:\Windows\System\vKgeXXY.exe
  C:\Windows\System\vKgeXXY.exe
  2⤵
  PID:1296
- C:\Windows\System\UwRWJQU.exe
  C:\Windows\System\UwRWJQU.exe
  2⤵
  PID:728
- C:\Windows\System\NAxMTDx.exe
  C:\Windows\System\NAxMTDx.exe
  2⤵
  PID:1868
- C:\Windows\System\JptrkvL.exe
  C:\Windows\System\JptrkvL.exe
  2⤵
  PID:1504
- C:\Windows\System\JoILOrd.exe
  C:\Windows\System\JoILOrd.exe
  2⤵
  PID:908
- C:\Windows\System\AVvwRVW.exe
  C:\Windows\System\AVvwRVW.exe
  2⤵
  PID:1304
- C:\Windows\System\fcfLGjJ.exe
  C:\Windows\System\fcfLGjJ.exe
  2⤵
  PID:1492
- C:\Windows\System\ZomTqyP.exe
  C:\Windows\System\ZomTqyP.exe
  2⤵
  PID:2420
- C:\Windows\System\DmWthvl.exe
  C:\Windows\System\DmWthvl.exe
  2⤵
  PID:788
- C:\Windows\System\mtEcWhb.exe
  C:\Windows\System\mtEcWhb.exe
  2⤵
  PID:1032
- C:\Windows\System\mHrabiW.exe
  C:\Windows\System\mHrabiW.exe
  2⤵
  PID:2008
- C:\Windows\System\jCVmwRS.exe
  C:\Windows\System\jCVmwRS.exe
  2⤵
  PID:2584
- C:\Windows\System\gteMNmJ.exe
  C:\Windows\System\gteMNmJ.exe
  2⤵
  PID:768
- C:\Windows\System\bgCviAm.exe
  C:\Windows\System\bgCviAm.exe
  2⤵
  PID:1680
- C:\Windows\System\UpMygeU.exe
  C:\Windows\System\UpMygeU.exe
  2⤵
  PID:2468
- C:\Windows\System\GGOvLHT.exe
  C:\Windows\System\GGOvLHT.exe
  2⤵
  PID:2772
- C:\Windows\System\tiWdVhE.exe
  C:\Windows\System\tiWdVhE.exe
  2⤵
  PID:1224
- C:\Windows\System\nRnuISX.exe
  C:\Windows\System\nRnuISX.exe
  2⤵
  PID:1164
- C:\Windows\System\qBSFgdY.exe
  C:\Windows\System\qBSFgdY.exe
  2⤵
  PID:2656
- C:\Windows\System\mUdyScL.exe
  C:\Windows\System\mUdyScL.exe
  2⤵
  PID:1484
- C:\Windows\System\qqjXhqx.exe
  C:\Windows\System\qqjXhqx.exe
  2⤵
  PID:2188
- C:\Windows\System\jMlPnts.exe
  C:\Windows\System\jMlPnts.exe
  2⤵
  PID:1976
- C:\Windows\System\UkQeoCG.exe
  C:\Windows\System\UkQeoCG.exe
  2⤵
  PID:1664
- C:\Windows\System\msTsYnG.exe
  C:\Windows\System\msTsYnG.exe
  2⤵
  PID:2024
- C:\Windows\System\fPzCPYo.exe
  C:\Windows\System\fPzCPYo.exe
  2⤵
  PID:2332
- C:\Windows\System\udDkSRE.exe
  C:\Windows\System\udDkSRE.exe
  2⤵
  PID:1788
- C:\Windows\System\WcVQlrf.exe
  C:\Windows\System\WcVQlrf.exe
  2⤵
  PID:2116
- C:\Windows\System\EXvLMiW.exe
  C:\Windows\System\EXvLMiW.exe
  2⤵
  PID:2376
- C:\Windows\System\VVTqlUG.exe
  C:\Windows\System\VVTqlUG.exe
  2⤵
  PID:2496
- C:\Windows\System\biavXTx.exe
  C:\Windows\System\biavXTx.exe
  2⤵
  PID:1400
- C:\Windows\System\kwXqJgJ.exe
  C:\Windows\System\kwXqJgJ.exe
  2⤵
  PID:2968
- C:\Windows\System\jkfOlWk.exe
  C:\Windows\System\jkfOlWk.exe
  2⤵
  PID:1960
- C:\Windows\System\tSYzvOu.exe
  C:\Windows\System\tSYzvOu.exe
  2⤵
  PID:2068
- C:\Windows\System\LkJKsmZ.exe
  C:\Windows\System\LkJKsmZ.exe
  2⤵
  PID:1496
- C:\Windows\System\LDnJNuQ.exe
  C:\Windows\System\LDnJNuQ.exe
  2⤵
  PID:1300
- C:\Windows\System\qwRitsL.exe
  C:\Windows\System\qwRitsL.exe
  2⤵
  PID:2088
- C:\Windows\System\iGpqiPE.exe
  C:\Windows\System\iGpqiPE.exe
  2⤵
  PID:1676
- C:\Windows\System\JtvgBcU.exe
  C:\Windows\System\JtvgBcU.exe
  2⤵
  PID:368
- C:\Windows\System\OnupNvH.exe
  C:\Windows\System\OnupNvH.exe
  2⤵
  PID:2160
- C:\Windows\System\jcgEDJq.exe
  C:\Windows\System\jcgEDJq.exe
  2⤵
  PID:2272
- C:\Windows\System\yItyqIj.exe
  C:\Windows\System\yItyqIj.exe
  2⤵
  PID:1564
- C:\Windows\System\kpyMjPp.exe
  C:\Windows\System\kpyMjPp.exe
  2⤵
  PID:3008
- C:\Windows\System\SvJocAY.exe
  C:\Windows\System\SvJocAY.exe
  2⤵
  PID:1604
- C:\Windows\System\vdFVfQs.exe
  C:\Windows\System\vdFVfQs.exe
  2⤵
  PID:2504
- C:\Windows\System\vfOBBxq.exe
  C:\Windows\System\vfOBBxq.exe
  2⤵
  PID:2284
- C:\Windows\System\ULsLBIu.exe
  C:\Windows\System\ULsLBIu.exe
  2⤵
  PID:1716
- C:\Windows\System\KOaviBt.exe
  C:\Windows\System\KOaviBt.exe
  2⤵
  PID:2700
- C:\Windows\System\GZMXnAO.exe
  C:\Windows\System\GZMXnAO.exe
  2⤵
  PID:1748
- C:\Windows\System\CUjgMLJ.exe
  C:\Windows\System\CUjgMLJ.exe
  2⤵
  PID:2536
- C:\Windows\System\GPoebsl.exe
  C:\Windows\System\GPoebsl.exe
  2⤵
  PID:2868
- C:\Windows\System\HuaLcwv.exe
  C:\Windows\System\HuaLcwv.exe
  2⤵
  PID:840
- C:\Windows\System\xdYPhxk.exe
  C:\Windows\System\xdYPhxk.exe
  2⤵
  PID:1744
- C:\Windows\System\eJPOfqk.exe
  C:\Windows\System\eJPOfqk.exe
  2⤵
  PID:2200
- C:\Windows\System\jPxhIPa.exe
  C:\Windows\System\jPxhIPa.exe
  2⤵
  PID:2728
- C:\Windows\System\kZofrkz.exe
  C:\Windows\System\kZofrkz.exe
  2⤵
  PID:2004
- C:\Windows\System\gUloBIL.exe
  C:\Windows\System\gUloBIL.exe
  2⤵
  PID:2464
- C:\Windows\System\KkLTzSo.exe
  C:\Windows\System\KkLTzSo.exe
  2⤵
  PID:3016
- C:\Windows\System\GuSLjRP.exe
  C:\Windows\System\GuSLjRP.exe
  2⤵
  PID:2992
- C:\Windows\System\cLxosbo.exe
  C:\Windows\System\cLxosbo.exe
  2⤵
  PID:2740
- C:\Windows\System\BluSMCM.exe
  C:\Windows\System\BluSMCM.exe
  2⤵
  PID:1804
- C:\Windows\System\ClwcOXx.exe
  C:\Windows\System\ClwcOXx.exe
  2⤵
  PID:2440
- C:\Windows\System\OeqEXaF.exe
  C:\Windows\System\OeqEXaF.exe
  2⤵
  PID:2248
- C:\Windows\System\RSsOVvb.exe
  C:\Windows\System\RSsOVvb.exe
  2⤵
  PID:664
- C:\Windows\System\GWMbbsq.exe
  C:\Windows\System\GWMbbsq.exe
  2⤵
  PID:1084
- C:\Windows\System\bKKpSEW.exe
  C:\Windows\System\bKKpSEW.exe
  2⤵
  PID:376
- C:\Windows\System\YHKmgxe.exe
  C:\Windows\System\YHKmgxe.exe
  2⤵
  PID:2924
- C:\Windows\System\LVtPfgq.exe
  C:\Windows\System\LVtPfgq.exe
  2⤵
  PID:2828
- C:\Windows\System\ZRClrFo.exe
  C:\Windows\System\ZRClrFo.exe
  2⤵
  PID:2364
- C:\Windows\System\aUYCEwI.exe
  C:\Windows\System\aUYCEwI.exe
  2⤵
  PID:2488
- C:\Windows\System\QmQbplQ.exe
  C:\Windows\System\QmQbplQ.exe
  2⤵
  PID:1512
- C:\Windows\System\yFfcGsu.exe
  C:\Windows\System\yFfcGsu.exe
  2⤵
  PID:2316
- C:\Windows\System\qPmxjYJ.exe
  C:\Windows\System\qPmxjYJ.exe
  2⤵
  PID:2360
- C:\Windows\System\fFfRisP.exe
  C:\Windows\System\fFfRisP.exe
  2⤵
  PID:1424
- C:\Windows\System\iyPfxyU.exe
  C:\Windows\System\iyPfxyU.exe
  2⤵
  PID:1652
- C:\Windows\System\qMicUNa.exe
  C:\Windows\System\qMicUNa.exe
  2⤵
  PID:1824
- C:\Windows\System\QCxmLsw.exe
  C:\Windows\System\QCxmLsw.exe
  2⤵
  PID:2192
- C:\Windows\System\rXteEqF.exe
  C:\Windows\System\rXteEqF.exe
  2⤵
  PID:2172
- C:\Windows\System\EdrJjjC.exe
  C:\Windows\System\EdrJjjC.exe
  2⤵
  PID:424
- C:\Windows\System\kFpAxAW.exe
  C:\Windows\System\kFpAxAW.exe
  2⤵
  PID:2932
- C:\Windows\System\KNleqzW.exe
  C:\Windows\System\KNleqzW.exe
  2⤵
  PID:2228
- C:\Windows\System\LXMtoaM.exe
  C:\Windows\System\LXMtoaM.exe
  2⤵
  PID:2652
- C:\Windows\System\ulDkCQh.exe
  C:\Windows\System\ulDkCQh.exe
  2⤵
  PID:2304
- C:\Windows\System\AMxfTdi.exe
  C:\Windows\System\AMxfTdi.exe
  2⤵
  PID:1592
- C:\Windows\System\teqHfjI.exe
  C:\Windows\System\teqHfjI.exe
  2⤵
  PID:1020
- C:\Windows\System\jAiNGoS.exe
  C:\Windows\System\jAiNGoS.exe
  2⤵
  PID:2680
- C:\Windows\System\bvIGhUm.exe
  C:\Windows\System\bvIGhUm.exe
  2⤵
  PID:2028
- C:\Windows\System\nbWqqmf.exe
  C:\Windows\System\nbWqqmf.exe
  2⤵
  PID:3068
- C:\Windows\System\bAKhljp.exe
  C:\Windows\System\bAKhljp.exe
  2⤵
  PID:2076
- C:\Windows\System\NnAgeXl.exe
  C:\Windows\System\NnAgeXl.exe
  2⤵
  PID:2732
- C:\Windows\System\PcdhwBS.exe
  C:\Windows\System\PcdhwBS.exe
  2⤵
  PID:2596
- C:\Windows\System\lRCsJPU.exe
  C:\Windows\System\lRCsJPU.exe
  2⤵
  PID:2128
- C:\Windows\System\uyTlXSL.exe
  C:\Windows\System\uyTlXSL.exe
  2⤵
  PID:2548
- C:\Windows\System\uGCMZjc.exe
  C:\Windows\System\uGCMZjc.exe
  2⤵
  PID:3028
- C:\Windows\System\xOJGWpi.exe
  C:\Windows\System\xOJGWpi.exe
  2⤵
  PID:2952
- C:\Windows\System\YktjkfG.exe
  C:\Windows\System\YktjkfG.exe
  2⤵
  PID:2020
- C:\Windows\System\LvpeSjg.exe
  C:\Windows\System\LvpeSjg.exe
  2⤵
  PID:2156
- C:\Windows\System\SlHzsCK.exe
  C:\Windows\System\SlHzsCK.exe
  2⤵
  PID:2324
- C:\Windows\System\oStsibi.exe
  C:\Windows\System\oStsibi.exe
  2⤵
  PID:1660
- C:\Windows\System\cyLAmid.exe
  C:\Windows\System\cyLAmid.exe
  2⤵
  PID:2072
- C:\Windows\System\cxdgkMt.exe
  C:\Windows\System\cxdgkMt.exe
  2⤵
  PID:3080
- C:\Windows\System\SHdVlSQ.exe
  C:\Windows\System\SHdVlSQ.exe
  2⤵
  PID:3096
- C:\Windows\System\achxzck.exe
  C:\Windows\System\achxzck.exe
  2⤵
  PID:3112
- C:\Windows\System\OCbTXwx.exe
  C:\Windows\System\OCbTXwx.exe
  2⤵
  PID:3128
- C:\Windows\System\LggKsqZ.exe
  C:\Windows\System\LggKsqZ.exe
  2⤵
  PID:3144
- C:\Windows\System\EeZZrKd.exe
  C:\Windows\System\EeZZrKd.exe
  2⤵
  PID:3160
- C:\Windows\System\MIKjymL.exe
  C:\Windows\System\MIKjymL.exe
  2⤵
  PID:3232
- C:\Windows\System\GjqYMLj.exe
  C:\Windows\System\GjqYMLj.exe
  2⤵
  PID:3252
- C:\Windows\System\kzOuUKw.exe
  C:\Windows\System\kzOuUKw.exe
  2⤵
  PID:3268
- C:\Windows\System\DoLFLpp.exe
  C:\Windows\System\DoLFLpp.exe
  2⤵
  PID:3284
- C:\Windows\System\QUAgSoq.exe
  C:\Windows\System\QUAgSoq.exe
  2⤵
  PID:3300
- C:\Windows\System\mKmoDFX.exe
  C:\Windows\System\mKmoDFX.exe
  2⤵
  PID:3316
- C:\Windows\System\jmSXxBE.exe
  C:\Windows\System\jmSXxBE.exe
  2⤵
  PID:3336
- C:\Windows\System\lzGhxgn.exe
  C:\Windows\System\lzGhxgn.exe
  2⤵
  PID:3352
- C:\Windows\System\TOKaLWv.exe
  C:\Windows\System\TOKaLWv.exe
  2⤵
  PID:3368
- C:\Windows\System\RTxZEaO.exe
  C:\Windows\System\RTxZEaO.exe
  2⤵
  PID:3388
- C:\Windows\System\GnAnped.exe
  C:\Windows\System\GnAnped.exe
  2⤵
  PID:3404
- C:\Windows\System\nFBAdHu.exe
  C:\Windows\System\nFBAdHu.exe
  2⤵
  PID:3420
- C:\Windows\System\ntQhAZz.exe
  C:\Windows\System\ntQhAZz.exe
  2⤵
  PID:3436
- C:\Windows\System\vXbUDvF.exe
  C:\Windows\System\vXbUDvF.exe
  2⤵
  PID:3456
- C:\Windows\System\eFcRGKU.exe
  C:\Windows\System\eFcRGKU.exe
  2⤵
  PID:3472
- C:\Windows\System\bsXwWyZ.exe
  C:\Windows\System\bsXwWyZ.exe
  2⤵
  PID:3536
- C:\Windows\System\OCEcCPP.exe
  C:\Windows\System\OCEcCPP.exe
  2⤵
  PID:3552
- C:\Windows\System\AfkSaoI.exe
  C:\Windows\System\AfkSaoI.exe
  2⤵
  PID:3568
- C:\Windows\System\Hbrgxle.exe
  C:\Windows\System\Hbrgxle.exe
  2⤵
  PID:3584
- C:\Windows\System\IRZMYLL.exe
  C:\Windows\System\IRZMYLL.exe
  2⤵
  PID:3600
- C:\Windows\System\KmgJGZq.exe
  C:\Windows\System\KmgJGZq.exe
  2⤵
  PID:3616
- C:\Windows\System\PjtNGQs.exe
  C:\Windows\System\PjtNGQs.exe
  2⤵
  PID:3636
- C:\Windows\System\nwvSfqB.exe
  C:\Windows\System\nwvSfqB.exe
  2⤵
  PID:3704
- C:\Windows\System\ZIDNpgo.exe
  C:\Windows\System\ZIDNpgo.exe
  2⤵
  PID:3720
- C:\Windows\System\KRQOIOy.exe
  C:\Windows\System\KRQOIOy.exe
  2⤵
  PID:3736
- C:\Windows\System\sFFpRuc.exe
  C:\Windows\System\sFFpRuc.exe
  2⤵
  PID:3756
- C:\Windows\System\HPJVyNq.exe
  C:\Windows\System\HPJVyNq.exe
  2⤵
  PID:3772
- C:\Windows\System\uvkxARx.exe
  C:\Windows\System\uvkxARx.exe
  2⤵
  PID:3808
- C:\Windows\System\igjhRgr.exe
  C:\Windows\System\igjhRgr.exe
  2⤵
  PID:3828
- C:\Windows\System\KLWPisW.exe
  C:\Windows\System\KLWPisW.exe
  2⤵
  PID:3844
- C:\Windows\System\yYOXiyR.exe
  C:\Windows\System\yYOXiyR.exe
  2⤵
  PID:3860
- C:\Windows\System\YACiwcd.exe
  C:\Windows\System\YACiwcd.exe
  2⤵
  PID:3900
- C:\Windows\System\xabRZbH.exe
  C:\Windows\System\xabRZbH.exe
  2⤵
  PID:3916
- C:\Windows\System\cjpyPAV.exe
  C:\Windows\System\cjpyPAV.exe
  2⤵
  PID:3932
- C:\Windows\System\KWYoGCD.exe
  C:\Windows\System\KWYoGCD.exe
  2⤵
  PID:3948
- C:\Windows\System\tHErVHy.exe
  C:\Windows\System\tHErVHy.exe
  2⤵
  PID:3964
- C:\Windows\System\rGGhfkG.exe
  C:\Windows\System\rGGhfkG.exe
  2⤵
  PID:3980
- C:\Windows\System\HlpwqAV.exe
  C:\Windows\System\HlpwqAV.exe
  2⤵
  PID:3996
- C:\Windows\System\RCxgTQz.exe
  C:\Windows\System\RCxgTQz.exe
  2⤵
  PID:4016
- C:\Windows\System\yMEHWGc.exe
  C:\Windows\System\yMEHWGc.exe
  2⤵
  PID:4056
- C:\Windows\System\RwDKQea.exe
  C:\Windows\System\RwDKQea.exe
  2⤵
  PID:4076
- C:\Windows\System\CCYYoxq.exe
  C:\Windows\System\CCYYoxq.exe
  2⤵
  PID:1864
- C:\Windows\System\UEmhGZY.exe
  C:\Windows\System\UEmhGZY.exe
  2⤵
  PID:2320
- C:\Windows\System\kwZnFoI.exe
  C:\Windows\System\kwZnFoI.exe
  2⤵
  PID:596
- C:\Windows\System\rWkXWaI.exe
  C:\Windows\System\rWkXWaI.exe
  2⤵
  PID:2620
- C:\Windows\System\ikupUlj.exe
  C:\Windows\System\ikupUlj.exe
  2⤵
  PID:3140
- C:\Windows\System\wHNCuvr.exe
  C:\Windows\System\wHNCuvr.exe
  2⤵
  PID:3184
- C:\Windows\System\kDwfzEO.exe
  C:\Windows\System\kDwfzEO.exe
  2⤵
  PID:3152
- C:\Windows\System\TiwXUMy.exe
  C:\Windows\System\TiwXUMy.exe
  2⤵
  PID:2348
- C:\Windows\System\LFTMlAv.exe
  C:\Windows\System\LFTMlAv.exe
  2⤵
  PID:3120
- C:\Windows\System\RrywREL.exe
  C:\Windows\System\RrywREL.exe
  2⤵
  PID:3260
- C:\Windows\System\OdppNPo.exe
  C:\Windows\System\OdppNPo.exe
  2⤵
  PID:3464
- C:\Windows\System\gLjShWj.exe
  C:\Windows\System\gLjShWj.exe
  2⤵
  PID:3280
- C:\Windows\System\EiRZdyI.exe
  C:\Windows\System\EiRZdyI.exe
  2⤵
  PID:3344
- C:\Windows\System\BRPHRtu.exe
  C:\Windows\System\BRPHRtu.exe
  2⤵
  PID:3384
- C:\Windows\System\IxFIYxX.exe
  C:\Windows\System\IxFIYxX.exe
  2⤵
  PID:3452
- C:\Windows\System\UDxhQpF.exe
  C:\Windows\System\UDxhQpF.exe
  2⤵
  PID:2592
- C:\Windows\System\JbriYWd.exe
  C:\Windows\System\JbriYWd.exe
  2⤵
  PID:3504
- C:\Windows\System\kXfvTyj.exe
  C:\Windows\System\kXfvTyj.exe
  2⤵
  PID:3520
- C:\Windows\System\WLFotZT.exe
  C:\Windows\System\WLFotZT.exe
  2⤵
  PID:3332
- C:\Windows\System\kgtvcCE.exe
  C:\Windows\System\kgtvcCE.exe
  2⤵
  PID:3548
- C:\Windows\System\XfbfsUQ.exe
  C:\Windows\System\XfbfsUQ.exe
  2⤵
  PID:3624
- C:\Windows\System\HDcsXWv.exe
  C:\Windows\System\HDcsXWv.exe
  2⤵
  PID:3608
- C:\Windows\System\ECfhsnT.exe
  C:\Windows\System\ECfhsnT.exe
  2⤵
  PID:3656
- C:\Windows\System\iRmpXuf.exe
  C:\Windows\System\iRmpXuf.exe
  2⤵
  PID:3648
- C:\Windows\System\KtfMFjU.exe
  C:\Windows\System\KtfMFjU.exe
  2⤵
  PID:3680
- C:\Windows\System\qqiAsvV.exe
  C:\Windows\System\qqiAsvV.exe
  2⤵
  PID:3688
- C:\Windows\System\TMhsyrx.exe
  C:\Windows\System\TMhsyrx.exe
  2⤵
  PID:3780
- C:\Windows\System\dyyqqCu.exe
  C:\Windows\System\dyyqqCu.exe
  2⤵
  PID:3764
- C:\Windows\System\DzNLfSu.exe
  C:\Windows\System\DzNLfSu.exe
  2⤵
  PID:3804
- C:\Windows\System\PTLowes.exe
  C:\Windows\System\PTLowes.exe
  2⤵
  PID:3836
- C:\Windows\System\ILvowbZ.exe
  C:\Windows\System\ILvowbZ.exe
  2⤵
  PID:3880
- C:\Windows\System\rUQJQpK.exe
  C:\Windows\System\rUQJQpK.exe
  2⤵
  PID:3824
- C:\Windows\System\auIuuJf.exe
  C:\Windows\System\auIuuJf.exe
  2⤵
  PID:752
- C:\Windows\System\QynNwuW.exe
  C:\Windows\System\QynNwuW.exe
  2⤵
  PID:3960
- C:\Windows\System\zDoWUYJ.exe
  C:\Windows\System\zDoWUYJ.exe
  2⤵
  PID:3940
- C:\Windows\System\wnGevWP.exe
  C:\Windows\System\wnGevWP.exe
  2⤵
  PID:4084
- C:\Windows\System\XNMUKRg.exe
  C:\Windows\System\XNMUKRg.exe
  2⤵
  PID:1240
- C:\Windows\System\iVbJRZb.exe
  C:\Windows\System\iVbJRZb.exe
  2⤵
  PID:3176
- C:\Windows\System\RBCmjMW.exe
  C:\Windows\System\RBCmjMW.exe
  2⤵
  PID:3108
- C:\Windows\System\elnpulo.exe
  C:\Windows\System\elnpulo.exe
  2⤵
  PID:3324
- C:\Windows\System\gLncmcm.exe
  C:\Windows\System\gLncmcm.exe
  2⤵
  PID:3400
- C:\Windows\System\XWisJTt.exe
  C:\Windows\System\XWisJTt.exe
  2⤵
  PID:3328
- C:\Windows\System\mEmroXq.exe
  C:\Windows\System\mEmroXq.exe
  2⤵
  PID:3448
- C:\Windows\System\zvxUckD.exe
  C:\Windows\System\zvxUckD.exe
  2⤵
  PID:3500
- C:\Windows\System\mFMbnkS.exe
  C:\Windows\System\mFMbnkS.exe
  2⤵
  PID:3492
- C:\Windows\System\HVjcsMe.exe
  C:\Windows\System\HVjcsMe.exe
  2⤵
  PID:3432
- C:\Windows\System\EVKAWWi.exe
  C:\Windows\System\EVKAWWi.exe
  2⤵
  PID:3668
- C:\Windows\System\otOaOgU.exe
  C:\Windows\System\otOaOgU.exe
  2⤵
  PID:3876
- C:\Windows\System\AwJzrhU.exe
  C:\Windows\System\AwJzrhU.exe
  2⤵
  PID:4028
- C:\Windows\System\RhzDwtb.exe
  C:\Windows\System\RhzDwtb.exe
  2⤵
  PID:3276
- C:\Windows\System\dsIQgTZ.exe
  C:\Windows\System\dsIQgTZ.exe
  2⤵
  PID:3712
- C:\Windows\System\QyXYAeZ.exe
  C:\Windows\System\QyXYAeZ.exe
  2⤵
  PID:3816
- C:\Windows\System\ouGEYfL.exe
  C:\Windows\System\ouGEYfL.exe
  2⤵
  PID:3716
- C:\Windows\System\RIqsRRv.exe
  C:\Windows\System\RIqsRRv.exe
  2⤵
  PID:3924
- C:\Windows\System\WIDxQin.exe
  C:\Windows\System\WIDxQin.exe
  2⤵
  PID:3156
- C:\Windows\System\rNPXCqE.exe
  C:\Windows\System\rNPXCqE.exe
  2⤵
  PID:3872
- C:\Windows\System\qFQASgl.exe
  C:\Windows\System\qFQASgl.exe
  2⤵
  PID:3652
- C:\Windows\System\lbhXMCt.exe
  C:\Windows\System\lbhXMCt.exe
  2⤵
  PID:3672
- C:\Windows\System\imIovse.exe
  C:\Windows\System\imIovse.exe
  2⤵
  PID:3744
- C:\Windows\System\PskLqUe.exe
  C:\Windows\System\PskLqUe.exe
  2⤵
  PID:3396
- C:\Windows\System\OuCaaLs.exe
  C:\Windows\System\OuCaaLs.exe
  2⤵
  PID:3292
- C:\Windows\System\zSxWsFq.exe
  C:\Windows\System\zSxWsFq.exe
  2⤵
  PID:3088
- C:\Windows\System\quLDHtp.exe
  C:\Windows\System\quLDHtp.exe
  2⤵
  PID:4048
- C:\Windows\System\SdzLHNs.exe
  C:\Windows\System\SdzLHNs.exe
  2⤵
  PID:3728
- C:\Windows\System\LurhOaM.exe
  C:\Windows\System\LurhOaM.exe
  2⤵
  PID:2280
- C:\Windows\System\pUEdVWB.exe
  C:\Windows\System\pUEdVWB.exe
  2⤵
  PID:2500
- C:\Windows\System\kMglAoR.exe
  C:\Windows\System\kMglAoR.exe
  2⤵
  PID:3124
- C:\Windows\System\JnWuqaL.exe
  C:\Windows\System\JnWuqaL.exe
  2⤵
  PID:3992
- C:\Windows\System\PgwpsmI.exe
  C:\Windows\System\PgwpsmI.exe
  2⤵
  PID:3628
- C:\Windows\System\ocIGpgD.exe
  C:\Windows\System\ocIGpgD.exe
  2⤵
  PID:3868
- C:\Windows\System\xMGRMwz.exe
  C:\Windows\System\xMGRMwz.exe
  2⤵
  PID:3364
- C:\Windows\System\WGfUcRJ.exe
  C:\Windows\System\WGfUcRJ.exe
  2⤵
  PID:3928
- C:\Windows\System\gkMMLJo.exe
  C:\Windows\System\gkMMLJo.exe
  2⤵
  PID:3580
- C:\Windows\System\RwuRXhk.exe
  C:\Windows\System\RwuRXhk.exe
  2⤵
  PID:3092
- C:\Windows\System\QKNSrMr.exe
  C:\Windows\System\QKNSrMr.exe
  2⤵
  PID:4112
- C:\Windows\System\EwfUHmx.exe
  C:\Windows\System\EwfUHmx.exe
  2⤵
  PID:4144
- C:\Windows\System\NkLplTu.exe
  C:\Windows\System\NkLplTu.exe
  2⤵
  PID:4168
- C:\Windows\System\vKArEHx.exe
  C:\Windows\System\vKArEHx.exe
  2⤵
  PID:4184
- C:\Windows\System\wBJzbKL.exe
  C:\Windows\System\wBJzbKL.exe
  2⤵
  PID:4200
- C:\Windows\System\XbZnQLu.exe
  C:\Windows\System\XbZnQLu.exe
  2⤵
  PID:4216
- C:\Windows\System\wgrYHfG.exe
  C:\Windows\System\wgrYHfG.exe
  2⤵
  PID:4232
- C:\Windows\System\RNELImA.exe
  C:\Windows\System\RNELImA.exe
  2⤵
  PID:4256
- C:\Windows\System\waxqhND.exe
  C:\Windows\System\waxqhND.exe
  2⤵
  PID:4272
- C:\Windows\System\fpfnETx.exe
  C:\Windows\System\fpfnETx.exe
  2⤵
  PID:4288
- C:\Windows\System\NgslcuW.exe
  C:\Windows\System\NgslcuW.exe
  2⤵
  PID:4304
- C:\Windows\System\yIcVLQi.exe
  C:\Windows\System\yIcVLQi.exe
  2⤵
  PID:4332
- C:\Windows\System\NCvmLqB.exe
  C:\Windows\System\NCvmLqB.exe
  2⤵
  PID:4352
- C:\Windows\System\AharQql.exe
  C:\Windows\System\AharQql.exe
  2⤵
  PID:4384
- C:\Windows\System\ZWEPHfg.exe
  C:\Windows\System\ZWEPHfg.exe
  2⤵
  PID:4412
- C:\Windows\System\GpMkcfR.exe
  C:\Windows\System\GpMkcfR.exe
  2⤵
  PID:4460
- C:\Windows\System\yKuzCow.exe
  C:\Windows\System\yKuzCow.exe
  2⤵
  PID:4500
- C:\Windows\System\IgbywUG.exe
  C:\Windows\System\IgbywUG.exe
  2⤵
  PID:4516
- C:\Windows\System\cABvmjx.exe
  C:\Windows\System\cABvmjx.exe
  2⤵
  PID:4532
- C:\Windows\System\vWhbATe.exe
  C:\Windows\System\vWhbATe.exe
  2⤵
  PID:4548
- C:\Windows\System\VHHBbJk.exe
  C:\Windows\System\VHHBbJk.exe
  2⤵
  PID:4564
- C:\Windows\System\CAGQOAQ.exe
  C:\Windows\System\CAGQOAQ.exe
  2⤵
  PID:4580
- C:\Windows\System\HHwWIQa.exe
  C:\Windows\System\HHwWIQa.exe
  2⤵
  PID:4596
- C:\Windows\System\LZcEyMz.exe
  C:\Windows\System\LZcEyMz.exe
  2⤵
  PID:4612
- C:\Windows\System\qrrcgaX.exe
  C:\Windows\System\qrrcgaX.exe
  2⤵
  PID:4632
- C:\Windows\System\uihVZOI.exe
  C:\Windows\System\uihVZOI.exe
  2⤵
  PID:4648
- C:\Windows\System\kBkRTGW.exe
  C:\Windows\System\kBkRTGW.exe
  2⤵
  PID:4664
- C:\Windows\System\eoOpQxE.exe
  C:\Windows\System\eoOpQxE.exe
  2⤵
  PID:4680
- C:\Windows\System\AuXSfZY.exe
  C:\Windows\System\AuXSfZY.exe
  2⤵
  PID:4696
- C:\Windows\System\gSGmPTI.exe
  C:\Windows\System\gSGmPTI.exe
  2⤵
  PID:4712
- C:\Windows\System\nomNKSq.exe
  C:\Windows\System\nomNKSq.exe
  2⤵
  PID:4728
- C:\Windows\System\AxQKInU.exe
  C:\Windows\System\AxQKInU.exe
  2⤵
  PID:4744
- C:\Windows\System\ChwqgpH.exe
  C:\Windows\System\ChwqgpH.exe
  2⤵
  PID:4760
- C:\Windows\System\aNQBaYs.exe
  C:\Windows\System\aNQBaYs.exe
  2⤵
  PID:4780
- C:\Windows\System\OjRVfqs.exe
  C:\Windows\System\OjRVfqs.exe
  2⤵
  PID:4800
- C:\Windows\System\WJLOmvZ.exe
  C:\Windows\System\WJLOmvZ.exe
  2⤵
  PID:4824
- C:\Windows\System\UYfonOx.exe
  C:\Windows\System\UYfonOx.exe
  2⤵
  PID:4876
- C:\Windows\System\xYwlsug.exe
  C:\Windows\System\xYwlsug.exe
  2⤵
  PID:4896
- C:\Windows\System\PyJFvAz.exe
  C:\Windows\System\PyJFvAz.exe
  2⤵
  PID:4916
- C:\Windows\System\VweHaTh.exe
  C:\Windows\System\VweHaTh.exe
  2⤵
  PID:4952
- C:\Windows\System\vtoXNhe.exe
  C:\Windows\System\vtoXNhe.exe
  2⤵
  PID:4968
- C:\Windows\System\AtacxSY.exe
  C:\Windows\System\AtacxSY.exe
  2⤵
  PID:4984
- C:\Windows\System\yNdWysX.exe
  C:\Windows\System\yNdWysX.exe
  2⤵
  PID:5000
- C:\Windows\System\QSSxSlz.exe
  C:\Windows\System\QSSxSlz.exe
  2⤵
  PID:5016
- C:\Windows\System\Jwzlbzp.exe
  C:\Windows\System\Jwzlbzp.exe
  2⤵
  PID:5032
- C:\Windows\System\puLFhQf.exe
  C:\Windows\System\puLFhQf.exe
  2⤵
  PID:5048
- C:\Windows\System\udLBvJk.exe
  C:\Windows\System\udLBvJk.exe
  2⤵
  PID:5096
- C:\Windows\System\JkHkpJc.exe
  C:\Windows\System\JkHkpJc.exe
  2⤵
  PID:5112
- C:\Windows\System\eULtJvQ.exe
  C:\Windows\System\eULtJvQ.exe
  2⤵
  PID:3576
- C:\Windows\System\EnHWkCT.exe
  C:\Windows\System\EnHWkCT.exe
  2⤵
  PID:2808
- C:\Windows\System\mAuxBdm.exe
  C:\Windows\System\mAuxBdm.exe
  2⤵
  PID:4124
- C:\Windows\System\cgFoGUA.exe
  C:\Windows\System\cgFoGUA.exe
  2⤵
  PID:4156
- C:\Windows\System\jNHhYyt.exe
  C:\Windows\System\jNHhYyt.exe
  2⤵
  PID:4164
- C:\Windows\System\nhnYIhF.exe
  C:\Windows\System\nhnYIhF.exe
  2⤵
  PID:4248
- C:\Windows\System\WBKapnI.exe
  C:\Windows\System\WBKapnI.exe
  2⤵
  PID:4244
- C:\Windows\System\nzoPriq.exe
  C:\Windows\System\nzoPriq.exe
  2⤵
  PID:4264
- C:\Windows\System\LxXyRks.exe
  C:\Windows\System\LxXyRks.exe
  2⤵
  PID:4340
- C:\Windows\System\goLOKdV.exe
  C:\Windows\System\goLOKdV.exe
  2⤵
  PID:4320
- C:\Windows\System\sKEvsqw.exe
  C:\Windows\System\sKEvsqw.exe
  2⤵
  PID:4364
- C:\Windows\System\vALKBGN.exe
  C:\Windows\System\vALKBGN.exe
  2⤵
  PID:2944
- C:\Windows\System\nyiLYeM.exe
  C:\Windows\System\nyiLYeM.exe
  2⤵
  PID:4408
- C:\Windows\System\ExmRtRO.exe
  C:\Windows\System\ExmRtRO.exe
  2⤵
  PID:4420
- C:\Windows\System\VJdfarH.exe
  C:\Windows\System\VJdfarH.exe
  2⤵
  PID:4440
- C:\Windows\System\uWcDbhc.exe
  C:\Windows\System\uWcDbhc.exe
  2⤵
  PID:4456
- C:\Windows\System\erwyypX.exe
  C:\Windows\System\erwyypX.exe
  2⤵
  PID:4468
- C:\Windows\System\xWpLkAS.exe
  C:\Windows\System\xWpLkAS.exe
  2⤵
  PID:4512
- C:\Windows\System\MXLbJiU.exe
  C:\Windows\System\MXLbJiU.exe
  2⤵
  PID:4496
- C:\Windows\System\wlqWNXj.exe
  C:\Windows\System\wlqWNXj.exe
  2⤵
  PID:4588
- C:\Windows\System\YaTEJqg.exe
  C:\Windows\System\YaTEJqg.exe
  2⤵
  PID:4644
- C:\Windows\System\huNYRFx.exe
  C:\Windows\System\huNYRFx.exe
  2⤵
  PID:4660
- C:\Windows\System\XSANfRq.exe
  C:\Windows\System\XSANfRq.exe
  2⤵
  PID:4736
- C:\Windows\System\sQuxBZW.exe
  C:\Windows\System\sQuxBZW.exe
  2⤵
  PID:4772
- C:\Windows\System\yYtlXal.exe
  C:\Windows\System\yYtlXal.exe
  2⤵
  PID:4752
- C:\Windows\System\fKforfe.exe
  C:\Windows\System\fKforfe.exe
  2⤵
  PID:4796
- C:\Windows\System\MRYMrKJ.exe
  C:\Windows\System\MRYMrKJ.exe
  2⤵
  PID:4820
- C:\Windows\System\Ewkilif.exe
  C:\Windows\System\Ewkilif.exe
  2⤵
  PID:4836
- C:\Windows\System\bbSWyUg.exe
  C:\Windows\System\bbSWyUg.exe
  2⤵
  PID:4888
- C:\Windows\System\NgGNjjm.exe
  C:\Windows\System\NgGNjjm.exe
  2⤵
  PID:4932
- C:\Windows\System\kCJuGQt.exe
  C:\Windows\System\kCJuGQt.exe
  2⤵
  PID:4976
- C:\Windows\System\CxcuiFy.exe
  C:\Windows\System\CxcuiFy.exe
  2⤵
  PID:4872
- C:\Windows\System\jrHNcfR.exe
  C:\Windows\System\jrHNcfR.exe
  2⤵
  PID:5008
- C:\Windows\System\fTVAaPb.exe
  C:\Windows\System\fTVAaPb.exe
  2⤵
  PID:4960
- C:\Windows\System\XikxlWs.exe
  C:\Windows\System\XikxlWs.exe
  2⤵
  PID:5060
- C:\Windows\System\NQrHBCD.exe
  C:\Windows\System\NQrHBCD.exe
  2⤵
  PID:5084
- C:\Windows\System\zwArZam.exe
  C:\Windows\System\zwArZam.exe
  2⤵
  PID:3908
- C:\Windows\System\kzIftoI.exe
  C:\Windows\System\kzIftoI.exe
  2⤵
  PID:5028
- C:\Windows\System\eELPUYP.exe
  C:\Windows\System\eELPUYP.exe
  2⤵
  PID:3428
- C:\Windows\System\EWbIgVU.exe
  C:\Windows\System\EWbIgVU.exe
  2⤵
  PID:4284
- C:\Windows\System\NSqJpNj.exe
  C:\Windows\System\NSqJpNj.exe
  2⤵
  PID:4296
- C:\Windows\System\OVjGeQw.exe
  C:\Windows\System\OVjGeQw.exe
  2⤵
  PID:4380
- C:\Windows\System\voZvllx.exe
  C:\Windows\System\voZvllx.exe
  2⤵
  PID:4484
- C:\Windows\System\tNtZgVe.exe
  C:\Windows\System\tNtZgVe.exe
  2⤵
  PID:4576
- C:\Windows\System\kASIHFp.exe
  C:\Windows\System\kASIHFp.exe
  2⤵
  PID:4396
- C:\Windows\System\SSlXhHi.exe
  C:\Windows\System\SSlXhHi.exe
  2⤵
  PID:4492
- C:\Windows\System\hVZGDkE.exe
  C:\Windows\System\hVZGDkE.exe
  2⤵
  PID:4768
- C:\Windows\System\VBPVuuO.exe
  C:\Windows\System\VBPVuuO.exe
  2⤵
  PID:4788
- C:\Windows\System\yABIiij.exe
  C:\Windows\System\yABIiij.exe
  2⤵
  PID:4860
- C:\Windows\System\OLxXfwK.exe
  C:\Windows\System\OLxXfwK.exe
  2⤵
  PID:4904
- C:\Windows\System\PmRyjHi.exe
  C:\Windows\System\PmRyjHi.exe
  2⤵
  PID:5068
- C:\Windows\System\YsTXVeq.exe
  C:\Windows\System\YsTXVeq.exe
  2⤵
  PID:4140
- C:\Windows\System\NniRyKQ.exe
  C:\Windows\System\NniRyKQ.exe
  2⤵
  PID:4688
- C:\Windows\System\hKbLfxG.exe
  C:\Windows\System\hKbLfxG.exe
  2⤵
  PID:4944
- C:\Windows\System\JKOugQQ.exe
  C:\Windows\System\JKOugQQ.exe
  2⤵
  PID:4120
- C:\Windows\System\WncUuzT.exe
  C:\Windows\System\WncUuzT.exe
  2⤵
  PID:4372
- C:\Windows\System\sTAJMEZ.exe
  C:\Windows\System\sTAJMEZ.exe
  2⤵
  PID:4560
- C:\Windows\System\owTySle.exe
  C:\Windows\System\owTySle.exe
  2⤵
  PID:4676
- C:\Windows\System\lZWiLMY.exe
  C:\Windows\System\lZWiLMY.exe
  2⤵
  PID:4724
- C:\Windows\System\xkCiAuu.exe
  C:\Windows\System\xkCiAuu.exe
  2⤵
  PID:3596
- C:\Windows\System\CForBOo.exe
  C:\Windows\System\CForBOo.exe
  2⤵
  PID:4488
- C:\Windows\System\xKHzscp.exe
  C:\Windows\System\xKHzscp.exe
  2⤵
  PID:4040
- C:\Windows\System\WNaGkCk.exe
  C:\Windows\System\WNaGkCk.exe
  2⤵
  PID:4392
- C:\Windows\System\aesewjv.exe
  C:\Windows\System\aesewjv.exe
  2⤵
  PID:4452
- C:\Windows\System\egmpZZo.exe
  C:\Windows\System\egmpZZo.exe
  2⤵
  PID:4928
- C:\Windows\System\aSlmuHr.exe
  C:\Windows\System\aSlmuHr.exe
  2⤵
  PID:4808
- C:\Windows\System\vGgmPaV.exe
  C:\Windows\System\vGgmPaV.exe
  2⤵
  PID:4212
- C:\Windows\System\IhNZKuz.exe
  C:\Windows\System\IhNZKuz.exe
  2⤵
  PID:4572
- C:\Windows\System\NMiQzmm.exe
  C:\Windows\System\NMiQzmm.exe
  2⤵
  PID:4544
- C:\Windows\System\enUxWxA.exe
  C:\Windows\System\enUxWxA.exe
  2⤵
  PID:4708
- C:\Windows\System\FnWidtS.exe
  C:\Windows\System\FnWidtS.exe
  2⤵
  PID:4884
- C:\Windows\System\WQWHcUz.exe
  C:\Windows\System\WQWHcUz.exe
  2⤵
  PID:4208
- C:\Windows\System\FCOXKhR.exe
  C:\Windows\System\FCOXKhR.exe
  2⤵
  PID:4348
- C:\Windows\System\gNdvJjY.exe
  C:\Windows\System\gNdvJjY.exe
  2⤵
  PID:5024
- C:\Windows\System\zcaOCFl.exe
  C:\Windows\System\zcaOCFl.exe
  2⤵
  PID:5012
- C:\Windows\System\mfmOmJN.exe
  C:\Windows\System\mfmOmJN.exe
  2⤵
  PID:5124
- C:\Windows\System\pQoMDbm.exe
  C:\Windows\System\pQoMDbm.exe
  2⤵
  PID:5144
- C:\Windows\System\OKlFkfw.exe
  C:\Windows\System\OKlFkfw.exe
  2⤵
  PID:5160
- C:\Windows\System\IVGqmlU.exe
  C:\Windows\System\IVGqmlU.exe
  2⤵
  PID:5184
- C:\Windows\System\pAdLrXB.exe
  C:\Windows\System\pAdLrXB.exe
  2⤵
  PID:5200
- C:\Windows\System\ciXWiva.exe
  C:\Windows\System\ciXWiva.exe
  2⤵
  PID:5216
- C:\Windows\System\EspYBMf.exe
  C:\Windows\System\EspYBMf.exe
  2⤵
  PID:5232
- C:\Windows\System\IiqCQEK.exe
  C:\Windows\System\IiqCQEK.exe
  2⤵
  PID:5252
- C:\Windows\System\jvYprGT.exe
  C:\Windows\System\jvYprGT.exe
  2⤵
  PID:5268
- C:\Windows\System\qADjvxN.exe
  C:\Windows\System\qADjvxN.exe
  2⤵
  PID:5284
- C:\Windows\System\XjFwXtH.exe
  C:\Windows\System\XjFwXtH.exe
  2⤵
  PID:5300
- C:\Windows\System\pYQCJzM.exe
  C:\Windows\System\pYQCJzM.exe
  2⤵
  PID:5316
- C:\Windows\System\zMjNxLR.exe
  C:\Windows\System\zMjNxLR.exe
  2⤵
  PID:5336
- C:\Windows\System\nAFyaTC.exe
  C:\Windows\System\nAFyaTC.exe
  2⤵
  PID:5352
- C:\Windows\System\YUhLWBO.exe
  C:\Windows\System\YUhLWBO.exe
  2⤵
  PID:5372
- C:\Windows\System\QTWEeNk.exe
  C:\Windows\System\QTWEeNk.exe
  2⤵
  PID:5388
- C:\Windows\System\NGJuXYv.exe
  C:\Windows\System\NGJuXYv.exe
  2⤵
  PID:5404
- C:\Windows\System\ewqeIVu.exe
  C:\Windows\System\ewqeIVu.exe
  2⤵
  PID:5420
- C:\Windows\System\RxOOLNY.exe
  C:\Windows\System\RxOOLNY.exe
  2⤵
  PID:5440
- C:\Windows\System\RRapqmx.exe
  C:\Windows\System\RRapqmx.exe
  2⤵
  PID:5456
- C:\Windows\System\YpyFgav.exe
  C:\Windows\System\YpyFgav.exe
  2⤵
  PID:5476
- C:\Windows\System\kHhHaaY.exe
  C:\Windows\System\kHhHaaY.exe
  2⤵
  PID:5492
- C:\Windows\System\cXSMHmr.exe
  C:\Windows\System\cXSMHmr.exe
  2⤵
  PID:5508
- C:\Windows\System\vklBOQP.exe
  C:\Windows\System\vklBOQP.exe
  2⤵
  PID:5528
- C:\Windows\System\PJVKTRF.exe
  C:\Windows\System\PJVKTRF.exe
  2⤵
  PID:5544
- C:\Windows\System\uGwbOZp.exe
  C:\Windows\System\uGwbOZp.exe
  2⤵
  PID:5560
- C:\Windows\System\NlClKdS.exe
  C:\Windows\System\NlClKdS.exe
  2⤵
  PID:5576
- C:\Windows\System\MvXPlka.exe
  C:\Windows\System\MvXPlka.exe
  2⤵
  PID:5596
- C:\Windows\System\NqwXZUR.exe
  C:\Windows\System\NqwXZUR.exe
  2⤵
  PID:5612
- C:\Windows\System\aQWFsBx.exe
  C:\Windows\System\aQWFsBx.exe
  2⤵
  PID:5632
- C:\Windows\System\CdGpmVh.exe
  C:\Windows\System\CdGpmVh.exe
  2⤵
  PID:5648
- C:\Windows\System\KZkXxzs.exe
  C:\Windows\System\KZkXxzs.exe
  2⤵
  PID:5672
- C:\Windows\System\SGhwSeM.exe
  C:\Windows\System\SGhwSeM.exe
  2⤵
  PID:5688
- C:\Windows\System\ayDXyzr.exe
  C:\Windows\System\ayDXyzr.exe
  2⤵
  PID:5704
- C:\Windows\System\rJYTwPe.exe
  C:\Windows\System\rJYTwPe.exe
  2⤵
  PID:5720
- C:\Windows\System\Okwfqng.exe
  C:\Windows\System\Okwfqng.exe
  2⤵
  PID:5736
- C:\Windows\System\wGFdPzN.exe
  C:\Windows\System\wGFdPzN.exe
  2⤵
  PID:5816
- C:\Windows\System\YTHqABY.exe
  C:\Windows\System\YTHqABY.exe
  2⤵
  PID:5840
- C:\Windows\System\naAjLOr.exe
  C:\Windows\System\naAjLOr.exe
  2⤵
  PID:5856
- C:\Windows\System\RCSEtOM.exe
  C:\Windows\System\RCSEtOM.exe
  2⤵
  PID:5872
- C:\Windows\System\yJbAKjV.exe
  C:\Windows\System\yJbAKjV.exe
  2⤵
  PID:5892
- C:\Windows\System\fTDwVbe.exe
  C:\Windows\System\fTDwVbe.exe
  2⤵
  PID:5980
- C:\Windows\System\UnpCElf.exe
  C:\Windows\System\UnpCElf.exe
  2⤵
  PID:5996
- C:\Windows\System\mMWPaNe.exe
  C:\Windows\System\mMWPaNe.exe
  2⤵
  PID:6012
- C:\Windows\System\LPbClqO.exe
  C:\Windows\System\LPbClqO.exe
  2⤵
  PID:6028
- C:\Windows\System\ZZQuzMD.exe
  C:\Windows\System\ZZQuzMD.exe
  2⤵
  PID:6044
- C:\Windows\System\GoLOOzh.exe
  C:\Windows\System\GoLOOzh.exe
  2⤵
  PID:6060
- C:\Windows\System\ydBrziN.exe
  C:\Windows\System\ydBrziN.exe
  2⤵
  PID:6076
- C:\Windows\System\KvfaumS.exe
  C:\Windows\System\KvfaumS.exe
  2⤵
  PID:6092
- C:\Windows\System\bTYPDwW.exe
  C:\Windows\System\bTYPDwW.exe
  2⤵
  PID:6108
- C:\Windows\System\Vcvwpcw.exe
  C:\Windows\System\Vcvwpcw.exe
  2⤵
  PID:6140
- C:\Windows\System\JCxDzsv.exe
  C:\Windows\System\JCxDzsv.exe
  2⤵
  PID:5044
- C:\Windows\System\cRsrwHG.exe
  C:\Windows\System\cRsrwHG.exe
  2⤵
  PID:4656
- C:\Windows\System\MjeReJS.exe
  C:\Windows\System\MjeReJS.exe
  2⤵
  PID:5192
- C:\Windows\System\pKFdbbs.exe
  C:\Windows\System\pKFdbbs.exe
  2⤵
  PID:5172
- C:\Windows\System\mJgoEZh.exe
  C:\Windows\System\mJgoEZh.exe
  2⤵
  PID:5396
- C:\Windows\System\TJROnVl.exe
  C:\Windows\System\TJROnVl.exe
  2⤵
  PID:5180
- C:\Windows\System\tsOIOJr.exe
  C:\Windows\System\tsOIOJr.exe
  2⤵
  PID:4152
- C:\Windows\System\VQUtBKd.exe
  C:\Windows\System\VQUtBKd.exe
  2⤵
  PID:5312
- C:\Windows\System\vrdCyUW.exe
  C:\Windows\System\vrdCyUW.exe
  2⤵
  PID:5348
- C:\Windows\System\ChiMplw.exe
  C:\Windows\System\ChiMplw.exe
  2⤵
  PID:5452
- C:\Windows\System\eZJEFzQ.exe
  C:\Windows\System\eZJEFzQ.exe
  2⤵
  PID:5244
- C:\Windows\System\BsiCmzj.exe
  C:\Windows\System\BsiCmzj.exe
  2⤵
  PID:5540
- C:\Windows\System\jbTbAma.exe
  C:\Windows\System\jbTbAma.exe
  2⤵
  PID:5552
- C:\Windows\System\vleVcsr.exe
  C:\Windows\System\vleVcsr.exe
  2⤵
  PID:5604
- C:\Windows\System\dfMmCPU.exe
  C:\Windows\System\dfMmCPU.exe
  2⤵
  PID:5644
- C:\Windows\System\aPQNMld.exe
  C:\Windows\System\aPQNMld.exe
  2⤵
  PID:5716
- C:\Windows\System\HHXQHcI.exe
  C:\Windows\System\HHXQHcI.exe
  2⤵
  PID:5664
- C:\Windows\System\cnPAyQm.exe
  C:\Windows\System\cnPAyQm.exe
  2⤵
  PID:5656
- C:\Windows\System\ULLOcaO.exe
  C:\Windows\System\ULLOcaO.exe
  2⤵
  PID:5092
- C:\Windows\System\jLnjYoN.exe
  C:\Windows\System\jLnjYoN.exe
  2⤵
  PID:5764
- C:\Windows\System\AqObKJI.exe
  C:\Windows\System\AqObKJI.exe
  2⤵
  PID:5780
- C:\Windows\System\rfbIGXW.exe
  C:\Windows\System\rfbIGXW.exe
  2⤵
  PID:5796
- C:\Windows\System\Zqpzbal.exe
  C:\Windows\System\Zqpzbal.exe
  2⤵
  PID:5812
- C:\Windows\System\QCOQyhq.exe
  C:\Windows\System\QCOQyhq.exe
  2⤵
  PID:5884
- C:\Windows\System\toJjfOc.exe
  C:\Windows\System\toJjfOc.exe
  2⤵
  PID:5868
- C:\Windows\System\zcBXkYf.exe
  C:\Windows\System\zcBXkYf.exe
  2⤵
  PID:5924
- C:\Windows\System\LSOcLZJ.exe
  C:\Windows\System\LSOcLZJ.exe
  2⤵
  PID:5952
- C:\Windows\System\buFEbGj.exe
  C:\Windows\System\buFEbGj.exe
  2⤵
  PID:5932
- C:\Windows\System\xyGrzLP.exe
  C:\Windows\System\xyGrzLP.exe
  2⤵
  PID:5956
- C:\Windows\System\lzVaiEN.exe
  C:\Windows\System\lzVaiEN.exe
  2⤵
  PID:5964
- C:\Windows\System\aqNphIh.exe
  C:\Windows\System\aqNphIh.exe
  2⤵
  PID:6056
- C:\Windows\System\JluLMDc.exe
  C:\Windows\System\JluLMDc.exe
  2⤵
  PID:6084
- C:\Windows\System\uaYLoAj.exe
  C:\Windows\System\uaYLoAj.exe
  2⤵
  PID:6100
- C:\Windows\System\TOKCsxU.exe
  C:\Windows\System\TOKCsxU.exe
  2⤵
  PID:6120
- C:\Windows\System\lBiReax.exe
  C:\Windows\System\lBiReax.exe
  2⤵
  PID:5152
- C:\Windows\System\OTlxMnA.exe
  C:\Windows\System\OTlxMnA.exe
  2⤵
  PID:6136
- C:\Windows\System\YTYenkq.exe
  C:\Windows\System\YTYenkq.exe
  2⤵
  PID:5196
- C:\Windows\System\QAgBCQC.exe
  C:\Windows\System\QAgBCQC.exe
  2⤵
  PID:5140
- C:\Windows\System\CwhYTjw.exe
  C:\Windows\System\CwhYTjw.exe
  2⤵
  PID:5292
- C:\Windows\System\aBxLneW.exe
  C:\Windows\System\aBxLneW.exe
  2⤵
  PID:5428
- C:\Windows\System\qMKGClv.exe
  C:\Windows\System\qMKGClv.exe
  2⤵
  PID:5276
- C:\Windows\System\csPeMea.exe
  C:\Windows\System\csPeMea.exe
  2⤵
  PID:5412
- C:\Windows\System\PUVqHNd.exe
  C:\Windows\System\PUVqHNd.exe
  2⤵
  PID:5520
- C:\Windows\System\wpUxVVm.exe
  C:\Windows\System\wpUxVVm.exe
  2⤵
  PID:5436
- C:\Windows\System\fuKREDP.exe
  C:\Windows\System\fuKREDP.exe
  2⤵
  PID:5344
- C:\Windows\System\XsYntvn.exe
  C:\Windows\System\XsYntvn.exe
  2⤵
  PID:5488
- C:\Windows\System\UpGckYo.exe
  C:\Windows\System\UpGckYo.exe
  2⤵
  PID:5588
- C:\Windows\System\fDIXQLE.exe
  C:\Windows\System\fDIXQLE.exe
  2⤵
  PID:5572
- C:\Windows\System\Gesziuv.exe
  C:\Windows\System\Gesziuv.exe
  2⤵
  PID:5624
- C:\Windows\System\cvFEwAI.exe
  C:\Windows\System\cvFEwAI.exe
  2⤵
  PID:5756
- C:\Windows\System\WoobILc.exe
  C:\Windows\System\WoobILc.exe
  2⤵
  PID:5792
- C:\Windows\System\FFqoVeB.exe
  C:\Windows\System\FFqoVeB.exe
  2⤵
  PID:5776
- C:\Windows\System\luKoGci.exe
  C:\Windows\System\luKoGci.exe
  2⤵
  PID:5908
- C:\Windows\System\OljhDzK.exe
  C:\Windows\System\OljhDzK.exe
  2⤵
  PID:5864
- C:\Windows\System\PbSNzER.exe
  C:\Windows\System\PbSNzER.exe
  2⤵
  PID:5944
- C:\Windows\System\CCYQOdF.exe
  C:\Windows\System\CCYQOdF.exe
  2⤵
  PID:6024
- C:\Windows\System\jqXLNOn.exe
  C:\Windows\System\jqXLNOn.exe
  2⤵
  PID:6068
- C:\Windows\System\mwxrEQE.exe
  C:\Windows\System\mwxrEQE.exe
  2⤵
  PID:6104
- C:\Windows\System\kdtLUov.exe
  C:\Windows\System\kdtLUov.exe
  2⤵
  PID:5368
- C:\Windows\System\tBYoJfk.exe
  C:\Windows\System\tBYoJfk.exe
  2⤵
  PID:5056
- C:\Windows\System\kCGHyIe.exe
  C:\Windows\System\kCGHyIe.exe
  2⤵
  PID:5224
- C:\Windows\System\OWrCusN.exe
  C:\Windows\System\OWrCusN.exe
  2⤵
  PID:5364
- C:\Windows\System\iVmsTJN.exe
  C:\Windows\System\iVmsTJN.exe
  2⤵
  PID:5516
- C:\Windows\System\MdrQSYV.exe
  C:\Windows\System\MdrQSYV.exe
  2⤵
  PID:5660
- C:\Windows\System\rzBnHGY.exe
  C:\Windows\System\rzBnHGY.exe
  2⤵
  PID:5852
- C:\Windows\System\TphUmml.exe
  C:\Windows\System\TphUmml.exe
  2⤵
  PID:5904
- C:\Windows\System\iVSUwhS.exe
  C:\Windows\System\iVSUwhS.exe
  2⤵
  PID:5584
- C:\Windows\System\JTyAiJk.exe
  C:\Windows\System\JTyAiJk.exe
  2⤵
  PID:5760
- C:\Windows\System\iUqUErY.exe
  C:\Windows\System\iUqUErY.exe
  2⤵
  PID:5916
- C:\Windows\System\loBmJZZ.exe
  C:\Windows\System\loBmJZZ.exe
  2⤵
  PID:5296
- C:\Windows\System\SFhWQCw.exe
  C:\Windows\System\SFhWQCw.exe
  2⤵
  PID:5384
- C:\Windows\System\LodxpAQ.exe
  C:\Windows\System\LodxpAQ.exe
  2⤵
  PID:6008
- C:\Windows\System\tGxVJHh.exe
  C:\Windows\System\tGxVJHh.exe
  2⤵
  PID:5988
- C:\Windows\System\frwLUQS.exe
  C:\Windows\System\frwLUQS.exe
  2⤵
  PID:5640
- C:\Windows\System\uyJkleV.exe
  C:\Windows\System\uyJkleV.exe
  2⤵
  PID:5136
- C:\Windows\System\nrVzPCi.exe
  C:\Windows\System\nrVzPCi.exe
  2⤵
  PID:5472
- C:\Windows\System\gyepZeX.exe
  C:\Windows\System\gyepZeX.exe
  2⤵
  PID:5212
- C:\Windows\System\zZBUXkL.exe
  C:\Windows\System\zZBUXkL.exe
  2⤵
  PID:6160
- C:\Windows\System\eiqGfhd.exe
  C:\Windows\System\eiqGfhd.exe
  2⤵
  PID:6176
- C:\Windows\System\ixjYlsQ.exe
  C:\Windows\System\ixjYlsQ.exe
  2⤵
  PID:6192
- C:\Windows\System\lwFOaEl.exe
  C:\Windows\System\lwFOaEl.exe
  2⤵
  PID:6208
- C:\Windows\System\xyUzkjX.exe
  C:\Windows\System\xyUzkjX.exe
  2⤵
  PID:6224
- C:\Windows\System\fUTBeNZ.exe
  C:\Windows\System\fUTBeNZ.exe
  2⤵
  PID:6240
- C:\Windows\System\kLIPjVv.exe
  C:\Windows\System\kLIPjVv.exe
  2⤵
  PID:6256
- C:\Windows\System\CTdizIO.exe
  C:\Windows\System\CTdizIO.exe
  2⤵
  PID:6272
- C:\Windows\System\xWNHycG.exe
  C:\Windows\System\xWNHycG.exe
  2⤵
  PID:6292
- C:\Windows\System\ZYFATyi.exe
  C:\Windows\System\ZYFATyi.exe
  2⤵
  PID:6308
- C:\Windows\System\PNiYuaw.exe
  C:\Windows\System\PNiYuaw.exe
  2⤵
  PID:6324
- C:\Windows\System\daRbjxy.exe
  C:\Windows\System\daRbjxy.exe
  2⤵
  PID:6348
- C:\Windows\System\JhOWqfh.exe
  C:\Windows\System\JhOWqfh.exe
  2⤵
  PID:6364
- C:\Windows\System\GwetIgR.exe
  C:\Windows\System\GwetIgR.exe
  2⤵
  PID:6384
- C:\Windows\System\yFjOUBQ.exe
  C:\Windows\System\yFjOUBQ.exe
  2⤵
  PID:6400
- C:\Windows\System\reUDcku.exe
  C:\Windows\System\reUDcku.exe
  2⤵
  PID:6448
- C:\Windows\System\EnWmXEY.exe
  C:\Windows\System\EnWmXEY.exe
  2⤵
  PID:6464
- C:\Windows\System\rUelJiX.exe
  C:\Windows\System\rUelJiX.exe
  2⤵
  PID:6484
- C:\Windows\System\zverKmf.exe
  C:\Windows\System\zverKmf.exe
  2⤵
  PID:6500
- C:\Windows\System\pBNpaDv.exe
  C:\Windows\System\pBNpaDv.exe
  2⤵
  PID:6516
- C:\Windows\System\GkIJEQl.exe
  C:\Windows\System\GkIJEQl.exe
  2⤵
  PID:6532
- C:\Windows\System\MWAKSWR.exe
  C:\Windows\System\MWAKSWR.exe
  2⤵
  PID:6552
- C:\Windows\System\ZcqArOF.exe
  C:\Windows\System\ZcqArOF.exe
  2⤵
  PID:6568
- C:\Windows\System\aXRJrkC.exe
  C:\Windows\System\aXRJrkC.exe
  2⤵
  PID:6584
- C:\Windows\System\wdezXVd.exe
  C:\Windows\System\wdezXVd.exe
  2⤵
  PID:6600
- C:\Windows\System\XjFDerz.exe
  C:\Windows\System\XjFDerz.exe
  2⤵
  PID:6616
- C:\Windows\System\ZkbReQg.exe
  C:\Windows\System\ZkbReQg.exe
  2⤵
  PID:6632
- C:\Windows\System\vZqZRrr.exe
  C:\Windows\System\vZqZRrr.exe
  2⤵
  PID:6648
- C:\Windows\System\QmQYDvP.exe
  C:\Windows\System\QmQYDvP.exe
  2⤵
  PID:6664
- C:\Windows\System\bfBaYJQ.exe
  C:\Windows\System\bfBaYJQ.exe
  2⤵
  PID:6708
- C:\Windows\System\jTYKoPz.exe
  C:\Windows\System\jTYKoPz.exe
  2⤵
  PID:6724
- C:\Windows\System\snqkbqe.exe
  C:\Windows\System\snqkbqe.exe
  2⤵
  PID:6744
- C:\Windows\System\TpMeUBQ.exe
  C:\Windows\System\TpMeUBQ.exe
  2⤵
  PID:6760
- C:\Windows\System\QtbblEe.exe
  C:\Windows\System\QtbblEe.exe
  2⤵
  PID:6780
- C:\Windows\System\qjXqOMw.exe
  C:\Windows\System\qjXqOMw.exe
  2⤵
  PID:6796
- C:\Windows\System\iCDXjyn.exe
  C:\Windows\System\iCDXjyn.exe
  2⤵
  PID:6816
- C:\Windows\System\KRmgjuj.exe
  C:\Windows\System\KRmgjuj.exe
  2⤵
  PID:6832
- C:\Windows\System\THuJxri.exe
  C:\Windows\System\THuJxri.exe
  2⤵
  PID:6848
- C:\Windows\System\clxgkhz.exe
  C:\Windows\System\clxgkhz.exe
  2⤵
  PID:6864
- C:\Windows\System\VnvZHxZ.exe
  C:\Windows\System\VnvZHxZ.exe
  2⤵
  PID:6880
- C:\Windows\System\yzotKll.exe
  C:\Windows\System\yzotKll.exe
  2⤵
  PID:6900
- C:\Windows\System\nFnYkPo.exe
  C:\Windows\System\nFnYkPo.exe
  2⤵
  PID:6916
- C:\Windows\System\XPKdxGG.exe
  C:\Windows\System\XPKdxGG.exe
  2⤵
  PID:6932
- C:\Windows\System\aRwrRgy.exe
  C:\Windows\System\aRwrRgy.exe
  2⤵
  PID:6948
- C:\Windows\System\itRVGkK.exe
  C:\Windows\System\itRVGkK.exe
  2⤵
  PID:6964
- C:\Windows\System\PXFIWll.exe
  C:\Windows\System\PXFIWll.exe
  2⤵
  PID:6980
- C:\Windows\System\NyLrDur.exe
  C:\Windows\System\NyLrDur.exe
  2⤵
  PID:6996
- C:\Windows\System\XoZPUPb.exe
  C:\Windows\System\XoZPUPb.exe
  2⤵
  PID:7016
- C:\Windows\System\hmQlXCC.exe
  C:\Windows\System\hmQlXCC.exe
  2⤵
  PID:7036
- C:\Windows\System\asVXnYA.exe
  C:\Windows\System\asVXnYA.exe
  2⤵
  PID:7052
- C:\Windows\System\yRcsdWh.exe
  C:\Windows\System\yRcsdWh.exe
  2⤵
  PID:7068
- C:\Windows\System\wqUzQtH.exe
  C:\Windows\System\wqUzQtH.exe
  2⤵
  PID:7084
- C:\Windows\System\clYoHzM.exe
  C:\Windows\System\clYoHzM.exe
  2⤵
  PID:7100
- C:\Windows\System\GxFTYSl.exe
  C:\Windows\System\GxFTYSl.exe
  2⤵
  PID:7116
- C:\Windows\System\bciKFyd.exe
  C:\Windows\System\bciKFyd.exe
  2⤵
  PID:7132
- C:\Windows\System\bMCSbbP.exe
  C:\Windows\System\bMCSbbP.exe
  2⤵
  PID:7148
- C:\Windows\System\XNqLAaD.exe
  C:\Windows\System\XNqLAaD.exe
  2⤵
  PID:7164
- C:\Windows\System\jCaahOB.exe
  C:\Windows\System\jCaahOB.exe
  2⤵
  PID:5880
- C:\Windows\System\sSBMuSt.exe
  C:\Windows\System\sSBMuSt.exe
  2⤵
  PID:5280
- C:\Windows\System\NUdMQTB.exe
  C:\Windows\System\NUdMQTB.exe
  2⤵
  PID:6088
- C:\Windows\System\CFczHKn.exe
  C:\Windows\System\CFczHKn.exe
  2⤵
  PID:6172
- C:\Windows\System\ezIrTlB.exe
  C:\Windows\System\ezIrTlB.exe
  2⤵
  PID:6236
- C:\Windows\System\miWyfkJ.exe
  C:\Windows\System\miWyfkJ.exe
  2⤵
  PID:6248
- C:\Windows\System\HOKVRQI.exe
  C:\Windows\System\HOKVRQI.exe
  2⤵
  PID:6356
- C:\Windows\System\vnhKYkC.exe
  C:\Windows\System\vnhKYkC.exe
  2⤵
  PID:6380
- C:\Windows\System\JWGjYCD.exe
  C:\Windows\System\JWGjYCD.exe
  2⤵
  PID:6336
- C:\Windows\System\tnTzHXS.exe
  C:\Windows\System\tnTzHXS.exe
  2⤵
  PID:6408
- C:\Windows\System\mEaIRkZ.exe
  C:\Windows\System\mEaIRkZ.exe
  2⤵
  PID:6428
- C:\Windows\System\LbXAZNp.exe
  C:\Windows\System\LbXAZNp.exe
  2⤵
  PID:6472
- C:\Windows\System\qfzQyJO.exe
  C:\Windows\System\qfzQyJO.exe
  2⤵
  PID:6496
- C:\Windows\System\OrClwmB.exe
  C:\Windows\System\OrClwmB.exe
  2⤵
  PID:6512
- C:\Windows\System\uQCGLPR.exe
  C:\Windows\System\uQCGLPR.exe
  2⤵
  PID:6592
- C:\Windows\System\SYMBbeU.exe
  C:\Windows\System\SYMBbeU.exe
  2⤵
  PID:6540
- C:\Windows\System\CoMExYT.exe
  C:\Windows\System\CoMExYT.exe
  2⤵
  PID:6624
- C:\Windows\System\iFPDIXf.exe
  C:\Windows\System\iFPDIXf.exe
  2⤵
  PID:6644
- C:\Windows\System\BbyXEJW.exe
  C:\Windows\System\BbyXEJW.exe
  2⤵
  PID:6672
- C:\Windows\System\fHlHLYE.exe
  C:\Windows\System\fHlHLYE.exe
  2⤵
  PID:6692
- C:\Windows\System\MsvaeHk.exe
  C:\Windows\System\MsvaeHk.exe
  2⤵
  PID:6776
- C:\Windows\System\DdUioLV.exe
  C:\Windows\System\DdUioLV.exe
  2⤵
  PID:6844
- C:\Windows\System\TydAMjt.exe
  C:\Windows\System\TydAMjt.exe
  2⤵
  PID:6856
- C:\Windows\System\XValsEy.exe
  C:\Windows\System\XValsEy.exe
  2⤵
  PID:6860
- C:\Windows\System\CANbJGq.exe
  C:\Windows\System\CANbJGq.exe
  2⤵
  PID:6772
- C:\Windows\System\pITPuiI.exe
  C:\Windows\System\pITPuiI.exe
  2⤵
  PID:6840
- C:\Windows\System\AITzSOF.exe
  C:\Windows\System\AITzSOF.exe
  2⤵
  PID:6908
- C:\Windows\System\EWNpPoa.exe
  C:\Windows\System\EWNpPoa.exe
  2⤵
  PID:6956
- C:\Windows\System\GeivYva.exe
  C:\Windows\System\GeivYva.exe
  2⤵
  PID:6988
- C:\Windows\System\xCFIVwO.exe
  C:\Windows\System\xCFIVwO.exe
  2⤵
  PID:7004
- C:\Windows\System\KcJGORV.exe
  C:\Windows\System\KcJGORV.exe
  2⤵
  PID:7028
- C:\Windows\System\fqVBolq.exe
  C:\Windows\System\fqVBolq.exe
  2⤵
  PID:7076
- C:\Windows\System\uCvAUOK.exe
  C:\Windows\System\uCvAUOK.exe
  2⤵
  PID:7092
- C:\Windows\System\YWmOxyU.exe
  C:\Windows\System\YWmOxyU.exe
  2⤵
  PID:7108
- C:\Windows\System\jYqgVtF.exe
  C:\Windows\System\jYqgVtF.exe
  2⤵
  PID:6132
- C:\Windows\System\BtwDZiV.exe
  C:\Windows\System\BtwDZiV.exe
  2⤵
  PID:5332
- C:\Windows\System\etcluvs.exe
  C:\Windows\System\etcluvs.exe
  2⤵
  PID:6004
- C:\Windows\System\WoSORYY.exe
  C:\Windows\System\WoSORYY.exe
  2⤵
  PID:6268
- C:\Windows\System\flkhswp.exe
  C:\Windows\System\flkhswp.exe
  2⤵
  PID:6392
- C:\Windows\System\TxkwlAs.exe
  C:\Windows\System\TxkwlAs.exe
  2⤵
  PID:6288
- C:\Windows\System\xNjXRCQ.exe
  C:\Windows\System\xNjXRCQ.exe
  2⤵
  PID:6344
- C:\Windows\System\pVeFkmC.exe
  C:\Windows\System\pVeFkmC.exe
  2⤵
  PID:6460
- C:\Windows\System\wJrOdDW.exe
  C:\Windows\System\wJrOdDW.exe
  2⤵
  PID:6444
- C:\Windows\System\sAaZyEL.exe
  C:\Windows\System\sAaZyEL.exe
  2⤵
  PID:6612
- C:\Windows\System\jusNbzq.exe
  C:\Windows\System\jusNbzq.exe
  2⤵
  PID:6580
- C:\Windows\System\IKbwdDd.exe
  C:\Windows\System\IKbwdDd.exe
  2⤵
  PID:6732
- C:\Windows\System\jhLoHhL.exe
  C:\Windows\System\jhLoHhL.exe
  2⤵
  PID:6548
- C:\Windows\System\NIQJWzf.exe
  C:\Windows\System\NIQJWzf.exe
  2⤵
  PID:6788
- C:\Windows\System\dubkZVY.exe
  C:\Windows\System\dubkZVY.exe
  2⤵
  PID:6928
- C:\Windows\System\UHpitoh.exe
  C:\Windows\System\UHpitoh.exe
  2⤵
  PID:6972
- C:\Windows\System\dUlvLWY.exe
  C:\Windows\System\dUlvLWY.exe
  2⤵
  PID:6976
- C:\Windows\System\YHfUnTF.exe
  C:\Windows\System\YHfUnTF.exe
  2⤵
  PID:6940
- C:\Windows\System\lJeFFix.exe
  C:\Windows\System\lJeFFix.exe
  2⤵
  PID:7064
- C:\Windows\System\moVwJbD.exe
  C:\Windows\System\moVwJbD.exe
  2⤵
  PID:7008
- C:\Windows\System\rGjSuGg.exe
  C:\Windows\System\rGjSuGg.exe
  2⤵
  PID:6168
- C:\Windows\System\KulkGRV.exe
  C:\Windows\System\KulkGRV.exe
  2⤵
  PID:6492
- C:\Windows\System\DzvQSir.exe
  C:\Windows\System\DzvQSir.exe
  2⤵
  PID:6220
- C:\Windows\System\XzcgNEf.exe
  C:\Windows\System\XzcgNEf.exe
  2⤵
  PID:6736
- C:\Windows\System\ovQKbZl.exe
  C:\Windows\System\ovQKbZl.exe
  2⤵
  PID:5328
- C:\Windows\System\ZVOlsbL.exe
  C:\Windows\System\ZVOlsbL.exe
  2⤵
  PID:6316
- C:\Windows\System\OERiYDd.exe
  C:\Windows\System\OERiYDd.exe
  2⤵
  PID:6756
- C:\Windows\System\pSxFzda.exe
  C:\Windows\System\pSxFzda.exe
  2⤵
  PID:6892
- C:\Windows\System\URRZSmP.exe
  C:\Windows\System\URRZSmP.exe
  2⤵
  PID:6768
- C:\Windows\System\DoSKYvH.exe
  C:\Windows\System\DoSKYvH.exe
  2⤵
  PID:6660
- C:\Windows\System\GApcxcm.exe
  C:\Windows\System\GApcxcm.exe
  2⤵
  PID:6876
- C:\Windows\System\UDiHock.exe
  C:\Windows\System\UDiHock.exe
  2⤵
  PID:6036
- C:\Windows\System\IIRGRww.exe
  C:\Windows\System\IIRGRww.exe
  2⤵
  PID:6188
- C:\Windows\System\JEjVsrd.exe
  C:\Windows\System\JEjVsrd.exe
  2⤵
  PID:7128
- C:\Windows\System\cOszdAG.exe
  C:\Windows\System\cOszdAG.exe
  2⤵
  PID:7180
- C:\Windows\System\biVaygg.exe
  C:\Windows\System\biVaygg.exe
  2⤵
  PID:7196
- C:\Windows\System\qGpDEpl.exe
  C:\Windows\System\qGpDEpl.exe
  2⤵
  PID:7212
- C:\Windows\System\uQNEdtK.exe
  C:\Windows\System\uQNEdtK.exe
  2⤵
  PID:7228
- C:\Windows\System\MbpeTJx.exe
  C:\Windows\System\MbpeTJx.exe
  2⤵
  PID:7252
- C:\Windows\System\ezOKSUl.exe
  C:\Windows\System\ezOKSUl.exe
  2⤵
  PID:7276
- C:\Windows\System\aOchitT.exe
  C:\Windows\System\aOchitT.exe
  2⤵
  PID:7292
- C:\Windows\System\igEjyGK.exe
  C:\Windows\System\igEjyGK.exe
  2⤵
  PID:7308
- C:\Windows\System\QILzaFJ.exe
  C:\Windows\System\QILzaFJ.exe
  2⤵
  PID:7324
- C:\Windows\System\gQjFhlT.exe
  C:\Windows\System\gQjFhlT.exe
  2⤵
  PID:7340
- C:\Windows\System\aqNHyXD.exe
  C:\Windows\System\aqNHyXD.exe
  2⤵
  PID:7356
- C:\Windows\System\KoWuaQV.exe
  C:\Windows\System\KoWuaQV.exe
  2⤵
  PID:7380
- C:\Windows\System\sIMYXxB.exe
  C:\Windows\System\sIMYXxB.exe
  2⤵
  PID:7396
- C:\Windows\System\EVUqiFV.exe
  C:\Windows\System\EVUqiFV.exe
  2⤵
  PID:7412
- C:\Windows\System\TnfjaGE.exe
  C:\Windows\System\TnfjaGE.exe
  2⤵
  PID:7428
- C:\Windows\System\XtSNsNy.exe
  C:\Windows\System\XtSNsNy.exe
  2⤵
  PID:7444
- C:\Windows\System\tWXiGvJ.exe
  C:\Windows\System\tWXiGvJ.exe
  2⤵
  PID:7460
- C:\Windows\System\oJrrbUr.exe
  C:\Windows\System\oJrrbUr.exe
  2⤵
  PID:7476
- C:\Windows\System\jeDzPho.exe
  C:\Windows\System\jeDzPho.exe
  2⤵
  PID:7492
- C:\Windows\System\EyLIjpW.exe
  C:\Windows\System\EyLIjpW.exe
  2⤵
  PID:7512
- C:\Windows\System\ZfmaTuB.exe
  C:\Windows\System\ZfmaTuB.exe
  2⤵
  PID:7528
- C:\Windows\System\dsXnaGX.exe
  C:\Windows\System\dsXnaGX.exe
  2⤵
  PID:7544
- C:\Windows\System\utYcfWl.exe
  C:\Windows\System\utYcfWl.exe
  2⤵
  PID:7560
- C:\Windows\System\qlTztsU.exe
  C:\Windows\System\qlTztsU.exe
  2⤵
  PID:7576
- C:\Windows\System\XYEgDle.exe
  C:\Windows\System\XYEgDle.exe
  2⤵
  PID:7592
- C:\Windows\System\ywaSjZL.exe
  C:\Windows\System\ywaSjZL.exe
  2⤵
  PID:7608
- C:\Windows\System\aNWoctJ.exe
  C:\Windows\System\aNWoctJ.exe
  2⤵
  PID:7624
- C:\Windows\System\JFvXXXB.exe
  C:\Windows\System\JFvXXXB.exe
  2⤵
  PID:7640
- C:\Windows\System\lOrWiUh.exe
  C:\Windows\System\lOrWiUh.exe
  2⤵
  PID:7656
- C:\Windows\System\WqlXSdm.exe
  C:\Windows\System\WqlXSdm.exe
  2⤵
  PID:7672
- C:\Windows\System\adyTrAY.exe
  C:\Windows\System\adyTrAY.exe
  2⤵
  PID:7692
- C:\Windows\System\DERQTEv.exe
  C:\Windows\System\DERQTEv.exe
  2⤵
  PID:7708
- C:\Windows\System\UpUgIdH.exe
  C:\Windows\System\UpUgIdH.exe
  2⤵
  PID:7724
- C:\Windows\System\DzaXCXe.exe
  C:\Windows\System\DzaXCXe.exe
  2⤵
  PID:7744
- C:\Windows\System\rEgQVwt.exe
  C:\Windows\System\rEgQVwt.exe
  2⤵
  PID:7760
- C:\Windows\System\ZckunTl.exe
  C:\Windows\System\ZckunTl.exe
  2⤵
  PID:7780
- C:\Windows\System\uqMBwbe.exe
  C:\Windows\System\uqMBwbe.exe
  2⤵
  PID:7796
- C:\Windows\System\OjCQIUG.exe
  C:\Windows\System\OjCQIUG.exe
  2⤵
  PID:7812
- C:\Windows\System\abvRgsT.exe
  C:\Windows\System\abvRgsT.exe
  2⤵
  PID:7832
- C:\Windows\System\HnQREgO.exe
  C:\Windows\System\HnQREgO.exe
  2⤵
  PID:7848
- C:\Windows\System\vyOOfQY.exe
  C:\Windows\System\vyOOfQY.exe
  2⤵
  PID:7868
- C:\Windows\System\yvKPNoD.exe
  C:\Windows\System\yvKPNoD.exe
  2⤵
  PID:7884
- C:\Windows\System\GjpMCmK.exe
  C:\Windows\System\GjpMCmK.exe
  2⤵
  PID:7900
- C:\Windows\System\bkFBPBS.exe
  C:\Windows\System\bkFBPBS.exe
  2⤵
  PID:7916
- C:\Windows\System\sAsmkhX.exe
  C:\Windows\System\sAsmkhX.exe
  2⤵
  PID:7932
- C:\Windows\System\fqEHGqm.exe
  C:\Windows\System\fqEHGqm.exe
  2⤵
  PID:7948
- C:\Windows\System\fFKmxpX.exe
  C:\Windows\System\fFKmxpX.exe
  2⤵
  PID:7964
- C:\Windows\System\qVHdrps.exe
  C:\Windows\System\qVHdrps.exe
  2⤵
  PID:7980
- C:\Windows\System\VZnhxVP.exe
  C:\Windows\System\VZnhxVP.exe
  2⤵
  PID:7996
- C:\Windows\System\ZnBqFzK.exe
  C:\Windows\System\ZnBqFzK.exe
  2⤵
  PID:8012
- C:\Windows\System\QhauOne.exe
  C:\Windows\System\QhauOne.exe
  2⤵
  PID:8028
- C:\Windows\System\QQGLBJi.exe
  C:\Windows\System\QQGLBJi.exe
  2⤵
  PID:8044
- C:\Windows\System\NMoGEGK.exe
  C:\Windows\System\NMoGEGK.exe
  2⤵
  PID:8060
- C:\Windows\System\PoZsCaX.exe
  C:\Windows\System\PoZsCaX.exe
  2⤵
  PID:8076
- C:\Windows\System\kDUtiyI.exe
  C:\Windows\System\kDUtiyI.exe
  2⤵
  PID:8092
- C:\Windows\System\wfNHPyL.exe
  C:\Windows\System\wfNHPyL.exe
  2⤵
  PID:8108
- C:\Windows\System\VWFkFlk.exe
  C:\Windows\System\VWFkFlk.exe
  2⤵
  PID:8124
- C:\Windows\System\xIBiscv.exe
  C:\Windows\System\xIBiscv.exe
  2⤵
  PID:8140
- C:\Windows\System\gWNOLYO.exe
  C:\Windows\System\gWNOLYO.exe
  2⤵
  PID:8156
- C:\Windows\System\jrziptZ.exe
  C:\Windows\System\jrziptZ.exe
  2⤵
  PID:8172
- C:\Windows\System\yqirIFE.exe
  C:\Windows\System\yqirIFE.exe
  2⤵
  PID:8188
- C:\Windows\System\gHLWLQK.exe
  C:\Windows\System\gHLWLQK.exe
  2⤵
  PID:7044
- C:\Windows\System\bDBFHdJ.exe
  C:\Windows\System\bDBFHdJ.exe
  2⤵
  PID:6740
- C:\Windows\System\iwYsBiq.exe
  C:\Windows\System\iwYsBiq.exe
  2⤵
  PID:7144
- C:\Windows\System\mvAOAVy.exe
  C:\Windows\System\mvAOAVy.exe
  2⤵
  PID:7192
- C:\Windows\System\ojushus.exe
  C:\Windows\System\ojushus.exe
  2⤵
  PID:7224
- C:\Windows\System\CvKDaVj.exe
  C:\Windows\System\CvKDaVj.exe
  2⤵
  PID:7304
- C:\Windows\System\IMVygzJ.exe
  C:\Windows\System\IMVygzJ.exe
  2⤵
  PID:7300
- C:\Windows\System\EgOvKPj.exe
  C:\Windows\System\EgOvKPj.exe
  2⤵
  PID:7288
- C:\Windows\System\ntmRGoC.exe
  C:\Windows\System\ntmRGoC.exe
  2⤵
  PID:7244
- C:\Windows\System\ZTuCfri.exe
  C:\Windows\System\ZTuCfri.exe
  2⤵
  PID:7364
- C:\Windows\System\SdfXNBz.exe
  C:\Windows\System\SdfXNBz.exe
  2⤵
  PID:7404
- C:\Windows\System\kgrlwHu.exe
  C:\Windows\System\kgrlwHu.exe
  2⤵
  PID:7468
- C:\Windows\System\sKeSVnp.exe
  C:\Windows\System\sKeSVnp.exe
  2⤵
  PID:7392
- C:\Windows\System\HASflmC.exe
  C:\Windows\System\HASflmC.exe
  2⤵
  PID:7456
- C:\Windows\System\iDFkVjD.exe
  C:\Windows\System\iDFkVjD.exe
  2⤵
  PID:7504
- C:\Windows\System\jILPwJm.exe
  C:\Windows\System\jILPwJm.exe
  2⤵
  PID:7568
- C:\Windows\System\tHJNyXN.exe
  C:\Windows\System\tHJNyXN.exe
  2⤵
  PID:7584
- C:\Windows\System\UCAWFfg.exe
  C:\Windows\System\UCAWFfg.exe
  2⤵
  PID:7520
- C:\Windows\System\YLhpXsx.exe
  C:\Windows\System\YLhpXsx.exe
  2⤵
  PID:7620
- C:\Windows\System\iQwiTnZ.exe
  C:\Windows\System\iQwiTnZ.exe
  2⤵
  PID:7664
- C:\Windows\System\zCnTJcI.exe
  C:\Windows\System\zCnTJcI.exe
  2⤵
  PID:7680
- C:\Windows\System\pgAERNY.exe
  C:\Windows\System\pgAERNY.exe
  2⤵
  PID:7684
- C:\Windows\System\hBsOjvE.exe
  C:\Windows\System\hBsOjvE.exe
  2⤵
  PID:7776
- C:\Windows\System\iYZvtvM.exe
  C:\Windows\System\iYZvtvM.exe
  2⤵
  PID:7844
- C:\Windows\System\xmIioTw.exe
  C:\Windows\System\xmIioTw.exe
  2⤵
  PID:7752
- C:\Windows\System\zwyhBDY.exe
  C:\Windows\System\zwyhBDY.exe
  2⤵
  PID:7828
- C:\Windows\System\htYyiaZ.exe
  C:\Windows\System\htYyiaZ.exe
  2⤵
  PID:7880
- C:\Windows\System\gFyUnLz.exe
  C:\Windows\System\gFyUnLz.exe
  2⤵
  PID:7944
- C:\Windows\System\UzNJAdk.exe
  C:\Windows\System\UzNJAdk.exe
  2⤵
  PID:7928
- C:\Windows\System\cuWARwc.exe
  C:\Windows\System\cuWARwc.exe
  2⤵
  PID:8040
- C:\Windows\System\GyCobJS.exe
  C:\Windows\System\GyCobJS.exe
  2⤵
  PID:7992
- C:\Windows\System\mrJGLUd.exe
  C:\Windows\System\mrJGLUd.exe
  2⤵
  PID:8072
- C:\Windows\System\aNIgstv.exe
  C:\Windows\System\aNIgstv.exe
  2⤵
  PID:8052
- C:\Windows\System\gRWZBQe.exe
  C:\Windows\System\gRWZBQe.exe
  2⤵
  PID:8132
- C:\Windows\System\GUZyvVA.exe
  C:\Windows\System\GUZyvVA.exe
  2⤵
  PID:8120
- C:\Windows\System\toUDgHT.exe
  C:\Windows\System\toUDgHT.exe
  2⤵
  PID:7140
- C:\Windows\System\SCBFmhX.exe
  C:\Windows\System\SCBFmhX.exe
  2⤵
  PID:6416
- C:\Windows\System\YQiQlUg.exe
  C:\Windows\System\YQiQlUg.exe
  2⤵
  PID:7264
- C:\Windows\System\iRcnPjl.exe
  C:\Windows\System\iRcnPjl.exe
  2⤵
  PID:7172
- C:\Windows\System\lMQESSQ.exe
  C:\Windows\System\lMQESSQ.exe
  2⤵
  PID:7376
- C:\Windows\System\STymRPd.exe
  C:\Windows\System\STymRPd.exe
  2⤵
  PID:7320
- C:\Windows\System\vzOYAGm.exe
  C:\Windows\System\vzOYAGm.exe
  2⤵
  PID:7500
- C:\Windows\System\giJlNiy.exe
  C:\Windows\System\giJlNiy.exe
  2⤵
  PID:7488
- C:\Windows\System\NeMaHVQ.exe
  C:\Windows\System\NeMaHVQ.exe
  2⤵
  PID:7652
- C:\Windows\System\QNcHVnp.exe
  C:\Windows\System\QNcHVnp.exe
  2⤵
  PID:7700
- C:\Windows\System\mmpHszk.exe
  C:\Windows\System\mmpHszk.exe
  2⤵
  PID:7720
- C:\Windows\System\caqgRxA.exe
  C:\Windows\System\caqgRxA.exe
  2⤵
  PID:7772
- C:\Windows\System\zXUxPIi.exe
  C:\Windows\System\zXUxPIi.exe
  2⤵
  PID:6480
- C:\Windows\System\aYvkcRB.exe
  C:\Windows\System\aYvkcRB.exe
  2⤵
  PID:7820
- C:\Windows\System\TdjZxdw.exe
  C:\Windows\System\TdjZxdw.exe
  2⤵
  PID:7960
- C:\Windows\System\mglkOZC.exe
  C:\Windows\System\mglkOZC.exe
  2⤵
  PID:8036
- C:\Windows\System\BHANiPf.exe
  C:\Windows\System\BHANiPf.exe
  2⤵
  PID:8056
- C:\Windows\System\kenqJiB.exe
  C:\Windows\System\kenqJiB.exe
  2⤵
  PID:7012
- C:\Windows\System\OdAPGLb.exe
  C:\Windows\System\OdAPGLb.exe
  2⤵
  PID:7896
- C:\Windows\System\chDJmhJ.exe
  C:\Windows\System\chDJmhJ.exe
  2⤵
  PID:3076
- C:\Windows\System\oQSupRN.exe
  C:\Windows\System\oQSupRN.exe
  2⤵
  PID:6456
- C:\Windows\System\GUqfcxN.exe
  C:\Windows\System\GUqfcxN.exe
  2⤵
  PID:7348
- C:\Windows\System\mSQQjDd.exe
  C:\Windows\System\mSQQjDd.exe
  2⤵
  PID:7556
- C:\Windows\System\ARvwSTO.exe
  C:\Windows\System\ARvwSTO.exe
  2⤵
  PID:7604
- C:\Windows\System\rieaskx.exe
  C:\Windows\System\rieaskx.exe
  2⤵
  PID:7908
- C:\Windows\System\OfzUZUR.exe
  C:\Windows\System\OfzUZUR.exe
  2⤵
  PID:7536
- C:\Windows\System\QkgdsUK.exe
  C:\Windows\System\QkgdsUK.exe
  2⤵
  PID:7976
- C:\Windows\System\CXotDXR.exe
  C:\Windows\System\CXotDXR.exe
  2⤵
  PID:7220
- C:\Windows\System\rltIOtB.exe
  C:\Windows\System\rltIOtB.exe
  2⤵
  PID:6812
- C:\Windows\System\uVIQgwN.exe
  C:\Windows\System\uVIQgwN.exe
  2⤵
  PID:7636
- C:\Windows\System\tYZXFrs.exe
  C:\Windows\System\tYZXFrs.exe
  2⤵
  PID:7452
- C:\Windows\System\IkeqJUg.exe
  C:\Windows\System\IkeqJUg.exe
  2⤵
  PID:8148
- C:\Windows\System\CXAVVFc.exe
  C:\Windows\System\CXAVVFc.exe
  2⤵
  PID:8024
- C:\Windows\System\zkubqEj.exe
  C:\Windows\System\zkubqEj.exe
  2⤵
  PID:7540
- C:\Windows\System\otdgwjc.exe
  C:\Windows\System\otdgwjc.exe
  2⤵
  PID:8196
- C:\Windows\System\RnpjIxl.exe
  C:\Windows\System\RnpjIxl.exe
  2⤵
  PID:8224
- C:\Windows\System\iOclMcJ.exe
  C:\Windows\System\iOclMcJ.exe
  2⤵
  PID:8240
- C:\Windows\System\nWOPMSS.exe
  C:\Windows\System\nWOPMSS.exe
  2⤵
  PID:8256
- C:\Windows\System\nmAnqlE.exe
  C:\Windows\System\nmAnqlE.exe
  2⤵
  PID:8272
- C:\Windows\System\fThkjzR.exe
  C:\Windows\System\fThkjzR.exe
  2⤵
  PID:8288
- C:\Windows\System\AvbHvsZ.exe
  C:\Windows\System\AvbHvsZ.exe
  2⤵
  PID:8304
- C:\Windows\System\xAmZcTb.exe
  C:\Windows\System\xAmZcTb.exe
  2⤵
  PID:8320
- C:\Windows\System\WnpMGgp.exe
  C:\Windows\System\WnpMGgp.exe
  2⤵
  PID:8340
- C:\Windows\System\tQEdyLo.exe
  C:\Windows\System\tQEdyLo.exe
  2⤵
  PID:8356
- C:\Windows\System\UuwvcHc.exe
  C:\Windows\System\UuwvcHc.exe
  2⤵
  PID:8396
- C:\Windows\System\JgannyP.exe
  C:\Windows\System\JgannyP.exe
  2⤵
  PID:8416
- C:\Windows\System\Rbqphhr.exe
  C:\Windows\System\Rbqphhr.exe
  2⤵
  PID:8464
- C:\Windows\System\arGnqlg.exe
  C:\Windows\System\arGnqlg.exe
  2⤵
  PID:8480
- C:\Windows\System\tjFRwQS.exe
  C:\Windows\System\tjFRwQS.exe
  2⤵
  PID:8496
- C:\Windows\System\fLOjKau.exe
  C:\Windows\System\fLOjKau.exe
  2⤵
  PID:8512
- C:\Windows\System\ESePSkb.exe
  C:\Windows\System\ESePSkb.exe
  2⤵
  PID:8532
- C:\Windows\System\VjhVgVJ.exe
  C:\Windows\System\VjhVgVJ.exe
  2⤵
  PID:8548
- C:\Windows\System\QtiiFgo.exe
  C:\Windows\System\QtiiFgo.exe
  2⤵
  PID:8564
- C:\Windows\System\cDpBidP.exe
  C:\Windows\System\cDpBidP.exe
  2⤵
  PID:8580
- C:\Windows\System\XSYlIQE.exe
  C:\Windows\System\XSYlIQE.exe
  2⤵
  PID:8596
- C:\Windows\System\BdPffqz.exe
  C:\Windows\System\BdPffqz.exe
  2⤵
  PID:8612
- C:\Windows\System\AEwrMyr.exe
  C:\Windows\System\AEwrMyr.exe
  2⤵
  PID:8628
- C:\Windows\System\HOnvjPR.exe
  C:\Windows\System\HOnvjPR.exe
  2⤵
  PID:8644
- C:\Windows\System\nFcBlWU.exe
  C:\Windows\System\nFcBlWU.exe
  2⤵
  PID:8660
- C:\Windows\System\HuZFvAl.exe
  C:\Windows\System\HuZFvAl.exe
  2⤵
  PID:8676
- C:\Windows\System\PVekmfs.exe
  C:\Windows\System\PVekmfs.exe
  2⤵
  PID:8692
- C:\Windows\System\LKPczlZ.exe
  C:\Windows\System\LKPczlZ.exe
  2⤵
  PID:8716
- C:\Windows\System\dACSgwG.exe
  C:\Windows\System\dACSgwG.exe
  2⤵
  PID:8732
- C:\Windows\System\ecXWywi.exe
  C:\Windows\System\ecXWywi.exe
  2⤵
  PID:8748
- C:\Windows\System\yigOBPS.exe
  C:\Windows\System\yigOBPS.exe
  2⤵
  PID:8764
- C:\Windows\System\duxFVWN.exe
  C:\Windows\System\duxFVWN.exe
  2⤵
  PID:8780
- C:\Windows\System\WcKSUZw.exe
  C:\Windows\System\WcKSUZw.exe
  2⤵
  PID:8796
- C:\Windows\System\rBocvcD.exe
  C:\Windows\System\rBocvcD.exe
  2⤵
  PID:8812
- C:\Windows\System\dWWFcpy.exe
  C:\Windows\System\dWWFcpy.exe
  2⤵
  PID:8832
- C:\Windows\System\WBmMDHx.exe
  C:\Windows\System\WBmMDHx.exe
  2⤵
  PID:8848
- C:\Windows\System\fySbhcn.exe
  C:\Windows\System\fySbhcn.exe
  2⤵
  PID:8864
- C:\Windows\System\ubTMhwh.exe
  C:\Windows\System\ubTMhwh.exe
  2⤵
  PID:8888
- C:\Windows\System\qYCRUba.exe
  C:\Windows\System\qYCRUba.exe
  2⤵
  PID:8904
- C:\Windows\System\YXAArxz.exe
  C:\Windows\System\YXAArxz.exe
  2⤵
  PID:8920
- C:\Windows\System\DhAmpCz.exe
  C:\Windows\System\DhAmpCz.exe
  2⤵
  PID:8936
- C:\Windows\System\cbfvMVw.exe
  C:\Windows\System\cbfvMVw.exe
  2⤵
  PID:8952
- C:\Windows\System\ILKmQiK.exe
  C:\Windows\System\ILKmQiK.exe
  2⤵
  PID:8968
- C:\Windows\System\oACMHQa.exe
  C:\Windows\System\oACMHQa.exe
  2⤵
  PID:8984
- C:\Windows\System\HvQQtho.exe
  C:\Windows\System\HvQQtho.exe
  2⤵
  PID:9000
- C:\Windows\System\mUNYgkt.exe
  C:\Windows\System\mUNYgkt.exe
  2⤵
  PID:9020
- C:\Windows\System\dMRQZvN.exe
  C:\Windows\System\dMRQZvN.exe
  2⤵
  PID:9040
- C:\Windows\System\BeDbgjJ.exe
  C:\Windows\System\BeDbgjJ.exe
  2⤵
  PID:9056
- C:\Windows\System\ixvLJJF.exe
  C:\Windows\System\ixvLJJF.exe
  2⤵
  PID:9072
- C:\Windows\System\DEQfnxz.exe
  C:\Windows\System\DEQfnxz.exe
  2⤵
  PID:9088
- C:\Windows\System\xueTFXs.exe
  C:\Windows\System\xueTFXs.exe
  2⤵
  PID:9112
- C:\Windows\System\teSyzJR.exe
  C:\Windows\System\teSyzJR.exe
  2⤵
  PID:9128
- C:\Windows\System\AUQqwgl.exe
  C:\Windows\System\AUQqwgl.exe
  2⤵
  PID:9144
- C:\Windows\System\xvPdIHa.exe
  C:\Windows\System\xvPdIHa.exe
  2⤵
  PID:9160
- C:\Windows\System\dQaYczv.exe
  C:\Windows\System\dQaYczv.exe
  2⤵
  PID:9176
- C:\Windows\System\YXsEAUm.exe
  C:\Windows\System\YXsEAUm.exe
  2⤵
  PID:9192
- C:\Windows\System\VfZZATy.exe
  C:\Windows\System\VfZZATy.exe
  2⤵
  PID:9212
- C:\Windows\System\UvBcLeP.exe
  C:\Windows\System\UvBcLeP.exe
  2⤵
  PID:7588
- C:\Windows\System\mJnmojX.exe
  C:\Windows\System\mJnmojX.exe
  2⤵
  PID:7824
- C:\Windows\System\wZJWKgb.exe
  C:\Windows\System\wZJWKgb.exe
  2⤵
  PID:8264
- C:\Windows\System\RUFQNRN.exe
  C:\Windows\System\RUFQNRN.exe
  2⤵
  PID:8352
- C:\Windows\System\rJLkYxK.exe
  C:\Windows\System\rJLkYxK.exe
  2⤵
  PID:8316
- C:\Windows\System\GmIzGrn.exe
  C:\Windows\System\GmIzGrn.exe
  2⤵
  PID:8404
- C:\Windows\System\HmHAbUf.exe
  C:\Windows\System\HmHAbUf.exe
  2⤵
  PID:8388
- C:\Windows\System\HEbCssa.exe
  C:\Windows\System\HEbCssa.exe
  2⤵
  PID:8428
- C:\Windows\System\RUJwkQs.exe
  C:\Windows\System\RUJwkQs.exe
  2⤵
  PID:8508
- C:\Windows\System\gwNVBEw.exe
  C:\Windows\System\gwNVBEw.exe
  2⤵
  PID:8488
- C:\Windows\System\PCyACvI.exe
  C:\Windows\System\PCyACvI.exe
  2⤵
  PID:8528
- C:\Windows\System\dECfSYc.exe
  C:\Windows\System\dECfSYc.exe
  2⤵
  PID:8208
- C:\Windows\System\BWAkFwT.exe
  C:\Windows\System\BWAkFwT.exe
  2⤵
  PID:8604
- C:\Windows\System\TIvVHHz.exe
  C:\Windows\System\TIvVHHz.exe
  2⤵
  PID:8588
- C:\Windows\System\ojpVmiB.exe
  C:\Windows\System\ojpVmiB.exe
  2⤵
  PID:8688
- C:\Windows\System\hfKmHtY.exe
  C:\Windows\System\hfKmHtY.exe
  2⤵
  PID:8704
- C:\Windows\System\atHBUnf.exe
  C:\Windows\System\atHBUnf.exe
  2⤵
  PID:8776
- C:\Windows\System\VfPJDMN.exe
  C:\Windows\System\VfPJDMN.exe
  2⤵
  PID:8876
- C:\Windows\System\xbDdRuU.exe
  C:\Windows\System\xbDdRuU.exe
  2⤵
  PID:8912
- C:\Windows\System\kCTHmoz.exe
  C:\Windows\System\kCTHmoz.exe
  2⤵
  PID:8824
- C:\Windows\System\JriCUlP.exe
  C:\Windows\System\JriCUlP.exe
  2⤵
  PID:8896
- C:\Windows\System\cyaFPKZ.exe
  C:\Windows\System\cyaFPKZ.exe
  2⤵
  PID:8948
- C:\Windows\System\EZvCCyD.exe
  C:\Windows\System\EZvCCyD.exe
  2⤵
  PID:8996
- C:\Windows\System\AwbTuZf.exe
  C:\Windows\System\AwbTuZf.exe
  2⤵
  PID:8980
- C:\Windows\System\cAXSypf.exe
  C:\Windows\System\cAXSypf.exe
  2⤵
  PID:9052
- C:\Windows\System\nzeeJfX.exe
  C:\Windows\System\nzeeJfX.exe
  2⤵
  PID:9068
- C:\Windows\System\CymUSPo.exe
  C:\Windows\System\CymUSPo.exe
  2⤵
  PID:9096
- C:\Windows\System\eniqMeD.exe
  C:\Windows\System\eniqMeD.exe
  2⤵
  PID:9136
- C:\Windows\System\juYmimA.exe
  C:\Windows\System\juYmimA.exe
  2⤵
  PID:9188
- C:\Windows\System\TCDHryV.exe
  C:\Windows\System\TCDHryV.exe
  2⤵
  PID:8212
- C:\Windows\System\sOOKuHT.exe
  C:\Windows\System\sOOKuHT.exe
  2⤵
  PID:9208
- C:\Windows\System\PzrcJyA.exe
  C:\Windows\System\PzrcJyA.exe
  2⤵
  PID:8384
- C:\Windows\System\KBclmPz.exe
  C:\Windows\System\KBclmPz.exe
  2⤵
  PID:8432
- C:\Windows\System\WbAjxlI.exe
  C:\Windows\System\WbAjxlI.exe
  2⤵
  PID:8492
- C:\Windows\System\WmWQfuS.exe
  C:\Windows\System\WmWQfuS.exe
  2⤵
  PID:8608
- C:\Windows\System\hpfwdoI.exe
  C:\Windows\System\hpfwdoI.exe
  2⤵
  PID:8284
- C:\Windows\System\IKrkRSw.exe
  C:\Windows\System\IKrkRSw.exe
  2⤵
  PID:8268
- C:\Windows\System\xOwkcez.exe
  C:\Windows\System\xOwkcez.exe
  2⤵
  PID:8392
- C:\Windows\System\lWQrrlW.exe
  C:\Windows\System\lWQrrlW.exe
  2⤵
  PID:8624
- C:\Windows\System\dhEBChD.exe
  C:\Windows\System\dhEBChD.exe
  2⤵
  PID:8456
- C:\Windows\System\ffkREFT.exe
  C:\Windows\System\ffkREFT.exe
  2⤵
  PID:8712
- C:\Windows\System\zdSsgVB.exe
  C:\Windows\System\zdSsgVB.exe
  2⤵
  PID:8740
- C:\Windows\System\ZGqpybY.exe
  C:\Windows\System\ZGqpybY.exe
  2⤵
  PID:8860
- C:\Windows\System\unLtoPC.exe
  C:\Windows\System\unLtoPC.exe
  2⤵
  PID:9048
- C:\Windows\System\JIEcYQN.exe
  C:\Windows\System\JIEcYQN.exe
  2⤵
  PID:8932
- C:\Windows\System\jVplLSf.exe
  C:\Windows\System\jVplLSf.exe
  2⤵
  PID:9032
- C:\Windows\System\VeCMhBe.exe
  C:\Windows\System\VeCMhBe.exe
  2⤵
  PID:9028
- C:\Windows\System\tFIspYy.exe
  C:\Windows\System\tFIspYy.exe
  2⤵
  PID:9156
- C:\Windows\System\HmkBMNy.exe
  C:\Windows\System\HmkBMNy.exe
  2⤵
  PID:8476
- C:\Windows\System\HTCwVSh.exe
  C:\Windows\System\HTCwVSh.exe
  2⤵
  PID:7940
- C:\Windows\System\NfhPEkl.exe
  C:\Windows\System\NfhPEkl.exe
  2⤵
  PID:8312
- C:\Windows\System\vwSCnem.exe
  C:\Windows\System\vwSCnem.exe
  2⤵
  PID:8440
- C:\Windows\System\kMcfJBE.exe
  C:\Windows\System\kMcfJBE.exe
  2⤵
  PID:8424
- C:\Windows\System\PoqXELG.exe
  C:\Windows\System\PoqXELG.exe
  2⤵
  PID:8636
- C:\Windows\System\mGtrRPt.exe
  C:\Windows\System\mGtrRPt.exe
  2⤵
  PID:8884
- C:\Windows\System\CCtjOaL.exe
  C:\Windows\System\CCtjOaL.exe
  2⤵
  PID:8700
- C:\Windows\System\KDNJirG.exe
  C:\Windows\System\KDNJirG.exe
  2⤵
  PID:9120
- C:\Windows\System\WQlCdjI.exe
  C:\Windows\System\WQlCdjI.exe
  2⤵
  PID:9016
- C:\Windows\System\CLDkvVj.exe
  C:\Windows\System\CLDkvVj.exe
  2⤵
  PID:8216
- C:\Windows\System\RwQMHOn.exe
  C:\Windows\System\RwQMHOn.exe
  2⤵
  PID:8248
- C:\Windows\System\nSldpWy.exe
  C:\Windows\System\nSldpWy.exe
  2⤵
  PID:8792
- C:\Windows\System\dWmJRXs.exe
  C:\Windows\System\dWmJRXs.exe
  2⤵
  PID:8592
- C:\Windows\System\nXuGGmf.exe
  C:\Windows\System\nXuGGmf.exe
  2⤵
  PID:8976
- C:\Windows\System\rGUXbgq.exe
  C:\Windows\System\rGUXbgq.exe
  2⤵
  PID:8376
- C:\Windows\System\ZtimHGo.exe
  C:\Windows\System\ZtimHGo.exe
  2⤵
  PID:8576
- C:\Windows\System\FRGqQEQ.exe
  C:\Windows\System\FRGqQEQ.exe
  2⤵
  PID:8296
- C:\Windows\System\ANbcMWT.exe
  C:\Windows\System\ANbcMWT.exe
  2⤵
  PID:9272
- C:\Windows\System\xDidnZU.exe
  C:\Windows\System\xDidnZU.exe
  2⤵
  PID:9296
- C:\Windows\System\LiuZWgA.exe
  C:\Windows\System\LiuZWgA.exe
  2⤵
  PID:9320
- C:\Windows\System\dMAZVBJ.exe
  C:\Windows\System\dMAZVBJ.exe
  2⤵
  PID:9336
- C:\Windows\System\oZPzWmj.exe
  C:\Windows\System\oZPzWmj.exe
  2⤵
  PID:9352
- C:\Windows\System\yXGPMAQ.exe
  C:\Windows\System\yXGPMAQ.exe
  2⤵
  PID:9368
- C:\Windows\System\ofVYqnJ.exe
  C:\Windows\System\ofVYqnJ.exe
  2⤵
  PID:9384
- C:\Windows\System\gYwydqK.exe
  C:\Windows\System\gYwydqK.exe
  2⤵
  PID:9400
- C:\Windows\System\JFOWyuD.exe
  C:\Windows\System\JFOWyuD.exe
  2⤵
  PID:9416
- C:\Windows\System\lZkHfnb.exe
  C:\Windows\System\lZkHfnb.exe
  2⤵
  PID:9432
- C:\Windows\System\YJuVqvw.exe
  C:\Windows\System\YJuVqvw.exe
  2⤵
  PID:9508
- C:\Windows\System\hUcCASy.exe
  C:\Windows\System\hUcCASy.exe
  2⤵
  PID:9524
- C:\Windows\System\LWLrnAg.exe
  C:\Windows\System\LWLrnAg.exe
  2⤵
  PID:9540
- C:\Windows\System\KMpXbEb.exe
  C:\Windows\System\KMpXbEb.exe
  2⤵
  PID:9556
- C:\Windows\System\XnGtuYg.exe
  C:\Windows\System\XnGtuYg.exe
  2⤵
  PID:9572
- C:\Windows\System\ISooJMf.exe
  C:\Windows\System\ISooJMf.exe
  2⤵
  PID:9612
- C:\Windows\System\bKxuQqe.exe
  C:\Windows\System\bKxuQqe.exe
  2⤵
  PID:9628
- C:\Windows\System\bpxFpzG.exe
  C:\Windows\System\bpxFpzG.exe
  2⤵
  PID:9644
- C:\Windows\System\CgvXpMO.exe
  C:\Windows\System\CgvXpMO.exe
  2⤵
  PID:9660
- C:\Windows\System\yznLfoD.exe
  C:\Windows\System\yznLfoD.exe
  2⤵
  PID:9676
- C:\Windows\System\HYreyZF.exe
  C:\Windows\System\HYreyZF.exe
  2⤵
  PID:9692
- C:\Windows\System\lTGIuSn.exe
  C:\Windows\System\lTGIuSn.exe
  2⤵
  PID:9708
- C:\Windows\System\SAYcCwo.exe
  C:\Windows\System\SAYcCwo.exe
  2⤵
  PID:9724
- C:\Windows\System\nJDcEBz.exe
  C:\Windows\System\nJDcEBz.exe
  2⤵
  PID:9740
- C:\Windows\System\jcfmnlH.exe
  C:\Windows\System\jcfmnlH.exe
  2⤵
  PID:9760
- C:\Windows\System\YqFBVtM.exe
  C:\Windows\System\YqFBVtM.exe
  2⤵
  PID:9776
- C:\Windows\System\KYfyIDO.exe
  C:\Windows\System\KYfyIDO.exe
  2⤵
  PID:9792
- C:\Windows\System\gjhaSaR.exe
  C:\Windows\System\gjhaSaR.exe
  2⤵
  PID:9860
- C:\Windows\System\JeAGcHY.exe
  C:\Windows\System\JeAGcHY.exe
  2⤵
  PID:9876
- C:\Windows\System\UXRRbtk.exe
  C:\Windows\System\UXRRbtk.exe
  2⤵
  PID:9892
- C:\Windows\System\BXvRdnm.exe
  C:\Windows\System\BXvRdnm.exe
  2⤵
  PID:9916
- C:\Windows\System\Shpgwhc.exe
  C:\Windows\System\Shpgwhc.exe
  2⤵
  PID:9932
- C:\Windows\System\ktODdvJ.exe
  C:\Windows\System\ktODdvJ.exe
  2⤵
  PID:9948
- C:\Windows\System\ZhjFbuZ.exe
  C:\Windows\System\ZhjFbuZ.exe
  2⤵
  PID:9964
- C:\Windows\System\eHVXbeW.exe
  C:\Windows\System\eHVXbeW.exe
  2⤵
  PID:9980
- C:\Windows\System\gMwSfne.exe
  C:\Windows\System\gMwSfne.exe
  2⤵
  PID:9996
- C:\Windows\System\vzorQfM.exe
  C:\Windows\System\vzorQfM.exe
  2⤵
  PID:10016
- C:\Windows\System\GmhCDor.exe
  C:\Windows\System\GmhCDor.exe
  2⤵
  PID:9752
- C:\Windows\System\dMVdHfd.exe
  C:\Windows\System\dMVdHfd.exe
  2⤵
  PID:9944
- C:\Windows\System\pgIMwpn.exe
  C:\Windows\System\pgIMwpn.exe
  2⤵
  PID:9640
- C:\Windows\System\juiqqIZ.exe
  C:\Windows\System\juiqqIZ.exe
  2⤵
  PID:9732
- C:\Windows\System\knbKnnn.exe
  C:\Windows\System\knbKnnn.exe
  2⤵
  PID:9816
- C:\Windows\System\pxWaOGd.exe
  C:\Windows\System\pxWaOGd.exe
  2⤵
  PID:9832
- C:\Windows\System\fwPgjtd.exe
  C:\Windows\System\fwPgjtd.exe
  2⤵
  PID:9868
- C:\Windows\System\zuedmYk.exe
  C:\Windows\System\zuedmYk.exe
  2⤵
  PID:9488
- C:\Windows\System\IiqnIpR.exe
  C:\Windows\System\IiqnIpR.exe
  2⤵
  PID:9468
- C:\Windows\System\GkVjeGS.exe
  C:\Windows\System\GkVjeGS.exe
  2⤵
  PID:9496
- C:\Windows\System\uMMBhdx.exe
  C:\Windows\System\uMMBhdx.exe
  2⤵
  PID:9656
- C:\Windows\System\dsVrVJG.exe
  C:\Windows\System\dsVrVJG.exe
  2⤵
  PID:9716
- C:\Windows\System\ZYbcKAN.exe
  C:\Windows\System\ZYbcKAN.exe
  2⤵
  PID:9684
- C:\Windows\System\rVASaar.exe
  C:\Windows\System\rVASaar.exe
  2⤵
  PID:9840
- C:\Windows\System\EnXOVbE.exe
  C:\Windows\System\EnXOVbE.exe
  2⤵
  PID:9636
- C:\Windows\System\FvNPaBw.exe
  C:\Windows\System\FvNPaBw.exe
  2⤵
  PID:9928
- C:\Windows\System\kgNKHdE.exe
  C:\Windows\System\kgNKHdE.exe
  2⤵
  PID:10008
- C:\Windows\System\vbbiqNg.exe
  C:\Windows\System\vbbiqNg.exe
  2⤵
  PID:10136
- C:\Windows\System\dipHfqj.exe
  C:\Windows\System\dipHfqj.exe
  2⤵
  PID:10168
- C:\Windows\System\beNORqs.exe
  C:\Windows\System\beNORqs.exe
  2⤵
  PID:10220
- C:\Windows\System\VHItfdC.exe
  C:\Windows\System\VHItfdC.exe
  2⤵
  PID:9344
- C:\Windows\System\amhiVvW.exe
  C:\Windows\System\amhiVvW.exe
  2⤵
  PID:9396
- C:\Windows\System\lWvinrc.exe
  C:\Windows\System\lWvinrc.exe
  2⤵
  PID:10184
- C:\Windows\System\fwPpwal.exe
  C:\Windows\System\fwPpwal.exe
  2⤵
  PID:8756
- C:\Windows\System\XWZeNsW.exe
  C:\Windows\System\XWZeNsW.exe
  2⤵
  PID:9424
- C:\Windows\System\pKTwJmW.exe
  C:\Windows\System\pKTwJmW.exe
  2⤵
  PID:10072
- C:\Windows\System\pOQcEku.exe
  C:\Windows\System\pOQcEku.exe
  2⤵
  PID:9844
- C:\Windows\System\YzYFETB.exe
  C:\Windows\System\YzYFETB.exe
  2⤵
  PID:9464
- C:\Windows\System\oYzCBUa.exe
  C:\Windows\System\oYzCBUa.exe
  2⤵
  PID:9568
- C:\Windows\System\QczTnNG.exe
  C:\Windows\System\QczTnNG.exe
  2⤵
  PID:9856
- C:\Windows\System\sEUOZkW.exe
  C:\Windows\System\sEUOZkW.exe
  2⤵
  PID:1940
- C:\Windows\System\iYdfhDr.exe
  C:\Windows\System\iYdfhDr.exe
  2⤵
  PID:9548
- C:\Windows\System\LCoRTKm.exe
  C:\Windows\System\LCoRTKm.exe
  2⤵
  PID:9608
- C:\Windows\System\HeOgePc.exe
  C:\Windows\System\HeOgePc.exe
  2⤵
  PID:1528
- C:\Windows\System\JTltVaJ.exe
  C:\Windows\System\JTltVaJ.exe
  2⤵
  PID:2512
- C:\Windows\System\CiCzPxN.exe
  C:\Windows\System\CiCzPxN.exe
  2⤵
  PID:9564
- C:\Windows\System\NZfuVjj.exe
  C:\Windows\System\NZfuVjj.exe
  2⤵
  PID:9584
- C:\Windows\System\lxFzKpu.exe
  C:\Windows\System\lxFzKpu.exe
  2⤵
  PID:9736
- C:\Windows\System\rLsyfhA.exe
  C:\Windows\System\rLsyfhA.exe
  2⤵
  PID:10036
- C:\Windows\System\XKSDwQT.exe
  C:\Windows\System\XKSDwQT.exe
  2⤵
  PID:10040
- C:\Windows\System\ARPkyee.exe
  C:\Windows\System\ARPkyee.exe
  2⤵
  PID:9988
- C:\Windows\System\LpZluhP.exe
  C:\Windows\System\LpZluhP.exe
  2⤵
  PID:9268
- C:\Windows\System\wJHZjOF.exe
  C:\Windows\System\wJHZjOF.exe
  2⤵
  PID:10084
- C:\Windows\System\ZqOkQkK.exe
  C:\Windows\System\ZqOkQkK.exe
  2⤵
  PID:9520
- C:\Windows\System\pyiXYLr.exe
  C:\Windows\System\pyiXYLr.exe
  2⤵
  PID:9580
- C:\Windows\System\bxfZtet.exe
  C:\Windows\System\bxfZtet.exe
  2⤵
  PID:9536
- C:\Windows\System\yDNuBXn.exe
  C:\Windows\System\yDNuBXn.exe
  2⤵
  PID:9236
- C:\Windows\System\ywIbsPj.exe
  C:\Windows\System\ywIbsPj.exe
  2⤵
  PID:9888
- C:\Windows\System\fbbQIhj.exe
  C:\Windows\System\fbbQIhj.exe
  2⤵
  PID:10228
- C:\Windows\System\bSNNGwy.exe
  C:\Windows\System\bSNNGwy.exe
  2⤵
  PID:10012
- C:\Windows\System\AMzHWFK.exe
  C:\Windows\System\AMzHWFK.exe
  2⤵
  PID:9248
- C:\Windows\System\npcgxRN.exe
  C:\Windows\System\npcgxRN.exe
  2⤵
  PID:10088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BnpvtMd.exe

Filesize
1.5MB

MD5
2649950cd754ba806eca040d2d83fd46

SHA1
20a0f73973b1626cf8cab07f68ac03cbe899f0e8

SHA256
e02927e814f5b1e530a137c3ab3d8af94b8a3399b4e7b07aa6803443ecc366f7

SHA512
c77360c63e5d59f650b69e8612e6ee28314d2f9d0921c54e8c8d1e8382f0c7a0bdf3d9981416604a144d38cd642a1125257e0ccb4c0353b7d0f3a368c78632d9

Download Submit
C:\Windows\system\FDDSUZY.exe

Filesize
1.5MB

MD5
9deaf6d325e63d0134f99432d803364a

SHA1
64e5458bdca99aa1cc387d7f3d87c9c8fdd8ec32

SHA256
999b7e7935575d9aac84f3e5cccb9b5525daca0531dcf9a5d34110efa7e22ce4

SHA512
8a3ef4a8e0cac58f65e57a1a748f4c320af65c20ace9f222d1f6d12bd440e930c4f2e758a97a29dca14702d3c6a7d183caa58fda7b260ee8efa7582863a8a65e

Download Submit
C:\Windows\system\HriWkMA.exe

Filesize
1.5MB

MD5
4c23db9e9416d6315fbc7f94f68eb343

SHA1
ad7cbca48b12fb0019eb916a85ed2d15b45ac902

SHA256
58c956a33218cfb0b0f4876eba98b63e0cb4e37d5a2ef176fc2c73d2f485e0f5

SHA512
b7c23024fc84ba2fcdeb61c56e2b7369930c75a18d26efb898c04a4360c5309bb93395a5fc0683e0eff2300738d850aa2e34d7d7fc269ea2808ac828f5e1a545

Download Submit
C:\Windows\system\ITfuTIF.exe

Filesize
1.5MB

MD5
7fea19ad82c9be5b7dd36058873e8b46

SHA1
79c10c488423957a72805fb329ec3d45093c8ad4

SHA256
292b629f4107abfd1e7dafe4488b3b32bb9d606deb88156456b127759075e91b

SHA512
b2542e4c009bad3b0a4cb4e5afd55d585650ff830953c7e23f4f8363191a22f569fcf6f6f2e48daef27a4247cf24cb3920c2ff4312149279d994ff268a717ad5

Download Submit
C:\Windows\system\Irigkxs.exe

Filesize
1.5MB

MD5
92701381a0d4e5b8bdb97cd42f59e7b1

SHA1
8fb4597a0899e2f2a0e573dfe574b97ca8770b67

SHA256
e1d9dc6a3650fb53e5d22e3540237a83b9e0e62630218a28c2ccdda406692440

SHA512
a8c76fa866960baeb45f47b3e51c5dc6ba326985d5a73ad1613286e2f47ec2eb602a536c7d4f5b9f71a52503975285d99c5ac19e6367e8c4631579792f06e304

Download Submit
C:\Windows\system\JRADHSY.exe

Filesize
1.5MB

MD5
50e3d5eea916e41e62223992265e2692

SHA1
d1e476aeb293a828738e67927c210502500af0c4

SHA256
451e0c0c561fac395d5e7fc71b8cc9f3337e4d467ea628b726cc01751a0168ac

SHA512
184c8ef2a22a8e212e7c8282a08eed2845921f0286132d6778659f3e569f0d1068e9719aa4ff3413c995cde2ed6771dfa23ff7f7eeca4cbad789782aa7e9028d

Download Submit
C:\Windows\system\MKVnqTA.exe

Filesize
1.5MB

MD5
88efb7609c6efdee3b590274de34fd87

SHA1
646fbaa5d4a2ea545ba9fd484bc99f557ba638b6

SHA256
cd6d2c652ed26341e142d83773e0f5b3b2066263ed926a98f620d8031613b408

SHA512
0497738ecc0067bf273fa7f72d86fedf43dc79daa3dcc00d1d7b56d74eb1091ed3506727d823e2f2ea1c8348f83045ff68e0975d149f99ec596addfeb087dca0

Download Submit
C:\Windows\system\PYzuRzA.exe

Filesize
1.5MB

MD5
c72988279b9f6f2f82484b0c0de46326

SHA1
834888ba5268c68e3c1489c6f9d81c21fcb3f85d

SHA256
9a3185dcae6a9e7d22404c1d7cdf9ac88f514ca9afe6c38fde75da286664c351

SHA512
4385df3ad862e9a1256b8391d4513c54ce8b6cfc89138aebd042bab7352d8e6ea76718371065ffccc9439f86d57a283f5d66e2e0345885cb732e9c52b11a6ada

Download Submit
C:\Windows\system\QRLrGdn.exe

Filesize
1.5MB

MD5
4260b09274f22965846b2bac2b23dab4

SHA1
91839999f614038ec91f7a9389c252218befbe5e

SHA256
ae98389ef0ca12085603a68668fe804ca0401920b88d0e70a7d391c170966863

SHA512
3cc43021887d75049258d6e725bc7cb3b14e765f990df4b5f600e9c8b7efc0299cc9edfe792280b7b3c4a7e349b5ad84d5d1720215d5441357326394867e8e4a

Download Submit
C:\Windows\system\TyQoftm.exe

Filesize
1.5MB

MD5
3639bc07b299cb6294b007d65a45b753

SHA1
233fac782706b66f45adc9dbc6201535501c00fd

SHA256
324d1d45cd00757d08459f5c0523e033c8ff8932de032f7b7b448063059ae75b

SHA512
08a5b7e527145a50d3b8026b961ead9fb7080ee585f7634e8d9c273df00a61a5184701133ffc0ca99a6f2edc4181e13181a012fd6d02caad00687bc922c6cb82

Download Submit
C:\Windows\system\VNYUuZQ.exe

Filesize
1.5MB

MD5
407af33d9429ed016322f67ddd132550

SHA1
16872fc19ad21243a87cc4cfbc9c4183d384289e

SHA256
d0e986159610f01ebb9791c7738d406d07eb1e60879fce98c0d7cf96ee53ff24

SHA512
c618ffb38fc0c75dfb5e73e8eb327db878111864e56bbedced97f701b4e96b43bd1570bcf5e4598436b3ba8a626115280164eff33e97eb1097cc2a98bed1bf1f

Download Submit
C:\Windows\system\VklsftI.exe

Filesize
1.5MB

MD5
601bfb6df0d23b95fab9deb634a9b7dc

SHA1
faf029f2ae0a055ebe8c2c78c60abefaaa93a3aa

SHA256
e31267af949d6ed54ebfc77e0b993c193c4a6adc1e0cf86c91d39534a22a2e42

SHA512
d9139a27cd732444bdcaba9c7daa04293102d2794bf4d87d323fc4705c84e70911e741411794e1381a8b4043fafc6dc5ba454182cee4c3d6f4d9c7cdb3b939e8

Download Submit
C:\Windows\system\XRBVgCr.exe

Filesize
1.5MB

MD5
a24332b137350cda9f85310e9c4fc4b7

SHA1
4d5a7ac0aa913871f54c5c067b77ca24708ff483

SHA256
eb97834d3ab48ea75ea474e5de99f77fe826b06f967a786c510dd4b2d0a09c15

SHA512
cd33cf5ff5fae6b284248708bb50c04379a5fdca9dd7d143d75e6e60012793651bb95154f06499eb42f68900c618b0a30abbd12344681757a74a4e18b74ded77

Download Submit
C:\Windows\system\XhhxIdv.exe

Filesize
1.5MB

MD5
0a8d8bc4cdc9e578e587e5911e2f9575

SHA1
0938dc9d145e68ab87043c6c40f58927c5978f85

SHA256
3dcf45c3a10b88bd82b823da6c0805e286f98bee1542245dee435e3709e45d31

SHA512
72c6499111724cac7452d7696acc451ecb6d8dc2c5feb0f51a293df7ad650e0410bd999c853e879981505731fe45c8fa5c87340667e9abec1b05d0e8d80cbee2

Download Submit
C:\Windows\system\aFFaFVj.exe

Filesize
1.5MB

MD5
057e548c7d64bd3393f53e6a9b76296b

SHA1
04ad3698b6ed935671f0138daab1a024f650f2e0

SHA256
0b16beeb5734c17ed857e60d28b7e8de379d7e9ab04bdd9be8f9dd68f6c061e3

SHA512
e3e02121fd91076297e935c4b5449a7d6bfd42566250bf316634c6fbb050197f372a0cb12936263ac17caf59a4454f445e7248d1318a9a81de8ba1fe13f9056e

Download Submit
C:\Windows\system\aQYNbKR.exe

Filesize
1.5MB

MD5
c17172b87b5d44e0ac6793e05b67116f

SHA1
9b1ce92e673b8d30615bbeda27434c7e3e81b195

SHA256
91e425a8e6c36da153ae1504782ec9b8edc578418e0d37208a0f152cd1d89b77

SHA512
15423175cbfef73e9358782acc8b71264c24069d60136f1410edcc5e221c0c067a068eec085de6951bff154aea037331ea3709b46c316103b6864e4ced336f79

Download Submit
C:\Windows\system\aWVxujY.exe

Filesize
1.5MB

MD5
0bca3b6f9594f59146a8624662bfd82b

SHA1
61f4379df8798ade0048e6dc61b348cbbde6fcc0

SHA256
402b62920b5c001d7787595812f929fbda4ce12151b1c3ea7398d4173b096793

SHA512
d703e4224198b4f31e22ca2e6e1a995ba71a50bcc3c7fd8d4e94fa9622143793643d39b0e0ff0400a399487973417e2072edc93b74264d37477f618f24eae231

Download Submit
C:\Windows\system\caEiMlH.exe

Filesize
1.5MB

MD5
2285c2c52633af898565f3bd5a5cb7fc

SHA1
7967b273c770928ee3e01a4d31c73f3ad143a5c8

SHA256
32a05169804dde8717d8b54134ce85a2df7ea7376bed679ed46254b5d2dbe95c

SHA512
e86df4a9fa18d4aff49a3319ebc67bea7c7cde63eeda145a125dba72ea022d09816ec3a876a101309de50fd018b054a2814b2fb244ba51da88ed18b9efa2b275

Download Submit
C:\Windows\system\cnDyJHr.exe

Filesize
1.5MB

MD5
d7ec3fd5eca2df6158c4ccea9fa8d257

SHA1
3d2dbfd69ac80a6ec1f690c9a89b531ca24c6291

SHA256
69fcd6b00b6846ce184d6120fa438417d5115f83bab9a525c1eecf4662f714df

SHA512
dbfa1f909542723390ee029d5a5576cc0ffa6ebaf79ed6a7033e3d6679360d02388730bdd64c437e1a9e48cf1af07734e0506eb04bbcd670572ee664db412ff1

Download Submit
C:\Windows\system\eIbCvrx.exe

Filesize
1.5MB

MD5
75cac1955c5eef1981c2ea48d8d417d4

SHA1
cff01d5ae621c2a5ba75be34c541d0a5a87f2df3

SHA256
718ac5851bf2fa69f182593155f238222e6227cac2f29ad4967ee3fcfa8a9e22

SHA512
9cb51b01a7932ee18dfc9a61ed5e11a76a89c930f2a563cb26fb0f83af83867eb9ec188cd16121af63d7aefe9fd36ec158ce0c118ce86285cef0b7e02e99cc3f

Download Submit
C:\Windows\system\ePFVNlD.exe

Filesize
1.5MB

MD5
40b8fcb0b46ab5398ed570376aac1748

SHA1
730fc8c73805e2ad2b8d229f9ec2277f98f415d0

SHA256
92ce0b3676557eb66c292352b2174754d3b34de8dc4a7b6d0813620a9b8dc13e

SHA512
6e30c766de324096abb0b6e79f2b8baaea6ce0918d9c00239e506e32e6afba5d5208efdfd2ff2798f59b62d94779c230f50f27090eeccaed85f726058ebff9d5

Download Submit
C:\Windows\system\hdVpEPU.exe

Filesize
1.5MB

MD5
6b5551589c623a9839fad94b6318a025

SHA1
9793d4512300777b4206e6fffcb233fdaa6a9446

SHA256
a17e503dd5ac7ad40facab21e56c7e5c8e81ffbaca3f65b9268431a990545230

SHA512
afded36b60daa1b5416929f2cb2d76324c6196803f331c5d8cdc641fae00125556116ed86c23d8e4503e2984a59d5eacc489a24a45b609a3deeef3cf829ffd0e

Download Submit
C:\Windows\system\jmfshim.exe

Filesize
1.5MB

MD5
bf59b6ac5888f51c7c5cf77e134b404f

SHA1
c748e6ea59c0a55160c0788073d723064869ffb0

SHA256
a6bd8454d51cf61b9c3693dbd4ff6e485b93cb91b6197bf51423edbd9ee8f79c

SHA512
6ba4835f73050b13d6c45df7ae2f8a07cdadfbda6404bc297177c29b8ebc62edda4d1ef642b865cb9cf4a84adf07460d63bfafecfff26eb47a3a2e92e7c58f62

Download Submit
C:\Windows\system\lDSIzxD.exe

Filesize
1.5MB

MD5
d4f44dea13b7e59303534482d52b2be0

SHA1
648b91b53e141f434347dd5088b4a7fb0af53ab4

SHA256
651709efec9cabfd83d12f39cdb9f7f52c724e3d0b9de264026bebb38f5b7f27

SHA512
4a941aabc84b0d82c4e9b5384c894d5db2915181a388b2983212623591124fd2aaa8cb2237a717c00a8bd3157e45a9376ebe5b9583455b68831f308af111bf16

Download Submit
C:\Windows\system\lkRRGnc.exe

Filesize
1.5MB

MD5
7e3f4b86d49231c7576b4733d63050f2

SHA1
8783435ef3c048f4f57472c4aa251ab13618245b

SHA256
942bfca12a8330c61bbc7a58ae4d40249bbb6ff426ada2197d14eb7c582963e5

SHA512
57c84a67114c7f6bafc9646905ae9f87d3a736d7e6694fb912b00915e5740a3eda1212189a76f5b8a8bcfbeea58af363b27bbfe8eb33928321f4e7398e6616fe

Download Submit
C:\Windows\system\oSUbMen.exe

Filesize
1.5MB

MD5
6a733e95fedf0da8599566b8f2e6c757

SHA1
09857cae6eda4addd2364c054a48310a53ffbf5e

SHA256
746c6e1fe88f45338775436cd8961ae31bf1980dfcc370576aa4adfbf4253996

SHA512
4772ff3f47d851b3618eee6cdf4a9347be6e8b1685c28f06ddaa9744dfe8982ed1594fb63a5fd6667c9504f041f1123342c2afde8292d56c1244965cb845e5c9

Download Submit
C:\Windows\system\qBxXzIM.exe

Filesize
1.5MB

MD5
6adf8a5318dee805b8cf7dfe3e0a3063

SHA1
a9b15c10397d53ca2b3d66f85e5f51119c574d8d

SHA256
cc0d1ea81d25d940f3b1a10040ecf6943e620e802e70e45a19f4e95803b43c10

SHA512
240e071ce4495811404705a09aa619be5500aa144bda9cde19d04197cfe110b26ef8e9416e9d38b757df580743ec4c88540149e6fcf8c19b8aae875354091a82

Download Submit
C:\Windows\system\rcYhLVB.exe

Filesize
1.5MB

MD5
070363468815fcf8cb87b8303f01aeb3

SHA1
de15e0ccbde3bb34a2508b8a496976dd68a96606

SHA256
276137480f64a7283e97a0fe0c8c985448b68b3070b5f9b75858d26fbd021b38

SHA512
b6ab2b20ea344507795b078793f541f1f68624197aa568bc725e5f49f00eaf18a54a359b55d685eef537fdd96e0e57963cd62d4612d9c70bd3f645a03950c8d1

Download Submit
C:\Windows\system\yCdWOmy.exe

Filesize
1.5MB

MD5
5da1367c1531167d26acbbe1d7aef712

SHA1
64af03fe9171b940fae4f6d3e206b9ba378d02a9

SHA256
0afbabebfc17a4312d8a95acb16727cb3c6089a1d0456cbbe536b9ccb982d0d8

SHA512
7caf82fac91503641a98f10a042dc5bb5084783cf182788331c74e7368711646adb2b7601530b3de7899927641fcc4683953d22d9b1f8783725a4a41a89cfcc9

Download Submit
\Windows\system\RuIdldF.exe

Filesize
1.5MB

MD5
3d7a0c951b40ee785326dec59fd37358

SHA1
d37c9547c661810f37662e1c532cc00062efc508

SHA256
6baf521c2309e085ec148b45d0cb7c44b71eab44021511e248bfd2441be96f83

SHA512
99dba6e489e1d7257fea80b376d0e8ae66b830d4fe326c67990ff39a45afecb9b0257500bfb5210abc31c16dbc8a5ca6d0296858f364737ff5b90541f485c2f7

Download Submit
\Windows\system\XkWVGpP.exe

Filesize
1.5MB

MD5
3267ea1db0b5247c1331cac0797ee003

SHA1
d5652a958f7ba066b9521b7c1e2999a123411a42

SHA256
3718fbe70677e25acf1913d7dbe1a5df378cba4b0406fd42b9ee8f32bbd8c1a9

SHA512
e7ce47db0a3ba1c79bada4b2426d3be5d85fa8355d10c3cc62648f201cd7484450520596acd16f7f8f628e0d64b7cfd96d5beb64908e267169b8d7ec052385c8

Download Submit
\Windows\system\zbapWUO.exe

Filesize
1.5MB

MD5
0cf859599d8fdedef66fb9e383178486

SHA1
8ff13d346fe3127312404e42cf825b1fe502b51b

SHA256
7d7ce11f16855351c50014255c6f432036ba40e07d741b6616bad11a6ea603bf

SHA512
5fafe444ad18d862e79adba3f4e9a61c881a068043fdd333c08d4261e184781b60858472ba68e14ff6ac79ac3b0f1deb6993968161cbfc885777e0ff56940d66

Download Submit
memory/1036-3968-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1036-205-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1092-214-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/1092-3967-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2244-193-0x0000000002BE0000-0x0000000002FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-8-0x0000000002BE0000-0x0000000002FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-186-0x0000000002BE0000-0x0000000002FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-18-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2244-1-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2244-182-0x0000000002BE0000-0x0000000002FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2244-196-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2244-180-0x0000000002BE0000-0x0000000002FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-188-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-211-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2244-178-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2244-173-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2244-175-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2392-3965-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2392-184-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4072-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2436-187-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3969-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2528-174-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2568-181-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-3873-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-20-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2616-3875-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2644-179-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4032-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2688-4073-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2688-176-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2804-191-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-3970-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-4071-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2816-194-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2872-3881-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-10-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-21-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2984-158-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/2984-157-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/2984-170-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-224-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-289-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2984-22-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download