xmrig | 5f88468781ca8dbb60545d0e85e3a1a5be2da51fb2c8ea3644fbbb041a97d4f3

Analysis

max time kernel
36s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
Size

1.9MB
MD5

0402bdd9eaa6bac2b63bf2e5975f7d47
SHA1

87bdf62c5e9d18df2a279068b5ab974509ef8e95
SHA256

5f88468781ca8dbb60545d0e85e3a1a5be2da51fb2c8ea3644fbbb041a97d4f3
SHA512

a1dca81b294d30c236077e75401aac32f9b6b8aa60164f68c6d94e37ff7653a47ca9c63c87940f71fc8b848f0452d837c235e0324d518cac0558c2d992590323
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlx/E:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2120-13-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2116-20-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2536-42-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2440-67-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2708-421-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2136-109-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2872-76-0x0000000003540000-0x0000000003932000-memory.dmp	xmrig
behavioral1/memory/2872-71-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2468-56-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2536-1730-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2972-2084-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2120	drLNxTt.exe
2116	nJozDLQ.exe
2708	KceSmqD.exe
2536	TbMaXwG.exe
2972	mlIFdhi.exe
2468	IXEUnRH.exe
2440	eTvGSmk.exe
2136	wpkOBMl.exe
2480	KTrHrey.exe
2664	rxpFUaV.exe
2900	yRQhksV.exe
1528	YbjsnJx.exe
1052	SpdynqW.exe
2148	EAtMkhk.exe
344	PceRDWx.exe
2612	SPGBBVs.exe
2788	KyzEWJR.exe
2740	JuehZCT.exe
1816	hLNvkQJ.exe
2304	HbjgbAN.exe
1084	BXvsrcE.exe
1744	hNfcYMI.exe
1652	qycuSiB.exe
2932	IACuVPl.exe
1900	aNBvyzx.exe
1464	yGxKEBQ.exe
1840	rKjeSgo.exe
1788	bIptwkm.exe
880	PZPQKya.exe
3008	PaEuxEw.exe
356	BTYNHXW.exe
1532	FgLYzyF.exe
1540	skEEjOf.exe
952	ATTeyQW.exe
740	DVdozmI.exe
904	bTMmIMm.exe
1280	zVQcqFw.exe
320	QGSgNfq.exe
644	cBklEuR.exe
700	raLOJGc.exe
1188	irtLxut.exe
2220	SxnCUii.exe
2224	CgTNhWI.exe
980	JxjaIBY.exe
1792	OTGSjhF.exe
2208	NOoSbPR.exe
1492	ARGvZeG.exe
1736	ksdJwfa.exe
2008	NdcHZIo.exe
1600	AZGrPkN.exe
2124	ItifKoN.exe
2728	aROkGMh.exe
1796	WsJqhzy.exe
2812	qdHsJqr.exe
2172	HShqsTP.exe
2248	OvojgXN.exe
2540	BdoxnCO.exe
2484	tBrseew.exe
2732	vMjaKoF.exe
2896	WZlPzJT.exe
764	HiHFmSI.exe
2776	mmeCiMp.exe
2300	JBJDZgL.exe
1524	qEoNuWe.exe

Loads dropped DLL 64 IoCs

pid	Process
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-0-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x000a000000015cb6-3.dat	upx
behavioral1/memory/2120-13-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0035000000015d42-14.dat	upx
behavioral1/memory/2116-20-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-16.dat	upx
behavioral1/files/0x0008000000015d7f-38.dat	upx
behavioral1/memory/2708-31-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2536-42-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2972-49-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0007000000015d93-52.dat	upx
behavioral1/memory/2440-67-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/files/0x0006000000016d9d-145.dat	upx
behavioral1/files/0x0006000000016d07-126.dat	upx
behavioral1/files/0x0006000000016dbe-152.dat	upx
behavioral1/files/0x00060000000171df-171.dat	upx
behavioral1/files/0x0015000000018644-186.dat	upx
behavioral1/files/0x0031000000018649-191.dat	upx
behavioral1/memory/2708-421-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0006000000017437-181.dat	upx
behavioral1/files/0x00060000000173d0-176.dat	upx
behavioral1/files/0x000600000001704a-161.dat	upx
behavioral1/files/0x000600000001708b-166.dat	upx
behavioral1/files/0x0006000000016d74-138.dat	upx
behavioral1/files/0x0006000000016d43-136.dat	upx
behavioral1/files/0x0035000000015d4e-156.dat	upx
behavioral1/files/0x0006000000016d3a-133.dat	upx
behavioral1/files/0x0006000000016da5-132.dat	upx
behavioral1/files/0x0006000000016d20-131.dat	upx
behavioral1/files/0x0006000000016db1-122.dat	upx
behavioral1/files/0x0006000000016d8e-118.dat	upx
behavioral1/files/0x0006000000016d5f-117.dat	upx
behavioral1/files/0x0006000000016d3e-116.dat	upx
behavioral1/memory/2136-109-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0008000000015ecc-99.dat	upx
behavioral1/files/0x0006000000016d34-92.dat	upx
behavioral1/files/0x0006000000016d18-91.dat	upx
behavioral1/files/0x0006000000016db9-141.dat	upx
behavioral1/files/0x0006000000016cdc-75.dat	upx
behavioral1/memory/2872-71-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0007000000015e32-60.dat	upx
behavioral1/memory/2468-56-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0007000000015d87-46.dat	upx
behavioral1/memory/2536-1730-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2972-2084-0x000000013FE60000-0x0000000140252000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BpVJyrE.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\GhGMOzV.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\kkmMsCm.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\XruXjOU.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DJEWgOo.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\iLwIekq.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\zZyFBMS.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\pazrYnr.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\HKzGThk.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\yFAdjpx.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\geiqiPN.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\LOZVfGF.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\iTHDqgd.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\xnpWsWH.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\mLMPYRw.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\nDOgLug.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\mmeCiMp.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\cgLqSyy.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\SFeWgIK.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\XsmWqMk.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\fkzGXDl.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\uRMrOCI.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\nVcBKwf.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\OvojgXN.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\QgvOpAZ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\HShqsTP.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ZVDCWMX.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\vwstAAg.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\aqZOTtb.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\gxreqbz.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\TyFyDIx.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\lfIsyug.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\BgoEklc.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hVSHUxQ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\FZgpnBY.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\gQkkHkU.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\MwSQLgk.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\xruWAdm.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\crwavAv.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\mMqEqcb.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\eTvGSmk.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\YhjeBtr.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\OOSlnhS.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\wmqKCnu.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\vrVPcxo.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\oXzdPhp.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\YrMaKbZ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\UPmiRlj.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ToevEJi.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DhBfQdz.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DVtlTxV.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\lZHZXqI.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\YhnkjgQ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\IRgTtDA.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\RJYDOxA.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\LGeCSme.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\xKwClUP.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\EMhXsCd.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ocKlIYi.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\udvvBUX.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ZKBgczP.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\rmAylIm.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\IgjJddT.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\RUIQvsZ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
Token: SeDebugPrivilege	3032	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3032	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	29
PID 2872 wrote to memory of 3032	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	29
PID 2872 wrote to memory of 3032	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	29
PID 2872 wrote to memory of 2120	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2120	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2120	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2116	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2116	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2116	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2708	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2708	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2708	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2536	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2536	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2536	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2972	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2972	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2972	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2468	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2468	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2468	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2440	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2440	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2440	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2900	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2900	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2900	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2136	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	38
PID 2872 wrote to memory of 2136	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	38
PID 2872 wrote to memory of 2136	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	38
PID 2872 wrote to memory of 344	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	39
PID 2872 wrote to memory of 344	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	39
PID 2872 wrote to memory of 344	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	39
PID 2872 wrote to memory of 2480	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	40
PID 2872 wrote to memory of 2480	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	40
PID 2872 wrote to memory of 2480	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	40
PID 2872 wrote to memory of 2612	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	41
PID 2872 wrote to memory of 2612	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	41
PID 2872 wrote to memory of 2612	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	41
PID 2872 wrote to memory of 2664	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	42
PID 2872 wrote to memory of 2664	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	42
PID 2872 wrote to memory of 2664	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	42
PID 2872 wrote to memory of 2740	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	43
PID 2872 wrote to memory of 2740	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	43
PID 2872 wrote to memory of 2740	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	43
PID 2872 wrote to memory of 1528	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	44
PID 2872 wrote to memory of 1528	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	44
PID 2872 wrote to memory of 1528	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	44
PID 2872 wrote to memory of 1816	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	45
PID 2872 wrote to memory of 1816	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	45
PID 2872 wrote to memory of 1816	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	45
PID 2872 wrote to memory of 1052	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	46
PID 2872 wrote to memory of 1052	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	46
PID 2872 wrote to memory of 1052	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	46
PID 2872 wrote to memory of 2304	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2304	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2304	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2148	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	48
PID 2872 wrote to memory of 2148	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	48
PID 2872 wrote to memory of 2148	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	48
PID 2872 wrote to memory of 1744	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	49
PID 2872 wrote to memory of 1744	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	49
PID 2872 wrote to memory of 1744	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	49
PID 2872 wrote to memory of 2788	2872	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System\drLNxTt.exe
  C:\Windows\System\drLNxTt.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nJozDLQ.exe
  C:\Windows\System\nJozDLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KceSmqD.exe
  C:\Windows\System\KceSmqD.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TbMaXwG.exe
  C:\Windows\System\TbMaXwG.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\mlIFdhi.exe
  C:\Windows\System\mlIFdhi.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\IXEUnRH.exe
  C:\Windows\System\IXEUnRH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\eTvGSmk.exe
  C:\Windows\System\eTvGSmk.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yRQhksV.exe
  C:\Windows\System\yRQhksV.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\wpkOBMl.exe
  C:\Windows\System\wpkOBMl.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\PceRDWx.exe
  C:\Windows\System\PceRDWx.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\KTrHrey.exe
  C:\Windows\System\KTrHrey.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\SPGBBVs.exe
  C:\Windows\System\SPGBBVs.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\rxpFUaV.exe
  C:\Windows\System\rxpFUaV.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JuehZCT.exe
  C:\Windows\System\JuehZCT.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\YbjsnJx.exe
  C:\Windows\System\YbjsnJx.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\hLNvkQJ.exe
  C:\Windows\System\hLNvkQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\SpdynqW.exe
  C:\Windows\System\SpdynqW.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\HbjgbAN.exe
  C:\Windows\System\HbjgbAN.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\EAtMkhk.exe
  C:\Windows\System\EAtMkhk.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\hNfcYMI.exe
  C:\Windows\System\hNfcYMI.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\KyzEWJR.exe
  C:\Windows\System\KyzEWJR.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\qycuSiB.exe
  C:\Windows\System\qycuSiB.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\BXvsrcE.exe
  C:\Windows\System\BXvsrcE.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\IACuVPl.exe
  C:\Windows\System\IACuVPl.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\aNBvyzx.exe
  C:\Windows\System\aNBvyzx.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\yGxKEBQ.exe
  C:\Windows\System\yGxKEBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\rKjeSgo.exe
  C:\Windows\System\rKjeSgo.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\bIptwkm.exe
  C:\Windows\System\bIptwkm.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\PZPQKya.exe
  C:\Windows\System\PZPQKya.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\PaEuxEw.exe
  C:\Windows\System\PaEuxEw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\BTYNHXW.exe
  C:\Windows\System\BTYNHXW.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\FgLYzyF.exe
  C:\Windows\System\FgLYzyF.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\skEEjOf.exe
  C:\Windows\System\skEEjOf.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ATTeyQW.exe
  C:\Windows\System\ATTeyQW.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\DVdozmI.exe
  C:\Windows\System\DVdozmI.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\bTMmIMm.exe
  C:\Windows\System\bTMmIMm.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\zVQcqFw.exe
  C:\Windows\System\zVQcqFw.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\QGSgNfq.exe
  C:\Windows\System\QGSgNfq.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\cBklEuR.exe
  C:\Windows\System\cBklEuR.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\raLOJGc.exe
  C:\Windows\System\raLOJGc.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\irtLxut.exe
  C:\Windows\System\irtLxut.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\SxnCUii.exe
  C:\Windows\System\SxnCUii.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\CgTNhWI.exe
  C:\Windows\System\CgTNhWI.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JxjaIBY.exe
  C:\Windows\System\JxjaIBY.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\OTGSjhF.exe
  C:\Windows\System\OTGSjhF.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\NOoSbPR.exe
  C:\Windows\System\NOoSbPR.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ARGvZeG.exe
  C:\Windows\System\ARGvZeG.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ksdJwfa.exe
  C:\Windows\System\ksdJwfa.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\NdcHZIo.exe
  C:\Windows\System\NdcHZIo.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\AZGrPkN.exe
  C:\Windows\System\AZGrPkN.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ItifKoN.exe
  C:\Windows\System\ItifKoN.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\aROkGMh.exe
  C:\Windows\System\aROkGMh.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\WsJqhzy.exe
  C:\Windows\System\WsJqhzy.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\qdHsJqr.exe
  C:\Windows\System\qdHsJqr.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HShqsTP.exe
  C:\Windows\System\HShqsTP.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\OvojgXN.exe
  C:\Windows\System\OvojgXN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\BdoxnCO.exe
  C:\Windows\System\BdoxnCO.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\tBrseew.exe
  C:\Windows\System\tBrseew.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\vMjaKoF.exe
  C:\Windows\System\vMjaKoF.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\WZlPzJT.exe
  C:\Windows\System\WZlPzJT.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\HiHFmSI.exe
  C:\Windows\System\HiHFmSI.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\mmeCiMp.exe
  C:\Windows\System\mmeCiMp.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\JBJDZgL.exe
  C:\Windows\System\JBJDZgL.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\qEoNuWe.exe
  C:\Windows\System\qEoNuWe.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\EtukSQv.exe
  C:\Windows\System\EtukSQv.exe
  2⤵
  PID:2928
- C:\Windows\System\nIjizvB.exe
  C:\Windows\System\nIjizvB.exe
  2⤵
  PID:2904
- C:\Windows\System\zkObqLD.exe
  C:\Windows\System\zkObqLD.exe
  2⤵
  PID:1928
- C:\Windows\System\gHNVfPD.exe
  C:\Windows\System\gHNVfPD.exe
  2⤵
  PID:2340
- C:\Windows\System\mqwqpSr.exe
  C:\Windows\System\mqwqpSr.exe
  2⤵
  PID:1300
- C:\Windows\System\RtQBijV.exe
  C:\Windows\System\RtQBijV.exe
  2⤵
  PID:1308
- C:\Windows\System\TvyRbEy.exe
  C:\Windows\System\TvyRbEy.exe
  2⤵
  PID:3036
- C:\Windows\System\IXlqoXC.exe
  C:\Windows\System\IXlqoXC.exe
  2⤵
  PID:1764
- C:\Windows\System\mynnHQo.exe
  C:\Windows\System\mynnHQo.exe
  2⤵
  PID:1076
- C:\Windows\System\rimPoFJ.exe
  C:\Windows\System\rimPoFJ.exe
  2⤵
  PID:1576
- C:\Windows\System\auquVJr.exe
  C:\Windows\System\auquVJr.exe
  2⤵
  PID:1680
- C:\Windows\System\wKoczrw.exe
  C:\Windows\System\wKoczrw.exe
  2⤵
  PID:1760
- C:\Windows\System\jcDDhMO.exe
  C:\Windows\System\jcDDhMO.exe
  2⤵
  PID:924
- C:\Windows\System\IXEqcaR.exe
  C:\Windows\System\IXEqcaR.exe
  2⤵
  PID:468
- C:\Windows\System\oZMuKIK.exe
  C:\Windows\System\oZMuKIK.exe
  2⤵
  PID:2180
- C:\Windows\System\epTlYDB.exe
  C:\Windows\System\epTlYDB.exe
  2⤵
  PID:2628
- C:\Windows\System\bnioTeJ.exe
  C:\Windows\System\bnioTeJ.exe
  2⤵
  PID:2092
- C:\Windows\System\SWIMKeB.exe
  C:\Windows\System\SWIMKeB.exe
  2⤵
  PID:2176
- C:\Windows\System\DFJxBCN.exe
  C:\Windows\System\DFJxBCN.exe
  2⤵
  PID:2980
- C:\Windows\System\mUkUdMO.exe
  C:\Windows\System\mUkUdMO.exe
  2⤵
  PID:2188
- C:\Windows\System\oFkOIHe.exe
  C:\Windows\System\oFkOIHe.exe
  2⤵
  PID:1740
- C:\Windows\System\lptCYbZ.exe
  C:\Windows\System\lptCYbZ.exe
  2⤵
  PID:2000
- C:\Windows\System\KdJQoyY.exe
  C:\Windows\System\KdJQoyY.exe
  2⤵
  PID:1704
- C:\Windows\System\NJcpdTc.exe
  C:\Windows\System\NJcpdTc.exe
  2⤵
  PID:3060
- C:\Windows\System\UgHUszo.exe
  C:\Windows\System\UgHUszo.exe
  2⤵
  PID:2572
- C:\Windows\System\iCtetbN.exe
  C:\Windows\System\iCtetbN.exe
  2⤵
  PID:2768
- C:\Windows\System\WxBnkeV.exe
  C:\Windows\System\WxBnkeV.exe
  2⤵
  PID:2144
- C:\Windows\System\deWlmuu.exe
  C:\Windows\System\deWlmuu.exe
  2⤵
  PID:2492
- C:\Windows\System\bvfcOlK.exe
  C:\Windows\System\bvfcOlK.exe
  2⤵
  PID:2604
- C:\Windows\System\qlBjoci.exe
  C:\Windows\System\qlBjoci.exe
  2⤵
  PID:1568
- C:\Windows\System\TqyHpad.exe
  C:\Windows\System\TqyHpad.exe
  2⤵
  PID:2064
- C:\Windows\System\AhuyuSL.exe
  C:\Windows\System\AhuyuSL.exe
  2⤵
  PID:2360
- C:\Windows\System\RhgDAvf.exe
  C:\Windows\System\RhgDAvf.exe
  2⤵
  PID:1804
- C:\Windows\System\zbUSTCm.exe
  C:\Windows\System\zbUSTCm.exe
  2⤵
  PID:2920
- C:\Windows\System\xRDKIsE.exe
  C:\Windows\System\xRDKIsE.exe
  2⤵
  PID:2772
- C:\Windows\System\jLnBowe.exe
  C:\Windows\System\jLnBowe.exe
  2⤵
  PID:2020
- C:\Windows\System\toVYVKS.exe
  C:\Windows\System\toVYVKS.exe
  2⤵
  PID:1844
- C:\Windows\System\ffXUFly.exe
  C:\Windows\System\ffXUFly.exe
  2⤵
  PID:1572
- C:\Windows\System\rfrjWHn.exe
  C:\Windows\System\rfrjWHn.exe
  2⤵
  PID:1656
- C:\Windows\System\NsmlaeH.exe
  C:\Windows\System\NsmlaeH.exe
  2⤵
  PID:2640
- C:\Windows\System\VerdkBN.exe
  C:\Windows\System\VerdkBN.exe
  2⤵
  PID:2328
- C:\Windows\System\wzceTJw.exe
  C:\Windows\System\wzceTJw.exe
  2⤵
  PID:2216
- C:\Windows\System\nVmzGNT.exe
  C:\Windows\System\nVmzGNT.exe
  2⤵
  PID:1720
- C:\Windows\System\kaZwURN.exe
  C:\Windows\System\kaZwURN.exe
  2⤵
  PID:2076
- C:\Windows\System\GPWBxsF.exe
  C:\Windows\System\GPWBxsF.exe
  2⤵
  PID:876
- C:\Windows\System\CdNZHJA.exe
  C:\Windows\System\CdNZHJA.exe
  2⤵
  PID:3056
- C:\Windows\System\auYqgCV.exe
  C:\Windows\System\auYqgCV.exe
  2⤵
  PID:1692
- C:\Windows\System\wZHSzCT.exe
  C:\Windows\System\wZHSzCT.exe
  2⤵
  PID:2688
- C:\Windows\System\JzrNdcC.exe
  C:\Windows\System\JzrNdcC.exe
  2⤵
  PID:2684
- C:\Windows\System\ToZFPQE.exe
  C:\Windows\System\ToZFPQE.exe
  2⤵
  PID:2556
- C:\Windows\System\uqgxsaV.exe
  C:\Windows\System\uqgxsaV.exe
  2⤵
  PID:2948
- C:\Windows\System\qMYMPZV.exe
  C:\Windows\System\qMYMPZV.exe
  2⤵
  PID:2168
- C:\Windows\System\ZBCjXQR.exe
  C:\Windows\System\ZBCjXQR.exe
  2⤵
  PID:2308
- C:\Windows\System\MXuQDLN.exe
  C:\Windows\System\MXuQDLN.exe
  2⤵
  PID:2560
- C:\Windows\System\glHMCAM.exe
  C:\Windows\System\glHMCAM.exe
  2⤵
  PID:1776
- C:\Windows\System\yZNssRg.exe
  C:\Windows\System\yZNssRg.exe
  2⤵
  PID:1212
- C:\Windows\System\cihXWZB.exe
  C:\Windows\System\cihXWZB.exe
  2⤵
  PID:2780
- C:\Windows\System\fbbMVXW.exe
  C:\Windows\System\fbbMVXW.exe
  2⤵
  PID:2996
- C:\Windows\System\olOKTpX.exe
  C:\Windows\System\olOKTpX.exe
  2⤵
  PID:1980
- C:\Windows\System\RcBtLej.exe
  C:\Windows\System\RcBtLej.exe
  2⤵
  PID:2376
- C:\Windows\System\yJuZjHD.exe
  C:\Windows\System\yJuZjHD.exe
  2⤵
  PID:656
- C:\Windows\System\SiTebmT.exe
  C:\Windows\System\SiTebmT.exe
  2⤵
  PID:2464
- C:\Windows\System\mzZZLjd.exe
  C:\Windows\System\mzZZLjd.exe
  2⤵
  PID:836
- C:\Windows\System\Hvgnrdx.exe
  C:\Windows\System\Hvgnrdx.exe
  2⤵
  PID:1800
- C:\Windows\System\IVnLTtx.exe
  C:\Windows\System\IVnLTtx.exe
  2⤵
  PID:1768
- C:\Windows\System\yFCDQKk.exe
  C:\Windows\System\yFCDQKk.exe
  2⤵
  PID:2744
- C:\Windows\System\IouaMfm.exe
  C:\Windows\System\IouaMfm.exe
  2⤵
  PID:1592
- C:\Windows\System\PqdoLfF.exe
  C:\Windows\System\PqdoLfF.exe
  2⤵
  PID:1728
- C:\Windows\System\FsRZSye.exe
  C:\Windows\System\FsRZSye.exe
  2⤵
  PID:2260
- C:\Windows\System\fWaaZNv.exe
  C:\Windows\System\fWaaZNv.exe
  2⤵
  PID:2100
- C:\Windows\System\zxUxvXo.exe
  C:\Windows\System\zxUxvXo.exe
  2⤵
  PID:1628
- C:\Windows\System\RFOSlhV.exe
  C:\Windows\System\RFOSlhV.exe
  2⤵
  PID:844
- C:\Windows\System\GeoDEhw.exe
  C:\Windows\System\GeoDEhw.exe
  2⤵
  PID:1364
- C:\Windows\System\jzbXmfN.exe
  C:\Windows\System\jzbXmfN.exe
  2⤵
  PID:2256
- C:\Windows\System\dhiPoPw.exe
  C:\Windows\System\dhiPoPw.exe
  2⤵
  PID:2580
- C:\Windows\System\RlNsFpl.exe
  C:\Windows\System\RlNsFpl.exe
  2⤵
  PID:376
- C:\Windows\System\zYerfVV.exe
  C:\Windows\System\zYerfVV.exe
  2⤵
  PID:2784
- C:\Windows\System\ZklHyTc.exe
  C:\Windows\System\ZklHyTc.exe
  2⤵
  PID:2600
- C:\Windows\System\NiPptIv.exe
  C:\Windows\System\NiPptIv.exe
  2⤵
  PID:1332
- C:\Windows\System\spaRiGo.exe
  C:\Windows\System\spaRiGo.exe
  2⤵
  PID:2544
- C:\Windows\System\qsSSfLq.exe
  C:\Windows\System\qsSSfLq.exe
  2⤵
  PID:1648
- C:\Windows\System\UihPDPD.exe
  C:\Windows\System\UihPDPD.exe
  2⤵
  PID:2160
- C:\Windows\System\pzSHoxY.exe
  C:\Windows\System\pzSHoxY.exe
  2⤵
  PID:748
- C:\Windows\System\SuTMWJw.exe
  C:\Windows\System\SuTMWJw.exe
  2⤵
  PID:2924
- C:\Windows\System\mBaZwor.exe
  C:\Windows\System\mBaZwor.exe
  2⤵
  PID:1772
- C:\Windows\System\ObtxKox.exe
  C:\Windows\System\ObtxKox.exe
  2⤵
  PID:620
- C:\Windows\System\xWOPUZh.exe
  C:\Windows\System\xWOPUZh.exe
  2⤵
  PID:2476
- C:\Windows\System\ifwnSnG.exe
  C:\Windows\System\ifwnSnG.exe
  2⤵
  PID:1676
- C:\Windows\System\MCfMpcH.exe
  C:\Windows\System\MCfMpcH.exe
  2⤵
  PID:1128
- C:\Windows\System\SmVxPUY.exe
  C:\Windows\System\SmVxPUY.exe
  2⤵
  PID:2912
- C:\Windows\System\lxILEXN.exe
  C:\Windows\System\lxILEXN.exe
  2⤵
  PID:1580
- C:\Windows\System\UCGVvFS.exe
  C:\Windows\System\UCGVvFS.exe
  2⤵
  PID:1292
- C:\Windows\System\uGYtoMw.exe
  C:\Windows\System\uGYtoMw.exe
  2⤵
  PID:2832
- C:\Windows\System\qrMpGds.exe
  C:\Windows\System\qrMpGds.exe
  2⤵
  PID:1612
- C:\Windows\System\CIrcaRp.exe
  C:\Windows\System\CIrcaRp.exe
  2⤵
  PID:2352
- C:\Windows\System\frKbidr.exe
  C:\Windows\System\frKbidr.exe
  2⤵
  PID:2372
- C:\Windows\System\YhjeBtr.exe
  C:\Windows\System\YhjeBtr.exe
  2⤵
  PID:296
- C:\Windows\System\PxaFNvJ.exe
  C:\Windows\System\PxaFNvJ.exe
  2⤵
  PID:3084
- C:\Windows\System\SiuqCWt.exe
  C:\Windows\System\SiuqCWt.exe
  2⤵
  PID:3100
- C:\Windows\System\klQNkcW.exe
  C:\Windows\System\klQNkcW.exe
  2⤵
  PID:3116
- C:\Windows\System\WNBCBxO.exe
  C:\Windows\System\WNBCBxO.exe
  2⤵
  PID:3132
- C:\Windows\System\ocKlIYi.exe
  C:\Windows\System\ocKlIYi.exe
  2⤵
  PID:3152
- C:\Windows\System\nfoYRch.exe
  C:\Windows\System\nfoYRch.exe
  2⤵
  PID:3168
- C:\Windows\System\KvtaZGK.exe
  C:\Windows\System\KvtaZGK.exe
  2⤵
  PID:3184
- C:\Windows\System\agzILsV.exe
  C:\Windows\System\agzILsV.exe
  2⤵
  PID:3200
- C:\Windows\System\pydlIbh.exe
  C:\Windows\System\pydlIbh.exe
  2⤵
  PID:3216
- C:\Windows\System\vXuXsmd.exe
  C:\Windows\System\vXuXsmd.exe
  2⤵
  PID:3232
- C:\Windows\System\pvpWvrS.exe
  C:\Windows\System\pvpWvrS.exe
  2⤵
  PID:3248
- C:\Windows\System\ybDKYrP.exe
  C:\Windows\System\ybDKYrP.exe
  2⤵
  PID:3264
- C:\Windows\System\MbOMDYP.exe
  C:\Windows\System\MbOMDYP.exe
  2⤵
  PID:3280
- C:\Windows\System\eXlMOXN.exe
  C:\Windows\System\eXlMOXN.exe
  2⤵
  PID:3296
- C:\Windows\System\HUqBIXX.exe
  C:\Windows\System\HUqBIXX.exe
  2⤵
  PID:3312
- C:\Windows\System\GHvrBRQ.exe
  C:\Windows\System\GHvrBRQ.exe
  2⤵
  PID:3328
- C:\Windows\System\tdZUcON.exe
  C:\Windows\System\tdZUcON.exe
  2⤵
  PID:3344
- C:\Windows\System\UgPAoTr.exe
  C:\Windows\System\UgPAoTr.exe
  2⤵
  PID:3360
- C:\Windows\System\AdpVsuy.exe
  C:\Windows\System\AdpVsuy.exe
  2⤵
  PID:3392
- C:\Windows\System\BQQpxJL.exe
  C:\Windows\System\BQQpxJL.exe
  2⤵
  PID:3408
- C:\Windows\System\nMTvJxA.exe
  C:\Windows\System\nMTvJxA.exe
  2⤵
  PID:3424
- C:\Windows\System\UjOldZJ.exe
  C:\Windows\System\UjOldZJ.exe
  2⤵
  PID:3440
- C:\Windows\System\HbbCyrd.exe
  C:\Windows\System\HbbCyrd.exe
  2⤵
  PID:3456
- C:\Windows\System\gaAOBdI.exe
  C:\Windows\System\gaAOBdI.exe
  2⤵
  PID:3472
- C:\Windows\System\BaDdmwK.exe
  C:\Windows\System\BaDdmwK.exe
  2⤵
  PID:3488
- C:\Windows\System\lkldRyZ.exe
  C:\Windows\System\lkldRyZ.exe
  2⤵
  PID:3504
- C:\Windows\System\CWlzuLT.exe
  C:\Windows\System\CWlzuLT.exe
  2⤵
  PID:3520
- C:\Windows\System\pcBAdsc.exe
  C:\Windows\System\pcBAdsc.exe
  2⤵
  PID:3536
- C:\Windows\System\LOZVfGF.exe
  C:\Windows\System\LOZVfGF.exe
  2⤵
  PID:3552
- C:\Windows\System\ksXyQbn.exe
  C:\Windows\System\ksXyQbn.exe
  2⤵
  PID:3568
- C:\Windows\System\QUwKqIu.exe
  C:\Windows\System\QUwKqIu.exe
  2⤵
  PID:3584
- C:\Windows\System\uEsXgsr.exe
  C:\Windows\System\uEsXgsr.exe
  2⤵
  PID:3600
- C:\Windows\System\RnKvHBy.exe
  C:\Windows\System\RnKvHBy.exe
  2⤵
  PID:3628
- C:\Windows\System\xSzjbCj.exe
  C:\Windows\System\xSzjbCj.exe
  2⤵
  PID:3664
- C:\Windows\System\vYMfHYY.exe
  C:\Windows\System\vYMfHYY.exe
  2⤵
  PID:3684
- C:\Windows\System\UPmiRlj.exe
  C:\Windows\System\UPmiRlj.exe
  2⤵
  PID:3712
- C:\Windows\System\vefTEEu.exe
  C:\Windows\System\vefTEEu.exe
  2⤵
  PID:3740
- C:\Windows\System\HQkkXfq.exe
  C:\Windows\System\HQkkXfq.exe
  2⤵
  PID:3760
- C:\Windows\System\zdoUtiP.exe
  C:\Windows\System\zdoUtiP.exe
  2⤵
  PID:3776
- C:\Windows\System\MeIodDk.exe
  C:\Windows\System\MeIodDk.exe
  2⤵
  PID:3808
- C:\Windows\System\jwdxVUH.exe
  C:\Windows\System\jwdxVUH.exe
  2⤵
  PID:3868
- C:\Windows\System\TqTqBRK.exe
  C:\Windows\System\TqTqBRK.exe
  2⤵
  PID:3916
- C:\Windows\System\HPxNWFz.exe
  C:\Windows\System\HPxNWFz.exe
  2⤵
  PID:3968
- C:\Windows\System\zdOJDlH.exe
  C:\Windows\System\zdOJDlH.exe
  2⤵
  PID:4024
- C:\Windows\System\QfggIts.exe
  C:\Windows\System\QfggIts.exe
  2⤵
  PID:4076
- C:\Windows\System\PuZQDCq.exe
  C:\Windows\System\PuZQDCq.exe
  2⤵
  PID:1712
- C:\Windows\System\ROVvtXB.exe
  C:\Windows\System\ROVvtXB.exe
  2⤵
  PID:2408
- C:\Windows\System\mwcxDgu.exe
  C:\Windows\System\mwcxDgu.exe
  2⤵
  PID:3112
- C:\Windows\System\CnUAxsv.exe
  C:\Windows\System\CnUAxsv.exe
  2⤵
  PID:3240
- C:\Windows\System\XuLIgcW.exe
  C:\Windows\System\XuLIgcW.exe
  2⤵
  PID:1316
- C:\Windows\System\mTChiMu.exe
  C:\Windows\System\mTChiMu.exe
  2⤵
  PID:3128
- C:\Windows\System\fXIHCby.exe
  C:\Windows\System\fXIHCby.exe
  2⤵
  PID:3224
- C:\Windows\System\cYHhoHm.exe
  C:\Windows\System\cYHhoHm.exe
  2⤵
  PID:2792
- C:\Windows\System\xmVioJr.exe
  C:\Windows\System\xmVioJr.exe
  2⤵
  PID:1544
- C:\Windows\System\KewGhGm.exe
  C:\Windows\System\KewGhGm.exe
  2⤵
  PID:3124
- C:\Windows\System\ZEVJeae.exe
  C:\Windows\System\ZEVJeae.exe
  2⤵
  PID:3260
- C:\Windows\System\JnidbIh.exe
  C:\Windows\System\JnidbIh.exe
  2⤵
  PID:2588
- C:\Windows\System\sWoMybr.exe
  C:\Windows\System\sWoMybr.exe
  2⤵
  PID:3420
- C:\Windows\System\iSdNwVL.exe
  C:\Windows\System\iSdNwVL.exe
  2⤵
  PID:3544
- C:\Windows\System\RDGZrqt.exe
  C:\Windows\System\RDGZrqt.exe
  2⤵
  PID:3564
- C:\Windows\System\wIiusUv.exe
  C:\Windows\System\wIiusUv.exe
  2⤵
  PID:3464
- C:\Windows\System\fFvCISW.exe
  C:\Windows\System\fFvCISW.exe
  2⤵
  PID:3532
- C:\Windows\System\iySFgbu.exe
  C:\Windows\System\iySFgbu.exe
  2⤵
  PID:3620
- C:\Windows\System\JTJtxwY.exe
  C:\Windows\System\JTJtxwY.exe
  2⤵
  PID:3648
- C:\Windows\System\GjspFbG.exe
  C:\Windows\System\GjspFbG.exe
  2⤵
  PID:3672
- C:\Windows\System\zkNsmTG.exe
  C:\Windows\System\zkNsmTG.exe
  2⤵
  PID:3700
- C:\Windows\System\EDUsLur.exe
  C:\Windows\System\EDUsLur.exe
  2⤵
  PID:3732
- C:\Windows\System\XWbyXAZ.exe
  C:\Windows\System\XWbyXAZ.exe
  2⤵
  PID:3756
- C:\Windows\System\roQmWQk.exe
  C:\Windows\System\roQmWQk.exe
  2⤵
  PID:3796
- C:\Windows\System\MzQFnHk.exe
  C:\Windows\System\MzQFnHk.exe
  2⤵
  PID:3788
- C:\Windows\System\XYqlpVL.exe
  C:\Windows\System\XYqlpVL.exe
  2⤵
  PID:3832
- C:\Windows\System\RtDueJR.exe
  C:\Windows\System\RtDueJR.exe
  2⤵
  PID:2444
- C:\Windows\System\TBbaqDg.exe
  C:\Windows\System\TBbaqDg.exe
  2⤵
  PID:3852
- C:\Windows\System\EeXBEfB.exe
  C:\Windows\System\EeXBEfB.exe
  2⤵
  PID:3876
- C:\Windows\System\kWAcKZo.exe
  C:\Windows\System\kWAcKZo.exe
  2⤵
  PID:3892
- C:\Windows\System\SRptdNh.exe
  C:\Windows\System\SRptdNh.exe
  2⤵
  PID:3924
- C:\Windows\System\rIYgnZb.exe
  C:\Windows\System\rIYgnZb.exe
  2⤵
  PID:3948
- C:\Windows\System\knQfQRe.exe
  C:\Windows\System\knQfQRe.exe
  2⤵
  PID:3956
- C:\Windows\System\ZLGaaEC.exe
  C:\Windows\System\ZLGaaEC.exe
  2⤵
  PID:3964
- C:\Windows\System\BjrWZYb.exe
  C:\Windows\System\BjrWZYb.exe
  2⤵
  PID:3992
- C:\Windows\System\vyhHnAd.exe
  C:\Windows\System\vyhHnAd.exe
  2⤵
  PID:4008
- C:\Windows\System\GIjiZcc.exe
  C:\Windows\System\GIjiZcc.exe
  2⤵
  PID:3980
- C:\Windows\System\wKdhsha.exe
  C:\Windows\System\wKdhsha.exe
  2⤵
  PID:4052
- C:\Windows\System\XsmWqMk.exe
  C:\Windows\System\XsmWqMk.exe
  2⤵
  PID:4068
- C:\Windows\System\UZzPvtD.exe
  C:\Windows\System\UZzPvtD.exe
  2⤵
  PID:4092
- C:\Windows\System\FxtbjsT.exe
  C:\Windows\System\FxtbjsT.exe
  2⤵
  PID:1028
- C:\Windows\System\nDBnWDh.exe
  C:\Windows\System\nDBnWDh.exe
  2⤵
  PID:1516
- C:\Windows\System\ChuhHug.exe
  C:\Windows\System\ChuhHug.exe
  2⤵
  PID:3076
- C:\Windows\System\iiRhJzZ.exe
  C:\Windows\System\iiRhJzZ.exe
  2⤵
  PID:3180
- C:\Windows\System\FLpNmlU.exe
  C:\Windows\System\FLpNmlU.exe
  2⤵
  PID:3212
- C:\Windows\System\wDuqRyx.exe
  C:\Windows\System\wDuqRyx.exe
  2⤵
  PID:3064
- C:\Windows\System\sFRdyfE.exe
  C:\Windows\System\sFRdyfE.exe
  2⤵
  PID:1588
- C:\Windows\System\qtPoaHB.exe
  C:\Windows\System\qtPoaHB.exe
  2⤵
  PID:3228
- C:\Windows\System\MtkshcG.exe
  C:\Windows\System\MtkshcG.exe
  2⤵
  PID:448
- C:\Windows\System\ZWsQHiv.exe
  C:\Windows\System\ZWsQHiv.exe
  2⤵
  PID:2672
- C:\Windows\System\dbXegTm.exe
  C:\Windows\System\dbXegTm.exe
  2⤵
  PID:3292
- C:\Windows\System\AGzQIrP.exe
  C:\Windows\System\AGzQIrP.exe
  2⤵
  PID:3480
- C:\Windows\System\qBpuYkz.exe
  C:\Windows\System\qBpuYkz.exe
  2⤵
  PID:3484
- C:\Windows\System\ZCNzWyj.exe
  C:\Windows\System\ZCNzWyj.exe
  2⤵
  PID:3580
- C:\Windows\System\HvwByXX.exe
  C:\Windows\System\HvwByXX.exe
  2⤵
  PID:3496
- C:\Windows\System\gxPUGxa.exe
  C:\Windows\System\gxPUGxa.exe
  2⤵
  PID:3528
- C:\Windows\System\yZvATwV.exe
  C:\Windows\System\yZvATwV.exe
  2⤵
  PID:3612
- C:\Windows\System\rqmdybr.exe
  C:\Windows\System\rqmdybr.exe
  2⤵
  PID:3660
- C:\Windows\System\DcDQRih.exe
  C:\Windows\System\DcDQRih.exe
  2⤵
  PID:3728
- C:\Windows\System\eKYxCoA.exe
  C:\Windows\System\eKYxCoA.exe
  2⤵
  PID:3748
- C:\Windows\System\BgoEklc.exe
  C:\Windows\System\BgoEklc.exe
  2⤵
  PID:3792
- C:\Windows\System\SwUhHqy.exe
  C:\Windows\System\SwUhHqy.exe
  2⤵
  PID:3848
- C:\Windows\System\jPeKdBA.exe
  C:\Windows\System\jPeKdBA.exe
  2⤵
  PID:4100
- C:\Windows\System\ZRiyhsA.exe
  C:\Windows\System\ZRiyhsA.exe
  2⤵
  PID:4120
- C:\Windows\System\IZuXpQB.exe
  C:\Windows\System\IZuXpQB.exe
  2⤵
  PID:4136
- C:\Windows\System\NUxDakp.exe
  C:\Windows\System\NUxDakp.exe
  2⤵
  PID:4152
- C:\Windows\System\vTYryvE.exe
  C:\Windows\System\vTYryvE.exe
  2⤵
  PID:4172
- C:\Windows\System\QiCvOjW.exe
  C:\Windows\System\QiCvOjW.exe
  2⤵
  PID:4188
- C:\Windows\System\EepHTqm.exe
  C:\Windows\System\EepHTqm.exe
  2⤵
  PID:4204
- C:\Windows\System\pnTZyre.exe
  C:\Windows\System\pnTZyre.exe
  2⤵
  PID:4220
- C:\Windows\System\DFvztSo.exe
  C:\Windows\System\DFvztSo.exe
  2⤵
  PID:4236
- C:\Windows\System\gcFidvc.exe
  C:\Windows\System\gcFidvc.exe
  2⤵
  PID:4256
- C:\Windows\System\XQCSkHJ.exe
  C:\Windows\System\XQCSkHJ.exe
  2⤵
  PID:4272
- C:\Windows\System\ZasQpNd.exe
  C:\Windows\System\ZasQpNd.exe
  2⤵
  PID:4288
- C:\Windows\System\cgLqSyy.exe
  C:\Windows\System\cgLqSyy.exe
  2⤵
  PID:4424
- C:\Windows\System\ESvYYnK.exe
  C:\Windows\System\ESvYYnK.exe
  2⤵
  PID:4496
- C:\Windows\System\uQkolSk.exe
  C:\Windows\System\uQkolSk.exe
  2⤵
  PID:4512
- C:\Windows\System\ANCxZWl.exe
  C:\Windows\System\ANCxZWl.exe
  2⤵
  PID:4528
- C:\Windows\System\LUgLoDc.exe
  C:\Windows\System\LUgLoDc.exe
  2⤵
  PID:4544
- C:\Windows\System\YgrnRHX.exe
  C:\Windows\System\YgrnRHX.exe
  2⤵
  PID:4560
- C:\Windows\System\GNVUNgX.exe
  C:\Windows\System\GNVUNgX.exe
  2⤵
  PID:4580
- C:\Windows\System\tmHOTwc.exe
  C:\Windows\System\tmHOTwc.exe
  2⤵
  PID:4596
- C:\Windows\System\POhhFdG.exe
  C:\Windows\System\POhhFdG.exe
  2⤵
  PID:4612
- C:\Windows\System\NbPoOTW.exe
  C:\Windows\System\NbPoOTW.exe
  2⤵
  PID:4632
- C:\Windows\System\fAdgUix.exe
  C:\Windows\System\fAdgUix.exe
  2⤵
  PID:4648
- C:\Windows\System\EovMCcg.exe
  C:\Windows\System\EovMCcg.exe
  2⤵
  PID:4664
- C:\Windows\System\klVobVi.exe
  C:\Windows\System\klVobVi.exe
  2⤵
  PID:4680
- C:\Windows\System\DHhbYBd.exe
  C:\Windows\System\DHhbYBd.exe
  2⤵
  PID:4696
- C:\Windows\System\MVqzcSr.exe
  C:\Windows\System\MVqzcSr.exe
  2⤵
  PID:4716
- C:\Windows\System\otCKHnz.exe
  C:\Windows\System\otCKHnz.exe
  2⤵
  PID:4732
- C:\Windows\System\JxBhcOX.exe
  C:\Windows\System\JxBhcOX.exe
  2⤵
  PID:4748
- C:\Windows\System\wmqKCnu.exe
  C:\Windows\System\wmqKCnu.exe
  2⤵
  PID:4764
- C:\Windows\System\MDQeGbX.exe
  C:\Windows\System\MDQeGbX.exe
  2⤵
  PID:4780
- C:\Windows\System\AxqKVBz.exe
  C:\Windows\System\AxqKVBz.exe
  2⤵
  PID:4800
- C:\Windows\System\dbYfked.exe
  C:\Windows\System\dbYfked.exe
  2⤵
  PID:4816
- C:\Windows\System\kwGriOo.exe
  C:\Windows\System\kwGriOo.exe
  2⤵
  PID:4836
- C:\Windows\System\rSOimsv.exe
  C:\Windows\System\rSOimsv.exe
  2⤵
  PID:4860
- C:\Windows\System\YXayVFr.exe
  C:\Windows\System\YXayVFr.exe
  2⤵
  PID:4876
- C:\Windows\System\ZKBgczP.exe
  C:\Windows\System\ZKBgczP.exe
  2⤵
  PID:4892
- C:\Windows\System\hVSHUxQ.exe
  C:\Windows\System\hVSHUxQ.exe
  2⤵
  PID:4908
- C:\Windows\System\vpXyILM.exe
  C:\Windows\System\vpXyILM.exe
  2⤵
  PID:4924
- C:\Windows\System\FirmEtY.exe
  C:\Windows\System\FirmEtY.exe
  2⤵
  PID:4984
- C:\Windows\System\utyJUGn.exe
  C:\Windows\System\utyJUGn.exe
  2⤵
  PID:5008
- C:\Windows\System\zBNwYVL.exe
  C:\Windows\System\zBNwYVL.exe
  2⤵
  PID:5068
- C:\Windows\System\zhlUwkm.exe
  C:\Windows\System\zhlUwkm.exe
  2⤵
  PID:5084
- C:\Windows\System\ykoGPHX.exe
  C:\Windows\System\ykoGPHX.exe
  2⤵
  PID:5100
- C:\Windows\System\NrvbqfR.exe
  C:\Windows\System\NrvbqfR.exe
  2⤵
  PID:3840
- C:\Windows\System\zfbPNSj.exe
  C:\Windows\System\zfbPNSj.exe
  2⤵
  PID:3864
- C:\Windows\System\doGIkUf.exe
  C:\Windows\System\doGIkUf.exe
  2⤵
  PID:3900
- C:\Windows\System\Qvnwoqb.exe
  C:\Windows\System\Qvnwoqb.exe
  2⤵
  PID:3644
- C:\Windows\System\qLeoUyH.exe
  C:\Windows\System\qLeoUyH.exe
  2⤵
  PID:4020
- C:\Windows\System\ejrHVsl.exe
  C:\Windows\System\ejrHVsl.exe
  2⤵
  PID:3976
- C:\Windows\System\iVnSWWd.exe
  C:\Windows\System\iVnSWWd.exe
  2⤵
  PID:3144
- C:\Windows\System\VQpMlOy.exe
  C:\Windows\System\VQpMlOy.exe
  2⤵
  PID:4284
- C:\Windows\System\SItygMO.exe
  C:\Windows\System\SItygMO.exe
  2⤵
  PID:4044
- C:\Windows\System\vOMgOfW.exe
  C:\Windows\System\vOMgOfW.exe
  2⤵
  PID:3844
- C:\Windows\System\yNjXOdN.exe
  C:\Windows\System\yNjXOdN.exe
  2⤵
  PID:4212
- C:\Windows\System\tGRmVln.exe
  C:\Windows\System\tGRmVln.exe
  2⤵
  PID:3092
- C:\Windows\System\SkKrFEe.exe
  C:\Windows\System\SkKrFEe.exe
  2⤵
  PID:3656
- C:\Windows\System\TwRdQfG.exe
  C:\Windows\System\TwRdQfG.exe
  2⤵
  PID:4108
- C:\Windows\System\CtxvOqp.exe
  C:\Windows\System\CtxvOqp.exe
  2⤵
  PID:4148
- C:\Windows\System\koeHxqe.exe
  C:\Windows\System\koeHxqe.exe
  2⤵
  PID:3708
- C:\Windows\System\cGYplyn.exe
  C:\Windows\System\cGYplyn.exe
  2⤵
  PID:4128
- C:\Windows\System\ESrvFsT.exe
  C:\Windows\System\ESrvFsT.exe
  2⤵
  PID:4200
- C:\Windows\System\vrVPcxo.exe
  C:\Windows\System\vrVPcxo.exe
  2⤵
  PID:3804
- C:\Windows\System\bgVZvdR.exe
  C:\Windows\System\bgVZvdR.exe
  2⤵
  PID:4404
- C:\Windows\System\KCSghbv.exe
  C:\Windows\System\KCSghbv.exe
  2⤵
  PID:3784
- C:\Windows\System\iTHDqgd.exe
  C:\Windows\System\iTHDqgd.exe
  2⤵
  PID:4312
- C:\Windows\System\uwplvQw.exe
  C:\Windows\System\uwplvQw.exe
  2⤵
  PID:4332
- C:\Windows\System\hnRhoLH.exe
  C:\Windows\System\hnRhoLH.exe
  2⤵
  PID:4348
- C:\Windows\System\rmAylIm.exe
  C:\Windows\System\rmAylIm.exe
  2⤵
  PID:4364
- C:\Windows\System\RRuRrOs.exe
  C:\Windows\System\RRuRrOs.exe
  2⤵
  PID:4380
- C:\Windows\System\mMoIqbB.exe
  C:\Windows\System\mMoIqbB.exe
  2⤵
  PID:4416
- C:\Windows\System\daiSmIS.exe
  C:\Windows\System\daiSmIS.exe
  2⤵
  PID:4448
- C:\Windows\System\QtHESUM.exe
  C:\Windows\System\QtHESUM.exe
  2⤵
  PID:4464
- C:\Windows\System\VzICqka.exe
  C:\Windows\System\VzICqka.exe
  2⤵
  PID:4484
- C:\Windows\System\iTWqDRg.exe
  C:\Windows\System\iTWqDRg.exe
  2⤵
  PID:4620
- C:\Windows\System\tUFkPiz.exe
  C:\Windows\System\tUFkPiz.exe
  2⤵
  PID:4688
- C:\Windows\System\YEnaqWX.exe
  C:\Windows\System\YEnaqWX.exe
  2⤵
  PID:4724
- C:\Windows\System\nGqVHRJ.exe
  C:\Windows\System\nGqVHRJ.exe
  2⤵
  PID:4792
- C:\Windows\System\AnRCykw.exe
  C:\Windows\System\AnRCykw.exe
  2⤵
  PID:4628
- C:\Windows\System\lvJaZNb.exe
  C:\Windows\System\lvJaZNb.exe
  2⤵
  PID:4608
- C:\Windows\System\VvjnLrW.exe
  C:\Windows\System\VvjnLrW.exe
  2⤵
  PID:4712
- C:\Windows\System\lIalajj.exe
  C:\Windows\System\lIalajj.exe
  2⤵
  PID:4904
- C:\Windows\System\jESeBPJ.exe
  C:\Windows\System\jESeBPJ.exe
  2⤵
  PID:4872
- C:\Windows\System\vwstAAg.exe
  C:\Windows\System\vwstAAg.exe
  2⤵
  PID:4956
- C:\Windows\System\jzghZCU.exe
  C:\Windows\System\jzghZCU.exe
  2⤵
  PID:4976
- C:\Windows\System\ffiRxpI.exe
  C:\Windows\System\ffiRxpI.exe
  2⤵
  PID:4936
- C:\Windows\System\LQCXflf.exe
  C:\Windows\System\LQCXflf.exe
  2⤵
  PID:5004
- C:\Windows\System\zcEjNIi.exe
  C:\Windows\System\zcEjNIi.exe
  2⤵
  PID:5032
- C:\Windows\System\UlQdwiK.exe
  C:\Windows\System\UlQdwiK.exe
  2⤵
  PID:5048
- C:\Windows\System\BpVJyrE.exe
  C:\Windows\System\BpVJyrE.exe
  2⤵
  PID:5064
- C:\Windows\System\RfftWrn.exe
  C:\Windows\System\RfftWrn.exe
  2⤵
  PID:5096
- C:\Windows\System\MgUurMp.exe
  C:\Windows\System\MgUurMp.exe
  2⤵
  PID:4084
- C:\Windows\System\mQJIqRp.exe
  C:\Windows\System\mQJIqRp.exe
  2⤵
  PID:3884
- C:\Windows\System\MAyfXWG.exe
  C:\Windows\System\MAyfXWG.exe
  2⤵
  PID:3148
- C:\Windows\System\oAqcByl.exe
  C:\Windows\System\oAqcByl.exe
  2⤵
  PID:3988
- C:\Windows\System\mXThDWm.exe
  C:\Windows\System\mXThDWm.exe
  2⤵
  PID:5060
- C:\Windows\System\oDfaYRP.exe
  C:\Windows\System\oDfaYRP.exe
  2⤵
  PID:4000
- C:\Windows\System\jPuapNJ.exe
  C:\Windows\System\jPuapNJ.exe
  2⤵
  PID:3576
- C:\Windows\System\AwKVcYJ.exe
  C:\Windows\System\AwKVcYJ.exe
  2⤵
  PID:892
- C:\Windows\System\yZrbPUv.exe
  C:\Windows\System\yZrbPUv.exe
  2⤵
  PID:4160
- C:\Windows\System\UAVrusY.exe
  C:\Windows\System\UAVrusY.exe
  2⤵
  PID:4320
- C:\Windows\System\yFAdjpx.exe
  C:\Windows\System\yFAdjpx.exe
  2⤵
  PID:4344
- C:\Windows\System\EXgclSe.exe
  C:\Windows\System\EXgclSe.exe
  2⤵
  PID:4372
- C:\Windows\System\QgsGTmS.exe
  C:\Windows\System\QgsGTmS.exe
  2⤵
  PID:2700
- C:\Windows\System\UkaGDMM.exe
  C:\Windows\System\UkaGDMM.exe
  2⤵
  PID:4472
- C:\Windows\System\bXyYoTY.exe
  C:\Windows\System\bXyYoTY.exe
  2⤵
  PID:4592
- C:\Windows\System\INZaRph.exe
  C:\Windows\System\INZaRph.exe
  2⤵
  PID:4492
- C:\Windows\System\tyAeiKs.exe
  C:\Windows\System\tyAeiKs.exe
  2⤵
  PID:4536
- C:\Windows\System\rQOuDLa.exe
  C:\Windows\System\rQOuDLa.exe
  2⤵
  PID:4832
- C:\Windows\System\LqRKXwz.exe
  C:\Windows\System\LqRKXwz.exe
  2⤵
  PID:4828
- C:\Windows\System\hBPtHiY.exe
  C:\Windows\System\hBPtHiY.exe
  2⤵
  PID:4540
- C:\Windows\System\JXCaGPR.exe
  C:\Windows\System\JXCaGPR.exe
  2⤵
  PID:4884
- C:\Windows\System\cmHUbEw.exe
  C:\Windows\System\cmHUbEw.exe
  2⤵
  PID:4868
- C:\Windows\System\lnNTgTJ.exe
  C:\Windows\System\lnNTgTJ.exe
  2⤵
  PID:4280
- C:\Windows\System\xfxkKKF.exe
  C:\Windows\System\xfxkKKF.exe
  2⤵
  PID:3908
- C:\Windows\System\lQjJxKf.exe
  C:\Windows\System\lQjJxKf.exe
  2⤵
  PID:4952
- C:\Windows\System\RRJhTmr.exe
  C:\Windows\System\RRJhTmr.exe
  2⤵
  PID:5000
- C:\Windows\System\lPqeufc.exe
  C:\Windows\System\lPqeufc.exe
  2⤵
  PID:5080
- C:\Windows\System\memrGuG.exe
  C:\Windows\System\memrGuG.exe
  2⤵
  PID:3176
- C:\Windows\System\WKMivSr.exe
  C:\Windows\System\WKMivSr.exe
  2⤵
  PID:1724
- C:\Windows\System\gfNOlAH.exe
  C:\Windows\System\gfNOlAH.exe
  2⤵
  PID:3724
- C:\Windows\System\UtFWSeX.exe
  C:\Windows\System\UtFWSeX.exe
  2⤵
  PID:3828
- C:\Windows\System\IgpvqVF.exe
  C:\Windows\System\IgpvqVF.exe
  2⤵
  PID:3608
- C:\Windows\System\wQtXJVX.exe
  C:\Windows\System\wQtXJVX.exe
  2⤵
  PID:304
- C:\Windows\System\PfAaFDp.exe
  C:\Windows\System\PfAaFDp.exe
  2⤵
  PID:4232
- C:\Windows\System\jarEZiF.exe
  C:\Windows\System\jarEZiF.exe
  2⤵
  PID:3952
- C:\Windows\System\xvkBGve.exe
  C:\Windows\System\xvkBGve.exe
  2⤵
  PID:4308
- C:\Windows\System\yMQeIMw.exe
  C:\Windows\System\yMQeIMw.exe
  2⤵
  PID:4456
- C:\Windows\System\IHcxWxR.exe
  C:\Windows\System\IHcxWxR.exe
  2⤵
  PID:4760
- C:\Windows\System\ugGxXRH.exe
  C:\Windows\System\ugGxXRH.exe
  2⤵
  PID:4660
- C:\Windows\System\VFPZExl.exe
  C:\Windows\System\VFPZExl.exe
  2⤵
  PID:4624
- C:\Windows\System\JbKqdqB.exe
  C:\Windows\System\JbKqdqB.exe
  2⤵
  PID:4520
- C:\Windows\System\sTqIfFc.exe
  C:\Windows\System\sTqIfFc.exe
  2⤵
  PID:4744
- C:\Windows\System\GhGMOzV.exe
  C:\Windows\System\GhGMOzV.exe
  2⤵
  PID:4708
- C:\Windows\System\WKbzQYv.exe
  C:\Windows\System\WKbzQYv.exe
  2⤵
  PID:4900
- C:\Windows\System\bENbdBK.exe
  C:\Windows\System\bENbdBK.exe
  2⤵
  PID:1424
- C:\Windows\System\vCzMQWv.exe
  C:\Windows\System\vCzMQWv.exe
  2⤵
  PID:3340
- C:\Windows\System\sZXyOOl.exe
  C:\Windows\System\sZXyOOl.exe
  2⤵
  PID:5136
- C:\Windows\System\rolmaZI.exe
  C:\Windows\System\rolmaZI.exe
  2⤵
  PID:5152
- C:\Windows\System\UWnaXin.exe
  C:\Windows\System\UWnaXin.exe
  2⤵
  PID:5168
- C:\Windows\System\eCFnusZ.exe
  C:\Windows\System\eCFnusZ.exe
  2⤵
  PID:5188
- C:\Windows\System\NnZgIey.exe
  C:\Windows\System\NnZgIey.exe
  2⤵
  PID:5208
- C:\Windows\System\pzTegum.exe
  C:\Windows\System\pzTegum.exe
  2⤵
  PID:5340
- C:\Windows\System\LwwOVIy.exe
  C:\Windows\System\LwwOVIy.exe
  2⤵
  PID:5356
- C:\Windows\System\DGqxcnz.exe
  C:\Windows\System\DGqxcnz.exe
  2⤵
  PID:5372
- C:\Windows\System\sWwWvFo.exe
  C:\Windows\System\sWwWvFo.exe
  2⤵
  PID:5388
- C:\Windows\System\RqRglTj.exe
  C:\Windows\System\RqRglTj.exe
  2⤵
  PID:5404
- C:\Windows\System\oueOvAD.exe
  C:\Windows\System\oueOvAD.exe
  2⤵
  PID:5436
- C:\Windows\System\EfOUQlj.exe
  C:\Windows\System\EfOUQlj.exe
  2⤵
  PID:5456
- C:\Windows\System\pRbkuet.exe
  C:\Windows\System\pRbkuet.exe
  2⤵
  PID:5476
- C:\Windows\System\zGnvUXn.exe
  C:\Windows\System\zGnvUXn.exe
  2⤵
  PID:5492
- C:\Windows\System\znYffZt.exe
  C:\Windows\System\znYffZt.exe
  2⤵
  PID:5508
- C:\Windows\System\ESrzPiB.exe
  C:\Windows\System\ESrzPiB.exe
  2⤵
  PID:5524
- C:\Windows\System\kifqfzP.exe
  C:\Windows\System\kifqfzP.exe
  2⤵
  PID:5540
- C:\Windows\System\PsSvKpw.exe
  C:\Windows\System\PsSvKpw.exe
  2⤵
  PID:5556
- C:\Windows\System\coOrYQC.exe
  C:\Windows\System\coOrYQC.exe
  2⤵
  PID:5572
- C:\Windows\System\WXozvhw.exe
  C:\Windows\System\WXozvhw.exe
  2⤵
  PID:5588
- C:\Windows\System\YrKuWYC.exe
  C:\Windows\System\YrKuWYC.exe
  2⤵
  PID:5608
- C:\Windows\System\rfddhMJ.exe
  C:\Windows\System\rfddhMJ.exe
  2⤵
  PID:5624
- C:\Windows\System\OvOXhLG.exe
  C:\Windows\System\OvOXhLG.exe
  2⤵
  PID:5640
- C:\Windows\System\voGsWtV.exe
  C:\Windows\System\voGsWtV.exe
  2⤵
  PID:5656
- C:\Windows\System\HZUagpT.exe
  C:\Windows\System\HZUagpT.exe
  2⤵
  PID:5684
- C:\Windows\System\apaMdqn.exe
  C:\Windows\System\apaMdqn.exe
  2⤵
  PID:5700
- C:\Windows\System\DYYKOqV.exe
  C:\Windows\System\DYYKOqV.exe
  2⤵
  PID:5716
- C:\Windows\System\vVFaYit.exe
  C:\Windows\System\vVFaYit.exe
  2⤵
  PID:5732
- C:\Windows\System\nCbKLwg.exe
  C:\Windows\System\nCbKLwg.exe
  2⤵
  PID:5748
- C:\Windows\System\sONEHMr.exe
  C:\Windows\System\sONEHMr.exe
  2⤵
  PID:5768
- C:\Windows\System\lSYPHVR.exe
  C:\Windows\System\lSYPHVR.exe
  2⤵
  PID:5784
- C:\Windows\System\qvWllBN.exe
  C:\Windows\System\qvWllBN.exe
  2⤵
  PID:5800
- C:\Windows\System\ldGkwqN.exe
  C:\Windows\System\ldGkwqN.exe
  2⤵
  PID:5816
- C:\Windows\System\iUbUGUF.exe
  C:\Windows\System\iUbUGUF.exe
  2⤵
  PID:5836
- C:\Windows\System\cRYJaAb.exe
  C:\Windows\System\cRYJaAb.exe
  2⤵
  PID:5852
- C:\Windows\System\psUdlbs.exe
  C:\Windows\System\psUdlbs.exe
  2⤵
  PID:5868
- C:\Windows\System\Thkkqti.exe
  C:\Windows\System\Thkkqti.exe
  2⤵
  PID:5884
- C:\Windows\System\QUhAYXn.exe
  C:\Windows\System\QUhAYXn.exe
  2⤵
  PID:5908
- C:\Windows\System\gqHtcFg.exe
  C:\Windows\System\gqHtcFg.exe
  2⤵
  PID:5932
- C:\Windows\System\ZvVwABU.exe
  C:\Windows\System\ZvVwABU.exe
  2⤵
  PID:5948
- C:\Windows\System\IsLrHAC.exe
  C:\Windows\System\IsLrHAC.exe
  2⤵
  PID:5968
- C:\Windows\System\GZSmuGK.exe
  C:\Windows\System\GZSmuGK.exe
  2⤵
  PID:5984
- C:\Windows\System\FNalSqP.exe
  C:\Windows\System\FNalSqP.exe
  2⤵
  PID:6000
- C:\Windows\System\FZgpnBY.exe
  C:\Windows\System\FZgpnBY.exe
  2⤵
  PID:6096
- C:\Windows\System\DJEWgOo.exe
  C:\Windows\System\DJEWgOo.exe
  2⤵
  PID:6116
- C:\Windows\System\tECEcpm.exe
  C:\Windows\System\tECEcpm.exe
  2⤵
  PID:6132
- C:\Windows\System\ZdVGJzs.exe
  C:\Windows\System\ZdVGJzs.exe
  2⤵
  PID:5024
- C:\Windows\System\VPlwesf.exe
  C:\Windows\System\VPlwesf.exe
  2⤵
  PID:1952
- C:\Windows\System\yaFwfWc.exe
  C:\Windows\System\yaFwfWc.exe
  2⤵
  PID:3196
- C:\Windows\System\nTEzkuO.exe
  C:\Windows\System\nTEzkuO.exe
  2⤵
  PID:4944
- C:\Windows\System\cAiSjug.exe
  C:\Windows\System\cAiSjug.exe
  2⤵
  PID:3860
- C:\Windows\System\PfuTkKU.exe
  C:\Windows\System\PfuTkKU.exe
  2⤵
  PID:3772
- C:\Windows\System\VsvaDMl.exe
  C:\Windows\System\VsvaDMl.exe
  2⤵
  PID:4144
- C:\Windows\System\SEPwuBT.exe
  C:\Windows\System\SEPwuBT.exe
  2⤵
  PID:4408
- C:\Windows\System\GeLmHIV.exe
  C:\Windows\System\GeLmHIV.exe
  2⤵
  PID:4340
- C:\Windows\System\ToevEJi.exe
  C:\Windows\System\ToevEJi.exe
  2⤵
  PID:4776
- C:\Windows\System\bYoeEEp.exe
  C:\Windows\System\bYoeEEp.exe
  2⤵
  PID:5132
- C:\Windows\System\reTQJrN.exe
  C:\Windows\System\reTQJrN.exe
  2⤵
  PID:4676
- C:\Windows\System\gQkkHkU.exe
  C:\Windows\System\gQkkHkU.exe
  2⤵
  PID:4856
- C:\Windows\System\uUiLZLc.exe
  C:\Windows\System\uUiLZLc.exe
  2⤵
  PID:5204
- C:\Windows\System\bbqufwY.exe
  C:\Windows\System\bbqufwY.exe
  2⤵
  PID:5216
- C:\Windows\System\fOvgLPj.exe
  C:\Windows\System\fOvgLPj.exe
  2⤵
  PID:5256
- C:\Windows\System\iGKbgYP.exe
  C:\Windows\System\iGKbgYP.exe
  2⤵
  PID:5184
- C:\Windows\System\bIPvEON.exe
  C:\Windows\System\bIPvEON.exe
  2⤵
  PID:5236
- C:\Windows\System\dnMXCJZ.exe
  C:\Windows\System\dnMXCJZ.exe
  2⤵
  PID:5248
- C:\Windows\System\mYbSZKM.exe
  C:\Windows\System\mYbSZKM.exe
  2⤵
  PID:5276
- C:\Windows\System\OSyiIqm.exe
  C:\Windows\System\OSyiIqm.exe
  2⤵
  PID:5304
- C:\Windows\System\tgyolXH.exe
  C:\Windows\System\tgyolXH.exe
  2⤵
  PID:5320
- C:\Windows\System\jhMRaXa.exe
  C:\Windows\System\jhMRaXa.exe
  2⤵
  PID:5336
- C:\Windows\System\yNBUAeD.exe
  C:\Windows\System\yNBUAeD.exe
  2⤵
  PID:5380
- C:\Windows\System\bYZXNxJ.exe
  C:\Windows\System\bYZXNxJ.exe
  2⤵
  PID:5636
- C:\Windows\System\gLytGJm.exe
  C:\Windows\System\gLytGJm.exe
  2⤵
  PID:5568
- C:\Windows\System\BIlkPAp.exe
  C:\Windows\System\BIlkPAp.exe
  2⤵
  PID:5580
- C:\Windows\System\AkEGdge.exe
  C:\Windows\System\AkEGdge.exe
  2⤵
  PID:5620
- C:\Windows\System\OGltDrQ.exe
  C:\Windows\System\OGltDrQ.exe
  2⤵
  PID:5672
- C:\Windows\System\rSScLka.exe
  C:\Windows\System\rSScLka.exe
  2⤵
  PID:5992
- C:\Windows\System\WYTNUTZ.exe
  C:\Windows\System\WYTNUTZ.exe
  2⤵
  PID:5880
- C:\Windows\System\eFZOCAq.exe
  C:\Windows\System\eFZOCAq.exe
  2⤵
  PID:5956
- C:\Windows\System\xqDjpbs.exe
  C:\Windows\System\xqDjpbs.exe
  2⤵
  PID:5652
- C:\Windows\System\foLkvVO.exe
  C:\Windows\System\foLkvVO.exe
  2⤵
  PID:5792
- C:\Windows\System\pazrYnr.exe
  C:\Windows\System\pazrYnr.exe
  2⤵
  PID:5724
- C:\Windows\System\XooZHgB.exe
  C:\Windows\System\XooZHgB.exe
  2⤵
  PID:5796
- C:\Windows\System\jhUXGvp.exe
  C:\Windows\System\jhUXGvp.exe
  2⤵
  PID:5940
- C:\Windows\System\jgeeQuz.exe
  C:\Windows\System\jgeeQuz.exe
  2⤵
  PID:6008
- C:\Windows\System\MMmkfxA.exe
  C:\Windows\System\MMmkfxA.exe
  2⤵
  PID:6028
- C:\Windows\System\KusrwmT.exe
  C:\Windows\System\KusrwmT.exe
  2⤵
  PID:6040
- C:\Windows\System\bnXumqz.exe
  C:\Windows\System\bnXumqz.exe
  2⤵
  PID:6060
- C:\Windows\System\tGCPxTl.exe
  C:\Windows\System\tGCPxTl.exe
  2⤵
  PID:6076
- C:\Windows\System\yLSKqSS.exe
  C:\Windows\System\yLSKqSS.exe
  2⤵
  PID:6092
- C:\Windows\System\udvvBUX.exe
  C:\Windows\System\udvvBUX.exe
  2⤵
  PID:6140
- C:\Windows\System\gYSsrQK.exe
  C:\Windows\System\gYSsrQK.exe
  2⤵
  PID:5040
- C:\Windows\System\lduduBS.exe
  C:\Windows\System\lduduBS.exe
  2⤵
  PID:3624
- C:\Windows\System\vEygozb.exe
  C:\Windows\System\vEygozb.exe
  2⤵
  PID:4844
- C:\Windows\System\ViLyTNb.exe
  C:\Windows\System\ViLyTNb.exe
  2⤵
  PID:6128
- C:\Windows\System\HTqMxUB.exe
  C:\Windows\System\HTqMxUB.exe
  2⤵
  PID:4572
- C:\Windows\System\HrTuoVU.exe
  C:\Windows\System\HrTuoVU.exe
  2⤵
  PID:5244
- C:\Windows\System\EWAFsGz.exe
  C:\Windows\System\EWAFsGz.exe
  2⤵
  PID:5292
- C:\Windows\System\ddQiGHh.exe
  C:\Windows\System\ddQiGHh.exe
  2⤵
  PID:5332
- C:\Windows\System\jRtntNG.exe
  C:\Windows\System\jRtntNG.exe
  2⤵
  PID:5196
- C:\Windows\System\iLwIekq.exe
  C:\Windows\System\iLwIekq.exe
  2⤵
  PID:5272
- C:\Windows\System\bCsVUBf.exe
  C:\Windows\System\bCsVUBf.exe
  2⤵
  PID:5352
- C:\Windows\System\zQfqXDd.exe
  C:\Windows\System\zQfqXDd.exe
  2⤵
  PID:5400
- C:\Windows\System\UPQkVgw.exe
  C:\Windows\System\UPQkVgw.exe
  2⤵
  PID:5536
- C:\Windows\System\OMrFPZr.exe
  C:\Windows\System\OMrFPZr.exe
  2⤵
  PID:5452
- C:\Windows\System\GDjOpVc.exe
  C:\Windows\System\GDjOpVc.exe
  2⤵
  PID:5596
- C:\Windows\System\kiWZuAr.exe
  C:\Windows\System\kiWZuAr.exe
  2⤵
  PID:5516
- C:\Windows\System\EnFEFoK.exe
  C:\Windows\System\EnFEFoK.exe
  2⤵
  PID:5668
- C:\Windows\System\bYBRxyS.exe
  C:\Windows\System\bYBRxyS.exe
  2⤵
  PID:5780
- C:\Windows\System\YhnkjgQ.exe
  C:\Windows\System\YhnkjgQ.exe
  2⤵
  PID:5776
- C:\Windows\System\MwSQLgk.exe
  C:\Windows\System\MwSQLgk.exe
  2⤵
  PID:5996
- C:\Windows\System\CjNujOu.exe
  C:\Windows\System\CjNujOu.exe
  2⤵
  PID:5864
- C:\Windows\System\yLJTKGa.exe
  C:\Windows\System\yLJTKGa.exe
  2⤵
  PID:5928
- C:\Windows\System\CObJHPy.exe
  C:\Windows\System\CObJHPy.exe
  2⤵
  PID:5756
- C:\Windows\System\QdRLOzY.exe
  C:\Windows\System\QdRLOzY.exe
  2⤵
  PID:6084
- C:\Windows\System\bWGqejn.exe
  C:\Windows\System\bWGqejn.exe
  2⤵
  PID:4972
- C:\Windows\System\hOTMjGo.exe
  C:\Windows\System\hOTMjGo.exe
  2⤵
  PID:6068
- C:\Windows\System\ufwDvxo.exe
  C:\Windows\System\ufwDvxo.exe
  2⤵
  PID:6112
- C:\Windows\System\nWGSnyj.exe
  C:\Windows\System\nWGSnyj.exe
  2⤵
  PID:4812
- C:\Windows\System\MLrfnyK.exe
  C:\Windows\System\MLrfnyK.exe
  2⤵
  PID:5148
- C:\Windows\System\JzgskpV.exe
  C:\Windows\System\JzgskpV.exe
  2⤵
  PID:4252
- C:\Windows\System\yfRoILs.exe
  C:\Windows\System\yfRoILs.exe
  2⤵
  PID:5180
- C:\Windows\System\uuyPmaP.exe
  C:\Windows\System\uuyPmaP.exe
  2⤵
  PID:5280
- C:\Windows\System\fSCtGtj.exe
  C:\Windows\System\fSCtGtj.exe
  2⤵
  PID:4568
- C:\Windows\System\PsJiPHI.exe
  C:\Windows\System\PsJiPHI.exe
  2⤵
  PID:5384
- C:\Windows\System\DGEBOUq.exe
  C:\Windows\System\DGEBOUq.exe
  2⤵
  PID:5316
- C:\Windows\System\yuzfzWi.exe
  C:\Windows\System\yuzfzWi.exe
  2⤵
  PID:5416
- C:\Windows\System\LflUOQV.exe
  C:\Windows\System\LflUOQV.exe
  2⤵
  PID:5564
- C:\Windows\System\abZrqVd.exe
  C:\Windows\System\abZrqVd.exe
  2⤵
  PID:5896
- C:\Windows\System\rUPLuql.exe
  C:\Windows\System\rUPLuql.exe
  2⤵
  PID:2024
- C:\Windows\System\fkzGXDl.exe
  C:\Windows\System\fkzGXDl.exe
  2⤵
  PID:6056
- C:\Windows\System\lDlErFf.exe
  C:\Windows\System\lDlErFf.exe
  2⤵
  PID:3400
- C:\Windows\System\zNSeIri.exe
  C:\Windows\System\zNSeIri.exe
  2⤵
  PID:4356
- C:\Windows\System\ocwcaKd.exe
  C:\Windows\System\ocwcaKd.exe
  2⤵
  PID:5312
- C:\Windows\System\PjboKuq.exe
  C:\Windows\System\PjboKuq.exe
  2⤵
  PID:5164
- C:\Windows\System\AjUfEvN.exe
  C:\Windows\System\AjUfEvN.exe
  2⤵
  PID:4968
- C:\Windows\System\JlXTpnY.exe
  C:\Windows\System\JlXTpnY.exe
  2⤵
  PID:5808
- C:\Windows\System\vpoGfvn.exe
  C:\Windows\System\vpoGfvn.exe
  2⤵
  PID:5832
- C:\Windows\System\StQVgqq.exe
  C:\Windows\System\StQVgqq.exe
  2⤵
  PID:6048
- C:\Windows\System\HqFKhdE.exe
  C:\Windows\System\HqFKhdE.exe
  2⤵
  PID:4196
- C:\Windows\System\gRZIKBu.exe
  C:\Windows\System\gRZIKBu.exe
  2⤵
  PID:3320
- C:\Windows\System\rYxcwbE.exe
  C:\Windows\System\rYxcwbE.exe
  2⤵
  PID:3272
- C:\Windows\System\RJYDOxA.exe
  C:\Windows\System\RJYDOxA.exe
  2⤵
  PID:5712
- C:\Windows\System\knQzCus.exe
  C:\Windows\System\knQzCus.exe
  2⤵
  PID:3912
- C:\Windows\System\WMjDJzC.exe
  C:\Windows\System\WMjDJzC.exe
  2⤵
  PID:5504
- C:\Windows\System\kCHZxJf.exe
  C:\Windows\System\kCHZxJf.exe
  2⤵
  PID:6108
- C:\Windows\System\FYNjfYD.exe
  C:\Windows\System\FYNjfYD.exe
  2⤵
  PID:4888
- C:\Windows\System\zHkJDmT.exe
  C:\Windows\System\zHkJDmT.exe
  2⤵
  PID:5916
- C:\Windows\System\ZtOJJMX.exe
  C:\Windows\System\ZtOJJMX.exe
  2⤵
  PID:5848
- C:\Windows\System\bpcoJCc.exe
  C:\Windows\System\bpcoJCc.exe
  2⤵
  PID:6160
- C:\Windows\System\cbsYcSk.exe
  C:\Windows\System\cbsYcSk.exe
  2⤵
  PID:6176
- C:\Windows\System\ayHFgeA.exe
  C:\Windows\System\ayHFgeA.exe
  2⤵
  PID:6192
- C:\Windows\System\LiDxCAb.exe
  C:\Windows\System\LiDxCAb.exe
  2⤵
  PID:6208
- C:\Windows\System\RzBSUEd.exe
  C:\Windows\System\RzBSUEd.exe
  2⤵
  PID:6224
- C:\Windows\System\ssMniYG.exe
  C:\Windows\System\ssMniYG.exe
  2⤵
  PID:6240
- C:\Windows\System\hZIItMS.exe
  C:\Windows\System\hZIItMS.exe
  2⤵
  PID:6256
- C:\Windows\System\wQjIAdk.exe
  C:\Windows\System\wQjIAdk.exe
  2⤵
  PID:6276
- C:\Windows\System\HANdcwY.exe
  C:\Windows\System\HANdcwY.exe
  2⤵
  PID:6292
- C:\Windows\System\obeTERl.exe
  C:\Windows\System\obeTERl.exe
  2⤵
  PID:6308
- C:\Windows\System\CgDdIcJ.exe
  C:\Windows\System\CgDdIcJ.exe
  2⤵
  PID:6324
- C:\Windows\System\shBpkcJ.exe
  C:\Windows\System\shBpkcJ.exe
  2⤵
  PID:6340
- C:\Windows\System\RnBiAXO.exe
  C:\Windows\System\RnBiAXO.exe
  2⤵
  PID:6356
- C:\Windows\System\iCMgWDy.exe
  C:\Windows\System\iCMgWDy.exe
  2⤵
  PID:6372
- C:\Windows\System\xruWAdm.exe
  C:\Windows\System\xruWAdm.exe
  2⤵
  PID:6388
- C:\Windows\System\ECDMCXd.exe
  C:\Windows\System\ECDMCXd.exe
  2⤵
  PID:6404
- C:\Windows\System\iXATSQY.exe
  C:\Windows\System\iXATSQY.exe
  2⤵
  PID:6420
- C:\Windows\System\ZqKpYSi.exe
  C:\Windows\System\ZqKpYSi.exe
  2⤵
  PID:6436
- C:\Windows\System\TwbGaMV.exe
  C:\Windows\System\TwbGaMV.exe
  2⤵
  PID:6472
- C:\Windows\System\HbOwgUo.exe
  C:\Windows\System\HbOwgUo.exe
  2⤵
  PID:6488
- C:\Windows\System\NBNmeTO.exe
  C:\Windows\System\NBNmeTO.exe
  2⤵
  PID:6504
- C:\Windows\System\lTwjxLR.exe
  C:\Windows\System\lTwjxLR.exe
  2⤵
  PID:6520
- C:\Windows\System\zrxgSBr.exe
  C:\Windows\System\zrxgSBr.exe
  2⤵
  PID:6536
- C:\Windows\System\yOdxgrI.exe
  C:\Windows\System\yOdxgrI.exe
  2⤵
  PID:6552
- C:\Windows\System\NFLUMKF.exe
  C:\Windows\System\NFLUMKF.exe
  2⤵
  PID:6568
- C:\Windows\System\vEfaMOB.exe
  C:\Windows\System\vEfaMOB.exe
  2⤵
  PID:6588
- C:\Windows\System\YkXCcRI.exe
  C:\Windows\System\YkXCcRI.exe
  2⤵
  PID:6608
- C:\Windows\System\zxCtDsL.exe
  C:\Windows\System\zxCtDsL.exe
  2⤵
  PID:6624
- C:\Windows\System\vpbnchZ.exe
  C:\Windows\System\vpbnchZ.exe
  2⤵
  PID:6644
- C:\Windows\System\ydJDsyG.exe
  C:\Windows\System\ydJDsyG.exe
  2⤵
  PID:6664
- C:\Windows\System\aAEtTLw.exe
  C:\Windows\System\aAEtTLw.exe
  2⤵
  PID:6680
- C:\Windows\System\EgHtueg.exe
  C:\Windows\System\EgHtueg.exe
  2⤵
  PID:6696
- C:\Windows\System\LTtuUtS.exe
  C:\Windows\System\LTtuUtS.exe
  2⤵
  PID:6772
- C:\Windows\System\LGeCSme.exe
  C:\Windows\System\LGeCSme.exe
  2⤵
  PID:6788
- C:\Windows\System\EsnASoj.exe
  C:\Windows\System\EsnASoj.exe
  2⤵
  PID:6812
- C:\Windows\System\OjgDKUn.exe
  C:\Windows\System\OjgDKUn.exe
  2⤵
  PID:6828
- C:\Windows\System\nBQGnIc.exe
  C:\Windows\System\nBQGnIc.exe
  2⤵
  PID:6844
- C:\Windows\System\CJgbGqt.exe
  C:\Windows\System\CJgbGqt.exe
  2⤵
  PID:6860
- C:\Windows\System\aWJAfdg.exe
  C:\Windows\System\aWJAfdg.exe
  2⤵
  PID:6876
- C:\Windows\System\trfxgYs.exe
  C:\Windows\System\trfxgYs.exe
  2⤵
  PID:6892
- C:\Windows\System\nWaTiDi.exe
  C:\Windows\System\nWaTiDi.exe
  2⤵
  PID:6908
- C:\Windows\System\GYIVWPI.exe
  C:\Windows\System\GYIVWPI.exe
  2⤵
  PID:6924
- C:\Windows\System\hqLSJFf.exe
  C:\Windows\System\hqLSJFf.exe
  2⤵
  PID:6940
- C:\Windows\System\VLrJVcU.exe
  C:\Windows\System\VLrJVcU.exe
  2⤵
  PID:6956
- C:\Windows\System\fziwdXG.exe
  C:\Windows\System\fziwdXG.exe
  2⤵
  PID:6972
- C:\Windows\System\tOeCdiC.exe
  C:\Windows\System\tOeCdiC.exe
  2⤵
  PID:6988
- C:\Windows\System\SxxcAmH.exe
  C:\Windows\System\SxxcAmH.exe
  2⤵
  PID:7004
- C:\Windows\System\pdkLOEl.exe
  C:\Windows\System\pdkLOEl.exe
  2⤵
  PID:7020
- C:\Windows\System\xQlVktL.exe
  C:\Windows\System\xQlVktL.exe
  2⤵
  PID:7036
- C:\Windows\System\zrzTtEp.exe
  C:\Windows\System\zrzTtEp.exe
  2⤵
  PID:7052
- C:\Windows\System\HWGwbKW.exe
  C:\Windows\System\HWGwbKW.exe
  2⤵
  PID:7068
- C:\Windows\System\xYYUnLg.exe
  C:\Windows\System\xYYUnLg.exe
  2⤵
  PID:7084
- C:\Windows\System\bwWMXcO.exe
  C:\Windows\System\bwWMXcO.exe
  2⤵
  PID:7100
- C:\Windows\System\xIQXjiS.exe
  C:\Windows\System\xIQXjiS.exe
  2⤵
  PID:7116
- C:\Windows\System\fAVBwhf.exe
  C:\Windows\System\fAVBwhf.exe
  2⤵
  PID:7132
- C:\Windows\System\SXCcgbP.exe
  C:\Windows\System\SXCcgbP.exe
  2⤵
  PID:7148
- C:\Windows\System\gdPtKNl.exe
  C:\Windows\System\gdPtKNl.exe
  2⤵
  PID:7164
- C:\Windows\System\XqzOMQM.exe
  C:\Windows\System\XqzOMQM.exe
  2⤵
  PID:6152
- C:\Windows\System\BsAbzPl.exe
  C:\Windows\System\BsAbzPl.exe
  2⤵
  PID:6216
- C:\Windows\System\JclkJpd.exe
  C:\Windows\System\JclkJpd.exe
  2⤵
  PID:6284
- C:\Windows\System\oEpfFAw.exe
  C:\Windows\System\oEpfFAw.exe
  2⤵
  PID:5444
- C:\Windows\System\kyhZzae.exe
  C:\Windows\System\kyhZzae.exe
  2⤵
  PID:6352
- C:\Windows\System\BygwFrQ.exe
  C:\Windows\System\BygwFrQ.exe
  2⤵
  PID:6052
- C:\Windows\System\OZuxmUv.exe
  C:\Windows\System\OZuxmUv.exe
  2⤵
  PID:5980
- C:\Windows\System\aIRhJNn.exe
  C:\Windows\System\aIRhJNn.exe
  2⤵
  PID:6200
- C:\Windows\System\rZlfyec.exe
  C:\Windows\System\rZlfyec.exe
  2⤵
  PID:6264
- C:\Windows\System\mhCAIga.exe
  C:\Windows\System\mhCAIga.exe
  2⤵
  PID:6300
- C:\Windows\System\wqFRJdg.exe
  C:\Windows\System\wqFRJdg.exe
  2⤵
  PID:6332
- C:\Windows\System\SPsytDt.exe
  C:\Windows\System\SPsytDt.exe
  2⤵
  PID:6416
- C:\Windows\System\MDDGqIH.exe
  C:\Windows\System\MDDGqIH.exe
  2⤵
  PID:6460
- C:\Windows\System\WXoqJUY.exe
  C:\Windows\System\WXoqJUY.exe
  2⤵
  PID:6496
- C:\Windows\System\pruLBOz.exe
  C:\Windows\System\pruLBOz.exe
  2⤵
  PID:6560
- C:\Windows\System\ncJcNRg.exe
  C:\Windows\System\ncJcNRg.exe
  2⤵
  PID:6632
- C:\Windows\System\sJdBnoa.exe
  C:\Windows\System\sJdBnoa.exe
  2⤵
  PID:6672
- C:\Windows\System\MXOqGeB.exe
  C:\Windows\System\MXOqGeB.exe
  2⤵
  PID:6480
- C:\Windows\System\lYfveat.exe
  C:\Windows\System\lYfveat.exe
  2⤵
  PID:6620
- C:\Windows\System\kKhOPpJ.exe
  C:\Windows\System\kKhOPpJ.exe
  2⤵
  PID:6432
- C:\Windows\System\dzOzORQ.exe
  C:\Windows\System\dzOzORQ.exe
  2⤵
  PID:6576
- C:\Windows\System\qJIfuYy.exe
  C:\Windows\System\qJIfuYy.exe
  2⤵
  PID:6692
- C:\Windows\System\XnNLLeJ.exe
  C:\Windows\System\XnNLLeJ.exe
  2⤵
  PID:6716
- C:\Windows\System\deqzXKG.exe
  C:\Windows\System\deqzXKG.exe
  2⤵
  PID:6736
- C:\Windows\System\nMWiqNq.exe
  C:\Windows\System\nMWiqNq.exe
  2⤵
  PID:6752
- C:\Windows\System\ucwdXKK.exe
  C:\Windows\System\ucwdXKK.exe
  2⤵
  PID:5532
- C:\Windows\System\XOGeSWI.exe
  C:\Windows\System\XOGeSWI.exe
  2⤵
  PID:6808
- C:\Windows\System\WTSmMrR.exe
  C:\Windows\System\WTSmMrR.exe
  2⤵
  PID:6868
- C:\Windows\System\SqsxAHM.exe
  C:\Windows\System\SqsxAHM.exe
  2⤵
  PID:6824
- C:\Windows\System\xnpWsWH.exe
  C:\Windows\System\xnpWsWH.exe
  2⤵
  PID:6888
- C:\Windows\System\TvUNCJr.exe
  C:\Windows\System\TvUNCJr.exe
  2⤵
  PID:6964
- C:\Windows\System\iLcjiWm.exe
  C:\Windows\System\iLcjiWm.exe
  2⤵
  PID:7028
- C:\Windows\System\FaVSOjs.exe
  C:\Windows\System\FaVSOjs.exe
  2⤵
  PID:7092
- C:\Windows\System\MYdCBCj.exe
  C:\Windows\System\MYdCBCj.exe
  2⤵
  PID:7128
- C:\Windows\System\IgjJddT.exe
  C:\Windows\System\IgjJddT.exe
  2⤵
  PID:5368
- C:\Windows\System\uzDlcVQ.exe
  C:\Windows\System\uzDlcVQ.exe
  2⤵
  PID:7112
- C:\Windows\System\DxAcmuF.exe
  C:\Windows\System\DxAcmuF.exe
  2⤵
  PID:6916
- C:\Windows\System\NIiuyWY.exe
  C:\Windows\System\NIiuyWY.exe
  2⤵
  PID:7144
- C:\Windows\System\ZaSrUMx.exe
  C:\Windows\System\ZaSrUMx.exe
  2⤵
  PID:7012
- C:\Windows\System\EYgXXQj.exe
  C:\Windows\System\EYgXXQj.exe
  2⤵
  PID:7108
- C:\Windows\System\vyXoOxf.exe
  C:\Windows\System\vyXoOxf.exe
  2⤵
  PID:6168
- C:\Windows\System\FkpNUoN.exe
  C:\Windows\System\FkpNUoN.exe
  2⤵
  PID:6396
- C:\Windows\System\zjPcOKb.exe
  C:\Windows\System\zjPcOKb.exe
  2⤵
  PID:6448
- C:\Windows\System\pCiIaCc.exe
  C:\Windows\System\pCiIaCc.exe
  2⤵
  PID:6604
- C:\Windows\System\wDwydfU.exe
  C:\Windows\System\wDwydfU.exe
  2⤵
  PID:6336
- C:\Windows\System\kXFpigc.exe
  C:\Windows\System\kXFpigc.exe
  2⤵
  PID:6616
- C:\Windows\System\UxYgZJJ.exe
  C:\Windows\System\UxYgZJJ.exe
  2⤵
  PID:6528
- C:\Windows\System\bTsnwth.exe
  C:\Windows\System\bTsnwth.exe
  2⤵
  PID:6760
- C:\Windows\System\JvSoqEs.exe
  C:\Windows\System\JvSoqEs.exe
  2⤵
  PID:6456
- C:\Windows\System\GZIDeTO.exe
  C:\Windows\System\GZIDeTO.exe
  2⤵
  PID:6744
- C:\Windows\System\LMKOGxa.exe
  C:\Windows\System\LMKOGxa.exe
  2⤵
  PID:6996
- C:\Windows\System\kauNMWX.exe
  C:\Windows\System\kauNMWX.exe
  2⤵
  PID:6640
- C:\Windows\System\IUzSGLY.exe
  C:\Windows\System\IUzSGLY.exe
  2⤵
  PID:6748
- C:\Windows\System\swxjqXi.exe
  C:\Windows\System\swxjqXi.exe
  2⤵
  PID:6804
- C:\Windows\System\CAZUcqZ.exe
  C:\Windows\System\CAZUcqZ.exe
  2⤵
  PID:7060
- C:\Windows\System\CRWNLTv.exe
  C:\Windows\System\CRWNLTv.exe
  2⤵
  PID:6952
- C:\Windows\System\boPbqKV.exe
  C:\Windows\System\boPbqKV.exe
  2⤵
  PID:7076
- C:\Windows\System\EbrteGD.exe
  C:\Windows\System\EbrteGD.exe
  2⤵
  PID:6596
- C:\Windows\System\ZkWGtLn.exe
  C:\Windows\System\ZkWGtLn.exe
  2⤵
  PID:6764
- C:\Windows\System\UbeWmuJ.exe
  C:\Windows\System\UbeWmuJ.exe
  2⤵
  PID:6188
- C:\Windows\System\VTaKaar.exe
  C:\Windows\System\VTaKaar.exe
  2⤵
  PID:6236
- C:\Windows\System\jvtnSKQ.exe
  C:\Windows\System\jvtnSKQ.exe
  2⤵
  PID:6248
- C:\Windows\System\aPfwGCQ.exe
  C:\Windows\System\aPfwGCQ.exe
  2⤵
  PID:6636
- C:\Windows\System\Zrilpns.exe
  C:\Windows\System\Zrilpns.exe
  2⤵
  PID:6856
- C:\Windows\System\psrvPXf.exe
  C:\Windows\System\psrvPXf.exe
  2⤵
  PID:6872
- C:\Windows\System\UzCfoIO.exe
  C:\Windows\System\UzCfoIO.exe
  2⤵
  PID:6412
- C:\Windows\System\LSqTCVy.exe
  C:\Windows\System\LSqTCVy.exe
  2⤵
  PID:6652
- C:\Windows\System\WaRRBQW.exe
  C:\Windows\System\WaRRBQW.exe
  2⤵
  PID:7064
- C:\Windows\System\FPbfaQV.exe
  C:\Windows\System\FPbfaQV.exe
  2⤵
  PID:6272
- C:\Windows\System\ECAaUgA.exe
  C:\Windows\System\ECAaUgA.exe
  2⤵
  PID:6452
- C:\Windows\System\fAjECkg.exe
  C:\Windows\System\fAjECkg.exe
  2⤵
  PID:7184
- C:\Windows\System\lzMljct.exe
  C:\Windows\System\lzMljct.exe
  2⤵
  PID:7200
- C:\Windows\System\UQGMloi.exe
  C:\Windows\System\UQGMloi.exe
  2⤵
  PID:7216
- C:\Windows\System\AGAftOV.exe
  C:\Windows\System\AGAftOV.exe
  2⤵
  PID:7232
- C:\Windows\System\RbPTxAg.exe
  C:\Windows\System\RbPTxAg.exe
  2⤵
  PID:7248
- C:\Windows\System\VexeGUN.exe
  C:\Windows\System\VexeGUN.exe
  2⤵
  PID:7264
- C:\Windows\System\EsIydic.exe
  C:\Windows\System\EsIydic.exe
  2⤵
  PID:7280
- C:\Windows\System\mCoSmzN.exe
  C:\Windows\System\mCoSmzN.exe
  2⤵
  PID:7296
- C:\Windows\System\DgImVpX.exe
  C:\Windows\System\DgImVpX.exe
  2⤵
  PID:7312
- C:\Windows\System\OOSlnhS.exe
  C:\Windows\System\OOSlnhS.exe
  2⤵
  PID:7328
- C:\Windows\System\bRFeoXy.exe
  C:\Windows\System\bRFeoXy.exe
  2⤵
  PID:7344
- C:\Windows\System\DacQftH.exe
  C:\Windows\System\DacQftH.exe
  2⤵
  PID:7360
- C:\Windows\System\xQuSqrM.exe
  C:\Windows\System\xQuSqrM.exe
  2⤵
  PID:7376
- C:\Windows\System\UEnXuoB.exe
  C:\Windows\System\UEnXuoB.exe
  2⤵
  PID:7392
- C:\Windows\System\mqaptsL.exe
  C:\Windows\System\mqaptsL.exe
  2⤵
  PID:7460
- C:\Windows\System\wNjHtXs.exe
  C:\Windows\System\wNjHtXs.exe
  2⤵
  PID:7476
- C:\Windows\System\FkdLvjt.exe
  C:\Windows\System\FkdLvjt.exe
  2⤵
  PID:7492
- C:\Windows\System\gazqdbM.exe
  C:\Windows\System\gazqdbM.exe
  2⤵
  PID:7508
- C:\Windows\System\hDWCdag.exe
  C:\Windows\System\hDWCdag.exe
  2⤵
  PID:7524
- C:\Windows\System\wzQIfVb.exe
  C:\Windows\System\wzQIfVb.exe
  2⤵
  PID:7540
- C:\Windows\System\DPqRSDe.exe
  C:\Windows\System\DPqRSDe.exe
  2⤵
  PID:7556
- C:\Windows\System\IPevFHB.exe
  C:\Windows\System\IPevFHB.exe
  2⤵
  PID:7572
- C:\Windows\System\KksAaoj.exe
  C:\Windows\System\KksAaoj.exe
  2⤵
  PID:7588
- C:\Windows\System\DMKPAVy.exe
  C:\Windows\System\DMKPAVy.exe
  2⤵
  PID:7604
- C:\Windows\System\eEeqfBP.exe
  C:\Windows\System\eEeqfBP.exe
  2⤵
  PID:7624
- C:\Windows\System\yapXiaR.exe
  C:\Windows\System\yapXiaR.exe
  2⤵
  PID:7640
- C:\Windows\System\fpLoyrv.exe
  C:\Windows\System\fpLoyrv.exe
  2⤵
  PID:7660
- C:\Windows\System\RzIzlcm.exe
  C:\Windows\System\RzIzlcm.exe
  2⤵
  PID:7676
- C:\Windows\System\wgWnBxh.exe
  C:\Windows\System\wgWnBxh.exe
  2⤵
  PID:7696
- C:\Windows\System\HMwbMpE.exe
  C:\Windows\System\HMwbMpE.exe
  2⤵
  PID:7712
- C:\Windows\System\ccpsfDl.exe
  C:\Windows\System\ccpsfDl.exe
  2⤵
  PID:7728
- C:\Windows\System\HtVlnhD.exe
  C:\Windows\System\HtVlnhD.exe
  2⤵
  PID:7744
- C:\Windows\System\cuesqzu.exe
  C:\Windows\System\cuesqzu.exe
  2⤵
  PID:7760
- C:\Windows\System\cyyaHqy.exe
  C:\Windows\System\cyyaHqy.exe
  2⤵
  PID:7776
- C:\Windows\System\nwhElDb.exe
  C:\Windows\System\nwhElDb.exe
  2⤵
  PID:7792
- C:\Windows\System\kzGmuFw.exe
  C:\Windows\System\kzGmuFw.exe
  2⤵
  PID:7808
- C:\Windows\System\QhkXnby.exe
  C:\Windows\System\QhkXnby.exe
  2⤵
  PID:7828
- C:\Windows\System\QeCPlRx.exe
  C:\Windows\System\QeCPlRx.exe
  2⤵
  PID:7844
- C:\Windows\System\AIXiRpX.exe
  C:\Windows\System\AIXiRpX.exe
  2⤵
  PID:7860
- C:\Windows\System\CsZgOzq.exe
  C:\Windows\System\CsZgOzq.exe
  2⤵
  PID:7876
- C:\Windows\System\hyfkOgT.exe
  C:\Windows\System\hyfkOgT.exe
  2⤵
  PID:7892
- C:\Windows\System\KVnZfXb.exe
  C:\Windows\System\KVnZfXb.exe
  2⤵
  PID:7952
- C:\Windows\System\crwavAv.exe
  C:\Windows\System\crwavAv.exe
  2⤵
  PID:7968
- C:\Windows\System\rvbowaO.exe
  C:\Windows\System\rvbowaO.exe
  2⤵
  PID:7984
- C:\Windows\System\ViFUhuS.exe
  C:\Windows\System\ViFUhuS.exe
  2⤵
  PID:8000
- C:\Windows\System\YomebaN.exe
  C:\Windows\System\YomebaN.exe
  2⤵
  PID:8020
- C:\Windows\System\FhjrHkP.exe
  C:\Windows\System\FhjrHkP.exe
  2⤵
  PID:8036
- C:\Windows\System\FEmDeHk.exe
  C:\Windows\System\FEmDeHk.exe
  2⤵
  PID:8052
- C:\Windows\System\wvxCqRO.exe
  C:\Windows\System\wvxCqRO.exe
  2⤵
  PID:8072
- C:\Windows\System\eUgWQIN.exe
  C:\Windows\System\eUgWQIN.exe
  2⤵
  PID:8088
- C:\Windows\System\GqbSkHZ.exe
  C:\Windows\System\GqbSkHZ.exe
  2⤵
  PID:8104
- C:\Windows\System\SAXyYjR.exe
  C:\Windows\System\SAXyYjR.exe
  2⤵
  PID:8120
- C:\Windows\System\xORjySF.exe
  C:\Windows\System\xORjySF.exe
  2⤵
  PID:8136
- C:\Windows\System\EyxsxeF.exe
  C:\Windows\System\EyxsxeF.exe
  2⤵
  PID:8156
- C:\Windows\System\vNyxkcM.exe
  C:\Windows\System\vNyxkcM.exe
  2⤵
  PID:8172
- C:\Windows\System\DLbqoJE.exe
  C:\Windows\System\DLbqoJE.exe
  2⤵
  PID:6252
- C:\Windows\System\vjNBzGC.exe
  C:\Windows\System\vjNBzGC.exe
  2⤵
  PID:7224
- C:\Windows\System\BfxqGIP.exe
  C:\Windows\System\BfxqGIP.exe
  2⤵
  PID:7288
- C:\Windows\System\fcXuYII.exe
  C:\Windows\System\fcXuYII.exe
  2⤵
  PID:7352
- C:\Windows\System\gGzwoDA.exe
  C:\Windows\System\gGzwoDA.exe
  2⤵
  PID:7208
- C:\Windows\System\hIVkpdi.exe
  C:\Windows\System\hIVkpdi.exe
  2⤵
  PID:7176
- C:\Windows\System\mLMPYRw.exe
  C:\Windows\System\mLMPYRw.exe
  2⤵
  PID:5300
- C:\Windows\System\QgvOpAZ.exe
  C:\Windows\System\QgvOpAZ.exe
  2⤵
  PID:6484
- C:\Windows\System\awxKWkm.exe
  C:\Windows\System\awxKWkm.exe
  2⤵
  PID:7276
- C:\Windows\System\jWPgNuO.exe
  C:\Windows\System\jWPgNuO.exe
  2⤵
  PID:7244
- C:\Windows\System\fMrIaJp.exe
  C:\Windows\System\fMrIaJp.exe
  2⤵
  PID:7400
- C:\Windows\System\uRMrOCI.exe
  C:\Windows\System\uRMrOCI.exe
  2⤵
  PID:7420
- C:\Windows\System\oqoiVZY.exe
  C:\Windows\System\oqoiVZY.exe
  2⤵
  PID:1560
- C:\Windows\System\mOSzXra.exe
  C:\Windows\System\mOSzXra.exe
  2⤵
  PID:7472
- C:\Windows\System\WoNybdO.exe
  C:\Windows\System\WoNybdO.exe
  2⤵
  PID:7536
- C:\Windows\System\zVcuIlR.exe
  C:\Windows\System\zVcuIlR.exe
  2⤵
  PID:7600
- C:\Windows\System\imYAOJF.exe
  C:\Windows\System\imYAOJF.exe
  2⤵
  PID:7636
- C:\Windows\System\nVcBKwf.exe
  C:\Windows\System\nVcBKwf.exe
  2⤵
  PID:7452
- C:\Windows\System\BcUUkzb.exe
  C:\Windows\System\BcUUkzb.exe
  2⤵
  PID:7516
- C:\Windows\System\RCWMfMs.exe
  C:\Windows\System\RCWMfMs.exe
  2⤵
  PID:7616
- C:\Windows\System\njdNwhh.exe
  C:\Windows\System\njdNwhh.exe
  2⤵
  PID:7736
- C:\Windows\System\FtuQLfy.exe
  C:\Windows\System\FtuQLfy.exe
  2⤵
  PID:7800
- C:\Windows\System\iKcQMgl.exe
  C:\Windows\System\iKcQMgl.exe
  2⤵
  PID:7872
- C:\Windows\System\osiDAjW.exe
  C:\Windows\System\osiDAjW.exe
  2⤵
  PID:7656
- C:\Windows\System\YqOMRcd.exe
  C:\Windows\System\YqOMRcd.exe
  2⤵
  PID:7904
- C:\Windows\System\IQMiixK.exe
  C:\Windows\System\IQMiixK.exe
  2⤵
  PID:7884
- C:\Windows\System\ejJOFcE.exe
  C:\Windows\System\ejJOFcE.exe
  2⤵
  PID:7788
- C:\Windows\System\mgfMnjM.exe
  C:\Windows\System\mgfMnjM.exe
  2⤵
  PID:7856
- C:\Windows\System\PyfkLoK.exe
  C:\Windows\System\PyfkLoK.exe
  2⤵
  PID:7916
- C:\Windows\System\PZjDnsf.exe
  C:\Windows\System\PZjDnsf.exe
  2⤵
  PID:7928
- C:\Windows\System\ATAbllF.exe
  C:\Windows\System\ATAbllF.exe
  2⤵
  PID:7960
- C:\Windows\System\fKdvMGv.exe
  C:\Windows\System\fKdvMGv.exe
  2⤵
  PID:7976
- C:\Windows\System\dPENCcP.exe
  C:\Windows\System\dPENCcP.exe
  2⤵
  PID:8044
- C:\Windows\System\GHKCxef.exe
  C:\Windows\System\GHKCxef.exe
  2⤵
  PID:7964
- C:\Windows\System\qCKaIEG.exe
  C:\Windows\System\qCKaIEG.exe
  2⤵
  PID:8180
- C:\Windows\System\ppZEAyH.exe
  C:\Windows\System\ppZEAyH.exe
  2⤵
  PID:8152
- C:\Windows\System\Yxnbpbi.exe
  C:\Windows\System\Yxnbpbi.exe
  2⤵
  PID:7256
- C:\Windows\System\oqEMXMO.exe
  C:\Windows\System\oqEMXMO.exe
  2⤵
  PID:6936
- C:\Windows\System\yVFlTLt.exe
  C:\Windows\System\yVFlTLt.exe
  2⤵
  PID:6884
- C:\Windows\System\QjxxwRZ.exe
  C:\Windows\System\QjxxwRZ.exe
  2⤵
  PID:7432
- C:\Windows\System\lTxeNmw.exe
  C:\Windows\System\lTxeNmw.exe
  2⤵
  PID:7448
- C:\Windows\System\kaaKrrM.exe
  C:\Windows\System\kaaKrrM.exe
  2⤵
  PID:7192
- C:\Windows\System\RxaPFXz.exe
  C:\Windows\System\RxaPFXz.exe
  2⤵
  PID:7340
- C:\Windows\System\mXDiUpF.exe
  C:\Windows\System\mXDiUpF.exe
  2⤵
  PID:7692
- C:\Windows\System\pxZXUXk.exe
  C:\Windows\System\pxZXUXk.exe
  2⤵
  PID:7908
- C:\Windows\System\ZFBoyfs.exe
  C:\Windows\System\ZFBoyfs.exe
  2⤵
  PID:7940
- C:\Windows\System\OmpxIhW.exe
  C:\Windows\System\OmpxIhW.exe
  2⤵
  PID:8112
- C:\Windows\System\VshSQtX.exe
  C:\Windows\System\VshSQtX.exe
  2⤵
  PID:7372
- C:\Windows\System\QfFlYQb.exe
  C:\Windows\System\QfFlYQb.exe
  2⤵
  PID:8132
- C:\Windows\System\IiYbOoW.exe
  C:\Windows\System\IiYbOoW.exe
  2⤵
  PID:7548
- C:\Windows\System\dcjJUXf.exe
  C:\Windows\System\dcjJUXf.exe
  2⤵
  PID:7772
- C:\Windows\System\CgTOWzs.exe
  C:\Windows\System\CgTOWzs.exe
  2⤵
  PID:7900
- C:\Windows\System\nZNmVve.exe
  C:\Windows\System\nZNmVve.exe
  2⤵
  PID:7756
- C:\Windows\System\nCBNpaI.exe
  C:\Windows\System\nCBNpaI.exe
  2⤵
  PID:7820
- C:\Windows\System\IRgTtDA.exe
  C:\Windows\System\IRgTtDA.exe
  2⤵
  PID:7468
- C:\Windows\System\IpuPgWe.exe
  C:\Windows\System\IpuPgWe.exe
  2⤵
  PID:8188
- C:\Windows\System\SlcCDSI.exe
  C:\Windows\System\SlcCDSI.exe
  2⤵
  PID:7584
- C:\Windows\System\EMXkHGr.exe
  C:\Windows\System\EMXkHGr.exe
  2⤵
  PID:7720
- C:\Windows\System\GoruHMf.exe
  C:\Windows\System\GoruHMf.exe
  2⤵
  PID:7428
- C:\Windows\System\pxJzskP.exe
  C:\Windows\System\pxJzskP.exe
  2⤵
  PID:7740
- C:\Windows\System\eMBsxdc.exe
  C:\Windows\System\eMBsxdc.exe
  2⤵
  PID:7384
- C:\Windows\System\oEIicgp.exe
  C:\Windows\System\oEIicgp.exe
  2⤵
  PID:8128
- C:\Windows\System\EDPjLaN.exe
  C:\Windows\System\EDPjLaN.exe
  2⤵
  PID:7180
- C:\Windows\System\nSlruTC.exe
  C:\Windows\System\nSlruTC.exe
  2⤵
  PID:7704
- C:\Windows\System\LkZYNjP.exe
  C:\Windows\System\LkZYNjP.exe
  2⤵
  PID:7824
- C:\Windows\System\aKbtgQB.exe
  C:\Windows\System\aKbtgQB.exe
  2⤵
  PID:7412
- C:\Windows\System\gbNeYNf.exe
  C:\Windows\System\gbNeYNf.exe
  2⤵
  PID:6532
- C:\Windows\System\UYIrjNU.exe
  C:\Windows\System\UYIrjNU.exe
  2⤵
  PID:7836
- C:\Windows\System\asrwYqi.exe
  C:\Windows\System\asrwYqi.exe
  2⤵
  PID:7948
- C:\Windows\System\XogPCbs.exe
  C:\Windows\System\XogPCbs.exe
  2⤵
  PID:8080
- C:\Windows\System\nyWNLDL.exe
  C:\Windows\System\nyWNLDL.exe
  2⤵
  PID:7688
- C:\Windows\System\IEzhEop.exe
  C:\Windows\System\IEzhEop.exe
  2⤵
  PID:8084
- C:\Windows\System\HKDRoXK.exe
  C:\Windows\System\HKDRoXK.exe
  2⤵
  PID:8032
- C:\Windows\System\kXiAgQd.exe
  C:\Windows\System\kXiAgQd.exe
  2⤵
  PID:7840
- C:\Windows\System\FiXcfCY.exe
  C:\Windows\System\FiXcfCY.exe
  2⤵
  PID:8204
- C:\Windows\System\TyWhcrD.exe
  C:\Windows\System\TyWhcrD.exe
  2⤵
  PID:8220
- C:\Windows\System\lirlcuU.exe
  C:\Windows\System\lirlcuU.exe
  2⤵
  PID:8236
- C:\Windows\System\aqZOTtb.exe
  C:\Windows\System\aqZOTtb.exe
  2⤵
  PID:8252
- C:\Windows\System\QdDXPgw.exe
  C:\Windows\System\QdDXPgw.exe
  2⤵
  PID:8268
- C:\Windows\System\HBrGjVI.exe
  C:\Windows\System\HBrGjVI.exe
  2⤵
  PID:8284
- C:\Windows\System\tMVAuSX.exe
  C:\Windows\System\tMVAuSX.exe
  2⤵
  PID:8300
- C:\Windows\System\kdfxmtn.exe
  C:\Windows\System\kdfxmtn.exe
  2⤵
  PID:8316
- C:\Windows\System\MkehdNi.exe
  C:\Windows\System\MkehdNi.exe
  2⤵
  PID:8332
- C:\Windows\System\oXzdPhp.exe
  C:\Windows\System\oXzdPhp.exe
  2⤵
  PID:8348
- C:\Windows\System\qoIqhFr.exe
  C:\Windows\System\qoIqhFr.exe
  2⤵
  PID:8364
- C:\Windows\System\AHigyve.exe
  C:\Windows\System\AHigyve.exe
  2⤵
  PID:8380
- C:\Windows\System\OXDpieG.exe
  C:\Windows\System\OXDpieG.exe
  2⤵
  PID:8396
- C:\Windows\System\zioinMZ.exe
  C:\Windows\System\zioinMZ.exe
  2⤵
  PID:8412
- C:\Windows\System\lbegYxo.exe
  C:\Windows\System\lbegYxo.exe
  2⤵
  PID:8428
- C:\Windows\System\cXySVEI.exe
  C:\Windows\System\cXySVEI.exe
  2⤵
  PID:8444
- C:\Windows\System\rxAdajO.exe
  C:\Windows\System\rxAdajO.exe
  2⤵
  PID:8460
- C:\Windows\System\XFEgdGQ.exe
  C:\Windows\System\XFEgdGQ.exe
  2⤵
  PID:8476
- C:\Windows\System\kzIPXVs.exe
  C:\Windows\System\kzIPXVs.exe
  2⤵
  PID:8492
- C:\Windows\System\eIxXKDP.exe
  C:\Windows\System\eIxXKDP.exe
  2⤵
  PID:8508
- C:\Windows\System\JmyHZse.exe
  C:\Windows\System\JmyHZse.exe
  2⤵
  PID:8524
- C:\Windows\System\huaGiOv.exe
  C:\Windows\System\huaGiOv.exe
  2⤵
  PID:8540
- C:\Windows\System\yXuqFGv.exe
  C:\Windows\System\yXuqFGv.exe
  2⤵
  PID:8556
- C:\Windows\System\oqoLRUY.exe
  C:\Windows\System\oqoLRUY.exe
  2⤵
  PID:8572
- C:\Windows\System\ZzUbrii.exe
  C:\Windows\System\ZzUbrii.exe
  2⤵
  PID:8588
- C:\Windows\System\imVzktP.exe
  C:\Windows\System\imVzktP.exe
  2⤵
  PID:8604
- C:\Windows\System\NLcwhkj.exe
  C:\Windows\System\NLcwhkj.exe
  2⤵
  PID:8624
- C:\Windows\System\vMwKurK.exe
  C:\Windows\System\vMwKurK.exe
  2⤵
  PID:8640
- C:\Windows\System\CQEbmyq.exe
  C:\Windows\System\CQEbmyq.exe
  2⤵
  PID:8656
- C:\Windows\System\BEIpEQm.exe
  C:\Windows\System\BEIpEQm.exe
  2⤵
  PID:8672
- C:\Windows\System\GSlCoXc.exe
  C:\Windows\System\GSlCoXc.exe
  2⤵
  PID:8692
- C:\Windows\System\OtgAkNL.exe
  C:\Windows\System\OtgAkNL.exe
  2⤵
  PID:8708
- C:\Windows\System\sWeSVbk.exe
  C:\Windows\System\sWeSVbk.exe
  2⤵
  PID:8724
- C:\Windows\System\ZLRjmRe.exe
  C:\Windows\System\ZLRjmRe.exe
  2⤵
  PID:8740
- C:\Windows\System\riroSyY.exe
  C:\Windows\System\riroSyY.exe
  2⤵
  PID:8756
- C:\Windows\System\VZLMiXs.exe
  C:\Windows\System\VZLMiXs.exe
  2⤵
  PID:8776
- C:\Windows\System\VIPrqSY.exe
  C:\Windows\System\VIPrqSY.exe
  2⤵
  PID:8792
- C:\Windows\System\QkVSeSU.exe
  C:\Windows\System\QkVSeSU.exe
  2⤵
  PID:8808
- C:\Windows\System\hbPIcFy.exe
  C:\Windows\System\hbPIcFy.exe
  2⤵
  PID:8824
- C:\Windows\System\QJdrqhh.exe
  C:\Windows\System\QJdrqhh.exe
  2⤵
  PID:8840
- C:\Windows\System\HAvnbPi.exe
  C:\Windows\System\HAvnbPi.exe
  2⤵
  PID:8860
- C:\Windows\System\EbXfzBk.exe
  C:\Windows\System\EbXfzBk.exe
  2⤵
  PID:8880
- C:\Windows\System\Ateruoz.exe
  C:\Windows\System\Ateruoz.exe
  2⤵
  PID:8980
- C:\Windows\System\IPFIvlS.exe
  C:\Windows\System\IPFIvlS.exe
  2⤵
  PID:8200
- C:\Windows\System\Tapgzhv.exe
  C:\Windows\System\Tapgzhv.exe
  2⤵
  PID:8012
- C:\Windows\System\REvIwKS.exe
  C:\Windows\System\REvIwKS.exe
  2⤵
  PID:8296
- C:\Windows\System\OEiDSta.exe
  C:\Windows\System\OEiDSta.exe
  2⤵
  PID:8168
- C:\Windows\System\RRAqQXd.exe
  C:\Windows\System\RRAqQXd.exe
  2⤵
  PID:8344
- C:\Windows\System\mAegXjL.exe
  C:\Windows\System\mAegXjL.exe
  2⤵
  PID:8248
- C:\Windows\System\gxreqbz.exe
  C:\Windows\System\gxreqbz.exe
  2⤵
  PID:8216
- C:\Windows\System\wfOdDhX.exe
  C:\Windows\System\wfOdDhX.exe
  2⤵
  PID:8388
- C:\Windows\System\nUkHQps.exe
  C:\Windows\System\nUkHQps.exe
  2⤵
  PID:8376
- C:\Windows\System\brPFtfz.exe
  C:\Windows\System\brPFtfz.exe
  2⤵
  PID:8420
- C:\Windows\System\xKziUfp.exe
  C:\Windows\System\xKziUfp.exe
  2⤵
  PID:8516
- C:\Windows\System\CDbAfMk.exe
  C:\Windows\System\CDbAfMk.exe
  2⤵
  PID:8488
- C:\Windows\System\LBrKxyE.exe
  C:\Windows\System\LBrKxyE.exe
  2⤵
  PID:8616
- C:\Windows\System\gtJUwoz.exe
  C:\Windows\System\gtJUwoz.exe
  2⤵
  PID:8620
- C:\Windows\System\xSGfvRD.exe
  C:\Windows\System\xSGfvRD.exe
  2⤵
  PID:8532
- C:\Windows\System\phltQzZ.exe
  C:\Windows\System\phltQzZ.exe
  2⤵
  PID:8596
- C:\Windows\System\oNoYcVl.exe
  C:\Windows\System\oNoYcVl.exe
  2⤵
  PID:8636
- C:\Windows\System\OJCnuSq.exe
  C:\Windows\System\OJCnuSq.exe
  2⤵
  PID:8680
- C:\Windows\System\avVTqaq.exe
  C:\Windows\System\avVTqaq.exe
  2⤵
  PID:8736
- C:\Windows\System\JGBZJJi.exe
  C:\Windows\System\JGBZJJi.exe
  2⤵
  PID:8720
- C:\Windows\System\vPgTTMo.exe
  C:\Windows\System\vPgTTMo.exe
  2⤵
  PID:8752
- C:\Windows\System\axbKaKa.exe
  C:\Windows\System\axbKaKa.exe
  2⤵
  PID:8832
- C:\Windows\System\zhVksju.exe
  C:\Windows\System\zhVksju.exe
  2⤵
  PID:8872
- C:\Windows\System\gdcdEcs.exe
  C:\Windows\System\gdcdEcs.exe
  2⤵
  PID:8856
- C:\Windows\System\uyBaMWH.exe
  C:\Windows\System\uyBaMWH.exe
  2⤵
  PID:8928
- C:\Windows\System\kRkbjrW.exe
  C:\Windows\System\kRkbjrW.exe
  2⤵
  PID:8952
- C:\Windows\System\ZQtCmOr.exe
  C:\Windows\System\ZQtCmOr.exe
  2⤵
  PID:8968
- C:\Windows\System\EibedSY.exe
  C:\Windows\System\EibedSY.exe
  2⤵
  PID:9004
- C:\Windows\System\UoRxxOV.exe
  C:\Windows\System\UoRxxOV.exe
  2⤵
  PID:9020
- C:\Windows\System\elEUdvt.exe
  C:\Windows\System\elEUdvt.exe
  2⤵
  PID:9036
- C:\Windows\System\RelksYU.exe
  C:\Windows\System\RelksYU.exe
  2⤵
  PID:9088
- C:\Windows\System\mMqEqcb.exe
  C:\Windows\System\mMqEqcb.exe
  2⤵
  PID:9104
- C:\Windows\System\HKzGThk.exe
  C:\Windows\System\HKzGThk.exe
  2⤵
  PID:9064
- C:\Windows\System\XStrAQA.exe
  C:\Windows\System\XStrAQA.exe
  2⤵
  PID:9108
- C:\Windows\System\VOMxdbt.exe
  C:\Windows\System\VOMxdbt.exe
  2⤵
  PID:9120
- C:\Windows\System\ZKvCLdW.exe
  C:\Windows\System\ZKvCLdW.exe
  2⤵
  PID:9140
- C:\Windows\System\SFeWgIK.exe
  C:\Windows\System\SFeWgIK.exe
  2⤵
  PID:9156
- C:\Windows\System\VVouZqk.exe
  C:\Windows\System\VVouZqk.exe
  2⤵
  PID:8564
- C:\Windows\System\UgzOWhq.exe
  C:\Windows\System\UgzOWhq.exe
  2⤵
  PID:8472
- C:\Windows\System\mPseGnU.exe
  C:\Windows\System\mPseGnU.exe
  2⤵
  PID:8804
- C:\Windows\System\BcLRWqN.exe
  C:\Windows\System\BcLRWqN.exe
  2⤵
  PID:8648
- C:\Windows\System\wURkZsL.exe
  C:\Windows\System\wURkZsL.exe
  2⤵
  PID:8868
- C:\Windows\System\VmBhDyg.exe
  C:\Windows\System\VmBhDyg.exe
  2⤵
  PID:8704
- C:\Windows\System\PcZlKLG.exe
  C:\Windows\System\PcZlKLG.exe
  2⤵
  PID:8900
- C:\Windows\System\APSXSrB.exe
  C:\Windows\System\APSXSrB.exe
  2⤵
  PID:9116
- C:\Windows\System\YRHCYrR.exe
  C:\Windows\System\YRHCYrR.exe
  2⤵
  PID:9176
- C:\Windows\System\fMFjVyt.exe
  C:\Windows\System\fMFjVyt.exe
  2⤵
  PID:9188
- C:\Windows\System\jIvkBlt.exe
  C:\Windows\System\jIvkBlt.exe
  2⤵
  PID:9196
- C:\Windows\System\WnMqPgV.exe
  C:\Windows\System\WnMqPgV.exe
  2⤵
  PID:8264
- C:\Windows\System\bvSNgBs.exe
  C:\Windows\System\bvSNgBs.exe
  2⤵
  PID:8328
- C:\Windows\System\UsZioFT.exe
  C:\Windows\System\UsZioFT.exe
  2⤵
  PID:8292
- C:\Windows\System\ruNziiv.exe
  C:\Windows\System\ruNziiv.exe
  2⤵
  PID:8340
- C:\Windows\System\iaZiBbC.exe
  C:\Windows\System\iaZiBbC.exe
  2⤵
  PID:8308
- C:\Windows\System\zEfsKvj.exe
  C:\Windows\System\zEfsKvj.exe
  2⤵
  PID:8484
- C:\Windows\System\jgpdZtG.exe
  C:\Windows\System\jgpdZtG.exe
  2⤵
  PID:8584
- C:\Windows\System\amceDuA.exe
  C:\Windows\System\amceDuA.exe
  2⤵
  PID:8848
- C:\Windows\System\puNZgxb.exe
  C:\Windows\System\puNZgxb.exe
  2⤵
  PID:8732
- C:\Windows\System\ZeriIcX.exe
  C:\Windows\System\ZeriIcX.exe
  2⤵
  PID:8912
- C:\Windows\System\diwSxnh.exe
  C:\Windows\System\diwSxnh.exe
  2⤵
  PID:8612
- C:\Windows\System\eclKlll.exe
  C:\Windows\System\eclKlll.exe
  2⤵
  PID:8888
- C:\Windows\System\eAEqNoY.exe
  C:\Windows\System\eAEqNoY.exe
  2⤵
  PID:8940
- C:\Windows\System\VGhwjNj.exe
  C:\Windows\System\VGhwjNj.exe
  2⤵
  PID:9000
- C:\Windows\System\KyDsOib.exe
  C:\Windows\System\KyDsOib.exe
  2⤵
  PID:9096
- C:\Windows\System\zotZSnV.exe
  C:\Windows\System\zotZSnV.exe
  2⤵
  PID:9076
- C:\Windows\System\RgmZmTK.exe
  C:\Windows\System\RgmZmTK.exe
  2⤵
  PID:9056
- C:\Windows\System\DlklQwP.exe
  C:\Windows\System\DlklQwP.exe
  2⤵
  PID:9136
- C:\Windows\System\nSrRMub.exe
  C:\Windows\System\nSrRMub.exe
  2⤵
  PID:9168
- C:\Windows\System\mHVOHuX.exe
  C:\Windows\System\mHVOHuX.exe
  2⤵
  PID:9232
- C:\Windows\System\UAgoBir.exe
  C:\Windows\System\UAgoBir.exe
  2⤵
  PID:9248
- C:\Windows\System\FmGYEFV.exe
  C:\Windows\System\FmGYEFV.exe
  2⤵
  PID:9268
- C:\Windows\System\PfNflJf.exe
  C:\Windows\System\PfNflJf.exe
  2⤵
  PID:9284
- C:\Windows\System\DhBfQdz.exe
  C:\Windows\System\DhBfQdz.exe
  2⤵
  PID:9304
- C:\Windows\System\qEdWNOa.exe
  C:\Windows\System\qEdWNOa.exe
  2⤵
  PID:9320
- C:\Windows\System\nDOgLug.exe
  C:\Windows\System\nDOgLug.exe
  2⤵
  PID:9336
- C:\Windows\System\gqIaZoo.exe
  C:\Windows\System\gqIaZoo.exe
  2⤵
  PID:9360
- C:\Windows\System\ouOCWpA.exe
  C:\Windows\System\ouOCWpA.exe
  2⤵
  PID:9376
- C:\Windows\System\emdPFSc.exe
  C:\Windows\System\emdPFSc.exe
  2⤵
  PID:9396
- C:\Windows\System\Tojcimt.exe
  C:\Windows\System\Tojcimt.exe
  2⤵
  PID:9412
- C:\Windows\System\ykZcpUY.exe
  C:\Windows\System\ykZcpUY.exe
  2⤵
  PID:9560
- C:\Windows\System\KOGubNl.exe
  C:\Windows\System\KOGubNl.exe
  2⤵
  PID:9580
- C:\Windows\System\NDoMsSN.exe
  C:\Windows\System\NDoMsSN.exe
  2⤵
  PID:9596
- C:\Windows\System\CUCCwHD.exe
  C:\Windows\System\CUCCwHD.exe
  2⤵
  PID:9612
- C:\Windows\System\mJRuoZU.exe
  C:\Windows\System\mJRuoZU.exe
  2⤵
  PID:9628
- C:\Windows\System\SrcTrys.exe
  C:\Windows\System\SrcTrys.exe
  2⤵
  PID:9644
- C:\Windows\System\Hjcvidb.exe
  C:\Windows\System\Hjcvidb.exe
  2⤵
  PID:9660
- C:\Windows\System\YRcqixq.exe
  C:\Windows\System\YRcqixq.exe
  2⤵
  PID:9684
- C:\Windows\System\AElmGGK.exe
  C:\Windows\System\AElmGGK.exe
  2⤵
  PID:9720
- C:\Windows\System\xXQMjmJ.exe
  C:\Windows\System\xXQMjmJ.exe
  2⤵
  PID:9736
- C:\Windows\System\dkihTuh.exe
  C:\Windows\System\dkihTuh.exe
  2⤵
  PID:9752
- C:\Windows\System\RUIQvsZ.exe
  C:\Windows\System\RUIQvsZ.exe
  2⤵
  PID:9768
- C:\Windows\System\FiFqEBy.exe
  C:\Windows\System\FiFqEBy.exe
  2⤵
  PID:9784
- C:\Windows\System\mONjJxc.exe
  C:\Windows\System\mONjJxc.exe
  2⤵
  PID:9800
- C:\Windows\System\UylwdBH.exe
  C:\Windows\System\UylwdBH.exe
  2⤵
  PID:9820
- C:\Windows\System\YrMaKbZ.exe
  C:\Windows\System\YrMaKbZ.exe
  2⤵
  PID:9836
- C:\Windows\System\TiEFbrG.exe
  C:\Windows\System\TiEFbrG.exe
  2⤵
  PID:9852
- C:\Windows\System\Dbzmere.exe
  C:\Windows\System\Dbzmere.exe
  2⤵
  PID:9868
- C:\Windows\System\yKQahnS.exe
  C:\Windows\System\yKQahnS.exe
  2⤵
  PID:9884
- C:\Windows\System\ahmMVAu.exe
  C:\Windows\System\ahmMVAu.exe
  2⤵
  PID:9900
- C:\Windows\System\HmjwLqq.exe
  C:\Windows\System\HmjwLqq.exe
  2⤵
  PID:10160
- C:\Windows\System\xKwClUP.exe
  C:\Windows\System\xKwClUP.exe
  2⤵
  PID:10180
- C:\Windows\System\WWlabFx.exe
  C:\Windows\System\WWlabFx.exe
  2⤵
  PID:10196
- C:\Windows\System\qpoJtYn.exe
  C:\Windows\System\qpoJtYn.exe
  2⤵
  PID:10212
- C:\Windows\System\oIxKUnC.exe
  C:\Windows\System\oIxKUnC.exe
  2⤵
  PID:10228
- C:\Windows\System\CfbOZWE.exe
  C:\Windows\System\CfbOZWE.exe
  2⤵
  PID:8144
- C:\Windows\System\zZyFBMS.exe
  C:\Windows\System\zZyFBMS.exe
  2⤵
  PID:8668
- C:\Windows\System\ZVHZxZe.exe
  C:\Windows\System\ZVHZxZe.exe
  2⤵
  PID:8684
- C:\Windows\System\jhPsggu.exe
  C:\Windows\System\jhPsggu.exe
  2⤵
  PID:9052
- C:\Windows\System\zaMOEHf.exe
  C:\Windows\System\zaMOEHf.exe
  2⤵
  PID:9016
- C:\Windows\System\JARkCHo.exe
  C:\Windows\System\JARkCHo.exe
  2⤵
  PID:7912
- C:\Windows\System\fILbOHL.exe
  C:\Windows\System\fILbOHL.exe
  2⤵
  PID:9032
- C:\Windows\System\fPlKHbG.exe
  C:\Windows\System\fPlKHbG.exe
  2⤵
  PID:8988
- C:\Windows\System\fHdZEsD.exe
  C:\Windows\System\fHdZEsD.exe
  2⤵
  PID:7444
- C:\Windows\System\ZAQNCIG.exe
  C:\Windows\System\ZAQNCIG.exe
  2⤵
  PID:8800
- C:\Windows\System\rgWEiKy.exe
  C:\Windows\System\rgWEiKy.exe
  2⤵
  PID:9332
- C:\Windows\System\EMhXsCd.exe
  C:\Windows\System\EMhXsCd.exe
  2⤵
  PID:9372
- C:\Windows\System\YcbjZxE.exe
  C:\Windows\System\YcbjZxE.exe
  2⤵
  PID:9312
- C:\Windows\System\njxsyju.exe
  C:\Windows\System\njxsyju.exe
  2⤵
  PID:9436
- C:\Windows\System\mioDVqc.exe
  C:\Windows\System\mioDVqc.exe
  2⤵
  PID:9352
- C:\Windows\System\pytGBUg.exe
  C:\Windows\System\pytGBUg.exe
  2⤵
  PID:9392
- C:\Windows\System\wOHfvMu.exe
  C:\Windows\System\wOHfvMu.exe
  2⤵
  PID:9440
- C:\Windows\System\gxkxcjR.exe
  C:\Windows\System\gxkxcjR.exe
  2⤵
  PID:9552
- C:\Windows\System\Ifaltby.exe
  C:\Windows\System\Ifaltby.exe
  2⤵
  PID:9592
- C:\Windows\System\XEVmryL.exe
  C:\Windows\System\XEVmryL.exe
  2⤵
  PID:9668
- C:\Windows\System\SLYlwgx.exe
  C:\Windows\System\SLYlwgx.exe
  2⤵
  PID:9672
- C:\Windows\System\qONuMHJ.exe
  C:\Windows\System\qONuMHJ.exe
  2⤵
  PID:9936
- C:\Windows\System\vIyKZbz.exe
  C:\Windows\System\vIyKZbz.exe
  2⤵
  PID:10044
- C:\Windows\System\HrceejA.exe
  C:\Windows\System\HrceejA.exe
  2⤵
  PID:10092
- C:\Windows\System\XPHzmLv.exe
  C:\Windows\System\XPHzmLv.exe
  2⤵
  PID:9708
- C:\Windows\System\yjcMLNU.exe
  C:\Windows\System\yjcMLNU.exe
  2⤵
  PID:9696
- C:\Windows\System\wLGHdUM.exe
  C:\Windows\System\wLGHdUM.exe
  2⤵
  PID:9924
- C:\Windows\System\ePZGgwg.exe
  C:\Windows\System\ePZGgwg.exe
  2⤵
  PID:9948
- C:\Windows\System\KksTNvL.exe
  C:\Windows\System\KksTNvL.exe
  2⤵
  PID:9968
- C:\Windows\System\kHCepWi.exe
  C:\Windows\System\kHCepWi.exe
  2⤵
  PID:10024
- C:\Windows\System\kViCsju.exe
  C:\Windows\System\kViCsju.exe
  2⤵
  PID:10048
- C:\Windows\System\dlQGiHV.exe
  C:\Windows\System\dlQGiHV.exe
  2⤵
  PID:10072
- C:\Windows\System\wefkgvr.exe
  C:\Windows\System\wefkgvr.exe
  2⤵
  PID:10096
- C:\Windows\System\oOmPIxK.exe
  C:\Windows\System\oOmPIxK.exe
  2⤵
  PID:10120
- C:\Windows\System\cRgTMCD.exe
  C:\Windows\System\cRgTMCD.exe
  2⤵
  PID:10140
- C:\Windows\System\goHtKOE.exe
  C:\Windows\System\goHtKOE.exe
  2⤵
  PID:9760
- C:\Windows\System\rPmuUlm.exe
  C:\Windows\System\rPmuUlm.exe
  2⤵
  PID:9880
- C:\Windows\System\ySGzxaA.exe
  C:\Windows\System\ySGzxaA.exe
  2⤵
  PID:10172
- C:\Windows\System\dLICVMW.exe
  C:\Windows\System\dLICVMW.exe
  2⤵
  PID:9208
- C:\Windows\System\mADAAaM.exe
  C:\Windows\System\mADAAaM.exe
  2⤵
  PID:9100
- C:\Windows\System\xtODKkh.exe
  C:\Windows\System\xtODKkh.exe
  2⤵
  PID:8768
- C:\Windows\System\xOVCaOL.exe
  C:\Windows\System\xOVCaOL.exe
  2⤵
  PID:9776
- C:\Windows\System\AlTkiAP.exe
  C:\Windows\System\AlTkiAP.exe
  2⤵
  PID:8456
- C:\Windows\System\TWARdBi.exe
  C:\Windows\System\TWARdBi.exe
  2⤵
  PID:8060
- C:\Windows\System\WdwQDzY.exe
  C:\Windows\System\WdwQDzY.exe
  2⤵
  PID:9744
- C:\Windows\System\FpvQIbD.exe
  C:\Windows\System\FpvQIbD.exe
  2⤵
  PID:9260
- C:\Windows\System\EfahgIl.exe
  C:\Windows\System\EfahgIl.exe
  2⤵
  PID:10220
- C:\Windows\System\MhVtKRi.exe
  C:\Windows\System\MhVtKRi.exe
  2⤵
  PID:8500
- C:\Windows\System\jwzUVyj.exe
  C:\Windows\System\jwzUVyj.exe
  2⤵
  PID:9276
- C:\Windows\System\kTnFjVO.exe
  C:\Windows\System\kTnFjVO.exe
  2⤵
  PID:9296
- C:\Windows\System\kLuxuCt.exe
  C:\Windows\System\kLuxuCt.exe
  2⤵
  PID:9224
- C:\Windows\System\mfoWZoq.exe
  C:\Windows\System\mfoWZoq.exe
  2⤵
  PID:9520
- C:\Windows\System\RTQBHIO.exe
  C:\Windows\System\RTQBHIO.exe
  2⤵
  PID:9540
- C:\Windows\System\HbccLhR.exe
  C:\Windows\System\HbccLhR.exe
  2⤵
  PID:9508
- C:\Windows\System\NqAhZap.exe
  C:\Windows\System\NqAhZap.exe
  2⤵
  PID:9620
- C:\Windows\System\wrTFsRX.exe
  C:\Windows\System\wrTFsRX.exe
  2⤵
  PID:10032
- C:\Windows\System\GxCsynn.exe
  C:\Windows\System\GxCsynn.exe
  2⤵
  PID:9928
- C:\Windows\System\kweYlkC.exe
  C:\Windows\System\kweYlkC.exe
  2⤵
  PID:9692
- C:\Windows\System\SXJeeNd.exe
  C:\Windows\System\SXJeeNd.exe
  2⤵
  PID:10080
- C:\Windows\System\MRZvIWg.exe
  C:\Windows\System\MRZvIWg.exe
  2⤵
  PID:10036
- C:\Windows\System\kkmMsCm.exe
  C:\Windows\System\kkmMsCm.exe
  2⤵
  PID:9640
- C:\Windows\System\PzyOZAg.exe
  C:\Windows\System\PzyOZAg.exe
  2⤵
  PID:9988
- C:\Windows\System\mzBOvFK.exe
  C:\Windows\System\mzBOvFK.exe
  2⤵
  PID:10000
- C:\Windows\System\gVNUkQm.exe
  C:\Windows\System\gVNUkQm.exe
  2⤵
  PID:10208
- C:\Windows\System\siwizul.exe
  C:\Windows\System\siwizul.exe
  2⤵
  PID:8964
- C:\Windows\System\JvVXgFy.exe
  C:\Windows\System\JvVXgFy.exe
  2⤵
  PID:10012
- C:\Windows\System\odAJgzE.exe
  C:\Windows\System\odAJgzE.exe
  2⤵
  PID:8276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTYNHXW.exe

Filesize
1.9MB

MD5
814943801790765e6d65ae35c09434b0

SHA1
4129756f63495155858aa2779c303c9eabca10a5

SHA256
0b2ffc0303d8fbcc6fc59c7a90132333750eed839296d8a23c0c98897ca464ec

SHA512
250be7f599894165fc842f061cdd68f987e7af8d41342af1f06a9f06bd8ef83a9fbf7634da7bb02e700eb494e13050d64f1f37df91926f3a7d3a2e538e291fe3

Download Submit
C:\Windows\system\BXvsrcE.exe

Filesize
1.9MB

MD5
08e54956bfecc269d6199ffc32bbd8c2

SHA1
1beffb64119a93f5d1c2ca21c9c9136d4619f6a5

SHA256
caad9bbb54a407ae05cb4d8eab344fca092e66be2cf40c82bbc40752d550abb8

SHA512
26166c3caa1a6feead7df7e7ac5007701a70ba96705f2988846f28db9c49f6476565367721016f0a0b9de26adbdcd14dcf08fe3084e268e5697bd236dc8c0dd1

Download Submit
C:\Windows\system\EAtMkhk.exe

Filesize
1.9MB

MD5
6cdad98e734bd9c2de8f25d79b9723ff

SHA1
65e382baf7aa2c62fa61b0b1bef534bfbada754d

SHA256
7584c91fdb915e1dc713ca10d1eaf3a8199baedf594e9c0cb9c1c57a5ed10152

SHA512
a5ce06bb6b1b7ba753f4c5378fd9b06ef27d70166020bf14c59bb0a386c09e411576f5beae75649e31ccdd73f5350f48db7212d01fddc1185208ff409177f465

Download Submit
C:\Windows\system\FgLYzyF.exe

Filesize
1.9MB

MD5
50ebc191ac3eba80cd522eea8005d31f

SHA1
a912bbb45a6f4453c844def338d53116fd812fc1

SHA256
3a2379548a57809419f3ea559cefde7fa46d91dfd16f494d4ee369616a9f5c56

SHA512
4a5c4255b467f33aef863ea334b627adcf2705bff324517ec7408764bcdf136b413beca7a4912d703cfcbd2e4cf6c16bf855a8f50d4098361479097057e0216d

Download Submit
C:\Windows\system\HbjgbAN.exe

Filesize
1.9MB

MD5
534a1a4af6bb65e956ea686e5f3972a8

SHA1
2576b358480621a3d42dbd11d459e3a7bbcc88d1

SHA256
e042da645f4183fb4521717ff45ea8164ed1a18ddc479431f970463c2c12321f

SHA512
91a6b04f059f9b2ba163e79bdc191b5070b4f095e4913cadc463e99da08ab608740a716ced4ce629106f486af38d5dca7b68d8b63beb057334b9a9c0e5905af1

Download Submit
C:\Windows\system\IACuVPl.exe

Filesize
1.9MB

MD5
25c7b3d35739555b63df941f5d98aa3b

SHA1
730e568cdb38a66ebcee5b9ea38ce7b2d2554109

SHA256
7c4c474a115f4bd0edd9674ce5a76bf2a31e18ea63b3ab1d85f96e58dd03d984

SHA512
a8b9f3fedcae4d58bd307c0663180a1320732eaf7b535bea5cf1d217c7749538d2b2f387057cf9abdaa7a208ce53f65cb57b152e7d30a511b347e4e292348aeb

Download Submit
C:\Windows\system\IXEUnRH.exe

Filesize
1.9MB

MD5
4bff0d4fa5dfc5fc0e1e448349085196

SHA1
1d43563bc8d4a30b04a9e3a840c3697b1a7f478c

SHA256
1e3d0cce25ec14687767eaf1c7026234b95013c6899d551387b3f8d358fab04a

SHA512
3b163e4ff6eddf3f6da8f19b4541b9fd5f19205b88f999f8d98b65082929910fc7ff898606258ffa9a55c71d8a7a84fccdb399693223625c0c6dc1c13cbdf26b

Download Submit
C:\Windows\system\JuehZCT.exe

Filesize
1.9MB

MD5
1e2e671efc346af506030989a16c2f49

SHA1
43fcdca980fa23c5fd0155322c9ec48ffb7b79de

SHA256
17b54c9c45fea46465a52b7aa01a7cfe542d1b3dd0c80acdede745b9ba4b45a1

SHA512
8c17041729335e1964bc05a887ac2aa80d55a2bb6d5fcd9bbe357fa2494620870642e3a2a001c57a3b1a36cc589079a8bdd579e5c712324af34545cf8a44cd44

Download Submit
C:\Windows\system\KTrHrey.exe

Filesize
1.9MB

MD5
a21f4caec689b7826d7c939fbf1fcc20

SHA1
1f2f29cf787adbde539d24827f95438ae727f124

SHA256
e8e17902e7cb5f8e68a2a0358967dc07863d3c37cb1834833494dc4858ce9cdb

SHA512
13eacf32e007503ac7cb28e4c2100d1cb6988c28ee7d7be6cdad3811b4d44eba02f8108983c8dd59e8e42879cac9bf2f425b7dcd56d8f48b64b3160dc6068afc

Download Submit
C:\Windows\system\KceSmqD.exe

Filesize
1.9MB

MD5
b97e991f9e2bf6778d0d5dec451e964e

SHA1
16db1880488d940293610c0be3031344b2665ca7

SHA256
3142cf6f9183b19bf9f64a0769f260994b389b5e6df3275c7551f29e82a5bf29

SHA512
d0b145e74f9b89b15b469cc07990dd2f4dff1336b7fb1d455534f35634c264f10281d614e0d2de804d3aa086f62e8067d8d8b3be1ffe2d9906907a4e8ec2c6c4

Download Submit
C:\Windows\system\KyzEWJR.exe

Filesize
1.9MB

MD5
34c063eef8b5d3bdf5968845c674cf94

SHA1
2fc6a2539bbc51d1a68433fb66f93e49ade08fd9

SHA256
6e1caabe6a8da3077804889292f3ec8c29dc2f5fa2a103c6fb04940ac0a0d4b6

SHA512
73a7d95c0b1466fb9f6fa03511fd9d49f99bb678d7ec6b6b2048a47c60646db008b28b355280f913c5a3aced1fa4979a5d3318b432792a99d159661ebdd75dab

Download Submit
C:\Windows\system\PZPQKya.exe

Filesize
1.9MB

MD5
5145e1e2db4f713751ef7c3352985a15

SHA1
26de0ce037930d32863ead38444e819ff085dbad

SHA256
ae0eaa425e4a90ac0ebef553ae613f907dc9be42aff7d1f0c09e11795932a6d2

SHA512
61342ff73d218123f5cd0cf59c567469b5fde7955c1386aefea801fee59155a43faa141fea5b8c85765b16801e176e0ed942f8f4afccd9aa379f2488122d998c

Download Submit
C:\Windows\system\PaEuxEw.exe

Filesize
1.9MB

MD5
0955fe19357094c93b462b5d184ccb8d

SHA1
dd9b93c957f7e771cecb17d09285970728f25330

SHA256
961ee4180c2d150cf5d882c22f0adcacf1b8a5c412ff2a1b59782ec5225d4109

SHA512
149d17da1438222e4d20d2b6a6801dd96b3f3d028059f4a985e31fb0360674a5fdcca91d24bcf1d8f724e3b7a21ed565882786b6c2686f06ca1d7e381fbf7606

Download Submit
C:\Windows\system\PceRDWx.exe

Filesize
1.9MB

MD5
6a369184132c1586c2eb61bc54ed840f

SHA1
822fa0f80f234b42b6df1a3c3f8b55b068809ed4

SHA256
f9d9de77a40a6039672782d17c25a2149b2dae8dc29cc8608fd7216cc35aaf7b

SHA512
dea706dd77f42685ec8d7279ee6d855f21da7a853c32a3a0be18b7bba21048175847b755ad648dab3b651fd58d412a3c61e455385ebfa9b4abb56ec1dc8afdb7

Download Submit
C:\Windows\system\SPGBBVs.exe

Filesize
1.9MB

MD5
8805e3c3973b1a8b9eb27fe1e9688bd2

SHA1
fbfdfa225a3e6e6cf564796679e1b46228c2216d

SHA256
44d27312dc62a79e31bab3f0e5f62e1fc831f0d590b7346bb96fdfed5d9a65b5

SHA512
1ba457cc50a3838d93c6cc5172ac1f2b2159e8472130549ec6c96249c148907135a8ab2951d7a8428041e150dbf55234a85862d53ddb9d0760740626b74540b5

Download Submit
C:\Windows\system\SpdynqW.exe

Filesize
1.9MB

MD5
2f6808284d8daeda0a133872cc1924c5

SHA1
618ef1f1cdf6c0b5dab49dd5163730320de237a2

SHA256
f35ad8e38eb93a67920ac378ccc954bcd1dd713fe83c5c41ab5ba9ff1236f4b0

SHA512
9ed2920dabead48e41977fae44318950e7de792dec7682f388644b3c67c7cb839197f3c795aed671e8e70766e0ae2874d4967eeba327d0cf7261f3f0eab65bc2

Download Submit
C:\Windows\system\TbMaXwG.exe

Filesize
1.9MB

MD5
f5bbf3a514f35dbb4c93e7f38fd39a84

SHA1
b4953557601cc60fd143039ee6b6045595dd7d1b

SHA256
4b79b72d8820b791999ad4f43cfdfc1cf37404b3ce4b7a921fcd1355607f9eb0

SHA512
da20c91071339f204ec28ee72912f4a099168e88a1557a4eace612b0be109acebd802f6004bc426c4e2b22f951384a7f581d870c666cd1570c38441040d72aaf

Download Submit
C:\Windows\system\YbjsnJx.exe

Filesize
1.9MB

MD5
5e190a3a1c69ac6b35012b9b02f25558

SHA1
ce4b54ba9ba1b3ac16b49d842e26789f90e72d32

SHA256
776d61c90656a10962a717e81ba129165a04cf1f59bcc0ba26f1a682088dcbdf

SHA512
8a28166d945ba1d25c8f3b652f131c978578a4529741a68713fecf466dfec6dab09ea0d9570c0805eee363f35714fe7d0f5a4eba304cedbd30766c0494197376

Download Submit
C:\Windows\system\aNBvyzx.exe

Filesize
1.9MB

MD5
1b904525de48f0a2fc898578127c97ef

SHA1
56036e5a682d2ff0c0ef691e90b2261489a0ba13

SHA256
bbb003fc1d75c690de3faa7f775a06c7475c30d9c9c998f017525de000b488d5

SHA512
a9fdbf6357d33720749b68a0628c93f5bef971c4f2c517b2eb5ce9dd77034e294bce6c4c0a64fc0aa18212a79b51a50466f7c228c7066f2199a5d72235e6c181

Download Submit
C:\Windows\system\bIptwkm.exe

Filesize
1.9MB

MD5
f186a9d1dc3ce8c7627df92d0341c892

SHA1
58123830d3c0945bf423c8aff47b80235a206862

SHA256
fabe06855acb0681b006b67750ee018499c0d9cb3b7197beaf87f556b1c8a3a9

SHA512
5153f6c4ff7c7db535fe242d1608574b20e788afb10ef14877f5c8018a5c868ef5160e95157358138c47c08d2ca9269c644ca7817afde904719f07ae7ae1e52f

Download Submit
C:\Windows\system\eTvGSmk.exe

Filesize
1.9MB

MD5
e97e96e57b13faf57abaedd53f9384de

SHA1
62f6e5906a959613d97605da67f0c5751d8243fa

SHA256
c593a2843b9d078b30ba47f46114ed237157c9f4262bb864badf3695e2d1e4bb

SHA512
d4806d1b3e862c8a56aab27916d55d9bd416cf6ea87b10d084ac43376ea491cd921ba39166c2da4d45fc0f30cb50c1f5ba4f4db1acb2f21f69136fb28a27071a

Download Submit
C:\Windows\system\hLNvkQJ.exe

Filesize
1.9MB

MD5
016ce04625b90104561795ebc7cf744e

SHA1
07a427dc38d68a6169e432a3af169e33112b96c3

SHA256
d5a7e55e8b4e47771943ee319d80012243b28006af1bd0445a22a4acc0b35221

SHA512
2c44de0e51abe281a631f2898266aff0a8a54c82ae3ed01ca5687bf50d4597d26d752f211cdbf8020afb6ee8f6e3c7693e43df1b4da48b903d5eb315391342f9

Download Submit
C:\Windows\system\hNfcYMI.exe

Filesize
1.9MB

MD5
28ceadcdb360f5c3df3cf57f3379599d

SHA1
4f872713a46dcbfdd5c92a3390fc5992eab2d5e5

SHA256
ab2c60b28b87c1042d58e8f5862f34867adb2eac4e6ffcb036345d76fe703189

SHA512
1d8311fb00880542f7754e890ea3a6bfb07208120be90e61223b4c62b7990a4d93d8c2feb8cdf62db9b9c24d4aa9110bd4daabe7e6ef064735198a6592bd160f

Download Submit
C:\Windows\system\mlIFdhi.exe

Filesize
1.9MB

MD5
af57f914469668473fe6791a3c42aa9a

SHA1
1b0d0da3e112d3b88612739604ee0941bb34b161

SHA256
553e3e2f11cdf8d17f9d1b1dc78c3956078751770c52e475d522eb8dde0b56e0

SHA512
97654d537928f78adea7c79e59c513e8f03c6ae2ad02a759ee9900dd0de3e279721c8794e741369dd67eb4943e1041593de0d0ac719914ffd26295bcf65d236d

Download Submit
C:\Windows\system\rKjeSgo.exe

Filesize
1.9MB

MD5
fdfee440408d2da8f95a0f5f0d5d61fc

SHA1
9e7cab9649ef95d5d13588e37e41a850e38e8995

SHA256
59b65baf7f2ff458612a9b377e6a0c2038eff54cff6a400c1598a8586664bfbd

SHA512
352eddc71e22ad8a2feb08bbc9dda9734c3cbd6e9fe57e029fc66b2f29f652bd68f013d618802ee42035d4ad0f9dc05582c513239d2a98fe626f87ca60ae7721

Download Submit
C:\Windows\system\rxpFUaV.exe

Filesize
1.9MB

MD5
c249d661a71e7a83e6d67f2623a8a94e

SHA1
3686b15f11aa4b21d84ea8a5ffcc14749735c783

SHA256
011c797938f030bd14668c72869df356c7af6e4fcc30e57ae1193766470976e7

SHA512
48218d7379e7961f070097a46186d4b9ecd5f7a3b7a6ff9cec10d551c86ae9abffdd78699ca40a5b448d99023147700ea231070f6874c92412d3155fd882c9f2

Download Submit
C:\Windows\system\wpkOBMl.exe

Filesize
1.9MB

MD5
3ca9555ef1b94516ab0d223e37a0d8c1

SHA1
c371b294051e3eb171426faa60a84710c725b3d2

SHA256
b4c2d7df22dd9669e7127176a5a45d5117632cbe349b8488417ad7460b30ecb1

SHA512
7d42bd16c4e41c60768fe3f4902f82473a79a14bbabf93277a010a717b8ade79509f049b8db8033a4b5c49006a7a36139be0a2c97b7d2d230cf23b8e93e63c67

Download Submit
C:\Windows\system\yGxKEBQ.exe

Filesize
1.9MB

MD5
d56184395f7df225f223998674c665af

SHA1
2a28d0a18e42aebb0e45ffece9551f37e217cec8

SHA256
dd95b1257b1ff1fc9d44f3450d24e737b971cfd0deb8887c79954ec81e5660e2

SHA512
d33ba33b3f5ef705bd0fe4a7697cd5a2905b1e070ac367cb0d35bfd74313ff76456477b62794422f9946cb665fd57068b9090adc84fee8c0597b14e2e39f27fc

Download Submit
C:\Windows\system\yRQhksV.exe

Filesize
1.9MB

MD5
833433b73f99ff9e7ccf9f288eb26983

SHA1
d17c3a78cf067e59b4ae6fa19452511c3185529e

SHA256
10a7e6e2d258ce646b192bfebab6507c82725dcfdccfd7d7df0b64da518a5726

SHA512
5a3dd4d5d560813546596ab46c718cf517d4d2d6f38b40cc7c68c27903136f337458a7b77df3dab1a1a164364b0d6336f43f10d61ec09be11c7ea1a6d6207a0c

Download Submit
\Windows\system\drLNxTt.exe

Filesize
1.9MB

MD5
3c72562e7c8113c864dd223e8095aaca

SHA1
da2d2e7398352ddcad8cd34eccf74c64271c87c4

SHA256
fabeac276b76bf447622516d9509135806bc2c82e8a6ef94994f1075d836ab71

SHA512
077371551cf86ca0bfc242881aebc330bb0abed69f6881d1ff0637386f1c5b957b0d1c1d3dfa072a14a8621505f4868bfd7b67863b17d63c687030cbadb93503

Download Submit
\Windows\system\nJozDLQ.exe

Filesize
1.9MB

MD5
cf47cafc19fd9486317f33ffb964ed48

SHA1
ff84a371929cfef93c23d28b46bffee1d4e6a590

SHA256
82f0f05b24b8730196e568c7f41c83dfadd2c97619587ebadd92cb9c91213ce3

SHA512
59fb523a20e3c003d1ac7a659d38beada20edb626e5507bef6acac480da4f695a0805eb98fdfadac3219a5350ecf8b9d11c43b5af43c479086391c3c94142bf1

Download Submit
\Windows\system\qycuSiB.exe

Filesize
1.9MB

MD5
a399ff019f0a4df6d36d390a45528b3d

SHA1
0ca35ca3247a59657dadf0a222dff1d54203fe39

SHA256
8bbeb297bfe36ab236846283d2d2055d8d778df0d73646cfbdfcc766410d683c

SHA512
c267ce6e8d85a4ae16d3b34b32561fa639196d2ad10f6248e22c0dddec5ca9cde15d3a2581fc7fd5e6e34c008d3920dfd6822c1ca6ceddfb2882c217660ea528

Download Submit
memory/2116-20-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-13-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2136-109-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-67-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-56-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2536-42-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-1730-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-421-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-31-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-54-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2872-63-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2872-1348-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2872-33-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-39-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2872-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2872-47-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2872-88-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-7-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2872-96-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2872-76-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2872-0-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2872-71-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2872-19-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-49-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2972-2084-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/3032-30-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3032-29-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3032-32-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3032-34-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3032-28-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/3032-27-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3032-26-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/3032-25-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/3032-62-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download