xmrig | 97d51f4134e00e3169fd572e0d8f8a97973198f66313a5539ccb7e096e8aa98e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
Size

1.6MB
MD5

efb2dccd9900c62cc8de1a7cb4b93810
SHA1

bf0e6c3bbfafe30c0c8714832cf39686eb18bd6d
SHA256

97d51f4134e00e3169fd572e0d8f8a97973198f66313a5539ccb7e096e8aa98e
SHA512

0696322eab3a969611e9416adc073bf05c45c9af4a4387ecfc17afbeba049e8b549b5ecf94366e1f99de826342004429ca0f303da76a7cdf9e137bedfa9728a2
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1zPg4g2Jfelo:GemTLkNdfE0pZab

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d000000012334-2.dat	xmrig
behavioral1/files/0x002f0000000146e6-9.dat	xmrig
behavioral1/files/0x0008000000014971-8.dat	xmrig
behavioral1/files/0x0007000000014b27-18.dat	xmrig
behavioral1/files/0x0007000000014b63-24.dat	xmrig
behavioral1/files/0x0007000000014baa-28.dat	xmrig
behavioral1/files/0x0009000000014e51-35.dat	xmrig
behavioral1/files/0x0006000000015d07-49.dat	xmrig
behavioral1/files/0x0006000000015d28-54.dat	xmrig
behavioral1/files/0x0006000000015d5e-69.dat	xmrig
behavioral1/files/0x0006000000015d8f-94.dat	xmrig
behavioral1/files/0x0006000000015e3a-104.dat	xmrig
behavioral1/files/0x00060000000164b2-137.dat	xmrig
behavioral1/files/0x0006000000016a9a-159.dat	xmrig
behavioral1/files/0x0006000000016843-154.dat	xmrig
behavioral1/files/0x000600000001661c-149.dat	xmrig
behavioral1/files/0x0006000000016572-144.dat	xmrig
behavioral1/files/0x000600000001630b-134.dat	xmrig
behavioral1/files/0x0006000000016117-124.dat	xmrig
behavioral1/files/0x00060000000161e7-129.dat	xmrig
behavioral1/files/0x0006000000015f6d-114.dat	xmrig
behavioral1/files/0x0006000000015fe9-119.dat	xmrig
behavioral1/files/0x0006000000015eaf-109.dat	xmrig
behavioral1/files/0x0006000000015d9b-99.dat	xmrig
behavioral1/files/0x0006000000015d87-89.dat	xmrig
behavioral1/files/0x0006000000015d79-84.dat	xmrig
behavioral1/files/0x0006000000015d6f-79.dat	xmrig
behavioral1/files/0x0006000000015d67-74.dat	xmrig
behavioral1/files/0x0006000000015d56-64.dat	xmrig
behavioral1/files/0x0006000000015d4a-59.dat	xmrig
behavioral1/files/0x0006000000015ceb-44.dat	xmrig
behavioral1/files/0x0008000000015ce1-39.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1640	pDhBBly.exe
2884	nTnGfTl.exe
2932	PQOpxvY.exe
2276	vXFxWeA.exe
2792	DlvybiQ.exe
2652	EuwrwAm.exe
2640	cQtkjhO.exe
2576	ssJHNhd.exe
2756	fxaVNjn.exe
2624	asSckpk.exe
2688	QFcOWjS.exe
2480	TAVlFjM.exe
1748	vhNabuJ.exe
1880	UlXtDrp.exe
2880	FNrmeGp.exe
1536	ekDzrCY.exe
772	mesbZnn.exe
2700	XIMVnem.exe
2696	BYbyLiS.exe
2348	CksOtZW.exe
1672	JVKoPWE.exe
1808	ADotOpq.exe
500	EeOmvLm.exe
1012	GFUJfGS.exe
2184	PqSsZxd.exe
2100	WURiJPw.exe
2116	UHFqDlV.exe
2204	PBOSeQX.exe
2632	LOwKHPd.exe
2160	tLJMFCB.exe
540	SZywlQb.exe
1052	ScyMJyN.exe
1040	VPYGVMI.exe
1740	rXqSVrC.exe
1112	PNQtKcD.exe
1892	CjQLrVc.exe
3024	NnhGgHr.exe
644	tasvsMy.exe
452	QNMrSyR.exe
2064	iAhxFsa.exe
2068	BerTzBn.exe
1760	MCYgLJj.exe
1652	hNpzhLs.exe
1960	lhqeHtr.exe
1376	gqRRCdB.exe
1904	ugIXpPk.exe
1992	LBJIJFc.exe
312	lovEzIZ.exe
1500	DhCIOJq.exe
2852	RLhgxSM.exe
2844	YlHmYkb.exe
2004	iojKxUs.exe
1732	sgpMXYT.exe
1972	yjqNcME.exe
2072	VhchlqT.exe
2008	GBlWWsQ.exe
1756	LjQbnWp.exe
2836	sqbqRrD.exe
2268	VnLDAJi.exe
1592	geMwIKq.exe
1696	Jbmvlau.exe
2936	IEBCRwx.exe
2660	QgybmNc.exe
2168	moQpHhz.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rXqSVrC.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\dennyla.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\foQojuj.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\WKPlyXR.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\QcQCtxh.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\NFJitxV.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\FOPdZiB.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\lmljKqG.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\wGTmiHm.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\HXnCkfS.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\XvWwhpU.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\jeHsLXU.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\iusGQjT.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\diotLxm.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\kPjwkNo.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\OaJfcdG.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\ZUFOCCN.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\KDaSCze.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\brEeYqZ.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\rDwBfCR.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\SkxDiAf.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\FGjaMJO.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\FLeEYwN.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\YHnBvDS.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\igeOCgi.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\koNZMlI.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\tueVZTj.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\vZzuBSz.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\SwKHfmQ.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\gTTLxbh.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\WWzhvjH.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\xkoXGyd.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\GoMCtsS.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\bmXuSYI.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\yxSPXFc.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\UpIjASx.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\ckaaLSV.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\KKIcHnZ.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\KsfgBhO.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\bIclOpP.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\TtRRLCD.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\nTGvYwd.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\MzFXrkj.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\GnMuDte.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\XrULiQf.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\JPQRMnq.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\MyVPTXM.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\XesogRI.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\qxxzIYE.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\AbCfulK.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\pXmaPzX.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\QhlbDLW.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\UghqCxI.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\ZhFAzxr.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\tXpUMDQ.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\EYiRmLn.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\tejsvTX.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\jpZpYuA.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\PULlDmw.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\KwDXmbf.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\kxbgojb.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\ZOcMGCU.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\CjtWvWC.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
File created	C:\Windows\System\FOVOKJl.exe	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	29
PID 1688 wrote to memory of 1640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	29
PID 1688 wrote to memory of 1640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	29
PID 1688 wrote to memory of 2884	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	30
PID 1688 wrote to memory of 2884	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	30
PID 1688 wrote to memory of 2884	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	30
PID 1688 wrote to memory of 2932	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	31
PID 1688 wrote to memory of 2932	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	31
PID 1688 wrote to memory of 2932	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	31
PID 1688 wrote to memory of 2276	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	32
PID 1688 wrote to memory of 2276	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	32
PID 1688 wrote to memory of 2276	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	32
PID 1688 wrote to memory of 2792	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	33
PID 1688 wrote to memory of 2792	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	33
PID 1688 wrote to memory of 2792	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	33
PID 1688 wrote to memory of 2652	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	34
PID 1688 wrote to memory of 2652	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	34
PID 1688 wrote to memory of 2652	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	34
PID 1688 wrote to memory of 2640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	35
PID 1688 wrote to memory of 2640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	35
PID 1688 wrote to memory of 2640	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	35
PID 1688 wrote to memory of 2576	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	36
PID 1688 wrote to memory of 2576	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	36
PID 1688 wrote to memory of 2576	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	36
PID 1688 wrote to memory of 2756	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	37
PID 1688 wrote to memory of 2756	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	37
PID 1688 wrote to memory of 2756	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	37
PID 1688 wrote to memory of 2624	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	38
PID 1688 wrote to memory of 2624	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	38
PID 1688 wrote to memory of 2624	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	38
PID 1688 wrote to memory of 2688	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	39
PID 1688 wrote to memory of 2688	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	39
PID 1688 wrote to memory of 2688	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	39
PID 1688 wrote to memory of 2480	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	40
PID 1688 wrote to memory of 2480	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	40
PID 1688 wrote to memory of 2480	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	40
PID 1688 wrote to memory of 1748	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	41
PID 1688 wrote to memory of 1748	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	41
PID 1688 wrote to memory of 1748	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	41
PID 1688 wrote to memory of 1880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	42
PID 1688 wrote to memory of 1880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	42
PID 1688 wrote to memory of 1880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	42
PID 1688 wrote to memory of 2880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	43
PID 1688 wrote to memory of 2880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	43
PID 1688 wrote to memory of 2880	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	43
PID 1688 wrote to memory of 1536	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	44
PID 1688 wrote to memory of 1536	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	44
PID 1688 wrote to memory of 1536	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	44
PID 1688 wrote to memory of 772	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	45
PID 1688 wrote to memory of 772	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	45
PID 1688 wrote to memory of 772	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	45
PID 1688 wrote to memory of 2700	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	46
PID 1688 wrote to memory of 2700	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	46
PID 1688 wrote to memory of 2700	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	46
PID 1688 wrote to memory of 2696	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	47
PID 1688 wrote to memory of 2696	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	47
PID 1688 wrote to memory of 2696	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	47
PID 1688 wrote to memory of 2348	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	48
PID 1688 wrote to memory of 2348	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	48
PID 1688 wrote to memory of 2348	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	48
PID 1688 wrote to memory of 1672	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	49
PID 1688 wrote to memory of 1672	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	49
PID 1688 wrote to memory of 1672	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	49
PID 1688 wrote to memory of 1808	1688	virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe	50

C:\Users\Admin\AppData\Local\Temp\virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_efb2dccd9900c62cc8de1a7cb4b93810.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System\pDhBBly.exe
  C:\Windows\System\pDhBBly.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\nTnGfTl.exe
  C:\Windows\System\nTnGfTl.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\PQOpxvY.exe
  C:\Windows\System\PQOpxvY.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\vXFxWeA.exe
  C:\Windows\System\vXFxWeA.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\DlvybiQ.exe
  C:\Windows\System\DlvybiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\EuwrwAm.exe
  C:\Windows\System\EuwrwAm.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\cQtkjhO.exe
  C:\Windows\System\cQtkjhO.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ssJHNhd.exe
  C:\Windows\System\ssJHNhd.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\fxaVNjn.exe
  C:\Windows\System\fxaVNjn.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\asSckpk.exe
  C:\Windows\System\asSckpk.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\QFcOWjS.exe
  C:\Windows\System\QFcOWjS.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\TAVlFjM.exe
  C:\Windows\System\TAVlFjM.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\vhNabuJ.exe
  C:\Windows\System\vhNabuJ.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\UlXtDrp.exe
  C:\Windows\System\UlXtDrp.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\FNrmeGp.exe
  C:\Windows\System\FNrmeGp.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ekDzrCY.exe
  C:\Windows\System\ekDzrCY.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\mesbZnn.exe
  C:\Windows\System\mesbZnn.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\XIMVnem.exe
  C:\Windows\System\XIMVnem.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\BYbyLiS.exe
  C:\Windows\System\BYbyLiS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\CksOtZW.exe
  C:\Windows\System\CksOtZW.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\JVKoPWE.exe
  C:\Windows\System\JVKoPWE.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\ADotOpq.exe
  C:\Windows\System\ADotOpq.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\EeOmvLm.exe
  C:\Windows\System\EeOmvLm.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\GFUJfGS.exe
  C:\Windows\System\GFUJfGS.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\PqSsZxd.exe
  C:\Windows\System\PqSsZxd.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\WURiJPw.exe
  C:\Windows\System\WURiJPw.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\UHFqDlV.exe
  C:\Windows\System\UHFqDlV.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\PBOSeQX.exe
  C:\Windows\System\PBOSeQX.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\LOwKHPd.exe
  C:\Windows\System\LOwKHPd.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\tLJMFCB.exe
  C:\Windows\System\tLJMFCB.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\SZywlQb.exe
  C:\Windows\System\SZywlQb.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ScyMJyN.exe
  C:\Windows\System\ScyMJyN.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\VPYGVMI.exe
  C:\Windows\System\VPYGVMI.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\rXqSVrC.exe
  C:\Windows\System\rXqSVrC.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PNQtKcD.exe
  C:\Windows\System\PNQtKcD.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\CjQLrVc.exe
  C:\Windows\System\CjQLrVc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\NnhGgHr.exe
  C:\Windows\System\NnhGgHr.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\tasvsMy.exe
  C:\Windows\System\tasvsMy.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\QNMrSyR.exe
  C:\Windows\System\QNMrSyR.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\iAhxFsa.exe
  C:\Windows\System\iAhxFsa.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\BerTzBn.exe
  C:\Windows\System\BerTzBn.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\MCYgLJj.exe
  C:\Windows\System\MCYgLJj.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\hNpzhLs.exe
  C:\Windows\System\hNpzhLs.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\lhqeHtr.exe
  C:\Windows\System\lhqeHtr.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\gqRRCdB.exe
  C:\Windows\System\gqRRCdB.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ugIXpPk.exe
  C:\Windows\System\ugIXpPk.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\LBJIJFc.exe
  C:\Windows\System\LBJIJFc.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\lovEzIZ.exe
  C:\Windows\System\lovEzIZ.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\DhCIOJq.exe
  C:\Windows\System\DhCIOJq.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\RLhgxSM.exe
  C:\Windows\System\RLhgxSM.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\YlHmYkb.exe
  C:\Windows\System\YlHmYkb.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\iojKxUs.exe
  C:\Windows\System\iojKxUs.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\sgpMXYT.exe
  C:\Windows\System\sgpMXYT.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\yjqNcME.exe
  C:\Windows\System\yjqNcME.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\VhchlqT.exe
  C:\Windows\System\VhchlqT.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GBlWWsQ.exe
  C:\Windows\System\GBlWWsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\LjQbnWp.exe
  C:\Windows\System\LjQbnWp.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\sqbqRrD.exe
  C:\Windows\System\sqbqRrD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\VnLDAJi.exe
  C:\Windows\System\VnLDAJi.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\geMwIKq.exe
  C:\Windows\System\geMwIKq.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\Jbmvlau.exe
  C:\Windows\System\Jbmvlau.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\IEBCRwx.exe
  C:\Windows\System\IEBCRwx.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\QgybmNc.exe
  C:\Windows\System\QgybmNc.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\moQpHhz.exe
  C:\Windows\System\moQpHhz.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nyphcyq.exe
  C:\Windows\System\nyphcyq.exe
  2⤵
  PID:2612
- C:\Windows\System\kOmuvcl.exe
  C:\Windows\System\kOmuvcl.exe
  2⤵
  PID:2808
- C:\Windows\System\QmuYdqY.exe
  C:\Windows\System\QmuYdqY.exe
  2⤵
  PID:2764
- C:\Windows\System\xOtxZbE.exe
  C:\Windows\System\xOtxZbE.exe
  2⤵
  PID:2716
- C:\Windows\System\fwPQbSP.exe
  C:\Windows\System\fwPQbSP.exe
  2⤵
  PID:2468
- C:\Windows\System\sHxtZPX.exe
  C:\Windows\System\sHxtZPX.exe
  2⤵
  PID:2528
- C:\Windows\System\AhoPAeT.exe
  C:\Windows\System\AhoPAeT.exe
  2⤵
  PID:1268
- C:\Windows\System\TqrIawo.exe
  C:\Windows\System\TqrIawo.exe
  2⤵
  PID:2424
- C:\Windows\System\tACYNfk.exe
  C:\Windows\System\tACYNfk.exe
  2⤵
  PID:2520
- C:\Windows\System\XKvNqGu.exe
  C:\Windows\System\XKvNqGu.exe
  2⤵
  PID:2280
- C:\Windows\System\hkGnHfz.exe
  C:\Windows\System\hkGnHfz.exe
  2⤵
  PID:2236
- C:\Windows\System\vsYNsRK.exe
  C:\Windows\System\vsYNsRK.exe
  2⤵
  PID:1864
- C:\Windows\System\NXyScWc.exe
  C:\Windows\System\NXyScWc.exe
  2⤵
  PID:1032
- C:\Windows\System\yQvtcMg.exe
  C:\Windows\System\yQvtcMg.exe
  2⤵
  PID:2128
- C:\Windows\System\dennyla.exe
  C:\Windows\System\dennyla.exe
  2⤵
  PID:2628
- C:\Windows\System\edZgLcG.exe
  C:\Windows\System\edZgLcG.exe
  2⤵
  PID:2816
- C:\Windows\System\XGvrpEQ.exe
  C:\Windows\System\XGvrpEQ.exe
  2⤵
  PID:684
- C:\Windows\System\xnJdrBn.exe
  C:\Windows\System\xnJdrBn.exe
  2⤵
  PID:1260
- C:\Windows\System\xxqHpYV.exe
  C:\Windows\System\xxqHpYV.exe
  2⤵
  PID:604
- C:\Windows\System\dSmMvRB.exe
  C:\Windows\System\dSmMvRB.exe
  2⤵
  PID:660
- C:\Windows\System\xDOhbPK.exe
  C:\Windows\System\xDOhbPK.exe
  2⤵
  PID:2376
- C:\Windows\System\bdsDNIE.exe
  C:\Windows\System\bdsDNIE.exe
  2⤵
  PID:2400
- C:\Windows\System\bcpbPGR.exe
  C:\Windows\System\bcpbPGR.exe
  2⤵
  PID:3028
- C:\Windows\System\eMPOEHp.exe
  C:\Windows\System\eMPOEHp.exe
  2⤵
  PID:1788
- C:\Windows\System\PDKgviZ.exe
  C:\Windows\System\PDKgviZ.exe
  2⤵
  PID:1320
- C:\Windows\System\prNcTaz.exe
  C:\Windows\System\prNcTaz.exe
  2⤵
  PID:1840
- C:\Windows\System\LZqUlzP.exe
  C:\Windows\System\LZqUlzP.exe
  2⤵
  PID:3012
- C:\Windows\System\bztnLkL.exe
  C:\Windows\System\bztnLkL.exe
  2⤵
  PID:916
- C:\Windows\System\ClqmMEc.exe
  C:\Windows\System\ClqmMEc.exe
  2⤵
  PID:1800
- C:\Windows\System\bIQlkkZ.exe
  C:\Windows\System\bIQlkkZ.exe
  2⤵
  PID:1600
- C:\Windows\System\kKRseLN.exe
  C:\Windows\System\kKRseLN.exe
  2⤵
  PID:2856
- C:\Windows\System\WEgMLYK.exe
  C:\Windows\System\WEgMLYK.exe
  2⤵
  PID:2016
- C:\Windows\System\aSELMIc.exe
  C:\Windows\System\aSELMIc.exe
  2⤵
  PID:2380
- C:\Windows\System\EBSQvJI.exe
  C:\Windows\System\EBSQvJI.exe
  2⤵
  PID:2332
- C:\Windows\System\ZMQezgd.exe
  C:\Windows\System\ZMQezgd.exe
  2⤵
  PID:1588
- C:\Windows\System\vxkxKWc.exe
  C:\Windows\System\vxkxKWc.exe
  2⤵
  PID:1292
- C:\Windows\System\LnktoKq.exe
  C:\Windows\System\LnktoKq.exe
  2⤵
  PID:2556
- C:\Windows\System\dyAyuaL.exe
  C:\Windows\System\dyAyuaL.exe
  2⤵
  PID:2668
- C:\Windows\System\kqtietZ.exe
  C:\Windows\System\kqtietZ.exe
  2⤵
  PID:2504
- C:\Windows\System\tejsvTX.exe
  C:\Windows\System\tejsvTX.exe
  2⤵
  PID:2444
- C:\Windows\System\jigpgCT.exe
  C:\Windows\System\jigpgCT.exe
  2⤵
  PID:2868
- C:\Windows\System\XqcxUMY.exe
  C:\Windows\System\XqcxUMY.exe
  2⤵
  PID:2692
- C:\Windows\System\waWxtmN.exe
  C:\Windows\System\waWxtmN.exe
  2⤵
  PID:2284
- C:\Windows\System\WinGspA.exe
  C:\Windows\System\WinGspA.exe
  2⤵
  PID:1680
- C:\Windows\System\vtGzYrG.exe
  C:\Windows\System\vtGzYrG.exe
  2⤵
  PID:2272
- C:\Windows\System\VIQyHxt.exe
  C:\Windows\System\VIQyHxt.exe
  2⤵
  PID:2428
- C:\Windows\System\fNFStTa.exe
  C:\Windows\System\fNFStTa.exe
  2⤵
  PID:2144
- C:\Windows\System\UWnhOdH.exe
  C:\Windows\System\UWnhOdH.exe
  2⤵
  PID:1168
- C:\Windows\System\asFyWmP.exe
  C:\Windows\System\asFyWmP.exe
  2⤵
  PID:1832
- C:\Windows\System\riqjquy.exe
  C:\Windows\System\riqjquy.exe
  2⤵
  PID:952
- C:\Windows\System\BXbWGaz.exe
  C:\Windows\System\BXbWGaz.exe
  2⤵
  PID:3056
- C:\Windows\System\XRMWjkc.exe
  C:\Windows\System\XRMWjkc.exe
  2⤵
  PID:2656
- C:\Windows\System\GAcSKjF.exe
  C:\Windows\System\GAcSKjF.exe
  2⤵
  PID:1156
- C:\Windows\System\sDVlPvf.exe
  C:\Windows\System\sDVlPvf.exe
  2⤵
  PID:1264
- C:\Windows\System\tXJoDLx.exe
  C:\Windows\System\tXJoDLx.exe
  2⤵
  PID:2680
- C:\Windows\System\GbhewJh.exe
  C:\Windows\System\GbhewJh.exe
  2⤵
  PID:2020
- C:\Windows\System\UghqCxI.exe
  C:\Windows\System\UghqCxI.exe
  2⤵
  PID:1720
- C:\Windows\System\pkSgaod.exe
  C:\Windows\System\pkSgaod.exe
  2⤵
  PID:1568
- C:\Windows\System\OXlitWs.exe
  C:\Windows\System\OXlitWs.exe
  2⤵
  PID:2384
- C:\Windows\System\VIRVaQk.exe
  C:\Windows\System\VIRVaQk.exe
  2⤵
  PID:2308
- C:\Windows\System\ZeBKjpv.exe
  C:\Windows\System\ZeBKjpv.exe
  2⤵
  PID:1708
- C:\Windows\System\zZtBBAg.exe
  C:\Windows\System\zZtBBAg.exe
  2⤵
  PID:2220
- C:\Windows\System\qEegHgH.exe
  C:\Windows\System\qEegHgH.exe
  2⤵
  PID:2436
- C:\Windows\System\dHMWxaD.exe
  C:\Windows\System\dHMWxaD.exe
  2⤵
  PID:1060
- C:\Windows\System\HUJQcWC.exe
  C:\Windows\System\HUJQcWC.exe
  2⤵
  PID:1620
- C:\Windows\System\BYOeZOF.exe
  C:\Windows\System\BYOeZOF.exe
  2⤵
  PID:2108
- C:\Windows\System\RRrDPms.exe
  C:\Windows\System\RRrDPms.exe
  2⤵
  PID:816
- C:\Windows\System\lQJoQMo.exe
  C:\Windows\System\lQJoQMo.exe
  2⤵
  PID:1140
- C:\Windows\System\rKQLmMy.exe
  C:\Windows\System\rKQLmMy.exe
  2⤵
  PID:3080
- C:\Windows\System\zFNCakl.exe
  C:\Windows\System\zFNCakl.exe
  2⤵
  PID:3096
- C:\Windows\System\NzrCGTW.exe
  C:\Windows\System\NzrCGTW.exe
  2⤵
  PID:3120
- C:\Windows\System\FUdKZQv.exe
  C:\Windows\System\FUdKZQv.exe
  2⤵
  PID:3136
- C:\Windows\System\cQBWpmT.exe
  C:\Windows\System\cQBWpmT.exe
  2⤵
  PID:3156
- C:\Windows\System\wvqCScH.exe
  C:\Windows\System\wvqCScH.exe
  2⤵
  PID:3180
- C:\Windows\System\GbtFOUk.exe
  C:\Windows\System\GbtFOUk.exe
  2⤵
  PID:3200
- C:\Windows\System\aOeoGHl.exe
  C:\Windows\System\aOeoGHl.exe
  2⤵
  PID:3216
- C:\Windows\System\syEHWYb.exe
  C:\Windows\System\syEHWYb.exe
  2⤵
  PID:3240
- C:\Windows\System\OYNTswT.exe
  C:\Windows\System\OYNTswT.exe
  2⤵
  PID:3256
- C:\Windows\System\QJHZWvZ.exe
  C:\Windows\System\QJHZWvZ.exe
  2⤵
  PID:3280
- C:\Windows\System\GlveVHY.exe
  C:\Windows\System\GlveVHY.exe
  2⤵
  PID:3296
- C:\Windows\System\asOdGFd.exe
  C:\Windows\System\asOdGFd.exe
  2⤵
  PID:3316
- C:\Windows\System\znWRJNS.exe
  C:\Windows\System\znWRJNS.exe
  2⤵
  PID:3336
- C:\Windows\System\iXiJIDP.exe
  C:\Windows\System\iXiJIDP.exe
  2⤵
  PID:3356
- C:\Windows\System\ZuqgdNh.exe
  C:\Windows\System\ZuqgdNh.exe
  2⤵
  PID:3380
- C:\Windows\System\ReDIAdX.exe
  C:\Windows\System\ReDIAdX.exe
  2⤵
  PID:3400
- C:\Windows\System\oLLvjvE.exe
  C:\Windows\System\oLLvjvE.exe
  2⤵
  PID:3420
- C:\Windows\System\YHYBnsq.exe
  C:\Windows\System\YHYBnsq.exe
  2⤵
  PID:3440
- C:\Windows\System\dDbQbon.exe
  C:\Windows\System\dDbQbon.exe
  2⤵
  PID:3460
- C:\Windows\System\itBulTy.exe
  C:\Windows\System\itBulTy.exe
  2⤵
  PID:3480
- C:\Windows\System\wrOWPyd.exe
  C:\Windows\System\wrOWPyd.exe
  2⤵
  PID:3500
- C:\Windows\System\iWPvYCp.exe
  C:\Windows\System\iWPvYCp.exe
  2⤵
  PID:3516
- C:\Windows\System\ViruDIs.exe
  C:\Windows\System\ViruDIs.exe
  2⤵
  PID:3540
- C:\Windows\System\SkxDiAf.exe
  C:\Windows\System\SkxDiAf.exe
  2⤵
  PID:3560
- C:\Windows\System\jtvYSar.exe
  C:\Windows\System\jtvYSar.exe
  2⤵
  PID:3580
- C:\Windows\System\qaUqYGF.exe
  C:\Windows\System\qaUqYGF.exe
  2⤵
  PID:3600
- C:\Windows\System\OQDxsLP.exe
  C:\Windows\System\OQDxsLP.exe
  2⤵
  PID:3620
- C:\Windows\System\qGQAQXF.exe
  C:\Windows\System\qGQAQXF.exe
  2⤵
  PID:3640
- C:\Windows\System\ZDbLWIB.exe
  C:\Windows\System\ZDbLWIB.exe
  2⤵
  PID:3656
- C:\Windows\System\aeSweFa.exe
  C:\Windows\System\aeSweFa.exe
  2⤵
  PID:3680
- C:\Windows\System\etbZRzF.exe
  C:\Windows\System\etbZRzF.exe
  2⤵
  PID:3700
- C:\Windows\System\JgoAqLM.exe
  C:\Windows\System\JgoAqLM.exe
  2⤵
  PID:3720
- C:\Windows\System\iLsgPfu.exe
  C:\Windows\System\iLsgPfu.exe
  2⤵
  PID:3736
- C:\Windows\System\PdyXyzK.exe
  C:\Windows\System\PdyXyzK.exe
  2⤵
  PID:3760
- C:\Windows\System\oXSgbQD.exe
  C:\Windows\System\oXSgbQD.exe
  2⤵
  PID:3776
- C:\Windows\System\LDtWGnl.exe
  C:\Windows\System\LDtWGnl.exe
  2⤵
  PID:3800
- C:\Windows\System\qRpHndh.exe
  C:\Windows\System\qRpHndh.exe
  2⤵
  PID:3816
- C:\Windows\System\DDnfMCR.exe
  C:\Windows\System\DDnfMCR.exe
  2⤵
  PID:3840
- C:\Windows\System\KJeAcMR.exe
  C:\Windows\System\KJeAcMR.exe
  2⤵
  PID:3856
- C:\Windows\System\mvtKoFO.exe
  C:\Windows\System\mvtKoFO.exe
  2⤵
  PID:3880
- C:\Windows\System\mxowOjf.exe
  C:\Windows\System\mxowOjf.exe
  2⤵
  PID:3900
- C:\Windows\System\pmxatpO.exe
  C:\Windows\System\pmxatpO.exe
  2⤵
  PID:3920
- C:\Windows\System\Clpffnh.exe
  C:\Windows\System\Clpffnh.exe
  2⤵
  PID:3940
- C:\Windows\System\sxzijXC.exe
  C:\Windows\System\sxzijXC.exe
  2⤵
  PID:3960
- C:\Windows\System\NpJttbX.exe
  C:\Windows\System\NpJttbX.exe
  2⤵
  PID:3976
- C:\Windows\System\VAkSbDH.exe
  C:\Windows\System\VAkSbDH.exe
  2⤵
  PID:4000
- C:\Windows\System\LEgwNkY.exe
  C:\Windows\System\LEgwNkY.exe
  2⤵
  PID:4016
- C:\Windows\System\kcgpmRm.exe
  C:\Windows\System\kcgpmRm.exe
  2⤵
  PID:4036
- C:\Windows\System\wRQuZtr.exe
  C:\Windows\System\wRQuZtr.exe
  2⤵
  PID:4060
- C:\Windows\System\zsFGtLc.exe
  C:\Windows\System\zsFGtLc.exe
  2⤵
  PID:4080
- C:\Windows\System\NqlSMMJ.exe
  C:\Windows\System\NqlSMMJ.exe
  2⤵
  PID:1540
- C:\Windows\System\UXBoKwY.exe
  C:\Windows\System\UXBoKwY.exe
  2⤵
  PID:3040
- C:\Windows\System\jNdmucD.exe
  C:\Windows\System\jNdmucD.exe
  2⤵
  PID:744
- C:\Windows\System\ImdNToN.exe
  C:\Windows\System\ImdNToN.exe
  2⤵
  PID:2208
- C:\Windows\System\AsUsZJg.exe
  C:\Windows\System\AsUsZJg.exe
  2⤵
  PID:1752
- C:\Windows\System\dtNNepL.exe
  C:\Windows\System\dtNNepL.exe
  2⤵
  PID:2672
- C:\Windows\System\zQNkmrR.exe
  C:\Windows\System\zQNkmrR.exe
  2⤵
  PID:1608
- C:\Windows\System\ymEXcvs.exe
  C:\Windows\System\ymEXcvs.exe
  2⤵
  PID:2912
- C:\Windows\System\bttjBUw.exe
  C:\Windows\System\bttjBUw.exe
  2⤵
  PID:1900
- C:\Windows\System\KbwGwVI.exe
  C:\Windows\System\KbwGwVI.exe
  2⤵
  PID:2568
- C:\Windows\System\GaAPhSQ.exe
  C:\Windows\System\GaAPhSQ.exe
  2⤵
  PID:1460
- C:\Windows\System\vfxEvMH.exe
  C:\Windows\System\vfxEvMH.exe
  2⤵
  PID:3112
- C:\Windows\System\omLVrVS.exe
  C:\Windows\System\omLVrVS.exe
  2⤵
  PID:3128
- C:\Windows\System\jcmvLIT.exe
  C:\Windows\System\jcmvLIT.exe
  2⤵
  PID:3164
- C:\Windows\System\jpZpYuA.exe
  C:\Windows\System\jpZpYuA.exe
  2⤵
  PID:3172
- C:\Windows\System\detKYLF.exe
  C:\Windows\System\detKYLF.exe
  2⤵
  PID:3228
- C:\Windows\System\oBdwquw.exe
  C:\Windows\System\oBdwquw.exe
  2⤵
  PID:3272
- C:\Windows\System\pzrqFtL.exe
  C:\Windows\System\pzrqFtL.exe
  2⤵
  PID:3312
- C:\Windows\System\KgGkcYj.exe
  C:\Windows\System\KgGkcYj.exe
  2⤵
  PID:3328
- C:\Windows\System\vqBPHnM.exe
  C:\Windows\System\vqBPHnM.exe
  2⤵
  PID:3332
- C:\Windows\System\PpzCVEc.exe
  C:\Windows\System\PpzCVEc.exe
  2⤵
  PID:1724
- C:\Windows\System\HLLcPfU.exe
  C:\Windows\System\HLLcPfU.exe
  2⤵
  PID:3396
- C:\Windows\System\BmPYRzk.exe
  C:\Windows\System\BmPYRzk.exe
  2⤵
  PID:3428
- C:\Windows\System\VpSfawF.exe
  C:\Windows\System\VpSfawF.exe
  2⤵
  PID:3468
- C:\Windows\System\TJfoxAt.exe
  C:\Windows\System\TJfoxAt.exe
  2⤵
  PID:3488
- C:\Windows\System\DrYfeGg.exe
  C:\Windows\System\DrYfeGg.exe
  2⤵
  PID:3528
- C:\Windows\System\NKFjhXg.exe
  C:\Windows\System\NKFjhXg.exe
  2⤵
  PID:3536
- C:\Windows\System\CEwzCBf.exe
  C:\Windows\System\CEwzCBf.exe
  2⤵
  PID:3576
- C:\Windows\System\kfhvDsm.exe
  C:\Windows\System\kfhvDsm.exe
  2⤵
  PID:3592
- C:\Windows\System\NMmzvRI.exe
  C:\Windows\System\NMmzvRI.exe
  2⤵
  PID:3632
- C:\Windows\System\jERuxto.exe
  C:\Windows\System\jERuxto.exe
  2⤵
  PID:3668
- C:\Windows\System\QcWDzTH.exe
  C:\Windows\System\QcWDzTH.exe
  2⤵
  PID:3696
- C:\Windows\System\ZdQeHot.exe
  C:\Windows\System\ZdQeHot.exe
  2⤵
  PID:3744
- C:\Windows\System\PgirzoJ.exe
  C:\Windows\System\PgirzoJ.exe
  2⤵
  PID:2176
- C:\Windows\System\UWsVaMq.exe
  C:\Windows\System\UWsVaMq.exe
  2⤵
  PID:3784
- C:\Windows\System\SKJDGPe.exe
  C:\Windows\System\SKJDGPe.exe
  2⤵
  PID:3768
- C:\Windows\System\JPQRMnq.exe
  C:\Windows\System\JPQRMnq.exe
  2⤵
  PID:3836
- C:\Windows\System\qjaAOVY.exe
  C:\Windows\System\qjaAOVY.exe
  2⤵
  PID:3812
- C:\Windows\System\ldQtpAy.exe
  C:\Windows\System\ldQtpAy.exe
  2⤵
  PID:3872
- C:\Windows\System\VGqfxwy.exe
  C:\Windows\System\VGqfxwy.exe
  2⤵
  PID:3912
- C:\Windows\System\fUnnHxG.exe
  C:\Windows\System\fUnnHxG.exe
  2⤵
  PID:3892
- C:\Windows\System\vcSfPDH.exe
  C:\Windows\System\vcSfPDH.exe
  2⤵
  PID:3932
- C:\Windows\System\HNNWHNx.exe
  C:\Windows\System\HNNWHNx.exe
  2⤵
  PID:4024
- C:\Windows\System\PIISLnb.exe
  C:\Windows\System\PIISLnb.exe
  2⤵
  PID:4028
- C:\Windows\System\HfpcwLg.exe
  C:\Windows\System\HfpcwLg.exe
  2⤵
  PID:4076
- C:\Windows\System\sUYUKJV.exe
  C:\Windows\System\sUYUKJV.exe
  2⤵
  PID:1064
- C:\Windows\System\WSTxQBO.exe
  C:\Windows\System\WSTxQBO.exe
  2⤵
  PID:1612
- C:\Windows\System\MmhLSqE.exe
  C:\Windows\System\MmhLSqE.exe
  2⤵
  PID:872
- C:\Windows\System\uMjpRbi.exe
  C:\Windows\System\uMjpRbi.exe
  2⤵
  PID:776
- C:\Windows\System\OWMGwQr.exe
  C:\Windows\System\OWMGwQr.exe
  2⤵
  PID:2252
- C:\Windows\System\eEItEIZ.exe
  C:\Windows\System\eEItEIZ.exe
  2⤵
  PID:3064
- C:\Windows\System\mcKVszZ.exe
  C:\Windows\System\mcKVszZ.exe
  2⤵
  PID:552
- C:\Windows\System\YhdRNDT.exe
  C:\Windows\System\YhdRNDT.exe
  2⤵
  PID:3108
- C:\Windows\System\FIltqGe.exe
  C:\Windows\System\FIltqGe.exe
  2⤵
  PID:3132
- C:\Windows\System\KsfgBhO.exe
  C:\Windows\System\KsfgBhO.exe
  2⤵
  PID:3192
- C:\Windows\System\cSfsBCK.exe
  C:\Windows\System\cSfsBCK.exe
  2⤵
  PID:3232
- C:\Windows\System\ZyTiTuR.exe
  C:\Windows\System\ZyTiTuR.exe
  2⤵
  PID:3248
- C:\Windows\System\EzAoITp.exe
  C:\Windows\System\EzAoITp.exe
  2⤵
  PID:3304
- C:\Windows\System\bIclOpP.exe
  C:\Windows\System\bIclOpP.exe
  2⤵
  PID:2472
- C:\Windows\System\iByOKVV.exe
  C:\Windows\System\iByOKVV.exe
  2⤵
  PID:1768
- C:\Windows\System\RArMjXW.exe
  C:\Windows\System\RArMjXW.exe
  2⤵
  PID:2588
- C:\Windows\System\OYRBNnN.exe
  C:\Windows\System\OYRBNnN.exe
  2⤵
  PID:3368
- C:\Windows\System\yUSnPIo.exe
  C:\Windows\System\yUSnPIo.exe
  2⤵
  PID:3436
- C:\Windows\System\XppHbzM.exe
  C:\Windows\System\XppHbzM.exe
  2⤵
  PID:2976
- C:\Windows\System\xIXmhEs.exe
  C:\Windows\System\xIXmhEs.exe
  2⤵
  PID:2040
- C:\Windows\System\WsJkWDx.exe
  C:\Windows\System\WsJkWDx.exe
  2⤵
  PID:3472
- C:\Windows\System\YGCuLxQ.exe
  C:\Windows\System\YGCuLxQ.exe
  2⤵
  PID:1296
- C:\Windows\System\ZoiZkEK.exe
  C:\Windows\System\ZoiZkEK.exe
  2⤵
  PID:1056
- C:\Windows\System\hqXxMWZ.exe
  C:\Windows\System\hqXxMWZ.exe
  2⤵
  PID:2824
- C:\Windows\System\NHqoszS.exe
  C:\Windows\System\NHqoszS.exe
  2⤵
  PID:3616
- C:\Windows\System\LksojXu.exe
  C:\Windows\System\LksojXu.exe
  2⤵
  PID:3596
- C:\Windows\System\FOVOKJl.exe
  C:\Windows\System\FOVOKJl.exe
  2⤵
  PID:3708
- C:\Windows\System\mroJqIj.exe
  C:\Windows\System\mroJqIj.exe
  2⤵
  PID:3612
- C:\Windows\System\mAKGzMX.exe
  C:\Windows\System\mAKGzMX.exe
  2⤵
  PID:3808
- C:\Windows\System\PMHNAwh.exe
  C:\Windows\System\PMHNAwh.exe
  2⤵
  PID:2032
- C:\Windows\System\AlYgifx.exe
  C:\Windows\System\AlYgifx.exe
  2⤵
  PID:2760
- C:\Windows\System\AnFZypt.exe
  C:\Windows\System\AnFZypt.exe
  2⤵
  PID:2980
- C:\Windows\System\fOakeFc.exe
  C:\Windows\System\fOakeFc.exe
  2⤵
  PID:4068
- C:\Windows\System\unTTBHE.exe
  C:\Windows\System\unTTBHE.exe
  2⤵
  PID:4088
- C:\Windows\System\rruSXjV.exe
  C:\Windows\System\rruSXjV.exe
  2⤵
  PID:1504
- C:\Windows\System\DimWheR.exe
  C:\Windows\System\DimWheR.exe
  2⤵
  PID:2876
- C:\Windows\System\lCkpBrN.exe
  C:\Windows\System\lCkpBrN.exe
  2⤵
  PID:796
- C:\Windows\System\XZzGcZP.exe
  C:\Windows\System\XZzGcZP.exe
  2⤵
  PID:2772
- C:\Windows\System\txauOPg.exe
  C:\Windows\System\txauOPg.exe
  2⤵
  PID:1816
- C:\Windows\System\RSkmcFl.exe
  C:\Windows\System\RSkmcFl.exe
  2⤵
  PID:2608
- C:\Windows\System\yRLiSxl.exe
  C:\Windows\System\yRLiSxl.exe
  2⤵
  PID:2052
- C:\Windows\System\xqTYpjJ.exe
  C:\Windows\System\xqTYpjJ.exe
  2⤵
  PID:2360
- C:\Windows\System\HvsDHSt.exe
  C:\Windows\System\HvsDHSt.exe
  2⤵
  PID:3092
- C:\Windows\System\sBUTwux.exe
  C:\Windows\System\sBUTwux.exe
  2⤵
  PID:2548
- C:\Windows\System\KJdTbqF.exe
  C:\Windows\System\KJdTbqF.exe
  2⤵
  PID:3556
- C:\Windows\System\fohAjyu.exe
  C:\Windows\System\fohAjyu.exe
  2⤵
  PID:2524
- C:\Windows\System\DoaCGMT.exe
  C:\Windows\System\DoaCGMT.exe
  2⤵
  PID:3672
- C:\Windows\System\xCIdNrM.exe
  C:\Windows\System\xCIdNrM.exe
  2⤵
  PID:3456
- C:\Windows\System\tJBaVHr.exe
  C:\Windows\System\tJBaVHr.exe
  2⤵
  PID:2620
- C:\Windows\System\UiOEsva.exe
  C:\Windows\System\UiOEsva.exe
  2⤵
  PID:3372
- C:\Windows\System\pPmPnRS.exe
  C:\Windows\System\pPmPnRS.exe
  2⤵
  PID:2368
- C:\Windows\System\VaqhSVZ.exe
  C:\Windows\System\VaqhSVZ.exe
  2⤵
  PID:600
- C:\Windows\System\uNzDBUM.exe
  C:\Windows\System\uNzDBUM.exe
  2⤵
  PID:3936
- C:\Windows\System\HhbFyQX.exe
  C:\Windows\System\HhbFyQX.exe
  2⤵
  PID:4008
- C:\Windows\System\ljYTmSW.exe
  C:\Windows\System\ljYTmSW.exe
  2⤵
  PID:3992
- C:\Windows\System\cZIJdGV.exe
  C:\Windows\System\cZIJdGV.exe
  2⤵
  PID:1624
- C:\Windows\System\OtDyVXR.exe
  C:\Windows\System\OtDyVXR.exe
  2⤵
  PID:3348
- C:\Windows\System\VSUVoxq.exe
  C:\Windows\System\VSUVoxq.exe
  2⤵
  PID:3452
- C:\Windows\System\KtvXeeU.exe
  C:\Windows\System\KtvXeeU.exe
  2⤵
  PID:3524
- C:\Windows\System\EMUtUgl.exe
  C:\Windows\System\EMUtUgl.exe
  2⤵
  PID:3324
- C:\Windows\System\foQojuj.exe
  C:\Windows\System\foQojuj.exe
  2⤵
  PID:2392
- C:\Windows\System\wDsmPsp.exe
  C:\Windows\System\wDsmPsp.exe
  2⤵
  PID:4056
- C:\Windows\System\xNYtHoa.exe
  C:\Windows\System\xNYtHoa.exe
  2⤵
  PID:3676
- C:\Windows\System\WWzhvjH.exe
  C:\Windows\System\WWzhvjH.exe
  2⤵
  PID:3828
- C:\Windows\System\WPaNsNJ.exe
  C:\Windows\System\WPaNsNJ.exe
  2⤵
  PID:3416
- C:\Windows\System\PrNgeRX.exe
  C:\Windows\System\PrNgeRX.exe
  2⤵
  PID:3076
- C:\Windows\System\TTEmyXj.exe
  C:\Windows\System\TTEmyXj.exe
  2⤵
  PID:3888
- C:\Windows\System\pZYOWPp.exe
  C:\Windows\System\pZYOWPp.exe
  2⤵
  PID:3448
- C:\Windows\System\LHjsekr.exe
  C:\Windows\System\LHjsekr.exe
  2⤵
  PID:1664
- C:\Windows\System\GPnsPow.exe
  C:\Windows\System\GPnsPow.exe
  2⤵
  PID:2288
- C:\Windows\System\OsBRurg.exe
  C:\Windows\System\OsBRurg.exe
  2⤵
  PID:2364
- C:\Windows\System\wfLxKuD.exe
  C:\Windows\System\wfLxKuD.exe
  2⤵
  PID:3224
- C:\Windows\System\QZtFmAc.exe
  C:\Windows\System\QZtFmAc.exe
  2⤵
  PID:980
- C:\Windows\System\QUKnfqK.exe
  C:\Windows\System\QUKnfqK.exe
  2⤵
  PID:4112
- C:\Windows\System\CfReSTf.exe
  C:\Windows\System\CfReSTf.exe
  2⤵
  PID:4128
- C:\Windows\System\HMqtYgE.exe
  C:\Windows\System\HMqtYgE.exe
  2⤵
  PID:4156
- C:\Windows\System\LfJmwrC.exe
  C:\Windows\System\LfJmwrC.exe
  2⤵
  PID:4172
- C:\Windows\System\uuApRhq.exe
  C:\Windows\System\uuApRhq.exe
  2⤵
  PID:4188
- C:\Windows\System\uCBzzta.exe
  C:\Windows\System\uCBzzta.exe
  2⤵
  PID:4212
- C:\Windows\System\wKJLNmt.exe
  C:\Windows\System\wKJLNmt.exe
  2⤵
  PID:4240
- C:\Windows\System\FQvItkJ.exe
  C:\Windows\System\FQvItkJ.exe
  2⤵
  PID:4256
- C:\Windows\System\albayVC.exe
  C:\Windows\System\albayVC.exe
  2⤵
  PID:4272
- C:\Windows\System\FtPfRzV.exe
  C:\Windows\System\FtPfRzV.exe
  2⤵
  PID:4308
- C:\Windows\System\xRqzhyi.exe
  C:\Windows\System\xRqzhyi.exe
  2⤵
  PID:4324
- C:\Windows\System\bSnTyFL.exe
  C:\Windows\System\bSnTyFL.exe
  2⤵
  PID:4344
- C:\Windows\System\CrYmffX.exe
  C:\Windows\System\CrYmffX.exe
  2⤵
  PID:4360
- C:\Windows\System\CGcpzyJ.exe
  C:\Windows\System\CGcpzyJ.exe
  2⤵
  PID:4376
- C:\Windows\System\ZFZRzbq.exe
  C:\Windows\System\ZFZRzbq.exe
  2⤵
  PID:4392
- C:\Windows\System\FpIlDmx.exe
  C:\Windows\System\FpIlDmx.exe
  2⤵
  PID:4416
- C:\Windows\System\kiyIoih.exe
  C:\Windows\System\kiyIoih.exe
  2⤵
  PID:4432
- C:\Windows\System\VTqfTLI.exe
  C:\Windows\System\VTqfTLI.exe
  2⤵
  PID:4460
- C:\Windows\System\xkoXGyd.exe
  C:\Windows\System\xkoXGyd.exe
  2⤵
  PID:4484
- C:\Windows\System\FqHJTzf.exe
  C:\Windows\System\FqHJTzf.exe
  2⤵
  PID:4500
- C:\Windows\System\VlubpwS.exe
  C:\Windows\System\VlubpwS.exe
  2⤵
  PID:4516
- C:\Windows\System\qmQCCEe.exe
  C:\Windows\System\qmQCCEe.exe
  2⤵
  PID:4532
- C:\Windows\System\atCwZtd.exe
  C:\Windows\System\atCwZtd.exe
  2⤵
  PID:4548
- C:\Windows\System\EreVPMc.exe
  C:\Windows\System\EreVPMc.exe
  2⤵
  PID:4564
- C:\Windows\System\faRMngu.exe
  C:\Windows\System\faRMngu.exe
  2⤵
  PID:4580
- C:\Windows\System\biiwxzr.exe
  C:\Windows\System\biiwxzr.exe
  2⤵
  PID:4596
- C:\Windows\System\SywiHnN.exe
  C:\Windows\System\SywiHnN.exe
  2⤵
  PID:4624
- C:\Windows\System\HstqpBH.exe
  C:\Windows\System\HstqpBH.exe
  2⤵
  PID:4640
- C:\Windows\System\dGNpKsh.exe
  C:\Windows\System\dGNpKsh.exe
  2⤵
  PID:4656
- C:\Windows\System\WjYOwlS.exe
  C:\Windows\System\WjYOwlS.exe
  2⤵
  PID:4680
- C:\Windows\System\axfdzFb.exe
  C:\Windows\System\axfdzFb.exe
  2⤵
  PID:4740
- C:\Windows\System\pWcoMTR.exe
  C:\Windows\System\pWcoMTR.exe
  2⤵
  PID:4756
- C:\Windows\System\ELLGKeU.exe
  C:\Windows\System\ELLGKeU.exe
  2⤵
  PID:4772
- C:\Windows\System\cXyJXaH.exe
  C:\Windows\System\cXyJXaH.exe
  2⤵
  PID:4788
- C:\Windows\System\EACDMPM.exe
  C:\Windows\System\EACDMPM.exe
  2⤵
  PID:4804
- C:\Windows\System\fPhhwOO.exe
  C:\Windows\System\fPhhwOO.exe
  2⤵
  PID:4832
- C:\Windows\System\qOujvjP.exe
  C:\Windows\System\qOujvjP.exe
  2⤵
  PID:4852
- C:\Windows\System\wNmOcwW.exe
  C:\Windows\System\wNmOcwW.exe
  2⤵
  PID:4872
- C:\Windows\System\oXeiLWg.exe
  C:\Windows\System\oXeiLWg.exe
  2⤵
  PID:4892
- C:\Windows\System\xLqTZyS.exe
  C:\Windows\System\xLqTZyS.exe
  2⤵
  PID:4908
- C:\Windows\System\PaXYKBk.exe
  C:\Windows\System\PaXYKBk.exe
  2⤵
  PID:4924
- C:\Windows\System\wvaSciC.exe
  C:\Windows\System\wvaSciC.exe
  2⤵
  PID:4940
- C:\Windows\System\NAFdDHF.exe
  C:\Windows\System\NAFdDHF.exe
  2⤵
  PID:4960
- C:\Windows\System\LgkpDAt.exe
  C:\Windows\System\LgkpDAt.exe
  2⤵
  PID:4980
- C:\Windows\System\jbcpBGu.exe
  C:\Windows\System\jbcpBGu.exe
  2⤵
  PID:4996
- C:\Windows\System\tntMIPZ.exe
  C:\Windows\System\tntMIPZ.exe
  2⤵
  PID:5032
- C:\Windows\System\wVcpiEh.exe
  C:\Windows\System\wVcpiEh.exe
  2⤵
  PID:5052
- C:\Windows\System\Obilmgx.exe
  C:\Windows\System\Obilmgx.exe
  2⤵
  PID:5072
- C:\Windows\System\fEoIuOn.exe
  C:\Windows\System\fEoIuOn.exe
  2⤵
  PID:5088
- C:\Windows\System\GtPpYsw.exe
  C:\Windows\System\GtPpYsw.exe
  2⤵
  PID:5104
- C:\Windows\System\cDewbkj.exe
  C:\Windows\System\cDewbkj.exe
  2⤵
  PID:1152
- C:\Windows\System\ZhFAzxr.exe
  C:\Windows\System\ZhFAzxr.exe
  2⤵
  PID:3748
- C:\Windows\System\dAJLpEf.exe
  C:\Windows\System\dAJLpEf.exe
  2⤵
  PID:3916
- C:\Windows\System\zvphQlt.exe
  C:\Windows\System\zvphQlt.exe
  2⤵
  PID:3364
- C:\Windows\System\cffxrfw.exe
  C:\Windows\System\cffxrfw.exe
  2⤵
  PID:4136
- C:\Windows\System\YaRvwvl.exe
  C:\Windows\System\YaRvwvl.exe
  2⤵
  PID:4164
- C:\Windows\System\rFOeveh.exe
  C:\Windows\System\rFOeveh.exe
  2⤵
  PID:4204
- C:\Windows\System\PDBzPNT.exe
  C:\Windows\System\PDBzPNT.exe
  2⤵
  PID:4280
- C:\Windows\System\IVXTIFW.exe
  C:\Windows\System\IVXTIFW.exe
  2⤵
  PID:4288
- C:\Windows\System\RNdMVkY.exe
  C:\Windows\System\RNdMVkY.exe
  2⤵
  PID:4304
- C:\Windows\System\VNAfwOu.exe
  C:\Windows\System\VNAfwOu.exe
  2⤵
  PID:4340
- C:\Windows\System\NIORPbu.exe
  C:\Windows\System\NIORPbu.exe
  2⤵
  PID:4412
- C:\Windows\System\miwrDQf.exe
  C:\Windows\System\miwrDQf.exe
  2⤵
  PID:4388
- C:\Windows\System\TeDmETq.exe
  C:\Windows\System\TeDmETq.exe
  2⤵
  PID:4492
- C:\Windows\System\riToyCr.exe
  C:\Windows\System\riToyCr.exe
  2⤵
  PID:4560
- C:\Windows\System\yBqmXAi.exe
  C:\Windows\System\yBqmXAi.exe
  2⤵
  PID:4636
- C:\Windows\System\qhTdAPj.exe
  C:\Windows\System\qhTdAPj.exe
  2⤵
  PID:4236
- C:\Windows\System\vpohJqc.exe
  C:\Windows\System\vpohJqc.exe
  2⤵
  PID:4316
- C:\Windows\System\AUCWGXU.exe
  C:\Windows\System\AUCWGXU.exe
  2⤵
  PID:4668
- C:\Windows\System\nCVxSSj.exe
  C:\Windows\System\nCVxSSj.exe
  2⤵
  PID:4468
- C:\Windows\System\HVaBTwV.exe
  C:\Windows\System\HVaBTwV.exe
  2⤵
  PID:4512
- C:\Windows\System\jDqhoWP.exe
  C:\Windows\System\jDqhoWP.exe
  2⤵
  PID:4604
- C:\Windows\System\goPnVbV.exe
  C:\Windows\System\goPnVbV.exe
  2⤵
  PID:4692
- C:\Windows\System\WulpfKg.exe
  C:\Windows\System\WulpfKg.exe
  2⤵
  PID:4748
- C:\Windows\System\ZWptvdj.exe
  C:\Windows\System\ZWptvdj.exe
  2⤵
  PID:4824
- C:\Windows\System\BlhAnia.exe
  C:\Windows\System\BlhAnia.exe
  2⤵
  PID:4764
- C:\Windows\System\IjXydvK.exe
  C:\Windows\System\IjXydvK.exe
  2⤵
  PID:4796
- C:\Windows\System\EEXyINQ.exe
  C:\Windows\System\EEXyINQ.exe
  2⤵
  PID:4848
- C:\Windows\System\miRQCzl.exe
  C:\Windows\System\miRQCzl.exe
  2⤵
  PID:4932
- C:\Windows\System\hLTaJnC.exe
  C:\Windows\System\hLTaJnC.exe
  2⤵
  PID:5024
- C:\Windows\System\Ltnekgs.exe
  C:\Windows\System\Ltnekgs.exe
  2⤵
  PID:4920
- C:\Windows\System\AOFSppY.exe
  C:\Windows\System\AOFSppY.exe
  2⤵
  PID:4988
- C:\Windows\System\XFgvMme.exe
  C:\Windows\System\XFgvMme.exe
  2⤵
  PID:5048
- C:\Windows\System\OLwODOw.exe
  C:\Windows\System\OLwODOw.exe
  2⤵
  PID:5096
- C:\Windows\System\aynmLla.exe
  C:\Windows\System\aynmLla.exe
  2⤵
  PID:4092
- C:\Windows\System\MrCAFzX.exe
  C:\Windows\System\MrCAFzX.exe
  2⤵
  PID:4108
- C:\Windows\System\nRqpkQL.exe
  C:\Windows\System\nRqpkQL.exe
  2⤵
  PID:4252
- C:\Windows\System\UQMHrRD.exe
  C:\Windows\System\UQMHrRD.exe
  2⤵
  PID:4404
- C:\Windows\System\JfuPwwE.exe
  C:\Windows\System\JfuPwwE.exe
  2⤵
  PID:4452
- C:\Windows\System\JWFJfuG.exe
  C:\Windows\System\JWFJfuG.exe
  2⤵
  PID:4632
- C:\Windows\System\JSnWeOA.exe
  C:\Windows\System\JSnWeOA.exe
  2⤵
  PID:4336
- C:\Windows\System\jvcSpDD.exe
  C:\Windows\System\jvcSpDD.exe
  2⤵
  PID:4384
- C:\Windows\System\buQRWtX.exe
  C:\Windows\System\buQRWtX.exe
  2⤵
  PID:4672
- C:\Windows\System\ccYyvJD.exe
  C:\Windows\System\ccYyvJD.exe
  2⤵
  PID:4576
- C:\Windows\System\lVGqyGy.exe
  C:\Windows\System\lVGqyGy.exe
  2⤵
  PID:4556
- C:\Windows\System\RbnXrwQ.exe
  C:\Windows\System\RbnXrwQ.exe
  2⤵
  PID:4428
- C:\Windows\System\FCifros.exe
  C:\Windows\System\FCifros.exe
  2⤵
  PID:4736
- C:\Windows\System\rUebIbT.exe
  C:\Windows\System\rUebIbT.exe
  2⤵
  PID:4972
- C:\Windows\System\xrNnzcu.exe
  C:\Windows\System\xrNnzcu.exe
  2⤵
  PID:5008
- C:\Windows\System\SooqFNo.exe
  C:\Windows\System\SooqFNo.exe
  2⤵
  PID:4612
- C:\Windows\System\IUwGNpe.exe
  C:\Windows\System\IUwGNpe.exe
  2⤵
  PID:4784
- C:\Windows\System\hVvywmM.exe
  C:\Windows\System\hVvywmM.exe
  2⤵
  PID:4864
- C:\Windows\System\FxSVpEI.exe
  C:\Windows\System\FxSVpEI.exe
  2⤵
  PID:4904
- C:\Windows\System\qUkkHPo.exe
  C:\Windows\System\qUkkHPo.exe
  2⤵
  PID:4956
- C:\Windows\System\RHajlmg.exe
  C:\Windows\System\RHajlmg.exe
  2⤵
  PID:4300
- C:\Windows\System\WNxnsPz.exe
  C:\Windows\System\WNxnsPz.exe
  2⤵
  PID:4592
- C:\Windows\System\xFCZivE.exe
  C:\Windows\System\xFCZivE.exe
  2⤵
  PID:3268
- C:\Windows\System\bVPxxQC.exe
  C:\Windows\System\bVPxxQC.exe
  2⤵
  PID:3712
- C:\Windows\System\XpZOGpo.exe
  C:\Windows\System\XpZOGpo.exe
  2⤵
  PID:3588
- C:\Windows\System\YGPJMNn.exe
  C:\Windows\System\YGPJMNn.exe
  2⤵
  PID:3796
- C:\Windows\System\DXyLLCb.exe
  C:\Windows\System\DXyLLCb.exe
  2⤵
  PID:4424
- C:\Windows\System\DZmMFaQ.exe
  C:\Windows\System\DZmMFaQ.exe
  2⤵
  PID:4508
- C:\Windows\System\sZfGtuZ.exe
  C:\Windows\System\sZfGtuZ.exe
  2⤵
  PID:4352
- C:\Windows\System\DvumCZc.exe
  C:\Windows\System\DvumCZc.exe
  2⤵
  PID:4704
- C:\Windows\System\VOefkyU.exe
  C:\Windows\System\VOefkyU.exe
  2⤵
  PID:4712
- C:\Windows\System\JMpzDXZ.exe
  C:\Windows\System\JMpzDXZ.exe
  2⤵
  PID:4732
- C:\Windows\System\nUGoRSt.exe
  C:\Windows\System\nUGoRSt.exe
  2⤵
  PID:1016
- C:\Windows\System\NTnpgJH.exe
  C:\Windows\System\NTnpgJH.exe
  2⤵
  PID:3664
- C:\Windows\System\AmroOGW.exe
  C:\Windows\System\AmroOGW.exe
  2⤵
  PID:4968
- C:\Windows\System\TtRRLCD.exe
  C:\Windows\System\TtRRLCD.exe
  2⤵
  PID:5004
- C:\Windows\System\dgDLlCU.exe
  C:\Windows\System\dgDLlCU.exe
  2⤵
  PID:3824
- C:\Windows\System\jMuXfuQ.exe
  C:\Windows\System\jMuXfuQ.exe
  2⤵
  PID:5116
- C:\Windows\System\EJWyZBb.exe
  C:\Windows\System\EJWyZBb.exe
  2⤵
  PID:4952
- C:\Windows\System\CxyUXna.exe
  C:\Windows\System\CxyUXna.exe
  2⤵
  PID:4900
- C:\Windows\System\pDijkNb.exe
  C:\Windows\System\pDijkNb.exe
  2⤵
  PID:4232
- C:\Windows\System\xUsJpCb.exe
  C:\Windows\System\xUsJpCb.exe
  2⤵
  PID:904
- C:\Windows\System\WPxYwmF.exe
  C:\Windows\System\WPxYwmF.exe
  2⤵
  PID:5040
- C:\Windows\System\GLSHttu.exe
  C:\Windows\System\GLSHttu.exe
  2⤵
  PID:5136
- C:\Windows\System\xKXwFDq.exe
  C:\Windows\System\xKXwFDq.exe
  2⤵
  PID:5152
- C:\Windows\System\wtCIfsx.exe
  C:\Windows\System\wtCIfsx.exe
  2⤵
  PID:5168
- C:\Windows\System\xxIOtrF.exe
  C:\Windows\System\xxIOtrF.exe
  2⤵
  PID:5184
- C:\Windows\System\RETkrWP.exe
  C:\Windows\System\RETkrWP.exe
  2⤵
  PID:5200
- C:\Windows\System\vahDdax.exe
  C:\Windows\System\vahDdax.exe
  2⤵
  PID:5216
- C:\Windows\System\IVPgLVa.exe
  C:\Windows\System\IVPgLVa.exe
  2⤵
  PID:5232
- C:\Windows\System\vqaFKeS.exe
  C:\Windows\System\vqaFKeS.exe
  2⤵
  PID:5256
- C:\Windows\System\OtzuZOo.exe
  C:\Windows\System\OtzuZOo.exe
  2⤵
  PID:5288
- C:\Windows\System\NAunXAF.exe
  C:\Windows\System\NAunXAF.exe
  2⤵
  PID:5312
- C:\Windows\System\swBhWZH.exe
  C:\Windows\System\swBhWZH.exe
  2⤵
  PID:5332
- C:\Windows\System\SPGEnCX.exe
  C:\Windows\System\SPGEnCX.exe
  2⤵
  PID:5352
- C:\Windows\System\hGKArgG.exe
  C:\Windows\System\hGKArgG.exe
  2⤵
  PID:5368
- C:\Windows\System\lvXbERQ.exe
  C:\Windows\System\lvXbERQ.exe
  2⤵
  PID:5388
- C:\Windows\System\OmzsXWm.exe
  C:\Windows\System\OmzsXWm.exe
  2⤵
  PID:5412
- C:\Windows\System\GgVGRvx.exe
  C:\Windows\System\GgVGRvx.exe
  2⤵
  PID:5432
- C:\Windows\System\OdXrpeq.exe
  C:\Windows\System\OdXrpeq.exe
  2⤵
  PID:5448
- C:\Windows\System\FCPPCfh.exe
  C:\Windows\System\FCPPCfh.exe
  2⤵
  PID:5464
- C:\Windows\System\AbYNjKZ.exe
  C:\Windows\System\AbYNjKZ.exe
  2⤵
  PID:5480
- C:\Windows\System\mZayhLz.exe
  C:\Windows\System\mZayhLz.exe
  2⤵
  PID:5496
- C:\Windows\System\VEDDjUG.exe
  C:\Windows\System\VEDDjUG.exe
  2⤵
  PID:5516
- C:\Windows\System\kfNqQMW.exe
  C:\Windows\System\kfNqQMW.exe
  2⤵
  PID:5532
- C:\Windows\System\CgRqxTe.exe
  C:\Windows\System\CgRqxTe.exe
  2⤵
  PID:5552
- C:\Windows\System\yfJFcLl.exe
  C:\Windows\System\yfJFcLl.exe
  2⤵
  PID:5572
- C:\Windows\System\tFyhYfl.exe
  C:\Windows\System\tFyhYfl.exe
  2⤵
  PID:5588
- C:\Windows\System\uVutegM.exe
  C:\Windows\System\uVutegM.exe
  2⤵
  PID:5604
- C:\Windows\System\tpQMiZi.exe
  C:\Windows\System\tpQMiZi.exe
  2⤵
  PID:5620
- C:\Windows\System\oOoGkGO.exe
  C:\Windows\System\oOoGkGO.exe
  2⤵
  PID:5636
- C:\Windows\System\QXbhiUL.exe
  C:\Windows\System\QXbhiUL.exe
  2⤵
  PID:5656
- C:\Windows\System\pmhtBfY.exe
  C:\Windows\System\pmhtBfY.exe
  2⤵
  PID:5676
- C:\Windows\System\VuULdKM.exe
  C:\Windows\System\VuULdKM.exe
  2⤵
  PID:5692
- C:\Windows\System\bbgGhJv.exe
  C:\Windows\System\bbgGhJv.exe
  2⤵
  PID:5712
- C:\Windows\System\UTqDxej.exe
  C:\Windows\System\UTqDxej.exe
  2⤵
  PID:5732
- C:\Windows\System\EiQScmV.exe
  C:\Windows\System\EiQScmV.exe
  2⤵
  PID:5748
- C:\Windows\System\ZDybBXP.exe
  C:\Windows\System\ZDybBXP.exe
  2⤵
  PID:5764
- C:\Windows\System\iBhEnUP.exe
  C:\Windows\System\iBhEnUP.exe
  2⤵
  PID:5780
- C:\Windows\System\sqmOWYo.exe
  C:\Windows\System\sqmOWYo.exe
  2⤵
  PID:5800
- C:\Windows\System\TVkiGul.exe
  C:\Windows\System\TVkiGul.exe
  2⤵
  PID:5816
- C:\Windows\System\KopXKeV.exe
  C:\Windows\System\KopXKeV.exe
  2⤵
  PID:5832
- C:\Windows\System\ANmygiS.exe
  C:\Windows\System\ANmygiS.exe
  2⤵
  PID:5852
- C:\Windows\System\PULlDmw.exe
  C:\Windows\System\PULlDmw.exe
  2⤵
  PID:5868
- C:\Windows\System\YyZlIfp.exe
  C:\Windows\System\YyZlIfp.exe
  2⤵
  PID:5892
- C:\Windows\System\uMUjhYt.exe
  C:\Windows\System\uMUjhYt.exe
  2⤵
  PID:5996
- C:\Windows\System\OpTGvxe.exe
  C:\Windows\System\OpTGvxe.exe
  2⤵
  PID:6012
- C:\Windows\System\ULJdgHJ.exe
  C:\Windows\System\ULJdgHJ.exe
  2⤵
  PID:6028
- C:\Windows\System\jTErhxa.exe
  C:\Windows\System\jTErhxa.exe
  2⤵
  PID:6048
- C:\Windows\System\wWlXOQJ.exe
  C:\Windows\System\wWlXOQJ.exe
  2⤵
  PID:6064
- C:\Windows\System\USAUcoB.exe
  C:\Windows\System\USAUcoB.exe
  2⤵
  PID:6084
- C:\Windows\System\rurEuRm.exe
  C:\Windows\System\rurEuRm.exe
  2⤵
  PID:6104
- C:\Windows\System\uLMahGA.exe
  C:\Windows\System\uLMahGA.exe
  2⤵
  PID:6124
- C:\Windows\System\vqwWzqB.exe
  C:\Windows\System\vqwWzqB.exe
  2⤵
  PID:6140
- C:\Windows\System\CAiPDiY.exe
  C:\Windows\System\CAiPDiY.exe
  2⤵
  PID:5164
- C:\Windows\System\rcQxHJQ.exe
  C:\Windows\System\rcQxHJQ.exe
  2⤵
  PID:5264
- C:\Windows\System\pZRuDil.exe
  C:\Windows\System\pZRuDil.exe
  2⤵
  PID:5080
- C:\Windows\System\nwKuiew.exe
  C:\Windows\System\nwKuiew.exe
  2⤵
  PID:5320
- C:\Windows\System\lyRRqFl.exe
  C:\Windows\System\lyRRqFl.exe
  2⤵
  PID:4180
- C:\Windows\System\KQjfbLd.exe
  C:\Windows\System\KQjfbLd.exe
  2⤵
  PID:5396
- C:\Windows\System\xmyyfWs.exe
  C:\Windows\System\xmyyfWs.exe
  2⤵
  PID:5440
- C:\Windows\System\AHmqIby.exe
  C:\Windows\System\AHmqIby.exe
  2⤵
  PID:5504
- C:\Windows\System\vFTgHWD.exe
  C:\Windows\System\vFTgHWD.exe
  2⤵
  PID:5544
- C:\Windows\System\ZuiaBml.exe
  C:\Windows\System\ZuiaBml.exe
  2⤵
  PID:5612
- C:\Windows\System\JVJAlOE.exe
  C:\Windows\System\JVJAlOE.exe
  2⤵
  PID:5652
- C:\Windows\System\dTrnGmn.exe
  C:\Windows\System\dTrnGmn.exe
  2⤵
  PID:5724
- C:\Windows\System\sKQXCUQ.exe
  C:\Windows\System\sKQXCUQ.exe
  2⤵
  PID:5860
- C:\Windows\System\OjXVfsy.exe
  C:\Windows\System\OjXVfsy.exe
  2⤵
  PID:4820
- C:\Windows\System\ZvLbdTa.exe
  C:\Windows\System\ZvLbdTa.exe
  2⤵
  PID:5144
- C:\Windows\System\UTZicIe.exe
  C:\Windows\System\UTZicIe.exe
  2⤵
  PID:4400
- C:\Windows\System\kGHTdeq.exe
  C:\Windows\System\kGHTdeq.exe
  2⤵
  PID:5380
- C:\Windows\System\WFxhkUn.exe
  C:\Windows\System\WFxhkUn.exe
  2⤵
  PID:5524
- C:\Windows\System\tHBdbDq.exe
  C:\Windows\System\tHBdbDq.exe
  2⤵
  PID:5568
- C:\Windows\System\RBhPSxB.exe
  C:\Windows\System\RBhPSxB.exe
  2⤵
  PID:5664
- C:\Windows\System\JpukEQs.exe
  C:\Windows\System\JpukEQs.exe
  2⤵
  PID:5704
- C:\Windows\System\FkUEsPB.exe
  C:\Windows\System\FkUEsPB.exe
  2⤵
  PID:5772
- C:\Windows\System\vlMqyMr.exe
  C:\Windows\System\vlMqyMr.exe
  2⤵
  PID:5460
- C:\Windows\System\pdNlksQ.exe
  C:\Windows\System\pdNlksQ.exe
  2⤵
  PID:5384
- C:\Windows\System\GgpHulf.exe
  C:\Windows\System\GgpHulf.exe
  2⤵
  PID:5900
- C:\Windows\System\QNibjlA.exe
  C:\Windows\System\QNibjlA.exe
  2⤵
  PID:5888
- C:\Windows\System\siAFKFF.exe
  C:\Windows\System\siAFKFF.exe
  2⤵
  PID:5928
- C:\Windows\System\XLBnNsP.exe
  C:\Windows\System\XLBnNsP.exe
  2⤵
  PID:5948
- C:\Windows\System\sMdqleO.exe
  C:\Windows\System\sMdqleO.exe
  2⤵
  PID:5964
- C:\Windows\System\uyZFbqa.exe
  C:\Windows\System\uyZFbqa.exe
  2⤵
  PID:5980
- C:\Windows\System\cBiCjdT.exe
  C:\Windows\System\cBiCjdT.exe
  2⤵
  PID:6096
- C:\Windows\System\HBSeYLH.exe
  C:\Windows\System\HBSeYLH.exe
  2⤵
  PID:6040
- C:\Windows\System\GFBbXpP.exe
  C:\Windows\System\GFBbXpP.exe
  2⤵
  PID:5196
- C:\Windows\System\uQeNgeu.exe
  C:\Windows\System\uQeNgeu.exe
  2⤵
  PID:5280
- C:\Windows\System\KPgSvkQ.exe
  C:\Windows\System\KPgSvkQ.exe
  2⤵
  PID:5132
- C:\Windows\System\oEoBcxB.exe
  C:\Windows\System\oEoBcxB.exe
  2⤵
  PID:6080
- C:\Windows\System\GCnszml.exe
  C:\Windows\System\GCnszml.exe
  2⤵
  PID:4120
- C:\Windows\System\SJeoUfC.exe
  C:\Windows\System\SJeoUfC.exe
  2⤵
  PID:5148
- C:\Windows\System\lCFWUAp.exe
  C:\Windows\System\lCFWUAp.exe
  2⤵
  PID:5404
- C:\Windows\System\DYFuhjz.exe
  C:\Windows\System\DYFuhjz.exe
  2⤵
  PID:5688
- C:\Windows\System\UJdUQME.exe
  C:\Windows\System\UJdUQME.exe
  2⤵
  PID:5760
- C:\Windows\System\VikKKFh.exe
  C:\Windows\System\VikKKFh.exe
  2⤵
  PID:5248
- C:\Windows\System\XlCeZvk.exe
  C:\Windows\System\XlCeZvk.exe
  2⤵
  PID:5180
- C:\Windows\System\XvWwhpU.exe
  C:\Windows\System\XvWwhpU.exe
  2⤵
  PID:5600
- C:\Windows\System\iftNNNQ.exe
  C:\Windows\System\iftNNNQ.exe
  2⤵
  PID:5428
- C:\Windows\System\jnPDAaA.exe
  C:\Windows\System\jnPDAaA.exe
  2⤵
  PID:5912
- C:\Windows\System\JBxMeEr.exe
  C:\Windows\System\JBxMeEr.exe
  2⤵
  PID:5944
- C:\Windows\System\YwYNiLQ.exe
  C:\Windows\System\YwYNiLQ.exe
  2⤵
  PID:5976
- C:\Windows\System\XLWmahY.exe
  C:\Windows\System\XLWmahY.exe
  2⤵
  PID:5808
- C:\Windows\System\jeHsLXU.exe
  C:\Windows\System\jeHsLXU.exe
  2⤵
  PID:5344
- C:\Windows\System\iusGQjT.exe
  C:\Windows\System\iusGQjT.exe
  2⤵
  PID:5884
- C:\Windows\System\DjIAXvK.exe
  C:\Windows\System\DjIAXvK.exe
  2⤵
  PID:5960
- C:\Windows\System\pmtLLcB.exe
  C:\Windows\System\pmtLLcB.exe
  2⤵
  PID:6036
- C:\Windows\System\bozTxSg.exe
  C:\Windows\System\bozTxSg.exe
  2⤵
  PID:6024
- C:\Windows\System\mmzBrAn.exe
  C:\Windows\System\mmzBrAn.exe
  2⤵
  PID:5084
- C:\Windows\System\nVhSZhw.exe
  C:\Windows\System\nVhSZhw.exe
  2⤵
  PID:5360
- C:\Windows\System\qGqbfxb.exe
  C:\Windows\System\qGqbfxb.exe
  2⤵
  PID:6136
- C:\Windows\System\EavfmGF.exe
  C:\Windows\System\EavfmGF.exe
  2⤵
  PID:4356
- C:\Windows\System\vgsRyXH.exe
  C:\Windows\System\vgsRyXH.exe
  2⤵
  PID:5840
- C:\Windows\System\stByDKB.exe
  C:\Windows\System\stByDKB.exe
  2⤵
  PID:5728
- C:\Windows\System\yPIzuNl.exe
  C:\Windows\System\yPIzuNl.exe
  2⤵
  PID:5824
- C:\Windows\System\ATdAxan.exe
  C:\Windows\System\ATdAxan.exe
  2⤵
  PID:5176
- C:\Windows\System\nyxBwmx.exe
  C:\Windows\System\nyxBwmx.exe
  2⤵
  PID:5240
- C:\Windows\System\lvGgtPs.exe
  C:\Windows\System\lvGgtPs.exe
  2⤵
  PID:5276
- C:\Windows\System\kOEYEYH.exe
  C:\Windows\System\kOEYEYH.exe
  2⤵
  PID:5940
- C:\Windows\System\vmyJUOI.exe
  C:\Windows\System\vmyJUOI.exe
  2⤵
  PID:5584
- C:\Windows\System\XFQAHnV.exe
  C:\Windows\System\XFQAHnV.exe
  2⤵
  PID:6060
- C:\Windows\System\VkroKRw.exe
  C:\Windows\System\VkroKRw.exe
  2⤵
  PID:5796
- C:\Windows\System\xsbVdfV.exe
  C:\Windows\System\xsbVdfV.exe
  2⤵
  PID:5296
- C:\Windows\System\lmljKqG.exe
  C:\Windows\System\lmljKqG.exe
  2⤵
  PID:5324
- C:\Windows\System\rVNMdtR.exe
  C:\Windows\System\rVNMdtR.exe
  2⤵
  PID:6092
- C:\Windows\System\bMlbkjG.exe
  C:\Windows\System\bMlbkjG.exe
  2⤵
  PID:5648
- C:\Windows\System\mwNIwBq.exe
  C:\Windows\System\mwNIwBq.exe
  2⤵
  PID:5740
- C:\Windows\System\WZNOwtO.exe
  C:\Windows\System\WZNOwtO.exe
  2⤵
  PID:5876
- C:\Windows\System\JKFFphf.exe
  C:\Windows\System\JKFFphf.exe
  2⤵
  PID:5920
- C:\Windows\System\xenQpcm.exe
  C:\Windows\System\xenQpcm.exe
  2⤵
  PID:5672
- C:\Windows\System\MOrBPdA.exe
  C:\Windows\System\MOrBPdA.exe
  2⤵
  PID:3792
- C:\Windows\System\ZbwUksN.exe
  C:\Windows\System\ZbwUksN.exe
  2⤵
  PID:5792
- C:\Windows\System\MuWZwaW.exe
  C:\Windows\System\MuWZwaW.exe
  2⤵
  PID:5936
- C:\Windows\System\vWvBZrE.exe
  C:\Windows\System\vWvBZrE.exe
  2⤵
  PID:6020
- C:\Windows\System\cZHBHJS.exe
  C:\Windows\System\cZHBHJS.exe
  2⤵
  PID:6160
- C:\Windows\System\IAClVfE.exe
  C:\Windows\System\IAClVfE.exe
  2⤵
  PID:6176
- C:\Windows\System\kAyMqWa.exe
  C:\Windows\System\kAyMqWa.exe
  2⤵
  PID:6192
- C:\Windows\System\yElGYcP.exe
  C:\Windows\System\yElGYcP.exe
  2⤵
  PID:6208
- C:\Windows\System\pFRCvpE.exe
  C:\Windows\System\pFRCvpE.exe
  2⤵
  PID:6236
- C:\Windows\System\nOruNmQ.exe
  C:\Windows\System\nOruNmQ.exe
  2⤵
  PID:6252
- C:\Windows\System\AxJklpW.exe
  C:\Windows\System\AxJklpW.exe
  2⤵
  PID:6280
- C:\Windows\System\QrkmPqC.exe
  C:\Windows\System\QrkmPqC.exe
  2⤵
  PID:6296
- C:\Windows\System\Ossyyph.exe
  C:\Windows\System\Ossyyph.exe
  2⤵
  PID:6312
- C:\Windows\System\luVcUtW.exe
  C:\Windows\System\luVcUtW.exe
  2⤵
  PID:6328
- C:\Windows\System\SJuYjKW.exe
  C:\Windows\System\SJuYjKW.exe
  2⤵
  PID:6344
- C:\Windows\System\NHDqUBD.exe
  C:\Windows\System\NHDqUBD.exe
  2⤵
  PID:6360
- C:\Windows\System\QeHUwBh.exe
  C:\Windows\System\QeHUwBh.exe
  2⤵
  PID:6376
- C:\Windows\System\DSPYrMp.exe
  C:\Windows\System\DSPYrMp.exe
  2⤵
  PID:6392
- C:\Windows\System\aJdpwmW.exe
  C:\Windows\System\aJdpwmW.exe
  2⤵
  PID:6408
- C:\Windows\System\IBjtCza.exe
  C:\Windows\System\IBjtCza.exe
  2⤵
  PID:6432
- C:\Windows\System\tZdErZd.exe
  C:\Windows\System\tZdErZd.exe
  2⤵
  PID:6476
- C:\Windows\System\tczrYnm.exe
  C:\Windows\System\tczrYnm.exe
  2⤵
  PID:6492
- C:\Windows\System\ASYiwed.exe
  C:\Windows\System\ASYiwed.exe
  2⤵
  PID:6512
- C:\Windows\System\OsVRxhm.exe
  C:\Windows\System\OsVRxhm.exe
  2⤵
  PID:6532
- C:\Windows\System\JSJRjAp.exe
  C:\Windows\System\JSJRjAp.exe
  2⤵
  PID:6560
- C:\Windows\System\GVnvdIb.exe
  C:\Windows\System\GVnvdIb.exe
  2⤵
  PID:6588
- C:\Windows\System\TjrFinK.exe
  C:\Windows\System\TjrFinK.exe
  2⤵
  PID:6604
- C:\Windows\System\QVaGbxp.exe
  C:\Windows\System\QVaGbxp.exe
  2⤵
  PID:6620
- C:\Windows\System\DsEaGMw.exe
  C:\Windows\System\DsEaGMw.exe
  2⤵
  PID:6644
- C:\Windows\System\XKtufWc.exe
  C:\Windows\System\XKtufWc.exe
  2⤵
  PID:6660
- C:\Windows\System\lAxwUcj.exe
  C:\Windows\System\lAxwUcj.exe
  2⤵
  PID:6676
- C:\Windows\System\pfUTvuP.exe
  C:\Windows\System\pfUTvuP.exe
  2⤵
  PID:6692
- C:\Windows\System\TYpuoQf.exe
  C:\Windows\System\TYpuoQf.exe
  2⤵
  PID:6712
- C:\Windows\System\vCBQKnJ.exe
  C:\Windows\System\vCBQKnJ.exe
  2⤵
  PID:6736
- C:\Windows\System\wIpdLFf.exe
  C:\Windows\System\wIpdLFf.exe
  2⤵
  PID:6760
- C:\Windows\System\BaOunez.exe
  C:\Windows\System\BaOunez.exe
  2⤵
  PID:6776
- C:\Windows\System\VdFgbfP.exe
  C:\Windows\System\VdFgbfP.exe
  2⤵
  PID:6792
- C:\Windows\System\NDYBVZy.exe
  C:\Windows\System\NDYBVZy.exe
  2⤵
  PID:6812
- C:\Windows\System\BrpbtvF.exe
  C:\Windows\System\BrpbtvF.exe
  2⤵
  PID:6840
- C:\Windows\System\QqAyZix.exe
  C:\Windows\System\QqAyZix.exe
  2⤵
  PID:6856
- C:\Windows\System\tlkeJRZ.exe
  C:\Windows\System\tlkeJRZ.exe
  2⤵
  PID:6872
- C:\Windows\System\kIwiRkU.exe
  C:\Windows\System\kIwiRkU.exe
  2⤵
  PID:6896
- C:\Windows\System\mBoHyIy.exe
  C:\Windows\System\mBoHyIy.exe
  2⤵
  PID:6912
- C:\Windows\System\fspvGlZ.exe
  C:\Windows\System\fspvGlZ.exe
  2⤵
  PID:6940
- C:\Windows\System\DiyRQuv.exe
  C:\Windows\System\DiyRQuv.exe
  2⤵
  PID:6964
- C:\Windows\System\msLjxcu.exe
  C:\Windows\System\msLjxcu.exe
  2⤵
  PID:6980
- C:\Windows\System\zBNEpfH.exe
  C:\Windows\System\zBNEpfH.exe
  2⤵
  PID:6996
- C:\Windows\System\cDOpZhJ.exe
  C:\Windows\System\cDOpZhJ.exe
  2⤵
  PID:7020
- C:\Windows\System\HpAtbCe.exe
  C:\Windows\System\HpAtbCe.exe
  2⤵
  PID:7036
- C:\Windows\System\YjsJSBr.exe
  C:\Windows\System\YjsJSBr.exe
  2⤵
  PID:7056
- C:\Windows\System\OzdOfBC.exe
  C:\Windows\System\OzdOfBC.exe
  2⤵
  PID:7072
- C:\Windows\System\NKeRzDk.exe
  C:\Windows\System\NKeRzDk.exe
  2⤵
  PID:7088
- C:\Windows\System\NriOYLd.exe
  C:\Windows\System\NriOYLd.exe
  2⤵
  PID:7108
- C:\Windows\System\NubzMPN.exe
  C:\Windows\System\NubzMPN.exe
  2⤵
  PID:7136
- C:\Windows\System\hYZwZaU.exe
  C:\Windows\System\hYZwZaU.exe
  2⤵
  PID:7152
- C:\Windows\System\zwUGodj.exe
  C:\Windows\System\zwUGodj.exe
  2⤵
  PID:6072
- C:\Windows\System\HQwIhFq.exe
  C:\Windows\System\HQwIhFq.exe
  2⤵
  PID:5476
- C:\Windows\System\HLJKLyd.exe
  C:\Windows\System\HLJKLyd.exe
  2⤵
  PID:6152
- C:\Windows\System\oxKIHEo.exe
  C:\Windows\System\oxKIHEo.exe
  2⤵
  PID:6288
- C:\Windows\System\lOzrVDj.exe
  C:\Windows\System\lOzrVDj.exe
  2⤵
  PID:6324
- C:\Windows\System\ifsUXyP.exe
  C:\Windows\System\ifsUXyP.exe
  2⤵
  PID:6224
- C:\Windows\System\umkmrXv.exe
  C:\Windows\System\umkmrXv.exe
  2⤵
  PID:6420
- C:\Windows\System\hHanStG.exe
  C:\Windows\System\hHanStG.exe
  2⤵
  PID:6188
- C:\Windows\System\NsRfOrt.exe
  C:\Windows\System\NsRfOrt.exe
  2⤵
  PID:6400
- C:\Windows\System\PAcmxOh.exe
  C:\Windows\System\PAcmxOh.exe
  2⤵
  PID:6340
- C:\Windows\System\JySnimD.exe
  C:\Windows\System\JySnimD.exe
  2⤵
  PID:6260
- C:\Windows\System\gLYpjuY.exe
  C:\Windows\System\gLYpjuY.exe
  2⤵
  PID:6488
- C:\Windows\System\bQVYmTH.exe
  C:\Windows\System\bQVYmTH.exe
  2⤵
  PID:6568
- C:\Windows\System\PpwLffB.exe
  C:\Windows\System\PpwLffB.exe
  2⤵
  PID:6464
- C:\Windows\System\ZIKPbVy.exe
  C:\Windows\System\ZIKPbVy.exe
  2⤵
  PID:6504
- C:\Windows\System\XAYngSE.exe
  C:\Windows\System\XAYngSE.exe
  2⤵
  PID:6612
- C:\Windows\System\MyVPTXM.exe
  C:\Windows\System\MyVPTXM.exe
  2⤵
  PID:6728
- C:\Windows\System\EDCiems.exe
  C:\Windows\System\EDCiems.exe
  2⤵
  PID:6808
- C:\Windows\System\aHHGcHf.exe
  C:\Windows\System\aHHGcHf.exe
  2⤵
  PID:6600
- C:\Windows\System\PimUBdZ.exe
  C:\Windows\System\PimUBdZ.exe
  2⤵
  PID:6552
- C:\Windows\System\dqOPuMl.exe
  C:\Windows\System\dqOPuMl.exe
  2⤵
  PID:6632
- C:\Windows\System\XfQXlDv.exe
  C:\Windows\System\XfQXlDv.exe
  2⤵
  PID:6824
- C:\Windows\System\XQbsFqm.exe
  C:\Windows\System\XQbsFqm.exe
  2⤵
  PID:6884
- C:\Windows\System\MIerdcJ.exe
  C:\Windows\System\MIerdcJ.exe
  2⤵
  PID:6836
- C:\Windows\System\PcntSyi.exe
  C:\Windows\System\PcntSyi.exe
  2⤵
  PID:6744
- C:\Windows\System\GxMCcIg.exe
  C:\Windows\System\GxMCcIg.exe
  2⤵
  PID:6928
- C:\Windows\System\UrbLCge.exe
  C:\Windows\System\UrbLCge.exe
  2⤵
  PID:6976
- C:\Windows\System\OnjpCTG.exe
  C:\Windows\System\OnjpCTG.exe
  2⤵
  PID:7016
- C:\Windows\System\bOjPxjq.exe
  C:\Windows\System\bOjPxjq.exe
  2⤵
  PID:7084
- C:\Windows\System\sZfNiHD.exe
  C:\Windows\System\sZfNiHD.exe
  2⤵
  PID:7120
- C:\Windows\System\WXcnIEM.exe
  C:\Windows\System\WXcnIEM.exe
  2⤵
  PID:6908
- C:\Windows\System\OaaUIGK.exe
  C:\Windows\System\OaaUIGK.exe
  2⤵
  PID:5304
- C:\Windows\System\cPDGUGb.exe
  C:\Windows\System\cPDGUGb.exe
  2⤵
  PID:7096
- C:\Windows\System\GdtRHGP.exe
  C:\Windows\System\GdtRHGP.exe
  2⤵
  PID:6388
- C:\Windows\System\gUhkBPS.exe
  C:\Windows\System\gUhkBPS.exe
  2⤵
  PID:6524
- C:\Windows\System\uPgTtee.exe
  C:\Windows\System\uPgTtee.exe
  2⤵
  PID:7148
- C:\Windows\System\ywGeaDk.exe
  C:\Windows\System\ywGeaDk.exe
  2⤵
  PID:6200
- C:\Windows\System\XjvkqZc.exe
  C:\Windows\System\XjvkqZc.exe
  2⤵
  PID:7028
- C:\Windows\System\nXZBMKI.exe
  C:\Windows\System\nXZBMKI.exe
  2⤵
  PID:6336
- C:\Windows\System\HyxWtTR.exe
  C:\Windows\System\HyxWtTR.exe
  2⤵
  PID:6460
- C:\Windows\System\vDMNvYN.exe
  C:\Windows\System\vDMNvYN.exe
  2⤵
  PID:6132
- C:\Windows\System\HLIWsCW.exe
  C:\Windows\System\HLIWsCW.exe
  2⤵
  PID:6584
- C:\Windows\System\PywuOOY.exe
  C:\Windows\System\PywuOOY.exe
  2⤵
  PID:6656
- C:\Windows\System\muNkhPn.exe
  C:\Windows\System\muNkhPn.exe
  2⤵
  PID:6724
- C:\Windows\System\FGjaMJO.exe
  C:\Windows\System\FGjaMJO.exe
  2⤵
  PID:6936
- C:\Windows\System\mOcjWMa.exe
  C:\Windows\System\mOcjWMa.exe
  2⤵
  PID:7080
- C:\Windows\System\BaXVOvB.exe
  C:\Windows\System\BaXVOvB.exe
  2⤵
  PID:6148
- C:\Windows\System\oXQscsR.exe
  C:\Windows\System\oXQscsR.exe
  2⤵
  PID:6804
- C:\Windows\System\BAdBabk.exe
  C:\Windows\System\BAdBabk.exe
  2⤵
  PID:7144
- C:\Windows\System\CKJPoKW.exe
  C:\Windows\System\CKJPoKW.exe
  2⤵
  PID:7008
- C:\Windows\System\RrTVXXy.exe
  C:\Windows\System\RrTVXXy.exe
  2⤵
  PID:6892
- C:\Windows\System\EVEdpHn.exe
  C:\Windows\System\EVEdpHn.exe
  2⤵
  PID:6548
- C:\Windows\System\ZYZHfAy.exe
  C:\Windows\System\ZYZHfAy.exe
  2⤵
  PID:6268
- C:\Windows\System\XJvMkNi.exe
  C:\Windows\System\XJvMkNi.exe
  2⤵
  PID:6172
- C:\Windows\System\GGbPgyx.exe
  C:\Windows\System\GGbPgyx.exe
  2⤵
  PID:6852
- C:\Windows\System\wxXEOFB.exe
  C:\Windows\System\wxXEOFB.exe
  2⤵
  PID:6628
- C:\Windows\System\wxhlORj.exe
  C:\Windows\System\wxhlORj.exe
  2⤵
  PID:6784
- C:\Windows\System\qyXaVus.exe
  C:\Windows\System\qyXaVus.exe
  2⤵
  PID:6428
- C:\Windows\System\JUIXhBL.exe
  C:\Windows\System\JUIXhBL.exe
  2⤵
  PID:6720
- C:\Windows\System\viMGnId.exe
  C:\Windows\System\viMGnId.exe
  2⤵
  PID:6484
- C:\Windows\System\jSqASfp.exe
  C:\Windows\System\jSqASfp.exe
  2⤵
  PID:7064
- C:\Windows\System\yxSwRLj.exe
  C:\Windows\System\yxSwRLj.exe
  2⤵
  PID:6992
- C:\Windows\System\JXPJlIz.exe
  C:\Windows\System\JXPJlIz.exe
  2⤵
  PID:6768
- C:\Windows\System\vHXfJaq.exe
  C:\Windows\System\vHXfJaq.exe
  2⤵
  PID:6820
- C:\Windows\System\uXDJobq.exe
  C:\Windows\System\uXDJobq.exe
  2⤵
  PID:6500
- C:\Windows\System\jREFRfM.exe
  C:\Windows\System\jREFRfM.exe
  2⤵
  PID:6184
- C:\Windows\System\HoNvVAc.exe
  C:\Windows\System\HoNvVAc.exe
  2⤵
  PID:6868
- C:\Windows\System\KErryfL.exe
  C:\Windows\System\KErryfL.exe
  2⤵
  PID:6688
- C:\Windows\System\MdJmiKQ.exe
  C:\Windows\System\MdJmiKQ.exe
  2⤵
  PID:6668
- C:\Windows\System\OhlFQsJ.exe
  C:\Windows\System\OhlFQsJ.exe
  2⤵
  PID:7172
- C:\Windows\System\XoVYqhi.exe
  C:\Windows\System\XoVYqhi.exe
  2⤵
  PID:7188
- C:\Windows\System\OrcuGrQ.exe
  C:\Windows\System\OrcuGrQ.exe
  2⤵
  PID:7204
- C:\Windows\System\xSzeBoa.exe
  C:\Windows\System\xSzeBoa.exe
  2⤵
  PID:7256
- C:\Windows\System\owFVOWr.exe
  C:\Windows\System\owFVOWr.exe
  2⤵
  PID:7276
- C:\Windows\System\tBuXXGI.exe
  C:\Windows\System\tBuXXGI.exe
  2⤵
  PID:7292
- C:\Windows\System\aRBLTkD.exe
  C:\Windows\System\aRBLTkD.exe
  2⤵
  PID:7320
- C:\Windows\System\mmhhARD.exe
  C:\Windows\System\mmhhARD.exe
  2⤵
  PID:7336
- C:\Windows\System\GQCDdWL.exe
  C:\Windows\System\GQCDdWL.exe
  2⤵
  PID:7352
- C:\Windows\System\wipUYXW.exe
  C:\Windows\System\wipUYXW.exe
  2⤵
  PID:7372
- C:\Windows\System\iUvrAsu.exe
  C:\Windows\System\iUvrAsu.exe
  2⤵
  PID:7392
- C:\Windows\System\lYXYFNk.exe
  C:\Windows\System\lYXYFNk.exe
  2⤵
  PID:7416
- C:\Windows\System\dDflxfK.exe
  C:\Windows\System\dDflxfK.exe
  2⤵
  PID:7432
- C:\Windows\System\pIoliZt.exe
  C:\Windows\System\pIoliZt.exe
  2⤵
  PID:7452
- C:\Windows\System\olRjMwi.exe
  C:\Windows\System\olRjMwi.exe
  2⤵
  PID:7472
- C:\Windows\System\UfTiNRt.exe
  C:\Windows\System\UfTiNRt.exe
  2⤵
  PID:7492
- C:\Windows\System\wrGMZTo.exe
  C:\Windows\System\wrGMZTo.exe
  2⤵
  PID:7512
- C:\Windows\System\wTEbemL.exe
  C:\Windows\System\wTEbemL.exe
  2⤵
  PID:7532
- C:\Windows\System\qSnHNRs.exe
  C:\Windows\System\qSnHNRs.exe
  2⤵
  PID:7552
- C:\Windows\System\isEhdmp.exe
  C:\Windows\System\isEhdmp.exe
  2⤵
  PID:7568
- C:\Windows\System\ymFBHeV.exe
  C:\Windows\System\ymFBHeV.exe
  2⤵
  PID:7588
- C:\Windows\System\pesPOhn.exe
  C:\Windows\System\pesPOhn.exe
  2⤵
  PID:7604
- C:\Windows\System\UzfADsn.exe
  C:\Windows\System\UzfADsn.exe
  2⤵
  PID:7620
- C:\Windows\System\EduEXfo.exe
  C:\Windows\System\EduEXfo.exe
  2⤵
  PID:7636
- C:\Windows\System\MEhwmTc.exe
  C:\Windows\System\MEhwmTc.exe
  2⤵
  PID:7656
- C:\Windows\System\WPwlREW.exe
  C:\Windows\System\WPwlREW.exe
  2⤵
  PID:7672
- C:\Windows\System\YtESpPB.exe
  C:\Windows\System\YtESpPB.exe
  2⤵
  PID:7692
- C:\Windows\System\LmSDmtr.exe
  C:\Windows\System\LmSDmtr.exe
  2⤵
  PID:7736
- C:\Windows\System\extErki.exe
  C:\Windows\System\extErki.exe
  2⤵
  PID:7764
- C:\Windows\System\xLpEXwl.exe
  C:\Windows\System\xLpEXwl.exe
  2⤵
  PID:7784
- C:\Windows\System\ggknLsG.exe
  C:\Windows\System\ggknLsG.exe
  2⤵
  PID:7804
- C:\Windows\System\jRVvhRY.exe
  C:\Windows\System\jRVvhRY.exe
  2⤵
  PID:7820
- C:\Windows\System\nRkvosO.exe
  C:\Windows\System\nRkvosO.exe
  2⤵
  PID:7840
- C:\Windows\System\OuIKwWl.exe
  C:\Windows\System\OuIKwWl.exe
  2⤵
  PID:7864
- C:\Windows\System\mRJNcAG.exe
  C:\Windows\System\mRJNcAG.exe
  2⤵
  PID:7880
- C:\Windows\System\GPddRQO.exe
  C:\Windows\System\GPddRQO.exe
  2⤵
  PID:7896
- C:\Windows\System\BzeJYNT.exe
  C:\Windows\System\BzeJYNT.exe
  2⤵
  PID:7912
- C:\Windows\System\LYkcwnX.exe
  C:\Windows\System\LYkcwnX.exe
  2⤵
  PID:7932
- C:\Windows\System\txPGCnJ.exe
  C:\Windows\System\txPGCnJ.exe
  2⤵
  PID:7948
- C:\Windows\System\aIXhtYj.exe
  C:\Windows\System\aIXhtYj.exe
  2⤵
  PID:7964
- C:\Windows\System\MXFWTeA.exe
  C:\Windows\System\MXFWTeA.exe
  2⤵
  PID:7980
- C:\Windows\System\nTGvYwd.exe
  C:\Windows\System\nTGvYwd.exe
  2⤵
  PID:7996
- C:\Windows\System\jfcbFnM.exe
  C:\Windows\System\jfcbFnM.exe
  2⤵
  PID:8020
- C:\Windows\System\DioAhVe.exe
  C:\Windows\System\DioAhVe.exe
  2⤵
  PID:8036
- C:\Windows\System\OMpPPSs.exe
  C:\Windows\System\OMpPPSs.exe
  2⤵
  PID:8056
- C:\Windows\System\PuSNcwX.exe
  C:\Windows\System\PuSNcwX.exe
  2⤵
  PID:8072
- C:\Windows\System\YqXJhLQ.exe
  C:\Windows\System\YqXJhLQ.exe
  2⤵
  PID:8088
- C:\Windows\System\mKUBcAB.exe
  C:\Windows\System\mKUBcAB.exe
  2⤵
  PID:8108
- C:\Windows\System\IwFXBhR.exe
  C:\Windows\System\IwFXBhR.exe
  2⤵
  PID:8140
- C:\Windows\System\TrmEDQg.exe
  C:\Windows\System\TrmEDQg.exe
  2⤵
  PID:8156
- C:\Windows\System\gdiAKEE.exe
  C:\Windows\System\gdiAKEE.exe
  2⤵
  PID:6440
- C:\Windows\System\UzwaFfR.exe
  C:\Windows\System\UzwaFfR.exe
  2⤵
  PID:7184
- C:\Windows\System\IvtRjHD.exe
  C:\Windows\System\IvtRjHD.exe
  2⤵
  PID:6748
- C:\Windows\System\urOVfHl.exe
  C:\Windows\System\urOVfHl.exe
  2⤵
  PID:7220
- C:\Windows\System\WKPlyXR.exe
  C:\Windows\System\WKPlyXR.exe
  2⤵
  PID:7224
- C:\Windows\System\bMVSQfH.exe
  C:\Windows\System\bMVSQfH.exe
  2⤵
  PID:7240
- C:\Windows\System\ghzSNOX.exe
  C:\Windows\System\ghzSNOX.exe
  2⤵
  PID:6204
- C:\Windows\System\MWnpVtu.exe
  C:\Windows\System\MWnpVtu.exe
  2⤵
  PID:7332
- C:\Windows\System\pCCUgYM.exe
  C:\Windows\System\pCCUgYM.exe
  2⤵
  PID:6220
- C:\Windows\System\wCKQaLX.exe
  C:\Windows\System\wCKQaLX.exe
  2⤵
  PID:6216
- C:\Windows\System\egwlNQQ.exe
  C:\Windows\System\egwlNQQ.exe
  2⤵
  PID:7196
- C:\Windows\System\ONTMSzn.exe
  C:\Windows\System\ONTMSzn.exe
  2⤵
  PID:7348
- C:\Windows\System\XXvNQpE.exe
  C:\Windows\System\XXvNQpE.exe
  2⤵
  PID:7400
- C:\Windows\System\ifJXbSD.exe
  C:\Windows\System\ifJXbSD.exe
  2⤵
  PID:7448
- C:\Windows\System\SDWKAPx.exe
  C:\Windows\System\SDWKAPx.exe
  2⤵
  PID:7524
- C:\Windows\System\rsmEEjh.exe
  C:\Windows\System\rsmEEjh.exe
  2⤵
  PID:7388
- C:\Windows\System\KbEVgfM.exe
  C:\Windows\System\KbEVgfM.exe
  2⤵
  PID:7664
- C:\Windows\System\pgvyrfr.exe
  C:\Windows\System\pgvyrfr.exe
  2⤵
  PID:7652
- C:\Windows\System\KVpbUqv.exe
  C:\Windows\System\KVpbUqv.exe
  2⤵
  PID:7700
- C:\Windows\System\hsDoOXM.exe
  C:\Windows\System\hsDoOXM.exe
  2⤵
  PID:7720
- C:\Windows\System\zBNZvvz.exe
  C:\Windows\System\zBNZvvz.exe
  2⤵
  PID:7544
- C:\Windows\System\DKZlZcZ.exe
  C:\Windows\System\DKZlZcZ.exe
  2⤵
  PID:7648
- C:\Windows\System\mbxWRLE.exe
  C:\Windows\System\mbxWRLE.exe
  2⤵
  PID:7684
- C:\Windows\System\VhvAiAO.exe
  C:\Windows\System\VhvAiAO.exe
  2⤵
  PID:7856
- C:\Windows\System\KwDXmbf.exe
  C:\Windows\System\KwDXmbf.exe
  2⤵
  PID:7920
- C:\Windows\System\vWShdwM.exe
  C:\Windows\System\vWShdwM.exe
  2⤵
  PID:8028
- C:\Windows\System\rIDqYbp.exe
  C:\Windows\System\rIDqYbp.exe
  2⤵
  PID:8100
- C:\Windows\System\VROexVu.exe
  C:\Windows\System\VROexVu.exe
  2⤵
  PID:7796
- C:\Windows\System\zpoUnbA.exe
  C:\Windows\System\zpoUnbA.exe
  2⤵
  PID:8116
- C:\Windows\System\lqLEcbS.exe
  C:\Windows\System\lqLEcbS.exe
  2⤵
  PID:8148
- C:\Windows\System\lKoNkcE.exe
  C:\Windows\System\lKoNkcE.exe
  2⤵
  PID:7976
- C:\Windows\System\PtlwjNt.exe
  C:\Windows\System\PtlwjNt.exe
  2⤵
  PID:8012
- C:\Windows\System\BQYrQzF.exe
  C:\Windows\System\BQYrQzF.exe
  2⤵
  PID:8052
- C:\Windows\System\svWyPTi.exe
  C:\Windows\System\svWyPTi.exe
  2⤵
  PID:6652
- C:\Windows\System\ABwQzIW.exe
  C:\Windows\System\ABwQzIW.exe
  2⤵
  PID:7232
- C:\Windows\System\CyeglAY.exe
  C:\Windows\System\CyeglAY.exe
  2⤵
  PID:8188
- C:\Windows\System\oMreREO.exe
  C:\Windows\System\oMreREO.exe
  2⤵
  PID:8128
- C:\Windows\System\viZDlWy.exe
  C:\Windows\System\viZDlWy.exe
  2⤵
  PID:7872
- C:\Windows\System\jKlnpME.exe
  C:\Windows\System\jKlnpME.exe
  2⤵
  PID:7328
- C:\Windows\System\npLLelu.exe
  C:\Windows\System\npLLelu.exe
  2⤵
  PID:7308
- C:\Windows\System\qTsBlKQ.exe
  C:\Windows\System\qTsBlKQ.exe
  2⤵
  PID:7252
- C:\Windows\System\RlXEVNa.exe
  C:\Windows\System\RlXEVNa.exe
  2⤵
  PID:7560
- C:\Windows\System\vmgFPdC.exe
  C:\Windows\System\vmgFPdC.exe
  2⤵
  PID:7540
- C:\Windows\System\SqRijqa.exe
  C:\Windows\System\SqRijqa.exe
  2⤵
  PID:7364
- C:\Windows\System\LOwehOj.exe
  C:\Windows\System\LOwehOj.exe
  2⤵
  PID:7048
- C:\Windows\System\yDfoUCu.exe
  C:\Windows\System\yDfoUCu.exe
  2⤵
  PID:7600
- C:\Windows\System\OjmXMJk.exe
  C:\Windows\System\OjmXMJk.exe
  2⤵
  PID:7584
- C:\Windows\System\OTCKGlP.exe
  C:\Windows\System\OTCKGlP.exe
  2⤵
  PID:7848
- C:\Windows\System\wGDxBiX.exe
  C:\Windows\System\wGDxBiX.exe
  2⤵
  PID:7632
- C:\Windows\System\wnwdKFG.exe
  C:\Windows\System\wnwdKFG.exe
  2⤵
  PID:7960
- C:\Windows\System\BFcewuZ.exe
  C:\Windows\System\BFcewuZ.exe
  2⤵
  PID:7460
- C:\Windows\System\vDNPQJN.exe
  C:\Windows\System\vDNPQJN.exe
  2⤵
  PID:7504
- C:\Windows\System\DpNnETb.exe
  C:\Windows\System\DpNnETb.exe
  2⤵
  PID:7748
- C:\Windows\System\qXaKLKx.exe
  C:\Windows\System\qXaKLKx.exe
  2⤵
  PID:7756
- C:\Windows\System\hwbWjtJ.exe
  C:\Windows\System\hwbWjtJ.exe
  2⤵
  PID:7828
- C:\Windows\System\vZwEqZO.exe
  C:\Windows\System\vZwEqZO.exe
  2⤵
  PID:2200
- C:\Windows\System\iLtZoDT.exe
  C:\Windows\System\iLtZoDT.exe
  2⤵
  PID:7944
- C:\Windows\System\EYXwqtT.exe
  C:\Windows\System\EYXwqtT.exe
  2⤵
  PID:8184
- C:\Windows\System\UodOamH.exe
  C:\Windows\System\UodOamH.exe
  2⤵
  PID:7904
- C:\Windows\System\wlniznI.exe
  C:\Windows\System\wlniznI.exe
  2⤵
  PID:8084
- C:\Windows\System\qtlIIGn.exe
  C:\Windows\System\qtlIIGn.exe
  2⤵
  PID:7344
- C:\Windows\System\IqBSxys.exe
  C:\Windows\System\IqBSxys.exe
  2⤵
  PID:7712
- C:\Windows\System\RXoXpXa.exe
  C:\Windows\System\RXoXpXa.exe
  2⤵
  PID:7304
- C:\Windows\System\IZYRqtd.exe
  C:\Windows\System\IZYRqtd.exe
  2⤵
  PID:7300
- C:\Windows\System\txqcPhl.exe
  C:\Windows\System\txqcPhl.exe
  2⤵
  PID:7508
- C:\Windows\System\ZoUnNHy.exe
  C:\Windows\System\ZoUnNHy.exe
  2⤵
  PID:8080
- C:\Windows\System\XTCnFGP.exe
  C:\Windows\System\XTCnFGP.exe
  2⤵
  PID:8048
- C:\Windows\System\LDQcffn.exe
  C:\Windows\System\LDQcffn.exe
  2⤵
  PID:7268
- C:\Windows\System\DcoeWlC.exe
  C:\Windows\System\DcoeWlC.exe
  2⤵
  PID:8200
- C:\Windows\System\NcnrauK.exe
  C:\Windows\System\NcnrauK.exe
  2⤵
  PID:8216
- C:\Windows\System\yGBdDOj.exe
  C:\Windows\System\yGBdDOj.exe
  2⤵
  PID:8236
- C:\Windows\System\cDubeNv.exe
  C:\Windows\System\cDubeNv.exe
  2⤵
  PID:8252
- C:\Windows\System\fdiNgcM.exe
  C:\Windows\System\fdiNgcM.exe
  2⤵
  PID:8296
- C:\Windows\System\HUDwyMI.exe
  C:\Windows\System\HUDwyMI.exe
  2⤵
  PID:8352
- C:\Windows\System\uEivdtk.exe
  C:\Windows\System\uEivdtk.exe
  2⤵
  PID:8368
- C:\Windows\System\JOOauAg.exe
  C:\Windows\System\JOOauAg.exe
  2⤵
  PID:8384
- C:\Windows\System\lxiBnTa.exe
  C:\Windows\System\lxiBnTa.exe
  2⤵
  PID:8400
- C:\Windows\System\GSVrBtv.exe
  C:\Windows\System\GSVrBtv.exe
  2⤵
  PID:8416
- C:\Windows\System\htEURlg.exe
  C:\Windows\System\htEURlg.exe
  2⤵
  PID:8432
- C:\Windows\System\QOGrIQm.exe
  C:\Windows\System\QOGrIQm.exe
  2⤵
  PID:8448
- C:\Windows\System\DbIxkIw.exe
  C:\Windows\System\DbIxkIw.exe
  2⤵
  PID:8472
- C:\Windows\System\ShoGKfj.exe
  C:\Windows\System\ShoGKfj.exe
  2⤵
  PID:8492
- C:\Windows\System\TEcbWOH.exe
  C:\Windows\System\TEcbWOH.exe
  2⤵
  PID:8508
- C:\Windows\System\lScVEHM.exe
  C:\Windows\System\lScVEHM.exe
  2⤵
  PID:8524
- C:\Windows\System\amoIelB.exe
  C:\Windows\System\amoIelB.exe
  2⤵
  PID:8540
- C:\Windows\System\tYDvyyH.exe
  C:\Windows\System\tYDvyyH.exe
  2⤵
  PID:8556
- C:\Windows\System\qJCvwZV.exe
  C:\Windows\System\qJCvwZV.exe
  2⤵
  PID:8576
- C:\Windows\System\AixuERw.exe
  C:\Windows\System\AixuERw.exe
  2⤵
  PID:8592
- C:\Windows\System\JTFlaNf.exe
  C:\Windows\System\JTFlaNf.exe
  2⤵
  PID:8608
- C:\Windows\System\IsuTjdm.exe
  C:\Windows\System\IsuTjdm.exe
  2⤵
  PID:8624
- C:\Windows\System\siaerDI.exe
  C:\Windows\System\siaerDI.exe
  2⤵
  PID:8640
- C:\Windows\System\oeFebaS.exe
  C:\Windows\System\oeFebaS.exe
  2⤵
  PID:8656
- C:\Windows\System\cnysneL.exe
  C:\Windows\System\cnysneL.exe
  2⤵
  PID:8672
- C:\Windows\System\JCykXzo.exe
  C:\Windows\System\JCykXzo.exe
  2⤵
  PID:8688
- C:\Windows\System\FUEbduD.exe
  C:\Windows\System\FUEbduD.exe
  2⤵
  PID:8704
- C:\Windows\System\EUYwIck.exe
  C:\Windows\System\EUYwIck.exe
  2⤵
  PID:8720
- C:\Windows\System\wpLsISS.exe
  C:\Windows\System\wpLsISS.exe
  2⤵
  PID:8736
- C:\Windows\System\mmlEnVv.exe
  C:\Windows\System\mmlEnVv.exe
  2⤵
  PID:8752
- C:\Windows\System\ZFbNTGt.exe
  C:\Windows\System\ZFbNTGt.exe
  2⤵
  PID:8768
- C:\Windows\System\nhFtBAT.exe
  C:\Windows\System\nhFtBAT.exe
  2⤵
  PID:8788
- C:\Windows\System\mHezjId.exe
  C:\Windows\System\mHezjId.exe
  2⤵
  PID:8804
- C:\Windows\System\ZJmBIBW.exe
  C:\Windows\System\ZJmBIBW.exe
  2⤵
  PID:8824
- C:\Windows\System\nptSSjI.exe
  C:\Windows\System\nptSSjI.exe
  2⤵
  PID:8840
- C:\Windows\System\zsSqvVT.exe
  C:\Windows\System\zsSqvVT.exe
  2⤵
  PID:8856
- C:\Windows\System\cKhUuja.exe
  C:\Windows\System\cKhUuja.exe
  2⤵
  PID:8872
- C:\Windows\System\AEIfmgY.exe
  C:\Windows\System\AEIfmgY.exe
  2⤵
  PID:8888
- C:\Windows\System\uVyVbyX.exe
  C:\Windows\System\uVyVbyX.exe
  2⤵
  PID:8904
- C:\Windows\System\bJKQFav.exe
  C:\Windows\System\bJKQFav.exe
  2⤵
  PID:8920
- C:\Windows\System\FLeEYwN.exe
  C:\Windows\System\FLeEYwN.exe
  2⤵
  PID:8940
- C:\Windows\System\aPcLoag.exe
  C:\Windows\System\aPcLoag.exe
  2⤵
  PID:8956
- C:\Windows\System\iRZzfvl.exe
  C:\Windows\System\iRZzfvl.exe
  2⤵
  PID:8972
- C:\Windows\System\dxYkXkq.exe
  C:\Windows\System\dxYkXkq.exe
  2⤵
  PID:8988
- C:\Windows\System\TETJkyS.exe
  C:\Windows\System\TETJkyS.exe
  2⤵
  PID:9004
- C:\Windows\System\WObCEQV.exe
  C:\Windows\System\WObCEQV.exe
  2⤵
  PID:9020
- C:\Windows\System\KRgWoAA.exe
  C:\Windows\System\KRgWoAA.exe
  2⤵
  PID:9036
- C:\Windows\System\XhASedG.exe
  C:\Windows\System\XhASedG.exe
  2⤵
  PID:9052
- C:\Windows\System\bomWeHz.exe
  C:\Windows\System\bomWeHz.exe
  2⤵
  PID:9068
- C:\Windows\System\wbcloUA.exe
  C:\Windows\System\wbcloUA.exe
  2⤵
  PID:9084
- C:\Windows\System\fsiHIOZ.exe
  C:\Windows\System\fsiHIOZ.exe
  2⤵
  PID:9100
- C:\Windows\System\xVlgoek.exe
  C:\Windows\System\xVlgoek.exe
  2⤵
  PID:9116
- C:\Windows\System\GGTtNdZ.exe
  C:\Windows\System\GGTtNdZ.exe
  2⤵
  PID:9132
- C:\Windows\System\mhIQNTj.exe
  C:\Windows\System\mhIQNTj.exe
  2⤵
  PID:9148
- C:\Windows\System\IagbmSI.exe
  C:\Windows\System\IagbmSI.exe
  2⤵
  PID:9164
- C:\Windows\System\pHZHjjP.exe
  C:\Windows\System\pHZHjjP.exe
  2⤵
  PID:9180
- C:\Windows\System\mKilYgm.exe
  C:\Windows\System\mKilYgm.exe
  2⤵
  PID:9196
- C:\Windows\System\kvmavFB.exe
  C:\Windows\System\kvmavFB.exe
  2⤵
  PID:9212
- C:\Windows\System\GBpTrCf.exe
  C:\Windows\System\GBpTrCf.exe
  2⤵
  PID:7528
- C:\Windows\System\GZZIlay.exe
  C:\Windows\System\GZZIlay.exe
  2⤵
  PID:8124
- C:\Windows\System\JFvOzvx.exe
  C:\Windows\System\JFvOzvx.exe
  2⤵
  PID:7032
- C:\Windows\System\ZRSxMpi.exe
  C:\Windows\System\ZRSxMpi.exe
  2⤵
  PID:8248
- C:\Windows\System\tUvrDyo.exe
  C:\Windows\System\tUvrDyo.exe
  2⤵
  PID:7052
- C:\Windows\System\gqokEYz.exe
  C:\Windows\System\gqokEYz.exe
  2⤵
  PID:8176
- C:\Windows\System\CYxmazI.exe
  C:\Windows\System\CYxmazI.exe
  2⤵
  PID:6352
- C:\Windows\System\KZUqNhm.exe
  C:\Windows\System\KZUqNhm.exe
  2⤵
  PID:7732
- C:\Windows\System\fKJxPvC.exe
  C:\Windows\System\fKJxPvC.exe
  2⤵
  PID:6880
- C:\Windows\System\LpjwjMw.exe
  C:\Windows\System\LpjwjMw.exe
  2⤵
  PID:8260
- C:\Windows\System\qHvCjOH.exe
  C:\Windows\System\qHvCjOH.exe
  2⤵
  PID:8284
- C:\Windows\System\yPhpFXc.exe
  C:\Windows\System\yPhpFXc.exe
  2⤵
  PID:7644
- C:\Windows\System\YKTgeOm.exe
  C:\Windows\System\YKTgeOm.exe
  2⤵
  PID:7480
- C:\Windows\System\JeaMTfU.exe
  C:\Windows\System\JeaMTfU.exe
  2⤵
  PID:8180
- C:\Windows\System\GEQIJMh.exe
  C:\Windows\System\GEQIJMh.exe
  2⤵
  PID:8292
- C:\Windows\System\wOjhyzh.exe
  C:\Windows\System\wOjhyzh.exe
  2⤵
  PID:8316
- C:\Windows\System\aqQDxoX.exe
  C:\Windows\System\aqQDxoX.exe
  2⤵
  PID:8332
- C:\Windows\System\YJVNbVE.exe
  C:\Windows\System\YJVNbVE.exe
  2⤵
  PID:8348
- C:\Windows\System\oKOxHHU.exe
  C:\Windows\System\oKOxHHU.exe
  2⤵
  PID:8360
- C:\Windows\System\OaJfcdG.exe
  C:\Windows\System\OaJfcdG.exe
  2⤵
  PID:8532
- C:\Windows\System\SYKiItd.exe
  C:\Windows\System\SYKiItd.exe
  2⤵
  PID:8464
- C:\Windows\System\BInXnTi.exe
  C:\Windows\System\BInXnTi.exe
  2⤵
  PID:8536
- C:\Windows\System\uxSbGnz.exe
  C:\Windows\System\uxSbGnz.exe
  2⤵
  PID:8588
- C:\Windows\System\iAJMADX.exe
  C:\Windows\System\iAJMADX.exe
  2⤵
  PID:9092
- C:\Windows\System\BjXIQNR.exe
  C:\Windows\System\BjXIQNR.exe
  2⤵
  PID:8212
- C:\Windows\System\SppHqRD.exe
  C:\Windows\System\SppHqRD.exe
  2⤵
  PID:7236
- C:\Windows\System\VSbOAPD.exe
  C:\Windows\System\VSbOAPD.exe
  2⤵
  PID:8064
- C:\Windows\System\KFMSbHE.exe
  C:\Windows\System\KFMSbHE.exe
  2⤵
  PID:8228
- C:\Windows\System\vHtVKzl.exe
  C:\Windows\System\vHtVKzl.exe
  2⤵
  PID:7288
- C:\Windows\System\MaJEPBt.exe
  C:\Windows\System\MaJEPBt.exe
  2⤵
  PID:8280
- C:\Windows\System\fqnmDcs.exe
  C:\Windows\System\fqnmDcs.exe
  2⤵
  PID:7776
- C:\Windows\System\WMFfDAg.exe
  C:\Windows\System\WMFfDAg.exe
  2⤵
  PID:8344
- C:\Windows\System\rWNCQTe.exe
  C:\Windows\System\rWNCQTe.exe
  2⤵
  PID:7412
- C:\Windows\System\IgjSVzc.exe
  C:\Windows\System\IgjSVzc.exe
  2⤵
  PID:8380
- C:\Windows\System\KLrRzfC.exe
  C:\Windows\System\KLrRzfC.exe
  2⤵
  PID:8484
- C:\Windows\System\htNipqa.exe
  C:\Windows\System\htNipqa.exe
  2⤵
  PID:8520
- C:\Windows\System\brhVbLB.exe
  C:\Windows\System\brhVbLB.exe
  2⤵
  PID:8616
- C:\Windows\System\UklnMGh.exe
  C:\Windows\System\UklnMGh.exe
  2⤵
  PID:8632
- C:\Windows\System\GoMCtsS.exe
  C:\Windows\System\GoMCtsS.exe
  2⤵
  PID:8668
- C:\Windows\System\YUXGiUT.exe
  C:\Windows\System\YUXGiUT.exe
  2⤵
  PID:8744
- C:\Windows\System\PuHKFbi.exe
  C:\Windows\System\PuHKFbi.exe
  2⤵
  PID:8760
- C:\Windows\System\tpjZMcF.exe
  C:\Windows\System\tpjZMcF.exe
  2⤵
  PID:8784
- C:\Windows\System\LMHAiRH.exe
  C:\Windows\System\LMHAiRH.exe
  2⤵
  PID:8820
- C:\Windows\System\vuXaqHi.exe
  C:\Windows\System\vuXaqHi.exe
  2⤵
  PID:8852
- C:\Windows\System\gGvHwql.exe
  C:\Windows\System\gGvHwql.exe
  2⤵
  PID:8952
- C:\Windows\System\dzdDObb.exe
  C:\Windows\System\dzdDObb.exe
  2⤵
  PID:8836
- C:\Windows\System\ldYcTBR.exe
  C:\Windows\System\ldYcTBR.exe
  2⤵
  PID:8832
- C:\Windows\System\qAwlPfU.exe
  C:\Windows\System\qAwlPfU.exe
  2⤵
  PID:7780
- C:\Windows\System\TCxQfzl.exe
  C:\Windows\System\TCxQfzl.exe
  2⤵
  PID:8900
- C:\Windows\System\ylUVcDD.exe
  C:\Windows\System\ylUVcDD.exe
  2⤵
  PID:8996
- C:\Windows\System\OhLRFsJ.exe
  C:\Windows\System\OhLRFsJ.exe
  2⤵
  PID:9028
- C:\Windows\System\pRHPxJs.exe
  C:\Windows\System\pRHPxJs.exe
  2⤵
  PID:9128
- C:\Windows\System\XesogRI.exe
  C:\Windows\System\XesogRI.exe
  2⤵
  PID:9188
- C:\Windows\System\fWTiOqC.exe
  C:\Windows\System\fWTiOqC.exe
  2⤵
  PID:7628
- C:\Windows\System\tXpUMDQ.exe
  C:\Windows\System\tXpUMDQ.exe
  2⤵
  PID:8196
- C:\Windows\System\AqWjCJk.exe
  C:\Windows\System\AqWjCJk.exe
  2⤵
  PID:8340
- C:\Windows\System\lcykApQ.exe
  C:\Windows\System\lcykApQ.exe
  2⤵
  PID:8408
- C:\Windows\System\umZyKvE.exe
  C:\Windows\System\umZyKvE.exe
  2⤵
  PID:8460
- C:\Windows\System\BhuJcMm.exe
  C:\Windows\System\BhuJcMm.exe
  2⤵
  PID:8604
- C:\Windows\System\oWidSeS.exe
  C:\Windows\System\oWidSeS.exe
  2⤵
  PID:8664
- C:\Windows\System\yphDdtx.exe
  C:\Windows\System\yphDdtx.exe
  2⤵
  PID:8728
- C:\Windows\System\HJvpWNu.exe
  C:\Windows\System\HJvpWNu.exe
  2⤵
  PID:8800
- C:\Windows\System\EMfdsTX.exe
  C:\Windows\System\EMfdsTX.exe
  2⤵
  PID:9012
- C:\Windows\System\HqywQTb.exe
  C:\Windows\System\HqywQTb.exe
  2⤵
  PID:9176
- C:\Windows\System\LjCYXQv.exe
  C:\Windows\System\LjCYXQv.exe
  2⤵
  PID:8796
- C:\Windows\System\myVukHR.exe
  C:\Windows\System\myVukHR.exe
  2⤵
  PID:9112
- C:\Windows\System\yoabxzl.exe
  C:\Windows\System\yoabxzl.exe
  2⤵
  PID:8816
- C:\Windows\System\mGxbGwS.exe
  C:\Windows\System\mGxbGwS.exe
  2⤵
  PID:8272
- C:\Windows\System\cXKmZxf.exe
  C:\Windows\System\cXKmZxf.exe
  2⤵
  PID:8328
- C:\Windows\System\mcQoInD.exe
  C:\Windows\System\mcQoInD.exe
  2⤵
  PID:8244
- C:\Windows\System\rBQcqwP.exe
  C:\Windows\System\rBQcqwP.exe
  2⤵
  PID:8396
- C:\Windows\System\soIIoDk.exe
  C:\Windows\System\soIIoDk.exe
  2⤵
  PID:8564
- C:\Windows\System\tideBmA.exe
  C:\Windows\System\tideBmA.exe
  2⤵
  PID:8652
- C:\Windows\System\UxQgoID.exe
  C:\Windows\System\UxQgoID.exe
  2⤵
  PID:8780
- C:\Windows\System\QIqgEgS.exe
  C:\Windows\System\QIqgEgS.exe
  2⤵
  PID:6472
- C:\Windows\System\IwoGGYD.exe
  C:\Windows\System\IwoGGYD.exe
  2⤵
  PID:8732
- C:\Windows\System\FikUymF.exe
  C:\Windows\System\FikUymF.exe
  2⤵
  PID:9064
- C:\Windows\System\UWTLKXU.exe
  C:\Windows\System\UWTLKXU.exe
  2⤵
  PID:8968
- C:\Windows\System\ZxmyoiF.exe
  C:\Windows\System\ZxmyoiF.exe
  2⤵
  PID:8232
- C:\Windows\System\YxtmHRP.exe
  C:\Windows\System\YxtmHRP.exe
  2⤵
  PID:8648
- C:\Windows\System\SjtyaZU.exe
  C:\Windows\System\SjtyaZU.exe
  2⤵
  PID:8928
- C:\Windows\System\eqnRKST.exe
  C:\Windows\System\eqnRKST.exe
  2⤵
  PID:8984
- C:\Windows\System\dVduTLa.exe
  C:\Windows\System\dVduTLa.exe
  2⤵
  PID:7772
- C:\Windows\System\PKYxPQg.exe
  C:\Windows\System\PKYxPQg.exe
  2⤵
  PID:8444
- C:\Windows\System\fGTIOkH.exe
  C:\Windows\System\fGTIOkH.exe
  2⤵
  PID:8516
- C:\Windows\System\hpTREBA.exe
  C:\Windows\System\hpTREBA.exe
  2⤵
  PID:8712
- C:\Windows\System\dyEImwO.exe
  C:\Windows\System\dyEImwO.exe
  2⤵
  PID:8276
- C:\Windows\System\GFuYGBv.exe
  C:\Windows\System\GFuYGBv.exe
  2⤵
  PID:8700
- C:\Windows\System\pdWhLGP.exe
  C:\Windows\System\pdWhLGP.exe
  2⤵
  PID:9192
- C:\Windows\System\ZRNqASv.exe
  C:\Windows\System\ZRNqASv.exe
  2⤵
  PID:8504
- C:\Windows\System\ohXVdMN.exe
  C:\Windows\System\ohXVdMN.exe
  2⤵
  PID:8912
- C:\Windows\System\kiuyFfE.exe
  C:\Windows\System\kiuyFfE.exe
  2⤵
  PID:8948
- C:\Windows\System\oxuqGes.exe
  C:\Windows\System\oxuqGes.exe
  2⤵
  PID:9228
- C:\Windows\System\vZzuBSz.exe
  C:\Windows\System\vZzuBSz.exe
  2⤵
  PID:9248
- C:\Windows\System\tbzwnDZ.exe
  C:\Windows\System\tbzwnDZ.exe
  2⤵
  PID:9264
- C:\Windows\System\eUvpaQE.exe
  C:\Windows\System\eUvpaQE.exe
  2⤵
  PID:9284
- C:\Windows\System\sMvedtL.exe
  C:\Windows\System\sMvedtL.exe
  2⤵
  PID:9304
- C:\Windows\System\VrFHCJF.exe
  C:\Windows\System\VrFHCJF.exe
  2⤵
  PID:9324
- C:\Windows\System\dbcEsWB.exe
  C:\Windows\System\dbcEsWB.exe
  2⤵
  PID:9344
- C:\Windows\System\IHWxdEB.exe
  C:\Windows\System\IHWxdEB.exe
  2⤵
  PID:9360
- C:\Windows\System\wPunPQW.exe
  C:\Windows\System\wPunPQW.exe
  2⤵
  PID:9376
- C:\Windows\System\NmSCBOj.exe
  C:\Windows\System\NmSCBOj.exe
  2⤵
  PID:9412
- C:\Windows\System\BmhMbng.exe
  C:\Windows\System\BmhMbng.exe
  2⤵
  PID:9432
- C:\Windows\System\WajZFeB.exe
  C:\Windows\System\WajZFeB.exe
  2⤵
  PID:9448
- C:\Windows\System\TcWbGpg.exe
  C:\Windows\System\TcWbGpg.exe
  2⤵
  PID:9472
- C:\Windows\System\hQjCFbc.exe
  C:\Windows\System\hQjCFbc.exe
  2⤵
  PID:9488
- C:\Windows\System\GBqsotv.exe
  C:\Windows\System\GBqsotv.exe
  2⤵
  PID:9504
- C:\Windows\System\KHelsle.exe
  C:\Windows\System\KHelsle.exe
  2⤵
  PID:9524
- C:\Windows\System\MNzEIyt.exe
  C:\Windows\System\MNzEIyt.exe
  2⤵
  PID:9540
- C:\Windows\System\yABeMKC.exe
  C:\Windows\System\yABeMKC.exe
  2⤵
  PID:9576
- C:\Windows\System\ngRnyqq.exe
  C:\Windows\System\ngRnyqq.exe
  2⤵
  PID:9596
- C:\Windows\System\jDDJPWZ.exe
  C:\Windows\System\jDDJPWZ.exe
  2⤵
  PID:9612
- C:\Windows\System\bmXuSYI.exe
  C:\Windows\System\bmXuSYI.exe
  2⤵
  PID:9632
- C:\Windows\System\FLARNlo.exe
  C:\Windows\System\FLARNlo.exe
  2⤵
  PID:9648
- C:\Windows\System\JaIrNfD.exe
  C:\Windows\System\JaIrNfD.exe
  2⤵
  PID:9664
- C:\Windows\System\AHRZrPp.exe
  C:\Windows\System\AHRZrPp.exe
  2⤵
  PID:9696
- C:\Windows\System\JdbiMKe.exe
  C:\Windows\System\JdbiMKe.exe
  2⤵
  PID:9712
- C:\Windows\System\YsgLxtp.exe
  C:\Windows\System\YsgLxtp.exe
  2⤵
  PID:9728
- C:\Windows\System\FtsAqSe.exe
  C:\Windows\System\FtsAqSe.exe
  2⤵
  PID:9744
- C:\Windows\System\eSGYAmd.exe
  C:\Windows\System\eSGYAmd.exe
  2⤵
  PID:9760
- C:\Windows\System\PvPStJq.exe
  C:\Windows\System\PvPStJq.exe
  2⤵
  PID:9780
- C:\Windows\System\YREPELo.exe
  C:\Windows\System\YREPELo.exe
  2⤵
  PID:9820
- C:\Windows\System\VXOaGCp.exe
  C:\Windows\System\VXOaGCp.exe
  2⤵
  PID:9836
- C:\Windows\System\GvUDFSg.exe
  C:\Windows\System\GvUDFSg.exe
  2⤵
  PID:9856
- C:\Windows\System\OmaylMw.exe
  C:\Windows\System\OmaylMw.exe
  2⤵
  PID:9876
- C:\Windows\System\IPrEHJk.exe
  C:\Windows\System\IPrEHJk.exe
  2⤵
  PID:9892
- C:\Windows\System\NInXIwR.exe
  C:\Windows\System\NInXIwR.exe
  2⤵
  PID:9908
- C:\Windows\System\IGhBuhi.exe
  C:\Windows\System\IGhBuhi.exe
  2⤵
  PID:9936
- C:\Windows\System\QRVSaba.exe
  C:\Windows\System\QRVSaba.exe
  2⤵
  PID:9952
- C:\Windows\System\VFdGoLd.exe
  C:\Windows\System\VFdGoLd.exe
  2⤵
  PID:9968
- C:\Windows\System\jqiuRNv.exe
  C:\Windows\System\jqiuRNv.exe
  2⤵
  PID:9988
- C:\Windows\System\zGMaNdA.exe
  C:\Windows\System\zGMaNdA.exe
  2⤵
  PID:10004
- C:\Windows\System\CLdYfva.exe
  C:\Windows\System\CLdYfva.exe
  2⤵
  PID:10020
- C:\Windows\System\bamVWXi.exe
  C:\Windows\System\bamVWXi.exe
  2⤵
  PID:10036
- C:\Windows\System\HsDliNs.exe
  C:\Windows\System\HsDliNs.exe
  2⤵
  PID:10080
- C:\Windows\System\RITNrte.exe
  C:\Windows\System\RITNrte.exe
  2⤵
  PID:10096
- C:\Windows\System\TNefpLx.exe
  C:\Windows\System\TNefpLx.exe
  2⤵
  PID:10116
- C:\Windows\System\jvQDKzv.exe
  C:\Windows\System\jvQDKzv.exe
  2⤵
  PID:10132
- C:\Windows\System\bqBrDdw.exe
  C:\Windows\System\bqBrDdw.exe
  2⤵
  PID:10152
- C:\Windows\System\QikkUqF.exe
  C:\Windows\System\QikkUqF.exe
  2⤵
  PID:10168
- C:\Windows\System\YbUCDSh.exe
  C:\Windows\System\YbUCDSh.exe
  2⤵
  PID:10184
- C:\Windows\System\QZFnYRr.exe
  C:\Windows\System\QZFnYRr.exe
  2⤵
  PID:10224
- C:\Windows\System\qLKyTiy.exe
  C:\Windows\System\qLKyTiy.exe
  2⤵
  PID:9236
- C:\Windows\System\KYmWJHO.exe
  C:\Windows\System\KYmWJHO.exe
  2⤵
  PID:9272
- C:\Windows\System\SsnyCzV.exe
  C:\Windows\System\SsnyCzV.exe
  2⤵
  PID:9260
- C:\Windows\System\WwIUOKz.exe
  C:\Windows\System\WwIUOKz.exe
  2⤵
  PID:9356
- C:\Windows\System\OLpwqBv.exe
  C:\Windows\System\OLpwqBv.exe
  2⤵
  PID:9292
- C:\Windows\System\ASQvhhR.exe
  C:\Windows\System\ASQvhhR.exe
  2⤵
  PID:9388
- C:\Windows\System\DanBlWv.exe
  C:\Windows\System\DanBlWv.exe
  2⤵
  PID:9428
- C:\Windows\System\CGIgcdZ.exe
  C:\Windows\System\CGIgcdZ.exe
  2⤵
  PID:9456
- C:\Windows\System\qgosvtb.exe
  C:\Windows\System\qgosvtb.exe
  2⤵
  PID:9480
- C:\Windows\System\noeeEaB.exe
  C:\Windows\System\noeeEaB.exe
  2⤵
  PID:9516
- C:\Windows\System\aqqcgeR.exe
  C:\Windows\System\aqqcgeR.exe
  2⤵
  PID:9532
- C:\Windows\System\XPMoGtc.exe
  C:\Windows\System\XPMoGtc.exe
  2⤵
  PID:9592
- C:\Windows\System\kLsAfCH.exe
  C:\Windows\System\kLsAfCH.exe
  2⤵
  PID:9620
- C:\Windows\System\GGpWVQk.exe
  C:\Windows\System\GGpWVQk.exe
  2⤵
  PID:9672
- C:\Windows\System\gFLidVv.exe
  C:\Windows\System\gFLidVv.exe
  2⤵
  PID:9684
- C:\Windows\System\HNFxZYl.exe
  C:\Windows\System\HNFxZYl.exe
  2⤵
  PID:9708
- C:\Windows\System\FGiwWcY.exe
  C:\Windows\System\FGiwWcY.exe
  2⤵
  PID:9756
- C:\Windows\System\UFvlajm.exe
  C:\Windows\System\UFvlajm.exe
  2⤵
  PID:9796
- C:\Windows\System\tWyecxj.exe
  C:\Windows\System\tWyecxj.exe
  2⤵
  PID:9816
- C:\Windows\System\tXuvIPw.exe
  C:\Windows\System\tXuvIPw.exe
  2⤵
  PID:9848
- C:\Windows\System\QAyCzrj.exe
  C:\Windows\System\QAyCzrj.exe
  2⤵
  PID:9888
- C:\Windows\System\KxIAkTn.exe
  C:\Windows\System\KxIAkTn.exe
  2⤵
  PID:9868
- C:\Windows\System\rECoYwU.exe
  C:\Windows\System\rECoYwU.exe
  2⤵
  PID:9964
- C:\Windows\System\bQtdwrP.exe
  C:\Windows\System\bQtdwrP.exe
  2⤵
  PID:10032
- C:\Windows\System\lhGwZab.exe
  C:\Windows\System\lhGwZab.exe
  2⤵
  PID:9948
- C:\Windows\System\qxxzIYE.exe
  C:\Windows\System\qxxzIYE.exe
  2⤵
  PID:10060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADotOpq.exe

Filesize
1.6MB

MD5
9edbed55c5042a0bfebc27cacd0893a8

SHA1
3299e56184d6d24d197c46c86a25a5792768abeb

SHA256
643ba85aca8eef362b10cfe7559d41866ab8b503dd5b6a2bb564061da48e7c29

SHA512
4c6306f5548b1ae9caf3b4989c05abd77d5abeff2c18821fbe6d385114001c673954873ef114543fdb548a5fb534db6588d211a4db5e0a6addc1f78efec12962

Download Submit
C:\Windows\system\BYbyLiS.exe

Filesize
1.6MB

MD5
d1ef794c43b15d1829aa00797e0eb0af

SHA1
55661a15509e550077cc635625acc83fa1c1f98b

SHA256
c7ae7fb869ef90eff266be94568fd97e03ee4ca4611dbf95571db9d039dd2562

SHA512
1702051465361aa775bf8595e4d47d846c3de5e60a598ee39c4a06fe6594c7cfdce824f5f6b8eec1104ef4d50a53306d36755bf782129cf5016daa1edeb4a6c4

Download Submit
C:\Windows\system\CksOtZW.exe

Filesize
1.6MB

MD5
02ea94b91172d771b434463061f2017b

SHA1
b6a1712cfa4d2a91870ae95df3b73b6581aec9d6

SHA256
4565a6c121c0321ae6827e9f09b066b2722cf0356d3887ac844461a4c7e547b6

SHA512
440fc65e4a2391635dd03ee825c376d5de09e1d25bb2790661ebfde48165568908a37240bc40a82ef29ade1ef92e55db3f45dee36f4a709b75a2230dc4fc55a0

Download Submit
C:\Windows\system\DlvybiQ.exe

Filesize
1.6MB

MD5
e69a8788a3433fcc7d2e9060d6dd832e

SHA1
9a8317bded1a9098ebd3d6f5eaff5800395c4a8f

SHA256
46f71a7c1157261e1057c8300433587479f65468cba3369cc07fe3ee7126b6fd

SHA512
7fdfa036a89594a493a8cd5d60d477c2cf53666959cf4607330db0369b6d758e715db80a904742399464792ff30505ab3701eca1ee77631344b7042f97d4fc71

Download Submit
C:\Windows\system\EeOmvLm.exe

Filesize
1.6MB

MD5
a79b9beb3a8270a21b6376acfd0b175f

SHA1
dce99b5cf7b702dd2c3a30a02f40e1123309db28

SHA256
d3a7ebb26ee6173ba1094e4ff81a47961967672d9d3cbaf4766178cc2a3882a4

SHA512
596ebfabf7769da37c8bf902eb03ca6825b2a92019d7c5e4e91305fe13bbc745ef99763e36e8818f740efd0bc6df3c2f9f2ee4b501b20a396ad11f835728be8a

Download Submit
C:\Windows\system\EuwrwAm.exe

Filesize
1.6MB

MD5
09ead1c008a1e4726a7162f7cf518565

SHA1
7ce40e7b2693b66a29689418a37e5972642dfe96

SHA256
32ed15d465b2b1362ed8dbba201ae2e552302359202954eb2304ebb84b0bb3c9

SHA512
5d1954b257b266bf4d74055129870a2abe6c500bf8a9cf00b24c2486008fc39d37ca538c3de9c8e8bda4d9423f21c14ad21ec84810f643db1a91950521fce319

Download Submit
C:\Windows\system\FNrmeGp.exe

Filesize
1.6MB

MD5
1e638f29762965b6344942a6307c77f3

SHA1
068cc9dad750501274bf9cfaf414c9e2c274bc47

SHA256
bd9590517cc154599c5f8b976cfd034c669a65d4dc47c1c18653108eba909db8

SHA512
1d59689770b2e815231294e008c7b726bffcbe29bc4e5ee6c3322d125a03df05932d78606cf9690e51b27d6bd5706ce327808506d624f027a81483fef14cb503

Download Submit
C:\Windows\system\GFUJfGS.exe

Filesize
1.6MB

MD5
f684374a975c8685e1e5cb92111df0da

SHA1
fc0e977d28be564557cd06937b0d22cdc7f58571

SHA256
620af1bc76fbb377a58a2559890e025a93281da19c49ae87022359b30b3f4557

SHA512
48942f3d149883cd4c02c97aa3f524e1876b4d5014f7368ed6b794c9c4fdbdae03941e7327b7e80ea4444aec356322ec7d547c4cde548b4e8077e137787f16ce

Download Submit
C:\Windows\system\JVKoPWE.exe

Filesize
1.6MB

MD5
9750dc16db3902a592be5b5fc7f636fd

SHA1
698d6105a3e07068b923d17305496c75808d514b

SHA256
6a0e1288821ab33655507a55f27e9e6e62f51d2e6b9230d7b88333609cb11f8c

SHA512
4ccc7ef51c5d7bff81f3482a085b17410acfa52deeaf44c3768c6c5c5643cf95ced78ce8d4179eefff54037ce5be268369b801b24f5e2b9a2476c1469ec39bf1

Download Submit
C:\Windows\system\LOwKHPd.exe

Filesize
1.6MB

MD5
0368e7dbd6093b66ff7245773c468362

SHA1
c75f6e2afba650e70c360566186cb246bee6cea0

SHA256
d64e093915a1455e010699f501ac948b63c37f9fc4c3614091f1c7978740bbc4

SHA512
f2f374129f493bce93294dcb04e2eccdbb111db607fee597e38c93360206125d71489c09e25713cd5738df1bcd8c8d678b33a1099491703d5f8a187f3ed37624

Download Submit
C:\Windows\system\PQOpxvY.exe

Filesize
1.6MB

MD5
d11b645494494574b90058c107159cc4

SHA1
800e197603267946a13704804163edb9872f2913

SHA256
6058877b6d5ac6563a72688e7f192577c40ae42452358a41486354f709d71f25

SHA512
4d5e3397698713cc4b3bd8d97be22ed5afda169667549af9cd299ee7145563477ec0f8287ce55eed4b09025796378b5c7076fae291249658e21720808b7b1a91

Download Submit
C:\Windows\system\PqSsZxd.exe

Filesize
1.6MB

MD5
44207811c92ac724157bc238df799934

SHA1
18eee58b5abb91f47387165463cd7a0c46e9702a

SHA256
498dfb6c144a782ff0b28c3cc55c0faf5f01f89cb44c1f4e5b181ec73dc0a118

SHA512
165d92b7a76f49764c38dfc5dc3e80ea43108c484c0b6da82d46d1f76f5b79e63692b6874f154b4cb5bbe875e86c860b2649ba80e0d0a757579683dea975313c

Download Submit
C:\Windows\system\QFcOWjS.exe

Filesize
1.6MB

MD5
93499cb6e577eb0652c1d203b79f853b

SHA1
6e65c7652655dfa81531a84839889aa0084c5a32

SHA256
b10831672e7ea23b4cc9c45476fb9f7c3ccb0bf8a037d3c144e9aefd0521064f

SHA512
e3907498349205646648c7b78b924127d6a2921cb5271f74529f529ea39b258308e00947c722f938cea814b12b27cd6f808f78c1354beeb3d64cb4c786c128e3

Download Submit
C:\Windows\system\SZywlQb.exe

Filesize
1.6MB

MD5
8abd144016d744193ffb106182e0649e

SHA1
fe45d8959bb7a92a602065978ba96be155fd3f36

SHA256
1e87afdb25a0ba23feeb1f04a08192f87717f35176e3748aa3932edc5bcad744

SHA512
962664caaf5e3551f0d1ae397dbc5f96197c35552e0ea927adf0878db27b6c9c2d702a061f3416062f0be0b3b4fc00e48b1747cb1e533b5ae781b9b6a5767bea

Download Submit
C:\Windows\system\ScyMJyN.exe

Filesize
1.6MB

MD5
8029568f0a46e95f257b4bd2cba3864d

SHA1
cd0c95a122c18e00866159f7896e053ac4a07c29

SHA256
ae1c9e623d8c7cfbf036c549d7abe94af97fcc2c7ada0b1c3775050c994bf55d

SHA512
bce14b186955f19ce4032a6535b88f6043cf621321b457ca427d1ac185693f8fa179dab8db0b9411a83a2b4347248c8080b34a8e00d0dab7833283c1ed88b88e

Download Submit
C:\Windows\system\TAVlFjM.exe

Filesize
1.6MB

MD5
803e765db6c05ac41b29a3f6213a3421

SHA1
05a0f0e5a4d12812e76755180461606c68c822ae

SHA256
d13a91e5666c7fdc9df178c7d55b124d48edc8d4df37fdfea5dde43b0359aaef

SHA512
3628f4457f5223ffafc20a3d1d59ae2f0fbfc7d121c4bf7e2fbc2ca58c4b9dd7c78211fb0da03b8e2afbbe914e13d6c7ee14e5e45a279a0d02b3419a3b5866f5

Download Submit
C:\Windows\system\UHFqDlV.exe

Filesize
1.6MB

MD5
fbe94a96b4e9dd71373cc533506d0ff1

SHA1
4be6fe26e2718b944269123a9590a1a68c62aee8

SHA256
803bc89a9342d5baccd1430b34ffa87faffc1bfee3eee5c0c570b8e1e60281f9

SHA512
30ddea078be80a80f61611b98f7dbcdbd3c98d626ab85e9234b637b1c9fcdadd763a19494b9321f800e962f8e67e6592e69d2cd2a6f3f6dd5d12a6f9391afe86

Download Submit
C:\Windows\system\UlXtDrp.exe

Filesize
1.6MB

MD5
7ea67f333449c6fb189938c1f1f084d4

SHA1
489ca45d918a5679342dcf3d5f0af3f64dcd7316

SHA256
cc7f0b54aa8e9fc76023036ecebcb0015e1016807b73bb1abee71e7323cad37f

SHA512
934030840eff8fb48b91d16bb356c07b266675debb2122a88d11ab0dcbc0321eb7823af771a811668e24015364a8309741fab015f8efd6d6522b9e99fbf3708a

Download Submit
C:\Windows\system\WURiJPw.exe

Filesize
1.6MB

MD5
35f048d56bce71d5da800ad756052847

SHA1
89e7fd9c3bbae2e20ec5cd31d1aebec580debf4a

SHA256
0edff2c5d09c9f6694fe95cd73d5c1f05cbeb16a105da003a23716c433ac13ff

SHA512
12a189df9df47352e3ba068b6eb1c0740e6f3f22a2d1e26deee0849b8954f789af107e7cb91de78c9472367aab4a8b9114cb33842d67a4e7074e1d3975a25be2

Download Submit
C:\Windows\system\XIMVnem.exe

Filesize
1.6MB

MD5
c9be44f7cb3d1d608f89d1e6cdc80c7a

SHA1
bb339ea36ed912bab9df3e166c2ff1f79e498341

SHA256
cfd101049673471fe32161d1bf6424f402c4b324a88ccc6eadc20e706b4545a2

SHA512
a6e5be2c98939ea53720c7d04e4aa0ef6e9163b5ecae50c740a4e4c16092cd55913821d948918cfe08a3e849909959df3f5feffed1c8809c50f5c90b0aa2f1f2

Download Submit
C:\Windows\system\asSckpk.exe

Filesize
1.6MB

MD5
025f587c7176a8133ece49dd32dd4647

SHA1
5e6ccf34cc10bc3bb6966aab2ad22689caff46d3

SHA256
d80b5862c2a360724d35501ba0e0542abbc874bbfc172a9b778b6d86028d7a83

SHA512
4df2c6df23f9e2c9346ca16beec15452849952258ea494283ae17d9f35f8cde383d9200333c16ce0d44a7352af062103b20a636d68364379cd602e43da167dee

Download Submit
C:\Windows\system\cQtkjhO.exe

Filesize
1.6MB

MD5
868f606c334ae27a63f2f7ca4ecf70c8

SHA1
26b67aba7735bd3ff9b2f267b84112111a85922c

SHA256
d71b45def166679a4a0d3c834efd27020a0de1ad48c57186db139eb2d98131b6

SHA512
b8448232a1045f6b1d3a5f2da828bc8419b5d2961da490b7fe32dfad6f0a952adcad1ae01951dd88f46cda71417514c5fb01e4ad85ad47e851ddb6608202fdc3

Download Submit
C:\Windows\system\ekDzrCY.exe

Filesize
1.6MB

MD5
7662dacba42d9d9b4b9269cfeb32bfd0

SHA1
510143d54da1dac772d71191519f48e2a40912b6

SHA256
80460b49c6eb525587ea60e287527eaebdd658e7cf5cdd551c4086890c7c19ec

SHA512
2555ed879f8070d26fb430ed5e8240dc5159e32e6dc38d74c0c28f831340f1ca02e0601b2f659124ecd943c62d57ef9fed919783340b12a835fff2ee862d3744

Download Submit
C:\Windows\system\fxaVNjn.exe

Filesize
1.6MB

MD5
97741c6b4818b7a0a1a7cdd81c0e447d

SHA1
76cb44405fbd83bc1fc5f1be3a0e5de84642304b

SHA256
8481e6f5a87a0abbbe213edc2f7ed42321c6ec8152f0eb0121c58c5cf1616d61

SHA512
0e02ce0f87003bd9cb364077326e08d6246031389ec3fff70e8084c2e0966e663309e4649cdfb72bc546ea517e3a226da24b5f22159f3e04caff1c93748d4f40

Download Submit
C:\Windows\system\mesbZnn.exe

Filesize
1.6MB

MD5
fce5cb6e81b0708b6b7e2f2704530bb7

SHA1
e24283c9b4310f1d5797e0bd6ece4a3601e52d7b

SHA256
4c9eada8b22b3f3fd20309d7a14a3fb939a35b60cabd0836254062799bd9890b

SHA512
891384a0a7b84844ced69a9f889177b2e10ca1cd667af89e42fc0fd91065db3076b7ad231515572f8fa72a825572a4441e5d90a011a653b413ea68aa88602a80

Download Submit
C:\Windows\system\nTnGfTl.exe

Filesize
1.6MB

MD5
40a12adad4998b834ce2dff44193358d

SHA1
0e05f430e2573ab4262c77fc1021796dc78800ff

SHA256
558a5a314bf729831761a853ea5d6ddb8669aefd5ff7a5e4bed4d7de425b7b08

SHA512
b4dffeba2da479e4735d1588f8503887e102b96a86de9b9d4c53d7578eaaa9806608aea84fe312cf17f73f7d3f6ccb841e055424f6b29cdc7bb65a61f324055f

Download Submit
C:\Windows\system\ssJHNhd.exe

Filesize
1.6MB

MD5
03e5b6e0cc9aae3775fd9c10333fe15e

SHA1
bb9c12de55ec47db46dc064dd24abcaa4727ac63

SHA256
d16051adc1072b7673b2170440e8575497ef74a08ac2544dde7ccbba7b246a8a

SHA512
1e7fd967409e8810afc988bcc4e4bc42ff6ba2422541b9ec85e87bbe25c5e17a82cd336bd44ad5882298e1a21ed76bf45a289ead5aa65cc33648c8ebe6b9b968

Download Submit
C:\Windows\system\tLJMFCB.exe

Filesize
1.6MB

MD5
9f9878e38f4f8bdd36a7af269a348d40

SHA1
2e11b492fae0ec3bee346a1365f776f5c5dea820

SHA256
48b1435d95bd37f2eaf4180fcdca2a11a9d8380e239a9b84cc3390f2b2c6f42f

SHA512
f33009529ae595c78e8d2a69fac26801ba301ca9ede349abadee35e427d66bc984f5a37956c671458b039e2c7faf7586d68a392e2fe0354cdf2a47bc471b3fd3

Download Submit
C:\Windows\system\vXFxWeA.exe

Filesize
1.6MB

MD5
61ba75d9a76bff991d399d6fa3403616

SHA1
643f8b2500ea90c78876507bad56d49cb563f38d

SHA256
602dcece31da480fe4e35b1856e7761bd56298b7e9b9a88b2f376b62b4699a65

SHA512
4134a5d6d6eb93570cfd03f3767bf32e76c062642db9dcf5cac0366a53262f0024028c61483aa577e7f358eb06cbcf67e2747671e9578b8d746d0d033354031f

Download Submit
C:\Windows\system\vhNabuJ.exe

Filesize
1.6MB

MD5
a1785d62604bb9a479699046386927fc

SHA1
e49f97cb340fabff5a11c3e69807b12a306e0013

SHA256
f49b39cd6937e043508f856979d325acd49987af606a39472e6f4e9bd39a0f0e

SHA512
4cea261ff92ad52b2663d6e9104ba8ce525a071825b8d3c33358575d90a6350e6c5d247890565b3a800266a8ecd2f4fd2f3b35434a2c510a678c4935c890daf3

Download Submit
\Windows\system\PBOSeQX.exe

Filesize
1.6MB

MD5
4e47c5c087fb4dca0e93dfd48b4d243a

SHA1
e7d4abe69526d40751ff415f4e3e39465f7e2485

SHA256
9120394b3896597ca9c8e934c89fb9cc5c575714a535506b261cf835d8cb19f6

SHA512
fd327a6cf4a2e5945ad1061d8a1faa429b4bff4c8469fdb576ebee7814d0c810b66f3a463bae94566d1f46ac8aeb40074387566c730ecbe9cbfc0e3efbcf510a

Download Submit
\Windows\system\pDhBBly.exe

Filesize
1.6MB

MD5
af09faa9afa448588158b38dd7f3e69d

SHA1
48ea532d956268adb19b500ba2061c203d429f5b

SHA256
12632b8b419ba7f3d9378e02f9b2484d1bcddabd46d24c200d09e22029f6a796

SHA512
298f6b0ef723fdc9c785eac2cb251977b64e94f3eb8b65ba607c870217af357c6f1e1a07bb61ed0e125344c55fb878cdfa53ddcff537ba47c2fd02c0c6d8e978

Download Submit
memory/1688-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download