xmrig | 299cf7a50745b91f99e64d88c0f7109977d055302b639f9b4ccb34722e248914

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_99e49ed4601d256f09cff799de839ce0.exe
Size

1.5MB
MD5

99e49ed4601d256f09cff799de839ce0
SHA1

6ccd029e49929244c8cc28de4d6969ab7619017c
SHA256

299cf7a50745b91f99e64d88c0f7109977d055302b639f9b4ccb34722e248914
SHA512

4471f8a22d031b27fb33584885307ab123d57dbfb9837f2221c1d06cb2f565fd5e3f8d53e139e238e1f18f1bfa64363c612def23bbe615b04ec51689df505467
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbfCuZXejQ7:Lz071uv4BPMkHC0IlnASEx/mCuZOjQ7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral2/memory/2168-66-0x00007FF7E9FD0000-0x00007FF7EA3C2000-memory.dmp	xmrig
behavioral2/memory/3984-80-0x00007FF6D8840000-0x00007FF6D8C32000-memory.dmp	xmrig
behavioral2/memory/3384-95-0x00007FF6EDFF0000-0x00007FF6EE3E2000-memory.dmp	xmrig
behavioral2/memory/1520-102-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp	xmrig
behavioral2/memory/1284-108-0x00007FF781C80000-0x00007FF782072000-memory.dmp	xmrig
behavioral2/memory/3844-109-0x00007FF6F9860000-0x00007FF6F9C52000-memory.dmp	xmrig
behavioral2/memory/1312-107-0x00007FF6E7A40000-0x00007FF6E7E32000-memory.dmp	xmrig
behavioral2/memory/3432-106-0x00007FF677920000-0x00007FF677D12000-memory.dmp	xmrig
behavioral2/memory/1936-105-0x00007FF787F90000-0x00007FF788382000-memory.dmp	xmrig
behavioral2/memory/2004-104-0x00007FF619A40000-0x00007FF619E32000-memory.dmp	xmrig
behavioral2/memory/4844-99-0x00007FF6FCAF0000-0x00007FF6FCEE2000-memory.dmp	xmrig
behavioral2/memory/3316-98-0x00007FF66B6E0000-0x00007FF66BAD2000-memory.dmp	xmrig
behavioral2/memory/2444-81-0x00007FF765470000-0x00007FF765862000-memory.dmp	xmrig
behavioral2/memory/2944-40-0x00007FF6E4E50000-0x00007FF6E5242000-memory.dmp	xmrig
behavioral2/memory/4136-154-0x00007FF6C80A0000-0x00007FF6C8492000-memory.dmp	xmrig
behavioral2/memory/4400-149-0x00007FF635840000-0x00007FF635C32000-memory.dmp	xmrig
behavioral2/memory/3660-148-0x00007FF7AC3A0000-0x00007FF7AC792000-memory.dmp	xmrig
behavioral2/memory/1992-194-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	xmrig
behavioral2/memory/3552-2753-0x00007FF662350000-0x00007FF662742000-memory.dmp	xmrig
behavioral2/memory/5100-3151-0x00007FF7AE340000-0x00007FF7AE732000-memory.dmp	xmrig
behavioral2/memory/2444-3777-0x00007FF765470000-0x00007FF765862000-memory.dmp	xmrig
behavioral2/memory/3552-3783-0x00007FF662350000-0x00007FF662742000-memory.dmp	xmrig
behavioral2/memory/1284-3818-0x00007FF781C80000-0x00007FF782072000-memory.dmp	xmrig
behavioral2/memory/1520-3823-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp	xmrig
behavioral2/memory/3844-3832-0x00007FF6F9860000-0x00007FF6F9C52000-memory.dmp	xmrig
behavioral2/memory/1372-3906-0x00007FF713F80000-0x00007FF714372000-memory.dmp	xmrig
behavioral2/memory/3196-3907-0x00007FF7EE550000-0x00007FF7EE942000-memory.dmp	xmrig
behavioral2/memory/3660-4850-0x00007FF7AC3A0000-0x00007FF7AC792000-memory.dmp	xmrig
behavioral2/memory/4992-4878-0x00007FF788DC0000-0x00007FF7891B2000-memory.dmp	xmrig
behavioral2/memory/1992-4891-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	4860	powershell.exe
11	4860	powershell.exe
13	4860	powershell.exe
14	4860	powershell.exe
16	4860	powershell.exe
22	4860	powershell.exe
23	4860	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4860	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1632	DFIRoFu.exe
1936	iApObtF.exe
2944	QIUHQep.exe
3552	qnNiaZv.exe
2168	lFCGKqw.exe
3984	YKLIdul.exe
2444	hqoYPmR.exe
3432	OKhWfpu.exe
3384	XPVJDjq.exe
1312	YHsIWOX.exe
3316	cLJDPQK.exe
4844	kAyEQkr.exe
1520	AiqVooN.exe
1284	omewwBn.exe
2004	qMBOmtR.exe
3844	ZOJWzBW.exe
5100	DgytyiA.exe
4136	sRkijtK.exe
3660	qzSiWnm.exe
4400	sSOWfBS.exe
1372	NMqbphi.exe
4992	ITedPZl.exe
3196	hDuOdpm.exe
1992	KSjTeeE.exe
2648	zNFbwuS.exe
1704	hhnVHdK.exe
4888	NnzMaJm.exe
4520	Xqxqasg.exe
4308	bcmzwNl.exe
1408	leXHdiX.exe
184	nvfxsnD.exe
5084	nzTnRXn.exe
4092	syiroWD.exe
4360	MFvTJdC.exe
1260	oLqbGmK.exe
2336	MiNWIyv.exe
2272	tvytEuc.exe
744	AeWCXrJ.exe
2820	OFPnPKW.exe
1828	CcMdhRi.exe
4788	oFwIapJ.exe
1996	JrwjuTn.exe
780	tOLLgsJ.exe
1892	mFKeDQL.exe
1460	zBVqbUN.exe
4580	GwOudoz.exe
2956	dOzXMxy.exe
4960	KpxFEVd.exe
3584	TjoaFiL.exe
1012	ycFUoJB.exe
4420	FzpTvZr.exe
2160	IPnKdkc.exe
2216	ifEyxoj.exe
3936	LUKFoyf.exe
888	SeuRJux.exe
2856	ZUsgfIX.exe
3940	WNoJAgh.exe
3528	QFjGABv.exe
4728	Elhljnw.exe
4708	yhKPHYT.exe
3784	FyTrlZh.exe
4928	stkfRcv.exe
2288	hSmQdjK.exe
2812	NzyLyuh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-0-0x00007FF621D20000-0x00007FF622112000-memory.dmp	upx
behavioral2/memory/1632-13-0x00007FF735100000-0x00007FF7354F2000-memory.dmp	upx
behavioral2/files/0x00070000000234cc-18.dat	upx
behavioral2/files/0x00070000000234d0-29.dat	upx
behavioral2/files/0x00070000000234d2-36.dat	upx
behavioral2/files/0x00070000000234d3-59.dat	upx
behavioral2/memory/2168-66-0x00007FF7E9FD0000-0x00007FF7EA3C2000-memory.dmp	upx
behavioral2/files/0x00070000000234d5-75.dat	upx
behavioral2/memory/3984-80-0x00007FF6D8840000-0x00007FF6D8C32000-memory.dmp	upx
behavioral2/memory/3384-95-0x00007FF6EDFF0000-0x00007FF6EE3E2000-memory.dmp	upx
behavioral2/memory/1520-102-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp	upx
behavioral2/memory/1284-108-0x00007FF781C80000-0x00007FF782072000-memory.dmp	upx
behavioral2/memory/3844-109-0x00007FF6F9860000-0x00007FF6F9C52000-memory.dmp	upx
behavioral2/memory/1312-107-0x00007FF6E7A40000-0x00007FF6E7E32000-memory.dmp	upx
behavioral2/memory/3432-106-0x00007FF677920000-0x00007FF677D12000-memory.dmp	upx
behavioral2/memory/1936-105-0x00007FF787F90000-0x00007FF788382000-memory.dmp	upx
behavioral2/memory/2004-104-0x00007FF619A40000-0x00007FF619E32000-memory.dmp	upx
behavioral2/files/0x00080000000234c8-100.dat	upx
behavioral2/memory/4844-99-0x00007FF6FCAF0000-0x00007FF6FCEE2000-memory.dmp	upx
behavioral2/memory/3316-98-0x00007FF66B6E0000-0x00007FF66BAD2000-memory.dmp	upx
behavioral2/files/0x00070000000234d8-96.dat	upx
behavioral2/files/0x00070000000234d6-83.dat	upx
behavioral2/memory/2444-81-0x00007FF765470000-0x00007FF765862000-memory.dmp	upx
behavioral2/files/0x00070000000234d7-77.dat	upx
behavioral2/files/0x00070000000234d4-73.dat	upx
behavioral2/memory/3552-57-0x00007FF662350000-0x00007FF662742000-memory.dmp	upx
behavioral2/files/0x00070000000234d1-54.dat	upx
behavioral2/files/0x00070000000234ce-46.dat	upx
behavioral2/files/0x00070000000234cb-45.dat	upx
behavioral2/memory/2944-40-0x00007FF6E4E50000-0x00007FF6E5242000-memory.dmp	upx
behavioral2/files/0x00070000000234cf-38.dat	upx
behavioral2/files/0x00070000000234cd-32.dat	upx
behavioral2/files/0x00090000000234c4-21.dat	upx
behavioral2/files/0x00070000000234d9-117.dat	upx
behavioral2/files/0x000200000001e6ff-141.dat	upx
behavioral2/memory/4136-154-0x00007FF6C80A0000-0x00007FF6C8492000-memory.dmp	upx
behavioral2/files/0x00080000000234da-156.dat	upx
behavioral2/files/0x000200000001e701-155.dat	upx
behavioral2/memory/4400-149-0x00007FF635840000-0x00007FF635C32000-memory.dmp	upx
behavioral2/memory/3660-148-0x00007FF7AC3A0000-0x00007FF7AC792000-memory.dmp	upx
behavioral2/memory/5100-139-0x00007FF7AE340000-0x00007FF7AE732000-memory.dmp	upx
behavioral2/files/0x000300000001e4d3-133.dat	upx
behavioral2/files/0x000200000001e6fe-132.dat	upx
behavioral2/files/0x000300000001e4d4-126.dat	upx
behavioral2/files/0x00070000000234de-190.dat	upx
behavioral2/memory/1992-194-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp	upx
behavioral2/files/0x00070000000234e1-212.dat	upx
behavioral2/files/0x00070000000234e4-214.dat	upx
behavioral2/files/0x00080000000234db-191.dat	upx
behavioral2/memory/4992-188-0x00007FF788DC0000-0x00007FF7891B2000-memory.dmp	upx
behavioral2/memory/3196-168-0x00007FF7EE550000-0x00007FF7EE942000-memory.dmp	upx
behavioral2/memory/1372-160-0x00007FF713F80000-0x00007FF714372000-memory.dmp	upx
behavioral2/files/0x00070000000234e7-371.dat	upx
behavioral2/files/0x000700000002351e-376.dat	upx
behavioral2/files/0x000700000002351f-379.dat	upx
behavioral2/files/0x0007000000023520-388.dat	upx
behavioral2/files/0x0007000000023523-395.dat	upx
behavioral2/files/0x0007000000023522-393.dat	upx
behavioral2/memory/3552-2753-0x00007FF662350000-0x00007FF662742000-memory.dmp	upx
behavioral2/memory/5100-3151-0x00007FF7AE340000-0x00007FF7AE732000-memory.dmp	upx
behavioral2/memory/2444-3777-0x00007FF765470000-0x00007FF765862000-memory.dmp	upx
behavioral2/memory/3552-3783-0x00007FF662350000-0x00007FF662742000-memory.dmp	upx
behavioral2/memory/1284-3818-0x00007FF781C80000-0x00007FF782072000-memory.dmp	upx
behavioral2/memory/1520-3823-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PnzksQD.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\NBVyZRU.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\eVvVDpp.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\nqKgJxJ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\HbPeKPA.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\sSIcWDj.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\WCfLusm.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\DiMOOcW.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\sAdAQfu.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\bRDiAeN.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ARKyTch.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\iQuVGZY.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\nXFkflN.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\cGPAWeK.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\uTkPHtd.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ZQOIBkE.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\GrdsNxx.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\lnLqpGh.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\qQDCIun.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\FmbMczv.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\KmSvARI.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\wBLhCcJ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\XpvOQZY.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\zbaPfQn.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\WjINVsQ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\kdzlQdE.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gjkHmdR.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\jMMVjxV.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\TSQUVGv.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\KMgFRBQ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\IKCzNmu.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\fttxgUt.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\oxFlPVU.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\cJehQdE.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\sWbWKrM.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gdOxftI.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\JvPeRMK.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\bbLYDVE.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\wIkhBRZ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ligyZsg.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\gHxtQrg.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\eENjQKY.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ZgOccMf.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\UpKXweV.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\XpZgXet.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\OVJmXlD.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\cqpzkUr.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\HrtDJXv.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\VLALCZu.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\PDFBdPh.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\UpqiLmG.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\SezETXL.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\pEROOnp.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\YKkRhpR.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\zNjGtkC.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\SPMIrPO.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\sskFevH.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\PgdrlpR.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\ujwmiEZ.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\AcKKrhb.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\pFXIyJp.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\etxwnsp.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\FGciHYM.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
File created	C:\Windows\System\nDBxRyo.exe	virussign.com_99e49ed4601d256f09cff799de839ce0.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeLockMemoryPrivilege	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe
Token: SeLockMemoryPrivilege	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4860	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	84
PID 216 wrote to memory of 4860	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	84
PID 216 wrote to memory of 1632	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	85
PID 216 wrote to memory of 1632	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	85
PID 216 wrote to memory of 3552	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	86
PID 216 wrote to memory of 3552	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	86
PID 216 wrote to memory of 1936	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	87
PID 216 wrote to memory of 1936	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	87
PID 216 wrote to memory of 2944	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	88
PID 216 wrote to memory of 2944	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	88
PID 216 wrote to memory of 2168	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	89
PID 216 wrote to memory of 2168	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	89
PID 216 wrote to memory of 3984	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	90
PID 216 wrote to memory of 3984	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	90
PID 216 wrote to memory of 2444	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	91
PID 216 wrote to memory of 2444	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	91
PID 216 wrote to memory of 3432	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	92
PID 216 wrote to memory of 3432	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	92
PID 216 wrote to memory of 3384	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	93
PID 216 wrote to memory of 3384	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	93
PID 216 wrote to memory of 1312	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	94
PID 216 wrote to memory of 1312	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	94
PID 216 wrote to memory of 3316	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	95
PID 216 wrote to memory of 3316	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	95
PID 216 wrote to memory of 4844	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	96
PID 216 wrote to memory of 4844	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	96
PID 216 wrote to memory of 1284	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	97
PID 216 wrote to memory of 1284	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	97
PID 216 wrote to memory of 1520	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	98
PID 216 wrote to memory of 1520	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	98
PID 216 wrote to memory of 2004	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	99
PID 216 wrote to memory of 2004	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	99
PID 216 wrote to memory of 3844	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	100
PID 216 wrote to memory of 3844	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	100
PID 216 wrote to memory of 5100	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	101
PID 216 wrote to memory of 5100	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	101
PID 216 wrote to memory of 3660	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	102
PID 216 wrote to memory of 3660	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	102
PID 216 wrote to memory of 4136	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	103
PID 216 wrote to memory of 4136	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	103
PID 216 wrote to memory of 4400	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	104
PID 216 wrote to memory of 4400	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	104
PID 216 wrote to memory of 1372	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	105
PID 216 wrote to memory of 1372	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	105
PID 216 wrote to memory of 4992	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	106
PID 216 wrote to memory of 4992	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	106
PID 216 wrote to memory of 3196	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	107
PID 216 wrote to memory of 3196	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	107
PID 216 wrote to memory of 1992	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	108
PID 216 wrote to memory of 1992	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	108
PID 216 wrote to memory of 2648	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	109
PID 216 wrote to memory of 2648	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	109
PID 216 wrote to memory of 1704	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	111
PID 216 wrote to memory of 1704	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	111
PID 216 wrote to memory of 4888	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	112
PID 216 wrote to memory of 4888	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	112
PID 216 wrote to memory of 4520	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	114
PID 216 wrote to memory of 4520	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	114
PID 216 wrote to memory of 4308	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	115
PID 216 wrote to memory of 4308	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	115
PID 216 wrote to memory of 1408	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	116
PID 216 wrote to memory of 1408	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	116
PID 216 wrote to memory of 184	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	117
PID 216 wrote to memory of 184	216	virussign.com_99e49ed4601d256f09cff799de839ce0.exe	117

C:\Users\Admin\AppData\Local\Temp\virussign.com_99e49ed4601d256f09cff799de839ce0.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_99e49ed4601d256f09cff799de839ce0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\System\DFIRoFu.exe
  C:\Windows\System\DFIRoFu.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\qnNiaZv.exe
  C:\Windows\System\qnNiaZv.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\iApObtF.exe
  C:\Windows\System\iApObtF.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QIUHQep.exe
  C:\Windows\System\QIUHQep.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\lFCGKqw.exe
  C:\Windows\System\lFCGKqw.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\YKLIdul.exe
  C:\Windows\System\YKLIdul.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\hqoYPmR.exe
  C:\Windows\System\hqoYPmR.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\OKhWfpu.exe
  C:\Windows\System\OKhWfpu.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\XPVJDjq.exe
  C:\Windows\System\XPVJDjq.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\YHsIWOX.exe
  C:\Windows\System\YHsIWOX.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\cLJDPQK.exe
  C:\Windows\System\cLJDPQK.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\kAyEQkr.exe
  C:\Windows\System\kAyEQkr.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\omewwBn.exe
  C:\Windows\System\omewwBn.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\AiqVooN.exe
  C:\Windows\System\AiqVooN.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\qMBOmtR.exe
  C:\Windows\System\qMBOmtR.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ZOJWzBW.exe
  C:\Windows\System\ZOJWzBW.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\DgytyiA.exe
  C:\Windows\System\DgytyiA.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\qzSiWnm.exe
  C:\Windows\System\qzSiWnm.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\sRkijtK.exe
  C:\Windows\System\sRkijtK.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\sSOWfBS.exe
  C:\Windows\System\sSOWfBS.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\NMqbphi.exe
  C:\Windows\System\NMqbphi.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ITedPZl.exe
  C:\Windows\System\ITedPZl.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\hDuOdpm.exe
  C:\Windows\System\hDuOdpm.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\KSjTeeE.exe
  C:\Windows\System\KSjTeeE.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\zNFbwuS.exe
  C:\Windows\System\zNFbwuS.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\hhnVHdK.exe
  C:\Windows\System\hhnVHdK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\NnzMaJm.exe
  C:\Windows\System\NnzMaJm.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\Xqxqasg.exe
  C:\Windows\System\Xqxqasg.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\bcmzwNl.exe
  C:\Windows\System\bcmzwNl.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\leXHdiX.exe
  C:\Windows\System\leXHdiX.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\nvfxsnD.exe
  C:\Windows\System\nvfxsnD.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\nzTnRXn.exe
  C:\Windows\System\nzTnRXn.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\syiroWD.exe
  C:\Windows\System\syiroWD.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\MFvTJdC.exe
  C:\Windows\System\MFvTJdC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\oLqbGmK.exe
  C:\Windows\System\oLqbGmK.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\MiNWIyv.exe
  C:\Windows\System\MiNWIyv.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\tvytEuc.exe
  C:\Windows\System\tvytEuc.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\AeWCXrJ.exe
  C:\Windows\System\AeWCXrJ.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\OFPnPKW.exe
  C:\Windows\System\OFPnPKW.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\CcMdhRi.exe
  C:\Windows\System\CcMdhRi.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\oFwIapJ.exe
  C:\Windows\System\oFwIapJ.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\JrwjuTn.exe
  C:\Windows\System\JrwjuTn.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\mFKeDQL.exe
  C:\Windows\System\mFKeDQL.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\tOLLgsJ.exe
  C:\Windows\System\tOLLgsJ.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\zBVqbUN.exe
  C:\Windows\System\zBVqbUN.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\GwOudoz.exe
  C:\Windows\System\GwOudoz.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\dOzXMxy.exe
  C:\Windows\System\dOzXMxy.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\KpxFEVd.exe
  C:\Windows\System\KpxFEVd.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\TjoaFiL.exe
  C:\Windows\System\TjoaFiL.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ycFUoJB.exe
  C:\Windows\System\ycFUoJB.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ifEyxoj.exe
  C:\Windows\System\ifEyxoj.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\FzpTvZr.exe
  C:\Windows\System\FzpTvZr.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\IPnKdkc.exe
  C:\Windows\System\IPnKdkc.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\LUKFoyf.exe
  C:\Windows\System\LUKFoyf.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\SeuRJux.exe
  C:\Windows\System\SeuRJux.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ZUsgfIX.exe
  C:\Windows\System\ZUsgfIX.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WNoJAgh.exe
  C:\Windows\System\WNoJAgh.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\QFjGABv.exe
  C:\Windows\System\QFjGABv.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\Elhljnw.exe
  C:\Windows\System\Elhljnw.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\yhKPHYT.exe
  C:\Windows\System\yhKPHYT.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\FyTrlZh.exe
  C:\Windows\System\FyTrlZh.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\stkfRcv.exe
  C:\Windows\System\stkfRcv.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\hSmQdjK.exe
  C:\Windows\System\hSmQdjK.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\THEdMnm.exe
  C:\Windows\System\THEdMnm.exe
  2⤵
  PID:1752
- C:\Windows\System\NzyLyuh.exe
  C:\Windows\System\NzyLyuh.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QbNhCFl.exe
  C:\Windows\System\QbNhCFl.exe
  2⤵
  PID:428
- C:\Windows\System\RNUViEL.exe
  C:\Windows\System\RNUViEL.exe
  2⤵
  PID:3260
- C:\Windows\System\NctNDyJ.exe
  C:\Windows\System\NctNDyJ.exe
  2⤵
  PID:3084
- C:\Windows\System\zQJhXMu.exe
  C:\Windows\System\zQJhXMu.exe
  2⤵
  PID:348
- C:\Windows\System\kNslMvm.exe
  C:\Windows\System\kNslMvm.exe
  2⤵
  PID:5092
- C:\Windows\System\COLGJli.exe
  C:\Windows\System\COLGJli.exe
  2⤵
  PID:4784
- C:\Windows\System\MsNvDEq.exe
  C:\Windows\System\MsNvDEq.exe
  2⤵
  PID:3816
- C:\Windows\System\xkDwhIh.exe
  C:\Windows\System\xkDwhIh.exe
  2⤵
  PID:4048
- C:\Windows\System\uARIJNY.exe
  C:\Windows\System\uARIJNY.exe
  2⤵
  PID:3516
- C:\Windows\System\qeHWYfp.exe
  C:\Windows\System\qeHWYfp.exe
  2⤵
  PID:3548
- C:\Windows\System\VZeJmvU.exe
  C:\Windows\System\VZeJmvU.exe
  2⤵
  PID:1448
- C:\Windows\System\dvkgfrG.exe
  C:\Windows\System\dvkgfrG.exe
  2⤵
  PID:3416
- C:\Windows\System\ffyntqy.exe
  C:\Windows\System\ffyntqy.exe
  2⤵
  PID:112
- C:\Windows\System\NWiXvXd.exe
  C:\Windows\System\NWiXvXd.exe
  2⤵
  PID:4476
- C:\Windows\System\kdrZYTe.exe
  C:\Windows\System\kdrZYTe.exe
  2⤵
  PID:1684
- C:\Windows\System\iCwZIAF.exe
  C:\Windows\System\iCwZIAF.exe
  2⤵
  PID:3912
- C:\Windows\System\jTjKxBF.exe
  C:\Windows\System\jTjKxBF.exe
  2⤵
  PID:2964
- C:\Windows\System\ZwWdaGO.exe
  C:\Windows\System\ZwWdaGO.exe
  2⤵
  PID:4912
- C:\Windows\System\ZRRDMgy.exe
  C:\Windows\System\ZRRDMgy.exe
  2⤵
  PID:1896
- C:\Windows\System\STiqgwz.exe
  C:\Windows\System\STiqgwz.exe
  2⤵
  PID:2100
- C:\Windows\System\oKLUWMh.exe
  C:\Windows\System\oKLUWMh.exe
  2⤵
  PID:2092
- C:\Windows\System\cFJSRNe.exe
  C:\Windows\System\cFJSRNe.exe
  2⤵
  PID:3012
- C:\Windows\System\AVluted.exe
  C:\Windows\System\AVluted.exe
  2⤵
  PID:4436
- C:\Windows\System\DHANeZs.exe
  C:\Windows\System\DHANeZs.exe
  2⤵
  PID:4648
- C:\Windows\System\gTmISno.exe
  C:\Windows\System\gTmISno.exe
  2⤵
  PID:4536
- C:\Windows\System\EUxFPCS.exe
  C:\Windows\System\EUxFPCS.exe
  2⤵
  PID:1988
- C:\Windows\System\mQilVAf.exe
  C:\Windows\System\mQilVAf.exe
  2⤵
  PID:1544
- C:\Windows\System\IhHmlMk.exe
  C:\Windows\System\IhHmlMk.exe
  2⤵
  PID:5144
- C:\Windows\System\SNzbPNP.exe
  C:\Windows\System\SNzbPNP.exe
  2⤵
  PID:5176
- C:\Windows\System\nYfIQta.exe
  C:\Windows\System\nYfIQta.exe
  2⤵
  PID:5208
- C:\Windows\System\aVmbISf.exe
  C:\Windows\System\aVmbISf.exe
  2⤵
  PID:5224
- C:\Windows\System\WvhOrOz.exe
  C:\Windows\System\WvhOrOz.exe
  2⤵
  PID:5268
- C:\Windows\System\nwwDYqc.exe
  C:\Windows\System\nwwDYqc.exe
  2⤵
  PID:5288
- C:\Windows\System\NvrgTVH.exe
  C:\Windows\System\NvrgTVH.exe
  2⤵
  PID:5308
- C:\Windows\System\zhssJNh.exe
  C:\Windows\System\zhssJNh.exe
  2⤵
  PID:5328
- C:\Windows\System\fwYIOyD.exe
  C:\Windows\System\fwYIOyD.exe
  2⤵
  PID:5368
- C:\Windows\System\IswlHkB.exe
  C:\Windows\System\IswlHkB.exe
  2⤵
  PID:5408
- C:\Windows\System\dyxYJun.exe
  C:\Windows\System\dyxYJun.exe
  2⤵
  PID:5464
- C:\Windows\System\WCCExeZ.exe
  C:\Windows\System\WCCExeZ.exe
  2⤵
  PID:5480
- C:\Windows\System\MGqyzcE.exe
  C:\Windows\System\MGqyzcE.exe
  2⤵
  PID:5500
- C:\Windows\System\WJEDCRB.exe
  C:\Windows\System\WJEDCRB.exe
  2⤵
  PID:5516
- C:\Windows\System\kCtVlNL.exe
  C:\Windows\System\kCtVlNL.exe
  2⤵
  PID:5536
- C:\Windows\System\RLWGaYO.exe
  C:\Windows\System\RLWGaYO.exe
  2⤵
  PID:5556
- C:\Windows\System\NVNkprO.exe
  C:\Windows\System\NVNkprO.exe
  2⤵
  PID:5596
- C:\Windows\System\oaJzFgk.exe
  C:\Windows\System\oaJzFgk.exe
  2⤵
  PID:5616
- C:\Windows\System\YOVZeWU.exe
  C:\Windows\System\YOVZeWU.exe
  2⤵
  PID:5636
- C:\Windows\System\BGDLaiK.exe
  C:\Windows\System\BGDLaiK.exe
  2⤵
  PID:5656
- C:\Windows\System\uHgKUnV.exe
  C:\Windows\System\uHgKUnV.exe
  2⤵
  PID:5676
- C:\Windows\System\JsFHJjf.exe
  C:\Windows\System\JsFHJjf.exe
  2⤵
  PID:5708
- C:\Windows\System\hOMvjqK.exe
  C:\Windows\System\hOMvjqK.exe
  2⤵
  PID:5756
- C:\Windows\System\zMJJmnx.exe
  C:\Windows\System\zMJJmnx.exe
  2⤵
  PID:5800
- C:\Windows\System\Vrnhxtn.exe
  C:\Windows\System\Vrnhxtn.exe
  2⤵
  PID:5828
- C:\Windows\System\UGMNIcx.exe
  C:\Windows\System\UGMNIcx.exe
  2⤵
  PID:5844
- C:\Windows\System\PckIwki.exe
  C:\Windows\System\PckIwki.exe
  2⤵
  PID:5872
- C:\Windows\System\Ragtclj.exe
  C:\Windows\System\Ragtclj.exe
  2⤵
  PID:5888
- C:\Windows\System\QrBdCBP.exe
  C:\Windows\System\QrBdCBP.exe
  2⤵
  PID:5928
- C:\Windows\System\agStfxP.exe
  C:\Windows\System\agStfxP.exe
  2⤵
  PID:5948
- C:\Windows\System\nkXaAOF.exe
  C:\Windows\System\nkXaAOF.exe
  2⤵
  PID:5992
- C:\Windows\System\sHCFOxm.exe
  C:\Windows\System\sHCFOxm.exe
  2⤵
  PID:6064
- C:\Windows\System\LaNIMZP.exe
  C:\Windows\System\LaNIMZP.exe
  2⤵
  PID:6088
- C:\Windows\System\PrbyzdY.exe
  C:\Windows\System\PrbyzdY.exe
  2⤵
  PID:6104
- C:\Windows\System\iGLwiAi.exe
  C:\Windows\System\iGLwiAi.exe
  2⤵
  PID:6120
- C:\Windows\System\FDoArom.exe
  C:\Windows\System\FDoArom.exe
  2⤵
  PID:6140
- C:\Windows\System\berPzdz.exe
  C:\Windows\System\berPzdz.exe
  2⤵
  PID:5168
- C:\Windows\System\xBtrsSG.exe
  C:\Windows\System\xBtrsSG.exe
  2⤵
  PID:5256
- C:\Windows\System\wUucVDO.exe
  C:\Windows\System\wUucVDO.exe
  2⤵
  PID:5300
- C:\Windows\System\sCFQuAB.exe
  C:\Windows\System\sCFQuAB.exe
  2⤵
  PID:5380
- C:\Windows\System\diQTJTC.exe
  C:\Windows\System\diQTJTC.exe
  2⤵
  PID:5416
- C:\Windows\System\gVzdqsw.exe
  C:\Windows\System\gVzdqsw.exe
  2⤵
  PID:5456
- C:\Windows\System\wwcmziY.exe
  C:\Windows\System\wwcmziY.exe
  2⤵
  PID:5532
- C:\Windows\System\pOSABZp.exe
  C:\Windows\System\pOSABZp.exe
  2⤵
  PID:5576
- C:\Windows\System\QZQZyVg.exe
  C:\Windows\System\QZQZyVg.exe
  2⤵
  PID:2264
- C:\Windows\System\ezJgxhG.exe
  C:\Windows\System\ezJgxhG.exe
  2⤵
  PID:5588
- C:\Windows\System\ogSgyLy.exe
  C:\Windows\System\ogSgyLy.exe
  2⤵
  PID:5644
- C:\Windows\System\QXcvMwM.exe
  C:\Windows\System\QXcvMwM.exe
  2⤵
  PID:5724
- C:\Windows\System\keGlHyq.exe
  C:\Windows\System\keGlHyq.exe
  2⤵
  PID:5748
- C:\Windows\System\mNIjlmw.exe
  C:\Windows\System\mNIjlmw.exe
  2⤵
  PID:5884
- C:\Windows\System\NgQSivW.exe
  C:\Windows\System\NgQSivW.exe
  2⤵
  PID:5840
- C:\Windows\System\LPimCWM.exe
  C:\Windows\System\LPimCWM.exe
  2⤵
  PID:5956
- C:\Windows\System\CRAeRgZ.exe
  C:\Windows\System\CRAeRgZ.exe
  2⤵
  PID:864
- C:\Windows\System\UqtitXq.exe
  C:\Windows\System\UqtitXq.exe
  2⤵
  PID:5244
- C:\Windows\System\pGtMewQ.exe
  C:\Windows\System\pGtMewQ.exe
  2⤵
  PID:5496
- C:\Windows\System\jMCuAde.exe
  C:\Windows\System\jMCuAde.exe
  2⤵
  PID:5880
- C:\Windows\System\fwypEbf.exe
  C:\Windows\System\fwypEbf.exe
  2⤵
  PID:440
- C:\Windows\System\SqicvRF.exe
  C:\Windows\System\SqicvRF.exe
  2⤵
  PID:5940
- C:\Windows\System\MbrQsDT.exe
  C:\Windows\System\MbrQsDT.exe
  2⤵
  PID:5568
- C:\Windows\System\VHwlBAg.exe
  C:\Windows\System\VHwlBAg.exe
  2⤵
  PID:5252
- C:\Windows\System\hqlFLjC.exe
  C:\Windows\System\hqlFLjC.exe
  2⤵
  PID:5692
- C:\Windows\System\JMiPBtY.exe
  C:\Windows\System\JMiPBtY.exe
  2⤵
  PID:5612
- C:\Windows\System\GcTGUEh.exe
  C:\Windows\System\GcTGUEh.exe
  2⤵
  PID:5220
- C:\Windows\System\XDJVjLX.exe
  C:\Windows\System\XDJVjLX.exe
  2⤵
  PID:5628
- C:\Windows\System\DlTgXUd.exe
  C:\Windows\System\DlTgXUd.exe
  2⤵
  PID:6160
- C:\Windows\System\cgNFAQY.exe
  C:\Windows\System\cgNFAQY.exe
  2⤵
  PID:6180
- C:\Windows\System\pbRQjqo.exe
  C:\Windows\System\pbRQjqo.exe
  2⤵
  PID:6196
- C:\Windows\System\DnSlrdw.exe
  C:\Windows\System\DnSlrdw.exe
  2⤵
  PID:6220
- C:\Windows\System\lonDaVY.exe
  C:\Windows\System\lonDaVY.exe
  2⤵
  PID:6244
- C:\Windows\System\ameTovk.exe
  C:\Windows\System\ameTovk.exe
  2⤵
  PID:6272
- C:\Windows\System\VpDRRUZ.exe
  C:\Windows\System\VpDRRUZ.exe
  2⤵
  PID:6288
- C:\Windows\System\ehscJjD.exe
  C:\Windows\System\ehscJjD.exe
  2⤵
  PID:6308
- C:\Windows\System\ozvFZMQ.exe
  C:\Windows\System\ozvFZMQ.exe
  2⤵
  PID:6348
- C:\Windows\System\xKBhjYJ.exe
  C:\Windows\System\xKBhjYJ.exe
  2⤵
  PID:6368
- C:\Windows\System\aXJGfod.exe
  C:\Windows\System\aXJGfod.exe
  2⤵
  PID:6448
- C:\Windows\System\BjEDdGu.exe
  C:\Windows\System\BjEDdGu.exe
  2⤵
  PID:6500
- C:\Windows\System\KIByYmj.exe
  C:\Windows\System\KIByYmj.exe
  2⤵
  PID:6520
- C:\Windows\System\SepzbLp.exe
  C:\Windows\System\SepzbLp.exe
  2⤵
  PID:6536
- C:\Windows\System\JRwbbnZ.exe
  C:\Windows\System\JRwbbnZ.exe
  2⤵
  PID:6560
- C:\Windows\System\iFgjrqK.exe
  C:\Windows\System\iFgjrqK.exe
  2⤵
  PID:6576
- C:\Windows\System\yIBCnGS.exe
  C:\Windows\System\yIBCnGS.exe
  2⤵
  PID:6600
- C:\Windows\System\CMqxpae.exe
  C:\Windows\System\CMqxpae.exe
  2⤵
  PID:6620
- C:\Windows\System\NeQNDxe.exe
  C:\Windows\System\NeQNDxe.exe
  2⤵
  PID:6660
- C:\Windows\System\UdaQIkl.exe
  C:\Windows\System\UdaQIkl.exe
  2⤵
  PID:6676
- C:\Windows\System\fcNsiuM.exe
  C:\Windows\System\fcNsiuM.exe
  2⤵
  PID:6700
- C:\Windows\System\TzxAvZX.exe
  C:\Windows\System\TzxAvZX.exe
  2⤵
  PID:6720
- C:\Windows\System\GftcpZf.exe
  C:\Windows\System\GftcpZf.exe
  2⤵
  PID:6740
- C:\Windows\System\xmDAToL.exe
  C:\Windows\System\xmDAToL.exe
  2⤵
  PID:6760
- C:\Windows\System\wWDIdSn.exe
  C:\Windows\System\wWDIdSn.exe
  2⤵
  PID:6780
- C:\Windows\System\usomrYf.exe
  C:\Windows\System\usomrYf.exe
  2⤵
  PID:6832
- C:\Windows\System\mvVJOES.exe
  C:\Windows\System\mvVJOES.exe
  2⤵
  PID:6888
- C:\Windows\System\sLtBDzR.exe
  C:\Windows\System\sLtBDzR.exe
  2⤵
  PID:6904
- C:\Windows\System\sSFIPEa.exe
  C:\Windows\System\sSFIPEa.exe
  2⤵
  PID:6952
- C:\Windows\System\jjSEjNA.exe
  C:\Windows\System\jjSEjNA.exe
  2⤵
  PID:6972
- C:\Windows\System\ZtNnKPl.exe
  C:\Windows\System\ZtNnKPl.exe
  2⤵
  PID:7024
- C:\Windows\System\MvUkYZh.exe
  C:\Windows\System\MvUkYZh.exe
  2⤵
  PID:7060
- C:\Windows\System\oePfNdH.exe
  C:\Windows\System\oePfNdH.exe
  2⤵
  PID:7076
- C:\Windows\System\gbZPbBh.exe
  C:\Windows\System\gbZPbBh.exe
  2⤵
  PID:7100
- C:\Windows\System\gWahbQf.exe
  C:\Windows\System\gWahbQf.exe
  2⤵
  PID:7124
- C:\Windows\System\mNomDeZ.exe
  C:\Windows\System\mNomDeZ.exe
  2⤵
  PID:7144
- C:\Windows\System\DdScjbp.exe
  C:\Windows\System\DdScjbp.exe
  2⤵
  PID:6032
- C:\Windows\System\tKdQasN.exe
  C:\Windows\System\tKdQasN.exe
  2⤵
  PID:6156
- C:\Windows\System\hKVDauc.exe
  C:\Windows\System\hKVDauc.exe
  2⤵
  PID:5296
- C:\Windows\System\osCgDdx.exe
  C:\Windows\System\osCgDdx.exe
  2⤵
  PID:6284
- C:\Windows\System\WWjolPs.exe
  C:\Windows\System\WWjolPs.exe
  2⤵
  PID:6236
- C:\Windows\System\SOhVuHz.exe
  C:\Windows\System\SOhVuHz.exe
  2⤵
  PID:6468
- C:\Windows\System\LpLPMVS.exe
  C:\Windows\System\LpLPMVS.exe
  2⤵
  PID:6612
- C:\Windows\System\ClyMACO.exe
  C:\Windows\System\ClyMACO.exe
  2⤵
  PID:6656
- C:\Windows\System\UrisJoz.exe
  C:\Windows\System\UrisJoz.exe
  2⤵
  PID:6652
- C:\Windows\System\SKiHDGn.exe
  C:\Windows\System\SKiHDGn.exe
  2⤵
  PID:6752
- C:\Windows\System\QkNNVHR.exe
  C:\Windows\System\QkNNVHR.exe
  2⤵
  PID:6844
- C:\Windows\System\HJJepME.exe
  C:\Windows\System\HJJepME.exe
  2⤵
  PID:6868
- C:\Windows\System\fEIUkRt.exe
  C:\Windows\System\fEIUkRt.exe
  2⤵
  PID:6992
- C:\Windows\System\rDwARZa.exe
  C:\Windows\System\rDwARZa.exe
  2⤵
  PID:6940
- C:\Windows\System\POdDhiq.exe
  C:\Windows\System\POdDhiq.exe
  2⤵
  PID:7044
- C:\Windows\System\MTMcBmI.exe
  C:\Windows\System\MTMcBmI.exe
  2⤵
  PID:7072
- C:\Windows\System\rortJmt.exe
  C:\Windows\System\rortJmt.exe
  2⤵
  PID:7108
- C:\Windows\System\kkHBRFi.exe
  C:\Windows\System\kkHBRFi.exe
  2⤵
  PID:6004
- C:\Windows\System\cHoeUDE.exe
  C:\Windows\System\cHoeUDE.exe
  2⤵
  PID:6304
- C:\Windows\System\asxSzYm.exe
  C:\Windows\System\asxSzYm.exe
  2⤵
  PID:6172
- C:\Windows\System\mlmANiM.exe
  C:\Windows\System\mlmANiM.exe
  2⤵
  PID:6712
- C:\Windows\System\ZLvvQZh.exe
  C:\Windows\System\ZLvvQZh.exe
  2⤵
  PID:6732
- C:\Windows\System\pOSbBRc.exe
  C:\Windows\System\pOSbBRc.exe
  2⤵
  PID:6828
- C:\Windows\System\xrqrmOd.exe
  C:\Windows\System\xrqrmOd.exe
  2⤵
  PID:6984
- C:\Windows\System\bdQaUkd.exe
  C:\Windows\System\bdQaUkd.exe
  2⤵
  PID:7068
- C:\Windows\System\SkOpGkz.exe
  C:\Windows\System\SkOpGkz.exe
  2⤵
  PID:7152
- C:\Windows\System\biVrLLW.exe
  C:\Windows\System\biVrLLW.exe
  2⤵
  PID:5492
- C:\Windows\System\JKCsBIC.exe
  C:\Windows\System\JKCsBIC.exe
  2⤵
  PID:7188
- C:\Windows\System\WMLSnIY.exe
  C:\Windows\System\WMLSnIY.exe
  2⤵
  PID:7208
- C:\Windows\System\brWNcEJ.exe
  C:\Windows\System\brWNcEJ.exe
  2⤵
  PID:7228
- C:\Windows\System\PNpmqta.exe
  C:\Windows\System\PNpmqta.exe
  2⤵
  PID:7244
- C:\Windows\System\fKmEQxI.exe
  C:\Windows\System\fKmEQxI.exe
  2⤵
  PID:7264
- C:\Windows\System\mlsBLOY.exe
  C:\Windows\System\mlsBLOY.exe
  2⤵
  PID:7280
- C:\Windows\System\wvEqCpa.exe
  C:\Windows\System\wvEqCpa.exe
  2⤵
  PID:7328
- C:\Windows\System\YmUhZgq.exe
  C:\Windows\System\YmUhZgq.exe
  2⤵
  PID:7348
- C:\Windows\System\mZjtwXN.exe
  C:\Windows\System\mZjtwXN.exe
  2⤵
  PID:7368
- C:\Windows\System\ppOfRJn.exe
  C:\Windows\System\ppOfRJn.exe
  2⤵
  PID:7428
- C:\Windows\System\fxLjlSV.exe
  C:\Windows\System\fxLjlSV.exe
  2⤵
  PID:7444
- C:\Windows\System\DxLuTxj.exe
  C:\Windows\System\DxLuTxj.exe
  2⤵
  PID:7468
- C:\Windows\System\LqrlmfO.exe
  C:\Windows\System\LqrlmfO.exe
  2⤵
  PID:7488
- C:\Windows\System\kmPofDC.exe
  C:\Windows\System\kmPofDC.exe
  2⤵
  PID:7564
- C:\Windows\System\SyOOhqv.exe
  C:\Windows\System\SyOOhqv.exe
  2⤵
  PID:7584
- C:\Windows\System\tLHormV.exe
  C:\Windows\System\tLHormV.exe
  2⤵
  PID:7660
- C:\Windows\System\UsEhgvv.exe
  C:\Windows\System\UsEhgvv.exe
  2⤵
  PID:7680
- C:\Windows\System\jptEHJr.exe
  C:\Windows\System\jptEHJr.exe
  2⤵
  PID:7704
- C:\Windows\System\GDJpMmU.exe
  C:\Windows\System\GDJpMmU.exe
  2⤵
  PID:7720
- C:\Windows\System\bvqfbbV.exe
  C:\Windows\System\bvqfbbV.exe
  2⤵
  PID:7748
- C:\Windows\System\lmhVcyv.exe
  C:\Windows\System\lmhVcyv.exe
  2⤵
  PID:7772
- C:\Windows\System\xSdkkka.exe
  C:\Windows\System\xSdkkka.exe
  2⤵
  PID:7796
- C:\Windows\System\lkFivsS.exe
  C:\Windows\System\lkFivsS.exe
  2⤵
  PID:7848
- C:\Windows\System\DPqcVwi.exe
  C:\Windows\System\DPqcVwi.exe
  2⤵
  PID:7868
- C:\Windows\System\xcLtArh.exe
  C:\Windows\System\xcLtArh.exe
  2⤵
  PID:7916
- C:\Windows\System\LMfqasC.exe
  C:\Windows\System\LMfqasC.exe
  2⤵
  PID:7960
- C:\Windows\System\KzaRdvm.exe
  C:\Windows\System\KzaRdvm.exe
  2⤵
  PID:8032
- C:\Windows\System\ymzvYij.exe
  C:\Windows\System\ymzvYij.exe
  2⤵
  PID:8076
- C:\Windows\System\SXxFCxx.exe
  C:\Windows\System\SXxFCxx.exe
  2⤵
  PID:8092
- C:\Windows\System\picQPCM.exe
  C:\Windows\System\picQPCM.exe
  2⤵
  PID:8108
- C:\Windows\System\PUeyJzk.exe
  C:\Windows\System\PUeyJzk.exe
  2⤵
  PID:8140
- C:\Windows\System\usjkKQT.exe
  C:\Windows\System\usjkKQT.exe
  2⤵
  PID:8156
- C:\Windows\System\oyMRVgF.exe
  C:\Windows\System\oyMRVgF.exe
  2⤵
  PID:8176
- C:\Windows\System\wMOvXCN.exe
  C:\Windows\System\wMOvXCN.exe
  2⤵
  PID:6412
- C:\Windows\System\WKYyzva.exe
  C:\Windows\System\WKYyzva.exe
  2⤵
  PID:6896
- C:\Windows\System\jUHEDTb.exe
  C:\Windows\System\jUHEDTb.exe
  2⤵
  PID:6444
- C:\Windows\System\GabtQwR.exe
  C:\Windows\System\GabtQwR.exe
  2⤵
  PID:7196
- C:\Windows\System\sMDjHYk.exe
  C:\Windows\System\sMDjHYk.exe
  2⤵
  PID:7276
- C:\Windows\System\FKhNmSO.exe
  C:\Windows\System\FKhNmSO.exe
  2⤵
  PID:7360
- C:\Windows\System\uvAdAbc.exe
  C:\Windows\System\uvAdAbc.exe
  2⤵
  PID:7504
- C:\Windows\System\NqaHIZq.exe
  C:\Windows\System\NqaHIZq.exe
  2⤵
  PID:7324
- C:\Windows\System\RSSxyfI.exe
  C:\Windows\System\RSSxyfI.exe
  2⤵
  PID:7544
- C:\Windows\System\MjtYORd.exe
  C:\Windows\System\MjtYORd.exe
  2⤵
  PID:7524
- C:\Windows\System\zwVyowk.exe
  C:\Windows\System\zwVyowk.exe
  2⤵
  PID:7652
- C:\Windows\System\GMvQYTk.exe
  C:\Windows\System\GMvQYTk.exe
  2⤵
  PID:7716
- C:\Windows\System\KRPVIOv.exe
  C:\Windows\System\KRPVIOv.exe
  2⤵
  PID:7728
- C:\Windows\System\hTXyiMn.exe
  C:\Windows\System\hTXyiMn.exe
  2⤵
  PID:7900
- C:\Windows\System\EogfqEr.exe
  C:\Windows\System\EogfqEr.exe
  2⤵
  PID:7948
- C:\Windows\System\UkEgEOV.exe
  C:\Windows\System\UkEgEOV.exe
  2⤵
  PID:7980
- C:\Windows\System\FdjMitd.exe
  C:\Windows\System\FdjMitd.exe
  2⤵
  PID:8056
- C:\Windows\System\WzCXfnQ.exe
  C:\Windows\System\WzCXfnQ.exe
  2⤵
  PID:8100
- C:\Windows\System\VCPhDXD.exe
  C:\Windows\System\VCPhDXD.exe
  2⤵
  PID:8152
- C:\Windows\System\ZWvFajG.exe
  C:\Windows\System\ZWvFajG.exe
  2⤵
  PID:8188
- C:\Windows\System\hITxEUe.exe
  C:\Windows\System\hITxEUe.exe
  2⤵
  PID:7240
- C:\Windows\System\vdZxMNb.exe
  C:\Windows\System\vdZxMNb.exe
  2⤵
  PID:7184
- C:\Windows\System\Luipeia.exe
  C:\Windows\System\Luipeia.exe
  2⤵
  PID:7436
- C:\Windows\System\mdCHqnD.exe
  C:\Windows\System\mdCHqnD.exe
  2⤵
  PID:7556
- C:\Windows\System\NjGezjc.exe
  C:\Windows\System\NjGezjc.exe
  2⤵
  PID:7844
- C:\Windows\System\NRibPjh.exe
  C:\Windows\System\NRibPjh.exe
  2⤵
  PID:7764
- C:\Windows\System\fCUBORx.exe
  C:\Windows\System\fCUBORx.exe
  2⤵
  PID:8088
- C:\Windows\System\luZtoVt.exe
  C:\Windows\System\luZtoVt.exe
  2⤵
  PID:6572
- C:\Windows\System\nAppQDf.exe
  C:\Windows\System\nAppQDf.exe
  2⤵
  PID:7204
- C:\Windows\System\JDqrEAX.exe
  C:\Windows\System\JDqrEAX.exe
  2⤵
  PID:8212
- C:\Windows\System\Ebrbvuc.exe
  C:\Windows\System\Ebrbvuc.exe
  2⤵
  PID:8284
- C:\Windows\System\kSuPZAy.exe
  C:\Windows\System\kSuPZAy.exe
  2⤵
  PID:8324
- C:\Windows\System\stHDrlN.exe
  C:\Windows\System\stHDrlN.exe
  2⤵
  PID:8352
- C:\Windows\System\IcJKMUa.exe
  C:\Windows\System\IcJKMUa.exe
  2⤵
  PID:8376
- C:\Windows\System\vBMOPfR.exe
  C:\Windows\System\vBMOPfR.exe
  2⤵
  PID:8396
- C:\Windows\System\LtFexOa.exe
  C:\Windows\System\LtFexOa.exe
  2⤵
  PID:8416
- C:\Windows\System\PvyNQGV.exe
  C:\Windows\System\PvyNQGV.exe
  2⤵
  PID:8456
- C:\Windows\System\MyXBsnm.exe
  C:\Windows\System\MyXBsnm.exe
  2⤵
  PID:8488
- C:\Windows\System\KWNJhtp.exe
  C:\Windows\System\KWNJhtp.exe
  2⤵
  PID:8504
- C:\Windows\System\kugNiab.exe
  C:\Windows\System\kugNiab.exe
  2⤵
  PID:8520
- C:\Windows\System\otdgTcM.exe
  C:\Windows\System\otdgTcM.exe
  2⤵
  PID:8544
- C:\Windows\System\qAYuXTe.exe
  C:\Windows\System\qAYuXTe.exe
  2⤵
  PID:8560
- C:\Windows\System\uEkoLtQ.exe
  C:\Windows\System\uEkoLtQ.exe
  2⤵
  PID:8592
- C:\Windows\System\pXJaJZI.exe
  C:\Windows\System\pXJaJZI.exe
  2⤵
  PID:8720
- C:\Windows\System\MdSLdil.exe
  C:\Windows\System\MdSLdil.exe
  2⤵
  PID:8736
- C:\Windows\System\oMSdEmj.exe
  C:\Windows\System\oMSdEmj.exe
  2⤵
  PID:8752
- C:\Windows\System\lXOxYqX.exe
  C:\Windows\System\lXOxYqX.exe
  2⤵
  PID:8768
- C:\Windows\System\EzJBjrL.exe
  C:\Windows\System\EzJBjrL.exe
  2⤵
  PID:8784
- C:\Windows\System\yhypLaT.exe
  C:\Windows\System\yhypLaT.exe
  2⤵
  PID:8800
- C:\Windows\System\DSiDadW.exe
  C:\Windows\System\DSiDadW.exe
  2⤵
  PID:8816
- C:\Windows\System\iVqSfEw.exe
  C:\Windows\System\iVqSfEw.exe
  2⤵
  PID:8832
- C:\Windows\System\NzcaJRa.exe
  C:\Windows\System\NzcaJRa.exe
  2⤵
  PID:8848
- C:\Windows\System\ToDJZVJ.exe
  C:\Windows\System\ToDJZVJ.exe
  2⤵
  PID:8872
- C:\Windows\System\SHZHgUK.exe
  C:\Windows\System\SHZHgUK.exe
  2⤵
  PID:8888
- C:\Windows\System\PSiEGPo.exe
  C:\Windows\System\PSiEGPo.exe
  2⤵
  PID:8904
- C:\Windows\System\uLCIIxP.exe
  C:\Windows\System\uLCIIxP.exe
  2⤵
  PID:8920
- C:\Windows\System\qwXcNfK.exe
  C:\Windows\System\qwXcNfK.exe
  2⤵
  PID:9048
- C:\Windows\System\yriKOZQ.exe
  C:\Windows\System\yriKOZQ.exe
  2⤵
  PID:9128
- C:\Windows\System\fSQDsrA.exe
  C:\Windows\System\fSQDsrA.exe
  2⤵
  PID:9144
- C:\Windows\System\TZitrgw.exe
  C:\Windows\System\TZitrgw.exe
  2⤵
  PID:9168
- C:\Windows\System\LWYyWvW.exe
  C:\Windows\System\LWYyWvW.exe
  2⤵
  PID:9184
- C:\Windows\System\SMWTvZl.exe
  C:\Windows\System\SMWTvZl.exe
  2⤵
  PID:9204
- C:\Windows\System\iOBAOJX.exe
  C:\Windows\System\iOBAOJX.exe
  2⤵
  PID:7576
- C:\Windows\System\CDjDJFJ.exe
  C:\Windows\System\CDjDJFJ.exe
  2⤵
  PID:8268
- C:\Windows\System\oFgimXO.exe
  C:\Windows\System\oFgimXO.exe
  2⤵
  PID:8368
- C:\Windows\System\hHyuqcr.exe
  C:\Windows\System\hHyuqcr.exe
  2⤵
  PID:8656
- C:\Windows\System\fZLQqsc.exe
  C:\Windows\System\fZLQqsc.exe
  2⤵
  PID:8744
- C:\Windows\System\euLeXDE.exe
  C:\Windows\System\euLeXDE.exe
  2⤵
  PID:8632
- C:\Windows\System\WxHYBjT.exe
  C:\Windows\System\WxHYBjT.exe
  2⤵
  PID:8636
- C:\Windows\System\zRZWnJF.exe
  C:\Windows\System\zRZWnJF.exe
  2⤵
  PID:8880
- C:\Windows\System\yyLqUTO.exe
  C:\Windows\System\yyLqUTO.exe
  2⤵
  PID:8668
- C:\Windows\System\jxYvPTu.exe
  C:\Windows\System\jxYvPTu.exe
  2⤵
  PID:8552
- C:\Windows\System\sXxGMYG.exe
  C:\Windows\System\sXxGMYG.exe
  2⤵
  PID:8952
- C:\Windows\System\AFOQJBz.exe
  C:\Windows\System\AFOQJBz.exe
  2⤵
  PID:8932
- C:\Windows\System\MLYmXke.exe
  C:\Windows\System\MLYmXke.exe
  2⤵
  PID:8700
- C:\Windows\System\xcfkpSV.exe
  C:\Windows\System\xcfkpSV.exe
  2⤵
  PID:9112
- C:\Windows\System\ExOfuKm.exe
  C:\Windows\System\ExOfuKm.exe
  2⤵
  PID:8944
- C:\Windows\System\POMVViQ.exe
  C:\Windows\System\POMVViQ.exe
  2⤵
  PID:9192
- C:\Windows\System\flzgrWi.exe
  C:\Windows\System\flzgrWi.exe
  2⤵
  PID:9120
- C:\Windows\System\aoFerrO.exe
  C:\Windows\System\aoFerrO.exe
  2⤵
  PID:8316
- C:\Windows\System\ONpDmeY.exe
  C:\Windows\System\ONpDmeY.exe
  2⤵
  PID:8256
- C:\Windows\System\hyakpQS.exe
  C:\Windows\System\hyakpQS.exe
  2⤵
  PID:8600
- C:\Windows\System\BtQtfbI.exe
  C:\Windows\System\BtQtfbI.exe
  2⤵
  PID:8580
- C:\Windows\System\dYiqzUe.exe
  C:\Windows\System\dYiqzUe.exe
  2⤵
  PID:8812
- C:\Windows\System\YlyXGkr.exe
  C:\Windows\System\YlyXGkr.exe
  2⤵
  PID:8896
- C:\Windows\System\VgELXpj.exe
  C:\Windows\System\VgELXpj.exe
  2⤵
  PID:8748
- C:\Windows\System\gsFuunP.exe
  C:\Windows\System\gsFuunP.exe
  2⤵
  PID:8956
- C:\Windows\System\HCGLjwX.exe
  C:\Windows\System\HCGLjwX.exe
  2⤵
  PID:9004
- C:\Windows\System\mNqsuUy.exe
  C:\Windows\System\mNqsuUy.exe
  2⤵
  PID:7744
- C:\Windows\System\CrjoaIW.exe
  C:\Windows\System\CrjoaIW.exe
  2⤵
  PID:8128
- C:\Windows\System\TWUrOjG.exe
  C:\Windows\System\TWUrOjG.exe
  2⤵
  PID:8728
- C:\Windows\System\McsOsYq.exe
  C:\Windows\System\McsOsYq.exe
  2⤵
  PID:8884
- C:\Windows\System\jVwiiZi.exe
  C:\Windows\System\jVwiiZi.exe
  2⤵
  PID:9220
- C:\Windows\System\YYiEnwS.exe
  C:\Windows\System\YYiEnwS.exe
  2⤵
  PID:9244
- C:\Windows\System\kONvQuh.exe
  C:\Windows\System\kONvQuh.exe
  2⤵
  PID:9260
- C:\Windows\System\JHLIZLh.exe
  C:\Windows\System\JHLIZLh.exe
  2⤵
  PID:9280
- C:\Windows\System\ABokBXg.exe
  C:\Windows\System\ABokBXg.exe
  2⤵
  PID:9312
- C:\Windows\System\VddJqSv.exe
  C:\Windows\System\VddJqSv.exe
  2⤵
  PID:9340
- C:\Windows\System\UtUfYsY.exe
  C:\Windows\System\UtUfYsY.exe
  2⤵
  PID:9360
- C:\Windows\System\eCljcrt.exe
  C:\Windows\System\eCljcrt.exe
  2⤵
  PID:9384
- C:\Windows\System\OOqbwAO.exe
  C:\Windows\System\OOqbwAO.exe
  2⤵
  PID:9408
- C:\Windows\System\cHpUDGI.exe
  C:\Windows\System\cHpUDGI.exe
  2⤵
  PID:9428
- C:\Windows\System\gtehvuW.exe
  C:\Windows\System\gtehvuW.exe
  2⤵
  PID:9452
- C:\Windows\System\iIvhzki.exe
  C:\Windows\System\iIvhzki.exe
  2⤵
  PID:9512
- C:\Windows\System\ikhhJvn.exe
  C:\Windows\System\ikhhJvn.exe
  2⤵
  PID:9532
- C:\Windows\System\fFnbHPK.exe
  C:\Windows\System\fFnbHPK.exe
  2⤵
  PID:9572
- C:\Windows\System\tEeneXP.exe
  C:\Windows\System\tEeneXP.exe
  2⤵
  PID:9592
- C:\Windows\System\pvgggIg.exe
  C:\Windows\System\pvgggIg.exe
  2⤵
  PID:9612
- C:\Windows\System\dxgALrR.exe
  C:\Windows\System\dxgALrR.exe
  2⤵
  PID:9668
- C:\Windows\System\qBMTFPl.exe
  C:\Windows\System\qBMTFPl.exe
  2⤵
  PID:9688
- C:\Windows\System\PyJeiOo.exe
  C:\Windows\System\PyJeiOo.exe
  2⤵
  PID:9732
- C:\Windows\System\wjFTVRw.exe
  C:\Windows\System\wjFTVRw.exe
  2⤵
  PID:9756
- C:\Windows\System\FAySlet.exe
  C:\Windows\System\FAySlet.exe
  2⤵
  PID:9780
- C:\Windows\System\oeKOkHV.exe
  C:\Windows\System\oeKOkHV.exe
  2⤵
  PID:9796
- C:\Windows\System\ufQSlff.exe
  C:\Windows\System\ufQSlff.exe
  2⤵
  PID:9840
- C:\Windows\System\BpfTLkz.exe
  C:\Windows\System\BpfTLkz.exe
  2⤵
  PID:9892
- C:\Windows\System\vDWIQUE.exe
  C:\Windows\System\vDWIQUE.exe
  2⤵
  PID:9908
- C:\Windows\System\RqRfdAt.exe
  C:\Windows\System\RqRfdAt.exe
  2⤵
  PID:9928
- C:\Windows\System\SPbrowX.exe
  C:\Windows\System\SPbrowX.exe
  2⤵
  PID:9948
- C:\Windows\System\UnGYzJW.exe
  C:\Windows\System\UnGYzJW.exe
  2⤵
  PID:9968
- C:\Windows\System\reLRBCd.exe
  C:\Windows\System\reLRBCd.exe
  2⤵
  PID:9988
- C:\Windows\System\gXBRjlf.exe
  C:\Windows\System\gXBRjlf.exe
  2⤵
  PID:10044
- C:\Windows\System\djHlgDV.exe
  C:\Windows\System\djHlgDV.exe
  2⤵
  PID:10080
- C:\Windows\System\vCKMRgI.exe
  C:\Windows\System\vCKMRgI.exe
  2⤵
  PID:10096
- C:\Windows\System\PqWNFax.exe
  C:\Windows\System\PqWNFax.exe
  2⤵
  PID:10124
- C:\Windows\System\EDmNfPx.exe
  C:\Windows\System\EDmNfPx.exe
  2⤵
  PID:10144
- C:\Windows\System\JPjnjHR.exe
  C:\Windows\System\JPjnjHR.exe
  2⤵
  PID:10168
- C:\Windows\System\FIjLsNA.exe
  C:\Windows\System\FIjLsNA.exe
  2⤵
  PID:10192
- C:\Windows\System\WsrZqtM.exe
  C:\Windows\System\WsrZqtM.exe
  2⤵
  PID:10208
- C:\Windows\System\RYaIEHY.exe
  C:\Windows\System\RYaIEHY.exe
  2⤵
  PID:8412
- C:\Windows\System\pMQyYUx.exe
  C:\Windows\System\pMQyYUx.exe
  2⤵
  PID:9180
- C:\Windows\System\YxrgiKF.exe
  C:\Windows\System\YxrgiKF.exe
  2⤵
  PID:9336
- C:\Windows\System\pmESGZO.exe
  C:\Windows\System\pmESGZO.exe
  2⤵
  PID:9520
- C:\Windows\System\ACJjRYr.exe
  C:\Windows\System\ACJjRYr.exe
  2⤵
  PID:9556
- C:\Windows\System\cQKQQNm.exe
  C:\Windows\System\cQKQQNm.exe
  2⤵
  PID:9584
- C:\Windows\System\OlUwKIv.exe
  C:\Windows\System\OlUwKIv.exe
  2⤵
  PID:9684
- C:\Windows\System\eEcHHFX.exe
  C:\Windows\System\eEcHHFX.exe
  2⤵
  PID:9768
- C:\Windows\System\NguyIYe.exe
  C:\Windows\System\NguyIYe.exe
  2⤵
  PID:9764
- C:\Windows\System\yKtguUY.exe
  C:\Windows\System\yKtguUY.exe
  2⤵
  PID:9884
- C:\Windows\System\bYkbHQc.exe
  C:\Windows\System\bYkbHQc.exe
  2⤵
  PID:9924
- C:\Windows\System\gBffDRC.exe
  C:\Windows\System\gBffDRC.exe
  2⤵
  PID:10020
- C:\Windows\System\UMZLOoH.exe
  C:\Windows\System\UMZLOoH.exe
  2⤵
  PID:10056
- C:\Windows\System\pSfkGsc.exe
  C:\Windows\System\pSfkGsc.exe
  2⤵
  PID:10104
- C:\Windows\System\poArlWy.exe
  C:\Windows\System\poArlWy.exe
  2⤵
  PID:10152
- C:\Windows\System\imciqjV.exe
  C:\Windows\System\imciqjV.exe
  2⤵
  PID:10224
- C:\Windows\System\pztGGrt.exe
  C:\Windows\System\pztGGrt.exe
  2⤵
  PID:10232
- C:\Windows\System\pmzKzRA.exe
  C:\Windows\System\pmzKzRA.exe
  2⤵
  PID:8568
- C:\Windows\System\IkxKeBR.exe
  C:\Windows\System\IkxKeBR.exe
  2⤵
  PID:9508
- C:\Windows\System\hqHnbWE.exe
  C:\Windows\System\hqHnbWE.exe
  2⤵
  PID:9604
- C:\Windows\System\WGCSPJF.exe
  C:\Windows\System\WGCSPJF.exe
  2⤵
  PID:9676
- C:\Windows\System\twMfefF.exe
  C:\Windows\System\twMfefF.exe
  2⤵
  PID:10004
- C:\Windows\System\iQPIwsU.exe
  C:\Windows\System\iQPIwsU.exe
  2⤵
  PID:10112
- C:\Windows\System\vBbliJi.exe
  C:\Windows\System\vBbliJi.exe
  2⤵
  PID:9400
- C:\Windows\System\kJXnMwG.exe
  C:\Windows\System\kJXnMwG.exe
  2⤵
  PID:9424
- C:\Windows\System\brmUBMr.exe
  C:\Windows\System\brmUBMr.exe
  2⤵
  PID:9472
- C:\Windows\System\FEGnMMW.exe
  C:\Windows\System\FEGnMMW.exe
  2⤵
  PID:9984
- C:\Windows\System\tyWkceo.exe
  C:\Windows\System\tyWkceo.exe
  2⤵
  PID:10260
- C:\Windows\System\CEydTFf.exe
  C:\Windows\System\CEydTFf.exe
  2⤵
  PID:10280
- C:\Windows\System\DUDGiSJ.exe
  C:\Windows\System\DUDGiSJ.exe
  2⤵
  PID:10332
- C:\Windows\System\uwTjvsZ.exe
  C:\Windows\System\uwTjvsZ.exe
  2⤵
  PID:10352
- C:\Windows\System\MIMBTNW.exe
  C:\Windows\System\MIMBTNW.exe
  2⤵
  PID:10372
- C:\Windows\System\oKgyUXx.exe
  C:\Windows\System\oKgyUXx.exe
  2⤵
  PID:10392
- C:\Windows\System\OifeUjP.exe
  C:\Windows\System\OifeUjP.exe
  2⤵
  PID:10408
- C:\Windows\System\gOZYgRb.exe
  C:\Windows\System\gOZYgRb.exe
  2⤵
  PID:10436
- C:\Windows\System\BdAiLqr.exe
  C:\Windows\System\BdAiLqr.exe
  2⤵
  PID:10456
- C:\Windows\System\zcfCESR.exe
  C:\Windows\System\zcfCESR.exe
  2⤵
  PID:10476
- C:\Windows\System\UeXYeAJ.exe
  C:\Windows\System\UeXYeAJ.exe
  2⤵
  PID:10520
- C:\Windows\System\mucMcAg.exe
  C:\Windows\System\mucMcAg.exe
  2⤵
  PID:10564
- C:\Windows\System\omAltOJ.exe
  C:\Windows\System\omAltOJ.exe
  2⤵
  PID:10584
- C:\Windows\System\UWEpfFn.exe
  C:\Windows\System\UWEpfFn.exe
  2⤵
  PID:10608
- C:\Windows\System\GMWcMsl.exe
  C:\Windows\System\GMWcMsl.exe
  2⤵
  PID:10644
- C:\Windows\System\lyfxFje.exe
  C:\Windows\System\lyfxFje.exe
  2⤵
  PID:10676
- C:\Windows\System\HRcfMrF.exe
  C:\Windows\System\HRcfMrF.exe
  2⤵
  PID:10692
- C:\Windows\System\WoRROEq.exe
  C:\Windows\System\WoRROEq.exe
  2⤵
  PID:10712
- C:\Windows\System\JkcGueW.exe
  C:\Windows\System\JkcGueW.exe
  2⤵
  PID:10748
- C:\Windows\System\SLDebGl.exe
  C:\Windows\System\SLDebGl.exe
  2⤵
  PID:10780
- C:\Windows\System\LFDSokx.exe
  C:\Windows\System\LFDSokx.exe
  2⤵
  PID:10800
- C:\Windows\System\HzvIYTb.exe
  C:\Windows\System\HzvIYTb.exe
  2⤵
  PID:10816
- C:\Windows\System\bikJPlF.exe
  C:\Windows\System\bikJPlF.exe
  2⤵
  PID:10848
- C:\Windows\System\MPmvmAr.exe
  C:\Windows\System\MPmvmAr.exe
  2⤵
  PID:10876
- C:\Windows\System\AmwJLSb.exe
  C:\Windows\System\AmwJLSb.exe
  2⤵
  PID:10892
- C:\Windows\System\QjazAhK.exe
  C:\Windows\System\QjazAhK.exe
  2⤵
  PID:10912
- C:\Windows\System\BrZqnpt.exe
  C:\Windows\System\BrZqnpt.exe
  2⤵
  PID:10964
- C:\Windows\System\DPlGlgw.exe
  C:\Windows\System\DPlGlgw.exe
  2⤵
  PID:11000
- C:\Windows\System\jscniCW.exe
  C:\Windows\System\jscniCW.exe
  2⤵
  PID:11048
- C:\Windows\System\HkVJWEJ.exe
  C:\Windows\System\HkVJWEJ.exe
  2⤵
  PID:11064
- C:\Windows\System\EcgMvWT.exe
  C:\Windows\System\EcgMvWT.exe
  2⤵
  PID:11088
- C:\Windows\System\mCbnkUn.exe
  C:\Windows\System\mCbnkUn.exe
  2⤵
  PID:11124
- C:\Windows\System\noXCKQw.exe
  C:\Windows\System\noXCKQw.exe
  2⤵
  PID:11176
- C:\Windows\System\GASGIiT.exe
  C:\Windows\System\GASGIiT.exe
  2⤵
  PID:11200
- C:\Windows\System\EKlbaeJ.exe
  C:\Windows\System\EKlbaeJ.exe
  2⤵
  PID:11224
- C:\Windows\System\RlCZbPM.exe
  C:\Windows\System\RlCZbPM.exe
  2⤵
  PID:11244
- C:\Windows\System\ruBnAEZ.exe
  C:\Windows\System\ruBnAEZ.exe
  2⤵
  PID:9600
- C:\Windows\System\SGArBBp.exe
  C:\Windows\System\SGArBBp.exe
  2⤵
  PID:10268
- C:\Windows\System\fzIiSKW.exe
  C:\Windows\System\fzIiSKW.exe
  2⤵
  PID:10340
- C:\Windows\System\xSUFiiQ.exe
  C:\Windows\System\xSUFiiQ.exe
  2⤵
  PID:10468
- C:\Windows\System\SAwmryp.exe
  C:\Windows\System\SAwmryp.exe
  2⤵
  PID:10432
- C:\Windows\System\JJmnIky.exe
  C:\Windows\System\JJmnIky.exe
  2⤵
  PID:10548
- C:\Windows\System\mUNhBXs.exe
  C:\Windows\System\mUNhBXs.exe
  2⤵
  PID:10688
- C:\Windows\System\zCifMwr.exe
  C:\Windows\System\zCifMwr.exe
  2⤵
  PID:10656
- C:\Windows\System\vDgrbPx.exe
  C:\Windows\System\vDgrbPx.exe
  2⤵
  PID:10740
- C:\Windows\System\HjwNByc.exe
  C:\Windows\System\HjwNByc.exe
  2⤵
  PID:10744
- C:\Windows\System\hzxAzaC.exe
  C:\Windows\System\hzxAzaC.exe
  2⤵
  PID:10788
- C:\Windows\System\QiRJvox.exe
  C:\Windows\System\QiRJvox.exe
  2⤵
  PID:10860
- C:\Windows\System\YNKEcfC.exe
  C:\Windows\System\YNKEcfC.exe
  2⤵
  PID:10900
- C:\Windows\System\ctyVEsl.exe
  C:\Windows\System\ctyVEsl.exe
  2⤵
  PID:10940
- C:\Windows\System\WVuVyXf.exe
  C:\Windows\System\WVuVyXf.exe
  2⤵
  PID:11072
- C:\Windows\System\WFJlOZX.exe
  C:\Windows\System\WFJlOZX.exe
  2⤵
  PID:11136
- C:\Windows\System\CTfYoNE.exe
  C:\Windows\System\CTfYoNE.exe
  2⤵
  PID:11216
- C:\Windows\System\jctOmZn.exe
  C:\Windows\System\jctOmZn.exe
  2⤵
  PID:10256
- C:\Windows\System\vzcljqV.exe
  C:\Windows\System\vzcljqV.exe
  2⤵
  PID:10404
- C:\Windows\System\nnQmZch.exe
  C:\Windows\System\nnQmZch.exe
  2⤵
  PID:10428
- C:\Windows\System\OQSpMbF.exe
  C:\Windows\System\OQSpMbF.exe
  2⤵
  PID:10632
- C:\Windows\System\rygkpSZ.exe
  C:\Windows\System\rygkpSZ.exe
  2⤵
  PID:10652
- C:\Windows\System\NfcUsEW.exe
  C:\Windows\System\NfcUsEW.exe
  2⤵
  PID:10772
- C:\Windows\System\WrLiQqg.exe
  C:\Windows\System\WrLiQqg.exe
  2⤵
  PID:10972
- C:\Windows\System\bPDOgjw.exe
  C:\Windows\System\bPDOgjw.exe
  2⤵
  PID:10888
- C:\Windows\System\cxgclCj.exe
  C:\Windows\System\cxgclCj.exe
  2⤵
  PID:10996
- C:\Windows\System\NkSuIow.exe
  C:\Windows\System\NkSuIow.exe
  2⤵
  PID:11192
- C:\Windows\System\mDpUKlj.exe
  C:\Windows\System\mDpUKlj.exe
  2⤵
  PID:10640
- C:\Windows\System\sktcBhz.exe
  C:\Windows\System\sktcBhz.exe
  2⤵
  PID:10884
- C:\Windows\System\Xemidre.exe
  C:\Windows\System\Xemidre.exe
  2⤵
  PID:11340
- C:\Windows\System\clqVlvi.exe
  C:\Windows\System\clqVlvi.exe
  2⤵
  PID:11360
- C:\Windows\System\AOcIlAh.exe
  C:\Windows\System\AOcIlAh.exe
  2⤵
  PID:11388
- C:\Windows\System\vFBNfAB.exe
  C:\Windows\System\vFBNfAB.exe
  2⤵
  PID:11404
- C:\Windows\System\IIRYQii.exe
  C:\Windows\System\IIRYQii.exe
  2⤵
  PID:11428
- C:\Windows\System\FPDffxy.exe
  C:\Windows\System\FPDffxy.exe
  2⤵
  PID:11448
- C:\Windows\System\JYiBJrE.exe
  C:\Windows\System\JYiBJrE.exe
  2⤵
  PID:11484
- C:\Windows\System\OhVvKZw.exe
  C:\Windows\System\OhVvKZw.exe
  2⤵
  PID:11512
- C:\Windows\System\VLGMSOf.exe
  C:\Windows\System\VLGMSOf.exe
  2⤵
  PID:11544
- C:\Windows\System\IycLiiy.exe
  C:\Windows\System\IycLiiy.exe
  2⤵
  PID:11596
- C:\Windows\System\HJfEnDL.exe
  C:\Windows\System\HJfEnDL.exe
  2⤵
  PID:11636
- C:\Windows\System\lScFuDA.exe
  C:\Windows\System\lScFuDA.exe
  2⤵
  PID:11656
- C:\Windows\System\HTTiuGb.exe
  C:\Windows\System\HTTiuGb.exe
  2⤵
  PID:11676
- C:\Windows\System\ggtrxrr.exe
  C:\Windows\System\ggtrxrr.exe
  2⤵
  PID:11732
- C:\Windows\System\fUOdnbG.exe
  C:\Windows\System\fUOdnbG.exe
  2⤵
  PID:11756
- C:\Windows\System\XiaPIeI.exe
  C:\Windows\System\XiaPIeI.exe
  2⤵
  PID:11772
- C:\Windows\System\mierhFY.exe
  C:\Windows\System\mierhFY.exe
  2⤵
  PID:11808
- C:\Windows\System\ewcHGDj.exe
  C:\Windows\System\ewcHGDj.exe
  2⤵
  PID:11840
- C:\Windows\System\VEojTum.exe
  C:\Windows\System\VEojTum.exe
  2⤵
  PID:11856
- C:\Windows\System\TtgfYWD.exe
  C:\Windows\System\TtgfYWD.exe
  2⤵
  PID:11876
- C:\Windows\System\zkLmAGp.exe
  C:\Windows\System\zkLmAGp.exe
  2⤵
  PID:11896
- C:\Windows\System\ehuRTyB.exe
  C:\Windows\System\ehuRTyB.exe
  2⤵
  PID:11932
- C:\Windows\System\lvlLDoQ.exe
  C:\Windows\System\lvlLDoQ.exe
  2⤵
  PID:11980
- C:\Windows\System\KyxjJWS.exe
  C:\Windows\System\KyxjJWS.exe
  2⤵
  PID:12020
- C:\Windows\System\efyHcmJ.exe
  C:\Windows\System\efyHcmJ.exe
  2⤵
  PID:12040
- C:\Windows\System\WZCNAeR.exe
  C:\Windows\System\WZCNAeR.exe
  2⤵
  PID:12064
- C:\Windows\System\TQyZDhL.exe
  C:\Windows\System\TQyZDhL.exe
  2⤵
  PID:12080
- C:\Windows\System\LUQbMGx.exe
  C:\Windows\System\LUQbMGx.exe
  2⤵
  PID:12100
- C:\Windows\System\zqMOlGo.exe
  C:\Windows\System\zqMOlGo.exe
  2⤵
  PID:12124
- C:\Windows\System\IBQlIDs.exe
  C:\Windows\System\IBQlIDs.exe
  2⤵
  PID:12148
- C:\Windows\System\BEMxMhn.exe
  C:\Windows\System\BEMxMhn.exe
  2⤵
  PID:12180
- C:\Windows\System\wCVFHNS.exe
  C:\Windows\System\wCVFHNS.exe
  2⤵
  PID:12224
- C:\Windows\System\mnmemyP.exe
  C:\Windows\System\mnmemyP.exe
  2⤵
  PID:12252
- C:\Windows\System\BsQuulP.exe
  C:\Windows\System\BsQuulP.exe
  2⤵
  PID:11236
- C:\Windows\System\icOoohc.exe
  C:\Windows\System\icOoohc.exe
  2⤵
  PID:11296
- C:\Windows\System\kqUtyfn.exe
  C:\Windows\System\kqUtyfn.exe
  2⤵
  PID:11284
- C:\Windows\System\sFwkKOf.exe
  C:\Windows\System\sFwkKOf.exe
  2⤵
  PID:11396
- C:\Windows\System\vKpzunD.exe
  C:\Windows\System\vKpzunD.exe
  2⤵
  PID:11464
- C:\Windows\System\GesRczJ.exe
  C:\Windows\System\GesRczJ.exe
  2⤵
  PID:11500
- C:\Windows\System\XGVsnRw.exe
  C:\Windows\System\XGVsnRw.exe
  2⤵
  PID:11564
- C:\Windows\System\toHLgdM.exe
  C:\Windows\System\toHLgdM.exe
  2⤵
  PID:11632
- C:\Windows\System\QrApAWU.exe
  C:\Windows\System\QrApAWU.exe
  2⤵
  PID:11672
- C:\Windows\System\szCsFaE.exe
  C:\Windows\System\szCsFaE.exe
  2⤵
  PID:11712
- C:\Windows\System\IgnzAKS.exe
  C:\Windows\System\IgnzAKS.exe
  2⤵
  PID:11800
- C:\Windows\System\DSASNWj.exe
  C:\Windows\System\DSASNWj.exe
  2⤵
  PID:11872
- C:\Windows\System\CgDlsDU.exe
  C:\Windows\System\CgDlsDU.exe
  2⤵
  PID:11884
- C:\Windows\System\IbqwnAg.exe
  C:\Windows\System\IbqwnAg.exe
  2⤵
  PID:11960
- C:\Windows\System\uinjbbx.exe
  C:\Windows\System\uinjbbx.exe
  2⤵
  PID:12052
- C:\Windows\System\ggYusEI.exe
  C:\Windows\System\ggYusEI.exe
  2⤵
  PID:12108
- C:\Windows\System\DKCwDfJ.exe
  C:\Windows\System\DKCwDfJ.exe
  2⤵
  PID:12144
- C:\Windows\System\TmwJWNs.exe
  C:\Windows\System\TmwJWNs.exe
  2⤵
  PID:12176
- C:\Windows\System\waRmKPl.exe
  C:\Windows\System\waRmKPl.exe
  2⤵
  PID:12264
- C:\Windows\System\RVAUhpu.exe
  C:\Windows\System\RVAUhpu.exe
  2⤵
  PID:10704
- C:\Windows\System\yVgOFGL.exe
  C:\Windows\System\yVgOFGL.exe
  2⤵
  PID:11384
- C:\Windows\System\Uwwlajc.exe
  C:\Windows\System\Uwwlajc.exe
  2⤵
  PID:11556
- C:\Windows\System\xirAPDC.exe
  C:\Windows\System\xirAPDC.exe
  2⤵
  PID:12016
- C:\Windows\System\mNndrgf.exe
  C:\Windows\System\mNndrgf.exe
  2⤵
  PID:12164
- C:\Windows\System\wJnFLCd.exe
  C:\Windows\System\wJnFLCd.exe
  2⤵
  PID:12248
- C:\Windows\System\CSNqOnJ.exe
  C:\Windows\System\CSNqOnJ.exe
  2⤵
  PID:11708
- C:\Windows\System\GhkDWew.exe
  C:\Windows\System\GhkDWew.exe
  2⤵
  PID:11628
- C:\Windows\System\sVAnRLA.exe
  C:\Windows\System\sVAnRLA.exe
  2⤵
  PID:11976
- C:\Windows\System\wXkWNay.exe
  C:\Windows\System\wXkWNay.exe
  2⤵
  PID:11276
- C:\Windows\System\WtwQIOX.exe
  C:\Windows\System\WtwQIOX.exe
  2⤵
  PID:12332
- C:\Windows\System\sejdKDK.exe
  C:\Windows\System\sejdKDK.exe
  2⤵
  PID:12396
- C:\Windows\System\HrvCPxb.exe
  C:\Windows\System\HrvCPxb.exe
  2⤵
  PID:12416
- C:\Windows\System\icggJVJ.exe
  C:\Windows\System\icggJVJ.exe
  2⤵
  PID:12432
- C:\Windows\System\kJoOiSZ.exe
  C:\Windows\System\kJoOiSZ.exe
  2⤵
  PID:12452
- C:\Windows\System\SNyVwUH.exe
  C:\Windows\System\SNyVwUH.exe
  2⤵
  PID:12472
- C:\Windows\System\xfpYYQU.exe
  C:\Windows\System\xfpYYQU.exe
  2⤵
  PID:12492
- C:\Windows\System\JZuBZVR.exe
  C:\Windows\System\JZuBZVR.exe
  2⤵
  PID:12508
- C:\Windows\System\VViunqG.exe
  C:\Windows\System\VViunqG.exe
  2⤵
  PID:12524
- C:\Windows\System\cSAJjkJ.exe
  C:\Windows\System\cSAJjkJ.exe
  2⤵
  PID:12540
- C:\Windows\System\fEUqtvI.exe
  C:\Windows\System\fEUqtvI.exe
  2⤵
  PID:12556
- C:\Windows\System\KcdtTJu.exe
  C:\Windows\System\KcdtTJu.exe
  2⤵
  PID:12572
- C:\Windows\System\RUgZORq.exe
  C:\Windows\System\RUgZORq.exe
  2⤵
  PID:12588
- C:\Windows\System\JJfQHQy.exe
  C:\Windows\System\JJfQHQy.exe
  2⤵
  PID:12604
- C:\Windows\System\fVojUKw.exe
  C:\Windows\System\fVojUKw.exe
  2⤵
  PID:12620
- C:\Windows\System\DxKzNFl.exe
  C:\Windows\System\DxKzNFl.exe
  2⤵
  PID:12648
- C:\Windows\System\hIptOLA.exe
  C:\Windows\System\hIptOLA.exe
  2⤵
  PID:12668
- C:\Windows\System\XzbZTow.exe
  C:\Windows\System\XzbZTow.exe
  2⤵
  PID:12696
- C:\Windows\System\hPLANTV.exe
  C:\Windows\System\hPLANTV.exe
  2⤵
  PID:12720
- C:\Windows\System\FPveglC.exe
  C:\Windows\System\FPveglC.exe
  2⤵
  PID:12744
- C:\Windows\System\BaySDwj.exe
  C:\Windows\System\BaySDwj.exe
  2⤵
  PID:12760
- C:\Windows\System\nHQWGZr.exe
  C:\Windows\System\nHQWGZr.exe
  2⤵
  PID:12800
- C:\Windows\System\piRWmIM.exe
  C:\Windows\System\piRWmIM.exe
  2⤵
  PID:12824
- C:\Windows\System\xVKSPpo.exe
  C:\Windows\System\xVKSPpo.exe
  2⤵
  PID:12984
- C:\Windows\System\ySYOwWg.exe
  C:\Windows\System\ySYOwWg.exe
  2⤵
  PID:13000
- C:\Windows\System\GowGbkZ.exe
  C:\Windows\System\GowGbkZ.exe
  2⤵
  PID:13180
- C:\Windows\System\iVtzyHv.exe
  C:\Windows\System\iVtzyHv.exe
  2⤵
  PID:13208
- C:\Windows\System\khzaSSv.exe
  C:\Windows\System\khzaSSv.exe
  2⤵
  PID:13236
- C:\Windows\System\MotLCgl.exe
  C:\Windows\System\MotLCgl.exe
  2⤵
  PID:11796
- C:\Windows\System\rMHhFQe.exe
  C:\Windows\System\rMHhFQe.exe
  2⤵
  PID:12236
- C:\Windows\System\YKHmeUI.exe
  C:\Windows\System\YKHmeUI.exe
  2⤵
  PID:11532
- C:\Windows\System\PyEDdMm.exe
  C:\Windows\System\PyEDdMm.exe
  2⤵
  PID:12968
- C:\Windows\System\HLEkHMn.exe
  C:\Windows\System\HLEkHMn.exe
  2⤵
  PID:13072
- C:\Windows\System\vLqBtAP.exe
  C:\Windows\System\vLqBtAP.exe
  2⤵
  PID:13088
- C:\Windows\System\ByTnKIA.exe
  C:\Windows\System\ByTnKIA.exe
  2⤵
  PID:13124
- C:\Windows\System\XEnWsvu.exe
  C:\Windows\System\XEnWsvu.exe
  2⤵
  PID:13108
- C:\Windows\System\RNNjPMb.exe
  C:\Windows\System\RNNjPMb.exe
  2⤵
  PID:13164
- C:\Windows\System\votXtll.exe
  C:\Windows\System\votXtll.exe
  2⤵
  PID:13152
- C:\Windows\System\BBJQDxO.exe
  C:\Windows\System\BBJQDxO.exe
  2⤵
  PID:13196
- C:\Windows\System\nfJhqvY.exe
  C:\Windows\System\nfJhqvY.exe
  2⤵
  PID:13220
- C:\Windows\System\UuhBmdX.exe
  C:\Windows\System\UuhBmdX.exe
  2⤵
  PID:13280
- C:\Windows\System\ffnRVCW.exe
  C:\Windows\System\ffnRVCW.exe
  2⤵
  PID:12996
- C:\Windows\System\vZIeIto.exe
  C:\Windows\System\vZIeIto.exe
  2⤵
  PID:12860
- C:\Windows\System\RDnRmVB.exe
  C:\Windows\System\RDnRmVB.exe
  2⤵
  PID:12660
- C:\Windows\System\VrgILMi.exe
  C:\Windows\System\VrgILMi.exe
  2⤵
  PID:12404
- C:\Windows\System\NmyvCuh.exe
  C:\Windows\System\NmyvCuh.exe
  2⤵
  PID:12712
- C:\Windows\System\QfWJUgg.exe
  C:\Windows\System\QfWJUgg.exe
  2⤵
  PID:12756
- C:\Windows\System\WnpIFOD.exe
  C:\Windows\System\WnpIFOD.exe
  2⤵
  PID:13084
- C:\Windows\System\SaVadTf.exe
  C:\Windows\System\SaVadTf.exe
  2⤵
  PID:3616
- C:\Windows\System\dHmiWwn.exe
  C:\Windows\System\dHmiWwn.exe
  2⤵
  PID:4604
- C:\Windows\System\cbMOTsm.exe
  C:\Windows\System\cbMOTsm.exe
  2⤵
  PID:4956
- C:\Windows\System\ybhBJyK.exe
  C:\Windows\System\ybhBJyK.exe
  2⤵
  PID:12388
- C:\Windows\System\fyiywDZ.exe
  C:\Windows\System\fyiywDZ.exe
  2⤵
  PID:12684
- C:\Windows\System\ecEwsxx.exe
  C:\Windows\System\ecEwsxx.exe
  2⤵
  PID:12808
- C:\Windows\System\ZzajTqt.exe
  C:\Windows\System\ZzajTqt.exe
  2⤵
  PID:12872
- C:\Windows\System\CQgJkYZ.exe
  C:\Windows\System\CQgJkYZ.exe
  2⤵
  PID:12340
- C:\Windows\System\HwQmNya.exe
  C:\Windows\System\HwQmNya.exe
  2⤵
  PID:12536
- C:\Windows\System\jFuRgoj.exe
  C:\Windows\System\jFuRgoj.exe
  2⤵
  PID:3100
- C:\Windows\System\lZHDCPt.exe
  C:\Windows\System\lZHDCPt.exe
  2⤵
  PID:12376
- C:\Windows\System\KyVGIaW.exe
  C:\Windows\System\KyVGIaW.exe
  2⤵
  PID:1108
- C:\Windows\System\eILczJV.exe
  C:\Windows\System\eILczJV.exe
  2⤵
  PID:3588
- C:\Windows\System\QxwPDNJ.exe
  C:\Windows\System\QxwPDNJ.exe
  2⤵
  PID:13288
- C:\Windows\System\EmYpXKk.exe
  C:\Windows\System\EmYpXKk.exe
  2⤵
  PID:13268
- C:\Windows\System\mueycuw.exe
  C:\Windows\System\mueycuw.exe
  2⤵
  PID:11648
- C:\Windows\System\SjqFVRd.exe
  C:\Windows\System\SjqFVRd.exe
  2⤵
  PID:6392
- C:\Windows\System\YGCMLDJ.exe
  C:\Windows\System\YGCMLDJ.exe
  2⤵
  PID:6692
- C:\Windows\System\oygCdxb.exe
  C:\Windows\System\oygCdxb.exe
  2⤵
  PID:6016
- C:\Windows\System\iyaqbeI.exe
  C:\Windows\System\iyaqbeI.exe
  2⤵
  PID:2308
- C:\Windows\System\TtDeTeR.exe
  C:\Windows\System\TtDeTeR.exe
  2⤵
  PID:4924
- C:\Windows\System\mAYnNZB.exe
  C:\Windows\System\mAYnNZB.exe
  2⤵
  PID:3472
- C:\Windows\System\ZCDxZfK.exe
  C:\Windows\System\ZCDxZfK.exe
  2⤵
  PID:13076
- C:\Windows\System\ERJimja.exe
  C:\Windows\System\ERJimja.exe
  2⤵
  PID:8584
- C:\Windows\System\TBUZYXf.exe
  C:\Windows\System\TBUZYXf.exe
  2⤵
  PID:10492
- C:\Windows\System\IpSIybd.exe
  C:\Windows\System\IpSIybd.exe
  2⤵
  PID:9420
- C:\Windows\System\kZoOSlz.exe
  C:\Windows\System\kZoOSlz.exe
  2⤵
  PID:8640
- C:\Windows\System\mLqzmhL.exe
  C:\Windows\System\mLqzmhL.exe
  2⤵
  PID:10532
- C:\Windows\System\NtYCWlo.exe
  C:\Windows\System\NtYCWlo.exe
  2⤵
  PID:12464
- C:\Windows\System\rNHHwFm.exe
  C:\Windows\System\rNHHwFm.exe
  2⤵
  PID:9680
- C:\Windows\System\qKbjeNB.exe
  C:\Windows\System\qKbjeNB.exe
  2⤵
  PID:9108
- C:\Windows\System\fjSrZBJ.exe
  C:\Windows\System\fjSrZBJ.exe
  2⤵
  PID:6936
- C:\Windows\System\gtMlEvx.exe
  C:\Windows\System\gtMlEvx.exe
  2⤵
  PID:7636
- C:\Windows\System\OvdYsup.exe
  C:\Windows\System\OvdYsup.exe
  2⤵
  PID:11108
- C:\Windows\System\NmpWOfr.exe
  C:\Windows\System\NmpWOfr.exe
  2⤵
  PID:3156
- C:\Windows\System\ZNnJMcJ.exe
  C:\Windows\System\ZNnJMcJ.exe
  2⤵
  PID:12352
- C:\Windows\System\HSYWiNn.exe
  C:\Windows\System\HSYWiNn.exe
  2⤵
  PID:8136
- C:\Windows\System\QwHmOlt.exe
  C:\Windows\System\QwHmOlt.exe
  2⤵
  PID:5976
- C:\Windows\System\baIggVI.exe
  C:\Windows\System\baIggVI.exe
  2⤵
  PID:13216
- C:\Windows\System\tGsFznn.exe
  C:\Windows\System\tGsFznn.exe
  2⤵
  PID:5152
- C:\Windows\System\kjWCsga.exe
  C:\Windows\System\kjWCsga.exe
  2⤵
  PID:10496
- C:\Windows\System\RQQwssC.exe
  C:\Windows\System\RQQwssC.exe
  2⤵
  PID:10604
- C:\Windows\System\CZxBvzX.exe
  C:\Windows\System\CZxBvzX.exe
  2⤵
  PID:4740
- C:\Windows\System\dNNlhkb.exe
  C:\Windows\System\dNNlhkb.exe
  2⤵
  PID:3856
- C:\Windows\System\JfDJkgJ.exe
  C:\Windows\System\JfDJkgJ.exe
  2⤵
  PID:10200
- C:\Windows\System\KbtCsxC.exe
  C:\Windows\System\KbtCsxC.exe
  2⤵
  PID:13304
- C:\Windows\System\CmurBJG.exe
  C:\Windows\System\CmurBJG.exe
  2⤵
  PID:9272
- C:\Windows\System\gmwKleu.exe
  C:\Windows\System\gmwKleu.exe
  2⤵
  PID:12308
- C:\Windows\System\zrajjlO.exe
  C:\Windows\System\zrajjlO.exe
  2⤵
  PID:10176
- C:\Windows\System\jFQOzpC.exe
  C:\Windows\System\jFQOzpC.exe
  2⤵
  PID:11300
- C:\Windows\System\CaMwOBa.exe
  C:\Windows\System\CaMwOBa.exe
  2⤵
  PID:12428
- C:\Windows\System\PdPLcsE.exe
  C:\Windows\System\PdPLcsE.exe
  2⤵
  PID:4412
- C:\Windows\System\gduQPPL.exe
  C:\Windows\System\gduQPPL.exe
  2⤵
  PID:11720
- C:\Windows\System\bRQDiWO.exe
  C:\Windows\System\bRQDiWO.exe
  2⤵
  PID:11700
- C:\Windows\System\TyGgNrO.exe
  C:\Windows\System\TyGgNrO.exe
  2⤵
  PID:8652
- C:\Windows\System\xQcAlIT.exe
  C:\Windows\System\xQcAlIT.exe
  2⤵
  PID:5444
- C:\Windows\System\DtEdtTA.exe
  C:\Windows\System\DtEdtTA.exe
  2⤵
  PID:9792
- C:\Windows\System\XBtncnQ.exe
  C:\Windows\System\XBtncnQ.exe
  2⤵
  PID:1676
- C:\Windows\System\KYverNJ.exe
  C:\Windows\System\KYverNJ.exe
  2⤵
  PID:7460
- C:\Windows\System\soDltYj.exe
  C:\Windows\System\soDltYj.exe
  2⤵
  PID:12320
- C:\Windows\System\yHCSHUR.exe
  C:\Windows\System\yHCSHUR.exe
  2⤵
  PID:9916
- C:\Windows\System\vuHPCKn.exe
  C:\Windows\System\vuHPCKn.exe
  2⤵
  PID:1672
- C:\Windows\System\qGLbMPH.exe
  C:\Windows\System\qGLbMPH.exe
  2⤵
  PID:12028
- C:\Windows\System\nMOOxiB.exe
  C:\Windows\System\nMOOxiB.exe
  2⤵
  PID:4744
- C:\Windows\System\IusPrfs.exe
  C:\Windows\System\IusPrfs.exe
  2⤵
  PID:12168
- C:\Windows\System\ZUlPEtS.exe
  C:\Windows\System\ZUlPEtS.exe
  2⤵
  PID:12232
- C:\Windows\System\mgCoxYk.exe
  C:\Windows\System\mgCoxYk.exe
  2⤵
  PID:11112
- C:\Windows\System\dAKMARh.exe
  C:\Windows\System\dAKMARh.exe
  2⤵
  PID:11336
- C:\Windows\System\ucJflQV.exe
  C:\Windows\System\ucJflQV.exe
  2⤵
  PID:1148
- C:\Windows\System\bMaDVhu.exe
  C:\Windows\System\bMaDVhu.exe
  2⤵
  PID:5744
- C:\Windows\System\mVqgDci.exe
  C:\Windows\System\mVqgDci.exe
  2⤵
  PID:9748
- C:\Windows\System\OGyZsgW.exe
  C:\Windows\System\OGyZsgW.exe
  2⤵
  PID:4256
- C:\Windows\System\lIUrwAB.exe
  C:\Windows\System\lIUrwAB.exe
  2⤵
  PID:2144
- C:\Windows\System\PGFBQOJ.exe
  C:\Windows\System\PGFBQOJ.exe
  2⤵
  PID:11616
- C:\Windows\System\pcUWKCC.exe
  C:\Windows\System\pcUWKCC.exe
  2⤵
  PID:11848
- C:\Windows\System\RkvKoJS.exe
  C:\Windows\System\RkvKoJS.exe
  2⤵
  PID:8436
- C:\Windows\System\dxAbOKy.exe
  C:\Windows\System\dxAbOKy.exe
  2⤵
  PID:5856
- C:\Windows\System\CVqXoAS.exe
  C:\Windows\System\CVqXoAS.exe
  2⤵
  PID:4116
- C:\Windows\System\wyDFNyJ.exe
  C:\Windows\System\wyDFNyJ.exe
  2⤵
  PID:11964
- C:\Windows\System\qXmbQOr.exe
  C:\Windows\System\qXmbQOr.exe
  2⤵
  PID:4428
- C:\Windows\System\JXqoQNb.exe
  C:\Windows\System\JXqoQNb.exe
  2⤵
  PID:2920
- C:\Windows\System\XWrWcTO.exe
  C:\Windows\System\XWrWcTO.exe
  2⤵
  PID:8332
- C:\Windows\System\egjhXXv.exe
  C:\Windows\System\egjhXXv.exe
  2⤵
  PID:12276
- C:\Windows\System\yYidBeC.exe
  C:\Windows\System\yYidBeC.exe
  2⤵
  PID:11752
- C:\Windows\System\YevHXHw.exe
  C:\Windows\System\YevHXHw.exe
  2⤵
  PID:972
- C:\Windows\System\UtYtRqS.exe
  C:\Windows\System\UtYtRqS.exe
  2⤵
  PID:11196
- C:\Windows\System\eezhIZU.exe
  C:\Windows\System\eezhIZU.exe
  2⤵
  PID:13116
- C:\Windows\System\MLhLtFH.exe
  C:\Windows\System\MLhLtFH.exe
  2⤵
  PID:12284
- C:\Windows\System\frbLKLe.exe
  C:\Windows\System\frbLKLe.exe
  2⤵
  PID:596
- C:\Windows\System\YYlyApE.exe
  C:\Windows\System\YYlyApE.exe
  2⤵
  PID:5192
- C:\Windows\System\fPYimcW.exe
  C:\Windows\System\fPYimcW.exe
  2⤵
  PID:5348
- C:\Windows\System\hLNXkbZ.exe
  C:\Windows\System\hLNXkbZ.exe
  2⤵
  PID:10948
- C:\Windows\System\Utqfxzo.exe
  C:\Windows\System\Utqfxzo.exe
  2⤵
  PID:4260
- C:\Windows\System\BCjuxAN.exe
  C:\Windows\System\BCjuxAN.exe
  2⤵
  PID:9836
- C:\Windows\System\ILdkRId.exe
  C:\Windows\System\ILdkRId.exe
  2⤵
  PID:6008
- C:\Windows\System\FTSKYAW.exe
  C:\Windows\System\FTSKYAW.exe
  2⤵
  PID:13148
- C:\Windows\System\mhvRVwH.exe
  C:\Windows\System\mhvRVwH.exe
  2⤵
  PID:11084
- C:\Windows\System\tJFPxWo.exe
  C:\Windows\System\tJFPxWo.exe
  2⤵
  PID:3064
- C:\Windows\System\kROQmRn.exe
  C:\Windows\System\kROQmRn.exe
  2⤵
  PID:6980
- C:\Windows\System\ufzrkvS.exe
  C:\Windows\System\ufzrkvS.exe
  2⤵
  PID:5280
- C:\Windows\System\cKGfwlu.exe
  C:\Windows\System\cKGfwlu.exe
  2⤵
  PID:5968
- C:\Windows\System\EjGIDGZ.exe
  C:\Windows\System\EjGIDGZ.exe
  2⤵
  PID:13200
- C:\Windows\System\JROzqZV.exe
  C:\Windows\System\JROzqZV.exe
  2⤵
  PID:5632
- C:\Windows\System\sITKeyH.exe
  C:\Windows\System\sITKeyH.exe
  2⤵
  PID:4572
- C:\Windows\System\kJiuqwy.exe
  C:\Windows\System\kJiuqwy.exe
  2⤵
  PID:1932
- C:\Windows\System\xRUqxFu.exe
  C:\Windows\System\xRUqxFu.exe
  2⤵
  PID:648
- C:\Windows\System\mrvoSAm.exe
  C:\Windows\System\mrvoSAm.exe
  2⤵
  PID:5924
- C:\Windows\System\VnZQjoz.exe
  C:\Windows\System\VnZQjoz.exe
  2⤵
  PID:840
- C:\Windows\System\asRQWwv.exe
  C:\Windows\System\asRQWwv.exe
  2⤵
  PID:4612
- C:\Windows\System\twyyShI.exe
  C:\Windows\System\twyyShI.exe
  2⤵
  PID:9372
- C:\Windows\System\BXIIXmP.exe
  C:\Windows\System\BXIIXmP.exe
  2⤵
  PID:11948
- C:\Windows\System\GKFiPgq.exe
  C:\Windows\System\GKFiPgq.exe
  2⤵
  PID:1472
- C:\Windows\System\kRtvNrU.exe
  C:\Windows\System\kRtvNrU.exe
  2⤵
  PID:6320
- C:\Windows\System\WqJjUkd.exe
  C:\Windows\System\WqJjUkd.exe
  2⤵
  PID:6464
- C:\Windows\System\ndzExVP.exe
  C:\Windows\System\ndzExVP.exe
  2⤵
  PID:9464
- C:\Windows\System\RhCYncL.exe
  C:\Windows\System\RhCYncL.exe
  2⤵
  PID:9504
- C:\Windows\System\zMnPExh.exe
  C:\Windows\System\zMnPExh.exe
  2⤵
  PID:5336
- C:\Windows\System\oQsiHuS.exe
  C:\Windows\System\oQsiHuS.exe
  2⤵
  PID:2508
- C:\Windows\System\FPjUyba.exe
  C:\Windows\System\FPjUyba.exe
  2⤵
  PID:5388
- C:\Windows\System\qIJVUWk.exe
  C:\Windows\System\qIJVUWk.exe
  2⤵
  PID:8588
- C:\Windows\System\MAqILMU.exe
  C:\Windows\System\MAqILMU.exe
  2⤵
  PID:9660
- C:\Windows\System\CAhByBg.exe
  C:\Windows\System\CAhByBg.exe
  2⤵
  PID:11828
- C:\Windows\System\bgnTzaR.exe
  C:\Windows\System\bgnTzaR.exe
  2⤵
  PID:8528
- C:\Windows\System\LqpxTal.exe
  C:\Windows\System\LqpxTal.exe
  2⤵
  PID:5572
- C:\Windows\System\PlABkSv.exe
  C:\Windows\System\PlABkSv.exe
  2⤵
  PID:6420
- C:\Windows\System\oMxvJDk.exe
  C:\Windows\System\oMxvJDk.exe
  2⤵
  PID:4416
- C:\Windows\System\qAYBSNP.exe
  C:\Windows\System\qAYBSNP.exe
  2⤵
  PID:5316
- C:\Windows\System\ZnuhpYh.exe
  C:\Windows\System\ZnuhpYh.exe
  2⤵
  PID:12728
- C:\Windows\System\NPyTBPq.exe
  C:\Windows\System\NPyTBPq.exe
  2⤵
  PID:1780
- C:\Windows\System\cTfYvbN.exe
  C:\Windows\System\cTfYvbN.exe
  2⤵
  PID:12768
- C:\Windows\System\cWpQxtl.exe
  C:\Windows\System\cWpQxtl.exe
  2⤵
  PID:5544
- C:\Windows\System\bJkfcNU.exe
  C:\Windows\System\bJkfcNU.exe
  2⤵
  PID:5900
- C:\Windows\System\jYcCfeY.exe
  C:\Windows\System\jYcCfeY.exe
  2⤵
  PID:11988
- C:\Windows\System\MReOHdH.exe
  C:\Windows\System\MReOHdH.exe
  2⤵
  PID:6036
- C:\Windows\System\cTPxYbi.exe
  C:\Windows\System\cTPxYbi.exe
  2⤵
  PID:12188
- C:\Windows\System\GqedqSD.exe
  C:\Windows\System\GqedqSD.exe
  2⤵
  PID:7836
- C:\Windows\System\TuUqjlS.exe
  C:\Windows\System\TuUqjlS.exe
  2⤵
  PID:13192
- C:\Windows\System\ZBWkkFA.exe
  C:\Windows\System\ZBWkkFA.exe
  2⤵
  PID:5104
- C:\Windows\System\vuencHY.exe
  C:\Windows\System\vuencHY.exe
  2⤵
  PID:9624
- C:\Windows\System\ARKQcaV.exe
  C:\Windows\System\ARKQcaV.exe
  2⤵
  PID:6168
- C:\Windows\System\CbJjfFY.exe
  C:\Windows\System\CbJjfFY.exe
  2⤵
  PID:8008
- C:\Windows\System\HGRytBL.exe
  C:\Windows\System\HGRytBL.exe
  2⤵
  PID:7000
- C:\Windows\System\IKZcDau.exe
  C:\Windows\System\IKZcDau.exe
  2⤵
  PID:11868
- C:\Windows\System\yHLCyGN.exe
  C:\Windows\System\yHLCyGN.exe
  2⤵
  PID:8064
- C:\Windows\System\fptladk.exe
  C:\Windows\System\fptladk.exe
  2⤵
  PID:11920
- C:\Windows\System\JnIYkQX.exe
  C:\Windows\System\JnIYkQX.exe
  2⤵
  PID:11740
- C:\Windows\System\TyzxuKv.exe
  C:\Windows\System\TyzxuKv.exe
  2⤵
  PID:7712
- C:\Windows\System\tdETRNr.exe
  C:\Windows\System\tdETRNr.exe
  2⤵
  PID:12012
- C:\Windows\System\eGWQVqL.exe
  C:\Windows\System\eGWQVqL.exe
  2⤵
  PID:5320
- C:\Windows\System\hwkooSm.exe
  C:\Windows\System\hwkooSm.exe
  2⤵
  PID:7392
- C:\Windows\System\PUalQJz.exe
  C:\Windows\System\PUalQJz.exe
  2⤵
  PID:10236
- C:\Windows\System\AEHyamB.exe
  C:\Windows\System\AEHyamB.exe
  2⤵
  PID:7992
- C:\Windows\System\yTtguxC.exe
  C:\Windows\System\yTtguxC.exe
  2⤵
  PID:7656
- C:\Windows\System\lHJVTFl.exe
  C:\Windows\System\lHJVTFl.exe
  2⤵
  PID:7928
- C:\Windows\System\XoTUAGD.exe
  C:\Windows\System\XoTUAGD.exe
  2⤵
  PID:9724
- C:\Windows\System\EPZXJwW.exe
  C:\Windows\System\EPZXJwW.exe
  2⤵
  PID:7056
- C:\Windows\System\LHDdDVq.exe
  C:\Windows\System\LHDdDVq.exe
  2⤵
  PID:244
- C:\Windows\System\npKOTic.exe
  C:\Windows\System\npKOTic.exe
  2⤵
  PID:11780
- C:\Windows\System\BlZXMUa.exe
  C:\Windows\System\BlZXMUa.exe
  2⤵
  PID:6508
- C:\Windows\System\wiRtkgd.exe
  C:\Windows\System\wiRtkgd.exe
  2⤵
  PID:6840
- C:\Windows\System\RLPlsNK.exe
  C:\Windows\System\RLPlsNK.exe
  2⤵
  PID:5700
- C:\Windows\System\TPRupuR.exe
  C:\Windows\System\TPRupuR.exe
  2⤵
  PID:2748
- C:\Windows\System\qCyXmHq.exe
  C:\Windows\System\qCyXmHq.exe
  2⤵
  PID:8016
- C:\Windows\System\NfKjKkD.exe
  C:\Windows\System\NfKjKkD.exe
  2⤵
  PID:7896
- C:\Windows\System\gFgBxbq.exe
  C:\Windows\System\gFgBxbq.exe
  2⤵
  PID:7984
- C:\Windows\System\CIrkteG.exe
  C:\Windows\System\CIrkteG.exe
  2⤵
  PID:8020
- C:\Windows\System\cmQwJfA.exe
  C:\Windows\System\cmQwJfA.exe
  2⤵
  PID:7508
- C:\Windows\System\YIcxXTK.exe
  C:\Windows\System\YIcxXTK.exe
  2⤵
  PID:7532
- C:\Windows\System\jxwpsxx.exe
  C:\Windows\System\jxwpsxx.exe
  2⤵
  PID:7768
- C:\Windows\System\FiIbgvW.exe
  C:\Windows\System\FiIbgvW.exe
  2⤵
  PID:7340
- C:\Windows\System\VsuipUa.exe
  C:\Windows\System\VsuipUa.exe
  2⤵
  PID:8044
- C:\Windows\System\hpxELLY.exe
  C:\Windows\System\hpxELLY.exe
  2⤵
  PID:9140
- C:\Windows\System\PVnRdch.exe
  C:\Windows\System\PVnRdch.exe
  2⤵
  PID:4012
- C:\Windows\System\xQxGGZV.exe
  C:\Windows\System\xQxGGZV.exe
  2⤵
  PID:10944
- C:\Windows\System\qOpwpCD.exe
  C:\Windows\System\qOpwpCD.exe
  2⤵
  PID:6728
- C:\Windows\System\fPbQCoo.exe
  C:\Windows\System\fPbQCoo.exe
  2⤵
  PID:7256
- C:\Windows\System\VThIlFa.exe
  C:\Windows\System\VThIlFa.exe
  2⤵
  PID:4936
- C:\Windows\System\BXtAJES.exe
  C:\Windows\System\BXtAJES.exe
  2⤵
  PID:8684
- C:\Windows\System\zlMQFbv.exe
  C:\Windows\System\zlMQFbv.exe
  2⤵
  PID:6488
- C:\Windows\System\mcovQYU.exe
  C:\Windows\System\mcovQYU.exe
  2⤵
  PID:7088
- C:\Windows\System\XskacXq.exe
  C:\Windows\System\XskacXq.exe
  2⤵
  PID:8620
- C:\Windows\System\MkeqxUB.exe
  C:\Windows\System\MkeqxUB.exe
  2⤵
  PID:8372
- C:\Windows\System\AAwUTeV.exe
  C:\Windows\System\AAwUTeV.exe
  2⤵
  PID:8960
- C:\Windows\System\rDLlIce.exe
  C:\Windows\System\rDLlIce.exe
  2⤵
  PID:6000
- C:\Windows\System\seInbqC.exe
  C:\Windows\System\seInbqC.exe
  2⤵
  PID:6860
- C:\Windows\System\TPTYOeT.exe
  C:\Windows\System\TPTYOeT.exe
  2⤵
  PID:4000
- C:\Windows\System\OeLGzYL.exe
  C:\Windows\System\OeLGzYL.exe
  2⤵
  PID:2948
- C:\Windows\System\npBiwQQ.exe
  C:\Windows\System\npBiwQQ.exe
  2⤵
  PID:1124
- C:\Windows\System\CuRxNCj.exe
  C:\Windows\System\CuRxNCj.exe
  2⤵
  PID:11256
- C:\Windows\System\Jdevlnl.exe
  C:\Windows\System\Jdevlnl.exe
  2⤵
  PID:1948
- C:\Windows\System\CtxvGdV.exe
  C:\Windows\System\CtxvGdV.exe
  2⤵
  PID:9156
- C:\Windows\System\eqEhKmi.exe
  C:\Windows\System\eqEhKmi.exe
  2⤵
  PID:8024
- C:\Windows\System\CNGfzhG.exe
  C:\Windows\System\CNGfzhG.exe
  2⤵
  PID:5284
- C:\Windows\System\BkShRDo.exe
  C:\Windows\System\BkShRDo.exe
  2⤵
  PID:6264
- C:\Windows\System\DbKhrus.exe
  C:\Windows\System\DbKhrus.exe
  2⤵
  PID:5324
- C:\Windows\System\EFQyfLR.exe
  C:\Windows\System\EFQyfLR.exe
  2⤵
  PID:6616
- C:\Windows\System\WttNuaE.exe
  C:\Windows\System\WttNuaE.exe
  2⤵
  PID:9116
- C:\Windows\System\WuWQNfz.exe
  C:\Windows\System\WuWQNfz.exe
  2⤵
  PID:8360
- C:\Windows\System\NGaqVgC.exe
  C:\Windows\System\NGaqVgC.exe
  2⤵
  PID:7048
- C:\Windows\System\anAFwSr.exe
  C:\Windows\System\anAFwSr.exe
  2⤵
  PID:5016
- C:\Windows\System\kuKxOQM.exe
  C:\Windows\System\kuKxOQM.exe
  2⤵
  PID:3212
- C:\Windows\System\ihYwiok.exe
  C:\Windows\System\ihYwiok.exe
  2⤵
  PID:6484
- C:\Windows\System\cyQlBek.exe
  C:\Windows\System\cyQlBek.exe
  2⤵
  PID:5736
- C:\Windows\System\JcXrEcG.exe
  C:\Windows\System\JcXrEcG.exe
  2⤵
  PID:7344
- C:\Windows\System\FTiNvgH.exe
  C:\Windows\System\FTiNvgH.exe
  2⤵
  PID:8948
- C:\Windows\System\QmNInla.exe
  C:\Windows\System\QmNInla.exe
  2⤵
  PID:8084
- C:\Windows\System\JlCeunb.exe
  C:\Windows\System\JlCeunb.exe
  2⤵
  PID:9164
- C:\Windows\System\JeoJFRT.exe
  C:\Windows\System\JeoJFRT.exe
  2⤵
  PID:11696
- C:\Windows\System\qhMqxuF.exe
  C:\Windows\System\qhMqxuF.exe
  2⤵
  PID:8572
- C:\Windows\System\XnQqFLp.exe
  C:\Windows\System\XnQqFLp.exe
  2⤵
  PID:13120
- C:\Windows\System\gfdRgPm.exe
  C:\Windows\System\gfdRgPm.exe
  2⤵
  PID:7612
- C:\Windows\System\ysvMPqu.exe
  C:\Windows\System\ysvMPqu.exe
  2⤵
  PID:9416
- C:\Windows\System\KyBOryv.exe
  C:\Windows\System\KyBOryv.exe
  2⤵
  PID:5188
- C:\Windows\System\AtRFSMh.exe
  C:\Windows\System\AtRFSMh.exe
  2⤵
  PID:3840
- C:\Windows\System\gLhJYDS.exe
  C:\Windows\System\gLhJYDS.exe
  2⤵
  PID:336
- C:\Windows\System\WQrJsah.exe
  C:\Windows\System\WQrJsah.exe
  2⤵
  PID:8232
- C:\Windows\System\iZHBHAJ.exe
  C:\Windows\System\iZHBHAJ.exe
  2⤵
  PID:6176
- C:\Windows\System\PLRLNdK.exe
  C:\Windows\System\PLRLNdK.exe
  2⤵
  PID:5824
- C:\Windows\System\JebkoAS.exe
  C:\Windows\System\JebkoAS.exe
  2⤵
  PID:7020
- C:\Windows\System\fFDMaJI.exe
  C:\Windows\System\fFDMaJI.exe
  2⤵
  PID:6136
- C:\Windows\System\tLzOUBe.exe
  C:\Windows\System\tLzOUBe.exe
  2⤵
  PID:8040
- C:\Windows\System\hSYIcDf.exe
  C:\Windows\System\hSYIcDf.exe
  2⤵
  PID:7740
- C:\Windows\System\mbSHkcR.exe
  C:\Windows\System\mbSHkcR.exe
  2⤵
  PID:8976
- C:\Windows\System\EQyJpWy.exe
  C:\Windows\System\EQyJpWy.exe
  2⤵
  PID:6772
- C:\Windows\System\wwaWmfi.exe
  C:\Windows\System\wwaWmfi.exe
  2⤵
  PID:10052
- C:\Windows\System\bjTwbac.exe
  C:\Windows\System\bjTwbac.exe
  2⤵
  PID:7008
- C:\Windows\System\OAgHmCX.exe
  C:\Windows\System\OAgHmCX.exe
  2⤵
  PID:10228
- C:\Windows\System\LaOIriO.exe
  C:\Windows\System\LaOIriO.exe
  2⤵
  PID:9268
- C:\Windows\System\cPjMlpc.exe
  C:\Windows\System\cPjMlpc.exe
  2⤵
  PID:8336
- C:\Windows\System\KrJSfKm.exe
  C:\Windows\System\KrJSfKm.exe
  2⤵
  PID:7552
- C:\Windows\System\fbNhtPs.exe
  C:\Windows\System\fbNhtPs.exe
  2⤵
  PID:8472
- C:\Windows\System\yZHpzts.exe
  C:\Windows\System\yZHpzts.exe
  2⤵
  PID:9100
- C:\Windows\System\ssryRyQ.exe
  C:\Windows\System\ssryRyQ.exe
  2⤵
  PID:7572
- C:\Windows\System\LrYWAga.exe
  C:\Windows\System\LrYWAga.exe
  2⤵
  PID:9332
- C:\Windows\System\Jesuubj.exe
  C:\Windows\System\Jesuubj.exe
  2⤵
  PID:9212
- C:\Windows\System\gKUpKoJ.exe
  C:\Windows\System\gKUpKoJ.exe
  2⤵
  PID:8240
- C:\Windows\System\lUUkZTl.exe
  C:\Windows\System\lUUkZTl.exe
  2⤵
  PID:7540
- C:\Windows\System\iYuiVuO.exe
  C:\Windows\System\iYuiVuO.exe
  2⤵
  PID:8364
- C:\Windows\System\QMYoRMm.exe
  C:\Windows\System\QMYoRMm.exe
  2⤵
  PID:10272
- C:\Windows\System\dBXEEfu.exe
  C:\Windows\System\dBXEEfu.exe
  2⤵
  PID:7692
- C:\Windows\System\eqnrfFP.exe
  C:\Windows\System\eqnrfFP.exe
  2⤵
  PID:9492
- C:\Windows\System\GCQTlLc.exe
  C:\Windows\System\GCQTlLc.exe
  2⤵
  PID:5488
- C:\Windows\System\VTsDhKA.exe
  C:\Windows\System\VTsDhKA.exe
  2⤵
  PID:10388
- C:\Windows\System\vLYSaHB.exe
  C:\Windows\System\vLYSaHB.exe
  2⤵
  PID:7820
- C:\Windows\System\cdInUdJ.exe
  C:\Windows\System\cdInUdJ.exe
  2⤵
  PID:9864
- C:\Windows\System\lvpnGxA.exe
  C:\Windows\System\lvpnGxA.exe
  2⤵
  PID:9920
- C:\Windows\System\ERegOfw.exe
  C:\Windows\System\ERegOfw.exe
  2⤵
  PID:10620
- C:\Windows\System\pIcfDuQ.exe
  C:\Windows\System\pIcfDuQ.exe
  2⤵
  PID:10660
- C:\Windows\System\gwuXeCH.exe
  C:\Windows\System\gwuXeCH.exe
  2⤵
  PID:6748
- C:\Windows\System\SbdteIy.exe
  C:\Windows\System\SbdteIy.exe
  2⤵
  PID:7216
- C:\Windows\System\rHWzMaX.exe
  C:\Windows\System\rHWzMaX.exe
  2⤵
  PID:6336
- C:\Windows\System\kZnLvvV.exe
  C:\Windows\System\kZnLvvV.exe
  2⤵
  PID:8672
- C:\Windows\System\zFNsdWA.exe
  C:\Windows\System\zFNsdWA.exe
  2⤵
  PID:10988
- C:\Windows\System\XtsnHWe.exe
  C:\Windows\System\XtsnHWe.exe
  2⤵
  PID:8132
- C:\Windows\System\PmSlUWW.exe
  C:\Windows\System\PmSlUWW.exe
  2⤵
  PID:10300
- C:\Windows\System\pDZPPYY.exe
  C:\Windows\System\pDZPPYY.exe
  2⤵
  PID:7648
- C:\Windows\System\bzIREOe.exe
  C:\Windows\System\bzIREOe.exe
  2⤵
  PID:9496
- C:\Windows\System\dfswvLz.exe
  C:\Windows\System\dfswvLz.exe
  2⤵
  PID:6296
- C:\Windows\System\sKtAZGr.exe
  C:\Windows\System\sKtAZGr.exe
  2⤵
  PID:10344
- C:\Windows\System\yktZhDt.exe
  C:\Windows\System\yktZhDt.exe
  2⤵
  PID:13132
- C:\Windows\System\XARDseE.exe
  C:\Windows\System\XARDseE.exe
  2⤵
  PID:8680
- C:\Windows\System\hzLyyBa.exe
  C:\Windows\System\hzLyyBa.exe
  2⤵
  PID:11908
- C:\Windows\System\yRCQtzB.exe
  C:\Windows\System\yRCQtzB.exe
  2⤵
  PID:11188
- C:\Windows\System\gNpFGdg.exe
  C:\Windows\System\gNpFGdg.exe
  2⤵
  PID:11012
- C:\Windows\System\lVicIyF.exe
  C:\Windows\System\lVicIyF.exe
  2⤵
  PID:10560
- C:\Windows\System\wTlFhPW.exe
  C:\Windows\System\wTlFhPW.exe
  2⤵
  PID:1136
- C:\Windows\System\rjKmDwJ.exe
  C:\Windows\System\rjKmDwJ.exe
  2⤵
  PID:11172
- C:\Windows\System\CoZUeMG.exe
  C:\Windows\System\CoZUeMG.exe
  2⤵
  PID:10708
- C:\Windows\System\nwXhHmQ.exe
  C:\Windows\System\nwXhHmQ.exe
  2⤵
  PID:1688
- C:\Windows\System\sBenfTI.exe
  C:\Windows\System\sBenfTI.exe
  2⤵
  PID:11328
- C:\Windows\System\STNQLVv.exe
  C:\Windows\System\STNQLVv.exe
  2⤵
  PID:11308
- C:\Windows\System\fHcmbom.exe
  C:\Windows\System\fHcmbom.exe
  2⤵
  PID:8972
- C:\Windows\System\WRwNLUy.exe
  C:\Windows\System\WRwNLUy.exe
  2⤵
  PID:10992
- C:\Windows\System\jweHCyU.exe
  C:\Windows\System\jweHCyU.exe
  2⤵
  PID:11060
- C:\Windows\System\eVbrGLq.exe
  C:\Windows\System\eVbrGLq.exe
  2⤵
  PID:9552
- C:\Windows\System\HXfNKOw.exe
  C:\Windows\System\HXfNKOw.exe
  2⤵
  PID:3484
- C:\Windows\System\lhOLZaM.exe
  C:\Windows\System\lhOLZaM.exe
  2⤵
  PID:11604
- C:\Windows\System\nNCydfu.exe
  C:\Windows\System\nNCydfu.exe
  2⤵
  PID:7668
- C:\Windows\System\aeaVWez.exe
  C:\Windows\System\aeaVWez.exe
  2⤵
  PID:3532
- C:\Windows\System\KWhjCpq.exe
  C:\Windows\System\KWhjCpq.exe
  2⤵
  PID:6400
- C:\Windows\System\OPqrrtM.exe
  C:\Windows\System\OPqrrtM.exe
  2⤵
  PID:10448
- C:\Windows\System\LMcLbYM.exe
  C:\Windows\System\LMcLbYM.exe
  2⤵
  PID:2088
- C:\Windows\System\UxenBKa.exe
  C:\Windows\System\UxenBKa.exe
  2⤵
  PID:11024
- C:\Windows\System\KmfWonl.exe
  C:\Windows\System\KmfWonl.exe
  2⤵
  PID:10160
- C:\Windows\System\BoXOxsE.exe
  C:\Windows\System\BoXOxsE.exe
  2⤵
  PID:11028
- C:\Windows\System\TuuvzTp.exe
  C:\Windows\System\TuuvzTp.exe
  2⤵
  PID:13336
- C:\Windows\System\afsoXnb.exe
  C:\Windows\System\afsoXnb.exe
  2⤵
  PID:13360
- C:\Windows\System\iMbhXUI.exe
  C:\Windows\System\iMbhXUI.exe
  2⤵
  PID:13388
- C:\Windows\System\EgTMGel.exe
  C:\Windows\System\EgTMGel.exe
  2⤵
  PID:13404
- C:\Windows\System\KhphNaE.exe
  C:\Windows\System\KhphNaE.exe
  2⤵
  PID:13428
- C:\Windows\System\dUFZCch.exe
  C:\Windows\System\dUFZCch.exe
  2⤵
  PID:13452
- C:\Windows\System\tSAxODr.exe
  C:\Windows\System\tSAxODr.exe
  2⤵
  PID:13468
- C:\Windows\System\vnQRhTc.exe
  C:\Windows\System\vnQRhTc.exe
  2⤵
  PID:13500
- C:\Windows\System\DtttDcl.exe
  C:\Windows\System\DtttDcl.exe
  2⤵
  PID:13528
- C:\Windows\System\Oksfoti.exe
  C:\Windows\System\Oksfoti.exe
  2⤵
  PID:13560
- C:\Windows\System\hslMLrE.exe
  C:\Windows\System\hslMLrE.exe
  2⤵
  PID:13588
- C:\Windows\System\JzDIMgW.exe
  C:\Windows\System\JzDIMgW.exe
  2⤵
  PID:13608
- C:\Windows\System\CivfcRW.exe
  C:\Windows\System\CivfcRW.exe
  2⤵
  PID:13636
- C:\Windows\System\vGyhLVQ.exe
  C:\Windows\System\vGyhLVQ.exe
  2⤵
  PID:13660
- C:\Windows\System\iYghXbF.exe
  C:\Windows\System\iYghXbF.exe
  2⤵
  PID:13692
- C:\Windows\System\CcQFduG.exe
  C:\Windows\System\CcQFduG.exe
  2⤵
  PID:13716
- C:\Windows\System\zLnXWYZ.exe
  C:\Windows\System\zLnXWYZ.exe
  2⤵
  PID:13744
- C:\Windows\System\tavMALw.exe
  C:\Windows\System\tavMALw.exe
  2⤵
  PID:13772
- C:\Windows\System\CRmLmdS.exe
  C:\Windows\System\CRmLmdS.exe
  2⤵
  PID:13804
- C:\Windows\System\YoFRXHD.exe
  C:\Windows\System\YoFRXHD.exe
  2⤵
  PID:13832
- C:\Windows\System\hafyiWr.exe
  C:\Windows\System\hafyiWr.exe
  2⤵
  PID:13860
- C:\Windows\System\omHweMj.exe
  C:\Windows\System\omHweMj.exe
  2⤵
  PID:13884
- C:\Windows\System\olgtjDE.exe
  C:\Windows\System\olgtjDE.exe
  2⤵
  PID:13908
- C:\Windows\System\oQQDIfY.exe
  C:\Windows\System\oQQDIfY.exe
  2⤵
  PID:13936
- C:\Windows\System\KNdxUnF.exe
  C:\Windows\System\KNdxUnF.exe
  2⤵
  PID:13956
- C:\Windows\System\bhZdzRd.exe
  C:\Windows\System\bhZdzRd.exe
  2⤵
  PID:13980
- C:\Windows\System\KOYkADg.exe
  C:\Windows\System\KOYkADg.exe
  2⤵
  PID:13996
- C:\Windows\System\sOyrKsv.exe
  C:\Windows\System\sOyrKsv.exe
  2⤵
  PID:14016
- C:\Windows\System\jqpZqxf.exe
  C:\Windows\System\jqpZqxf.exe
  2⤵
  PID:14052
- C:\Windows\System\RFVfors.exe
  C:\Windows\System\RFVfors.exe
  2⤵
  PID:14076
- C:\Windows\System\twRVtci.exe
  C:\Windows\System\twRVtci.exe
  2⤵
  PID:14104
- C:\Windows\System\XRstrBX.exe
  C:\Windows\System\XRstrBX.exe
  2⤵
  PID:14124
- C:\Windows\System\xxWMYql.exe
  C:\Windows\System\xxWMYql.exe
  2⤵
  PID:14148
- C:\Windows\System\nXFkflN.exe
  C:\Windows\System\nXFkflN.exe
  2⤵
  PID:14168
- C:\Windows\System\ellEAij.exe
  C:\Windows\System\ellEAij.exe
  2⤵
  PID:10504
- C:\Windows\System\BlnHvME.exe
  C:\Windows\System\BlnHvME.exe
  2⤵
  PID:11460
- C:\Windows\System\qgmiFXc.exe
  C:\Windows\System\qgmiFXc.exe
  2⤵
  PID:10348
- C:\Windows\System\fLsWjSk.exe
  C:\Windows\System\fLsWjSk.exe
  2⤵
  PID:12000
- C:\Windows\System\JTDhZIk.exe
  C:\Windows\System\JTDhZIk.exe
  2⤵
  PID:13540
- C:\Windows\System\fEgICGi.exe
  C:\Windows\System\fEgICGi.exe
  2⤵
  PID:10400
- C:\Windows\System\UzSxdmV.exe
  C:\Windows\System\UzSxdmV.exe
  2⤵
  PID:2752
- C:\Windows\System\zfMybsP.exe
  C:\Windows\System\zfMybsP.exe
  2⤵
  PID:6884
- C:\Windows\System\FpZqIFB.exe
  C:\Windows\System\FpZqIFB.exe
  2⤵
  PID:11480
- C:\Windows\System\TzHYAdV.exe
  C:\Windows\System\TzHYAdV.exe
  2⤵
  PID:9152
- C:\Windows\System\pHCWril.exe
  C:\Windows\System\pHCWril.exe
  2⤵
  PID:13732
- C:\Windows\System\NpzmMCb.exe
  C:\Windows\System\NpzmMCb.exe
  2⤵
  PID:13756
- C:\Windows\System\CyzludJ.exe
  C:\Windows\System\CyzludJ.exe
  2⤵
  PID:11912
- C:\Windows\System\DrHwLlh.exe
  C:\Windows\System\DrHwLlh.exe
  2⤵
  PID:13424
- C:\Windows\System\lQYmxiF.exe
  C:\Windows\System\lQYmxiF.exe
  2⤵
  PID:13880
- C:\Windows\System\swpfOGj.exe
  C:\Windows\System\swpfOGj.exe
  2⤵
  PID:536
- C:\Windows\System\WOzDtCS.exe
  C:\Windows\System\WOzDtCS.exe
  2⤵
  PID:13032
- C:\Windows\System\dxSkqBN.exe
  C:\Windows\System\dxSkqBN.exe
  2⤵
  PID:13616
- C:\Windows\System\xHQnvlL.exe
  C:\Windows\System\xHQnvlL.exe
  2⤵
  PID:14064
- C:\Windows\System\HZnHcXH.exe
  C:\Windows\System\HZnHcXH.exe
  2⤵
  PID:13680
- C:\Windows\System\gNETImF.exe
  C:\Windows\System\gNETImF.exe
  2⤵
  PID:13384
- C:\Windows\System\mgwXwNi.exe
  C:\Windows\System\mgwXwNi.exe
  2⤵
  PID:13572
- C:\Windows\System\SyhEHIX.exe
  C:\Windows\System\SyhEHIX.exe
  2⤵
  PID:13044
- C:\Windows\System\PMoruQM.exe
  C:\Windows\System\PMoruQM.exe
  2⤵
  PID:14092
- C:\Windows\System\sJnbAMA.exe
  C:\Windows\System\sJnbAMA.exe
  2⤵
  PID:13760
- C:\Windows\System\rIihcjt.exe
  C:\Windows\System\rIihcjt.exe
  2⤵
  PID:13904
- C:\Windows\System\xXmCFjT.exe
  C:\Windows\System\xXmCFjT.exe
  2⤵
  PID:13968
- C:\Windows\System\iGfQVvc.exe
  C:\Windows\System\iGfQVvc.exe
  2⤵
  PID:13028
- C:\Windows\System\ZbwkBKy.exe
  C:\Windows\System\ZbwkBKy.exe
  2⤵
  PID:11332
- C:\Windows\System\EkdgSMj.exe
  C:\Windows\System\EkdgSMj.exe
  2⤵
  PID:10424
- C:\Windows\System\EKxyljy.exe
  C:\Windows\System\EKxyljy.exe
  2⤵
  PID:6396
- C:\Windows\System\TgzdMqA.exe
  C:\Windows\System\TgzdMqA.exe
  2⤵
  PID:13248
- C:\Windows\System\GhTvsNQ.exe
  C:\Windows\System\GhTvsNQ.exe
  2⤵
  PID:10252
- C:\Windows\System\HEIKAnr.exe
  C:\Windows\System\HEIKAnr.exe
  2⤵
  PID:10512
- C:\Windows\System\OxGETRt.exe
  C:\Windows\System\OxGETRt.exe
  2⤵
  PID:10136
- C:\Windows\System\NyWviuY.exe
  C:\Windows\System\NyWviuY.exe
  2⤵
  PID:13848
- C:\Windows\System\EhWcXJw.exe
  C:\Windows\System\EhWcXJw.exe
  2⤵
  PID:13876
- C:\Windows\System\PYpJKks.exe
  C:\Windows\System\PYpJKks.exe
  2⤵
  PID:13316
- C:\Windows\System\QMyUpLa.exe
  C:\Windows\System\QMyUpLa.exe
  2⤵
  PID:13712
- C:\Windows\System\KMgFRBQ.exe
  C:\Windows\System\KMgFRBQ.exe
  2⤵
  PID:14072
- C:\Windows\System\HpHtPsc.exe
  C:\Windows\System\HpHtPsc.exe
  2⤵
  PID:12920
- C:\Windows\System\WRdKBMU.exe
  C:\Windows\System\WRdKBMU.exe
  2⤵
  PID:13396
- C:\Windows\System\knRnQGH.exe
  C:\Windows\System\knRnQGH.exe
  2⤵
  PID:8624
- C:\Windows\System\YQiWJvT.exe
  C:\Windows\System\YQiWJvT.exe
  2⤵
  PID:9232
- C:\Windows\System\ZMODOPU.exe
  C:\Windows\System\ZMODOPU.exe
  2⤵
  PID:14012
- C:\Windows\System\ltwtJwV.exe
  C:\Windows\System\ltwtJwV.exe
  2⤵
  PID:12300
- C:\Windows\System\DiiotIM.exe
  C:\Windows\System\DiiotIM.exe
  2⤵
  PID:14276
- C:\Windows\System\vXXuIIp.exe
  C:\Windows\System\vXXuIIp.exe
  2⤵
  PID:11588
- C:\Windows\System\QDpVofr.exe
  C:\Windows\System\QDpVofr.exe
  2⤵
  PID:11076
- C:\Windows\System\GtBJyWK.exe
  C:\Windows\System\GtBJyWK.exe
  2⤵
  PID:13440
- C:\Windows\System\KgsLHUM.exe
  C:\Windows\System\KgsLHUM.exe
  2⤵
  PID:13800
- C:\Windows\System\evBYWBG.exe
  C:\Windows\System\evBYWBG.exe
  2⤵
  PID:14164
- C:\Windows\System\NzeOhob.exe
  C:\Windows\System\NzeOhob.exe
  2⤵
  PID:13380
- C:\Windows\System\axqCoMN.exe
  C:\Windows\System\axqCoMN.exe
  2⤵
  PID:12932
- C:\Windows\System\zjSbRGm.exe
  C:\Windows\System\zjSbRGm.exe
  2⤵
  PID:13896
- C:\Windows\System\OVdjXhV.exe
  C:\Windows\System\OVdjXhV.exe
  2⤵
  PID:10732
- C:\Windows\System\miXUMUI.exe
  C:\Windows\System\miXUMUI.exe
  2⤵
  PID:14240
- C:\Windows\System\lraLEXK.exe
  C:\Windows\System\lraLEXK.exe
  2⤵
  PID:12048
- C:\Windows\System\OalzWBJ.exe
  C:\Windows\System\OalzWBJ.exe
  2⤵
  PID:10060
- C:\Windows\System\uRGChsu.exe
  C:\Windows\System\uRGChsu.exe
  2⤵
  PID:10976
- C:\Windows\System\iSZMQux.exe
  C:\Windows\System\iSZMQux.exe
  2⤵
  PID:11568
- C:\Windows\System\sHiRwom.exe
  C:\Windows\System\sHiRwom.exe
  2⤵
  PID:14344
- C:\Windows\System\mROqazk.exe
  C:\Windows\System\mROqazk.exe
  2⤵
  PID:14384
- C:\Windows\System\QTUvtyk.exe
  C:\Windows\System\QTUvtyk.exe
  2⤵
  PID:14428
- C:\Windows\System\NWMvmTn.exe
  C:\Windows\System\NWMvmTn.exe
  2⤵
  PID:14456
- C:\Windows\System\jPbBQDK.exe
  C:\Windows\System\jPbBQDK.exe
  2⤵
  PID:14488
- C:\Windows\System\OeuLfKt.exe
  C:\Windows\System\OeuLfKt.exe
  2⤵
  PID:14516
- C:\Windows\System\VJebyKe.exe
  C:\Windows\System\VJebyKe.exe
  2⤵
  PID:14556
- C:\Windows\System\nqyVPbX.exe
  C:\Windows\System\nqyVPbX.exe
  2⤵
  PID:14576
- C:\Windows\System\ECzcIFp.exe
  C:\Windows\System\ECzcIFp.exe
  2⤵
  PID:14608
- C:\Windows\System\bTlRCwe.exe
  C:\Windows\System\bTlRCwe.exe
  2⤵
  PID:14636
- C:\Windows\System\FZORDrY.exe
  C:\Windows\System\FZORDrY.exe
  2⤵
  PID:14664
- C:\Windows\System\XawLucc.exe
  C:\Windows\System\XawLucc.exe
  2⤵
  PID:14692
- C:\Windows\System\EqxdKhQ.exe
  C:\Windows\System\EqxdKhQ.exe
  2⤵
  PID:14720
- C:\Windows\System\DMdFlJN.exe
  C:\Windows\System\DMdFlJN.exe
  2⤵
  PID:14752
- C:\Windows\System\IVLAuYj.exe
  C:\Windows\System\IVLAuYj.exe
  2⤵
  PID:14788
- C:\Windows\System\rRfjQkc.exe
  C:\Windows\System\rRfjQkc.exe
  2⤵
  PID:14820
- C:\Windows\System\JDmhjXk.exe
  C:\Windows\System\JDmhjXk.exe
  2⤵
  PID:14844
- C:\Windows\System\ezUGhbu.exe
  C:\Windows\System\ezUGhbu.exe
  2⤵
  PID:14872
- C:\Windows\System\mFOjgMa.exe
  C:\Windows\System\mFOjgMa.exe
  2⤵
  PID:14916
- C:\Windows\System\UzdSMYE.exe
  C:\Windows\System\UzdSMYE.exe
  2⤵
  PID:14992
- C:\Windows\System\FpEwfzg.exe
  C:\Windows\System\FpEwfzg.exe
  2⤵
  PID:15008
- C:\Windows\System\xwmlIPQ.exe
  C:\Windows\System\xwmlIPQ.exe
  2⤵
  PID:15024
- C:\Windows\System\KnDjrfR.exe
  C:\Windows\System\KnDjrfR.exe
  2⤵
  PID:15040
- C:\Windows\System\JjKuTZp.exe
  C:\Windows\System\JjKuTZp.exe
  2⤵
  PID:15112
- C:\Windows\System\NeEVyYJ.exe
  C:\Windows\System\NeEVyYJ.exe
  2⤵
  PID:15132
- C:\Windows\System\pWUTqyz.exe
  C:\Windows\System\pWUTqyz.exe
  2⤵
  PID:15148
- C:\Windows\System\NuSxlCY.exe
  C:\Windows\System\NuSxlCY.exe
  2⤵
  PID:15164
- C:\Windows\System\MOYyubs.exe
  C:\Windows\System\MOYyubs.exe
  2⤵
  PID:15180
- C:\Windows\System\nanIvve.exe
  C:\Windows\System\nanIvve.exe
  2⤵
  PID:15196
- C:\Windows\System\uwTwshv.exe
  C:\Windows\System\uwTwshv.exe
  2⤵
  PID:15212
- C:\Windows\System\CtIUuTK.exe
  C:\Windows\System\CtIUuTK.exe
  2⤵
  PID:15232
- C:\Windows\System\wvDrHMZ.exe
  C:\Windows\System\wvDrHMZ.exe
  2⤵
  PID:15256
- C:\Windows\System\IYjBziP.exe
  C:\Windows\System\IYjBziP.exe
  2⤵
  PID:15280
- C:\Windows\System\OWiyJqi.exe
  C:\Windows\System\OWiyJqi.exe
  2⤵
  PID:15304
- C:\Windows\System\cwoXzUx.exe
  C:\Windows\System\cwoXzUx.exe
  2⤵
  PID:15332
- C:\Windows\System\kUusumB.exe
  C:\Windows\System\kUusumB.exe
  2⤵
  PID:13788
- C:\Windows\System\DDjNkZh.exe
  C:\Windows\System\DDjNkZh.exe
  2⤵
  PID:11008
- C:\Windows\System\VKiqZQT.exe
  C:\Windows\System\VKiqZQT.exe
  2⤵
  PID:14452
- C:\Windows\System\DBRTGvZ.exe
  C:\Windows\System\DBRTGvZ.exe
  2⤵
  PID:14620
- C:\Windows\System\mLmeOVY.exe
  C:\Windows\System\mLmeOVY.exe
  2⤵
  PID:14632
- C:\Windows\System\WHZwuJV.exe
  C:\Windows\System\WHZwuJV.exe
  2⤵
  PID:14676
- C:\Windows\System\OeEEBgj.exe
  C:\Windows\System\OeEEBgj.exe
  2⤵
  PID:14764
- C:\Windows\System\NMFgoqY.exe
  C:\Windows\System\NMFgoqY.exe
  2⤵
  PID:12852
- C:\Windows\System\XvLRnUi.exe
  C:\Windows\System\XvLRnUi.exe
  2⤵
  PID:14868
- C:\Windows\System\MwrJQdY.exe
  C:\Windows\System\MwrJQdY.exe
  2⤵
  PID:14944
- C:\Windows\System\odaRRSW.exe
  C:\Windows\System\odaRRSW.exe
  2⤵
  PID:15000
- C:\Windows\System\SOGVbdv.exe
  C:\Windows\System\SOGVbdv.exe
  2⤵
  PID:15016
- C:\Windows\System\gxEpMda.exe
  C:\Windows\System\gxEpMda.exe
  2⤵
  PID:15072
- C:\Windows\System\ONOghJc.exe
  C:\Windows\System\ONOghJc.exe
  2⤵
  PID:14976
- C:\Windows\System\AYaiXOK.exe
  C:\Windows\System\AYaiXOK.exe
  2⤵
  PID:15160
- C:\Windows\System\dURwTrB.exe
  C:\Windows\System\dURwTrB.exe
  2⤵
  PID:14984
- C:\Windows\System\xKjpvpZ.exe
  C:\Windows\System\xKjpvpZ.exe
  2⤵
  PID:15156
- C:\Windows\System\XbyVzDs.exe
  C:\Windows\System\XbyVzDs.exe
  2⤵
  PID:15108
- C:\Windows\System\CiVrUSg.exe
  C:\Windows\System\CiVrUSg.exe
  2⤵
  PID:14856
- C:\Windows\System\wtlBeEp.exe
  C:\Windows\System\wtlBeEp.exe
  2⤵
  PID:14896
- C:\Windows\System\gQaXVJL.exe
  C:\Windows\System\gQaXVJL.exe
  2⤵
  PID:14688
- C:\Windows\System\JlhneqP.exe
  C:\Windows\System\JlhneqP.exe
  2⤵
  PID:15060
- C:\Windows\System\cvcerVG.exe
  C:\Windows\System\cvcerVG.exe
  2⤵
  PID:16044
- C:\Windows\System\ZXDHqiM.exe
  C:\Windows\System\ZXDHqiM.exe
  2⤵
  PID:16076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hz2tam3.fe2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiqVooN.exe

Filesize
1.5MB

MD5
77d20b0704906d2afe3ce50dd69f139c

SHA1
e223a79c781fe6de11aefa5f44e356addfcb7b3a

SHA256
0f29e373f79f7d90db45ae57d9d5acb17c63dfd599b1052fe7c887e80b8b1b14

SHA512
b2ac765995d1651a657d9a4a018f1233763fb33c690845b706333ebe3bc64135af14c31623744ff312f8175ff84446219b1b2402dccb1b117058bd61f76d7fa7

Download Submit
C:\Windows\System\DFIRoFu.exe

Filesize
1.5MB

MD5
625578e291746ea66f0846f2b430861a

SHA1
e1e75ec9d8015d4722773962ec436a4b7472586f

SHA256
2f0ff055e969285729be34e667ebf09907f3cbee428c3088112bbff3d2e4738c

SHA512
fef8b4feaf99623bcc9752581d35e8ed0547b65999ffe1898d409028fce16495e79a53aff776bfead0a3a2b8abafa162e4c9e26776ad3984a011d571cd5d8064

Download Submit
C:\Windows\System\DbPszKg.exe

Filesize
8B

MD5
8df5d7cea6f17e33b828ee09a4f8c91e

SHA1
6aaff1a3a288a0aba2a3023d517e314fe986f730

SHA256
cebffee933f857324d8ea2bd5fb8dad33034c7e30f8e9b644e83274baeadc1d6

SHA512
aee4f16c452925a2700f8c6c545adb516dd855069c67839327087aebe75765ec2637a168ea26305bfaf7ca090b0abc3820134331985dd395f3751e82867cb7ea

Download Submit
C:\Windows\System\DgytyiA.exe

Filesize
1.5MB

MD5
18d3a97054fbfef382f5f34e7175a26e

SHA1
f570f8c8341efe0e58c7764e00cb5fb53c9d6333

SHA256
8a895f824fc9a0aacae5ac9b4866acdd8d273591228ebf4ad40541ab5da7c57f

SHA512
b02749807d79d5e4e4f19b65b2dfbf6c79339a524260079a3c64e197c67219fddcfb267d9a041768b3231909c5c48bd53280c2cf599dde9eace0d20820c0c10a

Download Submit
C:\Windows\System\ITedPZl.exe

Filesize
1.5MB

MD5
0001f141d6a89748c29ba6e136f124d8

SHA1
6403f0b9691c08d39c48ae3cf6cca8242011d7a6

SHA256
aa33767fe803d9e068c78700eb7b35c300252a22aa36c6cb8c5e1af3ceb66a0a

SHA512
5232f820a3dcf174a40d8fd2bf180fe146525bc026b205cb703df404ea70a01911334b4348f8d9deb118b7e6f6aee1337704e206591529ce31eba66a1c0cd23d

Download Submit
C:\Windows\System\KSjTeeE.exe

Filesize
1.5MB

MD5
332bf23c014b16910187c6d9b55aa37c

SHA1
52e438f935b8b01866ac76864b355df659e88961

SHA256
19c096b75e4e81d43ea558bd122534eed00d5e42881063e72fc543b64ca9121a

SHA512
99cdc573ceb56301e101adcc89ea103aa3ddc98855cee07b56c8237479ca8c4b1abcb542023c1946259545cd9f1fea9eb8beeaad9c34bbddda58200e3c15744e

Download Submit
C:\Windows\System\NMqbphi.exe

Filesize
1.5MB

MD5
10e64145f5c3547af0627181212f6ac0

SHA1
89fb64c0f4af68e1779f5ac0fc75a90fb981330c

SHA256
867cb9646417c108557045cb8547f57a89507b5d63334577963ee0f9349f5115

SHA512
bae2ea7d22909b1ce06d933ab565f39a8531ff61ad841e08f49eae8432c695c4befb60e44dfe0a88be2cc64b0d8d122123752b02fc658d47731b602c3be24d2d

Download Submit
C:\Windows\System\NnzMaJm.exe

Filesize
1.5MB

MD5
4f64950867cc6e34506099745c81868a

SHA1
e4a362e0352815011fa5f347d2b4344b4c2eebea

SHA256
1b2b604df8ebbaebcfffa78edca466330e3d36bf915d0848a44c63a00fb6ea3c

SHA512
004a9fc93123853103156d988d96b2f5945fd21cfabb98f8879d9843f115459b24d432e65fba45795ec1e302564f4488fb860a56b1a4c06e858067d33b9cbd9c

Download Submit
C:\Windows\System\OKhWfpu.exe

Filesize
1.5MB

MD5
7de211ad0dc0dfea03fc5f6d100d88c9

SHA1
6e386bfc4a21e932c8378704db86a6f86e65c8d8

SHA256
13b02c22bab9446d60f4e1c2893cd336223696e559dc993c6972fb04382ff35d

SHA512
4fd09e777f5683bf0239ea85e5c3508eb199d426053db8c2e1b4f4d5862924d47b8fe49159f684a5be6d29141faf750fd30902bb7976019bdaca8b6c77b64770

Download Submit
C:\Windows\System\QIUHQep.exe

Filesize
1.5MB

MD5
80f377ca851a2fb8924fe0a540dcb7e7

SHA1
c2fc8191d34afbb34657a20d9fc0e1392160f7eb

SHA256
bcaedb7291bcb6de6fb468ff0c6bc2f7a4b920f421c2d2c2fafb925be03c06f7

SHA512
a384e04ccef9c44826ca279a9792da38fe54174e0381294a3bd8b9b0c22fdf6f6a1cb8aa2d3d514c9fc9ebb1400b51449c85bf9e3097d440241c5edd792863ea

Download Submit
C:\Windows\System\XPVJDjq.exe

Filesize
1.5MB

MD5
a0df500100157bb289af09cebaaa5ca5

SHA1
3931d07786088c70fa6644fbc515d25e922713cf

SHA256
c731ecba998d830ee2dceb547e636cb2a6902c94a4c897ccdd6ce23c0edb5cf1

SHA512
d8a342815d9aa7dc083b99c02edd1befbea49b242e05706de18441b0ea06110a300873984cebad6aabf06a7818f5076b7663125971c811c18358f2dc4923565b

Download Submit
C:\Windows\System\Xqxqasg.exe

Filesize
1.5MB

MD5
37531c3d05028c7dd358680f05d8eeda

SHA1
0041171f44f43538d4ae76ef1d67c69126dc8bea

SHA256
0947eded4675a86779d6a2a1ef755d05b5172406b9df2cc14d52635a0471d140

SHA512
af04e78d7d646fcdf6e019e6b6a401dd015c944ffa0297effe389fcaf8e142879d7fe77ebea52b8d4d129554288f8cb890455d6681405f0c3856ea09e9ef2694

Download Submit
C:\Windows\System\YHsIWOX.exe

Filesize
1.5MB

MD5
da58c3d84cfd26003858d40f37955630

SHA1
f4981e696857340e71c3c8a4761ae7dfc1a2254c

SHA256
1c5d2b17c753524a14fde06a483670248d364312dd5c4927bde2105b16bcdbaf

SHA512
ded455aa8b8e61cd01ce40d4e5d4ce1fa5d116c14dc5c1fc82ecfc2d0a509b1964e6c6c4c6d2eea90e5768fb9a620985c79b960a9efe4802bd7e01061a7adc6f

Download Submit
C:\Windows\System\YKLIdul.exe

Filesize
1.5MB

MD5
2d98cfb3f74f66d8bc8d0a1234de5ce7

SHA1
e992dfcf244e41abfc63e71f5a60763f044e304d

SHA256
ae486ae5bc6826242d0e5c1e08de2b288370d6459ab0513ccc0087a69a4f71e6

SHA512
6ad5072c1d2f28c89dd2cfa6b9df1c6883c324782f46d1202b6c72c6d3b018c63c75a5a591afc8232905dc21f386c80c4831b3ea14954c4b890a92f9cf4fab9e

Download Submit
C:\Windows\System\ZOJWzBW.exe

Filesize
1.5MB

MD5
3c1739f627af3e645dfe4c5a69e4dfb0

SHA1
7452012243a8ca54a1245dbb0b6ca54c19783d0f

SHA256
ec3809e73d036d00bdee69b0bc8f90ceb0646e0dc5edda8d4f5ba040dda819f6

SHA512
ccf6135bd55d60d86bf9f3dd4c2562cfbbb2d88c29adb9f7bf9a22e592df82fd7eafb1bfb40c163850124644c5100c0fe569775f6cfe72f4e629e74a2962fdfb

Download Submit
C:\Windows\System\bcmzwNl.exe

Filesize
1.5MB

MD5
1c5ad30e63bf72af690212a287818ba9

SHA1
d8819168f8954e93ef51e4a14d6790c3474863f0

SHA256
70cc5487fed84bf8847ad82b6c6692887760d9503ac2243fe286a99b0371caae

SHA512
674f0cd0b6fa7b594e8738ab9a06f8d2dfae8e6bf5a1bb48db3dff94fe34168a69f8e65fc9b5ad63315153b7407503d00f36a0749573bd35202944d81ee11c93

Download Submit
C:\Windows\System\cLJDPQK.exe

Filesize
1.5MB

MD5
5d3a6c109d772e4460603044c2e3a465

SHA1
ffb23ff8b14ffc45d92ca6879bb9e4970ec65107

SHA256
e3d1977de90a3f78c0ff6da1b00ac08f74fd39cec38eacacb4e58895ae14fe68

SHA512
4c9ff7adf814f1778e4c9e01e87429c9aca1a98900b80132c8aff9d15c13d1d788972166725d8d2f7fe26e1842ee731eff86590351bc4acbbef8cc2a172c73b7

Download Submit
C:\Windows\System\hDuOdpm.exe

Filesize
1.5MB

MD5
a7d03646ebeca7b38547bf75cf830d54

SHA1
572fd8e2ae965973b0fcc29afcd9c9095c462745

SHA256
cbe00e7b21d6afc1274291d0c44c55f5f6b349efdf1a0a1dc756befc749785be

SHA512
a4b438feea7e5106876846693687c93b1759e1a94297c8de919bd5b4c92544280cbbfba23c8b51c071a7d2863a6318843287633191e681a181b62bd5fb8d539a

Download Submit
C:\Windows\System\hhnVHdK.exe

Filesize
1.5MB

MD5
a86faec245e6678ade09f7d8f3ea7845

SHA1
a6a714238adc8ffdf4a4e96c49a0cb820ccaef74

SHA256
3138dc70b71a1146be93ea42bca089ccca9495deb2ad88e612ff53003a51b534

SHA512
bfb97a46b56cb42891a3205115ac9fac4d8c82799ee3fe8c70fd85f379757b9e35320d20f3e600074cfad696ec0c9b5ee171d0a079142b08a87758233546f84e

Download Submit
C:\Windows\System\hqoYPmR.exe

Filesize
1.5MB

MD5
014e3d5c92197189c1d0b9cbdae0e29d

SHA1
241dfa9d1d30bcfe14feff0e65de5dfaa39d8563

SHA256
aa4a9f98017fb2ffa61386b6226016f42dec24fe90b0476495afa1374732cf9f

SHA512
4f6635f33e710d9f3f276ac4c0aaf5090c5ef83536fd2fe4691af29bb36269cd5fe1f89552ec0f9fe526eb72c7a6f491ea218893de5295504c463674b896b4a2

Download Submit
C:\Windows\System\iApObtF.exe

Filesize
1.5MB

MD5
497bcb8effd6ab266f88bcd4ab8d0389

SHA1
faf5687a52305bd596e536bf59d360db398aea65

SHA256
a0671d658fac0f74ed731a3a25097fcbb4b6d2fd60836eb39cc85bbdfeeb7d61

SHA512
2940fa8c2f58b7b38564153c668d29c756532a9707b4b6642d46daff6772bc3397f730ef353ec7e11f46bb01cae1159683bf877f7d2621d011c4d3d52bab5169

Download Submit
C:\Windows\System\kAyEQkr.exe

Filesize
1.5MB

MD5
70be90f340830b540e26fcb07f425bc9

SHA1
841fef437098478c8482fc1eba80a00b87a34d6d

SHA256
fd17024f9d372cbab2f4a95c781ec424bb595d85751c859ceb6f1cb1e823af67

SHA512
f7c09f72be67ce78f6065ef5b478bba1c5bccbfecee98d32234493f96833d75e3b6ab2c4b3a82fc811f546b4e73ae0b365266c1e14c670491f5c7b5b8371bbdd

Download Submit
C:\Windows\System\lFCGKqw.exe

Filesize
1.5MB

MD5
52588570d10cf11af3eedd08c81fc7a8

SHA1
f64f5cabcd32a0593156d713248762e4872a95a1

SHA256
807e55c40f3eb4dfc430d4f160231850197b314ea7590d28d0c9979fdcd0763d

SHA512
56ae60f18fcf571ee4a58035d04f93661696c44f2448c966d0560c1c0e647795f4f3735483dea1f5eeba4d2cce445f2fa597053abc77a595cffee7bdc0d59683

Download Submit
C:\Windows\System\leXHdiX.exe

Filesize
1.5MB

MD5
4c9fea3f4c961e5d74ca6f8ba46080d7

SHA1
c11a82989011b4ee67412b628383ad476ee7b80d

SHA256
3eeccdb7fc50b7fc0c8c738410fef9e2ad82fd7c9bdbf2c830639253e9bd2c81

SHA512
d19aa57d7666f964670c60e3db14ec6e45584f831773ee840e52b48a5f38e41841062b23256e5c831d771bb7edffa1dba46d9f708e0cc34f140d0a3e309d4a71

Download Submit
C:\Windows\System\nvfxsnD.exe

Filesize
1.5MB

MD5
0b65cb1c09a6ee6c027803c698e4dc3f

SHA1
d8f1789d4b2cfdea442ec35594c62da5a6562fd2

SHA256
27a345c682d1f557f69370708bc22b379a743f5d457b1dd9c14b8194f7caf3c7

SHA512
46ca4110fd9d10a803e5bc52cd688bf44a6501aa39891b352417c737200f86507e691410ac5e90a2d9f7f0c8653ef72bfa58ec2ad93847422b617e9961f750c3

Download Submit
C:\Windows\System\nzTnRXn.exe

Filesize
1.5MB

MD5
1cbd4981f3bc278b9ab48bf9eb7c36cb

SHA1
212942b1cd0bafdf5c46ee8c168a6ce41ada78cd

SHA256
07074e4998fa17a93572bd507af70903be1585ea9b10351de6f2819a0200d4b0

SHA512
5ca2a528254d4e89dfa88514ae1e652d55c52ec822c4662eeed3202e46ad4390ab4bd4f2717e6e2ddda54484ab8911ff87719e148dbfa16bc8cd4a9bd1abac30

Download Submit
C:\Windows\System\omewwBn.exe

Filesize
1.5MB

MD5
ddacf8e529639e42048bb2f3791ae7a0

SHA1
6ed06b2b64204daa8fc57bfb5adcfb1ff2e56fac

SHA256
5eb3effad593dcffed14f4be2144dad64bcf1359a2124018c4a45950f615987f

SHA512
3058f6ebdcf84bbb99bdd3b6b6c45632762d3b98a818319ee2238e8e57c7f2b4ff323e031ab12976c46357e346bb64ee7d580f68e7ae2ac211968401a8f54bf6

Download Submit
C:\Windows\System\qMBOmtR.exe

Filesize
1.5MB

MD5
38b0f5b8d3ef6358077e1fc222e1a233

SHA1
b198993fd8308b9d847c5f04dbda8b784f5b8ed3

SHA256
db4c26556d01cba192b22d4f964d2389f83c60d828a8c2fd24d8244824ffe07b

SHA512
28352736579452e34851781fcba4fce38ee5b60eca95bc5978acaa2258c1e7998beea793a11d82f7098928973a6d614ce424df71e643d6c0c0efa336b89889f0

Download Submit
C:\Windows\System\qnNiaZv.exe

Filesize
1.5MB

MD5
2729e299855df037507df050310bc794

SHA1
03b78759bbbf0c8eb8c630b5b6725caf35b313a1

SHA256
a8ac1ea9c7b9e73937569bf5d1a2f8b6d6995a77e43901183a8ef37ff3b3c698

SHA512
52275fb17f3b8ecf8f9b4ce52b7c529b216efd4fbd7145ade8b569b4bc82d83bc4a6b1430ac75ed13ccfd286c43828e34af93269a39e90818b665f236cb7978b

Download Submit
C:\Windows\System\qzSiWnm.exe

Filesize
1.5MB

MD5
9b9080e31d50162b3612a455544382d8

SHA1
17d43fb0eaf6c6f12d70bc36cc4f9083a53a58bf

SHA256
9ee4edf47cb7b215cd367af1eb787ae3a801070f8faa9bdec354c79006c17f71

SHA512
ceece59af05d7d872ca45afc0fbc6a719be48329e43d436df501ca30eb2b6150f4b3f4d5b9549fc195109749d46952789ce45412c69b45dcae8c63dae1b28ca2

Download Submit
C:\Windows\System\rbJNXhh.exe

Filesize
18B

MD5
ad11c4b88aaf117dd712bd0c40c22d45

SHA1
be7926c5e2771f36649608fadc8c052673230082

SHA256
45618ab6ed80b2b4f11d352872557dfa8aeb568d8f6f3074af2643d962cbef1f

SHA512
a338fa0c8e0f124fa360e511cada71ab648faa739f7e0d1bfa7f26251ad9ae3945cc56810f673601d3a38a49e72f8f9ad8671f6810e1c66d5dd0fcea5f0776e1

Download Submit
C:\Windows\System\sRkijtK.exe

Filesize
1.5MB

MD5
d0c7a9685e17cca3e716328b4f2e26ed

SHA1
36030abbbf1acc1db419386b48fbad75553cc4da

SHA256
e2120286d4735eaf26b3a0e99c3ce005de22396848517d84be2b5de11f167bdd

SHA512
499964dc067ae3cd946e422e61e82b729f2a3ae75d556be9a24088bf23a71dd7dfec848233e160eda2e9fd28599b3c1efc11658e7eaa13f945baaea9d9bcab7c

Download Submit
C:\Windows\System\sSOWfBS.exe

Filesize
1.5MB

MD5
0b89573682ce02c183f8dd0f85c809e5

SHA1
1e4f065623b0fb3a201196381c4f4dec8adf1fbf

SHA256
cd17f05c6905796c724b580f7234aa5ac64ef5f71f48809deba1b3446e97ebfc

SHA512
0d20b07166fbee19ad44cebc594471db056a06505b4afce4ea15ab36e459378f007fcfce44823128eaf727826af7192d356628eee4f89250c0ddd136d25d7a6d

Download Submit
C:\Windows\System\syiroWD.exe

Filesize
1.5MB

MD5
1b435d1219c4f7f1a24d95a1efbb2fd0

SHA1
43bcfd38eeaa2c9b57dc0427d339fffda85a9604

SHA256
7a09fb9e49b135f7741c4c0eed6ef139880f6485315b3c114d12cf7e4b9dad91

SHA512
ccf3d86048c3fb195d975c1c20f999210e140b923ee1897015e8ff6b83ae4a3a237b5ffe3f61d558347e41a7cd7089dacba4e2bae4143853189fea842d31b552

Download Submit
C:\Windows\System\zNFbwuS.exe

Filesize
1.5MB

MD5
d486953920071c8ed718915cad83d643

SHA1
2b43a97cc821c6b31b8c9d45268fd5608cfa220d

SHA256
c72192ab0ad4f374c9682b59779a59b9adad41f995f8fc3d2ecccd4f5194ee61

SHA512
c6994cf63093a0d2ab7c453a492e6e205f4c6acc5669302ab7cd87251e12936fb46e7e65e85e9bcc7538de66479e0ec3cf37b537cc2842145a399e84380c34ac

Download Submit
memory/216-1-0x0000026304CA0000-0x0000026304CB0000-memory.dmp

Filesize
64KB

Download
memory/216-0-0x00007FF621D20000-0x00007FF622112000-memory.dmp

Filesize
3.9MB

Download
memory/1284-3818-0x00007FF781C80000-0x00007FF782072000-memory.dmp

Filesize
3.9MB

Download
memory/1284-108-0x00007FF781C80000-0x00007FF782072000-memory.dmp

Filesize
3.9MB

Download
memory/1312-107-0x00007FF6E7A40000-0x00007FF6E7E32000-memory.dmp

Filesize
3.9MB

Download
memory/1372-160-0x00007FF713F80000-0x00007FF714372000-memory.dmp

Filesize
3.9MB

Download
memory/1372-3906-0x00007FF713F80000-0x00007FF714372000-memory.dmp

Filesize
3.9MB

Download
memory/1520-3823-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-102-0x00007FF6C58C0000-0x00007FF6C5CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-13-0x00007FF735100000-0x00007FF7354F2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-105-0x00007FF787F90000-0x00007FF788382000-memory.dmp

Filesize
3.9MB

Download
memory/1992-4891-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp

Filesize
3.9MB

Download
memory/1992-194-0x00007FF7F9870000-0x00007FF7F9C62000-memory.dmp

Filesize
3.9MB

Download
memory/2004-104-0x00007FF619A40000-0x00007FF619E32000-memory.dmp

Filesize
3.9MB

Download
memory/2168-66-0x00007FF7E9FD0000-0x00007FF7EA3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-81-0x00007FF765470000-0x00007FF765862000-memory.dmp

Filesize
3.9MB

Download
memory/2444-3777-0x00007FF765470000-0x00007FF765862000-memory.dmp

Filesize
3.9MB

Download
memory/2944-40-0x00007FF6E4E50000-0x00007FF6E5242000-memory.dmp

Filesize
3.9MB

Download
memory/3196-168-0x00007FF7EE550000-0x00007FF7EE942000-memory.dmp

Filesize
3.9MB

Download
memory/3196-3907-0x00007FF7EE550000-0x00007FF7EE942000-memory.dmp

Filesize
3.9MB

Download
memory/3316-98-0x00007FF66B6E0000-0x00007FF66BAD2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-95-0x00007FF6EDFF0000-0x00007FF6EE3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-106-0x00007FF677920000-0x00007FF677D12000-memory.dmp

Filesize
3.9MB

Download
memory/3552-2753-0x00007FF662350000-0x00007FF662742000-memory.dmp

Filesize
3.9MB

Download
memory/3552-57-0x00007FF662350000-0x00007FF662742000-memory.dmp

Filesize
3.9MB

Download
memory/3552-3783-0x00007FF662350000-0x00007FF662742000-memory.dmp

Filesize
3.9MB

Download
memory/3660-148-0x00007FF7AC3A0000-0x00007FF7AC792000-memory.dmp

Filesize
3.9MB

Download
memory/3660-4850-0x00007FF7AC3A0000-0x00007FF7AC792000-memory.dmp

Filesize
3.9MB

Download
memory/3844-109-0x00007FF6F9860000-0x00007FF6F9C52000-memory.dmp

Filesize
3.9MB

Download
memory/3844-3832-0x00007FF6F9860000-0x00007FF6F9C52000-memory.dmp

Filesize
3.9MB

Download
memory/3984-80-0x00007FF6D8840000-0x00007FF6D8C32000-memory.dmp

Filesize
3.9MB

Download
memory/4136-154-0x00007FF6C80A0000-0x00007FF6C8492000-memory.dmp

Filesize
3.9MB

Download
memory/4400-149-0x00007FF635840000-0x00007FF635C32000-memory.dmp

Filesize
3.9MB

Download
memory/4844-99-0x00007FF6FCAF0000-0x00007FF6FCEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-110-0x000001B8F97D0000-0x000001B8F9F76000-memory.dmp

Filesize
7.6MB

Download
memory/4860-103-0x000001B8F8C30000-0x000001B8F8C52000-memory.dmp

Filesize
136KB

Download
memory/4860-31-0x00007FFB3E600000-0x00007FFB3E8C9000-memory.dmp

Filesize
2.8MB

Download
memory/4992-188-0x00007FF788DC0000-0x00007FF7891B2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-4878-0x00007FF788DC0000-0x00007FF7891B2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-139-0x00007FF7AE340000-0x00007FF7AE732000-memory.dmp

Filesize
3.9MB

Download
memory/5100-3151-0x00007FF7AE340000-0x00007FF7AE732000-memory.dmp

Filesize
3.9MB

Download