xmrig | 584e6fbb29919bb988ca023593b015bc601008909757e04202cb96afa7f1dd8e

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
Size

1.8MB
MD5

352c9d913bd4d461417d39ec7b93e170
SHA1

45fc93af6299e9b5398c4b51cac812164e58ad43
SHA256

584e6fbb29919bb988ca023593b015bc601008909757e04202cb96afa7f1dd8e
SHA512

25f021c3f2cbe71a193040861212755e1816eacc0c5ffb0e10da53bb549132d961c1193b92312f24710e6d911ac836ca3695a43e0aa3e588b4bfe18bc114ecb7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMCry:Lz071uv4BPMkyW10/w16BvZuaXjAP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2952-12-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/1204-124-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2932-126-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2400-125-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2568-113-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2992-112-0x0000000002EB0000-0x00000000032A2000-memory.dmp	xmrig
behavioral1/memory/2344-111-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2632-98-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2816-62-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2344-5509-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2400-5518-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2816-5523-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2932-5532-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2568-5534-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/1204-5550-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2952-5571-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2632-5566-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2992-13349-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2940	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2952	MSCAjpY.exe
2816	DwJhOed.exe
2632	mHETgYZ.exe
2344	HefNDPN.exe
2568	QNtspMQ.exe
1204	sMjXhli.exe
2400	PcRpSeN.exe
2932	RbiLyBx.exe
2552	RrBSCYD.exe
1980	xFAuVra.exe
2500	LaAAyfd.exe
2892	wmIpbtf.exe
2688	JZBKbuq.exe
2728	nTnBcQB.exe
2180	zyxgyfa.exe
1632	teKyIpZ.exe
1776	avAwlcN.exe
2704	yCkDiCx.exe
2768	GUiMcSr.exe
1344	FnYQbZC.exe
2904	vIaKyai.exe
2208	WWZSzDE.exe
600	NwQYmfA.exe
912	AojQPlh.exe
1432	RvNMiVi.exe
1844	kglnITv.exe
1208	yRyHxMp.exe
2808	uTSAoYG.exe
1308	GDmSwMm.exe
980	jvjVgIL.exe
1716	TBVjjdC.exe
1708	AqtTbeU.exe
3048	BhPwTPI.exe
2152	scXoDIy.exe
1636	uMGuTTW.exe
1572	xwXbppI.exe
1004	dHEdsOw.exe
2040	BnCZFOq.exe
2348	pMnUcnP.exe
820	SxwyORx.exe
1852	mkEOZLc.exe
784	rWHlHbx.exe
576	gfMjuJI.exe
1864	dTxOptm.exe
2116	YPWwSDS.exe
1132	dorVCyg.exe
1152	nJgZSKS.exe
1816	hJhwuyo.exe
1904	iAythQV.exe
1724	yEBeaMc.exe
932	HoGqKFS.exe
568	GATgmuo.exe
2464	gUPxXwb.exe
864	zYwWGqh.exe
640	SGDwLtC.exe
2308	xKaFNwe.exe
2456	dwSOsLW.exe
1568	fQcydoy.exe
2004	vcqhlii.exe
2200	XdWqxNs.exe
2716	FNNXOWk.exe
1812	ZnwGnsd.exe
1284	sRvblUe.exe
1248	fiJifpK.exe

Loads dropped DLL 64 IoCs

pid	Process
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2992-0-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x000d000000012674-6.dat	upx
behavioral1/memory/2952-12-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0030000000014207-15.dat	upx
behavioral1/files/0x000e0000000054ab-17.dat	upx
behavioral1/files/0x00080000000143e5-26.dat	upx
behavioral1/files/0x000700000001443b-31.dat	upx
behavioral1/files/0x00070000000144e8-32.dat	upx
behavioral1/files/0x0006000000015653-53.dat	upx
behavioral1/files/0x000600000001564f-66.dat	upx
behavioral1/files/0x0006000000015cd9-103.dat	upx
behavioral1/files/0x0006000000015cae-75.dat	upx
behavioral1/files/0x0006000000015c87-115.dat	upx
behavioral1/memory/1204-124-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2932-126-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0006000000015cff-139.dat	upx
behavioral1/files/0x0006000000015fe5-187.dat	upx
behavioral1/files/0x0006000000015ecc-182.dat	upx
behavioral1/files/0x0006000000015d93-175.dat	upx
behavioral1/files/0x0006000000015f65-184.dat	upx
behavioral1/files/0x0006000000015e32-177.dat	upx
behavioral1/files/0x0006000000015d87-170.dat	upx
behavioral1/files/0x0006000000015d6b-163.dat	upx
behavioral1/files/0x0006000000015ce3-134.dat	upx
behavioral1/files/0x0006000000015d56-156.dat	upx
behavioral1/files/0x0006000000015d42-149.dat	upx
behavioral1/files/0x0006000000015ccd-133.dat	upx
behavioral1/files/0x0030000000014228-142.dat	upx
behavioral1/files/0x0006000000015d7f-168.dat	upx
behavioral1/files/0x0006000000015d5f-161.dat	upx
behavioral1/files/0x0006000000015d4e-154.dat	upx
behavioral1/files/0x0006000000015d20-147.dat	upx
behavioral1/memory/2400-125-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2568-113-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2344-111-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0006000000015677-105.dat	upx
behavioral1/files/0x0006000000015cb6-102.dat	upx
behavioral1/files/0x0006000000015c9e-101.dat	upx
behavioral1/files/0x0006000000015684-100.dat	upx
behavioral1/memory/2632-98-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x000600000001535e-93.dat	upx
behavioral1/files/0x000600000001565d-92.dat	upx
behavioral1/files/0x0009000000014597-81.dat	upx
behavioral1/files/0x000800000001469d-65.dat	upx
behavioral1/memory/2816-62-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2344-5509-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2400-5518-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2816-5523-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2932-5532-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2568-5534-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/1204-5550-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2952-5571-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2632-5566-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2992-13349-0x000000013FF40000-0x0000000140332000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TJChhyw.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\MbVhfvB.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\ZtuHrtg.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\XnejNAv.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\DUgpVzl.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\FsbwaIQ.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\SkbYSKJ.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\OUXuEUg.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\AHaCIJF.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\OnkQJxE.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\hzRsSZH.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\RCxCzod.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\nbqokjl.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\HKlDrrm.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\JIMOUhb.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\npMnjJH.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\rvkrLPL.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\HKyBkdt.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\amNMfnw.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\tmqZwKi.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\hvIiZvD.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\DtrnNjG.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\GuAteoq.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\bfSqIXC.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\vsRGQKc.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\AsCGyOo.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\OppNlfD.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\bnfINvy.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\djLXwzq.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\RcxSRxc.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\ibjGsbi.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\NQwbXIT.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\EqQZlMu.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\NdeNTmP.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\picAZKc.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\FBHwYQX.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\iuQDqDk.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\LBaNVNg.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\yYcWUmX.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\cwGjfHm.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\mjzuTXb.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\InDflZU.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\mngETzY.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\HmAfeEt.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\DtEmsPD.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\ucSYNFf.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\IlIqMgl.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\umhqSle.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\hNvogBz.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\BWTjPXc.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\OFCTaRF.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\DlFhUSt.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\ntfgCBJ.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\hsHkhBs.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\HrXnsRP.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\KOOfkfE.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\UpDNoDf.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\fgciJwI.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\GUJFMqC.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\CGRzEor.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\scXoDIy.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\XKwKYsJ.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\tcHkeFb.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
File created	C:\Windows\System\FcFPInG.exe	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
Token: SeLockMemoryPrivilege	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
Token: SeDebugPrivilege	2940	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2940	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	29
PID 2992 wrote to memory of 2940	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	29
PID 2992 wrote to memory of 2940	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	29
PID 2992 wrote to memory of 2952	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	30
PID 2992 wrote to memory of 2952	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	30
PID 2992 wrote to memory of 2952	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	30
PID 2992 wrote to memory of 2816	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	31
PID 2992 wrote to memory of 2816	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	31
PID 2992 wrote to memory of 2816	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	31
PID 2992 wrote to memory of 2632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	32
PID 2992 wrote to memory of 2632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	32
PID 2992 wrote to memory of 2632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	32
PID 2992 wrote to memory of 2344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	33
PID 2992 wrote to memory of 2344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	33
PID 2992 wrote to memory of 2344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	33
PID 2992 wrote to memory of 2568	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	34
PID 2992 wrote to memory of 2568	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	34
PID 2992 wrote to memory of 2568	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	34
PID 2992 wrote to memory of 1204	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	35
PID 2992 wrote to memory of 1204	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	35
PID 2992 wrote to memory of 1204	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	35
PID 2992 wrote to memory of 2552	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	36
PID 2992 wrote to memory of 2552	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	36
PID 2992 wrote to memory of 2552	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	36
PID 2992 wrote to memory of 2400	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	37
PID 2992 wrote to memory of 2400	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	37
PID 2992 wrote to memory of 2400	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	37
PID 2992 wrote to memory of 2500	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	38
PID 2992 wrote to memory of 2500	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	38
PID 2992 wrote to memory of 2500	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	38
PID 2992 wrote to memory of 2932	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	39
PID 2992 wrote to memory of 2932	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	39
PID 2992 wrote to memory of 2932	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	39
PID 2992 wrote to memory of 2892	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	40
PID 2992 wrote to memory of 2892	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	40
PID 2992 wrote to memory of 2892	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	40
PID 2992 wrote to memory of 1980	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	41
PID 2992 wrote to memory of 1980	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	41
PID 2992 wrote to memory of 1980	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	41
PID 2992 wrote to memory of 1776	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	42
PID 2992 wrote to memory of 1776	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	42
PID 2992 wrote to memory of 1776	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	42
PID 2992 wrote to memory of 2688	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	43
PID 2992 wrote to memory of 2688	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	43
PID 2992 wrote to memory of 2688	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	43
PID 2992 wrote to memory of 2704	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	44
PID 2992 wrote to memory of 2704	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	44
PID 2992 wrote to memory of 2704	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	44
PID 2992 wrote to memory of 2728	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	45
PID 2992 wrote to memory of 2728	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	45
PID 2992 wrote to memory of 2728	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	45
PID 2992 wrote to memory of 2768	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	46
PID 2992 wrote to memory of 2768	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	46
PID 2992 wrote to memory of 2768	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	46
PID 2992 wrote to memory of 2180	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	47
PID 2992 wrote to memory of 2180	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	47
PID 2992 wrote to memory of 2180	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	47
PID 2992 wrote to memory of 1344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	48
PID 2992 wrote to memory of 1344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	48
PID 2992 wrote to memory of 1344	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	48
PID 2992 wrote to memory of 1632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	49
PID 2992 wrote to memory of 1632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	49
PID 2992 wrote to memory of 1632	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	49
PID 2992 wrote to memory of 2904	2992	virussign.com_352c9d913bd4d461417d39ec7b93e170.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_352c9d913bd4d461417d39ec7b93e170.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_352c9d913bd4d461417d39ec7b93e170.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System\MSCAjpY.exe
  C:\Windows\System\MSCAjpY.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\DwJhOed.exe
  C:\Windows\System\DwJhOed.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\mHETgYZ.exe
  C:\Windows\System\mHETgYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\HefNDPN.exe
  C:\Windows\System\HefNDPN.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\QNtspMQ.exe
  C:\Windows\System\QNtspMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\sMjXhli.exe
  C:\Windows\System\sMjXhli.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\RrBSCYD.exe
  C:\Windows\System\RrBSCYD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\PcRpSeN.exe
  C:\Windows\System\PcRpSeN.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\LaAAyfd.exe
  C:\Windows\System\LaAAyfd.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\RbiLyBx.exe
  C:\Windows\System\RbiLyBx.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\wmIpbtf.exe
  C:\Windows\System\wmIpbtf.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\xFAuVra.exe
  C:\Windows\System\xFAuVra.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\avAwlcN.exe
  C:\Windows\System\avAwlcN.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\JZBKbuq.exe
  C:\Windows\System\JZBKbuq.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\yCkDiCx.exe
  C:\Windows\System\yCkDiCx.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\nTnBcQB.exe
  C:\Windows\System\nTnBcQB.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\GUiMcSr.exe
  C:\Windows\System\GUiMcSr.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\zyxgyfa.exe
  C:\Windows\System\zyxgyfa.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\FnYQbZC.exe
  C:\Windows\System\FnYQbZC.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\teKyIpZ.exe
  C:\Windows\System\teKyIpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\vIaKyai.exe
  C:\Windows\System\vIaKyai.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WWZSzDE.exe
  C:\Windows\System\WWZSzDE.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\mkEOZLc.exe
  C:\Windows\System\mkEOZLc.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\NwQYmfA.exe
  C:\Windows\System\NwQYmfA.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\rWHlHbx.exe
  C:\Windows\System\rWHlHbx.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\AojQPlh.exe
  C:\Windows\System\AojQPlh.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\gfMjuJI.exe
  C:\Windows\System\gfMjuJI.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\RvNMiVi.exe
  C:\Windows\System\RvNMiVi.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\dTxOptm.exe
  C:\Windows\System\dTxOptm.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\kglnITv.exe
  C:\Windows\System\kglnITv.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\YPWwSDS.exe
  C:\Windows\System\YPWwSDS.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\yRyHxMp.exe
  C:\Windows\System\yRyHxMp.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\dorVCyg.exe
  C:\Windows\System\dorVCyg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\uTSAoYG.exe
  C:\Windows\System\uTSAoYG.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\nJgZSKS.exe
  C:\Windows\System\nJgZSKS.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\GDmSwMm.exe
  C:\Windows\System\GDmSwMm.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\hJhwuyo.exe
  C:\Windows\System\hJhwuyo.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\jvjVgIL.exe
  C:\Windows\System\jvjVgIL.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\iAythQV.exe
  C:\Windows\System\iAythQV.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\TBVjjdC.exe
  C:\Windows\System\TBVjjdC.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\yEBeaMc.exe
  C:\Windows\System\yEBeaMc.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\AqtTbeU.exe
  C:\Windows\System\AqtTbeU.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\HoGqKFS.exe
  C:\Windows\System\HoGqKFS.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\BhPwTPI.exe
  C:\Windows\System\BhPwTPI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GATgmuo.exe
  C:\Windows\System\GATgmuo.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\scXoDIy.exe
  C:\Windows\System\scXoDIy.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\gUPxXwb.exe
  C:\Windows\System\gUPxXwb.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\uMGuTTW.exe
  C:\Windows\System\uMGuTTW.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\zYwWGqh.exe
  C:\Windows\System\zYwWGqh.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\xwXbppI.exe
  C:\Windows\System\xwXbppI.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\SGDwLtC.exe
  C:\Windows\System\SGDwLtC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\dHEdsOw.exe
  C:\Windows\System\dHEdsOw.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\xKaFNwe.exe
  C:\Windows\System\xKaFNwe.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\BnCZFOq.exe
  C:\Windows\System\BnCZFOq.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\fQcydoy.exe
  C:\Windows\System\fQcydoy.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\pMnUcnP.exe
  C:\Windows\System\pMnUcnP.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vcqhlii.exe
  C:\Windows\System\vcqhlii.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\SxwyORx.exe
  C:\Windows\System\SxwyORx.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ZnwGnsd.exe
  C:\Windows\System\ZnwGnsd.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\dwSOsLW.exe
  C:\Windows\System\dwSOsLW.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\XTwCzEK.exe
  C:\Windows\System\XTwCzEK.exe
  2⤵
  PID:2472
- C:\Windows\System\XdWqxNs.exe
  C:\Windows\System\XdWqxNs.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KISKNqb.exe
  C:\Windows\System\KISKNqb.exe
  2⤵
  PID:340
- C:\Windows\System\FNNXOWk.exe
  C:\Windows\System\FNNXOWk.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\frLAwyI.exe
  C:\Windows\System\frLAwyI.exe
  2⤵
  PID:2772
- C:\Windows\System\sRvblUe.exe
  C:\Windows\System\sRvblUe.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\WIkIzaH.exe
  C:\Windows\System\WIkIzaH.exe
  2⤵
  PID:2512
- C:\Windows\System\fiJifpK.exe
  C:\Windows\System\fiJifpK.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\MvsPghI.exe
  C:\Windows\System\MvsPghI.exe
  2⤵
  PID:1680
- C:\Windows\System\YsKaOrn.exe
  C:\Windows\System\YsKaOrn.exe
  2⤵
  PID:448
- C:\Windows\System\QBRSVfv.exe
  C:\Windows\System\QBRSVfv.exe
  2⤵
  PID:1536
- C:\Windows\System\QnkyVBa.exe
  C:\Windows\System\QnkyVBa.exe
  2⤵
  PID:1712
- C:\Windows\System\kgWucmz.exe
  C:\Windows\System\kgWucmz.exe
  2⤵
  PID:1772
- C:\Windows\System\vOtFkGI.exe
  C:\Windows\System\vOtFkGI.exe
  2⤵
  PID:1640
- C:\Windows\System\WVzSbvI.exe
  C:\Windows\System\WVzSbvI.exe
  2⤵
  PID:2144
- C:\Windows\System\RKhzqym.exe
  C:\Windows\System\RKhzqym.exe
  2⤵
  PID:1188
- C:\Windows\System\TxRJXHL.exe
  C:\Windows\System\TxRJXHL.exe
  2⤵
  PID:1520
- C:\Windows\System\OdchrUo.exe
  C:\Windows\System\OdchrUo.exe
  2⤵
  PID:572
- C:\Windows\System\mzDuEBU.exe
  C:\Windows\System\mzDuEBU.exe
  2⤵
  PID:776
- C:\Windows\System\gXTMmUk.exe
  C:\Windows\System\gXTMmUk.exe
  2⤵
  PID:1736
- C:\Windows\System\srgQpbZ.exe
  C:\Windows\System\srgQpbZ.exe
  2⤵
  PID:3064
- C:\Windows\System\zgEkqQw.exe
  C:\Windows\System\zgEkqQw.exe
  2⤵
  PID:2700
- C:\Windows\System\HTrlAVo.exe
  C:\Windows\System\HTrlAVo.exe
  2⤵
  PID:2428
- C:\Windows\System\mvbIBpR.exe
  C:\Windows\System\mvbIBpR.exe
  2⤵
  PID:1908
- C:\Windows\System\OZypgxi.exe
  C:\Windows\System\OZypgxi.exe
  2⤵
  PID:1256
- C:\Windows\System\hIUkrKK.exe
  C:\Windows\System\hIUkrKK.exe
  2⤵
  PID:2692
- C:\Windows\System\eaFRIlS.exe
  C:\Windows\System\eaFRIlS.exe
  2⤵
  PID:1524
- C:\Windows\System\iQFKJhb.exe
  C:\Windows\System\iQFKJhb.exe
  2⤵
  PID:1896
- C:\Windows\System\UXLfpEt.exe
  C:\Windows\System\UXLfpEt.exe
  2⤵
  PID:412
- C:\Windows\System\OmLAKih.exe
  C:\Windows\System\OmLAKih.exe
  2⤵
  PID:1236
- C:\Windows\System\vMoqjLM.exe
  C:\Windows\System\vMoqjLM.exe
  2⤵
  PID:2432
- C:\Windows\System\VzzKoLz.exe
  C:\Windows\System\VzzKoLz.exe
  2⤵
  PID:1488
- C:\Windows\System\miSRfzV.exe
  C:\Windows\System\miSRfzV.exe
  2⤵
  PID:1444
- C:\Windows\System\KHFexfr.exe
  C:\Windows\System\KHFexfr.exe
  2⤵
  PID:1436
- C:\Windows\System\LmquTIz.exe
  C:\Windows\System\LmquTIz.exe
  2⤵
  PID:2776
- C:\Windows\System\SADadSb.exe
  C:\Windows\System\SADadSb.exe
  2⤵
  PID:2304
- C:\Windows\System\grbZBSt.exe
  C:\Windows\System\grbZBSt.exe
  2⤵
  PID:2644
- C:\Windows\System\EgYGaSQ.exe
  C:\Windows\System\EgYGaSQ.exe
  2⤵
  PID:2192
- C:\Windows\System\sWkbsph.exe
  C:\Windows\System\sWkbsph.exe
  2⤵
  PID:1456
- C:\Windows\System\mCnfISr.exe
  C:\Windows\System\mCnfISr.exe
  2⤵
  PID:712
- C:\Windows\System\YsyZgyj.exe
  C:\Windows\System\YsyZgyj.exe
  2⤵
  PID:1692
- C:\Windows\System\IepYuVM.exe
  C:\Windows\System\IepYuVM.exe
  2⤵
  PID:1768
- C:\Windows\System\cPfbLGj.exe
  C:\Windows\System\cPfbLGj.exe
  2⤵
  PID:2056
- C:\Windows\System\OkdoQFB.exe
  C:\Windows\System\OkdoQFB.exe
  2⤵
  PID:900
- C:\Windows\System\qOkNbdb.exe
  C:\Windows\System\qOkNbdb.exe
  2⤵
  PID:2640
- C:\Windows\System\JwKsGyp.exe
  C:\Windows\System\JwKsGyp.exe
  2⤵
  PID:2756
- C:\Windows\System\sluqaWK.exe
  C:\Windows\System\sluqaWK.exe
  2⤵
  PID:2508
- C:\Windows\System\THljvwa.exe
  C:\Windows\System\THljvwa.exe
  2⤵
  PID:2532
- C:\Windows\System\wKwGfeO.exe
  C:\Windows\System\wKwGfeO.exe
  2⤵
  PID:2328
- C:\Windows\System\jluFfdG.exe
  C:\Windows\System\jluFfdG.exe
  2⤵
  PID:2668
- C:\Windows\System\IZtrygy.exe
  C:\Windows\System\IZtrygy.exe
  2⤵
  PID:3004
- C:\Windows\System\eaATsJL.exe
  C:\Windows\System\eaATsJL.exe
  2⤵
  PID:2028
- C:\Windows\System\FepxNzr.exe
  C:\Windows\System\FepxNzr.exe
  2⤵
  PID:2196
- C:\Windows\System\iKWzbnD.exe
  C:\Windows\System\iKWzbnD.exe
  2⤵
  PID:2000
- C:\Windows\System\UuZQvOl.exe
  C:\Windows\System\UuZQvOl.exe
  2⤵
  PID:2356
- C:\Windows\System\rWciKeU.exe
  C:\Windows\System\rWciKeU.exe
  2⤵
  PID:2284
- C:\Windows\System\GtLSvmV.exe
  C:\Windows\System\GtLSvmV.exe
  2⤵
  PID:3028
- C:\Windows\System\BUcnTsw.exe
  C:\Windows\System\BUcnTsw.exe
  2⤵
  PID:2084
- C:\Windows\System\hzDPgDq.exe
  C:\Windows\System\hzDPgDq.exe
  2⤵
  PID:840
- C:\Windows\System\HUrzxKf.exe
  C:\Windows\System\HUrzxKf.exe
  2⤵
  PID:1696
- C:\Windows\System\LSiIjlU.exe
  C:\Windows\System\LSiIjlU.exe
  2⤵
  PID:2964
- C:\Windows\System\ztSSFVl.exe
  C:\Windows\System\ztSSFVl.exe
  2⤵
  PID:2184
- C:\Windows\System\TOSgYGU.exe
  C:\Windows\System\TOSgYGU.exe
  2⤵
  PID:1700
- C:\Windows\System\EIFQhvS.exe
  C:\Windows\System\EIFQhvS.exe
  2⤵
  PID:2612
- C:\Windows\System\RuaZPfC.exe
  C:\Windows\System\RuaZPfC.exe
  2⤵
  PID:3060
- C:\Windows\System\yBnPRct.exe
  C:\Windows\System\yBnPRct.exe
  2⤵
  PID:756
- C:\Windows\System\xvpDIrX.exe
  C:\Windows\System\xvpDIrX.exe
  2⤵
  PID:772
- C:\Windows\System\ViHFbYO.exe
  C:\Windows\System\ViHFbYO.exe
  2⤵
  PID:3044
- C:\Windows\System\LZGYoLR.exe
  C:\Windows\System\LZGYoLR.exe
  2⤵
  PID:1960
- C:\Windows\System\vHkudjx.exe
  C:\Windows\System\vHkudjx.exe
  2⤵
  PID:1580
- C:\Windows\System\xtgeXfI.exe
  C:\Windows\System\xtgeXfI.exe
  2⤵
  PID:2440
- C:\Windows\System\EXJCknb.exe
  C:\Windows\System\EXJCknb.exe
  2⤵
  PID:2292
- C:\Windows\System\CMfzPIl.exe
  C:\Windows\System\CMfzPIl.exe
  2⤵
  PID:896
- C:\Windows\System\RRPExwA.exe
  C:\Windows\System\RRPExwA.exe
  2⤵
  PID:844
- C:\Windows\System\MCbNzTy.exe
  C:\Windows\System\MCbNzTy.exe
  2⤵
  PID:3068
- C:\Windows\System\EzjUped.exe
  C:\Windows\System\EzjUped.exe
  2⤵
  PID:2960
- C:\Windows\System\qrySddV.exe
  C:\Windows\System\qrySddV.exe
  2⤵
  PID:584
- C:\Windows\System\bysZXVg.exe
  C:\Windows\System\bysZXVg.exe
  2⤵
  PID:1744
- C:\Windows\System\nTtEbqz.exe
  C:\Windows\System\nTtEbqz.exe
  2⤵
  PID:1956
- C:\Windows\System\tkDcuet.exe
  C:\Windows\System\tkDcuet.exe
  2⤵
  PID:1900
- C:\Windows\System\DbuIdYi.exe
  C:\Windows\System\DbuIdYi.exe
  2⤵
  PID:2592
- C:\Windows\System\MbBfWLB.exe
  C:\Windows\System\MbBfWLB.exe
  2⤵
  PID:1996
- C:\Windows\System\yigsoxX.exe
  C:\Windows\System\yigsoxX.exe
  2⤵
  PID:2780
- C:\Windows\System\sqDUAuz.exe
  C:\Windows\System\sqDUAuz.exe
  2⤵
  PID:1228
- C:\Windows\System\aUnqVdm.exe
  C:\Windows\System\aUnqVdm.exe
  2⤵
  PID:2388
- C:\Windows\System\CSakSzI.exe
  C:\Windows\System\CSakSzI.exe
  2⤵
  PID:2528
- C:\Windows\System\fPVSisg.exe
  C:\Windows\System\fPVSisg.exe
  2⤵
  PID:2744
- C:\Windows\System\jVhgoGF.exe
  C:\Windows\System\jVhgoGF.exe
  2⤵
  PID:1888
- C:\Windows\System\fyIdmno.exe
  C:\Windows\System\fyIdmno.exe
  2⤵
  PID:2616
- C:\Windows\System\ZAtlOMs.exe
  C:\Windows\System\ZAtlOMs.exe
  2⤵
  PID:2172
- C:\Windows\System\uqEkDLf.exe
  C:\Windows\System\uqEkDLf.exe
  2⤵
  PID:1612
- C:\Windows\System\WJBplhP.exe
  C:\Windows\System\WJBplhP.exe
  2⤵
  PID:2896
- C:\Windows\System\eOsHjtt.exe
  C:\Windows\System\eOsHjtt.exe
  2⤵
  PID:2496
- C:\Windows\System\eTYOyCw.exe
  C:\Windows\System\eTYOyCw.exe
  2⤵
  PID:2488
- C:\Windows\System\AhsfZwy.exe
  C:\Windows\System\AhsfZwy.exe
  2⤵
  PID:1648
- C:\Windows\System\VZzqZIN.exe
  C:\Windows\System\VZzqZIN.exe
  2⤵
  PID:3084
- C:\Windows\System\NtkUpEa.exe
  C:\Windows\System\NtkUpEa.exe
  2⤵
  PID:3100
- C:\Windows\System\sAbEEQi.exe
  C:\Windows\System\sAbEEQi.exe
  2⤵
  PID:3116
- C:\Windows\System\iIfLfRW.exe
  C:\Windows\System\iIfLfRW.exe
  2⤵
  PID:3212
- C:\Windows\System\VbCPiKo.exe
  C:\Windows\System\VbCPiKo.exe
  2⤵
  PID:3236
- C:\Windows\System\LVNsKHh.exe
  C:\Windows\System\LVNsKHh.exe
  2⤵
  PID:3252
- C:\Windows\System\FllWEvP.exe
  C:\Windows\System\FllWEvP.exe
  2⤵
  PID:3268
- C:\Windows\System\crDVyXe.exe
  C:\Windows\System\crDVyXe.exe
  2⤵
  PID:3284
- C:\Windows\System\fzyWHcH.exe
  C:\Windows\System\fzyWHcH.exe
  2⤵
  PID:3300
- C:\Windows\System\SLLYcQf.exe
  C:\Windows\System\SLLYcQf.exe
  2⤵
  PID:3316
- C:\Windows\System\RaUhfvo.exe
  C:\Windows\System\RaUhfvo.exe
  2⤵
  PID:3332
- C:\Windows\System\aBqLIbx.exe
  C:\Windows\System\aBqLIbx.exe
  2⤵
  PID:3348
- C:\Windows\System\PfkreXQ.exe
  C:\Windows\System\PfkreXQ.exe
  2⤵
  PID:3364
- C:\Windows\System\ObQbTSr.exe
  C:\Windows\System\ObQbTSr.exe
  2⤵
  PID:3380
- C:\Windows\System\klySVEE.exe
  C:\Windows\System\klySVEE.exe
  2⤵
  PID:3396
- C:\Windows\System\wViOWBw.exe
  C:\Windows\System\wViOWBw.exe
  2⤵
  PID:3416
- C:\Windows\System\JWkBnuz.exe
  C:\Windows\System\JWkBnuz.exe
  2⤵
  PID:3432
- C:\Windows\System\lgouzwP.exe
  C:\Windows\System\lgouzwP.exe
  2⤵
  PID:3448
- C:\Windows\System\kvvhlGp.exe
  C:\Windows\System\kvvhlGp.exe
  2⤵
  PID:3464
- C:\Windows\System\lzNVbIJ.exe
  C:\Windows\System\lzNVbIJ.exe
  2⤵
  PID:3484
- C:\Windows\System\KDeeLah.exe
  C:\Windows\System\KDeeLah.exe
  2⤵
  PID:3500
- C:\Windows\System\gSvvihQ.exe
  C:\Windows\System\gSvvihQ.exe
  2⤵
  PID:3580
- C:\Windows\System\PgMsaHI.exe
  C:\Windows\System\PgMsaHI.exe
  2⤵
  PID:3600
- C:\Windows\System\WanWzGR.exe
  C:\Windows\System\WanWzGR.exe
  2⤵
  PID:3616
- C:\Windows\System\pwtmPLH.exe
  C:\Windows\System\pwtmPLH.exe
  2⤵
  PID:3632
- C:\Windows\System\XMjJZvt.exe
  C:\Windows\System\XMjJZvt.exe
  2⤵
  PID:3652
- C:\Windows\System\hvsvDTC.exe
  C:\Windows\System\hvsvDTC.exe
  2⤵
  PID:3668
- C:\Windows\System\zLHoNTO.exe
  C:\Windows\System\zLHoNTO.exe
  2⤵
  PID:3684
- C:\Windows\System\wVbHnTo.exe
  C:\Windows\System\wVbHnTo.exe
  2⤵
  PID:3700
- C:\Windows\System\HuFqwUx.exe
  C:\Windows\System\HuFqwUx.exe
  2⤵
  PID:3716
- C:\Windows\System\DNpGSsO.exe
  C:\Windows\System\DNpGSsO.exe
  2⤵
  PID:3732
- C:\Windows\System\EJILBFd.exe
  C:\Windows\System\EJILBFd.exe
  2⤵
  PID:3748
- C:\Windows\System\yvRyRas.exe
  C:\Windows\System\yvRyRas.exe
  2⤵
  PID:3764
- C:\Windows\System\OJQisFc.exe
  C:\Windows\System\OJQisFc.exe
  2⤵
  PID:3780
- C:\Windows\System\bfSqIXC.exe
  C:\Windows\System\bfSqIXC.exe
  2⤵
  PID:3796
- C:\Windows\System\JTdYJwW.exe
  C:\Windows\System\JTdYJwW.exe
  2⤵
  PID:3852
- C:\Windows\System\DXNQkXV.exe
  C:\Windows\System\DXNQkXV.exe
  2⤵
  PID:3876
- C:\Windows\System\iaXeOjd.exe
  C:\Windows\System\iaXeOjd.exe
  2⤵
  PID:3900
- C:\Windows\System\tENWSRt.exe
  C:\Windows\System\tENWSRt.exe
  2⤵
  PID:3920
- C:\Windows\System\KWLVAGt.exe
  C:\Windows\System\KWLVAGt.exe
  2⤵
  PID:3944
- C:\Windows\System\RXnkVYv.exe
  C:\Windows\System\RXnkVYv.exe
  2⤵
  PID:3960
- C:\Windows\System\nJKMzeg.exe
  C:\Windows\System\nJKMzeg.exe
  2⤵
  PID:3980
- C:\Windows\System\CNJFbGp.exe
  C:\Windows\System\CNJFbGp.exe
  2⤵
  PID:4000
- C:\Windows\System\ZMvPrvm.exe
  C:\Windows\System\ZMvPrvm.exe
  2⤵
  PID:4024
- C:\Windows\System\LuyvVNq.exe
  C:\Windows\System\LuyvVNq.exe
  2⤵
  PID:4040
- C:\Windows\System\MVfSAUe.exe
  C:\Windows\System\MVfSAUe.exe
  2⤵
  PID:4060
- C:\Windows\System\FeyZziS.exe
  C:\Windows\System\FeyZziS.exe
  2⤵
  PID:4080
- C:\Windows\System\uyGYMAQ.exe
  C:\Windows\System\uyGYMAQ.exe
  2⤵
  PID:384
- C:\Windows\System\GMbAtlH.exe
  C:\Windows\System\GMbAtlH.exe
  2⤵
  PID:2336
- C:\Windows\System\xVqYsfH.exe
  C:\Windows\System\xVqYsfH.exe
  2⤵
  PID:2724
- C:\Windows\System\imTJnyl.exe
  C:\Windows\System\imTJnyl.exe
  2⤵
  PID:2024
- C:\Windows\System\vHDRXlF.exe
  C:\Windows\System\vHDRXlF.exe
  2⤵
  PID:1596
- C:\Windows\System\XJmNCCt.exe
  C:\Windows\System\XJmNCCt.exe
  2⤵
  PID:1780
- C:\Windows\System\GowTjrj.exe
  C:\Windows\System\GowTjrj.exe
  2⤵
  PID:2636
- C:\Windows\System\YpIyjsq.exe
  C:\Windows\System\YpIyjsq.exe
  2⤵
  PID:1376
- C:\Windows\System\anvVNwF.exe
  C:\Windows\System\anvVNwF.exe
  2⤵
  PID:3092
- C:\Windows\System\amNMfnw.exe
  C:\Windows\System\amNMfnw.exe
  2⤵
  PID:3132
- C:\Windows\System\HcjiVbI.exe
  C:\Windows\System\HcjiVbI.exe
  2⤵
  PID:3156
- C:\Windows\System\tCsJsfF.exe
  C:\Windows\System\tCsJsfF.exe
  2⤵
  PID:3180
- C:\Windows\System\rIxSIwR.exe
  C:\Windows\System\rIxSIwR.exe
  2⤵
  PID:3196
- C:\Windows\System\MVtZdkF.exe
  C:\Windows\System\MVtZdkF.exe
  2⤵
  PID:2588
- C:\Windows\System\tDXfKSE.exe
  C:\Windows\System\tDXfKSE.exe
  2⤵
  PID:3208
- C:\Windows\System\hZghjgI.exe
  C:\Windows\System\hZghjgI.exe
  2⤵
  PID:3280
- C:\Windows\System\UCccrGV.exe
  C:\Windows\System\UCccrGV.exe
  2⤵
  PID:3376
- C:\Windows\System\zxQBIWZ.exe
  C:\Windows\System\zxQBIWZ.exe
  2⤵
  PID:3220
- C:\Windows\System\HIpqgeM.exe
  C:\Windows\System\HIpqgeM.exe
  2⤵
  PID:3356
- C:\Windows\System\nDTxSZI.exe
  C:\Windows\System\nDTxSZI.exe
  2⤵
  PID:3444
- C:\Windows\System\KsSXFuO.exe
  C:\Windows\System\KsSXFuO.exe
  2⤵
  PID:3460
- C:\Windows\System\SWCokNp.exe
  C:\Windows\System\SWCokNp.exe
  2⤵
  PID:3476
- C:\Windows\System\IAUyKUh.exe
  C:\Windows\System\IAUyKUh.exe
  2⤵
  PID:3524
- C:\Windows\System\QzODfGc.exe
  C:\Windows\System\QzODfGc.exe
  2⤵
  PID:3540
- C:\Windows\System\yZeNlzp.exe
  C:\Windows\System\yZeNlzp.exe
  2⤵
  PID:3560
- C:\Windows\System\hCahxdT.exe
  C:\Windows\System\hCahxdT.exe
  2⤵
  PID:3576
- C:\Windows\System\OWjnkMh.exe
  C:\Windows\System\OWjnkMh.exe
  2⤵
  PID:3608
- C:\Windows\System\KFZyCRN.exe
  C:\Windows\System\KFZyCRN.exe
  2⤵
  PID:3648
- C:\Windows\System\VImjLdm.exe
  C:\Windows\System\VImjLdm.exe
  2⤵
  PID:3596
- C:\Windows\System\bXKuEjW.exe
  C:\Windows\System\bXKuEjW.exe
  2⤵
  PID:3740
- C:\Windows\System\GiTIRXK.exe
  C:\Windows\System\GiTIRXK.exe
  2⤵
  PID:3812
- C:\Windows\System\yzGuNwN.exe
  C:\Windows\System\yzGuNwN.exe
  2⤵
  PID:3828
- C:\Windows\System\CqOMfaU.exe
  C:\Windows\System\CqOMfaU.exe
  2⤵
  PID:3844
- C:\Windows\System\dgVXpor.exe
  C:\Windows\System\dgVXpor.exe
  2⤵
  PID:3728
- C:\Windows\System\AWUKNFk.exe
  C:\Windows\System\AWUKNFk.exe
  2⤵
  PID:3808
- C:\Windows\System\oYGXWHT.exe
  C:\Windows\System\oYGXWHT.exe
  2⤵
  PID:3872
- C:\Windows\System\OLuyPMP.exe
  C:\Windows\System\OLuyPMP.exe
  2⤵
  PID:3892
- C:\Windows\System\cszlVNi.exe
  C:\Windows\System\cszlVNi.exe
  2⤵
  PID:3928
- C:\Windows\System\rcjstPo.exe
  C:\Windows\System\rcjstPo.exe
  2⤵
  PID:3956
- C:\Windows\System\SLOKpaP.exe
  C:\Windows\System\SLOKpaP.exe
  2⤵
  PID:3988
- C:\Windows\System\qGZKUzr.exe
  C:\Windows\System\qGZKUzr.exe
  2⤵
  PID:2260
- C:\Windows\System\zfXmDQy.exe
  C:\Windows\System\zfXmDQy.exe
  2⤵
  PID:4012
- C:\Windows\System\WILZleg.exe
  C:\Windows\System\WILZleg.exe
  2⤵
  PID:4056
- C:\Windows\System\apFrCFb.exe
  C:\Windows\System\apFrCFb.exe
  2⤵
  PID:4076
- C:\Windows\System\euwrGnd.exe
  C:\Windows\System\euwrGnd.exe
  2⤵
  PID:4092
- C:\Windows\System\oRmQeXb.exe
  C:\Windows\System\oRmQeXb.exe
  2⤵
  PID:2604
- C:\Windows\System\TpUALsC.exe
  C:\Windows\System\TpUALsC.exe
  2⤵
  PID:3080
- C:\Windows\System\OIHkixp.exe
  C:\Windows\System\OIHkixp.exe
  2⤵
  PID:1856
- C:\Windows\System\LcZzwmC.exe
  C:\Windows\System\LcZzwmC.exe
  2⤵
  PID:2696
- C:\Windows\System\OZvPQGf.exe
  C:\Windows\System\OZvPQGf.exe
  2⤵
  PID:1556
- C:\Windows\System\JpYUWxz.exe
  C:\Windows\System\JpYUWxz.exe
  2⤵
  PID:3096
- C:\Windows\System\MgeVeSW.exe
  C:\Windows\System\MgeVeSW.exe
  2⤵
  PID:3144
- C:\Windows\System\iOOrJtR.exe
  C:\Windows\System\iOOrJtR.exe
  2⤵
  PID:3164
- C:\Windows\System\XNCjStl.exe
  C:\Windows\System\XNCjStl.exe
  2⤵
  PID:3192
- C:\Windows\System\LEhwIoR.exe
  C:\Windows\System\LEhwIoR.exe
  2⤵
  PID:3112
- C:\Windows\System\uWmoXBj.exe
  C:\Windows\System\uWmoXBj.exe
  2⤵
  PID:3232
- C:\Windows\System\WXRahDZ.exe
  C:\Windows\System\WXRahDZ.exe
  2⤵
  PID:3312
- C:\Windows\System\HuSTIKj.exe
  C:\Windows\System\HuSTIKj.exe
  2⤵
  PID:3412
- C:\Windows\System\TTImbpN.exe
  C:\Windows\System\TTImbpN.exe
  2⤵
  PID:3324
- C:\Windows\System\IzphgEN.exe
  C:\Windows\System\IzphgEN.exe
  2⤵
  PID:3424
- C:\Windows\System\aMYoOPB.exe
  C:\Windows\System\aMYoOPB.exe
  2⤵
  PID:3508
- C:\Windows\System\IeEYFCM.exe
  C:\Windows\System\IeEYFCM.exe
  2⤵
  PID:3512
- C:\Windows\System\bhHZKnr.exe
  C:\Windows\System\bhHZKnr.exe
  2⤵
  PID:3556
- C:\Windows\System\CuEjTqx.exe
  C:\Windows\System\CuEjTqx.exe
  2⤵
  PID:3136
- C:\Windows\System\MFgsBQn.exe
  C:\Windows\System\MFgsBQn.exe
  2⤵
  PID:3516
- C:\Windows\System\EzZiiJy.exe
  C:\Windows\System\EzZiiJy.exe
  2⤵
  PID:3708
- C:\Windows\System\SDuVwNG.exe
  C:\Windows\System\SDuVwNG.exe
  2⤵
  PID:3936
- C:\Windows\System\OgaBTRS.exe
  C:\Windows\System\OgaBTRS.exe
  2⤵
  PID:3692
- C:\Windows\System\VfnKcNr.exe
  C:\Windows\System\VfnKcNr.exe
  2⤵
  PID:3776
- C:\Windows\System\EFxTpYc.exe
  C:\Windows\System\EFxTpYc.exe
  2⤵
  PID:3840
- C:\Windows\System\VxTQUJA.exe
  C:\Windows\System\VxTQUJA.exe
  2⤵
  PID:3896
- C:\Windows\System\cPZIkYF.exe
  C:\Windows\System\cPZIkYF.exe
  2⤵
  PID:4008
- C:\Windows\System\rfNtMXU.exe
  C:\Windows\System\rfNtMXU.exe
  2⤵
  PID:1860
- C:\Windows\System\lMvzfYK.exe
  C:\Windows\System\lMvzfYK.exe
  2⤵
  PID:1948
- C:\Windows\System\VplIMUl.exe
  C:\Windows\System\VplIMUl.exe
  2⤵
  PID:2572
- C:\Windows\System\ifMYIKK.exe
  C:\Windows\System\ifMYIKK.exe
  2⤵
  PID:3148
- C:\Windows\System\hksfnaZ.exe
  C:\Windows\System\hksfnaZ.exe
  2⤵
  PID:3276
- C:\Windows\System\ByIrKBd.exe
  C:\Windows\System\ByIrKBd.exe
  2⤵
  PID:3392
- C:\Windows\System\QfwBRED.exe
  C:\Windows\System\QfwBRED.exe
  2⤵
  PID:2900
- C:\Windows\System\HXQJUXa.exe
  C:\Windows\System\HXQJUXa.exe
  2⤵
  PID:3680
- C:\Windows\System\CbbXpjm.exe
  C:\Windows\System\CbbXpjm.exe
  2⤵
  PID:3640
- C:\Windows\System\YrPgqHu.exe
  C:\Windows\System\YrPgqHu.exe
  2⤵
  PID:3408
- C:\Windows\System\nbqokjl.exe
  C:\Windows\System\nbqokjl.exe
  2⤵
  PID:3868
- C:\Windows\System\iFASXKL.exe
  C:\Windows\System\iFASXKL.exe
  2⤵
  PID:592
- C:\Windows\System\rKWWTDJ.exe
  C:\Windows\System\rKWWTDJ.exe
  2⤵
  PID:3568
- C:\Windows\System\WWBSaqV.exe
  C:\Windows\System\WWBSaqV.exe
  2⤵
  PID:4048
- C:\Windows\System\hGNQgpg.exe
  C:\Windows\System\hGNQgpg.exe
  2⤵
  PID:4072
- C:\Windows\System\qlmdeGv.exe
  C:\Windows\System\qlmdeGv.exe
  2⤵
  PID:2228
- C:\Windows\System\HaVGElF.exe
  C:\Windows\System\HaVGElF.exe
  2⤵
  PID:3552
- C:\Windows\System\fzEGOrC.exe
  C:\Windows\System\fzEGOrC.exe
  2⤵
  PID:3824
- C:\Windows\System\hKPMVTA.exe
  C:\Windows\System\hKPMVTA.exe
  2⤵
  PID:4020
- C:\Windows\System\IGwuAHh.exe
  C:\Windows\System\IGwuAHh.exe
  2⤵
  PID:4016
- C:\Windows\System\RyMuGzr.exe
  C:\Windows\System\RyMuGzr.exe
  2⤵
  PID:3428
- C:\Windows\System\KPFPctU.exe
  C:\Windows\System\KPFPctU.exe
  2⤵
  PID:3884
- C:\Windows\System\XebhehZ.exe
  C:\Windows\System\XebhehZ.exe
  2⤵
  PID:3952
- C:\Windows\System\vRuqpjT.exe
  C:\Windows\System\vRuqpjT.exe
  2⤵
  PID:2484
- C:\Windows\System\DrpfBxR.exe
  C:\Windows\System\DrpfBxR.exe
  2⤵
  PID:3200
- C:\Windows\System\lHvLVdr.exe
  C:\Windows\System\lHvLVdr.exe
  2⤵
  PID:2220
- C:\Windows\System\KMcfbbw.exe
  C:\Windows\System\KMcfbbw.exe
  2⤵
  PID:3660
- C:\Windows\System\GvXdhIF.exe
  C:\Windows\System\GvXdhIF.exe
  2⤵
  PID:3440
- C:\Windows\System\kSNuCUR.exe
  C:\Windows\System\kSNuCUR.exe
  2⤵
  PID:3712
- C:\Windows\System\kCIqhTg.exe
  C:\Windows\System\kCIqhTg.exe
  2⤵
  PID:3696
- C:\Windows\System\btIIXVl.exe
  C:\Windows\System\btIIXVl.exe
  2⤵
  PID:3168
- C:\Windows\System\nWPRsab.exe
  C:\Windows\System\nWPRsab.exe
  2⤵
  PID:4116
- C:\Windows\System\ZzWSWTD.exe
  C:\Windows\System\ZzWSWTD.exe
  2⤵
  PID:4136
- C:\Windows\System\GVccRNI.exe
  C:\Windows\System\GVccRNI.exe
  2⤵
  PID:4156
- C:\Windows\System\kfnqpDk.exe
  C:\Windows\System\kfnqpDk.exe
  2⤵
  PID:4172
- C:\Windows\System\jIsxLgQ.exe
  C:\Windows\System\jIsxLgQ.exe
  2⤵
  PID:4188
- C:\Windows\System\yDUGQjX.exe
  C:\Windows\System\yDUGQjX.exe
  2⤵
  PID:4204
- C:\Windows\System\KyKmVNr.exe
  C:\Windows\System\KyKmVNr.exe
  2⤵
  PID:4220
- C:\Windows\System\FVyggjD.exe
  C:\Windows\System\FVyggjD.exe
  2⤵
  PID:4248
- C:\Windows\System\zIEaEAC.exe
  C:\Windows\System\zIEaEAC.exe
  2⤵
  PID:4268
- C:\Windows\System\pDWUfGS.exe
  C:\Windows\System\pDWUfGS.exe
  2⤵
  PID:4320
- C:\Windows\System\WYvftmV.exe
  C:\Windows\System\WYvftmV.exe
  2⤵
  PID:4340
- C:\Windows\System\vsRGQKc.exe
  C:\Windows\System\vsRGQKc.exe
  2⤵
  PID:4376
- C:\Windows\System\mekLaRe.exe
  C:\Windows\System\mekLaRe.exe
  2⤵
  PID:4392
- C:\Windows\System\vHGWfyc.exe
  C:\Windows\System\vHGWfyc.exe
  2⤵
  PID:4408
- C:\Windows\System\DaHMhAQ.exe
  C:\Windows\System\DaHMhAQ.exe
  2⤵
  PID:4424
- C:\Windows\System\wxRBLqs.exe
  C:\Windows\System\wxRBLqs.exe
  2⤵
  PID:4440
- C:\Windows\System\xraSxDX.exe
  C:\Windows\System\xraSxDX.exe
  2⤵
  PID:4456
- C:\Windows\System\kRwDbmu.exe
  C:\Windows\System\kRwDbmu.exe
  2⤵
  PID:4500
- C:\Windows\System\dKCAOwG.exe
  C:\Windows\System\dKCAOwG.exe
  2⤵
  PID:4516
- C:\Windows\System\xsShkuH.exe
  C:\Windows\System\xsShkuH.exe
  2⤵
  PID:4532
- C:\Windows\System\XbuNnig.exe
  C:\Windows\System\XbuNnig.exe
  2⤵
  PID:4548
- C:\Windows\System\sLLsbXr.exe
  C:\Windows\System\sLLsbXr.exe
  2⤵
  PID:4564
- C:\Windows\System\QmKNHFA.exe
  C:\Windows\System\QmKNHFA.exe
  2⤵
  PID:4580
- C:\Windows\System\PnXDebb.exe
  C:\Windows\System\PnXDebb.exe
  2⤵
  PID:4600
- C:\Windows\System\GqVOjby.exe
  C:\Windows\System\GqVOjby.exe
  2⤵
  PID:4616
- C:\Windows\System\otRRzCb.exe
  C:\Windows\System\otRRzCb.exe
  2⤵
  PID:4632
- C:\Windows\System\SUwkylY.exe
  C:\Windows\System\SUwkylY.exe
  2⤵
  PID:4648
- C:\Windows\System\NpSfBIu.exe
  C:\Windows\System\NpSfBIu.exe
  2⤵
  PID:4664
- C:\Windows\System\ZQwBWsu.exe
  C:\Windows\System\ZQwBWsu.exe
  2⤵
  PID:4680
- C:\Windows\System\TUwdhVZ.exe
  C:\Windows\System\TUwdhVZ.exe
  2⤵
  PID:4696
- C:\Windows\System\cwUSlEd.exe
  C:\Windows\System\cwUSlEd.exe
  2⤵
  PID:4712
- C:\Windows\System\KIbEPbU.exe
  C:\Windows\System\KIbEPbU.exe
  2⤵
  PID:4732
- C:\Windows\System\XePUCZa.exe
  C:\Windows\System\XePUCZa.exe
  2⤵
  PID:4748
- C:\Windows\System\nAqyEzA.exe
  C:\Windows\System\nAqyEzA.exe
  2⤵
  PID:4764
- C:\Windows\System\QdSlnxA.exe
  C:\Windows\System\QdSlnxA.exe
  2⤵
  PID:4780
- C:\Windows\System\WbfUFsk.exe
  C:\Windows\System\WbfUFsk.exe
  2⤵
  PID:4796
- C:\Windows\System\YRyqPhL.exe
  C:\Windows\System\YRyqPhL.exe
  2⤵
  PID:4880
- C:\Windows\System\PWUrxwO.exe
  C:\Windows\System\PWUrxwO.exe
  2⤵
  PID:4896
- C:\Windows\System\dffmsLC.exe
  C:\Windows\System\dffmsLC.exe
  2⤵
  PID:4912
- C:\Windows\System\PAmTGRB.exe
  C:\Windows\System\PAmTGRB.exe
  2⤵
  PID:4928
- C:\Windows\System\QhXKmVS.exe
  C:\Windows\System\QhXKmVS.exe
  2⤵
  PID:4948
- C:\Windows\System\zMWfoBA.exe
  C:\Windows\System\zMWfoBA.exe
  2⤵
  PID:4980
- C:\Windows\System\HjgJfBO.exe
  C:\Windows\System\HjgJfBO.exe
  2⤵
  PID:4996
- C:\Windows\System\ubazBiW.exe
  C:\Windows\System\ubazBiW.exe
  2⤵
  PID:5012
- C:\Windows\System\aUbtaLM.exe
  C:\Windows\System\aUbtaLM.exe
  2⤵
  PID:5028
- C:\Windows\System\hOogOxk.exe
  C:\Windows\System\hOogOxk.exe
  2⤵
  PID:5048
- C:\Windows\System\hlUSZQy.exe
  C:\Windows\System\hlUSZQy.exe
  2⤵
  PID:5064
- C:\Windows\System\KOsIdqv.exe
  C:\Windows\System\KOsIdqv.exe
  2⤵
  PID:5080
- C:\Windows\System\riGsPOr.exe
  C:\Windows\System\riGsPOr.exe
  2⤵
  PID:5096
- C:\Windows\System\vDvkwyz.exe
  C:\Windows\System\vDvkwyz.exe
  2⤵
  PID:5112
- C:\Windows\System\SKwbpqp.exe
  C:\Windows\System\SKwbpqp.exe
  2⤵
  PID:1548
- C:\Windows\System\LJzhafl.exe
  C:\Windows\System\LJzhafl.exe
  2⤵
  PID:4128
- C:\Windows\System\vdctgpI.exe
  C:\Windows\System\vdctgpI.exe
  2⤵
  PID:4148
- C:\Windows\System\pBQgOFz.exe
  C:\Windows\System\pBQgOFz.exe
  2⤵
  PID:4256
- C:\Windows\System\Pjqpjph.exe
  C:\Windows\System\Pjqpjph.exe
  2⤵
  PID:4236
- C:\Windows\System\ZlAMCWn.exe
  C:\Windows\System\ZlAMCWn.exe
  2⤵
  PID:4328
- C:\Windows\System\ezBweDf.exe
  C:\Windows\System\ezBweDf.exe
  2⤵
  PID:4292
- C:\Windows\System\LlwXAmY.exe
  C:\Windows\System\LlwXAmY.exe
  2⤵
  PID:4332
- C:\Windows\System\BFzKhvz.exe
  C:\Windows\System\BFzKhvz.exe
  2⤵
  PID:4356
- C:\Windows\System\vKnOCDp.exe
  C:\Windows\System\vKnOCDp.exe
  2⤵
  PID:4420
- C:\Windows\System\ogZrDxL.exe
  C:\Windows\System\ogZrDxL.exe
  2⤵
  PID:4404
- C:\Windows\System\rXRVgFX.exe
  C:\Windows\System\rXRVgFX.exe
  2⤵
  PID:4432
- C:\Windows\System\gDlwhWT.exe
  C:\Windows\System\gDlwhWT.exe
  2⤵
  PID:4488
- C:\Windows\System\wnTLsDN.exe
  C:\Windows\System\wnTLsDN.exe
  2⤵
  PID:4508
- C:\Windows\System\oJcGhBd.exe
  C:\Windows\System\oJcGhBd.exe
  2⤵
  PID:4624
- C:\Windows\System\aPvnMgo.exe
  C:\Windows\System\aPvnMgo.exe
  2⤵
  PID:4528
- C:\Windows\System\CJeiqKW.exe
  C:\Windows\System\CJeiqKW.exe
  2⤵
  PID:4692
- C:\Windows\System\UzTQZiJ.exe
  C:\Windows\System\UzTQZiJ.exe
  2⤵
  PID:4676
- C:\Windows\System\ROxvzzY.exe
  C:\Windows\System\ROxvzzY.exe
  2⤵
  PID:4608
- C:\Windows\System\XbRbirC.exe
  C:\Windows\System\XbRbirC.exe
  2⤵
  PID:4744
- C:\Windows\System\PDstpxJ.exe
  C:\Windows\System\PDstpxJ.exe
  2⤵
  PID:4724
- C:\Windows\System\DDJfVCf.exe
  C:\Windows\System\DDJfVCf.exe
  2⤵
  PID:4788
- C:\Windows\System\npNmWhk.exe
  C:\Windows\System\npNmWhk.exe
  2⤵
  PID:4808
- C:\Windows\System\heHWCgj.exe
  C:\Windows\System\heHWCgj.exe
  2⤵
  PID:4820
- C:\Windows\System\DBoiJGr.exe
  C:\Windows\System\DBoiJGr.exe
  2⤵
  PID:4836
- C:\Windows\System\HvxOLGP.exe
  C:\Windows\System\HvxOLGP.exe
  2⤵
  PID:4856
- C:\Windows\System\sXgsxdG.exe
  C:\Windows\System\sXgsxdG.exe
  2⤵
  PID:4868
- C:\Windows\System\dPToIXX.exe
  C:\Windows\System\dPToIXX.exe
  2⤵
  PID:4892
- C:\Windows\System\dUnmkCU.exe
  C:\Windows\System\dUnmkCU.exe
  2⤵
  PID:4944
- C:\Windows\System\iIvxqjT.exe
  C:\Windows\System\iIvxqjT.exe
  2⤵
  PID:4988
- C:\Windows\System\TJmmDLI.exe
  C:\Windows\System\TJmmDLI.exe
  2⤵
  PID:4972
- C:\Windows\System\pGiKBDE.exe
  C:\Windows\System\pGiKBDE.exe
  2⤵
  PID:5024
- C:\Windows\System\gQxAHPh.exe
  C:\Windows\System\gQxAHPh.exe
  2⤵
  PID:5044
- C:\Windows\System\qyDROKP.exe
  C:\Windows\System\qyDROKP.exe
  2⤵
  PID:5092
- C:\Windows\System\OtFnVQQ.exe
  C:\Windows\System\OtFnVQQ.exe
  2⤵
  PID:5040
- C:\Windows\System\bUrAPTt.exe
  C:\Windows\System\bUrAPTt.exe
  2⤵
  PID:4108
- C:\Windows\System\fGwnVyV.exe
  C:\Windows\System\fGwnVyV.exe
  2⤵
  PID:4124
- C:\Windows\System\znGcNmD.exe
  C:\Windows\System\znGcNmD.exe
  2⤵
  PID:4200
- C:\Windows\System\NmqmNjt.exe
  C:\Windows\System\NmqmNjt.exe
  2⤵
  PID:4276
- C:\Windows\System\nEpESrg.exe
  C:\Windows\System\nEpESrg.exe
  2⤵
  PID:4312
- C:\Windows\System\lHVxhpS.exe
  C:\Windows\System\lHVxhpS.exe
  2⤵
  PID:4308
- C:\Windows\System\DoVmKeU.exe
  C:\Windows\System\DoVmKeU.exe
  2⤵
  PID:4388
- C:\Windows\System\urTXAAZ.exe
  C:\Windows\System\urTXAAZ.exe
  2⤵
  PID:4364
- C:\Windows\System\aosMjWL.exe
  C:\Windows\System\aosMjWL.exe
  2⤵
  PID:4368
- C:\Windows\System\rwSnhbD.exe
  C:\Windows\System\rwSnhbD.exe
  2⤵
  PID:5124
- C:\Windows\System\rWdqFlQ.exe
  C:\Windows\System\rWdqFlQ.exe
  2⤵
  PID:5140
- C:\Windows\System\BpUNJVF.exe
  C:\Windows\System\BpUNJVF.exe
  2⤵
  PID:5156
- C:\Windows\System\GcDHpyy.exe
  C:\Windows\System\GcDHpyy.exe
  2⤵
  PID:5172
- C:\Windows\System\YofqFqa.exe
  C:\Windows\System\YofqFqa.exe
  2⤵
  PID:5188
- C:\Windows\System\RIgERCg.exe
  C:\Windows\System\RIgERCg.exe
  2⤵
  PID:5204
- C:\Windows\System\GShcNQD.exe
  C:\Windows\System\GShcNQD.exe
  2⤵
  PID:5220
- C:\Windows\System\tmmqSeK.exe
  C:\Windows\System\tmmqSeK.exe
  2⤵
  PID:5236
- C:\Windows\System\LEKtCUN.exe
  C:\Windows\System\LEKtCUN.exe
  2⤵
  PID:5252
- C:\Windows\System\kDmUNbz.exe
  C:\Windows\System\kDmUNbz.exe
  2⤵
  PID:5268
- C:\Windows\System\jDSVgSr.exe
  C:\Windows\System\jDSVgSr.exe
  2⤵
  PID:5288
- C:\Windows\System\bJZjsiw.exe
  C:\Windows\System\bJZjsiw.exe
  2⤵
  PID:5304
- C:\Windows\System\OqiKyDd.exe
  C:\Windows\System\OqiKyDd.exe
  2⤵
  PID:5320
- C:\Windows\System\UqGcyTm.exe
  C:\Windows\System\UqGcyTm.exe
  2⤵
  PID:5336
- C:\Windows\System\fiHXNVy.exe
  C:\Windows\System\fiHXNVy.exe
  2⤵
  PID:5352
- C:\Windows\System\XNwqlaK.exe
  C:\Windows\System\XNwqlaK.exe
  2⤵
  PID:5368
- C:\Windows\System\idmqNpt.exe
  C:\Windows\System\idmqNpt.exe
  2⤵
  PID:5384
- C:\Windows\System\sYUklHC.exe
  C:\Windows\System\sYUklHC.exe
  2⤵
  PID:5400
- C:\Windows\System\OoeMXXt.exe
  C:\Windows\System\OoeMXXt.exe
  2⤵
  PID:5416
- C:\Windows\System\NxMcxgi.exe
  C:\Windows\System\NxMcxgi.exe
  2⤵
  PID:5432
- C:\Windows\System\VQZXzkw.exe
  C:\Windows\System\VQZXzkw.exe
  2⤵
  PID:5448
- C:\Windows\System\HpGsMew.exe
  C:\Windows\System\HpGsMew.exe
  2⤵
  PID:5464
- C:\Windows\System\SruHkbL.exe
  C:\Windows\System\SruHkbL.exe
  2⤵
  PID:5480
- C:\Windows\System\mjhROvP.exe
  C:\Windows\System\mjhROvP.exe
  2⤵
  PID:5496
- C:\Windows\System\jTAUQUr.exe
  C:\Windows\System\jTAUQUr.exe
  2⤵
  PID:5512
- C:\Windows\System\UiYXEYF.exe
  C:\Windows\System\UiYXEYF.exe
  2⤵
  PID:5528
- C:\Windows\System\nZgSYKA.exe
  C:\Windows\System\nZgSYKA.exe
  2⤵
  PID:5544
- C:\Windows\System\BOeQrtc.exe
  C:\Windows\System\BOeQrtc.exe
  2⤵
  PID:5560
- C:\Windows\System\qZhVOJj.exe
  C:\Windows\System\qZhVOJj.exe
  2⤵
  PID:5576
- C:\Windows\System\GRWWVuI.exe
  C:\Windows\System\GRWWVuI.exe
  2⤵
  PID:5592
- C:\Windows\System\fwlrIHg.exe
  C:\Windows\System\fwlrIHg.exe
  2⤵
  PID:5608
- C:\Windows\System\CNPLgZQ.exe
  C:\Windows\System\CNPLgZQ.exe
  2⤵
  PID:5624
- C:\Windows\System\qFRnuLM.exe
  C:\Windows\System\qFRnuLM.exe
  2⤵
  PID:5640
- C:\Windows\System\VwAyjtw.exe
  C:\Windows\System\VwAyjtw.exe
  2⤵
  PID:5656
- C:\Windows\System\OjRnehA.exe
  C:\Windows\System\OjRnehA.exe
  2⤵
  PID:5672
- C:\Windows\System\SokiHIb.exe
  C:\Windows\System\SokiHIb.exe
  2⤵
  PID:5688
- C:\Windows\System\LrNqFEU.exe
  C:\Windows\System\LrNqFEU.exe
  2⤵
  PID:5704
- C:\Windows\System\DreribM.exe
  C:\Windows\System\DreribM.exe
  2⤵
  PID:5720
- C:\Windows\System\rKDEGao.exe
  C:\Windows\System\rKDEGao.exe
  2⤵
  PID:5736
- C:\Windows\System\kELoaHv.exe
  C:\Windows\System\kELoaHv.exe
  2⤵
  PID:5752
- C:\Windows\System\aEvaKCZ.exe
  C:\Windows\System\aEvaKCZ.exe
  2⤵
  PID:5768
- C:\Windows\System\BASecOr.exe
  C:\Windows\System\BASecOr.exe
  2⤵
  PID:5784
- C:\Windows\System\xZKDFEc.exe
  C:\Windows\System\xZKDFEc.exe
  2⤵
  PID:5800
- C:\Windows\System\ombaPUi.exe
  C:\Windows\System\ombaPUi.exe
  2⤵
  PID:5816
- C:\Windows\System\MhUpHGY.exe
  C:\Windows\System\MhUpHGY.exe
  2⤵
  PID:5832
- C:\Windows\System\SjVXCZP.exe
  C:\Windows\System\SjVXCZP.exe
  2⤵
  PID:5848
- C:\Windows\System\valkqsV.exe
  C:\Windows\System\valkqsV.exe
  2⤵
  PID:5864
- C:\Windows\System\jkldANd.exe
  C:\Windows\System\jkldANd.exe
  2⤵
  PID:5880
- C:\Windows\System\RKPeoOh.exe
  C:\Windows\System\RKPeoOh.exe
  2⤵
  PID:5896
- C:\Windows\System\VFWwjEB.exe
  C:\Windows\System\VFWwjEB.exe
  2⤵
  PID:5916
- C:\Windows\System\svKrmdf.exe
  C:\Windows\System\svKrmdf.exe
  2⤵
  PID:5932
- C:\Windows\System\ZkPuIrB.exe
  C:\Windows\System\ZkPuIrB.exe
  2⤵
  PID:5948
- C:\Windows\System\INtMqNA.exe
  C:\Windows\System\INtMqNA.exe
  2⤵
  PID:5964
- C:\Windows\System\pIwiwfR.exe
  C:\Windows\System\pIwiwfR.exe
  2⤵
  PID:5980
- C:\Windows\System\pFKRhir.exe
  C:\Windows\System\pFKRhir.exe
  2⤵
  PID:5996
- C:\Windows\System\ejBeiXH.exe
  C:\Windows\System\ejBeiXH.exe
  2⤵
  PID:6012
- C:\Windows\System\gGJTwik.exe
  C:\Windows\System\gGJTwik.exe
  2⤵
  PID:6028
- C:\Windows\System\sdiNfWX.exe
  C:\Windows\System\sdiNfWX.exe
  2⤵
  PID:6048
- C:\Windows\System\SavfzMJ.exe
  C:\Windows\System\SavfzMJ.exe
  2⤵
  PID:6064
- C:\Windows\System\dXCoJVH.exe
  C:\Windows\System\dXCoJVH.exe
  2⤵
  PID:6080
- C:\Windows\System\NcLVOJr.exe
  C:\Windows\System\NcLVOJr.exe
  2⤵
  PID:6096
- C:\Windows\System\MqvWDVI.exe
  C:\Windows\System\MqvWDVI.exe
  2⤵
  PID:4472
- C:\Windows\System\XLPFEnI.exe
  C:\Windows\System\XLPFEnI.exe
  2⤵
  PID:4960
- C:\Windows\System\GmVFpKU.exe
  C:\Windows\System\GmVFpKU.exe
  2⤵
  PID:5108
- C:\Windows\System\wQQcibD.exe
  C:\Windows\System\wQQcibD.exe
  2⤵
  PID:4216
- C:\Windows\System\ApUcSEL.exe
  C:\Windows\System\ApUcSEL.exe
  2⤵
  PID:4492
- C:\Windows\System\NMcfciB.exe
  C:\Windows\System\NMcfciB.exe
  2⤵
  PID:5168
- C:\Windows\System\XtbfiLK.exe
  C:\Windows\System\XtbfiLK.exe
  2⤵
  PID:5260
- C:\Windows\System\hRRqKXU.exe
  C:\Windows\System\hRRqKXU.exe
  2⤵
  PID:5328
- C:\Windows\System\MKVyfqa.exe
  C:\Windows\System\MKVyfqa.exe
  2⤵
  PID:2980
- C:\Windows\System\FNuoFXT.exe
  C:\Windows\System\FNuoFXT.exe
  2⤵
  PID:5424
- C:\Windows\System\FEBVmVq.exe
  C:\Windows\System\FEBVmVq.exe
  2⤵
  PID:5244
- C:\Windows\System\UdkmxzJ.exe
  C:\Windows\System\UdkmxzJ.exe
  2⤵
  PID:5180
- C:\Windows\System\ZJjkggp.exe
  C:\Windows\System\ZJjkggp.exe
  2⤵
  PID:5316
- C:\Windows\System\ZRhITcB.exe
  C:\Windows\System\ZRhITcB.exe
  2⤵
  PID:5380
- C:\Windows\System\BzHhFpW.exe
  C:\Windows\System\BzHhFpW.exe
  2⤵
  PID:5444
- C:\Windows\System\lGCqApU.exe
  C:\Windows\System\lGCqApU.exe
  2⤵
  PID:5312
- C:\Windows\System\EGmNIqe.exe
  C:\Windows\System\EGmNIqe.exe
  2⤵
  PID:5524
- C:\Windows\System\kqZBpOb.exe
  C:\Windows\System\kqZBpOb.exe
  2⤵
  PID:5508
- C:\Windows\System\JpameXw.exe
  C:\Windows\System\JpameXw.exe
  2⤵
  PID:5584
- C:\Windows\System\OBkwhUx.exe
  C:\Windows\System\OBkwhUx.exe
  2⤵
  PID:5552
- C:\Windows\System\nEauvpw.exe
  C:\Windows\System\nEauvpw.exe
  2⤵
  PID:5616
- C:\Windows\System\ouydJCB.exe
  C:\Windows\System\ouydJCB.exe
  2⤵
  PID:5712
- C:\Windows\System\eniciEP.exe
  C:\Windows\System\eniciEP.exe
  2⤵
  PID:5604
- C:\Windows\System\FrgSHyr.exe
  C:\Windows\System\FrgSHyr.exe
  2⤵
  PID:5636
- C:\Windows\System\yVlAvmF.exe
  C:\Windows\System\yVlAvmF.exe
  2⤵
  PID:5568
- C:\Windows\System\bqhEtdK.exe
  C:\Windows\System\bqhEtdK.exe
  2⤵
  PID:5760
- C:\Windows\System\TPflMSD.exe
  C:\Windows\System\TPflMSD.exe
  2⤵
  PID:5856
- C:\Windows\System\OXtspMP.exe
  C:\Windows\System\OXtspMP.exe
  2⤵
  PID:5924
- C:\Windows\System\HitNxhS.exe
  C:\Windows\System\HitNxhS.exe
  2⤵
  PID:5844
- C:\Windows\System\wkrSqPz.exe
  C:\Windows\System\wkrSqPz.exe
  2⤵
  PID:5908
- C:\Windows\System\usAnCLq.exe
  C:\Windows\System\usAnCLq.exe
  2⤵
  PID:5940
- C:\Windows\System\MDEjPri.exe
  C:\Windows\System\MDEjPri.exe
  2⤵
  PID:5960
- C:\Windows\System\Eolnhjo.exe
  C:\Windows\System\Eolnhjo.exe
  2⤵
  PID:6024
- C:\Windows\System\KpeaPMN.exe
  C:\Windows\System\KpeaPMN.exe
  2⤵
  PID:6092
- C:\Windows\System\SqPgeyh.exe
  C:\Windows\System\SqPgeyh.exe
  2⤵
  PID:6072
- C:\Windows\System\iPlDTDb.exe
  C:\Windows\System\iPlDTDb.exe
  2⤵
  PID:6104
- C:\Windows\System\HbGPlYk.exe
  C:\Windows\System\HbGPlYk.exe
  2⤵
  PID:6120
- C:\Windows\System\wbterIV.exe
  C:\Windows\System\wbterIV.exe
  2⤵
  PID:6136
- C:\Windows\System\pcgiGif.exe
  C:\Windows\System\pcgiGif.exe
  2⤵
  PID:4660
- C:\Windows\System\cnrartp.exe
  C:\Windows\System\cnrartp.exe
  2⤵
  PID:4556
- C:\Windows\System\YbVLkat.exe
  C:\Windows\System\YbVLkat.exe
  2⤵
  PID:4888
- C:\Windows\System\vnnAsCA.exe
  C:\Windows\System\vnnAsCA.exe
  2⤵
  PID:4672
- C:\Windows\System\lzDkhLl.exe
  C:\Windows\System\lzDkhLl.exe
  2⤵
  PID:5164
- C:\Windows\System\sZFnvHq.exe
  C:\Windows\System\sZFnvHq.exe
  2⤵
  PID:5396
- C:\Windows\System\VLQPJCq.exe
  C:\Windows\System\VLQPJCq.exe
  2⤵
  PID:5184
- C:\Windows\System\SlTFoty.exe
  C:\Windows\System\SlTFoty.exe
  2⤵
  PID:4592
- C:\Windows\System\uFHKPeL.exe
  C:\Windows\System\uFHKPeL.exe
  2⤵
  PID:5376
- C:\Windows\System\ayEWkSh.exe
  C:\Windows\System\ayEWkSh.exe
  2⤵
  PID:5460
- C:\Windows\System\sjVdOBN.exe
  C:\Windows\System\sjVdOBN.exe
  2⤵
  PID:5652
- C:\Windows\System\WfXzSHw.exe
  C:\Windows\System\WfXzSHw.exe
  2⤵
  PID:4336
- C:\Windows\System\eDZVaqz.exe
  C:\Windows\System\eDZVaqz.exe
  2⤵
  PID:4464
- C:\Windows\System\IvfSgUc.exe
  C:\Windows\System\IvfSgUc.exe
  2⤵
  PID:5632
- C:\Windows\System\wVCmDFj.exe
  C:\Windows\System\wVCmDFj.exe
  2⤵
  PID:5728
- C:\Windows\System\DhBNCZg.exe
  C:\Windows\System\DhBNCZg.exe
  2⤵
  PID:5732
- C:\Windows\System\LSMbIcD.exe
  C:\Windows\System\LSMbIcD.exe
  2⤵
  PID:5744
- C:\Windows\System\YfimXHS.exe
  C:\Windows\System\YfimXHS.exe
  2⤵
  PID:4688
- C:\Windows\System\YuBlnPk.exe
  C:\Windows\System\YuBlnPk.exe
  2⤵
  PID:5892
- C:\Windows\System\GsgugEN.exe
  C:\Windows\System\GsgugEN.exe
  2⤵
  PID:5972
- C:\Windows\System\KEIsXft.exe
  C:\Windows\System\KEIsXft.exe
  2⤵
  PID:6088
- C:\Windows\System\gaCUDbx.exe
  C:\Windows\System\gaCUDbx.exe
  2⤵
  PID:5928
- C:\Windows\System\xBcAPKa.exe
  C:\Windows\System\xBcAPKa.exe
  2⤵
  PID:6132
- C:\Windows\System\mGLWBIv.exe
  C:\Windows\System\mGLWBIv.exe
  2⤵
  PID:5824
- C:\Windows\System\dfGZNaE.exe
  C:\Windows\System\dfGZNaE.exe
  2⤵
  PID:4588
- C:\Windows\System\hzrpSlM.exe
  C:\Windows\System\hzrpSlM.exe
  2⤵
  PID:4576
- C:\Windows\System\nNKEBXd.exe
  C:\Windows\System\nNKEBXd.exe
  2⤵
  PID:4832
- C:\Windows\System\lFtmerX.exe
  C:\Windows\System\lFtmerX.exe
  2⤵
  PID:4924
- C:\Windows\System\uOTWFvA.exe
  C:\Windows\System\uOTWFvA.exe
  2⤵
  PID:3492
- C:\Windows\System\gASHMOh.exe
  C:\Windows\System\gASHMOh.exe
  2⤵
  PID:4760
- C:\Windows\System\mrFNZOS.exe
  C:\Windows\System\mrFNZOS.exe
  2⤵
  PID:4848
- C:\Windows\System\srISgaL.exe
  C:\Windows\System\srISgaL.exe
  2⤵
  PID:4644
- C:\Windows\System\PSTbcWj.exe
  C:\Windows\System\PSTbcWj.exe
  2⤵
  PID:5212
- C:\Windows\System\LIJOBRt.exe
  C:\Windows\System\LIJOBRt.exe
  2⤵
  PID:4540
- C:\Windows\System\dEBptJq.exe
  C:\Windows\System\dEBptJq.exe
  2⤵
  PID:5504
- C:\Windows\System\ouBYbav.exe
  C:\Windows\System\ouBYbav.exe
  2⤵
  PID:4264
- C:\Windows\System\VhGmMbx.exe
  C:\Windows\System\VhGmMbx.exe
  2⤵
  PID:5520
- C:\Windows\System\bimscoP.exe
  C:\Windows\System\bimscoP.exe
  2⤵
  PID:5228
- C:\Windows\System\GFbvpea.exe
  C:\Windows\System\GFbvpea.exe
  2⤵
  PID:5796
- C:\Windows\System\pwfpfgq.exe
  C:\Windows\System\pwfpfgq.exe
  2⤵
  PID:5792
- C:\Windows\System\SUhxGyB.exe
  C:\Windows\System\SUhxGyB.exe
  2⤵
  PID:5992
- C:\Windows\System\WxPhoEf.exe
  C:\Windows\System\WxPhoEf.exe
  2⤵
  PID:6060
- C:\Windows\System\fhJoecF.exe
  C:\Windows\System\fhJoecF.exe
  2⤵
  PID:6040
- C:\Windows\System\yQgexYg.exe
  C:\Windows\System\yQgexYg.exe
  2⤵
  PID:4908
- C:\Windows\System\VHcGdtF.exe
  C:\Windows\System\VHcGdtF.exe
  2⤵
  PID:5556
- C:\Windows\System\wRRPKyr.exe
  C:\Windows\System\wRRPKyr.exe
  2⤵
  PID:5136
- C:\Windows\System\irSoYOK.exe
  C:\Windows\System\irSoYOK.exe
  2⤵
  PID:5456
- C:\Windows\System\UsNgLXi.exe
  C:\Windows\System\UsNgLXi.exe
  2⤵
  PID:4452
- C:\Windows\System\mBzugvG.exe
  C:\Windows\System\mBzugvG.exe
  2⤵
  PID:5364
- C:\Windows\System\BxUkaVV.exe
  C:\Windows\System\BxUkaVV.exe
  2⤵
  PID:5904
- C:\Windows\System\fVvZSNH.exe
  C:\Windows\System\fVvZSNH.exe
  2⤵
  PID:4656
- C:\Windows\System\brCdqvB.exe
  C:\Windows\System\brCdqvB.exe
  2⤵
  PID:5232
- C:\Windows\System\KpEAdsu.exe
  C:\Windows\System\KpEAdsu.exe
  2⤵
  PID:6128
- C:\Windows\System\briuijJ.exe
  C:\Windows\System\briuijJ.exe
  2⤵
  PID:4352
- C:\Windows\System\azfipfn.exe
  C:\Windows\System\azfipfn.exe
  2⤵
  PID:4876
- C:\Windows\System\zKlHBSQ.exe
  C:\Windows\System\zKlHBSQ.exe
  2⤵
  PID:5976
- C:\Windows\System\utiiriu.exe
  C:\Windows\System\utiiriu.exe
  2⤵
  PID:4544
- C:\Windows\System\KjVrGGN.exe
  C:\Windows\System\KjVrGGN.exe
  2⤵
  PID:4816
- C:\Windows\System\VSvRVOO.exe
  C:\Windows\System\VSvRVOO.exe
  2⤵
  PID:5748
- C:\Windows\System\GYNxpae.exe
  C:\Windows\System\GYNxpae.exe
  2⤵
  PID:6152
- C:\Windows\System\SRtEAOG.exe
  C:\Windows\System\SRtEAOG.exe
  2⤵
  PID:6172
- C:\Windows\System\xhAkRdH.exe
  C:\Windows\System\xhAkRdH.exe
  2⤵
  PID:6188
- C:\Windows\System\yvKYiGT.exe
  C:\Windows\System\yvKYiGT.exe
  2⤵
  PID:6204
- C:\Windows\System\YqJtBxE.exe
  C:\Windows\System\YqJtBxE.exe
  2⤵
  PID:6220
- C:\Windows\System\OxQmLeV.exe
  C:\Windows\System\OxQmLeV.exe
  2⤵
  PID:6236
- C:\Windows\System\GdtlwLC.exe
  C:\Windows\System\GdtlwLC.exe
  2⤵
  PID:6252
- C:\Windows\System\wPHcSXj.exe
  C:\Windows\System\wPHcSXj.exe
  2⤵
  PID:6272
- C:\Windows\System\WsMTgpn.exe
  C:\Windows\System\WsMTgpn.exe
  2⤵
  PID:6288
- C:\Windows\System\gBtPWom.exe
  C:\Windows\System\gBtPWom.exe
  2⤵
  PID:6304
- C:\Windows\System\dfaWRlB.exe
  C:\Windows\System\dfaWRlB.exe
  2⤵
  PID:6320
- C:\Windows\System\toAEixh.exe
  C:\Windows\System\toAEixh.exe
  2⤵
  PID:6336
- C:\Windows\System\SOrIslN.exe
  C:\Windows\System\SOrIslN.exe
  2⤵
  PID:6352
- C:\Windows\System\ixnkpqh.exe
  C:\Windows\System\ixnkpqh.exe
  2⤵
  PID:6368
- C:\Windows\System\liLfcKu.exe
  C:\Windows\System\liLfcKu.exe
  2⤵
  PID:6384
- C:\Windows\System\Qyoxfjs.exe
  C:\Windows\System\Qyoxfjs.exe
  2⤵
  PID:6400
- C:\Windows\System\miodZDe.exe
  C:\Windows\System\miodZDe.exe
  2⤵
  PID:6416
- C:\Windows\System\alTgrko.exe
  C:\Windows\System\alTgrko.exe
  2⤵
  PID:6432
- C:\Windows\System\uWyHNVV.exe
  C:\Windows\System\uWyHNVV.exe
  2⤵
  PID:6448
- C:\Windows\System\jepQJPF.exe
  C:\Windows\System\jepQJPF.exe
  2⤵
  PID:6468
- C:\Windows\System\tgAcWki.exe
  C:\Windows\System\tgAcWki.exe
  2⤵
  PID:6484
- C:\Windows\System\obpBcEq.exe
  C:\Windows\System\obpBcEq.exe
  2⤵
  PID:6500
- C:\Windows\System\ZUyEEiU.exe
  C:\Windows\System\ZUyEEiU.exe
  2⤵
  PID:6516
- C:\Windows\System\wIlRbdZ.exe
  C:\Windows\System\wIlRbdZ.exe
  2⤵
  PID:6536
- C:\Windows\System\jgkCWqk.exe
  C:\Windows\System\jgkCWqk.exe
  2⤵
  PID:6556
- C:\Windows\System\yPqZzse.exe
  C:\Windows\System\yPqZzse.exe
  2⤵
  PID:6572
- C:\Windows\System\GuTevzz.exe
  C:\Windows\System\GuTevzz.exe
  2⤵
  PID:6588
- C:\Windows\System\XnnqalR.exe
  C:\Windows\System\XnnqalR.exe
  2⤵
  PID:6604
- C:\Windows\System\ILURICH.exe
  C:\Windows\System\ILURICH.exe
  2⤵
  PID:6620
- C:\Windows\System\cyljKoL.exe
  C:\Windows\System\cyljKoL.exe
  2⤵
  PID:6636
- C:\Windows\System\lgZnMBc.exe
  C:\Windows\System\lgZnMBc.exe
  2⤵
  PID:6652
- C:\Windows\System\RokqYHf.exe
  C:\Windows\System\RokqYHf.exe
  2⤵
  PID:6668
- C:\Windows\System\LaVKMiK.exe
  C:\Windows\System\LaVKMiK.exe
  2⤵
  PID:6684
- C:\Windows\System\zYjCLoZ.exe
  C:\Windows\System\zYjCLoZ.exe
  2⤵
  PID:6704
- C:\Windows\System\SEjbSLc.exe
  C:\Windows\System\SEjbSLc.exe
  2⤵
  PID:6720
- C:\Windows\System\pPcqrhx.exe
  C:\Windows\System\pPcqrhx.exe
  2⤵
  PID:6736
- C:\Windows\System\RiAXkQT.exe
  C:\Windows\System\RiAXkQT.exe
  2⤵
  PID:6752
- C:\Windows\System\RjbcWTK.exe
  C:\Windows\System\RjbcWTK.exe
  2⤵
  PID:6768
- C:\Windows\System\FxfMfSG.exe
  C:\Windows\System\FxfMfSG.exe
  2⤵
  PID:6784
- C:\Windows\System\YqKFcpz.exe
  C:\Windows\System\YqKFcpz.exe
  2⤵
  PID:6800
- C:\Windows\System\RRZahKG.exe
  C:\Windows\System\RRZahKG.exe
  2⤵
  PID:6816
- C:\Windows\System\hYJzYRA.exe
  C:\Windows\System\hYJzYRA.exe
  2⤵
  PID:6832
- C:\Windows\System\ZbbLEoL.exe
  C:\Windows\System\ZbbLEoL.exe
  2⤵
  PID:6848
- C:\Windows\System\cvniMMn.exe
  C:\Windows\System\cvniMMn.exe
  2⤵
  PID:6864
- C:\Windows\System\UudPXjM.exe
  C:\Windows\System\UudPXjM.exe
  2⤵
  PID:6880
- C:\Windows\System\KGGFstC.exe
  C:\Windows\System\KGGFstC.exe
  2⤵
  PID:6904
- C:\Windows\System\XuGTPyO.exe
  C:\Windows\System\XuGTPyO.exe
  2⤵
  PID:6924
- C:\Windows\System\VpoQxTR.exe
  C:\Windows\System\VpoQxTR.exe
  2⤵
  PID:6940
- C:\Windows\System\AsCGyOo.exe
  C:\Windows\System\AsCGyOo.exe
  2⤵
  PID:6956
- C:\Windows\System\dgloHnb.exe
  C:\Windows\System\dgloHnb.exe
  2⤵
  PID:6972
- C:\Windows\System\axuvbBH.exe
  C:\Windows\System\axuvbBH.exe
  2⤵
  PID:6988
- C:\Windows\System\anPBsYM.exe
  C:\Windows\System\anPBsYM.exe
  2⤵
  PID:7004
- C:\Windows\System\YrrIRrp.exe
  C:\Windows\System\YrrIRrp.exe
  2⤵
  PID:7020
- C:\Windows\System\EezwDEz.exe
  C:\Windows\System\EezwDEz.exe
  2⤵
  PID:7036
- C:\Windows\System\HdeaQrq.exe
  C:\Windows\System\HdeaQrq.exe
  2⤵
  PID:7052
- C:\Windows\System\TtJvGeW.exe
  C:\Windows\System\TtJvGeW.exe
  2⤵
  PID:7072
- C:\Windows\System\MPZktev.exe
  C:\Windows\System\MPZktev.exe
  2⤵
  PID:7088
- C:\Windows\System\cRyaweF.exe
  C:\Windows\System\cRyaweF.exe
  2⤵
  PID:7104
- C:\Windows\System\yPKgNQc.exe
  C:\Windows\System\yPKgNQc.exe
  2⤵
  PID:7124
- C:\Windows\System\PmHinFU.exe
  C:\Windows\System\PmHinFU.exe
  2⤵
  PID:7148
- C:\Windows\System\NZPlgTi.exe
  C:\Windows\System\NZPlgTi.exe
  2⤵
  PID:7164
- C:\Windows\System\EHDmkAj.exe
  C:\Windows\System\EHDmkAj.exe
  2⤵
  PID:4168
- C:\Windows\System\qyYPQQz.exe
  C:\Windows\System\qyYPQQz.exe
  2⤵
  PID:6196
- C:\Windows\System\UphASLt.exe
  C:\Windows\System\UphASLt.exe
  2⤵
  PID:6200
- C:\Windows\System\reuyCMS.exe
  C:\Windows\System\reuyCMS.exe
  2⤵
  PID:6216
- C:\Windows\System\DuscDnO.exe
  C:\Windows\System\DuscDnO.exe
  2⤵
  PID:6264
- C:\Windows\System\rjbqLki.exe
  C:\Windows\System\rjbqLki.exe
  2⤵
  PID:6280
- C:\Windows\System\xGoDBRx.exe
  C:\Windows\System\xGoDBRx.exe
  2⤵
  PID:6348
- C:\Windows\System\TlJeAUM.exe
  C:\Windows\System\TlJeAUM.exe
  2⤵
  PID:6412
- C:\Windows\System\WuQYDVN.exe
  C:\Windows\System\WuQYDVN.exe
  2⤵
  PID:6508
- C:\Windows\System\gZWvDwb.exe
  C:\Windows\System\gZWvDwb.exe
  2⤵
  PID:6444
- C:\Windows\System\PLVzhvP.exe
  C:\Windows\System\PLVzhvP.exe
  2⤵
  PID:6648
- C:\Windows\System\zKnhaFS.exe
  C:\Windows\System\zKnhaFS.exe
  2⤵
  PID:6612
- C:\Windows\System\bRJJuQf.exe
  C:\Windows\System\bRJJuQf.exe
  2⤵
  PID:6780
- C:\Windows\System\EkcJbJp.exe
  C:\Windows\System\EkcJbJp.exe
  2⤵
  PID:6744
- C:\Windows\System\VTRUAxQ.exe
  C:\Windows\System\VTRUAxQ.exe
  2⤵
  PID:6840
- C:\Windows\System\kSvgVCi.exe
  C:\Windows\System\kSvgVCi.exe
  2⤵
  PID:6732
- C:\Windows\System\hYuTfIc.exe
  C:\Windows\System\hYuTfIc.exe
  2⤵
  PID:6332
- C:\Windows\System\AoCPaHy.exe
  C:\Windows\System\AoCPaHy.exe
  2⤵
  PID:6424
- C:\Windows\System\byGRUod.exe
  C:\Windows\System\byGRUod.exe
  2⤵
  PID:6492
- C:\Windows\System\DPOfWPt.exe
  C:\Windows\System\DPOfWPt.exe
  2⤵
  PID:6532
- C:\Windows\System\GFuOnyB.exe
  C:\Windows\System\GFuOnyB.exe
  2⤵
  PID:6600
- C:\Windows\System\DkBWDzI.exe
  C:\Windows\System\DkBWDzI.exe
  2⤵
  PID:6692
- C:\Windows\System\MyVUuFv.exe
  C:\Windows\System\MyVUuFv.exe
  2⤵
  PID:6760
- C:\Windows\System\ZuawbgN.exe
  C:\Windows\System\ZuawbgN.exe
  2⤵
  PID:6828
- C:\Windows\System\PKSkdmr.exe
  C:\Windows\System\PKSkdmr.exe
  2⤵
  PID:6952
- C:\Windows\System\HvLRPNt.exe
  C:\Windows\System\HvLRPNt.exe
  2⤵
  PID:7016
- C:\Windows\System\cOlxDlT.exe
  C:\Windows\System\cOlxDlT.exe
  2⤵
  PID:7084
- C:\Windows\System\wHdZCtu.exe
  C:\Windows\System\wHdZCtu.exe
  2⤵
  PID:7156
- C:\Windows\System\fMJxqsj.exe
  C:\Windows\System\fMJxqsj.exe
  2⤵
  PID:6244
- C:\Windows\System\PLHFfVr.exe
  C:\Windows\System\PLHFfVr.exe
  2⤵
  PID:6548
- C:\Windows\System\KQskrZc.exe
  C:\Windows\System\KQskrZc.exe
  2⤵
  PID:6584
- C:\Windows\System\xjniMes.exe
  C:\Windows\System\xjniMes.exe
  2⤵
  PID:6876
- C:\Windows\System\migCvNv.exe
  C:\Windows\System\migCvNv.exe
  2⤵
  PID:4280
- C:\Windows\System\rcEsByJ.exe
  C:\Windows\System\rcEsByJ.exe
  2⤵
  PID:6632
- C:\Windows\System\NvZCkNE.exe
  C:\Windows\System\NvZCkNE.exe
  2⤵
  PID:6900
- C:\Windows\System\SZvtoWw.exe
  C:\Windows\System\SZvtoWw.exe
  2⤵
  PID:7140
- C:\Windows\System\ggxxsBR.exe
  C:\Windows\System\ggxxsBR.exe
  2⤵
  PID:6728
- C:\Windows\System\AAAYNSh.exe
  C:\Windows\System\AAAYNSh.exe
  2⤵
  PID:7000
- C:\Windows\System\hlNlYTz.exe
  C:\Windows\System\hlNlYTz.exe
  2⤵
  PID:7064
- C:\Windows\System\FOPsZgU.exe
  C:\Windows\System\FOPsZgU.exe
  2⤵
  PID:7132
- C:\Windows\System\qkGrBjP.exe
  C:\Windows\System\qkGrBjP.exe
  2⤵
  PID:6228
- C:\Windows\System\QpOyssy.exe
  C:\Windows\System\QpOyssy.exe
  2⤵
  PID:6312
- C:\Windows\System\CVlKbUO.exe
  C:\Windows\System\CVlKbUO.exe
  2⤵
  PID:6580
- C:\Windows\System\xSHQhtR.exe
  C:\Windows\System\xSHQhtR.exe
  2⤵
  PID:6776
- C:\Windows\System\HgdCQov.exe
  C:\Windows\System\HgdCQov.exe
  2⤵
  PID:6460
- C:\Windows\System\qZwMtlI.exe
  C:\Windows\System\qZwMtlI.exe
  2⤵
  PID:6700
- C:\Windows\System\zLivCSw.exe
  C:\Windows\System\zLivCSw.exe
  2⤵
  PID:6916
- C:\Windows\System\axLtULb.exe
  C:\Windows\System\axLtULb.exe
  2⤵
  PID:7012
- C:\Windows\System\wUTimrA.exe
  C:\Windows\System\wUTimrA.exe
  2⤵
  PID:6148
- C:\Windows\System\AxHRVIA.exe
  C:\Windows\System\AxHRVIA.exe
  2⤵
  PID:6296
- C:\Windows\System\thHhtlj.exe
  C:\Windows\System\thHhtlj.exe
  2⤵
  PID:6680
- C:\Windows\System\TqQpjvc.exe
  C:\Windows\System\TqQpjvc.exe
  2⤵
  PID:6824
- C:\Windows\System\RvnekFT.exe
  C:\Windows\System\RvnekFT.exe
  2⤵
  PID:7060
- C:\Windows\System\lxLUpeo.exe
  C:\Windows\System\lxLUpeo.exe
  2⤵
  PID:6552
- C:\Windows\System\reGRGWd.exe
  C:\Windows\System\reGRGWd.exe
  2⤵
  PID:6184
- C:\Windows\System\VVdsBZK.exe
  C:\Windows\System\VVdsBZK.exe
  2⤵
  PID:6456
- C:\Windows\System\lZUoKuw.exe
  C:\Windows\System\lZUoKuw.exe
  2⤵
  PID:7096
- C:\Windows\System\hHCCMSw.exe
  C:\Windows\System\hHCCMSw.exe
  2⤵
  PID:6984
- C:\Windows\System\qtnDatj.exe
  C:\Windows\System\qtnDatj.exe
  2⤵
  PID:7120
- C:\Windows\System\qFBzSQY.exe
  C:\Windows\System\qFBzSQY.exe
  2⤵
  PID:6396
- C:\Windows\System\YPqMeZz.exe
  C:\Windows\System\YPqMeZz.exe
  2⤵
  PID:6464
- C:\Windows\System\BQyobPg.exe
  C:\Windows\System\BQyobPg.exe
  2⤵
  PID:6596
- C:\Windows\System\AohFgPV.exe
  C:\Windows\System\AohFgPV.exe
  2⤵
  PID:7136
- C:\Windows\System\tfIocyK.exe
  C:\Windows\System\tfIocyK.exe
  2⤵
  PID:7100
- C:\Windows\System\NBMsBYS.exe
  C:\Windows\System\NBMsBYS.exe
  2⤵
  PID:6892
- C:\Windows\System\VOoecSp.exe
  C:\Windows\System\VOoecSp.exe
  2⤵
  PID:6164
- C:\Windows\System\WoWEouX.exe
  C:\Windows\System\WoWEouX.exe
  2⤵
  PID:6948
- C:\Windows\System\sGYPlVC.exe
  C:\Windows\System\sGYPlVC.exe
  2⤵
  PID:6716
- C:\Windows\System\xSgTywR.exe
  C:\Windows\System\xSgTywR.exe
  2⤵
  PID:7180
- C:\Windows\System\ceaqDqV.exe
  C:\Windows\System\ceaqDqV.exe
  2⤵
  PID:7196
- C:\Windows\System\lDverwL.exe
  C:\Windows\System\lDverwL.exe
  2⤵
  PID:7212
- C:\Windows\System\MJcYEZK.exe
  C:\Windows\System\MJcYEZK.exe
  2⤵
  PID:7228
- C:\Windows\System\MfvfdJu.exe
  C:\Windows\System\MfvfdJu.exe
  2⤵
  PID:7244
- C:\Windows\System\vskEpKT.exe
  C:\Windows\System\vskEpKT.exe
  2⤵
  PID:7260
- C:\Windows\System\JTXWxkN.exe
  C:\Windows\System\JTXWxkN.exe
  2⤵
  PID:7276
- C:\Windows\System\QGcPcwF.exe
  C:\Windows\System\QGcPcwF.exe
  2⤵
  PID:7292
- C:\Windows\System\KGyWVJP.exe
  C:\Windows\System\KGyWVJP.exe
  2⤵
  PID:7308
- C:\Windows\System\WiAiqgf.exe
  C:\Windows\System\WiAiqgf.exe
  2⤵
  PID:7324
- C:\Windows\System\SosTaRK.exe
  C:\Windows\System\SosTaRK.exe
  2⤵
  PID:7340
- C:\Windows\System\RzimqaY.exe
  C:\Windows\System\RzimqaY.exe
  2⤵
  PID:7356
- C:\Windows\System\LsBzGBy.exe
  C:\Windows\System\LsBzGBy.exe
  2⤵
  PID:7372
- C:\Windows\System\IgshnTK.exe
  C:\Windows\System\IgshnTK.exe
  2⤵
  PID:7388
- C:\Windows\System\ompequI.exe
  C:\Windows\System\ompequI.exe
  2⤵
  PID:7404
- C:\Windows\System\VSOravK.exe
  C:\Windows\System\VSOravK.exe
  2⤵
  PID:7420
- C:\Windows\System\jXfoVwS.exe
  C:\Windows\System\jXfoVwS.exe
  2⤵
  PID:7436
- C:\Windows\System\WOcGxjs.exe
  C:\Windows\System\WOcGxjs.exe
  2⤵
  PID:7452
- C:\Windows\System\FfagRvw.exe
  C:\Windows\System\FfagRvw.exe
  2⤵
  PID:7468
- C:\Windows\System\goAtxfn.exe
  C:\Windows\System\goAtxfn.exe
  2⤵
  PID:7484
- C:\Windows\System\FkCEXqO.exe
  C:\Windows\System\FkCEXqO.exe
  2⤵
  PID:7500
- C:\Windows\System\NkFVsrW.exe
  C:\Windows\System\NkFVsrW.exe
  2⤵
  PID:7516
- C:\Windows\System\aEIPonL.exe
  C:\Windows\System\aEIPonL.exe
  2⤵
  PID:7532
- C:\Windows\System\vsMnFEv.exe
  C:\Windows\System\vsMnFEv.exe
  2⤵
  PID:7548
- C:\Windows\System\tDRkTlL.exe
  C:\Windows\System\tDRkTlL.exe
  2⤵
  PID:7564
- C:\Windows\System\znjddJo.exe
  C:\Windows\System\znjddJo.exe
  2⤵
  PID:7580
- C:\Windows\System\xHeRwBq.exe
  C:\Windows\System\xHeRwBq.exe
  2⤵
  PID:7596
- C:\Windows\System\MgaXVJq.exe
  C:\Windows\System\MgaXVJq.exe
  2⤵
  PID:7612
- C:\Windows\System\uSbitUx.exe
  C:\Windows\System\uSbitUx.exe
  2⤵
  PID:7628
- C:\Windows\System\llpZtqU.exe
  C:\Windows\System\llpZtqU.exe
  2⤵
  PID:7644
- C:\Windows\System\JKjfkNW.exe
  C:\Windows\System\JKjfkNW.exe
  2⤵
  PID:7660
- C:\Windows\System\ZGSEOyB.exe
  C:\Windows\System\ZGSEOyB.exe
  2⤵
  PID:7676
- C:\Windows\System\qfhowao.exe
  C:\Windows\System\qfhowao.exe
  2⤵
  PID:7692
- C:\Windows\System\PkZyczX.exe
  C:\Windows\System\PkZyczX.exe
  2⤵
  PID:7708
- C:\Windows\System\hVzjXqR.exe
  C:\Windows\System\hVzjXqR.exe
  2⤵
  PID:7724
- C:\Windows\System\sZKjPvj.exe
  C:\Windows\System\sZKjPvj.exe
  2⤵
  PID:7740
- C:\Windows\System\yBxutUV.exe
  C:\Windows\System\yBxutUV.exe
  2⤵
  PID:7756
- C:\Windows\System\rSzTjmi.exe
  C:\Windows\System\rSzTjmi.exe
  2⤵
  PID:7772
- C:\Windows\System\LzpYrYC.exe
  C:\Windows\System\LzpYrYC.exe
  2⤵
  PID:7788
- C:\Windows\System\bpWtHBz.exe
  C:\Windows\System\bpWtHBz.exe
  2⤵
  PID:7804
- C:\Windows\System\NPPJRPB.exe
  C:\Windows\System\NPPJRPB.exe
  2⤵
  PID:7820
- C:\Windows\System\pSplCRj.exe
  C:\Windows\System\pSplCRj.exe
  2⤵
  PID:7836
- C:\Windows\System\HpyAngk.exe
  C:\Windows\System\HpyAngk.exe
  2⤵
  PID:7852
- C:\Windows\System\WoIRGyg.exe
  C:\Windows\System\WoIRGyg.exe
  2⤵
  PID:7868
- C:\Windows\System\paMpVOM.exe
  C:\Windows\System\paMpVOM.exe
  2⤵
  PID:7884
- C:\Windows\System\ymJJlPx.exe
  C:\Windows\System\ymJJlPx.exe
  2⤵
  PID:7900
- C:\Windows\System\MVtrhwy.exe
  C:\Windows\System\MVtrhwy.exe
  2⤵
  PID:7916
- C:\Windows\System\jbxbeZQ.exe
  C:\Windows\System\jbxbeZQ.exe
  2⤵
  PID:7932
- C:\Windows\System\eMzXkrI.exe
  C:\Windows\System\eMzXkrI.exe
  2⤵
  PID:7948
- C:\Windows\System\UigzcCP.exe
  C:\Windows\System\UigzcCP.exe
  2⤵
  PID:7964
- C:\Windows\System\YuyNrAS.exe
  C:\Windows\System\YuyNrAS.exe
  2⤵
  PID:7980
- C:\Windows\System\mkjqdQs.exe
  C:\Windows\System\mkjqdQs.exe
  2⤵
  PID:7996
- C:\Windows\System\sHolGPc.exe
  C:\Windows\System\sHolGPc.exe
  2⤵
  PID:8012
- C:\Windows\System\THQJfZZ.exe
  C:\Windows\System\THQJfZZ.exe
  2⤵
  PID:8028
- C:\Windows\System\HKlDrrm.exe
  C:\Windows\System\HKlDrrm.exe
  2⤵
  PID:8044
- C:\Windows\System\htnZbfi.exe
  C:\Windows\System\htnZbfi.exe
  2⤵
  PID:8060
- C:\Windows\System\AETMKQl.exe
  C:\Windows\System\AETMKQl.exe
  2⤵
  PID:8076
- C:\Windows\System\GROQvgz.exe
  C:\Windows\System\GROQvgz.exe
  2⤵
  PID:8092
- C:\Windows\System\RQoTfpJ.exe
  C:\Windows\System\RQoTfpJ.exe
  2⤵
  PID:8108
- C:\Windows\System\IyRMtvQ.exe
  C:\Windows\System\IyRMtvQ.exe
  2⤵
  PID:8124
- C:\Windows\System\RLNfjmr.exe
  C:\Windows\System\RLNfjmr.exe
  2⤵
  PID:8140
- C:\Windows\System\KFVFrFr.exe
  C:\Windows\System\KFVFrFr.exe
  2⤵
  PID:8156
- C:\Windows\System\GjTFvji.exe
  C:\Windows\System\GjTFvji.exe
  2⤵
  PID:8172
- C:\Windows\System\KQATDHG.exe
  C:\Windows\System\KQATDHG.exe
  2⤵
  PID:8188
- C:\Windows\System\bTCEfdl.exe
  C:\Windows\System\bTCEfdl.exe
  2⤵
  PID:7192
- C:\Windows\System\zUsGCem.exe
  C:\Windows\System\zUsGCem.exe
  2⤵
  PID:7236
- C:\Windows\System\xfUgsbh.exe
  C:\Windows\System\xfUgsbh.exe
  2⤵
  PID:7220
- C:\Windows\System\MMCkodm.exe
  C:\Windows\System\MMCkodm.exe
  2⤵
  PID:7284
- C:\Windows\System\BZiHDIh.exe
  C:\Windows\System\BZiHDIh.exe
  2⤵
  PID:7320
- C:\Windows\System\HsQNlsf.exe
  C:\Windows\System\HsQNlsf.exe
  2⤵
  PID:7364
- C:\Windows\System\JUQPZMM.exe
  C:\Windows\System\JUQPZMM.exe
  2⤵
  PID:7384
- C:\Windows\System\qQabokX.exe
  C:\Windows\System\qQabokX.exe
  2⤵
  PID:7396
- C:\Windows\System\SagPySz.exe
  C:\Windows\System\SagPySz.exe
  2⤵
  PID:7460
- C:\Windows\System\zfFMeUL.exe
  C:\Windows\System\zfFMeUL.exe
  2⤵
  PID:7476
- C:\Windows\System\wbFRqJc.exe
  C:\Windows\System\wbFRqJc.exe
  2⤵
  PID:7496
- C:\Windows\System\cshosAY.exe
  C:\Windows\System\cshosAY.exe
  2⤵
  PID:7556
- C:\Windows\System\XELslLR.exe
  C:\Windows\System\XELslLR.exe
  2⤵
  PID:7592
- C:\Windows\System\oOLLvEO.exe
  C:\Windows\System\oOLLvEO.exe
  2⤵
  PID:7572
- C:\Windows\System\oKHZBLk.exe
  C:\Windows\System\oKHZBLk.exe
  2⤵
  PID:7636
- C:\Windows\System\jwLDojw.exe
  C:\Windows\System\jwLDojw.exe
  2⤵
  PID:7576
- C:\Windows\System\UiCwWOa.exe
  C:\Windows\System\UiCwWOa.exe
  2⤵
  PID:7716
- C:\Windows\System\HkKDwuR.exe
  C:\Windows\System\HkKDwuR.exe
  2⤵
  PID:7752
- C:\Windows\System\GjGPQBU.exe
  C:\Windows\System\GjGPQBU.exe
  2⤵
  PID:7764
- C:\Windows\System\aHKMzcS.exe
  C:\Windows\System\aHKMzcS.exe
  2⤵
  PID:7828
- C:\Windows\System\SWpOxcS.exe
  C:\Windows\System\SWpOxcS.exe
  2⤵
  PID:7860
- C:\Windows\System\cLdMQmX.exe
  C:\Windows\System\cLdMQmX.exe
  2⤵
  PID:7928
- C:\Windows\System\fXsyFbJ.exe
  C:\Windows\System\fXsyFbJ.exe
  2⤵
  PID:7992
- C:\Windows\System\JftAHiM.exe
  C:\Windows\System\JftAHiM.exe
  2⤵
  PID:8056
- C:\Windows\System\AZbavWP.exe
  C:\Windows\System\AZbavWP.exe
  2⤵
  PID:7908
- C:\Windows\System\dIuqGvv.exe
  C:\Windows\System\dIuqGvv.exe
  2⤵
  PID:8104
- C:\Windows\System\ZPzFGSc.exe
  C:\Windows\System\ZPzFGSc.exe
  2⤵
  PID:7880
- C:\Windows\System\TltaqNn.exe
  C:\Windows\System\TltaqNn.exe
  2⤵
  PID:7972
- C:\Windows\System\pmtPMFk.exe
  C:\Windows\System\pmtPMFk.exe
  2⤵
  PID:8136
- C:\Windows\System\XpItvzU.exe
  C:\Windows\System\XpItvzU.exe
  2⤵
  PID:8132
- C:\Windows\System\ORMklHu.exe
  C:\Windows\System\ORMklHu.exe
  2⤵
  PID:8180
- C:\Windows\System\WEedbun.exe
  C:\Windows\System\WEedbun.exe
  2⤵
  PID:7252
- C:\Windows\System\hfCNbDD.exe
  C:\Windows\System\hfCNbDD.exe
  2⤵
  PID:8116
- C:\Windows\System\CZdZVqX.exe
  C:\Windows\System\CZdZVqX.exe
  2⤵
  PID:7268
- C:\Windows\System\SguNpdv.exe
  C:\Windows\System\SguNpdv.exe
  2⤵
  PID:7464
- C:\Windows\System\ZppriPj.exe
  C:\Windows\System\ZppriPj.exe
  2⤵
  PID:7304
- C:\Windows\System\lOsbhUF.exe
  C:\Windows\System\lOsbhUF.exe
  2⤵
  PID:7352
- C:\Windows\System\PyKTRsa.exe
  C:\Windows\System\PyKTRsa.exe
  2⤵
  PID:7624
- C:\Windows\System\qFsDIXQ.exe
  C:\Windows\System\qFsDIXQ.exe
  2⤵
  PID:7540
- C:\Windows\System\FLDRlhN.exe
  C:\Windows\System\FLDRlhN.exe
  2⤵
  PID:7588
- C:\Windows\System\rcWfqOX.exe
  C:\Windows\System\rcWfqOX.exe
  2⤵
  PID:7736
- C:\Windows\System\vAdosCn.exe
  C:\Windows\System\vAdosCn.exe
  2⤵
  PID:7780
- C:\Windows\System\rxjDTSL.exe
  C:\Windows\System\rxjDTSL.exe
  2⤵
  PID:8024
- C:\Windows\System\xjZbwLn.exe
  C:\Windows\System\xjZbwLn.exe
  2⤵
  PID:7960
- C:\Windows\System\AwggBQi.exe
  C:\Windows\System\AwggBQi.exe
  2⤵
  PID:7816
- C:\Windows\System\ZhpgsCD.exe
  C:\Windows\System\ZhpgsCD.exe
  2⤵
  PID:7940
- C:\Windows\System\hmaCqOj.exe
  C:\Windows\System\hmaCqOj.exe
  2⤵
  PID:8008
- C:\Windows\System\HxDUYHP.exe
  C:\Windows\System\HxDUYHP.exe
  2⤵
  PID:7412
- C:\Windows\System\sTlHSVg.exe
  C:\Windows\System\sTlHSVg.exe
  2⤵
  PID:7524
- C:\Windows\System\JqcObgj.exe
  C:\Windows\System\JqcObgj.exe
  2⤵
  PID:8152
- C:\Windows\System\WFMHjqm.exe
  C:\Windows\System\WFMHjqm.exe
  2⤵
  PID:8168
- C:\Windows\System\cClpVGM.exe
  C:\Windows\System\cClpVGM.exe
  2⤵
  PID:7208
- C:\Windows\System\mRbXvTN.exe
  C:\Windows\System\mRbXvTN.exe
  2⤵
  PID:6160
- C:\Windows\System\adqokkx.exe
  C:\Windows\System\adqokkx.exe
  2⤵
  PID:7668
- C:\Windows\System\rmtlJeT.exe
  C:\Windows\System\rmtlJeT.exe
  2⤵
  PID:7604
- C:\Windows\System\czWdRWD.exe
  C:\Windows\System\czWdRWD.exe
  2⤵
  PID:7332
- C:\Windows\System\AiCYWLH.exe
  C:\Windows\System\AiCYWLH.exe
  2⤵
  PID:7416
- C:\Windows\System\xpRarXn.exe
  C:\Windows\System\xpRarXn.exe
  2⤵
  PID:8072
- C:\Windows\System\IeBRpXg.exe
  C:\Windows\System\IeBRpXg.exe
  2⤵
  PID:8100
- C:\Windows\System\NdyeSmH.exe
  C:\Windows\System\NdyeSmH.exe
  2⤵
  PID:7924
- C:\Windows\System\vdxPmyF.exe
  C:\Windows\System\vdxPmyF.exe
  2⤵
  PID:1516
- C:\Windows\System\yhluZYo.exe
  C:\Windows\System\yhluZYo.exe
  2⤵
  PID:7492
- C:\Windows\System\FDYkGyy.exe
  C:\Windows\System\FDYkGyy.exe
  2⤵
  PID:8040
- C:\Windows\System\wEBynCd.exe
  C:\Windows\System\wEBynCd.exe
  2⤵
  PID:8208
- C:\Windows\System\OnClzyQ.exe
  C:\Windows\System\OnClzyQ.exe
  2⤵
  PID:8224
- C:\Windows\System\QGWcHJp.exe
  C:\Windows\System\QGWcHJp.exe
  2⤵
  PID:8240
- C:\Windows\System\SQuhjam.exe
  C:\Windows\System\SQuhjam.exe
  2⤵
  PID:8256
- C:\Windows\System\jQFYEaj.exe
  C:\Windows\System\jQFYEaj.exe
  2⤵
  PID:8272
- C:\Windows\System\pichxIG.exe
  C:\Windows\System\pichxIG.exe
  2⤵
  PID:8288
- C:\Windows\System\DLNwBme.exe
  C:\Windows\System\DLNwBme.exe
  2⤵
  PID:8304
- C:\Windows\System\HQJZGmx.exe
  C:\Windows\System\HQJZGmx.exe
  2⤵
  PID:8320
- C:\Windows\System\olenmkN.exe
  C:\Windows\System\olenmkN.exe
  2⤵
  PID:8336
- C:\Windows\System\fYdeSLj.exe
  C:\Windows\System\fYdeSLj.exe
  2⤵
  PID:8352
- C:\Windows\System\aNVLuHc.exe
  C:\Windows\System\aNVLuHc.exe
  2⤵
  PID:8368
- C:\Windows\System\uwkGxaK.exe
  C:\Windows\System\uwkGxaK.exe
  2⤵
  PID:8384
- C:\Windows\System\PdEQXwa.exe
  C:\Windows\System\PdEQXwa.exe
  2⤵
  PID:8400
- C:\Windows\System\ewqahwZ.exe
  C:\Windows\System\ewqahwZ.exe
  2⤵
  PID:8416
- C:\Windows\System\duYkBJF.exe
  C:\Windows\System\duYkBJF.exe
  2⤵
  PID:8432
- C:\Windows\System\nPkVMCW.exe
  C:\Windows\System\nPkVMCW.exe
  2⤵
  PID:8448
- C:\Windows\System\lnOqNPR.exe
  C:\Windows\System\lnOqNPR.exe
  2⤵
  PID:8464
- C:\Windows\System\SNWoRUG.exe
  C:\Windows\System\SNWoRUG.exe
  2⤵
  PID:8480
- C:\Windows\System\gTUJszh.exe
  C:\Windows\System\gTUJszh.exe
  2⤵
  PID:8496
- C:\Windows\System\wxHBkjp.exe
  C:\Windows\System\wxHBkjp.exe
  2⤵
  PID:8512
- C:\Windows\System\CmDTyrK.exe
  C:\Windows\System\CmDTyrK.exe
  2⤵
  PID:8528
- C:\Windows\System\tkZcPIF.exe
  C:\Windows\System\tkZcPIF.exe
  2⤵
  PID:8544
- C:\Windows\System\HUDmDtH.exe
  C:\Windows\System\HUDmDtH.exe
  2⤵
  PID:8560
- C:\Windows\System\ytKvbuk.exe
  C:\Windows\System\ytKvbuk.exe
  2⤵
  PID:8576
- C:\Windows\System\REHtnFZ.exe
  C:\Windows\System\REHtnFZ.exe
  2⤵
  PID:8592
- C:\Windows\System\PcTnWrq.exe
  C:\Windows\System\PcTnWrq.exe
  2⤵
  PID:8608
- C:\Windows\System\SVlIRzI.exe
  C:\Windows\System\SVlIRzI.exe
  2⤵
  PID:8624
- C:\Windows\System\JOccIiK.exe
  C:\Windows\System\JOccIiK.exe
  2⤵
  PID:8640
- C:\Windows\System\HGcqHzV.exe
  C:\Windows\System\HGcqHzV.exe
  2⤵
  PID:8656
- C:\Windows\System\uyvqXoZ.exe
  C:\Windows\System\uyvqXoZ.exe
  2⤵
  PID:8672
- C:\Windows\System\XfMwgoT.exe
  C:\Windows\System\XfMwgoT.exe
  2⤵
  PID:8688
- C:\Windows\System\bcsoKMz.exe
  C:\Windows\System\bcsoKMz.exe
  2⤵
  PID:8704
- C:\Windows\System\qyRyniQ.exe
  C:\Windows\System\qyRyniQ.exe
  2⤵
  PID:8720
- C:\Windows\System\oGgZMgy.exe
  C:\Windows\System\oGgZMgy.exe
  2⤵
  PID:8736
- C:\Windows\System\DxslBrN.exe
  C:\Windows\System\DxslBrN.exe
  2⤵
  PID:8752
- C:\Windows\System\fgciJwI.exe
  C:\Windows\System\fgciJwI.exe
  2⤵
  PID:8768
- C:\Windows\System\NxLPdCh.exe
  C:\Windows\System\NxLPdCh.exe
  2⤵
  PID:8784
- C:\Windows\System\GkOBWJa.exe
  C:\Windows\System\GkOBWJa.exe
  2⤵
  PID:8800
- C:\Windows\System\PAmepip.exe
  C:\Windows\System\PAmepip.exe
  2⤵
  PID:8816
- C:\Windows\System\cgHwNcE.exe
  C:\Windows\System\cgHwNcE.exe
  2⤵
  PID:8832
- C:\Windows\System\bCCYIxz.exe
  C:\Windows\System\bCCYIxz.exe
  2⤵
  PID:8848
- C:\Windows\System\OnkQJxE.exe
  C:\Windows\System\OnkQJxE.exe
  2⤵
  PID:8864
- C:\Windows\System\MOtvDWe.exe
  C:\Windows\System\MOtvDWe.exe
  2⤵
  PID:8880
- C:\Windows\System\jYCqtEr.exe
  C:\Windows\System\jYCqtEr.exe
  2⤵
  PID:8896
- C:\Windows\System\iOZxLeM.exe
  C:\Windows\System\iOZxLeM.exe
  2⤵
  PID:8912
- C:\Windows\System\jOwFtPW.exe
  C:\Windows\System\jOwFtPW.exe
  2⤵
  PID:8928
- C:\Windows\System\IOnTClU.exe
  C:\Windows\System\IOnTClU.exe
  2⤵
  PID:8944
- C:\Windows\System\pagKYqO.exe
  C:\Windows\System\pagKYqO.exe
  2⤵
  PID:8960
- C:\Windows\System\ESrwkWm.exe
  C:\Windows\System\ESrwkWm.exe
  2⤵
  PID:8976
- C:\Windows\System\zsMDbrM.exe
  C:\Windows\System\zsMDbrM.exe
  2⤵
  PID:8992
- C:\Windows\System\QnvbLrp.exe
  C:\Windows\System\QnvbLrp.exe
  2⤵
  PID:9008
- C:\Windows\System\RqAUhcr.exe
  C:\Windows\System\RqAUhcr.exe
  2⤵
  PID:9024
- C:\Windows\System\uRWZmet.exe
  C:\Windows\System\uRWZmet.exe
  2⤵
  PID:9040
- C:\Windows\System\HYGuQgw.exe
  C:\Windows\System\HYGuQgw.exe
  2⤵
  PID:9056
- C:\Windows\System\KBvaYTJ.exe
  C:\Windows\System\KBvaYTJ.exe
  2⤵
  PID:9072
- C:\Windows\System\WzOsXrJ.exe
  C:\Windows\System\WzOsXrJ.exe
  2⤵
  PID:9088
- C:\Windows\System\obAhvlz.exe
  C:\Windows\System\obAhvlz.exe
  2⤵
  PID:9104
- C:\Windows\System\WDOXoOV.exe
  C:\Windows\System\WDOXoOV.exe
  2⤵
  PID:9120
- C:\Windows\System\DuMRYgM.exe
  C:\Windows\System\DuMRYgM.exe
  2⤵
  PID:9136
- C:\Windows\System\KasCSuM.exe
  C:\Windows\System\KasCSuM.exe
  2⤵
  PID:9152
- C:\Windows\System\tcmQEAg.exe
  C:\Windows\System\tcmQEAg.exe
  2⤵
  PID:9168
- C:\Windows\System\YjNgNgp.exe
  C:\Windows\System\YjNgNgp.exe
  2⤵
  PID:9184
- C:\Windows\System\kEuCVzt.exe
  C:\Windows\System\kEuCVzt.exe
  2⤵
  PID:9200
- C:\Windows\System\fyInNkI.exe
  C:\Windows\System\fyInNkI.exe
  2⤵
  PID:7784
- C:\Windows\System\MeUIeMk.exe
  C:\Windows\System\MeUIeMk.exe
  2⤵
  PID:8220
- C:\Windows\System\OwstBAK.exe
  C:\Windows\System\OwstBAK.exe
  2⤵
  PID:8204
- C:\Windows\System\FdMLQNi.exe
  C:\Windows\System\FdMLQNi.exe
  2⤵
  PID:8252
- C:\Windows\System\EEiqlBn.exe
  C:\Windows\System\EEiqlBn.exe
  2⤵
  PID:8328
- C:\Windows\System\UMHleGx.exe
  C:\Windows\System\UMHleGx.exe
  2⤵
  PID:8392
- C:\Windows\System\TPaHhLA.exe
  C:\Windows\System\TPaHhLA.exe
  2⤵
  PID:8456
- C:\Windows\System\wAMHuMh.exe
  C:\Windows\System\wAMHuMh.exe
  2⤵
  PID:8520
- C:\Windows\System\BZBMcWI.exe
  C:\Windows\System\BZBMcWI.exe
  2⤵
  PID:8552
- C:\Windows\System\PvUiTMa.exe
  C:\Windows\System\PvUiTMa.exe
  2⤵
  PID:8280
- C:\Windows\System\ZdHJMcC.exe
  C:\Windows\System\ZdHJMcC.exe
  2⤵
  PID:8344
- C:\Windows\System\IHtzLwH.exe
  C:\Windows\System\IHtzLwH.exe
  2⤵
  PID:8408
- C:\Windows\System\xkofKuH.exe
  C:\Windows\System\xkofKuH.exe
  2⤵
  PID:8616
- C:\Windows\System\juSVSGZ.exe
  C:\Windows\System\juSVSGZ.exe
  2⤵
  PID:8540
- C:\Windows\System\jZjtNWn.exe
  C:\Windows\System\jZjtNWn.exe
  2⤵
  PID:8648
- C:\Windows\System\DEypaiz.exe
  C:\Windows\System\DEypaiz.exe
  2⤵
  PID:8604
- C:\Windows\System\snJGETR.exe
  C:\Windows\System\snJGETR.exe
  2⤵
  PID:8684
- C:\Windows\System\JleYBXW.exe
  C:\Windows\System\JleYBXW.exe
  2⤵
  PID:8716
- C:\Windows\System\hVAnneh.exe
  C:\Windows\System\hVAnneh.exe
  2⤵
  PID:8776
- C:\Windows\System\nqVQQKK.exe
  C:\Windows\System\nqVQQKK.exe
  2⤵
  PID:8732
- C:\Windows\System\zVZyotw.exe
  C:\Windows\System\zVZyotw.exe
  2⤵
  PID:8764
- C:\Windows\System\RZswuIE.exe
  C:\Windows\System\RZswuIE.exe
  2⤵
  PID:8828
- C:\Windows\System\brsgHKU.exe
  C:\Windows\System\brsgHKU.exe
  2⤵
  PID:8904
- C:\Windows\System\zkOUVFr.exe
  C:\Windows\System\zkOUVFr.exe
  2⤵
  PID:8972
- C:\Windows\System\sMxkGaJ.exe
  C:\Windows\System\sMxkGaJ.exe
  2⤵
  PID:9036
- C:\Windows\System\hnvESMx.exe
  C:\Windows\System\hnvESMx.exe
  2⤵
  PID:8860
- C:\Windows\System\GewIzIm.exe
  C:\Windows\System\GewIzIm.exe
  2⤵
  PID:8924
- C:\Windows\System\ZyAQACL.exe
  C:\Windows\System\ZyAQACL.exe
  2⤵
  PID:8988
- C:\Windows\System\XrMCAGv.exe
  C:\Windows\System\XrMCAGv.exe
  2⤵
  PID:9052
- C:\Windows\System\XzmnGYB.exe
  C:\Windows\System\XzmnGYB.exe
  2⤵
  PID:9100
- C:\Windows\System\qrFVaqM.exe
  C:\Windows\System\qrFVaqM.exe
  2⤵
  PID:9160
- C:\Windows\System\beSCLxV.exe
  C:\Windows\System\beSCLxV.exe
  2⤵
  PID:9164
- C:\Windows\System\KwQkQam.exe
  C:\Windows\System\KwQkQam.exe
  2⤵
  PID:8216
- C:\Windows\System\shxhpig.exe
  C:\Windows\System\shxhpig.exe
  2⤵
  PID:9212
- C:\Windows\System\AWVRHZk.exe
  C:\Windows\System\AWVRHZk.exe
  2⤵
  PID:8300
- C:\Windows\System\eOwqTeY.exe
  C:\Windows\System\eOwqTeY.exe
  2⤵
  PID:8476
- C:\Windows\System\tTrxVMp.exe
  C:\Windows\System\tTrxVMp.exe
  2⤵
  PID:8588
- C:\Windows\System\DlFhUSt.exe
  C:\Windows\System\DlFhUSt.exe
  2⤵
  PID:8236
- C:\Windows\System\xhgwgVl.exe
  C:\Windows\System\xhgwgVl.exe
  2⤵
  PID:8700
- C:\Windows\System\VEkoMAg.exe
  C:\Windows\System\VEkoMAg.exe
  2⤵
  PID:8876
- C:\Windows\System\BvBtfrx.exe
  C:\Windows\System\BvBtfrx.exe
  2⤵
  PID:8600
- C:\Windows\System\HonvvlA.exe
  C:\Windows\System\HonvvlA.exe
  2⤵
  PID:8824
- C:\Windows\System\WpOpjod.exe
  C:\Windows\System\WpOpjod.exe
  2⤵
  PID:8508
- C:\Windows\System\jkpEqYl.exe
  C:\Windows\System\jkpEqYl.exe
  2⤵
  PID:8360
- C:\Windows\System\RIjMtre.exe
  C:\Windows\System\RIjMtre.exe
  2⤵
  PID:8812
- C:\Windows\System\eRNMGrO.exe
  C:\Windows\System\eRNMGrO.exe
  2⤵
  PID:8984
- C:\Windows\System\jwgHGxP.exe
  C:\Windows\System\jwgHGxP.exe
  2⤵
  PID:9148
- C:\Windows\System\wlKxysw.exe
  C:\Windows\System\wlKxysw.exe
  2⤵
  PID:8424
- C:\Windows\System\ESJYmgi.exe
  C:\Windows\System\ESJYmgi.exe
  2⤵
  PID:8872
- C:\Windows\System\mYcIfcc.exe
  C:\Windows\System\mYcIfcc.exe
  2⤵
  PID:8936
- C:\Windows\System\uLklGCX.exe
  C:\Windows\System\uLklGCX.exe
  2⤵
  PID:9180
- C:\Windows\System\XgHkrhV.exe
  C:\Windows\System\XgHkrhV.exe
  2⤵
  PID:9004
- C:\Windows\System\ExVNRaK.exe
  C:\Windows\System\ExVNRaK.exe
  2⤵
  PID:9020
- C:\Windows\System\mkbWccU.exe
  C:\Windows\System\mkbWccU.exe
  2⤵
  PID:7748
- C:\Windows\System\yCZipvd.exe
  C:\Windows\System\yCZipvd.exe
  2⤵
  PID:8680
- C:\Windows\System\awxvHyF.exe
  C:\Windows\System\awxvHyF.exe
  2⤵
  PID:8668
- C:\Windows\System\HcSDyzN.exe
  C:\Windows\System\HcSDyzN.exe
  2⤵
  PID:9144
- C:\Windows\System\ANCBvED.exe
  C:\Windows\System\ANCBvED.exe
  2⤵
  PID:8796
- C:\Windows\System\gKsBsdu.exe
  C:\Windows\System\gKsBsdu.exe
  2⤵
  PID:8956
- C:\Windows\System\onqdRAD.exe
  C:\Windows\System\onqdRAD.exe
  2⤵
  PID:9096
- C:\Windows\System\GgotNQb.exe
  C:\Windows\System\GgotNQb.exe
  2⤵
  PID:8492
- C:\Windows\System\ATyAbkf.exe
  C:\Windows\System\ATyAbkf.exe
  2⤵
  PID:8472
- C:\Windows\System\fJsSiZW.exe
  C:\Windows\System\fJsSiZW.exe
  2⤵
  PID:8380
- C:\Windows\System\ORZacGV.exe
  C:\Windows\System\ORZacGV.exe
  2⤵
  PID:9232
- C:\Windows\System\jqwgSnI.exe
  C:\Windows\System\jqwgSnI.exe
  2⤵
  PID:9248
- C:\Windows\System\jKhZwqS.exe
  C:\Windows\System\jKhZwqS.exe
  2⤵
  PID:9264
- C:\Windows\System\qQrAGdI.exe
  C:\Windows\System\qQrAGdI.exe
  2⤵
  PID:9280
- C:\Windows\System\LUVDGTM.exe
  C:\Windows\System\LUVDGTM.exe
  2⤵
  PID:9296
- C:\Windows\System\WBYNRQI.exe
  C:\Windows\System\WBYNRQI.exe
  2⤵
  PID:9312
- C:\Windows\System\UYdgwDO.exe
  C:\Windows\System\UYdgwDO.exe
  2⤵
  PID:9328
- C:\Windows\System\gJkrQwo.exe
  C:\Windows\System\gJkrQwo.exe
  2⤵
  PID:9344
- C:\Windows\System\pnBMfSw.exe
  C:\Windows\System\pnBMfSw.exe
  2⤵
  PID:9360
- C:\Windows\System\UaZAqUQ.exe
  C:\Windows\System\UaZAqUQ.exe
  2⤵
  PID:9376
- C:\Windows\System\jgjUDkM.exe
  C:\Windows\System\jgjUDkM.exe
  2⤵
  PID:9392
- C:\Windows\System\PrerdZx.exe
  C:\Windows\System\PrerdZx.exe
  2⤵
  PID:9408
- C:\Windows\System\RNcdUTs.exe
  C:\Windows\System\RNcdUTs.exe
  2⤵
  PID:9424
- C:\Windows\System\FhdeaDI.exe
  C:\Windows\System\FhdeaDI.exe
  2⤵
  PID:9444
- C:\Windows\System\LvwjJeq.exe
  C:\Windows\System\LvwjJeq.exe
  2⤵
  PID:9460
- C:\Windows\System\bxtWbrT.exe
  C:\Windows\System\bxtWbrT.exe
  2⤵
  PID:9476
- C:\Windows\System\ddisCHG.exe
  C:\Windows\System\ddisCHG.exe
  2⤵
  PID:9492
- C:\Windows\System\EwmkdKe.exe
  C:\Windows\System\EwmkdKe.exe
  2⤵
  PID:9508
- C:\Windows\System\cIQRfYC.exe
  C:\Windows\System\cIQRfYC.exe
  2⤵
  PID:9524
- C:\Windows\System\lbkxwlU.exe
  C:\Windows\System\lbkxwlU.exe
  2⤵
  PID:9540
- C:\Windows\System\AongpfY.exe
  C:\Windows\System\AongpfY.exe
  2⤵
  PID:9556
- C:\Windows\System\bjlyCTM.exe
  C:\Windows\System\bjlyCTM.exe
  2⤵
  PID:9572
- C:\Windows\System\WodmmbI.exe
  C:\Windows\System\WodmmbI.exe
  2⤵
  PID:9588
- C:\Windows\System\Qlelvzx.exe
  C:\Windows\System\Qlelvzx.exe
  2⤵
  PID:9604
- C:\Windows\System\slXohIT.exe
  C:\Windows\System\slXohIT.exe
  2⤵
  PID:9620
- C:\Windows\System\QnXypxk.exe
  C:\Windows\System\QnXypxk.exe
  2⤵
  PID:9636
- C:\Windows\System\iEdvLIN.exe
  C:\Windows\System\iEdvLIN.exe
  2⤵
  PID:9652
- C:\Windows\System\aejjXdg.exe
  C:\Windows\System\aejjXdg.exe
  2⤵
  PID:9668
- C:\Windows\System\UrOcLqv.exe
  C:\Windows\System\UrOcLqv.exe
  2⤵
  PID:9684
- C:\Windows\System\cyRrqbv.exe
  C:\Windows\System\cyRrqbv.exe
  2⤵
  PID:9700
- C:\Windows\System\FUsOUnu.exe
  C:\Windows\System\FUsOUnu.exe
  2⤵
  PID:9720
- C:\Windows\System\tLamXRE.exe
  C:\Windows\System\tLamXRE.exe
  2⤵
  PID:9736
- C:\Windows\System\jQJzpiM.exe
  C:\Windows\System\jQJzpiM.exe
  2⤵
  PID:9752
- C:\Windows\System\HTUBXrO.exe
  C:\Windows\System\HTUBXrO.exe
  2⤵
  PID:9768
- C:\Windows\System\uGGQmPp.exe
  C:\Windows\System\uGGQmPp.exe
  2⤵
  PID:9784
- C:\Windows\System\lZTYObC.exe
  C:\Windows\System\lZTYObC.exe
  2⤵
  PID:9800
- C:\Windows\System\EXzZVgx.exe
  C:\Windows\System\EXzZVgx.exe
  2⤵
  PID:9816
- C:\Windows\System\wjLMuXB.exe
  C:\Windows\System\wjLMuXB.exe
  2⤵
  PID:9832
- C:\Windows\System\BpOgkhW.exe
  C:\Windows\System\BpOgkhW.exe
  2⤵
  PID:9848
- C:\Windows\System\IzaAObu.exe
  C:\Windows\System\IzaAObu.exe
  2⤵
  PID:9864
- C:\Windows\System\yGbVyKW.exe
  C:\Windows\System\yGbVyKW.exe
  2⤵
  PID:9880
- C:\Windows\System\caDAlcA.exe
  C:\Windows\System\caDAlcA.exe
  2⤵
  PID:9896
- C:\Windows\System\fYtQoFZ.exe
  C:\Windows\System\fYtQoFZ.exe
  2⤵
  PID:9912
- C:\Windows\System\uYHYPXa.exe
  C:\Windows\System\uYHYPXa.exe
  2⤵
  PID:9928
- C:\Windows\System\VqIaSsX.exe
  C:\Windows\System\VqIaSsX.exe
  2⤵
  PID:9944
- C:\Windows\System\rTCtZqM.exe
  C:\Windows\System\rTCtZqM.exe
  2⤵
  PID:9960
- C:\Windows\System\RUplvSt.exe
  C:\Windows\System\RUplvSt.exe
  2⤵
  PID:9976
- C:\Windows\System\rPDmnNx.exe
  C:\Windows\System\rPDmnNx.exe
  2⤵
  PID:9992
- C:\Windows\System\tHrWZPw.exe
  C:\Windows\System\tHrWZPw.exe
  2⤵
  PID:10008
- C:\Windows\System\pvhOYgc.exe
  C:\Windows\System\pvhOYgc.exe
  2⤵
  PID:10024
- C:\Windows\System\oJnCVqi.exe
  C:\Windows\System\oJnCVqi.exe
  2⤵
  PID:10040
- C:\Windows\System\NNHXQwe.exe
  C:\Windows\System\NNHXQwe.exe
  2⤵
  PID:10056
- C:\Windows\System\TUdDpFf.exe
  C:\Windows\System\TUdDpFf.exe
  2⤵
  PID:10072
- C:\Windows\System\EqQZlMu.exe
  C:\Windows\System\EqQZlMu.exe
  2⤵
  PID:10088
- C:\Windows\System\xfPViJl.exe
  C:\Windows\System\xfPViJl.exe
  2⤵
  PID:10104
- C:\Windows\System\sNvYQdb.exe
  C:\Windows\System\sNvYQdb.exe
  2⤵
  PID:10120
- C:\Windows\System\jklbVeQ.exe
  C:\Windows\System\jklbVeQ.exe
  2⤵
  PID:10136
- C:\Windows\System\flCwqlO.exe
  C:\Windows\System\flCwqlO.exe
  2⤵
  PID:10152
- C:\Windows\System\BlDzGbP.exe
  C:\Windows\System\BlDzGbP.exe
  2⤵
  PID:10168
- C:\Windows\System\KbcafwW.exe
  C:\Windows\System\KbcafwW.exe
  2⤵
  PID:10184
- C:\Windows\System\cMMKvxY.exe
  C:\Windows\System\cMMKvxY.exe
  2⤵
  PID:10200
- C:\Windows\System\OwmEHLd.exe
  C:\Windows\System\OwmEHLd.exe
  2⤵
  PID:10216
- C:\Windows\System\SHehONH.exe
  C:\Windows\System\SHehONH.exe
  2⤵
  PID:10232
- C:\Windows\System\RQLFafR.exe
  C:\Windows\System\RQLFafR.exe
  2⤵
  PID:9224
- C:\Windows\System\FMZIldF.exe
  C:\Windows\System\FMZIldF.exe
  2⤵
  PID:9128
- C:\Windows\System\iJkKPFp.exe
  C:\Windows\System\iJkKPFp.exe
  2⤵
  PID:9340
- C:\Windows\System\IssqUlU.exe
  C:\Windows\System\IssqUlU.exe
  2⤵
  PID:9244
- C:\Windows\System\jGgbuzG.exe
  C:\Windows\System\jGgbuzG.exe
  2⤵
  PID:8296
- C:\Windows\System\BTCgIwE.exe
  C:\Windows\System\BTCgIwE.exe
  2⤵
  PID:9240
- C:\Windows\System\ZlHHskg.exe
  C:\Windows\System\ZlHHskg.exe
  2⤵
  PID:9384
- C:\Windows\System\aYSjKLo.exe
  C:\Windows\System\aYSjKLo.exe
  2⤵
  PID:9320
- C:\Windows\System\wblTxDG.exe
  C:\Windows\System\wblTxDG.exe
  2⤵
  PID:9436
- C:\Windows\System\sMfhqlq.exe
  C:\Windows\System\sMfhqlq.exe
  2⤵
  PID:9488
- C:\Windows\System\HjZBMkq.exe
  C:\Windows\System\HjZBMkq.exe
  2⤵
  PID:9548
- C:\Windows\System\jvoVFcw.exe
  C:\Windows\System\jvoVFcw.exe
  2⤵
  PID:9612
- C:\Windows\System\FXzAdWw.exe
  C:\Windows\System\FXzAdWw.exe
  2⤵
  PID:9676
- C:\Windows\System\ojXjSMy.exe
  C:\Windows\System\ojXjSMy.exe
  2⤵
  PID:9744
- C:\Windows\System\Ztthxfs.exe
  C:\Windows\System\Ztthxfs.exe
  2⤵
  PID:9808
- C:\Windows\System\lIJyewE.exe
  C:\Windows\System\lIJyewE.exe
  2⤵
  PID:9872
- C:\Windows\System\uCybISh.exe
  C:\Windows\System\uCybISh.exe
  2⤵
  PID:9936
- C:\Windows\System\MEkywQM.exe
  C:\Windows\System\MEkywQM.exe
  2⤵
  PID:9972
- C:\Windows\System\bcHfKTh.exe
  C:\Windows\System\bcHfKTh.exe
  2⤵
  PID:10036
- C:\Windows\System\ZmAtwYC.exe
  C:\Windows\System\ZmAtwYC.exe
  2⤵
  PID:10064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AojQPlh.exe

Filesize
1.8MB

MD5
1df830a70d926064605851f91014147d

SHA1
0560afbfbf32ddf921b3b95edb2aa599c1307b57

SHA256
753b33a4c4a8acf3371308ae0dd46f40eb402f5aa0a626b078a64de64018553f

SHA512
3631e294ab8fed7808074e1eba7d005a6f12553c6b3e08cabd61f052552847303222cda5b1b8585fbbd839392eb0e9d929c86dd5c0009ec1006600da56a6d3b0

Download Submit
C:\Windows\system\FnYQbZC.exe

Filesize
1.8MB

MD5
008727fa3dbf06f9d2264e5e56c833eb

SHA1
a175524e63df650204153540b73fa7a04cd68f31

SHA256
a0396b4a97ae362d0425561881b79f1401bd58c690955d3e6ba31ba69b3b0282

SHA512
e67fcbce6c6f0717268898f4075c0024fb4c1b7c6c1f49e0a45f11e5ff209bcb7177912dd910abb1ee151505a47323183900c5ab98e69831110bae5777519fc0

Download Submit
C:\Windows\system\HefNDPN.exe

Filesize
1.8MB

MD5
926d29001d478cde36b56954c1142abe

SHA1
9472eda212219a451a45588b7f06002f4bf7d8dd

SHA256
5a1fe168f2748a9acd56ad36f637436cd5db7059adb5249392c171ee95229b30

SHA512
9365924e9830392d87b7d77a979f27a1a8f66895e183f0378d34b85b46c1a44f77254e3f30f62217b2de295062e813113fd136b913acd54c3f60b7e9416b39ab

Download Submit
C:\Windows\system\JZBKbuq.exe

Filesize
1.8MB

MD5
c2897259369b079d9c82dc0f16296b36

SHA1
29b7d08b05200f4bea1a85059597e4fbb701c058

SHA256
ee7df1a3ce128dd227a8e727db5f0434d8243da07286e1836c58aed55dae3ad9

SHA512
67bc33ee7a3352085a264a203ac5c823fe203c9eca693f8e8a1fe707f8b018ba9aa9a5e8f371703365a6c4b0e1ab2c599e4b8581d740fd72992ad860ad7ae0d4

Download Submit
C:\Windows\system\LaAAyfd.exe

Filesize
1.8MB

MD5
033da7c434a96e4107f652e5f4f38c97

SHA1
0cd39ef482795c44d0b6b3f35497f0c670fee326

SHA256
057d4e03458f9efaad9c00fe7aee0e21abe5687ff5cc8c65ae996a996a1649d5

SHA512
f9d109fbe65bdfce549682220c52653ffdb01fcece0dc50b2e3c1721380519127b70e9b49987e780654f05b6e85e307c865933565aa3f4db3c3fa90d9d301ff6

Download Submit
C:\Windows\system\MSCAjpY.exe

Filesize
1.8MB

MD5
b4f8a76ca8019c4e0d3ced9987854762

SHA1
d42a18a84ea9302c6de1402c76ee28daf5155b92

SHA256
d2fa0327821a5987112ec7d6be029430e448429d46780269bf1cfc6ff26d49e1

SHA512
ebbfdc176879908876b434b83e9239f8c49083fff063d08e1f63cf97d2573503cd8c91df0e4e14ba728c87f7c39b2b5590b9b45c7c4950ee3a7940cc1fc2b67b

Download Submit
C:\Windows\system\NwQYmfA.exe

Filesize
1.8MB

MD5
479348717d7bc0841d9eca9d57ced393

SHA1
26000162564ed19e575ad8f314dc39c53f91903a

SHA256
64604c750d94187c9520a374b312cdf27a2d0e07a2f9868847d0709298651a08

SHA512
5c6e621ed7ce1cd93e44a8a1a30a430dc99519710280c2a2a10477482068eb7e70ae78fab9bf03164862d630d8283a66665fd5ace122f4d26bd45ebb7af39a7e

Download Submit
C:\Windows\system\PcRpSeN.exe

Filesize
1.8MB

MD5
b259531af98d2e5e7b18ce7e86c9333e

SHA1
135f9293968d04e451592da01d6cda3301d537ec

SHA256
190f8fb5f2ca3064e90d1ae9357fb1a62542fc736d9dbf415944f1f25c25be16

SHA512
856b78a6dc34849b227bb28d6d0e66f5e1bc885f4c6c5c2bc7f52af14f836cc64358941b8c1e61f2d533596f9e3ae6536b9c6469ee8fd6d54896e97c6ddd3085

Download Submit
C:\Windows\system\QNtspMQ.exe

Filesize
1.8MB

MD5
3ff19806fb0b2b75b9fb5b7611812396

SHA1
e10eab5e03905cd840816047151003ec5069646f

SHA256
4caa77ff78eafcdaa9369b2a7cdd3ae294eb0891d6bcbf081038f1aa4eea5ef2

SHA512
e47e91e70492267f55ae7a8a964dea85aa2de7fe9020e7db55cda5fccdf74f5fd0ff7586eeccf17486f019cb0cc25839f66d9059fa1fe4ed5089fd5cd4a79e29

Download Submit
C:\Windows\system\RbiLyBx.exe

Filesize
1.8MB

MD5
78499037bed248b55b9d6b6891fcac40

SHA1
ce1bb399d896e692aac5c396eecdfd1777e7bcbd

SHA256
4076b9b6d20064c4d9bec3dec2fef1f70e078b895eb986c69ef981ba873c47cc

SHA512
ad225f7955de2361ec48bda5235a5dd2f3d3078e906f0028d6bc8331575e0285f4ecd2f71ef1a96bd1166d368c002025ab50b197ced30774c854a16e82d523a5

Download Submit
C:\Windows\system\RrBSCYD.exe

Filesize
1.8MB

MD5
50a0555653561f9a92c579225038f688

SHA1
117512d2c18eff606e1a7b7c408df9421783f96f

SHA256
bc2c814c542a136bc96af91afab14e4946fbc4762e0371792e7259fa9b5355e7

SHA512
bdd95c68bbd89e95e1ac0fd45ec7190d848db49f7333040050e6a50269984d0f73204e62fad847652229caf07dc41e60c26edce45a66b0e66571135a8f01da73

Download Submit
C:\Windows\system\RvNMiVi.exe

Filesize
1.8MB

MD5
3e87d5077e94d8e0c26027674bf0939e

SHA1
3df7d6add0cf55dbbe0d7fde88f9d64288059f8d

SHA256
354d129f68af1b8a0e0975f803b9e38e7305e2130b4ad5b2103468d17d7d9f3f

SHA512
d70bb1d238b77a35f826c708041d614926a1de30025d99d025b589fc6f7c251435b459e0390b1c57da418a22f3d5e81160724ab8e11f450f544f12a5abe9b3e1

Download Submit
C:\Windows\system\WWZSzDE.exe

Filesize
1.8MB

MD5
641b0fe44ba04a9ddd28ecbb568c4aff

SHA1
4d8c2d0ab2784ff155fb4946cee5bb9dc05bdd00

SHA256
d4256b894a08932d5b57eb3953d2f3188fc632d404032c7c4471b3fdda45b3f4

SHA512
096a12e9ba3c3ef63e7c7069e4982e0deb5a8870ab13bfa13ac301a3a7a71b3ea3f27a89ae13eefdfb0fb56a554097006da57ea77181de8cf64b6d0b1daf78e1

Download Submit
C:\Windows\system\avAwlcN.exe

Filesize
1.8MB

MD5
bc16ccd6740c7b210e15780477938b52

SHA1
31542302671a2cabe715814f94cee07e7f8dc2a1

SHA256
b33f8802e83c734c589a3fc4045f3b09066624a8ac7a2c8954d270eb17e29dcc

SHA512
cd8321519c379e16a914906b0d6d8b2fd519895dd2992300f3ebf59686c46131b3c20ef885b8a24c407264276b01c60e0105636f8c5a98627a4667a53708364c

Download Submit
C:\Windows\system\kglnITv.exe

Filesize
1.8MB

MD5
38596dbb7d36ba6873006a7af6038c56

SHA1
531e3939175d6f2e630f36e5d68e640a30037651

SHA256
b5349344abd7d3ef85090a6ac7620e80451384fc4bc91f1498d52f7bc0e6b5b9

SHA512
865d5a1224219833775f26ef3dfa7c99cb7269105d7683d116365884fec05159f38efd897552e9bd660b136924bfff4d67d01867102ba14da040f769f0299915

Download Submit
C:\Windows\system\mHETgYZ.exe

Filesize
1.8MB

MD5
6e8800b71bfd69364e507e741bb9e5fb

SHA1
52176fb59fa02a5e84ce3af61df7f881fb50d71f

SHA256
f7d2fc1e01d4fb440f9965886c8834ce00f23e753c61ca62e74be226c15a2a1f

SHA512
dfae9c42b7f1de548ffa9b58a3e54f75f61b2e078edbf64e050aa2c9e4e72570d5fa393d2f78013d40da24ffd540603fdcb487291bb509c6eb0179dc9d767b06

Download Submit
C:\Windows\system\nTnBcQB.exe

Filesize
1.8MB

MD5
e9163cbdee97fcaaf323df2a4f2b42c5

SHA1
f7418c1a0920f504d958dfcfe1bcb5073ec719f9

SHA256
0bc5a81b03ada13529a1a3361be86eff0fad1a62645f676834548fd788d99d5a

SHA512
6045f0bec55368f7e481d0881dd3d5d922d8da4be57958742d3c3e8cf454731986f25404dece253cb5795091b597d048dd5fb28acbe0587384ea803eaf5e3657

Download Submit
C:\Windows\system\teKyIpZ.exe

Filesize
1.8MB

MD5
cae6b638b9896e1cc8c5a1add5360936

SHA1
41bcd1de5be313fa08fd8fc70c9a0bc5f1e3ba4d

SHA256
6620d6f2a184e4d3ee7ccf3566cd00c2ede9b7b7daa1aa8a6c718e0c3e726a45

SHA512
d8792fbb8f63e0eef29e67b287b487889ce85d6805fb14e8541d93b9b284ff206b43191cf86171c20f2e4ce8f3d423fbb49bd9bc41759d8cb16b15e99b81eddf

Download Submit
C:\Windows\system\uTSAoYG.exe

Filesize
1.8MB

MD5
244ca517dfb52234615183359f27b7a0

SHA1
67e561af829fceabf1bfa94c93932154456dc401

SHA256
3aecab2f6420adb7066751ca72cd33718f4056886959900375f7ebcc664c580c

SHA512
00915aadcf5d0fa984300b34b4451f184eb5fc5ab64daeb1df12bd96efc040be938381f33e0ac918f05a404573e156b4f63f9540f85ab37a0be8e09954e2b3a7

Download Submit
C:\Windows\system\vIaKyai.exe

Filesize
1.8MB

MD5
d6088d052931f860bc188013d70e00e6

SHA1
a3a227b5ae8fae8eb488763939f0b72c1ff8b34f

SHA256
527a8a69c22c5bfc03c6bad53fbe691b3a009ca4048b90a0106f0d52af603ca0

SHA512
78b22817d1a8bd8db9e41874a77ad0066584f33d2e4e0e4c95d39c4d8d2037a293ca277585c5c2134c6ccc3aa3877f0eeb601ac11e308b83eebc5568ea647a54

Download Submit
C:\Windows\system\xFAuVra.exe

Filesize
1.8MB

MD5
dd3c6bbc45fd79654c48b3e2c0589d67

SHA1
d3e0ef531c8b898faa21a8667b04c60e7a319a4a

SHA256
262a326c6881c95bb7475f4a34eae8f7e31606c2977cd720c778ca25157bc4ac

SHA512
590fd0801211731592eee68ab7c88d85317e78fdb504010757cf10dc42718914cc3754bbf36b7d897db071ff64715b66fff5eb91832c77ba526a451e5cb2240e

Download Submit
C:\Windows\system\yCkDiCx.exe

Filesize
1.8MB

MD5
1a85e374e022a533297bcab466d92e5a

SHA1
fdcbe54027d6dbddb153bd0bb5c3169160f00e88

SHA256
1d71fc2a1c51fdd94b9c12f7aee18222ec08bef7280e24ad42481bc9dad03fb3

SHA512
4678c13993cd6f603be059234e342616fa2776d41bbad29536ae7a9f931dc85507835d2dfe03cd3a10f623b851b57d361bc810bc5521c1b04cfe07d7df478a52

Download Submit
C:\Windows\system\yRyHxMp.exe

Filesize
1.8MB

MD5
5055873580bf55c8a2b3f88a5dde99bc

SHA1
0fcd18eb4f2bf3856d0d31943b02e1e6a63ad1a1

SHA256
91c96367b6f3a1ddc392b6eb27c3e6a9234486869dc0a254417c0fd89927ea20

SHA512
664cd5baa9e4c290a0cc687aa83c70a50c9cd481b04746f7ce8858948832bd677a3a0c70598ab269d7196406ec58b6f36aa013daf9d643fbd5cac7471c99fbe4

Download Submit
C:\Windows\system\zyxgyfa.exe

Filesize
1.8MB

MD5
76acb2b28752b4a4f33af17b1948a301

SHA1
190a11a0b8134ab48254208ad5fef9d3453cb673

SHA256
8fe0a2f1bb702b5f14608fa9c44f02085aa209dd2743a16f4b1287e24f3d8d8d

SHA512
218a6de45318325dddcee5dacb8e000dbc841637153bfb2ed9117f6d41a78399a924cb1cd495f3dd45f29c68b29d894f972700c1e8d3da094afc0776a8febf6b

Download Submit
\Windows\system\DwJhOed.exe

Filesize
1.8MB

MD5
8d0cbe46cbc2ed88bdf036655ef593ad

SHA1
ff92ec3ec553f2c37d352c0178b22d57c5ca77a8

SHA256
09dfccedd63089286c6ac17cf8ad34c80bd6f101ba824693a604d9fe6a84a427

SHA512
3d1ea88cb92599d9a82ded917c5d593c691d79bfc9fc1d43a57d25619542c5f8788ba4d7c86bb10e7e04c4d94c9ff696cc4ebe359cc580df04677e7aafa08115

Download Submit
\Windows\system\GDmSwMm.exe

Filesize
1.8MB

MD5
4d063dd89c890fea917830a8da44fe9a

SHA1
f2dc478bffb57c548f0cfee678ce70ddcdff0858

SHA256
1909be20a9faf7b51cbfd00de1ea05cf267ca58e5a051c4e4792e673c8b04364

SHA512
792315f5362711a7d7fd8ccac95e4ac77bb6318b12573bee27761b1b5a0f5fbf6e89a83a33d414e8e7d2c07559d0332ab253a97d115c13d28eff68d64d3acbfa

Download Submit
\Windows\system\GUiMcSr.exe

Filesize
1.8MB

MD5
a898dbd5db27d1ba303eaa0e6efe2c7b

SHA1
5f6adcaa2a6dc6a6b3a945f90b09c6fcf834151c

SHA256
534ba4f849d21c61fa27400dcc11cdc2fd81b77ae53dae2da67c34f896917808

SHA512
fe3cc0f676a9c9d61bcaa50884b63f6f2df1ea316e90809cdbca92d9d03a9641584b6a2e439cb95b9558a56b6e7443c3d1189b2896c8a42f4bdd6606ee6b4398

Download Submit
\Windows\system\YPWwSDS.exe

Filesize
1.8MB

MD5
d203280219d9f42074c8cabb46e8f45b

SHA1
e365638e36c2fb9cfae9f3cf60e8bb20a1b98ab8

SHA256
64047c1604323fab5f00c74749ba4abd1e6e4b71f7579dccd8734c79506e95fb

SHA512
89100bf34f7f998610133d528a1909c8b9c564dac81581ead9db5aff41d5347110774219b7a13e5c22a64f53f311c07ca2d4312a248003c0d0d89679e88ba734

Download Submit
\Windows\system\dTxOptm.exe

Filesize
1.8MB

MD5
bdc89df4b89e3d1435af5b23ffc70326

SHA1
466734d612550be0f0dff58ca6709dfe6db0b7cf

SHA256
b487274f10a5e3656844934f29476e43e89fd69f0d0344281fbaa8218d2cfd24

SHA512
40004a0b2ff80bd0d9baebc42ed0bdf9d0cd087eed0bc9a708d5ccc4b3984aeeab7d14dfd583c966f0cd9799ff98c4b6d08caa5b983fab3f78dbdb3ab20bd6be

Download Submit
\Windows\system\dorVCyg.exe

Filesize
1.8MB

MD5
247ad4db9c7bb1f25c4476a9d7742ae5

SHA1
077a224b99f84ee4ff5583f06059ce7f836d7e9f

SHA256
e7658a9bf1e7c55c0567afcb66e5f99def915671632bb5bf3992edd0b1e97b8f

SHA512
777d9b7dbe29be33331e2600613a8b9c8d6e94217650f0a047562b7bb2586fdaf9b11b7c90a1315f2b200491fb6d42a0d321e281b01e419206fe9cd497db3dd3

Download Submit
\Windows\system\gfMjuJI.exe

Filesize
1.8MB

MD5
bfac5d13b710102b8c19fd8f91b1bb90

SHA1
b38d756b21102ae462e78e707878106336e0df97

SHA256
70f9e84edef18cef55d4a260a247ffd64abdfe70ead6e5eca94c850bbefb8831

SHA512
c9b782a8fe2bc3cc2671750436f27575d3148d753cf6d6a1038f9042dc906a3c4daded5dca4247fee3004b7db1d28ad8675a03c2f7665ae094fb4962c4673292

Download Submit
\Windows\system\mkEOZLc.exe

Filesize
1.8MB

MD5
1f6f7ccf96ae3e75307f00827d972c00

SHA1
aab3f7502c7e546d025585b9b21099e2118366aa

SHA256
65c1e6162cf1597c2b09028a0c7ee2c118a2e886fb24ea4392b52af4643be068

SHA512
a23298f457d995af35b86885796a27f999267879d29a3f9f871108b456cbb27454a4cda06d0f0836eda5b56714c3d851714df7f6a7b28efe1553b4de33b0903e

Download Submit
\Windows\system\nJgZSKS.exe

Filesize
1.8MB

MD5
16a8b2087ed50b37f2654c50c50c3f7a

SHA1
a67a9e397612a29caa7d7f5bc4aaf1a2e42657c0

SHA256
c35ba8047975445f553686ace2e689e821b894f2a034cede467dbe7c2c9a4bf2

SHA512
f3832aa7124d2e89c41db2130d5825894e251ad4975da33459c9fc45d542e7a141e81075db571583d3233c8fae47131e9b23ebec1517d69596a10bee34792dc2

Download Submit
\Windows\system\rWHlHbx.exe

Filesize
1.8MB

MD5
c6d51b31d1548911e69b083b0fe335df

SHA1
27a6c22a9560e135ffae59d34b87cb6a79cd0b93

SHA256
e676b366bccddc519f568bdff95afdec00b473a6cea9206d79a3a2fd040d0376

SHA512
f80ac34c77b2de116372d2427fd2c519b88bf2797e414618ce4712c8389d46d6ee2993c9c9e2bcff95b12cdda599011a228129a26432a0e897c7f115bf1cfbfa

Download Submit
\Windows\system\sMjXhli.exe

Filesize
1.8MB

MD5
bf4d541e805c94a2a3c95d19c6663fa1

SHA1
43ea8d1ed706a7ae53262fe048a3f51f3b12174a

SHA256
b8d8178ab76c5478e512e5db93fc5fc003396924bc0065f36e86e73d0ab1f91e

SHA512
adc06055eb8f3242547ae9a380ed60630317f2a4163b2760944bf84a4cee93e1f667d8e1e07b96dc0a4961c6fb4037c7cd235aac4a49c501c8182d5712782549

Download Submit
\Windows\system\wmIpbtf.exe

Filesize
1.8MB

MD5
f7441e33074f6997ec6a632698b46a8d

SHA1
c38acf88ea3081f60ec1cad4812a83ce15130cbd

SHA256
4f5f77ff9caf03811f30ea21b7512667dd1a5fa93979de8f1a754cf62dfd983c

SHA512
fe430d70b44c6091dc0f2d11637bffc354d92b0f4ceeed515238ef2a97c16e86855f06595a1cb5677c174275fb2b9f7caa05a1c6d26bd3f756aa69b5a0d085a6

Download Submit
memory/1204-5550-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1204-124-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2344-111-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2344-5509-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2400-125-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2400-5518-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2568-5534-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2568-113-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2632-98-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2632-5566-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2816-62-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2816-5523-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2932-126-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2932-5532-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2940-13-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/2940-14-0x000007FEF5D7E000-0x000007FEF5D7F000-memory.dmp

Filesize
4KB

Download
memory/2940-33-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2940-352-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2940-116-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2940-37-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2940-52-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2952-5571-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2952-12-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2992-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2992-123-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-112-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-121-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-120-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2992-96-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2992-122-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2992-117-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-99-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2992-0-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2992-130-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-131-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-114-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2992-132-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2992-13349-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download