xmrig | 7a65ea84978d653141d5fe65a05f59831cd7be417ae8c630a4e584647e92b35c

Analysis

max time kernel
73s
max time network
29s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/12/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_0050131715d61e9d072a3beed31a410c.exe
Size 1.4MB
Sample241229-mt58aazkh1
SHA256 b48eccb23d6c3697a8930d16fb5a41773b8f596d77be3eed282ce77854899456
MD5 0050131715d61e9d072a3beed31a410c
SHA1 8e901e106b282ae12df7593112e37801b2ffe903
SHA512 a416b19e9c088aa3771ebe7cba2f91d7ca64d2cb553ad290cb1ae8b70d95f65d1eca1a82fe597184062f2480b65833c099a3439cb3ed7d03ff24bb0e239e8178
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYj:GezaTF8FcNkNdfE0pZ9oztFwI7ei11Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral3/files/0x0003000000020e4f-21.dat	xmrig
behavioral3/files/0x0003000000020e4e-18.dat	xmrig
behavioral3/files/0x0003000000020e53-36.dat	xmrig
behavioral3/files/0x0003000000020e55-38.dat	xmrig
behavioral3/files/0x0003000000020e70-62.dat	xmrig
behavioral3/files/0x0003000000020e8b-88.dat	xmrig
behavioral3/files/0x0003000000020e9f-110.dat	xmrig
behavioral3/files/0x0003000000020eac-126.dat	xmrig
behavioral3/files/0x0003000000020ea4-121.dat	xmrig
behavioral3/files/0x0003000000020eb8-129.dat	xmrig
behavioral3/files/0x0003000000020ea6-124.dat	xmrig
behavioral3/files/0x0003000000020ea2-115.dat	xmrig
behavioral3/files/0x0003000000020e9c-109.dat	xmrig
behavioral3/files/0x0003000000020e99-104.dat	xmrig
behavioral3/files/0x0003000000020e96-100.dat	xmrig
behavioral3/files/0x0003000000020e94-97.dat	xmrig
behavioral3/files/0x0003000000020e92-92.dat	xmrig
behavioral3/files/0x0003000000020e82-84.dat	xmrig
behavioral3/files/0x0003000000020e78-80.dat	xmrig
behavioral3/files/0x0003000000020e76-76.dat	xmrig
behavioral3/files/0x0003000000020e74-73.dat	xmrig
behavioral3/files/0x0003000000020e72-68.dat	xmrig
behavioral3/files/0x0003000000020e67-60.dat	xmrig
behavioral3/files/0x0003000000020e62-56.dat	xmrig
behavioral3/files/0x0003000000020e60-53.dat	xmrig
behavioral3/files/0x0003000000020e59-48.dat	xmrig
behavioral3/files/0x0003000000020e57-44.dat	xmrig
behavioral3/files/0x0003000000020e51-33.dat	xmrig
behavioral3/files/0x0003000000020e4b-31.dat	xmrig
behavioral3/files/0x0003000000020e4d-29.dat	xmrig
behavioral3/files/0x0003000000020e49-28.dat	xmrig
behavioral3/files/0x0003000000020e47-24.dat	xmrig
behavioral3/files/0x0007000000012118-2.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2824	ZWFVKzo.exe
2960	BGtdaZN.exe
2228	kYVpcRo.exe
2856	mPwCVuG.exe
2920	JOfHNuA.exe
2840	lBazVrS.exe
2836	TOEePbO.exe
2844	SDzOZZz.exe
2648	mAArnPI.exe
3028	PpvWqyo.exe
2404	fkqNckb.exe
3048	JrkLZJA.exe
2908	XTxsqiq.exe
2488	MInJCcl.exe
1276	Hledqkn.exe
2124	RLYUIaz.exe
2872	cuaCdqh.exe
2976	ZdITTVi.exe
2536	kFoTDTS.exe
2932	CjyhcZY.exe
2760	bkoJKYw.exe
2676	WrHTbOS.exe
2916	ENWXMnU.exe
2548	vswnQZD.exe
484	MFIMmFa.exe
2260	MQbTqpb.exe
1776	cQLxqxO.exe
1644	FYrEdey.exe
1588	qivWQVg.exe
1984	ZCpgXLh.exe
1660	JrIRuPW.exe
540	NhYiDnb.exe
1976	fgTBNWw.exe
2332	MpuNbjq.exe
2060	jWiXBSo.exe
628	JiRTvtF.exe
1308	KTPAQQB.exe
860	gSnMkeJ.exe
1804	kdZruIb.exe
1564	dzPJstq.exe
1992	qnEwfYN.exe
468	rjNGYvk.exe
820	StFfTMn.exe
2348	yfFQPyk.exe
1040	IZbmVWs.exe
1044	serpCLa.exe
3004	oDkohyq.exe
720	RTNqqaC.exe
948	AmFtRVq.exe
1760	pQefTLF.exe
2248	nSuOAGr.exe
2288	nuwUaee.exe
1600	vSTAKQP.exe
1576	CskabcG.exe
2728	jQGzQbB.exe
2632	RLKItnZ.exe
2008	mSTkgPX.exe
324	MsDVpzI.exe
1632	hmJOxFd.exe
560	dpakecM.exe
2360	tbKFHcf.exe
2340	xUDNUNM.exe
2376	yonjWDL.exe
2936	ODVDvCn.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe
2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZMGSXmE.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\PltuQyE.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\kUHYvgI.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\famJdwb.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\MpuNbjq.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\RLKItnZ.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\emNFPsP.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\vtHLZRm.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\ZJvsCmy.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\loxwHxN.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\HthepWO.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\HbZMaUt.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\oPJBhks.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\hmCSOIW.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\aQGPoqY.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\TGlyTIl.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\YLxzPcO.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\GybuzUH.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\yfFQPyk.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\FouuPmW.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\QEhRagZ.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\QdAuQCH.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\wtGdyvc.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\ackRacz.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\jXtXYxW.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\FeOeCIU.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\xnDVZNC.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\qWdLVJg.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\hvPlwCA.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\ktWfjAx.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\qbYCKwY.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\zMhFNAn.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\aLBZdmN.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\ucFowvV.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\LGDhZNp.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\xPqlakj.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\dSkTOYk.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\laaMnMu.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\wYEvyyu.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\uGOVxgp.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\MtLVFck.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\ERdRDWd.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\DquIKrR.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\lNIREcg.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\HnXtspu.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\UVWgstA.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\tKdAyiM.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\sEpHacs.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\wgSxIsM.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\NhYiDnb.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\SdqHFNO.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\kTEcqbc.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\chGBKoK.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\eZQADuh.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\wpdtMZQ.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\CGLEapQ.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\PAUfOvh.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\MFIMmFa.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\BUakwCu.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\wdGaTnS.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\vaiMaXW.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\tmUHcaX.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\AWJyqQS.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe
File created	C:\Windows\System\YSDXrkS.exe	virussign.com_0050131715d61e9d072a3beed31a410c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2824	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	31
PID 2380 wrote to memory of 2824	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	31
PID 2380 wrote to memory of 2824	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	31
PID 2380 wrote to memory of 2960	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	32
PID 2380 wrote to memory of 2960	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	32
PID 2380 wrote to memory of 2960	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	32
PID 2380 wrote to memory of 2228	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	33
PID 2380 wrote to memory of 2228	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	33
PID 2380 wrote to memory of 2228	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	33
PID 2380 wrote to memory of 2840	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	34
PID 2380 wrote to memory of 2840	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	34
PID 2380 wrote to memory of 2840	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	34
PID 2380 wrote to memory of 2856	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	35
PID 2380 wrote to memory of 2856	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	35
PID 2380 wrote to memory of 2856	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	35
PID 2380 wrote to memory of 2836	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	36
PID 2380 wrote to memory of 2836	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	36
PID 2380 wrote to memory of 2836	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	36
PID 2380 wrote to memory of 2920	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	37
PID 2380 wrote to memory of 2920	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	37
PID 2380 wrote to memory of 2920	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	37
PID 2380 wrote to memory of 2844	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	38
PID 2380 wrote to memory of 2844	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	38
PID 2380 wrote to memory of 2844	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	38
PID 2380 wrote to memory of 2648	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	39
PID 2380 wrote to memory of 2648	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	39
PID 2380 wrote to memory of 2648	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	39
PID 2380 wrote to memory of 3028	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	40
PID 2380 wrote to memory of 3028	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	40
PID 2380 wrote to memory of 3028	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	40
PID 2380 wrote to memory of 2404	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	41
PID 2380 wrote to memory of 2404	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	41
PID 2380 wrote to memory of 2404	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	41
PID 2380 wrote to memory of 3048	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	42
PID 2380 wrote to memory of 3048	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	42
PID 2380 wrote to memory of 3048	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	42
PID 2380 wrote to memory of 2908	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	43
PID 2380 wrote to memory of 2908	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	43
PID 2380 wrote to memory of 2908	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	43
PID 2380 wrote to memory of 2488	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	44
PID 2380 wrote to memory of 2488	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	44
PID 2380 wrote to memory of 2488	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	44
PID 2380 wrote to memory of 1276	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	45
PID 2380 wrote to memory of 1276	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	45
PID 2380 wrote to memory of 1276	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	45
PID 2380 wrote to memory of 2124	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	46
PID 2380 wrote to memory of 2124	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	46
PID 2380 wrote to memory of 2124	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	46
PID 2380 wrote to memory of 2872	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	47
PID 2380 wrote to memory of 2872	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	47
PID 2380 wrote to memory of 2872	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	47
PID 2380 wrote to memory of 2976	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	48
PID 2380 wrote to memory of 2976	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	48
PID 2380 wrote to memory of 2976	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	48
PID 2380 wrote to memory of 2536	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	49
PID 2380 wrote to memory of 2536	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	49
PID 2380 wrote to memory of 2536	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	49
PID 2380 wrote to memory of 2932	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	50
PID 2380 wrote to memory of 2932	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	50
PID 2380 wrote to memory of 2932	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	50
PID 2380 wrote to memory of 2760	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	51
PID 2380 wrote to memory of 2760	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	51
PID 2380 wrote to memory of 2760	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	51
PID 2380 wrote to memory of 2676	2380	virussign.com_0050131715d61e9d072a3beed31a410c.exe	52

C:\Users\Admin\AppData\Local\Temp\virussign.com_0050131715d61e9d072a3beed31a410c.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_0050131715d61e9d072a3beed31a410c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System\ZWFVKzo.exe
  C:\Windows\System\ZWFVKzo.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\BGtdaZN.exe
  C:\Windows\System\BGtdaZN.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\kYVpcRo.exe
  C:\Windows\System\kYVpcRo.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\lBazVrS.exe
  C:\Windows\System\lBazVrS.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\mPwCVuG.exe
  C:\Windows\System\mPwCVuG.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\TOEePbO.exe
  C:\Windows\System\TOEePbO.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\JOfHNuA.exe
  C:\Windows\System\JOfHNuA.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\SDzOZZz.exe
  C:\Windows\System\SDzOZZz.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\mAArnPI.exe
  C:\Windows\System\mAArnPI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PpvWqyo.exe
  C:\Windows\System\PpvWqyo.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\fkqNckb.exe
  C:\Windows\System\fkqNckb.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JrkLZJA.exe
  C:\Windows\System\JrkLZJA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\XTxsqiq.exe
  C:\Windows\System\XTxsqiq.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\MInJCcl.exe
  C:\Windows\System\MInJCcl.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\Hledqkn.exe
  C:\Windows\System\Hledqkn.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\RLYUIaz.exe
  C:\Windows\System\RLYUIaz.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\cuaCdqh.exe
  C:\Windows\System\cuaCdqh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ZdITTVi.exe
  C:\Windows\System\ZdITTVi.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\kFoTDTS.exe
  C:\Windows\System\kFoTDTS.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CjyhcZY.exe
  C:\Windows\System\CjyhcZY.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\bkoJKYw.exe
  C:\Windows\System\bkoJKYw.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\WrHTbOS.exe
  C:\Windows\System\WrHTbOS.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ENWXMnU.exe
  C:\Windows\System\ENWXMnU.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\vswnQZD.exe
  C:\Windows\System\vswnQZD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\MFIMmFa.exe
  C:\Windows\System\MFIMmFa.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\MQbTqpb.exe
  C:\Windows\System\MQbTqpb.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\cQLxqxO.exe
  C:\Windows\System\cQLxqxO.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\qivWQVg.exe
  C:\Windows\System\qivWQVg.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\FYrEdey.exe
  C:\Windows\System\FYrEdey.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZCpgXLh.exe
  C:\Windows\System\ZCpgXLh.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\JrIRuPW.exe
  C:\Windows\System\JrIRuPW.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\jWiXBSo.exe
  C:\Windows\System\jWiXBSo.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\NhYiDnb.exe
  C:\Windows\System\NhYiDnb.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\JiRTvtF.exe
  C:\Windows\System\JiRTvtF.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\fgTBNWw.exe
  C:\Windows\System\fgTBNWw.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\KTPAQQB.exe
  C:\Windows\System\KTPAQQB.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\MpuNbjq.exe
  C:\Windows\System\MpuNbjq.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\gSnMkeJ.exe
  C:\Windows\System\gSnMkeJ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\kdZruIb.exe
  C:\Windows\System\kdZruIb.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\dzPJstq.exe
  C:\Windows\System\dzPJstq.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\qnEwfYN.exe
  C:\Windows\System\qnEwfYN.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\rjNGYvk.exe
  C:\Windows\System\rjNGYvk.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\StFfTMn.exe
  C:\Windows\System\StFfTMn.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\yfFQPyk.exe
  C:\Windows\System\yfFQPyk.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\IZbmVWs.exe
  C:\Windows\System\IZbmVWs.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\serpCLa.exe
  C:\Windows\System\serpCLa.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\oDkohyq.exe
  C:\Windows\System\oDkohyq.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\RTNqqaC.exe
  C:\Windows\System\RTNqqaC.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\AmFtRVq.exe
  C:\Windows\System\AmFtRVq.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pQefTLF.exe
  C:\Windows\System\pQefTLF.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\nSuOAGr.exe
  C:\Windows\System\nSuOAGr.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\nuwUaee.exe
  C:\Windows\System\nuwUaee.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\vSTAKQP.exe
  C:\Windows\System\vSTAKQP.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\CskabcG.exe
  C:\Windows\System\CskabcG.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\jQGzQbB.exe
  C:\Windows\System\jQGzQbB.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RLKItnZ.exe
  C:\Windows\System\RLKItnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\mSTkgPX.exe
  C:\Windows\System\mSTkgPX.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\hmJOxFd.exe
  C:\Windows\System\hmJOxFd.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\MsDVpzI.exe
  C:\Windows\System\MsDVpzI.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\xUDNUNM.exe
  C:\Windows\System\xUDNUNM.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\dpakecM.exe
  C:\Windows\System\dpakecM.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\yonjWDL.exe
  C:\Windows\System\yonjWDL.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\tbKFHcf.exe
  C:\Windows\System\tbKFHcf.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\xvBktVK.exe
  C:\Windows\System\xvBktVK.exe
  2⤵
  PID:1012
- C:\Windows\System\ODVDvCn.exe
  C:\Windows\System\ODVDvCn.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\NOlpKVY.exe
  C:\Windows\System\NOlpKVY.exe
  2⤵
  PID:300
- C:\Windows\System\NgTGAkw.exe
  C:\Windows\System\NgTGAkw.exe
  2⤵
  PID:1964
- C:\Windows\System\onGBNNl.exe
  C:\Windows\System\onGBNNl.exe
  2⤵
  PID:2064
- C:\Windows\System\cdYQBfp.exe
  C:\Windows\System\cdYQBfp.exe
  2⤵
  PID:960
- C:\Windows\System\KxmeABN.exe
  C:\Windows\System\KxmeABN.exe
  2⤵
  PID:2012
- C:\Windows\System\bSlbBBN.exe
  C:\Windows\System\bSlbBBN.exe
  2⤵
  PID:1876
- C:\Windows\System\lYObqzG.exe
  C:\Windows\System\lYObqzG.exe
  2⤵
  PID:1696
- C:\Windows\System\LjTDPzJ.exe
  C:\Windows\System\LjTDPzJ.exe
  2⤵
  PID:1368
- C:\Windows\System\XmAoIJN.exe
  C:\Windows\System\XmAoIJN.exe
  2⤵
  PID:1104
- C:\Windows\System\uYsFzMZ.exe
  C:\Windows\System\uYsFzMZ.exe
  2⤵
  PID:1656
- C:\Windows\System\ranUwdr.exe
  C:\Windows\System\ranUwdr.exe
  2⤵
  PID:2944
- C:\Windows\System\baFRcfO.exe
  C:\Windows\System\baFRcfO.exe
  2⤵
  PID:2024
- C:\Windows\System\lBTxCKA.exe
  C:\Windows\System\lBTxCKA.exe
  2⤵
  PID:1544
- C:\Windows\System\XGOBgaL.exe
  C:\Windows\System\XGOBgaL.exe
  2⤵
  PID:1828
- C:\Windows\System\lItGiTi.exe
  C:\Windows\System\lItGiTi.exe
  2⤵
  PID:1688
- C:\Windows\System\maRaGde.exe
  C:\Windows\System\maRaGde.exe
  2⤵
  PID:1744
- C:\Windows\System\SBbZdue.exe
  C:\Windows\System\SBbZdue.exe
  2⤵
  PID:2460
- C:\Windows\System\PtaUkYZ.exe
  C:\Windows\System\PtaUkYZ.exe
  2⤵
  PID:3032
- C:\Windows\System\zTDipxH.exe
  C:\Windows\System\zTDipxH.exe
  2⤵
  PID:576
- C:\Windows\System\nZNEoJi.exe
  C:\Windows\System\nZNEoJi.exe
  2⤵
  PID:1604
- C:\Windows\System\hatYEUa.exe
  C:\Windows\System\hatYEUa.exe
  2⤵
  PID:2764
- C:\Windows\System\oPJBhks.exe
  C:\Windows\System\oPJBhks.exe
  2⤵
  PID:2804
- C:\Windows\System\aBBGAAH.exe
  C:\Windows\System\aBBGAAH.exe
  2⤵
  PID:2572
- C:\Windows\System\HZcTHLt.exe
  C:\Windows\System\HZcTHLt.exe
  2⤵
  PID:2612
- C:\Windows\System\panUITm.exe
  C:\Windows\System\panUITm.exe
  2⤵
  PID:1676
- C:\Windows\System\INcAHnO.exe
  C:\Windows\System\INcAHnO.exe
  2⤵
  PID:1492
- C:\Windows\System\iyrZneW.exe
  C:\Windows\System\iyrZneW.exe
  2⤵
  PID:864
- C:\Windows\System\psEqaUC.exe
  C:\Windows\System\psEqaUC.exe
  2⤵
  PID:3088
- C:\Windows\System\lMKCbya.exe
  C:\Windows\System\lMKCbya.exe
  2⤵
  PID:3104
- C:\Windows\System\GBnWnVk.exe
  C:\Windows\System\GBnWnVk.exe
  2⤵
  PID:3124
- C:\Windows\System\CGJiwDG.exe
  C:\Windows\System\CGJiwDG.exe
  2⤵
  PID:3140
- C:\Windows\System\yjRJSdo.exe
  C:\Windows\System\yjRJSdo.exe
  2⤵
  PID:3160
- C:\Windows\System\whLRRdL.exe
  C:\Windows\System\whLRRdL.exe
  2⤵
  PID:3188
- C:\Windows\System\FgXNTJs.exe
  C:\Windows\System\FgXNTJs.exe
  2⤵
  PID:3204
- C:\Windows\System\NzMWixS.exe
  C:\Windows\System\NzMWixS.exe
  2⤵
  PID:3224
- C:\Windows\System\BUakwCu.exe
  C:\Windows\System\BUakwCu.exe
  2⤵
  PID:3244
- C:\Windows\System\DAjkHjC.exe
  C:\Windows\System\DAjkHjC.exe
  2⤵
  PID:3268
- C:\Windows\System\IKiaxUD.exe
  C:\Windows\System\IKiaxUD.exe
  2⤵
  PID:3284
- C:\Windows\System\iCkgUjk.exe
  C:\Windows\System\iCkgUjk.exe
  2⤵
  PID:3304
- C:\Windows\System\ebSHYOi.exe
  C:\Windows\System\ebSHYOi.exe
  2⤵
  PID:3324
- C:\Windows\System\LhagvdD.exe
  C:\Windows\System\LhagvdD.exe
  2⤵
  PID:3340
- C:\Windows\System\FBfXSuS.exe
  C:\Windows\System\FBfXSuS.exe
  2⤵
  PID:3364
- C:\Windows\System\LSDHqfz.exe
  C:\Windows\System\LSDHqfz.exe
  2⤵
  PID:3380
- C:\Windows\System\pHAFZzz.exe
  C:\Windows\System\pHAFZzz.exe
  2⤵
  PID:3400
- C:\Windows\System\srDDliU.exe
  C:\Windows\System\srDDliU.exe
  2⤵
  PID:3428
- C:\Windows\System\NbgAQDP.exe
  C:\Windows\System\NbgAQDP.exe
  2⤵
  PID:3444
- C:\Windows\System\tSeUUcq.exe
  C:\Windows\System\tSeUUcq.exe
  2⤵
  PID:3468
- C:\Windows\System\DwaafYO.exe
  C:\Windows\System\DwaafYO.exe
  2⤵
  PID:3484
- C:\Windows\System\rADzbEF.exe
  C:\Windows\System\rADzbEF.exe
  2⤵
  PID:3508
- C:\Windows\System\XtdRrMB.exe
  C:\Windows\System\XtdRrMB.exe
  2⤵
  PID:3528
- C:\Windows\System\pRzmpKC.exe
  C:\Windows\System\pRzmpKC.exe
  2⤵
  PID:3548
- C:\Windows\System\nZMnMfe.exe
  C:\Windows\System\nZMnMfe.exe
  2⤵
  PID:3564
- C:\Windows\System\WmKgpix.exe
  C:\Windows\System\WmKgpix.exe
  2⤵
  PID:3588
- C:\Windows\System\iOzJJll.exe
  C:\Windows\System\iOzJJll.exe
  2⤵
  PID:3604
- C:\Windows\System\yjtBvuM.exe
  C:\Windows\System\yjtBvuM.exe
  2⤵
  PID:3628
- C:\Windows\System\MySxFyr.exe
  C:\Windows\System\MySxFyr.exe
  2⤵
  PID:3644
- C:\Windows\System\GZxCrgl.exe
  C:\Windows\System\GZxCrgl.exe
  2⤵
  PID:3668
- C:\Windows\System\InwxXzd.exe
  C:\Windows\System\InwxXzd.exe
  2⤵
  PID:3684
- C:\Windows\System\xkuSbky.exe
  C:\Windows\System\xkuSbky.exe
  2⤵
  PID:3708
- C:\Windows\System\yUqMtqv.exe
  C:\Windows\System\yUqMtqv.exe
  2⤵
  PID:3728
- C:\Windows\System\QTDdaUB.exe
  C:\Windows\System\QTDdaUB.exe
  2⤵
  PID:3748
- C:\Windows\System\gfnTWuK.exe
  C:\Windows\System\gfnTWuK.exe
  2⤵
  PID:3764
- C:\Windows\System\glYnYIZ.exe
  C:\Windows\System\glYnYIZ.exe
  2⤵
  PID:3788
- C:\Windows\System\rPIvHMz.exe
  C:\Windows\System\rPIvHMz.exe
  2⤵
  PID:3808
- C:\Windows\System\JUyxmFa.exe
  C:\Windows\System\JUyxmFa.exe
  2⤵
  PID:3828
- C:\Windows\System\EotYlHX.exe
  C:\Windows\System\EotYlHX.exe
  2⤵
  PID:3844
- C:\Windows\System\zasXlNQ.exe
  C:\Windows\System\zasXlNQ.exe
  2⤵
  PID:3864
- C:\Windows\System\MZwLjoC.exe
  C:\Windows\System\MZwLjoC.exe
  2⤵
  PID:3888
- C:\Windows\System\xBibltc.exe
  C:\Windows\System\xBibltc.exe
  2⤵
  PID:3908
- C:\Windows\System\yINVYqu.exe
  C:\Windows\System\yINVYqu.exe
  2⤵
  PID:3928
- C:\Windows\System\HatwsVH.exe
  C:\Windows\System\HatwsVH.exe
  2⤵
  PID:3952
- C:\Windows\System\GrZgzpB.exe
  C:\Windows\System\GrZgzpB.exe
  2⤵
  PID:3968
- C:\Windows\System\OJKhjNN.exe
  C:\Windows\System\OJKhjNN.exe
  2⤵
  PID:3984
- C:\Windows\System\hmCSOIW.exe
  C:\Windows\System\hmCSOIW.exe
  2⤵
  PID:4008
- C:\Windows\System\eJsJKgC.exe
  C:\Windows\System\eJsJKgC.exe
  2⤵
  PID:4024
- C:\Windows\System\GkgRLgo.exe
  C:\Windows\System\GkgRLgo.exe
  2⤵
  PID:4048
- C:\Windows\System\UuOnFKO.exe
  C:\Windows\System\UuOnFKO.exe
  2⤵
  PID:4064
- C:\Windows\System\ddDGVCf.exe
  C:\Windows\System\ddDGVCf.exe
  2⤵
  PID:4080
- C:\Windows\System\oYajVDS.exe
  C:\Windows\System\oYajVDS.exe
  2⤵
  PID:2000
- C:\Windows\System\RnHYyTU.exe
  C:\Windows\System\RnHYyTU.exe
  2⤵
  PID:1888
- C:\Windows\System\RIGLTcA.exe
  C:\Windows\System\RIGLTcA.exe
  2⤵
  PID:600
- C:\Windows\System\YnwJNnu.exe
  C:\Windows\System\YnwJNnu.exe
  2⤵
  PID:1732
- C:\Windows\System\OMXYGIp.exe
  C:\Windows\System\OMXYGIp.exe
  2⤵
  PID:2236
- C:\Windows\System\fBirbCn.exe
  C:\Windows\System\fBirbCn.exe
  2⤵
  PID:1372
- C:\Windows\System\eKsSwFD.exe
  C:\Windows\System\eKsSwFD.exe
  2⤵
  PID:1772
- C:\Windows\System\JaGOACQ.exe
  C:\Windows\System\JaGOACQ.exe
  2⤵
  PID:2056
- C:\Windows\System\IkOcwPo.exe
  C:\Windows\System\IkOcwPo.exe
  2⤵
  PID:340
- C:\Windows\System\seqbkPc.exe
  C:\Windows\System\seqbkPc.exe
  2⤵
  PID:2080
- C:\Windows\System\NDUACJz.exe
  C:\Windows\System\NDUACJz.exe
  2⤵
  PID:3068
- C:\Windows\System\Idhnupk.exe
  C:\Windows\System\Idhnupk.exe
  2⤵
  PID:856
- C:\Windows\System\MSRZurU.exe
  C:\Windows\System\MSRZurU.exe
  2⤵
  PID:2232
- C:\Windows\System\oiOhXml.exe
  C:\Windows\System\oiOhXml.exe
  2⤵
  PID:2580
- C:\Windows\System\iLWKncs.exe
  C:\Windows\System\iLWKncs.exe
  2⤵
  PID:2540
- C:\Windows\System\xYIxMWW.exe
  C:\Windows\System\xYIxMWW.exe
  2⤵
  PID:3044
- C:\Windows\System\QmPIsgr.exe
  C:\Windows\System\QmPIsgr.exe
  2⤵
  PID:3096
- C:\Windows\System\ZOwWHOm.exe
  C:\Windows\System\ZOwWHOm.exe
  2⤵
  PID:3076
- C:\Windows\System\FDuGoGo.exe
  C:\Windows\System\FDuGoGo.exe
  2⤵
  PID:3152
- C:\Windows\System\OTrUfJC.exe
  C:\Windows\System\OTrUfJC.exe
  2⤵
  PID:3176
- C:\Windows\System\RRPlqVf.exe
  C:\Windows\System\RRPlqVf.exe
  2⤵
  PID:3212
- C:\Windows\System\WxLmflY.exe
  C:\Windows\System\WxLmflY.exe
  2⤵
  PID:3256
- C:\Windows\System\vmgqByC.exe
  C:\Windows\System\vmgqByC.exe
  2⤵
  PID:3276
- C:\Windows\System\aQGPoqY.exe
  C:\Windows\System\aQGPoqY.exe
  2⤵
  PID:3280
- C:\Windows\System\dgJSNFg.exe
  C:\Windows\System\dgJSNFg.exe
  2⤵
  PID:3312
- C:\Windows\System\DLrfDWO.exe
  C:\Windows\System\DLrfDWO.exe
  2⤵
  PID:3388
- C:\Windows\System\KuTFjHY.exe
  C:\Windows\System\KuTFjHY.exe
  2⤵
  PID:3408
- C:\Windows\System\nltgiYg.exe
  C:\Windows\System\nltgiYg.exe
  2⤵
  PID:3452
- C:\Windows\System\durnQHa.exe
  C:\Windows\System\durnQHa.exe
  2⤵
  PID:3440
- C:\Windows\System\lURnnkU.exe
  C:\Windows\System\lURnnkU.exe
  2⤵
  PID:3500
- C:\Windows\System\hFhUkzX.exe
  C:\Windows\System\hFhUkzX.exe
  2⤵
  PID:3540
- C:\Windows\System\PfXKqbh.exe
  C:\Windows\System\PfXKqbh.exe
  2⤵
  PID:3524
- C:\Windows\System\YioBUQf.exe
  C:\Windows\System\YioBUQf.exe
  2⤵
  PID:3612
- C:\Windows\System\WLFYttV.exe
  C:\Windows\System\WLFYttV.exe
  2⤵
  PID:3652
- C:\Windows\System\UGPewie.exe
  C:\Windows\System\UGPewie.exe
  2⤵
  PID:3640
- C:\Windows\System\SvtcLvt.exe
  C:\Windows\System\SvtcLvt.exe
  2⤵
  PID:3676
- C:\Windows\System\RlgBYcP.exe
  C:\Windows\System\RlgBYcP.exe
  2⤵
  PID:3716
- C:\Windows\System\mSdWQOI.exe
  C:\Windows\System\mSdWQOI.exe
  2⤵
  PID:3780
- C:\Windows\System\PMLLzCQ.exe
  C:\Windows\System\PMLLzCQ.exe
  2⤵
  PID:3760
- C:\Windows\System\qlDEIBF.exe
  C:\Windows\System\qlDEIBF.exe
  2⤵
  PID:3852
- C:\Windows\System\hSQBTdJ.exe
  C:\Windows\System\hSQBTdJ.exe
  2⤵
  PID:3896
- C:\Windows\System\LPYQhLe.exe
  C:\Windows\System\LPYQhLe.exe
  2⤵
  PID:3948
- C:\Windows\System\WcumydT.exe
  C:\Windows\System\WcumydT.exe
  2⤵
  PID:3916
- C:\Windows\System\ngNMbAI.exe
  C:\Windows\System\ngNMbAI.exe
  2⤵
  PID:3960
- C:\Windows\System\BNPVSik.exe
  C:\Windows\System\BNPVSik.exe
  2⤵
  PID:4056
- C:\Windows\System\KStMxwk.exe
  C:\Windows\System\KStMxwk.exe
  2⤵
  PID:4088
- C:\Windows\System\MGyzSLO.exe
  C:\Windows\System\MGyzSLO.exe
  2⤵
  PID:2316
- C:\Windows\System\XwhCgmS.exe
  C:\Windows\System\XwhCgmS.exe
  2⤵
  PID:1100
- C:\Windows\System\KFClZrq.exe
  C:\Windows\System\KFClZrq.exe
  2⤵
  PID:1020
- C:\Windows\System\XpsJika.exe
  C:\Windows\System\XpsJika.exe
  2⤵
  PID:4072
- C:\Windows\System\IBrRjfW.exe
  C:\Windows\System\IBrRjfW.exe
  2⤵
  PID:2992
- C:\Windows\System\HmKEPrI.exe
  C:\Windows\System\HmKEPrI.exe
  2⤵
  PID:2660
- C:\Windows\System\Qehwzwb.exe
  C:\Windows\System\Qehwzwb.exe
  2⤵
  PID:1736
- C:\Windows\System\EoZUueF.exe
  C:\Windows\System\EoZUueF.exe
  2⤵
  PID:2792
- C:\Windows\System\ZZwyMou.exe
  C:\Windows\System\ZZwyMou.exe
  2⤵
  PID:2968
- C:\Windows\System\iigQKKP.exe
  C:\Windows\System\iigQKKP.exe
  2⤵
  PID:3020
- C:\Windows\System\gYYwMDn.exe
  C:\Windows\System\gYYwMDn.exe
  2⤵
  PID:3148
- C:\Windows\System\RrxXCLB.exe
  C:\Windows\System\RrxXCLB.exe
  2⤵
  PID:3236
- C:\Windows\System\pPfvEGf.exe
  C:\Windows\System\pPfvEGf.exe
  2⤵
  PID:2428
- C:\Windows\System\zjgaHEk.exe
  C:\Windows\System\zjgaHEk.exe
  2⤵
  PID:320
- C:\Windows\System\zxwdLdx.exe
  C:\Windows\System\zxwdLdx.exe
  2⤵
  PID:3168
- C:\Windows\System\cQERElc.exe
  C:\Windows\System\cQERElc.exe
  2⤵
  PID:3336
- C:\Windows\System\kIDSfdl.exe
  C:\Windows\System\kIDSfdl.exe
  2⤵
  PID:3300
- C:\Windows\System\HnXtspu.exe
  C:\Windows\System\HnXtspu.exe
  2⤵
  PID:3360
- C:\Windows\System\LGDhZNp.exe
  C:\Windows\System\LGDhZNp.exe
  2⤵
  PID:3464
- C:\Windows\System\ulvTtki.exe
  C:\Windows\System\ulvTtki.exe
  2⤵
  PID:3544
- C:\Windows\System\QuUYDaR.exe
  C:\Windows\System\QuUYDaR.exe
  2⤵
  PID:3480
- C:\Windows\System\FouuPmW.exe
  C:\Windows\System\FouuPmW.exe
  2⤵
  PID:3744
- C:\Windows\System\KyVISiE.exe
  C:\Windows\System\KyVISiE.exe
  2⤵
  PID:3580
- C:\Windows\System\KXDCXwu.exe
  C:\Windows\System\KXDCXwu.exe
  2⤵
  PID:3600
- C:\Windows\System\DrSqTJw.exe
  C:\Windows\System\DrSqTJw.exe
  2⤵
  PID:3720
- C:\Windows\System\gtUDvAI.exe
  C:\Windows\System\gtUDvAI.exe
  2⤵
  PID:3776
- C:\Windows\System\pejGKns.exe
  C:\Windows\System\pejGKns.exe
  2⤵
  PID:3860
- C:\Windows\System\OvqkASg.exe
  C:\Windows\System\OvqkASg.exe
  2⤵
  PID:3884
- C:\Windows\System\UTwcaMm.exe
  C:\Windows\System\UTwcaMm.exe
  2⤵
  PID:3992
- C:\Windows\System\ODfqCEs.exe
  C:\Windows\System\ODfqCEs.exe
  2⤵
  PID:2656
- C:\Windows\System\vEtPBmC.exe
  C:\Windows\System\vEtPBmC.exe
  2⤵
  PID:4076
- C:\Windows\System\FHvXiYd.exe
  C:\Windows\System\FHvXiYd.exe
  2⤵
  PID:4004
- C:\Windows\System\ouTEKBN.exe
  C:\Windows\System\ouTEKBN.exe
  2⤵
  PID:4036
- C:\Windows\System\tfghMuX.exe
  C:\Windows\System\tfghMuX.exe
  2⤵
  PID:1792
- C:\Windows\System\trZuqhJ.exe
  C:\Windows\System\trZuqhJ.exe
  2⤵
  PID:1048
- C:\Windows\System\AKagIVY.exe
  C:\Windows\System\AKagIVY.exe
  2⤵
  PID:2720
- C:\Windows\System\pbpUMEb.exe
  C:\Windows\System\pbpUMEb.exe
  2⤵
  PID:3240
- C:\Windows\System\npfSsFq.exe
  C:\Windows\System\npfSsFq.exe
  2⤵
  PID:3296
- C:\Windows\System\CjxTGjE.exe
  C:\Windows\System\CjxTGjE.exe
  2⤵
  PID:3156
- C:\Windows\System\llTHCpx.exe
  C:\Windows\System\llTHCpx.exe
  2⤵
  PID:572
- C:\Windows\System\QovtORv.exe
  C:\Windows\System\QovtORv.exe
  2⤵
  PID:3348
- C:\Windows\System\pqPdOoZ.exe
  C:\Windows\System\pqPdOoZ.exe
  2⤵
  PID:4112
- C:\Windows\System\EtWAXID.exe
  C:\Windows\System\EtWAXID.exe
  2⤵
  PID:4128
- C:\Windows\System\xPqlakj.exe
  C:\Windows\System\xPqlakj.exe
  2⤵
  PID:4144
- C:\Windows\System\UFRiriq.exe
  C:\Windows\System\UFRiriq.exe
  2⤵
  PID:4164
- C:\Windows\System\pDfzkrf.exe
  C:\Windows\System\pDfzkrf.exe
  2⤵
  PID:4180
- C:\Windows\System\oSqJVqF.exe
  C:\Windows\System\oSqJVqF.exe
  2⤵
  PID:4196
- C:\Windows\System\FcPtyWT.exe
  C:\Windows\System\FcPtyWT.exe
  2⤵
  PID:4212
- C:\Windows\System\QEhRagZ.exe
  C:\Windows\System\QEhRagZ.exe
  2⤵
  PID:4240
- C:\Windows\System\mpgOUNf.exe
  C:\Windows\System\mpgOUNf.exe
  2⤵
  PID:4256
- C:\Windows\System\iSNyosz.exe
  C:\Windows\System\iSNyosz.exe
  2⤵
  PID:4272
- C:\Windows\System\LHxwiZt.exe
  C:\Windows\System\LHxwiZt.exe
  2⤵
  PID:4296
- C:\Windows\System\QDkxWVd.exe
  C:\Windows\System\QDkxWVd.exe
  2⤵
  PID:4316
- C:\Windows\System\sDRjYTU.exe
  C:\Windows\System\sDRjYTU.exe
  2⤵
  PID:4348
- C:\Windows\System\RBbCFdM.exe
  C:\Windows\System\RBbCFdM.exe
  2⤵
  PID:4368
- C:\Windows\System\laTkBHc.exe
  C:\Windows\System\laTkBHc.exe
  2⤵
  PID:4392
- C:\Windows\System\hrakYhv.exe
  C:\Windows\System\hrakYhv.exe
  2⤵
  PID:4408
- C:\Windows\System\TxVIXAV.exe
  C:\Windows\System\TxVIXAV.exe
  2⤵
  PID:4432
- C:\Windows\System\YLjUblf.exe
  C:\Windows\System\YLjUblf.exe
  2⤵
  PID:4456
- C:\Windows\System\bpPwcwq.exe
  C:\Windows\System\bpPwcwq.exe
  2⤵
  PID:4472
- C:\Windows\System\wpyauqM.exe
  C:\Windows\System\wpyauqM.exe
  2⤵
  PID:4488
- C:\Windows\System\VjuPrpF.exe
  C:\Windows\System\VjuPrpF.exe
  2⤵
  PID:4508
- C:\Windows\System\yaaSXni.exe
  C:\Windows\System\yaaSXni.exe
  2⤵
  PID:4524
- C:\Windows\System\JqNoefn.exe
  C:\Windows\System\JqNoefn.exe
  2⤵
  PID:4548
- C:\Windows\System\UVWgstA.exe
  C:\Windows\System\UVWgstA.exe
  2⤵
  PID:4564
- C:\Windows\System\nBxIexy.exe
  C:\Windows\System\nBxIexy.exe
  2⤵
  PID:4584
- C:\Windows\System\GcJXDra.exe
  C:\Windows\System\GcJXDra.exe
  2⤵
  PID:4600
- C:\Windows\System\rnyYpLu.exe
  C:\Windows\System\rnyYpLu.exe
  2⤵
  PID:4616
- C:\Windows\System\GdIkyNY.exe
  C:\Windows\System\GdIkyNY.exe
  2⤵
  PID:4640
- C:\Windows\System\FTNFmPz.exe
  C:\Windows\System\FTNFmPz.exe
  2⤵
  PID:4656
- C:\Windows\System\tnPuACW.exe
  C:\Windows\System\tnPuACW.exe
  2⤵
  PID:4692
- C:\Windows\System\flFeikD.exe
  C:\Windows\System\flFeikD.exe
  2⤵
  PID:4712
- C:\Windows\System\fideHJx.exe
  C:\Windows\System\fideHJx.exe
  2⤵
  PID:4728
- C:\Windows\System\vFstrAM.exe
  C:\Windows\System\vFstrAM.exe
  2⤵
  PID:4756
- C:\Windows\System\VEgPZjQ.exe
  C:\Windows\System\VEgPZjQ.exe
  2⤵
  PID:4772
- C:\Windows\System\iMqAVPG.exe
  C:\Windows\System\iMqAVPG.exe
  2⤵
  PID:4796
- C:\Windows\System\TolbdTz.exe
  C:\Windows\System\TolbdTz.exe
  2⤵
  PID:4812
- C:\Windows\System\IOndpyR.exe
  C:\Windows\System\IOndpyR.exe
  2⤵
  PID:4832
- C:\Windows\System\kKpywxN.exe
  C:\Windows\System\kKpywxN.exe
  2⤵
  PID:4856
- C:\Windows\System\lXLpNfR.exe
  C:\Windows\System\lXLpNfR.exe
  2⤵
  PID:4872
- C:\Windows\System\xrGjMvA.exe
  C:\Windows\System\xrGjMvA.exe
  2⤵
  PID:4888
- C:\Windows\System\TnVNHWi.exe
  C:\Windows\System\TnVNHWi.exe
  2⤵
  PID:4912
- C:\Windows\System\pipxuDq.exe
  C:\Windows\System\pipxuDq.exe
  2⤵
  PID:4936
- C:\Windows\System\nLVEzQo.exe
  C:\Windows\System\nLVEzQo.exe
  2⤵
  PID:4956
- C:\Windows\System\aKPpUxj.exe
  C:\Windows\System\aKPpUxj.exe
  2⤵
  PID:4972
- C:\Windows\System\cnkevpL.exe
  C:\Windows\System\cnkevpL.exe
  2⤵
  PID:4992
- C:\Windows\System\ftJZhmT.exe
  C:\Windows\System\ftJZhmT.exe
  2⤵
  PID:5008
- C:\Windows\System\QUkpRan.exe
  C:\Windows\System\QUkpRan.exe
  2⤵
  PID:5032
- C:\Windows\System\OUisijF.exe
  C:\Windows\System\OUisijF.exe
  2⤵
  PID:5048
- C:\Windows\System\LBBnyYY.exe
  C:\Windows\System\LBBnyYY.exe
  2⤵
  PID:5068
- C:\Windows\System\NzlURQO.exe
  C:\Windows\System\NzlURQO.exe
  2⤵
  PID:5096
- C:\Windows\System\IBZzbsk.exe
  C:\Windows\System\IBZzbsk.exe
  2⤵
  PID:3460
- C:\Windows\System\jptsCDM.exe
  C:\Windows\System\jptsCDM.exe
  2⤵
  PID:3556
- C:\Windows\System\sAolHHG.exe
  C:\Windows\System\sAolHHG.exe
  2⤵
  PID:3820
- C:\Windows\System\TRzyOkA.exe
  C:\Windows\System\TRzyOkA.exe
  2⤵
  PID:3876
- C:\Windows\System\SLdYWUj.exe
  C:\Windows\System\SLdYWUj.exe
  2⤵
  PID:3516
- C:\Windows\System\jGqzwMf.exe
  C:\Windows\System\jGqzwMf.exe
  2⤵
  PID:3736
- C:\Windows\System\WiVXyoJ.exe
  C:\Windows\System\WiVXyoJ.exe
  2⤵
  PID:2828
- C:\Windows\System\mYEgEAR.exe
  C:\Windows\System\mYEgEAR.exe
  2⤵
  PID:2420
- C:\Windows\System\RzlhoAW.exe
  C:\Windows\System\RzlhoAW.exe
  2⤵
  PID:3700
- C:\Windows\System\pScoVyY.exe
  C:\Windows\System\pScoVyY.exe
  2⤵
  PID:2800
- C:\Windows\System\uhPAKyw.exe
  C:\Windows\System\uhPAKyw.exe
  2⤵
  PID:3264
- C:\Windows\System\txUaVwd.exe
  C:\Windows\System\txUaVwd.exe
  2⤵
  PID:1692
- C:\Windows\System\YsfBDeT.exe
  C:\Windows\System\YsfBDeT.exe
  2⤵
  PID:3252
- C:\Windows\System\usdTixN.exe
  C:\Windows\System\usdTixN.exe
  2⤵
  PID:3996
- C:\Windows\System\lpvFDnX.exe
  C:\Windows\System\lpvFDnX.exe
  2⤵
  PID:112
- C:\Windows\System\uIQpeEH.exe
  C:\Windows\System\uIQpeEH.exe
  2⤵
  PID:2556
- C:\Windows\System\EMXlrCP.exe
  C:\Windows\System\EMXlrCP.exe
  2⤵
  PID:3372
- C:\Windows\System\xHryZhL.exe
  C:\Windows\System\xHryZhL.exe
  2⤵
  PID:4160
- C:\Windows\System\RMqzSbV.exe
  C:\Windows\System\RMqzSbV.exe
  2⤵
  PID:4188
- C:\Windows\System\IbWRtHk.exe
  C:\Windows\System\IbWRtHk.exe
  2⤵
  PID:2608
- C:\Windows\System\oyMailg.exe
  C:\Windows\System\oyMailg.exe
  2⤵
  PID:4232
- C:\Windows\System\rTTtzrE.exe
  C:\Windows\System\rTTtzrE.exe
  2⤵
  PID:2596
- C:\Windows\System\COjPUWJ.exe
  C:\Windows\System\COjPUWJ.exe
  2⤵
  PID:3356
- C:\Windows\System\XYLHmEp.exe
  C:\Windows\System\XYLHmEp.exe
  2⤵
  PID:4292
- C:\Windows\System\FkcWJIp.exe
  C:\Windows\System\FkcWJIp.exe
  2⤵
  PID:4208
- C:\Windows\System\MLVMVsC.exe
  C:\Windows\System\MLVMVsC.exe
  2⤵
  PID:4136
- C:\Windows\System\BeBFGyk.exe
  C:\Windows\System\BeBFGyk.exe
  2⤵
  PID:4360
- C:\Windows\System\jCQcyol.exe
  C:\Windows\System\jCQcyol.exe
  2⤵
  PID:1440
- C:\Windows\System\qkQvPPW.exe
  C:\Windows\System\qkQvPPW.exe
  2⤵
  PID:4440
- C:\Windows\System\pmLOUOK.exe
  C:\Windows\System\pmLOUOK.exe
  2⤵
  PID:2408
- C:\Windows\System\lBRvgFd.exe
  C:\Windows\System\lBRvgFd.exe
  2⤵
  PID:4328
- C:\Windows\System\ubHkZOJ.exe
  C:\Windows\System\ubHkZOJ.exe
  2⤵
  PID:4344
- C:\Windows\System\tLMqXPR.exe
  C:\Windows\System\tLMqXPR.exe
  2⤵
  PID:4480
- C:\Windows\System\ewbFzsu.exe
  C:\Windows\System\ewbFzsu.exe
  2⤵
  PID:4424
- C:\Windows\System\DiEBhrU.exe
  C:\Windows\System\DiEBhrU.exe
  2⤵
  PID:4520
- C:\Windows\System\xFbksaB.exe
  C:\Windows\System\xFbksaB.exe
  2⤵
  PID:4576
- C:\Windows\System\cJYTgPh.exe
  C:\Windows\System\cJYTgPh.exe
  2⤵
  PID:4648
- C:\Windows\System\qekNeCC.exe
  C:\Windows\System\qekNeCC.exe
  2⤵
  PID:4536
- C:\Windows\System\FjcimPm.exe
  C:\Windows\System\FjcimPm.exe
  2⤵
  PID:2848
- C:\Windows\System\qmDNOgc.exe
  C:\Windows\System\qmDNOgc.exe
  2⤵
  PID:4676
- C:\Windows\System\wlnZrIu.exe
  C:\Windows\System\wlnZrIu.exe
  2⤵
  PID:4720
- C:\Windows\System\LbhSVXP.exe
  C:\Windows\System\LbhSVXP.exe
  2⤵
  PID:4724
- C:\Windows\System\SqnFndU.exe
  C:\Windows\System\SqnFndU.exe
  2⤵
  PID:448
- C:\Windows\System\IwYKdOV.exe
  C:\Windows\System\IwYKdOV.exe
  2⤵
  PID:3012
- C:\Windows\System\mhhTvLq.exe
  C:\Windows\System\mhhTvLq.exe
  2⤵
  PID:1968
- C:\Windows\System\tMLQlhN.exe
  C:\Windows\System\tMLQlhN.exe
  2⤵
  PID:2756
- C:\Windows\System\JAHYYtd.exe
  C:\Windows\System\JAHYYtd.exe
  2⤵
  PID:4768
- C:\Windows\System\RjPWvrw.exe
  C:\Windows\System\RjPWvrw.exe
  2⤵
  PID:4804
- C:\Windows\System\rBOjyNf.exe
  C:\Windows\System\rBOjyNf.exe
  2⤵
  PID:4852
- C:\Windows\System\vXmoghJ.exe
  C:\Windows\System\vXmoghJ.exe
  2⤵
  PID:4820
- C:\Windows\System\ocVEjMf.exe
  C:\Windows\System\ocVEjMf.exe
  2⤵
  PID:4920
- C:\Windows\System\HfNMnow.exe
  C:\Windows\System\HfNMnow.exe
  2⤵
  PID:4828
- C:\Windows\System\hVPgsaF.exe
  C:\Windows\System\hVPgsaF.exe
  2⤵
  PID:4900
- C:\Windows\System\bzrRRvL.exe
  C:\Windows\System\bzrRRvL.exe
  2⤵
  PID:1280
- C:\Windows\System\cnZPuHi.exe
  C:\Windows\System\cnZPuHi.exe
  2⤵
  PID:1408
- C:\Windows\System\RJnyUuF.exe
  C:\Windows\System\RJnyUuF.exe
  2⤵
  PID:4984
- C:\Windows\System\KeBqxeu.exe
  C:\Windows\System\KeBqxeu.exe
  2⤵
  PID:4964
- C:\Windows\System\bdmyalL.exe
  C:\Windows\System\bdmyalL.exe
  2⤵
  PID:5000
- C:\Windows\System\XVGGEuf.exe
  C:\Windows\System\XVGGEuf.exe
  2⤵
  PID:5044
- C:\Windows\System\BsfhcJz.exe
  C:\Windows\System\BsfhcJz.exe
  2⤵
  PID:1536
- C:\Windows\System\EQSXrWe.exe
  C:\Windows\System\EQSXrWe.exe
  2⤵
  PID:5080
- C:\Windows\System\SSEvjny.exe
  C:\Windows\System\SSEvjny.exe
  2⤵
  PID:5104
- C:\Windows\System\EhFEnPk.exe
  C:\Windows\System\EhFEnPk.exe
  2⤵
  PID:5028
- C:\Windows\System\BDKBxFW.exe
  C:\Windows\System\BDKBxFW.exe
  2⤵
  PID:1952
- C:\Windows\System\QwpAdsH.exe
  C:\Windows\System\QwpAdsH.exe
  2⤵
  PID:3496
- C:\Windows\System\geZLYDz.exe
  C:\Windows\System\geZLYDz.exe
  2⤵
  PID:3784
- C:\Windows\System\VwJvxju.exe
  C:\Windows\System\VwJvxju.exe
  2⤵
  PID:332
- C:\Windows\System\sIPHywH.exe
  C:\Windows\System\sIPHywH.exe
  2⤵
  PID:3704
- C:\Windows\System\GBDNGEA.exe
  C:\Windows\System\GBDNGEA.exe
  2⤵
  PID:3804
- C:\Windows\System\ojgExGN.exe
  C:\Windows\System\ojgExGN.exe
  2⤵
  PID:1640
- C:\Windows\System\ojVWAZL.exe
  C:\Windows\System\ojVWAZL.exe
  2⤵
  PID:3180
- C:\Windows\System\paLtjvY.exe
  C:\Windows\System\paLtjvY.exe
  2⤵
  PID:3136
- C:\Windows\System\DAbOwQU.exe
  C:\Windows\System\DAbOwQU.exe
  2⤵
  PID:2052
- C:\Windows\System\ozjZDBP.exe
  C:\Windows\System\ozjZDBP.exe
  2⤵
  PID:3420
- C:\Windows\System\xkfqhHY.exe
  C:\Windows\System\xkfqhHY.exe
  2⤵
  PID:4248
- C:\Windows\System\wdGaTnS.exe
  C:\Windows\System\wdGaTnS.exe
  2⤵
  PID:4268
- C:\Windows\System\ZBIBsnc.exe
  C:\Windows\System\ZBIBsnc.exe
  2⤵
  PID:3052
- C:\Windows\System\tIgVedq.exe
  C:\Windows\System\tIgVedq.exe
  2⤵
  PID:1620
- C:\Windows\System\GlsGjiI.exe
  C:\Windows\System\GlsGjiI.exe
  2⤵
  PID:4108
- C:\Windows\System\AWJyqQS.exe
  C:\Windows\System\AWJyqQS.exe
  2⤵
  PID:4172
- C:\Windows\System\IemmkNA.exe
  C:\Windows\System\IemmkNA.exe
  2⤵
  PID:4452
- C:\Windows\System\FcMbYRa.exe
  C:\Windows\System\FcMbYRa.exe
  2⤵
  PID:4420
- C:\Windows\System\pvEahLM.exe
  C:\Windows\System\pvEahLM.exe
  2⤵
  PID:4592
- C:\Windows\System\JBpjYfI.exe
  C:\Windows\System\JBpjYfI.exe
  2⤵
  PID:4468
- C:\Windows\System\uDynPAr.exe
  C:\Windows\System\uDynPAr.exe
  2⤵
  PID:4636
- C:\Windows\System\UTrWXkb.exe
  C:\Windows\System\UTrWXkb.exe
  2⤵
  PID:2664
- C:\Windows\System\blsuUxv.exe
  C:\Windows\System\blsuUxv.exe
  2⤵
  PID:4324
- C:\Windows\System\DopDZBe.exe
  C:\Windows\System\DopDZBe.exe
  2⤵
  PID:4500
- C:\Windows\System\IJiBkap.exe
  C:\Windows\System\IJiBkap.exe
  2⤵
  PID:4704
- C:\Windows\System\WheaiAi.exe
  C:\Windows\System\WheaiAi.exe
  2⤵
  PID:1648
- C:\Windows\System\anGGNrn.exe
  C:\Windows\System\anGGNrn.exe
  2⤵
  PID:900
- C:\Windows\System\BTToqnT.exe
  C:\Windows\System\BTToqnT.exe
  2⤵
  PID:4932
- C:\Windows\System\fpWgWRC.exe
  C:\Windows\System\fpWgWRC.exe
  2⤵
  PID:4908
- C:\Windows\System\RyKCTWp.exe
  C:\Windows\System\RyKCTWp.exe
  2⤵
  PID:2708
- C:\Windows\System\AOzvZlW.exe
  C:\Windows\System\AOzvZlW.exe
  2⤵
  PID:4744
- C:\Windows\System\ruavLEk.exe
  C:\Windows\System\ruavLEk.exe
  2⤵
  PID:4844
- C:\Windows\System\vyYCZEx.exe
  C:\Windows\System\vyYCZEx.exe
  2⤵
  PID:4928
- C:\Windows\System\kvQllyz.exe
  C:\Windows\System\kvQllyz.exe
  2⤵
  PID:2384
- C:\Windows\System\rnxHUlZ.exe
  C:\Windows\System\rnxHUlZ.exe
  2⤵
  PID:2368
- C:\Windows\System\UvGAkXb.exe
  C:\Windows\System\UvGAkXb.exe
  2⤵
  PID:1156
- C:\Windows\System\ubEekHJ.exe
  C:\Windows\System\ubEekHJ.exe
  2⤵
  PID:3620
- C:\Windows\System\hbNxbBQ.exe
  C:\Windows\System\hbNxbBQ.exe
  2⤵
  PID:3436
- C:\Windows\System\nVpXBzC.exe
  C:\Windows\System\nVpXBzC.exe
  2⤵
  PID:3976
- C:\Windows\System\mOquWJv.exe
  C:\Windows\System\mOquWJv.exe
  2⤵
  PID:2628
- C:\Windows\System\Slhonoe.exe
  C:\Windows\System\Slhonoe.exe
  2⤵
  PID:3196
- C:\Windows\System\HIuoCWW.exe
  C:\Windows\System\HIuoCWW.exe
  2⤵
  PID:2832
- C:\Windows\System\yZhsoqw.exe
  C:\Windows\System\yZhsoqw.exe
  2⤵
  PID:5024
- C:\Windows\System\QZGvcQw.exe
  C:\Windows\System\QZGvcQw.exe
  2⤵
  PID:3116
- C:\Windows\System\joyMiXY.exe
  C:\Windows\System\joyMiXY.exe
  2⤵
  PID:3980
- C:\Windows\System\dSkTOYk.exe
  C:\Windows\System\dSkTOYk.exe
  2⤵
  PID:2560
- C:\Windows\System\tYXkfJb.exe
  C:\Windows\System\tYXkfJb.exe
  2⤵
  PID:2552
- C:\Windows\System\PYftmrq.exe
  C:\Windows\System\PYftmrq.exe
  2⤵
  PID:2876
- C:\Windows\System\SbVriqU.exe
  C:\Windows\System\SbVriqU.exe
  2⤵
  PID:4784
- C:\Windows\System\PtgnvDh.exe
  C:\Windows\System\PtgnvDh.exe
  2⤵
  PID:4664
- C:\Windows\System\zRcnbSY.exe
  C:\Windows\System\zRcnbSY.exe
  2⤵
  PID:4952
- C:\Windows\System\bRqRSJU.exe
  C:\Windows\System\bRqRSJU.exe
  2⤵
  PID:4624
- C:\Windows\System\xBLTTmg.exe
  C:\Windows\System\xBLTTmg.exe
  2⤵
  PID:4388
- C:\Windows\System\aHahASS.exe
  C:\Windows\System\aHahASS.exe
  2⤵
  PID:1284
- C:\Windows\System\VIYTrVC.exe
  C:\Windows\System\VIYTrVC.exe
  2⤵
  PID:2480
- C:\Windows\System\RzJmspC.exe
  C:\Windows\System\RzJmspC.exe
  2⤵
  PID:5064
- C:\Windows\System\NNLSdvU.exe
  C:\Windows\System\NNLSdvU.exe
  2⤵
  PID:5108
- C:\Windows\System\LOFiZZu.exe
  C:\Windows\System\LOFiZZu.exe
  2⤵
  PID:1884
- C:\Windows\System\FeMOqTh.exe
  C:\Windows\System\FeMOqTh.exe
  2⤵
  PID:4896
- C:\Windows\System\YkXpteq.exe
  C:\Windows\System\YkXpteq.exe
  2⤵
  PID:4380
- C:\Windows\System\BCfkfxv.exe
  C:\Windows\System\BCfkfxv.exe
  2⤵
  PID:5020
- C:\Windows\System\LccIQjo.exe
  C:\Windows\System\LccIQjo.exe
  2⤵
  PID:5136
- C:\Windows\System\OuSDTUV.exe
  C:\Windows\System\OuSDTUV.exe
  2⤵
  PID:5152
- C:\Windows\System\nBQJXyd.exe
  C:\Windows\System\nBQJXyd.exe
  2⤵
  PID:5168
- C:\Windows\System\BLcfWfr.exe
  C:\Windows\System\BLcfWfr.exe
  2⤵
  PID:5184
- C:\Windows\System\BimuLgt.exe
  C:\Windows\System\BimuLgt.exe
  2⤵
  PID:5200
- C:\Windows\System\dCHhgwd.exe
  C:\Windows\System\dCHhgwd.exe
  2⤵
  PID:5216
- C:\Windows\System\ejByGXN.exe
  C:\Windows\System\ejByGXN.exe
  2⤵
  PID:5232
- C:\Windows\System\qyRqoMH.exe
  C:\Windows\System\qyRqoMH.exe
  2⤵
  PID:5248
- C:\Windows\System\NwQSyjz.exe
  C:\Windows\System\NwQSyjz.exe
  2⤵
  PID:5264
- C:\Windows\System\LbTvhkW.exe
  C:\Windows\System\LbTvhkW.exe
  2⤵
  PID:5280
- C:\Windows\System\gECigOd.exe
  C:\Windows\System\gECigOd.exe
  2⤵
  PID:5296
- C:\Windows\System\ylfayIS.exe
  C:\Windows\System\ylfayIS.exe
  2⤵
  PID:5312
- C:\Windows\System\FYetbgQ.exe
  C:\Windows\System\FYetbgQ.exe
  2⤵
  PID:5336
- C:\Windows\System\SdkQlRj.exe
  C:\Windows\System\SdkQlRj.exe
  2⤵
  PID:5352
- C:\Windows\System\NBuIkVD.exe
  C:\Windows\System\NBuIkVD.exe
  2⤵
  PID:5368
- C:\Windows\System\mZQuvNa.exe
  C:\Windows\System\mZQuvNa.exe
  2⤵
  PID:5384
- C:\Windows\System\ZMuKALH.exe
  C:\Windows\System\ZMuKALH.exe
  2⤵
  PID:5400
- C:\Windows\System\IpYFibd.exe
  C:\Windows\System\IpYFibd.exe
  2⤵
  PID:5416
- C:\Windows\System\wrXTgBb.exe
  C:\Windows\System\wrXTgBb.exe
  2⤵
  PID:5432
- C:\Windows\System\VlbhAwF.exe
  C:\Windows\System\VlbhAwF.exe
  2⤵
  PID:5448
- C:\Windows\System\xrqypWT.exe
  C:\Windows\System\xrqypWT.exe
  2⤵
  PID:5464
- C:\Windows\System\wpDwOIO.exe
  C:\Windows\System\wpDwOIO.exe
  2⤵
  PID:5480
- C:\Windows\System\ATCCiSo.exe
  C:\Windows\System\ATCCiSo.exe
  2⤵
  PID:5496
- C:\Windows\System\jyUIxoA.exe
  C:\Windows\System\jyUIxoA.exe
  2⤵
  PID:5512
- C:\Windows\System\VTFZaMG.exe
  C:\Windows\System\VTFZaMG.exe
  2⤵
  PID:5528
- C:\Windows\System\GIYjbLd.exe
  C:\Windows\System\GIYjbLd.exe
  2⤵
  PID:5544
- C:\Windows\System\bHyvZTk.exe
  C:\Windows\System\bHyvZTk.exe
  2⤵
  PID:5560
- C:\Windows\System\ZTNmHGd.exe
  C:\Windows\System\ZTNmHGd.exe
  2⤵
  PID:5576
- C:\Windows\System\gmHozdQ.exe
  C:\Windows\System\gmHozdQ.exe
  2⤵
  PID:5596
- C:\Windows\System\xTmAukQ.exe
  C:\Windows\System\xTmAukQ.exe
  2⤵
  PID:5612
- C:\Windows\System\FVsVxnk.exe
  C:\Windows\System\FVsVxnk.exe
  2⤵
  PID:5628
- C:\Windows\System\CJTyaHg.exe
  C:\Windows\System\CJTyaHg.exe
  2⤵
  PID:5644
- C:\Windows\System\LnLUBhF.exe
  C:\Windows\System\LnLUBhF.exe
  2⤵
  PID:5660
- C:\Windows\System\cXgQVsa.exe
  C:\Windows\System\cXgQVsa.exe
  2⤵
  PID:5676
- C:\Windows\System\PPqZrSJ.exe
  C:\Windows\System\PPqZrSJ.exe
  2⤵
  PID:5692
- C:\Windows\System\LmKbxsB.exe
  C:\Windows\System\LmKbxsB.exe
  2⤵
  PID:5708
- C:\Windows\System\wXNfxZV.exe
  C:\Windows\System\wXNfxZV.exe
  2⤵
  PID:5724
- C:\Windows\System\PCHknop.exe
  C:\Windows\System\PCHknop.exe
  2⤵
  PID:5740
- C:\Windows\System\hjQtroK.exe
  C:\Windows\System\hjQtroK.exe
  2⤵
  PID:5756
- C:\Windows\System\SrItQcK.exe
  C:\Windows\System\SrItQcK.exe
  2⤵
  PID:5772
- C:\Windows\System\ZcUqjDO.exe
  C:\Windows\System\ZcUqjDO.exe
  2⤵
  PID:5788
- C:\Windows\System\Ldflkqq.exe
  C:\Windows\System\Ldflkqq.exe
  2⤵
  PID:5804
- C:\Windows\System\ExZPzDp.exe
  C:\Windows\System\ExZPzDp.exe
  2⤵
  PID:5820
- C:\Windows\System\eBmgvDm.exe
  C:\Windows\System\eBmgvDm.exe
  2⤵
  PID:5836
- C:\Windows\System\yLjyYeq.exe
  C:\Windows\System\yLjyYeq.exe
  2⤵
  PID:5852
- C:\Windows\System\xBPcPxF.exe
  C:\Windows\System\xBPcPxF.exe
  2⤵
  PID:5868
- C:\Windows\System\JfXSXiM.exe
  C:\Windows\System\JfXSXiM.exe
  2⤵
  PID:5884
- C:\Windows\System\vBfUZLX.exe
  C:\Windows\System\vBfUZLX.exe
  2⤵
  PID:5900
- C:\Windows\System\SVXAKtv.exe
  C:\Windows\System\SVXAKtv.exe
  2⤵
  PID:5916
- C:\Windows\System\SsuSOjI.exe
  C:\Windows\System\SsuSOjI.exe
  2⤵
  PID:5932
- C:\Windows\System\BcCYOkt.exe
  C:\Windows\System\BcCYOkt.exe
  2⤵
  PID:5948
- C:\Windows\System\aalgyyJ.exe
  C:\Windows\System\aalgyyJ.exe
  2⤵
  PID:5964
- C:\Windows\System\KOSXAOv.exe
  C:\Windows\System\KOSXAOv.exe
  2⤵
  PID:5980
- C:\Windows\System\KACispb.exe
  C:\Windows\System\KACispb.exe
  2⤵
  PID:5996
- C:\Windows\System\EryqYpX.exe
  C:\Windows\System\EryqYpX.exe
  2⤵
  PID:6012
- C:\Windows\System\XEfmwGY.exe
  C:\Windows\System\XEfmwGY.exe
  2⤵
  PID:6028
- C:\Windows\System\mUHKbXV.exe
  C:\Windows\System\mUHKbXV.exe
  2⤵
  PID:6048
- C:\Windows\System\wlYRbPT.exe
  C:\Windows\System\wlYRbPT.exe
  2⤵
  PID:6064
- C:\Windows\System\QgyBkhC.exe
  C:\Windows\System\QgyBkhC.exe
  2⤵
  PID:6080
- C:\Windows\System\StbctWO.exe
  C:\Windows\System\StbctWO.exe
  2⤵
  PID:6096
- C:\Windows\System\qTdCVyf.exe
  C:\Windows\System\qTdCVyf.exe
  2⤵
  PID:6112
- C:\Windows\System\uZPdlsN.exe
  C:\Windows\System\uZPdlsN.exe
  2⤵
  PID:6128
- C:\Windows\System\JweERaJ.exe
  C:\Windows\System\JweERaJ.exe
  2⤵
  PID:4672
- C:\Windows\System\wrNBHyy.exe
  C:\Windows\System\wrNBHyy.exe
  2⤵
  PID:5144
- C:\Windows\System\FHzPkFZ.exe
  C:\Windows\System\FHzPkFZ.exe
  2⤵
  PID:5208
- C:\Windows\System\JghzLIh.exe
  C:\Windows\System\JghzLIh.exe
  2⤵
  PID:5272
- C:\Windows\System\FZdiNlV.exe
  C:\Windows\System\FZdiNlV.exe
  2⤵
  PID:2152
- C:\Windows\System\obxHOgH.exe
  C:\Windows\System\obxHOgH.exe
  2⤵
  PID:5092
- C:\Windows\System\ZozsbFA.exe
  C:\Windows\System\ZozsbFA.exe
  2⤵
  PID:5328
- C:\Windows\System\EfFCtFl.exe
  C:\Windows\System\EfFCtFl.exe
  2⤵
  PID:3880
- C:\Windows\System\xbZikVE.exe
  C:\Windows\System\xbZikVE.exe
  2⤵
  PID:4400
- C:\Windows\System\ANnXPyb.exe
  C:\Windows\System\ANnXPyb.exe
  2⤵
  PID:4340
- C:\Windows\System\IaaatSh.exe
  C:\Windows\System\IaaatSh.exe
  2⤵
  PID:4840
- C:\Windows\System\TFLiBaQ.exe
  C:\Windows\System\TFLiBaQ.exe
  2⤵
  PID:4980
- C:\Windows\System\OsUPeyQ.exe
  C:\Windows\System\OsUPeyQ.exe
  2⤵
  PID:5160
- C:\Windows\System\aXUXrWE.exe
  C:\Windows\System\aXUXrWE.exe
  2⤵
  PID:5224
- C:\Windows\System\emNFPsP.exe
  C:\Windows\System\emNFPsP.exe
  2⤵
  PID:5288
- C:\Windows\System\rtIxKob.exe
  C:\Windows\System\rtIxKob.exe
  2⤵
  PID:5360
- C:\Windows\System\GZrgwOd.exe
  C:\Windows\System\GZrgwOd.exe
  2⤵
  PID:5344
- C:\Windows\System\KsBCPkf.exe
  C:\Windows\System\KsBCPkf.exe
  2⤵
  PID:5408
- C:\Windows\System\fBacqIZ.exe
  C:\Windows\System\fBacqIZ.exe
  2⤵
  PID:5472
- C:\Windows\System\fCuqACz.exe
  C:\Windows\System\fCuqACz.exe
  2⤵
  PID:5536
- C:\Windows\System\ruhHjWi.exe
  C:\Windows\System\ruhHjWi.exe
  2⤵
  PID:5636
- C:\Windows\System\cYypLhi.exe
  C:\Windows\System\cYypLhi.exe
  2⤵
  PID:5604
- C:\Windows\System\XdsaCAX.exe
  C:\Windows\System\XdsaCAX.exe
  2⤵
  PID:5732
- C:\Windows\System\ueyfzmi.exe
  C:\Windows\System\ueyfzmi.exe
  2⤵
  PID:5796
- C:\Windows\System\nGxaoXL.exe
  C:\Windows\System\nGxaoXL.exe
  2⤵
  PID:5860
- C:\Windows\System\PdykwMT.exe
  C:\Windows\System\PdykwMT.exe
  2⤵
  PID:5924
- C:\Windows\System\IYpRMTO.exe
  C:\Windows\System\IYpRMTO.exe
  2⤵
  PID:5988
- C:\Windows\System\RgRNMIX.exe
  C:\Windows\System\RgRNMIX.exe
  2⤵
  PID:5992
- C:\Windows\System\lxwqSBc.exe
  C:\Windows\System\lxwqSBc.exe
  2⤵
  PID:5488
- C:\Windows\System\GJyUcVe.exe
  C:\Windows\System\GJyUcVe.exe
  2⤵
  PID:5552
- C:\Windows\System\sVlyOKL.exe
  C:\Windows\System\sVlyOKL.exe
  2⤵
  PID:5592
- C:\Windows\System\Ymjtzqn.exe
  C:\Windows\System\Ymjtzqn.exe
  2⤵
  PID:5656
- C:\Windows\System\GcAYzPS.exe
  C:\Windows\System\GcAYzPS.exe
  2⤵
  PID:5720
- C:\Windows\System\NvdHTCd.exe
  C:\Windows\System\NvdHTCd.exe
  2⤵
  PID:5784
- C:\Windows\System\qonwnSA.exe
  C:\Windows\System\qonwnSA.exe
  2⤵
  PID:5848
- C:\Windows\System\GVaHwtX.exe
  C:\Windows\System\GVaHwtX.exe
  2⤵
  PID:5912
- C:\Windows\System\SPuLAsp.exe
  C:\Windows\System\SPuLAsp.exe
  2⤵
  PID:5976
- C:\Windows\System\sKOytXR.exe
  C:\Windows\System\sKOytXR.exe
  2⤵
  PID:6088
- C:\Windows\System\LjChCsu.exe
  C:\Windows\System\LjChCsu.exe
  2⤵
  PID:4792
- C:\Windows\System\ihVyQQK.exe
  C:\Windows\System\ihVyQQK.exe
  2⤵
  PID:4988
- C:\Windows\System\bnjRVuZ.exe
  C:\Windows\System\bnjRVuZ.exe
  2⤵
  PID:4864
- C:\Windows\System\uyETyVy.exe
  C:\Windows\System\uyETyVy.exe
  2⤵
  PID:5192
- C:\Windows\System\eORdyzY.exe
  C:\Windows\System\eORdyzY.exe
  2⤵
  PID:5332
- C:\Windows\System\cgAIOrn.exe
  C:\Windows\System\cgAIOrn.exe
  2⤵
  PID:1132
- C:\Windows\System\BGkrxll.exe
  C:\Windows\System\BGkrxll.exe
  2⤵
  PID:6140
- C:\Windows\System\TNtSyZP.exe
  C:\Windows\System\TNtSyZP.exe
  2⤵
  PID:5308
- C:\Windows\System\lpEMHqk.exe
  C:\Windows\System\lpEMHqk.exe
  2⤵
  PID:2640
- C:\Windows\System\ktWfjAx.exe
  C:\Windows\System\ktWfjAx.exe
  2⤵
  PID:5260
- C:\Windows\System\EOySlmX.exe
  C:\Windows\System\EOySlmX.exe
  2⤵
  PID:5444
- C:\Windows\System\zdEUOYd.exe
  C:\Windows\System\zdEUOYd.exe
  2⤵
  PID:5380
- C:\Windows\System\MdPrVtf.exe
  C:\Windows\System\MdPrVtf.exe
  2⤵
  PID:5672
- C:\Windows\System\PyfCYYS.exe
  C:\Windows\System\PyfCYYS.exe
  2⤵
  PID:5896
- C:\Windows\System\yCmqHCL.exe
  C:\Windows\System\yCmqHCL.exe
  2⤵
  PID:5704
- C:\Windows\System\vtHLZRm.exe
  C:\Windows\System\vtHLZRm.exe
  2⤵
  PID:5652
- C:\Windows\System\cBwaKGD.exe
  C:\Windows\System\cBwaKGD.exe
  2⤵
  PID:5908
- C:\Windows\System\POJorVY.exe
  C:\Windows\System\POJorVY.exe
  2⤵
  PID:6056
- C:\Windows\System\mLUmxsD.exe
  C:\Windows\System\mLUmxsD.exe
  2⤵
  PID:5832
- C:\Windows\System\ZJvsCmy.exe
  C:\Windows\System\ZJvsCmy.exe
  2⤵
  PID:5460
- C:\Windows\System\TFzCpjY.exe
  C:\Windows\System\TFzCpjY.exe
  2⤵
  PID:5716
- C:\Windows\System\pzvUTrb.exe
  C:\Windows\System\pzvUTrb.exe
  2⤵
  PID:5972
- C:\Windows\System\WHFdaWP.exe
  C:\Windows\System\WHFdaWP.exe
  2⤵
  PID:2672
- C:\Windows\System\wGGnsYY.exe
  C:\Windows\System\wGGnsYY.exe
  2⤵
  PID:5240
- C:\Windows\System\UZEZWkm.exe
  C:\Windows\System\UZEZWkm.exe
  2⤵
  PID:6076
- C:\Windows\System\mrVwVOX.exe
  C:\Windows\System\mrVwVOX.exe
  2⤵
  PID:6072
- C:\Windows\System\qVeQBhd.exe
  C:\Windows\System\qVeQBhd.exe
  2⤵
  PID:5768
- C:\Windows\System\OrfmxDk.exe
  C:\Windows\System\OrfmxDk.exe
  2⤵
  PID:6044
- C:\Windows\System\kbTfzxr.exe
  C:\Windows\System\kbTfzxr.exe
  2⤵
  PID:5844
- C:\Windows\System\xiDtFTC.exe
  C:\Windows\System\xiDtFTC.exe
  2⤵
  PID:6136
- C:\Windows\System\ywzCZow.exe
  C:\Windows\System\ywzCZow.exe
  2⤵
  PID:5668
- C:\Windows\System\rMoEGFv.exe
  C:\Windows\System\rMoEGFv.exe
  2⤵
  PID:5880
- C:\Windows\System\jBwSgfS.exe
  C:\Windows\System\jBwSgfS.exe
  2⤵
  PID:6124
- C:\Windows\System\LTHDefk.exe
  C:\Windows\System\LTHDefk.exe
  2⤵
  PID:5304
- C:\Windows\System\lnoAWdf.exe
  C:\Windows\System\lnoAWdf.exe
  2⤵
  PID:4228
- C:\Windows\System\pEdvcrq.exe
  C:\Windows\System\pEdvcrq.exe
  2⤵
  PID:5324
- C:\Windows\System\fhKcIjw.exe
  C:\Windows\System\fhKcIjw.exe
  2⤵
  PID:6156
- C:\Windows\System\RHZzxni.exe
  C:\Windows\System\RHZzxni.exe
  2⤵
  PID:6172
- C:\Windows\System\qTIDdbd.exe
  C:\Windows\System\qTIDdbd.exe
  2⤵
  PID:6192
- C:\Windows\System\HGYxQbO.exe
  C:\Windows\System\HGYxQbO.exe
  2⤵
  PID:6208
- C:\Windows\System\CkAEZZJ.exe
  C:\Windows\System\CkAEZZJ.exe
  2⤵
  PID:6224
- C:\Windows\System\voppVzK.exe
  C:\Windows\System\voppVzK.exe
  2⤵
  PID:6240
- C:\Windows\System\FOoVYJe.exe
  C:\Windows\System\FOoVYJe.exe
  2⤵
  PID:6256
- C:\Windows\System\ZhWyIne.exe
  C:\Windows\System\ZhWyIne.exe
  2⤵
  PID:6272
- C:\Windows\System\ZvcPnHG.exe
  C:\Windows\System\ZvcPnHG.exe
  2⤵
  PID:6288
- C:\Windows\System\TTulSRd.exe
  C:\Windows\System\TTulSRd.exe
  2⤵
  PID:6304
- C:\Windows\System\akanOQX.exe
  C:\Windows\System\akanOQX.exe
  2⤵
  PID:6324
- C:\Windows\System\YPITqdr.exe
  C:\Windows\System\YPITqdr.exe
  2⤵
  PID:6340
- C:\Windows\System\RhLZdyI.exe
  C:\Windows\System\RhLZdyI.exe
  2⤵
  PID:6356
- C:\Windows\System\vZhtGsA.exe
  C:\Windows\System\vZhtGsA.exe
  2⤵
  PID:6372
- C:\Windows\System\QdStEzr.exe
  C:\Windows\System\QdStEzr.exe
  2⤵
  PID:6388
- C:\Windows\System\aBgsRRR.exe
  C:\Windows\System\aBgsRRR.exe
  2⤵
  PID:6404
- C:\Windows\System\kioHJgd.exe
  C:\Windows\System\kioHJgd.exe
  2⤵
  PID:6424
- C:\Windows\System\estxazO.exe
  C:\Windows\System\estxazO.exe
  2⤵
  PID:6440
- C:\Windows\System\bGDlUQL.exe
  C:\Windows\System\bGDlUQL.exe
  2⤵
  PID:6460
- C:\Windows\System\lQqMseC.exe
  C:\Windows\System\lQqMseC.exe
  2⤵
  PID:6476
- C:\Windows\System\QXGfGIx.exe
  C:\Windows\System\QXGfGIx.exe
  2⤵
  PID:6492
- C:\Windows\System\qXrhihM.exe
  C:\Windows\System\qXrhihM.exe
  2⤵
  PID:6508
- C:\Windows\System\oDxFcNb.exe
  C:\Windows\System\oDxFcNb.exe
  2⤵
  PID:6528
- C:\Windows\System\TIbsylf.exe
  C:\Windows\System\TIbsylf.exe
  2⤵
  PID:6544
- C:\Windows\System\xyYVvas.exe
  C:\Windows\System\xyYVvas.exe
  2⤵
  PID:6560
- C:\Windows\System\xgzUKRb.exe
  C:\Windows\System\xgzUKRb.exe
  2⤵
  PID:6576
- C:\Windows\System\chGBKoK.exe
  C:\Windows\System\chGBKoK.exe
  2⤵
  PID:6592
- C:\Windows\System\KHwuMBy.exe
  C:\Windows\System\KHwuMBy.exe
  2⤵
  PID:6608
- C:\Windows\System\SRTPXxx.exe
  C:\Windows\System\SRTPXxx.exe
  2⤵
  PID:6624
- C:\Windows\System\MeraaQe.exe
  C:\Windows\System\MeraaQe.exe
  2⤵
  PID:6640
- C:\Windows\System\KfZlzgv.exe
  C:\Windows\System\KfZlzgv.exe
  2⤵
  PID:6656
- C:\Windows\System\tjgRlws.exe
  C:\Windows\System\tjgRlws.exe
  2⤵
  PID:6672
- C:\Windows\System\QdAuQCH.exe
  C:\Windows\System\QdAuQCH.exe
  2⤵
  PID:6688
- C:\Windows\System\qZkJfbj.exe
  C:\Windows\System\qZkJfbj.exe
  2⤵
  PID:6704
- C:\Windows\System\SubTxYT.exe
  C:\Windows\System\SubTxYT.exe
  2⤵
  PID:6720
- C:\Windows\System\kSGRpRT.exe
  C:\Windows\System\kSGRpRT.exe
  2⤵
  PID:6736
- C:\Windows\System\TyiFnDR.exe
  C:\Windows\System\TyiFnDR.exe
  2⤵
  PID:6752
- C:\Windows\System\NLJJsLu.exe
  C:\Windows\System\NLJJsLu.exe
  2⤵
  PID:6768
- C:\Windows\System\TGzZigj.exe
  C:\Windows\System\TGzZigj.exe
  2⤵
  PID:6784
- C:\Windows\System\loxwHxN.exe
  C:\Windows\System\loxwHxN.exe
  2⤵
  PID:6800
- C:\Windows\System\TdDonUq.exe
  C:\Windows\System\TdDonUq.exe
  2⤵
  PID:6816
- C:\Windows\System\CzuDpkn.exe
  C:\Windows\System\CzuDpkn.exe
  2⤵
  PID:6832
- C:\Windows\System\qkCLZhX.exe
  C:\Windows\System\qkCLZhX.exe
  2⤵
  PID:6848
- C:\Windows\System\dRUkain.exe
  C:\Windows\System\dRUkain.exe
  2⤵
  PID:6864
- C:\Windows\System\iajdpuW.exe
  C:\Windows\System\iajdpuW.exe
  2⤵
  PID:6880
- C:\Windows\System\YiwVmaH.exe
  C:\Windows\System\YiwVmaH.exe
  2⤵
  PID:6896
- C:\Windows\System\dSwPVdL.exe
  C:\Windows\System\dSwPVdL.exe
  2⤵
  PID:6912
- C:\Windows\System\eJDKBMf.exe
  C:\Windows\System\eJDKBMf.exe
  2⤵
  PID:6928
- C:\Windows\System\CngfiGA.exe
  C:\Windows\System\CngfiGA.exe
  2⤵
  PID:6944
- C:\Windows\System\qOrwZts.exe
  C:\Windows\System\qOrwZts.exe
  2⤵
  PID:6960
- C:\Windows\System\EJzIknv.exe
  C:\Windows\System\EJzIknv.exe
  2⤵
  PID:6976
- C:\Windows\System\LLuwKhj.exe
  C:\Windows\System\LLuwKhj.exe
  2⤵
  PID:6992
- C:\Windows\System\ZjXQxCX.exe
  C:\Windows\System\ZjXQxCX.exe
  2⤵
  PID:7008
- C:\Windows\System\qkgOmVv.exe
  C:\Windows\System\qkgOmVv.exe
  2⤵
  PID:7024
- C:\Windows\System\RHtRYGN.exe
  C:\Windows\System\RHtRYGN.exe
  2⤵
  PID:7040
- C:\Windows\System\YRNvwkz.exe
  C:\Windows\System\YRNvwkz.exe
  2⤵
  PID:7060
- C:\Windows\System\dzyZxps.exe
  C:\Windows\System\dzyZxps.exe
  2⤵
  PID:7076
- C:\Windows\System\mNisTMP.exe
  C:\Windows\System\mNisTMP.exe
  2⤵
  PID:7092
- C:\Windows\System\pexBVrs.exe
  C:\Windows\System\pexBVrs.exe
  2⤵
  PID:7108
- C:\Windows\System\TlNogPo.exe
  C:\Windows\System\TlNogPo.exe
  2⤵
  PID:7124
- C:\Windows\System\lseEjta.exe
  C:\Windows\System\lseEjta.exe
  2⤵
  PID:7140
- C:\Windows\System\IVZkxSM.exe
  C:\Windows\System\IVZkxSM.exe
  2⤵
  PID:7156
- C:\Windows\System\rglAzse.exe
  C:\Windows\System\rglAzse.exe
  2⤵
  PID:6164
- C:\Windows\System\aETXFmI.exe
  C:\Windows\System\aETXFmI.exe
  2⤵
  PID:5572
- C:\Windows\System\MYEjCAW.exe
  C:\Windows\System\MYEjCAW.exe
  2⤵
  PID:5960
- C:\Windows\System\fSdJXmh.exe
  C:\Windows\System\fSdJXmh.exe
  2⤵
  PID:5588
- C:\Windows\System\CUrLpls.exe
  C:\Windows\System\CUrLpls.exe
  2⤵
  PID:6148
- C:\Windows\System\CyyOIeN.exe
  C:\Windows\System\CyyOIeN.exe
  2⤵
  PID:6188
- C:\Windows\System\tIgrbmY.exe
  C:\Windows\System\tIgrbmY.exe
  2⤵
  PID:6252
- C:\Windows\System\udFKAvO.exe
  C:\Windows\System\udFKAvO.exe
  2⤵
  PID:6268
- C:\Windows\System\BISYiHM.exe
  C:\Windows\System\BISYiHM.exe
  2⤵
  PID:6320
- C:\Windows\System\HNHlXrn.exe
  C:\Windows\System\HNHlXrn.exe
  2⤵
  PID:6336
- C:\Windows\System\RSwQWVw.exe
  C:\Windows\System\RSwQWVw.exe
  2⤵
  PID:6400
- C:\Windows\System\BpMNWeS.exe
  C:\Windows\System\BpMNWeS.exe
  2⤵
  PID:6472
- C:\Windows\System\DNYHrju.exe
  C:\Windows\System\DNYHrju.exe
  2⤵
  PID:6540
- C:\Windows\System\ckLbLDt.exe
  C:\Windows\System\ckLbLDt.exe
  2⤵
  PID:6384
- C:\Windows\System\iYpvIcw.exe
  C:\Windows\System\iYpvIcw.exe
  2⤵
  PID:6448
- C:\Windows\System\LLomSfN.exe
  C:\Windows\System\LLomSfN.exe
  2⤵
  PID:6488
- C:\Windows\System\quJxoij.exe
  C:\Windows\System\quJxoij.exe
  2⤵
  PID:6552
- C:\Windows\System\IlbEzTV.exe
  C:\Windows\System\IlbEzTV.exe
  2⤵
  PID:6604
- C:\Windows\System\tsMDCoQ.exe
  C:\Windows\System\tsMDCoQ.exe
  2⤵
  PID:6668
- C:\Windows\System\IBSCaJw.exe
  C:\Windows\System\IBSCaJw.exe
  2⤵
  PID:6732
- C:\Windows\System\MhJULgo.exe
  C:\Windows\System\MhJULgo.exe
  2⤵
  PID:6556
- C:\Windows\System\QQvWcqX.exe
  C:\Windows\System\QQvWcqX.exe
  2⤵
  PID:6860
- C:\Windows\System\zYwQryh.exe
  C:\Windows\System\zYwQryh.exe
  2⤵
  PID:6924
- C:\Windows\System\qbYCKwY.exe
  C:\Windows\System\qbYCKwY.exe
  2⤵
  PID:6988
- C:\Windows\System\rHZcYtV.exe
  C:\Windows\System\rHZcYtV.exe
  2⤵
  PID:7052
- C:\Windows\System\sPZUhFk.exe
  C:\Windows\System\sPZUhFk.exe
  2⤵
  PID:7116
- C:\Windows\System\ilgvrVQ.exe
  C:\Windows\System\ilgvrVQ.exe
  2⤵
  PID:7072
- C:\Windows\System\MvVCUYI.exe
  C:\Windows\System\MvVCUYI.exe
  2⤵
  PID:6840
- C:\Windows\System\abSfFQG.exe
  C:\Windows\System\abSfFQG.exe
  2⤵
  PID:6776
- C:\Windows\System\JAUweRK.exe
  C:\Windows\System\JAUweRK.exe
  2⤵
  PID:6712
- C:\Windows\System\jmcpSdC.exe
  C:\Windows\System\jmcpSdC.exe
  2⤵
  PID:6680
- C:\Windows\System\dhxnShE.exe
  C:\Windows\System\dhxnShE.exe
  2⤵
  PID:6936
- C:\Windows\System\SdYILIO.exe
  C:\Windows\System\SdYILIO.exe
  2⤵
  PID:7004
- C:\Windows\System\wXtztmU.exe
  C:\Windows\System\wXtztmU.exe
  2⤵
  PID:7068
- C:\Windows\System\TtVQFwl.exe
  C:\Windows\System\TtVQFwl.exe
  2⤵
  PID:7148
- C:\Windows\System\tKdAyiM.exe
  C:\Windows\System\tKdAyiM.exe
  2⤵
  PID:5440
- C:\Windows\System\BBOLZsP.exe
  C:\Windows\System\BBOLZsP.exe
  2⤵
  PID:7136
- C:\Windows\System\vABKCjE.exe
  C:\Windows\System\vABKCjE.exe
  2⤵
  PID:6300
- C:\Windows\System\zBLCVFD.exe
  C:\Windows\System\zBLCVFD.exe
  2⤵
  PID:6380
- C:\Windows\System\yPzXOrm.exe
  C:\Windows\System\yPzXOrm.exe
  2⤵
  PID:5700
- C:\Windows\System\DKXseen.exe
  C:\Windows\System\DKXseen.exe
  2⤵
  PID:5524
- C:\Windows\System\LlGHqTs.exe
  C:\Windows\System\LlGHqTs.exe
  2⤵
  PID:6312
- C:\Windows\System\bWYeNNS.exe
  C:\Windows\System\bWYeNNS.exe
  2⤵
  PID:6536
- C:\Windows\System\CGcCROJ.exe
  C:\Windows\System\CGcCROJ.exe
  2⤵
  PID:6524
- C:\Windows\System\dbeFxAK.exe
  C:\Windows\System\dbeFxAK.exe
  2⤵
  PID:6828
- C:\Windows\System\ZenbbuU.exe
  C:\Windows\System\ZenbbuU.exe
  2⤵
  PID:6664
- C:\Windows\System\CjZPtPG.exe
  C:\Windows\System\CjZPtPG.exe
  2⤵
  PID:7088
- C:\Windows\System\MOXXzvl.exe
  C:\Windows\System\MOXXzvl.exe
  2⤵
  PID:6920
- C:\Windows\System\SPzGkpL.exe
  C:\Windows\System\SPzGkpL.exe
  2⤵
  PID:6584
- C:\Windows\System\uQDrNWi.exe
  C:\Windows\System\uQDrNWi.exe
  2⤵
  PID:6780
- C:\Windows\System\aeEdqnj.exe
  C:\Windows\System\aeEdqnj.exe
  2⤵
  PID:6968
- C:\Windows\System\QhOTTLA.exe
  C:\Windows\System\QhOTTLA.exe
  2⤵
  PID:6908
- C:\Windows\System\ENVyMFx.exe
  C:\Windows\System\ENVyMFx.exe
  2⤵
  PID:6204
- C:\Windows\System\bZBufQp.exe
  C:\Windows\System\bZBufQp.exe
  2⤵
  PID:6236
- C:\Windows\System\GffPANe.exe
  C:\Windows\System\GffPANe.exe
  2⤵
  PID:6248
- C:\Windows\System\oPbMokx.exe
  C:\Windows\System\oPbMokx.exe
  2⤵
  PID:6504
- C:\Windows\System\EtCEuGU.exe
  C:\Windows\System\EtCEuGU.exe
  2⤵
  PID:6420
- C:\Windows\System\YODnMnp.exe
  C:\Windows\System\YODnMnp.exe
  2⤵
  PID:6368
- C:\Windows\System\WgqoyLC.exe
  C:\Windows\System\WgqoyLC.exe
  2⤵
  PID:6844
- C:\Windows\System\QVQagEw.exe
  C:\Windows\System\QVQagEw.exe
  2⤵
  PID:6808
- C:\Windows\System\cLrtjQj.exe
  C:\Windows\System\cLrtjQj.exe
  2⤵
  PID:7020
- C:\Windows\System\VyUdiJc.exe
  C:\Windows\System\VyUdiJc.exe
  2⤵
  PID:6616
- C:\Windows\System\DuLyaJQ.exe
  C:\Windows\System\DuLyaJQ.exe
  2⤵
  PID:7164
- C:\Windows\System\NSzkxFv.exe
  C:\Windows\System\NSzkxFv.exe
  2⤵
  PID:6956
- C:\Windows\System\KqLRDhJ.exe
  C:\Windows\System\KqLRDhJ.exe
  2⤵
  PID:6700
- C:\Windows\System\mUVOrtj.exe
  C:\Windows\System\mUVOrtj.exe
  2⤵
  PID:6200
- C:\Windows\System\ywooKrZ.exe
  C:\Windows\System\ywooKrZ.exe
  2⤵
  PID:7036
- C:\Windows\System\DBvcNIf.exe
  C:\Windows\System\DBvcNIf.exe
  2⤵
  PID:6456
- C:\Windows\System\KMGyyjd.exe
  C:\Windows\System\KMGyyjd.exe
  2⤵
  PID:7172
- C:\Windows\System\RaHjHgk.exe
  C:\Windows\System\RaHjHgk.exe
  2⤵
  PID:7192
- C:\Windows\System\IqApzEu.exe
  C:\Windows\System\IqApzEu.exe
  2⤵
  PID:7208
- C:\Windows\System\odaKxYt.exe
  C:\Windows\System\odaKxYt.exe
  2⤵
  PID:7228
- C:\Windows\System\eSKFYoO.exe
  C:\Windows\System\eSKFYoO.exe
  2⤵
  PID:7244
- C:\Windows\System\pPAsqTe.exe
  C:\Windows\System\pPAsqTe.exe
  2⤵
  PID:7260
- C:\Windows\System\SdqHFNO.exe
  C:\Windows\System\SdqHFNO.exe
  2⤵
  PID:7276
- C:\Windows\System\DohuKVs.exe
  C:\Windows\System\DohuKVs.exe
  2⤵
  PID:7292
- C:\Windows\System\QkPiRDT.exe
  C:\Windows\System\QkPiRDT.exe
  2⤵
  PID:7308
- C:\Windows\System\ekxQXUO.exe
  C:\Windows\System\ekxQXUO.exe
  2⤵
  PID:7324
- C:\Windows\System\eqbmpcx.exe
  C:\Windows\System\eqbmpcx.exe
  2⤵
  PID:7340
- C:\Windows\System\yrzHvun.exe
  C:\Windows\System\yrzHvun.exe
  2⤵
  PID:7356
- C:\Windows\System\pyiGrPD.exe
  C:\Windows\System\pyiGrPD.exe
  2⤵
  PID:7372
- C:\Windows\System\KnxXpBa.exe
  C:\Windows\System\KnxXpBa.exe
  2⤵
  PID:7388
- C:\Windows\System\jnHwGTE.exe
  C:\Windows\System\jnHwGTE.exe
  2⤵
  PID:7404
- C:\Windows\System\bmylpyf.exe
  C:\Windows\System\bmylpyf.exe
  2⤵
  PID:7420
- C:\Windows\System\kurSUIO.exe
  C:\Windows\System\kurSUIO.exe
  2⤵
  PID:7436
- C:\Windows\System\NgrxKUr.exe
  C:\Windows\System\NgrxKUr.exe
  2⤵
  PID:7452
- C:\Windows\System\pLVoxeo.exe
  C:\Windows\System\pLVoxeo.exe
  2⤵
  PID:7472
- C:\Windows\System\uFdFWzR.exe
  C:\Windows\System\uFdFWzR.exe
  2⤵
  PID:7488
- C:\Windows\System\scfUMAD.exe
  C:\Windows\System\scfUMAD.exe
  2⤵
  PID:7504
- C:\Windows\System\cdjMKqf.exe
  C:\Windows\System\cdjMKqf.exe
  2⤵
  PID:7520
- C:\Windows\System\UoRfiGg.exe
  C:\Windows\System\UoRfiGg.exe
  2⤵
  PID:7536
- C:\Windows\System\BXWqchV.exe
  C:\Windows\System\BXWqchV.exe
  2⤵
  PID:7552
- C:\Windows\System\mWaoKUw.exe
  C:\Windows\System\mWaoKUw.exe
  2⤵
  PID:7568
- C:\Windows\System\BDmMwHO.exe
  C:\Windows\System\BDmMwHO.exe
  2⤵
  PID:7584
- C:\Windows\System\ohCOynZ.exe
  C:\Windows\System\ohCOynZ.exe
  2⤵
  PID:7600
- C:\Windows\System\lXnjKWz.exe
  C:\Windows\System\lXnjKWz.exe
  2⤵
  PID:7616
- C:\Windows\System\jrmYbva.exe
  C:\Windows\System\jrmYbva.exe
  2⤵
  PID:7632
- C:\Windows\System\dGdsaqT.exe
  C:\Windows\System\dGdsaqT.exe
  2⤵
  PID:7648
- C:\Windows\System\EtMDCUM.exe
  C:\Windows\System\EtMDCUM.exe
  2⤵
  PID:7664
- C:\Windows\System\doodKLk.exe
  C:\Windows\System\doodKLk.exe
  2⤵
  PID:7680
- C:\Windows\System\kCeivhC.exe
  C:\Windows\System\kCeivhC.exe
  2⤵
  PID:7696
- C:\Windows\System\HnTNOMF.exe
  C:\Windows\System\HnTNOMF.exe
  2⤵
  PID:7712
- C:\Windows\System\DnNqTbE.exe
  C:\Windows\System\DnNqTbE.exe
  2⤵
  PID:7728
- C:\Windows\System\SKqFhgU.exe
  C:\Windows\System\SKqFhgU.exe
  2⤵
  PID:7748
- C:\Windows\System\degqZdf.exe
  C:\Windows\System\degqZdf.exe
  2⤵
  PID:7764
- C:\Windows\System\gcHqWGg.exe
  C:\Windows\System\gcHqWGg.exe
  2⤵
  PID:7784
- C:\Windows\System\xnDVZNC.exe
  C:\Windows\System\xnDVZNC.exe
  2⤵
  PID:7800
- C:\Windows\System\blXygbv.exe
  C:\Windows\System\blXygbv.exe
  2⤵
  PID:7816
- C:\Windows\System\ouWqJcu.exe
  C:\Windows\System\ouWqJcu.exe
  2⤵
  PID:7832
- C:\Windows\System\hvfjTsK.exe
  C:\Windows\System\hvfjTsK.exe
  2⤵
  PID:7848
- C:\Windows\System\pOfCTJp.exe
  C:\Windows\System\pOfCTJp.exe
  2⤵
  PID:7864
- C:\Windows\System\jXCAAgY.exe
  C:\Windows\System\jXCAAgY.exe
  2⤵
  PID:7880
- C:\Windows\System\bkTCrjn.exe
  C:\Windows\System\bkTCrjn.exe
  2⤵
  PID:7896
- C:\Windows\System\hJMkLsy.exe
  C:\Windows\System\hJMkLsy.exe
  2⤵
  PID:7912
- C:\Windows\System\GBmFtbn.exe
  C:\Windows\System\GBmFtbn.exe
  2⤵
  PID:7928
- C:\Windows\System\wdDWojF.exe
  C:\Windows\System\wdDWojF.exe
  2⤵
  PID:7944
- C:\Windows\System\joswVIJ.exe
  C:\Windows\System\joswVIJ.exe
  2⤵
  PID:7960
- C:\Windows\System\ZMGSXmE.exe
  C:\Windows\System\ZMGSXmE.exe
  2⤵
  PID:7976
- C:\Windows\System\ehvVpcv.exe
  C:\Windows\System\ehvVpcv.exe
  2⤵
  PID:7992
- C:\Windows\System\mdCuAYi.exe
  C:\Windows\System\mdCuAYi.exe
  2⤵
  PID:8008
- C:\Windows\System\JctlLsk.exe
  C:\Windows\System\JctlLsk.exe
  2⤵
  PID:8024
- C:\Windows\System\sVZzxOt.exe
  C:\Windows\System\sVZzxOt.exe
  2⤵
  PID:8040
- C:\Windows\System\hGxlWno.exe
  C:\Windows\System\hGxlWno.exe
  2⤵
  PID:8056
- C:\Windows\System\oBUZgGF.exe
  C:\Windows\System\oBUZgGF.exe
  2⤵
  PID:8072
- C:\Windows\System\LOBAWZA.exe
  C:\Windows\System\LOBAWZA.exe
  2⤵
  PID:8092
- C:\Windows\System\wRdDnhd.exe
  C:\Windows\System\wRdDnhd.exe
  2⤵
  PID:8108
- C:\Windows\System\jXpbDwB.exe
  C:\Windows\System\jXpbDwB.exe
  2⤵
  PID:8124
- C:\Windows\System\YxxgRpM.exe
  C:\Windows\System\YxxgRpM.exe
  2⤵
  PID:8140
- C:\Windows\System\NYAomps.exe
  C:\Windows\System\NYAomps.exe
  2⤵
  PID:8156
- C:\Windows\System\ZOIVvBk.exe
  C:\Windows\System\ZOIVvBk.exe
  2⤵
  PID:8172
- C:\Windows\System\RIWuiIX.exe
  C:\Windows\System\RIWuiIX.exe
  2⤵
  PID:7180
- C:\Windows\System\AdkyBZi.exe
  C:\Windows\System\AdkyBZi.exe
  2⤵
  PID:6280
- C:\Windows\System\MHOJAFF.exe
  C:\Windows\System\MHOJAFF.exe
  2⤵
  PID:7252
- C:\Windows\System\KnNvVNm.exe
  C:\Windows\System\KnNvVNm.exe
  2⤵
  PID:7316
- C:\Windows\System\lMrsMHl.exe
  C:\Windows\System\lMrsMHl.exe
  2⤵
  PID:7048
- C:\Windows\System\GXHRbtu.exe
  C:\Windows\System\GXHRbtu.exe
  2⤵
  PID:7240
- C:\Windows\System\IOczFHg.exe
  C:\Windows\System\IOczFHg.exe
  2⤵
  PID:7304
- C:\Windows\System\pgavCME.exe
  C:\Windows\System\pgavCME.exe
  2⤵
  PID:7364
- C:\Windows\System\olmIgxo.exe
  C:\Windows\System\olmIgxo.exe
  2⤵
  PID:7448
- C:\Windows\System\zAfZZLu.exe
  C:\Windows\System\zAfZZLu.exe
  2⤵
  PID:7204
- C:\Windows\System\gillJbP.exe
  C:\Windows\System\gillJbP.exe
  2⤵
  PID:7544
- C:\Windows\System\hmRbrMH.exe
  C:\Windows\System\hmRbrMH.exe
  2⤵
  PID:7268
- C:\Windows\System\xmiDvcF.exe
  C:\Windows\System\xmiDvcF.exe
  2⤵
  PID:7612
- C:\Windows\System\tWeExac.exe
  C:\Windows\System\tWeExac.exe
  2⤵
  PID:7396
- C:\Windows\System\pEWCNSo.exe
  C:\Windows\System\pEWCNSo.exe
  2⤵
  PID:7428
- C:\Windows\System\zLMaREu.exe
  C:\Windows\System\zLMaREu.exe
  2⤵
  PID:7496
- C:\Windows\System\nHYfkkY.exe
  C:\Windows\System\nHYfkkY.exe
  2⤵
  PID:7676
- C:\Windows\System\PNwqLRW.exe
  C:\Windows\System\PNwqLRW.exe
  2⤵
  PID:7624
- C:\Windows\System\vzWgZNL.exe
  C:\Windows\System\vzWgZNL.exe
  2⤵
  PID:7740
- C:\Windows\System\PltuQyE.exe
  C:\Windows\System\PltuQyE.exe
  2⤵
  PID:7744
- C:\Windows\System\TRLAURw.exe
  C:\Windows\System\TRLAURw.exe
  2⤵
  PID:7808
- C:\Windows\System\aDGFpQg.exe
  C:\Windows\System\aDGFpQg.exe
  2⤵
  PID:7824
- C:\Windows\System\VRfhiSZ.exe
  C:\Windows\System\VRfhiSZ.exe
  2⤵
  PID:7796
- C:\Windows\System\LyCIrTD.exe
  C:\Windows\System\LyCIrTD.exe
  2⤵
  PID:7876
- C:\Windows\System\MUxxAKE.exe
  C:\Windows\System\MUxxAKE.exe
  2⤵
  PID:7940
- C:\Windows\System\foBUgZW.exe
  C:\Windows\System\foBUgZW.exe
  2⤵
  PID:8004
- C:\Windows\System\eROkbRA.exe
  C:\Windows\System\eROkbRA.exe
  2⤵
  PID:8068
- C:\Windows\System\ShSKgBv.exe
  C:\Windows\System\ShSKgBv.exe
  2⤵
  PID:8136
- C:\Windows\System\wDDrTJb.exe
  C:\Windows\System\wDDrTJb.exe
  2⤵
  PID:8168
- C:\Windows\System\YoVbzFW.exe
  C:\Windows\System\YoVbzFW.exe
  2⤵
  PID:7188
- C:\Windows\System\tRWRNIB.exe
  C:\Windows\System\tRWRNIB.exe
  2⤵
  PID:7984
- C:\Windows\System\FfKxIOz.exe
  C:\Windows\System\FfKxIOz.exe
  2⤵
  PID:8048
- C:\Windows\System\ltGdNzv.exe
  C:\Windows\System\ltGdNzv.exe
  2⤵
  PID:8116
- C:\Windows\System\bGKDQHh.exe
  C:\Windows\System\bGKDQHh.exe
  2⤵
  PID:8184
- C:\Windows\System\CKtpOGa.exe
  C:\Windows\System\CKtpOGa.exe
  2⤵
  PID:7384
- C:\Windows\System\EuaBCUB.exe
  C:\Windows\System\EuaBCUB.exe
  2⤵
  PID:7348
- C:\Windows\System\OoLCjGj.exe
  C:\Windows\System\OoLCjGj.exe
  2⤵
  PID:7300
- C:\Windows\System\RslWlak.exe
  C:\Windows\System\RslWlak.exe
  2⤵
  PID:7352
- C:\Windows\System\cIHdLQv.exe
  C:\Windows\System\cIHdLQv.exe
  2⤵
  PID:7468
- C:\Windows\System\UzgkDqe.exe
  C:\Windows\System\UzgkDqe.exe
  2⤵
  PID:7200
- C:\Windows\System\rNMDFwy.exe
  C:\Windows\System\rNMDFwy.exe
  2⤵
  PID:7400
- C:\Windows\System\eZQADuh.exe
  C:\Windows\System\eZQADuh.exe
  2⤵
  PID:7512
- C:\Windows\System\NXSKjcB.exe
  C:\Windows\System\NXSKjcB.exe
  2⤵
  PID:7644
- C:\Windows\System\vxOdTVP.exe
  C:\Windows\System\vxOdTVP.exe
  2⤵
  PID:7688
- C:\Windows\System\MUWHVDS.exe
  C:\Windows\System\MUWHVDS.exe
  2⤵
  PID:7776
- C:\Windows\System\xAqgPDq.exe
  C:\Windows\System\xAqgPDq.exe
  2⤵
  PID:7760
- C:\Windows\System\uKCoYsQ.exe
  C:\Windows\System\uKCoYsQ.exe
  2⤵
  PID:7872
- C:\Windows\System\rpshhzl.exe
  C:\Windows\System\rpshhzl.exe
  2⤵
  PID:8036
- C:\Windows\System\YBSnXWz.exe
  C:\Windows\System\YBSnXWz.exe
  2⤵
  PID:7920
- C:\Windows\System\VpOUode.exe
  C:\Windows\System\VpOUode.exe
  2⤵
  PID:8016
- C:\Windows\System\WKeqHHT.exe
  C:\Windows\System\WKeqHHT.exe
  2⤵
  PID:7924
- C:\Windows\System\jDBMOnP.exe
  C:\Windows\System\jDBMOnP.exe
  2⤵
  PID:7956
- C:\Windows\System\YSDXrkS.exe
  C:\Windows\System\YSDXrkS.exe
  2⤵
  PID:6764
- C:\Windows\System\qWdLVJg.exe
  C:\Windows\System\qWdLVJg.exe
  2⤵
  PID:6588
- C:\Windows\System\TLqETOg.exe
  C:\Windows\System\TLqETOg.exe
  2⤵
  PID:6468
- C:\Windows\System\PnUewdj.exe
  C:\Windows\System\PnUewdj.exe
  2⤵
  PID:7724
- C:\Windows\System\dkusKWm.exe
  C:\Windows\System\dkusKWm.exe
  2⤵
  PID:7464
- C:\Windows\System\QiqZvEG.exe
  C:\Windows\System\QiqZvEG.exe
  2⤵
  PID:8104
- C:\Windows\System\UPomGKH.exe
  C:\Windows\System\UPomGKH.exe
  2⤵
  PID:7516
- C:\Windows\System\XcZXfbZ.exe
  C:\Windows\System\XcZXfbZ.exe
  2⤵
  PID:7972
- C:\Windows\System\iqSTwFL.exe
  C:\Windows\System\iqSTwFL.exe
  2⤵
  PID:7416
- C:\Windows\System\vjbLnJL.exe
  C:\Windows\System\vjbLnJL.exe
  2⤵
  PID:7336
- C:\Windows\System\iDjgcQg.exe
  C:\Windows\System\iDjgcQg.exe
  2⤵
  PID:7592
- C:\Windows\System\jmKAkBw.exe
  C:\Windows\System\jmKAkBw.exe
  2⤵
  PID:8180
- C:\Windows\System\BxDWlxe.exe
  C:\Windows\System\BxDWlxe.exe
  2⤵
  PID:944
- C:\Windows\System\uGOVxgp.exe
  C:\Windows\System\uGOVxgp.exe
  2⤵
  PID:8088
- C:\Windows\System\NAxsgpi.exe
  C:\Windows\System\NAxsgpi.exe
  2⤵
  PID:6180
- C:\Windows\System\PApYWMZ.exe
  C:\Windows\System\PApYWMZ.exe
  2⤵
  PID:7412
- C:\Windows\System\GXrVeaf.exe
  C:\Windows\System\GXrVeaf.exe
  2⤵
  PID:7792
- C:\Windows\System\SNYkdfZ.exe
  C:\Windows\System\SNYkdfZ.exe
  2⤵
  PID:8208
- C:\Windows\System\PlBDZRe.exe
  C:\Windows\System\PlBDZRe.exe
  2⤵
  PID:8228
- C:\Windows\System\JoPRsqL.exe
  C:\Windows\System\JoPRsqL.exe
  2⤵
  PID:8248
- C:\Windows\System\HthepWO.exe
  C:\Windows\System\HthepWO.exe
  2⤵
  PID:8264
- C:\Windows\System\wEnKzQJ.exe
  C:\Windows\System\wEnKzQJ.exe
  2⤵
  PID:8284
- C:\Windows\System\nuTftvs.exe
  C:\Windows\System\nuTftvs.exe
  2⤵
  PID:8300
- C:\Windows\System\JgrACuB.exe
  C:\Windows\System\JgrACuB.exe
  2⤵
  PID:8316
- C:\Windows\System\rBAVSIr.exe
  C:\Windows\System\rBAVSIr.exe
  2⤵
  PID:8332
- C:\Windows\System\jwFJRDO.exe
  C:\Windows\System\jwFJRDO.exe
  2⤵
  PID:8348
- C:\Windows\System\Smjqehg.exe
  C:\Windows\System\Smjqehg.exe
  2⤵
  PID:8364
- C:\Windows\System\ynaFCzQ.exe
  C:\Windows\System\ynaFCzQ.exe
  2⤵
  PID:8384
- C:\Windows\System\bbfwmAE.exe
  C:\Windows\System\bbfwmAE.exe
  2⤵
  PID:8400
- C:\Windows\System\kXIQNTJ.exe
  C:\Windows\System\kXIQNTJ.exe
  2⤵
  PID:8416
- C:\Windows\System\dCAKEua.exe
  C:\Windows\System\dCAKEua.exe
  2⤵
  PID:8436
- C:\Windows\System\WSFsRWF.exe
  C:\Windows\System\WSFsRWF.exe
  2⤵
  PID:8452
- C:\Windows\System\bpFcpCK.exe
  C:\Windows\System\bpFcpCK.exe
  2⤵
  PID:8468
- C:\Windows\System\wKnosJm.exe
  C:\Windows\System\wKnosJm.exe
  2⤵
  PID:8488
- C:\Windows\System\gDZkYTX.exe
  C:\Windows\System\gDZkYTX.exe
  2⤵
  PID:8504
- C:\Windows\System\yRgTCJe.exe
  C:\Windows\System\yRgTCJe.exe
  2⤵
  PID:8520
- C:\Windows\System\MtLVFck.exe
  C:\Windows\System\MtLVFck.exe
  2⤵
  PID:8536
- C:\Windows\System\WlCzGjv.exe
  C:\Windows\System\WlCzGjv.exe
  2⤵
  PID:8552
- C:\Windows\System\VSeBObu.exe
  C:\Windows\System\VSeBObu.exe
  2⤵
  PID:8572
- C:\Windows\System\wpdtMZQ.exe
  C:\Windows\System\wpdtMZQ.exe
  2⤵
  PID:8588
- C:\Windows\System\HgtXWMK.exe
  C:\Windows\System\HgtXWMK.exe
  2⤵
  PID:8604
- C:\Windows\System\SnzOmXW.exe
  C:\Windows\System\SnzOmXW.exe
  2⤵
  PID:8620
- C:\Windows\System\Rwokjog.exe
  C:\Windows\System\Rwokjog.exe
  2⤵
  PID:8636
- C:\Windows\System\ZTitvyC.exe
  C:\Windows\System\ZTitvyC.exe
  2⤵
  PID:8656
- C:\Windows\System\czhIUJK.exe
  C:\Windows\System\czhIUJK.exe
  2⤵
  PID:8676
- C:\Windows\System\RZlHlxq.exe
  C:\Windows\System\RZlHlxq.exe
  2⤵
  PID:8692
- C:\Windows\System\bNRjCrF.exe
  C:\Windows\System\bNRjCrF.exe
  2⤵
  PID:8708
- C:\Windows\System\vtvPMXm.exe
  C:\Windows\System\vtvPMXm.exe
  2⤵
  PID:8724
- C:\Windows\System\ADBKTKg.exe
  C:\Windows\System\ADBKTKg.exe
  2⤵
  PID:8740
- C:\Windows\System\bBUTPEK.exe
  C:\Windows\System\bBUTPEK.exe
  2⤵
  PID:8756
- C:\Windows\System\wuBuxlz.exe
  C:\Windows\System\wuBuxlz.exe
  2⤵
  PID:8772
- C:\Windows\System\TMqKlNv.exe
  C:\Windows\System\TMqKlNv.exe
  2⤵
  PID:8788
- C:\Windows\System\TUYhQdK.exe
  C:\Windows\System\TUYhQdK.exe
  2⤵
  PID:8804
- C:\Windows\System\BhsAEEI.exe
  C:\Windows\System\BhsAEEI.exe
  2⤵
  PID:8828
- C:\Windows\System\GfjXiJt.exe
  C:\Windows\System\GfjXiJt.exe
  2⤵
  PID:8844
- C:\Windows\System\pgrwJAp.exe
  C:\Windows\System\pgrwJAp.exe
  2⤵
  PID:8860
- C:\Windows\System\KgFpNqZ.exe
  C:\Windows\System\KgFpNqZ.exe
  2⤵
  PID:8876
- C:\Windows\System\mrFZvCh.exe
  C:\Windows\System\mrFZvCh.exe
  2⤵
  PID:8892
- C:\Windows\System\uMiohEE.exe
  C:\Windows\System\uMiohEE.exe
  2⤵
  PID:8912
- C:\Windows\System\MMxhtze.exe
  C:\Windows\System\MMxhtze.exe
  2⤵
  PID:8928
- C:\Windows\System\TlwKpvL.exe
  C:\Windows\System\TlwKpvL.exe
  2⤵
  PID:8956
- C:\Windows\System\WTDrvOz.exe
  C:\Windows\System\WTDrvOz.exe
  2⤵
  PID:8972
- C:\Windows\System\EapAXLH.exe
  C:\Windows\System\EapAXLH.exe
  2⤵
  PID:8988
- C:\Windows\System\HTSjJqS.exe
  C:\Windows\System\HTSjJqS.exe
  2⤵
  PID:9016
- C:\Windows\System\CGLEapQ.exe
  C:\Windows\System\CGLEapQ.exe
  2⤵
  PID:9036
- C:\Windows\System\ChoQKyt.exe
  C:\Windows\System\ChoQKyt.exe
  2⤵
  PID:9152
- C:\Windows\System\WnpMOBV.exe
  C:\Windows\System\WnpMOBV.exe
  2⤵
  PID:8204
- C:\Windows\System\lkeBvhj.exe
  C:\Windows\System\lkeBvhj.exe
  2⤵
  PID:8628
- C:\Windows\System\Ondckgw.exe
  C:\Windows\System\Ondckgw.exe
  2⤵
  PID:8344
- C:\Windows\System\qDuvBHD.exe
  C:\Windows\System\qDuvBHD.exe
  2⤵
  PID:8292
- C:\Windows\System\EMGkfsM.exe
  C:\Windows\System\EMGkfsM.exe
  2⤵
  PID:9052
- C:\Windows\System\AbCdWUS.exe
  C:\Windows\System\AbCdWUS.exe
  2⤵
  PID:9060
- C:\Windows\System\hIYvzqE.exe
  C:\Windows\System\hIYvzqE.exe
  2⤵
  PID:9076
- C:\Windows\System\BsqevfR.exe
  C:\Windows\System\BsqevfR.exe
  2⤵
  PID:9092
- C:\Windows\System\capWehf.exe
  C:\Windows\System\capWehf.exe
  2⤵
  PID:8996
- C:\Windows\System\kuJqaeJ.exe
  C:\Windows\System\kuJqaeJ.exe
  2⤵
  PID:9116
- C:\Windows\System\urFYAHt.exe
  C:\Windows\System\urFYAHt.exe
  2⤵
  PID:9136
- C:\Windows\System\hvPlwCA.exe
  C:\Windows\System\hvPlwCA.exe
  2⤵
  PID:9144
- C:\Windows\System\OYxWUBS.exe
  C:\Windows\System\OYxWUBS.exe
  2⤵
  PID:9176
- C:\Windows\System\SKwraOw.exe
  C:\Windows\System\SKwraOw.exe
  2⤵
  PID:9192
- C:\Windows\System\dKPvBaH.exe
  C:\Windows\System\dKPvBaH.exe
  2⤵
  PID:9204
- C:\Windows\System\igOrJdT.exe
  C:\Windows\System\igOrJdT.exe
  2⤵
  PID:8200
- C:\Windows\System\EJkpMJE.exe
  C:\Windows\System\EJkpMJE.exe
  2⤵
  PID:8240
- C:\Windows\System\ISMPTsJ.exe
  C:\Windows\System\ISMPTsJ.exe
  2⤵
  PID:8064
- C:\Windows\System\XCZyFTI.exe
  C:\Windows\System\XCZyFTI.exe
  2⤵
  PID:8276
- C:\Windows\System\ywytIfz.exe
  C:\Windows\System\ywytIfz.exe
  2⤵
  PID:8340
- C:\Windows\System\xFuhaNg.exe
  C:\Windows\System\xFuhaNg.exe
  2⤵
  PID:8260
- C:\Windows\System\GbHOMjT.exe
  C:\Windows\System\GbHOMjT.exe
  2⤵
  PID:8444
- C:\Windows\System\cHvOKtf.exe
  C:\Windows\System\cHvOKtf.exe
  2⤵
  PID:8484
- C:\Windows\System\zMhFNAn.exe
  C:\Windows\System\zMhFNAn.exe
  2⤵
  PID:8356
- C:\Windows\System\swfBauc.exe
  C:\Windows\System\swfBauc.exe
  2⤵
  PID:8392
- C:\Windows\System\dZZLgfU.exe
  C:\Windows\System\dZZLgfU.exe
  2⤵
  PID:8460
- C:\Windows\System\dMQOnXg.exe
  C:\Windows\System\dMQOnXg.exe
  2⤵
  PID:8580
- C:\Windows\System\XHSEifY.exe
  C:\Windows\System\XHSEifY.exe
  2⤵
  PID:8564
- C:\Windows\System\afzjQso.exe
  C:\Windows\System\afzjQso.exe
  2⤵
  PID:8600
- C:\Windows\System\yNjtVQm.exe
  C:\Windows\System\yNjtVQm.exe
  2⤵
  PID:8688
- C:\Windows\System\aFXLaXX.exe
  C:\Windows\System\aFXLaXX.exe
  2⤵
  PID:8748
- C:\Windows\System\VdMLQeK.exe
  C:\Windows\System\VdMLQeK.exe
  2⤵
  PID:8816
- C:\Windows\System\vlNJpyh.exe
  C:\Windows\System\vlNJpyh.exe
  2⤵
  PID:8632
- C:\Windows\System\LnLembY.exe
  C:\Windows\System\LnLembY.exe
  2⤵
  PID:9188
- C:\Windows\System\FWLORtU.exe
  C:\Windows\System\FWLORtU.exe
  2⤵
  PID:7736
- C:\Windows\System\fiGQEUx.exe
  C:\Windows\System\fiGQEUx.exe
  2⤵
  PID:8312
- C:\Windows\System\LRTphCa.exe
  C:\Windows\System\LRTphCa.exe
  2⤵
  PID:8308
- C:\Windows\System\MpmVqjs.exe
  C:\Windows\System\MpmVqjs.exe
  2⤵
  PID:9172
- C:\Windows\System\hHHDxXM.exe
  C:\Windows\System\hHHDxXM.exe
  2⤵
  PID:8220
- C:\Windows\System\wtGdyvc.exe
  C:\Windows\System\wtGdyvc.exe
  2⤵
  PID:8328
- C:\Windows\System\NgQtArg.exe
  C:\Windows\System\NgQtArg.exe
  2⤵
  PID:8528
- C:\Windows\System\HezVPIO.exe
  C:\Windows\System\HezVPIO.exe
  2⤵
  PID:8480
- C:\Windows\System\YZTgRZN.exe
  C:\Windows\System\YZTgRZN.exe
  2⤵
  PID:8596
- C:\Windows\System\NpzkOWr.exe
  C:\Windows\System\NpzkOWr.exe
  2⤵
  PID:8780
- C:\Windows\System\bKxRztl.exe
  C:\Windows\System\bKxRztl.exe
  2⤵
  PID:8684
- C:\Windows\System\GijTWAj.exe
  C:\Windows\System\GijTWAj.exe
  2⤵
  PID:8884
- C:\Windows\System\tFTNFuz.exe
  C:\Windows\System\tFTNFuz.exe
  2⤵
  PID:8764
- C:\Windows\System\gQsUtzS.exe
  C:\Windows\System\gQsUtzS.exe
  2⤵
  PID:2684
- C:\Windows\System\FUloJNT.exe
  C:\Windows\System\FUloJNT.exe
  2⤵
  PID:8900
- C:\Windows\System\CXPIRCF.exe
  C:\Windows\System\CXPIRCF.exe
  2⤵
  PID:8800
- C:\Windows\System\bbmKhdP.exe
  C:\Windows\System\bbmKhdP.exe
  2⤵
  PID:9048
- C:\Windows\System\mmaFtlC.exe
  C:\Windows\System\mmaFtlC.exe
  2⤵
  PID:8224
- C:\Windows\System\CZHOeaY.exe
  C:\Windows\System\CZHOeaY.exe
  2⤵
  PID:9112
- C:\Windows\System\BHGhqzb.exe
  C:\Windows\System\BHGhqzb.exe
  2⤵
  PID:7860
- C:\Windows\System\vXwCxau.exe
  C:\Windows\System\vXwCxau.exe
  2⤵
  PID:9132
- C:\Windows\System\GARYEpj.exe
  C:\Windows\System\GARYEpj.exe
  2⤵
  PID:8380
- C:\Windows\System\aLBZdmN.exe
  C:\Windows\System\aLBZdmN.exe
  2⤵
  PID:8432
- C:\Windows\System\lVCBhEW.exe
  C:\Windows\System\lVCBhEW.exe
  2⤵
  PID:8616
- C:\Windows\System\feAzFjr.exe
  C:\Windows\System\feAzFjr.exe
  2⤵
  PID:8424
- C:\Windows\System\dkWcBGk.exe
  C:\Windows\System\dkWcBGk.exe
  2⤵
  PID:9068
- C:\Windows\System\RpgRnbx.exe
  C:\Windows\System\RpgRnbx.exe
  2⤵
  PID:8652
- C:\Windows\System\HbZMaUt.exe
  C:\Windows\System\HbZMaUt.exe
  2⤵
  PID:9044
- C:\Windows\System\TtrxyeX.exe
  C:\Windows\System\TtrxyeX.exe
  2⤵
  PID:8980
- C:\Windows\System\RyjcBso.exe
  C:\Windows\System\RyjcBso.exe
  2⤵
  PID:8984
- C:\Windows\System\zIaZUAB.exe
  C:\Windows\System\zIaZUAB.exe
  2⤵
  PID:9084
- C:\Windows\System\yzxMQeJ.exe
  C:\Windows\System\yzxMQeJ.exe
  2⤵
  PID:8272
- C:\Windows\System\wuOeWRb.exe
  C:\Windows\System\wuOeWRb.exe
  2⤵
  PID:8296
- C:\Windows\System\lisHzCs.exe
  C:\Windows\System\lisHzCs.exe
  2⤵
  PID:8716
- C:\Windows\System\YTtOBDX.exe
  C:\Windows\System\YTtOBDX.exe
  2⤵
  PID:7460
- C:\Windows\System\jsyJYsj.exe
  C:\Windows\System\jsyJYsj.exe
  2⤵
  PID:8924
- C:\Windows\System\mZyPHji.exe
  C:\Windows\System\mZyPHji.exe
  2⤵
  PID:8796
- C:\Windows\System\qfABHgQ.exe
  C:\Windows\System\qfABHgQ.exe
  2⤵
  PID:2516
- C:\Windows\System\buYGCtT.exe
  C:\Windows\System\buYGCtT.exe
  2⤵
  PID:8852
- C:\Windows\System\IHUYVIR.exe
  C:\Windows\System\IHUYVIR.exe
  2⤵
  PID:9024
- C:\Windows\System\ldSoVdI.exe
  C:\Windows\System\ldSoVdI.exe
  2⤵
  PID:8968
- C:\Windows\System\phuXuaD.exe
  C:\Windows\System\phuXuaD.exe
  2⤵
  PID:9148
- C:\Windows\System\tvRkmhw.exe
  C:\Windows\System\tvRkmhw.exe
  2⤵
  PID:8500
- C:\Windows\System\KMNrhmI.exe
  C:\Windows\System\KMNrhmI.exe
  2⤵
  PID:9228
- C:\Windows\System\ELjgqOC.exe
  C:\Windows\System\ELjgqOC.exe
  2⤵
  PID:9248
- C:\Windows\System\cPfCzwG.exe
  C:\Windows\System\cPfCzwG.exe
  2⤵
  PID:9264
- C:\Windows\System\lGcsykr.exe
  C:\Windows\System\lGcsykr.exe
  2⤵
  PID:9280
- C:\Windows\System\dTKBHTh.exe
  C:\Windows\System\dTKBHTh.exe
  2⤵
  PID:9336
- C:\Windows\System\QrQDRmS.exe
  C:\Windows\System\QrQDRmS.exe
  2⤵
  PID:9352
- C:\Windows\System\RJnRgFZ.exe
  C:\Windows\System\RJnRgFZ.exe
  2⤵
  PID:9368
- C:\Windows\System\jbcfhGS.exe
  C:\Windows\System\jbcfhGS.exe
  2⤵
  PID:9396
- C:\Windows\System\puVGpbV.exe
  C:\Windows\System\puVGpbV.exe
  2⤵
  PID:9412
- C:\Windows\System\xbaXDHR.exe
  C:\Windows\System\xbaXDHR.exe
  2⤵
  PID:9432
- C:\Windows\System\bHQQLqu.exe
  C:\Windows\System\bHQQLqu.exe
  2⤵
  PID:9448
- C:\Windows\System\crVVlxx.exe
  C:\Windows\System\crVVlxx.exe
  2⤵
  PID:9464
- C:\Windows\System\vxApMsC.exe
  C:\Windows\System\vxApMsC.exe
  2⤵
  PID:9480
- C:\Windows\System\ThvCPwk.exe
  C:\Windows\System\ThvCPwk.exe
  2⤵
  PID:9496
- C:\Windows\System\SvTiZHz.exe
  C:\Windows\System\SvTiZHz.exe
  2⤵
  PID:9524
- C:\Windows\System\rnWIVDH.exe
  C:\Windows\System\rnWIVDH.exe
  2⤵
  PID:9540
- C:\Windows\System\LvLGUZX.exe
  C:\Windows\System\LvLGUZX.exe
  2⤵
  PID:9556
- C:\Windows\System\FSpOxYK.exe
  C:\Windows\System\FSpOxYK.exe
  2⤵
  PID:9576
- C:\Windows\System\mKqtlkA.exe
  C:\Windows\System\mKqtlkA.exe
  2⤵
  PID:9592
- C:\Windows\System\EIXUtLk.exe
  C:\Windows\System\EIXUtLk.exe
  2⤵
  PID:9616
- C:\Windows\System\UcNoMez.exe
  C:\Windows\System\UcNoMez.exe
  2⤵
  PID:9636
- C:\Windows\System\koaNkZw.exe
  C:\Windows\System\koaNkZw.exe
  2⤵
  PID:9652
- C:\Windows\System\QRjPhkq.exe
  C:\Windows\System\QRjPhkq.exe
  2⤵
  PID:9668
- C:\Windows\System\wUkMSJE.exe
  C:\Windows\System\wUkMSJE.exe
  2⤵
  PID:9684
- C:\Windows\System\AFsLoMZ.exe
  C:\Windows\System\AFsLoMZ.exe
  2⤵
  PID:9700
- C:\Windows\System\ShtLWLv.exe
  C:\Windows\System\ShtLWLv.exe
  2⤵
  PID:9716
- C:\Windows\System\YOZTejo.exe
  C:\Windows\System\YOZTejo.exe
  2⤵
  PID:9732
- C:\Windows\System\vsHUAMX.exe
  C:\Windows\System\vsHUAMX.exe
  2⤵
  PID:9752
- C:\Windows\System\dPghxyR.exe
  C:\Windows\System\dPghxyR.exe
  2⤵
  PID:9768
- C:\Windows\System\hXLuCoQ.exe
  C:\Windows\System\hXLuCoQ.exe
  2⤵
  PID:9784
- C:\Windows\System\iNbTFiU.exe
  C:\Windows\System\iNbTFiU.exe
  2⤵
  PID:9800
- C:\Windows\System\CGlfFcY.exe
  C:\Windows\System\CGlfFcY.exe
  2⤵
  PID:9880
- C:\Windows\System\PeFwbkx.exe
  C:\Windows\System\PeFwbkx.exe
  2⤵
  PID:9896
- C:\Windows\System\ulpAkbQ.exe
  C:\Windows\System\ulpAkbQ.exe
  2⤵
  PID:9912
- C:\Windows\System\sRTEtqp.exe
  C:\Windows\System\sRTEtqp.exe
  2⤵
  PID:9928
- C:\Windows\System\HQvgZXb.exe
  C:\Windows\System\HQvgZXb.exe
  2⤵
  PID:9944
- C:\Windows\System\natelvS.exe
  C:\Windows\System\natelvS.exe
  2⤵
  PID:9960
- C:\Windows\System\xrVszLD.exe
  C:\Windows\System\xrVszLD.exe
  2⤵
  PID:9976
- C:\Windows\System\XbWkYIB.exe
  C:\Windows\System\XbWkYIB.exe
  2⤵
  PID:9992
- C:\Windows\System\wOwSTRp.exe
  C:\Windows\System\wOwSTRp.exe
  2⤵
  PID:10024
- C:\Windows\System\ySEUjjV.exe
  C:\Windows\System\ySEUjjV.exe
  2⤵
  PID:10040
- C:\Windows\System\jYbmril.exe
  C:\Windows\System\jYbmril.exe
  2⤵
  PID:10056
- C:\Windows\System\mBgYitL.exe
  C:\Windows\System\mBgYitL.exe
  2⤵
  PID:10092
- C:\Windows\System\MaaQvbl.exe
  C:\Windows\System\MaaQvbl.exe
  2⤵
  PID:10112
- C:\Windows\System\ARPdbRv.exe
  C:\Windows\System\ARPdbRv.exe
  2⤵
  PID:10132
- C:\Windows\System\hgiadJX.exe
  C:\Windows\System\hgiadJX.exe
  2⤵
  PID:10152
- C:\Windows\System\FrQyfZR.exe
  C:\Windows\System\FrQyfZR.exe
  2⤵
  PID:10168
- C:\Windows\System\ZHvxoIN.exe
  C:\Windows\System\ZHvxoIN.exe
  2⤵
  PID:10184
- C:\Windows\System\tUuzDUY.exe
  C:\Windows\System\tUuzDUY.exe
  2⤵
  PID:10200
- C:\Windows\System\vqrOLkp.exe
  C:\Windows\System\vqrOLkp.exe
  2⤵
  PID:10216
- C:\Windows\System\HnnBBjp.exe
  C:\Windows\System\HnnBBjp.exe
  2⤵
  PID:10232
- C:\Windows\System\gmtlihl.exe
  C:\Windows\System\gmtlihl.exe
  2⤵
  PID:9256
- C:\Windows\System\ihsOmPZ.exe
  C:\Windows\System\ihsOmPZ.exe
  2⤵
  PID:9288
- C:\Windows\System\bauKfYt.exe
  C:\Windows\System\bauKfYt.exe
  2⤵
  PID:9276
- C:\Windows\System\JsxMbLi.exe
  C:\Windows\System\JsxMbLi.exe
  2⤵
  PID:9260
- C:\Windows\System\ScDzxqp.exe
  C:\Windows\System\ScDzxqp.exe
  2⤵
  PID:9308
- C:\Windows\System\GJkWyLA.exe
  C:\Windows\System\GJkWyLA.exe
  2⤵
  PID:9324
- C:\Windows\System\LwYfYuL.exe
  C:\Windows\System\LwYfYuL.exe
  2⤵
  PID:9344
- C:\Windows\System\aVjvwXN.exe
  C:\Windows\System\aVjvwXN.exe
  2⤵
  PID:9380
- C:\Windows\System\gvxHeEC.exe
  C:\Windows\System\gvxHeEC.exe
  2⤵
  PID:9408
- C:\Windows\System\XcrhNCn.exe
  C:\Windows\System\XcrhNCn.exe
  2⤵
  PID:9428
- C:\Windows\System\MUJdqtb.exe
  C:\Windows\System\MUJdqtb.exe
  2⤵
  PID:9460
- C:\Windows\System\ucWHDBX.exe
  C:\Windows\System\ucWHDBX.exe
  2⤵
  PID:9512
- C:\Windows\System\wMRKFfg.exe
  C:\Windows\System\wMRKFfg.exe
  2⤵
  PID:9660
- C:\Windows\System\TsQBApr.exe
  C:\Windows\System\TsQBApr.exe
  2⤵
  PID:9724
- C:\Windows\System\anEYTzi.exe
  C:\Windows\System\anEYTzi.exe
  2⤵
  PID:9648
- C:\Windows\System\qgIAZYj.exe
  C:\Windows\System\qgIAZYj.exe
  2⤵
  PID:9604
- C:\Windows\System\IgjgXKl.exe
  C:\Windows\System\IgjgXKl.exe
  2⤵
  PID:9712
- C:\Windows\System\SbcWQnG.exe
  C:\Windows\System\SbcWQnG.exe
  2⤵
  PID:9760
- C:\Windows\System\TGlyTIl.exe
  C:\Windows\System\TGlyTIl.exe
  2⤵
  PID:9836
- C:\Windows\System\tfuHXuM.exe
  C:\Windows\System\tfuHXuM.exe
  2⤵
  PID:9852
- C:\Windows\System\rfrcsJF.exe
  C:\Windows\System\rfrcsJF.exe
  2⤵
  PID:9868
- C:\Windows\System\YiSjdhn.exe
  C:\Windows\System\YiSjdhn.exe
  2⤵
  PID:9904
- C:\Windows\System\UqBHxFV.exe
  C:\Windows\System\UqBHxFV.exe
  2⤵
  PID:9968
- C:\Windows\System\SFALRgn.exe
  C:\Windows\System\SFALRgn.exe
  2⤵
  PID:9952
- C:\Windows\System\YLxzPcO.exe
  C:\Windows\System\YLxzPcO.exe
  2⤵
  PID:10008
- C:\Windows\System\EgvWwZv.exe
  C:\Windows\System\EgvWwZv.exe
  2⤵
  PID:10052
- C:\Windows\System\jnpnSXE.exe
  C:\Windows\System\jnpnSXE.exe
  2⤵
  PID:10076
- C:\Windows\System\nkhdIYO.exe
  C:\Windows\System\nkhdIYO.exe
  2⤵
  PID:10108
- C:\Windows\System\SqplLDE.exe
  C:\Windows\System\SqplLDE.exe
  2⤵
  PID:10128
- C:\Windows\System\CTuOWFp.exe
  C:\Windows\System\CTuOWFp.exe
  2⤵
  PID:10192
- C:\Windows\System\HXYNVeu.exe
  C:\Windows\System\HXYNVeu.exe
  2⤵
  PID:10180
- C:\Windows\System\RxPjkDg.exe
  C:\Windows\System\RxPjkDg.exe
  2⤵
  PID:9240
- C:\Windows\System\mYEkckG.exe
  C:\Windows\System\mYEkckG.exe
  2⤵
  PID:10196
- C:\Windows\System\IrkGOeQ.exe
  C:\Windows\System\IrkGOeQ.exe
  2⤵
  PID:9236
- C:\Windows\System\gGmZKoR.exe
  C:\Windows\System\gGmZKoR.exe
  2⤵
  PID:9320
- C:\Windows\System\eYGXVuU.exe
  C:\Windows\System\eYGXVuU.exe
  2⤵
  PID:9304
- C:\Windows\System\cpITIgV.exe
  C:\Windows\System\cpITIgV.exe
  2⤵
  PID:9476
- C:\Windows\System\OqtbJgO.exe
  C:\Windows\System\OqtbJgO.exe
  2⤵
  PID:9552
- C:\Windows\System\GxriXfV.exe
  C:\Windows\System\GxriXfV.exe
  2⤵
  PID:9588
- C:\Windows\System\IxnCoQf.exe
  C:\Windows\System\IxnCoQf.exe
  2⤵
  PID:9584
- C:\Windows\System\aVngfUz.exe
  C:\Windows\System\aVngfUz.exe
  2⤵
  PID:9744
- C:\Windows\System\mztwEcq.exe
  C:\Windows\System\mztwEcq.exe
  2⤵
  PID:9780
- C:\Windows\System\fXguiNP.exe
  C:\Windows\System\fXguiNP.exe
  2⤵
  PID:9792
- C:\Windows\System\kClQsMO.exe
  C:\Windows\System\kClQsMO.exe
  2⤵
  PID:10148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BGtdaZN.exe

Path C:\Windows\system\BGtdaZN.exe
Size 1.4MB
SHA256 3294906c7a66219f98a323a4fdac21ba83638a979e6e0543079554e5341bfad2
MD5 c43e57d549f6fd2cb168ccb8a15d97b1
SHA1 3de52ef14cb74b0e21ed53733724c1e27fa074a3
SHA512 adc3c69164cbf35d4eb6391e6403d427acb5d5d4f13c26da5edbacb37aa1af20ad9bd0fe251fc50ccb68d42ca1c25a566c500c8611f86f976b04f1c905953b69
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY6:GezaTF8FcNkNdfE0pZ9oztFwI7ei114
MD5 SHA1 SHA512 SSDEEP

Submit Download

CjyhcZY.exe

Path C:\Windows\system\CjyhcZY.exe
Size 1.4MB
SHA256 dc87579d9be4c85a14b66f61b89e171194f4764ff4c072c4a1b9f593def8cc7f
MD5 440570b68fac38598ed5488432f172ee
SHA1 06381f5ee2382f132197c84e7799efb02accdcec
SHA512 1cb2252b379e0dbc984d111dd51b2b3e073ebae390fc8347ba90d02d321854e91c86e3bf97edb283ba47fc7d85028282edcb1e364daa5934304cf27e0e2c705f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYg:GezaTF8FcNkNdfE0pZ9oztFwI7ei116
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENWXMnU.exe

Path C:\Windows\system\ENWXMnU.exe
Size 1.4MB
SHA256 0e6d9edfd61f0c437df2f47b2adbf43e248af9e2732a4ce383d27b1abf67d2d1
MD5 f8c8fcd94f457b47a568b05c8126583e
SHA1 a809f6a3a335c22d5df3f2bab1d584dac38176b2
SHA512 28772031aff669023e8b41ba0d10088a85736b41293707a40421aed2ff8cbfca00aa91cf026a1c9cbfd22bea4b9116661bb568a1e932b64de808f0725656bdb7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYY:GezaTF8FcNkNdfE0pZ9oztFwI7ei11y
MD5 SHA1 SHA512 SSDEEP

Submit Download

FYrEdey.exe

Path C:\Windows\system\FYrEdey.exe
Size 1.4MB
SHA256 07101274b229df40cb4a7f939b87c89b5958ff2e2027b797200f5389eec41e71
MD5 23ed2291d374b5e6c5b4905f08a47db5
SHA1 874e9a3926ce440235ea4431faa193b19f4797ff
SHA512 4e5733941fcf3e9bbad9c8b61acb387465c1a976b378860323606b6db58cb76b4cceaf3801a81ff46f759d036bddf0f2bb10683d62fdee9339d435b8021521ac
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY2:GezaTF8FcNkNdfE0pZ9oztFwI7ei11FG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hledqkn.exe

Path C:\Windows\system\Hledqkn.exe
Size 1.4MB
SHA256 5460965fe129264830b89c2e51ec11da02071eabf9cb0451dd8889b873067050
MD5 2225b24d5368ee8be6c63b68b925b53c
SHA1 622603d94094664623337a04b97d22f12880b3ad
SHA512 10f39ad5a341e3ed3ec573d77a7697ae956d3d15186a43ccf3c2d30840cb7a0cb553faff3bef3d29c19719cd05882b624184e39493395b5647156931fae712ab
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY0:GezaTF8FcNkNdfE0pZ9oztFwI7ei11a
MD5 SHA1 SHA512 SSDEEP

Submit Download

JrIRuPW.exe

Path C:\Windows\system\JrIRuPW.exe
Size 1.4MB
SHA256 2ab7ad50b2205b2cffcf5adf3780f8fa6f2137141f6e600f5068ed30add30ee2
MD5 f7aa9547c5d1aeb07403d2956b9c377b
SHA1 ee88e63f36c3aa3415d4c18ca30f8aa78e52c805
SHA512 a53368eb41460ecdb8a6bf18ce37dd83c02b9d224fcdaaa9175bb550d002ba3e01d164a87aa283c6124fb751384288f01f8e9ded1fb9291c3c552c21fec8ca40
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY5:GezaTF8FcNkNdfE0pZ9oztFwI7ei11H
MD5 SHA1 SHA512 SSDEEP

Submit Download

JrkLZJA.exe

Path C:\Windows\system\JrkLZJA.exe
Size 1.4MB
SHA256 d9083a3fc605469dab6f4f40098ebf9474540982d82910f11d2abbcf86a8e39a
MD5 a24752b4ffd3165ce60f577ef17c6508
SHA1 02ccbf36342635bb893dc7d680e23c5d9b8d4e8e
SHA512 4426e693538142e743d6f2cc4c2f685c51476580b9cf49b22b456409aca5695344a3a1addd138cd0a367ff58074d2fa3c2ddcdec1b8545bae255187c472fbe21
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYN:GezaTF8FcNkNdfE0pZ9oztFwI7ei11D
MD5 SHA1 SHA512 SSDEEP

Submit Download

MFIMmFa.exe

Path C:\Windows\system\MFIMmFa.exe
Size 1.4MB
SHA256 9c639ebc40738189a1e77da50c54317321ee32b555d6e219e19063c95696f2fa
MD5 c5e1e7c52d47941bd9bb6fc7abd052b3
SHA1 09e1dddafa078aee9e6155b6498a36afa5589e3a
SHA512 cb6f9186d6392366213a4a7a4f6b6406aa253881b9e13dc5e2f9cb3dee0f546ba3af01fc1063b4b2cbbfd6c5295f16175df8f4e7cbad86c40e720f11c9a26a02
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYH:GezaTF8FcNkNdfE0pZ9oztFwI7ei11J
MD5 SHA1 SHA512 SSDEEP

Submit Download

MInJCcl.exe

Path C:\Windows\system\MInJCcl.exe
Size 1.4MB
SHA256 6cbd013a77b97b1ed8a1c5ec5ce676ede8296f2b5a29c189221430e72f50e954
MD5 76eeda800105034d686742b2e136dcaf
SHA1 6fa2726925dc8366280a469ed8fdb2a1e0f6f08b
SHA512 310ce3b0dc144ca829f8471e67257e6f6c3d5740a0137cd4cb685a33e1e6ba0ae31cc48306f9526a50cec0490e17af9b48f2f9cbac67eb6692df2aec5a0adaf9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYI:GezaTF8FcNkNdfE0pZ9oztFwI7ei11+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MQbTqpb.exe

Path C:\Windows\system\MQbTqpb.exe
Size 1.4MB
SHA256 2101cbdafb7c5db0ffef124597ae9b0f9a95d12645850cd1450a8ddb5369912c
MD5 4268e905be7902faa7210fc94f705af1
SHA1 68bc109eafd87b38ee77e518f334cfc4fb630187
SHA512 065a63266506225f30709bf3c26a10f9e1900fd4242d338aefe990cc445762dabb249732652202617fe04ff8398a187ada3b8018a154283b914d5098fdbce5cf
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYL:GezaTF8FcNkNdfE0pZ9oztFwI7ei11h
MD5 SHA1 SHA512 SSDEEP

Submit Download

SDzOZZz.exe

Path C:\Windows\system\SDzOZZz.exe
Size 1.4MB
SHA256 ac2f2b42a2de94aead07c45b37bbb3d5f24caca4daed42811ca04994ad050797
MD5 ba548c36362e0458714238c4ce836e90
SHA1 183c97ac960e648ee33bc6dfc23113507c818607
SHA512 14e3525903c17a7275eeaf2c02a69f9b5c6af4266f26eb6d7ee1ea3cd681622182a774f6b9f5960b024847b0f675206d779b004dd6b9f56b91e90c68f08ed153
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY5:GezaTF8FcNkNdfE0pZ9oztFwI7ei113
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrHTbOS.exe

Path C:\Windows\system\WrHTbOS.exe
Size 1.4MB
SHA256 6ee62bb2c17e84d32aaef5d7e0059450cecc7ced7eacb26b6b5c080d605c878f
MD5 e12a3caba8857d3f4f578b91eefd2c16
SHA1 3cba5611ca848c9a39b0a27c99b60bd1eed664c5
SHA512 85099e394052bf5f455a44609311a22785017f6a30e8be98bfd53c81cffe906c55a424dbaf8bfab417b820957c757016d0314d92632acd60b3a4eb9c68ee4d86
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYy:GezaTF8FcNkNdfE0pZ9oztFwI7ei118
MD5 SHA1 SHA512 SSDEEP

Submit Download

XTxsqiq.exe

Path C:\Windows\system\XTxsqiq.exe
Size 1.4MB
SHA256 be14195304880574984b0b38b55d8f62863c14384efeba2f56ac90c31befc151
MD5 5773715ea09d7d8bef064b0d64d2907f
SHA1 79474e0153d29b45c7cd366e5c240f9d5dc417d7
SHA512 f5273fcef76b11e9629bd7c289de8fb45123bd91424f38f3e3eb10c35cf34739bac1c809594bcf7ca3e1f9ce38b6763f43b5f4ca2a25143f0339b4c7a9475387
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYZ:GezaTF8FcNkNdfE0pZ9oztFwI7ei11P
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZCpgXLh.exe

Path C:\Windows\system\ZCpgXLh.exe
Size 1.4MB
SHA256 c2e45a18cf119223dcfd52cc5b29331df7ec4abb3d2cc01d5bf9adf87c17d37f
MD5 e27e03b8b1ab7317e9c7d626ba94a7a5
SHA1 30f8450d84d358deb17a5784ef67f94a6ea443f1
SHA512 0cf67615ceecdf80e88daadb679be2c093a6a6f7e72943d084a20ffa4aa2692b89f03ed868cbdf600818890bf2ddddc58b0512c60c60681d54e987390ad31ed8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYw:GezaTF8FcNkNdfE0pZ9oztFwI7ei11e
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdITTVi.exe

Path C:\Windows\system\ZdITTVi.exe
Size 1.4MB
SHA256 0c7aad8b4f995787c5c9fec83b70d09cafc34b06ed8380ec910e285a45803f9d
MD5 7ec42104d2dd307923fc7319d65db143
SHA1 8b5c2e8f605d7e21d8330af745fc12c985f265d4
SHA512 da1094baa954be01fa5227c25dee2c376afc5df55e2e60523fc6bbb24b00b08cc37422a526d2c46cae23b45276422215c3369f4fe3b927a47ecd0b0dafc169e2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYa:GezaTF8FcNkNdfE0pZ9oztFwI7ei110
MD5 SHA1 SHA512 SSDEEP

Submit Download

bkoJKYw.exe

Path C:\Windows\system\bkoJKYw.exe
Size 1.4MB
SHA256 4316853295360c9e4505fe8f03dfe9d8c7d9b5b88a1dc8cf055b721e131b072a
MD5 1533729ab6276abf3c50d8840e4b8b6e
SHA1 11b58369b5f65cced46773513b5eae98c3c03252
SHA512 b58398c3e5db80afd6b4c61121d663231280ce5abef5f7dde2d3e40228507f6fd77ede98bf6190b3e620b45fd766f556bd95d45149349aa5f8b3185ea183deb4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY7:GezaTF8FcNkNdfE0pZ9oztFwI7ei119
MD5 SHA1 SHA512 SSDEEP

Submit Download

cQLxqxO.exe

Path C:\Windows\system\cQLxqxO.exe
Size 1.4MB
SHA256 0215cccff301c2662412ab9e631d527009c16d6a40da38e2623807f04a1378a2
MD5 5b3ebaab2a77d8ca2bde3deca3fecc30
SHA1 80b2e069e6524d243460d4add68cb14b464c06d6
SHA512 3dd38840994f07d8d0488e2c51eca935987a4c41c1092b5349541039ac3c3a7efad7618183885aef7d7ea85a7dc24b1381db9f9c2fee1182647903e26b6b3d1e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYv:GezaTF8FcNkNdfE0pZ9oztFwI7ei111
MD5 SHA1 SHA512 SSDEEP

Submit Download

cuaCdqh.exe

Path C:\Windows\system\cuaCdqh.exe
Size 1.4MB
SHA256 e61f658f9425fb4bc342c06b5e7b7df79df3558f197d956fbaa41e248d9a48ca
MD5 e1d34310d23061825c37aec70d8104e3
SHA1 ed15aab45629c839dbf8e8e181bf020d03a179e8
SHA512 fde2df53345012aac2d9a1d51d99d3f98f7e532bc08d5ca5ca8e3de0545c1138ffb7ce126e693a52dfc2352ebe47afb573a5e447d02a6300da8fae39118a0c2b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYR:GezaTF8FcNkNdfE0pZ9oztFwI7ei11r
MD5 SHA1 SHA512 SSDEEP

Submit Download

fkqNckb.exe

Path C:\Windows\system\fkqNckb.exe
Size 1.4MB
SHA256 766a9774c4e32756749ae559c04982fbc652704cc123a50a2f0020abcf254716
MD5 ce7e322c2cb986cd1d734606a0191dc9
SHA1 0728042c9219136f335fe22dc01472c23b86e6de
SHA512 e89e9234ede9359739885e6e146f80b0018b135b374aa90a2c37ad8304ff1b4203af0b306d66af2176bbd1b8bf1f4cdcffc837fc58ccaedd305f8f6f4564e36a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYa:GezaTF8FcNkNdfE0pZ9oztFwI7ei11s
MD5 SHA1 SHA512 SSDEEP

Submit Download

kFoTDTS.exe

Path C:\Windows\system\kFoTDTS.exe
Size 1.4MB
SHA256 9f8a6dd5b3770ffe001cf56a2b5275996205117c9b38eb91bb698d9e5a1036d7
MD5 0a1dea315e7fd35837d282a091426c12
SHA1 17b2df552069bf18fdeea587ab63af8f45fccc7d
SHA512 86c3f277475a2877da1e7199020b31af17d76a85ee8821cea393ec2052ca19c1d61115f66241f8e4c8a18630a49edcd66aa8ab08d09cb834f73ec5e352624545
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYg:GezaTF8FcNkNdfE0pZ9oztFwI7ei1194
MD5 SHA1 SHA512 SSDEEP

Submit Download

kYVpcRo.exe

Path C:\Windows\system\kYVpcRo.exe
Size 1.4MB
SHA256 7c4144564edb9090cc396f213a9e61ae179251a2bfe129bc7f673f5b27e7c8ea
MD5 521b3888cb431efe7a67763ce0f12724
SHA1 80c1ecd6d521964064a86e222923a3b44a94ac63
SHA512 b6f5a32f8b8b90b023b860567d479321ed6f9c5d77905364dc2be9cae5cc7b63152fafa38490d0c33652bbc23126cfe417be6ff399b50c3a6e549fcbfce2487f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY0:GezaTF8FcNkNdfE0pZ9oztFwI7ei11u
MD5 SHA1 SHA512 SSDEEP

Submit Download

lBazVrS.exe

Path C:\Windows\system\lBazVrS.exe
Size 1.4MB
SHA256 62183a62a244336f58fcb7264ad98a4e3a70debb41fe9f0910f3c653c3b1f01e
MD5 fdbb9a644b1d5c516761048d0ea71885
SHA1 2ec140fdf5056ea7a8721a52b8dd190b431f8fff
SHA512 8ef08c997fd6271149f81257ed5030c8386c68355c91ee5b0e84e3931810e48177d0f649149796dfc0b7312a1754d0622ae225c86b5801240db1db711d467262
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYE:GezaTF8FcNkNdfE0pZ9oztFwI7ei11u
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAArnPI.exe

Path C:\Windows\system\mAArnPI.exe
Size 1.4MB
SHA256 0831fb98929f22d66683cf8801991c188cf866f1b7d82a35a059eb74274927e0
MD5 fc824a0b57957b9610c62c5c37e5117a
SHA1 6d7a5c245f94c461d19b73439ced2e17539fd8a5
SHA512 c0929306e9bb3bd2622fb274f45ff08745a51b2b98c90551c40e1f8972fc68a61ba795fb315a118081401701568a8877ce99541eb80b1cdb6277a6feee10778c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY4:GezaTF8FcNkNdfE0pZ9oztFwI7ei11K
MD5 SHA1 SHA512 SSDEEP

Submit Download

mPwCVuG.exe

Path C:\Windows\system\mPwCVuG.exe
Size 1.4MB
SHA256 72d792e1ee3c8a261b7e39dbf4cf45bfe1489983f136d845affc912e2ad24121
MD5 02d3eea73d62bb8e1a2140d4093cb4be
SHA1 43ce65d4a60f77d58264a04d960ac93d3f93974e
SHA512 9343e148e5b0d8c234d8407b088eaa352b1939bf182eca98d111291283389b5670ced9493aaa985e3988bc5a94b7a1c07602a3d98019a56541fdcf46e010b23f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYQ:GezaTF8FcNkNdfE0pZ9oztFwI7ei11q
MD5 SHA1 SHA512 SSDEEP

Submit Download

vswnQZD.exe

Path C:\Windows\system\vswnQZD.exe
Size 1.4MB
SHA256 bfc44b619641040ebc36c78842c8e220495c809396ebc3cc05ae1af1a9b32087
MD5 2f7d4343f4896e656555952abcd3f4e2
SHA1 95bfdcf958d97c6027a06a29b07d8ffce907718e
SHA512 3dabef2ccdc6af8f8201c566f8f5ad50541f27cfa36e54811fbf68814e952aa951a22ebe474e59ecfb6c9a55bb8662f2481470784b6c9a3a3ebae24edddbee5a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYx:GezaTF8FcNkNdfE0pZ9oztFwI7ei11b
MD5 SHA1 SHA512 SSDEEP

Submit Download

JOfHNuA.exe

Path \Windows\system\JOfHNuA.exe
Size 1.4MB
SHA256 38c3b58d8828fc7c5faa1e3b16f92e3f2442c591add19baa189a67b32a0827e3
MD5 bc374dbb27695c9a20f8b2ba9a3200a9
SHA1 e4040fa1c6166cf7c465de2a40f2a25eaff112a9
SHA512 4ee2188392da0585a73e194e1f964ba44f947314f754bbc27af03ff4b4857c2a12e92beea3382e63b8a3a8809941839405116f8c38dc7be91fe8554dce98d0a7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYK:GezaTF8FcNkNdfE0pZ9oztFwI7ei11Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

NhYiDnb.exe

Path \Windows\system\NhYiDnb.exe
Size 1.4MB
SHA256 b2d6155d4a452944f2b6a1c0764a382eeddf00e8e358b8832ee31a9b4c39d3a6
MD5 43fc3fbf0e7f7f480a08113a35869cc1
SHA1 f46e0c60d30a80a7cdab12c45e3b6a2474272790
SHA512 f910380c17f2ece12df181dd596387582cd18cf8a321e188c60d98a4fa0024b7ca2d94c1e9eb7ce101a301a7a4c5c3bc34c8645ef9f1ce199aa77192b590486b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY8:GezaTF8FcNkNdfE0pZ9oztFwI7ei11C
MD5 SHA1 SHA512 SSDEEP

Submit Download

PpvWqyo.exe

Path \Windows\system\PpvWqyo.exe
Size 1.4MB
SHA256 1211441498299f3f7163072d5e72a71dc7e42374335ed32869b69cf4cd03ccf4
MD5 f336c462e84a4c68496c3c5d5b6ece84
SHA1 109373025ab78afa3f2df013d12d6845c51fb00a
SHA512 7c7ec192e401a744664c55d9ee5fc36369c3c32a0ae3eab07857e70566c7d31e02ca314d391240145c355c4f0b0b46e8f3bf524b0facf0f170a2c77f39bd031d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYu:GezaTF8FcNkNdfE0pZ9oztFwI7ei11k
MD5 SHA1 SHA512 SSDEEP

Submit Download

RLYUIaz.exe

Path \Windows\system\RLYUIaz.exe
Size 1.4MB
SHA256 f45366534d48578b0159354d53e29ca79ce7eebee53bae1efd0da2def24ca20a
MD5 077bb969fb41f1e862c21789f617a03e
SHA1 3873a8219bf782c587e5f7cfadfafb68954651b0
SHA512 6c6ee7231512456a6471190311cbcbe0d18fe10a26e52091da4e2ee85d97ac05284523ab854c30f333c379187177a5968aa8fdad42297c73b4036ad2ff861edb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYg:GezaTF8FcNkNdfE0pZ9oztFwI7ei11W
MD5 SHA1 SHA512 SSDEEP

Submit Download

TOEePbO.exe

Path \Windows\system\TOEePbO.exe
Size 1.4MB
SHA256 79e26f094f204601862964a316ded599ee8c3c0758d6f1328381f9c1a8c50853
MD5 685de5d3521819a6afa68e5051cfe962
SHA1 d7eb6922822ea0d5c94732ebb4b08d581155f727
SHA512 992597cd0cb5df88c153526d82a3eba89ab6949ebf9ed2bbd00b1c582ddf1c3f6119ad3e6dfa6aa97ed887060cd87e0371cd0f62f7930bfafe9159c3b45465c3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYL:GezaTF8FcNkNdfE0pZ9oztFwI7ei11p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZWFVKzo.exe

Path \Windows\system\ZWFVKzo.exe
Size 1.4MB
SHA256 e22f04d150d28486b82d48c335f19d0ec2c7fe7967db3aad78cc730e7b5244df
MD5 871e28dd4c71cbdca400e3d40a9ee941
SHA1 40c7a5746b77cdf8814a47d629e0d2c73e8ddf8d
SHA512 7cae29fae883e760656047c8e84b137d3134412dd58c344cfb6d04f22d073f3e64188110b924128218c2ddc5072767ba5597486e9f7ebc573f61189dd655ecf1
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSYH:GezaTF8FcNkNdfE0pZ9oztFwI7ei11R
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWiXBSo.exe

Path \Windows\system\jWiXBSo.exe
Size 1.4MB
SHA256 260d859176b18c087a01438b0d39a25638c8917ffa463cbc3bad222e2b6c3779
MD5 90523c58cf1f678616e5cacb41cd9e88
SHA1 62dfae9c85e008945dac457992af09fa9f597d85
SHA512 b4eeceba50f8cc9c6a60ab1d342b2da72b12f4e424e0737e4f6e03cd2463b8260c108f363a6b674304d521be377bc64a0099a8828fbb40281f014f4fd8fb824a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY1:GezaTF8FcNkNdfE0pZ9oztFwI7ei11P
MD5 SHA1 SHA512 SSDEEP

Submit Download

qivWQVg.exe

Path \Windows\system\qivWQVg.exe
Size 1.4MB
SHA256 1ae06014b2b7645b7c4a5d1b96f6ffe0819669c78d77d66a47f21f447d104a36
MD5 edb4f4e1b6f64a793d871779cba05bc5
SHA1 5acd58ee804d04290ad79777b30dbd1ba2d609e9
SHA512 739dd00d4e698125ff2b5114aae24ef4444838560cb33b30256909fa065d5137685bf18e5d575643400b0f9797badf4d98fdb3003bae66d186621bfef1b89e8a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenKB/ksiZdMzPxFh1GuzSY9:GezaTF8FcNkNdfE0pZ9oztFwI7ei11H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2380-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads