xmrig | 419d0fb33b9bab52d3195e0f9af3f2f8fbd1a44db4545689018f00fc3afbb6bd

Analysis

max time kernel
37s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
Size

2.2MB
MD5

01a9fb2d13e5515c00d93ba93902d1d4
SHA1

c9a161a80280e6add147df6448a42b56aa764a53
SHA256

419d0fb33b9bab52d3195e0f9af3f2f8fbd1a44db4545689018f00fc3afbb6bd
SHA512

288fb102321ff273d00680db4871e02444303257f3ceefb96da0a615acf4fd19c474a6fdd9ff34581f2cdaf471a65ebeef88ee292cb96b18d1cc8611533aec56
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRb2M:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2484-26-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2992-67-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2992-83-0x00000000033C0000-0x00000000037B2000-memory.dmp	xmrig
behavioral1/memory/1956-97-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2380-277-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2456-95-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/3036-68-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2976-42-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/1284-39-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2592-21-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2304-2041-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3036	IDgqqNI.exe
2484	GvsSRUo.exe
2592	WjDqJsw.exe
1284	JuOuCVe.exe
2976	MOJKYVo.exe
2380	rrhSfEG.exe
2456	cvsIrzU.exe
2304	fRMudWz.exe
2436	XdgMyqa.exe
2692	JSYkbwO.exe
2624	pyOCNrF.exe
1956	vdsotqM.exe
2756	cyfaXcZ.exe
2204	CUfnfMz.exe
2016	XeKnVTI.exe
2020	xjDoimP.exe
1672	IWWDDMA.exe
1696	BuaIWNY.exe
1764	zYexOIL.exe
2856	kbmJfOX.exe
2084	QrRGNwJ.exe
2328	irgufwD.exe
604	cQGAoVu.exe
1348	HWdjArw.exe
1952	GvjiNWS.exe
1156	ECilaxb.exe
2860	iQQLGxC.exe
2832	GadRWuW.exe
356	xPDDcPP.exe
980	EEmBYWs.exe
1716	ONHKoSB.exe
1708	EOzQOrm.exe
3048	bGNKcZF.exe
2152	IMjtDJu.exe
1636	kxdYedd.exe
472	PQqTnHq.exe
3008	EcZxDug.exe
1460	iNxgNMn.exe
2292	hgGLVhX.exe
2056	QlvbrJm.exe
1812	jUjwpPK.exe
2504	ktCXeXz.exe
2776	iJwFwsm.exe
2932	YOoBSRW.exe
2272	Wlfsfpk.exe
2728	LkkOWek.exe
1960	LxwYWiO.exe
3056	HbqAbun.exe
784	gxAHvLe.exe
412	drbzoSK.exe
920	QKrZcCR.exe
2108	OIuLEJl.exe
1188	DEjkspJ.exe
2072	qtYhfjX.exe
2228	aKpyRoc.exe
824	pVysxni.exe
948	cGhlcCq.exe
1316	cjLuzZg.exe
1664	xzrGWPB.exe
2312	lrNwbvx.exe
2340	cNLkzQz.exe
1816	TdDZUAp.exe
1904	qqfkEgy.exe
1724	nLGSKuu.exe

Loads dropped DLL 64 IoCs

pid	Process
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2992-0-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x000d000000012674-6.dat	upx
behavioral1/files/0x0030000000014207-7.dat	upx
behavioral1/files/0x0007000000014358-12.dat	upx
behavioral1/memory/2484-26-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-47.dat	upx
behavioral1/files/0x000600000001535e-61.dat	upx
behavioral1/files/0x0009000000014597-45.dat	upx
behavioral1/files/0x000900000001469d-66.dat	upx
behavioral1/memory/2992-67-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2436-69-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0006000000015653-75.dat	upx
behavioral1/memory/2692-82-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0006000000015677-91.dat	upx
behavioral1/files/0x000600000001565d-89.dat	upx
behavioral1/memory/1956-97-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0006000000015c87-108.dat	upx
behavioral1/files/0x0006000000015ccd-128.dat	upx
behavioral1/files/0x0006000000015d20-144.dat	upx
behavioral1/files/0x0006000000015d93-172.dat	upx
behavioral1/files/0x000600000001610f-188.dat	upx
behavioral1/memory/2380-277-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0006000000015f65-181.dat	upx
behavioral1/files/0x0006000000015e32-174.dat	upx
behavioral1/files/0x0006000000015d87-167.dat	upx
behavioral1/files/0x0006000000015d6b-160.dat	upx
behavioral1/files/0x0006000000015d56-153.dat	upx
behavioral1/files/0x0006000000015d42-146.dat	upx
behavioral1/files/0x0006000000015cff-139.dat	upx
behavioral1/files/0x0006000000015cd9-133.dat	upx
behavioral1/files/0x0006000000015fe5-186.dat	upx
behavioral1/files/0x0006000000015ecc-179.dat	upx
behavioral1/files/0x0006000000015d7f-165.dat	upx
behavioral1/files/0x0006000000015d5f-158.dat	upx
behavioral1/files/0x0006000000015d4e-151.dat	upx
behavioral1/files/0x0006000000015ce3-137.dat	upx
behavioral1/files/0x0006000000015cb6-123.dat	upx
behavioral1/files/0x0006000000015c9e-113.dat	upx
behavioral1/files/0x0006000000015cae-118.dat	upx
behavioral1/files/0x0006000000015684-103.dat	upx
behavioral1/memory/2456-95-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2624-86-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x000600000001564f-70.dat	upx
behavioral1/memory/3036-68-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2304-65-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2456-54-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2380-51-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2976-42-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/1284-39-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x00070000000143e5-38.dat	upx
behavioral1/files/0x000700000001443b-34.dat	upx
behavioral1/memory/2592-21-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/3036-17-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2304-2041-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mPoXnbD.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\tvBrNCV.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\RoBZaWq.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\KMkNJCI.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\LBIrQOQ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\gSaqHmE.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hwwINeO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dyKfNru.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\iKGWSIH.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\MOvJJwj.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\sxfafoj.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\MebkKUB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\FyqSMgt.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\GwVFNqV.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\sMVKbIb.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\BfqJUWP.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\rmKSJif.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\nVdmSRa.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\lPmcXXr.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\GOVIIDh.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\EcZxDug.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\pSyYsRM.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\tXbhAEr.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\xpifNxB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zBUMxwZ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\CUfnfMz.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\aEtVbHF.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\sirtylv.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\gMqoaSh.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ScWLcRB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zNsEMcq.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\XdgMyqa.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\xPDDcPP.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\KSOyXLP.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dLlJEIh.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\aeUKFrv.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\GwiXdXD.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ahiOHEB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\LxwYWiO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\wehBoEn.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\AcDdDvo.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\Xrmyfmg.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\GhjOqsJ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\vKfXgdW.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\bQvficQ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\KNSnUUP.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\rUacpUu.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\PAHmQsK.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\AXAJHmj.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\xpginVx.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\niCXoXw.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\pADOkpo.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hxkiCce.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\jUjwpPK.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\bhsosXH.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hRrFsrE.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\gUWBbsp.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\cDOluVO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ITyYGYq.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hdGvZuC.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zvFnrqm.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dWFBefJ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\UGDMXQK.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\JEIKEMO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
Token: SeDebugPrivilege	2940	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2940	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	29
PID 2992 wrote to memory of 2940	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	29
PID 2992 wrote to memory of 2940	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	29
PID 2992 wrote to memory of 3036	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	30
PID 2992 wrote to memory of 3036	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	30
PID 2992 wrote to memory of 3036	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	30
PID 2992 wrote to memory of 2484	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	31
PID 2992 wrote to memory of 2484	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	31
PID 2992 wrote to memory of 2484	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	31
PID 2992 wrote to memory of 2592	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	32
PID 2992 wrote to memory of 2592	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	32
PID 2992 wrote to memory of 2592	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	32
PID 2992 wrote to memory of 2976	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2976	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2976	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	33
PID 2992 wrote to memory of 1284	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	34
PID 2992 wrote to memory of 1284	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	34
PID 2992 wrote to memory of 1284	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	34
PID 2992 wrote to memory of 2380	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	35
PID 2992 wrote to memory of 2380	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	35
PID 2992 wrote to memory of 2380	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	35
PID 2992 wrote to memory of 2456	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	36
PID 2992 wrote to memory of 2456	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	36
PID 2992 wrote to memory of 2456	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	36
PID 2992 wrote to memory of 2436	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	37
PID 2992 wrote to memory of 2436	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	37
PID 2992 wrote to memory of 2436	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	37
PID 2992 wrote to memory of 2304	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	38
PID 2992 wrote to memory of 2304	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	38
PID 2992 wrote to memory of 2304	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	38
PID 2992 wrote to memory of 2624	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	39
PID 2992 wrote to memory of 2624	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	39
PID 2992 wrote to memory of 2624	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	39
PID 2992 wrote to memory of 2692	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	40
PID 2992 wrote to memory of 2692	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	40
PID 2992 wrote to memory of 2692	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	40
PID 2992 wrote to memory of 1956	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	41
PID 2992 wrote to memory of 1956	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	41
PID 2992 wrote to memory of 1956	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	41
PID 2992 wrote to memory of 2756	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	42
PID 2992 wrote to memory of 2756	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	42
PID 2992 wrote to memory of 2756	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	42
PID 2992 wrote to memory of 2204	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	43
PID 2992 wrote to memory of 2204	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	43
PID 2992 wrote to memory of 2204	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	43
PID 2992 wrote to memory of 2016	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	44
PID 2992 wrote to memory of 2016	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	44
PID 2992 wrote to memory of 2016	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	44
PID 2992 wrote to memory of 2020	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	45
PID 2992 wrote to memory of 2020	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	45
PID 2992 wrote to memory of 2020	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	45
PID 2992 wrote to memory of 1672	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	46
PID 2992 wrote to memory of 1672	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	46
PID 2992 wrote to memory of 1672	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	46
PID 2992 wrote to memory of 1696	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	47
PID 2992 wrote to memory of 1696	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	47
PID 2992 wrote to memory of 1696	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	47
PID 2992 wrote to memory of 1764	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	48
PID 2992 wrote to memory of 1764	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	48
PID 2992 wrote to memory of 1764	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	48
PID 2992 wrote to memory of 2856	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	49
PID 2992 wrote to memory of 2856	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	49
PID 2992 wrote to memory of 2856	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	49
PID 2992 wrote to memory of 2084	2992	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System\IDgqqNI.exe
  C:\Windows\System\IDgqqNI.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\GvsSRUo.exe
  C:\Windows\System\GvsSRUo.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\WjDqJsw.exe
  C:\Windows\System\WjDqJsw.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MOJKYVo.exe
  C:\Windows\System\MOJKYVo.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\JuOuCVe.exe
  C:\Windows\System\JuOuCVe.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\rrhSfEG.exe
  C:\Windows\System\rrhSfEG.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\cvsIrzU.exe
  C:\Windows\System\cvsIrzU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\XdgMyqa.exe
  C:\Windows\System\XdgMyqa.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\fRMudWz.exe
  C:\Windows\System\fRMudWz.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\pyOCNrF.exe
  C:\Windows\System\pyOCNrF.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\JSYkbwO.exe
  C:\Windows\System\JSYkbwO.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\vdsotqM.exe
  C:\Windows\System\vdsotqM.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\cyfaXcZ.exe
  C:\Windows\System\cyfaXcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\CUfnfMz.exe
  C:\Windows\System\CUfnfMz.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\XeKnVTI.exe
  C:\Windows\System\XeKnVTI.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xjDoimP.exe
  C:\Windows\System\xjDoimP.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\IWWDDMA.exe
  C:\Windows\System\IWWDDMA.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\BuaIWNY.exe
  C:\Windows\System\BuaIWNY.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\zYexOIL.exe
  C:\Windows\System\zYexOIL.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\kbmJfOX.exe
  C:\Windows\System\kbmJfOX.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\QrRGNwJ.exe
  C:\Windows\System\QrRGNwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qtYhfjX.exe
  C:\Windows\System\qtYhfjX.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\irgufwD.exe
  C:\Windows\System\irgufwD.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\aKpyRoc.exe
  C:\Windows\System\aKpyRoc.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\cQGAoVu.exe
  C:\Windows\System\cQGAoVu.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\pVysxni.exe
  C:\Windows\System\pVysxni.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\HWdjArw.exe
  C:\Windows\System\HWdjArw.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\cGhlcCq.exe
  C:\Windows\System\cGhlcCq.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\GvjiNWS.exe
  C:\Windows\System\GvjiNWS.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\cjLuzZg.exe
  C:\Windows\System\cjLuzZg.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ECilaxb.exe
  C:\Windows\System\ECilaxb.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\xzrGWPB.exe
  C:\Windows\System\xzrGWPB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\iQQLGxC.exe
  C:\Windows\System\iQQLGxC.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\lrNwbvx.exe
  C:\Windows\System\lrNwbvx.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GadRWuW.exe
  C:\Windows\System\GadRWuW.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\cNLkzQz.exe
  C:\Windows\System\cNLkzQz.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\xPDDcPP.exe
  C:\Windows\System\xPDDcPP.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\TdDZUAp.exe
  C:\Windows\System\TdDZUAp.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EEmBYWs.exe
  C:\Windows\System\EEmBYWs.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\qqfkEgy.exe
  C:\Windows\System\qqfkEgy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ONHKoSB.exe
  C:\Windows\System\ONHKoSB.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\nLGSKuu.exe
  C:\Windows\System\nLGSKuu.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\EOzQOrm.exe
  C:\Windows\System\EOzQOrm.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\oYYAmax.exe
  C:\Windows\System\oYYAmax.exe
  2⤵
  PID:932
- C:\Windows\System\bGNKcZF.exe
  C:\Windows\System\bGNKcZF.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YMyEsok.exe
  C:\Windows\System\YMyEsok.exe
  2⤵
  PID:568
- C:\Windows\System\IMjtDJu.exe
  C:\Windows\System\IMjtDJu.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\YaFGYhD.exe
  C:\Windows\System\YaFGYhD.exe
  2⤵
  PID:2464
- C:\Windows\System\kxdYedd.exe
  C:\Windows\System\kxdYedd.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\mLEImRN.exe
  C:\Windows\System\mLEImRN.exe
  2⤵
  PID:1640
- C:\Windows\System\PQqTnHq.exe
  C:\Windows\System\PQqTnHq.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\jExNdnu.exe
  C:\Windows\System\jExNdnu.exe
  2⤵
  PID:556
- C:\Windows\System\EcZxDug.exe
  C:\Windows\System\EcZxDug.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\dNOoiEZ.exe
  C:\Windows\System\dNOoiEZ.exe
  2⤵
  PID:2308
- C:\Windows\System\iNxgNMn.exe
  C:\Windows\System\iNxgNMn.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\obykySt.exe
  C:\Windows\System\obykySt.exe
  2⤵
  PID:896
- C:\Windows\System\hgGLVhX.exe
  C:\Windows\System\hgGLVhX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\GOkshAE.exe
  C:\Windows\System\GOkshAE.exe
  2⤵
  PID:2240
- C:\Windows\System\QlvbrJm.exe
  C:\Windows\System\QlvbrJm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XtVJAux.exe
  C:\Windows\System\XtVJAux.exe
  2⤵
  PID:2524
- C:\Windows\System\jUjwpPK.exe
  C:\Windows\System\jUjwpPK.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\GBpAQip.exe
  C:\Windows\System\GBpAQip.exe
  2⤵
  PID:1520
- C:\Windows\System\ktCXeXz.exe
  C:\Windows\System\ktCXeXz.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EKwdEKS.exe
  C:\Windows\System\EKwdEKS.exe
  2⤵
  PID:2628
- C:\Windows\System\iJwFwsm.exe
  C:\Windows\System\iJwFwsm.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\CaLjfHE.exe
  C:\Windows\System\CaLjfHE.exe
  2⤵
  PID:2448
- C:\Windows\System\YOoBSRW.exe
  C:\Windows\System\YOoBSRW.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\OoiFPeQ.exe
  C:\Windows\System\OoiFPeQ.exe
  2⤵
  PID:2720
- C:\Windows\System\Wlfsfpk.exe
  C:\Windows\System\Wlfsfpk.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\gilWzaD.exe
  C:\Windows\System\gilWzaD.exe
  2⤵
  PID:2676
- C:\Windows\System\LkkOWek.exe
  C:\Windows\System\LkkOWek.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ePOTfoS.exe
  C:\Windows\System\ePOTfoS.exe
  2⤵
  PID:1280
- C:\Windows\System\LxwYWiO.exe
  C:\Windows\System\LxwYWiO.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\bjYfGfW.exe
  C:\Windows\System\bjYfGfW.exe
  2⤵
  PID:1616
- C:\Windows\System\HbqAbun.exe
  C:\Windows\System\HbqAbun.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\sBlyYMS.exe
  C:\Windows\System\sBlyYMS.exe
  2⤵
  PID:2208
- C:\Windows\System\gxAHvLe.exe
  C:\Windows\System\gxAHvLe.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\MEzsEiL.exe
  C:\Windows\System\MEzsEiL.exe
  2⤵
  PID:1488
- C:\Windows\System\drbzoSK.exe
  C:\Windows\System\drbzoSK.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\SoYdVuR.exe
  C:\Windows\System\SoYdVuR.exe
  2⤵
  PID:1504
- C:\Windows\System\QKrZcCR.exe
  C:\Windows\System\QKrZcCR.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\AFieYfC.exe
  C:\Windows\System\AFieYfC.exe
  2⤵
  PID:1592
- C:\Windows\System\OIuLEJl.exe
  C:\Windows\System\OIuLEJl.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\KAzpPgo.exe
  C:\Windows\System\KAzpPgo.exe
  2⤵
  PID:2576
- C:\Windows\System\DEjkspJ.exe
  C:\Windows\System\DEjkspJ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\GpajtoG.exe
  C:\Windows\System\GpajtoG.exe
  2⤵
  PID:1580
- C:\Windows\System\oRMxGPK.exe
  C:\Windows\System\oRMxGPK.exe
  2⤵
  PID:2900
- C:\Windows\System\YKFbNof.exe
  C:\Windows\System\YKFbNof.exe
  2⤵
  PID:912
- C:\Windows\System\nCBnAuU.exe
  C:\Windows\System\nCBnAuU.exe
  2⤵
  PID:1648
- C:\Windows\System\XfbcmGX.exe
  C:\Windows\System\XfbcmGX.exe
  2⤵
  PID:1888
- C:\Windows\System\xfmZFAt.exe
  C:\Windows\System\xfmZFAt.exe
  2⤵
  PID:2192
- C:\Windows\System\xwczXkD.exe
  C:\Windows\System\xwczXkD.exe
  2⤵
  PID:2468
- C:\Windows\System\cFCghfO.exe
  C:\Windows\System\cFCghfO.exe
  2⤵
  PID:1564
- C:\Windows\System\qluXrIj.exe
  C:\Windows\System\qluXrIj.exe
  2⤵
  PID:3084
- C:\Windows\System\hcUEMLP.exe
  C:\Windows\System\hcUEMLP.exe
  2⤵
  PID:3100
- C:\Windows\System\IyhnfMM.exe
  C:\Windows\System\IyhnfMM.exe
  2⤵
  PID:3116
- C:\Windows\System\Xiwuchv.exe
  C:\Windows\System\Xiwuchv.exe
  2⤵
  PID:3132
- C:\Windows\System\JUhOeAk.exe
  C:\Windows\System\JUhOeAk.exe
  2⤵
  PID:3148
- C:\Windows\System\XdDRYdr.exe
  C:\Windows\System\XdDRYdr.exe
  2⤵
  PID:3168
- C:\Windows\System\tPqcSVG.exe
  C:\Windows\System\tPqcSVG.exe
  2⤵
  PID:3184
- C:\Windows\System\HAcwgfm.exe
  C:\Windows\System\HAcwgfm.exe
  2⤵
  PID:3200
- C:\Windows\System\bQsAfKd.exe
  C:\Windows\System\bQsAfKd.exe
  2⤵
  PID:3216
- C:\Windows\System\zyidRck.exe
  C:\Windows\System\zyidRck.exe
  2⤵
  PID:3232
- C:\Windows\System\WQPAWHG.exe
  C:\Windows\System\WQPAWHG.exe
  2⤵
  PID:3248
- C:\Windows\System\nDPCqVA.exe
  C:\Windows\System\nDPCqVA.exe
  2⤵
  PID:3264
- C:\Windows\System\bKoyyKs.exe
  C:\Windows\System\bKoyyKs.exe
  2⤵
  PID:3284
- C:\Windows\System\TBJvWZJ.exe
  C:\Windows\System\TBJvWZJ.exe
  2⤵
  PID:3300
- C:\Windows\System\KpIkPWr.exe
  C:\Windows\System\KpIkPWr.exe
  2⤵
  PID:3316
- C:\Windows\System\WyZotGx.exe
  C:\Windows\System\WyZotGx.exe
  2⤵
  PID:3332
- C:\Windows\System\DyOwqoc.exe
  C:\Windows\System\DyOwqoc.exe
  2⤵
  PID:3348
- C:\Windows\System\KMBESoq.exe
  C:\Windows\System\KMBESoq.exe
  2⤵
  PID:3384
- C:\Windows\System\jVCGhty.exe
  C:\Windows\System\jVCGhty.exe
  2⤵
  PID:3404
- C:\Windows\System\YAriyow.exe
  C:\Windows\System\YAriyow.exe
  2⤵
  PID:3420
- C:\Windows\System\ZzbHlnC.exe
  C:\Windows\System\ZzbHlnC.exe
  2⤵
  PID:3436
- C:\Windows\System\FFZnqqw.exe
  C:\Windows\System\FFZnqqw.exe
  2⤵
  PID:3452
- C:\Windows\System\cdPNhJU.exe
  C:\Windows\System\cdPNhJU.exe
  2⤵
  PID:3472
- C:\Windows\System\oQHuiCZ.exe
  C:\Windows\System\oQHuiCZ.exe
  2⤵
  PID:3488
- C:\Windows\System\zElrcdf.exe
  C:\Windows\System\zElrcdf.exe
  2⤵
  PID:3504
- C:\Windows\System\ghwlKWf.exe
  C:\Windows\System\ghwlKWf.exe
  2⤵
  PID:3520
- C:\Windows\System\moECLnP.exe
  C:\Windows\System\moECLnP.exe
  2⤵
  PID:3540
- C:\Windows\System\lEBTrEZ.exe
  C:\Windows\System\lEBTrEZ.exe
  2⤵
  PID:3556
- C:\Windows\System\dyKfNru.exe
  C:\Windows\System\dyKfNru.exe
  2⤵
  PID:3572
- C:\Windows\System\AMIMbZQ.exe
  C:\Windows\System\AMIMbZQ.exe
  2⤵
  PID:3588
- C:\Windows\System\xIkZBmm.exe
  C:\Windows\System\xIkZBmm.exe
  2⤵
  PID:3604
- C:\Windows\System\tvBrNCV.exe
  C:\Windows\System\tvBrNCV.exe
  2⤵
  PID:3620
- C:\Windows\System\BsDkDrt.exe
  C:\Windows\System\BsDkDrt.exe
  2⤵
  PID:3636
- C:\Windows\System\MuiqkKF.exe
  C:\Windows\System\MuiqkKF.exe
  2⤵
  PID:3652
- C:\Windows\System\BfqJUWP.exe
  C:\Windows\System\BfqJUWP.exe
  2⤵
  PID:3672
- C:\Windows\System\xDRgqsB.exe
  C:\Windows\System\xDRgqsB.exe
  2⤵
  PID:3688
- C:\Windows\System\iXpyUCt.exe
  C:\Windows\System\iXpyUCt.exe
  2⤵
  PID:3704
- C:\Windows\System\hjZmMGW.exe
  C:\Windows\System\hjZmMGW.exe
  2⤵
  PID:3720
- C:\Windows\System\tKiULDd.exe
  C:\Windows\System\tKiULDd.exe
  2⤵
  PID:3736
- C:\Windows\System\aFFMuhJ.exe
  C:\Windows\System\aFFMuhJ.exe
  2⤵
  PID:3752
- C:\Windows\System\HtIdSoc.exe
  C:\Windows\System\HtIdSoc.exe
  2⤵
  PID:3768
- C:\Windows\System\XQohcjw.exe
  C:\Windows\System\XQohcjw.exe
  2⤵
  PID:3788
- C:\Windows\System\tpoAZpR.exe
  C:\Windows\System\tpoAZpR.exe
  2⤵
  PID:3804
- C:\Windows\System\FdETVLd.exe
  C:\Windows\System\FdETVLd.exe
  2⤵
  PID:3820
- C:\Windows\System\hdGvZuC.exe
  C:\Windows\System\hdGvZuC.exe
  2⤵
  PID:4052
- C:\Windows\System\Acclmvb.exe
  C:\Windows\System\Acclmvb.exe
  2⤵
  PID:2068
- C:\Windows\System\XZQcXWg.exe
  C:\Windows\System\XZQcXWg.exe
  2⤵
  PID:1808
- C:\Windows\System\iVOZOFi.exe
  C:\Windows\System\iVOZOFi.exe
  2⤵
  PID:2252
- C:\Windows\System\csHGcpU.exe
  C:\Windows\System\csHGcpU.exe
  2⤵
  PID:2412
- C:\Windows\System\KHuijGc.exe
  C:\Windows\System\KHuijGc.exe
  2⤵
  PID:2440
- C:\Windows\System\vReklVW.exe
  C:\Windows\System\vReklVW.exe
  2⤵
  PID:2372
- C:\Windows\System\qgGjllG.exe
  C:\Windows\System\qgGjllG.exe
  2⤵
  PID:1652
- C:\Windows\System\SNnXXDr.exe
  C:\Windows\System\SNnXXDr.exe
  2⤵
  PID:3068
- C:\Windows\System\MSnYoiO.exe
  C:\Windows\System\MSnYoiO.exe
  2⤵
  PID:1744
- C:\Windows\System\FZnVLzs.exe
  C:\Windows\System\FZnVLzs.exe
  2⤵
  PID:772
- C:\Windows\System\JTBdStD.exe
  C:\Windows\System\JTBdStD.exe
  2⤵
  PID:1988
- C:\Windows\System\MoqCfKO.exe
  C:\Windows\System\MoqCfKO.exe
  2⤵
  PID:3112
- C:\Windows\System\HndUYsF.exe
  C:\Windows\System\HndUYsF.exe
  2⤵
  PID:3208
- C:\Windows\System\aEtVbHF.exe
  C:\Windows\System\aEtVbHF.exe
  2⤵
  PID:3276
- C:\Windows\System\QMLNvXS.exe
  C:\Windows\System\QMLNvXS.exe
  2⤵
  PID:2696
- C:\Windows\System\hlluiEu.exe
  C:\Windows\System\hlluiEu.exe
  2⤵
  PID:1660
- C:\Windows\System\NsElgoJ.exe
  C:\Windows\System\NsElgoJ.exe
  2⤵
  PID:2924
- C:\Windows\System\fZJRaHE.exe
  C:\Windows\System\fZJRaHE.exe
  2⤵
  PID:3340
- C:\Windows\System\CdKhCTg.exe
  C:\Windows\System\CdKhCTg.exe
  2⤵
  PID:3392
- C:\Windows\System\NachXDW.exe
  C:\Windows\System\NachXDW.exe
  2⤵
  PID:3460
- C:\Windows\System\Ykgzmnc.exe
  C:\Windows\System\Ykgzmnc.exe
  2⤵
  PID:3528
- C:\Windows\System\SFcrmoG.exe
  C:\Windows\System\SFcrmoG.exe
  2⤵
  PID:3600
- C:\Windows\System\BjzBdNB.exe
  C:\Windows\System\BjzBdNB.exe
  2⤵
  PID:3668
- C:\Windows\System\QxXWzYp.exe
  C:\Windows\System\QxXWzYp.exe
  2⤵
  PID:3760
- C:\Windows\System\JiHoHoG.exe
  C:\Windows\System\JiHoHoG.exe
  2⤵
  PID:3836
- C:\Windows\System\jhzndfJ.exe
  C:\Windows\System\jhzndfJ.exe
  2⤵
  PID:600
- C:\Windows\System\pLqvGus.exe
  C:\Windows\System\pLqvGus.exe
  2⤵
  PID:3860
- C:\Windows\System\ZqEAmtd.exe
  C:\Windows\System\ZqEAmtd.exe
  2⤵
  PID:1228
- C:\Windows\System\wopeZfx.exe
  C:\Windows\System\wopeZfx.exe
  2⤵
  PID:1732
- C:\Windows\System\YDkClZo.exe
  C:\Windows\System\YDkClZo.exe
  2⤵
  PID:2928
- C:\Windows\System\VQuiodP.exe
  C:\Windows\System\VQuiodP.exe
  2⤵
  PID:2364
- C:\Windows\System\aHPpfQS.exe
  C:\Windows\System\aHPpfQS.exe
  2⤵
  PID:1208
- C:\Windows\System\eJoPDlu.exe
  C:\Windows\System\eJoPDlu.exe
  2⤵
  PID:3092
- C:\Windows\System\JDLdMnV.exe
  C:\Windows\System\JDLdMnV.exe
  2⤵
  PID:3192
- C:\Windows\System\VHFkAqI.exe
  C:\Windows\System\VHFkAqI.exe
  2⤵
  PID:3292
- C:\Windows\System\wfJXMaB.exe
  C:\Windows\System\wfJXMaB.exe
  2⤵
  PID:2636
- C:\Windows\System\pAFYsle.exe
  C:\Windows\System\pAFYsle.exe
  2⤵
  PID:2188
- C:\Windows\System\WlkYovA.exe
  C:\Windows\System\WlkYovA.exe
  2⤵
  PID:3896
- C:\Windows\System\NmEgPnX.exe
  C:\Windows\System\NmEgPnX.exe
  2⤵
  PID:3916
- C:\Windows\System\rEihyFy.exe
  C:\Windows\System\rEihyFy.exe
  2⤵
  PID:3932
- C:\Windows\System\jDlUzYI.exe
  C:\Windows\System\jDlUzYI.exe
  2⤵
  PID:3948
- C:\Windows\System\GmkexhE.exe
  C:\Windows\System\GmkexhE.exe
  2⤵
  PID:3968
- C:\Windows\System\ERKBGKJ.exe
  C:\Windows\System\ERKBGKJ.exe
  2⤵
  PID:3984
- C:\Windows\System\AvmdGDt.exe
  C:\Windows\System\AvmdGDt.exe
  2⤵
  PID:3996
- C:\Windows\System\RoBZaWq.exe
  C:\Windows\System\RoBZaWq.exe
  2⤵
  PID:2356
- C:\Windows\System\cWXxJrs.exe
  C:\Windows\System\cWXxJrs.exe
  2⤵
  PID:1900
- C:\Windows\System\XHWghAv.exe
  C:\Windows\System\XHWghAv.exe
  2⤵
  PID:4004
- C:\Windows\System\FDYwjoz.exe
  C:\Windows\System\FDYwjoz.exe
  2⤵
  PID:4016
- C:\Windows\System\OgurlsY.exe
  C:\Windows\System\OgurlsY.exe
  2⤵
  PID:4024
- C:\Windows\System\rjNheHg.exe
  C:\Windows\System\rjNheHg.exe
  2⤵
  PID:4040
- C:\Windows\System\LnPlsLm.exe
  C:\Windows\System\LnPlsLm.exe
  2⤵
  PID:1528
- C:\Windows\System\FnlgZkp.exe
  C:\Windows\System\FnlgZkp.exe
  2⤵
  PID:1296
- C:\Windows\System\RyrNeOM.exe
  C:\Windows\System\RyrNeOM.exe
  2⤵
  PID:3480
- C:\Windows\System\htdQhNX.exe
  C:\Windows\System\htdQhNX.exe
  2⤵
  PID:584
- C:\Windows\System\rMmvfxJ.exe
  C:\Windows\System\rMmvfxJ.exe
  2⤵
  PID:3548
- C:\Windows\System\lNJrOLa.exe
  C:\Windows\System\lNJrOLa.exe
  2⤵
  PID:3612
- C:\Windows\System\qoumAaQ.exe
  C:\Windows\System\qoumAaQ.exe
  2⤵
  PID:3680
- C:\Windows\System\yrtQCCu.exe
  C:\Windows\System\yrtQCCu.exe
  2⤵
  PID:3812
- C:\Windows\System\NvvWXjl.exe
  C:\Windows\System\NvvWXjl.exe
  2⤵
  PID:4064
- C:\Windows\System\wehBoEn.exe
  C:\Windows\System\wehBoEn.exe
  2⤵
  PID:2428
- C:\Windows\System\VqisTZK.exe
  C:\Windows\System\VqisTZK.exe
  2⤵
  PID:1344
- C:\Windows\System\khrDZdf.exe
  C:\Windows\System\khrDZdf.exe
  2⤵
  PID:1872
- C:\Windows\System\csWdhxE.exe
  C:\Windows\System\csWdhxE.exe
  2⤵
  PID:112
- C:\Windows\System\iVmVRog.exe
  C:\Windows\System\iVmVRog.exe
  2⤵
  PID:576
- C:\Windows\System\FarMCPV.exe
  C:\Windows\System\FarMCPV.exe
  2⤵
  PID:1112
- C:\Windows\System\nXBmuuz.exe
  C:\Windows\System\nXBmuuz.exe
  2⤵
  PID:1692
- C:\Windows\System\BnNCJHg.exe
  C:\Windows\System\BnNCJHg.exe
  2⤵
  PID:1216
- C:\Windows\System\WakUglF.exe
  C:\Windows\System\WakUglF.exe
  2⤵
  PID:2132
- C:\Windows\System\wazOSEz.exe
  C:\Windows\System\wazOSEz.exe
  2⤵
  PID:1040
- C:\Windows\System\DocxXPd.exe
  C:\Windows\System\DocxXPd.exe
  2⤵
  PID:2064
- C:\Windows\System\mRwpdNc.exe
  C:\Windows\System\mRwpdNc.exe
  2⤵
  PID:1476
- C:\Windows\System\kqtldyS.exe
  C:\Windows\System\kqtldyS.exe
  2⤵
  PID:3108
- C:\Windows\System\ahJfaVV.exe
  C:\Windows\System\ahJfaVV.exe
  2⤵
  PID:3176
- C:\Windows\System\nolOPDi.exe
  C:\Windows\System\nolOPDi.exe
  2⤵
  PID:2548
- C:\Windows\System\qTZXxAt.exe
  C:\Windows\System\qTZXxAt.exe
  2⤵
  PID:2276
- C:\Windows\System\zrZdNRP.exe
  C:\Windows\System\zrZdNRP.exe
  2⤵
  PID:328
- C:\Windows\System\lvWubqy.exe
  C:\Windows\System\lvWubqy.exe
  2⤵
  PID:864
- C:\Windows\System\sfWiWsd.exe
  C:\Windows\System\sfWiWsd.exe
  2⤵
  PID:2256
- C:\Windows\System\LsAHzOt.exe
  C:\Windows\System\LsAHzOt.exe
  2⤵
  PID:3500
- C:\Windows\System\KVHaaxM.exe
  C:\Windows\System\KVHaaxM.exe
  2⤵
  PID:3596
- C:\Windows\System\OrmTpia.exe
  C:\Windows\System\OrmTpia.exe
  2⤵
  PID:3696
- C:\Windows\System\WyugRjG.exe
  C:\Windows\System\WyugRjG.exe
  2⤵
  PID:3796
- C:\Windows\System\HtXbxuJ.exe
  C:\Windows\System\HtXbxuJ.exe
  2⤵
  PID:684
- C:\Windows\System\ODlLHXL.exe
  C:\Windows\System\ODlLHXL.exe
  2⤵
  PID:3164
- C:\Windows\System\AkvqvDF.exe
  C:\Windows\System\AkvqvDF.exe
  2⤵
  PID:3256
- C:\Windows\System\VaHRiPj.exe
  C:\Windows\System\VaHRiPj.exe
  2⤵
  PID:3908
- C:\Windows\System\BIpQGuL.exe
  C:\Windows\System\BIpQGuL.exe
  2⤵
  PID:3976
- C:\Windows\System\LcosKro.exe
  C:\Windows\System\LcosKro.exe
  2⤵
  PID:3964
- C:\Windows\System\dRHcUZQ.exe
  C:\Windows\System\dRHcUZQ.exe
  2⤵
  PID:3960
- C:\Windows\System\CRTLMfd.exe
  C:\Windows\System\CRTLMfd.exe
  2⤵
  PID:320
- C:\Windows\System\zLIUtQR.exe
  C:\Windows\System\zLIUtQR.exe
  2⤵
  PID:2632
- C:\Windows\System\BPvYcJa.exe
  C:\Windows\System\BPvYcJa.exe
  2⤵
  PID:3832
- C:\Windows\System\LkGbRoq.exe
  C:\Windows\System\LkGbRoq.exe
  2⤵
  PID:3912
- C:\Windows\System\TjRbdLl.exe
  C:\Windows\System\TjRbdLl.exe
  2⤵
  PID:4008
- C:\Windows\System\BVzDNuL.exe
  C:\Windows\System\BVzDNuL.exe
  2⤵
  PID:1656
- C:\Windows\System\GNTiuWB.exe
  C:\Windows\System\GNTiuWB.exe
  2⤵
  PID:1852
- C:\Windows\System\EyjNmZt.exe
  C:\Windows\System\EyjNmZt.exe
  2⤵
  PID:3584
- C:\Windows\System\GXQhgdI.exe
  C:\Windows\System\GXQhgdI.exe
  2⤵
  PID:3356
- C:\Windows\System\ndaatxN.exe
  C:\Windows\System\ndaatxN.exe
  2⤵
  PID:3748
- C:\Windows\System\qzeLiED.exe
  C:\Windows\System\qzeLiED.exe
  2⤵
  PID:3412
- C:\Windows\System\iuMUzHT.exe
  C:\Windows\System\iuMUzHT.exe
  2⤵
  PID:2880
- C:\Windows\System\MWaYthl.exe
  C:\Windows\System\MWaYthl.exe
  2⤵
  PID:3180
- C:\Windows\System\rjHrPcE.exe
  C:\Windows\System\rjHrPcE.exe
  2⤵
  PID:3308
- C:\Windows\System\llWhkSZ.exe
  C:\Windows\System\llWhkSZ.exe
  2⤵
  PID:2172
- C:\Windows\System\NfhspRb.exe
  C:\Windows\System\NfhspRb.exe
  2⤵
  PID:3800
- C:\Windows\System\mhwudhI.exe
  C:\Windows\System\mhwudhI.exe
  2⤵
  PID:2600
- C:\Windows\System\TnSHAUb.exe
  C:\Windows\System\TnSHAUb.exe
  2⤵
  PID:2124
- C:\Windows\System\SoTYbHU.exe
  C:\Windows\System\SoTYbHU.exe
  2⤵
  PID:3244
- C:\Windows\System\bblqqyD.exe
  C:\Windows\System\bblqqyD.exe
  2⤵
  PID:2748
- C:\Windows\System\FamLmKA.exe
  C:\Windows\System\FamLmKA.exe
  2⤵
  PID:3700
- C:\Windows\System\fhKMGZu.exe
  C:\Windows\System\fhKMGZu.exe
  2⤵
  PID:2400
- C:\Windows\System\Elnsjpe.exe
  C:\Windows\System\Elnsjpe.exe
  2⤵
  PID:3852
- C:\Windows\System\JRIoYev.exe
  C:\Windows\System\JRIoYev.exe
  2⤵
  PID:1736
- C:\Windows\System\cdVdqaK.exe
  C:\Windows\System\cdVdqaK.exe
  2⤵
  PID:3880
- C:\Windows\System\swasMQm.exe
  C:\Windows\System\swasMQm.exe
  2⤵
  PID:3160
- C:\Windows\System\vRociXJ.exe
  C:\Windows\System\vRociXJ.exe
  2⤵
  PID:3224
- C:\Windows\System\kagErTn.exe
  C:\Windows\System\kagErTn.exe
  2⤵
  PID:3928
- C:\Windows\System\RUVpUQZ.exe
  C:\Windows\System\RUVpUQZ.exe
  2⤵
  PID:3128
- C:\Windows\System\eDpykTt.exe
  C:\Windows\System\eDpykTt.exe
  2⤵
  PID:4036
- C:\Windows\System\MkZuFoN.exe
  C:\Windows\System\MkZuFoN.exe
  2⤵
  PID:1584
- C:\Windows\System\fXlLOBm.exe
  C:\Windows\System\fXlLOBm.exe
  2⤵
  PID:3260
- C:\Windows\System\YjGAQaI.exe
  C:\Windows\System\YjGAQaI.exe
  2⤵
  PID:2996
- C:\Windows\System\JJWqVYL.exe
  C:\Windows\System\JJWqVYL.exe
  2⤵
  PID:3516
- C:\Windows\System\OfRUWdm.exe
  C:\Windows\System\OfRUWdm.exe
  2⤵
  PID:2608
- C:\Windows\System\VwunAUr.exe
  C:\Windows\System\VwunAUr.exe
  2⤵
  PID:3376
- C:\Windows\System\CpaJOwb.exe
  C:\Windows\System\CpaJOwb.exe
  2⤵
  PID:3028
- C:\Windows\System\pSyYsRM.exe
  C:\Windows\System\pSyYsRM.exe
  2⤵
  PID:1972
- C:\Windows\System\TxmIDKt.exe
  C:\Windows\System\TxmIDKt.exe
  2⤵
  PID:1860
- C:\Windows\System\ZKrmgKu.exe
  C:\Windows\System\ZKrmgKu.exe
  2⤵
  PID:3648
- C:\Windows\System\xZmZceG.exe
  C:\Windows\System\xZmZceG.exe
  2⤵
  PID:2760
- C:\Windows\System\zVAljPo.exe
  C:\Windows\System\zVAljPo.exe
  2⤵
  PID:3660
- C:\Windows\System\polKHPv.exe
  C:\Windows\System\polKHPv.exe
  2⤵
  PID:1752
- C:\Windows\System\TcXXQaD.exe
  C:\Windows\System\TcXXQaD.exe
  2⤵
  PID:2580
- C:\Windows\System\HLWgugj.exe
  C:\Windows\System\HLWgugj.exe
  2⤵
  PID:1844
- C:\Windows\System\rSZggbK.exe
  C:\Windows\System\rSZggbK.exe
  2⤵
  PID:4108
- C:\Windows\System\ORTuUBj.exe
  C:\Windows\System\ORTuUBj.exe
  2⤵
  PID:4124
- C:\Windows\System\YBQgZMv.exe
  C:\Windows\System\YBQgZMv.exe
  2⤵
  PID:4140
- C:\Windows\System\OLmDjck.exe
  C:\Windows\System\OLmDjck.exe
  2⤵
  PID:4160
- C:\Windows\System\PjJIaGw.exe
  C:\Windows\System\PjJIaGw.exe
  2⤵
  PID:4176
- C:\Windows\System\csrXaJI.exe
  C:\Windows\System\csrXaJI.exe
  2⤵
  PID:4196
- C:\Windows\System\wjRBsmX.exe
  C:\Windows\System\wjRBsmX.exe
  2⤵
  PID:4300
- C:\Windows\System\BPHxLtk.exe
  C:\Windows\System\BPHxLtk.exe
  2⤵
  PID:4332
- C:\Windows\System\jEDiCio.exe
  C:\Windows\System\jEDiCio.exe
  2⤵
  PID:4348
- C:\Windows\System\vayhVVd.exe
  C:\Windows\System\vayhVVd.exe
  2⤵
  PID:4364
- C:\Windows\System\iTlXPQP.exe
  C:\Windows\System\iTlXPQP.exe
  2⤵
  PID:4392
- C:\Windows\System\IBxenQB.exe
  C:\Windows\System\IBxenQB.exe
  2⤵
  PID:4412
- C:\Windows\System\AvIAeZw.exe
  C:\Windows\System\AvIAeZw.exe
  2⤵
  PID:4432
- C:\Windows\System\xysNCJU.exe
  C:\Windows\System\xysNCJU.exe
  2⤵
  PID:4452
- C:\Windows\System\uPdxMlC.exe
  C:\Windows\System\uPdxMlC.exe
  2⤵
  PID:4468
- C:\Windows\System\aQfFExX.exe
  C:\Windows\System\aQfFExX.exe
  2⤵
  PID:4484
- C:\Windows\System\HDuLTxp.exe
  C:\Windows\System\HDuLTxp.exe
  2⤵
  PID:4504
- C:\Windows\System\KjDhyCn.exe
  C:\Windows\System\KjDhyCn.exe
  2⤵
  PID:4520
- C:\Windows\System\uQnnryd.exe
  C:\Windows\System\uQnnryd.exe
  2⤵
  PID:4536
- C:\Windows\System\YZSTSrV.exe
  C:\Windows\System\YZSTSrV.exe
  2⤵
  PID:4552
- C:\Windows\System\cMTnSxZ.exe
  C:\Windows\System\cMTnSxZ.exe
  2⤵
  PID:4568
- C:\Windows\System\KXMPiWj.exe
  C:\Windows\System\KXMPiWj.exe
  2⤵
  PID:4620
- C:\Windows\System\zoWwhhQ.exe
  C:\Windows\System\zoWwhhQ.exe
  2⤵
  PID:4636
- C:\Windows\System\dsqNEUx.exe
  C:\Windows\System\dsqNEUx.exe
  2⤵
  PID:4652
- C:\Windows\System\vkfbuYM.exe
  C:\Windows\System\vkfbuYM.exe
  2⤵
  PID:4668
- C:\Windows\System\AcDdDvo.exe
  C:\Windows\System\AcDdDvo.exe
  2⤵
  PID:4684
- C:\Windows\System\iUrCLsY.exe
  C:\Windows\System\iUrCLsY.exe
  2⤵
  PID:4700
- C:\Windows\System\xiXxgFs.exe
  C:\Windows\System\xiXxgFs.exe
  2⤵
  PID:4716
- C:\Windows\System\VEXurrJ.exe
  C:\Windows\System\VEXurrJ.exe
  2⤵
  PID:4736
- C:\Windows\System\SyKHjIp.exe
  C:\Windows\System\SyKHjIp.exe
  2⤵
  PID:4752
- C:\Windows\System\IYRppBF.exe
  C:\Windows\System\IYRppBF.exe
  2⤵
  PID:4768
- C:\Windows\System\iQJmbKs.exe
  C:\Windows\System\iQJmbKs.exe
  2⤵
  PID:4784
- C:\Windows\System\bvJZOqM.exe
  C:\Windows\System\bvJZOqM.exe
  2⤵
  PID:4844
- C:\Windows\System\yELmUXu.exe
  C:\Windows\System\yELmUXu.exe
  2⤵
  PID:4860
- C:\Windows\System\SzOztCI.exe
  C:\Windows\System\SzOztCI.exe
  2⤵
  PID:4876
- C:\Windows\System\wLKjkfQ.exe
  C:\Windows\System\wLKjkfQ.exe
  2⤵
  PID:4928
- C:\Windows\System\KbayXyo.exe
  C:\Windows\System\KbayXyo.exe
  2⤵
  PID:4944
- C:\Windows\System\FlCbgwT.exe
  C:\Windows\System\FlCbgwT.exe
  2⤵
  PID:4960
- C:\Windows\System\bQvficQ.exe
  C:\Windows\System\bQvficQ.exe
  2⤵
  PID:4976
- C:\Windows\System\eCKXrFm.exe
  C:\Windows\System\eCKXrFm.exe
  2⤵
  PID:4992
- C:\Windows\System\sepdqvS.exe
  C:\Windows\System\sepdqvS.exe
  2⤵
  PID:5008
- C:\Windows\System\jYWhABo.exe
  C:\Windows\System\jYWhABo.exe
  2⤵
  PID:5024
- C:\Windows\System\fwvnVwR.exe
  C:\Windows\System\fwvnVwR.exe
  2⤵
  PID:5040
- C:\Windows\System\yanmetF.exe
  C:\Windows\System\yanmetF.exe
  2⤵
  PID:5056
- C:\Windows\System\xamKlEJ.exe
  C:\Windows\System\xamKlEJ.exe
  2⤵
  PID:5072
- C:\Windows\System\bCHwrPn.exe
  C:\Windows\System\bCHwrPn.exe
  2⤵
  PID:5088
- C:\Windows\System\lAfIURH.exe
  C:\Windows\System\lAfIURH.exe
  2⤵
  PID:5108
- C:\Windows\System\FZxoFFy.exe
  C:\Windows\System\FZxoFFy.exe
  2⤵
  PID:4032
- C:\Windows\System\eqruIKe.exe
  C:\Windows\System\eqruIKe.exe
  2⤵
  PID:536
- C:\Windows\System\ixycKQe.exe
  C:\Windows\System\ixycKQe.exe
  2⤵
  PID:2708
- C:\Windows\System\bbQfuvC.exe
  C:\Windows\System\bbQfuvC.exe
  2⤵
  PID:3484
- C:\Windows\System\MmmjaXb.exe
  C:\Windows\System\MmmjaXb.exe
  2⤵
  PID:3956
- C:\Windows\System\ARlgNpX.exe
  C:\Windows\System\ARlgNpX.exe
  2⤵
  PID:3900
- C:\Windows\System\eSwUEHJ.exe
  C:\Windows\System\eSwUEHJ.exe
  2⤵
  PID:4132
- C:\Windows\System\OiZeiEi.exe
  C:\Windows\System\OiZeiEi.exe
  2⤵
  PID:4172
- C:\Windows\System\MbGEROm.exe
  C:\Windows\System\MbGEROm.exe
  2⤵
  PID:4216
- C:\Windows\System\oHmuuRt.exe
  C:\Windows\System\oHmuuRt.exe
  2⤵
  PID:4000
- C:\Windows\System\sDOeTGR.exe
  C:\Windows\System\sDOeTGR.exe
  2⤵
  PID:4260
- C:\Windows\System\JnLaTlq.exe
  C:\Windows\System\JnLaTlq.exe
  2⤵
  PID:3884
- C:\Windows\System\VqdrOkm.exe
  C:\Windows\System\VqdrOkm.exe
  2⤵
  PID:3328
- C:\Windows\System\ghIzJLs.exe
  C:\Windows\System\ghIzJLs.exe
  2⤵
  PID:3784
- C:\Windows\System\GxUkWBx.exe
  C:\Windows\System\GxUkWBx.exe
  2⤵
  PID:4044
- C:\Windows\System\stqbhtL.exe
  C:\Windows\System\stqbhtL.exe
  2⤵
  PID:1768
- C:\Windows\System\LEearxb.exe
  C:\Windows\System\LEearxb.exe
  2⤵
  PID:4372
- C:\Windows\System\qOAqctB.exe
  C:\Windows\System\qOAqctB.exe
  2⤵
  PID:2540
- C:\Windows\System\jcSVgrM.exe
  C:\Windows\System\jcSVgrM.exe
  2⤵
  PID:2112
- C:\Windows\System\NuHLOmk.exe
  C:\Windows\System\NuHLOmk.exe
  2⤵
  PID:4424
- C:\Windows\System\KZVjmij.exe
  C:\Windows\System\KZVjmij.exe
  2⤵
  PID:4444
- C:\Windows\System\slNWAwD.exe
  C:\Windows\System\slNWAwD.exe
  2⤵
  PID:4532
- C:\Windows\System\OgvibuO.exe
  C:\Windows\System\OgvibuO.exe
  2⤵
  PID:4476
- C:\Windows\System\MqvMKWU.exe
  C:\Windows\System\MqvMKWU.exe
  2⤵
  PID:4576
- C:\Windows\System\uYqiOBh.exe
  C:\Windows\System\uYqiOBh.exe
  2⤵
  PID:4580
- C:\Windows\System\ZXZEYeo.exe
  C:\Windows\System\ZXZEYeo.exe
  2⤵
  PID:4596
- C:\Windows\System\PUSZlME.exe
  C:\Windows\System\PUSZlME.exe
  2⤵
  PID:4612
- C:\Windows\System\OAkNftS.exe
  C:\Windows\System\OAkNftS.exe
  2⤵
  PID:4644
- C:\Windows\System\XUHpJKY.exe
  C:\Windows\System\XUHpJKY.exe
  2⤵
  PID:4696
- C:\Windows\System\VqOWYiu.exe
  C:\Windows\System\VqOWYiu.exe
  2⤵
  PID:4708
- C:\Windows\System\RBSfBDp.exe
  C:\Windows\System\RBSfBDp.exe
  2⤵
  PID:4748
- C:\Windows\System\FFhcpsx.exe
  C:\Windows\System\FFhcpsx.exe
  2⤵
  PID:4812
- C:\Windows\System\QPHPfqR.exe
  C:\Windows\System\QPHPfqR.exe
  2⤵
  PID:4804
- C:\Windows\System\mdZOrhM.exe
  C:\Windows\System\mdZOrhM.exe
  2⤵
  PID:4816
- C:\Windows\System\IAqHYLw.exe
  C:\Windows\System\IAqHYLw.exe
  2⤵
  PID:4832
- C:\Windows\System\ioVMTyk.exe
  C:\Windows\System\ioVMTyk.exe
  2⤵
  PID:4836
- C:\Windows\System\PAHmQsK.exe
  C:\Windows\System\PAHmQsK.exe
  2⤵
  PID:4872
- C:\Windows\System\IXrwBxn.exe
  C:\Windows\System\IXrwBxn.exe
  2⤵
  PID:4900
- C:\Windows\System\QeoXElR.exe
  C:\Windows\System\QeoXElR.exe
  2⤵
  PID:4904
- C:\Windows\System\NyMtoIT.exe
  C:\Windows\System\NyMtoIT.exe
  2⤵
  PID:4936
- C:\Windows\System\LaZiwDz.exe
  C:\Windows\System\LaZiwDz.exe
  2⤵
  PID:4968
- C:\Windows\System\WfCoCbl.exe
  C:\Windows\System\WfCoCbl.exe
  2⤵
  PID:5032
- C:\Windows\System\zcgGujF.exe
  C:\Windows\System\zcgGujF.exe
  2⤵
  PID:5096
- C:\Windows\System\cXIJVah.exe
  C:\Windows\System\cXIJVah.exe
  2⤵
  PID:4100
- C:\Windows\System\FYyGENU.exe
  C:\Windows\System\FYyGENU.exe
  2⤵
  PID:5100
- C:\Windows\System\OAVUXsU.exe
  C:\Windows\System\OAVUXsU.exe
  2⤵
  PID:3632
- C:\Windows\System\QIYksxk.exe
  C:\Windows\System\QIYksxk.exe
  2⤵
  PID:4212
- C:\Windows\System\ctNFaRw.exe
  C:\Windows\System\ctNFaRw.exe
  2⤵
  PID:240
- C:\Windows\System\zvFnrqm.exe
  C:\Windows\System\zvFnrqm.exe
  2⤵
  PID:3080
- C:\Windows\System\tiqnZFS.exe
  C:\Windows\System\tiqnZFS.exe
  2⤵
  PID:3732
- C:\Windows\System\UlwupWB.exe
  C:\Windows\System\UlwupWB.exe
  2⤵
  PID:2980
- C:\Windows\System\nlfDXlg.exe
  C:\Windows\System\nlfDXlg.exe
  2⤵
  PID:4120
- C:\Windows\System\nNLsLtV.exe
  C:\Windows\System\nNLsLtV.exe
  2⤵
  PID:808
- C:\Windows\System\lfXIZPw.exe
  C:\Windows\System\lfXIZPw.exe
  2⤵
  PID:2744
- C:\Windows\System\etPGNJf.exe
  C:\Windows\System\etPGNJf.exe
  2⤵
  PID:4308
- C:\Windows\System\EoQAxLK.exe
  C:\Windows\System\EoQAxLK.exe
  2⤵
  PID:4156
- C:\Windows\System\jwWFXyP.exe
  C:\Windows\System\jwWFXyP.exe
  2⤵
  PID:4328
- C:\Windows\System\CjqdzLK.exe
  C:\Windows\System\CjqdzLK.exe
  2⤵
  PID:4324
- C:\Windows\System\pNWpPYZ.exe
  C:\Windows\System\pNWpPYZ.exe
  2⤵
  PID:4384
- C:\Windows\System\EgvAQxy.exe
  C:\Windows\System\EgvAQxy.exe
  2⤵
  PID:3716
- C:\Windows\System\GKUniCV.exe
  C:\Windows\System\GKUniCV.exe
  2⤵
  PID:4464
- C:\Windows\System\VSWuMjS.exe
  C:\Windows\System\VSWuMjS.exe
  2⤵
  PID:4544
- C:\Windows\System\sycQwBw.exe
  C:\Windows\System\sycQwBw.exe
  2⤵
  PID:4628
- C:\Windows\System\fqZjkgY.exe
  C:\Windows\System\fqZjkgY.exe
  2⤵
  PID:4796
- C:\Windows\System\EaSxvOB.exe
  C:\Windows\System\EaSxvOB.exe
  2⤵
  PID:4808
- C:\Windows\System\EUnhIaM.exe
  C:\Windows\System\EUnhIaM.exe
  2⤵
  PID:4896
- C:\Windows\System\USHHxrL.exe
  C:\Windows\System\USHHxrL.exe
  2⤵
  PID:2808
- C:\Windows\System\nYLdHRk.exe
  C:\Windows\System\nYLdHRk.exe
  2⤵
  PID:5004
- C:\Windows\System\qdQLole.exe
  C:\Windows\System\qdQLole.exe
  2⤵
  PID:4972
- C:\Windows\System\qyNovtr.exe
  C:\Windows\System\qyNovtr.exe
  2⤵
  PID:4548
- C:\Windows\System\cVdUmmu.exe
  C:\Windows\System\cVdUmmu.exe
  2⤵
  PID:4608
- C:\Windows\System\BGbNHBl.exe
  C:\Windows\System\BGbNHBl.exe
  2⤵
  PID:4724
- C:\Windows\System\tGryGPU.exe
  C:\Windows\System\tGryGPU.exe
  2⤵
  PID:4824
- C:\Windows\System\wnkhJrG.exe
  C:\Windows\System\wnkhJrG.exe
  2⤵
  PID:5064
- C:\Windows\System\cyTSIWT.exe
  C:\Windows\System\cyTSIWT.exe
  2⤵
  PID:4984
- C:\Windows\System\EVsIAeQ.exe
  C:\Windows\System\EVsIAeQ.exe
  2⤵
  PID:5000
- C:\Windows\System\KSOyXLP.exe
  C:\Windows\System\KSOyXLP.exe
  2⤵
  PID:4840
- C:\Windows\System\SFUGaeu.exe
  C:\Windows\System\SFUGaeu.exe
  2⤵
  PID:1772
- C:\Windows\System\theSJUY.exe
  C:\Windows\System\theSJUY.exe
  2⤵
  PID:4280
- C:\Windows\System\rCbfPGA.exe
  C:\Windows\System\rCbfPGA.exe
  2⤵
  PID:4292
- C:\Windows\System\iKGWSIH.exe
  C:\Windows\System\iKGWSIH.exe
  2⤵
  PID:2620
- C:\Windows\System\DxKJfJV.exe
  C:\Windows\System\DxKJfJV.exe
  2⤵
  PID:1968
- C:\Windows\System\sFtqDAv.exe
  C:\Windows\System\sFtqDAv.exe
  2⤵
  PID:1308
- C:\Windows\System\yAiJoPj.exe
  C:\Windows\System\yAiJoPj.exe
  2⤵
  PID:4116
- C:\Windows\System\AWcsVhv.exe
  C:\Windows\System\AWcsVhv.exe
  2⤵
  PID:4868
- C:\Windows\System\NgjnwAM.exe
  C:\Windows\System\NgjnwAM.exe
  2⤵
  PID:4528
- C:\Windows\System\uUmRzVQ.exe
  C:\Windows\System\uUmRzVQ.exe
  2⤵
  PID:4828
- C:\Windows\System\OELcjUK.exe
  C:\Windows\System\OELcjUK.exe
  2⤵
  PID:3464
- C:\Windows\System\eakJWEm.exe
  C:\Windows\System\eakJWEm.exe
  2⤵
  PID:4248
- C:\Windows\System\opubCwI.exe
  C:\Windows\System\opubCwI.exe
  2⤵
  PID:4276
- C:\Windows\System\jjWwLDW.exe
  C:\Windows\System\jjWwLDW.exe
  2⤵
  PID:4252
- C:\Windows\System\aactMKo.exe
  C:\Windows\System\aactMKo.exe
  2⤵
  PID:2520
- C:\Windows\System\DurjSJE.exe
  C:\Windows\System\DurjSJE.exe
  2⤵
  PID:3848
- C:\Windows\System\xqpLYvb.exe
  C:\Windows\System\xqpLYvb.exe
  2⤵
  PID:2128
- C:\Windows\System\TWaiMXU.exe
  C:\Windows\System\TWaiMXU.exe
  2⤵
  PID:2416
- C:\Windows\System\OiQolDU.exe
  C:\Windows\System\OiQolDU.exe
  2⤵
  PID:4428
- C:\Windows\System\RPUfsmi.exe
  C:\Windows\System\RPUfsmi.exe
  2⤵
  PID:1352
- C:\Windows\System\Xrmyfmg.exe
  C:\Windows\System\Xrmyfmg.exe
  2⤵
  PID:4592
- C:\Windows\System\yylMQEL.exe
  C:\Windows\System\yylMQEL.exe
  2⤵
  PID:4764
- C:\Windows\System\FOfytYW.exe
  C:\Windows\System\FOfytYW.exe
  2⤵
  PID:776
- C:\Windows\System\vRnyCTc.exe
  C:\Windows\System\vRnyCTc.exe
  2⤵
  PID:852
- C:\Windows\System\ZuXAGwU.exe
  C:\Windows\System\ZuXAGwU.exe
  2⤵
  PID:4604
- C:\Windows\System\JkWfNNn.exe
  C:\Windows\System\JkWfNNn.exe
  2⤵
  PID:4408
- C:\Windows\System\lgRaTsq.exe
  C:\Windows\System\lgRaTsq.exe
  2⤵
  PID:448
- C:\Windows\System\MukwpuY.exe
  C:\Windows\System\MukwpuY.exe
  2⤵
  PID:4152
- C:\Windows\System\rQnxqjm.exe
  C:\Windows\System\rQnxqjm.exe
  2⤵
  PID:5048
- C:\Windows\System\lSxNWnE.exe
  C:\Windows\System\lSxNWnE.exe
  2⤵
  PID:4912
- C:\Windows\System\JMNapzw.exe
  C:\Windows\System\JMNapzw.exe
  2⤵
  PID:5084
- C:\Windows\System\zOvrDrJ.exe
  C:\Windows\System\zOvrDrJ.exe
  2⤵
  PID:4660
- C:\Windows\System\vJYEcBl.exe
  C:\Windows\System\vJYEcBl.exe
  2⤵
  PID:1780
- C:\Windows\System\jaFcZrf.exe
  C:\Windows\System\jaFcZrf.exe
  2⤵
  PID:5160
- C:\Windows\System\BNwtDzX.exe
  C:\Windows\System\BNwtDzX.exe
  2⤵
  PID:5196
- C:\Windows\System\kktilpC.exe
  C:\Windows\System\kktilpC.exe
  2⤵
  PID:5216
- C:\Windows\System\wtFuspw.exe
  C:\Windows\System\wtFuspw.exe
  2⤵
  PID:5232
- C:\Windows\System\oiahEsD.exe
  C:\Windows\System\oiahEsD.exe
  2⤵
  PID:5248
- C:\Windows\System\IsRdiwu.exe
  C:\Windows\System\IsRdiwu.exe
  2⤵
  PID:5264
- C:\Windows\System\sirtylv.exe
  C:\Windows\System\sirtylv.exe
  2⤵
  PID:5280
- C:\Windows\System\TZssjTO.exe
  C:\Windows\System\TZssjTO.exe
  2⤵
  PID:5296
- C:\Windows\System\VknJFUY.exe
  C:\Windows\System\VknJFUY.exe
  2⤵
  PID:5312
- C:\Windows\System\TsAuIrE.exe
  C:\Windows\System\TsAuIrE.exe
  2⤵
  PID:5328
- C:\Windows\System\rnIhPnW.exe
  C:\Windows\System\rnIhPnW.exe
  2⤵
  PID:5348
- C:\Windows\System\jWimnrH.exe
  C:\Windows\System\jWimnrH.exe
  2⤵
  PID:5364
- C:\Windows\System\PiqSAug.exe
  C:\Windows\System\PiqSAug.exe
  2⤵
  PID:5380
- C:\Windows\System\OcoAAwR.exe
  C:\Windows\System\OcoAAwR.exe
  2⤵
  PID:5396
- C:\Windows\System\TKjvhwx.exe
  C:\Windows\System\TKjvhwx.exe
  2⤵
  PID:5412
- C:\Windows\System\JuXMdly.exe
  C:\Windows\System\JuXMdly.exe
  2⤵
  PID:5432
- C:\Windows\System\bhsosXH.exe
  C:\Windows\System\bhsosXH.exe
  2⤵
  PID:5448
- C:\Windows\System\nTtyEll.exe
  C:\Windows\System\nTtyEll.exe
  2⤵
  PID:5464
- C:\Windows\System\vpzAvuz.exe
  C:\Windows\System\vpzAvuz.exe
  2⤵
  PID:5480
- C:\Windows\System\UCalkUu.exe
  C:\Windows\System\UCalkUu.exe
  2⤵
  PID:5568
- C:\Windows\System\uBlladO.exe
  C:\Windows\System\uBlladO.exe
  2⤵
  PID:5584
- C:\Windows\System\qubNVNa.exe
  C:\Windows\System\qubNVNa.exe
  2⤵
  PID:5600
- C:\Windows\System\xqGjisW.exe
  C:\Windows\System\xqGjisW.exe
  2⤵
  PID:5616
- C:\Windows\System\QoWLWzl.exe
  C:\Windows\System\QoWLWzl.exe
  2⤵
  PID:5632
- C:\Windows\System\jHRkrCb.exe
  C:\Windows\System\jHRkrCb.exe
  2⤵
  PID:5648
- C:\Windows\System\ZxHoQjY.exe
  C:\Windows\System\ZxHoQjY.exe
  2⤵
  PID:5664
- C:\Windows\System\vKcVsEI.exe
  C:\Windows\System\vKcVsEI.exe
  2⤵
  PID:5680
- C:\Windows\System\pyEkXig.exe
  C:\Windows\System\pyEkXig.exe
  2⤵
  PID:5696
- C:\Windows\System\UdBZHlU.exe
  C:\Windows\System\UdBZHlU.exe
  2⤵
  PID:5712
- C:\Windows\System\vEWDHzp.exe
  C:\Windows\System\vEWDHzp.exe
  2⤵
  PID:5732
- C:\Windows\System\hRrFsrE.exe
  C:\Windows\System\hRrFsrE.exe
  2⤵
  PID:5748
- C:\Windows\System\rDxfssa.exe
  C:\Windows\System\rDxfssa.exe
  2⤵
  PID:5764
- C:\Windows\System\REKdTBg.exe
  C:\Windows\System\REKdTBg.exe
  2⤵
  PID:5784
- C:\Windows\System\zNTAIYd.exe
  C:\Windows\System\zNTAIYd.exe
  2⤵
  PID:5828
- C:\Windows\System\JhOzyrc.exe
  C:\Windows\System\JhOzyrc.exe
  2⤵
  PID:5844
- C:\Windows\System\JLbLJaS.exe
  C:\Windows\System\JLbLJaS.exe
  2⤵
  PID:5860
- C:\Windows\System\NbVZmEg.exe
  C:\Windows\System\NbVZmEg.exe
  2⤵
  PID:5876
- C:\Windows\System\eMXwcXR.exe
  C:\Windows\System\eMXwcXR.exe
  2⤵
  PID:5896
- C:\Windows\System\AXAJHmj.exe
  C:\Windows\System\AXAJHmj.exe
  2⤵
  PID:5912
- C:\Windows\System\ZhIWKEA.exe
  C:\Windows\System\ZhIWKEA.exe
  2⤵
  PID:5928
- C:\Windows\System\oHLdfgL.exe
  C:\Windows\System\oHLdfgL.exe
  2⤵
  PID:5944
- C:\Windows\System\ClnfrKl.exe
  C:\Windows\System\ClnfrKl.exe
  2⤵
  PID:6000
- C:\Windows\System\mWUukWA.exe
  C:\Windows\System\mWUukWA.exe
  2⤵
  PID:6016
- C:\Windows\System\Gipyoct.exe
  C:\Windows\System\Gipyoct.exe
  2⤵
  PID:6032
- C:\Windows\System\nTLEGdj.exe
  C:\Windows\System\nTLEGdj.exe
  2⤵
  PID:6048
- C:\Windows\System\JupUbtF.exe
  C:\Windows\System\JupUbtF.exe
  2⤵
  PID:6064
- C:\Windows\System\CvWSXFQ.exe
  C:\Windows\System\CvWSXFQ.exe
  2⤵
  PID:6080
- C:\Windows\System\BLUeuXW.exe
  C:\Windows\System\BLUeuXW.exe
  2⤵
  PID:6096
- C:\Windows\System\rDFAKwG.exe
  C:\Windows\System\rDFAKwG.exe
  2⤵
  PID:6112
- C:\Windows\System\VjSbZIv.exe
  C:\Windows\System\VjSbZIv.exe
  2⤵
  PID:6132
- C:\Windows\System\ewqlnZp.exe
  C:\Windows\System\ewqlnZp.exe
  2⤵
  PID:4148
- C:\Windows\System\OkiKHQJ.exe
  C:\Windows\System\OkiKHQJ.exe
  2⤵
  PID:4236
- C:\Windows\System\rxunJsl.exe
  C:\Windows\System\rxunJsl.exe
  2⤵
  PID:4732
- C:\Windows\System\ZlNPUKP.exe
  C:\Windows\System\ZlNPUKP.exe
  2⤵
  PID:4344
- C:\Windows\System\pORGTTq.exe
  C:\Windows\System\pORGTTq.exe
  2⤵
  PID:5128
- C:\Windows\System\xPltAnP.exe
  C:\Windows\System\xPltAnP.exe
  2⤵
  PID:5156
- C:\Windows\System\DufAStv.exe
  C:\Windows\System\DufAStv.exe
  2⤵
  PID:5180
- C:\Windows\System\KpxrSVW.exe
  C:\Windows\System\KpxrSVW.exe
  2⤵
  PID:5224
- C:\Windows\System\tXbhAEr.exe
  C:\Windows\System\tXbhAEr.exe
  2⤵
  PID:5212
- C:\Windows\System\GhjOqsJ.exe
  C:\Windows\System\GhjOqsJ.exe
  2⤵
  PID:5260
- C:\Windows\System\yUHSjxH.exe
  C:\Windows\System\yUHSjxH.exe
  2⤵
  PID:5324
- C:\Windows\System\iJnZWvS.exe
  C:\Windows\System\iJnZWvS.exe
  2⤵
  PID:5420
- C:\Windows\System\jzKkmdL.exe
  C:\Windows\System\jzKkmdL.exe
  2⤵
  PID:5460
- C:\Windows\System\QgzbfEN.exe
  C:\Windows\System\QgzbfEN.exe
  2⤵
  PID:5504
- C:\Windows\System\ECFopiH.exe
  C:\Windows\System\ECFopiH.exe
  2⤵
  PID:5520
- C:\Windows\System\skBCUhb.exe
  C:\Windows\System\skBCUhb.exe
  2⤵
  PID:5532
- C:\Windows\System\dtKeIvd.exe
  C:\Windows\System\dtKeIvd.exe
  2⤵
  PID:5576
- C:\Windows\System\BePdjWq.exe
  C:\Windows\System\BePdjWq.exe
  2⤵
  PID:5624
- C:\Windows\System\ZckRJeA.exe
  C:\Windows\System\ZckRJeA.exe
  2⤵
  PID:5720
- C:\Windows\System\cQQmXOU.exe
  C:\Windows\System\cQQmXOU.exe
  2⤵
  PID:5756
- C:\Windows\System\vdRisKd.exe
  C:\Windows\System\vdRisKd.exe
  2⤵
  PID:5644
- C:\Windows\System\xAzqQGf.exe
  C:\Windows\System\xAzqQGf.exe
  2⤵
  PID:5708
- C:\Windows\System\uHaktEF.exe
  C:\Windows\System\uHaktEF.exe
  2⤵
  PID:5776
- C:\Windows\System\UTTXaof.exe
  C:\Windows\System\UTTXaof.exe
  2⤵
  PID:5792
- C:\Windows\System\HLdMqXA.exe
  C:\Windows\System\HLdMqXA.exe
  2⤵
  PID:5804
- C:\Windows\System\BVsPGtA.exe
  C:\Windows\System\BVsPGtA.exe
  2⤵
  PID:5820
- C:\Windows\System\wFcmWvq.exe
  C:\Windows\System\wFcmWvq.exe
  2⤵
  PID:5892
- C:\Windows\System\SuFleHb.exe
  C:\Windows\System\SuFleHb.exe
  2⤵
  PID:5952
- C:\Windows\System\qkScMWV.exe
  C:\Windows\System\qkScMWV.exe
  2⤵
  PID:5972
- C:\Windows\System\oAIcTvx.exe
  C:\Windows\System\oAIcTvx.exe
  2⤵
  PID:5984
- C:\Windows\System\foKxEOi.exe
  C:\Windows\System\foKxEOi.exe
  2⤵
  PID:5868
- C:\Windows\System\FesCIir.exe
  C:\Windows\System\FesCIir.exe
  2⤵
  PID:6060
- C:\Windows\System\iVhhYdE.exe
  C:\Windows\System\iVhhYdE.exe
  2⤵
  PID:6028
- C:\Windows\System\BSgxbeN.exe
  C:\Windows\System\BSgxbeN.exe
  2⤵
  PID:5132
- C:\Windows\System\bwXdEff.exe
  C:\Windows\System\bwXdEff.exe
  2⤵
  PID:5872
- C:\Windows\System\lJgfShB.exe
  C:\Windows\System\lJgfShB.exe
  2⤵
  PID:5936
- C:\Windows\System\iLZXncH.exe
  C:\Windows\System\iLZXncH.exe
  2⤵
  PID:5516
- C:\Windows\System\KnfrrNe.exe
  C:\Windows\System\KnfrrNe.exe
  2⤵
  PID:5408
- C:\Windows\System\EsThMfU.exe
  C:\Windows\System\EsThMfU.exe
  2⤵
  PID:5360
- C:\Windows\System\LUGbsrI.exe
  C:\Windows\System\LUGbsrI.exe
  2⤵
  PID:5544
- C:\Windows\System\rnKXwzr.exe
  C:\Windows\System\rnKXwzr.exe
  2⤵
  PID:5388
- C:\Windows\System\RtjbkiX.exe
  C:\Windows\System\RtjbkiX.exe
  2⤵
  PID:5596
- C:\Windows\System\cmLdnPg.exe
  C:\Windows\System\cmLdnPg.exe
  2⤵
  PID:5704
- C:\Windows\System\OwIiXOM.exe
  C:\Windows\System\OwIiXOM.exe
  2⤵
  PID:5272
- C:\Windows\System\dbdMhNa.exe
  C:\Windows\System\dbdMhNa.exe
  2⤵
  PID:5852
- C:\Windows\System\vKfXgdW.exe
  C:\Windows\System\vKfXgdW.exe
  2⤵
  PID:6120
- C:\Windows\System\jaFndrY.exe
  C:\Windows\System\jaFndrY.exe
  2⤵
  PID:5336
- C:\Windows\System\psycQWz.exe
  C:\Windows\System\psycQWz.exe
  2⤵
  PID:5376
- C:\Windows\System\fFcDcMl.exe
  C:\Windows\System\fFcDcMl.exe
  2⤵
  PID:5640
- C:\Windows\System\ZMWGMbq.exe
  C:\Windows\System\ZMWGMbq.exe
  2⤵
  PID:5564
- C:\Windows\System\ZCCPYHI.exe
  C:\Windows\System\ZCCPYHI.exe
  2⤵
  PID:5744
- C:\Windows\System\CEIuSTO.exe
  C:\Windows\System\CEIuSTO.exe
  2⤵
  PID:5884
- C:\Windows\System\dSUDZzL.exe
  C:\Windows\System\dSUDZzL.exe
  2⤵
  PID:5920
- C:\Windows\System\UuPnlOW.exe
  C:\Windows\System\UuPnlOW.exe
  2⤵
  PID:6024
- C:\Windows\System\HsDUnxj.exe
  C:\Windows\System\HsDUnxj.exe
  2⤵
  PID:1856
- C:\Windows\System\jdUucqs.exe
  C:\Windows\System\jdUucqs.exe
  2⤵
  PID:6076
- C:\Windows\System\eOgCbcW.exe
  C:\Windows\System\eOgCbcW.exe
  2⤵
  PID:4340
- C:\Windows\System\MOvJJwj.exe
  C:\Windows\System\MOvJJwj.exe
  2⤵
  PID:6040
- C:\Windows\System\LlVnvpO.exe
  C:\Windows\System\LlVnvpO.exe
  2⤵
  PID:4256
- C:\Windows\System\vqyZsLE.exe
  C:\Windows\System\vqyZsLE.exe
  2⤵
  PID:5176
- C:\Windows\System\JjDFkTN.exe
  C:\Windows\System\JjDFkTN.exe
  2⤵
  PID:5488
- C:\Windows\System\QpIfJNQ.exe
  C:\Windows\System\QpIfJNQ.exe
  2⤵
  PID:6148
- C:\Windows\System\QnXzguS.exe
  C:\Windows\System\QnXzguS.exe
  2⤵
  PID:6164
- C:\Windows\System\RGmXdLr.exe
  C:\Windows\System\RGmXdLr.exe
  2⤵
  PID:6184
- C:\Windows\System\ufgBzoH.exe
  C:\Windows\System\ufgBzoH.exe
  2⤵
  PID:6204
- C:\Windows\System\mABVGzu.exe
  C:\Windows\System\mABVGzu.exe
  2⤵
  PID:6220
- C:\Windows\System\ABSQcjC.exe
  C:\Windows\System\ABSQcjC.exe
  2⤵
  PID:6236
- C:\Windows\System\sUozhnq.exe
  C:\Windows\System\sUozhnq.exe
  2⤵
  PID:6252
- C:\Windows\System\hPabIwN.exe
  C:\Windows\System\hPabIwN.exe
  2⤵
  PID:6272
- C:\Windows\System\gUWBbsp.exe
  C:\Windows\System\gUWBbsp.exe
  2⤵
  PID:6288
- C:\Windows\System\PSvcTPe.exe
  C:\Windows\System\PSvcTPe.exe
  2⤵
  PID:6304
- C:\Windows\System\NdTxIzn.exe
  C:\Windows\System\NdTxIzn.exe
  2⤵
  PID:6324
- C:\Windows\System\qcHsJxa.exe
  C:\Windows\System\qcHsJxa.exe
  2⤵
  PID:6340
- C:\Windows\System\OhJndjQ.exe
  C:\Windows\System\OhJndjQ.exe
  2⤵
  PID:6356
- C:\Windows\System\sUyxvLY.exe
  C:\Windows\System\sUyxvLY.exe
  2⤵
  PID:6372
- C:\Windows\System\zAFmJeX.exe
  C:\Windows\System\zAFmJeX.exe
  2⤵
  PID:6388
- C:\Windows\System\gKUxFFh.exe
  C:\Windows\System\gKUxFFh.exe
  2⤵
  PID:6408
- C:\Windows\System\gjzgTLg.exe
  C:\Windows\System\gjzgTLg.exe
  2⤵
  PID:6424
- C:\Windows\System\TijtxeU.exe
  C:\Windows\System\TijtxeU.exe
  2⤵
  PID:6440
- C:\Windows\System\pOtTMsf.exe
  C:\Windows\System\pOtTMsf.exe
  2⤵
  PID:6460
- C:\Windows\System\xofVIQv.exe
  C:\Windows\System\xofVIQv.exe
  2⤵
  PID:6476
- C:\Windows\System\APMjZNa.exe
  C:\Windows\System\APMjZNa.exe
  2⤵
  PID:6492
- C:\Windows\System\BEzXvuM.exe
  C:\Windows\System\BEzXvuM.exe
  2⤵
  PID:6512
- C:\Windows\System\gNvgFvf.exe
  C:\Windows\System\gNvgFvf.exe
  2⤵
  PID:6544
- C:\Windows\System\zoaDKNY.exe
  C:\Windows\System\zoaDKNY.exe
  2⤵
  PID:6564
- C:\Windows\System\jQNumVr.exe
  C:\Windows\System\jQNumVr.exe
  2⤵
  PID:6584
- C:\Windows\System\IUrMEpn.exe
  C:\Windows\System\IUrMEpn.exe
  2⤵
  PID:6600
- C:\Windows\System\WlsAIjz.exe
  C:\Windows\System\WlsAIjz.exe
  2⤵
  PID:6616
- C:\Windows\System\aogsiyd.exe
  C:\Windows\System\aogsiyd.exe
  2⤵
  PID:6632
- C:\Windows\System\ozFsCwy.exe
  C:\Windows\System\ozFsCwy.exe
  2⤵
  PID:6648
- C:\Windows\System\WxSgBLj.exe
  C:\Windows\System\WxSgBLj.exe
  2⤵
  PID:6664
- C:\Windows\System\jtKNVxf.exe
  C:\Windows\System\jtKNVxf.exe
  2⤵
  PID:6680
- C:\Windows\System\XOaZinH.exe
  C:\Windows\System\XOaZinH.exe
  2⤵
  PID:6696
- C:\Windows\System\MzKyTre.exe
  C:\Windows\System\MzKyTre.exe
  2⤵
  PID:6712
- C:\Windows\System\dpPRMzW.exe
  C:\Windows\System\dpPRMzW.exe
  2⤵
  PID:6728
- C:\Windows\System\UdCOvBZ.exe
  C:\Windows\System\UdCOvBZ.exe
  2⤵
  PID:6744
- C:\Windows\System\cCgNADD.exe
  C:\Windows\System\cCgNADD.exe
  2⤵
  PID:6760
- C:\Windows\System\MNowGuA.exe
  C:\Windows\System\MNowGuA.exe
  2⤵
  PID:6780
- C:\Windows\System\QpvPbfn.exe
  C:\Windows\System\QpvPbfn.exe
  2⤵
  PID:6796
- C:\Windows\System\ceWDkDo.exe
  C:\Windows\System\ceWDkDo.exe
  2⤵
  PID:6812
- C:\Windows\System\pGAYTKc.exe
  C:\Windows\System\pGAYTKc.exe
  2⤵
  PID:6828
- C:\Windows\System\wPxGhqN.exe
  C:\Windows\System\wPxGhqN.exe
  2⤵
  PID:6844
- C:\Windows\System\OkQVwmC.exe
  C:\Windows\System\OkQVwmC.exe
  2⤵
  PID:6860
- C:\Windows\System\fpIPQHZ.exe
  C:\Windows\System\fpIPQHZ.exe
  2⤵
  PID:6880
- C:\Windows\System\UWYDKyc.exe
  C:\Windows\System\UWYDKyc.exe
  2⤵
  PID:6896
- C:\Windows\System\ySBqhDi.exe
  C:\Windows\System\ySBqhDi.exe
  2⤵
  PID:6912
- C:\Windows\System\ftSTlsy.exe
  C:\Windows\System\ftSTlsy.exe
  2⤵
  PID:6928
- C:\Windows\System\lRneFVC.exe
  C:\Windows\System\lRneFVC.exe
  2⤵
  PID:6944
- C:\Windows\System\nsDzCzo.exe
  C:\Windows\System\nsDzCzo.exe
  2⤵
  PID:6960
- C:\Windows\System\TGJppts.exe
  C:\Windows\System\TGJppts.exe
  2⤵
  PID:6976
- C:\Windows\System\KvnWHKd.exe
  C:\Windows\System\KvnWHKd.exe
  2⤵
  PID:6992
- C:\Windows\System\xynREKW.exe
  C:\Windows\System\xynREKW.exe
  2⤵
  PID:7008
- C:\Windows\System\eKBZMxY.exe
  C:\Windows\System\eKBZMxY.exe
  2⤵
  PID:7024
- C:\Windows\System\KMkNJCI.exe
  C:\Windows\System\KMkNJCI.exe
  2⤵
  PID:7040
- C:\Windows\System\dyDSzhP.exe
  C:\Windows\System\dyDSzhP.exe
  2⤵
  PID:7060
- C:\Windows\System\uiReFBx.exe
  C:\Windows\System\uiReFBx.exe
  2⤵
  PID:7076
- C:\Windows\System\gMqoaSh.exe
  C:\Windows\System\gMqoaSh.exe
  2⤵
  PID:7092
- C:\Windows\System\YJevasb.exe
  C:\Windows\System\YJevasb.exe
  2⤵
  PID:7108
- C:\Windows\System\MtuzyKP.exe
  C:\Windows\System\MtuzyKP.exe
  2⤵
  PID:7124
- C:\Windows\System\LZBuHvQ.exe
  C:\Windows\System\LZBuHvQ.exe
  2⤵
  PID:7140
- C:\Windows\System\JwBbIoG.exe
  C:\Windows\System\JwBbIoG.exe
  2⤵
  PID:7156
- C:\Windows\System\RKDADpG.exe
  C:\Windows\System\RKDADpG.exe
  2⤵
  PID:5256
- C:\Windows\System\efjshNs.exe
  C:\Windows\System\efjshNs.exe
  2⤵
  PID:5816
- C:\Windows\System\mvYrKFF.exe
  C:\Windows\System\mvYrKFF.exe
  2⤵
  PID:5372
- C:\Windows\System\HenIAhf.exe
  C:\Windows\System\HenIAhf.exe
  2⤵
  PID:5796
- C:\Windows\System\zkMbeXw.exe
  C:\Windows\System\zkMbeXw.exe
  2⤵
  PID:2528
- C:\Windows\System\fyHxBlC.exe
  C:\Windows\System\fyHxBlC.exe
  2⤵
  PID:4316
- C:\Windows\System\DZFjouM.exe
  C:\Windows\System\DZFjouM.exe
  2⤵
  PID:6160
- C:\Windows\System\CmvwFJA.exe
  C:\Windows\System\CmvwFJA.exe
  2⤵
  PID:6232
- C:\Windows\System\gPvNpbg.exe
  C:\Windows\System\gPvNpbg.exe
  2⤵
  PID:6300
- C:\Windows\System\NTcjxdy.exe
  C:\Windows\System\NTcjxdy.exe
  2⤵
  PID:6368
- C:\Windows\System\OJoEEYU.exe
  C:\Windows\System\OJoEEYU.exe
  2⤵
  PID:6436
- C:\Windows\System\qaKLtmA.exe
  C:\Windows\System\qaKLtmA.exe
  2⤵
  PID:6500
- C:\Windows\System\MDkTlpW.exe
  C:\Windows\System\MDkTlpW.exe
  2⤵
  PID:6104
- C:\Windows\System\siWwzGv.exe
  C:\Windows\System\siWwzGv.exe
  2⤵
  PID:5304
- C:\Windows\System\NgsOWCM.exe
  C:\Windows\System\NgsOWCM.exe
  2⤵
  PID:5812
- C:\Windows\System\mvMRTOa.exe
  C:\Windows\System\mvMRTOa.exe
  2⤵
  PID:6628
- C:\Windows\System\MwrgYXX.exe
  C:\Windows\System\MwrgYXX.exe
  2⤵
  PID:6456
- C:\Windows\System\xNtDwjr.exe
  C:\Windows\System\xNtDwjr.exe
  2⤵
  PID:6524
- C:\Windows\System\LEYRqUe.exe
  C:\Windows\System\LEYRqUe.exe
  2⤵
  PID:6540
- C:\Windows\System\jtRuLCo.exe
  C:\Windows\System\jtRuLCo.exe
  2⤵
  PID:6612
- C:\Windows\System\gkQOysZ.exe
  C:\Windows\System\gkQOysZ.exe
  2⤵
  PID:6676
- C:\Windows\System\bBIikMx.exe
  C:\Windows\System\bBIikMx.exe
  2⤵
  PID:6384
- C:\Windows\System\oTAUwxM.exe
  C:\Windows\System\oTAUwxM.exe
  2⤵
  PID:6772
- C:\Windows\System\dguGvYn.exe
  C:\Windows\System\dguGvYn.exe
  2⤵
  PID:6808
- C:\Windows\System\wvvyCIm.exe
  C:\Windows\System\wvvyCIm.exe
  2⤵
  PID:6656
- C:\Windows\System\kIHIfOe.exe
  C:\Windows\System\kIHIfOe.exe
  2⤵
  PID:6720
- C:\Windows\System\TDjFGjy.exe
  C:\Windows\System\TDjFGjy.exe
  2⤵
  PID:6940
- C:\Windows\System\tWVljoI.exe
  C:\Windows\System\tWVljoI.exe
  2⤵
  PID:7004
- C:\Windows\System\wFBUaqh.exe
  C:\Windows\System\wFBUaqh.exe
  2⤵
  PID:6956
- C:\Windows\System\bIbjrcO.exe
  C:\Windows\System\bIbjrcO.exe
  2⤵
  PID:7056
- C:\Windows\System\SaHWuyb.exe
  C:\Windows\System\SaHWuyb.exe
  2⤵
  PID:7016
- C:\Windows\System\ZazjAIt.exe
  C:\Windows\System\ZazjAIt.exe
  2⤵
  PID:7164
- C:\Windows\System\dLlJEIh.exe
  C:\Windows\System\dLlJEIh.exe
  2⤵
  PID:7152
- C:\Windows\System\LSsIbDq.exe
  C:\Windows\System\LSsIbDq.exe
  2⤵
  PID:5344
- C:\Windows\System\PhUbOTa.exe
  C:\Windows\System\PhUbOTa.exe
  2⤵
  PID:5980
- C:\Windows\System\FyqSMgt.exe
  C:\Windows\System\FyqSMgt.exe
  2⤵
  PID:6432
- C:\Windows\System\TLlKlve.exe
  C:\Windows\System\TLlKlve.exe
  2⤵
  PID:4296
- C:\Windows\System\tKPSvBm.exe
  C:\Windows\System\tKPSvBm.exe
  2⤵
  PID:6336
- C:\Windows\System\dHKGSRY.exe
  C:\Windows\System\dHKGSRY.exe
  2⤵
  PID:5136
- C:\Windows\System\OoXCgUx.exe
  C:\Windows\System\OoXCgUx.exe
  2⤵
  PID:5888
- C:\Windows\System\ZMPwZfg.exe
  C:\Windows\System\ZMPwZfg.exe
  2⤵
  PID:5612
- C:\Windows\System\QriHhPe.exe
  C:\Windows\System\QriHhPe.exe
  2⤵
  PID:6128
- C:\Windows\System\yDkZndt.exe
  C:\Windows\System\yDkZndt.exe
  2⤵
  PID:6552
- C:\Windows\System\xhFEEIq.exe
  C:\Windows\System\xhFEEIq.exe
  2⤵
  PID:6212
- C:\Windows\System\FUYrZfH.exe
  C:\Windows\System\FUYrZfH.exe
  2⤵
  PID:6284
- C:\Windows\System\DXIqgJZ.exe
  C:\Windows\System\DXIqgJZ.exe
  2⤵
  PID:6352
- C:\Windows\System\QusLMBj.exe
  C:\Windows\System\QusLMBj.exe
  2⤵
  PID:6448
- C:\Windows\System\klvVpUI.exe
  C:\Windows\System\klvVpUI.exe
  2⤵
  PID:6532
- C:\Windows\System\cDOluVO.exe
  C:\Windows\System\cDOluVO.exe
  2⤵
  PID:6740
- C:\Windows\System\eAWIJYb.exe
  C:\Windows\System\eAWIJYb.exe
  2⤵
  PID:6752
- C:\Windows\System\bTOYZbn.exe
  C:\Windows\System\bTOYZbn.exe
  2⤵
  PID:6824
- C:\Windows\System\zpXSOOX.exe
  C:\Windows\System\zpXSOOX.exe
  2⤵
  PID:6488
- C:\Windows\System\rTMYkBU.exe
  C:\Windows\System\rTMYkBU.exe
  2⤵
  PID:6708
- C:\Windows\System\XIrpoGz.exe
  C:\Windows\System\XIrpoGz.exe
  2⤵
  PID:6804
- C:\Windows\System\GTDiMvZ.exe
  C:\Windows\System\GTDiMvZ.exe
  2⤵
  PID:6892
- C:\Windows\System\zYQFhxJ.exe
  C:\Windows\System\zYQFhxJ.exe
  2⤵
  PID:6984
- C:\Windows\System\FLlgXOe.exe
  C:\Windows\System\FLlgXOe.exe
  2⤵
  PID:7136
- C:\Windows\System\MPFggWY.exe
  C:\Windows\System\MPFggWY.exe
  2⤵
  PID:6952
- C:\Windows\System\tpMjWjT.exe
  C:\Windows\System\tpMjWjT.exe
  2⤵
  PID:7148
- C:\Windows\System\ZSPlcWf.exe
  C:\Windows\System\ZSPlcWf.exe
  2⤵
  PID:6472
- C:\Windows\System\PIqsNFG.exe
  C:\Windows\System\PIqsNFG.exe
  2⤵
  PID:6508
- C:\Windows\System\GNvDRlQ.exe
  C:\Windows\System\GNvDRlQ.exe
  2⤵
  PID:6280
- C:\Windows\System\fvkpDBl.exe
  C:\Windows\System\fvkpDBl.exe
  2⤵
  PID:5444
- C:\Windows\System\UGyPbIR.exe
  C:\Windows\System\UGyPbIR.exe
  2⤵
  PID:7172
- C:\Windows\System\LgKobUJ.exe
  C:\Windows\System\LgKobUJ.exe
  2⤵
  PID:7188
- C:\Windows\System\cTeXRot.exe
  C:\Windows\System\cTeXRot.exe
  2⤵
  PID:7204
- C:\Windows\System\MqLMiWy.exe
  C:\Windows\System\MqLMiWy.exe
  2⤵
  PID:7220
- C:\Windows\System\ScWLcRB.exe
  C:\Windows\System\ScWLcRB.exe
  2⤵
  PID:7240
- C:\Windows\System\KdZwYtv.exe
  C:\Windows\System\KdZwYtv.exe
  2⤵
  PID:7256
- C:\Windows\System\rQusiNT.exe
  C:\Windows\System\rQusiNT.exe
  2⤵
  PID:7272
- C:\Windows\System\HazPOKW.exe
  C:\Windows\System\HazPOKW.exe
  2⤵
  PID:7516
- C:\Windows\System\qnjodGD.exe
  C:\Windows\System\qnjodGD.exe
  2⤵
  PID:7548
- C:\Windows\System\vNblPUy.exe
  C:\Windows\System\vNblPUy.exe
  2⤵
  PID:7564
- C:\Windows\System\GpCUbeo.exe
  C:\Windows\System\GpCUbeo.exe
  2⤵
  PID:7580
- C:\Windows\System\MrQHNrU.exe
  C:\Windows\System\MrQHNrU.exe
  2⤵
  PID:7596
- C:\Windows\System\pUEDFtE.exe
  C:\Windows\System\pUEDFtE.exe
  2⤵
  PID:7616
- C:\Windows\System\XfHSIAF.exe
  C:\Windows\System\XfHSIAF.exe
  2⤵
  PID:7632
- C:\Windows\System\vZftDGM.exe
  C:\Windows\System\vZftDGM.exe
  2⤵
  PID:7648
- C:\Windows\System\nzUcPaO.exe
  C:\Windows\System\nzUcPaO.exe
  2⤵
  PID:7664
- C:\Windows\System\OvuIktK.exe
  C:\Windows\System\OvuIktK.exe
  2⤵
  PID:7680
- C:\Windows\System\XXmNzfr.exe
  C:\Windows\System\XXmNzfr.exe
  2⤵
  PID:7700
- C:\Windows\System\JmZHaLZ.exe
  C:\Windows\System\JmZHaLZ.exe
  2⤵
  PID:7716
- C:\Windows\System\LBIrQOQ.exe
  C:\Windows\System\LBIrQOQ.exe
  2⤵
  PID:7732
- C:\Windows\System\nXhvlcz.exe
  C:\Windows\System\nXhvlcz.exe
  2⤵
  PID:7752
- C:\Windows\System\ENBfelV.exe
  C:\Windows\System\ENBfelV.exe
  2⤵
  PID:7768
- C:\Windows\System\lnITLan.exe
  C:\Windows\System\lnITLan.exe
  2⤵
  PID:7784
- C:\Windows\System\UAlRMSd.exe
  C:\Windows\System\UAlRMSd.exe
  2⤵
  PID:7800
- C:\Windows\System\MMAWXMC.exe
  C:\Windows\System\MMAWXMC.exe
  2⤵
  PID:7820
- C:\Windows\System\OlxBzNW.exe
  C:\Windows\System\OlxBzNW.exe
  2⤵
  PID:7836
- C:\Windows\System\YmPSFFX.exe
  C:\Windows\System\YmPSFFX.exe
  2⤵
  PID:7852
- C:\Windows\System\mqrQPKT.exe
  C:\Windows\System\mqrQPKT.exe
  2⤵
  PID:7868
- C:\Windows\System\UrXecUQ.exe
  C:\Windows\System\UrXecUQ.exe
  2⤵
  PID:7884
- C:\Windows\System\lbRBvmW.exe
  C:\Windows\System\lbRBvmW.exe
  2⤵
  PID:7904
- C:\Windows\System\BguLafl.exe
  C:\Windows\System\BguLafl.exe
  2⤵
  PID:7920
- C:\Windows\System\zCNwrns.exe
  C:\Windows\System\zCNwrns.exe
  2⤵
  PID:7936
- C:\Windows\System\MtKTIZD.exe
  C:\Windows\System\MtKTIZD.exe
  2⤵
  PID:7952
- C:\Windows\System\sbgnHBF.exe
  C:\Windows\System\sbgnHBF.exe
  2⤵
  PID:7972
- C:\Windows\System\rQTGatU.exe
  C:\Windows\System\rQTGatU.exe
  2⤵
  PID:7988
- C:\Windows\System\barLdTA.exe
  C:\Windows\System\barLdTA.exe
  2⤵
  PID:8004
- C:\Windows\System\dmsMyKT.exe
  C:\Windows\System\dmsMyKT.exe
  2⤵
  PID:8020
- C:\Windows\System\FsoMIdR.exe
  C:\Windows\System\FsoMIdR.exe
  2⤵
  PID:8036
- C:\Windows\System\qmVXOnL.exe
  C:\Windows\System\qmVXOnL.exe
  2⤵
  PID:8052
- C:\Windows\System\TRZepCQ.exe
  C:\Windows\System\TRZepCQ.exe
  2⤵
  PID:7116
- C:\Windows\System\HHvWjYO.exe
  C:\Windows\System\HHvWjYO.exe
  2⤵
  PID:5472
- C:\Windows\System\XuoVbRl.exe
  C:\Windows\System\XuoVbRl.exe
  2⤵
  PID:7180
- C:\Windows\System\NCrRLVP.exe
  C:\Windows\System\NCrRLVP.exe
  2⤵
  PID:7248
- C:\Windows\System\wqSGQSZ.exe
  C:\Windows\System\wqSGQSZ.exe
  2⤵
  PID:7196
- C:\Windows\System\XzMZocM.exe
  C:\Windows\System\XzMZocM.exe
  2⤵
  PID:6404
- C:\Windows\System\hzTOHOz.exe
  C:\Windows\System\hzTOHOz.exe
  2⤵
  PID:5492
- C:\Windows\System\gSaqHmE.exe
  C:\Windows\System\gSaqHmE.exe
  2⤵
  PID:5548
- C:\Windows\System\XynGjoN.exe
  C:\Windows\System\XynGjoN.exe
  2⤵
  PID:6592
- C:\Windows\System\TGHKKVX.exe
  C:\Windows\System\TGHKKVX.exe
  2⤵
  PID:6216
- C:\Windows\System\JfNhuFP.exe
  C:\Windows\System\JfNhuFP.exe
  2⤵
  PID:6856
- C:\Windows\System\wAiXbYu.exe
  C:\Windows\System\wAiXbYu.exe
  2⤵
  PID:7036
- C:\Windows\System\wTyhuAW.exe
  C:\Windows\System\wTyhuAW.exe
  2⤵
  PID:7132
- C:\Windows\System\woShZrz.exe
  C:\Windows\System\woShZrz.exe
  2⤵
  PID:6724
- C:\Windows\System\aeUKFrv.exe
  C:\Windows\System\aeUKFrv.exe
  2⤵
  PID:7228
- C:\Windows\System\eHaElXx.exe
  C:\Windows\System\eHaElXx.exe
  2⤵
  PID:7268
- C:\Windows\System\JHRbEiB.exe
  C:\Windows\System\JHRbEiB.exe
  2⤵
  PID:7296
- C:\Windows\System\xUznkQy.exe
  C:\Windows\System\xUznkQy.exe
  2⤵
  PID:7320
- C:\Windows\System\aWIPMIJ.exe
  C:\Windows\System\aWIPMIJ.exe
  2⤵
  PID:7304
- C:\Windows\System\DNQAGnJ.exe
  C:\Windows\System\DNQAGnJ.exe
  2⤵
  PID:7348
- C:\Windows\System\cRKrVDz.exe
  C:\Windows\System\cRKrVDz.exe
  2⤵
  PID:7340
- C:\Windows\System\jDenVzN.exe
  C:\Windows\System\jDenVzN.exe
  2⤵
  PID:7388
- C:\Windows\System\xpifNxB.exe
  C:\Windows\System\xpifNxB.exe
  2⤵
  PID:7464
- C:\Windows\System\mFvSLxK.exe
  C:\Windows\System\mFvSLxK.exe
  2⤵
  PID:7448
- C:\Windows\System\dZplqQW.exe
  C:\Windows\System\dZplqQW.exe
  2⤵
  PID:7588
- C:\Windows\System\amsEXvG.exe
  C:\Windows\System\amsEXvG.exe
  2⤵
  PID:7724
- C:\Windows\System\iSoPQvk.exe
  C:\Windows\System\iSoPQvk.exe
  2⤵
  PID:7796
- C:\Windows\System\DLhVveY.exe
  C:\Windows\System\DLhVveY.exe
  2⤵
  PID:7832
- C:\Windows\System\ZmmzEiF.exe
  C:\Windows\System\ZmmzEiF.exe
  2⤵
  PID:7896
- C:\Windows\System\ThzLziA.exe
  C:\Windows\System\ThzLziA.exe
  2⤵
  PID:7968
- C:\Windows\System\ACznVFF.exe
  C:\Windows\System\ACznVFF.exe
  2⤵
  PID:8072
- C:\Windows\System\RKXzDjk.exe
  C:\Windows\System\RKXzDjk.exe
  2⤵
  PID:7532
- C:\Windows\System\UXjLFYI.exe
  C:\Windows\System\UXjLFYI.exe
  2⤵
  PID:7572
- C:\Windows\System\dYfjimd.exe
  C:\Windows\System\dYfjimd.exe
  2⤵
  PID:7612
- C:\Windows\System\ROmepvt.exe
  C:\Windows\System\ROmepvt.exe
  2⤵
  PID:7676
- C:\Windows\System\lNprjKx.exe
  C:\Windows\System\lNprjKx.exe
  2⤵
  PID:7744
- C:\Windows\System\qyBJXyf.exe
  C:\Windows\System\qyBJXyf.exe
  2⤵
  PID:7808
- C:\Windows\System\eqdkMVN.exe
  C:\Windows\System\eqdkMVN.exe
  2⤵
  PID:7876
- C:\Windows\System\VUPAwfH.exe
  C:\Windows\System\VUPAwfH.exe
  2⤵
  PID:7944
- C:\Windows\System\XXKGOUK.exe
  C:\Windows\System\XXKGOUK.exe
  2⤵
  PID:8012
- C:\Windows\System\jECWUns.exe
  C:\Windows\System\jECWUns.exe
  2⤵
  PID:8016
- C:\Windows\System\BMcFNsE.exe
  C:\Windows\System\BMcFNsE.exe
  2⤵
  PID:8088
- C:\Windows\System\oQNnxRU.exe
  C:\Windows\System\oQNnxRU.exe
  2⤵
  PID:8096
- C:\Windows\System\ldWwKum.exe
  C:\Windows\System\ldWwKum.exe
  2⤵
  PID:8112
- C:\Windows\System\XjQmsad.exe
  C:\Windows\System\XjQmsad.exe
  2⤵
  PID:8128
- C:\Windows\System\aUfkevL.exe
  C:\Windows\System\aUfkevL.exe
  2⤵
  PID:8172
- C:\Windows\System\bUPubFj.exe
  C:\Windows\System\bUPubFj.exe
  2⤵
  PID:8184
- C:\Windows\System\ZQaYxip.exe
  C:\Windows\System\ZQaYxip.exe
  2⤵
  PID:6988
- C:\Windows\System\VXFqXJs.exe
  C:\Windows\System\VXFqXJs.exe
  2⤵
  PID:6092
- C:\Windows\System\YeczsDc.exe
  C:\Windows\System\YeczsDc.exe
  2⤵
  PID:6320
- C:\Windows\System\tTFFAXH.exe
  C:\Windows\System\tTFFAXH.exe
  2⤵
  PID:6228
- C:\Windows\System\eZwXUHS.exe
  C:\Windows\System\eZwXUHS.exe
  2⤵
  PID:7284
- C:\Windows\System\ljhlHwT.exe
  C:\Windows\System\ljhlHwT.exe
  2⤵
  PID:7032
- C:\Windows\System\psYsFmN.exe
  C:\Windows\System\psYsFmN.exe
  2⤵
  PID:7360
- C:\Windows\System\ZSxveGq.exe
  C:\Windows\System\ZSxveGq.exe
  2⤵
  PID:7440
- C:\Windows\System\PvTaAwp.exe
  C:\Windows\System\PvTaAwp.exe
  2⤵
  PID:6248
- C:\Windows\System\uVWGIMW.exe
  C:\Windows\System\uVWGIMW.exe
  2⤵
  PID:7328
- C:\Windows\System\vyCiJRj.exe
  C:\Windows\System\vyCiJRj.exe
  2⤵
  PID:7376
- C:\Windows\System\RrVIdrl.exe
  C:\Windows\System\RrVIdrl.exe
  2⤵
  PID:7476
- C:\Windows\System\XDbyCjk.exe
  C:\Windows\System\XDbyCjk.exe
  2⤵
  PID:7484
- C:\Windows\System\ytjJWCs.exe
  C:\Windows\System\ytjJWCs.exe
  2⤵
  PID:7472
- C:\Windows\System\PpBVMpT.exe
  C:\Windows\System\PpBVMpT.exe
  2⤵
  PID:7400
- C:\Windows\System\TyQpZfy.exe
  C:\Windows\System\TyQpZfy.exe
  2⤵
  PID:7372
- C:\Windows\System\lxaghPd.exe
  C:\Windows\System\lxaghPd.exe
  2⤵
  PID:7696
- C:\Windows\System\HNqKfQQ.exe
  C:\Windows\System\HNqKfQQ.exe
  2⤵
  PID:7624
- C:\Windows\System\YnQYvIh.exe
  C:\Windows\System\YnQYvIh.exe
  2⤵
  PID:7792
- C:\Windows\System\jSANBcS.exe
  C:\Windows\System\jSANBcS.exe
  2⤵
  PID:7964
- C:\Windows\System\AeIlwPP.exe
  C:\Windows\System\AeIlwPP.exe
  2⤵
  PID:7640
- C:\Windows\System\ydCMLCv.exe
  C:\Windows\System\ydCMLCv.exe
  2⤵
  PID:7912
- C:\Windows\System\HUTJvNn.exe
  C:\Windows\System\HUTJvNn.exe
  2⤵
  PID:8092
- C:\Windows\System\yuzniYj.exe
  C:\Windows\System\yuzniYj.exe
  2⤵
  PID:8108
- C:\Windows\System\onvzDoc.exe
  C:\Windows\System\onvzDoc.exe
  2⤵
  PID:7604
- C:\Windows\System\TRBiCkr.exe
  C:\Windows\System\TRBiCkr.exe
  2⤵
  PID:7816
- C:\Windows\System\LrQMZNA.exe
  C:\Windows\System\LrQMZNA.exe
  2⤵
  PID:8044
- C:\Windows\System\OWukCRI.exe
  C:\Windows\System\OWukCRI.exe
  2⤵
  PID:8152
- C:\Windows\System\KmPUWaB.exe
  C:\Windows\System\KmPUWaB.exe
  2⤵
  PID:8168
- C:\Windows\System\GAfzxEQ.exe
  C:\Windows\System\GAfzxEQ.exe
  2⤵
  PID:7428
- C:\Windows\System\rXTcEVk.exe
  C:\Windows\System\rXTcEVk.exe
  2⤵
  PID:6556
- C:\Windows\System\xpginVx.exe
  C:\Windows\System\xpginVx.exe
  2⤵
  PID:6756
- C:\Windows\System\OiHXBpM.exe
  C:\Windows\System\OiHXBpM.exe
  2⤵
  PID:6420
- C:\Windows\System\RqHQvRp.exe
  C:\Windows\System\RqHQvRp.exe
  2⤵
  PID:7104
- C:\Windows\System\yILsEDo.exe
  C:\Windows\System\yILsEDo.exe
  2⤵
  PID:7456
- C:\Windows\System\EDJGtWh.exe
  C:\Windows\System\EDJGtWh.exe
  2⤵
  PID:7408
- C:\Windows\System\aRHlaCj.exe
  C:\Windows\System\aRHlaCj.exe
  2⤵
  PID:7488
- C:\Windows\System\uKKRtvi.exe
  C:\Windows\System\uKKRtvi.exe
  2⤵
  PID:8208
- C:\Windows\System\XPowRhE.exe
  C:\Windows\System\XPowRhE.exe
  2⤵
  PID:8228
- C:\Windows\System\IXrlWFq.exe
  C:\Windows\System\IXrlWFq.exe
  2⤵
  PID:8248
- C:\Windows\System\AvqSVqI.exe
  C:\Windows\System\AvqSVqI.exe
  2⤵
  PID:8264
- C:\Windows\System\heNxRcE.exe
  C:\Windows\System\heNxRcE.exe
  2⤵
  PID:8280
- C:\Windows\System\lDykxsi.exe
  C:\Windows\System\lDykxsi.exe
  2⤵
  PID:8296
- C:\Windows\System\IWBvHoh.exe
  C:\Windows\System\IWBvHoh.exe
  2⤵
  PID:8312
- C:\Windows\System\oNFsLYp.exe
  C:\Windows\System\oNFsLYp.exe
  2⤵
  PID:8328
- C:\Windows\System\ODiQDZe.exe
  C:\Windows\System\ODiQDZe.exe
  2⤵
  PID:8344
- C:\Windows\System\dqAqXsj.exe
  C:\Windows\System\dqAqXsj.exe
  2⤵
  PID:8428
- C:\Windows\System\ShBZise.exe
  C:\Windows\System\ShBZise.exe
  2⤵
  PID:8464
- C:\Windows\System\VyMmHdC.exe
  C:\Windows\System\VyMmHdC.exe
  2⤵
  PID:8480
- C:\Windows\System\LrmXnWW.exe
  C:\Windows\System\LrmXnWW.exe
  2⤵
  PID:8496
- C:\Windows\System\szokhNp.exe
  C:\Windows\System\szokhNp.exe
  2⤵
  PID:8512
- C:\Windows\System\fejKbbN.exe
  C:\Windows\System\fejKbbN.exe
  2⤵
  PID:8528
- C:\Windows\System\JSUAEVo.exe
  C:\Windows\System\JSUAEVo.exe
  2⤵
  PID:8548
- C:\Windows\System\IXbQuzN.exe
  C:\Windows\System\IXbQuzN.exe
  2⤵
  PID:8648
- C:\Windows\System\cupFUWn.exe
  C:\Windows\System\cupFUWn.exe
  2⤵
  PID:8664
- C:\Windows\System\nmjEOdb.exe
  C:\Windows\System\nmjEOdb.exe
  2⤵
  PID:8680
- C:\Windows\System\BIcqtWI.exe
  C:\Windows\System\BIcqtWI.exe
  2⤵
  PID:8696
- C:\Windows\System\UVTEVSL.exe
  C:\Windows\System\UVTEVSL.exe
  2⤵
  PID:8712
- C:\Windows\System\EjuhodU.exe
  C:\Windows\System\EjuhodU.exe
  2⤵
  PID:8728
- C:\Windows\System\XRWQvwy.exe
  C:\Windows\System\XRWQvwy.exe
  2⤵
  PID:8744
- C:\Windows\System\ZybkgAa.exe
  C:\Windows\System\ZybkgAa.exe
  2⤵
  PID:8764
- C:\Windows\System\WehUOik.exe
  C:\Windows\System\WehUOik.exe
  2⤵
  PID:8780
- C:\Windows\System\tBPaDPQ.exe
  C:\Windows\System\tBPaDPQ.exe
  2⤵
  PID:8796
- C:\Windows\System\qANLiVo.exe
  C:\Windows\System\qANLiVo.exe
  2⤵
  PID:8816
- C:\Windows\System\aEHNwjJ.exe
  C:\Windows\System\aEHNwjJ.exe
  2⤵
  PID:8832
- C:\Windows\System\AaPjmpC.exe
  C:\Windows\System\AaPjmpC.exe
  2⤵
  PID:8848
- C:\Windows\System\yKEKkIw.exe
  C:\Windows\System\yKEKkIw.exe
  2⤵
  PID:8872
- C:\Windows\System\HtggBKd.exe
  C:\Windows\System\HtggBKd.exe
  2⤵
  PID:8924
- C:\Windows\System\thKiJsM.exe
  C:\Windows\System\thKiJsM.exe
  2⤵
  PID:8944
- C:\Windows\System\DRyEIdV.exe
  C:\Windows\System\DRyEIdV.exe
  2⤵
  PID:8960
- C:\Windows\System\AXnBJMn.exe
  C:\Windows\System\AXnBJMn.exe
  2⤵
  PID:8976
- C:\Windows\System\lvLYGlE.exe
  C:\Windows\System\lvLYGlE.exe
  2⤵
  PID:8992
- C:\Windows\System\MFrqeVy.exe
  C:\Windows\System\MFrqeVy.exe
  2⤵
  PID:9008
- C:\Windows\System\nriAJHc.exe
  C:\Windows\System\nriAJHc.exe
  2⤵
  PID:9024
- C:\Windows\System\NfbTzRq.exe
  C:\Windows\System\NfbTzRq.exe
  2⤵
  PID:9040
- C:\Windows\System\vtwOreR.exe
  C:\Windows\System\vtwOreR.exe
  2⤵
  PID:9056
- C:\Windows\System\HMXNhkv.exe
  C:\Windows\System\HMXNhkv.exe
  2⤵
  PID:9072
- C:\Windows\System\ZAnlMlj.exe
  C:\Windows\System\ZAnlMlj.exe
  2⤵
  PID:9088
- C:\Windows\System\GfAOZWb.exe
  C:\Windows\System\GfAOZWb.exe
  2⤵
  PID:9104
- C:\Windows\System\ddhMwYh.exe
  C:\Windows\System\ddhMwYh.exe
  2⤵
  PID:9120
- C:\Windows\System\lThFzgj.exe
  C:\Windows\System\lThFzgj.exe
  2⤵
  PID:9140
- C:\Windows\System\ZtueoTl.exe
  C:\Windows\System\ZtueoTl.exe
  2⤵
  PID:9156
- C:\Windows\System\JJZwcuj.exe
  C:\Windows\System\JJZwcuj.exe
  2⤵
  PID:9172
- C:\Windows\System\ZybZqEo.exe
  C:\Windows\System\ZybZqEo.exe
  2⤵
  PID:9192
- C:\Windows\System\ITyYGYq.exe
  C:\Windows\System\ITyYGYq.exe
  2⤵
  PID:9212
- C:\Windows\System\bGKREpk.exe
  C:\Windows\System\bGKREpk.exe
  2⤵
  PID:7780
- C:\Windows\System\oYkKCbf.exe
  C:\Windows\System\oYkKCbf.exe
  2⤵
  PID:7740
- C:\Windows\System\unfWXuk.exe
  C:\Windows\System\unfWXuk.exe
  2⤵
  PID:8116
- C:\Windows\System\wkaEmHp.exe
  C:\Windows\System\wkaEmHp.exe
  2⤵
  PID:6888
- C:\Windows\System\tLJOMlH.exe
  C:\Windows\System\tLJOMlH.exe
  2⤵
  PID:8200
- C:\Windows\System\eCxotMU.exe
  C:\Windows\System\eCxotMU.exe
  2⤵
  PID:8244
- C:\Windows\System\mkHsWDi.exe
  C:\Windows\System\mkHsWDi.exe
  2⤵
  PID:8340
- C:\Windows\System\jxtOOAR.exe
  C:\Windows\System\jxtOOAR.exe
  2⤵
  PID:6692
- C:\Windows\System\zBUMxwZ.exe
  C:\Windows\System\zBUMxwZ.exe
  2⤵
  PID:6468
- C:\Windows\System\IpDMHLZ.exe
  C:\Windows\System\IpDMHLZ.exe
  2⤵
  PID:7848
- C:\Windows\System\IKgVLVx.exe
  C:\Windows\System\IKgVLVx.exe
  2⤵
  PID:8220
- C:\Windows\System\oonehEv.exe
  C:\Windows\System\oonehEv.exe
  2⤵
  PID:7312
- C:\Windows\System\HEuStRD.exe
  C:\Windows\System\HEuStRD.exe
  2⤵
  PID:7416
- C:\Windows\System\uyTmCwS.exe
  C:\Windows\System\uyTmCwS.exe
  2⤵
  PID:7760
- C:\Windows\System\YcyuJtx.exe
  C:\Windows\System\YcyuJtx.exe
  2⤵
  PID:8080
- C:\Windows\System\oZXpMRJ.exe
  C:\Windows\System\oZXpMRJ.exe
  2⤵
  PID:7980
- C:\Windows\System\YkWevmM.exe
  C:\Windows\System\YkWevmM.exe
  2⤵
  PID:7280
- C:\Windows\System\piEypck.exe
  C:\Windows\System\piEypck.exe
  2⤵
  PID:7660
- C:\Windows\System\dWFBefJ.exe
  C:\Windows\System\dWFBefJ.exe
  2⤵
  PID:8256
- C:\Windows\System\TkfeHlT.exe
  C:\Windows\System\TkfeHlT.exe
  2⤵
  PID:8324
- C:\Windows\System\TdQJbZe.exe
  C:\Windows\System\TdQJbZe.exe
  2⤵
  PID:7436
- C:\Windows\System\CZBWYph.exe
  C:\Windows\System\CZBWYph.exe
  2⤵
  PID:8372
- C:\Windows\System\Sqnajme.exe
  C:\Windows\System\Sqnajme.exe
  2⤵
  PID:8400
- C:\Windows\System\SgKFAMu.exe
  C:\Windows\System\SgKFAMu.exe
  2⤵
  PID:8524
- C:\Windows\System\bFuvQPe.exe
  C:\Windows\System\bFuvQPe.exe
  2⤵
  PID:8388
- C:\Windows\System\xhGitjY.exe
  C:\Windows\System\xhGitjY.exe
  2⤵
  PID:8412
- C:\Windows\System\wlgtenx.exe
  C:\Windows\System\wlgtenx.exe
  2⤵
  PID:8536
- C:\Windows\System\uaaRzBp.exe
  C:\Windows\System\uaaRzBp.exe
  2⤵
  PID:8488
- C:\Windows\System\siPbwKu.exe
  C:\Windows\System\siPbwKu.exe
  2⤵
  PID:8588
- C:\Windows\System\yXafdjx.exe
  C:\Windows\System\yXafdjx.exe
  2⤵
  PID:8600
- C:\Windows\System\EWrKEDF.exe
  C:\Windows\System\EWrKEDF.exe
  2⤵
  PID:8616
- C:\Windows\System\wfYMrYe.exe
  C:\Windows\System\wfYMrYe.exe
  2⤵
  PID:8632
- C:\Windows\System\JINSnoF.exe
  C:\Windows\System\JINSnoF.exe
  2⤵
  PID:8672
- C:\Windows\System\YaTezlZ.exe
  C:\Windows\System\YaTezlZ.exe
  2⤵
  PID:8772
- C:\Windows\System\VlwHmGC.exe
  C:\Windows\System\VlwHmGC.exe
  2⤵
  PID:8840
- C:\Windows\System\RcFTcOX.exe
  C:\Windows\System\RcFTcOX.exe
  2⤵
  PID:8808
- C:\Windows\System\jQHqpVL.exe
  C:\Windows\System\jQHqpVL.exe
  2⤵
  PID:8904
- C:\Windows\System\rmKSJif.exe
  C:\Windows\System\rmKSJif.exe
  2⤵
  PID:8884
- C:\Windows\System\vYRmIMc.exe
  C:\Windows\System\vYRmIMc.exe
  2⤵
  PID:9016
- C:\Windows\System\RjVyAlM.exe
  C:\Windows\System\RjVyAlM.exe
  2⤵
  PID:8952
- C:\Windows\System\oKHTlxa.exe
  C:\Windows\System\oKHTlxa.exe
  2⤵
  PID:9148
- C:\Windows\System\HYXrolN.exe
  C:\Windows\System\HYXrolN.exe
  2⤵
  PID:9188
- C:\Windows\System\oZtnfvg.exe
  C:\Windows\System\oZtnfvg.exe
  2⤵
  PID:8100
- C:\Windows\System\QYOiqVc.exe
  C:\Windows\System\QYOiqVc.exe
  2⤵
  PID:7420
- C:\Windows\System\hwwINeO.exe
  C:\Windows\System\hwwINeO.exe
  2⤵
  PID:7000
- C:\Windows\System\BqEYpBX.exe
  C:\Windows\System\BqEYpBX.exe
  2⤵
  PID:7544
- C:\Windows\System\ZRKjhWA.exe
  C:\Windows\System\ZRKjhWA.exe
  2⤵
  PID:8224
- C:\Windows\System\HywPHpZ.exe
  C:\Windows\System\HywPHpZ.exe
  2⤵
  PID:8076
- C:\Windows\System\hrxiqKm.exe
  C:\Windows\System\hrxiqKm.exe
  2⤵
  PID:8472
- C:\Windows\System\sipXJUl.exe
  C:\Windows\System\sipXJUl.exe
  2⤵
  PID:8560
- C:\Windows\System\hwJbNHh.exe
  C:\Windows\System\hwJbNHh.exe
  2⤵
  PID:8608
- C:\Windows\System\SyuGkov.exe
  C:\Windows\System\SyuGkov.exe
  2⤵
  PID:8740
- C:\Windows\System\xBsylnL.exe
  C:\Windows\System\xBsylnL.exe
  2⤵
  PID:8900
- C:\Windows\System\SeRmYTY.exe
  C:\Windows\System\SeRmYTY.exe
  2⤵
  PID:9064
- C:\Windows\System\LWmsEPq.exe
  C:\Windows\System\LWmsEPq.exe
  2⤵
  PID:8792
- C:\Windows\System\CZIZIkt.exe
  C:\Windows\System\CZIZIkt.exe
  2⤵
  PID:8968
- C:\Windows\System\kVoPrSp.exe
  C:\Windows\System\kVoPrSp.exe
  2⤵
  PID:8756
- C:\Windows\System\zwqclEz.exe
  C:\Windows\System\zwqclEz.exe
  2⤵
  PID:9132
- C:\Windows\System\KVyEYwY.exe
  C:\Windows\System\KVyEYwY.exe
  2⤵
  PID:9204
- C:\Windows\System\bQbiRni.exe
  C:\Windows\System\bQbiRni.exe
  2⤵
  PID:8236
- C:\Windows\System\cLRCmXr.exe
  C:\Windows\System\cLRCmXr.exe
  2⤵
  PID:7540
- C:\Windows\System\ZTbmAEf.exe
  C:\Windows\System\ZTbmAEf.exe
  2⤵
  PID:7528
- C:\Windows\System\stsSPVH.exe
  C:\Windows\System\stsSPVH.exe
  2⤵
  PID:8320
- C:\Windows\System\HuAIOsv.exe
  C:\Windows\System\HuAIOsv.exe
  2⤵
  PID:8440
- C:\Windows\System\IIOIejA.exe
  C:\Windows\System\IIOIejA.exe
  2⤵
  PID:8572
- C:\Windows\System\GIDPNyP.exe
  C:\Windows\System\GIDPNyP.exe
  2⤵
  PID:8596
- C:\Windows\System\VFIPajl.exe
  C:\Windows\System\VFIPajl.exe
  2⤵
  PID:8736
- C:\Windows\System\DIldUrq.exe
  C:\Windows\System\DIldUrq.exe
  2⤵
  PID:8908
- C:\Windows\System\tsMiKvX.exe
  C:\Windows\System\tsMiKvX.exe
  2⤵
  PID:8688
- C:\Windows\System\AyqbCGz.exe
  C:\Windows\System\AyqbCGz.exe
  2⤵
  PID:8752
- C:\Windows\System\DBKDZRI.exe
  C:\Windows\System\DBKDZRI.exe
  2⤵
  PID:9084
- C:\Windows\System\hoHggUR.exe
  C:\Windows\System\hoHggUR.exe
  2⤵
  PID:8856
- C:\Windows\System\TMqvTKA.exe
  C:\Windows\System\TMqvTKA.exe
  2⤵
  PID:8864
- C:\Windows\System\CGiEGTe.exe
  C:\Windows\System\CGiEGTe.exe
  2⤵
  PID:9180
- C:\Windows\System\WzKxRZM.exe
  C:\Windows\System\WzKxRZM.exe
  2⤵
  PID:8196
- C:\Windows\System\vZWNpdP.exe
  C:\Windows\System\vZWNpdP.exe
  2⤵
  PID:8276
- C:\Windows\System\zNJnIrU.exe
  C:\Windows\System\zNJnIrU.exe
  2⤵
  PID:8520
- C:\Windows\System\SBkrCoW.exe
  C:\Windows\System\SBkrCoW.exe
  2⤵
  PID:8844
- C:\Windows\System\GwVFNqV.exe
  C:\Windows\System\GwVFNqV.exe
  2⤵
  PID:9200
- C:\Windows\System\SPTMHrg.exe
  C:\Windows\System\SPTMHrg.exe
  2⤵
  PID:9036
- C:\Windows\System\ObjoCQc.exe
  C:\Windows\System\ObjoCQc.exe
  2⤵
  PID:5152
- C:\Windows\System\kMUghBZ.exe
  C:\Windows\System\kMUghBZ.exe
  2⤵
  PID:7500
- C:\Windows\System\TGXmbsL.exe
  C:\Windows\System\TGXmbsL.exe
  2⤵
  PID:8636
- C:\Windows\System\YxjOtIW.exe
  C:\Windows\System\YxjOtIW.exe
  2⤵
  PID:8932
- C:\Windows\System\GROJZcO.exe
  C:\Windows\System\GROJZcO.exe
  2⤵
  PID:5560
- C:\Windows\System\wRVuhWq.exe
  C:\Windows\System\wRVuhWq.exe
  2⤵
  PID:7692
- C:\Windows\System\TxteOtv.exe
  C:\Windows\System\TxteOtv.exe
  2⤵
  PID:8452
- C:\Windows\System\HAzxiPt.exe
  C:\Windows\System\HAzxiPt.exe
  2⤵
  PID:6576
- C:\Windows\System\UUTJOUd.exe
  C:\Windows\System\UUTJOUd.exe
  2⤵
  PID:8988
- C:\Windows\System\jwrxILU.exe
  C:\Windows\System\jwrxILU.exe
  2⤵
  PID:1016
- C:\Windows\System\VesvTsC.exe
  C:\Windows\System\VesvTsC.exe
  2⤵
  PID:8576
- C:\Windows\System\xFUNTWg.exe
  C:\Windows\System\xFUNTWg.exe
  2⤵
  PID:8720
- C:\Windows\System\iMPERHC.exe
  C:\Windows\System\iMPERHC.exe
  2⤵
  PID:9048
- C:\Windows\System\FIgQPEK.exe
  C:\Windows\System\FIgQPEK.exe
  2⤵
  PID:8216
- C:\Windows\System\WlGrRlG.exe
  C:\Windows\System\WlGrRlG.exe
  2⤵
  PID:8956
- C:\Windows\System\XeRVoFC.exe
  C:\Windows\System\XeRVoFC.exe
  2⤵
  PID:9100
- C:\Windows\System\lDcCyUw.exe
  C:\Windows\System\lDcCyUw.exe
  2⤵
  PID:8292
- C:\Windows\System\KJEidJn.exe
  C:\Windows\System\KJEidJn.exe
  2⤵
  PID:7560
- C:\Windows\System\uSBffzY.exe
  C:\Windows\System\uSBffzY.exe
  2⤵
  PID:8660
- C:\Windows\System\CHlsSCO.exe
  C:\Windows\System\CHlsSCO.exe
  2⤵
  PID:8396
- C:\Windows\System\QLtsxGn.exe
  C:\Windows\System\QLtsxGn.exe
  2⤵
  PID:9116
- C:\Windows\System\NDumEaV.exe
  C:\Windows\System\NDumEaV.exe
  2⤵
  PID:7492
- C:\Windows\System\JDTEJOW.exe
  C:\Windows\System\JDTEJOW.exe
  2⤵
  PID:7424
- C:\Windows\System\sdneppM.exe
  C:\Windows\System\sdneppM.exe
  2⤵
  PID:7524
- C:\Windows\System\nAZZWTu.exe
  C:\Windows\System\nAZZWTu.exe
  2⤵
  PID:8416
- C:\Windows\System\mvVRkrj.exe
  C:\Windows\System\mvVRkrj.exe
  2⤵
  PID:9032
- C:\Windows\System\KQkodkW.exe
  C:\Windows\System\KQkodkW.exe
  2⤵
  PID:8892
- C:\Windows\System\ROcfvQd.exe
  C:\Windows\System\ROcfvQd.exe
  2⤵
  PID:8476
- C:\Windows\System\gVIKzAS.exe
  C:\Windows\System\gVIKzAS.exe
  2⤵
  PID:7512
- C:\Windows\System\rryAfds.exe
  C:\Windows\System\rryAfds.exe
  2⤵
  PID:8368
- C:\Windows\System\GwiXdXD.exe
  C:\Windows\System\GwiXdXD.exe
  2⤵
  PID:9232
- C:\Windows\System\tgGajAs.exe
  C:\Windows\System\tgGajAs.exe
  2⤵
  PID:9248
- C:\Windows\System\fbQNDFq.exe
  C:\Windows\System\fbQNDFq.exe
  2⤵
  PID:9264
- C:\Windows\System\uzhBdJM.exe
  C:\Windows\System\uzhBdJM.exe
  2⤵
  PID:9280
- C:\Windows\System\YHDQIIE.exe
  C:\Windows\System\YHDQIIE.exe
  2⤵
  PID:9296
- C:\Windows\System\SafWVkw.exe
  C:\Windows\System\SafWVkw.exe
  2⤵
  PID:9312
- C:\Windows\System\lNlghUu.exe
  C:\Windows\System\lNlghUu.exe
  2⤵
  PID:9328
- C:\Windows\System\XuLHWxZ.exe
  C:\Windows\System\XuLHWxZ.exe
  2⤵
  PID:9344
- C:\Windows\System\wHrNdoo.exe
  C:\Windows\System\wHrNdoo.exe
  2⤵
  PID:9360
- C:\Windows\System\xcykqrV.exe
  C:\Windows\System\xcykqrV.exe
  2⤵
  PID:9376
- C:\Windows\System\GOVIIDh.exe
  C:\Windows\System\GOVIIDh.exe
  2⤵
  PID:9392
- C:\Windows\System\ZVnOhWE.exe
  C:\Windows\System\ZVnOhWE.exe
  2⤵
  PID:9408
- C:\Windows\System\fTcnqjB.exe
  C:\Windows\System\fTcnqjB.exe
  2⤵
  PID:9424
- C:\Windows\System\PwoQSWO.exe
  C:\Windows\System\PwoQSWO.exe
  2⤵
  PID:9440
- C:\Windows\System\htazzFd.exe
  C:\Windows\System\htazzFd.exe
  2⤵
  PID:9456
- C:\Windows\System\pvliNJa.exe
  C:\Windows\System\pvliNJa.exe
  2⤵
  PID:9472
- C:\Windows\System\JEIKEMO.exe
  C:\Windows\System\JEIKEMO.exe
  2⤵
  PID:9488
- C:\Windows\System\ZNfnXvb.exe
  C:\Windows\System\ZNfnXvb.exe
  2⤵
  PID:9504
- C:\Windows\System\ADfptpS.exe
  C:\Windows\System\ADfptpS.exe
  2⤵
  PID:9520
- C:\Windows\System\fCRgASk.exe
  C:\Windows\System\fCRgASk.exe
  2⤵
  PID:9536
- C:\Windows\System\QUmTqSA.exe
  C:\Windows\System\QUmTqSA.exe
  2⤵
  PID:9552
- C:\Windows\System\XDhyOIo.exe
  C:\Windows\System\XDhyOIo.exe
  2⤵
  PID:9568
- C:\Windows\System\PhFvsGr.exe
  C:\Windows\System\PhFvsGr.exe
  2⤵
  PID:9584
- C:\Windows\System\iPMkKoE.exe
  C:\Windows\System\iPMkKoE.exe
  2⤵
  PID:9600
- C:\Windows\System\eGDrwhD.exe
  C:\Windows\System\eGDrwhD.exe
  2⤵
  PID:9616
- C:\Windows\System\KNSnUUP.exe
  C:\Windows\System\KNSnUUP.exe
  2⤵
  PID:9632
- C:\Windows\System\DIgQDIS.exe
  C:\Windows\System\DIgQDIS.exe
  2⤵
  PID:9648
- C:\Windows\System\mWXDsQk.exe
  C:\Windows\System\mWXDsQk.exe
  2⤵
  PID:9664
- C:\Windows\System\UCgbEAK.exe
  C:\Windows\System\UCgbEAK.exe
  2⤵
  PID:9680
- C:\Windows\System\ohsMwuY.exe
  C:\Windows\System\ohsMwuY.exe
  2⤵
  PID:9696
- C:\Windows\System\oGGweqD.exe
  C:\Windows\System\oGGweqD.exe
  2⤵
  PID:9712
- C:\Windows\System\ytSSbwR.exe
  C:\Windows\System\ytSSbwR.exe
  2⤵
  PID:9732
- C:\Windows\System\lzmVlkz.exe
  C:\Windows\System\lzmVlkz.exe
  2⤵
  PID:9748
- C:\Windows\System\ASZgUYD.exe
  C:\Windows\System\ASZgUYD.exe
  2⤵
  PID:9764
- C:\Windows\System\LvcpEpP.exe
  C:\Windows\System\LvcpEpP.exe
  2⤵
  PID:9780
- C:\Windows\System\MRqeMai.exe
  C:\Windows\System\MRqeMai.exe
  2⤵
  PID:9796
- C:\Windows\System\YjempZU.exe
  C:\Windows\System\YjempZU.exe
  2⤵
  PID:9812
- C:\Windows\System\nVdmSRa.exe
  C:\Windows\System\nVdmSRa.exe
  2⤵
  PID:9828
- C:\Windows\System\HPSmHTt.exe
  C:\Windows\System\HPSmHTt.exe
  2⤵
  PID:9844
- C:\Windows\System\dpmVkRi.exe
  C:\Windows\System\dpmVkRi.exe
  2⤵
  PID:9860
- C:\Windows\System\hfhmJpZ.exe
  C:\Windows\System\hfhmJpZ.exe
  2⤵
  PID:9876
- C:\Windows\System\QZVnjOO.exe
  C:\Windows\System\QZVnjOO.exe
  2⤵
  PID:9892
- C:\Windows\System\oIVkSoz.exe
  C:\Windows\System\oIVkSoz.exe
  2⤵
  PID:9908
- C:\Windows\System\iyXJSNS.exe
  C:\Windows\System\iyXJSNS.exe
  2⤵
  PID:9924
- C:\Windows\System\WQQDxhX.exe
  C:\Windows\System\WQQDxhX.exe
  2⤵
  PID:9940
- C:\Windows\System\GSIsKPY.exe
  C:\Windows\System\GSIsKPY.exe
  2⤵
  PID:9956
- C:\Windows\System\lJeUCNa.exe
  C:\Windows\System\lJeUCNa.exe
  2⤵
  PID:9972
- C:\Windows\System\yHDQrBL.exe
  C:\Windows\System\yHDQrBL.exe
  2⤵
  PID:9988
- C:\Windows\System\lSnUxQn.exe
  C:\Windows\System\lSnUxQn.exe
  2⤵
  PID:10004
- C:\Windows\System\umWZaSK.exe
  C:\Windows\System\umWZaSK.exe
  2⤵
  PID:10020
- C:\Windows\System\VqcwbPa.exe
  C:\Windows\System\VqcwbPa.exe
  2⤵
  PID:10036
- C:\Windows\System\dnPkcVO.exe
  C:\Windows\System\dnPkcVO.exe
  2⤵
  PID:10052
- C:\Windows\System\nbLCDmQ.exe
  C:\Windows\System\nbLCDmQ.exe
  2⤵
  PID:10068
- C:\Windows\System\VizeUcj.exe
  C:\Windows\System\VizeUcj.exe
  2⤵
  PID:10084
- C:\Windows\System\SxtGAMc.exe
  C:\Windows\System\SxtGAMc.exe
  2⤵
  PID:10100
- C:\Windows\System\bAyokVC.exe
  C:\Windows\System\bAyokVC.exe
  2⤵
  PID:10116
- C:\Windows\System\hxkiCce.exe
  C:\Windows\System\hxkiCce.exe
  2⤵
  PID:10132
- C:\Windows\System\WJmtDRs.exe
  C:\Windows\System\WJmtDRs.exe
  2⤵
  PID:10148
- C:\Windows\System\RKMNUwi.exe
  C:\Windows\System\RKMNUwi.exe
  2⤵
  PID:10164
- C:\Windows\System\qQhjUbK.exe
  C:\Windows\System\qQhjUbK.exe
  2⤵
  PID:10180
- C:\Windows\System\szpnhZv.exe
  C:\Windows\System\szpnhZv.exe
  2⤵
  PID:10196
- C:\Windows\System\fkRNoQm.exe
  C:\Windows\System\fkRNoQm.exe
  2⤵
  PID:10212
- C:\Windows\System\oZOXgDn.exe
  C:\Windows\System\oZOXgDn.exe
  2⤵
  PID:10228
- C:\Windows\System\dewtfEA.exe
  C:\Windows\System\dewtfEA.exe
  2⤵
  PID:9224
- C:\Windows\System\MTZrIdi.exe
  C:\Windows\System\MTZrIdi.exe
  2⤵
  PID:9288
- C:\Windows\System\ukawRrW.exe
  C:\Windows\System\ukawRrW.exe
  2⤵
  PID:9304
- C:\Windows\System\oMjXBIU.exe
  C:\Windows\System\oMjXBIU.exe
  2⤵
  PID:9308
- C:\Windows\System\uscDQvX.exe
  C:\Windows\System\uscDQvX.exe
  2⤵
  PID:9372
- C:\Windows\System\LGuTCwm.exe
  C:\Windows\System\LGuTCwm.exe
  2⤵
  PID:9356
- C:\Windows\System\PNerKZX.exe
  C:\Windows\System\PNerKZX.exe
  2⤵
  PID:9416
- C:\Windows\System\XlsygGq.exe
  C:\Windows\System\XlsygGq.exe
  2⤵
  PID:9480
- C:\Windows\System\UrarJqw.exe
  C:\Windows\System\UrarJqw.exe
  2⤵
  PID:9464
- C:\Windows\System\HXHzKnH.exe
  C:\Windows\System\HXHzKnH.exe
  2⤵
  PID:9432
- C:\Windows\System\ksUJRJM.exe
  C:\Windows\System\ksUJRJM.exe
  2⤵
  PID:9528
- C:\Windows\System\MVTiTnL.exe
  C:\Windows\System\MVTiTnL.exe
  2⤵
  PID:9576
- C:\Windows\System\RQeAlSK.exe
  C:\Windows\System\RQeAlSK.exe
  2⤵
  PID:9560
- C:\Windows\System\EuTQlaQ.exe
  C:\Windows\System\EuTQlaQ.exe
  2⤵
  PID:9644
- C:\Windows\System\kPDdvWW.exe
  C:\Windows\System\kPDdvWW.exe
  2⤵
  PID:9596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BuaIWNY.exe

Filesize
2.2MB

MD5
d944487f6912785ecab5228b5c5f343b

SHA1
e88c580a3ba35b66b027a98484b8c997c913d4ad

SHA256
ebfa2a397069ba2b15d503c441fd0ed1c9ea9d790473803d41498e54eb73e120

SHA512
3d3f4d9655bd8223cbe1b2231a63dbae2f8798c1a8ffd08e09a405463a19f317866be655cd55b199da779000d93f7c2fde077ac5dce451ea8629501250b85218

Download Submit
C:\Windows\system\CUfnfMz.exe

Filesize
2.2MB

MD5
10258d8991b812ab7b384e2cac4fe092

SHA1
46eed359f5fa950a18742a5cbfba3db5b0b83da0

SHA256
23ba5421b78c0a4ff5f39d282a44af51a8bf03f5f61adeb27dd5cd1e973f866d

SHA512
faaac29040c220c5fc2458d6cc4a9931fc1393c7b778c3a7b2403b083db513310f75ebfa60eb86efa76d2ac4818f90ca45e40886f008a30bd9f4a0f2b8b10e14

Download Submit
C:\Windows\system\ECilaxb.exe

Filesize
2.2MB

MD5
dd73c64ff4005d68aae0eb0bc2f0a2ca

SHA1
06faf6487edf1d8d62ae8f670ab4dd2d85865d60

SHA256
4a0c18dd1e0d22cd89db120576175de3b4f04bf25c74673cbb0a0962f3b66dfc

SHA512
dbd885cff597fb86642c7ce01bc4a2d70a08d68febad146be4a56f5db43b6ddc049cabbdb60049ea7434bcc5efa6b9140c435c18a02577e3fe5e1c497497028c

Download Submit
C:\Windows\system\GadRWuW.exe

Filesize
2.2MB

MD5
2af10e1a8b8dd5f5ca082734afcfd731

SHA1
3c7e99a3376bcecafabe044cf28dad9e493dc9df

SHA256
d98aa6c241d5d8135926b4b7539ff493e9b281dbe603f55f486f45fbcd00bd67

SHA512
47ecfd05663ca76261718658244664d32c2cead2a4cfbdabcfd10964d9b0332d2d854965a00e2c893321af599939bcc0f409491fdee104a5d432c5b743c9aea5

Download Submit
C:\Windows\system\GvjiNWS.exe

Filesize
2.2MB

MD5
1fe9f50af9f3c5de6a874f3d6aba392f

SHA1
f2773b08309ed39f2ff3371cffdb03ddcc1a73c2

SHA256
c23c46a2444b97b8bfdde3f09aad4632d2e7377bfec4516b2f53718085d6bdfc

SHA512
ffdbc52a68b97cdcc2a70c1f71967fd2884aafa3a56947056cfd8124811db296d0ce40ae0e24e66ad44314e3d1ba7771ef4ac80ece64b4f739fb6b77231e5ec8

Download Submit
C:\Windows\system\HWdjArw.exe

Filesize
2.2MB

MD5
e4a74a0a23ad77a509011f6b5269d710

SHA1
e730d29e4bea09ba8c53e719ee71ebf57c2684cd

SHA256
81dcac879805abcba85c1ad83773cd93be7a767ae9e2365ccaab741ee9f9fe4d

SHA512
d2e69f30ce71b40cbffa93615616dd4fbfce00fe280c77b876997210cd10e7194a8f7333461724b44edfba43aff732a67071e41b27c69b9bb8d06a02553d2efd

Download Submit
C:\Windows\system\IDgqqNI.exe

Filesize
2.2MB

MD5
4dd346df486ab3dc679dfb9ca46880e2

SHA1
886a8a74ae3ac5116381974eaa9aaae41ad65a23

SHA256
419251b75706b8713cc991a23eadab4e59b508cbfb359be28c2fb9a4343442fb

SHA512
9b2bb878a322d194a539f0ee431184361fdf9d9d158c86c1939f65374ee721cd9ab19cb1670b52d541bcccdce08761bd09b9868148aa3c81574e4032240786a1

Download Submit
C:\Windows\system\IWWDDMA.exe

Filesize
2.2MB

MD5
6adede6eca549d332ebddea0deee8bcb

SHA1
6f2281cef3b9fc69f327dfa7e4ac3fc3842a0fc8

SHA256
c9eb5e2d618eb4d12447d66dc6f4c79b8b3ed9c736d39c3ea0c86859c7818ac6

SHA512
fc53a7d92f8cc072b9ea51cc088c12e65dc6ae2a00dc36b0c59180b8c40e5af959e9d1751cb60c59c38a59b12631842b783ebd47ac3ba77797cd246db9d6487a

Download Submit
C:\Windows\system\JuOuCVe.exe

Filesize
2.2MB

MD5
35dd6366adeeb8ebc9a287ebd897dc5c

SHA1
00157f5a1e5a45c769a160fd9e6186ee8a62d032

SHA256
acb2a27f2c0b3c9d42bd1f67684d0b03ad909d42e5b8a7f20b9202f47ae4db65

SHA512
8e567907317343852bad6daa2964020544fe6945c68e2dc7c565bacf5f83bb5dbeb68a5be4ce516b991ecbc9ed5fa859c8c82ba54c7947d607b8246f64a85118

Download Submit
C:\Windows\system\MOJKYVo.exe

Filesize
2.2MB

MD5
740d0f142f81c6106ff0da803c79eabc

SHA1
507f7d15482f997fa8a1bfff21bc2cf353c2ba73

SHA256
fcc5131ecc85dfbbab1714427d4190d99aa79f2d73bd0c16321d84cd222b031c

SHA512
79b40a656e1b41b6093956a84fca1fe76adb510657e47f0542918bc9a57a776d00ac7ee9f2146673180599502b7c536b40ea2b9588c59d6fd9aa9152c63ccd8d

Download Submit
C:\Windows\system\QrRGNwJ.exe

Filesize
2.2MB

MD5
718d5c8381b878f942d56970d03f4373

SHA1
aae812248c1a93f67cc88005121ad360110fc042

SHA256
444b5b8e2a9f50a4d0608ef480f880043c8a1483966f0e12496f2dd3fa2dd972

SHA512
090514398325d83f7b22cc89a5dc2c1f9252e954332315be2e444a9b0b43aed5f640abcfd6d56af4f8aed9ba7385f77ddaef97996b26f8de6f1bd493dbb4bb92

Download Submit
C:\Windows\system\XdgMyqa.exe

Filesize
2.2MB

MD5
a7c93931e257c59a883379f20dca5c5e

SHA1
ffd4a0309b81aa579c734ee9edf05efd557b5ee7

SHA256
3bb4e72caad8e5fc3bb6081c3ef91b55a69412c30bac60cd04f8b3bd2b945ced

SHA512
c4bae288c0ca2131e62cdd42cd45aa7d21dc34ae33a43df5996473dd6a998ad09c74bae490dd3868be2f3cac7a3df13fa763a07cdd1784efdf140f0de8368681

Download Submit
C:\Windows\system\XeKnVTI.exe

Filesize
2.2MB

MD5
e11448b252c7c70fa1319752af1d6c10

SHA1
bae2720484364bc5fd53a13e88d0b4500b404cd2

SHA256
2ae06aeb184aa160d39c67cfab5266dd90dad7e6cddfc261708bf010dac59f8b

SHA512
971371f4989e6425855b45ee16ce9ebe53f596e14f4f024cb49057f86fcdbf90180b1bb2c3b40b7e8241c01bb3351c39a95d68cdfb307471d516d6be0d481f2e

Download Submit
C:\Windows\system\cQGAoVu.exe

Filesize
2.2MB

MD5
3242e948252c688847fbb0f2a70272b0

SHA1
b964b2847117a18d571daf0a1ce84b3645539227

SHA256
0db9e061381a7afc0609b047d62c734258356146541cb8378688272ea2af2f5c

SHA512
e5b8d93c91a0e21c42a3a5d6f985ab30bac8eff09e5a6b835733def0634f68043117a4fc3d0bdd428705df55a763892efe577d5a87c7f67b822a9301a01c1836

Download Submit
C:\Windows\system\iQQLGxC.exe

Filesize
2.2MB

MD5
b8b8b305a2699f4c8d948c44138a3d73

SHA1
5aa0f4c568d91ff9d9e70bb4a63e07d8470f8830

SHA256
d18261775ec7e703998e8c3357e4f81dde1e6d334dddcd75955e114ec6ab4ef4

SHA512
354c39a1c97ddf110c90d990819fc4615758e01d6ab9ea8b3cce50ec6642df13f93bbc3a9f2622d25c4be385fe8317b98dcce6e77f9d4c98b6ea0078afffe3ef

Download Submit
C:\Windows\system\irgufwD.exe

Filesize
2.2MB

MD5
c313232c0036a3e00112a1a9aedb3117

SHA1
1540897b7c0d12d3cd0499da74cb845f296271da

SHA256
bc216f8dcc7981e2d5eb09c905da0bf1ca0bbb1c95170bee710575172aa3f3a0

SHA512
07f3617296c2e1c3420b69d52bb74bab258213ada0e36fe79d618579f4f96b2dd43c0bd631e47efd95251a0ba48a3ab626e31248d4e1e70ccddfb696a6a5e81a

Download Submit
C:\Windows\system\kbmJfOX.exe

Filesize
2.2MB

MD5
f216e89087495701676358cc5d16aea5

SHA1
09242699fb5654ed615d31ec252b5c92aeded91f

SHA256
fbb69642fe92921bb015700e210493be66faf2f0a1eaeb4203dbb076cb9d20d4

SHA512
778fe24553b80c39adb51532b013e84e633728a9a2aa16a71c4901dd6fd06069890e2e555236d83dc0cf334dc28608eaa1304c40131fca8e5b277dae92c0ded6

Download Submit
C:\Windows\system\rrhSfEG.exe

Filesize
2.2MB

MD5
4574f81bae97f8f7c35d97fd9155b592

SHA1
0f5aab8ec427a4595ec3eeedebaa4acda5355aca

SHA256
c471b3cf09aaef9c7961ebba7dd97b3ba4190f6c155c38ac7cb424791b9475f4

SHA512
0a30add3afa4b30846415b0b6d0a651d4b406e42df5f5fa6c4626c6d6cfa3459638de8730907013ff192cb7e6e89f451bea36c8313ead2d6de05e9df7c0b78aa

Download Submit
C:\Windows\system\vdsotqM.exe

Filesize
2.2MB

MD5
29d8c05f77c3de4a55480926821ea3aa

SHA1
80034958175d56be4b78a64e94ec07cd0953a8be

SHA256
6de940a57dce1bbd41a0d35c7aa3f699cd67f1357a7ab05f698613917e638dd7

SHA512
2b1976c5469a2c87dcc6f92fa1ca6f52f5b05f7204eaa7491d57bc1f22a6299f6210bb26758a637803d4f95507871770aad386e0a1fb8683057db64770dfc923

Download Submit
C:\Windows\system\xjDoimP.exe

Filesize
2.2MB

MD5
c758963c0db637364d6224b9a1db1f80

SHA1
40f00c79484ca4cad25e78504beb6346640b54d6

SHA256
b892a595749cea07824c098f184f292bf04f1c5cd807a201e30917be81878d75

SHA512
fdd2bab1739ebb5d3c4be3cf72a6437122ec3524539a3004b2eb0ee3602be14de644ae8cea90249efc89dd0f19d7534dffbd43fbb40ca45b38207cddac2a23f9

Download Submit
C:\Windows\system\zYexOIL.exe

Filesize
2.2MB

MD5
1ecb3776251a1b92bf9d151cb061a852

SHA1
5d08719dbb6fb3041ba009762c504572a5232dd2

SHA256
88e387a1d19b02c6e1a33a9c4cdf04c126e44f69444e2602d6e9069c517462d8

SHA512
5c8e66a5bf2ba96357a37613075fadd14d6bf8d7773d4144a79e4c8564841933f43ed2890834d96164138a827e9fd3cb647401a28ff7eaaeb28b1573070956d7

Download Submit
\Windows\system\GvsSRUo.exe

Filesize
2.2MB

MD5
cc402be39e05667491b2490e7a5f4a5c

SHA1
9628f331b30d9278a47ddf32be0822c77d47be47

SHA256
1e1a497795e2413c0e06c229ac650321a1ac484bb46a02b829ff54a7d34f1fc3

SHA512
feef8958b6308fa1e904ae251f1285925dde0dc849ae57f403cffb69a0a4386e199c7b19640fe38006bf5a15e35ab5f2668d26f5a6fdefea559bad60ca683ca5

Download Submit
\Windows\system\JSYkbwO.exe

Filesize
2.2MB

MD5
44aa9d48e38fc7f7462e5a13b7d42c87

SHA1
a451496152a67ecca80b784e90715c7fb1a9e8fd

SHA256
53c0a204e93f53a1f3202e406867d4198599d71cd9d608a85639b32b95f986ce

SHA512
8426a6679f0982157eb876d6275fe67cc9f7aa44b6c442a9f43d326750270dc2fdf52f71a6722d697e4baa4bbe72b38c90607df3c03e3a54e8a6f1005338a961

Download Submit
\Windows\system\WjDqJsw.exe

Filesize
2.2MB

MD5
cd7f279f24d4570f94ab223c7f87a076

SHA1
c278aaea674b3d42fa6ebd6638854015595a3c9c

SHA256
2a078870b17ac1abe2af3589d164e3fcb253009c9dfa125a217db79cfbdd28b9

SHA512
99a7d82c47d5d6fcc4b2b68c8abfbc6ede6ee0ab0a5a938b11bce4362001ad990dcb1a390e8e2fa0fea1653f8d998b1a1a56beeb6554c14f5bc649d31c7d5074

Download Submit
\Windows\system\aKpyRoc.exe

Filesize
2.2MB

MD5
e8d992e468d5b37b75b42e55707ab9e6

SHA1
c2ca6983660d35ecdab88904d2a7069605a955a7

SHA256
e4273a75cb5480200bfb4992024f2a2ddfebad6c302cfc88fb4d416aadb3d4b6

SHA512
9e60c5ff8e88520a242485f2814fd1f2792fc5b5ce87e899470d7512bbff1fe044284951b90545d2deb1292f9ef52ac1d9deaf97c345c572ec66591995282c5a

Download Submit
\Windows\system\cGhlcCq.exe

Filesize
2.2MB

MD5
b6d058ce56677cbf995b798acc7574ad

SHA1
a1e993ef1bc0809e1a751a40491882bf84c21950

SHA256
fdbc0874a9a1acdacf36643cd3686599c2e13c010775d78588705284dffd4ccd

SHA512
14bbd782de4a7d25920a09a5d1b4030f4571765d362c1254e3e8cedbc79d9d96ca54f1fd91570f222daed8b32a3d84460bc39afa506dd2dd94fefc289100a0f4

Download Submit
\Windows\system\cNLkzQz.exe

Filesize
2.2MB

MD5
bb6592fb5f590cbe05ce6d5726c88f4f

SHA1
5296766f46dda627319bc14b71b32647b7cbdab7

SHA256
f1250f992e7261c1ec93eeae77eca5071e329fb925a32b62661f1de8933c9e92

SHA512
f19def2268ad4fa777b2e82382f8d52234c3039b1a1547671005e69aa55dabb10d6d13362db3fe52ce4ea6076e7b6371c1c85fdf533b7d4c4d1c7237fb926a1d

Download Submit
\Windows\system\cjLuzZg.exe

Filesize
2.2MB

MD5
99b6a866851ca7280ee62e6d06ef0840

SHA1
4f1bfe2237d2a8d32b9c518dc9481e112e0e6fdc

SHA256
d1c485d645db51e45c26af3d33a1e7286dfb64032395474a14edab62181d71b8

SHA512
6102b3818674497dd0894eacfe78315f91251b386ecf70a977558855eae81fdffdbc16bd6064825b469a8adaddd549d2d36ceebadec1a2669f63c931932071e7

Download Submit
\Windows\system\cvsIrzU.exe

Filesize
2.2MB

MD5
a371b1c99f32f6ba7faa0fc43cedc6ca

SHA1
37a12436992a2c05c16be9af3340b7e0244cc866

SHA256
dcf1571fedfa8315588fc16c3d481799fa25f58eaa85a4ae93b911f6be7a7c38

SHA512
a79c90bea4db8fff2a296be1620ef39e06d3ad922f071bc7fbb48c7f7e828f1a4bf20158ab1a7f1e62767308832e85d12ad8968313f20055590d8e5e074d93eb

Download Submit
\Windows\system\cyfaXcZ.exe

Filesize
2.2MB

MD5
0ebe488c114e995657bfaec339144cdf

SHA1
d09bcec479f131e674d744481f437183fce08d21

SHA256
5553939f2faebce2fc5e3a331d8a854235d7b82099d08b4c39f0f2668c8e32de

SHA512
0f06cbd8407f0f6c9a01061296236d90786f709429ca67057fa1c0a2ee5a18c959483d52932392364903063a1a50dfb6e3ccd1bae0d844ccac45e115ff807f1f

Download Submit
\Windows\system\fRMudWz.exe

Filesize
2.2MB

MD5
fe397b9d1596a508043d7acd260e6d43

SHA1
9e51e63c35306d210f5882a9db24c2ddce6e0342

SHA256
fb561027138653827224d177f48e2842fd1b14d4f92aa3e5048f6dda2c412634

SHA512
1d05674aa157646e547b4e50274717f946c1517923c2bf2fef2464c367de44e1581f7862aa52826173e9c7fb2826026f93d54053ab0e20cf0780a70ada715879

Download Submit
\Windows\system\lrNwbvx.exe

Filesize
2.2MB

MD5
f4bdb00e6bcc1869ed982e25fbdfb0ef

SHA1
a5d30aec5a9d2c81ea1aa318ff93c85af1ec0a35

SHA256
33e0e61a52268605b9ae54b908f4ac834398445ae5ea7e1c9c9ed020bfdc7645

SHA512
3c22132a81fac8a928a1cac4a4ce06b0cca8167008b433c54ecf7c3aebb83baa2568508c4e9ed416cf96e0352d723919d2bce63714a713df20688a4eedb5f6a0

Download Submit
\Windows\system\pVysxni.exe

Filesize
2.2MB

MD5
dfbad2ee740cf352c7b849b688316aa7

SHA1
034bc92085f8cb0cabec5bec06fa076b40877ed7

SHA256
a0db3e0cd6a1a1e6a9c5f226d65f862d32d3ecd990f81ee2a22a70cd668a1983

SHA512
7ad16cc68a58f787b637d9665d4d68295f9e8fa9501d8f548b8157b051501dbeb04106e8592cea317cc5d1395dcae18eb8095fb7c173244c1eb6238c70198e05

Download Submit
\Windows\system\pyOCNrF.exe

Filesize
2.2MB

MD5
e7ae1362739c1e64f4e90c50ffac15fb

SHA1
849aa0d9d25b68fb5e292ff666ebc54b49247561

SHA256
010a5fb643ea75131ca07c4ac5aa1ad9fbf09c136e45714ca59a88bb2ba7d497

SHA512
48b785aff816ed008545fdda3e06fc080c2ef244ed78f162a6574c3cde2f0fe0d4582d7a5bdab7e6de7cb67966490573bcf6c132dd735ce9581b7fe42f183748

Download Submit
\Windows\system\qtYhfjX.exe

Filesize
2.2MB

MD5
cafeaf5b556753517b3bb82450392046

SHA1
6976355357301063c61064d25f1050fae5a384d7

SHA256
54326be7f9f1386e81ce49eb21519644e8e5b2b1c117aa656df4ce2b4f9c0e72

SHA512
be389201170568c686210b35914c016b329d1d6a705131c368aad958e347cd7f184adc98539a08fce12038dcd28ac189d9b7a6c850bb5b1e1793122bc5061d31

Download Submit
\Windows\system\xzrGWPB.exe

Filesize
2.2MB

MD5
f41b11be898e835396ed766bedf6ec7d

SHA1
40f6d96a03b163ac5b5622ba060c5693ede71f4d

SHA256
342f6c95f0beb6fdecf60d0b98182e1a95563b427f48d9fe0568d8f54ab450ea

SHA512
c756b7bf8158465c79a956ed28d9d1134a2ada6ae059b256690babd5d6490201db9cbf978496cd467f41ee05aa6bd3b49b871599eee3bfdb5a4a746416474ae6

Download Submit
memory/1284-39-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/1956-97-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2304-65-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-2041-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-51-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2380-277-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2436-69-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2456-95-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2456-54-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2484-26-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-21-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-86-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2692-82-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2940-36-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2940-59-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2940-85-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2940-80-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2976-42-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2992-20-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-41-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-67-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2992-0-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-83-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-60-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2992-56-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2992-35-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-96-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-23-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-8-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-79-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/3036-17-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-68-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download